titaniumtown/server-config
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ports refactor

Browse Source
This commit is contained in:
Simon Gardling
2026-03-21 11:54:40 -04:00
parent 5ced648bd6
commit a5f3af5ff3
32 changed files with 264 additions and 128 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
configuration.nix
View File

@@ -285,7 +285,7 @@
openFirewall = true; openFirewall = true;
welcometext = "meow meow meow meow meow :3 xd"; welcometext = "meow meow meow meow meow :3 xd";
password = builtins.readFile ./secrets/murmur_password; password = builtins.readFile ./secrets/murmur_password;
port = service_configs.ports.murmur; port = service_configs.ports.public.murmur.port;
}; };
# services.botamusique = { # services.botamusique = {

45
flake.nix
View File

@@ -142,19 +142,46 @@
; ;
}; };
modules = [ modules = [
# SAFETY! make sure no ports collide # SAFETY! port sanity checks
( (
{ lib, ... }: { config, lib, ... }:
let
publicPorts = lib.attrValues service_configs.ports.public;
privatePorts = lib.attrValues service_configs.ports.private;
allPortNumbers = map (p: p.port) (publicPorts ++ privatePorts);
uniquePortNumbers = lib.unique allPortNumbers;
# Which public ports must be in each firewall list
publicTcp = map (p: p.port) (lib.filter (p: p.proto == "tcp" || p.proto == "both") publicPorts);
publicUdp = map (p: p.port) (lib.filter (p: p.proto == "udp" || p.proto == "both") publicPorts);
privatePortNumbers = map (p: p.port) privatePorts;
fwTcp = config.networking.firewall.allowedTCPPorts;
fwUdp = config.networking.firewall.allowedUDPPorts;
missingTcp = lib.filter (p: !(builtins.elem p fwTcp)) publicTcp;
missingUdp = lib.filter (p: !(builtins.elem p fwUdp)) publicUdp;
leakedTcp = lib.filter (p: builtins.elem p fwTcp) privatePortNumbers;
leakedUdp = lib.filter (p: builtins.elem p fwUdp) privatePortNumbers;
in
{ {
config.assertions = [ config.assertions = [
{ {
assertion = assertion = (lib.length allPortNumbers) == (lib.length uniquePortNumbers);
let message = "Duplicate port numbers detected in ports.public / ports.private";
ports = lib.attrValues service_configs.ports; }
uniquePorts = lib.unique ports; {
in assertion = missingTcp == [ ];
(lib.length ports) == (lib.length uniquePorts); message = "Public ports missing from allowedTCPPorts: ${builtins.toString missingTcp}";
message = "Duplicate ports detected in 'ports' configuration"; }
{
assertion = missingUdp == [ ];
message = "Public ports missing from allowedUDPPorts: ${builtins.toString missingUdp}";
}
{
assertion = leakedTcp == [ ] && leakedUdp == [ ];
message = "Private ports leaked into firewall allow-lists — TCP: ${builtins.toString leakedTcp}, UDP: ${builtins.toString leakedUdp}";
} }
]; ];
} }

