Merge branch 'main' of gh:greg-hellings/nixos-config

home/xonsh.nix

@@ -42,6 +42,8 @@ in {
 			molcol = "molecule -c ../../tests/molecule.yml";
 			pa = "cd ~/src/packaging";
 			dirflake = "nix flake new -t github:nix-community/nix-direnv";
+			tsup = "tailscale up";
+			tspub = "tailscale up --exit-node=linode";
 		};
 
 		configHeader = ''

hosts/linode/default.nix

@@ -10,6 +10,7 @@
 	];
 	greg.home = false;
 	greg.linode.enable = true;
+	greg.tailscale.enable = true;
 	networking.hostName = "linode";
 	networking.domain = "thehellings.com";
 }

hosts/linode/nextcloud.nix

@@ -30,8 +30,4 @@
 		enable = true;
 		devices = [ "nas" ];
 	};
-
-	services.cron.systemCronJobs = [
-		"59 2 * * * root chmod -R a+r ${config.services.syncthing.folders.nextcloud-backup.path} && find ${config.services.syncthing.folders.nextcloud-backup.path} -type d -exec chmod a+x '{}' \\;"
-	];
 }

hosts/linode/nginx.nix

@@ -5,7 +5,7 @@ in
 {
 	security.acme = {
 		acceptTerms = true;
-		email = "greg.hellings@gmail.com";
+		defaults.email = "greg.hellings@gmail.com";
 	};
 
 	services.nginx = {
@@ -30,5 +30,6 @@ in
 	greg.proxies."thehellings.com" = {
 		target = "http://${homepage}/";
 		ssl = true;
+		genAliases = false;
 	};
 }

hosts/linode/postgres.nix

@@ -31,10 +31,10 @@ root root postgres
 
 	services.logrotate = {
 		enable = true;
-		paths = {
+		settings = {
 			postgres = {
 				enable = true;
-				path = "${config.services.postgresqlBackup.location}/*.gz";
+				files = "${config.services.postgresqlBackup.location}/*.gz";
 			};
 		};
 	};
@@ -44,8 +44,4 @@ root root postgres
 		enable = true;
 		devices = [ "nas" ];
 	};
-
-	services.cron.systemCronJobs = [
-		"59 2 * * * root chmod -R a+r ${config.services.postgresqlBackup.location} && find ${config.services.postgresqlBackup.location} -type d -exec chmod a+x '{}' \\;"
-	];
 }

hosts/linode/synapse.nix

@@ -74,26 +74,30 @@ return 200 '${builtins.toJSON client}';
 
 	services.matrix-synapse = {
 		enable = true;
-		database_name = "synapse";
-		database_user = "matrix-synapse";
 		# Identify ourselves as the root of our own domain
-		server_name = "thehellings.com";
+		settings = {
-		#registration_shared_secret = "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa";
+			database.args = {
-		# Bind a single listener to localhost only, disable SSL/TLS, and put
+				user = "matrix-synapse";
-		# it behind an nginx proxy
+				database = "synapse";
-		listeners = [ {
+			};
-			port = 8448;
+			server_name = "thehellings.com";
-			bind_address = "127.0.0.1";
+			#registration_shared_secret = "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa";
-			type = "http";  # Offload SSL/TLS to Nginx
+			# Bind a single listener to localhost only, disable SSL/TLS, and put
-			tls = false;
+			# it behind an nginx proxy
-			resources = [ {
+			listeners = [ {
-				names = [ "client" "federation" ];
+				port = 8448;
-				compress = false;  # Offload compressiong to Nginx
+				bind_addresses = ["127.0.0.1"];
+				type = "http";  # Offload SSL/TLS to Nginx
+				tls = false;
+				resources = [ {
+					names = [ "client" "federation" ];
+					compress = false;  # Offload compressiong to Nginx
+				} ];
 			} ];
-		} ];
+			app_service_config_files = [
-		app_service_config_files = [
+				"/etc/${fbRegistrationFile}"
-			"/etc/${fbRegistrationFile}"
+			];
-		];
+		};
 	};
 
 	# Open networking ports for the server

modules/default.nix

@@ -7,6 +7,7 @@
 		./linode.nix
 		./proxy.nix
 		./rpi4.nix
+		./tailscale.nix
 		./xprograms.nix
 	];
 }

modules/proxy.nix

@@ -16,7 +16,7 @@ proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection $connection_upgrade;
 '';
 		};
-		serverAliases = [ "${alias name}" ];
+		serverAliases = lib.mkIf dest.genAliases [ "${alias name}" ];
 	};
 
 in with lib; {
@@ -40,6 +40,12 @@ in with lib; {
 				{ name, config, options, ... }:
 				{
 					options = {
+						genAliases = mkOption {
+							type = types.bool;
+							description = "Whether to auto-generate short alias name";
+							default = true;
+						};
+
 						target = mkOption {
 							type = types.str;
 							description = ''The destination that is being proxied.'';

modules/tailscale.nix

@@ -0,0 +1,14 @@
+{ lib, config, ... }:
+
+let
+	cfg = config.greg.tailscale;
+in {
+	options = {
+		greg.tailscale.enable = lib.mkEnableOption "Enable Tailscale";
+	};
+
+	config = lib.mkIf cfg.enable {
+		services.tailscale.enable = true;
+		networking.firewall.checkReversePath = "loose";
+	};
+}