Merge branch 'main' of https://git.cyperpunk.de/DerGrumpf/cyper-nix
This commit is contained in:
@@ -121,6 +121,8 @@
|
|||||||
extraSpecialArgs = sharedSpecialArgs;
|
extraSpecialArgs = sharedSpecialArgs;
|
||||||
users.${primaryUser} = import ./home;
|
users.${primaryUser} = import ./home;
|
||||||
backupFileExtension = "backup";
|
backupFileExtension = "backup";
|
||||||
|
useGlobalPkgs = true;
|
||||||
|
useUserPackages = true;
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|||||||
+5
-1
@@ -34,7 +34,11 @@
|
|||||||
./obsidian.nix
|
./obsidian.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
nixpkgs.config.allowUnfree = true;
|
nixpkgs.config.allowUnfreePredicate =
|
||||||
|
pkg:
|
||||||
|
builtins.elem (lib.getName pkg) [
|
||||||
|
"wezterm.nvim"
|
||||||
|
];
|
||||||
|
|
||||||
home = {
|
home = {
|
||||||
username = primaryUser;
|
username = primaryUser;
|
||||||
|
|||||||
@@ -14,7 +14,7 @@
|
|||||||
./alpha.nix
|
./alpha.nix
|
||||||
./avante.nix
|
./avante.nix
|
||||||
#./openscad.nix
|
#./openscad.nix
|
||||||
./molten.nix
|
#./molten.nix
|
||||||
./which-key.nix
|
./which-key.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|||||||
+13
-9
@@ -189,9 +189,6 @@
|
|||||||
|
|
||||||
# llm | glow
|
# llm | glow
|
||||||
def l [...args] { llm prompt -m groq/llama-3.3-70b-versatile -t std ...$args | glow }
|
def l [...args] { llm prompt -m groq/llama-3.3-70b-versatile -t std ...$args | glow }
|
||||||
|
|
||||||
# Fastfetch on shell start
|
|
||||||
fastfetch
|
|
||||||
'';
|
'';
|
||||||
|
|
||||||
extraEnv = ''
|
extraEnv = ''
|
||||||
@@ -226,12 +223,19 @@
|
|||||||
};
|
};
|
||||||
|
|
||||||
interactiveShellInit = ''
|
interactiveShellInit = ''
|
||||||
starship init fish | source
|
starship init fish | source
|
||||||
fzf --fish | source
|
fzf --fish | source
|
||||||
zoxide init fish --cmd cd | source
|
zoxide init fish --cmd cd | source
|
||||||
function fish_greeting
|
function fish_greeting
|
||||||
fastfetch
|
echo " _ _ ";
|
||||||
end
|
echo " | | | | ";
|
||||||
|
echo " ___ _ _ _ __ ___ _ __ _ __ _ _ _ __ | | __ __| | ___ ";
|
||||||
|
echo " / __| | | | '_ \\ / _ \\ '__| '_ \\| | | | '_ \\| |/ / / _\` |/ _ \\";
|
||||||
|
echo "| (__| |_| | |_) | __/ | | |_) | |_| | | | | < | (_| | __/";
|
||||||
|
echo " \\___|\\__, | .__/ \\___|_| | .__/ \\__,_|_| |_|_|\\_(_)__,_|\\___|";
|
||||||
|
echo " __/ | | | | ";
|
||||||
|
echo " |___/|_| |_| ";
|
||||||
|
end
|
||||||
'';
|
'';
|
||||||
|
|
||||||
functions.l = {
|
functions.l = {
|
||||||
|
|||||||
@@ -0,0 +1,28 @@
|
|||||||
|
{ config, ... }:
|
||||||
|
{
|
||||||
|
services = {
|
||||||
|
nginx.virtualHosts."www.cyperpunk.de".locations."/cloak" = {
|
||||||
|
proxyPass = "http://localhost:${toString config.services.keycloak.settings.http-port}/cloak/";
|
||||||
|
};
|
||||||
|
|
||||||
|
keycloak = {
|
||||||
|
enable = true;
|
||||||
|
|
||||||
|
database = {
|
||||||
|
type = "postgresql";
|
||||||
|
createLocally = true;
|
||||||
|
|
||||||
|
username = "keycloak";
|
||||||
|
passwordFile = "/etc/nixos/secrets/keycloak_psql_pass";
|
||||||
|
};
|
||||||
|
|
||||||
|
settings = {
|
||||||
|
hostname = "cyperpunk.de";
|
||||||
|
http-relative-path = "/cloak";
|
||||||
|
http-port = 38080;
|
||||||
|
proxy = "passthrough";
|
||||||
|
http-enabled = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,175 @@
|
|||||||
|
{ pkgs, lib, ... }:
|
||||||
|
let
|
||||||
|
flavours = [
|
||||||
|
{
|
||||||
|
name = "Latte";
|
||||||
|
slug = "latte";
|
||||||
|
is_dark = false;
|
||||||
|
}
|
||||||
|
{
|
||||||
|
name = "Frappé";
|
||||||
|
slug = "frappe";
|
||||||
|
is_dark = true;
|
||||||
|
}
|
||||||
|
{
|
||||||
|
name = "Macchiato";
|
||||||
|
slug = "macchiato";
|
||||||
|
is_dark = true;
|
||||||
|
}
|
||||||
|
{
|
||||||
|
name = "Mocha";
|
||||||
|
slug = "mocha";
|
||||||
|
is_dark = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
accents = [
|
||||||
|
"rosewater"
|
||||||
|
"flamingo"
|
||||||
|
"pink"
|
||||||
|
"mauve"
|
||||||
|
"red"
|
||||||
|
"maroon"
|
||||||
|
"peach"
|
||||||
|
"yellow"
|
||||||
|
"green"
|
||||||
|
"teal"
|
||||||
|
"sky"
|
||||||
|
"sapphire"
|
||||||
|
"blue"
|
||||||
|
"lavender"
|
||||||
|
];
|
||||||
|
themeHashes = {
|
||||||
|
"latte/rosewater" = "0l1m4bhaxdam07rfqag6pjbzhdpyi5w3i14vp6rq7aj59pildw3a";
|
||||||
|
"latte/flamingo" = "1m8hh2l87xv2rfgpnnl5vzddmam0n82h25fwadb37blgab08vhsr";
|
||||||
|
"latte/pink" = "0ambrc42mvg0vdspfmnl31ka1nsxpdyv1p3nh045822y02q20wwh";
|
||||||
|
"latte/mauve" = "1nnn2w6nsr24a45jy497c2vhi8v64bwg99fj2dyhpfsn89c63lhn";
|
||||||
|
"latte/red" = "14lmw4c4llfz6zqvfymkc6k3msxcml2gwq9rhwsixdpc5mjjbn8n";
|
||||||
|
"latte/maroon" = "0ydpng9451mpn7hv5ag1ck8hryx8pdvrml3zksvzm2fiwzzjkpcf";
|
||||||
|
"latte/peach" = "1fn5804wv9z9iv65ikyv015b01a7c546rsaaks2a2sq2c37n75l0";
|
||||||
|
"latte/yellow" = "0hzgiyhqmwgp3h3v1y23sx3x5qp712sw106472lbnxbywqlavcza";
|
||||||
|
"latte/green" = "194kxv6d9hc4nixy16hy9nvf32qs3v214nr2r2qf2z9l89rk5pnp";
|
||||||
|
"latte/teal" = "12n25d38zpqxsskglymhmza972klg2hj3c23v2nb3jfj82llw6v4";
|
||||||
|
"latte/sky" = "0yghds3xpmbhkbcj2jkh8df82j6vrn9q1z0s2129nca7l5g5f9w2";
|
||||||
|
"latte/sapphire" = "18dl1srxp3xccvvy56za6kp05n68d918l0wrxga11746g9sib7r3";
|
||||||
|
"latte/blue" = "1zv9nap21d80flvd1jwmjph05jgykxngv5kqbhk95mvqh962ygnf";
|
||||||
|
