Merge branch 'master' of ssh://git.dhilton.xyz:2020/k/nixos_configs

hosts/server/configuration.nix

@@ -32,6 +32,11 @@
     motd = "Welcome to the Server";
     defaultUserShell = pkgs.zsh;
     users = {
+      rodant = {
+        isNormalUser = true;
+	description = "llm user";
+	packages = with pkgs; [git python3 nodejs cargo ripgrep curl wget ffmpeg imagemagick texliveFull ];
+      };
       k = {
         isNormalUser = true;
         description = "k";
@@ -54,7 +59,7 @@
   };
 
   environment.systemPackages = with pkgs; [
-    microcodeIntel
+    microcode-intel
     firefox
   ];
 
@@ -65,10 +70,9 @@
     extraPackages = with pkgs; [
       intel-media-driver
       intel-vaapi-driver
-      vaapiVdpau
+      libva-vdpau-driver
       intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
       vpl-gpu-rt # QSV on 11th gen or newer
-      intel-media-sdk # QSV up to 11th gen
     ];
   };
 

hosts/server/service.nix

@@ -6,8 +6,8 @@
   networking = {
     firewall = {
       enable = true;
-      allowedTCPPorts = [80 443 22 25565 26615 8080 53 19132];
-      allowedUDPPorts = [26615 8080 1900 51820 53 19132];
+      allowedTCPPorts = [80 443 51820 2020 26615];
+      allowedUDPPorts = [51820 24454 26615];
     };
     nat.externalInterface = "wlp0s20f3";
     nat.internalInterfaces = ["wg0"];
@@ -47,11 +47,51 @@
   };
 
   services = {
-    openssh = {enable = true;};
+    openssh = {
+      enable = true;
+      ports = [2020];
+    };
 
     jellyfin = {enable = true;};
 
-    fail2ban = {enable = true;};
+    fail2ban = {
+      enable = true;
+      jails = {
+        nginx-http-auth = {
+          settings = {
+            enabled = true;
+            port = "http,https";
+            logpath = "/var/log/nginx/error.log";
+            # "auto" or "polling" is required for file-based logs on NixOS
+            backend = "auto";
+          };
+        };
+
+        nginx-botsearch = {
+          settings = {
+            enabled = true;
+            port = "http,https";
+            logpath = "/var/log/nginx/access.log";
+            backend = "auto";
+            maxretry = 2;
+          };
+        };
+        recidive = {
+          settings = {
+            enabled = true;
+            port = "allports";
+            protocol = "all";
+            # Look for 'Ban' messages in fail2ban's own log
+            backend = "systemd";
+            #logpath = "/var/log/fail2ban.log";
+            #backend = "auto";
+            bantime = "1w"; # Ban for 1 week
+            findtime = "1d"; # Look back 1 day
+            maxretry = 5; # If they were banned 5 times in 24 hours
+          };
+        };
+      };
+    };
 
     postgresql = {enable = true;};
 
@@ -62,18 +102,68 @@
       secretKeyFile = "/var/cache-priv-key.pem";
     };
 
-    ollama = {
-      enable = false;
-      package = pkgs.ollama-intel;
+prometheus = {
+  enable = true;
+  scrapeConfigs = [{
+    job_name = "ratchat-server";
+    static_configs = [{
+      targets = [ "127.0.0.1:9011" ];
+    }];
+  }];
 };
 
