config/hosts/forgejo/nginx.nix

@@ -29,8 +29,7 @@
       };
 
       extraConfig = ''
-        set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
-        set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
+        set_real_ip_from 10.202.41.100;
         real_ip_header proxy_protocol;
       '';
     };

config/hosts/hydra/nginx.nix

@@ -16,8 +16,7 @@
         extraConfig = ''
           listen 0.0.0.0:8443 http2 ssl proxy_protocol;
 
-          set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
-          set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
+          set_real_ip_from 10.202.41.100;
           real_ip_header proxy_protocol;
         '';
       };
@@ -34,8 +33,7 @@
         extraConfig = ''
           listen 0.0.0.0:8443 http2 ssl proxy_protocol;
 
-          set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
-          set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
+          set_real_ip_from 10.202.41.100;
           real_ip_header proxy_protocol;
         '';
       };

config/hosts/ikiwiki/nginx.nix

@@ -39,8 +39,7 @@ in
         };
       };
       extraConfig = ''
-        set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
-        set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
+        set_real_ip_from 10.202.41.100;
         real_ip_header proxy_protocol;
       '';
     };

config/hosts/keycloak/nginx.nix

@@ -27,8 +27,7 @@
         extraConfig = ''
           listen 0.0.0.0:8443 http2 ssl proxy_protocol;
 
-          set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
-          set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
+          set_real_ip_from 10.202.41.100;
           real_ip_header proxy_protocol;
 
           add_header Strict-Transport-Security "max-age=63072000" always;

config/hosts/mastodon/nginx.nix

@@ -57,8 +57,7 @@
       };
 
       extraConfig = ''
-        set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
-        set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
+        set_real_ip_from 10.202.41.100;
         real_ip_header proxy_protocol;
       '';
     };

config/hosts/matrix/nginx.nix

@@ -51,8 +51,7 @@
         extraConfig = ''
           listen 0.0.0.0:8443 http2 ssl proxy_protocol;
 
-          set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
-          set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
+          set_real_ip_from 10.202.41.100;
           real_ip_header proxy_protocol;
         '';
       };
@@ -81,8 +80,7 @@
         extraConfig = ''
           listen 0.0.0.0:8443 http2 ssl proxy_protocol;
 
-          set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
-          set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
+          set_real_ip_from 10.202.41.100;
           real_ip_header proxy_protocol;
         '';
       };
@@ -105,8 +103,7 @@
         extraConfig = ''
           listen 0.0.0.0:8443 http2 ssl proxy_protocol;
 
-          set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
-          set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
+          set_real_ip_from 10.202.41.100;
           real_ip_header proxy_protocol;
         '';
       };

config/hosts/metrics-nekomesh/nginx.nix

@@ -23,8 +23,7 @@
           proxyWebsockets = true;
         };
         extraConfig = ''
-          set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
-          set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
+          set_real_ip_from 10.202.41.100;
           real_ip_header proxy_protocol;
         '';
       };

config/hosts/navidrome/configuration.nix

@@ -0,0 +1,33 @@
+{ ... }:
+{
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/vda";
+  };
+
+  networking = {
+    hostName = "navidrome";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 80 443 ];
+    };
+  };
+
+  fileSystems = {
+    "/mnt/music" = {
+      device = "//10.202.40.5/music-ro";
+      fsType = "cifs";
+      options = [ 
+        "username=navidrome" 
+        "credentials=/secrets/navidrome-samba-credentials.secret"
+        "iocharset=utf8"
+        "vers=3.1.1"
+        "uid=navidrome"
+        "gid=navidrome"
+        "_netdev"
+      ];
+    };
+  };
+
+  system.stateVersion = "23.05";
+}

config/hosts/navidrome/default.nix

@@ -0,0 +1,7 @@
+{ ... }: {
+  imports = [
+    ./configuration.nix
+    ./navidrome.nix
+    ./nginx.nix
+  ];
+}

