Update references and folder names

system/server/acme.nix

@@ -0,0 +1,12 @@
+{outputs, ...}: {
+  security.acme = { 
+    acceptTerms = true;
+    defaults.email = outputs.secrets.jimEmail;
+    certs = {       
+      "turn.${outputs.secrets.jimDomain}" = {
+        group = "turnserver";
+        postRun = "systemctl restart coturn.service";
+      };
+    };
+  };
+}

system/server/archived/adguard.nix

@@ -0,0 +1,14 @@
+{
+  services = {
+    adguardhome.enable = true;
+    nginx.virtualHosts."guard.${outputs.secrets.jimDomain}" =  {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:3000";
+        proxyWebsockets = true;
+      };
+    };
+  };
+  networking.firewall.allowedUDPPorts = [ 53 ];
+}

system/server/archived/gitea.nix

@@ -0,0 +1,36 @@
+{outputs, ...}: {
+  services = {
+    gitea = {
+      enable = true;
+      settings = {
+        server = {
+          DOMAIN = "gitea.${outputs.secrets.jimDomain}";
+          ROOT_URL = "https://gitea.${outputs.secrets.jimDomain}:443";
+          HTTP_PORT = 3115;
+          SSH_PORT = 2295;
+          START_SSH_SERVER = true;
+        };
+        mailer = {
+          ENABLED = true;
+          SMTP_ADDR = "mx.${outputs.secrets.jimDomain}";
+          FROM = "Jimbo's Git <noreply@${outputs.secrets.jimDomain}>";
+          USER = "noreply@${outputs.secrets.jimDomain}";
+          PASSWD = outputs.secrets.noreplyPassword;
+          PROTOCOL = "smtps";
+        };
+        service.REGISTER_EMAIL_CONFIRM = true;
+      };
+    };
+    nginx.virtualHosts."gitea.${outputs.secrets.jimDomain}" =  {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:3115";
+        proxyWebsockets = true;
+      };
+    };
+  };
+
+  # Allow Gitea SSH to work
+  networking.firewall.allowedTCPPorts = [ 2295 ];
+}

system/server/archived/pufferpanel.nix

@@ -0,0 +1,31 @@
+{pkgs, outputs, lib, ...}: {
+  services = {
+    pufferpanel = {
+      enable = true;
+      environment = {
+        PUFFER_WEB_HOST = ":5010";
+        PUFFER_PANEL_SETTINGS_MASTERURL = "https://panel.${outputs.secrets.jimDomain}";
+        PUFFER_PANEL_EMAIL_PROVIDER = "smtp";
+        PUFFER_PANEL_EMAIL_HOST = "mx.${outputs.secrets.jimDomain}:587";
+        PUFFER_PANEL_EMAIL_FROM = "noreply@${outputs.secrets.jimDomain}";
+        PUFFER_PANEL_EMAIL_USERNAME = "noreply@${outputs.secrets.jimDomain}";
+        PUFFER_PANEL_EMAIL_PASSWORD = outputs.secrets.noreplyPassword;
+      };
+      extraPackages = with pkgs; [ bash curl gawk gnutar gzip ];
+      package = pkgs.buildFHSEnv {
+        name = "pufferpanel-fhs";
+        meta.mainProgram = "pufferpanel-fhs";
+        runScript = lib.getExe pkgs.pufferpanel;
+        targetPkgs = pkgs': with pkgs'; [ icu openssl zlib ];
+      };
+    };
+    nginx.virtualHosts."panel.${outputs.secrets.jimDomain}" =  {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:5010";
+        proxyWebsockets = true;
+      };
+    };
+  };
+}

system/server/coturn.nix

@@ -0,0 +1,48 @@
+{outputs, config, ...}: {
+  services = {
+    coturn = rec {
+      enable = true;
+      no-cli = true;
+      no-tcp-relay = true;
+      min-port = 49000;
+      max-port = 50000;
+      use-auth-secret = true;
+      static-auth-secret = "will be world readable for local users :(";
+      realm = "turn.${outputs.secrets.jimDomain}";
+      cert = "/var/lib/acme/turn.${outputs.secrets.jimDomain}.com/fullchain.pem";
+      pkey = "/var/lib/acme/turn.${outputs.secrets.jimDomain}.com/key.pem";
+    };
+
+    # Enable coturn on Synapse
+    matrix-synapse.settings = {
+      turn_uris = [
+        "turn:turn.${outputs.secrets.jimDomain}:3478?transport=udp"
+        "turn:turn.${outputs.secrets.jimDomain}:3478?transport=tcp"
+      ];
+      turn_shared_secret = config.services.coturn.static-auth-secret;
+      turn_user_lifetime = "1h";
+    };
+
+    # Proxy main coturn port
+    nginx.virtualHosts."turn.${outputs.secrets.jimDomain}" = {
+      enableACME = true;
+      forceSSL = true;
+      listen = [{
+        addr = "0.0.0.0";
+	port = 80;
+	ssl = false; 
+      }];
+      locations."/".proxyPass = "http://127.0.0.1:1380";
+    };
+  };
+
+  # Open coturn ports
+  networking.firewall = {
+    allowedUDPPorts = [
+      3478 5349
+    ];
+    allowedUDPPortRanges = [
+      { from = 49000; to = 50000; }
+    ];
+  };
+}

system/server/ddclient.nix

@@ -0,0 +1,21 @@
+{pkgs, outputs, ...}: {
+  # Dynamic IPs for Cloudflare records
+  services.ddclient = {
+    enable = true;
+    protocol = "cloudflare";
+    use = "web, web=https://ipinfo.io/ip";
+    zone = "${outputs.secrets.jimDomain}";
+    username = "token";
+    passwordFile = "${pkgs.writeText "cloudflareapikey" outputs.secrets.flareApiKey}";
+    domains = [
+      "${outputs.secrets.jimDomain}"
+      "*.${outputs.secrets.jimDomain}"
+      "beta.${outputs.secrets.jimDomain}"
+      "git.${outputs.secrets.jimDomain}"
+      "john.${outputs.secrets.jimDomain}"
+      "mc.${outputs.secrets.jimDomain}"
+      "rtmp.${outputs.secrets.jimDomain}"
+      "turn.${outputs.secrets.jimDomain}"
+    ];
+  };
+}

