moving helix into profiles
This commit is contained in:
		
							parent
							
								
									4a7e9d536b
								
							
						
					
					
						commit
						7ac844b1f9
					
				|  | @ -1,10 +0,0 @@ | ||||||
| { pkgs, lib, budUtils, ... }: { |  | ||||||
|   bud.cmds = with pkgs; { |  | ||||||
|     get = { |  | ||||||
|       writer = budUtils.writeBashWithPaths [ nixUnstable git coreutils ]; |  | ||||||
|       synopsis = "get [DEST]"; |  | ||||||
|       help = "Copy the desired template to DEST"; |  | ||||||
|       script = ./get.bash; |  | ||||||
|     }; |  | ||||||
|   }; |  | ||||||
| } |  | ||||||
|  | @ -1 +0,0 @@ | ||||||
| nix flake new -t "github:divnix/devos/core" "${2:-devos}" |  | ||||||
							
								
								
									
										12
									
								
								flake.nix
									
									
									
									
									
								
							
							
						
						
									
										12
									
								
								flake.nix
									
									
									
									
									
								
							|  | @ -1,10 +1,6 @@ | ||||||
| { | { | ||||||
|   description = "A highly structured configuration database."; |   description = "A highly structured configuration database."; | ||||||
| 
 | 
 | ||||||
|   nixConfig.extra-experimental-features = "nix-command flakes"; |  | ||||||
|   nixConfig.extra-substituters = "https://nrdxp.cachix.org https://nix-community.cachix.org"; |  | ||||||
|   nixConfig.extra-trusted-public-keys = "nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="; |  | ||||||
| 
 |  | ||||||
|   inputs = |   inputs = | ||||||
|     { |     { | ||||||
|       # Nix |       # Nix | ||||||
|  | @ -126,11 +122,11 @@ | ||||||
|             }; |             }; | ||||||
|             suites = with profiles; rec { |             suites = with profiles; rec { | ||||||
|               base = [ core users.root users.anish ]; |               base = [ core users.root users.anish ]; | ||||||
|               sealight = [ base server ]; # matrix rsshub backup wireguard-server |               sealight = [ base server rss-bridge gitea wireguard-server metrics sealight-website ]; # matrix backup | ||||||
|               mossnet = [ base server taskd shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale seafile syncthing ]; # hpi syncthing sync.music |               mossnet = [ base server taskd shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale seafile syncthing ]; # hpi sync.music | ||||||
|               cube = [ base site server ]; |               cube = [ base site server ]; | ||||||
|               graphical = [ base bluetooth music sync.kitaab sync.website sync.cal wifi desktop ]; # syncthing |               graphical = [ base bluetooth music sync.kitaab sync.website sync.cal wifi desktop ]; | ||||||
|               curve = [ graphical secrets ]; |               curve = [ graphical secrets syncthing ]; | ||||||
|               work = [ base ]; |               work = [ base ]; | ||||||
|             }; |             }; | ||||||
|           }; |           }; | ||||||
|  |  | ||||||
|  | @ -9,6 +9,7 @@ | ||||||
|   }; |   }; | ||||||
| 
 | 
 | ||||||
|   # For some reason this doesn't work in the profile, but does over here?? |   # For some reason this doesn't work in the profile, but does over here?? | ||||||
|  |   # Something weird in the way I'm importing nixpkgs in the profile or something | ||||||
|   services."grasp".enable = true; |   services."grasp".enable = true; | ||||||
|   services."grasp".path = "/home/anish/kitaab/grasp"; |   services."grasp".path = "/home/anish/kitaab/grasp"; | ||||||
|   services."grasp".user = "anish"; |   services."grasp".user = "anish"; | ||||||
|  | @ -28,10 +29,10 @@ | ||||||
|       "/var/www/shaarli-config" # sharli |       "/var/www/shaarli-config" # sharli | ||||||
|       "/var/backup/postgresql" # wallabag |       "/var/backup/postgresql" # wallabag | ||||||
|       "/var/lib/radicale" # radicale |       "/var/lib/radicale" # radicale | ||||||
|       "/home/anish/usr/syncthing" # syncthing |       "/home/anish/usr/drawing" # syncthing | ||||||
|  |       "/home/anish/usr/nonfiction" # syncthing | ||||||
|     ]; |     ]; | ||||||
|     # seafile? |     # seafile | ||||||
|     # syncthing |  | ||||||
|   }; |   }; | ||||||
| 
 | 
 | ||||||
|   age.secrets.box-wg.file = "${self}/secrets/box-wg.age"; |   age.secrets.box-wg.file = "${self}/secrets/box-wg.age"; | ||||||
|  | @ -41,4 +42,5 @@ | ||||||
|     ips = [ "10.0.69.4/24" ]; |     ips = [ "10.0.69.4/24" ]; | ||||||
|     privateKeyFile = "/run/agenix/box-wg"; |     privateKeyFile = "/run/agenix/box-wg"; | ||||||
|   }; |   }; | ||||||
|  |   services.syncthing.guiAddress = "0.0.0.0:8384"; # public syncthing | ||||||
| } | } | ||||||
|  |  | ||||||
							
								
								
									
										37
									
								
								hosts/helix/configuration.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										37
									
								
								hosts/helix/configuration.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,37 @@ | ||||||
|  | { config, pkgs, ... }: | ||||||
|  | { | ||||||
|  |   imports = | ||||||
|  |     [ | ||||||
|  |       # Include the results of the hardware scan. | ||||||
|  |       ./hardware-configuration.nix | ||||||
|  |     ]; | ||||||
|  | 
 | ||||||
|  |   # Use the GRUB 2 boot loader. | ||||||
|  |   boot.loader.grub.enable = true; | ||||||
|  |   boot.loader.grub.version = 2; | ||||||
|  |   boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only | ||||||
|  | 
 | ||||||
|  |   networking.hostName = "helix"; # Define your hostname. | ||||||
|  | 
 | ||||||
|  |   networking.useDHCP = false; | ||||||
|  |   networking.interfaces.ens3.useDHCP = true; | ||||||
|  | 
 | ||||||
|  |   # Configure network proxy if necessary | ||||||
|  |   # networking.proxy.default = "http://user:password@proxy:port/"; | ||||||
|  |   # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; | ||||||
|  | 
 | ||||||
|  |   # Enable the OpenSSH daemon. | ||||||
|  |   services.openssh.enable = true; | ||||||
|  |   services.openssh.passwordAuthentication = false; | ||||||
|  |   services.openssh.permitRootLogin = "no"; | ||||||
|  |   sound.enable = false; | ||||||
|  | 
 | ||||||
|  |   # Define a user account. Don't forget to set a password with ‘passwd’. | ||||||
|  |   # This value determines the NixOS release with which your system is to be | ||||||
|  |   # compatible, in order to avoid breaking some software such as database | ||||||
|  |   # servers. You should change this only after NixOS release notes say you | ||||||
|  |   # should. | ||||||
|  |   system.stateVersion = "19.09"; # Did you read the comment? | ||||||
|  | 
 | ||||||
|  | } | ||||||
|  | 
 | ||||||
							
								
								
									
										23
									
								
								hosts/helix/default.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										23
									
