fi/nix-infra
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Compare commits

base: fi:139033130f48be7f9edae9d235d928c9e5faa59c
Branches Tags
fi:main
fi:ikiwiki
fi:mas
..
compare: fi:ee38989e39f8a0f80e81988cddc1fa38cef7452e
Branches Tags
fi:main
fi:ikiwiki
fi:mas

No commits in common. "139033130f48be7f9edae9d235d928c9e5faa59c" and "ee38989e39f8a0f80e81988cddc1fa38cef7452e" have entirely different histories.
139033130f ... ee38989e39

8 changed files with 59 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

1
config/common/default.nix
View file

@ -41,6 +41,7 @@
security.acme = { security.acme = {
defaults.email = "acme@grzb.de"; defaults.email = "acme@grzb.de";
acceptTerms = true; acceptTerms = true;
preliminarySelfsigned = true;
}; };
# Print the ed25519 public ssh host key to console when booting # Print the ed25519 public ssh host key to console when booting

8
config/hosts/mastodon/mastodon.nix
View file

@ -2,8 +2,8 @@
let let
tangerineUI = pkgs.fetchgit { tangerineUI = pkgs.fetchgit {
url = "https://github.com/nileane/TangerineUI-for-Mastodon.git"; url = "https://github.com/nileane/TangerineUI-for-Mastodon.git";
rev = "v2.4.4"; rev = "v2.4.3";
hash = "sha256-58xiS2yzv4z24IULJQWpkqV1Op6e+U6SFd1XjpAB6Go="; hash = "sha256-OThT3fp676RMfYY3ehzM4DnAlJOqdPoYIHpoBbN/RHQ=";
}; };
mastodonModern = pkgs.fetchgit { mastodonModern = pkgs.fetchgit {
url = "https://git.gay/freeplay/Mastodon-Modern.git"; url = "https://git.gay/freeplay/Mastodon-Modern.git";
@ -16,14 +16,14 @@ let
}; };
mastodonNekoverseOverlay = final: prev: { mastodonNekoverseOverlay = final: prev: {
mastodon = (prev.mastodon.override rec { mastodon = (prev.mastodon.override rec {
version = "4.4.3"; version = "4.4.1";
srcOverride = final.applyPatches { srcOverride = final.applyPatches {
src = pkgs.stdenv.mkDerivation { src = pkgs.stdenv.mkDerivation {
name = "mastodonWithThemes"; name = "mastodonWithThemes";
src = pkgs.fetchgit { src = pkgs.fetchgit {
url = "https://github.com/mastodon/mastodon.git"; url = "https://github.com/mastodon/mastodon.git";
rev = "v${version}"; rev = "v${version}";
sha256 = "sha256-HFvsf8uNP5TV6vPaIkWKnuOKExQhgvrhyRWf3OCqIDk="; sha256 = "sha256-hu6AmR0CvI3lVixJ2UmWY3KAlWbqYULCQAjRGJcuIhc=";
}; };
# mastodon ships with broken symlinks, disable the check for that for now # mastodon ships with broken symlinks, disable the check for that for now
dontCheckForBrokenSymlinks = true; dontCheckForBrokenSymlinks = true;

2
config/hosts/matrix/configuration.nix
View file

@ -9,7 +9,7 @@
hostName = "matrix"; hostName = "matrix";
firewall = { firewall = {
enable = true; enable = true;
allowedTCPPorts = [ 80 8443 8448 9000 ]; allowedTCPPorts = [ 80 8443 8448 ];
}; };
}; };

53
config/hosts/matrix/matrix-synapse.nix
View file

@ -3,40 +3,26 @@
services.matrix-synapse = { services.matrix-synapse = {
enable = true; enable = true;
settings = { settings = {
listeners = [ listeners = [{
{ port = 8008;
port = 8008; bind_addresses = [
bind_addresses = [ "::1"
"::1" "127.0.0.1"
"127.0.0.1" ];
]; type = "http";
type = "http"; tls = false;
tls = false; x_forwarded = true;
x_forwarded = true; resources = [
resources = [ {
{ compress = true;
compress = true; names = [ "client" ];
names = [ "client" ]; }
} {
{
compress = false;
names = [ "federation" ];
}
];
}
{
port = 9000;
type = "http";
tls = false;
bind_addresses = [
"0.0.0.0"
];
resources = [{
names = [ "metrics" ];
compress = false; compress = false;
}]; names = [ "federation" ];
} }
]; ];
}];
server_name = "nekover.se"; server_name = "nekover.se";
public_baseurl = "https://matrix.nekover.se"; public_baseurl = "https://matrix.nekover.se";
database = { database = {
@ -54,7 +40,6 @@
signing_key_path = "/secrets/matrix-homeserver-signing-key.secret"; signing_key_path = "/secrets/matrix-homeserver-signing-key.secret";
admin_contact = "mailto:admin@nekover.se"; admin_contact = "mailto:admin@nekover.se";
web_client_location = "https://element.nekover.se"; web_client_location = "https://element.nekover.se";
enable_metrics = true;
turn_uris = [ turn_uris = [
"turns:turn.nekover.se?transport=udp" "turns:turn.nekover.se?transport=udp"
"turns:turn.nekover.se?transport=tcp" "turns:turn.nekover.se?transport=tcp"