system/server/element.nix

@@ -0,0 +1,28 @@
+{pkgs, outputs, ...}: {
+  # Configure the Element web server
+  nixpkgs.config.element-web.conf = {
+    default_server_config = {
+      "m.homeserver" = {
+        base_url = "https://matrix.${outputs.secrets.jimDomain}";
+        server_name = "matrix.${outputs.secrets.jimDomain}";
+      };
+    };
+    branding = {
+      #welcome_background_url = "https://staging.${outputs.secrets.jimDomain}/images/backgrounds/bloxelcom-sunset.jpg";
+      #auth_header_logo_url = "https://staging.${outputs.secrets.jimDomain}/images/logos/bloxelcom.png";
+    };
+    embedded_pages = {
+      home_url = "https://www.${outputs.secrets.jimDomain}/";
+    };
+    disable_custom_urls = true;
+    disable_guests = true;
+    default_theme = "dark";
+  };
+
+  # Serve the Element page over Nginx
+  services.nginx.virtualHosts."chat.${outputs.secrets.jimDomain}" = {
+    enableACME = true;
+    addSSL = true;
+    root = "${pkgs.element-web}";
+  };
+}

system/server/firewall.nix

@@ -0,0 +1,57 @@
+{outputs, ...}: {
+  # Allow forwarding
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+
+  # Configure firewall
+  networking = let
+    ips = import ../modules/ips.nix;
+    mailPorts = "{ 25, 143, 465, 587, 993, 4190 }";
+  in {
+    firewall = {
+      allowPing = false;
+  
+      # Add extra input rules using nftables
+      extraInputRules = ''
+        ip saddr ${ips.localSpan}.0/24 tcp dport 2049 accept comment "Accept NFS"
+        ip saddr { ${ips.pc}, ${outputs.secrets.lunaIP}, ${outputs.secrets.cornIP}, ${outputs.secrets.vertIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
+        ip saddr ${ips.wgSpan}.3 tcp dport ${mailPorts} accept comment "Accept mail"
+      '';
+    };
+  
+    # Enable nftables and forwarding
+    nftables = {
+      enable = true;
+      tables = {
+        forwarding = {
+          family = "ip";
+          content = ''
+            chain PREROUTING {
+              type nat hook prerouting priority dstnat; policy accept;
+              tcp dport 2211 dnat to ${ips.pc}:22 comment "SSH to PC"
+              tcp dport 2233 dnat to ${ips.wgSpan}.3:22 comment "SSH to Oracle VM"
+              
+              udp dport { 27005, 27015, 7777 } dnat to ${ips.pc} comment "PC Hosted Games"
+              
+              tcp dport { 58010, 57989, 57984 } dnat to ${ips.pc} comment "PC Sunshine TCP"
+              udp dport { 57998, 57999, 58000 } dnat to ${ips.pc} comment "PC Sunshine UDP"
+              
+              tcp dport { 38010, 37989, 37984 } dnat to ${ips.vm} comment "VM Sunshine TCP"
+              udp dport { 37998, 37999, 38000 } dnat to ${ips.vm} comment "VM Sunshine UDP"
+              
+              udp dport { 7790, 7791, 7792 } dnat to ${ips.hx} comment "Deus Ex"
+              
+              ip saddr ${outputs.secrets.cornIP} tcp dport { 9943, 9944 } dnat to ${ips.vm} comment "VM ALVR TCP"
+              ip saddr ${outputs.secrets.cornIP} udp dport { 9943, 9944 } dnat to ${ips.vm} comment "VM ALVR UDP"
+            }
+            chain POSTROUTING {
+              type nat hook postrouting priority 100; policy accept;
+              oifname "${ips.netInt}" masquerade
+	      iifname "${ips.netInt}" oifname "${ips.wgInt}" masquerade comment "Traffic from public to WireGuard"
+	      tcp dport ${mailPorts} oifname != "${ips.wgInt}" drop comment "Send mail"
+            }
+          '';
+        };
+      };
+    };
+  };
+}

system/server/forgejo.nix

@@ -0,0 +1,43 @@
+# This is a hard fork of Gitea.
+{outputs, ...}: {
+  services = {
+    forgejo = {
+      enable = true;
+      settings = {
+        server = {
+          DOMAIN = "git.${outputs.secrets.jimDomain}";
+          ROOT_URL = "https://git.${outputs.secrets.jimDomain}:443";
+          HTTP_PORT = 3110;
+          SSH_PORT = 2299;
+          START_SSH_SERVER = true;
+        };
+	ui = {
+	  DEFAULT_THEME = "forgejo-dark";
+	};
+        mailer = {
+          ENABLED = true;
+          SMTP_ADDR = "mx.${outputs.secrets.jimDomain}";
+          FROM = "Jimbo's Git <noreply@${outputs.secrets.jimDomain}>";
+          USER = "noreply@${outputs.secrets.jimDomain}";
+          PASSWD = outputs.secrets.noreplyPassword;
+          PROTOCOL = "smtps";
+        };
+        service = {
+	  REGISTER_EMAIL_CONFIRM = true;
+	  DISABLE_REGISTRATION = true;
+        };
+      };
+    };
+    nginx.virtualHosts."git.${outputs.secrets.jimDomain}" =  {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:3110";
+        proxyWebsockets = true;
+      };
+    };
+  };
+
+  # Allow Forgejo's SSH to work
+  networking.firewall.allowedTCPPorts = [ 2299 ];
+}

