DerGrumpf/cyper-nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WIP: Unfree problems

Browse Source
This commit is contained in:
DerGrumpf
2026-05-06 12:43:02 +02:00
parent dd88ffb0a3
commit b4327b2740
11 changed files with 348 additions and 439 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/roles/matrix/clients.nix
+175
View File
@@ -0,0 +1,175 @@
{ pkgs, lib, ... }:
let
flavours = [
{
name = "Latte";
slug = "latte";
is_dark = false;
}
{
name = "Frappé";
slug = "frappe";
is_dark = true;
}
{
name = "Macchiato";
slug = "macchiato";
is_dark = true;
}
{
name = "Mocha";
slug = "mocha";
is_dark = true;
}
];
accents = [
"rosewater"
"flamingo"
"pink"
"mauve"
"red"
"maroon"
"peach"
"yellow"
"green"
"teal"
"sky"
"sapphire"
"blue"
"lavender"
];
themeHashes = {
"latte/rosewater" = "0l1m4bhaxdam07rfqag6pjbzhdpyi5w3i14vp6rq7aj59pildw3a";
"latte/flamingo" = "1m8hh2l87xv2rfgpnnl5vzddmam0n82h25fwadb37blgab08vhsr";
"latte/pink" = "0ambrc42mvg0vdspfmnl31ka1nsxpdyv1p3nh045822y02q20wwh";
"latte/mauve" = "1nnn2w6nsr24a45jy497c2vhi8v64bwg99fj2dyhpfsn89c63lhn";
"latte/red" = "14lmw4c4llfz6zqvfymkc6k3msxcml2gwq9rhwsixdpc5mjjbn8n";
"latte/maroon" = "0ydpng9451mpn7hv5ag1ck8hryx8pdvrml3zksvzm2fiwzzjkpcf";
"latte/peach" = "1fn5804wv9z9iv65ikyv015b01a7c546rsaaks2a2sq2c37n75l0";
"latte/yellow" = "0hzgiyhqmwgp3h3v1y23sx3x5qp712sw106472lbnxbywqlavcza";
"latte/green" = "194kxv6d9hc4nixy16hy9nvf32qs3v214nr2r2qf2z9l89rk5pnp";
"latte/teal" = "12n25d38zpqxsskglymhmza972klg2hj3c23v2nb3jfj82llw6v4";
"latte/sky" = "0yghds3xpmbhkbcj2jkh8df82j6vrn9q1z0s2129nca7l5g5f9w2";
"latte/sapphire" = "18dl1srxp3xccvvy56za6kp05n68d918l0wrxga11746g9sib7r3";
"latte/blue" = "1zv9nap21d80flvd1jwmjph05jgykxngv5kqbhk95mvqh962ygnf";
"latte/lavender" = "03j4fwbscip1qm6px1qxkha0c5csq2wwvzg9vwjkc2ja48v1mp9k";
"frappe/rosewater" = "032qbgj32mvgpankl9777x2lxk18451kglsxg5215k8zrwcg9y95";
"frappe/flamingo" = "1grhgynn8q7isv18981km5k8ll72ihsjw2ciy8widl6wikv29j8p";
"frappe/pink" = "0h33g721bph8ihd6lmbc7szxy4dq85ng1cgg5cxjb5y2m7wpdbsy";
"frappe/mauve" = "121jmznc9q3p7crsy9p2khw8xnzvz4lxms26g1h5wqa67wqvalc4";
"frappe/red" = "07wm4h1giyy6a5nlh0d3qdarfsp6ikyr5nmg94n13lj4q03d0cn0";
"frappe/maroon" = "08vg70nr918n4ffi1wnbba4xrx5ak5vfgq7m5ik0rpkb2wdb4x6k";
"frappe/peach" = "1cg753w2dxs0sx97d8y0g62s8aw3w6b9hrll0lsrw3bc1bvm23fl";
"frappe/yellow" = "0g43g2if1pcm25i261zfw43bawqqdlgg2f6q2bqhyqvafk9yb3dy";
"frappe/green" = "1n71mndzds3zldb271g8hdw1yn29s68svzvh8ckjcsz4sb9h1i74";
"frappe/teal" = "0b6m9cibfwf8csh1pk5i76xi3wx3v2aqwgffzsidw8nwc7c1a3wk";
"frappe/sky" = "1l4d44399ixshlc9fdsx7iqwxm6kdkp6k4z3z6bdyyx6adw3z4q5";
