OOKNET                             [ /  search the index  ]  
──────────────────────────────────────────────────────────────────────────────────────
[ KB ]    [ GIT ]    [ PROJECTS ]    [ ABOUT ]                                      EN
══════════════════════════════════════════════════════════════════════════════════════
OOKNET   [ /  search  ]  
────────────────────────────────────────────────
[ KB ] [ GIT ] [ PROJECTS ] [ ABOUT ]
════════════════════════════════════════════════
 
HASH      2f04748f2e89
DATE      2025-10-23
SUBJECT   server: monitoring/auth/copyparty module init
FILES     10 CHANGED
HASH      2f04748f2e89
DATE      2025-10-23
SUBJECT   server: monitoring/auth/copyparty
          module init
FILES     10 CHANGED
 

diff --git a/modules/nixos/server/options.nix b/modules/nixos/server/options.nix
index c10572a..d0daf19 100644
--- a/modules/nixos/server/options.nix
+++ b/modules/nixos/server/options.nix
@@ -14,7 +14,7 @@ in {
       description = "The server profile the host will use as a base";
     };
     services = mkOption {
-      type = listOf (enum ["media-server" "website" "forgejo" "ookflix" "minecraf
t" "minecraft-proxy"]);
+      type = listOf (enum ["media-server" "website" "forgejo" "ookflix" "minecraf
t" "minecraft-proxy" "copyparty" "monitoring" "authelia"]);
       default = [];
       description = "List of services the server will host";
     };


diff --git a/modules/nixos/server/options.ni
x b/modules/nixos/server/options.nix
index c10572a..d0daf19 100644
--- a/modules/nixos/server/options.nix
+++ b/modules/nixos/server/options.nix
@@ -14,7 +14,7 @@ in {
       description = "The server profile the
 host will use as a base";
     };
     services = mkOption {
-      type = listOf (enum ["media-server" "
website" "forgejo" "ookflix" "minecraft" "mi
necraft-proxy"]);
+      type = listOf (enum ["media-server" "
website" "forgejo" "ookflix" "minecraft" "mi
necraft-proxy" "copyparty" "monitoring" "aut
helia"]);
       default = [];
       description = "List of services the s
erver will host";
     };

 

diff --git a/modules/nixos/server/services/auth/authelia.nix b/modules/nixos/serve
r/services/auth/authelia.nix
new file mode 100644
index 0000000..73ee34f
--- /dev/null
+++ b/modules/nixos/server/services/auth/authelia.nix
@@ -0,0 +1,91 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (config.ooknet.server) services domain;
+  inherit (config.age) secrets;
+in {
+  config = mkIf (elem "authelia" services) {
+    # Enable Caddy
+    ooknet.server.webserver.caddy = {
+      enable = true;
+      cloudflare.enable = true;
+    };
+
+    # Authelia portal virtual host
+    services.caddy.virtualHosts = {
+      "auth.${domain}".extraConfig = ''
+        reverse_proxy localhost:9091
+      '';
+    };
+
+    # Enable Redis for session storage
+    services.redis.servers.authelia = {
+      enable = true;
+      port = 6379;
+      bind = "127.0.0.1";
+    };
+
+    services.authelia.instances.main = {
+      enable = true;
+
+      secrets = {
+        jwtSecretFile = secrets.authelia-jwt.path;
+        storageEncryptionKeyFile = secrets.authelia-storage-key.path;
+        sessionSecretFile = secrets.authelia-session.path;
+      };
+
+      settings = {
+        theme = "dark";
+        default_2fa_method = "totp";
+
+        server = {
+          address = "tcp://127.0.0.1:9091";
+        };
+
+        log = {
+          level = "info";
+        };
+
+        authentication_backend = {
+          file = {
+            path = secrets.authelia-users.path;
+          };
+        };
+
+        session = {
+          domain = domain;
+          redis = {
+            host = "127.0.0.1";
+            port = 6379;
+          };
+        };
+
+        storage = {
+          local = {
+            path = "/var/lib/authelia-main/db.sqlite3";
+          };
+        };
+
+        notifier = {
+          filesystem = {
+            filename = "/var/lib/authelia-main/notifications.txt";
+          };
+        };
+
+        access_control = {
+          default_policy = "deny";
+          rules = [
+            {
+              domain = "auth.${domain}";
+              policy = "bypass";
+            }
+          ];
+        };
+      };
+    };
+  };
+}


