alyssum/samba: bind music

containers/emerald/configuration.nix

@@ -16,7 +16,8 @@
       ShareURL = "https://${shareFqdn}";
       EnableSharing = true;
       DataFolder = "/persist/navidrome";
-      MusicFolder = "/binds/music";
+      MusicFolder = "/binds/music/main";
     };
   };
+  systemd.services.navidrome.serviceConfig.BindReadOnlyPaths = ["/binds/music"];
 }

containers/emerald/flake.nix

@@ -9,11 +9,11 @@
     shareFqdn = "muse.lava.moe";
     subnetId = "5";
 
-    subnet = x: "fd0d:1::${subnetId}:${toString x}";
+    subnet = x: "fd0d:2::${subnetId}:${toString x}";
     host = subnet 1;
     client = subnet 2;
 
-    subnet4 = x: "10.30.${subnetId}.${toString x}";
+    subnet4 = x: "10.32.${subnetId}.${toString x}";
     host4 = subnet4 1;
     client4 = subnet4 2;
 
@@ -39,13 +39,7 @@
         useACMEHost = "lava.moe";
         forceSSL = true;
         locations."/".proxyPass = "http://[${client}]:4533";
-        listenAddresses = [ "10.0.0.1" "[fd0d::1]" "100.67.1.1" ];
-      };
-      services.nginx.virtualHosts."${shareFqdn}" = {
-        useACMEHost = "lava.moe";
-        forceSSL = true;
-        locations."/".return = "404";
-        locations."/share/".proxyPass = "http://[${client}]:4533";
+        listenAddresses = [ "100.67.2.1" ];
       };
 
       systemd.tmpfiles.rules = [ "d /persist/containers/${name} 755 root users" ];
@@ -68,7 +62,7 @@
           isReadOnly = false;
         };
         bindMounts."music" = {
-          hostPath = "/persist/media/music";
+          hostPath = "/flower/media/music";
           mountPoint = "/binds/music";
           isReadOnly = true;
         };

containers/fluorite/configuration.nix

@@ -1,42 +1,22 @@
 { ... }: {
   system.stateVersion = "25.11";
   systemd.tmpfiles.rules = [
-    "d /persist/slskd/downloads 755 slskd slskd"
+    "d /persist/slskd/Downloads 755 slskd slskd"
   ];
   fileSystems."/var/lib/slskd" = {
     device = "/persist/slskd";
     fsType = "none";
     options = [ "bind" ];
   };
-  fileSystems."/var/lib/tailscale" = {
-    device = "/persist/tailscale";
-    fsType = "none";
-    options = [ "bind" ];
-  };
   networking.firewall.allowedTCPPorts = [ 5030 50300 ];
   networking.firewall.allowedUDPPorts = [ 5030 50300 ];
 
-  services.tailscale = {
-    enable = true;
-    authKeyFile = "/binds/tailscale_auth";
-    openFirewall = true;
-    # interfaceName = "userspace-networking";
-    # extraDaemonFlags = [ "--socks5-server=localhost:1055" ];
-    extraSetFlags = [ "--exit-node=100.67.1.1" ];
-    useRoutingFeatures = "client";
-  };
-
   services.slskd = {
     enable = true;
     domain = null;
     environmentFile = "/binds/slskd_env";
     settings = {
       shares.directories = [ "/binds/music/" ];
-      # soulseek.connection.proxy = {
-      #   enabled = true;
-      #   address = "localhost";
-      #   port = "1055";
-      # };
     };
   };
 }

containers/fluorite/flake.nix

@@ -16,27 +16,18 @@
     host4 = subnet4 1;
     client4 = subnet4 2;
 
