From 7ac844b1f9d9496041c8b99c0b440cc734b7497b Mon Sep 17 00:00:00 2001 From: Anish L Date: Sat, 2 Jul 2022 00:21:51 +1000 Subject: [PATCH] moving helix into profiles --- bud/default.nix | 10 - bud/get.bash | 1 - flake.nix | 12 +- hosts/box/default.nix | 8 +- hosts/helix/configuration.nix | 37 ++ hosts/helix/default.nix | 23 + .../helix}/hardware-configuration.nix | 6 +- .../heisenbridge.nix | 2 +- .../gitea.nix => gitea/default.nix} | 29 +- profiles/helix-zone/configuration.nix | 60 --- profiles/helix-zone/matrix.nix | 375 -------------- profiles/helix-zone/monitoring.nix | 159 ------ profiles/helix-zone/rss-bridge.nix | 11 - profiles/helix-zone/sealight.nix | 14 - profiles/helix-zone/wireguard.nix | 32 -- profiles/matrix/default.nix | 469 ++++++++++-------- .../{helix-zone => matrix}/matrix-slack.nix | 3 +- .../mautrix-whatsapp.nix | 11 +- .../mod-mx-puppet-slack.nix | 5 +- profiles/metrics/default.nix | 159 ++++++ profiles/mossnet-hosts/default.nix | 1 + profiles/rss-bridge/default.nix | 15 +- profiles/seafile/default.nix | 43 +- profiles/sealight-website/default.nix | 14 + profiles/syncthing/default.nix | 2 +- profiles/wireguard-server/default.nix | 35 ++ 26 files changed, 621 insertions(+), 915 deletions(-) delete mode 100644 bud/default.nix delete mode 100644 bud/get.bash create mode 100644 hosts/helix/configuration.nix create mode 100644 hosts/helix/default.nix rename {profiles/helix-zone => hosts/helix}/hardware-configuration.nix (81%) rename profiles/helix-zone/mod-heisenbridge.nix => modules/heisenbridge.nix (98%) rename profiles/{helix-zone/gitea.nix => gitea/default.nix} (54%) delete mode 100644 profiles/helix-zone/configuration.nix delete mode 100644 profiles/helix-zone/matrix.nix delete mode 100644 profiles/helix-zone/monitoring.nix delete mode 100644 profiles/helix-zone/rss-bridge.nix delete mode 100644 profiles/helix-zone/sealight.nix delete mode 100644 profiles/helix-zone/wireguard.nix rename profiles/{helix-zone => matrix}/matrix-slack.nix (99%) rename profiles/{helix-zone => matrix}/mautrix-whatsapp.nix (93%) rename profiles/{helix-zone => matrix}/mod-mx-puppet-slack.nix (98%) create mode 100644 profiles/metrics/default.nix create mode 100644 profiles/sealight-website/default.nix create mode 100644 profiles/wireguard-server/default.nix diff --git a/bud/default.nix b/bud/default.nix deleted file mode 100644 index c486636b..00000000 --- a/bud/default.nix +++ /dev/null @@ -1,10 +0,0 @@ -{ pkgs, lib, budUtils, ... }: { - bud.cmds = with pkgs; { - get = { - writer = budUtils.writeBashWithPaths [ nixUnstable git coreutils ]; - synopsis = "get [DEST]"; - help = "Copy the desired template to DEST"; - script = ./get.bash; - }; - }; -} diff --git a/bud/get.bash b/bud/get.bash deleted file mode 100644 index 3b4d9a74..00000000 --- a/bud/get.bash +++ /dev/null @@ -1 +0,0 @@ -nix flake new -t "github:divnix/devos/core" "${2:-devos}" diff --git a/flake.nix b/flake.nix index 38632dc6..42f382d7 100644 --- a/flake.nix +++ b/flake.nix @@ -1,10 +1,6 @@ { description = "A highly structured configuration database."; - nixConfig.extra-experimental-features = "nix-command flakes"; - nixConfig.extra-substituters = "https://nrdxp.cachix.org https://nix-community.cachix.org"; - nixConfig.extra-trusted-public-keys = "nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="; - inputs = { # Nix @@ -126,11 +122,11 @@ }; suites = with profiles; rec { base = [ core users.root users.anish ]; - sealight = [ base server ]; # matrix rsshub backup wireguard-server - mossnet = [ base server taskd shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale seafile syncthing ]; # hpi syncthing sync.music + sealight = [ base server rss-bridge gitea wireguard-server metrics sealight-website ]; # matrix backup + mossnet = [ base server taskd shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale seafile syncthing ]; # hpi sync.music cube = [ base site server ]; - graphical = [ base bluetooth music sync.kitaab sync.website sync.cal wifi desktop ]; # syncthing - curve = [ graphical secrets ]; + graphical = [ base bluetooth music sync.kitaab sync.website sync.cal wifi desktop ]; + curve = [ graphical secrets syncthing ]; work = [ base ]; }; }; diff --git a/hosts/box/default.nix b/hosts/box/default.nix index aae435fe..f4884ee7 100644 --- a/hosts/box/default.nix +++ b/hosts/box/default.nix @@ -9,6 +9,7 @@ }; # For some reason this doesn't work in the profile, but does over here?? + # Something weird in the way I'm importing nixpkgs in the profile or something services."grasp".enable = true; services."grasp".path = "/home/anish/kitaab/grasp"; services."grasp".user = "anish"; @@ -28,10 +29,10 @@ "/var/www/shaarli-config" # sharli "/var/backup/postgresql" # wallabag "/var/lib/radicale" # radicale - "/home/anish/usr/syncthing" # syncthing + "/home/anish/usr/drawing" # syncthing + "/home/anish/usr/nonfiction" # syncthing ]; - # seafile? - # syncthing + # seafile }; age.secrets.box-wg.file = "${self}/secrets/box-wg.age"; @@ -41,4 +42,5 @@ ips = [ "10.0.69.4/24" ]; privateKeyFile = "/run/agenix/box-wg"; }; + services.syncthing.guiAddress = "0.0.0.0:8384"; # public syncthing } diff --git a/hosts/helix/configuration.nix b/hosts/helix/configuration.nix new file mode 100644 index 00000000..b893737a --- /dev/null +++ b/hosts/helix/configuration.nix @@ -0,0 +1,37 @@ +{ config, pkgs, ... }: +{ + imports = + [ + # Include the results of the hardware scan. + ./hardware-configuration.nix + ]; + + # Use the GRUB 2 boot loader. + boot.loader.grub.enable = true; + boot.loader.grub.version = 2; + boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only + + networking.hostName = "helix"; # Define your hostname. + + networking.useDHCP = false; + networking.interfaces.ens3.useDHCP = true; + + # Configure network proxy if necessary + # networking.proxy.default = "http://user:password@proxy:port/"; + # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; + + # Enable the OpenSSH daemon. + services.openssh.enable = true; + services.openssh.passwordAuthentication = false; + services.openssh.permitRootLogin = "no"; + sound.enable = false; + + # Define a user account. Don't forget to set a password with ‘passwd’. + # This value determines the NixOS release with which your system is to be + # compatible, in order to avoid breaking some software such as database + # servers. You should change this only after NixOS release notes say you + # should. + system.stateVersion = "19.09"; # Did you read the comment? + +} + diff --git a/hosts/helix/default.nix b/hosts/helix/default.nix new file mode 100644 index 00000000..faf16e70 --- /dev/null +++ b/hosts/helix/default.nix @@ -0,0 +1,23 @@ +{ self, profiles, suites, ... }: +{ + imports = [ + ./configuration.nix + ] ++ suites.sealight; + + home-manager.users.anish = { self, suites, ... }: { + imports = [ ] ++ suites.hmBase; + }; + + mossnet.backup = { + enable = false; + name = "sealight"; + paths = [ "/var/backup/postgresql" ]; + }; + + age.secrets.borg-password.file = "${self}/secrets/borg-password.age"; + services.postgresqlBackup = { + enable = false; + databases = [ "matrix" "gitea" ]; + location = "/var/backup/postgresql"; + }; +} diff --git a/profiles/helix-zone/hardware-configuration.nix b/hosts/helix/hardware-configuration.nix similarity index 81% rename from profiles/helix-zone/hardware-configuration.nix rename to hosts/helix/hardware-configuration.nix index a80788fe..403ff39d 100644 --- a/profiles/helix-zone/hardware-configuration.nix +++ b/hosts/helix/hardware-configuration.nix @@ -5,7 +5,8 @@ { imports = - [ + [ + ]; boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ]; @@ -14,7 +15,8 @@ boot.extraModulePackages = [ ]; fileSystems."