Fix everything.

system/accounts/default.nix

@@ -0,0 +1,6 @@
+{ ... }: {
+  imports = [
+    ./users
+    ./groups
+  ];
+}

system/accounts/groups/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  imports = [ ./nfsShare ];
+}

system/accounts/groups/nfsShare/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  users.groups.nfsShare.gid = 983;
+}

system/accounts/users/custom/default.nix

@@ -0,0 +1,9 @@
+{ home-manager, ... }:
+{
+  imports = [
+    ./jules
+    ./jimbo
+
+    home-manager.nixosModules.home-manager
+  ];
+}

system/accounts/users/custom/jimbo/default.nix

@@ -0,0 +1,27 @@
+{ config, lib, pkgs, ... }:
+{
+  users.users.jimbo = {
+    hashedPassword = config.secrets.mainAccPass;
+    isNormalUser = true;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC2lMkUd+BbXITE5LTg94hEzmA6UKsIIbaf5YOjGoLzl"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIFGHaxdTeC1xnTx2BY5LLR5LxhdSkmYoWuOeEuRIz0k"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahAoF74BY6GCTsFkt1ADKaraFgJJozW1Y1aBTLK0j9 Pixel9"
+    ];
+    extraGroups = [
+      "wheel"
+      "input"
+      "disk"
+      "dialout"
+      "kvm"
+      "libvirtd"
+      "qemu-libvirtd"
+      "nginx"
+      "nfsShare"
+    ];
+    uid = 1000;
+    shell = pkgs.zsh;
+  };
+
+  home-manager.users.jimbo = import ../../../../../home/jimbo;
+}

system/accounts/users/custom/jules/default.nix

@@ -0,0 +1,26 @@
+{ config, lib, pkgs, ... }:
+{
+  users.users.jules = {
+    hashedPassword = config.secrets.mainAccPass;
+    isNormalUser = true;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHwxJcAWuHkKy/Ar37aIoqg34CDcZu7/bh978nYkOgzj jules@jules-pc"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEOszCNP+6rkIS75GyFVhn9o6QpUuGdx/J4rjzROrpSl jules@xeta"
+    ];
+    extraGroups = [
+      "wheel"
+      "input"
+      "disk"
+      "dialout"
+      "kvm"
+      "libvirtd"
+      "qemu-libvirtd"
+      "nginx"
+      "nfsShare"
+    ];
+    uid = 1001;
+    shell = pkgs.fish;
+  };
+
+  #home-manager.users.jimbo = import ../../../../../home/jimbo;
+}

system/accounts/users/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ./custom
+    ./system
+  ];
+
+  users.mutableUsers = false;
+}

system/accounts/users/system/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ./jellyfin
+    ./liquidsoap
+    ./nextcloud
+    ./nginx
+  ];
+}

system/accounts/users/system/jellyfin/default.nix

@@ -0,0 +1,12 @@
+{ ... }:
+{
+  users = {
+    users.jellyfin = {
+      group = "jellyfin";
+      extraGroups = [ "nfsShare" ];
+      isSystemUser = true;
+      uid = 983;
+    };
+    groups.jellyfin = {};
+  };
+}

system/accounts/users/system/liquidsoap/default.nix

@@ -0,0 +1,12 @@
+{ ... }:
+{
+  users = {
+    users.liquidsoap = {
+      group = "liquidsoap";
+      extraGroups = [ "nginx" ];
+      isSystemUser = true;
+      uid = 155;
+    };
+    groups.liquidsoap = {};
+  };
+}

system/accounts/users/system/nextcloud/default.nix

@@ -0,0 +1,12 @@
+{ ... }:
+{
+  users = {
+    users.nextcloud = {
+      group = "nextcloud";
+      extraGroups = [ "nfsShare" ];
+      isSystemUser = true;
+      uid = 218;
+    };
+    groups.nextcloud = {};
+  };
+}

system/accounts/users/system/nginx/default.nix

@@ -0,0 +1,15 @@
+{ ... }:
+{
+  users = {
+    users.nginx = {
+      group = "nginx";
+      extraGroups = [
+        "turnserver"
+        "virtualMail"
+      ];
+      isSystemUser = true;
+      uid = 60;
+    };
+    groups.nginx = {};
+  };
+}

system/default.nix

@@ -0,0 +1,24 @@
+{ lib, ... }:
+{
+  imports = [
+    ./accounts
+    ./devices
+    ./programs
+    ./secrets
+    ./services
+    ./settings
+  ];
+
+  options.system = with lib; {
+    server.enable = mkEnableOption "Enable server apps and services";
+  };
+
+  config = {
+    networking = {
+      hostName = "rubble";
+      hostId = "e0b1fcef";
+    };
+
+    system.stateVersion = "24.11";
+  };
+}

system/devices/boot/default.nix

@@ -0,0 +1,12 @@
+{ ... }:
+{
+  imports = [
+    ./extlinux
+    ./services
+  ];
+
+  boot.kernel.sysctl = {
+    "vm.max_map_count" = 2147483642;
+    "kernel.sysrq" = 1;
+  };
+}

