update: system update & refactor

# Breaking Changes
- sops location movod to "system/dev/<dev-name>/sops/sops-conf.nix"
- flake devices declaration changes
- whole flake update

system/dev/dn-server/services/actual-budget.nix

@@ -0,0 +1,7 @@
+{
+  imports = [
+    (import ../../../modules/actual {
+      fqdn = "actual.net.dn";
+    })
+  ];
+}

system/dev/dn-server/services/bitwarden.nix

@@ -0,0 +1,7 @@
+{
+  imports = [
+    (import ../../../modules/vaultwarden.nix {
+      domain = "bitwarden.net.dn";
+    })
+  ];
+}

system/dev/dn-server/services/default.nix

@@ -0,0 +1,11 @@
+{
+  imports = [
+    ./actual-budget.nix
+    ./bitwarden.nix
+    ./docmost.nix
+    ./mail-server.nix
+    ./nextcloud.nix
+    ./paperless-ngx.nix
+    ./metrics.nix
+  ];
+}

system/dev/dn-server/services/docmost.nix

@@ -0,0 +1,12 @@
+{ config, ... }:
+{
+  imports = [
+    (import ../../../modules/docmost.nix {
+      fqdn = "docmost.net.dn";
+      extraConf = {
+        MAIL_DRIVER = "smtp";
+      };
+      envFile = config.sops.secrets."docmost".path;
+    })
+  ];
+}

system/dev/dn-server/services/mail-server.nix

@@ -0,0 +1,58 @@
+{ config, ... }:
+let
+  inherit (config.systemConf) username;
+in
+{
+  mail-server =
+    let
+      domain = "net.dn";
+    in
+    {
+      inherit domain;
+
+      enable = true;
+      openFirewall = true;
+      configureNginx = true;
+      hostname = "mx1";
+      extraDomains = [
+        "mail.${domain}"
+      ];
+      caFile = "" + ../../../extra/ca.crt;
+      rootAlias = "${username}";
+      networks = [
+        "127.0.0.0/8"
+        "10.0.0.0/24"
+      ];
+      virtual = ''
+        admin@${domain} ${username}@${domain}
+        postmaster@${domain} ${username}@${domain}
+      '';
+      webmail = {
+        enable = true;
+        hostname = "mail.${domain}";
+      };
+      keycloak = {
+        dbSecretFile = config.sops.secrets."oauth/password".path;
+        adminAccountFile = config.sops.secrets."oauth/adminEnv".path;
+      };
+      ldap = {
+        filter = "(&(objectClass=inetOrgPerson)(objectClass=mailRoutingObject)(uid=%{user | username}))";
+        extraAuthConf = ''
+          auth_username_format = %{user | lower}
+          fields {
+            user = %{ldap:mail}
+            password = %{ldap:userPassword}
+          }
+        '';
+        secretFile = config.sops.secrets."ldap/password".path;
+        webSecretFile = config.sops.secrets."ldap/env".path;
+      };
+      rspamd = {
+        secretFile = config.sops.secrets."rspamd".path;
+        trainerSecretFile = config.sops.secrets."rspamd-trainer".path;
+      };
+      dovecot.oauth = {
+        enable = true;
+      };
+    };
+}

system/dev/dn-server/services/metrics.nix

@@ -0,0 +1,157 @@
+{
+  config,
+  lib,
+  helper,
+  pkgs,
+  ...
+}:
+let
+  inherit (helper.grafana) mkDashboard;
+  inherit (lib) optionalAttrs;
+  inherit (config.networking) hostName;
+
+  datasourceTemplate = [
+    {
+      current = {
+        text = "Prometheus";
+        value = "prometheus-dn-server";
+      };
+      label = "DS_PROMETHEUS";
+      name = "DS_PROMETHEUS";
+      options = [ ];
+      query = "prometheus";
+      refresh = 1;
+      regex = "";
+      type = "datasource";
+    }
+  ];
+
+  crowdsecSrc = fetchTarball {
+    url = "https://github.com/crowdsecurity/grafana-dashboards/archive/c89d8476b32ea76e924c488db7d0afd0306fc609.tar.gz";
+    sha256 = "sha256:1s7v03hzss22dkl3hw9qf0qc86qn98wx8x13rvy73wc5mgxv9wnk";
+  };
+
+  crowdsecDashboard = mkDashboard {
+    name = "crowdsec";
+    src = "${crowdsecSrc}/dashboards_v5";
+    templateList = datasourceTemplate;
+  };
+
+  pdnsRecursorSrc = pkgs.fetchurl {
+    name = "pdns-recursor-grafana-dashboard.json";
+    url = "https://grafana.com/api/dashboards/20448/revisions/3/download";
+    sha256 = "sha256-8lgo+A3dnFLanhGJWCKAo/iPYSMiove17xvMolgq9nI=";
+  };
+
+  pdnsRecursorDashboard = mkDashboard {
+    name = "pdns-recursor";
+    src = "${pdnsRecursorSrc}";
+    templateList = datasourceTemplate;
+    conf = {
+      dontUnpack = true;
+    };
+  };
+in
+{
+  imports = [
+    (import ../../../modules/prometheus.nix {
+      fqdn = "metrics.net.dn";
+      selfMonitor = true;
+      configureNginx = true;
+      scrapes = [
+        (optionalAttrs config.services.pdns-recursor.enable {
+          job_name = "powerdns_recursor";
+          static_configs = [
+            {
+              targets = [ "localhost:${toString config.services.pdns-recursor.api.port}" ];
+              labels = {
+                machine = "${hostName}";
+              };
+            }
+          ];
+          relabel_configs = [
+            {
+              source_labels = [ "__address__" ];
+              target_label = "instance";
+              regex = "(.*):[0-9]+";
+              replacement = "PDNS Recursor - \${1}";
+            }
+          ];
+        })
+        (optionalAttrs config.services.crowdsec.settings.general.prometheus.enabled {
+          job_name = "crowdsec";
+          static_configs = [
+            {
+              targets = [
+                "localhost:${toString config.services.crowdsec.settings.general.prometheus.listen_port}"
+              ];
+              labels = {
+                machine = "${hostName}";
+              };
+            }
+          ];
+          relabel_configs = [
+            {
+              source_labels = [ "__address__" ];
+              target_label = "instance";
+              regex = "(.*):[0-9]+";
+              replacement = "CrowdSec - \${1}";
+            }
+          ];
+        })
+      ];
+    })
+
+    (import ../../../modules/grafana.nix {
+      domain = "grafana.net.dn";
+      passFile = config.sops.secrets."grafana/password".path;
+      smtpHost = "${config.mail-server.hostname}.${config.mail-server.domain}:465";
+      smtpDomain = config.mail-server.domain;
+      extraSettings = {
+        "auth.generic_oauth" =
+          let
+            OIDCBaseUrl = "https://keycloak.net.dn/realms/master/protocol/openid-connect";
+          in
+          {
+            enabled = true;
+            allow_sign_up = true;
+            client_id = "grafana";
+            client_secret = ''$__file{${config.sops.secrets."grafana/client_secret".path}}'';
+            scopes = "openid email profile offline_access roles";
+            email_attribute_path = "email";
+            login_attribute_path = "username";
+            name_attribute_path = "username";
+            auth_url = "${OIDCBaseUrl}/auth";
+            token_url = "${OIDCBaseUrl}/token";
+            api_url = "${OIDCBaseUrl}/userinfo";
+            role_attribute_path = "contains(roles[*], 'admin') && 'Admin' || contains(roles[*], 'editor') && 'Editor' || 'Viewer'";
+          };
+      };
+      extraConf = {
+        provision.datasources.settings = {
+          prune = true;
+          datasources = [
+            {
+              uid = "prometheus-dn-server";
+              name = "Prometheus";
+              url = "https://metrics.net.dn";
+              type = "prometheus";
+            }
+          ];
+        };
+        provision.dashboards.settings.providers = [
+          {
+            name = "CrowdSec";
+            type = "file";
+            options.path = "${crowdsecDashboard}";
+          }
+          {
+            name = "PDNSRecursor";
+            type = "file";
+            options.path = "${pdnsRecursorDashboard}";
+          }
+        ];
+      };
+    })
+  ];
+}

system/dev/dn-server/services/nextcloud.nix

@@ -0,0 +1,11 @@
+{ config, ... }:
+{
+  imports = [
+    (import ../../../modules/nextcloud.nix {
+      hostname = "nextcloud.net.dn";
+      adminpassFile = config.sops.secrets."nextcloud/adminPassword".path;
+      trusted-domains = [ "nextcloud.daccc.info" ];
+      trusted-proxies = [ "10.0.0.0/24" ];
+    })
+  ];
+}

system/dev/dn-server/services/paperless-ngx.nix

@@ -0,0 +1,9 @@
+{ config, ... }:
+{
+  imports = [
+    (import ../../../modules/paperless-ngx.nix {
+      domain = "paperless.net.dn";
+      passwordFile = config.sops.secrets."paperless/adminPassword".path;
+    })
+  ];
+}