NixOS/modules/servers.nix

{ lib, config, pkgs, ... }:
let
  serviceBase = {
    enable = true;
    group = "piracy";
  };
  proxy = locations: {
    inherit locations;
    forceSSL = true;
    enableACME = true;
    http2 = true;
  };
  proxyReverse = port:
    proxy {
      "/".proxyPass = "http://${config.my.localhost}:${toString port}/";
    };
  proxyReverseArr = port:
    proxyReverse port // {
      extraConfig = ''
        proxy_set_header   Host $host;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Host $host;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection $http_connection;
        proxy_redirect     off;
        proxy_http_version 1.1;
      '';
    };
  enableDocker = lib.any (opt: opt) [
    config.my.servers.collabora.enable
    config.my.servers.ryot.enable
    config.my.servers.lidarr.enable
    config.my.servers.prowlarr.enable
    config.my.servers.maloja.enable
    config.my.servers.multi-scrobbler.enable
    config.my.servers.flame.enable
    config.my.servers.metube.enable
    config.my.servers.go-vod.enable
  ];
in {
  imports = [
    ./servers/adguardhome.nix
    ./servers/paperless.nix
    ./servers/postgres.nix
    (import ./servers/audiobookshelf.nix { inherit lib config proxy; })
    (import ./servers/bazarr.nix {
      inherit lib config serviceBase proxyReverse;
    })
    (import ./servers/flame.nix { inherit lib config proxyReverse; })
    (import ./servers/jellyfin.nix { inherit lib config pkgs serviceBase; })
    (import ./servers/kavita.nix { inherit lib config pkgs proxyReverse; })
    (import ./servers/lidarr.nix { inherit lib config proxyReverseArr; })
    (import ./servers/maloja.nix { inherit lib config proxyReverse; })
    (import ./servers/mealie.nix { inherit lib config proxyReverse; })
    (import ./servers/metube.nix { inherit lib config proxyReverse; })
    (import ./servers/microbin.nix { inherit lib config proxyReverse; })
    (import ./servers/multi-scrobbler.nix { inherit lib config proxyReverse; })
    (import ./servers/nextcloud.nix { inherit lib config pkgs serviceBase; })
    (import ./servers/prowlarr.nix { inherit lib config proxyReverseArr; })
    (import ./servers/qbittorrent.nix { inherit lib config pkgs proxyReverse; })
    (import ./servers/radarr.nix {
      inherit lib config serviceBase proxyReverseArr;
    })
    (import ./servers/ryot.nix { inherit lib config proxyReverse; })
    (import ./servers/shiori.nix { inherit lib config pkgs proxyReverse; })
    (import ./servers/sonarr.nix {
      inherit lib config serviceBase proxyReverse;
    })
    (import ./servers/vaultwarden.nix { inherit lib config pkgs proxyReverse; })
    (import ./servers/firefly-iii.nix { inherit lib config pkgs proxyReverse; })
  ];
  options.my = {
    localhost = lib.mkOption {
      type = lib.types.str;
      default = "127.0.0.1";
      description = "The localhost address.";
    };
    domain = lib.mkOption {
      type = lib.types.str;
      default = "servidos.lat";
      description = "The domain name.";
    };
    miniserver-ip = lib.mkOption {
      type = lib.types.str;
      default = "192.168.1.100";
      description = "The miniserver ip.";
    };
    postgresSocket = lib.mkOption {
      type = lib.types.str;
      default = "/run/postgresql";
      description = "The PostgreSQL socket path.";
    };
    containerSocket = lib.mkOption {
      type = lib.types.str;
      default = "/var/run/docker.sock";
      description = "The docker/podman socket path.";
    };
    containerData = lib.mkOption {
      type = lib.types.str;
      default = "/var/lib/docker-configs";
      description = "The docker/podman socket path.";
    };
    smtpemail = lib.mkOption {
      type = lib.types.str;
      default = "stunner6399@gmail.com";
      description = "localhost smtp email";
    };
    email = lib.mkOption {
      type = lib.types.str;
      default = "CaptainJawZ@protonmail.com";
      description = "localhost smtp email";
    };
  };
  config = {
    my.servers = {
      jellyfin = {
        enable = lib.mkDefault false;
        enableCron = lib.mkDefault false;
      };
      nextcloud = {
        enable = lib.mkDefault false;
        enableCron = lib.mkDefault false;
      };
      adguardhome.enable = lib.mkDefault false;
      audiobookshelf.enable = lib.mkDefault false;
      bazarr.enable = lib.mkDefault false;
      collabora.enable = lib.mkDefault false;
      flame.enable = lib.mkDefault false;
      flameSecret.enable = lib.mkDefault false;
      go-vod.enable = lib.mkDefault false;
      kavita.enable = lib.mkDefault false;
      lidarr.enable = lib.mkDefault false;
      maloja.enable = lib.mkDefault false;
      mealie.enable = lib.mkDefault false;
      metube.enable = lib.mkDefault false;
      microbin.enable = lib.mkDefault false;
      multi-scrobbler.enable = lib.mkDefault false;
      paperless.enable = lib.mkDefault false;
      postgres.enable = lib.mkDefault false;
      prowlarr.enable = lib.mkDefault false;
      qbittorrent.enable = lib.mkDefault false;
      radarr.enable = lib.mkDefault false;
      ryot.enable = lib.mkDefault false;
      shiori.enable = lib.mkDefault false;
      sonarr.enable = lib.mkDefault false;
      vaultwarden.enable = lib.mkDefault false;
      firefly-iii.enable = lib.mkDefault false;
    };
    virtualisation = {
      containers.enable = true;
      oci-containers.backend = "podman";
      podman = lib.mkIf enableDocker {
        enable = true;
        dockerCompat = true;
        dockerSocket.enable = true;
        defaultNetwork.settings.dns_enabled = true;
        autoPrune = {
          enable = true;
          flags = [ "--all" ];
          dates = "weekly";
        };
      };
    };
    security.acme = lib.mkIf config.services.nginx.enable {
      acceptTerms = true;
      defaults.email = config.my.email;
    };
    services.nginx = {
      clientMaxBodySize = "4096m";
      sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
    };
    networking.firewall = let ports = [ 80 443 ];
    in {
      enable = true;
      allowedTCPPorts = ports;
      allowedUDPPorts = ports;
    };
  };
}