this repo has no description
A bit of cleanup
+333
-312
+155
hosts/sand-archives/core/caddy.nix
+155
hosts/sand-archives/core/caddy.nix
···
1
+
{ pkgs, args, ... }:
2
+
let
3
+
netbird_dashboard_settings = {
4
+
NETBIRD_MGMT_API_ENDPOINT = "https://netbird.killuaa.dev";
5
+
NETBIRD_MGMT_GRPC_API_ENDPOINT = "https://netbird.killuaa.dev";
6
+
AUTH_AUTHORITY = "https://auth.awoo.ren/oauth2/openid/netbird";
7
+
AUTH_AUDIENCE = "netbird";
8
+
AUTH_CLIENT_ID = "netbird";
9
+
AUTH_SUPPORTED_SCOPES = "openid profile email offline_access api";
10
+
NETBIRD_TOKEN_SOURCE = "idToken";
11
+
USE_AUTH0 = false;
12
+
AUTH_REDIRECT_URI = "/auth";
13
+
AUTH_SILENT_REDIRECT_URI = "/silent-auth";
14
+
};
15
+
16
+
pm = (args.mods.priv_mod.get_data args);
17
+
in
18
+
{
19
+
services.caddy = {
20
+
enable = true;
21
+
email = "roufpup@killuaa.dev";
22
+
package = pkgs.caddy.withPlugins {
23
+
plugins = [
24
+
"github.com/mholt/caddy-l4@v0.0.0-20251209130418-1a3490ef786a"
25
+
"github.com/caddy-dns/rfc2136@v1.0.0"
26
+
"github.com/mholt/caddy-events-exec@v0.1.0"
27
+
];
28
+
hash = "sha256-61qiNHbh7vgQuI6Ecc9xVpHpy4faTbpvIxz9B/8bPqQ=";
29
+
};
30
+
logFormat = pkgs.lib.mkForce "level DEBUG";
31
+
globalConfig = ''
32
+
events {
33
+
on certificate_obtained exec /run/current-system/sw/bin/chmod 640 /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/{event.data.domain}/{event.data.domain}.crt /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/{event.data.domain}/{event.data.domain}.key
34
+
}
35
+
acme_dns rfc2136 {
36
+
key_name "caddy_key"
37
+
key_alg "hmac-sha512"
38
+
key "${pm.srv.bind.caddy_key}"
39
+
server "127.0.0.1:5353"
40
+
}
41
+
http_port 8880
42
+
https_port 4443
43
+
layer4 {
44
+
:80 {
45
+
@local_http {
46
+
http {
47
+
host netbird.killuaa.dev auth.awoo.ren
48
+
}
49
+
}
50
+
route @local_http {
51
+
proxy 127.0.0.1:8880
52
+
}
53
+
54
+
@inner_http {
55
+
http {
56
+
57
+
}
58
+
}
59
+
route @inner_http {
60
+
proxy ${pm.net.ipv4.vulpes.addr}:80
61
+
}
62
+
}
63
+
64
+
:443 {
65
+
@local_https {
66
+
tls {
67
+
sni netbird.killuaa.dev auth.awoo.ren syncthing.killuaa.dev
68
+
}
69
+
}
70
+
route @local_https {
71
+
proxy 127.0.0.1:4443
72
+
}
73
+
74
+
@inner_https {
75
+
tls {
76
+
77
+
}
78
+
}
79
+
route @inner_https {
80
+
proxy ${pm.net.ipv4.vulpes.addr}:443
81
+
}
82
+
}
83
+
84
+
udp/:5353 {
85
+
route {
86
+
proxy udp/${pm.net.ipv4.vulpes.addr}:5300
87
+
}
88
+
}
89
+
90
+
tcp/:5353 {
91
+
route {
92
+
proxy tcp/${pm.net.ipv4.vulpes.addr}:5300
93
+
}
94
+
}
95
+
}
96
+
'';
97
+
virtualHosts = {
98
+
"auth.awoo.ren" = {
99
+
extraConfig = ''
100
+
reverse_proxy https://127.0.0.1:8443 {
101
+
transport http {
102
+
tls
103
+
tls_server_name auth.awoo.ren
104
+
}
105
+
}
106
+
'';
107
+
};
108
+
"netbird.killuaa.dev:4443" = {
109
+
extraConfig = ''
110
+
handle /api* {
111
+
reverse_proxy http://127.0.0.1:8011
112
+
}
113
+
handle /ws-proxy/management* {
114
+
reverse_proxy http://127.0.0.1:8011
115
+
}
116
+
handle /management.ManagementService* {
117
+
reverse_proxy h2c://127.0.0.1:33073
118
+
}
119
+
120
+
handle /signalexchange.SignalExchange* {
121
+
reverse_proxy h2c://127.0.0.1:10000
122
+
}
123
+
handle /ws-proxy/signal* {
124
+
reverse_proxy http://127.0.0.1:8012
125
+
}
126
+
