My NixOS dotfiles
✨ My port planning
Simon R. - fantomitechno
(Jun 30, 2026, 11:54 AM +0200)
bbd7f096
ba8bb9e3
+198
-55
+70
-10
IPAM.md
+70
-10
IPAM.md
···
2
2
3
3
## VLANs
4
4
5
-
| VID | NAME | PREFIX | ACESS | PERMISSIONS |
6
-
| -- | -- | -- | -- | -- |
7
-
| 10 | ADMIN | `172.16.10.0/24` | Ethernet with 802.1X | Internet without restrictions, SSH to servers |
8
-
| 20 | SERVERS | `172.16.20.0/24` | specific ethernet ports | Internet without restrictions |
9
-
| 100 | GUEST | `172.16.100.0/24` | Ethernet and WiFi | Restricted to HTTP and HTTPS |
5
+
| VID | NAME | PREFIX | ACESS | PERMISSIONS |
6
+
| --- | ------- | ----------------- | ----------------------- | --------------------------------------------- |
7
+
| 10 | ADMIN | `172.16.10.0/24` | Ethernet with 802.1X | Internet without restrictions, SSH to servers |
8
+
| 20 | SERVERS | `172.16.20.0/24` | specific ethernet ports | Internet without restrictions |
9
+
| 100 | GUEST | `172.16.100.0/24` | Ethernet and WiFi | Restricted to HTTP and HTTPS |
10
10
11
11
## IPs
12
12
13
-
| hostname | address(es) |
14
-
| :-- | -- |
13
+
| hostname | address(es) |
14
+
| :----------------- | ----------------------------------------------------- |
15
15
| OpnSense-DeLoreane | `172.16.10.1/24`, `172.16.20.1/24`, `172.16.100.1/24` |
16
-
| SG500X-Argo3 | `172.16.10.2/24`, `172.16.20.2/24`, `172.16.100.2/24` |
17
-
| conseil | `172.16.20.10/24` |
18
-
| fant0mib0t | `172.16.20.20/24` |
16
+
| SG500X-Argo3 | `172.16.10.2/24`, `172.16.20.2/24`, `172.16.100.2/24` |
17
+
| Conseil | `172.16.20.10/24` |
18
+
| fant0mib0t | `172.16.20.20/24` |
19
+
20
+
## Ports & DNS
21
+
22
+
There is 4 domains that are in use:
23
+
24
+
- `fantomitechno.dev` and `renoux.dev` that are domains used for public services and are available over the internet
25
+
- `fantom.home` which is not a real domain (it only exists via my router), this one is used for local services I, as a user, uses
26
+
- `fantom.internal` another local domain, this one used only for communication between different devices
27
+
28
+
All DNS entries are registered by OpnSense-DeLoreane to point to each machines (using their 172.16.20.0/24 IP if they are on multiple networks).
29
+
30
+
All public DNS entries are also registered on Cloudflare with a CNAME entry to `rack.fantomitechno.dev` which points to my public IP.
31
+
32
+
| Ranges | Description |
33
+
| :----- | :------------- |
34
+
| 10XX | Websites |
35
+
| 20XX | Communications |
36
+
| 40XX | Storages |
37
+
38
+
### OpnSense-DeLoreane
39
+
40
+
| Port Number | Service | DNS entry |
41
+
| :---------- | :------- | :------------------- |
42
+
| 443 | OpnSense | `router.fantom.home` |
43
+
44
+
### SG500X-Argo3
45
+
46
+
| Port Number | Service | DNS entry |
47
+
| :---------- | :----------- | :------------------- |
48
+
| 443 | Cisco Web UI | `switch.fantom.home` |
49
+
50
+
### Conseil
51
+
52
+
Global DNS: `conseil.renoux.dev`
53
+
54
+
| Port Number | Service | DNS entry |
55
+
| :--------------- | :--------------- | :------------------------ |
56
+
| 22 | OpenSSH | |
57
+
| 80, 443 | Caddy | |
58
+
| 4000, 4001, 4002 | NFS | |
59
+
| 4010 | Garage S3 API | `s3.fantom.internal` |
60
+
| 4011 | Garage S3 Web UI | `s3.fantom.home` |
61
+
| 4020 | Copyparty | `files.fantomitechno.dev` |
62
+
63
+
### fant0mib0t
64
+
65
+
Global DNS: `fant0mib0t.renoux.dev`
66
+
67
+
| Port Number | Service | DNS entry |
68
+
| :---------- | :------------------------------ | :-------------------------------------------- |
69
+
| 22 | OpenSSH | |
70
+
| 80, 443 | Caddy | |
71
+
| 2000 | Matrix | `matrix.fantomitechno.dev` |
72
+
| 2010 | Tranquill PDS | `pds.fantomitechno.dev` |
