moving helix into profiles
This commit is contained in:
parent
4a7e9d536b
commit
7ac844b1f9
|
|
@ -1,10 +0,0 @@
|
||||||
{ pkgs, lib, budUtils, ... }: {
|
|
||||||
bud.cmds = with pkgs; {
|
|
||||||
get = {
|
|
||||||
writer = budUtils.writeBashWithPaths [ nixUnstable git coreutils ];
|
|
||||||
synopsis = "get [DEST]";
|
|
||||||
help = "Copy the desired template to DEST";
|
|
||||||
script = ./get.bash;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
nix flake new -t "github:divnix/devos/core" "${2:-devos}"
|
|
||||||
12
flake.nix
12
flake.nix
|
|
@ -1,10 +1,6 @@
|
||||||
{
|
{
|
||||||
description = "A highly structured configuration database.";
|
description = "A highly structured configuration database.";
|
||||||
|
|
||||||
nixConfig.extra-experimental-features = "nix-command flakes";
|
|
||||||
nixConfig.extra-substituters = "https://nrdxp.cachix.org https://nix-community.cachix.org";
|
|
||||||
nixConfig.extra-trusted-public-keys = "nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=";
|
|
||||||
|
|
||||||
inputs =
|
inputs =
|
||||||
{
|
{
|
||||||
# Nix
|
# Nix
|
||||||
|
|
@ -126,11 +122,11 @@
|
||||||
};
|
};
|
||||||
suites = with profiles; rec {
|
suites = with profiles; rec {
|
||||||
base = [ core users.root users.anish ];
|
base = [ core users.root users.anish ];
|
||||||
sealight = [ base server ]; # matrix rsshub backup wireguard-server
|
sealight = [ base server rss-bridge gitea wireguard-server metrics sealight-website ]; # matrix backup
|
||||||
mossnet = [ base server taskd shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale seafile syncthing ]; # hpi syncthing sync.music
|
mossnet = [ base server taskd shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale seafile syncthing ]; # hpi sync.music
|
||||||
cube = [ base site server ];
|
cube = [ base site server ];
|
||||||
graphical = [ base bluetooth music sync.kitaab sync.website sync.cal wifi desktop ]; # syncthing
|
graphical = [ base bluetooth music sync.kitaab sync.website sync.cal wifi desktop ];
|
||||||
curve = [ graphical secrets ];
|
curve = [ graphical secrets syncthing ];
|
||||||
work = [ base ];
|
work = [ base ];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -9,6 +9,7 @@
|
||||||
};
|
};
|
||||||
|
|
||||||
# For some reason this doesn't work in the profile, but does over here??
|
# For some reason this doesn't work in the profile, but does over here??
|
||||||
|
# Something weird in the way I'm importing nixpkgs in the profile or something
|
||||||
services."grasp".enable = true;
|
services."grasp".enable = true;
|
||||||
services."grasp".path = "/home/anish/kitaab/grasp";
|
services."grasp".path = "/home/anish/kitaab/grasp";
|
||||||
services."grasp".user = "anish";
|
services."grasp".user = "anish";
|
||||||
|
|
@ -28,10 +29,10 @@
|
||||||
"/var/www/shaarli-config" # sharli
|
"/var/www/shaarli-config" # sharli
|
||||||
"/var/backup/postgresql" # wallabag
|
"/var/backup/postgresql" # wallabag
|
||||||
"/var/lib/radicale" # radicale
|
"/var/lib/radicale" # radicale
|
||||||
"/home/anish/usr/syncthing" # syncthing
|
"/home/anish/usr/drawing" # syncthing
|
||||||
|
"/home/anish/usr/nonfiction" # syncthing
|
||||||
];
|
];
|
||||||
# seafile?
|
# seafile
|
||||||
# syncthing
|
|
||||||
};
|
};
|
||||||
|
|
||||||
age.secrets.box-wg.file = "${self}/secrets/box-wg.age";
|
age.secrets.box-wg.file = "${self}/secrets/box-wg.age";
|
||||||
|
|
@ -41,4 +42,5 @@
|
||||||
ips = [ "10.0.69.4/24" ];
|
ips = [ "10.0.69.4/24" ];
|
||||||
privateKeyFile = "/run/agenix/box-wg";
|
privateKeyFile = "/run/agenix/box-wg";
|
||||||
};
|
};
|
||||||
|
services.syncthing.guiAddress = "0.0.0.0:8384"; # public syncthing
|
||||||
}
|
}
|
||||||
|
|
|
||||||
37
hosts/helix/configuration.nix
Normal file
37
hosts/helix/configuration.nix
Normal file
|
|
@ -0,0 +1,37 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[
|
||||||
|
# Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
# Use the GRUB 2 boot loader.
|
||||||
|
boot.loader.grub.enable = true;
|
||||||
|
boot.loader.grub.version = 2;
|
||||||
|
boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
|
||||||
|
|
||||||
|
networking.hostName = "helix"; # Define your hostname.
|
||||||
|
|
||||||
|
networking.useDHCP = false;
|
||||||
|
networking.interfaces.ens3.useDHCP = true;
|
||||||
|
|
||||||
|
# Configure network proxy if necessary
|
||||||
|
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||||
|
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||||
|
|
||||||
|
# Enable the OpenSSH daemon.
|
||||||
|
services.openssh.enable = true;
|
||||||
|
services.openssh.passwordAuthentication = false;
|
||||||
|
services.openssh.permitRootLogin = "no";
|
||||||
|
sound.enable = false;
|
||||||
|
|
||||||
|
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||||
|
# This value determines the NixOS release with which your system is to be
|
||||||
|
# compatible, in order to avoid breaking some software such as database
|
||||||
|
# servers. You should change this only after NixOS release notes say you
|
||||||
|
# should.
|
||||||
|
system.stateVersion = "19.09"; # Did you read the comment?
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
23
hosts/helix/default.nix
Normal file
23
hosts/helix/default.nix
Normal file
|
|
@ -0,0 +1,23 @@
|
||||||
|
{ self, profiles, suites, ... }:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./configuration.nix
|
||||||
|
] ++ suites.sealight;
|
||||||
|
|
||||||
|
home-manager.users.anish = { self, suites, ... }: {
|
||||||
|
imports = [ ] ++ suites.hmBase;
|
||||||
|
};
|
||||||
|
|
||||||
|
mossnet.backup = {
|
||||||
|
enable = false;
|
||||||
|
name = "sealight";
|
||||||
|
paths = [ "/var/backup/postgresql" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
|
||||||
|
services.postgresqlBackup = {
|
||||||
|
enable = false;
|
||||||
|
databases = [ "matrix" "gitea" ];
|
||||||
|
location = "/var/backup/postgresql";
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -5,7 +5,8 @@
|
||||||
|
|
||||||
{
|
{
|
||||||
imports =
|
imports =
|
||||||
[ <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
|
[
|
||||||
|
<nixpkgs/nixos/modules/profiles/qemu-guest.nix>
|
||||||
];
|
];
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
|
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
|
||||||
|
|
@ -14,7 +15,8 @@
|
||||||
boot.extraModulePackages = [ ];
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
fileSystems."/" =
|
fileSystems."/" =
|
||||||
{ device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
|
{
|
||||||
|
device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
|
||||||
fsType = "btrfs";
|
fsType = "btrfs";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -89,7 +89,7 @@ in
|
||||||
|
|
||||||
systemd.services.heisenbridge = {
|
systemd.services.heisenbridge = {
|
||||||
description = "Heisenbridge Matrix IRC bridge";
|
description = "Heisenbridge Matrix IRC bridge";
|
||||||
after = ["matrix-synapse.service"];
|
after = [ "matrix-synapse.service" ];
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = [ "multi-user.target" ];
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
ExecStart = ''
|
ExecStart = ''
|
||||||
|
|
@ -17,18 +17,18 @@
|
||||||
ENABLED = true;
|
ENABLED = true;
|
||||||
};
|
};
|
||||||
repository = {
|
repository = {
|
||||||
DEFAULT_BRANCH = "main";
|
DEFAULT_BRANCH = "main";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
||||||
services.postgresql = {
|
services.postgresql = {
|
||||||
enable = true; # Ensure postgresql is enabled
|
enable = true; # Ensure postgresql is enabled
|
||||||
authentication = ''
|
authentication = ''
|
||||||
local gitea all ident map=gitea-users
|
local gitea all ident map=gitea-users
|
||||||
'';
|
'';
|
||||||
identMap = # Map the gitea user to postgresql
|
identMap = # Map the gitea user to postgresql
|
||||||
''
|
''
|
||||||
gitea-users gitea gitea
|
gitea-users gitea gitea
|
||||||
'';
|
'';
|
||||||
|
|
@ -39,15 +39,16 @@
|
||||||
};
|
};
|
||||||
|
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
enable = true; # Enable Nginx
|
enable = true; # Enable Nginx
|
||||||
recommendedGzipSettings = true;
|
recommendedGzipSettings = true;
|
||||||
recommendedOptimisation = true;
|
recommendedOptimisation = true;
|
||||||
recommendedProxySettings = true;
|
recommendedProxySettings = true;
|
||||||
recommendedTlsSettings = true;
|
recommendedTlsSettings = true;
|
||||||
virtualHosts."git.sealight.xyz" = { # Gitea hostname
|
virtualHosts."git.sealight.xyz" = {
|
||||||
enableACME = true; # Use ACME certs
|
# Gitea hostname
|
||||||
forceSSL = true; # Force SSL
|
enableACME = true; # Use ACME certs
|
||||||
locations."/".proxyPass = "http://localhost:3001/"; # Proxy Gitea
|
forceSSL = true; # Force SSL
|
||||||
};
|
locations."/".proxyPass = "http://localhost:3001/"; # Proxy Gitea
|
||||||
};
|
};
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|
@ -1,60 +0,0 @@
|
||||||
{ config, pkgs, ... }:
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ # Include the results of the hardware scan.
