initial commit here we are

appserver/server1/nixos/aliases.nix

@@ -0,0 +1,20 @@
+{ config, pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    tldr
+    eza
+    bat
+    ripgrep
+  ];
+  environment.shellAliases = {
+    vi = "nvim";
+    vim = "nvim";
+    h = "tldr";
+    # oxidized
+    ls = "eza -l";
+    cat = "bat";
+    grep = "rg";
+    top = "btm --color gruvbox";
+    # some tools
+  };
+}

appserver/server1/nixos/audiobook.nix

@@ -0,0 +1,33 @@
+{ configs, pkgs, ... }:
+let
+  audioBookShelfPort = 8000;
+in
+{
+  environment.systemPackages = [
+    pkgs.audiobookshelf
+  ];
+  systemd.services = {
+    audiobookshelf = {
+      description = "Audiobookshelf";
+      wantedBy = ["multi-user.target"];
+      restartIfChanged = true;
+      environment = {
+        PORT = builtins.toString audioBookShelfPort;
+        HOST = "0.0.0.0";
+      };
+      serviceConfig = {
+        Type = "simple";
+        Restart = "always";
+        RestartSec = "5";
+        ExecStart = ''
+                  ${pkgs.audiobookshelf}/bin/audiobookshelf
+                  '';
+      };
+    };
+  };
+  networking.firewall.allowedTCPPorts = [ audioBookShelfPort ];
+  #services.audiobookshelf.enable = true;
+  #services.audiobookshelf.host = 0.0.0.0 ;
+  #services.audiobookshelf.port = 8000;
+  #services.audiobookshelf.openFirewall = true;
+}

appserver/server1/nixos/calibre-web.nix

@@ -0,0 +1,16 @@
+{ config, pkgs, ... }:
+{
+  services.calibre-web = {
+    enable = true;
+    #group = "media";
+    listen = {
+        ip = "0.0.0.0";
+        port = 8083;
+    };
+    options = {
+      calibreLibrary = "/mnt/remote/media/books/calibre/";
+      enableBookUploading = true;
+    };
+  };
+  networking.firewall.allowedTCPPorts = [ 8083 ];
+}

appserver/server1/nixos/configuration-server1.nix

@@ -0,0 +1,77 @@
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ./starship.nix
+      ./podman.nix
+      ./libvirt.nix
+      ./wg.nix
+      ./jellfin.nix
+    ];
+
+  # Swap zram
+  zramSwap = {
+    enable = true;
+    algorithm = "zstd";
+  };
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.efiSupport = true;
+  boot.loader.grub.efiInstallAsRemovable = true;
+  boot.loader.efi.efiSysMountPoint = "/boot/";
+  boot.loader.grub.device = "nodev"; 
+
+  # Disks and Updates
+  services.fstrim.enable = true;
+
+  # Enable all unfree hardware support.
+  hardware.firmware = with pkgs; [ firmwareLinuxNonfree ];
+  hardware.enableAllFirmware = true;
+  hardware.enableRedistributableFirmware = true;
+  nixpkgs.config.allowUnfree = true;
+  services.fwupd.enable = true;
+
+  # Networking
+  networking.hostName = "server1"; 
+  networking.networkmanager.enable = true;  
+
+  # Set your time zone.
+  time.timeZone = "Europe/Oslo";
+
+
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "no";
+  };
+
+  users.users.geir = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" "networkmanager" "libvirt" "podman" ];
+    packages = with pkgs; [
+        bottom
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    neovim emacs nano curl htop glances neofetch 
+    wget git wireguard-tools 
+  ];
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  services.openssh.settings.PermitRootLogin = "yes";
+  services.openssh.settings.PasswordAuthentication = false; 
+
+  # Enable Netdata
+  services.netdata.enable = true;
+
+  # Firewall
+  networking.firewall.enable = true;
+  networking.firewall.allowedTCPPorts = [ 22 19999 ];
+  networking.firewall.allowedUDPPorts = [ 22 ];
+  system.stateVersion = "23.05"; 
+
+}

