ci_config.nix
Rama main · réplica de lectura del repositorio original.
# Full configuration of every stack to catch potential errors in CI pipeline
# Secrets etc. will be not read from file / available in Nix store. Don't do this at home :)
{
config,
lib,
pkgs,
...
}: let
inherit
(import ./tests/dummy-values.nix pkgs)
dummyClientSecretHash
dummyEmail
dummyId
dummySecret
dummySecretFile
dummyUser
;
in {
config.nps = rec {
hostIP4Address = "192.168.178.2";
hostUid = 1000;
storageBaseDir = "${config.home.homeDirectory}/stacks";
externalStorageBaseDir = "/mnt/hdd";
defaultTz = "Europe/Berlin";
stacks = {
adguard.enable = true;
adventurelog = {
enable = true;
secretKeyFile = dummySecretFile;
db.passwordFile = dummySecretFile;
adminProvisioning = {
username = "admin";
email = "admin@example.com";
passwordFile = dummySecretFile;
};
oidc = {
registerClient = true;
clientSecretHash = dummyClientSecretHash;
};
};
anchor = {
enable = true;
oidc.enable = true;
db = {
type = "postgres";
passwordFile = dummySecretFile;
};
};
aiostreams = {
enable = true;
secretKeyFile = dummySecretFile;
extraEnv = {
TMDB_ACCESS_TOKEN.fromFile = dummySecretFile;
};
};
audiobookshelf = {
oidc = {
registerClient = true;
clientSecretHash = dummyClientSecretHash;
};
};
authelia = {
enable = true;
jwtSecretFile = dummySecretFile;
sessionSecretFile = dummySecretFile;
storageEncryptionKeyFile = dummySecretFile;
oidc = {
enable = true;
hmacSecretFile = dummySecretFile;
jwksRsaKeyFile = dummySecretFile;
clients.dummy = {
public = true;
authorization_policy = "two_factor";
redirect_uris = [];
};
};
settings.access_control.rules = [
{
domain = "private.example.com";
subject = [
"group:guest"
];
policy = "deny";
}
];
};
baikal.enable = true;
bambuddy = {
enable = true;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
orcaSlicer.enable = true;
bambuStudio.enable = true;
virtualPrinter.enable = true;
};
bentopdf.enable = true;
beszel = {
enable = true;
ed25519PrivateKeyFile = dummySecretFile;
ed25519PublicKeyFile = dummySecretFile;
tokenFile = dummySecretFile;
adminProvisioning = {
email = "admin@admin.com";
passwordFile = dummySecretFile;
};
oidc = {
registerClient = true;
clientSecretHash = dummyClientSecretHash;
};
};
blocky = {
enable = true;
enableGrafanaDashboard = true;
enablePrometheusExport = true;
containers.blocky = {
dashboard.url = "${config.nps.containers.grafana.traefik.serviceUrl}/d/blocky";
gatus = {
enable = true;
settings = {
url = "host.containers.internal";
dns = {
query-name = config.nps.stacks.traefik.domain;
query-type = "A";
};
conditions = [
"[DNS_RCODE] == NOERROR"
];
};
};
};
};
bookorbit = {
enable = true;
jwtSecretFile = dummySecretFile;
podcastEncryptionKeyFile = dummySecretFile;
setupBootstrapTokenFile = dummySecretFile;
db.passwordFile = dummySecretFile;
oidc = {
registerClient = true;
clientSecretHash = dummyClientSecretHash;
};
tts.enable = true;
};
bytestash = {
enable = true;
jwtSecretFile = dummySecretFile;
};
calibre.enable = true;
changedetection.enable = true;
crowdsec = {
enable = true;
extraEnv = {
ENROLL_INSTANCE_NAME = "dummy";
ENROLL_KEY.fromFile = dummySecretFile;
};
};
davis = {
adminPasswordFile = dummySecretFile;
enableLdapAuth = true;
db = {
type = "mysql";
userPasswordFile = dummySecretFile;
rootPasswordFile = dummySecretFile;
};
};
dawarich = {
enable = true;
secretKeyFile = dummySecretFile;
db.passwordFile = dummySecretFile;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
};
};
ddns-updater = {
enable = true;
settings = [
{
provider = "duckdns";
domain = "example.duckdns.org";
token = "{{ file.Read `${dummySecretFile}`}}";