127
+
handle /relay* {
128
+
reverse_proxy http://127.0.0.1:33080
129
+
}
130
+
131
+
handle /* {
132
+
root * ${args.pup_lib.get_netbird_dashboard netbird_dashboard_settings}
133
+
try_files {path} {path}.html {path}/ /index.html
134
+
file_server
135
+
}
136
+
137
+
header * {
138
+
Cache-Control "no-store, no-cache, must-revalidate, max-age=0"
139
+
Strict-Transport-Security "max-age=3600; includeSubDomains; preload"
140
+
X-Content-Type-Options "nosniff"
141
+
X-Frame-Options "DENY"
142
+
X-XSS-Protection "1; mode=block"
143
+
-Server
144
+
Referrer-Policy strict-origin-when-cross-origin
145
+
}
146
+
'';
147
+
};
148
+
"syncthing.killuaa.dev" = {
149
+
extraConfig = ''
150
+
reverse_proxy 0.0.0.0:8384
151
+
'';
152
+
};
153
+
};
154
+
};
155
+
}
+88
hosts/sand-archives/core/netbird.nix
+88
hosts/sand-archives/core/netbird.nix
···
1
+
{
2
+
pkgs,
3
+
config,
4
+
args,
5
+
...
6
+
}:
7
+
let
8
+
9
+
netbird = pkgs.netbird.overrideAttrs (prev: {
10
+
src = pkgs.fetchFromGitHub {
11
+
owner = "netbirdio";
12
+
repo = "netbird";
13
+
tag = "v0.60.8";
14
+
hash = "sha256-XM4pUYimxbO3ZCmTPbg7dwDB3x2TnL9PUgbMfjHjxmo=";
15
+
};
16
+
vendorHash = "sha256-b3Wl9jsAdYC91JM/kDo4yIF05hqbivtrcn1aRuZzP3s=";
17
+
});
18
+
19
+
pm = (args.mods.priv_mod.get_data args);
20
+
in
21
+
{
22
+
services.netbird = {
23
+
package = netbird;
24
+
server = {
25
+
enable = true;
26
+
domain = "netbird.killuaa.dev";
27
+
management = {
28
+
enable = true;
29
+
oidcConfigEndpoint = "https://auth.awoo.ren/oauth2/openid/netbird/.well-known/openid-configuration";
30
+
settings = {
31
+
DataStoreEncryptionKey = {
32
+
_secret = config.sops.secrets.netbird_data_store_encryption_key.path;
33
+
};
34
+
TURNConfig.Turns = [ ];
35
+
Stuns = [ ];
36
+
Relay = {
37
+
Addresses = [ "rels://netbird.killuaa.dev:443" ];
38
+
CredentialsTTL = "12h";
39
+
Secret = {
40
+
_secret = config.sops.secrets.netbird_relay_secret.path;
41
+
};
42
+
TimeBasedCredentials = false;
43
+
};
44
+
};
45
+
};
46
+
dashboard = {
47
+
settings.AUTH_AUTHORITY = "https://auth.awoo.ren/oauth2/openid/netbird";
48
+
};
49
+
signal = {
50
+
enable = true;
51
+
};
52
+
};
53
+
clients.sand_arc = {
54
+
port = 51820;
55
+
openFirewall = false;
56
+
environment = {
57
+
NB_MANAGEMENT_URL = "https://netbird.killuaa.dev";
58
+
NB_SETUP_KEY_FILE = config.sops.secrets.nb_setup_key.path;
59
+
};
60
+
};
61
+
};
62
+
63
+
systemd.services = {
64
+
netbird-sand_arc = {
65
+
serviceConfig = {
66
+
AmbientCapabilities = [
67
+
"CAP_NET_BIND_SERVICE"
68
+
"CAP_DAC_OVERRIDE"
69
+
];
70
+
ReadWritePaths = [
71
+
"/etc/resolv.conf"
72
+
"/etc/resolv.conf.original.netbird"
73
+
];
74
+
};
75
+
};
76
+
netbird-relay = {
77
+
enable = true;
78
+
wantedBy = [ "multi-user.target" ];
79
+
after = [ "network.target" ];
80
+
serviceConfig = {
81
+
User = "netbird-sand_arc";
82
+
Group = "netbird-sand_arc";
83
+
ExecStart = "${pkgs.netbird-relay}/bin/netbird-relay --exposed-address rels://netbird.killuaa.dev:443 --listen-address :33080 --metrics-port 9092 --auth-secret ${pm.srv.netbird.relay_secret}";
84
+
Restart = "always";
85
+
};
86
+
};
87
+
};
88
+
}
-226
hosts/sand-archives/core/services.nix
-226
hosts/sand-archives/core/services.nix
···
1
1
{
2
2
args,
3
-
config,
4
3
pkgs,
5
4
...
