split!

flake.nix

@@ -25,8 +25,11 @@
     nixosConfigurations = {
       distrust = lib.nixosSystem {
         system = "x86_64-linux";
-        modules = [./system ./services ./helpers/services.nix nixos-mailserver.nixosModules.default agenix.nixosModules.default];
+        modules = [./system/distrust ./services/distrust ./helpers/services.nix nixos-mailserver.nixosModules.default agenix.nixosModules.default { networking.hostName = "distrust"; }];
       };
+      distrust-mini = lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [./system/distrust-mini ./services/distrust-mini ./helpers/services.nix { networking.hostName = "distrust-mini"; }];
     };
   };
 }

secrets/secrets.nix

@@ -4,8 +4,9 @@ let
   users = [user];
 
   # Current host
-  system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEVvvjL4XXn6z0fOZnr1v0twoVBINi1FOES15JL/3vU4 root@distrust";
+  distrust = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEVvvjL4XXn6z0fOZnr1v0twoVBINi1FOES15JL/3vU4 root@distrust";
-  systems = [system];
+  distrust-mini = "";
+  systems = [distrust distrust-mini];
 
   all = users ++ systems;
 in {
@@ -27,5 +28,6 @@ in {
   "hidden_service/microbin".publicKeys = all;
   "hidden_service/nextcloud".publicKeys = all;
   "hidden_service/site".publicKeys = all;
+  "hidden_service/uptime-kuma".publicKeys = all;
   "hidden_service/vaultwarden".publicKeys = all;
 }

services/distrust-mini/default.nix

@@ -0,0 +1,10 @@
+{
+    imports = [
+        ../shared
+
+        # TOR bridge
+        ./tor.nix
+        # Status page in diff. data center for redundancy/resilience
+        ./uptime-kuma.nix
+    ]
+}

services/distrust-mini/tor.nix

@@ -0,0 +1,16 @@
+{
+  services.tor = {
+    enable = true;
+    relay = {
+      enable = true;
+      role = "bridge";
+    };
+    settings = {
+      Nickname = "Distrust Mini";
+      ContactInfo = "root@distrust.network";
+      ORPort = 8080;
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [8080];
+}

services/distrust-mini/uptime-kuma.nix

@@ -0,0 +1,28 @@
+let
+  kumaPort = 3001;
+in
+{
+  services.uptime-kuma = {
+    enable = true;
+    settings = {
+      PORT = kumaPort;
+    };
+  };
+
+  distrust.services."uptime-kuma" = {
+    url = "http://uptime.distrust.network";
+    onion = {
+      url = "http://uxp5y2l7g3jv2x7f4j5zv3j5x7z5z7z5z5z5z5z5z5z5z5z5z5z5z5z5z5.onion";
+      secretKey = null;
+    };
+    virtualHostConfig = ''
+      reverse_proxy localhost:${toString kumaPort}
+    '';
+    backup = {
+      enable = true;
+      paths = [
+        "/var/lib/uptime-kuma"
+      ];
+    };
+  };
+}

services/distrust/default.nix

@@ -1,7 +1,8 @@
 {
   imports = [
+    ../shared
+
     # Core System
-    ./borg.nix
     ./caddy.nix
 
     # Non-stateful services

services/shared/default.nix

@@ -0,0 +1,5 @@
+{
+    imports = [
+        ./borg.nix
+    ];
+}

system/configuration.nix

@@ -16,7 +16,7 @@ in {
   # Necessary for flake support
   nix.settings.experimental-features = ["nix-command" "flakes"];
 
-  networking.hostName = "distrust";
+  # General / Perf
   zramSwap.enable = true;
   boot.tmp.cleanOnBoot = true;
 

system/distrust-mini/default.nix

@@ -4,7 +4,7 @@
   ...
 }: {
   imports = [
-    ./configuration.nix
+    ../configuration.nix
 
     # Auto generated, do not edit. Replace per host
     ./hardware-configuration.nix

system/distrust/default.nix

@@ -0,0 +1,16 @@
+{
+  lib,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    ../configuration.nix
+
+    # Auto generated, do not edit. Replace per host
+    ./hardware-configuration.nix
+    ./networking.nix
+
+    "${modulesPath}/profiles/hardened.nix"
+    {environment.memoryAllocator.provider = lib.mkForce "libc";}
+  ];
+}