From ff3c4f6faf0053fd3a4b860ad5c8214a3d09ecdf Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Mon, 27 Apr 2026 21:16:30 +0200 Subject: [PATCH 01/15] Added Livekit --- flake.lock | 6 +- hosts/cyper-proxy/configuration.nix | 1 + nixos/roles/livekit.nix | 90 ++++++++++++++++++----------- nixos/roles/matrix/clients.nix | 5 +- nixos/roles/matrix/synapse.nix | 2 + nixos/roles/nginx.nix | 22 ++++++- 6 files changed, 86 insertions(+), 40 deletions(-) diff --git a/flake.lock b/flake.lock index 50881ba..beb3a51 100644 --- a/flake.lock +++ b/flake.lock @@ -707,11 +707,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1775423009, - "narHash": "sha256-vPKLpjhIVWdDrfiUM8atW6YkIggCEKdSAlJPzzhkQlw=", + "lastModified": 1776877367, + "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=", "owner": "nixos", "repo": "nixpkgs", - "rev": "68d8aa3d661f0e6bd5862291b5bb263b2a6595c9", + "rev": "0726a0ecb6d4e08f6adced58726b95db924cef57", "type": "github" }, "original": { diff --git a/hosts/cyper-proxy/configuration.nix b/hosts/cyper-proxy/configuration.nix index d2c0f1c..75f2ddd 100644 --- a/hosts/cyper-proxy/configuration.nix +++ b/hosts/cyper-proxy/configuration.nix @@ -4,6 +4,7 @@ ./hardware-configuration.nix ../../nixos/roles/nginx.nix ../../nixos/roles/livekit.nix + ../../nixos/roles/jitsi.nix ]; networking = { diff --git a/nixos/roles/livekit.nix b/nixos/roles/livekit.nix index 4bd504b..c5c8a71 100644 --- a/nixos/roles/livekit.nix +++ b/nixos/roles/livekit.nix @@ -1,45 +1,67 @@ { pkgs, ... }: - let keyFile = "/run/livekit/livekit.key"; domain = "cyperpunk.de"; - synapseUrl = "http://100.109.179.25:8008"; # Tailscale IP of cyper-controller + synapseUrl = "http://100.109.179.25:8008"; in { - services.livekit = { - enable = true; - openFirewall = true; - inherit keyFile; - settings.room.auto_create = false; + services = { + livekit = { + enable = true; + openFirewall = true; + inherit keyFile; + settings = { + rtc = { + tcp_port = 7881; + udp_port = 7882; + port_range_start = 50000; + port_range_end = 60000; + use_external_ip = true; + node_ip = "178.254.8.35"; + }; + room = { + auto_create = false; + enabled_codecs = [ + { mime = "video/VP8"; } + { mime = "video/VP9"; } + { mime = "video/H264"; } + { mime = "audio/opus"; } + ]; + enable_remote_unmute = true; + }; + }; + }; + + lk-jwt-service = { + enable = true; + livekitUrl = "ws://127.0.0.1:7880"; + inherit keyFile; + }; }; - services.lk-jwt-service = { - enable = true; - livekitUrl = "wss://${domain}/livekit/sfu"; - inherit keyFile; - }; + systemd.services = { + livekit-key = { + before = [ + "lk-jwt-service.service" + "livekit.service" + ]; + wantedBy = [ "multi-user.target" ]; + path = with pkgs; [ + livekit + coreutils + gawk + ]; + script = '' + mkdir -p /run/livekit + echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${keyFile}" + ''; + serviceConfig.Type = "oneshot"; + unitConfig.ConditionPathExists = "!${keyFile}"; + }; - systemd.services.livekit-key = { - before = [ - "lk-jwt-service.service" - "livekit.service" - ]; - wantedBy = [ "multi-user.target" ]; - path = with pkgs; [ - livekit - coreutils - gawk - ]; - script = '' - mkdir -p /run/livekit - echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${keyFile}" - ''; - serviceConfig.Type = "oneshot"; - unitConfig.ConditionPathExists = "!${keyFile}"; - }; - - systemd.services.lk-jwt-service.environment = { - LIVEKIT_FULL_ACCESS_HOMESERVERS = domain; - MATRIX_BASE_URL = synapseUrl; # tells lk-jwt-service where to validate tokens + lk-jwt-service.environment = { + LIVEKIT_FULL_ACCESS_HOMESERVERS = domain; + MATRIX_BASE_URL = synapseUrl; + }; }; } diff --git a/nixos/roles/matrix/clients.nix b/nixos/roles/matrix/clients.nix index e0ba613..9123709 100644 --- a/nixos/roles/matrix/clients.nix +++ b/nixos/roles/matrix/clients.nix @@ -126,9 +126,12 @@ let preferred_domain = "jitsi.cyperpunk.de"; }; element_call = { - url = "https://cyperpunk.de/livekit/jwt"; + url = "https://call.element.io"; use_exclusively = true; }; + livekit = { + livekit_service_url = "https://cyperpunk.de/livekit/jwt"; + }; setting_defaults = { custom_themes = catppuccinThemes; feature_custom_themes = true; diff --git a/nixos/roles/matrix/synapse.nix b/nixos/roles/matrix/synapse.nix index 4ef23dd..8bd271c 100644 --- a/nixos/roles/matrix/synapse.nix +++ b/nixos/roles/matrix/synapse.nix @@ -33,6 +33,8 @@ experimental_features = { "msc3266_enabled" = true; "msc3779_enabled" = true; + "msc3401_enabled" = true; + "msc4143_enabled" = true; }; listeners = [ { diff --git a/nixos/roles/nginx.nix b/nixos/roles/nginx.nix index d61f342..e521389 100644 --- a/nixos/roles/nginx.nix +++ b/nixos/roles/nginx.nix @@ -34,7 +34,17 @@ let extraConfig = '' default_type application/json; add_header Access-Control-Allow-Origin *; - return 200 '{"m.homeserver":{"base_url":"https://matrix.cyperpunk.de"},"org.matrix.msc4143.rtc_foci":[{"type":"livekit","livekit_service_url":"https://cyperpunk.de/livekit/jwt"}]}'; + return 200 '{ + "m.homeserver":{ + "base_url":"https://matrix.cyperpunk.de" + }, + "org.matrix.msc4143.rtc_foci":[ + { + "type":"livekit", + "livekit_service_url":"https://cyperpunk.de/livekit/jwt" + } + ] + }'; ''; }; "/.well-known/matrix/server" = { @@ -102,7 +112,7 @@ in proxyPass = "http://${upstream}:8008"; proxyWebsockets = true; }; - "^~ /livekit/jwt/" = { + "^~ /livekit/jwt" = { priority = 400; proxyPass = "http://127.0.0.1:8080"; }; @@ -110,6 +120,14 @@ in priority = 400; proxyPass = "http://127.0.0.1:7880"; proxyWebsockets = true; + extraConfig = '' + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 86400s; + proxy_send_timeout 86400s; + ''; }; }; }; From a0ed95e5e7cf634c203cb85c4113a50662bf1c01 Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Mon, 27 Apr 2026 21:18:35 +0200 Subject: [PATCH 02/15] Added Livekit --- nixos/roles/matrix/clients.