genebean/dots
1
0
Fork 0
mirror of https://github.com/genebean/dots.git synced 2026-03-28 01:47:42 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Working on setting up matrix

Browse source
This commit is contained in:
Gene Liverman 2024-06-17 21:40:01 -04:00
parent d285d44932
commit 972cb8bc82
5 changed files with 57 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

61
modules/hosts/nixos/hetznix01/post-install/default.nix Normal file
View file

@ -0,0 +1,61 @@
{ config, username, ... }: {
imports = [
../../../../system/common/linux/restic.nix
./matrix-synapse.nix
./nginx.nix
];
services = {
restic.backups.daily.paths = [
"/var/lib/uptime-kuma"
];
tailscale = {
enable = true;
authKeyFile = config.sops.secrets.tailscale_key.path;
extraUpFlags = [
"--advertise-exit-node"
"--operator"
"${username}"
"--ssh"
];
useRoutingFeatures = "both";
};
};
sops = {
age.keyFile = /home/${username}/.config/sops/age/keys.txt;
defaultSopsFile = ../secrets.yaml;
secrets = {
local_git_config = {
owner = "${username}";
path = "/home/${username}/.gitconfig-local";
};
local_private_env = {
owner = "${username}";
path = "/home/${username}/.private-env";
};
mqtt_recorder_pass.restartUnits = ["mosquitto.service"];
owntracks_basic_auth = {
owner = config.users.users.nginx.name;
restartUnits = ["nginx.service"];
};
tailscale_key = {
restartUnits = [ "tailscaled-autoconnect.service" ];
};
};
};
# Enable common container config files in /etc/containers
virtualisation.containers.enable = true;
virtualisation = {
podman = {
enable = true;
# Create a `docker` alias for podman, to use it as a drop-in replacement
dockerCompat = true;
# Required for containers under podman-compose to be able to talk to each other.
defaultNetwork.settings.dns_enabled = true;
};
};
}

46
modules/hosts/nixos/hetznix01/post-install/matrix-synapse.nix Normal file
View file

@ -0,0 +1,46 @@
{ config, pkgs, ... }: let
#
in {
services.matrix-synapse = {
enable = true;
configureRedisLocally = true;
settings = {
public_baseurl = "https://matrix.technicalissues.us";
listeners = [
{
port = 8008;
tls = false;
type = "http";
x_forwarded = true;
bind_addresses = [
"::1"
"127.0.0.1"
];
resources = [
{
names = [
"client"
"federation"
];
compress = false;
}
];
}
];
database = {
name = "psycopg2";
args = {
user = "synapse_user";
database = "synapse";
};
};
url_preview_enabled = true;
enable_registration = false;
registration_shared_secret = config.sops.secrets.matrix-registration_shared_secret;
macaroon_secret_key = config.sops.secrets.matrix-macaroon_secret_key;
trusted_key_servers = [{ server_name = "matrix.org"; }];
};
};
}

103
modules/hosts/nixos/hetznix01/post-install/nginx.nix Normal file
View file

@ -0,0 +1,103 @@
{ config, ... }: let
domain = "technicalissues.us";
http_port = 80;
https_port = 443;
in {
imports = [
../../../../system/common/linux/lets-encrypt.nix
];
services.nginx = {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
appendHttpConfig = ''
# Add HSTS header with preloading to HTTPS requests.
# Adding this header to HTTP requests is discouraged
map $scheme $hsts_header {
https "max-age=31536000 always;";
}
add_header Strict-Transport-Security $hsts_header;
'';
virtualHosts = {
"hetznix01.${domain}" = {
default = true;
listen = [
{ port = http_port; addr = "0.0.0.0"; }
{ port = https_port; addr = "0.0.0.0"; ssl = true; }
];
enableACME = true;
acmeRoot = null;
addSSL = true;
forceSSL = false;
locations."/" = {
return = "200 '<h1>Hello world ;)</h1>'";
extraConfig = ''
add_header Content-Type text/html;
'';
};
};
"ot.${domain}" = {
listen = [{ port = https_port; addr = "0.0.0.0"; ssl = true; }];
enableACME = true;
acmeRoot = null;
forceSSL = true;
basicAuthFile = config.sops.secrets.owntracks_basic_auth.path;
locations = {
# OwnTracks Frontend container
"/" = {
proxyPass = "http://127.0.0.1:8082";
recommendedProxySettings = true;
};
};
};
"recorder.${domain}" = {
listen = [{ port = https_port; addr = "0.0.0.0"; ssl = true; }];
enableACME = true;
acmeRoot = null;
forceSSL = true;
basicAuthFile = config.sops.secrets.owntracks_basic_auth.path;
locations = {
# OwnTracks Recorder
"/" = {
proxyPass = "http://127.0.0.1:8083";
recommendedProxySettings = true;
};
"/pub" = { # Client apps need to point to this path
extraConfig = "proxy_set_header X-Limit-U $remote_user;";
proxyPass = "http://127.0.0.1:8083/pub";
recommendedProxySettings = true;
};
"/static/" = {
proxyPass = "http://127.0.0.1:8083/static/";
recommendedProxySettings = true;
};
"/utils/" = {
proxyPass = "http://127.0.0.1:8083/utils/";
recommendedProxySettings = true;
};
"/view/" = {
extraConfig = "proxy_buffering off;";
proxyPass = "http://127.0.0.1:8083/view/";
recommendedProxySettings = true;
};
"/ws" = {
extraConfig = "rewrite ^/(.*) /$1 break;";
proxyPass = "http://127.0.0.1:8083";
recommendedProxySettings = true;
};
};
};
"utk.${domain}" = {
listen = [{ port = https_port; addr = "0.0.0.0"; ssl = true; }];
enableACME = true;
acmeRoot = null;
forceSSL = true;
locations."/".proxyWebsockets = true;
locations."/".proxyPass = "http://127.0.0.1:3001";
};
}; # end virtualHosts
}; # end nginx
}