diff --git a/caddy.nix b/caddy.nix index 0318909..dc45810 100755 --- a/caddy.nix +++ b/caddy.nix @@ -22,6 +22,23 @@ } reverse_proxy 192.168.100.11:80 ''; + + # Nextcloud — served by local nginx + # (Authelia forward-auth disabled for now; re-enable by uncommenting the + # forward_auth block below.) + virtualHosts."nextcloud.srazka.com".extraConfig = '' + # forward_auth 127.0.0.1:9091 { + # uri /api/authz/forward-auth + # copy_headers Remote-User Remote-Groups Remote-Email Remote-Name + # } + reverse_proxy 127.0.0.1:8081 + ''; + + # Forgejo — no Authelia forward-auth, since it would break git over HTTPS + # and the API. Forgejo handles its own logins. + virtualHosts."git.srazka.com".extraConfig = '' + reverse_proxy 127.0.0.1:14921 + ''; }; } diff --git a/configuration.nix b/configuration.nix index 824aee7..ef4e9cf 100644 --- a/configuration.nix +++ b/configuration.nix @@ -29,12 +29,11 @@ homeMode = "0755"; extraGroups = [ "wheel" "podman" ]; #sudo openssh.authorizedKeys.keys = [ - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6TOSFZ+P0oWTa9U3fX/L9c3btv/lCgzPrwKu621aLDjSbWbaddGhAXQtJvl7GJvs7QN52z+icftK94gdeyTbZyzQtY6JNUVmUs5EHlZlYTkAYSFN/rkn6N7/n9aYRN+vd8r0B4IrP5gTPtGglLD16dfukpOgwtQj/eK6tqZpVlZ7LnKK7UaA6a4OXMYgJZAwdzAOfFGfbO++5q+igBdfNJmh5LtYMI6te8AlJGBSVierzeStEzTVbIys1EsyNrEMzAljHBxxco2L7enNmz4xciRNCQ/za5xPmhf8nOoZTIalBziM52DGH6rFzUEBVsqez1U2U4ajVzdSIudOlku4w63YnClHeGNu9AdHJjR7PbIHwui17aGKM/l/Qv/LOWWo+nfO1hbCl0fGZwVkl8p4yR3WM73OWEHn1f+Uc4cWAUDZ/ZDPE0qyA/HAnSA6dfzY66y2evjRBeekA4zcxgmc7Q/2XfKHDYMEKTNkgdO6UAFoUqW4BiyF36FcS1ccjUok= root@DESKTOP-40EVMS3" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahgKnADam4PGc9TiANkWGx09uNuS42tllj70UuyzPf u0_a279@localhost" + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6TOSFZ+P0oWTa9U3fX/L9c3btv/lCgzPrwKu621aLDjSbWbaddGhAXQtJvl7GJvs7QN52z+icftK94gdeyTbZyzQtY6JNUVmUs5EHlZlYTkAYSFN/rkn6N7/n9aYRN+vd8r0B4IrP5gTPtGglLD16dfukpOgwtQj/eK6tqZpVlZ7LnKK7UaA6a4OXMYgJZAwdzAOfFGfbO++5q+igBdfNJmh5LtYMI6te8AlJGBSVierzeStEzTVbIys1EsyNrEMzAljHBxxco2L7enNmz4xciRNCQ/za5xPmhf8nOoZTIalBziM52DGH6rFzUEBVsqez1U2U4ajVzdSIudOlku4w63YnClHeGNu9AdHJjR7PbIHwui17aGKM/l/Qv/LOWWo+nfO1hbCl0fGZwVkl8p4yR3WM73OWEHn1f+Uc4cWAUDZ/ZDPE0qyA/HAnSA6dfzY66y2evjRBeekA4zcxgmc7Q/2XfKHDYMEKTNkgdO6UAFoUqW4BiyF36FcS1ccjUok= root@DESKTOP-40EVMS3" # desktop "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhbz4AlnRrRNvUwlYd5siMTuvgvSwlJ21Tq54OA20ID