reudy-net/nixos
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Move all services from srazka.com to reudy.net

Browse source 
Renames every domain in the config: Caddy virtual hosts (auth, hello,
nextcloud, git, panel), the ACME contact email, Authelia's session cookie
domain / portal URL / default redirect and TOTP issuer, Nextcloud's
hostName and overwritehost, and Forgejo's DOMAIN (ROOT_URL and ssh clone
URLs follow from it; the panel picks them up via panel.nix). Panel docs and
examples updated too, and a README paragraph that had run together is
split again.

Requires DNS for auth/hello/nextcloud/git/panel.reudy.net (or a
*.reudy.net wildcard) pointing at the server before deploying.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf
This commit is contained in:
agent 2026-09-27 15:32:49 +00:00
parent 0d0e44b39e
commit a3c730e1db
8 changed files with 38 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

10
authelia.nix
View file

@ -45,7 +45,7 @@
totp = { totp = {
disable = false; disable = false;
issuer = "srazka.com"; issuer = "reudy.net";
period = 30; period = 30;
}; };
@ -70,9 +70,9 @@
cookies = [ cookies = [
{ {
domain = "srazka.com"; domain = "reudy.net";
authelia_url = "https://auth.srazka.com"; authelia_url = "https://auth.reudy.net";
default_redirection_url = "https://hello.srazka.com"; default_redirection_url = "https://hello.reudy.net";
} }
]; ];
}; };
@ -82,7 +82,7 @@
default_policy = "two_factor"; default_policy = "two_factor";
# You can add per-domain rules here later, e.g.: # You can add per-domain rules here later, e.g.:
# rules = [ # rules = [
# { domain = "hello.srazka.com"; policy = "two_factor"; } # { domain = "hello.reudy.net"; policy = "two_factor"; }
# ]; # ];
}; };

10
caddy.nix
View file

@ -2,7 +2,7 @@
{ {
services.caddy = { services.caddy = {
enable = true; enable = true;
email = "admin@srazka.com"; email = "admin@reudy.net";
# Generated app routes from the panel backend. # Generated app routes from the panel backend.
extraConfig = '' extraConfig = ''
@ -10,12 +10,12 @@
''; '';
# Authelia's own login portal # Authelia's own login portal
virtualHosts."auth.srazka.com".extraConfig = '' virtualHosts."auth.reudy.net".extraConfig = ''
reverse_proxy 127.0.0.1:9091 reverse_proxy 127.0.0.1:9091
''; '';
# Every protected site uses this snippet # Every protected site uses this snippet
virtualHosts."hello.srazka.com".extraConfig = '' virtualHosts."hello.reudy.net".extraConfig = ''
forward_auth 127.0.0.1:9091 { forward_auth 127.0.0.1:9091 {
uri /api/authz/forward-auth uri /api/authz/forward-auth
copy_headers Remote-User Remote-Groups Remote-Email Remote-Name copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
@ -26,7 +26,7 @@
# Nextcloud — served by local nginx # Nextcloud — served by local nginx
# (Authelia forward-auth disabled for now; re-enable by uncommenting the # (Authelia forward-auth disabled for now; re-enable by uncommenting the
# forward_auth block below.) # forward_auth block below.)
virtualHosts."nextcloud.srazka.com".extraConfig = '' virtualHosts."nextcloud.reudy.net".extraConfig = ''
# forward_auth 127.0.0.1:9091 { # forward_auth 127.0.0.1:9091 {
# uri /api/authz/forward-auth # uri /api/authz/forward-auth
# copy_headers Remote-User Remote-Groups Remote-Email Remote-Name # copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
@ -36,7 +36,7 @@
# Forgejo — no Authelia forward-auth, since it would break git over HTTPS # Forgejo — no Authelia forward-auth, since it would break git over HTTPS
# and the API. Forgejo handles its own logins. # and the API. Forgejo handles its own logins.
virtualHosts."git.srazka.com".extraConfig = '' virtualHosts."git.reudy.net".extraConfig = ''
reverse_proxy 127.0.0.1:14921 reverse_proxy 127.0.0.1:14921
''; '';
}; };

4
forgejo.nix
View file

@ -1,6 +1,6 @@
{ config, ... }: { config, ... }:
let let
domain = "git.srazka.com"; domain = "git.reudy.net";
sshPort = 14922; sshPort = 14922;
in in
{ {
@ -24,7 +24,7 @@ in
# Forgejo's built-in SSH server, separate from the system sshd (which # Forgejo's built-in SSH server, separate from the system sshd (which
# only allows 'reudy' on 14902). Clone URLs look like: # only allows 'reudy' on 14902). Clone URLs look like:
# ssh://git@git.srazka.com:14922/<user>/<repo>.git # ssh://git@git.reudy.net:14922/<user>/<repo>.git
START_SSH_SERVER = true; START_SSH_SERVER = true;
SSH_PORT = sshPort; SSH_PORT = sshPort;
SSH_LISTEN_PORT = sshPort; SSH_LISTEN_PORT = sshPort;

