added cloudflared

.sops.yaml

@@ -0,0 +1,7 @@
+keys:
+  - &host_key age102mctuw7xvs3fakft0mlfh740kc6rdaqqgmmwf400c4g3spefyjqrfmwct
+creation_rules:
+  - path_regex: (yaml|json)$
+    key_groups:
+      - age:
+        - *host_key

configuration.nix

@@ -1,36 +1,26 @@
-{ pkgs, userSettings, systemSettings, ... }:
+{ pkgs, config, ... }: {
-{
+  config = {
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+    services.openssh.enable = true;
+    services.avahi = { enable = true; nssmdns4 = true; };
+
+    sops.defaultSopsFile = ./secrets/encrypted_secrets.yaml;
+    sops.defaultSopsFormat = "yaml";
+
+    sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
     environment.systemPackages = with pkgs; [
-    # (pkgs.writeShellScriptBin "nrbs" "sudo nixos-rebuild switch")
+      home-manager
-    # (pkgs.writeShellScriptBin "nrbsu" "sudo nix-channel --update && sudo nixos-rebuild switch")
       bash
       busybox
       git
       eza
+      sops
     ];
 
-  # For SSH access
-  services.openssh.enable = true;
-
-  # Networking stuff
-  services.avahi = { enable = true; nssmdns4 = true; };
-
-  # Uses rust-based sudo
     security.sudo-rs = {
       enable = true;
       execWheelOnly = false;
       wheelNeedsPassword = false; # allows sudo without password for those in the wheel group
     };
-
-  users.users.${userSettings.username} = {
-    isNormalUser  = true;
-    uid = 1000;
-    extraGroups  = [ "wheel" "networkmanager" ];
-    openssh.authorizedKeys.keyFiles = [ /root/.ssh/authorized_keys ];
   };
-
-  time.timeZone = "${systemSettings.timeZone}";
-  networking.hostName = systemSettings.hostName;
 }

flake.lock

@@ -25,11 +25,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733484277,
+        "lastModified": 1748227609,
-        "narHash": "sha256-i5ay20XsvpW91N4URET/nOc0VQWOAd4c4vbqYtcH8Rc=",
+        "narHash": "sha256-SaSdslyo6UGDpPUlmrPA4dWOEuxCy2ihRN9K6BnqYsA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d00c6f6d0ad16d598bf7e2956f52c1d9d5de3c3a",
+        "rev": "d23d20f55d49d8818ac1f1b2783671e8a6725022",
         "type": "github"
       },
       "original": {
@@ -40,58 +40,48 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1733581040,
+        "lastModified": 1748190013,
-        "narHash": "sha256-Qn3nPMSopRQJgmvHzVqPcE3I03zJyl8cSbgnnltfFDY=",
+        "narHash": "sha256-R5HJFflOfsP5FBtk+zE8FpL8uqE7n62jqOsADvVshhE=",
-        "owner": "NixOS",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "22c3f2cf41a0e70184334a958e6b124fb0ce3e01",
+        "rev": "62b852f6c6742134ade1abdd2a21685fd617a291",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "nixos",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "nixpkgs-stable": {
-      "locked": {
-        "lastModified": 1733412085,
-        "narHash": "sha256-FillH0qdWDt/nlO6ED7h4cmN+G9uXwGjwmCnHs0QVYM=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "4dc2fc4e62dbf62b84132fe526356fbac7b03541",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-24.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1682134069,
-        "narHash": "sha256-TnI/ZXSmRxQDt2sjRYK/8j8iha4B4zP2cnQCZZ3vp7k=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "fd901ef4bf93499374c5af385b2943f5801c0833",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "type": "indirect"
-      }
-    },
     "root": {
       "inputs": {
         "home-manager": "home-manager",
         "nixpkgs": "nixpkgs",
-        "nixpkgs-stable": "nixpkgs-stable",
+        "sops-nix": "sops-nix",
         "vscode-server": "vscode-server"
       }
     },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1747603214,
+        "narHash": "sha256-lAblXm0VwifYCJ/ILPXJwlz0qNY07DDYdLD+9H+Wc8o=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "8d215e1c981be3aa37e47aeabd4e61bb069548fd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -110,7 +100,9 @@
     "vscode-server": {
       "inputs": {
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
         "lastModified": 1729422940,