"frappe/sapphire" = "03fa9rnclvs5ljd0lzz15vnkzpqpbrhfppg3zwfchs9fvak0n3ni";
"frappe/blue" = "0r4jjn3pab77w1aanlv3143ch60400q44mdzaqmcjbcr6l2knmjh";
"frappe/lavender" = "1mrkaz72w6j9hh4dpxwgd6ks5wsnq9ydgy6f9gms4jx1611aab96";
"macchiato/rosewater" = "001akfnhlvwaiz5faahl4qi0qp6as6ilvkbja6bjy9f5iasr4ygp";
"macchiato/flamingo" = "06xq3pbx4cb3pyblx2vydr4bp0ylm7866d66agg5wg5qnr356wb3";
"macchiato/pink" = "1hb32dj0n3wx4f1wxa4n7fib2mazghwsg2ljycza9macfn2n87qn";
"macchiato/mauve" = "1yrnp162blizc10fz2n6ls1x0di1sdjk53vpsl7mifrkcr1k2nq7";
"macchiato/red" = "1g9s39q7459lk830vhdrfqkbzz88p3fp8k98a2ygj2hz8sycpryq";
"macchiato/maroon" = "0ad7rx8sbkygvsgywhpjvvzmyflyhz7jlm13dr7cxj3801rxhl6d";
"macchiato/peach" = "1m5m6afcl8s1ghn2b9n1d20fhsygnhgn0205nhpxh4bih3kg8c8m";
"macchiato/yellow" = "0zcc26d28jaq71mz8nqssz8p0hylczirjwjxr2dkha1133vjmvy5";
"macchiato/green" = "055xdb5jilp5fq3a1g8773rv52zr68fp4l3hs56yj6dy3bq3q22v";
"macchiato/teal" = "1sfci2g2nvmj0v72gnxqbj0k8053qz0rl6iphfxs3pgpi1b0rczq";
"macchiato/sky" = "0vhfmdliy8cbb0vqq3v26isvcz4sxzq0xrb4p5a6gibvxaqi6bf3";
"macchiato/sapphire" = "1744jiv57aqz4qi52n92nrx0s1rhylgg08qqc31jr2clk9h6bw18";
"macchiato/blue" = "1arp8r2g8ivs1xipq39d3l6cvx0zrr1vwv9yac5j33d6c93wbb2i";
"macchiato/lavender" = "0kak1f574c07gqjfafg3w5avrci584iqxjkmvrl2pv1879g84nn3";
"mocha/rosewater" = "0p3ck9crskrhk1za6knaznjlj464mx4sdkkadna6k2152m3czjpz";
"mocha/flamingo" = "04xx1mky230saqxxqin2fph8cnnz1jhmvb9qd9f5yc3pai3q5wdw";
"mocha/pink" = "1cj9zdd72vcc45ziav625yq6hrp1zw21f7xsic0ip065xcqzdl3p";
"mocha/mauve" = "1wb0ibmdv6vn07bk570pikm43qdxj3n2zsqr5sip17ay05j5l6dm";
"mocha/red" = "1mnzrk57ar2cphyi2ry2lg5ilmb26gm4pr7ixch2ls0hk8ilp9p9";
"mocha/maroon" = "1mcpwz3yrg3kk0hkqv5nykxj07bm70403yyl8r60pqlh74dnhkbf";
"mocha/peach" = "0jglpcs41rfqxcm45mvnbdqhma0bv4h07nc7c3nrwz3g3h2djmzr";
"mocha/yellow" = "0jqkvcjiwid1zdvrj2ikqf5winm08qyd51nfsawfdspbfhqnzmis";
"mocha/green" = "0bg0014a77yx7f2r6n4mxm7rqgdnymqq7cq6bvpgkfk2z1gyr38l";
"mocha/teal" = "0kzvi3gfirpcxdhgsilm51lk3j1z6lavb7160chgd9jhzk0xg97c";
"mocha/sky" = "057nmp2aywdxzrkmzi65bh2mvf1a9cnri0g0jdyzdnrn7f8bbsiw";
"mocha/sapphire" = "0nfklzb0a7mxv6nzav7m2g0y9plm72vwadm06445myv3k9j3ffmj";
"mocha/blue" = "06ay46x2aq1q5ghz2zhzhn6qyqkrrf4p9j59qywnxh1jvv728ns8";
"mocha/lavender" = "0iip063f6km17998c7ak0lb3kq6iskyi3xv2phn618mhslnxhwm5";
};
catppuccinThemes = lib.concatMap (
flavour:
map (
accent:
builtins.fromJSON (
builtins.readFile (
pkgs.fetchurl {
url = "https://element.catppuccin.com/${flavour.slug}/${accent}.json";
sha256 = themeHashes."${flavour.slug}/${accent}";
}
)
)
) accents
) flavours;
elementConfig = builtins.toFile "element-config.json" (
builtins.toJSON {
default_server_config = {
"m.homeserver" = {
base_url = "https://matrix.cyperpunk.de";
server_name = "cyperpunk.de";
};
};
setting_defaults = {
custom_themes = catppuccinThemes;
feature_custom_themes = true;
};
}
);
elementWebConfigured = pkgs.element-web.overrideAttrs (old: {
postInstall = (old.postInstall or "") + ''
cp ${elementConfig} $out/config.json
'';
});
in
{
services.nginx.virtualHosts = {
"cinny.cyperpunk.de" = {
forceSSL = true;
enableACME = true;
root = "${pkgs.cinny}";
};
"element.cyperpunk.de" = {
forceSSL = true;
enableACME = true;
root = "${elementWebConfigured}";
};
"fluffy.cyperpunk.de" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8082";
proxyWebsockets = true;
};
};
};
virtualisation.oci-containers.containers.fluffychat = {
image = "ghcr.io/krille-chan/fluffychat:latest";
ports = [ "127.0.0.1:8082:80" ];
volumes = [
"${
builtins.toFile "fluffychat-config.json" (
builtins.toJSON {
default_homeserver = "matrix.cyperpunk.de";
preset_homeserver = "matrix.cyperpunk.de";
}
)
}:/app/config.json:ro"
];
};
}
nixos/roles/matrix/default.nix
+3 -23
View File
@@ -4,28 +4,8 @@
{
imports = [
./synapse.nix
./lk-jwt.nix
./livekit.nix
#./lk-jwt.nix
#./livekit.nix
./clients.nix
];
#networking.firewall = {
# allowedTCPPorts = [
# 8008 # Matrix Synapse
# 8009 # Cinny
# 8010 # Element
# 8011 # Synapse Admin
# 8012 # FluffyChat
# 8448 # Matrix federation
# 3478 # TURN (coturn)
# ];
# allowedUDPPorts = [
# 3478 # TURN (coturn)
# ];
# allowedUDPPortRanges = [
# {
# from = 49152;
# to = 65535; # TURN relay ports (coturn)
# }
# ];
#};
}
nixos/roles/matrix/livekit.nix
+16 -6
View File
@@ -1,22 +1,23 @@
{ config, lib, ... }:
{
sops.secrets.livekit_key_sfu = { };
# Shared key file — same secret used by lk-jwt-service (see lk-jwt.nix)
sops.secrets.livekit_key = { };
services.livekit = {
enable = true;
openFirewall = true;
keyFile = config.sops.secrets.livekit_key_sfu.path;
keyFile = config.sops.secrets.livekit_key.path;
settings = {
rtc = {
tcp_port = 7881;
#udp_port = 7882;
port_range_start = 50000;
port_range_end = 60000;
use_external_ip = true;
node_ip = "178.254.8.35";
};
room = {
auto_create = true;
# Must be false — rooms are created by the JWT service on demand
auto_create = false;
enabled_codecs = [
{ mime = "video/VP8"; }
{ mime = "video/VP9"; }
@@ -27,7 +28,17 @@
};
};
};
networking.firewall.allowedTCPPorts = [ 7881 ];
networking.firewall = {
allowedTCPPorts = [ 7881 ];
# WebRTC media relay — must be open or calls connect then immediately drop
allowedUDPPortRanges = [
{
from = 50000;
to = 60000;
}
];
};
systemd.services.livekit.serviceConfig = {
PrivateUsers = lib.mkForce false;
@@ -50,5 +61,4 @@
};
