From 59907f7ece32cb159bddfd96527224fbda58f60c Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Thu, 30 Apr 2026 13:22:20 +0200 Subject: [PATCH 01/10] WIP: Livekit --- hosts/cyper-proxy/configuration.nix | 2 +- nixos/roles/livekit.nix | 68 ----------------------------- nixos/roles/matrix/clients.nix | 4 +- nixos/roles/matrix/default.nix | 2 +- nixos/roles/matrix/livekit.nix | 30 +++++++++++++ nixos/roles/matrix/lk-jwt.nix | 19 ++++++++ nixos/roles/matrix/synapse.nix | 1 + nixos/roles/nginx.nix | 4 +- 8 files changed, 56 insertions(+), 74 deletions(-) delete mode 100644 nixos/roles/livekit.nix create mode 100644 nixos/roles/matrix/livekit.nix create mode 100644 nixos/roles/matrix/lk-jwt.nix diff --git a/hosts/cyper-proxy/configuration.nix b/hosts/cyper-proxy/configuration.nix index 0436356..2439248 100644 --- a/hosts/cyper-proxy/configuration.nix +++ b/hosts/cyper-proxy/configuration.nix @@ -3,7 +3,7 @@ imports = [ ./hardware-configuration.nix ../../nixos/roles/nginx.nix - ../../nixos/roles/livekit.nix + ../../nixos/roles/matrix/livekit.nix ../../nixos/roles/jitsi.nix ]; diff --git a/nixos/roles/livekit.nix b/nixos/roles/livekit.nix deleted file mode 100644 index bf2dbf2..0000000 --- a/nixos/roles/livekit.nix +++ /dev/null @@ -1,68 +0,0 @@ -{ pkgs, ... }: -let - keyFile = "/run/livekit/livekit.key"; - domain = "cyperpunk.de"; - synapseUrl = "http://100.109.179.25:8008"; -in -{ - services = { - livekit = { - enable = true; - openFirewall = true; - inherit keyFile; - settings = { - rtc = { - tcp_port = 7881; - udp_port = 7882; - port_range_start = 50000; - port_range_end = 60000; - use_external_ip = true; - node_ip = "178.254.8.35"; - }; - room = { - auto_create = false; - enabled_codecs = [ - { mime = "video/VP8"; } - { mime = "video/VP9"; } - { mime = "video/H264"; } - { mime = "audio/opus"; } - ]; - enable_remote_unmute = true; - }; - }; - }; - - lk-jwt-service = { - enable = true; - #livekitUrl = "wss://cyperpunk.de/livekit/sfu"; - inherit keyFile; - livekitUrl = "wss://127.0.0.1:7880"; - }; - }; - - systemd.services = { - livekit-key = { - before = [ - "lk-jwt-service.service" - "livekit.service" - ]; - wantedBy = [ "multi-user.target" ]; - path = with pkgs; [ - livekit - coreutils - gawk - ]; - script = '' - mkdir -p /run/livekit - echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${keyFile}" - ''; - serviceConfig.Type = "oneshot"; - unitConfig.ConditionPathExists = "!${keyFile}"; - }; - - lk-jwt-service.environment = { - LIVEKIT_FULL_ACCESS_HOMESERVERS = domain; - MATRIX_BASE_URL = synapseUrl; - }; - }; -} diff --git a/nixos/roles/matrix/clients.nix b/nixos/roles/matrix/clients.nix index 2b96d04..797728e 100644 --- a/nixos/roles/matrix/clients.nix +++ b/nixos/roles/matrix/clients.nix @@ -126,13 +126,13 @@ let preferred_domain = "jitsi.cyperpunk.de"; }; element_call = { - url = "https://element.cyperpunk.de/widgets/element-call"; + url = "https://element-call.cyperpunk.de"; use_exclusively = true; participant_limit = 8; brand = "Cyperpunk Call"; }; livekit = { - livekit_service_url = "https://cyperpunk.de/livekit/jwt"; + livekit_service_url = "https://cyperpunk.de/livekit/jwt/"; }; setting_defaults = { custom_themes = catppuccinThemes; diff --git a/nixos/roles/matrix/default.nix b/nixos/roles/matrix/default.nix index 6e5b359..5a89637 100644 --- a/nixos/roles/matrix/default.nix +++ b/nixos/roles/matrix/default.nix @@ -4,8 +4,8 @@ { imports = [ ./synapse.nix - # ./coturn.nix ./clients.nix + ./lk-jwt.nix ]; #networking.firewall = { diff --git a/nixos/roles/matrix/livekit.nix b/nixos/roles/matrix/livekit.nix new file mode 100644 index 0000000..a4d243d --- /dev/null +++ b/nixos/roles/matrix/livekit.nix @@ -0,0 +1,30 @@ +{ config, ... }: +{ + sops.secrets.livekit_key = { }; + + services.livekit = { + enable = true; + openFirewall = true; + keyFile = config.sops.secrets.livekit_key.path; + settings = { + rtc = { + tcp_port = 7881; + udp_port = 7882; + port_range_start = 50000; + port_range_end = 60000; + use_external_ip = true; + node_ip = "178.254.8.35"; + }; + room = { + auto_create = false; + enabled_codecs = [ + { mime = "video/VP8"; } + { mime = "video/VP9"; } + { mime = "video/H264"; } + { mime = "audio/opus"; } + ]; + enable_remote_unmute = true; + }; + }; + }; +} diff --git a/nixos/roles/matrix/lk-jwt.nix b/nixos/roles/matrix/lk-jwt.nix new file mode 100644 index 0000000..fa06b39 --- /dev/null +++ b/nixos/roles/matrix/lk-jwt.nix @@ -0,0 +1,19 @@ +{ config, ... }: +let + domain = "cyperpunk.de"; + synapseUrl = "http://100.109.179.25:8008"; +in +{ + sops.secrets.livekit_key = { }; + + services.lk-jwt-service = { + enable = true; + keyFile = config.sops.secrets.livekit_key.path; + livekitUrl = "wss://cyperpunk.de/livekit/sfu"; + }; + + systemd.services.lk-jwt-service.environment = { + LIVEKIT_FULL_ACCESS_HOMESERVERS = domain; + MATRIX_BASE_URL = synapseUrl; + }; +} diff --git a/nixos/roles/matrix/synapse.nix b/nixos/roles/matrix/synapse.nix index a96c616..e6e5497 100644 --- a/nixos/roles/matrix/synapse.nix +++ b/nixos/roles/matrix/synapse.nix @@ -49,6 +49,7 @@ names = [ "client" "federation" + "openid" ]; compress = false; } diff --git a/nixos/roles/nginx.nix b/nixos/roles/nginx.nix index f96e7ba..00a7162 100644 --- a/nixos/roles/nginx.nix +++ b/nixos/roles/nginx.nix @@ -41,7 +41,7 @@ let "org.matrix.msc4143.rtc_foci":[ { "type":"livekit", - "livekit_service_url":"https://cyperpunk.de/livekit/jwt" + "livekit_service_url":"https://cyperpunk.de/livekit/jwt/" } ] }'; @@ -116,7 +116,7 @@ in }; "^~ /livekit/jwt/" = { priority = 400; - proxyPass = "http://127.0.0.1:8080/"; + proxyPass = "http://${upstream}:8080/"; }; "^~ /livekit/sfu/" = { priority = 400; From 4590eca1bd259e8488210217bca615a8c1548484 Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Thu, 30 Apr 2026 13:24:02 +0200 Subject: [PATCH 02/10] WIP: livekit --- nixos/roles/paperless-ngx.nix | 3 ++- secrets/secrets.yaml | 5 +++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/nixos/roles/paperless-ngx.nix b/nixos/roles/paperless-ngx.nix index e7bf250..387c59e 100644 --- a/nixos/roles/paperless-ngx.nix +++ b/nixos/roles/paperless-ngx.nix @@ -9,7 +9,7 @@ address = "0.0.0.0"; port = 28101; domain = "ngx.cyperpunk.de"; - consumptionDir = "/var/lib/paperless/consume"; + consumptionDir = "/storage/fast/paperless/consume"; dataDir = "/storage/fast/paperless"; configureTika = true; passwordFile = config.sops.secrets.paperless_admin.path; @@ -22,6 +22,7 @@ "http://100.109.179.25:28101" ]; PAPERLESS_OCR_LANGUAGE = "deu+eng"; + PAPERLESS_CONSUMER_POLLING = 60; }; exporter = { diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 0a044df..03f650a 100644 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -8,6 +8,7 @@ vaultwarden_admin_token: ENC[AES256_GCM,data:yoBs4CaIEJXB5b3PEwTpXFgxpX39hR9A4r9 flame_phil_password: ENC[AES256_GCM,data:Xy2ixMeRlnzC2gjKGrjfSbz/ee4=,iv:WFuBS8jn7WYRxEDG3XBzCMnm4eNkHQpSs5+GUwq/dcg=,tag:1zzj0eB9/4KrmYAqcxJMlg==,type:str] flame_calvin_password: ENC[AES256_GCM,data:P5ppyqTjAJ1TL4hXtx5WyoS9a+g=,iv:sq98P3Oqud2FXfqsD76YS/p5NEF2xlN0MfG+ukCB9B0=,tag:AeKnu4Hg4xQ3tII0y6oNpQ==,type:str] paperless_admin: ENC[AES256_GCM,data:sVvlMQ3dDE2XsDfpwpCTbzPCEKdUMNTFtRXDIuBbgyf1gd6oiJzE23Ytc57plNUGg5h5aEtgxZ7NXeuK5vrhQw==,iv:x+QNAzY9k9t23UYlM9GcAke0urEA5jlV0VzHaBQkm7M=,tag:D/bMtjuwrX6pquZfJLwdkQ==,type:str] +livekit_key: ENC[AES256_GCM,data:h5iDET2DrIgudFVIRSzVvQ701urpww/kcXhR7X+GMHjwTZwCLkaC5NmO83Q4e7hM+OIagO8gmoJ2MBWe85sJCw==,iv:LO3WIRurr5t3U6PFKCpMXlKrAXGJOCb9EYT3FBxOYFo=,tag:KLl+qBfTLwAnDr7MHcQg3w==,type:str] gitea: dbPassword: ENC[AES256_GCM,data:S6VvRgkdYk1AzXljyQEEq68UJ9zrFy6+INBMIAspXNcqcM6o+es19o0mcXA=,iv:/pHYpkZZq+9Md+75uSCb2YXfSvaDzUh6mMfH53wb7eg=,tag:ZnbyCQwrK2JnbO5HFqgJYw==,type:str] internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str] @@ -26,7 +27,7 @@ sops: N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9 6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-28T20:56:41Z" - mac: ENC[AES256_GCM,data:7LzlnFm2R7YFtZ2Nei/uOG2G/VSGcN3KQtTZSUM+TKvPXgCcFXa/ZF8u4WtoXSJOiVTJ9gQ2wvtKjW8OPtd4ALGId33dM4fapB9fl3LTF9hgVpu01s5kIkYKPf1bRZ8vpsFzMUoPDUHXgIlTgobf9dTxeyu6utBrM9+7AHCQxV4=,iv:LYgDr+10bXmk9Jg0oyvfr3jty4Y7GeFDuUMkjsXYzXs=,tag:/553lafJUjOdUrljLYd2Wg==,type:str] + lastmodified: "2026-04-30T11:23:51Z" + mac: ENC[AES256_GCM,data:uN7xSSiy9fDdfFoGjYHyXaRg5eR2CJiW5mDH6OSoKPccZ/MjnA8KCVmdIZplKfQBEuQvxeGHHp2SnnNbEoEdu2tXNdv7eVh1IR4KITPjzHxAjjsOckozajcENF0EWC6uv+Ca3HDU61mC86cpnA6Te9dlk9g9oZ5IDKhQSbKTLVA=,iv:CCdkBQgiZZKf2obQjPGpT+5ltf+ahvDNJjl5xk5xw24=,tag:wOh92+4io+2vKyogkOffGw==,type:str] unencrypted_suffix: _unencrypted version: 3.12.2 From 35598f777b5ce9f7d369911bac91dc0045e3a32d Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Thu, 30 Apr 2026 13:45:34 +0200 Subject: [PATCH 03/10] WIP: livekit --- nixos/roles/matrix/livekit.nix | 4 ++-- nixos/roles/matrix/lk-jwt.nix | 17 +++++++++++------ nixos/roles/nginx.nix | 2 +- secrets/secrets.yaml | 7 ++++--- 4 files changed, 18 insertions(+), 12 deletions(-) diff --git a/nixos/roles/matrix/livekit.nix b/nixos/roles/matrix/livekit.nix index a4d243d..cf52061 100644 --- a/nixos/roles/matrix/livekit.nix +++ b/nixos/roles/matrix/livekit.nix @@ -1,11 +1,11 @@ { config, ... }: { - sops.secrets.livekit_key = { }; + sops.secrets.livekit_key_sfu = { }; services.livekit = { enable = true; openFirewall = true; - keyFile = config.sops.secrets.livekit_key.path; + keyFile = config.sops.secrets.livekit_key_sfu.path; settings = { rtc = { tcp_port = 7881; diff --git a/nixos/roles/matrix/lk-jwt.nix b/nixos/roles/matrix/lk-jwt.nix index fa06b39..7ce3978 100644 --- a/nixos/roles/matrix/lk-jwt.nix +++ b/nixos/roles/matrix/lk-jwt.nix @@ -1,19 +1,24 @@ -{ config, ... }: +{ config, lib, ... }: let domain = "cyperpunk.de"; synapseUrl = "http://100.109.179.25:8008"; in { - sops.secrets.livekit_key = { }; + sops.secrets.livekit_key_jwt = { }; + + networking.firewall.allowedTCPPorts = [ 18080 ]; services.lk-jwt-service = { enable = true; - keyFile = config.sops.secrets.livekit_key.path; + keyFile = config.sops.secrets.livekit_key_jwt.path; livekitUrl = "wss://cyperpunk.de/livekit/sfu"; }; - systemd.services.lk-jwt-service.environment = { - LIVEKIT_FULL_ACCESS_HOMESERVERS = domain; - MATRIX_BASE_URL = synapseUrl; + systemd.services.lk-jwt-service = { + environment = { + LIVEKIT_FULL_ACCESS_HOMESERVERS = domain; + MATRIX_BASE_URL = synapseUrl; + LIVEKIT_JWT_BIND = lib.mkForce ":18080"; + }; }; } diff --git a/nixos/roles/nginx.nix b/nixos/roles/nginx.nix index 00a7162..304c3fe 100644 --- a/nixos/roles/nginx.nix +++ b/nixos/roles/nginx.nix @@ -116,7 +116,7 @@ in }; "^~ /livekit/jwt/" = { priority = 400; - proxyPass = "http://${upstream}:8080/"; + proxyPass = "http://${upstream}:18080/"; }; "^~ /livekit/sfu/" = { priority = 400; diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 03f650a..120a54f 100644 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -8,7 +8,8 @@ vaultwarden_admin_token: ENC[AES256_GCM,data:yoBs4CaIEJXB5b3PEwTpXFgxpX39hR9A4r9 flame_phil_password: ENC[AES256_GCM,data:Xy2ixMeRlnzC2gjKGrjfSbz/ee4=,iv:WFuBS8jn7WYRxEDG3XBzCMnm4eNkHQpSs5+GUwq/dcg=,tag:1zzj0eB9/4KrmYAqcxJMlg==,type:str] flame_calvin_password: ENC[AES256_GCM,data:P5ppyqTjAJ1TL4hXtx5WyoS9a+g=,iv:sq98P3Oqud2FXfqsD76YS/p5NEF2xlN0MfG+ukCB9B0=,tag:AeKnu4Hg4xQ3tII0y6oNpQ==,type:str] paperless_admin: ENC[AES256_GCM,data:sVvlMQ3dDE2XsDfpwpCTbzPCEKdUMNTFtRXDIuBbgyf1gd6oiJzE23Ytc57plNUGg5h5aEtgxZ7NXeuK5vrhQw==,iv:x+QNAzY9k9t23UYlM9GcAke0urEA5jlV0VzHaBQkm7M=,tag:D/bMtjuwrX6pquZfJLwdkQ==,type:str] -livekit_key: ENC[AES256_GCM,data:h5iDET2DrIgudFVIRSzVvQ701urpww/kcXhR7X+GMHjwTZwCLkaC5NmO83Q4e7hM+OIagO8gmoJ2MBWe85sJCw==,iv:LO3WIRurr5t3U6PFKCpMXlKrAXGJOCb9EYT3FBxOYFo=,tag:KLl+qBfTLwAnDr7MHcQg3w==,type:str] +livekit_key_sfu: ENC[AES256_GCM,data:3pRAN0Vz134mg/omkSRlC9OAvToQg42aZbXj7TurYYOLUMnW6sWk+eexyIcYAAjCSP5GRES4WySuN/qjGeUDBKr8OYAxTXjR/w==,iv:NYhcfiKlXT3v5R4djkhHusMMRYgc3bCM66VD0G2MyME=,tag:8341ntSCmteTn+6AM0xu8g==,type:str] +livekit_key_jwt: ENC[AES256_GCM,data:G8IDQoAFpibI7Rs0dTPj7kLj9RogPRpufiq6GMCSFhGYtscTrDlsGOu5+hq0hP487QHnCEMZIUPOcKxy54ktdW2SQKyUDP/qc037o0eFqjI=,iv:iss3/VN0/mbkWujwRsv1+/IIFQ9hVxOg5FVV8A5kl2o=,tag:geLyPYH2iHxcRLUtruUAJg==,type:str] gitea: dbPassword: ENC[AES256_GCM,data:S6VvRgkdYk1AzXljyQEEq68UJ9zrFy6+INBMIAspXNcqcM6o+es19o0mcXA=,iv:/pHYpkZZq+9Md+75uSCb2YXfSvaDzUh6mMfH53wb7eg=,tag:ZnbyCQwrK2JnbO5HFqgJYw==,type:str] internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str] @@ -27,7 +28,7 @@ sops: N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9 6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-30T11:23:51Z" - mac: ENC[AES256_GCM,data:uN7xSSiy9fDdfFoGjYHyXaRg5eR2CJiW5mDH6OSoKPccZ/MjnA8KCVmdIZplKfQBEuQvxeGHHp2SnnNbEoEdu2tXNdv7eVh1IR4KITPjzHxAjjsOckozajcENF0EWC6uv+Ca3HDU61mC86cpnA6Te9dlk9g9oZ5IDKhQSbKTLVA=,iv:CCdkBQgiZZKf2obQjPGpT+5ltf+ahvDNJjl5xk5xw24=,tag:wOh92+4io+2vKyogkOffGw==,type:str] + lastmodified: "2026-04-30T11:36:37Z" + mac: ENC[AES256_GCM,data:CIRG016ew09deYXENzus8L1abAjpBnKMrziezorwsceFG5I59ch7OJn7edYyr+VaVPrjBb3JeNShC/Ks1Pq7cwl4MGlAyheCpfE1IcFFMK2r0ldvAqgAWZhqLM7QbyQbC9Gkbi95TiMiTgQ8RQRk6RZPEWdBPecLcARLoj9PbcQ=,iv:iAqWDjqy9xZ/xh1n94zWUXiMmqEX9PH0QEFSv6y0Onc=,tag:VJauyqv4HByK3Kq84QI8sQ==,type:str] unencrypted_suffix: _unencrypted version: 3.12.2 From 5cee5f217ef67baea0f99d2a593f80c54465acdb Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Thu, 30 Apr 2026 14:21:32 +0200 Subject: [PATCH 04/10] WIP: livekit --- nixos/roles/matrix/lk-jwt.nix | 2 +- secrets/secrets.yaml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/nixos/roles/matrix/lk-jwt.nix b/nixos/roles/matrix/lk-jwt.nix index 7ce3978..76c6482 100644 --- a/nixos/roles/matrix/lk-jwt.nix +++ b/nixos/roles/matrix/lk-jwt.nix @@ -11,7 +11,7 @@ in services.lk-jwt-service = { enable = true; keyFile = config.sops.secrets.livekit_key_jwt.path; - livekitUrl = "wss://cyperpunk.de/livekit/sfu"; + livekitUrl = "ws://100.109.10.91:7880"; }; systemd.services.lk-jwt-service = { diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 120a54f..bec4e10 100644 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -9,7 +9,7 @@ flame_phil_password: ENC[AES256_GCM,data:Xy2ixMeRlnzC2gjKGrjfSbz/ee4=,iv:WFuBS8j flame_calvin_password: ENC[AES256_GCM,data:P5ppyqTjAJ1TL4hXtx5WyoS9a+g=,iv:sq98P3Oqud2FXfqsD76YS/p5NEF2xlN0MfG+ukCB9B0=,tag:AeKnu4Hg4xQ3tII0y6oNpQ==,type:str] paperless_admin: ENC[AES256_GCM,data:sVvlMQ3dDE2XsDfpwpCTbzPCEKdUMNTFtRXDIuBbgyf1gd6oiJzE23Ytc57plNUGg5h5aEtgxZ7NXeuK5vrhQw==,iv:x+QNAzY9k9t23UYlM9GcAke0urEA5jlV0VzHaBQkm7M=,tag:D/bMtjuwrX6pquZfJLwdkQ==,type:str] livekit_key_sfu: ENC[AES256_GCM,data:3pRAN0Vz134mg/omkSRlC9OAvToQg42aZbXj7TurYYOLUMnW6sWk+eexyIcYAAjCSP5GRES4WySuN/qjGeUDBKr8OYAxTXjR/w==,iv:NYhcfiKlXT3v5R4djkhHusMMRYgc3bCM66VD0G2MyME=,tag:8341ntSCmteTn+6AM0xu8g==,type:str] -livekit_key_jwt: ENC[AES256_GCM,data:G8IDQoAFpibI7Rs0dTPj7kLj9RogPRpufiq6GMCSFhGYtscTrDlsGOu5+hq0hP487QHnCEMZIUPOcKxy54ktdW2SQKyUDP/qc037o0eFqjI=,iv:iss3/VN0/mbkWujwRsv1+/IIFQ9hVxOg5FVV8A5kl2o=,tag:geLyPYH2iHxcRLUtruUAJg==,type:str] +livekit_key_jwt: ENC[AES256_GCM,data:9cBMJ0AyyWaoUZsXmnGvIL7EPIO8l16TQRBC6iK6h1TQAriOTPicfcE40Itf7cmiplZFtK6z7DhkgggRpG88HT7ZCvcXP0P69A==,iv:GiZb/8Vz4tiLG8kpF93kiFkmmA/KdgWr0ILARsL15oo=,tag:SZxzfFSk125q9sqlRbsxdw==,type:str] gitea: dbPassword: ENC[AES256_GCM,data:S6VvRgkdYk1AzXljyQEEq68UJ9zrFy6+INBMIAspXNcqcM6o+es19o0mcXA=,iv:/pHYpkZZq+9Md+75uSCb2YXfSvaDzUh6mMfH53wb7eg=,tag:ZnbyCQwrK2JnbO5HFqgJYw==,type:str] internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str] @@ -28,7 +28,7 @@ sops: N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9 6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-30T11:36:37Z" - mac: ENC[AES256_GCM,data:CIRG016ew09deYXENzus8L1abAjpBnKMrziezorwsceFG5I59ch7OJn7edYyr+VaVPrjBb3JeNShC/Ks1Pq7cwl4MGlAyheCpfE1IcFFMK2r0ldvAqgAWZhqLM7QbyQbC9Gkbi95TiMiTgQ8RQRk6RZPEWdBPecLcARLoj9PbcQ=,iv:iAqWDjqy9xZ/xh1n94zWUXiMmqEX9PH0QEFSv6y0Onc=,tag:VJauyqv4HByK3Kq84QI8sQ==,type:str] + lastmodified: "2026-04-30T12:21:26Z" + mac: ENC[AES256_GCM,data:sta1qQugWsGS0+g8stmyxHtKOiba6QiVyGfV5krJ688wrW1Ox38RW1cYf9+9Z04hXVQukYguR/k/y7v49oQxoefH5+7zlt/BxzadvPC5f55RsDREC7U4FKcpEEb2Pt1PtscQ3Trx/nDy3x5S8zJ1Uy1QTvSsEccQ+FYel6pcsgQ=,iv:r8spgHthtKoJjlHIpNGpVde1WFVI0xwbE1yJ4W6nHl8=,tag:qXnmmFRDISV3LTmlSlHgvA==,type:str] unencrypted_suffix: _unencrypted version: 3.12.2 From 61e8a1e037436311cf764fc96b354fbf687ef8fd Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Sun, 3 May 2026 12:38:31 +0200 Subject: [PATCH 05/10] WIP: Livekit --- hosts/cyper-proxy/configuration.nix | 2 +- nixos/roles/matrix/livekit.nix | 13 ++++++++++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/hosts/cyper-proxy/configuration.nix b/hosts/cyper-proxy/configuration.nix index 2439248..661a3ca 100644 --- a/hosts/cyper-proxy/configuration.nix +++ b/hosts/cyper-proxy/configuration.nix @@ -4,7 +4,7 @@ ./hardware-configuration.nix ../../nixos/roles/nginx.nix ../../nixos/roles/matrix/livekit.nix - ../../nixos/roles/jitsi.nix + # ../../nixos/roles/jitsi.nix ]; networking = { diff --git a/nixos/roles/matrix/livekit.nix b/nixos/roles/matrix/livekit.nix index cf52061..c973c63 100644 --- a/nixos/roles/matrix/livekit.nix +++ b/nixos/roles/matrix/livekit.nix @@ -1,4 +1,4 @@ -{ config, ... }: +{ config, lib, ... }: { sops.secrets.livekit_key_sfu = { }; @@ -27,4 +27,15 @@ }; }; }; + networking.firewall.allowedTCPPorts = [ 7881 ]; + + systemd.services.livekit.serviceConfig = { + PrivateUsers = lib.mkForce false; + RestrictAddressFamilies = lib.mkForce [ + "AF_INET" + "AF_INET6" + "AF_NETLINK" + "AF_UNIX" + ]; + }; } From 6276a57cb36fbab3ccd033f9f540cbb5b1914cd0 Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Sun, 3 May 2026 12:38:55 +0200 Subject: [PATCH 06/10] Added: Proxy to monito --- nixos/roles/monitoring.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/roles/monitoring.nix b/nixos/roles/monitoring.nix index 172735c..4c9c14c 100644 --- a/nixos/roles/monitoring.nix +++ b/nixos/roles/monitoring.nix @@ -19,6 +19,7 @@ let "cyper-desktop" = "192.168.2.40"; "cyper-node-1" = "192.168.2.30"; "cyper-node-2" = "192.168.2.31"; + "cyper-proxy" = "178.254.8.35"; }; mkWeatherScrapeConfigs = From c91ed778d476f58a72a57dbc94e96d1b02532d6f Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Sun, 3 May 2026 23:19:38 +0200 Subject: [PATCH 07/10] WIP: Livekit --- nixos/roles/matrix/livekit.nix | 15 +++++++++- nixos/roles/nginx.nix | 51 ++++++++++++++++++++++++++++++++-- 2 files changed, 63 insertions(+), 3 deletions(-) diff --git a/nixos/roles/matrix/livekit.nix b/nixos/roles/matrix/livekit.nix index c973c63..15ab0cb 100644 --- a/nixos/roles/matrix/livekit.nix +++ b/nixos/roles/matrix/livekit.nix @@ -9,7 +9,7 @@ settings = { rtc = { tcp_port = 7881; - udp_port = 7882; + #udp_port = 7882; port_range_start = 50000; port_range_end = 60000; use_external_ip = true; @@ -31,11 +31,24 @@ systemd.services.livekit.serviceConfig = { PrivateUsers = lib.mkForce false; + DynamicUser = lib.mkForce false; + User = "livekit"; + Group = "livekit"; RestrictAddressFamilies = lib.mkForce [ "AF_INET" "AF_INET6" "AF_NETLINK" "AF_UNIX" ]; + SystemCallFilter = lib.mkForce [ "@system-service" ]; }; + + users = { + users.livekit = { + isSystemUser = true; + group = "livekit"; + }; + groups.livekit = { }; + }; + } diff --git a/nixos/roles/nginx.nix b/nixos/roles/nginx.nix index 304c3fe..632c4bc 100644 --- a/nixos/roles/nginx.nix +++ b/nixos/roles/nginx.nix @@ -100,8 +100,46 @@ in "calvin.cyperpunk.de" = mkWsProxy 15006; "cinny.cyperpunk.de" = mkWsProxy 8009; - "element.cyperpunk.de" = mkWsProxy 8010; - "element-call.cyperpunk.de" = mkWsProxy 8013; + + "element-call.cyperpunk.de" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://${upstream}:8013"; + proxyWebsockets = true; + extraConfig = '' + add_header Cross-Origin-Opener-Policy "same-origin"; + add_header Cross-Origin-Embedder-Policy "require-corp"; + add_header Cross-Origin-Resource-Policy "cross-origin"; + ''; + }; + }; + + "element.cyperpunk.de" = { + forceSSL = true; + enableACME = true; + locations = { + "/" = { + proxyPass = "http://${upstream}:8010"; + proxyWebsockets = true; + }; + "/widgets/element-call/config.json" = { + extraConfig = '' + default_type application/json; + add_header Access-Control-Allow-Origin *; + return 200 '{ + "livekit_service_url": "https://cyperpunk.de/livekit/jwt/", + "default_server_config": { + "m.homeserver": { + "base_url": "https://matrix.cyperpunk.de", + "server_name":"cyperpunk.de" + } + } + }'; + ''; + }; + }; + }; "cyperpunk.de" = { forceSSL = true; @@ -132,6 +170,15 @@ in ''; }; + "/_matrix/client/unstable/org.matrix.msc4143/rtc/transports" = { + extraConfig = '' + default_type application/json; + add_header Access-Control-Allow-Origin *; + add_header Access-Control-Allow-Headers "Authorization, Content-Type"; + add_header Access-Control-Allow-Methods "GET, OPTIONS"; + return 200 '{"rtc_transports":[{"type":"livekit","livekit_service_url":"https://cyperpunk.de/livekit/jwt/"}]}'; + ''; + }; }; }; }; From e8253312b23fe3ed5f71a64f3ae22aacbeec1647 Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Sun, 3 May 2026 23:20:10 +0200 Subject: [PATCH 08/10] WIP: Matrix --- nixos/roles/matrix/clients.nix | 5 +++++ nixos/roles/matrix/lk-jwt.nix | 2 +- nixos/roles/matrix/synapse.nix | 11 ++++++++++- 3 files changed, 16 insertions(+), 2 deletions(-) diff --git a/nixos/roles/matrix/clients.nix