/" = - { device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6"; + { + device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6"; fsType = "btrfs"; }; diff --git a/profiles/helix-zone/mod-heisenbridge.nix b/modules/heisenbridge.nix similarity index 98% rename from profiles/helix-zone/mod-heisenbridge.nix rename to modules/heisenbridge.nix index 06db08c4..3a74bb47 100644 --- a/profiles/helix-zone/mod-heisenbridge.nix +++ b/modules/heisenbridge.nix @@ -89,7 +89,7 @@ in systemd.services.heisenbridge = { description = "Heisenbridge Matrix IRC bridge"; - after = ["matrix-synapse.service"]; + after = [ "matrix-synapse.service" ]; wantedBy = [ "multi-user.target" ]; serviceConfig = { ExecStart = '' diff --git a/profiles/helix-zone/gitea.nix b/profiles/gitea/default.nix similarity index 54% rename from profiles/helix-zone/gitea.nix rename to profiles/gitea/default.nix index fe3488da..c34c7056 100644 --- a/profiles/helix-zone/gitea.nix +++ b/profiles/gitea/default.nix @@ -17,18 +17,18 @@ ENABLED = true; }; repository = { - DEFAULT_BRANCH = "main"; + DEFAULT_BRANCH = "main"; }; }; }; services.postgresql = { - enable = true; # Ensure postgresql is enabled + enable = true; # Ensure postgresql is enabled authentication = '' local gitea all ident map=gitea-users ''; - identMap = # Map the gitea user to postgresql + identMap = # Map the gitea user to postgresql '' gitea-users gitea gitea ''; @@ -39,15 +39,16 @@ }; services.nginx = { - enable = true; # Enable Nginx - recommendedGzipSettings = true; - recommendedOptimisation = true; - recommendedProxySettings = true; - recommendedTlsSettings = true; - virtualHosts."git.sealight.xyz" = { # Gitea hostname - enableACME = true; # Use ACME certs - forceSSL = true; # Force SSL - locations."/".proxyPass = "http://localhost:3001/"; # Proxy Gitea - }; - }; + enable = true; # Enable Nginx + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedProxySettings = true; + recommendedTlsSettings = true; + virtualHosts."git.sealight.xyz" = { + # Gitea hostname + enableACME = true; # Use ACME certs + forceSSL = true; # Force SSL + locations."/".proxyPass = "http://localhost:3001/"; # Proxy Gitea + }; + }; } diff --git a/profiles/helix-zone/configuration.nix b/profiles/helix-zone/configuration.nix deleted file mode 100644 index c64d62bd..00000000 --- a/profiles/helix-zone/configuration.nix +++ /dev/null @@ -1,60 +0,0 @@ -{ config, pkgs, ... }: -{ - imports = - [ # Include the results of the hardware scan. - ./hardware-configuration.nix - ./wireguard.nix - ./matrix.nix - ./monitoring.nix - ./rss-bridge.nix - ./gitea.nix - # ./dns.nix - "${builtins.fetchTarball "https://github.com/ryantm/agenix/archive/main.tar.gz"}/modules/age.nix" - ]; - - # Use the GRUB 2 boot loader. - boot.loader.grub.enable = true; - boot.loader.grub.version = 2; - boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only - - networking.hostName = "helix"; # Define your hostname. - - networking.useDHCP = false; - networking.interfaces.ens3.useDHCP = true; - - # Configure network proxy if necessary - # networking.proxy.default = "http://user:password@proxy:port/"; - # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; - - # Enable the OpenSSH daemon. - services.openssh.enable = true; - services.openssh.passwordAuthentication = false; - services.openssh.permitRootLogin = "no"; - - # Open ports in the firewall. - # networking.firewall.allowedTCPPorts = [ ... ]; - # networking.firewall.allowedUDPPorts = [ ... ]; - # Or disable the firewall altogether. - # networking.firewall.enable = false; - - # Include agenix - #environment.systemPackages = [ agenix.defaultPackage.x86_64-linux ]; - - # Define a user account. Don't forget to set a password with ‘passwd’. - users.users.anish = { - isNormalUser = true; - extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user - openssh.authorizedKeys.keys = [ - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve" - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCeWQsf9rbE+KBrWLkLkg1PMKx0jPfDP8xyv+XtddIQzAskRTN+JSSQp1GpoRgfQij7bx6f6DfjkwSQK5NWDQNQ+klGhcdEwEdptWUzpRAvKHMImjyIwFHmRKKEgcfH8+DSHVM93nRSQKrLezX4PzPkHF9f3TLxFdGeQDeY0J2oP2Oa97hRtuTJZW9BwUojyvDYUbg7F3fxf+pdFCvIAFaayiLkhOYdTXnjLt1Ks6NOhSzM78ZibHv4pFYI9r6dhflkFP/SzyLeSSm1aVAtxqE7vF5HnnORAg0byDsiOv/9RXxiDx7gkAAw3xENDSpp9TRj54M7iz1OSsRMhmD6orHjZFIRejlE4DIn+PBPm3PH+U5ILKTogE6n5MfPT28V0QdtHuqq3b5tSWiDcFpnjxbIUmEIo5hLzMR0tXZoNLQhBCSNfxjE8CYzpk7mHbvhSs2GPfG+NI1vvldbw2EF8beJFQHNYTqJw8y7p8RXpCwZqqpSitJX6v9DiYdLVG1hWvE= nix-on-droid@localhost" - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box" ]; - }; - - # This value determines the NixOS release with which your system is to be - # compatible, in order to avoid breaking some software such as database - # servers. You should change this only after NixOS release notes say you - # should. - system.stateVersion = "19.09"; # Did you read the comment? - -} - diff --git a/profiles/helix-zone/matrix.nix b/profiles/helix-zone/matrix.nix deleted file mode 100644 index 4d75f17d..00000000 --- a/profiles/helix-zone/matrix.nix +++ /dev/null @@ -1,375 +0,0 @@ -{ config, lib, pkgs, ... }: - -{ - imports = [ - #./mod-mx-puppet-slack.nix - ./mautrix-whatsapp.nix - ./mod-heisenbridge.nix - ]; - security.acme.email = "anish+acme@lakhwara.com"; - security.acme.acceptTerms = true; - services.matrix-synapse = { - enable = true; - app_service_config_files = [ - # # The registration file is automatically generated after starting the appservice for the first time. - # # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/ - # # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml - "/var/lib/matrix-synapse/discord-registration.yaml" - "/var/lib/matrix-synapse/telegram-registration.yaml" - #"/var/lib/matrix-synapse/slack-registration.yaml" - #"/var/lib/matrix-synapse/whatsapp-registration.yaml" - ]; - server_name = "sealight.xyz"; - registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; - enable_metrics = true; - enable_registration = true; - database_type = "psycopg2"; - database_args = { - database = "matrix-synapse"; - }; - - listeners = [ - { - port = 8448; - tls = false; - resources = [{ - compress = true; - names = ["client" "federation"]; - }]; - } - { - port = 9090; - type = "metrics"; - bind_address = "0.0.0.0"; - resources = [{ - compress = false; - names = []; - }]; - tls = false; - } - ]; - extraConfig = '' - max_upload_size: "50M" - use_presence: false - ''; - ## coturn based TURN server integration (TURN server setup mentioned later), - ## shared secret generated while configuring coturn - ## and reused here (power of Nix being a real programming language) - turn_uris = [ - "turn:turn.sealight.xyz:3478?transport=udp" - "turn:turn.sealight.xyz:3478?transport=tcp" - ]; - turn_shared_secret = config.services.coturn.static-auth-secret; - }; - - - services.coturn = { - enable = true; - use-auth-secret = true; - static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ"; - realm = "turn.sealight.xyz"; - min-port = 49111; - max-port = 51111; - no-cli = true; - no-tcp-relay = true; - no-tls = true; - cert = "${config.security.acme.certs."turn.sealight.xyz".directory}/full.pem"; - pkey = "${config.security.acme.certs."turn.sealight.xyz".directory}/key.pem"; - extraConfig = '' - verbose - user-quota=12 - total-quota=1200 - denied-peer-ip=10.0.0.0-10.255.255.255 - denied-peer-ip=192.168.0.0-192.168.255.255 - denied-peer-ip=172.16.0.0-172.31.255.255 - denied-peer-ip=0.0.0.0-0.255.255.255 - denied-peer-ip=100.64.0.0-100.127.255.255 - denied-peer-ip=127.0.0.0-127.255.255.255 - denied-peer-ip=169.254.0.0-169.254.255.255 - denied-peer-ip=192.0.0.0-192.0.0.255 - denied-peer-ip=192.0.2.0-192.0.2.255 - denied-peer-ip=192.88.99.0-192.88.99.255 - denied-peer-ip=198.18.0.0-198.19.255.255 - denied-peer-ip=198.51.100.0-198.51.100.255 - denied-peer-ip=203.0.113.0-203.0.113.255 - denied-peer-ip=240.0.0.0-255.255.255.255 - ''; - }; - - security.acme.certs.${config.services.coturn.realm} = { - /* insert here the right configuration to obtain a certificate */ - webroot = "/var/lib/acme/acme-challenge/"; - email = "anish+acme@lakhwara.com"; - postRun = "systemctl restart coturn.service"; - group = "turnserver"; - }; - - services.jitsi-meet = { - enable = true; - hostName = "jitsi.sealight.xyz"; - }; - services.jitsi-videobridge.enable = true; - - services.mautrix-telegram = { - enable = true; - environmentFile = /etc/secrets/telegram.env; # file containing the appservice and telegram tokens - # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. - settings = { - homeserver = { - address = "https://sealight.xyz"; - domain = "sealight.xyz"; - }; - appservice = { - provisioning.enabled = false; - id = "telegram"; - bot_username = "telegrambridge"; - public = { - enabled = false; - prefix = "/public"; - external = "https://chat.sealight.xyz/public"; - }; - address = "http://localhost:18787"; - port = 18787; - # The service uses SQLite by default, but it's also possible to use PostgreSQL instead: - #database = "postgresql:///mautrix-telegram?host=/run/postgresql"; - }; - bridge = { - relaybot.authless_portals = false; - permissions = { - "@aynish:sealight.xyz" = "admin"; - }; - }; - }; - }; - - services.mautrix-whatsapp = { - enable = false; - # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. - #configOptions = { - # homeserver = { - # address = "https://chat.sealight.xyz"; - # domain = "sealight.xyz"; - # }; - # appservice = { - # id = "whatsapp"; - # address = http://localhost:9897; - # hostname = "0.0.0.0"; - # port = 9897; - # database = { - # type = "sqlite3"; - # uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db"; - # }; - # state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json"; - # bot = { - # username = "whatsappbot"; - # displayname = "WhatsApp bridge bot"; - # avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr"; - # }; - # as_token = ""; - # hs_token = ""; - # }; - # bridge = { - # username_template = "whatsapp_{{.}}"; - # displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)"; - # command_prefix = "!wa"; - # permissions = { - # "@aynish:sealight.xyz" = 100; - # }; - # }; - # logging = { - # directory = "/var/lib/mautrix-whatsapp/logs"; - # file_name_format = "{{.Date}}-{{.Index}}.log"; - # file_date_format = "\"2006-01-02\""; - # file_mode = 384; - # timestamp_format = "Jan _2, 2006 15:04:05"; - # print_level = "debug"; - # }; - # metrics = { - # enabled = true; - # listen = "http://localhost:5070"; - # }; - #}; - }; - - services.mx-puppet-discord = { - enable = true; - settings = { - bridge = { - bindAddress = "localhost"; - port = 16785; - domain = "sealight.xyz"; - homeserverUrl = "https://sealight.xyz"; - avatarUrl = "https://discord.com/assets/2d20a45d79110dc5bf947137e9d99b66.svg"; - }; - provisioning = { - whitelist = [ "@aynish:sealight.xyz" ]; - }; - relay = { - whitelist = [ "@aynish:sealight.xyz" ]; - }; - namePatterns = { - group = ":name"; - room = ":name"; - user = ":name (Discord)"; - userOverride = ":displayname"; - }; - presence = { - enabled = false; - }; - }; - serviceDependencies = ["matrix-synapse.service"]; - }; - - #services.mx-puppet-slack= { - #enable = false; - #settings = { - # bridge = { - # bindAddress = "localhost"; - # port = 16786; - # domain = "sealight.xyz"; - # homeserverUrl = "https://sealight.xyz"; - # }; - # provisioning = { - # whitelist = [ "@aynish:sealight.xyz" ]; - # }; - # relay = { - # whitelist = [ "@aynish:sealight.xyz" ]; - # }; - # namePatterns = { - # group = ":name"; - # room = ":name[:team? - :team,]"; - # user = ":name (Slack)"; - # userOverride = ":displayname"; - # }; - # presence = { - # enabled = false; - # }; - # oauth = { - # enabled = false; - # }; - #}; - #serviceDependencies = ["matrix-synapse.service"]; - #}; - - services.heisenbridge = { - enable = true; - homeserver = "https://sealight.xyz"; - listenPort = 14456; - appServiceToken = "wyujLh8kjpmk2bfKeEE3sZ2gWOEUBKK5"; - homeserverToken = "yEHs7lthD2ZHUibJOAv1APaFhEjxN5PT"; - }; - - services.postgresql = { - enable = true; - ## postgresql user and db name remains in the - ## service.matrix-synapse.database_args setting which - ## by default is matrix-synapse - initialScript = pkgs.writeText "synapse-init.sql" '' - CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|'kq@iBwlIzu"; - CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse" - TEMPLATE template0 - LC_COLLATE = "C" - LC_CTYPE = "C"; - ''; - }; - - networking.firewall = let - range = with config.services.coturn; [ { - from = min-port; - to = max-port; - } ]; - in { - enable = true; - allowedUDPPortRanges = range; # coturn - allowedTCPPortRanges = range; - allowedTCPPorts = [ - 22 # SSH - 8448 # Matrix federation - 8008 - 80 - 443 - 3478 # Coturn service - 5349 # Coturn service - 9090 # Synapse Metrics - ]; - allowedUDPPorts = [ - 3478 - 5349 # Coturn service - ]; - }; - - nixpkgs.overlays = [ - (self: super: { - element-web = super.element-web.override { - conf = { - default_server_config = { - "m.homeserver" = { - "base_url" = "https://chat.sealight.xyz"; - "server_name" = "sealight.xyz"; - }; - "m.identity_server" = { - "base_url" = "https://vector.im"; - }; - }; - - ## jitsi will be setup later, - ## but we need to add to Riot configuration - jitsi.preferredDomain = "jitsi.sealight.xyz"; - }; - }; - }) - ]; - - services.nginx = { - enable = true; - virtualHosts = { - - "sealight.xyz" = { - forceSSL = true; - enableACME = true; - locations."