WIP: feat: Add minecraft server

configuration/hardware-specific/hetzner/disko.nix

@@ -80,17 +80,6 @@
                     inherit mountOptions;
                     mountpoint = "/var";
                   };
-                  "/volume/var/lib/private/matrix-conduit" = {
-                    mountOptions = [
-                      # Explicitly don't compress here, since
-                      # conduwuit's database does compression by
-                      # itself, and relies on being able to read the
-                      # raw file data from disk (which is impossible
-                      # if btrfs compresses it)
-                      "noatime"
-                    ];
-                    mountpoint = "/var/lib/private/matrix-conduit";
-                  };
                   "/volume/nix-store" = {
                     inherit mountOptions;
                     mountpoint = "/nix";

configuration/nginx.nix

@@ -53,7 +53,7 @@
         "*.tlater.com"
       ];
       dnsProvider = "porkbun";
-      group = "ssl-cert";
+      group = "nginx";
       credentialFiles = {
         PORKBUN_API_KEY_FILE = config.sops.secrets."porkbun/api-key".path;
         PORKBUN_SECRET_API_KEY_FILE = config.sops.secrets."porkbun/secret-api-key".path;
@@ -61,12 +61,6 @@
     };
   };
 
-  users.groups.ssl-cert = { };
-
-  systemd.services.nginx.serviceConfig.SupplementaryGroups = [
-    config.security.acme.certs."tlater.net".group
-  ];
-
   services.backups.acme = {
     user = "acme";
     paths = lib.mapAttrsToList (

configuration/services/battery-manager.nix

@@ -4,13 +4,9 @@
 
   services.batteryManager = {
     enable = true;
+    battery = "3ca39300-c523-4315-b9a3-d030f85a9373";
 
     emailFile = "${config.sops.secrets."battery-manager/email".path}";
     passwordFile = "${config.sops.secrets."battery-manager/password".path}";
-
-    settings = {
-      battery_id = "3ca39300-c523-4315-b9a3-d030f85a9373";
-      log_level = "DEBUG";
-    };
   };
 }

configuration/services/conduit/default.nix

@@ -1,6 +1,4 @@
 {
-  pkgs,
-  flake-inputs,
   config,
   lib,
   ...
@@ -20,12 +18,10 @@ in
 
   services.matrix-conduit = {
     enable = true;
-    package = flake-inputs.conduwuit.packages.${pkgs.system}.default;
     settings.global = {
       address = "127.0.0.1";
       server_name = domain;
-      new_user_displayname_suffix = "🦆";
+      database_backend = "rocksdb";
-      allow_check_for_updates = true;
 
       # Set up delegation: https://docs.conduit.rs/delegation.html#automatic-recommended
       # This is primarily to make sliding sync work
@@ -48,18 +44,11 @@ in
     };
   };
 
-  systemd.services.conduit.serviceConfig = {
+  # Pass in the TURN secret via EnvironmentFile, not supported by
-    ExecStart = lib.mkForce "${config.services.matrix-conduit.package}/bin/conduwuit";
+  # upstream module currently.
-    # Pass in the TURN secret via EnvironmentFile, not supported by
+  #
-    # upstream module currently.
+  # See also https://gitlab.com/famedly/conduit/-/issues/314
-    #
+  systemd.services.conduit.serviceConfig.EnvironmentFile = config.sops.secrets."turn/env".path;
-    # See also https://gitlab.com/famedly/conduit/-/issues/314
-    EnvironmentFile = config.sops.secrets."turn/env".path;
-  };
-
-  systemd.services.coturn.serviceConfig.SupplementaryGroups = [
-    config.security.acme.certs."tlater.net".group
-  ];
 
   services.coturn = {
     enable = true;
@@ -70,8 +59,11 @@ in
     relay-ips = [ "116.202.158.55" ];
 
