setup services, firewall, secrets etc

nixos/viridian/configuration.nix

@@ -12,10 +12,10 @@
   imports = [
     # If you want to use modules your own flake exports (from modules/nixos):
     # outputs.nixosModules.example
+    outputs.nixosModules.qbittorrent
 
     # Or modules from other flakes (such as nixos-hardware):
-    # inputs.hardware.nixosModules.common-cpu-amd
+    inputs.agenix.nixosModules.default
-    # inputs.hardware.nixosModules.common-ssd
 
     # You can also split up your configuration and import pieces of it here:
     # ./users.nix
@@ -23,8 +23,9 @@
     # Import common configurations
     ../common/system-tools.nix
 
-    # Import our docker containers
+    # Import services
-    ./containers
+    ./services/traefik
+    ./services/media-stack
 
     # Import your generated (nixos-generate-config) hardware configuration
     ./hardware-configuration.nix
@@ -86,49 +87,149 @@
     firewall = {
       enable = true;
       allowedTCPPorts = [
-        53    # pihole-FTL  (DNS)
+        53    # adguardhome (DNS)
         80    # traefik     (HTTP)
         443   # traefik     (HTTPS)
-        8096  # jellyfin
         32372 # qbittorrent
+
       ];
       allowedUDPPorts = [
-        53    # pihole-FTL  (DNS)
+        53    # adguardhome (DNS)
         80    # traefik     (HTTP)
         443   # traefik     (HTTPS)
-        8096  # jellyfin
         32372 # qbittorrent
       ];
     };
   };
 
-  boot.loader = {
+  boot = {
-    systemd-boot.enable = true;
+    loader = {
-    efi = {
+      systemd-boot.enable = true;
+      efi = {
         canTouchEfiVariables = true;
         efiSysMountPoint = "/boot/efi";
+      };
+    };
+    kernel.sysctl = {
+      # Allow listening on TCP & UDP ports below 1024
+      "net.ipv4.ip_unprivileged_port_start" = 0;
     };
   };
 
-  programs.zsh.enable = true;
+  # Setup environment
+  environment = {
+    # Symlink /bin/sh to POSIX-Complient shell
+    binsh = "${pkgs.bash}/bin/bash";
+    shells = with pkgs; [ zsh ];
 
-  users.users = {
+    # Install packages, prefix with 'unstable.' to use overlay
-    admin = {
+    systemPackages = with pkgs; [
-      isNormalUser = true;
+      inputs.agenix.packages."${system}".default
-      extraGroups = [ "networkmanager" "wheel" "docker" ];
+    ];
-      shell = pkgs.zsh;
+  };
-      openssh.authorizedKeys.keyFiles = [ ../fuchsia/id_ed25519_sk.pub ];
+
+  programs = {
+    zsh.enable = true;
+  };
+
+  services = {
+    # This setups a SSH server. Very important if you're setting up a headless system.
+    # Feel free to remove if you don't need it.
+    openssh = {
+      enable = true;
+      # Forbid root login through SSH.
+      settings.PermitRootLogin = "no";
+      # Use keys only. Remove if you want to SSH using password (not recommended)
+      settings.PasswordAuthentication = false;
+    };
+
+    # Privacy protection center
+    adguardhome = {
+      enable = true;
+      openFirewall = true;
+      settings = {
+        # Web interface IP address to listen on.
+        bind_port = 3000;
+        # Web interface IP port to listen on.
+        bind_host = "0.0.0.0";
+        # Custom DNS responses
+        dns.rewrites = [
+          { domain = "kanto.dev";
+            answer = "192.168.1.102";
+          }
+          { domain = "*.kanto.dev";
+            answer = "kanto.dev";
+          }
+        ];
+      };
+    };
+
+    # Home automation that puts local control and privacy first.
+    home-assistant = {
+      enable = true;
+      openFirewall = true;
+      extraComponents = [
+        # Components required to complete the onboarding
+        "esphome"
+        "met"
+        "radio_browser"
+
+        "adguard"
+        "jellyfin"
+      ];
+      config = {
+        # Includes dependencies for a basic setup
+        # https://www.home-assistant.io/integrations/defaultoconfig/
+        default_config = {};
+        http = {
+          use_x_forwarded_for = true;
+          trusted_proxies = [
+            "192.168.1.102"
+          ];
+        };
+      };
+      configDir = "/var/lib/home-assistant";
+    };
+
+    # Sandbox game developed by Mojang Studios
+    minecraft-server = {
+      enable = true;
+      openFirewall = true;
+      dataDir = "/var/lib/minecraft";
+      declarative = true;
+      serverProperties = {
+        gamemode = "survival";
+        level-name = "kanto";
+        difficulty = "easy";
+        server-port = 43000;
+        motd = "A Caterpie May Change Into A Butterfree, But The Heart That Beats Inside Remains The Same.";
+      };
+      eula = true;
     };
   };
 
-  # This setups a SSH server. Very important if you're setting up a headless system.
+  # Configure your system-wide user settings (groups, etc), add more users as needed.
-  # Feel free to remove if you don't need it.
+  users = {
-  services.openssh = {
+    users = {
-    enable = true;
+      # System administator
-    # Forbid root login through SSH.
+      sabrina = {
-    settings.PermitRootLogin = "no";
+        isNormalUser = true;
-    # Use keys only. Remove if you want to SSH using password (not recommended)
+        extraGroups = [ "networkmanager" "wheel" "media" ];
-    settings.PasswordAuthentication = false;
+        openssh.authorizedKeys.keyFiles = [ ../fuchsia/id_ed25519_sk.pub ];
+        shell = pkgs.zsh;
+      };
+    };
+
+    # Additional groups to create.
+    groups = {
+      media.members = [
+        "jellyfin"
+        "sonarr"
+        "radarr"
+        "lidarr"
+        "qbittorrent"
+      ];
+    };
   };
 
   # https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion

nixos/viridian/services/media-stack/default.nix

@@ -0,0 +1,41 @@
+{ ... }:
+
+{
+  services = {
+    # Volunteer-built media solution that puts you in control of your media
+    jellyfin = {
+      enable = true;
+      openFirewall = true;
+    };
+    # PVR for Usenet and BitTorrent users
+    sonarr = {
+      enable = true;
+      openFirewall = true;
+      dataDir = "/var/lib/sonarr";
+    };
+    # Movie collection manager for Usenet and BitTorrent users
+    radarr = {
+      enable = true;
+      openFirewall = true;
+      dataDir = "/var/lib/radarr";
+    };
+    # Music collection manager for Usenet and BitTorrent users
+    lidarr = {
+      enable = true;
+      openFirewall = true;
+      dataDir = "/var/lib/lidarr";
+    };
+    # Indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps.
+    prowlarr = {
+      enable = true;
+      openFirewall = true;
+    };
+    # Open-source software alternative to µTorrent
+    qbittorrent = {
+      enable = true;
+      openFirewall = true;
+      port = 8080;
+    };
+  };
+}
+