diff --git a/README.md b/README.md
index fc45502..7e6055c 100644
--- a/README.md
+++ b/README.md
@@ -46,12 +46,11 @@ I've included the major components in the lists below.
| ~~~~~~~~~~~~ | Service | Source | Description
---|---|---|---
-💸 Budgeting | Firefly III \& Firefly Pico | [Link](./hosts/ward/guests/firefly.nix) | Budgeting application to track income and expenses
🛡️ Adblock | AdGuard Home | [Link](./hosts/ward/guests/adguardhome.nix) | DNS level adblocker
🔒 SSO | Kanidm | [Link](./hosts/ward/guests/kanidm.nix) | Identity provider for Single-Sign-On on my hosted services, with provisioning.
🐙 Git | Forgejo | [Link](./hosts/ward/guests/forgejo.nix) | Forgejo with SSO
🔑 Passwords | Vaultwarden | [Link](./hosts/ward/guests/vaultwarden.nix) | Self-hosted password manager
-📷 Photos | Immich | [Link](./hosts/sire/guests/immich.nix) | Self-hosted photo and video backup solution
+📷 Photos | Ente | [Link](./hosts/sire/guests/ente.nix) | E2E encrypted photo and video backup solution
📄 Documents | Paperless | [Link](./hosts/sire/guests/paperless.nix) | Document management system. With per-user Samba share integration (consume & archive)
🗓️ CalDAV/CardDAV | Radicale | [Link](./hosts/ward/guests/radicale.nix) | Contacts, Calender and Tasks synchronization
📁 NAS | Samba | [Link](./hosts/sire/guests/samba.nix) | Network attached storage. Cross-integration with paperless
diff --git a/config/users.nix b/config/users.nix
index bf62d6d..b0c161f 100644
--- a/config/users.nix
+++ b/config/users.nix
@@ -43,8 +43,8 @@
unifi = uidGid 968;
plugdev.gid = 967;
tss = uidGid 966;
- firefly-iii = uidGid 965;
- firefly-pico = uidGid 964;
+ # firefly-iii = uidGid 965;
+ # firefly-pico = uidGid 964;
avahi = uidGid 963;
};
}
diff --git a/hosts/kroma/default.nix b/hosts/kroma/default.nix
index 53a7361..2df3790 100644
--- a/hosts/kroma/default.nix
+++ b/hosts/kroma/default.nix
@@ -91,9 +91,6 @@
programs.nix-ld.enable = true;
topology.self.icon = "devices.desktop";
- # Mainly for client-side formatting in websites like firefly-iii
- i18n.supportedLocales = [ "de_DE.UTF-8/UTF-8" ];
-
hardware.nvidia-container-toolkit.enable = true;
virtualisation.containers.enable = true;
virtualisation.podman = {
diff --git a/hosts/sentinel/firezone.nix b/hosts/sentinel/firezone.nix
index 674b72f..dceb1a8 100644
--- a/hosts/sentinel/firezone.nix
+++ b/hosts/sentinel/firezone.nix
@@ -12,8 +12,7 @@ let
# FIXME: new entry here? make new firezone gateway on ward entry too.
homeDomains = [
globals.services.grafana.domain
- globals.services.firefly.domain
- globals.services.firefly-pico.domain
+ globals.services.ente.domain
globals.services.immich.domain
globals.services.influxdb.domain
globals.services.loki.domain
diff --git a/hosts/sire/default.nix b/hosts/sire/default.nix
index 960c27e..277d7e1 100644
--- a/hosts/sire/default.nix
+++ b/hosts/sire/default.nix
@@ -150,7 +150,7 @@
}
// mkMicrovm "ai" { }
// mkMicrovm "minecraft" { }
- #// mkMicrovm "firefly" {}
+ // mkMicrovm "ente" { }
#// mkMicrovm "fasten-health" {}
);
}
diff --git a/hosts/ward/default.nix b/hosts/ward/default.nix
index f69e832..b5207b7 100644
--- a/hosts/ward/default.nix
+++ b/hosts/ward/default.nix
@@ -13,8 +13,7 @@ let
# FIXME: new entry here? make new firezone entry too.
homeDomains = [
globals.services.grafana.domain
- globals.services.firefly.domain
- globals.services.firefly-pico.domain
+ globals.services.ente.domain
globals.services.immich.domain
globals.services.influxdb.domain
globals.services.loki.domain
@@ -135,7 +134,6 @@ in
lib.mkIf (!minimal) (
{ }
// mkMicrovm "adguardhome"
- // mkMicrovm "firefly"
// mkMicrovm "forgejo"
// mkMicrovm "kanidm"
// mkMicrovm "radicale"
diff --git a/hosts/ward/guests/adguardhome.nix b/hosts/ward/guests/adguardhome.nix
index fe00c8b..f7b6bbd 100644
--- a/hosts/ward/guests/adguardhome.nix
+++ b/hosts/ward/guests/adguardhome.nix
@@ -112,8 +112,7 @@ in
# FIXME: new entry here? make new firezone entry too.
# FIXME: new entry here? make new firezone gateway on ward entry too.
globals.services.grafana.domain
- globals.services.firefly.domain
- globals.services.firefly-pico.domain
+ globals.services.ente.domain
globals.services.immich.domain
globals.services.influxdb.domain
globals.services.loki.domain
diff --git a/hosts/ward/guests/firefly.nix b/hosts/ward/guests/firefly.nix
deleted file mode 100644
index ab43289..0000000
--- a/hosts/ward/guests/firefly.nix
+++ /dev/null
@@ -1,166 +0,0 @@
-{
- config,
- globals,
- nodes,
- ...
-}:
-let
- fireflyDomain = "firefly.${globals.domains.me}";
- fireflyPicoDomain = "firefly-pico.${globals.domains.me}";
- wardWebProxyCfg = nodes.ward-web-proxy.config;
-in
-{
- wireguard.proxy-home = {
- client.via = "ward";
- firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [ 80 ];
- };
-
- globals.services.firefly.domain = fireflyDomain;
- globals.services.firefly-pico.domain = fireflyPicoDomain;
- globals.monitoring.http.firefly = {
- url = "https://${fireflyDomain}";
- expectedBodyRegex = "Firefly III";
- network = "home-lan.vlans.services";
- };
- globals.monitoring.http.firefly-pico = {
- url = "https://${fireflyPicoDomain}";
- expectedBodyRegex = "Pico";
- network = "home-lan.vlans.services";
- };
-
- age.secrets.firefly-iii-app-key = {
- generator.script = _: ''
- echo "base64:$(head -c 32 /dev/urandom | base64)"
- '';
- owner = "firefly-iii";
- };
-
- age.secrets.firefly-pico-app-key = {
- generator.script = _: ''
- echo "base64:$(head -c 32 /dev/urandom | base64)"
- '';
- owner = "firefly-pico";
- };
-
- environment.persistence."/persist".directories = [
- {
- directory = "/var/lib/firefly-iii";
- user = "firefly-iii";
- }
- {
- directory = "/var/lib/firefly-pico";
- user = "firefly-pico";
- }
- ];
-
- networking.hosts.${wardWebProxyCfg.wireguard.proxy-home.ipv4} = [
- globals.services.firefly.domain
- globals.services.firefly-pico.domain
- ];
-
- i18n.supportedLocales = [ "all" ];
- services.firefly-iii = {
- enable = true;
- enableNginx = true;
- virtualHost = globals.services.firefly.domain;
- settings = {
- AUDIT_LOG_LEVEL = "emergency"; # disable audit logs
- LOG_CHANNEL = "syslog";
- APP_URL = "https://${globals.services.firefly.domain}";
- TZ = "Europe/Berlin";
- TRUSTED_PROXIES = wardWebProxyCfg.wireguard.proxy-home.ipv4;
- SITE_OWNER = "admin@${globals.domains.me}";
- APP_KEY_FILE = config.age.secrets.firefly-iii-app-key.path;
- };
