ashie/nixos-vps
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
94 commits 1 branch 0 tags 134 KiB
Commit graph

94 commits

This branch
This branch
All branches
Author SHA1 Message Date
ashisgreat22
7ea9246d74 Manage AdGuard Home blocklists via NixOS using yq-go injection 2026-03-18 22:01:38 +01:00
ashisgreat22
4790078ff9 Fix CrowdSec GeoIP filter syntax 2026-03-18 21:54:34 +01:00
ashisgreat22
c3adfa7e25 Restrict incoming connections to DE via CrowdSec GeoIP 2026-03-18 21:53:05 +01:00
ashisgreat22
8f44273faf Cleanup 2026-03-18 21:33:42 +01:00
ashisgreat22
01b19c9fa0 Cleanup 2026-03-18 21:31:19 +01:00
ashisgreat22
ecf4fe59af Cleanup 2026-03-18 21:29:58 +01:00
ashisgreat22
e9652aaaa6 Cleanup 2026-03-18 21:27:41 +01:00
ashisgreat22
ac36befbd7 Cleanup 2026-03-18 21:26:19 +01:00
ashisgreat22
e82bbec626 Cleanup 2026-03-18 21:23:53 +01:00
ashisgreat22
1c56d477fa Cleanup 2026-03-18 21:23:37 +01:00
ashisgreat22
e1d18c18be Cleanup 2026-03-18 21:22:19 +01:00
ashisgreat22
1792180144 Cleanup 2026-03-18 21:20:42 +01:00
ashisgreat22
1942425605 feat(adguard): enable DoT and fix ClientID injection 
- Enable DNS-over-TLS (DoT) on port 853 using Nginx's ACME certificates
- Fix an issue where the native NixOS module dropped SOPS client IDs
- Use sops.templates and yq to inject ClientIDs dynamically before start
- Enable allow_unencrypted_doh to fix Nginx proxying DoH correctly
 2026-03-18 21:12:31 +01:00
ashisgreat22
5dd91f74b1 fix(adguard): resolve port 53 conflict 
Change AdGuard Home DNS listener to bind to 127.0.0.1:5353 to avoid conflicting with existing services on port 53, since we only expose DoH via Nginx.
 2026-03-18 20:58:07 +01:00
ashisgreat22
219391bc85 refactor(adguard): migrate to native nixos service 
Replace the Podman container and manual YAML templating with the native  NixOS module for better system integration and simpler declarative configuration.
 2026-03-18 20:56:30 +01:00
ashisgreat22
7a505055f8 fix(adguard): fix string interpolation syntax error 
Fix a broken string concatenation that was causing a syntax error during NixOS evaluation.

Co-Authored-By: Gemini CLI <noreply@google.com>
 2026-03-18 20:49:31 +01:00
ashisgreat22
93bef3b301 fix(adguard): rewrite with correct lib.length syntax 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:51:53 +01:00
ashisgreat22
7bdbe767b6 fix(adguard): use lib.length instead of == for empty check 
Nix doesn't support == operator.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:27:47 +01:00
ashisgreat22
51e937c02f fix(adguard): add empty clients list when no clients configured 
AdGuard Home fails with empty persistent list.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:27:21 +01:00
ashisgreat22
7b9b1e1909 fix(adguard): add newline before filtering section 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:26:40 +01:00
ashisgreat22
a5d1f3e136 fix(adguard): fix YAML structure - clients at correct level 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:24:37 +01:00
ashisgreat22
ce152ba2b3 fix(adguard): fix template string concatenation 
Properly concatenate optionalString with content.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:23:51 +01:00
ashisgreat22
294b556542 fix(adguard): handle empty clients list 
Only render clients section when clients are configured.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:22:58 +01:00
ashisgreat22
23696e7e79 fix(adguard): remove --cap-drop=ALL flag 
AdGuard Home needs capabilities to run.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:20:41 +01:00
ashisgreat22
9b1d5ede54 fix(adguard): remove --read-only flag 
AdGuard Home needs write access to working directory.
Config file remains read-only via :ro mount.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:19:30 +01:00
ashisgreat22
8b3df01823 chore(secrets): add AdGuard ClientID secrets 2026-03-18 18:14:48 +00:00
ashisgreat22
9189a9c49d feat(config): enable AdGuard Home module with two clients 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:09:59 +01:00
ashisgreat22
d413d5ec1b feat(modules): register adguard module in default.nix 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:09:04 +01:00
ashisgreat22
1ed9acdcda feat(modules): add AdGuard Home module with DoH and ClientID support 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:07:59 +01:00
ashisgreat22
30d5ce8134 docs: add AdGuard Home implementation plan 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:06:42 +01:00
ashisgreat22
4eeeef121e docs: add explicit podman dependency in implementation 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:03:57 +01:00
ashisgreat22
fd5d3f3a7c docs: fix remaining spec issues 
- Remove unused tmpfiles rule (using named volume)
- Remove redundant firewall config (nginx module handles 443)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:03:00 +01:00
ashisgreat22
70016fe9c4 docs: fix spec review issues 
- Fix YAML indentation in SOPS template
- Add myModules.podman.enable dependency
- Remove unused tmpfiles rule (using named volume)
- Remove redundant firewall config (nginx module handles 443)
- Fix lib.types.listOf parentheses