|
|
||||||
./hardware-configuration.nix
|
|
||||||
./wireguard.nix
|
|
||||||
./matrix.nix
|
|
||||||
./monitoring.nix
|
|
||||||
./rss-bridge.nix
|
|
||||||
./gitea.nix
|
|
||||||
# ./dns.nix
|
|
||||||
"${builtins.fetchTarball "https://github.com/ryantm/agenix/archive/main.tar.gz"}/modules/age.nix"
|
|
||||||
];
|
|
||||||
|
|
||||||
# Use the GRUB 2 boot loader.
|
|
||||||
boot.loader.grub.enable = true;
|
|
||||||
boot.loader.grub.version = 2;
|
|
||||||
boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
|
|
||||||
|
|
||||||
networking.hostName = "helix"; # Define your hostname.
|
|
||||||
|
|
||||||
networking.useDHCP = false;
|
|
||||||
networking.interfaces.ens3.useDHCP = true;
|
|
||||||
|
|
||||||
# Configure network proxy if necessary
|
|
||||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
|
||||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
|
||||||
|
|
||||||
# Enable the OpenSSH daemon.
|
|
||||||
services.openssh.enable = true;
|
|
||||||
services.openssh.passwordAuthentication = false;
|
|
||||||
services.openssh.permitRootLogin = "no";
|
|
||||||
|
|
||||||
# Open ports in the firewall.
|
|
||||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
|
||||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
|
||||||
# Or disable the firewall altogether.
|
|
||||||
# networking.firewall.enable = false;
|
|
||||||
|
|
||||||
# Include agenix
|
|
||||||
#environment.systemPackages = [ agenix.defaultPackage.x86_64-linux ];
|
|
||||||
|
|
||||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
|
||||||
users.users.anish = {
|
|
||||||
isNormalUser = true;
|
|
||||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user
|
|
||||||
openssh.authorizedKeys.keys = [
|
|
||||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve"
|
|
||||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCeWQsf9rbE+KBrWLkLkg1PMKx0jPfDP8xyv+XtddIQzAskRTN+JSSQp1GpoRgfQij7bx6f6DfjkwSQK5NWDQNQ+klGhcdEwEdptWUzpRAvKHMImjyIwFHmRKKEgcfH8+DSHVM93nRSQKrLezX4PzPkHF9f3TLxFdGeQDeY0J2oP2Oa97hRtuTJZW9BwUojyvDYUbg7F3fxf+pdFCvIAFaayiLkhOYdTXnjLt1Ks6NOhSzM78ZibHv4pFYI9r6dhflkFP/SzyLeSSm1aVAtxqE7vF5HnnORAg0byDsiOv/9RXxiDx7gkAAw3xENDSpp9TRj54M7iz1OSsRMhmD6orHjZFIRejlE4DIn+PBPm3PH+U5ILKTogE6n5MfPT28V0QdtHuqq3b5tSWiDcFpnjxbIUmEIo5hLzMR0tXZoNLQhBCSNfxjE8CYzpk7mHbvhSs2GPfG+NI1vvldbw2EF8beJFQHNYTqJw8y7p8RXpCwZqqpSitJX6v9DiYdLVG1hWvE= nix-on-droid@localhost"
|
|
||||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
# This value determines the NixOS release with which your system is to be
|
|
||||||
# compatible, in order to avoid breaking some software such as database
|
|
||||||
# servers. You should change this only after NixOS release notes say you
|
|
||||||
# should.
|
|
||||||
system.stateVersion = "19.09"; # Did you read the comment?
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
@ -1,375 +0,0 @@
|
||||||
{ config, lib, pkgs, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
#./mod-mx-puppet-slack.nix
|
|
||||||
./mautrix-whatsapp.nix
|
|
||||||
./mod-heisenbridge.nix
|
|
||||||
];
|
|
||||||
security.acme.email = "anish+acme@lakhwara.com";
|
|
||||||
security.acme.acceptTerms = true;
|
|
||||||
services.matrix-synapse = {
|
|
||||||
enable = true;
|
|
||||||
app_service_config_files = [
|
|
||||||
# # The registration file is automatically generated after starting the appservice for the first time.
|
|
||||||
# # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/
|
|
||||||
# # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml
|
|
||||||
"/var/lib/matrix-synapse/discord-registration.yaml"
|
|
||||||
"/var/lib/matrix-synapse/telegram-registration.yaml"
|
|
||||||
#"/var/lib/matrix-synapse/slack-registration.yaml"
|
|
||||||
#"/var/lib/matrix-synapse/whatsapp-registration.yaml"
|
|
||||||
];
|
|
||||||
server_name = "sealight.xyz";
|
|
||||||
registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU";
|
|
||||||
enable_metrics = true;
|
|
||||||
enable_registration = true;
|
|
||||||
database_type = "psycopg2";
|
|
||||||
database_args = {
|
|
||||||
database = "matrix-synapse";
|
|
||||||
};
|
|
||||||
|
|
||||||
listeners = [
|
|
||||||
{
|
|
||||||
port = 8448;
|
|
||||||
tls = false;
|
|
||||||
resources = [{
|
|
||||||
compress = true;
|
|
||||||
names = ["client" "federation"];
|
|
||||||
}];
|
|
||||||
}
|
|
||||||
{
|
|
||||||
port = 9090;
|
|
||||||
type = "metrics";
|
|
||||||
bind_address = "0.0.0.0";
|
|
||||||
resources = [{
|
|
||||||
compress = false;
|
|
||||||
names = [];
|
|
||||||
}];
|
|
||||||
tls = false;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
extraConfig = ''
|
|
||||||
max_upload_size: "50M"
|
|
||||||
use_presence: false
|
|
||||||
'';
|
|
||||||
## coturn based TURN server integration (TURN server setup mentioned later),
|
|
||||||
## shared secret generated while configuring coturn
|
|
||||||
## and reused here (power of Nix being a real programming language)
|
|
||||||
turn_uris = [
|
|
||||||
"turn:turn.sealight.xyz:3478?transport=udp"
|
|
||||||
"turn:turn.sealight.xyz:3478?transport=tcp"
|
|
||||||
];
|
|
||||||
turn_shared_secret = config.services.coturn.static-auth-secret;
|
|
||||||
};
|
|
||||||
|
|
||||||
|
|
||||||
services.coturn = {
|
|
||||||
enable = true;
|
|
||||||
use-auth-secret = true;
|
|
||||||
static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ";
|
|
||||||
realm = "turn.sealight.xyz";
|
|
||||||
min-port = 49111;
|
|
||||||
max-port = 51111;
|
|
||||||
no-cli = true;
|
|
||||||
no-tcp-relay = true;
|
|
||||||
no-tls = true;
|
|
||||||
cert = "${config.security.acme.certs."turn.sealight.xyz".directory}/full.pem";
|
|
||||||
pkey = "${config.security.acme.certs."turn.sealight.xyz".directory}/key.pem";
|
|
||||||
extraConfig = ''
|
|
||||||
verbose
|
|
||||||
user-quota=12
|
|
||||||
total-quota=1200
|
|
||||||
denied-peer-ip=10.0.0.0-10.255.255.255
|
|
||||||
denied-peer-ip=192.168.0.0-192.168.255.255
|
|
||||||
denied-peer-ip=172.16.0.0-172.31.255.255
|
|
||||||
denied-peer-ip=0.0.0.0-0.255.255.255
|
|
||||||
denied-peer-ip=100.64.0.0-100.127.255.255
|
|
||||||
denied-peer-ip=127.0.0.0-127.255.255.255
|
|
||||||
denied-peer-ip=169.254.0.0-169.254.255.255
|
|
||||||
denied-peer-ip=192.0.0.0-192.0.0.255
|
|
||||||
denied-peer-ip=192.0.2.0-192.0.2.255
|
|
||||||
denied-peer-ip=192.88.99.0-192.88.99.255
|
|
||||||
denied-peer-ip=198.18.0.0-198.19.255.255
|
|
||||||
denied-peer-ip=198.51.100.0-198.51.100.255
|
|
||||||
denied-peer-ip=203.0.113.0-203.0.113.255
|
|
||||||
denied-peer-ip=240.0.0.0-255.255.255.255
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
security.acme.certs.${config.services.coturn.realm} = {
|
|
||||||
/* insert here the right configuration to obtain a certificate */
|
|
||||||
webroot = "/var/lib/acme/acme-challenge/";
|
|
||||||
email = "anish+acme@lakhwara.com";
|
|
||||||
postRun = "systemctl restart coturn.service";
|
|
||||||
group = "turnserver";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.jitsi-meet = {
|
|
||||||
enable = true;
|
|
||||||
hostName = "jitsi.sealight.xyz";
|
|
||||||
};
|
|
||||||
services.jitsi-videobridge.enable = true;
|
|
||||||
|
|
||||||
services.mautrix-telegram = {
|
|
||||||
enable = true;
|
|
||||||
environmentFile = /etc/secrets/telegram.env; # file containing the appservice and telegram tokens
|
|
||||||
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
|
|
||||||
settings = {
|
|
||||||
homeserver = {
|
|
||||||
address = "https://sealight.xyz";
|
|
||||||
domain = "sealight.xyz";
|
|
||||||
};
|
|
||||||
appservice = {
|
|
||||||
provisioning.enabled = false;
|
|
||||||
id = "telegram";
|
|
||||||
bot_username = "telegrambridge";
|
|
||||||
public = {
|
|
||||||
enabled = false;
|
|
||||||
prefix = "/public";
|
|
||||||
external = "https://chat.sealight.xyz/public";
|
|
||||||
};
|
|
||||||
address = "http://localhost:18787";
|
|
||||||
port = 18787;
|
|
||||||
