ringofstorms/dotfiles
ringofstorms/dotfiles
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

bunch of updates to use more effecient DNS split paths

Browse source
This commit is contained in:
RingOfStorms (Joshua Bell) 2025-10-09 23:02:10 -05:00
parent 160be6071e
commit 1717f8e3e9
15 changed files with 151 additions and 1145 deletions
Download patch file Download diff file Expand all files Collapse all files

3
hosts/h001/containers/forgejo.nix
View file

@ -69,6 +69,9 @@ in
virtualHosts = {
# forgejo http traffic
"git.joshuabell.xyz" = {
addSSL = true;
sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations."/" = {
proxyPass = "http://10.0.0.2:3000";
};

5
hosts/h001/containers/opengist.nix
View file

@ -29,8 +29,9 @@ in
'';
services.nginx.virtualHosts."gist.joshuabell.xyz" = {
# enableACME = true;
# forceSSL = true;
addSSL = true;
sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = {
"/" = {
proxyWebsockets = true;

5
hosts/h001/containers/zitadel.nix
View file

@ -68,8 +68,9 @@ in
options = { };
config = {
services.nginx.virtualHosts."sso.joshuabell.xyz" = {
# enableACME = true;
# forceSSL = true;
addSSL = true;
sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = {
"/" = {
proxyWebsockets = true;

5
hosts/h001/mods/n8n.nix
View file

@ -6,8 +6,9 @@
config = {
services.nginx.virtualHosts = {
"n8n.joshuabell.xyz" = {
# enableACME = true;
# forceSSL = true;
addSSL = true;
sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = {
"/" = {
proxyWebsockets = true;

5
hosts/h001/mods/oauth2-proxy.nix
View file

@ -45,8 +45,9 @@ in
};
services.nginx.virtualHosts."sso-proxy.joshuabell.xyz" = {
# enableACME = true;
# forceSSL = true;
addSSL = true;
sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = {
"/" = {
proxyWebsockets = true;

5
hosts/h001/mods/openwebui.nix
View file

@ -17,8 +17,9 @@ in
options = { };
config = {
services.nginx.virtualHosts."chat.joshuabell.xyz" = {
# enableACME = true;
# forceSSL = true;
addSSL = true;
sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = {
"/" = {
proxyWebsockets = true;

7
hosts/h001/mods/trilium.nix
View file

@ -44,8 +44,9 @@ in
};
services.nginx.virtualHosts = {
"notes.joshuabell.xyz" = {
# enableACME = true;
# forceSSL = true;
addSSL = true;
sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = {
"/" = {
proxyWebsockets = true;
@ -54,6 +55,8 @@ in
};
};
};
# TODO revisit, am I going to use the native app or web version
# this is only needed for the app that can't handle the oauth flow
"trilium_overlay" = {
serverName = "h001.net.joshuabell.xyz";
listen = [

1115
hosts/linode/l001/flake.lock generated
View file

File diff suppressed because it is too large Load diff

12
hosts/linode/l001/flake.nix
View file

@ -1,9 +1,10 @@
{
inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
home-manager.url = "github:rycee/home-manager/release-24.11";
deploy-rs.url = "github:serokell/deploy-rs";
common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles";
ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?rev=39edfefa5871d07c9f88ce92a55995eb347d9b09";
common.inputs.home-manager.follows = "home-manager";
};
outputs =
@ -11,7 +12,6 @@
self,
nixpkgs,
common,
ros_neovim,
deploy-rs,
...
}:
@ -40,7 +40,6 @@
lib.nixosSystem {
modules = [
common.nixosModules.default
ros_neovim.nixosModules.default
./configuration.nix
./hardware-configuration.nix
./linode.nix
@ -49,11 +48,6 @@
(
{ config, pkgs, ... }:
{
environment.systemPackages = with pkgs; [
bitwarden
vaultwarden
];
ringofstorms_common = {
systemName = configuration_name;
general = {

26
hosts/linode/l001/headscale.nix
View file

@ -1,6 +1,5 @@
{ pkgs, ... }:
{
config = {
# TODO backup /var/lib/headscale data
# TODO https://github.com/gurucomputing/headscale-ui ?
@ -17,6 +16,31 @@
dns = {
magic_dns = true;
base_domain = "net.joshuabell.xyz";
extra_records =
let
h001ARecord = name: {
type = "A";
name = "${name}.joshuabell.xyz";
value = "100.64.0.13";
};
in
[
# {
# type = "A";
# name = "jellyfin.joshuabell.xyz";
# value = "100.64.0.13";
# }
h001ARecord "jellyfin"
h001ARecord "media"
h001ARecord "notes"
h001ARecord "chat"
h001ARecord "sso-proxy"
h001ARecord "n8n"
h001ARecord "sso"
h001ARecord "gist"
h001ARecord "git"
];
};
};
};

41
hosts/linode/l001/nginx.nix
View file

@ -4,6 +4,7 @@
{
security.acme.acceptTerms = true;
security.acme.email = "admin@joshuabell.xyz";
# security.acme.default.email = "admin@joshuabell.xyz";
services.nginx = {
enable = true;
recommendedGzipSettings = true;
@ -11,29 +12,16 @@
recommendedProxySettings = true;
recommendedTlsSettings = true;
virtualHosts = {
# default that is put first for fallbacks
# Note that order here doesn't matter it orders alphabetically so `0` puts it first
# I had an issue tha the first SSL port 443 site would catch any https traffic instead
# of hitting my default fallback and this fixes that issue and ensure this is hit instead
"001.linodes.joshuabell.xyz" = {
default = true;
enableACME = true;
forceSSL = true;
locations."/" = {
return = "444"; # 404 for not found or 444 for drop
};
};
"172.236.111.33" = {
locations."/" = {
return = "444";
};
};
"2600:3c06::f03c:95ff:fe1c:84d3" = {
locations."/" = {
return = "444";
};
};
# "172.236.111.33" = {
# locations."/" = {
# return = "444";
# };
# };
# "2600:3c06::f03c:95ff:fe1c:84d3" = {
# locations."/" = {
# return = "444";
# };
# };
"headscale.joshuabell.xyz" = {
enableACME = true;
forceSSL = true;
@ -42,6 +30,13 @@
proxyPass = "http://localhost:8080"; # headscale
};
};
"_" = {
rejectSSL = true;
default = true;
locations."/" = {
return = "444"; # 404 for not found or 444 for drop
};
};
};
};

2
hosts/lio/flake.nix
View file

@ -79,6 +79,8 @@
upkgs.ladybird
google-chrome
trilium-desktop
dig
traceroute
];
# Also allow this key to work for root user, this will let us use this as a remote builder easier
users.users.root.openssh.authorizedKeys.keys = [

5
hosts/oracle/o001/flake.nix
View file

@ -19,6 +19,7 @@
}:
let
configuration_name = "o001";
system = "aarch64-linux";
lib = nixpkgs.lib;
in
{
@ -30,7 +31,7 @@
];
nodes.${configuration_name} = {
hostname = "64.181.210.7";
targetPlatform = "aarch64-linux";
targetPlatform = system;
profiles.system = {
user = "root";
path = deploy-rs.lib.aarch64-linux.activate.nixos self.nixosConfigurations.${configuration_name};
@ -41,7 +42,7 @@
nixosConfigurations = {
nixos = self.nixosConfigurations.${configuration_name};
"${configuration_name}" = lib.nixosSystem {
system = "aarch64-linux";
inherit system;
modules = [
common.nixosModules.default
ros_neovim.nixosModules.default