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:01:39 +01:00
ashisgreat22
51e723ddad docs: address spec review feedback for AdGuard module 
- Add complete container definition with security options
- Add SOPS template code with ClientID interpolation
- Fix nginx location to use regex for /dns-query/{clientId}
- Add volume persistence for stats/logs
- Add proxy_http_version for DoH
- Document security considerations

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:00:15 +01:00
ashisgreat22
053198d013 docs: add AdGuard Home module design spec 
Design for private DoH server with ClientID-based access control.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 18:57:54 +01:00
ashisgreat22
638d588d81 fix(backup): use new B2 bucket for restic repository 
Switch to nixos-vps-backup2 bucket to resolve password mismatch
with existing repository.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 18:10:54 +01:00
ashisgreat22
d2d02f8a60 chore: add backup secrets 2026-03-18 13:19:46 +00:00
ashisgreat22
8030657042 chore: add backup secrets 2026-03-18 13:18:53 +00:00
ashisgreat22
70ef850994 feat: enable B2 backups 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 14:17:10 +01:00
ashisgreat22
fd056367d2 feat: add backup module with Restic + Backblaze B2 
- Encrypted backups to B2
- Configurable retention (daily/weekly/monthly)
- SOPS-managed credentials
- Automatic pruning

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 14:11:11 +01:00
ashisgreat22
f82b822d16 feat: add firewall bouncer to CrowdSec module 
- Enable crowdsec-firewall-bouncer by default
- Auto-registers bouncer with local CrowdSec API
- Blocks malicious IPs at iptables/nftables level

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 13:58:13 +01:00
ashisgreat22
8a933fd9de fix: enable CrowdSec Local API for cscli 
Add LAPI server configuration with credentials file path.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 13:53:15 +01:00
ashisgreat22
e0de37b15f fix: simplify CrowdSec module 
Remove LAPI server config causing null coercion error.
Detection-only mode for now; bouncer can be added later.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 13:50:44 +01:00
ashisgreat22
9a57a2c511 . 2026-03-18 12:49:08 +00:00
ashisgreat22
211693ef3b feat: add CrowdSec security module 
- Wraps native NixOS CrowdSec service
- Configures SSH and nginx log acquisition
- Installs linux/nginx/sshd hub collections
- Supports IP whitelisting and ban duration config
- Optional nginx bouncer integration (requires manual API key setup)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 13:44:36 +01:00
ashisgreat22
db4f0f8f61 fix: remove duplicate SOPS declaration, clean up unused param 
- Remove redundant vaultwarden_admin_token from configuration.nix
  (already declared in module)
- Remove unused pkgs parameter from vaultwarden module

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 12:37:09 +01:00
ashisgreat22
45b6997fac chore: disable Vaultwarden signup 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 12:12:19 +01:00
ashisgreat22
ea7ca739ba feat: enable Vaultwarden in configuration 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 12:08:22 +01:00
ashisgreat22
e2facd1fa9 feat: add Vaultwarden module 
- Add native NixOS Vaultwarden service module
- Supports WebSocket for real-time sync notifications
- Integrates with nginx via extraLocations for /notifications/hub
- Configurable signup, invitations, and SMTP settings
- Uses SOPS for admin token secret management

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 12:07:26 +01:00
ashisgreat22
cbce4aa228 feat(nginx): add extraLocations option for WebSocket support 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 03:19:31 +01:00