feat: add pangolin and newt modules

modules/hosts/alpha/config.nix

@@ -39,8 +39,13 @@
         };
 
         services = {
-          pangolin = {
+          nginx = {
             enable = true;
+            domain = "lab.tux.rs";
+          };
+
+          pangolin = {
+            enable = false;
             domain = "pangolin.lab.tux.rs";
             baseDomain = "lab.tux.rs";
             environmentFile = innerArgs.config.sops.secrets."pangolin".path;
@@ -48,11 +53,19 @@
 
           uptime-kuma = {
             enable = true;
+            port = 1111;
             domain = "status.lab.tux.rs";
           };
 
+          vaultwarden = {
+            enable = true;
+            port = 9999;
+            domain = "bw.lab.tux.rs";
+          };
+
           mediaflow-proxy = {
             enable = true;
+            port = 8888;
             environmentFile = innerArgs.config.sops.secrets."mediaflow-proxy".path;
           };
         };

modules/hosts/arcturus/config.nix

@@ -43,7 +43,7 @@
           openssh.enable = true;
           netbird-client.enable = true;
           newt = {
-            enable = true;
+            enable = false;
             environmentFile = innerArgs.config.sops.secrets.newt.path;
           };
         };
@@ -53,12 +53,6 @@
             enable = true;
             environmentFile = innerArgs.config.sops.secrets.discord-token.path;
           };
-
-          vaultwarden = {
-            enable = true;
-            domain = "bw.lab.tux.rs";
-            configurePangolin = true;
-          };
         };
 
         virtualisation = {

modules/hosts/arcturus/secrets.yaml

@@ -4,7 +4,7 @@ gemini-api-key: ENC[AES256_GCM,data:gLZSoYTdKY+rwIpYiXvN9n9PGkUD6q8Oe7dHnYkjEjwD
 openrouter-api-key: ENC[AES256_GCM,data:6xONCl9lqOoO7b4CEyCz9607tICDUAkpglRjGS5nYq2ppg2UKqYTrWD1BGCA5Xfs/CWskniVhoNG3vscjKiYCCh9gbM6aqdmTQ==,iv:7Iwc9t00HOOBjA7URXcUO41badqYyJCkFHM/uPkLFxY=,tag:Cl39kitr2e0//HVwAdsdUQ==,type:str]
 opencode-go-api-key: ENC[AES256_GCM,data:dmeRKn7TWHnqvpyPQpcEG6yHTb2bRby/rh10ytL0jHj5R+lRmNVdmqUF92GTznY9vEaB6ZYCJecWhpm8g4upNfOWBg==,iv:9UMJpAlD8gpcNiN+liu3nawoAZQKapEg7sCp561N9E8=,tag:OZlASpOa5BQaQwFWjoLCRw==,type:str]
 netbird-key: ENC[AES256_GCM,data:q6eKisca04qn/CvALrvXF79MsToDhvLRLv2JTiUBAZglCC9m,iv:jj0/ZD7IDgopprTVUgSfJmdAJmUP3iqewU3dqssGYbk=,tag:6IPRdCm2FGdlTEIX7jt3qA==,type:str]
-newt: ENC[AES256_GCM,data:r5Rd81ZrzrIYbXtFkypbJltoGCOYrW6P4IpwGCtaH7lqCg7wD/WMboMx13HN4Mm0J4qbBpDakpfVv9qUTrisYP1xwpKkmY1kqPlFWRZN8hzuuNS2Tv3qUjavTp5XGotVPLHj1Cg/cwGcf8EAssYTwTy7H0PgdQKwqigQD1f1s/j4iXQ=,iv:1xP38/Ayt1xvn2fJGa5zgOrVNOw2J5taG1Orx6uNgZI=,tag:H9JXu9gzyyvTPWgXaoTsiw==,type:str]
+newt: ENC[AES256_GCM,data:Agv3ljcUhld+e+YpRNsOXuQPq5uyZWQ+S6epUH044CIlvrC3DMFskOFVPnDco9P5y0pBnL5m9rltlRiQtMP4RNMzYFz5yR/weskmvZkt3dtZ2sdyaK36p6PTsQDOLl3l8rCDoFxaGRHBz3gD5Gyz9lS5GmLcZql6xg/VIAMdwv36/g0=,iv:NrsrTVJ+ycjEU1/nPigCXGUoIZqheEf+WqYhVqVsuJ0=,tag:0UqLf5ZdVCoQrhKDq4EgPw==,type:str]
 sops:
     age:
         - enc: |
@@ -25,7 +25,7 @@ sops:
             TLKEYsPQgOJ7s8P9gw2uPUY6HRz86CtiC6EbO27u0+8BbI85x1QScg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1huqa3hc7wcxk4dpelrzny437nzrx4fnll3d8g9ahznzk268yju5qufapxy
-    lastmodified: "2026-08-09T11:21:03Z"
-    mac: ENC[AES256_GCM,data:XFy+AiJRfrLhbX3j+0oO24qiHD5Hj2bVFqTMbUOOzsJzR0r8FBrwSNAZ0FVlFPFPAMitAIpZySS+kvbmEdZUfZ0soo83F5qwH6i/H5PZxqyDHst/Ig6Mrypp2DZMNZXNlqyLLmuaNGDf2pqApxCM3eSsgvCsNxdapRKlLSFJou4=,iv:D7gB4J4dhCfRo+1DaUAvOe3dWpoGvzIFouCJBNpwKiY=,tag:eLBZq/+Lce2S5Hu9OIC3gw==,type:str]
+    lastmodified: "2026-08-08T11:57:44Z"
+    mac: ENC[AES256_GCM,data:0BYRw78P4Q0x/Wm5XmT1Jg3o/njic4qmaCFrZ+Egz34TL42zLCjax7TvVrJ/Rzb6UqGgeQb0Nca+JOHjOqs5J+J3SqnTpWnQa51LBu3naPwMphPhGrXgmvzHIFNlTXmljxjGo7tHt8hWHtHy6SgAOuep4tP7vgV/XeY91HGQyXc=,iv:mEbJ8OZ+uaTjhG4tsrHtPjQ6N6UDo7yAJAA7JMdO/r8=,tag:JE2aqSv4hJT4hpWZiyu9/g==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3

modules/nixos/networking/netbird-client.nix

@@ -18,7 +18,7 @@
       config = mkIf cfg.enable {
         services.netbird.clients = {
           ${hostName} = {
-            port = 61820;
+            port = 51820;
             login = {
               enable = true;
               setupKeyFile = config.sops.secrets.netbird-key.path;

modules/nixos/services/aiostreams.nix

@@ -15,12 +15,6 @@
       options.tnix.services.aiostreams = {
         enable = mkEnableOption "AIOStreams";
 
-        host = mkOption {
-          type = types.str;
-          default = "127.0.0.1";
-          description = "Host on which AIOStreams listens";
-        };
-
         port = mkOption {
           type = types.port;
           default = 3000;
@@ -30,19 +24,7 @@
         domain = mkOption {
           type = types.str;
           default = "";
-          description = "Domain on which AIOStreams is available";
-        };
-
-        configureNginx = mkOption {
-          type = types.bool;
-          default = false;
-          description = "Whether to configure Nginx as a reverse proxy for AIOStreams";
-        };
-
-        configurePangolin = mkOption {
-          type = types.bool;
-          default = false;
-          description = "Whether to configure Pangolin as a reverse proxy for AIOStreams";
+          description = "Domain on which nginx serves AIOStreams (disabled when empty)";
         };
 
         image = mkOption {
@@ -65,17 +47,10 @@
       };
 
       config = mkIf cfg.enable {
-        assertions = [
-          {
-            assertion = cfg.domain != "";
-            message = "tnix.services.aiostreams.domain must be set when tnix.services.aiostreams.enable is true.";
-          }
-        ];
-
         virtualisation.oci-containers.containers.aiostreams = {
           image = cfg.image;
           ports = [
-            "${cfg.host}:${port}:3000"
+            "127.0.0.1:${port}:3000"
           ];
           environment = {
             ADDON_ID = cfg.domain;
@@ -87,39 +62,11 @@
           ];
         };
 
-        services = {
-          nginx.virtualHosts.${cfg.domain} = mkIf cfg.configureNginx {
+        services.nginx.virtualHosts.${cfg.domain} = mkIf (cfg.domain != "") {
           forceSSL = acmeHost != "";
           useACMEHost = mkIf (acmeHost != "") acmeHost;
           locations."/" = {
-              proxyPass = "http://${cfg.host}:${port}";
-              proxyWebsockets = true;
-            };
-          };
-
-          newt.blueprint.proxy-resources = mkIf cfg.configurePangolin {
-            aiostreams = {
-              auth = {
-                sso-enabled = false;
-              };
-              full-domain = cfg.domain;
-              name = "aiostreams";
-              protocol = "http";
-              targets = [
-                {
-                  hostname = "localhost";
-                  method = "http";
-                  port = cfg.port;
-                  healthcheck = {
-                    hostname = "localhost";
-                    port = cfg.port;
-                    scheme = "http";
-                    method = "GET";
-                    path = "/";
-                  };
-                }
-              ];
-            };
+            proxyPass = "http://127.0.0.1:${port}";
           };
         };
       };

