Compare commits
6 Commits
4e7e885289
...
master
| Author | SHA1 | Date | |
|---|---|---|---|
 coolneng
|
2112a32348
|
||
|
coolneng
|
299e332a83
|
||
|
coolneng
|
488969abd7
|
||
|
coolneng
|
4cd14c0838
|
||
|
coolneng
|
7544f6d121
|
||
|
coolneng
|
0b7c199fa4
|
+12
-10
@@ -173,18 +173,10 @@ with pkgs;
|
||||
group = "users";
|
||||
};
|
||||
# HACK The owner and group is set by systemd due to the use of DynamicUser
|
||||
secrets.dendrite = {
|
||||
file = secrets/dendrite.age;
|
||||
owner = "63026";
|
||||
group = "63026";
|
||||
};
|
||||
secrets.dendrite-postgres = {
|
||||
file = secrets/dendrite-postgres.age;
|
||||
owner = "63026";
|
||||
group = "63026";
|
||||
};
|
||||
secrets.telegram = {
|
||||
file = secrets/telegram.age;
|
||||
owner = "mautrix-telegram";
|
||||
group = "mautrix-telegram";
|
||||
};
|
||||
secrets.mqtt-sender = {
|
||||
file = secrets/mqtt-sender.age;
|
||||
@@ -198,9 +190,14 @@ with pkgs;
|
||||
};
|
||||
secrets.facebook = {
|
||||
file = secrets/facebook.age;
|
||||
owner = "mautrix-meta-facebook";
|
||||
group = "mautrix-meta-facebook";
|
||||
|
||||
};
|
||||
secrets.signal = {
|
||||
file = secrets/signal.age;
|
||||
owner = "mautrix-signal";
|
||||
group = "mautrix-signal";
|
||||
};
|
||||
secrets.inadyn-duckdns = {
|
||||
file = secrets/inadyn-duckdns.age;
|
||||
@@ -237,6 +234,11 @@ with pkgs;
|
||||
owner = "63026";
|
||||
group = "63026";
|
||||
};
|
||||
secrets.grafana = {
|
||||
file = secrets/grafana.age;
|
||||
owner = "grafana";
|
||||
group = "granafa";
|
||||
};
|
||||
identityPaths = [ "/etc/ssh/id_ed25519" ];
|
||||
};
|
||||
|
||||
|
||||
Generated
+48
-32
@@ -54,12 +54,12 @@
|
||||
"nixpkgs": "nixpkgs_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1778179392,
|
||||
"narHash": "sha256-W6zorvjBYbzMNvqKIqCdpDF4rq3gj50Xximl56YM9/I=",
|
||||
"rev": "efd54faa68be8cd777b5c28cab11e638998a0853",
|
||||
"revCount": 416,
|
||||
"lastModified": 1780941588,
|
||||
"narHash": "sha256-cXxaBtTSYEYVtSxw4IH0hPa+p+VFxS0i+66GwxVFk7o=",
|
||||
"rev": "70c28bcdd4dde10d04f39e7accb5738a1f5d5298",
|
||||
"revCount": 421,
|
||||
"type": "tarball",
|
||||
"url": "https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.20.0/019e03c3-7dc0-7873-a333-9ab02d6f690c/source.tar.gz"
|
||||
"url": "https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.21.1/019ea867-5568-7d03-9579-e943ed6d4cef/source.tar.gz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
@@ -69,37 +69,37 @@
|
||||
"determinate-nixd-aarch64-darwin": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"narHash": "sha256-z4mCqKI3Qd6weuHrlfzGccJG0giym/VJhKv20ijRSs0=",
|
||||
"narHash": "sha256-ctwRrPKWBSFkTqlCHRGz6MHBSWRkbSAEVGoelsxdr2g=",
|
||||
"type": "file",
|
||||
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.20.0/macOS"
|
||||
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.1/macOS"
|
||||
},
|
||||
"original": {
|
||||
"type": "file",
|
||||
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.20.0/macOS"
|
||||
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.1/macOS"
|
||||
}
|
||||
},
|
||||
