diff --git a/modules/hosts/nixos/hetznix01/default.nix b/modules/hosts/nixos/hetznix01/default.nix
index fd63a63..0a6161f 100644
--- a/modules/hosts/nixos/hetznix01/default.nix
+++ b/modules/hosts/nixos/hetznix01/default.nix
@@ -40,6 +40,7 @@
services = {
fail2ban.enable = true;
+ logrotate.enable = true;
postgresql = {
enable = true;
package = pkgs.postgresql_16;
diff --git a/modules/hosts/nixos/hetznix01/post-install/default.nix b/modules/hosts/nixos/hetznix01/post-install/default.nix
index a0c9b3a..8bbc04e 100644
--- a/modules/hosts/nixos/hetznix01/post-install/default.nix
+++ b/modules/hosts/nixos/hetznix01/post-install/default.nix
@@ -38,6 +38,7 @@
owner = config.users.users.matrix-synapse.name;
restartUnits = ["matrix-synapse.service"];
};
+ matrix_homeserver_signing_key.owner = config.users.users.matrix-synapse.name;
mqtt_recorder_pass.restartUnits = ["mosquitto.service"];
owntracks_basic_auth = {
owner = config.users.users.nginx.name;
diff --git a/modules/hosts/nixos/hetznix01/post-install/matrix-synapse.nix b/modules/hosts/nixos/hetznix01/post-install/matrix-synapse.nix
index 74ac820..d320b2a 100644
--- a/modules/hosts/nixos/hetznix01/post-install/matrix-synapse.nix
+++ b/modules/hosts/nixos/hetznix01/post-install/matrix-synapse.nix
@@ -9,7 +9,9 @@ in {
config.sops.secrets.matrix_secrets_yaml.path
];
settings = {
- public_baseurl = "https://matrix-test.technicalissues.us";
+ server_name = "technicalissues.us";
+ public_baseurl = "https://matrix.technicalissues.us";
+ signing_key_path = config.sops.secrets.matrix_homeserver_signing_key.path;
listeners = [
{
port = 8008;
@@ -31,17 +33,9 @@ in {
];
}
];
- database = {
- name = "psycopg2";
- args = {
- user = "synapse_user";
- database = "synapse";
- };
- };
url_preview_enabled = true;
enable_registration = false;
trusted_key_servers = [{ server_name = "matrix.org"; }];
-
};
};
diff --git a/modules/hosts/nixos/hetznix01/post-install/nginx.nix b/modules/hosts/nixos/hetznix01/post-install/nginx.nix
index ef0b7bb..d7e0a55 100644
--- a/modules/hosts/nixos/hetznix01/post-install/nginx.nix
+++ b/modules/hosts/nixos/hetznix01/post-install/nginx.nix
@@ -9,6 +9,7 @@ in {
];
services.nginx = {
enable = true;
+ recommendedBrotliSettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
@@ -21,40 +22,79 @@ in {
}
add_header Strict-Transport-Security $hsts_header;
'';
+ defaultListen = [
+ { port = https_port; addr = "0.0.0.0"; ssl = true; }
+ { port = https_port; addr = "[::]"; ssl = true; }
+ ];
virtualHosts = {
"hetznix01.${domain}" = {
+ serverAliases = [
+ "technicalissues.us"
+ ];
default = true;
+ enableACME = true;
+ acmeRoot = null;
+ forceSSL = true;
+ locations = {
+ "/" = {
+ return = "301 https://beanbag.technicalissues.us";
+ };
+ "/.well-known/matrix/client" = {
+ return = ''
+ 200 '{"m.homeserver": {"base_url": "https://matrix.technicalissues.us"}}'
+ '';
+ extraConfig = ''
+ default_type application/json;
+ add_header Access-Control-Allow-Origin *;
+ '';
+ };
+ "/.well-known/matrix/server" = {
+ return = ''
+ 200 '{"m.server": "matrix.technicalissues.us"}'
+ '';
+ extraConfig = ''
+ default_type application/json;
+ add_header Access-Control-Allow-Origin *;
+ '';
+ };
+ };
+ };
+ "matrix.${domain}" = {
listen = [
- { port = http_port; addr = "0.0.0.0"; }
{ port = https_port; addr = "0.0.0.0"; ssl = true; }
+ { port = https_port; addr = "[::]"; ssl = true; }
+ { port = 8448; addr = "0.0.0.0"; ssl = true; }
+ { port = 8448; addr = "[::]"; ssl = true; }
];
enableACME = true;
acmeRoot = null;
- addSSL = true;
- forceSSL = false;
- locations."/" = {
- return = "200 'Hello world ;)
'";
- extraConfig = ''
- add_header Content-Type text/html;
- '';
+ forceSSL = true;
+ extraConfig = ''
+ client_max_body_size 0;
+ '';
+ locations = {
+ "/" = {
+ return = "200 'Hi.