config/hosts/navidrome/navidrome.nix

@@ -0,0 +1,9 @@
+{ ... }: {
+  services.navidrome = {
+    enable = true;
+    settings = {
+      Address = "unix:/run/navidrome/navidrome.socket";
+      MusicFolder = "/mnt/music";
+    };
+  };
+}

config/hosts/navidrome/nginx.nix

@@ -0,0 +1,24 @@
+{ ... }: {
+  services.nginx = {
+    enable = true;
+    user = "navidrome";
+    virtualHosts."navidrome.grzb.de" = {
+      forceSSL = true;
+      enableACME = true;
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 80;
+        }
+        {
+          addr = "0.0.0.0";
+          port = 443;
+          ssl = true;
+        }
+      ];
+      locations."/" = {
+        proxyPass = "http://unix:/run/navidrome/navidrome.socket";
+      };
+    };
+  };
+}

config/hosts/navidrome/secrets.nix

@@ -0,0 +1,13 @@
+{ keyCommandEnv, ... }:
+{
+  deployment.keys = {
+    "navidrome-samba-credentials.secret" = {
+      keyCommand = keyCommandEnv ++ [ "pass" "navidrome/samba-credentials" ];
+      destDir = "/secrets";
+      user = "root";
+      group = "root";
+      permissions = "0640";
+      uploadAt = "pre-activation";
+    };
+  };
+}

config/hosts/netbox/configuration.nix

@@ -0,0 +1,17 @@
+{ ... }:
+{
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/vda";
+  };
+
+  networking = {
+    hostName = "netbox";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 80 443 ];
+    };
+  };
+
+  system.stateVersion = "23.05";
+}

config/hosts/netbox/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  imports = [
+    ./configuration.nix
+    ./netbox.nix
+    ./nginx.nix
+  ];
+}

config/hosts/netbox/netbox.nix

@@ -0,0 +1,8 @@
+{ pkgs, ... }:
+{
+  services.netbox = {
+    enable = true;
+    package = pkgs.netbox;
+    secretKeyFile = "/secrets/netbox-secret-key.secret";
+  };
+}

config/hosts/netbox/nginx.nix

@@ -0,0 +1,29 @@
+{ config, ... }:
+{
+  services.nginx = {
+    enable = true;
+    clientMaxBodySize = "25m";
+    user = "netbox";
+    virtualHosts."netbox.grzb.de" = {
+      forceSSL = true;
+      enableACME = true;
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 80;
+        }
+        {
+          addr = "0.0.0.0";
+          port = 443;
+          ssl = true;
+        }
+      ];
+      locations."/static/" = {
+        alias = "${config.services.netbox.dataDir}/static/";
+      };
+      locations."/" = {
+        proxyPass = "http://${config.services.netbox.listenAddress}:${builtins.toString config.services.netbox.port}";
+      };
+    };
+  };
+}

config/hosts/netbox/secrets.nix

@@ -0,0 +1,11 @@
+{ keyCommandEnv, ... }:
+{
+  deployment.keys."netbox-secret-key.secret" = {
+    keyCommand = keyCommandEnv ++ [ "pass" "netbox/secret-key" ];
+    destDir = "/secrets";
+    user = "netbox";
+    group = "netbox";
+    permissions = "0640";
+    uploadAt = "pre-activation";
+  };
+}

config/hosts/nextcloud/nextcloud.nix

@@ -44,8 +44,7 @@
       extraConfig = ''
         listen 0.0.0.0:8443 http2 ssl proxy_protocol;
 
-        set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
-        set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
+        set_real_ip_from 10.202.41.100;
         real_ip_header proxy_protocol;
       '';
     };

config/hosts/nitter/configuration.nix

@@ -0,0 +1,17 @@
+{ ... }:
+{
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/vda";
+  };
+
+  networking = {
+    hostName = "nitter";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 8443 ];
+    };
+  };
+
+  system.stateVersion = "23.05";
+}

config/hosts/nitter/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  imports = [
+    ./configuration.nix
+    ./nginx.nix
+    ./nitter.nix
+  ];
+}