From b536a7e3ef828fa597ce1e9a4a2a19e7c2efd9e4 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 27 Feb 2024 14:40:35 -0600 Subject: [PATCH] Move Dendrite to Isaiah --- hosts/linode/postgres.nix | 7 +-- hosts/linode/synapse.nix | 60 ---------------------- hosts/myself/default.nix | 3 +- hosts/myself/matrix.nix | 101 ++++++++++++++++++++++++++++++++++++++ modules/nixos/db.nix | 62 +++++++++++++++++++++++ modules/nixos/default.nix | 1 + secrets/3proxy.age | 2 +- secrets/secrets.nix | 2 - 8 files changed, 168 insertions(+), 70 deletions(-) create mode 100644 hosts/myself/matrix.nix create mode 100644 modules/nixos/db.nix diff --git a/hosts/linode/postgres.nix b/hosts/linode/postgres.nix index 4d53947..447ad1c 100644 --- a/hosts/linode/postgres.nix +++ b/hosts/linode/postgres.nix @@ -5,7 +5,6 @@ enable = true; checkConfig = true; ensureDatabases = [ - "dendrite" "nextcloud" ]; #initialScript = pkgs.writeText "create-matrix-db.sql" '' @@ -16,10 +15,7 @@ ensureUsers = [ { name = "nextcloud"; ensureDBOwnership = true; - } { - name = "dendrite"; - ensureDBOwnership = true; - } ]; + } ]; settings = { log_connections = true; log_statement = "all"; @@ -34,7 +30,6 @@ root root postgres services.postgresqlBackup = { enable = true; databases = [ - "dendrite" "nextcloud" ]; }; diff --git a/hosts/linode/synapse.nix b/hosts/linode/synapse.nix index b10e16b..380ab11 100644 --- a/hosts/linode/synapse.nix +++ b/hosts/linode/synapse.nix @@ -69,66 +69,6 @@ return 200 '${builtins.toJSON client}'; }; }; - # Environment secrets - age.secrets.dendrite = { - file = ../../secrets/dendrite.age; - owner = "dendrite"; - }; - - users.users.dendrite = { - isSystemUser = true; - group = "dendrite"; - }; - users.groups.dendrite = {}; - - systemd.services.dendrite.serviceConfig = { - User = "dendrite"; - }; - - services.dendrite = { - enable = true; - environmentFile = "/run/agenix/dendrite"; - httpPort = 8448; - # Identify ourselves as the root of our own domain - settings = ( - (builtins.listToAttrs ( - (map (x: { name = x; value = { database.connection_string = conn; }; }) [ - "app_service_api" - "federation_api" - "key_server" - "media_api" - "mscs" - "relay_api" - "room_server" - "sync_api" - ]) - ) ) // - { - user_api.account_database.connection_string = conn; - user_api.device_database.connection_string = conn; - global = { - database = { - connection_string = conn; - max_open_conns = 25; - max_idle_conns = 5; - conn_max_lifetime = -1; - }; - server_name = "thehellings.com"; - trusted_third_party_id_servers = [ - "matrix.org" - "vector.im" - "jupiterbroadcasting.com" - ]; - # Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem - private_key = "/etc/dendrite.pem"; - }; - client_api = { - registration_enabled = false; - registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}"; - }; - }); - }; - # Open networking ports for the server networking.firewall = { enable = true; diff --git a/hosts/myself/default.nix b/hosts/myself/default.nix index 7d1d9f2..fabcf08 100644 --- a/hosts/myself/default.nix +++ b/hosts/myself/default.nix @@ -1,8 +1,9 @@ { config, pkgs, lib, ... }: { - imports = [ + imports = [ ./hardware-configuration.nix ./git.nix + ./matrix.nix ]; environment.systemPackages = with pkgs; [ diff --git a/hosts/myself/matrix.nix b/hosts/myself/matrix.nix new file mode 100644 index 0000000..f636219 --- /dev/null +++ b/hosts/myself/matrix.nix @@ -0,0 +1,101 @@ +{ config, pkgs, inputs, lib, ... }: +let + domain = "thehellings.com"; + fqdn = "matrix.${domain}"; + conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql"; +in +{ + containers.matrix = { + autoStart = true; + bindMounts."