Server & Podman

modules/nixos/system/hw/virt/default.nix

@@ -1,17 +1,15 @@
 { lib, config, pkgs, ... }: {
   config = lib.mkIf (config.syscfg.make.virt) {
-
     #environment.systemPackages = [ pkgs.qemu ];
     virtualisation = {
       #libvirtd.enable = true;
       # waydroid.enable = true;
       # lxd.enable = true;
-      docker = {
+      docker.enable = false;
+      podman = {
         enable = true;
-        rootless = {
-          enable = true;
-          setSocketVariable = true;
-        };
+        dockerSocket.enable = true;
+        defaultNetwork.dnsname.enable = true;
       };
     };
   };

modules/nixos/users/default.nix

@@ -19,6 +19,7 @@ in {
           "audio"
           "video"
           "docker"
+          "podman"
           "wireshark"
         ];
       }) config.syscfg.users);

modules/server/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+
+}

modules/server/docker/authentik.nix

@@ -0,0 +1,99 @@
+{ pkgs, ... }:{
+  project.name = "Authentik";
+
+  networks = {
+    internal = {
+      internal = true;
+      external = false;
+    };
+    external = { external = true; };
+  };
+
+  services = {
+
+    auth_postgresql.service = {
+      image = "postgres:14-alpine";
+      container_name = "auth_postgresql";
+      restart = "unless-stopped";
+      networks = [ "internal" ];
+      volumes = [ ];
+      environment = {
+        POSTGRES_PASSWORD = "/run/secrets/AUTHENTIK_POSTGRESQL__PASSWORD";
+        POSTGRES_USER = "authentik";
+        POSTGRES_DB = "authentik";
+      };
+    };
+
+    auth_redis.service = {
+      image = "redis:alpine";
+      container_name = "auth_redis";
+      restart = "unless-stopped";
+      networks = [ "internal" ];
+      volumes = [ ];
+      environment = { };
+      labels = { "traefik.enable" = "false"; };
+    };
+
+    auth_server.service = {
+      image = "ghcr.io/goauthentik/server:latest";
+      container_name = "auth_server";
+      restart = "unless-stopped";
+      networks = [ "internal" "external" ];
+      volumes = [
+        "${DATA_PATH}/authentik/media:/media"
+        "${DATA_PATH}/authentik/templates:/templates"
+      ];
+      environment = {
+        "AUTHENTIK_REDIS__HOST" = "auth_redis";
+        "AUTHENTIK_POSTGRESQL__HOST" = "auth_postgresql";
+        "AUTHENTIK_POSTGRESQL__USER" = "authentik";
+        "AUTHENTIK_POSTGRESQL__NAME" = "authentik";
+        "AUTHENTIK_POSTGRESQL__PASSWORD" = "AUTHENTIK_DB_PASSWORD";
+        "AUTHENTIK_SECRET_KEY" = "AUTHENTIK_SECRET_KEY";
+        "AUTHENTIK_EMAIL__HOST" = "${MAIL_SERVER_DOMAIN}";
+        "AUTHENTIK_EMAIL__PORT" = "587";
+        "AUTHENTIK_EMAIL__USERNAME" = "noreply@${MAIL_HOST_DOMAIN}";
+        "AUTHENTIK_EMAIL__PASSWORD" = "AUTHENTIK_EMAIL_PASSWORD";
+        "AUTHENTIK_EMAIL__USE_TLS" = "true";
+        "AUTHENTIK_EMAIL__USE_SSL" = "false";
+        "AUTHENTIK_EMAIL__TIMEOUT" = "10";
+        "AUTHENTIK_EMAIL__FROM" = "sso@noreply.${MAIL_HOST_DOMAIN}";
+      };
+      labels = {
+        "traefik.enable" = "true";
+        "traefik.http.routers.sso.entrypoints" = "web-secure";
+        "traefik.http.routers.sso.rule" = "Host(`sso.${HOST_DOMAIN}`)";
+        "traefik.http.routers.sso.tls" = "true";
+        "traefik.http.services.sso.loadbalancer.server.port" = "9000";
+        "traefik.docker.network" = "external";
+      };
+      command = "server";
+      service.ports = [
+        "9999:9000" # host:container
+      ];
+    };
+
+    auth_worker.service = {
+      image = "ghcr.io/goauthentik/server:latest";
+      container_name = "auth_worker";
+      restart = "unless-stopped";
+      networks = [ "internal" ];
+      volumes = [
+        "${DATA_PATH}/authentik/media:/media"
+        "${DATA_PATH}/authentik/templates:/templates"
+        "/var/run/docker.sock:/var/run/docker.sock"
+      ];
+      environment = {
+        "AUTHENTIK_REDIS__HOST" = "auth_redis";
+        "AUTHENTIK_POSTGRESQL__HOST" = "auth_postgresql";
+        "AUTHENTIK_POSTGRESQL__USER" = "authentik";
+        "AUTHENTIK_POSTGRESQL__NAME" = "authentik";
+        "AUTHENTIK_POSTGRESQL__PASSWORD" = "AUTHENTIK_DB_PASSWORD";
+        "AUTHENTIK_SECRET_KEY" = "AUTHENTIK_SECRET_KEY";
+      };
+      labels = { "traefik.enable" = "false"; };
+      command = "worker";
+      user = "root";
+    };
+  };
+}

