Compare commits

..

1 Commits

Author SHA1 Message Date
coolneng fce6c83fc4 Upgrade to NixOS 26.05 2026-05-31 20:12:35 +02:00
11 changed files with 141 additions and 157 deletions
+10 -7
View File
@@ -173,10 +173,18 @@ with pkgs;
group = "users";
};
# HACK The owner and group is set by systemd due to the use of DynamicUser
secrets.dendrite = {
file = secrets/dendrite.age;
owner = "63026";
group = "63026";
};
secrets.dendrite-postgres = {
file = secrets/dendrite-postgres.age;
owner = "63026";
group = "63026";
};
secrets.telegram = {
file = secrets/telegram.age;
owner = "mautrix-telegram";
group = "mautrix-telegram";
};
secrets.mqtt-sender = {
file = secrets/mqtt-sender.age;
@@ -190,14 +198,9 @@ with pkgs;
};
secrets.facebook = {
file = secrets/facebook.age;
owner = "mautrix-meta-facebook";
group = "mautrix-meta-facebook";
};
secrets.signal = {
file = secrets/signal.age;
owner = "mautrix-signal";
group = "mautrix-signal";
};
secrets.inadyn-duckdns = {
file = secrets/inadyn-duckdns.age;
Generated
+55 -51
View File
@@ -54,12 +54,12 @@
"nixpkgs": "nixpkgs_2"
},
"locked": {
"lastModified": 1786121778,
"narHash": "sha256-KV12+FdIAecrnrS97IYhDUUotvnwYMrB+bXirUMPOdA=",
"rev": "c5a93225f633faee482cbd0670e5d6dca0edf9de",
"revCount": 431,
"lastModified": 1779475417,
"narHash": "sha256-7/U/+X66C7XmLnt5JVJVtpx8wVDRU//Awaeqkq9+NNc=",
"rev": "8a9c57ea6b458a40589df60f26200b7d305354d1",
"revCount": 417,
"type": "tarball",
"url": "https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.22.0/019fdd2b-320e-7cf1-8321-a350e90231d9/source.tar.gz"
"url": "https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.21.0/019e5103-0940-7a50-bac6-f1c621bf31ff/source.tar.gz"
},
"original": {
"type": "tarball",
@@ -69,51 +69,51 @@
"determinate-nixd-aarch64-darwin": {
"flake": false,
"locked": {
"narHash": "sha256-MJ6w+0xdY7SGBfk90WzNo9qJAINb7EqywoTUyJf+rbE=",
"narHash": "sha256-LNvx0qZsH8tbdgNfaig/x5Cf4r4UrXfU1m+0bO3D0E4=",
"type": "file",
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.22.0/macOS"
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/macOS"
},
"original": {
"type": "file",
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.22.0/macOS"
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/macOS"
}
},
"determinate-nixd-aarch64-linux": {
"flake": false,
"locked": {
"narHash": "sha256-CL1jY3+NauKiMgH52YE1ZxJ2X78XiOcSaAkAQJa03ek=",
"narHash": "sha256-rKg7uVAEK8X3TTFGaWp8CVZuCAr3wHkMnuJOndhXJF0=",
"type": "file",
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.22.0/aarch64-linux"
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/aarch64-linux"
},
"original": {
"type": "file",
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.22.0/aarch64-linux"
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/aarch64-linux"
}
},
"determinate-nixd-x86_64-linux": {
"flake": false,
"locked": {
"narHash": "sha256-n2/CLr4NrldpdfNnBzH3jQL3CdAfxDvya1KzM9Hh5Ec=",
"narHash": "sha256-vBCUEVPfY4+nxGDM62evpxJYEVqLTqdBGbCkmZ2sQhk=",
"type": "file",
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.22.0/x86_64-linux"
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/x86_64-linux"
},
"original": {
"type": "file",
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.22.0/x86_64-linux"
"url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/x86_64-linux"
}
},
"flake-compat": {
"flake": false,
"locked": {
"lastModified": 1767039857,
"narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
"owner": "NixOS",
"lastModified": 1696426674,
