Fix everything.

system/services/server/cfdyndns/default.nix

@@ -0,0 +1,7 @@
+{ config, pkgs, ... }:
+{
+  services.cloudflare-dyndns = {
+    enable = config.system.server.enable;
+    apiTokenFile = "${pkgs.writeText "cloudflareapikey" config.secrets.flareApiKey}";
+  };
+}

system/services/server/default.nix

@@ -0,0 +1,13 @@
+{ ... }:
+{
+  imports = [
+    ./cfdyndns
+    ./fileserver
+    ./forgejo
+    ./mysql
+    ./socialserver
+    ./transmission
+    ./vaultwarden
+    ./webserver
+  ];
+}

system/services/server/fileserver/default.nix

@@ -0,0 +1,10 @@
+{ lib, ... }: 
+{
+  options.system.fileserver.enable = lib.mkEnableOption "Enable file serving services";
+
+  imports = [
+    ./jellyfin
+    ./nextcloud
+    ./nfs
+  ];
+}

system/services/server/fileserver/jellyfin/default.nix

@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+{
+  imports = [
+    ./nginx
+  ];
+
+  config = lib.mkIf config.system.fileserver.enable {
+    services.jellyfin.enable = true;
+    environment.persistence."/persist".directories = [ "/var/lib/jellyfin" ];
+  };
+}

system/services/server/fileserver/jellyfin/nginx/default.nix

@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."jelly.nixfox.ca" = lib.mkIf config.services.forgejo.enable {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:8096";
+      proxyWebsockets = true;
+    };
+  };
+}

system/services/server/fileserver/nextcloud/collabora/default.nix

@@ -0,0 +1,4 @@
+{ config, lib, ... }:
+{
+  services.collabora-online.enable = config.services.nextcloud.enable;
+}

system/services/server/fileserver/nextcloud/default.nix

@@ -0,0 +1,34 @@
+{ config, lib, pkgs, ... }:
+{
+  imports = [
+    ./collabora
+    ./nginx
+  ];
+
+  config = lib.mkIf config.system.fileserver.enable {
+    services.nextcloud = {
+      enable = true;
+      package = pkgs.nextcloud30;
+      hostName = "cloud.nixfox.ca";
+      https = true;
+      config = {
+        adminuser = config.sysusers.main;
+        adminpassFile = "${pkgs.writeText "initial" config.secrets.initialPass}";
+      };
+      settings = {
+        trusted_proxies = [ "127.0.0.1" ];
+        trusted_domains = [ "cloud.nixfox.ca" ];
+        overwriteprotocol = "https";
+        mail_smtphost = "mx.nixfox.ca";
+        mail_domain = "nixfox.ca";
+        mail_from_address = "noreply";
+        mail_smtpauth = "true";
+        mail_smtpname = "noreply@nixfox.ca";
+        mail_smtppassword = config.secrets.noreplyPassword;
+        mail_smtpmode = "smtp";
+        mail_smtpport = 587;
+      };
+    };
+    environment.persistence."/persist".directories = [ "/var/lib/nextcloud" ];
+  };
+}

system/services/server/fileserver/nextcloud/nginx/default.nix

@@ -0,0 +1,18 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."cloud.nixfox.ca" = lib.mkIf config.services.nextcloud.enable {
+    enableACME = true;
+    addSSL = true;
+    locations."/" = {
+      proxyWebsockets = true;
+      extraConfig = ''
+        location /.well-known/carddav {
+          return 301 $scheme://$host/remote.php/dav;
+        }
+        location /.well-known/caldav {
+          return 301 $scheme://$host/remote.php/dav;
+        }
+     '';
+    };
+  };
+}

