fix: localhost as default not in caddy allowlist

requires openssh, but removing public key

flake.lock

@@ -17,6 +17,22 @@
         "type": "github"
       }
     },
+    "baleia-nvim-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1681806450,
+        "narHash": "sha256-jxRlIzWbnSj89032msc5w+2TVt7zVyzlxdXxiH1dQqY=",
+        "owner": "m00qek",
+        "repo": "baleia.nvim",
+        "rev": "00bb4af31c8c3865b735d40ebefa6c3f07b2dd16",
+        "type": "github"
+      },
+      "original": {
+        "owner": "m00qek",
+        "repo": "baleia.nvim",
+        "type": "github"
+      }
+    },
     "bufferline-nvim-src": {
       "flake": false,
       "locked": {
@@ -98,11 +114,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1688605308,
+        "lastModified": 1689731219,
-        "narHash": "sha256-B9suu7dcdX4a18loO5ul237gqIJ5/+TRuheLj8fJjwM=",
+        "narHash": "sha256-6S3XfZWe7x0zViHy2Ix0rzHL/RmVT3s0ZtI+LmJMC2g=",
         "owner": "bandithedoge",
         "repo": "nixpkgs-firefox-darwin",
-        "rev": "78d28acf685e19d353b2ecb6c38eeb3fc624fc68",
+        "rev": "7aa20dbbcbd2371ef13b622ac03f1c3cc5662f37",
         "type": "github"
       },
       "original": {
@@ -395,6 +411,7 @@
     "root": {
       "inputs": {
         "Comment-nvim-src": "Comment-nvim-src",
+        "baleia-nvim-src": "baleia-nvim-src",
         "bufferline-nvim-src": "bufferline-nvim-src",
         "cmp-nvim-lsp-src": "cmp-nvim-lsp-src",
         "darwin": "darwin",

flake.nix

@@ -75,6 +75,10 @@
       url = "github:jose-elias-alvarez/null-ls.nvim";
       flake = false;
     };
+    baleia-nvim-src = {
+      url = "github:m00qek/baleia.nvim";
+      flake = false;
+    };
     Comment-nvim-src = {
       url = "github:numToStr/Comment.nvim/v0.8.0";
       flake = false;
@@ -110,20 +114,10 @@
 
   };
 
-  outputs = { self, nixpkgs, ... }@inputs:
+  outputs = { nixpkgs, ... }@inputs:
 
     let
 
-      # Common overlays to always use
-      overlays = [
-        inputs.nur.overlay
-        inputs.nix2vim.overlay
-        (import ./overlays/neovim-plugins.nix inputs)
-        (import ./overlays/calibre-web.nix)
-        (import ./overlays/disko.nix inputs)
-        (import ./overlays/tree-sitter.nix inputs)
-      ];
-
       # Global configuration for my systems
       globals = let baseName = "masu.rs";
       in rec {
@@ -135,7 +129,6 @@
         mail.imapHost = "imap.purelymail.com";
         mail.smtpHost = "smtp.purelymail.com";
         dotfilesRepo = "git@github.com:nmasur/dotfiles";
-        nixpkgs.overlays = overlays;
         hostnames = {
           git = "git.${baseName}";
           metrics = "metrics.${baseName}";
@@ -148,6 +141,16 @@
         };
       };
 
+      # Common overlays to always use
+      overlays = [
+        inputs.nur.overlay
+        inputs.nix2vim.overlay
+        (import ./overlays/neovim-plugins.nix inputs)
+        (import ./overlays/calibre-web.nix)
+        (import ./overlays/disko.nix inputs)
+        (import ./overlays/tree-sitter.nix inputs)
+      ];
+
       # System types to support.
       supportedSystems =
         [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
@@ -157,26 +160,20 @@
 
     in rec {
 
-      nixosModules = {
-        globals = { config }: { config = globals; };
-        common = import ./modules/common;
-        nixos = import ./modules/nixos;
-        darwin = import ./modules/darwin;
-      };
-
       # Contains my full system builds, including home-manager
       # nixos-rebuild switch --flake .#tempest
       nixosConfigurations = {
-        tempest = import ./hosts/tempest { inherit self; };
+        tempest = import ./hosts/tempest { inherit inputs globals overlays; };
-        hydra = import ./hosts/hydra { inherit self; };
+        hydra = import ./hosts/hydra { inherit inputs globals overlays; };
-        flame = import ./hosts/flame { inherit self; };
+        flame = import ./hosts/flame { inherit inputs globals overlays; };
-        swan = import ./hosts/swan { inherit self; };
+        swan = import ./hosts/swan { inherit inputs globals overlays; };
       };
 
       # Contains my full Mac system builds, including home-manager
       # darwin-rebuild switch --flake .#lookingglass
       darwinConfigurations = {
-        lookingglass = import ./hosts/lookingglass { inherit self; };
+        lookingglass =
+          import ./hosts/lookingglass { inherit inputs globals overlays; };
       };
 
       # For quickly applying home-manager settings with:
@@ -192,8 +189,10 @@
       diskoConfigurations = { root = import ./disks/root.nix; };
 
       packages = let
-        aws = system: import ./hosts/aws { inherit self system; };
+        aws = system:
-        staff = system: import ./hosts/staff { inherit self system; };
+          import ./hosts/aws { inherit inputs globals overlays system; };
+        staff = system:
+          import ./hosts/staff { inherit inputs globals overlays system; };
         neovim = system:
           let pkgs = import nixpkgs { inherit system overlays; };
           in import ./modules/common/neovim/package {

hosts/aws/default.nix

@@ -1,14 +1,17 @@
-{ self, system, ... }:
+{ inputs, system, globals, overlays, ... }:
 
