g

configuration.nix

@@ -7,20 +7,26 @@
     ./services/nginx.nix
     ./services/openssh.nix
     ./services/forgejo.nix
+    # ./services/nextcloud.nix
+    # ./services/seafile.nix
     ./services/vaultwarden.nix
     ./services/jellyfin.nix
     ./services/website.nix
     ./services/mailserver.nix
     ./services/fail2ban.nix
-    ./services/sonarr.nix
+
+    ./services/zed.nix # IMPORTANTE
+
+    ./services/auto-torrent.nix
+
     ./services/misc.nix
 
     ./modules/age.nix
-    ./modules/microvm.nix
     ./modules/git.nix
     ./modules/nix-settings.nix
     ./modules/zfs.nix
 
+    (import ./modules/microvm.nix {routed = true;})
     (import ./modules/networking-shared.nix {hostname = "server";})
     (import ./modules/users.nix {main-user = "baritone";})
   ];
@@ -30,20 +36,18 @@
     efi.canTouchEfiVariables = true;
     timeout = 0;
   };
+  boot.kernel.sysctl = {"vm.swappiness" = 85;};
 
   # Enable microcode updates
   hardware.enableRedistributableFirmware = true;
 
-  programs.zsh = {
+  # programs.zsh = {
-    enable = true;
+  #   enable = true;
-    enableGlobalCompInit = true;
+  #   enableGlobalCompInit = true;
-    shellAliases = {
+  #   shellAliases = {
-      "nrb" = "sudo nixos-rebuild switch --flake /etc/nixos";
+  #     "nrb" = "sudo nixos-rebuild switch --flake /etc/nixos";
-    };
+  #   };
-  };
+  # };
-
-  programs.ssh.startAgent = true;
-  programs.nano.enable = false;
 
   environment.systemPackages = with pkgs; [
     wget
@@ -54,6 +58,7 @@
     inputs.agenix.packages."${system}".default
   ];
 
+  programs.nano.enable = false;
   environment.variables = {
     EDITOR = "vim"; # FUCK NANO
   };
@@ -68,8 +73,5 @@
     '';
   };
 
-  programs.mtr.enable = true;
-  programs.gnupg.agent.enable = true;
-
   system.stateVersion = "24.11";
 }

disko.nix

@@ -104,7 +104,7 @@
             type = "zfs_fs";
             mountpoint = "/home";
           };
-          src = {
+          srv = {
             type = "zfs_fs";
             mountpoint = "/srv";
           };

flake.nix

@@ -79,10 +79,10 @@
               swap-size = "128G";
               root-disk = "/dev/nvme0n1";
               raid-disks = [
-                # "sda"
+                "sda"
-                # "sdb"
+                "sdb"
-                # "sdc"
+                "sdc"
-                # "sdd"
+                "sdd"
               ];
             })
 

modules/age.nix

@@ -1,3 +1,4 @@
 {config, ...}: {
   # This is where the age files go
+  # age.secrets.nextcloud.file = ../secrets/nextcloud.age;
 }

modules/microvm.nix

@@ -1,14 +1,14 @@
-{
+{routed ? false}: {
+  pkgs,
   config,
-  lib,
   ...
 }: let
-  attrSet = lib.lists.imap1 (i: v: {
+  attrSet = pkgs.lib.lists.imap1 (i: v: {
     name = v;
     index = i;
   }) (builtins.attrNames config.microvm.vms);
 in {
-  config.systemd.network.networks = builtins.listToAttrs (builtins.map ({
+  systemd.network.networks = builtins.listToAttrs (builtins.map ({
       name,
       index,
     }: {
@@ -16,22 +16,25 @@ in {
       value = {
         matchConfig.Name = "vm${toString index}";
         address = [
-          "10.0.0.0/32"
+          "10.0.${toString index}.254/24" # Host gateway
         ];
         routes = [
           {
-            Destination = "10.0.0.${toString index}/32";
+            Destination = "10.0.${toString index}.1/24";
           }
         ];
-        networkConfig = {IPv4Forwarding = true;};
+        networkConfig = {
+          IPv4Forwarding = true;
+        };
       };
     })
     attrSet);
 
   # NAT (make vms accessible in host)
-  config.networking.nat = {
+  networking.nat = {
     enable = true;
-    internalIPs = ["10.0.0.0/24"];
     externalInterface = "enp2s0";
+    internalIPs = ["10.0.1.0/24"];
+    internalInterfaces = ["vm1"];
   };
 }

modules/users.nix

@@ -25,14 +25,14 @@
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICPQ3uc8UB9m6NPkXHETTJrzxB6M+SfUiBx6YeWUSADU sxsgamer@gmail.com"
     ];
 
-    shell = pkgs.zsh;
+    shell = pkgs.fish;
   };
 
