numbus/numbus-server-module
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Created a helper to create the container configurations. Updated all containers files to use it.

Browse Source
This commit is contained in:
Raphaël Numbus
2026-02-20 10:23:24 +01:00
parent 3b130bc2e9
commit c90169f242
10 changed files with 706 additions and 916 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/global.nix
+2 -2
View File
@@ -9,7 +9,7 @@ with lib;
domain = mkOption { domain = mkOption {
type = types.str; type = types.str;
example = "numbus.eu"; example = "numbus.eu";
description = "The root domain name (e.g., example.com) that your services will use"; description = "The root domain name (i.e. example.com) that your services will use";
}; };
dns = mkOption { dns = mkOption {
type = types.enum [ "pi-hole" "adguard" ]; type = types.enum [ "pi-hole" "adguard" ];
@@ -22,7 +22,7 @@ with lib;
type = types.str; type = types.str;
default = "/etc/traefik/rules"; default = "/etc/traefik/rules";
example = "/etc/traefik/rules"; example = "/etc/traefik/rules";
description = "! Choose a directory outside of /etc/ will break things ! The directory where Traefik's dynamic configuration files will be stored"; description = "! Choosing a directory outside of /etc/ will break things ! The directory where Traefik's dynamic configuration files will be stored";
}; };
email = { email = {
modules/services/frigate.nix
+41 -135
View File
@@ -3,154 +3,60 @@
with lib; with lib;
let let
helper = import ./lib.nix { inherit config pkgs lib; };
cfg = config.numbus.services.frigate; cfg = config.numbus.services.frigate;
containerName = "frigate";
pod = "home-assistant";
composeFile = "podman/frigate/compose.yaml";
in in
{ helper.mkPodmanService {
options.numbus.services.frigate = { name = "frigate";
enable = mkEnableOption "Frigate fully-local NVR (Network Video Recorder)"; description = "Frigate, your fully-local NVR (Network Video Recorder)";
defaultPort = "8971";
configDir = mkOption { pod = "home-assistant";
type = types.str; scheme = "https";
default = "/mnt/config/frigate"; dependencies = [ "traefik.service" "${config.numbus.services.dns}.service" "home-assistant.service" ];
example = "/mnt/config/frigate";
description = "The directory where Frigate's configuration files will be stored";
};
dataDir = mkOption {
type = types.str;
default = "/mnt/data/frigate";
example = "/mnt/data/frigate";
description = "The directory where Frigate's data (i.e. clips, recordings, exports) will be stored";
};
subdomain = mkOption {
type = types.str;
default = "frigate";
example = "frigate";
description = "The subdomain that Frigate will use (i.e. your-subdomain.your-domain.com)";
};
extraOptions = {
devices = mkOption { devices = mkOption {
type = types.listOf types.str; type = types.listOf types.str;
default = []; default = [];
example = [ "/dev/dri:/dev/dri" "/dev/bus/usb:/dev/bus/usb" "/dev/apex_0:/dev/apex_0" ]; example = [ "/dev/dri:/dev/dri" "/dev/bus/usb:/dev/bus/usb" "/dev/apex_0:/dev/apex_0" ];
description = "List of devices to map into the container. /dev/dri is used for graphics acceleration, /dev/bus/usb for USB Coral TPUs, and /dev/apex_0 for PCI coral TPUs"; description = "List of devices to map into the container. /dev/dri is used for graphics acceleration, /dev/bus/usb for USB Coral TPUs, and /dev/apex_0 for PCI coral TPUs";
}; };
port = mkOption {
type = types.str;
default = "8971";
example = "8971";
description = "The port that Frigate will use. Be careful, do not use a port already in use such as 80 or 443";
};
}; };
config = mkIf cfg.enable { composeText = ''
environment.etc."${composeFile}".text = services:
/* frigate:
yaml image: ghcr.io/blakeblackshear/frigate:stable
*/ container_name: frigate
'' hostname: frigate
services: shm_size: "256mb"
${containerName}:
image: ghcr.io/blakeblackshear/frigate:stable
container_name: ${containerName}
hostname: ${containerName}
shm_size: "256mb"
networks:
home-assistant_frontend:
home-assistant_backend:
ports:
- "${cfg.port}:8971/tcp"
volumes:
- ${cfg.configDir}:/config
- ${cfg.dataDir}:/media/frigate
- /etc/localtime:/etc/localtime:ro
- type: tmpfs
target: /tmp/cache
tmpfs:
size: 1000000000
environment:
- FRIGATE_MQTT_USER=$FRIGATE_MQTT_USER
- FRIGATE_MQTT_PASSWORD=$FRIGATE_MQTT_PASSWORD
${lib.optionalString (cfg.devices != []) ''
devices:
${lib.concatStringsSep "\n" (map (d: " - \"${d}\"") cfg.devices)}
''}
restart: unless-stopped
networks: networks:
home-assistant_backend:
external: true
home-assistant_frontend: home-assistant_frontend:
external: true home-assistant_backend:
''; ports:
- "${cfg.port}:8971/tcp"
volumes:
- ${cfg.configDir}:/config
- ${cfg.dataDir}:/media/frigate
- /etc/localtime:/etc/localtime:ro
- type: tmpfs
target: /tmp/cache
tmpfs:
size: 1000000000
environment:
- FRIGATE_MQTT_USER=$FRIGATE_MQTT_USER
- FRIGATE_MQTT_PASSWORD=$FRIGATE_MQTT_PASSWORD
${lib.optionalString (cfg.devices != []) ''
devices:
${lib.concatStringsSep "\n" (map (d: " - \"${d}\"") cfg.devices)}
''}
restart: unless-stopped
environment.etc."${config.numbus.services.traefikDynamicConfigDir}/frigate.yaml".text = networks:
/* home-assistant_backend:
yaml external: true
*/ home-assistant_frontend:
'' external: true
http: '';
routers:
${containerName}:
rule: "Host(`${cfg.subdomain}.${config.numbus.services.domain}`)"
entrypoints:
- "websecure"
service: ${containerName}
middlewares:
- secureHeaders
tls:
certresolver: "cloudflare"
options: "secureTLS"
services:
${containerName}:
loadBalancer:
servers:
- url: "https://host.containers.internal:${cfg.port}"
