NixOS/server/servers.nix

{ config, lib, pkgs, modulesPath, ... }:
let
  localhost = "127.0.0.1";
  postgresSocket = "/run/postgresql";
  unstable = import
    (builtins.fetchTarball "https://github.com/nixos/nixpkgs/tarball/master") {
      config = config.nixpkgs.config;
    };
in {

  imports = [ ./nginx.nix ];
  nixpkgs.config = {
    permittedInsecurePackages = [ "nodejs-14.21.3" "openssl-1.1.1v" ];
  };
  environment.systemPackages = with pkgs;
    [
      # Upgrades postgres
      (let
        # XXX specify the postgresql package you'd like to upgrade to.
        # Do not forget to list the extensions you need.
        newPostgres = pkgs.postgresql_16.withPackages (pp:
          [
            # pp.plv8
          ]);
      in pkgs.writeScriptBin "upgrade-pg-cluster" ''
        set -eux
        # XXX it's perhaps advisable to stop all services that depend on postgresql
        systemctl stop postgresql

        export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"

        export NEWBIN="${newPostgres}/bin"

        export OLDDATA="${config.services.postgresql.dataDir}"
        export OLDBIN="${config.services.postgresql.package}/bin"

        install -d -m 0700 -o postgres -g postgres "$NEWDATA"
        cd "$NEWDATA"
        sudo -u postgres $NEWBIN/initdb -D "$NEWDATA"

