vps: add mealie

README.md

@@ -0,0 +1,11 @@
+## Unified nix configuration
+
+Switch server: `nixos-rebuild switch --target-host root@posixlycorrect.com --use-substitutes --show-trace --flake .\#vps`
+
+Switch current machine: `sudo nixos-rebuild switch --flake . --show-trace`
+
+Switch current home manager: `home-manager switch --flake . --show-trace`
+
+Update homepage: `nix flake update --commit-lock-file --update-input homepage`
+
+Update whole flake: `nix flake update --commit-lock-file`

home/modules/baseline.nix

@@ -13,17 +13,6 @@ in {
   config = mkIf cfg.enable {
     xdg = {
       enable = true;
-      mimeApps = {
-        enable = true;
-        defaultApplications = {};
-      };
-      portal = {
-        # this shouldnt be on baseline, as servers have no GUI
-        enable = true;
-        xdgOpenUsePortal = true;
-        extraPortals = with pkgs; [xdg-desktop-portal-gtk]; #wtf is this
-        configPackages = with pkgs; [xdg-desktop-portal-gtk]; #wtf is this
-      };
     };
 
     home = {

home/modules/browsers.nix

@@ -1,19 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.local.apps.browsers;
-in {
-  options.local.apps.browsers = {
-    enable = mkEnableOption "Browser home settings";
-  };
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      chromium
-      firefox
-    ];
-  };
-}

home/modules/deepState.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.services.deepState;
+in {
+  options.local.services.deepState.enable = mkEnableOption "trivionomicon settings";
+  config =
+    mkIf cfg.enable {
+      home.sessionVariables = {
+        FSOCIETY_TELEGRAM_BACKUP_N = "0";
+        FSOCIETY_TELEGRAM_BACKUP_LOCATION = "/extern/var/fsociety_backup";
+      };
+    };
+}

home/modules/default.nix

@@ -8,13 +8,15 @@
     ./terminal
     ./neovim.nix
     ./baseline.nix
-    ./gaming
+    ./gaming.nix
     ./yubikey.nix
-    ./browsers.nix
+    ./firefox.nix
     ./gui
     ./zsh
     ./gpg.nix
     ./defaultDesktopPack.nix
     ./accounts.nix
+    ./syncthing.nix
+    ./deepState.nix
   ];
 }

home/modules/defaultDesktopPack.nix

@@ -13,6 +13,7 @@ in {
   config = mkIf cfg.enable {
     home.packages = with pkgs; [
       calibre
+      chromium
       discord
       gwenview
       libreoffice-fresh
@@ -28,7 +29,6 @@ in {
       vpsfree-client
       vscodium-fhs
       zola
-      zoom-us
     ];
   };
 }

home/modules/firefox.nix

@@ -0,0 +1,57 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.apps.firefox;
+in {
+  options.local.apps.firefox = {
+    enable = mkEnableOption "firefox settings";
+
+    workspace = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        i3 Workspace in which Firefox should open. If not set, Firefox will not open at startup
+      '';
+    };
+
+    makeDefaultBrowser = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Take a guess
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable (mkMerge [
+    {
+      programs.firefox.enable = true;
+
+      xsession.windowManager.i3.config.startup = optional (cfg.workspace != null) {
+        command = "${lib.getExe pkgs.i3-gaps} 'workspace ${cfg.workspace}; exec ${lib.getExe pkgs.firefox}'";
+      };
+    }
+
+    (mkIf cfg.makeDefaultBrowser {
+      xdg = {
+        mimeApps = {
+          enable = true;
+          defaultApplications = {
+            "text/html" = ["firefox"];
+            "text/uri-list" = ["firefox"];
+            "x-scheme-handler/http" = ["firefox"];
+            "x-scheme-handler/https" = ["firefox"];
+            "x-scheme-handler/about" = ["firefox"];
+            "x-scheme-handler/unknown" = ["firefox"];
+          };
+        };
+      };
+
+      home.sessionVariables.DEFAULT_BROWSER = "${lib.getExe pkgs.firefox}";
+    })
+  ]);
+}