"latte/lavender" = "03j4fwbscip1qm6px1qxkha0c5csq2wwvzg9vwjkc2ja48v1mp9k";
|
||||||
|
"frappe/rosewater" = "032qbgj32mvgpankl9777x2lxk18451kglsxg5215k8zrwcg9y95";
|
||||||
|
"frappe/flamingo" = "1grhgynn8q7isv18981km5k8ll72ihsjw2ciy8widl6wikv29j8p";
|
||||||
|
"frappe/pink" = "0h33g721bph8ihd6lmbc7szxy4dq85ng1cgg5cxjb5y2m7wpdbsy";
|
||||||
|
"frappe/mauve" = "121jmznc9q3p7crsy9p2khw8xnzvz4lxms26g1h5wqa67wqvalc4";
|
||||||
|
"frappe/red" = "07wm4h1giyy6a5nlh0d3qdarfsp6ikyr5nmg94n13lj4q03d0cn0";
|
||||||
|
"frappe/maroon" = "08vg70nr918n4ffi1wnbba4xrx5ak5vfgq7m5ik0rpkb2wdb4x6k";
|
||||||
|
"frappe/peach" = "1cg753w2dxs0sx97d8y0g62s8aw3w6b9hrll0lsrw3bc1bvm23fl";
|
||||||
|
"frappe/yellow" = "0g43g2if1pcm25i261zfw43bawqqdlgg2f6q2bqhyqvafk9yb3dy";
|
||||||
|
"frappe/green" = "1n71mndzds3zldb271g8hdw1yn29s68svzvh8ckjcsz4sb9h1i74";
|
||||||
|
"frappe/teal" = "0b6m9cibfwf8csh1pk5i76xi3wx3v2aqwgffzsidw8nwc7c1a3wk";
|
||||||
|
"frappe/sky" = "1l4d44399ixshlc9fdsx7iqwxm6kdkp6k4z3z6bdyyx6adw3z4q5";
|
||||||
|
"frappe/sapphire" = "03fa9rnclvs5ljd0lzz15vnkzpqpbrhfppg3zwfchs9fvak0n3ni";
|
||||||
|
"frappe/blue" = "0r4jjn3pab77w1aanlv3143ch60400q44mdzaqmcjbcr6l2knmjh";
|
||||||
|
"frappe/lavender" = "1mrkaz72w6j9hh4dpxwgd6ks5wsnq9ydgy6f9gms4jx1611aab96";
|
||||||
|
"macchiato/rosewater" = "001akfnhlvwaiz5faahl4qi0qp6as6ilvkbja6bjy9f5iasr4ygp";
|
||||||
|
"macchiato/flamingo" = "06xq3pbx4cb3pyblx2vydr4bp0ylm7866d66agg5wg5qnr356wb3";
|
||||||
|
"macchiato/pink" = "1hb32dj0n3wx4f1wxa4n7fib2mazghwsg2ljycza9macfn2n87qn";
|
||||||
|
"macchiato/mauve" = "1yrnp162blizc10fz2n6ls1x0di1sdjk53vpsl7mifrkcr1k2nq7";
|
||||||
|
"macchiato/red" = "1g9s39q7459lk830vhdrfqkbzz88p3fp8k98a2ygj2hz8sycpryq";
|
||||||
|
"macchiato/maroon" = "0ad7rx8sbkygvsgywhpjvvzmyflyhz7jlm13dr7cxj3801rxhl6d";
|
||||||
|
"macchiato/peach" = "1m5m6afcl8s1ghn2b9n1d20fhsygnhgn0205nhpxh4bih3kg8c8m";
|
||||||
|
"macchiato/yellow" = "0zcc26d28jaq71mz8nqssz8p0hylczirjwjxr2dkha1133vjmvy5";
|
||||||
|
"macchiato/green" = "055xdb5jilp5fq3a1g8773rv52zr68fp4l3hs56yj6dy3bq3q22v";
|
||||||
|
"macchiato/teal" = "1sfci2g2nvmj0v72gnxqbj0k8053qz0rl6iphfxs3pgpi1b0rczq";
|
||||||
|
"macchiato/sky" = "0vhfmdliy8cbb0vqq3v26isvcz4sxzq0xrb4p5a6gibvxaqi6bf3";
|
||||||
|
"macchiato/sapphire" = "1744jiv57aqz4qi52n92nrx0s1rhylgg08qqc31jr2clk9h6bw18";
|
||||||
|
"macchiato/blue" = "1arp8r2g8ivs1xipq39d3l6cvx0zrr1vwv9yac5j33d6c93wbb2i";
|
||||||
|
"macchiato/lavender" = "0kak1f574c07gqjfafg3w5avrci584iqxjkmvrl2pv1879g84nn3";
|
||||||
|
"mocha/rosewater" = "0p3ck9crskrhk1za6knaznjlj464mx4sdkkadna6k2152m3czjpz";
|
||||||
|
"mocha/flamingo" = "04xx1mky230saqxxqin2fph8cnnz1jhmvb9qd9f5yc3pai3q5wdw";
|
||||||
|
"mocha/pink" = "1cj9zdd72vcc45ziav625yq6hrp1zw21f7xsic0ip065xcqzdl3p";
|
||||||
|
"mocha/mauve" = "1wb0ibmdv6vn07bk570pikm43qdxj3n2zsqr5sip17ay05j5l6dm";
|
||||||
|
"mocha/red" = "1mnzrk57ar2cphyi2ry2lg5ilmb26gm4pr7ixch2ls0hk8ilp9p9";
|
||||||
|
"mocha/maroon" = "1mcpwz3yrg3kk0hkqv5nykxj07bm70403yyl8r60pqlh74dnhkbf";
|
||||||
|
"mocha/peach" = "0jglpcs41rfqxcm45mvnbdqhma0bv4h07nc7c3nrwz3g3h2djmzr";
|
||||||
|
"mocha/yellow" = "0jqkvcjiwid1zdvrj2ikqf5winm08qyd51nfsawfdspbfhqnzmis";
|
||||||
|
"mocha/green" = "0bg0014a77yx7f2r6n4mxm7rqgdnymqq7cq6bvpgkfk2z1gyr38l";
|
||||||
|
"mocha/teal" = "0kzvi3gfirpcxdhgsilm51lk3j1z6lavb7160chgd9jhzk0xg97c";
|
||||||
|
"mocha/sky" = "057nmp2aywdxzrkmzi65bh2mvf1a9cnri0g0jdyzdnrn7f8bbsiw";
|
||||||
|
"mocha/sapphire" = "0nfklzb0a7mxv6nzav7m2g0y9plm72vwadm06445myv3k9j3ffmj";
|
||||||
|
"mocha/blue" = "06ay46x2aq1q5ghz2zhzhn6qyqkrrf4p9j59qywnxh1jvv728ns8";
|
||||||
|
"mocha/lavender" = "0iip063f6km17998c7ak0lb3kq6iskyi3xv2phn618mhslnxhwm5";
|
||||||
|
};
|
||||||
|
|
||||||
|
catppuccinThemes = lib.concatMap (
|
||||||
|
flavour:
|
||||||
|
map (
|
||||||
|
accent:
|
||||||
|
builtins.fromJSON (
|
||||||
|
builtins.readFile (
|
||||||
|
pkgs.fetchurl {
|
||||||
|
url = "https://element.catppuccin.com/${flavour.slug}/${accent}.json";
|
||||||
|
sha256 = themeHashes."${flavour.slug}/${accent}";
|
||||||
|
}
|
||||||
|
)
|
||||||
|
)
|
||||||
|
) accents
|
||||||
|
) flavours;
|
||||||
|
|
||||||
|
elementConfig = builtins.toFile "element-config.json" (
|
||||||
|
builtins.toJSON {
|
||||||
|
default_server_config = {
|
||||||
|
"m.homeserver" = {
|
||||||
|
base_url = "https://matrix.cyperpunk.de";
|
||||||
|
server_name = "cyperpunk.de";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
setting_defaults = {
|
||||||
|
custom_themes = catppuccinThemes;
|
||||||
|
feature_custom_themes = true;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
);
|
||||||
|
|
||||||
|
elementWebConfigured = pkgs.element-web.overrideAttrs (old: {
|
||||||
|
postInstall = (old.postInstall or "") + ''
|
||||||
|
cp ${elementConfig} $out/config.json
|
||||||
|
'';
|
||||||
|
});
|
||||||
|
|
||||||
|
in
|
||||||
|
{
|
||||||
|
services.nginx.virtualHosts = {
|
||||||
|
"cinny.cyperpunk.de" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
root = "${pkgs.cinny}";
|
||||||
|
};
|
||||||
|
|
||||||
|
"element.cyperpunk.de" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
root = "${elementWebConfigured}";
|
||||||
|
};
|
||||||
|
|
||||||
|
"fluffy.cyperpunk.de" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://127.0.0.1:8082";
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
