server: plant: drop

flake.lock

@@ -908,23 +908,6 @@
         "type": "github"
       }
     },
-    "plant": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1758423341,
-        "narHash": "sha256-dHcKh7T8I70bKPwgqO5MxZ9bWHINwzRPhFp5waQy2r8=",
-        "ref": "refs/heads/master",
-        "rev": "08dc0b3889797eb3618c7475c3c367ec0e5fdf40",
-        "revCount": 6,
-        "type": "git",
-        "url": "ssh://git@git.imxyy.top:2222/imxyy1soope1/HF-plant.git"
-      },
-      "original": {
-        "rev": "08dc0b3889797eb3618c7475c3c367ec0e5fdf40",
-        "type": "git",
-        "url": "ssh://git@git.imxyy.top:2222/imxyy1soope1/HF-plant.git"
-      }
-    },
     "root": {
       "inputs": {
         "angrr": "angrr",
@@ -950,7 +933,6 @@
         "nixpkgs-stable": "nixpkgs-stable",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "noctalia": "noctalia",
-        "plant": "plant",
         "sops-nix": "sops-nix",
         "stylix": "stylix",
         "system76-scheduler-niri": "system76-scheduler-niri",

flake.nix

@@ -117,10 +117,6 @@
       url = "github:numtide/treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    plant = {
-      url = "git+ssh://git@git.imxyy.top:2222/imxyy1soope1/HF-plant.git?rev=08dc0b3889797eb3618c7475c3c367ec0e5fdf40";
-      flake = false;
-    };
     my-templates.url = "git+https://git.imxyy.top/imxyy1soope1/flake-templates";
 
     # Flattened indirect dependencies

hosts/imxyy-nix-server/caddy.nix

@@ -2,6 +2,18 @@
   services.caddy = {
     enable = true;
     email = "acme@imxyy.top";
+    globalConfig = ''
+      servers {
+        listener_wrappers {
+          proxy_protocol {
+            timeout 5s
+            allow 127.0.0.1/32
+          }
+          tls
+        }
+        trusted_proxies static 127.0.0.1
+      }
+    '';
   };
   security.acme = {
     acceptTerms = true;

hosts/imxyy-nix-server/code.nix

@@ -7,9 +7,8 @@
   users.users.coder.extraGroups = [ "podman" ];
   services.caddy.virtualHosts."coder.imxyy.top" = {
     extraConfig = ''
-      reverse_proxy :8086 {
+      reverse_proxy :8086
-        header_up X-Real-IP {remote_host}
-      }
     '';
   };
+  my.services.frp.webServers = [ "coder.imxyy.top" ];
 }

hosts/imxyy-nix-server/efl.nix

@@ -34,16 +34,16 @@
   };
   services.caddy.virtualHosts."mtx.eflx.top" = {
     extraConfig = ''
-      reverse_proxy :6167 {
+      reverse_proxy :6167
-        header_up X-Real-IP {remote_host}
-      }
     '';
   };
   services.caddy.virtualHosts."send.eflx.top" = {
     extraConfig = ''
-      reverse_proxy :12345 {
+      reverse_proxy :12345
-        header_up X-Real-IP {remote_host}
-      }
     '';
   };
+  my.services.frp.webServers = [
+    "mtx.eflx.top"
+    "send.eflx.top"
+  ];
 }

hosts/imxyy-nix-server/frp.nix

@@ -0,0 +1,33 @@
+{ config, lib, ... }:
+let
+  cfg = config.my.services.frp;
+  mkServer = domain: [
+    {
+      name = "${domain}-http";
+      type = "http";
+      localIP = "127.0.0.1";
+      localPort = 80;
+      customDomains = [ domain ];
+    }
+    {
+      name = "${domain}-https";
+      type = "https";
+      localIP = "127.0.0.1";
+      localPort = 443;
+      customDomains = [ domain ];
+      transport.proxyProtocolVersion = "v2";
+    }
+  ];
+in
+{
+  options = {
+    my.services.frp.webServers = lib.mkOption {
+      type = with lib.types; listOf str;
+      default = [ ];
+    };
+  };
+
+  config = {
+    services.frp.instances."".settings.proxies = builtins.concatLists (map mkServer cfg.webServers);
+  };
+}