home/modules/gaming.nix

@@ -12,11 +12,6 @@ in {
   };
   config = mkIf cfg.enable {
     home.packages = [
-      # Steam. todo: move to the steam module later
-      (pkgs.callPackage ./package.nix {})
-      pkgs.protonup
-      pkgs.winetricks
-      pkgs.protontricks
       pkgs.lutris
       pkgs.openrct2
       pkgs.prismlauncher

home/modules/gaming/package.nix

@@ -1,9 +0,0 @@
-{
-  writeShellScriptBin,
-  steam-run,
-  steam,
-  ...
-}:
-writeShellScriptBin "steam" ''
-  exec ${steam-run}/bin/steam-run ${steam}/bin/steam -console
-''

home/modules/gui/default.nix

@@ -81,8 +81,9 @@ in {
     ./fonts.nix
     ./i3.nix
     ./polybar.nix
-    ./startx.nix # move to ly once 24.11 comes out :(
+    ./startx.nix
     ./picom.nix
+    ./theme.nix
   ];
 
   config = let
@@ -113,45 +114,15 @@ in {
         picom.enable = true;
       };
 
-      gtk = {
+      xdg = {
         enable = true;
-
-        iconTheme = {
-          name = "Papirus-Dark";
-          package = pkgs.papirus-icon-theme;
+        mimeApps = {
+          enable = true;
+          defaultApplications = {
+            "application/pdf" = with pkgs; ["qpdfview"];
+            "x-scheme-handler/file" = with pkgs; ["kitty"];
+          };
         };
-        theme = {
-          package = pkgs.materia-theme;
-          name = "Materia-dark";
-        };
-
-        gtk2.extraConfig = ''
-          gtk-toolbar-style=GTK_TOOLBAR_BOTH_HORIZ
-          gtk-menu-images=1
-          gtk-button-images=1
-        '';
-
-        gtk3.extraConfig = {
-          gtk-application-prefer-dark-theme = 1;
-        };
-        gtk4.extraConfig = {
-          gtk-application-prefer-dark-theme = 1;
-        };
-      };
-
-      #qt = { mentioning qt makes qt applications not work, I should probably check how to fix this
-      #  enable = true;
-      #  style.name = "bb10dark";
-      #};
-
-      home.sessionVariables = {
-        # Use gtk in jvm apps
-        _JAVA_OPTIONS = concatStringsSep " " [
-          "-Dawt.useSystemAAFontSettings=on"
-          "-Dswing.aatext=true"
-          "-Dswing.defaultlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel"
-          "-Dswing.crossplatformlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel"
-        ];
       };
     };
 }

home/modules/gui/i3.nix

@@ -45,47 +45,43 @@ with lib; {
       # y se sobreescriba las cosas que pongo acá
       # NO QUITARLO. ver man home-configuration.nix
       keybindings = mkOptionDefault {
-        "${mod}+Return" = "exec ${pkgs.kitty}/bin/kitty ${pkgs.tmux}/bin/tmux";
+        "${mod}+Return" = "exec ${lib.getExe pkgs.kitty} ${lib.getExe pkgs.tmux}";
         "${mod}+Tab" = "focus right";
         "${mod}+Shift+Tab" = "focus left";
-        "${mod}+Shift+s" = "exec ${pkgs.maim}/bin/maim -s -u | ${pkgs.xclip}/bin/xclip -selection clipboard -t image/png -i";
+        "${mod}+Shift+s" = "exec ${lib.getExe pkgs.maim} -s -u | ${lib.getExe pkgs.xclip} -selection clipboard -t image/png -i";
         "${mod}+Shift+w" = "move workspace to output right";
-        "${mod}+l" = "exec ${pkgs.betterlockscreen}/bin/betterlockscreen -l";
+        "${mod}+l" = "exec ${lib.getExe pkgs.betterlockscreen} -l";
       };
 