ip_version = "ipv4";
}
];
};
dockdns = {
enable = true;
extraEnv.EXAMPLE_COM_API_TOKEN.fromFile = dummySecretFile;
settings.dns.purgeUnknown = true;
settings.domains = let
domain = config.nps.stacks.traefik.domain;
in [
{
name = domain;
a = hostIP4Address;
}
{
name = "*.${domain}";
a = hostIP4Address;
}
];
};
donetick = {
jwtSecretFile = dummySecretFile;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
settings.is_user_creation_disabled = true;
};
dozzle = {
enable = true;
containers.dozzle.forwardAuth = {
enable = true;
rules = [
{
policy = "one_factor";
}
];
};
};
dynacat = {
enable = true;
secretKeyFile = dummySecretFile;
settings.pages.home.columns.start = {
rank = 500;
size = "small";
widgets = [
{
type = "server-stats";
servers = [
{
type = "local";
name = "Server";
}
];
}
{
type = "reddit";
subreddit = "selfhosted";
collapse-after = 3;
}
];
};
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
};
excalidash = {
enable = true;
jwtSecretFile = dummySecretFile;
csrfSecretFile = dummySecretFile;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
};
filebrowser-quantum = {
enable = true;
mounts = {
${config.nps.externalStorageBaseDir} = {
path = "/hdd";
name = "hdd";
config = {
denyByDefault = true;
disableIndexing = false;
};
};
};
oidc = {
enable = true;
clientSecretHash = dummyClientSecretHash;
clientSecretFile = dummySecretFile;
};
settings.auth.methods.password.enabled = false;
};
flaresolverr.enable = true;
fredy.enable = true;
forgejo = {
enable = true;
lfsJwtSecretFile = dummySecretFile;
secretKeyFile = dummySecretFile;
internalTokenFile = dummySecretFile;
jwtSecretFile = dummySecretFile;
adminProvisioning = {
username = "forgejo";
email = "admin@test.com";
passwordFile = dummySecretFile;
};
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
};
db = {
type = "postgres";
passwordFile = dummySecretFile;
};
};
freshrss = {
enable = true;
adminProvisioning = {
enable = true;
username = dummyUser;
email = dummyEmail;
passwordFile = dummySecretFile;
apiPasswordFile = dummySecretFile;
};
};
frigate = {
enable = true;
containers.frigate.devices = lib.mkForce [];
};
gatus = {
enable = true;
db = {
type = "postgres";
passwordFile = dummySecretFile;
};
settings.endpoints = [
{
name = "Some website";
url = "https://example.com";
client.dns-resolver = "tcp://1.1.1.1:53";
conditions = [
"[STATUS] == 200"
];
}
];
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
};
glance = {
enable = true;
settings.pages.home = {
columns.start = {
rank = 500;
size = "small";
widgets = [
{
type = "server-stats";
servers = [
{
type = "local";
name = "Server";
}
];
}
{
type = "reddit";
subreddit = "selfhosted";
collapse-after = 3;
}
];
};
columns.end = {
rank = 1500;
size = "small";
widgets = [
{
type = "clock";
time-format = "24h";
date-format = "d MMMM yyyy";
show-seconds = true;
show-timezone = true;
timezone = config.nps.defaultTz;
}
{
type = "calendar";
first-day-of-week = "monday";
}
];
};
};
};
grimmory = {
enable = true;
oidc = {
registerClient = true;
};
db = {
userPasswordFile = dummySecretFile;
rootPasswordFile = dummySecretFile;
};
};
guacamole = {
enable = true;
userMappingXml = ''
<user-mapping>
<authorize username="${dummyUser}" password="${dummySecret}">
<connection name="SSH">
<protocol>ssh</protocol>
<param name="hostname">host.containers.internal</param>
<param name="port">22</param>
</connection>
<connection name="RDP">
<protocol>rdp</protocol>
<param name="hostname">103.5.133.3</param>
<param name="port">22</param>
</connection>
</authorize>
</user-mapping>
'';
};
healthchecks = {
enable = true;
secretKeyFile = dummySecretFile;