virtualisation.oci-containers.containers.fluffychat = {
|
||||||
|
image = "ghcr.io/krille-chan/fluffychat:latest";
|
||||||
|
ports = [ "127.0.0.1:8082:80" ];
|
||||||
|
volumes = [
|
||||||
|
"${
|
||||||
|
builtins.toFile "fluffychat-config.json" (
|
||||||
|
builtins.toJSON {
|
||||||
|
default_homeserver = "matrix.cyperpunk.de";
|
||||||
|
preset_homeserver = "matrix.cyperpunk.de";
|
||||||
|
}
|
||||||
|
)
|
||||||
|
}:/app/config.json:ro"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,95 @@
|
|||||||
|
{ config, lib, ... }:
|
||||||
|
{
|
||||||
|
sops.secrets = {
|
||||||
|
coturn_static_auth_secret = {
|
||||||
|
owner = "turnserver";
|
||||||
|
group = "turnserver";
|
||||||
|
};
|
||||||
|
|
||||||
|
coturn_static_auth_secret_synapse = {
|
||||||
|
owner = "matrix-synapse";
|
||||||
|
group = "matrix-synapse";
|
||||||
|
key = "coturn_static_auth_secret";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services = {
|
||||||
|
coturn = rec {
|
||||||
|
enable = true;
|
||||||
|
no-cli = true;
|
||||||
|
no-tcp-relay = true;
|
||||||
|
min-port = 49000;
|
||||||
|
max-port = 50000;
|
||||||
|
use-auth-secret = true;
|
||||||
|
static-auth-secret-file = config.sops.secrets.coturn_static_auth_secret.path;
|
||||||
|
realm = "turn.cyperpunk.de";
|
||||||
|
cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
|
||||||
|
pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
|
||||||
|
extraConfig = ''
|
||||||
|
no-multicast-peers
|
||||||
|
denied-peer-ip=0.0.0.0-0.255.255.255
|
||||||
|
denied-peer-ip=10.0.0.0-10.255.255.255
|
||||||
|
denied-peer-ip=100.64.0.0-100.127.255.255
|
||||||
|
denied-peer-ip=127.0.0.0-127.255.255.255
|
||||||
|
denied-peer-ip=169.254.0.0-169.254.255.255
|
||||||
|
denied-peer-ip=172.16.0.0-172.31.255.255
|
||||||
|
denied-peer-ip=192.0.0.0-192.0.0.255
|
||||||
|
denied-peer-ip=192.0.2.0-192.0.2.255
|
||||||
|
denied-peer-ip=192.88.99.0-192.88.99.255
|
||||||
|
denied-peer-ip=192.168.0.0-192.168.255.255
|
||||||
|
denied-peer-ip=198.18.0.0-198.19.255.255
|
||||||
|
denied-peer-ip=198.51.100.0-198.51.100.255
|
||||||
|
denied-peer-ip=203.0.113.0-203.0.113.255
|
||||||
|
denied-peer-ip=240.0.0.0-255.255.255.255
|
||||||
|
denied-peer-ip=::1
|
||||||
|
denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
|
||||||
|
denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
|
||||||
|
denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
|
||||||
|
denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
|
||||||
|
denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
||||||
|
denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
||||||
|
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
||||||
|
'';
|
||||||
|
relay-ips = [ "178.254.8.35" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
nginx.virtualHosts."turn.cyperpunk.de" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
matrix-synapse.settings = with config.services.coturn; {
|
||||||
|
turn_uris = [
|
||||||
|
"turn:${realm}:3478?transport=udp"
|
||||||
|
"turn:${realm}:3478?transport=tcp"
|
||||||
|
];
|
||||||
|
turn_shared_secret_path = config.sops.secrets.coturn_static_auth_secret_synapse.path;
|
||||||
|
turn_user_lifetime = "1h";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
security.acme.certs."turn.cyperpunk.de".group = "nginx";
|
||||||
|
|
||||||
|
users.users.turnserver.extraGroups = [ "nginx" ];
|
||||||
|
|
||||||
|
networking.firewall.interfaces.ens3 =
|
||||||
|
let
|
||||||
|
range =
|
||||||
|
with config.services.coturn;
|
||||||
|
lib.singleton {
|
||||||
|
from = min-port;
|
||||||
|
to = max-port;
|
||||||
|
};
|
||||||
|
in
|
||||||
|
{
|
||||||
|
allowedUDPPortRanges = range;
|
||||||
|
allowedUDPPorts = [
|
||||||
|
3478
|
||||||
|
5349
|
||||||
|
];
|
||||||
|
allowedTCPPorts = [
|
||||||
|
3478
|
||||||
|
5349
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -4,28 +4,11 @@
|
|||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
./synapse.nix
|
./synapse.nix
|
||||||
./lk-jwt.nix
|
|
||||||
./livekit.nix
|
./livekit.nix
|
||||||
|
./clients.nix
|
||||||
|
./mjolnir.nix
|
||||||
|
./coturn.nix
|
||||||
|
./discord-bridge.nix
|
||||||
|
./whatsapp-bridge.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
#networking.firewall = {
|
|
||||||
# allowedTCPPorts = [
|
|
||||||
# 8008 # Matrix Synapse
|
|
||||||
# 8009 # Cinny
|
|
||||||
# 8010 # Element
|
|
||||||
# 8011 # Synapse Admin
|
|
||||||
# 8012 # FluffyChat
|
|
||||||
# 8448 # Matrix federation
|
|
||||||
# 3478 # TURN (coturn)
|
|
||||||
# ];
|
|
||||||
# allowedUDPPorts = [
|
|
||||||
# 3478 # TURN (coturn)
|
|
||||||
# ];
|
|
||||||
# allowedUDPPortRanges = [
|
|
||||||
# {
|
|
||||||
# from = 49152;
|
|
||||||
# to = 65535; # TURN relay ports (coturn)
|
|
||||||
# }
|
|
||||||
# ];
|
|
||||||
#};
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -0,0 +1,64 @@
|
|||||||
|
{ config, pkgs, ... }:
|
||||||
|
{
|
||||||
|
nixpkgs.config.permittedInsecurePackages = [ "olm-3.2.16" ];
|
||||||
|
|
||||||
|
sops.secrets.discord_bot_token = {
|
||||||
|
owner = "mautrix-discord";
|
||||||
|
group = "mautrix-discord";
|
||||||
|
};
|
||||||
|
sops.secrets.discord_client_id = {
|
||||||
|
owner = "mautrix-discord";
|
||||||
|
group = "mautrix-discord";
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.mautrix-discord-env = {