/" = { - root = "/var/www/sealight.xyz"; - }; - locations."/_matrix" = { - proxyPass = "http://localhost:8448"; - }; - locations."/slackbridge" = { - proxyPass = "http://localhost:9899"; - }; - }; - - ## virtual host for Synapse - "chat.sealight.xyz" = { - forceSSL = true; - enableACME = true; - #useACMEHost = "sealight.xyz"; - locations."/" = { - proxyPass = "http://localhost:8448"; - }; - }; - - ## virtual host for Riot/Web - "element.sealight.xyz" = { - forceSSL = true; - enableACME = true; - #useACMEHost = "sealight.xyz"; - - ## root points to the riot-web package content, also configured via Nix - locations."/" = { - root = pkgs.element-web; - }; - }; - - ${config.services.jitsi-meet.hostName} = { - enableACME = true; - forceSSL = true; - }; - }; - ## other nginx specific best practices - recommendedGzipSettings = true; - recommendedOptimisation = true; - recommendedTlsSettings = true; - }; - - environment.systemPackages = with pkgs; [ matrix-appservice-slack ]; -} diff --git a/profiles/helix-zone/monitoring.nix b/profiles/helix-zone/monitoring.nix deleted file mode 100644 index a487ac77..00000000 --- a/profiles/helix-zone/monitoring.nix +++ /dev/null @@ -1,159 +0,0 @@ -{ config, pkgs, ... }: { - # grafana configuration - #services.grafana = { - # enable = true; - # domain = "grafana.mossnet.lan"; - # port = 2342; - # addr = "127.0.0.1"; - #}; - # - ## nginx reverse proxy - #services.nginx.virtualHosts.${config.services.grafana.domain} = { - # locations."/" = { - # proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; - # proxyWebsockets = true; - # }; - #}; - - services.prometheus = { - enable = true; - port = 9001; - exporters = { - node = { - enable = true; - enabledCollectors = [ "systemd" ]; - port = 9002; - }; - }; - rules = [ - '' -groups: -- name: synapse - rules: - - record: "synapse_federation_transaction_queue_pendingEdus:total" - expr: "sum(synapse_federation_transaction_queue_pendingEdus or absent(synapse_federation_transaction_queue_pendingEdus)*0)" - - record: "synapse_federation_transaction_queue_pendingPdus:total" - expr: "sum(synapse_federation_transaction_queue_pendingPdus or absent(synapse_federation_transaction_queue_pendingPdus)*0)" - - record: 'synapse_http_server_request_count:method' - labels: - servlet: "" - expr: "sum(synapse_http_server_request_count) by (method)" - - record: 'synapse_http_server_request_count:servlet' - labels: - method: "" - expr: 'sum(synapse_http_server_request_count) by (servlet)' - - - record: 'synapse_http_server_request_count:total' - labels: - servlet: "" - expr: 'sum(synapse_http_server_request_count:by_method) by (servlet)' - - - record: 'synapse_cache:hit_ratio_5m' - expr: 'rate(synapse_util_caches_cache:hits[5m]) / rate(synapse_util_caches_cache:total[5m])' - - record: 'synapse_cache:hit_ratio_30s' - expr: 'rate(synapse_util_caches_cache:hits[30s]) / rate(synapse_util_caches_cache:total[30s])' - - - record: 'synapse_federation_client_sent' - labels: - type: "EDU" - expr: 'synapse_federation_client_sent_edus + 0' - - record: 'synapse_federation_client_sent' - labels: - type: "PDU" - expr: 'synapse_federation_client_sent_pdu_destinations:count + 0' - - record: 'synapse_federation_client_sent' - labels: - type: "Query" - expr: 'sum(synapse_federation_client_sent_queries) by (job)' - - - record: 'synapse_federation_server_received' - labels: - type: "EDU" - expr: 'synapse_federation_server_received_edus + 0' - - record: 'synapse_federation_server_received' - labels: - type: "PDU" - expr: 'synapse_federation_server_received_pdus + 0' - - record: 'synapse_federation_server_received' - labels: - type: "Query" - expr: 'sum(synapse_federation_server_received_queries) by (job)' - - - record: 'synapse_federation_transaction_queue_pending' - labels: - type: "EDU" - expr: 'synapse_federation_transaction_queue_pending_edus + 0' - - record: 'synapse_federation_transaction_queue_pending' - labels: - type: "PDU" - expr: 'synapse_federation_transaction_queue_pending_pdus + 0' - - - record: synapse_storage_events_persisted_by_source_type - expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_type="remote"}) - labels: - type: remote - - record: synapse_storage_events_persisted_by_source_type - expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity="*client*",origin_type="local"}) - labels: - type: local - - record: synapse_storage_events_persisted_by_source_type - expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity!="*client*",origin_type="local"}) - labels: - type: bridges - - record: synapse_storage_events_persisted_by_event_type - expr: sum without(origin_entity, origin_type) (synapse_storage_events_persisted_events_sep) - - record: synapse_storage_events_persisted_by_origin - expr: sum without(type) (synapse_storage_events_persisted_events_sep) - '' - ]; - scrapeConfigs = [ - { - job_name = "helix"; - static_configs = [{ - targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ]; - }]; - } - { - job_name = "synapse"; - metrics_path = "/_synapse/metrics"; - static_configs = [{ - targets = [ "localhost:9090" ]; - }]; - } - { - job_name = "gitea"; - static_configs = [{ - targets = [ "localhost:3001" ]; - }]; - } - ]; - }; - - networking.firewall = { - enable = true; - allowedTCPPorts = [ 9001 ]; - }; - - services.nginx.virtualHosts."sealight.xyz" = { - locations."/metrics" = { - #basicAuth = { anish = "password"; }; - proxyPass = "http://localhost:9001"; - }; - }; - - services.loki = { - enable = true; - configFile = /var/loki-config.yaml; - }; - - systemd.services.promtail = { - description = "Promtail service for Loki"; - wantedBy = [ "multi-user.target" ]; - - serviceConfig = { - ExecStart = '' - ${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml} - ''; - }; - }; -} diff --git a/profiles/helix-zone/rss-bridge.nix b/profiles/helix-zone/rss-bridge.nix deleted file mode 100644 index dee16e01..00000000 --- a/profiles/helix-zone/rss-bridge.nix +++ /dev/null @@ -1,11 +0,0 @@ -{pkgs, lib, config, ...