     # SSL config
-    pkey = "${config.security.acme.certs."tlater.net".directory}/key.pem";
+    #
-    cert = "${config.security.acme.certs."tlater.net".directory}/fullchain.pem";
+    # TODO(tlater): Switch to letsencrypt once google fix:
+    #  https://github.com/vector-im/element-android/issues/1533
+    pkey = config.sops.secrets."turn/ssl-key".path;
+    cert = config.sops.secrets."turn/ssl-cert".path;
 
     # Based on suggestions from
     # https://github.com/matrix-org/synapse/blob/develop/docs/turn-howto.md

configuration/services/conduit/matrix-hookshot.nix

@@ -138,7 +138,7 @@ in
         }
       ];
 
-      metrics.enabled = true;
+      metrics.enable = true;
     };
   };
 }

configuration/services/metrics/default.nix

@@ -5,6 +5,5 @@
     ./exporters.nix
     ./grafana.nix
     ./victoriametrics.nix
-    ./victorialogs.nix
   ];
 }

configuration/services/metrics/exporters.nix

@@ -20,16 +20,6 @@ in
               timeout = "5s";
               http.preferred_ip_protocol = "ip4";
             };
-
-            turn_server = {
-              prober = "tcp";
-              timeout = "5s";
-              tcp = {
-                preferred_ip_protocol = "ip4";
-                source_ip_address = "116.202.158.55";
-                tls = true;
-              };
-            };
           };
         };
       };

configuration/services/metrics/grafana.nix

@@ -1,9 +1,4 @@
-{
+{ config, ... }:
-  pkgs,
-  config,
-  flake-inputs,
-  ...
-}:
 let
   domain = "metrics.${config.services.nginx.domain}";
 in
@@ -33,11 +28,6 @@ in
       };
     };
 
-    declarativePlugins = [
-      pkgs.grafanaPlugins.victoriametrics-metrics-datasource
-      flake-inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.grafanaPlugins.victoriametrics-logs-datasource
-    ];
-
     provision = {
       enable = true;
 
@@ -45,16 +35,7 @@ in
         {
           name = "Victoriametrics - tlater.net";
           url = "http://localhost:8428";
-          type = "victoriametrics-metrics-datasource";
+          type = "prometheus";
-          access = "proxy";
-          isDefault = true;
-        }
-
-        {
-          name = "Victorialogs - tlater.net";
-          url = "http://${config.services.victorialogs.bindAddress}";
-          type = "victoriametrics-logs-datasource";
-          access = "proxy";
         }
       ];
     };

configuration/services/metrics/victorialogs.nix

@@ -1,34 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.services.victorialogs;
-in
-{
-  options.services.victorialogs.bindAddress = lib.mkOption {
-    readOnly = true;
-    type = lib.types.str;
-    description = ''
-      Final address on which victorialogs listens.
-    '';
-  };
-
-  config = {
-    services.victorialogs = {
-      enable = true;
-      bindAddress =
-        (lib.optionalString (lib.hasPrefix ":" cfg.listenAddress) "127.0.0.1") + cfg.listenAddress;
-    };
-
-    services.journald.upload = {
-      enable = true;
-      settings.Upload = {
-        URL = "http://${cfg.bindAddress}/insert/journald";
-        NetworkTimeoutSec = "20s";
-      };
-    };
-    systemd.services."systemd-journal-upload".after = [ "victorialogs.service" ];
-  };
-}

configuration/services/metrics/victoriametrics.nix

@@ -40,30 +40,6 @@ in
         };
       };
 