'';
systemd.services."${containerName}" = {
description = "Podman container : ${containerName}";
requires = [ "traefik.service" "home-assistant.service" "${config.numbus.services.dns}.service" ];
after = [ "traefik.service" "home-assistant.service" "${config.numbus.services.dns}.service" ];
wantedBy = [ "multi-user.target" ];
path = [ pkgs.podman pkgs.podman-compose pkgs.coreutils pkgs.sudo ];
serviceConfig = {
Type = "exec";
ExecStartPre = "bash -c 'sleep $((RANDOM % 180))'";
ExecStart = "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} up --remove-orphans";
ExecStop = "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} down";
Restart = "on-failure";
RestartSec = "1m";
StartLimitBurst = "5";
};
};
systemd.services."update-${containerName}" = {
description = "Update ${containerName} container";
path = [ pkgs.podman pkgs.podman-compose pkgs.sudo ];
serviceConfig = {
Type = "oneshot";
ExecStart = [
"sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} pull"
"sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} down"
"sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} up -d"
];
};
};
systemd.timers."update-${containerName}" = {
timerConfig = {
OnCalendar = "02:00";
RandomizedDelaySec = "60m";
Unit = "update-${containerName}.service";
};
wantedBy = [ "timers.target" ];
};
};
} }
modules/services/gitea.nix
+65 -107
View File
@@ -1,119 +1,77 @@
{ config, pkgs, ... }: { config, pkgs, lib, ... }:
with lib;
let let
containerName = "gitea"; helper = import ./lib.nix { inherit config pkgs lib; };
composeFile = "podman/gitea/compose.yaml"; cfg = config.numbus.services.gitea;
configDir = "/mnt/config/gitea";
dataDir = "gitea_data";
in in
{ helper.mkPodmanService {
config = { name = "gitea";
environment.etc."${compose_file}".text = description = "Gitea, your own self-hosted git platform";
/* defaultPort = "3000";
yaml pod = "gitea";
*/ dependencies = [ "traefik.service" "${config.numbus.services.dns}.service" ];
''
services:
gitea-server:
image: docker.gitea.com/gitea:latest-rootless
container_name: gitea-server
hostname: gitea-server
networks:
gitea_frontend:
gitea_backend:
ports:
- "3000:3000/tcp" #http
volumes:
- gitea_data:/var/lib/gitea
- ${configDir}:/etc/gitea
- /etc/localtime:/etc/localtime:ro
environment:
- GITEA__database__DB_TYPE=postgres
- GITEA__database__HOST=$POSTGRES_HOST:$POSTGRES_PORT
- GITEA__database__NAME=$DB_NAME
- GITEA__database__USER=$DB_USERNAME
- GITEA__database__PASSWD=$DB_PASSWORD
- GITEA__server__SSH_PORT=2424
- GITEA__server__ROOT_URL=gitea.$DOMAIN_NAME
depends_on:
- gitea-database
restart: unless-stopped
gitea-database:
image: docker.io/library/postgres:14
container_name: gitea-database
hostname: gitea-database
networks:
gitea_backend:
volumes:
- gitea_database:/var/lib/postgresql/data
environment:
- POSTGRES_USER=$DB_USERNAME
- POSTGRES_PASSWORD=$DB_PASSWORD
- POSTGRES_DB=$DB_NAME
restart: unless-stopped
volumes:
gitea_data:
gitea_database:
composeText = ''
services:
gitea-server:
image: docker.gitea.com/gitea:latest-rootless
container_name: gitea-server
hostname: gitea-server
networks: networks:
gitea_frontend: gitea_frontend:
name: gitea_frontend
driver: bridge
ipam:
config:
- subnet: "10.89.3.0/24"
gateway: "10.89.3.254"
gitea_backend: gitea_backend:
name: gitea_backend ports:
driver: bridge - "${cfg.port}:3000/tcp"
ipam: volumes:
config: - ${cfg.dataDir}:/var/lib/gitea
- subnet: "10.89.4.0/24" - ${cfg.configDir}:/etc/gitea
gateway: "10.89.4.254" - /etc/localtime:/etc/localtime:ro
''; environment:
- GITEA__database__DB_TYPE=postgres
- GITEA__database__HOST=$POSTGRES_HOST:$POSTGRES_PORT
- GITEA__database__NAME=$DB_NAME
- GITEA__database__USER=$DB_USERNAME
- GITEA__database__PASSWD=$DB_PASSWORD
- GITEA__server__SSH_PORT=2424
- GITEA__server__ROOT_URL=${cfg.subdomain}.${config.numbus.services.domain}
depends_on:
- gitea-database
restart: unless-stopped
systemd.services."${container_name}" = { gitea-database:
description = "Podman container : ${container_name}"; image: docker.io/library/postgres:14
after = [ "network.target" "traefik.service" "pi-hole.service" ]; container_name: gitea-database
requires = [ "traefik.service" ]; hostname: gitea-database
wantedBy = [ "multi-user.target" ]; networks:
path = [ pkgs.podman pkgs.coreutils ]; gitea_backend:
volumes:
- gitea_database:/var/lib/postgresql/data
environment:
- POSTGRES_USER=$DB_USERNAME
- POSTGRES_PASSWORD=$DB_PASSWORD
- POSTGRES_DB=$DB_NAME
restart: unless-stopped
serviceConfig = { volumes:
User = "numbus-admin"; gitea_database:
Environment = [ "XDG_RUNTIME_DIR=/run/user/1000" ];
Type = "exec";
TimeoutStartSec = "900";
ExecStartPre = [
"${pkgs.bash}/bin/bash -c 'sleep $((RANDOM % 400))'"
"-${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} pull"
];
ExecStart = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} up --remove-orphans";
ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
Restart = "on-failure";
RestartSec = "5m";
StartLimitBurst = "3";
};
};
systemd.services."update-${container_name}" = { networks:
description = "Update ${container_name} container"; gitea_frontend:
serviceConfig = { name: gitea_frontend
Type = "oneshot"; driver: bridge
ExecStart = "${pkgs.systemd}/bin/systemctl restart ${container_name}.service"; ipam:
}; config:
}; - subnet: "10.89.3.0/24"
gateway: "10.89.3.254"
systemd.timers."update-${container_name}" = { gitea_backend:
timerConfig = { name: gitea_backend
OnCalendar = "02:00"; driver: bridge
RandomizedDelaySec = "60m"; ipam:
Unit = "update-${container_name}.service"; config:
}; - subnet: "10.89.4.0/24"