# The service uses SQLite by default, but it's also possible to use PostgreSQL instead:
|
|
||||||
#database = "postgresql:///mautrix-telegram?host=/run/postgresql";
|
|
||||||
};
|
|
||||||
bridge = {
|
|
||||||
relaybot.authless_portals = false;
|
|
||||||
permissions = {
|
|
||||||
"@aynish:sealight.xyz" = "admin";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.mautrix-whatsapp = {
|
|
||||||
enable = false;
|
|
||||||
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
|
|
||||||
#configOptions = {
|
|
||||||
# homeserver = {
|
|
||||||
# address = "https://chat.sealight.xyz";
|
|
||||||
# domain = "sealight.xyz";
|
|
||||||
# };
|
|
||||||
# appservice = {
|
|
||||||
# id = "whatsapp";
|
|
||||||
# address = http://localhost:9897;
|
|
||||||
# hostname = "0.0.0.0";
|
|
||||||
# port = 9897;
|
|
||||||
# database = {
|
|
||||||
# type = "sqlite3";
|
|
||||||
# uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
|
|
||||||
# };
|
|
||||||
# state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json";
|
|
||||||
# bot = {
|
|
||||||
# username = "whatsappbot";
|
|
||||||
# displayname = "WhatsApp bridge bot";
|
|
||||||
# avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
|
|
||||||
# };
|
|
||||||
# as_token = "";
|
|
||||||
# hs_token = "";
|
|
||||||
# };
|
|
||||||
# bridge = {
|
|
||||||
# username_template = "whatsapp_{{.}}";
|
|
||||||
# displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
|
|
||||||
# command_prefix = "!wa";
|
|
||||||
# permissions = {
|
|
||||||
# "@aynish:sealight.xyz" = 100;
|
|
||||||
# };
|
|
||||||
# };
|
|
||||||
# logging = {
|
|
||||||
# directory = "/var/lib/mautrix-whatsapp/logs";
|
|
||||||
# file_name_format = "{{.Date}}-{{.Index}}.log";
|
|
||||||
# file_date_format = "\"2006-01-02\"";
|
|
||||||
# file_mode = 384;
|
|
||||||
# timestamp_format = "Jan _2, 2006 15:04:05";
|
|
||||||
# print_level = "debug";
|
|
||||||
# };
|
|
||||||
# metrics = {
|
|
||||||
# enabled = true;
|
|
||||||
# listen = "http://localhost:5070";
|
|
||||||
# };
|
|
||||||
#};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.mx-puppet-discord = {
|
|
||||||
enable = true;
|
|
||||||
settings = {
|
|
||||||
bridge = {
|
|
||||||
bindAddress = "localhost";
|
|
||||||
port = 16785;
|
|
||||||
domain = "sealight.xyz";
|
|
||||||
homeserverUrl = "https://sealight.xyz";
|
|
||||||
avatarUrl = "https://discord.com/assets/2d20a45d79110dc5bf947137e9d99b66.svg";
|
|
||||||
};
|
|
||||||
provisioning = {
|
|
||||||
whitelist = [ "@aynish:sealight.xyz" ];
|
|
||||||
};
|
|
||||||
relay = {
|
|
||||||
whitelist = [ "@aynish:sealight.xyz" ];
|
|
||||||
};
|
|
||||||
namePatterns = {
|
|
||||||
group = ":name";
|
|
||||||
room = ":name";
|
|
||||||
user = ":name (Discord)";
|
|
||||||
userOverride = ":displayname";
|
|
||||||
};
|
|
||||||
presence = {
|
|
||||||
enabled = false;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
serviceDependencies = ["matrix-synapse.service"];
|
|
||||||
};
|
|
||||||
|
|
||||||
#services.mx-puppet-slack= {
|
|
||||||
#enable = false;
|
|
||||||
#settings = {
|
|
||||||
# bridge = {
|
|
||||||
# bindAddress = "localhost";
|
|
||||||
# port = 16786;
|
|
||||||
# domain = "sealight.xyz";
|
|
||||||
# homeserverUrl = "https://sealight.xyz";
|
|
||||||
# };
|
|
||||||
# provisioning = {
|
|
||||||
# whitelist = [ "@aynish:sealight.xyz" ];
|
|
||||||
# };
|
|
||||||
# relay = {
|
|
||||||
# whitelist = [ "@aynish:sealight.xyz" ];
|
|
||||||
# };
|
|
||||||
# namePatterns = {
|
|
||||||
# group = ":name";
|
|
||||||
# room = ":name[:team? - :team,]";
|
|
||||||
# user = ":name (Slack)";
|
|
||||||
# userOverride = ":displayname";
|
|
||||||
# };
|
|
||||||
# presence = {
|
|
||||||
# enabled = false;
|
|
||||||
# };
|
|
||||||
# oauth = {
|
|
||||||
# enabled = false;
|
|
||||||
# };
|
|
||||||
#};
|
|
||||||
#serviceDependencies = ["matrix-synapse.service"];
|
|
||||||
#};
|
|
||||||
|
|
||||||
services.heisenbridge = {
|
|
||||||
enable = true;
|
|
||||||
homeserver = "https://sealight.xyz";
|
|
||||||
listenPort = 14456;
|
|
||||||
appServiceToken = "wyujLh8kjpmk2bfKeEE3sZ2gWOEUBKK5";
|
|
||||||
homeserverToken = "yEHs7lthD2ZHUibJOAv1APaFhEjxN5PT";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.postgresql = {
|
|
||||||
enable = true;
|
|
||||||
## postgresql user and db name remains in the
|
|
||||||
## service.matrix-synapse.database_args setting which
|
|
||||||
## by default is matrix-synapse
|
|
||||||
initialScript = pkgs.writeText "synapse-init.sql" ''
|
|
||||||
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|'kq@iBwlIzu";
|
|
||||||
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
|
|
||||||
TEMPLATE template0
|
|
||||||
LC_COLLATE = "C"
|
|
||||||
LC_CTYPE = "C";
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall = let
|
|
||||||
range = with config.services.coturn; [ {
|
|
||||||
from = min-port;
|
|
||||||
to = max-port;
|
|
||||||
} ];
|
|
||||||
in {
|
|
||||||
enable = true;
|
|
||||||
allowedUDPPortRanges = range; # coturn
|
|
||||||
allowedTCPPortRanges = range;
|
|
||||||
allowedTCPPorts = [
|
|
||||||
22 # SSH
|
|
||||||
8448 # Matrix federation
|
|
||||||
8008
|
|
||||||
80
|
|
||||||
443
|
|
||||||
3478 # Coturn service
|
|
||||||
5349 # Coturn service
|
|
||||||
9090 # Synapse Metrics
|
|
||||||
];
|
|
||||||
allowedUDPPorts = [
|
|
||||||
3478
|
|
||||||
5349 # Coturn service
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
nixpkgs.overlays = [
|
|
||||||
(self: super: {
|
|
||||||
element-web = super.element-web.override {
|
|
||||||
conf = {
|
|
||||||
default_server_config = {
|
|
||||||
"m.homeserver" = {
|
|
||||||
"base_url" = "https://chat.sealight.xyz";
|
|
||||||
"server_name" = "sealight.xyz";
|
|
||||||
};
|
|
||||||
"m.identity_server" = {
|
|
||||||
"base_url" = "https://vector.im";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
## jitsi will be setup later,
|
|
||||||
## but we need to add to Riot configuration
|
|
||||||
jitsi.preferredDomain = "jitsi.sealight.xyz";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
})
|
|
||||||
];
|
|
||||||
|
|
||||||
services.nginx = {
|
|
||||||
enable = true;
|
|
||||||
virtualHosts = {
|
|
||||||
|
|
||||||
"sealight.xyz" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
locations."/" = {
|
|
||||||
root = "/var/www/sealight.xyz";
|
|
||||||
};
|
|
||||||
locations."/_matrix" = {
|
|
||||||
proxyPass = "http://localhost:8448";
|
|
||||||
};
|
|
||||||
locations."/slackbridge" = {
|
|
||||||
proxyPass = "http://localhost:9899";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
## virtual host for Synapse
|
|
||||||
"chat.sealight.xyz" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
#useACMEHost = "sealight.xyz";
|
|
||||||
locations."/" = {
|
|
||||||
proxyPass = "http://localhost:8448";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
## virtual host for Riot/Web
|
|
||||||
"element.sealight.xyz" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
#useACMEHost = "sealight.xyz";
|
|
||||||
|
|
||||||
## root points to the riot-web package content, also configured via Nix
|
|
||||||
locations."/" = {
|
|
||||||
root = pkgs.element-web;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
${config.services.jitsi-meet.hostName} = {
|
|
||||||
enableACME = true;
|
|
||||||
forceSSL = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
## other nginx specific best practices
|
|
||||||
recommendedGzipSettings = true;
|
|
||||||
recommendedOptimisation = true;
|
|
||||||
recommendedTlsSettings = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [ matrix-appservice-slack ];
|
|
||||||
}
|
|
||||||
|
|
@ -1,159 +0,0 @@
|
||||||
{ config, pkgs, ... }: {
|
|
||||||
# grafana configuration
|
|
||||||
#services.grafana = {
|
|
||||||
# enable = true;
|
|
||||||
# domain = "grafana.mossnet.lan";
|
|
||||||
# port = 2342;
|
|
||||||
# addr = "127.0.0.1";
|
