aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity

move lituus to agenix

Browse source
This commit is contained in:
Anish Lakhwara 2022-10-10 19:10:07 +10:00
parent ce79882247
commit 9e12445a3e
3 changed files with 33 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

49
profiles/matrix/default.nix
View file

@ -2,11 +2,15 @@
{
imports = [
./mautrix-telegram
./mautrix-telegram.nix
# ./mjolnir.nix # need to create the mod user
./heisenbridge.nix
];
environment.systemPackages = [ pkgs.matrix-synapse-tools.rust-synapse-compress-state ];
age.secrets.synapse-database-password.file = "${self}/secrets/synapse-database-password.age";
age.secrets.synapse-database-password.owner = "matrix-synapse";
age.secrets.synapse-database-password.file = "${self}/secrets/synapse-config.age";
age.secrets.synapse-database-password.owner = "matrix-synapse";
services.matrix-synapse = {
enable = true;
@ -45,17 +49,20 @@
"turn:turn.sealight.xyz:3478?transport=udp"
"turn:turn.sealight.xyz:3478?transport=tcp"
];
turn_shared_secret = config.services.coturn.static-auth-secret;
extraConfig = ''
max_upload_size: "50M"
use_presence: false
registration_shared_secret: "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; # TODO agenix
'';
# turn_shared_secret = config.services.coturn.static-auth-secret;
extraConfig = "/run/agenix/synapse-config";
# Example config (saved as secret??)
# ''
# max_upload_size: "50M"
# use_presence: false
# registration_shared_secret: "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU";
# enable_registration_without_verification: true
# '';
enable_metrics = true;
enable_registration = false;
enable_registration = true;
database = {
name = "psycopg2";
args.password = "Da0?H*9i{x?,]|kq@iBwlIzu"; # TODO agenix
args.passfile = "/run/agenix/synapse-database-password";
};
};
## coturn based TURN server integration (TURN server setup mentioned later),
@ -96,13 +103,13 @@
# '';
# };
security.acme.certs.${config.services.coturn.realm} = {
/* insert here the right configuration to obtain a certificate */
webroot = "/var/lib/acme/acme-challenge/";
email = "anish+acme@lakhwara.com";
postRun = "systemctl restart coturn.service";
group = "turnserver";
};
# security.acme.certs.${config.services.coturn.realm} = {
# /* insert here the right configuration to obtain a certificate */
# webroot = "/var/lib/acme/acme-challenge/";
# email = "anish+acme@lakhwara.com";
# postRun = "systemctl restart coturn.service";
# group = "turnserver";
# };
# TODO fix up jitsi bridge stuff
## services.jitsi-meet = {
@ -119,7 +126,7 @@
## by default is matrix-synapse
# TODO agenix
initialScript = pkgs.writeText "synapse-init.sql" ''
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|kq@iBwlIzu";
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "s0m3s3cur3p455w0rdth4tisch4ng3d";
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
TEMPLATE template0
LC_COLLATE = "C"
@ -202,8 +209,7 @@
## virtual host for Synapse
"chat.sealight.xyz" = {
forceSSL = true;
enableACME = true; # TODO
#useACMEHost = "sealight.xyz";
enableACME = true;
locations."/" = {
proxyPass = "http://localhost:8448";
};
@ -211,9 +217,8 @@
## virtual host for Riot/Web
"element.sealight.xyz" = {
forceSSL = true;
enableACME = true; # TODO
#useACMEHost = "sealight.xyz";
## root points to the riot-web package content, also configured via Nix
enableACME = true;
## root points to the element-web package content, also configured via Nix
locations."/" = {
root = pkgs.element-web;
};

4
profiles/matrix/mautrix-telegram.nix
View file

@ -1,8 +1,10 @@
{ config, lib, pkgs, ... }:
{
age.secrets.telegram-matrix-env.file = "${self}/secrets/telegram-matrix-env.age";
age.secrets.telegram-matrix-env.owner = "mautrix-telegram";
services.mautrix-telegram = {
enable = true;
environmentFile = /etc/secrets/telegram.env; # TODO agenix
environmentFile = "/run/agenix/telegram-matrix-env";
# TODO use pgsql
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
settings = {

4
profiles/matrix/mjolnir.nix
View file

@ -1,5 +1,7 @@
{ pkgs, lib, config, ... }:
{
age.secrets.sealight-mod-password.file = "${self}/secrets/sealight-mod-password.age";
age.secrets.sealight-mod-password.owner = "mjolnir";
services.mjolnir = {
enable = true;
protectedRooms = [
@ -13,7 +15,7 @@
pantalaimon = {
enable = true;
username = "mod";
passwordFile = "/run/agenix/sealight-mod-password"; # TODO
passwordFile = "/run/agenix/sealight-mod-password";
options.homeserver = config.services.mjolnir.homeserverUrl;
};
};