|
||||||
|
before = [ "mautrix-discord-registration.service" ];
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
RemainAfterExit = true;
|
||||||
|
};
|
||||||
|
script = ''
|
||||||
|
mkdir -p /run/mautrix-discord
|
||||||
|
echo "DISCORD_BOT_TOKEN=$(cat ${config.sops.secrets.discord_bot_token.path})" > /run/mautrix-discord/env
|
||||||
|
echo "DISCORD_CLIENT_ID=$(cat ${config.sops.secrets.discord_client_id.path})" >> /run/mautrix-discord/env
|
||||||
|
chmod 600 /run/mautrix-discord/env
|
||||||
|
chown mautrix-discord:mautrix-discord /run/mautrix-discord/env
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
services.postgresql = {
|
||||||
|
ensureUsers = [
|
||||||
|
{
|
||||||
|
name = "mautrix-discord";
|
||||||
|
ensureDBOwnership = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
ensureDatabases = [ "mautrix-discord" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
services.mautrix-discord = {
|
||||||
|
enable = true;
|
||||||
|
environmentFile = "/run/mautrix-discord/env";
|
||||||
|
settings = {
|
||||||
|
homeserver = {
|
||||||
|
address = "http://127.0.0.1:8008";
|
||||||
|
domain = "cyperpunk.de";
|
||||||
|
};
|
||||||
|
appservice.database = {
|
||||||
|
type = "postgres";
|
||||||
|
uri = "postgres:///mautrix-discord?host=/run/postgresql&sslmode=disable";
|
||||||
|
};
|
||||||
|
bridge = {
|
||||||
|
permissions = {
|
||||||
|
"cyperpunk.de" = "user";
|
||||||
|
"@dergrumpf:cyperpunk.de" = "admin";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
discord = {
|
||||||
|
client_id = "$DISCORD_CLIENT_ID";
|
||||||
|
bot_token = "$DISCORD_BOT_TOKEN";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -1,54 +1,19 @@
|
|||||||
{ config, lib, ... }:
|
{ config, ... }:
|
||||||
{
|
{
|
||||||
sops.secrets.livekit_key_sfu = { };
|
sops.secrets.livekit_key_file = { };
|
||||||
|
|
||||||
services.livekit = {
|
services.livekit = {
|
||||||
enable = true;
|
enable = true;
|
||||||
openFirewall = true;
|
openFirewall = true;
|
||||||
keyFile = config.sops.secrets.livekit_key_sfu.path;
|
settings.room.auto_create = false;
|
||||||
settings = {
|
keyFile = config.sops.secrets.livekit_key_file.path;
|
||||||
rtc = {
|
|
||||||
tcp_port = 7881;
|
|
||||||
#udp_port = 7882;
|
|
||||||
port_range_start = 50000;
|
|
||||||
port_range_end = 60000;
|
|
||||||
use_external_ip = true;
|
|
||||||
node_ip = "178.254.8.35";
|
|
||||||
};
|
|
||||||
room = {
|
|
||||||
auto_create = true;
|
|
||||||
enabled_codecs = [
|
|
||||||
{ mime = "video/VP8"; }
|
|
||||||
{ mime = "video/VP9"; }
|
|
||||||
{ mime = "video/H264"; }
|
|
||||||
{ mime = "audio/opus"; }
|
|
||||||
];
|
|
||||||
enable_remote_unmute = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
networking.firewall.allowedTCPPorts = [ 7881 ];
|
|
||||||
|
|
||||||
systemd.services.livekit.serviceConfig = {
|
|
||||||
PrivateUsers = lib.mkForce false;
|
|
||||||
DynamicUser = lib.mkForce false;
|
|
||||||
User = "livekit";
|
|
||||||
Group = "livekit";
|
|
||||||
RestrictAddressFamilies = lib.mkForce [
|
|
||||||
"AF_INET"
|
|
||||||
"AF_INET6"
|
|
||||||
"AF_NETLINK"
|
|
||||||
"AF_UNIX"
|
|
||||||
];
|
|
||||||
SystemCallFilter = lib.mkForce [ "@system-service" ];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
users = {
|
services.lk-jwt-service = {
|
||||||
users.livekit = {
|
enable = true;
|
||||||
isSystemUser = true;
|
livekitUrl = "wss://cyperpunk.de/livekit/sfu";
|
||||||
group = "livekit";
|
keyFile = config.sops.secrets.livekit_key_file.path;
|
||||||
};
|
|
||||||
groups.livekit = { };
|
|
||||||
};
|
};
|
||||||
|
|
||||||
|
systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = "cyperpunk.de";
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,25 +0,0 @@
|
|||||||
{ config, lib, ... }:
|
|
||||||
let
|
|
||||||
domain = "cyperpunk.de";
|
|
||||||
synapseUrl = "http://localhost:8008";
|
|
||||||
in
|
|
||||||
{
|
|
||||||
sops.secrets.livekit_key_jwt = { };
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 18080 ];
|
|
||||||
|
|
||||||
services.lk-jwt-service = {
|
|
||||||
enable = true;
|
|
||||||
keyFile = config.sops.secrets.livekit_key_jwt.path;
|
|
||||||
livekitUrl = "wss://cyperpunk.de/livekit/sfu";
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.lk-jwt-service = {
|
|
||||||
environment = {
|
|
||||||
LIVEKIT_FULL_ACCESS_HOMESERVERS = domain;
|
|
||||||
MATRIX_BASE_URL = synapseUrl;
|
|
||||||
LIVEKIT_JWT_BIND = lib.mkForce ":18080";
|
|
||||||
LIVEKIT_INSECURE_SKIP_VERIFY_TLS = "YES_I_KNOW_WHAT_I_AM_DOING";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
{ config, ... }:
|
||||||
|
{
|
||||||
|
sops.secrets.mjolnir_access_token = { };
|
||||||
|
|
||||||
|
services.draupnir = {
|
||||||
|
enable = true;
|
||||||
|
secrets.accessToken = config.sops.secrets.mjolnir_access_token.path;
|
||||||
|
settings = {
|
||||||
|
homeserverUrl = "https://matrix.cyperpunk.de";
|
||||||
|
managementRoom = "!eErCimyDjLSebHjpJA:cyperpunk.de";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
#curl -X POST https://matrix.cyperpunk.de/_matrix/client/v3/login \
|
||||||
|
# -H "Content-Type: application/json" \
|
||||||
|
# -d '{"type":"m.login.password ","user":"mjolnir","password":"i318HXBRkt)Lh$nOPwq#6n9z&<W[XJ&2c4$Zf>7jV}-uQCE{<plwk;LZ)10*N<~1"}'
|
||||||
@@ -3,13 +3,30 @@
|
|||||||
pkgs,
|
pkgs,
|
||||||
...
|
...
