Move Dendrite to Isaiah

hosts/linode/postgres.nix

@@ -5,7 +5,6 @@
 		enable = true;
 		checkConfig = true;
 		ensureDatabases = [
-			"dendrite"
 			"nextcloud"
 		];
 		#initialScript = pkgs.writeText "create-matrix-db.sql" ''
@@ -16,10 +15,7 @@
 		ensureUsers = [ {
 			name = "nextcloud";
 			ensureDBOwnership = true;
-		} {
+		}  ];
-			name = "dendrite";
-			ensureDBOwnership = true;
-		} ];
 		settings = {
 			log_connections = true;
 			log_statement = "all";
@@ -34,7 +30,6 @@ root root postgres
 	services.postgresqlBackup = {
 		enable = true;
 		databases = [
-			"dendrite"
 			"nextcloud"
 		];
 	};

hosts/linode/synapse.nix

@@ -69,66 +69,6 @@ return 200 '${builtins.toJSON client}';
 		};
 	};
 
-	# Environment secrets
-	age.secrets.dendrite = {
-		file = ../../secrets/dendrite.age;
-		owner = "dendrite";
-	};
-
-	users.users.dendrite = {
-		isSystemUser = true;
-		group = "dendrite";
-	};
-	users.groups.dendrite = {};
-
-	systemd.services.dendrite.serviceConfig = {
-		User = "dendrite";
-	};
-
-	services.dendrite = {
-		enable = true;
-		environmentFile = "/run/agenix/dendrite";
-		httpPort = 8448;
-		# Identify ourselves as the root of our own domain
-		settings = (
-		(builtins.listToAttrs (
-			(map (x: { name = x; value = { database.connection_string = conn; }; }) [
-				"app_service_api"
-				"federation_api"
-				"key_server"
-				"media_api"
-				"mscs"
-				"relay_api"
-				"room_server"
-				"sync_api"
-			])
-		) ) //
-		{
-			user_api.account_database.connection_string = conn;
-			user_api.device_database.connection_string = conn;
-			global = {
-				database = {
-					connection_string = conn;
-					max_open_conns = 25;
-					max_idle_conns = 5;
-					conn_max_lifetime = -1;
-				};
-				server_name = "thehellings.com";
-				trusted_third_party_id_servers = [
-					"matrix.org"
-					"vector.im"
-					"jupiterbroadcasting.com"
-				];
-				# Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
-				private_key = "/etc/dendrite.pem";
-			};
-			client_api = {
-				registration_enabled = false;
-				registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
-			};
-		});
-	};
-
 	# Open networking ports for the server
 	networking.firewall = {
 		enable = true;

hosts/myself/default.nix

@@ -3,6 +3,7 @@
 	imports = [
 		./hardware-configuration.nix
 		./git.nix
+		./matrix.nix
 	];
 
