feat: add panel configuration with API service and Caddy integration

Co-authored-by: Copilot <copilot@github.com>

caddy.nix

@@ -22,29 +22,7 @@
       }
       reverse_proxy 192.168.100.11:80
     '';
-
-    virtualHosts."panel.srazka.com".extraConfig = ''
-      forward_auth 127.0.0.1:9091 {
-        uri /api/authz/forward-auth
-        copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
-      }
-      reverse_proxy 127.0.0.1:9911
-    '';
-  };
-
-
-  systemd.paths."caddy-routes-reload" = {
-    wantedBy = [ "multi-user.target" ];
-    pathConfig = {
-      PathChanged = "/var/lib/containers/routes/routes.caddy";
-    };
-  };
-
-  systemd.services."caddy-routes-reload" = {
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = "${pkgs.systemd}/bin/systemctl reload caddy.service";
-    };
   };
 
 }
+

configuration.nix

@@ -15,7 +15,6 @@
     pkgs.zip
     pkgs.unzip
     pkgs.jq
-    (pkgs.writeShellScriptBin "panelctl" (builtins.readFile ./panel/panelctl.sh))
   ];
 
   virtualisation.podman = {
@@ -24,12 +23,10 @@
     defaultNetwork.settings.dns_enabled = true;
   };
 
-  users.groups.panelroutes = { };
-
   users.users.reudy = {
     isNormalUser = true;
     homeMode = "0755";
-    extraGroups = [ "wheel" "podman" "panelroutes" ]; #sudo
+    extraGroups = [ "wheel" "podman" ]; #sudo
     openssh.authorizedKeys.keys = [
       "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6TOSFZ+P0oWTa9U3fX/L9c3btv/lCgzPrwKu621aLDjSbWbaddGhAXQtJvl7GJvs7QN52z+icftK94gdeyTbZyzQtY6JNUVmUs5EHlZlYTkAYSFN/rkn6N7/n9aYRN+vd8r0B4IrP5gTPtGglLD16dfukpOgwtQj/eK6tqZpVlZ7LnKK7UaA6a4OXMYgJZAwdzAOfFGfbO++5q+igBdfNJmh5LtYMI6te8AlJGBSVierzeStEzTVbIys1EsyNrEMzAljHBxxco2L7enNmz4xciRNCQ/za5xPmhf8nOoZTIalBziM52DGH6rFzUEBVsqez1U2U4ajVzdSIudOlku4w63YnClHeGNu9AdHJjR7PbIHwui17aGKM/l/Qv/LOWWo+nfO1hbCl0fGZwVkl8p4yR3WM73OWEHn1f+Uc4cWAUDZ/ZDPE0qyA/HAnSA6dfzY66y2evjRBeekA4zcxgmc7Q/2XfKHDYMEKTNkgdO6UAFoUqW4BiyF36FcS1ccjUok= root@DESKTOP-40EVMS3"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahgKnADam4PGc9TiANkWGx09uNuS42tllj70UuyzPf u0_a279@localhost"
@@ -39,53 +36,10 @@
     ];
   };
 
-  users.users.caddy.extraGroups = [ "panelroutes" ];
-
   systemd.tmpfiles.rules = [
-    "d /var/lib/containers 0755 reudy panelroutes -"
-    "d /var/lib/containers/stacks 0750 reudy panelroutes -"
-    "d /var/lib/containers/volumes 0750 reudy panelroutes -"
-    "d /var/lib/containers/routes 0755 reudy panelroutes -"
-    "d /var/lib/containers/state 0750 reudy panelroutes -"
-    "d /var/lib/containers/state/apps 0750 reudy panelroutes -"
-    "d /var/lib/containers/backups 0750 reudy panelroutes -"
-    "f /var/lib/containers/routes/routes.caddy 0664 reudy panelroutes -"
     "f /var/lib/systemd/linger/reudy"
   ];
 
