Created a helper to create the container configurations. Updated all containers files to use it.

modules/global.nix

@@ -9,7 +9,7 @@ with lib;
       domain = mkOption {
         type = types.str;
         example = "numbus.eu";
-        description = "The root domain name (e.g., example.com) that your services will use";
+        description = "The root domain name (i.e. example.com) that your services will use";
       };
       dns = mkOption {
       type = types.enum [ "pi-hole" "adguard" ];
@@ -22,7 +22,7 @@ with lib;
       type = types.str;
       default = "/etc/traefik/rules";
       example = "/etc/traefik/rules";
-      description = "! Choose a directory outside of /etc/ will break things ! The directory where Traefik's dynamic configuration files will be stored";
+      description = "! Choosing a directory outside of /etc/ will break things ! The directory where Traefik's dynamic configuration files will be stored";
     };
 
     email = {

modules/services/frigate.nix

@@ -3,63 +3,33 @@
 with lib;
 
 let
+  helper = import ./lib.nix { inherit config pkgs lib; };
   cfg = config.numbus.services.frigate;
-  containerName = "frigate";
-  pod = "home-assistant";
-  composeFile = "podman/frigate/compose.yaml";
 in
 
-{
+helper.mkPodmanService {
-  options.numbus.services.frigate = {
+  name = "frigate";
-    enable = mkEnableOption "Frigate fully-local NVR (Network Video Recorder)";
+  description = "Frigate, your fully-local NVR (Network Video Recorder)";
-
+  defaultPort = "8971";
-    configDir = mkOption {
+  pod = "home-assistant";
-      type = types.str;
+  scheme = "https";
-      default = "/mnt/config/frigate";
+  dependencies = [ "traefik.service" "${config.numbus.services.dns}.service" "home-assistant.service" ];
-      example = "/mnt/config/frigate";
-      description = "The directory where Frigate's configuration files will be stored";
-    };
-
-    dataDir = mkOption {
-      type = types.str;
-      default = "/mnt/data/frigate";
-      example = "/mnt/data/frigate";
-      description = "The directory where Frigate's data (i.e. clips, recordings, exports) will be stored";
-    };
-
-    subdomain = mkOption {
-      type = types.str;
-      default = "frigate";
-      example = "frigate";
-      description = "The subdomain that Frigate will use (i.e. your-subdomain.your-domain.com)";
-    };
 
+  extraOptions = {
     devices = mkOption {
       type = types.listOf types.str;
       default = [];
       example = [ "/dev/dri:/dev/dri" "/dev/bus/usb:/dev/bus/usb" "/dev/apex_0:/dev/apex_0" ];
       description = "List of devices to map into the container. /dev/dri is used for graphics acceleration, /dev/bus/usb for USB Coral TPUs, and /dev/apex_0 for PCI coral TPUs";
     };
-
-    port = mkOption {
-      type = types.str;
-      default = "8971";
-      example = "8971";
-      description = "The port that Frigate will use. Be careful, do not use a port already in use such as 80 or 443";
-    };
   };
 
-  config = mkIf cfg.enable {
+  composeText = ''
-    environment.etc."${composeFile}".text =
-      /*
-      yaml
-      */
-      ''
     services:
-          ${containerName}:
+      frigate:
         image: ghcr.io/blakeblackshear/frigate:stable
-            container_name: ${containerName}
+        container_name: frigate
-            hostname: ${containerName}
+        hostname: frigate
         shm_size: "256mb"
         networks:
           home-assistant_frontend:
@@ -89,68 +59,4 @@ ${lib.concatStringsSep "\n" (map (d: "              - \"${d}\"") cfg.devices)}
       home-assistant_frontend:
         external: true
   '';
-
-    environment.etc."${config.numbus.services.traefikDynamicConfigDir}/frigate.yaml".text =
-      /*
-      yaml
-      */
-      ''
-        http:
-          routers:
-            ${containerName}:
-              rule: "Host(`${cfg.subdomain}.${config.numbus.services.domain}`)"
-              entrypoints:
-                - "websecure"
-              service: ${containerName}
-              middlewares:
-                - secureHeaders
-              tls:
-                certresolver: "cloudflare"
-                options: "secureTLS"
-          services:
-            ${containerName}:
-              loadBalancer:
-                servers:
-                  - url: "https://host.containers.internal:${cfg.port}"
-      '';
-
-    systemd.services."${containerName}" = {
-      description = "Podman container : ${containerName}";
-      requires = [ "traefik.service" "home-assistant.service" "${config.numbus.services.dns}.service" ];
-      after = [ "traefik.service" "home-assistant.service" "${config.numbus.services.dns}.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.podman pkgs.podman-compose pkgs.coreutils pkgs.sudo ];
-      serviceConfig = {
-        Type = "exec";
-        ExecStartPre = "bash -c 'sleep $((RANDOM % 180))'";
-        ExecStart = "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} up --remove-orphans";
-        ExecStop = "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} down";
-        Restart = "on-failure";
-        RestartSec = "1m";
-        StartLimitBurst = "5";
-      };
-    };
-
-    systemd.services."update-${containerName}" = {
-      description = "Update ${containerName} container";
-      path = [ pkgs.podman pkgs.podman-compose pkgs.sudo ];
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = [
-          "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} pull"
-          "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} down"
-          "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} up -d"
-        ];
-      };
-    };
-
-    systemd.timers."update-${containerName}" = {
-      timerConfig = {
-        OnCalendar = "02:00";
-        RandomizedDelaySec = "60m";
-        Unit = "update-${containerName}.service";
-      };
-      wantedBy = [ "timers.target" ];
-    };
-  };
 }

modules/services/gitea.nix

@@ -1,19 +1,20 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
+
+with lib;
 
 let
-  containerName = "gitea";
+  helper = import ./lib.nix { inherit config pkgs lib; };
-  composeFile = "podman/gitea/compose.yaml";
+  cfg = config.numbus.services.gitea;
-  configDir = "/mnt/config/gitea";
-  dataDir = "gitea_data";
 in
 
-{
+helper.mkPodmanService {
-  config = {
+  name = "gitea";
-    environment.etc."${compose_file}".text =
+  description = "Gitea, your own self-hosted git platform";
-      /*
+  defaultPort = "3000";
-      yaml
+  pod = "gitea";
-      */
+  dependencies = [ "traefik.service" "${config.numbus.services.dns}.service" ];
-      ''
+
+  composeText = ''
     services:
       gitea-server:
         image: docker.gitea.com/gitea:latest-rootless
@@ -23,10 +24,10 @@ in
           gitea_frontend:
           gitea_backend:
         ports:
-              - "3000:3000/tcp" #http
+          - "${cfg.port}:3000/tcp"
         volumes:
-              - gitea_data:/var/lib/gitea
+          - ${cfg.dataDir}:/var/lib/gitea
-              - ${configDir}:/etc/gitea
+          - ${cfg.configDir}:/etc/gitea
           - /etc/localtime:/etc/localtime:ro
         environment:
           - GITEA__database__DB_TYPE=postgres
@@ -35,7 +36,7 @@ in
           - GITEA__database__USER=$DB_USERNAME
           - GITEA__database__PASSWD=$DB_PASSWORD
           - GITEA__server__SSH_PORT=2424
-              - GITEA__server__ROOT_URL=gitea.$DOMAIN_NAME
+          - GITEA__server__ROOT_URL=${cfg.subdomain}.${config.numbus.services.domain}
         depends_on:
           - gitea-database
         restart: unless-stopped
@@ -55,7 +56,6 @@ in
         restart: unless-stopped
 
     volumes:
-          gitea_data:
       gitea_database:
 
     networks:
@@ -74,46 +74,4 @@ in
             - subnet: "10.89.4.0/24"
               gateway: "10.89.4.254"
   '';
-
-    systemd.services."${container_name}" = {
-      description = "Podman container : ${container_name}";
-      after = [ "network.target" "traefik.service" "pi-hole.service" ];
-      requires = [ "traefik.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.podman pkgs.coreutils ];
-
-      serviceConfig = {
-        User = "numbus-admin";
-        Environment = [ "XDG_RUNTIME_DIR=/run/user/1000" ];
-        Type = "exec";
-        TimeoutStartSec = "900";
-        ExecStartPre = [
-          "${pkgs.bash}/bin/bash -c 'sleep $((RANDOM % 400))'"
-          "-${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} pull"
-        ];
-        ExecStart = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} up --remove-orphans";
-        ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
-        Restart = "on-failure";
-        RestartSec = "5m";
-        StartLimitBurst = "3";
-      };
-    };
-
-    systemd.services."update-${container_name}" = {
-      description = "Update ${container_name} container";
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = "${pkgs.systemd}/bin/systemctl restart ${container_name}.service";
-      };
-    };
-
-    systemd.timers."update-${container_name}" = {
-      timerConfig = {
-        OnCalendar = "02:00";
-        RandomizedDelaySec = "60m";
-        Unit = "update-${container_name}.service";
-      };
-      wantedBy = [ "timers.target" ];
-    };
-  };
 }

modules/services/home-assistant.nix

@@ -1,83 +1,73 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
+
+with lib;
 
 let
-  container_name = "home-assistant";
+  helper = import ./lib.nix { inherit config pkgs lib; };
-  compose_file = "podman/home-assistant/compose.yaml";
+  cfg = config.numbus.services.home-assistant;
-  config_dir_1 = "/mnt/config/home-assistant";
-  config_dir_2 = "/mnt/config/mqtt";
 in
 
-{
+helper.mkPodmanService {
-  config = {
+  name = "home-assistant";
-    environment.etc."${compose_file}".text =
+  description = "Home Assistant, libre house control and much more";
-      /*
+  defaultPort = "8123";
-      yaml
+  pod = "home-assistant";
-      */
+  dependencies = [ "traefik.service" "${config.numbus.services.dns}.service" ];
-      ''
+
+  extraOptions = {
+    devices = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      example = [ "/dev/serial/by-id/Sonoff_Zigbee_3.0-id-port0:/dev/ttyUSB0" ];
+      description = "List of devices to map into the container. /dev/ttyUSB0 is used for Zigbee dongles";
+    };
+  };
+
+  composeText = ''
     services:
       home-assistant:
         image: ghcr.io/home-assistant/home-assistant:latest
         container_name: home-assistant
+        hostname: home-assistant
         networks:
           home-assistant_frontend:
           home-assistant_backend:
+        ports:
+          - "${cfg.port}:8123/tcp"
         volumes:
-              - ${config_dir_1}:/config
+          - ${cfg.configDir}:/config
           - /etc/localtime:/etc/localtime:ro
           - /run/dbus:/run/dbus:ro
-            # --- home-assistant devices --- #
+${lib.optionalString (cfg.devices != []) ''
-            labels:
+        devices:
-              - traefik.enable=true
+${lib.concatStringsSep "\n" (map (d: "        - \"${d}\"") cfg.devices)}
-              - traefik.docker.network=home-assistant_frontend
+''}
-              - traefik.http.services.home-assistant.loadbalancer.server.port=8123
-              - traefik.http.services.home-assistant.loadbalancer.server.scheme=http
-              - traefik.http.routers.home-assistant-https.entrypoints=websecure
-              - traefik.http.routers.home-assistant-https.rule=Host(`home-assistant.$DOMAIN_NAME`)
-              - traefik.http.routers.home-assistant-https.tls=true
-              - traefik.http.routers.home-assistant-https.tls.certresolver=cloudflare
         restart: unless-stopped
 
-          frigate-mqtt:
+      home-assistant-mqtt:
-            image: eclipse-mosquitto
+        image: docker.io/library/eclipse-mosquitto:latest
-            container_name: mqtt
+        container_name: home-assistant-mqtt
-            user: 1000:1000
+        hostname: home-assistant-mqtt
         networks:
           home-assistant_backend:
         volumes:
-                - ${config_dir_2}:/mosquitto
+          - /mnt/config/mosquitto:/mosquitto
         restart: unless-stopped
 
     networks:
-          home-assistant_backend:
-            external: true
       home-assistant_frontend:
-            external: true
+        name: home-assistant_frontend
+        driver: bridge
+        ipam:
+          config:
+            - subnet: "10.89.5.0/24"
+              gateway: "10.89.5.254"
+      home-assistant_backend:
+        name: home-assistant_backend
+        driver: bridge
+        ipam:
+          config:
+            - subnet: "10.89.6.0/24"
+              gateway: "10.89.6.254"
   '';
-    systemd.services.${container_name} = {
-      description = "Podman container : ${container_name}";
-      after = [ "network.target" "traefik.service" "pi-hole.service" ];
-      requires = [ "traefik.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.podman pkgs.coreutils ];
-
-      serviceConfig = {
-        User = "numbus-admin";
-        Environment = [ "XDG_RUNTIME_DIR=/run/user/1000" ];
-        Type = "exec";
-        TimeoutStartSec = "600";
-        # Pull the latest image before running
-        ExecStartPre = [
-          "${pkgs.coreutils}/bin/sleep 180"
-          "-${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} pull"
-        ];
-        # Bring the service up
-        ExecStart = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} up --remove-orphans";
-        # Take it down gracefully
-        ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
-        Restart = "on-failure";
-        RestartSec = "5m";
-        StartLimitBurst = "3";
-      };
-    };
-  };
 }

modules/services/immich.nix

@@ -1,134 +1,118 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
+
+with lib;
 
 let
-  container_name = "immich";
+  helper = import ./lib.nix { inherit config pkgs lib; };
-  compose_file = "podman/immich/compose.yaml";
+  cfg = config.numbus.services.immich;
-  config_dir = "/mnt/config/immich";
-  data_dir = "/mnt/data/immich";
 in
 
-{
+helper.mkPodmanService {
-  config = {
+  name = "immich";
-    environment.etc."${compose_file}".text =
+  description = "Immich, Google Photos but better";
-      /*
+  defaultPort = "2283";
-      yaml
+  pod = "immich";
-      */
+  dependencies = [ "traefik.service" "${config.numbus.services.dns}.service" ];
-      ''
+
+  composeText = ''
     services:
       immich-server:
-            image: ghcr.io/immich-app/immich-server:$IMMICH_VERSION
+        image: ghcr.io/immich-app/immich-server:latest
         container_name: immich-server
+        hostname: immich-server
+        user: '1000:1000'
         networks:
           immich_frontend:
           immich_backend:
+        ports:
+          - "${cfg.port}:2283/tcp" #http
         volumes:
-              - $UPLOAD_LOCATION:/data
+          - ${cfg.dataDir}:/data
           - /etc/localtime:/etc/localtime:ro
-            # --- immich devices --- #
-            labels:
-              - traefik.enable=true
-              - traefik.docker.network=immich_frontend
-              - traefik.http.services.immich.loadbalancer.server.port=2283
-              - traefik.http.services.immich.loadbalancer.server.scheme=http
-              - traefik.http.routers.immich-https.entrypoints=websecure
-              - traefik.http.routers.immich-https.rule=Host(`immich.$DOMAIN_NAME`)
-              - traefik.http.routers.immich-https.tls=true
-              - traefik.http.routers.immich-https.tls.certresolver=cloudflare
         env_file:
           - .env
         depends_on:
           - immich-redis
           - immich-database
-            restart: always
         healthcheck:
           disable: false
+        security_opt:
+          - no-new-privileges:true
+        cap_drop:
+          - NET_RAW
+        restart: unless-stopped
 
       immich-machine-learning:
+        image: ghcr.io/immich-app/immich-machine-learning:latest
         container_name: immich-machine-learning
-            image: ghcr.io/immich-app/immich-machine-learning:$IMMICH_VERSION
+        hostname: immich-machine-learning
+        user: '1000:1000'
         networks:
           immich_backend:
         volumes:
-              - ${config_dir}/models:/cache
+          - ${cfg.configDir}/machine-learning:/cache
         env_file:
           - .env
-            restart: always
         healthcheck:
           disable: false
+        security_opt:
+          - no-new-privileges:true
+        cap_drop:
+          - NET_RAW
+        restart: unless-stopped
 
       immich-redis:
+        image: docker.io/valkey/valkey:8-bookworm
         container_name: immich-redis
-            image: docker.io/valkey/valkey:8-bookworm@sha256:a137a2b60aca1a75130022d6bb96af423fefae4eb55faf395732db3544803280
+        hostname: immich-redis
+        user: '1000:1000'
         networks:
           immich_backend:
         healthcheck:
           test: redis-cli ping || exit 1
-            restart: always
+        security_opt:
+          - no-new-privileges:true
+        cap_drop:
+          - NET_RAW
+        restart: unless-stopped
 
       immich-database:
+        image: ghcr.io/immich-app/postgres:14
         container_name: immich-database
-            image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:32324a2f41df5de9efe1af166b7008c3f55646f8d0e00d9550c16c9822366b4a
+        hostname: immich-database
+        user: '1000:1000'
         networks:
           immich_backend:
         shm_size: 128mb
         volumes:
-              # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
+          - ${cfg.configDir}/database:/var/lib/postgresql/data
-              - $DB_DATA_LOCATION:/var/lib/postgresql/data
         environment:
           POSTGRES_PASSWORD: $DB_PASSWORD
           POSTGRES_USER: $DB_USERNAME
           POSTGRES_DB: $DB_DATABASE_NAME
           POSTGRES_INITDB_ARGS: '--data-checksums'
-            restart: always
         healthcheck:
           disable: false
+        security_opt:
+          - no-new-privileges:true
+        cap_drop:
+          - NET_RAW
+        restart: unless-stopped
 
     networks:
-          immich_backend:
-            external: true
       immich_frontend:
-            external: true
+        name: immich_frontend
+        driver: bridge
+        ipam:
+          config:
+            - subnet: "10.89.7.0/24"
+              gateway: "10.89.7.254"
+      immich_backend:
+        name: immich_backend
+        driver: bridge
+        ipam:
+          config:
+            - subnet: "10.89.8.0/24"
+              gateway: "10.89.8.254"
   '';
-
-    systemd.services."${container_name}" = {
-      description = "Podman container : ${container_name}";
-      after = [ "network.target" "traefik.service" "pi-hole.service" ];
-      requires = [ "traefik.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.podman pkgs.coreutils ];
-
-      serviceConfig = {
-        User = "numbus-admin";
-        Environment = [ "XDG_RUNTIME_DIR=/run/user/1000" ];
-        Type = "exec";
-        TimeoutStartSec = "900";
-        ExecStartPre = [
-          "${pkgs.bash}/bin/bash -c 'sleep $((RANDOM % 400))'"
-          "-${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} pull"
-        ];
-        ExecStart = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} up --remove-orphans";
-        ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
-        Restart = "on-failure";
-        RestartSec = "5m";
-        StartLimitBurst = "3";
-      };
-    };
-
-    systemd.services."update-${container_name}" = {
-      description = "Update ${container_name} container";
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = "${pkgs.systemd}/bin/systemctl restart ${container_name}.service";
-      };
-    };
-
-    systemd.timers."update-${container_name}" = {
-      timerConfig = {
-        OnCalendar = "02:00";
-        RandomizedDelaySec = "60m";
-        Unit = "update-${container_name}.service";
-      };
-      wantedBy = [ "timers.target" ];
-    };
-  };
 }

modules/services/it-tools.nix

@@ -1,77 +1,37 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
+
+with lib;
 
 let
-  container_name = "it-tools";
+  helper = import ./lib.nix { inherit config pkgs lib; };
-  compose_file = "podman/it-tools/compose.yaml";
+  cfg = config.numbus.services.it-tools;
 in
 
-{
+helper.mkPodmanService {
-  config = {
+  name = "it-tools";
-    environment.etc."${compose_file}".text =
+  description = "Immich, Google Photos but better";
-      /*
+  defaultPort = "8880";
-      yaml
+  pod = "false";
-      */
+
-      ''
+  composeText = ''
     services:
       it-tools:
+        image: docker.io/corentinth/it-tools:latest
         container_name: it-tools
-            image: corentinth/it-tools
+        hostname: it-tools
         networks:
           it-tools_frontend:
-            labels:
+        ports:
-              - traefik.enable=true
+          - "${cfg.port}:80/tcp"
-              - traefik.docker.network=it-tools_frontend
-              - traefik.http.services.it-tools.loadbalancer.server.port=80
-              - traefik.http.services.it-tools.loadbalancer.server.scheme=http
-              - traefik.http.routers.it-tools-https.entrypoints=websecure
-              - traefik.http.routers.it-tools-https.rule=Host(`it-tools.$DOMAIN_NAME`)
-              - traefik.http.routers.it-tools-https.tls=true
-              - traefik.http.routers.it-tools-https.tls.certresolver=cloudflare
         restart: unless-stopped
+
     networks:
       it-tools_frontend:
-            external: true
+        name: it-tools_frontend
+        driver: bridge
+        ipam:
+          config:
+            - subnet: "10.89.9.0/24"
+              gateway: "10.89.9.254"
   '';
-
-    systemd.services."${container_name}" = {
-      description = "Podman container : ${container_name}";
-      after = [ "network.target" "traefik.service" "pi-hole.service" ];
-      requires = [ "traefik.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.podman pkgs.coreutils ];
-
-      serviceConfig = {
-        User = "numbus-admin";
-        Environment = [ "XDG_RUNTIME_DIR=/run/user/1000" ];
-        Type = "exec";
-        TimeoutStartSec = "600";
-        ExecStartPre = [
-          "${pkgs.bash}/bin/bash -c 'sleep $((RANDOM % 180))'"
-          "-${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} pull"
-        ];
-        ExecStart = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} up --remove-orphans";
-        ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
-        Restart = "on-failure";
-        RestartSec = "5m";
-        StartLimitBurst = "3";
-      };
-    };
-
-    systemd.services."update-${container_name}" = {
-      description = "Update ${container_name} container";
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = "${pkgs.systemd}/bin/systemctl restart ${container_name}.service";
-      };
-    };
-
-    systemd.timers."update-${container_name}" = {
-      timerConfig = {
-        OnCalendar = "02:00";
-        RandomizedDelaySec = "60m";
-        Unit = "update-${container_name}.service";
-      };
-      wantedBy = [ "timers.target" ];
-    };
-  };
 }

modules/services/lib.nix

@@ -0,0 +1,134 @@
+{ lib, config, pkgs }:
+
+with lib;
+
+{
+  mkPodmanService = {
+    name,
+    description,
+    defaultPort ? "0",
+    defaultSubdomain ? name,
+    pod ? name,
+    reverseProxied ? true,
+    composeFile ? "podman/${name}/compose.yaml",
+    composeText,
+    scheme ? "http",
+    middlewares ? [ "secureHeaders" ],
+    dependencies ? [],
+    extraOptions ? {},
+    extraConfig ? {},
+    configDir ? true,
+    dataDir ? true,
+    delaySec ? 180
+  }:
+  let
+    cfg = config.numbus.services.${name};
+    Deps = dependencies;
+  in
+  {
+    options.numbus.services.${name} = recursiveUpdate ({
+      enable = mkEnableOption description;
+
+      subdomain = mkOption {
+        type = types.str;
+        default = defaultSubdomain;
+        example = defaultSubdomain;
+        description = "The subdomain that ${name} will use";
+      };
+
+      port = mkOption {
+        type = types.str;
+        default = defaultPort;
+        example = defaultPort;
+        description = "The port that ${name} will use.";
+      };
+
+      reverseProxied = mkOption {
+        type = types.bool;
+        default = reverseProxied;
+        description = "Whether to create a Traefik reverse proxy configuration for this service.";
+      };
+    } // (optionalAttrs configDir {
+      configDir = mkOption {
+        type = types.str;
+        default = "/mnt/config/${name}";
+        example = "/mnt/config/${name}";
+        description = "The directory where ${name}'s configuration files will be stored";
+      };
+    }) // (optionalAttrs dataDir {
+      dataDir = mkOption {
+        type = types.str;
+        default = "/mnt/data/${name}";
+        example = "/mnt/data/${name}";
+        description = "The directory where ${name}'s data will be stored";
+      };
+    })) extraOptions;
+
+    config = mkIf cfg.enable (mkMerge [
+      {
+        environment.etc."${composeFile}".text = composeText;
+
+        environment.etc."${config.numbus.traefikDynamicConfigDir}/${name}.yaml" = mkIf cfg.reverseProxied {
+          text = ''
+          http:
+            routers:
+              ${name}:
+                rule: "Host(`${cfg.subdomain}.${config.numbus.services.domain}`)"
+                entrypoints:
+                  - "websecure"
+                service: ${name}
+                middlewares:
+${concatStringsSep "\n" (map (m: "                  - ${m}") middlewares)}
+                tls:
+                  certresolver: "cloudflare"
+                  options: "secureTLS"
+            services:
+              ${name}:
+                loadBalancer:
+                  servers:
+                    - url: "${scheme}://host.containers.internal:${cfg.port}"
+          '';
+        };
+
+        systemd.services."${name}" = {
+          description = "Podman container : ${name}";
+          requires = Deps;
+          after = Deps;
+          wantedBy = [ "multi-user.target" ];
+          path = [ pkgs.podman pkgs.podman-compose pkgs.coreutils pkgs.sudo ];
+          serviceConfig = {
+            Type = "exec";
+            ExecStartPre = "bash -c 'sleep $((RANDOM % ${delaySec}))'";
+            ExecStart = "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} up --remove-orphans";
+            ExecStop = "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} down";
+            Restart = "on-failure";
+            RestartSec = "1m";
+            StartLimitBurst = "5";
+          };
+        };
+
+        systemd.services."update-${name}" = {
+          description = "Update ${name} container";
+          path = [ pkgs.podman pkgs.podman-compose pkgs.sudo pkgs.systemd ];
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStart = [
+              "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} pull"
+              "${pkgs.systemd}/bin/systemctl restart ${name}.service"
+            ];
+          };
+        };
+
+        systemd.timers."update-${name}" = {
+          timerConfig = {
+            OnCalendar = "02:00";
+            RandomizedDelaySec = "60m";
+            Unit = "update-${name}.service";
+          };
+          wantedBy = [ "timers.target" ];
+        };
+      }
+      extraConfig
+    ]);
+  };
+}

modules/services/passbolt.nix

@@ -1,30 +1,37 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
+
+with lib;
 
 let
-  container_name = "passbolt";
+  helper = import ./lib.nix { inherit config pkgs lib; };
-  compose_file = "podman/passbolt/compose.yaml";
+  cfg = config.numbus.services.passbolt;
 in
 
-{
+helper.mkPodmanService {
-  config = {
+  name = "passbolt";
-    environment.etc."${compose_file}".text =
+  description = "Passbolt, your password manager";
-      /*
+  defaultPort = "4433";
-      yaml
+  pod = "passbolt";
-      */
+  scheme = "https";
-      ''
+  dependencies = [ "traefik.service" "${config.numbus.services.dns}.service" ];
+
+  composeText = ''
     services:
-          passbolt:
+      passbolt-server:
-            image: passbolt/passbolt:latest-ce-non-root
+        image: docker.io/passbolt/passbolt:latest-ce-non-root
-            container_name: passbolt
+        container_name: passbolt-server
+        hostname: passbolt-server
         networks:
           passbolt_frontend:
           passbolt_backend:
+        ports:
+          - "${cfg.port}:4433/tcp"
         volumes:
           - passbolt-gpg:/etc/passbolt/gpg
           - passbolt-jwt:/etc/passbolt/jwt
         environment:
           APP_DEFAULT_TIMEZONE: $TZ
-              APP_FULL_BASE_URL: https://passbolt.$DOMAIN_NAME
+          APP_FULL_BASE_URL: https://${cfg.subdomain}.${config.numbus.services.domain}
           DATASOURCES_DEFAULT_HOST: "passbolt-database"
           DATASOURCES_DEFAULT_USERNAME: $PASSBOLT_MYSQL_USER
           DATASOURCES_DEFAULT_PASSWORD: $PASSBOLT_MYSQL_PASSWORD
@@ -37,15 +44,6 @@ in
           EMAIL_TRANSPORT_DEFAULT_TLS: true
           EMAIL_DEFAULT_FROM: $EMAIL_ADDRESS
           PASSBOLT_SSL_FORCE: true
-            labels:
-              - traefik.enable=true
-              - traefik.docker.network=passbolt_frontend
-              - traefik.http.services.passbolt.loadbalancer.server.port=4433
-              - traefik.http.services.passbolt.loadbalancer.server.scheme=https
-              - traefik.http.routers.passbolt-https.entrypoints=websecure
-              - traefik.http.routers.passbolt-https.rule=Host(`passbolt.$DOMAIN_NAME`)
-              - traefik.http.routers.passbolt-https.tls=true
-              - traefik.http.routers.passbolt-https.tls.certresolver=cloudflare
         command:
           [
             "/usr/bin/wait-for.sh",
@@ -57,11 +55,16 @@ in
           ]
         depends_on:
           - passbolt-database
+        security_opt:
+          - no-new-privileges:true
+        cap_drop:
+          - NET_RAW
         restart: unless-stopped
 
       passbolt-database:
-            image: mariadb:11.3
+        image: docker.io/library/mariadb:12.2
         container_name: passbolt-database
+        hostname: passbolt-database
         networks:
           passbolt_backend:
         volumes:
@@ -71,59 +74,31 @@ in
           MYSQL_DATABASE: $PASSBOLT_MYSQL_DATABASE
           MYSQL_USER: $PASSBOLT_MYSQL_USER
           MYSQL_PASSWORD: $PASSBOLT_MYSQL_PASSWORD
+        security_opt:
+          - no-new-privileges:true
+        cap_drop:
+          - NET_RAW
         restart: unless-stopped
 
-        networks:
-          passbolt_backend:
-            external: true
-          passbolt_frontend:
-            external: true
-
     volumes:
       passbolt-database:
       passbolt-gpg:
       passbolt-jwt:
+
+    networks:
+      passbolt_frontend:
+        name: passbolt_frontend
+        driver: bridge
+        ipam:
+          config:
+            - subnet: "10.89.12.0/24"
+              gateway: "10.89.12.254"
+      passbolt_backend:
+        name: passbolt_backend
+        driver: bridge
+        ipam:
+          config:
+            - subnet: "10.89.13.0/24"
+              gateway: "10.89.13.254"
   '';
-
-    systemd.services."${container_name}" = {
-      description = "Podman container : ${container_name}";
-      after = [ "network.target" "traefik.service" "pi-hole.service" ];
-      requires = [ "traefik.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.podman pkgs.coreutils ];
-
-      serviceConfig = {
-        User = "numbus-admin";
-        Environment = [ "XDG_RUNTIME_DIR=/run/user/1000" ];
-        Type = "exec";
-        TimeoutStartSec = "600";
-        ExecStartPre = [
-          "${pkgs.bash}/bin/bash -c 'sleep $((RANDOM % 180))'"
-          "-${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} pull"
-        ];
-        ExecStart = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} up --remove-orphans";
-        ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
-        Restart = "on-failure";
-        RestartSec = "5m";
-        StartLimitBurst = "3";
-      };
-    };
-
-    systemd.services."update-${container_name}" = {
-      description = "Update ${container_name} container";
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = "${pkgs.systemd}/bin/systemctl restart ${container_name}.service";
-      };
-    };
-
-    systemd.timers."update-${container_name}" = {
-      timerConfig = {
-        OnCalendar = "02:00";
-        RandomizedDelaySec = "60m";
-        Unit = "update-${container_name}.service";
-      };
-      wantedBy = [ "timers.target" ];
-    };
-  };
 }

modules/services/pi-hole.nix

@@ -1,106 +1,61 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
+
+with lib;
 
 let
-  container_name = "pi-hole";
+  helper = import ./lib.nix { inherit config pkgs lib; };
-  compose_file = "podman/pi-hole/compose.yaml";
+  cfg = config.numbus.services.pi-hole;
-  config_dir = "/mnt/config/pi-hole";
 in
 
-{
+helper.mkPodmanService {
-  config = {
+  name = "pi-hole";
-    environment.etc."${compose_file}".text =
+  description = "Pi-Hole, the ads black hole";
-      /*
+  defaultPort = "4443";
-      yaml
+  pod = "false";
-      */
+  scheme = "https";
-      ''
+  dependencies = [ "traefik.service" "${config.numbus.services.dns}.service" ];
+  delaySec = 10;
+
+  composeText = ''
     services:
-          pihole:
+      pi-hole:
         image: docker.io/pihole/pihole:latest
         container_name: pi-hole
-            networks:
+        hostname: pi-hole
-              pi-hole_frontend:
+        network_mode: pasta
         ports:
-              # DNS Ports
+          - "${cfg.port}:443/tcp"
           - "53:53/tcp"
           - "53:53/udp"
         environment:
+          PIHOLE_UID: '1000'
+          PIHOLE_GID: '1000'
           TZ: $TZ
           FTLCONF_webserver_api_password: $FTLCONF_webserver_api_password
-              FTLCONF_dns_hosts: |
+          FTLCONF_webserver_domain: ${cfg.subdomain}.${config.numbus.services.domain}
-                $HOME_SERVER_IP frigate.$DOMAIN_NAME
-                $HOME_SERVER_IP gitea.$DOMAIN_NAME
-                $HOME_SERVER_IP home-assistant.$DOMAIN_NAME
-                $HOME_SERVER_IP immich.$DOMAIN_NAME
-                $HOME_SERVER_IP it-tools.$DOMAIN_NAME
-                $HOME_SERVER_IP nextcloud.$DOMAIN_NAME
-                $HOME_SERVER_IP nextcloud-aio.$DOMAIN_NAME
-                $HOME_SERVER_IP passbolt.$DOMAIN_NAME
-                $HOME_SERVER_IP pi-hole.$DOMAIN_NAME
-                $HOME_SERVER_IP traefik.$DOMAIN_NAME
-              FTLCONF_dhcp_active: "false"
           FTLCONF_dns_upstreams: 9.9.9.9;149.112.112.112
+          FTLCONF_dns_hosts: |
+${lib.concatStringsSep "" (lib.mapAttrsToList (name: service:
+  if builtins.isAttrs service && service ? enable && service.enable && service ? subdomain then
+    "            $HOME_SERVER_IP ${service.subdomain}.${config.numbus.services.domain}\n"
+  else
+    ""
+) config.numbus.services)}
+    # TODO : get revServers to work
+    #      FTLCONF_dns_revServers: |
+    #        true,$HOME_ROUTER_SUBNET,$HOME_ROUTER_IP,${config.numbus.services.domain}
+    #        true,$HOME_VPN_SUBNET,$HOME_VPN_IP,${config.numbus.services.domain}
+          FTLCONF_dns_listeningMode: "BIND"
+          FTLCONF_dns_domain_name: "${config.numbus.services.domain}"
+          FTLCONF_dns_domain_local: "true"
+          FTLCONF_dhcp_active: "false"
           FTLCONF_ntp_ipv4_active: "false"
           FTLCONF_ntp_ipv6_active: "false"
           FTLCONF_ntp_sync_active: "false"
         volumes:
-              - ${config_dir}:/etc/pihole
+          - ${cfg.configDir}:/etc/pihole
         cap_add:
           - SYS_NICE
-            labels:
-              - traefik.enable=true
-              - traefik.docker.network=pi-hole_frontend
-              - traefik.http.services.pihole.loadbalancer.server.port=80
-              - traefik.http.services.pihole.loadbalancer.server.scheme=http
-              - traefik.http.routers.pihole-https.entrypoints=websecure
-              - traefik.http.routers.pihole-https.rule=Host(`pi-hole.$DOMAIN_NAME`)
-              - traefik.http.routers.pihole-https.tls=true
-              - traefik.http.routers.pihole-https.tls.certresolver=cloudflare
         restart: unless-stopped
-
-        networks:
-          pi-hole_frontend:
-            external: true
   '';
-
-    systemd.services."${container_name}" = {
-      description = "Podman container : ${container_name}";
-      after = [ "network.target" "traefik.service" ];
-      requires = [ "traefik.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.podman pkgs.coreutils ];
-
-      serviceConfig = {
-        User = "numbus-admin";
-        Environment = [ "XDG_RUNTIME_DIR=/run/user/1000" ];
-        Type = "exec";
-        TimeoutStartSec = "600";
-        ExecStartPre = [
-          "${pkgs.bash}/bin/bash -c 'sleep 20'"
-          "-${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} pull"
-        ];
-        ExecStart = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} up --remove-orphans";
-        ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
-        Restart = "on-failure";
-        RestartSec = "5m";
-        StartLimitBurst = "3";
-      };
-    };
-
-    systemd.services."update-${container_name}" = {
-      description = "Update ${container_name} container";
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = "${pkgs.systemd}/bin/systemctl restart ${container_name}.service";
-      };
-    };
-
-    systemd.timers."update-${container_name}" = {
-      timerConfig = {
-        OnCalendar = "02:00";
-        RandomizedDelaySec = "60m";
-        Unit = "update-${container_name}.service";
-      };
-      wantedBy = [ "timers.target" ];
-    };
-  };
 }

modules/services/traefik.nix

@@ -1,58 +1,36 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
 with lib;
 
 let
+  helper = import ./lib.nix { inherit config pkgs lib; };
   cfg = config.numbus.services.traefik;
-  containerName = "traefik";
-  pod = "false";
-  composeFile = "podman/traefik/compose.yaml";
 in
 
-{
+helper.mkPodmanService {
-  options.numbus.services.traefik = {
+  name = "traefik";
-    enable = mkOption {
+  description = "Traefik reverse proxy, one to rule them all";
-      type = lib.types.bool;
+  pod = "false";
-      default = true;
+  reverseProxied = false;
-      example = true;
+  dependencies = [ "${config.numbus.services.dns}.service" ];
-      description = "Traefik reverse-proxy";
+  configDir = false;
-    };
+  delaySec = 10;
 
+  extraOptions = {
+    enable.default = true;
     staticConfigFile = mkOption {
       type = types.str;
       default = "traefik/config.yaml";
-      example = "traefik/config.yaml";
+      description = "The path for Traefik's static configuration file, relative to /etc/";
-      description = "The directory path where Traefik's static configuration file will be stored, prefixed by /etc/";
     };
-
-    dataDir = mkOption {
-      type = types.str;
-      default = "/mnt/config/traefik";
-      example = "/mnt/config/traefik";
-      description = "The directory where traefik's data (i.e. SSL certificates) will be stored";
-    };
-
-    subdomain = mkOption {
-      type = types.str;
-      default = "traefik";
-      example = "traefik";
-      description = "The subdomain that traefik will use (i.e. your-subdomain.your-domain.com)";
-    };
-
     logLevel = mkOption {
       type = types.enum [ "TRACE" "DEBUG" "INFO" "WARN" "ERROR" "FATAL" ];
       default = "ERROR";
-      example = "ERROR";
+      description = "The level of detail Traefik should print in the logs.";
-      description = "The level of detail Traefik should print in the logs : TRACE, DEBUG, INFO, WARN, ERROR, FATAL (from most to least verbose)";
     };
   };
 
-  config = mkIf cfg.enable {
+  composeText = ''
-    environment.etc."${composeFile}".text =
-      /*
-      yaml
-      */
-      ''
     services:
       traefik:
         image: docker.io/library/traefik:latest
@@ -64,8 +42,8 @@ in
           - "443:443/tcp"
         volumes:
           - /run/user/1000/podman/podman.sock:/run/docker.sock:ro
-              - ${cfg.staticConfigFile}:/etc/traefik/traefik.yaml:ro
+          - /etc/${cfg.staticConfigFile}:/etc/traefik/traefik.yaml:ro
-              - ${config.numbus.services.traefikDynamicConfigDir}:/etc/traefik/conf:ro
+          - ${config.numbus.traefikDynamicConfigDir}:/etc/traefik/conf:ro
           - ${cfg.dataDir}:/var/traefik/certs:rw
         environment:
           - CF_DNS_API_TOKEN=$CF_DNS_API_TOKEN
@@ -74,11 +52,8 @@ in
         restart: unless-stopped
   '';
 
-    environment.etc."${cfg.staticConfigFile}".text =
+  extraConfig = {
-      /*
+    environment.etc."${cfg.staticConfigFile}".text = ''
-      yaml
-      */
-      ''
       global:
         checkNewVersion: false
         sendAnonymousUsage: false
@@ -123,11 +98,7 @@ in
           watch: true
     '';
 
-    environment.etc."${config.numbus.services.traefikDynamicConfigDir}/secureHeaders.yaml".text =
+    environment.etc."${config.numbus.traefikDynamicConfigDir}/secureHeaders.yaml".text = ''
-      /*
-      yaml
-      */
-      ''
       http:
         middlewares:
           secureHeaders:
@@ -150,11 +121,7 @@ in
               STSSeconds: 315360000
     '';
 
-    environment.etc."${config.numbus.services.traefikDynamicConfigDir}/secureTLS.yaml".text =
+    environment.etc."${config.numbus.traefikDynamicConfigDir}/secureTLS.yaml".text = ''
-      /*
-      yaml
-      */
-      ''
       tls:
         options:
           secureTLS:
@@ -168,44 +135,5 @@ in
               - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
               - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
     '';
-
-    systemd.services."${containerName}" = {
-      description = "Podman container : ${containerName}";
-      requires = [ "network.target" ];
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.podman pkgs.podman-compose pkgs.coreutils pkgs.sudo ];
-      serviceConfig = {
-        Type = "exec";
-        ExecStartPre = "bash -c 'sleep $((RANDOM % 180))'";
-        ExecStart = "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} up --remove-orphans";
-        ExecStop = "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} down";
-        Restart = "on-failure";
-        RestartSec = "1m";
-        StartLimitBurst = "5";
-      };
-    };
-
-    systemd.services."update-${containerName}" = {
-      description = "Update ${containerName} container";
-      path = [ pkgs.podman pkgs.podman-compose pkgs.sudo ];
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = [
-          "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} pull"
-          "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} down"
-          "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} up -d"
-        ];
-      };
-    };
-
-    systemd.timers."update-${containerName}" = {
-      timerConfig = {
-        OnCalendar = "02:00";
-        RandomizedDelaySec = "60m";
-        Unit = "update-${containerName}.service";
-      };
-      wantedBy = [ "timers.target" ];
-    };
   };
 }