moving helix into profiles
This commit is contained in:
parent
4a7e9d536b
commit
7ac844b1f9
|
|
@ -1,10 +0,0 @@
|
|||
{ pkgs, lib, budUtils, ... }: {
|
||||
bud.cmds = with pkgs; {
|
||||
get = {
|
||||
writer = budUtils.writeBashWithPaths [ nixUnstable git coreutils ];
|
||||
synopsis = "get [DEST]";
|
||||
help = "Copy the desired template to DEST";
|
||||
script = ./get.bash;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1 +0,0 @@
|
|||
nix flake new -t "github:divnix/devos/core" "${2:-devos}"
|
||||
12
flake.nix
12
flake.nix
|
|
@ -1,10 +1,6 @@
|
|||
{
|
||||
description = "A highly structured configuration database.";
|
||||
|
||||
nixConfig.extra-experimental-features = "nix-command flakes";
|
||||
nixConfig.extra-substituters = "https://nrdxp.cachix.org https://nix-community.cachix.org";
|
||||
nixConfig.extra-trusted-public-keys = "nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=";
|
||||
|
||||
inputs =
|
||||
{
|
||||
# Nix
|
||||
|
|
@ -126,11 +122,11 @@
|
|||
};
|
||||
suites = with profiles; rec {
|
||||
base = [ core users.root users.anish ];
|
||||
sealight = [ base server ]; # matrix rsshub backup wireguard-server
|
||||
mossnet = [ base server taskd shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale seafile syncthing ]; # hpi syncthing sync.music
|
||||
sealight = [ base server rss-bridge gitea wireguard-server metrics sealight-website ]; # matrix backup
|
||||
mossnet = [ base server taskd shaarli wallabag dns monitoring nfs rss-bridge gonic headphones radicale seafile syncthing ]; # hpi sync.music
|
||||
cube = [ base site server ];
|
||||
graphical = [ base bluetooth music sync.kitaab sync.website sync.cal wifi desktop ]; # syncthing
|
||||
curve = [ graphical secrets ];
|
||||
graphical = [ base bluetooth music sync.kitaab sync.website sync.cal wifi desktop ];
|
||||
curve = [ graphical secrets syncthing ];
|
||||
work = [ base ];
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@
|
|||
};
|
||||
|
||||
# For some reason this doesn't work in the profile, but does over here??
|
||||
# Something weird in the way I'm importing nixpkgs in the profile or something
|
||||
services."grasp".enable = true;
|
||||
services."grasp".path = "/home/anish/kitaab/grasp";
|
||||
services."grasp".user = "anish";
|
||||
|
|
@ -28,10 +29,10 @@
|
|||
"/var/www/shaarli-config" # sharli
|
||||
"/var/backup/postgresql" # wallabag
|
||||
"/var/lib/radicale" # radicale
|
||||
"/home/anish/usr/syncthing" # syncthing
|
||||
"/home/anish/usr/drawing" # syncthing
|
||||
"/home/anish/usr/nonfiction" # syncthing
|
||||
];
|
||||
# seafile?
|
||||
# syncthing
|
||||
# seafile
|
||||
};
|
||||
|
||||
age.secrets.box-wg.file = "${self}/secrets/box-wg.age";
|
||||
|
|
@ -41,4 +42,5 @@
|
|||
ips = [ "10.0.69.4/24" ];
|
||||
privateKeyFile = "/run/agenix/box-wg";
|
||||
};
|
||||
services.syncthing.guiAddress = "0.0.0.0:8384"; # public syncthing
|
||||
}
|
||||
|
|
|
|||
37
hosts/helix/configuration.nix
Normal file
37
hosts/helix/configuration.nix
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
{ config, pkgs, ... }:
|
||||
{
|
||||
imports =
|
||||
[
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
# Use the GRUB 2 boot loader.
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.version = 2;
|
||||
boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
|
||||
|
||||
networking.hostName = "helix"; # Define your hostname.
|
||||
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.ens3.useDHCP = true;
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh.enable = true;
|
||||
services.openssh.passwordAuthentication = false;
|
||||
services.openssh.permitRootLogin = "no";
|
||||
sound.enable = false;
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
# This value determines the NixOS release with which your system is to be
|
||||
# compatible, in order to avoid breaking some software such as database
|
||||
# servers. You should change this only after NixOS release notes say you
|
||||
# should.
|
||||
system.stateVersion = "19.09"; # Did you read the comment?
|
||||
|
||||
}
|
||||
|
||||
23
hosts/helix/default.nix
Normal file
23
hosts/helix/default.nix
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
{ self, profiles, suites, ... }:
|
||||
{
|
||||
imports = [
|
||||
./configuration.nix
|
||||
] ++ suites.sealight;
|
||||
|
||||
home-manager.users.anish = { self, suites, ... }: {
|
||||
imports = [ ] ++ suites.hmBase;
|
||||
};
|
||||
|
||||
mossnet.backup = {
|
||||
enable = false;
|
||||
name = "sealight";
|
||||
paths = [ "/var/backup/postgresql" ];
|
||||
};
|
||||
|
||||
age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
|
||||
services.postgresqlBackup = {
|
||||
enable = false;
|
||||
databases = [ "matrix" "gitea" ];
|
||||
location = "/var/backup/postgresql";
|
||||
};
|
||||
}
|
||||
|
|
@ -5,7 +5,8 @@
|
|||
|
||||
{
|
||||
imports =
|
||||
[ <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
|
||||
[
|
||||
<nixpkgs/nixos/modules/profiles/qemu-guest.nix>
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
|
||||
|
|
@ -14,7 +15,8 @@
|
|||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
|
||||
{
|
||||
device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
|
||||
|
|
@ -89,7 +89,7 @@ in
|
|||
|
||||
systemd.services.heisenbridge = {
|
||||
description = "Heisenbridge Matrix IRC bridge";
|
||||
after = ["matrix-synapse.service"];
|
||||
after = [ "matrix-synapse.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
ExecStart = ''
|
||||
|
|
@ -44,7 +44,8 @@
|
|||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
virtualHosts."git.sealight.xyz" = { # Gitea hostname
|
||||
virtualHosts."git.sealight.xyz" = {
|
||||
# Gitea hostname
|
||||
enableACME = true; # Use ACME certs
|
||||
forceSSL = true; # Force SSL
|
||||
locations."/".proxyPass = "http://localhost:3001/"; # Proxy Gitea
|
||||
|
|
@ -1,60 +0,0 @@
|
|||
{ config, pkgs, ... }:
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./wireguard.nix
|
||||
./matrix.nix
|
||||
./monitoring.nix
|
||||
./rss-bridge.nix
|
||||
./gitea.nix
|
||||
# ./dns.nix
|
||||
"${builtins.fetchTarball "https://github.com/ryantm/agenix/archive/main.tar.gz"}/modules/age.nix"
|
||||
];
|
||||
|
||||
# Use the GRUB 2 boot loader.
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.version = 2;
|
||||
boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only
|
||||
|
||||
networking.hostName = "helix"; # Define your hostname.