-  users.users."nixos" = {
+  programs.fish = {
-    isNormalUser = true;
+    enable = true;
-    extraGroups = ["wheel"];
+    shellAbbrs = {
-    openssh.authorizedKeys.keys = [
+      "nrb" = "sudo nixos-rebuild switch --flake /etc/nixos";
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIFhTExbc9m4dCK6676wGiA8zPjE0l/9Fz2yf0IKvUvg snorre@archlinux"
+      "vmr" = "rm ~/.ssh/known_hosts; ssh root@10.0.0.1";
-    ];
+    };
   };
 }

secrets/nextcloud.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 rgw77A FBgTHsvCbpuhDFHCOQ4MtkSu3b9WmlSDboN4x3J/p1M
+Mwts15GY7TwmWhB/wZPQ7EfBJ61aV+1QbjwZL8xRcgM
+--- PI2311X1EC/csuMWV1Nx5Wnu4ajhh6e42NkDYW/fNgE
+Sód†AIdä*}<7D>éw”À;Î]¥û7êÍÛ]
<@¢ž)^Ô˜³ü÷

secrets/secrets.nix

@@ -1,4 +1,5 @@
 let
-  public-key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC562Woe/yT/3dNVceN9rKPJQcvgTFzIhJVdVGv7sqn1 baritone@server";
+  public-keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC562Woe/yT/3dNVceN9rKPJQcvgTFzIhJVdVGv7sqn1 baritone@server"];
 in {
+  "nextcloud.age".publicKeys = public-keys;
 }

