reudy-net/nixos
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Move all services from srazka.com to reudy.net

Browse source 
Renames every domain in the config: Caddy virtual hosts (auth, hello,
nextcloud, git, panel), the ACME contact email, Authelia's session cookie
domain / portal URL / default redirect and TOTP issuer, Nextcloud's
hostName and overwritehost, and Forgejo's DOMAIN (ROOT_URL and ssh clone
URLs follow from it; the panel picks them up via panel.nix). Panel docs and
examples updated too, and a README paragraph that had run together is
split again.

Requires DNS for auth/hello/nextcloud/git/panel.reudy.net (or a
*.reudy.net wildcard) pointing at the server before deploying.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf
This commit is contained in:
agent 2026-09-27 15:32:49 +00:00
parent 0d0e44b39e
commit a3c730e1db
8 changed files with 38 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

10
authelia.nix
View file

@ -45,7 +45,7 @@
totp = {
disable = false;
issuer = "srazka.com";
issuer = "reudy.net";
period = 30;
};
@ -70,9 +70,9 @@
cookies = [
{
domain = "srazka.com";
authelia_url = "https://auth.srazka.com";
default_redirection_url = "https://hello.srazka.com";
domain = "reudy.net";
authelia_url = "https://auth.reudy.net";
default_redirection_url = "https://hello.reudy.net";
}
];
};
@ -82,7 +82,7 @@
default_policy = "two_factor";
# You can add per-domain rules here later, e.g.:
# rules = [
# { domain = "hello.srazka.com"; policy = "two_factor"; }
# { domain = "hello.reudy.net"; policy = "two_factor"; }
# ];
};

10
caddy.nix
View file

@ -2,7 +2,7 @@
{
services.caddy = {
enable = true;
email = "admin@srazka.com";
email = "admin@reudy.net";
# Generated app routes from the panel backend.
extraConfig = ''
@ -10,12 +10,12 @@
'';
# Authelia's own login portal
virtualHosts."auth.srazka.com".extraConfig = ''
virtualHosts."auth.reudy.net".extraConfig = ''
reverse_proxy 127.0.0.1:9091
'';
# Every protected site uses this snippet
virtualHosts."hello.srazka.com".extraConfig = ''
virtualHosts."hello.reudy.net".extraConfig = ''
forward_auth 127.0.0.1:9091 {
uri /api/authz/forward-auth
copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
@ -26,7 +26,7 @@
# Nextcloud — served by local nginx
# (Authelia forward-auth disabled for now; re-enable by uncommenting the
# forward_auth block below.)
virtualHosts."nextcloud.srazka.com".extraConfig = ''
virtualHosts."nextcloud.reudy.net".extraConfig = ''
# forward_auth 127.0.0.1:9091 {
# uri /api/authz/forward-auth
# copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
@ -36,7 +36,7 @@
# Forgejo — no Authelia forward-auth, since it would break git over HTTPS
# and the API. Forgejo handles its own logins.
virtualHosts."git.srazka.com".extraConfig = ''
virtualHosts."git.reudy.net".extraConfig = ''
reverse_proxy 127.0.0.1:14921
'';
};

4
forgejo.nix
View file

@ -1,6 +1,6 @@
{ config, ... }:
let
domain = "git.srazka.com";
domain = "git.reudy.net";
sshPort = 14922;
in
{
@ -24,7 +24,7 @@ in
# Forgejo's built-in SSH server, separate from the system sshd (which
# only allows 'reudy' on 14902). Clone URLs look like:
# ssh://git@git.srazka.com:14922/<user>/<repo>.git
# ssh://git@git.reudy.net:14922/<user>/<repo>.git
START_SSH_SERVER = true;
SSH_PORT = sshPort;
SSH_LISTEN_PORT = sshPort;