-    clientTun = "100.67.2.101";
-
     modules = [
       ./configuration.nix
       {
         networking.useHostResolvConf = false;
-        networking.nameservers = [ "8.8.8.8" ];
+        networking.nameservers = [ host ];
       }
     ];
   in {
     nixosConfigurations.container = nixpkgs.lib.nixosSystem {
       inherit modules;
     };
-    nixosModule = { config, ... }: let
-      hostfqdn = "${config.networking.hostName}.lava.moe";
-      altfqdn = "fluorite.${hostfqdn}";
-      # TODO: HACK
-      listenAddr = if (config.networking.hostName == "alyssum")
-        then [ "100.67.2.1" ]
-        else [ "10.0.0.1" "[fd0d::1]" "100.67.1.1" ];
-    in {
+    nixosModule = { config, ... }: {
       networking.nat = {
         enable = true;
         enableIPv6 = true;
@@ -47,16 +38,8 @@
       services.nginx.virtualHosts."${fqdn}" = {
         useACMEHost = "lava.moe";
         forceSSL = true;
-        locations."/".proxyPass = "http://${clientTun}:5030";
-        listenAddresses = listenAddr;
-      };
-
-      security.acme.certs.${hostfqdn} = { extraDomainNames = [ "*.${hostfqdn}" ]; };
-      services.nginx.virtualHosts."${altfqdn}" = {
-        useACMEHost = hostfqdn;
-        forceSSL = true;
-        locations."/".proxyPass = "http://${clientTun}:5030";
-        listenAddresses = listenAddr;
+        locations."/".proxyPass = "http://[${client}]:5030";
+        listenAddresses = [ "10.0.0.1" "[fd0d::1]" "100.67.1.1" ];
       };
 
       systemd.tmpfiles.rules = [
@@ -66,7 +49,6 @@
       containers.${name} = {
         autoStart = true;
         privateNetwork = true;
-        enableTun = true;
         hostAddress = host4;
         localAddress = client4;
         hostAddress6 = host;
@@ -100,11 +82,6 @@
           mountPoint = "/binds/slskd_env";
           isReadOnly = true;
         };
-        bindMounts."tailscale_auth" = {
-          hostPath = config.age.secrets.tailscale_auth.path;
-          mountPoint = "/binds/tailscale_auth";
-          isReadOnly = true;
-        };
         # flake = "path:" + ./.;
       };
     };

hosts/alyssum/default.nix

@@ -5,7 +5,8 @@
 
   age.secrets = {
     acme_dns.file = ../../secrets/acme_dns.age;
-    slskd_env.file = ../../secrets/slskd_env.age;
+    passwd.file = ../../secrets/passwd.age;
+    navidrome_env.file = ../../secrets/navidrome_env.age;
     wpa_conf = {
       file = ../../secrets/wpa_conf.age;
       path = "/etc/wpa_supplicant/imperative.conf";
@@ -25,15 +26,16 @@
     tailscale
 
     modules.services.nginx
-    modules.services.soulbeet
     modules.services.syncthing
 
-    inputs.c-fluorite.nixosModule
+    inputs.c-emerald.nixosModule
     inputs.c-garnet.nixosModule
 
     ./filesystem.nix
     ./kernel.nix
     ./networking.nix
+    ./home.syncthing.nix
+    ./samba.nix
 
     ../../users/hana
   ];

hosts/alyssum/home.syncthing.nix

@@ -0,0 +1,39 @@
+{ config, lib, ... }:
+let
+  configOn = user: port: {
+    me.binds."/home/${user}/.config/syncthing" = "${user}/syncthing/config";
+    me.binds."/home/${user}/.local/state/syncthing" = "${user}/syncthing/state";
+
+    systemd.tmpfiles.rules = [ "d /flower/syncthing/${user} 700 ${user} users" ];
+
+    users.users.${user} = {
+      hashedPasswordFile = config.age.secrets.passwd.path;
+      isNormalUser = true;
+      linger = true;
+    };
+    home-manager.users.${user} = { ... }: {
+      home = {
+        username = "${user}";
+        homeDirectory = "/home/${user}";
+        stateVersion = "26.05";
+      };
+      services.syncthing = {
+        enable = true;
+        guiAddress = "[::]:${toString port}";
+        overrideDevices = false;
+        overrideFolders = false;
+        settings = {
+          options.listenAddresses = [
+            "tcp://0.0.0.0:2${toString port}"
+            "quic://0.0.0.0:2${toString port}"
+            "dynamic+https://relays.syncthing.net/endpoint"
+          ];
+          defaults.folder.path = "/flower/syncthing/${user}";
+        };
+      };
+    };
+  };
+in lib.mkMerge [
+  (configOn "kujira" 8385)
+  (configOn "cilly" 8386)
+]