"determinate-nixd-aarch64-linux": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"narHash": "sha256-yW+VNepSRytzfanSssPMJPvwioCcmlZYaBX8++UFkAk=",
|
||||
"narHash": "sha256-qYFrMN6lSMRYV87D/uK5L2CUBvOpoLZAAfSYXvcp9cc=",
|
||||
"type": "file",
|
||||
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.20.0/aarch64-linux"
|
||||
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.1/aarch64-linux"
|
||||
},
|
||||
"original": {
|
||||
"type": "file",
|
||||
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.20.0/aarch64-linux"
|
||||
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.1/aarch64-linux"
|
||||
}
|
||||
},
|
||||
"determinate-nixd-x86_64-linux": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"narHash": "sha256-+L102C3Hhkd1GlXmRm2eLTLsZKBxEvooiQZFqQRlBf0=",
|
||||
"narHash": "sha256-BxzPf6fT1ekyvD5JA0vvDJOTPtIyjrzVg3Puuo0ftbg=",
|
||||
"type": "file",
|
||||
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.20.0/x86_64-linux"
|
||||
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.1/x86_64-linux"
|
||||
},
|
||||
"original": {
|
||||
"type": "file",
|
||||
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.20.0/x86_64-linux"
|
||||
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.1/x86_64-linux"
|
||||
}
|
||||
},
|
||||
"flake-compat": {
|
||||
@@ -195,12 +195,12 @@
|
||||
"nixpkgs-regression": "nixpkgs-regression"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1778177425,
|
||||
"narHash": "sha256-oyHvP5HDRe59opmjTrq2ED9lh+R9FrHyaCGPPNfBqWM=",
|
||||
"rev": "f0ccb960d3ad5bff28acd9cabf8bdef885b5d52f",
|
||||
"revCount": 25858,
|
||||
"lastModified": 1780939209,
|
||||
"narHash": "sha256-/JuW5C6sWuC836Y9b7hga3ZvhRiY4k4Zs73RRg5KVWM=",
|
||||
"rev": "952beffe9c45ed245d30209d4f17cf1d26654a2a",
|
||||
"revCount": 26044,
|
||||
"type": "tarball",
|
||||
"url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.20.0/019e03bc-3f83-7833-aba3-b691ef4956c7/source.tar.gz"
|
||||
"url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.21.1/019ea860-2acd-7680-ae61-10f9574b2694/source.tar.gz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
@@ -208,12 +208,15 @@
|
||||
}
|
||||
},
|
||||
"nixos-hardware": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1779258371,
|
||||
"narHash": "sha256-j1iZsLy6oFApqR1oiDmHhvkwxXqcNi0aoSJj643LuwU=",
|
||||
"lastModified": 1781020964,
|
||||
"narHash": "sha256-fS7xTi2j2iso5Hj7RNZLv/acDlCT+fgMVkVk40A7Uco=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixos-hardware",
|
||||
"rev": "c97bc4d15bd3473dd095e8e8ba57330ab1943a77",
|
||||
"rev": "32c2cd9e46286c4eced3dc6b613c659126bf3cca",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -271,12 +274,12 @@
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1777826146,
|
||||
"narHash": "sha256-wQ/iN5Zp5VIa3ebBibijPnLyKhor+xEbDy4d0goa9Zs=",
|
||||
"rev": "73c703c22422b8951895a960959dbbaca7296492",
|
||||
"revCount": 991389,
|
||||
"lastModified": 1780336545,
|
||||
"narHash": "sha256-vhVhuXzFrIOfcssC/9hDHx7MHzDKjF3keHuREOQqQiQ=",
|
||||
"rev": "4df1b885d76a54e1aa1a318f8d16fd6005b6401f",
|
||||
"revCount": 1008784,
|
||||
"type": "tarball",
|
||||