-  systemd.services.panel-api = {
-    description = "Minimal panel API service";
-    after = [ "network.target" ];
-    wantedBy = [ "multi-user.target" ];
-    path = [
-      pkgs.podman
-      pkgs.podman-compose
-      pkgs.curl
-      pkgs.sudo
-      pkgs.coreutils
-      pkgs.zip
-      pkgs.unzip
-    ];
-
-    serviceConfig = {
-      Type = "simple";
-      User = "reudy";
-      Group = "panelroutes";
-      Restart = "always";
-      RestartSec = 3;
-      WorkingDirectory = "/home/reudy";
-      ExecStart = "${pkgs.python3}/bin/python3 ${./panel/panel-api.py}";
-    };
-
-    environment = {
-      PANEL_API_BIND = "127.0.0.1";
-      PANEL_API_PORT = "9911";
-      PANEL_BASE_DIR = "/var/lib/containers";
-      PANELCTL_PATH = "/run/current-system/sw/bin/panelctl";
-      PANEL_FRONTEND_DIR = "${./panel/frontend}";
-    };
-  };
-
   security.sudo.wheelNeedsPassword = true;
   security.sudo.extraRules = [
     {

flake.nix

@@ -30,6 +30,7 @@
           { nixpkgs.overlays = [ agenix.overlays.default ]; }
           vpsadminos.nixosModules.container_25_11
           ./configuration.nix
+          ./panel.nix
           ./caddy.nix
           ./authelia.nix
           ./containers/hello.nix

panel.nix

@@ -0,0 +1,78 @@
+{ config, pkgs, ... }:
+
+{
+  environment.systemPackages = [
+    (pkgs.writeShellScriptBin "panelctl" (builtins.readFile ./panel/panelctl.sh))
+  ];
+
+  users.groups.panelroutes = { };
+
+  users.users.reudy.extraGroups = [ "panelroutes" ];
+  users.users.caddy.extraGroups = [ "panelroutes" ];
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/containers 0755 reudy panelroutes -"
+    "d /var/lib/containers/stacks 0750 reudy panelroutes -"
+    "d /var/lib/containers/volumes 0750 reudy panelroutes -"
+    "d /var/lib/containers/routes 0755 reudy panelroutes -"
+    "d /var/lib/containers/state 0750 reudy panelroutes -"
+    "d /var/lib/containers/state/apps 0750 reudy panelroutes -"
+    "d /var/lib/containers/backups 0750 reudy panelroutes -"
+    "f /var/lib/containers/routes/routes.caddy 0664 reudy panelroutes -"
+  ];
+
+  systemd.services.panel-api = {
+    description = "Minimal panel API service";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    path = [
+      pkgs.podman
+      pkgs.podman-compose
+      pkgs.curl
+      pkgs.sudo
+      pkgs.coreutils
+      pkgs.zip
+      pkgs.unzip
+    ];
+
+    serviceConfig = {
+      Type = "simple";
+      User = "reudy";
+      Group = "panelroutes";
+      Restart = "always";
+      RestartSec = 3;
+      WorkingDirectory = "/home/reudy";
+      ExecStart = "${pkgs.python3}/bin/python3 ${./panel/panel-api.py}";
+    };
+
+    environment = {
+      PANEL_API_BIND = "127.0.0.1";
+      PANEL_API_PORT = "9911";
+      PANEL_BASE_DIR = "/var/lib/containers";
+      PANELCTL_PATH = "/run/current-system/sw/bin/panelctl";
+      PANEL_FRONTEND_DIR = "${./panel/frontend}";
+    };
+  };
+
+  services.caddy.virtualHosts."panel.srazka.com".extraConfig = ''
+    forward_auth 127.0.0.1:9091 {
+      uri /api/authz/forward-auth
+      copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+    }
+    reverse_proxy 127.0.0.1:9911
+  '';
+
+  systemd.paths."caddy-routes-reload" = {
+    wantedBy = [ "multi-user.target" ];
+    pathConfig = {
+      PathChanged = "/var/lib/containers/routes/routes.caddy";
+    };
+  };
+
+  systemd.services."caddy-routes-reload" = {
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.systemd}/bin/systemctl reload caddy.service";
+    };
+  };
+}