system/services/server/fileserver/nfs/default.nix

@@ -0,0 +1,11 @@
+{ config, ... }:
+{
+  services.nfs.server = {
+    enable = config.system.fileserver.enable;
+    exports = ''
+      /export/KittyNFS/Files *(rw,sync,no_subtree_check)
+      /export/KittyNFS/Media *(rw,sync,no_subtree_check)
+      /export/KittyNFS/Music *(rw,sync,no_subtree_check)
+    '';
+  };
+}

system/services/server/forgejo/default.nix

@@ -0,0 +1,39 @@
+{ config, lib, pkgs, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.system.server.enable {
+    services.forgejo = {
+      enable = true;
+      package = pkgs.forgejo;
+      settings = {
+        server = {
+          DOMAIN = "git.nixfox.ca";
+          ROOT_URL = "https://git.nixfox.ca:443";
+          HTTP_PORT = 3110;
+          SSH_PORT = 2299;
+          START_SSH_SERVER = true;
+        };
+        mailer = {
+          ENABLED = true;
+          SMTP_ADDR = "mx.nixfox.ca";
+          FROM = "NixFox Git <noreply@nixfox.ca>";
+          USER = "noreply@nixfox.ca";
+          PASSWD = config.secrets.noreplyPassword;
+          PROTOCOL = "smtps";
+        };
+        service = {
+          REGISTER_EMAIL_CONFIRM = true;
+          DISABLE_REGISTRATION = true;
+        };
+        ui.DEFAULT_THEME = "forgejo-dark";
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 2299 ];
+
+    services.cloudflare-dyndns.domains = [ "git.nixfox.ca" ];
+
+    environment.persistence."/persist".directories = [ "/var/lib/forgejo" ];
+  };
+}

system/services/server/forgejo/nginx/default.nix

@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."git.nixfox.ca" = lib.mkIf config.services.forgejo.enable {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:3110";
+      proxyWebsockets = true;
+    };
+  };
+}

system/services/server/mysql/default.nix

@@ -0,0 +1,23 @@
+{ config, lib, pkgs, ... }:
+{
+  config = lib.mkIf config.system.server.enable {
+    services.mysql = {
+      enable = true;
+      package = pkgs.mariadb;
+      ensureDatabases = [
+        "minecraft"
+      ];
+      ensureUsers = [
+        {
+          name = "minecraft";
+          ensurePermissions = {
+            "minecraft.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+    environment.persistence."/persist".directories = [
+      "/var/lib/mysql"
+    ];
+  };
+}

system/services/server/socialserver/default.nix

@@ -0,0 +1,10 @@
+{ lib, ... }:
+{
+  options.system.socialserver.enable = lib.mkEnableOption "Enable social media like services";
+
+  imports = [
+    ./mastodon
+    ./matrix
+    ./owncast
+  ];
+}

system/services/server/socialserver/mastodon/default.nix

@@ -0,0 +1,23 @@
+{ config, lib, pkgs, ... }:
+{
+  config = lib.mkIf config.system.socialserver.enable {
+    services.mastodon = {
+      enable = true;
+      localDomain = "social.nixfox.ca";
+      streamingProcesses = 4;
+      configureNginx = true;
+      smtp = {
+        createLocally = false;
+        host = "mx.nixfox.ca";
+        port = 587;
+        authenticate = true;
+        fromAddress = "NixFox Mastodon <noreply@nixfox.ca>";
+        user = "noreply@nixfox.ca";
+        passwordFile = pkgs.writeText "smtp_pass.txt" config.secrets.noreplyPassword;
+      };
+    };
+    environment.persistence."/persist".directories = [
+      "/var/lib/mastodon"
+    ];
+  };
+}

