moving helix into profiles

bud/default.nix

@@ -1,10 +0,0 @@
-{ pkgs, lib, budUtils, ... }: {
-  bud.cmds = with pkgs; {
-    get = {
-      writer = budUtils.writeBashWithPaths [ nixUnstable git coreutils ];
-      synopsis = "get [DEST]";
-      help = "Copy the desired template to DEST";
-      script = ./get.bash;
-    };
-  };
-}

bud/get.bash

@@ -1 +0,0 @@
-nix flake new -t "github:divnix/devos/core" "${2:-devos}"

flake.nix

@@ -1,10 +1,6 @@
 {
   description = "A highly structured configuration database.";
 
-  nixConfig.extra-experimental-features = "nix-command flakes";
-  nixConfig.extra-substituters = "https://nrdxp.cachix.org https://nix-community.cachix.org";
-  nixConfig.extra-trusted-public-keys = "nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=";
-
   inputs =
     {
       # Nix
@@ -126,11 +122,11 @@
             };
             suites = with profiles; rec {
               base = [ core users.root users.anish ];
-              sealight = [ base server ]; # matrix rsshub backup wireguard-server
+              sealight = [ base server rss-bridge gitea wireguard-server metrics sealight-website ]; # matrix backup
-              mossnet = [ base server taskd shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale seafile syncthing ]; # hpi syncthing sync.music
+              mossnet = [ base server taskd shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale seafile syncthing ]; # hpi sync.music
               cube = [ base site server ];
-              graphical = [ base bluetooth music sync.kitaab sync.website sync.cal wifi desktop ]; # syncthing
+              graphical = [ base bluetooth music sync.kitaab sync.website sync.cal wifi desktop ];
-              curve = [ graphical secrets ];
+              curve = [ graphical secrets syncthing ];
               work = [ base ];
             };
           };

hosts/box/default.nix

@@ -9,6 +9,7 @@
   };
 
   # For some reason this doesn't work in the profile, but does over here??
+  # Something weird in the way I'm importing nixpkgs in the profile or something
   services."grasp".enable = true;
   services."grasp".path = "/home/anish/kitaab/grasp";
   services."grasp".user = "anish";
@@ -28,10 +29,10 @@
       "/var/www/shaarli-config" # sharli
       "/var/backup/postgresql" # wallabag
       "/var/lib/radicale" # radicale
-      "/home/anish/usr/syncthing" # syncthing
+      "/home/anish/usr/drawing" # syncthing
+      "/home/anish/usr/nonfiction" # syncthing
     ];
-    # seafile?
+    # seafile
-    # syncthing
   };
 
   age.secrets.box-wg.file = "${self}/secrets/box-wg.age";
@@ -41,4 +42,5 @@
     ips = [ "10.0.69.4/24" ];
     privateKeyFile = "/run/agenix/box-wg";
   };
+  services.syncthing.guiAddress = "0.0.0.0:8384"; # public syncthing
 }

hosts/helix/configuration.nix

@@ -0,0 +1,37 @@
+{ config, pkgs, ... }:
+{
+  imports =
+    [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
+  boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
+
+  networking.hostName = "helix"; # Define your hostname.
+
+  networking.useDHCP = false;
+  networking.interfaces.ens3.useDHCP = true;
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  services.openssh.passwordAuthentication = false;
+  services.openssh.permitRootLogin = "no";
+  sound.enable = false;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  # This value determines the NixOS release with which your system is to be
+  # compatible, in order to avoid breaking some software such as database
+  # servers. You should change this only after NixOS release notes say you
+  # should.
+  system.stateVersion = "19.09"; # Did you read the comment?
+
+}
+

hosts/helix/default.nix

@@ -0,0 +1,23 @@
+{ self, profiles, suites, ... }:
+{
+  imports = [
+    ./configuration.nix
+  ] ++ suites.sealight;
+
+  home-manager.users.anish = { self, suites, ... }: {
+    imports = [ ] ++ suites.hmBase;
+  };
+
+  mossnet.backup = {
+    enable = false;
+    name = "sealight";
+    paths = [ "/var/backup/postgresql" ];
+  };
+
+  age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
+  services.postgresqlBackup = {
+    enable = false;
+    databases = [ "matrix" "gitea" ];
+    location = "/var/backup/postgresql";
+  };
+}

hosts/helix/hardware-configuration.nix

@@ -5,7 +5,8 @@
 
 {
   imports =
-    [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
+    [
+      <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
     ];
 
   boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
@@ -14,7 +15,8 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
+    {
+      device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
       fsType = "btrfs";
     };
 

modules/heisenbridge.nix

@@ -89,7 +89,7 @@ in
 
     systemd.services.heisenbridge = {
       description = "Heisenbridge Matrix IRC bridge";
-      after = ["matrix-synapse.service"];
+      after = [ "matrix-synapse.service" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         ExecStart = ''

profiles/gitea/default.nix

@@ -44,7 +44,8 @@
     recommendedOptimisation = true;
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
-   virtualHosts."git.sealight.xyz" = {                  # Gitea hostname
+    virtualHosts."git.sealight.xyz" = {
+      # Gitea hostname
       enableACME = true; # Use ACME certs
       forceSSL = true; # Force SSL
       locations."/".proxyPass = "http://localhost:3001/"; # Proxy Gitea

