Added server configs.

modules/hosts/server/configuration.nix

@@ -0,0 +1,36 @@
+{self, inputs, ...}: {
+  flake.nixosModules.serverConfig = { pkgs, ... }: {
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "lily-server";
+  networking.networkmanager.enable = true;
+
+  services.displayManager.sddm.enable = true;
+  services.desktopManager.plasma6.enable = true;
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+      X11Forwarding = false;
+    };
+  };
+
+    nixpkgs.config.allowUnfree = true;
+    networking.firewall.allowedTCPPorts = [ 22 80 443 9001 9002 ];
+
+    nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+    programs.firefox.enable = true;
+    environment.systemPackages = [ 
+      pkgs.vim
+
+      self.packages.${pkgs.stdenv.hostPlatform.system}.nh
+
+    ];
+    system.stateVersion = "24.11";
+  };
+}
+

modules/hosts/server/hardware-configuration.nix

@@ -0,0 +1,40 @@
+{
+  flake.nixosModules.serverHardware = { config, lib, modulesPath, ... }: {
+	imports = [ 
+      (modulesPath + "/installer/scan/not-detected.nix")
+	];
+	boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
+	boot.initrd.kernelModules = [ ];
+	boot.kernelModules = [ "kvm-intel" ];
+	boot.extraModulePackages = [ ];
+
+    fileSystems = {
+      "/" = {
+        device = "/dev/disk/by-uuid/208d39a0-fa7d-4fe4-be61-8867e7a51bc8";
+		fsType = "ext4";
+	  };
+
+	  "/boot" = { 
+        device = "/dev/disk/by-uuid/AED2-D209";
+		fsType = "vfat";
+		options = [ "fmask=0077" "dmask=0077" ];
+	  };
+    };
+
+	swapDevices = [ { 
+      device = "/dev/disk/by-uuid/ec9d9773-d48b-4221-af73-7c365fe0966d"; 
+    } ];
+
+# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+# (the default) this is the recommended approach. When using systemd-networkd it's
+# still possible to use this option, but it's recommended to use it in conjunction
+# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+		networking.useDHCP = lib.mkDefault true;
+# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+
+		nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+		hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+ 
+  };
+}
+

modules/hosts/server/nginx.nix

@@ -0,0 +1,172 @@
+{inputs, ...}: {
+  flake.nixosModules.nginx = { config, pkgs, ... }: {
+    imports = [ inputs.sops-nix.nixosModules.sops ];
+    users.users.nginx.extraGroups = [ "acme" ];
+    systemd.services.webdavPrivate = {
+      description = "Rclone WebDAV server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = ''
+        ${pkgs.rclone}/bin/rclone serve webdav --addr :8081 --baseurl / --htpasswd /var/www/basic_auth /var/www/dav.lilyanderson.xyz
+        '';
+        Restart = "always";
+      };
+    };
+
+    services.nginx = {
+      enable = true;
+
+      virtualHosts = {
+        "lilyanderson.xyz" = {
+          locations."/" = {
+            root = "/var/www/web";
+          };
+        };
+
+        "ai.lilyanderson.xyz" = {
+          enableACME = true;
+          forceSSL = true;
+          locations."/" = {
+            proxyPass = "http://localhost:9001";
+          };
+          extraConfig = ''
+          client_body_timeout 300;
+          client_header_timeout 300;
+          keepalive_timeout 300;
+          proxy_connect_timeout 300;
+          proxy_send_timeout 300;
+          proxy_read_timeout 300;
+
+# Add WebSocket support
+proxy_http_version 1.1;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Connection "upgrade";
+
+proxy_set_header Host $host;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+
+# Disable proxy buffering for better streaming response from models
+proxy_buffering off;
+'';
+      };
+
+      "dav.lilyanderson.xyz" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://localhost:8081";
+        };
+      };
+
+      "swap.lilyanderson.xyz" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://192.168.0.101:9001";
+        };
+        basicAuthFile = "/var/www/basic_auth";
+      };
+
+      "192.168.0.42" = {
+      };
+
+
+      "git.lilyanderson.xyz" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://localhost:3001";
+        };
+      };
+    };
+  };
+  services.postgresql = {
+    ensureDatabases = [ config.services.gitea.user ];
+    ensureUsers = [
+      {
+        name = config.services.gitea.database.user;
+        ensureDBOwnership = true;
+#ensurePermissions."DATABASE ${config.services.gitea.database.name}" = "ALL PRIVILEGES";
+        }
+      ];
+    };
+
+    sops = {
+      age.keyFile = "/secrets/age/keys.txt";
+      defaultSopsFile = ../../../secrets/secrets.yaml;
+      defaultSopsFormat = "yaml";
+      secrets = {
+        "postgres/gitea_dbpass".owner = config.services.gitea.user;
+        "porkbun/api_pk".owner = "root";
+        "porkbun/api_sk".owner = "root";
+      };
+    };
+
+    services.gitea = {
+      enable = true;
+      appName = "Lily's Gitea Server";
+      database = {
+        type = "postgres";
+        passwordFile = config.sops.secrets."postgres/gitea_dbpass".path;
+      };
+
+      settings.service.DISABLE_REGISTRATION = true;
+
+      settings.server = {
+        DOMAIN = "git.lilyanderson.xyz";
+        ROOT_URL = "https://git.lilyanderson.xyz";
+        HTTP_PORT = 3001;
+      };
+    };
+
+
+
+    security.acme = {
+      acceptTerms = true;
+      defaults.email = "lilylanderson@zoho.com";
+    };
+
+    services.open-webui = {
+      enable = true;
+      host = "0.0.0.0";
+      port = 9001;
+      environment = {
+        ANONYMIZED_TELEMETRY = "False";
+        DO_NOT_TRACK = "True";
+        SCARF_NO_ANALYTICS = "True";
+        ENABLE_LOGIN_FORM = "True";
+      };
+    };
+
+    services.oink = {
+      enable = true;
+      apiKeyFile = config.sops.secrets."porkbun/api_pk".path;
+      secretApiKeyFile = config.sops.secrets."porkbun/api_sk".path;
+      domains = [ 
+        { 
+          domain = "ausrineblackthorn.com"; 
+          subdomain = "";
+          ttl = 600;
+        }
+        {
+          domain = "ausrineblackthorn.com";
+          subdomain = "*";
+          ttl = 600;
+        }
+        {
+          domain = "lilyanderson.xyz";
+          subdomain = "";
+          ttl = 600;
+        }
+        {
+          domain = "lilyanderson.xyz";
+          subdomain = "*";
+          ttl = 600;
+        }	
+      ];
+    };
+  };
+}

modules/hosts/server/server.nix

@@ -0,0 +1,13 @@
+{ inputs, self, ... }: {
+  flake.nixosConfigurations.lily-server = inputs.nixpkgs.lib.nixosSystem {
+    modules = [
+      self.nixosModules.serverConfig
+      self.nixosModules.serverHardware
+      self.nixosModules.nginx
+
+      self.nixosModules.lily
+
+      self.nixosModules.localization
+    ];
+  };
+}