modules/server/docker/cloud.nix

@@ -0,0 +1,143 @@
+{ pkgs, ... }:{
+  project.name = "Cloud";
+
+  networks = {
+    internal = {
+      internal = true;
+      external = false;
+    };
+    external = { external = true; };
+  };
+
+  services = {
+
+    cloud_nextcloud.service = {
+      image = "nextcloud:27";
+      container_name = "cloud";
+      restart = "unless-stopped";
+      networks = [ "external" ];
+      volumes = [
+        "${DATA_PATH}/data/nextcloud:/var/www/html"
+        "${DATA_PATH}/data/music:/media/music"
+        "${DATA_PATH}/data/video:/media/video"
+        "${DATA_PATH}/data/photo:/media/photo"
+      ];
+      tmpfs = [ "/tmp" ];
+      labels = {
+        "traefik.enable" = "true";
+        "traefik.http.routers.nextcloud.entrypoints" = "web-secure";
+        "traefik.http.routers.nextcloud.rule" = "Host(`cloud.${HOST_DOMAIN}`)";
+        "traefik.http.routers.nextcloud.tls" = "true";
+        "traefik.http.routers.nextcloud.middlewares" =
+          "sts_headers,nextcloud-caldav";
+
+        "traefik.http.middlewares.nextcloud-caldav.redirectregex.permanent" =
+          "true";
+        "traefik.http.middlewares.nextcloud-caldav.redirectregex.regex" =
+          "^https://(.*)/.well-known/(card|cal)dav";
+        "traefik.http.middlewares.nextcloud-caldav.redirectregex.replacement" =
+          "https://$\${1}/remote.php/dav/";
+        "traefik.http.middlewares.sts_headers.headers.stsSeconds" = "15552000";
+        "traefik.http.middlewares.sts_headers.headers.stsIncludeSubdomains" =
+          "true";
+      };
+    };
+
+    cloud_office.service = {
+      image = "collabora/code:latest";
+      container_name = "cloud_office";
+      restart = "unless-stopped";
+      networks = [ "external" ];
+      volumes = [ ];
+      environment = {
+        username = "COLLABORA_USER";
+        password = "COLLABORA_PASSWORD";
+        aliasgroup1 = "https://cloud.${HOST_DOMAIN}";
+        server_name = "office.${HOST_DOMAIN}";
+        VIRTUAL_HOST = "office.${HOST_DOMAIN}";
+        VIRTUAL_PORT = "9980";
+        VIRTUAL_PROTO = "http";
+        DONT_GEN_SSL_CERT = "true";
+        RESOLVE_TO_PROXY_IP = "true";
+        NETWORK_ACCESS = "internal";
+        extra_params = "--o:ssl.enable=false --o:ssl.termination=true";
+        dictionaries = "en fr de jp";
+      };
+      labels = {
+        "traefik.enable" = "true";
+        "traefik.http.routers.collabora.entrypoints" = "web-secure";
+        "traefik.http.routers.collabora.rule" = "Host(`office.${HOST_DOMAIN}`)";
+        "traefik.http.routers.collabora.tls" = "true";
+      };
+    };
+
+    cloud_etherpad.service = {
+      image = "etherpad/etherpad:latest";
+      container_name = "etherpad";
+      restart = "unless-stopped";
+      networks = [ "external" ];
+      volumes = [
+        "${DATA_PATH}/ether/etherpad/data:/opt/etherpad-lite/var"
+        "/${DATA_PATH}/ether/etherpad/APIKEY.txt:/opt/etherpad-lite/APIKEY.txt"
+      ];
+      environment = {
+        NODE_ENV = "production";
+        TITLE = "Helcel-Pad";
+        DB_TYPE = "mysql";
+        DB_HOST = DB_HOST;
+        DB_PORT = DB_PORT;
+        DB_NAME = "etherpad";
+        DB_USER = "ETHERPAD_DB_USER";
+        DB_PASS = "ETHERPAD_DB_PASSWORD";
+        DB_CHARSET = "utf8mb4";
+        DEFAULT_PAD_TEXT = "P A D";
+        PAD_OPTIONS_SHOW_LINE_NUMBERS = "true";
+        PAD_OPTIONS_USE_MONOSPACE_FONT = "true";
+        ADMIN_PASSWORD = "ETHERPAD_ADMIN_PASSWORD";
+        SKIN_VARIANTS = "super-dark-toolbar light-editor dark-background";
+      };
+      labels = {
+        "traefik.enable" = "true";
+        "traefik.http.routers.etherpad.entrypoints" = "web-secure";
+        "traefik.http.routers.etherpad.rule" = "Host(`pad.${HOST_DOMAIN}`)";
+        "traefik.http.routers.etherpad.tls" = "true";
+      };
+    };
+
+    cloud_ethercalc.service = {
+      image = "audreyt/ethercalc:latest";
+      container_name = "ethercalc";
+      restart = "unless-stopped";
+      networks = [ "external" "internal" ];
+      volumes = [
+        "${DATA_PATH}/ether/etherpad/data:/opt/etherpad-lite/var"
+        "/${DATA_PATH}/ether/etherpad/APIKEY.txt:/opt/etherpad-lite/APIKEY.txt"
+      ];
+      environment = {
+        NODE_ENV = "production";
+        TITLE = "Helcel-Calc";
+        REDIS_PORT_6379_TCP_ADDR = "redis";
+        REDIS_PORT_6379_TCP_PORT = "6379";
+        ADMIN_PASSWORD = "ETHERPAD_ADMIN_PASSWORD";
+        SKIN_VARIANTS = "super-dark-toolbar light-editor dark-background";
+      };
+      labels = {
+        "traefik.enable" = "true";
+        "traefik.http.routers.ethercalc.entrypoints" = "web-secure";
+        "traefik.http.routers.ethercalc.rule" = "Host(`calc.${HOST_DOMAIN}`)";
+        "traefik.http.routers.ethercalc.tls" = "true";
+      };
+    };
+
+    cloud_redis.service = {
+      image = "redis:latest";
+      container_name = "ethercalc-redis";
+      restart = "unless-stopped";
+      networks = [ "internal" ];
+      volumes = [ "${DATA_PATH}/ether/ethercalc/redis:/data" ];
+      environment = { };
+      labels = { "traefik.enable" = "false"; };
+    };
+
+  };
+}