"url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.991389%2Brev-73c703c22422b8951895a960959dbbaca7296492/019df6c8-934b-7d40-b402-027bb5def30f/source.tar.gz"
|
||||
"url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.1008784%2Brev-4df1b885d76a54e1aa1a318f8d16fd6005b6401f/019e8725-c925-7ec1-8f35-3f9effcf169a/source.tar.gz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
@@ -285,16 +288,29 @@
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1779102034,
|
||||
"narHash": "sha256-vZJZjLo513IeI8hjzHFc6TDezUd4uCE2Eq4SNO3DNNg=",
|
||||
"lastModified": 1767892417,
|
||||
"narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
|
||||
"rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
|
||||
"type": "tarball",
|
||||
"url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
"url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
|
||||
}
|
||||
},
|
||||
"nixpkgs_4": {
|
||||
"locked": {
|
||||
"lastModified": 1780902259,
|
||||
"narHash": "sha256-q8yYEC5f1mFlQO9RGna4LTc9QrcvWunX6FYp83munkQ=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "687f05a9184cad4eaf905c48b63649e3a86f5433",
|
||||
"rev": "bd0ff2d3eac24699c3664d5966b9ef36f388e2ca",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-25.11",
|
||||
"ref": "nixos-26.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
@@ -304,7 +320,7 @@
|
||||
"agenix": "agenix",
|
||||
"determinate": "determinate",
|
||||
"nixos-hardware": "nixos-hardware",
|
||||
"nixpkgs": "nixpkgs_3"
|
||||
"nixpkgs": "nixpkgs_4"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
|
||||
@@ -9,17 +9,13 @@
|
||||
};
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
|
||||
determinate.url = "https://flakehub.com/f/DeterminateSystems/determinate/*";
|
||||
agenix = {
|
||||
url = "github:ryantm/agenix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
nixos-hardware.url = "github:NixOS/nixos-hardware/master";
|
||||
nix-matrix-appservices = {
|
||||
url = "gitlab:coffeetables/nix-matrix-appservices";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
};
|
||||
|
||||
outputs =
|
||||
|
||||
+76
-55
@@ -7,71 +7,92 @@
|
||||
|
||||
with pkgs;
|
||||
|
||||
# NOTE Reference the environment variable set in the corresponding agenix secret
|
||||
let
|
||||
database = {
|
||||
connection_string = "$DB_STRING";
|
||||
max_open_conns = 100;
|
||||
max_idle_conns = 5;
|
||||
conn_max_lifetime = -1;
|
||||
};
|
||||
|
||||
in
|
||||
{
|
||||
# Matrix server configuration
|
||||
services.dendrite = {
|
||||
services.matrix-continuwuity = {
|
||||
enable = true;
|
||||
httpPort = 8008;
|
||||
environmentFile = config.age.secrets.dendrite-postgres.path;
|
||||
loadCredential = [ "private_key:${config.age.secrets.dendrite.path}" ];
|
||||
settings = {
|
||||
global = {
|
||||
server_name = "coolneng.duckdns.org";
|
||||
private_key = config.age.secrets.dendrite.path;
|
||||
inherit database;
|
||||
dns_cache.enabled = true;
|
||||
};
|
||||
# HACK Inherit postgres connection string for the rest of the DBs
|
||||
app_service_api = {
|
||||
inherit database;
|
||||
};
|
||||
media_api = {
|
||||
inherit database;
|
||||
};
|
||||
room_server = {
|
||||
inherit database;
|
||||
};
|
||||
push_server = {
|
||||
inherit database;