								
								hosts/helix/default.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,23 @@ | ||||||
|  | { self, profiles, suites, ... }: | ||||||
|  | { | ||||||
|  |   imports = [ | ||||||
|  |     ./configuration.nix | ||||||
|  |   ] ++ suites.sealight; | ||||||
|  | 
 | ||||||
|  |   home-manager.users.anish = { self, suites, ... }: { | ||||||
|  |     imports = [ ] ++ suites.hmBase; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   mossnet.backup = { | ||||||
|  |     enable = false; | ||||||
|  |     name = "sealight"; | ||||||
|  |     paths = [ "/var/backup/postgresql" ]; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   age.secrets.borg-password.file = "${self}/secrets/borg-password.age"; | ||||||
|  |   services.postgresqlBackup = { | ||||||
|  |     enable = false; | ||||||
|  |     databases = [ "matrix" "gitea" ]; | ||||||
|  |     location = "/var/backup/postgresql"; | ||||||
|  |   }; | ||||||
|  | } | ||||||
|  | @ -5,7 +5,8 @@ | ||||||
| 
 | 
 | ||||||
| { | { | ||||||
|   imports = |   imports = | ||||||
|     [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> |     [ | ||||||
|  |       <nixpkgs/nixos/modules/profiles/qemu-guest.nix> | ||||||
|     ]; |     ]; | ||||||
| 
 | 
 | ||||||
|   boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ]; |   boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ]; | ||||||
|  | @ -14,7 +15,8 @@ | ||||||
|   boot.extraModulePackages = [ ]; |   boot.extraModulePackages = [ ]; | ||||||
| 
 | 
 | ||||||
|   fileSystems."/" = |   fileSystems."/" = | ||||||
|     { device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6"; |     { | ||||||
|  |       device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6"; | ||||||
|       fsType = "btrfs"; |       fsType = "btrfs"; | ||||||
|     }; |     }; | ||||||
| 
 | 
 | ||||||
|  | @ -44,7 +44,8 @@ | ||||||
|     recommendedOptimisation = true; |     recommendedOptimisation = true; | ||||||
|     recommendedProxySettings = true; |     recommendedProxySettings = true; | ||||||
|     recommendedTlsSettings = true; |     recommendedTlsSettings = true; | ||||||
|    virtualHosts."git.sealight.xyz" = {                  # Gitea hostname |     virtualHosts."git.sealight.xyz" = { | ||||||
|  |       # Gitea hostname | ||||||
|       enableACME = true; # Use ACME certs |       enableACME = true; # Use ACME certs | ||||||
|       forceSSL = true; # Force SSL |       forceSSL = true; # Force SSL | ||||||
|       locations."/".proxyPass = "http://localhost:3001/"; # Proxy Gitea |       locations."/".proxyPass = "http://localhost:3001/"; # Proxy Gitea | ||||||
|  | @ -1,60 +0,0 @@ | ||||||
| { config, pkgs, ... }: |  | ||||||
| { |  | ||||||
|   imports = |  | ||||||
|     [ # Include the results of the hardware scan. |  | ||||||
|       ./hardware-configuration.nix |  | ||||||
|       ./wireguard.nix |  | ||||||
|       ./matrix.nix |  | ||||||
|       ./monitoring.nix |  | ||||||
|       ./rss-bridge.nix |  | ||||||
|       ./gitea.nix |  | ||||||
|       # ./dns.nix |  | ||||||
|       "${builtins.fetchTarball "https://github.com/ryantm/agenix/archive/main.tar.gz"}/modules/age.nix" |  | ||||||
|     ]; |  | ||||||
| 
 |  | ||||||
|   # Use the GRUB 2 boot loader. |  | ||||||
|   boot.loader.grub.enable = true; |  | ||||||
|   boot.loader.grub.version = 2; |  | ||||||
|   boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only |  | ||||||
| 
 |  | ||||||
|   networking.hostName = "helix"; # Define your hostname. |  | ||||||
| 
 |  | ||||||
|   networking.useDHCP = false; |  | ||||||
|   networking.interfaces.ens3.useDHCP = true; |  | ||||||
| 
 |  | ||||||
|   # Configure network proxy if necessary |  | ||||||
|   # networking.proxy.default = "http://user:password@proxy:port/"; |  | ||||||
|   # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; |  | ||||||
| 
 |  | ||||||
|   # Enable the OpenSSH daemon. |  | ||||||
|   services.openssh.enable = true; |  | ||||||
|   services.openssh.passwordAuthentication = false; |  | ||||||
|   services.openssh.permitRootLogin = "no"; |  | ||||||
| 
 |  | ||||||
|   # Open ports in the firewall. |  | ||||||
|   # networking.firewall.allowedTCPPorts = [ ... ]; |  | ||||||
|   # networking.firewall.allowedUDPPorts = [ ... ]; |  | ||||||
|   # Or disable the firewall altogether. |  | ||||||
|   # networking.firewall.enable = false; |  | ||||||
| 
 |  | ||||||
|   # Include agenix |  | ||||||
|   #environment.systemPackages = [ agenix.defaultPackage.x86_64-linux ]; |  | ||||||
| 
 |  | ||||||
|   # Define a user account. Don't forget to set a password with ‘passwd’. |  | ||||||
|   users.users.anish = { |  | ||||||
|     isNormalUser = true; |  | ||||||
|     extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user |  | ||||||
|     openssh.authorizedKeys.keys = [ |  | ||||||
| 	"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve"   |  | ||||||
| 	"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCeWQsf9rbE+KBrWLkLkg1PMKx0jPfDP8xyv+XtddIQzAskRTN+JSSQp1GpoRgfQij7bx6f6DfjkwSQK5NWDQNQ+klGhcdEwEdptWUzpRAvKHMImjyIwFHmRKKEgcfH8+DSHVM93nRSQKrLezX4PzPkHF9f3TLxFdGeQDeY0J2oP2Oa97hRtuTJZW9BwUojyvDYUbg7F3fxf+pdFCvIAFaayiLkhOYdTXnjLt1Ks6NOhSzM78ZibHv4pFYI9r6dhflkFP/SzyLeSSm1aVAtxqE7vF5HnnORAg0byDsiOv/9RXxiDx7gkAAw3xENDSpp9TRj54M7iz1OSsRMhmD6orHjZFIRejlE4DIn+PBPm3PH+U5ILKTogE6n5MfPT28V0QdtHuqq3b5tSWiDcFpnjxbIUmEIo5hLzMR0tXZoNLQhBCSNfxjE8CYzpk7mHbvhSs2GPfG+NI1vvldbw2EF8beJFQHNYTqJw8y7p8RXpCwZqqpSitJX6v9DiYdLVG1hWvE= nix-on-droid@localhost" |  | ||||||
| 	 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box" ]; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   # This value determines the NixOS release with which your system is to be |  | ||||||
|   # compatible, in order to avoid breaking some software such as database |  | ||||||
|   # servers. You should change this only after NixOS release notes say you |  | ||||||
|   # should. |  | ||||||
|   system.stateVersion = "19.09"; # Did you read the comment? |  | ||||||
| 
 |  | ||||||
| } |  | ||||||
| 
 |  | ||||||
|  | @ -1,375 +0,0 @@ | ||||||
| { config, lib, pkgs, ... }: |  | ||||||
| 
 |  | ||||||
| { |  | ||||||
|   imports = [  |  | ||||||
| 	#./mod-mx-puppet-slack.nix  |  | ||||||
| 	./mautrix-whatsapp.nix  |  | ||||||
| 	./mod-heisenbridge.nix |  | ||||||
|   ]; |  | ||||||
|   security.acme.email = "anish+acme@lakhwara.com"; |  | ||||||
|   security.acme.acceptTerms = true; |  | ||||||
|   services.matrix-synapse = { |  | ||||||
|     enable = true; |  | ||||||
|     app_service_config_files = [ |  | ||||||
|     #  # The registration file is automatically generated after starting the appservice for the first time. |  | ||||||
|     #  # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/ |  | ||||||
|     #  # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml |  | ||||||
|        "/var/lib/matrix-synapse/discord-registration.yaml" |  | ||||||
|        "/var/lib/matrix-synapse/telegram-registration.yaml" |  | ||||||
|        #"/var/lib/matrix-synapse/slack-registration.yaml" |  | ||||||
|        #"/var/lib/matrix-synapse/whatsapp-registration.yaml" |  | ||||||
|     ]; |  | ||||||
|     server_name = "sealight.xyz"; |  | ||||||
|     registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; |  | ||||||
|     enable_metrics = true; |  | ||||||
|     enable_registration = true; |  | ||||||
|     database_type = "psycopg2"; |  | ||||||
|     database_args = { |  | ||||||
|       database = "matrix-synapse"; |  | ||||||
|     }; |  | ||||||
| 
 |  | ||||||
|     listeners = [ |  | ||||||
|       { |  | ||||||
|         port = 8448; |  | ||||||
|         tls = false; |  | ||||||
|         resources = [{ |  | ||||||
|             compress = true; |  | ||||||
|             names = ["client" "federation"]; |  | ||||||
|           }]; |  | ||||||
|       } |  | ||||||
|       { |  | ||||||
| 	port = 9090; |  | ||||||
| 	type = "metrics"; |  | ||||||
| 	bind_address = "0.0.0.0"; |  | ||||||
| 	resources = [{  |  | ||||||
| 	  compress = false; |  | ||||||
| 	  names = []; |  | ||||||
| 	}]; |  | ||||||
| 	tls = false; |  | ||||||
|       } |  | ||||||
|     ]; |  | ||||||
|     extraConfig = '' |  | ||||||
|       max_upload_size: "50M" |  | ||||||
|       use_presence: false |  | ||||||
|     ''; |  | ||||||
|     ## coturn based TURN server integration (TURN server setup mentioned later), |  | ||||||
|     ## shared secret generated while configuring coturn |  | ||||||
|     ## and reused here (power of Nix being a real programming language) |  | ||||||
|     turn_uris = [ |  | ||||||
|       "turn:turn.sealight.xyz:3478?transport=udp" |  | ||||||
|       "turn:turn.sealight.xyz:3478?transport=tcp" |  | ||||||
|     ]; |  | ||||||
|     turn_shared_secret = config.services.coturn.static-auth-secret; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
| 
 |  | ||||||
|   services.coturn = { |  | ||||||
|     enable = true; |  | ||||||
