moving helix into profiles
This commit is contained in:
		
							parent
							
								
									4a7e9d536b
								
							
						
					
					
						commit
						7ac844b1f9
					
				|  | @ -1,10 +0,0 @@ | |||
| { pkgs, lib, budUtils, ... }: { | ||||
|   bud.cmds = with pkgs; { | ||||
|     get = { | ||||
|       writer = budUtils.writeBashWithPaths [ nixUnstable git coreutils ]; | ||||
|       synopsis = "get [DEST]"; | ||||
|       help = "Copy the desired template to DEST"; | ||||
|       script = ./get.bash; | ||||
|     }; | ||||
|   }; | ||||
| } | ||||
|  | @ -1 +0,0 @@ | |||
| nix flake new -t "github:divnix/devos/core" "${2:-devos}" | ||||
							
								
								
									
										12
									
								
								flake.nix
									
									
									
									
									
								
							
							
						
						
									
										12
									
								
								flake.nix
									
									
									
									
									
								
							|  | @ -1,10 +1,6 @@ | |||
| { | ||||
|   description = "A highly structured configuration database."; | ||||
| 
 | ||||
|   nixConfig.extra-experimental-features = "nix-command flakes"; | ||||
|   nixConfig.extra-substituters = "https://nrdxp.cachix.org https://nix-community.cachix.org"; | ||||
|   nixConfig.extra-trusted-public-keys = "nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="; | ||||
| 
 | ||||
|   inputs = | ||||
|     { | ||||
|       # Nix | ||||
|  | @ -126,11 +122,11 @@ | |||
|             }; | ||||
|             suites = with profiles; rec { | ||||
|               base = [ core users.root users.anish ]; | ||||
|               sealight = [ base server ]; # matrix rsshub backup wireguard-server | ||||
|               mossnet = [ base server taskd shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale seafile syncthing ]; # hpi syncthing sync.music | ||||
|               sealight = [ base server rss-bridge gitea wireguard-server metrics sealight-website ]; # matrix backup | ||||
|               mossnet = [ base server taskd shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale seafile syncthing ]; # hpi sync.music | ||||
|               cube = [ base site server ]; | ||||
|               graphical = [ base bluetooth music sync.kitaab sync.website sync.cal wifi desktop ]; # syncthing | ||||
|               curve = [ graphical secrets ]; | ||||
|               graphical = [ base bluetooth music sync.kitaab sync.website sync.cal wifi desktop ]; | ||||
|               curve = [ graphical secrets syncthing ]; | ||||
|               work = [ base ]; | ||||
|             }; | ||||
|           }; | ||||
|  |  | |||
|  | @ -9,6 +9,7 @@ | |||
|   }; | ||||
| 
 | ||||
|   # For some reason this doesn't work in the profile, but does over here?? | ||||
|   # Something weird in the way I'm importing nixpkgs in the profile or something | ||||
|   services."grasp".enable = true; | ||||
|   services."grasp".path = "/home/anish/kitaab/grasp"; | ||||
|   services."grasp".user = "anish"; | ||||
|  | @ -28,10 +29,10 @@ | |||
|       "/var/www/shaarli-config" # sharli | ||||
|       "/var/backup/postgresql" # wallabag | ||||
|       "/var/lib/radicale" # radicale | ||||
|       "/home/anish/usr/syncthing" # syncthing | ||||
|       "/home/anish/usr/drawing" # syncthing | ||||
|       "/home/anish/usr/nonfiction" # syncthing | ||||
|     ]; | ||||
|     # seafile? | ||||
|     # syncthing | ||||
|     # seafile | ||||
|   }; | ||||
| 
 | ||||
|   age.secrets.box-wg.file = "${self}/secrets/box-wg.age"; | ||||
|  | @ -41,4 +42,5 @@ | |||
|     ips = [ "10.0.69.4/24" ]; | ||||
|     privateKeyFile = "/run/agenix/box-wg"; | ||||
|   }; | ||||
|   services.syncthing.guiAddress = "0.0.0.0:8384"; # public syncthing | ||||
| } | ||||
|  |  | |||
							
								
								
									
										37
									
								
								hosts/helix/configuration.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										37
									
								
								hosts/helix/configuration.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,37 @@ | |||
| { config, pkgs, ... }: | ||||
| { | ||||
|   imports = | ||||
|     [ | ||||
|       # Include the results of the hardware scan. | ||||
|       ./hardware-configuration.nix | ||||
|     ]; | ||||
| 
 | ||||
|   # Use the GRUB 2 boot loader. | ||||
|   boot.loader.grub.enable = true; | ||||
|   boot.loader.grub.version = 2; | ||||
|   boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only | ||||
| 
 | ||||
|   networking.hostName = "helix"; # Define your hostname. | ||||
| 
 | ||||
|   networking.useDHCP = false; | ||||
|   networking.interfaces.ens3.useDHCP = true; | ||||
| 
 | ||||
|   # Configure network proxy if necessary | ||||
|   # networking.proxy.default = "http://user:password@proxy:port/"; | ||||
|   # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; | ||||
| 
 | ||||
|   # Enable the OpenSSH daemon. | ||||
|   services.openssh.enable = true; | ||||
|   services.openssh.passwordAuthentication = false; | ||||
|   services.openssh.permitRootLogin = "no"; | ||||
|   sound.enable = false; | ||||
| 
 | ||||
|   # Define a user account. Don't forget to set a password with ‘passwd’. | ||||
|   # This value determines the NixOS release with which your system is to be | ||||
|   # compatible, in order to avoid breaking some software such as database | ||||
|   # servers. You should change this only after NixOS release notes say you | ||||
|   # should. | ||||
|   system.stateVersion = "19.09"; # Did you read the comment? | ||||
| 
 | ||||
| } | ||||
| 
 | ||||
							
								
								
									
										23
									
								
								hosts/helix/default.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										23
									