|
||||
};
|
||||
mscs = {
|
||||
inherit database;
|
||||
mscs = [
|
||||
"msc2836"
|
||||
"msc2946"
|
||||
];
|
||||
};
|
||||
sync_api = {
|
||||
inherit database;
|
||||
};
|
||||
key_server = {
|
||||
inherit database;
|
||||
};
|
||||
federation_api = {
|
||||
inherit database;
|
||||
};
|
||||
user_api = {
|
||||
account_database = database;
|
||||
device_database = database;
|
||||
server_name = "psydnd.org";
|
||||
port = [ 8008 ];
|
||||
allow_encryption = true;
|
||||
allow_federation = true;
|
||||
well_known.client = "https://matrix.psydnd.org";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
## Matrix bridges
|
||||
# Facebook
|
||||
services.mautrix-meta.instances.facebook = {
|
||||
enable = true;
|
||||
environmentFile = config.age.secrets.facebook.path;
|
||||
settings = {
|
||||
homeserver = {
|
||||
address = "https://matrix.psysdnd.org";
|
||||
domain = "psydnd.org";
|
||||
};
|
||||
appservice = {
|
||||
address = "http://localhost:8228";
|
||||
port = 8228;
|
||||
database = "$DB_STRING";
|
||||
};
|
||||
bridge.permissions."@coolneng:psydnd.org" = "admin";
|
||||
};
|
||||
serviceDependencies = [ "continuwuity.service" ];
|
||||
};
|
||||
|
||||
# Enable voice messages for Facebook
|
||||
systemd.services.matrix-as-facebook.path = [ ffmpeg ];
|
||||
|
||||
# Telegram
|
||||
services.mautrix-telegram = {
|
||||
enable = true;
|
||||
environmentFile = config.age.secrets.telegram.path;
|
||||
settings = {
|
||||
homeserver = {
|
||||
address = "https://matrix.psysdnd.org";
|
||||
domain = "psydnd.org";
|
||||
};
|
||||
appservice = {
|
||||
address = "http://localhost:8118";
|
||||
port = 8118;
|
||||
database = "$DB_STRING";
|
||||
};
|
||||
bridge.permissions."@coolneng:psydnd.org" = "admin";
|
||||
};
|
||||
serviceDependencies = [ "continuwuity.service" ];
|
||||
};
|
||||
|
||||
# Signal
|
||||
services.mautrix-signal = {
|
||||
enable = true;
|
||||
environmentFile = config.age.secrets.signal.path;
|
||||
settings = {
|
||||
homeserver = {
|
||||
address = "https://matrix.psysdnd.org";
|
||||
domain = "psydnd.org";
|
||||
};
|
||||
appservice = {
|
||||
address = "http://localhost:8338";
|
||||
port = 8338;
|
||||
database = "$DB_STRING";
|
||||
};
|
||||
bridge.permissions."@coolneng:psydnd.org" = "admin";
|
||||
};
|
||||
serviceDependencies = [ "continuwuity.service" ];
|
||||
};
|
||||
|
||||
# HACK Use libolm as there's no good alternative
|
||||
nixpkgs.config.permittedInsecurePackages = [
|
||||
"olm-3.2.16"
|
||||
];
|
||||
|
||||
# Start dendrite after config files are mounted
|
||||
systemd.services.dendrite.unitConfig.RequiresMountsFor = [
|
||||
/var/lib/matrix-as-facebook
|
||||
/var/lib/matrix-as-signal
|
||||
/var/lib/matrix-as-telegram
|
||||
systemd.services.continuwuity.unitConfig.RequiresMountsFor = [
|
||||
/var/lib/mautrix-meta-facebook
|
||||
/var/lib/mautrix-signal
|
||||
/var/lib/mautrix-telegram
|
||||
];
|
||||
|
||||
# MQTT configuration
|
||||
|
||||
@@ -82,10 +82,13 @@ with pkgs;
|
||||
# Grafana configuration
|
||||
services.grafana = {
|
||||
enable = true;
|
||||
settings.server = {
|
||||
domain = "grafana.psydnd.org";