b/nixos/roles/matrix/clients.nix index 797728e..641e706 100644 --- a/nixos/roles/matrix/clients.nix +++ b/nixos/roles/matrix/clients.nix @@ -130,6 +130,7 @@ let use_exclusively = true; participant_limit = 8; brand = "Cyperpunk Call"; + encryption = "None"; }; livekit = { livekit_service_url = "https://cyperpunk.de/livekit/jwt/"; @@ -141,6 +142,7 @@ let features = { feature_group_calls = true; "feature_disable_call_per_sender_encryption" = true; + "feature_sliding_sync" = true; }; } ); @@ -165,6 +167,9 @@ let }; }; livekit_service_url = "https://cyperpunk.de/livekit/jwt/"; + e2ee = { + default = false; + }; } ) } $out/config.json diff --git a/nixos/roles/matrix/lk-jwt.nix b/nixos/roles/matrix/lk-jwt.nix index 76c6482..7ce3978 100644 --- a/nixos/roles/matrix/lk-jwt.nix +++ b/nixos/roles/matrix/lk-jwt.nix @@ -11,7 +11,7 @@ in services.lk-jwt-service = { enable = true; keyFile = config.sops.secrets.livekit_key_jwt.path; - livekitUrl = "ws://100.109.10.91:7880"; + livekitUrl = "wss://cyperpunk.de/livekit/sfu"; }; systemd.services.lk-jwt-service = { diff --git a/nixos/roles/matrix/synapse.nix b/nixos/roles/matrix/synapse.nix index e6e5497..a81e282 100644 --- a/nixos/roles/matrix/synapse.nix +++ b/nixos/roles/matrix/synapse.nix @@ -36,6 +36,7 @@ "msc3401_enabled" = true; "msc4143_enabled" = true; "msc4195_enabled" = true; + "msc4222_enabled" = true; }; listeners = [ { @@ -63,7 +64,15 @@ resources = [ ]; } ]; - + matrix_rtc = { + enabled = true; + transports = [ + { + type = "livekit"; + livekit_service_url = "https://cyperpunk.de/livekit/jwt/"; + } + ]; + }; enable_metrics = true; }; }; From 50e57a89f8c221fc1eb9c8008d9caf990c9c23c0 Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Sun, 3 May 2026 23:20:40 +0200 Subject: [PATCH 09/10] Stuff --- flake.lock | 158 ++++++++++++++++++++++++------------------------- home/shell.nix | 1 + nixos/ssh.nix | 5 +- 3 files changed, 84 insertions(+), 80 deletions(-) diff --git a/flake.lock b/flake.lock index 50881ba..3605138 100644 --- a/flake.lock +++ b/flake.lock @@ -20,11 +20,11 @@ ] }, "locked": { - "lastModified": 1775558810, - "narHash": "sha256-fy95EdPnqQlpbP8+rk0yWKclWShCUS5VKs6P7/1MF2c=", + "lastModified": 1776876344, + "narHash": "sha256-Ubqb/agkuMJK+k19gjQgHux/eOYRc1sRGoOZOho8+VY=", "owner": "hyprwm", "repo": "aquamarine", - "rev": "7371b669b22aa2af980f913fc312a786d2f1abb2", + "rev": "648a13d0ee1e03a843b3e145b8ece15393058701", "type": "github" }, "original": { @@ -36,16 +36,16 @@ "brew-src": { "flake": false, "locked": { - "lastModified": 1774235677, - "narHash": "sha256-0ryNYmzDAeRlrzPTAgmzGH/Cgc8iv/LBN6jWGUANvIk=", + "lastModified": 1776478798, + "narHash": "sha256-ERStG27tf83VbCfYMxtDSs+sa8FUMJ/3jSu/QfX9rKE=", "owner": "Homebrew", "repo": "brew", - "rev": "894a3d23ac0c8aaf561b9874b528b9cb2e839201", + "rev": "3aae056b8d072624255bc8fd27febb7f327b2265", "type": "github" }, "original": { "owner": "Homebrew", - "ref": "5.1.1", + "ref": "5.1.7", "repo": "brew", "type": "github" } @@ -57,11 +57,11 @@ ] }, "locked": { - "lastModified": 1775213373, - "narHash": "sha256-wJHsijC2l/E+ovmlpPGha8pXA6RHSwHWmBV97gvkmyI=", + "lastModified": 1777024856, + "narHash": "sha256-OQ+yIcRMXo4UaHyX+W5DCgBvJ5dZo/3kFGWPJiuR6x8=", "owner": "catppuccin", "repo": "nix", - "rev": "ba73719e673e7c2d89ac2f8df0bc0d48983e4907", + "rev": "f41cc1cf13647e482b7317396f749840ef715e16", "type": "github" }, "original": { @@ -125,11 +125,11 @@ "nixpkgs-lib": "nixpkgs-lib" }, "locked": { - "lastModified": 1772408722, - "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=", + "lastModified": 1775087534, + "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3", + "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b", "type": "github" }, "original": { @@ -146,11 +146,11 @@ ] }, "locked": { - "lastModified": 1769996383, - "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=", + "lastModified": 1775087534, + "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "57928607ea566b5db3ad13af0e57e921e6b12381", + "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b", "type": "github" }, "original": { @@ -188,11 +188,11 @@ ] }, "locked": { - "lastModified": 1775661044, - "narHash": "sha256-HlvLj+wE5ELaU+u2cY2nBFUJHdrob1V7qydk9lBx7oE=", + "lastModified": 1777258755, + "narHash": "sha256-EC07KwADRE2LdIk7vEDyAaD3I0ZUq24T9jQF9L0iEPk=", "owner": "nix-community", "repo": "home-manager", - "rev": "4ac0a4fd1537325d769377d574dccd10b97c28a2", + "rev": "7f8bbc93d63401e41368d6ddc46a4f631610fa90", "type": "github" }, "original": { @@ -211,11 +211,11 @@ "systems": "systems" }, "locked": { - "lastModified": 1772461003, - "narHash": "sha256-pVICsV7FtcEeVwg5y/LFh3XFUkVJninm/P1j/JHzEbM=", + "lastModified": 1776511930, + "narHash": "sha256-fCpwFiTW0rT7oKJqr3cqHMnkwypSwQKpbtUEtxdkgrM=", "owner": "hyprwm", "repo": "hyprcursor", - "rev": "b62396457b9cfe2ebf24fe05404b09d2a40f8ed7", + "rev": "39435900785d0c560c6ae8777d29f28617d031ef", "type": "github" }, "original": { @@ -240,11 +240,11 @@ ] }, "locked": { - "lastModified": 1772461003, - "narHash": "sha256-pVICsV7FtcEeVwg5y/LFh3XFUkVJninm/P1j/JHzEbM=", + "lastModified": 1776511930, + "narHash": "sha256-fCpwFiTW0rT7oKJqr3cqHMnkwypSwQKpbtUEtxdkgrM=", "owner": "hyprwm", "repo": "hyprcursor", - "rev": "b62396457b9cfe2ebf24fe05404b09d2a40f8ed7", + "rev": "39435900785d0c560c6ae8777d29f28617d031ef", "type": "github" }, "original": { @@ -269,11 +269,11 @@ ] }, "locked": { - "lastModified": 1775496928, - "narHash": "sha256-Ds759WU03mGWtu3I43J+5GF5Ni8TvF+GYQUFD+fVeMo=", + "lastModified": 1776426399, + "narHash": "sha256-RUESLKNikIeEq9ymGJ6nmcDXiSFQpUW1IhJ245nL3xM=", "owner": "hyprwm", "repo": "hyprgraphics", - "rev": "cf95d93d17baa18f1d9b016b3afe27f820521a6e", + "rev": "68d064434787cf1ed4a2fe257c03c5f52f33cf84", "type": "github" }, "original": { @@ -301,11 +301,11 @@ "xdph": "xdph" }, "locked": { - "lastModified": 1775646418, - "narHash": "sha256-gKAbM0d0JCZNgHl2MgkEiYId50pmgmqUzqEkadnphsA=", + "lastModified": 1777248628, + "narHash": "sha256-3RoogdcCOknnzMCNw4MxQBHlAL0qXZw/Jk1fN4Hm8jE=", "owner": "hyprwm", "repo": "Hyprland", - "rev": "fb46d16fc2bedea96b6b2a4d005ec66d701431aa", + "rev": "80763b13ff9b8abb94654d9f5ca635003c0b5d84", "type": "github" }, "original": { @@ -347,11 +347,11 @@ ] }, "locked": { - "lastModified": 1774710575, - "narHash": "sha256-p7Rcw13+gA4Z9EI3oGYe3neQ3FqyOOfZCleBTfhJ95Q=", + "lastModified": 1776426575, + "narHash": "sha256-KI6nIfVihn/DPaeB5Et46Xg3dkNHrrEtUd5LBBVomB0=", "owner": "hyprwm", "repo": "hyprland-guiutils", - "rev": "0703df899520001209646246bef63358c9881e36", + "rev": "a968d211048e3ed538e47b84cb3649299578f19d", "type": "github" }, "original": { @@ -377,11 +377,11 @@ ] }, "locked": { - "lastModified": 1771865848, - "narHash": "sha256-xwNa+1D8WPsDnJtUofDrtyDCZKZotbUymzV/R5s+M0I=", + "lastModified": 1777220105, + "narHash": "sha256-M9JZK+8GVKAIVdQpcCG/49zBF3ylxO8zxW+hVjM5QpE=", "owner": "hyprwm", "repo": "hyprland-plugins", - "rev": "b85a56b9531013c79f2f3846fd6ee2ff014b8960", + "rev": "dbe221941a5095e1b381ac460a152cf173b108b8", "type": "github" }, "original": { @@ -457,11 +457,11 @@ ] }, "locked": { - "lastModified": 