profiles/helix-zone/configuration.nix

@@ -1,60 +0,0 @@
-{ config, pkgs, ... }:
-{
-  imports =
-    [ # Include the results of the hardware scan.
-      ./hardware-configuration.nix
-      ./wireguard.nix
-      ./matrix.nix
-      ./monitoring.nix
-      ./rss-bridge.nix
-      ./gitea.nix
-      # ./dns.nix
-      "${builtins.fetchTarball "https://github.com/ryantm/agenix/archive/main.tar.gz"}/modules/age.nix"
-    ];
-
-  # Use the GRUB 2 boot loader.
-  boot.loader.grub.enable = true;
-  boot.loader.grub.version = 2;
-  boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
-
-  networking.hostName = "helix"; # Define your hostname.
-
-  networking.useDHCP = false;
-  networking.interfaces.ens3.useDHCP = true;
-
-  # Configure network proxy if necessary
-  # networking.proxy.default = "http://user:password@proxy:port/";
-  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
-
-  # Enable the OpenSSH daemon.
-  services.openssh.enable = true;
-  services.openssh.passwordAuthentication = false;
-  services.openssh.permitRootLogin = "no";
-
-  # Open ports in the firewall.
-  # networking.firewall.allowedTCPPorts = [ ... ];
-  # networking.firewall.allowedUDPPorts = [ ... ];
-  # Or disable the firewall altogether.
-  # networking.firewall.enable = false;
-
-  # Include agenix
-  #environment.systemPackages = [ agenix.defaultPackage.x86_64-linux ];
-
-  # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.anish = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user
-    openssh.authorizedKeys.keys = [
-	"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve"  
-	"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCeWQsf9rbE+KBrWLkLkg1PMKx0jPfDP8xyv+XtddIQzAskRTN+JSSQp1GpoRgfQij7bx6f6DfjkwSQK5NWDQNQ+klGhcdEwEdptWUzpRAvKHMImjyIwFHmRKKEgcfH8+DSHVM93nRSQKrLezX4PzPkHF9f3TLxFdGeQDeY0J2oP2Oa97hRtuTJZW9BwUojyvDYUbg7F3fxf+pdFCvIAFaayiLkhOYdTXnjLt1Ks6NOhSzM78ZibHv4pFYI9r6dhflkFP/SzyLeSSm1aVAtxqE7vF5HnnORAg0byDsiOv/9RXxiDx7gkAAw3xENDSpp9TRj54M7iz1OSsRMhmD6orHjZFIRejlE4DIn+PBPm3PH+U5ILKTogE6n5MfPT28V0QdtHuqq3b5tSWiDcFpnjxbIUmEIo5hLzMR0tXZoNLQhBCSNfxjE8CYzpk7mHbvhSs2GPfG+NI1vvldbw2EF8beJFQHNYTqJw8y7p8RXpCwZqqpSitJX6v9DiYdLVG1hWvE= nix-on-droid@localhost"
-	 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box" ];
-  };
-
-  # This value determines the NixOS release with which your system is to be
-  # compatible, in order to avoid breaking some software such as database
-  # servers. You should change this only after NixOS release notes say you
-  # should.
-  system.stateVersion = "19.09"; # Did you read the comment?
-
-}
-

