move sites to their own modules

modules/home/apps/tools/neovim/config/lua/plugins/editor/nvim-cmp.lua

@@ -6,6 +6,47 @@ return {
 		build = "make install_jsregexp",
 		config = function()
 			require("luasnip.loaders.from_vscode").lazy_load()
+
+			local ls = require("luasnip")
+			local s = ls.snippet
+			local i = ls.insert_node
+			local t = ls.text_node
+			local fmt = require("luasnip.extras.fmt").fmt -- Import the fmt function
+
+			-- Define a new snippet for your specific use case
+			ls.add_snippets("nix", { -- Assuming the snippet is for Nix files, adjust the filetype as necessary
+				s(
+					"nixcfg",
+					fmt(
+						[[
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib;
+with lib.custom; let
+  cfg = config.{<>};
+in {
+  options.{<>} = with types; {
+    enable = mkBoolOpt false "<>";
+  };
+
+  config = mkIf cfg.enable {
+<>
+  };
+}]],
+						{
+							i(1), -- Cursor point 1, after config.
+							i(2), -- Cursor point 2, after options.
+							i(3), -- Cursor point 3, for the option description inside mkBoolOpt
+							i(4), -- Cursor point 4, inside the mkIf cfg.enable block
+						},
+						{ delimiters = "<>" }
+					)
+				), -- Ensure to specify the delimiters if they differ from the default
+			})
 		end,
 	},
 

modules/nixos/services/web/nginx/default.nix

@@ -0,0 +1,28 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib;
+with lib.custom; let
+  cfg = config.services.web.nginx;
+in {
+  options.services.web.nginx = with types; {
+    enable = mkBoolOpt false "Enable NGINX Service";
+  };
+
+  config = mkIf cfg.enable {
+    services.nginx = {
+      enable = true;
+      package = pkgs.nginxStable.override {openssl = pkgs.libressl;};
+      recommendedProxySettings = true;
+      virtualHosts = {
+        "node.nyc.zackmyers.io" = {
+          forceSSL = true;
+          enableACME = true;
+        };
+      };
+    };
+  };
+}

modules/nixos/sites/cv/default.nix

@@ -0,0 +1,34 @@
+{
+  lib,
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+with lib;
+with lib.custom; let
+  cfg = config.sites.cv;
+in {
+  options.sites.cv = with types; {
+    enable = mkBoolOpt false "Enable CV site";
+
+    domain = mkStringOpt "cv.zackster.zip" "The domain for the site";
+  };
+
+  config = mkIf cfg.enable {
+    warnings =
+      lib.optional (!config.services.nginx.enable)
+      "CV site is enabled, but it depends on Nginx which is not enabled.";
+
+    services.nginx.virtualHosts.${cfg.domain} = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        root = "${inputs.resume.packages.${pkgs.system}.default}";
+      };
+      extraConfig = ''
+        index resume.pdf;
+      '';
+    };
+  };
+}