19
config/hosts/metrics/nginx.nix
View file

@ -22,6 +22,25 @@
proxyWebsockets = true; proxyWebsockets = true;
}; };
}; };
"alertmanager.grzb.de"= {
forceSSL = true;
enableACME = true;
listen = [
{
addr = "0.0.0.0";
port = 80;
}
{
addr = "0.0.0.0";
port = 443;
ssl = true;
}
];
locations."/" = {
proxyPass = "http://${config.services.prometheus.alertmanager.listenAddress}:${builtins.toString config.services.prometheus.alertmanager.port}";
proxyWebsockets = true;
};
};
}; };
}; };
} }

18
config/hosts/metrics/prometheus.nix
View file

@ -1,16 +1,8 @@
{ hosts, pkgs, ... }: { hosts, ... }:
let
# https://github.com/element-hq/synapse/tree/master/contrib/prometheus/
synapseRules = pkgs.fetchurl {
url = "https://raw.githubusercontent.com/element-hq/synapse/refs/heads/master/contrib/prometheus/synapse-v2.rules";
hash = "sha256-WldlBdCMzul49OlFhJMsrx4MYFakHTa36Y9HnV22EwI=";
};
in
{ {
services.prometheus = { services.prometheus = {
enable = true; enable = true;
retentionTime = "90d"; retentionTime = "90d";
ruleFiles = [ synapseRules ];
scrapeConfigs = [ scrapeConfigs = [
{ {
job_name = "node"; job_name = "node";
@ -23,14 +15,6 @@ in
}; };
}) (builtins.attrNames hosts); }) (builtins.attrNames hosts);
} }
{
job_name = "synapse";
scrape_interval = "15s";
metrics_path = "/_synapse/metrics";
static_configs = [{
targets = [ "matrix.vs.grzb.de:9000" ];
}];
}
]; ];
}; };
} }

4
config/hosts/web-public-2/virtualHosts/element.nekover.se.nix
View file

@ -1,9 +1,9 @@
{ pkgs, ... }: { pkgs, ... }:
let let
elementWebVersion = "1.11.109"; elementWebVersion = "1.11.106";
element-web = pkgs.fetchzip { element-web = pkgs.fetchzip {
url = "https://github.com/vector-im/element-web/releases/download/v${elementWebVersion}/element-v${elementWebVersion}.tar.gz"; url = "https://github.com/vector-im/element-web/releases/download/v${elementWebVersion}/element-v${elementWebVersion}.tar.gz";
sha256 = "sha256-eKPClYJxUhCJznI1+dv9w2h0CoSKgZsBZCsuM3KH5ag="; sha256 = "sha256-5E6za7G7Olia5VzOnBjYMeGJ2Xifqx+vDmCFgNLaRZo=";
}; };
elementWebSecurityHeaders = '' elementWebSecurityHeaders = ''
# Configuration best practices # Configuration best practices

24
flake.lock generated
View file

@ -118,11 +118,11 @@
}, },
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1755678965, "lastModified": 1754951463,
"narHash": "sha256-zyEsoxHTMIbyYWpc4n+jiKwZ9TcIE4DPotdxAe2Jrso=", "narHash": "sha256-QokKO2Ofo4hW5XvcMdZ89XEPAyFo6vqz7yCD5fx9wFw=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "0ee3848fea3e9c7dadf47cf1e89f8c13878e9f6f", "rev": "216c1318892aa8236e38dcbc6dfd976f5eff4e48",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -150,11 +150,11 @@
}, },
"nixpkgs-master": { "nixpkgs-master": {
"locked": { "locked": {
"lastModified": 1755716446, "lastModified": 1754986950,
"narHash": "sha256-AdVENrXoFws0sENT2Sz9SMavbqVJnATmCODuqJ7GcSs=", "narHash": "sha256-8sbLVtESf/0gBp522Bz7TSvgulzTOFx9/wG92tBM4GE=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "b0eccfbc0168243438e8a6747fcdfb1bb796a3f7", "rev": "cfa72d41e8b342aea82ee6ae28ecfc2293ac599b",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -166,11 +166,11 @@
}, },
"nixpkgs-unstable": { "nixpkgs-unstable": {
"locked": { "locked": {
"lastModified": 1755672759, "lastModified": 1754975461,
"narHash": "sha256-YO9q05I+vi6zrHpxeBcDnQYKX7TS4T3SxPXYd6N00XA=", "narHash": "sha256-F/EzILKOWZ4UvCbj655MLAf2EfjbhFbz1iKrxaJxmuk=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "25bf5c5df47ae79b24fbae8d0d3f6480dadde3ed", "rev": "cca779286a4dfd33a04d11954829dfeca0904b79",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -214,11 +214,11 @@
"nixpkgs-25_05": "nixpkgs-25_05" "nixpkgs-25_05": "nixpkgs-25_05"
}, },
"locked": { "locked": {
"lastModified": 1755110674, "lastModified": 1747965231,
"narHash": "sha256-PigqTAGkdBYXVFWsJnqcirrLeFqRFN4PFigLA8FzxeI=", "narHash": "sha256-BW3ktviEhfCN/z3+kEyzpDKAI8qFTwO7+S0NVA0C90o=",
"owner": "simple-nixos-mailserver", "owner": "simple-nixos-mailserver",
"repo": "nixos-mailserver", "repo": "nixos-mailserver",
"rev": "f5936247dbdb8501221978562ab0b302dd75456c", "rev": "53007af63fade28853408370c4c600a63dd97f41",
"type": "gitlab" "type": "gitlab"
}, },
"original": { "original": {