mirror of
https://github.com/genebean/dots.git
synced 2026-03-27 01:17:42 -04:00
Matrix works, Nginx is carrying the load
This commit is contained in:
parent
fac12b855e
commit
f3e75455b3
5 changed files with 66 additions and 36 deletions
|
|
@ -40,6 +40,7 @@
|
|||
|
||||
services = {
|
||||
fail2ban.enable = true;
|
||||
logrotate.enable = true;
|
||||
postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_16;
|
||||
|
|
|
|||
|
|
@ -38,6 +38,7 @@
|
|||
owner = config.users.users.matrix-synapse.name;
|
||||
restartUnits = ["matrix-synapse.service"];
|
||||
};
|
||||
matrix_homeserver_signing_key.owner = config.users.users.matrix-synapse.name;
|
||||
mqtt_recorder_pass.restartUnits = ["mosquitto.service"];
|
||||
owntracks_basic_auth = {
|
||||
owner = config.users.users.nginx.name;
|
||||
|
|
|
|||
|
|
@ -9,7 +9,9 @@ in {
|
|||
config.sops.secrets.matrix_secrets_yaml.path
|
||||
];
|
||||
settings = {
|
||||
public_baseurl = "https://matrix-test.technicalissues.us";
|
||||
server_name = "technicalissues.us";
|
||||
public_baseurl = "https://matrix.technicalissues.us";
|
||||
signing_key_path = config.sops.secrets.matrix_homeserver_signing_key.path;
|
||||
listeners = [
|
||||
{
|
||||
port = 8008;
|
||||
|
|
@ -31,17 +33,9 @@ in {
|
|||
];
|
||||
}
|
||||
];
|
||||
database = {
|
||||
name = "psycopg2";
|
||||
args = {
|
||||
user = "synapse_user";
|
||||
database = "synapse";
|
||||
};
|
||||
};
|
||||
url_preview_enabled = true;
|
||||
enable_registration = false;
|
||||
trusted_key_servers = [{ server_name = "matrix.org"; }];
|
||||
|
||||
};
|
||||
|
||||
};
|
||||
|
|
|
|||
|
|
@ -9,6 +9,7 @@ in {
|
|||
];
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
recommendedBrotliSettings = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
|
|
@ -21,40 +22,79 @@ in {
|
|||
}
|
||||
add_header Strict-Transport-Security $hsts_header;
|
||||
'';
|
||||
defaultListen = [
|
||||
{ port = https_port; addr = "0.0.0.0"; ssl = true; }
|
||||
{ port = https_port; addr = "[::]"; ssl = true; }
|
||||
];
|
||||
virtualHosts = {
|
||||
"hetznix01.${domain}" = {
|
||||
serverAliases = [
|
||||
"technicalissues.us"
|
||||
];
|
||||
default = true;
|
||||
enableACME = true;
|
||||
acmeRoot = null;
|
||||
forceSSL = true;
|
||||
locations = {
|
||||
"/" = {
|
||||
return = "301 https://beanbag.technicalissues.us";
|
||||
};
|
||||
"/.well-known/matrix/client" = {
|
||||
return = ''
|
||||
200 '{"m.homeserver": {"base_url": "https://matrix.technicalissues.us"}}'
|
||||
'';
|
||||
extraConfig = ''
|
||||
default_type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
'';
|
||||
};
|
||||
"/.well-known/matrix/server" = {
|
||||
return = ''
|
||||
200 '{"m.server": "matrix.technicalissues.us"}'
|
||||
'';
|
||||
extraConfig = ''
|
||||
default_type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
"matrix.${domain}" = {
|
||||
listen = [
|
||||
{ port = http_port; addr = "0.0.0.0"; }
|
||||
{ port = https_port; addr = "0.0.0.0"; ssl = true; }
|
||||
{ port = https_port; addr = "[::]"; ssl = true; }
|
||||
{ port = 8448; addr = "0.0.0.0"; ssl = true; }
|
||||
{ port = 8448; addr = "[::]"; ssl = true; }
|
||||
];
|
||||
enableACME = true;
|
||||
acmeRoot = null;
|
||||
addSSL = true;
|
||||
forceSSL = false;
|
||||
locations."/" = {
|
||||
return = "200 '<h1>Hello world ;)</h1>'";
|
||||
forceSSL = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 0;
|
||||
'';
|
||||
locations = {
|
||||
"/" = {
|
||||
return = "200 '<h1>Hi.</h1>'";
|
||||
extraConfig = ''
|
||||
add_header Content-Type text/html;
|
||||
'';
|
||||
};
