summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.sops.yaml7
-rw-r--r--flake.nix17
-rw-r--r--hosts/cirrus/nextcloud-proxy.nix38
-rw-r--r--hosts/cirrus/wireguard-server.nix8
-rw-r--r--hosts/dishwasher/default.nix1
-rw-r--r--hosts/dishwasher/mcvm-network.nix6
-rw-r--r--hosts/dishwasher/microvms.nix12
-rw-r--r--microvms/music/default.nix49
-rw-r--r--microvms/music/navidrome.nix12
-rw-r--r--microvms/music/oxaproxy.nix68
-rw-r--r--secrets/music/secrets.yaml42
11 files changed, 242 insertions, 18 deletions
diff --git a/.sops.yaml b/.sops.yaml
index bd46c74..98b764a 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -5,6 +5,7 @@ keys:
- &dishwasher age1cxlskqynwl5njjm0qf363308dsjwxjq59rq7pn6ucpscpzpvry4qwtpx73
- &nextcloud age1ds7zgenz9a664jqx5308m6q5mgtavzmelg239xsj8mdh64pmqa9qtkffmk
- &toaster age1qyj95tsntreefqeetawqy5pf26456s9c0v3tzz8yzs706c0jsg6qv56jzk
+ - &music age1qyj95tsntreefqeetawqy5pf26456s9c0v3tzz8yzs706c0jsg6qv56jzk
creation_rules:
- path_regex: secrets/microwave/[^/]+\.yaml$
key_groups:
@@ -36,3 +37,9 @@ creation_rules:
- *admin_oxa
age:
- *toaster
+ - path_regex: secrets/music/[^/]+\.yaml$
+ key_groups:
+ - pgp:
+ - *admin_oxa
+ age:
+ - *music
diff --git a/flake.nix b/flake.nix
index 35b2212..6061f7e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -106,13 +106,6 @@
./hosts/dishwasher
./modules/basic-tools
./modules/binary-caches.nix
-
- {
- microvm.vms.nextcloud = {
- flake = self;
- updateFlake = "github:oxapentane/nix-config/master";
- };
- }
];
};
@@ -125,6 +118,16 @@
./microvms/nextcloud
];
};
+
+ music = nixpkgs.lib.nixosSystem {
+ system = "x86_64-linux";
+ specialArgs = { inherit inputs; };
+ modules = [
+ sops-nix.nixosModules.sops
+ microvm.nixosModules.microvm
+ ./microvms/music
+ ];
+ };
};
};
}
diff --git a/hosts/cirrus/nextcloud-proxy.nix b/hosts/cirrus/nextcloud-proxy.nix
index 647d29f..11fc5ed 100644
--- a/hosts/cirrus/nextcloud-proxy.nix
+++ b/hosts/cirrus/nextcloud-proxy.nix
@@ -16,15 +16,15 @@
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
};
- services.nginx.virtualHosts."nc.oxapentane.com" = {
- enableACME = true;
- forceSSL = true;
- extraConfig = ''
+ services.nginx.virtualHosts = {
+ "nc.oxapentane.com" = {
+ enableACME = true;
+ forceSSL = true;
+ extraConfig = ''
client_max_body_size 512M;
- '';
- locations = {
- "/" = {
- # extraConfig = '' return 503; '';
+ '';
+ locations = {
+ "/" = {
proxyPass = "http://10.34.45.100:8080";
};
"/well-known/carddav" = {
@@ -33,7 +33,29 @@
"/well-known/caldav" = {
return = "301 $scheme://$host/remote.php/dav";
};
+ };
+ };
+ "music.oxapentane.com" = {
+ enableACME = true;
+ forceSSL = true;
+ extraConfig = ''
+ client_max_body_size 32M;