73
+
| 4000 | Tangled Knot | `knot.fantomitechno.dev` |
74
+
| 4010 | Tangled Spindle | `spindle.fantomitechno.dev` |
75
+
| 4020, 4021 | Cryptpad | `drive.renoux.dev`, `drive.s.renoux.dev` |
76
+
| 4030 | Kiwix | `kiwix.fantomitechno.dev`, `kiwix.renoux.dev` |
77
+
| | (redirection to Wikipedia .zim) | `wikipedia.renoux.dev` |
78
+
| 4040 | Immich | `photo.renoux.dev` |
+2
-2
README.md
+2
-2
README.md
···
22
22
## Rebuild and switch on an existing configuration
23
23
24
24
```sh
25
-
rebuild
25
+
rebuild
26
26
# or
27
27
cd /home/fantomitechno/dotfiles && sudo nixos-rebuild switch --flake
28
28
```
···
37
37
- `lux_wallpapere_v1.png`, `lux_wallpapere_v2.png` and `folly_wlalaper.png`: AlexxWinters\_ ([crd.co](https://alexxswinters.carrd.co/))
38
38
- `red_and_yellow.jpg`: Undertale: Red And Yellow by Sinix and more ([gmjlt](https://gamejolt.com/games/undertale-red-yellow/877387))
39
39
- `sol_rue.jpg`: (Extended Version of) OneShot by Future Cat Games ([stm](https://store.steampowered.com/app/420530/OneShot/))
40
-
- `undertale_yellow.png`: Undertale Yellow by Team Undertale Yellow ([gmjlt](https://gamejolt.com/games/UndertaleYellow/136925))
40
+
- `undertale_yellow.png`: Undertale Yellow by Team Undertale Yellow ([gmjlt](https://gamejolt.com/games/UndertaleYellow/136925))
+3
hosts/fant0mib0t/default.nix
+3
hosts/fant0mib0t/default.nix
-16
modules/caddy/common
-16
modules/caddy/common
···
1
-
{
2
-
email simon@renoux.dev
3
-
}
4
-
5
-
(logging) {
6
-
log {
7
-
output file /var/log/{args[0]}.log
8
-
format console
9
-
# level error
10
-
}
11
-
}
12
-
13
-
@local_net client_ip 172.16.0.0/12
14
-
@server_net client_ip 172.16.20.0/24
15
-
@admin_net client_ip 172.16.10.0/24
16
-
@guest_net client_ip 172.16.100.0/24
+27
-13
modules/caddy/conseil
+27
-13
modules/caddy/conseil
···
1
-
import common
1
+
{
2
+
email simon@renoux.dev
3
+
}
4
+
5
+
(logging) {
6
+
log {
7
+
output file /var/log/{args[0]}.log
8
+
format console
9
+
# level error
10
+
}
11
+
}
12
+
13
+
@local_net client_ip 172.16.0.0/12
14
+
@server_net client_ip 172.16.20.0/24
15
+
@admin_net client_ip 172.16.10.0/24
16
+
@guest_net client_ip 172.16.100.0/24
2
17
3
18
conseil.renoux.dev {
4
19
respond "Welcome!"
5
20
}
6
21
7
-
8
-
files.fantomitechno.dev {
9
-
import logging copyparty
10
-
reverse_proxy 127.0.0.1:3210 {
22
+
# Storage
23
+
http://s3.fantom.internal {
24
+
import logging garage
25
+
abort not @server_net
26
+
reverse_proxy 127.0.0.1:4010 {
11
27
header_up X-Forwarded-For {remote_host}
12
28
header_up X-Forwarded-Proto {scheme}
13
29
}
14
30
}
15
31
16
-
17
-
s3.fantom.internal {
32
+
http://s3.fantom.home {
18
33
import logging garage
19
-
abort not @server_net
20
-
reverse_proxy 127.0.0.1:3900 {
34
+
abort not @local_net
35
+
reverse_proxy 127.0.0.1:4011 {
21
36
header_up X-Forwarded-For {remote_host}
22
37
header_up X-Forwarded-Proto {scheme}
23
38
}
24
39
}
25
40
26
-
s3.fantom.home {
27
-
import logging garage
28
-
abort not @local_net
29
-
reverse_proxy 127.0.0.1:3901 {
41
+
files.fantomitechno.dev {
42
+
import logging copyparty
43
+
reverse_proxy 127.0.0.1:4020 {
30
44
header_up X-Forwarded-For {remote_host}
31
45
header_up X-Forwarded-Proto {scheme}
32
46
}
+86
-3
modules/caddy/fant0mib0t
+86
-3
modules/caddy/fant0mib0t
···
1
-
import common
1
+
{
2
+
email simon@renoux.dev
3
+
}
4
+
5
+
(logging) {
6
+
log {
7
+
output file /var/log/{args[0]}.log
8
+
format console
9
+
# level error
10
+
}
11
+
}
12
+
13
+
@local_net client_ip 172.16.0.0/12
14
+
@server_net client_ip 172.16.20.0/24
15
+
@admin_net client_ip 172.16.10.0/24
16
+
@guest_net client_ip 172.16.100.0/24
2
17
3
18
fant0mib0t.renoux.dev {
4
19
respond "Welcome!"