       startup = [
         {
-          command = "${pkgs.xss-lock}/bin/xss-lock --transfer-sleep-lock -- ${pkgs.i3lock}/bin/i3lock --nofork";
+          command = "${lib.getExe pkgs.xss-lock} --transfer-sleep-lock -- ${lib.getExe pkgs.i3lock} --nofork";
           notification = false;
         }
         {
-          command = "${pkgs.networkmanagerapplet}/bin/nm-applet";
+          command = "${lib.getExe pkgs.networkmanagerapplet}";
           notification = false;
         }
         #todo: sería nice hostear esta imagen en el server y fetchearla si no existe
         {
-          command = "${pkgs.feh}/bin/feh --bg-fill ${config.home.homeDirectory}/Pictures/wallpapers/jupiter.png";
+          command = "${lib.getExe pkgs.feh} --bg-fill ${config.home.homeDirectory}/Pictures/wallpapers/jupiter.png";
           notification = false;
           always = true;
         }
         {
-          #todo: move this to browsers module
-          command = "${pkgs.i3-gaps}/bin/i3-msg 'workspace 1; exec ${pkgs.firefox}/bin/firefox'";
+          #todo: move this to telegram module
+          command = "${lib.getExe pkgs.i3-gaps} 'workspace 2; exec ${lib.getExe pkgs.tdesktop}'";
         }
         {
-          #todo: move this to telegram module
-          command = "${pkgs.i3-gaps}/bin/i3-msg 'workspace 2; exec ${pkgs.tdesktop}/bin/telegram-desktop'";
+          command = "${lib.getExe pkgs.i3-gaps} 'workspace 2; exec ${lib.getExe pkgs.gajim}'";
         }
-        #{
-        #  command = "${pkgs.i3-gaps}/bin/i3-msg 'workspace 2; exec ${pkgs.element-desktop}/bin/element-desktop'";
-        #}
         {
           command = "${pkgs.systemd}/bin/systemctl --user restart polybar.service";
           notification = false;
           always = true;
         }
         {
-          command = "${pkgs.autorandr}/bin/autorandr -c";
+          command = "${lib.getExe pkgs.autorandr} -c";
           notification = false;
           always = true;
         }

home/modules/gui/theme.nix

@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; {
+  gtk = {
+    enable = true;
+
+    iconTheme = {
+      name = "Papirus-Dark";
+      package = pkgs.papirus-icon-theme;
+    };
+    theme = {
+      package = pkgs.materia-theme;
+      name = "Materia-dark";
+    };
+
+    gtk2.extraConfig = ''
+      gtk-toolbar-style=GTK_TOOLBAR_BOTH_HORIZ
+      gtk-menu-images=1
+      gtk-button-images=1
+    '';
+
+    gtk3.extraConfig = {
+      gtk-application-prefer-dark-theme = 1;
+    };
+    gtk4.extraConfig = {
+      gtk-application-prefer-dark-theme = 1;
+    };
+  };
+
+  home.sessionVariables = {
+    # Use gtk in jvm apps
+    _JAVA_OPTIONS = concatStringsSep " " [
+      "-Dawt.useSystemAAFontSettings=on"
+      "-Dswing.aatext=true"
+      "-Dswing.defaultlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel"
+      "-Dswing.crossplatformlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel"
+    ];
+  };
+}

home/modules/syncthing.nix

@@ -0,0 +1,20 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.services.syncthing;
+in {
+  options.local.services.syncthing = {
+    enable = mkEnableOption "syncthing settings";
+  };
+
+  config = mkIf cfg.enable {
+    services.syncthing = {
+      enable = true;
+      tray.enable = true;
+    };
+  };
+}