- };
-
- services.firefly-pico = {
- enable = true;
- enableNginx = true;
- virtualHost = globals.services.firefly-pico.domain;
- settings = {
- LOG_CHANNEL = "syslog";
- APP_URL = "https://${globals.services.firefly-pico.domain}";
- TZ = "Europe/Berlin";
- FIREFLY_URL = config.services.firefly-iii.settings.APP_URL;
- TRUSTED_PROXIES = wardWebProxyCfg.wireguard.proxy-home.ipv4;
- SITE_OWNER = "admin@${globals.domains.me}";
- APP_KEY_FILE = config.age.secrets.firefly-pico-app-key.path;
- };
- };
-
- services.nginx.commonHttpConfig = ''
- log_format json_combined escape=json '{'
- '"time": $msec,'
- '"remote_addr":"$remote_addr",'
- '"status":$status,'
- '"method":"$request_method",'
- '"host":"$host",'
- '"uri":"$request_uri",'
- '"request_size":$request_length,'
- '"response_size":$body_bytes_sent,'
- '"response_time":$request_time,'
- '"referrer":"$http_referer",'
- '"user_agent":"$http_user_agent"'
- '}';
- error_log syslog:server=unix:/dev/log,nohostname;
- access_log syslog:server=unix:/dev/log,nohostname json_combined;
- ssl_ecdh_curve secp384r1;
- '';
-
- nodes.ward-web-proxy = {
- services.nginx = {
- upstreams.firefly = {
- servers."${config.wireguard.proxy-home.ipv4}:80" = { };
- extraConfig = ''
- zone firefly 64k;
- keepalive 2;
- '';
- monitoring = {
- enable = true;
- expectedBodyRegex = "Firefly";
- };
- };
- virtualHosts.${fireflyDomain} = {
- forceSSL = true;
- useACMEWildcardHost = true;
- locations."/" = {
- proxyPass = "http://firefly";
- proxyWebsockets = true;
- };
- extraConfig = ''
- # allow self-access
- allow ${config.wireguard.proxy-home.ipv4};
- allow ${config.wireguard.proxy-home.ipv6};
- # allow home traffic
- allow ${globals.net.home-lan.vlans.home.cidrv4};
- allow ${globals.net.home-lan.vlans.home.cidrv6};
- # Firezone traffic
- allow ${globals.net.home-lan.vlans.services.hosts.ward.ipv4};
- allow ${globals.net.home-lan.vlans.services.hosts.ward.ipv6};
- deny all;
- '';
- };
- virtualHosts.${fireflyPicoDomain} = {
- forceSSL = true;
- useACMEWildcardHost = true;
- locations."/" = {
- proxyPass = "http://firefly";
- proxyWebsockets = true;
- };
- extraConfig = ''
- # allow self-access
- allow ${config.wireguard.proxy-home.ipv4};
- allow ${config.wireguard.proxy-home.ipv6};
- # allow home traffic
- allow ${globals.net.home-lan.vlans.home.cidrv4};
- allow ${globals.net.home-lan.vlans.home.cidrv6};
- # Firezone traffic
- allow ${globals.net.home-lan.vlans.services.hosts.ward.ipv4};
- allow ${globals.net.home-lan.vlans.services.hosts.ward.ipv6};
- deny all;
- '';
- };
- };
- };
-}
diff --git a/hosts/ward/secrets/firefly/host.pub b/hosts/ward/secrets/firefly/host.pub
deleted file mode 100644
index 97cc759..0000000
--- a/hosts/ward/secrets/firefly/host.pub
+++ /dev/null
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK9bxRVB7zpCZhwfIwr7oyuNy0Tfu1Ki3KWPNiFyQizH
diff --git a/modules/default.nix b/modules/default.nix
index fc7701e..fe00f12 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -4,7 +4,6 @@
./backups.nix
./deterministic-ids.nix
./distributed-config.nix
- ./firefly-pico.nix
./globals.nix
./meta.nix
./nginx-upstream-monitoring.nix
diff --git a/modules/firefly-pico.nix b/modules/firefly-pico.nix
deleted file mode 100644
index e86c92c..0000000
--- a/modules/firefly-pico.nix
+++ /dev/null
@@ -1,410 +0,0 @@
-{
- pkgs,
- config,
- lib,
- ...
-}:
-
-let
- cfg = config.services.firefly-pico;
-
- inherit (cfg) user;
- inherit (cfg) group;
-
- defaultUser = "firefly-pico";
- defaultGroup = "firefly-pico";
-
- artisan = "${cfg.package}/share/php/firefly-pico/artisan";
-
- env-file-values = lib.attrsets.mapAttrs' (
- n: v: lib.attrsets.nameValuePair (lib.strings.removeSuffix "_FILE" n) v
- ) (lib.attrsets.filterAttrs (n: _v: lib.strings.hasSuffix "_FILE" n) cfg.settings);
- env-nonfile-values = lib.attrsets.filterAttrs (
- n: _v: !lib.strings.hasSuffix "_FILE" n
- ) cfg.settings;
-
- firefly-pico-maintenance = pkgs.writeShellScript "firefly-pico-maintenance.sh" ''
- set -a
- ${lib.strings.toShellVars env-nonfile-values}
- ${lib.strings.concatLines (
- lib.attrsets.mapAttrsToList (n: v: "${n}=\"$(< ${v})\"") env-file-values
- )}
- set +a
- ${lib.optionalString (
- cfg.settings.DB_CONNECTION == "sqlite"
- ) "touch ${cfg.dataDir}/storage/database/database.sqlite"}
- ${artisan} migrate --isolated --force
- ${artisan} config:clear
- ${artisan} config:cache
- ${artisan} cache:clear
- '';
-
- commonServiceConfig = {
- Type = "oneshot";
- User = user;
- Group = group;
- StateDirectory = "firefly-pico";
- ReadWritePaths = [ cfg.dataDir ];
- WorkingDirectory = cfg.package;
- PrivateTmp = true;
- PrivateDevices = true;
- CapabilityBoundingSet = "";
- AmbientCapabilities = "";
- ProtectSystem = "strict";
- ProtectKernelTunables = true;
- ProtectKernelModules = true;
- ProtectControlGroups = true;
- ProtectClock = true;
- ProtectHostname = true;
- ProtectHome = "tmpfs";
- ProtectKernelLogs = true;
- ProtectProc = "invisible";
- ProcSubset = "pid";
- PrivateNetwork = false;
- RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX";
- SystemCallArchitectures = "native";
- SystemCallFilter = [
- "@system-service @resources"
- "~@obsolete @privileged"
- ];
- RestrictSUIDSGID = true;
- RemoveIPC = true;
- NoNewPrivileges = true;
- RestrictRealtime = true;
- RestrictNamespaces = true;
- LockPersonality = true;
- PrivateUsers = true;
- };
-
-in
-{
-
- options.services.firefly-pico = {
-
- enable = lib.mkEnableOption "Firefly-Pico: A delightful Firefly III companion web app for effortless transaction tracking";
-
- user = lib.mkOption {
- type = lib.types.str;
- default = defaultUser;
- description = "User account under which firefly-pico runs.";
- };
-
- group = lib.mkOption {
- type = lib.types.str;
- default = if cfg.enableNginx then "nginx" else defaultGroup;
- defaultText = "If `services.firefly-pico.enableNginx` is true then `nginx` else ${defaultGroup}";
- description = ''
- Group under which firefly-pico runs. It is best to set this to the group
- of whatever webserver is being used as the frontend.
- '';
- };
-
- dataDir = lib.mkOption {
- type = lib.types.path;
- default = "/var/lib/firefly-pico";
- description = ''
- The place where firefly-pico stores its state.
- '';
- };
-
- package =
- lib.mkPackageOption pkgs "firefly-pico" { }
- // lib.mkOption {
- apply =
- firefly-pico:
- firefly-pico.override {
- inherit (cfg) dataDir;
- };
- };
-
- enableNginx = lib.mkOption {
- type = lib.types.bool;
- default = false;
- description = ''
- Whether to enable nginx or not. If enabled, an nginx virtual host will
- be created for access to firefly-pico. If not enabled, then you may use
- `''${config.services.firefly-pico.package}` as your document root in
- whichever webserver you wish to setup.
- '';
- };
-
- virtualHost = lib.mkOption {
- type = lib.types.str;
- default = "localhost";
- description = ''
- The hostname at which you wish firefly-pico to be served. If you have
- enabled nginx using `services.firefly-pico.enableNginx` then this will
- be used.
- '';
- };
-
- poolConfig = lib.mkOption {
- type = lib.types.attrsOf (
- lib.types.oneOf [
- lib.types.str
- lib.types.int
- lib.types.bool
- ]
- );
- default = { };
- defaultText = ''
- {
- "pm" = "dynamic";
- "pm.max_children" = 32;
- "pm.start_servers" = 2;
- "pm.min_spare_servers" = 2;
- "pm.max_spare_servers" = 4;
- "pm.max_requests" = 500;
- }
- '';
- description = ''
- Options for the Firefly III PHP pool. See the documentation on php-fpm.conf
- for details on configuration directives.
- '';
- };
-
- settings = lib.mkOption {
- default = { };
- description = ''
- Options for firefly-iii configuration. Refer to
- for
- details on supported values. All