								
								hosts/helix/default.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,23 @@ | |||
| { self, profiles, suites, ... }: | ||||
| { | ||||
|   imports = [ | ||||
|     ./configuration.nix | ||||
|   ] ++ suites.sealight; | ||||
| 
 | ||||
|   home-manager.users.anish = { self, suites, ... }: { | ||||
|     imports = [ ] ++ suites.hmBase; | ||||
|   }; | ||||
| 
 | ||||
|   mossnet.backup = { | ||||
|     enable = false; | ||||
|     name = "sealight"; | ||||
|     paths = [ "/var/backup/postgresql" ]; | ||||
|   }; | ||||
| 
 | ||||
|   age.secrets.borg-password.file = "${self}/secrets/borg-password.age"; | ||||
|   services.postgresqlBackup = { | ||||
|     enable = false; | ||||
|     databases = [ "matrix" "gitea" ]; | ||||
|     location = "/var/backup/postgresql"; | ||||
|   }; | ||||
| } | ||||
|  | @ -5,7 +5,8 @@ | |||
| 
 | ||||
| { | ||||
|   imports = | ||||
|     [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> | ||||
|     [ | ||||
|       <nixpkgs/nixos/modules/profiles/qemu-guest.nix> | ||||
|     ]; | ||||
| 
 | ||||
|   boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ]; | ||||
|  | @ -14,7 +15,8 @@ | |||
|   boot.extraModulePackages = [ ]; | ||||
| 
 | ||||
|   fileSystems."/" = | ||||
|     { device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6"; | ||||
|     { | ||||
|       device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6"; | ||||
|       fsType = "btrfs"; | ||||
|     }; | ||||
| 
 | ||||
|  | @ -44,7 +44,8 @@ | |||
|     recommendedOptimisation = true; | ||||
|     recommendedProxySettings = true; | ||||
|     recommendedTlsSettings = true; | ||||
|    virtualHosts."git.sealight.xyz" = {                  # Gitea hostname | ||||
|     virtualHosts."git.sealight.xyz" = { | ||||
|       # Gitea hostname | ||||
|       enableACME = true; # Use ACME certs | ||||
|       forceSSL = true; # Force SSL | ||||
|       locations."/".proxyPass = "http://localhost:3001/"; # Proxy Gitea | ||||
|  | @ -1,60 +0,0 @@ | |||
| { config, pkgs, ... }: | ||||
| { | ||||
|   imports = | ||||
|     [ # Include the results of the hardware scan. | ||||
|       ./hardware-configuration.nix | ||||
|       ./wireguard.nix | ||||
|       ./matrix.nix | ||||
|       ./monitoring.nix | ||||
|       ./rss-bridge.nix | ||||
|       ./gitea.nix | ||||
|       # ./dns.nix | ||||
|       "${builtins.fetchTarball "https://github.com/ryantm/agenix/archive/main.tar.gz"}/modules/age.nix" | ||||
|     ]; | ||||
| 
 | ||||
|   # Use the GRUB 2 boot loader. | ||||
|   boot.loader.grub.enable = true; | ||||
|   boot.loader.grub.version = 2; | ||||
|   boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only | ||||
| 
 | ||||
|   networking.hostName = "helix"; # Define your hostname. | ||||
| 
 | ||||
|   networking.useDHCP = false; | ||||
|   networking.interfaces.ens3.useDHCP = true; | ||||
| 
 | ||||
|   # Configure network proxy if necessary | ||||
|   # networking.proxy.default = "http://user:password@proxy:port/"; | ||||
|   # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; | ||||
| 
 | ||||
|   # Enable the OpenSSH daemon. | ||||
|   services.openssh.enable = true; | ||||
|   services.openssh.passwordAuthentication = false; | ||||
|   services.openssh.permitRootLogin = "no"; | ||||
| 
 | ||||
|   # Open ports in the firewall. | ||||
|   # networking.firewall.allowedTCPPorts = [ ... ]; | ||||
|   # networking.firewall.allowedUDPPorts = [ ... ]; | ||||
|   # Or disable the firewall altogether. | ||||
|   # networking.firewall.enable = false; | ||||
| 
 | ||||
|   # Include agenix | ||||
|   #environment.systemPackages = [ agenix.defaultPackage.x86_64-linux ]; | ||||
| 
 | ||||
|   # Define a user account. Don't forget to set a password with ‘passwd’. | ||||
|   users.users.anish = { | ||||
|     isNormalUser = true; | ||||
|     extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user | ||||
|     openssh.authorizedKeys.keys = [ | ||||
| 	"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve"   | ||||
| 	"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCeWQsf9rbE+KBrWLkLkg1PMKx0jPfDP8xyv+XtddIQzAskRTN+JSSQp1GpoRgfQij7bx6f6DfjkwSQK5NWDQNQ+klGhcdEwEdptWUzpRAvKHMImjyIwFHmRKKEgcfH8+DSHVM93nRSQKrLezX4PzPkHF9f3TLxFdGeQDeY0J2oP2Oa97hRtuTJZW9BwUojyvDYUbg7F3fxf+pdFCvIAFaayiLkhOYdTXnjLt1Ks6NOhSzM78ZibHv4pFYI9r6dhflkFP/SzyLeSSm1aVAtxqE7vF5HnnORAg0byDsiOv/9RXxiDx7gkAAw3xENDSpp9TRj54M7iz1OSsRMhmD6orHjZFIRejlE4DIn+PBPm3PH+U5ILKTogE6n5MfPT28V0QdtHuqq3b5tSWiDcFpnjxbIUmEIo5hLzMR0tXZoNLQhBCSNfxjE8CYzpk7mHbvhSs2GPfG+NI1vvldbw2EF8beJFQHNYTqJw8y7p8RXpCwZqqpSitJX6v9DiYdLVG1hWvE= nix-on-droid@localhost" | ||||
| 	 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box" ]; | ||||
|   }; | ||||
| 
 | ||||
|   # This value determines the NixOS release with which your system is to be | ||||
|   # compatible, in order to avoid breaking some software such as database | ||||
|   # servers. You should change this only after NixOS release notes say you | ||||
|   # should. | ||||
|   system.stateVersion = "19.09"; # Did you read the comment? | ||||
| 
 | ||||
| } | ||||
| 
 | ||||
|  | @ -1,375 +0,0 @@ | |||
| { config, lib, pkgs, ... }: | ||||
| 
 | ||||
| { | ||||
|   imports = [  | ||||
| 	#./mod-mx-puppet-slack.nix  | ||||
| 	./mautrix-whatsapp.nix  | ||||
| 	./mod-heisenbridge.nix | ||||
|   ]; | ||||
|   security.acme.email = "anish+acme@lakhwara.com"; | ||||
|   security.acme.acceptTerms = true; | ||||
|   services.matrix-synapse = { | ||||
|     enable = true; | ||||
|     app_service_config_files = [ | ||||
|     #  # The registration file is automatically generated after starting the appservice for the first time. | ||||
|     #  # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/ | ||||
|     #  # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml | ||||
|        "/var/lib/matrix-synapse/discord-registration.yaml" | ||||
|        "/var/lib/matrix-synapse/telegram-registration.yaml" | ||||
|        #"/var/lib/matrix-synapse/slack-registration.yaml" | ||||
|        #"/var/lib/matrix-synapse/whatsapp-registration.yaml" | ||||
|     ]; | ||||
|     server_name = "sealight.xyz"; | ||||
|     registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; | ||||
|     enable_metrics = true; | ||||
|     enable_registration = true; | ||||
|     database_type = "psycopg2"; | ||||
|     database_args = { | ||||
|       database = "matrix-synapse"; | ||||
|     }; | ||||
| 
 | ||||
|     listeners = [ | ||||
|       { | ||||
|         port = 8448; | ||||
|         tls = false; | ||||
|         resources = [{ | ||||
|             compress = true; | ||||
|             names = ["client" "federation"]; | ||||
|           }]; | ||||
|       } | ||||
|       { | ||||
| 	port = 9090; | ||||
| 	type = "metrics"; | ||||
| 	bind_address = "0.0.0.0"; | ||||
| 	resources = [{  | ||||
| 	  compress = false; | ||||
| 	  names = []; | ||||
| 	}]; | ||||
| 	tls = false; | ||||
|       } | ||||
|     ]; | ||||
|     extraConfig = '' | ||||
|       max_upload_size: "50M" | ||||
|       use_presence: false | ||||
|     ''; | ||||
|     ## coturn based TURN server integration (TURN server setup mentioned later), | ||||
|     ## shared secret generated while configuring coturn | ||||
|     ## and reused here (power of Nix being a real programming language) | ||||
|     turn_uris = [ | ||||
|       "turn:turn.sealight.xyz:3478?transport=udp" | ||||
|       "turn:turn.sealight.xyz:3478?transport=tcp" | ||||