hosts/alyssum/samba.nix

@@ -0,0 +1,84 @@
+{ config, lib, pkgs, ... }:
+let
+  configOn = user: let
+    passwd_fname = "passwd_smb${user}";
+  in {
+    age.secrets.${passwd_fname}.file = ../../secrets/${passwd_fname}.age;
+    me.binds."/flower/smb/${user}/music" = "/flower/media/music/${user}";
+    me.binds."/flower/smb/${user}/syncthing" = "/flower/syncthing/${user}";
+
+    users.users.${user} = {
+      hashedPasswordFile = config.age.secrets.passwd.path;
+      isNormalUser = true;
+    };
+
+    system.activationScripts = {
+      init_smbpasswd.text = let
+        smbpasswd = "${config.services.samba.package}/bin/smbpasswd";
+      in ''
+        printf "$(cat ${config.age.secrets.${passwd_fname}.path})\n$(cat ${config.age.secrets.${passwd_fname}.path})\n" | ${smbpasswd} -sa ${user}
+      '';
+    };
+    services.samba.settings."${user}" = {
+      "path" = "/flower/smb/${user}";
+      "browseable" = "yes";
+      "read only" = "no";
+      "guest ok" = "no";
+      "create mask" = "0644";
+      "directory mask" = "0755";
+      "force user" = user;
+      "force group" = "users";
+      "valid users" = user;
+    };
+  };
+in lib.mkMerge [
+  (configOn "cilly")
+  (configOn "kujira")
+  {
+    me.binds."/flower/smb/kujira/opencloud" = "/flower/opencloud/data/storage/users/users/a8e29fc0-673c-4c67-be00-2442904acb43";
+
+    networking.firewall.allowPing = true;
+
+    services.samba = {
+      enable = true;
+      package = pkgs.samba4Full;
+      openFirewall = true;
+      settings = {
+        global = {
+          "server smb encrypt" = "required";
+          "workgroup" = "WORKGROUP";
+          "server string" = "smbnix";
+          "netbios name" = "smbnix";
+          "security" = "user";
+          "hosts allow" = "100.64.0.0/10 127.0.0.1 alyssum localhost";
+          "hosts deny" = "0.0.0.0/0";
+          "guest account" = "nobody";
+          "map to guest" = "bad user";
+        };
+        "public" = {
+          "path" = "/flower/smb/public";
+          "browseable" = "yes";
+          "read only" = "no";
+          "guest ok" = "yes";
+          "create mask" = "0644";
+          "directory mask" = "0755";
+          "force user" = "hana";
+          "force group" = "users";
+        };
+      };
+    };
+
+    services.samba-wsdd = {
+      enable = true;
+      openFirewall = true;
+    };
+
+    services.avahi = {
+      enable = true;
+      openFirewall = true;
+      nssmdns4 = true;
+      publish.enable = true;
+      publish.userServices = true;
+    };
+  }
+]

hosts/dandelion/default.nix

@@ -5,7 +5,6 @@
 
   age.secrets = {
     acme_dns.file = ../../secrets/acme_dns.age;
-    navidrome_env.file = ../../secrets/navidrome_env.age;
     slskd_env.file = ../../secrets/slskd_env.age;
     wg_dandelion.file = ../../secrets/wg_dandelion.age;
   };
@@ -31,11 +30,12 @@
     inputs.c-beryllium.nixosModule
     inputs.c-citrine.nixosModule
     inputs.c-diamond.nixosModule
-    inputs.c-emerald.nixosModule
+    inputs.c-fluorite.nixosModule
 
     ./filesystem.nix
     ./kernel.nix
     ./networking.nix
+    ./nginx.nix
 
     ../../users/hana
   ];

hosts/dandelion/nginx.nix

@@ -0,0 +1,8 @@
+{ ... }: {
+  services.nginx.virtualHosts."muse.lava.moe" = {
+    useACMEHost = "lava.moe";
+    forceSSL = true;
+    locations."/".return = "404";
+    locations."/share/".proxyPass = "http://[fd0d:2::5:2]:4533";
+  };
+}

modules/binds.nix

@@ -1,8 +1,12 @@
 { config, lib, ...}: {
   imports = [ ./options.nix ];
-  fileSystems = lib.mapAttrs (dest: key: {
+  fileSystems = lib.mapAttrs (dest: key: let
+    target = if (lib.strings.hasPrefix "/" key)
+      then key
+      else "/persist/binds/${key}";
+  in {
     depends = [ "/persist" ];
-    device = "/persist/binds/${key}";
+    device = target;
     fsType = "none";
     options = [ "bind" ];
   }) config.me.binds;