modules/server/docker/sample.nix

@@ -0,0 +1,25 @@
+{ pkgs, ... }:{
+  project.name = "NEW";
+
+  networks = {
+    internal = {
+      internal = true;
+      external = false;
+    };
+    external = { external = true; };
+  };
+
+  services = {
+
+    NAME.service = {
+      image = "NAME:latest";
+      container_name = "NAME";
+      restart = "unless-stopped";
+      networks = [ "internal" ];
+      volumes = [ ];
+      environment = { };
+      labels = { "traefik.enable" = "false"; };
+    };
+
+  };
+}

modules/shared/syscfg/default.nix

@@ -12,63 +12,77 @@ let
       key = mkOption { type = types.str; };
     };
   };
+  netOpt = with lib; {
+    wlp = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+      };
+      nif = mkOption {
+        type = types.str;
+        default = "";
+      };
+    };
+    wg = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+      };
+      ip4 = mkOption {
+        type = types.str;
+        default = "";
+      };
+      ip6 = mkOption {
+        type = types.str;
+        default = "";
+      };
+    };
+  };
+  makeOpt = with lib; {
+    cli = mkOption {
+      type = types.bool;
+      default = true;
+    };
+    gui = mkOption {
+      type = types.bool;
+      default = false;
+    };
+    virt = mkOption {
+      type = types.bool;
+      default = true;
+    };
+    power = mkOption {
+      type = types.bool;
+      default = false;
+    };
+    game = mkOption {
+      type = types.bool;
+      default = false;
+    };
+    develop = mkOption {
+      type = types.bool;
+      default = false;
+    };
+  };
+  serverOpt = with lib; {
+    hostDomain = mkOption {type = types.str;};
+    mailDomain = mkOption {type = types.str;};
+    mailServer = mkOption {type = types.str;};
+
+    dbHost = mkOption {type = types.str; default = "localhost";};
+    dbPort = mkOption {type = types.str; default = "3306";};
+
+    configPath = mkOption {type=types.str; default= "/media/config";};
+    dataPath = mkOption {type=types.str; default= "/media/data";};
+    
+  };
 in with lib; {
   options.usercfg = userOpt;
   options.syscfg = {
     hostname = mkOption { type = types.str; };
     defaultUser = mkOption { type = types.str; };
-    make = {
-      cli = mkOption {
-        type = types.bool;
-        default = true;
-      };
-      gui = mkOption {
-        type = types.bool;
-        default = false;
-      };
-      virt = mkOption {
-        type = types.bool;
-        default = true;
-      };
-      power = mkOption {
-        type = types.bool;
-        default = false;
-      };
-      game = mkOption {
-        type = types.bool;
-        default = false;
-      };
-      develop = mkOption {
-        type = types.bool;
-        default = false;
-      };
-    };
-    net = {
-      wlp = {
-        enable = mkOption {
-          type = types.bool;
-          default = false;
-        };
-        nif = mkOption {
-          type = types.str;
-          default = "";
-        };
-      };
-      wg = {
-        enable = mkOption {
-          type = types.bool;
-          default = false;
-        };
-        ip4 = mkOption {
-          type = types.str;
-          default = "";
-        };
-        ip6 = mkOption {
-          type = types.str;
-          default = "";
-        };
-      };
-    };
+    make = makeOpt;
+    net = netOpt;
     users = mkOption {
       type = types.listOf (types.submodule { options = userOpt; });
       default = [ ];