175
service-configs.nix
View File

@@ -9,42 +9,147 @@ rec {
cpu_arch = "znver3"; cpu_arch = "znver3";
ports = { ports = {
# public # Ports exposed to the internet. The flake asserts every public port
http = 80; # TCP # appears in the corresponding firewall allow-list (TCP, UDP, or both).
https = 443; # TCP+UDP (HTTP/3 QUIC) public = {
minecraft = 25565; # TCP http = {
syncthing_protocol = 22000; # TCP+UDP (QUIC) port = 80;
syncthing_discovery = 21027; # UDP proto = "tcp";
matrix_federation = 8448; # TCP+UDP (HTTP/3 QUIC) };
coturn = 3478; # TCP+UDP https = {
coturn_tls = 5349; # TCP+UDP port = 443;
livekit = 7880; # TCP proto = "both";
soulseek_listen = 50300; # TCP }; # HTTP/3 QUIC
monero = 18080; # TCP minecraft = {
p2pool_p2p = 37889; # TCP port = 25565;
murmur = 64738; # TCP + UDP proto = "tcp";
};
syncthing_protocol = {
port = 22000;
proto = "both";
}; # QUIC
syncthing_discovery = {
port = 21027;
proto = "udp";
};
matrix_federation = {
port = 8448;
proto = "both";
}; # HTTP/3 QUIC
coturn = {
port = 3478;
proto = "both";
};
coturn_tls = {
port = 5349;
proto = "both";
};
livekit = {
port = 7880;
proto = "tcp";
};
soulseek_listen = {
port = 50300;
proto = "tcp";
};
monero = {
port = 18080;
proto = "tcp";
};
monero_rpc = {
port = 18081;
proto = "tcp";
}; # restricted public RPC
p2pool_p2p = {
port = 37889;
proto = "tcp";
};
murmur = {
port = 64738;
proto = "both";
};
};
# private # Ports bound to localhost / VPN only. The flake asserts none of
jellyfin = 8096; # TCP - no services.jellyfin option for this # these appear in the firewall allow-lists.
torrent = 6011; # TCP private = {
bitmagnet = 3333; # TCP jellyfin = {
gitea = 2283; # TCP port = 8096;
immich = 2284; # TCP proto = "tcp";
soulseek_web = 5030; # TCP };
vaultwarden = 8222; # TCP torrent = {
syncthing_gui = 8384; # TCP port = 6011;
matrix = 6167; # TCP proto = "tcp";
ntfy = 2586; # TCP };
lk_jwt = 8081; # TCP bitmagnet = {
prowlarr = 9696; # TCP port = 3333;
sonarr = 8989; # TCP proto = "tcp";
radarr = 7878; # TCP };
bazarr = 6767; # TCP gitea = {
jellyseerr = 5055; # TCP port = 2283;
monero_rpc = 18081; # TCP proto = "tcp";
monero_zmq = 18083; # TCP };
p2pool_stratum = 3334; # TCP immich = {
firefox_syncserver = 5000; # TCP port = 2284;
proto = "tcp";
};
soulseek_web = {
port = 5030;
proto = "tcp";
};
vaultwarden = {
port = 8222;
proto = "tcp";
};
syncthing_gui = {
port = 8384;
proto = "tcp";
};
matrix = {
port = 6167;
proto = "tcp";
};
ntfy = {
port = 2586;
proto = "tcp";
};
lk_jwt = {
port = 8081;
proto = "tcp";
};
prowlarr = {
port = 9696;
proto = "tcp";
};
sonarr = {
port = 8989;
proto = "tcp";
};
radarr = {
port = 7878;
proto = "tcp";
};
bazarr = {
port = 6767;
proto = "tcp";
};
jellyseerr = {
port = 5055;
proto = "tcp";
};
monero_zmq = {
port = 18083;
proto = "tcp";
};
p2pool_stratum = {
port = 3334;
proto = "tcp";
};
firefox_syncserver = {
port = 5000;
proto = "tcp";
};
};
}; };
https = { https = {

4
services/arr/arr-search.nix
View File

@@ -7,8 +7,8 @@ let
radarrConfig = "${service_configs.radarr.dataDir}/config.xml"; radarrConfig = "${service_configs.radarr.dataDir}/config.xml";
sonarrConfig = "${service_configs.sonarr.dataDir}/config.xml"; sonarrConfig = "${service_configs.sonarr.dataDir}/config.xml";
radarrUrl = "http://localhost:${builtins.toString service_configs.ports.radarr}"; radarrUrl = "http://localhost:${builtins.toString service_configs.ports.private.radarr.port}";
sonarrUrl = "http://localhost:${builtins.toString service_configs.ports.sonarr}"; sonarrUrl = "http://localhost:${builtins.toString service_configs.ports.private.sonarr.port}";
curl = "${pkgs.curl}/bin/curl"; curl = "${pkgs.curl}/bin/curl";
jq = "${pkgs.jq}/bin/jq"; jq = "${pkgs.jq}/bin/jq";

4
services/arr/bazarr.nix
View File

@@ -20,12 +20,12 @@
services.bazarr = { services.bazarr = {
enable = true; enable = true;
listenPort = service_configs.ports.bazarr; listenPort = service_configs.ports.private.bazarr.port;
}; };
services.caddy.virtualHosts."bazarr.${service_configs.https.domain}".extraConfig = '' services.caddy.virtualHosts."bazarr.${service_configs.https.domain}".extraConfig = ''
import ${config.age.secrets.caddy_auth.path} import ${config.age.secrets.caddy_auth.path}
reverse_proxy :${builtins.toString service_configs.ports.bazarr} reverse_proxy :${builtins.toString service_configs.ports.private.bazarr.port}
''; '';
users.users.${config.services.bazarr.user}.extraGroups = [ users.users.${config.services.bazarr.user}.extraGroups = [

