benq/nixos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add selfhosted services

Browse Source
This commit is contained in:
aloslider
2026-06-30 04:26:40 +03:00
parent f212c874b5
commit 13e407847f
78 changed files with 2346 additions and 690 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/common/optional/selfhosted/netbird/dashboard/config.nix
+23
View File
@@ -0,0 +1,23 @@
{ config, ... }:
let
fullDomain = "${config.selfhosted.netbird.subdomain}.${config.sops.placeholder."domains/serv"}";
in
{
sops.templates."nb-dashboard.env".content = ''
NETBIRD_MGMT_API_ENDPOINT=https://${fullDomain}
NETBIRD_MGMT_GRPC_API_ENDPOINT=https://${fullDomain}
# Initial NB setup: custom OIDCP is added manually in panel later
AUTH_AUTHORITY=https://${fullDomain}/oauth2
AUTH_AUDIENCE=netbird-dashboard
AUTH_CLIENT_ID=netbird-dashboard
AUTH_CLIENT_SECRET=
USE_AUTH0=false
AUTH_SUPPORTED_SCOPES=openid profile email groups
AUTH_REDIRECT_URI=/nb-auth
AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
LETSENCRYPT_DOMAIN=none
LETSENCRYPT_EMAIL=${config.sops.placeholder."letsEncrypt/email"}
'';
}
hosts/common/optional/selfhosted/netbird/dashboard/default.nix
+43
View File
@@ -0,0 +1,43 @@
{ config, lib, ... }:
with lib;
let
common = config.selfhosted.common;
cfg = config.selfhosted.netbird;
in
{
imports = [ ./config.nix ];
options.selfhosted.netbird.dashboard = {
name = mkOption {
type = types.str;
};
};
config = {
virtualisation.oci-containers.containers.${cfg.dashboard.name} = {
image = "netbirdio/dashboard:latest";
environmentFiles = [ config.sops.templates."nb-dashboard.env".path ];
log-driver = "journald";
extraOptions = [
"--network-alias=${cfg.dashboard.name}"
"--network=${common.network.name}"
];
};
systemd.services."${common.backend}-${cfg.dashboard.name}" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
};
after = [
"${common.backend}-${cfg.server.name}.service"
"${common.backend}-${config.selfhosted.traefik.name}.service"
];
requires = [
"${common.backend}-${cfg.server.name}.service"
"${common.backend}-${config.selfhosted.traefik.name}.service"
];
partOf = [ "${common.backend}-${cfg.targetName}.target" ];
wantedBy = [ "${common.backend}-${cfg.targetName}.target" ];
};
};
}
hosts/common/optional/selfhosted/netbird/default.nix
+43
View File
@@ -0,0 +1,43 @@
{
config,
lib,
pkgs,
...
}:
with lib;
let
common = config.selfhosted.common;
cfg = config.selfhosted.netbird;
in
{
imports = [
./dashboard
./proxy
./server
];
options.selfhosted.netbird = {
targetName = mkOption {
type = types.str;
};
subdomain = mkOption {
type = types.str;
};
};
config = {
sops.secrets = {
"netbird/proxy/token" = { };
};
systemd.targets."${common.backend}-${cfg.targetName}" = {
unitConfig = {
Description = "Root target for ${cfg.targetName}";
};
after = [ "${common.backend}-network-${common.network.name}.service" ];
requires = [ "${common.backend}-network-${common.network.name}.service" ];
partOf = [ "${common.backend}-${common.rootTarget.name}.target" ];
wantedBy = [ "${common.backend}-${common.rootTarget.name}.target" ];
};
};
}
hosts/common/optional/selfhosted/netbird/proxy/config.nix
+20
View File
@@ -0,0 +1,20 @@
{ config, ... }:
let
cfg = config.selfhosted.netbird;
in
{
sops.templates."nb-proxy.env".content = ''
NB_PROXY_DEBUG_LOGS=false
NB_PROXY_PROXY_PROTOCOL=true
NB_PROXY_MANAGEMENT_ADDRESS=http://${cfg.server.name}:80
NB_PROXY_ALLOW_INSECURE=true
NB_PROXY_DOMAIN=${cfg.subdomain}.${config.sops.placeholder."domains/serv"}
NB_PROXY_ADDRESS=:8443
NB_PROXY_TOKEN=${config.sops.placeholder."netbird/proxy/token"}
NB_PROXY_FORWARDED_PROTO=https
NB_PROXY_CERTIFICATE_DIRECTORY=/certs
NB_PROXY_ACME_CERTIFICATES=true
NB_PROXY_ACME_CHALLENGE_TYPE=tls-alpn-01
NB_PROXY_TRUSTED_PROXIES=${config.selfhosted.traefik.ip}
'';
}
hosts/common/optional/selfhosted/netbird/proxy/default.nix
+60
View File
@@ -0,0 +1,60 @@
{ config, lib, ... }:
with lib;
let
common = config.selfhosted.common;