}: -{ - services.rss-bridge = { - enable = true; - virtualHost = "bridge.sealight.xyz"; - whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit"]; - }; - - services.nginx.virtualHosts."bridge.sealight.xyz".forceSSL = true; - services.nginx.virtualHosts."bridge.sealight.xyz".enableACME = true; -} diff --git a/profiles/helix-zone/sealight.nix b/profiles/helix-zone/sealight.nix deleted file mode 100644 index ed882042..00000000 --- a/profiles/helix-zone/sealight.nix +++ /dev/null @@ -1,14 +0,0 @@ -{ - services.nginx = { - enable = true; - vhost = { - "sealight.xyz" = { - forceSSL = true; - enableACME = true; - locations."/" = { - root = "/var/www/sealight.xyz" - }; - }; - }; - }; -} diff --git a/profiles/helix-zone/wireguard.nix b/profiles/helix-zone/wireguard.nix deleted file mode 100644 index a74ab802..00000000 --- a/profiles/helix-zone/wireguard.nix +++ /dev/null @@ -1,32 +0,0 @@ -{ config, pkgs, lib, ... }: -{ - environment.systemPackages = [ pkgs.wireguard pkgs.mosh ]; - networking.nat = { - enable = true; - externalInterface = "ens3"; - internalInterfaces = [ "wg0" ]; - }; - networking.firewall = { - allowedUDPPorts = [ 60990 ]; - }; - - networking.wireguard.interfaces.wg0 = { - ips = [ "10.0.69.1/24" ]; - listenPort = 60990; - privateKeyFile = "/var/lib/wireguard/priv"; - peers = [ - { # box - publicKey = "Ra78mOc110K7URN5uB3m9d78iBKgeRHzT+3HkiFp9BU="; - allowedIPs = [ "10.0.69.4/32" ]; - } - { # line - publicKey = "fsb1FuGmYi89p4CVXytKw2FYamONKtoanxrgs/dJjC8="; - allowedIPs = [ "10.0.69.3/32" ]; - } - { # curve - publicKey = "XmV4AcPPND/eeSI6d9M1iahCjtymqY6DdUDEFNP/x3g="; - allowedIPs = [ "10.0.69.2/32" ]; - } -]; - }; -} diff --git a/profiles/matrix/default.nix b/profiles/matrix/default.nix index a3995a12..f3959d84 100644 --- a/profiles/matrix/default.nix +++ b/profiles/matrix/default.nix @@ -1,25 +1,47 @@ +{ config, lib, pkgs, ... }: + { security.acme.email = "anish+acme@lakhwara.com"; security.acme.acceptTerms = true; services.matrix-synapse = { enable = true; app_service_config_files = [ - # # The registration file is automatically generated after starting the appservice for the first time. - # # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/ - # # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml - # "/var/lib/matrix-synapse/discord-registration.yaml" - # "/var/lib/matrix-synapse/telegram-registration.yaml" - # "/var/lib/matrix-synapse/slack-registration.yaml" - # # "/var/lib/matrix-synapse/whatsapp-registration.yaml" + # # The registration file is automatically generated after starting the appservice for the first time. + # # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/ + # # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml + "/var/lib/matrix-synapse/discord-registration.yaml" + "/var/lib/matrix-synapse/telegram-registration.yaml" + #"/var/lib/matrix-synapse/slack-registration.yaml" + #"/var/lib/matrix-synapse/whatsapp-registration.yaml" ]; server_name = "sealight.xyz"; - registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; # TODO use agnix + registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; enable_metrics = true; enable_registration = true; database_type = "psycopg2"; database_args = { database = "matrix-synapse"; }; + listeners = [ + { + port = 8448; + tls = false; + resources = [{ + compress = true; + names = [ "client" "federation" ]; + }]; + } + { + port = 9090; + type = "metrics"; + bind_address = "0.0.0.0"; + resources = [{ + compress = false; + names = [ ]; + }]; + tls = false; + } + ]; extraConfig = '' max_upload_size: "50M" use_presence: false @@ -32,27 +54,6 @@ "turn:turn.sealight.xyz:3478?transport=tcp" ]; turn_shared_secret = config.services.coturn.static-auth-secret; - - listeners = [ - { - port = 8448; - tls = false; - resources = [{ - compress = true; - names = ["client" "federation"]; - }]; - } - { - port = 9090; - type = "metrics"; - bind_address = "0.0.0.0"; - resources = [{ - compress = false; - names = []; - }]; - tls = false; - } - ]; }; services.coturn = { @@ -60,27 +61,45 @@ use-auth-secret = true; static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ"; realm = "turn.sealight.xyz"; + min-port = 49111; + max-port = 51111; + no-cli = true; no-tcp-relay = true; no-tls = true; - no-dtls = true; + cert = "${config.security.acme.certs."turn.sealight.xyz".directory}/full.pem"; + pkey = "${config.security.acme.certs."turn.sealight.xyz".directory}/key.pem"; extraConfig = '' - user-quota=12 - total-quota=1200 - denied-peer-ip=10.0.0.0-10.255.255.255 - denied-peer-ip=192.168.0.0-192.168.255.255 - denied-peer-ip=172.16.0.0-172.31.255.255 - - allowed-peer-ip=192.168.191.127 + verbose + user-quota=12 + total-quota=1200 + denied-peer-ip=10.0.0.0-10.255.255.255 + denied-peer-ip=192.168.0.0-192.168.255.255 + denied-peer-ip=172.16.0.0-172.31.255.255 + denied-peer-ip=0.0.0.0-0.255.255.255 + denied-peer-ip=100.64.0.0-100.127.255.255 + denied-peer-ip=127.0.0.0-127.255.255.255 + denied-peer-ip=169.254.0.0-169.254.255.255 + denied-peer-ip=192.0.0.0-192.0.0.255 + denied-peer-ip=192.0.2.0-192.0.2.255 + denied-peer-ip=192.88.99.0-192.88.99.255 + denied-peer-ip=198.18.0.0-198.19.255.255 + denied-peer-ip=198.51.100.0-198.51.100.255 + denied-peer-ip=203.0.113.0-203.0.113.255 + denied-peer-ip=240.0.0.0-255.255.255.255 ''; }; + security.acme.certs.${config.services.coturn.realm} = { + /* insert here the right configuration to obtain a certificate */ + webroot = "/var/lib/acme/acme-challenge/"; + email = "anish+acme@lakhwara.com"; + postRun = "systemctl restart coturn.service"; + group = "turnserver"; + }; + services.jitsi-meet = { enable = true; hostName = "jitsi.sealight.xyz"; - - ## this setting is going to add relevant ports to - ## networking.firewall.allowedTCPPorts & - ## networking.firewall.allowedUDPPorts }; services.jitsi-videobridge.enable = true; @@ -90,17 +109,20 @@ # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. settings = { homeserver = { - address = "https://chat.sealight.xyz"; + address = "https://sealight.xyz"; domain = "sealight.xyz"; }; appservice = { provisioning.enabled = false; id = "telegram"; + bot_username = "telegrambridge"; public = { enabled = false; prefix = "/public"; external = "https://chat.sealight.xyz/public"; }; + address = "http://localhost:18787"; + port = 18787; # The service uses SQLite by default, but it's also possible to use PostgreSQL instead: #database = "postgresql:///mautrix-telegram?host=/run/postgresql"; }; @@ -113,96 +135,41 @@ }; }; - services.mautrix-whatsapp = { + services.mx-puppet-discord = { enable = true; - # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. - configOptions = { - homeserver = { - address = "https://chat.sealight.xyz"; - domain = "sealight.xyz"; - }; - appservice = { - id = "whatsapp"; - address = http://localhost:9897; - hostname = "0.0.0.0"; - port = 9897; - database = { - type = "sqlite3"; - uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db"; - }; - state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json"; - bot = { - username = "whatsappbot"; - displayname = "WhatsApp bridge bot"; - avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr"; - }; - as_token = ""; - hs_token = ""; - }; + settings = { bridge = { - username_template = "whatsapp_{{.