diff --git a/modules/nixos/server/services/a
uth/authelia.nix b/modules/nixos/server/serv
ices/auth/authelia.nix
new file mode 100644
index 0000000..73ee34f
--- /dev/null
+++ b/modules/nixos/server/services/auth/aut
helia.nix
@@ -0,0 +1,91 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (config.ooknet.server) services d
omain;
+  inherit (config.age) secrets;
+in {
+  config = mkIf (elem "authelia" services) 
{
+    # Enable Caddy
+    ooknet.server.webserver.caddy = {
+      enable = true;
+      cloudflare.enable = true;
+    };
+
+    # Authelia portal virtual host
+    services.caddy.virtualHosts = {
+      "auth.${domain}".extraConfig = ''
+        reverse_proxy localhost:9091
+      '';
+    };
+
+    # Enable Redis for session storage
+    services.redis.servers.authelia = {
+      enable = true;
+      port = 6379;
+      bind = "127.0.0.1";
+    };
+
+    services.authelia.instances.main = {
+      enable = true;
+
+      secrets = {
+        jwtSecretFile = secrets.authelia-jw
t.path;
+        storageEncryptionKeyFile = secrets.
authelia-storage-key.path;
+        sessionSecretFile = secrets.autheli
a-session.path;
+      };
+
+      settings = {
+        theme = "dark";
+        default_2fa_method = "totp";
+
+        server = {
+          address = "tcp://127.0.0.1:9091";
+        };
+
+        log = {
+          level = "info";
+        };
+
+        authentication_backend = {
+          file = {
+            path = secrets.authelia-users.p
ath;
+          };
+        };
+
+        session = {
+          domain = domain;
+          redis = {
+            host = "127.0.0.1";
+            port = 6379;
+          };
+        };
+
+        storage = {
+          local = {
+            path = "/var/lib/authelia-main/
db.sqlite3";
+          };
+        };
+
+        notifier = {
+          filesystem = {
+            filename = "/var/lib/authelia-m
ain/notifications.txt";
+          };
+        };
+
+        access_control = {
+          default_policy = "deny";
+          rules = [
+            {
+              domain = "auth.${domain}";
+              policy = "bypass";
+            }
+          ];
+        };
+      };
+    };
+  };
+}

 

diff --git a/modules/nixos/server/services/auth/default.nix b/modules/nixos/server
/services/auth/default.nix
new file mode 100644
index 0000000..4b9c671
--- /dev/null
+++ b/modules/nixos/server/services/auth/default.nix
@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./authelia.nix
+  ];
+}


diff --git a/modules/nixos/server/services/a
uth/default.nix b/modules/nixos/server/servi
ces/auth/default.nix
new file mode 100644
index 0000000..4b9c671
--- /dev/null
+++ b/modules/nixos/server/services/auth/def
ault.nix
@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./authelia.nix
+  ];
+}

 

diff --git a/modules/nixos/server/services/copyparty/default.nix b/modules/nixos/s
erver/services/copyparty/default.nix
new file mode 100644
index 0000000..c765ead
--- /dev/null
+++ b/modules/nixos/server/services/copyparty/default.nix
@@ -0,0 +1,48 @@
+{
+  inputs,
+  inputs',
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (config.ooknet.server) services;
+  inherit (config.age) secrets;
+in {
+  imports = [
+    inputs.copyparty.nixosModules.default
+  ];
+
+  config = mkIf (elem "copyparty" services) {
+    services.copyparty = {
+      enable = true;
+      package = inputs'.copyparty.packages.default;
+      settings = {
+        i = "127.0.0.1"; # default option, listen on local host
+        p = 3923; # use default port for now
+        e2dsa = true; # enable file indexing
+        e2ts = true; # enable metadata indexing for media files
+        ah-alg = "argon2";
+      };
+
+      accounts = {
+        ooks = {
+          passwordFile = "${secrets.ooks-copyparty.path}";
+        };
+      };
+
+      volumes = {
+        "/media" = {
+          path = "/home/ooks/Media";
+          access = {
+            rw = "ooks";
+          };
+          flags = {
+            e2d = true;
+            scan = 300;
+          };
+        };
+      };
+    };
+  };
+}


diff --git a/modules/nixos/server/services/c
opyparty/default.nix b/modules/nixos/server/
services/copyparty/default.nix
new file mode 100644
index 0000000..c765ead
--- /dev/null
+++ b/modules/nixos/server/services/copypart
y/default.nix
@@ -0,0 +1,48 @@
+{
+  inputs,
+  inputs',
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (config.ooknet.server) services;
+  inherit (config.age) secrets;
+in {
+  imports = [
+    inputs.copyparty.nixosModules.default
+  ];
+
+  config = mkIf (elem "copyparty" services)
 {
+    services.copyparty = {
+      enable = true;
+      package = inputs'.copyparty.packages.
default;
+      settings = {
+        i = "127.0.0.1"; # default option, 
listen on local host
+        p = 3923; # use default port for no
w
+        e2dsa = true; # enable file indexin
g
+        e2ts = true; # enable metadata inde
xing for media files
+        ah-alg = "argon2";
+      };
+
+      accounts = {
+        ooks = {
+          passwordFile = "${secrets.ooks-co
pyparty.path}";
+        };
+      };
+
+      volumes = {
+        "/media" = {
+          path = "/home/ooks/Media";
+          access = {
+            rw = "ooks";
+          };
+          flags = {
+            e2d = true;
+            scan = 300;
+          };
+        };
+      };
+    };
+  };
+}

 

diff --git a/modules/nixos/server/services/default.nix b/modules/nixos/server/serv
ices/default.nix
index c509cbf..d94a0f3 100644
--- a/modules/nixos/server/services/default.nix
+++ b/modules/nixos/server/services/default.nix
@@ -3,6 +3,9 @@
     ./website
     ./forgejo
     ./ookflix
-    ./minecraft
+    ./copyparty
+    ./monitoring
+    ./auth
+    # ./minecraft
   ];
 }


diff --git a/modules/nixos/server/services/d
efault.nix b/modules/nixos/server/services/d
efault.nix
index c509cbf..d94a0f3 100644
--- a/modules/nixos/server/services/default.
nix
+++ b/modules/nixos/server/services/default.
nix
@@ -3,6 +3,9 @@
     ./website
     ./forgejo
     ./ookflix
-    ./minecraft
+    ./copyparty
+    ./monitoring
+    ./auth
+    # ./minecraft
   ];
 }

 

diff --git a/modules/nixos/server/services/monitoring/default.nix b/modules/nixos/
server/services/monitoring/default.nix
new file mode 100644
index 0000000..1d95664
--- /dev/null
+++ b/modules/nixos/server/services/monitoring/default.nix
@@ -0,0 +1,8 @@
+{
+  imports = [
+    ./prometheus.nix
+    ./grafana.nix
+    ./loki.nix
+    ./exporters.nix
+  ];
+}


diff --git a/modules/nixos/server/services/m
onitoring/default.nix b/modules/nixos/server
/services/monitoring/default.nix
new file mode 100644
index 0000000..1d95664
--- /dev/null
+++ b/modules/nixos/server/services/monitori
ng/default.nix
@@ -0,0 +1,8 @@
+{
+  imports = [
+    ./prometheus.nix
+    ./grafana.nix
+    ./loki.nix
+    ./exporters.nix
+  ];
+}

 

diff --git a/modules/nixos/server/services/monitoring/exporters.nix b/modules/nixo
s/server/services/monitoring/exporters.nix
new file mode 100644
index 0000000..7f3a4d5
--- /dev/null
+++ b/modules/nixos/server/services/monitoring/exporters.nix
@@ -0,0 +1,19 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf;
+  inherit (config.ooknet.host) role;
+in {
+  # Enable node_exporter on all servers for Prometheus scraping
+  config = mkIf (role == "server") {
+    services.prometheus.exporters.node = {
+      enable = true;
+      enabledCollectors = ["systemd"];
+      port = 9100;
+    };
+
+    networking.firewall.interfaces."tailscale0".allowedTCPPorts = [9100];
+  };
+}


diff --git a/modules/nixos/server/services/m
onitoring/exporters.nix b/modules/nixos/serv
er/services/monitoring/exporters.nix
new file mode 100644
index 0000000..7f3a4d5
--- /dev/null
+++ b/modules/nixos/server/services/monitori
ng/exporters.nix
@@ -0,0 +1,19 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf;
+  inherit (config.ooknet.host) role;
+in {
+  # Enable node_exporter on all servers for
 Prometheus scraping
+  config = mkIf (role == "server") {
+    services.prometheus.exporters.node = {
+      enable = true;
+      enabledCollectors = ["systemd"];
+      port = 9100;
+    };
+
+    networking.firewall.interfaces."tailsca
le0".allowedTCPPorts = [9100];
+  };
+}

 

diff --git a/modules/nixos/server/services/monitoring/grafana.nix b/modules/nixos/
server/services/monitoring/grafana.nix
new file mode 100644
index 0000000..4b465c7
--- /dev/null
+++ b/modules/nixos/server/services/monitoring/grafana.nix
@@ -0,0 +1,39 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (config.ooknet.server) services;
+in {
+  config = mkIf (elem "monitoring" services) {
+    networking.firewall.interfaces."tailscale0".allowedTCPPorts = [3001];
+
+    services.grafana = {
+      enable = true;
+      settings = {
+        server = {
+          http_addr = "0.0.0.0";
+          http_port = 3001;
+        };
+      };
+
+      provision = {
+        enable = true;
+        datasources.settings.datasources = [
+          {
+            name = "Prometheus";
+            type = "prometheus";
+            url = "http://localhost:9090";
+            isDefault = true;
+          }
+          {
+            name = "Loki";
+            type = "loki";
+            url = "http://localhost:3100";
+          }
+        ];
+      };
+    };
+  };
+}


diff --git a/modules/nixos/server/services/m
onitoring/grafana.nix b/modules/nixos/server
/services/monitoring/grafana.nix
new file mode 100644
index 0000000..4b465c7
--- /dev/null
+++ b/modules/nixos/server/services/monitori
ng/grafana.nix
@@ -0,0 +1,39 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (config.ooknet.server) services;
+in {
+  config = mkIf (elem "monitoring" services
) {
+    networking.firewall.interfaces."tailsca
le0".allowedTCPPorts = [3001];
+
+    services.grafana = {
+      enable = true;
+      settings = {
+        server = {
+          http_addr = "0.0.0.0";
+          http_port = 3001;
+        };
+      };
+
+      provision = {
+        enable = true;
+        datasources.settings.datasources = 
[
+          {
+            name = "Prometheus";
+            type = "prometheus";
+            url = "http://localhost:9090";
+            isDefault = true;
+          }
+          {
+            name = "Loki";
+            type = "loki";
+            url = "http://localhost:3100";
+          }
+        ];
+      };
+    };
+  };
+}

 

diff --git a/modules/nixos/server/services/monitoring/loki.nix b/modules/nixos/ser
ver/services/monitoring/loki.nix
new file mode 100644
index 0000000..7113eb3
--- /dev/null
+++ b/modules/nixos/server/services/monitoring/loki.nix
@@ -0,0 +1,95 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (config.ooknet.server) services;
+in {
+  config = mkIf (elem "monitoring" services) {
+    services.loki = {
+      enable = true;
+      configuration = {
+        server.http_listen_port = 3100;
+        auth_enabled = false;
+
+        common = {
+          ring = {
+            instance_addr = "127.0.0.1";
+            kvstore.store = "inmemory";
+          };
+          replication_factor = 1;
+          path_prefix = "/var/lib/loki";
+        };
+
+        schema_config = {
+          configs = [
+            {
+              from = "2024-01-01";
+              store = "tsdb";
+              object_store = "filesystem";
+              schema = "v13";
+              index = {
+                prefix = "index_";
+                period = "24h";
+              };
+            }
+          ];
+        };
+
+        storage_config = {
+          filesystem.directory = "/var/lib/loki/chunks";
+          tsdb_shipper = {
+            active_index_directory = "/var/lib/loki/tsdb-index";
+            cache_location = "/var/lib/loki/tsdb-cache";
+          };
+        };
+
+        limits_config = {
+          reject_old_samples = true;
+          reject_old_samples_max_age = "168h";
+        };
+      };
+    };
+
+    # Promtail to ship logs to Loki
+    services.promtail = {
+      enable = true;
+      configuration = {
+        server = {
+          http_listen_port = 3031;
+          grpc_listen_port = 0;
+        };
+
+        positions = {
+          filename = "/tmp/positions.yaml";
+        };
+
+        clients = [
+          {
+            url = "http://127.0.0.1:3100/loki/api/v1/push";
+          }
+        ];
+
+        scrape_configs = [
+          {
+            job_name = "journal";
+            journal = {
+              max_age = "12h";
+              labels = {
+                job = "systemd-journal";
+                host = config.networking.hostName;
+              };
+            };
+            relabel_configs = [
+              {
+                source_labels = ["__journal__systemd_unit"];
+                target_label = "unit";
+              }
+            ];
+          }
+        ];
+      };
+    };
+  };
+}