-self.inputs.nixos-generators.nixosGenerate {
+inputs.nixos-generators.nixosGenerate {
   inherit system;
   format = "amazon";
   modules = [
-    self.inputs.home-manager.nixosModules.home-manager
+    inputs.home-manager.nixosModules.home-manager
-    self.nixosModules.globals
-    self.nixosModules.common
-    self.nixosModules.nixos
     {
+      nixpkgs.overlays = overlays;
+      user = globals.user;
+      fullName = globals.fullName;
+      dotfilesRepo = globals.dotfilesRepo;
+      gitName = globals.gitName;
+      gitEmail = globals.gitEmail;
       networking.hostName = "sheep";
       gui.enable = false;
       theme.colors = (import ../../colorscheme/gruvbox).dark;
@@ -18,6 +21,9 @@ self.inputs.nixos-generators.nixosGenerate {
       # AWS settings require this
       permitRootLogin = "prohibit-password";
     }
+    ../../modules/common
+    ../../modules/nixos
+    ../../modules/nixos/services/sshd.nix
   ] ++ [
     # Required to fix diskSize errors during build
     ({ ... }: { amazonImage.sizeMB = 16 * 1024; })

hosts/flame/default.nix

@@ -4,23 +4,24 @@
 # How to install:
 # https://blog.korfuri.fr/posts/2022/08/nixos-on-an-oracle-free-tier-ampere-machine/
 
-{ self, ... }:
+{ inputs, globals, overlays, ... }:
 
-self.inputs.nixpkgs.lib.nixosSystem {
+inputs.nixpkgs.lib.nixosSystem {
   system = "aarch64-linux";
   specialArgs = { };
   modules = [
-    self.inputs.home-manager.nixosModules.home-manager
+    globals
-    self.nixosModules.globals
+    inputs.home-manager.nixosModules.home-manager
-    self.nixosModules.common
+    ../../modules/common
-    self.nixosModules.nixos
+    ../../modules/nixos
     {
+      nixpkgs.overlays = overlays;
+
       # Hardware
       server = true;
       networking.hostName = "flame";
 
-      imports =
+      imports = [ (inputs.nixpkgs + "/nixos/modules/profiles/qemu-guest.nix") ];
-        [ (self.inputs.nixpkgs + "/nixos/modules/profiles/qemu-guest.nix") ];
       boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "usbhid" ];
 
       fileSystems."/" = {
@@ -48,7 +49,8 @@ self.inputs.nixpkgs.lib.nixosSystem {
 
       services.caddy.enable = true;
       services.grafana.enable = true;
-      services.prometheus.enable = true;
+      services.openssh.enable = true;
+      services.victoriametrics.enable = true;
       services.gitea.enable = true;
       services.vaultwarden.enable = true;
       services.minecraft-server.enable = true; # Setup Minecraft server
@@ -70,6 +72,9 @@ self.inputs.nixpkgs.lib.nixosSystem {
         accessKeyId = "0026b0e73b2e2c80000000005";
       };
 
+      # # Grant access to Jellyfin directories from Nextcloud
+      # users.users.nextcloud.extraGroups = [ "jellyfin" ];
+
       # # Wireguard config for Transmission
       # wireguard.enable = true;
       # networking.wireguard.interfaces.wg0 = {

hosts/hydra/default.nix

@@ -1,20 +1,21 @@
 # The Hydra
 # System configuration for WSL
 
-{ self, ... }:
+{ inputs, globals, overlays, ... }:
 
-self.inputs.nixpkgs.lib.nixosSystem {
+inputs.nixpkgs.lib.nixosSystem {
   system = "x86_64-linux";
   specialArgs = { };
   modules = [
-    self.inputs.wsl.nixosModules.wsl
+    ../../modules/common
-    self.inputs.home-manager.nixosModules.home-manager
+    ../../modules/nixos
-    self.nixosModules.globals
+    ../../modules/wsl
-    self.nixosModules.common
+    globals
-    self.nixosModules.nixos
+    inputs.wsl.nixosModules.wsl
-    self.nixosModules.wsl
+    inputs.home-manager.nixosModules.home-manager
     {
       networking.hostName = "hydra";
+      nixpkgs.overlays = overlays;
       identityFile = "/home/${globals.user}/.ssh/id_ed25519";
       gui.enable = false;
       theme = {

hosts/lookingglass/default.nix

@@ -1,23 +1,24 @@
 # The Looking Glass
 # System configuration for my work Macbook
 
-{ self, ... }:
+{ inputs, globals, overlays, ... }:
 
-self.inputs.darwin.lib.darwinSystem {
+inputs.darwin.lib.darwinSystem {
   system = "x86_64-darwin";
   specialArgs = { };
   modules = [
-    self.inputs.home-manager.darwinModules.home-manager
+    ../../modules/common
-    self.nixosModules.common
+    ../../modules/darwin
-    self.nixosModules.darwin
+    (globals // rec {
-    ({ config, lib, ... }: {
+      user = "Noah.Masur";
-      config = rec {
+      gitName = "Noah-Masur_1701";
-        user = lib.mkForce "Noah.Masur";
+      gitEmail = "${user}@take2games.com";
-        gitName = lib.mkForce "Noah-Masur_1701";
+    })
-        gitEmail = lib.mkForce "${user}@take2games.com";
+    inputs.home-manager.darwinModules.home-manager
-        nixpkgs.overlays = [ self.inputs.firefox-darwin.overlay ];
+    {
+      nixpkgs.overlays = [ inputs.firefox-darwin.overlay ] ++ overlays;
       networking.hostName = "lookingglass";
-        identityFile = "/Users/${user}/.ssh/id_ed25519";
+      identityFile = "/Users/Noah.Masur/.ssh/id_ed25519";
       gui.enable = true;
       theme = {
         colors = (import ../../colorscheme/gruvbox-dark).dark;
@@ -40,7 +41,6 @@ self.inputs.darwin.lib.darwinSystem {
       kubernetes.enable = true;
       _1password.enable = true;
       slack.enable = true;
-      };
+    }
-    })
   ];
 }

hosts/staff/default.nix

@@ -1,16 +1,13 @@
 # The Staff
 # ISO configuration for my USB drive
 
-{ self, system, ... }:
+{ inputs, system, overlays, ... }:
 
