genebean/dots
1
0
Fork 0
mirror of https://github.com/genebean/dots.git synced 2026-05-31 07:45:20 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add dots.ports module: fleet-wide service port registry (nixnuc + hetznix01)

Browse source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Gene Liverman 2026-05-28 22:42:49 -04:00
parent 84a5c695b0
commit 94fdc678e4
No known key found for this signature in database
15 changed files with 353 additions and 135 deletions
Download patch file Download diff file Expand all files Collapse all files

5
modules/hosts/nixos/nixnuc/containers/audiobookshelf.nix
View file

@ -1,7 +1,6 @@
_:
{ config, ... }:
let
volume_base = "/var/lib/audiobookshelf";
http_port = "13378";
in
{
# Audiobookshelf
@ -14,7 +13,7 @@ in
AUDIOBOOKSHELF_UID = "99";
AUDIOBOOKSHELF_GID = "100";
};
ports = [ "${http_port}:80" ];
ports = [ "${toString config.dots.ports.audiobookshelf.port}:80" ];
volumes = [
"${volume_base}/audiobooks:/audiobooks"
"${volume_base}/podcasts:/podcasts"

3
modules/hosts/nixos/nixnuc/containers/photon.nix
View file

@ -1,7 +1,6 @@
{ config, ... }:
let
volume_base = "/orico/photon";
http_port = "2322";
in
{
systemd.services."${config.virtualisation.oci-containers.containers.photon.serviceName}" = {
@ -19,7 +18,7 @@ in
UPDATE_STRATEGY = "PARALLEL";
UPDATE_INTERVAL = "30d";
};
ports = [ "${http_port}:2322" ];
ports = [ "${toString config.dots.ports.photon.port}:2322" ];
volumes = [
"${volume_base}:/photon/data"
];

3
modules/hosts/nixos/nixnuc/containers/psitransfer.nix
View file

@ -1,7 +1,6 @@
{ config, ... }:
let
volume_base = "/orico/psitransfer";
http_port = "3000";
psitransfer_dot_env = "${config.sops.secrets.psitransfer_dot_env.path}";
in
{
@ -24,7 +23,7 @@ in
autoStart = true;
image = "psitrax/psitransfer";
environmentFiles = [ psitransfer_dot_env ];
ports = [ "${http_port}:3000" ];
ports = [ "${toString config.dots.ports.psitransfer.port}:3000" ];
volumes = [
"${volume_base}/data:/data"
];

4
modules/hosts/nixos/nixnuc/cup-collector.nix
View file

@ -22,9 +22,9 @@ in
];
migrationsDir = inputs.cup-collector.packages.${pkgs.stdenv.hostPlatform.system}.migrations;
pbBindIp = "0.0.0.0";
pbPort = 8091; # override default due to conflict
pbPort = config.dots.ports.pocketbase.port; # override default due to conflict
pocketidIssuerUrl = config.services.pocket-id.settings.APP_URL;
port = 3010; # override default due to conflict
inherit (config.dots.ports.cup-collector) port; # override default due to conflict
};
restic.backups.daily = {