|     ]; | ||||
|     turn_shared_secret = config.services.coturn.static-auth-secret; | ||||
|   }; | ||||
| 
 | ||||
| 
 | ||||
|   services.coturn = { | ||||
|     enable = true; | ||||
|     use-auth-secret = true; | ||||
|     static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ"; | ||||
|     realm = "turn.sealight.xyz"; | ||||
|     min-port = 49111; | ||||
|     max-port = 51111; | ||||
|     no-cli = true; | ||||
|     no-tcp-relay = true; | ||||
|     no-tls = true; | ||||
|     cert = "${config.security.acme.certs."turn.sealight.xyz".directory}/full.pem"; | ||||
|     pkey = "${config.security.acme.certs."turn.sealight.xyz".directory}/key.pem"; | ||||
|     extraConfig = '' | ||||
| 	verbose | ||||
|         user-quota=12 | ||||
|         total-quota=1200 | ||||
|         denied-peer-ip=10.0.0.0-10.255.255.255 | ||||
|         denied-peer-ip=192.168.0.0-192.168.255.255 | ||||
|         denied-peer-ip=172.16.0.0-172.31.255.255 | ||||
| 	denied-peer-ip=0.0.0.0-0.255.255.255 | ||||
| 	denied-peer-ip=100.64.0.0-100.127.255.255 | ||||
| 	denied-peer-ip=127.0.0.0-127.255.255.255 | ||||
| 	denied-peer-ip=169.254.0.0-169.254.255.255 | ||||
| 	denied-peer-ip=192.0.0.0-192.0.0.255 | ||||
| 	denied-peer-ip=192.0.2.0-192.0.2.255 | ||||
| 	denied-peer-ip=192.88.99.0-192.88.99.255 | ||||
| 	denied-peer-ip=198.18.0.0-198.19.255.255 | ||||
| 	denied-peer-ip=198.51.100.0-198.51.100.255 | ||||
| 	denied-peer-ip=203.0.113.0-203.0.113.255 | ||||
| 	denied-peer-ip=240.0.0.0-255.255.255.255 | ||||
|     ''; | ||||
|   }; | ||||
| 
 | ||||
|   security.acme.certs.${config.services.coturn.realm} = { | ||||
|     /* insert here the right configuration to obtain a certificate */ | ||||
|     webroot = "/var/lib/acme/acme-challenge/"; | ||||
|     email = "anish+acme@lakhwara.com"; | ||||
|     postRun = "systemctl restart coturn.service"; | ||||
|     group = "turnserver"; | ||||
|   }; | ||||
| 
 | ||||
|   services.jitsi-meet = { | ||||
|     enable = true; | ||||
|     hostName = "jitsi.sealight.xyz"; | ||||
|   }; | ||||
|   services.jitsi-videobridge.enable = true; | ||||
| 
 | ||||
|   services.mautrix-telegram = { | ||||
|     enable = true; | ||||
|     environmentFile = /etc/secrets/telegram.env; # file containing the appservice and telegram tokens | ||||
|     # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. | ||||
|     settings = { | ||||
|       homeserver = { | ||||
|         address = "https://sealight.xyz"; | ||||
|         domain = "sealight.xyz"; | ||||
|       }; | ||||
|       appservice = { | ||||
|         provisioning.enabled = false; | ||||
|         id = "telegram"; | ||||
| 	bot_username = "telegrambridge"; | ||||
|         public = { | ||||
|           enabled = false; | ||||
|           prefix = "/public"; | ||||
|           external = "https://chat.sealight.xyz/public"; | ||||
|         }; | ||||
| 	address = "http://localhost:18787"; | ||||
| 	port = 18787; | ||||
|         # The service uses SQLite by default, but it's also possible to use PostgreSQL instead: | ||||
|         #database = "postgresql:///mautrix-telegram?host=/run/postgresql"; | ||||
|       }; | ||||
|       bridge = { | ||||
|         relaybot.authless_portals = false; | ||||
|         permissions = { | ||||
|           "@aynish:sealight.xyz" = "admin"; | ||||
|         }; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   services.mautrix-whatsapp = { | ||||
|     enable = false; | ||||
|     # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. | ||||
|     #configOptions = { | ||||
|     #  homeserver = { | ||||
|     #    address = "https://chat.sealight.xyz"; | ||||
|     #    domain = "sealight.xyz"; | ||||
|     #  }; | ||||
|     #  appservice = { | ||||
|     #    id = "whatsapp"; | ||||
|     #    address = http://localhost:9897; | ||||
|     #    hostname = "0.0.0.0"; | ||||
|     #    port = 9897; | ||||
|     #    database = { | ||||
|     #      type = "sqlite3"; | ||||
|     #      uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db"; | ||||
|     #    }; | ||||
|     #    state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json"; | ||||
|     #    bot = { | ||||
|     #      username = "whatsappbot"; | ||||
|     #      displayname = "WhatsApp bridge bot"; | ||||
|     #      avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr"; | ||||
|     #    }; | ||||
|     #    as_token = ""; | ||||
|     #    hs_token = ""; | ||||
|     #  }; | ||||
|     #  bridge = { | ||||
|     #    username_template = "whatsapp_{{.}}"; | ||||
|     #    displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)"; | ||||
|     #    command_prefix = "!wa"; | ||||
|     #    permissions = { | ||||
|     #    	"@aynish:sealight.xyz" = 100; | ||||
|     #    }; | ||||
|     #  }; | ||||
|     #  logging = { | ||||
|     #    directory = "/var/lib/mautrix-whatsapp/logs"; | ||||
|     #    file_name_format = "{{.Date}}-{{.Index}}.log"; | ||||
|     #    file_date_format = "\"2006-01-02\""; | ||||
|     #    file_mode = 384; | ||||
|     #    timestamp_format = "Jan _2, 2006 15:04:05"; | ||||
|     #    print_level = "debug"; | ||||
|     #  }; | ||||
|     #  metrics = { | ||||
|     #    enabled = true; | ||||
|     #    listen  = "http://localhost:5070"; | ||||
|     #  }; | ||||
|     #}; | ||||
|   }; | ||||
| 
 | ||||
|   services.mx-puppet-discord = { | ||||
|     enable = true; | ||||
|     settings = { | ||||
|       bridge = {  | ||||
| 	bindAddress = "localhost"; | ||||
| 	port = 16785; | ||||
|  	domain = "sealight.xyz"; | ||||
|  	homeserverUrl = "https://sealight.xyz"; | ||||
| 	avatarUrl = "https://discord.com/assets/2d20a45d79110dc5bf947137e9d99b66.svg"; | ||||
|       }; | ||||
|       provisioning = { | ||||
| 	whitelist = [ "@aynish:sealight.xyz" ]; | ||||
|       }; | ||||
|       relay = { | ||||
| 	whitelist = [ "@aynish:sealight.xyz" ]; | ||||
|       }; | ||||
|       namePatterns = { | ||||
|         group = ":name"; | ||||
|         room = ":name"; | ||||
|         user = ":name (Discord)"; | ||||
|         userOverride = ":displayname"; | ||||
|       }; | ||||
|       presence = { | ||||
|         enabled = false; | ||||
|       }; | ||||
|     }; | ||||
|     serviceDependencies = ["matrix-synapse.service"]; | ||||
|   }; | ||||
| 
 | ||||
|   #services.mx-puppet-slack= { | ||||
|     #enable = false; | ||||
|     #settings = { | ||||
|     #  bridge = {  | ||||
|     #    bindAddress = "localhost"; | ||||
|     #    port = 16786; | ||||
|     #    domain = "sealight.xyz"; | ||||
|     #    homeserverUrl = "https://sealight.xyz"; | ||||
|     #  }; | ||||
|     #  provisioning = { | ||||
|     #    whitelist = [ "@aynish:sealight.xyz" ]; | ||||
|     #  }; | ||||
|     #  relay = { | ||||
|     #    whitelist = [ "@aynish:sealight.xyz" ]; | ||||
|     #  }; | ||||
|     #  namePatterns = { | ||||
|     #    group = ":name"; | ||||
|     #    room = ":name[:team? - :team,]"; | ||||
|     #    user = ":name (Slack)"; | ||||
|     #    userOverride = ":displayname"; | ||||
|     #  }; | ||||
|     #  presence = { | ||||
|     #    enabled = false; | ||||
|     #  }; | ||||
|     #  oauth = { | ||||
|     #    enabled = false; | ||||
|     #  }; | ||||
|     #}; | ||||
|     #serviceDependencies = ["matrix-synapse.service"]; | ||||
|   #}; | ||||
| 
 | ||||
|   services.heisenbridge = { | ||||
|     enable = true; | ||||