        sudo -u postgres $NEWBIN/pg_upgrade \
          --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
          --old-bindir $OLDBIN --new-bindir $NEWBIN \
          "$@"
      '')
    ];
  users.groups = { piracy.gid = 985; };
  # users.users = let base = { isSystemUser = true; };
  # in {
  #   # prowlarr = base // { group = "piracy"; };
  #   # kavita = base // {
  #   #   group = "kavita";
  #   #   extraGroups = [ "piracy" ];
  #   # };
  #   # nextcloud = base // {
  #   #   extraGroups = [ "render" ];
  #   #   packages = (with pkgs; [
  #   #     nodejs
  #   #     (python3.withPackages (ps: with ps; [ tensorflow ]))
  #   #     perl
  #   #     (perlPackages.buildPerlPackage rec {
  #   #       pname = "Image-ExifTool";
  #   #       version = "12.70";
  #   #       src = fetchurl {
  #   #         url = "https://exiftool.org/Image-ExifTool-${version}.tar.gz";
  #   #         hash = "sha256-TLJSJEXMPj870TkExq6uraX8Wl4kmNerrSlX3LQsr/4=";
  #   #       };
  #   #     })
  #   #   ]);
  #   # };
  # };
  services = let
    base = {
      enable = true;
      group = "piracy";
    };
  in {
    # sonarr = base // { package = pkgs.sonarr; };
    # radarr = base // { package = pkgs.radarr; };
    # bazarr = base // { };
    # jellyfin = base // { };
    # prowlarr.enable = true;
    microbin = {
      enable = true;
      settings = {
        MICROBIN_HIDE_LOGO = false;
        MICROBIN_PORT = 8080;
        MICROBIN_HIGHLIGHTSYNTAX = true;
        MICROBIN_PRIVATE = true;
        MICROBIN_QR = true;
        MICROBIN_ENCRYPTION_CLIENT_SIDE = true;
        MICROBIN_ENCRYPTION_SERVER_SIDE = true;
      };
    };
    audiobookshelf = {
      enable = true;
      group = "piracy";
      port = 5687;
    };
    paperless = {
      enable = true;
      address = "0.0.0.0";
      consumptionDirIsPublic = true;
      consumptionDir = "/home/jawz/Backups/Scans";
      extraConfig = {
        PAPERLESS_DBENGINE = "postgress";
        PAPERLESS_DBNAME = "paperless";
        PAPERLESS_DBHOST = postgresSocket;
        PAPERLESS_CONSUMER_IGNORE_PATTERN =
          builtins.toJSON [ ".DS_STORE/*" "desktop.ini" ];
        PAPERLESS_TIME_ZONE = "America/Mexico_City";
        PAPERLESS_OCR_USER_ARGS = builtins.toJSON {
          optimize = 1;
          pdfa_image_compression = "lossless";
        };
      };
    };
    vaultwarden = {
      enable = true;
      dbBackend = "postgresql";
      package = pkgs.vaultwarden;
      config = {
        ROCKET_ADDRESS = "${localhost}";
        ROCKET_PORT = 8222;
        WEBSOCKET_PORT = 8333;
        ADMIN_TOKEN =
          "x9BLqz2QmnU5RmrMLt2kPpoPBTNPZxNFw/b8XrPgpQML2/01+MYENl87dmhDX+Jm";
        DATABASE_URL = "postgresql:///vaultwarden?host=${postgresSocket}";
        ENABLE_DB_WAL = false;
        WEBSOCKET_ENABLED = true;
        SHOW_PASSWORD_HINT = false;
        SIGNUPS_ALLOWED = false;
        EXTENDED_LOGGING = true;
        LOG_LEVEL = "warn";
      };
    };
    # kavita = {
    #   enable = true;
    #   tokenKeyFile = "${pkgs.writeText "kavitaToken"
    #     "Au002BRkRxBjlQrmWSuXWTGUcpXZjzMo2nJ0Z4g4OZ1S4c2zp6oaesGUXzKp2mhvOwjju002BNoURG3CRIE2qnGybvOgAlDxAZCPBzSNRcx6RJ1lFRgvI8wQR6Nd5ivYX0RMo4S8yOH8XIDhzN6vNo31rCjyv2IycX0JqiJPIovfbvXn9Y="}";
    # };
    # nextcloud = {
    #   enable = true;
    #   https = true;
    #   package = pkgs.nextcloud27;
    #   appstoreEnable = true;
    #   configureRedis = true;
    #   extraAppsEnable = true;
    #   enableImagemagick = true;
    #   maxUploadSize = "16G";
    #   hostName = "cloud.servidos.lat";
    #   config = {
    #     adminpassFile = "${pkgs.writeText "adminpass"
    #       "Overlying-Hatchback-Charting-Encounter-Deface-Gallantly7"}";
    #     overwriteProtocol = "https";
    #     defaultPhoneRegion = "MX";
    #     dbtype = "pgsql";
    #     dbhost = postgresSocket;
    #     dbtableprefix = "oc_";
    #     dbname = "nextcloud";
    #     trustedProxies = [ "nginx" ];
    #     extraTrustedDomains = [ "cloud.rotehaare.art" "danilo-reyes.com" ];
    #   };
    #   phpOptions = {
    #     catch_workers_output = "yes";
    #     display_errors = "stderr";
    #     error_reporting = "E_ALL & ~E_DEPRECATED & ~E_STRICT";
    #     expose_php = "Off";
    #     "opcache.enable_cli" = "1";
    #     "opcache.fast_shutdown" = "1";
    #     "opcache.interned_strings_buffer" = "16";
    #     "opcache.jit" = "1255";
    #     "opcache.jit_buffer_size" = "256M";
    #     "opcache.max_accelerated_files" = "10000";
    #     "opcache.huge_code_pages" = "1";
    #     "opcache.enable_file_override" = "1";
    #     "opcache.memory_consumption" = "128";
    #     "opcache.revalidate_freq" = "60";
    #     "opcache.save_comments" = "1";
    #     "opcache.validate_timestamps" = "0";
    #     "openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
    #     short_open_tag = "Off";
    #   };
    #   extraOptions = {
    #     "allow_local_remote_servers" = true;
    #     mail_smtpmode = "sendmail";
    #     mail_sendmailmode = "pipe";
    #     "installed" = true;
    #     "memories.exiftool" = "/etc/profiles/per-user/nextcloud/bin/exiftool";
    #     enabledPreviewProviders = [
    #       "OC\\Preview\\Image"
    #       "OC\\Preview\\HEIC"
    #       "OC\\Preview\\TIFF"
    #       "OC\\Preview\\MKV"
    #       "OC\\Preview\\MP4"
    #       "OC\\Preview\\AVI"
    #       "OC\\Preview\\Movie"
    #     ];
    #   };
    #   phpExtraExtensions = all: [ all.pdlib all.bz2 ];
    # };
    postgresql = {
      enable = true;
      ensureDatabases = [ "jawz" "paperless" "nextcloud" "ryot" "vaultwarden" ];
      package = pkgs.postgresql_16;
      ensureUsers = [
        {
          name = "jawz";
          ensureDBOwnership = true;
        }
        {
          name = "nextcloud";
          ensureDBOwnership = true;
        }
        {
          name = "paperless";
          ensureDBOwnership = true;
        }
        {
          name = "ryot";
          ensureDBOwnership = true;
        }
        {
          name = "vaultwarden";
          ensureDBOwnership = true;
        }
      ];
      authentication = pkgs.lib.mkOverride 10 ''
        local all all              trust
        host  all all ${localhost}/32 trust
        host  all all ::1/128      trust
      '';
    };
  };
  systemd = {
    services = {
      nextcloud-cronjob = let
        jawzNextcloudCronjob = pkgs.writeScriptBin "nextcloud-cronjob"
          (builtins.readFile ../scripts/nextcloud-cronjob.sh);
      in {
        description = "Runs various nextcloud-related cronjobs";
        wantedBy = [ "multi-user.target" ];
        path = [ pkgs.bash jawzNextcloudCronjob ];
        serviceConfig = {
          Restart = "on-failure";
          RestartSec = 30;
          ExecStart = "${jawzNextcloudCronjob}/bin/nextcloud-cronjob";
        };
      };
    };
    timers = {
      # nextcloud-cronjob = {
      #   enable = true;
      #   description = "Runs various nextcloud-related cronjobs";
      #   wantedBy = [ "timers.target" ];
      #   timerConfig = { OnCalendar = "*:0/10"; };
      # };
    };
    user.services = {
      update-dns = let
        jawzUpdateDns = pkgs.writeScriptBin "update-dns"
          (builtins.readFile ../scripts/update-dns.sh);
      in {
        restartIfChanged = true;
        description = "update DNS of my websites";
        wantedBy = [ "default.target" ];
        path = [ pkgs.bash pkgs.nix jawzUpdateDns ];
        serviceConfig = {
          Restart = "on-failure";
          RestartSec = 30;
          ExecStart = "${jawzUpdateDns}/bin/update-dns";
        };
      };
    };
    user.timers = {
      update-dns = {
        enable = true;
        description = "update DNS of my websites";
        wantedBy = [ "timers.target" ];
        timerConfig = {
          OnBootSec = "1min";
          OnUnitActiveSec = "30m";
        };
      };
    };
  };

  networking = {
    firewall = let open_firewall_ports = [ config.services.paperless.port ];
    in {
      enable = true;
      allowedTCPPorts = open_firewall_ports;
      allowedUDPPorts = open_firewall_ports;
    };
  };
}