/etc/ssh".hostPath = "/etc/ssh"; + config = { pkgs, config, ... }: { + imports = [ + inputs.agenix.nixosModules.default + inputs.self.modules.nixosModule + ]; + + nixpkgs.overlays = inputs.self.overlays.all; + + networking = { + firewall = { + enable = true; + allowedTCPPorts = [ config.services.dendrite.httpPort ]; + }; + useHostResolvConf = lib.mkForce false; + }; + + # Environment secrets + age = { + identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + secrets.dendrite = { + file = ../../secrets/dendrite.age; + owner = "dendrite"; + }; + }; + + users.users.dendrite = { + isSystemUser = true; + group = "dendrite"; + }; + users.groups.dendrite = {}; + + systemd.services.dendrite.serviceConfig = { + User = "dendrite"; + }; + + greg = { + databases.dendrite = {}; + tailscale.enable = true; + }; + + services.dendrite = { + enable = true; + environmentFile = config.age.secrets.dendrite.path; + httpPort = 8448; + # Identify ourselves as the root of our own domain + settings = ( + (builtins.listToAttrs ( + (map (x: { name = x; value = { database.connection_string = conn; }; }) [ + "app_service_api" + "federation_api" + "key_server" + "media_api" + "mscs" + "relay_api" + "room_server" + "sync_api" + ]) + ) ) // + { + user_api.account_database.connection_string = conn; + user_api.device_database.connection_string = conn; + global = { + database = { + connection_string = conn; + max_open_conns = 25; + max_idle_conns = 5; + conn_max_lifetime = -1; + }; + server_name = "thehellings.com"; + trusted_third_party_id_servers = [ + "matrix.org" + "vector.im" + "jupiterbroadcasting.com" + ]; + # Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem + private_key = "/etc/dendrite.pem"; + }; + client_api = { + registration_enabled = false; + registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}"; + }; + }); + }; + + systemd.services.dendrite = { + after = [ "postgresql.service" ]; + requires = [ "postgresql.service" ]; + }; + }; + }; +} diff --git a/modules/nixos/db.nix b/modules/nixos/db.nix new file mode 100644 index 0000000..50c09e2 --- /dev/null +++ b/modules/nixos/db.nix @@ -0,0 +1,62 @@ +{ config, lib, pkgs, ... }: + +let + cfg = config.greg.databases; + dbs = (lib.attrNames cfg); +in { + options.greg.databases = lib.mkOption { + default = {}; + type = with lib.types; attrsOf ( submodule ( + { name, config, options, ... }: { + # Options reserved for future expansion + options = {}; + } + )); + }; + + config = lib.mkIf ( dbs != [] ) { + services = { + postgresql = { + enable = true; + checkConfig = true; + ensureDatabases = dbs; + ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs; + settings = { + log_connections = true; + log_statement = "all"; + logging_collector = true; + log_filename = "postgresql.log"; + }; + identMap = "root root postgres"; + }; + + postgresqlBackup = { + enable = true; + databases = dbs; + }; + + logrotate = { + enable = true; + settings = { + postgresqlBackup = { + enable = true; + files = "${config.services.postgresqlBackup.location}/*.gz"; + }; + postgresLog = { + enable = true; + files = "/var/lib/postgresql/*/log/*.log"; + compress = true; + compresscmd = "${pkgs.xz}/bin/xz"; + }; + }; + }; + + }; + + greg.backup.jobs.greg-postgresql-backup = { + src = config.services.postgresqlBackup.location; + dest = "linode-postgres"; + user = "postgres"; + }; + }; +} diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix index ad807e1..a4712bd 100644 --- a/modules/nixos/default.nix +++ b/modules/nixos/default.nix @@ -4,6 +4,7 @@ imports = [ ../baseline.nix ./backup.nix + ./db.nix ./gnome.nix ./home.nix ./kde.nix diff --git a/secrets/3proxy.age b/secrets/3proxy.age index 173197d..607aa55 100644 --- a/secrets/3proxy.age +++ b/secrets/3proxy.age @@ -16,4 +16,4 @@ F8D5VJIplhXcqfTzlUhk2GlwRkBmPIiOee980H0VJLM -> ssh-ed25519 kdPvzQ ky3n+PXUHZOXiXNa4+MBaLmSMW6H2z/NBX+H9QHVKhE wR2DfcF5CgOXBsbQxHKVcZLU+uo1Vt3berKpWoMo/FA --- Zrbuy61RBb9S64+YAaGcXNn+i+v/qEkJjXRrDBBKEKY - • æeÖÁùU|ñ:í¶rCv*~ÿÞ8¾[)ˆ²V†„ÛG ÎÚ@Kæ‡Õ