|     homeserver = "https://sealight.xyz"; | ||||
|     listenPort = 14456; | ||||
|     appServiceToken = "wyujLh8kjpmk2bfKeEE3sZ2gWOEUBKK5";  | ||||
|     homeserverToken = "yEHs7lthD2ZHUibJOAv1APaFhEjxN5PT"; | ||||
|   }; | ||||
| 
 | ||||
|   services.postgresql = { | ||||
|     enable = true; | ||||
|     ## postgresql user and db name remains in the | ||||
|     ## service.matrix-synapse.database_args setting which | ||||
|     ## by default is matrix-synapse | ||||
|     initialScript = pkgs.writeText "synapse-init.sql" '' | ||||
|         CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|'kq@iBwlIzu"; | ||||
|         CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse" | ||||
|             TEMPLATE template0 | ||||
|             LC_COLLATE = "C" | ||||
|             LC_CTYPE = "C"; | ||||
|         ''; | ||||
|   }; | ||||
| 
 | ||||
|   networking.firewall = let | ||||
|   range = with config.services.coturn; [ { | ||||
|       from = min-port; | ||||
|       to = max-port; | ||||
|     } ];  | ||||
|     in { | ||||
|     enable = true; | ||||
|     allowedUDPPortRanges = range; # coturn | ||||
|     allowedTCPPortRanges = range; | ||||
|     allowedTCPPorts = [ | ||||
|       22    # SSH | ||||
|       8448  # Matrix federation | ||||
|       8008 | ||||
|       80  | ||||
|       443 | ||||
|       3478 # Coturn service | ||||
|       5349 # Coturn service | ||||
|       9090 # Synapse Metrics | ||||
|     ]; | ||||
|     allowedUDPPorts = [  | ||||
|       3478 | ||||
|       5349 # Coturn service | ||||
|     ]; | ||||
|   }; | ||||
| 
 | ||||
|  nixpkgs.overlays = [ | ||||
|     (self: super: { | ||||
|         element-web = super.element-web.override { | ||||
|             conf = { | ||||
|                  default_server_config = { | ||||
|                     "m.homeserver" = { | ||||
|                         "base_url" = "https://chat.sealight.xyz"; | ||||
|                         "server_name" = "sealight.xyz"; | ||||
|                     }; | ||||
|                     "m.identity_server" = { | ||||
|                         "base_url" = "https://vector.im"; | ||||
|                     }; | ||||
|                  }; | ||||
| 
 | ||||
|                  ## jitsi will be setup later, | ||||
|                  ## but we need to add to Riot configuration | ||||
|                  jitsi.preferredDomain = "jitsi.sealight.xyz"; | ||||
|             }; | ||||
|         }; | ||||
|     }) | ||||
|   ]; | ||||
| 
 | ||||
|   services.nginx = { | ||||
|    enable = true; | ||||
|    virtualHosts = { | ||||
| 
 | ||||
|      "sealight.xyz" = { | ||||
|        forceSSL = true; | ||||
|        enableACME = true; | ||||
|        locations."/" = { | ||||
|          root = "/var/www/sealight.xyz"; | ||||
|        }; | ||||
|        locations."/_matrix" = { | ||||
|          proxyPass = "http://localhost:8448"; | ||||
|        }; | ||||
|        locations."/slackbridge" = { | ||||
|          proxyPass = "http://localhost:9899"; | ||||
|        }; | ||||
|      }; | ||||
| 
 | ||||
|      ## virtual host for Synapse | ||||
|      "chat.sealight.xyz" = { | ||||
|        forceSSL = true; | ||||
|        enableACME = true; | ||||
|        #useACMEHost = "sealight.xyz"; | ||||
|        locations."/" = { | ||||
|          proxyPass = "http://localhost:8448"; | ||||
|        }; | ||||
|      }; | ||||
| 
 | ||||
|      ## virtual host for Riot/Web | ||||
|      "element.sealight.xyz" = { | ||||
|        forceSSL = true; | ||||
|        enableACME = true; | ||||
|        #useACMEHost = "sealight.xyz"; | ||||
| 
 | ||||
|        ## root points to the riot-web package content, also configured via Nix | ||||
|        locations."/" = { | ||||
|            root = pkgs.element-web; | ||||
|        }; | ||||
|      }; | ||||
|   | ||||
|      ${config.services.jitsi-meet.hostName} = { | ||||
|        enableACME = true; | ||||
|        forceSSL = true; | ||||
|      }; | ||||
|    }; | ||||
|    ## other nginx specific best practices | ||||
|    recommendedGzipSettings = true; | ||||
|    recommendedOptimisation = true; | ||||
|    recommendedTlsSettings = true; | ||||
|   }; | ||||
| 
 | ||||
|   environment.systemPackages = with pkgs; [ matrix-appservice-slack ]; | ||||
| } | ||||
|  | @ -1,159 +0,0 @@ | |||
| { config, pkgs, ... }: { | ||||
|   # grafana configuration | ||||
|   #services.grafana = { | ||||
|   #  enable = true; | ||||
|   #  domain = "grafana.mossnet.lan"; | ||||
|   #  port = 2342; | ||||
|   #  addr = "127.0.0.1"; | ||||
|   #}; | ||||
|   # | ||||
|   ## nginx reverse proxy | ||||
|   #services.nginx.virtualHosts.${config.services.grafana.domain} = { | ||||
|   #  locations."/" = { | ||||
|   #      proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; | ||||
|   #      proxyWebsockets = true; | ||||
|   #  }; | ||||
|   #}; | ||||
| 
 | ||||
|   services.prometheus = { | ||||
|     enable = true; | ||||
|     port = 9001; | ||||
|     exporters = { | ||||
|       node = { | ||||
| 	enable = true; | ||||
| 	enabledCollectors = [ "systemd" ]; | ||||
| 	port = 9002; | ||||
|       }; | ||||
|     }; | ||||
|     rules = [ | ||||
|       '' | ||||
| groups: | ||||
| - name: synapse | ||||
|   rules: | ||||
|   - record: "synapse_federation_transaction_queue_pendingEdus:total" | ||||
|     expr: "sum(synapse_federation_transaction_queue_pendingEdus or absent(synapse_federation_transaction_queue_pendingEdus)*0)" | ||||
|   - record: "synapse_federation_transaction_queue_pendingPdus:total" | ||||
|     expr:   "sum(synapse_federation_transaction_queue_pendingPdus or absent(synapse_federation_transaction_queue_pendingPdus)*0)" | ||||
|   - record: 'synapse_http_server_request_count:method' | ||||
|     labels: | ||||
|       servlet: "" | ||||
|     expr: "sum(synapse_http_server_request_count) by (method)" | ||||
|   - record: 'synapse_http_server_request_count:servlet' | ||||
|     labels: | ||||
|       method: "" | ||||
|     expr: 'sum(synapse_http_server_request_count) by (servlet)' | ||||
| 
 | ||||
|   - record: 'synapse_http_server_request_count:total' | ||||
|     labels: | ||||
|       servlet: "" | ||||
|     expr: 'sum(synapse_http_server_request_count:by_method) by (servlet)' | ||||
| 
 | ||||
|   - record: 'synapse_cache:hit_ratio_5m' | ||||
|     expr: 'rate(synapse_util_caches_cache:hits[5m]) / rate(synapse_util_caches_cache:total[5m])' | ||||
|   - record: 'synapse_cache:hit_ratio_30s' | ||||
|     expr: 'rate(synapse_util_caches_cache:hits[30s]) / rate(synapse_util_caches_cache:total[30s])' | ||||
| 
 | ||||
|   - record: 'synapse_federation_client_sent' | ||||
|     labels: | ||||
|       type: "EDU" | ||||
|     expr: 'synapse_federation_client_sent_edus + 0' | ||||
|   - record: 'synapse_federation_client_sent' | ||||
|     labels: | ||||
|       type: "PDU" | ||||
|     expr: 'synapse_federation_client_sent_pdu_destinations:count + 0' | ||||
|   - record: 'synapse_federation_client_sent' | ||||
|     labels: | ||||
|       type: "Query" | ||||
|     expr: 'sum(synapse_federation_client_sent_queries) by (job)' | ||||
| 
 | ||||
|   - record: 'synapse_federation_server_received' | ||||
|     labels: | ||||
|       type: "EDU" | ||||
|     expr: 'synapse_federation_server_received_edus + 0' | ||||
|   - record: 'synapse_federation_server_received' | ||||
|     labels: | ||||
|       type: "PDU" | ||||
|     expr: 'synapse_federation_server_received_pdus + 0' | ||||