system/server/icecast.nix

@@ -0,0 +1,78 @@
+{pkgs, outputs, ...}: {
+  # Icecast, replacing Azuracast maybe
+  services = {
+    # The host service
+    icecast = {
+      enable = true;
+      listen.port = 265;
+      hostname = "icecast.${outputs.secrets.jimDomain}";
+      admin = {
+        user = "jimbo";
+	password = "${outputs.secrets.castAdminPass}";
+      };
+      extraConf = ''
+        <authentication>
+          <source-password>${outputs.secrets.castSourcePass}</source-password>
+        </authentication>
+
+	<location>Canada</location>
+	<admin>jimbo@jimbosfiles.com</admin>
+
+        <mount type="normal">
+          <mount-name>/jimbops.opus</mount-name>
+          <stream-name>JimBops Radio</stream-name>
+          <stream-description>Music gathered by me, Jimbo.</stream-description>
+          <stream-url>https://icecast.jimbosfiles.com/jimbops.opus</stream-url>
+          <genre>Anything</genre>
+          <type>application/ogg</type>
+          <subtype>vorbis</subtype>
+        </mount>
+      '';
+    };
+
+    # The audio stream
+    liquidsoap.streams = let
+      jimbops = ''
+        # CONFIGURATION
+        settings.log.stdout.set(true)
+        settings.init.allow_root.set(true)
+        settings.scheduler.fast_queues.set(2)
+        settings.decoder.file_extensions.mp4.set(["m4a", "m4b", "m4p", "m4v", "m4r", "3gp", "mp4"])
+        
+        # Define the source with random playlist
+        jimbops = mksafe(playlist(mode='randomize', reload=1, reload_mode="rounds", "/export/JimboNFS/Music/"))
+        
+        # Ensure the stream never stops
+        jimbops_fallback = fallback([jimbops, jimbops])
+        
+        # Output configuration to Icecast
+        output.icecast(
+	  %ffmpeg(format="ogg", %audio(codec="libvorbis", samplerate=48000, b="256k", channels=2)),
+          host="127.0.0.1",
+          port=265,
+          password="${outputs.secrets.castSourcePass}",
+          public=true,
+          icy_metadata=["artist", "title"],
+          mount="jimbops.opus",
+	  encoding = "UTF-8",
+          jimbops_fallback
+        )
+      '';
+    in {
+      JimBops = pkgs.writeText "liquidjim" jimbops;
+    };
+
+    # The web frontend
+    nginx.virtualHosts."icecast.${outputs.secrets.jimDomain}" =  {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:265";
+        proxyWebsockets = true;
+	extraConfig = ''
+	  add_header Ice-Public "1";
+	'';
+      };
+    };
+  };
+}

system/server/lemmy.nix

@@ -0,0 +1,25 @@
+{outputs, ...}: {
+  services = {
+    lemmy = {
+      enable = true;
+      nginx.enable = true;
+      database.createLocally = true;
+      settings = {
+        hostname = "lemmy.${outputs.secrets.jimDomain}";
+        email = {
+          smtp_server = "mx.${outputs.secrets.jimDomain}:587";
+          smtp_login = "noreply@${outputs.secrets.jimDomain}";
+          smtp_from_address = "Jimbo's Lemmy <noreply@${outputs.secrets.jimDomain}>";
+          smtp_password = outputs.secrets.noreplyPassword;
+          tls_type = "starttls";
+        };
+      };
+    };
+
+    # Add SSL to webpage
+    nginx.virtualHosts."lemmy.${outputs.secrets.jimDomain}" =  {
+      enableACME = true;
+      forceSSL = true;
+    };
+  };
+}

system/server/mailserver.nix

@@ -0,0 +1,68 @@
+{pkgs, outputs, ...}: rec {
+  # Mail server
+  mailserver = rec {
+    enable = true;
+    openFirewall = false;
+    domains = [ "${outputs.secrets.jimDomain}" ];
+    fqdn = "mx.${outputs.secrets.jimDomain}";
+    certificateScheme = "acme-nginx";
+    localDnsResolver = false;
+    redis.port = 1515;
+
+    # Dmarc info
+    dmarcReporting = {
+      enable = true;
+      domain = "${outputs.secrets.jimDomain}";
+      localpart = "noreply";
+      organizationName = "Jimbo's Files";
+    };
+        
+    # A list of accounts, passwords generated with nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
+    loginAccounts = {
+      "noreply@${outputs.secrets.jimDomain}" = {
+        hashedPasswordFile = pkgs.writeText "noreply" outputs.secrets.noreplyMailHash;
+        sendOnly = true;
+      };    
+      "jimbo@${outputs.secrets.jimDomain}" = {
+        hashedPasswordFile = pkgs.writeText "jimbo" outputs.secrets.jimboMailHash;
+        aliases = [ "james@${outputs.secrets.jimDomain}" "contact@${outputs.secrets.jimDomain}" ];
+      };
+      "lunamoonlight@${outputs.secrets.jimDomain}" = {
+        hashedPasswordFile = pkgs.writeText "luna" outputs.secrets.lunaMailHash;
+      };
+      "freecorn1854@${outputs.secrets.jimDomain}" = {
+        hashedPasswordFile = pkgs.writeText "freecorn" outputs.secrets.freecornMailHash;
+      };
+      "tinyattack09@${outputs.secrets.jimDomain}" = {
+        hashedPasswordFile = pkgs.writeText "tiny" outputs.secrets.tinyMailHash;
+      };
+    };
+  };
+
+  # Related services
+  services = {
+    # Roundcube mail server
+    roundcube = {
+     enable = true;
+     hostName = "mail.${outputs.secrets.jimDomain}";
+     extraConfig = ''
+       $config['smtp_server'] = "tls://${mailserver.fqdn}";
+       $config['smtp_user'] = "%u";
+       $config['smtp_pass'] = "%p";
+     '';
+    };
+
+    # Force the mailserver to use a different redis port
+    redis.servers.rspamd.port = 1515;
+
+    # The hostname mail ports use
+    nginx.virtualHosts."mx.${outputs.secrets.jimDomain}" =  {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:1390";
+        proxyWebsockets = true;
+      };
+    };
+  };
+}

system/server/mariadb.nix

@@ -0,0 +1,25 @@
+{pkgs, ...}: {
+  services.mysql = {
+    enable = true;
+    package = pkgs.mariadb;
+    dataDir = "/var/lib/mysql";
+    ensureDatabases = [
+      "minecraft"
+      "photoprism"
+    ];
+    ensureUsers = [
+      {
+        name = "minecraft";
+        ensurePermissions = {
+          "minecraft.*" = "ALL PRIVILEGES";
+        };
+      }
+      {
+        name = "photoprism";
+        ensurePermissions = {
+          "photoprism.*" = "ALL PRIVILEGES";
+        };
+      }
+    ];
+  };
+}

system/server/mastodon.nix

@@ -0,0 +1,17 @@
+{pkgs, outputs, ...}: {
+  services.mastodon = {
+    enable = true;
+    localDomain = "social.${outputs.secrets.jimDomain}";
+    streamingProcesses = 4;
+    configureNginx = true;
+    smtp = {
+      createLocally = false;
+      host = "mx.${outputs.secrets.jimDomain}";
+      port = 587;
+      authenticate = true;
+      fromAddress = "Jimbo's Mastodon <noreply@${outputs.secrets.jimDomain}>";
+      user = "noreply@${outputs.secrets.jimDomain}";
+      passwordFile = pkgs.writeText "smtp_pass.txt" outputs.secrets.noreplyPassword;
+    };
+  };
+}

system/server/matrix-discord.nix

@@ -0,0 +1,16 @@
+{outputs, ...}: {
+    services.matrix-appservice-discord = {
+    enable = true;
+    settings = {
+      auth = {
+        clientID = "${outputs.secrets.discordBotID}";
+	botToken = "${outputs.secrets.discordBotToken}";
+	usePrivilegedIntents = true;
+      };
+      bridge = {
+        domain = "${outputs.secrets.jimDomain}";
+        homeserverUrl = "https://matrix.${outputs.secrets.jimDomain}";
+      };
+    };
+  };
+}

system/server/minecraft/common.nix

@@ -0,0 +1,68 @@
+{pkgs, ...}: {
+  # Common properties
+  serverProperties = {
+    enforce-secure-profile = false;
+    max-players = 20;
+    online-mode = false;
+    spawn-protection = 0;
+    view-distance = 10;
+    simulation-distance = 10;
+    white-list = true;
+  };
+
+  # Common whitelist
+  whitelist = {
+    K5G = "8656dc10-6050-4a17-b29e-88c4babbc54c";
+    JimmJam = "2f7affee-e10b-450f-a5e2-44c79a14a109";
+    Foxzilla04 = "f583f591-ad9b-4a30-8d91-514881b31394";
+    DewDemolisher = "9205524f-3886-483d-b471-82bb9905671a";
+    Freecorn1854 = "8299cd8d-3cd4-4779-8180-0d9db6dc12a9";
+    Tinyattack09 = "aaa8e9e2-4e51-4925-b9df-8a9504aec5d5";
+    Ankha3000 = "dd65a277-f618-411e-812c-900c9c7e82d9";
+    catoiico = "01f10cdf-c146-437e-99b1-2278b5dbe420";
+    Sp0ok7 = "016c3daa-3dd5-4631-ae79-3a6f48d7cbe6";
+    PooxterMooxter = "c973f4b5-ab50-45e3-b3eb-36286a6f66aa";
+  };
+
+  # Common plugins
+  paperSymlinks = {
+    "plugins/Backuper.jar" = builtins.fetchurl {
+      url = "https://cdn.modrinth.com/data/7cMAqMND/versions/nkcNIvUw/Backuper-3.0.1.jar";
+      sha256 = "081hvs7khd9s8598i59ai8n0idp85rgc89m9hpfajwym9rmy7il4";
+    };
+    "plugins/BungeeGuard.jar" = builtins.fetchurl {
+      url = "https://github.com/lucko/BungeeGuard/releases/download/v1.3.3/BungeeGuard.jar";
+      sha256 = "0cackavwk7kl71hn1i78hcvkdp7q81srq35nranpvysbmm8v34vk";
+    };
+    "plugins/EssentialsX.jar" = builtins.fetchurl {
+      url = "https://ci.ender.zone/job/EssentialsX/lastSuccessfulBuild/artifact/jars/EssentialsX-2.21.0-dev+111-b54c8c1.jar";
+      sha256 = "0kcsgz5kcfbjc3nbdlgp549y497m4v90dnjqkv30sd1bfyzs9i5z";
+    };
+    "plugins/EssentialsXChat.jar" = builtins.fetchurl {
+      url = "https://ci.ender.zone/job/EssentialsX/lastSuccessfulBuild/artifact/jars/EssentialsXChat-2.21.0-dev+111-b54c8c1.jar";
+      sha256 = "0nraiclvnpl69gigs7h6vq55iksfd47clbzp7n3rsjmgvrbl1wil";
+    };
+    "plugins/LuckPerms.jar" = builtins.fetchurl {
+      url = "https://download.luckperms.net/1556/bukkit/loader/LuckPerms-Bukkit-5.4.141.jar";
+      sha256 = "02ad0dl34vdk6b1wyflqa6wq440xrh5w7yf3z3w1x1g089myddw4";
+    };
+    "plugins/ProtocolLib.jar" = builtins.fetchurl {
+      url = "https://ci.dmulloy2.net/job/ProtocolLib/lastSuccessfulBuild/artifact/build/libs/ProtocolLib.jar";
+      sha256 = "16krc7pyav4khnaxkyg27i5yxsgcdkildrn4nm5bhzh1f0ngqv2s";
+    };
+    "plugins/Vault.jar" = builtins.fetchurl {
+      url = "https://github.com/MilkBowl/Vault/releases/download/1.7.3/Vault.jar";
+      sha256 = "07fhfz7ycdlbmxsri11z02ywkby54g6wi9q0myxzap1syjbyvdd6";
+    };
+    "plugins/VoiceChat.jar" = builtins.fetchurl {
+      url = "https://cdn.modrinth.com/data/9eGKb6K1/versions/nS19YToN/voicechat-bukkit-2.5.20.jar";
+      sha256 = "023wjx0zxf9rc2x9vsqg398wapz0nlwfs5g6c8pci3qx75i5s4jx";
+    };
+  };
+
+  # Config files
+  configSymlinks = {
+    "plugins/Essentials/config.yml" = ./essentialsconfig.yml;
+    "plugins/voicechat/voicechat-server.properties" = ./vcserver.properties;
+  };
+}

system/server/minecraft/default.nix

@@ -0,0 +1,17 @@
+{inputs, ...}: {
+  imports = [
+    inputs.nix-minecraft.nixosModules.minecraft-servers
+    ./servers/velocity.nix
+    ./servers/dewdemolisher.nix
+    ./servers/johnside.nix
+    ./servers/blockworld.nix
+    ./servers/uberbeta.nix
+    #./servers/freaktards.nix
+  ];
+  nixpkgs.overlays = [ inputs.nix-minecraft.overlay ];
+
+  services.minecraft-servers = {
+    enable = true;
+    eula = true;
+  };
+}