6
5
}:
7
6
8
7
let
9
8
pm = (args.mods.priv_mod.get_data args);
10
-
netbird_dashboard_settings = {
11
-
NETBIRD_MGMT_API_ENDPOINT = "https://netbird.killuaa.dev";
12
-
NETBIRD_MGMT_GRPC_API_ENDPOINT = "https://netbird.killuaa.dev";
13
-
AUTH_AUTHORITY = "https://auth.awoo.ren/oauth2/openid/netbird";
14
-
AUTH_AUDIENCE = "netbird";
15
-
AUTH_CLIENT_ID = "netbird";
16
-
AUTH_SUPPORTED_SCOPES = "openid profile email offline_access api";
17
-
NETBIRD_TOKEN_SOURCE = "idToken";
18
-
USE_AUTH0 = false;
19
-
AUTH_REDIRECT_URI = "/auth";
20
-
AUTH_SILENT_REDIRECT_URI = "/silent-auth";
21
-
};
22
-
netbird = pkgs.netbird.overrideAttrs (prev: {
23
-
src = pkgs.fetchFromGitHub {
24
-
owner = "netbirdio";
25
-
repo = "netbird";
26
-
tag = "v0.60.8";
27
-
hash = "sha256-XM4pUYimxbO3ZCmTPbg7dwDB3x2TnL9PUgbMfjHjxmo=";
28
-
};
29
-
vendorHash = "sha256-b3Wl9jsAdYC91JM/kDo4yIF05hqbivtrcn1aRuZzP3s=";
30
-
});
31
9
in
32
10
{
33
11
services = {
···
55
33
};
56
34
};
57
35
58
-
caddy = {
59
-
enable = true;
60
-
email = "roufpup@killuaa.dev";
61
-
package = pkgs.caddy.withPlugins {
62
-
plugins = [
63
-
"github.com/mholt/caddy-l4@v0.0.0-20251209130418-1a3490ef786a"
64
-
"github.com/caddy-dns/rfc2136@v1.0.0"
65
-
"github.com/mholt/caddy-events-exec@v0.1.0"
66
-
];
67
-
hash = "sha256-61qiNHbh7vgQuI6Ecc9xVpHpy4faTbpvIxz9B/8bPqQ=";
68
-
};
69
-
logFormat = pkgs.lib.mkForce "level DEBUG";
70
-
globalConfig = ''
71
-
events {
72
-
on certificate_obtained exec /run/current-system/sw/bin/chmod 640 /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/{event.data.domain}/{event.data.domain}.crt /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/{event.data.domain}/{event.data.domain}.key
73
-
}
74
-
acme_dns rfc2136 {
75
-
key_name "caddy_key"
76
-
key_alg "hmac-sha512"
77
-
key "${pm.srv.bind.caddy_key}"
78
-
server "127.0.0.1:5353"
79
-
}
80
-
http_port 8880
81
-
https_port 4443
82
-
layer4 {
83
-
:80 {
84
-
@local_http {
85
-
http {
86
-
host netbird.killuaa.dev auth.awoo.ren
87
-
}
88
-
}
89
-
route @local_http {
90
-
proxy 127.0.0.1:8880
91
-
}
92
-
93
-
@inner_http {
94
-
http {
95
-
96
-
}
97
-
}
98
-
route @inner_http {
99
-
proxy ${pm.net.ipv4.vulpes.addr}:80
100
-
}
101
-
}
102
-
103
-
:443 {
104
-
@local_https {
105
-
tls {
106
-
sni netbird.killuaa.dev auth.awoo.ren syncthing.killuaa.dev
107
-
}
108
-
}
109
-
route @local_https {
110
-
proxy 127.0.0.1:4443
111
-
}
112
-
113
-
@inner_https {
114
-
tls {
115
-
116
-
}
117
-
}
118
-
route @inner_https {
119
-
proxy ${pm.net.ipv4.vulpes.addr}:443
120
-
}
121
-
}
122
-
123
-
