Merge branch 'main' of ssh://gitea.xeovalyte.dev:2222/xeovalyte/nix

modules/home/applications/zellij.nix

@@ -1,9 +1,38 @@
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 
 with lib;
 
 let
   cfg = config.settings.applications.zellij;
+  sesh = pkgs.writeScriptBin "sesh" ''
+    #! /usr/bin/env sh
+  
+    # Taken from https://github.com/zellij-org/zellij/issues/884#issuecomment-1851136980
+    # select a directory using zoxide
+    ZOXIDE_RESULT=$(${pkgs.zoxide}/bin/zoxide query --interactive)
+
+    # checks whether a directory has been selected
+    if [[ -z "$ZOXIDE_RESULT" ]]; then
+    	# if there was no directory, select returns without executing
+    	exit 0
+    fi
+    # extracts the directory name from the absolute path
+    SESSION_TITLE=$(echo "$ZOXIDE_RESULT" | sed 's#.*/##')
+
+    # get the list of sessions
+    SESSION_LIST=$(zellij list-sessions -n | awk '{print $1}')
+
+    # checks if SESSION_TITLE is in the session list
+    if echo "$SESSION_LIST" | grep -q "^$SESSION_TITLE$"; then
+    	# if so, attach to existing session
+    	zellij attach "$SESSION_TITLE"
+    else
+    	# if not, create a new session
+    	echo "Creating new session $SESSION_TITLE and CD $ZOXIDE_RESULT"
+    	cd $ZOXIDE_RESULT
+    	zellij attach -c "$SESSION_TITLE"
+    fi
+  '';
 in {
   options = {
     settings.applications.zellij.enable = lib.mkOption {
@@ -19,6 +48,15 @@ in {
       enable = true;
     };
 
+    programs.zoxide = {
+      enable = true;
+      enableZshIntegration = true;
+    };
+
+    home.packages = [
+      sesh
+    ];
+
     home.file.zellij = {
       target = ".config/zellij/config.kdl";
       text = ''
@@ -26,6 +64,7 @@ in {
         keybinds {
           normal {
             bind "Ctrl e" { ToggleFloatingPanes; SwitchToMode "normal"; }
+            bind "Ctrl d" { Detach; }
             bind "Alt 1" { GoToTab 1; }
             bind "Alt 2" { GoToTab 2; }
             bind "Alt 3" { GoToTab 3; }

modules/home/containers/beszel.nix

@@ -0,0 +1,56 @@
+{ config, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.settings.containers.beszel;
+in {
+  options = {
+    settings.containers.beszel.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enable Beszel container
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    settings.services.sops.enable = true;
+
+    services.podman.containers.beszel = {
+      image = "henrygd/beszel:latest";
+      network = "proxy";
+      volumes = [
+        "%h/containers/beszel/data:/beszel_data" 
+        "%h/containers/beszel/socket:/beszel_socket" 
+      ];
+      environment = {
+        DISABLE_PASSWORD_AUTH = false;
+        USER_CREATION = true;
+      };
+    };
+
+    services.podman.containers.beszel-agent = {
+      image = "henrygd/beszel-agent:latest";
+      network = "proxy";
+      volumes = [
+        "%h/containers/beszel/socket:/beszel_socket" 
+        "/run/user/1000/podman/podman.sock:/var/run/podman.sock:ro"
+
+        "${config.sops.secrets."containers/beszel/key".path}:/run/secrets/key" 
+      ];
+      user = 1000;
+      userNS = "keep-id";
+      environment = {
+        LISTEN = "/beszel_socket/beszel.sock";
+        KEY_FILE = "/run/secrets/key";
+        DOCKER_HOST = "unix:///var/run/podman.sock";
+      };
+    };
+
+    sops.secrets = {
+      "containers/beszel/key" = { };
+    };
+  };
+}

modules/home/containers/caddy.nix

@@ -17,20 +17,83 @@ in {
 
   config = mkIf cfg.enable {
     services.podman.containers.caddy = {
-      image = "ghcr.io/iarekylew00t/caddy-cloudflare:latest";
+      image = "localhost/tboomers/caddy-custom:latest";
+      network = "proxy";
       ports = [
         "1080:80"
-        "1443:8443"
+        "1443:443"
       ];
       volumes = [
-        "~/containers/caddy/Caddyfile:/etc/caddy/Caddyfile"
+        "%h/containers/caddy/Caddyfile:/etc/caddy/Caddyfile"
+        "%h/containers/caddy/acme_key:/etc/caddy/acme_key"
+        "%h/containers/caddy/data:/data"
       ];
     };
 
     home.file."containers/caddy/Caddyfile".text = ''
-      localhost
+      *.tbmrs.nl, tbmrs.nl {
+        tls {
+          dns transip xeovalyte /etc/caddy/acme_key
+          resolvers 1.1.1.1
+        }
 
