DerGrumpf/cyper-nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added Impermanence and Disko setup to Proxy

Browse Source
This commit is contained in:
DerGrumpf
2026-06-28 23:23:56 +02:00
parent 75bd7875cb
commit 708b00ac61
11 changed files with 225 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
flake.nix
+4
View File
@@ -271,6 +271,10 @@
install-cyper-controller = mkInstall {
hostName = "cyper-controller";
};
install-cyper-proxy = mkInstall {
hostName = "cyper-proxy";
target = ""; # KVM console IP
};
};
};
}
hosts/cyper-proxy/configuration.nix
+1
View File
@@ -1,6 +1,7 @@
{ ... }:
{
imports = [
./disko.nix
./hardware-configuration.nix
../../nixos/roles/nginx.nix
# ../../nixos/roles/jitsi.nix
hosts/cyper-proxy/disko.nix
+65
View File
@@ -0,0 +1,65 @@
{
disko.devices.disk.main = {
type = "disk";
device = "/dev/vda";
content = {
type = "gpt";
partitions = {
boot = {
size = "1M";
type = "EF02";
};
ESP = {
size = "512M";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
mountOptions = [
"fmask=0022"
"dmask=0022"
];
extraArgs = [
"-n"
"NIXBOOT"
];
};
};
swap = {
size = "4G";
content = {
type = "swap";
extraArgs = [
"-L"
"NIXSWAP"
];
};
};
nix = {
size = "40G";
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/nix";
extraArgs = [
"-L"
"NIXSTORE"
];
};
};
persist = {
size = "100%";
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/persist";
extraArgs = [
"-L"
"NIXPERSIST"
];
};
};
};
};
};
}
hosts/cyper-proxy/hardware-configuration.nix
+7 -15
View File
@@ -5,11 +5,6 @@
];
boot = {
loader.grub = {
enable = true;
device = "/dev/vda";
};
initrd = {
availableKernelModules = [
"ata_piix"
@@ -27,21 +22,18 @@
fileSystems = {
"/" = {
device = "/dev/disk/by-label/NIXROOT";
fsType = "ext4";
};
"/boot" = {
device = "/dev/disk/by-label/NIXBOOT";
fsType = "vfat";
device = "none";
fsType = "tmpfs";
options = [
"fmask=0022"
"dmask=0022"
"defaults"
"size=2G"
"mode=755"
];
};
};
swapDevices = [ ];
fileSystems."/nix".neededForBoot = true;
fileSystems."/persist".neededForBoot = true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}
nixos/roles/matrix/clients.nix
+9
View File
@@ -149,6 +149,15 @@ let
in
{
environment.persistence."/persist".directories = [
{
directory = "/var/lib/containers";
user = "root";
group = "root";
mode = "0700";
}
];
services.nginx.virtualHosts = {
"cinny.cyperpunk.de" = {
forceSSL = true;
nixos/roles/matrix/discord-bridge.nix
+9
View File
@@ -15,6 +15,15 @@
};
};
environment.persistence."/persist".directories = [
{
directory = "/var/lib/mautrix-discord";
user = "mautrix-discord";
group = "mautrix-discord";
mode = "0750";
}
];
systemd = {
services = {
mautrix-discord-env = {
nixos/roles/matrix/maubot.nix
+12 -1
View File
@@ -1,9 +1,20 @@
{ config, pkgs, ... }:
{
environment.systemPackages = with pkgs; [
environment = {
systemPackages = with pkgs; [
maubot
];
persistence."/persist".directories = [
{
directory = "/var/lib/maubot";
user = "maubot";
group = "maubot";
mode = "0750";
}
];
};
services = {
maubot = {
enable = true;
nixos/roles/matrix/meta-bridge.nix
+15
View File
@@ -19,6 +19,21 @@
};
};
environment.persistence."/persist".directories = [
{
directory = "/var/lib/mautrix-meta-facebook";
user = "mautrix-meta-facebook";
group = "mautrix-meta";
mode = "0750";
}
{
directory = "/var/lib/mautrix-meta-instagram";