-self.inputs.nixos-generators.nixosGenerate {
+inputs.nixos-generators.nixosGenerate {
   inherit system;
   format = "install-iso";
-  modules = [
+  modules = [{
-    self.nixosModules.global
+    nixpkgs.overlays = overlays;
-    self.nixosModules.common
-    self.nixosModules.nixos
-    ({ config, pkgs, ... }: {
     networking.hostName = "staff";
     users.extraUsers.root.openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s"
@@ -26,7 +23,9 @@ self.inputs.nixos-generators.nixosGenerate {
         PermitRootLogin = "yes";
       };
     };
-      environment.systemPackages = with pkgs; [
+    environment.systemPackages =
+      let pkgs = import inputs.nixpkgs { inherit system overlays; };
+      in with pkgs; [
         git
         vim
         wget
@@ -40,6 +39,5 @@ self.inputs.nixos-generators.nixosGenerate {
       experimental-features = nix-command flakes
       warn-dirty = false
     '';
-    })
+  }];
-  ];
 }

hosts/swan/default.nix

@@ -1,20 +1,21 @@
 # The Swan
 # System configuration for my home NAS server
 
-{ self, ... }:
+{ inputs, globals, overlays, ... }:
 
-self.inputs.nixpkgs.lib.nixosSystem {
+inputs.nixpkgs.lib.nixosSystem {
   system = "x86_64-linux";
   specialArgs = { };
   modules = [
-    self.inputs.home-manager.nixosModules.home-manager
+    globals
-    self.inputs.disko.nixosModules.disko
+    inputs.home-manager.nixosModules.home-manager
-    self.nixosModules.globals
+    inputs.disko.nixosModules.disko
-    self.nixosModules.common
+    ../../modules/common
-    self.nixosModules.nixos
+    ../../modules/nixos
     {
       # Hardware
       server = true;
+      physical = true;
       networking.hostName = "swan";
 
       boot.initrd.availableKernelModules =
@@ -46,16 +47,20 @@ self.inputs.nixpkgs.lib.nixosSystem {
 
       gui.enable = false;
       theme = { colors = (import ../../colorscheme/gruvbox).dark; };
+      nixpkgs.overlays = overlays;
       neovim.enable = true;
       cloudflare.enable = true;
       dotfiles.enable = true;
       arrs.enable = true;
 
+      services.bind.enable = true;
       services.caddy.enable = true;
       services.jellyfin.enable = true;
       services.nextcloud.enable = true;
       services.calibre-web.enable = true;
-      services.prometheus.enable = true;
+      services.openssh.enable = true;
+      services.prometheus.enable = false;
+      services.vmagent.enable = true;
       services.samba.enable = true;
 
       cloudflareTunnel = {

hosts/tempest/default.nix

@@ -1,16 +1,18 @@
 # The Tempest
 # System configuration for my desktop
 
-{ self, ... }:
+{ inputs, globals, overlays, ... }:
 
-self.inputs.nixpkgs.lib.nixosSystem {
+inputs.nixpkgs.lib.nixosSystem {
   system = "x86_64-linux";
   modules = [
-    self.inputs.home-manager.nixosModules.home-manager
+    globals
-    self.nixosModules.globals
+    inputs.home-manager.nixosModules.home-manager
-    self.nixosModules.common
+    ../../modules/common
-    self.nixosModules.nixos
+    ../../modules/nixos
     {
+      nixpkgs.overlays = overlays;
+
       # Hardware
       physical = true;
       networking.hostName = "tempest";
@@ -51,7 +53,7 @@ self.inputs.nixpkgs.lib.nixosSystem {
 
       # Must be prepared ahead
       identityFile = "/home/${globals.user}/.ssh/id_ed25519";
-      passwordHash = self.inputs.nixpkgs.lib.fileContents ../../password.sha512;
+      passwordHash = inputs.nixpkgs.lib.fileContents ../../password.sha512;
 
       # Theming
       gui.enable = true;
@@ -59,8 +61,8 @@ self.inputs.nixpkgs.lib.nixosSystem {
         colors = (import ../../colorscheme/gruvbox-dark).dark;
         dark = true;
       };
-      wallpaper = "${self.inputs.wallpapers}/gruvbox/road.jpg";
+      wallpaper = "${inputs.wallpapers}/gruvbox/road.jpg";
-      gtk.theme.name = self.inputs.nixpkgs.lib.mkDefault "Adwaita-dark";
+      gtk.theme.name = inputs.nixpkgs.lib.mkDefault "Adwaita-dark";
 
       # Programs and services
       charm.enable = true;
@@ -89,7 +91,9 @@ self.inputs.nixpkgs.lib.nixosSystem {
         leagueoflegends.enable = true;
         ryujinx.enable = true;
       };
+      services.vmagent.enable = true;
 
+      services.openssh.enable = true; # Required for Cloudflare tunnel
       cloudflareTunnel = {
         enable = true;
         id = "ac133a82-31fb-480c-942a-cdbcd4c58173";

modules/common/applications/firefox.nix

@@ -73,6 +73,7 @@
             "media.ffmpeg.vaapi.enabled" =
               true; # Enable hardware video acceleration
             "cookiebanners.ui.desktop.enabled" = true; # Reject cookie popups
+            "svg.context-properties.content.enabled" = true; # Sidebery styling
           };
           userChrome = ''
             :root {

modules/common/applications/kitty.nix

@@ -28,6 +28,12 @@
       programs.rofi.terminal =
         lib.mkIf pkgs.stdenv.isLinux "${pkgs.kitty}/bin/kitty";
 