94
modules/hosts/nixos/nixnuc/default.nix
View file

@ -1,12 +1,12 @@
{
inputs,
config,
lib,
pkgs,
username,
...
}:
let
https_port = 443;
home_domain = "home.technicalissues.us";
backend_ip = "127.0.0.1";
restic_backup_time = "02:00";
@ -20,8 +20,10 @@ in
./containers/psitransfer.nix
./cup-collector.nix
./monitoring-stack.nix
./ports.nix
./zfs-datasets.nix
../../../shared/nixos/lets-encrypt.nix
../../../shared/nixos/ports.nix
../../../shared/nixos/restic.nix
];
@ -71,36 +73,18 @@ in
};
networking = {
# Open ports in the firewall.
firewall = {
allowedTCPPorts = [
22 # ssh
80 # http to local Nginx
443 # https to local Nginx
2322 # Photon geocoder in oci-container
3000 # PsiTransfer in oci-container
3001 # immich-kiosk in compose
3002 # grafana
3005 # Firefly III
3006 # Firefly III Data Importer
3010 # Cup Collector
3030 # Forgejo
3087 # Youtarr in docker compose
8001 # Tube Archivist
8384 # Syncthing gui
8888 # Atuin
8090 # Wallabag in docker compose
8091 # PocketBase
8945 # Pinchflat
13378 # Audiobookshelf in oci-container
allowedTCPPorts = lib.pipe config.dots.ports [
builtins.attrValues
(builtins.filter (e: e.openFirewall && e.protocol == "tcp"))
(map (e: e.port))
];
allowedUDPPorts = [
1900 # Jellyfin service auto-discovery
7359 # Jellyfin auto-discovery
allowedUDPPorts = lib.pipe config.dots.ports [
builtins.attrValues
(builtins.filter (e: e.openFirewall && e.protocol == "udp"))
(map (e: e.port))
];
};
# Or disable the firewall altogether.
# firewall.enable = false;
hostId = "c5826b45"; # head -c4 /dev/urandom | od -A none -t x4
@ -177,7 +161,7 @@ in
enable = true;
enableNginx = true;
settings = {
FIREFLY_III_URL = "http://localhost:3005";
FIREFLY_III_URL = "http://localhost:${toString config.dots.ports.fireflyiii.port}";
VANITY_URL_FILE = "${config.sops.secrets.firefly_vanity_url.path}";
FIREFLY_III_ACCESS_TOKEN_FILE = "${config.sops.secrets.firefly_pat_data_import.path}";
SIMPLEFIN_TOKEN_FILE = "${config.sops.secrets.firefly_simplefin_token.path}";
@ -203,7 +187,7 @@ in
};
server = {
DOMAIN = "git.${home_domain}";
HTTP_PORT = 3030;
HTTP_PORT = config.dots.ports.forgejo.port;
LANDING_PAGE = "explore";
ROOT_URL = "https://git.${home_domain}/";
};
@ -222,7 +206,7 @@ in
enable = true;
credentialsFile = config.sops.secrets.mealie.path;
listenAddress = "0.0.0.0";
port = 9000;
inherit (config.dots.ports.mealie) port;
settings = {
ALLOW_SIGNUP = "false";
BASE_URL = "https://mealie.${home_domain}";
@ -314,7 +298,7 @@ in
];
listen = [
{
port = https_port;
inherit (config.dots.ports.https) port;
addr = "0.0.0.0";
ssl = true;
}
@ -339,7 +323,7 @@ in
"ab.${home_domain}" = {
listen = [
{
port = https_port;
inherit (config.dots.ports.https) port;
addr = "0.0.0.0";
ssl = true;
}
@ -348,7 +332,7 @@ in
acmeRoot = null;
forceSSL = true;
locations."/".proxyWebsockets = true;
locations."/".proxyPass = "http://${backend_ip}:13378";
locations."/".proxyPass = "http://${backend_ip}:${toString config.dots.ports.audiobookshelf.port}";
extraConfig = ''
client_max_body_size 0;
'';
@ -356,7 +340,7 @@ in
"atuin.${home_domain}" = {
listen = [
{
port = https_port;
inherit (config.dots.ports.https) port;
addr = "0.0.0.0";
ssl = true;
}
@ -364,19 +348,19 @@ in
enableACME = true;
acmeRoot = null;
forceSSL = true;
locations."/".proxyPass = "http://${backend_ip}:8888";
locations."/".proxyPass = "http://${backend_ip}:${toString config.dots.ports.atuin.port}";
};
# budget.${home_domain}
"${config.services.firefly-iii.virtualHost}".listen = [
{
port = 3005;
inherit (config.dots.ports.fireflyiii) port;
addr = "0.0.0.0";
ssl = false;
}
];
"${config.services.firefly-iii-data-importer.virtualHost}".listen = [
{
port = 3006;
inherit (config.dots.ports.fireflyiii-importer) port;
addr = "0.0.0.0";
ssl = false;
}
@ -384,7 +368,7 @@ in
"git.${home_domain}" = {
listen = [
{
port = https_port;
inherit (config.dots.ports.https) port;