}}"; - displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)"; - command_prefix = "!wa"; - permissions = { - "@aynish:sealight.xyz" = 100; - }; + bindAddress = "localhost"; + port = 16785; + domain = "sealight.xyz"; + homeserverUrl = "https://sealight.xyz"; + avatarUrl = "https://discord.com/assets/2d20a45d79110dc5bf947137e9d99b66.svg"; }; - logging = { - directory = "/var/lib/mautrix-whatsapp/logs"; - file_name_format = "{{.Date}}-{{.Index}}.log"; - file_date_format = "\"2006-01-02\""; - file_mode = 384; - timestamp_format = "Jan _2, 2006 15:04:05"; - print_level = "debug"; + provisioning = { + whitelist = [ "@aynish:sealight.xyz" ]; }; - metrics = { - enabled = true; - listen = "http://localhost:5070"; + relay = { + whitelist = [ "@aynish:sealight.xyz" ]; + }; + namePatterns = { + group = ":name"; + room = ":name"; + user = ":name (Discord)"; + userOverride = ":displayname"; + }; + presence = { + enabled = false; }; }; + serviceDependencies = [ "matrix-synapse.service" ]; }; - services.matrix-appservice-slack = { + services.heisenbridge = { enable = true; - #environmentFile = /etc/secrets/matrix-appservice-slack.env; - settings = { - homeserver = { - server_name = "sealight.xyz"; - url = "https://chat.sealight.xyz"; - }; - db = { - engine = "postgres"; - connectionString = "postgres://slackbridge_user:somethingverysecret@localhost/slack_bridge?sslmode=require"; - }; - matrix_admin_room = "!ikEWOHCcmoZtVzSmPF:sealight.xyz"; - username_prefix = "slack_"; - rtm = { - enable = true; - logging = "silent"; - }; - slack_hook_port = 9899; - enable_metrics = true; - puppeting = { - enabled = true; - onboard_users = true; - }; - oauth2 = { - client_id = "2832868673.1609454840563"; - client_secret = "079a7ca42b192e66a9ff32740a69cb9d"; - redirect_prefix = "https://sealight.xyz/slackbridge/"; - }; - #team_sync = { - # T02QGRJKT = { - # users = { - # enabled = false; - # }; - # channels = { - # enabled = true; - # alias_prefix = "qf_"; - # }; - # }; - #}; - }; + homeserver = "https://sealight.xyz"; + listenPort = 14456; + appServiceToken = "wyujLh8kjpmk2bfKeEE3sZ2gWOEUBKK5"; + homeserverToken = "yEHs7lthD2ZHUibJOAv1APaFhEjxN5PT"; }; services.postgresql = { @@ -211,99 +178,189 @@ ## service.matrix-synapse.database_args setting which ## by default is matrix-synapse initialScript = pkgs.writeText "synapse-init.sql" '' - CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|'kq@iBwlIzu"; - CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse" - TEMPLATE template0 - LC_COLLATE = "C" - LC_CTYPE = "C"; - ''; + CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|'kq@iBwlIzu"; + CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse" + TEMPLATE template0 + LC_COLLATE = "C" + LC_CTYPE = "C"; + ''; }; - networking.firewall = { - enable = true; - allowedTCPPorts = [ - 22 # SSH - 8448 # Matrix federation - 8008 - 80 - 443 - 9090 # Synapse Metrics - 9899 # Matrix <-> Slack Bridge Puppeting - ]; - }; + networking.firewall = + let + range = with config.services.coturn; [{ + from = min-port; + to = max-port; + }]; + in + { + enable = true; + allowedUDPPortRanges = range; # coturn + allowedTCPPortRanges = range; + allowedTCPPorts = [ + 22 # SSH + 8448 # Matrix federation + 8008 + 80 + 443 + 3478 # Coturn service + 5349 # Coturn service + 9090 # Synapse Metrics + ]; + allowedUDPPorts = [ + 3478 + 5349 # Coturn service + ]; + }; - nixpkgs.overlays = [ + nixpkgs.overlays = [ (self: super: { - element-web = super.element-web.override { - conf = { - default_server_config = { - "m.homeserver" = { - "base_url" = "https://chat.sealight.xyz"; - "server_name" = "sealight.xyz"; - }; - "m.identity_server" = { - "base_url" = "https://vector.im"; - }; - }; - - ## jitsi will be setup later, - ## but we need to add to Riot configuration - jitsi.preferredDomain = "jitsi.sealight.xyz"; + element-web = super.element-web.override { + conf = { + default_server_config = { + "m.homeserver" = { + "base_url" = "https://chat.sealight.xyz"; + "server_name" = "sealight.xyz"; }; + "m.identity_server" = { + "base_url" = "https://vector.im"; + }; + }; + + ## jitsi will be setup later, + ## but we need to add to Riot configuration + jitsi.preferredDomain = "jitsi.sealight.xyz"; }; + }; }) ]; services.nginx = { - enable = true; - virtualHosts = { - - "sealight.xyz" = { - forceSSL = true; - enableACME = true; - locations."/" = { - root = "/var/www/sealight.xyz"; - }; - locations."/_matrix" = { - proxyPass = "http://localhost:8448"; - }; - locations."/slackbridge" = { - proxyPass = "http://localhost:9899"; - }; - }; - - ## virtual host for Synapse - "chat.sealight.xyz" = { - forceSSL = true; - enableACME = true; - #useACMEHost = "sealight.xyz"; - locations."/" = { - proxyPass = "http://localhost:8448"; - }; - }; - - ## virtual host for Riot/Web - "element.sealight.xyz" = { - forceSSL = true; - enableACME = true; - #useACMEHost = "sealight.xyz"; - - ## root points to the riot-web package content, also configured via Nix - locations."/" = { - root = pkgs.element-web; - }; - }; - - ${config.services.jitsi-meet.hostName} = { - enableACME = true; - forceSSL = true; - }; - }; - ## other nginx specific best practices - recommendedGzipSettings = true; - recommendedOptimisation = true; - recommendedTlsSettings = true; + enable = true; + virtualHosts = { + "sealight.xyz" = { + forceSSL = true; + enableACME = true; + locations."/" = { + root = "/var/www/sealight.xyz"; + }; + locations."/_matrix" = { + proxyPass = "http://localhost:8448"; + }; + locations."/slackbridge" = { + proxyPass = "http://localhost:9899"; + }; + }; + ## virtual host for Synapse + "chat.sealight.xyz" = { + forceSSL = true; + enableACME = true; + #useACMEHost = "sealight.xyz"; + locations."/" = { + proxyPass = "http://localhost:8448"; + }; + }; + ## virtual host for Riot/Web + "element.sealight.xyz" = { + forceSSL = true; + enableACME = true; + #useACMEHost = "sealight.xyz"; + ## root points to the riot-web package content, also configured via Nix + locations."