options/custom/containers/actualbudget.nix

@@ -15,10 +15,11 @@ in {
     virtualisation.arion.projects.actualbudget.settings.services = {
       actualbudget.service = {
         container_name = "actualbudget";
-        image = "actualbudget/actual-server:25.2.0";
+        image = "actualbudget/actual-server:24.9.0";
-        ports = ["127.0.0.1:5006:5006"];
+        ports = ["5006:5006"];
         restart = "unless-stopped";
         volumes = ["${config.custom.containers.directory}/actualbudget/data:/data"];
+        # TODO: Set up trusted proxies
       };
     };
   };

options/custom/containers/adguardhome.nix

@@ -1,56 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.custom.containers.adguardhome;
-in {
-  options = {
-    custom.containers.adguardhome.enable = mkOption {default = false;};
-  };
-
-  config = mkIf cfg.enable {
-    #?? arion-adguardhome pull
-    environment.shellAliases.arion-adguardhome = "sudo arion --prebuilt-file ${config.virtualisation.arion.projects.adguardhome.settings.out.dockerComposeYaml}";
-
-    virtualisation.arion.projects.adguardhome.settings.services = {
-      # https://github.com/AdguardTeam/AdGuardHome
-      # https://adguard-dns.io/kb/adguard-home/overview/
-      adguardhome.service = {
-        container_name = "adguardhome";
-        image = "adguard/adguardhome:v0.107.56";
-
-        ports = [
-          "53:53" # DNS
-          "853:853" # DNS-over-TLS
-          "3003:80" # Admin panel
-          "8443:443" # DNS-over-HTTPS
-        ];
-
-        restart = "unless-stopped";
-
-        volumes = [
-          "${config.custom.containers.directory}/adguardhome/config:/opt/adguardhome/conf"
-          "${config.custom.containers.directory}/adguardhome/data:/opt/adguardhome/data"
-        ];
-      };
-    };
-
-    # https://github.com/AdguardTeam/AdGuardHome/wiki/Encryption
-    networking.firewall = {
-      allowedTCPPorts = [
-        853 # DNS-over-TLS
-      ];
-
-      allowedUDPPorts = [
-        53 # DNS
-      ];
-    };
-
-    # https://adguard-dns.io/kb/adguard-home/faq/#bindinuse
-    services.resolved.extraConfig = ''
-      DNSStubListener=false
-    '';
-  };
-}

options/custom/containers/coturn.nix

@@ -46,25 +46,5 @@ in {
         };
       };
     };
-
-    networking.firewall = {
-      allowedTCPPorts = [
-        3478 # TURN
-        5349 # TURN
-      ];
-
-      allowedUDPPorts = [
-        3478 # TURN
-        5349 # TURN
-      ];
-
-      allowedUDPPortRanges = [
-        {
-          # TURN
-          from = 49152;
-          to = 65535;
-        }
-      ];
-    };
   };
 }

options/custom/containers/oryx.nix

@@ -38,16 +38,5 @@ in {
         volumes = ["${config.custom.containers.directory}/oryx/data:/data"];
       };
     };
-
-    networking.firewall = {
-      allowedTCPPorts = [
-        1935 # RTMP
-      ];
-
-      allowedUDPPorts = [
-        8000 # WebRTC
-        10080 # SRT
-      ];
-    };
   };
 }

options/custom/containers/owncast.nix

@@ -25,11 +25,5 @@ in {
         ];
       };
     };
-
-    networking.firewall = {
-      allowedTCPPorts = [
-        1935 # RTMP
-      ];
-    };
   };
 }

options/custom/services/caddy.nix

@@ -54,9 +54,29 @@ in {
     # https://github.com/coturn/coturn/blob/master/docker/coturn/README.md
     # https://element-hq.github.io/synapse/latest/turn-howto.html
     networking.firewall = {
+      enable = true;
+
       allowedTCPPorts = [
         80 # HTTP
         443 # HTTPS
+        1935 # RTMP
+        3478 # TURN
+        5349 # TURN
+      ];
+
+      allowedUDPPorts = [
+        3478 # TURN
+        5349 # TURN
+        8000 # WebRTC
+        10080 # SRT
+      ];
+
+      allowedUDPPortRanges = [
+        {
+          # TURN
+          from = 49152;
+          to = 65535;
+        }
       ];
     };
   };

options/custom/settings/networking.nix

@@ -9,7 +9,6 @@ in {
   options.custom.settings.networking = {
     enable = mkOption {default = false;};
     dns = mkOption {default = config.custom.default;};
-    firewall = mkOption {default = config.custom.default;};
     ipv4 = mkOption {default = null;};
     ipv6 = mkOption {default = null;};
     networkd = mkOption {default = !cfg.networkmanager;};
@@ -31,7 +30,6 @@ in {
     # https://wiki.nixos.org/wiki/Networking
     networking = {
       hostName = config.custom.hostname;
-      firewall.enable = cfg.firewall;
       useNetworkd = cfg.networkd;
       wireless.iwd.enable = cfg.wifi;
 

profiles/server/default.nix

@@ -10,8 +10,7 @@
     containers = {
       enable = true;
       boot = true;
-      actualbudget.enable = true;
+      #// actualbudget.enable = true;
-      adguardhome.enable = true;
       conduwuit.enable = true;
       coturn.enable = true;
       forgejo.enable = true;