root/flake
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

make .onion domains declarative, site updates, add helpers

Browse source
This commit is contained in:
root 2025-11-07 03:09:13 +00:00
parent b3d2a34bc0
commit 450a5ce1d6
25 changed files with 341 additions and 109 deletions
Download patch file Download diff file Expand all files Collapse all files

23
services/akkoma.nix
View file

@ -1,8 +1,13 @@
{pkgs, ...}: let
{
pkgs,
config,
...
}: let
fediPort = 8083;
onionUrl = "http://n5j5sq55iem2hzbgvkba5vwd5gx5qj2pkb7nxyginbtmnkah74rtulad.onion";
inherit ((pkgs.formats.elixirConf {}).lib) mkAtom;
in {
age.secrets."hidden_service/akkoma".file = ../secrets/hidden_service/akkoma;
services = {
akkoma = {
enable = true;
@ -35,14 +40,16 @@ in {
};
};
};
};
caddy.virtualHosts."https://social.distrust.network ${onionUrl}".extraConfig = ''
distrust.services."akkoma" = {
url = "https://social.distrust.network";
onion = {
url = "http://n5j5sq55iem2hzbgvkba5vwd5gx5qj2pkb7nxyginbtmnkah74rtulad.onion";
secretKey = config.age.secrets."hidden_service/akkoma".path;
};
virtualHostConfig = ''
reverse_proxy localhost:${toString fediPort}
header Onion-Loction ${onionUrl}
'';
tor.relay.onionServices."akkoma".map = [
80
];
};
}

12
services/caddy.nix
View file

@ -1,7 +1,13 @@
{
services = {
caddy.enable = true;
tor.enable = true;
services.caddy = {
enable = true;
#globalConfig = ''
# pki {
# ca local {
# name "Distrust CA"
# }
# }
#'';
};
networking.firewall.allowedTCPPorts = [80 443];

39
services/forgejo.nix
View file

@ -1,26 +1,29 @@
let
{config, ...}: let
forgejoPort = 8082;
onionUrl = "http://cr27k6asjs7skvjxs6smhqfam3wlvmft2f3iins44k6p6rmmfyolobqd.onion";
in {
services = {
forgejo = {
enable = true;
lfs.enable = false;
settings.server = {
DOMAIN = "git.distrust.network";
HTTP_PORT = forgejoPort;
ROOT_URL = "https://git.distrust.network/";
SSH_PORT = 292;
};
age.secrets."hidden_service/forgejo" = {
file = ../secrets/hidden_service/forgejo;
};
services.forgejo = {
enable = true;
lfs.enable = false;
settings.server = {
DOMAIN = "git.distrust.network";
HTTP_PORT = forgejoPort;
ROOT_URL = "https://git.distrust.network/";
SSH_PORT = builtins.head config.services.openssh.ports;
};
};
caddy.virtualHosts."https://git.distrust.network ${onionUrl}".extraConfig = ''
distrust.services."forgejo" = {
url = "https://git.distrust.network";
onion = {
url = "http://cr27k6asjs7skvjxs6smhqfam3wlvmft2f3iins44k6p6rmmfyolobqd.onion";
secretKey = config.age.secrets."hidden_service/forgejo".path;
};
virtualHostConfig = ''
reverse_proxy localhost:${toString forgejoPort}
header Onion-Location ${onionUrl}
'';
tor.relay.onionServices."forgejo".map = [
80
];
};
}

41
services/lldap.nix
View file

@ -1,25 +1,28 @@
let
onionUrl = "http://i3a47orggn2cebueja2jur66yjgyqd2y7kzthajar4ghuerbx2kzwqyd.onion";
{config, ...}: let
lldapPort = 8089;
in {
services = {
lldap = {
enable = true;
settings = {
http_url = "https://login.distrust.network";
ldap_user_email = "root@distrust.network";
ldap_user_dn = "root";
ldap_base_dn = "dc=distrust,dc=network";
ldap_user_pass = "VERY_SECURE";
};
age.secrets."hidden_service/lldap".file = ../secrets/hidden_service/lldap;
services.lldap = {
enable = true;
settings = {
http_url = "https://login.distrust.network";
http_port = lldapPort;
ldap_user_email = "root@distrust.network";
ldap_user_dn = "root";
ldap_base_dn = "dc=distrust,dc=network";
ldap_user_pass = "VERY_SECURE";
};
};
caddy.virtualHosts."https://login.distrust.network ${onionUrl}".extraConfig = ''
reverse_proxy localhost:17170
header Onion-Location ${onionUrl}
distrust.services."lldap" = {
url = "https://login.distrust.network";
onion = {
url = "http://i3a47orggn2cebueja2jur66yjgyqd2y7kzthajar4ghuerbx2kzwqyd.onion";
secretKey = config.age.secrets."hidden_service/lldap".path;
};
virtualHostConfig = ''
reverse_proxy localhost:${toString lldapPort}
'';
tor.relay.onionServices."lldap".map = [
80
];
};
}

