Small refactor and added prowlarr

nixos/server/package-configs/akkoma/configuration.nix

@@ -0,0 +1,51 @@
+{
+  inputs,
+  outputs,
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
+  sops.secrets."releaseCookie".mode = "0440";
+  sops.secrets."releaseCookie".owner = config.users.users.akkoma.name;
+
+  users.groups.akkoma = {};
+
+  users.users = {
+    akkoma = {
+      isSystemUser = true;
+      group = "akkoma";
+    };
+  };
+
+  services.akkoma = {
+    enable = true;
+    package = pkgs.akkoma;
+    extraPackages = with pkgs; [ffmpeg exiftool imagemagick];
+    nginx = {
+      enableACME = true;
+      forceSSL = true;
+      serverName = "akkoma.gladtherescake.eu";
+    };
+    #dist.cookie._secret = config.sops.secrets."releaseCookie".path;
+    config = {
+      ":pleroma".":instance" = {
+        name = "GLaDTheresCake Akkoma";
+        email = "akkoma@gladtherescake.eu";
+        notify_email = "no-reply@akkoma.gladtherescake.eu";
+        emails.mailer = {
+          enabled = true;
+          adapter = "Swoosh.Adapters.Sendmail";
+          cmd_path = "sendmail";
+          cmd_args = "-N delay,failure,success";
+          qmail = true;
+        };
+        description = "Lillian's Akkoma server!";
+        languages = ["en" "nl"];
+        registrations_open = true;
+        max_pinned_statuses = 10;
+        cleanup_attachments = true;
+      };
+    };
+  };
+}

nixos/server/package-configs/aria2/configuration.nix

@@ -0,0 +1,26 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  users.users = {
+    aria2.extraGroups = ["jellyfin" "nextcloud"];
+  };
+  services.aria2 = {
+    enable = true;
+    downloadDir = "/var/lib/media";
+    rpcListenPort = 6969;
+  };
+
+  # services.nginx = {
+  #   virtualHosts = {
+  #     "aria2.gladtherescake.eu" = {
+  #       forceSSL = true;
+  #       enableACME = true;
+  #       locations."/" = {
+  #         proxyPass = "http://localhost:6800";
+  #       };
+  #     };
+  #   };
+  # };
+}

nixos/server/package-configs/forgejo/configuration.nix

@@ -0,0 +1,76 @@
+{
+  inputs,
+  outputs,
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
+  imports = [];
+  users.groups.gitea = {};
+  users.users = {
+    gitea = {
+      isSystemUser = true;
+      isNormalUser = false;
+      group = "gitea";
+      extraGroups = ["virtualMail"];
+    };
+  };
+  sops.secrets."mailpassunhash".mode = "0440";
+  sops.secrets."mailpassunhash".owner = config.users.users.virtualMail.name;
+
+  services.forgejo = {
+    enable = true;
+    user = "gitea";
+    group = "gitea";
+    stateDir = "/var/lib/gitea";
+    #TODO: different mail passwords for different services
+    mailerPasswordFile = config.sops.secrets."mailpassunhash".path;
+    database = {
+      user = "gitea";
+      name = "gitea";
+      type = "postgres";
+    };
+    settings = {
+      "cron.sync_external_users" = {
+        RUN_AT_START = true;
+        SCHEDULE = "@every 24h";
+        UPDATE_EXISTING = true;
+      };
+      mailer = {
+        ENABLED = true;
+        PROTOCOL = "sendmail";
+        FROM = "no-reply@git.lillianviolet.dev";
+        SENDMAIL_PATH = "${pkgs.system-sendmail}/bin/sendmail";
+        SENDMAIL_ARGS = "-bs";
+      };
+      repository = {
+        ENABLE_PUSH_CREATE_USER = true;
+      };
+      federation = {
+        ENABLED = true;
+      };
+      other = {
+        SHOW_FOOTER_VERSION = false;
+      };
+      service.DISABLE_REGISTRATION = true;
+      server = {
+        DOMAIN = "git.lillianviolet.dev";
+        ROOT_URL = "https://git.lillianviolet.dev/";
+        HTTP_PORT = 3218;
+      };
+    };
+  };
+
+  services.nginx = {
+    virtualHosts = {
+      "git.lillianviolet.dev" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://localhost:3218";
+        };
+      };
+    };
+  };
+}

