DerGrumpf/cyper-nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added Impermanence and Disko setup to Proxy

Browse Source
This commit is contained in:
DerGrumpf
2026-06-28 23:23:56 +02:00
parent 75bd7875cb
commit 708b00ac61
11 changed files with 225 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
flake.nix
+4
View File
@@ -271,6 +271,10 @@
install-cyper-controller = mkInstall {
hostName = "cyper-controller";
};
install-cyper-proxy = mkInstall {
hostName = "cyper-proxy";
target = ""; # KVM console IP
};
};
};
}
hosts/cyper-proxy/configuration.nix
+1
View File
@@ -1,6 +1,7 @@
{ ... }:
{
imports = [
./disko.nix
./hardware-configuration.nix
../../nixos/roles/nginx.nix
# ../../nixos/roles/jitsi.nix
hosts/cyper-proxy/disko.nix
+65
View File
@@ -0,0 +1,65 @@
{
disko.devices.disk.main = {
type = "disk";
device = "/dev/vda";
content = {
type = "gpt";
partitions = {
boot = {
size = "1M";
type = "EF02";
};
ESP = {
size = "512M";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
mountOptions = [
"fmask=0022"
"dmask=0022"
];
extraArgs = [
"-n"
"NIXBOOT"
];
};
};
swap = {
size = "4G";
content = {
type = "swap";
extraArgs = [
"-L"
"NIXSWAP"
];
};
};
nix = {
size = "40G";
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/nix";
extraArgs = [
"-L"
"NIXSTORE"
];
};
};
persist = {
size = "100%";
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/persist";
extraArgs = [
"-L"
"NIXPERSIST"
];
};
};
};
};
};
}
hosts/cyper-proxy/hardware-configuration.nix
+7 -15
View File
@@ -5,11 +5,6 @@
];
boot = {
loader.grub = {
enable = true;
device = "/dev/vda";
};
initrd = {
availableKernelModules = [
"ata_piix"
@@ -27,21 +22,18 @@
fileSystems = {
"/" = {
device = "/dev/disk/by-label/NIXROOT";
fsType = "ext4";
};
"/boot" = {
device = "/dev/disk/by-label/NIXBOOT";
fsType = "vfat";
device = "none";
fsType = "tmpfs";
options = [
"fmask=0022"
"dmask=0022"
"defaults"
"size=2G"
"mode=755"
];
};
};
swapDevices = [ ];
fileSystems."/nix".neededForBoot = true;
fileSystems."/persist".neededForBoot = true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}
nixos/roles/matrix/clients.nix
+9
View File
@@ -149,6 +149,15 @@ let
in
{
environment.persistence."/persist".directories = [
{
directory = "/var/lib/containers";
user = "root";
group = "root";
mode = "0700";
}
];
services.nginx.virtualHosts = {
"cinny.cyperpunk.de" = {
forceSSL = true;
nixos/roles/matrix/discord-bridge.nix
+9
View File
@@ -15,6 +15,15 @@
};
};
environment.persistence."/persist".directories = [
{
directory = "/var/lib/mautrix-discord";
user = "mautrix-discord";
group = "mautrix-discord";
mode = "0750";
}
];
systemd = {
services = {
mautrix-discord-env = {
nixos/roles/matrix/maubot.nix
+14 -3
View File
@@ -1,8 +1,19 @@
{ config, pkgs, ... }:
{
environment.systemPackages = with pkgs; [
maubot
];
environment = {
systemPackages = with pkgs; [
maubot
];
persistence."/persist".directories = [
{
directory = "/var/lib/maubot";
user = "maubot";
group = "maubot";
mode = "0750";
}
];
};
services = {
maubot = {
nixos/roles/matrix/meta-bridge.nix
+15
View File
@@ -19,6 +19,21 @@
};
};
environment.persistence."/persist".directories = [
{
directory = "/var/lib/mautrix-meta-facebook";
user = "mautrix-meta-facebook";
group = "mautrix-meta";
mode = "0750";
}
{
directory = "/var/lib/mautrix-meta-instagram";
user = "mautrix-meta-instagram";
group = "mautrix-meta";
mode = "0750";
}
];
systemd.services = {
mautrix-meta-facebook-env = {
before = [ "mautrix-meta-facebook-registration.service" ];
nixos/roles/matrix/mjolnir.nix
+9 -4
View File
@@ -2,6 +2,15 @@
{
sops.secrets.mjolnir_access_token = { };
environment.persistence."/persist".directories = [
{
directory = "/var/lib/private";
user = "root";
group = "root";
mode = "0700";
}
];
services.draupnir = {
enable = true;
secrets.accessToken = config.sops.secrets.mjolnir_access_token.path;
@@ -11,7 +20,3 @@
};
};
}
#curl -X POST https://matrix.cyperpunk.de/_matrix/client/v3/login \
# -H "Content-Type: application/json" \
# -d '{"type":"m.login.password ","user":"mjolnir","password":"i318HXBRkt)Lh$nOPwq#6n9z&<W[XJ&2c4$Zf>7jV}-uQCE{<plwk;LZ)10*N<~1"}'
nixos/roles/matrix/synapse.nix