1772459629, - "narHash": "sha256-/iwvNUYShmmnwmz/czEUh6+0eF5vCMv0xtDW0STPIuM=", + "lastModified": 1776426736, + "narHash": "sha256-rl7i4aY+9p8LysJp7o8uRWahCkpFznCgGHXszlTw7b0=", "owner": "hyprwm", "repo": "hyprlang", - "rev": "7615ee388de18239a4ab1400946f3d0e498a8186", + "rev": "7833ff33b2e82d3406337b5dcf0d1cec595d83e9", "type": "github" }, "original": { @@ -561,11 +561,11 @@ ] }, "locked": { - "lastModified": 1774911391, - "narHash": "sha256-c4YVwO33Mmw+FIV8E0u3atJZagHvGTJ9Jai6RtiB8rE=", + "lastModified": 1777148223, + "narHash": "sha256-PTf7kRFFzCW6rIYxLH2fWfVJmj86FSYe3k6L8B+IM9o=", "owner": "hyprwm", "repo": "hyprutils", - "rev": "e6caa3d4d1427eedbdf556cf4ceb70f2d9c0b56d", + "rev": "fa3992be2dfebe4ab06d753c6ca59bea298e798f", "type": "github" }, "original": { @@ -586,11 +586,11 @@ ] }, "locked": { - "lastModified": 1772459835, - "narHash": "sha256-978jRz/y/9TKmZb/qD4lEYHCQGHpEXGqy+8X2lFZsak=", + "lastModified": 1777148232, + "narHash": "sha256-Uv0WZLhu89SafuSOmYDA7akrPt4wBRmsa1ucasO5aXg=", "owner": "hyprwm", "repo": "hyprwayland-scanner", - "rev": "0a692d4a645165eebd65f109146b8861e3a925e7", + "rev": "fec9cf1abcc1011e46f0a0986f46bf93c6bf8b92", "type": "github" }, "original": { @@ -615,11 +615,11 @@ ] }, "locked": { - "lastModified": 1775414057, - "narHash": "sha256-mDpHnf+MkdOxEqIM1TnckYYh9p1SXR8B3KQfNZ12M8s=", + "lastModified": 1776728575, + "narHash": "sha256-z9eGphrArEBpl1O/GCH0wlY6z4K9vA6yWh2gAS6qytU=", "owner": "hyprwm", "repo": "hyprwire", - "rev": "86012ee01b0fdd8bf3101ef38816f2efbee42490", + "rev": "f3a80888783702a39691b684d099e16b83ed4702", "type": "github" }, "original": { @@ -633,11 +633,11 @@ "brew-src": "brew-src" }, "locked": { - "lastModified": 1774720267, - "narHash": "sha256-YYftFe8jyfpQI649yfr0E+dqEXE2jznZNcYvy/lKV1U=", + "lastModified": 1777250621, + "narHash": "sha256-WynkkG0hdZ5niYPJUbVg7oMfu8MVwGGzKZ6lKmfa+O8=", "owner": "zhaofengli", "repo": "nix-homebrew", - "rev": "a7760a3a83f7609f742861afb5732210fdc437ed", + "rev": "aeb2069920742d0d6570089e8b3b8620050bacf2", "type": "github" }, "original": { @@ -656,11 +656,11 @@ "nixpkgs-nixcord": "nixpkgs-nixcord" }, "locked": { - "lastModified": 1775668757, - "narHash": "sha256-IYgdtendCXbY0wbORVoD0pvxliF7TRaAPHUKQb7Hi9c=", + "lastModified": 1777280836, + "narHash": "sha256-rID/Tj1mZLoJsATAmN+YtmPCFAafXxq+gEP1EkPWtpY=", "owner": "kaylorben", "repo": "nixcord", - "rev": "b3816569255c0dbf3026e6ee95e42d16edcca6e1", + "rev": "93fac7ee93c449e94beac2750983a5fcf7785493", "type": "github" }, "original": { @@ -707,11 +707,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1775423009, - "narHash": "sha256-vPKLpjhIVWdDrfiUM8atW6YkIggCEKdSAlJPzzhkQlw=", + "lastModified": 1776877367, + "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=", "owner": "nixos", "repo": "nixpkgs", - "rev": "68d8aa3d661f0e6bd5862291b5bb263b2a6595c9", + "rev": "0726a0ecb6d4e08f6adced58726b95db924cef57", "type": "github" }, "original": { @@ -723,11 +723,11 @@ }, "nixpkgs-lib": { "locked": { - "lastModified": 1772328832, - "narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=", + "lastModified": 1774748309, + "narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=", "owner": "nix-community", "repo": "nixpkgs.lib", - "rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742", + "rev": "333c4e0545a6da976206c74db8773a1645b5870a", "type": "github" }, "original": { @@ -738,11 +738,11 @@ }, "nixpkgs-nixcord": { "locked": { - "lastModified": 1773222311, - "narHash": "sha256-BHoB/XpbqoZkVYZCfXJXfkR+GXFqwb/4zbWnOr2cRcU=", + "lastModified": 1776734388, + "narHash": "sha256-vl3dkhlE5gzsItuHoEMVe+DlonsK+0836LIRDnm6MXQ=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "0590cd39f728e129122770c029970378a79d076a", + "rev": "10e7ad5bbcb421fe07e3a4ad53a634b0cd57ffac", "type": "github" }, "original": { @@ -761,11 +761,11 @@ "systems": "systems_3" }, "locked": { - "lastModified": 1775307257, - "narHash": "sha256-y9hEecHH4ennFwIcw1n480YCGh73DkEmizmQnyXuvgg=", + "lastModified": 1777236345, + "narHash": "sha256-ALOqlq7bE30lsX4rA76hXeQ2aLLEpb44hS+D1+jWS88=", "owner": "nix-community", "repo": "nixvim", - "rev": "2e008bb941f72379d5b935d5bfe70ed8b7c793ff", + "rev": "a67d9cd6ff725a763afe88727aac73208ded3bf4", "type": "github" }, "original": { @@ -784,11 +784,11 @@ ] }, "locked": { - "lastModified": 1775036584, - "narHash": "sha256-zW0lyy7ZNNT/x8JhzFHBsP2IPx7ATZIPai4FJj12BgU=", + "lastModified": 1776796298, + "narHash": "sha256-PcRvlWayisPSjd0UcRQbhG8Oqw78AcPE6x872cPRHN8=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "4e0eb042b67d863b1b34b3f64d52ceb9cd926735", + "rev": "3cfd774b0a530725a077e17354fbdb87ea1c4aad", "type": "github" }, "original": { @@ -821,11 +821,11 @@ ] }, "locked": { - "lastModified": 1775619836, - "narHash": "sha256-VcC/+MMMldwQKcST2y/QTndGLusSxjeUvYwFwzZKKko=", + "lastModified": 1776771786, + "narHash": "sha256-DRFGPfFV6hbrfO9a1PH1FkCi7qR5FgjSqsQGGvk1rdI=", "owner": "Mic92", "repo": "sops-nix", - "rev": "de5f2d596eb896a5728afcd15f823f59cb9ecfdb", + "rev": "bef289e2248991f7afeb95965c82fbcd8ff72598", "type": "github" }, "original": { @@ -842,11 +842,11 @@ "systems": "systems_4" }, "locked": { - "lastModified": 1775421933, - "narHash": "sha256-JkEbzFDFTsUlVtHEzA8Y4r3O9LInhb96eOCbtGjGnbM=", + "lastModified": 1777183994, + "narHash": "sha256-zahis/vVFOsWv/HeyHbU13jxnrCC+ppIg49xG+viWxg=", "owner": "Gerg-L", "repo": "spicetify-nix", - "rev": "ec8d73085fdf807d55765335dc8126e14e7b2096", + "rev": "501256c3e670ca1679501ce3839ea805df00d8ba", "type": "github" }, "original": { @@ -943,11 +943,11 @@ ] }, "locked": { - "lastModified": 1773601989, - "narHash": "sha256-2tJf/CQoHApoIudxHeJye+0Ii7scR0Yyi7pNiWk0Hn8=", + "lastModified": 1777035886, + "narHash": "sha256-m1TNuBoSXUBSKhD9UVMkU90M0wFTPTfvIOOltO8IM8A=", "owner": "hyprwm", "repo": "xdg-desktop-portal-hyprland", - "rev": "a9b862d1aa000a676d310cc62d249f7ad726233d", + "rev": "ecfcdcc781f48821d83e1e2a0e30d7beca0eeb5e", "type": "github" }, "original": { diff --git a/home/shell.nix b/home/shell.nix index 90af6dc..d744d23 100644 --- a/home/shell.nix +++ b/home/shell.nix @@ -15,6 +15,7 @@ fd # find alternative bat # cat alternative ripgrep # grep alternative + doas # sudo alternative # LLM in the Terminal (pkgs.llm.withPlugins { llm-groq = true; }) diff --git a/nixos/ssh.nix b/nixos/ssh.nix index 5491dc1..02f3a0d 100644 --- a/nixos/ssh.nix +++ b/nixos/ssh.nix @@ -10,5 +10,8 @@ }; users.users.