server-config/flake.nix

{
  description = "Flake for server muffin";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";

    lanzaboote = {
      url = "github:nix-community/lanzaboote";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    nixos-hardware.url = "github:NixOS/nixos-hardware/master";

    nix-minecraft = {
      url = "github:Infinidoge/nix-minecraft";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    vpn-confinement.url = "github:Maroka-chan/VPN-Confinement";

    home-manager = {
      url = "github:nix-community/home-manager/release-25.11";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    disko = {
      url = "github:nix-community/disko";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    srvos = {
      url = "github:nix-community/srvos";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    deploy-rs = {
      url = "github:serokell/deploy-rs";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    impermanence = {
      url = "github:nix-community/impermanence";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    agenix = {
      url = "github:ryantm/agenix";
      inputs.nixpkgs.follows = "nixpkgs";
      inputs.home-manager.follows = "home-manager";
      inputs.darwin.follows = "";
    };

    senior_project-website = {
      url = "github:Titaniumtown/senior-project-website";
      flake = false;
    };

    website = {
      url = "git+https://git.gardling.com/titaniumtown/website";
      flake = false;
    };

    trackerlist = {
      url = "github:ngosang/trackerslist";
      flake = false;
    };

    ytbn-graphing-software = {
      url = "git+https://git.gardling.com/titaniumtown/YTBN-Graphing-Software";
    };
  };

  outputs =
    {
      self,
      nixpkgs,
      nix-minecraft,
      nixos-hardware,
      vpn-confinement,
      home-manager,
      lanzaboote,
      disko,
      srvos,
      deploy-rs,
      impermanence,
      agenix,
      ...
    }@inputs:
    let
      username = "primary";
      hostname = "muffin";
      eth_interface = "enp4s0";
      system = "x86_64-linux";

      service_configs = rec {
        zpool_ssds = "tank";
        zpool_hdds = "hdds";
        torrents_path = "/torrents";
        services_dir = "/services";
        music_dir = "/${zpool_ssds}/music";
        media_group = "media";

        cpu_arch = "znver3";

        ports = {
          http = 80;
          https = 443;
          jellyfin = 8096; # no services.jellyfin option for this
          torrent = 6011;
          bitmagnet = 3333;
          gitea = 2283;
          immich = 2284;
          soulseek_web = 5030;
          soulseek_listen = 50300;
          llama_cpp = 8991;
          vaultwarden = 8222;
          syncthing_gui = 8384;
          syncthing_protocol = 22000;
          syncthing_discovery = 21027;
          minecraft = 25565;
          matrix = 6167;
          matrix_federation = 8448;
          coturn = 3478;
          coturn_tls = 5349;
          ntfy = 2586;
          livekit = 7880;
          lk_jwt = 8081;
          prowlarr = 9696;
          sonarr = 8989;
          radarr = 7878;
          bazarr = 6767;
          jellyseerr = 5055;
        };

        https = {
          certs = services_dir + "/http_certs";
          domain = "gardling.com";
        };

        gitea = {
          dir = services_dir + "/gitea";
          domain = "git.${https.domain}";
        };

        postgres = {
          socket = "/run/postgresql";
          dataDir = services_dir + "/sql";
        };

        immich = {
          dir = services_dir + "/immich";
        };

        minecraft = {
          parent_dir = services_dir + "/minecraft";
          server_name = "main";
        };

        torrent = {
          SavePath = torrents_path;
          TempPath = torrents_path + "/incomplete";
        };

        jellyfin = {
          dataDir = services_dir + "/jellyfin";
          cacheDir = services_dir + "/jellyfin_cache";
        };

        slskd = rec {
          base = "/var/lib/slskd";
          downloads = base + "/downloads";
          incomplete = base + "/incomplete";
        };

        vaultwarden = {
          path = "/var/lib/vaultwarden";
        };

        monero = {
          dataDir = services_dir + "/monero";
        };

        matrix = {
          dataDir = "/var/lib/continuwuity";
          domain = "matrix.${https.domain}";
        };

        ntfy = {
          domain = "ntfy.${https.domain}";
        };

        livekit = {
          domain = "livekit.${https.domain}";
        };

        syncthing = {
          dataDir = services_dir + "/syncthing";
          signalBackupDir = "/${zpool_ssds}/bak/signal";
          grayjayBackupDir = "/${zpool_ssds}/bak/grayjay";

        prowlarr = {
          dataDir = services_dir + "/prowlarr";
        };

        sonarr = {
          dataDir = services_dir + "/sonarr";
        };

        radarr = {
          dataDir = services_dir + "/radarr";
        };

        bazarr = {
          dataDir = services_dir + "/bazarr";
        };

        jellyseerr = {
          configDir = services_dir + "/jellyseerr";
        };

        recyclarr = {
          dataDir = services_dir + "/recyclarr";
        };

        media = {
          moviesDir = torrents_path + "/media/movies";
          tvDir = torrents_path + "/media/tv";
        };
        };
      };

      pkgs = import nixpkgs {
        inherit system;
        targetPlatform = system;
        buildPlatform = builtins.currentSystem;
      };
      lib = import ./modules/lib.nix { inherit inputs pkgs service_configs; };
    in
    {
      formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-tree;
      nixosConfigurations.${hostname} = lib.nixosSystem {
        inherit system;
        specialArgs = {
          inherit
            username
            hostname
            eth_interface
            service_configs
            inputs
            ;
        };
        modules = [
          # SAFETY! make sure no ports collide
          (
            { lib, ... }:
            {
              config.assertions = [
                {
                  assertion =
                    let
                      ports = lib.attrValues service_configs.ports;
                      uniquePorts = lib.unique ports;
                    in
                    (lib.length ports) == (lib.length uniquePorts);
                  message = "Duplicate ports detected in 'ports' configuration";
                }
              ];
            }
          )

          # sets up things like the watchdog
          srvos.nixosModules.server

          # diff terminal support
          srvos.nixosModules.mixins-terminfo

          ./disk-config.nix
          ./configuration.nix

          {
            nixpkgs.overlays = [
              nix-minecraft.overlay
              (import ./modules/overlays.nix)
            ];
            nixpkgs.config.allowUnfreePredicate =
              pkg:
              builtins.elem (nixpkgs.lib.getName pkg) [
                "minecraft-server"
              ];
          }

          lanzaboote.nixosModules.lanzaboote

          home-manager.nixosModules.home-manager
          (
            {
              home-manager,
              ...
            }:
            {
              home-manager.users.${username} = import ./modules/home.nix;
            }
          )
        ]
        ++ (with nixos-hardware.nixosModules; [
          common-cpu-amd-pstate
          common-cpu-amd-zenpower
          common-pc-ssd
          common-gpu-intel
        ]);
      };

      deploy.nodes.muffin = {
        hostname = "server-public";
        profiles.system = {
          sshUser = "root";
          user = "root";
          path = deploy-rs.lib.${system}.activate.nixos self.nixosConfigurations.muffin;
        };
      };

      packages.${system} =
        let
          testSuite = import ./tests/tests.nix {
            inherit pkgs lib inputs;
            config = self.nixosConfigurations.muffin.config;
          };
        in
        {
          tests = pkgs.linkFarm "all-tests" (
            pkgs.lib.mapAttrsToList (name: test: {
              name = name;
              path = test;
            }) testSuite
          );
        }
        // (pkgs.lib.mapAttrs' (name: test: {
          name = "test-${name}";
          value = test;
        }) testSuite);
    };
}