tfc-nixos/system/shen/configuration.nix

# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).

{ config, lib, pkgs, ... }:

{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
      ../../pkgs/base-packages.nix
      ../../modules/base.nix
    ];

  networking.hostName = "shen"; # Define your hostname.

  # Enable CUPS to print documents.
  services.printing = {
    enable = true;
    drivers = [pkgs.gutenprint];
    browsing = true;
    listenAddresses = [ "*:631" ]; # Not 100% sure this is needed and you might want to restrict to the local network
    allowFrom = [ "all" ]; # this gives access to anyone on the interface you might want to limit it see the official documentation
    defaultShared = true; # If you want
    extraConf = ''
    DefaultEncryption Never
    '';
  };

  hardware.opengl = {
   enable = true;
   extraPackages = with pkgs; [
    intel-media-driver
    vaapiIntel
    vaapiVdpau
    libvdpau-va-gl    
    rocm-opencl-icd
    rocm-opencl-runtime
    amdvlk
   ];
   driSupport = lib.mkDefault true;
   driSupport32Bit = lib.mkDefault true;
   #extraPackages32 = with pkgs; [
   #  driversi686linux.amdvlk
   #];
  };

  environment.variables.AMD_VULKAN_ICD = lib.mkDefault "RADV";

  # CADDY
  services.caddy = {
    enable = true;
    extraConfig = ''
    (matrix-well-known-header) {                                     
        # Headers                                                    
        header Access-Control-Allow-Origin "*"                       
        header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"                                                     
        header Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization"
        header Content-Type "application/json"
    }
    '';
    virtualHosts = {
      "bitwarden.tfcconnection.org".extraConfig = ''
        reverse_proxy localhost:9898
        encode gzip
      '';
    };
    virtualHosts = {
      "staff.tfcconnection.org".extraConfig = ''
	    encode gzip
	    reverse_proxy localhost:8080
	
      redir /.well-known/carddav /remote.php/carddav 301
      redir /.well-known/caldav /remote.php/caldav 301
      header {
              Strict-Transport-Security "max-age=15768000; includeSubDomains; reload;"
              Access-Control-Allow-Origin *
              Referrer-Policy no-referrer-when-downgrade
      }
      redir /.well-known/oidc-configuration /apps/oidc/openid-configuration 301
      '';
    };
    virtualHosts = {
      "office.tfcconnection.org".extraConfig = ''
        encode gzip
        @collabora {
          path /loleaflet/*
          path /hosting/discovery # WOPI discovery URL
          path /hosting/capabilities # Show capabilities as json
          path /cool/* # Main websocket, uploads/downloads, presentations
          path /lool/* # Main websocket, uploads/downloads, presentations
          path /cool/adminws # Main websocket, uploads/downloads, presentations
          path /browser # Main websocket, uploads/downloads, presentations
        }
        reverse_proxy https://127.0.0.1:9980 {
          transport http {
            tls_insecure_skip_verify
          }
        }
      '';
    };
    virtualHosts = {
      "table.tfcconnection.org".extraConfig = ''
        reverse_proxy localhost:8181
      '';
    };
    virtualHosts = {
      "app.tfcconnection.org".extraConfig = ''
        reverse_proxy localhost:8686
      '';
    };
    virtualHosts = {
      "test.tfcconnection.org".extraConfig = ''
        reverse_proxy localhost:8880
      '';
    };
    virtualHosts = {
      "n8n.tfcconnection.org".extraConfig = ''
        reverse_proxy localhost:5678
        header {
              Access-Control-Allow-Origin *
        }
      '';
    };
    virtualHosts = {
      "videosdani.tfcconnection.org".extraConfig = ''

        @live {
          protocol rtmps
        }

        reverse_proxy 172.16.1.7:9000
        reverse_proxy @live 172.16.1.7:1935
      '';
    };
    virtualHosts = {
      "streamdani.tfcconnection.org".extraConfig = ''
        reverse_proxy 172.16.1.7:1935
      '';
    };
    virtualHosts = {
      "tbl.tfcconnection.org".extraConfig = ''
        reverse_proxy localhost:9180
      '';
    };
    virtualHosts = {
      "ytdl.tfcconnection.org".extraConfig = ''
        reverse_proxy localhost:8686
      '';
    };
    virtualHosts = {
      "mail.tfcconnection.org".extraConfig = ''
        reverse_proxy localhost:8443
      '';
    };
    virtualHosts = {
      "data.tfcconnection.org".extraConfig = ''
        reverse_proxy localhost:8055
      '';
    };
    virtualHosts = {
      "photos.tfcconnection.org".extraConfig = ''
        reverse_proxy localhost:2342
      '';
    };
    virtualHosts = {
      "new.tfcconnection.org".extraConfig = ''
        encode gzip
        root * /srv/tfcconnection
	      file_server        
        header {
              Access-Control-Allow-Origin *
        }
      '';
    };
    virtualHosts = {
      "tfcconnection.org".extraConfig = ''
        encode gzip
        root * /srv/tfcconnection
	      file_server        
        header {
              Access-Control-Allow-Origin *
        }
        handle /.well-known/matrix/server {
              import matrix-well-known-header
              respond `{"m.server":"matrix.tfcconnection.org"}`
        }

