add host: janeway
This commit is contained in:
parent
5d56e81747
commit
0c64f1e7ab
|
|
@ -26,3 +26,9 @@ creation_rules:
|
|||
- *host_sarek
|
||||
- *user_felixalb_old
|
||||
- *user_felixalb
|
||||
|
||||
- path_regex: secrets/janeway/[^/]+\.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
- *user_felixalb_old
|
||||
- *user_felixalb
|
||||
|
|
|
|||
18
flake.lock
18
flake.lock
|
|
@ -62,11 +62,11 @@
|
|||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1696697597,
|
||||
"narHash": "sha256-q26Qv4DQ+h6IeozF2o1secyQG0jt2VUT3V0K58jr3pg=",
|
||||
"lastModified": 1696983906,
|
||||
"narHash": "sha256-L7GyeErguS7Pg4h8nK0wGlcUTbfUMDu+HMf1UcyP72k=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "5a237aecb57296f67276ac9ab296a41c23981f56",
|
||||
"rev": "bd1cde45c77891214131cbbea5b1203e485a9d51",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -125,11 +125,11 @@
|
|||
"nixpkgs-stable": "nixpkgs-stable"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1696734395,
|
||||
"narHash": "sha256-O/g/wwBqqSS7RQ53bE6Ssf0pXVTCYfN7NnJDhKfggQY=",
|
||||
"lastModified": 1697064251,
|
||||
"narHash": "sha256-xxp2sB+4vqB6S6zC/L5J8LlRKgVbgIZOcYl9/TDrEzI=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "d7380c38d407eaf06d111832f4368ba3486b800e",
|
||||
"rev": "f995ea159252a53b25fa99824f2891e3b479d511",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -140,11 +140,11 @@
|
|||
},
|
||||
"unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1696604326,
|
||||
"narHash": "sha256-YXUNI0kLEcI5g8lqGMb0nh67fY9f2YoJsILafh6zlMo=",
|
||||
"lastModified": 1697059129,
|
||||
"narHash": "sha256-9NJcFF9CEYPvHJ5ckE8kvINvI84SZZ87PvqMbH6pro0=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "87828a0e03d1418e848d3dd3f3014a632e4a4f64",
|
||||
"rev": "5e4c2ada4fcd54b99d56d7bd62f384511a7e2593",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
|
|||
14
flake.nix
14
flake.nix
|
|
@ -83,6 +83,20 @@
|
|||
}
|
||||
];
|
||||
};
|
||||
janeway = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
specialArgs = {
|
||||
inherit inputs;
|
||||
};
|
||||
modules = [
|
||||
# Overlays-module makes "pkgs.unstable" available in configuration.nix
|
||||
({ config, pkgs, ... }: { nixpkgs.overlays = [ overlay-unstable ]; })
|
||||
|
||||
./hosts/janeway/configuration.nix
|
||||
sops-nix.nixosModules.sops
|
||||
matrix-synapse-next.nixosModules.default
|
||||
];
|
||||
};
|
||||
redshirt = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
specialArgs = {
|
||||
|
|
|
|||
|
|
@ -0,0 +1,39 @@
|
|||
{ config, pkgs, lib, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
(modulesPath + "/virtualisation/proxmox-lxc.nix")
|
||||
../../base.nix
|
||||
../../common/metrics-exporters.nix
|
||||
|
||||
./services/nginx.nix
|
||||
./services/postgresql.nix
|
||||
./services/matrix-synapse.nix
|
||||
];
|
||||
|
||||
# Boot and console is handled by proxmoxLXC.
|
||||
boot.loader.systemd-boot.enable = lib.mkForce false; # Enabled in base.nix, forced off here.
|
||||
|
||||
# Override proxmox networking
|
||||
proxmoxLXC.manageNetwork = true;
|
||||
networking = {
|
||||
hostName = "janeway";
|
||||
defaultGateway = "192.168.10.1";
|
||||
interfaces."eth0".ipv4 = {
|
||||
addresses = [
|
||||
{ address = "192.168.10.183"; prefixLength = 24; }
|
||||
];
|
||||
};
|
||||
hostId = "bed956ff";
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
bottom
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = ../../secrets/janeway/janeway.yaml;
|
||||
|
||||
system.stateVersion = "23.05";
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,86 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
main_ip = "127.0.1.2";
|
||||
in
|
||||
{
|
||||
sops.secrets."matrix/synapse/registrationsecret" = {
|
||||
restartUnits = [ "matrix-synapse.service" ];
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
};
|
||||
|
||||
services.matrix-synapse-next = {
|
||||
enable = true;
|
||||
enableNginx = true;
|
||||
|
||||
workers = {
|
||||
federationSenders = 1;
|
||||
federationReceivers = 2;
|
||||
initialSyncers = 1;
|
||||
normalSyncers = 1;
|
||||
eventPersisters = 1;
|
||||
useUserDirectoryWorker = true;
|
||||
};
|
||||
|
||||
extraConfigFiles = [
|
||||
config.sops.secrets."matrix/synapse/registrationsecret".path
|
||||
];
|
||||
|
||||
settings = {
|
||||
server_name = "feal.no";
|
||||
public_baseurl = "https://matrix.feal.no";
|
||||
database.name = "psycopg2";
|
||||
autocreate_auto_join_rooms = false;
|
||||
max_upload_size = "50M";
|
||||
|
||||
#registration_shared_secret = "do_not_put_secret_here_use_extraConfigFiles";
|
||||
|
||||
trusted_key_servers = [
|
||||
{
|
||||
server_name = "matrix.org";
|
||||
verify_keys = {};
|
||||
}
|
||||
];
|
||||
|
||||
enable_registration = false;
|
||||
use_presence = true;
|
||||
|
||||
url_preview_enabled = true;
|
||||
url_preview_ip_range_blacklist = [
|
||||
# synapse example config
|
||||
"127.0.0.0/8"
|
||||
"10.0.0.0/8"
|
||||
"172.16.0.0/12"
|
||||
"192.168.0.0/16"
|
||||
"100.64.0.0/10"
|
||||
"192.0.0.0/24"
|
||||
"169.254.0.0/16"
|
||||
"192.88.99.0/24"
|
||||
"198.18.0.0/15"
|
||||
"192.0.2.0/24"
|
||||
"198.51.100.0/24"
|
||||
"203.0.113.0/24"
|
||||
"224.0.0.0/4"
|
||||
"::1/128"
|
||||
"fe80::/10"
|
||||
"fc00::/7"
|
||||
"2001:db8::/32"
|
||||
"ff00::/8"
|
||||
"fec0::/10"
|
||||
];
|
||||
|
||||
tls_certificate_path = "/etc/ssl-snakeoil/matrix_feal_no.crt";
|
||||
tls_private_key_path = "/etc/ssl-snakeoil/matrix_feal_no.key";
|
||||
|
||||
};
|
||||
};
|
||||
|
||||
services.redis.servers."".enable = true;
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
|
||||
services.nginx.virtualHosts."matrix.feal.no" = {
|
||||
enableACME = lib.mkForce false;
|
||||
forceSSL = lib.mkForce false;
|
||||
};
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{ config, values, ... }:
|
||||
{
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
enableReload = true;
|
||||
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
|
||||
/* security.acme = { */
|
||||
/* acceptTerms = true; */
|
||||
/* email = "felix@albrigtsen.it"; */
|
||||
/* }; */
|
||||
}
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
enableTCPIP = true; # Expose on the network
|
||||
authentication = pkgs.lib.mkOverride 10 ''
|
||||
local all all trust
|
||||
host all all 127.0.0.1/32 trust
|
||||
host all all ::1/128 trust
|
||||
'';
|
||||
};
|
||||
|
||||
services.postgresqlBackup = {
|
||||
enable = true;
|
||||
location = "/backup/postgresql/";
|
||||
startAt = "*-*-* 03:15:00";
|
||||
backupAll = true;
|
||||
};
|
||||
|
||||
|
||||
environment.systemPackages = [ config.services.postgresql.package ];
|
||||
}
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
matrix:
|
||||
synapse:
|
||||
registrationsecret: ENC[AES256_GCM,data:hXLNFkvMe21RlT1wgQvsBeyxtn+0yLK5bYUeMQbV/1bVtl6nvoInZ1qP7wz8MoWhFiAq1ZwxE2bjDfxXdkL8YSvNHlhdbFD1nJBP51mci9SQE/xLaMh7Aqtos0swdKw=,iv:uIxuhhaTpCRQQ/fP16J50cKCSbAD+KYO3a2kb70BX2M=,tag:EqD5jeZvCcJJCrBcG0YjsA==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age1n6j9umxfn5ekvmsrqngdhux0y994yh72sd5xdt6sxec86k4dyu9shsgjkw
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1VllZUGR6d3dpSlczS1cx
|
||||
ejZCMEhDaDJ3ZEIxR1NWV3NXQXhDVERNUlIwCjU4TWNBbmNpc2x4MHNibVBJWk5s
|
||||
Sk5aamZVcnZGSThLTXI1Vkh0UFVBNkUKLS0tIDdHYWhjK3pBM3VydldzdTBTcEVz
|
||||
YUhoWTJ4SnBRb1ZzVUhxdnBCTEFnTUEK72ofuMzrLBzFmA0fO9hX5vhtzcbJse+q
|
||||
qK1YKKv12iF1TZ9+Ty73W5Dlum51YWfUD0/BX+/QwQob9AmszlQ7vg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1nj7ju6f3jfvzw4c0sxywthjmztwp7rwqceun8xw2tlfrt7qymatser4vqf
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArWEFrN0xJY2ltcENKbzgv
|
||||
V1BiVm9URll0QlUzVVlpV2RNNDdlcGJ5eFRrCnJabTVEVFFMK0xUalJtWjJuSnNF
|
||||
TW5iVkl4WXp0VU5BVkZWSTdINWRBMmsKLS0tIC9aaUZWWXNKRUpnNGR4TDM1Rmpx
|
||||
d3VYdmJjQys3NWN6KzJNSTFqQ0hOR0kKKLYpphnephuK9Pbp7yzwtGeXadYciogn
|
||||
nQs4qiNooRGpC7wjcuwH6OUBbFsnLWrt3lQjP00Xs8uEFFtcx7wotw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2023-10-13T22:50:20Z"
|
||||
mac: ENC[AES256_GCM,data:ktGFV+oNBMIKNCVLXZtrxn8HbvgjmXTRmAWuDQaNyMIIWvnTvd5IQBivG1kCimVr96RFl6RWTMWH4nqHVFlo0jxQfx8KUVXmaO7dfp4Ri+ZKMLu33HmLfwHiStnYRwPCAtwG/AXx9SXl0SAL5S+xHSl4mnShbyYfLAHibccYros=,iv:JeMtQ5uxYzpqr1eHZrLTNqhizjOCaixNg8VFcwjY2Y8=,tag:gHfRDBezAwzCqmEhayVYEg==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.7.3
|
||||
Loading…
Reference in New Issue