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
"type": "github"
},
"original": {
"owner": "NixOS",
"owner": "edolstra",
"repo": "flake-compat",
"type": "github"
}
@@ -127,12 +127,12 @@
]
},
"locked": {
"lastModified": 1782949081,
"narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
"rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
"revCount": 480,
"lastModified": 1748821116,
"narHash": "sha256-F82+gS044J1APL0n4hH50GYdPRv/5JWm34oCJYmVKdE=",
"rev": "49f0870db23e8c1ca0b5259734a02cd9e1e371a1",
"revCount": 377,
"type": "tarball",
"url": "https://api.flakehub.com/f/pinned/hercules-ci/flake-parts/0.1.480%2Brev-17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e/019f2195-dee5-7233-9747-eca0c27f7406/source.tar.gz"
"url": "https://api.flakehub.com/f/pinned/hercules-ci/flake-parts/0.1.377%2Brev-49f0870db23e8c1ca0b5259734a02cd9e1e371a1/01972f28-554a-73f8-91f4-d488cc502f08/source.tar.gz"
},
"original": {
"type": "tarball",
@@ -142,6 +142,10 @@
"git-hooks-nix": {
"inputs": {
"flake-compat": "flake-compat",
"gitignore": [
"determinate",
"nix"
],
"nixpkgs": [
"determinate",
"nix",
@@ -149,12 +153,12 @@
]
},
"locked": {
"lastModified": 1784288435,
"narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=",
"rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9",
"revCount": 1231,
"lastModified": 1747372754,
"narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
"rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
"revCount": 1026,
"type": "tarball",
"url": "https://api.flakehub.com/f/pinned/cachix/git-hooks.nix/0.1.1231%2Brev-43b3c1ab9d40fb1dbb008f451988a91e375825e9/019f7135-8fdf-76f0-b1a1-d2c67e91af8d/source.tar.gz"
"url": "https://api.flakehub.com/f/pinned/cachix/git-hooks.nix/0.1.1026%2Brev-80479b6ec16fefd9c1db3ea13aeb038c60530f46/0196d79a-1b35-7b8e-a021-c894fb62163d/source.tar.gz"
},
"original": {
"type": "tarball",
@@ -191,12 +195,12 @@
"nixpkgs-regression": "nixpkgs-regression"
},
"locked": {
"lastModified": 1786114274,
"narHash": "sha256-Quqthts9sCdYDCelos6cVrlxgJgkGcJNtQmWwFwvPQw=",
"rev": "c9c272f5ab1a99fb149ab2b152bd8cd8d6fa1186",
"revCount": 27199,
"lastModified": 1779472733,
"narHash": "sha256-nV5OHwivEf392cB5MDwoVdDHSvy6Q+rRYZBHd9sePj4=",
"rev": "11f3aff904f84ae612e36e8bc578ac421fca74fa",
"revCount": 25967,
"type": "tarball",
"url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.22.0/019fdd0b-8551-7d43-a627-08af9d70b415/source.tar.gz"
"url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.21.0/019e50fb-8633-73d0-b673-b2e265950490/source.tar.gz"
},
"original": {
"type": "tarball",
@@ -208,11 +212,11 @@
"nixpkgs": "nixpkgs_3"
},
"locked": {
"lastModified": 1785232496,
"narHash": "sha256-65EQYIRRpTdpH8lUiB6Mvo5uBkG60aBIzAJuALfx+O0=",
"lastModified": 1780065812,
"narHash": "sha256-SCSLUKBmwlSLGQ8Xbr8PjRFtiHNk0l9ktqkcmqdBkfE=",
"owner": "NixOS",
"repo": "nixos-hardware",
"rev": "2e790b0a6be8ec2b76174ac0931b8ff11919ec98",
"rev": "b76b5639c0593e0aeb0b5879ad62d4b30596c144",
"type": "github"
},
"original": {
@@ -224,16 +228,16 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1784160687,
"narHash": "sha256-iYL/bixrb6FlHFu/gIuBYzq6c6lM5AAXsXNSWXtIgQc=",
"rev": "4382ed2b7a6839d4280a9b386db49cbc5907414d",
"revCount": 1009383,
"lastModified": 1773222311,
"narHash": "sha256-BHoB/XpbqoZkVYZCfXJXfkR+GXFqwb/4zbWnOr2cRcU=",
"rev": "0590cd39f728e129122770c029970378a79d076a",
"revCount": 909248,
"type": "tarball",
"url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2605.1009383%2Brev-4382ed2b7a6839d4280a9b386db49cbc5907414d/019f6c11-ad78-7500-a194-d18a5bad0fbe/source.tar.gz"
"url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2511.909248%2Brev-0590cd39f728e129122770c029970378a79d076a/019ce32b-8ace-7339-b129-cceaa8dd10c6/source.tar.gz"
},
"original": {
"type": "tarball",
"url": "https://flakehub.com/f/NixOS/nixpkgs/0.2605"
"url": "https://flakehub.com/f/NixOS/nixpkgs/0.2511"
}
},
"nixpkgs-23-11": {
@@ -270,12 +274,12 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1785090369,
"narHash": "sha256-m0pDuRJG7EDo9ri+4Ksu83VsI+PlxNC9lNBfydejce4=",
"rev": "624af665418d3c65d544145b4d34ad696439570e",
"revCount": 1042126,
"lastModified": 1778869304,
"narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
"rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
"revCount": 998534,
"type": "tarball",
"url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.1042126%2Brev-624af665418d3c65d544145b4d34ad696439570e/019fcb6c-e772-7cb3-baa0-211e12b79e38/source.tar.gz"
"url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.998534%2Brev-d233902339c02a9c334e7e593de68855ad26c4cb/019e3efc-e09a-7ff1-b05f-0c8f85ba7441/source.tar.gz"
},
"original": {
"type": "tarball",
@@ -297,11 +301,11 @@
},
"nixpkgs_4": {
"locked": {
"lastModified": 1785989512,
"narHash": "sha256-HFQhkQcl5D1hUNoen3SGHCSFCt2Bg6uP+HgbrnA3InQ=",
"lastModified": 1780051219,
"narHash": "sha256-WnxzG4x47uCgjz+uD+vOzbF+Qid+hKyYdJWbduA9w7g=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "445d861c6d31b4af0c79d8d4be2331f762a361d7",
"rev": "e8e446a361172fe838243958325845d0b845c5e5",
"type": "github"
},
"original": {
+4
View File
@@ -16,6 +16,10 @@
inputs.nixpkgs.follows = "nixpkgs";
};
nixos-hardware.url = "github:NixOS/nixos-hardware/master";
nix-matrix-appservices = {
url = "gitlab:coffeetables/nix-matrix-appservices";
inputs.nixpkgs.follows = "nixpkgs";
};
};
outputs =
+52 -73
View File
@@ -7,92 +7,71 @@
with pkgs;
# NOTE Reference the environment variable set in the corresponding agenix secret
let
database = {
connection_string = "$DB_STRING";
max_open_conns = 100;
max_idle_conns = 5;
conn_max_lifetime = -1;
};
in
{
# Matrix server configuration
services.matrix-continuwuity = {
services.dendrite = {
enable = true;
httpPort = 8008;
environmentFile = config.age.secrets.dendrite-postgres.path;
loadCredential = [ "private_key:${config.age.secrets.dendrite.path}" ];
settings = {
global = {
server_name = "psydnd.org";
port = [ 8008 ];
allow_encryption = true;
allow_federation = true;
well_known.client = "https://matrix.psydnd.org";
server_name = "coolneng.duckdns.org";
private_key = config.age.secrets.dendrite.path;
inherit database;
dns_cache.enabled = true;
};
# HACK Inherit postgres connection string for the rest of the DBs
app_service_api = {
inherit database;
};
media_api = {
inherit database;
};
## Matrix bridges
# Facebook
services.mautrix-meta.instances.facebook = {
enable = true;
environmentFile = config.age.secrets.facebook.path;
settings = {
homeserver = {
address = "https://matrix.psysdnd.org";
domain = "psydnd.org";
room_server = {
inherit database;
};
appservice = {
address = "http://localhost:8228";
port = 8228;
database = "$DB_STRING";
push_server = {
inherit database;
};
bridge.permissions."@coolneng:psydnd.org" = "admin";
};
serviceDependencies = [ "continuwuity.service" ];
};
# Enable voice messages for Facebook
systemd.services.matrix-as-facebook.path = [ ffmpeg ];
# Telegram
services.mautrix-telegram = {
enable = true;
environmentFile = config.age.secrets.telegram.path;
settings = {
homeserver = {
address = "https://matrix.psysdnd.org";
domain = "psydnd.org";
};
appservice = {
address = "http://localhost:8118";
port = 8118;
database = "$DB_STRING";
};
bridge.permissions."@coolneng:psydnd.org" = "admin";
};
serviceDependencies = [ "continuwuity.service" ];
};
# Signal
services.mautrix-signal = {
enable = true;
environmentFile = config.age.secrets.signal.path;
settings = {
homeserver = {
address = "https://matrix.psysdnd.org";
domain = "psydnd.org";
};
appservice = {
address = "http://localhost:8338";
port = 8338;
database = "$DB_STRING";
};
bridge.permissions."@coolneng:psydnd.org" = "admin";
};
serviceDependencies = [ "continuwuity.service" ];
};
# HACK Use libolm as there's no good alternative
nixpkgs.config.permittedInsecurePackages = [
"olm-3.2.16"
mscs = {
inherit database;
mscs = [
"msc2836"
"msc2946"
];
};
sync_api = {
inherit database;
};
key_server = {
inherit database;
};
federation_api = {
inherit database;
};
user_api = {
account_database = database;
device_database = database;
};
};
};
# Start dendrite after config files are mounted
systemd.services.continuwuity.unitConfig.RequiresMountsFor = [
/var/lib/mautrix-meta-facebook
/var/lib/mautrix-signal
/var/lib/mautrix-telegram
systemd.services.dendrite.unitConfig.RequiresMountsFor = [
/var/lib/matrix-as-facebook
/var/lib/matrix-as-signal
/var/lib/matrix-as-telegram
];
# MQTT configuration
+1 -4
View File
@@ -82,14 +82,11 @@ with pkgs;
# Grafana configuration
services.grafana = {
enable = true;
settings = {
server = {
settings.server = {
domain = "grafana.psydnd.org";
http_port = 9009;
http_addr = "127.0.0.1";
};
security.secret_key = config.age.secrets.grafana.path;
};
};
}
+10 -10
View File
@@ -34,12 +34,21 @@
proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
'';
virtualHosts = {
# Redirection of the old domain
# Old domain being redirected
"coolneng.duckdns.org" = {
useACMEHost = "coolneng.duckdns.org";
forceSSL = true;
locations = {
"/".return = "301 https://psydnd.org$request_uri";
# Delegation for Matrix
"/.well-known/" = {
alias = "${../well-known}" + "/";
extraConfig = ''
${config.services.nginx.commonHttpConfig}
default_type application/json;
add_header Access-Control-Allow-Origin * always;
'';
};
};
};
# Redirect subdomains
@@ -52,15 +61,6 @@
"psydnd.org" = {
useACMEHost = "psydnd.org";
forceSSL = true;
# Delegation for Matrix
locations."/.well-known/" = {
alias = "${../well-known}" + "/";
extraConfig = ''
${config.services.nginx.commonHttpConfig}
default_type application/json;
add_header Access-Control-Allow-Origin * always;
'';
};
};
"radicale.psydnd.org" = {
useACMEHost = "psydnd.org";
+1 -1
View File
@@ -24,7 +24,7 @@ services=(
"radicale.service"
"miniflux.service"
"gitea.service"
"continuwuity.service"
"dendrite.service"
"nginx.service"
"dnsmasq.service"
"dnscrypt-proxy.service"
Binary file not shown.
Binary file not shown.
-5
View File
@@ -1,5 +0,0 @@
age-encryption.org/v1
-> ssh-ed25519 iUaRGg Ag32nut/aBlxEy7RPw7sV5itZSHkp8eMLVtxFxwQ8EM
ZhK8EZWTLkxrwo+x97w4HpexDXkC1yQuKyYFujqlOgs
--- kszqKtyubreK5mGkrJg4hrEKrfITJCCM/hW6IHKlMIE
TÚ+À~/ œDbM?Çø×å ½œa-ð'ƒÒp^5ç›?ï&#!àϳ‰þ~59O
+2
View File
@@ -8,6 +8,8 @@ in
"gitea.age".publicKeys = [ zion ];
"miniflux.age".publicKeys = [ zion ];
"git.age".publicKeys = [ zion ];
"dendrite.age".publicKeys = [ zion ];
"dendrite-postgres.age".publicKeys = [ zion ];
"telegram.age".publicKeys = [ zion ];
"mqtt-sender.age".publicKeys = [ zion ];
"mqtt-receiver.age".publicKeys = [ zion ];