addr = "0.0.0.0";
ssl = true;
}
@ -392,7 +376,7 @@ in
enableACME = true;
acmeRoot = null;
forceSSL = true;
locations."/".proxyPass = "http://${backend_ip}:3030";
locations."/".proxyPass = "http://${backend_ip}:${toString config.dots.ports.forgejo.port}";
extraConfig = ''
client_max_body_size 0;
'';
@ -400,7 +384,7 @@ in
"id.${home_domain}" = {
listen = [
{
port = https_port;
inherit (config.dots.ports.https) port;
addr = "0.0.0.0";
ssl = true;
}
@ -408,7 +392,7 @@ in
enableACME = true;
acmeRoot = null;
forceSSL = true;
locations."/".proxyPass = "http://${backend_ip}:1411";
locations."/".proxyPass = "http://${backend_ip}:${toString config.dots.ports.pocket-id.port}";
extraConfig = ''
proxy_busy_buffers_size 512k;
proxy_buffers 4 512k;
@ -418,7 +402,7 @@ in
"immich.${home_domain}" = {
listen = [
{
port = https_port;
inherit (config.dots.ports.https) port;
addr = "0.0.0.0";
ssl = true;
}
@ -426,7 +410,7 @@ in
enableACME = true;
acmeRoot = null;
forceSSL = true;
locations."/".proxyPass = "http://${backend_ip}:2283";
locations."/".proxyPass = "http://${backend_ip}:${toString config.dots.ports.immich.port}";
locations."/".proxyWebsockets = true;
extraConfig = ''
client_max_body_size 0;
@ -438,7 +422,7 @@ in
"immich-kiosk.${home_domain}" = {
listen = [
{
port = https_port;
inherit (config.dots.ports.https) port;
addr = "0.0.0.0";
ssl = true;
}
@ -447,7 +431,7 @@ in
acmeRoot = null;
forceSSL = true;
basicAuthFile = config.sops.secrets.immich_kiosk_basic_auth.path;
locations."/".proxyPass = "http://${backend_ip}:3001";
locations."/".proxyPass = "http://${backend_ip}:${toString config.dots.ports.immich-kiosk.port}";
locations."/".proxyWebsockets = true;
extraConfig = ''
client_max_body_size 0;
@ -459,7 +443,7 @@ in
"jellyfin.${home_domain}" = {
listen = [
{
port = https_port;
inherit (config.dots.ports.https) port;
addr = "0.0.0.0";
ssl = true;
}
@ -469,14 +453,14 @@ in
forceSSL = true;
locations = {
"/" = {
proxyPass = "http://${backend_ip}:8096";
proxyPass = "http://${backend_ip}:${toString config.dots.ports.jellyfin.port}";
extraConfig = ''
proxy_buffering off;
proxy_set_header X-Forwarded-Protocol $scheme;
'';
};
"/socket" = {
proxyPass = "http://${backend_ip}:8096";
proxyPass = "http://${backend_ip}:${toString config.dots.ports.jellyfin.port}";
proxyWebsockets = true;
extraConfig = ''
proxy_set_header X-Forwarded-Protocol $scheme;
@ -490,7 +474,7 @@ in
"mealie.${home_domain}" = {
listen = [
{
port = https_port;
inherit (config.dots.ports.https) port;
addr = "0.0.0.0";
ssl = true;
}
@ -498,7 +482,7 @@ in
enableACME = true;
acmeRoot = null;
forceSSL = true;
locations."/".proxyPass = "http://${backend_ip}:9000";
locations."/".proxyPass = "http://${backend_ip}:${toString config.dots.ports.mealie.port}";
extraConfig = ''
client_max_body_size 10M;
'';
@ -506,7 +490,7 @@ in
"monitoring.${home_domain}" = {
listen = [
{
port = https_port;
inherit (config.dots.ports.https) port;
addr = "0.0.0.0";
ssl = true;
}
@ -515,10 +499,10 @@ in
acmeRoot = null;
forceSSL = true;
locations = {
"/grafana/".proxyPass = "http://${backend_ip}:3002/grafana/";
"/grafana/".proxyPass = "http://${backend_ip}:${toString config.dots.ports.grafana.port}/grafana/";
"/remotewrite" = {
basicAuthFile = config.sops.secrets.nginx_basic_auth.path;
proxyPass = "http://127.0.0.1:8428/api/v1/write";
proxyPass = "http://127.0.0.1:${toString config.dots.ports.victoriametrics.port}/api/v1/write";
proxyWebsockets = true;
};
};
@ -531,7 +515,7 @@ in
"readit.${home_domain}" = {
listen = [
{
port = https_port;
inherit (config.dots.ports.https) port;
addr = "0.0.0.0";
ssl = true;
}
@ -539,7 +523,7 @@ in
enableACME = true;
acmeRoot = null;
forceSSL = true;
locations."/".proxyPass = "http://${backend_ip}:8090";
locations."/".proxyPass = "http://${backend_ip}:${toString config.dots.ports.wallabag.port}";
};
};
};