hosts/imxyy-nix-server/gitea.nix

@@ -1,11 +1,19 @@
 {
   services.caddy.virtualHosts."git.imxyy.top" = {
     extraConfig = ''
-      reverse_proxy :8082 {
+      reverse_proxy :8082
-        header_up X-Real-IP {remote_host}
-      }
     '';
   };
+  my.services.frp.webServers = [ "git.imxyy.top" ];
+  services.frp.instances."".settings.proxies = [
+    {
+      name = "gitea-ssh";
+      type = "tcp";
+      localIP = "127.0.0.1";
+      localPort = 2222;
+      remotePort = 2222;
+    }
+  ];
   services.gitea = {
     enable = true;
     appName = "imxyy_soope_'s Gitea";
@@ -25,7 +33,10 @@
         SSH_PORT = 2222;
       };
       service = {
-        REGISTER_MANUAL_CONFIRM = true;
+        DISABLE_REGISTRATION = true;
+      };
+      security = {
+        REVERSE_PROXY_TRUSTED_PROXIES = "127.0.0.0/8,::1/128";
       };
     };
   };

hosts/imxyy-nix-server/homepage.nix

@@ -11,4 +11,5 @@
       reverse_proxy :8085
     '';
   };
+  my.services.frp.webServers = [ "home.imxyy.top" ];
 }

hosts/imxyy-nix-server/immich.nix

@@ -13,9 +13,8 @@
   };
   services.caddy.virtualHosts."immich.imxyy.top" = {
     extraConfig = ''
-      reverse_proxy :8096 {
+      reverse_proxy :8096
-        header_up X-Real-IP {remote_host}
-      }
     '';
   };
+  my.services.frp.webServers = [ "immich.imxyy.top" ];
 }

hosts/imxyy-nix-server/mail.nix

@@ -46,9 +46,8 @@
   };
   services.caddy.virtualHosts."mail.imxyy.top" = {
     extraConfig = ''
-      reverse_proxy :8087 {
+      reverse_proxy :8087
-        header_up X-Real-IP {remote_host}
-      }
     '';
   };
+  my.services.frp.webServers = [ "mail.imxyy.top" ];
 }

hosts/imxyy-nix-server/matrix.nix

@@ -75,6 +75,10 @@
       reverse_proxy :8094
     '';
   };
+  my.services.frp.webServers = [
+    "imxyy.top"
+    "matrix.imxyy.top"
+  ];
 
   sops.secrets.mautrix-telegram = {
     sopsFile = secrets.mautrix-telegram;