+ '';
+ locations = {
+ "/" = {
+ proxyPass = "http://10.34.45.101:4533";
+ extraConfig = ''
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_set_header X-Forwarded-Protocol $scheme;
+ proxy_set_header X-Forwarded-Host $http_host;
+ proxy_buffering off;
+ '';
+ };
};
};
+};
}
diff --git a/hosts/cirrus/wireguard-server.nix b/hosts/cirrus/wireguard-server.nix
index ee4cf60..45c3dcb 100644
--- a/hosts/cirrus/wireguard-server.nix
+++ b/hosts/cirrus/wireguard-server.nix
@@ -66,6 +66,14 @@
PersistentKeepalive = 25;
};
}
+ # music
+ {
+ wireguardPeerConfig = {
+ PublicKey = "vQNkp51S9qLsu97dLPj0/EqFwvVtRFZpMHufgKhxum0=";
+ AllowedIPs = [ "10.34.45.101/32" ];
+ PersistentKeepalive = 25;
+ };
+ }
];
};
networks."oxaproxy" = {
diff --git a/hosts/dishwasher/default.nix b/hosts/dishwasher/default.nix
index b6c6651..f6e7a79 100644
--- a/hosts/dishwasher/default.nix
+++ b/hosts/dishwasher/default.nix
@@ -5,5 +5,6 @@
./secrets.nix
./oxalab.nix
./mcvm-network.nix
+ ./microvms.nix
];
}
diff --git a/hosts/dishwasher/mcvm-network.nix b/hosts/dishwasher/mcvm-network.nix
index 1e59d3f..73894f8 100644
--- a/hosts/dishwasher/mcvm-network.nix
+++ b/hosts/dishwasher/mcvm-network.nix
@@ -14,9 +14,9 @@
addresses = [{
addressConfig.Address = "10.99.99.1/24";
}
- {
- addressConfig.Address = "fd12:3456:789a::1/64";
- }];
+ {
+ addressConfig.Address = "fd12:3456:789a::1/64";
+ }];
ipv6Prefixes = [{
ipv6PrefixConfig.Prefix = "fd12:3456:789a::/64";
}];
diff --git a/hosts/dishwasher/microvms.nix b/hosts/dishwasher/microvms.nix
new file mode 100644
index 0000000..9c69142
--- /dev/null
+++ b/hosts/dishwasher/microvms.nix
@@ -0,0 +1,12 @@
+{ self, ... }: {
+ microvm.vms = {
+ nextcloud = {
+ flake = self;
+ updateFlake = "github:oxapentane/nix-config/master";
+ };
+ music = {
+ flake = self;
+ updateFlake = "github:oxapentane/nix-config/navidrome";
+ };
+ };
+}
diff --git a/microvms/music/default.nix b/microvms/music/default.nix
new file mode 100644
index 0000000..f57de58
--- /dev/null
+++ b/microvms/music/default.nix
@@ -0,0 +1,49 @@
+{ pkgs, lib, config, ... }: {
+ imports = [
+ ./navidrome.nix
+ ./oxaproxy.nix
+ ];
+
+ microvm = {
+ hypervisor = "qemu";
+ mem = 4 * 1024;
+ vcpu = 3;
+
+ shares = [{
+ source = "/nix/store";
+ mountPoint = "/nix/.ro-store";
+ tag = "store";
+ proto = "virtiofs";
+ socket = "store.socket";
+ }] ++ map
+ (dir: {
+ source = "/var/lib/microvms/${config.networking.hostName}/${dir}";
+ mountPoint = "/${dir}";
+ tag = dir;
+ proto = "virtiofs";
+ socket = "${dir}.socket";
+ }) [ "etc" "var" "home" ];
+
+ interfaces = [{
+ type = "tap";
+ id = "vm-music";
+ mac = "EA:40:E8:60:C5:37";
+ }];
+ };
+
+ networking = {
