diff --git a/flake.nix b/flake.nix index e7e5033..be3e29e 100644 --- a/flake.nix +++ b/flake.nix @@ -121,6 +121,8 @@ extraSpecialArgs = sharedSpecialArgs; users.${primaryUser} = import ./home; backupFileExtension = "backup"; + useGlobalPkgs = true; + useUserPackages = true; }; } ]; diff --git a/home/default.nix b/home/default.nix index 5bb48f9..83fda5b 100644 --- a/home/default.nix +++ b/home/default.nix @@ -34,7 +34,11 @@ ./obsidian.nix ]; - nixpkgs.config.allowUnfree = true; + nixpkgs.config.allowUnfreePredicate = + pkg: + builtins.elem (lib.getName pkg) [ + "wezterm.nvim" + ]; home = { username = primaryUser; diff --git a/home/neovim/default.nix b/home/neovim/default.nix index b187b58..88af22b 100644 --- a/home/neovim/default.nix +++ b/home/neovim/default.nix @@ -14,7 +14,7 @@ ./alpha.nix ./avante.nix #./openscad.nix - ./molten.nix + #./molten.nix ./which-key.nix ]; diff --git a/home/shell.nix b/home/shell.nix index ed0b7ff..4febb84 100644 --- a/home/shell.nix +++ b/home/shell.nix @@ -189,9 +189,6 @@ # llm | glow def l [...args] { llm prompt -m groq/llama-3.3-70b-versatile -t std ...$args | glow } - - # Fastfetch on shell start - fastfetch ''; extraEnv = '' @@ -226,12 +223,19 @@ }; interactiveShellInit = '' - starship init fish | source - fzf --fish | source - zoxide init fish --cmd cd | source - function fish_greeting - fastfetch - end + starship init fish | source + fzf --fish | source + zoxide init fish --cmd cd | source + function fish_greeting + echo " _ _ "; + echo " | | | | "; + echo " ___ _ _ _ __ ___ _ __ _ __ _ _ _ __ | | __ __| | ___ "; + echo " / __| | | | '_ \\ / _ \\ '__| '_ \\| | | | '_ \\| |/ / / _\` |/ _ \\"; + echo "| (__| |_| | |_) | __/ | | |_) | |_| | | | | < | (_| | __/"; + echo " \\___|\\__, | .__/ \\___|_| | .__/ \\__,_|_| |_|_|\\_(_)__,_|\\___|"; + echo " __/ | | | | "; + echo " |___/|_| |_| "; + end ''; functions.l = { diff --git a/nixos/roles/keycloack.nix b/nixos/roles/keycloack.nix new file mode 100644 index 0000000..0d7f491 --- /dev/null +++ b/nixos/roles/keycloack.nix @@ -0,0 +1,28 @@ +{ config, ... }: +{ + services = { + nginx.virtualHosts."www.cyperpunk.de".locations."/cloak" = { + proxyPass = "http://localhost:${toString config.services.keycloak.settings.http-port}/cloak/"; + }; + + keycloak = { + enable = true; + + database = { + type = "postgresql"; + createLocally = true; + + username = "keycloak"; + passwordFile = "/etc/nixos/secrets/keycloak_psql_pass"; + }; + + settings = { + hostname = "cyperpunk.de"; + http-relative-path = "/cloak"; + http-port = 38080; + proxy = "passthrough"; + http-enabled = true; + }; + }; + }; +} diff --git a/nixos/roles/matrix/clients.nix b/nixos/roles/matrix/clients.nix new file mode 100644 index 0000000..a7ff4c7 --- /dev/null +++ b/nixos/roles/matrix/clients.nix @@ -0,0 +1,175 @@ +{ pkgs, lib, ... }: +let + flavours = [ + { + name = "Latte"; + slug = "latte"; + is_dark = false; + } + { + name = "Frappé"; + slug = "frappe"; + is_dark = true; + } + { + name = "Macchiato"; + slug = "macchiato"; + is_dark = true; + } + { + name = "Mocha"; + slug = "mocha"; + is_dark = true; + } + ]; + accents = [ + "rosewater" + "flamingo" + "pink" + "mauve" + "red" + "maroon" + "peach" + "yellow" + "green" + "teal" + "sky" + "sapphire" + "blue" + "lavender" + ]; + themeHashes = { + "latte/rosewater" = "0l1m4bhaxdam07rfqag6pjbzhdpyi5w3i14vp6rq7aj59pildw3a"; + "latte/flamingo" = "1m8hh2l87xv2rfgpnnl5vzddmam0n82h25fwadb37blgab08vhsr"; + "latte/pink" = "0ambrc42mvg0vdspfmnl31ka1nsxpdyv1p3nh045822y02q20wwh"; + "latte/mauve" = "1nnn2w6nsr24a45jy497c2vhi8v64bwg99fj2dyhpfsn89c63lhn"; + "latte/red" = "14lmw4c4llfz6zqvfymkc6k3msxcml2gwq9rhwsixdpc5mjjbn8n"; + "latte/maroon" = "0ydpng9451mpn7hv5ag1ck8hryx8pdvrml3zksvzm2fiwzzjkpcf"; + "latte/peach" = "1fn5804wv9z9iv65ikyv015b01a7c546rsaaks2a2sq2c37n75l0"; + "latte/yellow" = "0hzgiyhqmwgp3h3v1y23sx3x5qp712sw106472lbnxbywqlavcza"; + "latte/green" = "194kxv6d9hc4nixy16hy9nvf32qs3v214nr2r2qf2z9l89rk5pnp"; + "latte/teal" = "12n25d38zpqxsskglymhmza972klg2hj3c23v2nb3jfj82llw6v4"; + "latte/sky" = "0yghds3xpmbhkbcj2jkh8df82j6vrn9q1z0s2129nca7l5g5f9w2"; + "latte/sapphire" = "18dl1srxp3xccvvy56za6kp05n68d918l0wrxga11746g9sib7r3"; + "latte/blue" = "1zv9nap21d80flvd1jwmjph05jgykxngv5kqbhk95mvqh962ygnf"; + "latte/lavender" = "03j4fwbscip1qm6px1qxkha0c5csq2wwvzg9vwjkc2ja48v1mp9k"; + "frappe/rosewater" = "032qbgj32mvgpankl9777x2lxk18451kglsxg5215k8zrwcg9y95"; + "frappe/flamingo" = "1grhgynn8q7isv18981km5k8ll72ihsjw2ciy8widl6wikv29j8p"; + "frappe/pink" = "0h33g721bph8ihd6lmbc7szxy4dq85ng1cgg5cxjb5y2m7wpdbsy"; + "frappe/mauve" = "121jmznc9q3p7crsy9p2khw8xnzvz4lxms26g1h5wqa67wqvalc4"; + "frappe/red" = "07wm4h1giyy6a5nlh0d3qdarfsp6ikyr5nmg94n13lj4q03d0cn0"; + "frappe/maroon" = "08vg70nr918n4ffi1wnbba4xrx5ak5vfgq7m5ik0rpkb2wdb4x6k"; + "frappe/peach" = "1cg753w2dxs0sx97d8y0g62s8aw3w6b9hrll0lsrw3bc1bvm23fl"; + "frappe/yellow" = "0g43g2if1pcm25i261zfw43bawqqdlgg2f6q2bqhyqvafk9yb3dy"; + "frappe/green" = "1n71mndzds3zldb271g8hdw1yn29s68svzvh8ckjcsz4sb9h1i74"; + "frappe/teal" = "0b6m9cibfwf8csh1pk5i76xi3wx3v2aqwgffzsidw8nwc7c1a3wk"; + "frappe/sky" = "1l4d44399ixshlc9fdsx7iqwxm6kdkp6k4z3z6bdyyx6adw3z4q5"; + "frappe/sapphire" = "03fa9rnclvs5ljd0lzz15vnkzpqpbrhfppg3zwfchs9fvak0n3ni"; + "frappe/blue" = "0r4jjn3pab77w1aanlv3143ch60400q44mdzaqmcjbcr6l2knmjh"; + "frappe/lavender" = "1mrkaz72w6j9hh4dpxwgd6ks5wsnq9ydgy6f9gms4jx1611aab96"; + "macchiato/rosewater" = "001akfnhlvwaiz5faahl4qi0qp6as6ilvkbja6bjy9f5iasr4ygp"; + "macchiato/flamingo" = "06xq3pbx4cb3pyblx2vydr4bp0ylm7866d66agg5wg5qnr356wb3"; + "macchiato/pink" = "1hb32dj0n3wx4f1wxa4n7fib2mazghwsg2ljycza9macfn2n87qn"; + "macchiato/mauve" = "1yrnp162blizc10fz2n6ls1x0di1sdjk53vpsl7mifrkcr1k2nq7"; + "macchiato/red" = "1g9s39q7459lk830vhdrfqkbzz88p3fp8k98a2ygj2hz8sycpryq"; + "macchiato/maroon" = "0ad7rx8sbkygvsgywhpjvvzmyflyhz7jlm13dr7cxj3801rxhl6d"; + "macchiato/peach" = "1m5m6afcl8s1ghn2b9n1d20fhsygnhgn0205nhpxh4bih3kg8c8m"; + "macchiato/yellow" = "0zcc26d28jaq71mz8nqssz8p0hylczirjwjxr2dkha1133vjmvy5"; + "macchiato/green" = "055xdb5jilp5fq3a1g8773rv52zr68fp4l3hs56yj6dy3bq3q22v"; + "macchiato/teal" = "1sfci2g2nvmj0v72gnxqbj0k8053qz0rl6iphfxs3pgpi1b0rczq"; + "macchiato/sky" = "0vhfmdliy8cbb0vqq3v26isvcz4sxzq0xrb4p5a6gibvxaqi6bf3"; + "macchiato/sapphire" = "1744jiv57aqz4qi52n92nrx0s1rhylgg08qqc31jr2clk9h6bw18"; + "macchiato/blue" = "1arp8r2g8ivs1xipq39d3l6cvx0zrr1vwv9yac5j33d6c93wbb2i"; + "macchiato/lavender" = "0kak1f574c07gqjfafg3w5avrci584iqxjkmvrl2pv1879g84nn3"; + "mocha/rosewater" = "0p3ck9crskrhk1za6knaznjlj464mx4sdkkadna6k2152m3czjpz"; + "mocha/flamingo" = "04xx1mky230saqxxqin2fph8cnnz1jhmvb9qd9f5yc3pai3q5wdw"; + "mocha/pink" = "1cj9zdd72vcc45ziav625yq6hrp1zw21f7xsic0ip065xcqzdl3p"; + "mocha/mauve" = "1wb0ibmdv6vn07bk570pikm43qdxj3n2zsqr5sip17ay05j5l6dm"; + "mocha/red" = "1mnzrk57ar2cphyi2ry2lg5ilmb26gm4pr7ixch2ls0hk8ilp9p9"; + "mocha/maroon" = "1mcpwz3yrg3kk0hkqv5nykxj07bm70403yyl8r60pqlh74dnhkbf"; + "mocha/peach" = "0jglpcs41rfqxcm45mvnbdqhma0bv4h07nc7c3nrwz3g3h2djmzr"; + "mocha/yellow" = "0jqkvcjiwid1zdvrj2ikqf5winm08qyd51nfsawfdspbfhqnzmis"; + "mocha/green" = "0bg0014a77yx7f2r6n4mxm7rqgdnymqq7cq6bvpgkfk2z1gyr38l"; + "mocha/teal" = "0kzvi3gfirpcxdhgsilm51lk3j1z6lavb7160chgd9jhzk0xg97c"; + "mocha/sky" = "057nmp2aywdxzrkmzi65bh2mvf1a9cnri0g0jdyzdnrn7f8bbsiw"; + "mocha/sapphire" = "0nfklzb0a7mxv6nzav7m2g0y9plm72vwadm06445myv3k9j3ffmj"; + "mocha/blue" = "06ay46x2aq1q5ghz2zhzhn6qyqkrrf4p9j59qywnxh1jvv728ns8"; + "mocha/lavender" = "0iip063f6km17998c7ak0lb3kq6iskyi3xv2phn618mhslnxhwm5"; + }; + + catppuccinThemes = lib.concatMap ( + flavour: + map ( + accent: + builtins.fromJSON ( + builtins.readFile ( + pkgs.fetchurl { + url = "https://element.catppuccin.com/${flavour.slug}/${accent}.json"; + sha256 = themeHashes."${flavour.slug}/${accent}"; + } + ) + ) + ) accents + ) flavours; + + elementConfig = builtins.toFile "element-config.json" ( + builtins.toJSON { + default_server_config = { + "m.homeserver" = { + base_url = "https://matrix.cyperpunk.de"; + server_name = "cyperpunk.de"; + }; + }; + setting_defaults = { + custom_themes = catppuccinThemes; + feature_custom_themes = true; + }; + } + ); + + elementWebConfigured = pkgs.element-web.overrideAttrs (old: { + postInstall = (old.postInstall or "") + '' + cp ${elementConfig} $out/config.json + ''; + }); + +in +{ + services.nginx.virtualHosts = { + "cinny.cyperpunk.de" = { + forceSSL = true; + enableACME = true; + root = "${pkgs.cinny}"; + }; + + "element.cyperpunk.de" = { + forceSSL = true; + enableACME = true; + root = "${elementWebConfigured}"; + }; + + "fluffy.cyperpunk.de" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://127.0.0.1:8082"; + proxyWebsockets = true; + }; + }; + }; + + virtualisation.oci-containers.containers.fluffychat = { + image = "ghcr.io/krille-chan/fluffychat:latest"; + ports = [ "127.0.0.1:8082:80" ]; + volumes = [ + "${ + builtins.toFile "fluffychat-config.json" ( + builtins.toJSON { + default_homeserver = "matrix.cyperpunk.de"; + preset_homeserver = "matrix.cyperpunk.de"; + } + ) + }:/app/config.json:ro" + ]; + }; +} diff --git a/nixos/roles/matrix/coturn.nix b/nixos/roles/matrix/coturn.nix new file mode 100644 index 0000000..8c630ad --- /dev/null +++ b/nixos/roles/matrix/coturn.nix @@ -0,0 +1,95 @@ +{ config, lib, ... }: +{ + sops.secrets = { + coturn_static_auth_secret = { + owner = "turnserver"; + group = "turnserver"; + }; + + coturn_static_auth_secret_synapse = { + owner = "matrix-synapse"; + group = "matrix-synapse"; + key = "coturn_static_auth_secret"; + }; + }; + + services = { + coturn = rec { + enable = true; + no-cli = true; + no-tcp-relay = true; + min-port = 49000; + max-port = 50000; + use-auth-secret = true; + static-auth-secret-file = config.sops.secrets.coturn_static_auth_secret.path; + realm = "turn.cyperpunk.de"; + cert = "${config.security.acme.certs.${realm}.directory}/full.pem"; + pkey = "${config.security.acme.certs.${realm}.directory}/key.pem"; + extraConfig = '' + no-multicast-peers + denied-peer-ip=0.0.0.0-0.255.255.255 + denied-peer-ip=10.0.0.0-10.255.255.255 + denied-peer-ip=100.64.0.0-100.127.255.255 + denied-peer-ip=127.0.0.0-127.255.255.255 + denied-peer-ip=169.254.0.0-169.254.255.255 + denied-peer-ip=172.16.0.0-172.31.255.255 + denied-peer-ip=192.0.0.0-192.0.0.255 + denied-peer-ip=192.0.2.0-192.0.2.255 + denied-peer-ip=192.88.99.0-192.88.99.255 + denied-peer-ip=192.168.0.0-192.168.255.255 + denied-peer-ip=198.18.0.0-198.19.255.255 + denied-peer-ip=198.51.100.0-198.51.100.255 + denied-peer-ip=203.0.113.0-203.0.113.255 + denied-peer-ip=240.0.0.0-255.255.255.255 + denied-peer-ip=::1 + denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff + denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255 + denied-peer-ip=100::-100::ffff:ffff:ffff:ffff + denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff + denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff + denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff + ''; + relay-ips = [ "178.254.8.35" ]; + }; + + nginx.virtualHosts."turn.cyperpunk.de" = { + forceSSL = true; + enableACME = true; + }; + + matrix-synapse.settings = with config.services.coturn; { + turn_uris = [ + "turn:${realm}:3478?transport=udp" + "turn:${realm}:3478?transport=tcp" + ]; + turn_shared_secret_path = config.sops.secrets.coturn_static_auth_secret_synapse.path; + turn_user_lifetime = "1h"; + }; + }; + + security.acme.certs."turn.cyperpunk.de".group = "nginx"; + + users.users.turnserver.extraGroups = [ "nginx" ]; + + networking.firewall.interfaces.ens3 = + let + range = + with config.services.coturn; + lib.singleton { + from = min-port; + to = max-port; + }; + in + { + allowedUDPPortRanges = range; + allowedUDPPorts = [ + 3478 + 5349 + ]; + allowedTCPPorts = [ + 3478 + 5349 + ]; + }; +} diff --git a/nixos/roles/matrix/default.nix b/nixos/roles/matrix/default.nix index 7111612..8d3f947 100644 --- a/nixos/roles/matrix/default.nix +++ b/nixos/roles/matrix/default.nix @@ -4,28 +4,11 @@ { imports = [ ./synapse.nix - ./lk-jwt.nix ./livekit.nix + ./clients.nix + ./mjolnir.nix + ./coturn.nix + ./discord-bridge.nix + ./whatsapp-bridge.nix ]; - - #networking.firewall = { - # allowedTCPPorts = [ - # 8008 # Matrix Synapse - # 8009 # Cinny - # 8010 # Element - # 8011 # Synapse Admin - # 8012 # FluffyChat - # 8448 # Matrix federation - # 3478 # TURN (coturn) - # ]; - # allowedUDPPorts = [ - # 3478 # TURN (coturn) - # ]; - # allowedUDPPortRanges = [ - # { - # from = 49152; - # to = 65535; # TURN relay ports (coturn) - # } - # ]; - #}; } diff --git a/nixos/roles/matrix/discord-bridge.nix b/nixos/roles/matrix/discord-bridge.nix new file mode 100644 index 0000000..9bcf190 --- /dev/null +++ b/nixos/roles/matrix/discord-bridge.nix @@ -0,0 +1,64 @@ +{ config, pkgs, ... }: +{ + nixpkgs.config.permittedInsecurePackages = [ "olm-3.2.16" ]; + + sops.secrets.discord_bot_token = { + owner = "mautrix-discord"; + group = "mautrix-discord"; + }; + sops.secrets.discord_client_id = { + owner = "mautrix-discord"; + group = "mautrix-discord"; + }; + + systemd.services.mautrix-discord-env = { + before = [ "mautrix-discord-registration.service" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + }; + script = '' + mkdir -p /run/mautrix-discord + echo "DISCORD_BOT_TOKEN=$(cat ${config.sops.secrets.discord_bot_token.path})" > /run/mautrix-discord/env + echo "DISCORD_CLIENT_ID=$(cat ${config.sops.secrets.discord_client_id.path})" >> /run/mautrix-discord/env + chmod 600 /run/mautrix-discord/env + chown mautrix-discord:mautrix-discord /run/mautrix-discord/env + ''; + }; + + services.postgresql = { + ensureUsers = [ + { + name = "mautrix-discord"; + ensureDBOwnership = true; + } + ]; + ensureDatabases = [ "mautrix-discord" ]; + }; + + services.mautrix-discord = { + enable = true; + environmentFile = "/run/mautrix-discord/env"; + settings = { + homeserver = { + address = "http://127.0.0.1:8008"; + domain = "cyperpunk.de"; + }; + appservice.database = { + type = "postgres"; + uri = "postgres:///mautrix-discord?host=/run/postgresql&sslmode=disable"; + }; + bridge = { + permissions = { + "cyperpunk.de" = "user"; + "@dergrumpf:cyperpunk.de" = "admin"; + }; + }; + discord = { + client_id = "$DISCORD_CLIENT_ID"; + bot_token = "$DISCORD_BOT_TOKEN"; + }; + }; + }; +} diff --git a/nixos/roles/matrix/livekit.nix b/nixos/roles/matrix/livekit.nix index db5f9e5..9460a95 100644 --- a/nixos/roles/matrix/livekit.nix +++ b/nixos/roles/matrix/livekit.nix @@ -1,54 +1,19 @@ -{ config, lib, ... }: +{ config, ... }: { - sops.secrets.livekit_key_sfu = { }; + sops.secrets.livekit_key_file = { }; services.livekit = { enable = true; openFirewall = true; - keyFile = config.sops.secrets.livekit_key_sfu.path; - settings = { - rtc = { - tcp_port = 7881; - #udp_port = 7882; - port_range_start = 50000; - port_range_end = 60000; - use_external_ip = true; - node_ip = "178.254.8.35"; - }; - room = { - auto_create = true; - enabled_codecs = [ - { mime = "video/VP8"; } - { mime = "video/VP9"; } - { mime = "video/H264"; } - { mime = "audio/opus"; } - ]; - enable_remote_unmute = true; - }; - }; - }; - networking.firewall.allowedTCPPorts = [ 7881 ]; - - systemd.services.livekit.serviceConfig = { - PrivateUsers = lib.mkForce false; - DynamicUser = lib.mkForce false; - User = "livekit"; - Group = "livekit"; - RestrictAddressFamilies = lib.mkForce [ - "AF_INET" - "AF_INET6" - "AF_NETLINK" - "AF_UNIX" - ]; - SystemCallFilter = lib.mkForce [ "@system-service" ]; + settings.room.auto_create = false; + keyFile = config.sops.secrets.livekit_key_file.path; }; - users = { - users.livekit = { - isSystemUser = true; - group = "livekit"; - }; - groups.livekit = { }; + services.lk-jwt-service = { + enable = true; + livekitUrl = "wss://cyperpunk.de/livekit/sfu"; + keyFile = config.sops.secrets.livekit_key_file.path; }; + systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = "cyperpunk.de"; } diff --git a/nixos/roles/matrix/lk-jwt.nix b/nixos/roles/matrix/lk-jwt.nix deleted file mode 100644 index fbf2fbd..0000000 --- a/nixos/roles/matrix/lk-jwt.nix +++ /dev/null @@ -1,25 +0,0 @@ -{ config, lib, ... }: -let - domain = "cyperpunk.de"; - synapseUrl = "http://localhost:8008"; -in -{ - sops.secrets.livekit_key_jwt = { }; - - networking.firewall.allowedTCPPorts = [ 18080 ]; - - services.lk-jwt-service = { - enable = true; - keyFile = config.sops.secrets.livekit_key_jwt.path; - livekitUrl = "wss://cyperpunk.de/livekit/sfu"; - }; - - systemd.services.lk-jwt-service = { - environment = { - LIVEKIT_FULL_ACCESS_HOMESERVERS = domain; - MATRIX_BASE_URL = synapseUrl; - LIVEKIT_JWT_BIND = lib.mkForce ":18080"; - LIVEKIT_INSECURE_SKIP_VERIFY_TLS = "YES_I_KNOW_WHAT_I_AM_DOING"; - }; - }; -} diff --git a/nixos/roles/matrix/mjolnir.nix b/nixos/roles/matrix/mjolnir.nix new file mode 100644 index 0000000..ff96a2c --- /dev/null +++ b/nixos/roles/matrix/mjolnir.nix @@ -0,0 +1,17 @@ +{ config, ... }: +{ + sops.secrets.mjolnir_access_token = { }; + + services.draupnir = { + enable = true; + secrets.accessToken = config.sops.secrets.mjolnir_access_token.path; + settings = { + homeserverUrl = "https://matrix.cyperpunk.de"; + managementRoom = "!eErCimyDjLSebHjpJA:cyperpunk.de"; + }; + }; +} + +#curl -X POST https://matrix.cyperpunk.de/_matrix/client/v3/login \ +# -H "Content-Type: application/json" \ +# -d '{"type":"m.login.password ","user":"mjolnir","password":"i318HXBRkt)Lh$nOPwq#6n9z&7jV}-uQCE{