|
||||
http_port = 9009;
|
||||
http_addr = "127.0.0.1";
|
||||
settings = {
|
||||
server = {
|
||||
domain = "grafana.psydnd.org";
|
||||
http_port = 9009;
|
||||
http_addr = "127.0.0.1";
|
||||
};
|
||||
security.secret_key = config.age.secrets.grafana.path;
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
@@ -135,10 +135,10 @@ in
|
||||
services.resolved = {
|
||||
enable = true;
|
||||
llmnr = "false";
|
||||
extraConfig = ''
|
||||
MulticastDNS=yes
|
||||
DNSStubListener=no
|
||||
'';
|
||||
settings.Resolve = {
|
||||
MulticastDNS = true;
|
||||
DNSStubListener = false;
|
||||
};
|
||||
};
|
||||
|
||||
# DNS server with ad-block
|
||||
|
||||
+10
-10
@@ -34,21 +34,12 @@
|
||||
proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
|
||||
'';
|
||||
virtualHosts = {
|
||||
# Old domain being redirected
|
||||
# Redirection of the old domain
|
||||
"coolneng.duckdns.org" = {
|
||||
useACMEHost = "coolneng.duckdns.org";
|
||||
forceSSL = true;
|
||||
locations = {
|
||||
"/".return = "301 https://psydnd.org$request_uri";
|
||||
# Delegation for Matrix
|
||||
"/.well-known/" = {
|
||||
alias = "${../well-known}" + "/";
|
||||
extraConfig = ''
|
||||
${config.services.nginx.commonHttpConfig}
|
||||
default_type application/json;
|
||||
add_header Access-Control-Allow-Origin * always;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
# Redirect subdomains
|
||||
@@ -61,6 +52,15 @@
|
||||
"psydnd.org" = {
|
||||
useACMEHost = "psydnd.org";
|
||||
forceSSL = true;
|
||||
# Delegation for Matrix
|
||||
locations."/.well-known/" = {
|
||||
alias = "${../well-known}" + "/";
|
||||
extraConfig = ''
|
||||
${config.services.nginx.commonHttpConfig}
|
||||
default_type application/json;
|
||||
add_header Access-Control-Allow-Origin * always;
|
||||
'';
|
||||
};
|
||||
};
|
||||
"radicale.psydnd.org" = {
|
||||
useACMEHost = "psydnd.org";
|
||||
|
||||
+1
-1
@@ -24,7 +24,7 @@ services=(
|
||||
"radicale.service"
|
||||
"miniflux.service"
|
||||
"gitea.service"
|
||||
"dendrite.service"
|
||||
"continuwuity.service"
|
||||
"nginx.service"
|
||||
"dnsmasq.service"
|
||||
"dnscrypt-proxy.service"
|
||||
|
||||
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,5 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 iUaRGg Ag32nut/aBlxEy7RPw7sV5itZSHkp8eMLVtxFxwQ8EM
|
||||
ZhK8EZWTLkxrwo+x97w4HpexDXkC1yQuKyYFujqlOgs
|
||||
--- kszqKtyubreK5mGkrJg4hrEKrfITJCCM/hW6IHKlMIE
|
||||
TÚ+À~/ œDbM?Çø×å ½œa-ð'ƒÒp^5ç›?�ï & #!àϳ‰þ~59 O
|
||||
+1
-2
@@ -8,8 +8,6 @@ in
|
||||
"gitea.age".publicKeys = [ zion ];
|
||||
"miniflux.age".publicKeys = [ zion ];
|
||||
"git.age".publicKeys = [ zion ];
|
||||
"dendrite.age".publicKeys = [ zion ];
|
||||
"dendrite-postgres.age".publicKeys = [ zion ];
|
||||
"telegram.age".publicKeys = [ zion ];
|
||||
"mqtt-sender.age".publicKeys = [ zion ];
|
||||
"mqtt-receiver.age".publicKeys = [ zion ];
|
||||
@@ -22,4 +20,5 @@ in
|
||||
"acme-porkbun.age".publicKeys = [ zion ];
|
||||
"microbin.age".publicKeys = [ zion ];
|
||||
"readeck.age".publicKeys = [ zion ];
|
||||
"grafana.age".publicKeys = [ zion ];
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user