nixos/server/package-configs/gotosocial/configuration.nix

@@ -0,0 +1,50 @@
+{
+  inputs,
+  outputs,
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
+  users.users.gotosocial.extraGroups = ["virtualMail"];
+
+  services.nginx = {
+    virtualHosts = {
+      "social.gladtherescake.eu" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://localhost:4257";
+        };
+      };
+    };
+  };
+
+  services.gotosocial = {
+    enable = true;
+    package = pkgs.gotosocial;
+    setupPostgresqlDB = true;
+    settings = {
+      application-name = "gotosocial";
+      host = "social.gladtherescake.eu";
+      bind-address = "localhost";
+      port = 4257;
+      protocol = "https";
+      storage-local-base-path = "/var/lib/gotosocial/storage";
+      instance-languages = ["en-gb" "nl"];
+      media-image-max-size = 41943040;
+      media-video-max-size = 209715200;
+      media-description-max-chars = 2000;
+      smtp-host = "localhost";
+      smtp-port = 587;
+      smtp-username = "no-reply@social.gladtherescake.eu";
+      smtp-password = config.sops.secrets."mailpassunhash".path;
+      smtp-from = "no-reply@social.gladtherescake.eu";
+    };
+  };
+
+  systemd.services."gotosocial" = {
+    requires = ["postgresql.service"];
+    after = ["postgresql.service"];
+  };
+}

nixos/server/package-configs/jellyfin/configuration.nix

@@ -0,0 +1,26 @@
+{
+  inputs,
+  outputs,
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
+  users.users.jellyfin.extraGroups = ["nextcloud"];
+
+  services.nginx = {
+    virtualHosts = {
+      "video.gladtherescake.eu" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://localhost:8096";
+        };
+      };
+    };
+  };
+
+  services.jellyfin = {
+    enable = true;
+  };
+}

nixos/server/package-configs/mail-server/configuration.nix

@@ -0,0 +1,108 @@
+{
+  inputs,
+  outputs,
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
+  imports = [
+    (builtins.fetchTarball {
+      # Pick a release version you are interested in and set its hash, e.g.
+      url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/24128c3052090311688b09a400aa408ba61c6ee5/nixos-mailserver-A-COMMIT-ID.tar.gz";
+      # To get the sha256 of the nixos-mailserver tarball, we can use the nix-prefetch-url command:
+      # release="nixos-23.05"; nix-prefetch-url "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/24128c3052090311688b09a400aa408ba61c6ee5/nixos-mailserver-A-COMMIT-ID.tar.gz" --unpack
+      sha256 = "1ngil2shzkf61qxiqw11awyl81cr7ks2kv3r3k243zz7v2xakm5c";
+    })
+  ];
+
+  sops.secrets."mailpass".mode = "0440";
+  sops.secrets."mailpass".owner = config.users.users.virtualMail.name;
+
+  # users.users = {
+  #   virtualMail = {
+  #     isSystemUser = true;
+  #     isNormalUser = false;
+  #     group = "virtualMail";
+  #   };
+  # };
+
+  mailserver = {
+    enable = true;
+    enableImap = true;
+    enableSubmission = true;
+    fqdn = "mail.gladtherescake.eu";
+    domains = [
+      "nextcloud.gladtherescake.eu"
+      "akkoma.gladtherescake.eu"
+      "social.gladtherescake.eu"
+      "lillianviolet.dev"
+      "git.lillianviolet.dev"
+    ];
+
+    loginAccounts = {
+      "no-reply@nextcloud.gladtherescake.eu" = {
+        hashedPasswordFile = config.sops.secrets."mailpass".path;
+      };
+      "no-reply@akkoma.gladtherescake.eu" = {
+        hashedPasswordFile = config.sops.secrets."mailpass".path;
+      };
+      "no-reply@social.gladtherescake.eu" = {
+        hashedPasswordFile = config.sops.secrets."mailpass".path;
+      };
+      "info@lillianviolet.dev" = {
+        hashedPasswordFile = config.sops.secrets."mailpass".path;
+        aliases = [
+          "@lillianviolet.dev"
+        ];
+        catchAll = [
+          "lillianviolet.dev"
+        ];
+      };
+      "no-reply@git.lillianviolet.dev" = {
+        hashedPasswordFile = config.sops.secrets."mailpass".path;
+      };
+    };
+
+    mailboxes = {
+      All = {
+        auto = "subscribe";
+        specialUse = "All";
+      };
+      Archive = {
+        auto = "subscribe";
+        specialUse = "Archive";
+      };
+      Drafts = {
+        auto = "subscribe";
+        specialUse = "Drafts";
+      };
+      Junk = {
+        auto = "subscribe";
+        specialUse = "Junk";
+      };
+      Sent = {
+        auto = "subscribe";
+        specialUse = "Sent";
+      };
+      Trash = {
+        auto = "no";
+        specialUse = "Trash";
+      };
+    };
+
+    rejectRecipients = [
+      "no-reply@nextcloud.gladtherescake.eu"
+      "no-reply@akkoma.gladtherescake.eu"
+      "no-reply@social.gladtherescake.eu"
+      "no-reply@git.lillianviolet.dev"
+    ];
+    certificateScheme = "acme-nginx";
+    certificateDomains = [
+      "imap.lillianviolet.dev"
+      "mail.lillianviolet.dev"
+      "pop3.lillianviolet.dev"
+      "lillianviolet.dev"
+    ];
+  };
+}

nixos/server/package-configs/nextcloud/configuration.nix

@@ -0,0 +1,121 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  sops.secrets."nextcloudadmin".mode = "0440";
+  sops.secrets."nextcloudadmin".owner = config.users.users.nextcloud.name;
+  sops.secrets."nextclouddb".mode = "0440";
+  sops.secrets."nextclouddb".owner = config.users.users.nextcloud.name;
+  sops.secrets."local.json".mode = "0440";
+  sops.secrets."local.json".owner = config.users.users.onlyoffice.name;
+
+  users.users = {
+    nextcloud.extraGroups = [config.users.groups.keys.name "aria2" "onlyoffice"];
+    aria2.extraGroups = ["nextcloud"];
+  };
+
+  # Enable Nginx
+  services.nginx = {
+    enable = true;
+
+    # Use recommended settings
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+
+    # Only allow PFS-enabled ciphers with AES256
+    sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
+
+    # Setup Nextcloud virtual host to listen on ports
+    virtualHosts = {
+      "nextcloud.gladtherescake.eu" = {
+        ## Force HTTP redirect to HTTPS
+        forceSSL = true;
+        ## LetsEncrypt
+        enableACME = true;
+      };
+      "onlyoffice.gladtherescake.eu" = {
+        forceSSL = true;
+        enableACME = true;
+      };
+    };
+  };
+
+  # Actual Nextcloud Config
+  services.nextcloud = {
+    enable = true;
+    hostName = "nextcloud.gladtherescake.eu";
+
+    package = pkgs.nextcloud28;
+
+    # Use HTTPS for links
+    https = true;
+
+    # Auto-update Nextcloud Apps
+    autoUpdateApps.enable = true;
+    # Set what time makes sense for you
+    autoUpdateApps.startAt = "05:00:00";
+    configureRedis = true;
+    maxUploadSize = "16G";
+
+    #Increase opcache string buffer
+    phpOptions."opcache.interned_strings_buffer" = "23";
+    # Further forces Nextcloud to use HTTPS
+    extraOptions = {
+      defaultPhoneRegion = "NL";
+      overwriteprotocol = "https";
+    };
+    appstoreEnable = true;
+    extraAppsEnable = true;
+    #extraApps = with config.services.nextcloud.package.packages.apps; {
+    # List of apps we want to install and are already packaged in
+    # https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/nextcloud/packages/nextcloud-apps.json
+    # inherit calendar contacts deck forms notes onlyoffice polls twofactor_nextcloud_notification unsplash;
+    #};
+
+    config = {
+      # Nextcloud PostegreSQL database configuration, recommended over using SQLite
+      dbtype = "pgsql";
+      dbuser = "nextcloud";
+      dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself
+      dbname = "nextcloud";
+      dbpassFile = config.sops.secrets."nextclouddb".path;
+
+      adminpassFile = config.sops.secrets."nextcloudadmin".path;
+      adminuser = "GLaDTheresCake";
+    };
+  };
+
+  services.onlyoffice = {
+    enable = true;
+    hostname = "onlyoffice.gladtherescake.eu";
+    #postgresHost = "/run/postgesql";
+    #postgresUser = "onlyoffice";
+    #postgresName = "onlyoffice";
+    #jwtSecretFile = config.sops.secrets."local.json".path;
+  };
+
+  services.rabbitmq = {
+    enable = true;
+  };
+
+  systemd.services."sops-nix.service" = {
+    before = [
+      "nextcloud-setup.service"
+      "postgresql.service"
+      "onlyoffice-converter.service"
+      "onlyoffice-docservice.service"
+      "nginx.service"
+      "phpfpm-nextcloud.service"
+      "redis-nextcloud.service"
+    ];
+  };
+
+  # Ensure that postgres is running before running the setup
+  systemd.services."nextcloud-setup" = {
+    requires = ["postgresql.service"];
+    after = ["postgresql.service"];
+  };
+}

