music: init

.sops.yaml

@@ -5,6 +5,7 @@ keys:
   - &dishwasher age1cxlskqynwl5njjm0qf363308dsjwxjq59rq7pn6ucpscpzpvry4qwtpx73
   - &nextcloud age1ds7zgenz9a664jqx5308m6q5mgtavzmelg239xsj8mdh64pmqa9qtkffmk
   - &toaster age1qyj95tsntreefqeetawqy5pf26456s9c0v3tzz8yzs706c0jsg6qv56jzk
+  - &music age1qyj95tsntreefqeetawqy5pf26456s9c0v3tzz8yzs706c0jsg6qv56jzk
 creation_rules:
   - path_regex: secrets/microwave/[^/]+\.yaml$
     key_groups:
@@ -36,3 +37,9 @@ creation_rules:
         - *admin_oxa
         age:
         - *toaster
+  - path_regex: secrets/music/[^/]+\.yaml$
+    key_groups:
+      - pgp:
+        - *admin_oxa
+        age:
+        - *music

flake.nix

@@ -106,13 +106,6 @@
             ./hosts/dishwasher
             ./modules/basic-tools
             ./modules/binary-caches.nix
-
-            {
-              microvm.vms.nextcloud = {
-                flake = self;
-                updateFlake = "github:oxapentane/nix-config/master";
-              };
-            }
           ];
         };
 
@@ -125,6 +118,16 @@
             ./microvms/nextcloud
           ];
         };
+
+        music = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          specialArgs = { inherit inputs; };
+          modules = [
+            sops-nix.nixosModules.sops
+            microvm.nixosModules.microvm
+            ./microvms/music
+          ];
+        };
       };
     };
 }

hosts/cirrus/nextcloud-proxy.nix

@@ -16,7 +16,8 @@
     sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
   };
 
-  services.nginx.virtualHosts."nc.oxapentane.com" = {
+  services.nginx.virtualHosts = {
+    "nc.oxapentane.com" = {
       enableACME = true;
       forceSSL = true;
       extraConfig = ''
@@ -24,7 +25,6 @@
       '';
       locations = {
         "/" = {
-        #  extraConfig = '' return 503; '';
         proxyPass = "http://10.34.45.100:8080";
       };
       "/well-known/carddav" = {
@@ -33,7 +33,29 @@
       "/well-known/caldav" = {
         return = "301 $scheme://$host/remote.php/dav";
       };
+    };
+  };
 
+  "music.oxapentane.com" = {
+    enableACME = true;
+    forceSSL = true;
+    extraConfig = ''
+    client_max_body_size 32M;
+    '';
+    locations = {
+      "/" = {
+        proxyPass = "http://10.34.45.101:4533";
+        extraConfig = ''
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $scheme;
+          proxy_set_header X-Forwarded-Protocol $scheme;
+          proxy_set_header X-Forwarded-Host $http_host;
+          proxy_buffering off;
+        '';
+      };
+    };
   };
 };
 }

hosts/cirrus/wireguard-server.nix

@@ -66,6 +66,14 @@
             PersistentKeepalive = 25;
           };
         }
+        # music
+        {
+          wireguardPeerConfig = {
+            PublicKey = "vQNkp51S9qLsu97dLPj0/EqFwvVtRFZpMHufgKhxum0=";
+            AllowedIPs = [ "10.34.45.101/32" ];
+            PersistentKeepalive = 25;
+          };
+        }
       ];
     };
     networks."oxaproxy" = {

hosts/dishwasher/default.nix

@@ -5,5 +5,6 @@
     ./secrets.nix
     ./oxalab.nix
     ./mcvm-network.nix
+    ./microvms.nix
   ];
 }

hosts/dishwasher/microvms.nix

@@ -0,0 +1,12 @@
+{ self, ... }: {
+  microvm.vms = {
+    nextcloud = {
+      flake = self;
+      updateFlake = "github:oxapentane/nix-config/master";
+    };
+    music = {
+      flake = self;
+      updateFlake = "github:oxapentane/nix-config/navidrome";
+    };
+  };
+}