appserver/server1/nixos/configuration.nix

@@ -0,0 +1,96 @@
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ./starship.nix
+      ./aliases.nix
+      ./podman.nix
+      ./libvirt.nix
+      ./incus.nix
+      ./jellyfin.nix
+      ./tailscale.nix
+      ./calibre-web.nix
+      ./audiobook.nix
+      ./ollama.nix
+      #./soft-serve.nix
+    ];
+
+  # Swap zram
+  zramSwap = {
+    enable = true;
+    algorithm = "zstd";
+  };
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.efiSupport = true;
+  boot.loader.grub.efiInstallAsRemovable = true;
+  boot.loader.efi.efiSysMountPoint = "/boot/";
+  boot.loader.grub.device = "nodev"; 
+
+  # Disks and Updates
+  services.fstrim.enable = true;
+
+  # Mount remote filesystem
+  fileSystems."/mnt/remote/media" = {
+    device = "10.0.0.8:/mnt/storage/media";
+    fsType = "nfs";
+  };
+
+  # Enable all unfree hardware support.
+  hardware.firmware = with pkgs; [ firmwareLinuxNonfree ];
+  hardware.enableAllFirmware = true;
+  hardware.enableRedistributableFirmware = true;
+  nixpkgs.config.allowUnfree = true;
+  services.fwupd.enable = true;
+
+  # Networking
+  networking.hostName = "server1"; 
+  networking.networkmanager.enable = true;  
+
+  # Set your time zone.
+  time.timeZone = "Europe/Oslo";
+
+
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "no";
+  };
+
+  users.users.geir = {
+    isNormalUser = true;
+    extraGroups = [ "wheel"
+                    "networkmanager"
+                    "libvirt"
+                    "podman"
+                    "ollama"
+                    "writefreely"
+                  ];
+    packages = with pkgs; [
+        bottom
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    neovim emacs nano curl htop glances kitty 
+    wget git inxi nethogs fastfetch
+  ];
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  services.openssh.settings.PermitRootLogin = "yes";
+  services.openssh.settings.PasswordAuthentication = false; 
+
+
+  # Enable Netdata
+  services.netdata.enable = true;
+
+  # Firewall
+  networking.firewall.enable = true;
+  networking.firewall.allowedTCPPorts = [ 22 19999 23231];
+  networking.firewall.allowedUDPPorts = [ 22 23231 ];
+  system.stateVersion = "23.05"; 
+
+}

appserver/server1/nixos/incus.nix

@@ -0,0 +1,9 @@
+{ config, pkgs, ... }:
+{
+  virtualisation.incus.enable = true;
+
+  environment.systemPackages = with pkgs; [
+    incus
+    lxc
+  ];
+}

appserver/server1/nixos/jellyfin.nix

@@ -0,0 +1,6 @@
+{ config, pkgs, ... }:
+{
+  services.jellyfin.enable = true;
+  networking.firewall.allowedTCPPorts = [ 8096 8920 ];
+  networking.firewall.allowedUDPPorts = [ 1900 7359 ];
+}

appserver/server1/nixos/libvirt.nix

@@ -0,0 +1,8 @@
+{ config, pkgs, ... }:
+{
+  virtualisation.libvirtd.enable = true;
+  environment.systemPackages = with pkgs; [
+    qemu_kvm
+    libvirt
+  ];
+}

appserver/server1/nixos/nextcloud.nix

@@ -0,0 +1,30 @@
+{ pkgs, ... }:
+
+{
+  #  Nextcloud Config
+  environment.etc."nextcloud-admin-pass".text = "siKKerhet666";
+  services.nextcloud = {
+    enable = true;
+    hostName = "server1.tail807ea.ts.net";
+
+    # Ssl Let'encrypt
+    #hostName = "cloud.geokkjer.eu";
+    #https = true;
+
+    # Auto-update Nextcloud Apps
+    autoUpdateApps.enable = true;
+    # Set what time makes sense for you
+    autoUpdateApps.startAt = "05:00:00";
+    # enable redis cache
+    configureRedis = true;
+    # Create db locally , maybe not needed with sqlite
+    database.createLocally = true;
+    # Config options
+    config = {
+      dbtype = "sqlite";
+      adminpassFile = "/etc/nextcloud-admin-pass";
+      trustedProxies = [ "46.226.104.98" "100.75.29.52" ];
+      extraTrustedDomains = [ "localhost" "*.cloudflare.net" "*.tail807ea.ts.net" "46.226.104.98" "*.geokkjer.eu" ];
+    };
+  };
+}

appserver/server1/nixos/ollama.nix

@@ -0,0 +1,30 @@
+{ config, pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    ollama
+  ];
+  systemd.services = {
+    ollama = {
+      description = "Server for local large language models";
+      after = ["network-online.target"];
+      wantedBy = ["multi-user.target"];
+      environment = {
+        HOME = "%S/ollama";
+        OLLAMA_HOST = "0.0.0.0";
+        OLLAMA_MODELS = "%S/ollama/models";
+      };
+      serviceConfig = {
+        Type = "simple";
+        User = "ollama";
+        Group = "ollama";
+        Restart = "always";
+        RestartSec = "3";
+        WorkingDirectory = "/var/lib/ollama";
+        StateDirectory = [ "ollama" ];
+        DynamicUser = true;  
+        ExecStart = "${pkgs.ollama}/bin/ollama serve";
+      };
+    };
+  };
+  networking.firewall.allowedTCPPorts = [ 11434 ];
+}

