Restructure folders, add mail host
The entire file structure has been reorganised into stable and unstable to separate deployments running on either channel. A `mail` host running Simple Nix Mailserver has also been added for testing to see if it's a good alternative to soverin as well as SMTP for other services.
This commit is contained in:
parent
51ba0ae296
commit
90eb0c3708
GPG key ID:
C11123726DBB55A1
78 changed files with 535 additions and 1 deletions
|
|
@ -1,85 +0,0 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./data/secrets/secrets.nix
|
||||
../../common/services/ssh.nix
|
||||
./services/acme.nix
|
||||
./services/coturn.nix
|
||||
./services/nginx.nix
|
||||
./services/restic.nix
|
||||
./services/synapse.nix
|
||||
./services/postgres.nix
|
||||
];
|
||||
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.version = 2;
|
||||
boot.loader.grub.device = "/dev/vda";
|
||||
boot.kernelPackages = pkgs.linuxPackages_5_10;
|
||||
networking = {
|
||||
hostName = "grondahl";
|
||||
useDHCP = false;
|
||||
interfaces = {
|
||||
"ens3" = {
|
||||
ipv4.addresses = [ {
|
||||
address = "107.189.30.157";
|
||||
prefixLength = 24;
|
||||
} ];
|
||||
ipv6.addresses = [ {
|
||||
address = "2605:6400:30:ef32::1";
|
||||
prefixLength = 48;
|
||||
} ];
|
||||
};
|
||||
};
|
||||
defaultGateway = "107.189.30.1";
|
||||
defaultGateway6 = {
|
||||
address = "2605:6400:30::1";
|
||||
interface = "ens3";
|
||||
};
|
||||
nameservers = [ "1.1.1.1" "1.0.0.1" "2606:4700:4700::1111" "2606:4700:4700::1001" ];
|
||||
};
|
||||
|
||||
time.timeZone = "Europe/Copenhagen";
|
||||
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
nix = {
|
||||
autoOptimiseStore = true;
|
||||
trustedUsers = [
|
||||
"root"
|
||||
"@wheel"
|
||||
];
|
||||
};
|
||||
|
||||
|
||||
|
||||
users.users.emelie = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICO4LyBsW1YuUA6i3EL/IZhchSvk7reO4qgRmR/tdQPU emelie@flap"
|
||||
];
|
||||
};
|
||||
|
||||
users.groups.acme.members = [ "nginx" "turnserver" ];
|
||||
users.groups.backup.members = [ "matrix-synapse" "postgres" ];
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
environment.systemPackages = with pkgs; [
|
||||
vim
|
||||
wget
|
||||
htop
|
||||
iotop
|
||||
dig
|
||||
];
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 22 80 443 ];
|
||||
networking.firewall.allowedTCPPortRanges = [ { from = 3478; to = 3479; } { from = 5349; to = 5350; } ];
|
||||
networking.firewall.allowedUDPPortRanges = [ { from = 3478; to = 3479; } { from = 5349; to = 5350; } { from = 49152; to = 49999; } ];
|
||||
|
||||
system.stateVersion = "21.05";
|
||||
|
||||
}
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -1,22 +0,0 @@
|
|||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
(modulesPath + "/profiles/minimal.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sr_mod" "virtio_blk" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/8c343c61-87b5-493c-984c-634f59814f3d";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/2cd0615d-c517-4153-907e-6d8dd9d0e7fc"; }
|
||||
];
|
||||
|
||||
}
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
{ config, ... }:
|
||||
|
||||
{
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
email = "admin+certs@anarkafem.dev";
|
||||
certs."anarkafem.dev" = {
|
||||
extraDomainNames = [ "*.anarkafem.dev" ];
|
||||
dnsProvider = "hurricane";
|
||||
credentialsFile = config.secrets.files.acme_anarkafem_dev.file;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
{ config, ... }:
|
||||
{
|
||||
services.coturn = {
|
||||
enable = true;
|
||||
lt-cred-mech = true;
|
||||
use-auth-secret = true;
|
||||
static-auth-secret = builtins.toString config.secrets.files.turn_shared_secret.file;
|
||||
realm = "turn.anarkafem.dev";
|
||||
relay-ips = [
|
||||
"107.189.30.157"
|
||||
"2605:6400:30:ef32::1"
|
||||
];
|
||||
no-tcp-relay = true;
|
||||
extraConfig = "
|
||||
cipher-list=\"HIGH\"
|
||||
no-loopback-peers
|
||||
no-multicast-peers
|
||||
";
|
||||
secure-stun = true;
|
||||
cert = "/var/lib/acme/anarkafem.dev/fullchain.pem";
|
||||
pkey = "/var/lib/acme/anarkafem.dev/key.pem";
|
||||
min-port = 49152;
|
||||
max-port = 49999;
|
||||
};
|
||||
}
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
{
|
||||
imports = [ ../../../common/services/nginx.nix ];
|
||||
services.nginx.virtualHosts = {
|
||||
"anarkafem.dev" = {
|
||||
useACMEHost = "anarkafem.dev";
|
||||
forceSSL = true;
|
||||
locations."/".root = "/var/www/anarkafem.dev/public";
|
||||
locations."/_matrix/".proxyPass = "http://127.0.0.1:8008";
|
||||