profiles/helix-zone/matrix.nix

@@ -1,375 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  imports = [ 
-	#./mod-mx-puppet-slack.nix 
-	./mautrix-whatsapp.nix 
-	./mod-heisenbridge.nix
-  ];
-  security.acme.email = "anish+acme@lakhwara.com";
-  security.acme.acceptTerms = true;
-  services.matrix-synapse = {
-    enable = true;
-    app_service_config_files = [
-    #  # The registration file is automatically generated after starting the appservice for the first time.
-    #  # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/
-    #  # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml
-       "/var/lib/matrix-synapse/discord-registration.yaml"
-       "/var/lib/matrix-synapse/telegram-registration.yaml"
-       #"/var/lib/matrix-synapse/slack-registration.yaml"
-       #"/var/lib/matrix-synapse/whatsapp-registration.yaml"
-    ];
-    server_name = "sealight.xyz";
-    registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU";
-    enable_metrics = true;
-    enable_registration = true;
-    database_type = "psycopg2";
-    database_args = {
-      database = "matrix-synapse";
-    };
-
-    listeners = [
-      {
-        port = 8448;
-        tls = false;
-        resources = [{
-            compress = true;
-            names = ["client" "federation"];
-          }];
-      }
-      {
-	port = 9090;
-	type = "metrics";
-	bind_address = "0.0.0.0";
-	resources = [{ 
-	  compress = false;
-	  names = [];
-	}];
-	tls = false;
-      }
-    ];
-    extraConfig = ''
-      max_upload_size: "50M"
-      use_presence: false
-    '';
-    ## coturn based TURN server integration (TURN server setup mentioned later),
-    ## shared secret generated while configuring coturn
-    ## and reused here (power of Nix being a real programming language)
-    turn_uris = [
-      "turn:turn.sealight.xyz:3478?transport=udp"
-      "turn:turn.sealight.xyz:3478?transport=tcp"
-    ];
-    turn_shared_secret = config.services.coturn.static-auth-secret;
-  };
-
-
-  services.coturn = {
-    enable = true;
-    use-auth-secret = true;
-    static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ";
-    realm = "turn.sealight.xyz";
-    min-port = 49111;
-    max-port = 51111;
-    no-cli = true;
-    no-tcp-relay = true;
-    no-tls = true;
-    cert = "${config.security.acme.certs."turn.sealight.xyz".directory}/full.pem";
-    pkey = "${config.security.acme.certs."turn.sealight.xyz".directory}/key.pem";
-    extraConfig = ''
-	verbose
-        user-quota=12
-        total-quota=1200
-        denied-peer-ip=10.0.0.0-10.255.255.255
-        denied-peer-ip=192.168.0.0-192.168.255.255
-        denied-peer-ip=172.16.0.0-172.31.255.255
-	denied-peer-ip=0.0.0.0-0.255.255.255
-	denied-peer-ip=100.64.0.0-100.127.255.255
-	denied-peer-ip=127.0.0.0-127.255.255.255
-	denied-peer-ip=169.254.0.0-169.254.255.255
-	denied-peer-ip=192.0.0.0-192.0.0.255
-	denied-peer-ip=192.0.2.0-192.0.2.255
-	denied-peer-ip=192.88.99.0-192.88.99.255
-	denied-peer-ip=198.18.0.0-198.19.255.255
-	denied-peer-ip=198.51.100.0-198.51.100.255
-	denied-peer-ip=203.0.113.0-203.0.113.255
-	denied-peer-ip=240.0.0.0-255.255.255.255
-    '';
-  };
-
-  security.acme.certs.${config.services.coturn.realm} = {
-    /* insert here the right configuration to obtain a certificate */
-    webroot = "/var/lib/acme/acme-challenge/";
-    email = "anish+acme@lakhwara.com";
-    postRun = "systemctl restart coturn.service";
-    group = "turnserver";
-  };
-
-  services.jitsi-meet = {
-    enable = true;
-    hostName = "jitsi.sealight.xyz";
-  };
-  services.jitsi-videobridge.enable = true;
-
-  services.mautrix-telegram = {
-    enable = true;
-    environmentFile = /etc/secrets/telegram.env; # file containing the appservice and telegram tokens
-    # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
-    settings = {
-      homeserver = {
-        address = "https://sealight.xyz";
-        domain = "sealight.xyz";
-      };
-      appservice = {
-        provisioning.enabled = false;
-        id = "telegram";
-	bot_username = "telegrambridge";
-        public = {
-          enabled = false;
-          prefix = "/public";
-          external = "https://chat.sealight.xyz/public";
-        };
-	address = "http://localhost:18787";
-	port = 18787;
-        # The service uses SQLite by default, but it's also possible to use PostgreSQL instead:
-        #database = "postgresql:///mautrix-telegram?host=/run/postgresql";
-      };
-      bridge = {
-        relaybot.authless_portals = false;
-        permissions = {
-          "@aynish:sealight.xyz" = "admin";
-        };
-      };
-    };
-  };
-
-  services.mautrix-whatsapp = {
-    enable = false;
-    # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
-    #configOptions = {
-    #  homeserver = {
-    #    address = "https://chat.sealight.xyz";
-    #    domain = "sealight.xyz";
-    #  };
-    #  appservice = {
-    #    id = "whatsapp";
-    #    address = http://localhost:9897;
-    #    hostname = "0.0.0.0";
-    #    port = 9897;
-    #    database = {
-    #      type = "sqlite3";
-    #      uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
-    #    };
-    #    state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json";
-    #    bot = {
-    #      username = "whatsappbot";
-    #      displayname = "WhatsApp bridge bot";
-    #      avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
-    #    };
-    #    as_token = "";
-    #    hs_token = "";
-    #  };
-    #  bridge = {
-    #    username_template = "whatsapp_{{.}}";
-    #    displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
-    #    command_prefix = "!wa";
-    #    permissions = {
-    #    	"@aynish:sealight.xyz" = 100;
-    #    };
-    #  };
-    #  logging = {
-    #    directory = "/var/lib/mautrix-whatsapp/logs";
-    #    file_name_format = "{{.Date}}-{{.Index}}.log";
-    #    file_date_format = "\"2006-01-02\"";
-    #    file_mode = 384;
-    #    timestamp_format = "Jan _2, 2006 15:04:05";
-    #    print_level = "debug";
-    #  };
-    #  metrics = {
-    #    enabled = true;
-    #    listen  = "http://localhost:5070";
-    #  };
-    #};
-  };
-
-  services.mx-puppet-discord = {
-    enable = true;
-    settings = {
-      bridge = { 
-	bindAddress = "localhost";
-	port = 16785;
- 	domain = "sealight.xyz";
- 	homeserverUrl = "https://sealight.xyz";
-	avatarUrl = "https://discord.com/assets/2d20a45d79110dc5bf947137e9d99b66.svg";
-      };
-      provisioning = {
-	whitelist = [ "@aynish:sealight.xyz" ];
-      };
-      relay = {
-	whitelist = [ "@aynish:sealight.xyz" ];
-      };
-      namePatterns = {
-        group = ":name";
-        room = ":name";
-        user = ":name (Discord)";
-        userOverride = ":displayname";
-      };
-      presence = {
-        enabled = false;
-      };
-    };
-    serviceDependencies = ["matrix-synapse.service"];
-  };
-
-  #services.mx-puppet-slack= {
-    #enable = false;
-    #settings = {
-    #  bridge = { 
-    #    bindAddress = "localhost";
-    #    port = 16786;
-    #    domain = "sealight.xyz";
-    #    homeserverUrl = "https://sealight.xyz";
-    #  };
-    #  provisioning = {
-    #    whitelist = [ "@aynish:sealight.xyz" ];
-    #  };
-    #  relay = {
-    #    whitelist = [ "@aynish:sealight.xyz" ];
-    #  };
-    #  namePatterns = {
-    #    group = ":name";
-    #    room = ":name[:team? - :team,]";
-    #    user = ":name (Slack)";
-    #    userOverride = ":displayname";
-    #  };
-    #  presence = {
-    #    enabled = false;
-    #  };
-    #  oauth = {
-    #    enabled = false;
-    #  };
-    #};
-    #serviceDependencies = ["matrix-synapse.service"];
-  #};
-
-  services.heisenbridge = {
-    enable = true;
-    homeserver = "https://sealight.xyz";
-    listenPort = 14456;
-    appServiceToken = "wyujLh8kjpmk2bfKeEE3sZ2gWOEUBKK5"; 
-    homeserverToken = "yEHs7lthD2ZHUibJOAv1APaFhEjxN5PT";
-  };
-
-  services.postgresql = {
-    enable = true;
-    ## postgresql user and db name remains in the
-    ## service.matrix-synapse.database_args setting which
-    ## by default is matrix-synapse
-    initialScript = pkgs.writeText "synapse-init.sql" ''
-        CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|'kq@iBwlIzu";
-        CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
-            TEMPLATE template0
-            LC_COLLATE = "C"
-            LC_CTYPE = "C";
-        '';
-  };
-
-  networking.firewall = let
-  range = with config.services.coturn; [ {
-      from = min-port;
-      to = max-port;
-    } ]; 
-    in {
-    enable = true;
-    allowedUDPPortRanges = range; # coturn
-    allowedTCPPortRanges = range;
-    allowedTCPPorts = [
-      22    # SSH
-      8448  # Matrix federation
-      8008
-      80 
-      443
-      3478 # Coturn service
-      5349 # Coturn service
-      9090 # Synapse Metrics
-    ];
-    allowedUDPPorts = [ 
-      3478
-      5349 # Coturn service
-    ];
-  };
-
- nixpkgs.overlays = [
-    (self: super: {
-        element-web = super.element-web.override {
-            conf = {
-                 default_server_config = {
-                    "m.homeserver" = {
-                        "base_url" = "https://chat.sealight.xyz";
-                        "server_name" = "sealight.xyz";
-                    };
-                    "m.identity_server" = {
-                        "base_url" = "https://vector.im";
-                    };
-                 };
-
-                 ## jitsi will be setup later,
-                 ## but we need to add to Riot configuration
-                 jitsi.preferredDomain = "jitsi.sealight.xyz";
-            };
-        };
-    })
-  ];
-
-  services.nginx = {
-   enable = true;
-   virtualHosts = {
-
-     "sealight.xyz" = {
-       forceSSL = true;
-       enableACME = true;
-       locations."/" = {
-         root = "/var/www/sealight.xyz";
-       };
-       locations."/_matrix" = {
-         proxyPass = "http://localhost:8448";
-       };
-       locations."/slackbridge" = {
-         proxyPass = "http://localhost:9899";
-       };
-     };
-
-     ## virtual host for Synapse
-     "chat.sealight.xyz" = {
-       forceSSL = true;
-       enableACME = true;
-       #useACMEHost = "sealight.xyz";
-       locations."/" = {
-         proxyPass = "http://localhost:8448";
-       };
-     };
-
-     ## virtual host for Riot/Web
-     "element.sealight.xyz" = {
-       forceSSL = true;
-       enableACME = true;
-       #useACMEHost = "sealight.xyz";
-
-       ## root points to the riot-web package content, also configured via Nix
-       locations."/" = {
-           root = pkgs.element-web;
-       };
-     };
- 
-     ${config.services.jitsi-meet.hostName} = {
-       enableACME = true;
-       forceSSL = true;
-     };
-   };
-   ## other nginx specific best practices
-   recommendedGzipSettings = true;
-   recommendedOptimisation = true;
-   recommendedTlsSettings = true;
-  };
-
-  environment.systemPackages = with pkgs; [ matrix-appservice-slack ];
-}

profiles/helix-zone/monitoring.nix

@@ -1,159 +0,0 @@
-{ config, pkgs, ... }: {
-  # grafana configuration
-  #services.grafana = {
-  #  enable = true;
-  #  domain = "grafana.mossnet.lan";
-  #  port = 2342;
-  #  addr = "127.0.0.1";
-  #};
-  #
-  ## nginx reverse proxy
-  #services.nginx.virtualHosts.${config.services.grafana.domain} = {
-  #  locations."/" = {
-  #      proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
-  #      proxyWebsockets = true;
-  #  };
-  #};
-
-  services.prometheus = {
-    enable = true;
-    port = 9001;
-    exporters = {
-      node = {
-	enable = true;
-	enabledCollectors = [ "systemd" ];
-	port = 9002;
-      };
-    };
-    rules = [
-      ''
-groups:
-- name: synapse
-  rules:
-  - record: "synapse_federation_transaction_queue_pendingEdus:total"
-    expr: "sum(synapse_federation_transaction_queue_pendingEdus or absent(synapse_federation_transaction_queue_pendingEdus)*0)"
-  - record: "synapse_federation_transaction_queue_pendingPdus:total"
-    expr:   "sum(synapse_federation_transaction_queue_pendingPdus or absent(synapse_federation_transaction_queue_pendingPdus)*0)"
-  - record: 'synapse_http_server_request_count:method'
-    labels:
-      servlet: ""
-    expr: "sum(synapse_http_server_request_count) by (method)"
-  - record: 'synapse_http_server_request_count:servlet'
-    labels:
-      method: ""
-    expr: 'sum(synapse_http_server_request_count) by (servlet)'
-
-  - record: 'synapse_http_server_request_count:total'
-    labels:
-      servlet: ""
-    expr: 'sum(synapse_http_server_request_count:by_method) by (servlet)'
-
-  - record: 'synapse_cache:hit_ratio_5m'
-    expr: 'rate(synapse_util_caches_cache:hits[5m]) / rate(synapse_util_caches_cache:total[5m])'
-  - record: 'synapse_cache:hit_ratio_30s'
-    expr: 'rate(synapse_util_caches_cache:hits[30s]) / rate(synapse_util_caches_cache:total[30s])'
-
-  - record: 'synapse_federation_client_sent'
-    labels:
-      type: "EDU"
-    expr: 'synapse_federation_client_sent_edus + 0'
-  - record: 'synapse_federation_client_sent'
-    labels:
-      type: "PDU"
-    expr: 'synapse_federation_client_sent_pdu_destinations:count + 0'
-  - record: 'synapse_federation_client_sent'
-    labels:
-      type: "Query"
-    expr: 'sum(synapse_federation_client_sent_queries) by (job)'
-
-  - record: 'synapse_federation_server_received'
-    labels:
-      type: "EDU"
-    expr: 'synapse_federation_server_received_edus + 0'
-  - record: 'synapse_federation_server_received'
-    labels:
-      type: "PDU"
-    expr: 'synapse_federation_server_received_pdus + 0'
-  - record: 'synapse_federation_server_received'
-    labels:
-      type: "Query"
-    expr: 'sum(synapse_federation_server_received_queries) by (job)'
-
-  - record: 'synapse_federation_transaction_queue_pending'
-    labels:
-      type: "EDU"
-    expr: 'synapse_federation_transaction_queue_pending_edus + 0'
-  - record: 'synapse_federation_transaction_queue_pending'
-    labels:
-      type: "PDU"
-    expr: 'synapse_federation_transaction_queue_pending_pdus + 0'
-
-  - record: synapse_storage_events_persisted_by_source_type
-    expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_type="remote"})
-    labels:
-      type: remote
-  - record: synapse_storage_events_persisted_by_source_type
-    expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity="*client*",origin_type="local"})
-    labels:
-      type: local
-  - record: synapse_storage_events_persisted_by_source_type
-    expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity!="*client*",origin_type="local"})
-    labels:
-      type: bridges
-  - record: synapse_storage_events_persisted_by_event_type
-    expr: sum without(origin_entity, origin_type) (synapse_storage_events_persisted_events_sep)
-  - record: synapse_storage_events_persisted_by_origin
-    expr: sum without(type) (synapse_storage_events_persisted_events_sep)
-      ''
-    ];
-    scrapeConfigs = [
-      {
-	job_name = "helix";
-	static_configs = [{
-	  targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
-	}];
-      }
-      {
-	job_name = "synapse";
-	metrics_path = "/_synapse/metrics";
-	static_configs = [{
-	  targets = [ "localhost:9090" ];
-      }];
-      }
-      {
-        job_name = "gitea";
-        static_configs = [{
-          targets = [ "localhost:3001" ];
-        }];
-      }
-    ];
-  };
-
-  networking.firewall = {
-    enable = true;
-    allowedTCPPorts = [ 9001 ];
-  };
-
-  services.nginx.virtualHosts."sealight.xyz" = {
-    locations."/metrics" = {
-      #basicAuth = { anish = "password"; };
-      proxyPass = "http://localhost:9001";
-    };
-  };
-
-  services.loki = {
-    enable = true;
-    configFile = /var/loki-config.yaml;
-  };
-
-  systemd.services.promtail = {
-    description = "Promtail service for Loki";
-    wantedBy = [ "multi-user.target" ];
-
-    serviceConfig = {
-      ExecStart = ''
-        ${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml}
-      '';
-    };
-  };
-}

profiles/helix-zone/rss-bridge.nix

@@ -1,11 +0,0 @@
-{pkgs, lib, config, ...}:
-{
-  services.rss-bridge = {
-    enable = true;
-    virtualHost = "bridge.sealight.xyz";
-    whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit"];
-  };
-
-  services.nginx.virtualHosts."bridge.sealight.xyz".forceSSL = true;
-  services.nginx.virtualHosts."bridge.sealight.xyz".enableACME = true;
-}

profiles/helix-zone/sealight.nix

@@ -1,14 +0,0 @@
-{
-   services.nginx = {
-      enable = true;
-      vhost = { 
-	  "sealight.xyz" = {
-		  forceSSL = true;
-		  enableACME = true;
-		  locations."/" = {
-		    root = "/var/www/sealight.xyz"
-		  };
-      };
-    };
-   };
-}

