hosts/jorah.cx.ts.hillion.co.uk/default.nix

@@ -46,6 +46,7 @@
     };
 
     networking.firewall = {
+      trustedInterfaces = [ "tailscale0" ];
       allowedTCPPorts = lib.mkForce [
         22 # SSH
       ];
@@ -55,9 +56,11 @@
           allowedTCPPorts = lib.mkForce [
             80 # HTTP 1-2
             443 # HTTPS 1-2
+            8080 # Unifi (inform)
           ];
           allowedUDPPorts = lib.mkForce [
             443 # HTTP 3
+            3478 # Unifi STUN
           ];
         };
       };

hosts/vm.strangervm.ts.hillion.co.uk/default.nix

@@ -61,20 +61,6 @@
       ipv6Addr = "fd7a:115c:a1e0:ab12:4843:cd96:626e:596f";
     };
 
-    ## Caddy
-    services.caddy = {
-      enable = true;
-      virtualHosts = {
-        "unifi.hillion.co.uk".extraConfig = ''
-          reverse_proxy https://unifi.unifi.ts.hillion.co.uk:8443 {
-            transport http {
-              tls_insecure_skip_verify
-            }
-          }
-        '';
-      };
-    };
-
     ## Backups
     services.postgresqlBackup.location = "/data/backup/postgres";
   };

modules/default.nix

@@ -13,6 +13,7 @@
     ./services/downloads.nix
     ./services/mastodon/default.nix
     ./services/matrix.nix
+    ./services/unifi.nix
     ./services/version_tracker.nix
     ./services/zigbee2mqtt.nix
     ./storj.nix

modules/impermanence.nix

@@ -47,7 +47,8 @@ in
       ] ++ (listIf config.custom.tailscale.enable [ "/var/lib/tailscale" ]) ++
       (listIf config.services.zigbee2mqtt.enable [ config.services.zigbee2mqtt.dataDir ]) ++
       (listIf config.services.postgresql.enable [ config.services.postgresql.dataDir ]) ++
-      (listIf config.hardware.bluetooth.enable [ "/var/lib/bluetooth" ]);
+      (listIf config.hardware.bluetooth.enable [ "/var/lib/bluetooth" ]) ++
+      (listIf config.custom.services.unifi.enable [ "/var/lib/unifi" ]);
     };
 
     home-manager.users =

modules/locations.nix

@@ -16,6 +16,7 @@ in
           downloads = "tywin.storage.ts.hillion.co.uk";
           mastodon = "vm.strangervm.ts.hillion.co.uk";
           matrix = "jorah.cx.ts.hillion.co.uk";
+          unifi = "jorah.cx.ts.hillion.co.uk";
         };
         drone = {
           server = "vm.strangervm.ts.hillion.co.uk";
@@ -28,6 +29,7 @@ in
     custom.services.downloads.enable = cfg.locations.services.downloads == config.networking.fqdn;
     custom.services.mastodon.enable = cfg.locations.services.mastodon == config.networking.fqdn;
     custom.services.matrix.enable = cfg.locations.services.matrix == config.networking.fqdn;
+    custom.services.unifi.enable = cfg.locations.services.unifi == config.networking.fqdn;
 
     custom.drone.server.enable = cfg.locations.drone.server == config.networking.fqdn;
   };

modules/services/unifi.nix

@@ -0,0 +1,59 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.custom.services.unifi;
+in
+{
+  options.custom.services.unifi = {
+    enable = lib.mkEnableOption "unifi";
+
+    dataDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/unifi";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.unifi = {
+      uid = config.ids.uids.unifi;
+      isSystemUser = true;
+      group = "unifi";
+      description = "UniFi controller daemon user";
+      home = "${cfg.dataDir}";
+    };
+    users.groups.unifi = {
+      gid = config.ids.gids.unifi;
+    };
+
+    services.caddy = {
+      enable = true;
+      virtualHosts = {
+        "unifi.hillion.co.uk".extraConfig = ''
+          reverse_proxy https://localhost:8443 {
+            transport http {
+              tls_insecure_skip_verify
+            }
+          }
+        '';
+      };
+    };
+
+    virtualisation.oci-containers.containers = {
+      "unifi" = {
+        image = "lscr.io/linuxserver/unifi-controller:8.0.7-ls218";
+        environment = {
+          PUID = toString config.ids.uids.unifi;
+          PGID = toString config.ids.gids.unifi;
+          TZ = "Etc/UTC";
+        };
+        volumes = [ "${cfg.dataDir}:/config" ];
+        ports = [
+          "8080:8080"
+          "8443:8443"
+          "3478:3478/udp"
+        ];
+      };
+    };
+  };
+}
+

modules/users.nix

@@ -4,6 +4,7 @@
   config = {
     ids.uids = {
       ## Defined System Users (see https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/misc/ids.nix)
+      unifi = 183;
 
       ## Consistent People
       jake = 1000;
@@ -11,6 +12,7 @@
     };
     ids.gids = {
       ## Defined System Groups (see https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/misc/ids.nix)
+      unifi = 183;
 
       ## Consistent Groups
       mediaaccess = 1200;