manatee: Add home-assistant module

hosts/manatee/modules/calibre-web/default.nix

@@ -29,19 +29,6 @@ in
           enableBookUploading = true;
         };
       };
-
-      nginx = {
-        virtualHosts."books.ppp.pm" = {
-
-          extraConfig = ''
-            client_max_body_size 1024M;
-          '';
-
-          locations."/" = {
-            proxyPass = "http://0.0.0.0:8083"; # TODO add option for port + host
-          };
-        };
-      };
     };
   };
 }

hosts/manatee/modules/certs/default.nix

@@ -0,0 +1,31 @@
+{ config, ... }:
+{
+  security.acme = {
+    acceptTerms = true;
+
+    defaults = {
+      email = "acme@ppp.pm";
+    };
+
+    certs = {
+      "ha.ppp.pm" = {
+        dnsProvider = "hetzner";
+        environmentFile = config.age.secrets.hetzner-dns.path;
+        group = "nginx";
+
+        extraLegoFlags = [
+          "--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
+          "--dns.propagation-wait=60s" # Wait for 60 seconds for DNS propagation
+          "--dns-timeout=60"
+          "--http-timeout=60"
+        ];
+      };
+    };
+  };
+
+  age = {
+    secrets = {
+      "hetzner-dns".file = ../../../../secrets/manatee/hetzner-dns.age;
+    };
+  };
+}

hosts/manatee/modules/default.nix

@@ -21,6 +21,7 @@ in
       jellyfin.enable = true;
       immich.enable = true;
       navidrome.enable = true;
+      komga.enable = true;
     };
   };
 }

hosts/manatee/modules/home-assistant/default.nix

@@ -0,0 +1,62 @@
+{ lib, config, ... }:
+let
+  nginxEnabled = config.mod.nginx.enable;
+in
+{
+  hardware.bluetooth.enable = true;
+
+  virtualisation.oci-containers = {
+    backend = "podman";
+
+    containers.homeassistant = {
+      image = "ghcr.io/home-assistant/home-assistant:stable";
+
+      volumes = [
+        "/home/alex/.config/home-assistant:/config"
+        # Pass in bluetooth
+        "/run/dbus:/run/dbus:ro"
+      ];
+
+      environment.TZ = "Europe/Stockholm";
+
+      extraOptions = [
+        "--network=host"
+
+        # Allows HA to perform low-level network operations (scan/reset adapter)
+        "--cap-add=NET_ADMIN"
+        "--cap-add=NET_RAW"
+
+        # Pass in Zigbee antenna
+        "--device=/dev/serial/by-id/usb-Nabu_Casa_ZBT-2_9C139EAAD464-if00:/dev/ttyACM0"
+      ];
+    };
+  };
+
+  services = {
+    blueman.enable = true;
+
+    nginx = lib.mkIf nginxEnabled {
+      recommendedProxySettings = true;
+
+      virtualHosts."ha.ppp.pm" = {
+        forceSSL = true;
+        useACMEHost = "ha.ppp.pm";
+
+        extraConfig = ''
+          proxy_buffering off;
+        '';
+
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:8123";
+          proxyWebsockets = true;
+        };
+      };
+    };
+  };
+
+  age = {
+    secrets = {
+      "hetzner-dns".file = ../../../../secrets/manatee/hetzner-dns.age;
+    };
+  };
+}

hosts/manatee/modules/komga/default.nix

@@ -0,0 +1,28 @@
+{ lib, config, ... }:
+let
+  enabled = config.mod.komga.enable;
+in
+{
+  options = {
+    mod.komga = {
+      enable = lib.mkEnableOption "Enable komga module";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    users.users.komga = {
+      isSystemUser = true;
+      group = "storage";
+    };
+
+    services.komga = {
+      enable = true;
+
+      user = "komga";
+      group = "storage";
+
+      settings.server.port = 8002;
+      openFirewall = true;
+    };
+  };
+}

hosts/manatee/modules/network/default.nix

@@ -3,6 +3,10 @@
   networking = {
     hostName = "manatee";
 
+    # Required for asymmetric routing (sending replies out a different interface
+    # than the default route). Without this, the kernel drops the return traffic.
+    firewall.checkReversePath = "loose";
+
     defaultGateway = "192.168.50.1";
     nameservers = [ "1.1.1.1" ];
     interfaces = {
@@ -16,7 +20,25 @@
             }
           ];
         };
+
+        ipv4.routes = [
+          {
+            address = "0.0.0.0";
+            prefixLength = 0;
+            via = "192.168.50.1"; # Router
+            options = {
+              table = "100";
+            };
+          }
+        ];
       };
     };
+
+    # Route packets from machines local IP back to router
+    localCommands = ''
+      # Add the rule only if it doesn't exist yet (idempotent)
+      ip rule list | grep -q "from 192.168.50.203 lookup 100" || \
+      ip rule add from 192.168.50.203 lookup 100 priority 5000
+    '';
   };
 }

hosts/manatee/modules/nginx/default.nix

@@ -18,5 +18,11 @@ in
         recommendedTlsSettings = true;
       };
     };
+
+    networking = {
+      firewall = {
+        allowedTCPPorts = [ 443 ];
+      };
+    };
   };
 }

secrets/manatee/hetzner-dns.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 wkRvNA mr8aDxrNmdcxT5BEXJ32Q4DckYKidh3zblrSm8GV3hg
+JngH+sfId8Z6SuXnQo9EQR0nw+y7LfdgYgI7SYisPL4
+-> ssh-ed25519 +oNaHQ QI1+VLIa1sN8HSzBXoAGio7TcfxpGERw30uNlMCmejw
+m3+nrTwsAb/Fg1p9JCYnc7jS9uteMO3AbUtDbKP60Dk
+--- etDNlalBL2SdgfFxIhDCAWXpXcSZr+BlCoTt6yIUiBQ
+èZw œ»ØÁëkáÂÎó4=UÉÜ:J
+ã–›½p#"ˆà^pŠî!KÚÔ
+¯’cŽC÷ô´cd¾·"g.óÒ¦ó¥_(ÄA% ¶Ýp<C39D>ÇÏGA2`CqÖPš¢<C5A1>P¾Ç$jåMººŒþ¾ƒ™_â

secrets/secrets.nix

@@ -34,6 +34,7 @@ in {
   "manatee/alex.manatee-git.ppp.pm.pub.age".publicKeys = [ manatee alex ];
   "manatee/syncthing-cert.age".publicKeys = [ manatee alex ];
   "manatee/syncthing-key.age".publicKeys = [ manatee alex ];
+  "manatee/hetzner-dns.age".publicKeys = [ manatee alex ];
 
   "backwards/root.backwards.age".publicKeys = [ backwards alex ];
   "backwards/root.backwards.pub.age".publicKeys = [ backwards alex ];