system/devices/boot/extlinux/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  boot.loader = {
+    grub.enable = false;
+    systemd-boot.enable = false;
+    generic-extlinux-compatible.enable = true;
+  };
+}

system/devices/boot/services/default.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  imports = [ ./root-reset ];
+
+  boot.initrd.systemd.enable = true;
+}

system/devices/boot/services/root-reset/default.nix

@@ -0,0 +1,31 @@
+{ config, ... }:
+{
+  boot.initrd.systemd.services.root-reset = {
+    enable = config.environment.persistence."/persist".enable;
+    description = "Create new and snapshot previous root";
+    wantedBy = [ "initrd.target" ];
+    before = [ "sysroot.mount" ];
+    after = [ "initrd-root-device.target" ];
+    unitConfig.DefaultDependencies = "no";
+    serviceConfig.Type = "oneshot";
+    script = ''
+      mkdir -p /mnt
+      mount -t btrfs /dev/${config.networking.hostName}/root /mnt
+
+      if [[ -e /mnt/prev ]]; then
+        btrfs subvolume delete /mnt/prev
+      fi
+
+      btrfs subvolume snapshot /mnt/root /mnt/prev
+
+      btrfs subvolume list -o /mnt/root | cut -f9 -d' ' | while read subvolume; do
+        btrfs subvolume delete "/mnt/$subvolume"
+      done
+
+      btrfs subvolume delete /mnt/root
+      btrfs subvolume create /mnt/root
+
+      umount /mnt
+    '';
+  };
+}

system/devices/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ./boot
+    ./disks
+    ./hardware
+    ./networking
+  ];
+}

system/devices/disks/default.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  imports = [
+    ./disko
+    ./filesystems
+    ./immutable
+    ./impermanence
+    ./snapper
+  ];
+}

system/devices/disks/disko/default.nix

@@ -0,0 +1,94 @@
+{ config, disko, ... }:
+{
+  imports = [ disko.nixosModules.disko ];
+
+  disko.devices = {
+    disk = {
+      "${config.networking.hostName}" = {
+        type = "disk";
+        device = "/dev/mmcblk1";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              priority = 1;
+              size = "2G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            luks = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "${config.networking.hostName}-disk";
+                settings.allowDiscards = true;
+                passwordFile = "/tmp/secret.key";
+                content = {
+                  type = "lvm_pv";
+                  vg = "${config.networking.hostName}";
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+
+    lvm_vg = {
+      "${config.networking.hostName}" = {
+        type = "lvm_vg";
+        lvs = {
+          root = {
+            size = "100%";
+            content = {
+              type = "btrfs";
+              extraArgs = [ "-f" ];
+              subvolumes = {
+                "/root" = {
+                  mountpoint = "/";
+                  mountOptions = [ "compress=zstd" "noatime" "ssd" ];
+                };
+                "/prev" = {
+                  mountpoint = "/prev";
+                  mountOptions = [ "compress=zstd" "noatime" "ssd" "noexec" ];
+                };
+                "/nix" = {
+                  mountpoint = "/nix";
+                  mountOptions = [ "compress=zstd" "noatime" "ssd" ];
+                };
+
+                # Impermanence
+                "/persist" = {
+                  mountpoint = "/persist";
+                  mountOptions = [ "compress=zstd" "noatime" "ssd" ];
+                };
+                "/persist/.snapshots" = { };
+
+                "/persist/home/jules" = { };
+                "/persist/home/jules/.snapshots" = { };
+
+                "/persist/home/jimbo" = { };
+                "/persist/home/jimbo/.snapshots" = { };
+              };
+            };
+          };
+          swap = {
+            size = "4G";
+            content = {
+              type = "swap";
+              discardPolicy = "both";
+            };
+          };
+        };
+      };
+    };
+  };
+
+  # Needed for impermanence
+  fileSystems."/persist".neededForBoot = true;
+}

system/devices/disks/filesystems/default.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+{
+  boot.supportedFilesystems = {
+    btrfs = true;
+    ntfs = true;
+    zfs = true;
+  };
+
+  services = {
+    btrfs.autoScrub.enable = true;
+    fstrim.enable = true;
+  };
+}

system/devices/disks/immutable/default.nix

@@ -0,0 +1,5 @@
+{ ... }:
+{
+  system.etc.overlay.mutable = false;
+  boot.tmp.cleanOnBoot = true;
+}

system/devices/disks/impermanence/default.nix

@@ -0,0 +1,10 @@
+{ impermanence, ... }:
+{
+  imports = [
+    ./jules
+    ./jimbo
+    ./root
+
+    impermanence.nixosModules.impermanence
+  ];
+}

