From 5c9999132b46b643dbf2176fd729b587e2b55e09 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Thu, 11 Jun 2026 21:39:43 +0200 Subject: [PATCH 1/7] Add beszel module --- hosts/srv03/default.nix | 6 +++++ modules/beszel-hub.nix | 58 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 64 insertions(+) create mode 100644 modules/beszel-hub.nix diff --git a/hosts/srv03/default.nix b/hosts/srv03/default.nix index 78f2cfc..d53ba85 100644 --- a/hosts/srv03/default.nix +++ b/hosts/srv03/default.nix @@ -16,6 +16,7 @@ ../../modules/docker.nix ../../modules/traefik.nix ../../modules/pocket-id.nix + ../../modules/beszel-hub.nix ../../modules/netbird-docker.nix ../../modules/netbird-client.nix ../../modules/dockhand.nix @@ -51,6 +52,11 @@ appUrl = "dockhand.jfreudenberger.de"; }; + beszel-docker = { + enable = true; + appUrl = "https://beszel.jfreudenberger.de"; + }; + netbird-docker = { enable = true; secrets = config.age.secrets.netbird-server; diff --git a/modules/beszel-hub.nix b/modules/beszel-hub.nix new file mode 100644 index 0000000..7b2376a --- /dev/null +++ b/modules/beszel-hub.nix @@ -0,0 +1,58 @@ +{ + config, + lib, + ... +}: +let + + cfg = config.services.beszel-docker; + version = "0.18.7"; + +in { + + options.services.beszel-docker = { + enable = lib.mkEnableOption "Beszel hub hosted as OCI container"; + appUrl = lib.mkOption { + description = "URL of the beszel hub"; + type = lib.types.str; + }; + }; + + config = lib.mkIf cfg.enable { + virtualisation.oci-containers.containers = { + beszel = { + image = "henrygd/beszel:${version}"; + autoStart = true; + networks = [ + "traefik" + ]; + environment = { + APP_URL = cfg.appUrl; + }; + extraOptions = [ + ''--mount=type=volume,source=data,target=/beszel_data,volume-driver=local'' + /*''--health-cmd=["/beszel" "health" "--url" "http://localhost:8090"]'' + "--health-interval=120s" + "--health-timeout=5s" + "--health-retries=2" + "--health-start-period=10s"*/ + ]; + labels = { + "traefik.enable" = "true"; + "traefik.http.routers.beszel.rule" = "Host(`${lib.removePrefix "https://" cfg.appUrl}`)"; + "traefik.http.routers.beszel.entrypoints" = "websecure"; + }; + }; + }; + + systemd.services."docker-beszel" = { + after = [ + "docker-traefik.service" + ]; + requires = [ + "docker-traefik.service" + ]; + }; + + }; +} From a7abed17d5fd78979c47fd894b0447d739deef28 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Thu, 11 Jun 2026 21:40:57 +0200 Subject: [PATCH 2/7] Add beszel agent to busch --- flake.nix | 1 + hosts/busch/default.nix | 35 +++++++++++++++++++++++------------ hosts/busch/secrets.nix | 6 ++++++ 3 files changed, 30 insertions(+), 12 deletions(-) create mode 100644 hosts/busch/secrets.nix diff --git a/flake.nix b/flake.nix index 217baab..fe2e6da 100644 --- a/flake.nix +++ b/flake.nix @@ -136,6 +136,7 @@ modules = [ ./hosts/busch disko.nixosModules.disko + agenix.nixosModules.default proxmox-nixos.nixosModules.proxmox-ve ({...