home/platforms/fabian@posixlycorrect/default.nix

@@ -29,10 +29,12 @@
         prompt = "%B[%~] \${vcs_info_msg_0_}%b";
       };
       accounts.enable = true;
+      deepState.enable = true;
       gpg = {
         enable = true;
         defaultKey = "7AA277E604A4173916BBB4E91FFAC35E1798174F";
       };
+      syncthing.enable = true;
     };
 
     apps = {
@@ -40,8 +42,11 @@
       neovim.enable = true;
       gaming.enable = true;
       yubikey.enable = true;
-      browsers.enable = true;
       defaultDesktopPack.enable = true;
+      firefox = {
+        enable = true;
+        workspace = "1"; #make this an int later
+      };
     };
 
     gui = {
@@ -81,6 +86,7 @@
       })
       gnucash
       kdenlive
+      nmap
       virt-manager
     ];
 

pkgs/config/unfree.nix

@@ -8,5 +8,4 @@ with lib;
     "steam-original"
     "steam-unwrapped"
     "steam-run"
-    "zoom"
   ]

sys/modules/default.nix

@@ -13,5 +13,7 @@
     ./android.nix
     ./users.nix
     ./bluetooth.nix
+    ./net.nix
+    ./steam.nix
   ];
 }

sys/modules/net.nix

@@ -0,0 +1,186 @@
+{
+  config,
+  lib,
+  ...
+}:
+with lib; {
+  options.local.sys.nets = with lib.types;
+    mkOption {
+      readOnly = true;
+
+      type = attrsOf (submodule ({config, ...}: {
+        options = let
+          v4config = config.v4;
+          v6config = config.v6;
+        in {
+          hosts = mkOption {
+            default = {};
+
+            type = attrsOf (submodule {
+              options = {
+                v4 = mkOption {
+                  default = null;
+
+                  type = nullOr (submodule ({config, ...}: {
+                    options = {
+                      suffix = mkOption {
+                        type = str;
+                      };
+
+                      address = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+
+                      cidr = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+
+                      single = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+                    };
+
+                    config = {
+                      address =
+                        if v4config.bits == 0
+                        then config.suffix
+                        else if v4config.bits == 32
+                        then v4config.subnet
+                        else "${v4config.prefix}.${config.suffix}";
+
+                      cidr = "${config.address}/${toString v4config.bits}";
+                      single = "${config.address}/32";
+                    };
+                  }));
+                };
+
+                v6 = mkOption {
+                  default = null;
+
+                  type = nullOr (submodule ({config, ...}: {
+                    options = {
+                      suffix = mkOption {
+                        type = str;
+                      };
+
+                      address = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+
+                      cidr = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+
+                      single = mkOption {
+                        type = str;
+                        readOnly = true;
+                      };
+                    };
+
+                    config = {
+                      address = let
+                        hextets = fragment: length (splitString ":" fragment);
+                        separator =
+                          if doubleColon
+                          then "::"
+                          else ":";
+                        doubleColon = hextets v6config.prefix + hextets config.suffix < 8;
+
+                        joined =
+                          if v6config.bits == 128
+                          then v6config.prefix
+                          else if v6config.bits == 0
+                          then config.suffix
+                          else "${v6config.prefix}${separator}${config.suffix}";
+                      in
+                        joined;
+
+                      cidr = "${config.address}/${toString v6config.bits}";
+                      single = "${config.address}/128";
+                    };
+                  }));
+                };
+              };
+            });
+          };
+
+          v4 = mkOption {
+            default = null;
+
+            type = nullOr (submodule ({config, ...}: {
+              options = {
+                bits = mkOption {
+                  type = enum [0 8 16 24 32];
+                };
+
+                prefix = mkOption {
+                  type = str;
+                };
+
+                subnet = mkOption {
+                  type = str;
+                  readOnly = true;
+                };
+
+                cidr = mkOption {
+                  type = str;
+                  readOnly = true;
+                };
+              };
+
+              config = {
+                cidr = "${config.subnet}/${toString config.bits}";
+                subnet =
+                  if config.bits != 0
+                  then config.prefix + strings.replicate (4 - config.bits / 8) ".0"
+                  else "0.0.0.0";
+              };
+            }));
+          };
+
+          v6 = mkOption {
+            default = null;
+
+            type = nullOr (submodule ({config, ...}: {
+              options = {
+                bits = mkOption {
+                  type =
+                    addCheck (ints.between 0 128) (b: mod b 4 == 0)
+                    // {
+                      description = "IPv6 subnet bits at nibble boundary";
+                    };
+                };
+
+                prefix = mkOption {
+                  type = str;
+                };
+
+                subnet = mkOption {
+                  type = str;
+                  readOnly = true;
+                };
+
+                cidr = mkOption {
+                  type = str;
+                  readOnly = true;
+                };
+              };
+
+              config = {
+                cidr = "${config.subnet}/${toString config.bits}";
+                subnet =
+                  if config.bits == 128 || length (splitString "::" config.prefix) > 1
+                  then config.prefix
+                  else "${config.prefix}::";
+              };
+            }));
+          };
+        };
+      }));
+    };
+}

