Initial commit

hosts/server/hikari/hako/services/attic.nix

@@ -0,0 +1,21 @@
+{
+  services.atticd = {
+    enable = true;
+
+    # Replace with absolute path to your environment file
+    environmentFile = "/etc/atticd.env";
+
+    settings = {
+      listen = "[::]:8080";
+
+      jwt = { };
+
+      database.url = "postgresql:///attic";
+
+      storage = {
+        type = "local";
+        path = "/mnt/attic";
+      };
+    };
+  };
+}

hosts/server/hikari/hako/services/forgejo.nix

@@ -0,0 +1,130 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  sops = {
+    defaultSopsFile = ../secrets/forgejo.yaml;
+    validateSopsFiles = false;
+    age = {
+      keyFile = "/var/lib/sops-nix/key.txt";
+      generateKey = true;
+    };
+    secrets = {
+      "forgejo/server_lfs_jwt_secret" = {
+        owner = "forgejo";
+        group = "forgejo";
+        restartUnits = [ "forgejo.service" ];
+      };
+      "forgejo/security_internal_token" = {
+        owner = "forgejo";
+        group = "forgejo";
+        restartUnits = [ "forgejo.service" ];
+      };
+      "forgejo/oauth2_jwt_secret" = {
+        owner = "forgejo";
+        group = "forgejo";
+        restartUnits = [ "forgejo.service" ];
+      };
+      "forgejo/mailer_passwd" = {
+        owner = "forgejo";
+        group = "forgejo";
+        restartUnits = [ "forgejo.service" ];
+      };
+    };
+  };
+
+  services.forgejo = {
+    enable = true;
+    package = pkgs.forgejo;
+
+    database = {
+      type = "postgres";
+      createDatabase = true;
+      host = "/run/postgresql/";
+      name = "forgejo";
+      user = "forgejo";
+    };
+
+    settings = {
+      DEFAULT = {
+        APP_NAME = "git.mizuki.guru";
+        APP_SLOGAN = "with 🎀";
+        RUN_MODE = "prod";
+      };
+
+      federation = {
+        ENABLED = true;
+      };
+
+      server = {
+        DOMAIN = "git.mizuki.guru";
+        SSH_DOMAIN = "mizuki.guru";
+        HTTP_PORT = 3000;
+        ROOT_URL = "https://git.mizuki.guru/";
+        DISABLE_SSH = false;
+        SSH_PORT = 22;
+        LFS_START_SERVER = true;
+        OFFLINE_MODE = false;
+      };
+
+      security = {
+        INSTALL_LOCK = true;
+        PASSWORD_HASH_ALGO = "pbkdf2_hi";
+      };
+
+      service = {
+        REGISTER_EMAIL_CONFIRM = true;
+        ENABLE_NOTIFY_MAIL = true;
+        DISABLE_REGISTRATION = false;
+        ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
+        ENABLE_CAPTCHA = false;
+        REQUIRE_SIGNIN_VIEW = false;
+        DEFAULT_KEEP_EMAIL_PRIVATE = false;
+        DEFAULT_ALLOW_CREATE_ORGANIZATION = true;
+        DEFAULT_ENABLE_TIMETRACKING = true;
+        NO_REPLY_ADDRESS = "noreply.relay.imnya.ng";
+      };
+
+      mailer = {
+        ENABLED = true;
+        SMTP_ADDR = "mail.mizuki.guru";
+        SMTP_PORT = 587;
+        FROM = "systemmail@mizuki.guru";
+        USER = "systemmail@mizuki.guru";
+      };
+
+      oauth2 = {
+        ENABLED = true;
+      };
+
+      actions = {
+        ENABLED = true;
+      };
+
+      ui = {
+        THEMES = "dark,light,auto,forgejo-auto,forgejo-light,forgejo-dark";
+        DEFAULT_THEME = "auto";
+      };
+
+      repository = {
+        ROOT = "/var/lib/forgejo/repositories";
+      };
+      "repository.pull-request".DEFAULT_MERGE_STYLE = "merge";
+      "repository.signing".DEFAULT_TRUST_MODEL = "committer";
+      "cron.update_checker".ENABLED = true;
+      session.PROVIDER = "file";
+      oauth2_client.ENABLE_AUTO_REGISTRATION = true;
+    };
+
+    secrets = {
+      server.LFS_JWT_SECRET = lib.mkForce config.sops.secrets."forgejo/server_lfs_jwt_secret".path;
+      security.INTERNAL_TOKEN = lib.mkForce config.sops.secrets."forgejo/security_internal_token".path;
+      oauth2.JWT_SECRET = lib.mkForce config.sops.secrets."forgejo/oauth2_jwt_secret".path;
+      mailer.PASSWD = lib.mkForce config.sops.secrets."forgejo/mailer_passwd".path;
+    };
+  };
+}