|   - record: 'synapse_federation_server_received' | ||||
|     labels: | ||||
|       type: "Query" | ||||
|     expr: 'sum(synapse_federation_server_received_queries) by (job)' | ||||
| 
 | ||||
|   - record: 'synapse_federation_transaction_queue_pending' | ||||
|     labels: | ||||
|       type: "EDU" | ||||
|     expr: 'synapse_federation_transaction_queue_pending_edus + 0' | ||||
|   - record: 'synapse_federation_transaction_queue_pending' | ||||
|     labels: | ||||
|       type: "PDU" | ||||
|     expr: 'synapse_federation_transaction_queue_pending_pdus + 0' | ||||
| 
 | ||||
|   - record: synapse_storage_events_persisted_by_source_type | ||||
|     expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_type="remote"}) | ||||
|     labels: | ||||
|       type: remote | ||||
|   - record: synapse_storage_events_persisted_by_source_type | ||||
|     expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity="*client*",origin_type="local"}) | ||||
|     labels: | ||||
|       type: local | ||||
|   - record: synapse_storage_events_persisted_by_source_type | ||||
|     expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity!="*client*",origin_type="local"}) | ||||
|     labels: | ||||
|       type: bridges | ||||
|   - record: synapse_storage_events_persisted_by_event_type | ||||
|     expr: sum without(origin_entity, origin_type) (synapse_storage_events_persisted_events_sep) | ||||
|   - record: synapse_storage_events_persisted_by_origin | ||||
|     expr: sum without(type) (synapse_storage_events_persisted_events_sep) | ||||
|       '' | ||||
|     ]; | ||||
|     scrapeConfigs = [ | ||||
|       { | ||||
| 	job_name = "helix"; | ||||
| 	static_configs = [{ | ||||
| 	  targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ]; | ||||
| 	}]; | ||||
|       } | ||||
|       { | ||||
| 	job_name = "synapse"; | ||||
| 	metrics_path = "/_synapse/metrics"; | ||||
| 	static_configs = [{ | ||||
| 	  targets = [ "localhost:9090" ]; | ||||
|       }]; | ||||
|       } | ||||
|       { | ||||
|         job_name = "gitea"; | ||||
|         static_configs = [{ | ||||
|           targets = [ "localhost:3001" ]; | ||||
|         }]; | ||||
|       } | ||||
|     ]; | ||||
|   }; | ||||
| 
 | ||||
|   networking.firewall = { | ||||
|     enable = true; | ||||
|     allowedTCPPorts = [ 9001 ]; | ||||
|   }; | ||||
| 
 | ||||
|   services.nginx.virtualHosts."sealight.xyz" = { | ||||
|     locations."/metrics" = { | ||||
|       #basicAuth = { anish = "password"; }; | ||||
|       proxyPass = "http://localhost:9001"; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   services.loki = { | ||||
|     enable = true; | ||||
|     configFile = /var/loki-config.yaml; | ||||
|   }; | ||||
| 
 | ||||
|   systemd.services.promtail = { | ||||
|     description = "Promtail service for Loki"; | ||||
|     wantedBy = [ "multi-user.target" ]; | ||||
| 
 | ||||
|     serviceConfig = { | ||||
|       ExecStart = '' | ||||
|         ${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml} | ||||
|       ''; | ||||
|     }; | ||||
|   }; | ||||
| } | ||||
|  | @ -1,11 +0,0 @@ | |||
| {pkgs, lib, config, ...}: | ||||
| { | ||||
|   services.rss-bridge = { | ||||
|     enable = true; | ||||
|     virtualHost = "bridge.sealight.xyz"; | ||||
|     whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit"]; | ||||
|   }; | ||||
| 
 | ||||
|   services.nginx.virtualHosts."bridge.sealight.xyz".forceSSL = true; | ||||
|   services.nginx.virtualHosts."bridge.sealight.xyz".enableACME = true; | ||||
| } | ||||
|  | @ -1,14 +0,0 @@ | |||
| { | ||||
|    services.nginx = { | ||||
|       enable = true; | ||||
|       vhost = {  | ||||
| 	  "sealight.xyz" = { | ||||
| 		  forceSSL = true; | ||||
| 		  enableACME = true; | ||||
| 		  locations."/" = { | ||||
| 		    root = "/var/www/sealight.xyz" | ||||
| 		  }; | ||||
|       }; | ||||
|     }; | ||||
|    }; | ||||
| } | ||||
|  | @ -1,32 +0,0 @@ | |||
| { config, pkgs, lib, ... }: | ||||
| {  | ||||
|   environment.systemPackages = [ pkgs.wireguard pkgs.mosh ]; | ||||
|   networking.nat = { | ||||
|       enable = true; | ||||
|       externalInterface = "ens3"; | ||||
|       internalInterfaces = [ "wg0" ]; | ||||
|   }; | ||||
|   networking.firewall = { | ||||
|     allowedUDPPorts = [ 60990 ]; | ||||
|   }; | ||||
| 
 | ||||
|   networking.wireguard.interfaces.wg0 = { | ||||
|     ips = [ "10.0.69.1/24" ]; | ||||
|     listenPort = 60990; | ||||
|     privateKeyFile = "/var/lib/wireguard/priv"; | ||||
|     peers = [ | ||||
|     { # box | ||||
|       publicKey = "Ra78mOc110K7URN5uB3m9d78iBKgeRHzT+3HkiFp9BU="; | ||||
|       allowedIPs = [ "10.0.69.4/32" ]; | ||||
|     } | ||||
|     { # line | ||||
|       publicKey = "fsb1FuGmYi89p4CVXytKw2FYamONKtoanxrgs/dJjC8="; | ||||
|       allowedIPs = [ "10.0.69.3/32" ]; | ||||
|     } | ||||
|     { # curve | ||||
|       publicKey = "XmV4AcPPND/eeSI6d9M1iahCjtymqY6DdUDEFNP/x3g="; | ||||
|       allowedIPs = [ "10.0.69.2/32" ]; | ||||
|     } | ||||
| ]; | ||||
|   }; | ||||
| } | ||||
|  | @ -1,3 +1,5 @@ | |||
| { config, lib, pkgs, ... }: | ||||
| 
 | ||||
| { | ||||
|   security.acme.email = "anish+acme@lakhwara.com"; | ||||
|   security.acme.acceptTerms = true; | ||||
|  | @ -7,32 +9,19 @@ | |||
|       #  # The registration file is automatically generated after starting the appservice for the first time. | ||||
|       #  # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/ | ||||
|       #  # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml | ||||
|     #   "/var/lib/matrix-synapse/discord-registration.yaml" | ||||
|     #   "/var/lib/matrix-synapse/telegram-registration.yaml" | ||||
|       "/var/lib/matrix-synapse/discord-registration.yaml" | ||||
|       "/var/lib/matrix-synapse/telegram-registration.yaml" | ||||
|       #"/var/lib/matrix-synapse/slack-registration.yaml" | ||||
|     #  # "/var/lib/matrix-synapse/whatsapp-registration.yaml" | ||||
|       #"/var/lib/matrix-synapse/whatsapp-registration.yaml" | ||||
|     ]; | ||||
|     server_name = "sealight.xyz"; | ||||
|     registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; # TODO use agnix | ||||
|     registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; | ||||
|     enable_metrics = true; | ||||
|     enable_registration = true; | ||||
|     database_type = "psycopg2"; | ||||
|     database_args = { | ||||
|       database = "matrix-synapse"; | ||||
|     }; | ||||
|     extraConfig = '' | ||||
|       max_upload_size: "50M" | ||||
|       use_presence: false | ||||
|     ''; | ||||
|     ## coturn based TURN server integration (TURN server setup mentioned later), | ||||
|     ## shared secret generated while configuring coturn | ||||
|     ## and reused here (power of Nix being a real programming language) | ||||
|     turn_uris = [ | ||||
|       "turn:turn.sealight.xyz:3478?transport=udp" | ||||
|       "turn:turn.sealight.xyz:3478?transport=tcp" | ||||
|     ]; | ||||
|     turn_shared_secret = config.services.coturn.static-auth-secret; | ||||
| 
 | ||||
|     listeners = [ | ||||
|       { | ||||
|         port = 8448; | ||||
|  | @ -53,6 +42,18 @@ | |||
|         tls = false; | ||||
|       } | ||||
|     ]; | ||||
|     extraConfig = '' | ||||
|       max_upload_size: "50M" | ||||
|       use_presence: false | ||||
|     ''; | ||||
|     ## coturn based TURN server integration (TURN server setup mentioned later), | ||||
