# blunix services

Imported from `default.nix`. blunix is the Connector: reverse proxy,
identity, mesh control, and the two statically-hosted sites that need to
stay reachable independent of pinix.

| File/dir | Service |
| --- | --- |
| `traefik/` | Reverse proxy — router config, split into `routes-external.nix`/`routes-internal.nix` plus per-service dynamic config (`dex.nix`, `forgejo.nix`, `cal.nix`, `prosody.nix`); see `default.nix` for the base setup |
| `dex.nix`, `service-dex.nix` | OIDC provider (Dex), authenticates against LLDAP |
| `lldap.nix` | LDAP user/group directory with the shared 0ff.space background |
| `oauth2-proxy.nix` | OIDC gate in front of the `launcher` site |
| `adguard.nix` | DNS, including the internal-route rewrites (see `docs/networking.md` on the wiki) |
| `headscale.nix` | Tailscale mesh control plane |
| `tailscale.nix` | This host's own tailnet client |
| `website.nix`, `launcher.nix` | Static sites hosted directly on blunix (`lukasrosier.com`, `0ff.space`) so they stay up independent of pinix |
| `fileserver-external.nix` | Public file mirror (`data.${domain}`); its generated directory listings use the shared 0ff.space background |
| `wordpress.nix` | WordPress instance |
| `webhook.nix` | Auto-pull receiver for `website`/`launcher` on push |
| `agent-codex/` | XMPP-reachable Codex agent (Agent + Builder roles), see its own README |
| `orga-agent.nix`, `orga-agent/` | Secret-isolated, read-only CalDAV/IMAP helpers and strictly non-executable write previews for the visible Orga agent |
| `prosody/setup-prosody.nix`, `xmpp-web.nix` | XMPP server (c2s/s2s/MUC/HTTP upload) and its two web frontends (`chat`, `plaza`), moved here from pinix; see `prosody/README.md` |
| `nixbuild.nix` | nixbuild.net remote-builder registration (opt-in, not automatic) |
| `restic.nix` | Backups |
| `fail2ban.nix` | Brute-force protection |
| `packages.nix`, `packages-stable.nix`, `secrets.nix` | Host plumbing, not user-facing services |

Not currently wired into `default.nix` at all: `emptyCerts.nix` (commented
out), `sshd.nix` (a tailnet-bound sshd listener that isn't imported
anywhere — the global `sshd.nix` from `hosts/globalServices/` is what's
actually active). Dead config, not deployed. `forgejo.nix` *is* wired in
and active as of 2026-09-06 — Forgejo itself moved here from pinix; the
line above describing it as "an earlier attempt ... superseded by pinix"
was stale and has been corrected.