|
||||||
}:
|
}:
|
||||||
|
let
|
||||||
|
wellKnownMatrix = {
|
||||||
|
"= /.well-known/matrix/client" = {
|
||||||
|
extraConfig = ''
|
||||||
|
default_type application/json;
|
||||||
|
add_header Access-Control-Allow-Origin *;
|
||||||
|
return 200 '{"m.homeserver":{"base_url":"https://matrix.cyperpunk.de"},"org.matrix.msc4143.rtc_foci":[{"type":"livekit","livekit_service_url":"https://cyperpunk.de/livekit/jwt/"}]}';
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
"= /.well-known/matrix/server" = {
|
||||||
|
extraConfig = ''
|
||||||
|
default_type application/json;
|
||||||
|
add_header Access-Control-Allow-Origin *;
|
||||||
|
return 200 '{"m.server":"matrix.cyperpunk.de:443"}';
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
synapseAdmin = pkgs.ketesa.withConfig {
|
||||||
|
restrictBaseUrl = [ "https://matrix.cyperpunk.de" ];
|
||||||
|
loginFlows = [ "password" ];
|
||||||
|
};
|
||||||
|
in
|
||||||
{
|
{
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [
|
|
||||||
8008 # Matrix Synapse
|
|
||||||
8448 # Matrix federation
|
|
||||||
];
|
|
||||||
|
|
||||||
sops.secrets = {
|
sops.secrets = {
|
||||||
matrix_macaroon_secret = { };
|
matrix_macaroon_secret = { };
|
||||||
matrix_registration_secret = {
|
matrix_registration_secret = {
|
||||||
@@ -24,24 +41,36 @@
|
|||||||
settings = {
|
settings = {
|
||||||
server_name = "cyperpunk.de";
|
server_name = "cyperpunk.de";
|
||||||
public_baseurl = "https://matrix.cyperpunk.de";
|
public_baseurl = "https://matrix.cyperpunk.de";
|
||||||
enable_registration = false; # TODO: disable
|
enable_registration = false;
|
||||||
enable_registration_without_verification = false;
|
|
||||||
trusted_key_servers = [ { server_name = "matrix.org"; } ];
|
trusted_key_servers = [ { server_name = "matrix.org"; } ];
|
||||||
suppress_key_server_warning = true;
|
suppress_key_server_warning = true;
|
||||||
registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path;
|
registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path;
|
||||||
macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}";
|
macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}";
|
||||||
experimental_features = {
|
matrix_rtc = {
|
||||||
"msc3266_enabled" = true;
|
enabled = true;
|
||||||
"msc3779_enabled" = true;
|
transports = [
|
||||||
"msc3401_enabled" = true;
|
{
|
||||||
"msc4143_enabled" = true;
|
type = "livekit";
|
||||||
"msc4195_enabled" = true;
|
livekit_service_url = "https://cyperpunk.de/livekit/jwt/";
|
||||||
"msc4222_enabled" = true;
|
}
|
||||||
|
];
|
||||||
};
|
};
|
||||||
|
#experimental_features = {
|
||||||
|
# msc3266_enabled = true;
|
||||||
|
# msc3779_enabled = true;
|
||||||
|
# msc3401_enabled = true;
|
||||||
|
# msc4143_enabled = true;
|
||||||
|
# msc4195_enabled = true;
|
||||||
|
# msc4222_enabled = true;
|
||||||
|
#};
|
||||||
|
|
||||||
listeners = [
|
listeners = [
|
||||||
{
|
{
|
||||||
port = 8008;
|
port = 8008;
|
||||||
bind_addresses = [ "0.0.0.0" ];
|
bind_addresses = [
|
||||||
|
"127.0.0.1"
|
||||||
|
"::1"
|
||||||
|
];
|
||||||
type = "http";
|
type = "http";
|
||||||
tls = false;
|
tls = false;
|
||||||
x_forwarded = true;
|
x_forwarded = true;
|
||||||
@@ -52,7 +81,7 @@
|
|||||||
"federation"
|
"federation"
|
||||||
"openid"
|
"openid"
|
||||||
];
|
];
|
||||||
compress = false;
|
compress = true;
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
@@ -64,19 +93,53 @@
|
|||||||
resources = [ ];
|
resources = [ ];
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
matrix_rtc = {
|
|
||||||
enabled = true;
|
|
||||||
transports = [
|
|
||||||
{
|
|
||||||
type = "livekit";
|
|
||||||
livekit_service_url = "https://cyperpunk.de/livekit/jwt/";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
enable_metrics = true;
|
enable_metrics = true;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
nginx.virtualHosts = {
|
||||||
|
# Matrix homeserver
|
||||||
|
"cyperpunk.de" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
serverAliases = [ "matrix.cyperpunk.de" ];
|
||||||
|
http2 = true;
|
||||||
|
locations = wellKnownMatrix // {
|
||||||
|
"/_matrix".proxyPass = "http://127.0.0.1:8008";
|
||||||
|
"/_synapse/client".proxyPass = "http://127.0.0.1:8008";
|
||||||
|
"/_synapse/admin".proxyPass = "http://127.0.0.1:8008";
|
||||||
|
"/metrics" = {
|
||||||
|
proxyPass = "http://127.0.0.1:9009";
|
||||||
|
extraConfig = ''
|
||||||
|
allow 127.0.0.1;
|
||||||
|
deny all;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
"/admin/" = {
|
||||||
|
alias = "${synapseAdmin}/";
|
||||||
|
tryFiles = "$uri $uri/ /admin/index.html";
|
||||||
|
};
|
||||||
|
"^~ /livekit/jwt/" = {
|
||||||
|
priority = 400;
|
||||||
|
proxyPass = "http://127.0.0.1:${toString config.services.lk-jwt-service.port}/";
|
||||||
|
};
|
||||||
|
"^~ /livekit/sfu/" = {
|
||||||
|
priority = 400;
|
||||||
|
proxyPass = "http://127.0.0.1:${toString config.services.livekit.settings.port}/";
|
||||||
|
proxyWebsockets = true;
|
||||||
|
extraConfig = ''
|
||||||
|
proxy_send_timeout 120;
|
||||||
|
proxy_read_timeout 120;
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_set_header Accept-Encoding gzip;
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
postgresql = {
|
postgresql = {
|
||||||
enable = true;
|
enable = true;
|
||||||
initialScript = pkgs.writeText "synapse-init.sql" ''
|
initialScript = pkgs.writeText "synapse-init.sql" ''
|
||||||
|
|||||||
@@ -0,0 +1,30 @@
|
|||||||
|
{ ... }:
|
||||||
|
{
|
||||||
|
services.postgresql = {
|
||||||
|
ensureUsers = [
|
||||||
|
{
|
||||||
|
name = "mautrix-whatsapp";
|
||||||
|
ensureDBOwnership = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
ensureDatabases = [ "mautrix-whatsapp" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
services.mautrix-whatsapp = {
|
||||||
|
enable = true;
|
||||||
|
settings = {
|
||||||
|
homeserver = {
|
||||||
|
address = "http://127.0.0.1:8008";
|
||||||
|
