numbus/numbus
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update services. Update configuration.

Browse Source
This commit is contained in:
Raphaël Numbus
2026-01-11 17:45:11 +01:00
parent 755cf09fdc
commit 14c5190dc8
13 changed files with 111 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
templates/nix-config/misc/activation.nix
+1
View File
@@ -20,6 +20,7 @@
mkdir -p /mnt/config/ /mnt/data/ /home/numbus-admin/.numbus-server/
chown -R numbus-admin:users /mnt/config/
chown -R numbus-admin:users /mnt/data/
chown -R 100032:users /mnt/data/nextcloud/
chown -R numbus-admin:users /home/numbus-admin/.numbus-server/
touch /home/numbus-admin/.numbus-server/chowned.true
templates/nix-config/misc/networking.nix
+7 -17
View File
@@ -6,14 +6,18 @@
networking.wireless.enable = false;
networking.networkmanager.enable = false;
services.resolved.enable = false;
networking.nftables.enable = true;
networking.firewall.enable = true;
# Allow rootless containers to bind to port 53 and up
boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 53;
# Bridge configuration for VMs
networking.bridges.br0.interfaces = [ "TARGET_INTERFACE" ];
networking.interfaces.br0.useDHCP = false;
networking.nameservers = [ "HOME_SERVER_IP" "9.9.9.9" ];
networking.nameservers = [ "127.0.0.1" "9.9.9.9" ];
networking.interfaces.br0.ipv4.addresses = [{
address = "HOME_SERVER_IP";
prefixLength = 24;
@@ -23,22 +27,8 @@
interface = "br0";
};
networking.nftables.tables.nat = {
family = "ip";
content = ''
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
iifname "br0" tcp dport 80 redirect to :8080
iifname "br0" tcp dport 443 redirect to :8443
iifname "br0" tcp dport 53 redirect to :5353
iifname "br0" udp dport 53 redirect to :5353
iifname "br0" udp dport 67 redirect to :6767
}
'';
};
# Open ports in the firewall
networking.firewall.allowPing = true;
networking.firewall.allowedTCPPorts = [ 5353 8080 8443 ];
networking.firewall.allowedUDPPorts = [ 5353 6767 ];
networking.firewall.allowedTCPPorts = [ 53 80 443 ];
networking.firewall.allowedUDPPorts = [ 53 443 ];
}
templates/nix-config/podman/frigate.nix
+1 -2
View File
@@ -71,9 +71,8 @@ in
# Take it down gracefully
ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
Restart = "on-failure";
RestartSec = "10m";
RestartSec = "5m";
StartLimitBurst = "3";
StartLimitIntervalSec = "30s";
};
};
};
templates/nix-config/podman/gitea.nix
+1 -2
View File
@@ -84,9 +84,8 @@ in
# Take it down gracefully
ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
Restart = "on-failure";
RestartSec = "10m";
RestartSec = "5m";
StartLimitBurst = "3";
StartLimitIntervalSec = "30s";
};
};
};
templates/nix-config/podman/home-assistant.nix
+1 -2
View File
@@ -70,9 +70,8 @@ in
# Take it down gracefully
ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
Restart = "on-failure";
RestartSec = "10m";
RestartSec = "5m";
StartLimitBurst = "3";
StartLimitIntervalSec = "30s";
};
};
};
templates/nix-config/podman/immich.nix
+1 -2
View File
@@ -107,9 +107,8 @@ in
# Take it down gracefully
ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
Restart = "on-failure";
RestartSec = "10m";
RestartSec = "5m";
StartLimitBurst = "3";
StartLimitIntervalSec = "30s";
};
};
};
templates/nix-config/podman/it-tools.nix
+1 -2
View File
@@ -50,9 +50,8 @@ in
# Take it down gracefully
ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
Restart = "on-failure";
RestartSec = "10m";
RestartSec = "5m";
StartLimitBurst = "3";
StartLimitIntervalSec = "30s";
};
};
};
templates/nix-config/podman/nextcloud.nix
+3 -4
View File
@@ -15,7 +15,7 @@ in
''
services:
nextcloud-aio-mastercontainer:
image: nextcloud/all-in-one:latest
image: ghcr.io/nextcloud-releases/all-in-one:latest
container_name: nextcloud-aio-mastercontainer
networks:
nextcloud-aio:
@@ -32,9 +32,9 @@ in
NEXTCLOUD_UPLOAD_LIMIT: 16G
NEXTCLOUD_MAX_TIME: 3600
NEXTCLOUD_MEMORY_LIMIT: 2048M
SKIP_DOMAIN_VALIDATION: true
NEXTCLOUD_ADDITIONAL_APKS: imagemagick
NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS: imagick
WATCHTOWER_DOCKER_SOCKET_PATH: /run/user/1000/podman/podman.sock
labels:
- traefik.enable=true
- traefik.http.services.nextcloud-aio.loadbalancer.server.port=8080
@@ -73,9 +73,8 @@ in
# Take it down gracefully
ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
Restart = "on-failure";
RestartSec = "10m";
RestartSec = "5m";
StartLimitBurst = "3";
StartLimitIntervalSec = "30s";
};
};
};
templates/nix-config/podman/passbolt.nix
+1 -2
View File
@@ -102,9 +102,8 @@ in
# Take it down gracefully
ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
Restart = "on-failure";
RestartSec = "10m";
RestartSec = "5m";
StartLimitBurst = "3";
StartLimitIntervalSec = "30s";
};
};
};
templates/nix-config/podman/pi-hole.nix
+25 -20
View File
@@ -2,8 +2,8 @@
let
container_name = "pi-hole";
compose_file = "podman/pihole/compose.yaml";
config_dir = "/mnt/config/pihole";
compose_file = "podman/pi-hole/compose.yaml";
config_dir = "/mnt/config/pi-hole";
in
{
@@ -18,7 +18,7 @@ in
image: pihole/pihole:latest
container_name: pi-hole
networks:
pihole_frontend:
pi-hole_frontend:
ports:
# DNS Ports
- "53:53/tcp"
@@ -26,30 +26,35 @@ in
environment:
TZ: $TZ
FTLCONF_webserver_api_password: $FTLCONF_webserver_api_password
FTLCONF_dns_listeningMode: all
FTLCONF_dns_listeningMode: "all"
FTLCONF_dns_revServers: true,$HOME_ROUTER_SUBNET,$HOME_ROUTER_IP,home
FTLCONF_dns_domain_name: home
FTLCONF_dns_domain_local: true
FTLCONF_dns_domain_name: "home"
FTLCONF_dns_domain_local: "true"
FTLCONF_dns_hosts: |
$HOME_SERVER_IP dns.$DOMAIN_NAME
$HOME_SERVER_IP reverse.$DOMAIN_NAME
$HOME_SERVER_IP frigate.$DOMAIN_NAME
$HOME_SERVER_IP gitea.$DOMAIN_NAME
$HOME_SERVER_IP home-assistant.$DOMAIN_NAME
$HOME_SERVER_IP immich.$DOMAIN_NAME
$HOME_SERVER_IP it-tools.$DOMAIN_NAME
$HOME_SERVER_IP nextcloud.$DOMAIN_NAME
$HOME_SERVER_IP nextcloud-aio.$DOMAIN_NAME
$HOME_SERVER_IP hass.$DOMAIN_NAME
$HOME_SERVER_IP passbolt.$DOMAIN_NAME
FTLCONF_dhcp_active: false
FTLCONF_dns_upstreams: 9.9.9.11;149.112.112.11
PIHOLE_UID: 1000
PIHOLE_GID: 1000
$HOME_SERVER_IP pi-hole.$DOMAIN_NAME
$HOME_SERVER_IP traefik.$DOMAIN_NAME
FTLCONF_dhcp_active: "false"
FTLCONF_dns_upstreams: 9.9.9.9;149.112.112.112
FTLCONF_ntp_ipv4_active: "false"
FTLCONF_ntp_ipv6_active: "false"
FTLCONF_ntp_sync_active: "false"
volumes:
- ${config_dir}:/etc/pihole
cap_add:
- SYS_TIME
- NET_ADMIN
- SYS_NICE
labels:
- traefik.enable=true
- traefik.http.services.pihole.loadbalancer.server.port=443
- traefik.http.services.pihole.loadbalancer.server.scheme=https
- traefik.http.services.pihole.loadbalancer.server.port=80
- traefik.http.services.pihole.loadbalancer.server.scheme=http
- traefik.http.routers.pihole-https.entrypoints=websecure
- traefik.http.routers.pihole-https.rule=Host(`pi-hole.$DOMAIN_NAME`)
- traefik.http.routers.pihole-https.tls=true
@@ -57,7 +62,7 @@ in
restart: unless-stopped
networks:
pihole_frontend:
pi-hole_frontend:
external: true
'';
systemd.services.${container_name} = {
@@ -70,6 +75,8 @@ in
serviceConfig = {
User = "numbus-admin";
Environment = [ "XDG_RUNTIME_DIR=/run/user/1000" ];
AmbientCapabilities = "CAP_NET_ADMIN CAP_SYS_NICE";
LimitNICE = -20;
Type = "exec";
# Pull the latest image before running
ExecStartPre = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} pull";
@@ -78,11 +85,9 @@ in
# Take it down gracefully
ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
Restart = "on-failure";
RestartSec = "10m";
RestartSec = "5m";
StartLimitBurst = "3";
StartLimitIntervalSec = "30s";
};
};
};
}
templates/nix-config/podman/traefik.nix
+3 -4
View File
@@ -20,8 +20,8 @@ in
networks:
TRAEFIK_NETWORKS
ports:
- 8080:80
- 8443:443
- "80:80"
- "443:443"
volumes:
- /run/user/1000/podman/podman.sock:/run/docker.sock:ro
- ${config_dir}/rules/:/etc/traefik/conf/:ro
@@ -59,9 +59,8 @@ TRAEFIK_REF_NETWORKS
# Take it down gracefully
ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
Restart = "on-failure";
RestartSec = "10m";
RestartSec = "5m";
StartLimitBurst = "3";
StartLimitIntervalSec = "30s";
};
};
};