ashie/nixos-vps
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
102 commits 1 branch 0 tags 134 KiB
Commit graph

23 commits

Author SHA1 Message Date
ashisgreat22
abf2080f91 Add auto-update and maintenance options to system module 2026-03-19 00:03:58 +01:00
ashisgreat22
6e9de4c189 Add Forgejo self-hosted Git service with Nginx, PostgreSQL, and Restic backups 2026-03-18 23:32:01 +01:00
ashisgreat22
e9652aaaa6 Cleanup 2026-03-18 21:27:41 +01:00
ashisgreat22
9189a9c49d feat(config): enable AdGuard Home module with two clients 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 19:09:59 +01:00
ashisgreat22
638d588d81 fix(backup): use new B2 bucket for restic repository 
Switch to nixos-vps-backup2 bucket to resolve password mismatch
with existing repository.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 18:10:54 +01:00
ashisgreat22
70ef850994 feat: enable B2 backups 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 14:17:10 +01:00
ashisgreat22
fd056367d2 feat: add backup module with Restic + Backblaze B2 
- Encrypted backups to B2
- Configurable retention (daily/weekly/monthly)
- SOPS-managed credentials
- Automatic pruning

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 14:11:11 +01:00
ashisgreat22
e0de37b15f fix: simplify CrowdSec module 
Remove LAPI server config causing null coercion error.
Detection-only mode for now; bouncer can be added later.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 13:50:44 +01:00
ashisgreat22
211693ef3b feat: add CrowdSec security module 
- Wraps native NixOS CrowdSec service
- Configures SSH and nginx log acquisition
- Installs linux/nginx/sshd hub collections
- Supports IP whitelisting and ban duration config
- Optional nginx bouncer integration (requires manual API key setup)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 13:44:36 +01:00
ashisgreat22
db4f0f8f61 fix: remove duplicate SOPS declaration, clean up unused param 
- Remove redundant vaultwarden_admin_token from configuration.nix
  (already declared in module)
- Remove unused pkgs parameter from vaultwarden module

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 12:37:09 +01:00
ashisgreat22
45b6997fac chore: disable Vaultwarden signup 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 12:12:19 +01:00
ashisgreat22
ea7ca739ba feat: enable Vaultwarden in configuration 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 12:08:22 +01:00
ashisgreat22
a87fd37489 Add Brave Search web search to OpenClaw 
- Enable web_search tool with Brave provider
- Add openclaw_brave_api_key secret to SOPS configuration
- Add BRAVE_API_KEY to openclaw.env template

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 02:50:09 +01:00
ashisgreat22
ae5e61cb6e Fix openclaw config syntax - use external json file 
- Move openclaw config to separate json file
- Reference file directly in podman module
- Remove problematic builtins.toJSON with nested arrays

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 01:37:46 +01:00
ashisgreat22
a595445bd2 Convert Openclaw to Podman container 
- Use official ghcr.io/openclaw/openclaw image
- configure via JSON config file
- containerized for better isolation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-18 01:35:02 +01:00
ashisgreat22
68240b7319 Set openclaw as owner of sops template 2026-03-17 21:32:37 +01:00
ashisgreat22
1d11816a55 Remove OpenAI, use z.ai for OpenClaw 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-17 20:59:05 +01:00
ashisgreat22
1748360922 Add z.ai API key to OpenClaw secrets 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-17 20:55:40 +01:00
ashisgreat22
3a885463f0 Add OpenClaw AI Agent module 
- Systemd service running OpenClaw gateway
- Configurable via sops secrets
- Runs on localhost:18789

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-17 20:55:15 +01:00
ashisgreat22
24d01ac630 Add modular service configuration with SearXNG and Nginx 
- Create modules/ directory with reusable NixOS modules
- Add system module for main user configuration
- Add podman module for rootless container support
- Add nginx module with automatic Let's Encrypt SSL
- Add searxng module with Anubis AI firewall protection
- Configure SearXNG at search.ashisgreat.xyz
- Enable nginx reverse proxy with HTTPS

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-17 19:47:43 +01:00
ashisgreat22
5dcb85e56d Add sops-nix for secrets management 
- Add flake.nix with sops-nix input
- Configure sops with age key encryption
- Add .sops.yaml template for age key configuration
- Create secrets/ directory for encrypted secrets
- Add .gitignore for age keys and nix result symlinks

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-17 19:34:10 +01:00
ashisgreat22
58905b7666 Add security hardening and basic VPS setup 
- Enable firewall with only SSH port 22 open, disable ping
- Harden SSH: disable root login and password auth
- Create non-root user 'ashie' with sudo access
- Add htop and tmux to system packages
- Enable automatic NixOS updates (no auto-reboot)
- Fix hostname syntax error (missing closing quote)
- Remove duplicate nixos/ subdirectory

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-17 19:28:26 +01:00
System administrator
2e768daefa Initial commit 2026-03-17 18:20:35 +00:00