|
||||||
#};
|
|
||||||
#
|
|
||||||
## nginx reverse proxy
|
|
||||||
#services.nginx.virtualHosts.${config.services.grafana.domain} = {
|
|
||||||
# locations."/" = {
|
|
||||||
# proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
|
|
||||||
# proxyWebsockets = true;
|
|
||||||
# };
|
|
||||||
#};
|
|
||||||
|
|
||||||
services.prometheus = {
|
|
||||||
enable = true;
|
|
||||||
port = 9001;
|
|
||||||
exporters = {
|
|
||||||
node = {
|
|
||||||
enable = true;
|
|
||||||
enabledCollectors = [ "systemd" ];
|
|
||||||
port = 9002;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
rules = [
|
|
||||||
''
|
|
||||||
groups:
|
|
||||||
- name: synapse
|
|
||||||
rules:
|
|
||||||
- record: "synapse_federation_transaction_queue_pendingEdus:total"
|
|
||||||
expr: "sum(synapse_federation_transaction_queue_pendingEdus or absent(synapse_federation_transaction_queue_pendingEdus)*0)"
|
|
||||||
- record: "synapse_federation_transaction_queue_pendingPdus:total"
|
|
||||||
expr: "sum(synapse_federation_transaction_queue_pendingPdus or absent(synapse_federation_transaction_queue_pendingPdus)*0)"
|
|
||||||
- record: 'synapse_http_server_request_count:method'
|
|
||||||
labels:
|
|
||||||
servlet: ""
|
|
||||||
expr: "sum(synapse_http_server_request_count) by (method)"
|
|
||||||
- record: 'synapse_http_server_request_count:servlet'
|
|
||||||
labels:
|
|
||||||
method: ""
|
|
||||||
expr: 'sum(synapse_http_server_request_count) by (servlet)'
|
|
||||||
|
|
||||||
- record: 'synapse_http_server_request_count:total'
|
|
||||||
labels:
|
|
||||||
servlet: ""
|
|
||||||
expr: 'sum(synapse_http_server_request_count:by_method) by (servlet)'
|
|
||||||
|
|
||||||
- record: 'synapse_cache:hit_ratio_5m'
|
|
||||||
expr: 'rate(synapse_util_caches_cache:hits[5m]) / rate(synapse_util_caches_cache:total[5m])'
|
|
||||||
- record: 'synapse_cache:hit_ratio_30s'
|
|
||||||
expr: 'rate(synapse_util_caches_cache:hits[30s]) / rate(synapse_util_caches_cache:total[30s])'
|
|
||||||
|
|
||||||
- record: 'synapse_federation_client_sent'
|
|
||||||
labels:
|
|
||||||
type: "EDU"
|
|
||||||
expr: 'synapse_federation_client_sent_edus + 0'
|
|
||||||
- record: 'synapse_federation_client_sent'
|
|
||||||
labels:
|
|
||||||
type: "PDU"
|
|
||||||
expr: 'synapse_federation_client_sent_pdu_destinations:count + 0'
|
|
||||||
- record: 'synapse_federation_client_sent'
|
|
||||||
labels:
|
|
||||||
type: "Query"
|
|
||||||
expr: 'sum(synapse_federation_client_sent_queries) by (job)'
|
|
||||||
|
|
||||||
- record: 'synapse_federation_server_received'
|
|
||||||
labels:
|
|
||||||
type: "EDU"
|
|
||||||
expr: 'synapse_federation_server_received_edus + 0'
|
|
||||||
- record: 'synapse_federation_server_received'
|
|
||||||
labels:
|
|
||||||
type: "PDU"
|
|
||||||
expr: 'synapse_federation_server_received_pdus + 0'
|
|
||||||
- record: 'synapse_federation_server_received'
|
|
||||||
labels:
|
|
||||||
type: "Query"
|
|
||||||
expr: 'sum(synapse_federation_server_received_queries) by (job)'
|
|
||||||
|
|
||||||
- record: 'synapse_federation_transaction_queue_pending'
|
|
||||||
labels:
|
|
||||||
type: "EDU"
|
|
||||||
expr: 'synapse_federation_transaction_queue_pending_edus + 0'
|
|
||||||
- record: 'synapse_federation_transaction_queue_pending'
|
|
||||||
labels:
|
|
||||||
type: "PDU"
|
|
||||||
expr: 'synapse_federation_transaction_queue_pending_pdus + 0'
|
|
||||||
|
|
||||||
- record: synapse_storage_events_persisted_by_source_type
|
|
||||||
expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_type="remote"})
|
|
||||||
labels:
|
|
||||||
type: remote
|
|
||||||
- record: synapse_storage_events_persisted_by_source_type
|
|
||||||
expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity="*client*",origin_type="local"})
|
|
||||||
labels:
|
|
||||||
type: local
|
|
||||||
- record: synapse_storage_events_persisted_by_source_type
|
|
||||||
expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity!="*client*",origin_type="local"})
|
|
||||||
labels:
|
|
||||||
type: bridges
|
|
||||||
- record: synapse_storage_events_persisted_by_event_type
|
|
||||||
expr: sum without(origin_entity, origin_type) (synapse_storage_events_persisted_events_sep)
|
|
||||||
- record: synapse_storage_events_persisted_by_origin
|
|
||||||
expr: sum without(type) (synapse_storage_events_persisted_events_sep)
|
|
||||||
''
|
|
||||||
];
|
|
||||||
scrapeConfigs = [
|
|
||||||
{
|
|
||||||
job_name = "helix";
|
|
||||||
static_configs = [{
|
|
||||||
targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
|
|
||||||
}];
|
|
||||||
}
|
|
||||||
{
|
|
||||||
job_name = "synapse";
|
|
||||||
metrics_path = "/_synapse/metrics";
|
|
||||||
static_configs = [{
|
|
||||||
targets = [ "localhost:9090" ];
|
|
||||||
}];
|
|
||||||
}
|
|
||||||
{
|
|
||||||
job_name = "gitea";
|
|
||||||
static_configs = [{
|
|
||||||
targets = [ "localhost:3001" ];
|
|
||||||
}];
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall = {
|
|
||||||
enable = true;
|
|
||||||
allowedTCPPorts = [ 9001 ];
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."sealight.xyz" = {
|
|
||||||
locations."/metrics" = {
|
|
||||||
#basicAuth = { anish = "password"; };
|
|
||||||
proxyPass = "http://localhost:9001";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.loki = {
|
|
||||||
enable = true;
|
|
||||||
configFile = /var/loki-config.yaml;
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.promtail = {
|
|
||||||
description = "Promtail service for Loki";
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
|
|
||||||
serviceConfig = {
|
|
||||||
ExecStart = ''
|
|
||||||
${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml}
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
{pkgs, lib, config, ...}:
|
|
||||||
{
|
|
||||||
services.rss-bridge = {
|
|
||||||
enable = true;
|
|
||||||
virtualHost = "bridge.sealight.xyz";
|
|
||||||
whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit"];
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."bridge.sealight.xyz".forceSSL = true;
|
|
||||||
services.nginx.virtualHosts."bridge.sealight.xyz".enableACME = true;
|
|
||||||
}
|
|
||||||
|
|
@ -1,14 +0,0 @@
|
||||||
{
|
|
||||||
services.nginx = {
|
|
||||||
enable = true;
|
|
||||||
vhost = {
|
|
||||||
"sealight.xyz" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
locations."/" = {
|
|
||||||
root = "/var/www/sealight.xyz"
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,32 +0,0 @@
|
||||||
{ config, pkgs, lib, ... }:
|
|
||||||
{
|
|
||||||
environment.systemPackages = [ pkgs.wireguard pkgs.mosh ];
|
|
||||||
networking.nat = {
|
|
||||||
enable = true;
|
|
||||||
externalInterface = "ens3";
|
|
||||||
internalInterfaces = [ "wg0" ];
|
|
||||||
};
|
|
||||||
networking.firewall = {
|
|
||||||
allowedUDPPorts = [ 60990 ];
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.wireguard.interfaces.wg0 = {
|
|
||||||
ips = [ "10.0.69.1/24" ];
|
|
||||||
listenPort = 60990;
|
|
||||||
privateKeyFile = "/var/lib/wireguard/priv";
|
|
||||||
peers = [
|
|
||||||
{ # box
|
|
||||||
publicKey = "Ra78mOc110K7URN5uB3m9d78iBKgeRHzT+3HkiFp9BU=";
|
|
||||||
allowedIPs = [ "10.0.69.4/32" ];
|
|
||||||
}
|
|
||||||
{ # line
|
|
||||||
publicKey = "fsb1FuGmYi89p4CVXytKw2FYamONKtoanxrgs/dJjC8=";
|
|
||||||
allowedIPs = [ "10.0.69.3/32" ];
|
|
||||||
}
|
|
||||||
{ # curve
|
|
||||||
publicKey = "XmV4AcPPND/eeSI6d9M1iahCjtymqY6DdUDEFNP/x3g=";
|
|
||||||
allowedIPs = [ "10.0.69.2/32" ];
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,25 +1,47 @@
|
||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
security.acme.email = "anish+acme@lakhwara.com";
|
security.acme.email = "anish+acme@lakhwara.com";
|
||||||
security.acme.acceptTerms = true;
|
security.acme.acceptTerms = true;
|
||||||
services.matrix-synapse = {
|
services.matrix-synapse = {
|
||||||
enable = true;
|
enable = true;