groups.livekit = { };
};
}
nixos/roles/matrix/lk-jwt.nix
+14 -14
View File
@@ -1,25 +1,25 @@
{ config, lib, ... }:
{ config, ... }:
let
domain = "cyperpunk.de";
synapseUrl = "http://localhost:8008";
synapseUrl = "http://127.0.0.1:8008";
# Internal LiveKit address — JWT service must NOT go through the TLS proxy.
# Using the public wss:// URL caused token rejection because nginx re-wraps
# the connection and the JWT service couldn't verify the livekit instance.
livekitInternalUrl = "ws://127.0.0.1:7880";
in
{
sops.secrets.livekit_key_jwt = { };
networking.firewall.allowedTCPPorts = [ 18080 ];
# Same secret as livekit.nix — both services must share the same key pair
sops.secrets.livekit_key = { };
services.lk-jwt-service = {
enable = true;
keyFile = config.sops.secrets.livekit_key_jwt.path;
livekitUrl = "wss://cyperpunk.de/livekit/sfu";
port = 18080;
keyFile = config.sops.secrets.livekit_key.path;
livekitUrl = livekitInternalUrl;
};
systemd.services.lk-jwt-service = {
environment = {
LIVEKIT_FULL_ACCESS_HOMESERVERS = domain;
MATRIX_BASE_URL = synapseUrl;
LIVEKIT_JWT_BIND = lib.mkForce ":18080";
LIVEKIT_INSECURE_SKIP_VERIFY_TLS = "YES_I_KNOW_WHAT_I_AM_DOING";
};
systemd.services.lk-jwt-service.environment = {
LIVEKIT_FULL_ACCESS_HOMESERVERS = domain;
MATRIX_BASE_URL = synapseUrl;
};
}
nixos/roles/matrix/synapse.nix
+64 -27
View File
@@ -3,13 +3,30 @@
pkgs,
...
}:
let
wellKnownMatrix = {
"= /.well-known/matrix/client" = {
extraConfig = ''
default_type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '{"m.homeserver":{"base_url":"https://matrix.cyperpunk.de"}}';
'';
};
"= /.well-known/matrix/server" = {
extraConfig = ''
default_type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '{"m.server":"matrix.cyperpunk.de:443"}';
'';
};
};
synapseAdmin = pkgs.ketesa.withConfig {
restrictBaseUrl = [ "https://matrix.cyperpunk.de" ];
loginFlows = [ "password" ];
};
in
{
networking.firewall.allowedTCPPorts = [
8008 # Matrix Synapse
8448 # Matrix federation
];
sops.secrets = {
matrix_macaroon_secret = { };
matrix_registration_secret = {
@@ -24,24 +41,28 @@
settings = {
server_name = "cyperpunk.de";
public_baseurl = "https://matrix.cyperpunk.de";
enable_registration = false; # TODO: disable
enable_registration_without_verification = false;
enable_registration = false;
trusted_key_servers = [ { server_name = "matrix.org"; } ];
suppress_key_server_warning = true;
registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path;
macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}";
experimental_features = {
"msc3266_enabled" = true;
"msc3779_enabled" = true;
"msc3401_enabled" = true;
"msc4143_enabled" = true;
"msc4195_enabled" = true;
"msc4222_enabled" = true;
};
#experimental_features = {
# msc3266_enabled = true;
# msc3779_enabled = true;
# msc3401_enabled = true;
# msc4143_enabled = true;
# msc4195_enabled = true;
# msc4222_enabled = true;
#};
listeners = [
{
port = 8008;
bind_addresses = [ "0.0.0.0" ];
bind_addresses = [
"127.0.0.1"
"::1"
];
type = "http";
tls = false;
x_forwarded = true;
@@ -52,7 +73,7 @@
"federation"
"openid"
];
compress = false;
compress = true;
}
];
}
@@ -64,19 +85,35 @@
resources = [ ];
}
];
matrix_rtc = {
enabled = true;
transports = [
{
type = "livekit";
livekit_service_url = "https://cyperpunk.de/livekit/jwt/";
}
];
};
enable_metrics = true;
};
};
nginx.virtualHosts = {
# Matrix homeserver
"cyperpunk.de" = {
forceSSL = true;
enableACME = true;
serverAliases = [ "matrix.cyperpunk.de" ];
http2 = true;
locations = wellKnownMatrix // {
"/_matrix".proxyPass = "http://127.0.0.1:8008";
"/_synapse/client".proxyPass = "http://127.0.0.1:8008";
"/metrics" = {
proxyPass = "http://127.0.0.1:9009";
extraConfig = ''
allow 127.0.0.1;
deny all;
'';
};
"/admin/" = {
root = "${synapseAdmin}";
tryFiles = "$uri $uri/ /index.html";
};
};
};
};
postgresql = {
enable = true;
initialScript = pkgs.writeText "synapse-init.sql" ''
nixos/roles/nginx.nix
+2 -301
View File
@@ -1,4 +1,4 @@
{ pkgs, lib, ... }:
_:
let
upstream = "100.109.179.25";
@@ -19,210 +19,6 @@ let
proxyWebsockets = true;
};
};
matrixConfig = ''
client_max_body_size 50M;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $host;
'';
wellKnownMatrix = {
"/.well-known/matrix/client" = {
extraConfig = ''
default_type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '{
"m.homeserver":{
"base_url":"https://matrix.cyperpunk.de"
},
"org.matrix.msc4143.rtc_foci":[
{
"type":"livekit",
"livekit_service_url":"https://cyperpunk.de/livekit/jwt/"
}
]
}';
'';
};
"/.well-known/matrix/server" = {
extraConfig = ''
default_type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '{"m.server":"matrix.cyperpunk.de:443"}';
'';
};
};
flavours = [
{
name = "Latte";
slug = "latte";
is_dark = false;
}
{
name = "Frappé";
slug = "frappe";
is_dark = true;
}
{
name = "Macchiato";
slug = "macchiato";
is_dark = true;
}
{
name = "Mocha";
slug = "mocha";
is_dark = true;
}
];
accents = [
"rosewater"
"flamingo"
"pink"
"mauve"
"red"
"maroon"
"peach"
"yellow"
"green"
"teal"
"sky"
"sapphire"
"blue"
"lavender"
];
themeHashes = {
"latte/rosewater" = "0l1m4bhaxdam07rfqag6pjbzhdpyi5w3i14vp6rq7aj59pildw3a";
"latte/flamingo" = "1m8hh2l87xv2rfgpnnl5vzddmam0n82h25fwadb37blgab08vhsr";
"latte/pink" = "0ambrc42mvg0vdspfmnl31ka1nsxpdyv1p3nh045822y02q20wwh";
