add headscale

home/lilac.nix

@@ -11,7 +11,7 @@
   ];
 
   imports = [
-    ./modules/ripping.nix
+    ../modules/ripping.nix
   ];
 
   programs.git = {

hosts/desktop/default.nix

@@ -7,6 +7,7 @@
 	../../modules/network.nix
 	../../modules/ssh.nix
 	../../modules/wireguard.nix
+	../../modules/tailscale.nix
 
 	../../modules/site.nix
 	../../modules/gitea.nix

hosts/vps/default.nix

@@ -7,6 +7,7 @@
     ../../modules/network.nix
     ../../modules/ssh.nix
     ../../modules/wireguard.nix
+	../../modules/headscale.nix
 
     ../../modules/http-forwarding.nix
   ];

modules/email.nix

@@ -0,0 +1,5 @@
+{ config, lib, pkgs, ... }:
+
+{
+  
+}

modules/gitea.nix

@@ -1,16 +1,6 @@
 { config, lib, pkgs, ... }:
 
 {
-  sops = {
-    defaultSopsFile = ./secrets.yaml;
-    defaultSopsFormat = "yaml";
-    age.keyFile = "/var/lib/sops-nix/key.txt";
-
-    secrets.gitea_database_password = {
-      owner = "gitea";
-    };
-  };
-
   services.postgresql = {
     enable = true;
     ensureDatabases = [ "gitea" ];
@@ -25,10 +15,9 @@
     appName = "Lilac's Code";
     database = {
       type = "postgres";
-      host = "/run/postgres";
+      host = "/run/postgresql";
       name = "gitea";
       user = "gitea";
-      passwordFile = config.sops.secrets.gitea_database_password.path;
     };
   };
 
@@ -38,6 +27,4 @@
 	  reverse_proxy localhost:3000
 	'';
   };
-
-  networking.firewall.allowedTCPPorts = [ 3000 ];
 }

modules/headscale.nix

@@ -0,0 +1,30 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.headscale = {
+    enable = true;
+	settings = {
+      server_url = "https://vpn.grasswren.net";
+	  listen_addr = "127.0.0.1:8080";
+
+	  database.type = "sqlite";
+
+	  ip_prefixes = [
+        "100.64.0.0/10"
+        "fd7a:115c:a1e0::/48"
+      ];
+
+	  dns = {
+	    magic_domain = true;
+	    base_domain = "vpn.grasswren.net";
+	  };
+	};
+  };
+
+  services.caddy = {
+    enable = true;
+	virtualHosts."vpn.grasswren.net".extraConfig = ''
+	  reverse_proxy localhost:8080
+	'';
+  };
+}

modules/immich.nix

@@ -1,15 +1,17 @@
 { config, lib, pkgs, ... }:
 
 {
-  services.immich.enable = true;
+  services.immich = {
-  services.immich.port = 2283;
+    enable = true;
-  services.immich.host = "0.0.0.0";
+	host = "127.0.0.1";
-  services.immich.mediaLocation = "/var/lib/media/images";
+	port = 2283;
+	mediaLocation = "/var/lib/immich";
+  };
 
-  services.caddy.enable = true;
+  services.caddy = {
-  services.caddy.virtualHosts."image.grasswren.net".extraConfig = ''
+    enable = true;
+	virtualHosts."image.grasswren.net".extraConfig = ''
       reverse_proxy localhost:2283
 	'';
-
+  };
-  networking.firewall.allowedTCPPorts = [ 2283 ];
 }

modules/navidrome.nix

@@ -1,15 +1,15 @@
 { config, lib, pkgs, ... }:
 
 {
-  services.navidrome.enable = true;
+  services.navidrome = {
-  services.navidrome.settings = {
+    enable = true;
-    MusicFolder = "/var/lib/media/music";
+	settings.MusicFolder = "/var/lib/music";
   };
 
-  services.caddy.enable = true;
+  services.caddy = {
-  services.caddy.virtualHosts."music.grasswren.net".extraConfig = ''
+    enable = true;
+	virtualHosts."music.grasswren.net".extraConfig = ''
       reverse_proxy localhost:4533
 	'';
-
+  };
-  networking.firewall.allowedTCPPorts = [ 4533 ];
 }

modules/ripping.nix

@@ -14,9 +14,11 @@
       library = "/var/lib/media/music/library.db";
 
       plugins = [
+	    "musicbrainz"
         "fetchart"
         "embedart"
         "scrub"
+		"chroma"
       ];
 
       per_disc_numbering = true;
@@ -25,9 +27,9 @@
         move = true;
         copy = false;
         write = true;
-        resume = "ask";
+        timid = true;
         incremental = false;
-        timid = false;
+        resume = "ask";
       };
 
       paths = {

modules/secrets.yaml

@@ -1,16 +0,0 @@
-gitea_database_password: ENC[AES256_GCM,data:bL0VpnAk8rglXmjIWwpKiFnadYQVmPkR0Jq6o+ecFIPWDLt3YCD1LdBHd2E=,iv:4sMOZ5V4XopzuLcDxtwTFDbjkeeUoqggN4wAQIQvB/o=,tag:5iqAYIt0cCBoEMF/ySrO1A==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCVCtsSnhnQWplWGNqWDNv
-            M2UycWRBZmVDZnpQNWJwOWRFeVBxQ0hsZEd3CmhXc2JxNFNMdGNhTFFYbWVVQ0E0
-            enRRQjJ2WnlPSGgyOUZZQUxNRGl4bXcKLS0tIDFMRm1TN0dOM05YaXhaNlQwVGFW
-            WStnazd3RkRNRUZ2N3VWR0dEM2h4MFUK8BmxNJC07XpjM0/ONRyhQFJqNDDeebeH
-            8TgZukSjeq++fdaSNQQfRHX33MjhIkv5ynPaNi+dJ/m4INv5kfKGEA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1ttmws269mrs30f65qwky5rzkwuq0dcfgrhgegxr7u9x9ty2nqfxq9v8dwu
-    lastmodified: "2026-07-05T03:11:33Z"
-    mac: ENC[AES256_GCM,data:2SaYCBj/U/JFUMejMZeGLhzcQk0O5+UkZ8xOHJJj5zwS6n1N8ns8sJOPixErOR2rm/Gnd1QG/KLqkQFdbKjTEpAYDUB65LOqatKWD3uGqrO8/Yu+3bvJSMahuJIJCTAm8zG8tvYpYdijiFBzw2tCgji83tjOBXn7YnM1R09jY2o=,iv:syC6kINOgG9NA8cxWGa3WzWy9e7JawHS6U5e3uUS3uM=,tag:YRlrjHgx1gGTUrq5NTvu3w==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.1

modules/tailscale.nix

@@ -0,0 +1,5 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.tailscale.enable = true;
+}