k3t/nixconf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

*actually* upload nixcloud configs

Browse Source
This commit is contained in:
k3t
2026-03-12 05:15:14 -06:00
parent 18261a9969
commit e8b59f873b
12 changed files with 471 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/nixcloud/configuration.nix
+73
View File
@@ -0,0 +1,73 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page, on
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
{ config, lib, pkgs, inputs, ... }:
{
imports =
(lib.filesystem.listFilesRecursive ./services.d)
++ [ # Include the results of the hardware scan.
./hardware-configuration.nix
];
networking.hostName = "nixcloud"; # Define your hostname.
# Define a user account. Don't forget to set a password with ‘passwd’.
users.users = {
steward = {
isNormalUser = true;
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
packages = with pkgs; [
btop htop
nano
];
};
kuro = {
isNormalUser = true;
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
packages = with pkgs; [
btop htop
nano
];
};
};
# List packages installed in system profile.
# You can use https://search.nixos.org/ to find more packages (and options).
#environment.systemPackages = with pkgs; [
# wget
#];
# Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 80 443 25565 4433 9971 ];
networking.firewall.allowedUDPPorts = [ 24454 4433 9971 ];
# Copy the NixOS configuration file and link it from the resulting system
# (/run/current-system/configuration.nix). This is useful in case you
# accidentally delete configuration.nix.
# system.copySystemConfiguration = true;
# This option defines the first version of NixOS you have installed on this particular machine,
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
#
# Most users should NEVER change this value after the initial install, for any reason,
# even if you've upgraded your system to a new NixOS release.
#
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
# to actually do that.
#
# This value being lower than the current NixOS release does NOT mean your system is
# out of date, out of support, or vulnerable.
#
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
# and migrated your data accordingly.
#
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
system.stateVersion = "25.05"; # Did you read the comment?
}
hosts/nixcloud/frontendfriendly.d/README.md
+1
View File
@@ -0,0 +1 @@
this was the old configs for FrontendFriendly, a project of Team SDS, which i have since left.
hosts/nixcloud/frontendfriendly.d/anonoverflow.nix
+127
View File
@@ -0,0 +1,127 @@
{ config, pkgs, lib, ... }:
let
domain = "frontendfriendly.xyz";
host = "stackoverflow.${domain}";
upstreamPort = 7101;
# 1) Fetch source from GitHub
anonymousOverflowSrc = pkgs.fetchFromGitHub {
owner = "httpjamesm";
repo = "AnonymousOverflow";
rev = "v1.13.0"; # pin a release tag
# TODO: replace with real hash after first build
sha256 = "sha256-hvcOJctvNswEws+cCoeGQSvFzZvnThhKk3fJ7TnNulY=";
};
# 2) Build the Go binary
anonymousOverflowPkg = pkgs.buildGoModule {
pname = "anonymousoverflow";
version = "1.13.0";
src = anonymousOverflowSrc;
# code is at repo root
subPackages = [ "." ];
# TODO: replace with real vendor hash after first build
vendorHash = "sha256-P3kUGFJhj/pTNeVTwtg4IqhoHBH9rROfkr+ZsrUtmdo=";
};
in
{
containers.anonymousoverflow = {
autoStart = true;
# Simple veth connection between host and container
privateNetwork = true;
hostAddress = "10.250.0.1";
localAddress = "10.250.0.2";
# Rootfs is generated from this NixOS config:
config = { config, pkgs, ... }:
let
# 1) Fetch AnonymousOverflow source
anonymousOverflowSrc = pkgs.fetchFromGitHub {
owner = "httpjamesm";
repo = "AnonymousOverflow";
# Pin some tag or commit
rev = "v1.13.0";
# TODO: replace with real hash after first build
sha256 = "sha256-hvcOJctvNswEws+cCoeGQSvFzZvnThhKk3fJ7TnNulY=";
};
# 2) Build the Go binary
anonymousOverflowPkg = pkgs.buildGoModule {
pname = "anonymousoverflow";
version = "1.13.0";
src = anonymousOverflowSrc;
# repo root
subPackages = [ "." ];
# TODO: replace with real vendor hash after first build
vendorHash = "sha256-P3kUGFJhj/pTNeVTwtg4IqhoHBH9rROfkr+ZsrUtmdo=";
};
in
{
# Set this to match your host’s stateVersion
system.stateVersion = "24.11";
# Optional but nice: container firewall allowing port 80
networking.firewall.allowedTCPPorts = [ 80 ];
systemd.services.anonymousoverflow = {
description = "AnonymousOverflow StackOverflow frontend (container)";
wantedBy = [ "multi-user.target" ];
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
serviceConfig = {
# Runs as root in container; that’s fine here, it needs port 80
ExecStart = "${anonymousOverflowPkg}/bin/anonymousoverflow";
Restart = "always";
RestartSec = 3;
};
};
# If AO needs env vars / config, set them here:
# systemd.services.anonymousoverflow.serviceConfig.Environment = [
# "PORT=80"
# "BIND_ADDR=0.0.0.0"
# ];
};
};
#################################
## Anubis in front of it ##
#################################
services.anubis.instances.anonymousoverflow = {
enable = true;
