From a5ad72423a09e306742cdeb052322847331cef48 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Fri, 10 Jun 2022 05:48:18 +0000 Subject: [PATCH 1/5] Linode config update 22.05 --- hosts/linode/postgres.nix | 4 ++-- hosts/linode/synapse.nix | 40 +++++++++++++++++++++------------------ 2 files changed, 24 insertions(+), 20 deletions(-) diff --git a/hosts/linode/postgres.nix b/hosts/linode/postgres.nix index 9191feb..e75e1b4 100644 --- a/hosts/linode/postgres.nix +++ b/hosts/linode/postgres.nix @@ -31,10 +31,10 @@ root root postgres services.logrotate = { enable = true; - paths = { + settings = { postgres = { enable = true; - path = "${config.services.postgresqlBackup.location}/*.gz"; + files = "${config.services.postgresqlBackup.location}/*.gz"; }; }; }; diff --git a/hosts/linode/synapse.nix b/hosts/linode/synapse.nix index 2d296e5..42ea89f 100644 --- a/hosts/linode/synapse.nix +++ b/hosts/linode/synapse.nix @@ -74,26 +74,30 @@ return 200 '${builtins.toJSON client}'; services.matrix-synapse = { enable = true; - database_name = "synapse"; - database_user = "matrix-synapse"; # Identify ourselves as the root of our own domain - server_name = "thehellings.com"; - #registration_shared_secret = "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa"; - # Bind a single listener to localhost only, disable SSL/TLS, and put - # it behind an nginx proxy - listeners = [ { - port = 8448; - bind_address = "127.0.0.1"; - type = "http"; # Offload SSL/TLS to Nginx - tls = false; - resources = [ { - names = [ "client" "federation" ]; - compress = false; # Offload compressiong to Nginx + settings = { + database.args = { + user = "matrix-synapse"; + name = "synapse"; + }; + server_name = "thehellings.com"; + #registration_shared_secret = "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa"; + # Bind a single listener to localhost only, disable SSL/TLS, and put + # it behind an nginx proxy + listeners = [ { + port = 8448; + bind_addresses = ["127.0.0.1"]; + type = "http"; # Offload SSL/TLS to Nginx + tls = false; + resources = [ { + names = [ "client" "federation" ]; + compress = false; # Offload compressiong to Nginx + } ]; } ]; - } ]; - app_service_config_files = [ - "/etc/${fbRegistrationFile}" - ]; + app_service_config_files = [ + "/etc/${fbRegistrationFile}" + ]; + }; }; # Open networking ports for the server From e8b4f3b3b018a6cc12dceed7cf098f30939ef82e Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Sun, 12 Jun 2022 03:50:24 +0000 Subject: [PATCH 2/5] Simplify syncthing and fix Synapse --- hosts/linode/nextcloud.nix | 4 ---- hosts/linode/postgres.nix | 4 ---- hosts/linode/synapse.nix | 2 +- 3 files changed, 1 insertion(+), 9 deletions(-) diff --git a/hosts/linode/nextcloud.nix b/hosts/linode/nextcloud.nix index b4c7265..068ec5a 100644 --- a/hosts/linode/nextcloud.nix +++ b/hosts/linode/nextcloud.nix @@ -30,8 +30,4 @@ enable = true; devices = [ "nas" ]; }; - - services.cron.systemCronJobs = [ - "59 2 * * * root chmod -R a+r ${config.services.syncthing.folders.nextcloud-backup.path} && find ${config.services.syncthing.folders.nextcloud-backup.path} -type d -exec chmod a+x '{}' \\;" - ]; } diff --git a/hosts/linode/postgres.nix b/hosts/linode/postgres.nix index e75e1b4..c8f9780 100644 --- a/hosts/linode/postgres.nix +++ b/hosts/linode/postgres.nix @@ -44,8 +44,4 @@ root root postgres enable = true; devices = [ "nas" ]; }; - - services.cron.systemCronJobs = [ - "59 2 * * * root chmod -R a+r ${config.services.postgresqlBackup.location} && find ${config.services.postgresqlBackup.location} -type d -exec chmod a+x '{}' \\;" - ]; } diff --git a/hosts/linode/synapse.nix b/hosts/linode/synapse.nix index 42ea89f..02bb222 