reudy@DESKTOP-40EVMS3" - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQD0mitcnuzNWof+RbTIoxDaXonU6yk+i6kpA4lIdI5fE6fzLCOGia5q4t1qen7Lhj1RMuJRqg5R8GeYmAW3tx2Uo3mqnQLJY227xs2FJU5ygn8JW1Uivp6sCJO5yzCHv8JYy9ala+eHlmppmjBo+NnU2mNlPfM5pNKef/srz5jmkeD+73rUim/1KSCZ3yOzSzc1jf7vNkxXAgDREzbmX/sqIrhG2DxjGAaX6SJjh0lh9OF6m1lAkEGq39h3WS7UKAsP3Z2OOSfEKwAefYvijIoWpL5+XGas3p7mhBG9ZDATJVcUHD/tg7XC4QOU8rYTjuP2/ECFS37q4+OCCJlyBRY46AS4ohKDs9iF8z9IjI3G2P6nTOeIySL84kKGI3ufcvBtUpITKWF4rwLE2R4WVG3SOMSCizFJZtpijVOJJulJUYwIyx0khSGpg3cL2LePyJn23FMlaG6w03H0ngdckGxLuvd+H0D12YVa0990hYaquzXPfMsSUy5T9ZievsVu6jU= reudy@Reudy" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICKwpcTESCEAiQ+/c8bM9Y2b53nCCl3qFI5KRuEkR+Ya jacob@DESKTOP-40EVMS3" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDY+AJwXxv/kv0LvZLWPfjxbG3jsjfrtCyPzhXYGKttK reudy-book@fedora" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahgKnADam4PGc9TiANkWGx09uNuS42tllj70UuyzPf u0_a279@localhost" # termux-phone + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDY+AJwXxv/kv0LvZLWPfjxbG3jsjfrtCyPzhXYGKttK reudy-book@fedora" # surface-fedora ]; }; diff --git a/flake.nix b/flake.nix index 0003122..89ee6d6 100644 --- a/flake.nix +++ b/flake.nix @@ -34,6 +34,8 @@ ./panel.nix ./caddy.nix ./authelia.nix + ./nextcloud.nix + ./forgejo.nix ./containers/hello.nix agenix.nixosModules.default diff --git a/forgejo.nix b/forgejo.nix new file mode 100644 index 0000000..47846df --- /dev/null +++ b/forgejo.nix @@ -0,0 +1,42 @@ +{ config, ... }: +let + domain = "git.srazka.com"; + sshPort = 14922; +in +{ + services.forgejo = { + enable = true; + + # SQLite is plenty for a single-user VPS, same as Nextcloud/Authelia. + database.type = "sqlite3"; + + # Git LFS support for large files. + lfs.enable = true; + + settings = { + server = { + DOMAIN = domain; + ROOT_URL = "https://${domain}/"; + + # Caddy terminates TLS and proxies to this; not reachable from outside. + HTTP_ADDR = "127.0.0.1"; + HTTP_PORT = 14921; + + # Forgejo's built-in SSH server, separate from the system sshd (which + # only allows 'reudy' on 14902). Clone URLs look like: + # ssh://git@git.srazka.com:14922//.git + START_SSH_SERVER = true; + SSH_PORT = sshPort; + SSH_LISTEN_PORT = sshPort; + BUILTIN_SSH_SERVER_USER = "git"; + }; + + # Private instance — create accounts with the admin CLI instead. + service.DISABLE_REGISTRATION = true; + + session.COOKIE_SECURE = true; + }; + }; + + networking.firewall.allowedTCPPorts = [ sshPort ]; +} diff --git a/nextcloud.nix b/nextcloud.nix new file mode 100644 index 0000000..87a0c1a --- /dev/null +++ b/nextcloud.nix @@ -0,0 +1,53 @@ +{ config, pkgs, ... }: + +{ + # Admin password is managed by agenix. + # Create