Nixfiles! :3
Try caddy too?
Signed-off-by: MLC Bloeiman <mar@strawmelonjuice.com>
MLC Bloeiman
(Jul 12, 2026, 12:03 AM +0200)
fe3f2102
fe865cab
+197
-19
+197
-19
home/host-specific/Cubchoo.nix
+197
-19
home/host-specific/Cubchoo.nix
···
1
1
{ pkgs, config, ... }: {
2
+
# Shared network ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2
3
services.podman = {
3
4
networks = {
4
5
"server-net" = {
5
6
autoStart = true;
6
7
};
7
8
};
8
-
containers = {
9
-
"main-database" = {
10
-
autoStart = true;
11
-
networkAlias = [
12
-
"main-database"
13
-
"db"
14
-
];
15
-
network = "server-net";
16
-
image = "postgres:18-alpine";
17
-
environment = {
18
-
"POSTGRES_HOST_AUTH_METHOD" = "trust";
19
-
};
20
-
volumes = [
21
-
"${config.home.homeDirectory}/database:/var/lib/postgresql:Z"
22
-
"${config.home.homeDirectory}/.config/services/main-database/postgresql.conf:/etc/postgresql/postgresql.conf:ro"
23
-
];
24
-
exec = "postgres -c 'config_file=/etc/postgresql/postgresql.conf'";
25
-
};
9
+
};
10
+
# Main database ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
11
+
services.podman.containers.main-database = {
12
+
autoStart = true;
13
+
networkAlias = [
14
+
"main-database"
15
+
"db"
16
+
];
17
+
network = "server-net";
18
+
image = "postgres:18-alpine";
19
+
environment = {
20
+
"POSTGRES_HOST_AUTH_METHOD" = "trust";
26
21
};
27
-
22
+
volumes = [
23
+
"${config.home.homeDirectory}/database:/var/lib/postgresql:Z"
24
+
"${config.home.homeDirectory}/.config/services/main-database/postgresql.conf:/etc/postgresql/postgresql.conf:ro"
25
+
];
26
+
exec = "postgres -c 'config_file=/etc/postgresql/postgresql.conf'";
28
27
};
29
28
xdg.configFile."services/main-database/postgresql.conf".text = ''
30
29
# Connectivity
···
92
91
maintenance_io_concurrency = 1
93
92
wal_recycle = on
94
93
'';
94
+
95
+
# Caddy ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
96
+
services.caddy = {
97
+
enable = true;
98
+
virtualHosts = {
99
+
# email = "webmaster@strawmelonjuice.com";
100
+
configFile = pkgs.writeText "Caddyfile" ''
101
+
{
102
+
email webmaster@strawmelonjuice.com
103
+
}
104
+
105
+
(icon_redirect) {
106
+
redir /assets/site_icon.png https://strawmelonjuice.com/strawmelonjuice.svg permanent
107
+
redir /favicon.ico https://strawmelonjuice.com/strawmelonjuice.svg permanent
108
+
redir /favicon.png https://strawmelonjuice.com/strawmelonjuice.svg permanent
109
+
redir /assets/img/favicon.svg https://strawmelonjuice.com/strawmelonjuice.svg permanent
110
+
redir /assets/img/favicon.png https://strawmelonjuice.com/strawmelonjuice.svg permanent
111
+
redir /assets/img/site_icon.svg https://strawmelonjuice.com/strawmelonjuice.svg permanent
112
+
redir /assets/img/logo.svg https://strawmelonjuice.com/strawmelonjuice.svg permanent
113
+
}
114
+
115
+
knot.strawmelonjuice.com {
116
+
reverse_proxy tangled:5555
117
+
}
118
+
119
+
music.strawmelonjuice.com {
120
+
reverse_proxy navidrome:4533
121
+
}
122
+
123
+
git.strawmelonjuice.com {
124
+
redir https://forge.strawmelonjuice.com{uri}
125
+
}
126
+
127
+
forge.strawmelonjuice.com {
128
+
redir /assets/site_icon.png https://strawmelonjuice.com/svg/forgejo_strawmelonjuice.svg permanent
129
+
redir /favicon.ico https://strawmelonjuice.com/svg/forgejo_strawmelonjuice.svg permanent
130
+
redir /favicon.png https://strawmelonjuice.com/svg/forgejo_strawmelonjuice.svg permanent
131
+
redir /assets/img/favicon.svg https://strawmelonjuice.com/svg/forgejo_strawmelonjuice.svg permanent
132
+
redir /assets/img/favicon.png https://strawmelonjuice.com/svg/forgejo_strawmelonjuice.svg permanent
133
+
redir /assets/img/site_icon.svg https://strawmelonjuice.com/svg/forgejo_strawmelonjuice.svg permanent
134
+
redir /assets/img/logo.svg https://strawmelonjuice.com/svg/forgejo_strawmelonjuice.svg permanent