domain = "cyperpunk.de";
|
||||||
|
};
|
||||||
|
database = {
|
||||||
|
type = "postgres";
|
||||||
|
uri = "postgres:///mautrix-whatsapp?host=/run/postgresql&sslmode=disable";
|
||||||
|
};
|
||||||
|
bridge.permissions = {
|
||||||
|
"cyperpunk.de" = "user";
|
||||||
|
"@dergrumpf:cyperpunk.de" = "admin";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
+2
-301
@@ -1,4 +1,4 @@
|
|||||||
{ pkgs, lib, ... }:
|
_:
|
||||||
let
|
let
|
||||||
upstream = "100.109.179.25";
|
upstream = "100.109.179.25";
|
||||||
|
|
||||||
@@ -19,210 +19,6 @@ let
|
|||||||
proxyWebsockets = true;
|
proxyWebsockets = true;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
matrixConfig = ''
|
|
||||||
client_max_body_size 50M;
|
|
||||||
proxy_set_header X-Forwarded-For $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
'';
|
|
||||||
|
|
||||||
wellKnownMatrix = {
|
|
||||||
"/.well-known/matrix/client" = {
|
|
||||||
extraConfig = ''
|
|
||||||
default_type application/json;
|
|
||||||
add_header Access-Control-Allow-Origin *;
|
|
||||||
return 200 '{
|
|
||||||
"m.homeserver":{
|
|
||||||
"base_url":"https://matrix.cyperpunk.de"
|
|
||||||
},
|
|
||||||
"org.matrix.msc4143.rtc_foci":[
|
|
||||||
{
|
|
||||||
"type":"livekit",
|
|
||||||
"livekit_service_url":"https://cyperpunk.de/livekit/jwt/"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}';
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
"/.well-known/matrix/server" = {
|
|
||||||
extraConfig = ''
|
|
||||||
default_type application/json;
|
|
||||||
add_header Access-Control-Allow-Origin *;
|
|
||||||
return 200 '{"m.server":"matrix.cyperpunk.de:443"}';
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
flavours = [
|
|
||||||
{
|
|
||||||
name = "Latte";
|
|
||||||
slug = "latte";
|
|
||||||
is_dark = false;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
name = "Frappé";
|
|
||||||
slug = "frappe";
|
|
||||||
is_dark = true;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
name = "Macchiato";
|
|
||||||
slug = "macchiato";
|
|
||||||
is_dark = true;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
name = "Mocha";
|
|
||||||
slug = "mocha";
|
|
||||||
is_dark = true;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
accents = [
|
|
||||||
"rosewater"
|
|
||||||
"flamingo"
|
|
||||||
"pink"
|
|
||||||
"mauve"
|
|
||||||
"red"
|
|
||||||
"maroon"
|
|
||||||
"peach"
|
|
||||||
"yellow"
|
|
||||||
"green"
|
|
||||||
"teal"
|
|
||||||
"sky"
|
|
||||||
"sapphire"
|
|
||||||
"blue"
|
|
||||||
"lavender"
|
|
||||||
];
|
|
||||||
themeHashes = {
|
|
||||||
"latte/rosewater" = "0l1m4bhaxdam07rfqag6pjbzhdpyi5w3i14vp6rq7aj59pildw3a";
|
|
||||||
"latte/flamingo" = "1m8hh2l87xv2rfgpnnl5vzddmam0n82h25fwadb37blgab08vhsr";
|
|
||||||
"latte/pink" = "0ambrc42mvg0vdspfmnl31ka1nsxpdyv1p3nh045822y02q20wwh";
|
|
||||||
"latte/mauve" = "1nnn2w6nsr24a45jy497c2vhi8v64bwg99fj2dyhpfsn89c63lhn";
|
|
||||||
"latte/red" = "14lmw4c4llfz6zqvfymkc6k3msxcml2gwq9rhwsixdpc5mjjbn8n";
|
|
||||||
"latte/maroon" = "0ydpng9451mpn7hv5ag1ck8hryx8pdvrml3zksvzm2fiwzzjkpcf";
|
|
||||||
"latte/peach" = "1fn5804wv9z9iv65ikyv015b01a7c546rsaaks2a2sq2c37n75l0";
|
|
||||||
"latte/yellow" = "0hzgiyhqmwgp3h3v1y23sx3x5qp712sw106472lbnxbywqlavcza";
|
|
||||||
"latte/green" = "194kxv6d9hc4nixy16hy9nvf32qs3v214nr2r2qf2z9l89rk5pnp";
|
|
||||||
"latte/teal" = "12n25d38zpqxsskglymhmza972klg2hj3c23v2nb3jfj82llw6v4";
|
|
||||||
"latte/sky" = "0yghds3xpmbhkbcj2jkh8df82j6vrn9q1z0s2129nca7l5g5f9w2";
|
|
||||||
"latte/sapphire" = "18dl1srxp3xccvvy56za6kp05n68d918l0wrxga11746g9sib7r3";
|
|
||||||
"latte/blue" = "1zv9nap21d80flvd1jwmjph05jgykxngv5kqbhk95mvqh962ygnf";
|
|
||||||
"latte/lavender" = "03j4fwbscip1qm6px1qxkha0c5csq2wwvzg9vwjkc2ja48v1mp9k";
|
|
||||||
"frappe/rosewater" = "032qbgj32mvgpankl9777x2lxk18451kglsxg5215k8zrwcg9y95";
|
|
||||||
"frappe/flamingo" = "1grhgynn8q7isv18981km5k8ll72ihsjw2ciy8widl6wikv29j8p";
|
|
||||||
"frappe/pink" = "0h33g721bph8ihd6lmbc7szxy4dq85ng1cgg5cxjb5y2m7wpdbsy";
|
|
||||||
"frappe/mauve" = "121jmznc9q3p7crsy9p2khw8xnzvz4lxms26g1h5wqa67wqvalc4";
|
|
||||||
"frappe/red" = "07wm4h1giyy6a5nlh0d3qdarfsp6ikyr5nmg94n13lj4q03d0cn0";
|
|
||||||
"frappe/maroon" = "08vg70nr918n4ffi1wnbba4xrx5ak5vfgq7m5ik0rpkb2wdb4x6k";
|
|
||||||
"frappe/peach" = "1cg753w2dxs0sx97d8y0g62s8aw3w6b9hrll0lsrw3bc1bvm23fl";
|
|
||||||
"frappe/yellow" = "0g43g2if1pcm25i261zfw43bawqqdlgg2f6q2bqhyqvafk9yb3dy";
|
|
||||||
"frappe/green" = "1n71mndzds3zldb271g8hdw1yn29s68svzvh8ckjcsz4sb9h1i74";
|
|
||||||
"frappe/teal" = "0b6m9cibfwf8csh1pk5i76xi3wx3v2aqwgffzsidw8nwc7c1a3wk";
|
|
||||||
"frappe/sky" = "1l4d44399ixshlc9fdsx7iqwxm6kdkp6k4z3z6bdyyx6adw3z4q5";
|
|
||||||
"frappe/sapphire" = "03fa9rnclvs5ljd0lzz15vnkzpqpbrhfppg3zwfchs9fvak0n3ni";
|
|
||||||
"frappe/blue" = "0r4jjn3pab77w1aanlv3143ch60400q44mdzaqmcjbcr6l2knmjh";
|
|
||||||
"frappe/lavender" = "1mrkaz72w6j9hh4dpxwgd6ks5wsnq9ydgy6f9gms4jx1611aab96";
|
|
||||||
"macchiato/rosewater" = "001akfnhlvwaiz5faahl4qi0qp6as6ilvkbja6bjy9f5iasr4ygp";
|
|
||||||
"macchiato/flamingo" = "06xq3pbx4cb3pyblx2vydr4bp0ylm7866d66agg5wg5qnr356wb3";
|
|
||||||
"macchiato/pink" = "1hb32dj0n3wx4f1wxa4n7fib2mazghwsg2ljycza9macfn2n87qn";
|
|
||||||
"macchiato/mauve" = "1yrnp162blizc10fz2n6ls1x0di1sdjk53vpsl7mifrkcr1k2nq7";
|
|
||||||
"macchiato/red" = "1g9s39q7459lk830vhdrfqkbzz88p3fp8k98a2ygj2hz8sycpryq";
|
|
||||||
"macchiato/maroon" = "0ad7rx8sbkygvsgywhpjvvzmyflyhz7jlm13dr7cxj3801rxhl6d";
|
|
||||||
"macchiato/peach" = "1m5m6afcl8s1ghn2b9n1d20fhsygnhgn0205nhpxh4bih3kg8c8m";
|
|
||||||
"macchiato/yellow" = "0zcc26d28jaq71mz8nqssz8p0hylczirjwjxr2dkha1133vjmvy5";
|
|
||||||
"macchiato/green" = "055xdb5jilp5fq3a1g8773rv52zr68fp4l3hs56yj6dy3bq3q22v";
|
|
||||||
"macchiato/teal" = "1sfci2g2nvmj0v72gnxqbj0k8053qz0rl6iphfxs3pgpi1b0rczq";
|
|
||||||
"macchiato/sky" = "0vhfmdliy8cbb0vqq3v26isvcz4sxzq0xrb4p5a6gibvxaqi6bf3";
|
|
||||||
"macchiato/sapphire" = "1744jiv57aqz4qi52n92nrx0s1rhylgg08qqc31jr2clk9h6bw18";