udp/:5353 {
124
-
route {
125
-
proxy udp/${pm.net.ipv4.vulpes.addr}:5300
126
-
}
127
-
}
128
-
129
-
tcp/:5353 {
130
-
route {
131
-
proxy tcp/${pm.net.ipv4.vulpes.addr}:5300
132
-
}
133
-
}
134
-
}
135
-
'';
136
-
virtualHosts = {
137
-
"auth.awoo.ren" = {
138
-
extraConfig = ''
139
-
reverse_proxy https://127.0.0.1:8443 {
140
-
transport http {
141
-
tls
142
-
tls_server_name auth.awoo.ren
143
-
}
144
-
}
145
-
'';
146
-
};
147
-
"netbird.killuaa.dev:4443" = {
148
-
extraConfig = ''
149
-
handle /api* {
150
-
reverse_proxy http://127.0.0.1:8011
151
-
}
152
-
handle /ws-proxy/management* {
153
-
reverse_proxy http://127.0.0.1:8011
154
-
}
155
-
handle /management.ManagementService* {
156
-
reverse_proxy h2c://127.0.0.1:33073
157
-
}
158
-
159
-
handle /signalexchange.SignalExchange* {
160
-
reverse_proxy h2c://127.0.0.1:10000
161
-
}
162
-
handle /ws-proxy/signal* {
163
-
reverse_proxy http://127.0.0.1:8012
164
-
}
165
-
166
-
handle /relay* {
167
-
reverse_proxy http://127.0.0.1:33080
168
-
}
169
-
170
-
handle /* {
171
-
root * ${args.pup_lib.get_netbird_dashboard netbird_dashboard_settings}
172
-
try_files {path} {path}.html {path}/ /index.html
173
-
file_server
174
-
}
175
-
176
-
header * {
177
-
Cache-Control "no-store, no-cache, must-revalidate, max-age=0"
178
-
Strict-Transport-Security "max-age=3600; includeSubDomains; preload"
179
-
X-Content-Type-Options "nosniff"
180
-
X-Frame-Options "DENY"
181
-
X-XSS-Protection "1; mode=block"
182
-
-Server
183
-
Referrer-Policy strict-origin-when-cross-origin
184
-
}
185
-
'';
186
-
};
187
-
"syncthing.killuaa.dev" = {
188
-
extraConfig = ''
189
-
reverse_proxy 0.0.0.0:8384
190
-
'';
191
-
};
192
-
};
193
-
};
194
-
195
36
kanidm = {
196
37
package = pkgs.kanidm_1_9;
197
38
client = {
···
219
60
group = "arr";
220
61
openDefaultPorts = true;
221
62
guiAddress = "0.0.0.0:8384";
222
-
};
223
-
224
-
netbird = {
225
-
package = netbird;
226
-
server = {
227
-
enable = true;
228
-
domain = "netbird.killuaa.dev";
229
-
management = {
230
-
enable = true;
231
-
oidcConfigEndpoint = "https://auth.awoo.ren/oauth2/openid/netbird/.well-known/openid-configuration";
232
-
settings = {
233
-
DataStoreEncryptionKey = {
234
-
_secret = config.sops.secrets.netbird_data_store_encryption_key.path;
235
-
};
236
-
TURNConfig.Turns = [ ];
237
-
Stuns = [ ];
238
-
Relay = {
239
-
Addresses = [ "rels://netbird.killuaa.dev:443" ];
240
-
CredentialsTTL = "12h";
241
-
Secret = {
242
-
_secret = config.sops.secrets.netbird_relay_secret.path;
243
-
};
244
-
TimeBasedCredentials = false;
245