5
20
}
6
21
7
-
22
+
# Communication
8
23
matrix.fantomitechno.dev {
9
24
import logging matrix
10
-
reverse_proxy 127.0.0.1:6167 {
25
+
reverse_proxy 127.0.0.1:2000 {
26
+
header_up X-Forwarded-For {remote_host}
27
+
header_up X-Forwarded-Proto {scheme}
28
+
}
29
+
}
30
+
31
+
pds.fantomitechno.dev {
32
+
import logging pds
33
+
reverse_proxy 127.0.0.1:2010 {
34
+
header_up X-Forwarded-For {remote_host}
35
+
header_up X-Forwarded-Proto {scheme}
36
+
}
37
+
}
38
+
39
+
# Storage
40
+
knot.fantomitechno.dev {
41
+
import logging knot
42
+
reverse_proxy 127.0.0.1:4000 {
43
+
header_up X-Forwarded-For {remote_host}
44
+
header_up X-Forwarded-Proto {scheme}
45
+
}
46
+
}
47
+
48
+
spindle.fantomitechno.dev {
49
+
import logging spindle
50
+
reverse_proxy 127.0.0.1:4001 {
51
+
header_up X-Forwarded-For {remote_host}
52
+
header_up X-Forwarded-Proto {scheme}
53
+
}
54
+
}
55
+
56
+
hold.fantomitechno.dev {
57
+
import logging hold
58
+
reverse_proxy 127.0.0.1:4010 {
59
+
header_up X-Forwarded-For {remote_host}
60
+
header_up X-Forwarded-Proto {scheme}
61
+
}
62
+
}
63
+
64
+
drive.renoux.dev, drive.s.renoux.dev {
65
+
import logging cryptpad
66
+
67
+
handle /cryptpad_websocket* {
68
+
reverse_proxy 127.0.0.1:4021
69
+
}
70
+
71
+
handle {
72
+
reverse_proxy 127.0.0.1:44020 {
73
+
header_up X-Real-IP {remote_host}
74
+
header_up X-Forwarded-For {remote_host}
75
+
}
76
+
}
77
+
}
78
+
79
+
kiwix.fantomitechno.dev, kiwix.renoux.dev {
80
+
import logging kiwix
81
+
reverse_proxy 127.0.0.1:4030 {
82
+
header_up X-Forwarded-For {remote_host}
83
+
header_up X-Forwarded-Proto {scheme}
84
+
}
85
+
}
86
+
87
+
wikipedia.renoux.dev {
88
+
redir https://kiwix.renoux.dev/viewer#wikipedia_en_all_maxi_2026-02{uri}
89
+
}
90
+
91
+
photo.renoux.dev {
92
+
import logging immich
93
+
reverse_proxy 127.0.0.1:4040 {
11
94
header_up X-Forwarded-For {remote_host}
12
95
header_up X-Forwarded-Proto {scheme}
13
96
}
+1
-1
modules/matrix.nix
+1
-1
modules/matrix.nix
+4
-5
modules/nas/copyparty.nix
+4
-5
modules/nas/copyparty.nix
···
9
9
enable = true;
10
10
user = "copyparty";
11
11
group = "copyparty";
12
+
12
13
settings = {
13
14
i = "172.16.20.10";
14
15
p = [
15
-
3210
16
-
3211
16
+
4020
17
17
];
18
-
no-reload = true;
19
-
ignored-flag = false;
20
18
};
21
19
22
20
accounts = {
···
27
25
28
26
volumes = {
29
27
"/public" = {
30
-
# path = ""
28
+
path = "/data/public";
31
29
32
30
access = {
33
31
r = "*";
···
35
33
};
36
34
37
35
flags = {
36
+
# scan for new files every 60sec
38
37
scan = 60;
39
38
};
40
39
};
+3
-3
modules/nas/default.nix
+3
-3
modules/nas/default.nix
+2
-2
modules/nas/s3.nix
+2
-2
modules/nas/s3.nix
···
9
9
data_dir = "/var/lib/garage/data";
10
10
11
11
s3_api = {
12
-
api_bind_addr = "127.0.0.1:3900";
12
+
api_bind_addr = "127.0.0.1:4010";
13
13
s3_region = "garage";
14
14
};
15
15
16
16
s3_web = {
17
-
bind_addr = "127.0.0.1:3902";
17
+
bind_addr = "127.0.0.1:4011";
18
18
};
19
19
};
20
20
};