        handle /.well-known/matrix/client {
              import matrix-well-known-header
              respond `{"m.homeserver":{"base_url":"https://matrix.tfcconnection.org"},"m.identity_server":{"base_url":"https://identity.matrix.org"},"im.vector.riot.jitsi": {
              "preferredDomain": "jitsi.tfcconnection.org"
        }}`
        }
      '';
    };
    virtualHosts = {
      "www.tfcconnection.org".extraConfig = ''
        encode gzip
        root * /srv/tfcconnection
	      file_server        
        header {
              Access-Control-Allow-Origin *
        }
      '';
    };
    virtualHosts = {
      "plausible.tfcconnection.org".extraConfig = ''
        encode gzip
        reverse_proxy 127.0.0.1:8000
      '';
    };
    virtualHosts = {
      "imaginary.tfcconnection.org".extraConfig = ''
        encode gzip
        reverse_proxy 127.0.0.1:9000
      '';
    };
    virtualHosts = {
      "sd.tfcconnection.org".extraConfig = ''
        encode gzip
        reverse_proxy 172.16.1.7:7860
        header {
              Access-Control-Allow-Origin *
        }
      '';
    };
  };

  systemd.services = {
    nextcloud-cron = {
      enable = true;
      serviceConfig = {
        Type = "oneshot";
        ExecStart = "${pkgs.docker}/bin/docker exec -u www-data -d nextcloud-app-1 php cron.php";
      };
    };
    nextcloud-push = {
      enable = true;
      serviceConfig = {
	      Environment = "PORT=7867";
        ExecStart = "${pkgs.docker}/bin/docker exec -u www-data -d nextcloud-app-1 /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push /var/www/html/config/config.php";
      };
    };
    nextcloud-previews = {
      enable = true;
      serviceConfig = {
        Type = "oneshot";
        ExecStart = "${pkgs.docker}/bin/docker exec -u www-data -d nextcloud-app-1 php occ preview:pre-generate";
      };
    };
    nextcloud-backup = {
      enable = true;
      serviceConfig = {
        Type = "oneshot";
        ExecStart = "/home/chris/bin/nextcloud/backup.sh";
      };
    };
    photoprism-index = {
      enable = true;
      serviceConfig = {
        Type = "oneshot";
        ExecStart = "${pkgs.docker}/bin/docker exec -d photoprism-photoprism-1 photoprism index";
      };
    };
  };

  systemd.timers = {
    nextcloud-cron = {
      enable = true;
      partOf = ["nextcloud-cron.service"];
      timerConfig = {
        OnStartupSec = "2min";
        OnUnitActiveSec = "5min";
        Unit = "nextcloud-cron.service";
      };
      wantedBy = [ "timers.target" ];
    };
    nextcloud-previews = {
      enable = true;
      partOf = ["nextcloud-previews.service"];
      timerConfig = {
        OnCalendar = "*-*-* 00:02:30";
        Unit = "nextcloud-previews.service";
      };
      wantedBy = [ "timers.target" ];
    };
    nextcloud-backup = {
      enable = true;
      partOf = ["nextcloud-backup.service"];
      timerConfig = {
        OnCalendar = "*-*-* 00:00:30";
        Unit = "nextcloud-backup.service";
      };
      wantedBy = [ "timers.target" ];
    };
    photoprism-index = {
      enable = true;
      partOf = ["photoprism-index.service"];
      timerConfig = {
        OnStartupSec = "2min";
        OnUnitActiveSec = "15min";
        Unit = "photoprism-index.service";
      };
      wantedBy = [ "timers.target" ];
    };
  };

  # Open ports in the firewall.
  # networking.firewall.allowedTCPPorts = [ ... ];
  # networking.firewall.allowedUDPPorts = [ ... ];
  # Or disable the firewall altogether.
  networking.firewall.enable = false;

  # Copy the NixOS configuration file and link it from the resulting system
  # (/run/current-system/configuration.nix). This is useful in case you
  # accidentally delete configuration.nix.
  # system.copySystemConfiguration = true;

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "22.05"; # Did you read the comment?

}