modules/default.nix

@@ -22,7 +22,6 @@ in {
     ./services/nginx.nix
     ./services/postgres.nix
     ./services/sonarr.nix
-    ./services/soulbeet.nix
     ./services/synapse.nix
     ./services/syncthing.nix
     ./services/tmptsync.nix

modules/services/soulbeet.nix

@@ -1,32 +0,0 @@
-{ ... }:
-let
-  dir_data = "/persist/services/soulbeet/data";
-  dir_downloads = "/persist/containers/fluorite/slskd/downloads";
-  dir_music = "/persist/media/music";
-in {
-  systemd.tmpfiles.rules = [
-    "d ${dir_data} 700 root root"
-    "d ${dir_downloads} 755 root users"
-    "d ${dir_music} 075 nobody users"
-  ];
-  virtualisation.oci-containers.backend = "docker";
-  virtualisation.oci-containers.containers = {
-    container-name = {
-      image = "docker.io/docccccc/soulbeet:latest";
-      autoStart = true;
-      ports = [ "9765:9765" ];
-      environment = {
-        DATABASE_URL = "sqlite:/data/soulbeet.db";
-        DOWNLOAD_PATH = "/downloads";
-        SECRET_KEY = "change-me-in-production";
-        NAVIDROME_URL = "http://navidrome:4533";
-        BEETS_CONFIG = "/config/config.yaml";
-      };
-      volumes = [
-        "${dir_data}:/data"
-        "${dir_downloads}:/downloads"
-        "${dir_music}:/music"
-      ];
-    };
-  };
-}

modules/system/nix.nix

@@ -1,5 +1,6 @@
-{ config, lib, pkgs, ... }: {
+{ config, inputs, pkgs, ... }: {
   nix = {
+    nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
     package = pkgs.nixVersions.latest;
 
     settings = rec {

modules/system/tailscale.nix

@@ -4,19 +4,6 @@
   networking.firewall.trustedInterfaces = [ "tailscale0" ];
   networking.firewall.allowedUDPPorts = lib.mkIf (config.me.environment == "headless") [ 123 ];
 
-  networking.nat = lib.mkIf (config.networking.hostName == "dandelion") {
-    enable = true;
-    externalInterface = "enp0s6";
-    internalInterfaces = [ "tailscale0" ];
-    forwardPorts = [
-      {
-        sourcePort = 50300;
-        proto = "tcp";
-        destination = "100.67.2.101:50300";
-      }
-    ];
-  };
-  networking.firewall.allowedTCPPorts = [ 50300 ];
   services.tailscale = {
     enable = true;
     authKeyFile = config.age.secrets.tailscale_auth.path;

modules/user/neovim.nix

@@ -1,9 +1,9 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, sysConfig, ... }:
 let
   luaconf = pkgs.writeText "config.lua"
     (lib.replaceStrings
-      ["{{OMNISHARP_PATH}}" "{{DART_PATH}}" "{{CATPPUCCIN_FLAVOUR}}"]
-      ["${pkgs.omnisharp-roslyn}/bin/OmniSharp" "${pkgs.dart}/bin/dart" config.catppuccin.nvim.flavor]
+      ["{{OMNISHARP_PATH}}" "{{DART_PATH}}" "{{CATPPUCCIN_FLAVOUR}}" "{{USERNAME}}" "{{HOSTNAME}}"]
+      ["${pkgs.omnisharp-roslyn}/bin/OmniSharp" "${pkgs.dart}/bin/dart" config.catppuccin.nvim.flavor config.home.username sysConfig.networking.hostName]
       (builtins.readFile ../../res/config.lua));
 in {
   systemd.user.tmpfiles.rules = [
@@ -21,6 +21,7 @@ in {
     withRuby = false;
 
     extraPackages = with pkgs; [
+      nixd
       rust-analyzer
       texlab
       astro-language-server

res/config.lua

@@ -167,7 +167,7 @@ vim.diagnostic.config({
 
 capabilities = require('cmp_nvim_lsp').default_capabilities(capabilities)
 
