Clean up and add services

Remove jupyter service and qbittorrent traefik route

Add ntfy-sh (enabled) and initial grafana (not enabled) expressions

Change services to call own traefik expression, rather than needing to
be called explicitly

flake.nix

@@ -229,17 +229,11 @@
         in systemConfig {
           inherit hostName user system;
           systemModules = [ ./system/default.nix ];
-          serviceModules = [
+          serviceModules = default.serviceModules ++ [
-            # ./services/adguardhome/default.nix
+            ./services/adguardhome/default.nix
             ./services/gitea/default.nix
             ./services/nextcloud/default.nix
-            ./services/sshd/default.nix
+            ./services/ntfy-sh/default.nix
-            ./services/syncthing/default.nix
-            # ./services/terraria/windy_limbo_of_melancholy.nix
-            # ./services/traefik/adguardhome.nix
-            ./services/traefik/gitea.nix
-            ./services/traefik/nextcloud.nix
-            # ./services/traefik/qbittorrent.nix
           ];
           homeModules = [ ./home/default.nix ];
         };

services/adguardhome/default.nix

@@ -1,4 +1,7 @@
-{...}: {
+{ ... }:
+
+{
+  imports = [ ../traefik/adguardhome.nix ];
   services.adguardhome = {
     enable = true;
     mutableSettings = true;
@@ -6,7 +9,7 @@
     openFirewall = true;
   };
   networking.firewall = {
-    allowedTCPPorts = [53];
+    allowedTCPPorts = [ 53 ];
-    allowedUDPPorts = [53];
+    allowedUDPPorts = [ 53 ];
   };
 }

services/fail2ban/default.nix

@@ -1,7 +1,9 @@
-{...}: {
+{ config, lib, pkgs, ... }:
+
+{
   services.fail2ban = {
     enable = true;
-    ignoreIP = ["127.0.0.1/8" "::1" "192.168.1.0/16"];
+    ignoreIP = [ "127.0.0.1/8" "::1" "192.168.1.0/16" ];
-    bantime-increment = {enable = true;};
+    bantime-increment = { enable = true; };
   };
 }

services/fail2ban/traefik.nix

@@ -1,5 +1,7 @@
-{...}: {
+{ config, lib, pkgs, ... }:
-  imports = [./default.nix];
+
+{
+  imports = [ ./default.nix ];
   services.fail2ban.jails.traefik = ''
     enabled = true
     filter = traefik-auth

services/gitea/default.nix

@@ -1,4 +1,7 @@
-{...}: {
+{ ... }:
+
+{
+  imports = [ ../traefik/gitea.nix ];
   services.gitea = {
     enable = true;
     settings = {
@@ -9,7 +12,8 @@
       };
       service.DISABLE_REGISTRATION = true;
       ui = {
-        THEMES = "auto,gitea,arc-green,catppuccin-latte-lavender,catppuccin-frappe-lavender,catppuccin-macchiato-lavender,catppuccin-mocha-lavender";
+        THEMES =
+          "auto,gitea,arc-green,catppuccin-latte-lavender,catppuccin-frappe-lavender,catppuccin-macchiato-lavender,catppuccin-mocha-lavender";
       };
     };
     appName = "Gitea";

services/grafana/default.nix

@@ -0,0 +1,14 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.grafana = {
+    enable = true;
+    settings = {
+      server = {
+        http_addr = "127.0.0.1";
+        http_port = 3100;
+        domain = "grafana.xenia.me.uk";
+      };
+    };
+  };
+}

services/jupyter/default.nix

@@ -1,11 +0,0 @@
-{...}: {
-  users.users.jupyter.group = "jupyter";
-  users.groups.jupyter = {};
-  services.jupyter = {
-    enable = true;
-    notebookConfig = ''
-      c.FileCheckpoints.checkpoint_dir = c.ServerApp.root_dir + ".ipynb_checkpoints"
-      c.ServerApp.open_browser = False
-    '';
-  };
-}

services/jupyter/lab.nix

@@ -1,7 +0,0 @@
-{pkgs, ...}: {
-  imports = [./default.nix];
-  services.jupyter = {
-    command = "jupyter-lab";
-    package = pkgs.python3Packages.jupyterlab;
-  };
-}

services/nextcloud/default.nix

@@ -1,4 +1,7 @@
-{ pkgs, config, ... }: {
+{ pkgs, config, ... }:
+
+{
+  imports = [ ../traefik/nextcloud.nix ];
   services.nextcloud = {
     enable = true;
     package = pkgs.nextcloud27;

services/ntfy-sh/default.nix

@@ -0,0 +1,14 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.ntfy-sh = {
+    enable = true;
+    settings = {
+      base-url = "https://ntfy.xenia.me.uk";
+      listen-http = ":8800";
+      behind-proxy = true;
+      enable-signup = false;
+      enable-metrics = true;
+    };
+  };
+}

services/sshd/default.nix

@@ -1,7 +1,9 @@
-{...}: {
+{ config, lib, pkgs, ... }:
+
+{
   services.openssh = {
     enable = true;
-    ports = [22];
+    ports = [ 22 ];
     settings = {
       UseDns = true;
       PermitRootLogin = "no";

