Added Impermanence and Disko setup to Proxy

flake.nix

@@ -271,6 +271,10 @@
         install-cyper-controller = mkInstall {
           hostName = "cyper-controller";
         };
+        install-cyper-proxy = mkInstall {
+          hostName = "cyper-proxy";
+          target = ""; # KVM console IP
+        };
       };
     };
 }

hosts/cyper-proxy/configuration.nix

@@ -1,6 +1,7 @@
 { ... }:
 {
   imports = [
+    ./disko.nix
     ./hardware-configuration.nix
     ../../nixos/roles/nginx.nix
     #    ../../nixos/roles/jitsi.nix

hosts/cyper-proxy/disko.nix

@@ -0,0 +1,65 @@
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/vda";
+    content = {
+      type = "gpt";
+      partitions = {
+        boot = {
+          size = "1M";
+          type = "EF02";
+        };
+        ESP = {
+          size = "512M";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [
+              "fmask=0022"
+              "dmask=0022"
+            ];
+            extraArgs = [
+              "-n"
+              "NIXBOOT"
+            ];
+          };
+        };
+        swap = {
+          size = "4G";
+          content = {
+            type = "swap";
+            extraArgs = [
+              "-L"
+              "NIXSWAP"
+            ];
+          };
+        };
+        nix = {
+          size = "40G";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/nix";
+            extraArgs = [
+              "-L"
+              "NIXSTORE"
+            ];
+          };
+        };
+        persist = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/persist";
+            extraArgs = [
+              "-L"
+              "NIXPERSIST"
+            ];
+          };
+        };
+      };
+    };
+  };
+}

hosts/cyper-proxy/hardware-configuration.nix

@@ -5,11 +5,6 @@
   ];
 
   boot = {
-    loader.grub = {
-      enable = true;
-      device = "/dev/vda";
-    };
-
     initrd = {
       availableKernelModules = [
         "ata_piix"
@@ -27,21 +22,18 @@
 
   fileSystems = {
     "/" = {
-      device = "/dev/disk/by-label/NIXROOT";
+      device = "none";
-      fsType = "ext4";
+      fsType = "tmpfs";
-    };
-
-    "/boot" = {
-      device = "/dev/disk/by-label/NIXBOOT";
-      fsType = "vfat";
       options = [
-        "fmask=0022"
+        "defaults"
-        "dmask=0022"
+        "size=2G"
+        "mode=755"
       ];
     };
   };
 
-  swapDevices = [ ];
+  fileSystems."/nix".neededForBoot = true;
+  fileSystems."/persist".neededForBoot = true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

nixos/roles/matrix/clients.nix

@@ -149,6 +149,15 @@ let
 
 in
 {
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/containers";
+      user = "root";
+      group = "root";
+      mode = "0700";
+    }
+  ];
+
   services.nginx.virtualHosts = {
     "cinny.cyperpunk.de" = {
       forceSSL = true;

nixos/roles/matrix/discord-bridge.nix

@@ -15,6 +15,15 @@
     };
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/mautrix-discord";
+      user = "mautrix-discord";
+      group = "mautrix-discord";
+      mode = "0750";
+    }
+  ];
+
   systemd = {
     services = {
       mautrix-discord-env = {

nixos/roles/matrix/maubot.nix

@@ -1,9 +1,20 @@
 { config, pkgs, ... }:
 {
-  environment.systemPackages = with pkgs; [
+  environment = {
+    systemPackages = with pkgs; [
       maubot
     ];
 
+    persistence."/persist".directories = [
+      {
+        directory = "/var/lib/maubot";
+        user = "maubot";
+        group = "maubot";
+        mode = "0750";
+      }
+    ];
+  };
+
   services = {
     maubot = {
       enable = true;

nixos/roles/matrix/meta-bridge.nix

@@ -19,6 +19,21 @@
     };
   };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/mautrix-meta-facebook";
+      user = "mautrix-meta-facebook";
+      group = "mautrix-meta";
+      mode = "0750";
+    }
+    {
+      directory = "/var/lib/mautrix-meta-instagram";
+      user = "mautrix-meta-instagram";
+      group = "mautrix-meta";
+      mode = "0750";
+    }
+  ];
+
   systemd.services = {
     mautrix-meta-facebook-env = {
       before = [ "mautrix-meta-facebook-registration.service" ];

nixos/roles/matrix/mjolnir.nix

@@ -2,6 +2,15 @@
 {
   sops.secrets.mjolnir_access_token = { };
 
