System Gen171 @ 2026-07-17-23:59:59 by jonas@monolith
This commit is contained in:
+5
-5
@@ -4,7 +4,7 @@ keys:
|
||||
- &comfy-station age1xkmnvzus6fhundn4c0f6hyuwrj0f0m7x3hxtuhnez6cecr6m032qalw308
|
||||
- &monolith age1clh2c489j7mx94aqr44u6k2cx5axqme9rlshqu9l2mcynluwhq6qwn0sv0
|
||||
creation_rules:
|
||||
- path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
|
||||
- path_regex: secrets/[^/]+$
|
||||
key_groups:
|
||||
- age:
|
||||
- *jonas
|
||||
@@ -12,24 +12,24 @@ creation_rules:
|
||||
- *comfy-station
|
||||
- *monolith
|
||||
|
||||
- path_regex: secrets/jonas/[^/]+\.(yaml|json|env|ini)$
|
||||
- path_regex: secrets/jonas/[^/]+$
|
||||
key_groups:
|
||||
- age:
|
||||
- *jonas
|
||||
|
||||
- path_regex: secrets/comfy-station/[^/]+\.(yaml|json|env|ini)$
|
||||
- path_regex: secrets/comfy-station/[^/]+$
|
||||
key_groups:
|
||||
- age:
|
||||
- *comfy-station
|
||||
- *jonas
|
||||
|
||||
- path_regex: secrets/harbor/[^/]+\.(yaml|json|env|ini)$
|
||||
- path_regex: secrets/harbor/[^/]+$
|
||||
key_groups:
|
||||
- age:
|
||||
- *harbor
|
||||
- *jonas
|
||||
|
||||
- path_regex: secrets/monolith/[^/]+\.(yaml|json|env|ini)$
|
||||
- path_regex: secrets/monolith/[^/]+$
|
||||
key_groups:
|
||||
- age:
|
||||
- *monolith
|
||||
|
||||
@@ -29,6 +29,18 @@
|
||||
owner = config.hive.gotify-instance.user;
|
||||
key = "adminPassword";
|
||||
};
|
||||
sops.secrets.matrix-hs-secret = {
|
||||
format = "binary";
|
||||
sopsFile = ../../secrets/harbor/hs_ed25519_secret_key;
|
||||
};
|
||||
sops.secrets.hidden-matrix-hostname = {
|
||||
sopsFile = ../../secrets/harbor/hidden-matrix.yaml;
|
||||
key = "hostname";
|
||||
};
|
||||
sops.secrets.hidden-matrix-registration-secret = {
|
||||
sopsFile = ../../secrets/harbor/hidden-matrix.yaml;
|
||||
key = "registration_secret";
|
||||
};
|
||||
|
||||
# gc settings and binary caches
|
||||
nix = {
|
||||
@@ -82,6 +94,10 @@
|
||||
hive.borg-server.repositories.comfy-station.ssh_public_key = builtins.readFile (../../static/keys + "/borg-jonas@comfy-station.pub");
|
||||
hive.wg.server.enable = true;
|
||||
hive.wg.server.privateKeyFile = config.sops.secrets.wg-priv.path;
|
||||
hive.matrix.enable = true;
|
||||
hive.matrix.hiddenServiceSecret = config.sops.secrets.matrix-hs-secret.path;
|
||||
hive.matrix.hiddenServiceHostnameSopsKey = config.sops.secrets.hidden-matrix-hostname.name;
|
||||
hive.matrix.registrationSecretSopsKey = config.sops.secrets.hidden-matrix-registration-secret.name;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
|
||||
@@ -20,6 +20,7 @@
|
||||
self.nixosModules.minecraft-server
|
||||
self.nixosModules.borg-server
|
||||
self.nixosModules.wireguard-server
|
||||
self.nixosModules.matrix
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -0,0 +1,113 @@
|
||||
{
|
||||
flake.nixosModules.matrix = {
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
cfg = config.hive.matrix;
|
||||
in {
|
||||
options.hive.matrix = {
|
||||
enable = lib.mkEnableOption "Enable matrix server (synapse)";
|
||||
|
||||