locations."/_synapse".proxyPass = "http://127.0.0.1:8008";
|
||||
locations."/.well-known/matrix/" = {
|
||||
root = "/var/www/matrix/public";
|
||||
extraConfig = ''
|
||||
default_type application/json;
|
||||
add_header Access-Control-Allow-Origin "*";
|
||||
add_header Strict-Transport-Security $hsts_header;
|
||||
add_header Referrer-Policy "origin-when-cross-origin";
|
||||
add_header X-Frame-Options "DENY";
|
||||
add_header X-Content-Type-Options "nosniff";
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,28 +0,0 @@
|
|||
{ pkgs, ... }:
|
||||
{
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_13;
|
||||
initialScript = pkgs.writeText "synapse-init.sql" ''
|
||||
CREATE ROLE synapse;
|
||||
CREATE DATABASE synapse WITH OWNER synapse
|
||||
TEMPLATE template0
|
||||
LC_COLLATE = "C"
|
||||
LC_CTYPE = "C"
|
||||
ENCODING = "UTF8";
|
||||
'';
|
||||
authentication = pkgs.lib.mkOverride 10 ''
|
||||
local all all trust
|
||||
host all all ::1/128 trust
|
||||
'';
|
||||
};
|
||||
|
||||
services.postgresqlBackup = {
|
||||
enable = true;
|
||||
location = "/var/lib/postgresql/backup";
|
||||
databases = [ "synapse" ];
|
||||
startAt = "02:30";
|
||||
compression = "none";
|
||||
};
|
||||
}
|
||||
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
{ config, ... }:
|
||||
{
|
||||
services.restic.backups = {
|
||||
"postgres" = {
|
||||
paths = [ "/var/lib/postgresql/backup" ];
|
||||
repository = "sftp:restic@despondos.nao.sh:/etheria/backup/grondahl/postgres";
|
||||
initialize = true;
|
||||
pruneOpts = [ "--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12" "--keep-yearly 75" ];
|
||||
timerConfig = { "OnCalendar" = "03:15"; };
|
||||
extraOptions = [ "sftp.command='ssh restic@despondos.nao.sh -i ${config.secrets.files.ssh_key.file} -s sftp'" ];
|
||||
passwordFile = builtins.toString config.secrets.files.restic_pass.file;
|
||||
user = "postgres";
|
||||
};
|
||||
"synapse" = {
|
||||
paths = [ "/var/lib/matrix-synapse" ];
|
||||
repository = "sftp:restic@despondos.nao.sh:/etheria/backup/grondahl/synapse";
|
||||
initialize = true;
|
||||
pruneOpts = [ "--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12" "--keep-yearly 75" ];
|
||||
timerConfig = { "OnCalendar" = "03:45"; };
|
||||
extraOptions = [ "sftp.command='ssh restic@despondos.nao.sh -i ${config.secrets.files.ssh_key.file} -s sftp'" ];
|
||||
passwordFile = builtins.toString config.secrets.files.restic_pass.file;
|
||||
user = "matrix-synapse";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
|
@ -1,72 +0,0 @@
|
|||
{ config, ... }:
|
||||
|
||||
{
|
||||
services.matrix-synapse = {
|
||||
enable = true;
|
||||
server_name = "anarkafem.dev";
|
||||
enable_registration = false;
|
||||
registration_shared_secret = builtins.toString config.secrets.files.synapse_registration_shared_secret.file;
|
||||
turn_shared_secret = builtins.toString config.secrets.files.turn_shared_secret.file;
|
||||
max_upload_size = "20M";
|
||||
database_type = "psycopg2";
|
||||
database_user = "synapse";
|
||||
database_name = "synapse";
|
||||
turn_uris = [
|
||||
"turn:turn.anarkafem.dev:3478?transport=udp"
|
||||
"turn:turn.anarkafem.dev:3478?transport=tcp"
|
||||
"turn:turn.anarkafem.dev:3479?transport=udp"
|
||||
"turn:turn.anarkafem.dev:3479?transport=tcp"
|
||||
"turns:turn.anarkafem.dev:5349?transport=udp"
|
||||
"turns:turn.anarkafem.dev:5349?transport=tcp"
|
||||
"turns:turn.anarkafem.dev:5350?transport=udp"
|
||||
"turns:turn.anarkafem.dev:5350?transport=tcp"
|
||||
];
|
||||
report_stats = false;
|
||||
withJemalloc = true;
|
||||
servers = { "anarkafem.dev" = {}; };
|
||||
extraConfig = ''
|
||||
auto_join_rooms:
|
||||
- "#suf-aalborg:anarkafem.dev"
|
||||
'';
|
||||
logConfig = ''
|
||||
version: 1
|
||||
|
||||
formatters:
|
||||
precise:
|
||||
format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
|
||||
|
||||
handlers:
|
||||
console:
|
||||
class: logging.StreamHandler
|
||||
formatter: precise
|
||||
|
||||
loggers:
|
||||
synapse.storage.SQL:
|
||||
# beware: increasing this to DEBUG will make synapse log sensitive
|
||||
# information such as access tokens.
|
||||
level: INFO
|
||||
|
||||
root:
|
||||
level: INFO
|
||||
handlers: [console]
|
||||
|
||||
disable_existing_loggers: false
|
||||
'';
|
||||
listeners = [
|
||||
{
|
||||
port = 8008;
|
||||
bind_address = "127.0.0.1";
|
||||
type = "http";
|
||||
tls = false;
|
||||
x_forwarded = true;
|
||||
resources = [
|
||||
{
|
||||
names = [ "client" "federation" ];
|
||||
compress = false;
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue