System Gen56 @ 2026-09-06-03:53:39 by jonas@harbor

hosts/harbor/configuration.nix

@@ -29,10 +29,6 @@
     owner = config.hive.gotify-instance.user;
     key = "adminPassword";
   };
-  sops.secrets.ketesa-hs-secret = {
-    format = "binary";
-    sopsFile = ../../secrets/harbor/ketesa_hs_ed25519_secret_key;
-  };
   sops.secrets.matrix-hs-secret = {
     format = "binary";
     sopsFile = ../../secrets/harbor/hs_ed25519_secret_key;
@@ -95,7 +91,6 @@
   hive.wg.server.enable = true;
   hive.wg.server.privateKeyFile = config.sops.secrets.wg-priv.path;
   hive.matrix.enable = true;
-  hive.matrix.ketesaHiddenServiceSecret = config.sops.secrets.ketesa-hs-secret.path;
   hive.matrix.hiddenServiceSecret = config.sops.secrets.matrix-hs-secret.path;
   hive.matrix.hiddenServiceHostnameSopsKey = config.sops.secrets.hidden-matrix-hostname.name;
   hive.calibre.enable = true;

modules/services/gitea-instance.nix

@@ -2,6 +2,7 @@
   flake.nixosModules.gitea-instance = {
     config,
     lib,
+    pkgs,
     ...
   }: let
     cfg = config.hive.gitea-instance;
@@ -62,6 +63,7 @@
         locations."/" = {
           proxyPass = "http://unix:/run/gitea/gitea.sock";
           extraConfig = ''
+            client_max_body_size 1G;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -84,13 +86,25 @@
       };
 
       # act_runner
-      services.gitea-actions-runner = lib.mkIf cfg.nativeRunner {
-        instances.nixos-host = {
-          enable = true;
+      services.gitea-actions-runner.instances.nixoshost = {
+        enable = cfg.nativeRunner;
         name = "nixos-host-runner";
         url = "https://${cfg.instanceFQDN}";
         tokenFile = "/var/lib/gitea-registration/nixos-host";
 
+        hostPackages = with pkgs; [
+          bash
+          coreutils
+          curl
+          gawk
+          gitMinimal
+          gnused
+          nix
+          nodejs
+          skopeo
+          wget
+        ];
+
         labels = ["nixos:host"];
 
         settings = {
@@ -99,13 +113,9 @@
           };
         };
       };
-      };
-      systemd.services.gitea-runner-nixos-host = lib.mkIf cfg.nativeRunner {
+      systemd.services.gitea-runner-nixoshost = lib.mkIf cfg.nativeRunner {
         after = ["gitea-runner-gen-token.service"];
         requires = ["gitea-runner-gen-token.service"];
-        serviceConfig.Environment = ''
-          PATH=/run/current-system/sw/bin:/usr/bin:/bin
-        '';
       };
       systemd.services.gitea-runner-gen-token = lib.mkIf cfg.nativeRunner {
         wantedBy = ["multi-user.target"];

modules/services/matrix.nix

@@ -29,14 +29,11 @@
         type = lib.types.str;
         description = "The sops key of the secret containing the hostname of the hidden service";
       };
+
       hiddenServiceSecret = lib.mkOption {
         type = lib.types.path;
         description = "The file containing the hidden service's secret";
       };
-      ketesaHiddenServiceSecret = lib.mkOption {
-        type = lib.types.path;
-        description = "The file containing the ketesa hidden service's secret";
-      };
     };
 
     config = lib.mkIf cfg.enable {
@@ -60,14 +57,8 @@
                 port = cfg.localPort;
               };
             }
-          ];
-        };
-        relay.onionServices.ketesa = {
-          secretKey = cfg.ketesaHiddenServiceSecret;
-          version = 3;
-          map = [
             {
-              port = 80;
+              port = 8080;
               target = {
                 addr = "127.0.0.1";
                 port = cfg.ketesaLocalPort;
@@ -123,6 +114,7 @@
           report_stats = false;
           federation_domain_whitelist = [];
           federation_ip_range_blacklist = ["0.0.0.0/0"];
+          matrix_static_files_file_matrix_support_enabled = true;
         };
 
         extraConfigFiles = [

secrets/harbor/ketesa_hs_ed25519_secret_key

@@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:+BOkCDyX67+vmEPYdGM4im44QiLjFuC6reUU30WeUZRIy5aanyxrTYjFfdEF7g42RpB3zeZjOY5uhtfAnJZLggXz4whbKg8AqMZoBXuL14vniuklO0iubTyMChjQA2mm,iv:A1Lng4Qr0/KXGzrZXbDvwgYJI75ODT3py/oFXNtPQHk=,tag:eMwm4PtjJ6WfrXeX9vT/Jw==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxZ2xGVWY2OUo5dyttOXdv\nZmE5eTkwVkc5TWlPbVU1dDVQOXBzNTVzbzEwCmRBZEhtUm9PMG9zdExJNlhqU1hU\ndVRkM3BqVEVwVXdHOEYrNkpyL1FoTDgKLS0tIExEdHNFbFpWVWhpbWJsMmU1QzNH\nTXJpSmhJSnNpaEVxZ2RiTkExV2l5K0EKb+VLqFeQ2o/C674Rl6bfsOgRPqlW0U4B\nygPzyCpq0pZke0auLdeNYsvlI/+0D1LIVskWmGGClDVIyuCIvtnKZw==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1wf0rq27v0n27zfy0es8ns3n25e2fdt063dgn68tt3f89rgrtu9csq4yhsp"
-			},
-			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwdjdkZVQ2MjMyNllnN0lE\naDhHVThXVmloU2d1UWk0NUl5MTZ3bHVVcFEwClNxdThxVUZmRkZRNlhxaXNkcExT\nU1AxbmJLS21CdVFhdVJmd2hNSW1pRDAKLS0tIHp0Q1Z3SGQ3V3h2eExmQjJyZGF5\nWUo2L1JuVFVnb3k1UktQc1R5R3E5KzQKk8FUGGAUNC2pd+kEYvA5LcB1hQv6nrtR\nNLD1wYap7mE4yBKnAfHUqilPmiPPYqeCZFuQ5v2YJe0TH6nWV0Hq7w==\n-----END AGE ENCRYPTED FILE-----\n",
-				"recipient": "age1expg8vyduf290pz7l4f3mjzvk9f0azfdn48pyjzs3m6p7v4qjq0qwtn36z"
-			}
-		],
-		"lastmodified": "2026-09-03T13:42:49Z",
-		"mac": "ENC[AES256_GCM,data:FY14QBkfIsPVkse+DzLEggDYRpuoqWh3KmTOghQLRSGMFdWJVYfc0ljSrFaiCf3qMojmLGmHStkcQ9fSmlYDJiK7Rk8DGehv76XH5OfWin9tulO6ll3acZqygxLthq2uqsFmfj4/kB6RnB2AAjMqS5NhUup+7vHgzriVEAX0Ti0=,iv:MCbYQy6I69Hfw+J5fkqpHC6ok5ZGt6+WiBTCHOOVZfU=,tag:yWQn8CYmGsbHxqD7ZyZwDQ==,type:str]",
-		"version": "3.13.3"
-	}
-}