135
+
136
+
137
+
# proxy to forgejo
138
+
# reverse_proxy anubis-forge:3000 {
139
+
reverse_proxy forgejo:3000 {
140
+
header_up X-Real-Ip {remote_host}
141
+
}
142
+
}
143
+
144
+
files-shared.strawmelonjuice.com {
145
+
redir https://media.strawmelonjuice.com{uri}
146
+
}
147
+
148
+
fonts.strawmelonjuice.com {
149
+
reverse_proxy 100.65.127.22:39936
150
+
}
151
+
152
+
media.strawmelonjuice.com {
153
+
# request_body {
154
+
# max_size 3GB
155
+
# }
156
+
reverse_proxy strawmedia:3022
157
+
}
158
+
159
+
cloud.strawmelonjuice.com {
160
+
reverse_proxy owncloud_server:8080
161
+
}
162
+
163
+
www.strawmelonjuice.com,
164
+
strawmelonjuice.com {
165
+
# Old strawmelonjuice.php and Cynthia Full pages that google is still trying and its annoying me.
166
+
@old_php_pages {
167
+
query p=*
168
+
query c=*
169
+
}
170
+
171
+
handle @old_php_pages {
172
+
respond "This content is no longer available." 410
173
+
}
174
+
# ===================------ ATPROTO ------===================
175
+
handle_path /.well-known/atproto-did {
176
+
respond "did:plc:jgtfsmv25thfs4zmydtbccnn"
177
+
}
178
+
179
+
# ================---- Matrix Homeserver ----================
180
+
handle /.well-known/matrix/* {
181
+
header Access-Control-Allow-Origin "*"
182
+
header Content-Type "application/json"
183
+
184
+
# Using a Matcher inside the handle to respond differently
185
+
@server path /.well-known/matrix/server
186
+
respond @server `{"m.server": "strawmelonjuice.com:443"}`
187
+
188
+
@client path /.well-known/matrix/client
189
+
respond @client `{"m.homeserver": {"base_url": "https://strawmelonjuice.com"}}`
190
+
}
191
+
192
+
handle /_matrix/* {
193
+
reverse_proxy matrix:8008
194
+
}
195
+
196
+
handle /_synapse/client/* {
197
+
reverse_proxy matrix:8008
198
+
}
199
+
200
+
# ===================------ My Site ------===================
201
+
handle {
202
+
root * /srv/strawmelonjuice-site/
203
+
try_files {path} {path}/index.html /unpopulated.html unpopulated.html
204
+
file_server
205
+
}
206
+
}
207
+
'';
208
+
};
209
+
210
+
};
211
+
212
+
# Owncloud ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
213
+
# Add symlink between Owncloud files <-> Home folders
214
+
home.file."media/music" = {
215
+
source = config.lib.file.mkOutOfStoreSymlink "${config.xdg.configHome}/services/data/owncloud/data/files/mar/files/Music";
216
+
force = true;
217
+
};
218
+
219
+
# Backups ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
220
+
systemd.user.services.services-backups = {
221
+
Unit.Description = "Backups";
222
+
Service = {
223
+
ExecStart = pkgs.writeShellScript "backups" ''
224
+
BACKUP_DIR="${config.home.homeDirectory}/backups_temp"
225
+
DATA_DIR="${config.home.homeDirectory}/services/data"
226
+
TIMESTAMP=$(date +"%Y-%m-%d-%H.%M")
227
+
ARCHIVE_NAME="$TIMESTAMP.tar.zst"
228
+
FINAL_DEST="${config.home.homeDirectory}/backups"
229
+
230
+
231
+
rm -rf $BACKUP_DIR
232
+
mkdir -p $BACKUP_DIR
233
+
mkdir -p $FINAL_DEST
234
+
235
+
echo "Dumping database..."
236
+
${pkgs.podman} exec main-database pg_dumpall -U postgres > $BACKUP_DIR/full_db_backup.sql
237
+
238
+
239
+
echo "Cloning services repository..."
240
+
git clone --depth 1 --bare https://tangled.org/did:plc:jgtfsmv25thfs4zmydtbccnn/services $BACKUP_DIR/services_repo
241
+
242
+
echo "Copying data folder..."
243
+
sudo cp -r $DATA_DIR $BACKUP_DIR/data_files
244
+
sudo rm -fr $BACKUP_DIR/data_files/owncloud/data/files/mar/files/Music
245
+
sudo chown mar:mar -R $BACKUP_DIR
246
+
247
+
echo "Creating archive..."
248
+
tar -I 'zstd -1 --threads=0' -cf $FINAL_DEST/$ARCHIVE_NAME -C $BACKUP_DIR .
249
+
250
+
echo "Uploading configs and data..."
251
+
# rsync --bwlimit=5000 --partial --progress -avzt $FINAL_DEST/$ARCHIVE_NAME root@mar-backups:${config.home.homeDirectory}/backups/
252
+
tailscale file cp $FINAL_DEST/$ARCHIVE_NAME root@mar-backups:${config.home.homeDirectory}/backups/
253
+
echo "Uploading any new or updated music..."
254
+
rsync --bwlimit=5000 -hrvPt --update ${config.home.homeDirectory}/media/music root@mar-backups:${config.home.homeDirectory}/music
255
+
256
+
echo "Cleaning up..."
257
+
rm -rf $BACKUP_DIR
258
+
259
+
echo "Backup $ARCHIVE_NAME complete!"
260
+
'';
261
+
};
262
+
};
263
+
# Run every hour
264
+
systemd.user.timers.services-backups = {
265
+
Unit.Description = "Daily backup at half past eleven.";
266
+
Timer = {
267
+
OnCalendar = "*-*-* 23:30:00";
268
+
Persistent = true;
269
+
};
270
+
Install.WantedBy = [ "timers.target" ];
271
+
};
272
+
95
273
}