'";
+ extraConfig = ''
+ add_header Content-Type text/html;
+ '';
+ };
+ # Forward all Matrix API calls to the synapse Matrix homeserver. A trailing slash
+ # *must not* be used here.
+ "/_matrix".proxyPass = "http://[::1]:8008";
+ # Forward requests for e.g. SSO and password-resets.
+ "/_synapse/client".proxyPass = "http://[::1]:8008";
};
};
"ot.${domain}" = {
- listen = [{ port = https_port; addr = "0.0.0.0"; ssl = true; }];
enableACME = true;
acmeRoot = null;
forceSSL = true;
basicAuthFile = config.sops.secrets.owntracks_basic_auth.path;
- locations = {
- # OwnTracks Frontend container
- "/" = {
- proxyPass = "http://127.0.0.1:8082";
- recommendedProxySettings = true;
- };
- };
+ # OwnTracks Frontend container
+ locations."/".proxyPass = "http://127.0.0.1:8082";
};
"recorder.${domain}" = {
- listen = [{ port = https_port; addr = "0.0.0.0"; ssl = true; }];
enableACME = true;
acmeRoot = null;
forceSSL = true;
@@ -63,35 +103,28 @@ in {
# OwnTracks Recorder
"/" = {
proxyPass = "http://127.0.0.1:8083";
- recommendedProxySettings = true;
};
"/pub" = { # Client apps need to point to this path
extraConfig = "proxy_set_header X-Limit-U $remote_user;";
proxyPass = "http://127.0.0.1:8083/pub";
- recommendedProxySettings = true;
};
"/static/" = {
proxyPass = "http://127.0.0.1:8083/static/";
- recommendedProxySettings = true;
};
"/utils/" = {
proxyPass = "http://127.0.0.1:8083/utils/";
- recommendedProxySettings = true;
};
"/view/" = {
extraConfig = "proxy_buffering off;";
proxyPass = "http://127.0.0.1:8083/view/";
- recommendedProxySettings = true;
};
"/ws" = {
extraConfig = "rewrite ^/(.*) /$1 break;";
proxyPass = "http://127.0.0.1:8083";
- recommendedProxySettings = true;
};
};
};
"utk.${domain}" = {
- listen = [{ port = https_port; addr = "0.0.0.0"; ssl = true; }];
enableACME = true;
acmeRoot = null;
forceSSL = true;
diff --git a/modules/hosts/nixos/hetznix01/secrets.yaml b/modules/hosts/nixos/hetznix01/secrets.yaml
index 4abb301..10532b2 100644
--- a/modules/hosts/nixos/hetznix01/secrets.yaml
+++ b/modules/hosts/nixos/hetznix01/secrets.yaml
@@ -1,6 +1,7 @@
local_git_config: ENC[AES256_GCM,data:BulcGoJ85+BA3maqbMewUdaNOl3feaJMq/4yZL8Y8SLOHqzmA/DUO7k=,iv:V7wpSiEQpt7AhKd+MUyGqTsO6YZovpkj+AaqpLnfRM0=,tag:7f3fFzQX3bpjokVPnUKDPQ==,type:str]
local_private_env: ENC[AES256_GCM,data:OFcCaE9/hpd6JIoUTTxg0pEFL3rkUE3G+JzP/wjFXpa/AJa2Rr0Kv42Pu+iwgPMWgcpp50ChjVxGvbceNQ==,iv:I2LyWwvdMdE4wKLb3udLVMu3jFsvYR1ruZvaVt9GG7c=,tag:tBPmlNr0iNdLRU1GIRV2mg==,type:str]