|     use-auth-secret = true; |  | ||||||
|     static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ"; |  | ||||||
|     realm = "turn.sealight.xyz"; |  | ||||||
|     min-port = 49111; |  | ||||||
|     max-port = 51111; |  | ||||||
|     no-cli = true; |  | ||||||
|     no-tcp-relay = true; |  | ||||||
|     no-tls = true; |  | ||||||
|     cert = "${config.security.acme.certs."turn.sealight.xyz".directory}/full.pem"; |  | ||||||
|     pkey = "${config.security.acme.certs."turn.sealight.xyz".directory}/key.pem"; |  | ||||||
|     extraConfig = '' |  | ||||||
| 	verbose |  | ||||||
|         user-quota=12 |  | ||||||
|         total-quota=1200 |  | ||||||
|         denied-peer-ip=10.0.0.0-10.255.255.255 |  | ||||||
|         denied-peer-ip=192.168.0.0-192.168.255.255 |  | ||||||
|         denied-peer-ip=172.16.0.0-172.31.255.255 |  | ||||||
| 	denied-peer-ip=0.0.0.0-0.255.255.255 |  | ||||||
| 	denied-peer-ip=100.64.0.0-100.127.255.255 |  | ||||||
| 	denied-peer-ip=127.0.0.0-127.255.255.255 |  | ||||||
| 	denied-peer-ip=169.254.0.0-169.254.255.255 |  | ||||||
| 	denied-peer-ip=192.0.0.0-192.0.0.255 |  | ||||||
| 	denied-peer-ip=192.0.2.0-192.0.2.255 |  | ||||||
| 	denied-peer-ip=192.88.99.0-192.88.99.255 |  | ||||||
| 	denied-peer-ip=198.18.0.0-198.19.255.255 |  | ||||||
| 	denied-peer-ip=198.51.100.0-198.51.100.255 |  | ||||||
| 	denied-peer-ip=203.0.113.0-203.0.113.255 |  | ||||||
| 	denied-peer-ip=240.0.0.0-255.255.255.255 |  | ||||||
|     ''; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   security.acme.certs.${config.services.coturn.realm} = { |  | ||||||
|     /* insert here the right configuration to obtain a certificate */ |  | ||||||
|     webroot = "/var/lib/acme/acme-challenge/"; |  | ||||||
|     email = "anish+acme@lakhwara.com"; |  | ||||||
|     postRun = "systemctl restart coturn.service"; |  | ||||||
|     group = "turnserver"; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   services.jitsi-meet = { |  | ||||||
|     enable = true; |  | ||||||
|     hostName = "jitsi.sealight.xyz"; |  | ||||||
|   }; |  | ||||||
|   services.jitsi-videobridge.enable = true; |  | ||||||
| 
 |  | ||||||
|   services.mautrix-telegram = { |  | ||||||
|     enable = true; |  | ||||||
|     environmentFile = /etc/secrets/telegram.env; # file containing the appservice and telegram tokens |  | ||||||
|     # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. |  | ||||||
|     settings = { |  | ||||||
|       homeserver = { |  | ||||||
|         address = "https://sealight.xyz"; |  | ||||||
|         domain = "sealight.xyz"; |  | ||||||
|       }; |  | ||||||
|       appservice = { |  | ||||||
|         provisioning.enabled = false; |  | ||||||
|         id = "telegram"; |  | ||||||
| 	bot_username = "telegrambridge"; |  | ||||||
|         public = { |  | ||||||
|           enabled = false; |  | ||||||
|           prefix = "/public"; |  | ||||||
|           external = "https://chat.sealight.xyz/public"; |  | ||||||
|         }; |  | ||||||
| 	address = "http://localhost:18787"; |  | ||||||
| 	port = 18787; |  | ||||||
|         # The service uses SQLite by default, but it's also possible to use PostgreSQL instead: |  | ||||||
|         #database = "postgresql:///mautrix-telegram?host=/run/postgresql"; |  | ||||||
|       }; |  | ||||||
|       bridge = { |  | ||||||
|         relaybot.authless_portals = false; |  | ||||||
|         permissions = { |  | ||||||
|           "@aynish:sealight.xyz" = "admin"; |  | ||||||
|         }; |  | ||||||
|       }; |  | ||||||
|     }; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   services.mautrix-whatsapp = { |  | ||||||
|     enable = false; |  | ||||||
|     # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. |  | ||||||
|     #configOptions = { |  | ||||||
|     #  homeserver = { |  | ||||||
|     #    address = "https://chat.sealight.xyz"; |  | ||||||
|     #    domain = "sealight.xyz"; |  | ||||||
|     #  }; |  | ||||||
|     #  appservice = { |  | ||||||
|     #    id = "whatsapp"; |  | ||||||
|     #    address = http://localhost:9897; |  | ||||||
|     #    hostname = "0.0.0.0"; |  | ||||||
|     #    port = 9897; |  | ||||||
|     #    database = { |  | ||||||
|     #      type = "sqlite3"; |  | ||||||
|     #      uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db"; |  | ||||||
|     #    }; |  | ||||||
|     #    state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json"; |  | ||||||
|     #    bot = { |  | ||||||
|     #      username = "whatsappbot"; |  | ||||||
|     #      displayname = "WhatsApp bridge bot"; |  | ||||||
|     #      avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr"; |  | ||||||
|     #    }; |  | ||||||
|     #    as_token = ""; |  | ||||||
|     #    hs_token = ""; |  | ||||||
|     #  }; |  | ||||||
|     #  bridge = { |  | ||||||
|     #    username_template = "whatsapp_{{.}}"; |  | ||||||
|     #    displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)"; |  | ||||||
|     #    command_prefix = "!wa"; |  | ||||||
|     #    permissions = { |  | ||||||
|     #    	"@aynish:sealight.xyz" = 100; |  | ||||||
|     #    }; |  | ||||||
|     #  }; |  | ||||||
|     #  logging = { |  | ||||||
|     #    directory = "/var/lib/mautrix-whatsapp/logs"; |  | ||||||
|     #    file_name_format = "{{.Date}}-{{.Index}}.log"; |  | ||||||
|     #    file_date_format = "\"2006-01-02\""; |  | ||||||
|     #    file_mode = 384; |  | ||||||
|     #    timestamp_format = "Jan _2, 2006 15:04:05"; |  | ||||||
|     #    print_level = "debug"; |  | ||||||
|     #  }; |  | ||||||
|     #  metrics = { |  | ||||||
|     #    enabled = true; |  | ||||||
|     #    listen  = "http://localhost:5070"; |  | ||||||
|     #  }; |  | ||||||
|     #}; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   services.mx-puppet-discord = { |  | ||||||
|     enable = true; |  | ||||||
|     settings = { |  | ||||||
|       bridge = {  |  | ||||||
| 	bindAddress = "localhost"; |  | ||||||
| 	port = 16785; |  | ||||||
|  	domain = "sealight.xyz"; |  | ||||||
|  	homeserverUrl = "https://sealight.xyz"; |  | ||||||
| 	avatarUrl = "https://discord.com/assets/2d20a45d79110dc5bf947137e9d99b66.svg"; |  | ||||||
|       }; |  | ||||||
|       provisioning = { |  | ||||||
| 	whitelist = [ "@aynish:sealight.xyz" ]; |  | ||||||
|       }; |  | ||||||
|       relay = { |  | ||||||
| 	whitelist = [ "@aynish:sealight.xyz" ]; |  | ||||||
|       }; |  | ||||||
|       namePatterns = { |  | ||||||
|         group = ":name"; |  | ||||||
|         room = ":name"; |  | ||||||
|         user = ":name (Discord)"; |  | ||||||
|         userOverride = ":displayname"; |  | ||||||
|       }; |  | ||||||
|       presence = { |  | ||||||
|         enabled = false; |  | ||||||
|       }; |  | ||||||
|     }; |  | ||||||
|     serviceDependencies = ["matrix-synapse.service"]; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   #services.mx-puppet-slack= { |  | ||||||
|     #enable = false; |  | ||||||
|     #settings = { |  | ||||||
|     #  bridge = {  |  | ||||||
|     #    bindAddress = "localhost"; |  | ||||||
|     #    port = 16786; |  | ||||||
|     #    domain = "sealight.xyz"; |  | ||||||
|     #    homeserverUrl = "https://sealight.xyz"; |  | ||||||
|     #  }; |  | ||||||
|     #  provisioning = { |  | ||||||
|     #    whitelist = [ "@aynish:sealight.xyz" ]; |  | ||||||
|     #  }; |  | ||||||
|     #  relay = { |  | ||||||
|     #    whitelist = [ "@aynish:sealight.xyz" ]; |  | ||||||
|     #  }; |  | ||||||
|     #  namePatterns = { |  | ||||||
|     #    group = ":name"; |  | ||||||
|     #    room = ":name[:team? - :team,]"; |  | ||||||
|     #    user = ":name (Slack)"; |  | ||||||
|     #    userOverride = ":displayname"; |  | ||||||
|     #  }; |  | ||||||
|     #  presence = { |  | ||||||
|     #    enabled = false; |  | ||||||
|     #  }; |  | ||||||
|     #  oauth = { |  | ||||||
|     #    enabled = false; |  | ||||||
|     #  }; |  | ||||||
|     #}; |  | ||||||
|     #serviceDependencies = ["matrix-synapse.service"]; |  | ||||||
|   #}; |  | ||||||
| 
 |  | ||||||
|   services.heisenbridge = { |  | ||||||
|     enable = true; |  | ||||||
|     homeserver = "https://sealight.xyz"; |  | ||||||
|     listenPort = 14456; |  | ||||||
|     appServiceToken = "wyujLh8kjpmk2bfKeEE3sZ2gWOEUBKK5";  |  | ||||||
|     homeserverToken = "yEHs7lthD2ZHUibJOAv1APaFhEjxN5PT"; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   services.postgresql = { |  | ||||||
|     enable = true; |  | ||||||
|     ## postgresql user and db name remains in the |  | ||||||
|     ## service.matrix-synapse.database_args setting which |  | ||||||
|     ## by default is matrix-synapse |  | ||||||
|     initialScript = pkgs.writeText "synapse-init.sql" '' |  | ||||||
|         CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|'kq@iBwlIzu"; |  | ||||||
|         CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse" |  | ||||||
|             TEMPLATE template0 |  | ||||||
|             LC_COLLATE = "C" |  | ||||||
|             LC_CTYPE = "C"; |  | ||||||
|         ''; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   networking.firewall = let |  | ||||||
|   range = with config.services.coturn; [ { |  | ||||||
|       from = min-port; |  | ||||||
|       to = max-port; |  | ||||||
|     } ];  |  | ||||||
|     in { |  | ||||||
|     enable = true; |  | ||||||
|     allowedUDPPortRanges = range; # coturn |  | ||||||
|     allowedTCPPortRanges = range; |  | ||||||
|     allowedTCPPorts = [ |  | ||||||
|       22    # SSH |  | ||||||
|       8448  # Matrix federation |  | ||||||
|       8008 |  | ||||||
|       80  |  | ||||||
|       443 |  | ||||||
|       3478 # Coturn service |  | ||||||
|       5349 # Coturn service |  | ||||||
|       9090 # Synapse Metrics |  | ||||||
|     ]; |  | ||||||
|     allowedUDPPorts = [  |  | ||||||
|       3478 |  | ||||||
|       5349 # Coturn service |  | ||||||
|     ]; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|  nixpkgs.overlays = [ |  | ||||||
|     (self: super: { |  | ||||||
|         element-web = super.element-web.override { |  | ||||||
|             conf = { |  | ||||||
|                  default_server_config = { |  | ||||||
|                     "m.homeserver" = { |  | ||||||
|                         "base_url" = "https://chat.sealight.xyz"; |  | ||||||
|                         "server_name" = "sealight.xyz"; |  | ||||||
|                     }; |  | ||||||
|                     "m.identity_server" = { |  | ||||||
|                         "base_url" = "https://vector.im"; |  | ||||||
|                     }; |  | ||||||
|                  }; |  | ||||||
| 
 |  | ||||||
|                  ## jitsi will be setup later, |  | ||||||
|                  ## but we need to add to Riot configuration |  | ||||||
|                  jitsi.preferredDomain = "jitsi.sealight.xyz"; |  | ||||||
|             }; |  | ||||||
|         }; |  | ||||||
|     }) |  | ||||||
|   ]; |  | ||||||
| 
 |  | ||||||
|   services.nginx = { |  | ||||||
|    enable = true; |  | ||||||
|    virtualHosts = { |  | ||||||
| 
 |  | ||||||
|      "sealight.xyz" = { |  | ||||||
|        forceSSL = true; |  | ||||||
|        enableACME = true; |  | ||||||
|        locations."/" = { |  | ||||||
|          root = "/var/www/sealight.xyz"; |  | ||||||
|        }; |  | ||||||
|        locations."/_matrix" = { |  | ||||||
|          proxyPass = "http://localhost:8448"; |  | ||||||
|        }; |  | ||||||
|        locations."/slackbridge" = { |  | ||||||
|          proxyPass = "http://localhost:9899"; |  | ||||||
|        }; |  | ||||||
|      }; |  | ||||||
| 
 |  | ||||||
|      ## virtual host for Synapse |  | ||||||
|      "chat.sealight.xyz" = { |  | ||||||
|        forceSSL = true; |  | ||||||
|        enableACME = true; |  | ||||||
|        #useACMEHost = "sealight.xyz"; |  | ||||||
|        locations."/" = { |  | ||||||
|          proxyPass = "http://localhost:8448"; |  | ||||||
|        }; |  | ||||||
|      }; |  | ||||||
| 
 |  | ||||||
|      ## virtual host for Riot/Web |  | ||||||
|      "element.sealight.xyz" = { |  | ||||||
|        forceSSL = true; |  | ||||||
|        enableACME = true; |  | ||||||
|        #useACMEHost = "sealight.xyz"; |  | ||||||
| 
 |  | ||||||
|        ## root points to the riot-web package content, also configured via Nix |  | ||||||
|        locations."/" = { |  | ||||||
|            root = pkgs.element-web; |  | ||||||
|        }; |  | ||||||
|      }; |  | ||||||
|   |  | ||||||
|      ${config.services.jitsi-meet.hostName} = { |  | ||||||
|        enableACME = true; |  | ||||||
|        forceSSL = true; |  | ||||||
|      }; |  | ||||||
|    }; |  | ||||||
|    ## other nginx specific best practices |  | ||||||
|    recommendedGzipSettings = true; |  | ||||||
|    recommendedOptimisation = true; |  | ||||||
|    recommendedTlsSettings = true; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   environment.systemPackages = with pkgs; [ matrix-appservice-slack ]; |  | ||||||
| } |  | ||||||
|  | @ -1,159 +0,0 @@ | ||||||
| { config, pkgs, ... }: { |  | ||||||
|   # grafana configuration |  | ||||||
|   #services.grafana = { |  | ||||||
|   #  enable = true; |  | ||||||
|   #  domain = "grafana.mossnet.lan"; |  | ||||||
|   #  port = 2342; |  | ||||||
|   #  addr = "127.0.0.1"; |  | ||||||
|   #}; |  | ||||||
|   # |  | ||||||
|   ## nginx reverse proxy |  | ||||||
|   #services.nginx.virtualHosts.${config.services.grafana.domain} = { |  | ||||||
|   #  locations."/" = { |  | ||||||
|   #      proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; |  | ||||||
|   #      proxyWebsockets = true; |  | ||||||
|   #  }; |  | ||||||
|   #}; |  | ||||||
| 
 |  | ||||||
|   services.prometheus = { |  | ||||||
|     enable = true; |  | ||||||
|     port = 9001; |  | ||||||
|     exporters = { |  | ||||||
|       node = { |  | ||||||
| 	enable = true; |  | ||||||
| 	enabledCollectors = [ "systemd" ]; |  | ||||||
| 	port = 9002; |  | ||||||
|       }; |  | ||||||
|     }; |  | ||||||
|     rules = [ |  | ||||||
|       '' |  | ||||||
| groups: |  | ||||||
| - name: synapse |  | ||||||
|   rules: |  | ||||||
|   - record: "synapse_federation_transaction_queue_pendingEdus:total" |  | ||||||
|     expr: "sum(synapse_federation_transaction_queue_pendingEdus or absent(synapse_federation_transaction_queue_pendingEdus)*0)" |  | ||||||
|   - record: "synapse_federation_transaction_queue_pendingPdus:total" |  | ||||||
|     expr:   "sum(synapse_federation_transaction_queue_pendingPdus or absent(synapse_federation_transaction_queue_pendingPdus)*0)" |  | ||||||
|   - record: 'synapse_http_server_request_count:method' |  | ||||||
|     labels: |  | ||||||
|       servlet: "" |  | ||||||
|     expr: "sum(synapse_http_server_request_count) by (method)" |  | ||||||
|   - record: 'synapse_http_server_request_count:servlet' |  | ||||||
|     labels: |  | ||||||
|       method: "" |  | ||||||
|     expr: 'sum(synapse_http_server_request_count) by (servlet)' |  | ||||||
| 
 |  | ||||||
|   - record: 'synapse_http_server_request_count:total' |  | ||||||
|     labels: |  | ||||||
|       servlet: "" |  | ||||||
|     expr: 'sum(synapse_http_server_request_count:by_method) by (servlet)' |  | ||||||
| 
 |  | ||||||
|   - record: 'synapse_cache:hit_ratio_5m' |  | ||||||
|     expr: 'rate(synapse_util_caches_cache:hits[5m]) / rate(synapse_util_caches_cache:total[5m])' |  | ||||||
|   - record: 'synapse_cache:hit_ratio_30s' |  | ||||||
|     expr: 'rate(synapse_util_caches_cache:hits[30s]) / rate(synapse_util_caches_cache:total[30s])' |  | ||||||
| 
 |  | ||||||
|   - record: 'synapse_federation_client_sent' |  | ||||||
|     labels: |  | ||||||
|       type: "EDU" |  | ||||||
|     expr: 'synapse_federation_client_sent_edus + 0' |  | ||||||
|   - record: 'synapse_federation_client_sent' |  | ||||||
|     labels: |  | ||||||
|       type: "PDU" |  | ||||||
|     expr: 'synapse_federation_client_sent_pdu_destinations:count + 0' |  | ||||||
|   - record: 'synapse_federation_client_sent' |  | ||||||
|     labels: |  | ||||||
|       type: "Query" |  | ||||||
|     expr: 'sum(synapse_federation_client_sent_queries) by (job)' |  | ||||||
| 
 |  | ||||||
|   - record: 'synapse_federation_server_received' |  | ||||||
|     labels: |  | ||||||
|       type: "EDU" |  | ||||||
|     expr: 'synapse_federation_server_received_edus + 0' |  | ||||||
|   - record: 'synapse_federation_server_received' |  | ||||||
|     labels: |  | ||||||
|       type: "PDU" |  | ||||||
|     expr: 'synapse_federation_server_received_pdus + 0' |  | ||||||
|   - record: 'synapse_federation_server_received' |  | ||||||
|     labels: |  | ||||||
|       type: "Query" |  | ||||||
|     expr: 'sum(synapse_federation_server_received_queries) by (job)' |  | ||||||
| 
 |  | ||||||
|   - record: 'synapse_federation_transaction_queue_pending' |  | ||||||
|     labels: |  | ||||||
|       type: "EDU" |  | ||||||
|     expr: 'synapse_federation_transaction_queue_pending_edus + 0' |  | ||||||
|   - record: 'synapse_federation_transaction_queue_pending' |  | ||||||
|     labels: |  | ||||||
|       type: "PDU" |  | ||||||
|     expr: 'synapse_federation_transaction_queue_pending_pdus + 0' |  | ||||||
| 
 |  | ||||||
|   - record: synapse_storage_events_persisted_by_source_type |  | ||||||
|     expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_type="remote"}) |  | ||||||
|     labels: |  | ||||||
|       type: remote |  | ||||||
|   - record: synapse_storage_events_persisted_by_source_type |  | ||||||
|     expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity="*client*",origin_type="local"}) |  | ||||||
|     labels: |  | ||||||
|       type: local |  | ||||||
|   - record: synapse_storage_events_persisted_by_source_type |  | ||||||
|     expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity!="*client*",origin_type="local"}) |  | ||||||
|     labels: |  | ||||||
|       type: bridges |  | ||||||
|   - record: synapse_storage_events_persisted_by_event_type |  | ||||||
|     expr: sum without(origin_entity, origin_type) (synapse_storage_events_persisted_events_sep) |  | ||||||
|   - record: synapse_storage_events_persisted_by_origin |  | ||||||
|     expr: sum without(type) (synapse_storage_events_persisted_events_sep) |  | ||||||
|       '' |  | ||||||
|     ]; |  | ||||||
|     scrapeConfigs = [ |  | ||||||
|       { |  | ||||||
| 	job_name = "helix"; |  | ||||||
| 	static_configs = [{ |  | ||||||
| 	  targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ]; |  | ||||||
| 	}]; |  | ||||||
|       } |  | ||||||
|       { |  | ||||||
| 	job_name = "synapse"; |  | ||||||
| 	metrics_path = "/_synapse/metrics"; |  | ||||||
| 	static_configs = [{ |  | ||||||
| 	  targets = [ "localhost:9090" ]; |  | ||||||
|       }]; |  | ||||||
|       } |  | ||||||
|       { |  | ||||||
|         job_name = "gitea"; |  | ||||||
|         static_configs = [{ |  | ||||||
|           targets = [ "localhost:3001" ]; |  | ||||||
|         }]; |  | ||||||
|       } |  | ||||||
|     ]; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   networking.firewall = { |  | ||||||
|     enable = true; |  | ||||||
|     allowedTCPPorts = [ 9001 ]; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   services.nginx.virtualHosts."sealight.xyz" = { |  | ||||||
|     locations."/metrics" = { |  | ||||||
|       #basicAuth = { anish = "password"; }; |  | ||||||
|       proxyPass = "http://localhost:9001"; |  | ||||||
|     }; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   services.loki = { |  | ||||||
|     enable = true; |  | ||||||
|     configFile = /var/loki-config.yaml; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   systemd.services.promtail = { |  | ||||||
|     description = "Promtail service for Loki"; |  | ||||||
|     wantedBy = [ "multi-user.target" ]; |  | ||||||
| 
 |  | ||||||
|     serviceConfig = { |  | ||||||
|       ExecStart = '' |  | ||||||
|         ${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml} |  | ||||||
|       ''; |  | ||||||
|     }; |  | ||||||
|   }; |  | ||||||
| } |  | ||||||
|  | @ -1,11 +0,0 @@ | ||||||
| {pkgs, lib, config, ...}: |  | ||||||
| { |  | ||||||
|   services.rss-bridge = { |  | ||||||
|     enable = true; |  | ||||||
|     virtualHost = "bridge.sealight.xyz"; |  | ||||||
|     whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit"]; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   services.nginx.virtualHosts."bridge.sealight.xyz".forceSSL = true; |  | ||||||
|   services.nginx.virtualHosts."bridge.sealight.xyz".enableACME = true; |  | ||||||
| } |  | ||||||
|  | @ -1,14 +0,0 @@ | ||||||
| { |  | ||||||
|    services.nginx = { |  | ||||||
|       enable = true; |  | ||||||
|       vhost = {  |  | ||||||
| 	  "sealight.xyz" = { |  | ||||||
| 		  forceSSL = true; |  | ||||||
| 		  enableACME = true; |  | ||||||
| 		  locations."/" = { |  | ||||||
| 		    root = "/var/www/sealight.xyz" |  | ||||||
| 		  }; |  | ||||||
|       }; |  | ||||||
|     }; |  | ||||||
|    }; |  | ||||||
| } |  | ||||||
|  | @ -1,32 +0,0 @@ | ||||||
| { config, pkgs, lib, ... }: |  | ||||||
| {  |  | ||||||
|   environment.systemPackages = [ pkgs.wireguard pkgs.mosh ]; |  | ||||||
|   networking.nat = { |  | ||||||
|       enable = true; |  | ||||||
|       externalInterface = "ens3"; |  | ||||||
|       internalInterfaces = [ "wg0" ]; |  | ||||||
|   }; |  | ||||||
|   networking.firewall = { |  | ||||||
|     allowedUDPPorts = [ 60990 ]; |  | ||||||
|   }; |  | ||||||
| 
 |  | ||||||
|   networking.wireguard.interfaces.wg0 = { |  | ||||||
|     ips = [ "10.0.69.1/24" ]; |  | ||||||
|     listenPort = 60990; |  | ||||||
|     privateKeyFile = "/var/lib/wireguard/priv"; |  | ||||||
|     peers = [ |  | ||||||
|     { # box |  | ||||||
|       publicKey = "Ra78mOc110K7URN5uB3m9d78iBKgeRHzT+3HkiFp9BU="; |  | ||||||
|       allowedIPs = [ "10.0.69.4/32" ]; |  | ||||||
|     } |  | ||||||
|     { # line |  | ||||||
|       publicKey = "fsb1FuGmYi89p4CVXytKw2FYamONKtoanxrgs/dJjC8="; |  | ||||||
|       allowedIPs = [ "10.0.69.3/32" ]; |  | ||||||
|     } |  | ||||||
|     { # curve |  | ||||||
|       publicKey = "XmV4AcPPND/eeSI6d9M1iahCjtymqY6DdUDEFNP/x3g="; |  | ||||||
|       allowedIPs = [ "10.0.69.2/32" ]; |  | ||||||
|     } |  | ||||||
| ]; |  | ||||||
|   }; |  | ||||||
| } |  | ||||||
|  | @ -1,3 +1,5 @@ | ||||||
|  | { config, lib, pkgs, ... }: | ||||||
|  | 
 | ||||||
| { | { | ||||||
|   security.acme.email = "anish+acme@lakhwara.com"; |   security.acme.email = "anish+acme@lakhwara.com"; | ||||||
|   security.acme.acceptTerms = true; |   security.acme.acceptTerms = true; | ||||||
|  | @ -7,32 +9,19 @@ | ||||||
|       #  # The registration file is automatically generated after starting the appservice for the first time. |       #  # The registration file is automatically generated after starting the appservice for the first time. | ||||||
|       #  # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/ |       #  # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/ | ||||||
|       #  # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml |       #  # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml | ||||||
|     #   "/var/lib/matrix-synapse/discord-registration.yaml" |       "/var/lib/matrix-synapse/discord-registration.yaml" | ||||||
|     #   "/var/lib/matrix-synapse/telegram-registration.yaml" |       "/var/lib/matrix-synapse/telegram-registration.yaml" | ||||||
|       #"/var/lib/matrix-synapse/slack-registration.yaml" |       #"/var/lib/matrix-synapse/slack-registration.yaml" | ||||||
|     #  # "/var/lib/matrix-synapse/whatsapp-registration.yaml" |       #"/var/lib/matrix-synapse/whatsapp-registration.yaml" | ||||||
|     ]; |     ]; | ||||||
|     server_name = "sealight.xyz"; |     server_name = "sealight.xyz"; | ||||||
|     registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; # TODO use agnix |     registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; | ||||||
|     enable_metrics = true; |     enable_metrics = true; | ||||||
|     enable_registration = true; |     enable_registration = true; | ||||||
|     database_type = "psycopg2"; |     database_type = "psycopg2"; | ||||||
|     database_args = { |     database_args = { | ||||||
|       database = "matrix-synapse"; |       database = "matrix-synapse"; | ||||||
|     }; |     }; | ||||||
|     extraConfig = '' |  | ||||||
|       max_upload_size: "50M" |  | ||||||
|       use_presence: false |  | ||||||
|     ''; |  | ||||||
|     ## coturn based TURN server integration (TURN server setup mentioned later), |  | ||||||
|     ## shared secret generated while configuring coturn |  | ||||||
|     ## and reused here (power of Nix being a real programming language) |  | ||||||
|     turn_uris = [ |  | ||||||
|       "turn:turn.sealight.xyz:3478?transport=udp" |  | ||||||
|       "turn:turn.sealight.xyz:3478?transport=tcp" |  | ||||||
|     ]; |  | ||||||
|     turn_shared_secret = config.services.coturn.static-auth-secret; |  | ||||||
| 
 |  | ||||||
|     listeners = [ |     listeners = [ | ||||||
|       { |       { | ||||||
|         port = 8448; |         port = 8448; | ||||||
|  | @ -53,6 +42,18 @@ | ||||||
|         tls = false; |         tls = false; | ||||||
|       } |       } | ||||||
|     ]; |     ]; | ||||||
|  |     extraConfig = '' | ||||||
|  |       max_upload_size: "50M" | ||||||
|  |       use_presence: false | ||||||
|  |     ''; | ||||||
|  |     ## coturn based TURN server integration (TURN server setup mentioned later), | ||||||
|  |     ## shared secret generated while configuring coturn | ||||||
|  |     ## and reused here (power of Nix being a real programming language) | ||||||
|  |     turn_uris = [ | ||||||
|  |       "turn:turn.sealight.xyz:3478?transport=udp" | ||||||
|  |       "turn:turn.sealight.xyz:3478?transport=tcp" | ||||||
|  |     ]; | ||||||
|  |     turn_shared_secret = config.services.coturn.static-auth-secret; | ||||||
|   }; |   }; | ||||||
| 
 | 
 | ||||||
|   services.coturn = { |   services.coturn = { | ||||||
|  | @ -60,27 +61,45 @@ | ||||||
|     use-auth-secret = true; |     use-auth-secret = true; | ||||||
|     static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ"; |     static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ"; | ||||||
|     realm = "turn.sealight.xyz"; |     realm = "turn.sealight.xyz"; | ||||||
|  |     min-port = 49111; | ||||||
|  |     max-port = 51111; | ||||||
|  |     no-cli = true; | ||||||
|     no-tcp-relay = true; |     no-tcp-relay = true; | ||||||
|     no-tls = true; |     no-tls = true; | ||||||
|     no-dtls = true; |     cert = "${config.security.acme.certs."turn.sealight.xyz".directory}/full.pem"; | ||||||
|  |     pkey = "${config.security.acme.certs."turn.sealight.xyz".directory}/key.pem"; | ||||||
|     extraConfig = '' |     extraConfig = '' | ||||||
|  |       verbose | ||||||
|       user-quota=12 |       user-quota=12 | ||||||
|       total-quota=1200 |       total-quota=1200 | ||||||
|       denied-peer-ip=10.0.0.0-10.255.255.255 |       denied-peer-ip=10.0.0.0-10.255.255.255 | ||||||
|       denied-peer-ip=192.168.0.0-192.168.255.255 |       denied-peer-ip=192.168.0.0-192.168.255.255 | ||||||
|       denied-peer-ip=172.16.0.0-172.31.255.255 |       denied-peer-ip=172.16.0.0-172.31.255.255 | ||||||
| 
 |       denied-peer-ip=0.0.0.0-0.255.255.255 | ||||||
|         allowed-peer-ip=192.168.191.127 |       denied-peer-ip=100.64.0.0-100.127.255.255 | ||||||
|  |       denied-peer-ip=127.0.0.0-127.255.255.255 | ||||||
|  |       denied-peer-ip=169.254.0.0-169.254.255.255 | ||||||
|  |       denied-peer-ip=192.0.0.0-192.0.0.255 | ||||||
|  |       denied-peer-ip=192.0.2.0-192.0.2.255 | ||||||
|  |       denied-peer-ip=192.88.99.0-192.88.99.255 | ||||||
|  |       denied-peer-ip=198.18.0.0-198.19.255.255 | ||||||
|  |       denied-peer-ip=198.51.100.0-198.51.100.255 | ||||||
|  |       denied-peer-ip=203.0.113.0-203.0.113.255 | ||||||
|  |       denied-peer-ip=240.0.0.0-255.255.255.255 | ||||||
|     ''; |     ''; | ||||||
|   }; |   }; | ||||||
| 
 | 
 | ||||||
|  |   security.acme.certs.${config.services.coturn.realm} = { | ||||||
|  |     /* insert here the right configuration to obtain a certificate */ | ||||||
|  |     webroot = "/var/lib/acme/acme-challenge/"; | ||||||
|  |     email = "anish+acme@lakhwara.com"; | ||||||
|  |     postRun = "systemctl restart coturn.service"; | ||||||
|  |     group = "turnserver"; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|   services.jitsi-meet = { |   services.jitsi-meet = { | ||||||
|     enable = true; |     enable = true; | ||||||
|     hostName = "jitsi.sealight.xyz"; |     hostName = "jitsi.sealight.xyz"; | ||||||
| 
 |  | ||||||
|     ## this setting is going to add relevant ports to |  | ||||||
|     ## networking.firewall.allowedTCPPorts & |  | ||||||
|     ## networking.firewall.allowedUDPPorts |  | ||||||
|   }; |   }; | ||||||
|   services.jitsi-videobridge.enable = true; |   services.jitsi-videobridge.enable = true; | ||||||
| 
 | 
 | ||||||
|  | @ -90,17 +109,20 @@ | ||||||
|     # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. |     # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. | ||||||
|     settings = { |     settings = { | ||||||
|       homeserver = { |       homeserver = { | ||||||
|         address = "https://chat.sealight.xyz"; |         address = "https://sealight.xyz"; | ||||||
|         domain = "sealight.xyz"; |         domain = "sealight.xyz"; | ||||||
|       }; |       }; | ||||||
|       appservice = { |       appservice = { | ||||||
|         provisioning.enabled = false; |         provisioning.enabled = false; | ||||||
|         id = "telegram"; |         id = "telegram"; | ||||||
|  |         bot_username = "telegrambridge"; | ||||||
|         public = { |         public = { | ||||||
|           enabled = false; |           enabled = false; | ||||||
|           prefix = "/public"; |           prefix = "/public"; | ||||||
|           external = "https://chat.sealight.xyz/public"; |           external = "https://chat.sealight.xyz/public"; | ||||||
|         }; |         }; | ||||||
|  |         address = "http://localhost:18787"; | ||||||
|  |         port = 18787; | ||||||
|         # The service uses SQLite by default, but it's also possible to use PostgreSQL instead: |         # The service uses SQLite by default, but it's also possible to use PostgreSQL instead: | ||||||
|         #database = "postgresql:///mautrix-telegram?host=/run/postgresql"; |         #database = "postgresql:///mautrix-telegram?host=/run/postgresql"; | ||||||
|       }; |       }; | ||||||
|  | @ -113,96 +135,41 @@ | ||||||
|     }; |     }; | ||||||
|   }; |   }; | ||||||
| 
 | 
 | ||||||
|   services.mautrix-whatsapp = { |   services.mx-puppet-discord = { | ||||||
|     enable = true; |     enable = true; | ||||||
|     # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. |     settings = { | ||||||
|     configOptions = { |  | ||||||
|       homeserver = { |  | ||||||
|         address = "https://chat.sealight.xyz"; |  | ||||||
|         domain = "sealight.xyz"; |  | ||||||
|       }; |  | ||||||
|       appservice = { |  | ||||||
|         id = "whatsapp"; |  | ||||||
|         address = http://localhost:9897; |  | ||||||
|         hostname = "0.0.0.0"; |  | ||||||
|         port = 9897; |  | ||||||
|         database = { |  | ||||||
|   	  type = "sqlite3"; |  | ||||||
|   	  uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db"; |  | ||||||
|         }; |  | ||||||
|         state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json"; |  | ||||||
|         bot = { |  | ||||||
|           username = "whatsappbot"; |  | ||||||
|           displayname = "WhatsApp bridge bot"; |  | ||||||
|           avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr"; |  | ||||||
|         }; |  | ||||||
|         as_token = ""; |  | ||||||
|         hs_token = ""; |  | ||||||
|       }; |  | ||||||
|       bridge = { |       bridge = { | ||||||
|         username_template = "whatsapp_{{.}}"; |         bindAddress = "localhost"; | ||||||
|         displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)"; |         port = 16785; | ||||||
|         command_prefix = "!wa"; |         domain = "sealight.xyz"; | ||||||
|         permissions = { |         homeserverUrl = "https://sealight.xyz"; | ||||||
|         	"@aynish:sealight.xyz" = 100; |         avatarUrl = "https://discord.com/assets/2d20a45d79110dc5bf947137e9d99b66.svg"; | ||||||
|         }; |       }; | ||||||
|       }; |       provisioning = { | ||||||
|       logging = { |         whitelist = [ "@aynish:sealight.xyz" ]; | ||||||
|         directory = "/var/lib/mautrix-whatsapp/logs"; |       }; | ||||||
|         file_name_format = "{{.Date}}-{{.Index}}.log"; |       relay = { | ||||||
|         file_date_format = "\"2006-01-02\""; |         whitelist = [ "@aynish:sealight.xyz" ]; | ||||||
|         file_mode = 384; |       }; | ||||||
|         timestamp_format = "Jan _2, 2006 15:04:05"; |       namePatterns = { | ||||||
|         print_level = "debug"; |         group = ":name"; | ||||||
|       }; |         room = ":name"; | ||||||
|       metrics = { |         user = ":name (Discord)"; | ||||||
|         enabled = true; |         userOverride = ":displayname"; | ||||||
|         listen  = "http://localhost:5070"; |       }; | ||||||
|  |       presence = { | ||||||
|  |         enabled = false; | ||||||
|       }; |       }; | ||||||
|     }; |     }; | ||||||
|  |     serviceDependencies = [ "matrix-synapse.service" ]; | ||||||
|   }; |   }; | ||||||
| 
 | 
 | ||||||
|   services.matrix-appservice-slack = { |   services.heisenbridge = { | ||||||
|     enable = true; |     enable = true; | ||||||
|     #environmentFile = /etc/secrets/matrix-appservice-slack.env; |     homeserver = "https://sealight.xyz"; | ||||||
|     settings = { |     listenPort = 14456; | ||||||
|       homeserver = { |     appServiceToken = "wyujLh8kjpmk2bfKeEE3sZ2gWOEUBKK5"; | ||||||
|         server_name = "sealight.xyz"; |     homeserverToken = "yEHs7lthD2ZHUibJOAv1APaFhEjxN5PT"; | ||||||
|         url = "https://chat.sealight.xyz"; |  | ||||||
|       }; |  | ||||||
|       db = { |  | ||||||
|         engine = "postgres"; |  | ||||||
|         connectionString = "postgres://slackbridge_user:somethingverysecret@localhost/slack_bridge?sslmode=require"; |  | ||||||
|       }; |  | ||||||
|       matrix_admin_room = "!ikEWOHCcmoZtVzSmPF:sealight.xyz"; |  | ||||||
|       username_prefix = "slack_"; |  | ||||||
|       rtm = { |  | ||||||
|         enable = true; |  | ||||||
|         logging = "silent"; |  | ||||||
|       }; |  | ||||||
|       slack_hook_port = 9899; |  | ||||||
|       enable_metrics = true; |  | ||||||
|       puppeting = { |  | ||||||
|         enabled = true; |  | ||||||
|         onboard_users = true; |  | ||||||
|       }; |  | ||||||
|       oauth2 = { |  | ||||||
|         client_id = "2832868673.1609454840563"; |  | ||||||
|         client_secret = "079a7ca42b192e66a9ff32740a69cb9d"; |  | ||||||
|         redirect_prefix = "https://sealight.xyz/slackbridge/"; |  | ||||||
|       }; |  | ||||||
|       #team_sync = { |  | ||||||
|       #  T02QGRJKT = { |  | ||||||
|       #    users = { |  | ||||||
|       #      enabled = false; |  | ||||||
|       #    }; |  | ||||||
|       #    channels = { |  | ||||||
|       #       enabled = true; |  | ||||||
|       #       alias_prefix = "qf_"; |  | ||||||
|       #    }; |  | ||||||
|       #  }; |  | ||||||
|       #}; |  | ||||||
|     }; |  | ||||||
|   }; |   }; | ||||||
| 
 | 
 | ||||||
|   services.postgresql = { |   services.postgresql = { | ||||||
|  | @ -219,16 +186,30 @@ | ||||||
|     ''; |     ''; | ||||||
|   }; |   }; | ||||||
| 
 | 
 | ||||||
|   networking.firewall = { |   networking.firewall = | ||||||
|  |     let | ||||||
|  |       range = with config.services.coturn; [{ | ||||||
|  |         from = min-port; | ||||||
|  |         to = max-port; | ||||||
|  |       }]; | ||||||
|  |     in | ||||||
|  |     { | ||||||
|       enable = true; |       enable = true; | ||||||
|  |       allowedUDPPortRanges = range; # coturn | ||||||
|  |       allowedTCPPortRanges = range; | ||||||
|       allowedTCPPorts = [ |       allowedTCPPorts = [ | ||||||
|         22 # SSH |         22 # SSH | ||||||
|         8448 # Matrix federation |         8448 # Matrix federation | ||||||
|         8008 |         8008 | ||||||
|         80 |         80 | ||||||
|         443 |         443 | ||||||
|  |         3478 # Coturn service | ||||||
|  |         5349 # Coturn service | ||||||
|         9090 # Synapse Metrics |         9090 # Synapse Metrics | ||||||
|       9899 # Matrix <-> Slack Bridge Puppeting |       ]; | ||||||
|  |       allowedUDPPorts = [ | ||||||
|  |         3478 | ||||||
|  |         5349 # Coturn service | ||||||
|       ]; |       ]; | ||||||
|     }; |     }; | ||||||
| 
 | 
 | ||||||
|  | @ -257,7 +238,6 @@ | ||||||
|   services.nginx = { |   services.nginx = { | ||||||
|     enable = true; |     enable = true; | ||||||
|     virtualHosts = { |     virtualHosts = { | ||||||
| 
 |  | ||||||
|       "sealight.xyz" = { |       "sealight.xyz" = { | ||||||
|         forceSSL = true; |         forceSSL = true; | ||||||
|         enableACME = true; |         enableACME = true; | ||||||
|  | @ -271,7 +251,6 @@ | ||||||
|           proxyPass = "http://localhost:9899"; |           proxyPass = "http://localhost:9899"; | ||||||
|         }; |         }; | ||||||
|       }; |       }; | ||||||
| 
 |  | ||||||
|       ## virtual host for Synapse |       ## virtual host for Synapse | ||||||
|       "chat.sealight.xyz" = { |       "chat.sealight.xyz" = { | ||||||
|         forceSSL = true; |         forceSSL = true; | ||||||
|  | @ -281,19 +260,16 @@ | ||||||
|           proxyPass = "http://localhost:8448"; |           proxyPass = "http://localhost:8448"; | ||||||
|         }; |         }; | ||||||
|       }; |       }; | ||||||
| 
 |  | ||||||
|       ## virtual host for Riot/Web |       ## virtual host for Riot/Web | ||||||
|       "element.sealight.xyz" = { |       "element.sealight.xyz" = { | ||||||
|         forceSSL = true; |         forceSSL = true; | ||||||
|         enableACME = true; |         enableACME = true; | ||||||
|         #useACMEHost = "sealight.xyz"; |         #useACMEHost = "sealight.xyz"; | ||||||
| 
 |  | ||||||
|         ## root points to the riot-web package content, also configured via Nix |         ## root points to the riot-web package content, also configured via Nix | ||||||
|         locations."/" = { |         locations."/" = { | ||||||
|           root = pkgs.element-web; |           root = pkgs.element-web; | ||||||
|         }; |         }; | ||||||
|       }; |       }; | ||||||
|   |  | ||||||
|       ${config.services.jitsi-meet.hostName} = { |       ${config.services.jitsi-meet.hostName} = { | ||||||
|         enableACME = true; |         enableACME = true; | ||||||
|         forceSSL = true; |         forceSSL = true; | ||||||
|  | @ -305,5 +281,86 @@ | ||||||
|     recommendedTlsSettings = true; |     recommendedTlsSettings = true; | ||||||
|   }; |   }; | ||||||
| 
 | 
 | ||||||
|   environment.systemPackages = with pkgs; [ matrix-appservice-slack ]; |   # environment.systemPackages = with pkgs; [ matrix-appservice-slack ]; | ||||||
|  |   #services.mx-puppet-slack= { | ||||||
|  |   #enable = false; | ||||||
|  |   #settings = { | ||||||
|  |   #  bridge = {  | ||||||
|  |   #    bindAddress = "localhost"; | ||||||
|  |   #    port = 16786; | ||||||
|  |   #    domain = "sealight.xyz"; | ||||||
|  |   #    homeserverUrl = "https://sealight.xyz"; | ||||||
|  |   #  }; | ||||||
|  |   #  provisioning = { | ||||||
|  |   #    whitelist = [ "@aynish:sealight.xyz" ]; | ||||||
|  |   #  }; | ||||||
|  |   #  relay = { | ||||||
|  |   #    whitelist = [ "@aynish:sealight.xyz" ]; | ||||||
|  |   #  }; | ||||||
|  |   #  namePatterns = { | ||||||
|  |   #    group = ":name"; | ||||||
|  |   #    room = ":name[:team? - :team,]"; | ||||||
|  |   #    user = ":name (Slack)"; | ||||||
|  |   #    userOverride = ":displayname"; | ||||||
|  |   #  }; | ||||||
|  |   #  presence = { | ||||||
|  |   #    enabled = false; | ||||||
|  |   #  }; | ||||||
|  |   #  oauth = { | ||||||
|  |   #    enabled = false; | ||||||
|  |   #  }; | ||||||
|  |   #}; | ||||||
|  |   #serviceDependencies = ["matrix-synapse.service"]; | ||||||
|  |   #}; | ||||||
|  | 
 | ||||||
|  |   # services.mautrix-whatsapp = { | ||||||
|  |   #   enable = false; | ||||||
|  |   # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. | ||||||
|  |   #configOptions = { | ||||||
|  |   #  homeserver = { | ||||||
|  |   #    address = "https://chat.sealight.xyz"; | ||||||
|  |   #    domain = "sealight.xyz"; | ||||||
|  |   #  }; | ||||||
|  |   #  appservice = { | ||||||
|  |   #    id = "whatsapp"; | ||||||
|  |   #    address = http://localhost:9897; | ||||||
|  |   #    hostname = "0.0.0.0"; | ||||||
|  |   #    port = 9897; | ||||||
|  |   #    database = { | ||||||
|  |   #      type = "sqlite3"; | ||||||
|  |   #      uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db"; | ||||||
|  |   #    }; | ||||||
|  |   #    state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json"; | ||||||
|  |   #    bot = { | ||||||
|  |   #      username = "whatsappbot"; | ||||||
|  |   #      displayname = "WhatsApp bridge bot"; | ||||||
|  |   #      avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr"; | ||||||
|  |   #    }; | ||||||
|  |   #    as_token = ""; | ||||||
|  |   #    hs_token = ""; | ||||||
|  |   #  }; | ||||||
|  |   #  bridge = { | ||||||
|  |   #    username_template = "whatsapp_{{.}}"; | ||||||
|  |   #    displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)"; | ||||||
|  |   #    command_prefix = "!wa"; | ||||||
|  |   #    permissions = { | ||||||
|  |   #      "@aynish:sealight.xyz" = 100; | ||||||
|  |   #    }; | ||||||
|  |   #  }; | ||||||
|  |   #  logging = { | ||||||
|  |   #    directory = "/var/lib/mautrix-whatsapp/logs"; | ||||||
|  |   #    file_name_format = "{{.Date}}-{{.Index}}.log"; | ||||||
|  |   #    file_date_format = "\"2006-01-02\""; | ||||||
|  |   #    file_mode = 384; | ||||||
|  |   #    timestamp_format = "Jan _2, 2006 15:04:05"; | ||||||
|  |   #    print_level = "debug"; | ||||||
|  |   #  }; | ||||||
|  |   #  metrics = { | ||||||
|  |   #    enabled = true; | ||||||
|  |   #    listen  = "http://localhost:5070"; | ||||||
|  |   #  }; | ||||||
|  |   #}; | ||||||
|  |   # }; | ||||||
|  | 
 | ||||||
|  | 
 | ||||||
| } | } | ||||||
|  |  | ||||||
|  | @ -10,7 +10,8 @@ let | ||||||
|   # TODO: switch to configGen.json once RFC42 is implemented |   # TODO: switch to configGen.json once RFC42 is implemented | ||||||
|   settingsFile = pkgs.writeText "matrix-appservice-slack-settings.json" (builtins.toJSON cfg.settings); |   settingsFile = pkgs.writeText "matrix-appservice-slack-settings.json" (builtins.toJSON cfg.settings); | ||||||
| 
 | 
 | ||||||
| in { | in | ||||||
|  | { | ||||||
|   options = { |   options = { | ||||||
|     services.matrix-appservice-slack = { |     services.matrix-appservice-slack = { | ||||||
|       enable = mkEnableOption "a bridge between Matrix and Slack"; |       enable = mkEnableOption "a bridge between Matrix and Slack"; | ||||||
|  | @ -5,7 +5,8 @@ with lib; | ||||||
| let | let | ||||||
|   cfg = config.services.mautrix-whatsapp; |   cfg = config.services.mautrix-whatsapp; | ||||||
| 
 | 
 | ||||||
|   configFile = pkgs.runCommand "mautrix-whatsapp" { |   configFile = pkgs.runCommand "mautrix-whatsapp" | ||||||
|  |     { | ||||||
|       buildInputs = [ pkgs.mautrix-whatsapp pkgs.remarshal ]; |       buildInputs = [ pkgs.mautrix-whatsapp pkgs.remarshal ]; | ||||||
|       preferLocalBuild = true; |       preferLocalBuild = true; | ||||||
|     } '' |     } '' | ||||||
|  | @ -10,7 +10,8 @@ let | ||||||
|   settingsFile = settingsFormat.generate "mx-puppet-slack-config.json" cfg.settings; |   settingsFile = settingsFormat.generate "mx-puppet-slack-config.json" cfg.settings; | ||||||
|   mx-puppet-slack = pkgs.callPackage ./pkg-mx-puppet-slack.nix { }; |   mx-puppet-slack = pkgs.callPackage ./pkg-mx-puppet-slack.nix { }; | ||||||
| 
 | 
 | ||||||
| in { | in | ||||||
|  | { | ||||||
|   options = { |   options = { | ||||||
|     services.mx-puppet-slack = { |     services.mx-puppet-slack = { | ||||||
|       enable = mkEnableOption '' |       enable = mkEnableOption '' | ||||||
							