system/server/minecraft/servers/blockworld.nix

@@ -0,0 +1,17 @@
+{pkgs, ...}: let
+  common = import ../common.nix { inherit pkgs; };
+in {
+  services.minecraft-servers.servers.blockworld = {
+    enable = true;
+    autoStart = false;
+    package = pkgs.paperServers.paper-1_21_1;
+    jvmOpts = "-Xmx3072M";
+    serverProperties = common.serverProperties // {
+      difficulty = 2;
+      server-port = 30012;
+      motd = "§fArchival §l§n§cBloxelcom §r§fMinecraft server.";
+    };
+    whitelist = common.whitelist;
+    symlinks = common.paperSymlinks // common.configSymlinks;
+  };
+}

system/server/minecraft/servers/dewdemolisher.nix

@@ -0,0 +1,16 @@
+{pkgs, ...}: let
+  common = import ../common.nix { inherit pkgs; };
+in {
+  services.minecraft-servers.servers.dewdemolisher = {
+    enable = true;
+    package = pkgs.paperServers.paper-1_21_1;
+    jvmOpts = "-Xmx3072M";
+    serverProperties = common.serverProperties // {
+      difficulty = 2;
+      server-port = 30010;
+      motd = "§l§aDew Demolisher is here.";
+    };
+    whitelist = common.whitelist;
+    symlinks = common.paperSymlinks // common.configSymlinks;
+  };
+}

system/server/minecraft/servers/johnside.nix

@@ -0,0 +1,65 @@
+{pkgs, outputs, ...}: let
+  common = import ../common.nix { inherit pkgs; };
+in {
+  services = {
+    minecraft-servers.servers.johnside = {
+      enable = true;
+      package = pkgs.paperServers.paper-1_20_6;
+      jvmOpts = "-Xmx3072M";
+      serverProperties = common.serverProperties // {
+        difficulty = 2;
+        server-port = 30009;
+        motd = "§l§9Johnside SMP§r §l§fworld for §4John lovers only.";
+      };
+      whitelist = common.whitelist;
+      symlinks = common.paperSymlinks // common.configSymlinks // {
+        "plugins/BlueMap.jar" = builtins.fetchurl {
+          url = "https://cdn.modrinth.com/data/swbUV1cr/versions/TL5ElRWX/BlueMap-5.3-spigot.jar";
+          sha256 = "08ls3wk0333vjg49kcmri884pcgm2xk9xdhwcxyffbh4ra0xrlbw";
+        };
+        "plugins/BlueMapOfflinePlayers.jar" = builtins.fetchurl {
+          url = "https://github.com/TechnicJelle/BlueMapOfflinePlayerMarkers/releases/download/v3.0/BlueMapOfflinePlayerMarkers-3.0.jar";
+          sha256 = "1f07w53q7yr4mvph7013d7ajxmp4lnsv6b1ab14y2x0bmqv39nwr";
+        };
+        "plugins/BlueMapMarkerManager.jar" = builtins.fetchurl {
+          url = "https://cdn.modrinth.com/data/a8UoyV2h/versions/E0XoPfJV/BMM-2.1.5.jar";
+          sha256 = "1vpnqglybysxnqyzkjnwbwg000dqkbk516apzvhmg39wlfaysl9d";
+        };
+        "plugins/CustomDiscs.jar" = builtins.fetchurl {
+          url = "https://github.com/Navoei/CustomDiscs/releases/download/v3.0/custom-discs-3.0.jar";
+          sha256 = "0xv0zrkdmjx0d7l34nqag8j004pm9zqivc12d3zy9pdrkv7pz87d";
+        };
+        "plugins/NotTooExpensive.jar" = builtins.fetchurl {
+          url = "https://github.com/Mrredstone5230/Not-Too-Expensive/releases/download/1.1/not-too-expensive-1.1.jar";
+          sha256 = "0da4v5l7iwry3wc21292lkmjprgmign4vdshzmhp7qc9hx26pj2d";
+        };
+        "plugins/SilkTouchHands.jar" = builtins.fetchurl {
+          url = "https://github.com/5U55/SilkTouchSpigot/releases/download/v1.1/SilkTouchv1.1.jar";
+          sha256 = "0mbp73xclr7f5m2lbdfz6is1j8vvyv1qwpl28sm089zrpm73qn6w";
+        };
+      };
+    };
+
+    # BlueMap webhost
+    nginx.virtualHosts."john.${outputs.secrets.jimDomain}" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:31010";
+        proxyWebsockets = true;
+      };
+    };
+  };
+
+  # Allow Nginx to read and write to paths
+  systemd.services.nginx.serviceConfig = {
+    ReadWritePaths = [ "/var/www/Jimbo-Landing-Page/streams/hls/" ];
+  };
+
+  # Open HTTP and HTTPs ports
+  networking.firewall = {
+    allowedTCPPorts = [
+      80 443 # Nginx
+    ];
+  };
+}

system/server/minecraft/servers/uberbeta.nix

@@ -0,0 +1,21 @@
+{pkgs, ...}: let
+  common = import ../common.nix { inherit pkgs; };
+  uberBukkitZip = pkgs.fetchzip {
+    url = "https://github.com/Moresteck/Project-Poseidon-Uberbukkit/releases/download/2.0.0/uberbukkit-2.0.0-java17.zip";
+    sha256 = "m4hgcqXJ43SnBGn6qNBGeEcXFv5Q8f/VFYJmx3aJ9PE=";
+    stripRoot = false;
+  };
+  uberBukkit = pkgs.vanillaServers.vanilla.overrideAttrs (oldAttrs: {
+    src = "${uberBukkitZip}/uberbukkit-2.0.0.jar";
+  });
+in {
+  services.minecraft-servers.servers.uberbeta = {
+    enable = true;
+    package = uberBukkit;
+    jvmOpts = "-Xmx512M";
+    serverProperties = common.serverProperties // {
+      difficulty = 3;
+      server-port = 30005;
+    };
+  };
+}

