-2

hosts/cm4-node-1.nix

reviewed

··· 6 6 ../modules/tailscale.nix 7 7 ../modules/caddy.nix 8 8 ../modules/dyndns.nix 9 9 - ../modules/beszel/hub.nix 10 10 - ../modules/uptime-kuma.nix 11 9 ../modules/pocket-id.nix 12 10 ]; 13 11

+2

hosts/cm4-node-2.nix

reviewed

··· 3 3 imports = [ 4 4 ../hardware/cm4 5 5 ../modules/common.nix 6 6 + ../modules/beszel/hub.nix 7 7 + ../modules/uptime-kuma.nix 6 8 ../modules/mumble.nix 7 9 ../modules/tasks-md.nix 8 10 ../modules/rustical.nix

+1 -1

modules/beszel/agent.nix

reviewed

··· 15 15 content = '' 16 16 KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKXHE/75uA6Qk08PDCcxBiXcbvmx4RNEpMtqNiO3LkN3" 17 17 TOKEN="${config.sops.placeholder."beszel-token-${name}"}" 18 18 - HUB_URL="10.0.0.11" 18 18 + HUB_URL="10.0.0.12" 19 19 SKIP_GPU=true 20 20 ''; 21 21 };

+1 -9

modules/beszel/hub.nix

reviewed

··· 4 4 enable = true; 5 5 port = 8090; 6 6 host = "0.0.0.0"; 7 7 - dataDir = "/mnt/nas/data/beszel"; 8 7 environment = { 9 8 APP_URL = "https://beszel.goo.garden"; 10 9 USER_CREATION = "true"; ··· 12 11 }; 13 12 }; 14 13 15 15 - systemd.services.beszel-hub = { 16 16 - after = [ "mnt-nas.mount" ]; 17 17 - requires = [ "mnt-nas.mount" ]; 18 18 - }; 19 19 - 20 20 - systemd.tmpfiles.rules = [ "d /mnt/nas/data/beszel 0750 root root -" ]; 21 21 - 22 22 - # networking.firewall.allowedTCPPorts = [ 8090 ]; 14 14 + networking.firewall.allowedTCPPorts = [ 8090 ]; 23 15 }

+4 -10

modules/caddy.nix

reviewed

··· 58 58 ${mkCaddySecurity "tasks" "tasks.goo.garden"} 59 59 } 60 60 ''; 61 61 - logDir = "/mnt/nas/logs/caddy"; 61 61 + # no logs on disk 62 62 + logFormat = lib.mkForce "output discard"; 62 63 virtualHosts = { 63 64 "(goo_garden_cert)".extraConfig = '' 64 65 tls ${config.security.acme.certs."goo.garden".directory}/fullchain.pem ${ ··· 95 96 reverse_proxy rk1-node-1:6167 96 97 ''; 97 98 "beszel.goo.garden".extraConfig = '' 98 98 - reverse_proxy localhost:${toString config.services.beszel.hub.port} 99 99 + reverse_proxy cm4-node-2:8090 99 100 ''; 100 101 "id.goo.garden".extraConfig = '' 101 102 reverse_proxy localhost:1411 ··· 140 141 reverse_proxy rk1-node-1:5555 141 142 ''; 142 143 "probe.outerwilds.space".extraConfig = '' 143 143 - reverse_proxy localhost:${config.services.uptime-kuma.settings.PORT} 144 144 + reverse_proxy cm4-node-2:3001 144 145 ''; 145 146 }; 146 147 }; ··· 158 159 159 160 sops.secrets.tasks-oidc-client-id = { }; 160 161 sops.secrets.tasks-oidc-client-secret = { }; 161 161 - 162 162 - systemd.tmpfiles.rules = [ "d /mnt/nas/logs/caddy 0750 root root -" ]; 163 163 - 164 164 - systemd.services.caddy = { 165 165 - after = [ "mnt-nas.mount" ]; 166 166 - requires = [ "mnt-nas.mount" ]; 167 167 - }; 168 162 169 163 networking.firewall.allowedTCPPorts = [ 170 164 80

+2 -11

modules/uptime-kuma.nix

reviewed

··· 3 3 services.uptime-kuma = { 4 4 enable = true; 5 5 settings = { 6 6 + HOST = "0.0.0.0"; 6 7 PORT = "3001"; 7 8 }; 8 9 }; 9 10 10 10 - systemd.services.uptime-kuma = { 11 11 - after = [ "mnt-nas.mount" ]; 12 12 - requires = [ "mnt-nas.mount" ]; 13 13 - serviceConfig = { 14 14 - BindPaths = [ "/mnt/nas/data/uptime-kuma:/var/lib/uptime-kuma" ]; 15 15 - }; 16 16 - }; 17 17 - 18 18 - systemd.tmpfiles.rules = [ "d /mnt/nas/data/uptime-kuma 0750 root root -" ]; 19 19 - 20 20 - # networking.firewall.allowedTCPPorts = [ 3001 ]; 11 11 + networking.firewall.allowedTCPPorts = [ 3001 ]; 21 12 }