|
||||
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.ens3.useDHCP = true;
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh.enable = true;
|
||||
services.openssh.passwordAuthentication = false;
|
||||
services.openssh.permitRootLogin = "no";
|
||||
|
||||
# Open ports in the firewall.
|
||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# Include agenix
|
||||
#environment.systemPackages = [ agenix.defaultPackage.x86_64-linux ];
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.anish = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve"
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCeWQsf9rbE+KBrWLkLkg1PMKx0jPfDP8xyv+XtddIQzAskRTN+JSSQp1GpoRgfQij7bx6f6DfjkwSQK5NWDQNQ+klGhcdEwEdptWUzpRAvKHMImjyIwFHmRKKEgcfH8+DSHVM93nRSQKrLezX4PzPkHF9f3TLxFdGeQDeY0J2oP2Oa97hRtuTJZW9BwUojyvDYUbg7F3fxf+pdFCvIAFaayiLkhOYdTXnjLt1Ks6NOhSzM78ZibHv4pFYI9r6dhflkFP/SzyLeSSm1aVAtxqE7vF5HnnORAg0byDsiOv/9RXxiDx7gkAAw3xENDSpp9TRj54M7iz1OSsRMhmD6orHjZFIRejlE4DIn+PBPm3PH+U5ILKTogE6n5MfPT28V0QdtHuqq3b5tSWiDcFpnjxbIUmEIo5hLzMR0tXZoNLQhBCSNfxjE8CYzpk7mHbvhSs2GPfG+NI1vvldbw2EF8beJFQHNYTqJw8y7p8RXpCwZqqpSitJX6v9DiYdLVG1hWvE= nix-on-droid@localhost"
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box" ];
|
||||
};
|
||||
|
||||
# This value determines the NixOS release with which your system is to be
|
||||
# compatible, in order to avoid breaking some software such as database
|
||||
# servers. You should change this only after NixOS release notes say you
|
||||
# should.
|
||||
system.stateVersion = "19.09"; # Did you read the comment?
|
||||
|
||||
}
|
||||
|
||||
|
|
@ -1,375 +0,0 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
#./mod-mx-puppet-slack.nix
|
||||
./mautrix-whatsapp.nix
|
||||
./mod-heisenbridge.nix
|
||||
];
|
||||
security.acme.email = "anish+acme@lakhwara.com";
|
||||
security.acme.acceptTerms = true;
|
||||
services.matrix-synapse = {
|
||||
enable = true;
|
||||
app_service_config_files = [
|
||||
# # The registration file is automatically generated after starting the appservice for the first time.
|
||||
# # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/
|
||||
# # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml
|
||||
"/var/lib/matrix-synapse/discord-registration.yaml"
|
||||
"/var/lib/matrix-synapse/telegram-registration.yaml"
|
||||
#"/var/lib/matrix-synapse/slack-registration.yaml"
|
||||
#"/var/lib/matrix-synapse/whatsapp-registration.yaml"
|
||||
];
|
||||
server_name = "sealight.xyz";
|
||||
registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU";
|
||||
enable_metrics = true;
|
||||
enable_registration = true;
|
||||
database_type = "psycopg2";
|
||||
database_args = {
|
||||
database = "matrix-synapse";
|
||||
};
|
||||
|
||||
listeners = [
|
||||
{
|
||||
port = 8448;
|
||||
tls = false;
|
||||
resources = [{
|
||||
compress = true;
|
||||
names = ["client" "federation"];
|
||||
}];
|
||||
}
|
||||
{
|
||||
port = 9090;
|
||||
type = "metrics";
|
||||
bind_address = "0.0.0.0";
|
||||
resources = [{
|
||||
compress = false;
|
||||
names = [];
|
||||
}];
|
||||
tls = false;
|
||||
}
|
||||
];
|
||||
extraConfig = ''
|
||||
max_upload_size: "50M"
|
||||
use_presence: false
|
||||
'';
|
||||
## coturn based TURN server integration (TURN server setup mentioned later),
|
||||
## shared secret generated while configuring coturn
|
||||
## and reused here (power of Nix being a real programming language)
|
||||
turn_uris = [
|
||||
"turn:turn.sealight.xyz:3478?transport=udp"
|
||||
"turn:turn.sealight.xyz:3478?transport=tcp"
|
||||
];
|
||||
turn_shared_secret = config.services.coturn.static-auth-secret;
|
||||
};
|
||||
|
||||
|
||||
services.coturn = {
|
||||
enable = true;
|
||||
use-auth-secret = true;
|
||||
static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ";
|
||||
realm = "turn.sealight.xyz";
|
||||
min-port = 49111;
|
||||
max-port = 51111;
|
||||
no-cli = true;
|
||||
no-tcp-relay = true;
|
||||
no-tls = true;
|
||||
cert = "${config.security.acme.certs."turn.sealight.xyz".directory}/full.pem";
|
||||
pkey = "${config.security.acme.certs."turn.sealight.xyz".directory}/key.pem";
|
||||
extraConfig = ''
|
||||
verbose
|
||||
user-quota=12
|
||||
total-quota=1200
|
||||
denied-peer-ip=10.0.0.0-10.255.255.255
|
||||
denied-peer-ip=192.168.0.0-192.168.255.255
|
||||
denied-peer-ip=172.16.0.0-172.31.255.255
|
||||
denied-peer-ip=0.0.0.0-0.255.255.255
|
||||
denied-peer-ip=100.64.0.0-100.127.255.255
|
||||
denied-peer-ip=127.0.0.0-127.255.255.255
|
||||
denied-peer-ip=169.254.0.0-169.254.255.255
|
||||
denied-peer-ip=192.0.0.0-192.0.0.255
|
||||
denied-peer-ip=192.0.2.0-192.0.2.255
|
||||
denied-peer-ip=192.88.99.0-192.88.99.255
|
||||
denied-peer-ip=198.18.0.0-198.19.255.255
|
||||
denied-peer-ip=198.51.100.0-198.51.100.255
|
||||
denied-peer-ip=203.0.113.0-203.0.113.255
|
||||
denied-peer-ip=240.0.0.0-255.255.255.255
|
||||
'';
|
||||
};
|
||||
|
||||
security.acme.certs.${config.services.coturn.realm} = {
|
||||
/* insert here the right configuration to obtain a certificate */
|
||||
webroot = "/var/lib/acme/acme-challenge/";
|
||||
email = "anish+acme@lakhwara.com";
|
||||
postRun = "systemctl restart coturn.service";
|
||||
group = "turnserver";
|
||||
};
|
||||
|
||||
services.jitsi-meet = {
|
||||
enable = true;
|
||||
hostName = "jitsi.sealight.xyz";
|
||||
};
|
||||
services.jitsi-videobridge.enable = true;
|
||||
|
||||
services.mautrix-telegram = {
|
||||
enable = true;
|
||||
environmentFile = /etc/secrets/telegram.env; # file containing the appservice and telegram tokens
|
||||
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
|
||||
settings = {
|
||||
homeserver = {
|
||||
address = "https://sealight.xyz";
|
||||
domain = "sealight.xyz";
|
||||
};
|
||||
appservice = {
|
||||
provisioning.enabled = false;
|
||||
id = "telegram";
|
||||
bot_username = "telegrambridge";
|
||||
public = {
|
||||
enabled = false;
|
||||
prefix = "/public";
|
||||
external = "https://chat.sealight.xyz/public";
|
||||
};
|
||||
address = "http://localhost:18787";
|
||||
port = 18787;
|
||||
# The service uses SQLite by default, but it's also possible to use PostgreSQL instead:
|
||||
#database = "postgresql:///mautrix-telegram?host=/run/postgresql";
|
||||
};
|
||||
bridge = {
|
||||
relaybot.authless_portals = false;
|
||||
permissions = {
|
||||
"@aynish:sealight.xyz" = "admin";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.mautrix-whatsapp = {
|
||||
enable = false;
|
||||
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
|
||||
#configOptions = {
|
||||
# homeserver = {
|