4
nextcloud.nix
View file

@ -15,7 +15,7 @@
enable = true; enable = true;
package = pkgs.nextcloud33; package = pkgs.nextcloud33;
hostName = "nextcloud.srazka.com"; hostName = "nextcloud.reudy.net";
https = true; https = true;
config = { config = {
@ -28,7 +28,7 @@
settings = { settings = {
trusted_proxies = [ "127.0.0.1" ]; trusted_proxies = [ "127.0.0.1" ];
overwriteprotocol = "https"; overwriteprotocol = "https";
overwritehost = "nextcloud.srazka.com"; overwritehost = "nextcloud.reudy.net";
default_phone_region = "NL"; default_phone_region = "NL";
}; };
}; };

2
panel.nix
View file

@ -65,7 +65,7 @@ in
}; };
}; };
services.caddy.virtualHosts."panel.srazka.com".extraConfig = '' services.caddy.virtualHosts."panel.reudy.net".extraConfig = ''
forward_auth 127.0.0.1:9091 { forward_auth 127.0.0.1:9091 {
uri /api/authz/forward-auth uri /api/authz/forward-auth
copy_headers Remote-User Remote-Groups Remote-Email Remote-Name copy_headers Remote-User Remote-Groups Remote-Email Remote-Name

26
panel/API.md
View file

@ -67,10 +67,10 @@ same app returns `409` with `{"ok": false, "error": "...", "busy": "deploy"}`.
```json ```json
{ {
"name": "blog", "name": "blog",
"routes": [{"domain": "blog.srazka.com", "upstream": "127.0.0.1:18090"}], "routes": [{"domain": "blog.reudy.net", "upstream": "127.0.0.1:18090"}],
"auth": true, "auth": true,
"source_type": "git", "source_type": "git",
"repo_url": "https://git.srazka.com/reudy-net/blog.git", "repo_url": "https://git.reudy.net/reudy-net/blog.git",
"repo_branch": "", "repo_branch": "",
"use_forgejo_token": true, "use_forgejo_token": true,
"env": [{"key": "DATABASE_URL", "value": "postgres://..."}], "env": [{"key": "DATABASE_URL", "value": "postgres://..."}],
@ -108,7 +108,7 @@ same app returns `409` with `{"ok": false, "error": "...", "busy": "deploy"}`.
"apps": [ "apps": [
{ {
"name": "whoami", "name": "whoami",
"routes": [{"domain": "whoami.srazka.com", "upstream": "127.0.0.1:18080"}], "routes": [{"domain": "whoami.reudy.net", "upstream": "127.0.0.1:18080"}],
"auth": true, "auth": true,
"compose_file": "/var/lib/containers/stacks/whoami/compose.yaml", "compose_file": "/var/lib/containers/stacks/whoami/compose.yaml",
"repo_url": "", "repo_url": "",
@ -136,7 +136,7 @@ same app returns `409` with `{"ok": false, "error": "...", "busy": "deploy"}`.
{ {
"name": "whoami", "name": "whoami",
"routes": [ "routes": [
{"domain": "whoami.srazka.com", "upstream": "127.0.0.1:18080"} {"domain": "whoami.reudy.net", "upstream": "127.0.0.1:18080"}
], ],
"auth": true "auth": true
} }
@ -148,8 +148,8 @@ same app returns `409` with `{"ok": false, "error": "...", "busy": "deploy"}`.
{ {
"name": "myapp", "name": "myapp",
"routes": [ "routes": [
{"domain": "app.srazka.com", "upstream": "127.0.0.1:18080"}, {"domain": "app.reudy.net", "upstream": "127.0.0.1:18080"},
{"domain": "api.app.srazka.com", "upstream": "127.0.0.1:18081"} {"domain": "api.app.reudy.net", "upstream": "127.0.0.1:18081"}
], ],
"auth": true "auth": true
} }
@ -161,7 +161,7 @@ same app returns `409` with `{"ok": false, "error": "...", "busy": "deploy"}`.
{ {
"name": "pocketbase", "name": "pocketbase",
"routes": [ "routes": [
{"domain": "pb.srazka.com", "upstream": "127.0.0.1:8090", "path": "/_/*"} {"domain": "pb.reudy.net", "upstream": "127.0.0.1:8090", "path": "/_/*"}
], ],
"auth": true "auth": true
} }
@ -175,7 +175,7 @@ The `path` field is optional. When present, it generates a Caddy `reverse_proxy
{ {
"name": "wildcard", "name": "wildcard",
"routes": [ "routes": [
{"domain": "*.srazka.com", "upstream": "127.0.0.1:18082"} {"domain": "*.reudy.net", "upstream": "127.0.0.1:18082"}
], ],
"auth": false "auth": false
} }
@ -188,9 +188,9 @@ Note: Wildcard domains require DNS challenge configuration in Caddy.
```json ```json
{ {
"routes": [ "routes": [
{"domain": "app.srazka.com", "upstream": "127.0.0.1:18080"}, {"domain": "app.reudy.net", "upstream": "127.0.0.1:18080"},
{"domain": "api.srazka.com", "upstream": "127.0.0.1:18081"}, {"domain": "api.reudy.net", "upstream": "127.0.0.1:18081"},
{"domain": "pb.srazka.com", "upstream": "127.0.0.1:8090", "path": "/_/*"} {"domain": "pb.reudy.net", "upstream": "127.0.0.1:8090", "path": "/_/*"}
] ]
} }
``` ```
@ -230,8 +230,8 @@ Caddy reloads automatically via the systemd path watcher. Containers stay runnin
"ok": true, "ok": true,
"name": "myapp", "name": "myapp",
"routes": [ "routes": [
{"domain": "app.srazka.com", "upstream": "127.0.0.1:18080"}, {"domain": "app.reudy.net", "upstream": "127.0.0.1:18080"},
{"domain": "api.srazka.com", "upstream": "127.0.0.1:18081", "path": "/api/*"} {"domain": "api.reudy.net", "upstream": "127.0.0.1:18081", "path": "/api/*"}
] ]
} }
``` ```