services/traefik/adguardhome.nix

@@ -1,12 +1,15 @@
-{...}: {
+{ config, lib, pkgs, ... }:
-  imports = [./default.nix];
+
+{
+  imports = [ ./default.nix ];
   services.traefik.dynamicConfigOptions.http = {
     routers.adguard = {
       rule = "Host(`guard.xenia.me.uk`)";
-      entryPoints = ["http" "https"];
+      entryPoints = [ "http" "https" ];
       service = "adguard-webinterface";
-      tls = {certResolver = "default";};
+      tls = { certResolver = "default"; };
     };
-    services.adguard-webinterface.loadBalancer.servers = [{url = "http://localhost:3001";}];
+    services.adguard-webinterface.loadBalancer.servers =
+      [{ url = "http://localhost:3001"; }];
   };
 }

services/traefik/default.nix

@@ -1,9 +1,11 @@
-{...}: {
+{ config, lib, pkgs, ... }:
-  imports = [../fail2ban/traefik.nix];
+
+{
+  imports = [ ../fail2ban/traefik.nix ];
   services.traefik = {
     enable = true;
     staticConfigOptions = {
-      api = {dashboard = true;};
+      api = { dashboard = true; };
       entryPoints = {
         http = {
           address = ":80";
@@ -20,7 +22,7 @@
           acme = {
             email = "evie@xenia.me.uk";
             storage = "/var/lib/traefik/acme.json";
-            httpChallenge = {entryPoint = "http";};
+            httpChallenge = { entryPoint = "http"; };
           };
         };
       };
@@ -31,19 +33,20 @@
         routers = {
           api = {
             rule = "Host(`traefik.xenia.me.uk`)";
-            entryPoints = ["http" "https"];
+            entryPoints = [ "http" "https" ];
             service = "api@internal";
-            middlewares = ["auth"];
+            middlewares = [ "auth" ];
-            tls = {certResolver = "default";};
+            tls = { certResolver = "default"; };
           };
           api-internal = {
             rule = "ClientIP(`192.168.0.0/16`)";
-            entryPoints = ["traefik-internal"];
+            entryPoints = [ "traefik-internal" ];
             service = "api@internal";
           };
         };
         middlewares = {
-          auth.basicAuth.users = ["xenia:$apr1$LB0wVd6I$BHVPIyh.F5Ewt9/7PqAtS."];
+          auth.basicAuth.users =
+            [ "xenia:$apr1$LB0wVd6I$BHVPIyh.F5Ewt9/7PqAtS." ];
           hsts.headers = {
             stsSeconds = "31536000";
             stsIncludeSubdomains = true;
@@ -54,6 +57,6 @@
   };
   networking.firewall = {
     enable = true;
-    allowedTCPPorts = [80 443 8080];
+    allowedTCPPorts = [ 80 443 8080 ];
   };
 }

services/traefik/gitea.nix

@@ -1,14 +1,17 @@
-{...}: {
+{ config, lib, pkgs, ... }:
-  imports = [./default.nix];
+
+{
+  imports = [ ./default.nix ];
   services.traefik.dynamicConfigOptions = {
     http = {
       routers.gitea = {
         rule = "Host(`git.xenia.me.uk`)";
-        entryPoints = ["http" "https"];
+        entryPoints = [ "http" "https" ];
         service = "gitea-websecure";
-        tls = {certResolver = "default";};
+        tls = { certResolver = "default"; };
       };
-      services.gitea-websecure.loadBalancer.servers = [{url = "http://localhost:3000";}];
+      services.gitea-websecure.loadBalancer.servers =
+        [{ url = "http://localhost:3000"; }];
     };
   };
 }

services/traefik/nextcloud.nix

@@ -1,13 +1,16 @@
-{...}: {
+{ config, lib, pkgs, ... }:
-  imports = [./default.nix];
+
+{
+  imports = [ ./default.nix ];
   services.traefik.dynamicConfigOptions.http = {
     routers.nextcloud = {
       rule = "Host(`cloud.xenia.me.uk`)";
-      entryPoints = ["http" "https"];
+      entryPoints = [ "http" "https" ];
       service = "nextcloud-webinterface";
-      middlewares = ["hsts"];
+      middlewares = [ "hsts" ];
-      tls = {certResolver = "default";};
+      tls = { certResolver = "default"; };
     };
-    services.nextcloud-webinterface.loadBalancer.servers = [{url = "http://localhost:8000";}];
+    services.nextcloud-webinterface.loadBalancer.servers =
+      [{ url = "http://localhost:8000"; }];
   };
 }

services/traefik/ntfy-sh.nix

@@ -0,0 +1,17 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [ ./default.nix ];
+  services.traefik.dynamicConfigOptions = {
+    http = {
+      routers.ntfy-sh = {
+        rule = "Host(`ntfy.xenia.me.uk`)";
+        entryPoints = [ "http" "https" ];
+        service = "ntfy-sh-service";
+        tls = { certResolver = "default"; };
+      };
+      services.ntfy-sh-service.loadBalancer.servers =
+        [{ url = "http://localhost:8800"; }];
+    };
+  };
+}

services/traefik/qbittorrent.nix

@@ -1,14 +0,0 @@
-{pkgs, ...}: {
-  imports = [./default.nix];
-  environment.systemPackages = [pkgs.qbittorrent];
-  services.traefik.dynamicConfigOptions.http = {
-    routers.qbittorrent = {
-      rule = "Host(`torrent.xenia.me.uk`)";
-      entryPoints = ["http" "https"];
-      service = "qbittorrent-webinterface";
-      middlewares = ["auth"];
-      tls = {certResolver = "default";};
-    };
-    services.qbittorrent-webinterface.loadBalancer.servers = [{url = "http://localhost:8090";}];
-  };
-}