24
services/arr/init.nix
View File

@@ -4,7 +4,7 @@
prowlarr = { prowlarr = {
enable = true; enable = true;
serviceName = "prowlarr"; serviceName = "prowlarr";
port = service_configs.ports.prowlarr; port = service_configs.ports.private.prowlarr.port;
dataDir = service_configs.prowlarr.dataDir; dataDir = service_configs.prowlarr.dataDir;
apiVersion = "v1"; apiVersion = "v1";
networkNamespacePath = "/run/netns/wg"; networkNamespacePath = "/run/netns/wg";
@@ -14,8 +14,8 @@
name = "Sonarr"; name = "Sonarr";
implementation = "Sonarr"; implementation = "Sonarr";
configContract = "SonarrSettings"; configContract = "SonarrSettings";
prowlarrUrl = "http://localhost:${builtins.toString service_configs.ports.prowlarr}"; prowlarrUrl = "http://localhost:${builtins.toString service_configs.ports.private.prowlarr.port}";
baseUrl = "http://${config.vpnNamespaces.wg.bridgeAddress}:${builtins.toString service_configs.ports.sonarr}"; baseUrl = "http://${config.vpnNamespaces.wg.bridgeAddress}:${builtins.toString service_configs.ports.private.sonarr.port}";
apiKeyFrom = "${service_configs.sonarr.dataDir}/config.xml"; apiKeyFrom = "${service_configs.sonarr.dataDir}/config.xml";
syncCategories = [ syncCategories = [
5000 5000
@@ -33,8 +33,8 @@
name = "Radarr"; name = "Radarr";
implementation = "Radarr"; implementation = "Radarr";
configContract = "RadarrSettings"; configContract = "RadarrSettings";
prowlarrUrl = "http://localhost:${builtins.toString service_configs.ports.prowlarr}"; prowlarrUrl = "http://localhost:${builtins.toString service_configs.ports.private.prowlarr.port}";
baseUrl = "http://${config.vpnNamespaces.wg.bridgeAddress}:${builtins.toString service_configs.ports.radarr}"; baseUrl = "http://${config.vpnNamespaces.wg.bridgeAddress}:${builtins.toString service_configs.ports.private.radarr.port}";
apiKeyFrom = "${service_configs.radarr.dataDir}/config.xml"; apiKeyFrom = "${service_configs.radarr.dataDir}/config.xml";
syncCategories = [ syncCategories = [
2000 2000
@@ -56,7 +56,7 @@
sonarr = { sonarr = {
enable = true; enable = true;
serviceName = "sonarr"; serviceName = "sonarr";
port = service_configs.ports.sonarr; port = service_configs.ports.private.sonarr.port;
dataDir = service_configs.sonarr.dataDir; dataDir = service_configs.sonarr.dataDir;
healthChecks = true; healthChecks = true;
rootFolders = [ service_configs.media.tvDir ]; rootFolders = [ service_configs.media.tvDir ];
@@ -68,7 +68,7 @@
serviceName = "qbittorrent"; serviceName = "qbittorrent";
fields = { fields = {
host = config.vpnNamespaces.wg.namespaceAddress; host = config.vpnNamespaces.wg.namespaceAddress;
port = service_configs.ports.torrent; port = service_configs.ports.private.torrent.port;
useSsl = false; useSsl = false;
tvCategory = "tvshows"; tvCategory = "tvshows";
}; };
@@ -79,7 +79,7 @@
radarr = { radarr = {
enable = true; enable = true;
serviceName = "radarr"; serviceName = "radarr";
port = service_configs.ports.radarr; port = service_configs.ports.private.radarr.port;
dataDir = service_configs.radarr.dataDir; dataDir = service_configs.radarr.dataDir;
healthChecks = true; healthChecks = true;
rootFolders = [ service_configs.media.moviesDir ]; rootFolders = [ service_configs.media.moviesDir ];
@@ -91,7 +91,7 @@
serviceName = "qbittorrent"; serviceName = "qbittorrent";
fields = { fields = {
host = config.vpnNamespaces.wg.namespaceAddress; host = config.vpnNamespaces.wg.namespaceAddress;
port = service_configs.ports.torrent; port = service_configs.ports.private.torrent.port;
useSsl = false; useSsl = false;
movieCategory = "movies"; movieCategory = "movies";
}; };
@@ -103,17 +103,17 @@
services.bazarrInit = { services.bazarrInit = {
enable = true; enable = true;
dataDir = "/var/lib/bazarr"; dataDir = "/var/lib/bazarr";
port = service_configs.ports.bazarr; port = service_configs.ports.private.bazarr.port;
sonarr = { sonarr = {
enable = true; enable = true;
dataDir = service_configs.sonarr.dataDir; dataDir = service_configs.sonarr.dataDir;
port = service_configs.ports.sonarr; port = service_configs.ports.private.sonarr.port;
serviceName = "sonarr"; serviceName = "sonarr";
}; };
radarr = { radarr = {
enable = true; enable = true;
dataDir = service_configs.radarr.dataDir; dataDir = service_configs.radarr.dataDir;
port = service_configs.ports.radarr; port = service_configs.ports.private.radarr.port;
serviceName = "radarr"; serviceName = "radarr";
}; };
}; };