cfg = config.selfhosted.netbird;
hostDataPath = "${common.dataDir}/netbird/proxy";
in
{
imports = [ ./config.nix ];
options.selfhosted.netbird.proxy = {
name = mkOption {
type = types.str;
};
};
config = {
virtualisation.oci-containers.containers.${cfg.proxy.name} = {
image = "netbirdio/reverse-proxy:latest";
environmentFiles = [ config.sops.templates."nb-proxy.env".path ];
volumes = [
"${hostDataPath}/certs:/certs:rw"
];
ports = [
"0.0.0.0:2222:2222/tcp" # gitea
"0.0.0.0:7359:7359/udp" # jelly
"0.0.0.0:51820:51820/udp"
];
dependsOn = [ cfg.server.name ];
log-driver = "journald";
extraOptions = [
"--network-alias=${cfg.proxy.name}"
"--network=${common.network.name}"
];
};
systemd.services."${common.backend}-${cfg.proxy.name}" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
};
after = [
"${common.backend}-network-${common.network.name}.service"
"${common.backend}-${cfg.server.name}.service"
"${common.backend}-${config.selfhosted.traefik.name}.service"
];
requires = [
"${common.backend}-network-${common.network.name}.service"
"${common.backend}-${cfg.server.name}.service"
"${common.backend}-${config.selfhosted.traefik.name}.service"
];
partOf = [ "${common.backend}-${cfg.targetName}.target" ];
wantedBy = [ "${common.backend}-${cfg.targetName}.target" ];
preStart = ''
mkdir -p ${hostDataPath}/certs
chown -R ${common.user.uid}:${common.group.gid} ${hostDataPath}
chmod -R 0755 ${hostDataPath}
'';
};
};
}
hosts/common/optional/selfhosted/netbird/server/config.nix
+43
View File
@@ -0,0 +1,43 @@
{ config, ... }:
let
common = config.selfhosted.common;
cfg = config.selfhosted.netbird;
fullDomain = "${cfg.subdomain}.${config.sops.placeholder."domains/serv"}";
in
{
sops.secrets = {
"netbird/server/auth_secret" = { };
"netbird/server/enc_key" = { };
};
sops.templates."nb-server.yaml".content = ''
server:
listenAddress: ":80"
exposedAddress: "https://${fullDomain}:443"
stunPorts:
- 3478
metricsPort: 9090
healthcheckAddress: ":9000"
logLevel: "info"
logFile: "console"
authSecret: "${config.sops.placeholder."netbird/server/auth_secret"}"
auth:
issuer: "https://${fullDomain}/oauth2"
dashboardRedirectURIs:
- "https://${fullDomain}/nb-auth"
- "https://${fullDomain}/nb-silent-auth"
cliRedirectURIs:
- "http://localhost:53000/"
localAuthDisabled: false
store:
engine: "sqlite"
encryptionKey: "${config.sops.placeholder."netbird/server/enc_key"}"
reverseProxy:
trustedHTTPProxies:
- "${config.selfhosted.traefik.ip}/32"
'';
}
hosts/common/optional/selfhosted/netbird/server/default.nix
+59
View File
@@ -0,0 +1,59 @@
{ config, lib, ... }:
with lib;
let
common = config.selfhosted.common;
cfg = config.selfhosted.netbird;
hostDataPath = "${common.dataDir}/netbird/server";
in
{
imports = [ ./config.nix ];
options.selfhosted.netbird.server = {
name = mkOption {
type = types.str;
};
};
config = {
virtualisation.oci-containers.containers.${cfg.server.name} = {
image = "netbirdio/netbird-server:latest";
volumes = [
"${config.sops.templates."nb-server.yaml".path}:/etc/netbird/config.yaml:rw"
"${hostDataPath}/data:/var/lib/netbird:rw"
];
ports = [
"0.0.0.0:3478:3478/udp"
];
cmd = [
"--config"
"/etc/netbird/config.yaml"
];
log-driver = "journald";
extraOptions = [
"--network-alias=${cfg.server.name}"
"--network=${common.network.name}"
];
};
systemd.services."${common.backend}-${cfg.server.name}" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
};
after = [
"${common.backend}-network-${common.network.name}.service"
"${common.backend}-${config.selfhosted.traefik.name}.service"
];
requires = [
"${common.backend}-network-${common.network.name}.service"
"${common.backend}-${config.selfhosted.traefik.name}.service"
];
partOf = [ "${common.backend}-${cfg.targetName}.target" ];
wantedBy = [ "${common.backend}-${cfg.targetName}.target" ];
preStart = ''
mkdir -p ${hostDataPath}/data
chown -R ${common.user.uid}:${common.group.gid} ${hostDataPath}
chmod -R 0755 ${hostDataPath}
'';
};
};
}