+      # Display images in the terminal
+      programs.fish.shellAliases = {
+        icat = "kitty +kitten icat";
+        ssh = "kitty +kitten ssh";
+      };
+
       programs.kitty = {
         enable = true;
         environment = { };
@@ -85,7 +91,6 @@
           # Scrollback
           scrolling_lines = 10000;
           scrollback_pager_history_size = 10; # MB
-          scrollback_pager = "${pkgs.neovim}/bin/nvim -c 'normal G'";
 
           # Window
           window_padding_width = 6;

modules/common/neovim/config/syntax.nix

@@ -22,6 +22,7 @@
     pkgs.vimPlugins.playground # Tree-sitter experimenting
     pkgs.vimPlugins.nginx-vim
     pkgs.vimPlugins.vim-helm
+    pkgs.baleia-nvim # Clean ANSI from kitty scrollback
     (pkgs.vimUtils.buildVimPluginFrom2Nix {
       pname = "nmasur";
       version = "0.1";

modules/common/neovim/default.nix

@@ -31,8 +31,8 @@ in {
             vll = "nvim -c 'Telescope oldfiles'";
           };
         };
-        programs.kitty.settings.scrollback_pager = lib.mkForce ''
+        programs.kitty.settings.scrollback_pager = ''
-          ${neovim}/bin/nvim -c 'setlocal nonumber nolist showtabline=0 foldcolumn=0|Man!' -c "autocmd VimEnter * normal G" -'';
+          $SHELL -c 'sed -r "s/[[:cntrl:]]\]133;[AC]..//g" | ${neovim}/bin/nvim -c "setlocal nonumber norelativenumber nolist laststatus=0" -c "lua baleia = require(\"baleia\").setup({}); baleia.once(0)" -c "map <silent> q :qa!<CR>" -c "autocmd VimEnter * normal G"' '';
 
         xdg.desktopEntries.nvim = lib.mkIf pkgs.stdenv.isLinux {
           name = "Neovim wrapper";

modules/common/neovim/lua/keybinds.lua

@@ -39,7 +39,7 @@ key("n", "<Leader>fs", ":write<CR>")
 key("n", "<Leader>fd", ":lcd %:p:h<CR>", { silent = true })
 key("n", "<Leader>fu", ":lcd ..<CR>", { silent = true })
 key("n", "<Leader><Tab>", ":b#<CR>", { silent = true })
-key("n", "<Leader>gr", ":!gh repo view -w<CR><CR>", { silent = true })
+key("n", "<Leader>gr", ":!gh browse %<CR><CR>", { silent = true })
 key("n", "<Leader>tt", [[<Cmd>exe 'edit $NOTES_PATH/journal/'.strftime("%Y-%m-%d_%a").'.md'<CR>]])
 key("n", "<Leader>jj", ":!journal<CR>:e<CR>")
 

modules/common/shell/utilities.nix

@@ -52,10 +52,6 @@ in {
         };
       };
 
-      programs.fish.shellAbbrs = {
-        cat = "bat"; # Swap cat with bat
-      };
-
       programs.fish.functions = {
         ping = {
           description = "Improved ping";

modules/nixos/applications/nautilus.nix

@@ -40,6 +40,7 @@
         defaultApplications."inode/directory" =
           lib.mkBefore [ "org.gnome.Nautilus.desktop" ];
       };
+
     };
 
     # # Set default for opening directories
@@ -50,6 +51,13 @@
     #     lib.mkForce [ "org.gnome.Nautilus.desktop" ];
     # };
 
+    # Delete Trash files older than 1 week
+    systemd.user.services.empty-trash = {
+      description = "Empty Trash on a regular basis";
+      wantedBy = [ "default.target" ];
+      script = "${pkgs.trash-cli}/bin/trash-empty 7";
+    };
+
   };
 
 }

modules/nixos/hardware/boot.nix

@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }: {
 
-  boot.loader = lib.mkIf config.physical {
+  boot.loader = lib.mkIf (config.physical && !config.server) {
     grub = {
       enable = true;
 

modules/nixos/hardware/networking.nix

@@ -2,12 +2,7 @@
 
   config = lib.mkIf config.physical {
 
-    # The global useDHCP flag is deprecated, therefore explicitly set to false here.
+    networking.useDHCP = true;
-    # Per-interface useDHCP will be mandatory in the future, so this generated config
-    # replicates the default behaviour.
-    networking.useDHCP = false;
-    networking.interfaces.enp5s0.useDHCP = true;
-    networking.interfaces.wlp4s0.useDHCP = true;
 
     networking.firewall.allowPing = lib.mkIf config.server true;
 
@@ -15,6 +10,9 @@
     services.avahi = {
       enable = true;
       domainName = "local";
+      ipv6 = false; # Should work either way
+      # Resolve local hostnames using Avahi DNS
+      nssmdns = true;
       publish = {
         enable = true;
         addresses = true;
@@ -22,10 +20,6 @@
         workstation = true;
       };
     };
-
-    # Resolve local hostnames using Avahi DNS
-    services.avahi.nssmdns = true;
-
   };
 
 }

modules/nixos/hardware/server.nix

@@ -1,6 +1,6 @@
-{ config, pkgs, lib, ... }: {
+{ config, lib, ... }: {
 
-  config = lib.mkIf (pkgs.stdenv.isLinux && config.server) {
+  config = lib.mkIf config.server {
 
     # Servers need a bootloader or they won't start
     boot.loader.systemd-boot.enable = true;

modules/nixos/hardware/sleep.nix

@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }: {
 
-  config = lib.mkIf config.physical {
+  config = lib.mkIf (config.physical && !config.server) {
 