-
};
246
-
};
247
-
};
248
-
dashboard = {
249
-
settings.AUTH_AUTHORITY = "https://auth.awoo.ren/oauth2/openid/netbird";
250
-
};
251
-
signal = {
252
-
enable = true;
253
-
};
254
-
};
255
-
clients.sand_arc = {
256
-
port = 51820;
257
-
openFirewall = false;
258
-
environment = {
259
-
NB_MANAGEMENT_URL = "https://netbird.killuaa.dev";
260
-
NB_SETUP_KEY_FILE = config.sops.secrets.nb_setup_key.path;
261
-
};
262
-
};
263
-
};
264
-
};
265
-
266
-
systemd.services = {
267
-
netbird-sand_arc = {
268
-
serviceConfig = {
269
-
AmbientCapabilities = [
270
-
"CAP_NET_BIND_SERVICE"
271
-
"CAP_DAC_OVERRIDE"
272
-
];
273
-
ReadWritePaths = [
274
-
"/etc/resolv.conf"
275
-
"/etc/resolv.conf.original.netbird"
276
-
];
277
-
};
278
-
};
279
-
netbird-relay = {
280
-
enable = true;
281
-
wantedBy = [ "multi-user.target" ];
282
-
after = [ "network.target" ];
283
-
serviceConfig = {
284
-
User = "netbird-sand_arc";
285
-
Group = "netbird-sand_arc";
286
-
ExecStart = "${pkgs.netbird-relay}/bin/netbird-relay --exposed-address rels://netbird.killuaa.dev:443 --listen-address :33080 --metrics-port 9092 --auth-secret ${pm.srv.netbird.relay_secret}";
287
-
Restart = "always";
288
-
};
289
63
};
290
64
};
291
65
}
+4
-4
hosts/vulpes/core/boot.nix
+4
-4
hosts/vulpes/core/boot.nix
···
21
21
};
22
22
23
23
initrd = {
24
+
kernelModules = [
25
+
"dm-snapshot"
26
+
"tpm_tis"
27
+
];
24
28
availableKernelModules = [
25
29
"xhci_pci"
26
30
"ahci"
···
28
32
"usbhid"
29
33
"usb_storage"
30
34
"sd_mod"
31
-
];
32
-
kernelModules = [
33
-
"dm-snapshot"
34
-
"tpm_tis"
35
35
];
36
36
systemd = {
37
37
enable = true;
-31
hosts/vulpes/core/services.nix
-31
hosts/vulpes/core/services.nix
···
1
1
{
2
2
args,
3
-
config,
4
3
...
5
4
}:
6
5
let
···
25
24
};
26
25
27
26
fwupd = {
28
-
enable = true;
29
-
};
30
-
31
-
netbird = {
32
-
clients.vulpes = {
33
-
port = 51820;
34
-
openFirewall = false;
35
-
environment = {
36
-
NB_MANAGEMENT_URL = "https://netbird.killuaa.dev";
37
-
NB_SETUP_KEY_FILE = config.sops.secrets.nb_setup_key.path;
38
-
};
39
-
};
40
-
};
41
-
42
-
qemuGuest = {
43
27
enable = true;
44
28
};
45
29
···
51
35
};
52
36
};
53
37
};
54
-
systemd.services = {
55
-
netbird-vulpes = {
56
-
serviceConfig = {
57
-
AmbientCapabilities = [
58
-
"CAP_NET_BIND_SERVICE"
59
-
"CAP_DAC_OVERRIDE"
60
-
];
61
-
ReadWritePaths = [
62
-
"/etc/resolv.conf"
63
-
"/etc/resolv.conf.original.netbird"
64
-
];
65
-
};
66
-
};
67
-
};
68
-
69
38
}
+57
-33
hosts/vulpes/default.nix
+57
-33
hosts/vulpes/default.nix
···
1
1
{
2
2
args,
3
3
pkgs,
4
+
lib,
4
5
...