16
panel/README.md
View file

@ -25,16 +25,16 @@ All app routes are written to a single `routes/routes.caddy` file that Caddy imp
# Routes are "domain|upstream[|path]" entries, comma-separated. # Routes are "domain|upstream[|path]" entries, comma-separated.
# Create a new app (single route, protected by Authelia) # Create a new app (single route, protected by Authelia)
panelctl init whoami "whoami.srazka.com|127.0.0.1:18080" true panelctl init whoami "whoami.reudy.net|127.0.0.1:18080" true
# Create with multiple routes (different ports, optional path) # Create with multiple routes (different ports, optional path)
panelctl init myapp "app.srazka.com|127.0.0.1:18081,api.srazka.com|127.0.0.1:18082|/api/*" true panelctl init myapp "app.reudy.net|127.0.0.1:18081,api.reudy.net|127.0.0.1:18082|/api/*" true
# Create with wildcard domain (requires DNS challenge in Caddy) # Create with wildcard domain (requires DNS challenge in Caddy)
panelctl init wild "*.srazka.com|127.0.0.1:18083" false panelctl init wild "*.reudy.net|127.0.0.1:18083" false
# Change routes later (Caddy reloads automatically) # Change routes later (Caddy reloads automatically)
panelctl set-routes whoami "whoami.srazka.com|127.0.0.1:18080,who.srazka.com|127.0.0.1:18080" panelctl set-routes whoami "whoami.reudy.net|127.0.0.1:18080,who.reudy.net|127.0.0.1:18080"
# Deploy (compose up + caddy reload) # Deploy (compose up + caddy reload)
panelctl deploy whoami panelctl deploy whoami
@ -90,8 +90,8 @@ panelctl remove whoami
## Web UI & API ## Web UI & API
- Nix runs `panel-api` as a systemd service on `127.0.0.1:9911`. - Nix runs `panel-api` as a systemd service on `127.0.0.1:9911`.
- Caddy proxies `https://panel.srazka.com` → panel-api with Authelia forward_auth. - Caddy proxies `https://panel.reudy.net` → panel-api with Authelia forward_auth.
- Open `https://panel.srazka.com` for the web UI. - Open `https://panel.reudy.net` for the web UI.
- API docs: [API.md](API.md) - API docs: [API.md](API.md)
### Web UI features ### Web UI features
@ -130,7 +130,9 @@ Forgejo. The token is stored in `state/panel/forgejo-token` (mode 0600).
`state/panel/ssh/` the first time it is needed. Its public half is shown in `state/panel/ssh/` the first time it is needed. Its public half is shown in
Settings (and next to ssh URLs); add it as a read-only deploy key to a Settings (and next to ssh URLs); add it as a read-only deploy key to a
repository — or to your Forgejo account for access to all repositories — to repository — or to your Forgejo account for access to all repositories — to
clone `ssh://git@git.srazka.com:14922/owner/repo.git` style URLs. **Sync** fetches the configured branch and clone `ssh://git@git.reudy.net:14922/owner/repo.git` style URLs.
**Sync** fetches the configured branch and
hard-resets the checkout to it before redeploying, so the repository is the hard-resets the checkout to it before redeploying, so the repository is the
source of truth: compose edits made in the panel are discarded on the next sync source of truth: compose edits made in the panel are discarded on the next sync
(the UI warns about this). An access token for a private repository is stored in (the UI warns about this). An access token for a private repository is stored in

2
panel/panelctl.sh
View file

@ -78,7 +78,7 @@ Wildcard domains are supported (requires DNS challenge in Caddy):
panelctl init myapp "*.example.com|127.0.0.1:18080" true panelctl init myapp "*.example.com|127.0.0.1:18080" true
Examples: Examples:
panelctl init whoami "whoami.srazka.com|127.0.0.1:18080" true panelctl init whoami "whoami.reudy.net|127.0.0.1:18080" true
panelctl deploy whoami panelctl deploy whoami
panelctl restart whoami panelctl restart whoami
panelctl status whoami panelctl status whoami