-      response "Hello, world!"
+        @root host tbmrs.nl
+        handle @root {
+          respond "Hello there"
+        }
+
+        @kanidm host auth.tbmrs.nl
+        handle @kanidm {
+          reverse_proxy https://auth.tbmrs.nl
+        }
+
+        @forgejo host git.tbmrs.nl
+        handle @forgejo {
+          reverse_proxy forgejo:3000
+        }
+
+        @immich host photos.tbmrs.nl
+        handle @immich {
+          reverse_proxy immich-server:2283
+        }
+
+        @homepage host home.tbmrs.nl
+        handle @homepage {
+          reverse_proxy homepage:3000
+        }
+
+        @uptime-kuma host uptime.tbmrs.nl
+        handle @uptime-kuma {
+          reverse_proxy uptime-kuma:3001
+        }
+
+        @pingvin-share host share.tbmrs.nl
+        handle @pingvin-share {
+          reverse_proxy pingvin-share:3000
+        }
+      }
+
+      *.local.tbmrs.nl {
+        tls {
+          dns transip xeovalyte /etc/caddy/acme_key
+          resolvers 1.1.1.1
+        }
+
+        @vaultwarden host vault.local.tbmrs.nl
+        handle @vaultwarden {
+          reverse_proxy vaultwarden:80
+        }
+
+        @paperless-ngx host paperless.local.tbmrs.nl
+        handle @paperless-ngx {
+          reverse_proxy paperless-ngx:8000
+        }
+
+        @beszel host monitor.local.tbmrs.nl
+        handle @beszel {
+          reverse_proxy beszel:8090
+        }
+      }
     '';
   };
 }

modules/home/containers/forgejo.nix

@@ -0,0 +1,32 @@
+{ config, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.settings.containers.forgejo;
+in {
+  options = {
+    settings.containers.forgejo.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enable forgejo container
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.podman.containers.forgejo = {
+      image = "codeberg.org/forgejo/forgejo:11";
+      network = "proxy";
+      volumes = [
+        "%h/containers/forgejo/data:/data" 
+      ];
+      environment = {
+        FORGEJO__service__ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
+        FORGEJO__service__SHOW_REGISTRATION_BUTTON = false;
+        FORGEJO__service__ENABLE_PASSWORD_SIGNIN_FORM = false;
+      };
+    };
+  };
+}

modules/home/containers/homepage.nix

@@ -0,0 +1,130 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.settings.containers.homepage;
+in {
+  options = {
+    settings.containers.homepage.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enable homepage container
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.podman.containers.homepage = {
+      image = "ghcr.io/gethomepage/homepage:latest";
+      network = "proxy";
+      volumes = [
+        "%h/containers/homepage/config:/app/config" 
+        "%h/containers/homepage/config/settings.yaml:/app/config/settings.yaml"
+        "%h/containers/homepage/config/services.yaml:/app/config/services.yaml"
+        "%h/containers/homepage/config/docker.yaml:/app/config/docker.yaml"
+        "/run/user/1000/podman/podman.sock:/var/run/podman.sock:ro"
+      ];
+      environment = {
+        HOMEPAGE_ALLOWED_HOSTS = "home.tbmrs.nl";
+      };
+    };
+
+    home.file."containers/homepage/config/settings.yaml".source = (pkgs.formats.yaml { }).generate "settings" {
+      title = "Timo's Server";
+      description = "server from Timo";
+      theme = "dark";
+      color = "slate";
+    };
+
+    home.file."containers/homepage/config/services.yaml".source = (pkgs.formats.yaml { }).generate "services" [
+      {
+        "Infra" = [
+          {
+            "Kanidm" = {
+              href = "https://auth.tbmrs.nl";
+              description = "Oauth2 and ldap provider";
+              icon = "kanidm";
+              server = "podman";
+              container = "kanidm";
+            };    
+          }
+          {
+            "Uptime Kuma" = {
+              href = "https://uptime.tbmrs.nl";
+              description = "Uptime and status";
+              icon = "uptime-kuma";
+              server = "podman";
+              container = "uptime-kuma";
+            };    
+          }
+          {
+            "Beszel" = {
+              href = "https://monitor.local.tbmrs.nl";
+              description = "Server monitoring";
+              icon = "beszel";
+              server = "podman";
+              container = "beszel";
+            };    
+          }
+        ];
+      }
+      {
+        "Services" = [
+          {
+            "Forgejo" = {
+              href = "https://git.tbmrs.nl";
+              description = "Git server";
+              icon = "forgejo";
+              server = "podman";
+              container = "forgejo";
+            };    
+          }
+          {
+            "Immich" = {
+              href = "https://photos.tbmrs.nl";
+              description = "Photo's and videos";
+              icon = "immich";
+              server = "podman";
+              container = "immich-server";
+            };    
+          }
+          {
+            "Pingvin" = {
+              href = "https://share.tbmrs.nl";
+              description = "File sharing";
+              icon = "pingvin-share";
+              server = "podman";
+              container = "pingvin-share";
+            };    
+          }
+          {
+            "Vaultwarden" = {
+              href = "https://vault.local.tbmrs.nl";
+              description = "Password management";
+              icon = "vaultwarden";
+              server = "podman";
+              container = "vaultwarden";
+            };    
+          }
+          {
+            "Paperless" = {
+              href = "https://paperless.local.tbmrs.nl";
+              description = "Documents management";
+              icon = "paperless-ngx";
+              server = "podman";
+              container = "paperless-ngx";
+            };    
+          }
+        ];
+      }
+    ];
+
+    home.file."containers/homepage/config/docker.yaml".source = (pkgs.formats.yaml {}).generate "docker" {
+      podman = {
+        socket = "/var/run/podman.sock";  
+      };
+    };
+  };
+}

