From 7a1094715373e92c30456b46c2d3a0c35266d141 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Sat, 18 Mar 2023 06:19:10 +0000 Subject: [PATCH] Compress Postgres logs --- hosts/linode/postgres.nix | 6 +++++- hosts/linode/synapse.nix | 23 ++++++++++++++++++++-- secrets/dendrite.age | 40 +++++++++++++++++++++++++++++++++++++++ secrets/secrets.nix | 3 +++ 4 files changed, 69 insertions(+), 3 deletions(-) create mode 100644 secrets/dendrite.age diff --git a/hosts/linode/postgres.nix b/hosts/linode/postgres.nix index baff49a..497edd1 100644 --- a/hosts/linode/postgres.nix +++ b/hosts/linode/postgres.nix @@ -1,4 +1,4 @@ -{ config, pkgs, ... }: +{ config, pkgs, lib, ... }: { services.postgresql = { @@ -53,6 +53,10 @@ root root postgres postgresLog = { enable = true; files = "/var/lib/postgresql/*/log/*.log"; + extraConfig = (lib.strings.concatStringsSep "\n" [ + "compress" + "compresscmd=${pkgs.xz}/bin/xz" + ]); }; }; }; diff --git a/hosts/linode/synapse.nix b/hosts/linode/synapse.nix index f52349b..17d97c8 100644 --- a/hosts/linode/synapse.nix +++ b/hosts/linode/synapse.nix @@ -68,8 +68,25 @@ return 200 '${builtins.toJSON client}'; }; }; + # Environment secrets + age.secrets.dendrite = { + file = ../../secrets/dendrite.age; + owner = "dendrite"; + }; + + users.users.dendrite = { + isSystemUser = true; + group = "dendrite"; + }; + users.groups.dendrite = {}; + + systemd.services.dendrite.serviceConfig = { + User = "dendrite"; + }; + services.dendrite = { enable = true; + environmentFile = "/run/agenix/dendrite"; httpPort = 8448; # Identify ourselves as the root of our own domain settings = { @@ -89,8 +106,10 @@ return 200 '${builtins.toJSON client}'; # Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem private_key = "/etc/dendrite.pem"; }; - client_api.registration_enabled = false; - #registration_shared_secret = "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa"; + client_api = { + egistration_enabled = false; + registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}"; + }; }; }; diff --git a/secrets/dendrite.age b/secrets/dendrite.age new file mode 100644 index 0000000..da13b0e --- /dev/null +++ b/secrets/dendrite.age @@ -0,0 +1,40 @@ +age-encryption.org/v1 +-> ssh-rsa KsR+0w +R2PsRmdINg0rmUBmA1LPw/BTmmqU6mRZ3ge0jCmBYXJ3mXK3KPtDDkEHD5mD0aeb +50pYQjOj4TGQS2sUH6VpPHbjLtJJ3Wp3ASOdJkJD/BLhcq8fk6Z4C0O+x2O2EySO +tEHefkn1WMFHatbx222h6M75p2XftJMb9+lvG3DcoucgqJp3SlvXCoy9Yvm/ByuS +aIzcThtmG8dLYP0QqQXUBYC3juf60KOyg9HdDGyTGESkQxv1NrOMkMQwXS/LfThb +WUhsPRUMHrsGs/22v06F5a3dhtoe5Q7YdX1gEVVyv/91rAo/8Y7iLhABKH3F0oBL +sfQysiEecEUM2NHV9+ULX6ILbkommnI/ApiPrg2eZPulllqI8+8/Me2tAkfOrH/g +GZglwOD+wBadbfhreq3bZbf5DTgs3Tnt+AgSOtoxPKFCHEP//J2olLcOD6SaLbyO +p8aDIlcwTSIH6SlX2srCGuGyCINkZu/LqeDMLJCJ/cKeGJ9WClhcoRrs0NyThfCQ +fnoL35i5JBkZoJqm1REx0nfZN88YuXBKxFItw7hagJpY/D1Ob0Z51oEhQaIDUyXx +1CzTOUoyFmtTdrXdfHnzHbqA6truG9nk2Sx7XeYgUtEuoaKL1yjSiLiVe91aYJ2u +IXglgHZxGvoCx5PHVK6x1EwvedyPGWMuViqB0Xi/ryg +-> ssh-rsa mMfKqA +F4lbJ/lcN/2aQ0q7jV3TIhGnH3UvEz5/CZY+kTDrq++If/ywfZ8KqW9y90u9bDUn +7E/vQ27p581byFLEeNVNddMgqLyup5Yb0Qf7mcJqJyYYpcBNbhiY3/0pwzlXjJ+1 +KaaNCnCKRwHa2zPbC6ntLiU5FXNNjolp9vcthlmsVTPDnCTYyi0ymlyi+eBpWMph +fb3Kf1Bnv2GDMEO1/02vXIn7mYbU41rd2sD7U1bGQKPI4zewQVWXOdDqDAJZ4TTO +mPnuG3bruhrQt5AHHsGIyiZMMk412ZHdl91RGQp8NU4X9Sqr4IsoJWQ/sXAuuArf +eHqFfh7dqKmkZdpSVWFPboTwAlFdSUD2fhSscD2RPvvnuUsWpm8SlJCrPtRylNex +DxZeS7Nd5+Z/rVpyeSXywMAZNtr9fjhabRULoPopkC97Rl/uu2VR/yS6gvyFYsgH +sqI7wB57vRewrqvGsGCSwH7ixTq7ZpH6J0Ir/46IxD/pJmLFKsqbyrRKQEFMqXEj +b3hOqWxdApGSpZiNYNAJq/BFG3wjtD3j1k56DaT2ndkKSP+tKKg9JCh3/50LJAwZ +kzNvw78NM19XVQVe6O4YZrK9f8IdEb6paepDhoJ5yTs1oPq9DoNaBu9qqksazi8J +Wvs8QQU/HE6WW+9IcOb3VX7bs22va+RP/veIIk6cTWyiqB3QNftwKe49PklIH1Gu +iCGSF8BLDmiRIUeNEFm9SwwxZseJWGFvwLc33DtAtroxF/5d4Da5ZAHkyeNVvWxI +9txHyZgXq+9CmzUpWzi2fuaQhzS/hnJJCllfmPUOUu9rfRX4C++/pjxWvKfXZaPC +sq0vypRGJA4CRFzpWxqsvGC/2/gOyi4bYFvsAY6uK112V1YFZC5NxwOitfciGHL1 +/Xqj3m8ktZ1wjbYLGWWnHG3Oocn8iqVkZoUiqLmhJq3ZNtvf4w1eXseZyCKr7ewf +jdtzb8c8LppQbOLSrMl5zrkUAdl54ABlR+9NviEPUWeJgCIYRK/IepxSjGM2qg7m +0fMbZlU8VR8EPRVIlHFXpRodBEJVbJmSRUkbkQcRHhmPXTcJtMaTZ3myB/YIhPA7 +en7He8NRd6EK81SrVuyGAV2FJvtyTpu3xC7gNw+Gk1VK2w1P4X44VMZyx8p854XH +Hjl/YvFwEfJ/BLGAFMoVCY5L7dVg1LpurDHVp6qyPfpnfL1AJrmyr6l1r1dc6c2L +8Dr2iPb2mMtPsc+iLKvUlQ294xLNOL8suSxtbEPPLShDha+O/gxc6ZIcI/PrqYjH +6yVUcFmmhboK3R0P7ixTNIdufoDDYElpJqmuBRCNN4RLCnkZmavJbcvDixN27+LC +GviSA/gv5SbQ52xhqLHQ+A +-> t0bR}S-grease Lu?rS2 T75`p ]j4 52B.Y%W+ +ciIU5BVUMwJ73pnPNhhFbksGL6pBg2RGuUBbEONYvbU +--- ZW5rizNGFWnLTd0dW9PaC8sVsYPZN7hDX6dXZRzRAQw +S.Hk" /m?Dm>U/-G/dqBB8v& h] Ns}q&CWUz*דG'1AD \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index e3af871..75c25a4 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -4,6 +4,7 @@ let systems = [ linode macca2 ]; user = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDLQRq55JKqLifX+31kEXyuoB8gfM+5thAlgR7XLPvvdu6g2a5cCWyozQ1I2oGbPRfJtzcJ5ifM7Ii2PuqAj3MdYFLHBEDOhIpBBWme9Ts2YB9HJ4NorBvB4zEfJd0Q7k2MmylyeBOwdwGz3bVqPRDcJbxWFMDHqr33FEs6SXdfyAQ5SvhWGARI84qz8zUUdOp6M4e3aIGO3cx1gA+YzYQ4FbUtL8+m1NFO8VoNFMZBMf5q0iF/SgEu5bmGWUCePia6DvfeBFQ2/y4Y7WmOj980WE+JmFTkIvmGruMYeGI8FuDQ2JIIIcehddy9bQbPF4VlGnTFsHqJYVRUUWc+vH1cPNMn01oB8s27ogf9e1lyhIN+cZOgp/jDt4eXcO4Wr04uwj7CI6m+d8iMQOa5Jv0hmNgqqiwOMVBlKeo0FCxlovzwvn/Lia9WZ74JqM6JwLCD8SZ0oFgiSIHOTHrQhr7iaCmj7X/0ey7VR8FnCrpeAJpG+ELTfWGshF1d9QR2zW7u4EsXTDLiuOmdJ+/KxwMvjMcWdlg2+Qch6SwulTQRxWaED2IWJo+YiAql8eaiVXu/eZJGLoiskGFZnONoLrzIT4pSjakPlrSpn/M/GkP1pDpaMkr24OhJsGpJNEU3F1ZcOMqy2iJzIxlPmU8Xg0I/OrnbJplpaXeRCqnmouJUJhWkaPzawaVyW7dtvprLWcpQtUgTRet18WLyOrLKlq1jwvNRMTPKUJ2IFJMpk2pNEP6bdiUxyMa4vrRIEU2p1zsYSUJpCRLtccZ/i/+yAqwnTA2L5TdAORi9nD2uCdM/Ljz52V3A14QapS6oqcoWx2soWKgnsbVXoG8DxmUTpll77Ze9t7Y5216SMInWuOu0vstP8ZcgFmWsiBgIYIuLA58abWHMxgD251phYidua6R3Gtkf8J/kYqTR1P6eJF1bt5efEg7FD2aL1QQZsYJo3CRNz7yVe1XqMdPbfe2mFXQVF9TDX5x6r9Ir3d0KiEmTlBdByz8nSyPJ8IQxC58NT4LNVQs3p2XH2Zcf6B4JOBSmV4NNBnLseFobsxniWjkWwZigED/D2iu3OXuuhmskCbw0hKy2rBcKffaSNMioVqYIiYNfKlMlSvAacQKqc/1HCpqgX8PwAcSgNSLy4K7/gIrTHmjY+g+CH7onzatWzkLo+0vsZRa/D/qwhhK2CU2FeU07mhnWxWuzqpJuqVaAwDTaEforK7nQUtAOFAZZP6qGhIoqsynYt4THb+QORb3QYfaP0PVgQwXfVU5Q8eUQFZ8A+siPtOASFjDumsIbseB5VzkF+UhvdseJwkX2+4pVFu8eHFDyvArYsHeGK6fBcQGJFQc2jSs6doIP9HD9IO2R ghelling@unknown38BAF87CD102"; + linode_user = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDUd5LQVl/spIfJ3mh/MERlCfSIHCh3jXnaNVnyHY2AVD2dFVgFX+Q+1adA64plXqXHEQVb3q2EMzVW14QAMP9VJspnODgpyMHwpxp6ZNUsZIH83RN8kauVHgW2LRDCZ4DLRzbqaeDm92rntapoUB74Vjto00AE3gWyGQp/v6BeAUhqE0J2p6T6xDgsuyJ+Tzm2YEUozFW8w8LSGDgaoTKzjq0WVkAo9rNaxGLr/ez8P3SUHgb2VSUrL1qrHE99KL8rravOjP0aQmGGWu/MOjgvh7icQuqYlBF6MHfxeSd7/FZApVNKzEXD9TKBg5IaCOjHH2GHnxthSC0mcjKmF2EVAXuWYDARqxmtIfV/9YdeECEFxzB6X+t6b3RYxA0/oa5Zt70WH2LILmc3U5EfiRf88x4WcsdmbcsKQ74/julgg7vYlTlndBxvl8Nd1IKd6ZD3nJBMMMKrDOYbME5r6x2VTzm/RQkpp+SHarCMXxjukhguYY3Iz9CTO2hdGaQ/41ftlOhpb3I1Gai9GymTPFDt9n3JCEVyQ1+a97ELVr+Ky1L3hMewE8nqZFIoXUB2RFMu2pD9GggDO2e6bXdN3SIHLL/8amoDK62iYgVEp1XBkzHJ7U6hhIYbkFji0KK8A7Cwg8+gOKdovycJIAWndHjaDcLmWDlBktqHIRQvLMTzE9f935faTcrSTpnrCLK/pR3f7ir7HGpD8lUug8m7DfxhH3am1Fz7uY9iNI1GLctexC7espXq/xEA/+j7JRVVKbpIubXcmJjNlKs6jOx849SpdWvLlnJpqo1PIjxE9ZDa7zlPSLMTKGTuY0ekKvvbuaOhcOBuYg1RfbdN1QIX5ba86U7giFMZb7wGh7Pbsy0PhFgO7ANgNZy81RKp45G8ozHLnXCj/qhstqjcEgUICDkT/CGnNkreu023kqOaix0nELBLwWBVM/5iWmKQZnpiBhHHDNJ3Q6DsCkIUdfOWZNCIRwGDPuV8uMOEHJIemg25Z282QqWUIfWzGOO1f0ylVmhTQooZIfjhyGXxKa6AV+/tAXQtkF5B1Z8rB5A3pYYLDmnY1E007sWpvm2L/HKV7cWUX7bkuS+qBXZyHxEn+cc6YvalJbDi5/bE5kFQudZFgKInwFiMLhX/8BpbgBUv+6MvvCn79o9qnoOnkI36A9bEOdQKpjwPdg9tkVWr0RotXfP62tIAQsxS05J7yxprC5Uitf+Bhp+Hph0tS/hyxTbN1h30vfdABouvQpcqbgUlp6psyTT17efeNbGcs9l4gkg4HOGpmF60alA1+PBZ1l7ba6bglp+CZoeA5qsCTmMxT5yLaWcEck/8WR3NHQqkER5ZyH1204Kci35kNon69y1/ greg@linode"; in { # Demo of how to create it @@ -16,4 +17,6 @@ in "drone.age".publicKeys = [ linode user ]; "3proxy.age".publicKeys = [ macca2 user ]; + + "dendrite.age".publicKeys = [ linode linode_user ]; }