4
nextcloud.nix
View file

@ -15,7 +15,7 @@
enable = true;
package = pkgs.nextcloud33;
hostName = "nextcloud.srazka.com";
hostName = "nextcloud.reudy.net";
https = true;
config = {
@ -28,7 +28,7 @@
settings = {
trusted_proxies = [ "127.0.0.1" ];
overwriteprotocol = "https";
overwritehost = "nextcloud.srazka.com";
overwritehost = "nextcloud.reudy.net";
default_phone_region = "NL";
};
};

2
panel.nix
View file

@ -65,7 +65,7 @@ in
};
};
services.caddy.virtualHosts."panel.srazka.com".extraConfig = ''
services.caddy.virtualHosts."panel.reudy.net".extraConfig = ''
forward_auth 127.0.0.1:9091 {
uri /api/authz/forward-auth
copy_headers Remote-User Remote-Groups Remote-Email Remote-Name

26
panel/API.md
View file

@ -67,10 +67,10 @@ same app returns `409` with `{"ok": false, "error": "...", "busy": "deploy"}`.
```json
{
"name": "blog",
"routes": [{"domain": "blog.srazka.com", "upstream": "127.0.0.1:18090"}],
"routes": [{"domain": "blog.reudy.net", "upstream": "127.0.0.1:18090"}],
"auth": true,
"source_type": "git",
"repo_url": "https://git.srazka.com/reudy-net/blog.git",
"repo_url": "https://git.reudy.net/reudy-net/blog.git",
"repo_branch": "",
"use_forgejo_token": true,
"env": [{"key": "DATABASE_URL", "value": "postgres://..."}],
@ -108,7 +108,7 @@ same app returns `409` with `{"ok": false, "error": "...", "busy": "deploy"}`.
"apps": [
{
"name": "whoami",
"routes": [{"domain": "whoami.srazka.com", "upstream": "127.0.0.1:18080"}],
"routes": [{"domain": "whoami.reudy.net", "upstream": "127.0.0.1:18080"}],
"auth": true,
"compose_file": "/var/lib/containers/stacks/whoami/compose.yaml",
"repo_url": "",
@ -136,7 +136,7 @@ same app returns `409` with `{"ok": false, "error": "...", "busy": "deploy"}`.
{
"name": "whoami",
"routes": [
{"domain": "whoami.srazka.com", "upstream": "127.0.0.1:18080"}
{"domain": "whoami.reudy.net", "upstream": "127.0.0.1:18080"}
],
"auth": true
}
@ -148,8 +148,8 @@ same app returns `409` with `{"ok": false, "error": "...", "busy": "deploy"}`.
{
"name": "myapp",
"routes": [
{"domain": "app.srazka.com", "upstream": "127.0.0.1:18080"},
{"domain": "api.app.srazka.com", "upstream": "127.0.0.1:18081"}
{"domain": "app.reudy.net", "upstream": "127.0.0.1:18080"},
{"domain": "api.app.reudy.net", "upstream": "127.0.0.1:18081"}
],
"auth": true
}
@ -161,7 +161,7 @@ same app returns `409` with `{"ok": false, "error": "...", "busy": "deploy"}`.
{
"name": "pocketbase",
"routes": [
{"domain": "pb.srazka.com", "upstream": "127.0.0.1:8090", "path": "/_/*"}
{"domain": "pb.reudy.net", "upstream": "127.0.0.1:8090", "path": "/_/*"}
],
"auth": true
}
@ -175,7 +175,7 @@ The `path` field is optional. When present, it generates a Caddy `reverse_proxy
{
"name": "wildcard",
"routes": [
{"domain": "*.srazka.com", "upstream": "127.0.0.1:18082"}
{"domain": "*.reudy.net", "upstream": "127.0.0.1:18082"}
],
"auth": false
}
@ -188,9 +188,9 @@ Note: Wildcard domains require DNS challenge configuration in Caddy.
```json
{
"routes": [
{"domain": "app.srazka.com", "upstream": "127.0.0.1:18080"},
{"domain": "api.srazka.com", "upstream": "127.0.0.1:18081"},
{"domain": "pb.srazka.com", "upstream": "127.0.0.1:8090", "path": "/_/*"}
{"domain": "app.reudy.net", "upstream": "127.0.0.1:18080"},
{"domain": "api.reudy.net", "upstream": "127.0.0.1:18081"},
{"domain": "pb.reudy.net", "upstream": "127.0.0.1:8090", "path": "/_/*"}
]
}
```
@ -230,8 +230,8 @@ Caddy reloads automatically via the systemd path watcher. Containers stay runnin
"ok": true,
"name": "myapp",
"routes": [
{"domain": "app.srazka.com", "upstream": "127.0.0.1:18080"},
{"domain": "api.srazka.com", "upstream": "127.0.0.1:18081", "path": "/api/*"}
{"domain": "app.reudy.net", "upstream": "127.0.0.1:18080"},
{"domain": "api.reudy.net", "upstream": "127.0.0.1:18081", "path": "/api/*"}
]
}
```

