homelab/hosts/neptun/configuration.nix

{ config, pkgs, lib, ... }:

# netcup VPS (UEFI, /dev/vda). Public reverse proxy + tailnet node.
{
  imports = [
    ./hardware-configuration.nix
    ./disk-config.nix          # disko: vda partitions + filesystems
    ./secrets.nix              # sops-nix: tailscale authkey
    ../../common.nix              # shared base: user / ssh / nix / firewall
    ../../services/network/caddy.nix
    ../../services/vpn/tailscale.nix
    ../../services/monitoring/node-exporter.nix
    ../../services/identity/authentik.nix
    ../../services/vpn/headscale.nix
    ../../services/vpn/headplane.nix
  ];

  # ---- Boot (UEFI) ----
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  # Root is on the virtio disk — pin these so stage-1 mounts it regardless of
  # what nixos-generate-config detects in the installer.
  boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_blk" "virtio_scsi" ];

  networking.hostName = "neptun";

  # 8 GB and no swap device (netcup gives one disk, disko takes all of it for
  # root). authentik's server + worker + postgres are the memory-hungry part;
  # zram is enough headroom at this size and costs no disk.
  zramSwap.enable = true;

  # ---- Static networking (netcup) ----
  # No LAN fallback: get this right or the box is unreachable (use netcup's
  # VNC console / rescue system to fix). Values captured from the running VPS.
  networking.useDHCP = false;
  networking.usePredictableInterfaceNames = false;   # keep the NIC named eth0
  networking.interfaces.eth0 = {
    ipv4.addresses = [ { address = "159.195.64.117"; prefixLength = 22; } ];
    ipv6.addresses = [ { address = "2a0a:4cc0:c2:19e1:44b4:8dff:fe4d:c7d7"; prefixLength = 64; } ];
  };
  networking.defaultGateway = { address = "159.195.64.1"; interface = "eth0"; };
  # Confirmed against `ip -6 route show default` on the VPS:
  #   default via fe80::1 dev eth0 metric 1024 onlink
  networking.defaultGateway6 = { address = "fe80::1"; interface = "eth0"; };
  networking.nameservers = [ "9.9.9.9" "1.1.1.1" "2620:fe::fe" ];
  # Addressing is fully static above, but netcup's router still sends periodic
  # RAs on this segment; the kernel then tries (and fails, since the static
  # route already exists) to install its own default route from them, spamming
  # "ndisc_router_discovery failed to add default route" on the console. Stop
  # it from processing RAs on eth0 at all rather than just live with the noise.
  boot.kernel.sysctl."net.ipv6.conf.eth0.accept_ra" = 0;

  # ---- Local split-DNS stub ----
  # neptun must NOT take the tailnet's DNS: headscale points every node at
  # pihole on mercury, and making a public reverse proxy's name resolution
  # depend on a Pi behind a domestic line would take ACME renewals — and so
  # the certs for the control server every node needs — down with it. It is
  # also circular, since tailscaled has to resolve vpn.mgaction.town to
  # connect in the first place.
  #
  # So neptun opts out with --accept-dns=false and does its own split DNS.
  # tailscaled still answers MagicDNS on 100.100.100.100 whenever it is
  # running (--accept-dns only governs whether it rewrites resolv.conf), so
  # dnsmasq forwards just the tailnet suffix there and everything else to the
  # public resolvers above. jupiter's address is therefore resolved live and
  # never pinned — nothing to update when the tailnet is rebuilt.
  #
  # resolveLocalQueries (default) points resolv.conf at 127.0.0.1 and feeds
  # networking.nameservers to dnsmasq as upstreams via resolvconf.
  services.tailscale.extraUpFlags = [ "--accept-dns=false" ];
  services.dnsmasq = {
    enable = true;
    settings.server = [ "/orbit.sol/100.100.100.100" ];
  };

  # firewall (enable + 22), caddy (80/443), tailscale (trust tailscale0 + join
  # headscale) come from ../../common.nix and ../../services/{caddy,tailscale}.nix.

  # ---- ACME account email ----
  # services.caddy.email would render the address into the world-readable
  # store, so pass it via EnvironmentFile and reference it with the Caddyfile
  # {$VAR} parse-time placeholder (see hosts/neptun/secrets.nix). globalConfig
  # is types.lines, so this appends to the module's own global block.
  services.caddy.environmentFile = config.sops.templates."caddy.env".path;
  services.caddy.globalConfig = "email {$ACME_EMAIL}";

  # ---- Public reverse proxy vhosts ----
  # Caddy gets automatic public HTTPS (Let's Encrypt) for real domains; the
  # *.mgaction.town wildcard already points every name here (A + AAAA), and
  # the module opens 80/443. All of these live on jupiter and are reached over
  # the tailnet by their MagicDNS name, which resolves because headscale no
  # longer overrides local DNS (see services/vpn/headscale.nix).

