From a44c76fd7d9c6f2d17b43b38dba1b5aafd6ab803 Mon Sep 17 00:00:00 2001 From: oddlama Date: Thu, 15 May 2025 21:11:55 +0200 Subject: [PATCH] feat: remove firefly iii again (no multi user auto sync) --- README.md | 3 +- config/users.nix | 4 +- hosts/kroma/default.nix | 3 - hosts/sentinel/firezone.nix | 3 +- hosts/sire/default.nix | 2 +- hosts/ward/default.nix | 4 +- hosts/ward/guests/adguardhome.nix | 3 +- hosts/ward/guests/firefly.nix | 166 ------- hosts/ward/secrets/firefly/host.pub | 1 - modules/default.nix | 1 - modules/firefly-pico.nix | 410 ------------------ pkgs/default.nix | 2 - pkgs/firefly-pico-frontend.nix | 50 --- pkgs/firefly-pico.nix | 73 ---- .../firefly-data-importer-app-key.age | Bin 443 -> 0 bytes .../ward-firefly/firefly-iii-app-key.age | 12 - .../ward-firefly/firefly-pico-app-key.age | Bin 417 -> 0 bytes .../promtail-loki-basic-auth-password.age | Bin 461 -> 0 bytes .../ward-firefly/telegraf-influxdb-token.age | 11 - ...4-telegraf-influxdb-token-ward-firefly.age | 7 - ...e868a44f8f70bd383-firefly-pico-app-key.age | 7 - ...uard-proxy-home-psks-ward+ward-firefly.age | 8 - ...bd4199c9db79d103de-firefly-iii-app-key.age | Bin 353 -> 0 bytes ...a651a63413f5e0-telegraf-influxdb-token.age | 9 - ...20811918-firefly-data-importer-app-key.age | 8 - ...fef1-promtail-loki-basic-auth-password.age | Bin 417 -> 0 bytes ...wireguard-proxy-home-priv-ward-firefly.age | Bin 391 -> 0 bytes ...uard-proxy-home-psks-ward+ward-firefly.age | 7 - .../proxy-home/keys/ward-firefly.age | 10 - .../proxy-home/keys/ward-firefly.pub | 1 - .../proxy-home/psks/ward+ward-firefly.age | 9 - 31 files changed, 7 insertions(+), 807 deletions(-) delete mode 100644 hosts/ward/guests/firefly.nix delete mode 100644 hosts/ward/secrets/firefly/host.pub delete mode 100644 modules/firefly-pico.nix delete mode 100644 pkgs/firefly-pico-frontend.nix delete mode 100644 pkgs/firefly-pico.nix delete mode 100644 secrets/generated/ward-firefly/firefly-data-importer-app-key.age delete mode 100644 secrets/generated/ward-firefly/firefly-iii-app-key.age delete mode 100644 secrets/generated/ward-firefly/firefly-pico-app-key.age delete mode 100644 secrets/generated/ward-firefly/promtail-loki-basic-auth-password.age delete mode 100644 secrets/generated/ward-firefly/telegraf-influxdb-token.age delete mode 100644 secrets/rekeyed/sire-influxdb/25afc8a55a3c3646f3d5b63f1626e324-telegraf-influxdb-token-ward-firefly.age delete mode 100644 secrets/rekeyed/ward-firefly/0c03e82003735b0e868a44f8f70bd383-firefly-pico-app-key.age delete mode 100644 secrets/rekeyed/ward-firefly/206d313b87995351cd0b97e804d37886-wireguard-proxy-home-psks-ward+ward-firefly.age delete mode 100644 secrets/rekeyed/ward-firefly/3e9f3cf2a49cc7bd4199c9db79d103de-firefly-iii-app-key.age delete mode 100644 secrets/rekeyed/ward-firefly/42e563c91200775d10a651a63413f5e0-telegraf-influxdb-token.age delete mode 100644 secrets/rekeyed/ward-firefly/bf62c2abb03665ad857f821820811918-firefly-data-importer-app-key.age delete mode 100644 secrets/rekeyed/ward-firefly/c17f6d023aa2f3bf37bc286b3766fef1-promtail-loki-basic-auth-password.age delete mode 100644 secrets/rekeyed/ward-firefly/cc7db31943caeff66244b3aa934b7297-wireguard-proxy-home-priv-ward-firefly.age delete mode 100644 secrets/rekeyed/ward/ca883e2bce6ceff39bb8dc133d3a092e-wireguard-proxy-home-psks-ward+ward-firefly.age delete mode 100644 secrets/wireguard/proxy-home/keys/ward-firefly.age delete mode 100644 secrets/wireguard/proxy-home/keys/ward-firefly.pub delete mode 100644 