								
								
									
										159
									
								
								profiles/metrics/default.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										159
									
								
								profiles/metrics/default.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,159 @@ | ||||||
|  | { config, pkgs, ... }: { | ||||||
|  |   # grafana configuration | ||||||
|  |   #services.grafana = { | ||||||
|  |   #  enable = true; | ||||||
|  |   #  domain = "grafana.mossnet.lan"; | ||||||
|  |   #  port = 2342; | ||||||
|  |   #  addr = "127.0.0.1"; | ||||||
|  |   #}; | ||||||
|  |   # | ||||||
|  |   ## nginx reverse proxy | ||||||
|  |   #services.nginx.virtualHosts.${config.services.grafana.domain} = { | ||||||
|  |   #  locations."/" = { | ||||||
|  |   #      proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; | ||||||
|  |   #      proxyWebsockets = true; | ||||||
|  |   #  }; | ||||||
|  |   #}; | ||||||
|  | 
 | ||||||
|  |   services.prometheus = { | ||||||
|  |     enable = true; | ||||||
|  |     port = 9001; | ||||||
|  |     exporters = { | ||||||
|  |       node = { | ||||||
|  |         enable = true; | ||||||
|  |         enabledCollectors = [ "systemd" ]; | ||||||
|  |         port = 9002; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  |     rules = [ | ||||||
|  |       '' | ||||||
|  |         groups: | ||||||
|  |         - name: synapse | ||||||
|  |           rules: | ||||||
|  |           - record: "synapse_federation_transaction_queue_pendingEdus:total" | ||||||
|  |             expr: "sum(synapse_federation_transaction_queue_pendingEdus or absent(synapse_federation_transaction_queue_pendingEdus)*0)" | ||||||
|  |           - record: "synapse_federation_transaction_queue_pendingPdus:total" | ||||||
|  |             expr:   "sum(synapse_federation_transaction_queue_pendingPdus or absent(synapse_federation_transaction_queue_pendingPdus)*0)" | ||||||
|  |           - record: 'synapse_http_server_request_count:method' | ||||||
|  |             labels: | ||||||
|  |               servlet: "" | ||||||
|  |             expr: "sum(synapse_http_server_request_count) by (method)" | ||||||
|  |           - record: 'synapse_http_server_request_count:servlet' | ||||||
|  |             labels: | ||||||
|  |               method: "" | ||||||
|  |             expr: 'sum(synapse_http_server_request_count) by (servlet)' | ||||||
|  | 
 | ||||||
|  |           - record: 'synapse_http_server_request_count:total' | ||||||
|  |             labels: | ||||||
|  |               servlet: "" | ||||||
|  |             expr: 'sum(synapse_http_server_request_count:by_method) by (servlet)' | ||||||
|  | 
 | ||||||
|  |           - record: 'synapse_cache:hit_ratio_5m' | ||||||
|  |             expr: 'rate(synapse_util_caches_cache:hits[5m]) / rate(synapse_util_caches_cache:total[5m])' | ||||||
|  |           - record: 'synapse_cache:hit_ratio_30s' | ||||||
|  |             expr: 'rate(synapse_util_caches_cache:hits[30s]) / rate(synapse_util_caches_cache:total[30s])' | ||||||
|  | 
 | ||||||
|  |           - record: 'synapse_federation_client_sent' | ||||||
|  |             labels: | ||||||
|  |               type: "EDU" | ||||||
|  |             expr: 'synapse_federation_client_sent_edus + 0' | ||||||
|  |           - record: 'synapse_federation_client_sent' | ||||||
|  |             labels: | ||||||
|  |               type: "PDU" | ||||||
|  |             expr: 'synapse_federation_client_sent_pdu_destinations:count + 0' | ||||||
|  |           - record: 'synapse_federation_client_sent' | ||||||
|  |             labels: | ||||||
|  |               type: "Query" | ||||||
|  |             expr: 'sum(synapse_federation_client_sent_queries) by (job)' | ||||||
|  | 
 | ||||||
|  |           - record: 'synapse_federation_server_received' | ||||||
|  |             labels: | ||||||
|  |               type: "EDU" | ||||||
|  |             expr: 'synapse_federation_server_received_edus + 0' | ||||||
|  |           - record: 'synapse_federation_server_received' | ||||||
|  |             labels: | ||||||
|  |               type: "PDU" | ||||||
|  |             expr: 'synapse_federation_server_received_pdus + 0' | ||||||
|  |           - record: 'synapse_federation_server_received' | ||||||
|  |             labels: | ||||||
|  |               type: "Query" | ||||||
|  |             expr: 'sum(synapse_federation_server_received_queries) by (job)' | ||||||
|  | 
 | ||||||
|  |           - record: 'synapse_federation_transaction_queue_pending' | ||||||
|  |             labels: | ||||||
|  |               type: "EDU" | ||||||
|  |             expr: 'synapse_federation_transaction_queue_pending_edus + 0' | ||||||
|  |           - record: 'synapse_federation_transaction_queue_pending' | ||||||
|  |             labels: | ||||||
|  |               type: "PDU" | ||||||
|  |             expr: 'synapse_federation_transaction_queue_pending_pdus + 0' | ||||||
|  | 
 | ||||||
|  |           - record: synapse_storage_events_persisted_by_source_type | ||||||
|  |             expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_type="remote"}) | ||||||
|  |             labels: | ||||||
|  |               type: remote | ||||||
|  |           - record: synapse_storage_events_persisted_by_source_type | ||||||
|  |             expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity="*client*",origin_type="local"}) | ||||||
|  |             labels: | ||||||
|  |               type: local | ||||||
|  |           - record: synapse_storage_events_persisted_by_source_type | ||||||
|  |             expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity!="*client*",origin_type="local"}) | ||||||
|  |             labels: | ||||||
|  |               type: bridges | ||||||
|  |           - record: synapse_storage_events_persisted_by_event_type | ||||||
|  |             expr: sum without(origin_entity, origin_type) (synapse_storage_events_persisted_events_sep) | ||||||
|  |           - record: synapse_storage_events_persisted_by_origin | ||||||
|  |             expr: sum without(type) (synapse_storage_events_persisted_events_sep) | ||||||
|  |       '' | ||||||
|  |     ]; | ||||||
|  |     scrapeConfigs = [ | ||||||
|  |       { | ||||||
|  |         job_name = "helix"; | ||||||
|  |         static_configs = [{ | ||||||
|  |           targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ]; | ||||||
|  |         }]; | ||||||
|  |       } | ||||||
|  |       { | ||||||
|  |         job_name = "synapse"; | ||||||
|  |         metrics_path = "/_synapse/metrics"; | ||||||
|  |         static_configs = [{ | ||||||
|  |           targets = [ "localhost:9090" ]; | ||||||
|  |         }]; | ||||||
|  |       } | ||||||
|  |       { | ||||||
|  |         job_name = "gitea"; | ||||||
|  |         static_configs = [{ | ||||||
|  |           targets = [ "localhost:3001" ]; | ||||||
|  |         }]; | ||||||
|  |       } | ||||||
|  |     ]; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   networking.firewall = { | ||||||
|  |     enable = true; | ||||||
|  |     allowedTCPPorts = [ 9001 ]; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   services.nginx.virtualHosts."sealight.xyz" = { | ||||||
|  |     locations."/metrics" = { | ||||||
|  |       #basicAuth = { anish = "password"; }; | ||||||
|  |       proxyPass = "http://localhost:9001"; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   services.loki = { | ||||||
|  |     enable = true; | ||||||
|  |     configFile = /var/loki-config.yaml; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   systemd.services.promtail = { | ||||||
|  |     description = "Promtail service for Loki"; | ||||||
|  |     wantedBy = [ "multi-user.target" ]; | ||||||
|  | 
 | ||||||
|  |     serviceConfig = { | ||||||
|  |       ExecStart = '' | ||||||
|  |         ${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml} | ||||||
|  |       ''; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | } | ||||||
|  | @ -5,6 +5,7 @@ | ||||||
|     192.168.1.240 read.mossnet.lan |     192.168.1.240 read.mossnet.lan | ||||||
|     192.168.1.240 music.mossnet.lan |     192.168.1.240 music.mossnet.lan | ||||||
|     192.168.1.240 stats.mossnet.lan |     192.168.1.240 stats.mossnet.lan | ||||||
|  |     192.168.1.240 file.mossnet.lan | ||||||
|   ''; |   ''; | ||||||
|   # 10.0.69.4 mossnet.lan |   # 10.0.69.4 mossnet.lan | ||||||
|   #  10.0.69.4 links.mossnet.lan |   #  10.0.69.4 links.mossnet.lan | ||||||
|  |  | ||||||
|  | @ -2,13 +2,10 @@ | ||||||
| { | { | ||||||
|   services.rss-bridge = { |   services.rss-bridge = { | ||||||
|     enable = true; |     enable = true; | ||||||
|     virtualHost = "rss.mossnet.lan"; |     virtualHost = "bridge.sealight.xyz"; | ||||||
|     whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram"]; |     whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit" ]; | ||||||
|     #dataDir = "/etc/rss-bridge/"; |  | ||||||
|   }; |   }; | ||||||
|   #environment.etc."rss-bridge/config.ini.php" = '' | 
 | ||||||
|   #  [InstagramBridge] |   services.nginx.virtualHosts."bridge.sealight.xyz".forceSSL = true; | ||||||
|   #  session_id = %sessionid from step 1% |   services.nginx.virtualHosts."bridge.sealight.xyz".enableACME = true; | ||||||
|   #  cache_timeout = %cache timeout in seconds% |  | ||||||
|   #''; |  | ||||||
| } | } | ||||||
|  |  | ||||||
|  | @ -7,7 +7,48 @@ | ||||||
|       fileserver.host = "0.0.0.0"; |       fileserver.host = "0.0.0.0"; | ||||||
|       fileserver.port = 8082; |       fileserver.port = 8082; | ||||||
|     }; |     }; | ||||||
|     ccnetSettings.General.SERVICE_URL = "file.mossnet.lan"; |     ccnetSettings.General.SERVICE_URL = "http://file.mossnet.lan"; | ||||||
|  |     adminEmail = "anish@lakhwara.com"; | ||||||
|     initialAdminPassword = "arandompasswordsecure!"; |     initialAdminPassword = "arandompasswordsecure!"; | ||||||
|   }; |   }; | ||||||
|  | 
 | ||||||
|  |   services.nginx = { | ||||||
|  |     enable = true; | ||||||
|  |   }; | ||||||
|  |   services.nginx.upstreams."gunicorn_seafile" = { | ||||||
|  |     servers."unix:/run/seahub/gunicorn.sock" = { }; | ||||||
|  |   }; | ||||||
|  |   services.nginx.upstreams."seafhttp" = { | ||||||
|  |     servers."127.0.0.1:8082" = { }; | ||||||
|  |   }; | ||||||
|  |   services.nginx.virtualHosts."file.mossnet.lan" = { | ||||||
|  |     serverName = "file.mossnet.lan"; | ||||||
|  |     locations."/" = { | ||||||
|  |       proxyPass = "http://gunicorn_seafile"; # without a trailing / | ||||||
|  |       extraConfig = '' | ||||||
|  |         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||||||
|  |         proxy_set_header X-Forwarded-Proto $scheme; | ||||||
|  |         proxy_set_header X-Real-IP $remote_addr; | ||||||
|  |         proxy_set_header X-Forwarded-Host $server_name; | ||||||
|  |         #proxy_set_header Host $host; | ||||||
|  |         proxy_read_timeout  1200s; | ||||||
|  | 
 | ||||||
|  |         client_max_body_size 0; # disable max upload size | ||||||
|  |       ''; | ||||||
|  |     }; | ||||||
|  |     locations."/seafhttp" = { | ||||||
|  |       proxyPass = "http://seafhttp"; # without a trailing / | ||||||
|  |       extraConfig = '' | ||||||
|  |         rewrite ^/seafhttp(.*)$ $1 break; | ||||||
|  |         client_max_body_size 0; | ||||||
|  | 
 | ||||||
|  |         proxy_connect_timeout  36000s; | ||||||
|  |         proxy_read_timeout  36000s; | ||||||
|  |         proxy_send_timeout  36000s; | ||||||
|  | 
 | ||||||
|  |         proxy_request_buffering off; | ||||||
|  |         send_timeout  36000s; | ||||||
|  |       ''; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
| } | } | ||||||
|  |  | ||||||
							
								
								
									
										14
									
								
								profiles/sealight-website/default.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										14
									
								
								profiles/sealight-website/default.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,14 @@ | ||||||
|  | { | ||||||
|  |   services.nginx = { | ||||||
|  |     enable = true; | ||||||
|  |     vhost = { | ||||||
|  |       "sealight.xyz" = { | ||||||
|  |         forceSSL = true; | ||||||
|  |         enableACME = true; | ||||||
|  |         locations."/" = { | ||||||
|  |           root = "/var/www/sealight.xyz" | ||||||
|  |             }; | ||||||
|  |         }; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  |   } | ||||||
|  | @ -7,8 +7,8 @@ | ||||||
|     group = "users"; |     group = "users"; | ||||||
|     dataDir = "/home/anish/"; |     dataDir = "/home/anish/"; | ||||||
|     configDir = "/home/anish/.config/syncthing"; |     configDir = "/home/anish/.config/syncthing"; | ||||||
|     guiAddress = "0.0.0.0:8384"; |  | ||||||
|   }; |   }; | ||||||
| 
 | 
 | ||||||
|   networking.firewall.allowedTCPPorts = [ 8384 22000 ]; |   networking.firewall.allowedTCPPorts = [ 8384 22000 ]; | ||||||
|  |   networking.firewall.allowedUDPPorts = [ 22000 21027 ]; | ||||||
| } | } | ||||||
|  |  | ||||||
							
								
								
									
										35
									
								
								profiles/wireguard-server/default.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										35
									
								
								profiles/wireguard-server/default.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,35 @@ | ||||||
|  | { config, pkgs, lib, ... }: | ||||||
|  | { | ||||||
|  |   environment.systemPackages = [ pkgs.wireguard pkgs.mosh ]; | ||||||
|  |   networking.nat = { | ||||||
|  |     enable = true; | ||||||
|  |     externalInterface = "ens3"; | ||||||
|  |     internalInterfaces = [ "wg0" ]; | ||||||
|  |   }; | ||||||
|  |   networking.firewall = { | ||||||
|  |     allowedUDPPorts = [ 60990 ]; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   networking.wireguard.interfaces.wg0 = { | ||||||
|  |     ips = [ "10.0.69.1/24" ]; | ||||||
|  |     listenPort = 60990; | ||||||
|  |     privateKeyFile = "/var/lib/wireguard/priv"; | ||||||
|  |     peers = [ | ||||||
|  |       { | ||||||
|  |         # box | ||||||
|  |         publicKey = "Ra78mOc110K7URN5uB3m9d78iBKgeRHzT+3HkiFp9BU="; | ||||||
|  |         allowedIPs = [ "10.0.69.4/32" ]; | ||||||
|  |       } | ||||||
|  |       { | ||||||
|  |         # line | ||||||
|  |         publicKey = "fsb1FuGmYi89p4CVXytKw2FYamONKtoanxrgs/dJjC8="; | ||||||
|  |         allowedIPs = [ "10.0.69.3/32" ]; | ||||||
|  |       } | ||||||
|  |       { | ||||||
|  |         # curve | ||||||
|  |         publicKey = "XmV4AcPPND/eeSI6d9M1iahCjtymqY6DdUDEFNP/x3g="; | ||||||
|  |         allowedIPs = [ "10.0.69.2/32" ]; | ||||||
|  |       } | ||||||
|  |     ]; | ||||||
|  |   }; | ||||||
|  | } | ||||||
		Loading…
	
		Reference in a new issue