||||
# address = "https://chat.sealight.xyz";
|
||||
# domain = "sealight.xyz";
|
||||
# };
|
||||
# appservice = {
|
||||
# id = "whatsapp";
|
||||
# address = http://localhost:9897;
|
||||
# hostname = "0.0.0.0";
|
||||
# port = 9897;
|
||||
# database = {
|
||||
# type = "sqlite3";
|
||||
# uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
|
||||
# };
|
||||
# state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json";
|
||||
# bot = {
|
||||
# username = "whatsappbot";
|
||||
# displayname = "WhatsApp bridge bot";
|
||||
# avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
|
||||
# };
|
||||
# as_token = "";
|
||||
# hs_token = "";
|
||||
# };
|
||||
# bridge = {
|
||||
# username_template = "whatsapp_{{.}}";
|
||||
# displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
|
||||
# command_prefix = "!wa";
|
||||
# permissions = {
|
||||
# "@aynish:sealight.xyz" = 100;
|
||||
# };
|
||||
# };
|
||||
# logging = {
|
||||
# directory = "/var/lib/mautrix-whatsapp/logs";
|
||||
# file_name_format = "{{.Date}}-{{.Index}}.log";
|
||||
# file_date_format = "\"2006-01-02\"";
|
||||
# file_mode = 384;
|
||||
# timestamp_format = "Jan _2, 2006 15:04:05";
|
||||
# print_level = "debug";
|
||||
# };
|
||||
# metrics = {
|
||||
# enabled = true;
|
||||
# listen = "http://localhost:5070";
|
||||
# };
|
||||
#};
|
||||
};
|
||||
|
||||
services.mx-puppet-discord = {
|
||||
enable = true;
|
||||
settings = {
|
||||
bridge = {
|
||||
bindAddress = "localhost";
|
||||
port = 16785;
|
||||
domain = "sealight.xyz";
|
||||
homeserverUrl = "https://sealight.xyz";
|
||||
avatarUrl = "https://discord.com/assets/2d20a45d79110dc5bf947137e9d99b66.svg";
|
||||
};
|
||||
provisioning = {
|
||||
whitelist = [ "@aynish:sealight.xyz" ];
|
||||
};
|
||||
relay = {
|
||||
whitelist = [ "@aynish:sealight.xyz" ];
|
||||
};
|
||||
namePatterns = {
|
||||
group = ":name";
|
||||
room = ":name";
|
||||
user = ":name (Discord)";
|
||||
userOverride = ":displayname";
|
||||
};
|
||||
presence = {
|
||||
enabled = false;
|
||||
};
|
||||
};
|
||||
serviceDependencies = ["matrix-synapse.service"];
|
||||
};
|
||||
|
||||
#services.mx-puppet-slack= {
|
||||
#enable = false;
|
||||
#settings = {
|
||||
# bridge = {
|
||||
# bindAddress = "localhost";
|
||||
# port = 16786;
|
||||
# domain = "sealight.xyz";
|
||||
# homeserverUrl = "https://sealight.xyz";
|
||||
# };
|
||||
# provisioning = {
|
||||
# whitelist = [ "@aynish:sealight.xyz" ];
|
||||
# };
|
||||
# relay = {
|
||||
# whitelist = [ "@aynish:sealight.xyz" ];
|
||||
# };
|
||||
# namePatterns = {
|
||||
# group = ":name";
|
||||
# room = ":name[:team? - :team,]";
|
||||
# user = ":name (Slack)";
|
||||
# userOverride = ":displayname";
|
||||
# };
|
||||
# presence = {
|
||||
# enabled = false;
|
||||
# };
|
||||
# oauth = {
|
||||
# enabled = false;
|
||||
# };
|
||||
#};
|
||||
#serviceDependencies = ["matrix-synapse.service"];
|
||||
#};
|
||||
|
||||
services.heisenbridge = {
|
||||
enable = true;
|
||||
homeserver = "https://sealight.xyz";
|
||||
listenPort = 14456;
|
||||
appServiceToken = "wyujLh8kjpmk2bfKeEE3sZ2gWOEUBKK5";
|
||||
homeserverToken = "yEHs7lthD2ZHUibJOAv1APaFhEjxN5PT";
|
||||
};
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
## postgresql user and db name remains in the
|
||||
## service.matrix-synapse.database_args setting which
|
||||
## by default is matrix-synapse
|
||||
initialScript = pkgs.writeText "synapse-init.sql" ''
|
||||
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|'kq@iBwlIzu";
|
||||
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
|
||||
TEMPLATE template0
|
||||
LC_COLLATE = "C"
|
||||
LC_CTYPE = "C";
|
||||
'';
|
||||
};
|
||||
|
||||
networking.firewall = let
|
||||
range = with config.services.coturn; [ {
|
||||
from = min-port;
|
||||
to = max-port;
|
||||
} ];
|
||||
in {
|
||||
enable = true;
|
||||
allowedUDPPortRanges = range; # coturn
|
||||
allowedTCPPortRanges = range;
|
||||
allowedTCPPorts = [
|
||||
22 # SSH
|
||||
8448 # Matrix federation
|
||||
8008
|
||||
80
|
||||
443
|
||||
3478 # Coturn service
|
||||
5349 # Coturn service
|
||||
9090 # Synapse Metrics
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
3478
|
||||
5349 # Coturn service
|
||||
];
|
||||
};
|
||||
|
||||
nixpkgs.overlays = [
|
||||
(self: super: {
|
||||
element-web = super.element-web.override {
|
||||
conf = {
|
||||
default_server_config = {
|
||||
"m.homeserver" = {
|
||||
"base_url" = "https://chat.sealight.xyz";
|
||||
"server_name" = "sealight.xyz";
|
||||
};
|
||||
"m.identity_server" = {
|
||||
"base_url" = "https://vector.im";
|
||||
};
|
||||
};
|
||||
|
||||
## jitsi will be setup later,
|
||||
## but we need to add to Riot configuration
|
||||
jitsi.preferredDomain = "jitsi.sealight.xyz";
|
||||
};
|
||||
};
|
||||
})
|
||||
];
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts = {
|
||||
|
||||
"sealight.xyz" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
root = "/var/www/sealight.xyz";
|
||||
};
|
||||
locations."/_matrix" = {
|
||||
proxyPass = "http://localhost:8448";
|
||||
};
|
||||
locations."/slackbridge" = {
|
||||
proxyPass = "http://localhost:9899";
|
||||
};
|
||||
};
|
||||
|
||||
## virtual host for Synapse
|
||||
"chat.sealight.xyz" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
#useACMEHost = "sealight.xyz";
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:8448";
|
||||
};
|
||||
};
|
||||
|
||||
## virtual host for Riot/Web
|
||||
"element.sealight.xyz" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
#useACMEHost = "sealight.xyz";
|
||||
|
||||
## root points to the riot-web package content, also configured via Nix
|
||||
locations."/" = {
|
||||
root = pkgs.element-web;
|
||||
};
|
||||
};
|
||||
|
||||
${config.services.jitsi-meet.hostName} = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
};
|
||||
};
|
||||
## other nginx specific best practices
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedTlsSettings = true;
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [ matrix-appservice-slack ];
|
||||
}
|
||||
|
|
@ -1,159 +0,0 @@
|
|||
{ config, pkgs, ... }: {
|
||||
# grafana configuration
|
||||
#services.grafana = {
|
||||
# enable = true;
|
||||
# domain = "grafana.mossnet.lan";
|
||||
# port = 2342;
|
||||
# addr = "127.0.0.1";
|
||||
#};
|
||||
#
|
||||
## nginx reverse proxy
|
||||
#services.nginx.virtualHosts.${config.services.grafana.domain} = {
|
||||
# locations."/" = {
|
||||
# proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
|
||||
# proxyWebsockets = true;
|
||||
