From beb426efcb4d27201e0061c313b83175d09bf1c3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jonas=20R=C3=B6ger?= Date: Fri, 17 Jul 2026 23:59:59 +0200 Subject: [PATCH] System Gen171 @ 2026-07-17-23:59:59 by jonas@monolith --- .sops.yaml | 10 +-- hosts/harbor/configuration.nix | 16 ++++ hosts/harbor/default.nix | 1 + modules/services/matrix.nix | 113 +++++++++++++++++++++++++++ secrets/harbor/hidden-matrix.yaml | 26 ++++++ secrets/harbor/hs_ed25519_secret_key | 19 +++++ 6 files changed, 180 insertions(+), 5 deletions(-) create mode 100644 modules/services/matrix.nix create mode 100644 secrets/harbor/hidden-matrix.yaml create mode 100644 secrets/harbor/hs_ed25519_secret_key diff --git a/.sops.yaml b/.sops.yaml index 4cbeda0..aa2e8e8 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -4,7 +4,7 @@ keys: - &comfy-station age1xkmnvzus6fhundn4c0f6hyuwrj0f0m7x3hxtuhnez6cecr6m032qalw308 - &monolith age1clh2c489j7mx94aqr44u6k2cx5axqme9rlshqu9l2mcynluwhq6qwn0sv0 creation_rules: - - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$ + - path_regex: secrets/[^/]+$ key_groups: - age: - *jonas @@ -12,24 +12,24 @@ creation_rules: - *comfy-station - *monolith - - path_regex: secrets/jonas/[^/]+\.(yaml|json|env|ini)$ + - path_regex: secrets/jonas/[^/]+$ key_groups: - age: - *jonas - - path_regex: secrets/comfy-station/[^/]+\.(yaml|json|env|ini)$ + - path_regex: secrets/comfy-station/[^/]+$ key_groups: - age: - *comfy-station - *jonas - - path_regex: secrets/harbor/[^/]+\.(yaml|json|env|ini)$ + - path_regex: secrets/harbor/[^/]+$ key_groups: - age: - *harbor - *jonas - - path_regex: secrets/monolith/[^/]+\.(yaml|json|env|ini)$ + - path_regex: secrets/monolith/[^/]+$ key_groups: - age: - *monolith diff --git a/hosts/harbor/configuration.nix b/hosts/harbor/configuration.nix index cd23fd7..b29b9c8 100644 --- a/hosts/harbor/configuration.nix +++ b/hosts/harbor/configuration.nix @@ -29,6 +29,18 @@ owner = config.hive.gotify-instance.user; key = "adminPassword"; }; + sops.secrets.matrix-hs-secret = { + format = "binary"; + sopsFile = ../../secrets/harbor/hs_ed25519_secret_key; + }; + sops.secrets.hidden-matrix-hostname = { + sopsFile = ../../secrets/harbor/hidden-matrix.yaml; + key = "hostname"; + }; + sops.secrets.hidden-matrix-registration-secret = { + sopsFile = ../../secrets/harbor/hidden-matrix.yaml; + key = "registration_secret"; + }; # gc settings and binary caches nix = { @@ -82,6 +94,10 @@ hive.borg-server.repositories.comfy-station.ssh_public_key = builtins.readFile (../../static/keys + "/borg-jonas@comfy-station.pub"); hive.wg.server.enable = true; hive.wg.server.privateKeyFile = config.sops.secrets.wg-priv.path; + hive.matrix.enable = true; + hive.matrix.hiddenServiceSecret = config.sops.secrets.matrix-hs-secret.path; + hive.matrix.hiddenServiceHostnameSopsKey = config.sops.secrets.hidden-matrix-hostname.name; + hive.matrix.registrationSecretSopsKey = config.sops.secrets.hidden-matrix-registration-secret.name; # This value determines the NixOS release from which the default # settings for stateful data, like file locations and database versions diff --git a/hosts/harbor/default.nix b/hosts/harbor/default.nix index 4d02ca7..739fa5b 100644 --- a/hosts/harbor/default.nix +++ b/hosts/harbor/default.nix @@ -20,6 +20,7 @@ self.nixosModules.minecraft-server self.nixosModules.borg-server self.nixosModules.wireguard-server + self.nixosModules.matrix ]; }; } diff --git a/modules/services/matrix.nix b/modules/services/matrix.nix new file mode 100644 index 0000000..ebc2e21 --- /dev/null +++ b/modules/services/matrix.nix @@ -0,0 +1,113 @@ +{ + flake.nixosModules.matrix = { + config, + lib, + pkgs, + ... + }: let + cfg = config.hive.matrix; + in { + options.hive.matrix = { + enable = lib.mkEnableOption "Enable matrix server (synapse)"; + + localPort = lib.mkOption { + type = lib.types.int; + default = 8474; + description = "The internal port of the synapse server"; + }; + + registrationSecretSopsKey = lib.mkOption { + type = lib.types.str; + description = "The sops key of the secret containing the registration secret"; + }; + + hiddenServiceHostnameSopsKey = lib.mkOption { + type = lib.types.str; + description = "The sops key of the secret containing the hostname of the hidden service"; + }; + hiddenServiceSecret = lib.mkOption { + type = lib.types.path; + description = "The file containing the hidden service's secret"; + }; + instanceFQDN = lib.mkOption { + type = lib.types.str; + example = "nextcloud.example.com"; + description = "Fully qualified domain name of the Nextcloud instance"; + }; + }; + + config = lib.mkIf cfg.enable { + # Database setup + services.postgresql = { + enable = true; + initialScript = pkgs.writeText "matrix-synapse-initScript" '' + CREATE ROLE "matrix-synapse"; + CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse" + TEMPLATE template0 + LC_COLLATE = "C" + LC_CTYPE = "C"; + ''; + }; + + # Hidden service + services.tor = { + enable = true; + enableGeoIP = false; + relay.onionServices.matrix = { + secretKey = cfg.hiddenServiceSecret; + version = 3; + map = [ + { + port = 80; + target = { + addr = "[::1]"; + port = cfg.localPort; + }; + } + ]; + }; + }; + + # Secret hostname for matrix-synapse + sops.templates."hidden-matrix-synapse".owner = "matrix-synapse"; + sops.templates."hidden-matrix-synapse".content = '' + server_name: "${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}" + public_baseurl: "http://${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}" + registration_shared_secret: "${config.sops.placeholder.${cfg.registrationSecretSopsKey}}" + ''; + + # Synapse + services.matrix-synapse = { + enable = true; + settings.listeners = [ + { + port = cfg.localPort; + bind_addresses = ["::1"]; + type = "http"; + tls = false; + x_forwarded = false; + resources = [ + { + names = [ + "client" + ]; + compress = false; + } + ]; + } + ]; + settings = { + enable_registration = false; + registration_requires_token = true; + report_stats = false; + federation_domain_whitelist = []; + federation_ip_range_blacklist = ["0.0.0.0/0"]; + }; + + extraConfigFiles = [ + config.sops.templates."hidden-matrix-synapse".path + ]; + }; + }; + }; +} diff --git a/secrets/harbor/hidden-matrix.yaml b/secrets/harbor/hidden-matrix.yaml new file mode 100644 index 0000000..358756a --- /dev/null +++ b/secrets/harbor/hidden-matrix.yaml @@ -0,0 +1,26 @@ +hostname: ENC[AES256_GCM,data:XRWNaOW738h9s1ppu6mopw6fEdrO7FoH0Tg3sqxFacMGvwIUonCaTm0dKtuqaToq8PNVlOE3Fkg74bMnzJ4=,iv:7iRalbTlrpoGXkNBm+StetvMBQyxtT0+ZYhMyBmipts=,tag:HQqnBP2Wj6I3bZTsoc27Yw==,type:str] +registration_secret: ENC[AES256_GCM,data:jPiq+n3c2o4lC1AnA6E=,iv:kTjRl3ipV8WSEXqLUgveUQtxq1QWeNIUN17o2xGS3dI=,tag:He2zK/jXRi4GOWisw4yjSA==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaTWJ6djJqU0FtdUkvL2d6 + SWt3NHBSUS9jQmlJVUVpaUZ3RGVJS0NCT2t3CkhvZzc3cUIyV3ZlT1ZVMUhFbDRE + RWtGTmxFQllnOTdJQ3ppNCtNcG9qbmcKLS0tIEdQNGlpQzBVU2c4alVrTUlmeXNZ + enRwUWl0Mzd6bmtRaDhkSlN0cGVRVG8KpJqu51CIRNK/nVLnUoFhPSyEWdW0TdqS + EUbDt71zKUEg4jHe+RqR9ThT2PSY3j03ZtkCYJ+aDIftWJrmpisUew== + -----END AGE ENCRYPTED FILE----- + recipient: age1wf0rq27v0n27zfy0es8ns3n25e2fdt063dgn68tt3f89rgrtu9csq4yhsp + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2TWZxVDEzckNjMTRrNXpF + RGtMUmVVMjdjbVNzWHBHc21aV1RQZGExSmlrCnNpbXZLUHhnaWxNbFNyUHVnM05F + cWVYSFhGbUF2ejlGRjNvRWp6SFFQMncKLS0tIGt2VXhmcGFGOTNlSzdCM3Y3NFNr + NStxbkN4VitSOUJwN3BxWjljM1QvUWMK4dgk/luLWp9qDGLOp9vy/xJco/dLvepz + SSXKtuT3UbbyWqjV6AJ/slzsVWbBQCnf4fkJKpBnlCiqprjaFehXFg== + -----END AGE ENCRYPTED FILE----- + recipient: age1expg8vyduf290pz7l4f3mjzvk9f0azfdn48pyjzs3m6p7v4qjq0qwtn36z + lastmodified: "2026-07-17T21:59:19Z" + mac: ENC[AES256_GCM,data:hZ14dzYNrXLr2FK7LPZoggYT36n0kD2gX1Nd3OM256+uJcvLV1jyqhGqeg+xWLVWC4R31YZlhHWQwA6ZcGrzgk/ograarGEgE1pDkG74+02fRyqcvC6SxvF8I1hq2FxDKzmAK89lXh7GTjiFmo9nqrkgA1aDTnogW0FHoJhVB+4=,iv:3cPMHQmpc+Lfu2GpiGKn9H9y1DNo0dhGfr8M5zzXvl8=,tag:6uhGRnBXN7Mnw6M1iULZCQ==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/secrets/harbor/hs_ed25519_secret_key b/secrets/harbor/hs_ed25519_secret_key new file mode 100644 index 0000000..e78e122 --- /dev/null +++ b/secrets/harbor/hs_ed25519_secret_key @@ -0,0 +1,19 @@ +{ + "data": "ENC[AES256_GCM,data:1OXbkYAQrKgB49ex8UUOJXSirXD0Pjbm+IvUUniYLrCU8mItyuEvyuU3KNifn4ygkcm2pJ/oVbHpNtUvikxUWgrAVbc2t1U0GaEpTEEz/Si9g4uliJov4Qke+RZtz4Mh,iv:eReke55jV8N44YgNQEQffLPrk2+0DK0T9knPAFofW5Y=,tag:/653TVicd4StzEanhH9vFw==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvSk5XM1dIVXZvOHFzbzRo\nSzcvZEtWMGZtaTIxa1hRbUZXVFRodC9JRkdBCkJ3V0t4R2N4bEdTUFNrNU9vUGs1\nVjRGZ1VzZnBBYUpIL1JXcmNtNEhWM0UKLS0tIG5XbjdobkFrMGZXaHlaRFdwMWo0\nU21MNnlNbkk1TVcwbEtsUC81Q1JBbFUKkgAiQCIscxuuIG+7Aplx67L4G1F4pMhX\n3UUnR6uWlrhhYS84K/oRb5h7tqHcK2ZPNRQtf66+QYLeYnoQkw2fAA==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1wf0rq27v0n27zfy0es8ns3n25e2fdt063dgn68tt3f89rgrtu9csq4yhsp" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKRFdkTmlZc3RqVWwvMXJE\nZHVhNzNRWE1Wc3Y0M0VjR1M4R1pITlBBRTJrCllETlFiaEJGcHN0WW1jTnVldTZl\nV2ZxbUtBdytFeDFocXhVZ1Z3M01TWW8KLS0tIEpyeTJhMy95NnNaU3Fhbm91TVpu\nZjNjdmQwWGJ6YUlCRXh6Uk54eHlPUGMK5RGFrteIcon1CpVWddI0jftU3Q/SXGdz\nw9DwqtwkFTQpvRl2RGSJToipGwy91Pn3vubF+U77xEcPvtAhW8cIcQ==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1expg8vyduf290pz7l4f3mjzvk9f0azfdn48pyjzs3m6p7v4qjq0qwtn36z" + } + ], + "lastmodified": "2026-07-17T20:23:08Z", + "mac": "ENC[AES256_GCM,data:vwz/UOSbE3p57HzYx5Im2Zgq/W7qHh9SSX10k6sIzJJQHIKTSFJaA8qwYJIStz8ULyBw0CDcROun+1RBhdpUCBDNl/fVcXHVgk39ubBbLJji0z84eW1qZmg9/WAW7y/nAid1SH5TU95OwC1KCUxSLzDdUNuO2YdRwvQ10ST8QJo=,iv:9yJ0yP7SoNhuFJ9LR1BXileQTYNus/FwSKLZETXY8Hg=,tag:S8tXzl6DhN/u6wMjIsr13w==,type:str]", + "unencrypted_suffix": "_unencrypted", + "version": "3.13.2" + } +}