system/devices/disks/impermanence/jimbo/default.nix

@@ -0,0 +1,26 @@
+{ config, ... }:
+{
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    users.jimbo = {
+      directories = [
+        "Keepers"
+        "Documents"
+        "Pictures"
+        "Videos"
+        "Games"
+        "VMs"
+
+        ".snapshots"
+        ".cache/nix-index"
+
+        { directory = ".ssh"; mode = "0700"; }
+        { directory = ".gnupg"; mode = "0700"; }
+      ];
+      files = [
+        ".zsh_history"
+        ".local/state/lazygit/state.yml"
+      ];
+    };
+  };
+}

system/devices/disks/impermanence/jules/default.nix

@@ -0,0 +1,26 @@
+{ config, ... }:
+{
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    users.jules = {
+      directories = [
+        "Keepers"
+        "Documents"
+        "Pictures"
+        "Videos"
+        "Games"
+        "VMs"
+
+        ".snapshots"
+        ".cache/nix-index"
+
+        { directory = ".ssh"; mode = "0700"; }
+        { directory = ".gnupg"; mode = "0700"; }
+      ];
+      files = [
+        ".zsh_history"
+        ".local/state/lazygit/state.yml"
+      ];
+    };
+  };
+}

system/devices/disks/impermanence/root/default.nix

@@ -0,0 +1,15 @@
+{ ... }:
+{
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/etc/nixos"
+      "/etc/secureboot"
+      "/var/lib/nixos"
+    ];
+    files = [
+      "/etc/machine-id"
+      "/root/.gitconfig"
+    ];
+  };
+}

system/devices/disks/snapper/default.nix

@@ -0,0 +1,13 @@
+{ ... }:
+{
+  imports = [
+    ./jules
+    ./jimbo
+    ./root
+  ];
+
+  services.snapper = {
+    snapshotInterval = "0/6:00:00";
+    persistentTimer = true;
+  };
+}

system/devices/disks/snapper/jimbo/default.nix

@@ -0,0 +1,12 @@
+{ config, lib, ... }:
+{
+  services.snapper.configs.jimbo = lib.mkIf config.environment.persistence."/persist".enable {
+    SUBVOLUME = "/persist/home/jimbo";
+    TIMELINE_CREATE = true;
+    TIMELINE_CLEANUP = true;
+    TIMELINE_LIMIT_DAILY = 1;
+    TIMELINE_LIMIT_WEEKLY = 1;
+    TIMELINE_LIMIT_MONTHLY = 0;
+    TIMELINE_LIMIT_YEARLY = 0;
+  };
+}

system/devices/disks/snapper/jules/default.nix

@@ -0,0 +1,12 @@
+{ config, lib, ... }:
+{
+  services.snapper.configs.jules = lib.mkIf config.environment.persistence."/persist".enable {
+    SUBVOLUME = "/persist/home/jules";
+    TIMELINE_CREATE = true;
+    TIMELINE_CLEANUP = true;
+    TIMELINE_LIMIT_DAILY = 1;
+    TIMELINE_LIMIT_WEEKLY = 1;
+    TIMELINE_LIMIT_MONTHLY = 0;
+    TIMELINE_LIMIT_YEARLY = 0;
+  };
+}

system/devices/disks/snapper/root/default.nix

@@ -0,0 +1,12 @@
+{ config, lib, ... }:
+{
+  services.snapper.configs.root = lib.mkIf config.environment.persistence."/persist".enable {
+    SUBVOLUME = "/persist";
+    TIMELINE_CREATE = true;
+    TIMELINE_CLEANUP = true;
+    TIMELINE_LIMIT_DAILY = 1;
+    TIMELINE_LIMIT_WEEKLY = 0;
+    TIMELINE_LIMIT_MONTHLY = 0;
+    TIMELINE_LIMIT_YEARLY = 0;
+  };
+}

system/devices/hardware/default.nix

@@ -0,0 +1,8 @@
+{ config, lib, modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.kernelModules = [ "ahci" "dm-snapshot" "mmc_core" "pcie_rockchip_host" "phy_rockchip_pcie" "rockchip_dfi" "rockchip_thermal" "rtc_rk808" "rockchip_saradc" "uas" "fusb302" ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+}

system/devices/networking/default.nix

@@ -0,0 +1,30 @@
+{ config, ... }:
+{
+  networking = {
+    wireless = {
+      enable = false;
+      iwd.enable = true;
+    };
+    dhcpcd.enable = true;
+    nftables.enable = true;
+    firewall.allowPing = false;
+    useNetworkd = true;
+    nameservers = [
+      "1.1.1.1#one.one.one.one"
+      "1.0.0.1#one.one.one.one"
+    ];
+  };
+
+  services.resolved = {
+    enable = true;
+    dnssec = "true";
+    domains = [ "~." ];
+    fallbackDns = config.networking.nameservers;
+    dnsovertls = "true";
+  };
+
+  environment = {
+    systemPackages = with pkgs; [ impala ];
+    persistence."/persist".directories = [ "/var/lib/iwd/" ];
+  };
+}

system/programs/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ./doas
+    ./git
+    ./home-manager
+    ./shells
+  ];
+}