services/auto-torrent.nix

@@ -0,0 +1,241 @@
+{
+  config,
+  pkgs,
+  ...
+}: let
+  lib = pkgs.lib;
+  host = "10.0.${toString vm-index}.1";
+  port = 8989;
+  vm-index = 1;
+  vm-mac = "02:00:00:00:00:02";
+  vm-name = "auto-torrent";
+  vpn-endpoint = "193.32.248.70";
+  enable-services = true;
+in {
+  microvm.autostart = [vm-name];
+
+  users.extraUsers.microvm.extraGroups = [
+    "jellyfin" # access to media folder
+  ];
+
+  system.activationScripts."make-${vm-name}-data-dir" = lib.stringAfter ["var"] ''
+    mkdir -p /var/lib/${vm-name}
+    chmod -R 777 /var/lib/${vm-name}
+    chown -R microvm /var/lib/${vm-name}
+    chmod -R 777 /media
+  '';
+
+  microvm.vms.${vm-name} = {
+    config = {...}: {
+      system.stateVersion = "25.05";
+      microvm.interfaces = [
+        {
+          id = "vm${toString vm-index}";
+          type = "tap";
+          mac = vm-mac;
+        }
+      ];
+
+      # 1gb of memory
+      microvm.mem = 1024;
+
+      microvm.shares = let
+        proto = "virtiofs";
+      in [
+        {
+          tag = "ro-store";
+          source = "/nix/store";
+          mountPoint = "/nix/.ro-store";
+        }
+        {
+          tag = "data-dir";
+          source = "/var/lib/${vm-name}";
+          mountPoint = "/mnt";
+          inherit proto;
+        }
+        {
+          tag = "media-dir";
+          source = "/media";
+          mountPoint = "/media";
+          inherit proto;
+        }
+      ];
+
+      networking.useNetworkd = true;
+      networking.usePredictableInterfaceNames = false;
+      systemd.network.networks."10-eth" = {
+        matchConfig.MACAddress = vm-mac;
+        address = [
+          "10.0.${toString vm-index}.1/24"
+        ];
+        routes = [
+          # Default route
+          {
+            Destination = "${toString vpn-endpoint}/32";
+            Gateway = "10.0.${toString vm-index}.254";
+            GatewayOnLink = true;
+          }
+        ];
+        networkConfig = {
+          DNS = [
+            "9.9.9.9"
+            "8.8.8.8"
+            "8.8.4.4"
+          ];
+        };
+      };
+
+      networking.useDHCP = false;
+      networking.nameservers = [
+        "10.0.101.1"
+        "8.8.8.8"
+        "8.8.4.4"
+      ];
+
+      systemd.services."start-wireguard" = {
+        description = "Start wireguard mullvad";
+        after = ["network-online.target"];
+        wants = ["network-online.target"];
+        wantedBy = ["multi-user.target"];
+
+        serviceConfig = {
+          type = "oneshot";
+          ExecStart = pkgs.writeShellScript "wgconf.sh" ''
+            ${pkgs.wireguard-tools}/bin/wg-quick up /mnt/wg.conf
+          '';
+          RemainAfterExit = "yes";
+        };
+      };
+
+      networking.wireguard.enable = true;
+
+      # Sleep them for a while to make sure everything is set up
+      systemd.services.sonarr.serviceConfig.ExecStartPre = pkgs.lib.mkIf enable-services "/run/current-system/sw/bin/sleep 1";
+      systemd.services.radarr.serviceConfig.ExecStartPre = pkgs.lib.mkIf enable-services "/run/current-system/sw/bin/sleep 1";
+      systemd.services.jackett.serviceConfig.ExecStartPre = pkgs.lib.mkIf enable-services "/run/current-system/sw/bin/sleep 1";
+      systemd.services.rutorrent.serviceConfig.ExecStartPre = pkgs.lib.mkIf enable-services "/run/current-system/sw/bin/sleep 1";
+
+      # fuck nano
+      programs.nano.enable = lib.mkForce false;
+      programs.vim.enable = true;
+
+      # Services
+      services.sonarr = pkgs.lib.mkIf enable-services {
+        enable = true;
+        openFirewall = true;
+        dataDir = "/mnt/sonarr";
+      };
+      services.radarr = pkgs.lib.mkIf enable-services {