superUserEmail = dummyEmail;
superUserPasswordFile = dummySecretFile;
};
homeassistant.enable = true;
homelable = {
enable = true;
secretKeyFile = dummySecretFile;
mcp = {
enable = true;
apiKeyFile = dummySecretFile;
serviceKeyFile = dummySecretFile;
};
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
};
homebox = {
enable = true;
apiKeyPepperFile = dummySecretFile;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
db = {
type = "postgres";
passwordFile = dummySecretFile;
};
};
homepage = {
enable = true;
widgets = [
{
openweathermap = {
units = "metric";
cache = 5;
apiKey.path = dummySecretFile;
};
}
];
};
hortusfox = {
enable = true;
db = {
userPasswordFile = dummySecretFile;
rootPasswordFile = dummySecretFile;
};
containers.hortusfox.forwardAuth.enable = true;
adminEmail = dummyEmail;
extraEnv = {
PROXY_ENABLE = true;
PROXY_HEADER_EMAIL = "Remote-Email";
PROXY_HEADER_USERNAME = "Remote-User";
PROXY_AUTO_SIGNUP = true;
PROXY_WHITELIST = config.nps.stacks.traefik.ip4;
PROXY_HIDE_LOGOUT = true;
};
};
immich = {
enable = true;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
db.passwordFile = dummySecretFile;
};
it-tools = {
enable = true;
containers.it-tools.sablier = {
enable = true;
group = "devtools";
idleReplicas = "1";
middleware = {
sessionDuration = "10m";
failOpen = true;
ignoreUserAgent = ["curl"];
# `displayName` is intentionally unset, `jotty` sets it and the strategy default has
# to survive for containers that do not.
dynamic.theme = "matrix";
};
};
};
jotty = {
enable = true;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
# Second container of the "devtools" Sablier group, to exercise merging.
containers.jotty.sablier = {
enable = true;
group = "devtools";
middleware = {
sessionDuration = "20m";
ignoreUserAgent = ["(?i)uptimerobot" "curl"];
dynamic.displayName = "Jotty";
};
};
};
karakeep = {
enable = true;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
nextauthSecretFile = dummySecretFile;
meiliMasterKeyFile = dummySecretFile;
};
kimai = {
enable = true;
adminEmail = dummyEmail;
adminPasswordFile = dummySecretFile;
db = {
userPasswordFile = dummySecretFile;
rootPasswordFile = dummySecretFile;
};
};
kitchenowl = {
enable = true;
jwtSecretFile = dummySecretFile;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
};
komga = {
enable = true;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
};
lldap = {
enable = true;
baseDn = "DC=example,DC=com";
jwtSecretFile = dummySecretFile;
keySeedFile = dummySecretFile;
adminPasswordFile = dummySecretFile;
bootstrap = {
cleanUp = true;
users = {
test = {
email = dummyEmail;
password_file = dummySecretFile;
};
};
};
};
mazanoke.enable = true;
mealie = {
enable = true;
oidc = {
enable = true;
clientSecretHash = dummyClientSecretHash;
clientSecretFile = dummySecretFile;
};
};
memos = {
enable = true;
oidc = {
registerClient = true;
clientSecretHash = dummyClientSecretHash;
};
db = {
type = "postgres";
passwordFile = dummySecretFile;
};
};
microbin = {
enable = true;
extraEnv = {
MICROBIN_ADMIN_USERNAME = dummyUser;
MICROBIN_ADMIN_PASSWORD.fromFile = dummySecretFile;
MICROBIN_UPLOADER_PASSWORD.fromFile = dummySecretFile;
};
};
monitoring = {
enable = true;
prometheus.rules.groups = let
cpuThresh = 90;
in [
{
name = "resource.usage";
rules = [
{
alert = "HighCpuUsage";
expr = ''100 - (avg by(instance)(rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > ${toString cpuThresh}'';
for = "20m";
labels = {
severity = "warning";
};
annotations = {
summary = "High CPU usage";
description = "CPU usage is above ${toString cpuThresh}% (current value: {{ $value }}%)";
};
}
];
}
];
