genebean/dots
1
0
Fork 0
mirror of https://github.com/genebean/dots.git synced 2026-05-31 07:45:20 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add dots.ports module: fleet-wide service port registry (nixnuc + hetznix01)

Browse source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Gene Liverman 2026-05-28 22:42:49 -04:00
parent 84a5c695b0
commit 94fdc678e4
No known key found for this signature in database
15 changed files with 353 additions and 135 deletions
Download patch file Download diff file Expand all files Collapse all files

37
modules/hosts/nixos/hetznix01/default.nix
View file

@ -1,4 +1,6 @@
{
config,
lib,
pkgs,
username,
...
@ -6,8 +8,10 @@
{
imports = [
../../../shared/nixos/nixroutes.nix
../../../shared/nixos/ports.nix
./disk-config.nix
./hardware-configuration.nix
./ports.nix
./post-install
];
@ -27,27 +31,18 @@
];
networking = {
# Open ports in the firewall.
firewall.allowedTCPPorts = [
22 # ssh
25 # SMTP (unencrypted)
80 # http to local Nginx
143 # imap
443 # https to local Nginx
465 # SMTP with TLS
587 # SMTP with STARTTLS
993 # imaps
1883 # mqtt
8333 # Bitcoin Core
8448 # Matrix Synapse
8883 # mqtt over tls
9001 # mqtt websockets over tls
9333 # Bitcoin Knots
9735 # LND
];
# firewall.allowedUDPPorts = [ ... ];
# Or disable the firewall altogether.
# firewall.enable = false;
firewall = {
allowedTCPPorts = lib.pipe config.dots.ports [
builtins.attrValues
(builtins.filter (e: e.openFirewall && e.protocol == "tcp"))
(map (e: e.port))
];
allowedUDPPorts = lib.pipe config.dots.ports [
builtins.attrValues
(builtins.filter (e: e.openFirewall && e.protocol == "udp"))
(map (e: e.port))
];
};
hostId = "85d0e6cb"; # head -c4 /dev/urandom | od -A none -t x4

82
modules/hosts/nixos/hetznix01/ports.nix Normal file
View file

@ -0,0 +1,82 @@
{
config.dots.ports = {
# Firewalled TCP services (email)
smtp = {
port = 25;
openFirewall = true;
};
imap = {
port = 143;
openFirewall = true;
};
smtp-tls = {
port = 465;
openFirewall = true;
};
smtp-starttls = {
port = 587;
openFirewall = true;
};
imaps = {
port = 993;
openFirewall = true;
};
# MQTT (via EMQX container)
mqtt = {
port = 1883;
openFirewall = true;
};
mqtt-tls = {
port = 8883;
openFirewall = true;
};
mqtt-ws = {
port = 9001;
openFirewall = true;
};
# Bitcoin / Lightning (proxied to umbrel on tailnet)
bitcoin-core = {
port = 8333;
openFirewall = true;
};
bitcoin-knots = {
port = 9333;
openFirewall = true;
};
lnd = {
port = 9735;
openFirewall = true;
};
# Matrix federation listener (nginx terminates, proxies to matrix-synapse)
matrix-federation = {
port = 8448;
openFirewall = true;
};
# Internal-only TCP services (proxied via nginx, not firewalled)
matrix-synapse = {
port = 8008;
};
owntracks-frontend = {
port = 8082;
};
owntracks-recorder = {
port = 8083;
};
plausible = {
port = 8001;
};
uptime-kuma = {
port = 3001;
};
collabora = {
port = 9980;
};
emqx-admin = {
port = 18083;
};
};
}

4
modules/hosts/nixos/hetznix01/post-install/containers/emqx.nix
View file

@ -16,10 +16,10 @@ in
];
hostname = "emqx1.hetznix01.technicalissues.us";
ports = [
"1883:1883"
"${toString config.dots.ports.mqtt.port}:1883"
#"8083:8083"
#"8084:8084"
"18083:18083"
"${toString config.dots.ports.emqx-admin.port}:18083"
];
volumes = [
"${volume_base}/data:/opt/emqx/data"