profiles/helix-zone/wireguard.nix

@@ -1,32 +0,0 @@
-{ config, pkgs, lib, ... }:
-{ 
-  environment.systemPackages = [ pkgs.wireguard pkgs.mosh ];
-  networking.nat = {
-      enable = true;
-      externalInterface = "ens3";
-      internalInterfaces = [ "wg0" ];
-  };
-  networking.firewall = {
-    allowedUDPPorts = [ 60990 ];
-  };
-
-  networking.wireguard.interfaces.wg0 = {
-    ips = [ "10.0.69.1/24" ];
-    listenPort = 60990;
-    privateKeyFile = "/var/lib/wireguard/priv";
-    peers = [
-    { # box
-      publicKey = "Ra78mOc110K7URN5uB3m9d78iBKgeRHzT+3HkiFp9BU=";
-      allowedIPs = [ "10.0.69.4/32" ];
-    }
-    { # line
-      publicKey = "fsb1FuGmYi89p4CVXytKw2FYamONKtoanxrgs/dJjC8=";
-      allowedIPs = [ "10.0.69.3/32" ];
-    }
-    { # curve
-      publicKey = "XmV4AcPPND/eeSI6d9M1iahCjtymqY6DdUDEFNP/x3g=";
-      allowedIPs = [ "10.0.69.2/32" ];
-    }
-];
-  };
-}

profiles/matrix/default.nix

@@ -1,3 +1,5 @@
+{ config, lib, pkgs, ... }:
+
 {
   security.acme.email = "anish+acme@lakhwara.com";
   security.acme.acceptTerms = true;
@@ -7,19 +9,39 @@
       #  # The registration file is automatically generated after starting the appservice for the first time.
       #  # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/
       #  # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml
-    #   "/var/lib/matrix-synapse/discord-registration.yaml"
+      "/var/lib/matrix-synapse/discord-registration.yaml"
-    #   "/var/lib/matrix-synapse/telegram-registration.yaml"
+      "/var/lib/matrix-synapse/telegram-registration.yaml"
-    #   "/var/lib/matrix-synapse/slack-registration.yaml"
+      #"/var/lib/matrix-synapse/slack-registration.yaml"
-    #  # "/var/lib/matrix-synapse/whatsapp-registration.yaml"
+      #"/var/lib/matrix-synapse/whatsapp-registration.yaml"
     ];
     server_name = "sealight.xyz";
-    registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; # TODO use agnix
+    registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU";
     enable_metrics = true;
     enable_registration = true;
     database_type = "psycopg2";
     database_args = {
       database = "matrix-synapse";
     };
+    listeners = [
+      {
+        port = 8448;
+        tls = false;
+        resources = [{
+          compress = true;
+          names = [ "client" "federation" ];
+        }];
+      }
+      {
+        port = 9090;
+        type = "metrics";
+        bind_address = "0.0.0.0";
+        resources = [{
+          compress = false;
+          names = [ ];
+        }];
+        tls = false;
+      }
+    ];
     extraConfig = ''
       max_upload_size: "50M"
       use_presence: false
@@ -32,27 +54,6 @@
       "turn:turn.sealight.xyz:3478?transport=tcp"
     ];
     turn_shared_secret = config.services.coturn.static-auth-secret;
-
-    listeners = [
-      {
-        port = 8448;
-        tls = false;
-        resources = [{
-            compress = true;
-            names = ["client" "federation"];
-          }];
-      }
-      {
-        port = 9090;
-        type = "metrics";
-        bind_address = "0.0.0.0";
-        resources = [{ 
-          compress = false;
-          names = [];
-        }];
-        tls = false;
-      }
-    ];
   };
 
   services.coturn = {
@@ -60,27 +61,45 @@
     use-auth-secret = true;
     static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ";
     realm = "turn.sealight.xyz";
+    min-port = 49111;
+    max-port = 51111;
+    no-cli = true;
     no-tcp-relay = true;
     no-tls = true;
-    no-dtls = true;
+    cert = "${config.security.acme.certs."turn.sealight.xyz".directory}/full.pem";
+    pkey = "${config.security.acme.certs."turn.sealight.xyz".directory}/key.pem";
     extraConfig = ''
+      verbose
       user-quota=12
       total-quota=1200
       denied-peer-ip=10.0.0.0-10.255.255.255
       denied-peer-ip=192.168.0.0-192.168.255.255
       denied-peer-ip=172.16.0.0-172.31.255.255
-
+      denied-peer-ip=0.0.0.0-0.255.255.255
-        allowed-peer-ip=192.168.191.127
+      denied-peer-ip=100.64.0.0-100.127.255.255
+      denied-peer-ip=127.0.0.0-127.255.255.255
+      denied-peer-ip=169.254.0.0-169.254.255.255
+      denied-peer-ip=192.0.0.0-192.0.0.255
+      denied-peer-ip=192.0.2.0-192.0.2.255
+      denied-peer-ip=192.88.99.0-192.88.99.255
+      denied-peer-ip=198.18.0.0-198.19.255.255
+      denied-peer-ip=198.51.100.0-198.51.100.255
+      denied-peer-ip=203.0.113.0-203.0.113.255
+      denied-peer-ip=240.0.0.0-255.255.255.255
     '';
   };
 
+  security.acme.certs.${config.services.coturn.realm} = {
+    /* insert here the right configuration to obtain a certificate */
+    webroot = "/var/lib/acme/acme-challenge/";
+    email = "anish+acme@lakhwara.com";
+    postRun = "systemctl restart coturn.service";
+    group = "turnserver";
+  };
+
   services.jitsi-meet = {
     enable = true;
     hostName = "jitsi.sealight.xyz";
-
-    ## this setting is going to add relevant ports to
-    ## networking.firewall.allowedTCPPorts &
-    ## networking.firewall.allowedUDPPorts
   };
   services.jitsi-videobridge.enable = true;
 
@@ -90,17 +109,20 @@
     # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
     settings = {
       homeserver = {
-        address = "https://chat.sealight.xyz";
+        address = "https://sealight.xyz";
         domain = "sealight.xyz";
       };
       appservice = {
         provisioning.enabled = false;
         id = "telegram";
+        bot_username = "telegrambridge";
         public = {
           enabled = false;
           prefix = "/public";
           external = "https://chat.sealight.xyz/public";
         };
+        address = "http://localhost:18787";
+        port = 18787;
         # The service uses SQLite by default, but it's also possible to use PostgreSQL instead:
         #database = "postgresql:///mautrix-telegram?host=/run/postgresql";
       };
@@ -113,96 +135,41 @@
     };
   };
 