${primaryUser}.openssh.authorizedKeys.keyFiles = [ ../secrets/ssh-key ]; programs.ssh.startAgent = true; - + security.doas = { + enable = true; + wheelNeedsPassword = false; + }; } From dd88ffb0a384885b2b158d937439bfea484806a7 Mon Sep 17 00:00:00 2001 From: DerGrumpf Date: Tue, 5 May 2026 11:52:15 +0200 Subject: [PATCH 10/10] WIP: Livekit --- hosts/cyper-controller/configuration.nix | 1 - hosts/cyper-proxy/configuration.nix | 2 +- nixos/roles/matrix/clients.nix | 253 ---------------------- nixos/roles/matrix/coturn.nix | 39 ---- nixos/roles/matrix/default.nix | 2 +- nixos/roles/matrix/livekit.nix | 2 +- nixos/roles/matrix/lk-jwt.nix | 3 +- nixos/roles/nginx.nix | 263 +++++++++++++++++++---- 8 files changed, 226 insertions(+), 339 deletions(-) delete mode 100644 nixos/roles/matrix/clients.nix delete mode 100644 nixos/roles/matrix/coturn.nix diff --git a/hosts/cyper-controller/configuration.nix b/hosts/cyper-controller/configuration.nix index 772709b..975d6ea 100644 --- a/hosts/cyper-controller/configuration.nix +++ b/hosts/cyper-controller/configuration.nix @@ -3,7 +3,6 @@ ./hardware-configuration.nix ./smb.nix ../../nixos/roles/monitoring.nix - ../../nixos/roles/matrix ../../nixos/roles/wyl.nix ../../nixos/roles/adguard.nix ../../nixos/roles/unifi.nix diff --git a/hosts/cyper-proxy/configuration.nix b/hosts/cyper-proxy/configuration.nix index 661a3ca..22152cb 100644 --- a/hosts/cyper-proxy/configuration.nix +++ b/hosts/cyper-proxy/configuration.nix @@ -3,8 +3,8 @@ imports = [ ./hardware-configuration.nix ../../nixos/roles/nginx.nix - ../../nixos/roles/matrix/livekit.nix # ../../nixos/roles/jitsi.nix + ../../nixos/roles/matrix ]; networking = { diff --git a/nixos/roles/matrix/clients.nix b/nixos/roles/matrix/clients.nix deleted file mode 100644 index 641e706..0000000 --- a/nixos/roles/matrix/clients.nix +++ /dev/null @@ -1,253 +0,0 @@ -{ - pkgs, - lib, - ... -}: -let - flavours = [ - { - name = "Latte"; - slug = "latte"; - is_dark = false; - } - { - name = "Frappé"; - slug = "frappe"; - is_dark = true; - } - { - name = "Macchiato"; - slug = "macchiato"; - is_dark = true; - } - { - name = "Mocha"; - slug = "mocha"; - is_dark = true; - } - ]; - accents = [ - "rosewater" - "flamingo" - "pink" - "mauve" - "red" - "maroon" - "peach" - "yellow" - "green" - "teal" - "sky" - "sapphire" - "blue" - "lavender" - ]; - themeHashes = { - "latte/rosewater" = "0l1m4bhaxdam07rfqag6pjbzhdpyi5w3i14vp6rq7aj59pildw3a"; - "latte/flamingo" = "1m8hh2l87xv2rfgpnnl5vzddmam0n82h25fwadb37blgab08vhsr"; - "latte/pink" = "0ambrc42mvg0vdspfmnl31ka1nsxpdyv1p3nh045822y02q20wwh"; - "latte/mauve" = "1nnn2w6nsr24a45jy497c2vhi8v64bwg99fj2dyhpfsn89c63lhn"; - "latte/red" = "14lmw4c4llfz6zqvfymkc6k3msxcml2gwq9rhwsixdpc5mjjbn8n"; - "latte/maroon" = "0ydpng9451mpn7hv5ag1ck8hryx8pdvrml3zksvzm2fiwzzjkpcf"; - "latte/peach" = "1fn5804wv9z9iv65ikyv015b01a7c546rsaaks2a2sq2c37n75l0"; - "latte/yellow" = "0hzgiyhqmwgp3h3v1y23sx3x5qp712sw106472lbnxbywqlavcza"; - "latte/green" = "194kxv6d9hc4nixy16hy9nvf32qs3v214nr2r2qf2z9l89rk5pnp"; - "latte/teal" = "12n25d38zpqxsskglymhmza972klg2hj3c23v2nb3jfj82llw6v4"; - "latte/sky" = "0yghds3xpmbhkbcj2jkh8df82j6vrn9q1z0s2129nca7l5g5f9w2"; - "latte/sapphire" = "18dl1srxp3xccvvy56za6kp05n68d918l0wrxga11746g9sib7r3"; - "latte/blue" = "1zv9nap21d80flvd1jwmjph05jgykxngv5kqbhk95mvqh962ygnf"; - "latte/lavender" = "03j4fwbscip1qm6px1qxkha0c5csq2wwvzg9vwjkc2ja48v1mp9k"; - "frappe/rosewater" = "032qbgj32mvgpankl9777x2lxk18451kglsxg5215k8zrwcg9y95"; - "frappe/flamingo" = "1grhgynn8q7isv18981km5k8ll72ihsjw2ciy8widl6wikv29j8p"; - "frappe/pink" = "0h33g721bph8ihd6lmbc7szxy4dq85ng1cgg5cxjb5y2m7wpdbsy"; - "frappe/mauve" = "121jmznc9q3p7crsy9p2khw8xnzvz4lxms26g1h5wqa67wqvalc4"; - "frappe/red" = "07wm4h1giyy6a5nlh0d3qdarfsp6ikyr5nmg94n13lj4q03d0cn0"; - "frappe/maroon" = "08vg70nr918n4ffi1wnbba4xrx5ak5vfgq7m5ik0rpkb2wdb4x6k"; - "frappe/peach" = "1cg753w2dxs0sx97d8y0g62s8aw3w6b9hrll0lsrw3bc1bvm23fl"; - "frappe/yellow" = "0g43g2if1pcm25i261zfw43bawqqdlgg2f6q2bqhyqvafk9yb3dy"; - "frappe/green" = "1n71mndzds3zldb271g8hdw1yn29s68svzvh8ckjcsz4sb9h1i74"; - "frappe/teal" = "0b6m9cibfwf8csh1pk5i76xi3wx3v2aqwgffzsidw8nwc7c1a3wk"; - "frappe/sky" = "1l4d44399ixshlc9fdsx7iqwxm6kdkp6k4z3z6bdyyx6adw3z4q5"; - "frappe/sapphire" = "03fa9rnclvs5ljd0lzz15vnkzpqpbrhfppg3zwfchs9fvak0n3ni"; - "frappe/blue" = "0r4jjn3pab77w1aanlv3143ch60400q44mdzaqmcjbcr6l2knmjh"; - "frappe/lavender" = "1mrkaz72w6j9hh4dpxwgd6ks5wsnq9ydgy6f9gms4jx1611aab96"; - "macchiato/rosewater" = "001akfnhlvwaiz5faahl4qi0qp6as6ilvkbja6bjy9f5iasr4ygp"; - "macchiato/flamingo" = "06xq3pbx4cb3pyblx2vydr4bp0ylm7866d66agg5wg5qnr356wb3"; - "macchiato/pink" = "1hb32dj0n3wx4f1wxa4n7fib2mazghwsg2ljycza9macfn2n87qn"; - "macchiato/mauve" = "1yrnp162blizc10fz2n6ls1x0di1sdjk53vpsl7mifrkcr1k2nq7"; - "macchiato/red" = "1g9s39q7459lk830vhdrfqkbzz88p3fp8k98a2ygj2hz8sycpryq"; - "macchiato/maroon" = "0ad7rx8sbkygvsgywhpjvvzmyflyhz7jlm13dr7cxj3801rxhl6d"; - "macchiato/peach" = "1m5m6afcl8s1ghn2b9n1d20fhsygnhgn0205nhpxh4bih3kg8c8m"; - "macchiato/yellow" = "0zcc26d28jaq71mz8nqssz8p0hylczirjwjxr2dkha1133vjmvy5"; - "macchiato/green" = "055xdb5jilp5fq3a1g8773rv52zr68fp4l3hs56yj6dy3bq3q22v"; - "macchiato/teal" = "1sfci2g2nvmj0v72gnxqbj0k8053qz0rl6iphfxs3pgpi1b0rczq"; - "macchiato/sky" = "0vhfmdliy8cbb0vqq3v26isvcz4sxzq0xrb4p5a6gibvxaqi6bf3"; - "macchiato/sapphire" = "1744jiv57aqz4qi52n92nrx0s1rhylgg08qqc31jr2clk9h6bw18"; - "macchiato/blue" = "1arp8r2g8ivs1xipq39d3l6cvx0zrr1vwv9yac5j33d6c93wbb2i"; - "macchiato/lavender" = "0kak1f574c07gqjfafg3w5avrci584iqxjkmvrl2pv1879g84nn3"; - "mocha/rosewater" = "0p3ck9crskrhk1za6knaznjlj464mx4sdkkadna6k2152m3czjpz"; - "mocha/flamingo" = "04xx1mky230saqxxqin2fph8cnnz1jhmvb9qd9f5yc3pai3q5wdw"; - "mocha/pink" = "1cj9zdd72vcc45ziav625yq6hrp1zw21f7xsic0ip065xcqzdl3p"; - "mocha/mauve" = "1wb0ibmdv6vn07bk570pikm43qdxj3n2zsqr5sip17ay05j5l6dm"; - "mocha/red" = "1mnzrk57ar2cphyi2ry2lg5ilmb26gm4pr7ixch2ls0hk8ilp9p9"; - "mocha/maroon" = "1mcpwz3yrg3kk0hkqv5nykxj07bm70403yyl8r60pqlh74dnhkbf"; - "mocha/peach" = "0jglpcs41rfqxcm45mvnbdqhma0bv4h07nc7c3nrwz3g3h2djmzr"; - "mocha/yellow" = "0jqkvcjiwid1zdvrj2ikqf5winm08qyd51nfsawfdspbfhqnzmis"; - "mocha/green" = "0bg0014a77yx7f2r6n4mxm7rqgdnymqq7cq6bvpgkfk2z1gyr38l"; - "mocha/teal" = "0kzvi3gfirpcxdhgsilm51lk3j1z6lavb7160chgd9jhzk0xg97c"; - "mocha/sky" = "057nmp2aywdxzrkmzi65bh2mvf1a9cnri0g0jdyzdnrn7f8bbsiw"; - "mocha/sapphire" = "0nfklzb0a7mxv6nzav7m2g0y9plm72vwadm06445myv3k9j3ffmj"; - "mocha/blue" = "06ay46x2aq1q5ghz2zhzhn6qyqkrrf4p9j59qywnxh1jvv728ns8"; - "mocha/lavender" = "0iip063f6km17998c7ak0lb3kq6iskyi3xv2phn618mhslnxhwm5"; - }; - catppuccinThemes = lib.concatMap ( - flavour: - map ( - accent: - builtins.fromJSON ( - builtins.readFile ( - pkgs.fetchurl { - url = "https://element.catppuccin.com/${flavour.slug}/${accent}.json"; - sha256 = themeHashes."