     # Prevent wake from keyboard
     powerManagement.powerDownCommands = ''

modules/nixos/hardware/zfs.nix

@@ -1,15 +1,20 @@
-{ config, pkgs, lib, ... }: {
+{ config, lib, ... }: {
 
   options = { zfs.enable = lib.mkEnableOption "ZFS file system."; };
 
-  config =
+  config = lib.mkIf (config.server && config.zfs.enable) {
-    lib.mkIf (pkgs.stdenv.isLinux && config.server && config.zfs.enable) {
 
     # Only use compatible Linux kernel, since ZFS can be behind
-      boot.kernelPackages =
+    boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
-        config.boot.zfs.package.latestCompatibleLinuxPackages;
     boot.kernelParams = [ "nohibernate" ];
     boot.supportedFilesystems = [ "zfs" ];
+    services.prometheus.exporters.zfs.enable =
+      config.prometheus.exporters.enable;
+    prometheus.scrapeTargets = [
+      "127.0.0.1:${
+        builtins.toString config.services.prometheus.exporters.zfs.port
+      }"
+    ];
 
   };
 

modules/nixos/services/bind.nix

@@ -0,0 +1,55 @@
+{ config, pkgs, lib, ... }:
+
+let
+
+  localIp = "192.168.1.218";
+  localServices = [
+    config.hostnames.stream
+    config.hostnames.content
+    config.hostnames.books
+    config.hostnames.download
+  ];
+  mkRecord = service: "${service}       A       ${localIp}";
+  localRecords = lib.concatLines (map mkRecord localServices);
+
+in {
+
+  config = lib.mkIf config.services.bind.enable {
+
+    caddy.cidrAllowlist = [ "192.168.0.0/16" ];
+
+    services.bind = {
+      cacheNetworks = [ "127.0.0.0/24" "192.168.0.0/16" ];
+      forwarders = [ "1.1.1.1" "1.0.0.1" ];
+      ipv4Only = true;
+
+      # Use rpz zone as an override
+      extraOptions = ''response-policy { zone "rpz"; };'';
+
+      zones = {
+        rpz = {
+          master = true;
+          file = pkgs.writeText "db.rpz" ''
+            $TTL 60  ; 1 minute
+            @       IN      SOA     localhost. root.localhost. (
+                                    2023071800      ; serial
+                                    1h              ; refresh
+                                    30m             ; retry
+                                    1w              ; expire
+                                    30m             ; minimum ttl
+                                    )
+                    IN      NS      localhost.
+            localhost       A       127.0.0.1
+            ${localRecords}
+          '';
+        };
+      };
+
+    };
+
+    networking.firewall.allowedTCPPorts = [ 53 ];
+    networking.firewall.allowedUDPPorts = [ 53 ];
+
+  };
+
+}

modules/nixos/services/caddy.nix

@@ -1,25 +1,41 @@
 { config, pkgs, lib, ... }: {
 
   options = {
-    caddy.tlsPolicies = lib.mkOption {
+    caddy = {
+      tlsPolicies = lib.mkOption {
         type = lib.types.listOf lib.types.attrs;
         description = "Caddy JSON TLS policies";
         default = [ ];
       };
-    caddy.routes = lib.mkOption {
+      routes = lib.mkOption {
         type = lib.types.listOf lib.types.attrs;
         description = "Caddy JSON routes for http servers";
         default = [ ];
       };
-    caddy.blocks = lib.mkOption {
+      blocks = lib.mkOption {
         type = lib.types.listOf lib.types.attrs;
         description = "Caddy JSON error blocks for http servers";
         default = [ ];
       };
+      cidrAllowlist = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        description = "CIDR blocks to allow for requests";
+        default = [ ];
+      };
+    };
   };
 
-  config =
+  config = lib.mkIf config.services.caddy.enable {
-    lib.mkIf (config.services.caddy.enable && config.caddy.routes != [ ]) {
+
+    # Force Caddy to 403 if not coming from allowlisted source
+    caddy.cidrAllowlist = [ "127.0.0.1/32" ];
+    caddy.routes = [{
+      match = [{ not = [{ remote_ip.ranges = config.caddy.cidrAllowlist; }]; }];
+      handle = [{
+        handler = "static_response";
+        status_code = "403";
+      }];
+    }];
 
     services.caddy = {
       adapter = "''"; # Required to enable JSON
@@ -30,6 +46,7 @@
           errors.routes = config.caddy.blocks;
           # logs = { }; # Uncomment to collect access logs
         };
+        apps.http.servers.metrics = { }; # Enables Prometheus metrics
         apps.tls.automation.policies = config.caddy.tlsPolicies;
         logging.logs.main = {
           encoder = { format = "console"; };
@@ -47,6 +64,8 @@
     networking.firewall.allowedTCPPorts = [ 80 443 ];
     networking.firewall.allowedUDPPorts = [ 443 ];
 
+    prometheus.scrapeTargets = [ "127.0.0.1:2019" ];
+
   };
 
 }

modules/nixos/services/cloudflare.nix

@@ -41,13 +41,7 @@ in {
   config = lib.mkIf config.cloudflare.enable {
 
     # Forces Caddy to error if coming from a non-Cloudflare IP
-    caddy.blocks = [{
+    caddy.cidrAllowlist = cloudflareIpRanges;
-      match = [{ not = [{ remote_ip.ranges = cloudflareIpRanges; }]; }];
-      handle = [{
-        handler = "static_response";
-        abort = true;
-      }];
-    }];
 