# };
|
||||
#};
|
||||
|
||||
services.prometheus = {
|
||||
enable = true;
|
||||
port = 9001;
|
||||
exporters = {
|
||||
node = {
|
||||
enable = true;
|
||||
enabledCollectors = [ "systemd" ];
|
||||
port = 9002;
|
||||
};
|
||||
};
|
||||
rules = [
|
||||
''
|
||||
groups:
|
||||
- name: synapse
|
||||
rules:
|
||||
- record: "synapse_federation_transaction_queue_pendingEdus:total"
|
||||
expr: "sum(synapse_federation_transaction_queue_pendingEdus or absent(synapse_federation_transaction_queue_pendingEdus)*0)"
|
||||
- record: "synapse_federation_transaction_queue_pendingPdus:total"
|
||||
expr: "sum(synapse_federation_transaction_queue_pendingPdus or absent(synapse_federation_transaction_queue_pendingPdus)*0)"
|
||||
- record: 'synapse_http_server_request_count:method'
|
||||
labels:
|
||||
servlet: ""
|
||||
expr: "sum(synapse_http_server_request_count) by (method)"
|
||||
- record: 'synapse_http_server_request_count:servlet'
|
||||
labels:
|
||||
method: ""
|
||||
expr: 'sum(synapse_http_server_request_count) by (servlet)'
|
||||
|
||||
- record: 'synapse_http_server_request_count:total'
|
||||
labels:
|
||||
servlet: ""
|
||||
expr: 'sum(synapse_http_server_request_count:by_method) by (servlet)'
|
||||
|
||||
- record: 'synapse_cache:hit_ratio_5m'
|
||||
expr: 'rate(synapse_util_caches_cache:hits[5m]) / rate(synapse_util_caches_cache:total[5m])'
|
||||
- record: 'synapse_cache:hit_ratio_30s'
|
||||
expr: 'rate(synapse_util_caches_cache:hits[30s]) / rate(synapse_util_caches_cache:total[30s])'
|
||||
|
||||
- record: 'synapse_federation_client_sent'
|
||||
labels:
|
||||
type: "EDU"
|
||||
expr: 'synapse_federation_client_sent_edus + 0'
|
||||
- record: 'synapse_federation_client_sent'
|
||||
labels:
|
||||
type: "PDU"
|
||||
expr: 'synapse_federation_client_sent_pdu_destinations:count + 0'
|
||||
- record: 'synapse_federation_client_sent'
|
||||
labels:
|
||||
type: "Query"
|
||||
expr: 'sum(synapse_federation_client_sent_queries) by (job)'
|
||||
|
||||
- record: 'synapse_federation_server_received'
|
||||
labels:
|
||||
type: "EDU"
|
||||
expr: 'synapse_federation_server_received_edus + 0'
|
||||
- record: 'synapse_federation_server_received'
|
||||
labels:
|
||||
type: "PDU"
|
||||
expr: 'synapse_federation_server_received_pdus + 0'
|
||||
- record: 'synapse_federation_server_received'
|
||||
labels:
|
||||
type: "Query"
|
||||
expr: 'sum(synapse_federation_server_received_queries) by (job)'
|
||||
|
||||
- record: 'synapse_federation_transaction_queue_pending'
|
||||
labels:
|
||||
type: "EDU"
|
||||
expr: 'synapse_federation_transaction_queue_pending_edus + 0'
|
||||
- record: 'synapse_federation_transaction_queue_pending'
|
||||
labels:
|
||||
type: "PDU"
|
||||
expr: 'synapse_federation_transaction_queue_pending_pdus + 0'
|
||||
|
||||
- record: synapse_storage_events_persisted_by_source_type
|
||||
expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_type="remote"})
|
||||
labels:
|
||||
type: remote
|
||||
- record: synapse_storage_events_persisted_by_source_type
|
||||
expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity="*client*",origin_type="local"})
|
||||
labels:
|
||||
type: local
|
||||
- record: synapse_storage_events_persisted_by_source_type
|
||||
expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity!="*client*",origin_type="local"})
|
||||
labels:
|
||||
type: bridges
|
||||
- record: synapse_storage_events_persisted_by_event_type
|
||||
expr: sum without(origin_entity, origin_type) (synapse_storage_events_persisted_events_sep)
|
||||
- record: synapse_storage_events_persisted_by_origin
|
||||
expr: sum without(type) (synapse_storage_events_persisted_events_sep)
|
||||
''
|
||||
];
|
||||
scrapeConfigs = [
|
||||
{
|
||||
job_name = "helix";
|
||||
static_configs = [{
|
||||
targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
|
||||
}];
|
||||
}
|
||||
{
|
||||
job_name = "synapse";
|
||||
metrics_path = "/_synapse/metrics";
|
||||
static_configs = [{
|
||||
targets = [ "localhost:9090" ];
|
||||
}];
|
||||
}
|
||||
{
|
||||
job_name = "gitea";
|
||||
static_configs = [{
|
||||
targets = [ "localhost:3001" ];
|
||||
}];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 9001 ];
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."sealight.xyz" = {
|
||||
locations."/metrics" = {
|
||||
#basicAuth = { anish = "password"; };
|
||||
proxyPass = "http://localhost:9001";
|
||||
};
|
||||
};
|
||||
|
||||
services.loki = {
|
||||
enable = true;
|
||||
configFile = /var/loki-config.yaml;
|
||||
};
|
||||
|
||||
systemd.services.promtail = {
|
||||
description = "Promtail service for Loki";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = ''
|
||||
${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml}
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
{pkgs, lib, config, ...}:
|
||||
{
|
||||
services.rss-bridge = {
|
||||
enable = true;
|
||||
virtualHost = "bridge.sealight.xyz";
|
||||
whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit"];
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."bridge.sealight.xyz".forceSSL = true;
|
||||
services.nginx.virtualHosts."bridge.sealight.xyz".enableACME = true;
|
||||
}
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
{
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
vhost = {
|
||||
"sealight.xyz" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
root = "/var/www/sealight.xyz"
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,32 +0,0 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
environment.systemPackages = [ pkgs.wireguard pkgs.mosh ];
|
||||
networking.nat = {
|
||||
enable = true;
|
||||
externalInterface = "ens3";
|
||||
internalInterfaces = [ "wg0" ];
|
||||
};
|
||||
networking.firewall = {
|
||||
allowedUDPPorts = [ 60990 ];
|
||||
};
|
||||
|
||||
networking.wireguard.interfaces.wg0 = {
|
||||
ips = [ "10.0.69.1/24" ];
|
||||
listenPort = 60990;
|
||||
privateKeyFile = "/var/lib/wireguard/priv";
|
||||
peers = [
|
||||
{ # box
|
||||
publicKey = "Ra78mOc110K7URN5uB3m9d78iBKgeRHzT+3HkiFp9BU=";
|
||||
allowedIPs = [ "10.0.69.4/32" ];
|
||||
}
|
||||
{ # line
|
||||
publicKey = "fsb1FuGmYi89p4CVXytKw2FYamONKtoanxrgs/dJjC8=";
|
||||
allowedIPs = [ "10.0.69.3/32" ];
|
||||
}
|
||||
{ # curve
|
||||
publicKey = "XmV4AcPPND/eeSI6d9M1iahCjtymqY6DdUDEFNP/x3g=";
|
||||
allowedIPs = [ "10.0.69.2/32" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
@ -1,3 +1,5 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
security.acme.email = "anish+acme@lakhwara.com";
|
||||
security.acme.acceptTerms = true;
