systems -> hosts

moved functions to /lib

inputs over imports

turned each module file into a nixosModule

moved registry and $NIX_PATH pinning to /modules/pinning.nix

hosts/gerg-desktop/containers/minecraft.nix_

@@ -0,0 +1,100 @@
+_:{
+  containers."minecraft" = {
+    ephemeral = true;
+    autoStart = true;
+    privateNetwork = true;
+    hostBridge = "bridge0";
+    localAddress = "192.168.1.10/24";
+    bindMounts."/minecraft" = {
+      hostPath = "/persist/minecraft";
+      isReadOnly = false;
+    };
+    config = {pkgs, ...}: {
+      nixpkgs.config.allowUnfree = true;
+      environment.systemPackages = [pkgs.neovim];
+      networking = {
+        defaultGateway = "192.168.1.1";
+        nameservers = ["192.168.1.1"];
+        firewall = {
+          allowedUDPPorts = [25565];
+          allowedTCPPorts = [25565];
+        };
+      };
+      systemd.services.setmacaddr = {
+        script = ''
+          /run/current-system/sw/bin/ip link set dev eth0 address 00:00:00:00:00:10
+        '';
+        wantedBy = ["basic.target"];
+        after = ["dhcpcd.service"];
+      };
+      boot.initrd.postDeviceCommands = "mkdir -p /minecraft";
+
+      system.stateVersion = "unstable";
+      users.users.minecraft = {
+        description = "Minecraft server service user";
+        home = "/minecraft";
+        createHome = true;
+        isSystemUser = true;
+        group = "minecraft";
+      };
+      users.groups.minecraft = {};
+
+      systemd.sockets.minecraft-server = {
+        bindsTo = ["minecraft-server.service"];
+        socketConfig = {
+          ListenFIFO = "/run/minecraft-server.stdin";
+          SocketMode = "0660";
+          SocketUser = "minecraft";
+          SocketGroup = "minecraft";
+          RemoveOnStop = true;
+          FlushPending = true;
+        };
+      };
+
+      systemd.services.minecraft-server = {
+        enable = true;
+        description = "Minecraft Server Service";
+        wantedBy = ["multi-user.target"];
+        requires = ["minecraft-server.socket"];
+        after = ["network.target" "minecraft-server.socket"];
+
+        serviceConfig = {
+          ExecStart = "${pkgs.papermc}/bin/minecraft-server -Xms8G -Xmx8G -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+DisableExplicitGC -XX:+AlwaysPreTouch -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1 -Dusing.aikars.flags=https://mcflags.emc.gs -Daikars.new.flags=true";
+          Restart = "always";
+          User = "minecraft";
+          WorkingDirectory = "/minecraft";
+
+          StandardInput = "socket";
+          StandardOutput = "journal";
+          StandardError = "journal";
+
+          # Hardening
+          CapabilityBoundingSet = [""];
+          DeviceAllow = [""];
+          LockPersonality = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          RestrictAddressFamilies = ["AF_INET" "AF_INET6"];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          UMask = "0077";
+        };
+        preStart = ''
+          echo "eula=true" > eula.txt
+
+        '';
+      };
+    };
+  };
+}

hosts/gerg-desktop/containers/website.nix_

@@ -0,0 +1,155 @@
+_:{
+  sops.secrets = {
+    "website/sql_gitea" = {
+      mode = "0444";
+    };
+    "website/sql_nextcloud" = {
+      mode = "0444";
+    };
+    "website/nextcloud" = {
+      mode = "0444";
+    };
+
+    "website/ssl_key" = {
+      mode = "0444";
+    };
+
+    "website/ssl_cert" = {
+      mode = "0444";
+    };
+  };
+  containers."website" = {
+    ephemeral = true;
+    autoStart = true;
+    privateNetwork = true;
+    hostBridge = "bridge0";
+    localAddress = "192.168.1.11/24";
+    bindMounts = {
+      "/var" = {
+        hostPath = "/persist/website/var";
+        isReadOnly = false;
+      };
+      "/etc/ssh" = {
+        hostPath = "/persist/website/etc/ssh/";
+        isReadOnly = false;
+      };
+      "/secrets".hostPath = "/run/secrets/website";
+    };
+    config = {
+      pkgs,
+      config,
+      ...
+    }: let
+      giteaPort = 3000;
+    in {
+      nixpkgs.config.allowUnfree = true;
+      environment.systemPackages = [pkgs.neovim];
+      networking = {
+        defaultGateway = "192.168.1.1";
+        nameservers = ["1.1.1.1" "1.0.0.1"];
+        firewall = {
+          allowedTCPPorts = [giteaPort 80 443 22];
+        };
+      };
+      systemd.services.setmacaddr = {
+        script = ''
+          /run/current-system/sw/bin/ip link set dev eth0 address 00:00:00:00:00:11
+        '';
+        wantedBy = ["basic.target"];
+        after = ["dhcpcd.service"];
+      };
+      system.stateVersion = "unstable";
+      services = {
+        gitea = {
+          enable = true;
+          appName = "Powered by NixOS";
+          domain = "git.gerg-l.com";
+          rootUrl = "https://git.gerg-l.com/";
+          httpPort = giteaPort;
+          settings = {
+            server = {
+              LANDING_PAGE = "/explore/repos";
+            };
+            ui = {
+              DEFAULT_THEME = "arc-green";
+            };
+            service = {
+              DISABLE_REGISTRATION = true;
+            };
+          };
+          database = {
+            type = "postgres";
+            passwordFile = "/secrets/sql_gitea";
+          };
+        };
+        nextcloud = {
+          enable = true;
+          package = pkgs.nextcloud26;
+          hostName = "next.gerg-l.com";
+          autoUpdateApps.enable = true;
+          enableBrokenCiphersForSSE = false;
+          config = {
+            dbtype = "pgsql";
+            dbhost = "/run/postgresql";
+            dbpassFile = "/secrets/sql_nextcloud";
+            adminpassFile = "/secrets/nextcloud";
+            adminuser = "admin-root";
+            defaultPhoneRegion = "IL";
+          };
+        };
+        postgresql = {
+          enable = true;
+          package = pkgs.postgresql_13;
+          ensureDatabases = [config.services.nextcloud.config.dbname];
+          ensureUsers = [
+            {
+              name = config.services.nextcloud.config.dbuser;
+              ensurePermissions."DATABASE ${config.services.nextcloud.config.dbname}" = "ALL PRIVILEGES";
+            }
+          ];
+          authentication = ''
+            local gitea all ident map=gitea-users
+          '';
+          identMap = ''
+            gitea-users gitea gitea
+          '';
+        };
+        nginx = {
+          enable = true;
+          recommendedGzipSettings = true;
+          recommendedOptimisation = true;
+          recommendedProxySettings = true;
+          recommendedTlsSettings = true;
+          virtualHosts = let
+            template = {
+              forceSSL = true;
+              sslCertificate = "/secrets/ssl_cert";
+              sslCertificateKey = "/secrets/ssl_key";
+            };
+          in {
+            "git.gerg-l.com" =
+              template
+              // {
+                locations."/" = {
+                  proxyPass = "http://localhost:${toString giteaPort}";
+                };
+              };
+            "next.gerg-l.com" = template;
+          };
+        };
+        openssh = {
+          enable = true;
+          settings = {
+            PermitRootLogin = "no";
+            PasswordAuthentication = false;
+            KbdInteractiveAuthentication = false;
+          };
+        };
+      };
+      systemd.services."nextcloud-setup" = {
+        requires = ["postgresql.service"];
+        after = ["postgresql.service"];
+      };
+    };
+  };
+}