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/private";
+      user = "root";
+      group = "root";
+      mode = "0700";
+    }
+  ];
+
   services.draupnir = {
     enable = true;
     secrets.accessToken = config.sops.secrets.mjolnir_access_token.path;
@@ -11,7 +20,3 @@
     };
   };
 }
-
-#curl -X POST https://matrix.cyperpunk.de/_matrix/client/v3/login \
-#  -H "Content-Type: application/json" \
-#  -d '{"type":"m.login.password ","user":"mjolnir","password":"i318HXBRkt)Lh$nOPwq#6n9z&<W[XJ&2c4$Zf>7jV}-uQCE{<plwk;LZ)10*N<~1"}'

nixos/roles/matrix/synapse.nix

@@ -49,15 +49,30 @@ in
     };
   };
 
-  systemd.tmpfiles.rules = [
+  environment.persistence."/persist".directories = [
-    "d /var/www/matrix            0755 nginx nginx -"
+    {
-    "L+ /var/www/matrix/index.html   0644 nginx nginx - ${matrixIndexHtml}"
+      directory = "/var/lib/matrix-synapse";
-    "L+ /var/www/matrix/register.php 0644 nginx nginx - ${matrixRegisterPhp}"
+      user = "matrix-synapse";
-    "L+ /var/www/matrix/style.css  0644 nginx nginx - ${matrixStyleCss}"
+      group = "matrix-synapse";
-    "L+ /var/www/matrix/app.js     0644 nginx nginx - ${matrixAppJs}"
+      mode = "0700";
+    }
+    {
+      directory = "/var/lib/postgresql";
+      user = "postgres";
+      group = "postgres";
+      mode = "0750";
+    }
+    {
+      directory = "/var/lib/acme";
+      user = "acme";
+      group = "acme";
+      mode = "0755";
+    }
   ];
 
-  services.phpfpm.pools.matrix = {
+  services = {
+
+    phpfpm.pools.matrix = {
       user = "nginx";
       group = "nginx";
       settings = {
@@ -72,7 +87,6 @@ in
       phpPackage = pkgs.php.withExtensions ({ enabled, all }: enabled ++ [ all.curl ]);
     };
 
-  services = {
     matrix-synapse = {
       enable = true;
       settings = {
@@ -237,9 +251,10 @@ in
         max_wal_senders = 5;
         wal_keep_size = "512MB";
         listen_addresses = lib.mkForce "127.0.0.1,100.109.10.91";
+        ssl = true;
       };
       authentication = lib.mkAfter ''
-        host replication replicator 100.0.0.0/8 scram-sha-256
+        hostssl replication replicator 100.0.0.0/8 scram-sha-256
       '';
     };
 
@@ -251,7 +266,8 @@ in
     };
   };
 
-  systemd.services = {
+  systemd = {
+    services = {
       matrix-synapse.serviceConfig.ReadOnlyPaths = [
         "/var/lib/mautrix-discord"
         "/var/lib/mautrix-whatsapp"
@@ -262,4 +278,14 @@ in
           "ALTER ROLE replicator WITH PASSWORD '$PG_PASS';"
       '';
     };
+
+    tmpfiles.rules = [
+      "d /var/www/matrix            0755 nginx nginx -"
+      "L+ /var/www/matrix/index.html   0644 nginx nginx - ${matrixIndexHtml}"
+      "L+ /var/www/matrix/register.php 0644 nginx nginx - ${matrixRegisterPhp}"
+      "L+ /var/www/matrix/style.css  0644 nginx nginx - ${matrixStyleCss}"
+      "L+ /var/www/matrix/app.js     0644 nginx nginx - ${matrixAppJs}"
+    ];
+  };
+
 }

nixos/roles/matrix/whatsapp-bridge.nix

@@ -1,6 +1,16 @@
-{ ... }:
 {
-  services.postgresql = {
+
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/mautrix-whatsapp";
+      user = "mautrix-whatsapp";
+      group = "mautrix-whatsapp";
+      mode = "0750";
+    }
+  ];
+
+  services = {
+    postgresql = {
       ensureUsers = [
         {
           name = "mautrix-whatsapp";
@@ -10,7 +20,7 @@
       ensureDatabases = [ "mautrix-whatsapp" ];
     };
 
-  services.mautrix-whatsapp = {
+    mautrix-whatsapp = {
       enable = true;
       settings = {
         homeserver = {
@@ -27,4 +37,5 @@
         };
       };
     };
+  };
 }