nixos/server/package-configs/ombi/configuration.nix

@@ -0,0 +1,65 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  users.users = {
+    ombi.extraGroups = ["radarr" "sonarr" "aria2"];
+  };
+  services.ombi = {
+    enable = true;
+    port = 2368;
+  };
+
+  users.users = {
+    radarr.extraGroups = ["aria2"];
+    sonarr.extraGroups = ["aria2"];
+    prowlarr.extraGroups = ["aria2"];
+  };
+  #uses port 7878
+  services.radarr = {
+    enable = true;
+  };
+
+  #uses port 8989
+  services.sonarr = {
+    enable = true;
+  };
+
+  services.prowlarr = {
+    enable = true;
+  };
+
+  services.nginx = {
+    virtualHosts = {
+      "ombi.gladtherescake.eu" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://localhost:2368";
+        };
+      };
+      "radarr.gladtherescake.eu" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://localhost:7878";
+        };
+      };
+      "sonarr.gladtherescake.eu" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://localhost:8989";
+        };
+      };
+      "prowlarr.gladtherescake.eu" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://localhost:9696";
+        };
+      };
+    };
+  };
+}

nixos/server/package-configs/postgres/configuration.nix

@@ -0,0 +1,42 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  services.postgresql = {
+    # https://nixos.org/manual/nixos/stable/#module-postgresql
+    package = pkgs.postgresql_16;
+    enable = true;
+
+    # Ensure the database, user, and ownership is set
+    ensureDatabases = [
+      "nextcloud"
+      "onlyoffice"
+      "akkoma"
+      "gotosocial"
+      "gitea"
+    ];
+    ensureUsers = [
+      {
+        name = "nextcloud";
+        ensureDBOwnership = true;
+      }
+      {
+        name = "onlyoffice";
+        ensureDBOwnership = true;
+      }
+      {
+        name = "akkoma";
+        ensureDBOwnership = true;
+      }
+      {
+        name = "gotosocial";
+        ensureDBOwnership = true;
+      }
+      {
+        name = "gitea";
+        ensureDBOwnership = true;
+      }
+    ];
+  };
+}

nixos/server/package-configs/postgres/upgrade.nix

@@ -0,0 +1,36 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  environment.systemPackages = [
+    (let
+      # XXX specify the postgresql package you'd like to upgrade to.
+      # Do not forget to list the extensions you need.
+      newPostgres = pkgs.postgresql_16.withPackages (pp: [
+        # pp.plv8
+      ]);
+    in
+      pkgs.writeScriptBin "upgrade-pg-cluster" ''
+        set -eux
+        # XXX it's perhaps advisable to stop all services that depend on postgresql
+        systemctl stop postgresql
+
+        export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
+
+        export NEWBIN="${newPostgres}/bin"
+
+        export OLDDATA="${config.services.postgresql.dataDir}"
+        export OLDBIN="${config.services.postgresql.package}/bin"
+
+        install -d -m 0700 -o postgres -g postgres "$NEWDATA"
+        cd "$NEWDATA"
+        sudo -u postgres $NEWBIN/initdb -D "$NEWDATA"
+
+        sudo -u postgres $NEWBIN/pg_upgrade \
+          --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
+          --old-bindir $OLDBIN --new-bindir $NEWBIN \
+          "$@"
+      '')
+  ];
+}

nixos/server/package-configs/roundcube/configuration.nix

@@ -0,0 +1,40 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  # TODO: Figure out how to create packages for some plugins for roundcube!
+  # https://packagist.org/search/?query=roundcube
+  # https://discourse.nixos.org/t/roundcube-with-plugins/28292/7
+  services.roundcube = {
+    enable = true;
+    package = pkgs.roundcube.withPlugins (
+      plugins: [
+        plugins.contextmenu
+        plugins.carddav
+        plugins.custom_from
+        plugins.persistent_login
+        plugins.thunderbird_labels
+      ]
+    );
+    plugins = [
+      "contextmenu"
+      "carddav"
+      "custom_from"
+      "persistent_login"
+      "thunderbird_labels"
+    ];
+
+    # this is the url of the vhost, not necessarily the same as the fqdn of
+    # the mailserver
+    hostName = "webmail.lillianviolet.dev";
+    extraConfig = ''
+      # starttls needed for authentication, so the fqdn required to match
+      # the certificate
+      $config['smtp_server'] = "tls://${config.mailserver.fqdn}";
+      $config['smtp_user'] = "%u";
+      $config['smtp_pass'] = "%p";
+    '';
+  };
+}