settings = {
# Must use this prefix form: /run/anubis/anubis-<name>/...
BIND = "/run/anubis/anubis-anonymousoverflow/anubis.sock";
METRICS_BIND = "/run/anubis/anubis-anonymousoverflow/metrics.sock";
# If you keep the default :8080:
# TARGET = "http://127.0.0.1:8080";
# If you configure the app to listen on 127.0.0.1:${upstreamPort}:
TARGET = "http://10.250.0.2:${toString upstreamPort}";
SERVE_ROBOTS_TXT = true;
};
};
#################################
## Caddy vhost ##
#################################
services.caddy.virtualHosts.${host}.extraConfig = ''
reverse_proxy unix//run/anubis/anubis-anonymousoverflow/anubis.sock
'';
}
hosts/nixcloud/frontendfriendly.d/dumb.nix
+29
View File
@@ -0,0 +1,29 @@
{ config, pkgs, lib, ... }:
let
domain = "frontendfriendly.xyz";
host = "dumb.${domain}";
upstreamPort = 5555;
in
{
virtualisation.oci-containers.containers.dumb = {
image = "ghcr.io/rramiachraf/dumb:latest";
autoStart = true;
ports = [ "127.0.0.1:${toString upstreamPort}:5555" ];
# environment = { ... } if Dumb needs configuration
};
services.anubis.instances.dumb = {
enable = true;
settings = {
BIND = "/run/anubis/anubis-dumb/anubis.sock";
METRICS_BIND = "/run/anubis/anubis-dumb/metrics.sock";
TARGET = "http://127.0.0.1:${toString upstreamPort}";
SERVE_ROBOTS_TXT = true;
};
};
services.caddy.virtualHosts.${host}.extraConfig = ''
reverse_proxy unix//run/anubis/anubis-dumb/anubis.sock
'';
}
hosts/nixcloud/frontendfriendly.d/global.nix
+30
View File
@@ -0,0 +1,30 @@
{ config, pkgs, lib, ... }:
{
users.users.caddy.extraGroups = [ config.users.groups.anubis.name ];
# hacky fix since ssl was broken
services.caddy.virtualHosts."frontendfriendly.xyz".extraConfig = ''
root /var/www/frontendfriendly.xyz
file_server
handle /webhook/828e8c10-af83-4a9b-a7ee-1b687ba12adc {
reverse_proxy https://n8n.teamsds.net {
transport http {
tls_insecure_skip_verify
}
header_up Host n8n.teamsds.net
}
}
handle /webhook-test/828e8c10-af83-4a9b-a7ee-1b687ba12adc {
reverse_proxy https://n8n.teamsds.net {
transport http {
tls_insecure_skip_verify
}
header_up Host n8n.teamsds.net
}
}
'';
}
hosts/nixcloud/frontendfriendly.d/redlib.nix
+29
View File
@@ -0,0 +1,29 @@
{ config, pkgs, lib, ... }:
let
domain = "frontendfriendly.xyz";
host = "redlib.${domain}";
upstreamPort = 7105;
in
{
services.redlib = {
enable = true;
address = "127.0.0.1";
port = upstreamPort;
# extraSettings = { ... }; # if you want instance-specific options
};
services.anubis.instances.redlib = {
enable = true;
settings = {
BIND = "/run/anubis/anubis-redlib/anubis.sock";
METRICS_BIND = "/run/anubis/anubis-redlib/metrics.sock";
TARGET = "http://127.0.0.1:${toString upstreamPort}";
SERVE_ROBOTS_TXT = true;
};
};
services.caddy.virtualHosts.${host}.extraConfig = ''
reverse_proxy unix//run/anubis/anubis-redlib/anubis.sock
'';
}
hosts/nixcloud/frontendfriendly.d/rimgo.nix
+31
View File
@@ -0,0 +1,31 @@
{ config, pkgs, lib, ... }:
let
domain = "frontendfriendly.xyz";
host = "rimgo.${domain}";
upstreamPort = 7104;
in
{
services.rimgo = {
enable = true;
# Rimgo uses a port in its settings; set it to local only
settings = {
ADDRESS = "127.0.0.1";
PORT = upstreamPort;
};
};
services.anubis.instances.rimgo = {
enable = true;
settings = {
BIND = "/run/anubis/anubis-rimgo/anubis.sock";
METRICS_BIND = "/run/anubis/anubis-rimgo/metrics.sock";
TARGET = "http://127.0.0.1:${toString upstreamPort}";
SERVE_ROBOTS_TXT = true;
};
};