secrets/nextcloud-admin-pass.age and add it to secrets.nix, + # then run: agenix -e secrets/nextcloud-admin-pass.age + age.secrets."nextcloud-admin-pass" = { + file = ./secrets/nextcloud-admin-pass.age; + owner = "nextcloud"; + group = "nextcloud"; + mode = "0400"; + }; + + services.nextcloud = { + enable = true; + package = pkgs.nextcloud33; + + hostName = "nextcloud.srazka.com"; + https = true; + + config = { + adminuser = "admin-reudy"; + adminpassFile = config.age.secrets."nextcloud-admin-pass".path; + dbtype = "sqlite"; + }; + + # Tell Nextcloud it's behind a trusted reverse proxy. + settings = { + trusted_proxies = [ "127.0.0.1" ]; + overwriteprotocol = "https"; + overwritehost = "nextcloud.srazka.com"; + default_phone_region = "NL"; + }; + }; + + # Let Caddy handle TLS termination; nginx only listens on localhost. + # The nextcloud module creates the virtualhost at hostName; we override + # its listen address here. + services.nginx.virtualHosts.${config.services.nextcloud.hostName}.listen = [ + { + addr = "127.0.0.1"; + port = 8081; + } + ]; + + # The cron timer can fire before nextcloud-setup.service has finished on + # first boot, causing a "Not installed" failure. Make the cron service wait + # for setup to complete before it's allowed to run. + systemd.services.nextcloud-cron = { + after = [ "nextcloud-setup.service" ]; + requires = [ "nextcloud-setup.service" ]; + }; +} diff --git a/secrets.nix b/secrets.nix index 0141976..4db5017 100644 --- a/secrets.nix +++ b/secrets.nix @@ -2,7 +2,8 @@ let wsl-desktop = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhbz4AlnRrRNvUwlYd5siMTuvgvSwlJ21Tq54OA20ID reudy@DESKTOP-40EVMS3"; termux-phone = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahgKnADam4PGc9TiANkWGx09uNuS42tllj70UuyzPf u0_a279@localhost"; bash-nixos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAP6gemgKZVguFi6Diif+dBbMAZQupimeV9OQuUotlw vps-manual"; - users = [ wsl-desktop termux-phone bash-nixos ]; + reudy-book = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDY+AJwXxv/kv0LvZLWPfjxbG3jsjfrtCyPzhXYGKttK reudy-book@fedora"; + users = [ wsl-desktop termux-phone bash-nixos reudy-book ]; nixos-vps = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINjPVQpFlKGbDNqOVvKAFRExKHAAkKSAqKabDSMtJsth"; systems = [ nixos-vps ]; @@ -16,4 +17,7 @@ in "secrets/authelia-session-secret.age".publicKeys = users ++ systems; # The hashed users database (contains bcrypt-hashed passwords) "secrets/authelia-users.age".publicKeys = users ++ systems; + + # Nextcloud admin password (plaintext, read