localPort = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 8474;
|
||||
description = "The internal port of the synapse server";
|
||||
};
|
||||
|
||||
registrationSecretSopsKey = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "The sops key of the secret containing the registration secret";
|
||||
};
|
||||
|
||||
hiddenServiceHostnameSopsKey = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "The sops key of the secret containing the hostname of the hidden service";
|
||||
};
|
||||
hiddenServiceSecret = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "The file containing the hidden service's secret";
|
||||
};
|
||||
instanceFQDN = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
example = "nextcloud.example.com";
|
||||
description = "Fully qualified domain name of the Nextcloud instance";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# Database setup
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
initialScript = pkgs.writeText "matrix-synapse-initScript" ''
|
||||
CREATE ROLE "matrix-synapse";
|
||||
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
|
||||
TEMPLATE template0
|
||||
LC_COLLATE = "C"
|
||||
LC_CTYPE = "C";
|
||||
'';
|
||||
};
|
||||
|
||||
# Hidden service
|
||||
services.tor = {
|
||||
enable = true;
|
||||
enableGeoIP = false;
|
||||
relay.onionServices.matrix = {
|
||||
secretKey = cfg.hiddenServiceSecret;
|
||||
version = 3;
|
||||
map = [
|
||||
{
|
||||
port = 80;
|
||||
target = {
|
||||
addr = "[::1]";
|
||||
port = cfg.localPort;
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# Secret hostname for matrix-synapse
|
||||
sops.templates."hidden-matrix-synapse".owner = "matrix-synapse";
|
||||
sops.templates."hidden-matrix-synapse".content = ''
|
||||
server_name: "${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}"
|
||||
public_baseurl: "http://${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}"
|
||||
registration_shared_secret: "${config.sops.placeholder.${cfg.registrationSecretSopsKey}}"
|
||||
'';
|
||||
|
||||
# Synapse
|
||||
services.matrix-synapse = {
|
||||
enable = true;
|
||||
settings.listeners = [
|
||||
{
|
||||
port = cfg.localPort;
|
||||
bind_addresses = ["::1"];
|
||||
type = "http";
|
||||
tls = false;
|
||||
x_forwarded = false;
|
||||
resources = [
|
||||
{
|
||||
names = [
|
||||
"client"
|
||||
];
|
||||
compress = false;
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
settings = {
|
||||
enable_registration = false;
|
||||
registration_requires_token = true;
|
||||
report_stats = false;
|
||||
federation_domain_whitelist = [];
|
||||
federation_ip_range_blacklist = ["0.0.0.0/0"];
|
||||
};
|
||||
|
||||
extraConfigFiles = [
|
||||
config.sops.templates."hidden-matrix-synapse".path
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,26 @@
|
||||
hostname: ENC[AES256_GCM,data:XRWNaOW738h9s1ppu6mopw6fEdrO7FoH0Tg3sqxFacMGvwIUonCaTm0dKtuqaToq8PNVlOE3Fkg74bMnzJ4=,iv:7iRalbTlrpoGXkNBm+StetvMBQyxtT0+ZYhMyBmipts=,tag:HQqnBP2Wj6I3bZTsoc27Yw==,type:str]
|
||||
