adding server config to repo. setting up laptop in repo. other changes.

hosts/server/configuration.nix

@@ -0,0 +1,45 @@
+{ config, pkgs, ... }:
+{
+  imports = [ 
+    ./hardware-configuration.nix 
+    ./nginx.nix
+  ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "lily-server";
+  networking.networkmanager.enable = true;
+
+  services.displayManager.sddm.enable = true;
+  services.desktopManager.plasma6.enable = true;
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+      X11Forwarding = false;
+    };
+  };
+
+    nixpkgs.config.allowUnfree = true;
+    networking.firewall.allowedTCPPorts = [ 22 80 443 9001 9002 ];
+
+users.users.lily = {
+isNormalUser = true;
+description = "Lily Luna";
+extraGroups = [ "networkmanager" "wheel" "lily" "input" "uinput" ];
+};
+users.groups.lily = { };
+
+	programs.nh = {
+		enable = true;
+		flake = "/home/lily/Programming/LiNix26";
+	};
+
+environment.systemPackages = with pkgs; [ vim firefox ];
+nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+    system.stateVersion = "24.11";
+}

hosts/server/hardware-configuration.nix

@@ -0,0 +1,40 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+	imports =
+		[ (modulesPath + "/installer/scan/not-detected.nix")
+		];
+
+	boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
+	boot.initrd.kernelModules = [ ];
+	boot.kernelModules = [ "kvm-intel" ];
+	boot.extraModulePackages = [ ];
+
+	fileSystems."/" =
+	{ device = "/dev/disk/by-uuid/208d39a0-fa7d-4fe4-be61-8867e7a51bc8";
+		fsType = "ext4";
+	};
+
+	fileSystems."/boot" =
+	{ device = "/dev/disk/by-uuid/AED2-D209";
+		fsType = "vfat";
+		options = [ "fmask=0077" "dmask=0077" ];
+	};
+
+	swapDevices =
+		[ { device = "/dev/disk/by-uuid/ec9d9773-d48b-4221-af73-7c365fe0966d"; }
+		];
+
+# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+# (the default) this is the recommended approach. When using systemd-networkd it's
+# still possible to use this option, but it's recommended to use it in conjunction
+# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+		networking.useDHCP = lib.mkDefault true;
+# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+
+		nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+		hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/server/jupyter.nix

@@ -0,0 +1,11 @@
+{ config, pkgs, ... }:
+{
+  services.jupyter = {
+    enable = false;
+    ip = "0.0.0.0";
+    port = 9002;
+    password = "'argon2:$argon2id$v=19$m=10240,t=10,p=8$wcvyvCdrrixsD/IUfOij7A$D05SNCsu0gtkCk7V7QSQw3RkcrUfoKXWzn9N/MJjRIA'";
+    notebookDir = "/var/www/jupyter.lilyanderson.xyz";
+    notebookConfig = "c.ServerApp.root_dir = '/var/www/jupyter.lilyanderson.xyz'";
+  };
+}

hosts/server/nginx.nix

@@ -0,0 +1,158 @@
+{ config, pkgs, ... }:
+{
+  imports = [ ./jupyter.nix ];
+  users.users.nginx.extraGroups = [ "acme" ];
+  systemd.services.webdavPrivate = {
+    description = "Rclone WebDAV server";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      ExecStart = ''
+      ${pkgs.rclone}/bin/rclone serve webdav --addr :8081 --baseurl / --htpasswd /var/www/basic_auth /var/www/dav.lilyanderson.xyz
+      '';
+      Restart = "always";
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts = {
+#     "jupyter.lilyanderson.xyz" = {
+#       enableACME = true;
+#       forceSSL = true;
+#       locations."/" = {
+#         proxyPass = "http://localhost:9002";
+#       };
+#       basicAuthFile = "/var/www/basic_auth";
+#       extraConfig = ''
+# proxy_http_version 1.1;
+# proxy_set_header Upgrade $http_upgrade;
+# proxy_set_header Connection “upgrade”;
+# proxy_set_header Host $host;
+# proxy_set_header X-Real-IP $remote_addr;
+# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+# '';
+#     };
+
+      "lilyanderson.xyz" = {
+        locations."/" = {
+          root = "/var/www/web";
+        };
+      };
+
+      "ai.lilyanderson.xyz" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://localhost:9001";
+        };
+		extraConfig = ''
+			client_body_timeout 300;
+			client_header_timeout 300;
+			keepalive_timeout 300;
+			proxy_connect_timeout 300;
+			proxy_send_timeout 300;
+			proxy_read_timeout 300;
+
+# Add WebSocket support
+			proxy_http_version 1.1;
+			proxy_set_header Upgrade $http_upgrade;
+			proxy_set_header Connection "upgrade";
+
+			proxy_set_header Host $host;
+			proxy_set_header X-Real-IP $remote_addr;
+			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+			proxy_set_header X-Forwarded-Proto $scheme;
+
+# Disable proxy buffering for better streaming response from models
+			proxy_buffering off;
+			'';
+      };
+
+      "dav.lilyanderson.xyz" = {
+            enableACME = true;
+            forceSSL = true;
+            locations."/" = {
+              proxyPass = "http://localhost:8081";
+            };
+      };
+
+      "swap.lilyanderson.xyz" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://192.168.0.101:9001";
+        };
+        basicAuthFile = "/var/www/basic_auth";
+      };
+
+      "192.168.0.42" = {
+      };
+
+
+      "git.lilyanderson.xyz" = {
+		enableACME = true;
+	    forceSSL = true;
+		locations."/" = {
+		  proxyPass = "http://localhost:3001";
+	  	};
+	  };
+    };
+  };
+	services.postgresql = {
+		ensureDatabases = [ config.services.gitea.user ];
+		ensureUsers = [
+		{
+			name = config.services.gitea.database.user;
+			ensureDBOwnership = true;
+#ensurePermissions."DATABASE ${config.services.gitea.database.name}" = "ALL PRIVILEGES";
+		}
+		];
+	};
+
+    sops = {
+      age.keyFile = "/secrets/age/keys.txt";
+	  defaultSopsFile = ../../secrets/secrets.yaml;
+	  defaultSopsFormat = "yaml";
+	  secrets."postgres/gitea_dbpass" = { 
+        owner = config.services.gitea.user;
+	  };
+    };
+
+	services.gitea = {
+		enable = true;
+		appName = "Lily's Gitea Server";
+		database = {
+			type = "postgres";
+			passwordFile = config.sops.secrets."postgres/gitea_dbpass".path;
+		};
+
+		settings.service.DISABLE_REGISTRATION = true;
+
+		settings.server = {
+			DOMAIN = "git.lilyanderson.xyz";
+			ROOT_URL = "https://git.lilyanderson.xyz";
+			HTTP_PORT = 3001;
+		};
+	};
+
+
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "lilylanderson@zoho.com";
+  };
+
+  services.open-webui = {
+    enable = true;
+    host = "0.0.0.0";
+    port = 9001;
+    environment = {
+      ANONYMIZED_TELEMETRY = "False";
+      DO_NOT_TRACK = "True";
+      SCARF_NO_ANALYTICS = "True";
+      ENABLE_LOGIN_FORM = "True";
+    };
+  };
+}