4
services/arr/jellyseerr.nix
View File

@@ -17,7 +17,7 @@
services.jellyseerr = { services.jellyseerr = {
enable = true; enable = true;
port = service_configs.ports.jellyseerr; port = service_configs.ports.private.jellyseerr.port;
configDir = service_configs.jellyseerr.configDir; configDir = service_configs.jellyseerr.configDir;
}; };
@@ -38,6 +38,6 @@
services.caddy.virtualHosts."jellyseerr.${service_configs.https.domain}".extraConfig = '' services.caddy.virtualHosts."jellyseerr.${service_configs.https.domain}".extraConfig = ''
# import ${config.age.secrets.caddy_auth.path} # import ${config.age.secrets.caddy_auth.path}
reverse_proxy :${builtins.toString service_configs.ports.jellyseerr} reverse_proxy :${builtins.toString service_configs.ports.private.jellyseerr.port}
''; '';
} }

6
services/arr/prowlarr.nix
View File

@@ -10,17 +10,17 @@
(lib.serviceMountWithZpool "prowlarr" service_configs.zpool_ssds [ (lib.serviceMountWithZpool "prowlarr" service_configs.zpool_ssds [
service_configs.prowlarr.dataDir service_configs.prowlarr.dataDir
]) ])
(lib.vpnNamespaceOpenPort service_configs.ports.prowlarr "prowlarr") (lib.vpnNamespaceOpenPort service_configs.ports.private.prowlarr.port "prowlarr")
]; ];
services.prowlarr = { services.prowlarr = {
enable = true; enable = true;
dataDir = service_configs.prowlarr.dataDir; dataDir = service_configs.prowlarr.dataDir;
settings.server.port = service_configs.ports.prowlarr; settings.server.port = service_configs.ports.private.prowlarr.port;
}; };
services.caddy.virtualHosts."prowlarr.${service_configs.https.domain}".extraConfig = '' services.caddy.virtualHosts."prowlarr.${service_configs.https.domain}".extraConfig = ''
import ${config.age.secrets.caddy_auth.path} import ${config.age.secrets.caddy_auth.path}
reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.prowlarr} reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.private.prowlarr.port}
''; '';
} }

4
services/arr/radarr.nix
View File

@@ -21,13 +21,13 @@
services.radarr = { services.radarr = {
enable = true; enable = true;
dataDir = service_configs.radarr.dataDir; dataDir = service_configs.radarr.dataDir;
settings.server.port = service_configs.ports.radarr; settings.server.port = service_configs.ports.private.radarr.port;
settings.update.mechanism = "external"; settings.update.mechanism = "external";
}; };
services.caddy.virtualHosts."radarr.${service_configs.https.domain}".extraConfig = '' services.caddy.virtualHosts."radarr.${service_configs.https.domain}".extraConfig = ''
import ${config.age.secrets.caddy_auth.path} import ${config.age.secrets.caddy_auth.path}
reverse_proxy :${builtins.toString service_configs.ports.radarr} reverse_proxy :${builtins.toString service_configs.ports.private.radarr.port}
''; '';
users.users.${config.services.radarr.user}.extraGroups = [ users.users.${config.services.radarr.user}.extraGroups = [

4
services/arr/recyclarr.nix
View File

@@ -44,7 +44,7 @@ in
configuration = { configuration = {
radarr.movies = { radarr.movies = {
base_url = "http://localhost:${builtins.toString service_configs.ports.radarr}"; base_url = "http://localhost:${builtins.toString service_configs.ports.private.radarr.port}";
include = [ include = [
{ template = "radarr-quality-definition-movie"; } { template = "radarr-quality-definition-movie"; }
@@ -123,7 +123,7 @@ in
}; };
sonarr.series = { sonarr.series = {
base_url = "http://localhost:${builtins.toString service_configs.ports.sonarr}"; base_url = "http://localhost:${builtins.toString service_configs.ports.private.sonarr.port}";
include = [ include = [
{ template = "sonarr-quality-definition-series"; } { template = "sonarr-quality-definition-series"; }

4
services/arr/sonarr.nix
View File

@@ -27,13 +27,13 @@
services.sonarr = { services.sonarr = {
enable = true; enable = true;
dataDir = service_configs.sonarr.dataDir; dataDir = service_configs.sonarr.dataDir;
settings.server.port = service_configs.ports.sonarr; settings.server.port = service_configs.ports.private.sonarr.port;
settings.update.mechanism = "external"; settings.update.mechanism = "external";
}; };
services.caddy.virtualHosts."sonarr.${service_configs.https.domain}".extraConfig = '' services.caddy.virtualHosts."sonarr.${service_configs.https.domain}".extraConfig = ''
import ${config.age.secrets.caddy_auth.path} import ${config.age.secrets.caddy_auth.path}
reverse_proxy :${builtins.toString service_configs.ports.sonarr} reverse_proxy :${builtins.toString service_configs.ports.private.sonarr.port}
''; '';
users.users.${config.services.sonarr.user}.extraGroups = [ users.users.${config.services.sonarr.user}.extraGroups = [