     # Tell Caddy to use Cloudflare DNS for ACME challenge validation
     services.caddy.package = (pkgs.callPackage ../../../overlays/caddy.nix {

modules/nixos/services/default.nix

@@ -3,6 +3,7 @@
   imports = [
     ./arr.nix
     ./backups.nix
+    ./bind.nix
     ./caddy.nix
     ./calibre.nix
     ./cloudflare-tunnel.nix
@@ -24,6 +25,7 @@
     ./sshd.nix
     ./transmission.nix
     ./vaultwarden.nix
+    ./victoriametrics.nix
     ./wireguard.nix
   ];
 

modules/nixos/services/gitea-runner.nix

@@ -10,9 +10,9 @@
       enable = true;
       labels = [
         # Provide a Debian base with NodeJS for actions
-        "debian-latest:docker://node:18-bullseye"
+        # "debian-latest:docker://node:18-bullseye"
         # Fake the Ubuntu name, because Node provides no Ubuntu builds
-        "ubuntu-latest:docker://node:18-bullseye"
+        # "ubuntu-latest:docker://node:18-bullseye"
         # Provide native execution on the host using below packages
         "native:host"
       ];
@@ -31,6 +31,23 @@
       tokenFile = config.secrets.giteaRunnerToken.dest;
     };
 
+    secrets.giteaRunnerToken = {
+      source = ../../../private/gitea-runner-token.age; # TOKEN=xyz
+      dest = "${config.secretsDirectory}/gitea-runner-token";
+    };
+    systemd.services.giteaRunnerToken-secret = {
+      requiredBy = [
+        "gitea-runner-${
+          config.services.gitea-actions-runner.instances.${config.networking.hostName}.name
+        }.service"
+      ];
+      before = [
+        "gitea-runner-${
+          config.services.gitea-actions-runner.instances.${config.networking.hostName}.name
+        }.service"
+      ];
+    };
+
   };
 
 }

modules/nixos/services/grafana.nix

@@ -13,7 +13,12 @@
       match = [{ host = [ config.hostnames.metrics ]; }];
       handle = [{
         handler = "reverse_proxy";
-        upstreams = [{ dial = "localhost:3000"; }];
+        upstreams = [{
+          dial = "localhost:${
+              builtins.toString
+              config.services.grafana.settings.server.http_port
+            }";
+        }];
       }];
     }];
 

modules/nixos/services/jellyfin.nix

@@ -5,13 +5,25 @@
     services.jellyfin.group = "media";
     users.users.jellyfin = { isSystemUser = true; };
 
-    caddy.routes = [{
+    caddy.routes = [
+      {
+        match = [{
+          host = [ config.hostnames.stream ];
+          path = [ "/metrics*" ];
+        }];
+        handle = [{
+          handler = "static_response";
+          status_code = "403";
+        }];
+      }
+      {
         match = [{ host = [ config.hostnames.stream ]; }];
         handle = [{
           handler = "reverse_proxy";
           upstreams = [{ dial = "localhost:8096"; }];
         }];
-    }];
+      }
+    ];
 
     # Create videos directory, allow anyone in Jellyfin group to manage it
     systemd.tmpfiles.rules = [
@@ -35,6 +47,9 @@
     users.users.jellyfin.extraGroups =
       [ "render" "video" ]; # Access to /dev/dri
 
+    # Requires MetricsEnable is true in /var/lib/jellyfin/config/system.xml
+    prometheus.scrapeTargets = [ "127.0.0.1:8096" ];
+
   };
 
 }

modules/nixos/services/nextcloud.nix

@@ -1,9 +1,15 @@
-{ config, pkgs, lib, ... }: {
+{ config, pkgs, lib, ... }:
+
+let
+
+  port = 8080;
+
+in {
 
   config = lib.mkIf config.services.nextcloud.enable {
 
     services.nextcloud = {
-      package = pkgs.nextcloud26; # Required to specify
+      package = pkgs.nextcloud27; # Required to specify
       datadir = "/data/nextcloud";
       https = true;
       hostName = "localhost";
@@ -11,13 +17,14 @@
       config = {
         adminpassFile = config.secrets.nextcloud.dest;
         extraTrustedDomains = [ config.hostnames.content ];
+        trustedProxies = [ "127.0.0.1" ];
       };
     };
 
     # Don't let Nginx use main ports (using Caddy instead)
     services.nginx.virtualHosts."localhost".listen = [{
       addr = "127.0.0.1";
-      port = 8080;
+      port = port;
     }];
 
     # Point Caddy to Nginx
@@ -25,7 +32,7 @@
       match = [{ host = [ config.hostnames.content ]; }];
       handle = [{
         handler = "reverse_proxy";
-        upstreams = [{ dial = "localhost:8080"; }];
+        upstreams = [{ dial = "localhost:${builtins.toString port}"; }];
       }];
     }];
 
@@ -74,6 +81,23 @@
       requires = [ "phpfpm-nextcloud.service" ];
     };
 
+    # Log metrics to prometheus
+    services.prometheus.exporters.nextcloud = {
+      enable = config.prometheus.exporters.enable;
+      username = config.services.nextcloud.config.adminuser;
+      url = "http://localhost:${builtins.toString port}";
+      passwordFile = config.services.nextcloud.config.adminpassFile;
+    };
+    prometheus.scrapeTargets = [
+      "127.0.0.1:${
+        builtins.toString config.services.prometheus.exporters.nextcloud.port
+      }"
+    ];
+    # Allows nextcloud-exporter to read passwordFile
+    users.users.nextcloud-exporter.extraGroups =
+      lib.mkIf config.services.prometheus.exporters.nextcloud.enable
+      [ "nextcloud" ];
+
   };
 
 }

modules/nixos/services/prometheus.nix

@@ -1,18 +1,58 @@
 { config, pkgs, lib, ... }: {
 
+  options.prometheus = {
+    exporters.enable = lib.mkEnableOption "Enable Prometheus exporters";
+    scrapeTargets = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = "Prometheus scrape targets";
+      default = [ ];
+    };
+  };
+
   config = let
 