alertmanager = {
enable = true;
ntfy = {
enable = true;
settings.ntfy.notification.topic = "monitoring";
};
};
};
netbird-client = {
enable = true;
setupKeyFile = dummySecretFile;
};
netbird-management = {
enable = true;
authSecretFile = dummySecretFile;
storeEncryptionKeyFile = dummySecretFile;
adminProvisioning = {
email = dummyEmail;
passwordFile = dummySecretFile;
};
oidc = {
clientSecretFile = dummySecretFile;
};
};
n8n.enable = true;
navidrome.enable = true;
networking-toolbox.enable = true;
norish = {
enable = true;
masterKeyFile = dummySecretFile;
db.passwordFile = dummySecretFile;
cdpTokenFile = dummySecretFile;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
};
ntfy = {
enable = true;
extraEnv = {
NTFY_WEB_PUSH_EMAIL_ADDRESS = dummyEmail;
NTFY_WEB_PUSH_PUBLIC_KEY.fromFile = dummySecretFile;
NTFY_WEB_PUSH_PRIVATE_KEY.fromFile = dummySecretFile;
};
enableGrafanaDashboard = true;
enablePrometheusExport = true;
};
omnigent = {
enable = true;
db = {
type = "postgres";
passwordFile = dummySecretFile;
};
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
cookieSecretFile = dummySecretFile;
};
};
omnitools.enable = true;
outline = {
enable = true;
secretKeyFile = dummySecretFile;
utilsSecretFile = dummySecretFile;
db.passwordFile = dummySecretFile;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
};
pangolin-newt = {
enable = true;
enableGrafanaDashboard = true;
enablePrometheusExport = true;
extraEnv = {
PANGOLIN_ENDPOINT.fromFile = dummySecretFile;
NEWT_ID.fromFile = dummySecretFile;
NEWT_SECRET.fromFile = dummySecretFile;
NEWT_METRICS_PROMETHEUS_ENABLED = "true";
NEWT_ADMIN_ADDR = ":2112";
LOG_LEVEL = "INFO";
};
};
paperless = {
enable = true;
adminProvisioning = {
username = dummyUser;
email = dummyEmail;
passwordFile = dummySecretFile;
};
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
secretKeyFile = dummySecretFile;
extraEnv = {
PAPERLESS_OCR_LANGUAGES = "eng deu";
PAPERLESS_OCR_LANGUAGE = "eng+deu";
};
db = {
passwordFile = dummySecretFile;
};
ftp = {
enable = true;
passwordFile = dummySecretFile;
};
};
pinepods = {
enable = true;
db.passwordFile = dummySecretFile;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
};
adminProvisioning = {
enable = true;
email = "admin@example.com";
passwordFile = dummySecretFile;
};
};
prowlarr = {
enable = true;
db = {
type = "postgres";
passwordFile = dummySecretFile;
};
extraEnv."PROWLARR__AUTH__APIKEY".fromFile = dummySecretFile;
};
qbittorrent = {
enable = true;
gluetun = {
vpnProvider = "airvpn";
wireguardPrivateKeyFile = dummySecretFile;
wireguardPresharedKeyFile = dummySecretFile;
wireguardAddressesFile = dummySecretFile;
extraEnv = {
FIREWALL_VPN_INPUT_PORTS.fromFile = dummySecretFile;
SERVER_NAMES.fromFile = dummySecretFile;
HTTP_CONTROL_SERVER_LOG = "off";
};
};
extraEnv.TORRENTING_PORT.fromFile = dummySecretFile;
qui = {
enable = true;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
};
};
romm = {
enable = true;
authSecretKeyFile = dummySecretFile;
romLibraryPath = "${config.nps.externalStorageBaseDir}/romm/library";
extraEnv = {
IGDB_CLIENT_ID.fromFile = dummySecretFile;
IGDB_CLIENT_SECRET.fromFile = dummySecretFile;
};
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
db = {
userPasswordFile = dummySecretFile;
rootPasswordFile = dummySecretFile;
};
};
sabnzbd = {
enable = true;
configIni = ''
[misc]
host_whitelist_entry = sabnzbd.example.com
'';
};
sablier = {
enable = true;
settings = {
sessions.default-duration = "10m";
};
};
searxng = {
enable = true;
secretKeyFile = dummySecretFile;
settings.engines = [
{
name = "dummy.online";
engine = "dummy";
}
];
};