"latte/mauve" = "1nnn2w6nsr24a45jy497c2vhi8v64bwg99fj2dyhpfsn89c63lhn";
"latte/red" = "14lmw4c4llfz6zqvfymkc6k3msxcml2gwq9rhwsixdpc5mjjbn8n";
"latte/maroon" = "0ydpng9451mpn7hv5ag1ck8hryx8pdvrml3zksvzm2fiwzzjkpcf";
"latte/peach" = "1fn5804wv9z9iv65ikyv015b01a7c546rsaaks2a2sq2c37n75l0";
"latte/yellow" = "0hzgiyhqmwgp3h3v1y23sx3x5qp712sw106472lbnxbywqlavcza";
"latte/green" = "194kxv6d9hc4nixy16hy9nvf32qs3v214nr2r2qf2z9l89rk5pnp";
"latte/teal" = "12n25d38zpqxsskglymhmza972klg2hj3c23v2nb3jfj82llw6v4";
"latte/sky" = "0yghds3xpmbhkbcj2jkh8df82j6vrn9q1z0s2129nca7l5g5f9w2";
"latte/sapphire" = "18dl1srxp3xccvvy56za6kp05n68d918l0wrxga11746g9sib7r3";
"latte/blue" = "1zv9nap21d80flvd1jwmjph05jgykxngv5kqbhk95mvqh962ygnf";
"latte/lavender" = "03j4fwbscip1qm6px1qxkha0c5csq2wwvzg9vwjkc2ja48v1mp9k";
"frappe/rosewater" = "032qbgj32mvgpankl9777x2lxk18451kglsxg5215k8zrwcg9y95";
"frappe/flamingo" = "1grhgynn8q7isv18981km5k8ll72ihsjw2ciy8widl6wikv29j8p";
"frappe/pink" = "0h33g721bph8ihd6lmbc7szxy4dq85ng1cgg5cxjb5y2m7wpdbsy";
"frappe/mauve" = "121jmznc9q3p7crsy9p2khw8xnzvz4lxms26g1h5wqa67wqvalc4";
"frappe/red" = "07wm4h1giyy6a5nlh0d3qdarfsp6ikyr5nmg94n13lj4q03d0cn0";
"frappe/maroon" = "08vg70nr918n4ffi1wnbba4xrx5ak5vfgq7m5ik0rpkb2wdb4x6k";
"frappe/peach" = "1cg753w2dxs0sx97d8y0g62s8aw3w6b9hrll0lsrw3bc1bvm23fl";
"frappe/yellow" = "0g43g2if1pcm25i261zfw43bawqqdlgg2f6q2bqhyqvafk9yb3dy";
"frappe/green" = "1n71mndzds3zldb271g8hdw1yn29s68svzvh8ckjcsz4sb9h1i74";
"frappe/teal" = "0b6m9cibfwf8csh1pk5i76xi3wx3v2aqwgffzsidw8nwc7c1a3wk";
"frappe/sky" = "1l4d44399ixshlc9fdsx7iqwxm6kdkp6k4z3z6bdyyx6adw3z4q5";
"frappe/sapphire" = "03fa9rnclvs5ljd0lzz15vnkzpqpbrhfppg3zwfchs9fvak0n3ni";
"frappe/blue" = "0r4jjn3pab77w1aanlv3143ch60400q44mdzaqmcjbcr6l2knmjh";
"frappe/lavender" = "1mrkaz72w6j9hh4dpxwgd6ks5wsnq9ydgy6f9gms4jx1611aab96";
"macchiato/rosewater" = "001akfnhlvwaiz5faahl4qi0qp6as6ilvkbja6bjy9f5iasr4ygp";
"macchiato/flamingo" = "06xq3pbx4cb3pyblx2vydr4bp0ylm7866d66agg5wg5qnr356wb3";
"macchiato/pink" = "1hb32dj0n3wx4f1wxa4n7fib2mazghwsg2ljycza9macfn2n87qn";
"macchiato/mauve" = "1yrnp162blizc10fz2n6ls1x0di1sdjk53vpsl7mifrkcr1k2nq7";
"macchiato/red" = "1g9s39q7459lk830vhdrfqkbzz88p3fp8k98a2ygj2hz8sycpryq";
"macchiato/maroon" = "0ad7rx8sbkygvsgywhpjvvzmyflyhz7jlm13dr7cxj3801rxhl6d";
"macchiato/peach" = "1m5m6afcl8s1ghn2b9n1d20fhsygnhgn0205nhpxh4bih3kg8c8m";
"macchiato/yellow" = "0zcc26d28jaq71mz8nqssz8p0hylczirjwjxr2dkha1133vjmvy5";
"macchiato/green" = "055xdb5jilp5fq3a1g8773rv52zr68fp4l3hs56yj6dy3bq3q22v";
"macchiato/teal" = "1sfci2g2nvmj0v72gnxqbj0k8053qz0rl6iphfxs3pgpi1b0rczq";
"macchiato/sky" = "0vhfmdliy8cbb0vqq3v26isvcz4sxzq0xrb4p5a6gibvxaqi6bf3";