modules/nixos/services/gitea.nix

@@ -1,123 +0,0 @@
-{
-  flake.modules.nixos.services =
-    {
-      config,
-      lib,
-      ...
-    }:
-    with lib;
-    let
-      cfg = config.tnix.services.gitea;
-      port = toString cfg.port;
-      acmeHost = config.tnix.services.nginx.domain;
-    in
-    {
-      options.tnix.services.gitea = {
-        enable = mkEnableOption "Gitea";
-
-        host = mkOption {
-          type = types.str;
-          default = "127.0.0.1";
-          description = "Host on which Gitea listens";
-        };
-
-        port = mkOption {
-          type = types.port;
-          default = 1114;
-          description = "Port on which Gitea listens";
-        };
-
-        domain = mkOption {
-          type = types.str;
-          default = "";
-          description = "Domain on which Gitea is available";
-        };
-
-        configureNginx = mkOption {
-          type = types.bool;
-          default = false;
-          description = "Whether to configure Nginx as a reverse proxy for Gitea";
-        };
-
-        configurePangolin = mkOption {
-          type = types.bool;
-          default = false;
-          description = "Whether to configure Pangolin as a reverse proxy for Gitea";
-        };
-      };
-
-      config = mkIf cfg.enable {
-        assertions = [
-          {
-            assertion = cfg.domain != "";
-            message = "tnix.services.gitea.domain must be set when tnix.services.gitea.enable is true.";
-          }
-        ];
-
-        services = {
-          gitea = {
-            enable = true;
-            settings = {
-              service.DISABLE_REGISTRATION = true;
-              server = {
-                HTTP_ADDR = cfg.host;
-                HTTP_PORT = cfg.port;
-                DOMAIN = cfg.domain;
-                ROOT_URL = "https://${cfg.domain}";
-              };
-            };
-            database = {
-              type = "postgres";
-              name = "gitea";
-              user = "gitea";
-            };
-          };
-
-          nginx.virtualHosts.${cfg.domain} = mkIf cfg.configureNginx {
-            forceSSL = acmeHost != "";
-            useACMEHost = mkIf (acmeHost != "") acmeHost;
-            locations."/" = {
-              proxyPass = "http://${cfg.host}:${port}";
-              proxyWebsockets = true;
-            };
-          };
-
-          newt.blueprint.proxy-resources = mkIf cfg.configurePangolin {
-            gitea = {
-              auth = {
-                sso-enabled = false;
-              };
-              full-domain = cfg.domain;
-              name = "gitea";
-              protocol = "http";
-              targets = [
-                {
-                  hostname = "localhost";
-                  method = "http";
-                  port = cfg.port;
-                  healthcheck = {
-                    hostname = "localhost";
-                    port = cfg.port;
-                    scheme = "http";
-                    method = "GET";
-                    path = "/";
-                  };
-                }
-              ];
-            };
-          };
-
-          postgresql = {
-            enable = true;
-            ensureDatabases = [ "gitea" ];
-            ensureUsers = [
-              {
-                name = "gitea";
-                ensureDBOwnership = true;
-              }
-            ];
-          };
-        };
-      };
-    };
-}

modules/nixos/services/mediaflow-proxy.nix

@@ -15,34 +15,16 @@
       options.tnix.services.mediaflow-proxy = {
         enable = mkEnableOption "MediaFlow Proxy";
 
-        host = mkOption {
-          type = types.str;
-          default = "0.0.0.0";
-          description = "Host on which MediaFlow Proxy listens";
-        };
-
         port = mkOption {
           type = types.port;
-          default = 1113;
+          default = 8888;
           description = "Port on which MediaFlow Proxy listens";
         };
 
         domain = mkOption {
           type = types.str;
           default = "";
-          description = "Domain on which MediaFlow Proxy is available";
-        };
-
-        configureNginx = mkOption {
-          type = types.bool;
-          default = false;
-          description = "Whether to configure Nginx as a reverse proxy for MediaFlow Proxy";
-        };
-
-        configurePangolin = mkOption {
-          type = types.bool;
-          default = false;
-          description = "Whether to configure Pangolin as a reverse proxy for MediaFlow Proxy";
+          description = "Domain on which nginx serves MediaFlow Proxy (disabled when empty)";
         };
 
         image = mkOption {
@@ -59,21 +41,10 @@
       };
 
