homelab/vm-homelab.nix

{ pkgs, ... }:

let
  minidump = pkgs.writeScript "minidump" "exec /run/wrappers/bin/sudo -u postgres /run/current-system/sw/bin/pg_dump miniflux";
in
{
  imports = [
    ./vm-base.nix
  ];

  config = {
    my.vm = {
      name = "lab01";
      ip4 = "192.168.0.5";
    };

    environment.systemPackages = with pkgs; [
      curl
    ];

    networking.firewall.allowedTCPPorts = [
      80
      443
    ];

    services.caddy = {
      enable = true;
      virtualHosts = {
        "feed.rperce.net".extraConfig = ''
          reverse_proxy http://192.168.0.5:8080
        '';
        "barkeep.dukeceph.xyz".extraConfig = ''
          reverse_proxy http://192.168.0.2:8000
        '';
        "barkeep.rperce.net".extraConfig = ''
          reverse_proxy http://192.168.0.2:8000
        '';
        "minecraft.dukeceph.xyz".extraConfig = ''
          reverse_proxy http://192.168.0.4:8080
        '';
        "immich.rperce.net".extraConfig = ''
          reverse_proxy http://192.168.0.2:2283
        '';
        "metrics.rperce.net".extraConfig = ''
          reverse_proxy http://192.168.0.6:3000
        '';
        "metrics.dukeceph.xyz".extraConfig = ''
          reverse_proxy http://192.168.0.6:3000
        '';
        "uptime.rperce.net".extraConfig = ''
          reverse_proxy 192.168.0.6:3001
        '';
        "jellyfin.rperce.net".extraConfig = ''
          reverse_proxy http://192.168.0.2:8096
        '';
        "forge.rperce.net".extraConfig = ''
          reverse_proxy http://192.168.0.5:3333
        '';
        "unifi.rperce.net".extraConfig = ''
          reverse_proxy 192.168.0.100:8443 {
            transport http {
              tls_insecure_skip_verify
            }
            header_up - Authorization
          }
        '';
      };
    };

    services.miniflux = {
      enable = true;
      adminCredentialsFile = "/mnt/nfs/miniflux/admin-credentials";
      config = {
        LISTEN_ADDR = "0.0.0.0:8080";
      };
    };

    services.forgejo = {
      enable = true;
      database.type = "postgres";
      lfs.enable = true;
      settings = {
        server = {
          DOMAIN = "forge.rperce.net";
          ROOT_URL = "https://forge.rperce.net/";
          HTTP_PORT = 3333;
        };
        service.DISABLE_REGISTRATION = true;
        actions = {
          ENABLED = true;
          DEFAULT_ACTIONS_URL = "github";
        };
        mailer.ENABLED = false;
      };
    };

    services.borgbackup.jobs.miniflux = {
      dumpCommand = minidump;
      archiveBaseName = null;
      encryption.mode = "none";
      environment.BORG_RSH = "ssh -i /etc/ssh/ssh_host_ed25519_key";
      repo = "ssh://backup@xalicas/./miniflux";
      compression = "auto,zstd";
      startAt = "daily";
      postHook = ''
        echo "exit $exitStatus"
        if [ $exitStatus -eq 0 ]; then
          /run/current-system/sw/bin/curl -sSL http://192.168.0.6:3001/api/push/yTBTVZF8Bz?status=up&msg=OK&ping=
        fi
      '';
    };
  };
}