secrets/wireguard/proxy-home/psks/ward+ward-firefly.age diff --git a/README.md b/README.md index fc45502..7e6055c 100644 --- a/README.md +++ b/README.md @@ -46,12 +46,11 @@ I've included the major components in the lists below. | ~~~~~~~~~~~~ | Service | Source | Description ---|---|---|--- -💸 Budgeting | Firefly III \& Firefly Pico | [Link](./hosts/ward/guests/firefly.nix) | Budgeting application to track income and expenses 🛡️ Adblock | AdGuard Home | [Link](./hosts/ward/guests/adguardhome.nix) | DNS level adblocker 🔒 SSO | Kanidm | [Link](./hosts/ward/guests/kanidm.nix) | Identity provider for Single-Sign-On on my hosted services, with provisioning. 🐙 Git | Forgejo | [Link](./hosts/ward/guests/forgejo.nix) | Forgejo with SSO 🔑 Passwords | Vaultwarden | [Link](./hosts/ward/guests/vaultwarden.nix) | Self-hosted password manager -📷 Photos | Immich | [Link](./hosts/sire/guests/immich.nix) | Self-hosted photo and video backup solution +📷 Photos | Ente | [Link](./hosts/sire/guests/ente.nix) | E2E encrypted photo and video backup solution 📄 Documents | Paperless | [Link](./hosts/sire/guests/paperless.nix) | Document management system. With per-user Samba share integration (consume & archive) 🗓️ CalDAV/CardDAV | Radicale | [Link](./hosts/ward/guests/radicale.nix) | Contacts, Calender and Tasks synchronization 📁 NAS | Samba | [Link](./hosts/sire/guests/samba.nix) | Network attached storage. Cross-integration with paperless diff --git a/config/users.nix b/config/users.nix index bf62d6d..b0c161f 100644 --- a/config/users.nix +++ b/config/users.nix @@ -43,8 +43,8 @@ unifi = uidGid 968; plugdev.gid = 967; tss = uidGid 966; - firefly-iii = uidGid 965; - firefly-pico = uidGid 964; + # firefly-iii = uidGid 965; + # firefly-pico = uidGid 964; avahi = uidGid 963; }; } diff --git a/hosts/kroma/default.nix b/hosts/kroma/default.nix index 53a7361..2df3790 100644 --- a/hosts/kroma/default.nix +++ b/hosts/kroma/default.nix @@ -91,9 +91,6 @@ programs.nix-ld.enable = true; topology.self.icon = "devices.desktop"; - # Mainly for client-side formatting in websites like firefly-iii - i18n.supportedLocales = [ "de_DE.UTF-8/UTF-8" ]; - hardware.nvidia-container-toolkit.enable = true; virtualisation.containers.enable = true; virtualisation.podman = { diff --git a/hosts/sentinel/firezone.nix b/hosts/sentinel/firezone.nix index 674b72f..dceb1a8 100644 --- a/hosts/sentinel/firezone.nix +++ b/hosts/sentinel/firezone.nix @@ -12,8 +12,7 @@ let # FIXME: new entry here? make new firezone gateway on ward entry too. homeDomains = [ globals.services.grafana.domain - globals.services.firefly.domain - globals.services.firefly-pico.domain + globals.services.ente.domain globals.services.immich.domain globals.services.influxdb.domain globals.services.loki.domain diff --git a/hosts/sire/default.nix b/hosts/sire/default.nix index 960c27e..277d7e1 100644 --- a/hosts/sire/default.nix +++ b/hosts/sire/default.nix @@ -150,7 +150,7 @@ } // mkMicrovm "ai" { } // mkMicrovm "minecraft" { } - #// mkMicrovm "firefly" {} + // mkMicrovm "ente" { } #// mkMicrovm "fasten-health" {} ); } diff --git a/hosts/ward/default.nix b/hosts/ward/default.nix index f69e832..b5207b7 100644 --- a/hosts/ward/default.nix +++ b/hosts/ward/default.nix @@ -13,8 +13,7 @@ let # FIXME: new entry here? make new firezone entry too. homeDomains = [ globals.services.grafana.domain - globals.services.firefly.domain - globals.services.firefly-pico.domain + globals.services.ente.domain globals.services.immich.domain globals.services.influxdb.domain