scanopy = {
enable = true;
db.passwordFile = dummySecretFile;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
};
};
shelfmark = {
enable = true;
downloadDirectory = "${config.nps.storageBaseDir}/grimmory/bookdrop";
useProwlarr = true;
useQbittorrent = true;
extraEnv = {
PROWLARR_API_KEY.fromFile = dummySecretFile;
QBITTORRENT_PASSWORD.fromFile = dummySecretFile;
};
};
socket-proxy.enable = true;
sparky-fitness = {
enable = true;
betterAuthSecretFile = dummySecretFile;
apiEncryptionKeyFile = dummySecretFile;
db.passwordFile = dummySecretFile;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
};
};
spliit = {
enable = true;
db.passwordFile = dummySecretFile;
};
sshwifty = {
enable = true;
settings = {
SharedKey = dummySecret;
Presets = [
{
Title = "Host SSH";
Type = "SSH";
Host = "host.containers.internal:22";
Meta = {
User = dummyId;
Encoding = "utf-8";
"Private Key" = "file://${dummySecretFile}";
Authentication = "Private Key";
};
}
];
};
};
stirling-pdf.enable = true;
storyteller = {
enable = true;
secretKeyFile = dummySecretFile;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
};
streaming =
{
enable = true;
jellyfin = {
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
};
seerr.enable = true;
profilarr.enable = true;
useSabnzbd = true;
maintainerr.enable = true;
}
// lib.genAttrs ["sonarr" "radarr" "bazarr"] (name: {
db = {
type = "postgres";
passwordFile = dummySecretFile;
};
extraEnv."${lib.toUpper name}__AUTH__APIKEY".fromFile = dummySecretFile;
});
super-productivity = {
enable = true;
enableSync = true;
jwtSecretFile = dummySecretFile;
db.passwordFile = dummySecretFile;
smtp = {
host = "localhost";
user = "test";
passwordFile = dummySecretFile;
from = "test@localhost";
};
};
tandoor = {
enable = true;
secretKeyFile = dummySecretFile;
db.passwordFile = dummySecretFile;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
containers.tandoor.extraEnv = {
# https://docs.tandoor.dev/system/configuration/#default-permissions
SOCIAL_DEFAULT_ACCESS = 1;
SOCIAL_DEFAULT_GROUP = "user";
};
};
timetracker = {
enable = true;
secretKeyFile = dummySecretFile;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
db.passwordFile = dummySecretFile;
};
traefik = {
enable = true;
domain = "example.com";
extraEnv.CF_DNS_API_TOKEN.fromFile = dummySecretFile;
geoblock.allowedCountries = ["DE"];
enablePrometheusExport = true;
enableGrafanaMetricsDashboard = true;
enableGrafanaAccessLogDashboard = true;
crowdsec.middleware.bouncerKeyFile = dummySecretFile;
};
trek = {
enable = true;
oidc = {
enable = true;
clientSecretHash = dummyClientSecretHash;
clientSecretFile = dummySecretFile;
};
};
trip = {
enable = true;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
};
uptime-kuma.enable = true;
vaultwarden = {
enable = true;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
};
vikunja = {
enable = true;
db.type = "postgres";
db.passwordFile = dummySecretFile;
jwtSecretFile = dummySecretFile;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
settings = {
service.enableregistration = false;
auth.local.enabled = false;
};
};
webtop = {
enable = true;
username = dummyUser;
passwordFile = dummySecretFile;
};
wg-easy = {
enable = true;
adminPasswordFile = dummySecretFile;
extraEnv = {
DISABLE_IPV6 = true;
};
};
wg-portal = {
enable = true;
settings.core = {
admin_user = dummyUser;
admin_password = "\${ADMIN_PASSWORD}";
};
extraEnv.ADMIN_PASSWORD.fromFile = dummySecretFile;
settings.advanved.use_ip_v6 = false;
oidc = {
enable = true;
clientSecretFile = dummySecretFile;
clientSecretHash = dummyClientSecretHash;
};
};
yopass.enable = true;
};
};
}