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/roles/matrix/clients.nix b/nixos/roles/matrix/clients.nix index 9123709..0339f70 100644 --- a/nixos/roles/matrix/clients.nix +++ b/nixos/roles/matrix/clients.nix @@ -128,6 +128,8 @@ let element_call = { url = "https://call.element.io"; use_exclusively = true; + participant_limit = 8; + brand = "Cyperpunk Call"; }; livekit = { livekit_service_url = "https://cyperpunk.de/livekit/jwt"; From 101fb29dba2b8bc85f71101bb8b0f02bed81ca1a Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Tue, 28 Apr 2026 22:25:24 +0200 Subject: [PATCH 03/15] Added Octoprint; Minor config changes; --- hosts/cyper-controller/configuration.nix | 2 +- nixos/roles/matrix/clients.nix | 32 +++++++++++- nixos/roles/matrix/synapse.nix | 1 + nixos/roles/octoprint.nix | 62 ++++++++++++++++++++++++ nixos/roles/paperless-ngx.nix | 53 +++++++++----------- secrets/secrets.yaml | 4 +- 6 files changed, 120 insertions(+), 34 deletions(-) create mode 100644 nixos/roles/octoprint.nix diff --git a/hosts/cyper-controller/configuration.nix b/hosts/cyper-controller/configuration.nix index 5d99c31..772709b 100644 --- a/hosts/cyper-controller/configuration.nix +++ b/hosts/cyper-controller/configuration.nix @@ -12,8 +12,8 @@ ../../nixos/roles/gitea.nix ../../nixos/roles/vaultwarden.nix ../../nixos/roles/frontpage - ../../nixos/roles/cage.nix ../../nixos/roles/paperless-ngx.nix + ../../nixos/roles/octoprint.nix ]; networking = { diff --git a/nixos/roles/matrix/clients.nix b/nixos/roles/matrix/clients.nix index 0339f70..2b96d04 100644 --- a/nixos/roles/matrix/clients.nix +++ b/nixos/roles/matrix/clients.nix @@ -126,7 +126,7 @@ let preferred_domain = "jitsi.cyperpunk.de"; }; element_call = { - url = "https://call.element.io"; + url = "https://element.cyperpunk.de/widgets/element-call"; use_exclusively = true; participant_limit = 8; brand = "Cyperpunk Call"; @@ -140,6 +140,7 @@ let }; features = { feature_group_calls = true; + "feature_disable_call_per_sender_encryption" = true; }; } ); @@ -148,10 +149,27 @@ let cp ${elementConfig} $out/config.json ''; }); - synapseAdmin = pkgs.synapse-admin-etkecc.withConfig { + synapseAdmin = pkgs.ketesa.withConfig { restrictBaseUrl = [ "https://matrix.cyperpunk.de" ]; loginFlows = [ "password" ]; }; + elementCallConfigured = pkgs.element-call.overrideAttrs (old: { + postInstall = (old.postInstall or "") + '' + cp ${ + builtins.toFile "element-call-config.json" ( + builtins.toJSON { + default_server_config = { + "m.homeserver" = { + base_url = "https://matrix.cyperpunk.de"; + server_name = "cyperpunk.de"; + }; + }; + livekit_service_url = "https://cyperpunk.de/livekit/jwt/"; + } + ) + } $out/config.json + ''; + }); in { @@ -160,6 +178,7 @@ in 8010 # Element 8011 # Synapse Admin 8012 # FluffyChat + 8013 # Element Call ]; services.nginx.virtualHosts = { @@ -201,6 +220,15 @@ in ]; root = "${synapseAdmin}"; }; + "element-call.cyperpunk.de" = { + listen = [ + { + addr = "0.0.0.0"; + port = 8013; + } + ]; + root = "${elementCallConfigured}"; + }; }; virtualisation.oci-containers.containers.fluffychat = { diff --git a/nixos/roles/matrix/synapse.nix b/nixos/roles/matrix/synapse.nix index 8bd271c..a96c616 100644 --- a/nixos/roles/matrix/synapse.nix +++ b/nixos/roles/matrix/synapse.nix @@ -35,6 +35,7 @@ "msc3779_enabled" = true; "msc3401_enabled" = true; "msc4143_enabled" = true; + "msc4195_enabled" = true; }; listeners = [ { diff --git a/nixos/roles/octoprint.nix b/nixos/roles/octoprint.nix new file mode 100644 index 0000000..12447ca --- /dev/null +++ b/nixos/roles/octoprint.nix @@ -0,0 +1,62 @@ +{ lib, pkgs, ... }: +let + octoprint-overlay = self: super: { + octoprint = super.octoprint.override { + packageOverrides = pyself: pysuper: { + + octoprint-customcss = pyself.buildPythonPackage { + pname = "OctoPrint-CustomCSS"; + version = "20201210"; + format = "setuptools"; + src = pkgs.fetchFromGitHub { + owner = "crankeye"; + repo = "OctoPrint-CustomCSS"; + rev = "7a042b11055592b42b59298ad8d579b731081acd"; + sha256 = "sha256-N5DjaZ2KzSi1xfmvhS8gWKAMyXz5btYqU1QSRIMkFZY="; + }; + propagatedBuildInputs = [ pysuper.octoprint ]; + doCheck = false; + meta = with lib; { + description = "A simple plugin for adding custom CSS to OctoPrint"; + homepage = "https://github.com/crankeye/OctoPrint-CustomCSS"; + license = licenses.agpl3Only; + }; + }; + + octoprint-bedlevelvisualizer = pyself.buildPythonPackage { + pname = "OctoPrint-BedLevelVisualizer"; + version = "1.1.1"; + format = "setuptools"; + src = pkgs.fetchFromGitHub { + owner = "jneilliii"; + repo = "OctoPrint-BedLevelVisualizer"; + rev = "1.1.1"; + sha256 = "1v7gqyp605z3hyc1w8a2h6ir6k0vp2ccby1wwxlri6h4i2yii5z8"; + }; + propagatedBuildInputs = [ pysuper.octoprint ]; + doCheck = false; + meta = with lib; { + description = "Visualize your bed leveling via a 3D mesh"; + homepage = "https://github.com/jneilliii/OctoPrint-BedLevelVisualizer"; + license = licenses.mit; + }; + }; + + }; + }; + }; +in +{ + nixpkgs.overlays = [ octoprint-overlay ]; + services.octoprint = { + enable = true; + host = "0.0.0.0"; + openFirewall = true; + port = 5000; + plugins = + ps: with ps; [ + octoprint-customcss + octoprint-bedlevelvisualizer + ]; + }; +} diff --git a/nixos/roles/paperless-ngx.nix b/nixos/roles/paperless-ngx.nix index 0f83219..ee3e22d 100644 --- a/nixos/roles/paperless-ngx.nix +++ b/nixos/roles/paperless-ngx.nix @@ -1,37 +1,31 @@ { pkgs, ... }: - { - services.paperless = { - enable = true; - package = pkgs.paperless-ngx; - address = "0.0.0.0"; - port = 28101; - settings = { + services = { + paperless = { + enable = true; + package = pkgs.paperless-ngx; + address = "0.0.0.0"; + port = 28101; + settings = { + PAPERLESS_USE_X_FORWARDED_HOST = "true"; + PAPERLESS_USE_X_FORWARDED_PORT = "true"; + PAPERLESS_ALLOWED_HOSTS = "ngx.cyperpunk.de,100.109.179.25,localhost"; + PAPERLESS_CSRF_TRUSTED_ORIGINS = [ + "https://ngx.cyperpunk.de" + "http://100.109.179.25:28101" + ]; + PAPERLESS_OCR_LANGUAGE = "deu+eng"; + PAPERLESS_CONSUMPTION_DIR = "/var/lib/paperless/consume"; + PAPERLESS_URL = "https://ngx.cyperpunk.de"; + }; - # Da der Proxy auf einem anderen Server (via Tailscale) liegt: - # Erlaubt Paperless, die 'X-Forwarded-*' Header zu akzeptieren - PAPERLESS_USE_X_FORWARDED_HOST = "true"; - PAPERLESS_USE_X_FORWARDED_PORT = "true"; - - # Erlaubt den Zugriff über die Domain UND die Tailscale-IP - # Der Stern '*' ist die einfachste Lösung für private Server - PAPERLESS_ALLOWED_HOSTS = "ngx.cyperpunk.de,100.109.179.25,localhost"; - - # Füge die IP auch zu den vertrauenswürdigen Ursprüngen hinzu (für CSRF) - PAPERLESS_CSRF_TRUSTED_ORIGINS = [ - "https://ngx.cyperpunk.de" - "http://100.109.179.25:28101" - ]; - - # Restliche Einstellungen bleiben gleich - PAPERLESS_OCR_LANGUAGE = "deu+eng"; - PAPERLESS_CONSUMPTION_DIR = "/var/lib/paperless/consume"; # Falls du den Bind-Mount nutzt - PAPERLESS_URL = "https://ngx.cyperpunk.de"; + exporter = { + enable = true; + }; }; }; - # Gruppe und Berechtigungen wie besprochen users.users.paperless.extraGroups = [ "users" ]; systemd.tmpfiles.rules = [ @@ -39,6 +33,7 @@ "z /storage/internal/paperless 0775 root users -" ]; - # Öffne den Port für Tailscale (oder das lokale Netz) - networking.firewall.allowedTCPPorts = [ 28101 ]; + networking.firewall.allowedTCPPorts = [ + 28101 + ]; } diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 956759d..00081f3 100644 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -25,7 +25,7 @@ sops: N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9 6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-25T01:01:15Z" - mac: ENC[AES256_GCM,data:LEoQilJrVhhzLdAyMz2xugOlnsu1j3XyCJbRLnMpRivbOFlqOu9dvwAJJ8gDzizOxTwh/24YD14f+njdPGNSB42O9sD9Mcb9UdB3N2pzHNaaUYQXFDHdqfxTQ93sYkwOP4KZHbMgbtzb1a/1a+G2cLhBcmIZSdOdkAzcVwUVmVY=,iv:D9xDKS2X6AiJi61/a/YbU+DvhTq5XB30HvE85i5lGvo=,tag:ztDsyGvk4KhBa6NJdOqhGg==,type:str] + lastmodified: "2026-04-28T20:24:56Z" + mac: ENC[AES256_GCM,data:ckUMW2VucN8foLbSk8iKBHOtIOSFi0eOy4d0unLlJZpaKEFO91UofHN00Gh+sfw3jG0VNRWGUhAGxQC+di4LFbITlODPkWOzY10FMAES5FSQVyKkW9gnQY/BGbHlDX63iwZ9FLQEbCg4LSVA1emVlCmZ5QEYy5bBH7LddNdnEbo=,iv:u9akYdHujAuFoSAv0Q7rcsSAn5PJZhBhkKjrBWn0XBg=,tag:GvN2Kgi2+5bTZ7t/tZASRw==,type:str] unencrypted_suffix: _unencrypted version: 3.12.2 From 3dc398a460bbf34341d9c603706d9591bf98fd94 Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Tue, 28 Apr 2026 22:29:16 +0200 Subject: [PATCH 04/15] Added DNSUtils --- home/shell.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/home/shell.nix b/home/shell.nix index 90af6dc..ab21f82 100644 --- a/home/shell.nix +++ b/home/shell.nix @@ -15,6 +15,7 @@ fd # find alternative bat # cat alternative ripgrep # grep alternative + dnsutils # LLM in the Terminal (pkgs.llm.withPlugins { llm-groq = true; }) From d46ce2d93eb1bf7183b3cdf4c693b3415a1ef742 Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Tue, 28 Apr 2026 22:30:31 +0200 Subject: [PATCH 05/15] WIP: Livekit; added ngx.cyperpunk.de host --- hosts/cyper-proxy/configuration.nix | 7 +++++++ nixos/roles/livekit.nix | 3 ++- nixos/roles/nginx.nix | 11 +++++++---- 3 files changed, 16 insertions(+), 5 deletions(-) diff --git a/hosts/cyper-proxy/configuration.nix b/hosts/cyper-proxy/configuration.nix index 75f2ddd..0436356 100644 --- a/hosts/cyper-proxy/configuration.nix +++ b/hosts/cyper-proxy/configuration.nix @@ -29,6 +29,13 @@ 443 ]; + hosts = { + "178.254.8.35" = [ + "cyperpunk.de" + "matrix.cyperpunk.de" + ]; + }; + }; system.stateVersion = "26.05"; diff --git a/nixos/roles/livekit.nix b/nixos/roles/livekit.nix index c5c8a71..bf2dbf2 100644 --- a/nixos/roles/livekit.nix +++ b/nixos/roles/livekit.nix @@ -34,8 +34,9 @@ in lk-jwt-service = { enable = true; - livekitUrl = "ws://127.0.0.1:7880"; + #livekitUrl = "wss://cyperpunk.de/livekit/sfu"; inherit keyFile; + livekitUrl = "wss://127.0.0.1:7880"; }; }; diff --git a/nixos/roles/nginx.nix b/nixos/roles/nginx.nix index e521389..f96e7ba 100644 --- a/nixos/roles/nginx.nix +++ b/nixos/roles/nginx.nix @@ -78,6 +78,7 @@ in "git.cyperpunk.de" = mkProxy 9000; "search.cyperpunk.de" = mkProxy 11080; "file.cyperpunk.de" = mkProxy 10000; + "ngx.cyperpunk.de" = mkWsProxy 28101; "vault.cyperpunk.de" = mkWsProxy 8222; "fluffy.cyperpunk.de" = mkWsProxy 8012; @@ -100,6 +101,7 @@ in "calvin.cyperpunk.de" = mkWsProxy 15006; "cinny.cyperpunk.de" = mkWsProxy 8009; "element.cyperpunk.de" = mkWsProxy 8010; + "element-call.cyperpunk.de" = mkWsProxy 8013; "cyperpunk.de" = { forceSSL = true; @@ -112,13 +114,13 @@ in proxyPass = "http://${upstream}:8008"; proxyWebsockets = true; }; - "^~ /livekit/jwt" = { + "^~ /livekit/jwt/" = { priority = 400; - proxyPass = "http://127.0.0.1:8080"; + proxyPass = "http://127.0.0.1:8080/"; }; - "^~ /livekit/sfu" = { + "^~ /livekit/sfu/" = { priority = 400; - proxyPass = "http://127.0.0.1:7880"; + proxyPass = "http://127.0.0.1:7880/"; proxyWebsockets = true; extraConfig = '' proxy_set_header Host $host; @@ -127,6 +129,7 @@ in proxy_set_header X-Forwarded-Proto $scheme; proxy_read_timeout 86400s; proxy_send_timeout 86400s; + ''; }; }; From d824b42a2b6c18005dd530a07f992c6f827703ce Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Tue, 28 Apr 2026 23:22:41 +0200 Subject: [PATCH 