|
||||
|
|
@ -7,19 +9,39 @@
|
|||
# # The registration file is automatically generated after starting the appservice for the first time.
|
||||
# # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/
|
||||
# # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml
|
||||
# "/var/lib/matrix-synapse/discord-registration.yaml"
|
||||
# "/var/lib/matrix-synapse/telegram-registration.yaml"
|
||||
# "/var/lib/matrix-synapse/slack-registration.yaml"
|
||||
# # "/var/lib/matrix-synapse/whatsapp-registration.yaml"
|
||||
"/var/lib/matrix-synapse/discord-registration.yaml"
|
||||
"/var/lib/matrix-synapse/telegram-registration.yaml"
|
||||
#"/var/lib/matrix-synapse/slack-registration.yaml"
|
||||
#"/var/lib/matrix-synapse/whatsapp-registration.yaml"
|
||||
];
|
||||
server_name = "sealight.xyz";
|
||||
registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; # TODO use agnix
|
||||
registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU";
|
||||
enable_metrics = true;
|
||||
enable_registration = true;
|
||||
database_type = "psycopg2";
|
||||
database_args = {
|
||||
database = "matrix-synapse";
|
||||
};
|
||||
listeners = [
|
||||
{
|
||||
port = 8448;
|
||||
tls = false;
|
||||
resources = [{
|
||||
compress = true;
|
||||
names = [ "client" "federation" ];
|
||||
}];
|
||||
}
|
||||
{
|
||||
port = 9090;
|
||||
type = "metrics";
|
||||
bind_address = "0.0.0.0";
|
||||
resources = [{
|
||||
compress = false;
|
||||
names = [ ];
|
||||
}];
|
||||
tls = false;
|
||||
}
|
||||
];
|
||||
extraConfig = ''
|
||||
max_upload_size: "50M"
|
||||
use_presence: false
|
||||
|
|
@ -32,27 +54,6 @@
|
|||
"turn:turn.sealight.xyz:3478?transport=tcp"
|
||||
];
|
||||
turn_shared_secret = config.services.coturn.static-auth-secret;
|
||||
|
||||
listeners = [
|
||||
{
|
||||
port = 8448;
|
||||
tls = false;
|
||||
resources = [{
|
||||
compress = true;
|
||||
names = ["client" "federation"];
|
||||
}];
|
||||
}
|
||||
{
|
||||
port = 9090;
|
||||
type = "metrics";
|
||||
bind_address = "0.0.0.0";
|
||||
resources = [{
|
||||
compress = false;
|
||||
names = [];
|
||||
}];
|
||||
tls = false;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
services.coturn = {
|
||||
|
|
@ -60,27 +61,45 @@
|
|||
use-auth-secret = true;
|
||||
static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ";
|
||||
realm = "turn.sealight.xyz";
|
||||
min-port = 49111;
|
||||
max-port = 51111;
|
||||
no-cli = true;
|
||||
no-tcp-relay = true;
|
||||
no-tls = true;
|
||||
no-dtls = true;
|
||||
cert = "${config.security.acme.certs."turn.sealight.xyz".directory}/full.pem";
|
||||
pkey = "${config.security.acme.certs."turn.sealight.xyz".directory}/key.pem";
|
||||
extraConfig = ''
|
||||
verbose
|
||||
user-quota=12
|
||||
total-quota=1200
|
||||
denied-peer-ip=10.0.0.0-10.255.255.255
|
||||
denied-peer-ip=192.168.0.0-192.168.255.255
|
||||
denied-peer-ip=172.16.0.0-172.31.255.255
|
||||
|
||||
allowed-peer-ip=192.168.191.127
|
||||
denied-peer-ip=0.0.0.0-0.255.255.255
|
||||
denied-peer-ip=100.64.0.0-100.127.255.255
|
||||
denied-peer-ip=127.0.0.0-127.255.255.255
|
||||
denied-peer-ip=169.254.0.0-169.254.255.255
|
||||
denied-peer-ip=192.0.0.0-192.0.0.255
|
||||
denied-peer-ip=192.0.2.0-192.0.2.255
|
||||
denied-peer-ip=192.88.99.0-192.88.99.255
|
||||
denied-peer-ip=198.18.0.0-198.19.255.255
|
||||
denied-peer-ip=198.51.100.0-198.51.100.255
|
||||
denied-peer-ip=203.0.113.0-203.0.113.255
|
||||
denied-peer-ip=240.0.0.0-255.255.255.255
|
||||
'';
|
||||
};
|
||||
|
||||
security.acme.certs.${config.services.coturn.realm} = {
|
||||
/* insert here the right configuration to obtain a certificate */
|
||||
webroot = "/var/lib/acme/acme-challenge/";
|
||||
email = "anish+acme@lakhwara.com";
|
||||
postRun = "systemctl restart coturn.service";
|
||||
group = "turnserver";
|
||||
};
|
||||
|
||||
services.jitsi-meet = {
|
||||
enable = true;
|
||||
hostName = "jitsi.sealight.xyz";
|
||||
|
||||
## this setting is going to add relevant ports to
|
||||
## networking.firewall.allowedTCPPorts &
|
||||
## networking.firewall.allowedUDPPorts
|
||||
};
|
||||
services.jitsi-videobridge.enable = true;
|
||||
|
||||
|
|
@ -90,17 +109,20 @@
|
|||
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
|
||||
settings = {
|
||||
homeserver = {
|
||||
address = "https://chat.sealight.xyz";
|
||||
address = "https://sealight.xyz";
|
||||
domain = "sealight.xyz";
|
||||
};
|
||||
appservice = {
|
||||
provisioning.enabled = false;
|
||||
id = "telegram";
|
||||
bot_username = "telegrambridge";
|
||||
public = {
|
||||
enabled = false;
|
||||
prefix = "/public";
|
||||
external = "https://chat.sealight.xyz/public";
|
||||
};
|
||||
address = "http://localhost:18787";
|
||||
port = 18787;
|
||||
# The service uses SQLite by default, but it's also possible to use PostgreSQL instead:
|
||||
#database = "postgresql:///mautrix-telegram?host=/run/postgresql";
|
||||
};
|
||||
|
|
@ -113,96 +135,41 @@
|
|||
};
|
||||
};
|
||||
|
||||
services.mautrix-whatsapp = {
|
||||
services.mx-puppet-discord = {
|
||||
enable = true;
|
||||
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
|
||||
configOptions = {
|
||||
homeserver = {
|
||||
address = "https://chat.sealight.xyz";
|
||||
domain = "sealight.xyz";
|
||||
};
|
||||
appservice = {
|
||||
id = "whatsapp";
|
||||
address = http://localhost:9897;
|
||||
hostname = "0.0.0.0";
|
||||
port = 9897;
|
||||
database = {
|
||||
type = "sqlite3";
|
||||
uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
|
||||
};
|
||||
state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json";
|
||||
bot = {
|
||||
username = "whatsappbot";
|
||||
displayname = "WhatsApp bridge bot";
|
||||
avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
|
||||
};
|
||||
as_token = "";
|
||||
hs_token = "";
|
||||
};
|
||||
settings = {
|
||||
bridge = {
|
||||
username_template = "whatsapp_{{.}}";
|
||||
displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