wantedBy = [ "timers.target" ]; gateway: "10.89.4.254"
}; '';
};
} }
modules/services/home-assistant.nix
+65 -75
View File
@@ -1,83 +1,73 @@
{ config, pkgs, ... }: { config, pkgs, lib, ... }:
with lib;
let let
container_name = "home-assistant"; helper = import ./lib.nix { inherit config pkgs lib; };
compose_file = "podman/home-assistant/compose.yaml"; cfg = config.numbus.services.home-assistant;
config_dir_1 = "/mnt/config/home-assistant";
config_dir_2 = "/mnt/config/mqtt";
in in
{ helper.mkPodmanService {
config = { name = "home-assistant";
environment.etc."${compose_file}".text = description = "Home Assistant, libre house control and much more";
/* defaultPort = "8123";
yaml pod = "home-assistant";
*/ dependencies = [ "traefik.service" "${config.numbus.services.dns}.service" ];
''
services:
home-assistant:
image: ghcr.io/home-assistant/home-assistant:latest
container_name: home-assistant
networks:
home-assistant_frontend:
home-assistant_backend:
volumes:
- ${config_dir_1}:/config
- /etc/localtime:/etc/localtime:ro
- /run/dbus:/run/dbus:ro
# --- home-assistant devices --- #
labels:
- traefik.enable=true
- traefik.docker.network=home-assistant_frontend
- traefik.http.services.home-assistant.loadbalancer.server.port=8123
- traefik.http.services.home-assistant.loadbalancer.server.scheme=http
- traefik.http.routers.home-assistant-https.entrypoints=websecure
- traefik.http.routers.home-assistant-https.rule=Host(`home-assistant.$DOMAIN_NAME`)
- traefik.http.routers.home-assistant-https.tls=true
- traefik.http.routers.home-assistant-https.tls.certresolver=cloudflare
restart: unless-stopped
frigate-mqtt:
image: eclipse-mosquitto
container_name: mqtt
user: 1000:1000
networks:
home-assistant_backend:
volumes:
- ${config_dir_2}:/mosquitto
restart: unless-stopped
networks:
home-assistant_backend:
external: true
home-assistant_frontend:
external: true
'';
systemd.services.${container_name} = {
description = "Podman container : ${container_name}";
after = [ "network.target" "traefik.service" "pi-hole.service" ];
requires = [ "traefik.service" ];
wantedBy = [ "multi-user.target" ];
path = [ pkgs.podman pkgs.coreutils ];
serviceConfig = { extraOptions = {
User = "numbus-admin"; devices = mkOption {
Environment = [ "XDG_RUNTIME_DIR=/run/user/1000" ]; type = types.listOf types.str;
Type = "exec"; default = [];
TimeoutStartSec = "600"; example = [ "/dev/serial/by-id/Sonoff_Zigbee_3.0-id-port0:/dev/ttyUSB0" ];
# Pull the latest image before running description = "List of devices to map into the container. /dev/ttyUSB0 is used for Zigbee dongles";
ExecStartPre = [
"${pkgs.coreutils}/bin/sleep 180"
"-${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} pull"
];
# Bring the service up
ExecStart = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} up --remove-orphans";
# Take it down gracefully
ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
Restart = "on-failure";
RestartSec = "5m";
StartLimitBurst = "3";
};
}; };
}; };
composeText = ''
services:
home-assistant:
image: ghcr.io/home-assistant/home-assistant:latest
container_name: home-assistant
hostname: home-assistant
networks:
home-assistant_frontend:
home-assistant_backend:
ports:
- "${cfg.port}:8123/tcp"
volumes:
- ${cfg.configDir}:/config
- /etc/localtime:/etc/localtime:ro
- /run/dbus:/run/dbus:ro
${lib.optionalString (cfg.devices != []) ''
devices:
${lib.concatStringsSep "\n" (map (d: " - \"${d}\"") cfg.devices)}
''}
restart: unless-stopped
home-assistant-mqtt:
image: docker.io/library/eclipse-mosquitto:latest
container_name: home-assistant-mqtt
hostname: home-assistant-mqtt
networks:
home-assistant_backend:
volumes:
- /mnt/config/mosquitto:/mosquitto
restart: unless-stopped
networks:
home-assistant_frontend:
name: home-assistant_frontend
driver: bridge
ipam:
config:
- subnet: "10.89.5.0/24"
gateway: "10.89.5.254"
home-assistant_backend:
name: home-assistant_backend
driver: bridge
ipam:
config:
- subnet: "10.89.6.0/24"
gateway: "10.89.6.254"
'';
} }
modules/services/immich.nix
+106 -122
View File
@@ -1,134 +1,118 @@
{ config, pkgs, ... }: { config, pkgs, lib, ... }:
with lib;
let let
container_name = "immich"; helper = import ./lib.nix { inherit config pkgs lib; };
compose_file = "podman/immich/compose.yaml"; cfg = config.numbus.services.immich;
config_dir = "/mnt/config/immich";
data_dir = "/mnt/data/immich";
in in
{ helper.mkPodmanService {
config = { name = "immich";
environment.etc."${compose_file}".text = description = "Immich, Google Photos but better";
/* defaultPort = "2283";
yaml pod = "immich";
*/ dependencies = [ "traefik.service" "${config.numbus.services.dns}.service" ];
''
services:
immich-server:
image: ghcr.io/immich-app/immich-server:$IMMICH_VERSION
container_name: immich-server
networks:
immich_frontend:
immich_backend:
volumes:
- $UPLOAD_LOCATION:/data
- /etc/localtime:/etc/localtime:ro
# --- immich devices --- #
labels:
- traefik.enable=true
- traefik.docker.network=immich_frontend
- traefik.http.services.immich.loadbalancer.server.port=2283
- traefik.http.services.immich.loadbalancer.server.scheme=http
- traefik.http.routers.immich-https.entrypoints=websecure
- traefik.http.routers.immich-https.rule=Host(`immich.$DOMAIN_NAME`)
- traefik.http.routers.immich-https.tls=true
- traefik.http.routers.immich-https.tls.certresolver=cloudflare
env_file:
- .env
depends_on:
- immich-redis
- immich-database
restart: always
healthcheck:
disable: false
immich-machine-learning: composeText = ''
container_name: immich-machine-learning services:
image: ghcr.io/immich-app/immich-machine-learning:$IMMICH_VERSION immich-server:
