lite smått och gott

moduler/programs.nix

@@ -65,6 +65,9 @@
     evince
     spotify
     firefox
+	ipcalc
+
+	dbeaver-bin
 
     # ansible
     # freecad-wayland

moduler/services/immich/default.nix

@@ -0,0 +1,63 @@
+{
+  lib,
+  pkgs,
+  config,
+  myhost,
+  ...
+}:
+let
+  cfg = config.services.immich;
+  srv = cfg.settings.server;
+in
+with lib;
+{
+  options = {
+    immich = {
+      enable = mkEnableOption "enables immich";
+      domain = lib.mkOption {
+        type = lib.types.str;
+        default = "immich.wastring.com";
+        description = "The hostname that Immich is served on.";
+      };
+      port = lib.mkOption {
+        type = lib.types.int;
+        default = 8000;
+        description = "The port that Immich is served on.";
+      };
+    };
+  };
+  config = mkMerge [
+    (mkIf config.immich.enable {
+      services.nginx = {
+        virtualHosts.${config.immich.domain} = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://[::1]:${toString config.immich.port}";
+            proxyWebsockets = true;
+            recommendedProxySettings = true;
+            extraConfig = ''
+              client_max_body_size 50000M;
+              proxy_read_timeout   600s;
+              proxy_send_timeout   600s;
+              send_timeout         600s;
+            '';
+          };
+        };
+      };
+
+      sops.secrets.immich-secrets-file = { };
+
+	  services.immich = {
+		enable = true;
+		port = config.immich.port;
+		settings = {
+			server.externalDomain = "https://${toString config.immich.domain}";
+		};
+		secretsFile = config.sops.secrets.immich-secrets-file.path;
+	  };
+
+    })
+  ];
+
+}

moduler/services/nextcloud/default.nix

@@ -11,23 +11,29 @@ let
 in
 with lib;
 {
+  imports = [
+    "${
+      fetchTarball {
+        url = "https://github.com/onny/nixos-nextcloud-testumgebung/archive/fa6f062830b4bc3cedb9694c1dbf01d5fdf775ac.tar.gz";
+        sha256 = "0gzd0276b8da3ykapgqks2zhsqdv4jjvbv97dsxg0hgrhb74z0fs";
+      }
+    }/nextcloud-extras.nix"
+  ];
   options = {
     nextcloud = {
       enable = mkEnableOption "enables nextcloud";
-      port = lib.mkOption {
-        type = lib.types.int;
-        default = 8003;
-        description = "The port that Nextcloud is served on.";
-      };
       domain = lib.mkOption {
         type = lib.types.str;
         default = "files.wastring.com";
         description = "The hostname that Nextcloud is served on.";
       };
+      fail2ban = {
+        enable = mkEnableOption "enables fail2ban integration";
+      };
     };
   };
   config = mkMerge [
-    (mkIf config.nextloud.enable {
+    (mkIf config.nextcloud.enable {
       services.nginx = {
         virtualHosts.${config.nextcloud.domain} = {
           forceSSL = true;
@@ -38,6 +44,7 @@ with lib;
       sops.secrets.nextcloud-admin-password = { };
       sops.secrets.nextcloud-fw-password = { };
       sops.secrets.nextcloud-disa-password = { };
+      sops.secrets.nextcloud-database-password = { };
 
       services.nextcloud = {
         enable = true;
@@ -45,8 +52,10 @@ with lib;
         hostName = config.nextcloud.domain;
         https = true;
         configureRedis = true;
-        config.adminpassFile = config.sops.secrets.nextcloud-admin-password.path;
-        config.dbtype = "sqlite";
+        config = {
+          adminpassFile = config.sops.secrets.nextcloud-admin-password.path;
+          dbtype = "sqlite";
+        };
         ensureUsers = {
           fw = {
             email = "fredrik@wastring.com";
@@ -79,7 +88,8 @@ with lib;
           "OC\\Preview\\HEIC"
         ];
       };
-
+    })
+    (mkIf config.nextcloud.fail2ban.enable {
       services.fail2ban = {
         enable = true;
         jails = {
@@ -96,6 +106,7 @@ with lib;
           };
         };
       };
+
     })
   ];
 

moduler/users.nix

@@ -4,13 +4,13 @@
   ...
 }:
 {
-#  sops.secrets.user-password = { };
+  #  sops.secrets.user-password = { };
   users = {
     defaultUserShell = pkgs.bash;
     users = {
       fw = {
         #	hashedPasswordFile = config.sops.secrets.user-password.path;
-	initialPassword = "password";
+        initialPassword = "password";
         isNormalUser = true;
         description = "Fredrik Wastring";
         extraGroups = [