|
||||
command_prefix = "!wa";
|
||||
permissions = {
|
||||
"@aynish:sealight.xyz" = 100;
|
||||
};
|
||||
};
|
||||
logging = {
|
||||
directory = "/var/lib/mautrix-whatsapp/logs";
|
||||
file_name_format = "{{.Date}}-{{.Index}}.log";
|
||||
file_date_format = "\"2006-01-02\"";
|
||||
file_mode = 384;
|
||||
timestamp_format = "Jan _2, 2006 15:04:05";
|
||||
print_level = "debug";
|
||||
};
|
||||
metrics = {
|
||||
enabled = true;
|
||||
listen = "http://localhost:5070";
|
||||
bindAddress = "localhost";
|
||||
port = 16785;
|
||||
domain = "sealight.xyz";
|
||||
homeserverUrl = "https://sealight.xyz";
|
||||
avatarUrl = "https://discord.com/assets/2d20a45d79110dc5bf947137e9d99b66.svg";
|
||||
};
|
||||
provisioning = {
|
||||
whitelist = [ "@aynish:sealight.xyz" ];
|
||||
};
|
||||
relay = {
|
||||
whitelist = [ "@aynish:sealight.xyz" ];
|
||||
};
|
||||
namePatterns = {
|
||||
group = ":name";
|
||||
room = ":name";
|
||||
user = ":name (Discord)";
|
||||
userOverride = ":displayname";
|
||||
};
|
||||
presence = {
|
||||
enabled = false;
|
||||
};
|
||||
};
|
||||
serviceDependencies = [ "matrix-synapse.service" ];
|
||||
};
|
||||
|
||||
services.matrix-appservice-slack = {
|
||||
services.heisenbridge = {
|
||||
enable = true;
|
||||
#environmentFile = /etc/secrets/matrix-appservice-slack.env;
|
||||
settings = {
|
||||
homeserver = {
|
||||
server_name = "sealight.xyz";
|
||||
url = "https://chat.sealight.xyz";
|
||||
};
|
||||
db = {
|
||||
engine = "postgres";
|
||||
connectionString = "postgres://slackbridge_user:somethingverysecret@localhost/slack_bridge?sslmode=require";
|
||||
};
|
||||
matrix_admin_room = "!ikEWOHCcmoZtVzSmPF:sealight.xyz";
|
||||
username_prefix = "slack_";
|
||||
rtm = {
|
||||
enable = true;
|
||||
logging = "silent";
|
||||
};
|
||||
slack_hook_port = 9899;
|
||||
enable_metrics = true;
|
||||
puppeting = {
|
||||
enabled = true;
|
||||
onboard_users = true;
|
||||
};
|
||||
oauth2 = {
|
||||
client_id = "2832868673.1609454840563";
|
||||
client_secret = "079a7ca42b192e66a9ff32740a69cb9d";
|
||||
redirect_prefix = "https://sealight.xyz/slackbridge/";
|
||||
};
|
||||
#team_sync = {
|
||||
# T02QGRJKT = {
|
||||
# users = {
|
||||
# enabled = false;
|
||||
# };
|
||||
# channels = {
|
||||
# enabled = true;
|
||||
# alias_prefix = "qf_";
|
||||
# };
|
||||
# };
|
||||
#};
|
||||
};
|
||||
homeserver = "https://sealight.xyz";
|
||||
listenPort = 14456;
|
||||
appServiceToken = "wyujLh8kjpmk2bfKeEE3sZ2gWOEUBKK5";
|
||||
homeserverToken = "yEHs7lthD2ZHUibJOAv1APaFhEjxN5PT";
|
||||
};
|
||||
|
||||
services.postgresql = {
|
||||
|
|
@ -219,16 +186,30 @@
|
|||
'';
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
networking.firewall =
|
||||
let
|
||||
range = with config.services.coturn; [{
|
||||
from = min-port;
|
||||
to = max-port;
|
||||
}];
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
allowedUDPPortRanges = range; # coturn
|
||||
allowedTCPPortRanges = range;
|
||||
allowedTCPPorts = [
|
||||
22 # SSH
|
||||
8448 # Matrix federation
|
||||
8008
|
||||
80
|
||||
443
|
||||
3478 # Coturn service
|
||||
5349 # Coturn service
|
||||
9090 # Synapse Metrics
|
||||
9899 # Matrix <-> Slack Bridge Puppeting
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
3478
|
||||
5349 # Coturn service
|
||||
];
|
||||
};
|
||||
|
||||
|
|
@ -257,7 +238,6 @@
|
|||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts = {
|
||||
|
||||
"sealight.xyz" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
|
|
@ -271,7 +251,6 @@
|
|||
proxyPass = "http://localhost:9899";
|
||||
};
|
||||
};
|
||||
|
||||
## virtual host for Synapse
|
||||
"chat.sealight.xyz" = {
|
||||
forceSSL = true;
|
||||
|
|
@ -281,19 +260,16 @@
|
|||
proxyPass = "http://localhost:8448";
|
||||
};
|
||||
};
|
||||
|
||||
## virtual host for Riot/Web
|
||||
"element.sealight.xyz" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
#useACMEHost = "sealight.xyz";
|
||||
|
||||
## root points to the riot-web package content, also configured via Nix
|
||||
locations."/" = {
|
||||
root = pkgs.element-web;
|
||||
};
|
||||
};
|
||||
|
||||
${config.services.jitsi-meet.hostName} = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
|
|
@ -305,5 +281,86 @@
|
|||
recommendedTlsSettings = true;
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [ matrix-appservice-slack ];
|
||||
# environment.systemPackages = with pkgs; [ matrix-appservice-slack ];
|
||||
#services.mx-puppet-slack= {
|
||||
#enable = false;
|
||||
#settings = {
|
||||
# bridge = {
|
||||
# bindAddress = "localhost";
|
||||
# port = 16786;
|
||||
# domain = "sealight.xyz";
|
||||
# homeserverUrl = "https://sealight.xyz";
|
||||
# };
|
||||
# provisioning = {
|
||||
# whitelist = [ "@aynish:sealight.xyz" ];
|
||||
# };
|
||||
# relay = {
|
||||
# whitelist = [ "@aynish:sealight.xyz" ];
|
||||
# };
|
||||
# namePatterns = {
|
||||
# group = ":name";
|
||||
# room = ":name[:team? - :team,]";
|
||||
# user = ":name (Slack)";
|
||||
# userOverride = ":displayname";
|
||||
# };
|
||||
# presence = {
|
||||
# enabled = false;
|
||||
# };
|
||||
# oauth = {
|
||||
# enabled = false;
|
||||
# };
|
||||
#};
|
||||
#serviceDependencies = ["matrix-synapse.service"];
|
||||
#};
|
||||
|
||||
# services.mautrix-whatsapp = {
|
||||
# enable = false;
|
||||
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
|
||||
#configOptions = {
|
||||
# homeserver = {
|
||||
# address = "https://chat.sealight.xyz";
|
||||
# domain = "sealight.xyz";
|
||||
# };
|
||||
# appservice = {
|
||||
# id = "whatsapp";
|
||||
# address = http://localhost:9897;
|
||||
# hostname = "0.0.0.0";
|
||||
# port = 9897;
|
||||
# database = {
|
||||
# type = "sqlite3";
|
||||
# uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
|
||||
# };
|
||||
# state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json";
|
||||
# bot = {
|
||||
# username = "whatsappbot";
|
||||
# displayname = "WhatsApp bridge bot";
|