       config = mkIf cfg.enable {
-        assertions = [
-          {
-            assertion = !cfg.configureNginx || cfg.domain != "";
-            message = "tnix.services.mediaflow-proxy.domain must be set when tnix.services.mediaflow-proxy.configureNginx is enabled.";
-          }
-          {
-            assertion = !cfg.configurePangolin || cfg.domain != "";
-            message = "tnix.services.mediaflow-proxy.domain must be set when tnix.services.mediaflow-proxy.configurePangolin is enabled.";
-          }
-        ];
-
         virtualisation.oci-containers.containers.mediaflow-proxy = {
           image = cfg.image;
           ports = [
-            "${cfg.host}:${port}:${port}"
+            "${port}:${port}"
           ];
           environment = {
             APP__SERVER__HOST = "0.0.0.0";
@@ -82,41 +53,14 @@
           environmentFiles = optional (cfg.environmentFile != null) cfg.environmentFile;
         };
 
-        services = {
-          nginx.virtualHosts.${cfg.domain} = mkIf cfg.configureNginx {
+        services.nginx.virtualHosts.${cfg.domain} = mkIf (cfg.domain != "") {
           forceSSL = acmeHost != "";
           useACMEHost = mkIf (acmeHost != "") acmeHost;
           locations."/" = {
-              proxyPass = "http://${cfg.host}:${port}";
+            proxyPass = "http://127.0.0.1:${port}";
             proxyWebsockets = true;
           };
         };
-
-          newt.blueprint.proxy-resources = mkIf cfg.configurePangolin {
-            mediaflow-proxy = {
-              auth = {
-                sso-enabled = false;
-              };
-              full-domain = cfg.domain;
-              name = "mediaflow-proxy";
-              protocol = "http";
-              targets = [
-                {
-                  hostname = "localhost";
-                  method = "http";
-                  port = cfg.port;
-                  healthcheck = {
-                    hostname = "localhost";
-                    port = cfg.port;
-                    scheme = "http";
-                    method = "GET";
-                    path = "/";
-                  };
-                }
-              ];
-            };
-          };
-        };
       };
     };
 }

modules/nixos/services/pangolin.nix

@@ -4,7 +4,6 @@
       config,
       lib,
       userEmail,
-      pkgs,
       ...
     }:
     with lib;
@@ -18,13 +17,13 @@
         domain = mkOption {
           type = types.str;
           default = "";
-          description = "Domain on which Pangolin Dashboard is available";
+          description = "Domain on which nginx serves MediaFlow Proxy (disabled when empty)";
         };
 
         baseDomain = mkOption {
           type = types.str;
           default = "";
-          description = "Pangolin base fully qualified domain name";
+          description = "Domain on which nginx serves MediaFlow Proxy (disabled when empty)";
         };
 
         environmentFile = mkOption {
@@ -38,11 +37,6 @@
         services = {
           pangolin = {
             enable = true;
-            package = (
-              pkgs.fosrl-pangolin.override {
-                databaseType = "pg";
-              }
-            );
             openFirewall = true;
             baseDomain = cfg.baseDomain;
             dashboardDomain = cfg.domain;
@@ -64,14 +58,20 @@
                 # see https://github.com/fosrl/newt/issues/37
                 internal_hostname = "localhost";
               };
-              gerbil.base_endpoint = config.services.pangolin.dashboardDomain;
+              gerbil = {
+                base_endpoint = "178.105.102.63";
+                port = 51820;
+                clients_start_port = 21820;
+              };
               flags = {
                 disable_signup_without_invite = true;
                 enable_integration_api = false;
                 allow_raw_resources = true;
                 disable_enterprise_features = true;
               };
-              postgres.connection_string = "postgresql:///pangolin?host=/run/postgresql";
+              postgres = {
+                connection_string = "postgresql:///pangolin?host=/run/postgresql";
+              };
             };
           };
 

modules/nixos/services/uptime-kuma.nix

@@ -15,12 +15,6 @@
       options.tnix.services.uptime-kuma = {
         enable = mkEnableOption "Uptime Kuma";
 
-        host = mkOption {
-          type = types.str;
-          default = "127.0.0.1";
-          description = "Host on which Uptime Kuma listens";
-        };
-
         port = mkOption {
           type = types.port;
           default = 1111;
@@ -30,70 +24,25 @@
         domain = mkOption {
           type = types.str;
           default = "";
-          description = "Domain on which Uptime Kuma is available";
-        };
-
-        configureNginx = mkOption {
-          type = types.bool;
-          default = false;
-          description = "Whether to configure Nginx as a reverse proxy for Uptime Kuma";
-        };
-
-        configurePangolin = mkOption {
-          type = types.bool;
-          default = false;
-          description = "Whether to configure Pangolin as a reverse proxy for Uptime Kuma";
+          description = "Domain on which nginx serves Uptime Kuma (disabled when empty)";
         };
       };
 
       config = mkIf cfg.enable {
-        assertions = [
-          {
-            assertion = cfg.domain != "";
-            message = "tnix.services.uptime-kuma.domain must be set when tnix.services.uptime-kuma.enable is true.";
-          }
-        ];
-
         services = {
           uptime-kuma = {
             enable = true;
             settings = {
-              HOST = cfg.host;
+              HOST = "127.0.0.1";
               PORT = port;
             };
           };
 