|
||||||
app_service_config_files = [
|
app_service_config_files = [
|
||||||
# # The registration file is automatically generated after starting the appservice for the first time.
|
# # The registration file is automatically generated after starting the appservice for the first time.
|
||||||
# # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/
|
# # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/
|
||||||
# # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml
|
# # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml
|
||||||
# "/var/lib/matrix-synapse/discord-registration.yaml"
|
"/var/lib/matrix-synapse/discord-registration.yaml"
|
||||||
# "/var/lib/matrix-synapse/telegram-registration.yaml"
|
"/var/lib/matrix-synapse/telegram-registration.yaml"
|
||||||
# "/var/lib/matrix-synapse/slack-registration.yaml"
|
#"/var/lib/matrix-synapse/slack-registration.yaml"
|
||||||
# # "/var/lib/matrix-synapse/whatsapp-registration.yaml"
|
#"/var/lib/matrix-synapse/whatsapp-registration.yaml"
|
||||||
];
|
];
|
||||||
server_name = "sealight.xyz";
|
server_name = "sealight.xyz";
|
||||||
registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; # TODO use agnix
|
registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU";
|
||||||
enable_metrics = true;
|
enable_metrics = true;
|
||||||
enable_registration = true;
|
enable_registration = true;
|
||||||
database_type = "psycopg2";
|
database_type = "psycopg2";
|
||||||
database_args = {
|
database_args = {
|
||||||
database = "matrix-synapse";
|
database = "matrix-synapse";
|
||||||
};
|
};
|
||||||
|
listeners = [
|
||||||
|
{
|
||||||
|
port = 8448;
|
||||||
|
tls = false;
|
||||||
|
resources = [{
|
||||||
|
compress = true;
|
||||||
|
names = [ "client" "federation" ];
|
||||||
|
}];
|
||||||
|
}
|
||||||
|
{
|
||||||
|
port = 9090;
|
||||||
|
type = "metrics";
|
||||||
|
bind_address = "0.0.0.0";
|
||||||
|
resources = [{
|
||||||
|
compress = false;
|
||||||
|
names = [ ];
|
||||||
|
}];
|
||||||
|
tls = false;
|
||||||
|
}
|
||||||
|
];
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
max_upload_size: "50M"
|
max_upload_size: "50M"
|
||||||
use_presence: false
|
use_presence: false
|
||||||
|
|
@ -32,27 +54,6 @@
|
||||||
"turn:turn.sealight.xyz:3478?transport=tcp"
|
"turn:turn.sealight.xyz:3478?transport=tcp"
|
||||||
];
|
];
|
||||||
turn_shared_secret = config.services.coturn.static-auth-secret;
|
turn_shared_secret = config.services.coturn.static-auth-secret;
|
||||||
|
|
||||||
listeners = [
|
|
||||||
{
|
|
||||||
port = 8448;
|
|
||||||
tls = false;
|
|
||||||
resources = [{
|
|
||||||
compress = true;
|
|
||||||
names = ["client" "federation"];
|
|
||||||
}];
|
|
||||||
}
|
|
||||||
{
|
|
||||||
port = 9090;
|
|
||||||
type = "metrics";
|
|
||||||
bind_address = "0.0.0.0";
|
|
||||||
resources = [{
|
|
||||||
compress = false;
|
|
||||||
names = [];
|
|
||||||
}];
|
|
||||||
tls = false;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
services.coturn = {
|
services.coturn = {
|
||||||
|
|
@ -60,27 +61,45 @@
|
||||||
use-auth-secret = true;
|
use-auth-secret = true;
|
||||||
static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ";
|
static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ";
|
||||||
realm = "turn.sealight.xyz";
|
realm = "turn.sealight.xyz";
|
||||||
|
min-port = 49111;
|
||||||
|
max-port = 51111;
|
||||||
|
no-cli = true;
|
||||||
no-tcp-relay = true;
|
no-tcp-relay = true;
|
||||||
no-tls = true;
|
no-tls = true;
|
||||||
no-dtls = true;
|
cert = "${config.security.acme.certs."turn.sealight.xyz".directory}/full.pem";
|
||||||
|
pkey = "${config.security.acme.certs."turn.sealight.xyz".directory}/key.pem";
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
user-quota=12
|
verbose
|
||||||
total-quota=1200
|
user-quota=12
|
||||||
denied-peer-ip=10.0.0.0-10.255.255.255
|
total-quota=1200
|
||||||
denied-peer-ip=192.168.0.0-192.168.255.255
|
denied-peer-ip=10.0.0.0-10.255.255.255
|
||||||
denied-peer-ip=172.16.0.0-172.31.255.255
|
denied-peer-ip=192.168.0.0-192.168.255.255
|
||||||
|
denied-peer-ip=172.16.0.0-172.31.255.255
|
||||||
allowed-peer-ip=192.168.191.127
|
denied-peer-ip=0.0.0.0-0.255.255.255
|
||||||
|
denied-peer-ip=100.64.0.0-100.127.255.255
|
||||||
|
denied-peer-ip=127.0.0.0-127.255.255.255
|
||||||
|
denied-peer-ip=169.254.0.0-169.254.255.255
|
||||||
|
denied-peer-ip=192.0.0.0-192.0.0.255
|
||||||
|
denied-peer-ip=192.0.2.0-192.0.2.255
|
||||||
|
denied-peer-ip=192.88.99.0-192.88.99.255
|
||||||
|
denied-peer-ip=198.18.0.0-198.19.255.255
|
||||||
|
denied-peer-ip=198.51.100.0-198.51.100.255
|
||||||
|
denied-peer-ip=203.0.113.0-203.0.113.255
|
||||||
|
denied-peer-ip=240.0.0.0-255.255.255.255
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
|
security.acme.certs.${config.services.coturn.realm} = {
|
||||||
|
/* insert here the right configuration to obtain a certificate */
|
||||||
|
webroot = "/var/lib/acme/acme-challenge/";
|
||||||
|
email = "anish+acme@lakhwara.com";
|
||||||
|
postRun = "systemctl restart coturn.service";
|
||||||
|
group = "turnserver";
|
||||||
|
};
|
||||||
|
|
||||||
services.jitsi-meet = {
|
services.jitsi-meet = {
|
||||||
enable = true;
|
enable = true;
|
||||||
hostName = "jitsi.sealight.xyz";
|
hostName = "jitsi.sealight.xyz";
|
||||||
|
|
||||||
## this setting is going to add relevant ports to
|
|
||||||
## networking.firewall.allowedTCPPorts &
|
|
||||||
## networking.firewall.allowedUDPPorts
|
|
||||||
};
|
};
|
||||||
services.jitsi-videobridge.enable = true;
|
services.jitsi-videobridge.enable = true;
|
||||||
|
|
||||||
|
|
@ -90,17 +109,20 @@
|
||||||
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
|
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
|
||||||
settings = {
|
settings = {
|
||||||
homeserver = {
|
homeserver = {
|
||||||
address = "https://chat.sealight.xyz";
|
address = "https://sealight.xyz";
|
||||||
domain = "sealight.xyz";
|
domain = "sealight.xyz";
|
||||||
};
|
};
|
||||||
appservice = {
|
appservice = {
|
||||||
provisioning.enabled = false;
|
provisioning.enabled = false;
|
||||||
id = "telegram";
|
id = "telegram";
|
||||||
|
bot_username = "telegrambridge";
|
||||||
public = {
|
public = {
|
||||||
enabled = false;
|
enabled = false;
|
||||||
prefix = "/public";
|
prefix = "/public";
|
||||||
external = "https://chat.sealight.xyz/public";
|
external = "https://chat.sealight.xyz/public";
|
||||||
};
|
};
|
||||||
|
address = "http://localhost:18787";
|
||||||
|
port = 18787;
|
||||||
# The service uses SQLite by default, but it's also possible to use PostgreSQL instead:
|
# The service uses SQLite by default, but it's also possible to use PostgreSQL instead:
|
||||||
#database = "postgresql:///mautrix-telegram?host=/run/postgresql";
|
#database = "postgresql:///mautrix-telegram?host=/run/postgresql";
|
||||||
};
|
};
|
||||||
|
|
@ -113,96 +135,41 @@
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
services.mautrix-whatsapp = {
|
services.mx-puppet-discord = {
|
||||||
enable = true;
|
enable = true;
|
||||||
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
|
settings = {
|
||||||
configOptions = {
|
|
||||||
homeserver = {
|
|
||||||
address = "https://chat.sealight.xyz";
|
|
||||||
domain = "sealight.xyz";
|
|
||||||
};
|
|
||||||
appservice = {
|
|
||||||
id = "whatsapp";
|
|
||||||
address = http://localhost:9897;
|
|
||||||
hostname = "0.0.0.0";
|
|
||||||
port = 9897;
|
|
||||||
database = {
|
|
||||||
type = "sqlite3";
|
|
||||||
uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
|
|
||||||
};
|
|
||||||
state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json";
|
|
||||||
bot = {
|
|
||||||
username = "whatsappbot";
|
|
||||||
displayname = "WhatsApp bridge bot";
|
|
||||||
avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
|
|
||||||
};
|
|
||||||
as_token = "";
|
|
||||||
hs_token = "";
|
|
||||||
};
|
|
||||||
bridge = {
|
bridge = {
|
||||||
username_template = "whatsapp_{{.}}";
|
bindAddress = "localhost";
|
||||||
displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
|
port = 16785;
|
||||||
command_prefix = "!wa";
|
domain = "sealight.xyz";
|
||||||
permissions = {
|
homeserverUrl = "https://sealight.xyz";
|
||||||
"@aynish:sealight.xyz" = 100;
|
avatarUrl = "https://discord.com/assets/2d20a45d79110dc5bf947137e9d99b66.svg";
|
||||||
};
|
|
||||||
};
|
};
|
||||||
logging = {
|
provisioning = {
|
||||||
directory = "/var/lib/mautrix-whatsapp/logs";
|
whitelist = [ "@aynish:sealight.xyz" ];
|
||||||
file_name_format = "{{.Date}}-{{.Index}}.log";
|
|
||||||
file_date_format = "\"2006-01-02\"";
|
|
||||||
file_mode = 384;
|
|
||||||
timestamp_format = "Jan _2, 2006 15:04:05";
|
|
||||||
print_level = "debug";
|
|
||||||
};
|
};
|
||||||
metrics = {
|
relay = {
|
||||||
enabled = true;
|
whitelist = [ "@aynish:sealight.xyz" ];
|
||||||
listen = "http://localhost:5070";
|
};
|
||||||
|
namePatterns = {
|
||||||
|
group = ":name";
|
||||||
|
room = ":name";
|
||||||
|
user = ":name (Discord)";
|
||||||
|
userOverride = ":displayname";
|
||||||
|
};
|
||||||
|
presence = {
|
||||||
|
enabled = false;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
serviceDependencies = [ "matrix-synapse.service" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
services.matrix-appservice-slack = {
|
services.heisenbridge = {
|
||||||
enable = true;
|
enable = true;
|
||||||
#environmentFile = /etc/secrets/matrix-appservice-slack.env;
|
homeserver = "https://sealight.xyz";
|
||||||
settings = {
|
listenPort = 14456;
|
||||||
homeserver = {
|
appServiceToken = "wyujLh8kjpmk2bfKeEE3sZ2gWOEUBKK5";
|
||||||
server_name = "sealight.xyz";
|
homeserverToken = "yEHs7lthD2ZHUibJOAv1APaFhEjxN5PT";
|
||||||
url = "https://chat.sealight.xyz";
|
|
||||||
};
|
|
||||||
db = {
|
|
||||||
engine = "postgres";
|
|
||||||
connectionString = "postgres://slackbridge_user:somethingverysecret@localhost/slack_bridge?sslmode=require";
|
|
||||||
};
|
|
||||||
matrix_admin_room = "!ikEWOHCcmoZtVzSmPF:sealight.xyz";
|
|
||||||
username_prefix = "slack_";
|
|
||||||
rtm = {
|
|
||||||
enable = true;
|
|
||||||
logging = "silent";
|
|
||||||
};
|
|
||||||
slack_hook_port = 9899;
|
|
||||||
enable_metrics = true;
|
|
||||||
puppeting = {
|
|
||||||
enabled = true;
|
|
||||||
onboard_users = true;
|
|
||||||
};
|
|
||||||
oauth2 = {
|
|
||||||
client_id = "2832868673.1609454840563";
|
|
||||||
client_secret = "079a7ca42b192e66a9ff32740a69cb9d";
|
|
||||||
redirect_prefix = "https://sealight.xyz/slackbridge/";
|
|
||||||
};
|
|
||||||
#team_sync = {
|
|
||||||
# T02QGRJKT = {
|
|
||||||
# users = {
|
|
||||||
# enabled = false;
|
|
||||||
# };
|
|
||||||
# channels = {
|
|
||||||
# enabled = true;
|
|
||||||
# alias_prefix = "qf_";
|
|
||||||
# };
|
|
||||||
# };
|
|
||||||
#};
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
services.postgresql = {
|
services.postgresql = {
|
||||||
|
|
@ -211,99 +178,189 @@
|
||||||
## service.matrix-synapse.database_args setting which
|
## service.matrix-synapse.database_args setting which
|
||||||
## by default is matrix-synapse
|
## by default is matrix-synapse
|
||||||
initialScript = pkgs.writeText "synapse-init.sql" ''
|
initialScript = pkgs.writeText "synapse-init.sql" ''
|
||||||
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|'kq@iBwlIzu";
|
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|'kq@iBwlIzu";
|
||||||
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
|
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
|
||||||
TEMPLATE template0
|
TEMPLATE template0
|
||||||
LC_COLLATE = "C"
|
LC_COLLATE = "C"
|
||||||
LC_CTYPE = "C";
|
LC_CTYPE = "C";
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall = {
|
networking.firewall =
|
||||||
enable = true;
|
let
|
||||||
allowedTCPPorts = [
|
range = with config.services.coturn; [{
|
||||||
22 # SSH
|
from = min-port;
|
||||||
8448 # Matrix federation
|
to = max-port;
|
||||||
8008
|
}];
|
||||||
80
|
in
|
||||||
443
|
{
|
||||||
9090 # Synapse Metrics
|
enable = true;
|
||||||
9899 # Matrix <-> Slack Bridge Puppeting
|
allowedUDPPortRanges = range; # coturn
|
||||||
];
|
allowedTCPPortRanges = range;
|
||||||
};
|
allowedTCPPorts = [
|
||||||
|
22 # SSH
|
||||||
|
8448 # Matrix federation
|
||||||
|
8008
|
||||||
|
80
|
||||||
|
443
|
||||||
|
3478 # Coturn service
|
||||||
|
5349 # Coturn service
|
||||||
|
9090 # Synapse Metrics
|
||||||
|
];
|
||||||
|
allowedUDPPorts = [
|
||||||
|
3478
|
||||||
|
5349 # Coturn service
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
nixpkgs.overlays = [
|
nixpkgs.overlays = [
|
||||||
(self: super: {
|
(self: super: {
|
||||||
element-web = super.element-web.override {
|
element-web = super.element-web.override {
|
||||||
conf = {
|
conf = {
|
||||||
default_server_config = {
|
default_server_config = {
|
||||||
"m.homeserver" = {
|
"m.homeserver" = {
|
||||||
"base_url" = "https://chat.sealight.xyz";
|
"base_url" = "https://chat.sealight.xyz";
|
||||||
"server_name" = "sealight.xyz";
|
"server_name" = "sealight.xyz";
|
||||||
};
|
|
||||||
"m.identity_server" = {
|
|
||||||
"base_url" = "https://vector.im";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
## jitsi will be setup later,
|
|
||||||
## but we need to add to Riot configuration
|
|
||||||
jitsi.preferredDomain = "jitsi.sealight.xyz";
|
|
||||||
};
|
};
|
||||||
|
"m.identity_server" = {
|
||||||
|
"base_url" = "https://vector.im";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
## jitsi will be setup later,
|
||||||
|
## but we need to add to Riot configuration
|
||||||
|
jitsi.preferredDomain = "jitsi.sealight.xyz";
|
||||||
};
|
};
|
||||||
|
};
|
||||||
})
|
})
|
||||||
];
|
];
|
||||||
|
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
enable = true;
|
enable = true;
|
||||||
virtualHosts = {
|
virtualHosts = {
|
||||||
|
"sealight.xyz" = {
|
||||||
"sealight.xyz" = {
|
forceSSL = true;
|
||||||
forceSSL = true;
|
enableACME = true;
|
||||||
enableACME = true;
|
locations."/" = {
|
||||||
locations."/" = {
|
root = "/var/www/sealight.xyz";
|
||||||
root = "/var/www/sealight.xyz";
|
};
|
||||||
};
|
locations."/_matrix" = {
|
||||||
locations."/_matrix" = {
|
proxyPass = "http://localhost:8448";
|
||||||
proxyPass = "http://localhost:8448";
|
};
|
||||||
};
|
locations."/slackbridge" = {
|
||||||
locations."/slackbridge" = {
|
proxyPass = "http://localhost:9899";
|
||||||
proxyPass = "http://localhost:9899";
|
};
|
||||||
};
|
};
|
||||||
};
|
## virtual host for Synapse
|
||||||
|
"chat.sealight.xyz" = {
|
||||||
## virtual host for Synapse
|
forceSSL = true;
|
||||||
"chat.sealight.xyz" = {
|
enableACME = true;
|
||||||
forceSSL = true;
|
#useACMEHost = "sealight.xyz";
|
||||||
enableACME = true;
|
locations."/" = {
|
||||||
#useACMEHost = "sealight.xyz";
|
proxyPass = "http://localhost:8448";
|
||||||
locations."/" = {
|
};
|
||||||
proxyPass = "http://localhost:8448";
|
};
|
||||||
};
|
## virtual host for Riot/Web
|
||||||
};
|
"element.sealight.xyz" = {
|
||||||
|
forceSSL = true;
|
||||||
## virtual host for Riot/Web
|
enableACME = true;
|
||||||
"element.sealight.xyz" = {
|
#useACMEHost = "sealight.xyz";
|
||||||
forceSSL = true;
|
## root points to the riot-web package content, also configured via Nix
|
||||||
enableACME = true;
|
locations."/" = {
|
||||||
#useACMEHost = "sealight.xyz";
|
root = pkgs.element-web;
|
||||||
|
};
|
||||||
## root points to the riot-web package content, also configured via Nix
|
};
|
||||||
locations."/" = {
|
${config.services.jitsi-meet.hostName} = {
|
||||||
root = pkgs.element-web;
|
enableACME = true;
|
||||||
};
|
forceSSL = true;
|
||||||
};
|
};
|
||||||
|
};
|
||||||
${config.services.jitsi-meet.hostName} = {
|
## other nginx specific best practices
|
||||||
enableACME = true;
|
recommendedGzipSettings = true;
|
||||||
forceSSL = true;
|
recommendedOptimisation = true;
|
||||||
};
|
recommendedTlsSettings = true;
|
||||||
};
|
|
||||||
## other nginx specific best practices
|
|
||||||
recommendedGzipSettings = true;
|
|
||||||
recommendedOptimisation = true;
|
|
||||||
recommendedTlsSettings = true;
|
|
||||||
};
|
};
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [ matrix-appservice-slack ];
|
# environment.systemPackages = with pkgs; [ matrix-appservice-slack ];
|
||||||
|
#services.mx-puppet-slack= {
|
||||||
|
#enable = false;
|
||||||
|
#settings = {
|
||||||
|
# bridge = {
|
||||||
|
# bindAddress = "localhost";
|
||||||
|
# port = 16786;
|
||||||
|
# domain = "sealight.xyz";
|
||||||
|
# homeserverUrl = "https://sealight.xyz";
|
||||||
|
# };
|
||||||
|
# provisioning = {
|
||||||
|