modules/nixos/sites/gitlab/default.nix

@@ -0,0 +1,117 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib;
+with lib.custom; let
+  cfg = config.sites.gitlab;
+
+  sec = config.age.secrets;
+  user = config.services.gitlab.user;
+  group = config.services.gitlab.group;
+in {
+  options.sites.gitlab = with types; {
+    enable = mkBoolOpt false "Enable GitLab";
+
+    domain = mkStringOpt "git.zackster.zip" "Domain for GitLab";
+  };
+
+  config = mkIf cfg.enable {
+    age.secrets = {
+      gitlab_db = {
+        file = ../../../sec/gitlab_db.age;
+        owner = user;
+        group = group;
+      };
+      gitlab_initpw = {
+        file = ../../../sec/gitlab_initpw.age;
+        owner = user;
+        group = group;
+      };
+      gitlab_otp = {
+        file = ../../../sec/gitlab_otp.age;
+        owner = user;
+        group = group;
+      };
+      gitlab_pw = {
+        file = ../../../sec/gitlab_pw.age;
+        owner = user;
+        group = group;
+      };
+      gitlab_sec = {
+        file = ../../../sec/gitlab_sec.age;
+        owner = user;
+        group = group;
+      };
+      gitlab_runner = {
+        file = ../../../sec/gitlab_runner.age;
+      };
+    };
+
+    boot.kernel.sysctl."net.ipv4.ip_forward" = true; # 1
+
+    services.gitlab-runner = {
+      enable = true;
+      services = {
+        nix = with lib; {
+          registrationConfigFile = toString sec.gitlab_runner.path; # 2
+          dockerImage = "alpine";
+          dockerVolumes = [
+            "/nix/store:/nix/store:ro"
+            "/nix/var/nix/db:/nix/var/nix/db:ro"
+            "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
+          ];
+          dockerDisableCache = true;
+          preBuildScript = pkgs.writeScript "setup-container" ''
+            mkdir -p -m 0755 /nix/var/log/nix/drvs
+            mkdir -p -m 0755 /nix/var/nix/gcroots
+            mkdir -p -m 0755 /nix/var/nix/profiles
+            mkdir -p -m 0755 /nix/var/nix/temproots
+            mkdir -p -m 0755 /nix/var/nix/userpool
+            mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
+            mkdir -p -m 1777 /nix/var/nix/profiles/per-user
+            mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
+            mkdir -p -m 0700 "$HOME/.nix-defexpr"
+            . ${pkgs.nix}/etc/profile.d/nix-daemon.sh
+            ${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixos-20.09 nixpkgs # 3
+            ${pkgs.nix}/bin/nix-channel --update nixpkgs
+            ${pkgs.nix}/bin/nix-env -i ${concatStringsSep " " (with pkgs; [nix cacert git openssh])}
+          '';
+          environmentVariables = {
+            ENV = "/etc/profile";
+            USER = "root";
+            NIX_REMOTE = "daemon";
+            PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
+            NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
+          };
+          tagList = ["nix"];
+        };
+      };
+    };
+
+    services.gitlab = {
+      enable = true;
+      databasePasswordFile = sec.gitlab_db.path;
+      initialRootPasswordFile = sec.gitlab_initpw.path;
+      port = 443;
+      https = true;
+      host = "git.zackmyers.io";
+      secrets = {
+        secretFile = sec.gitlab_sec.path;
+        otpFile = sec.gitlab_otp.path;
+        dbFile = sec.gitlab_db.path;
+        jwsFile = pkgs.runCommand "oidcKeyBase" {} "${pkgs.openssl}/bin/openssl genrsa 2048 > $out";
+      };
+    };
+
+    services.nginx.virtualHosts.${cfg.domain} = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
+    };
+
+    systemd.services.gitlab-backup.environment.BACKUP = "dump";
+  };
+}