"macchiato/sapphire" = "1744jiv57aqz4qi52n92nrx0s1rhylgg08qqc31jr2clk9h6bw18";
"macchiato/blue" = "1arp8r2g8ivs1xipq39d3l6cvx0zrr1vwv9yac5j33d6c93wbb2i";
"macchiato/lavender" = "0kak1f574c07gqjfafg3w5avrci584iqxjkmvrl2pv1879g84nn3";
"mocha/rosewater" = "0p3ck9crskrhk1za6knaznjlj464mx4sdkkadna6k2152m3czjpz";
"mocha/flamingo" = "04xx1mky230saqxxqin2fph8cnnz1jhmvb9qd9f5yc3pai3q5wdw";
"mocha/pink" = "1cj9zdd72vcc45ziav625yq6hrp1zw21f7xsic0ip065xcqzdl3p";
"mocha/mauve" = "1wb0ibmdv6vn07bk570pikm43qdxj3n2zsqr5sip17ay05j5l6dm";
"mocha/red" = "1mnzrk57ar2cphyi2ry2lg5ilmb26gm4pr7ixch2ls0hk8ilp9p9";
"mocha/maroon" = "1mcpwz3yrg3kk0hkqv5nykxj07bm70403yyl8r60pqlh74dnhkbf";
"mocha/peach" = "0jglpcs41rfqxcm45mvnbdqhma0bv4h07nc7c3nrwz3g3h2djmzr";
"mocha/yellow" = "0jqkvcjiwid1zdvrj2ikqf5winm08qyd51nfsawfdspbfhqnzmis";
"mocha/green" = "0bg0014a77yx7f2r6n4mxm7rqgdnymqq7cq6bvpgkfk2z1gyr38l";
"mocha/teal" = "0kzvi3gfirpcxdhgsilm51lk3j1z6lavb7160chgd9jhzk0xg97c";
"mocha/sky" = "057nmp2aywdxzrkmzi65bh2mvf1a9cnri0g0jdyzdnrn7f8bbsiw";
"mocha/sapphire" = "0nfklzb0a7mxv6nzav7m2g0y9plm72vwadm06445myv3k9j3ffmj";
"mocha/blue" = "06ay46x2aq1q5ghz2zhzhn6qyqkrrf4p9j59qywnxh1jvv728ns8";
"mocha/lavender" = "0iip063f6km17998c7ak0lb3kq6iskyi3xv2phn618mhslnxhwm5";
};
catppuccinThemes = lib.concatMap (
flavour:
map (
accent:
builtins.fromJSON (
builtins.readFile (
pkgs.fetchurl {
url = "https://element.catppuccin.com/${flavour.slug}/${accent}.json";
sha256 = themeHashes."${flavour.slug}/${accent}";
}
)
)
) accents
) flavours;
elementConfig = builtins.toFile "element-config.json" (
builtins.toJSON {
default_server_config = {
"m.homeserver" = {
base_url = "https://matrix.cyperpunk.de";
server_name = "cyperpunk.de";
};
};
jitsi.preferred_domain = "jitsi.cyperpunk.de";
element_call = {
url = "https://element-call.cyperpunk.de";
use_exclusively = true;
participant_limit = 8;
brand = "Cyperpunk Call";
encryption = "None";
};
livekit.livekit_service_url = "https://cyperpunk.de/livekit/jwt/";
setting_defaults = {
custom_themes = catppuccinThemes;
feature_custom_themes = true;
};
features = {
feature_group_calls = true;
feature_disable_call_per_sender_encryption = true;
feature_sliding_sync = true;
};
}
);
elementWebConfigured = pkgs.element-web.overrideAttrs (old: {
postInstall = (old.postInstall or "") + ''
cp ${elementConfig} $out/config.json
'';
});
synapseAdmin = pkgs.ketesa.withConfig {
restrictBaseUrl = [ "https://matrix.cyperpunk.de" ];
loginFlows = [ "password" ];
};
elementCallConfigured = pkgs.element-call.overrideAttrs (old: {
postInstall = (old.postInstall or "") + ''
cp ${