5
6
}:
6
7
let
···
14
15
++ (args.pup_lib.module_imports ./core)
15
16
++ (args.pup_lib.module_imports ./infra);
16
17
17
-
environment.systemPackages = with pkgs; [
18
-
yazi
19
-
helix
20
-
eza
21
-
bat
22
-
btop
23
-
zellij
24
-
vulkan-tools
25
-
mangohud
26
-
sbctl
27
-
];
28
-
29
-
nix.settings = {
30
-
trusted-users = [
31
-
"root"
32
-
"@wheel"
33
-
];
34
-
experimental-features = [
35
-
"nix-command"
36
-
"flakes"
37
-
];
38
-
substituters = [
39
-
"https://cache.garnix.io"
40
-
];
41
-
trusted-public-keys = [
42
-
"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
43
-
];
44
-
};
45
-
nixpkgs = {
46
-
config.allowUnfree = true;
47
-
hostPlatform = "x86_64-linux";
48
-
overlays = [
49
-
overlays.default
18
+
environment = {
19
+
enableAllTerminfo = true;
20
+
systemPackages = with pkgs; [
21
+
yazi
22
+
helix
23
+
eza
24
+
bat
25
+
btop
26
+
zellij
27
+
vulkan-tools
28
+
mangohud
29
+
sbctl
50
30
];
51
31
};
52
32
···
68
48
cue = true;
69
49
};
70
50
};
51
+
};
52
+
};
53
+
54
+
nixpkgs = {
55
+
config.allowUnfree = true;
56
+
hostPlatform = lib.mkDefault "x86_64-linux";
57
+
overlays = [
58
+
overlays.default
59
+
];
60
+
};
61
+
62
+
nix = {
63
+
package = pkgs.lix;
64
+
nixPath = [
65
+
"nixpkgs=${args.sources.nixpkgs.outPath}"
66
+
"dots=${args.root_path}"
67
+
];
68
+
registry.nixpkgs.to = {
69
+
type = "path";
70
+
path = args.sources.nixpkgs.outPath;
71
+
};
72
+
channel.enable = false;
73
+
settings = {
74
+
use-xdg-base-directories = true;
75
+
auto-optimise-store = true;
76
+
accept-flake-config = false;
77
+
78
+
trusted-users = [
79
+
"@wheel"
80
+
];
81
+
experimental-features = [
82
+
"nix-command"
83
+
"flakes"
84
+
];
85
+
substituters = [
86
+
"https://cache.garnix.io"
87
+
];
88
+
trusted-public-keys = [
89
+
"cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
90
+
];
91
+
};
92
+
gc = {
93
+
automatic = true;
94
+
dates = "weekly";
71
95
};
72
96
};
73
97
+1
-1
hosts/vulpes/infra/caddy.nix
+1
-1
hosts/vulpes/infra/caddy.nix
-17
hosts/vulpes/infra/forgejo.nix
-17
hosts/vulpes/infra/forgejo.nix
···
142
142
};
143
143
};
144
144
};
145
-
146
-
# gitea-actions-runner = {
147
-
# package = pkgs.forgejo-runner;
148
-
# instances.default = {
149
-
# enable = true;
150
-
# name = "hourglass";
151
-
# url = "https://git.killuaa.dev";
152
-
# tokenFile = config.sops.secrets.forgejo_runner_token.path;
153
-
# labels = [
154
-
# "ubuntu-latest:docker://node:20-bookworm"
155
-
# "ubuntu-22.04:docker://node:20-bookworm"
156
-
157
-
# "ubuntu-20.04:docker://node:16-bullseye"
158
-
# "ubuntu-18.04:docker://node:16-buster"
159
-
# ];
160
-
# };
161
-
# };
162
145
};
163
146
}
+28
hosts/vulpes/infra/netbird.nix
+28
hosts/vulpes/infra/netbird.nix
···
1
+
{ config, ... }:
2
+
{
3
+
services.netbird = {
4
+
clients.vulpes = {
5
+
port = 51820;
6
+
openFirewall = false;
7
+
environment = {
8
+
NB_MANAGEMENT_URL = "https://netbird.killuaa.dev";
9
+
NB_SETUP_KEY_FILE = config.sops.secrets.nb_setup_key.path;
10
+
};
11
+
};
12
+
};
13
+
14
+
systemd.services = {
15
+
netbird-vulpes = {
16
+
serviceConfig = {
17
+
AmbientCapabilities = [
18
+
"CAP_NET_BIND_SERVICE"
19
+
"CAP_DAC_OVERRIDE"
20
+
];
21
+
ReadWritePaths = [
22
+
"/etc/resolv.conf"
23
+
"/etc/resolv.conf.original.netbird"
24
+
];
25
+
};
26
+
};
27
+
};
28
+
}