Refactor setup

linux/nebula/caddy.nix

@@ -1,29 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  services.caddy =
-    {
-      enable = true;
-      virtualHosts =
-        let
-          conduitCfg = config.services.matrix-conduit.settings.global;
-          forgejoCfg = config.services.gitea.settings.server;
-          dn = config.constants.domain;
-          lh = config.constants.localhost;
-        in
-        {
-          "forgejo.${dn}".extraConfig = ''
-            reverse_proxy ${forgejoCfg.HTTP_ADDR}:${toString forgejoCfg.HTTP_PORT}
-          '';
-          "jellyfin.${dn}".extraConfig = ''
-            reverse_proxy ${lh}:${toString config.constants.port.jellyfin}
-          '';
-          "matrix.${dn}".extraConfig = ''
-            reverse_proxy /_matrix/* ${conduitCfg.address}:${toString conduitCfg.port}
-            file_server {
-              root ${pkgs.cinny}
-            }
-          '';
-        };
-    };
-}

linux/nebula/conduit.nix

@@ -3,9 +3,9 @@
 {
   services.matrix-conduit = {
     enable = true;
-    settings.global = {
-      address = config.constants.localhost;
-      port = 29800;
+    settings.global = let const = config.constants; in {
+      address = const.tsMask;
+      port = const.port.conduit;
       server_name = config.constants.domain;
     };
   };

linux/nebula/default.nix

@@ -6,7 +6,6 @@
     hardware.nixosModules.common-cpu-amd
     hardware.nixosModules.common-cpu-amd-pstate
   ] ++ [
-    ./caddy.nix
     ./conduit.nix
     ./configuration.nix
     ./disko.nix

linux/nebula/forgejo.nix

@@ -6,11 +6,11 @@
     appName = "Forgejo";
     package = pkgs.forgejo;
     settings = {
-      server = let dn = config.constants.domain; in {
-        DOMAIN = dn;
-        HTTP_ADDR = config.constants.localhost;
-        HTTP_PORT = 47674;
-        ROOT_URL = "https://forgejo.${dn}";
+      server = let const = config.constants; in {
+        DOMAIN = const.domain;
+        HTTP_ADDR = const.tsMask;
+        HTTP_PORT = const.port.forgejo;
+        ROOT_URL = "https://forgejo.${const.domain}";
       };
       service.DISABLE_REGISTRATION = true;
       session.COOKIE_SECURE = true;

linux/nebula/network.nix

@@ -1,9 +1,9 @@
 { config, ... }:
 
-let const = config.constants; hn = config.networking.hostName; in {
+let hn = config.networking.hostName; in {
   networking = {
     domain = config.constants.domain;
-    firewall.allowedTCPPorts = with const.port; [ http https ];
+    firewall.trustedInterfaces = [ config.services.tailscale.interfaceName ];
     hostId = "e6449321";
     networkmanager = {
       enable = true;
@@ -15,13 +15,6 @@ let const = config.constants; hn = config.networking.hostName; in {
   };
 
   services = {
-    cloudflare-dyndns = {
-      enable = true;
-      apiTokenFile = config.sops.secrets."cloudflare/${hn}".path;
-      domains = builtins.attrNames config.services.caddy.virtualHosts;
-      ipv4 = false;
-      ipv6 = true;
-    };
     openssh = {
       enable = true;
       hostKeys = [{
@@ -37,6 +30,4 @@ let const = config.constants; hn = config.networking.hostName; in {
     };
     resolved.enable = true;
   };
-
-  sops.secrets."cloudflare/${hn}" = { };
 }

linux/nebula/tailscale.nix

@@ -1,7 +1,6 @@
 { ... }: {
   services.tailscale = {
     enable = true;
-    extraUpFlags = [ "--advertise-exit-node" ];
     port = 25555;
     useRoutingFeatures = "both";
   };