diff --git a/modules/nixos/server/services/m
onitoring/loki.nix b/modules/nixos/server/se
rvices/monitoring/loki.nix
new file mode 100644
index 0000000..7113eb3
--- /dev/null
+++ b/modules/nixos/server/services/monitori
ng/loki.nix
@@ -0,0 +1,95 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (config.ooknet.server) services;
+in {
+  config = mkIf (elem "monitoring" services
) {
+    services.loki = {
+      enable = true;
+      configuration = {
+        server.http_listen_port = 3100;
+        auth_enabled = false;
+
+        common = {
+          ring = {
+            instance_addr = "127.0.0.1";
+            kvstore.store = "inmemory";
+          };
+          replication_factor = 1;
+          path_prefix = "/var/lib/loki";
+        };
+
+        schema_config = {
+          configs = [
+            {
+              from = "2024-01-01";
+              store = "tsdb";
+              object_store = "filesystem";
+              schema = "v13";
+              index = {
+                prefix = "index_";
+                period = "24h";
+              };
+            }
+          ];
+        };
+
+        storage_config = {
+          filesystem.directory = "/var/lib/
loki/chunks";
+          tsdb_shipper = {
+            active_index_directory = "/var/
lib/loki/tsdb-index";
+            cache_location = "/var/lib/loki
/tsdb-cache";
+          };
+        };
+
+        limits_config = {
+          reject_old_samples = true;
+          reject_old_samples_max_age = "168
h";
+        };
+      };
+    };
+
+    # Promtail to ship logs to Loki
+    services.promtail = {
+      enable = true;
+      configuration = {
+        server = {
+          http_listen_port = 3031;
+          grpc_listen_port = 0;
+        };
+
+        positions = {
+          filename = "/tmp/positions.yaml";
+        };
+
+        clients = [
+          {
+            url = "http://127.0.0.1:3100/lo
ki/api/v1/push";
+          }
+        ];
+
+        scrape_configs = [
+          {
+            job_name = "journal";
+            journal = {
+              max_age = "12h";
+              labels = {
+                job = "systemd-journal";
+                host = config.networking.ho
stName;
+              };
+            };
+            relabel_configs = [
+              {
+                source_labels = ["__journal
__systemd_unit"];
+                target_label = "unit";
+              }
+            ];
+          }
+        ];
+      };
+    };
+  };
+}

 

diff --git a/modules/nixos/server/services/monitoring/prometheus.nix b/modules/nix
os/server/services/monitoring/prometheus.nix
new file mode 100644
index 0000000..affe52e
--- /dev/null
+++ b/modules/nixos/server/services/monitoring/prometheus.nix
@@ -0,0 +1,46 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (config.ooknet.server) services;
+in {
+  config = mkIf (elem "monitoring" services) {
+    services.prometheus = {
+      enable = true;
+      port = 9090;
+
+      scrapeConfigs = [
+        {
+          job_name = "ooksmedia";
+          static_configs = [{
+            targets = ["localhost:9100"];
+            labels = {
+              host = "ooksmedia";
+            };
+          }];
+        }
+        {
+          job_name = "ooknode";
+          static_configs = [{
+            targets = ["ooknode.taila3ca6.ts.net:9100"];
+            labels = {
+              host = "ooknode";
+            };
+          }];
+        }
+        {
+          job_name = "caddy";
+          static_configs = [{
+            targets = ["ooknode.taila3ca6.ts.net:2019"];
+            labels = {
+              host = "ooknode";
+              service = "caddy";
+            };
+          }];
+        }
+      ];
+    };
+  };
+}


diff --git a/modules/nixos/server/services/m
onitoring/prometheus.nix b/modules/nixos/ser
ver/services/monitoring/prometheus.nix
new file mode 100644
index 0000000..affe52e
--- /dev/null
+++ b/modules/nixos/server/services/monitori
ng/prometheus.nix
@@ -0,0 +1,46 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf elem;
+  inherit (config.ooknet.server) services;
+in {
+  config = mkIf (elem "monitoring" services
) {
+    services.prometheus = {
+      enable = true;
+      port = 9090;
+
+      scrapeConfigs = [
+        {
+          job_name = "ooksmedia";
+          static_configs = [{
+            targets = ["localhost:9100"];
+            labels = {
+              host = "ooksmedia";
+            };
+          }];
+        }
+        {
+          job_name = "ooknode";
+          static_configs = [{
+            targets = ["ooknode.taila3ca6.t
s.net:9100"];
+            labels = {
+              host = "ooknode";
+            };
+          }];
+        }
+        {
+          job_name = "caddy";
+          static_configs = [{
+            targets = ["ooknode.taila3ca6.t
s.net:2019"];
+            labels = {
+              host = "ooknode";
+              service = "caddy";
+            };
+          }];
+        }
+      ];
+    };
+  };
+}

 
[ BACK TO LOG ]
──────────────────────────────────────────────────────────────────────────────────────
OOKNET
────────────────────────────────────────────────
OOKNET