modules/nixos/sites/grafana/default.nix

@@ -0,0 +1,193 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib;
+with lib.custom; let
+  cfg = config.sites.grafana;
+in {
+  options.sites.grafana = with types; {
+    enable = mkBoolOpt false "Enable grafana";
+
+    domain = mkStringOpt "monitor.zackmyers.io" "The domain for grafana";
+  };
+
+  config = mkIf cfg.enable {
+    services.grafana = {
+      enable = true;
+      domain = cfg.domain;
+      port = 2342;
+      addr = "127.0.0.1";
+      protocol = "http";
+      analytics.reporting.enable = false;
+
+      provision = {
+        enable = true;
+        datasources.settings.datasources = [
+          {
+            name = "Prometheus";
+            type = "prometheus";
+            access = "proxy";
+            url = "http://127.0.0.1:${toString config.services.prometheus.port}";
+          }
+          {
+            name = "Loki";
+            type = "loki";
+            access = "proxy";
+            url = "http://127.0.0.1:${toString config.services.loki.configuration.server.http_listen_port}";
+          }
+        ];
+      };
+    };
+
+    services.prometheus = {
+      enable = true;
+      port = 9001;
+      exporters = {
+        node = {
+          enable = true;
+          enabledCollectors = ["systemd"];
+          port = 9002;
+        };
+      };
+
+      scrapeConfigs = [
+        {
+          job_name = "chrysalis";
+          scrape_interval = "10s";
+          static_configs = [
+            {
+              targets = ["127.0.0.1:${toString config.services.prometheus.exporters.node.port}"];
+            }
+          ];
+        }
+      ];
+    };
+
+    services.loki = {
+      enable = true;
+      configuration = {
+        server.http_listen_port = 3030;
+        auth_enabled = false;
+
+        ingester = {
+          lifecycler = {
+            address = "127.0.0.1";
+            ring = {
+              kvstore = {
+                store = "inmemory";
+              };
+              replication_factor = 1;
+            };
+          };
+          chunk_idle_period = "1h";
+          max_chunk_age = "1h";
+          chunk_target_size = 999999;
+          chunk_retain_period = "30s";
+          max_transfer_retries = 0;
+        };
+
+        schema_config = {
+          configs = [
+            {
+              from = "2022-06-06";
+              store = "boltdb-shipper";
+              object_store = "filesystem";
+              schema = "v11";
+              index = {
+                prefix = "index_";
+                period = "24h";
+              };
+            }
+          ];
+        };
+
+        storage_config = {
+          boltdb_shipper = {
+            active_index_directory = "/var/lib/loki/boltdb-shipper-active";
+            cache_location = "/var/lib/loki/boltdb-shipper-cache";
+            cache_ttl = "24h";
+            shared_store = "filesystem";
+          };
+
+          filesystem = {
+            directory = "/var/lib/loki/chunks";
+          };
+        };
+
+        limits_config = {
+          reject_old_samples = true;
+          reject_old_samples_max_age = "168h";
+        };
+
+        chunk_store_config = {
+          max_look_back_period = "0s";
+        };
+
+        table_manager = {
+          retention_deletes_enabled = false;
+          retention_period = "0s";
+        };
+
+        compactor = {
+          working_directory = "/var/lib/loki";
+          shared_store = "filesystem";
+          compactor_ring = {
+            kvstore = {
+              store = "inmemory";
+            };
+          };
+        };
+      };
+    };
+
+    services.promtail = {
+      enable = true;
+      configuration = {
+        server = {
+          http_listen_port = 3031;
+          grpc_listen_port = 0;
+        };
+        positions = {
+          filename = "/tmp/positions.yaml";
+        };
+        clients = [
+          {
+            url = "http://127.0.0.1:${toString config.services.loki.configuration.server.http_listen_port}/loki/api/v1/push";
+          }
+        ];
+        scrape_configs = [
+          {
+            job_name = "journal";
+            journal = {
+              max_age = "12h";
+              labels = {
+                job = "systemd-journal";
+                host = "pluto";
+              };
+            };
+            relabel_configs = [
+              {
+                source_labels = ["__journal__systemd_unit"];
+                target_label = "unit";
+              }
+            ];
+          }
+        ];
+      };
+      # extraFlags
+    };
+
+    services.nginx.virtualHosts.${config.services.grafana.domain} = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
+        recommendedProxySettings = true;
+        proxyWebsockets = true;
+      };
+    };
+  };
+}

modules/nixos/sites/mirror/default.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib;
+with lib.custom; let
+  cfg = config.sites.mirror;
+in {
+  options.sites.mirror = with types; {
+    enable = mkBoolOpt false "Enable ArchLinux Mirror";
+  };
+
+  config = mkIf cfg.enable {
+    systemd.timers."mirror-update" = {
+      wantedBy = ["timers.target"];
+      timerConfig = {
+        OnBootSec = "1h";
+        OnUnitActiveSec = "1h";
+        Unit = "mirror-update.service";
+      };
+    };
+
+    systemd.services."mirror-update" = {
+      script = ''
+        ${pkgs.rsync}/bin/rsync -vPa rsync://mirrors.lug.mtu.edu/archlinux/ /var/www/mirror.zackmyers.io/archlinux/
+      '';
+      serviceConfig = {
+        Type = "oneshot";
+        User = "root";
+      };
+    };
+
+    services.nginx.virtualHosts."mirror.zackmyers.io" = {
+      forceSSL = true;
+      enableACME = true;
+      root = "/var/www/mirror.zackmyers.io";
+      locations."/".extraConfig = ''
+        autoindex on;
+      '';
+    };
+  };
+}