microvms/music/default.nix

@@ -0,0 +1,49 @@
+{ pkgs, lib, config, ... }: {
+  imports = [
+    ./navidrome.nix
+    ./oxaproxy.nix
+  ];
+
+  microvm = {
+    hypervisor = "qemu";
+    mem = 4 * 1024;
+    vcpu = 3;
+
+    shares = [{
+      source = "/nix/store";
+      mountPoint = "/nix/.ro-store";
+      tag = "store";
+      proto = "virtiofs";
+      socket = "store.socket";
+    }] ++ map
+      (dir: {
+        source = "/var/lib/microvms/${config.networking.hostName}/${dir}";
+        mountPoint = "/${dir}";
+        tag = dir;
+        proto = "virtiofs";
+        socket = "${dir}.socket";
+      }) [ "etc" "var" "home" ];
+
+    interfaces = [{
+      type = "tap";
+      id = "vm-music";
+      mac = "EA:40:E8:60:C5:37";
+    }];
+  };
+
+  networking = {
+    hostName = "music";
+  };
+
+  services.openssh = {
+    enable = true;
+    permitRootLogin = "prohibit-password";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 22 ];
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDP6xE2ey0C8XXfvniiiHiqXsCC277jKI9RXEA+s2LQLUI5zl7v350i3Oa8H3NCcPj39lfMreqE6ncxcOhqYyzahPrrMkOqgbPAoRvq8H3ophLK+56O3xdHoKwLBwRD1yoGACjqG4UTiTrmnN2ateENgYcnTEY1e4vDw1qMj1drUXCsZ/6mkBBmHJiFfCaR4yCMt1r4gGi/dAC7ifnBP3oSyV/lJEwPxYYkGlbOBIvX/7Ar98pJS6xYPB3jHs9gwyNNON63d0fNYrwBojXPPCnGGaRZNOkBTzex3zZYp12ThINQ2xl8tRp9D8qpZ7vrLjhTD6AXkOBRzmDj+NsCeEaeTuWajqUM93iKncYUI+JxR1t7q8gA2pBMFzLesMXnx7R+5Kw7QDtSJM7a4GMIfsocPwf64BH6rzxEz68rXFE3P+J77PPM9CuaYw90JXHo3z220zYw2nMQ/1qjATVZw/hiVrLmQMVfmFJIufnGjTBs2sy3IoNyzvYm/oDeNNg1cdSV9gyyRKZhK08fxjXN5GSf9vZkfZa9tHtqaZ99HI40GQBHUVx1K2/NQJY8TVTSA+v16SFnJK8BIbmp/WFCuvDcMkgLIbqiYtDASe7P2mKIib86uOENT+P820egeLiTQ06kFw/gfUa8t69d5qEcjiQZ+lxCeYIs/E9KrEXHvRUWew== cardno:16 811 348"
+  ];
+
+  system.stateVersion = "22.11";
+}

microvms/music/navidrome.nix

@@ -0,0 +1,12 @@
+{ config, ... }: {
+  services.navidrome = {
+    enable = true;
+    settings = {
+      BaseUrl = "/";
+      EnableExternalServices = false;
+      MusicFolder = "/var/lib/navidrome/library";
+      ScanSchedule = "@every 17min";
+      TranscondigCacheSize = "5GiB";
+    };
+  };
+}

microvms/music/oxaproxy.nix

@@ -0,0 +1,68 @@
+{ config, ... }: {
+
+  networking.wireguard.enable = true;
+  networking.useNetworkd = true;
+
+  #oxaproxy secret
+  sops.defaultSopsFile = ../../secrets/music/secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets."wg/oxaproxy-seckey" = {
+    owner = config.users.users.systemd-network.name;
+  };
+
+  systemd.network = {
+    enable = true;
+    netdevs."10-oxaproxy" = {
+      netdevConfig = {
+        Kind = "wireguard";
+        Name = "oxaproxy";
+        Description = "oxa's enterprise reverse-proxy network";
+      };
+      wireguardConfig = {
+        PrivateKeyFile = config.sops.secrets."wg/oxaproxy-seckey".path;
+        #own pubkey: vQNkp51S9qLsu97dLPj0/EqFwvVtRFZpMHufgKhxum0=
+      };
+      wireguardPeers = [
+        {
+          # cirrus
+          wireguardPeerConfig = {
+            PublicKey = "0KMtL2fQOrrCH6c2a2l4FKiM73G86sUuyaNj4FarzVM=";
+            AllowedIPs = [ "10.34.45.0/24" ];
+            Endpoint = [ "95.216.166.21:51821" ];
+            PersistentKeepalive = 25;
+          };
+        }
+      ];
+    };
+    networks."10-oxaproxy" = {
+      matchConfig.Name = "oxaproxy";
+      networkConfig = {
+        Address = "10.34.45.101/24";
+      };
+    };
+
+    networks."111-host" = {
+      matchConfig.Name = "enp0s8";
+      networkConfig = {
+        Address = "10.99.99.101/24";
+      };
+      routes = [
+        {
+          routeConfig = {
+            Gateway = "10.99.99.1";
+            Destination = "0.0.0.0/0";
+            Metric = 1024;
+          };
+        }
+        {
+          routeConfig = {
+            Gateway = "10.99.99.1";
+            Destination = "10.99.99.0/24";
+            Metric = 1024;
+          };
+        }
+      ];
+    };
+  };
+}

