From fe4d3f4432f8f77702210440271350f29532c28d Mon Sep 17 00:00:00 2001 From: Jakub Dorfman Date: Tue, 28 Apr 2026 22:54:36 +0200 Subject: [PATCH] feat: add panel configuration with API service and Caddy integration Co-authored-by: Copilot --- caddy.nix | 24 +-------------- configuration.nix | 48 +---------------------------- flake.nix | 1 + panel.nix | 78 +++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 81 insertions(+), 70 deletions(-) create mode 100644 panel.nix diff --git a/caddy.nix b/caddy.nix index ad07fe4..0318909 100755 --- a/caddy.nix +++ b/caddy.nix @@ -22,29 +22,7 @@ } reverse_proxy 192.168.100.11:80 ''; - - virtualHosts."panel.srazka.com".extraConfig = '' - forward_auth 127.0.0.1:9091 { - uri /api/authz/forward-auth - copy_headers Remote-User Remote-Groups Remote-Email Remote-Name - } - reverse_proxy 127.0.0.1:9911 - ''; - }; - - - systemd.paths."caddy-routes-reload" = { - wantedBy = [ "multi-user.target" ]; - pathConfig = { - PathChanged = "/var/lib/containers/routes/routes.caddy"; - }; - }; - - systemd.services."caddy-routes-reload" = { - serviceConfig = { - Type = "oneshot"; - ExecStart = "${pkgs.systemd}/bin/systemctl reload caddy.service"; - }; }; } + diff --git a/configuration.nix b/configuration.nix index ca9f180..8e5e1d8 100644 --- a/configuration.nix +++ b/configuration.nix @@ -15,7 +15,6 @@ pkgs.zip pkgs.unzip pkgs.jq - (pkgs.writeShellScriptBin "panelctl" (builtins.readFile ./panel/panelctl.sh)) ]; virtualisation.podman = { @@ -24,12 +23,10 @@ defaultNetwork.settings.dns_enabled = true; }; - users.groups.panelroutes = { }; - users.users.reudy = { isNormalUser = true; homeMode = "0755"; - extraGroups = [ "wheel" "podman" "panelroutes" ]; #sudo + extraGroups = [ "wheel" "podman" ]; #sudo openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6TOSFZ+P0oWTa9U3fX/L9c3btv/lCgzPrwKu621aLDjSbWbaddGhAXQtJvl7GJvs7QN52z+icftK94gdeyTbZyzQtY6JNUVmUs5EHlZlYTkAYSFN/rkn6N7/n9aYRN+vd8r0B4IrP5gTPtGglLD16dfukpOgwtQj/eK6tqZpVlZ7LnKK7UaA6a4OXMYgJZAwdzAOfFGfbO++5q+igBdfNJmh5LtYMI6te8AlJGBSVierzeStEzTVbIys1EsyNrEMzAljHBxxco2L7enNmz4xciRNCQ/za5xPmhf8nOoZTIalBziM52DGH6rFzUEBVsqez1U2U4ajVzdSIudOlku4w63YnClHeGNu9AdHJjR7PbIHwui17aGKM/l/Qv/LOWWo+nfO1hbCl0fGZwVkl8p4yR3WM73OWEHn1f+Uc4cWAUDZ/ZDPE0qyA/HAnSA6dfzY66y2evjRBeekA4zcxgmc7Q/2XfKHDYMEKTNkgdO6UAFoUqW4BiyF36FcS1ccjUok= root@DESKTOP-40EVMS3" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahgKnADam4PGc9TiANkWGx09uNuS42tllj70UuyzPf u0_a279@localhost" @@ -39,53 +36,10 @@ ]; }; - users.users.caddy.extraGroups = [ "panelroutes" ]; - systemd.tmpfiles.rules = [ - "d /var/lib/containers 0755 reudy panelroutes -" - "d /var/lib/containers/stacks 0750 reudy panelroutes -" - "d /var/lib/containers/volumes 0750 reudy panelroutes -" - "d /var/lib/containers/routes 0755 reudy panelroutes -" - "d /var/lib/containers/state 0750 reudy panelroutes -" - "d /var/lib/containers/state/apps 0750 reudy panelroutes -" - "d /var/lib/containers/backups 0750 reudy panelroutes -" - "f /var/lib/containers/routes/routes.caddy 0664 reudy panelroutes -" "f /var/lib/systemd/linger/reudy" ]; - systemd.services.panel-api = { - description = "Minimal panel API service"; - after = [ "network.target" ]; - wantedBy = [ "multi-user.target" ]; - path = [ - pkgs.podman - pkgs.podman-compose - pkgs.curl - pkgs.sudo - pkgs.coreutils - pkgs.zip - pkgs.unzip - ]; - - serviceConfig = { - Type = "simple"; - User = "reudy"; - Group = "panelroutes"; - Restart = "always"; - RestartSec = 3; - WorkingDirectory = "/home/reudy"; - ExecStart = "${pkgs.python3}/bin/python3 ${./panel/panel-api.py}"; - }; - - environment = { - PANEL_API_BIND = "127.0.0.1"; - PANEL_API_PORT = "9911"; - PANEL_BASE_DIR = "/var/lib/containers"; - PANELCTL_PATH = "/run/current-system/sw/bin/panelctl"; - PANEL_FRONTEND_DIR = "${./panel/frontend}"; - }; - }; - security.sudo.wheelNeedsPassword = true; security.sudo.extraRules = [ { diff --git a/flake.nix b/flake.nix index f2587f9..666b385 100644 --- a/flake.nix +++ b/flake.nix @@ -30,6 +30,7 @@ { nixpkgs.overlays = [ agenix.overlays.default ]; } vpsadminos.nixosModules.container_25_11 ./configuration.nix + ./panel.nix ./caddy.nix ./authelia.nix ./containers/hello.nix diff --git a/panel.nix b/panel.nix new file mode 100644 index 0000000..a0a11cd --- /dev/null +++ b/panel.nix @@ -0,0 +1,78 @@ +{ config, pkgs, ... }: + +{ + environment.systemPackages = [ + (pkgs.writeShellScriptBin "panelctl" (builtins.readFile ./panel/panelctl.sh)) + ]; + + users.groups.panelroutes = { }; + + users.users.reudy.extraGroups = [ "panelroutes" ]; + users.users.caddy.extraGroups = [ "panelroutes" ]; + + systemd.tmpfiles.rules = [ + "d /var/lib/containers 0755 reudy panelroutes -" + "d /var/lib/containers/stacks 0750 reudy panelroutes -" + "d /var/lib/containers/volumes 0750 reudy panelroutes -" + "d /var/lib/containers/routes 0755 reudy panelroutes -" + "d /var/lib/containers/state 0750 reudy panelroutes -" + "d /var/lib/containers/state/apps 0750 reudy panelroutes -" + "d /var/lib/containers/backups 0750 reudy panelroutes -" + "f /var/lib/containers/routes/routes.caddy 0664 reudy panelroutes -" + ]; + + systemd.services.panel-api = { + description = "Minimal panel API service"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + path = [ + pkgs.podman + pkgs.podman-compose + pkgs.curl + pkgs.sudo + pkgs.coreutils + pkgs.zip + pkgs.unzip + ]; + + serviceConfig = { + Type = "simple"; + User = "reudy"; + Group = "panelroutes"; + Restart = "always"; + RestartSec = 3; + WorkingDirectory = "/home/reudy"; + ExecStart = "${pkgs.python3}/bin/python3 ${./panel/panel-api.py}"; + }; + + environment = { + PANEL_API_BIND = "127.0.0.1"; + PANEL_API_PORT = "9911"; + PANEL_BASE_DIR = "/var/lib/containers"; + PANELCTL_PATH = "/run/current-system/sw/bin/panelctl"; + PANEL_FRONTEND_DIR = "${./panel/frontend}"; + }; + }; + + services.caddy.virtualHosts."panel.srazka.com".extraConfig = '' + forward_auth 127.0.0.1:9091 { + uri /api/authz/forward-auth + copy_headers Remote-User Remote-Groups Remote-Email Remote-Name + } + reverse_proxy 127.0.0.1:9911 + ''; + + systemd.paths."caddy-routes-reload" = { + wantedBy = [ "multi-user.target" ]; + pathConfig = { + PathChanged = "/var/lib/containers/routes/routes.caddy"; + }; + }; + + systemd.services."caddy-routes-reload" = { + serviceConfig = { + Type = "oneshot"; + ExecStart = "${pkgs.systemd}/bin/systemctl reload caddy.service"; + }; + }; +} \ No newline at end of file