6
services/bitmagnet.nix
View File

@@ -7,7 +7,7 @@
}: }:
{ {
imports = [ imports = [
(lib.vpnNamespaceOpenPort service_configs.ports.bitmagnet "bitmagnet") (lib.vpnNamespaceOpenPort service_configs.ports.private.bitmagnet.port "bitmagnet")
]; ];
services.bitmagnet = { services.bitmagnet = {
@@ -19,13 +19,13 @@
}; };
http_server = { http_server = {
# TODO! make issue about this being a string and not a `port` type # TODO! make issue about this being a string and not a `port` type
port = ":" + (builtins.toString service_configs.ports.bitmagnet); port = ":" + (builtins.toString service_configs.ports.private.bitmagnet.port);
}; };
}; };
}; };
services.caddy.virtualHosts."bitmagnet.${service_configs.https.domain}".extraConfig = '' services.caddy.virtualHosts."bitmagnet.${service_configs.https.domain}".extraConfig = ''
import ${config.age.secrets.caddy_auth.path} import ${config.age.secrets.caddy_auth.path}
reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.bitmagnet} reverse_proxy ${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.private.bitmagnet.port}
''; '';
} }

2
services/bitwarden.nix
View File

@@ -30,7 +30,7 @@
SIGNUPS_ALLOWED = false; SIGNUPS_ALLOWED = false;
ROCKET_ADDRESS = "127.0.0.1"; ROCKET_ADDRESS = "127.0.0.1";
ROCKET_PORT = service_configs.ports.vaultwarden; ROCKET_PORT = service_configs.ports.private.vaultwarden.port;
ROCKET_LOG = "critical"; ROCKET_LOG = "critical";
}; };
}; };

6
services/caddy.nix
View File

@@ -113,14 +113,14 @@ in
systemd.packages = with pkgs; [ nssTools ]; systemd.packages = with pkgs; [ nssTools ];
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
service_configs.ports.https service_configs.ports.public.https.port
# http (but really acmeCA challenges) # http (but really acmeCA challenges)
service_configs.ports.http service_configs.ports.public.http.port
]; ];
networking.firewall.allowedUDPPorts = [ networking.firewall.allowedUDPPorts = [
service_configs.ports.https service_configs.ports.public.https.port
]; ];
# Protect Caddy basic auth endpoints from brute force attacks # Protect Caddy basic auth endpoints from brute force attacks

12
services/coturn.nix
View File

@@ -10,8 +10,8 @@
realm = service_configs.https.domain; realm = service_configs.https.domain;
use-auth-secret = true; use-auth-secret = true;
static-auth-secret = lib.strings.trim (builtins.readFile ../secrets/coturn_static_auth_secret); static-auth-secret = lib.strings.trim (builtins.readFile ../secrets/coturn_static_auth_secret);
listening-port = service_configs.ports.coturn; listening-port = service_configs.ports.public.coturn.port;
tls-listening-port = service_configs.ports.coturn_tls; tls-listening-port = service_configs.ports.public.coturn_tls.port;
no-cli = true; no-cli = true;
# recommended security settings from Synapse's coturn docs # recommended security settings from Synapse's coturn docs
@@ -41,12 +41,12 @@
# coturn needs these ports open # coturn needs these ports open
networking.firewall = { networking.firewall = {
allowedTCPPorts = [ allowedTCPPorts = [
service_configs.ports.coturn service_configs.ports.public.coturn.port
service_configs.ports.coturn_tls service_configs.ports.public.coturn_tls.port
]; ];
allowedUDPPorts = [ allowedUDPPorts = [
service_configs.ports.coturn service_configs.ports.public.coturn.port
service_configs.ports.coturn_tls service_configs.ports.public.coturn_tls.port
]; ];
# relay port range # relay port range
allowedUDPPortRanges = [ allowedUDPPortRanges = [

4
services/firefox-syncserver.nix
View File

@@ -14,7 +14,7 @@
user = "firefox_syncserver"; user = "firefox_syncserver";
}; };
secrets = config.age.secrets.firefox-syncserver-env.path; secrets = config.age.secrets.firefox-syncserver-env.path;
settings.port = service_configs.ports.firefox_syncserver; settings.port = service_configs.ports.private.firefox_syncserver.port;
singleNode = { singleNode = {
enable = true; enable = true;
hostname = service_configs.firefox_syncserver.domain; hostname = service_configs.firefox_syncserver.domain;
@@ -34,6 +34,6 @@
}; };
services.caddy.virtualHosts."${service_configs.firefox_syncserver.domain}".extraConfig = '' services.caddy.virtualHosts."${service_configs.firefox_syncserver.domain}".extraConfig = ''
reverse_proxy :${builtins.toString service_configs.ports.firefox_syncserver} reverse_proxy :${builtins.toString service_configs.ports.private.firefox_syncserver.port}
''; '';
} }