27
services/nextcloud.nix
View file

@ -4,18 +4,21 @@
lib,
...
}: let
onionDomain = "znfdxs4e3rqvzxtkksiidomupgm2x44wtrzyxtpomczto3xg5qxpcbqd.onion";
onionUrl = "http://${onionDomain}";
onionHostName = "znfdxs4e3rqvzxtkksiidomupgm2x44wtrzyxtpomczto3xg5qxpcbqd.onion";
in {
age.secrets."nextcloud-admin-pass".file = ../secrets/nextcloud-admin-pass;
age.secrets = {
"nextcloud-admin-pass".file = ../secrets/nextcloud-admin-pass;
"hidden_service/nextcloud".file = ../secrets/hidden_service/nextcloud;
};
users.groups.nextcloud.members = ["nextcloud" "caddy"];
services = {
nextcloud = {
enable = true;
hostName = "cloud.distrust.network";
settings = {
trusted_domains = [onionDomain];
trusted_domains = [onionHostName];
trusted_proxies = ["127.0.0.1"];
maintenance_window_start = 1;
};
@ -38,7 +41,15 @@ in {
"listen.owner" = "caddy";
"listen.group" = "caddy";
};
caddy.virtualHosts."https://cloud.distrust.network ${onionUrl}".extraConfig = ''
};
distrust.services."nextcloud" = {
url = "https://cloud.distrust.network";
onion = {
url = "http://${onionHostName}";
secretKey = config.age.secrets."hidden_service/nextcloud".path;
};
virtualHostConfig = ''
# encode zstd gzip
root * ${config.services.nginx.virtualHosts."cloud.distrust.network".root}
@ -64,7 +75,7 @@ in {
X-Forwarded-For {remote_host}
X-Forwarded-Proto {scheme}
X-Forwarded-Host {host}
Onion-Loation ${onionUrl}
Onion-Loation http://${onionHostName}
}
@ -98,9 +109,5 @@ in {
file_server
'';
tor.relay.onionServices."nextcloud".map = [
80
];
};
}

39
services/paste.nix
View file

@ -1,27 +1,28 @@
let
{config, ...}: let
pastePort = 8087;
onionUrl = "http://s4h5nfnwwhzku55opxlqouobioibx4htwygnp2l4fkp256lur5s53rad.onion";
in {
services = {
microbin = {
enable = true;
settings = {
MICROBIN_PORT = pastePort;
MICROBIN_ENABLE_BURN_AFTER = true;
MICROBIN_QR = true;
MICROBIN_NO_LISTING = true;
MICROBIN_HIGHLIGHTSYNTAX = true;
MICROBIN_PUBLIC_PATH = "https://paste.distrust.network/";
};
age.secrets."hidden_service/microbin".file = ../secrets/hidden_service/microbin;
services.microbin = {
enable = true;
settings = {
MICROBIN_PORT = pastePort;
MICROBIN_ENABLE_BURN_AFTER = true;
MICROBIN_QR = true;
MICROBIN_NO_LISTING = true;
MICROBIN_HIGHLIGHTSYNTAX = true;
MICROBIN_PUBLIC_PATH = "https://paste.distrust.network/";
};
};
caddy.virtualHosts."https://paste.distrust.network ${onionUrl}".extraConfig = ''
distrust.services."microbin" = {
url = "https://paste.distrust.network";
onion = {
url = "http://s4h5nfnwwhzku55opxlqouobioibx4htwygnp2l4fkp256lur5s53rad.onion";
secretKey = config.age.secrets."hidden_service/microbin".path;
};
virtualHostConfig = ''
reverse_proxy localhost:${toString pastePort}
header Onion-Location ${onionUrl}
'';
tor.relay.onionServices."microbin".map = [
80
];
};
}

26
services/site.nix
View file

@ -1,15 +1,17 @@
let
onionUrl = "http://distrustdtp5qgbk2firlzfkkmu5p6v6acuh2ox454zd2i3ujdqad5yd.onion";
in {
services.caddy.virtualHosts = {
"https://distrust.network ${onionUrl}".extraConfig = ''
root * /etc/nixos/site
file_server
header Onion-Location ${onionUrl}
'';
{config, ...}: {
age.secrets."hidden_service/site" = {
file = ../secrets/hidden_service/site;
};
services.tor.relay.onionServices."site".map = [
80
];
distrust.services."site" = {
url = "https://distrust.network";
onion = {
url = "http://distrustdtp5qgbk2firlzfkkmu5p6v6acuh2ox454zd2i3ujdqad5yd.onion";
secretKey = config.age.secrets."hidden_service/site".path;
};
virtualHostConfig = ''
root * /etc/nixos/site
file_server
'';
};
}

4
services/tor.nix
View file

@ -10,6 +10,6 @@
ORPort = 9001;
};
};
networking.firewall.allowedTCPPorts = [ 9001 ];
networking.firewall.allowedTCPPorts = [9001];
}

34
services/vaultwarden.nix
View file

@ -1,26 +1,28 @@
{config, ...}: let
vaultPort = 8222;
onionUrl = "http://gfoqwlo4nmhcywzzyhfanhkf7hz64lkjayngfyrpbd7ohaucu3q4znqd.onion";
in {
age.secrets."vaultwarden.env".file = ../secrets/vaultwarden.env;
age.secrets = {
"vaultwarden.env".file = ../secrets/vaultwarden.env;
"hidden_service/vaultwarden".file = ../secrets/hidden_service/vaultwarden;
};
services = {
vaultwarden = {
enable = true;
config = {
DOMAIN = "https://vault.distrust.network";
ROCKET_PORT = vaultPort;
};
environmentFile = config.age.secrets."vaultwarden.env".path;
services.vaultwarden = {
enable = true;
config = {
DOMAIN = "https://vault.distrust.network";
ROCKET_PORT = vaultPort;
};
environmentFile = config.age.secrets."vaultwarden.env".path;
};
caddy.virtualHosts."https://vault.distrust.network ${onionUrl}".extraConfig = ''
distrust.services."vaultwarden" = {
url = "https://vault.distrust.network";
onion = {
url = "http://gfoqwlo4nmhcywzzyhfanhkf7hz64lkjayngfyrpbd7ohaucu3q4znqd.onion";
secretKey = config.age.secrets."hidden_service/vaultwarden".path;
};
virtualHostConfig = ''
reverse_proxy localhost:${toString vaultPort}
header Onion-Location ${onionUrl}
'';
tor.relay.onionServices."vaultwarden".map = [
80
];
};
}