-  services.mautrix-whatsapp = {
+  services.mx-puppet-discord = {
     enable = true;
-    # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
+    settings = {
-    configOptions = {
-      homeserver = {
-        address = "https://chat.sealight.xyz";
-        domain = "sealight.xyz";
-      };
-      appservice = {
-        id = "whatsapp";
-        address = http://localhost:9897;
-        hostname = "0.0.0.0";
-        port = 9897;
-        database = {
-  	  type = "sqlite3";
-  	  uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
-        };
-        state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json";
-        bot = {
-          username = "whatsappbot";
-          displayname = "WhatsApp bridge bot";
-          avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
-        };
-        as_token = "";
-        hs_token = "";
-      };
       bridge = {
-        username_template = "whatsapp_{{.}}";
+        bindAddress = "localhost";
-        displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
+        port = 16785;
-        command_prefix = "!wa";
+        domain = "sealight.xyz";
-        permissions = {
+        homeserverUrl = "https://sealight.xyz";
-        	"@aynish:sealight.xyz" = 100;
+        avatarUrl = "https://discord.com/assets/2d20a45d79110dc5bf947137e9d99b66.svg";
-        };
+      };
-      };
+      provisioning = {
-      logging = {
+        whitelist = [ "@aynish:sealight.xyz" ];
-        directory = "/var/lib/mautrix-whatsapp/logs";
+      };
-        file_name_format = "{{.Date}}-{{.Index}}.log";
+      relay = {
-        file_date_format = "\"2006-01-02\"";
+        whitelist = [ "@aynish:sealight.xyz" ];
-        file_mode = 384;
+      };
-        timestamp_format = "Jan _2, 2006 15:04:05";
+      namePatterns = {
-        print_level = "debug";
+        group = ":name";
-      };
+        room = ":name";
-      metrics = {
+        user = ":name (Discord)";
-        enabled = true;
+        userOverride = ":displayname";
-        listen  = "http://localhost:5070";
+      };
+      presence = {
+        enabled = false;
       };
     };
+    serviceDependencies = [ "matrix-synapse.service" ];
   };
 
-  services.matrix-appservice-slack = {
+  services.heisenbridge = {
     enable = true;
-    #environmentFile = /etc/secrets/matrix-appservice-slack.env;
+    homeserver = "https://sealight.xyz";
-    settings = {
+    listenPort = 14456;
-      homeserver = {
+    appServiceToken = "wyujLh8kjpmk2bfKeEE3sZ2gWOEUBKK5";
-        server_name = "sealight.xyz";
+    homeserverToken = "yEHs7lthD2ZHUibJOAv1APaFhEjxN5PT";
-        url = "https://chat.sealight.xyz";
-      };
-      db = {
-        engine = "postgres";
-        connectionString = "postgres://slackbridge_user:somethingverysecret@localhost/slack_bridge?sslmode=require";
-      };
-      matrix_admin_room = "!ikEWOHCcmoZtVzSmPF:sealight.xyz";
-      username_prefix = "slack_";
-      rtm = {
-        enable = true;
-        logging = "silent";
-      };
-      slack_hook_port = 9899;
-      enable_metrics = true;
-      puppeting = {
-        enabled = true;
-        onboard_users = true;
-      };
-      oauth2 = {
-        client_id = "2832868673.1609454840563";
-        client_secret = "079a7ca42b192e66a9ff32740a69cb9d";
-        redirect_prefix = "https://sealight.xyz/slackbridge/";
-      };
-      #team_sync = {
-      #  T02QGRJKT = {
-      #    users = {
-      #      enabled = false;
-      #    };
-      #    channels = {
-      #       enabled = true;
-      #       alias_prefix = "qf_";
-      #    };
-      #  };
-      #};
-    };
   };
 
   services.postgresql = {
@@ -219,16 +186,30 @@
     '';
   };
 
-  networking.firewall = {
+  networking.firewall =
+    let
+      range = with config.services.coturn; [{
+        from = min-port;
+        to = max-port;
+      }];
+    in
+    {
       enable = true;
+      allowedUDPPortRanges = range; # coturn
+      allowedTCPPortRanges = range;
       allowedTCPPorts = [
         22 # SSH
         8448 # Matrix federation
         8008
         80
         443
+        3478 # Coturn service
+        5349 # Coturn service
         9090 # Synapse Metrics
-      9899 # Matrix <-> Slack Bridge Puppeting
+      ];
+      allowedUDPPorts = [
+        3478
+        5349 # Coturn service
       ];
     };
 
@@ -257,7 +238,6 @@
   services.nginx = {
     enable = true;
     virtualHosts = {
-
       "sealight.xyz" = {
         forceSSL = true;
         enableACME = true;
@@ -271,7 +251,6 @@
           proxyPass = "http://localhost:9899";
         };
       };
-
       ## virtual host for Synapse
       "chat.sealight.xyz" = {
         forceSSL = true;
@@ -281,19 +260,16 @@
           proxyPass = "http://localhost:8448";
         };
       };
-
       ## virtual host for Riot/Web
       "element.sealight.xyz" = {
         forceSSL = true;
         enableACME = true;
         #useACMEHost = "sealight.xyz";
-
         ## root points to the riot-web package content, also configured via Nix
         locations."/" = {
           root = pkgs.element-web;
         };
       };
- 
       ${config.services.jitsi-meet.hostName} = {
         enableACME = true;
         forceSSL = true;
@@ -305,5 +281,86 @@
     recommendedTlsSettings = true;
   };
 
-  environment.systemPackages = with pkgs; [ matrix-appservice-slack ];
+  # environment.systemPackages = with pkgs; [ matrix-appservice-slack ];
+  #services.mx-puppet-slack= {
+  #enable = false;
+  #settings = {
+  #  bridge = { 
+  #    bindAddress = "localhost";
+  #    port = 16786;
+  #    domain = "sealight.xyz";
+  #    homeserverUrl = "https://sealight.xyz";
+  #  };
+  #  provisioning = {
+  #    whitelist = [ "@aynish:sealight.xyz" ];
+  #  };
+  #  relay = {
+  #    whitelist = [ "@aynish:sealight.xyz" ];
+  #  };
+  #  namePatterns = {
+  #    group = ":name";
+  #    room = ":name[:team? - :team,]";
+  #    user = ":name (Slack)";
+  #    userOverride = ":displayname";
+  #  };
+  #  presence = {
+  #    enabled = false;
+  #  };
+  #  oauth = {
+  #    enabled = false;
+  #  };
+  #};
+  #serviceDependencies = ["matrix-synapse.service"];
+  #};
+
+  # services.mautrix-whatsapp = {
+  #   enable = false;
+  # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
+  #configOptions = {
+  #  homeserver = {
+  #    address = "https://chat.sealight.xyz";
+  #    domain = "sealight.xyz";
+  #  };
+  #  appservice = {
+  #    id = "whatsapp";
+  #    address = http://localhost:9897;
+  #    hostname = "0.0.0.0";
+  #    port = 9897;
+  #    database = {
+  #      type = "sqlite3";
+  #      uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
+  #    };
+  #    state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json";
+  #    bot = {
+  #      username = "whatsappbot";
+  #      displayname = "WhatsApp bridge bot";
+  #      avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
+  #    };
+  #    as_token = "";
+  #    hs_token = "";
+  #  };
+  #  bridge = {
+  #    username_template = "whatsapp_{{.}}";
+  #    displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
+  #    command_prefix = "!wa";
+  #    permissions = {
+  #      "@aynish:sealight.xyz" = 100;
+  #    };
+  #  };
+  #  logging = {
+  #    directory = "/var/lib/mautrix-whatsapp/logs";
+  #    file_name_format = "{{.Date}}-{{.Index}}.log";
+  #    file_date_format = "\"2006-01-02\"";
+  #    file_mode = 384;
+  #    timestamp_format = "Jan _2, 2006 15:04:05";
+  #    print_level = "debug";
+  #  };
+  #  metrics = {
+  #    enabled = true;
+  #    listen  = "http://localhost:5070";
+  #  };
+  #};
+  # };
+
+
 }

profiles/matrix/matrix-slack.nix

@@ -10,7 +10,8 @@ let
   # TODO: switch to configGen.json once RFC42 is implemented
   settingsFile = pkgs.writeText "matrix-appservice-slack-settings.json" (builtins.toJSON cfg.settings);
 
-in {
+in
+{
   options = {
     services.matrix-appservice-slack = {
       enable = mkEnableOption "a bridge between Matrix and Slack";

profiles/matrix/mautrix-whatsapp.nix

@@ -5,7 +5,8 @@ with lib;
 let
   cfg = config.services.mautrix-whatsapp;
 
-  configFile = pkgs.runCommand "mautrix-whatsapp" {
+  configFile = pkgs.runCommand "mautrix-whatsapp"
+    {
       buildInputs = [ pkgs.mautrix-whatsapp pkgs.remarshal ];
       preferLocalBuild = true;
     } ''

profiles/matrix/mod-mx-puppet-slack.nix

@@ -6,11 +6,12 @@ let
   dataDir = "/var/lib/mx-puppet-slack";
   registrationFile = "${dataDir}/slack-registration.yaml";
   cfg = config.services.mx-puppet-slack;
-  settingsFormat = pkgs.formats.json {};
+  settingsFormat = pkgs.formats.json { };
   settingsFile = settingsFormat.generate "mx-puppet-slack-config.json" cfg.settings;
   mx-puppet-slack = pkgs.callPackage ./pkg-mx-puppet-slack.nix { };
 
-in {
+in
+{
   options = {
     services.mx-puppet-slack = {
       enable = mkEnableOption ''

profiles/metrics/default.nix

@@ -0,0 +1,159 @@
+{ config, pkgs, ... }: {
+  # grafana configuration
+  #services.grafana = {
+  #  enable = true;
+  #  domain = "grafana.mossnet.lan";
+  #  port = 2342;
+  #  addr = "127.0.0.1";
+  #};
+  #
+  ## nginx reverse proxy
+  #services.nginx.virtualHosts.${config.services.grafana.domain} = {
+  #  locations."/" = {
+  #      proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
+  #      proxyWebsockets = true;
+  #  };
+  #};
+
+  services.prometheus = {
+    enable = true;
+    port = 9001;
+    exporters = {
+      node = {
+        enable = true;
+        enabledCollectors = [ "systemd" ];
+        port = 9002;
+      };
+    };
+    rules = [
+      ''
+        groups:
+        - name: synapse
+          rules:
+          - record: "synapse_federation_transaction_queue_pendingEdus:total"
+            expr: "sum(synapse_federation_transaction_queue_pendingEdus or absent(synapse_federation_transaction_queue_pendingEdus)*0)"
+          - record: "synapse_federation_transaction_queue_pendingPdus:total"
+            expr:   "sum(synapse_federation_transaction_queue_pendingPdus or absent(synapse_federation_transaction_queue_pendingPdus)*0)"
+          - record: 'synapse_http_server_request_count:method'
+            labels:
+              servlet: ""
+            expr: "sum(synapse_http_server_request_count) by (method)"
+          - record: 'synapse_http_server_request_count:servlet'
+            labels:
+              method: ""
+            expr: 'sum(synapse_http_server_request_count) by (servlet)'
+
+          - record: 'synapse_http_server_request_count:total'
+            labels:
+              servlet: ""
+            expr: 'sum(synapse_http_server_request_count:by_method) by (servlet)'
+
+          - record: 'synapse_cache:hit_ratio_5m'
+            expr: 'rate(synapse_util_caches_cache:hits[5m]) / rate(synapse_util_caches_cache:total[5m])'
+          - record: 'synapse_cache:hit_ratio_30s'
+            expr: 'rate(synapse_util_caches_cache:hits[30s]) / rate(synapse_util_caches_cache:total[30s])'
+
+          - record: 'synapse_federation_client_sent'
+            labels:
+              type: "EDU"
+            expr: 'synapse_federation_client_sent_edus + 0'
+          - record: 'synapse_federation_client_sent'
+            labels:
+              type: "PDU"
+            expr: 'synapse_federation_client_sent_pdu_destinations:count + 0'
+          - record: 'synapse_federation_client_sent'
+            labels:
+              type: "Query"
+            expr: 'sum(synapse_federation_client_sent_queries) by (job)'
+
+          - record: 'synapse_federation_server_received'
+            labels:
+              type: "EDU"
+            expr: 'synapse_federation_server_received_edus + 0'
+          - record: 'synapse_federation_server_received'
+            labels:
+              type: "PDU"
+            expr: 'synapse_federation_server_received_pdus + 0'
+          - record: 'synapse_federation_server_received'
+            labels:
+              type: "Query"
+            expr: 'sum(synapse_federation_server_received_queries) by (job)'
+
+          - record: 'synapse_federation_transaction_queue_pending'
+            labels:
+              type: "EDU"
+            expr: 'synapse_federation_transaction_queue_pending_edus + 0'
+          - record: 'synapse_federation_transaction_queue_pending'
+            labels:
+              type: "PDU"
+            expr: 'synapse_federation_transaction_queue_pending_pdus + 0'
+
+          - record: synapse_storage_events_persisted_by_source_type
+            expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_type="remote"})
+            labels:
+              type: remote
+          - record: synapse_storage_events_persisted_by_source_type
+            expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity="*client*",origin_type="local"})
+            labels:
+              type: local
+          - record: synapse_storage_events_persisted_by_source_type
+            expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity!="*client*",origin_type="local"})
+            labels:
+              type: bridges
+          - record: synapse_storage_events_persisted_by_event_type
+            expr: sum without(origin_entity, origin_type) (synapse_storage_events_persisted_events_sep)
+          - record: synapse_storage_events_persisted_by_origin
+            expr: sum without(type) (synapse_storage_events_persisted_events_sep)
+      ''
+    ];
+    scrapeConfigs = [
+      {
+        job_name = "helix";
+        static_configs = [{
+          targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
+        }];
+      }
+      {
+        job_name = "synapse";
+        metrics_path = "/_synapse/metrics";
+        static_configs = [{
+          targets = [ "localhost:9090" ];
+        }];
+      }
+      {
+        job_name = "gitea";
+        static_configs = [{
+          targets = [ "localhost:3001" ];
+        }];
+      }
+    ];
+  };
+
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [ 9001 ];
+  };
+
+  services.nginx.virtualHosts."sealight.xyz" = {
+    locations."/metrics" = {
+      #basicAuth = { anish = "password"; };
+      proxyPass = "http://localhost:9001";
+    };
+  };
+
+  services.loki = {
+    enable = true;
+    configFile = /var/loki-config.yaml;
+  };
+
+  systemd.services.promtail = {
+    description = "Promtail service for Loki";
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml}
+      '';
+    };
+  };
+}

profiles/mossnet-hosts/default.nix

@@ -5,6 +5,7 @@
     192.168.1.240 read.mossnet.lan
     192.168.1.240 music.mossnet.lan
     192.168.1.240 stats.mossnet.lan
+    192.168.1.240 file.mossnet.lan
   '';
   # 10.0.69.4 mossnet.lan
   #  10.0.69.4 links.mossnet.lan

profiles/rss-bridge/default.nix

@@ -1,14 +1,11 @@
-{pkgs, lib, config, ...}:
+{ pkgs, lib, config, ... }:
 {
   services.rss-bridge = {
     enable = true;
-    virtualHost = "rss.mossnet.lan";
+    virtualHost = "bridge.sealight.xyz";
-    whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram"];
+    whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit" ];
-    #dataDir = "/etc/rss-bridge/";
   };
-  #environment.etc."rss-bridge/config.ini.php" = ''
+
-  #  [InstagramBridge]
+  services.nginx.virtualHosts."bridge.sealight.xyz".forceSSL = true;
-  #  session_id = %sessionid from step 1%
+  services.nginx.virtualHosts."bridge.sealight.xyz".enableACME = true;
-  #  cache_timeout = %cache timeout in seconds%
-  #'';
 }

profiles/seafile/default.nix

@@ -7,7 +7,48 @@
       fileserver.host = "0.0.0.0";
       fileserver.port = 8082;
     };
-    ccnetSettings.General.SERVICE_URL = "file.mossnet.lan";
+    ccnetSettings.General.SERVICE_URL = "http://file.mossnet.lan";
+    adminEmail = "anish@lakhwara.com";
     initialAdminPassword = "arandompasswordsecure!";
   };
+
+  services.nginx = {
+    enable = true;
+  };
+  services.nginx.upstreams."gunicorn_seafile" = {
+    servers."unix:/run/seahub/gunicorn.sock" = { };
+  };
+  services.nginx.upstreams."seafhttp" = {
+    servers."127.0.0.1:8082" = { };
+  };
+  services.nginx.virtualHosts."file.mossnet.lan" = {
+    serverName = "file.mossnet.lan";
+    locations."/" = {
+      proxyPass = "http://gunicorn_seafile"; # without a trailing /
+      extraConfig = ''
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-Host $server_name;
+        #proxy_set_header Host $host;
+        proxy_read_timeout  1200s;
+
+        client_max_body_size 0; # disable max upload size
+      '';
+    };
+    locations."/seafhttp" = {
+      proxyPass = "http://seafhttp"; # without a trailing /
+      extraConfig = ''
+        rewrite ^/seafhttp(.*)$ $1 break;
+        client_max_body_size 0;
+
+        proxy_connect_timeout  36000s;
+        proxy_read_timeout  36000s;
+        proxy_send_timeout  36000s;
+
+        proxy_request_buffering off;
+        send_timeout  36000s;
+      '';
+    };
+  };
 }

profiles/sealight-website/default.nix

@@ -0,0 +1,14 @@
+{
+  services.nginx = {
+    enable = true;
+    vhost = {
+      "sealight.xyz" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          root = "/var/www/sealight.xyz"
+            };
+        };
+      };
+    };
+  }

profiles/syncthing/default.nix

@@ -7,8 +7,8 @@
     group = "users";
     dataDir = "/home/anish/";
     configDir = "/home/anish/.config/syncthing";
-    guiAddress = "0.0.0.0:8384";
   };
 
   networking.firewall.allowedTCPPorts = [ 8384 22000 ];
+  networking.firewall.allowedUDPPorts = [ 22000 21027 ];
 }

profiles/wireguard-server/default.nix

@@ -0,0 +1,35 @@
+{ config, pkgs, lib, ... }:
+{
+  environment.systemPackages = [ pkgs.wireguard pkgs.mosh ];
+  networking.nat = {
+    enable = true;
+    externalInterface = "ens3";
+    internalInterfaces = [ "wg0" ];
+  };
+  networking.firewall = {
+    allowedUDPPorts = [ 60990 ];
+  };
+
+  networking.wireguard.interfaces.wg0 = {
+    ips = [ "10.0.69.1/24" ];
+    listenPort = 60990;
+    privateKeyFile = "/var/lib/wireguard/priv";
+    peers = [
+      {
+        # box
+        publicKey = "Ra78mOc110K7URN5uB3m9d78iBKgeRHzT+3HkiFp9BU=";
+        allowedIPs = [ "10.0.69.4/32" ];
+      }
+      {
+        # line
+        publicKey = "fsb1FuGmYi89p4CVXytKw2FYamONKtoanxrgs/dJjC8=";
+        allowedIPs = [ "10.0.69.3/32" ];
+      }
+      {
+        # curve
+        publicKey = "XmV4AcPPND/eeSI6d9M1iahCjtymqY6DdUDEFNP/x3g=";
+        allowedIPs = [ "10.0.69.2/32" ];
+      }
+    ];
+  };
+}