hosts/imxyy-nix-server/net.nix

@@ -177,222 +177,6 @@
         serverAddr = "{{ .Envs.FRP_SERVER_ADDR }}";
         serverPort = 7000;
         auth.token = "{{ .Envs.FRP_AUTH_TOKEN }}";
-        proxies = [
-          {
-            name = "nextcloud-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "nextcloud.imxyy.top" ];
-          }
-          {
-            name = "nextcloud-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "nextcloud.imxyy.top" ];
-          }
-
-          {
-            name = "oidc-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "oidc.imxyy.top" ];
-          }
-          {
-            name = "oidc-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "oidc.imxyy.top" ];
-          }
-
-          {
-            name = "mail-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "mail.imxyy.top" ];
-          }
-          {
-            name = "mail-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "mail.imxyy.top" ];
-          }
-
-          {
-            name = "gitea-ssh";
-            type = "tcp";
-            localIP = "127.0.0.1";
-            localPort = 2222;
-            remotePort = 2222;
-          }
-          {
-            name = "gitea-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "git.imxyy.top" ];
-          }
-          {
-            name = "gitea-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "git.imxyy.top" ];
-          }
-
-          {
-            name = "vault-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "vault.imxyy.top" ];
-          }
-          {
-            name = "vault-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "vault.imxyy.top" ];
-          }
-
-          {
-            name = "home-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "home.imxyy.top" ];
-          }
-          {
-            name = "home-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "home.imxyy.top" ];
-          }
-
-          {
-            name = "coder-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "coder.imxyy.top" ];
-          }
-          {
-            name = "coder-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "coder.imxyy.top" ];
-          }
-
-          {
-            name = "siyuan-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "sy.imxyy.top" ];
-          }
-          {
-            name = "siyuan-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "sy.imxyy.top" ];
-          }
-
-          {
-            name = "matrix-root-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "imxyy.top" ];
-          }
-          {
-            name = "matrix-root-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "imxyy.top" ];
-          }
-          {
-            name = "matrix-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "matrix.imxyy.top" ];
-          }
-          {
-            name = "matrix-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "matrix.imxyy.top" ];
-          }
-
-          {
-            name = "immich-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "immich.imxyy.top" ];
-          }
-          {
-            name = "immich-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "immich.imxyy.top" ];
-          }
-
-          {
-            name = "memo-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "memo.imxyy.top" ];
-          }
-          {
-            name = "memo-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "memo.imxyy.top" ];
-          }
-
-          {
-            name = "efl-matrix-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "mtx.eflx.top" ];
-          }
-          {
-            name = "efl-matrix-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "mtx.eflx.top" ];
-          }
-          {
-            name = "efl-send-http";
-            type = "http";
-            localIP = "127.0.0.1";
-            localPort = 80;
-            customDomains = [ "send.eflx.top" ];
-          }
-          {
-            name = "efl-send-https";
-            type = "https";
-            localIP = "127.0.0.1";
-            localPort = 443;
-            customDomains = [ "send.eflx.top" ];
-          }
-        ];
       };
     };
   };
@@ -438,11 +222,10 @@
   };
   services.caddy.virtualHosts."oidc.imxyy.top" = {
     extraConfig = ''
-      reverse_proxy :8081 {
+      reverse_proxy :8081
-        header_up X-Real-IP {remote_host}
-      }
     '';
   };
+  my.services.frp.webServers = [ "oidc.imxyy.top" ];
 
   systemd.services.ddns-go =
     let
@@ -475,37 +258,18 @@
       ];
     };
 
-  services.dnsmasq =
+  services.dnsmasq = {
-    let
-      subDomains = [
-        "home"
-        "nextcloud"
-        "mail"
-        "git"
-        "vault"
-        "coder"
-        "matrix"
-        "note"
-        "oidc"
-        "mc"
-        "music"
-        "sy"
-        "immich"
-      ];
-    in
-    {
     enable = true;
     resolveLocalQueries = false;
     settings = {
       no-resolv = true;
       server = [ "192.168.3.1" ];
-        address = map (sub: "/${sub}.imxyy.top/192.168.3.2") subDomains ++ [
+      address = [
         "/imxyy-nix-server/192.168.3.2"
-          "/mtx.eflx.top/192.168.3.2"
-          "/send.eflx.top/192.168.3.2"
         "/imxyy-cloudwin/192.168.3.4"
         "/printer.home/192.168.3.53"
-        ];
+      ]
+      ++ (map (domain: "/${domain}/192.168.3.2") config.my.services.frp.webServers);
       cache-size = 0;
       log-queries = "extra";
     };

hosts/imxyy-nix-server/nextcloud.nix

@@ -113,6 +113,7 @@ in
       redir /.well-known/caldav /remote.php/dav/ 301
     '';
   };
+  my.services.frp.webServers = [ "nextcloud.imxyy.top" ];
 