by the nextcloud service) + "secrets/nextcloud-admin-pass.age".publicKeys = users ++ systems; } diff --git a/secrets/authelia-jwt-secret.age b/secrets/authelia-jwt-secret.age index 57e4a1c..95f7ef2 100644 --- a/secrets/authelia-jwt-secret.age +++ b/secrets/authelia-jwt-secret.age @@ -1,11 +1,14 @@ age-encryption.org/v1 --> ssh-ed25519 Ol8kbg zksXMifeU7LyTKz1oQ1Qj+/U8FJUrvuRKqpQIK82TGo -GCsLKn6A2exjSLRLsUmF6+Loa7IGvTLnPG9Jr/A0yM8 --> ssh-ed25519 QGvsHg MzWMzGsdlyvdAKkXHPesGT+H5C2sCXokpQyIvr4xrHc -LhGNtbBQNVWyz4WAIEYIw8J812me7qBE0xjlWk8N58k --> ssh-ed25519 yjVKVA 5rTOZYgaA/MMuoFmiLJo2dbuw2ZdRkrJ2fYXHjd0xQI -M0NEgt9CwRQDWQgXSU7Ef4UP2wLoe/RAu1uJxQGH1ws --> ssh-ed25519 4XPa+g hLGxBVCTB/je9yQrjPNZaJYRqlJrabsFQT8BQzw8d3Q -qpyMa38v48SzATy1vUVzccKPhPcqV6BgnkyiwBDOiEI ---- 6Ft39sS5aV9B5pyMX7yr6FH19M2uW8j3AcN86LsVztg -eÑ?CkgBui";..:GJB/aYab=]U(=|SYfV7GBz7FJGKg__C{nU}n \ No newline at end of file +-> ssh-ed25519 Ol8kbg 2wJUE7haViW3E1CSSv8dsZjsSXszmDFmn+JU6b2zqQ0 +/mdmCA0JTPrN13ES9J6d1e/NP7o3uzdAVDHuLRLbUEw +-> ssh-ed25519 QGvsHg WbbdMC6coHNQswT+iftkGHI8ztioyOWFVFWrnC4BK3I +ECBNNcEt5qhaS2l7YJLzt8nahdMn5JYvzB7giEXLog8 +-> ssh-ed25519 yjVKVA sRVRnJy/jj2xMNTtuJJJpvl45EirQZdPNSmm0tQLBjI +McDk7P8kUSkvb/cfzPvpCsNElvK4px4TY3jT+0005Zo +-> ssh-ed25519 5jHFSg 8D/T/d4CBLGMy/BOKTrgoRqlYzImChosh6Y5fArwDns +IPIUX25vNg7iZ7fzP3cv/3uj6iW/KR613KoLglTzHYQ +-> ssh-ed25519 4XPa+g Qgekfq0nBDZjdx4pe9VlWXrFCcssvwMC+tCnEP142kE +zZEBinsKM0+b7YpEy7CTsj3MKmuKcS9UmoKJWsE44rs +--- j9Tg3Skfil0D+wdP/Sg12ES5hiiBeAVHBHy3boWThCc +ٞl104ظGۦ~ZrE.Β~뗣p@XOh ]PUP-C(y[8Ro1v.7tԖnDy@ ݖ9}s + \ No newline at end of file diff --git a/secrets/authelia-session-secret.age b/secrets/authelia-session-secret.age index 8ee810b..2d8fdca 100644 --- a/secrets/authelia-session-secret.age +++ b/secrets/authelia-session-secret.age @@ -1,11 +1,15 @@ age-encryption.org/v1 --> ssh-ed25519 Ol8kbg PME/VhYsgR6BmtBkayWFiQenodqfOjMGzuLk8UK1RFQ -zprwLWBvcXwc6mvSiOYDYz0UvCi6V7u7Wfmh6eQ2AlY --> ssh-ed25519 QGvsHg HR7vnqTjsb46efZd00s7cDlhWz4xe+bpvBEOrAY0o0I -2T4h8K93osNlOR+4pqSa42LqjTvnNSiJC532Lh2oZI0 --> ssh-ed25519 yjVKVA tcXgP7+G6bfLj85Zx8wpGHD5UqtH9LcV56fHdLA2Ak8 -BZTIikJmI0Qu6MYxM8EiGXFu+MSGC2ZGfhqNf4j0jVc --> ssh-ed25519 4XPa+g PdwyAoUViWkBiQ4l8mUWH7Elw/KdI2Torjgm72pvWzk -XanrDZ2NNiU7bBvz3OQdHRh66WAwT0U81QmEXjX9QT8 ---- OTl/rm+mZy0LF+O7ff8AeseeacGhRGX+NitEMX7nYDA -{vi螾etJx bB03jW_K|EB7^_,"sr G56Qv_!$E:?C+hyեoٛ&GHuX \ No newline at end of file +-> ssh-ed25519 Ol8kbg xZ+5r1uS7FJi7Oi2yg0QJgsKaXT8rk7coxSH0Ky++Fo +0MQFruRiO/Pq5HcxdKI8/QF/oy/3Z5hyak/Y/m1od1I +-> ssh-ed25519 QGvsHg 2tNU/yrDrRBV2R2FWbd1zQqXZaigEat8ChrtGo2fHmU +oS9aEWiaMg3jDZ6d6iUjblaEEbKLVkqxxqw4gA/8YO0 +-> ssh-ed25519 yjVKVA Dx4Tf4Dhs/kUDC7jhdgZYNxr0pIObGJw/KKJR8luWBc +07ASNQzRlKzRI1Y4v5qdhxOH8g+Xzi2k51KMmApcTuY +-> ssh-ed25519 5jHFSg lWVSFCU0xBspN9VYEOcjHvss9HLobGmC6UUh+0Fp7H8 +UH7YQy/pHVYi5N7xiGos6g8cnP5TEhu+QMWju2l63uQ +-> ssh-ed25519 4XPa+g yaxH6rX1mhaQ00dvLCyjkbJYWjgsHuciP5AvfZab4U4 +Z2eWdeze/Wv+rEbZys5/dL8OeWhO5OkGsofyae82YwU +--- V+ieHOEeY8PVexEjHETuKFvq4/FSXj4pN0yD7dik7S4 +ɏ g2 Qc&w&?\5%(a)%ݐ% +Gva +_iל} 5M2,'-,/hR{TD$SG-iW2, \ No newline at end of file diff --git a/secrets/authelia-storage-key.age b/secrets/authelia-storage-key.age index a5101b1..6aaeafd 100644 Binary files a/secrets/authelia-storage-key.age and b/secrets/authelia-storage-key.age differ diff --git a/secrets/authelia-users.age b/secrets/authelia-users.age index 87f02ad..f35ed5f 100644 Binary files a/secrets/authelia-users.age and b/secrets/authelia-users.age differ diff --git a/secrets/lilsecret.age b/secrets/lilsecret.age index 2dbcded..a4b6012 100644 --- a/secrets/lilsecret.age +++ b/secrets/lilsecret.age @@ -1,11 +1,13 @@ age-encryption.org/v1 --> ssh-ed25519 Ol8kbg fWu9AFQRAbjt0HMIdT/I5mk8D03yg9awUBT4I40Pel0 -k68FQ2Hdlle23Fr8trCFYV9Si0VKJWm80CkNBLYa4rI --> ssh-ed25519 QGvsHg qDDe9753l0rVmMcWXwMqtG49zv29lMVVbnttdFP1l30 -bvbtwFqvkrBZl0usEdvq1n0Y1k1UrGdi6paBCJygNAg --> ssh-ed25519 yjVKVA FRbiN2Ki8UH4nQC8zLyFXszvw7K6r7BI4dhrgqNbAGI -zXRBQ1e06qFGvDPPqchbIlKs+Rm8+Mz7BmQsx/jobMU --> ssh-ed25519 4XPa+g Wl+5kuVZDfybb3TA6Rn5bfPS4nS1oLz6m1Oo51UC1Fo -aDR6bXclTpBa6IWa+yDfCWei/hBq+5NpBINSqKgkx24 ---- /vQcwx2JMqdVIM0EVDUfuNWOPiFfXg91WAKvjHrq1xA -z9ڶ7"D|]ޢZwTE`IOv,DRNJ;-AN \ No newline at end of file +-> ssh-ed25519 Ol8kbg PUbRX+aA8Sp6ZY6NeQmnYDrzoGhLPsJ9Zy9G7t4TPE0 +FS6YUAGwKNdVXnG8K9t3mlRVnM9gFeX+S1TER3NduPY +-> ssh-ed25519 QGvsHg KXB/Y5/J6Q5TcHjT7yUHHVhNuajbzF/Alk17WZuPcho +TqwPN/yO/UTEYPELWl8i3XfhI1o5OwRCQF8whnw0ewI +-> ssh-ed25519 yjVKVA y5yDQ5x+399MpZQL6bzExvs5PI2jvhVXgp14zaVOwSQ +XuxM98i+jH8ux6UhB9G8qZqpuLnt9dgwf03QOf4p1lQ +-> ssh-ed25519 5jHFSg MIk2APZ9fGRa/+S6ppT/5MpXgOA8ncqz7Nk9xJvwiDg +fJrvR79qZTpEhpsj5q2wqRMHUy4xT4CdoAF6fHNGD2A +-> ssh-ed25519 4XPa+g 0BKeQIajOJ1CCGLjS48PDTxEkAGNWeH6Lwp02Q8scwo +bGvrxqmMstH8EahbAUwvbuSViZDinjtW5I+3+/4jw8w +--- rNfyE9cTfN/UbpEkJc7ACmhg/ME/ocVeZll8S+R7Oos +*j<m]+ C\>.:_%FLjqtPign \ No newline at end of file diff --git a/secrets/nextcloud-admin-pass.age b/secrets/nextcloud-admin-pass.age new file mode 100644 index 0000000..4040408 Binary files /dev/null and b/secrets/nextcloud-admin-pass.age differ