     # If hosting Grafana, host local Prometheus and listen for inbound jobs. If
     # not hosting Grafana, send remote Prometheus writes to primary host.
     isServer = config.services.grafana.enable;
 
-  in lib.mkIf config.services.prometheus.enable {
+  in {
+
+    # Turn on exporters if any Prometheus scraper is running
+    prometheus.exporters.enable = builtins.any (x: x) [
+      config.services.prometheus.enable
+      config.services.victoriametrics.enable
+      config.services.vmagent.enable
+    ];
+
+    prometheus.scrapeTargets = [
+      "127.0.0.1:${
+        builtins.toString config.services.prometheus.exporters.node.port
+      }"
+      "127.0.0.1:${
+        builtins.toString config.services.prometheus.exporters.systemd.port
+      }"
+      "127.0.0.1:${
+        builtins.toString config.services.prometheus.exporters.process.port
+      }"
+    ];
 
     services.prometheus = {
-      exporters.node.enable = true;
+      exporters.node.enable = config.prometheus.exporters.enable;
+      exporters.node.enabledCollectors = [ ];
+      exporters.node.disabledCollectors = [ "cpufreq" ];
+      exporters.systemd.enable = config.prometheus.exporters.enable;
+      exporters.process.enable = config.prometheus.exporters.enable;
+      exporters.process.settings.process_names = [
+        # Remove nix store path from process name
+        {
+          name = "{{.Matches.Wrapped}} {{ .Matches.Args }}";
+          cmdline = [ "^/nix/store[^ ]*/(?P<Wrapped>[^ /]*) (?P<Args>.*)" ];
+        }
+      ];
+      extraFlags = lib.mkIf isServer [ "--web.enable-remote-write-receiver" ];
       scrapeConfigs = [{
-        job_name = "local";
+        job_name = config.networking.hostName;
-        static_configs = [{ targets = [ "127.0.0.1:9100" ]; }];
+        static_configs = [{ targets = config.scrapeTargets; }];
       }];
       webExternalUrl =
         lib.mkIf isServer "https://${config.hostnames.prometheus}";
@@ -28,7 +68,7 @@
         });
       remoteWrite = lib.mkIf (!isServer) [{
         name = config.networking.hostName;
-        url = "https://${config.hostnames.prometheus}";
+        url = "https://${config.hostnames.prometheus}/api/v1/write";
         basic_auth = {
           # Uses password hashed with bcrypt above
           username = "prometheus";
@@ -38,23 +78,26 @@
     };
 
     # Create credentials file for remote Prometheus push
-    secrets.prometheus = lib.mkIf (!isServer) {
+    secrets.prometheus =
+      lib.mkIf (config.services.prometheus.enable && !isServer) {
         source = ../../../private/prometheus.age;
         dest = "${config.secretsDirectory}/prometheus";
         owner = "prometheus";
         group = "prometheus";
         permissions = "0440";
       };
-    systemd.services.prometheus-secret = lib.mkIf (!isServer) {
+    systemd.services.prometheus-secret =
+      lib.mkIf (config.services.prometheus.enable && !isServer) {
         requiredBy = [ "prometheus.service" ];
         before = [ "prometheus.service" ];
       };
 
-    caddy.routes = lib.mkIf isServer [{
+    caddy.routes = lib.mkIf (config.services.prometheus.enable && isServer) [{
       match = [{ host = [ config.hostnames.prometheus ]; }];
       handle = [{
         handler = "reverse_proxy";
-        upstreams = [{ dial = "localhost:9090"; }];
+        upstreams =
+          [{ dial = "localhost:${config.services.prometheus.port}"; }];
       }];
     }];
 

modules/nixos/services/secrets.nix

@@ -39,6 +39,11 @@
             type = lib.types.str;
             description = "Permissions expressed as octal.";
           };
+          prefix = lib.mkOption {
+            default = "";
+            type = lib.types.str;
+            description = "Prefix for secret value (for environment files).";
+          };
         };
       });
       description = "Set of secrets to decrypt to disk.";
@@ -65,10 +70,10 @@
         wantedBy = [ "multi-user.target" ];
         serviceConfig.Type = "oneshot";
         script = ''
+          echo "${attrs.prefix}$(
             ${pkgs.age}/bin/age --decrypt \
-            --identity ${config.identityFile} \
+                --identity ${config.identityFile} ${attrs.source}
-            --output ${attrs.dest} \
+          )" > ${attrs.dest}
-            ${attrs.source}
 
           chown '${attrs.owner}':'${attrs.group}' '${attrs.dest}'
           chmod '${attrs.permissions}' '${attrs.dest}'

modules/nixos/services/sshd.nix

@@ -13,9 +13,8 @@
     };
   };
 
-  config = lib.mkIf (config.publicKey != null) {
+  config = lib.mkIf config.services.openssh.enable {
     services.openssh = {
-      enable = true;
       ports = [ 22 ];
       allowSFTP = true;
       settings = {
@@ -27,7 +26,7 @@
     };
 
     users.users.${config.user}.openssh.authorizedKeys.keys =
-      [ config.publicKey ];
+      lib.mkIf (config.publicKey != null) [ config.publicKey ];
 