06/15] Hardened Paperless --- nixos/roles/paperless-ngx.nix | 68 ++++++++++++++++++++--------------- secrets/secrets.yaml | 5 +-- 2 files changed, 42 insertions(+), 31 deletions(-) diff --git a/nixos/roles/paperless-ngx.nix b/nixos/roles/paperless-ngx.nix index ee3e22d..e7bf250 100644 --- a/nixos/roles/paperless-ngx.nix +++ b/nixos/roles/paperless-ngx.nix @@ -1,39 +1,49 @@ -{ pkgs, ... }: +{ config, ... }: { - services = { - paperless = { - enable = true; - package = pkgs.paperless-ngx; - address = "0.0.0.0"; - port = 28101; - settings = { - PAPERLESS_USE_X_FORWARDED_HOST = "true"; - PAPERLESS_USE_X_FORWARDED_PORT = "true"; - PAPERLESS_ALLOWED_HOSTS = "ngx.cyperpunk.de,100.109.179.25,localhost"; - PAPERLESS_CSRF_TRUSTED_ORIGINS = [ - "https://ngx.cyperpunk.de" - "http://100.109.179.25:28101" - ]; - PAPERLESS_OCR_LANGUAGE = "deu+eng"; - PAPERLESS_CONSUMPTION_DIR = "/var/lib/paperless/consume"; - PAPERLESS_URL = "https://ngx.cyperpunk.de"; - }; + sops.secrets.paperless_admin = { + owner = "paperless"; + }; + services.paperless = { + enable = true; + address = "0.0.0.0"; + port = 28101; + domain = "ngx.cyperpunk.de"; + consumptionDir = "/var/lib/paperless/consume"; + dataDir = "/storage/fast/paperless"; + configureTika = true; + passwordFile = config.sops.secrets.paperless_admin.path; + settings = { + PAPERLESS_USE_X_FORWARDED_HOST = true; + PAPERLESS_USE_X_FORWARDED_PORT = true; + PAPERLESS_ALLOWED_HOSTS = "ngx.cyperpunk.de,100.109.179.25,localhost"; + PAPERLESS_CSRF_TRUSTED_ORIGINS = [ + "https://ngx.cyperpunk.de" + "http://100.109.179.25:28101" + ]; + PAPERLESS_OCR_LANGUAGE = "deu+eng"; + }; - exporter = { - enable = true; - }; + exporter = { + enable = true; + directory = "/storage/backup/paperless"; }; }; users.users.paperless.extraGroups = [ "users" ]; - systemd.tmpfiles.rules = [ - "d /storage/internal/paperless 0775 root users -" - "z /storage/internal/paperless 0775 root users -" - ]; + systemd = { + tmpfiles.rules = [ + "d /storage/fast/paperless 0775 paperless paperless -" + "d /storage/fast/paperless/media 0775 paperless paperless -" + "d /storage/fast/paperless/consume 0775 paperless paperless -" + "d /storage/backup/paperless 0775 root users -" + ]; - networking.firewall.allowedTCPPorts = [ - 28101 - ]; + services.paperless-scheduler = { + after = [ "systemd-tmpfiles-setup.service" ]; + requires = [ "systemd-tmpfiles-setup.service" ]; + }; + }; + networking.firewall.allowedTCPPorts = [ 28101 ]; } diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 00081f3..0a044df 100644 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -7,6 +7,7 @@ matrix_registration_secret: ENC[AES256_GCM,data:KhKkJZqwE8xk4/tuQ7NYTv/Ot1qCAiy8 vaultwarden_admin_token: ENC[AES256_GCM,data:yoBs4CaIEJXB5b3PEwTpXFgxpX39hR9A4r9yamwDV7cTSRRp3n3O2VjDKTcI5Vo6RP2QUjcqUqYf98cZ09wDMc+6+oHHJke7+O0FgRgOC0vOQFs4bfZCBJBLxogrGiwtLGkyykR6VYhrT64AN3CbrXflj82OED2Hl8WwEdruBzGIcfnh6FqQowDx6vDR/kXXJHk=,iv:PJQo5V7FaKPQ+GzZNsy3KB+xyjcDKJ1UBHErrqgn/1U=,tag:BRIDJEDOAeToqio/DHMQaA==,type:str] flame_phil_password: ENC[AES256_GCM,data:Xy2ixMeRlnzC2gjKGrjfSbz/ee4=,iv:WFuBS8jn7WYRxEDG3XBzCMnm4eNkHQpSs5+GUwq/dcg=,tag:1zzj0eB9/4KrmYAqcxJMlg==,type:str] flame_calvin_password: ENC[AES256_GCM,data:P5ppyqTjAJ1TL4hXtx5WyoS9a+g=,iv:sq98P3Oqud2FXfqsD76YS/p5NEF2xlN0MfG+ukCB9B0=,tag:AeKnu4Hg4xQ3tII0y6oNpQ==,type:str] +paperless_admin: ENC[AES256_GCM,data:sVvlMQ3dDE2XsDfpwpCTbzPCEKdUMNTFtRXDIuBbgyf1gd6oiJzE23Ytc57plNUGg5h5aEtgxZ7NXeuK5vrhQw==,iv:x+QNAzY9k9t23UYlM9GcAke0urEA5jlV0VzHaBQkm7M=,tag:D/bMtjuwrX6pquZfJLwdkQ==,type:str] gitea: dbPassword: ENC[AES256_GCM,data:S6VvRgkdYk1AzXljyQEEq68UJ9zrFy6+INBMIAspXNcqcM6o+es19o0mcXA=,iv:/pHYpkZZq+9Md+75uSCb2YXfSvaDzUh6mMfH53wb7eg=,tag:ZnbyCQwrK2JnbO5HFqgJYw==,type:str] internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str] @@ -25,7 +26,7 @@ sops: N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9 6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-28T20:24:56Z" - mac: ENC[AES256_GCM,data:ckUMW2VucN8foLbSk8iKBHOtIOSFi0eOy4d0unLlJZpaKEFO91UofHN00Gh+sfw3jG0VNRWGUhAGxQC+di4LFbITlODPkWOzY10FMAES5FSQVyKkW9gnQY/BGbHlDX63iwZ9FLQEbCg4LSVA1emVlCmZ5QEYy5bBH7LddNdnEbo=,iv:u9akYdHujAuFoSAv0Q7rcsSAn5PJZhBhkKjrBWn0XBg=,tag:GvN2Kgi2+5bTZ7t/tZASRw==,type:str] + lastmodified: "2026-04-28T20:56:41Z" + mac: ENC[AES256_GCM,data:7LzlnFm2R7YFtZ2Nei/uOG2G/VSGcN3KQtTZSUM+TKvPXgCcFXa/ZF8u4WtoXSJOiVTJ9gQ2wvtKjW8OPtd4ALGId33dM4fapB9fl3LTF9hgVpu01s5kIkYKPf1bRZ8vpsFzMUoPDUHXgIlTgobf9dTxeyu6utBrM9+7AHCQxV4=,iv:LYgDr+10bXmk9Jg0oyvfr3jty4Y7GeFDuUMkjsXYzXs=,tag:/553lafJUjOdUrljLYd2Wg==,type:str] unencrypted_suffix: _unencrypted version: 3.12.2 From a48b6b60d48c47fa94ef3971c964e6269a1eaf31 Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Tue, 28 Apr 2026 23:40:38 +0200 Subject: [PATCH 07/15] Added SMB Paperless Share --- hosts/cyper-controller/smb.nix | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/hosts/cyper-controller/smb.nix b/hosts/cyper-controller/smb.nix index 71ab463..9cbb4d9 100644 --- a/hosts/cyper-controller/smb.nix +++ b/hosts/cyper-controller/smb.nix @@ -59,6 +59,18 @@ "valid users" = primaryUser; "force user" = primaryUser; }; + + paperless-consume = { + "path" = "/storage/fast/paperless/consume"; + "comment" = "Paperless incoming documents"; + "browseable" = "yes"; + "read only" = "no"; + "valid users" = primaryUser; + "create mask" = "0664"; + "directory mask" = "0775"; + "force user" = "paperless"; + "force group" = "paperless"; + }; }; }; From 59907f7ece32cb159bddfd96527224fbda58f60c Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Thu, 30 Apr 2026 13:22:20 +0200 Subject: [PATCH 08/15] WIP: Livekit --- hosts/cyper-proxy/configuration.nix | 2 +- nixos/roles/livekit.nix | 68 ----------------------------- nixos/roles/matrix/clients.nix | 4 +- nixos/roles/matrix/default.nix | 2 +- nixos/roles/matrix/livekit.nix | 30 +++++++++++++ nixos/roles/matrix/lk-jwt.nix | 19 ++++++++ nixos/roles/matrix/synapse.nix | 1 + nixos/roles/nginx.nix | 4 +- 8 files changed, 56 insertions(+), 74 deletions(-) delete mode 100644 nixos/roles/livekit.nix create mode 100644 nixos/roles/matrix/livekit.nix create mode 100644 nixos/roles/matrix/lk-jwt.nix diff --git a/hosts/cyper-proxy/configuration.nix b/hosts/cyper-proxy/configuration.nix index 0436356..2439248 100644 --- a/hosts/cyper-proxy/configuration.nix +++ b/hosts/cyper-proxy/configuration.nix @@ -3,7 +3,7 @@ imports = [ ./hardware-configuration.nix ../../nixos/roles/nginx.nix - ../../nixos/roles/livekit.nix + ../../nixos/roles/matrix/livekit.nix ../../nixos/roles/jitsi.nix ]; diff --git a/nixos/roles/livekit.nix b/nixos/roles/livekit.nix deleted file mode 100644 index bf2dbf2..0000000 --- a/nixos/roles/livekit.nix +++ /dev/null @@ -1,68 +0,0 @@ -{ pkgs, ... }: -let - keyFile = "/run/livekit/livekit.key"; - domain = "cyperpunk.de"; - synapseUrl = "http://100.109.179.25:8008"; -in -{ - services = { - livekit = { - enable = true; - openFirewall = true; - inherit keyFile; - settings = { - rtc = { - tcp_port = 7881; - udp_port = 7882; - port_range_start = 50000; - port_range_end = 60000; - use_external_ip = true; - node_ip = "178.254.8.35"; - }; - room = { - auto_create = false; - enabled_codecs = [ - { mime = "video/VP8"; } - { mime = "video/VP9"; } - { mime = "video/H264"; } - { mime = "audio/opus"; } - ]; - enable_remote_unmute = true; - }; - }; - }; - - lk-jwt-service = { - enable = true; - #livekitUrl = "wss://cyperpunk.de/livekit/sfu"; - inherit keyFile; - livekitUrl = "wss://127.0.0.1:7880"; - }; - }; - - systemd.services = { - livekit-key = { - before = [ - "lk-jwt-service.service" - "livekit.service" - ]; - wantedBy = [ "multi-user.target" ]; - path = with pkgs; [ - livekit - coreutils - gawk - ]; - script = '' - mkdir -p /run/livekit - echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${keyFile}" - ''; - serviceConfig.Type = "oneshot"; - unitConfig.ConditionPathExists = "!${keyFile}"; - }; - - lk-jwt-service.environment = { - LIVEKIT_FULL_ACCESS_HOMESERVERS = domain; - MATRIX_BASE_URL = synapseUrl; - }; - }; -} diff --git a/nixos/roles/matrix/clients.nix b/nixos/roles/matrix/clients.nix index 2b96d04..797728e 100644 --- a/nixos/roles/matrix/clients.nix +++ b/nixos/roles/matrix/clients.nix @@ -126,13 +126,13 @@ let preferred_domain = "jitsi.cyperpunk.de"; }; element_call = { - url = "https://element.cyperpunk.de/widgets/element-call"; + url = "https://element-call.cyperpunk.de"; use_exclusively = true; participant_limit = 8; brand = "Cyperpunk Call"; }; livekit = { - livekit_service_url = "https://cyperpunk.de/livekit/jwt"; + livekit_service_url = "https://cyperpunk.de/livekit/jwt/"; }; setting_defaults = { custom_themes = catppuccinThemes; diff --git a/nixos/roles/matrix/default.nix b/nixos/roles/matrix/default.nix index 6e5b359..5a89637 100644 --- a/nixos/roles/matrix/default.nix +++ b/nixos/roles/matrix/default.nix @@ -4,8 +4,8 @@ { imports = [ ./synapse.nix - # ./coturn.nix ./clients.nix + ./lk-jwt.nix ]; #networking.firewall = { diff --git a/nixos/roles/matrix/livekit.nix b/nixos/roles/matrix/livekit.nix new file mode 100644 index 0000000..a4d243d --- /dev/null +++ b/nixos/roles/matrix/livekit.nix @@ -0,0 +1,30 @@ +{ config, ... }: +{ + sops.secrets.livekit_key = { }; + + services.livekit = { + enable = true; + openFirewall = true; + keyFile = config.sops.secrets.livekit_key.path; + settings = { + rtc = { + tcp_port = 7881; + udp_port = 7882; + port_range_start = 50000; + port_range_end = 60000; + use_external_ip = true; + node_ip = "178.254.8.35"; + }; + room = { + auto_create = false; + enabled_codecs = [ + { mime = "video/VP8"; } + { mime = "video/VP9"; } + { mime = "video/H264"; } + { mime = "audio/opus"; } + ]; + enable_remote_unmute = true; + }; + }; + }; +} diff --git a/nixos/roles/matrix/lk-jwt.nix b/nixos/roles/matrix/lk-jwt.nix new file mode 100644 index 0000000..fa06b39 --- /dev/null +++ b/nixos/roles/matrix/lk-jwt.nix @@ -0,0 +1,19 @@ +{ config, ... }: +let + domain = "cyperpunk.de"; + synapseUrl = "http://100.109.179.25:8008"; +in +{ + sops.secrets.livekit_key = { }; + + services.lk-jwt-service = { + enable = true; + keyFile = config.sops.secrets.livekit_key.path; + livekitUrl = "wss://cyperpunk.de/livekit/sfu"; + }; + + systemd.services.lk-jwt-service.environment = { + LIVEKIT_FULL_ACCESS_HOMESERVERS = domain; + MATRIX_BASE_URL = synapseUrl; + }; +} diff --git a/nixos/roles/matrix/synapse.nix b/nixos/roles/matrix/synapse.nix index a96c616..e6e5497 100644 --- a/nixos/roles/matrix/synapse.nix +++ b/nixos/roles/matrix/synapse.nix @@ -49,6 +49,7 @@ names = [ "client" "federation" + "openid" ]; compress = false; } diff --git a/nixos/roles/nginx.nix b/nixos/roles/nginx.nix index f96e7ba..00a7162 100644 --- a/nixos/roles/nginx.nix +++ b/nixos/roles/nginx.nix @@ -41,7 +41,7 @@ let "org.matrix.msc4143.rtc_foci":[ { "type":"livekit", - "livekit_service_url":"https://cyperpunk.de/livekit/jwt" + "livekit_service_url":"https://cyperpunk.de/livekit/jwt/" } ] }'; @@ -116,7 +116,7 @@ in }; "^~ /livekit/jwt/" = { priority = 400; - proxyPass = "http://127.0.0.1:8080/"; + proxyPass = "http://${upstream}:8080/"; }; "^~ /livekit/sfu/" = { priority = 400; From 4590eca1bd259e8488210217bca615a8c1548484 Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Thu, 30 Apr 2026 13:24:02 +0200 Subject: [PATCH 09/15] WIP: livekit --- nixos/roles/paperless-ngx.nix | 3 ++- secrets/secrets.yaml | 5 +++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/nixos/roles/paperless-ngx.nix b/nixos/roles/paperless-ngx.nix index e7bf250..387c59e 100644 --- a/nixos/roles/paperless-ngx.nix +++ b/nixos/roles/paperless-ngx.nix @@ -9,7 +9,7 @@ address = "0.0.0.0"; port = 28101; domain = "ngx.cyperpunk.de"; - consumptionDir = "/var/lib/paperless/consume"; + consumptionDir = "/storage/fast/paperless/consume"; dataDir = "/storage/fast/paperless"; configureTika = true; passwordFile = config.sops.secrets.paperless_admin.path; @@ -22,6 +22,7 @@ "http://100.109.179.25:28101" ]; PAPERLESS_OCR_LANGUAGE = "deu+eng"; + PAPERLESS_CONSUMER_POLLING = 60; }; exporter = { diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 0a044df..03f650a 100644 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -8,6 +8,7 @@ vaultwarden_admin_token: ENC[AES256_GCM,data:yoBs4CaIEJXB5b3PEwTpXFgxpX39hR9A4r9 flame_phil_password: ENC[AES256_GCM,data:Xy2ixMeRlnzC2gjKGrjfSbz/ee4=,iv:WFuBS8jn7WYRxEDG3XBzCMnm4eNkHQpSs5+GUwq/dcg=,tag:1zzj0eB9/4KrmYAqcxJMlg==,type:str] flame_calvin_password: ENC[AES256_GCM,data:P5ppyqTjAJ1TL4hXtx5WyoS9a+g=,iv:sq98P3Oqud2FXfqsD76YS/p5NEF2xlN0MfG+ukCB9B0=,tag:AeKnu4Hg4xQ3tII0y6oNpQ==,type:str] paperless_admin: ENC[AES256_GCM,data:sVvlMQ3dDE2XsDfpwpCTbzPCEKdUMNTFtRXDIuBbgyf1gd6oiJzE23Ytc57plNUGg5h5aEtgxZ7NXeuK5vrhQw==,iv:x+QNAzY9k9t23UYlM9GcAke0urEA5jlV0VzHaBQkm7M=,tag:D/bMtjuwrX6pquZfJLwdkQ==,type:str] +livekit_key: ENC[AES256_GCM,data:h5iDET2DrIgudFVIRSzVvQ701urpww/kcXhR7X+GMHjwTZwCLkaC5NmO83Q4e7hM+OIagO8gmoJ2MBWe85sJCw==,iv:LO3WIRurr5t3U6PFKCpMXlKrAXGJOCb9EYT3FBxOYFo=,tag:KLl+qBfTLwAnDr7MHcQg3w==,type:str] gitea: dbPassword: ENC[AES256_GCM,data:S6VvRgkdYk1AzXljyQEEq68UJ9zrFy6+INBMIAspXNcqcM6o+es19o0mcXA=,iv:/pHYpkZZq+9Md+75uSCb2YXfSvaDzUh6mMfH53wb7eg=,tag:ZnbyCQwrK2JnbO5HFqgJYw==,type:str] internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str] @@ -26,7 +27,7 @@ sops: N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9 6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-28T20:56:41Z" - mac: ENC[AES256_GCM,data:7LzlnFm2R7YFtZ2Nei/uOG2G/VSGcN3KQtTZSUM+TKvPXgCcFXa/ZF8u4WtoXSJOiVTJ9gQ2wvtKjW8OPtd4ALGId33dM4fapB9fl3LTF9hgVpu01s5kIkYKPf1bRZ8vpsFzMUoPDUHXgIlTgobf9dTxeyu6utBrM9+7AHCQxV4=,iv:LYgDr+10bXmk9Jg0oyvfr3jty4Y7GeFDuUMkjsXYzXs=,tag:/553lafJUjOdUrljLYd2Wg==,type:str] + lastmodified: "2026-04-30T11:23:51Z" + mac: ENC[AES256_GCM,data:uN7xSSiy9fDdfFoGjYHyXaRg5eR2CJiW5mDH6OSoKPccZ/MjnA8KCVmdIZplKfQBEuQvxeGHHp2SnnNbEoEdu2tXNdv7eVh1IR4KITPjzHxAjjsOckozajcENF0EWC6uv+Ca3HDU61mC86cpnA6Te9dlk9g9oZ5IDKhQSbKTLVA=,iv:CCdkBQgiZZKf2obQjPGpT+5ltf+ahvDNJjl5xk5xw24=,tag:wOh92+4io+2vKyogkOffGw==,type:str] unencrypted_suffix: _unencrypted version: 3.12.2 From 35598f777b5ce9f7d369911bac91dc0045e3a32d Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Thu, 30 Apr 2026 13:45:34 +0200 Subject: [PATCH 10/15] WIP: livekit --- nixos/roles/matrix/livekit.nix | 4 ++-- nixos/roles/matrix/lk-jwt.nix | 17 +++++++++++------ nixos/roles/nginx.nix | 2 +- secrets/secrets.yaml | 7 ++++--- 4 files changed, 18 insertions(+), 12 deletions(-) diff --git a/nixos/roles/matrix/livekit.nix b/nixos/roles/matrix/livekit.nix index a4d243d..cf52061 100644 --- a/nixos/roles/matrix/livekit.nix +++ b/nixos/roles/matrix/livekit.nix @@ -1,11 +1,11 @@ { config, ... }: { - sops.secrets.livekit_key = { }; + sops.secrets.livekit_key_sfu = { }; services.livekit = { enable = true; openFirewall = true; - keyFile = config.sops.secrets.livekit_key.path; + keyFile = config.sops.secrets.livekit_key_sfu.path; settings = { rtc = { tcp_port = 7881; diff --git a/nixos/roles/matrix/lk-jwt.nix b/nixos/roles/matrix/lk-jwt.nix index fa06b39..7ce3978 100644 --- a/nixos/roles/matrix/lk-jwt.nix +++ b/nixos/roles/matrix/lk-jwt.nix @@ -1,19 +1,24 @@ -{ config, ... }: +{ config, lib, ... }: let domain = "cyperpunk.de"; synapseUrl = "http://100.109.179.25:8008"; in { - sops.secrets.livekit_key = { }; + sops.secrets.livekit_key_jwt = { }; + + networking.firewall.allowedTCPPorts = [ 18080 ]; services.lk-jwt-service = { enable = true; - keyFile = config.sops.secrets.livekit_key.path; + keyFile = config.sops.secrets.livekit_key_jwt.path; livekitUrl = "wss://cyperpunk.de/livekit/sfu"; }; - systemd.services.lk-jwt-service.environment = { - LIVEKIT_FULL_ACCESS_HOMESERVERS = domain; - MATRIX_BASE_URL = synapseUrl; + systemd.services.lk-jwt-service = { + environment = { + LIVEKIT_FULL_ACCESS_HOMESERVERS = domain; + MATRIX_BASE_URL = synapseUrl; + LIVEKIT_JWT_BIND = lib.mkForce ":18080"; + }; }; } diff --git a/nixos/roles/nginx.nix b/nixos/roles/nginx.nix index 00a7162..304c3fe 100644 --- a/nixos/roles/nginx.nix +++ b/nixos/roles/nginx.nix @@ -116,7 +116,7 @@ in }; "^~ /livekit/jwt/" = { priority = 400; - proxyPass = "http://${upstream}:8080/"; + proxyPass = "http://${upstream}:18080/"; }; "^~ /livekit/sfu/" = { priority = 400; diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 03f650a..120a54f 100644 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -8,7 +8,8 @@ vaultwarden_admin_token: ENC[AES256_GCM,data:yoBs4CaIEJXB5b3PEwTpXFgxpX39hR9A4r9 flame_phil_password: ENC[AES256_GCM,data:Xy2ixMeRlnzC2gjKGrjfSbz/ee4=,iv:WFuBS8jn7WYRxEDG3XBzCMnm4eNkHQpSs5+GUwq/dcg=,tag:1zzj0eB9/4KrmYAqcxJMlg==,type:str] flame_calvin_password: ENC[AES256_GCM,data:P5ppyqTjAJ1TL4hXtx5WyoS9a+g=,iv:sq98P3Oqud2FXfqsD76YS/p5NEF2xlN0MfG+ukCB9B0=,tag:AeKnu4Hg4xQ3tII0y6oNpQ==,type:str] paperless_admin: ENC[AES256_GCM,data:sVvlMQ3dDE2XsDfpwpCTbzPCEKdUMNTFtRXDIuBbgyf1gd6oiJzE23Ytc57plNUGg5h5aEtgxZ7NXeuK5vrhQw==,iv:x+QNAzY9k9t23UYlM9GcAke0urEA5jlV0VzHaBQkm7M=,tag:D/bMtjuwrX6pquZfJLwdkQ==,type:str] -livekit_key: ENC[AES256_GCM,data:h5iDET2DrIgudFVIRSzVvQ701urpww/kcXhR7X+GMHjwTZwCLkaC5NmO83Q4e7hM+OIagO8gmoJ2MBWe85sJCw==,iv:LO3WIRurr5t3U6PFKCpMXlKrAXGJOCb9EYT3FBxOYFo=,tag:KLl+qBfTLwAnDr7MHcQg3w==,type:str] +livekit_key_sfu: ENC[AES256_GCM,data:3pRAN0Vz134mg/omkSRlC9OAvToQg42aZbXj7TurYYOLUMnW6sWk+eexyIcYAAjCSP5GRES4WySuN/qjGeUDBKr8OYAxTXjR/w==,iv:NYhcfiKlXT3v5R4djkhHusMMRYgc3bCM66VD0G2MyME=,tag:8341ntSCmteTn+6AM0xu8g==,type:str] +livekit_key_jwt: ENC[AES256_GCM,data:G8IDQoAFpibI7Rs0dTPj7kLj9RogPRpufiq6GMCSFhGYtscTrDlsGOu5+hq0hP487QHnCEMZIUPOcKxy54ktdW2SQKyUDP/qc037o0eFqjI=,iv:iss3/VN0/mbkWujwRsv1+/IIFQ9hVxOg5FVV8A5kl2o=,tag:geLyPYH2iHxcRLUtruUAJg==,type:str] gitea: dbPassword: ENC[AES256_GCM,data:S6VvRgkdYk1AzXljyQEEq68UJ9zrFy6+INBMIAspXNcqcM6o+es19o0mcXA=,iv:/pHYpkZZq+9Md+75uSCb2YXfSvaDzUh6mMfH53wb7eg=,tag:ZnbyCQwrK2JnbO5HFqgJYw==,type:str] internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str] @@ -27,7 +28,7 @@ sops: N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9 6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-30T11:23:51Z" - mac: ENC[AES256_GCM,data:uN7xSSiy9fDdfFoGjYHyXaRg5eR2CJiW5mDH6OSoKPccZ/MjnA8KCVmdIZplKfQBEuQvxeGHHp2SnnNbEoEdu2tXNdv7eVh1IR4KITPjzHxAjjsOckozajcENF0EWC6uv+Ca3HDU61mC86cpnA6Te9dlk9g9oZ5IDKhQSbKTLVA=,iv:CCdkBQgiZZKf2obQjPGpT+5ltf+ahvDNJjl5xk5xw24=,tag:wOh92+4io+2vKyogkOffGw==,type:str] + lastmodified: "2026-04-30T11:36:37Z" + mac: ENC[AES256_GCM,data:CIRG016ew09deYXENzus8L1abAjpBnKMrziezorwsceFG5I59ch7OJn7edYyr+VaVPrjBb3JeNShC/Ks1Pq7cwl4MGlAyheCpfE1IcFFMK2r0ldvAqgAWZhqLM7QbyQbC9Gkbi95TiMiTgQ8RQRk6RZPEWdBPecLcARLoj9PbcQ=,iv:iAqWDjqy9xZ/xh1n94zWUXiMmqEX9PH0QEFSv6y0Onc=,tag:VJauyqv4HByK3Kq84QI8sQ==,type:str] unencrypted_suffix: _unencrypted version: 3.12.2 From 5cee5f217ef67baea0f99d2a593f80c54465acdb Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Thu, 30 Apr 2026 14:21:32 +0200 Subject: [PATCH 11/15] WIP: livekit --- nixos/roles/matrix/lk-jwt.nix | 2 +- secrets/secrets.yaml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/nixos/roles/matrix/lk-jwt.nix b/nixos/roles/matrix/lk-jwt.nix index 7ce3978..76c6482 100644 --- a/nixos/roles/matrix/lk-jwt.nix +++ b/nixos/roles/matrix/lk-jwt.nix @@ -11,7 +11,7 @@ in services.lk-jwt-service = { enable = true; keyFile = config.sops.secrets.livekit_key_jwt.path; - livekitUrl = "wss://cyperpunk.de/livekit/sfu"; + livekitUrl = "ws://100.109.10.91:7880"; }; systemd.services.lk-jwt-service = { diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 120a54f..bec4e10 100644 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -9,7 +9,7 @@ flame_phil_password: ENC[AES256_GCM,data:Xy2ixMeRlnzC2gjKGrjfSbz/ee4=,iv:WFuBS8j flame_calvin_password: ENC[AES256_GCM,data:P5ppyqTjAJ1TL4hXtx5WyoS9a+g=,iv:sq98P3Oqud2FXfqsD76YS/p5NEF2xlN0MfG+ukCB9B0=,tag:AeKnu4Hg4xQ3tII0y6oNpQ==,type:str] paperless_admin: ENC[AES256_GCM,data:sVvlMQ3dDE2XsDfpwpCTbzPCEKdUMNTFtRXDIuBbgyf1gd6oiJzE23Ytc57plNUGg5h5aEtgxZ7NXeuK5vrhQw==,iv:x+QNAzY9k9t23UYlM9GcAke0urEA5jlV0VzHaBQkm7M=,tag:D/bMtjuwrX6pquZfJLwdkQ==,type:str] livekit_key_sfu: ENC[AES256_GCM,data:3pRAN0Vz134mg/omkSRlC9OAvToQg42aZbXj7TurYYOLUMnW6sWk+eexyIcYAAjCSP5GRES4WySuN/qjGeUDBKr8OYAxTXjR/w==,iv:NYhcfiKlXT3v5R4djkhHusMMRYgc3bCM66VD0G2MyME=,tag:8341ntSCmteTn+6AM0xu8g==,type:str] -livekit_key_jwt: ENC[AES256_GCM,data:G8IDQoAFpibI7Rs0dTPj7kLj9RogPRpufiq6GMCSFhGYtscTrDlsGOu5+hq0hP487QHnCEMZIUPOcKxy54ktdW2SQKyUDP/qc037o0eFqjI=,iv:iss3/VN0/mbkWujwRsv1+/IIFQ9hVxOg5FVV8A5kl2o=,tag:geLyPYH2iHxcRLUtruUAJg==,type:str] +livekit_key_jwt: ENC[AES256_GCM,data:9cBMJ0AyyWaoUZsXmnGvIL7EPIO8l16TQRBC6iK6h1TQAriOTPicfcE40Itf7cmiplZFtK6z7DhkgggRpG88HT7ZCvcXP0P69A==,iv:GiZb/8Vz4tiLG8kpF93kiFkmmA/KdgWr0ILARsL15oo=,tag:SZxzfFSk125q9sqlRbsxdw==,type:str] gitea: dbPassword: ENC[AES256_GCM,data:S6VvRgkdYk1AzXljyQEEq68UJ9zrFy6+INBMIAspXNcqcM6o+es19o0mcXA=,iv:/pHYpkZZq+9Md+75uSCb2YXfSvaDzUh6mMfH53wb7eg=,tag:ZnbyCQwrK2JnbO5HFqgJYw==,type:str] internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str] @@ -28,7 +28,7 @@ sops: N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9 6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-30T11:36:37Z" - mac: ENC[AES256_GCM,data:CIRG016ew09deYXENzus8L1abAjpBnKMrziezorwsceFG5I59ch7OJn7edYyr+VaVPrjBb3JeNShC/Ks1Pq7cwl4MGlAyheCpfE1IcFFMK2r0ldvAqgAWZhqLM7QbyQbC9Gkbi95TiMiTgQ8RQRk6RZPEWdBPecLcARLoj9PbcQ=,iv:iAqWDjqy9xZ/xh1n94zWUXiMmqEX9PH0QEFSv6y0Onc=,tag:VJauyqv4HByK3Kq84QI8sQ==,type:str] + lastmodified: "2026-04-30T12:21:26Z" + mac: ENC[AES256_GCM,data:sta1qQugWsGS0+g8stmyxHtKOiba6QiVyGfV5krJ688wrW1Ox38RW1cYf9+9Z04hXVQukYguR/k/y7v49oQxoefH5+7zlt/BxzadvPC5f55RsDREC7U4FKcpEEb2Pt1PtscQ3Trx/nDy3x5S8zJ1Uy1QTvSsEccQ+FYel6pcsgQ=,iv:r8spgHthtKoJjlHIpNGpVde1WFVI0xwbE1yJ4W6nHl8=,tag:qXnmmFRDISV3LTmlSlHgvA==,type:str] unencrypted_suffix: _unencrypted version: 3.12.2 From 61e8a1e037436311cf764fc96b354fbf687ef8fd Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Sun, 3 May 2026 12:38:31 +0200 Subject: [PATCH 12/15] WIP: Livekit --- hosts/cyper-proxy/configuration.nix | 2 +- nixos/roles/matrix/livekit.nix | 13 ++++++++++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/hosts/cyper-proxy/configuration.nix b/hosts/cyper-proxy/configuration.nix index 2439248..661a3ca 100644 --- a/hosts/cyper-proxy/configuration.nix +++ b/hosts/cyper-proxy/configuration.nix @@ -4,7 +4,7 @@ ./hardware-configuration.nix ../../nixos/roles/nginx.nix ../../nixos/roles/matrix/livekit.nix - ../../nixos/roles/jitsi.nix + # ../../nixos/roles/jitsi.nix ]; networking = { diff --git a/nixos/roles/matrix/livekit.nix b/nixos/roles/matrix/livekit.nix index cf52061..c973c63 100644 --- a/nixos/roles/matrix/livekit.nix +++ b/nixos/roles/matrix/livekit.nix @@ -1,4 +1,4 @@ -{ config, ... }: +{ config, lib, ... }: { sops.secrets.livekit_key_sfu = { }; @@ -27,4 +27,15 @@ }; }; }; + networking.firewall.allowedTCPPorts = [ 7881 ]; + + systemd.services.livekit.serviceConfig = { + PrivateUsers = lib.mkForce false; + RestrictAddressFamilies = lib.mkForce [ + "AF_INET" + "AF_INET6" + "AF_NETLINK" + "AF_UNIX" + ]; + }; } From 6276a57cb36fbab3ccd033f9f540cbb5b1914cd0 Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Sun, 3 May 2026 12:38:55 +0200 Subject: [PATCH 13/15] Added: Proxy to monito --- nixos/roles/monitoring.