6
modules/hosts/nixos/hetznix01/post-install/default.nix
View file

@ -23,7 +23,7 @@ in
services = {
collabora-online = {
enable = true;
port = 9980; # default
inherit (config.dots.ports.collabora) port;
settings = {
# Rely on reverse proxy for SSL
ssl = {
@ -51,7 +51,7 @@ in
enable = true;
configureNginx = true;
environment = {
PHOTON_API_HOST = "nixnuc.${config.private-flake.tailnetDomain}:2322";
PHOTON_API_HOST = "nixnuc.${config.private-flake.tailnetDomain}:${toString config.dots.ports.photon.port}";
PHOTON_API_USE_HTTPS = "false";
};
extraEnvFiles = [
@ -122,7 +122,7 @@ in
server = {
baseUrl = "https://stats.${domain}";
disableRegistration = true;
port = 8001;
inherit (config.dots.ports.plausible) port;
# secretKeybaseFile is a path to the file which contains the secret generated
# with openssl as described above.
secretKeybaseFile = config.sops.secrets.plausible_secret_key_base.path;

2
modules/hosts/nixos/hetznix01/post-install/matrix-synapse.nix
View file

@ -13,7 +13,7 @@
signing_key_path = config.sops.secrets.matrix_homeserver_signing_key.path;
listeners = [
{
port = 8008;
inherit (config.dots.ports.matrix-synapse) port;
tls = false;
type = "http";
x_forwarded = true;

8
modules/hosts/nixos/hetznix01/post-install/monitoring.nix
View file

@ -16,7 +16,7 @@ in
{
job_name = "node";
static_configs = [
{ targets = [ "127.0.0.1:9100" ]; }
{ targets = [ "127.0.0.1:${toString config.dots.ports.node-exporter.port}" ]; }
];
metric_relabel_configs = [
{
@ -37,7 +37,7 @@ in
{
job_name = "nginx";
static_configs = [
{ targets = [ "127.0.0.1:9113" ]; }
{ targets = [ "127.0.0.1:${toString config.dots.ports.nginx-exporter.port}" ]; }
];
metric_relabel_configs = [
{
@ -84,7 +84,7 @@ in
prometheus.exporters.node = {
enable = true;
listenAddress = "127.0.0.1";
port = 9100;
inherit (config.dots.ports.node-exporter) port;
enabledCollectors = [
"systemd"
];
@ -98,7 +98,7 @@ in
prometheus.exporters.nginx = {
enable = true;
listenAddress = "127.0.0.1";
port = 9113;
inherit (config.dots.ports.nginx-exporter) port;
scrapeUri = "https://127.0.0.1/server_status";
sslVerify = false;
};