${flavour.slug}/${accent}"; - } - ) - ) - ) accents - ) flavours; - elementConfig = builtins.toFile "element-config.json" ( - builtins.toJSON { - default_server_config = { - "m.homeserver" = { - base_url = "https://matrix.cyperpunk.de"; - server_name = "cyperpunk.de"; - }; - }; - jitsi = { - preferred_domain = "jitsi.cyperpunk.de"; - }; - element_call = { - url = "https://element-call.cyperpunk.de"; - use_exclusively = true; - participant_limit = 8; - brand = "Cyperpunk Call"; - encryption = "None"; - }; - livekit = { - livekit_service_url = "https://cyperpunk.de/livekit/jwt/"; - }; - setting_defaults = { - custom_themes = catppuccinThemes; - feature_custom_themes = true; - }; - features = { - feature_group_calls = true; - "feature_disable_call_per_sender_encryption" = true; - "feature_sliding_sync" = true; - }; - } - ); - elementWebConfigured = pkgs.element-web.overrideAttrs (old: { - postInstall = (old.postInstall or "") + '' - cp ${elementConfig} $out/config.json - ''; - }); - synapseAdmin = pkgs.ketesa.withConfig { - restrictBaseUrl = [ "https://matrix.cyperpunk.de" ]; - loginFlows = [ "password" ]; - }; - elementCallConfigured = pkgs.element-call.overrideAttrs (old: { - postInstall = (old.postInstall or "") + '' - cp ${ - builtins.toFile "element-call-config.json" ( - builtins.toJSON { - default_server_config = { - "m.homeserver" = { - base_url = "https://matrix.cyperpunk.de"; - server_name = "cyperpunk.de"; - }; - }; - livekit_service_url = "https://cyperpunk.de/livekit/jwt/"; - e2ee = { - default = false; - }; - } - ) - } $out/config.json - ''; - }); -in -{ - - networking.firewall.allowedTCPPorts = [ - 8009 # Cinny - 8010 # Element - 8011 # Synapse Admin - 8012 # FluffyChat - 8013 # Element Call - ]; - - services.nginx.virtualHosts = { - "cinny.cyperpunk.de" = { - listen = [ - { - addr = "0.0.0.0"; - port = 8009; - } - ]; - root = "${pkgs.cinny}"; - }; - "element.cyperpunk.de" = { - listen = [ - { - addr = "0.0.0.0"; - port = 8010; - } - ]; - root = "${elementWebConfigured}"; - }; - "fluffy.cyperpunk.de" = { - listen = [ - { - addr = "0.0.0.0"; - port = 8012; - } - ]; - locations."/" = { - proxyPass = "http://127.0.0.1:8082"; - }; - }; - "admin.cyperpunk.de" = { - listen = [ - { - addr = "0.0.0.0"; - port = 8011; - } - ]; - root = "${synapseAdmin}"; - }; - "element-call.cyperpunk.de" = { - listen = [ - { - addr = "0.0.0.0"; - port = 8013; - } - ]; - root = "${elementCallConfigured}"; - }; - }; - - virtualisation.oci-containers.containers.fluffychat = { - image = "ghcr.io/krille-chan/fluffychat:latest"; - ports = [ "127.0.0.1:8082:80" ]; - volumes = [ - "${ - builtins.toFile "fluffychat-config.json" ( - builtins.toJSON { - default_homeserver = "matrix.cyperpunk.de"; - preset_homeserver = "matrix.cyperpunk.de"; - } - ) - }:/app/config.json:ro" - ]; - }; -} diff --git a/nixos/roles/matrix/coturn.nix b/nixos/roles/matrix/coturn.nix deleted file mode 100644 index 8540cd5..0000000 --- a/nixos/roles/matrix/coturn.nix +++ /dev/null @@ -1,39 +0,0 @@ -{ - config, - ... -}: -{ - networking.firewall = { - allowedTCPPorts = [ - 3478 # TURN (coturn) - ]; - allowedUDPPorts = [ - 3478 # TURN (coturn) - ]; - allowedUDPPortRanges = [ - { - from = 49152; - to = 65535; # TURN relay ports (coturn) - } - ]; - }; - - sops.secrets.matrix_turn_secret = { - owner = "matrix-synapse"; - group = "matrix-synapse"; - }; - - services.coturn = { - enable = true; - no-cli = true; - no-tcp-relay = true; - min-port = 49152; - max-port = 65535; - use-auth-secret = true; - static-auth-secret-file = config.sops.secrets.matrix_turn_secret.path; - realm = "turn.cyperpunk.de"; - extraConfig = '' - no-multicast-peers - ''; - }; -} diff --git a/nixos/roles/matrix/default.nix b/nixos/roles/matrix/default.nix index 5a89637..7111612 100644 --- a/nixos/roles/matrix/default.nix +++ b/nixos/roles/matrix/default.nix @@ -4,8 +4,8 @@ { imports = [ ./synapse.nix - ./clients.nix ./lk-jwt.nix + ./livekit.nix ]; #networking.firewall = { diff --git a/nixos/roles/matrix/livekit.nix b/nixos/roles/matrix/livekit.nix index 15ab0cb..db5f9e5 100644 --- a/nixos/roles/matrix/livekit.nix +++ b/nixos/roles/matrix/livekit.nix @@ -16,7 +16,7 @@ node_ip = "178.254.8.35"; }; room = { - auto_create = false; + auto_create = true; enabled_codecs = [ { mime = "video/VP8"; } { mime = "video/VP9"; } diff --git a/nixos/roles/matrix/lk-jwt.nix b/nixos/roles/matrix/lk-jwt.nix index 7ce3978..fbf2fbd 100644 --- a/nixos/roles/matrix/lk-jwt.nix +++ b/nixos/roles/matrix/lk-jwt.nix @@ -1,7 +1,7 @@ { config, lib, ... }: let domain = "cyperpunk.de"; - synapseUrl = "http://100.109.179.25:8008"; + synapseUrl = "http://localhost:8008"; in { sops.secrets.livekit_key_jwt = { }; @@ -19,6 +19,7 @@ in LIVEKIT_FULL_ACCESS_HOMESERVERS = domain; MATRIX_BASE_URL = synapseUrl; LIVEKIT_JWT_BIND = lib.mkForce ":18080"; + LIVEKIT_INSECURE_SKIP_VERIFY_TLS = "YES_I_KNOW_WHAT_I_AM_DOING"; }; }; } diff --git a/nixos/roles/nginx.nix b/nixos/roles/nginx.nix index 632c4bc..639af87 100644 --- a/nixos/roles/nginx.nix +++ b/nixos/roles/nginx.nix @@ -1,8 +1,7 @@ -_: +{ pkgs, lib, ... }: let upstream = "100.109.179.25"; - # helper: simple reverse proxy, force SSL mkProxy = port: { forceSSL = true; enableACME = true; @@ -11,7 +10,6 @@ let }; }; - # helper: like mkProxy but with websocket support mkWsProxy = port: (mkProxy port) @@ -55,6 +53,176 @@ let ''; }; }; + + flavours = [ + { + name = "Latte"; + slug = "latte"; + is_dark = false; + } + { + name = "Frappé"; + slug = "frappe"; + is_dark = true; + } + { + name = "Macchiato"; + slug = "macchiato"; + is_dark = true; + } + { + name = "Mocha"; + slug = "mocha"; + is_dark = true; + } + ]; + accents = [ + "rosewater" + "flamingo" + "pink" + "mauve" + "red" + "maroon" + "peach" + "yellow" + "green" + "teal" + "sky" + "sapphire" + "blue" + "lavender" + ]; + themeHashes = { + "latte/rosewater" = "0l1m4bhaxdam07rfqag6pjbzhdpyi5w3i14vp6rq7aj59pildw3a"; + "latte/flamingo" = "1m8hh2l87xv2rfgpnnl5vzddmam0n82h25fwadb37blgab08vhsr"; + "latte/pink" = "0ambrc42mvg0vdspfmnl31ka1nsxpdyv1p3nh045822y02q20wwh"; + "latte/mauve" = "1nnn2w6nsr24a45jy497c2vhi8v64bwg99fj2dyhpfsn89c63lhn"; + "latte/red" = "14lmw4c4llfz6zqvfymkc6k3msxcml2gwq9rhwsixdpc5mjjbn8n"; + "latte/maroon" = "0ydpng9451mpn7hv5ag1ck8hryx8pdvrml3zksvzm2fiwzzjkpcf"; + "latte/peach" = "1fn5804wv9z9iv65ikyv015b01a7c546rsaaks2a2sq2c37n75l0"; + "latte/yellow" = "0hzgiyhqmwgp3h3v1y23sx3x5qp712sw106472lbnxbywqlavcza"; + "latte/green" = "194kxv6d9hc4nixy16hy9nvf32qs3v214nr2r2qf2z9l89rk5pnp"; + "latte/teal" = "12n25d38zpqxsskglymhmza972klg2hj3c23v2nb3jfj82llw6v4"; + "latte/sky" = "0yghds3xpmbhkbcj2jkh8df82j6vrn9q1z0s2129nca7l5g5f9w2"; + "latte/sapphire" = "18dl1srxp3xccvvy56za6kp05n68d918l0wrxga11746g9sib7r3"; + "latte/blue" = "1zv9nap21d80flvd1jwmjph05jgykxngv5kqbhk95mvqh962ygnf"; + "latte/lavender" = "03j4fwbscip1qm6px1qxkha0c5csq2wwvzg9vwjkc2ja48v1mp9k"; + "frappe/rosewater" = "032qbgj32mvgpankl9777x2lxk18451kglsxg5215k8zrwcg9y95"; + "frappe/flamingo" = "1grhgynn8q7isv18981km5k8ll72ihsjw2ciy8widl6wikv29j8p"; + "frappe/pink" = "0h33g721bph8ihd6lmbc7szxy4dq85ng1cgg5cxjb5y2m7wpdbsy"; + "frappe/mauve" = "121jmznc9q3p7crsy9p2khw8xnzvz4lxms26g1h5wqa67wqvalc4"; + "frappe/red" = "07wm4h1giyy6a5nlh0d3qdarfsp6ikyr5nmg94n13lj4q03d0cn0"; + "frappe/maroon" = "08vg70nr918n4ffi1wnbba4xrx5ak5vfgq7m5ik0rpkb2wdb4x6k"; + "frappe/peach" = "1cg753w2dxs0sx97d8y0g62s8aw3w6b9hrll0lsrw3bc1bvm23fl"; + "frappe/yellow" = "0g43g2if1pcm25i261zfw43bawqqdlgg2f6q2bqhyqvafk9yb3dy"; + "frappe/green" = "1n71mndzds3zldb271g8hdw1yn29s68svzvh8ckjcsz4sb9h1i74"; + "frappe/teal" = "0b6m9cibfwf8csh1pk5i76xi3wx3v2aqwgffzsidw8nwc7c1a3wk"; + "frappe/sky" = "1l4d44399ixshlc9fdsx7iqwxm6kdkp6k4z3z6bdyyx6adw3z4q5"; + "frappe/sapphire" = "03fa9rnclvs5ljd0lzz15vnkzpqpbrhfppg3zwfchs9fvak0n3ni"; + "frappe/blue" = "0r4jjn3pab77w1aanlv3143ch60400q44mdzaqmcjbcr6l2knmjh"; + "frappe/lavender" = "1mrkaz72w6j9hh4dpxwgd6ks5wsnq9ydgy6f9gms4jx1611aab96"; + "macchiato/rosewater" = "001akfnhlvwaiz5faahl4qi0qp6as6ilvkbja6bjy9f5iasr4ygp"; + "macchiato/flamingo" = "06xq3pbx4cb3pyblx2vydr4bp0ylm7866d66agg5wg5qnr356wb3"; + "macchiato/pink" = "1hb32dj0n3wx4f1wxa4n7fib2mazghwsg2ljycza9macfn2n87qn"; + "macchiato/mauve" = "1yrnp162blizc10fz2n6ls1x0di1sdjk53vpsl7mifrkcr1k2nq7"; + "macchiato/red" = "1g9s39q7459lk830vhdrfqkbzz88p3fp8k98a2ygj2hz8sycpryq"; + "macchiato/maroon" = "0ad7rx8sbkygvsgywhpjvvzmyflyhz7jlm13dr7cxj3801rxhl6d"; + "macchiato/peach" = "1m5m6afcl8s1ghn2b9n1d20fhsygnhgn0205nhpxh4bih3kg8c8m"; + "macchiato/yellow" = "0zcc26d28jaq71mz8nqssz8p0hylczirjwjxr2dkha1133vjmvy5"; + "macchiato/green" = "055xdb5jilp5fq3a1g8773rv52zr68fp4l3hs56yj6dy3bq3q22v"; + "macchiato/teal" = "1sfci2g2nvmj0v72gnxqbj0k8053qz0rl6iphfxs3pgpi1b0rczq"; + "macchiato/sky" = "0vhfmdliy8cbb0vqq3v26isvcz4sxzq0xrb4p5a6gibvxaqi6bf3"; + "macchiato/sapphire" = "1744jiv57aqz4qi52n92nrx0s1rhylgg08qqc31jr2clk9h6bw18"; + "macchiato/blue" = "1arp8r2g8ivs1xipq39d3l6cvx0zrr1vwv9yac5j33d6c93wbb2i"; + "macchiato/lavender" = "0kak1f574c07gqjfafg3w5avrci584iqxjkmvrl2pv1879g84nn3"; + "mocha/rosewater" = "0p3ck9crskrhk1za6knaznjlj464mx4sdkkadna6k2152m3czjpz"; + "mocha/flamingo" = "04xx1mky230saqxxqin2fph8cnnz1jhmvb9qd9f5yc3pai3q5wdw"; + "mocha/pink" = "1cj9zdd72vcc45ziav625yq6hrp1zw21f7xsic0ip065xcqzdl3p"; + "mocha/mauve" = "1wb0ibmdv6vn07bk570pikm43qdxj3n2zsqr5sip17ay05j5l6dm"; + "mocha/red" = "1mnzrk57ar2cphyi2ry2lg5ilmb26gm4pr7ixch2ls0hk8ilp9p9"; + "mocha/maroon" = "1mcpwz3yrg3kk0hkqv5nykxj07bm70403yyl8r60pqlh74dnhkbf"; + "mocha/peach" = "0jglpcs41rfqxcm45mvnbdqhma0bv4h07nc7c3nrwz3g3h2djmzr"; + "mocha/yellow" = "0jqkvcjiwid1zdvrj2ikqf5winm08qyd51nfsawfdspbfhqnzmis"; + "mocha/green" = "0bg0014a77yx7f2r6n4mxm7rqgdnymqq7cq6bvpgkfk2z1gyr38l"; + "mocha/teal" = "0kzvi3gfirpcxdhgsilm51lk3j1z6lavb7160chgd9jhzk0xg97c"; + "mocha/sky" = "057nmp2aywdxzrkmzi65bh2mvf1a9cnri0g0jdyzdnrn7f8bbsiw"; + "mocha/sapphire" = "0nfklzb0a7mxv6nzav7m2g0y9plm72vwadm06445myv3k9j3ffmj"; + "mocha/blue" = "06ay46x2aq1q5ghz2zhzhn6qyqkrrf4p9j59qywnxh1jvv728ns8"; + "mocha/lavender" = "0iip063f6km17998c7ak0lb3kq6iskyi3xv2phn618mhslnxhwm5"; + }; + catppuccinThemes = lib.concatMap ( + flavour: + map ( + accent: + builtins.fromJSON ( + builtins.readFile ( + pkgs.fetchurl { + url = "https://element.catppuccin.com/${flavour.slug}/${accent}.json"; + sha256 = themeHashes."${flavour.slug}/${accent}"; + } + ) + ) + ) accents + ) flavours; + + elementConfig = builtins.toFile "element-config.json" ( + builtins.toJSON { + default_server_config = { + "m.homeserver" = { + base_url = "https://matrix.cyperpunk.de"; + server_name = "cyperpunk.de"; + }; + }; + jitsi.preferred_domain = "jitsi.cyperpunk.de"; + element_call = { + url = "https://element-call.cyperpunk.de"; + use_exclusively = true; + participant_limit = 8; + brand = "Cyperpunk Call"; + encryption = "None"; + }; + livekit.livekit_service_url = "https://cyperpunk.de/livekit/jwt/"; + setting_defaults = { + custom_themes = catppuccinThemes; + feature_custom_themes = true; + }; + features = { + feature_group_calls = true; + feature_disable_call_per_sender_encryption = true; + feature_sliding_sync = true; + }; + } + ); + + elementWebConfigured = pkgs.element-web.overrideAttrs (old: { + postInstall = (old.postInstall or "") + '' + cp ${elementConfig} $out/config.json + ''; + }); + + synapseAdmin = pkgs.ketesa.withConfig { + restrictBaseUrl = [ "https://matrix.cyperpunk.de" ]; + loginFlows = [ "password" ]; + }; + + elementCallConfigured = pkgs.element-call.overrideAttrs (old: { + postInstall = (old.postInstall or "") + '' + cp ${ + builtins.toFile "element-call-config.json" ( + builtins.toJSON { + default_server_config = { + "m.homeserver" = { + base_url = "https://matrix.cyperpunk.de"; + server_name = "cyperpunk.de"; + }; + }; + livekit_service_url = "https://cyperpunk.de/livekit/jwt/"; + e2ee.default = false; + } + ) + } $out/config.json + ''; + }); in { networking.firewall.allowedTCPPorts = [ @@ -64,7 +232,7 @@ in security.acme = { acceptTerms = true; - defaults.email = "phil.keier@hotmail.com"; # Change accordingly + defaults.email = "phil.keier@hotmail.com"; }; services.nginx = { @@ -75,13 +243,13 @@ in recommendedGzipSettings = true; virtualHosts = { + # controller services "git.cyperpunk.de" = mkProxy 9000; "search.cyperpunk.de" = mkProxy 11080; "file.cyperpunk.de" = mkProxy 10000; "ngx.cyperpunk.de" = mkWsProxy 28101; - "vault.cyperpunk.de" = mkWsProxy 8222; - "fluffy.cyperpunk.de" = mkWsProxy 8012; + "calvin.cyperpunk.de" = mkWsProxy 15006; "www.cyperpunk.de" = { forceSSL = true; @@ -98,49 +266,46 @@ in }; }; - "calvin.cyperpunk.de" = mkWsProxy 15006; - "cinny.cyperpunk.de" = mkWsProxy 8009; - - "element-call.cyperpunk.de" = { + # local static clients + "cinny.cyperpunk.de" = { forceSSL = true; enableACME = true; - locations."/" = { - proxyPass = "http://${upstream}:8013"; - proxyWebsockets = true; - extraConfig = '' - add_header Cross-Origin-Opener-Policy "same-origin"; - add_header Cross-Origin-Embedder-Policy "require-corp"; - add_header Cross-Origin-Resource-Policy "cross-origin"; - ''; - }; + root = "${pkgs.cinny}"; }; "element.cyperpunk.de" = { forceSSL = true; enableACME = true; - locations = { - "/" = { - proxyPass = "http://${upstream}:8010"; - proxyWebsockets = true; - }; - "/widgets/element-call/config.json" = { - extraConfig = '' - default_type application/json; - add_header Access-Control-Allow-Origin *; - return 200 '{ - "livekit_service_url": "https://cyperpunk.de/livekit/jwt/", - "default_server_config": { - "m.homeserver": { - "base_url": "https://matrix.cyperpunk.de", - "server_name":"cyperpunk.de" - } - } - }'; - ''; - }; + root = "${elementWebConfigured}"; + }; + + "element-call.cyperpunk.de" = { + forceSSL = true; + enableACME = true; + root = "${elementCallConfigured}"; + extraConfig = '' + add_header Cross-Origin-Opener-Policy "same-origin"; + add_header Cross-Origin-Embedder-Policy "require-corp"; + add_header Cross-Origin-Resource-Policy "cross-origin"; + ''; + }; + + "fluffy.cyperpunk.de" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://127.0.0.1:8082"; + proxyWebsockets = true; }; }; + "admin.cyperpunk.de" = { + forceSSL = true; + enableACME = true; + root = "${synapseAdmin}"; + }; + + # matrix + livekit "cyperpunk.de" = { forceSSL = true; enableACME = true; @@ -149,12 +314,12 @@ in extraConfig = matrixConfig; locations = wellKnownMatrix // { "/" = { - proxyPass = "http://${upstream}:8008"; + proxyPass = "http://127.0.0.1:8008"; proxyWebsockets = true; }; "^~ /livekit/jwt/" = { priority = 400; - proxyPass = "http://${upstream}:18080/"; + proxyPass = "http://127.0.0.1:18080/"; }; "^~ /livekit/sfu/" = { priority = 400; @@ -167,7 +332,6 @@ in proxy_set_header X-Forwarded-Proto $scheme; proxy_read_timeout 86400s; proxy_send_timeout 86400s; - ''; }; "/_matrix/client/unstable/org.matrix.msc4143/rtc/transports" = { @@ -183,4 +347,19 @@ in }; }; }; + + virtualisation.oci-containers.containers.fluffychat = { + image = "ghcr.io/krille-chan/fluffychat:latest"; + ports = [ "127.0.0.1:8082:80" ]; + volumes = [ + "${ + builtins.toFile "fluffychat-config.json" ( + builtins.toJSON { + default_homeserver = "matrix.cyperpunk.de"; + preset_homeserver = "matrix.cyperpunk.de"; + } + ) + }:/app/config.json:ro" + ]; + }; }