modules/home/containers/immich.nix

@@ -0,0 +1,75 @@
+{ config, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.settings.containers.immich;
+in {
+  options = {
+    settings.containers.immich.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enable immich container
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.podman.containers.immich-server = {
+      image = "ghcr.io/immich-app/immich-server:release";
+      network = "proxy";
+      volumes = [
+        "%h/containers/immich/upload:/usr/src/app/upload"
+        "/etc/localtime:/etc/localtime:ro" 
+      ];
+      extraConfig = {
+        Unit = {
+          After = [
+            "podman-immich-redis.service"
+            "podman-immich-database.service"
+          ];
+          Requires = [
+            "podman-immich-redis.service"
+            "podman-immich-database.service"
+          ];
+        };
+      };
+      environment = {
+        DB_PASSWORD = "changeme";
+        DB_USERNAME = "postgres";
+        DB_DATABASE_NAME = "immich";
+        DB_HOSTNAME = "immich-database";
+        REDIS_HOSTNAME = "immich-redis";
+      };
+    };
+
+    services.podman.containers.immich-machine-learning = {
+      image = "ghcr.io/immich-app/immich-machine-learning:release";
+      network = "proxy";
+      volumes = [
+        "%h/containers/immich/model-cache:/cache"
+      ];
+    };
+
+    services.podman.containers.immich-redis = {
+      image = "docker.io/valkey/valkey:8-bookworm@sha256:42cba146593a5ea9a622002c1b7cba5da7be248650cbb64ecb9c6c33d29794b1";
+      network = "proxy";
+    };
+
+    services.podman.containers.immich-database = {
+      image = "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:739cdd626151ff1f796dc95a6591b55a714f341c737e27f045019ceabf8e8c52";
+      network = "proxy";
+      volumes = [
+        "%h/containers/immich/database-data:/var/lib/postgresql/data"
+      ];
+      environment = {
+        POSTGRES_PASSWORD = "changeme";
+        POSTGRES_USER = "postgres";
+        POSTGRES_DB = "immich";
+        POSTGRES_INITDB_ARGS = "--data-checksums";
+      };
+      exec = ''postgres -c shared_preload_libraries=vectors.so -c 'search_path="$$user", public, vectors' -c logging_collector=on -c max_wal_size=2GB -c shared_buffers=512MB -c wal_compression=on'';
+    };
+  };
+}