networks: image: ghcr.io/immich-app/immich-server:latest
immich_backend: container_name: immich-server
volumes: hostname: immich-server
- ${config_dir}/models:/cache user: '1000:1000'
env_file: networks:
- .env immich_frontend:
restart: always immich_backend:
healthcheck: ports:
disable: false - "${cfg.port}:2283/tcp" #http
volumes:
immich-redis: - ${cfg.dataDir}:/data
container_name: immich-redis - /etc/localtime:/etc/localtime:ro
image: docker.io/valkey/valkey:8-bookworm@sha256:a137a2b60aca1a75130022d6bb96af423fefae4eb55faf395732db3544803280 env_file:
networks: - .env
immich_backend: depends_on:
healthcheck: - immich-redis
test: redis-cli ping || exit 1 - immich-database
restart: always healthcheck:
disable: false
immich-database: security_opt:
container_name: immich-database - no-new-privileges:true
image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:32324a2f41df5de9efe1af166b7008c3f55646f8d0e00d9550c16c9822366b4a cap_drop:
networks: - NET_RAW
immich_backend: restart: unless-stopped
shm_size: 128mb
volumes:
# Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
- $DB_DATA_LOCATION:/var/lib/postgresql/data
environment:
POSTGRES_PASSWORD: $DB_PASSWORD
POSTGRES_USER: $DB_USERNAME
POSTGRES_DB: $DB_DATABASE_NAME
POSTGRES_INITDB_ARGS: '--data-checksums'
restart: always
healthcheck:
disable: false
immich-machine-learning:
image: ghcr.io/immich-app/immich-machine-learning:latest
container_name: immich-machine-learning
hostname: immich-machine-learning
user: '1000:1000'
networks: networks:
immich_backend: immich_backend:
external: true volumes:
immich_frontend: - ${cfg.configDir}/machine-learning:/cache
external: true env_file:
''; - .env
healthcheck:
disable: false
security_opt:
- no-new-privileges:true
cap_drop:
- NET_RAW
restart: unless-stopped
systemd.services."${container_name}" = { immich-redis:
description = "Podman container : ${container_name}"; image: docker.io/valkey/valkey:8-bookworm
after = [ "network.target" "traefik.service" "pi-hole.service" ]; container_name: immich-redis
requires = [ "traefik.service" ]; hostname: immich-redis
wantedBy = [ "multi-user.target" ]; user: '1000:1000'
path = [ pkgs.podman pkgs.coreutils ]; networks:
immich_backend:
healthcheck:
test: redis-cli ping || exit 1
security_opt:
- no-new-privileges:true
cap_drop:
- NET_RAW
restart: unless-stopped
serviceConfig = { immich-database:
User = "numbus-admin"; image: ghcr.io/immich-app/postgres:14
Environment = [ "XDG_RUNTIME_DIR=/run/user/1000" ]; container_name: immich-database
Type = "exec"; hostname: immich-database
TimeoutStartSec = "900"; user: '1000:1000'
ExecStartPre = [ networks:
"${pkgs.bash}/bin/bash -c 'sleep $((RANDOM % 400))'" immich_backend:
"-${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} pull" shm_size: 128mb
]; volumes:
ExecStart = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} up --remove-orphans"; - ${cfg.configDir}/database:/var/lib/postgresql/data
ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down"; environment:
Restart = "on-failure"; POSTGRES_PASSWORD: $DB_PASSWORD
RestartSec = "5m"; POSTGRES_USER: $DB_USERNAME
StartLimitBurst = "3"; POSTGRES_DB: $DB_DATABASE_NAME
}; POSTGRES_INITDB_ARGS: '--data-checksums'
}; healthcheck:
disable: false
security_opt:
- no-new-privileges:true
cap_drop:
- NET_RAW
restart: unless-stopped
systemd.services."update-${container_name}" = { networks:
description = "Update ${container_name} container"; immich_frontend:
serviceConfig = { name: immich_frontend
Type = "oneshot"; driver: bridge
ExecStart = "${pkgs.systemd}/bin/systemctl restart ${container_name}.service"; ipam:
}; config:
}; - subnet: "10.89.7.0/24"
gateway: "10.89.7.254"
systemd.timers."update-${container_name}" = { immich_backend:
timerConfig = { name: immich_backend
OnCalendar = "02:00"; driver: bridge
RandomizedDelaySec = "60m"; ipam:
Unit = "update-${container_name}.service"; config:
}; - subnet: "10.89.8.0/24"
wantedBy = [ "timers.target" ]; gateway: "10.89.8.254"
}; '';
};
} }
modules/services/it-tools.nix
+29 -69
View File
@@ -1,77 +1,37 @@
{ config, pkgs, ... }: { config, pkgs, lib, ... }:
with lib;
let let
container_name = "it-tools"; helper = import ./lib.nix { inherit config pkgs lib; };
compose_file = "podman/it-tools/compose.yaml"; cfg = config.numbus.services.it-tools;
in in
{ helper.mkPodmanService {
config = { name = "it-tools";
environment.etc."${compose_file}".text = description = "Immich, Google Photos but better";
/* defaultPort = "8880";
yaml pod = "false";
*/
'' composeText = ''
services: services:
it-tools: it-tools:
container_name: it-tools image: docker.io/corentinth/it-tools:latest
image: corentinth/it-tools container_name: it-tools
networks: hostname: it-tools
it-tools_frontend:
labels:
- traefik.enable=true
- traefik.docker.network=it-tools_frontend
- traefik.http.services.it-tools.loadbalancer.server.port=80
- traefik.http.services.it-tools.loadbalancer.server.scheme=http
- traefik.http.routers.it-tools-https.entrypoints=websecure
- traefik.http.routers.it-tools-https.rule=Host(`it-tools.$DOMAIN_NAME`)
- traefik.http.routers.it-tools-https.tls=true
- traefik.http.routers.it-tools-https.tls.certresolver=cloudflare
restart: unless-stopped
networks: networks:
it-tools_frontend: it-tools_frontend:
external: true ports:
''; - "${cfg.port}:80/tcp"
restart: unless-stopped
systemd.services."${container_name}" = { networks:
description = "Podman container : ${container_name}"; it-tools_frontend:
after = [ "network.target" "traefik.service" "pi-hole.service" ]; name: it-tools_frontend