|     ## shared secret generated while configuring coturn | ||||
|     ## and reused here (power of Nix being a real programming language) | ||||
|     turn_uris = [ | ||||
|       "turn:turn.sealight.xyz:3478?transport=udp" | ||||
|       "turn:turn.sealight.xyz:3478?transport=tcp" | ||||
|     ]; | ||||
|     turn_shared_secret = config.services.coturn.static-auth-secret; | ||||
|   }; | ||||
| 
 | ||||
|   services.coturn = { | ||||
|  | @ -60,27 +61,45 @@ | |||
|     use-auth-secret = true; | ||||
|     static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ"; | ||||
|     realm = "turn.sealight.xyz"; | ||||
|     min-port = 49111; | ||||
|     max-port = 51111; | ||||
|     no-cli = true; | ||||
|     no-tcp-relay = true; | ||||
|     no-tls = true; | ||||
|     no-dtls = true; | ||||
|     cert = "${config.security.acme.certs."turn.sealight.xyz".directory}/full.pem"; | ||||
|     pkey = "${config.security.acme.certs."turn.sealight.xyz".directory}/key.pem"; | ||||
|     extraConfig = '' | ||||
|       verbose | ||||
|       user-quota=12 | ||||
|       total-quota=1200 | ||||
|       denied-peer-ip=10.0.0.0-10.255.255.255 | ||||
|       denied-peer-ip=192.168.0.0-192.168.255.255 | ||||
|       denied-peer-ip=172.16.0.0-172.31.255.255 | ||||
| 
 | ||||
|         allowed-peer-ip=192.168.191.127 | ||||
|       denied-peer-ip=0.0.0.0-0.255.255.255 | ||||
|       denied-peer-ip=100.64.0.0-100.127.255.255 | ||||
|       denied-peer-ip=127.0.0.0-127.255.255.255 | ||||
|       denied-peer-ip=169.254.0.0-169.254.255.255 | ||||
|       denied-peer-ip=192.0.0.0-192.0.0.255 | ||||
|       denied-peer-ip=192.0.2.0-192.0.2.255 | ||||
|       denied-peer-ip=192.88.99.0-192.88.99.255 | ||||
|       denied-peer-ip=198.18.0.0-198.19.255.255 | ||||
|       denied-peer-ip=198.51.100.0-198.51.100.255 | ||||
|       denied-peer-ip=203.0.113.0-203.0.113.255 | ||||
|       denied-peer-ip=240.0.0.0-255.255.255.255 | ||||
|     ''; | ||||
|   }; | ||||
| 
 | ||||
|   security.acme.certs.${config.services.coturn.realm} = { | ||||
|     /* insert here the right configuration to obtain a certificate */ | ||||
|     webroot = "/var/lib/acme/acme-challenge/"; | ||||
|     email = "anish+acme@lakhwara.com"; | ||||
|     postRun = "systemctl restart coturn.service"; | ||||
|     group = "turnserver"; | ||||
|   }; | ||||
| 
 | ||||
|   services.jitsi-meet = { | ||||
|     enable = true; | ||||
|     hostName = "jitsi.sealight.xyz"; | ||||
| 
 | ||||
|     ## this setting is going to add relevant ports to | ||||
|     ## networking.firewall.allowedTCPPorts & | ||||
|     ## networking.firewall.allowedUDPPorts | ||||
|   }; | ||||
|   services.jitsi-videobridge.enable = true; | ||||
| 
 | ||||
|  | @ -90,17 +109,20 @@ | |||
|     # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. | ||||
|     settings = { | ||||
|       homeserver = { | ||||
|         address = "https://chat.sealight.xyz"; | ||||
|         address = "https://sealight.xyz"; | ||||
|         domain = "sealight.xyz"; | ||||
|       }; | ||||
|       appservice = { | ||||
|         provisioning.enabled = false; | ||||
|         id = "telegram"; | ||||
|         bot_username = "telegrambridge"; | ||||
|         public = { | ||||
|           enabled = false; | ||||
|           prefix = "/public"; | ||||
|           external = "https://chat.sealight.xyz/public"; | ||||
|         }; | ||||
|         address = "http://localhost:18787"; | ||||
|         port = 18787; | ||||
|         # The service uses SQLite by default, but it's also possible to use PostgreSQL instead: | ||||
|         #database = "postgresql:///mautrix-telegram?host=/run/postgresql"; | ||||
|       }; | ||||
|  | @ -113,96 +135,41 @@ | |||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   services.mautrix-whatsapp = { | ||||
|   services.mx-puppet-discord = { | ||||
|     enable = true; | ||||
|     # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. | ||||
|     configOptions = { | ||||
|       homeserver = { | ||||
|         address = "https://chat.sealight.xyz"; | ||||
|         domain = "sealight.xyz"; | ||||
|       }; | ||||
|       appservice = { | ||||
|         id = "whatsapp"; | ||||
|         address = http://localhost:9897; | ||||
|         hostname = "0.0.0.0"; | ||||
|         port = 9897; | ||||
|         database = { | ||||
|   	  type = "sqlite3"; | ||||
|   	  uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db"; | ||||
|         }; | ||||
|         state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json"; | ||||
|         bot = { | ||||
|           username = "whatsappbot"; | ||||
|           displayname = "WhatsApp bridge bot"; | ||||
|           avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr"; | ||||
|         }; | ||||
|         as_token = ""; | ||||
|         hs_token = ""; | ||||
|       }; | ||||
|     settings = { | ||||
|       bridge = { | ||||
|         username_template = "whatsapp_{{.}}"; | ||||
|         displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)"; | ||||
|         command_prefix = "!wa"; | ||||
|         permissions = { | ||||
|         	"@aynish:sealight.xyz" = 100; | ||||
|         }; | ||||
|       }; | ||||
|       logging = { | ||||
|         directory = "/var/lib/mautrix-whatsapp/logs"; | ||||
|         file_name_format = "{{.Date}}-{{.Index}}.log"; | ||||
|         file_date_format = "\"2006-01-02\""; | ||||
|         file_mode = 384; | ||||
|         timestamp_format = "Jan _2, 2006 15:04:05"; | ||||
|         print_level = "debug"; | ||||
|       }; | ||||
|       metrics = { | ||||
|         enabled = true; | ||||
|         listen  = "http://localhost:5070"; | ||||
|         bindAddress = "localhost"; | ||||
|         port = 16785; | ||||
|         domain = "sealight.xyz"; | ||||
|         homeserverUrl = "https://sealight.xyz"; | ||||
|         avatarUrl = "https://discord.com/assets/2d20a45d79110dc5bf947137e9d99b66.svg"; | ||||
|       }; | ||||
|       provisioning = { | ||||
|         whitelist = [ "@aynish:sealight.xyz" ]; | ||||
|       }; | ||||
|       relay = { | ||||
|         whitelist = [ "@aynish:sealight.xyz" ]; | ||||
|       }; | ||||
|       namePatterns = { | ||||
|         group = ":name"; | ||||
|         room = ":name"; | ||||
|         user = ":name (Discord)"; | ||||
|         userOverride = ":displayname"; | ||||
|       }; | ||||
|       presence = { | ||||
|         enabled = false; | ||||
|       }; | ||||
|     }; | ||||
|     serviceDependencies = [ "matrix-synapse.service" ]; | ||||
|   }; | ||||
| 
 | ||||
|   services.matrix-appservice-slack = { | ||||
|   services.heisenbridge = { | ||||
|     enable = true; | ||||
|     #environmentFile = /etc/secrets/matrix-appservice-slack.env; | ||||
|     settings = { | ||||
|       homeserver = { | ||||
|         server_name = "sealight.xyz"; | ||||
|         url = "https://chat.sealight.xyz"; | ||||
|       }; | ||||
|       db = { | ||||
|         engine = "postgres"; | ||||
|         connectionString = "postgres://slackbridge_user:somethingverysecret@localhost/slack_bridge?sslmode=require"; | ||||
|       }; | ||||
|       matrix_admin_room = "!ikEWOHCcmoZtVzSmPF:sealight.xyz"; | ||||
|       username_prefix = "slack_"; | ||||
|       rtm = { | ||||
|         enable = true; | ||||
|         logging = "silent"; | ||||
|       }; | ||||
|       slack_hook_port = 9899; | ||||
|       enable_metrics = true; | ||||