22
modules/hosts/nixos/nixnuc/monitoring-stack.nix
View file

@ -49,9 +49,9 @@ in
static_configs = [
{
targets = [
"127.0.0.1:9100" # nixnuc
"192.168.22.22:9100" # home assistant
"umbrel:9100"
"127.0.0.1:${toString config.dots.ports.node-exporter.port}" # nixnuc
"192.168.22.22:${toString config.dots.ports.node-exporter.port}" # home assistant
"umbrel:${toString config.dots.ports.node-exporter.port}"
];
}
];
@ -89,7 +89,7 @@ in
{
job_name = "cadvisor";
static_configs = [
{ targets = [ "127.0.0.1:8081" ]; }
{ targets = [ "127.0.0.1:${toString config.dots.ports.cadvisor.port}" ]; }
];
metric_relabel_configs = [
{
@ -110,7 +110,7 @@ in
{
job_name = "nginx";
static_configs = [
{ targets = [ "127.0.0.1:9113" ]; }
{ targets = [ "127.0.0.1:${toString config.dots.ports.nginx-exporter.port}" ]; }
];
metric_relabel_configs = [
{
@ -181,7 +181,7 @@ in
};
# Remote write to VictoriaMetrics
remoteWrite.url = "http://127.0.0.1:8428/api/v1/write";
remoteWrite.url = "http://127.0.0.1:${toString config.dots.ports.victoriametrics.port}/api/v1/write";
extraArgs = [
# Pass other remote write flags the module does not expose natively:
@ -219,7 +219,7 @@ in
name = "VictoriaMetrics";
type = "victoriametrics-metrics-datasource";
access = "proxy";
url = "http://127.0.0.1:8428";
url = "http://127.0.0.1:${toString config.dots.ports.victoriametrics.port}";
isDefault = true;
uid = "VictoriaMetrics"; # Set explicit UID for use in alert rules
}
@ -272,7 +272,7 @@ in
server = {
domain = "monitoring.${home_domain}";
http_addr = "0.0.0.0";
http_port = 3002;
http_port = config.dots.ports.grafana.port;
root_url = "https://monitoring.${home_domain}/grafana/";
serve_from_sub_path = true;
};
@ -295,7 +295,7 @@ in
prometheus.exporters.node = {
enable = true;
listenAddress = "127.0.0.1";
port = 9100;
inherit (config.dots.ports.node-exporter) port;
enabledCollectors = [
"zfs"
"systemd"
@ -310,7 +310,7 @@ in
prometheus.exporters.nginx = {
enable = true;
listenAddress = "127.0.0.1";
port = 9113;
inherit (config.dots.ports.nginx-exporter) port;
scrapeUri = "https://127.0.0.1/server_status";
sslVerify = false;
};
@ -319,7 +319,7 @@ in
cadvisor = {
enable = true;
listenAddress = "127.0.0.1";
port = 8081;
inherit (config.dots.ports.cadvisor) port;
extraOptions = [
"--docker_only=true"
"--housekeeping_interval=30s"

102
modules/hosts/nixos/nixnuc/ports.nix Normal file
View file

@ -0,0 +1,102 @@
{
config.dots.ports = {
# Override global photon default: open the firewall on this host
photon = {
openFirewall = true;
};
# Firewalled TCP services
psitransfer = {
port = 3000;
openFirewall = true;
};
immich-kiosk = {
port = 3001;
openFirewall = true;
};
grafana = {
port = 3002;
openFirewall = true;
};
fireflyiii = {
port = 3005;
openFirewall = true;
};
fireflyiii-importer = {
port = 3006;
openFirewall = true;
};
cup-collector = {
port = 3010;
openFirewall = true;
};
forgejo = {
port = 3030;
openFirewall = true;
};
youtarr = {
port = 3087;
openFirewall = true;
};
tube-archivist = {
port = 8001;
openFirewall = true;
};
syncthing-gui = {
port = 8384;
openFirewall = true;
};
atuin = {
port = 8888;
openFirewall = true;
};
wallabag = {
port = 8090;
openFirewall = true;
};
pocketbase = {
port = 8091;
openFirewall = true;
};
pinchflat = {
port = 8945;
openFirewall = true;
};
audiobookshelf = {
port = 13378;
openFirewall = true;
};
# Internal-only TCP services (proxied via nginx, not firewalled)
pocket-id = {
port = 1411;
};
immich = {
port = 2283;
};
cadvisor = {
port = 8081;
};
victoriametrics = {
port = 8428;
};
jellyfin = {
port = 8096;
};
mealie = {
port = 9000;
};
# UDP services
jellyfin-ssdp = {
port = 1900;
protocol = "udp";
openFirewall = true;
};
jellyfin-discovery = {
port = 7359;
protocol = "udp";
openFirewall = true;
};
};
}