+        enable = true;
+        openFirewall = true;
+        dataDir = "/mnt/radarr";
+      };
+      services.jackett = pkgs.lib.mkIf enable-services {
+        enable = true;
+        dataDir = "/mnt/jackett";
+        openFirewall = true;
+      };
+
+      services.transmission = pkgs.lib.mkIf enable-services {
+        enable = true;
+        openFirewall = true;
+        home = "/mnt/transmission";
+        settings.download-dir = "/mnt/transmission";
+        settings.incomplete-dir = "/mnt/transmission/.incomplete";
+        downloadDirPermissions = "775";
+      };
+
+      # debugging
+      users.users.root = {
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC562Woe/yT/3dNVceN9rKPJQcvgTFzIhJVdVGv7sqn1 baritone@server"
+        ];
+      };
+
+      environment.systemPackages = with pkgs; [
+        wireguard-tools
+        tcpdump
+      ];
+
+      services.openssh = {
+        enable = true;
+        settings = {
+          PermitRootLogin = "yes";
+          AllowUsers = null;
+          PasswordAuthentication = true;
+          KbdInteractiveAuthentication = true;
+        };
+      };
+    };
+  };
+
+  # Sonarr
+  services.nginx.virtualHosts."sonarr.spoodythe.one" = {
+    addSSL = true;
+    enableACME = true;
+    listen = [
+      {
+        inherit port;
+        addr = "0.0.0.0";
+        ssl = false;
+      }
+      {
+        port = 443;
+        addr = "0.0.0.0";
+        ssl = true;
+      }
+    ];
+    locations."/" = {
+      proxyPass = "http://${host}:${toString port}";
+    };
+  };
+
+  # Radarr
+  services.nginx.virtualHosts."radarr.spoodythe.one" = let
+    port = 7878;
+  in {
+    addSSL = true;
+    enableACME = true;
+    listen = [
+      {
+        inherit port;
+        addr = "0.0.0.0";
+        ssl = false;
+      }
+      {
+        port = 443;
+        addr = "0.0.0.0";
+        ssl = true;
+      }
+    ];
+    locations."/" = {
+      proxyPass = "http://${host}:${toString port}";
+    };
+  };
+
+  # Jackett
+  services.nginx.virtualHosts."jackett.spoodythe.one" = let
+    port = 9117;
+  in {
+    addSSL = true;
+    enableACME = true;
+    listen = [
+      {
+        inherit port;
+        addr = "0.0.0.0";
+        ssl = false;
+      }
+      {
+        port = 443;
+        addr = "0.0.0.0";
+        ssl = true;
+      }
+    ];
+    locations."/" = {
+      proxyPass = "http://${host}:${toString port}";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [port 9117 7878 9696 80 433];
+  networking.firewall.allowedUDPPorts = [port 9117 7878 9696 80 433];
+}

services/forgejo.nix

@@ -33,6 +33,9 @@ in {
     enableACME = true;
     locations."/" = {
       proxyPass = "http://${host}:${toString port}";
+      extraConfig = ''
+        client_max_body_size 100M;
+      '';
     };
   };
 

services/homepage.nix

@@ -0,0 +1,44 @@
+{...}: let
+  host = "127.0.0.1";
+  port = 8082;
+in {
+  services.homepage-dashboard = {
+    enable = true;
+    listenPort = port;
+    openFirewall = false;
+    widgets = [
+      {
+        resources = {
+          cpu = true;
+          disk = "/";
+          memory = true;
+        };
+      }
+    ];
+
+    services = [
+      {
+        "WebUI" = [
+          {
+            "Jellyfin" = {
+              description = "Jellyfin";
+              href = "https://media.spoodythe.one";
+            };
+          }
+        ];
+      }
+    ];
+  };
+
+  services.nginx.virtualHosts."dashboard.spoodythe.one" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://${host}:${toString port}";
+    };
+  };
+
+  # Open port 80 and 443 for reverse proxy
+  networking.firewall.allowedTCPPorts = [80 443];
+  networking.firewall.allowedUDPPorts = [80 443];
+}