sys/modules/steam.nix

@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.sys.steam;
+in {
+  options.local.sys.steam = {
+    enable = mkEnableOption "steam settings";
+  };
+  config = mkIf cfg.enable {
+    programs.steam = {
+      enable = true;
+      remotePlay.openFirewall = true;
+      dedicatedServer.openFirewall = true;
+      localNetworkGameTransfers.openFirewall = true;
+    };
+
+    environment = {
+      systemPackages = with pkgs; [
+        protontricks
+        protonup
+        protonup-ng
+        winetricks
+      ];
+    };
+  };
+}

sys/platforms/posixlycorrect/default.nix

@@ -19,6 +19,7 @@
     graphics.enable = true;
     virtualisation.enable = true;
     androidSupport.enable = true;
+    steam.enable = true;
 
     users = {
       fabian = {

sys/platforms/vps/default.nix

@@ -13,6 +13,7 @@ with lib; {
     flakes.impermanence.nixosModule
     ./hardware-configuration.nix
     ./srv
+    ./networkMap.nix
   ];
 
   local.sys = {
@@ -50,9 +51,67 @@ with lib; {
     };
   };
 
-  systemd.extraConfig = ''
-    DefaultTimeoutStartSec=900s
-  '';
+  networking.firewall.allowedUDPPorts = [51820]; #TODO
+
+  systemd = {
+    extraConfig = ''
+      DefaultTimeoutStartSec=900s
+    '';
+
+    network = let
+      inherit (config.local.sys) nets;
+    in {
+      enable = true;
+
+      netdevs = {
+        wg-vpn = {
+          netdevConfig = {
+            Name = "wg-vpn";
+            Kind = "wireguard";
+          };
+
+          wireguardConfig = {
+            PrivateKeyFile = "/var/trust/wg/vpn/key.priv";
+            ListenPort = "51820";
+          };
+
+          wireguardPeers = [
+            {
+              PublicKey = "wwUp3Uu/rSxbp+6J745O+cpnZHGWOJYWfWEsTjRE3yU=";
+              PresharedKeyFile = "/var/trust/wg/vpn/vps-posixlycorrect.psk";
+              AllowedIPs = ["${nets.vpn-posixlycorrect.v6.cidr}"];
+            }
+            {
+              PublicKey = "YFqg/ED26KygSRSmGzvUXpwnXPqMOI3R3caVfAtHVks=";
+              PresharedKeyFile = "/var/trust/wg/vpn/vps-pixel8.psk";
+              AllowedIPs = ["${nets.vpn-pixel8.v6.cidr}"];
+            }
+          ];
+        };
+      };
+
+      networks = {
+        wg-vpn = {
+          name = "wg-vpn";
+
+          networkConfig = {
+            Address = [
+              nets.vpn-vps.hosts.vps.v6.cidr
+            ];
+          };
+
+          routes = [
+            {
+              Destination = nets.vpn.v6.cidr;
+            }
+            {
+              Source = nets.vpn.v6.cidr;
+            }
+          ];
+        };
+      };
+    };
+  };
 
   time.timeZone = "Europe/Amsterdam";
 }

sys/platforms/vps/networkMap.nix

@@ -0,0 +1,78 @@
+{
+  config,
+  pkgs,
+  lib,
+  flakes,
+  ...
+}:
+with lib; {
+  local.sys.nets = {
+    default = {
+      v4 = {
+        bits = 32;
+        prefix = "37.205.12.34";
+      };
+
+      v6 = {
+        bits = 64;
+        prefix = "2a03:3b40:fe:102";
+      };
+
+      hosts = {
+        vps.v6.suffix = "1";
+        vps.v4.suffix = "";
+      };
+    };
+
+    vpn = {
+      v6 = {
+        bits = 48;
+        prefix = "2a03:3b40:2b";
+      };
+    };
+
+    vpn-vps = {
+      v6 = {
+        bits = 64;
+        prefix = "2a03:3b40:2b:1000";
+      };
+
+      hosts = {
+        vps.v6.suffix = "1";
+      };
+    };
+
+    vpn-posixlycorrect = {
+      v6 = {
+        bits = 64;
+        prefix = "2a03:3b40:2b:1001";
+      };
+
+      hosts = {
+        posixlycorrect.v6.suffix = "1";
+      };
+    };
+
+    vpn-pixel8 = {
+      v6 = {
+        bits = 64;
+        prefix = "2a03:3b40:2b:1002";
+      };
+
+      hosts = {
+        pixel8.v6.suffix = "1";
+      };
+    };
+
+    vpn-t14 = {
+      v6 = {
+        bits = 64;
+        prefix = "2a03:3b40:2b:1003";
+      };
+
+      hosts = {
+        t14.v6.suffix = "1";
+      };
+    };
+  };
+}

sys/platforms/vps/srv/default.nix

@@ -18,5 +18,7 @@ with lib; {
     ./shiori.nix
     ./calibre-web.nix
     ./immich.nix
+    ./wiki-js.nix
+    ./mealie.nix
   ];
 }

sys/platforms/vps/srv/forgejo.nix

@@ -47,12 +47,10 @@ with lib; {
             LANDING_PAGE = "explore";
           };
 
-          # You can temporarily allow registration to create an admin user.
           service.DISABLE_REGISTRATION = true;
 
-          # ver https://github.com/nektos/act
           actions = {
-            ENABLED = false;
+            ENABLED = true;
           };
           mailer = {
             ENABLED = false;

sys/platforms/vps/srv/immich.nix

@@ -28,6 +28,46 @@ with lib; {
       environment = {
         IMMICH_TELEMETRY_EXCLUDE = "host,api,io,repo,job";
       };
+      settings = {
+        machineLearning = {
+          enabled = false;
+        };
+        job = {
+          backgroundTask = {
+            concurrency = 1;
+          };
+          smartSearch = {
+            concurrency = 1;
+          };
+          metadataExtraction = {
+            concurrency = 1;
+          };
+          faceDetection = {
+            concurrency = 1;
+          };
+          search = {
+            concurrency = 1;
+          };
+          sidecar = {
+            concurrency = 1;
+          };
+          library = {
+            concurrency = 1;
+          };
+          migration = {
+            concurrency = 1;
+          };
+          thumbnailGeneration = {
+            concurrency = 1;
+          };
+          videoConversion = {
+            concurrency = 1;
+          };
+          notifications = {
+            concurrency = 1;
+          };
+        };
+      };
     };
   };
 }

