voidarc/nixos.server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: voidarc:56cc6ab71b8285d48789513314485e82e44cecf7
Branches Tags
voidarc:main
...
compare: voidarc:main
Branches Tags
voidarc:main

5 Commits
56cc6ab71b ... main

Author SHA1 Message Date
voidarc
e82337ba65 fixed the container dependancies 2026-10-04 15:14:17 +01:00
voidarc
9b4ab1e722 removed unused database 2026-10-03 07:57:02 +01:00
voidarc
515ffaf9bb added matrix server :D 2026-10-02 19:23:30 +01:00
voidarc
a3187e973a added warpgate (very cool) 2026-09-29 10:10:59 +01:00
voidarc
ab7b10d63b added paperless-ngx 2026-09-28 11:20:29 +01:00
6 changed files with 318 additions and 3 deletions
Expand all files Collapse all files

3
modules/containers/default.nix
View File

@@ -18,6 +18,9 @@
containerKomga
containerNginxHomeAssistant
containerSilverbullet
containerPaperless
containerWarpgate
containerMatrix
];
in {
imports = modules;

96
modules/containers/matrix/container.nix Normal file
View File

@@ -0,0 +1,96 @@
{moduleWithSystem, ...}: {
flake.nixosModules.containerMatrix = moduleWithSystem ({pkgs, ...}: {
virtualisation.oci-containers.containers."matrix-mjolnir" = {
image = "matrixdotorg/mjolnir:latest";
volumes = [
"/containers/synapse/mjolnir:/data:rw"
];
log-driver = "journald";
extraOptions = [
"--network-alias=mjolnir"
"--network=matrix_default"
];
};
systemd.services."podman-matrix-mjolnir" = {
serviceConfig = {
Restart = pkgs.lib.mkOverride 90 "always";
};
after = [
"podman-network-matrix_default.service"
];
requires = [
"podman-network-matrix_default.service"
];
partOf = [
"podman-compose-matrix-root.target"
];
wantedBy = [
"podman-compose-matrix-root.target"
];
};
virtualisation.oci-containers.containers."synapse" = {
image = "matrixdotorg/synapse:latest";
environment = {
"SYNAPSE_CONFIG_PATH" = "/data/homeserver.yaml";
};
volumes = [
"/containers/synapse/synapse-data:/data:rw"
];
ports = [
"8008:8008/tcp"
];
log-driver = "journald";
extraOptions = [
"--network-alias=synapse"
"--network=matrix_default"
];
};
systemd.services."podman-synapse" = {
serviceConfig = {
Restart = pkgs.lib.mkOverride 90 "always";
};
after = [
"podman-network-matrix_default.service"
];
requires = [
"podman-network-matrix_default.service"
];
partOf = [
"podman-compose-matrix-root.target"
];
wantedBy = [
"podman-compose-matrix-root.target"
];
};
# Networks
systemd.services."podman-network-matrix_default" = {
path = [pkgs.podman];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "podman network rm -f matrix_default";
};
script = ''
podman network inspect matrix_default || podman network create --ipv6=false matrix_default
'';
partOf = ["podman-compose-matrix-root.target"];
wantedBy = ["podman-compose-matrix-root.target"];
};
networking.firewall.allowedTCPPorts = [
22
8448
];
# Root service
# When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources.
systemd.targets."podman-compose-matrix-root" = {
unitConfig = {
Description = "Root target generated by compose2nix.";
};
wantedBy = ["multi-user.target"];
};
});
}

140
modules/containers/paperless-ngx/container.nix Normal file
View File

@@ -0,0 +1,140 @@
{moduleWithSystem, ...}: {
flake.nixosModules.containerPaperless = moduleWithSystem ({pkgs, ...}: {config, ...}: {
virtualisation.oci-containers.containers."paperless-ngx-broker" = {
image = "docker.io/valkey/valkey:9-alpine";
volumes = [
"/containers/paperless-ngx/redisdata:/data:rw"
];
log-driver = "journald";
extraOptions = [
"--network-alias=broker"
"--network=paperless-ngx_default"
];
};
systemd.services."podman-paperless-ngx-broker" = {
serviceConfig = {
Restart = pkgs.lib.mkOverride 90 "always";
};
after = [
"podman-network-paperless-ngx_default.service"
];
requires = [
"podman-network-paperless-ngx_default.service"
];
partOf = [
"podman-compose-paperless-ngx-root.target"
];
wantedBy = [
"podman-compose-paperless-ngx-root.target"
];
};
virtualisation.oci-containers.containers."paperless-ngx-db" = {
image = "docker.io/library/postgres:18";
environmentFiles = [config.sops.templates."paperless.env".path];
environment = {
"POSTGRES_DB" = "paperless";
"POSTGRES_USER" = "paperless";
};
volumes = [
"/containers/paperless-ngx/pgdata:/var/lib/postgresql:rw"
];
log-driver = "journald";
extraOptions = [
"--network-alias=db"
"--network=paperless-ngx_default"
];
};
systemd.services."podman-paperless-ngx-db" = {
serviceConfig = {
Restart = pkgs.lib.mkOverride 90 "always";
};
after = [
"podman-network-paperless-ngx_default.service"
];
requires = [
"podman-network-paperless-ngx_default.service"
];
partOf = [
"podman-compose-paperless-ngx-root.target"
];
wantedBy = [
"podman-compose-paperless-ngx-root.target"
];
};
virtualisation.oci-containers.containers."paperless-ngx-webserver" = {
image = "ghcr.io/paperless-ngx/paperless-ngx:latest";
environmentFiles = [config.sops.templates."paperless.env".path];
environment = {
"PAPERLESS_DBENGINE" = "postgresql";
"PAPERLESS_DBHOST" = "db";
"PAPERLESS_OCR_LANGUAGE" = "eng";
"PAPERLESS_REDIS" = "redis://broker:6379";
"PAPERLESS_TIME_ZONE" = "Europe/London";
"PAPERLESS_URL" = "https://paperless.voidarc.co.uk";
"USERMAP_GID" = "0";
"USERMAP_UID" = "0";
};
volumes = [
"/containers/paperless-ngx/consume:/usr/src/paperless/consume:rw"
"/containers/paperless-ngx/data:/usr/src/paperless/data:rw"
"/containers/paperless-ngx/export:/usr/src/paperless/export:rw"
"/containers/paperless-ngx/media:/usr/src/paperless/media:rw"
];
ports = [
"8000:8000/tcp"
];
dependsOn = [
"paperless-ngx-broker"
"paperless-ngx-db"
];
log-driver = "journald";
extraOptions = [
"--network-alias=webserver"
"--network=paperless-ngx_default"
];
};
systemd.services."podman-paperless-ngx-webserver" = {
serviceConfig = {
Restart = pkgs.lib.mkOverride 90 "always";
};
after = [
"podman-network-paperless-ngx_default.service"
];
requires = [
"podman-network-paperless-ngx_default.service"
];
partOf = [
"podman-compose-paperless-ngx-root.target"
];
wantedBy = [
"podman-compose-paperless-ngx-root.target"
];
};
# Networks
systemd.services."podman-network-paperless-ngx_default" = {
path = [pkgs.podman];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "podman network rm -f paperless-ngx_default";
};
script = ''
podman network inspect paperless-ngx_default || podman network create paperless-ngx_default
'';
partOf = ["podman-compose-paperless-ngx-root.target"];
wantedBy = ["podman-compose-paperless-ngx-root.target"];
};
# Root service
# When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources.
systemd.targets."podman-compose-paperless-ngx-root" = {
unitConfig = {
Description = "Root target generated by compose2nix.";
};
wantedBy = ["multi-user.target"];
};
});
}

63
modules/containers/warpgate/container.nix Normal file
View File

@@ -0,0 +1,63 @@
{moduleWithSystem, ...}: {
flake.nixosModules.containerWarpgate = moduleWithSystem ({pkgs, ...}: {
virtualisation.oci-containers.containers."warpgate-warpgate" = {
image = "ghcr.io/warp-tech/warpgate";
volumes = [
"/containers/warpgate/data:/data:rw"
];
ports = [
"2222:2222/tcp"
"8888:8888/tcp"
"33306:33306/tcp"
];
log-driver = "journald";
# cmd = ["warpgate" "--skip-securing-files"];
extraOptions = [
"--network-alias=warpgate"
"--network=warpgate_default"
];
};
systemd.services."podman-warpgate-warpgate" = {
serviceConfig = {
Restart = pkgs.lib.mkOverride 90 "always";
};
after = [
"podman-network-warpgate_default.service"
];
requires = [
"podman-network-warpgate_default.service"
];
partOf = [
"podman-compose-warpgate-root.target"
];
wantedBy = [
"podman-compose-warpgate-root.target"
];
};
# Networks
systemd.services."podman-network-warpgate_default" = {
path = [pkgs.podman];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "podman network rm -f warpgate_default";
};
script = ''
podman network inspect warpgate_default || podman network create warpgate_default
'';
partOf = ["podman-compose-warpgate-root.target"];
wantedBy = ["podman-compose-warpgate-root.target"];
};
# Root service
# When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources.
systemd.targets."podman-compose-warpgate-root" = {
unitConfig = {
Description = "Root target generated by compose2nix.";
};
wantedBy = ["multi-user.target"];
};
});
}

