all repos — nixfiles @ f160698b6a46b9c73e3fc29e8ac7deabd1868881

System and user configuration, managed by nix and home-manager

extract open webui to role (without importing—build failure)

Alin
commit

f160698b6a46b9c73e3fc29e8ac7deabd1868881

parent

0f401029b13951d31e6eaba0141439ea5ddefb36

2 files changed, 42 insertions(+), 30 deletions(-)

changed files
M system/hosts/linde.nix → system/hosts/linde.nix
@@ -46,7 +46,6 @@ age.secrets = {
     redis-website.file = ../../secrets/redis-website.age;
     cifs-jellyfin.file = ../../secrets/cifs-jellyfin.age;
     ntfy.file = ../../secrets/ntfy.age;
-    open-webui.file = ../../secrets/open-webui.age;
   };
 
   boot.loader.efi.efiSysMountPoint = "/boot/efi";

@@ -366,37 +365,8 @@ extraConfig = ''
             reverse_proxy ${config.services.ntfy-sh.settings.listen-http}
           '';
         };
-        "chat.${ts-domain}" = {
-          extraConfig = ''
-            bind tailscale/chat
-            tailscale_auth
-            reverse_proxy localhost:${toString config.services.open-webui.port} {
-              header_up X-Webauth-User {http.auth.user.tailscale_login}
-              header_up X-Webauth-Email {http.auth.user.tailscale_user}
-              header_up X-Webauth-Name {http.auth.user.tailscale_name}
-            }
-          '';
-        };
       };
   };
-  services.open-webui = {
-    enable = true;
-    environment = {
-      ANONYMIZED_TELEMETRY = "False";
-      DO_NOT_TRACK = "True";
-      ENABLE_VERSION_UPDATE_CHECK = "False";
-
-      ENABLE_API_KEYS = "True";
-      WEBUI_URL = "https://chat.${ts-domain}";
-      WEBUI_AUTH_TRUSTED_EMAIL_HEADER = "X-Webauth-Email";
-      WEBUI_AUTH_TRUSTED_NAME_HEADER = "X-Webauth-User";
-      WEBUI_AUTH = "False";
-      CORS_ALLOW_ORIGIN = "https://chat.${ts-domain}";
-
-      OPENAI_API_BASE_URL = "https://openrouter.ai/api/vi";
-    };
-  };
-
   networking.nat = {
     enable = true;
     internalInterfaces = [ "ve-+" ];
A system/roles/chat.nix
@@ -0,0 +1,42 @@
+{
+  config,
+  ...
+}:
+let
+  ts-domain = "fin-marlin.ts.net";
+in
+{
+  age.secrets.open-webui.file = ../../secrets/open-webui.age;
+
+  services.open-webui = {
+    enable = true;
+    environment = {
+      ANONYMIZED_TELEMETRY = "False";
+      DO_NOT_TRACK = "True";
+      ENABLE_VERSION_UPDATE_CHECK = "False";
+
+      ENABLE_API_KEYS = "True";
+      WEBUI_URL = "https://chat.${ts-domain}";
+      WEBUI_AUTH_TRUSTED_EMAIL_HEADER = "X-Webauth-Email";
+      WEBUI_AUTH_TRUSTED_NAME_HEADER = "X-Webauth-User";
+      WEBUI_AUTH = "False";
+      CORS_ALLOW_ORIGIN = "https://chat.${ts-domain}";
+
+      OPENAI_API_BASE_URL = "https://openrouter.ai/api/vi";
+    };
+  };
+
+  services.caddy.virtualHosts = {
+    "chat.${ts-domain}" = {
+      extraConfig = ''
+        bind tailscale/chat
+        tailscale_auth
+        reverse_proxy localhost:${toString config.services.open-webui.port} {
+          header_up X-Webauth-User {http.auth.user.tailscale_login}
+          header_up X-Webauth-Email {http.auth.user.tailscale_user}
+          header_up X-Webauth-Name {http.auth.user.tailscale_name}
+        }
+      '';
+    };
+  };
+}