aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity

move lituus to agenix

Browse source
This commit is contained in:
Anish Lakhwara 2022-10-10 19:10:07 +10:00
parent ce79882247
commit 9e12445a3e
3 changed files with 33 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

49
profiles/matrix/default.nix
View file

@ -2,11 +2,15 @@
{ {
imports = [ imports = [
./mautrix-telegram ./mautrix-telegram.nix
# ./mjolnir.nix # need to create the mod user # ./mjolnir.nix # need to create the mod user
./heisenbridge.nix ./heisenbridge.nix
]; ];
environment.systemPackages = [ pkgs.matrix-synapse-tools.rust-synapse-compress-state ]; environment.systemPackages = [ pkgs.matrix-synapse-tools.rust-synapse-compress-state ];
age.secrets.synapse-database-password.file = "${self}/secrets/synapse-database-password.age";
age.secrets.synapse-database-password.owner = "matrix-synapse";
age.secrets.synapse-database-password.file = "${self}/secrets/synapse-config.age";
age.secrets.synapse-database-password.owner = "matrix-synapse";
services.matrix-synapse = { services.matrix-synapse = {
enable = true; enable = true;
@ -45,17 +49,20 @@
"turn:turn.sealight.xyz:3478?transport=udp" "turn:turn.sealight.xyz:3478?transport=udp"
"turn:turn.sealight.xyz:3478?transport=tcp" "turn:turn.sealight.xyz:3478?transport=tcp"
]; ];
turn_shared_secret = config.services.coturn.static-auth-secret; # turn_shared_secret = config.services.coturn.static-auth-secret;
extraConfig = '' extraConfig = "/run/agenix/synapse-config";
max_upload_size: "50M" # Example config (saved as secret??)
use_presence: false # ''
registration_shared_secret: "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; # TODO agenix # max_upload_size: "50M"
''; # use_presence: false
# registration_shared_secret: "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU";
# enable_registration_without_verification: true
# '';
enable_metrics = true; enable_metrics = true;
enable_registration = false; enable_registration = true;
database = { database = {
name = "psycopg2"; name = "psycopg2";
args.password = "Da0?H*9i{x?,]|kq@iBwlIzu"; # TODO agenix args.passfile = "/run/agenix/synapse-database-password";
}; };
}; };
## coturn based TURN server integration (TURN server setup mentioned later), ## coturn based TURN server integration (TURN server setup mentioned later),
@ -96,13 +103,13 @@
# ''; # '';
# }; # };
security.acme.certs.${config.services.coturn.realm} = { # security.acme.certs.${config.services.coturn.realm} = {
/* insert here the right configuration to obtain a certificate */ # /* insert here the right configuration to obtain a certificate */
webroot = "/var/lib/acme/acme-challenge/"; # webroot = "/var/lib/acme/acme-challenge/";
email = "anish+acme@lakhwara.com"; # email = "anish+acme@lakhwara.com";
postRun = "systemctl restart coturn.service"; # postRun = "systemctl restart coturn.service";
group = "turnserver"; # group = "turnserver";
}; # };
# TODO fix up jitsi bridge stuff # TODO fix up jitsi bridge stuff
## services.jitsi-meet = { ## services.jitsi-meet = {
@ -119,7 +126,7 @@
## by default is matrix-synapse ## by default is matrix-synapse
# TODO agenix # TODO agenix
initialScript = pkgs.writeText "synapse-init.sql" '' initialScript = pkgs.writeText "synapse-init.sql" ''
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|kq@iBwlIzu"; CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "s0m3s3cur3p455w0rdth4tisch4ng3d";
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse" CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
TEMPLATE template0 TEMPLATE template0
LC_COLLATE = "C" LC_COLLATE = "C"
@ -202,8 +209,7 @@
## virtual host for Synapse ## virtual host for Synapse
"chat.sealight.xyz" = { "chat.sealight.xyz" = {
forceSSL = true; forceSSL = true;
enableACME = true; # TODO enableACME = true;
#useACMEHost = "sealight.xyz";
locations."/" = { locations."/" = {
proxyPass = "http://localhost:8448"; proxyPass = "http://localhost:8448";
}; };
@ -211,9 +217,8 @@
## virtual host for Riot/Web ## virtual host for Riot/Web
"element.sealight.xyz" = { "element.sealight.xyz" = {
forceSSL = true; forceSSL = true;
enableACME = true; # TODO enableACME = true;
#useACMEHost = "sealight.xyz"; ## root points to the element-web package content, also configured via Nix
## root points to the riot-web package content, also configured via Nix
locations."/" = { locations."/" = {
root = pkgs.element-web; root = pkgs.element-web;
}; };

4
profiles/matrix/mautrix-telegram.nix
View file

@ -1,8 +1,10 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
{ {
age.secrets.telegram-matrix-env.file = "${self}/secrets/telegram-matrix-env.age";
age.secrets.telegram-matrix-env.owner = "mautrix-telegram";
services.mautrix-telegram = { services.mautrix-telegram = {
enable = true; enable = true;
environmentFile = /etc/secrets/telegram.env; # TODO agenix environmentFile = "/run/agenix/telegram-matrix-env";
# TODO use pgsql # TODO use pgsql
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
settings = { settings = {

4
profiles/matrix/mjolnir.nix
View file

@ -1,5 +1,7 @@
{ pkgs, lib, config, ... }: { pkgs, lib, config, ... }:
{ {
age.secrets.sealight-mod-password.file = "${self}/secrets/sealight-mod-password.age";
age.secrets.sealight-mod-password.owner = "mjolnir";
services.mjolnir = { services.mjolnir = {
enable = true; enable = true;
protectedRooms = [ protectedRooms = [
@ -13,7 +15,7 @@
pantalaimon = { pantalaimon = {
enable = true; enable = true;
username = "mod"; username = "mod";
passwordFile = "/run/agenix/sealight-mod-password"; # TODO passwordFile = "/run/agenix/sealight-mod-password";
options.homeserver = config.services.mjolnir.homeserverUrl; options.homeserver = config.services.mjolnir.homeserverUrl;
}; };
}; };