services/jellyfin.nix

@@ -6,6 +6,34 @@
 }: let
   host = "127.0.0.1";
   port = 8096;
+  jellyfin =
+    if config.services.mullvad-vpn.enable == true
+    then
+      pkgs.callPackage ({...}:
+        pkgs.stdenv.mkDerivation {
+          pname = "jellyfin-excluded";
+          version = "1.0.0";
+
+          phases = ["installPhase"];
+
+          buildInputs = [pkgs.jellyfin];
+
+          # Define the install phase
+          installPhase = ''
+            mkdir -p $out/bin
+            # Create a wrapper script
+            echo "${pkgs.mullvad-vpn}/bin/mullvad-exclude ${pkgs.jellyfin}/bin/jellyfin \"$@\"" > $out/bin/jellyfin-excluded
+            chmod +x $out/bin/jellyfin-excluded
+          '';
+
+          # Specify the output
+          meta = with pkgs.lib; {
+            description = "A wrapper for the hello command";
+            mainProgram = "jellyfin-excluded";
+            license = licenses.mit;
+          };
+        }) {}
+    else pkgs.jellyfin;
 in {
   # Enable VAAPI
   config.nixpkgs.config.packageOverrides = pkgs: {
@@ -32,6 +60,7 @@ in {
   # Enable Jellyfin
   config.services.jellyfin = {
     enable = true;
+    package = jellyfin;
     openFirewall = false; # We want jellyfin behind a reverse proxy
   };
 

services/nextcloud.nix

@@ -1,13 +1,24 @@
-{pkgs, ...}: let
+{
+  config,
+  pkgs,
+  ...
+}: let
   nextcloud-pkg = pkgs.nextcloud30;
   host = "127.0.0.1";
   port = 8008;
+  lib = pkgs.lib;
 in {
+  #  system.activationScripts."make-nextcloud-dir" = lib.stringAfter ["var"] ''
+  #    mkdir -p /var/lib/nextcloud
+  #    chmod -R 770 /var/lib/nextcloud
+  #    chown -R nextcloud:nextcloud /var/lib/nextcloud
+  #  '';
+
   services.nextcloud = {
     enable = true;
     package = nextcloud-pkg;
     hostName = "localhost";
-    config.adminpassFile = "/var/lib/db/nextcloud/admin-password";
+    config.adminpassFile = "/etc/nextcloud-admin-password";
     config.dbtype = "sqlite";
   };
 
@@ -19,7 +30,7 @@ in {
     }
   ];
   services.nginx.virtualHosts."nextcloud.spoodythe.one" = {
-    addSSL = true;
+    forceSSL = true;
     enableACME = true;
     locations."/" = {
       proxyPass = "http://${host}:${toString port}";

services/nginx.nix

@@ -6,7 +6,9 @@
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
 
-    virtualHosts."_" = {
+    virtualHosts."spoodythe.one" = {
+      forceSSL = true;
+      enableACME = true;
       default = true;
       locations."/" = {
         return = 404;

services/openssh.nix

@@ -24,4 +24,8 @@
       }
     ];
   };
+
+  programs.ssh.startAgent = true;
+  programs.mtr.enable = true;
+  programs.gnupg.agent.enable = true;
 }

services/rtorrent.nix

@@ -0,0 +1,18 @@
+{pkgs, ...}: let
+  port = 9091;
+in {
+  #  services.rtorrent = {
+  #    enable = true;
+  #    dataDir = "/mnt/rtorrent";
+  #    user = "rtorrent";
+  #    group = "rtorrent";
+  #    package = pkgs.jesec-rtorrent;
+  #    inherit port;
+  #  };
+
+  services.transmission = {
+    enable = true;
+    openFirewall = false;
+    settings.rpc-port = port;
+  };
+}

services/seafile.nix

@@ -0,0 +1,28 @@
+{
+  config,
+  pkgs,
+  ...
+}: let
+  host = "127.0.0.1";
+  port = 8008;
+in {
+  services.seafile = {
+    enable = true;
+    adminEmail = "snorre@altschul.dk";
+    seahubAddress = "http://${host}:${toString port}";
+    # seafileSettings.fileserver = {
+    # inherit host port;
+    # };
+  };
+  services.nginx.virtualHosts."files.spoodythe.one" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://${host}:${toString port}";
+    };
+  };
+
+  # Open port 80 and 443 for reverse proxy
+  networking.firewall.allowedTCPPorts = [80 443];
+  networking.firewall.allowedUDPPorts = [80 443];
+}