|       puppeting = { | ||||
|         enabled = true; | ||||
|         onboard_users = true; | ||||
|       }; | ||||
|       oauth2 = { | ||||
|         client_id = "2832868673.1609454840563"; | ||||
|         client_secret = "079a7ca42b192e66a9ff32740a69cb9d"; | ||||
|         redirect_prefix = "https://sealight.xyz/slackbridge/"; | ||||
|       }; | ||||
|       #team_sync = { | ||||
|       #  T02QGRJKT = { | ||||
|       #    users = { | ||||
|       #      enabled = false; | ||||
|       #    }; | ||||
|       #    channels = { | ||||
|       #       enabled = true; | ||||
|       #       alias_prefix = "qf_"; | ||||
|       #    }; | ||||
|       #  }; | ||||
|       #}; | ||||
|     }; | ||||
|     homeserver = "https://sealight.xyz"; | ||||
|     listenPort = 14456; | ||||
|     appServiceToken = "wyujLh8kjpmk2bfKeEE3sZ2gWOEUBKK5"; | ||||
|     homeserverToken = "yEHs7lthD2ZHUibJOAv1APaFhEjxN5PT"; | ||||
|   }; | ||||
| 
 | ||||
|   services.postgresql = { | ||||
|  | @ -219,16 +186,30 @@ | |||
|     ''; | ||||
|   }; | ||||
| 
 | ||||
|   networking.firewall = { | ||||
|   networking.firewall = | ||||
|     let | ||||
|       range = with config.services.coturn; [{ | ||||
|         from = min-port; | ||||
|         to = max-port; | ||||
|       }]; | ||||
|     in | ||||
|     { | ||||
|       enable = true; | ||||
|       allowedUDPPortRanges = range; # coturn | ||||
|       allowedTCPPortRanges = range; | ||||
|       allowedTCPPorts = [ | ||||
|         22 # SSH | ||||
|         8448 # Matrix federation | ||||
|         8008 | ||||
|         80 | ||||
|         443 | ||||
|         3478 # Coturn service | ||||
|         5349 # Coturn service | ||||
|         9090 # Synapse Metrics | ||||
|       9899 # Matrix <-> Slack Bridge Puppeting | ||||
|       ]; | ||||
|       allowedUDPPorts = [ | ||||
|         3478 | ||||
|         5349 # Coturn service | ||||
|       ]; | ||||
|     }; | ||||
| 
 | ||||
|  | @ -257,7 +238,6 @@ | |||
|   services.nginx = { | ||||
|     enable = true; | ||||
|     virtualHosts = { | ||||
| 
 | ||||
|       "sealight.xyz" = { | ||||
|         forceSSL = true; | ||||
|         enableACME = true; | ||||
|  | @ -271,7 +251,6 @@ | |||
|           proxyPass = "http://localhost:9899"; | ||||
|         }; | ||||
|       }; | ||||
| 
 | ||||
|       ## virtual host for Synapse | ||||
|       "chat.sealight.xyz" = { | ||||
|         forceSSL = true; | ||||
|  | @ -281,19 +260,16 @@ | |||
|           proxyPass = "http://localhost:8448"; | ||||
|         }; | ||||
|       }; | ||||
| 
 | ||||
|       ## virtual host for Riot/Web | ||||
|       "element.sealight.xyz" = { | ||||
|         forceSSL = true; | ||||
|         enableACME = true; | ||||
|         #useACMEHost = "sealight.xyz"; | ||||
| 
 | ||||
|         ## root points to the riot-web package content, also configured via Nix | ||||
|         locations."/" = { | ||||
|           root = pkgs.element-web; | ||||
|         }; | ||||
|       }; | ||||
|   | ||||
|       ${config.services.jitsi-meet.hostName} = { | ||||
|         enableACME = true; | ||||
|         forceSSL = true; | ||||
|  | @ -305,5 +281,86 @@ | |||
|     recommendedTlsSettings = true; | ||||
|   }; | ||||
| 
 | ||||
|   environment.systemPackages = with pkgs; [ matrix-appservice-slack ]; | ||||
|   # environment.systemPackages = with pkgs; [ matrix-appservice-slack ]; | ||||
|   #services.mx-puppet-slack= { | ||||
|   #enable = false; | ||||
|   #settings = { | ||||
|   #  bridge = {  | ||||
|   #    bindAddress = "localhost"; | ||||
|   #    port = 16786; | ||||
|   #    domain = "sealight.xyz"; | ||||
|   #    homeserverUrl = "https://sealight.xyz"; | ||||
|   #  }; | ||||
|   #  provisioning = { | ||||
|   #    whitelist = [ "@aynish:sealight.xyz" ]; | ||||
|   #  }; | ||||
|   #  relay = { | ||||
|   #    whitelist = [ "@aynish:sealight.xyz" ]; | ||||
|   #  }; | ||||
|   #  namePatterns = { | ||||
|   #    group = ":name"; | ||||
|   #    room = ":name[:team? - :team,]"; | ||||
|   #    user = ":name (Slack)"; | ||||
|   #    userOverride = ":displayname"; | ||||
|   #  }; | ||||
|   #  presence = { | ||||
|   #    enabled = false; | ||||
|   #  }; | ||||
|   #  oauth = { | ||||
|   #    enabled = false; | ||||
|   #  }; | ||||
|   #}; | ||||
|   #serviceDependencies = ["matrix-synapse.service"]; | ||||
|   #}; | ||||
| 
 | ||||
|   # services.mautrix-whatsapp = { | ||||
|   #   enable = false; | ||||
|   # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. | ||||
|   #configOptions = { | ||||
|   #  homeserver = { | ||||
|   #    address = "https://chat.sealight.xyz"; | ||||
|   #    domain = "sealight.xyz"; | ||||
|   #  }; | ||||
|   #  appservice = { | ||||
|   #    id = "whatsapp"; | ||||
|   #    address = http://localhost:9897; | ||||
|   #    hostname = "0.0.0.0"; | ||||
|   #    port = 9897; | ||||
|   #    database = { | ||||
|   #      type = "sqlite3"; | ||||
|   #      uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db"; | ||||
|   #    }; | ||||
|   #    state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json"; | ||||
|   #    bot = { | ||||
|   #      username = "whatsappbot"; | ||||
|   #      displayname = "WhatsApp bridge bot"; | ||||
|   #      avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr"; | ||||
|   #    }; | ||||
|   #    as_token = ""; | ||||
|   #    hs_token = ""; | ||||
|   #  }; | ||||
|   #  bridge = { | ||||
|   #    username_template = "whatsapp_{{.}}"; | ||||
|   #    displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)"; | ||||
|   #    command_prefix = "!wa"; | ||||
|   #    permissions = { | ||||
|   #      "@aynish:sealight.xyz" = 100; | ||||
|   #    }; | ||||
|   #  }; | ||||
|   #  logging = { | ||||
|   #    directory = "/var/lib/mautrix-whatsapp/logs"; | ||||
|   #    file_name_format = "{{.Date}}-{{.Index}}.log"; | ||||
|   #    file_date_format = "\"2006-01-02\""; | ||||
|   #    file_mode = 384; | ||||
|   #    timestamp_format = "Jan _2, 2006 15:04:05"; | ||||
|   #    print_level = "debug"; | ||||
|   #  }; | ||||
|   #  metrics = { | ||||
|   #    enabled = true; | ||||
|   #    listen  = "http://localhost:5070"; | ||||
|   #  }; | ||||
|   #}; | ||||
|   # }; | ||||
| 
 | ||||
| 
 | ||||
| } | ||||
|  |  | |||
|  | @ -10,7 +10,8 @@ let | |||
|   # TODO: switch to configGen.json once RFC42 is implemented | ||||
|   settingsFile = pkgs.writeText "matrix-appservice-slack-settings.json" (builtins.toJSON cfg.settings); | ||||
| 
 | ||||
| in { | ||||
| in | ||||
| { | ||||
|   options = { | ||||
|     services.matrix-appservice-slack = { | ||||
|       enable = mkEnableOption "a bridge between Matrix and Slack"; | ||||
|  | @ -5,7 +5,8 @@ with lib; | |||
| let | ||||
|   cfg = config.services.mautrix-whatsapp; | ||||
| 
 | ||||
|   configFile = pkgs.runCommand "mautrix-whatsapp" { | ||||
|   configFile = pkgs.runCommand "mautrix-whatsapp" | ||||
|     { | ||||
|       buildInputs = [ pkgs.mautrix-whatsapp pkgs.remarshal ]; | ||||
|       preferLocalBuild = true; | ||||
|     } '' | ||||
|  | @ -10,7 +10,8 @@ let | |||
|   settingsFile = settingsFormat.generate "mx-puppet-slack-config.json" cfg.settings; | ||||
|   mx-puppet-slack = pkgs.callPackage ./pkg-mx-puppet-slack.nix { }; | ||||
| 
 | ||||
| in { | ||||
| in | ||||
| { | ||||
|   options = { | ||||
|     services.mx-puppet-slack = { | ||||
|       enable = mkEnableOption '' | ||||
							