# whitelist = [ "@aynish:sealight.xyz" ];
|
||||||
|
# };
|
||||||
|
# relay = {
|
||||||
|
# whitelist = [ "@aynish:sealight.xyz" ];
|
||||||
|
# };
|
||||||
|
# namePatterns = {
|
||||||
|
# group = ":name";
|
||||||
|
# room = ":name[:team? - :team,]";
|
||||||
|
# user = ":name (Slack)";
|
||||||
|
# userOverride = ":displayname";
|
||||||
|
# };
|
||||||
|
# presence = {
|
||||||
|
# enabled = false;
|
||||||
|
# };
|
||||||
|
# oauth = {
|
||||||
|
# enabled = false;
|
||||||
|
# };
|
||||||
|
#};
|
||||||
|
#serviceDependencies = ["matrix-synapse.service"];
|
||||||
|
#};
|
||||||
|
|
||||||
|
# services.mautrix-whatsapp = {
|
||||||
|
# enable = false;
|
||||||
|
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
|
||||||
|
#configOptions = {
|
||||||
|
# homeserver = {
|
||||||
|
# address = "https://chat.sealight.xyz";
|
||||||
|
# domain = "sealight.xyz";
|
||||||
|
# };
|
||||||
|
# appservice = {
|
||||||
|
# id = "whatsapp";
|
||||||
|
# address = http://localhost:9897;
|
||||||
|
# hostname = "0.0.0.0";
|
||||||
|
# port = 9897;
|
||||||
|
# database = {
|
||||||
|
# type = "sqlite3";
|
||||||
|
# uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
|
||||||
|
# };
|
||||||
|
# state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json";
|
||||||
|
# bot = {
|
||||||
|
# username = "whatsappbot";
|
||||||
|
# displayname = "WhatsApp bridge bot";
|
||||||
|
# avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
|
||||||
|
# };
|
||||||
|
# as_token = "";
|
||||||
|
# hs_token = "";
|
||||||
|
# };
|
||||||
|
# bridge = {
|
||||||
|
# username_template = "whatsapp_{{.}}";
|
||||||
|
# displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
|
||||||
|
# command_prefix = "!wa";
|
||||||
|
# permissions = {
|
||||||
|
# "@aynish:sealight.xyz" = 100;
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
# logging = {
|
||||||
|
# directory = "/var/lib/mautrix-whatsapp/logs";
|
||||||
|
# file_name_format = "{{.Date}}-{{.Index}}.log";
|
||||||
|
# file_date_format = "\"2006-01-02\"";
|
||||||
|
# file_mode = 384;
|
||||||
|
# timestamp_format = "Jan _2, 2006 15:04:05";
|
||||||
|
# print_level = "debug";
|
||||||
|
# };
|
||||||
|
# metrics = {
|
||||||
|
# enabled = true;
|
||||||
|
# listen = "http://localhost:5070";
|
||||||
|
# };
|
||||||
|
#};
|
||||||
|
# };
|
||||||
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -10,7 +10,8 @@ let
|
||||||
# TODO: switch to configGen.json once RFC42 is implemented
|
# TODO: switch to configGen.json once RFC42 is implemented
|
||||||
settingsFile = pkgs.writeText "matrix-appservice-slack-settings.json" (builtins.toJSON cfg.settings);
|
settingsFile = pkgs.writeText "matrix-appservice-slack-settings.json" (builtins.toJSON cfg.settings);
|
||||||
|
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
options = {
|
options = {
|
||||||
services.matrix-appservice-slack = {
|
services.matrix-appservice-slack = {
|
||||||
enable = mkEnableOption "a bridge between Matrix and Slack";
|
enable = mkEnableOption "a bridge between Matrix and Slack";
|
||||||
|
|
@ -5,10 +5,11 @@ with lib;
|
||||||
let
|
let
|
||||||
cfg = config.services.mautrix-whatsapp;
|
cfg = config.services.mautrix-whatsapp;
|
||||||
|
|
||||||
configFile = pkgs.runCommand "mautrix-whatsapp" {
|
configFile = pkgs.runCommand "mautrix-whatsapp"
|
||||||
buildInputs = [ pkgs.mautrix-whatsapp pkgs.remarshal ];
|
{
|
||||||
preferLocalBuild = true;
|
buildInputs = [ pkgs.mautrix-whatsapp pkgs.remarshal ];
|
||||||
} ''
|
preferLocalBuild = true;
|
||||||
|
} ''
|
||||||
mkdir -p $out
|
mkdir -p $out
|
||||||
${pkgs.remarshal}/bin/json2yaml -i ${pkgs.writeText "config.json" (builtins.toJSON cfg.configOptions)} \
|
${pkgs.remarshal}/bin/json2yaml -i ${pkgs.writeText "config.json" (builtins.toJSON cfg.configOptions)} \
|
||||||
-o $out/config.yaml
|
-o $out/config.yaml
|
||||||
|
|
@ -82,7 +83,7 @@ in
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
DynamicUser = true;
|
DynamicUser = true;
|
||||||
StateDirectory = "mautrix-whatsapp";
|
StateDirectory = "mautrix-whatsapp";
|
||||||
LoggingDir = "mautrix-whatsapp";
|
LoggingDir = "mautrix-whatsapp";
|
||||||
ExecStart = ''
|
ExecStart = ''
|
||||||
${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp -c "${configFile}/config.yaml"
|
${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp -c "${configFile}/config.yaml"
|
||||||
'';
|
'';
|
||||||
|
|
@ -6,11 +6,12 @@ let
|
||||||
dataDir = "/var/lib/mx-puppet-slack";
|
dataDir = "/var/lib/mx-puppet-slack";
|
||||||
registrationFile = "${dataDir}/slack-registration.yaml";
|
registrationFile = "${dataDir}/slack-registration.yaml";
|
||||||
cfg = config.services.mx-puppet-slack;
|
cfg = config.services.mx-puppet-slack;
|
||||||
settingsFormat = pkgs.formats.json {};
|
settingsFormat = pkgs.formats.json { };
|
||||||
settingsFile = settingsFormat.generate "mx-puppet-slack-config.json" cfg.settings;
|
settingsFile = settingsFormat.generate "mx-puppet-slack-config.json" cfg.settings;
|
||||||
mx-puppet-slack = pkgs.callPackage ./pkg-mx-puppet-slack.nix { };
|
mx-puppet-slack = pkgs.callPackage ./pkg-mx-puppet-slack.nix { };
|
||||||
|
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
options = {
|
options = {
|
||||||
services.mx-puppet-slack = {
|
services.mx-puppet-slack = {
|
||||||
enable = mkEnableOption ''
|
enable = mkEnableOption ''
|
||||||
159
profiles/metrics/default.nix
Normal file
159
profiles/metrics/default.nix
Normal file
|
|
@ -0,0 +1,159 @@
|
||||||
|
{ config, pkgs, ... }: {
|
||||||
|
# grafana configuration
|
||||||
|
#services.grafana = {
|
||||||
|
# enable = true;
|
||||||
|
# domain = "grafana.mossnet.lan";
|
||||||
|
# port = 2342;
|
||||||
|
# addr = "127.0.0.1";
|
||||||
|
#};
|
||||||
|
#
|
||||||
|
## nginx reverse proxy
|
||||||
|
#services.nginx.virtualHosts.${config.services.grafana.domain} = {
|
||||||
|
# locations."/" = {
|
||||||
|
# proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
|
||||||
|
# proxyWebsockets = true;
|
||||||
|
# };
|
||||||
|
#};
|
||||||
|
|
||||||
|
services.prometheus = {
|
||||||
|
enable = true;
|
||||||
|
port = 9001;
|
||||||
|
exporters = {
|
||||||
|
node = {
|
||||||
|
enable = true;
|
||||||
|
enabledCollectors = [ "systemd" ];
|
||||||
|
port = 9002;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
rules = [
|
||||||
|
''
|
||||||
|
groups:
|
||||||
|
- name: synapse
|
||||||
|
rules:
|
||||||
|
- record: "synapse_federation_transaction_queue_pendingEdus:total"
|
||||||
|
expr: "sum(synapse_federation_transaction_queue_pendingEdus or absent(synapse_federation_transaction_queue_pendingEdus)*0)"
|
||||||
|
- record: "synapse_federation_transaction_queue_pendingPdus:total"
|
||||||
|
expr: "sum(synapse_federation_transaction_queue_pendingPdus or absent(synapse_federation_transaction_queue_pendingPdus)*0)"
|
||||||
|
- record: 'synapse_http_server_request_count:method'
|
||||||
|
labels:
|
||||||
|
servlet: ""
|
||||||
|
expr: "sum(synapse_http_server_request_count) by (method)"
|
||||||
|
- record: 'synapse_http_server_request_count:servlet'
|
||||||
|
labels:
|
||||||
|
method: ""
|
||||||
|
expr: 'sum(synapse_http_server_request_count) by (servlet)'
|
||||||
|
|
||||||
|
- record: 'synapse_http_server_request_count:total'
|
||||||
|
labels:
|
||||||
|
servlet: ""
|
||||||
|
expr: 'sum(synapse_http_server_request_count:by_method) by (servlet)'
|
||||||
|
|
||||||
|
- record: 'synapse_cache:hit_ratio_5m'
|
||||||
|
expr: 'rate(synapse_util_caches_cache:hits[5m]) / rate(synapse_util_caches_cache:total[5m])'
|
||||||
|
- record: 'synapse_cache:hit_ratio_30s'
|
||||||
|
expr: 'rate(synapse_util_caches_cache:hits[30s]) / rate(synapse_util_caches_cache:total[30s])'
|
||||||
|
|
||||||
|
- record: 'synapse_federation_client_sent'
|
||||||
|
labels:
|
||||||
|
type: "EDU"
|
||||||
|
expr: 'synapse_federation_client_sent_edus + 0'
|
||||||
|
- record: 'synapse_federation_client_sent'
|
||||||
|
labels:
|
||||||
|
type: "PDU"
|
||||||
|
expr: 'synapse_federation_client_sent_pdu_destinations:count + 0'
|
||||||
|
- record: 'synapse_federation_client_sent'
|
||||||
|
labels:
|
||||||
|
type: "Query"
|
||||||
|
expr: 'sum(synapse_federation_client_sent_queries) by (job)'
|
||||||
|
|
||||||
|
- record: 'synapse_federation_server_received'
|
||||||
|
labels:
|
||||||
|
type: "EDU"
|
||||||
|
expr: 'synapse_federation_server_received_edus + 0'
|
||||||
|
- record: 'synapse_federation_server_received'
|
||||||
|
labels:
|
||||||
|
type: "PDU"
|
||||||
|
expr: 'synapse_federation_server_received_pdus + 0'
|
||||||
|
- record: 'synapse_federation_server_received'
|
||||||
|
labels:
|
||||||
|
type: "Query"
|
||||||
|
expr: 'sum(synapse_federation_server_received_queries) by (job)'
|
||||||
|
|
||||||
|
- record: 'synapse_federation_transaction_queue_pending'
|
||||||
|
labels:
|
||||||
|
type: "EDU"
|
||||||
|
expr: 'synapse_federation_transaction_queue_pending_edus + 0'
|
||||||
|
- record: 'synapse_federation_transaction_queue_pending'
|
||||||
|
labels:
|
||||||
|
type: "PDU"
|
||||||
|
expr: 'synapse_federation_transaction_queue_pending_pdus + 0'
|
||||||
|
|
||||||
|
- record: synapse_storage_events_persisted_by_source_type
|
||||||
|
expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_type="remote"})
|
||||||
|
labels:
|
||||||
|
type: remote
|
||||||
|
- record: synapse_storage_events_persisted_by_source_type
|
||||||
|
expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity="*client*",origin_type="local"})
|
||||||
|
labels:
|
||||||
|
type: local
|
||||||
|
- record: synapse_storage_events_persisted_by_source_type
|
||||||
|
expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity!="*client*",origin_type="local"})
|
||||||
|
labels:
|
||||||
|
type: bridges
|
||||||
|
- record: synapse_storage_events_persisted_by_event_type
|
||||||
|
expr: sum without(origin_entity, origin_type) (synapse_storage_events_persisted_events_sep)
|
||||||
|
- record: synapse_storage_events_persisted_by_origin
|
||||||
|
expr: sum without(type) (synapse_storage_events_persisted_events_sep)
|
||||||
|
''
|
||||||
|
];
|
||||||
|
scrapeConfigs = [
|
||||||
|
{
|
||||||
|
job_name = "helix";
|
||||||
|
static_configs = [{
|
||||||
|
targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
|
||||||
|
}];
|
||||||
|
}
|
||||||
|
{
|
||||||
|
job_name = "synapse";
|
||||||
|
metrics_path = "/_synapse/metrics";
|
||||||
|
static_configs = [{
|
||||||
|
targets = [ "localhost:9090" ];
|
||||||
|
}];
|
||||||
|
}
|
||||||
|
{
|
||||||
|
job_name = "gitea";
|
||||||
|
static_configs = [{
|
||||||
|
targets = [ "localhost:3001" ];
|
||||||
|
}];
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall = {
|
||||||
|
enable = true;
|
||||||
|
allowedTCPPorts = [ 9001 ];
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."sealight.xyz" = {
|
||||||
|
locations."/metrics" = {
|
||||||
|
#basicAuth = { anish = "password"; };
|
||||||
|
proxyPass = "http://localhost:9001";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.loki = {
|
||||||
|
enable = true;
|
||||||
|
configFile = /var/loki-config.yaml;
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.promtail = {
|
||||||
|
description = "Promtail service for Loki";
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
|
||||||
|
serviceConfig = {
|
||||||
|
ExecStart = ''
|
||||||
|
${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml}
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -5,6 +5,7 @@
|
||||||
192.168.1.240 read.mossnet.lan
|
192.168.1.240 read.mossnet.lan
|
||||||
192.168.1.240 music.mossnet.lan
|
192.168.1.240 music.mossnet.lan
|
||||||
192.168.1.240 stats.mossnet.lan
|
192.168.1.240 stats.mossnet.lan
|
||||||
|
192.168.1.240 file.mossnet.lan
|
||||||
'';
|
'';
|
||||||
# 10.0.69.4 mossnet.lan
|
# 10.0.69.4 mossnet.lan
|
||||||
# 10.0.69.4 links.mossnet.lan
|
# 10.0.69.4 links.mossnet.lan
|
||||||
|
|
|
||||||
|
|
@ -1,14 +1,11 @@
|
||||||
{pkgs, lib, config, ...}:
|
{ pkgs, lib, config, ... }:
|
||||||
{
|
{
|
||||||
services.rss-bridge = {
|
services.rss-bridge = {
|
||||||
enable = true;
|
enable = true;
|
||||||
virtualHost = "rss.mossnet.lan";
|
virtualHost = "bridge.sealight.xyz";
|
||||||
whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram"];
|
whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit" ];
|
||||||
#dataDir = "/etc/rss-bridge/";
|
|
||||||
};
|
};
|
||||||
#environment.etc."rss-bridge/config.ini.php" = ''
|
|
||||||
# [InstagramBridge]
|
services.nginx.virtualHosts."bridge.sealight.xyz".forceSSL = true;
|
||||||
# session_id = %sessionid from step 1%
|
services.nginx.virtualHosts."bridge.sealight.xyz".enableACME = true;
|
||||||
# cache_timeout = %cache timeout in seconds%
|
|
||||||
#'';
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -7,7 +7,48 @@
|
||||||
fileserver.host = "0.0.0.0";
|
fileserver.host = "0.0.0.0";
|
||||||
fileserver.port = 8082;
|
fileserver.port = 8082;
|
||||||
};
|
};
|
||||||
ccnetSettings.General.SERVICE_URL = "file.mossnet.lan";
|
ccnetSettings.General.SERVICE_URL = "http://file.mossnet.lan";
|
||||||
|
adminEmail = "anish@lakhwara.com";
|
||||||
initialAdminPassword = "arandompasswordsecure!";
|
initialAdminPassword = "arandompasswordsecure!";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
};
|
||||||
|
services.nginx.upstreams."gunicorn_seafile" = {
|
||||||
|
servers."unix:/run/seahub/gunicorn.sock" = { };
|
||||||
|
};
|
||||||
|
services.nginx.upstreams."seafhttp" = {
|
||||||
|
servers."127.0.0.1:8082" = { };
|
||||||
|
};
|
||||||
|
services.nginx.virtualHosts."file.mossnet.lan" = {
|
||||||
|
serverName = "file.mossnet.lan";
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://gunicorn_seafile"; # without a trailing /
|
||||||
|
extraConfig = ''
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-Host $server_name;
|
||||||
|
#proxy_set_header Host $host;
|
||||||
|
proxy_read_timeout 1200s;
|
||||||
|
|
||||||
|
client_max_body_size 0; # disable max upload size
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
locations."/seafhttp" = {
|
||||||
|
proxyPass = "http://seafhttp"; # without a trailing /
|
||||||
|
extraConfig = ''
|
||||||
|
rewrite ^/seafhttp(.*)$ $1 break;
|
||||||
|
client_max_body_size 0;
|
||||||
|
|
||||||
|
proxy_connect_timeout 36000s;
|
||||||
|
proxy_read_timeout 36000s;
|
||||||
|
proxy_send_timeout 36000s;
|
||||||
|
|
||||||
|
proxy_request_buffering off;
|
||||||
|
send_timeout 36000s;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
14
profiles/sealight-website/default.nix
Normal file
14
profiles/sealight-website/default.nix
Normal file
|
|
@ -0,0 +1,14 @@
|
||||||
|
{
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
vhost = {
|
||||||
|
"sealight.xyz" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
locations."/" = {
|
||||||
|
root = "/var/www/sealight.xyz"
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -7,8 +7,8 @@
|
||||||
group = "users";
|
group = "users";
|
||||||
dataDir = "/home/anish/";
|
dataDir = "/home/anish/";
|
||||||
configDir = "/home/anish/.config/syncthing";
|
configDir = "/home/anish/.config/syncthing";
|
||||||
guiAddress = "0.0.0.0:8384";
|
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 8384 22000 ];
|
networking.firewall.allowedTCPPorts = [ 8384 22000 ];
|
||||||
|
networking.firewall.allowedUDPPorts = [ 22000 21027 ];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
35
profiles/wireguard-server/default.nix
Normal file
35
profiles/wireguard-server/default.nix
Normal file
|
|
@ -0,0 +1,35 @@
|
||||||
|
{ config, pkgs, lib, ... }:
|
||||||
|
{
|
||||||
|
environment.systemPackages = [ pkgs.wireguard pkgs.mosh ];
|
||||||
|
networking.nat = {
|
||||||
|
enable = true;
|
||||||
|
externalInterface = "ens3";
|
||||||
|
internalInterfaces = [ "wg0" ];
|
||||||
|
};
|
||||||
|
networking.firewall = {
|
||||||
|
allowedUDPPorts = [ 60990 ];
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.wireguard.interfaces.wg0 = {
|
||||||
|
ips = [ "10.0.69.1/24" ];
|
||||||
|
listenPort = 60990;
|
||||||
|
privateKeyFile = "/var/lib/wireguard/priv";
|
||||||
|
peers = [
|
||||||
|
{
|
||||||
|
# box
|
||||||
|
publicKey = "Ra78mOc110K7URN5uB3m9d78iBKgeRHzT+3HkiFp9BU=";
|
||||||
|
allowedIPs = [ "10.0.69.4/32" ];
|
||||||
|
}
|
||||||
|
{
|
||||||
|
# line
|
||||||
|
publicKey = "fsb1FuGmYi89p4CVXytKw2FYamONKtoanxrgs/dJjC8=";
|
||||||
|
allowedIPs = [ "10.0.69.3/32" ];
|
||||||
|
}
|
||||||
|
{
|
||||||
|
# curve
|
||||||
|
publicKey = "XmV4AcPPND/eeSI6d9M1iahCjtymqY6DdUDEFNP/x3g=";
|
||||||
|
allowedIPs = [ "10.0.69.2/32" ];
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
Loading…
Reference in a new issue