appserver/server1/nixos/podman.nix

@@ -0,0 +1,13 @@
+{ config, pkgs, ... }:
+{
+  virtualisation.podman.enable = true;
+  virtualisation.podman.dockerCompat = true;
+  virtualisation.podman.dockerSocket.enable = true;
+
+  #virtualisation.defaultNetwork.settings.dns_enabled = true;
+  environment.systemPackages = with pkgs; [
+     podman-tui
+     podman-compose
+   ];
+
+ }

appserver/server1/nixos/soft-serve.nix

@@ -0,0 +1,48 @@
+{ pkgs, configs, ... }:
+  {
+    services.soft-serve.enable = true;
+    services.soft-serve.settings = {
+      name = "geokkjer's repos";
+      log_format = "text";
+      ssh = {
+        listen_addr = "0.0.0.0:23231";
+        public_url = "ssh://git.geokkjer.eu:23231";
+        max_timeout = 30;
+        idle_timeout = 120;
+      };
+      stats.listen_addr = ":23233";
+    };
+  }
+#+end80808080 * Ollama
+
+#+begin_src nix :tangle ollama.nix
+  { config, pkgs, ... }:
+  {
+    environment.systemPackages = with pkgs; [
+      ollama
+    ];
+    systemd.services = {
+      ollama = {
+        description = "Server for local large language models";
+        after = ["network-online.target"];
+        wantedBy = ["multi-user.target"];
+        environment = {
+          HOME = "%S/ollama";
+          OLLAMA_HOST = "0.0.0.0";
+          OLLAMA_MODELS = "%S/ollama/models";
+        };
+        serviceConfig = {
+          Type = "simple";
+          User = "ollama";
+          Group = "ollama";
+          Restart = "always";
+          RestartSec = "3";
+          WorkingDirectory = "/var/lib/ollama";
+          StateDirectory = [ "ollama" ];
+          DynamicUser = true;  
+          ExecStart = "${pkgs.ollama}/bin/ollama serve";
+        };
+      };
+    };
+    networking.firewall.allowedTCPPorts = [ 11434 ];
+  }

appserver/server1/nixos/starship.nix

@@ -0,0 +1,6 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    starship
+  ];
+}

appserver/server1/nixos/tailscale.nix

@@ -0,0 +1,18 @@
+{config, pkgs, ... }:
+  {
+    environment.systemPackages = with pkgs; [
+      tailscale
+    ];
+
+    services.tailscale.enable = true;
+    networking.firewall = {
+      # trace: warning: Strict reverse path filtering breaks Tailscale exit node
+      # use and some subnet routing setups. Consider setting
+      # `networking.firewall.checkReversePath` = 'loose'
+      checkReversePath = "loose";
+      trustedInterfaces = [ "tailscale0" ];
+    };
+  }
+#+end80808080 * nginx
+
+#+begin_src nix

appserver/server1/nixos/wg.nix

@@ -0,0 +1,20 @@
+{ config, pkgs, lib, ... }:
+  {
+    networking.firewall.checkReversePath = "loose";
+    networking.wg-quick.interfaces = {
+      wg0 = {
+        address = [ "192.168.100.3/24" ]; # "fdc9:281f:04d7:9ee9::2/64" 
+        #dns = [ "192.168.100.1" "192.168.1.1" ]; # "fdc9:281f:04d7:9ee9::1"
+        privateKeyFile = "/root/wireguard-keys/private";
+        peers = [
+          {
+            publicKey = "";
+            presharedKeyFile = "/root/wireguard-keys/preshared";
+            allowedIPs = [ "192.168.100.1/24" ]; # "::/0"
+            endpoint = "46.226.104.98:51820";
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+    };
+  }

appserver/server1/nixos/writefreely.nix

@@ -0,0 +1,26 @@
+{ pkgs, configs, ... }:
+{
+  services.writefreely = {
+    enable = true;
+    admin.name = "geir@geokkjer.eu";
+    host = "blog.geokkjer.eu";
+    database = {
+      type = "sqlite3";
+      #filename = "writefreely.db";
+      #database = "writefreely";
+    };
+    nginx = {
+      # Enable Nginx and configure it to serve WriteFreely.
+      enable = true;
+    };
+    settings = {
+      server = {
+        port = 8088;
+        bind = "0.0.0.0";
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 8088 ];
+  networking.firewall.allowedUDPPorts = [ 8088 ];
+}