system/programs/doas/default.nix

@@ -0,0 +1,18 @@
+{ ... }:
+{
+  security = {
+    sudo.enable = false;
+    doas = {
+      enable = true;
+      extraRules = [
+        { # Give wheel root access
+          groups = [ "wheel" ];
+          keepEnv = true;
+          persist = true;
+        }
+      ];
+    };
+  };
+
+  environment.systemPackages = with pkgs; [ doas-sudo-shim ];
+}

system/programs/git/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  programs.git = {
+    enable = true;
+    lfs.enable = true;
+  };
+}

system/programs/home-manager/default.nix

@@ -0,0 +1,12 @@
+{ unstable, ... }:
+{
+  home-manager = {
+    useUserPackages = true;
+    backupFileExtension = "bak";
+    extraSpecialArgs = {
+      inherit
+        unstable
+        ;
+    };
+  };
+}

system/programs/shells/default.nix

@@ -0,0 +1,7 @@
+{ pkgs, ... }:
+{
+  programs.fish.enable = true;
+  users.defaultUserShell = pkgs.fish;
+
+  programs.zsh.enable = true;
+}

system/services/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./general
+    ./server
+  ];
+}

system/services/general/apparmor/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  security.apparmor.enable = true;
+}

system/services/general/default.nix

@@ -0,0 +1,12 @@
+{ ... }:
+{
+  imports = [
+    ./apparmor
+    ./earlyoom
+    ./libvirtd
+    ./snowflake
+    ./ssh
+    ./tlp
+    ./userborn
+  ];
+}

system/services/general/earlyoom/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.earlyoom.enable = true;
+}

system/services/general/libvirtd/default.nix

@@ -0,0 +1,39 @@
+{ config, lib, pkgs, ... }:
+{
+  options.system.libvirtd.enable = lib.mkEnableOption "Enable libvirtd services";
+
+  config = lib.mkIf config.system.libvirtd.enable {
+    virtualisation.libvirtd = {
+      enable = true;
+      onBoot = "ignore";
+      onShutdown = "shutdown";
+      qemu = {
+        ovmf = {
+          enable = true;
+          packages = with pkgs; [ OVMFFull.fd ];
+        };
+        vhostUserPackages = with pkgs; [ virtiofsd ];
+        swtpm.enable = true;
+      };
+    };
+
+    programs.virt-manager.enable = true;
+
+    environment.persistence."/persist".directories = [
+      "/var/lib/libvirt/dnsmasq"
+      "/var/lib/libvirt/nwfilter"
+      "/var/lib/libvirt/qemu"
+      "/var/lib/libvirt/secrets"
+      "/var/lib/libvirt/storage"
+      "/var/lib/libvirt/swtpm"
+    ];
+
+    # Needed to make NAT work
+    networking.firewall.trustedInterfaces = [
+      "virbr0"
+      "virbr1"
+    ];
+
+    systemd.tmpfiles.rules = [ "f /dev/shm/looking-glass 0660 - libvirtd -" ];
+  };
+}

system/services/general/snowflake/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.snowflake-proxy.enable = true;
+}

system/services/general/ssh/default.nix

@@ -0,0 +1,22 @@
+{ lib, ... }:
+{
+  imports = [ ./fail2ban ];
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = lib.mkForce "no";
+      PrintLastLog = "no";
+      PasswordAuthentication = false;
+      UsePAM = false;
+      X11Forwarding = false;
+    };
+  };
+
+  environment.persistence."/persist".files = [
+    "/etc/ssh/ssh_host_ed25519_key"
+    "/etc/ssh/ssh_host_ed25519_key.pub"
+    "/etc/ssh/ssh_host_rsa_key"
+    "/etc/ssh/ssh_host_rsa_key.pub"
+  ];
+}

system/services/general/ssh/fail2ban/default.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  services.fail2ban = {
+    enable = true;
+    maxretry = 5;
+    bantime = "10m";
+  };
+
+  environment.persistence."/persist".directories = [ "/var/lib/fail2ban" ];
+}

system/services/general/tlp/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.tlp.enable = true;
+}

system/services/general/userborn/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.userborn.enable = true;
+}

system/services/server/cfdyndns/default.nix

@@ -0,0 +1,7 @@
+{ config, pkgs, ... }:
+{
+  services.cloudflare-dyndns = {
+    enable = config.system.server.enable;
+    apiTokenFile = "${pkgs.writeText "cloudflareapikey" config.secrets.flareApiKey}";
+  };
+}

system/services/server/default.nix

@@ -0,0 +1,13 @@
+{ ... }:
+{
+  imports = [
+    ./cfdyndns
+    ./fileserver
+    ./forgejo
+    ./mysql
+    ./socialserver
+    ./transmission
+    ./vaultwarden
+    ./webserver
+  ];
+}