system/server/minecraft/servers/velocity.nix

@@ -0,0 +1,49 @@
+{pkgs, ...}: let
+  common = import ../common.nix { inherit pkgs; };
+in {
+  services.minecraft-servers.servers.velocity = {
+    enable = true;
+    package = pkgs.velocityServers.velocity;
+    jvmOpts = "-Xmx512M";
+    symlinks = {
+      "plugins/Geyser.jar" = builtins.fetchurl {
+        url = "https://download.geysermc.org/v2/projects/geyser/versions/2.4.2/builds/660/downloads/velocity";
+        sha256 = "09z938v6xrgbiba8rxgi7cdh3xxkv9fdampy15k6fmwddmj9y4a2";
+      };
+      "plugins/Floodgate.jar" = builtins.fetchurl {
+        url = "https://download.geysermc.org/v2/projects/floodgate/versions/2.2.3/builds/109/downloads/velocity";
+        sha256 = "1hxdf38qzpzdnyn2gn1152fyd54bi37i0ayc82dgcjf0qrcbmv0c";
+      };
+      "plugins/LuckPerms.jar" = builtins.fetchurl {
+        url = "https://download.luckperms.net/1556/velocity/LuckPerms-Velocity-5.4.141.jar";
+        sha256 = "0j5f7r3g8h4f8z8ppakwfk96hijp3slr0vxyj9v8x4h8w5rcl9d1";
+      };
+      "plugins/SkinsRestorer.jar" = builtins.fetchurl {
+        url = "https://github.com/SkinsRestorer/SkinsRestorer/releases/download/15.4.2/SkinsRestorer.jar";
+        sha256 = "14nl9mi958bfqwqz9182cxj7m6l15kalq3wjmjqzy50s52si35wf";
+      };
+      "plugins/ViaVersion.jar" = builtins.fetchurl {
+        url = "https://github.com/ViaVersion/ViaVersion/releases/download/5.0.3/ViaVersion-5.0.3.jar";
+        sha256 = "02gf91ysialgvbl0w8awa0dsi1yb33ac7clmz0wika1xigk9z10r";
+      };
+      "plugins/ViaBackwards.jar" = builtins.fetchurl {
+        url = "https://github.com/ViaVersion/ViaBackwards/releases/download/5.0.3/ViaBackwards-5.0.3.jar";
+        sha256 = "1wqk68pjrzl1zhajb9lxa1s6wzj85rb0c2riycv9yysr5bcxssqi";
+      };
+      "plugins/Voicechat.jar" = builtins.fetchurl {
+        url = "https://cdn.modrinth.com/data/9eGKb6K1/versions/svvcJhgC/voicechat-velocity-2.5.20.jar";
+        sha256 = "0nw85x24qa9skbhfgbhsjl2r7d9xshr9f04nnq490zbgz7716lqq";
+      };
+    };
+  };
+
+  # Open ports for proxy
+  networking.firewall = {
+    allowedTCPPorts = [
+      25565 19132 30013 5657 # Minecraft server info
+    ];
+    allowedUDPPorts = [
+      25565 19132 30013 # Minecraft server, VC, and Bedrock
+    ];
+  };
+}

system/server/minecraft/vcserver.properties

@@ -0,0 +1,36 @@
+# Simple Voice Chat server config v2.5.16
+
+# The port of the voice chat server, "-1" sets the port to the Minecraft servers port
+port=-1
+# The distance to where the voice can be heard
+max_voice_distance=48.0
+# The multiplier the voice distance will be reduced by when sneaking
+crouch_distance_multiplier=1.0
+# The multiplier the voice distance will be reduced by when whispering
+whisper_distance_multiplier=0.5
+# The opus codec
+codec=VOIP
+# The maximum size in bytes in a voice packet
+# Set this to a lower value if your voice packets don't arrive
+mtu_size=1024
+# The frequency in which keep alive packets are sent
+# Setting this to a higher value may result in timeouts
+keep_alive=1000
+# If group chats are allowed
+enable_groups=true
+# If players are allowed to record the voice chat
+allow_recording=true
+# If spectators are allowed to talk to other players
+spectator_interaction=false
+# If spectators can talk to players they are spectating
+spectator_player_possession=false
+# If players without the mod should get kicked from the server
+force_voice_chat=false
+# The amount of milliseconds, the server should wait to check if the player has the mod installed
+# Only active when force_voice_chat is set to true
+login_timeout=10000
+# The range where the voice chat should broadcast audio to
+# A value <0 means 'max_voice_distance'
+broadcast_range=-1.0
+# If the voice chat server should reply to pings
+allow_pings=true

system/server/misc.nix

@@ -0,0 +1,10 @@
+{pkgs, ...}: {
+  # Install programs system-wide
+  environment.systemPackages = with pkgs; [
+    mdadm
+  ];
+  services = {
+    snowflake-proxy.enable = true;
+    logrotate.checkConfig = false;
+  };
+}

system/server/nextcloud.nix

@@ -0,0 +1,45 @@
+{pkgs, outputs, ...}: {
+  services = {
+    nextcloud = {
+      enable = true;
+      package = pkgs.nextcloud29;
+      hostName = "cloud.${outputs.secrets.jimDomain}";
+      datadir = "/mnt/nextcloud";
+      https = true;
+      config = {
+        adminuser = "jimbo";
+        adminpassFile = "/mnt/nextcloud/password.txt";
+      };
+      settings = {
+        trusted_proxies = [ "127.0.0.1" ];
+        trusted_domains = [ "cloud.${outputs.secrets.jimDomain}" ];
+        overwriteprotocol = "https";
+
+        # Mailserver settings
+        mail_smtphost = "mx.${outputs.secrets.jimDomain}";
+        mail_domain = "${outputs.secrets.jimDomain}";
+        mail_from_address = "noreply";
+        mail_smtpauth = "true";
+        mail_smtpname = "noreply@${outputs.secrets.jimDomain}";
+        mail_smtppassword = outputs.secrets.noreplyPassword;
+        mail_smtpmode = "smtp";
+        mail_smtpport = 587;
+      };
+    };
+    nginx.virtualHosts."cloud.${outputs.secrets.jimDomain}" =  {
+      enableACME = true;
+      addSSL = true;
+      locations."/" = {
+        proxyWebsockets = true;
+        extraConfig = "
+         location /.well-known/carddav {
+            return 301 $scheme://$host/remote.php/dav;
+          }
+          location /.well-known/caldav {
+            return 301 $scheme://$host/remote.php/dav;
+          }
+       ";
+      };
+    };
+  };
+}

system/server/nfs.nix

@@ -0,0 +1,9 @@
+{
+  # NFS server
+  services.nfs.server = {
+    enable = true;
+    exports = ''
+      /export/JimboNFS *(rw,no_subtree_check)
+    '';
+  };
+}