56
modules/hosts/nixos/hetznix01/post-install/nginx.nix
View file

@ -1,8 +1,6 @@
{ config, ... }:
let
domain = "technicalissues.us";
http_port = 80;
https_port = 443;
private_btc = "umbrel.${config.private-flake.tailnetDomain}";
in
{
@ -25,13 +23,13 @@ in
streamConfig = ''
server {
# https://docs.emqx.com/en/emqx/latest/deploy/cluster/lb-nginx.html
listen 8883 ssl;
listen ${toString config.dots.ports.mqtt-tls.port} ssl;
ssl_session_timeout 10m;
ssl_certificate ${config.security.acme.certs."mqtt.${domain}".directory}/fullchain.pem;
ssl_certificate_key ${config.security.acme.certs."mqtt.${domain}".directory}/key.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
proxy_pass 127.0.0.0:1883;
proxy_pass 127.0.0.0:${toString config.dots.ports.mqtt.port};
proxy_protocol on;
proxy_connect_timeout 10s;
# Default keep-alive time is 10 minutes
@ -41,17 +39,17 @@ in
}
server {
listen 0.0.0.0:8333;
listen 0.0.0.0:9333;
listen [::]:8333;
listen [::]:9333;
proxy_pass ${private_btc}:8333;
listen 0.0.0.0:${toString config.dots.ports.bitcoin-core.port};
listen 0.0.0.0:${toString config.dots.ports.bitcoin-knots.port};
listen [::]:${toString config.dots.ports.bitcoin-core.port};
listen [::]:${toString config.dots.ports.bitcoin-knots.port};
proxy_pass ${private_btc}:${toString config.dots.ports.bitcoin-core.port};
}
server {
listen 0.0.0.0:9735;
listen [::]:9735;
proxy_pass ${private_btc}:9735;
listen 0.0.0.0:${toString config.dots.ports.lnd.port};
listen [::]:${toString config.dots.ports.lnd.port};
proxy_pass ${private_btc}:${toString config.dots.ports.lnd.port};
}
'';
virtualHosts = {
@ -137,32 +135,32 @@ in
"matrix.${domain}" = {
listen = [
{
port = http_port;
inherit (config.dots.ports.http) port;
addr = "0.0.0.0";
}
{
port = http_port;
inherit (config.dots.ports.http) port;
addr = "[::]";
}
{
port = https_port;
inherit (config.dots.ports.https) port;
addr = "0.0.0.0";
ssl = true;
}
{
port = https_port;
inherit (config.dots.ports.https) port;
addr = "[::]";
ssl = true;
}
{
port = 8448;
inherit (config.dots.ports.matrix-federation) port;
addr = "0.0.0.0";
ssl = true;
}
{
port = 8448;
inherit (config.dots.ports.matrix-federation) port;
addr = "[::]";
ssl = true;
}
@ -182,9 +180,9 @@ in
};
# Forward all Matrix API calls to the synapse Matrix homeserver. A trailing slash
# *must not* be used here.
"/_matrix".proxyPass = "http://[::1]:8008";
"/_matrix".proxyPass = "http://[::1]:${toString config.dots.ports.matrix-synapse.port}";
# Forward requests for e.g. SSO and password-resets.
"/_synapse/client".proxyPass = "http://[::1]:8008";
"/_synapse/client".proxyPass = "http://[::1]:${toString config.dots.ports.matrix-synapse.port}";
};
};
"mqtt.${domain}" = {
@ -199,7 +197,7 @@ in
forceSSL = true;
basicAuthFile = config.sops.secrets.owntracks_basic_auth.path;
# OwnTracks Frontend container
locations."/".proxyPass = "http://127.0.0.1:8082";
locations."/".proxyPass = "http://127.0.0.1:${toString config.dots.ports.owntracks-frontend.port}";
};
"pack1828.org" = {
enableACME = true;
@ -217,26 +215,26 @@ in
locations = {
# OwnTracks Recorder
"/" = {
proxyPass = "http://127.0.0.1:8083";
proxyPass = "http://127.0.0.1:${toString config.dots.ports.owntracks-recorder.port}";
};
"/pub" = {
# Client apps need to point to this path
extraConfig = "proxy_set_header X-Limit-U $remote_user;";
proxyPass = "http://127.0.0.1:8083/pub";
proxyPass = "http://127.0.0.1:${toString config.dots.ports.owntracks-recorder.port}/pub";
};
"/static/" = {
proxyPass = "http://127.0.0.1:8083/static/";
proxyPass = "http://127.0.0.1:${toString config.dots.ports.owntracks-recorder.port}/static/";
};
"/utils/" = {
proxyPass = "http://127.0.0.1:8083/utils/";
proxyPass = "http://127.0.0.1:${toString config.dots.ports.owntracks-recorder.port}/utils/";
};
"/view/" = {
extraConfig = "proxy_buffering off;";
proxyPass = "http://127.0.0.1:8083/view/";
proxyPass = "http://127.0.0.1:${toString config.dots.ports.owntracks-recorder.port}/view/";
};
"/ws" = {
extraConfig = "rewrite ^/(.*) /$1 break;";
proxyPass = "http://127.0.0.1:8083";
proxyPass = "http://127.0.0.1:${toString config.dots.ports.owntracks-recorder.port}";
};
};
};
@ -244,7 +242,7 @@ in
enableACME = true;
acmeRoot = null;
forceSSL = true;
locations."/".proxyPass = "http://127.0.0.1:8001";
locations."/".proxyPass = "http://127.0.0.1:${toString config.dots.ports.plausible.port}";
locations."/".proxyWebsockets = true;
extraConfig = ''
access_log /var/log/nginx/stats.${domain}.log;
@ -259,7 +257,7 @@ in
acmeRoot = null;
forceSSL = true;
locations."/".proxyWebsockets = true;
locations."/".proxyPass = "http://127.0.0.1:3001";
locations."/".proxyPass = "http://127.0.0.1:${toString config.dots.ports.uptime-kuma.port}";
};
}; # end virtualHosts
}; # end nginx