system/services/server/fileserver/default.nix

@@ -0,0 +1,10 @@
+{ lib, ... }: 
+{
+  options.system.fileserver.enable = lib.mkEnableOption "Enable file serving services";
+
+  imports = [
+    ./jellyfin
+    ./nextcloud
+    ./nfs
+  ];
+}

system/services/server/fileserver/jellyfin/default.nix

@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+{
+  imports = [
+    ./nginx
+  ];
+
+  config = lib.mkIf config.system.fileserver.enable {
+    services.jellyfin.enable = true;
+    environment.persistence."/persist".directories = [ "/var/lib/jellyfin" ];
+  };
+}

system/services/server/fileserver/jellyfin/nginx/default.nix

@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."jelly.nixfox.ca" = lib.mkIf config.services.forgejo.enable {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:8096";
+      proxyWebsockets = true;
+    };
+  };
+}

system/services/server/fileserver/nextcloud/collabora/default.nix

@@ -0,0 +1,4 @@
+{ config, lib, ... }:
+{
+  services.collabora-online.enable = config.services.nextcloud.enable;
+}

system/services/server/fileserver/nextcloud/default.nix

@@ -0,0 +1,34 @@
+{ config, lib, pkgs, ... }:
+{
+  imports = [
+    ./collabora
+    ./nginx
+  ];
+
+  config = lib.mkIf config.system.fileserver.enable {
+    services.nextcloud = {
+      enable = true;
+      package = pkgs.nextcloud30;
+      hostName = "cloud.nixfox.ca";
+      https = true;
+      config = {
+        adminuser = config.sysusers.main;
+        adminpassFile = "${pkgs.writeText "initial" config.secrets.initialPass}";
+      };
+      settings = {
+        trusted_proxies = [ "127.0.0.1" ];
+        trusted_domains = [ "cloud.nixfox.ca" ];
+        overwriteprotocol = "https";
+        mail_smtphost = "mx.nixfox.ca";
+        mail_domain = "nixfox.ca";
+        mail_from_address = "noreply";
+        mail_smtpauth = "true";
+        mail_smtpname = "noreply@nixfox.ca";
+        mail_smtppassword = config.secrets.noreplyPassword;
+        mail_smtpmode = "smtp";
+        mail_smtpport = 587;
+      };
+    };
+    environment.persistence."/persist".directories = [ "/var/lib/nextcloud" ];
+  };
+}

system/services/server/fileserver/nextcloud/nginx/default.nix

@@ -0,0 +1,18 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."cloud.nixfox.ca" = lib.mkIf config.services.nextcloud.enable {
+    enableACME = true;
+    addSSL = true;
+    locations."/" = {
+      proxyWebsockets = true;
+      extraConfig = ''
+        location /.well-known/carddav {
+          return 301 $scheme://$host/remote.php/dav;
+        }
+        location /.well-known/caldav {
+          return 301 $scheme://$host/remote.php/dav;
+        }
+     '';
+    };
+  };
+}

system/services/server/fileserver/nfs/default.nix

@@ -0,0 +1,11 @@
+{ config, ... }:
+{
+  services.nfs.server = {
+    enable = config.system.fileserver.enable;
+    exports = ''
+      /export/KittyNFS/Files *(rw,sync,no_subtree_check)
+      /export/KittyNFS/Media *(rw,sync,no_subtree_check)
+      /export/KittyNFS/Music *(rw,sync,no_subtree_check)
+    '';
+  };
+}

system/services/server/forgejo/default.nix

@@ -0,0 +1,39 @@
+{ config, lib, pkgs, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.system.server.enable {
+    services.forgejo = {
+      enable = true;
+      package = pkgs.forgejo;
+      settings = {
+        server = {
+          DOMAIN = "git.nixfox.ca";
+          ROOT_URL = "https://git.nixfox.ca:443";
+          HTTP_PORT = 3110;
+          SSH_PORT = 2299;
+          START_SSH_SERVER = true;
+        };
+        mailer = {
+          ENABLED = true;
+          SMTP_ADDR = "mx.nixfox.ca";
+          FROM = "NixFox Git <noreply@nixfox.ca>";
+          USER = "noreply@nixfox.ca";
+          PASSWD = config.secrets.noreplyPassword;
+          PROTOCOL = "smtps";
+        };
+        service = {
+          REGISTER_EMAIL_CONFIRM = true;
+          DISABLE_REGISTRATION = true;
+        };
+        ui.DEFAULT_THEME = "forgejo-dark";
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 2299 ];
+
+    services.cloudflare-dyndns.domains = [ "git.nixfox.ca" ];
+
+    environment.persistence."/persist".directories = [ "/var/lib/forgejo" ];
+  };
+}

system/services/server/forgejo/nginx/default.nix

@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."git.nixfox.ca" = lib.mkIf config.services.forgejo.enable {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:3110";
+      proxyWebsockets = true;
+    };
+  };
+}