flake.nix

@@ -1,83 +1,64 @@
 {
-  description = "Panoptes flake config";
+  description = "A very basic flake";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
-    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-24.11";
+    vscode-server = {
+      url = "github:nix-community/nixos-vscode-server";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    vscode-server.url = "github:nix-community/nixos-vscode-server";
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
-  outputs = {
+  outputs = { self, ... }@args:
-    self,
-    nixpkgs,
-    nixpkgs-stable,
-    home-manager,
-    ...
-  } @ inputs:
   let
-    stateVersion = "24.11";
     inherit (self) outputs;
-    nixosSystem = inputs.nixpkgs.lib.nixosSystem;
+    systemSettings = {
-    
-    userSettings = rec {
-      username = "panoptes";
-      gitUserName = "John Lancaster";
-      gitUserEmail = "32917998+jsl12@users.noreply.github.com";
-      # gitUserEmail = "asdfasdf@asdf.com";
-    };
-
-    systemSettings = rec {
       hostName = "panoptes-nix";
       system = "x86_64-linux";
       timeZone = "America/Chicago";
       locale = "en_US.UTF-8";
     };
-
+    userSettings = {
-    pkgs = inputs.nixpkgs.legacyPackages.${systemSettings.system};
+      username = "root";
-    pkgs-stable = inputs.nixpkgs-stable.legacyPackages.${systemSettings.system};
+    };
+    nixosSystem = args.nixpkgs.lib.nixosSystem;
+    pkgs = args.nixpkgs.legacyPackages.${systemSettings.system};
 
   in
   {
-    nixosConfigurations = {
+    nixosConfigurations.${systemSettings.hostName} = nixosSystem {
-      "${systemSettings.hostName}" = nixosSystem {
       system = systemSettings.system;
       specialArgs = {
-          inherit inputs;
+        inherit systemSettings userSettings;
-          inherit outputs;
-          inherit userSettings;
-          inherit systemSettings;
       };
       modules = [
-          ./configuration.nix # > Our main nixos configuration file <
+        (args.nixpkgs + "/nixos/modules/virtualisation/proxmox-lxc.nix")
-          "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"
+        args.home-manager.nixosModules.default
-          ({ ... }: {
+        args.sops-nix.nixosModules.sops
-            system.stateVersion = "${stateVersion}";
+        args.vscode-server.nixosModules.default
-            services.vscode-server.enable = true;
+        ./configuration.nix
-          })
+        ./nixosModules
-          inputs.vscode-server.nixosModules.default
+        ./scripts
-        ];
+        ({ pkgs, systemSettings, ... }: {
-      };
+          networking.hostName = systemSettings.hostName;
-    };
+          system.stateVersion = "24.11";
+          nix.settings.experimental-features = [ "nix-command" "flakes" ];
+          time.timeZone = "${systemSettings.timeZone}";
 
-    homeConfigurations = {
+          nixpkgs.config.allowUnfree = true;
-      useGlobalPkgs = true;
+          services.vscode-server.enable = true;
-      "panoptes@panoptes-nix" = home-manager.lib.homeManagerConfiguration {
+          programs.nix-ld.enable = true;
-        inherit pkgs stateVersion;
+          environment.systemPackages = with pkgs; [ git ];
-        specialArgs = {
+        })
-          inherit inputs;
-          inherit outputs;
-          inherit userSettings;
-          inherit systemSettings;
-        };
-        modules = [
-          ./home.nix
-          # ({...}: {home.stateVersion = "${stateVersion}";})
       ];
     };
   };
-  };
 }

home.nix

@@ -5,9 +5,10 @@
   ...
 }:
 let
-  homePath = "/srv/panoptes";
+  repoURL = "https://gitea.john-stream.com/john/panoptes-nix";
-  repoURL = "https://gitea.john-stream.com/john/loki-nix";
+  repoBranch = "main";
-  repoBranch = "reorg";
+  homePath = "/home/${userSettings.username}";
+  repoPath = "${homePath}/${systemSettings.hostName}";
 in
 {
   nixpkgs.config.allowUnfree = true;
@@ -18,22 +19,26 @@ in
     extraConfig.credential.helper = "store --file ~/.git-credentials";
     userName = "${userSettings.gitUserName}";
     userEmail = "${userSettings.gitUserEmail}";
-    extraConfig.safe.directory = "${homePath}";
+    extraConfig.safe.directory = "${repoPath}";
   };
 