+ hostName = "music";
+ };
+
+ services.openssh = {
+ enable = true;
+ permitRootLogin = "prohibit-password";
+ };
+
+ networking.firewall.allowedTCPPorts = [ 22 ];
+ users.users.root.openssh.authorizedKeys.keys = [
+ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDP6xE2ey0C8XXfvniiiHiqXsCC277jKI9RXEA+s2LQLUI5zl7v350i3Oa8H3NCcPj39lfMreqE6ncxcOhqYyzahPrrMkOqgbPAoRvq8H3ophLK+56O3xdHoKwLBwRD1yoGACjqG4UTiTrmnN2ateENgYcnTEY1e4vDw1qMj1drUXCsZ/6mkBBmHJiFfCaR4yCMt1r4gGi/dAC7ifnBP3oSyV/lJEwPxYYkGlbOBIvX/7Ar98pJS6xYPB3jHs9gwyNNON63d0fNYrwBojXPPCnGGaRZNOkBTzex3zZYp12ThINQ2xl8tRp9D8qpZ7vrLjhTD6AXkOBRzmDj+NsCeEaeTuWajqUM93iKncYUI+JxR1t7q8gA2pBMFzLesMXnx7R+5Kw7QDtSJM7a4GMIfsocPwf64BH6rzxEz68rXFE3P+J77PPM9CuaYw90JXHo3z220zYw2nMQ/1qjATVZw/hiVrLmQMVfmFJIufnGjTBs2sy3IoNyzvYm/oDeNNg1cdSV9gyyRKZhK08fxjXN5GSf9vZkfZa9tHtqaZ99HI40GQBHUVx1K2/NQJY8TVTSA+v16SFnJK8BIbmp/WFCuvDcMkgLIbqiYtDASe7P2mKIib86uOENT+P820egeLiTQ06kFw/gfUa8t69d5qEcjiQZ+lxCeYIs/E9KrEXHvRUWew== cardno:16 811 348"
+ ];
+
+ system.stateVersion = "22.11";
+}
diff --git a/microvms/music/navidrome.nix b/microvms/music/navidrome.nix
new file mode 100644
index 0000000..a9c52df
--- /dev/null
+++ b/microvms/music/navidrome.nix
@@ -0,0 +1,12 @@
+{ config, ... }: {
+ services.navidrome = {
+ enable = true;
+ settings = {
+ BaseUrl = "/";
+ EnableExternalServices = false;
+ MusicFolder = "/var/lib/navidrome/library";
+ ScanSchedule = "@every 17min";
+ TranscondigCacheSize = "5GiB";
+ };
+ };
+}
diff --git a/microvms/music/oxaproxy.nix b/microvms/music/oxaproxy.nix
new file mode 100644
index 0000000..3340cdc
--- /dev/null
+++ b/microvms/music/oxaproxy.nix
@@ -0,0 +1,68 @@
+{ config, ... }: {
+
+ networking.wireguard.enable = true;
+ networking.useNetworkd = true;
+
+ #oxaproxy secret
+ sops.defaultSopsFile = ../../secrets/music/secrets.yaml;
+ sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+ sops.secrets."wg/oxaproxy-seckey" = {
+ owner = config.users.users.systemd-network.name;
+ };
+
+ systemd.network = {
+ enable = true;
+ netdevs."10-oxaproxy" = {
+ netdevConfig = {
+ Kind = "wireguard";
+ Name = "oxaproxy";
+ Description = "oxa's enterprise reverse-proxy network";
+ };
+ wireguardConfig = {
+ PrivateKeyFile = config.sops.secrets."wg/oxaproxy-seckey".path;
+ #own pubkey: vQNkp51S9qLsu97dLPj0/EqFwvVtRFZpMHufgKhxum0=
+ };
+ wireguardPeers = [
+ {
+ # cirrus
+ wireguardPeerConfig = {
+ PublicKey = "0KMtL2fQOrrCH6c2a2l4FKiM73G86sUuyaNj4FarzVM=";
+ AllowedIPs = [ "10.34.45.0/24" ];
+ Endpoint = [ "95.216.166.21:51821" ];
+ PersistentKeepalive = 25;
+ };
+ }
+ ];
+ };
+ networks."10-oxaproxy" = {
+ matchConfig.Name = "oxaproxy";
+ networkConfig = {
+ Address = "10.34.45.101/24";
+ };
+ };
+