services/sonarr-old.nix

@@ -0,0 +1,189 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  host = "127.0.0.1";
+  port = 8989;
+  vm-index = 1;
+  vm-mac = "00:00:00:00:00:01";
+  vm-name = "necoarc";
+in {
+  config.microvm.autostart = [vm-name];
+
+  config.users.extraUsers.microvm.extraGroups = [
+    "jellyfin" # access to media folder
+  ];
+
+  config.system.activationScripts."make${vm-name}DataDir" = lib.stringAfter ["var"] ''
+    mkdir -p /var/lib/${vm-name}
+    chmod -R 777 /var/lib/${vm-name}
+    chown -R microvm /var/lib/${vm-name}
+    chmod -R 777 /media
+  '';
+
+  # config.networking.wireguard.enable = true;
+  # # config.boot.extraModulePackages = [config.boot.kernelPackages.wireguard];
+
+  # config.networking.wireguard.interfaces.wg0 = {
+  #   ips = ["10.75.60.108/32"];
+  #   listenPort = 51820;
+  #   privateKeyFile = "${./wireguard-secret}";
+  #   peers = [
+  #     {
+  #       publicKey = "TPAIPTgu9jIitgX1Bz5xMCZJ9pRRZTdtZEOIxArO0Hc=";
+  #       endpoint = "185.254.75.4:51820";
+  #       allowedIPs = ["0.0.0.0/0"];
+  #       persistentKeepalive = 25;
+  #     }
+  #   ];
+  # };
+
+  # config.systemd.network.networks.wg0 = {
+  #   matchConfig.Name = "wg0";
+  #   address = ["10.0.1.${toString vm-index}/24"];
+  #   networkConfig = {
+  #     IPMasquerade = "ipv4";
+  #     IPv4Forwarding = true;
+  #   };
+  # };
+
+  config.microvm.vms.${vm-name} = {
+    config = {config, ...}: {
+      system.stateVersion = "24.11";
+      # Storage share configuration
+      microvm.shares = [
+        {
+          tag = "ro-store";
+          source = "/nix/store";
+          mountPoint = "/nix/.ro-store";
+        }
+        {
+          tag = "data-dir";
+          source = "/var/lib/${vm-name}";
+          mountPoint = "/mnt";
+          proto = "virtiofs";
+        }
+        {
+          tag = "media-dir";
+          source = "/media/shows";
+          mountPoint = "/media/shows";
+          proto = "virtiofs";
+        }
+      ];
+
+      # Allow the service to use the share
+      system.activationScripts."chownDataDir" = lib.stringAfter ["var"] ''
+        mkdir -p /mnt
+        chmod -R 770 /mnt
+        chown -R sonarr:sonarr /mnt
+      '';
+      systemd.services.sonarr.serviceConfig.ExecStartPre = "/run/current-system/sw/bin/sleep 5";
+      systemd.services.rutorrent.serviceConfig.ExecStartPre = "/run/current-system/sw/bin/sleep 5";
+
+      microvm.hypervisor = "qemu";
+
+      # VM Networking
+      microvm.interfaces = [
+        {
+          id = "vm${toString vm-index}";
+          type = "tap";
+          mac = vm-mac;
+        }
+      ];
+      networking.useNetworkd = true;
+      systemd.network.networks."10-eth" = {
+        matchConfig.MACAddress = vm-mac;
+        address = [
+          "10.0.0.${toString vm-index}/32"
+        ];
+        routes = [
+          # Host Route
+          {
+            Destination = "10.0.0.0/32";
+            GatewayOnLink = true;
+          }
+          # Default route
+          {
+            Destination = "0.0.0.0/0";
+            Gateway = "10.0.0.0";
+            GatewayOnLink = true;
+          }
+        ];
+        networkConfig = {
+          DNS = [
+            "9.9.9.9"
+            "8.8.8.8"
+            "8.8.4.4"
+          ];
+        };
+      };
+
+      networking.useDHCP = false;
+      networking.nameservers = [
+        "10.0.101.1"
+        "8.8.8.8"
+        "8.8.4.4"
+      ];
+
+      programs.nano.enable = lib.mkForce false;
+      programs.vim.enable = true;
+
+      # Services
+      services.sonarr = {
+        enable = true;
+        openFirewall = true;
+        dataDir = "/mnt/sonarr";
+      };
+
+      services.rtorrent = {
+        enable = true;
+        dataDir = "/mnt/rtorrent";
+        user = "rtorrent";
+        group = "rtorrent";
+        port = 9999;
+      };
+
+      # Debug user
+      users.users."root" = {
+        password = "1234";
+      };
+
+      environment.systemPackages = [pkgs.dig];
+
+      services.openssh = {
+        enable = true;
+        settings = {
+          PermitRootLogin = "yes";
+          AllowUsers = null;
+          PasswordAuthentication = true;
+          KbdInteractiveAuthentication = true;
+        };
+      };
+    };
+  };
+
+  config.networking.firewall.allowedTCPPorts = [port 80 433];
+  config.networking.firewall.allowedUDPPorts = [port 80 433];
+
+  config.services.nginx.virtualHosts."sonarr.spoodythe.one" = {
+    addSSL = true;
+    enableACME = true;
+    listen = [
+      {
+        port = 8989;
+        addr = "0.0.0.0";
+        ssl = false;
+      }
+      {
+        port = 443;
+        addr = "0.0.0.0";
+        ssl = true;
+      }
+    ];
+    locations."/" = {
+      proxyPass = "http://10.0.0.${toString vm-index}:${toString port}";
+    };
+  };
+}