requires = [ "traefik.service" ]; driver: bridge
wantedBy = [ "multi-user.target" ]; ipam:
path = [ pkgs.podman pkgs.coreutils ]; config:
- subnet: "10.89.9.0/24"
serviceConfig = { gateway: "10.89.9.254"
User = "numbus-admin"; '';
Environment = [ "XDG_RUNTIME_DIR=/run/user/1000" ];
Type = "exec";
TimeoutStartSec = "600";
ExecStartPre = [
"${pkgs.bash}/bin/bash -c 'sleep $((RANDOM % 180))'"
"-${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} pull"
];
ExecStart = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} up --remove-orphans";
ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
Restart = "on-failure";
RestartSec = "5m";
StartLimitBurst = "3";
};
};
systemd.services."update-${container_name}" = {
description = "Update ${container_name} container";
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.systemd}/bin/systemctl restart ${container_name}.service";
};
};
systemd.timers."update-${container_name}" = {
timerConfig = {
OnCalendar = "02:00";
RandomizedDelaySec = "60m";
Unit = "update-${container_name}.service";
};
wantedBy = [ "timers.target" ];
};
};
} }
modules/services/lib.nix
+134
View File
@@ -0,0 +1,134 @@
{ lib, config, pkgs }:
with lib;
{
mkPodmanService = {
name,
description,
defaultPort ? "0",
defaultSubdomain ? name,
pod ? name,
reverseProxied ? true,
composeFile ? "podman/${name}/compose.yaml",
composeText,
scheme ? "http",
middlewares ? [ "secureHeaders" ],
dependencies ? [],
extraOptions ? {},
extraConfig ? {},
configDir ? true,
dataDir ? true,
delaySec ? 180
}:
let
cfg = config.numbus.services.${name};
Deps = dependencies;
in
{
options.numbus.services.${name} = recursiveUpdate ({
enable = mkEnableOption description;
subdomain = mkOption {
type = types.str;
default = defaultSubdomain;
example = defaultSubdomain;
description = "The subdomain that ${name} will use";
};
port = mkOption {
type = types.str;
default = defaultPort;
example = defaultPort;
description = "The port that ${name} will use.";
};
reverseProxied = mkOption {
type = types.bool;
default = reverseProxied;
description = "Whether to create a Traefik reverse proxy configuration for this service.";
};
} // (optionalAttrs configDir {
configDir = mkOption {
type = types.str;
default = "/mnt/config/${name}";
example = "/mnt/config/${name}";
description = "The directory where ${name}'s configuration files will be stored";
};
}) // (optionalAttrs dataDir {
dataDir = mkOption {
type = types.str;
default = "/mnt/data/${name}";
example = "/mnt/data/${name}";
description = "The directory where ${name}'s data will be stored";
};
})) extraOptions;
config = mkIf cfg.enable (mkMerge [
{
environment.etc."${composeFile}".text = composeText;
environment.etc."${config.numbus.traefikDynamicConfigDir}/${name}.yaml" = mkIf cfg.reverseProxied {
text = ''
http:
routers:
${name}:
rule: "Host(`${cfg.subdomain}.${config.numbus.services.domain}`)"
entrypoints:
- "websecure"
service: ${name}
middlewares:
${concatStringsSep "\n" (map (m: " - ${m}") middlewares)}
tls:
certresolver: "cloudflare"
options: "secureTLS"
services:
${name}:
loadBalancer:
servers:
- url: "${scheme}://host.containers.internal:${cfg.port}"
'';
};
systemd.services."${name}" = {
description = "Podman container : ${name}";
requires = Deps;
after = Deps;
wantedBy = [ "multi-user.target" ];
path = [ pkgs.podman pkgs.podman-compose pkgs.coreutils pkgs.sudo ];
serviceConfig = {
Type = "exec";
ExecStartPre = "bash -c 'sleep $((RANDOM % ${delaySec}))'";
ExecStart = "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} up --remove-orphans";
ExecStop = "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} down";
Restart = "on-failure";
RestartSec = "1m";
StartLimitBurst = "5";
};
};
systemd.services."update-${name}" = {
description = "Update ${name} container";
path = [ pkgs.podman pkgs.podman-compose pkgs.sudo pkgs.systemd ];
serviceConfig = {
Type = "oneshot";
ExecStart = [
"sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} pull"
"${pkgs.systemd}/bin/systemctl restart ${name}.service"
];
};
};
systemd.timers."update-${name}" = {
timerConfig = {
OnCalendar = "02:00";
RandomizedDelaySec = "60m";
Unit = "update-${name}.service";
};
wantedBy = [ "timers.target" ];
};
}
extraConfig
]);
};
}
modules/services/passbolt.nix
+92 -117
View File
@@ -1,129 +1,104 @@
{ config, pkgs, ... }: { config, pkgs, lib, ... }:
with lib;
let let
container_name = "passbolt"; helper = import ./lib.nix { inherit config pkgs lib; };
compose_file = "podman/passbolt/compose.yaml"; cfg = config.numbus.services.passbolt;
in in
{ helper.mkPodmanService {
config = { name = "passbolt";
environment.etc."${compose_file}".text = description = "Passbolt, your password manager";
/* defaultPort = "4433";
yaml pod = "passbolt";
*/ scheme = "https";
'' dependencies = [ "traefik.service" "${config.numbus.services.dns}.service" ];
services:
passbolt:
image: passbolt/passbolt:latest-ce-non-root
container_name: passbolt
networks:
passbolt_frontend:
passbolt_backend:
volumes:
- passbolt-gpg:/etc/passbolt/gpg
- passbolt-jwt:/etc/passbolt/jwt
environment:
APP_DEFAULT_TIMEZONE: $TZ
APP_FULL_BASE_URL: https://passbolt.$DOMAIN_NAME
DATASOURCES_DEFAULT_HOST: "passbolt-database"
DATASOURCES_DEFAULT_USERNAME: $PASSBOLT_MYSQL_USER
DATASOURCES_DEFAULT_PASSWORD: $PASSBOLT_MYSQL_PASSWORD
DATASOURCES_DEFAULT_DATABASE: $PASSBOLT_MYSQL_DATABASE
EMAIL_DEFAULT_FROM_NAME: "Passbolt"
EMAIL_TRANSPORT_DEFAULT_HOST: $EMAIL_TRANSPORT_DEFAULT_HOST
EMAIL_TRANSPORT_DEFAULT_PORT: $EMAIL_TRANSPORT_DEFAULT_PORT
EMAIL_TRANSPORT_DEFAULT_USERNAME: $EMAIL_TRANSPORT_DEFAULT_USERNAME