10
modules/features/sops/default.nix
View File

@@ -24,6 +24,9 @@
mail-relay-user = {};
mail-relay-passwd = {};
silverbullet-user = {};
paperless-ngx-key = {};
paperless-postgres-password = {};
matrix-postgres-password = {};
};
templates = {
"gitea.env".content = ''
@@ -43,6 +46,13 @@
"silverbullet.env".content = ''
SB_USER=${config.sops.placeholder.silverbullet-user}
'';
"paperless.env".content = ''
POSTGRES_PASSWORD=${config.sops.placeholder.paperless-postgres-password}
PAPERLESS_SECRET_KEY=${config.sops.placeholder.paperless-ngx-key}
'';
"matrix.env".content = ''
"POSTGRES_PASSWORD" = ${config.sops.placeholder.matrix-postgres-password}
'';
};
};
};

7
secrets/secrets.yaml
View File

@@ -9,6 +9,9 @@ immich-postgres-passwd: ENC[AES256_GCM,data:Kv0l+xMwcBA=,iv:SLzp6Qo1YrwAmrhtg11M
mail-relay-user: ENC[AES256_GCM,data:yaqB1uJ9N+9LwSsS4VsCsQxK/IPA8A0m,iv:k8c9GVeU4bdH8G+4SVKYOw4X5ytiPn33rnqx7CVn4hs=,tag:P9l6G87kI2CH301PPUmXzw==,type:str]
mail-relay-passwd: ENC[AES256_GCM,data:9+2KuS27qukbedmG4fLwyw==,iv:+x5EgbJw/fha98CO58lwTxeF1lfZ5dL8W0zkyOvfF8w=,tag:GnMpinf68b2HdISia0wkrg==,type:str]
silverbullet-user: ENC[AES256_GCM,data:8eoTT+T1+/khV7A96h3KoA==,iv:5wRlIU8hdRnseI5b3WUUZ0KOYtLdyrcON/P+yxg0LCs=,tag:Xxiae5Yrhv2gzIpUPX3PAw==,type:str]
paperless-ngx-key: ENC[AES256_GCM,data:LxOcEwW4KXHHVM7rQ+qyFyZJX/uuIc5Fc0NDFF7k7qycNcGB1jYq90gAKnz3yf2DnN2FFQQfwc/nS3Z6s+z1bZqFtR6mGdOFQSzu4ALV3CUvY6im518=,iv:cuAGN8L1Rd44WIPCCwj+7W1b110tqG+kftyq9aHwc04=,tag:j3UE1hVAUu4Ch3FZAXdTKA==,type:str]
paperless-postgres-password: ENC[AES256_GCM,data:lVPWNWuCUx1Q,iv:m8h1xiNoTg5w4lJ6Lv66EEzj5UxvVkEjv9DYG3KkcKw=,tag:QjggXhCCFZ9jrydUmwl3Ng==,type:str]
matrix-postgres-password: ENC[AES256_GCM,data:TQfbzA/YKCsFKw634m9SeuHiiUHrogkBuhI=,iv:92poaFU7yWLo/U1DKMmoqVP1pjwTBp++Aqqd7tUv3Hs=,tag:olI2c+ISUlmWMICxLGfYJA==,type:str]
sops:
age:
- enc: |
@@ -20,7 +23,7 @@ sops:
XS8/g9qFT4nSgM/8nLhx7I4j5/NQU+CuB/iiG5Zs4iY6+vvAe0jIUg==
-----END AGE ENCRYPTED FILE-----
recipient: age1rg4rsns375z2zj4tv8cyqtjl504fw8tprlmj2w057dz6ztttjstsgjvkvy
lastmodified: "2026-07-31T17:10:29Z"
mac: ENC[AES256_GCM,data:RzmgeFEKYRzqEnHMtSxpg7GKleAr64F7bI7EM/FHq/aYyHgtYkn22oGz8uz9/RVijLIyHcL1rJSOyO7RhUSInqfJeSOKLyxI/X1B862ZuqYOkAFSMOeNMl719cINmgw9uHUQD62Tk6VReii1L0Yf2t/l29wObIRTKg96aZPEkjA=,iv:jAWIpSq7jx71RQ6agMu7ULG2IV6oG5U7ri9rbTyQ8JU=,tag:ybo7an+/9pN0sBA73WzGjg==,type:str]
lastmodified: "2026-10-02T18:20:27Z"
mac: ENC[AES256_GCM,data:P+f2bGyWVSiRlMXzlqdENNA0bI1ShM1WK+S82RZc2fcb8R+oZ3SmVnZDHQ76WEa/AAGX6DjkrwYGOB3uBvOWkJlnz+akhG7B7prn1gxH8KlfkBnVMuCwbl7gOSTGV82yS88rD5fT5p0qprLh60EnyI61NckYj7+cMeFdIF8JMJA=,iv:Ib70zrw8WBXzeGC6KjY3p59b1MIOMxy3Bkrd63SYWGY=,tag:yn4uFr12Gn/ObU5xCcxyoQ==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.3