services/sonarr.nix

@@ -1,240 +1,25 @@
-{
+{...}: let
-  pkgs,
-  lib,
-  config,
-  ...
-}: let
   host = "127.0.0.1";
   port = 8989;
-  vm-index = 1;
-  vm-mac = "00:00:00:00:00:01";
-  vm-name = "necoarc";
 in {
-  config.microvm.autostart = [vm-name];
+  users.extraUsers.sonarr.extraGroups = ["jellyfin"]; # Access to the media folder
-
+  services.sonarr = {
-  config.users.extraUsers.microvm.extraGroups = [
+    enable = true;
-    "jellyfin" # access to media folder
+    openFirewall = true;
-  ];
+  };
-
+  services.rtorrent = {
-  config.system.activationScripts."make${vm-name}DataDir" = lib.stringAfter ["var"] ''
+    enable = true;
-    mkdir -p /var/lib/${vm-name}
+    dataDir = "/mnt/rtorrent";
-    chmod -R 777 /var/lib/${vm-name}
+    user = "rtorrent";
-    chown -R microvm /var/lib/${vm-name}
+    group = "rtorrent";
-    chmod -R 777 /media
+    port = 9999;
-  '';
-
-  # config.networking.wireguard.enable = true;
-  # # config.boot.extraModulePackages = [config.boot.kernelPackages.wireguard];
-
-  # config.networking.wireguard.interfaces.wg0 = {
-  #   ips = ["10.75.60.108/32"];
-  #   listenPort = 51820;
-  #   privateKeyFile = "${./wireguard-secret}";
-  #   peers = [
-  #     {
-  #       publicKey = "TPAIPTgu9jIitgX1Bz5xMCZJ9pRRZTdtZEOIxArO0Hc=";
-  #       endpoint = "185.254.75.4:51820";
-  #       allowedIPs = ["0.0.0.0/0"];
-  #       persistentKeepalive = 25;
-  #     }
-  #   ];
-  # };
-
-  # config.systemd.network.networks.wg0 = {
-  #   matchConfig.Name = "wg0";
-  #   address = ["10.0.1.${toString vm-index}/24"];
-  #   networkConfig = {
-  #     IPMasquerade = "ipv4";
-  #     IPv4Forwarding = true;
-  #   };
-  # };
-
-  config.microvm.vms.${vm-name} = {
-    config = {config, ...}: {
-      system.stateVersion = "24.11";
-      # Storage share configuration
-      microvm.shares = [
-        {
-          tag = "ro-store";
-          source = "/nix/store";
-          mountPoint = "/nix/.ro-store";
-        }
-        {
-          tag = "data-dir";
-          source = "/var/lib/${vm-name}";
-          mountPoint = "/mnt";
-          proto = "virtiofs";
-        }
-        {
-          tag = "media-dir";
-          source = "/media/shows";
-          mountPoint = "/media/shows";
-          proto = "virtiofs";
-        }
-      ];
-
-      # Allow the service to use the share
-      system.activationScripts."chownDataDir" = lib.stringAfter ["var"] ''
-        mkdir -p /mnt
-        chmod -R 770 /mnt
-        chown -R sonarr:sonarr /mnt
-      '';
-      systemd.services.sonarr.serviceConfig.ExecStartPre = "/run/current-system/sw/bin/sleep 5";
-      systemd.services.rutorrent.serviceConfig.ExecStartPre = "/run/current-system/sw/bin/sleep 5";
-
-      microvm.hypervisor = "qemu";
-
-      # VM Networking
-      microvm.interfaces = [
-        {
-          id = "vm${toString vm-index}";
-          type = "tap";
-          mac = vm-mac;
-        }
-      ];
-      networking.useNetworkd = true;
-      systemd.network.networks."10-eth" = {
-        matchConfig.MACAddress = vm-mac;
-        address = [
-          "10.0.0.${toString vm-index}/32"
-        ];
-        routes = [
-          # Host Route
-          {
-            Destination = "10.0.0.0/32";
-            GatewayOnLink = true;
-          }
-          # Default route
-          {
-            Destination = "0.0.0.0/0";
-            Gateway = "10.0.0.0";
-            GatewayOnLink = true;
-          }
-        ];
-        networkConfig = {
-          DNS = [
-            # "9.9.9.9"
-            # "8.8.8.8"
-            # "8.8.4.4"
-
-            # Only allow mullvad DNS server
-            "10.64.0.1"
-          ];
-        };
-      };
-
-      networking.useDHCP = false;
-      networking.nameservers = [
-        "10.0.101.1"
-        "8.8.8.8"
-        "8.8.4.4"
-      ];
-
-      # Services
-      services.sonarr = {
-        enable = true;
-        openFirewall = true;
-        dataDir = "/mnt/sonarr";
-      };
-
-      services.rtorrent = {
-        enable = true;
-        dataDir = "/mnt/rtorrent";
-        user = "rtorrent";
-        group = "rtorrent";
-        port = 9999;
-      };
-
-      # networking.wireguard.enable = true;
-      # boot.extraModulePackages = [config.boot.kernelPackages.wireguard];
-
-      # networking.wireguard.interfaces.wg0 = {
-      #   ips = ["10.75.60.108/32"];
-      #   listenPort = 51820;
-      #   privateKeyFile = "${./wireguard-secret}";
-      #   peers = [
-      #     {
-      #       publicKey = "TPAIPTgu9jIitgX1Bz5xMCZJ9pRRZTdtZEOIxArO0Hc=";
-      #       endpoint = "185.254.75.4:51820";
-      #       allowedIPs = ["0.0.0.0/0"];
-      #       persistentKeepalive = 25;
-      #     }
-      #   ];
-      # };
-
-      # networking.firewall.extraCommands = ''
-      #   ${pkgs.iptables}/bin/iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL ! -d 10.0.0.0/8 -j REJECT && ${pkgs.iptables}/bin/ip6tables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
-      # '';
-
-     #  services.openvpn.servers.mullvad = {
-     #    config = ''
-     #      client
-     #      dev tun
-     #      resolv-retry infinite
-     #      nobind
-     #      persist-key
-     #      persist-tun
-     #      verb 3
-     #      remote-cert-tls server
-     #      ping 10
-     #      ping-restart 60
-     #      sndbuf 524288
-     #      rcvbuf 524288
-     #      cipher AES-256-GCM
-     #      tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384
-     #      proto udp
-     #      auth-user-pass mullvad_userpass.txt
-     #      ca mullvad_ca.crt
-     #      script-security 2
-     #      up /etc/openvpn/update-resolv-conf
-     #      down /etc/openvpn/update-resolv-conf
-     #      fast-io
-     #      remote 193.32.248.72 1301 # de-ber-ovpn-001
-     #    '';
-     #    authUserPass.username = "9898431198930064";
-     #    authUserPass.password = "m";
-     #    updateResolvConf = true;
-     #  };
-
-      # Debug user
-      users.users."root" = {
-        password = "1234";
-      };
-
-      environment.systemPackages = [pkgs.dig];
-
-      services.openssh = {
-        enable = true;
-        settings = {
-          PermitRootLogin = "yes";
-          AllowUsers = null;
-          PasswordAuthentication = true;
-          KbdInteractiveAuthentication = true;
-        };
-      };
-    };
   };
 