|
|
||||||
"macchiato/blue" = "1arp8r2g8ivs1xipq39d3l6cvx0zrr1vwv9yac5j33d6c93wbb2i";
|
|
||||||
"macchiato/lavender" = "0kak1f574c07gqjfafg3w5avrci584iqxjkmvrl2pv1879g84nn3";
|
|
||||||
"mocha/rosewater" = "0p3ck9crskrhk1za6knaznjlj464mx4sdkkadna6k2152m3czjpz";
|
|
||||||
"mocha/flamingo" = "04xx1mky230saqxxqin2fph8cnnz1jhmvb9qd9f5yc3pai3q5wdw";
|
|
||||||
"mocha/pink" = "1cj9zdd72vcc45ziav625yq6hrp1zw21f7xsic0ip065xcqzdl3p";
|
|
||||||
"mocha/mauve" = "1wb0ibmdv6vn07bk570pikm43qdxj3n2zsqr5sip17ay05j5l6dm";
|
|
||||||
"mocha/red" = "1mnzrk57ar2cphyi2ry2lg5ilmb26gm4pr7ixch2ls0hk8ilp9p9";
|
|
||||||
"mocha/maroon" = "1mcpwz3yrg3kk0hkqv5nykxj07bm70403yyl8r60pqlh74dnhkbf";
|
|
||||||
"mocha/peach" = "0jglpcs41rfqxcm45mvnbdqhma0bv4h07nc7c3nrwz3g3h2djmzr";
|
|
||||||
"mocha/yellow" = "0jqkvcjiwid1zdvrj2ikqf5winm08qyd51nfsawfdspbfhqnzmis";
|
|
||||||
"mocha/green" = "0bg0014a77yx7f2r6n4mxm7rqgdnymqq7cq6bvpgkfk2z1gyr38l";
|
|
||||||
"mocha/teal" = "0kzvi3gfirpcxdhgsilm51lk3j1z6lavb7160chgd9jhzk0xg97c";
|
|
||||||
"mocha/sky" = "057nmp2aywdxzrkmzi65bh2mvf1a9cnri0g0jdyzdnrn7f8bbsiw";
|
|
||||||
"mocha/sapphire" = "0nfklzb0a7mxv6nzav7m2g0y9plm72vwadm06445myv3k9j3ffmj";
|
|
||||||
"mocha/blue" = "06ay46x2aq1q5ghz2zhzhn6qyqkrrf4p9j59qywnxh1jvv728ns8";
|
|
||||||
"mocha/lavender" = "0iip063f6km17998c7ak0lb3kq6iskyi3xv2phn618mhslnxhwm5";
|
|
||||||
};
|
|
||||||
catppuccinThemes = lib.concatMap (
|
|
||||||
flavour:
|
|
||||||
map (
|
|
||||||
accent:
|
|
||||||
builtins.fromJSON (
|
|
||||||
builtins.readFile (
|
|
||||||
pkgs.fetchurl {
|
|
||||||
url = "https://element.catppuccin.com/${flavour.slug}/${accent}.json";
|
|
||||||
sha256 = themeHashes."${flavour.slug}/${accent}";
|
|
||||||
}
|
|
||||||
)
|
|
||||||
)
|
|
||||||
) accents
|
|
||||||
) flavours;
|
|
||||||
|
|
||||||
elementConfig = builtins.toFile "element-config.json" (
|
|
||||||
builtins.toJSON {
|
|
||||||
default_server_config = {
|
|
||||||
"m.homeserver" = {
|
|
||||||
base_url = "https://matrix.cyperpunk.de";
|
|
||||||
server_name = "cyperpunk.de";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
jitsi.preferred_domain = "jitsi.cyperpunk.de";
|
|
||||||
element_call = {
|
|
||||||
url = "https://element-call.cyperpunk.de";
|
|
||||||
use_exclusively = true;
|
|
||||||
participant_limit = 8;
|
|
||||||
brand = "Cyperpunk Call";
|
|
||||||
encryption = "None";
|
|
||||||
};
|
|
||||||
livekit.livekit_service_url = "https://cyperpunk.de/livekit/jwt/";
|
|
||||||
setting_defaults = {
|
|
||||||
custom_themes = catppuccinThemes;
|
|
||||||
feature_custom_themes = true;
|
|
||||||
};
|
|
||||||
features = {
|
|
||||||
feature_group_calls = true;
|
|
||||||
feature_disable_call_per_sender_encryption = true;
|
|
||||||
feature_sliding_sync = true;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
);
|
|
||||||
|
|
||||||
elementWebConfigured = pkgs.element-web.overrideAttrs (old: {
|
|
||||||
postInstall = (old.postInstall or "") + ''
|
|
||||||
cp ${elementConfig} $out/config.json
|
|
||||||
'';
|
|
||||||
});
|
|
||||||
|
|
||||||
synapseAdmin = pkgs.ketesa.withConfig {
|
|
||||||
restrictBaseUrl = [ "https://matrix.cyperpunk.de" ];
|
|
||||||
loginFlows = [ "password" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
elementCallConfigured = pkgs.element-call.overrideAttrs (old: {
|
|
||||||
postInstall = (old.postInstall or "") + ''
|
|
||||||
cp ${
|
|
||||||
builtins.toFile "element-call-config.json" (
|
|
||||||
builtins.toJSON {
|
|
||||||
default_server_config = {
|
|
||||||
"m.homeserver" = {
|
|
||||||
base_url = "https://matrix.cyperpunk.de";
|
|
||||||
server_name = "cyperpunk.de";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
livekit_service_url = "https://cyperpunk.de/livekit/jwt/";
|
|
||||||
e2ee.default = false;
|
|
||||||
}
|
|
||||||
)
|
|
||||||
} $out/config.json
|
|
||||||
'';
|
|
||||||
});
|
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
networking.firewall.allowedTCPPorts = [
|
networking.firewall.allowedTCPPorts = [
|
||||||
@@ -243,7 +39,7 @@ in
|
|||||||
recommendedGzipSettings = true;
|
recommendedGzipSettings = true;
|
||||||
|
|
||||||
virtualHosts = {
|
virtualHosts = {
|
||||||
# controller services
|
# controller services (proxied to upstream tailscale node)
|
||||||
"git.cyperpunk.de" = mkProxy 9000;
|
"git.cyperpunk.de" = mkProxy 9000;
|
||||||
"search.cyperpunk.de" = mkProxy 11080;
|
"search.cyperpunk.de" = mkProxy 11080;
|
||||||
"file.cyperpunk.de" = mkProxy 10000;
|
"file.cyperpunk.de" = mkProxy 10000;
|
||||||
@@ -265,101 +61,6 @@ in
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
# local static clients
|
|
||||||
"cinny.cyperpunk.de" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
root = "${pkgs.cinny}";
|
|
||||||
};
|
|
||||||
|
|
||||||
"element.cyperpunk.de" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
root = "${elementWebConfigured}";
|
|
||||||
};
|
|
||||||
|
|
||||||
"element-call.cyperpunk.de" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
root = "${elementCallConfigured}";
|
|
||||||
extraConfig = ''
|
|
||||||
add_header Cross-Origin-Opener-Policy "same-origin";
|
|
||||||
add_header Cross-Origin-Embedder-Policy "require-corp";
|
|
||||||
add_header Cross-Origin-Resource-Policy "cross-origin";
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
"fluffy.cyperpunk.de" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
locations."/" = {
|
|
||||||
proxyPass = "http://127.0.0.1:8082";
|
|
||||||
proxyWebsockets = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
"admin.cyperpunk.de" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
root = "${synapseAdmin}";
|
|
||||||
};
|
|
||||||
|
|
||||||
# matrix + livekit
|
|
||||||
"cyperpunk.de" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
serverAliases = [ "matrix.cyperpunk.de" ];
|
|
||||||
http2 = true;
|
|
||||||
extraConfig = matrixConfig;
|
|
||||||
locations = wellKnownMatrix // {