modules/nixos/sites/pterodactyl/default.nix

@@ -0,0 +1,183 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib;
+with lib.custom; let
+  cfg = config.sites.pterodactyl;
+
+  wings = pkgs.stdenv.mkDerivation {
+    name = "wings";
+
+    src = pkgs.fetchurl {
+      name = "wings";
+      url = "https://github.com/pterodactyl/wings/releases/latest/download/wings_linux_amd64";
+      sha256 = "sha256-S8vTpxvtmv7TfRMpgKxVPkvTmji1rlPEd9ApM3Rt6FY=";
+    };
+
+    phases = ["installPhase"];
+
+    installPhase = ''
+      install -D $src $out/bin/wings
+    '';
+  };
+in {
+  options.sites.pterodactyl = with types; {
+    enable = mkBoolOpt false "Enable Pterodactyl Site";
+  };
+
+  config = mkIf cfg.enable {
+    services.mysql = {
+      enable = true;
+      package = pkgs.mariadb;
+    };
+
+    systemd.timers."p_artisan-run" = {
+      wantedBy = ["timers.target"];
+      timerConfig = {
+        OnBootSec = "1m";
+        OnUnitActiveSec = "1m";
+        Unit = "p_artisan-run.service";
+      };
+    };
+
+    systemd.services."p_artisan-run" = {
+      script = ''
+        ${pkgs.php}/bin/php /var/www/pterodactyl/artisan schedule:run >> /dev/null 2>&1
+      '';
+      serviceConfig = {
+        Type = "oneshot";
+        User = "root";
+      };
+    };
+
+    systemd.services."wings" = {
+      after = ["docker.service"];
+      requires = ["docker.service"];
+      partOf = ["docker.service"];
+      script = ''
+        #!/usr/bin/env bash
+        export PATH=${pkgs.shadow}/bin:$PATH
+        ${wings}/bin/wings
+      '';
+      wantedBy = ["multi-user.target"];
+      serviceConfig = {
+        User = "root";
+        WorkingDirectory = "/etc/pterodactyl";
+        LimitNOFILE = 4096;
+        PIDFile = /var/run/wings/daemon.pid;
+        Restart = "on-failure";
+        StartLimitInterval = 180;
+        StartLimitBurst = 30;
+        RestartSec = "5s";
+      };
+    };
+
+    systemd.services."p_queue-worker" = {
+      after = ["redis.service"];
+      wantedBy = ["multi-user.target"];
+      script = ''
+        ${pkgs.php}/bin/php /var/www/pterodactyl/artisan queue:work --queue=high,standard,low --sleep=3 --tries=3
+      '';
+      serviceConfig = {
+        User = "nginx";
+        Group = "nginx";
+        Restart = "always";
+        StartLimitInterval = 180;
+        StartLimitBurst = 30;
+        RestartSec = "5s";
+      };
+    };
+
+    services.nginx.virtualHosts."pterodactyl.zackmyers.io" = {
+      forceSSL = true;
+      enableACME = true;
+      root = "/var/www/pterodactyl/public";
+
+      locations."/".extraConfig = ''
+        try_files $uri $uri/ /index.php?$query_string;
+      '';
+      locations."/favicon.ico".extraConfig = ''
+        access_log off; log_not_found off;
+      '';
+      locations."/robots.txt".extraConfig = ''
+        access_log off; log_not_found off;
+      '';
+      locations."~ \\.php$".extraConfig = ''
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        fastcgi_pass unix:${config.services.phpfpm.pools.pterodactyl.socket};
+        fastcgi_index index.php;
+        include ${pkgs.nginx}/conf/fastcgi_params;
+        fastcgi_param PHP_VALUE "upload_max_filesize = 100M \n post_max_size=100M";
