nix-conf/hosts/router/services.nix

{ config, lib, pkgs, ... }:
let
  vars = import ./vars.nix;
  domain = vars.domain;
in
{
  # Glance dashboard
  services.glance.enable = true;
  services.glance.settings.pages = [
    {
     name = "Home";
     # hideDesktopNavigation = true; # Uncomment if needed
     columns = [
       {
         size = "small";
         widgets = [
           {
             type = "calendar";
             firstDayOfWeek = "monday";
           }
           {
             type = "rss";
             limit = 10;
             collapseAfter = 3;
             cache = "12h";
             feeds = [
               { url = "https://rtk0c.pages.dev/index.xml"; }
               { url = "https://www.yegor256.com/rss.xml"; }
               { url = "https://selfh.st/rss/"; title = "selfh.st"; }
               { url = "https://ciechanow.ski/atom.xml"; }
               { url = "https://www.joshwcomeau.com/rss.xml"; title = "Josh Comeau"; }
               { url = "https://samwho.dev/rss.xml"; }
               { url = "https://ishadeed.com/feed.xml"; title = "Ahmad Shadeed"; }
             ];
           }
           {
             type = "twitch-channels";
             channels = [
               "theprimeagen"
               "j_blow"
               "piratesoftware"
               "cohhcarnage"
               "christitustech"
               "EJ_SA"
             ];
           }
         ];
       }
       {
         size = "full";
         widgets = [
           {
             type = "group";
             widgets = [
               { type = "hacker-news"; }
               { type = "lobsters"; }
             ];
           }
           {
             type = "videos";
             channels = [
               "UCXuqSBlHAE6Xw-yeJA0Tunw" # Linus Tech Tips
               "UCR-DXc1voovS8nhAvccRZhg" # Jeff Geerling
               "UCsBjURrPoezykLs9EqgamOA" # Fireship
               "UCBJycsmduvYEL83R_U4JriQ" # Marques Brownlee
               "UCHnyfMqiRRG1u-2MsSQLbXA" # Veritasium
             ];
           }
           {
             type = "group";
             widgets = [
               {
                 type = "reddit";
                 subreddit = "technology";
                 showThumbnails = true;
               }
               {
                 type = "reddit";
                 subreddit = "selfhosted";
                 showThumbnails = true;
               }
             ];
           }
         ];
       }
       {
         size = "small";
         widgets = [
           {
             type = "weather";
             location = "San Jose, California, United States";
             units = "metric";
             hourFormat = "12h";
             # hideLocation = true; # Uncomment if needed
           }
           {
             type = "server-stats";
             servers = [
               { type = "local"; name = "Router"; }
             ];
           }
           {
             type = "dns-stats";
             service = "adguard";
             url = "http://localhost:${toString config.services.adguardhome.port}";
             username = "admin";
             password = "admin";
           }
           {
             type = "markets";
             markets = [
               { symbol = "SPY"; name = "S&P 500"; }
               { symbol = "BTC-USD"; name = "Bitcoin"; }
               { symbol = "NVDA"; name = "NVIDIA"; }
               { symbol = "AAPL"; name = "Apple"; }
               { symbol = "MSFT"; name = "Microsoft"; }
             ];
           }
           {
             type = "releases";
             cache = "1d";
             # token = "..."; # Uncomment and set if needed
             repositories = [
               "glanceapp/glance"
               "go-gitea/gitea"
               "immich-app/immich"
               "syncthing/syncthing"
             ];
           }
         ];
       }
     ];
    }
  ];

  # vnStat for tracking network interface stats
  services.vnstat.enable = true;

  # https://wiki.nixos.org/wiki/Prometheus
  services.prometheus = {
    enable = true;
    exporters = {
      # TODO: DNS, Kea, Knot, other exporters
      node = {
        enable = true;
        enabledCollectors = [ "systemd" ];
      };
    };
    scrapeConfigs = [
      {
        job_name = "node";
        static_configs = [{
          targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ];
        }];
      }
    ];
  };

  # https://wiki.nixos.org/wiki/Grafana#Declarative_configuration
  services.grafana = {
    enable = true;
    settings.server = {
      http_port = 3001;
      serve_from_sub_path = true;
      root_url = "%(protocol)s://%(domain)s:%(http_port)s/grafana/";
    };
    provision = {
      enable = true;
      datasources.settings.datasources = [
        {
          name = "Prometheus";
          type = "prometheus";
          url = "http://localhost:${toString config.services.prometheus.port}";
        }
      ];
    };
  };

  secrix.system.secrets.cf-api-key.encrypted.file = ../../secrets/cf_api_key.age;
  systemd.services.caddy.serviceConfig.EnvironmentFile = config.secrix.system.secrets.cf-api-key.decrypted.path;
  services.caddy = {
    enable = true;
    package = pkgs.caddy.withPlugins {
      plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
      hash = "sha256-saKJatiBZ4775IV2C5JLOmZ4BwHKFtRZan94aS5pO90=";
    };
    virtualHosts."grouter.${domain}".extraConfig = ''
      encode
      tls {
          dns cloudflare {env.CF_API_KEY}
          resolvers 1.1.1.1
      }
      @grafana path /grafana /grafana/*
      handle @grafana {
          reverse_proxy localhost:${toString config.services.grafana.settings.server.http_port}
      }
      redir /adghome /adghome/
      handle_path /adghome/* {
          reverse_proxy localhost:${toString config.services.adguardhome.port}
          basic_auth {
              Bob $2a$14$HsWmmzQTN68K3vwiRAfiUuqIjKoXEXaj9TOLUtG2mO1vFpdovmyBy
          }
      }
      handle /* {
          reverse_proxy localhost:${toString config.services.glance.settings.server.port}
      }
    '';
  };
}