system/services/server/mysql/default.nix

@@ -0,0 +1,23 @@
+{ config, lib, pkgs, ... }:
+{
+  config = lib.mkIf config.system.server.enable {
+    services.mysql = {
+      enable = true;
+      package = pkgs.mariadb;
+      ensureDatabases = [
+        "minecraft"
+      ];
+      ensureUsers = [
+        {
+          name = "minecraft";
+          ensurePermissions = {
+            "minecraft.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+    environment.persistence."/persist".directories = [
+      "/var/lib/mysql"
+    ];
+  };
+}

system/services/server/socialserver/default.nix

@@ -0,0 +1,10 @@
+{ lib, ... }:
+{
+  options.system.socialserver.enable = lib.mkEnableOption "Enable social media like services";
+
+  imports = [
+    ./mastodon
+    ./matrix
+    ./owncast
+  ];
+}

system/services/server/socialserver/mastodon/default.nix

@@ -0,0 +1,23 @@
+{ config, lib, pkgs, ... }:
+{
+  config = lib.mkIf config.system.socialserver.enable {
+    services.mastodon = {
+      enable = true;
+      localDomain = "social.nixfox.ca";
+      streamingProcesses = 4;
+      configureNginx = true;
+      smtp = {
+        createLocally = false;
+        host = "mx.nixfox.ca";
+        port = 587;
+        authenticate = true;
+        fromAddress = "NixFox Mastodon <noreply@nixfox.ca>";
+        user = "noreply@nixfox.ca";
+        passwordFile = pkgs.writeText "smtp_pass.txt" config.secrets.noreplyPassword;
+      };
+    };
+    environment.persistence."/persist".directories = [
+      "/var/lib/mastodon"
+    ];
+  };
+}

system/services/server/socialserver/matrix/coturn/default.nix

@@ -0,0 +1,46 @@
+{ config, lib, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.services.matrix-synapse.enable {
+    services = {
+      coturn = {
+        enable = true;
+        no-cli = true;
+        no-tcp-relay = true;
+        min-port = 49000;
+        max-port = 50000;
+        use-auth-secret = true;
+        static-auth-secret = config.secrets.coturnSecret;
+        realm = "turn.jimbosfiles.com";
+        cert = "/var/lib/acme/turn.jimbosfiles.com/fullchain.pem";
+        pkey = "/var/lib/acme/turn.jimbosfiles.com/key.pem";
+      };
+
+      # Enable coturn on Synapse
+      matrix-synapse.settings = {
+        turn_uris = [
+          "turn:turn.jimbosfiles.com:3478?transport=udp"
+          "turn:turn.jimbosfiles.com:3478?transport=tcp"
+        ];
+        turn_shared_secret = config.secrets.coturnSecret;
+        turn_user_lifetime = "1h";
+      };
+
+      # Sync the IP to Cloudflare
+      cloudflare-dyndns.domains = [ "turn.jimbosfiles.com" ];
+    };
+
+    # Open coturn ports
+    networking.firewall = {
+      allowedUDPPorts = [
+        3478
+        5349
+      ];
+      allowedUDPPortRanges = [{
+        from = config.services.coturn.min-port;
+        to = config.services.coturn.max-port;
+      }];
+    };
+  };
+}

system/services/server/socialserver/matrix/coturn/nginx/default.nix

@@ -0,0 +1,22 @@
+{ config, lib, ... }:
+{
+  config = lib.mkIf config.services.coturn.enable {
+    services.nginx.virtualHosts."turn.jimbosfiles.com" = {
+      enableACME = true;
+      forceSSL = true;
+      listen = [{
+        addr = "0.0.0.0";
+        port = 80;
+        ssl = false; 
+      }];
+      locations."/".proxyPass = "http://127.0.0.1:1380";
+    };
+
+    security.acme.certs = {       
+      "turn.jimbosfiles.com" = {
+        group = "turnserver";
+        postRun = "systemctl restart coturn.service";
+      };
+    };
+  };
+}

system/services/server/socialserver/matrix/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  imports = [
+    ./coturn
+    ./element
+    ./synapse
+  ];
+}

system/services/server/socialserver/matrix/element/default.nix

@@ -0,0 +1,23 @@
+{ config, lib, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.services.matrix-synapse.enable {
+    nixpkgs.config.element-web.conf = {
+      default_server_config."m.homeserver" = {
+        base_url = "https://matrix.jimbosfiles.com";
+        server_name = "matrix.jimbosfiles.com";
+      };
+      branding = {
+        #welcome_background_url = "https://staging.jimbosfiles.com/images/backgrounds/template-background.png";
+        #auth_header_logo_url = "https://staging.jimbosfiles.com/images/logos/template-logo.png";
+      };
+      embedded_pages = {
+        home_url = "https://www.jimbosfiles.com/";
+      };
+      disable_custom_urls = true;
+      disable_guests = true;
+      default_theme = "dark";
+    };
+  };
+}

system/services/server/socialserver/matrix/element/nginx/default.nix

@@ -0,0 +1,8 @@
+{ config, lib, pkgs, ... }:
+{
+  services.nginx.virtualHosts."chat.nixfox.ca" = lib.mkIf config.services.matrix-synapse.enable {
+    enableACME = true;
+    addSSL = true;
+    root = "${pkgs.element-web}";
+  };
+}