EMAIL_TRANSPORT_DEFAULT_PASSWORD: $EMAIL_TRANSPORT_DEFAULT_PASSWORD
EMAIL_TRANSPORT_DEFAULT_TLS: true
EMAIL_DEFAULT_FROM: $EMAIL_ADDRESS
PASSBOLT_SSL_FORCE: true
labels:
- traefik.enable=true
- traefik.docker.network=passbolt_frontend
- traefik.http.services.passbolt.loadbalancer.server.port=4433
- traefik.http.services.passbolt.loadbalancer.server.scheme=https
- traefik.http.routers.passbolt-https.entrypoints=websecure
- traefik.http.routers.passbolt-https.rule=Host(`passbolt.$DOMAIN_NAME`)
- traefik.http.routers.passbolt-https.tls=true
- traefik.http.routers.passbolt-https.tls.certresolver=cloudflare
command:
[
"/usr/bin/wait-for.sh",
"-t",
"0",
"passbolt-database:3306",
"--",
"/docker-entrypoint.sh",
]
depends_on:
- passbolt-database
restart: unless-stopped
passbolt-database: composeText = ''
image: mariadb:11.3 services:
container_name: passbolt-database passbolt-server:
networks: image: docker.io/passbolt/passbolt:latest-ce-non-root
passbolt_backend: container_name: passbolt-server
volumes: hostname: passbolt-server
- passbolt-database:/var/lib/mysql networks:
environment: passbolt_frontend:
MYSQL_RANDOM_ROOT_PASSWORD: "true" passbolt_backend:
MYSQL_DATABASE: $PASSBOLT_MYSQL_DATABASE ports:
MYSQL_USER: $PASSBOLT_MYSQL_USER - "${cfg.port}:4433/tcp"
MYSQL_PASSWORD: $PASSBOLT_MYSQL_PASSWORD volumes:
restart: unless-stopped - passbolt-gpg:/etc/passbolt/gpg
- passbolt-jwt:/etc/passbolt/jwt
environment:
APP_DEFAULT_TIMEZONE: $TZ
APP_FULL_BASE_URL: https://${cfg.subdomain}.${config.numbus.services.domain}
DATASOURCES_DEFAULT_HOST: "passbolt-database"
DATASOURCES_DEFAULT_USERNAME: $PASSBOLT_MYSQL_USER
DATASOURCES_DEFAULT_PASSWORD: $PASSBOLT_MYSQL_PASSWORD
DATASOURCES_DEFAULT_DATABASE: $PASSBOLT_MYSQL_DATABASE
EMAIL_DEFAULT_FROM_NAME: "Passbolt"
EMAIL_TRANSPORT_DEFAULT_HOST: $EMAIL_TRANSPORT_DEFAULT_HOST
EMAIL_TRANSPORT_DEFAULT_PORT: $EMAIL_TRANSPORT_DEFAULT_PORT
EMAIL_TRANSPORT_DEFAULT_USERNAME: $EMAIL_TRANSPORT_DEFAULT_USERNAME
EMAIL_TRANSPORT_DEFAULT_PASSWORD: $EMAIL_TRANSPORT_DEFAULT_PASSWORD
EMAIL_TRANSPORT_DEFAULT_TLS: true
EMAIL_DEFAULT_FROM: $EMAIL_ADDRESS
PASSBOLT_SSL_FORCE: true
command:
[
"/usr/bin/wait-for.sh",
"-t",
"0",
"passbolt-database:3306",
"--",
"/docker-entrypoint.sh",
]
depends_on:
- passbolt-database
security_opt:
- no-new-privileges:true
cap_drop:
- NET_RAW
restart: unless-stopped
passbolt-database:
image: docker.io/library/mariadb:12.2
container_name: passbolt-database
hostname: passbolt-database
networks: networks:
passbolt_backend: passbolt_backend:
external: true
passbolt_frontend:
external: true
volumes: volumes:
passbolt-database: - passbolt-database:/var/lib/mysql
passbolt-gpg: environment:
passbolt-jwt: MYSQL_RANDOM_ROOT_PASSWORD: "true"
''; MYSQL_DATABASE: $PASSBOLT_MYSQL_DATABASE
MYSQL_USER: $PASSBOLT_MYSQL_USER
MYSQL_PASSWORD: $PASSBOLT_MYSQL_PASSWORD
security_opt:
- no-new-privileges:true
cap_drop:
- NET_RAW
restart: unless-stopped
systemd.services."${container_name}" = { volumes:
description = "Podman container : ${container_name}"; passbolt-database:
after = [ "network.target" "traefik.service" "pi-hole.service" ]; passbolt-gpg:
requires = [ "traefik.service" ]; passbolt-jwt:
wantedBy = [ "multi-user.target" ];
path = [ pkgs.podman pkgs.coreutils ];
serviceConfig = { networks:
User = "numbus-admin"; passbolt_frontend:
Environment = [ "XDG_RUNTIME_DIR=/run/user/1000" ]; name: passbolt_frontend
Type = "exec"; driver: bridge
TimeoutStartSec = "600"; ipam:
ExecStartPre = [ config:
"${pkgs.bash}/bin/bash -c 'sleep $((RANDOM % 180))'" - subnet: "10.89.12.0/24"
"-${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} pull" gateway: "10.89.12.254"
]; passbolt_backend:
ExecStart = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} up --remove-orphans"; name: passbolt_backend
ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down"; driver: bridge
Restart = "on-failure"; ipam:
RestartSec = "5m"; config:
StartLimitBurst = "3"; - subnet: "10.89.13.0/24"
}; gateway: "10.89.13.254"
}; '';
systemd.services."update-${container_name}" = {
description = "Update ${container_name} container";
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.systemd}/bin/systemctl restart ${container_name}.service";
};
};
systemd.timers."update-${container_name}" = {
timerConfig = {
OnCalendar = "02:00";
RandomizedDelaySec = "60m";
Unit = "update-${container_name}.service";
};
wantedBy = [ "timers.target" ];
};
};
} }
modules/services/pi-hole.nix
+56 -101
View File
@@ -1,106 +1,61 @@
{ config, pkgs, ... }: { config, pkgs, lib, ... }:
with lib;
let let
container_name = "pi-hole"; helper = import ./lib.nix { inherit config pkgs lib; };
compose_file = "podman/pi-hole/compose.yaml"; cfg = config.numbus.services.pi-hole;
config_dir = "/mnt/config/pi-hole";
in in
{ helper.mkPodmanService {
config = { name = "pi-hole";
environment.etc."${compose_file}".text = description = "Pi-Hole, the ads black hole";
/* defaultPort = "4443";
yaml pod = "false";
*/ scheme = "https";
'' dependencies = [ "traefik.service" "${config.numbus.services.dns}.service" ];
services: delaySec = 10;
pihole:
image: docker.io/pihole/pihole:latest
container_name: pi-hole
networks:
pi-hole_frontend:
ports:
# DNS Ports
- "53:53/tcp"
- "53:53/udp"
environment:
TZ: $TZ
FTLCONF_webserver_api_password: $FTLCONF_webserver_api_password
FTLCONF_dns_hosts: |
$HOME_SERVER_IP frigate.$DOMAIN_NAME
$HOME_SERVER_IP gitea.$DOMAIN_NAME
$HOME_SERVER_IP home-assistant.$DOMAIN_NAME
$HOME_SERVER_IP immich.$DOMAIN_NAME
$HOME_SERVER_IP it-tools.$DOMAIN_NAME
$HOME_SERVER_IP nextcloud.$DOMAIN_NAME
$HOME_SERVER_IP nextcloud-aio.$DOMAIN_NAME
$HOME_SERVER_IP passbolt.$DOMAIN_NAME
$HOME_SERVER_IP pi-hole.$DOMAIN_NAME
$HOME_SERVER_IP traefik.$DOMAIN_NAME
FTLCONF_dhcp_active: "false"
FTLCONF_dns_upstreams: 9.9.9.9;149.112.112.112
FTLCONF_ntp_ipv4_active: "false"
FTLCONF_ntp_ipv6_active: "false"
FTLCONF_ntp_sync_active: "false"
volumes:
- ${config_dir}:/etc/pihole
cap_add:
- SYS_NICE
labels:
- traefik.enable=true
- traefik.docker.network=pi-hole_frontend
- traefik.http.services.pihole.loadbalancer.server.port=80
- traefik.http.services.pihole.loadbalancer.server.scheme=http
- traefik.http.routers.pihole-https.entrypoints=websecure
- traefik.http.routers.pihole-https.rule=Host(`pi-hole.$DOMAIN_NAME`)
- traefik.http.routers.pihole-https.tls=true
- traefik.http.routers.pihole-https.tls.certresolver=cloudflare
restart: unless-stopped
networks: composeText = ''
pi-hole_frontend: services:
external: true pi-hole:
''; image: docker.io/pihole/pihole:latest
container_name: pi-hole
systemd.services."${container_name}" = { hostname: pi-hole
description = "Podman container : ${container_name}"; network_mode: pasta
after = [ "network.target" "traefik.service" ]; ports:
requires = [ "traefik.service" ]; - "${cfg.port}:443/tcp"
wantedBy = [ "multi-user.target" ]; - "53:53/tcp"
path = [ pkgs.podman pkgs.coreutils ]; - "53:53/udp"
environment:
serviceConfig = { PIHOLE_UID: '1000'
User = "numbus-admin"; PIHOLE_GID: '1000'
Environment = [ "XDG_RUNTIME_DIR=/run/user/1000" ]; TZ: $TZ
Type = "exec"; FTLCONF_webserver_api_password: $FTLCONF_webserver_api_password
TimeoutStartSec = "600"; FTLCONF_webserver_domain: ${cfg.subdomain}.${config.numbus.services.domain}
ExecStartPre = [ FTLCONF_dns_upstreams: 9.9.9.9;149.112.112.112
"${pkgs.bash}/bin/bash -c 'sleep 20'" FTLCONF_dns_hosts: |
"-${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} pull" ${lib.concatStringsSep "" (lib.mapAttrsToList (name: service:
]; if builtins.isAttrs service && service ? enable && service.enable && service ? subdomain then
ExecStart = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} up --remove-orphans"; " $HOME_SERVER_IP ${service.subdomain}.${config.numbus.services.domain}\n"
ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down"; else
Restart = "on-failure"; ""
RestartSec = "5m"; ) config.numbus.services)}
StartLimitBurst = "3"; # TODO : get revServers to work
}; # FTLCONF_dns_revServers: |
}; # true,$HOME_ROUTER_SUBNET,$HOME_ROUTER_IP,${config.numbus.services.domain}
# true,$HOME_VPN_SUBNET,$HOME_VPN_IP,${config.numbus.services.domain}
systemd.services."update-${container_name}" = { FTLCONF_dns_listeningMode: "BIND"
description = "Update ${container_name} container"; FTLCONF_dns_domain_name: "${config.numbus.services.domain}"
serviceConfig = { FTLCONF_dns_domain_local: "true"
Type = "oneshot"; FTLCONF_dhcp_active: "false"
ExecStart = "${pkgs.systemd}/bin/systemctl restart ${container_name}.service"; FTLCONF_ntp_ipv4_active: "false"
}; FTLCONF_ntp_ipv6_active: "false"
}; FTLCONF_ntp_sync_active: "false"
volumes:
systemd.timers."update-${container_name}" = { - ${cfg.configDir}:/etc/pihole
timerConfig = { cap_add:
OnCalendar = "02:00"; - SYS_NICE
RandomizedDelaySec = "60m"; restart: unless-stopped
Unit = "update-${container_name}.service"; '';
}; }
wantedBy = [ "timers.target" ];
};
};
}
modules/services/traefik.nix
+116 -188
View File
@@ -1,211 +1,139 @@
{ config, pkgs, ... }: { config, pkgs, lib, ... }:
with lib; with lib;
let let
helper = import ./lib.nix { inherit config pkgs lib; };
cfg = config.numbus.services.traefik; cfg = config.numbus.services.traefik;
containerName = "traefik";
pod = "false";
composeFile = "podman/traefik/compose.yaml";
in in
{ helper.mkPodmanService {
options.numbus.services.traefik = { name = "traefik";
enable = mkOption { description = "Traefik reverse proxy, one to rule them all";
type = lib.types.bool; pod = "false";
default = true; reverseProxied = false;
example = true; dependencies = [ "${config.numbus.services.dns}.service" ];
description = "Traefik reverse-proxy"; configDir = false;
}; delaySec = 10;
extraOptions = {
enable.default = true;
staticConfigFile = mkOption { staticConfigFile = mkOption {
type = types.str; type = types.str;
default = "traefik/config.yaml"; default = "traefik/config.yaml";
example = "traefik/config.yaml"; description = "The path for Traefik's static configuration file, relative to /etc/";
description = "The directory path where Traefik's static configuration file will be stored, prefixed by /etc/";
}; };
dataDir = mkOption {
type = types.str;
default = "/mnt/config/traefik";
example = "/mnt/config/traefik";
description = "The directory where traefik's data (i.e. SSL certificates) will be stored";
};
subdomain = mkOption {
type = types.str;
default = "traefik";
example = "traefik";
description = "The subdomain that traefik will use (i.e. your-subdomain.your-domain.com)";
};
logLevel = mkOption { logLevel = mkOption {
type = types.enum [ "TRACE" "DEBUG" "INFO" "WARN" "ERROR" "FATAL" ]; type = types.enum [ "TRACE" "DEBUG" "INFO" "WARN" "ERROR" "FATAL" ];
default = "ERROR"; default = "ERROR";
example = "ERROR"; description = "The level of detail Traefik should print in the logs.";
description = "The level of detail Traefik should print in the logs : TRACE, DEBUG, INFO, WARN, ERROR, FATAL (from most to least verbose)";
}; };
}; };
config = mkIf cfg.enable { composeText = ''
environment.etc."${composeFile}".text = services:
/* traefik:
yaml image: docker.io/library/traefik:latest
*/ container_name: traefik
'' hostname: traefik
