imnyang/nix-flakes
Watch
1
0
Fork
You've already forked nix-flakes
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'main' of ssh://mizuki.guru/imnyang/nix-flakes

Browse source
This commit is contained in:
암냥 2026-08-04 19:24:31 +09:00
commit 79e35c876e
No known key found for this signature in database
9 changed files with 479 additions and 92 deletions
Download patch file Download diff file Expand all files Collapse all files

2
hosts/machine/kanade/modules/homebrew/casks.nix
View file

@ -17,6 +17,8 @@
"figma"
"notion"
"firefox@developer-edition"
# Development
"android-studio"
"burp-suite"

2
hosts/machine/mizuki/configuration.nix
View file

@ -61,5 +61,7 @@
services.flatpak.enable = true;
hardware.nvidia-container-toolkit.enable = true;
system.stateVersion = "26.05";
}

1
hosts/server/hikari/hako/default.nix
View file

@ -12,6 +12,7 @@ nixpkgs.lib.nixosSystem {
./services/forgejo.nix
./services/immich.nix
./services/attic.nix
./services/caddy.nix
./services/postgresql.nix
./services/nc.nix

327
hosts/server/hikari/hako/services/caddy.nix Normal file
View file

@ -0,0 +1,327 @@
{ pkgs, ... }:
let
errorHandlers = ''
handle_errors {
@unauthorized expression {http.error.status_code} == 401
handle @unauthorized {
rewrite * /401.html
root * /var/static/error
header Hey "Are you Hacker??? 😠"
file_server
}
@notFound expression {http.error.status_code} == 404
handle @notFound {
rewrite * /404.html
root * /var/static/error
file_server
}
@gone expression {http.error.status_code} == 410
handle @gone {
rewrite * /410.html
root * /var/static/error
file_server
}
@serverError expression {http.error.status_code} in [500, 502, 504, 505]
handle @serverError {
rewrite * /server.html
root * /var/static/error
file_server
}
@clientError expression {http.error.status_code} in [403, 405, 411, 497]
handle @clientError {
rewrite * /client.html
root * /var/static/error
file_server
}
}
'';
withErrors = config: ''
${config}
${errorHandlers}
'';
reverseProxy =
upstream:
withErrors ''
reverse_proxy ${upstream}
'';
reverseProxyWithHeaders =
upstream:
withErrors ''
reverse_proxy ${upstream} {
header_up Host {host}
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
header_up Upgrade {>Upgrade}
header_up Connection {>Connection}
}
'';
staticHost = host: {
extraConfig = withErrors ''
root * /var/static/${host}
@notExist {
not file
not file {path}/
}
handle @notExist {
rewrite * /410.html
root * /var/static/error
file_server
}
file_server
@txt path *.txt
header @txt Content-Type "text/plain; charset=utf-8"
header {
Access-Control-Allow-Origin *
Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
Access-Control-Allow-Headers "Content-Type, Authorization"
Access-Control-Max-Age 3600
}
'';
};
# These were previously served by *.imnya.ng. Listing them explicitly lets
# stock Caddy obtain an individual certificate without a DNS challenge.
staticHosts = [
"26layer7beginner.imnya.ng"
"alt.imnya.ng"
"dday.imnya.ng"
"download.imnya.ng"
"f.imnya.ng"
"hako.imnya.ng"
"ilovecloudflare.imnya.ng"
"img.imnya.ng"
"jongyeol.imnya.ng"
"letters.imnya.ng"
"log.imnya.ng"
"nixos.imnya.ng"
"pack.imnya.ng"
"pf.imnya.ng"
"potato.imnya.ng"
"sometesting.imnya.ng"
"spam.imnya.ng"
"twohearts.imnya.ng"
"whs.imnya.ng"
];
in
{
services.caddy = {
enable = true;
email = "imnyang@pm.me";
openFirewall = true;
package = pkgs.caddy;
virtualHosts =
builtins.listToAttrs (
map (host: {
name = host;
value = staticHost host;
}) staticHosts
)
// {
"api.imnya.ng".extraConfig = reverseProxyWithHeaders "10.11.8.101:1108";
"nou.imnya.ng".extraConfig = reverseProxyWithHeaders "10.11.8.101:6974";
"docs.imnya.ng".extraConfig = reverseProxy "100.70.1.1:3939";
"panel.imnya.ng".extraConfig = reverseProxy "127.0.0.1:32981";
"monitorss.imnya.ng".extraConfig = reverseProxy "127.0.0.1:3132";
"imnya.ng".extraConfig = withErrors ''
handle_path /.well-known/webfinger {
root * /var/www/imnya.ng
file_server
}
root * /var/static/imnya.ng
file_server {
index index.html
}
redir /testtesttest "https://docs.google.com/forms/d/e/1FAIpQLScFDIU151s-CwKZccCET0kfdPigluiGb8BY7vL2US85dAgmhw/viewform?entry.2088744905=test" 302
redir /discord https://api.imnya.ng/discord_invite 302
redir /al https://f.imnya.ng/archlinux/install 302
redir /a https://cloud.hrts.kr/s/ZSHcpHgb9jdtaMR 302
redir /당신은김치찌개의무구한역사를자의적으로이해할수있습니까 https://www.figma.com/deck/LtnSWN6FHhHhTMIPECkdKT 302
redir /tree https://colormytree.me/2025/01KB8E3N0YS1X4EQZDZQ855HAG 302
redir /memos https://discord.gg/CrSjzppDed 302
redir /ctf/29hackcampwriteup "https://imneko.notion.site/29-CTF-31ca3fe0643b809291d2c7c3a1a818b6?source=copy_link" 302
redir /ctf/2025logcon "https://imneko.notion.site/2025-LOGCON-Write-UP-17fa3fe0643b80c0833adf1bd85f46fa?source=copy_link" 302
redir /ctf/2024layer7 "https://imneko.notion.site/2024-Layer7-CTF-177a3fe0643b802d96d9e255f32bf034?pvs=74" 302
'';
"cdn-wiki.tpr.kr".extraConfig = withErrors ''
handle_path /i/* {
rewrite * /thetree/i{uri}
reverse_proxy 127.0.0.1:9000
}
'';
"tts.imnya.ng".extraConfig = ''
reverse_proxy 10.11.8.30:8080
'';
"vw.imnya.ng".extraConfig = reverseProxy "127.0.0.1:30505";
"jongyeoliswebscale.imnya.ng".extraConfig = withErrors ''
basic_auth {
jongyeol $2a$10$I00t8tJJLrcl4jZznO/XmOtd84uGAeJxL71wbN/sYksFrAvZ08n0q
}
reverse_proxy 10.20.31.48:3001 {
header_up Host {host}
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
header_up Upgrade {>Upgrade}
header_up Connection {>Connection}
}
'';
"auth.imnyang.dev".extraConfig = reverseProxy "10.11.8.25:3000";
"imnyang.dev".extraConfig = reverseProxy "82.21.82.30:3000";
"wiki.imnyang.dev".extraConfig = reverseProxy "10.11.8.150:51337";
"adofai.gay".extraConfig = withErrors ''
handle_path /.well-known/discord {
respond "dh=81062ffb49f63e8b7310905aee38aada33a68edb" 200
header Content-Type text/plain
}
redir https://7thbe.at/#adofai 302
'';
"wiki.tpr.kr".extraConfig = reverseProxy "127.0.0.1:51337";
"imlo.li".extraConfig = withErrors ''
handle /rpmfusion.sh {
root * /var/static/scripts
file_server
}
handle {
reverse_proxy 127.0.0.1:4000
}
'';
"http://117.110.40.206".extraConfig = "";
"event.dazzle.st".extraConfig = ''
reverse_proxy 127.0.0.1:9794
'';
"plutos.dazzle.st".extraConfig = ''
reverse_proxy 10.11.8.200:3000
'';
"multiplay.rpc.dazzle.st".extraConfig = ''
@preflight method OPTIONS
header {
Access-Control-Allow-Origin *
Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS"
Access-Control-Allow-Headers *
}
respond @preflight "" 204
reverse_proxy 10.20.30.101:6769
'';
"t.hrts.kr".extraConfig = reverseProxy "10.11.8.101:4041";
"wakapi.hrts.kr".extraConfig = reverseProxy "127.0.0.1:13000";
"ziit.hrts.kr".extraConfig = reverseProxy "127.0.0.1:6030";
"hikari-panel.hrts.kr".extraConfig = reverseProxy "10.11.8.104:8080";
"http://hikari.icn.hrts.kr".extraConfig = withErrors ''
respond "우응" 200
'';
"pve.hrts.kr".extraConfig = withErrors ''
reverse_proxy https://10.11.8.100:8006 {
header_up X-Real-Ip {remote_host}
header_up X-Http-Version {http.request.proto}
transport http {
tls_insecure_skip_verify
}
}
'';
"auth.hrts.kr".extraConfig = reverseProxy "10.11.8.32:1411";
"git.hrts.kr".extraConfig = reverseProxy "127.0.0.1:3000";
"api-ftp.hrts.kr".extraConfig = reverseProxy "10.11.8.101:25716";
"panel.hrts.kr".extraConfig = reverseProxy "127.0.0.1:3929";
"pgadmin.hrts.kr".extraConfig = reverseProxy "127.0.0.1:5050";
"al-1s.hrts.kr".extraConfig = reverseProxy "127.0.0.1:9120";
"hrts.kr".extraConfig = withErrors ''
redir / https://imnya.ng 302
redir /whyididmakethis.md "https://md.imnya.ng/?c=唣𣏫𧆘𡚴唿𢓬𧆬𣺯𢓬𧊈𣪖㸿堊𧈠𠪕𢷬𧆁𠪏𧈠𣪝𣣪喌𢓬𧆬𣺯𢓬𧊈𣪖㸿" 302
'';
"cloud.hrts.kr".extraConfig = ''
redir https://cloud.mizuki.guru{uri}
'';
"i.mizuki.guru".extraConfig = reverseProxy "127.0.0.1:10040";
"git.mizuki.guru".extraConfig = reverseProxy "127.0.0.1:3000";
"cloud.mizuki.guru".extraConfig = reverseProxy "10.11.8.100:60300";
"mizuki.guru".extraConfig = withErrors ''
redir / https://akiyama.mizuki.guru 302
reverse_proxy /_matrix* 127.0.0.1:6167
'';
"api.kanade.mizuki.guru".extraConfig = reverseProxy "10.20.31.41:3000";
"akiyama.mizuki.guru".extraConfig = withErrors ''
handle /api {
reverse_proxy 10.11.8.121:1108
}
handle /api/* {
reverse_proxy 10.11.8.121:1108
}
handle {
reverse_proxy 10.11.8.121:3000
}
'';
"cache.mizuki.guru".extraConfig = reverseProxy "127.0.0.1:8080";
"phrygiacomo.mizuki.guru".extraConfig = withErrors ''
basic_auth {
imnyang $2a$10$zA83XKt84pcXiwfkuvNmKOpQ5Cw0IP6m/.1AX0ahkVQaPOzrmFlxm
}
reverse_proxy 10.20.31.103:3000
'';
"http://hikari.icn.mizuki.guru".extraConfig = withErrors ''
respond "우응" 200
'';
"fs.mizuki.guru".extraConfig = reverseProxy "10.11.8.121:9000";
"broadcast.epc.mizuki.guru".extraConfig = ''
reverse_proxy 10.20.30.101:1234
'';
"apijongyeoltts.mizuki.guru".extraConfig = reverseProxy "10.20.30.103:9880";
"demo.mizuki.guru".extraConfig = reverseProxy "10.20.30.103:3000";
};
};
}

5
hosts/server/kazusa/services/mailserver.nix
View file

@ -137,11 +137,6 @@ in
];
oauth2_tokeninfo_url = "https://auth.mizuki.guru/application/o/userinfo/?access_token=";
# 주의:
# 여기는 아직 secret '값'이 아니라 secret '경로'가 들어감.
# Dovecot이 URL 안에서 file_get_contents 같은 처리를 안 하므로
# 이 방식은 제대로 동작하지 않을 가능성이 큼.
oauth2_introspection_url = "https://auth.mizuki.guru/application/o/introspect/";
oauth2_introspection_mode = "post";