system/services/server/socialserver/matrix/coturn/default.nix

@@ -0,0 +1,46 @@
+{ config, lib, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.services.matrix-synapse.enable {
+    services = {
+      coturn = {
+        enable = true;
+        no-cli = true;
+        no-tcp-relay = true;
+        min-port = 49000;
+        max-port = 50000;
+        use-auth-secret = true;
+        static-auth-secret = config.secrets.coturnSecret;
+        realm = "turn.jimbosfiles.com";
+        cert = "/var/lib/acme/turn.jimbosfiles.com/fullchain.pem";
+        pkey = "/var/lib/acme/turn.jimbosfiles.com/key.pem";
+      };
+
+      # Enable coturn on Synapse
+      matrix-synapse.settings = {
+        turn_uris = [
+          "turn:turn.jimbosfiles.com:3478?transport=udp"
+          "turn:turn.jimbosfiles.com:3478?transport=tcp"
+        ];
+        turn_shared_secret = config.secrets.coturnSecret;
+        turn_user_lifetime = "1h";
+      };
+
+      # Sync the IP to Cloudflare
+      cloudflare-dyndns.domains = [ "turn.jimbosfiles.com" ];
+    };
+
+    # Open coturn ports
+    networking.firewall = {
+      allowedUDPPorts = [
+        3478
+        5349
+      ];
+      allowedUDPPortRanges = [{
+        from = config.services.coturn.min-port;
+        to = config.services.coturn.max-port;
+      }];
+    };
+  };
+}

system/services/server/socialserver/matrix/coturn/nginx/default.nix

@@ -0,0 +1,22 @@
+{ config, lib, ... }:
+{
+  config = lib.mkIf config.services.coturn.enable {
+    services.nginx.virtualHosts."turn.jimbosfiles.com" = {
+      enableACME = true;
+      forceSSL = true;
+      listen = [{
+        addr = "0.0.0.0";
+        port = 80;
+        ssl = false; 
+      }];
+      locations."/".proxyPass = "http://127.0.0.1:1380";
+    };
+
+    security.acme.certs = {       
+      "turn.jimbosfiles.com" = {
+        group = "turnserver";
+        postRun = "systemctl restart coturn.service";
+      };
+    };
+  };
+}

system/services/server/socialserver/matrix/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  imports = [
+    ./coturn
+    ./element
+    ./synapse
+  ];
+}

system/services/server/socialserver/matrix/element/default.nix

@@ -0,0 +1,23 @@
+{ config, lib, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.services.matrix-synapse.enable {
+    nixpkgs.config.element-web.conf = {
+      default_server_config."m.homeserver" = {
+        base_url = "https://matrix.jimbosfiles.com";
+        server_name = "matrix.jimbosfiles.com";
+      };
+      branding = {
+        #welcome_background_url = "https://staging.jimbosfiles.com/images/backgrounds/template-background.png";
+        #auth_header_logo_url = "https://staging.jimbosfiles.com/images/logos/template-logo.png";
+      };
+      embedded_pages = {
+        home_url = "https://www.jimbosfiles.com/";
+      };
+      disable_custom_urls = true;
+      disable_guests = true;
+      default_theme = "dark";
+    };
+  };
+}

system/services/server/socialserver/matrix/element/nginx/default.nix

@@ -0,0 +1,8 @@
+{ config, lib, pkgs, ... }:
+{
+  services.nginx.virtualHosts."chat.nixfox.ca" = lib.mkIf config.services.matrix-synapse.enable {
+    enableACME = true;
+    addSSL = true;
+    root = "${pkgs.element-web}";
+  };
+}