-  config.networking.firewall.allowedTCPPorts = [port 80 433];
+  services.nginx.virtualHosts."sonarr.spoodythe.one" = {
-  config.networking.firewall.allowedUDPPorts = [port 80 433];
-
-  config.services.nginx.virtualHosts."sonarr.spoodythe.one" = {
     addSSL = true;
     enableACME = true;
-    listen = [
-      {
-        port = 8989;
-        addr = "0.0.0.0";
-        ssl = false;
-      }
-      {
-        port = 443;
-        addr = "0.0.0.0";
-        ssl = true;
-      }
-    ];
     locations."/" = {
-      proxyPass = "http://10.0.0.${toString vm-index}:${toString port}";
+      proxyPass = "http://${host}:${toString port}";
     };
   };
 }

services/vaultwarden.nix

@@ -32,6 +32,12 @@ in {
     forceSSL = true;
     locations."/" = {
       proxyPass = "http://${host}:${toString port}";
+
+      extraConfig = ''
+        # Websocket support
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $http_connection;
+      '';
     };
   };
 }

services/vm-test.nix

@@ -0,0 +1,133 @@
+{
+  config,
+  pkgs,
+  ...
+}: let
+  vm-index = 1;
+  vm-mac = "02:00:00:00:00:02";
+in {
+  config.microvm.vms."vm-test" = {
+    config = {...}: {
+      microvm.interfaces = [
+        {
+          id = "vm${toString vm-index}";
+          type = "tap";
+          mac = vm-mac;
+        }
+      ];
+
+      microvm.shares = [
+        {
+          tag = "ro-store";
+          source = "/nix/store";
+          mountPoint = "/nix/.ro-store";
+        }
+      ];
+
+      networking.useNetworkd = true;
+      networking.usePredictableInterfaceNames = false;
+      systemd.network.networks."10-eth" = {
+        matchConfig.MACAddress = vm-mac;
+        address = [
+          "10.0.0.${toString vm-index}/32"
+        ];
+        routes = [
+          # Host Route
+          {
+            Destination = "10.0.0.0/32";
+            GatewayOnLink = true;
+          }
+          # Default route
+          {
+            Destination = "0.0.0.0/0";
+            Gateway = "10.0.0.0";
+            GatewayOnLink = true;
+          }
+        ];
+        networkConfig = {
+          DNS = [
+            "9.9.9.9"
+            "8.8.8.8"
+            "8.8.4.4"
+          ];
+        };
+      };
+
+      networking.useDHCP = false;
+      networking.nameservers = [
+        "10.0.101.1"
+        "8.8.8.8"
+        "8.8.4.4"
+      ];
+
+      systemd.services."wireguard-kill-switch" = {
+        description = "Wireguard Kill Switch";
+        after = ["network-online.target"];
+        wants = ["network-online.target"];
+        wantedBy = ["multi-user.target"];
+
+        serviceConfig = {
+          type = "oneshot";
+          ExecStart = pkgs.writeShellScript "wgconf.sh" ''
+            # Stay a while and listen
+            # ${pkgs.toybox}/bin/sleep 5
+            # Route local traffic through wg0 except local traffic
+            ${pkgs.iproute2}/bin/ip route add 10.0.0.0/32 dev eth0 && \
+            ${pkgs.iproute2}/bin/ip route add 0.0.0.0/1 dev wg0
+            # Block all traffic that isnt local or through the vpn
+            ${pkgs.iptables}/bin/iptables -I OUTPUT ! -o wg0 -m mark ! --mark 42 -m addrtype ! --dst-type LOCAL ! -d 10.0.0.0/32 -j REJECT
+          '';
+          RemainAfterExit = "yes";
+        };
+      };
+
+      networking.wireguard.enable = true;
+      systemd.network = {
+        netdevs."10-wg0" = {
+          netdevConfig = {
+            Kind = "wireguard";
+            Name = "wg0";
+            MTUBytes = "1300";
+          };
+          wireguardConfig = {
+            PrivateKeyFile = "${./wireguard-secret}";
+            FirewallMark = 42;
+            ListenPort = 51820;
+          };
+          wireguardPeers = [
+            {
+              PublicKey = "0qSP0VxoIhEhRK+fAHVvmfRdjPs2DmmpOCNLFP/7cGw=";
+              AllowedIPs = ["0.0.0.0/0"];
+              Endpoint = "193.32.248.66:51820";
+              # PersistentKeepalive = 25;
+            }
+          ];
+        };
+        networks."wg0" = {
+          matchConfig.Name = "wg0";
+          address = [
+            " 10.65.241.123/32"
+          ];
+          DHCP = "no";
+          dns = ["10.64.0.1"];
+          gateway = [
+            "10.0.0.0"
+          ];
+        };
+      };
+
+      users.users.root = {
+        password = "1234";
+      };
+      services.openssh = {
+        enable = true;
+        settings = {
+          PermitRootLogin = "yes";
+          AllowUsers = null;
+          PasswordAuthentication = true;
+          KbdInteractiveAuthentication = true;
+        };
+      };
+    };
+  };
+}

services/vpn.nix

@@ -0,0 +1,4 @@
+{pkgs, ...}: {
+  services.mullvad-vpn.enable = true;
+  environment.systemPackages = [pkgs.wireguard-tools];
+}

services/zed.nix

@@ -0,0 +1,20 @@
+{...}: {
+  services.zfs.zed = {
+    enableMail = true;
+    settings = {
+      ZED_DEBUG_LOG = "/tmp/zed.debug.log";
+      ZED_EMAIL_ADDR = "snorre@altschul.dk";
+      ZED_EMAIL_PROG = "sendmail";
+      ZED_EMAIL_OPTS = "-s '@SUBJECT@' @ADDRESS@";
+
+      ZED_LOCKDIR = "/var/lock";
+      ZED_NOTIFY_INTERVAL_SECS = 3600;
+
+      ZED_NOTIFY_VERBOSE = 0;
+
+      ZED_USE_ENCLOSURE_LEDS = 1;
+      ZED_SYSLOG_PRIORITY = "daemon.notice";
+      ZED_SYSLOG_TAG = "zed";
+    };
+  };
+}