   /*
     systemd.timers."kopia" = {

hosts/imxyy-nix-server/note.nix

@@ -28,13 +28,6 @@
       ];
       ports = [ "8095:6806" ];
     };
-    memos = {
-      image = "neosmemo/memos:stable";
-      volumes = [
-        "/mnt/nas/memos:/var/opt/memos"
-      ];
-      ports = [ "8097:5230" ];
-    };
   };
   services.caddy.virtualHosts = {
     "sy.imxyy.top" = {
@@ -42,10 +35,6 @@
         reverse_proxy :8095
       '';
     };
-    "memo.imxyy.top" = {
-      extraConfig = ''
-        reverse_proxy :8097
-      '';
-    };
   };
+  my.services.frp.webServers = [ "sy.imxyy.top" ];
 }

hosts/imxyy-nix-server/plant.nix

@@ -1,74 +0,0 @@
-{
-  inputs,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  app = pkgs.buildNpmPackage (finalAttrs: {
-    pname = "HF-plant";
-    version = "unstable-2025-09-21";
-
-    src = inputs.plant;
-
-    buildPhase = ''
-      runHook preBuild
-
-      npm run build
-      npm run build:proxy
-
-      runHook postBuild
-    '';
-    installPhase = ''
-      runHook preInstall
-
-      mkdir $out
-      mv dist $out
-      cp .env proxy-server-bundled.js $out
-
-      runHook postInstall
-    '';
-
-    npmDepsHash = "sha256-ret4BtjrEt8L1nlvJmFiejAKmbz89Z7NSiKs+qlB51w=";
-  });
-in
-{
-  systemd.services.HF-plant-proxy = {
-    after = [ "network.target" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      ExecStart = "${lib.getExe pkgs.bash} -c 'source ${app}/.env; export FEISHU_APP_ID FEISHU_APP_SECRET AMAP_JSCODE; ${lib.getExe pkgs.nodejs} ${app}/proxy-server-bundled.js'";
-      Restart = "always";
-      RestartSec = 120;
-    };
-  };
-  services.caddy.virtualHosts."plant.imxyy.top" = {
-    extraConfig = ''
-      handle /api/* {
-        reverse_proxy localhost:3001
-      }
-
-      handle /* {
-        root * ${app}/dist
-        try_files {path} /index.html
-        file_server
-      }
-    '';
-  };
-  services.frp.instances."".settings.proxies = [
-    {
-      name = "plant-http";
-      type = "http";
-      localIP = "127.0.0.1";
-      localPort = 80;
-      customDomains = [ "plant.imxyy.top" ];
-    }
-    {
-      name = "plant-https";
-      type = "https";
-      localIP = "127.0.0.1";
-      localPort = 443;
-      customDomains = [ "plant.imxyy.top" ];
-    }
-  ];
-}

hosts/imxyy-nix-server/rss.nix

@@ -36,20 +36,5 @@ in
       reverse_proxy :8100
     '';
   };
-  services.frp.instances."".settings.proxies = [
+  my.services.frp.webServers = [ "rss.imxyy.top" ];
-    {
-      name = "rsshub-http";
-      type = "http";
-      localIP = "127.0.0.1";
-      localPort = 80;
-      customDomains = [ "rss.imxyy.top" ];
-    }
-    {
-      name = "rsshub-https";
-      type = "https";
-      localIP = "127.0.0.1";
-      localPort = 443;
-      customDomains = [ "rss.imxyy.top" ];
-    }
-  ];
 }

hosts/imxyy-nix-server/sshwifty.nix

@@ -30,20 +30,5 @@
       reverse_proxy :8101
     '';
   };
-  services.frp.instances."".settings.proxies = [
+  my.services.frp.webServers = [ "ssh.imxyy.top" ];
-    {
-      name = "sshwifty-http";
-      type = "http";
-      localIP = "127.0.0.1";
-      localPort = 80;
-      customDomains = [ "ssh.imxyy.top" ];
-    }
-    {
-      name = "sshwifty-https";
-      type = "https";
-      localIP = "127.0.0.1";
-      localPort = 443;
-      customDomains = [ "ssh.imxyy.top" ];
-    }
-  ];
 }

hosts/imxyy-nix-server/vault.nix

@@ -24,9 +24,8 @@
   };
   services.caddy.virtualHosts."vault.imxyy.top" = {
     extraConfig = ''
-      reverse_proxy :8083 {
+      reverse_proxy :8083
-        header_up X-Real-IP {remote_host}
-      }
     '';
   };
+  my.services.frp.webServers = [ "vault.imxyy.top" ];
 }