-    gitea = {
+grafana = {
+  enable = true;
+  settings = {
+    server = {
+      http_addr = "127.0.0.1";
+      http_port = 3000;
+    };
+  };
+
+  provision = {
+    enable = true;
+    datasources.settings.datasources = [{
+      name = "Prometheus";
+      type = "prometheus";
+      url = "http://localhost:9090";
+    }];
+  };
+};
+
+    ollama = {
+      enable = true;
+      package = pkgs.ollama-vulkan;
+      environmentVariables = {
+        GGML_VK_DISABLE_INTEGER_DOT_PRODUCT = "1";
+        OLLAMA_FLASH_ATTENTION = "1";
+        OLLAMA_VULKAN = "1";
+        OLLAMA_HOST = "0.0.0.0:11434";
+      };
+    };
+    anubis = {
+      defaultOptions = {
+        enable = true;
+        settings.SERVE_ROBOTS_TXT = true;
+        firewall.enabled = true;
+        firewall.block_openai = true;
+        firewall.block_google = true;
+      };
+    };
+
+    open-webui = {
+      enable = true;
+      port = 5009;
+    };
+
+    forgejo = {
       enable = true;
       settings = {
         service.DISABLE_REGISTRATION = true;
         service.ENABLE_PUSH_CREATE_USER = true;
         server = {
           HTTP_PORT = 8001;
+          SSH_PORT = 2020;
           DOMAIN = "dhilton.xyz";
           ROOT_URL = "https://git.dhilton.xyz";
           ENABLE_PUSH_CREATE_USER = true;
@@ -81,6 +171,7 @@
       };
     };
 
+    gitea-actions-runner.package = pkgs.forgejo-runner;
     gitea-actions-runner.instances.home = {
       enable = true;
       url = "https://git.dhilton.xyz";
@@ -96,8 +187,8 @@
     };
 
     home-assistant = {
-      enable = false;
-      extraComponents = ["wiz" "fail2ban" "ollama" "wyoming" "androidtv" "androidtv_remote"];
+      enable = true;
+      extraComponents = ["wiz" "fail2ban" "ollama" "wyoming" "bluetooth" "ios" "homekit" "jellyfin" "apple_tv" "androidtv" "androidtv_remote"];
       config = {
         default_config = {};
         "automation ui" = "!include automations.yaml";
@@ -111,12 +202,12 @@
 
     wyoming = {
       piper.servers."piperNix" = {
-        enable = false;
+        enable = true;
         uri = "tcp://0.0.0.0:10200";
         voice = "en-us-ryan-low";
       };
       faster-whisper.servers."whisperNix" = {
-        enable = false;
+        enable = true;
         uri = "tcp://0.0.0.0:10300";
         language = "en";
       };
@@ -131,30 +222,18 @@
       };
     };
 
-    akkoma = {
-      enable = true;
-      initDb.enable = true;
-      config = {
-        ":pleroma" = {
-          ":instance" = {
-            name = "dhilton fedi";
-            description = "dhilton akkoma server";
-            email = "markers711@gmail.com";
-            registration_open = false;
-          };
-          "Pleroma.Web.Endpoint" = {url.host = "fed.dhilton.xyz";};
-        };
-      };
-      nginx = {
-        enableACME = true;
-        forceSSL = true;
-      };
-    };
-
     nginx = {
       enable = true;
+commonHttpConfig = ''
+    map $http_authorization $is_allowed_user {
+        default 0;
+        "Bearer ratToken"      1;
+        "Bearer notRatToken"     1;
+    }
+  '';
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
+      clientMaxBodySize = "4g";
 
       virtualHosts = {
         "dhilton.xyz" = {
@@ -181,6 +260,17 @@
           };
         };
 
+        "rat.dhilton.xyz" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:9011";
+extraConfig = ''
+        if ($is_allowed_user = 0) { return 401; }
+      '';
+          };
+        };
+
         "hom.dhilton.xyz" = {
           forceSSL = true;
           enableACME = true;
@@ -199,11 +289,20 @@
           };
         };
 
-        "map.dhilton.xyz" = {
+        "oai.dhilton.xyz" = {
           forceSSL = true;
           enableACME = true;
           locations."/" = {
-            proxyPass = "http://127.0.0.1:8100";
+            proxyPass = "http://127.0.0.1:5009";
+            proxyWebsockets = true;
+          };
+        };
+
+        "gfa.dhilton.xyz" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:3000";
             proxyWebsockets = true;
           };
         };