random stuff

hosts/oracle/o001/configuration.nix

@@ -5,4 +5,20 @@
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
   system.stateVersion = "25.05"; # Did you read the comment?
+  # boot.supportedFilesystems = [ "zfs" ];
+
+
+  boot.kernelParams = [ "net.ifnames=0" ];
+  networking.useDHCP = false;  # deprecated flag, set to false until removed
+  networking = {
+    defaultGateway = "10.0.0.1";
+    nameservers = [ "9.9.9.9" ];  
+    interfaces.eth0 = {
+      ipAddress = "149.130.211.142";
+      prefixLength = 24;
+    };
+  };
+
+  networking.firewall.enable = true;
+  networking.firewall.allowPing = true;
 }

hosts/oracle/o001/containers.nix

@@ -0,0 +1,63 @@
+{
+  config,
+  ...
+}:
+{
+
+  # NOTE some useful links
+  # nixos containers: https://blog.beardhatcode.be/2020/12/Declarative-Nixos-Containers.html
+  # https://nixos.wiki/wiki/NixOS_Containers
+  options = {};
+
+  imports = [
+    ./containers/tests.nix
+  ];
+
+  config = {
+    ## Give internet access
+    # networking.nat.enable = true;
+    # networking.nat.internalInterfaces = [ "ve-*" ];
+    # networking.nat.externalInterface = "eth0";
+
+    virtualisation.oci-containers.backend = "docker";
+
+    security.acme.acceptTerms = true;
+    security.acme.defaults.email = "admin@joshuabell.xyz";
+    services.nginx = {
+      enable = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      virtualHosts = {
+        "local.belljm.com" = {
+          # enableACME = true;
+          # forceSSL = true;
+          locations."/".proxyPass = "http://${config.containers.wasabi.localAddress}:80";
+        };
+        "127.0.0.1" = {
+          locations."/wasabi/" = {
+            extraConfig = ''
+              rewrite ^/wasabi/(.*) /$1 break;
+            '';
+            proxyPass = "http://${config.containers.wasabi.localAddress}:80/";
+          };
+          locations."/" = {
+            return = "404"; # or 444 for drop
+          };
+        };
+        "_" = {
+          default = true;
+          locations."/" = {
+            return = "404"; # or 444 for drop
+          };
+        };
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
+  };
+}

hosts/oracle/o001/containers/tests.nix

@@ -0,0 +1,39 @@
+{
+  ...
+}:
+{
+  options = { };
+
+  config = {
+    # Random test, visit http://192.168.100.11/
+    containers.wasabi = {
+      ephemeral = true;
+      autoStart = true;
+      privateNetwork = true;
+      hostAddress = "192.168.100.2";
+      localAddress = "192.168.100.11";
+      config =
+        { config, pkgs, ... }:
+        {
+          system.stateVersion = "24.11";
+          services.httpd.enable = true;
+          services.httpd.adminAddr = "foo@example.org";
+          networking.firewall = {
+            enable = true;
+            allowedTCPPorts = [ 80 ];
+          };
+        };
+    };
+
+    virtualisation.oci-containers.containers = {
+      # Example of defining a container, visit http://localhost:8085/
+      "nginx_simple" = {
+        # autoStart = true; this is default true
+        image = "nginx:latest";
+        ports = [
+          "127.0.0.1:8085:80"
+        ];
+      };
+    };
+  };
+}

hosts/oracle/o001/flake.nix

@@ -55,6 +55,7 @@
             modules = [
               ./configuration.nix
               ./hardware-configuration.nix
+              ./nginx.nix
               (
                 { pkgs, ... }:
                 {

hosts/oracle/o001/nginx.nix

@@ -0,0 +1,90 @@
+{
+  config,
+  ...
+}:
+{
+
+  # JUST A TEST TODO remove
+  containers.wasabi = {
+    ephemeral = true;
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = "192.168.100.2";
+    localAddress = "192.168.100.11";
+    config =
+      { config, pkgs, ... }:
+      {
+        system.stateVersion = "24.11";
+        services.httpd.enable = true;
+        services.httpd.adminAddr = "foo@example.org";
+        networking.firewall = {
+          enable = true;
+          allowedTCPPorts = [ 80 ];
+        };
+      };
+  };
+
+  security.acme.acceptTerms = true;
+  security.acme.email = "admin@joshuabell.xyz";
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    virtualHosts = {
+      # Redirect self IP to domain
+      "149.130.211.142" = {
+        locations."/" = {
+          return = "301 https://o001.joshuabell.xyz";
+        };
+      };
+
+      # "o001.joshuabell.xyz" = {
+      #   enableACME = true;
+      #   forceSSL = true;
+      #   locations = {
+      #     "/wasabi" = {
+      #       proxyPass = "http://192.168.100.11/";
+      #       extraConfig = ''
+      #         rewrite ^/wasabi/(.*) /$1 break;
+      #       '';
+      #     };
+      #     "/" = {
+      #       # return = "200 '<html>Hello World</html>'";
+      #       extraConfig = ''
+      #         default_type text/html;
+      #         return 200 '
+      #           <html>
+      #             <body style="width:100vw;height:100vh;overflow:hidden">
+      #               <div style="display: flex;width:100vw;height:100vh;justify-content: center;align-items:center;text-align:center;overflow:hidden">
+      #                 In the void you roam,</br>
+      #                 A page that cannot be found-</br>
+      #                 Turn back, seek anew.
+      #               </div>
+      #             </body>
+      #           </html>
+      #         ';
+      #       '';
+      #     };
+      #   };
+      # };
+
+      "_" = {
+        default = true;
+        locations."/" = {
+          return = "444"; # 404 for not found or 444 for drop
+        };
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    80 # web http
+    443 # web https
+  ];
+
+  networking.firewall.allowedUDPPorts = [
+    # 4242 # nebula
+  ];
+}

hosts/oracle/oracle.nix

@@ -3,6 +3,18 @@
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  boot.supportedFilesystems = [ "zfs" ];
+  boot.kernelParams = [ "net.ifnames=0" ];
+
+  networking.useDHCP = false;  # deprecated flag, set to false until removed
+  networking = {
+    defaultGateway = "10.0.0.1";
+    nameservers = [ "9.9.9.9" ];  
+    interfaces.eth0 = {
+      ipAddress = throw "set your own";
+      prefixLength = 24;
+    };
+  };
 
   # TODO disable after first startup with ssh keys
   services.openssh = {