100644 --- a/hosts/linode/synapse.nix +++ b/hosts/linode/synapse.nix @@ -78,7 +78,7 @@ return 200 '${builtins.toJSON client}'; settings = { database.args = { user = "matrix-synapse"; - name = "synapse"; + database = "synapse"; }; server_name = "thehellings.com"; #registration_shared_secret = "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa"; From 164e30cd87e203836749e588d9af56c95de5731f Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Sun, 12 Jun 2022 04:58:34 +0000 Subject: [PATCH 3/5] Update ACME configurations --- hosts/linode/nginx.nix | 3 ++- modules/proxy.nix | 8 +++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/hosts/linode/nginx.nix b/hosts/linode/nginx.nix index 9f17309..dc7c4de 100644 --- a/hosts/linode/nginx.nix +++ b/hosts/linode/nginx.nix @@ -5,7 +5,7 @@ in { security.acme = { acceptTerms = true; - email = "greg.hellings@gmail.com"; + defaults.email = "greg.hellings@gmail.com"; }; services.nginx = { @@ -30,5 +30,6 @@ in greg.proxies."thehellings.com" = { target = "http://${homepage}/"; ssl = true; + genAliases = false; }; } diff --git a/modules/proxy.nix b/modules/proxy.nix index 7e0768f..e108242 100644 --- a/modules/proxy.nix +++ b/modules/proxy.nix @@ -16,7 +16,7 @@ proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; ''; }; - serverAliases = [ "${alias name}" ]; + serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ]; }; in with lib; { @@ -40,6 +40,12 @@ in with lib; { { name, config, options, ... }: { options = { + genAliases = mkOption { + type = types.bool; + description = "Whether to auto-generate short alias name"; + default = true; + }; + target = mkOption { type = types.str; description = ''The destination that is being proxied.''; From d34a180efe4687cc141d9ea339cebbb2b42c9056 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Sun, 12 Jun 2022 04:59:12 +0000 Subject: [PATCH 4/5] Add tailscale support to linode --- hosts/linode/default.nix | 1 + modules/default.nix | 1 + modules/tailscale.nix | 14 ++++++++++++++ 3 files changed, 16 insertions(+) create mode 100644 modules/tailscale.nix diff --git a/hosts/linode/default.nix b/hosts/linode/default.nix index 2ab58f5..ae0a13c 100644 --- a/hosts/linode/default.nix +++ b/hosts/linode/default.nix @@ -10,6 +10,7 @@ ]; greg.home = false; greg.linode.enable = true; + greg.tailscale.enable = true; networking.hostName = "linode"; networking.domain = "thehellings.com"; } diff --git a/modules/default.nix b/modules/default.nix index 8124384..2a2d0c4 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -7,6 +7,7 @@ ./linode.nix ./proxy.nix ./rpi4.nix + ./tailscale.nix ./xprograms.nix ]; } diff --git a/modules/tailscale.nix b/modules/tailscale.nix new file mode 100644 index 0000000..54e34b1 --- /dev/null +++ b/modules/tailscale.nix @@ -0,0 +1,14 @@ +{ lib, config, ... }: + +let + cfg = config.greg.tailscale; +in { + options = { + greg.tailscale.enable = lib.mkEnableOption "Enable Tailscale"; + }; + + config = lib.mkIf cfg.enable { + services.tailscale.enable = true; + networking.firewall.checkReversePath = "loose"; + }; +} From 6bfbf544c5868978f6a79da75e2e7699a57d7fdb Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Sun, 12 Jun 2022 05:31:45 +0000 Subject: [PATCH 5/5] Add tailscale helpers --- home/xonsh.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/home/xonsh.nix b/home/xonsh.nix index 7b7ccc2..b4a3187 100644 --- a/home/xonsh.nix +++ b/home/xonsh.nix @@ -42,6 +42,8 @@ in { molcol = "molecule -c ../../tests/molecule.yml"; pa = "cd ~/src/packaging"; dirflake = "nix flake new -t github:nix-community/nix-direnv"; + tsup = "tailscale up"; + tspub = "tailscale up --exit-node=linode"; }; configHeader = ''