nixos-hypervisor/flake.nix

{
  description = "A simple system flake using some Aux defaults";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
    home-manager = {
      url = "github:nix-community/home-manager/release-24.11";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    microvm = {
      url = "github:astro/microvm.nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    agenix.url = "github:yaxitech/ragenix";
  };

  outputs = inputs @ {
    self,
    nixpkgs,
    home-manager,
    microvm,
    agenix,
    ...
  }: let
    system = "x86_64-linux";
    username = "tbarnouin";
    proxy_host = "192.168.1.40";
    pgsql_host = "192.168.1.13";
  in {
    nixosConfigurations = {
      nixmox-curiosity = nixpkgs.lib.nixosSystem {
        inherit system;
        modules = [
          agenix.nixosModules.default
          ./hosts/nixmox-curiosity/configuration.nix
          {
            networking.hostName = "nixmox-curiosity";
          }
          home-manager.nixosModules.home-manager
          {
            home-manager.useGlobalPkgs = true;
            home-manager.useUserPackages = true;
            home-manager.users.${username} = import ./hosts/nixmox-curiosity/home.nix;
          }
          microvm.nixosModules.host
          {
            microvm = {
              autostart = [];
              vms = {};
            };
          }
        ];

        specialArgs = {
          inherit inputs;
          inherit username;
          inherit proxy_host;
          inherit pgsql_host;
          inherit system;
        };
      };
      nginx = nixpkgs.lib.nixosSystem {
        inherit system;
        modules = [
          agenix.nixosModules.default
          "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"
          "${inputs.self}/systems/minimalLXCConfig.nix"
          "${inputs.self}/services"
          "${inputs.self}/modules"
          {
            networking.hostName = "nginx";
            services = {
              vm_nginx = {
                enable = true;
              };
              crowdsec-firewall-bouncer = {
                enable = true;
              };
              crowdsec = {
                enable = true;
                autoUpdateService = false;
                settings = {
                  general = {
                    api = {
                      server = {
                        enable = false;
                      };
                    };
                    prometheus.listen_addr = "0.0.0.0";
                  };
                };
                hub.collections = [
                  "firix/authentik"
                  "crowdsecurity/sshd"
                  "crowdsecurity/linux"
                  "crowdsecurity/nginx"
                  "LePresidente/grafana"
                  "LePresidente/jellyfin"
                  "crowdsecurity/http-cve"
                  "crowdsecurity/nextcloud"
                  "crowdsecurity/base-http-scenarios"
                ];
                localConfig = {
                  acquisitions = [
                    {
                      source = "journalctl";
                      journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
                      labels = {
                        type = "syslog";
                      };
                    }
                    {
                      source = "file";

                      labels = {
                        type = "syslog";
                      };
                    }
                  ];
                };
              };
            };
          }
        ];
      };
      pgsql = nixpkgs.lib.nixosSystem {
        inherit system;
        modules = [
          agenix.nixosModules.default
          "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"
          "${inputs.self}/systems/minimalLXCConfig.nix"
          "${inputs.self}/services"
          {
            networking.hostName = "pgsql";
            services.vm_postgresql = {
              enable = true;
            };
          }
        ];
      };
      onlyoffice = nixpkgs.lib.nixosSystem {
        inherit system;
        modules = [
          agenix.nixosModules.default
          "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"
          "${inputs.self}/systems/minimalLXCConfig.nix"
          "${inputs.self}/services"
          {
            networking.hostName = "onlyoffice";
            services.vm_onlyoffice = {
              enable = true;
              pgsql_ip = pgsql_host;
            };
          }
        ];
      };
      collabora = nixpkgs.lib.nixosSystem {
        inherit system;
        modules = [
          agenix.nixosModules.default
          "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"
          "${inputs.self}/systems/minimalLXCConfig.nix"
          "${inputs.self}/services"
          {
            networking.hostName = "collabora";
            services.vm_collabora = {
              enable = true;
            };
          }
        ];
      };
      forgejo = nixpkgs.lib.nixosSystem {
        inherit system;
        modules = [
          agenix.nixosModules.default
          "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"
          "${inputs.self}/systems/minimalLXCConfig.nix"
          "${inputs.self}/services"
          {
            networking.hostName = "forgejo";
            services.vm_forgejo = {
              enable = true;
              pgsql_ip = pgsql_host;
            };
          }
        ];
      };
#      template = nixpkgs.lib.nixosSystem {
#        inherit system;
#        modules = [
#          agenix.nixosModules.default
#          "${inputs.self}/systems/minimalVMConfig.nix"
#          {
#            networking.hostName = "nixos";
#          }
#        ];
#      };
      jellyfin = nixpkgs.lib.nixosSystem {
        inherit system;
        modules = [
          agenix.nixosModules.default
          microvm.nixosModules.microvm
          "${inputs.self}/systems/minimalVMConfig.nix"
          "${inputs.self}/services"
          {
            services.vm_jellyfin = {
              enable = true;
            };
          }
        ];
      };
      redis = nixpkgs.lib.nixosSystem {
        inherit system;
        modules = [
          agenix.nixosModules.default
          "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"
          "${inputs.self}/systems/minimalLXCConfig.nix"
          "${inputs.self}/services"
          {
            networking.hostName = "redis";
            services.vm_redis = {
              enable = true;
            };
          }
        ];
      };
      grafana-lxc = nixpkgs.lib.nixosSystem {
        inherit system;
        modules = [
          agenix.nixosModules.default
          "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"
          "${inputs.self}/systems/minimalLXCConfig.nix"
          "${inputs.self}/services"
          {
            services.vm_grafana = {
              enable = true;
              vm_ip = "192.168.1.27";
              proxy_ip = proxy_host;
              pgsql_ip = pgsql_host;
            };
          }
        ];
      };
      grafana = nixpkgs.lib.nixosSystem {
        inherit system;
        modules = [
          agenix.nixosModules.default
          microvm.nixosModules.microvm
          "${inputs.self}/systems/minimalMicrovmConfig.nix"
          "${inputs.self}/services"
          {
            services.vm_grafana = {
              enable = true;
              vm_ip = "192.168.1.27";
              proxy_ip = proxy_host;
              pgsql_ip = pgsql_host;
            };
            services.micro_vm = {
              enable = true;
              hostname = "grafana";
              vm_ip = "192.168.1.20";
              vm_cpu = 1;
              vm_mem = 512;
              macAddr = "02:00:00:00:00:20";
            };
          }
        ];
      };
    };
  };
}