builtins.toFile "element-call-config.json" (
builtins.toJSON {
default_server_config = {
"m.homeserver" = {
base_url = "https://matrix.cyperpunk.de";
server_name = "cyperpunk.de";
};
};
livekit_service_url = "https://cyperpunk.de/livekit/jwt/";
e2ee.default = false;
}
)
} $out/config.json
'';
});
in
{
networking.firewall.allowedTCPPorts = [
@@ -243,7 +39,7 @@ in
recommendedGzipSettings = true;
virtualHosts = {
# controller services
# controller services (proxied to upstream tailscale node)
"git.cyperpunk.de" = mkProxy 9000;
"search.cyperpunk.de" = mkProxy 11080;
"file.cyperpunk.de" = mkProxy 10000;
@@ -265,101 +61,6 @@ in
};
};
};
# local static clients
"cinny.cyperpunk.de" = {
forceSSL = true;
enableACME = true;
root = "${pkgs.cinny}";
};
"element.cyperpunk.de" = {
forceSSL = true;
enableACME = true;
root = "${elementWebConfigured}";
};
"element-call.cyperpunk.de" = {
forceSSL = true;
enableACME = true;
root = "${elementCallConfigured}";
extraConfig = ''
add_header Cross-Origin-Opener-Policy "same-origin";
add_header Cross-Origin-Embedder-Policy "require-corp";
add_header Cross-Origin-Resource-Policy "cross-origin";
'';
};
"fluffy.cyperpunk.de" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8082";
proxyWebsockets = true;
};
};
"admin.cyperpunk.de" = {
forceSSL = true;
enableACME = true;
root = "${synapseAdmin}";
};
# matrix + livekit
"cyperpunk.de" = {
forceSSL = true;
enableACME = true;
serverAliases = [ "matrix.cyperpunk.de" ];
http2 = true;
extraConfig = matrixConfig;
locations = wellKnownMatrix // {
"/" = {
proxyPass = "http://127.0.0.1:8008";
proxyWebsockets = true;
};
"^~ /livekit/jwt/" = {
priority = 400;
proxyPass = "http://127.0.0.1:18080/";
};
"^~ /livekit/sfu/" = {
priority = 400;
proxyPass = "http://127.0.0.1:7880/";
proxyWebsockets = true;
extraConfig = ''
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 86400s;
proxy_send_timeout 86400s;
'';
};
"/_matrix/client/unstable/org.matrix.msc4143/rtc/transports" = {
extraConfig = ''
default_type application/json;
add_header Access-Control-Allow-Origin *;
add_header Access-Control-Allow-Headers "Authorization, Content-Type";
add_header Access-Control-Allow-Methods "GET, OPTIONS";
return 200 '{"rtc_transports":[{"type":"livekit","livekit_service_url":"https://cyperpunk.de/livekit/jwt/"}]}';
'';
};
};
};
};
};
virtualisation.oci-containers.containers.fluffychat = {
image = "ghcr.io/krille-chan/fluffychat:latest";
ports = [ "127.0.0.1:8082:80" ];
volumes = [
"${
builtins.toFile "fluffychat-config.json" (
builtins.toJSON {
default_homeserver = "matrix.cyperpunk.de";
preset_homeserver = "matrix.cyperpunk.de";
}
)
}:/app/config.json:ro"
];
};
}