|
||||
# Forward all Matrix API calls to the synapse Matrix homeserver. A trailing slash
|
||||
# *must not* be used here.
|
||||
"/_matrix".proxyPass = "http://[::1]:8008";
|
||||
# Forward requests for e.g. SSO and password-resets.
|
||||
"/_synapse/client".proxyPass = "http://[::1]:8008";
|
||||
};
|
||||
};
|
||||
"ot.${domain}" = {
|
||||
listen = [{ port = https_port; addr = "0.0.0.0"; ssl = true; }];
|
||||
enableACME = true;
|
||||
acmeRoot = null;
|
||||
forceSSL = true;
|
||||
basicAuthFile = config.sops.secrets.owntracks_basic_auth.path;
|
||||
locations = {
|
||||
# OwnTracks Frontend container
|
||||
"/" = {
|
||||
proxyPass = "http://127.0.0.1:8082";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
};
|
||||
locations."/".proxyPass = "http://127.0.0.1:8082";
|
||||
};
|
||||
"recorder.${domain}" = {
|
||||
listen = [{ port = https_port; addr = "0.0.0.0"; ssl = true; }];
|
||||
enableACME = true;
|
||||
acmeRoot = null;
|
||||
forceSSL = true;
|
||||
|
|
@ -63,35 +103,28 @@ in {
|
|||
# OwnTracks Recorder
|
||||
"/" = {
|
||||
proxyPass = "http://127.0.0.1:8083";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
"/pub" = { # Client apps need to point to this path
|
||||
extraConfig = "proxy_set_header X-Limit-U $remote_user;";
|
||||
proxyPass = "http://127.0.0.1:8083/pub";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
"/static/" = {
|
||||
proxyPass = "http://127.0.0.1:8083/static/";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
"/utils/" = {
|
||||
proxyPass = "http://127.0.0.1:8083/utils/";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
"/view/" = {
|
||||
extraConfig = "proxy_buffering off;";
|
||||
proxyPass = "http://127.0.0.1:8083/view/";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
"/ws" = {
|
||||
extraConfig = "rewrite ^/(.*) /$1 break;";
|
||||
proxyPass = "http://127.0.0.1:8083";
|
||||
recommendedProxySettings = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
"utk.${domain}" = {
|
||||
listen = [{ port = https_port; addr = "0.0.0.0"; ssl = true; }];
|
||||
enableACME = true;
|
||||
acmeRoot = null;
|
||||
forceSSL = true;
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
local_git_config: ENC[AES256_GCM,data:BulcGoJ85+BA3maqbMewUdaNOl3feaJMq/4yZL8Y8SLOHqzmA/DUO7k=,iv:V7wpSiEQpt7AhKd+MUyGqTsO6YZovpkj+AaqpLnfRM0=,tag:7f3fFzQX3bpjokVPnUKDPQ==,type:str]
|
||||
local_private_env: ENC[AES256_GCM,data:OFcCaE9/hpd6JIoUTTxg0pEFL3rkUE3G+JzP/wjFXpa/AJa2Rr0Kv42Pu+iwgPMWgcpp50ChjVxGvbceNQ==,iv:I2LyWwvdMdE4wKLb3udLVMu3jFsvYR1ruZvaVt9GG7c=,tag:tBPmlNr0iNdLRU1GIRV2mg==,type:str]
|
||||
matrix_secrets_yaml: ENC[AES256_GCM,data:El9razifgbJEaJd9NccOZX1RuZQHRyw6Yg7TY4G8vDtD2w7KxnHUG7bcpIQodh3I1GDjj3gQcHXP6HNs0zS7UjaoGltDt3mHnrhqkvvDW/RgAGrJ9nUsQitB3yhF51PG3IOK1SSbIBk+Pr/wQWbs11ic8i+fGJ6yPcv8k/X5Az8rKmDqDuZh9KUvSB3SQ9J/roOZ+HDb8fv1VmMgZZNGmkOUGZupZkKd+kc2rWrBl5zHTd9XUH6oLk2EwRDufR7T,iv:xCG8xJ7A1bFwK9v1+XJ+vSp/GXCTwdKCL4H/uQ6h4fQ=,tag:Z72quTZvJUMLJ+VJVsTKrw==,type:str]
|
||||
matrix_secrets_yaml: ENC[AES256_GCM,data:6DLtAZIYBlL7iQVS/FBeUEhHyAOFZ5JRNqFBqi59GVh7cP0Hp8RBWxKpWAH2eUPYqUqUGCKrSSH3sJqzV+vasSR62tcltV7+13+q+rZVCZNCEf21EwQ5aaxgR3yG4n3YUPqLsCQB6UnWn0tF5HO0ofjYkya0pQ/nX9TBiiqIcPcd4NovbTtf+S0G0VptqyXAuRvJoKCx42ft9IBfV9tF1QsXLemKYlI10hN5l/MgJHwVbwH5xXR2kLKvnlpAyIoST/uJhswQV9DyK9cnl09ZM9ztcXhveBzv6uDW+pme8lFL99SMtMJcbSzxYW/pt+GJgYd1NiaoPbayWM72jdpH0hf2zWchxnIJIyL3H6EzIjD8BE9GnMP7ujQwBZGNZITRSg==,iv:cDtuOhv2v6CZcwiMM3oqjmajIl7D8Im+LkfarcjTM/w=,tag:e7zRQBYslJqESOGN3c4/aw==,type:str]
|
||||
matrix_homeserver_signing_key: ENC[AES256_GCM,data:+RflNxFfS2w9LbavT7YnCQIhJWI49kN7pOa9/dH0BpDWxKQaLE4ZYBYq0ikAgcHaF3+rBL3f6KxUacw=,iv:6+nZzuxBUwjM74XHCD89YWfyuMRcoIwQlHLiNN4NWdc=,tag:91yigynRz6QdEd4rF7d/9g==,type:str]
|
||||
mqtt_recorder_pass: ENC[AES256_GCM,data:N44nv2mk5zguWXNHdKsxhoKUjiduD1hzsAb6,iv:aLudKuUBTPXgtAF33exELH/PESD0CqoDaydeqdhcmbA=,tag:3lhrqO8jxJiRHWZjWSRa0g==,type:str]
|
||||
owntracks_basic_auth: ENC[AES256_GCM,data:GX1U1uf7+erE+g9GzhXK5ED2QicfcbpRCwpJDw6Zr9X2FtdMYleH5mhLxw==,iv:PflRq+P50+oFf4wv5wwlY6V9bApGuJ3tlYTvJZ5mg0E=,tag:VHBY5qv7rX74DGURsYaWpw==,type:str]
|
||||
tailscale_key: ENC[AES256_GCM,data:Bl00WuIrLvxmt7aNsoXC6G7XFls7waZMzdfo/MsEOZl/i3wHwrjrmgwd3V4GkaJ42UjrC1OLobrkuLves4w=,iv:tlCu0EWgvhvs1ANdtQr7KWHJ2RjpHniUm/rFC4L/MHs=,tag:+8eov9w+SPGZPnjMdrN8gA==,type:str]
|
||||
|
|
@ -19,8 +20,8 @@ sops:
|
|||
WkI4ejBaODI0d0tjWHpTT3VWTXNyaXcKMDtvHN4gcZqBNslyC+NwYW05zgs8QuPV
|
||||
W6EktAz+xu6kx5BJbli5GkUFmj52AtEGIqZ1Sr4a0pKQACC87XcTQA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2024-06-18T01:49:28Z"
|
||||
mac: ENC[AES256_GCM,data:ckwiYte2TP4ufiFkmX2cTuNNae+VizjQ/CM1b1m3Lz3Vo5utd1g82loChQS95s9lr1dmKljuUbklHzg74JbNCeFky4f6od5CEydq/R9dXFTZKBen9cLcdvTVQ0i6E9rZS0t6ohy3wMFyJxw0ss6Zyykd0cqQOPuFBpyHmKFZTVs=,iv:85G4CxlLPD0Ac6KxRYaZ+4H9uj8Co6nmh1bbL6s3MVI=,tag:oyRhgR2Uf7lWFIlH5FKAvw==,type:str]
|
||||
lastmodified: "2024-06-19T01:44:04Z"
|
||||
mac: ENC[AES256_GCM,data:PU4r7DhcG6OgqTCeKBtxyAHDErGH6Eh33sOd+KuImQ74ajgahFNfd4zO27OldZbSERkOYLuFqw7w9+zblV3eaaXRQx97Ek3z4oMtJFv2t9lnNfG0lm45c1eECKV742mzTDi6/bcnQMdn/CaGli8DL45IGGctW+beXRJza0S3wEY=,iv:51WymgQc4OWcannaD4g+fjp4vc75WonWsOMS3Jyz7Xo=,tag:dmNFFgkuKQxy2Snb/HjX/A==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.8.1
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue