feat(nixos): migrate system configuration

configs/nixos/guests/actualbudget.nix

@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.guests.actualbudget;
+  dataDir = "/data";
+in
+{
+  options.guests.actualbudget = {
+    dataPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/actualbudget";
+      description = "Host path bind-mounted as Actual Budget's data directory.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.dataPath != null;
+        message = "guests.actualbudget.dataPath must point at the host directory that stores Actual Budget data.";
+      }
+    ];
+
+    guests.actualbudget = {
+      interior = {
+        modules.services.actualbudget = {
+          enable = true;
+          inherit dataDir;
+        };
+      };
+      mounts.${dataDir}.directory = cfg.dataPath;
+      limits = {
+        memory = lib.mkDefault "2G";
+        cpu = lib.mkDefault "200%";
+        tasksMax = lib.mkDefault 512;
+      };
+    };
+  };
+}

configs/nixos/guests/copyparty.nix

@@ -0,0 +1,128 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.guests.copyparty;
+
+  volumeType = lib.types.submodule {
+    options = {
+      hostPath = lib.mkOption {
+        type = lib.types.str;
+        description = "Host path bind-mounted into the Copyparty guest for this volume.";
+      };
+
+      path = lib.mkOption {
+        type = lib.types.str;
+        description = "Guest path served by this Copyparty volume.";
+      };
+
+      access = lib.mkOption {
+        type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+        default = { };
+        description = "Copyparty access map from permission string to account names.";
+      };
+
+      flags = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "Copyparty volume flags.";
+      };
+    };
+  };
+in
+{
+  options.guests.copyparty = {
+    accountName = lib.mkOption {
+      type = lib.types.str;
+      default = "alexion";
+      description = "Copyparty account name configured for password authentication.";
+    };
+
+    passwordSecret = lib.mkOption {
+      type = lib.types.str;
+      default = "services/copyparty/users/alexion/password";
+      description = "SOPS secret name containing the Copyparty account password.";
+    };
+
+    stateDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/copyparty";
+      description = "Guest path where Copyparty stores service state.";
+    };
+
+    statePath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/copyparty";
+      description = "Host path bind-mounted as Copyparty's state directory.";
+    };
+
+    reverseProxy.trustedSources = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "IP ranges that may supply Copyparty's forwarded client IP header.";
+    };
+
+    volumes = lib.mkOption {
+      type = lib.types.attrsOf volumeType;
+      default = { };
+      description = "Copyparty volumes keyed by their URL path.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.statePath != null;
+        message = "guests.copyparty.statePath must point at the host directory that stores Copyparty state.";
+      }
+      {
+        assertion = cfg.volumes != { };
+        message = "guests.copyparty.volumes must declare the host's served Copyparty volumes.";
+      }
+    ];
+
+    guests.copyparty = {
+      interior.modules.services.copyparty = {
+        enable = true;
+        inherit (cfg) accountName stateDir;
+        passwordFile = "/run/secrets/${cfg.passwordSecret}";
+        reverseProxy = {
+          enable = cfg.reverseProxy.enable;
+          inherit (cfg.reverseProxy) trustedSources;
+        };
+        volumes = lib.mapAttrs (_urlPath: volume: {
+          inherit (volume) path access flags;
+        }) cfg.volumes;
+      };
+
+      mounts =
+        {
+          ${cfg.stateDir} = {
+            directory = cfg.statePath;
+            owner = config.registry."stable-uid".${config.networking.hostName}.copyparty;
+            group = "storage";
+            mode = "0770";
+          };
+          ${"/run/secrets/${cfg.passwordSecret}"} = {
+            file = config.sops.secrets.${cfg.passwordSecret}.path;
+            readOnly = true;
+          };
+        }
+        // lib.mapAttrs' (_urlPath: volume: lib.nameValuePair volume.path { directory = volume.hostPath; }) cfg.volumes;
+      limits = {
+        memory = lib.mkDefault "2G";
+        cpu = lib.mkDefault "200%";
+        tasksMax = lib.mkDefault 512;
+      };
+    };
+
+    sops.secrets.${cfg.passwordSecret} = {
+      owner = "root";
+      group = "storage";
+      mode = "0440";
+    };
+  };
+}

configs/nixos/guests/reverse-proxy.nix

@@ -0,0 +1,75 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  giteaSshBackend = "10.23.20.45:2022";
+in
+{
+  config = lib.mkIf config.guests.reverse-proxy.enable {
+    guests.reverse-proxy = {
+      interior = {
+        modules.services.reverse-proxy.enable = true;
+
+        services.nginx.virtualHosts = {
+          "games.alexion.dev" = {
+            forceSSL = true;
+            enableACME = true;
+            locations."/".proxyPass = "http://10.23.20.32";
+          };
+          "git.alexion.dev" = {
+            forceSSL = true;
+            enableACME = true;
+            locations."/".proxyPass = "http://10.23.20.32";
+          };
+          "music.alexion.dev" = {
+            forceSSL = true;
+            enableACME = true;
+            locations."/".proxyPass = "http://10.23.20.32";
+          };
+          "photos.alexion.dev" = {
+            forceSSL = true;
+            enableACME = true;
+            locations."/".proxyPass = "http://10.23.20.32";
+          };
+          "plex.alexion.dev" = {
+            forceSSL = true;
+            enableACME = true;
+            locations."/".proxyPass = "http://10.23.20.32";
+          };
+          "servers.alexion.dev" = {
+            forceSSL = true;
+            enableACME = true;
+            locations."/".proxyPass = "http://10.23.20.32";
+          };
+          "todo.alexion.dev" = {
+            forceSSL = true;
+            enableACME = true;
+            locations."/".proxyPass = "http://10.23.20.32";
+          };
+          "wings.alexion.dev" = {
+            forceSSL = true;
+            enableACME = true;
+            locations."/".proxyPass = "http://10.23.20.32";
+          };
+        };
+
+        networking.firewall.allowedTCPPorts = [ 2022 ];
+
+        services.nginx.streamConfig = ''
+          server {
+            listen 2022;
+            proxy_pass ${giteaSshBackend};
+          }
+        '';
+      };
+
+      limits = {
+        memory = lib.mkDefault "1G";
+        cpu = lib.mkDefault "100%";
+        tasksMax = lib.mkDefault 256;
+      };
+    };
+  };
+}