-local servers = { 'astro', 'clangd', 'cssls', 'html', 'nil_ls', 'tailwindcss', 'texlab', 'ts_ls', 'yamlls' }
+local servers = { 'astro', 'clangd', 'cssls', 'html', 'tailwindcss', 'texlab', 'ts_ls', 'yamlls' }
 for _, lsp in ipairs(servers) do
     vim.lsp.config(lsp, {
         capabilities = capabilities,
@@ -292,6 +292,32 @@ vim.lsp.config("diagnosticls", {
 })
 vim.lsp.enable("diagnosticls")
 
+-- LSP/nixd
+vim.lsp.config("nixd", {
+  cmd = { "nixd" },
+  filetypes = { "nix" },
+  root_markers = { "flake.nix", ".git" },
+  settings = {
+    nixd = {
+      nixpkgs = {
+        expr = "import <nixpkgs> { }",
+      },
+      formatting = {
+        command = { "nixfmt" },
+      },
+      options = {
+        nixos = {
+          expr = '(builtins.getFlake (toString ./.)).nixosConfigurations.{{HOSTNAME}}.options',
+        },
+        home_manager = {
+          expr = '(builtins.getFlake (builtins.toString ./.)).nixosConfigurations."{{USERNAME}}@{{HOSTNAME}}".options.home-manager.users.type.getSubOptions []',
+        },
+      },
+    },
+  },
+})
+vim.lsp.enable("nixd")
+
 -- LSP/Signatures
 require("lsp_signature").setup {
     hint_enable = false,

secrets.nix

@@ -7,12 +7,14 @@ let
 
   rin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPru5eTBvHJ4ZmrrzPRHCGM09wQP/ZHSaKYalDuBVO15";
 in {
-  "secrets/passwd.age".publicKeys = [ anemone blossom rin ];
+  "secrets/passwd.age".publicKeys = [ alyssum anemone blossom rin ];
+  "secrets/passwd_smbcilly.age".publicKeys = [ alyssum rin ];
+  "secrets/passwd_smbkujira.age".publicKeys = [ alyssum rin ];
   "secrets/wpa_conf.age".publicKeys = [ alyssum blossom rin ];
 
   "secrets/acme_dns.age".publicKeys = [ alyssum dandelion hazel rin ];
-  "secrets/navidrome_env.age".publicKeys = [ anemone dandelion rin ];
-  "secrets/slskd_env.age".publicKeys = [ alyssum anemone dandelion rin ];
+  "secrets/navidrome_env.age".publicKeys = [ alyssum dandelion rin ];
+  "secrets/slskd_env.age".publicKeys = [ anemone dandelion rin ];
   "secrets/tailscale_auth.age".publicKeys = [ alyssum anemone blossom dandelion rin ];
   "secrets/warden_admin.age".publicKeys = [ rin ];
   "secrets/wg_anemone.age".publicKeys = [ anemone rin ];

secrets/passwd_smbcilly.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 kOMSPw CQaXT9/nw3NGD2/H/ctSQGXIoacgjfKQ24wkpEieLSQ
+i4xEXgWGQ7xgQyaDQQIeDuiCLjA6Le23qSnv8C1cbcI
+-> ssh-ed25519 U9FXlg GL4dCSCku/FA6ipb9XI1AxO4lhm2r/1lRAeqaGrB32o
++pPgqwnoPi3wJLobTimVMj0rng+XRapRG6jTYFXSsDM
+--- eVgn3ON19pqq+L832bqlbkHUQXdaTI+LfSL4bYfEdew
+Æ*Œl\ÈWç!J7E/´»îò"f@%\ìüÏ[¨òj8fÓ¶›ž

secrets/passwd_smbkujira.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 kOMSPw Kn+LPMoyOrVwI/nrGgnxgVA3D+tVY9Tccg/Yx/jL+E8
+IfWiSBh7KgNvgcHlcDzfdcB9nxm1zy12Ae7AGm39fdE
+-> ssh-ed25519 U9FXlg 6eIIGEIYDo02FBsgBnwbuOeR8t4xB6jSmLfIL73UCDg
+QOc0ddunQQcVEVD20DKKpn3wZWUSveFJSUTBnv+xnNk
+--- MjN2i0FNzbUpBGUDNgWGXrRsYl2gtsQX+JlzZV/fYdw
+TÎ <ç‘R#d<>ĆÌŽlLkáN¦½º8´cÃ_N¬)±ŠT

users/rin/packages.nix

@@ -15,7 +15,6 @@ in {
     ffmpeg
     gnupg
     kitty
-    nil
     nodejs_latest
     pamixer
     pnpm