     # Implement a simple fail2ban service for sshd
     services.sshguard.enable = true;

modules/nixos/services/victoriametrics.nix

@@ -0,0 +1,95 @@
+{ config, pkgs, lib, ... }:
+
+let
+
+  username = "prometheus";
+
+  prometheusConfig = (pkgs.formats.yaml { }).generate "prometheus.yml" {
+    scrape_configs = [{
+      job_name = config.networking.hostName;
+      stream_parse = true;
+      static_configs = [{ targets = config.prometheus.scrapeTargets; }];
+    }];
+  };
+
+  authConfig = (pkgs.formats.yaml { }).generate "auth.yml" {
+    users = [{
+      username = username;
+      password = "%{PASSWORD}";
+      url_prefix =
+        "http://localhost${config.services.victoriametrics.listenAddress}";
+    }];
+  };
+
+  authPort = "8427";
+
+in {
+
+  config = {
+
+    services.victoriametrics.extraOptions =
+      [ "-promscrape.config=${prometheusConfig}" ];
+
+    systemd.services.vmauth = lib.mkIf config.services.victoriametrics.enable {
+      description = "VictoriaMetrics basic auth proxy";
+      after = [ "network.target" ];
+      startLimitBurst = 5;
+      serviceConfig = {
+        Restart = "on-failure";
+        RestartSec = 1;
+        DynamicUser = true;
+        EnvironmentFile = config.secrets.vmauth.dest;
+        ExecStart = ''
+          ${pkgs.victoriametrics}/bin/vmauth \
+                    -auth.config=${authConfig} \
+                    -httpListenAddr=:${authPort}'';
+      };
+      wantedBy = [ "multi-user.target" ];
+    };
+
+    secrets.vmauth = lib.mkIf config.services.victoriametrics.enable {
+      source = ../../../private/prometheus.age;
+      dest = "${config.secretsDirectory}/vmauth";
+      prefix = "PASSWORD=";
+    };
+    systemd.services.vmauth-secret =
+      lib.mkIf config.services.victoriametrics.enable {
+        requiredBy = [ "vmauth.service" ];
+        before = [ "vmauth.service" ];
+      };
+
+    caddy.routes = lib.mkIf config.services.victoriametrics.enable [{
+      match = [{ host = [ config.hostnames.prometheus ]; }];
+      handle = [{
+        handler = "reverse_proxy";
+        upstreams = [{ dial = "localhost:${authPort}"; }];
+      }];
+    }];
+
+    # VMAgent
+
+    services.vmagent.prometheusConfig = prometheusConfig; # Overwritten below
+    systemd.services.vmagent.serviceConfig =
+      lib.mkIf config.services.vmagent.enable {
+        ExecStart = lib.mkForce ''
+          ${pkgs.victoriametrics}/bin/vmagent \
+                  -promscrape.config=${prometheusConfig} \
+                  -remoteWrite.url="https://${config.hostnames.prometheus}/api/v1/write" \
+                  -remoteWrite.basicAuth.username=${username} \
+                  -remoteWrite.basicAuth.passwordFile=${config.secrets.vmagent.dest}'';
+      };
+
+    secrets.vmagent = lib.mkIf config.services.vmagent.enable {
+      source = ../../../private/prometheus.age;
+      dest = "${config.secretsDirectory}/vmagent";
+      owner = "vmagent";
+      group = "vmagent";
+    };
+    systemd.services.vmagent-secret = lib.mkIf config.services.vmagent.enable {
+      requiredBy = [ "vmagent.service" ];
+      before = [ "vmagent.service" ];
+    };
+
+  };
+
+}

overlays/neovim-plugins.nix

@@ -7,12 +7,12 @@ let
   # Use nixpkgs vimPlugin but with source directly from plugin author
   withSrc = pkg: src: pkg.overrideAttrs (_: { inherit src; });
 
-  # Package plugin - disabling until in use
+  # Package plugin - for plugins not found in nixpkgs at all
-  # plugin = pname: src:
+  plugin = pname: src:
-  #   prev.vimUtils.buildVimPluginFrom2Nix {
+    prev.vimUtils.buildVimPluginFrom2Nix {
-  #     inherit pname src;
+      inherit pname src;
-  #     version = "master";
+      version = "master";
-  #   };
+    };
 
 in {
 
@@ -36,8 +36,7 @@ in {
     (withSrc prev.vimPlugins.bufferline-nvim inputs.bufferline-nvim);
   nvim-tree-lua = (withSrc prev.vimPlugins.nvim-tree-lua inputs.nvim-tree-lua);
 
-  # Packaging plugins with Nix
+  # Packaging plugins entirely with Nix
-  # comment-nvim = plugin "comment-nvim" comment-nvim-src;
+  baleia-nvim = plugin "baleia-nvim" inputs.baleia-nvim-src;
-  # plenary-nvim = plugin "plenary-nvim" plenary-nvim-src;
 
 }

private/gitea-runner-token.age

@@ -0,0 +1,12 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBoOVF1
+NmZocHpQQnRJcWpWUHh2bU93NkdnZWNzSlFiaHdTd24rcHpsczFRCmJaSzNkNGs1
+UDJCN2dYUVE3UTE1OU5RUWljQlN4dmxuUnpOMFYxQTdUaVEKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIE5HdGd6aTlKM0lFUlYzT1VhS05nZ2ZxTndVZHBNQlJxYlovdXkx
+ei96d2cKdzlUYVFFaEIzaS9LZmY3MzM1RmNnR0xjOEpHK1kxM0FMTWRQSlVnczVF
+dwotPiBzc2gtZWQyNTUxOSBuanZYNUEgQ1lhMGQvUy9OWkRBR3BZV1pFNmNtb2pq
+Y2VEUzhRWGVWUkZJY1l4RGtWdwphdFZtM0ZLZURvYVZQYjV4bWVPdWJxa3RmWmVh
+SHl0T0pQWmxnVlFPR2drCi0tLSBnd2lwS3dqUk5Jelg0b3RxbFdEcnJ6ZkkvZTVN
+UllBeUUyOXBxVDBKMG5BCkGo9kj9sMVhbnXVM35lGScAb8r5LH9vf5jOdhLC/Wj2
++uA0ONIh7F2GELzf5Cw1KZJ8aHTURM2r41vZvfAQN1RwrmYOiUzlyMrvTDe78cY=
+-----END AGE ENCRYPTED FILE-----