Add selfhosted services

2026-06-30 04:26:40 +03:00
parent f212c874b5
commit 13e407847f
78 changed files with 2346 additions and 690 deletions
@@ -0,0 +1,43 @@
+{ config, ... }:
+let
+  common = config.selfhosted.common;
+  cfg = config.selfhosted.netbird;
+  fullDomain = "${cfg.subdomain}.${config.sops.placeholder."domains/serv"}";
+in
+{
+  sops.secrets = {
+    "netbird/server/auth_secret" = { };
+    "netbird/server/enc_key" = { };
+  };
+
+  sops.templates."nb-server.yaml".content = ''
+    server:
+      listenAddress: ":80"
+      exposedAddress: "https://${fullDomain}:443"
+      stunPorts:
+        - 3478
+      metricsPort: 9090
+      healthcheckAddress: ":9000"
+      logLevel: "info"
+      logFile: "console"
+
+      authSecret: "${config.sops.placeholder."netbird/server/auth_secret"}"
+
+      auth:
+        issuer: "https://${fullDomain}/oauth2"
+        dashboardRedirectURIs:
+          - "https://${fullDomain}/nb-auth"
+          - "https://${fullDomain}/nb-silent-auth"
+        cliRedirectURIs:
+          - "http://localhost:53000/"
+        localAuthDisabled: false
+
+      store:
+        engine: "sqlite"
+        encryptionKey: "${config.sops.placeholder."netbird/server/enc_key"}"
+
+      reverseProxy:
+        trustedHTTPProxies:
+          - "${config.selfhosted.traefik.ip}/32"
+  '';
+}
@@ -0,0 +1,59 @@
+{ config, lib, ... }:
+with lib;
+let
+  common = config.selfhosted.common;
+  cfg = config.selfhosted.netbird;
+  hostDataPath = "${common.dataDir}/netbird/server";
+in
+{
+  imports = [ ./config.nix ];
+
+  options.selfhosted.netbird.server = {
+    name = mkOption {
+      type = types.str;
+    };
+  };
+
+  config = {
+    virtualisation.oci-containers.containers.${cfg.server.name} = {
+      image = "netbirdio/netbird-server:latest";
+      volumes = [
+        "${config.sops.templates."nb-server.yaml".path}:/etc/netbird/config.yaml:rw"
+        "${hostDataPath}/data:/var/lib/netbird:rw"
+      ];
+      ports = [
+        "0.0.0.0:3478:3478/udp"
+      ];
+      cmd = [
+        "--config"
+        "/etc/netbird/config.yaml"
+      ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network-alias=${cfg.server.name}"
+        "--network=${common.network.name}"
+      ];
+    };
+
+    systemd.services."${common.backend}-${cfg.server.name}" = {
+      serviceConfig = {
+        Restart = lib.mkOverride 90 "always";
+      };
+      after = [
+        "${common.backend}-network-${common.network.name}.service"
+        "${common.backend}-${config.selfhosted.traefik.name}.service"
+      ];
+      requires = [
+        "${common.backend}-network-${common.network.name}.service"
+        "${common.backend}-${config.selfhosted.traefik.name}.service"
+      ];
+      partOf = [ "${common.backend}-${cfg.targetName}.target" ];
+      wantedBy = [ "${common.backend}-${cfg.targetName}.target" ];
+      preStart = ''
+        mkdir -p ${hostDataPath}/data
+        chown -R ${common.user.uid}:${common.group.gid} ${hostDataPath}
+        chmod -R 0755 ${hostDataPath}
+      '';
+    };
+  };
+}