-matrix_secrets_yaml: ENC[AES256_GCM,data:El9razifgbJEaJd9NccOZX1RuZQHRyw6Yg7TY4G8vDtD2w7KxnHUG7bcpIQodh3I1GDjj3gQcHXP6HNs0zS7UjaoGltDt3mHnrhqkvvDW/RgAGrJ9nUsQitB3yhF51PG3IOK1SSbIBk+Pr/wQWbs11ic8i+fGJ6yPcv8k/X5Az8rKmDqDuZh9KUvSB3SQ9J/roOZ+HDb8fv1VmMgZZNGmkOUGZupZkKd+kc2rWrBl5zHTd9XUH6oLk2EwRDufR7T,iv:xCG8xJ7A1bFwK9v1+XJ+vSp/GXCTwdKCL4H/uQ6h4fQ=,tag:Z72quTZvJUMLJ+VJVsTKrw==,type:str]
+matrix_secrets_yaml: ENC[AES256_GCM,data:6DLtAZIYBlL7iQVS/FBeUEhHyAOFZ5JRNqFBqi59GVh7cP0Hp8RBWxKpWAH2eUPYqUqUGCKrSSH3sJqzV+vasSR62tcltV7+13+q+rZVCZNCEf21EwQ5aaxgR3yG4n3YUPqLsCQB6UnWn0tF5HO0ofjYkya0pQ/nX9TBiiqIcPcd4NovbTtf+S0G0VptqyXAuRvJoKCx42ft9IBfV9tF1QsXLemKYlI10hN5l/MgJHwVbwH5xXR2kLKvnlpAyIoST/uJhswQV9DyK9cnl09ZM9ztcXhveBzv6uDW+pme8lFL99SMtMJcbSzxYW/pt+GJgYd1NiaoPbayWM72jdpH0hf2zWchxnIJIyL3H6EzIjD8BE9GnMP7ujQwBZGNZITRSg==,iv:cDtuOhv2v6CZcwiMM3oqjmajIl7D8Im+LkfarcjTM/w=,tag:e7zRQBYslJqESOGN3c4/aw==,type:str]
+matrix_homeserver_signing_key: ENC[AES256_GCM,data:+RflNxFfS2w9LbavT7YnCQIhJWI49kN7pOa9/dH0BpDWxKQaLE4ZYBYq0ikAgcHaF3+rBL3f6KxUacw=,iv:6+nZzuxBUwjM74XHCD89YWfyuMRcoIwQlHLiNN4NWdc=,tag:91yigynRz6QdEd4rF7d/9g==,type:str]
mqtt_recorder_pass: ENC[AES256_GCM,data:N44nv2mk5zguWXNHdKsxhoKUjiduD1hzsAb6,iv:aLudKuUBTPXgtAF33exELH/PESD0CqoDaydeqdhcmbA=,tag:3lhrqO8jxJiRHWZjWSRa0g==,type:str]
owntracks_basic_auth: ENC[AES256_GCM,data:GX1U1uf7+erE+g9GzhXK5ED2QicfcbpRCwpJDw6Zr9X2FtdMYleH5mhLxw==,iv:PflRq+P50+oFf4wv5wwlY6V9bApGuJ3tlYTvJZ5mg0E=,tag:VHBY5qv7rX74DGURsYaWpw==,type:str]
tailscale_key: ENC[AES256_GCM,data:Bl00WuIrLvxmt7aNsoXC6G7XFls7waZMzdfo/MsEOZl/i3wHwrjrmgwd3V4GkaJ42UjrC1OLobrkuLves4w=,iv:tlCu0EWgvhvs1ANdtQr7KWHJ2RjpHniUm/rFC4L/MHs=,tag:+8eov9w+SPGZPnjMdrN8gA==,type:str]
@@ -19,8 +20,8 @@ sops:
WkI4ejBaODI0d0tjWHpTT3VWTXNyaXcKMDtvHN4gcZqBNslyC+NwYW05zgs8QuPV
W6EktAz+xu6kx5BJbli5GkUFmj52AtEGIqZ1Sr4a0pKQACC87XcTQA==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2024-06-18T01:49:28Z"
- mac: ENC[AES256_GCM,data:ckwiYte2TP4ufiFkmX2cTuNNae+VizjQ/CM1b1m3Lz3Vo5utd1g82loChQS95s9lr1dmKljuUbklHzg74JbNCeFky4f6od5CEydq/R9dXFTZKBen9cLcdvTVQ0i6E9rZS0t6ohy3wMFyJxw0ss6Zyykd0cqQOPuFBpyHmKFZTVs=,iv:85G4CxlLPD0Ac6KxRYaZ+4H9uj8Co6nmh1bbL6s3MVI=,tag:oyRhgR2Uf7lWFIlH5FKAvw==,type:str]
+ lastmodified: "2024-06-19T01:44:04Z"
+ mac: ENC[AES256_GCM,data:PU4r7DhcG6OgqTCeKBtxyAHDErGH6Eh33sOd+KuImQ74ajgahFNfd4zO27OldZbSERkOYLuFqw7w9+zblV3eaaXRQx97Ek3z4oMtJFv2t9lnNfG0lm45c1eECKV742mzTDi6/bcnQMdn/CaGli8DL45IGGctW+beXRJza0S3wEY=,iv:51WymgQc4OWcannaD4g+fjp4vc75WonWsOMS3Jyz7Xo=,tag:dmNFFgkuKQxy2Snb/HjX/A==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1