initial commit

modules/gitea.nix

@@ -0,0 +1,43 @@
+{ config, lib, pkgs, ... }:
+
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+    defaultSopsFormat = "yaml";
+    age.keyFile = "/var/lib/sops-nix/key.txt";
+
+    secrets.gitea_database_password = {
+      owner = "gitea";
+    };
+  };
+
+  services.postgresql = {
+    enable = true;
+    ensureDatabases = [ "gitea" ];
+    ensureUsers = [{
+      name = "gitea";
+      ensureDBOwnership = true;
+    }];
+  };
+
+  services.gitea = {
+    enable = true;
+    appName = "Lilac's Code";
+    database = {
+      type = "postgres";
+      host = "/run/postgres";
+      name = "gitea";
+      user = "gitea";
+      passwordFile = config.sops.secrets.gitea_database_password.path;
+    };
+  };
+
+  services.caddy = {
+    enable = true;
+	virtualHosts."code.grasswren.net".extraConfig = ''
+	  reverse_proxy localhost:3000
+	'';
+  };
+
+  networking.firewall.allowedTCPPorts = [ 3000 ];
+}

modules/http-forwarding.nix

@@ -0,0 +1,28 @@
+{ config, lib, pkgs, ... }:
+
+{
+  networking.firewall.enable = true;
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  networking.nftables.enable = true;
+  networking.nftables.tables.nat = {
+    family = "ip";
+    content = ''
+      chain prerouting {
+        type nat hook prerouting priority dstnat; policy accept;
+
+        iifname "enp1s0" tcp dport 80 dnat to 10.0.0.2:80
+        iifname "enp1s0" tcp dport 443 dnat to 10.0.0.2:443
+      }
+	    chain postrouting {
+        type nat hook postrouting priority srcnat; policy accept;
+
+        oifname "wg0" masquerade
+      }
+    '';
+  };
+
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+  };
+}

modules/network.nix

@@ -0,0 +1,41 @@
+{ config, lib, pkgs, ... }:
+
+{
+  options.network = {
+    nodes = lib.mkOption { type = lib.types.attrsOf
+	  (lib.types.submodule ({ name, config, ... }: {
+        options = {
+          id          = lib.mkOption { type = lib.types.int; };
+          ssh         = lib.mkOption { type = lib.types.str; };
+          vpn         = lib.mkOption { type = lib.types.str; };
+		  address-vpn = lib.mkOption { type = lib.types.str; };
+          address-pub = lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; };
+		};
+		config = {
+          address-vpn = "10.0.0.${toString config.id}";
+		};
+	  }));
+	};
+	node = lib.mkOption { type = lib.types.str; };
+  };
+  config.network = {
+    nodes = {
+      laptop = {
+        id = 1;
+        ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg";
+        vpn = "n+9eh8VUP9NCnjPL0Z/KPc0TQCQloXE2Ipc5+CBtJjU=";
+      };
+      desktop = {
+        id = 2;
+        ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdOUv+mUhnS2sbahlqcqm9Ili16/rOk2WAlMSXrjnHu";
+        vpn = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
+      };
+      vps = {
+        id = 3;
+        ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGiiLFiy+UcOi0RgZ1Xvuzl4C5aiZ+bcGaOmQcI/UBXp";
+        vpn = "c5irm217aE+QVwHYmnQh4r91u2fZmQKBIWVgFVMaEwU=";
+        address-pub = "216.128.177.13";
+      };
+    };
+  };
+}

modules/secrets.yaml

@@ -0,0 +1,16 @@
+gitea_database_password: ENC[AES256_GCM,data:bL0VpnAk8rglXmjIWwpKiFnadYQVmPkR0Jq6o+ecFIPWDLt3YCD1LdBHd2E=,iv:4sMOZ5V4XopzuLcDxtwTFDbjkeeUoqggN4wAQIQvB/o=,tag:5iqAYIt0cCBoEMF/ySrO1A==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCVCtsSnhnQWplWGNqWDNv
+            M2UycWRBZmVDZnpQNWJwOWRFeVBxQ0hsZEd3CmhXc2JxNFNMdGNhTFFYbWVVQ0E0
+            enRRQjJ2WnlPSGgyOUZZQUxNRGl4bXcKLS0tIDFMRm1TN0dOM05YaXhaNlQwVGFW
+            WStnazd3RkRNRUZ2N3VWR0dEM2h4MFUK8BmxNJC07XpjM0/ONRyhQFJqNDDeebeH
+            8TgZukSjeq++fdaSNQQfRHX33MjhIkv5ynPaNi+dJ/m4INv5kfKGEA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ttmws269mrs30f65qwky5rzkwuq0dcfgrhgegxr7u9x9ty2nqfxq9v8dwu
+    lastmodified: "2026-07-05T03:11:33Z"
+    mac: ENC[AES256_GCM,data:2SaYCBj/U/JFUMejMZeGLhzcQk0O5+UkZ8xOHJJj5zwS6n1N8ns8sJOPixErOR2rm/Gnd1QG/KLqkQFdbKjTEpAYDUB65LOqatKWD3uGqrO8/Yu+3bvJSMahuJIJCTAm8zG8tvYpYdijiFBzw2tCgji83tjOBXn7YnM1R09jY2o=,iv:syC6kINOgG9NA8cxWGa3WzWy9e7JawHS6U5e3uUS3uM=,tag:YRlrjHgx1gGTUrq5NTvu3w==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1

modules/ssh.nix

@@ -0,0 +1,27 @@
+{ config, lib, pkgs, ... }:
+
+let
+  me = config.network.nodes.${config.network.node};
+in
+{
+  networking.firewall = {
+    enable = true;
+	interfaces.wg0.allowedTCPPorts = [ 22 ];
+  };
+  services.openssh = {
+    enable = true;
+	settings = {
+      PermitRootLogin = "prohibit-password";
+	  PasswordAuthentication = false;
+	  KbdInteractiveAuthentication = false;
+	};
+	listenAddresses = [{
+      addr = me.address-vpn;
+	  port = 22;
+	}];
+  };
+  users.users.root.openssh.authorizedKeys.keys = [
+    config.network.nodes.laptop.ssh
+	config.network.nodes.desktop.ssh
+  ];
+}

modules/wireguard.nix

@@ -0,0 +1,38 @@
+{ config, lib, pkgs, ... }:
+
+let
+  me = config.network.nodes.${config.network.node};
+in
+{
+  networking = {
+    firewall = {
+      allowedUDPPorts = [ 51820 ];
+	    trustedInterfaces = [ "wg0" ];
+	  };
+	  wireguard.interfaces."wg0" = {
+      ips = [ "${me.address-vpn}/24" ];
+	    listenPort = 51820;
+	    generatePrivateKeyFile = true;
+	    privateKeyFile = "/var/lib/wireguard/wg0.key";
+	    peers = lib.mapAttrsToList (name: peer: {
+        publicKey = peer.vpn;
+		    allowedIPs =
+		      if config.network.node == "vps"
+			      then [ "${peer.address-vpn}/32" ]
+			      else [ "10.0.0.0/24" ];
+		    endpoint =
+		      if peer.address-pub != null
+			      then "${peer.address-pub}:51820"
+			      else null;
+		    persistentKeepalive =
+		      if peer.address-pub != null
+			      then 25
+			      else null;
+	    }) (lib.filterAttrs (name: _:
+        if config.network.node == "vps"
+		      then name != "vps"
+          else name == "vps"
+      ) config.network.nodes);
+	  };
+  };
+}