From 21cb84ac7a519f4ab77e9d440e76e7aeeb579021 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Sat, 1 Aug 2026 14:38:01 -0500 Subject: [PATCH] Major update for linode and Nebula * Consolidate Linode into a single file * Convert gitea and matrix to using Nebula connections * Have Linode proxy to Nebula connections instead of Tailscale * Update Acme to use DNS-01 * Update Flake to pull from branch that supports ACME 5.x client --- flake.lock | 12 +- flake.nix | 3 +- hosts/unstable/linode/default.nix | 299 ++++++++++++++++++++++++++-- hosts/unstable/linode/git.nix | 148 -------------- hosts/unstable/linode/matrix.nix | 70 ------- hosts/unstable/linode/nextcloud.nix | 58 ------ hosts/unstable/linode/nginx.nix | 38 ---- hosts/unstable/linode/podman.nix | 13 -- hosts/unstable/linode/postgres.nix | 63 ------ manifests/gitea/ingress.yaml | 17 ++ manifests/matrix/ingress.yaml | 17 ++ secrets/acme.age | Bin 0 -> 2259 bytes secrets/secrets.nix | 3 + 13 files changed, 329 insertions(+), 412 deletions(-) delete mode 100644 hosts/unstable/linode/git.nix delete mode 100644 hosts/unstable/linode/matrix.nix delete mode 100644 hosts/unstable/linode/nextcloud.nix delete mode 100644 hosts/unstable/linode/nginx.nix delete mode 100644 hosts/unstable/linode/podman.nix delete mode 100644 hosts/unstable/linode/postgres.nix create mode 100644 secrets/acme.age diff --git a/flake.lock b/flake.lock index 39c3eb4..2601cbe 100644 --- a/flake.lock +++ b/flake.lock @@ -496,16 +496,16 @@ }, "nixunstable": { "locked": { - "lastModified": 1784356753, - "narHash": "sha256-12KrbMiWLcf8m7pCvAtZh1ZrgF85ZXDXvfR/fWTKy84=", - "owner": "nixos", + "lastModified": 1784700541, + "narHash": "sha256-LcCdjhqwjFVrFTNW6tHm3KNYRrD1TA6bYRea30yIIjw=", + "owner": "geri1701", "repo": "nixpkgs", - "rev": "61b7c44c4073f0b827768aff0049561b5110ea5a", + "rev": "3c598184d1f70c5d0beeea8b95d01ab0179e4ef7", "type": "github" }, "original": { - "owner": "nixos", - "ref": "nixos-unstable", + "owner": "geri1701", + "ref": "lego-v5-acme-spike", "repo": "nixpkgs", "type": "github" } diff --git a/flake.nix b/flake.nix index c38c04b..9eee756 100644 --- a/flake.nix +++ b/flake.nix @@ -28,7 +28,8 @@ nix-hardware.url = "github:nixos/nixos-hardware"; nixpkgs-lib.url = "github:nix-community/nixpkgs.lib"; nixvimunstable.url = "github:nix-community/nixvim/main"; - nixunstable.url = "github:nixos/nixpkgs/nixos-unstable"; + #nixunstable.url = "github:nixos/nixpkgs/nixos-unstable"; + nixunstable.url = "github:geri1701/nixpkgs/lego-v5-acme-spike"; nurpkgs.url = "github:nix-community/NUR"; vsext.url = "github:nix-community/nix-vscode-extensions"; wsl = { diff --git a/hosts/unstable/linode/default.nix b/hosts/unstable/linode/default.nix index b7534c5..e30ece5 100644 --- a/hosts/unstable/linode/default.nix +++ b/hosts/unstable/linode/default.nix @@ -1,31 +1,65 @@ { pkgs, + pkgs', lib, config, ... }: +let + homepage = "127.0.0.1:30080"; + nextcloudPort = 8080; + sshPort = 2222; +in { imports = [ - ./git.nix ./hardware-configuration.nix - ./podman.nix - ./matrix.nix - ./nextcloud.nix - ./nginx.nix - ./postgres.nix ]; + age.secrets = { + acme.file = ../../../secrets/acme.age; + nextcloudadmin = { + file = ../../../secrets/nextcloudadmin.age; + owner = "nextcloud"; + }; + }; + environment.systemPackages = with pkgs; [ bind graphviz nix-du pgloader + podman-compose + pkgs'.upgrade-pg-cluster ]; greg = { + backup.jobs = { + nextcloud-bkup = { + src = "/var/lib/nextcloud"; + dest = "nextcloud-backup"; + pre = lib.getExe ( + pkgs.writeShellApplication { + name = "nextcloud-backup-pre"; + runtimeInputs = [ config.services.nextcloud.occ ]; + text = "nextcloud-occ maintenance:mode --on"; + } + ); + post = lib.getExe ( + pkgs.writeShellApplication { + name = "nextcloud-backup-post"; + runtimeInputs = [ config.services.nextcloud.occ ]; + text = "nextcloud-occ maintenance:mode --off"; + } + ); + }; + greg-postgresql-backup = { + src = config.services.postgresqlBackup.location; + dest = "linode-postgres"; + }; + }; gitea-runner = { - enable = true; + enable = false; extraLabels = [ "vps:host" "blog:host" @@ -37,19 +71,22 @@ enable = true; isLighthouse = true; }; - proxies."immich.thehellings.com" = { - genAliases = false; - target = "http://localhost:${builtins.toString config.services.immich-public-proxy.port}"; - ssl = true; - }; tailscale.enable = true; }; networking = { - networkmanager.enable = lib.mkForce false; - hostName = "linode"; domain = "thehellings.com"; - nameservers = [ "100.88.91.27" ]; + firewall.allowedTCPPorts = [ + sshPort + 80 + 443 + ]; + hostName = "linode"; + nameservers = [ + "10.157.0.2" + "100.96.198.104" + ]; + networkmanager.enable = lib.mkForce false; }; programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [ @@ -60,10 +97,242 @@ " UserKnownHostsFile /dev/null" ]; + security.acme = { + acceptTerms = true; + defaults = { + dnsPropagationCheck = false; + dnsResolver = "92.123.95.3:53,92.123.94.3:53,92.123.94.2:53,92.123.95.4:53,92.123.95.2:53"; + email = "greg.hellings@gmail.com"; + extraLegoRunFlags = [ "--ipv4only" ]; # Force IPv4 only + #server = "https://acme-staging-v02.api.letsencrypt.org/directory"; + }; + certs."thehellings.com" = { + dnsProvider = "linode"; + environmentFile = config.age.secrets.acme.path; + extraDomainNames = [ + "*.thehellings.com" + ]; + }; + }; + services = { + + anubis = { + instances = { + git = { + enable = true; + settings = { + BIND = "/run/anubis/anubis-git/anubis.sock"; + COOKIE_DOMAIN = "thehellings.com"; + SERVE_ROBOTS_TXT = true; + SLOG_LEVEL = "DEBUG"; + TARGET = "http://git.k3s.nebula.thehellings.com"; + }; + }; + }; + }; + + haproxy = { + enable = true; + config = '' + global + nbthread 4 + maxconn 80 + log /dev/log local0 + + defaults + timeout connect 500s + timeout client 500s + timeout server 1h + + listen gitsshd + bind *:${toString sshPort} + timeout client 1h + mode tcp + server git-isaiah isaiah.nebula.thehellings.com:32222 + server git-jeremiah jeremiah.nebula.thehellings.com:32222 + server git-zeke zeke.nebula.thehellings.com:32222 + + frontend https + bind *:80 + bind *:443 ssl crt ${config.security.acme.certs."thehellings.com".directory}/full.pem + + http-request redirect scheme https unless { ssl_fc } + http-request add-header X-Forwarded-Proto https + + http-response replace-header ^Set-Cookie:\ (.*) Set-Cookie \1;\ Secure + + option http-server-close + option http-keep-alive + + #option httplog + #declare capture response len 80 + #http-response capture res.hdr(Location) id 0 + + use_backend git if { hdr(host) -i src.thehellings.com } + use_backend git if { req_ssl_sni -i src.thehellings.com } + use_backend next if { hdr(host) -i next.thehellings.com } + use_backend next if { req_ssl_sni -i next.thehellings.com } + use_backend matrix if { hdr(host) -i matrix.thehellings.com } + use_backend matrix if { req_ssl_sni -i matrix.thehellings.com } + use_backend web if { hdr(host) -i thehellings.com } + use_backend web if { req_ssl_sni -i thehellings.com } + + backend git + mode http + balance roundrobin + option accept-unsafe-violations-in-http-response + retries 3 + option forwardfor + http-request set-header Host git.k3s.nebula.thehellings.com + server git-isaiah isaiah.nebula.thehellings.com:80 + server git-jeremiah jeremiah.nebula.thehellings.com:80 + server git-zeke zeke.nebula.thehellings.com:80 + + backend matrix + mode http + balance roundrobin + option accept-unsafe-violations-in-http-response + retries 3 + option forwardfor + http-request set-header Host matrix.k3s.nebula.thehellings.com + server git-isaiah isaiah.nebula.thehellings.com:80 + server git-jeremiah jeremiah.nebula.thehellings.com:80 + server git-zeke zeke.nebula.thehellings.com:80 + + backend web + mode http + balance roundrobin + option accept-unsafe-violations-in-http-response + retries 3 + option forwardfor + server web-container ${homepage} + + backend next + log global + mode http + balance roundrobin + option accept-unsafe-violations-in-http-response + retries 3 + option forwardfor + #http-response replace-value Location http://localhost:${builtins.toString nextcloudPort}/(.*) https://next.thehellings.com/\2 + server nextcloud 127.0.0.1:${builtins.toString nextcloudPort} + ''; + }; + immich-public-proxy = { enable = true; immichUrl = "https://immich.shire-zebra.ts.net"; }; + + logrotate = { + enable = true; + settings = { + postgresBackup = { + enable = true; + files = "${config.services.postgresqlBackup.location}/*.gz"; + }; + postgresLog = { + enable = true; + files = "/var/lib/postgresql/*/log/*.log"; + compress = true; + compresscmd = "${pkgs.xz}/bin/xz"; + }; + }; + }; + + nextcloud = { + enable = true; + package = pkgs.nextcloud33; + appstoreEnable = true; + hostName = "localhost"; + https = false; + config = { + adminpassFile = config.age.secrets.nextcloudadmin.path; + adminuser = "greg"; + dbhost = "/run/postgresql"; + dbtype = "pgsql"; + }; + settings = { + default_phone_region = "US"; + overwriteprotocol = "http"; + trusted_domains = [ "next.thehellings.com" ]; + trusted_proxies = [ + "localhost" + "127.0.0.1" + ]; + }; + }; + + # Move to :8080 so that we can run haproxy as the primary HTTP service + nginx.virtualHosts."${config.services.nextcloud.hostName}".listen = [ + { + addr = "127.0.0.1"; + port = nextcloudPort; + } + ]; + + openssh.settings.PasswordAuthentication = false; + + postgresql = { + enable = true; + package = pkgs.postgresql_15; + checkConfig = true; + ensureDatabases = [ "nextcloud" ]; + #initialScript = pkgs.writeText "create-matrix-db.sql" '' + # CREATE ROLE "matrix-synapse" WITH LOGIN; + # CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C"; + # GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse"; + #''; # These are done manually in order to set the LC_COLLATE values properly + ensureUsers = [ + { + name = "nextcloud"; + ensureDBOwnership = true; + } + ]; + settings = { + log_connections = true; + log_statement = "all"; + logging_collector = true; + log_filename = "postgresql.log"; + }; + identMap = '' + root root postgres + ''; + }; + + postgresqlBackup = { + enable = true; + databases = [ "nextcloud" ]; + }; + }; + + systemd.services = { + haproxy = { + after = [ + "nextcloud.service" + "network-online.target" + ]; + wants = [ + "nextcloud.service" + "network-online.target" + ]; + }; + }; + + users.users.haproxy.extraGroups = [ config.security.acme.certs."thehellings.com".group ]; + + # Actually serve the content from here + virtualisation.oci-containers = { + backend = "podman"; + containers."homepage" = { + image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest"; + ports = [ "${homepage}:80" ]; + }; + }; + virtualisation.podman = { + enable = true; + dockerCompat = true; + dockerSocket.enable = true; }; } diff --git a/hosts/unstable/linode/git.nix b/hosts/unstable/linode/git.nix deleted file mode 100644 index c7f5b65..0000000 --- a/hosts/unstable/linode/git.nix +++ /dev/null @@ -1,148 +0,0 @@ -{ config, ... }: - -let - srcDomain = "src.thehellings.com"; - sshPort = 2222; -in -{ - greg.proxies."${srcDomain}" = { - target = "http://unix:${config.services.anubis.instances.git.settings.BIND}"; - ssl = true; - genAliases = false; - extraConfig = '' - #proxy_ssl_verify off; - #proxy_ssl_server_name on; - - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Http-Version $server_protocol; - proxy_set_header User-Agent $http_user_agent; - client_max_body_size 100000m; - - #proxy_set_header Host $host; - #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - #proxy_set_header X-Forwarded-Proto $scheme; - #proxy_set_header X-Forwarded-Ssl on; - - # Ultimate AI Block List v1.7 20250924 - # https://perishablepress.com/ultimate-ai-block-list/ - - if ($http_user_agent ~* "(openai\.com|\.ai|-ai|_ai|ai\.|ai-|ai_|ai=|AddSearchBot|Agentic|AgentQL|Agent\ 3|Agent\ API|AI\ Agent|AI\ Article\ Writer|AI\ Chat|AI\ Content\ Detector|AI\ Detection|AI\ Dungeon|AI\ Journalist|AI\ Legion)") { - return 444; - } - if ($http_user_agent ~* "(AI\ RAG|AI\ Search|AI\ SEO\ Crawler|AI\ Training|AI\ Web|AI\ Writer|AI2|AIBot|aiHitBot|AIMatrix|AISearch|AITraining|Alexa|Alice\ Yandex|AliGenie|AliyunSec|Alpha\ AI|AlphaAI|Amazon|Amelia)") { - return 444; - } - if ($http_user_agent ~* "(AndersPinkBot|AndiBot|Anonymous\ AI|Anthropic|AnyPicker|Anyword|Applebot|Aria\ AI|Aria\ Browse|Articoolo|Ask\ AI|AutoGen|AutoGLM|Automated\ Writer|AutoML|Autonomous\ RAG|AwarioRssBot|AwarioSmartBot|AWS\ Trainium|Azure)") { - return 444; - } - if ($http_user_agent ~* "(BabyAGI|BabyCatAGI|BardBot|Basic\ RAG|Bedrock|Big\ Sur|Bigsur|Botsonic|Brightbot|Browser\ MCP\ Agent|Browser\ Use|Bytebot|ByteDance|Bytespider|CarynAI|CatBoost|CC-Crawler|CCBot|Chai|Character)") { - return 444; - } - if ($http_user_agent ~* "(Charstar\ AI|Chatbot|ChatGLM|Chatsonic|ChatUser|Chinchilla|Claude|ClearScope|Clearview|Cognitive\ AI|Cohere|Common\ Crawl|CommonCrawl|Content\ Harmony|Content\ King|Content\ Optimizer|Content\ Samurai|ContentAtScale|ContentBot|Contentedge)") { - return 444; - } - if ($http_user_agent ~* "(ContentShake|Conversion\ AI|Copilot|CopyAI|Copymatic|Copyscape|CoreWeave|Corrective\ RAG|Cotoyogi|CRAB|Crawl4AI|CrawlQ\ AI|Crawlspace|Crew\ AI|CrewAI|Crushon\ AI|DALL-E|DarkBard|DataFor|DataProvider)") { - return 444; - } - if ($http_user_agent ~* "(Datenbank\ Crawler|DeepAI|Deep\ AI|DeepL|DeepMind|Deep\ Research|DeepResearch|DeepSeek|Devin|Diffbot|Doubao\ AI|DuckAssistBot|DuckDuckGo\ Chat|DuckDuckGo-Enhanced|Echobot|Echobox|Elixir|FacebookBot|FacebookExternalHit|Factset)") { - return 444; - } - if ($http_user_agent ~* "(Falcon|FIRE-1|Firebase|Firecrawl|Flux|Flyriver|Frase\ AI|FriendlyCrawler|Gato|Gemini|Gemma|Gen\ AI|GenAI|Generative|Genspark|Gentoo-chat|Ghostwriter|GigaChat|GLM|GodMode)") { - return 444; - } - if ($http_user_agent ~* "(Goose|GPT|Grammarly|Grendizer|Grok|GT\ Bot|GTBot|GTP|Hemingway\ Editor|Hetzner|Hugging|Hunyuan|Hybrid\ Search\ RAG|Hypotenuse\ AI|iAsk|ICC-Crawler|ImageGen|ImagesiftBot|img2dataset|imgproxy)") { - return 444; - } - if ($http_user_agent ~* "(INK\ Editor|INKforall|Instructor|IntelliSeek|Inferkit|ISSCyberRiskCrawler|Janitor\ AI|Jasper|Jenni\ AI|Julius\ AI|Kafkai|Kaggle|Kangaroo|Keyword\ Density\ AI|Kimi|Knowledge|KomoBot|Kruti|LangChain|Le\ Chat)") { - return 444; - } - if ($http_user_agent ~* "(Lensa|Lightpanda|LinerBot|LLaMA|LLM|Local\ RAG\ Agent|Lovable|Magistral|magpie-crawler|Manus|MarketMuse|Meltwater|Meta-AI|Meta-External|Meta-Webindexer|Meta\ AI|MetaAI|MetaTagBot|Middleware|Midjourney)") { - return 444; - } - if ($http_user_agent ~* "(Mini\ AGI|MiniMax|Mintlify|Mistral|Mixtral|model-training|Monica|Narrative|NeevaBot|netEstate|Neural\ Text|NeuralSEO|NinjaAI|NodeZero|Nova\ Act|NovaAct|OAI-SearchBot|OAI\ SearchBot|OASIS|Olivia)") { - return 444; - } - if ($http_user_agent ~* "(Omgili|Open\ AI|Open\ Interpreter|OpenAGI|OpenAI|OpenBot|OpenPi|OpenRouter|OpenText\ AI|Operator|Outwrite|Page\ Analyzer\ AI|PanguBot|Panscient|Paperlibot|Paraphraser\.io|peer39_crawler|Perflexity|Perplexity|Petal)") { - return 444; - } - if ($http_user_agent ~* "(Phind|PiplBot|PoeBot|PoeSearchBot|ProWritingAid|Proximic|Puppeteer|Python\ AI|Qualified|Quark|QuillBot|Qopywriter|Qwen|RAG\ Agent|RAG\ Azure\ AI|RAG\ Chatbot|RAG\ Database|RAG\ IS|RAG\ Pipeline|RAG\ Search)") { - return 444; - } - if ($http_user_agent ~* "(RAG\ with|RAG-|RAG_|Raptor|React\ Agent|Redis\ AI\ RAG|RobotSpider|Rytr|SaplingAI|SBIntuitionsBot|Scala|Scalenut|Scrap|ScriptBook|Seekr|SEObot|SEO\ Content\ Machine|SEO\ Robot|SemrushBot|Sentibot)") { - return 444; - } - if ($http_user_agent ~* "(Serper|ShapBot|Sidetrade|Simplified\ AI|Sitefinity|Skydancer|SlickWrite|SmartBot|Sonic|Sora|Spider/2|SpiderCreator|Spin\ Rewrite|Spinbot|Stability|StableDiffusionBot|Sudowrite|SummalyBot|Super\ Agent|Superagent)") { - return 444; - } - if ($http_user_agent ~* "(SuperAGI|Surfer\ AI|TerraCotta|Text\ Blaze|TextCortex|Thinkbot|Thordata|TikTokSpider|Timpibot|Tinybird|Together\ AI|Traefik|TurnitinBot|uAgents|VelenPublicWebCrawler|Venus\ Chub\ AI|Vidnami\ AI|Vision\ RAG|WebSurfer|WebText)") { - return 444; - } - if ($http_user_agent ~* "(Webzio|WeChat|Whisper|WordAI|Wordtune|WPBot|Writecream|WriterZen|Writescope|Writesonic|xAI|xBot|YaML|YandexAdditional|YouBot|Zendesk|Zero|Zhipu|Zhuque\ AI|Zimm)") { - return 444; - } - ''; - }; - #greg.proxies."registry.thehellings.com" = { - #target = "https://gitea.shire-zebra.ts.net:5000"; - #ssl = true; - #genAliases = false; - #extraConfig = '' - #proxy_set_header X-Forwarded-Proto https; - #proxy_set_header X-Forwarded-Ssl on; - #client_max_body_size 25000m; - #''; - #}; - - networking.firewall.allowedTCPPorts = [ sshPort ]; - - services = { - anubis = { - instances = { - git = { - enable = true; - settings = { - BIND = "/run/anubis/anubis-git/anubis.sock"; - COOKIE_DOMAIN = "thehellings.com"; - SERVE_ROBOTS_TXT = true; - TARGET = "https://gitea.shire-zebra.ts.net/"; - }; - }; - }; - }; - - haproxy = { - enable = true; - config = '' - global - daemon - maxconn 20 - - defaults - timeout connect 500s - timeout client 500s - timeout server 1h - - listen gitsshd - bind *:${toString sshPort} - timeout client 1h - mode tcp - server git-isaiah isaiah.shire-zebra.ts.net:32222 - server git-jeremiah jeremiah.shire-zebra.ts.net:32222 - server git-zeke zeke.shire-zebra.ts.net:32222 - ''; - }; - }; - - systemd.services = { - haproxy = { - after = [ - "network-online.target" - ]; - wants = [ - "network-online.target" - ]; - }; - }; - - users.users.nginx.extraGroups = [ config.users.groups.anubis.name ]; -} diff --git a/hosts/unstable/linode/matrix.nix b/hosts/unstable/linode/matrix.nix deleted file mode 100644 index f7b603c..0000000 --- a/hosts/unstable/linode/matrix.nix +++ /dev/null @@ -1,70 +0,0 @@ -# Registration of new users is disabled for the public, but I can create -# them by the following commands: -# nix run nixpkgs.matrix-synapse -# register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448 -{ config, ... }: -let - domain = "${config.networking.domain}"; - fqdn = "matrix.${domain}"; -in -{ - greg.proxies."${fqdn}" = { - extraConfig = '' - error_log /var/log/nginx/debug.log debug; - proxy_ssl_verify off; - proxy_ssl_server_name on; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Forwarded-Ssl on; - ''; - genAliases = false; - ssl = true; - target = "https://matrix.shire-zebra.ts.net"; - }; - services.nginx = { - virtualHosts = { - # Server the '.well-known' files to find the Matrix API server - "${domain}" = { - enableACME = true; - forceSSL = true; - # This is needed so that servers contacting hellings.com can find - # the actual application server at matrix.thehellings.com - locations."= /.well-known/matrix/server".extraConfig = - let - server = { - "m.server" = "${fqdn}:443"; - }; - in - '' - add_header Content-Type application/json; - return 200 '${builtins.toJSON server}'; - ''; - - locations."= /.well-known/matrix/client".extraConfig = - let - client = { - "m.homeserver" = { - "base_url" = "https://${fqdn}"; - }; - "m.identity_server" = { - "base_url" = "https://vector.im"; - }; - }; - in - '' - add_header Content-Type application/json; - add_header Access-Control-Allow-Origin *; - return 200 '${builtins.toJSON client}'; - ''; - }; - }; - }; - - # Open networking ports for the server - networking.firewall = { - enable = true; - allowedTCPPorts = [ - 80 - 443 - ]; - }; -} diff --git a/hosts/unstable/linode/nextcloud.nix b/hosts/unstable/linode/nextcloud.nix deleted file mode 100644 index c5b7bf5..0000000 --- a/hosts/unstable/linode/nextcloud.nix +++ /dev/null @@ -1,58 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: - -{ - age.secrets.nextcloudadmin = { - file = ../../../secrets/nextcloudadmin.age; - owner = "nextcloud"; - }; - - services.nextcloud = { - enable = true; - package = pkgs.nextcloud33; - appstoreEnable = true; - hostName = "next.