16
panel/README.md
View file

@ -25,16 +25,16 @@ All app routes are written to a single `routes/routes.caddy` file that Caddy imp
# Routes are "domain|upstream[|path]" entries, comma-separated.
# Create a new app (single route, protected by Authelia)
panelctl init whoami "whoami.srazka.com|127.0.0.1:18080" true
panelctl init whoami "whoami.reudy.net|127.0.0.1:18080" true
# Create with multiple routes (different ports, optional path)
panelctl init myapp "app.srazka.com|127.0.0.1:18081,api.srazka.com|127.0.0.1:18082|/api/*" true
panelctl init myapp "app.reudy.net|127.0.0.1:18081,api.reudy.net|127.0.0.1:18082|/api/*" true
# Create with wildcard domain (requires DNS challenge in Caddy)
panelctl init wild "*.srazka.com|127.0.0.1:18083" false
panelctl init wild "*.reudy.net|127.0.0.1:18083" false
# Change routes later (Caddy reloads automatically)
panelctl set-routes whoami "whoami.srazka.com|127.0.0.1:18080,who.srazka.com|127.0.0.1:18080"
panelctl set-routes whoami "whoami.reudy.net|127.0.0.1:18080,who.reudy.net|127.0.0.1:18080"
# Deploy (compose up + caddy reload)
panelctl deploy whoami
@ -90,8 +90,8 @@ panelctl remove whoami
## Web UI & API
- Nix runs `panel-api` as a systemd service on `127.0.0.1:9911`.
- Caddy proxies `https://panel.srazka.com` → panel-api with Authelia forward_auth.
- Open `https://panel.srazka.com` for the web UI.
- Caddy proxies `https://panel.reudy.net` → panel-api with Authelia forward_auth.
- Open `https://panel.reudy.net` for the web UI.
- API docs: [API.md](API.md)
### Web UI features
@ -130,7 +130,9 @@ Forgejo. The token is stored in `state/panel/forgejo-token` (mode 0600).
`state/panel/ssh/` the first time it is needed. Its public half is shown in
Settings (and next to ssh URLs); add it as a read-only deploy key to a
repository — or to your Forgejo account for access to all repositories — to
clone `ssh://git@git.srazka.com:14922/owner/repo.git` style URLs. **Sync** fetches the configured branch and
clone `ssh://git@git.reudy.net:14922/owner/repo.git` style URLs.
**Sync** fetches the configured branch and
hard-resets the checkout to it before redeploying, so the repository is the
source of truth: compose edits made in the panel are discarded on the next sync
(the UI warns about this). An access token for a private repository is stored in

2
panel/panelctl.sh
View file

@ -78,7 +78,7 @@ Wildcard domains are supported (requires DNS challenge in Caddy):
panelctl init myapp "*.example.com|127.0.0.1:18080" true
Examples:
panelctl init whoami "whoami.srazka.com|127.0.0.1:18080" true
panelctl init whoami "whoami.reudy.net|127.0.0.1:18080" true
panelctl deploy whoami
panelctl restart whoami
panelctl status whoami