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        fastcgi_param HTTP_PROXY "";
+        fastcgi_intercept_errors off;
+        fastcgi_buffer_size 16k;
+        fastcgi_buffers 4 16k;
+        fastcgi_connect_timeout 300;
+        fastcgi_send_timeout 300;
+        fastcgi_read_timeout 300;
+
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_redirect off;
+        proxy_buffering off;
+        proxy_request_buffering off;
+      '';
+
+      locations."~ /\\.ht".extraConfig = ''
+        deny all;
+      '';
+
+      extraConfig = ''
+        index index.html index.htm index.php;
+        charset utf-8;
+
+        access_log off;
+        error_log  /var/log/nginx/pterodactyl.app-error.log error;
+
+        # allow larger file uploads and longer script runtimes
+        client_max_body_size 100m;
+        client_body_timeout 120s;
+
+        sendfile off;
+      '';
+    };
+
+    services.phpfpm = {
+      phpOptions = ''
+        extension=${pkgs.php81Extensions.openssl}/lib/php/extensions/openssl.so
+        extension=${pkgs.php81Extensions.gd}/lib/php/extensions/gd.so
+        extension=${pkgs.php81Extensions.mysqlnd}/lib/php/extensions/mysqlnd.so
+        extension=${pkgs.php81Extensions.mbstring}/lib/php/extensions/mbstring.so
+        extension=${pkgs.php81Extensions.tokenizer}/lib/php/extensions/tokenizer.so
+        extension=${pkgs.php81Extensions.bcmath}/lib/php/extensions/bcmath.so
+        extension=${pkgs.php81Extensions.xml}/lib/php/extensions/xml.so
+        extension=${pkgs.php81Extensions.dom}/lib/php/extensions/dom.so
+        extension=${pkgs.php81Extensions.curl}/lib/php/extensions/curl.so
+        extension=${pkgs.php81Extensions.zip}/lib/php/extensions/zip.so
+      '';
+      pools.pterodactyl = {
+        user = config.services.nginx.user;
+        phpPackage = pkgs.php81;
+        settings = {
+          "pm" = "dynamic";
+          "listen.owner" = config.services.nginx.user;
+          "pm.max_children" = 5;
+          "pm.start_servers" = 2;
+          "pm.min_spare_servers" = 1;
+          "pm.max_spare_servers" = 3;
+          "pm.max_requests" = 500;
+        };
+      };
+    };
+
+    services.redis = {
+      enable = true;
+    };
+  };
+}

modules/nixos/sites/search/default.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib;
+with lib.custom; let
+  cfg = config.sites.search;
+in {
+  options.sites.search = with types; {
+    enable = mkBoolOpt false "Enable Search (Searxng)";
+
+    domain = mkStringOpt "search.zackmyers.io" "The domain of the search instance";
+  };
+
+  config = mkIf cfg.enable {
+    services.searx = {
+      enable = true;
+      package = pkgs.searxng;
+      runInUwsgi = true;
+      settings = {
+        # server.port = 8080;
+        # server.bind_addres = "0.0.0.0";
+        server.secret_key = "6f6bf40218f239718cacbc2cd837792be828e840b48ac72a8e0a9d0ddb9d0b00"; # you can know this i don't care
+        server.base_url = "https://${cfg.domain}/searx/";
+      };
+      uwsgiConfig = {
+        http = ":8080";
+      };
+    };
+
+    services.nginx.virtualHosts.${cfg.domain} = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/searx/" = {
+        proxyPass = "http://localhost:8080";
+      };
+    };
+  };
+}