secrets/music/secrets.yaml

@@ -0,0 +1,42 @@
+wg:
+    oxaproxy-seckey: ENC[AES256_GCM,data:8gBeqbtQ3mA3dKlidBOMfxZJZEkR/aVhawW9MJ8t/uDx+f2ciZIlrl/ggLw=,iv:w+gbINc5ORmPO9QZfeR3nzMa6QE3ISqBsIBywplij3w=,tag:oNecMKIuySepT0LiShJ29w==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1qyj95tsntreefqeetawqy5pf26456s9c0v3tzz8yzs706c0jsg6qv56jzk
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzMWV0TXBsMTV2UUE2cklt
+            dDV1UkkzdlRuK1NFRXFGWEd0Tk9MSHExcUdnCmtIM05LOC9wRE1tMUliRnBQbDE2
+            QnFpMzBPMkFHQU1GUHlUdVBJYVFhSVkKLS0tIFJYVE1pSmlTU2NqUmEyaW9ReXhy
+            S0pTWlc5MTRYMTcyaHZoamRxVElkcncKCqntCHrNQjxTWdiQwFtKJ81Z1cK1id1P
+            wZSnmiAszn4qwrI9x8loS9tqq0lnq1NcJ+EbGfjygcsk0kXJHkPLIQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-01-24T19:36:01Z"
+    mac: ENC[AES256_GCM,data:SGRS/Xp0bc4omUq2WHKFx5F55rZvh2bo0KmxxZ73srImkF+65GAFeVaWJVxH8ie01N2jYDtVbe6NOfapRvcPFaXEIwJItTcMgUmqPr8fLI9WAzZpAWS1LeaNKkLAOcYHIoCEFgJbxtm3Ngj1NGxlam2/Cbwo1ONNNnulwvWDASo=,iv:ClDkkpsZHn4z9d1cnuN0zgqtxWijqjyhUCPDzrWCW8g=,tag:g65C9RazwWiI1jjap+/TnQ==,type:str]
+    pgp:
+        - created_at: "2023-01-24T19:33:50Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA7zUOKwzpAE7AQ//cFpabxVtZeMwn6UPr+gLlWTFB1VgW3aFugmHfHbC7+gW
+            fdmh0ENsl8v8q7AiQWU8U9SfYE09C9RwrHinHnRpE7UT97jtu3PZ24WaJhXbfUEC
+            4PvZKCLK9tqkyK74wFl/yVfPZXvkMKCzUn99mZvtqz7X/KCV3JgEz+HzjvO8gS0y
+            gKYSUYtu9t4jsH7VL662AuF2sjlslH61PFpUCC8CkWPkwBoyvRGyRt7Qpc2TCFD0
+            9Kqd4YaAILIIu3xM8oP+xq/KGuledo6+k/xASjTkJDhOJ5L+aDBl0MYyJ1tUFEDt
+            twn5rDw5/BJYSrqDlRFEsr5QDdagMXrLmDSJ3Lm9mXgJh7rRE1Cz8cMDfP/bkvDv
+            U/c2aM5U3+HNaiFNVQGALWqHK774n4QZlJfH+KqFcECfXMZTRg7g8DM3EkdGUUXF
+            U5oa3LgYimMxC/1sNroHNpztmozCqdpCPXiyduTQzPDp24UqyfVWw4CDtuQnpmX7
+            NQtCzzG4J3+vHFhUrRBTtqdbdjmbJAzA9FXZeyCCrhLg4iT2W9MrR6ZCBBsZDxXB
+            QJv/A1wRLHVSuG9fZEFQFyaH3YT8BZHnHnBF+hcyMlo0cgoUm1cbbxwESb7JqkeM
+            4J8f8kKVCH93Cw4d0AcaIKmaBVxFZ1clwO/8gvce2EQ+YoydLC+G2p9HOGXuhGjS
+            UQEOTZFBDy0sLffDr4G+FCGXACuxgaCJZ1SHGTyot1Ljj1hpAoz8xFoioHR8BGID
+            0AYvaf6cmDcYAX5uf5mCKZaXHvVBzbuitNUr7GsQ54zawA==
+            =k8qB
+            -----END PGP MESSAGE-----
+          fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3