system/services/server/socialserver/matrix/synapse/default.nix

@@ -0,0 +1,62 @@
+{ config, lib, pkgs, ... }:
+{
+  imports = [
+    ./nginx
+  ];
+
+  config = lib.mkIf config.system.socialserver.enable {
+    services.matrix-synapse = {
+      enable = true;
+      settings = {
+        server_name = "jimbosfiles.com";
+        public_baseurl = "https://matrix.jimbosfiles.com";
+        suppress_key_server_warning = true;
+
+        listeners = [{
+          port = 8008;
+          bind_addresses = [
+            "::"
+            "0.0.0.0"
+          ];
+          resources = [{
+            compress = true;
+            names = [
+              "client"
+              "federation"
+            ];
+          }];
+          type = "http";
+          tls = false;
+          x_forwarded = true;
+        }];
+
+        email = {
+          notif_from = "NixFox Matrix <noreply@nixfox.ca>";
+          smtp_host = "mx.nixfox.ca";
+          smtp_user = "noreply@nixfox.ca";
+          smtp_pass = config.secrets.noreplyPassword;
+          enable_tls = true;
+          smtp_port = 587;
+          require_transport_security = true;
+        };
+
+        # Disable registration without email
+        registrations_require_3pid = [ "email" ];
+
+        # Set the type of database
+        database.name = "sqlite3";
+
+        # Allow account registration
+        #enable_registration = true;
+
+        # General settings
+        url_preview_enabled = true;
+        max_upload_size = "50M";
+        report_stats = false;
+        burst_count = 15;
+      };
+    };
+
+    environment.persistence."/persist".directories = [ "/var/lib/matrix-synapse" ];
+  };
+}

system/services/server/socialserver/matrix/synapse/nginx/default.nix

@@ -0,0 +1,13 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."matrix.jimbosfiles.com" = lib.mkIf config.services.matrix-synapse.enable {
+    enableACME = true;
+    forceSSL = true;
+    locations = {
+      "/".extraConfig = ''return 403;'';
+      "/client".proxyPass = "http://127.0.0.1:8008";
+      "/_matrix".proxyPass = "http://127.0.0.1:8008";
+      "/_synapse/client".proxyPass = "http://127.0.0.1:8008";
+    };
+  };
+}

system/services/server/socialserver/owncast/default.nix

@@ -0,0 +1,16 @@
+{ config, lib, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.system.socialserver.enable {
+    services.owncast = {
+      enable = true;
+      port = 8060;
+      rtmp-port = 1945;
+      listen = "0.0.0.0";
+    };
+    environment.persistence."/persist".directories = [
+      "/var/lib/owncast"
+    ];
+  };
+}

system/services/server/socialserver/owncast/nginx/default.nix

@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."live.nixfox.ca" = lib.mkIf config.services.owncast.enable {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:8060";
+      proxyWebsockets = true;
+    };
+  };
+}

system/services/server/transmission/default.nix

@@ -0,0 +1,16 @@
+{ config, lib, pkgs, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.system.server.enable {
+    services.transmission = {
+      enable = true;
+      credentialsFile = pkgs.writeText "credentials" config.secrets.transmissionCredFile;
+      openPeerPorts = true;
+      settings.rpc-authentication-required = true;
+    };
+    environment.persistence."/persist".directories = [
+      "/var/lib/transmission"
+    ];
+  };
+}

system/services/server/transmission/nginx/default.nix

@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."tor.nixfox.ca" = lib.mkIf config.services.transmission.enable {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:9091";
+      proxyWebsockets = true;
+    };
+  };
+}

system/services/server/vaultwarden/default.nix

@@ -0,0 +1,29 @@
+{ config, lib, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.system.server.enable {
+    services.vaultwarden = {
+      enable = true;
+      config = {
+        DOMAIN = "https://pass.nixfox.ca";
+        SIGNUPS_ALLOWED = false;
+        ROCKET_ADDRESS = "127.0.0.1";
+        ROCKET_PORT = 8222;
+        ROCKET_LOG = "critical";
+
+        # Smtp email
+        SMTP_HOST = "mx.nixfox.ca";
+        SMTP_FROM = "noreply@nixfox.ca";
+        SMTP_FROM_NAME = "Vaultwarden";
+        SMTP_USERNAME = "noreply@nixfox.ca";
+        SMTP_PASSWORD = config.secrets.noreplyPassword;
+        SMTP_SECURITY = "starttls";
+        SMTP_PORT = 587;
+        SMTP_TIMEOUT = 15;
+      };
+    };
+
+    environment.persistence."/persist".directories = [ "/var/lib/bitwarden_rs" ];
+  };
+}

system/services/server/vaultwarden/nginx/default.nix

@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."pass.nixfox.ca" = lib.mkIf config.services.vaultwarden.enable {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:8222";
+      proxyWebsockets = true;
+    };
+  };
+}