|
|
||||||
"/" = {
|
|
||||||
proxyPass = "http://127.0.0.1:8008";
|
|
||||||
proxyWebsockets = true;
|
|
||||||
};
|
|
||||||
"^~ /livekit/jwt/" = {
|
|
||||||
priority = 400;
|
|
||||||
proxyPass = "http://127.0.0.1:18080/";
|
|
||||||
};
|
|
||||||
"^~ /livekit/sfu/" = {
|
|
||||||
priority = 400;
|
|
||||||
proxyPass = "http://127.0.0.1:7880/";
|
|
||||||
proxyWebsockets = true;
|
|
||||||
extraConfig = ''
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
proxy_read_timeout 86400s;
|
|
||||||
proxy_send_timeout 86400s;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
"/_matrix/client/unstable/org.matrix.msc4143/rtc/transports" = {
|
|
||||||
extraConfig = ''
|
|
||||||
default_type application/json;
|
|
||||||
add_header Access-Control-Allow-Origin *;
|
|
||||||
add_header Access-Control-Allow-Headers "Authorization, Content-Type";
|
|
||||||
add_header Access-Control-Allow-Methods "GET, OPTIONS";
|
|
||||||
return 200 '{"rtc_transports":[{"type":"livekit","livekit_service_url":"https://cyperpunk.de/livekit/jwt/"}]}';
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
virtualisation.oci-containers.containers.fluffychat = {
|
|
||||||
image = "ghcr.io/krille-chan/fluffychat:latest";
|
|
||||||
ports = [ "127.0.0.1:8082:80" ];
|
|
||||||
volumes = [
|
|
||||||
"${
|
|
||||||
builtins.toFile "fluffychat-config.json" (
|
|
||||||
builtins.toJSON {
|
|
||||||
default_homeserver = "matrix.cyperpunk.de";
|
|
||||||
preset_homeserver = "matrix.cyperpunk.de";
|
|
||||||
}
|
|
||||||
)
|
|
||||||
}:/app/config.json:ro"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -8,8 +8,11 @@ vaultwarden_admin_token: ENC[AES256_GCM,data:yoBs4CaIEJXB5b3PEwTpXFgxpX39hR9A4r9
|
|||||||
flame_phil_password: ENC[AES256_GCM,data:Xy2ixMeRlnzC2gjKGrjfSbz/ee4=,iv:WFuBS8jn7WYRxEDG3XBzCMnm4eNkHQpSs5+GUwq/dcg=,tag:1zzj0eB9/4KrmYAqcxJMlg==,type:str]
|
flame_phil_password: ENC[AES256_GCM,data:Xy2ixMeRlnzC2gjKGrjfSbz/ee4=,iv:WFuBS8jn7WYRxEDG3XBzCMnm4eNkHQpSs5+GUwq/dcg=,tag:1zzj0eB9/4KrmYAqcxJMlg==,type:str]
|
||||||
flame_calvin_password: ENC[AES256_GCM,data:P5ppyqTjAJ1TL4hXtx5WyoS9a+g=,iv:sq98P3Oqud2FXfqsD76YS/p5NEF2xlN0MfG+ukCB9B0=,tag:AeKnu4Hg4xQ3tII0y6oNpQ==,type:str]
|
flame_calvin_password: ENC[AES256_GCM,data:P5ppyqTjAJ1TL4hXtx5WyoS9a+g=,iv:sq98P3Oqud2FXfqsD76YS/p5NEF2xlN0MfG+ukCB9B0=,tag:AeKnu4Hg4xQ3tII0y6oNpQ==,type:str]
|
||||||
paperless_admin: ENC[AES256_GCM,data:sVvlMQ3dDE2XsDfpwpCTbzPCEKdUMNTFtRXDIuBbgyf1gd6oiJzE23Ytc57plNUGg5h5aEtgxZ7NXeuK5vrhQw==,iv:x+QNAzY9k9t23UYlM9GcAke0urEA5jlV0VzHaBQkm7M=,tag:D/bMtjuwrX6pquZfJLwdkQ==,type:str]
|
paperless_admin: ENC[AES256_GCM,data:sVvlMQ3dDE2XsDfpwpCTbzPCEKdUMNTFtRXDIuBbgyf1gd6oiJzE23Ytc57plNUGg5h5aEtgxZ7NXeuK5vrhQw==,iv:x+QNAzY9k9t23UYlM9GcAke0urEA5jlV0VzHaBQkm7M=,tag:D/bMtjuwrX6pquZfJLwdkQ==,type:str]
|
||||||
livekit_key_sfu: ENC[AES256_GCM,data:3pRAN0Vz134mg/omkSRlC9OAvToQg42aZbXj7TurYYOLUMnW6sWk+eexyIcYAAjCSP5GRES4WySuN/qjGeUDBKr8OYAxTXjR/w==,iv:NYhcfiKlXT3v5R4djkhHusMMRYgc3bCM66VD0G2MyME=,tag:8341ntSCmteTn+6AM0xu8g==,type:str]
|
livekit_key_file: ENC[AES256_GCM,data:wOtJhwDtZNEY+QjHyLL1FTOtkmzkNA5BoTsx0+ZMij9uUaKC28uFIkMAq2ZzIU7Nyvk8+4YjbK/Rrsoy,iv:UTDuItr0XsG+/4HFkEHDpxXy41QiVgPCisHeMMY2dQo=,tag:SkoeLWClO9I/V2sn27Y2uw==,type:str]
|
||||||
livekit_key_jwt: ENC[AES256_GCM,data:9cBMJ0AyyWaoUZsXmnGvIL7EPIO8l16TQRBC6iK6h1TQAriOTPicfcE40Itf7cmiplZFtK6z7DhkgggRpG88HT7ZCvcXP0P69A==,iv:GiZb/8Vz4tiLG8kpF93kiFkmmA/KdgWr0ILARsL15oo=,tag:SZxzfFSk125q9sqlRbsxdw==,type:str]
|
mjolnir_access_token: ENC[AES256_GCM,data:vvrAY9CAkEIGEzah+TQiwa6PahGuXVvU7wzBpTnqeSLqe3mqtw120GRj,iv:J+/VJ40BsImr832eGUHShhDVWYC7KsEwQUH9AE6Rs9c=,tag:n+y0flxfqY47rB4yv9TnBw==,type:str]
|
||||||
|
coturn_static_auth_secret: ENC[AES256_GCM,data:7AI0E8Hu4WxI5q4j1GqBMSQ+evE006uPMtwIfGn4eFz+XB2JA6fhhiGMPPxSkqOyK+3eZJ5ahiG05JpmBmmAbw==,iv:hQJQQDVo43U7lvV754PC1THeFCpZZEyag+BslXyoDos=,tag:Vkm+IXr1h8ZNpah6UYaKng==,type:str]
|
||||||
|
discord_bot_token: ENC[AES256_GCM,data:j37Qo3FCyRwNFqWSWpnQKCs+AxH5HlQ8U5If7ylHilQoORp8Pb3TtNETTJSjZyvUXllldevAbHrbAEEKnNfoUJx1U8/wl6H0,iv:WQqxFXTE+0LIB2lSvVcnr4LNXPE7uzNc0Kk8NU6Z/aE=,tag:fNeQLhoThEgfa4sSGKLZCw==,type:str]
|
||||||
|
discord_client_id: ENC[AES256_GCM,data:U/iUKXT6Nsl6LRN9lPh1xaIaqw==,iv:k7kQ8rJBrMs3YwD9aDfZ6qhd7H3aVsSPTOwEIxVTw2Y=,tag:2wKhxGbf+P+h3BYeWUSczA==,type:str]
|
||||||
gitea:
|
gitea:
|
||||||
dbPassword: ENC[AES256_GCM,data:S6VvRgkdYk1AzXljyQEEq68UJ9zrFy6+INBMIAspXNcqcM6o+es19o0mcXA=,iv:/pHYpkZZq+9Md+75uSCb2YXfSvaDzUh6mMfH53wb7eg=,tag:ZnbyCQwrK2JnbO5HFqgJYw==,type:str]
|
dbPassword: ENC[AES256_GCM,data:S6VvRgkdYk1AzXljyQEEq68UJ9zrFy6+INBMIAspXNcqcM6o+es19o0mcXA=,iv:/pHYpkZZq+9Md+75uSCb2YXfSvaDzUh6mMfH53wb7eg=,tag:ZnbyCQwrK2JnbO5HFqgJYw==,type:str]
|
||||||
internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str]
|
internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str]
|
||||||
@@ -28,7 +31,7 @@ sops:
|
|||||||
N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9
|
N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9
|
||||||
6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w==
|
6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
lastmodified: "2026-04-30T12:21:26Z"
|
lastmodified: "2026-05-07T07:00:06Z"
|
||||||
mac: ENC[AES256_GCM,data:sta1qQugWsGS0+g8stmyxHtKOiba6QiVyGfV5krJ688wrW1Ox38RW1cYf9+9Z04hXVQukYguR/k/y7v49oQxoefH5+7zlt/BxzadvPC5f55RsDREC7U4FKcpEEb2Pt1PtscQ3Trx/nDy3x5S8zJ1Uy1QTvSsEccQ+FYel6pcsgQ=,iv:r8spgHthtKoJjlHIpNGpVde1WFVI0xwbE1yJ4W6nHl8=,tag:qXnmmFRDISV3LTmlSlHgvA==,type:str]
|
mac: ENC[AES256_GCM,data:KSkcRm/aTGAZBfj2ZZ03x8EB2Sh0lFKUSDKLedgtYYk/QnUKTZOO8oaT36xIdrPN0pjK1CnElDQMkAHG6JCklif2UkcodKcerVWaVcNwZ4mk6wSvZz7OIqneMR0W/U+Ly3NMgwIKrlP9f7axiYMq9JyK6pVeepKrmw4RvOPzxqU=,iv:vlcFxxV5EofNAPnDf7eGJZ8FUM83uGUnkZtU57Epb3Y=,tag:yfYpa/F7PTwvZY11SZyRaw==,type:str]
|
||||||
unencrypted_suffix: _unencrypted
|
unencrypted_suffix: _unencrypted
|
||||||
version: 3.12.2
|
version: 3.12.2
|
||||||
|
|||||||
Reference in New Issue
Block a user