services: network_mode: pasta
traefik: ports:
image: docker.io/library/traefik:latest - "80:80/tcp"
container_name: traefik - "443:443/tcp"
hostname: traefik volumes:
network_mode: pasta - /run/user/1000/podman/podman.sock:/run/docker.sock:ro
ports: - /etc/${cfg.staticConfigFile}:/etc/traefik/traefik.yaml:ro
- "80:80/tcp" - ${config.numbus.traefikDynamicConfigDir}:/etc/traefik/conf:ro
- "443:443/tcp" - ${cfg.dataDir}:/var/traefik/certs:rw
volumes: environment:
- /run/user/1000/podman/podman.sock:/run/docker.sock:ro - CF_DNS_API_TOKEN=$CF_DNS_API_TOKEN
- ${cfg.staticConfigFile}:/etc/traefik/traefik.yaml:ro security_opt:
- ${config.numbus.services.traefikDynamicConfigDir}:/etc/traefik/conf:ro - no-new-privileges:true
- ${cfg.dataDir}:/var/traefik/certs:rw restart: unless-stopped
environment: '';
- CF_DNS_API_TOKEN=$CF_DNS_API_TOKEN
security_opt:
- no-new-privileges:true
restart: unless-stopped
'';
environment.etc."${cfg.staticConfigFile}".text = extraConfig = {
/* environment.etc."${cfg.staticConfigFile}".text = ''
yaml global:
*/ checkNewVersion: false
'' sendAnonymousUsage: false
global: log:
checkNewVersion: false level: ${cfg.logLevel}
sendAnonymousUsage: false accesslog: {}
log: api:
level: ${cfg.logLevel} dashboard: false
accesslog: {} insecure: false
api: entryPoints:
dashboard: false web:
insecure: false address: :80
entryPoints: http:
web: redirections:
address: :80 entryPoint:
http: to: websecure
redirections: scheme: https
entryPoint: websecure:
to: websecure address: :443
scheme: https forwardedHeaders:
websecure: trustedIPs:
address: :443 - "127.0.0.1/32"
forwardedHeaders: - "10.0.0.0/8"
trustedIPs: - "192.168.0.0/16"
- "127.0.0.1/32" - "172.16.0.0/12"
- "10.0.0.0/8" certificatesResolvers:
- "192.168.0.0/16" cloudflare:
- "172.16.0.0/12" acme:
certificatesResolvers: email: ${config.numbus.email.administratorEmail}
cloudflare: storage: /var/traefik/certs/cloudflare-acme.json
acme: caServer: "https://acme-v02.api.letsencrypt.org/directory"
email: ${config.numbus.email.administratorEmail} dnsChallenge:
storage: /var/traefik/certs/cloudflare-acme.json provider: cloudflare
caServer: "https://acme-v02.api.letsencrypt.org/directory" resolvers:
dnsChallenge: - "1.1.1.1:53"
provider: cloudflare - "9.9.9.9:53"
resolvers: serversTransport:
- "1.1.1.1:53" insecureSkipVerify: true
- "9.9.9.9:53" providers:
serversTransport: file:
insecureSkipVerify: true directory: "/etc/traefik/conf/"
providers: watch: true
file: '';
directory: "/etc/traefik/conf/"
watch: true
'';
environment.etc."${config.numbus.services.traefikDynamicConfigDir}/secureHeaders.yaml".text = environment.etc."${config.numbus.traefikDynamicConfigDir}/secureHeaders.yaml".text = ''
/* http:
yaml middlewares:
*/ secureHeaders:
'' headers:
http: FrameDeny: true
middlewares: AccessControlAllowMethods: 'GET,OPTIONS,PUT'
secureHeaders: AccessControlAllowOriginList:
headers: - origin-list-or-null
FrameDeny: true AccessControlMaxAge: 100
AccessControlAllowMethods: 'GET,OPTIONS,PUT' AddVaryHeader: true
AccessControlAllowOriginList: BrowserXssFilter: true
- origin-list-or-null ContentTypeNosniff: true
AccessControlMaxAge: 100 ForceSTSHeader: true
AddVaryHeader: true STSIncludeSubdomains: true
BrowserXssFilter: true STSPreload: true
ContentTypeNosniff: true ContentSecurityPolicy: default-src 'self' 'unsafe-inline'
ForceSTSHeader: true CustomFrameOptionsValue: SAMEORIGIN
STSIncludeSubdomains: true ReferrerPolicy: same-origin
STSPreload: true PermissionsPolicy: vibrate 'self'
ContentSecurityPolicy: default-src 'self' 'unsafe-inline' STSSeconds: 315360000
CustomFrameOptionsValue: SAMEORIGIN '';
ReferrerPolicy: same-origin
PermissionsPolicy: vibrate 'self'
STSSeconds: 315360000
'';
environment.etc."${config.numbus.services.traefikDynamicConfigDir}/secureTLS.yaml".text = environment.etc."${config.numbus.traefikDynamicConfigDir}/secureTLS.yaml".text = ''
/* tls:
yaml options:
*/ secureTLS:
'' minVersion: VersionTLS12
tls: sniStrict: true
options: curvePreferences:
secureTLS: - CurveP521
minVersion: VersionTLS12 - CurveP384
sniStrict: true cipherSuites:
curvePreferences: - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
- CurveP521 - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
- CurveP384 - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
cipherSuites: '';
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
'';
systemd.services."${containerName}" = {
description = "Podman container : ${containerName}";
requires = [ "network.target" ];
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
path = [ pkgs.podman pkgs.podman-compose pkgs.coreutils pkgs.sudo ];
serviceConfig = {
Type = "exec";
ExecStartPre = "bash -c 'sleep $((RANDOM % 180))'";
ExecStart = "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} up --remove-orphans";
ExecStop = "sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} down";
Restart = "on-failure";
RestartSec = "1m";
StartLimitBurst = "5";
};
};
systemd.services."update-${containerName}" = {
description = "Update ${containerName} container";
path = [ pkgs.podman pkgs.podman-compose pkgs.sudo ];
serviceConfig = {
Type = "oneshot";
ExecStart = [
"sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} pull"
"sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} down"
"sudo -u numbus-admin podman-compose --in-pod ${pod} -f /etc/${composeFile} up -d"
];
};
};
systemd.timers."update-${containerName}" = {
timerConfig = {
OnCalendar = "02:00";
RandomizedDelaySec = "60m";
Unit = "update-${containerName}.service";
};
wantedBy = [ "timers.target" ];
};
}; };
} }