system/services/server/socialserver/matrix/synapse/default.nix

@@ -0,0 +1,62 @@
+{ config, lib, pkgs, ... }:
+{
+  imports = [
+    ./nginx
+  ];
+
+  config = lib.mkIf config.system.socialserver.enable {
+    services.matrix-synapse = {
+      enable = true;
+      settings = {
+        server_name = "jimbosfiles.com";
+        public_baseurl = "https://matrix.jimbosfiles.com";
+        suppress_key_server_warning = true;
+
+        listeners = [{
+          port = 8008;
+          bind_addresses = [
+            "::"
+            "0.0.0.0"
+          ];
+          resources = [{
+            compress = true;
+            names = [
+              "client"
+              "federation"
+            ];
+          }];
+          type = "http";
+          tls = false;
+          x_forwarded = true;
+        }];
+
+        email = {
+          notif_from = "NixFox Matrix <noreply@nixfox.ca>";
+          smtp_host = "mx.nixfox.ca";
+          smtp_user = "noreply@nixfox.ca";
+          smtp_pass = config.secrets.noreplyPassword;
+          enable_tls = true;
+          smtp_port = 587;
+          require_transport_security = true;
+        };
+
+        # Disable registration without email
+        registrations_require_3pid = [ "email" ];
+
+        # Set the type of database
+        database.name = "sqlite3";
+
+        # Allow account registration
+        #enable_registration = true;
+
+        # General settings
+        url_preview_enabled = true;
+        max_upload_size = "50M";
+        report_stats = false;
+        burst_count = 15;
+      };
+    };
+
+    environment.persistence."/persist".directories = [ "/var/lib/matrix-synapse" ];
+  };
+}

system/services/server/socialserver/matrix/synapse/nginx/default.nix

@@ -0,0 +1,13 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."matrix.jimbosfiles.com" = lib.mkIf config.services.matrix-synapse.enable {
+    enableACME = true;
+    forceSSL = true;
+    locations = {
+      "/".extraConfig = ''return 403;'';
+      "/client".proxyPass = "http://127.0.0.1:8008";
+      "/_matrix".proxyPass = "http://127.0.0.1:8008";
+      "/_synapse/client".proxyPass = "http://127.0.0.1:8008";
+    };
+  };
+}

system/services/server/socialserver/owncast/default.nix

@@ -0,0 +1,16 @@
+{ config, lib, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.system.socialserver.enable {
+    services.owncast = {
+      enable = true;
+      port = 8060;
+      rtmp-port = 1945;
+      listen = "0.0.0.0";
+    };
+    environment.persistence."/persist".directories = [
+      "/var/lib/owncast"
+    ];
+  };
+}

system/services/server/socialserver/owncast/nginx/default.nix

@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."live.nixfox.ca" = lib.mkIf config.services.owncast.enable {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:8060";
+      proxyWebsockets = true;
+    };
+  };
+}

system/services/server/transmission/default.nix

@@ -0,0 +1,16 @@
+{ config, lib, pkgs, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.system.server.enable {
+    services.transmission = {
+      enable = true;
+      credentialsFile = pkgs.writeText "credentials" config.secrets.transmissionCredFile;
+      openPeerPorts = true;
+      settings.rpc-authentication-required = true;
+    };
+    environment.persistence."/persist".directories = [
+      "/var/lib/transmission"
+    ];
+  };
+}

system/services/server/transmission/nginx/default.nix

@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."tor.nixfox.ca" = lib.mkIf config.services.transmission.enable {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:9091";
+      proxyWebsockets = true;
+    };
+  };
+}

system/services/server/vaultwarden/default.nix

@@ -0,0 +1,29 @@
+{ config, lib, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.system.server.enable {
+    services.vaultwarden = {
+      enable = true;
+      config = {
+        DOMAIN = "https://pass.nixfox.ca";
+        SIGNUPS_ALLOWED = false;
+        ROCKET_ADDRESS = "127.0.0.1";
+        ROCKET_PORT = 8222;
+        ROCKET_LOG = "critical";
+
+        # Smtp email
+        SMTP_HOST = "mx.nixfox.ca";
+        SMTP_FROM = "noreply@nixfox.ca";
+        SMTP_FROM_NAME = "Vaultwarden";
+        SMTP_USERNAME = "noreply@nixfox.ca";
+        SMTP_PASSWORD = config.secrets.noreplyPassword;
+        SMTP_SECURITY = "starttls";
+        SMTP_PORT = 587;
+        SMTP_TIMEOUT = 15;
+      };
+    };
+
+    environment.persistence."/persist".directories = [ "/var/lib/bitwarden_rs" ];
+  };
+}