   programs.bash.enable = true;
   programs.ssh.enable = true;
 
   home = {
+    stateVersion = "${systemSettings.stateVersion}";
+    username = "${userSettings.username}";
     homeDirectory = "${homePath}";
-    packages = [
+    packages = with pkgs; [
-      (pkgs.writeShellScriptBin "nfs" ''
+      (writeShellScriptBin "nfs" ''
-        sudo nixos-rebuild switch --flake ${homePath}#${hostName} --impure
+        sudo nixos-rebuild switch --flake ${repoPath}#${systemSettings.hostName} --impure
       '')
-      (pkgs.writeShellScriptBin "init-panoptes" ''
+      (writeShellScriptBin "nhs" ''
-        sudo -u git clone -b ${repoBranch} ${repoURL} /srv/panoptes
+        home-manager switch --flake ${repoPath}#${userSettings.username}
+      '')
+      (writeShellScriptBin "init-panoptes" ''
+        sudo -u ${userSettings.username} git clone -b ${repoBranch} ${repoURL} ${repoPath}
       '')
-      git
     ];
   };
 

nixosModules/caddy.nix

@@ -0,0 +1,27 @@
+{ config, pkgs, ... }:
+{
+  sops.secrets.cloudflare-api-key = {};
+
+  # https://nixos.wiki/wiki/Caddy
+  services.caddy = {
+    enable = true;
+    environmentFile = config.sops.secrets.cloudflare-api-key.path;
+    virtualHosts."panoptes.john-stream.com".extraConfig = ''
+      reverse_proxy 192.168.1.110:8000
+      tls {
+        dns cloudflare {env.CF_API_TOKEN}
+      }
+    '';
+    package = pkgs.caddy.withPlugins {
+      plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
+      hash = "sha256-Gsuo+ripJSgKSYOM9/yl6Kt/6BFCA6BuTDvPdteinAI=";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  # systemd.services.caddy.serviceConfig = {
+  #   # EnvironmentFile = "/etc/caddy/cloudflare.env";
+  #   AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+  # };
+}

nixosModules/cloudflared.nix

@@ -0,0 +1,38 @@
+{ config, pkgs, lib, ... }:
+# https://wiki.nixos.org/wiki/Cloudflared
+{
+  boot.kernel.sysctl."net.ipv4.ping_group_range" = "0 65535";
+  users.groups.cloudflared = {};
+  users.users.cloudflared = {
+    isSystemUser = true;
+    group = "cloudflared"; # Match allowed range
+  };
+
+  sops.secrets.cloudflared-creds = {};
+  environment.systemPackages = with pkgs; [ cloudflared ];
+  services.cloudflared = {
+    enable = true;
+    tunnels = {
+      "panoptes-nix" = {
+        credentialsFile = config.sops.secrets.cloudflared-creds.path;
+        # credentialsFile = /root/.cloudflared/c5d343b4-c12c-4490-9d92-9a2345738dc2.json;
+        default = "http_status:404";
+        ingress = {
+          "panoptes.john-stream.com" = {
+            service = "https://localhost:443";
+            # path = ".*";
+            originRequest = {
+              originServerName = "panoptes.john-stream.com";
+              noTLSVerify = true;
+            };
+          };
+        };
+      };
+    };
+  };
+  systemd.services.cloudflared-tunnel-panoptes-nix.serviceConfig = {
+    DynamicUser = lib.mkForce false;
+    User = "cloudflared";
+    Group = "cloudflared";
+  };
+}

nixosModules/default.nix

@@ -1,19 +1,9 @@
-{
+{ ... }: {
-  pkgs,
-  config,
-  lib,
-  inputs,
-  outputs,
-  ...
-}: {
   imports =
     [
+      # ./caddy.nix
+      ./cloudflared.nix
       ./services/loki.nix
+      ./users.nix
     ];
-
-  config = {
-    nix.settings.experimental-features = ["nix-command" "flakes"];
-    programs.nix-ld.enable = true;
-    nixpkgs.config.allowUnfree = true;
-  };
 }

nixosModules/home-manager/git.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  programs.git = {
+    enable = true;
+    extraConfig.credential.helper = "store --file ~/.git-credentials";
+    userName = "John Lancaster";
+    userEmail = "32917998+jsl12@users.noreply.github.com";
+  };
+}

