diff options
Diffstat (limited to 'hosts')
| -rw-r--r-- | hosts/poweredge-pro/configuration.nix | 1 | ||||
| -rw-r--r-- | hosts/poweredge-pro/dhcp-hosts.nix | 1 | ||||
| -rw-r--r-- | hosts/poweredge-pro/embedtube.nix | 43 | ||||
| -rw-r--r-- | hosts/poweredge-pro/resources/secrets/embedtube.yaml | 16 |
4 files changed, 61 insertions, 0 deletions
diff --git a/hosts/poweredge-pro/configuration.nix b/hosts/poweredge-pro/configuration.nix index 23b16f8..483b14e 100644 --- a/hosts/poweredge-pro/configuration.nix +++ b/hosts/poweredge-pro/configuration.nix @@ -1,6 +1,7 @@ { config, lib, pkgs, ... }: { imports = [ ./dns.nix + ./embedtube.nix ./filebrowser.nix ./fileshares.nix ./key.nix diff --git a/hosts/poweredge-pro/dhcp-hosts.nix b/hosts/poweredge-pro/dhcp-hosts.nix index 3f97e29..6ca6ca7 100644 --- a/hosts/poweredge-pro/dhcp-hosts.nix +++ b/hosts/poweredge-pro/dhcp-hosts.nix @@ -13,6 +13,7 @@ let tjkeller = { macAddress = "00:a0:98:62:cf:86"; staticIp = "192.168.77.8"; }; filebrowser = { macAddress = "02:00:00:00:77:12"; staticIp = "192.168.77.12"; }; searxng = { macAddress = "02:00:00:00:77:13"; staticIp = "192.168.77.13"; }; + embedtube = { macAddress = "02:00:00:00:77:14"; staticIp = "192.168.77.14"; }; WIN-BGBGC27B1PF = { macAddress = "d8:9e:f3:1c:f0:1c"; staticIp = "192.168.77.30"; }; # DACS DESKTOP-CQ4UIF9 = { macAddress = "08:bf:b8:3f:bd:48"; staticIp = "192.168.77.31"; }; # Kyle WIN-6FVMAFOID4G = { macAddress = "00:a0:98:58:10:85"; staticIp = "192.168.77.33"; }; # QB diff --git a/hosts/poweredge-pro/embedtube.nix b/hosts/poweredge-pro/embedtube.nix new file mode 100644 index 0000000..12d375e --- /dev/null +++ b/hosts/poweredge-pro/embedtube.nix @@ -0,0 +1,43 @@ +{ config, pkgs, inputs, ... }: { + # Secrets + sops.secrets.embedtube-api-key = { sopsFile = ./resources/secrets/embedtube.yaml; key = "api-key"; }; + + # Container + containers.embedtube = { + autoStart = true; + privateNetwork = true; + ephemeral = true; + hostBridge = "br-lan1"; + localMacAddress = "02:00:00:00:77:14"; + + bindMounts."/run/secrets/api-key" = { + hostPath = config.sops.secrets.embedtube-api-key.path; + isReadOnly = true; + }; + + config = { lib, pkg, config, ... }: { + # Import EmbedTube flake input + imports = [ inputs.embedtube.nixosModules.default ]; + + # Network + networking.interfaces.eth0.useDHCP = true; + networking.firewall.allowedTCPPorts = [ 80 ]; # Caddy (private + public) + + # EmbedTube + services.embedtube = { + enable = true; + apiKeyFile = "/run/secrets/api-key"; + }; + + # Reverse proxy + services.caddy = { + enable = true; + virtualHosts.":80".extraConfig = '' + reverse_proxy localhost:8080 + ''; + }; + + system.stateVersion = "26.05"; + }; + }; +} diff --git a/hosts/poweredge-pro/resources/secrets/embedtube.yaml b/hosts/poweredge-pro/resources/secrets/embedtube.yaml new file mode 100644 index 0000000..f75d6d5 --- /dev/null +++ b/hosts/poweredge-pro/resources/secrets/embedtube.yaml @@ -0,0 +1,16 @@ +api-key: ENC[AES256_GCM,data:F0/EBnAhFeJBMAG/D6gRNPwdsLy3HubjEp/Tw07s3dah+ZhWCC93,iv:nSVrGI11nx0vCtSWGbU2+vtEdQwOBihJWI8oM9sbT0o=,tag:GbsNXalVWarwmENpsFIfkA==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvTXc3S2M5dWVDbnZGRmhM + Qmo0SzM4K2tndldCYnlvZkhmYmgrdCtVSW00Cm1TVnAxdEV1V2lRN1Q1ZU5WSFRy + OXN1ZjVJMGkyL2JISlNnYURuNDZiblUKLS0tIEo4NXpHZ1BFZ29lZDhnS3RUcVh6 + eFplVVBBV011SUMwbTdzcHdDODJoQXMKjn9LtU7lK65pHW+Rcbbh8eXZgKnTe3TK + ZC/dtyBHc/esp93GiYAqMYRH9+6pfAZNNpko6PFqsVsN6eCzPrh05g== + -----END AGE ENCRYPTED FILE----- + recipient: age1q8l3g3t6qjhsmz0gju0n535pz45d2c9crla8jcd5ftjlqe4fs3eqfqay0k + lastmodified: "2026-09-22T22:34:40Z" + mac: ENC[AES256_GCM,data:7AsRul6ze58dzK00i1eA9fO4alCSXANQNaVb7mkVfcRQLr+llv/6cU1E67LnEDh4r5TMZt2L2zz4duP2uVHQP6lRG5dNUU7b3c7O/DJbLKvT7jDPxJdfPz2XZOFz1+NHCPNdhPkmuPWlIbffiw+yVA9kuS8iJJ8DS2rjTDR2/tE=,iv:rKemvVhEBluw2ZfxwlNVtQW49oLbVKdEHhrQ61e5t0M=,tag:rgCj6PPsZLkpqecPgVJ6Fw==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.3 |