system/services/server/vaultwarden/nginx/default.nix

@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."pass.nixfox.ca" = lib.mkIf config.services.vaultwarden.enable {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:8222";
+      proxyWebsockets = true;
+    };
+  };
+}

system/services/server/webserver/acme/default.nix

@@ -0,0 +1,10 @@
+{ config, lib, ... }:
+{
+  config = lib.mkIf config.services.nginx.enable {
+    security.acme = { 
+      acceptTerms = true;
+      defaults.email = "contact@nixfox.ca";
+    };
+    environment.persistence."/persist".directories = [ "/var/lib/acme" ];
+  };
+}

system/services/server/webserver/default.nix

@@ -0,0 +1,9 @@
+{ lib, ... }: 
+{
+  options.system.webserver.enable = lib.mkEnableOption "Enable nginx related services";
+
+  imports = [
+    ./acme
+    ./nginx
+  ];
+}

system/services/server/webserver/nginx/default.nix

@@ -0,0 +1,24 @@
+{ config, lib, ... }:
+{
+  imports = [
+    ./rtmp
+    ./virtualhosts
+  ];
+
+  config = lib.mkIf config.system.server.enable {
+    services.nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedProxySettings = true;
+    };
+
+    environment.persistence."/persist".directories = [ "/var/www" ];
+
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
+  };
+}

system/services/server/webserver/nginx/rtmp/default.nix

@@ -0,0 +1,32 @@
+{ config, lib, pkgs, ... }:
+{
+  options.services.nginx.rtmp.enable = lib.mkEnableOption "Enable an RTMP server using Nginx";
+
+  config = lib.mkIf config.services.nginx.rtmp.enable {
+    services.nginx = {
+      package = (pkgs.nginx.override {
+        modules = with pkgs.nginxModules; [ rtmp ];
+      });
+      appendConfig = ''
+        rtmp {
+          server {
+            listen 1935;
+            chunk_size 4096;
+            allow publish all;
+            application stream {
+              record off;
+              live on;
+              allow play all;
+              hls on;
+              hls_path /var/www/landing-page/streams/hls/;
+              hls_fragment_naming system;
+              hls_fragment 3;
+              hls_playlist_length 40;
+            }
+          }
+        }
+      '';
+    };
+    systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www/landing-page/streams/hls/" ];
+  };
+}

system/services/server/webserver/nginx/virtualhosts/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./nixfox
+    ./jimbosfiles
+  ];
+}

system/services/server/webserver/nginx/virtualhosts/jimbosfiles/default.nix

@@ -0,0 +1,27 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."jimbosfiles.com" = lib.mkIf config.system.server.enable {
+    enableACME = true;
+    addSSL = true;
+    globalRedirect = "www.nixfox.ca";
+    locations = {
+      "/.well-known/matrix/client".extraConfig = ''
+        default_type application/json;
+        return 200 '
+          {
+            "m.homeserver": {
+              "base_url": "https://matrix.jimbosfiles.com"
+            },
+            "m.identity_server": {
+              "base_url": "https://matrix.org"
+            }
+          }
+        ';
+      '';
+      "/.well-known/matrix/server".extraConfig = ''
+        default_type application/json;
+        return 200 '{ "m.server": "matrix.jimbosfiles.com:443" }';
+      '';
+    };
+  };
+}

system/services/server/webserver/nginx/virtualhosts/nixfox/default.nix

@@ -0,0 +1,16 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts = lib.mkIf config.system.server.enable {
+    "www.nixfox.ca" = {
+      enableACME = true;
+      addSSL = true;
+      default = true;
+      root = "/var/www/landing-page";
+    };
+    "nixfox.ca" = {
+      enableACME = true;
+      addSSL = true;
+      globalRedirect = "www.nixfox.ca";
+    };
+  };
+}