Merge remote-tracking branch 'origin/main'

hosts/2maccabees/dnsmasq.nix

@@ -2,16 +2,21 @@
 
 let
 	extraHosts = builtins.concatStringsSep "\n" [
+		# Local hosts
 		"10.42.0.1 switch"
 		"10.42.1.1 router"
 		"10.42.1.2 2maccabees 2maccabees.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan"
-		"100.99.244.92 dns.me.ts 2maccabees.me.ts smart.me.ts"
 		"10.42.1.3 printer"
 		"10.42.1.4 chronicles nas"
-		"100.119.228.115 nas.me.ts"
 		"10.42.1.12 tv"
-		"100.90.74.19 jude.me.ts"
 
+		# Tailscale hosts
+		"100.90.74.19 jude.me.ts"
+		"100.99.244.92 dns.me.ts 2maccabees.me.ts smart.me.ts"
+		"100.119.228.115 chronicles.me.ts nas.me.ts"
+		"100.115.57.8 linode.me.ts"
+
+		# Dev hosts
 		"10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan"
 	];
 

hosts/iso/default.nix

@@ -2,7 +2,7 @@
 {
 
 	imports = [
-		"${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-base.nix"
+		"${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix"
 	];
 
 	networking.networkmanager.enable = lib.mkForce false;

hosts/jude/boot.nix

@@ -4,6 +4,12 @@
 	# Use the systemd-boot EFI boot loader.
 	#boot.loader.systemd-boot.enable = true;
 	boot.loader.grub.device = "/dev/nvme0n1";
+	boot.loader.grub.useOSProber = true;
+	boot.loader.grub.extraEntries = ''
+		menuentry "Windows" {
+		  chainloader (hd0,2)+1
+		}
+	'';
 	boot.loader.efi.canTouchEfiVariables = true;
 	networking.interfaces.enp4s0.useDHCP = true;
 }

hosts/jude/default.nix

@@ -9,5 +9,6 @@
 		./virt.nix
 	];
 	networking.hostName = "jude";
+	greg.tailscale.enable = true;
 	greg.gnome.enable= true;
 }

hosts/linode/default.nix

@@ -10,6 +10,7 @@
 	];
 	greg.home = false;
 	greg.linode.enable = true;
+	greg.tailscale.enable = true;
 	networking.hostName = "linode";
 	networking.domain = "thehellings.com";
 }

hosts/linode/nextcloud.nix

@@ -30,8 +30,4 @@
 		enable = true;
 		devices = [ "nas" ];
 	};
-
-	services.cron.systemCronJobs = [
-		"59 2 * * * root chmod -R a+r ${config.services.syncthing.folders.nextcloud-backup.path} && find ${config.services.syncthing.folders.nextcloud-backup.path} -type d -exec chmod a+x '{}' \\;"
-	];
 }

hosts/linode/nginx.nix

@@ -5,7 +5,7 @@ in
 {
 	security.acme = {
 		acceptTerms = true;
-		email = "greg.hellings@gmail.com";
+		defaults.email = "greg.hellings@gmail.com";
 	};
 
 	services.nginx = {
@@ -30,5 +30,6 @@ in
 	greg.proxies."thehellings.com" = {
 		target = "http://${homepage}/";
 		ssl = true;
+		genAliases = false;
 	};
 }

hosts/linode/postgres.nix

@@ -27,14 +27,20 @@ root root postgres
 '';
 	};
 
-	services.postgresqlBackup.enable = true;
+	services.postgresqlBackup = {
+		enable = true;
+		databases = [
+			"nextcloud"
+			"matrix-synapse"
+		];
+	};
 
 	services.logrotate = {
 		enable = true;
-		paths = {
+		settings = {
 			postgres = {
 				enable = true;
-				path = "${config.services.postgresqlBackup.location}/*.gz";
+				files = "${config.services.postgresqlBackup.location}/*.gz";
 			};
 		};
 	};
@@ -44,8 +50,4 @@ root root postgres
 		enable = true;
 		devices = [ "nas" ];
 	};
-
-	services.cron.systemCronJobs = [
-		"59 2 * * * root chmod -R a+r ${config.services.postgresqlBackup.location} && find ${config.services.postgresqlBackup.location} -type d -exec chmod a+x '{}' \\;"
-	];
 }

hosts/linode/synapse.nix

@@ -74,26 +74,30 @@ return 200 '${builtins.toJSON client}';
 
 	services.matrix-synapse = {
 		enable = true;
-		database_name = "synapse";
-		database_user = "matrix-synapse";
 		# Identify ourselves as the root of our own domain
-		server_name = "thehellings.com";
-		#registration_shared_secret = "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa";
-		# Bind a single listener to localhost only, disable SSL/TLS, and put
-		# it behind an nginx proxy
-		listeners = [ {
-			port = 8448;
-			bind_address = "127.0.0.1";
-			type = "http";  # Offload SSL/TLS to Nginx
-			tls = false;
-			resources = [ {
-				names = [ "client" "federation" ];
-				compress = false;  # Offload compressiong to Nginx
+		settings = {
+			database.args = {
+				user = "matrix-synapse";
+				database = "synapse";
+			};
+			server_name = "thehellings.com";
+			#registration_shared_secret = "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa";
+			# Bind a single listener to localhost only, disable SSL/TLS, and put
+			# it behind an nginx proxy
+			listeners = [ {
+				port = 8448;
+				bind_addresses = ["127.0.0.1"];
+				type = "http";  # Offload SSL/TLS to Nginx
+				tls = false;
+				resources = [ {
+					names = [ "client" "federation" ];
+					compress = false;  # Offload compressiong to Nginx
+				} ];
 			} ];
-		} ];
-		app_service_config_files = [
-			"/etc/${fbRegistrationFile}"
-		];
+			app_service_config_files = [
+				"/etc/${fbRegistrationFile}"
+			];
+		};
 	};
 
 	# Open networking ports for the server