${config.networking.domain}"; - https = true; - config = { - adminpassFile = config.age.secrets.nextcloudadmin.path; - adminuser = "greg"; - dbhost = "/run/postgresql"; - dbtype = "pgsql"; - }; - settings = { - default_phone_region = "US"; - overwriteprotocol = "https"; - }; - }; - - services.nginx.virtualHosts."next.thehellings.com" = { - forceSSL = true; - enableACME = true; - }; - - # Otherwise nginx errors looking for the nextcloud sock file - systemd.services.nginx.after = [ "nextcloud.service" ]; - - greg.backup.jobs.nextcloud-bkup = { - src = "/var/lib/nextcloud"; - dest = "nextcloud-backup"; - pre = lib.getExe ( - pkgs.writeShellApplication { - name = "nextcloud-backup-pre"; - runtimeInputs = [ config.services.nextcloud.occ ]; - text = "nextcloud-occ maintenance:mode --on"; - } - ); - post = lib.getExe ( - pkgs.writeShellApplication { - name = "nextcloud-backup-post"; - runtimeInputs = [ config.services.nextcloud.occ ]; - text = "nextcloud-occ maintenance:mode --off"; - } - ); - }; -} diff --git a/hosts/unstable/linode/nginx.nix b/hosts/unstable/linode/nginx.nix deleted file mode 100644 index 73a94de..0000000 --- a/hosts/unstable/linode/nginx.nix +++ /dev/null @@ -1,38 +0,0 @@ -{ ... }: -let - homepage = "127.0.0.1:30080"; -in -{ - security.acme = { - acceptTerms = true; - defaults.email = "greg.hellings@gmail.com"; - }; - - services.nginx = { - enable = true; - - clientMaxBodySize = "25000m"; # To help with uploading container images - # If there are recommended settings, let's use them! - recommendedGzipSettings = true; - recommendedOptimisation = true; - recommendedProxySettings = true; - recommendedTlsSettings = true; - }; - - # Actually serve the content from here - virtualisation.podman.enable = true; - virtualisation.oci-containers = { - backend = "podman"; - containers."homepage" = { - image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest"; - ports = [ "${homepage}:80" ]; - }; - }; - greg.proxies = { - "thehellings.com" = { - target = "http://${homepage}/"; - ssl = true; - genAliases = false; - }; - }; -} diff --git a/hosts/unstable/linode/podman.nix b/hosts/unstable/linode/podman.nix deleted file mode 100644 index ef0b20f..0000000 --- a/hosts/unstable/linode/podman.nix +++ /dev/null @@ -1,13 +0,0 @@ -{ pkgs, ... }: - -{ - environment.systemPackages = with pkgs; [ - podman-compose - ]; - - virtualisation.podman = { - enable = true; - dockerCompat = true; - dockerSocket.enable = true; - }; -} diff --git a/hosts/unstable/linode/postgres.nix b/hosts/unstable/linode/postgres.nix deleted file mode 100644 index 10c39c0..0000000 --- a/hosts/unstable/linode/postgres.nix +++ /dev/null @@ -1,63 +0,0 @@ -{ - config, - pkgs, - pkgs', - ... -}: - -{ - environment.systemPackages = [ pkgs'.upgrade-pg-cluster ]; - - services.postgresql = { - enable = true; - package = pkgs.postgresql_15; - checkConfig = true; - ensureDatabases = [ "nextcloud" ]; - #initialScript = pkgs.writeText "create-matrix-db.sql" '' - # CREATE ROLE "matrix-synapse" WITH LOGIN; - # CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C"; - # GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse"; - #''; # These are done manually in order to set the LC_COLLATE values properly - ensureUsers = [ - { - name = "nextcloud"; - ensureDBOwnership = true; - } - ]; - settings = { - log_connections = true; - log_statement = "all"; - logging_collector = true; - log_filename = "postgresql.log"; - }; - identMap = '' - root root postgres - ''; - }; - - services.postgresqlBackup = { - enable = true; - databases = [ "nextcloud" ]; - }; - - services.logrotate = { - enable = true; - settings = { - postgresBackup = { - enable = true; - files = "${config.services.postgresqlBackup.location}/*.gz"; - }; - postgresLog = { - enable = true; - files = "/var/lib/postgresql/*/log/*.log"; - compress = true; - compresscmd = "${pkgs.xz}/bin/xz"; - }; - }; - }; - - greg.backup.jobs.greg-postgresql-backup = { - src = config.services.postgresqlBackup.location; - dest = "linode-postgres"; - }; -} diff --git a/manifests/gitea/ingress.yaml b/manifests/gitea/ingress.yaml index 9ce31de..7297e12 100644 --- a/manifests/gitea/ingress.yaml +++ b/manifests/gitea/ingress.yaml @@ -12,3 +12,20 @@ spec: tls: - hosts: - gitea +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: gitea-direct +spec: + rules: + - host: git.k3s.nebula.thehellings.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: gitea-release-http + port: + name: http diff --git a/manifests/matrix/ingress.yaml b/manifests/matrix/ingress.yaml index 9c6f684..9ee86c0 100644 --- a/manifests/matrix/ingress.yaml +++ b/manifests/matrix/ingress.yaml @@ -13,3 +13,20 @@ spec: tls: - hosts: - matrix +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: matrix-direct +spec: + rules: + - host: matrix.k3s.nebula.thehellings.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: dendrite + port: + number: 8008 diff --git a/secrets/acme.age b/secrets/acme.age new file mode 100644 index 0000000000000000000000000000000000000000..23f50abeb592ca90342e199bc2db60f76a37d92d GIT binary patch literal 2259 zcmZYA+t1{59R_d=xElvAHn53Nycj`HoV-k@)6TStlD0FQX=mE$`7kDI+D=c?PEXV6 zi7T_NXuv2N5)6r4ZB}D8x3e9?A*w)YNCaaSKo&FkmN9I`YKI^{CX`O~R-cY$x<4^OrMgfY%8~dsOd`X6PWM zVeL_oZg5MbBDVoaO)an@Tk(akEQfQ8rq>|Eg5BKF0eM8VA{eY#NHNz16(_oL`;xCPB)h8uRb%w!-7vL$AD!J;~{!q`Jk3{`+kD8LzEF` zsD}~p+LY#V3UKD(bU<^YsKMLO$Z(QjHE}=`od7L=tR`A#Ov84M8+P$>2Tp`w;IH^N z+;~7Njv8idBy!gn0|&LuV#7IZo7hj3Q#4V9|It)`p_5$6A2^H7A+v57ek%UWXSgcIXOA(bvR^qDPO+3p{hMpg? zc%$XkbiLUg)Yz~K*I2t>8HU1by3xX~qcs$Gkhfw~e%bS?1!oNzf&-?Wh|U{=Z}~lk zUKSF724!Yba||h_f-@$tIk@Ckgi#=lN}9W>gxEv9O;&T4;M=M+#JI|({TLY`R`v>>+~+cjy)ro%+Y!34BglbF#`quzC=`HC}qPV+;~LRoaabcsZq%=@&5rPF1N zBZstnG3`$IcII$&FY{}$?}zewmS=1-616cVvoaXT*nk{K4dkgjQ0XnJ8NsxJ$3m?y zuvLG|HxdkF{YE0}T4lK=v?Su~W?XmGA&u>#>!pq1)|7B7Y--m8e6ZEu1O z!)^wGQ@EnePaO{&gDxyiO{FLgYQc&t8os?0Bg)Q5ml>f&x~9Y2!n^q#TiYD`rK-80I$9oz#ATj2WvF1f&ew z)tXJ?@xrFcfT?IAoF96*h{ziOZabZt##XQiLP15b=WTGFvuI*CU{YDib8CqELsuYT zy0?GbqjEmTw(Ck+@kmFL;#mtcI*s-F+D=f zkw2C)wJ4YS|K6+?*8#Zmpnj)-f~W=)mKs5=p<$L`rbT3sg+Rg#6WP{ddJrh6T$e14 zMV<@e;}GF{`X0oa_bXcIr%;~ew?`d#PQ$1`uz9mpIy4=%<*TWw~c%I zPq|6uXj>CeCPHR=X~ zzc|7^`p5IVpT2!Lwtjv3gZf4E)N>E{&HtXcaO~C#(j%RpFdzKt`7gix-%ot#=8sdi z1E0C$+2FA|E{iw7Gq1e$#sE!U{oCc&&wk_B!^+(cK+MkI9O>Y-B4gPZM s;`y5|9>1{nhcC{~KYIQ2_Rjmh|JDmv&OUeZgD&vmQy;nOqkq5ge;u+7y#N3J literal 0 HcmV?d00001 diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 7a319b3..87de9f7 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -62,6 +62,9 @@ in # Demo of how to create it "matrix.age".publicKeys = everyone; "tailscale.age".publicKeys = everyone; + + "acme.age".publicKeys = everyone; + # At the point where you want to use it, put # age.secrets.matrix.file = ../../secrets/matrix.age; # Then you can reference the file at /run/agenix/matrix