+ networks."111-host" = {
+ matchConfig.Name = "enp0s8";
+ networkConfig = {
+ Address = "10.99.99.101/24";
+ };
+ routes = [
+ {
+ routeConfig = {
+ Gateway = "10.99.99.1";
+ Destination = "0.0.0.0/0";
+ Metric = 1024;
+ };
+ }
+ {
+ routeConfig = {
+ Gateway = "10.99.99.1";
+ Destination = "10.99.99.0/24";
+ Metric = 1024;
+ };
+ }
+ ];
+ };
+ };
+}
diff --git a/secrets/music/secrets.yaml b/secrets/music/secrets.yaml
new file mode 100644
index 0000000..608f92a
--- /dev/null
+++ b/secrets/music/secrets.yaml
@@ -0,0 +1,42 @@
+wg:
+ oxaproxy-seckey: ENC[AES256_GCM,data:8gBeqbtQ3mA3dKlidBOMfxZJZEkR/aVhawW9MJ8t/uDx+f2ciZIlrl/ggLw=,iv:w+gbINc5ORmPO9QZfeR3nzMa6QE3ISqBsIBywplij3w=,tag:oNecMKIuySepT0LiShJ29w==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1qyj95tsntreefqeetawqy5pf26456s9c0v3tzz8yzs706c0jsg6qv56jzk
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzMWV0TXBsMTV2UUE2cklt
+ dDV1UkkzdlRuK1NFRXFGWEd0Tk9MSHExcUdnCmtIM05LOC9wRE1tMUliRnBQbDE2
+ QnFpMzBPMkFHQU1GUHlUdVBJYVFhSVkKLS0tIFJYVE1pSmlTU2NqUmEyaW9ReXhy
+ S0pTWlc5MTRYMTcyaHZoamRxVElkcncKCqntCHrNQjxTWdiQwFtKJ81Z1cK1id1P
+ wZSnmiAszn4qwrI9x8loS9tqq0lnq1NcJ+EbGfjygcsk0kXJHkPLIQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2023-01-24T19:36:01Z"
+ mac: ENC[AES256_GCM,data:SGRS/Xp0bc4omUq2WHKFx5F55rZvh2bo0KmxxZ73srImkF+65GAFeVaWJVxH8ie01N2jYDtVbe6NOfapRvcPFaXEIwJItTcMgUmqPr8fLI9WAzZpAWS1LeaNKkLAOcYHIoCEFgJbxtm3Ngj1NGxlam2/Cbwo1ONNNnulwvWDASo=,iv:ClDkkpsZHn4z9d1cnuN0zgqtxWijqjyhUCPDzrWCW8g=,tag:g65C9RazwWiI1jjap+/TnQ==,type:str]
+ pgp:
+ - created_at: "2023-01-24T19:33:50Z"
+ enc: |-
+ -----BEGIN PGP MESSAGE-----
+
+ wcFMA7zUOKwzpAE7AQ//cFpabxVtZeMwn6UPr+gLlWTFB1VgW3aFugmHfHbC7+gW
+ fdmh0ENsl8v8q7AiQWU8U9SfYE09C9RwrHinHnRpE7UT97jtu3PZ24WaJhXbfUEC
+ 4PvZKCLK9tqkyK74wFl/yVfPZXvkMKCzUn99mZvtqz7X/KCV3JgEz+HzjvO8gS0y
+ gKYSUYtu9t4jsH7VL662AuF2sjlslH61PFpUCC8CkWPkwBoyvRGyRt7Qpc2TCFD0
+ 9Kqd4YaAILIIu3xM8oP+xq/KGuledo6+k/xASjTkJDhOJ5L+aDBl0MYyJ1tUFEDt
+ twn5rDw5/BJYSrqDlRFEsr5QDdagMXrLmDSJ3Lm9mXgJh7rRE1Cz8cMDfP/bkvDv
+ U/c2aM5U3+HNaiFNVQGALWqHK774n4QZlJfH+KqFcECfXMZTRg7g8DM3EkdGUUXF
+ U5oa3LgYimMxC/1sNroHNpztmozCqdpCPXiyduTQzPDp24UqyfVWw4CDtuQnpmX7
+ NQtCzzG4J3+vHFhUrRBTtqdbdjmbJAzA9FXZeyCCrhLg4iT2W9MrR6ZCBBsZDxXB
+ QJv/A1wRLHVSuG9fZEFQFyaH3YT8BZHnHnBF+hcyMlo0cgoUm1cbbxwESb7JqkeM
+ 4J8f8kKVCH93Cw4d0AcaIKmaBVxFZ1clwO/8gvce2EQ+YoydLC+G2p9HOGXuhGjS
+ UQEOTZFBDy0sLffDr4G+FCGXACuxgaCJZ1SHGTyot1Ljj1hpAoz8xFoioHR8BGID
+ 0AYvaf6cmDcYAX5uf5mCKZaXHvVBzbuitNUr7GsQ54zawA==
+ =k8qB
+ -----END PGP MESSAGE-----
+ fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
+ unencrypted_suffix: _unencrypted
+ version: 3.7.3
generated by cgit v1.3.1 (git 2.54.0) at 2026-07-28 03:12:36 +0000