Blunkall-Technologies/Olympus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add pihole and recursive dns

Browse Source
This commit is contained in:
blaknull
2024-11-11 16:09:48 -06:00
parent 9c10fa694d
commit f1a1e11992
8 changed files with 180 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
system-config/services/containers/authentik/default.nix
View File

@@ -8,7 +8,7 @@
config = lib.mkIf config.sysconfig.opts.virtualization.authentik.enable {
sops.templates.".env" = {
sops.templates."authentik.env" = {
content = ''
POSTGRES_DB=authentik-db
POSTGRES_USER=authentik-admin

2
system-config/services/containers/default.nix
View File

@@ -6,5 +6,7 @@
# ./authentik-nix
./authentik
./nginx
./jellyfin
./pihole
];
}

37
system-config/services/containers/jellyfin/default.nix
View File

@@ -0,0 +1,37 @@
{ config, lib, ... }: {
options.sysconfig.opts.virtualization.jellyfin.enable = lib.options.mkOption {
type = lib.types.bool;
default = false;
};
config = lib.mkIf config.sysconfig.opts.virtualization.jellyfin.enable {
containers.jellyfin = {
autoStart = true;
privateNetwork = true;
hostAddress = "192.168.100.10";
localAddress = "192.168.100.14";
bindMounts = {
"/etc/jellyfin" = {
hostPath = "/ssd1/Jellyfin";
isReadOnly = false;
};
};
config = {
services.jellyfin = {
enable = true;
dataDir = "/etc/jellyfin/data";
configDir = "/etc/jellyfin/config";
logDir = "/etc/jellyfin/log";
openFirewall = true;
};
};
};
};
}

85
system-config/services/containers/pihole/default.nix
View File

@@ -0,0 +1,85 @@
{ config, lib, pkgs, ... }: {
options.sysconfig.opts.virtualization.pihole.enable = lib.options.mkOption {
type = lib.types.bool;
default = false;
};
config = lib.mkIf config.sysconfig.opts.virtualization.pihole.enable {
sops.templates."pihole.env" = {
content = ''
WEBPASSWORD=${config.sops.placeholder."pihole/pass"}
'';
path = "/ssd1/Pihole/.env";
};
systemd.services.launchPihole = {
enable = true;
wantedBy = [ "multi-user.target" ];
script = ''
cd /ssd1/Pihole
${pkgs.docker-compose}/bin/docker-compose up
'';
};
containers.unbound = {
autoStart = true;
privateNetwork = true;
hostAddress = "192.168.100.10";
localAddress = "192.168.100.15";
config = {
services.unbound = {
enable = true;
settings = {
server = {
interface = [ "127.0.0.1" ];
port = 5335;
do-ipv4 = "yes";
do-udp = "yes";
do-tcp = "yes";
do-ipv6 = "no";
perfer-ipv6 = "no";
harden-glue = "yes";
harden-dnssec-stripped = "yes";
use-caps-for-id = "no";
edns-buffer-size = 1232;
prefetch = "yes";
num-threads = 1;
so-rcvbuf = "1m";
private-address = [
"192.168.0.0/16"
"169.254.0.0/16"
"172.16.0.0/12"
"10.0.0.0/8"
"fd00::/8"
"fe80::/10"
];
};
};
};
};
};
};
}

48
system-config/services/containers/traefik/default.nix
View File

@@ -14,9 +14,9 @@
hostAddress = "192.168.100.10";
localAddress = "192.168.100.11";
forwardPorts = [
{
containerPort = 80;
hostPort = 80;
{
containerPort = 80;
hostPort = 80;
}
{
containerPort = 443;
@@ -87,7 +87,13 @@
websecure = {
address = ":443";
asDefault = true;
http.tls.certResolver = "cloudflare";
http.tls = {
certResolver = "cloudflare";
domains = {
main = "blunkall.us";
sans = [ "*.blunkall.us" "blunkall.us" ];
};
};
};
};
log = {
@@ -119,33 +125,48 @@
dynamicConfigOptions = {
http = {
routers = {
homepageSecure = {
homepageSecure = {
entryPoints = [ "localsecure" "websecure" ];
rule = "Host(`blunkall.us`) || Host(`www.blunkall.us`)";
service = "homepage";
middlewares = [
"authentik"
];
tls = {
/*tls = {
certResolver = "cloudflare";
domains = {
main = "blunkall.us";
sans = [ "*.blunkall.us" "*.local.blunkall.us" ];
sans = [ "*.blunkall.us" ];
};
};
};*/
};
jellyfin = {
entryPoints = [ "localsecure" "websecure" ];
rule = "Host(`jellyfin.blunkall.us`)";
service = "jellyfin";
/*middlewares = [
"authentik"
];*/
/*tls = {
certResolver = "cloudflare";
domains = {
main = "blunkall.us";
sans = [ "*.blunkall.us" ];
};
};*/
};
auth = {
entryPoints = [ "localsecure" "websecure" ];
rule = "Host(`auth.blunkall.us`)";
service = "authentik";
tls = {
/*tls = {
certResolver = "cloudflare";
domains = {
main = "auth.blunkall.us";
sans = [ "*.blunkall.us" "*.local.blunkall.us" ];
main = "blunkall.us";
sans = [ "*.blunkall.us" ];
};
};
};*/
};
/*gitlab = {
@@ -200,6 +221,8 @@
homepage.loadBalancer.servers = [ { url = "http://192.168.100.13:80"; } ];
jellyfin.loadBalancer.servers = [ { url = "http://192.168.100.14:8096"; } ];
authentik.loadBalancer.servers = [ { url = "http://192.168.100.10:9000"; } ];
};
};
@@ -207,6 +230,7 @@
};
networking.firewall.allowedTCPPorts = [ 80 443 9080 9443 8080 ];
networking.firewall.allowedUDPPorts = [ 80 443 ];
system.stateVersion = "24.05";
};