nixosModules/services/loki.nix

@@ -1,14 +1,15 @@
 { pkgs, config, ... }:
+let
+  lokiPort = config.services.loki.configuration.server.http_listen_port;
+in
 {
-  networking.firewall.allowedTCPPorts = [
+  networking.firewall.allowedTCPPorts = [ lokiPort ];
-    config.services.loki.configuration.server.http_listen_port
-  ];
 
   environment.systemPackages = with pkgs; [
     (pkgs.writeShellScriptBin "loki-check" ''
-      curl http://localhost:${config.services.loki.configuration.server.http_listen_port}/ready
+      curl http://localhost:${builtins.toString lokiPort}/ready
     '')
-    (pkgs.writeShellScriptBin "loki-logs" "journalctl -b -u loki.service -n 10")
+    (pkgs.writeShellScriptBin "loki-watch" "journalctl -b -u loki.service -n 10 -f")
   ];
   
   services.loki = {

nixosModules/users.nix

@@ -0,0 +1,30 @@
+{ pkgs, config, userSettings, ... }:
+{
+  # Uses rust-based sudo
+  security.sudo-rs = {
+    enable = true;
+    execWheelOnly = false;
+    wheelNeedsPassword = false; # allows sudo without password for those in the wheel group
+  };
+
+  users.users.root = {
+    isSystemUser = true;
+    extraGroups = [
+      "wheel"   # needed for sudo without password
+      "docker"  # needed for docker without sudo
+    ];
+    openssh.authorizedKeys.keyFiles = [ ../secrets/authorized_keys ];
+  };
+
+  home-manager = {
+    useGlobalPkgs = true;
+    users.root = {
+      home.stateVersion = config.system.stateVersion;
+      imports = [ ./home-manager/git.nix ];
+      programs.vscode = {
+        enable = true;
+        package = pkgs.vscode.fhs;
+      };
+    };
+  };
+}

scripts/default.nix

@@ -0,0 +1,24 @@
+{ pkgs, systemSettings, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    (pkgs.writeShellScriptBin "nfs" ''
+      sudo nixos-rebuild switch --flake $(readlink -f /etc/nixos)#${systemSettings.hostName} --impure
+    '')
+    (pkgs.writeShellScriptBin "nfsu" ''
+      FLAKE=$(readlink -f /etc/nixos)
+      nix flake update --flake $FLAKE --impure
+      git -C $FLAKE add "$FLAKE/flake.lock" > /dev/null 2>&1
+      sudo nixos-rebuild switch --flake $FLAKE#${systemSettings.hostName} --impure
+    '')
+    (pkgs.writeShellScriptBin "edit-secrets" "sudo sops $(readlink -f /etc/nixos)/secrets/encrypted_secrets.yaml")
+    (pkgs.writeShellScriptBin "public-age-key" ''
+      nix run nixpkgs#ssh-to-age -- -i /etc/ssh/ssh_host_ed25519_key.pub
+    '')
+    (pkgs.writeShellScriptBin "private-age-key" ''
+      sudo mkdir -p ~/.config/sops/age
+      sudo nix run nixpkgs#ssh-to-age -- -private-key -i /etc/ssh/ssh_host_ed25519_key > ~/.config/sops/age/keys.txt
+      sudo chown -R 0:0 ~/.config
+      sudo chmod -R 600 ~/.config/sops
+    '')
+  ];
+}

secrets/authorized_keys

@@ -0,0 +1,3 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDIaHS9CLiDc6T1tja0fBwwv5qc6iwuckWN6w8MNo5yiR8LPWyrfueowNJkL4HMqu6OEuggtdybGw1Do4sW5o+toHCyWfZf3khI1l15opPXuVpD4CWED+SpJiZ0wBgRaCaWhfxLI+s4JOhjOO2OjiClPX3HfxIHyTpRiR78lOMcIieHSnzrAV2MatYKf6lL2ckOsIPwxo/OVM+1ljjX+HLq9IxGUCpWOnF4nF1rq3gKL2JUh2KsrgrzE3NB7EFuqKm8F0tF2rG3JjSvlwox0h06drKD02lpZWXPOBRlcyFDpNXymmc2bpG0S2Bbj5g+pqNBB0jO0h3kzWvYYqrtU/ElObg1cXhyi0PFOhhptlbhbK0Ao8B+pAbSZ661nMT3jpRWLVbnJrRFnXXdjX08r5eseQ3k4CFpv+g64n7yg3IMo9f8gA9P/hOexR+qu5AQ1Ad/tvkp6pPXnR/zsUnbe4p2A9MaNJm4E1zxbs5VGlXynNikXwDL+spkrnjwdfUULTk= john@JOHN-PC
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFn5ilhqaeDsOWSk7y29se2NvxGm8djlfL3RGLokj0q6 john@john-p14s
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHh9SBuxU2dOJHnpGZAE4cwe0fXcTBBAx+JmRsmIX+Tk8zooeM32vbNxxSXiZNpBGH5wzHNb534dWexGGG3sOaONmcL7SCoPIvaAdnIn5VsiznerLrzppSbx3Qn8eyF97WAGCcOcIUNmTIDDx1m6zG762WQnoaUEy0Ul5IR7ET5GQxP3p5Qwx8yqfixKDwarvV421sUIxYt9gee31jS9jcI3MFd6EL57hWle95Z8BGpR/Q7sXDBTZQWMZauh5NPwLMZS7k3bHgxXZ7WNOw/J/yts1ckBbvIFJSRNnMuWD0oGnDTL6aivGi+Eiswp0fpKzYGzquB3/wr3VU4G1JcMM5 JuiceSSH

secrets/encrypted_secrets.yaml

@@ -0,0 +1,17 @@
+cloudflare-api-key: ENC[AES256_GCM,data:ktlEznpdv7H6+w7vPe+0ylHdNR9ODZe2TMRiKs5RMEmblqMsvZTiCG5J/54cjaGwgwPHdw02pwc=,iv:H4YoS7sqxl9MBmwYb6N7pA/hGm21AyYgBQv64dSQU/o=,tag:93Ah+xReidRHuhvnuMWqdQ==,type:str]
+cloudflared-creds: ENC[AES256_GCM,data:O0gfegXK/qCZRwgf6I3PTu6wV8dcvLE8Bz4vdoNAqofY3SKVuP0O1xgP+tOZ4kI9Eow/q9EOmDR5sVUTls89515EY9PE/3PG7OmGMK1hRFH63kvXAa9ElUP0W2NU2mtz48qex8DQ12cMBX49C2gvJ9ezhPp930nB+deGb4XOzBuzvixexiEXixyTdOVzjxDULEQL+C2v+HFJP8XncoqjReNSwUg0Xv13TobQdnzHRlM=,iv:bHBu+vGvOKtIb1asfxOlRPk27/3b5vqyqPjV02Z7xk8=,tag:04ey2e4txAoQzhuqWjjmWw==,type:str]
+sops:
+    age:
+        - recipient: age102mctuw7xvs3fakft0mlfh740kc6rdaqqgmmwf400c4g3spefyjqrfmwct
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJSjV4NFo4eFRKck05NWpZ
+            ZmU4QlA2T3lKVzd0M1VhaHRhWXJXQ2U5OHpNCnVPaGtIYVF3MzJjek1iYUFGOFdz
+            bisrRTlOMFYxczI5VUhSWjk5c3MyUVUKLS0tIGpSOStsRTlQaUxkWlpZUUJEMVpK
+            ZnExa3NseGRrdXcrNTN4YkVSa2d6SDAKlzXHOUKAjNxY/okZJQurTpeaZUjjnyp/
+            OrvFMTxuMfK+EIIgj6WTm23ZKV4vmk0q0yboS4eXgDZTEB79tKxgyA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-05-27T06:37:54Z"
+    mac: ENC[AES256_GCM,data:RWtEhFz2rVae8RZImbcMCwRjv1Zmn0CAKa3O+RU4dEujLxLbu8NGyqJUi5iCloubetTzdAIvYd43Z0bxLQSPyZzCrRAwe6M7t0MMAwpbJnM8oPWzdciotCz4JRiegKTfpYMWx6s+Ixa+b7Dohj76zpToU3c39+llbN1/suGPIUw=,iv:+6cAZt6Nf514YK5yFTVmjL+XE85+bSb7phjFcKe+4j8=,tag:KAYnzouBVLSUI9ScX9tnog==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2