modules/home/containers/kanidm.nix

@@ -0,0 +1,40 @@
+{ config, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.settings.containers.nginx;
+in {
+  options = {
+    settings.containers.kanidm.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enable kanidm container
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.podman.containers.kanidm = {
+      image = "kanidm/server:latest";
+      network = "proxy";
+      networkAlias = [
+        "auth.tbmrs.nl"
+      ];
+      volumes = [
+        "%h/containers/kanidm/data:/data"
+        "%h/containers/caddy/data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.tbmrs.nl:/data/keys"
+      ];
+      environment = {
+        KANIDM_VERSION = "2";
+        KANIDM_BINDADDRESS = "[::]:443";
+        KANIDM_DB_PATH = "/data/kanidm.db";
+        KANIDM_TLS_CHAIN = "/data/keys/wildcard_.tbmrs.nl.crt";
+        KANIDM_TLS_KEY = "/data/keys/wildcard_.tbmrs.nl.key";
+        KANIDM_DOMAIN = "auth.tbmrs.nl";
+        KANIDM_ORIGIN = "https://auth.tbmrs.nl";
+      };
+    };
+  };
+}

modules/home/containers/network.nix

@@ -0,0 +1,24 @@
+{ config, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.settings.containers.nginx;
+in {
+  options = {
+    settings.containers.network.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enable network
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.podman.networks.proxy = {
+      description = "Container network for the proxy";
+      autoStart = true;
+    };
+  };
+}

modules/home/containers/paperless-ngx.nix

@@ -0,0 +1,97 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.settings.containers.paperless-ngx;
+in {
+  options = {
+    settings.containers.paperless-ngx.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enable Paperless NGX container
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    settings.services.sops.enable = true;
+  
+    services.podman.containers.paperless-ngx = {
+      image = "ghcr.io/paperless-ngx/paperless-ngx:latest";
+      network = "proxy";
+      volumes = [
+        "%h/containers/paperless-ngx/data:/usr/src/paperless/data" 
+        "%h/containers/paperless-ngx/media:/usr/src/paperless/media" 
+        "%h/containers/paperless-ngx/export:/usr/src/paperless/export" 
+        "%h/containers/paperless-ngx/consume:/usr/src/paperless/consume" 
+
+        "${config.sops.secrets."containers/paperless-ngx/db-password".path}:/run/secrets/db-password" 
+        "${config.sops.secrets."containers/paperless-ngx/secret".path}:/run/secrets/secret" 
+        "${config.sops.secrets."containers/paperless-ngx/openid-providers".path}:/run/secrets/openid-providers" 
+      ];
+      environment = {
+        PAPERLESS_REDIS = "redis://paperless-ngx-broker:6379";
+        PAPERLESS_DBHOST = "paperless-ngx-db";
+        PAPERLESS_URL = "https://paperless.local.tbmrs.nl";
+        PAPERLESS_DBPASS_FILE = "/run/secrets/db-password";
+        PAPERLESS_SECRET_KEY_FILE = "/run/secrets/secret";
+
+        PAPERLESS_DISABLE_REGULAR_LOGIN = false;
+        PAPERLESS_APPS = "allauth.socialaccount.providers.openid_connect";
+        PAPERLESS_SOCIALACCOUNT_PROVIDERS_FILE = "/run/secrets/openid-providers";
+        PAPERLESS_SOCIAL_ACCOUNT_SYNC_GROUPS = true;
+      };
+      extraConfig = {
+        Unit = {
+          After = [
+            "sops-nix.service"
+            "podman-paperless-ngx-db.service"
+            "podman-paperless-ngx-broker.service"
+          ];
+          Requires = [
+            "podman-paperless-ngx-db.service"
+            "podman-paperless-ngx-broker.service"
+          ];
+        };
+      };
+    };
+
+    services.podman.containers.paperless-ngx-db = {
+      image = "docker.io/library/postgres:17";
+      network = "proxy";
+      volumes = [
+        "%h/containers/paperless-ngx/db-data:/var/lib/postgresql/data" 
+
+        "${config.sops.secrets."containers/paperless-ngx/db-password".path}:/run/secrets/db-password" 
+      ];
+      environment = {
+        POSTGRES_DB = "paperless";
+        POSTGRES_USER = "paperless";
+        POSTGRES_PASSWORD_FILE = "/run/secrets/db-password";
+      };
+      extraConfig = {
+        Unit = {
+          After = [
+            "sops-nix.service"
+          ];
+        };
+      };
+    };
+
+    services.podman.containers.paperless-ngx-broker = {
+      image = "docker.io/library/redis:7";
+      network = "proxy";
+      volumes = [
+        "%h/containers/paperless-ngx/redis-data:/data" 
+      ];
+    };
+
+    sops.secrets = {
+      "containers/paperless-ngx/db-password" = { };
+      "containers/paperless-ngx/secret" = { };
+      "containers/paperless-ngx/openid-providers" = { };
+    };
+  };
+}