hosts/server/hikari/hako/services/immich.nix

@@ -0,0 +1,37 @@
+{ config, ... }:
+let
+  immichSecret = key: {
+    sopsFile = ../secrets/immich.yaml;
+    inherit key;
+    owner = "immich";
+  };
+in
+{
+  sops.secrets."immich/oauth2/client-id" = immichSecret "immich/oauth2/client-id";
+  sops.secrets."immich/oauth2/client-secret" = immichSecret "immich/oauth2/client-secret";
+
+  services.immich = {
+    enable = true;
+    host = "0.0.0.0";
+    port = 10040;
+
+    mediaLocation = "/mnt/data/immich/media";
+    openFirewall = true;
+    machine-learning.enable = false;
+
+    settings = {
+      server.externalDomain = "https://i.mizuki.guru";
+      machineLearning = {
+        enabled = false;
+      };
+      oauth = {
+        enabled = true;
+        issuerUrl = "https://auth.mizuki.guru/application/o/immich/.well-known/openid-configuration";
+        clientId._secret = config.sops.secrets."immich/oauth2/client-id".path;
+        clientSecret._secret = config.sops.secrets."immich/oauth2/client-secret".path;
+        scope = "openid email profile";
+        buttonText = "Login with mizuki";
+      };
+    };
+  };
+}

hosts/server/hikari/hako/services/nc.nix

@@ -0,0 +1,63 @@
+{
+  pkgs,
+  inputs,
+  config,
+  ...
+}:
+
+let
+  ncSecret = key: {
+    sopsFile = ../secrets/nc.yaml;
+    inherit key;
+    owner = "mizuki-nc";
+    group = "mizuki-nc";
+    mode = "0400";
+  };
+in
+{
+  users.users.mizuki-nc = {
+    isSystemUser = true;
+    group = "mizuki-nc";
+  };
+
+  users.groups.mizuki-nc = { };
+
+  sops.secrets."google/api-key" = ncSecret "google/api-key";
+
+  systemd.services.mizuki-nc = {
+    description = "mizuki.guru";
+    wantedBy = [ "multi-user.target" ];
+
+    preStart = ''
+      set -eu
+      umask 077
+
+      rm -f /var/lib/mizuki-nc/config.toml
+
+      cat > /tmp/mizuki-nc-config.toml <<EOF
+[google]
+api-key = "$(cat ${config.sops.secrets."google/api-key".path})"
+EOF
+
+      install -o mizuki-nc -g mizuki-nc -m 0400 \
+        /tmp/mizuki-nc-config.toml \
+        /var/lib/mizuki-nc/config.toml
+
+      rm -f /tmp/mizuki-nc-config.toml
+    '';
+
+    serviceConfig = {
+      User = "mizuki-nc";
+      Group = "mizuki-nc";
+
+      StateDirectory = "mizuki-nc";
+      StateDirectoryMode = "0750";
+      WorkingDirectory = "/var/lib/mizuki-nc";
+
+      ExecStart = "${inputs.mizuki-nc.packages.${pkgs.system}.default}/bin/mizuki-nc";
+
+      Restart = "always";
+      RestartSec = 3;
+    };
+  };
+}

hosts/server/hikari/hako/services/postgresql.nix

@@ -0,0 +1,16 @@
+{ pkgs, ... }: {
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_17.withPackages (ps: with ps; [
+      pgvector
+      vectorchord
+    ]);
+    ensureDatabases = [ "attic" "atticd" ];
+    ensureUsers = [
+      {
+        name = "atticd";
+        ensureDBOwnership = true;
+      }
+    ];
+  };
+}