system/server/nginx.nix

@@ -0,0 +1,74 @@
+{pkgs, outputs, ...}: {
+  services.nginx = {
+    enable = true;
+    package = (pkgs.nginx.override {
+      modules = with pkgs.nginxModules; [ rtmp ];
+    });
+    recommendedTlsSettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+    recommendedProxySettings = true;
+    virtualHosts = {
+      # Landing page
+      "${outputs.secrets.jimDomain}" =  {
+        enableACME = true;
+        addSSL = true;
+        root = "/var/www/Jimbo-Landing-Page";
+        locations = {
+          "/.well-known/matrix/client" = {
+            extraConfig = ''
+              default_type application/json;
+              return 200 '
+              {
+                "m.homeserver": {
+                  "base_url": "https://matrix.${outputs.secrets.jimDomain}"
+                },
+                "m.identity_server": {
+                  "base_url": "https://matrix.org"
+                },
+                "org.matrix.msc3575.proxy": {
+                  "url": "https://matrix.${outputs.secrets.jimDomain}"
+                }
+              }';
+            '';
+          };
+          "/.well-known/matrix/server" = {
+            extraConfig = ''
+              default_type application/json;
+              return 200 '{"m.server": "matrix.${outputs.secrets.jimDomain}:443"}';
+            '';
+          };
+        };
+      };
+    };
+    appendConfig = ''
+      rtmp {
+        server {
+          listen 1935;
+          chunk_size 4096;
+          allow publish all;
+          application stream {
+            record off;
+            live on;
+            allow play all;
+            hls on;
+            hls_path /var/www/Jimbo-Landing-Page/streams/hls/;
+            hls_fragment_naming system;
+            hls_fragment 3;
+            hls_playlist_length 40;
+          }
+        }
+      }
+    '';
+  };
+
+  # Allow Nginx to read and write to paths
+  systemd.services.nginx.serviceConfig = {
+    ReadWritePaths = [ "/var/www/Jimbo-Landing-Page/streams/hls/" ];
+  };
+
+  # Open HTTP and HTTPs ports
+  networking.firewall.allowedTCPPorts = [
+    80 443
+  ];
+}

system/server/owncast.nix

@@ -0,0 +1,18 @@
+{outputs, ...}: {
+  services = {
+    owncast = {
+      enable = true;
+      port = 8060;
+      rtmp-port = 1945;
+      listen = "0.0.0.0";
+    };
+    nginx.virtualHosts."live.${outputs.secrets.jimDomain}" =  {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:8060";
+        proxyWebsockets = true;
+      };
+    };
+  };
+}

system/server/photoprism.nix

@@ -0,0 +1,29 @@
+{outputs, ...}: {
+  services = {
+    photoprism = {
+      enable = true;
+      port = 2342;
+      originalsPath = "/var/lib/private/photoprism/originals";
+      address = "0.0.0.0";
+      settings = {
+        PHOTOPRISM_ADMIN_USER = "jimbo";
+        PHOTOPRISM_ADMIN_PASSWORD = "${outputs.secrets.prismAdminPass}";
+        PHOTOPRISM_DEFAULT_LOCALE = "en";
+        PHOTOPRISM_DATABASE_DRIVER = "mysql";
+        PHOTOPRISM_DATABASE_NAME = "photoprism";
+        PHOTOPRISM_DATABASE_SERVER = "/run/mysqld/mysqld.sock";
+        PHOTOPRISM_DATABASE_USER = "photoprism";
+        PHOTOPRISM_SITE_URL = "https://gallery.${outputs.secrets.jimDomain}";
+        PHOTOPRISM_SITE_TITLE = "Jimbo's PhotoPrism";
+      };
+    };
+    nginx.virtualHosts."gallery.${outputs.secrets.jimDomain}" =  {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:2342";
+        proxyWebsockets = true;
+      };
+    };
+  };
+}

system/server/pixelfed.nix

@@ -0,0 +1,31 @@
+{pkgs, outputs, ...}: {
+  services.pixelfed = {
+    enable = true;
+    domain = "pics.${outputs.secrets.jimDomain}";
+    secretFile = pkgs.writeText "appkey" outputs.secrets.pixelfedKey;
+    settings = {
+      APP_NAME = ''"Jimbo's Pixelfed"'';
+      INSTANCE_DESCRIPTION = ''"The Jimbosfiles Pixelfed Instance"'';
+      INSTANCE_CONTACT_EMAIL = "jimbo@${outputs.secrets.jimDomain}";
+      OPEN_REGISTRATION = true;
+      APP_LOCALE = "en";
+      INSTANCE_DISCOVER_PUBLIC = false;
+      STORIES_ENABLED = true;
+
+      # Mail config
+      ENFORCE_EMAIL_VERIFICATION = true;
+      MAIL_FROM_ADDRESS = "noreply@${outputs.secrets.jimDomain}";
+      MAIL_FROM_NAME = ''"Jimbo's Pixelfed <noreply@${outputs.secrets.jimDomain}>"'';
+      MAIL_ENCRYPTION = "tls";
+      MAIL_DRIVER = "smtp";
+      MAIL_HOST = "mx.${outputs.secrets.jimDomain}";
+      MAIL_PORT = 587;
+      MAIL_USERNAME = "noreply@${outputs.secrets.jimDomain}";
+      MAIL_PASSWORD = "${outputs.secrets.noreplyPassword}";
+    };
+    nginx = {
+      enableACME = true;
+      forceSSL = true;
+    };
+  };
+}

system/server/samba.nix

@@ -0,0 +1,37 @@
+{
+  services = {
+    samba = {
+      enable = true;
+      securityType = "user";
+      openFirewall = true;
+      extraConfig = let
+        ips = import ../modules/ips.nix;
+      in ''
+        workgroup = WORKGROUP
+        server string = JimSMB
+        security = user 
+        hosts allow = ${ips.localSpan}. 127.0.0.1 localhost
+        hosts deny = 0.0.0.0/0
+        guest account = nobody
+        map to guest = bad user
+      '';
+      shares = {
+        roms = {
+          comment = "Samba share with my ROMs";
+          path = "/export/JimboNFS/Downloads/GameFiles/ROMS";
+          browseable = "yes";
+          "read only" = "no";
+          "guest ok" = "no";
+          "create mask" = "0644";
+          "directory mask" = "0755";
+        };
+      };
+    };
+
+    # Advertise to Windows
+    samba-wsdd = {
+      enable = true;
+      openFirewall = true;
+    };
+  };
+}