services.caddy.virtualHosts.${host}.extraConfig = ''
reverse_proxy unix//run/anubis/anubis-rimgo/anubis.sock
'';
}
hosts/nixcloud/hardware-configuration.nix
+37
View File
@@ -0,0 +1,37 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/fa7b07d8-0648-4009-a26c-a3565ef06ba5";
fsType = "btrfs";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/ACF4-F854";
fsType = "vfat";
options = [ "fmask=0022" "dmask=0022" ];
};
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp7s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
}
hosts/nixcloud/services.d/caddy.nix
+14
View File
@@ -0,0 +1,14 @@
{ config, lib, pkgs, ... }:
{
services.caddy = {
enable = true;
virtualHosts."k3t.dev".extraConfig = ''
encode zstd gzip
root /var/www/k3t.dev/
file_server browse
'';
};
}
hosts/nixcloud/services.d/minecraft.nix
+41
View File
@@ -0,0 +1,41 @@
{ config, pkgs, ... }:
{
virtualisation.podman = {
enable = true;
autoPrune.enable = true;
dockerCompat = true; # optional; lets you use `docker` CLI
};
systemd.services.minecraft-container = {
description = "Minecraft Server Container (GraalVM JVM 21)";
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
serviceConfig = {
ExecStart = ''
${pkgs.podman}/bin/podman run \
--rm \
--name minecraft-server \
-v /var/lib/minecraft:/data \
-p 25565:25565 \
-p 24454:24454/udp \
ghcr.io/graalvm/graalvm-community:25 \
/data/run.sh
'';
ExecStop = "${pkgs.podman}/bin/podman stop minecraft-server";
Restart = "always";
RestartSec = "10s";
};
# Ensure the directory exists
preStart = ''
mkdir -p /var/lib/minecraft
'';
wantedBy = [ "multi-user.target" ];
};
# Give Podman permission to access persistent storage
systemd.tmpfiles.rules = [
"d /var/lib/minecraft 0755 root root"
];
}
hosts/nixcloud/services.d/vaultwarden.nix
+38
View File
@@ -0,0 +1,38 @@
{ config, lib, pkgs, ... }:
{
services.vaultwarden = {
enable = true;
backupDir = "/var/local/vaultwarden/backup";
# in order to avoid having ADMIN_TOKEN in the nix store it can be also set with the help of an environment file
# be aware that this file must be created by hand (or via secrets management like sops)
environmentFile = "/var/lib/vaultwarden/vaultwarden.env";
config = {
# Refer to https://github.com/dani-garcia/vaultwarden/blob/main/.env.template
DOMAIN = "https://bitwarden.k3t.dev";
SIGNUPS_ALLOWED = true;
ROCKET_ADDRESS = "127.0.0.1";
ROCKET_PORT = 8222;
ROCKET_LOG = "critical";
# This example assumes a mailserver running on localhost,
# thus without transport encryption.
# If you use an external mail server, follow:
# https://github.com/dani-garcia/vaultwarden/wiki/SMTP-configuration
#SMTP_HOST = "127.0.0.1";
#SMTP_PORT = 25;
#SMTP_SSL = false;
#SMTP_FROM = "admin@bitwarden.example.com";
#SMTP_FROM_NAME = "example.com Bitwarden server";
};
};
services.caddy.virtualHosts."bitwarden.k3t.dev".extraConfig = ''
encode zstd gzip
reverse_proxy :${toString config.services.vaultwarden.config.ROCKET_PORT} {
header_up X-Real-IP {remote_host}
}
'';
}
modules/vps-aarch64-common.nix
Executable
+21
View File
@@ -0,0 +1,21 @@
{ pkgs, ... }: {
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
boot.binfmt.emulatedSystems = ["x86_64-linux" "i386-linux"];
#environment.systemPackages = with pkgs; [
#];
services.fail2ban.enable = true;
services.openssh = {
enable = true;
settings.PasswordAuthentication = true;
};
system.autoUpgrade = {
operation = "boot";
allowReboot = true;
rebootWindow = { lower = "02:00"; upper = "05:00"; };
};
}