system/services/server/webserver/acme/default.nix

@@ -0,0 +1,10 @@
+{ config, lib, ... }:
+{
+  config = lib.mkIf config.services.nginx.enable {
+    security.acme = { 
+      acceptTerms = true;
+      defaults.email = "contact@nixfox.ca";
+    };
+    environment.persistence."/persist".directories = [ "/var/lib/acme" ];
+  };
+}

system/services/server/webserver/default.nix

@@ -0,0 +1,9 @@
+{ lib, ... }: 
+{
+  options.system.webserver.enable = lib.mkEnableOption "Enable nginx related services";
+
+  imports = [
+    ./acme
+    ./nginx
+  ];
+}

system/services/server/webserver/nginx/default.nix

@@ -0,0 +1,24 @@
+{ config, lib, ... }:
+{
+  imports = [
+    ./rtmp
+    ./virtualhosts
+  ];
+
+  config = lib.mkIf config.system.server.enable {
+    services.nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedProxySettings = true;
+    };
+
+    environment.persistence."/persist".directories = [ "/var/www" ];
+
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
+  };
+}

system/services/server/webserver/nginx/rtmp/default.nix

@@ -0,0 +1,32 @@
+{ config, lib, pkgs, ... }:
+{
+  options.services.nginx.rtmp.enable = lib.mkEnableOption "Enable an RTMP server using Nginx";
+
+  config = lib.mkIf config.services.nginx.rtmp.enable {
+    services.nginx = {
+      package = (pkgs.nginx.override {
+        modules = with pkgs.nginxModules; [ rtmp ];
+      });
+      appendConfig = ''
+        rtmp {
+          server {
+            listen 1935;
+            chunk_size 4096;
+            allow publish all;
+            application stream {
+              record off;
+              live on;
+              allow play all;
+              hls on;
+              hls_path /var/www/landing-page/streams/hls/;
+              hls_fragment_naming system;
+              hls_fragment 3;
+              hls_playlist_length 40;
+            }
+          }
+        }
+      '';
+    };
+    systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www/landing-page/streams/hls/" ];
+  };
+}

system/services/server/webserver/nginx/virtualhosts/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./nixfox
+    ./jimbosfiles
+  ];
+}

system/services/server/webserver/nginx/virtualhosts/jimbosfiles/default.nix

@@ -0,0 +1,27 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."jimbosfiles.com" = lib.mkIf config.system.server.enable {
+    enableACME = true;
+    addSSL = true;
+    globalRedirect = "www.nixfox.ca";
+    locations = {
+      "/.well-known/matrix/client".extraConfig = ''
+        default_type application/json;
+        return 200 '
+          {
+            "m.homeserver": {
+              "base_url": "https://matrix.jimbosfiles.com"
+            },
+            "m.identity_server": {
+              "base_url": "https://matrix.org"
+            }
+          }
+        ';
+      '';
+      "/.well-known/matrix/server".extraConfig = ''
+        default_type application/json;
+        return 200 '{ "m.server": "matrix.jimbosfiles.com:443" }';
+      '';
+    };
+  };
+}

system/services/server/webserver/nginx/virtualhosts/nixfox/default.nix

@@ -0,0 +1,16 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts = lib.mkIf config.system.server.enable {
+    "www.nixfox.ca" = {
+      enableACME = true;
+      addSSL = true;
+      default = true;
+      root = "/var/www/landing-page";
+    };
+    "nixfox.ca" = {
+      enableACME = true;
+      addSSL = true;
+      globalRedirect = "www.nixfox.ca";
+    };
+  };
+}

system/settings/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ./minimal
+    ./nix
+    ./security
+    ./timezone
+  ];
+}

system/settings/minimal/default.nix

@@ -0,0 +1,21 @@
+{ ... }:
+{
+  environment = {
+    defaultPackages = [ ];
+    stub-ld.enable = false;
+  };
+
+  documentation = {
+    doc.enable = false;
+    info.enable = false;
+    nixos.enable = false;
+  };
+
+  programs = {
+    nano.enable = false;
+    less.lessopen = null;
+    command-not-found.enable = false;
+  };
+
+  services.logrotate.enable = false;
+}

system/settings/nix/default.nix

@@ -0,0 +1,23 @@
+{ config, lib, pkgs, unstable, ... }:
+{
+  imports = [ ./gc ];
+
+  options.nixpkgs.allowUnfreePackages = lib.mkOption {
+    type = with lib.types; listOf str;
+  };
+
+  config = {
+    nix.settings = {
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      auto-optimise-store = true;
+    };
+
+    _module.args.pkgsUnstable = import unstable {
+      inherit (pkgs.stdenv.hostPlatform) system;
+      inherit (config.nixpkgs) config;
+    };
+  };
+}

system/settings/nix/gc/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 7d";
+  };
+}

system/settings/timezone/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  time.timeZone = "America/Toronto";
+}