  # ---- Audiobookshelf ----
  services.caddy.virtualHosts."abs.mgaction.town".extraConfig = ''
    reverse_proxy http://jupiter.orbit.sol:8000
  '';

  # ---- Seerr ----
  services.caddy.virtualHosts."seerr.mgaction.town".extraConfig = ''
    reverse_proxy http://jupiter.orbit.sol:5055
  '';

  # ---- Jellyfin ----
  services.caddy.virtualHosts."jellyfin.mgaction.town".extraConfig = ''
    reverse_proxy http://jupiter.orbit.sol:8096
  '';

  # ---- Immich ----
  services.caddy.virtualHosts."immich.mgaction.town".extraConfig = ''
    reverse_proxy http://jupiter.orbit.sol:2283
  '';

  # ---- Obsidian LiveSync (CouchDB on jupiter) ----
  # Obsidian's mobile apps refuse cleartext HTTP and *.jupiter.sol cannot hold
  # a publicly trusted cert, so the vault database is published here instead of
  # staying on the LAN. That means a credentialed database on the open
  # internet; two things keep it sane:
  #
  #  1. The plugin's end-to-end encryption, switched on BEFORE the first sync.
  #     jupiter then stores only ciphertext, so a breach here is not a leak of
  #     the notes themselves.
  #  2. This allowlist. CouchDB serves far more than the replication API —
  #     Fauxton (/_utils), /_all_dbs, and /_node/_local/_config, the last of
  #     which REWRITES the server's config given admin credentials. Only the
  #     paths the plugin actually speaks are proxied; everything else is
  #     answered here and never reaches jupiter. Use the tailnet for the rest:
  #     `curl http://jupiter.orbit.sol:5984/_utils/`.
  #
  # ONE DATABASE PER VAULT, and the matcher keys off CouchDB's own naming rule
  # rather than listing them: every system endpoint begins with `_`, and a
  # user-creatable database never can (CouchDB requires a lowercase letter
  # first). So adding a vault needs no edit here. `_session` is the single
  # underscore path let through, for cookie auth.
  #
  # The flip side of not listing them: a mistyped but otherwise LEGAL database
  # name is proxied through and reaches CouchDB, which answers a real 404 the
  # plugin can report. An ILLEGAL one — anything starting with a capital or an
  # underscore — fails the matcher instead and gets caddy's 404, which carries
  # no CORS headers and surfaces in Obsidian as a connection failure with no
  # error message at all. If a new vault refuses to connect and the plugin
  # says nothing, check the database name is lowercase first.
  #
  # Never point two vaults at one database: LiveSync merges them into a single
  # file tree, which is not cleanly reversible.
  #
  # Known consequence: LiveSync's "Check database configuration" panel reads
  # /_node/_local/_config and so reports the server as unconfigured from
  # outside. Expected — that config is declarative in
  # services/dev/obsidian-livesync.nix and is not the plugin's to patch.
  #
  # `flush_interval -1` is required, not tuning: replication rides a
  # continuous _changes feed, which caddy would otherwise buffer — sync then
  # stalls until the buffer fills (same reason vpn.mgaction.town sets it).
  #
  # No netcup edge-firewall change: this rides the 443 the other vhosts
  # already use, unlike gitea's :2222.
  services.caddy.virtualHosts."notes.mgaction.town".extraConfig = ''
    @livesync path_regexp ^/(_session|[a-z][a-z0-9_$()+-]*)?(/.*)?$
    handle @livesync {
      reverse_proxy http://jupiter.orbit.sol:5984 {
        flush_interval -1
      }
    }
    handle {
      respond 404
    }
  '';

  # ---- Hermes dashboard ----
  # Authentik-gated (hosts/mars/hermes-agent.nix has the OIDC config and the
  # "create the Authentik app" instructions — moved here from jupiter).
  services.caddy.virtualHosts."hermes.mgaction.town".extraConfig = ''
    reverse_proxy http://mars.orbit.sol:9119
  '';

  # ---- Gitea WebUI ----
  # Gitea's web UI and HTTPS clones (services/dev/gitea.nix, HTTP_PORT 3000).
  # Its SSH side is the separate :2222 forward further down.
  services.caddy.virtualHosts."git.mgaction.town".extraConfig = ''
    reverse_proxy http://jupiter.orbit.sol:3000
  '';

  # ---- Gitea SSH forward ----
  # Caddy only proxies HTTP; forward :2222 over the tailnet to gitea's own
  # SSH server on jupiter (services/dev/gitea.nix), so
  # `ssh://git@git.mgaction.town:2222/...` works. Also needs a matching
  # inbound-2222 rule in netcup's edge firewall panel (not managed by Nix).
  systemd.services.gitea-ssh-forward = {
    description = "Forward :2222 to jupiter's gitea SSH server over tailscale";
    after = [ "network-online.target" "tailscaled.service" ];
    wants = [ "network-online.target" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      DynamicUser = true;
      ExecStart = "${pkgs.socat}/bin/socat TCP-LISTEN:2222,fork,reuseaddr TCP:jupiter.orbit.sol:2222";
      Restart = "always";
    };
  };
  networking.firewall.allowedTCPPorts = [ 2222 ];

  # ---- Authentik (identity/OIDC provider) ----
  # Runs locally on neptun (see services/identity/authentik.nix); Caddy just
  # terminates TLS and proxies to its loopback HTTP listener. Authentik serves
  # its UI and its OIDC endpoints from one port — no second frontend upstream,
  # and no h2c (it's plain HTTP/1.1, unlike Zitadel's gRPC).
  services.caddy.virtualHosts."auth.mgaction.town".extraConfig = ''
    reverse_proxy http://127.0.0.1:9000
  '';

  # ---- Headscale + Headplane (tailnet control server + its web UI) ----
  # Path-routed on one vhost: Headplane owns /admin* (uses `handle`, not
  # `handle_path`, since it needs the prefix kept in the forwarded path for
  # its own assets + OIDC callback); everything else goes to headscale.
  # `flush_interval -1`: headscale's node-update endpoint is a long-poll and
  # Caddy would otherwise buffer it, showing clients stale state.
  services.caddy.virtualHosts."vpn.mgaction.town".extraConfig = ''
    handle /admin* {
      reverse_proxy http://localhost:3000
    }
    handle {
      reverse_proxy http://localhost:8082 {
        flush_interval -1
      }
    }
  '';

  system.stateVersion = "26.05";   # set at install time; do NOT bump on upgrades
}