/" = { + root = pkgs.element-web; + }; + }; + ${config.services.jitsi-meet.hostName} = { + enableACME = true; + forceSSL = true; + }; + }; + ## other nginx specific best practices + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedTlsSettings = true; }; - environment.systemPackages = with pkgs; [ matrix-appservice-slack ]; + # environment.systemPackages = with pkgs; [ matrix-appservice-slack ]; + #services.mx-puppet-slack= { + #enable = false; + #settings = { + # bridge = { + # bindAddress = "localhost"; + # port = 16786; + # domain = "sealight.xyz"; + # homeserverUrl = "https://sealight.xyz"; + # }; + # provisioning = { + # whitelist = [ "@aynish:sealight.xyz" ]; + # }; + # relay = { + # whitelist = [ "@aynish:sealight.xyz" ]; + # }; + # namePatterns = { + # group = ":name"; + # room = ":name[:team? - :team,]"; + # user = ":name (Slack)"; + # userOverride = ":displayname"; + # }; + # presence = { + # enabled = false; + # }; + # oauth = { + # enabled = false; + # }; + #}; + #serviceDependencies = ["matrix-synapse.service"]; + #}; + + # services.mautrix-whatsapp = { + # enable = false; + # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. + #configOptions = { + # homeserver = { + # address = "https://chat.sealight.xyz"; + # domain = "sealight.xyz"; + # }; + # appservice = { + # id = "whatsapp"; + # address = http://localhost:9897; + # hostname = "0.0.0.0"; + # port = 9897; + # database = { + # type = "sqlite3"; + # uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db"; + # }; + # state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json"; + # bot = { + # username = "whatsappbot"; + # displayname = "WhatsApp bridge bot"; + # avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr"; + # }; + # as_token = ""; + # hs_token = ""; + # }; + # bridge = { + # username_template = "whatsapp_{{.}}"; + # displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)"; + # command_prefix = "!wa"; + # permissions = { + # "@aynish:sealight.xyz" = 100; + # }; + # }; + # logging = { + # directory = "/var/lib/mautrix-whatsapp/logs"; + # file_name_format = "{{.Date}}-{{.Index}}.log"; + # file_date_format = "\"2006-01-02\""; + # file_mode = 384; + # timestamp_format = "Jan _2, 2006 15:04:05"; + # print_level = "debug"; + # }; + # metrics = { + # enabled = true; + # listen = "http://localhost:5070"; + # }; + #}; + # }; + + } diff --git a/profiles/helix-zone/matrix-slack.nix b/profiles/matrix/matrix-slack.nix similarity index 99% rename from profiles/helix-zone/matrix-slack.nix rename to profiles/matrix/matrix-slack.nix index b3b071c2..8c4a9e77 100644 --- a/profiles/helix-zone/matrix-slack.nix +++ b/profiles/matrix/matrix-slack.nix @@ -10,7 +10,8 @@ let # TODO: switch to configGen.json once RFC42 is implemented settingsFile = pkgs.writeText "matrix-appservice-slack-settings.json" (builtins.toJSON cfg.settings); -in { +in +{ options = { services.matrix-appservice-slack = { enable = mkEnableOption "a bridge between Matrix and Slack"; diff --git a/profiles/helix-zone/mautrix-whatsapp.nix b/profiles/matrix/mautrix-whatsapp.nix similarity index 93% rename from profiles/helix-zone/mautrix-whatsapp.nix rename to profiles/matrix/mautrix-whatsapp.nix index beaaa6f0..91431e9e 100644 --- a/profiles/helix-zone/mautrix-whatsapp.nix +++ b/profiles/matrix/mautrix-whatsapp.nix @@ -5,10 +5,11 @@ with lib; let cfg = config.services.mautrix-whatsapp; - configFile = pkgs.runCommand "mautrix-whatsapp" { - buildInputs = [ pkgs.mautrix-whatsapp pkgs.remarshal ]; - preferLocalBuild = true; - } '' + configFile = pkgs.runCommand "mautrix-whatsapp" + { + buildInputs = [ pkgs.mautrix-whatsapp pkgs.remarshal ]; + preferLocalBuild = true; + } '' mkdir -p $out ${pkgs.remarshal}/bin/json2yaml -i ${pkgs.writeText "config.json" (builtins.toJSON cfg.configOptions)} \ -o $out/config.yaml @@ -82,7 +83,7 @@ in serviceConfig = { DynamicUser = true; StateDirectory = "mautrix-whatsapp"; - LoggingDir = "mautrix-whatsapp"; + LoggingDir = "mautrix-whatsapp"; ExecStart = '' ${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp -c "${configFile}/config.yaml" ''; diff --git a/profiles/helix-zone/mod-mx-puppet-slack.nix b/profiles/matrix/mod-mx-puppet-slack.nix similarity index 98% rename from profiles/helix-zone/mod-mx-puppet-slack.nix rename to profiles/matrix/mod-mx-puppet-slack.nix index 8778f9c7..602cd615 100644 --- a/profiles/helix-zone/mod-mx-puppet-slack.nix +++ b/profiles/matrix/mod-mx-puppet-slack.nix @@ -6,11 +6,12 @@ let dataDir = "/var/lib/mx-puppet-slack"; registrationFile = "${dataDir}/slack-registration.yaml"; cfg = config.services.mx-puppet-slack; - settingsFormat = pkgs.formats.json {}; + settingsFormat = pkgs.formats.json { }; settingsFile = settingsFormat.generate "mx-puppet-slack-config.json" cfg.settings; mx-puppet-slack = pkgs.callPackage ./pkg-mx-puppet-slack.nix { }; -in { +in +{ options = { services.mx-puppet-slack = { enable = mkEnableOption '' diff --git a/profiles/metrics/default.nix b/profiles/metrics/default.nix new file mode 100644 index 00000000..957f6afc --- /dev/null +++ b/profiles/metrics/default.nix @@ -0,0 +1,159 @@ +{ config, pkgs, ... }: { + # grafana configuration + #services.grafana = { + # enable = true; + # domain = "grafana.mossnet.lan"; + # port = 2342; + # addr = "127.0.0.1"; + #}; + # + ## nginx reverse proxy + #services.nginx.virtualHosts.${config.services.grafana.domain} = { + # locations."/" = { + # proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; + # proxyWebsockets = true; + # }; + #}; + + services.prometheus = { + enable = true; + port = 9001; + exporters = { + node = { + enable = true; + enabledCollectors = [ "systemd" ]; + port = 9002; + }; + }; + rules = [ + '' + groups: + - name: synapse + rules: + - record: "synapse_federation_transaction_queue_pendingEdus:total" + expr: "sum(synapse_federation_transaction_queue_pendingEdus or absent(synapse_federation_transaction_queue_pendingEdus)*0)" + - record: "synapse_federation_transaction_queue_pendingPdus:total" + expr: "sum(synapse_federation_transaction_queue_pendingPdus or absent(synapse_federation_transaction_queue_pendingPdus)*0)" + - record: 'synapse_http_server_request_count:method' + labels: + servlet: "" + expr: "sum(synapse_http_server_request_count) by (method)" + - record: 'synapse_http_server_request_count:servlet' + labels: + method: "" + expr: 'sum(synapse_http_server_request_count) by (servlet)' + + - record: 'synapse_http_server_request_count:total' + labels: + servlet: "" + expr: 'sum(synapse_http_server_request_count:by_method) by (servlet)' + + - record: 'synapse_cache:hit_ratio_5m' + expr: 'rate(synapse_util_caches_cache:hits[5m]) / rate(synapse_util_caches_cache:total[5m])' + - record: 'synapse_cache:hit_ratio_30s' + expr: 'rate(synapse_util_caches_cache:hits[30s]) / rate(synapse_util_caches_cache:total[30s])' + + - record: 'synapse_federation_client_sent' + labels: + type: "EDU" + expr: 'synapse_federation_client_sent_edus + 0' + - record: 'synapse_federation_client_sent' + labels: + type: "PDU" + expr: 'synapse_federation_client_sent_pdu_destinations:count + 0' + - record: 'synapse_federation_client_sent' + labels: + type: "Query" + expr: 'sum(synapse_federation_client_sent_queries) by (job)' + + - record: 'synapse_federation_server_received' + labels: + type: "EDU" + expr: 'synapse_federation_server_received_edus + 0' + - record: 'synapse_federation_server_received' + labels: + type: "PDU" + expr: 'synapse_federation_server_received_pdus + 0' + - record: 'synapse_federation_server_received' + labels: + type: "Query" + expr: 'sum(synapse_federation_server_received_queries) by (job)' + + - record: 'synapse_federation_transaction_queue_pending' + labels: + type: "EDU" + expr: 'synapse_federation_transaction_queue_pending_edus + 0' + - record: 'synapse_federation_transaction_queue_pending' + labels: + type: "PDU" + expr: 'synapse_federation_transaction_queue_pending_pdus + 0' + + - record: synapse_storage_events_persisted_by_source_type + expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_type="remote"}) + labels: + type: remote + - record: synapse_storage_events_persisted_by_source_type + expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity="*client*",origin_type="local"}) + labels: + type: local + - record: synapse_storage_events_persisted_by_source_type + expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity!="*client*",origin_type="local"}) + labels: + type: bridges + - record: synapse_storage_events_persisted_by_event_type + expr: sum without(origin_entity, origin_type) (synapse_storage_events_persisted_events_sep) + - record: synapse_storage_events_persisted_by_origin + expr: sum without(type) (synapse_storage_events_persisted_events_sep) + '' + ]; + scrapeConfigs = [ + { + job_name = "helix"; + static_configs = [{ + targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ]; + }]; + } + { + job_name = "synapse"; + metrics_path = "/_synapse/metrics"; + static_configs = [{ + targets = [ "localhost:9090" ]; + }]; + } + { + job_name = "gitea"; + static_configs = [{ + targets = [ "localhost:3001" ]; + }]; + } + ]; + }; + + networking.firewall = { + enable = true; + allowedTCPPorts = [ 9001 ]; + }; + + services.nginx.virtualHosts."sealight.xyz" = { + locations."/metrics" = { + #basicAuth = { anish = "password"; }; + proxyPass = "http://localhost:9001"; + }; + }; + + services.loki = { + enable = true; + configFile = /var/loki-config.yaml; + }; + + systemd.services.promtail = { + description = "Promtail service for Loki"; + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + ExecStart = '' + ${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml} + ''; + }; + }; +} diff --git a/profiles/mossnet-hosts/default.nix b/profiles/mossnet-hosts/default.nix index 37ead7a3..763fa9d6 100644 --- a/profiles/mossnet-hosts/default.nix +++ b/profiles/mossnet-hosts/default.nix @@ -5,6 +5,7 @@ 192.168.1.240 read.mossnet.lan 192.168.1.240 music.mossnet.lan 192.168.1.240 stats.mossnet.lan + 192.168.1.240 file.mossnet.lan ''; # 10.0.69.4 mossnet.lan # 10.0.69.4 links.mossnet.lan diff --git a/profiles/rss-bridge/default.nix b/profiles/rss-bridge/default.nix index 6157d8ae..f84dbe23 100644 --- a/profiles/rss-bridge/default.nix +++ b/profiles/rss-bridge/default.nix @@ -1,14 +1,11 @@ -{pkgs, lib, config, ...}: +{ pkgs, lib, config, ... }: { services.rss-bridge = { enable = true; - virtualHost = "rss.mossnet.lan"; - whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram"]; - #dataDir = "/etc/rss-bridge/"; + virtualHost = "bridge.sealight.xyz"; + whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit" ]; }; - #environment.etc."rss-bridge/config.ini.php" = '' - # [InstagramBridge] - # session_id = %sessionid from step 1% - # cache_timeout = %cache timeout in seconds% - #''; + + services.nginx.virtualHosts."bridge.sealight.xyz".forceSSL = true; + services.nginx.virtualHosts."bridge.sealight.xyz".enableACME = true; } diff --git a/profiles/seafile/default.nix b/profiles/seafile/default.nix index a3bb28ff..13d7e2ae 100644 --- a/profiles/seafile/default.nix +++ b/profiles/seafile/default.nix @@ -7,7 +7,48 @@ fileserver.host = "0.0.0.0"; fileserver.port = 8082; }; - ccnetSettings.General.SERVICE_URL = "file.mossnet.lan"; + ccnetSettings.General.SERVICE_URL = "http://file.mossnet.lan"; + adminEmail = "anish@lakhwara.com"; initialAdminPassword = "arandompasswordsecure!"; }; + + services.nginx = { + enable = true; + }; + services.nginx.upstreams."gunicorn_seafile" = { + servers."unix:/run/seahub/gunicorn.sock" = { }; + }; + services.nginx.upstreams."seafhttp" = { + servers."127.0.0.1:8082" = { }; + }; + services.nginx.virtualHosts."file.mossnet.lan" = { + serverName = "file.mossnet.lan"; + locations."/" = { + proxyPass = "http://gunicorn_seafile"; # without a trailing / + extraConfig = '' + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-Host $server_name; + #proxy_set_header Host $host; + proxy_read_timeout 1200s; + + client_max_body_size 0; # disable max upload size + ''; + }; + locations."/seafhttp" = { + proxyPass = "http://seafhttp"; # without a trailing / + extraConfig = '' + rewrite ^/seafhttp(.*)$ $1 break; + client_max_body_size 0; + + proxy_connect_timeout 36000s; + proxy_read_timeout 36000s; + proxy_send_timeout 36000s; + + proxy_request_buffering off; + send_timeout 36000s; + ''; + }; + }; } diff --git a/profiles/sealight-website/default.nix b/profiles/sealight-website/default.nix new file mode 100644 index 00000000..a079ee61 --- /dev/null +++ b/profiles/sealight-website/default.nix @@ -0,0 +1,14 @@ +{ + services.nginx = { + enable = true; + vhost = { + "sealight.xyz" = { + forceSSL = true; + enableACME = true; + locations."/" = { + root = "/var/www/sealight.xyz" + }; + }; + }; + }; + } diff --git a/profiles/syncthing/default.nix b/profiles/syncthing/default.nix index 5710dea6..142bfdd5 100644 --- a/profiles/syncthing/default.nix +++ b/profiles/syncthing/default.nix @@ -7,8 +7,8 @@ group = "users"; dataDir = "/home/anish/"; configDir = "/home/anish/.config/syncthing"; - guiAddress = "0.0.0.0:8384"; }; networking.firewall.allowedTCPPorts = [ 8384 22000 ]; + networking.firewall.allowedUDPPorts = [ 22000 21027 ]; } diff --git a/profiles/wireguard-server/default.nix b/profiles/wireguard-server/default.nix new file mode 100644 index 00000000..8a5eaffe --- /dev/null +++ b/profiles/wireguard-server/default.nix @@ -0,0 +1,35 @@ +{ config, pkgs, lib, ... }: +{ + environment.systemPackages = [ pkgs.wireguard pkgs.mosh ]; + networking.nat = { + enable = true; + externalInterface = "ens3"; + internalInterfaces = [ "wg0" ]; + }; + networking.firewall = { + allowedUDPPorts = [ 60990 ]; + }; + + networking.wireguard.interfaces.wg0 = { + ips = [ "10.0.69.1/24" ]; + listenPort = 60990; + privateKeyFile = "/var/lib/wireguard/priv"; + peers = [ + { + # box + publicKey = "Ra78mOc110K7URN5uB3m9d78iBKgeRHzT+3HkiFp9BU="; + allowedIPs = [ "10.0.69.4/32" ]; + } + { + # line + publicKey = "fsb1FuGmYi89p4CVXytKw2FYamONKtoanxrgs/dJjC8="; + allowedIPs = [ "10.0.69.3/32" ]; + } + { + # curve + publicKey = "XmV4AcPPND/eeSI6d9M1iahCjtymqY6DdUDEFNP/x3g="; + allowedIPs = [ "10.0.69.2/32" ]; + } + ]; + }; +}