switched to flakes and built out modularity

modules/control.nix

@@ -0,0 +1,119 @@
+{ lib, ... }:
+
+with lib;
+
+{
+  options.control = {
+    homeassistant.enable = mkEnableOption "Home Assistant";
+
+    jellyfin.enable = mkEnableOption "Jellyfin";
+
+    gitea.enable = mkEnableOption "Gitea";
+
+    navidrome = {
+      enable = mkEnableOption "Navidrome";
+
+      musicFolder = mkOption {
+        type = types.str;
+        default = "/srv/navidrome/music";
+        description = "Folder containing music files.";
+      };
+
+      dataFolder = mkOption {
+        type = types.str;
+        default = "/srv/navidrome/data";
+        description = "Folder for Navidrome state/data.";
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 4533;
+        description = "Navidrome listen port.";
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Open Navidrome port in firewall.";
+      };
+    };
+
+    vaultwarden = {
+      enable = mkEnableOption "Vaultwarden";
+
+      domain = mkOption {
+        type = types.str;
+        default = "http://vaultwarden.local";
+        description = "External URL used by Vaultwarden.";
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 8222;
+        description = "Vaultwarden listen port.";
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Open Vaultwarden port in firewall.";
+      };
+    };
+
+    nextcloud = {
+      enable = mkEnableOption "Nextcloud";
+
+      hostName = mkOption {
+        type = types.str;
+        default = "nextcloud.local";
+        description = "Hostname served by Nextcloud.";
+      };
+
+      adminPassFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = "Path to file containing Nextcloud admin password.";
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Open HTTP(S) ports used by Nextcloud.";
+      };
+    };
+
+    k3s = {
+      enable = mkEnableOption "k3s";
+
+      role = mkOption {
+        type = types.enum [ "server" "agent" ];
+        default = "server";
+        description = "k3s node role.";
+      };
+
+      clusterInit = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Initialize a new k3s cluster on this node.";
+      };
+
+      serverAddr = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = "k3s server address for joining an existing cluster.";
+      };
+
+      tokenFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = "Path to file containing shared k3s token.";
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Open k3s ports in the firewall.";
+      };
+    };
+  };
+}

modules/services/gitea.nix

@@ -0,0 +1,22 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.control.gitea;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.gitea = {
+      enable = true;
+      settings = {
+        server = {
+          HTTP_PORT = 3000;
+          DOMAIN = "gitea.local";
+          ROOT_URL = "http://gitea.local:3000/";
+        };
+        service.DISABLE_REGISTRATION = true;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 3000 ];
+  };
+}

modules/services/homeassistant.nix

@@ -0,0 +1,27 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.control.homeassistant;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.home-assistant = {
+      enable = true;
+
+      extraComponents = [
+        "analytics"
+        "google_translate"
+        "met"
+        "radio_browser"
+        "shopping_list"
+        "isal"
+      ];
+
+      config = {
+        default_config = {};
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 8123 ];
+  };
+}

modules/services/jellyfin.nix

@@ -0,0 +1,12 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.control.jellyfin;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.jellyfin.enable = true;
+
+    networking.firewall.allowedTCPPorts = [ 8096 ];
+  };
+}

modules/services/k3s.nix

@@ -0,0 +1,21 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.control.k3s;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.k3s = {
+      enable = true;
+      role = cfg.role;
+      clusterInit = cfg.clusterInit;
+      serverAddr = cfg.serverAddr;
+      tokenFile = cfg.tokenFile;
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ 6443 2379 2380 ];
+      allowedUDPPorts = [ 8472 ];
+    };
+  };
+}

modules/services/navidrome.nix

@@ -0,0 +1,20 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.control.navidrome;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.navidrome = {
+      enable = true;
+      settings = {
+        Address = "0.0.0.0";
+        Port = cfg.port;
+        MusicFolder = cfg.musicFolder;
+        DataFolder = cfg.dataFolder;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.port ];
+  };
+}

modules/services/nextcloud.nix

@@ -0,0 +1,31 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.control.nextcloud;
+in
+{
+  assertions = [
+    {
+      assertion = (!cfg.enable) || (cfg.adminPassFile != null);
+      message = "control.nextcloud.adminPassFile must be set when Nextcloud is enabled.";
+    }
+  ];
+
+  config = lib.mkIf cfg.enable {
+    services.nextcloud = {
+      enable = true;
+      hostName = cfg.hostName;
+      https = false;
+      config = {
+        dbtype = "sqlite";
+        adminuser = "admin";
+        adminpassFile = cfg.adminPassFile;
+      };
+      settings = {
+        trusted_domains = [ cfg.hostName ];
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ 80 443 ];
+  };
+}

modules/services/vaultwarden.nix

@@ -0,0 +1,20 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.control.vaultwarden;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.vaultwarden = {
+      enable = true;
+      config = {
+        DOMAIN = cfg.domain;
+        ROCKET_ADDRESS = "0.0.0.0";
+        ROCKET_PORT = cfg.port;
+        SIGNUPS_ALLOWED = false;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.port ];
+  };
+}