globals.services.loki.domain @@ -135,7 +134,6 @@ in lib.mkIf (!minimal) ( { } // mkMicrovm "adguardhome" - // mkMicrovm "firefly" // mkMicrovm "forgejo" // mkMicrovm "kanidm" // mkMicrovm "radicale" diff --git a/hosts/ward/guests/adguardhome.nix b/hosts/ward/guests/adguardhome.nix index fe00c8b..f7b6bbd 100644 --- a/hosts/ward/guests/adguardhome.nix +++ b/hosts/ward/guests/adguardhome.nix @@ -112,8 +112,7 @@ in # FIXME: new entry here? make new firezone entry too. # FIXME: new entry here? make new firezone gateway on ward entry too. globals.services.grafana.domain - globals.services.firefly.domain - globals.services.firefly-pico.domain + globals.services.ente.domain globals.services.immich.domain globals.services.influxdb.domain globals.services.loki.domain diff --git a/hosts/ward/guests/firefly.nix b/hosts/ward/guests/firefly.nix deleted file mode 100644 index ab43289..0000000 --- a/hosts/ward/guests/firefly.nix +++ /dev/null @@ -1,166 +0,0 @@ -{ - config, - globals, - nodes, - ... -}: -let - fireflyDomain = "firefly.${globals.domains.me}"; - fireflyPicoDomain = "firefly-pico.${globals.domains.me}"; - wardWebProxyCfg = nodes.ward-web-proxy.config; -in -{ - wireguard.proxy-home = { - client.via = "ward"; - firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [ 80 ]; - }; - - globals.services.firefly.domain = fireflyDomain; - globals.services.firefly-pico.domain = fireflyPicoDomain; - globals.monitoring.http.firefly = { - url = "https://${fireflyDomain}"; - expectedBodyRegex = "Firefly III"; - network = "home-lan.vlans.services"; - }; - globals.monitoring.http.firefly-pico = { - url = "https://${fireflyPicoDomain}"; - expectedBodyRegex = "Pico"; - network = "home-lan.vlans.services"; - }; - - age.secrets.firefly-iii-app-key = { - generator.script = _: '' - echo "base64:$(head -c 32 /dev/urandom | base64)" - ''; - owner = "firefly-iii"; - }; - - age.secrets.firefly-pico-app-key = { - generator.script = _: '' - echo "base64:$(head -c 32 /dev/urandom | base64)" - ''; - owner = "firefly-pico"; - }; - - environment.persistence."/persist".directories = [ - { - directory = "/var/lib/firefly-iii"; - user = "firefly-iii"; - } - { - directory = "/var/lib/firefly-pico"; - user = "firefly-pico"; - } - ]; - - networking.hosts.${wardWebProxyCfg.wireguard.proxy-home.ipv4} = [ - globals.services.firefly.domain - globals.services.firefly-pico.domain - ]; - - i18n.supportedLocales = [ "all" ]; - services.firefly-iii = { - enable = true; - enableNginx = true; - virtualHost = globals.services.firefly.domain; - settings = { - AUDIT_LOG_LEVEL = "emergency"; # disable audit logs - LOG_CHANNEL = "syslog"; - APP_URL = "https://${globals.services.firefly.domain}"; - TZ = "Europe/Berlin"; - TRUSTED_PROXIES = wardWebProxyCfg.wireguard.proxy-home.ipv4; - SITE_OWNER = "admin@${globals.domains.me}"; - APP_KEY_FILE = config.age.secrets.firefly-iii-app-key.path; - }; - }; - - services.firefly-pico = { - enable = true; - enableNginx = true; - virtualHost = globals.services.firefly-pico.domain; - settings = { - LOG_CHANNEL = "syslog"; - APP_URL = "https://${globals.services.firefly-pico.domain}"; - TZ = "Europe/Berlin"; - FIREFLY_URL = config.services.firefly-iii.settings.APP_URL; - TRUSTED_PROXIES = wardWebProxyCfg.wireguard.proxy-home.ipv4; - SITE_OWNER = "admin@${globals.domains.me}"; - APP_KEY_FILE = config.age.secrets.firefly-pico-app-key.path; - }; - }; - - services.nginx.commonHttpConfig = '' - log_format json_combined escape=json '{' - '"time": $msec,' - '"remote_addr":"$remote_addr",' - '"status":$status,' - '"method":"$request_method",' - '"host":"$host",' - '"uri":"$request_uri",' - '"request_size":$request_length,' - '"response_size":$body_bytes_sent,' - '"response_time":$request_time,' - '"referrer":"$http_referer",' - '"user_agent":"$http_user_agent"' - '}'; - error_log syslog:server=unix:/dev/log,nohostname; - access_log syslog:server=unix:/dev/log,nohostname json_combined; - ssl_ecdh_curve secp384r1; - ''; - - nodes.ward-web-proxy = { - services.nginx = { - upstreams.firefly = { - servers."${config.wireguard.proxy-home.ipv4}:80" = { }; - extraConfig = '' - zone firefly 64k; - keepalive 2; - ''; - monitoring = { - enable = true; - expectedBodyRegex = "Firefly"; - }; - }; - virtualHosts.${fireflyDomain} = { - forceSSL = true; - useACMEWildcardHost = true; - locations."/" = { - proxyPass = "http://firefly"; - proxyWebsockets = true; - }; - extraConfig = '' - # allow self-access - allow ${config.wireguard.proxy-home.ipv4}; - allow ${config.wireguard.proxy-home.ipv6}; - # allow home traffic - allow ${globals.net.home-lan.vlans.home.cidrv4}; - allow ${globals.net.home-lan.vlans.home.cidrv6}; - # Firezone traffic - allow ${globals.net.home-lan.vlans.services.hosts.ward.ipv4}; - allow ${globals.net.home-lan.vlans.services.hosts.ward.ipv6}; - deny all; - ''; - }; - virtualHosts.${fireflyPicoDomain} = { - forceSSL = true; - useACMEWildcardHost = true; - locations."/" = { - proxyPass = "http://firefly"; - proxyWebsockets = true; - }; - extraConfig = '' - # allow self-access - allow ${config.wireguard.proxy-home.ipv4}; - allow ${config.wireguard.proxy-home.ipv6}; - # allow home traffic - allow ${globals.net.home-lan.vlans.home.cidrv4}; - allow ${globals.net.home-lan.vlans.home.cidrv6}; - # Firezone traffic - allow ${globals.net.home-lan.vlans.services.hosts.ward.ipv4}; - allow ${globals.net.home-lan.vlans.services.hosts.ward.ipv6}; - deny all; - ''; - }; - }; - }; -} diff --git a/hosts/ward/secrets/firefly/host.pub b/hosts/ward/secrets/firefly/host.pub deleted file mode 100644 index 97cc759..0000000 --- a/hosts/ward/secrets/firefly/host.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK9bxRVB7zpCZhwfIwr7oyuNy0Tfu1Ki3KWPNiFyQizH diff --git a/modules/default.nix b/modules/default.nix index fc7701e..fe00f12 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -4,7 +4,6 @@ ./backups.nix ./deterministic-ids.nix ./distributed-config.nix - ./firefly-pico.nix ./globals.nix ./meta.nix ./nginx-upstream-monitoring.nix diff --git a/modules/firefly-pico.nix b/modules/firefly-pico.nix deleted file mode 100644 index e86c92c..0000000 --- a/modules/firefly-pico.nix +++ /dev/null @@ -1,410 +0,0 @@ -{ - pkgs, - config, - lib, - ... -}: - -let - cfg = config.services.firefly-pico; - - inherit (cfg) user; - inherit (cfg) group; - - defaultUser = "firefly-pico"; - defaultGroup = "firefly-pico"; - - artisan = "${cfg.package}/share/php/firefly-pico/artisan"; - - env-file-values = lib.attrsets.mapAttrs' ( - n: v: lib.attrsets.nameValuePair (lib.strings.removeSuffix "_FILE" n) v - ) (lib.attrsets.filterAttrs (n: _v: lib.strings.hasSuffix "_FILE" n) cfg.settings); - env-nonfile-values = lib.attrsets.filterAttrs ( - n: _v: !lib.strings.hasSuffix "_FILE" n - ) cfg.settings; - - firefly-pico-maintenance = pkgs.writeShellScript "firefly-pico-maintenance.sh" '' - set -a - ${lib.strings.toShellVars env-nonfile-values} - ${lib.strings.concatLines ( - lib.attrsets.mapAttrsToList (n: v: "${n}=\"$(< ${v})\"") env-file-values - )} - set +a - ${lib.optionalString ( - cfg.settings.DB_CONNECTION == "sqlite" - ) "touch ${cfg.dataDir}/storage/database/database.sqlite"} - ${artisan} migrate --isolated --force - ${artisan} config:clear - ${artisan} config:cache - ${artisan} cache:clear - ''; - - commonServiceConfig = { - Type = "oneshot"; - User = user; - Group = group; - StateDirectory = "firefly-pico"; - ReadWritePaths = [ cfg.dataDir ]; - WorkingDirectory = cfg.package; - PrivateTmp = true; - PrivateDevices = true; - CapabilityBoundingSet = ""; - AmbientCapabilities = ""; - ProtectSystem = "strict"; - ProtectKernelTunables = true; - ProtectKernelModules = true; - ProtectControlGroups = true; - ProtectClock = true; - ProtectHostname = true; - ProtectHome = "tmpfs"; - ProtectKernelLogs = true; - ProtectProc = "invisible"; - ProcSubset = "pid"; - PrivateNetwork = false; - RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX"; - SystemCallArchitectures = "native"; - SystemCallFilter = [ - "@system-service @resources" - "~@obsolete @privileged" - ]; - RestrictSUIDSGID = true; - RemoveIPC = true; - NoNewPrivileges = true; - RestrictRealtime = true; - RestrictNamespaces = true; - LockPersonality = true; - PrivateUsers = true; - }; - -in -{ - - options.services.firefly-pico = { - - enable = lib.mkEnableOption "Firefly-Pico: A delightful Firefly III companion web app for effortless transaction tracking"; - - user = lib.mkOption { - type = lib.types.str; - default = defaultUser; - description = "User account under which firefly-pico runs."; - }; - - group = lib.mkOption { - type = lib.types.str; - default = if cfg.enableNginx then "nginx" else defaultGroup; - defaultText = "If `services.firefly-pico.enableNginx` is true then `nginx` else ${defaultGroup}"; - description = '' - Group under which firefly-pico runs. It is best to set this to the group - of whatever webserver is being used as the frontend. - ''; - }; - - dataDir = lib.mkOption { - type = lib.types.path; - default = "/var/lib/firefly-pico"; - description = '' - The place where firefly-pico stores its state. - ''; - }; - - package = - lib.mkPackageOption pkgs "firefly-pico" { } - // lib.mkOption { - apply = - firefly-pico: - firefly-pico.override { - inherit (cfg) dataDir; - }; - }; - - enableNginx = lib.mkOption { - type = lib.types.bool; - default = false; - description = '' - Whether to enable nginx or not. If enabled, an nginx virtual host will - be created for access to firefly-pico. If not enabled, then you may use - `''${config.services.firefly-pico.package}` as your document root in - whichever webserver you wish to setup. - ''; - }; - - virtualHost = lib.mkOption { - type = lib.types.str; - default = "localhost"; - description = '' - The hostname at which you wish firefly-pico to be served. If you have - enabled nginx using `services.firefly-pico.enableNginx` then this will - be used. - ''; - }; - - poolConfig = lib.mkOption { - type = lib.types.attrsOf ( - lib.types.oneOf [ - lib.types.str - lib.types.int - lib.types.bool - ] - ); - default = { }; - defaultText = '' - { - "pm" = "dynamic"; - "pm.max_children" = 32; - "pm.start_servers" = 2; - "pm.min_spare_servers" = 2; - "pm.max_spare_servers" = 4; - "pm.max_requests" = 500; - } - ''; - description = '' - Options for the Firefly III PHP pool. See the documentation on php-fpm.conf - for details on configuration directives. - ''; - }; - - settings = lib.mkOption { - default = { }; - description = '' - Options for firefly-iii configuration. Refer to - for - details on supported values. All