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/roles/monitoring.nix b/nixos/roles/monitoring.nix index 172735c..4c9c14c 100644 --- a/nixos/roles/monitoring.nix +++ b/nixos/roles/monitoring.nix @@ -19,6 +19,7 @@ let "cyper-desktop" = "192.168.2.40"; "cyper-node-1" = "192.168.2.30"; "cyper-node-2" = "192.168.2.31"; + "cyper-proxy" = "178.254.8.35"; }; mkWeatherScrapeConfigs = From c91ed778d476f58a72a57dbc94e96d1b02532d6f Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Sun, 3 May 2026 23:19:38 +0200 Subject: [PATCH 14/15] WIP: Livekit --- nixos/roles/matrix/livekit.nix | 15 +++++++++- nixos/roles/nginx.nix | 51 ++++++++++++++++++++++++++++++++-- 2 files changed, 63 insertions(+), 3 deletions(-) diff --git a/nixos/roles/matrix/livekit.nix b/nixos/roles/matrix/livekit.nix index c973c63..15ab0cb 100644 --- a/nixos/roles/matrix/livekit.nix +++ b/nixos/roles/matrix/livekit.nix @@ -9,7 +9,7 @@ settings = { rtc = { tcp_port = 7881; - udp_port = 7882; + #udp_port = 7882; port_range_start = 50000; port_range_end = 60000; use_external_ip = true; @@ -31,11 +31,24 @@ systemd.services.livekit.serviceConfig = { PrivateUsers = lib.mkForce false; + DynamicUser = lib.mkForce false; + User = "livekit"; + Group = "livekit"; RestrictAddressFamilies = lib.mkForce [ "AF_INET" "AF_INET6" "AF_NETLINK" "AF_UNIX" ]; + SystemCallFilter = lib.mkForce [ "@system-service" ]; }; + + users = { + users.livekit = { + isSystemUser = true; + group = "livekit"; + }; + groups.livekit = { }; + }; + } diff --git a/nixos/roles/nginx.nix b/nixos/roles/nginx.nix index 304c3fe..632c4bc 100644 --- a/nixos/roles/nginx.nix +++ b/nixos/roles/nginx.nix @@ -100,8 +100,46 @@ in "calvin.cyperpunk.de" = mkWsProxy 15006; "cinny.cyperpunk.de" = mkWsProxy 8009; - "element.cyperpunk.de" = mkWsProxy 8010; - "element-call.cyperpunk.de" = mkWsProxy 8013; + + "element-call.cyperpunk.de" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://${upstream}:8013"; + proxyWebsockets = true; + extraConfig = '' + add_header Cross-Origin-Opener-Policy "same-origin"; + add_header Cross-Origin-Embedder-Policy "require-corp"; + add_header Cross-Origin-Resource-Policy "cross-origin"; + ''; + }; + }; + + "element.cyperpunk.de" = { + forceSSL = true; + enableACME = true; + locations = { + "/" = { + proxyPass = "http://${upstream}:8010"; + proxyWebsockets = true; + }; + "/widgets/element-call/config.json" = { + extraConfig = '' + default_type application/json; + add_header Access-Control-Allow-Origin *; + return 200 '{ + "livekit_service_url": "https://cyperpunk.de/livekit/jwt/", + "default_server_config": { + "m.homeserver": { + "base_url": "https://matrix.cyperpunk.de", + "server_name":"cyperpunk.de" + } + } + }'; + ''; + }; + }; + }; "cyperpunk.de" = { forceSSL = true; @@ -132,6 +170,15 @@ in ''; }; + "/_matrix/client/unstable/org.matrix.msc4143/rtc/transports" = { + extraConfig = '' + default_type application/json; + add_header Access-Control-Allow-Origin *; + add_header Access-Control-Allow-Headers "Authorization, Content-Type"; + add_header Access-Control-Allow-Methods "GET, OPTIONS"; + return 200 '{"rtc_transports":[{"type":"livekit","livekit_service_url":"https://cyperpunk.de/livekit/jwt/"}]}'; + ''; + }; }; }; }; From e8253312b23fe3ed5f71a64f3ae22aacbeec1647 Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Sun, 3 May 2026 23:20:10 +0200 Subject: [PATCH 15/15] WIP: Matrix --- nixos/roles/matrix/clients.nix | 5 +++++ nixos/roles/matrix/lk-jwt.nix | 2 +- nixos/roles/matrix/synapse.nix | 11 ++++++++++- 3 files changed, 16 insertions(+), 2 deletions(-) diff --git a/nixos/roles/matrix/clients.nix b/nixos/roles/matrix/clients.nix index 797728e..641e706 100644 --- a/nixos/roles/matrix/clients.nix +++ b/nixos/roles/matrix/clients.nix @@ -130,6 +130,7 @@ let use_exclusively = true; participant_limit = 8; brand = "Cyperpunk Call"; + encryption = "None"; }; livekit = { livekit_service_url = "https://cyperpunk.de/livekit/jwt/"; @@ -141,6 +142,7 @@ let features = { feature_group_calls = true; "feature_disable_call_per_sender_encryption" = true; + "feature_sliding_sync" = true; }; } ); @@ -165,6 +167,9 @@ let }; }; livekit_service_url = "https://cyperpunk.de/livekit/jwt/"; + e2ee = { + default = false; + }; } ) } $out/config.json diff --git a/nixos/roles/matrix/lk-jwt.nix b/nixos/roles/matrix/lk-jwt.nix index 76c6482..7ce3978 100644 --- a/nixos/roles/matrix/lk-jwt.nix +++ b/nixos/roles/matrix/lk-jwt.nix @@ -11,7 +11,7 @@ in services.lk-jwt-service = { enable = true; keyFile = config.sops.secrets.livekit_key_jwt.path; - livekitUrl = "ws://100.109.10.91:7880"; + livekitUrl = "wss://cyperpunk.de/livekit/sfu"; }; systemd.services.lk-jwt-service = { diff --git a/nixos/roles/matrix/synapse.nix b/nixos/roles/matrix/synapse.nix index e6e5497..a81e282 100644 --- a/nixos/roles/matrix/synapse.nix +++ b/nixos/roles/matrix/synapse.nix @@ -36,6 +36,7 @@ "msc3401_enabled" = true; "msc4143_enabled" = true; "msc4195_enabled" = true; + "msc4222_enabled" = true; }; listeners = [ { @@ -63,7 +64,15 @@ resources = [ ]; } ]; - + matrix_rtc = { + enabled = true; + transports = [ + { + type = "livekit"; + livekit_service_url = "https://cyperpunk.de/livekit/jwt/"; + } + ]; + }; enable_metrics = true; }; };