||||
# avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
|
||||
# };
|
||||
# as_token = "";
|
||||
# hs_token = "";
|
||||
# };
|
||||
# bridge = {
|
||||
# username_template = "whatsapp_{{.}}";
|
||||
# displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
|
||||
# command_prefix = "!wa";
|
||||
# permissions = {
|
||||
# "@aynish:sealight.xyz" = 100;
|
||||
# };
|
||||
# };
|
||||
# logging = {
|
||||
# directory = "/var/lib/mautrix-whatsapp/logs";
|
||||
# file_name_format = "{{.Date}}-{{.Index}}.log";
|
||||
# file_date_format = "\"2006-01-02\"";
|
||||
# file_mode = 384;
|
||||
# timestamp_format = "Jan _2, 2006 15:04:05";
|
||||
# print_level = "debug";
|
||||
# };
|
||||
# metrics = {
|
||||
# enabled = true;
|
||||
# listen = "http://localhost:5070";
|
||||
# };
|
||||
#};
|
||||
# };
|
||||
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,7 +10,8 @@ let
|
|||
# TODO: switch to configGen.json once RFC42 is implemented
|
||||
settingsFile = pkgs.writeText "matrix-appservice-slack-settings.json" (builtins.toJSON cfg.settings);
|
||||
|
||||
in {
|
||||
in
|
||||
{
|
||||
options = {
|
||||
services.matrix-appservice-slack = {
|
||||
enable = mkEnableOption "a bridge between Matrix and Slack";
|
||||
|
|
@ -5,7 +5,8 @@ with lib;
|
|||
let
|
||||
cfg = config.services.mautrix-whatsapp;
|
||||
|
||||
configFile = pkgs.runCommand "mautrix-whatsapp" {
|
||||
configFile = pkgs.runCommand "mautrix-whatsapp"
|
||||
{
|
||||
buildInputs = [ pkgs.mautrix-whatsapp pkgs.remarshal ];
|
||||
preferLocalBuild = true;
|
||||
} ''
|
||||
|
|
@ -6,11 +6,12 @@ let
|
|||
dataDir = "/var/lib/mx-puppet-slack";
|
||||
registrationFile = "${dataDir}/slack-registration.yaml";
|
||||
cfg = config.services.mx-puppet-slack;
|
||||
settingsFormat = pkgs.formats.json {};
|
||||
settingsFormat = pkgs.formats.json { };
|
||||
settingsFile = settingsFormat.generate "mx-puppet-slack-config.json" cfg.settings;
|
||||
mx-puppet-slack = pkgs.callPackage ./pkg-mx-puppet-slack.nix { };
|
||||
|
||||
in {
|
||||
in
|
||||
{
|
||||
options = {
|
||||
services.mx-puppet-slack = {
|
||||
enable = mkEnableOption ''
|
||||
159
profiles/metrics/default.nix
Normal file
159
profiles/metrics/default.nix
Normal file
|
|
@ -0,0 +1,159 @@
|
|||
{ config, pkgs, ... }: {
|
||||
# grafana configuration
|
||||
#services.grafana = {
|
||||
# enable = true;
|
||||
# domain = "grafana.mossnet.lan";
|
||||
# port = 2342;
|
||||
# addr = "127.0.0.1";
|
||||
#};
|
||||
#
|
||||
## nginx reverse proxy
|
||||
#services.nginx.virtualHosts.${config.services.grafana.domain} = {
|
||||
# locations."/" = {
|
||||
# proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}";
|
||||
# proxyWebsockets = true;
|
||||
# };
|
||||
#};
|
||||
|
||||
services.prometheus = {
|
||||
enable = true;
|
||||
port = 9001;
|
||||
exporters = {
|
||||
node = {
|
||||
enable = true;
|
||||
enabledCollectors = [ "systemd" ];
|
||||
port = 9002;
|
||||
};
|
||||
};
|
||||
rules = [
|
||||
''
|
||||
groups:
|
||||
- name: synapse
|
||||
rules:
|
||||
- record: "synapse_federation_transaction_queue_pendingEdus:total"
|
||||
expr: "sum(synapse_federation_transaction_queue_pendingEdus or absent(synapse_federation_transaction_queue_pendingEdus)*0)"
|
||||
- record: "synapse_federation_transaction_queue_pendingPdus:total"
|
||||
expr: "sum(synapse_federation_transaction_queue_pendingPdus or absent(synapse_federation_transaction_queue_pendingPdus)*0)"
|
||||
- record: 'synapse_http_server_request_count:method'
|
||||
labels:
|
||||
servlet: ""
|
||||
expr: "sum(synapse_http_server_request_count) by (method)"
|
||||
- record: 'synapse_http_server_request_count:servlet'
|
||||
labels:
|
||||
method: ""
|
||||
expr: 'sum(synapse_http_server_request_count) by (servlet)'
|
||||
|
||||
- record: 'synapse_http_server_request_count:total'
|
||||
labels:
|
||||
servlet: ""
|
||||
expr: 'sum(synapse_http_server_request_count:by_method) by (servlet)'
|
||||
|
||||
- record: 'synapse_cache:hit_ratio_5m'
|
||||
expr: 'rate(synapse_util_caches_cache:hits[5m]) / rate(synapse_util_caches_cache:total[5m])'
|
||||
- record: 'synapse_cache:hit_ratio_30s'
|
||||
expr: 'rate(synapse_util_caches_cache:hits[30s]) / rate(synapse_util_caches_cache:total[30s])'
|
||||
|
||||
- record: 'synapse_federation_client_sent'
|
||||
labels:
|
||||
type: "EDU"
|
||||
expr: 'synapse_federation_client_sent_edus + 0'
|
||||
- record: 'synapse_federation_client_sent'
|
||||
labels:
|
||||
type: "PDU"
|
||||
expr: 'synapse_federation_client_sent_pdu_destinations:count + 0'
|
||||
- record: 'synapse_federation_client_sent'
|
||||
labels:
|
||||
type: "Query"
|
||||
expr: 'sum(synapse_federation_client_sent_queries) by (job)'
|
||||
|
||||
- record: 'synapse_federation_server_received'
|
||||
labels:
|
||||
type: "EDU"
|
||||
expr: 'synapse_federation_server_received_edus + 0'
|
||||
- record: 'synapse_federation_server_received'
|
||||
labels:
|
||||
type: "PDU"
|
||||
expr: 'synapse_federation_server_received_pdus + 0'
|
||||
- record: 'synapse_federation_server_received'
|
||||
labels:
|
||||
type: "Query"
|
||||
expr: 'sum(synapse_federation_server_received_queries) by (job)'
|
||||
|
||||
- record: 'synapse_federation_transaction_queue_pending'
|
||||
labels:
|
||||
type: "EDU"
|
||||
expr: 'synapse_federation_transaction_queue_pending_edus + 0'
|
||||
- record: 'synapse_federation_transaction_queue_pending'
|
||||
labels:
|
||||
type: "PDU"
|
||||
expr: 'synapse_federation_transaction_queue_pending_pdus + 0'
|
||||
|
||||
- record: synapse_storage_events_persisted_by_source_type
|
||||
expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_type="remote"})
|
||||
labels:
|
||||
type: remote
|
||||
- record: synapse_storage_events_persisted_by_source_type
|
||||
expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity="*client*",origin_type="local"})
|
||||
labels:
|
||||
type: local
|
||||
- record: synapse_storage_events_persisted_by_source_type
|
||||
expr: sum without(type, origin_type, origin_entity) (synapse_storage_events_persisted_events_sep{origin_entity!="*client*",origin_type="local"})
|
||||
labels:
|
||||
type: bridges
|
||||
- record: synapse_storage_events_persisted_by_event_type
|
||||
expr: sum without(origin_entity, origin_type) (synapse_storage_events_persisted_events_sep)
|
||||
- record: synapse_storage_events_persisted_by_origin
|
||||
expr: sum without(type) (synapse_storage_events_persisted_events_sep)
|
||||
''
|
||||
];
|
||||
scrapeConfigs = [
|
||||
{
|
||||
job_name = "helix";
|
||||
static_configs = [{
|
||||
targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
|
||||
}];
|
||||
}
|
||||
{
|
||||
job_name = "synapse";
|
||||
metrics_path = "/_synapse/metrics";
|
||||
static_configs = [{
|
||||
targets = [ "localhost:9090" ];
|
||||
}];
|
||||
}
|
||||
{
|
||||
job_name = "gitea";
|
||||
static_configs = [{
|
||||
targets = [ "localhost:3001" ];
|
||||
}];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 9001 ];
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."sealight.xyz" = {
|
||||
locations."/metrics" = {
|
||||
#basicAuth = { anish = "password"; };
|
||||
proxyPass = "http://localhost:9001";
|
||||
};
|
||||
};
|
||||
|
||||
services.loki = {
|
||||
enable = true;
|
||||
configFile = /var/loki-config.yaml;
|
||||
};
|
||||
|
||||
systemd.services.promtail = {
|
||||
description = "Promtail service for Loki";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = ''
|
||||
${pkgs.grafana-loki}/bin/promtail --config.file ${/var/promtail.yaml}
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -5,6 +5,7 @@
|
|||
192.168.1.240 read.mossnet.lan
|
||||
192.168.1.240 music.mossnet.lan
|
||||
192.168.1.240 stats.mossnet.lan
|
||||
192.168.1.240 file.mossnet.lan
|
||||
'';
|
||||
# 10.0.69.4 mossnet.lan
|
||||
# 10.0.69.4 links.mossnet.lan
|
||||
|
|
|
|||
|
|
@ -1,14 +1,11 @@
|
|||
{pkgs, lib, config, ...}:
|
||||
{ pkgs, lib, config, ... }:
|
||||
{
|
||||
services.rss-bridge = {
|
||||
enable = true;
|
||||
virtualHost = "rss.mossnet.lan";
|
||||
whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram"];
|
||||
#dataDir = "/etc/rss-bridge/";
|
||||
virtualHost = "bridge.sealight.xyz";
|
||||
whitelist = [ "Facebook" "Bandcamp" "Twitter" "Telegram" "Instagram" "Reddit" ];
|
||||
};
|
||||
#environment.etc."rss-bridge/config.ini.php" = ''
|
||||
# [InstagramBridge]
|
||||
# session_id = %sessionid from step 1%
|
||||
# cache_timeout = %cache timeout in seconds%
|
||||
#'';
|
||||
|
||||
services.nginx.virtualHosts."bridge.sealight.xyz".forceSSL = true;
|
||||
services.nginx.virtualHosts."bridge.sealight.xyz".enableACME = true;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,7 +7,48 @@
|
|||
fileserver.host = "0.0.0.0";
|
||||
fileserver.port = 8082;
|
||||
};
|
||||
ccnetSettings.General.SERVICE_URL = "file.mossnet.lan";
|
||||
ccnetSettings.General.SERVICE_URL = "http://file.mossnet.lan";
|
||||
adminEmail = "anish@lakhwara.com";
|
||||
initialAdminPassword = "arandompasswordsecure!";
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
};
|
||||
services.nginx.upstreams."gunicorn_seafile" = {
|
||||
servers."unix:/run/seahub/gunicorn.sock" = { };
|
||||
};
|
||||
services.nginx.upstreams."seafhttp" = {
|
||||
servers."127.0.0.1:8082" = { };
|
||||
};
|
||||
services.nginx.virtualHosts."file.mossnet.lan" = {
|
||||
serverName = "file.mossnet.lan";
|
||||
locations."/" = {
|
||||
proxyPass = "http://gunicorn_seafile"; # without a trailing /
|
||||
extraConfig = ''
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-Host $server_name;
|
||||
#proxy_set_header Host $host;
|
||||
proxy_read_timeout 1200s;
|
||||
|
||||
client_max_body_size 0; # disable max upload size
|
||||
'';
|
||||
};
|
||||
locations."/seafhttp" = {
|
||||
proxyPass = "http://seafhttp"; # without a trailing /
|
||||
extraConfig = ''
|
||||
rewrite ^/seafhttp(.*)$ $1 break;
|
||||
client_max_body_size 0;
|
||||
|
||||
proxy_connect_timeout 36000s;
|
||||
proxy_read_timeout 36000s;
|
||||
proxy_send_timeout 36000s;
|
||||
|
||||
proxy_request_buffering off;
|
||||
send_timeout 36000s;
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
14
profiles/sealight-website/default.nix
Normal file
14
profiles/sealight-website/default.nix
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
vhost = {
|
||||
"sealight.xyz" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
root = "/var/www/sealight.xyz"
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -7,8 +7,8 @@
|
|||
group = "users";
|
||||
dataDir = "/home/anish/";
|
||||
configDir = "/home/anish/.config/syncthing";
|
||||
guiAddress = "0.0.0.0:8384";
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 8384 22000 ];
|
||||
networking.firewall.allowedUDPPorts = [ 22000 21027 ];
|
||||
}
|
||||
|
|
|
|||
35
profiles/wireguard-server/default.nix
Normal file
35
profiles/wireguard-server/default.nix
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
environment.systemPackages = [ pkgs.wireguard pkgs.mosh ];
|
||||
networking.nat = {
|
||||
enable = true;
|
||||
externalInterface = "ens3";
|
||||
internalInterfaces = [ "wg0" ];
|
||||
};
|
||||
networking.firewall = {
|
||||
allowedUDPPorts = [ 60990 ];
|
||||
};
|
||||
|
||||
networking.wireguard.interfaces.wg0 = {
|
||||
ips = [ "10.0.69.1/24" ];
|
||||
listenPort = 60990;
|
||||
privateKeyFile = "/var/lib/wireguard/priv";
|
||||
peers = [
|
||||
{
|
||||
# box
|
||||
publicKey = "Ra78mOc110K7URN5uB3m9d78iBKgeRHzT+3HkiFp9BU=";
|
||||
allowedIPs = [ "10.0.69.4/32" ];
|
||||
}
|
||||
{
|
||||
# line
|
||||
publicKey = "fsb1FuGmYi89p4CVXytKw2FYamONKtoanxrgs/dJjC8=";
|
||||
allowedIPs = [ "10.0.69.3/32" ];
|
||||
}
|
||||
{
|
||||
# curve
|
||||
publicKey = "XmV4AcPPND/eeSI6d9M1iahCjtymqY6DdUDEFNP/x3g=";
|
||||
allowedIPs = [ "10.0.69.2/32" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
Loading…
Reference in a new issue