system/server/synapse.nix

@@ -0,0 +1,91 @@
+{pkgs, outputs, ...}: {
+  services = {
+    # Synapse Matrix server
+    matrix-synapse = {
+      enable = true;
+      settings = {
+        server_name = "${outputs.secrets.jimDomain}";
+        public_baseurl = "https://matrix.${outputs.secrets.jimDomain}";
+        suppress_key_server_warning = true;
+
+        # Set the network config
+        listeners = [{
+          port = 8008;
+          bind_addresses = [ "::" "0.0.0.0" ];
+          resources = [ { compress = false;  names = [ "client" "federation" ]; } ];
+          type = "http";
+          tls = false;
+          x_forwarded = true;
+        }];
+
+        # Enable smtp for password resets
+        email = {
+          notif_from = "Jimbo's Matrix <noreply@${outputs.secrets.jimDomain}>";
+          smtp_host = "mx.${outputs.secrets.jimDomain}";
+          smtp_user = "noreply@${outputs.secrets.jimDomain}";
+          smtp_pass = outputs.secrets.noreplyPassword;
+          enable_tls = true;
+          smtp_port = 587;
+          require_transport_security = true;
+        };
+
+	# Allows a Discord/Matrix bridge, comment on first use and copy using instructions
+	app_service_config_files = [
+          # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/
+          # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml
+          "/var/lib/matrix-synapse/discord-registration.yaml"
+        ];
+
+        # Disable registration without email
+        registrations_require_3pid = [ "email" ];
+
+        # Allow only this range of emails
+        allowed_local_3pids = [{
+          medium = "email";
+          pattern = "^[^@]+@jimbosfiles\\.com$";
+        }];
+
+        # Set the type of database
+        database.name = "sqlite3";
+
+        # Allow account registration
+        enable_registration = true;
+
+        # General settings
+        url_preview_enabled = true;
+        max_upload_size = "50M";
+        report_stats = false;
+
+        # Ratelimiting
+        burst_count = 15;
+      };
+    };
+
+    # Sliding sync proxy for Matrix
+    matrix-sliding-sync = let
+      matrixSecretFile = pkgs.writeText "matrixsecret" ''
+        SYNCV3_SECRET=${outputs.secrets.matrixSecret}
+      '';
+    in {
+      enable = true;
+      settings = {
+        SYNCV3_SERVER = "https://matrix.${outputs.secrets.jimDomain}";
+        SYNCV3_BINDADDR = "0.0.0.0:8009";
+      };
+      environmentFile = "${matrixSecretFile}";
+    };
+
+    # Proxy for both Synapse and Sliding Sync
+    nginx.virtualHosts."matrix.${outputs.secrets.jimDomain}" = {
+      enableACME = true;
+      forceSSL = true;
+      locations = {
+        "/".extraConfig = ''return 403;'';
+        "/client".proxyPass = "http://127.0.0.1:8009";
+        "/_matrix".proxyPass = "http://127.0.0.1:8008";
+        "/_matrix/client/unstable/org.matrix.msc3575/sync".proxyPass = "http://127.0.0.1:8009";
+        "/_synapse/client".proxyPass = "http://127.0.0.1:8008";
+      };
+    };
+  };
+}

system/server/transmission.nix

@@ -0,0 +1,20 @@
+{pkgs, outputs, ...}: {
+  services = {
+    transmission = {
+      enable = true;
+      credentialsFile = pkgs.writeText "credentials" outputs.secrets.transmissionCredFile;
+      openPeerPorts = true;
+      settings = {
+        rpc-authentication-required = true;
+      };
+    };
+    nginx.virtualHosts."torrent.${outputs.secrets.jimDomain}" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:9091";
+        proxyWebsockets = true;
+      };
+    };
+  };
+}

system/server/vaultwarden.nix

@@ -0,0 +1,32 @@
+{outputs, ...}: {
+  services = {
+    vaultwarden = {
+      enable = true;
+      config = {
+        DOMAIN = "https://warden.${outputs.secrets.jimDomain}";
+        SIGNUPS_ALLOWED = false;
+        ROCKET_ADDRESS = "127.0.0.1";
+        ROCKET_PORT = 8222;
+        ROCKET_LOG = "critical";
+
+        # Smtp email
+        SMTP_HOST = "mx.${outputs.secrets.jimDomain}";
+        SMTP_FROM = "Jimbo's Vaultwarden <noreply@${outputs.secrets.jimDomain}>";
+        SMTP_FROM_NAME = "Vaultwarden";
+        SMTP_USERNAME = "noreply@${outputs.secrets.jimDomain}";
+        SMTP_PASSWORD = outputs.secrets.noreplyPassword;
+        SMTP_SECURITY = "starttls";
+        SMTP_PORT = 587;
+        SMTP_TIMEOUT = 15;
+      };
+    };
+    nginx.virtualHosts."warden.${outputs.secrets.jimDomain}" =  {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:8222";
+        proxyWebsockets = true;
+      };
+    };
+  };
+}

system/server/wireguard.nix

@@ -0,0 +1,36 @@
+{outputs, ...}: let
+  ips = import ../modules/ips.nix;
+in {
+  # Enable NAT
+  networking = {
+    nat = {
+      enable = true;
+      externalInterface = "${ips.netInt}";
+      internalInterfaces = [ "${ips.wgInt}" ];
+    };
+    firewall.allowedUDPPorts = [ 51820 ];
+  };
+
+  networking.wireguard = {
+    enable = true;
+    interfaces = {
+      # Wireguard interface name can be arbitrary
+      wg0 = {
+        # Determines the IP and subnet of the tunnel interface
+        ips = [ "${ips.wgSpan}.1/24" ];
+        listenPort = 51820;
+	privateKey = outputs.secrets.wireguardPriv;
+        peers = [
+          { # Jimbo Pixel 9
+            publicKey = outputs.secrets.wirePixel9Pub;
+            allowedIPs = [ "${ips.wgSpan}.2/32" ];
+          }
+          { # Oracle VM
+            publicKey = outputs.secrets.wireOraclePub;
+            allowedIPs = [ "${ips.wgSpan}.3/32" ];
+          }
+        ];
+      };
+    };
+  };
+}