user = "mautrix-meta-instagram";
group = "mautrix-meta";
mode = "0750";
}
];
systemd.services = {
mautrix-meta-facebook-env = {
before = [ "mautrix-meta-facebook-registration.service" ];
nixos/roles/matrix/mjolnir.nix
+9 -4
View File
@@ -2,6 +2,15 @@
{
sops.secrets.mjolnir_access_token = { };
environment.persistence."/persist".directories = [
{
directory = "/var/lib/private";
user = "root";
group = "root";
mode = "0700";
}
];
services.draupnir = {
enable = true;
secrets.accessToken = config.sops.secrets.mjolnir_access_token.path;
@@ -11,7 +20,3 @@
};
};
}
#curl -X POST https://matrix.cyperpunk.de/_matrix/client/v3/login \
# -H "Content-Type: application/json" \
# -d '{"type":"m.login.password ","user":"mjolnir","password":"i318HXBRkt)Lh$nOPwq#6n9z&<W[XJ&2c4$Zf>7jV}-uQCE{<plwk;LZ)10*N<~1"}'
nixos/roles/matrix/synapse.nix
+36 -10
View File
@@ -49,15 +49,30 @@ in
};
};
systemd.tmpfiles.rules = [
"d /var/www/matrix 0755 nginx nginx -"
"L+ /var/www/matrix/index.html 0644 nginx nginx - ${matrixIndexHtml}"
"L+ /var/www/matrix/register.php 0644 nginx nginx - ${matrixRegisterPhp}"
"L+ /var/www/matrix/style.css 0644 nginx nginx - ${matrixStyleCss}"
"L+ /var/www/matrix/app.js 0644 nginx nginx - ${matrixAppJs}"
environment.persistence."/persist".directories = [
{
directory = "/var/lib/matrix-synapse";
user = "matrix-synapse";
group = "matrix-synapse";
mode = "0700";
}
{
directory = "/var/lib/postgresql";
user = "postgres";
group = "postgres";
mode = "0750";
}
{
directory = "/var/lib/acme";
user = "acme";
group = "acme";
mode = "0755";
}
];
services.phpfpm.pools.matrix = {
services = {
phpfpm.pools.matrix = {
user = "nginx";
group = "nginx";
settings = {
@@ -72,7 +87,6 @@ in
phpPackage = pkgs.php.withExtensions ({ enabled, all }: enabled ++ [ all.curl ]);
};
services = {
matrix-synapse = {
enable = true;
settings = {
@@ -237,9 +251,10 @@ in
max_wal_senders = 5;
wal_keep_size = "512MB";
listen_addresses = lib.mkForce "127.0.0.1,100.109.10.91";
ssl = true;
};
authentication = lib.mkAfter ''
host replication replicator 100.0.0.0/8 scram-sha-256
hostssl replication replicator 100.0.0.0/8 scram-sha-256
'';
};
@@ -251,7 +266,8 @@ in
};
};
systemd.services = {
systemd = {
services = {
matrix-synapse.serviceConfig.ReadOnlyPaths = [
"/var/lib/mautrix-discord"
"/var/lib/mautrix-whatsapp"
@@ -262,4 +278,14 @@ in
"ALTER ROLE replicator WITH PASSWORD '$PG_PASS';"
'';
};
tmpfiles.rules = [
"d /var/www/matrix 0755 nginx nginx -"
"L+ /var/www/matrix/index.html 0644 nginx nginx - ${matrixIndexHtml}"
"L+ /var/www/matrix/register.php 0644 nginx nginx - ${matrixRegisterPhp}"
"L+ /var/www/matrix/style.css 0644 nginx nginx - ${matrixStyleCss}"
"L+ /var/www/matrix/app.js 0644 nginx nginx - ${matrixAppJs}"
];
};
}
nixos/roles/matrix/whatsapp-bridge.nix
+14 -3
View File
@@ -1,6 +1,16 @@
{ ... }:
{
services.postgresql = {
environment.persistence."/persist".directories = [
{
directory = "/var/lib/mautrix-whatsapp";
user = "mautrix-whatsapp";
group = "mautrix-whatsapp";
mode = "0750";
}
];
services = {
postgresql = {
ensureUsers = [
{
name = "mautrix-whatsapp";
@@ -10,7 +20,7 @@
ensureDatabases = [ "mautrix-whatsapp" ];
};
services.mautrix-whatsapp = {
mautrix-whatsapp = {
enable = true;
settings = {
homeserver = {
@@ -27,4 +37,5 @@
};
};
};
};
}