registration_secret: ENC[AES256_GCM,data:jPiq+n3c2o4lC1AnA6E=,iv:kTjRl3ipV8WSEXqLUgveUQtxq1QWeNIUN17o2xGS3dI=,tag:He2zK/jXRi4GOWisw4yjSA==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaTWJ6djJqU0FtdUkvL2d6
|
||||
SWt3NHBSUS9jQmlJVUVpaUZ3RGVJS0NCT2t3CkhvZzc3cUIyV3ZlT1ZVMUhFbDRE
|
||||
RWtGTmxFQllnOTdJQ3ppNCtNcG9qbmcKLS0tIEdQNGlpQzBVU2c4alVrTUlmeXNZ
|
||||
enRwUWl0Mzd6bmtRaDhkSlN0cGVRVG8KpJqu51CIRNK/nVLnUoFhPSyEWdW0TdqS
|
||||
EUbDt71zKUEg4jHe+RqR9ThT2PSY3j03ZtkCYJ+aDIftWJrmpisUew==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1wf0rq27v0n27zfy0es8ns3n25e2fdt063dgn68tt3f89rgrtu9csq4yhsp
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2TWZxVDEzckNjMTRrNXpF
|
||||
RGtMUmVVMjdjbVNzWHBHc21aV1RQZGExSmlrCnNpbXZLUHhnaWxNbFNyUHVnM05F
|
||||
cWVYSFhGbUF2ejlGRjNvRWp6SFFQMncKLS0tIGt2VXhmcGFGOTNlSzdCM3Y3NFNr
|
||||
NStxbkN4VitSOUJwN3BxWjljM1QvUWMK4dgk/luLWp9qDGLOp9vy/xJco/dLvepz
|
||||
SSXKtuT3UbbyWqjV6AJ/slzsVWbBQCnf4fkJKpBnlCiqprjaFehXFg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1expg8vyduf290pz7l4f3mjzvk9f0azfdn48pyjzs3m6p7v4qjq0qwtn36z
|
||||
lastmodified: "2026-07-17T21:59:19Z"
|
||||
mac: ENC[AES256_GCM,data:hZ14dzYNrXLr2FK7LPZoggYT36n0kD2gX1Nd3OM256+uJcvLV1jyqhGqeg+xWLVWC4R31YZlhHWQwA6ZcGrzgk/ograarGEgE1pDkG74+02fRyqcvC6SxvF8I1hq2FxDKzmAK89lXh7GTjiFmo9nqrkgA1aDTnogW0FHoJhVB+4=,iv:3cPMHQmpc+Lfu2GpiGKn9H9y1DNo0dhGfr8M5zzXvl8=,tag:6uhGRnBXN7Mnw6M1iULZCQ==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.2
|
||||
@@ -0,0 +1,19 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:1OXbkYAQrKgB49ex8UUOJXSirXD0Pjbm+IvUUniYLrCU8mItyuEvyuU3KNifn4ygkcm2pJ/oVbHpNtUvikxUWgrAVbc2t1U0GaEpTEEz/Si9g4uliJov4Qke+RZtz4Mh,iv:eReke55jV8N44YgNQEQffLPrk2+0DK0T9knPAFofW5Y=,tag:/653TVicd4StzEanhH9vFw==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvSk5XM1dIVXZvOHFzbzRo\nSzcvZEtWMGZtaTIxa1hRbUZXVFRodC9JRkdBCkJ3V0t4R2N4bEdTUFNrNU9vUGs1\nVjRGZ1VzZnBBYUpIL1JXcmNtNEhWM0UKLS0tIG5XbjdobkFrMGZXaHlaRFdwMWo0\nU21MNnlNbkk1TVcwbEtsUC81Q1JBbFUKkgAiQCIscxuuIG+7Aplx67L4G1F4pMhX\n3UUnR6uWlrhhYS84K/oRb5h7tqHcK2ZPNRQtf66+QYLeYnoQkw2fAA==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1wf0rq27v0n27zfy0es8ns3n25e2fdt063dgn68tt3f89rgrtu9csq4yhsp"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKRFdkTmlZc3RqVWwvMXJE\nZHVhNzNRWE1Wc3Y0M0VjR1M4R1pITlBBRTJrCllETlFiaEJGcHN0WW1jTnVldTZl\nV2ZxbUtBdytFeDFocXhVZ1Z3M01TWW8KLS0tIEpyeTJhMy95NnNaU3Fhbm91TVpu\nZjNjdmQwWGJ6YUlCRXh6Uk54eHlPUGMK5RGFrteIcon1CpVWddI0jftU3Q/SXGdz\nw9DwqtwkFTQpvRl2RGSJToipGwy91Pn3vubF+U77xEcPvtAhW8cIcQ==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1expg8vyduf290pz7l4f3mjzvk9f0azfdn48pyjzs3m6p7v4qjq0qwtn36z"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-17T20:23:08Z",
|
||||
"mac": "ENC[AES256_GCM,data:vwz/UOSbE3p57HzYx5Im2Zgq/W7qHh9SSX10k6sIzJJQHIKTSFJaA8qwYJIStz8ULyBw0CDcROun+1RBhdpUCBDNl/fVcXHVgk39ubBbLJji0z84eW1qZmg9/WAW7y/nAid1SH5TU95OwC1KCUxSLzDdUNuO2YdRwvQ10ST8QJo=,iv:9yJ0yP7SoNhuFJ9LR1BXileQTYNus/FwSKLZETXY8Hg=,tag:S8tXzl6DhN/u6wMjIsr13w==,type:str]",
|
||||
"unencrypted_suffix": "_unencrypted",
|
||||
"version": "3.13.2"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user