2
services/gitea.nix
View File

@@ -27,7 +27,7 @@
SSH_USER = "gitea"; SSH_USER = "gitea";
DOMAIN = service_configs.gitea.domain; DOMAIN = service_configs.gitea.domain;
ROOT_URL = "https://" + config.services.gitea.settings.server.DOMAIN; ROOT_URL = "https://" + config.services.gitea.settings.server.DOMAIN;
HTTP_PORT = service_configs.ports.gitea; HTTP_PORT = service_configs.ports.private.gitea.port;
LANDING_PAGE = "/explore/repos"; LANDING_PAGE = "/explore/repos";
DISABLE_HTTP_GIT = true; DISABLE_HTTP_GIT = true;
}; };

2
services/immich.nix
View File

@@ -21,7 +21,7 @@
services.immich = { services.immich = {
enable = true; enable = true;
mediaLocation = service_configs.immich.dir; mediaLocation = service_configs.immich.dir;
port = service_configs.ports.immich; port = service_configs.ports.private.immich.port;
# openFirewall = true; # openFirewall = true;
host = "0.0.0.0"; host = "0.0.0.0";
database = { database = {

4
services/jellyfin-qbittorrent-monitor.nix
View File

@@ -43,8 +43,8 @@
}; };
environment = { environment = {
JELLYFIN_URL = "http://localhost:${builtins.toString service_configs.ports.jellyfin}"; JELLYFIN_URL = "http://localhost:${builtins.toString service_configs.ports.private.jellyfin.port}";
QBITTORRENT_URL = "http://${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.torrent}"; QBITTORRENT_URL = "http://${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.private.torrent.port}";
CHECK_INTERVAL = "30"; CHECK_INTERVAL = "30";
# Bandwidth budget configuration # Bandwidth budget configuration
TOTAL_BANDWIDTH_BUDGET = "30000000"; # 30 Mbps in bits per second TOTAL_BANDWIDTH_BUDGET = "30000000"; # 30 Mbps in bits per second

2
services/jellyfin.nix
View File

@@ -25,7 +25,7 @@
}; };
services.caddy.virtualHosts."jellyfin.${service_configs.https.domain}".extraConfig = '' services.caddy.virtualHosts."jellyfin.${service_configs.https.domain}".extraConfig = ''
reverse_proxy :${builtins.toString service_configs.ports.jellyfin} { reverse_proxy :${builtins.toString service_configs.ports.private.jellyfin.port} {
header_up X-Real-IP {remote_host} header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host} header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme} header_up X-Forwarded-Proto {scheme}

10
services/livekit.nix
View File

@@ -4,8 +4,6 @@
}: }:
let let
keyFile = ../secrets/livekit_keys; keyFile = ../secrets/livekit_keys;
ports = service_configs.ports;
in in
{ {
services.livekit = { services.livekit = {
@@ -14,7 +12,7 @@ in
openFirewall = true; openFirewall = true;
settings = { settings = {
port = ports.livekit; port = service_configs.ports.public.livekit.port;
bind_addresses = [ "127.0.0.1" ]; bind_addresses = [ "127.0.0.1" ];
rtc = { rtc = {
@@ -38,16 +36,16 @@ in
enable = true; enable = true;
inherit keyFile; inherit keyFile;
livekitUrl = "wss://${service_configs.livekit.domain}"; livekitUrl = "wss://${service_configs.livekit.domain}";
port = ports.lk_jwt; port = service_configs.ports.private.lk_jwt.port;
}; };
services.caddy.virtualHosts."${service_configs.livekit.domain}".extraConfig = '' services.caddy.virtualHosts."${service_configs.livekit.domain}".extraConfig = ''
@jwt path /sfu/get /healthz @jwt path /sfu/get /healthz
handle @jwt { handle @jwt {
reverse_proxy :${builtins.toString ports.lk_jwt} reverse_proxy :${builtins.toString service_configs.ports.private.lk_jwt.port}
} }
handle { handle {
reverse_proxy :${builtins.toString ports.livekit} reverse_proxy :${builtins.toString service_configs.ports.public.livekit.port}
} }
''; '';
} }

12
services/matrix.nix
View File

@@ -18,7 +18,7 @@
enable = true; enable = true;
settings.global = { settings.global = {
port = [ service_configs.ports.matrix ]; port = [ service_configs.ports.private.matrix.port ];
server_name = service_configs.https.domain; server_name = service_configs.https.domain;
allow_registration = true; allow_registration = true;
registration_token = lib.strings.trim (builtins.readFile ../secrets/matrix_reg_token); registration_token = lib.strings.trim (builtins.readFile ../secrets/matrix_reg_token);
@@ -49,25 +49,25 @@
services.caddy.virtualHosts.${service_configs.https.domain}.extraConfig = lib.mkBefore '' services.caddy.virtualHosts.${service_configs.https.domain}.extraConfig = lib.mkBefore ''
header /.well-known/matrix/* Content-Type application/json header /.well-known/matrix/* Content-Type application/json
header /.well-known/matrix/* Access-Control-Allow-Origin * header /.well-known/matrix/* Access-Control-Allow-Origin *
respond /.well-known/matrix/server `{"m.server": "${service_configs.matrix.domain}:${builtins.toString service_configs.ports.https}"}` respond /.well-known/matrix/server `{"m.server": "${service_configs.matrix.domain}:${builtins.toString service_configs.ports.public.https.port}"}`
respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${service_configs.matrix.domain}"},"m.homeserver":{"base_url":"https://${service_configs.matrix.domain}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-continuwuity.settings.global.server_name}"},"org.matrix.msc4143.rtc_foci":[{"type":"livekit","livekit_service_url":"https://${service_configs.livekit.domain}"}]}` respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${service_configs.matrix.domain}"},"m.homeserver":{"base_url":"https://${service_configs.matrix.domain}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-continuwuity.settings.global.server_name}"},"org.matrix.msc4143.rtc_foci":[{"type":"livekit","livekit_service_url":"https://${service_configs.livekit.domain}"}]}`
''; '';
services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig = '' services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig = ''
reverse_proxy :${builtins.toString service_configs.ports.matrix} reverse_proxy :${builtins.toString service_configs.ports.private.matrix.port}
''; '';
# Exact duplicate for federation port # Exact duplicate for federation port
services.caddy.virtualHosts."${service_configs.matrix.domain}:${builtins.toString service_configs.ports.matrix_federation}".extraConfig = services.caddy.virtualHosts."${service_configs.matrix.domain}:${builtins.toString service_configs.ports.public.matrix_federation.port}".extraConfig =
config.services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig; config.services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig;
# for federation # for federation
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
service_configs.ports.matrix_federation service_configs.ports.public.matrix_federation.port
]; ];
# for federation # for federation
networking.firewall.allowedUDPPorts = [ networking.firewall.allowedUDPPorts = [
service_configs.ports.matrix_federation service_configs.ports.public.matrix_federation.port
]; ];
} }

2
services/minecraft.nix
View File

@@ -73,7 +73,7 @@
]; ];
serverProperties = { serverProperties = {
server-port = service_configs.ports.minecraft; server-port = service_configs.ports.public.minecraft.port;
enforce-whitelist = true; enforce-whitelist = true;
gamemode = "survival"; gamemode = "survival";
white-list = true; white-list = true;

10
services/monero.nix
View File

@@ -18,12 +18,12 @@
dataDir = service_configs.monero.dataDir; dataDir = service_configs.monero.dataDir;
rpc = { rpc = {
address = "0.0.0.0"; address = "0.0.0.0";
port = service_configs.ports.monero_rpc; port = service_configs.ports.public.monero_rpc.port;
restricted = true; restricted = true;
}; };
extraConfig = '' extraConfig = ''
p2p-bind-port=${builtins.toString service_configs.ports.monero} p2p-bind-port=${builtins.toString service_configs.ports.public.monero.port}
zmq-pub=tcp://127.0.0.1:${builtins.toString service_configs.ports.monero_zmq} zmq-pub=tcp://127.0.0.1:${builtins.toString service_configs.ports.private.monero_zmq.port}
db-sync-mode=fast:async:1000000000bytes db-sync-mode=fast:async:1000000000bytes
public-node=1 public-node=1
confirm-external-bind=1 confirm-external-bind=1
@@ -31,7 +31,7 @@
}; };
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
service_configs.ports.monero service_configs.ports.public.monero.port
service_configs.ports.monero_rpc service_configs.ports.public.monero_rpc.port
]; ];
} }

4
services/ntfy.nix
View File

@@ -19,7 +19,7 @@
settings = { settings = {
base-url = "https://${service_configs.ntfy.domain}"; base-url = "https://${service_configs.ntfy.domain}";
listen-http = "127.0.0.1:${builtins.toString service_configs.ports.ntfy}"; listen-http = "127.0.0.1:${builtins.toString service_configs.ports.private.ntfy.port}";
behind-proxy = true; behind-proxy = true;
auth-default-access = "deny-all"; auth-default-access = "deny-all";
enable-login = true; enable-login = true;
@@ -28,7 +28,7 @@
}; };
services.caddy.virtualHosts."${service_configs.ntfy.domain}".extraConfig = '' services.caddy.virtualHosts."${service_configs.ntfy.domain}".extraConfig = ''
reverse_proxy :${builtins.toString service_configs.ports.ntfy} reverse_proxy :${builtins.toString service_configs.ports.private.ntfy.port}
''; '';
} }