								
								
									
										159
									
								
								profiles/metrics/default.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										159
									
								
								profiles/metrics/default.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,159 @@ | |||
| { config, pkgs, ... }: { | ||||
|   # grafana configuration | ||||
|   #services.grafana = { | ||||
|   #  enable = true; | ||||
|   #  domain = "grafana.mossnet.lan"; | ||||
|   #  port = 2342; | ||||
|   #  addr = "127.0.0.1"; | ||||
|   #}; | ||||
|   # | ||||
|   ## nginx reverse proxy | ||||
|   #services.nginx.virtualHosts.${config.services.grafana.domain} = { | ||||
|   #  locations."/" = { | ||||
|   #      proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; | ||||
|   #      proxyWebsockets = true; | ||||
|   #  }; | ||||
|   #}; | ||||
| 
 | ||||
|   services.prometheus = { | ||||
|     enable = true; | ||||
|     port = 9001; | ||||
|     exporters = { | ||||
|       node = { | ||||
|         enable = true; | ||||
|         enabledCollectors = [ "systemd" ]; | ||||
|         port = 9002; | ||||
|       }; | ||||
|     }; | ||||
|     rules = [ | ||||
|       '' | ||||
|         groups: | ||||
|         - name: synapse | ||||
|           rules: | ||||
|           - record: "synapse_federation_transaction_queue_pendingEdus:total" | ||||
|             expr: "sum(synapse_federation_transaction_queue_pendingEdus or absent(synapse_federation_transaction_queue_pendingEdus)*0)" | ||||
|           - record: "synapse_federation_transaction_queue_pendingPdus:total" | ||||
|             expr:   "sum(synapse_federation_transaction_queue_pendingPdus or absent(synapse_federation_transaction_queue_pendingPdus)*0)" | ||||
|           - record: 'synapse_http_server_request_count:method' | ||||
|             labels: | ||||
|               servlet: "" | ||||
|             expr: "sum(synapse_http_server_request_count) by (method)" | ||||
|           - record: 'synapse_http_server_request_count:servlet' | ||||
|             labels: | ||||
|               method: "" | ||||
|             expr: 'sum(synapse_http_server_request_count) by (servlet)' | ||||
| 
 | ||||
|           - record: 'synapse_http_server_request_count:total' | ||||
|             labels: | ||||
|               servlet: "" | ||||
|             expr: 'sum(synapse_http_server_request_count:by_method) by (servlet)' | ||||
| 
 | ||||
|           - record: 'synapse_cache:hit_ratio_5m' | ||||
|             expr: 'rate(synapse_util_caches_cache:hits[5m]) / rate(synapse_util_caches_cache:total[5m])' | ||||
|           - record: 'synapse_cache:hit_ratio_30s' | ||||
|             expr: 'rate(synapse_util_caches_cache:hits[30s]) / rate(synapse_util_caches_cache:total[30s])' | ||||
| 
 | ||||
|           - record: 'synapse_federation_client_sent' | ||||
|             labels: | ||||
|               type: "EDU" | ||||
|             expr: 'synapse_federation_client_sent_edus + 0' | ||||
|           - record: 'synapse_federation_client_sent' | ||||
|             labels: | ||||
|               type: "PDU" | ||||
|             expr: 'synapse_federation_client_sent_pdu_destinations:count + 0' | ||||
|           - record: 'synapse_federation_client_sent' | ||||
|             labels: | ||||
|               type: "Query" | ||||
|             expr: 'sum(synapse_federation_client_sent_queries) by (job)' | ||||
| 
 | ||||
|           - record: 'synapse_federation_server_received' | ||||
|             labels: | ||||
|               type: "EDU" | ||||
|             expr: 'synapse_federation_server_received_edus + 0' | ||||
|           - record: 'synapse_federation_server_received' | ||||
|             labels: | ||||
|               type: "PDU" | ||||
|             expr: 'synapse_federation_server_received_pdus + 0' | ||||
|           - record: 'synapse_federation_server_received' | ||||
|             labels: | ||||
|               type: "Query" | ||||
|             expr: 'sum(synapse_federation_server_received_queries) by (job)' | ||||
| 
 | ||||
|           - record: 'synapse_federation_transaction_queue_pending' | ||||
|             labels: | ||||
|               type: "EDU" | ||||
|             expr: 'synapse_federation_transaction_queue_pending_edus + 0' | ||||
|           - record: 'synapse_federation_transaction_queue_pending' | ||||
|             labels: | ||||
|               type: "PDU" | ||||
|             expr: 'synapse_federation_transaction_queue_pending_pdus + 0' | ||||
| 
 | ||||
|           - record: synapse_storage_events_persisted_by_source_type | ||||
|             expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_type="remote"}) | ||||
|             labels: | ||||
|               type: remote | ||||
|           - record: synapse_storage_events_persisted_by_source_type | ||||
|             expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity="*client*",origin_type="local"}) | ||||
|             labels: | ||||
|               type: local | ||||
|           - record: synapse_storage_events_persisted_by_source_type | ||||
|             expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity!="*client*",origin_type="local"}) | ||||
|             labels: | ||||
|               type: bridges | ||||
|           - record: synapse_storage_events_persisted_by_event_type | ||||
|             expr: sum without(origin_entity, origin_type) (synapse_storage_events_persisted_events_sep) | ||||
|           - record: synapse_storage_events_persisted_by_origin | ||||
|             expr: sum without(type) (synapse_storage_events_persisted_events_sep) | ||||
|       '' | ||||
|     ]; | ||||
|     scrapeConfigs = [ | ||||
|       { | ||||
|         job_name = "helix"; | ||||
|         static_configs = [{ | ||||
|           targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ]; | ||||
|         }]; | ||||
|       } | ||||
|       { | ||||
|         job_name = "synapse"; | ||||
|         metrics_path = "/_synapse/metrics"; | ||||
|         static_configs = [{ | ||||
|           targets = [ "localhost:9090" ]; | ||||
|         }]; | ||||
|       } | ||||
|       { | ||||
|         job_name = "gitea"; | ||||
|         static_configs = [{ | ||||
|           targets = [ "localhost:3001" ]; | ||||
|         }]; | ||||
|       } | ||||
|     ]; | ||||
|   }; | ||||
| 
 | ||||
|   networking.firewall = { | ||||
|     enable = true; | ||||
|     allowedTCPPorts = [ 9001 ]; | ||||
|   }; | ||||
| 
 | ||||
|   services.nginx.virtualHosts."sealight.xyz" = { | ||||
|     locations."/metrics" = { | ||||
|       #basicAuth = { anish = "password"; }; | ||||
|       proxyPass = "http://localhost:9001"; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   services.loki = { | ||||
|     enable = true; | ||||
|     configFile = /var/loki-config.yaml; | ||||
|   }; | ||||
| 
 | ||||
|   systemd.services.promtail = { | ||||
|     description = "Promtail service for Loki"; | ||||
|     wantedBy = [ "multi-user.target" ]; | ||||
| 
 | ||||
|     serviceConfig = { | ||||
|       ExecStart = '' | ||||
|         ${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml} | ||||
|       ''; | ||||
|     }; | ||||
|   }; | ||||
| } | ||||
|  | @ -5,6 +5,7 @@ | |||
|     192.168.1.240 read.mossnet.lan | ||||
|     192.168.1.240 music.mossnet.lan | ||||
|     192.168.1.240 stats.mossnet.lan | ||||
|     192.168.1.240 file.mossnet.lan | ||||
|   ''; | ||||
|   # 10.0.69.4 mossnet.lan | ||||
|   #  10.0.69.4 links.mossnet.lan | ||||
|  |  | |||
|  | @ -2,13 +2,10 @@ | |||
| { | ||||
|   services.rss-bridge = { | ||||
|     enable = true; | ||||
|     virtualHost = "rss.mossnet.lan"; | ||||
|     whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram"]; | ||||
|     #dataDir = "/etc/rss-bridge/"; | ||||
|     virtualHost = "bridge.sealight.xyz"; | ||||
|     whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit" ]; | ||||
|   }; | ||||
|   #environment.etc."rss-bridge/config.ini.php" = '' | ||||
|   #  [InstagramBridge] | ||||
|   #  session_id = %sessionid from step 1% | ||||
|   #  cache_timeout = %cache timeout in seconds% | ||||
|   #''; | ||||
| 
 | ||||
|   services.nginx.virtualHosts."bridge.sealight.xyz".forceSSL = true; | ||||
|   services.nginx.virtualHosts."bridge.sealight.xyz".enableACME = true; | ||||
| } | ||||
|  |  | |||
|  | @ -7,7 +7,48 @@ | |||
|       fileserver.host = "0.0.0.0"; | ||||
|       fileserver.port = 8082; | ||||
|     }; | ||||
|     ccnetSettings.General.SERVICE_URL = "file.mossnet.lan"; | ||||
|     ccnetSettings.General.SERVICE_URL = "http://file.mossnet.lan"; | ||||
|     adminEmail = "anish@lakhwara.com"; | ||||
|     initialAdminPassword = "arandompasswordsecure!"; | ||||
|   }; | ||||
| 
 | ||||
|   services.nginx = { | ||||
|     enable = true; | ||||
|   }; | ||||
|   services.nginx.upstreams."gunicorn_seafile" = { | ||||
|     servers."unix:/run/seahub/gunicorn.sock" = { }; | ||||
|   }; | ||||
|   services.nginx.upstreams."seafhttp" = { | ||||
|     servers."127.0.0.1:8082" = { }; | ||||
|   }; | ||||
|   services.nginx.virtualHosts."file.mossnet.lan" = { | ||||
|     serverName = "file.mossnet.lan"; | ||||
|     locations."/" = { | ||||
|       proxyPass = "http://gunicorn_seafile"; # without a trailing / | ||||
|       extraConfig = '' | ||||
|         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||||
|         proxy_set_header X-Forwarded-Proto $scheme; | ||||
|         proxy_set_header X-Real-IP $remote_addr; | ||||
|         proxy_set_header X-Forwarded-Host $server_name; | ||||
|         #proxy_set_header Host $host; | ||||
|         proxy_read_timeout  1200s; | ||||
| 
 | ||||
|         client_max_body_size 0; # disable max upload size | ||||
|       ''; | ||||
|     }; | ||||
|     locations."/seafhttp" = { | ||||
|       proxyPass = "http://seafhttp"; # without a trailing / | ||||
|       extraConfig = '' | ||||
|         rewrite ^/seafhttp(.*)$ $1 break; | ||||
|         client_max_body_size 0; | ||||
| 
 | ||||
|         proxy_connect_timeout  36000s; | ||||
|         proxy_read_timeout  36000s; | ||||
|         proxy_send_timeout  36000s; | ||||
| 
 | ||||
|         proxy_request_buffering off; | ||||
|         send_timeout  36000s; | ||||
|       ''; | ||||
|     }; | ||||
|   }; | ||||
| } | ||||
|  |  | |||
							
								
								
									
										14
									
								
								profiles/sealight-website/default.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										14
									
								
								profiles/sealight-website/default.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,14 @@ | |||
| { | ||||
|   services.nginx = { | ||||
|     enable = true; | ||||
|     vhost = { | ||||
|       "sealight.xyz" = { | ||||
|         forceSSL = true; | ||||
|         enableACME = true; | ||||
|         locations."/" = { | ||||
|           root = "/var/www/sealight.xyz" | ||||
|             }; | ||||
|         }; | ||||
|       }; | ||||
|     }; | ||||
|   } | ||||
|  | @ -7,8 +7,8 @@ | |||
|     group = "users"; | ||||
|     dataDir = "/home/anish/"; | ||||
|     configDir = "/home/anish/.config/syncthing"; | ||||
|     guiAddress = "0.0.0.0:8384"; | ||||
|   }; | ||||
| 
 | ||||
|   networking.firewall.allowedTCPPorts = [ 8384 22000 ]; | ||||
|   networking.firewall.allowedUDPPorts = [ 22000 21027 ]; | ||||
| } | ||||
|  |  | |||
							
								
								
									
										35
									
								
								profiles/wireguard-server/default.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										35
									
								
								profiles/wireguard-server/default.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,35 @@ | |||
| { config, pkgs, lib, ... }: | ||||
| { | ||||
|   environment.systemPackages = [ pkgs.wireguard pkgs.mosh ]; | ||||
|   networking.nat = { | ||||
|     enable = true; | ||||
|     externalInterface = "ens3"; | ||||
|     internalInterfaces = [ "wg0" ]; | ||||
|   }; | ||||
|   networking.firewall = { | ||||
|     allowedUDPPorts = [ 60990 ]; | ||||
|   }; | ||||
| 
 | ||||
|   networking.wireguard.interfaces.wg0 = { | ||||
|     ips = [ "10.0.69.1/24" ]; | ||||
|     listenPort = 60990; | ||||
|     privateKeyFile = "/var/lib/wireguard/priv"; | ||||
|     peers = [ | ||||
|       { | ||||
|         # box | ||||
|         publicKey = "Ra78mOc110K7URN5uB3m9d78iBKgeRHzT+3HkiFp9BU="; | ||||
|         allowedIPs = [ "10.0.69.4/32" ]; | ||||
|       } | ||||
|       { | ||||
|         # line | ||||
|         publicKey = "fsb1FuGmYi89p4CVXytKw2FYamONKtoanxrgs/dJjC8="; | ||||
|         allowedIPs = [ "10.0.69.3/32" ]; | ||||
|       } | ||||
|       { | ||||
|         # curve | ||||
|         publicKey = "XmV4AcPPND/eeSI6d9M1iahCjtymqY6DdUDEFNP/x3g="; | ||||
|         allowedIPs = [ "10.0.69.2/32" ]; | ||||
|       } | ||||
|     ]; | ||||
|   }; | ||||
| } | ||||
		Loading…
	
		Reference in a new issue