+57 -31
View File
@@ -49,30 +49,44 @@ in
};
};
systemd.tmpfiles.rules = [
"d /var/www/matrix 0755 nginx nginx -"
"L+ /var/www/matrix/index.html 0644 nginx nginx - ${matrixIndexHtml}"
"L+ /var/www/matrix/register.php 0644 nginx nginx - ${matrixRegisterPhp}"
"L+ /var/www/matrix/style.css 0644 nginx nginx - ${matrixStyleCss}"
"L+ /var/www/matrix/app.js 0644 nginx nginx - ${matrixAppJs}"
environment.persistence."/persist".directories = [
{
directory = "/var/lib/matrix-synapse";
user = "matrix-synapse";
group = "matrix-synapse";
mode = "0700";
}
{
directory = "/var/lib/postgresql";
user = "postgres";
group = "postgres";
mode = "0750";
}
{
directory = "/var/lib/acme";
user = "acme";
group = "acme";
mode = "0755";
}
];
services.phpfpm.pools.matrix = {
user = "nginx";
group = "nginx";
settings = {
"listen.owner" = "nginx";
"listen.group" = "nginx";
"pm" = "dynamic";
"pm.max_children" = 10;
"pm.start_servers" = 2;
"pm.min_spare_servers" = 1;
"pm.max_spare_servers" = 3;
};
phpPackage = pkgs.php.withExtensions ({ enabled, all }: enabled ++ [ all.curl ]);
};
services = {
phpfpm.pools.matrix = {
user = "nginx";
group = "nginx";
settings = {
"listen.owner" = "nginx";
"listen.group" = "nginx";
"pm" = "dynamic";
"pm.max_children" = 10;
"pm.start_servers" = 2;
"pm.min_spare_servers" = 1;
"pm.max_spare_servers" = 3;
};
phpPackage = pkgs.php.withExtensions ({ enabled, all }: enabled ++ [ all.curl ]);
};
matrix-synapse = {
enable = true;
settings = {
@@ -237,9 +251,10 @@ in
max_wal_senders = 5;
wal_keep_size = "512MB";
listen_addresses = lib.mkForce "127.0.0.1,100.109.10.91";
ssl = true;
};
authentication = lib.mkAfter ''
host replication replicator 100.0.0.0/8 scram-sha-256
hostssl replication replicator 100.0.0.0/8 scram-sha-256
'';
};
@@ -251,15 +266,26 @@ in
};
};
systemd.services = {
matrix-synapse.serviceConfig.ReadOnlyPaths = [
"/var/lib/mautrix-discord"
"/var/lib/mautrix-whatsapp"
systemd = {
services = {
matrix-synapse.serviceConfig.ReadOnlyPaths = [
"/var/lib/mautrix-discord"
"/var/lib/mautrix-whatsapp"
];
postgresql.postStart = lib.mkAfter ''
PG_PASS=$(cat ${config.sops.secrets.pg_replication_password.path})
${config.services.postgresql.package}/bin/psql -U postgres -c \
"ALTER ROLE replicator WITH PASSWORD '$PG_PASS';"
'';
};
tmpfiles.rules = [
"d /var/www/matrix 0755 nginx nginx -"
"L+ /var/www/matrix/index.html 0644 nginx nginx - ${matrixIndexHtml}"
"L+ /var/www/matrix/register.php 0644 nginx nginx - ${matrixRegisterPhp}"
"L+ /var/www/matrix/style.css 0644 nginx nginx - ${matrixStyleCss}"
"L+ /var/www/matrix/app.js 0644 nginx nginx - ${matrixAppJs}"
];
postgresql.postStart = lib.mkAfter ''
PG_PASS=$(cat ${config.sops.secrets.pg_replication_password.path})
${config.services.postgresql.package}/bin/psql -U postgres -c \
"ALTER ROLE replicator WITH PASSWORD '$PG_PASS';"
'';
};
}
nixos/roles/matrix/whatsapp-bridge.nix
+35 -24
View File
@@ -1,29 +1,40 @@
{ ... }:
{
services.postgresql = {
ensureUsers = [
{
name = "mautrix-whatsapp";
ensureDBOwnership = true;
}
];
ensureDatabases = [ "mautrix-whatsapp" ];
};
services.mautrix-whatsapp = {
enable = true;
settings = {
homeserver = {
address = "http://127.0.0.1:8008";
domain = "cyperpunk.de";
};
database = {
type = "postgres";
uri = "postgres:///mautrix-whatsapp?host=/run/postgresql&sslmode=disable";
};
bridge.permissions = {
"cyperpunk.de" = "user";
"@dergrumpf:cyperpunk.de" = "admin";
environment.persistence."/persist".directories = [
{
directory = "/var/lib/mautrix-whatsapp";
user = "mautrix-whatsapp";
group = "mautrix-whatsapp";
mode = "0750";
}
];
services = {
postgresql = {
ensureUsers = [
{
name = "mautrix-whatsapp";
ensureDBOwnership = true;
}
];
ensureDatabases = [ "mautrix-whatsapp" ];
};
mautrix-whatsapp = {
enable = true;
settings = {
homeserver = {
address = "http://127.0.0.1:8008";
domain = "cyperpunk.de";
};
database = {
type = "postgres";
uri = "postgres:///mautrix-whatsapp?host=/run/postgresql&sslmode=disable";
};
bridge.permissions = {
"cyperpunk.de" = "user";
"@dergrumpf:cyperpunk.de" = "admin";
};
};
};
};