8
services/p2pool.nix
View File

@@ -23,10 +23,10 @@ in
walletAddress = walletAddress; walletAddress = walletAddress;
sidechain = "nano"; sidechain = "nano";
host = "127.0.0.1"; host = "127.0.0.1";
rpcPort = service_configs.ports.monero_rpc; rpcPort = service_configs.ports.public.monero_rpc.port;
zmqPort = service_configs.ports.monero_zmq; zmqPort = service_configs.ports.private.monero_zmq.port;
extraArgs = [ extraArgs = [
" --stratum 0.0.0.0:${builtins.toString service_configs.ports.p2pool_stratum}" " --stratum 0.0.0.0:${builtins.toString service_configs.ports.private.p2pool_stratum.port}"
]; ];
}; };
@@ -43,6 +43,6 @@ in
}; };
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
service_configs.ports.p2pool_p2p service_configs.ports.public.p2pool_p2p.port
]; ];
} }

2
services/qbittorrent.nix
View File

@@ -26,7 +26,7 @@
services.qbittorrent = { services.qbittorrent = {
enable = true; enable = true;
webuiPort = service_configs.ports.torrent; webuiPort = service_configs.ports.private.torrent.port;
profileDir = "/var/lib/qBittorrent"; profileDir = "/var/lib/qBittorrent";
# Set the service group to 'media' so the systemd unit runs with media as # Set the service group to 'media' so the systemd unit runs with media as
# the primary GID. Linux assigns new file ownership from the process's GID # the primary GID. Linux assigns new file ownership from the process's GID

6
services/soulseek.nix
View File

@@ -30,11 +30,11 @@
settings = { settings = {
web = { web = {
port = service_configs.ports.soulseek_web; port = service_configs.ports.private.soulseek_web.port;
}; };
soulseek = { soulseek = {
# description = "smth idk"; # description = "smth idk";
listen_port = service_configs.ports.soulseek_listen; listen_port = service_configs.ports.public.soulseek_listen.port;
}; };
shares = { shares = {
@@ -64,6 +64,6 @@
''; '';
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [
service_configs.ports.soulseek_listen service_configs.ports.public.soulseek_listen.port
]; ];
} }

10
services/syncthing.nix
View File

@@ -24,7 +24,7 @@
dataDir = service_configs.syncthing.dataDir; dataDir = service_configs.syncthing.dataDir;
guiAddress = "127.0.0.1:${toString service_configs.ports.syncthing_gui}"; guiAddress = "127.0.0.1:${toString service_configs.ports.private.syncthing_gui.port}";
overrideDevices = false; overrideDevices = false;
overrideFolders = false; overrideFolders = false;
@@ -42,16 +42,16 @@
# Open firewall ports for syncthing protocol # Open firewall ports for syncthing protocol
networking.firewall = { networking.firewall = {
allowedTCPPorts = [ service_configs.ports.syncthing_protocol ]; allowedTCPPorts = [ service_configs.ports.public.syncthing_protocol.port ];
allowedUDPPorts = [ allowedUDPPorts = [
service_configs.ports.syncthing_discovery service_configs.ports.public.syncthing_discovery.port
service_configs.ports.syncthing_protocol service_configs.ports.public.syncthing_protocol.port
]; ];
}; };
services.caddy.virtualHosts."syncthing.${service_configs.https.domain}".extraConfig = '' services.caddy.virtualHosts."syncthing.${service_configs.https.domain}".extraConfig = ''
import ${config.age.secrets.caddy_auth.path} import ${config.age.secrets.caddy_auth.path}
reverse_proxy :${toString service_configs.ports.syncthing_gui} reverse_proxy :${toString service_configs.ports.private.syncthing_gui.port}
''; '';
} }

2
services/xmrig.nix
View File

@@ -32,7 +32,7 @@ in
pools = [ pools = [
{ {
url = "127.0.0.1:${builtins.toString service_configs.ports.p2pool_stratum}"; url = "127.0.0.1:${builtins.toString service_configs.ports.private.p2pool_stratum.port}";
tls = false; tls = false;
} }
]; ];

5
tests/fail2ban-gitea.nix
View File

@@ -12,7 +12,10 @@ let
dir = "/var/lib/gitea"; dir = "/var/lib/gitea";
domain = "git.test.local"; domain = "git.test.local";
}; };
ports.gitea = 3000; ports.private.gitea = {
port = 3000;
proto = "tcp";
};
}; };
testLib = lib.extend ( testLib = lib.extend (

5
tests/fail2ban-immich.nix
View File

@@ -9,7 +9,10 @@ let
testServiceConfigs = lib.recursiveUpdate baseServiceConfigs { testServiceConfigs = lib.recursiveUpdate baseServiceConfigs {
zpool_ssds = ""; zpool_ssds = "";
https.domain = "test.local"; https.domain = "test.local";
ports.immich = 2283; ports.private.immich = {
port = 2283;
proto = "tcp";
};
immich.dir = "/var/lib/immich"; immich.dir = "/var/lib/immich";
}; };