From a74cc6a140356c926bb2746c56182ef33a7a4cde Mon Sep 17 00:00:00 2001
From: Andre <andre@8bitbuddhism.com>
Date: Tue, 2 Jul 2024 10:02:46 -0400
Subject: [PATCH] Add Haven's services to Dimaga

---
 hosts/Dimaga/default.nix | 132 ++++++++++++++++++++++++++++++++++++---
 1 file changed, 124 insertions(+), 8 deletions(-)

diff --git a/hosts/Dimaga/default.nix b/hosts/Dimaga/default.nix
index 4f4e1f7..f73cc5d 100644
--- a/hosts/Dimaga/default.nix
+++ b/hosts/Dimaga/default.nix
@@ -8,6 +8,28 @@
 let
   # Do not change this value! This tracks when NixOS was installed on your system.
   stateVersion = "24.11";
+
+  start-services = pkgs.writeShellScriptBin "start-services" (
+    builtins.readFile ../Haven/start-haven.sh
+  );
+
+  services-root = "/storage/services";
+
+  subdomains = [
+    config.secrets.services.airsonic.url
+    config.secrets.services.cache.url
+    config.secrets.services.forgejo.url
+    config.secrets.services.gremlin-lab.url
+  ];
+
+  namecheapCredentials = {
+    "NAMECHEAP_API_USER_FILE" = "${pkgs.writeText "namecheap-api-user" ''
+      ${config.secrets.networking.namecheap.api.user}
+    ''}";
+    "NAMECHEAP_API_KEY_FILE" = "${pkgs.writeText "namecheap-api-key" ''
+      ${config.secrets.networking.namecheap.api.key}
+    ''}";
+  };
 in
 {
   imports = [ ./hardware-configuration.nix ];
@@ -28,6 +50,7 @@ in
 
     apps = {
       development.enable = true;
+      tmux.enable = true;
       #media.enable = true;
       #office.enable = true;
       #recording.enable = true;
@@ -38,7 +61,7 @@ in
     # Enable Secure Boot support.
     bootloader = {
       enable = true;
-      #secureboot.enable = true;
+      secureboot.enable = true;
       tpm2.enable = true;
     };
 
@@ -58,17 +81,113 @@ in
       };
     };
 
+    packages = [
+      start-services
+      pkgs.htop
+    ];
+
     # Change how long old generations are kept for.
-    retentionPeriod = "14d";
+    retentionPeriod = "monthly";
 
     services = {
-      autoUpgrade = {
+      acme = {
         enable = true;
+        defaultEmail = config.secrets.users.aires.email;
+        certs = {
+          "${config.secrets.networking.primaryDomain}" = {
+            dnsProvider = "namecheap";
+            extraDomainNames = subdomains;
+            webroot = null; # Required in order to prevent a failed assertion
+            credentialFiles = namecheapCredentials;
+          };
+          "${config.secrets.networking.blogDomain}" = {
+            dnsProvider = "namecheap";
+            webroot = null; # Required in order to prevent a failed assertion
+            credentialFiles = namecheapCredentials;
+          };
+        };
+      };
+      apcupsd = {
+        enable = true;
+        configText = builtins.readFile ../Haven/etc/apcupsd.conf;
+      };
+      airsonic = {
+        enable = true;
+        home = "${services-root}/airsonic-advanced";
+        domain = config.secrets.networking.primaryDomain;
+        url = config.secrets.services.airsonic.url;
+      };
+      autoUpgrade = {
+        enable = false; # Don't update the system...
+        pushUpdates = true; # ...but do push updates remotely.
         configDir = config.secrets.nixConfigFolder;
         onCalendar = "daily";
         user = config.users.users.aires.name;
       };
-      virtualization.enable = true;
+      boinc.enable = true;
+      cache = {
+        enable = false; # Disable for now
+        secretKeyFile = "${services-root}/nix-cache/cache-priv-key.pem";
+      };
+      duplicacy-web = {
+        enable = true;
+        autostart = false;
+        environment = "/storage/backups/settings/Haven";
+      };
+      forgejo = {
+        enable = true;
+        home = "${services-root}/forgejo";
+        domain = config.secrets.networking.primaryDomain;
+        url = config.secrets.services.forgejo.url;
+        actions = {
+          enable = true;
+          token = config.secrets.services.forgejo.runner-token;
+        };
+      };
+      msmtp.enable = true;
+      nginx = {
+        enable = true;
+        autostart = false;
+        virtualHosts = {
+          "${config.secrets.networking.primaryDomain}" = {
+            default = true;
+            enableACME = true; # Enable Let's Encrypt
+            locations."/" = {
+              # Catchall vhost, will redirect users to Forgejo
+              return = "301 https://${config.secrets.services.forgejo.url}";
+            };
+          };
+          "${config.secrets.networking.blogDomain}" = {
+            useACMEHost = config.secrets.networking.blogDomain;
+            forceSSL = true;
+            root = "${services-root}/nginx/sites/${config.secrets.networking.blogDomain}";
+          };
+          "${config.secrets.services.gremlin-lab.url}" = {
+            useACMEHost = config.secrets.networking.primaryDomain;
+            forceSSL = true;
+            locations."/" = {
+              proxyPass = "http://${config.secrets.services.gremlin-lab.ip}";
+              proxyWebsockets = true;
+              extraConfig = "proxy_ssl_server_name on;";
+            };
+          };
+        };
+      };
+      ssh = {
+        enable = true;
+        ports = [ config.secrets.hosts.haven.ssh.port ];
+      };
+      virtualization = {
+        host = {
+          enable = true;
+          user = "aires";
+          vmBuilds = {
+            enable = true;
+            cores = 3;
+            ram = 4096;
+          };
+        };
+      };
     };
 
     ui = {
@@ -83,8 +202,6 @@ in
         # Define Flatpak packages to install.
         packages = [
           "com.github.tchx84.Flatseal"
-          "com.github.wwmm.easyeffects"
-          "md.obsidian.Obsidian"
           "org.keepassxc.KeePassXC"
           "org.mozilla.firefox"
         ];
@@ -96,8 +213,7 @@ in
       services = {
         syncthing = {
           enable = true;
-          autostart = true;
-          enableTray = false;
+          autostart = false;
         };
       };
     };