sys/platforms/vps/srv/mealie.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+with lib; {
+  systemd.services.wiki-js = {
+    requires = ["postgresql.service"];
+    after = ["postgresql.service"];
+  };
+
+  services = {
+    nginx = {
+      virtualHosts."food.posixlycorrect.com" = {
+        enableACME = true;
+        forceSSL = true;
+        extraConfig = ''
+          proxy_headers_hash_max_size 512;
+          proxy_headers_hash_bucket_size 128;
+        '';
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:9000";
+        };
+      };
+    };
+
+    mealie = {
+      enable = true;
+      listenAddress = "127.0.0.1";
+      port = 9000;
+      credentialsFile = "/var/trust/mealie/credentials.env";
+      settings = {
+        ALLOW_SIGNUP = "false";
+      };
+    };
+  };
+}

sys/platforms/vps/srv/net.nix

@@ -1,11 +1,14 @@
 {
+  config,
   lib,
   pkgs,
   ...
 }:
-with lib; {
+with lib; let
+  inherit (config.local.sys) nets;
+in {
   networking = {
-    nftables.enable = true;
+    nftables.enable = false; # learn how to use this later
     firewall = {
       enable = true;
       allowedTCPPorts = [80 443];
@@ -49,10 +52,15 @@ with lib; {
         };
       };
     };
+
     fail2ban = {
       enable = true;
       bantime = "10m";
-      ignoreIP = ["37.205.12.34"]; # Never ban the server's own IP
+      ignoreIP = [
+        nets.default.hosts.vps.v6.cidr
+        nets.default.hosts.vps.v4.address
+        nets.vpn.v6.cidr
+      ];
       bantime-increment = {
         enable = true;
         formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";

sys/platforms/vps/srv/syncthing.nix

@@ -13,6 +13,7 @@ with lib; {
       openDefaultPorts = true;
       guiAddress = "127.0.0.1:8384";
       settings.options.urAccepted = -1;
+      dataDir = "/mnt/export2179/syncthing";
       relay = {
         enable = true;
         pools = [];
@@ -20,4 +21,22 @@ with lib; {
       };
     };
   };
+
+  # calibre web stuff. make this better someday, this is pure duct-tape
+  users.groups."calybresync".members = ["syncthing" "calibre-web"];
+  systemd = {
+    services."calybreown" = {
+      script = ''
+        chgrp -R calybresync /var/lib/calibre-web/calibre_library
+        chmod -R g+w /var/lib/calibre-web/calibre_library
+      '';
+      serviceConfig.Type = "oneshot";
+    };
+    timers."calybreown" = {
+      wantedBy = [
+        "timers.target"
+      ];
+      timerConfig.OnCalendar = "*-*-* *:00/30:00";
+    };
+  };
 }

sys/platforms/vps/srv/wiki-js.nix

@@ -0,0 +1,53 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+with lib; {
+  systemd.services.wiki-js = {
+    requires = ["postgresql.service"];
+    after = ["postgresql.service"];
+  };
+
+  services = {
+    nginx = {
+      virtualHosts."wjs.posixlycorrect.com" = {
+        enableACME = true;
+        forceSSL = true;
+        extraConfig = ''
+          proxy_headers_hash_max_size 512;
+          proxy_headers_hash_bucket_size 128;
+        '';
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:3000";
+        };
+      };
+    };
+
+    wiki-js = {
+      enable = true;
+      environmentFile = "/var/trust/wiki-js/env.txt";
+      settings = {
+        bindIP = "127.0.0.1";
+        port = 3000;
+        db = {
+          db = "wiki-js";
+          user = "wiki-js";
+          type = "postgres";
+          host = "/run/postgresql";
+        };
+      };
+    };
+
+    postgresql = {
+      enable = true;
+      ensureDatabases = ["wiki-js"];
+      ensureUsers = [
+        {
+          name = "wiki-js";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+  };
+}