}: { diff --git a/hosts/busch/default.nix b/hosts/busch/default.nix index 0d84c12..3c55b48 100644 --- a/hosts/busch/default.nix +++ b/hosts/busch/default.nix @@ -4,6 +4,7 @@ imports = [ ./disko.nix + ./secrets.nix ../../modules/nix.nix ../../modules/auto-upgrade.nix @@ -29,21 +30,31 @@ networking.hostName = "busch"; # Define your hostname. - services.netbird = { - package = pkgs-unstable.netbird; - useRoutingFeatures = "both"; - clients.wt0 = { - hardened = false; - login = { - enable = true; - setupKeyFile = (pkgs.writeText "setupKey" '' - A99F5508-D543-40B7-A31A-A8931B1AE246 - '').outPath; + services = { + netbird = { + package = pkgs-unstable.netbird; + useRoutingFeatures = "both"; + clients.wt0 = { + hardened = false; + login = { + enable = true; + setupKeyFile = (pkgs.writeText "setupKey" '' + A99F5508-D543-40B7-A31A-A8931B1AE246 + '').outPath; + }; + port = 51820; + environment = { + NB_MANAGEMENT_URL = "https://netbird.jfreudenberger.de"; + }; }; - port = 51820; + }; + beszel.agent = { + enable = true; environment = { - NB_MANAGEMENT_URL = "https://netbird.jfreudenberger.de"; + HUB_URL = "https://beszel.jfreudenberger.de"; + DISABLE_SSH = "true"; }; + environmentFile = config.age.secrets.beszel.path; }; }; systemd.services.${config.services.netbird.clients.wt0.service.name}.path = [ pkgs.shadow ]; diff --git a/hosts/busch/secrets.nix b/hosts/busch/secrets.nix new file mode 100644 index 0000000..b98512e --- /dev/null +++ b/hosts/busch/secrets.nix @@ -0,0 +1,6 @@ +{ inputs, ... }: +{ + age.secrets = { + beszel.file = "${inputs.secrets}/secrets/busch/beszel"; + }; +} From 80437389dc3b384948fa1de1963a4929111ef058 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Thu, 11 Jun 2026 21:41:29 +0200 Subject: [PATCH 3/7] Add networkmanager_dmenu to i3 --- modules/i3.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/i3.nix b/modules/i3.nix index 80fcb57..9540221 100644 --- a/modules/i3.nix +++ b/modules/i3.nix @@ -41,6 +41,7 @@ pinentry-gnome3 xdotool playerctl + networkmanager_dmenu ]; }; From 0f29ecacfddb9f9ae39e937e446ab59bbbe84682 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Thu, 11 Jun 2026 21:41:56 +0200 Subject: [PATCH 4/7] pocket-id: 2.6.2 -> 2.8.0 --- modules/pocket-id.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/pocket-id.nix b/modules/pocket-id.nix index ff62097..fd311c1 100644 --- a/modules/pocket-id.nix +++ b/modules/pocket-id.nix @@ -7,7 +7,7 @@ let cfg = config.services.pocket-id-docker; pocketidCfg = config.services.pocket-id; - version = "2.6.2"; + version = "2.8.0"; in { From a8cdec9d9a27f3f4ea8b34a61b0f9f0303ade051 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Thu, 11 Jun 2026 21:42:35 +0200 Subject: [PATCH 5/7] traefik: 3.6.14 -> 3.7.5 --- modules/traefik.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/traefik.nix b/modules/traefik.nix index 322c190..7e8e19c 100644 --- a/modules/traefik.nix +++ b/modules/traefik.nix @@ -7,7 +7,7 @@ let cfg = config.services.traefik-docker; - version = "3.6.14"; + version = "3.7.5"; in { From 8d09ffa2d807aff0b9f69cc3d7e6abcd1b4f4f27 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Thu, 11 Jun 2026 23:23:21 +0200 Subject: [PATCH 6/7] Add baszel agent to vms and xcy --- hosts/busch-gpu-docker/default.nix | 9 +++++++++ hosts/busch-gpu-docker/secrets.nix | 1 + hosts/busch-main-docker/default.nix | 9 +++++++++ hosts/busch-main-docker/secrets.nix | 1 + hosts/xcy/default.nix | 9 +++++++++ hosts/xcy/secrets.nix | 1 + 6 files changed, 30 insertions(+) diff --git a/hosts/busch-gpu-docker/default.nix b/hosts/busch-gpu-docker/default.nix index d7870cd..a31b2e3 100644 --- a/hosts/busch-gpu-docker/default.nix +++ b/hosts/busch-gpu-docker/default.nix @@ -56,6 +56,15 @@ tokenSecretFile = config.age.secrets.hawser-token; }; + services.beszel.agent = { + enable = true; + environment = { + HUB_URL = "https://beszel.jfreudenberger.de"; + DISABLE_SSH = "true"; + }; + environmentFile = config.age.secrets.beszel.path; + }; + # This option defines the first version of NixOS you have installed on this particular machine, # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. # Most users should NEVER change this value after the initial install, for any reason, diff --git a/hosts/busch-gpu-docker/secrets.nix b/hosts/busch-gpu-docker/secrets.nix index 093c7a0..82a4982 100644 --- a/hosts/busch-gpu-docker/secrets.nix +++ b/hosts/busch-gpu-docker/secrets.nix @@ -2,5 +2,6 @@ { age.secrets = { hawser-token.file = "${inputs.secrets}/secrets/busch-gpu-docker/hawser-token"; + beszel.file = "${inputs.secrets}/secrets/busch-gpu-docker/beszel"; }; } diff --git a/hosts/busch-main-docker/default.nix b/hosts/busch-main-docker/default.nix index ce7c502..6df1d21 100644 --- a/hosts/busch-main-docker/default.nix +++ b/hosts/busch-main-docker/default.nix @@ -44,6 +44,15 @@ tokenSecretFile = config.age.secrets.hawser-token; }; + services.beszel.agent = { + enable = true; + environment = { + HUB_URL = "https://beszel.jfreudenberger.de"; + DISABLE_SSH = "true"; + }; + environmentFile = config.age.secrets.beszel.path; + }; + # This option defines the first version of NixOS you have installed on this particular machine, # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. # Most users should NEVER change this value after the initial install, for any reason, diff --git a/hosts/busch-main-docker/secrets.nix b/hosts/busch-main-docker/secrets.nix index f06e116..f009a67 100644 --- a/hosts/busch-main-docker/secrets.nix +++ b/hosts/busch-main-docker/secrets.nix @@ -2,5 +2,6 @@ { age.secrets = { hawser-token.file = "${inputs.secrets}/secrets/busch-main-docker/hawser-token"; + beszel.file = "${inputs.secrets}/secrets/busch-main-docker/beszel"; }; } diff --git a/hosts/xcy/default.nix b/hosts/xcy/default.nix index 0c62fef..8c87473 100644 --- a/hosts/xcy/default.nix +++ b/hosts/xcy/default.nix @@ -33,6 +33,15 @@ tokenSecretFile = config.age.secrets.hawser-token; }; + services.beszel.agent = { + enable = true; + environment = { + HUB_URL = "https://beszel.jfreudenberger.de"; + DISABLE_SSH = "true"; + }; + environmentFile = config.age.secrets.beszel.path; + }; + networking.firewall = { checkReversePath = "loose"; allowedTCPPorts = [ diff --git a/hosts/xcy/secrets.nix b/hosts/xcy/secrets.nix index 4add6e7..6dfb2eb 100644 --- a/hosts/xcy/secrets.nix +++ b/hosts/xcy/secrets.nix @@ -2,5 +2,6 @@ { age.secrets = { hawser-token.file = "${inputs.secrets}/secrets/xcy/hawser-token"; + beszel.file = "${inputs.secrets}/secrets/xcy/beszel"; }; } From 35fd6d6d63cd2dd504acd0aa5af33bca4b73f57b Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Thu, 11 Jun 2026 23:35:17 +0200 Subject: [PATCH 7/7] Update flake.lock --- flake.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/flake.lock b/flake.lock index 0b4945c..1c1d638 100644 --- a/flake.lock +++ b/flake.lock @@ -476,11 +476,11 @@ "secrets": { "flake": false, "locked": { - "lastModified": 1779441912, - "narHash": "sha256-Le50mFgpetFC8gyc1j3+oXEjRV3lZdeU2vqBtoWaAJo=", + "lastModified": 1781207988, + "narHash": "sha256-ZsPqHeeUXDR1fksT4EGlizv8RHPHp42kusVNhnenzxo=", "ref": "refs/heads/main", - "rev": "847ed2f52fd5ff0ead5958d6932b219b4254a2bf", - "revCount": 38, + "rev": "53c5bdca5f2ff22b4e950c38b4d8bb96ee03c80d", + "revCount": 40, "type": "git", "url": "ssh://git@git.jfreudenberger.de/JuliusFreudenberger/nix-private.git" },