-          nginx.virtualHosts.${cfg.domain} = mkIf cfg.configureNginx {
+          nginx.virtualHosts.${cfg.domain} = mkIf (cfg.domain != "") {
             forceSSL = acmeHost != "";
             useACMEHost = mkIf (acmeHost != "") acmeHost;
             locations."/" = {
-              proxyPass = "http://${cfg.host}:${port}";
-              proxyWebsockets = true;
-            };
-          };
-
-          newt.blueprint.proxy-resources = mkIf cfg.configurePangolin {
-            uptime-kuma = {
-              auth = {
-                sso-enabled = false;
-              };
-              full-domain = cfg.domain;
-              name = "uptime-kuma";
-              protocol = "http";
-              targets = [
-                {
-                  hostname = "localhost";
-                  method = "http";
-                  port = cfg.port;
-                  healthcheck = {
-                    hostname = "localhost";
-                    port = cfg.port;
-                    scheme = "http";
-                    method = "GET";
-                    path = "/";
-                  };
-                }
-              ];
+              proxyPass = "http://127.0.0.1:${port}";
             };
           };
         };

modules/nixos/services/vaultwarden.nix

@@ -15,51 +15,26 @@
       options.tnix.services.vaultwarden = {
         enable = mkEnableOption "Vaultwarden";
 
-        host = mkOption {
-          type = types.str;
-          default = "127.0.0.1";
-          description = "Host on which Vaultwarden listens";
-        };
-
         port = mkOption {
           type = types.port;
-          default = 1112;
+          default = 8000;
           description = "Port on which Vaultwarden listens";
         };
 
         domain = mkOption {
           type = types.str;
           default = "";
-          description = "Domain on which Vaultwarden is available";
-        };
-
-        configureNginx = mkOption {
-          type = types.bool;
-          default = false;
-          description = "Whether to configure Nginx as a reverse proxy for Vaultwarden";
-        };
-
-        configurePangolin = mkOption {
-          type = types.bool;
-          default = false;
-          description = "Whether to configure Pangolin as a reverse proxy for Vaultwarden";
+          description = "Domain on which nginx serves Vaultwarden (disabled when empty)";
         };
       };
 
       config = mkIf cfg.enable {
-        assertions = [
-          {
-            assertion = cfg.domain != "";
-            message = "tnix.services.vaultwarden.domain must be set when tnix.services.vaultwarden.enable is true.";
-          }
-        ];
-
         services = {
           vaultwarden = {
             enable = true;
             dbBackend = "postgresql";
             config = {
-              ROCKET_ADDRESS = cfg.host;
+              ROCKET_ADDRESS = "127.0.0.1";
               ROCKET_PORT = cfg.port;
               DOMAIN = "https://${cfg.domain}";
 
@@ -70,40 +45,15 @@
             };
           };
 
-          nginx.virtualHosts.${cfg.domain} = mkIf cfg.configureNginx {
+          nginx.virtualHosts.${cfg.domain} = mkIf (cfg.domain != "") {
             forceSSL = acmeHost != "";
             useACMEHost = mkIf (acmeHost != "") acmeHost;
             locations."/" = {
-              proxyPass = "http://${cfg.host}:${port}";
+              proxyPass = "http://127.0.0.1:${port}";
               proxyWebsockets = true;
             };
           };
 
-          newt.blueprint.proxy-resources = mkIf cfg.configurePangolin {
-            vaultwarden = {
-              auth = {
-                sso-enabled = false;
-              };
-              full-domain = cfg.domain;
-              name = "vaultwarden";
-              protocol = "http";
-              targets = [
-                {
-                  hostname = "localhost";
-                  method = "http";
-                  port = cfg.port;
-                  healthcheck = {
-                    hostname = "localhost";
-                    port = cfg.port;
-                    scheme = "http";
-                    method = "GET";
-                    path = "/";
-                  };
-                }
-              ];
-            };
-          };
-
           postgresql = {
             enable = true;
             ensureDatabases = [ "vaultwarden" ];