 	environment.systemPackages = with pkgs; [

hosts/myself/matrix.nix

@@ -0,0 +1,101 @@
+{ config, pkgs, inputs, lib, ... }:
+let
+	domain = "thehellings.com";
+	fqdn = "matrix.${domain}";
+	conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
+in
+{
+	containers.matrix = {
+		autoStart = true;
+		bindMounts."/etc/ssh".hostPath = "/etc/ssh";
+		config = { pkgs, config, ... }: {
+			imports = [
+				inputs.agenix.nixosModules.default
+				inputs.self.modules.nixosModule
+			];
+
+			nixpkgs.overlays = inputs.self.overlays.all;
+
+			networking = {
+				firewall = {
+					enable = true;
+					allowedTCPPorts = [ config.services.dendrite.httpPort ];
+				};
+				useHostResolvConf = lib.mkForce false;
+			};
+
+			# Environment secrets
+			age = {
+				identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+				secrets.dendrite = {
+					file = ../../secrets/dendrite.age;
+					owner = "dendrite";
+				};
+			};
+
+			users.users.dendrite = {
+				isSystemUser = true;
+				group = "dendrite";
+			};
+			users.groups.dendrite = {};
+
+			systemd.services.dendrite.serviceConfig = {
+				User = "dendrite";
+			};
+
+			greg = {
+				databases.dendrite = {};
+				tailscale.enable = true;
+			};
+
+			services.dendrite = {
+				enable = true;
+				environmentFile = config.age.secrets.dendrite.path;
+				httpPort = 8448;
+				# Identify ourselves as the root of our own domain
+				settings = (
+				(builtins.listToAttrs (
+					(map (x: { name = x; value = { database.connection_string = conn; }; }) [
+						"app_service_api"
+						"federation_api"
+						"key_server"
+						"media_api"
+						"mscs"
+						"relay_api"
+						"room_server"
+						"sync_api"
+					])
+				) ) //
+				{
+					user_api.account_database.connection_string = conn;
+					user_api.device_database.connection_string = conn;
+					global = {
+						database = {
+							connection_string = conn;
+							max_open_conns = 25;
+							max_idle_conns = 5;
+							conn_max_lifetime = -1;
+						};
+						server_name = "thehellings.com";
+						trusted_third_party_id_servers = [
+							"matrix.org"
+							"vector.im"
+							"jupiterbroadcasting.com"
+						];
+						# Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
+						private_key = "/etc/dendrite.pem";
+					};
+					client_api = {
+						registration_enabled = false;
+						registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
+					};
+				});
+			};
+
+			systemd.services.dendrite = {
+				after = [ "postgresql.service" ];
+				requires = [ "postgresql.service" ];
+			};
+		};
+	};
+}

modules/nixos/db.nix

@@ -0,0 +1,62 @@
+{ config, lib, pkgs, ... }:
+
+let
+	cfg = config.greg.databases;
+	dbs = (lib.attrNames cfg);
+in {
+	options.greg.databases = lib.mkOption {
+		default = {};
+		type = with lib.types; attrsOf ( submodule (
+			{ name, config, options, ... }: {
+				# Options reserved for future expansion
+				options = {};
+			}
+		));
+	};
+
+	config = lib.mkIf ( dbs != [] ) {
+		services = {
+			postgresql = {
+				enable = true;
+				checkConfig = true;
+				ensureDatabases = dbs;
+				ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs;
+				settings = {
+					log_connections = true;
+					log_statement = "all";
+					logging_collector = true;
+					log_filename = "postgresql.log";
+				};
+				identMap = "root root postgres";
+			};
+
+			postgresqlBackup =  {
+				enable = true;
+				databases = dbs;
+			};
+
+			logrotate = {
+				enable = true;
+				settings = {
+					postgresqlBackup = {
+						enable = true;
+						files = "${config.services.postgresqlBackup.location}/*.gz";
+					};
+					postgresLog = {
+						enable = true;
+						files = "/var/lib/postgresql/*/log/*.log";
+						compress = true;
+						compresscmd = "${pkgs.xz}/bin/xz";
+					};
+				};
+			};
+
+		};
+
+		greg.backup.jobs.greg-postgresql-backup = {
+			src = config.services.postgresqlBackup.location;
+			dest = "linode-postgres";
+			user = "postgres";
+		};
+	};
+}

modules/nixos/default.nix

@@ -4,6 +4,7 @@
 	imports = [
 		../baseline.nix
 		./backup.nix
+		./db.nix
 		./gnome.nix
 		./home.nix
 		./kde.nix

secrets/secrets.nix

@@ -33,8 +33,6 @@ in
 	# Then you can reference the file at /run/agenix/matrix
 	"nextcloudadmin.age".publicKeys = everyone;
 
-	"drone.age".publicKeys = everyone;
-
 	"3proxy.age".publicKeys = everyone;
 
 	"linode-forgejo-runner.age".publicKeys = everyone;