modules/home/containers/pingvin-share.nix

@@ -0,0 +1,73 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.settings.containers.pingvin-share;
+in {
+  options = {
+    settings.containers.pingvin-share.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enable Pingvin share container
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    settings.services.sops.enable = true;
+  
+    services.podman.containers.pingvin-share = {
+      image = "ghcr.io/stonith404/pingvin-share";
+      network = "proxy";
+      volumes = [
+        "%h/containers/pingvin-share/data:/opt/app/backend/data" 
+        # "%h/containers/pingvin-share/config.yaml:/opt/app/config.yaml" 
+        "${config.sops.templates."container-pingvin.yaml".path}:/opt/app/config.yaml" 
+      ];
+      environment = {
+        TRUST_PROXY = true;
+      };
+      userNS = "keep-id";
+      extraConfig = {
+        Unit = {
+          After = [
+            "sops-nix.service"
+          ];
+        };
+      };
+    };
+
+    sops.templates = {
+      "container-pingvin.yaml" = {
+        content = /*yaml*/ ''
+          general:
+            secureCookies: "true"
+            appUrl: https://share.tbmrs.nl
+            showHomePage: "false"
+          share:
+            allowRegistration: "true"
+            maxSize: "10000000000"
+          oauth:
+            disablePassword: "false"
+            oidc-enabled: "true"
+            oidc-discoveryUri: "https://auth.tbmrs.nl/oauth2/openid/pingvin/.well-known/openid-configuration"
+            oidc-clientId: pingvin
+            oidc-clientSecret: "${config.sops.placeholder."containers/pingvin-share/oidc-secret"}"
+          initUser:
+            enabled: "true"
+            username: "admin"
+            email: "admin@example.com"
+            password: "my-secure-password"
+            isAdmin: true
+            ldapDN: ""
+        '';
+      };
+    };
+
+    sops.secrets = {
+      "containers/pingvin-share/oidc-secret" = { };
+    };
+  };
+}

modules/home/containers/uptime-kuma.nix

@@ -0,0 +1,27 @@
+{ config, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.settings.containers.uptime-kuma;
+in {
+  options = {
+    settings.containers.uptime-kuma.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enable uptime kuma container
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.podman.containers.uptime-kuma = {
+      image = "louislam/uptime-kuma:1";
+      network = "proxy";
+      volumes = [
+        "%h/containers/uptime-kuma/data:/app/data" 
+      ];
+    };
+  };
+}

modules/home/containers/vaultwarden.nix

@@ -0,0 +1,31 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.settings.containers.vaultwarden;
+in {
+  options = {
+    settings.containers.vaultwarden.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enable Vaultwarden container
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.podman.containers.vaultwarden = {
+      image = "ghcr.io/dani-garcia/vaultwarden:latest";
+      network = "proxy";
+      volumes = [
+        "%h/containers/vaultwarden/data:/data" 
+      ];
+      environment = {
+        DOMAIN = "https://vault.local.tbmrs.nl";
+        SIGNUPS_ALLOWED = true;
+      };
+    };
+  };
+}

modules/home/default.nix

@@ -17,13 +17,25 @@
 
     ./services/nextcloud.nix
     ./services/podman.nix
+    ./services/sops.nix
 
     ./theming/fonts.nix
     ./theming/stylix.nix
 
     ./desktop-environments/hyprland/default.nix
 
-    ./containers/nginx.nix
+    ./containers/network.nix
+
     ./containers/caddy.nix
+    ./containers/kanidm.nix
+    ./containers/nginx.nix
+    ./containers/forgejo.nix
+    ./containers/immich.nix
+    ./containers/homepage.nix
+    ./containers/uptime-kuma.nix
+    ./containers/pingvin-share.nix
+    ./containers/vaultwarden.nix
+    ./containers/paperless-ngx.nix
+    ./containers/beszel.nix
   ];
 }

modules/home/services/sops.nix

@@ -0,0 +1,34 @@
+{ lib, config, inputs, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.settings.services.sops;
+in {
+  options = {
+    settings.services.sops.enable = lib.mkOption {
+      type = lib.types.bool;
+      description = ''
+        Enable sops secret management
+      '';
+      default = false;
+    };
+  };
+
+  imports = [
+    inputs.sops-nix.homeManagerModules.sops
+  ];
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      sops
+      age
+    ];
+
+    sops = {
+      age.keyFile = "/home/${config.home.username}/.config/sops/age/keys.txt"; # must have no password!
+
+      defaultSopsFile = ../../../secrets/deploy.yaml;
+    };
+  };
+}