-      blackbox_turn = {
-        targets = [ "turn.tlater.net:${toString config.services.coturn.tls-listening-port}" ];
-
-        extraSettings = {
-          metrics_path = "/probe";
-          params.module = [ "turn_server" ];
-
-          relabel_configs = [
-            {
-              source_labels = [ "__address__" ];
-              target_label = "__param_target";
-            }
-            {
-              source_labels = [ "__param_target" ];
-              target_label = "instance";
-            }
-            {
-              target_label = "__address__";
-              replacement = "${blackbox_host}:${toString blackbox_port}";
-            }
-          ];
-        };
-      };
-
       blackbox_exporter.targets = [ "${blackbox_host}:${toString blackbox_port}" ];
 
       coturn.targets = [ "127.0.0.1:9641" ];
@@ -87,8 +63,6 @@ in
       # Configured in the hookshot listeners, but it's hard to filter
       # the correct values out of that config.
       matrixHookshot.targets = [ "127.0.0.1:9001" ];
-
-      victorialogs.targets = [ config.services.victorialogs.bindAddress ];
     };
   };
 }

configuration/sops.nix

@@ -1,11 +1,18 @@
+{ config, lib, ... }:
 {
   sops = {
     defaultSopsFile = ../keys/production.yaml;
 
     secrets = {
-      "battery-manager/email" = { };
+      "battery-manager/email" = lib.mkIf config.services.batteryManager.enable {
+        owner = "battery-manager";
+        group = "battery-manager";
+      };
 
-      "battery-manager/password" = { };
+      "battery-manager/password" = lib.mkIf config.services.batteryManager.enable {
+        owner = "battery-manager";
+        group = "battery-manager";
+      };
 
       # Gitea
       "forgejo/metrics-token" = {

flake.nix

@@ -4,10 +4,6 @@
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11-small";
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable-small";
-    conduwuit = {
-      url = "github:girlbossceo/conduwuit";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     disko = {
       url = "github:nix-community/disko";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -30,6 +26,8 @@
       url = "git+ssh://git@github.com/sonnenshift/battery-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    nixpkgs-crowdsec.url = "github:tlater/nixpkgs/tlater/fix-crowdsec";
   };
 
   outputs =
@@ -108,6 +106,7 @@
         in
         {
           default = vm.config.system.build.vm;
+          crowdsec = pkgs.callPackage "${inputs.nixpkgs-crowdsec}/pkgs/by-name/cr/crowdsec/package.nix" { };
           crowdsec-hub = localPkgs.crowdsec.hub;
           crowdsec-firewall-bouncer = localPkgs.crowdsec.firewall-bouncer;
         };

modules/crowdsec/default.nix

@@ -1,4 +1,5 @@
 {
+  flake-inputs,
   pkgs,
   lib,
   config,
@@ -8,6 +9,8 @@ let
   cfg = config.security.crowdsec;
   settingsFormat = pkgs.formats.yaml { };
 
+  crowdsec = flake-inputs.self.packages.${pkgs.system}.crowdsec;
+
   hub = pkgs.fetchFromGitHub {
     owner = "crowdsecurity";
     repo = "hub";
@@ -16,14 +19,14 @@ let
   };
 
   cscli = pkgs.writeShellScriptBin "cscli" ''
-    export PATH="$PATH:${cfg.package}/bin/"
+    export PATH="$PATH:${crowdsec}/bin/"
 
     sudo=exec
     if [ "$USER" != "crowdsec" ]; then
         sudo='exec /run/wrappers/bin/sudo -u crowdsec'
     fi
 
-    $sudo ${cfg.package}/bin/cscli "$@"
+    $sudo ${crowdsec}/bin/cscli "$@"
   '';
 
   acquisitions = ''
@@ -50,7 +53,7 @@ in
 
       package = lib.mkOption {
         type = package;
-        default = pkgs.crowdsec;
+        default = crowdsec;
       };
 
       stateDirectory = lib.mkOption {

pkgs/crowdsec/_sources/generated.json

@@ -21,7 +21,7 @@
     },
     "crowdsec-hub": {
         "cargoLocks": null,
-        "date": "2025-04-04",
+        "date": "2025-01-30",
         "extract": null,
         "name": "crowdsec-hub",
         "passthru": null,
@@ -33,10 +33,10 @@
             "name": null,
             "owner": "crowdsecurity",
             "repo": "hub",
-            "rev": "eebc5f71379ea8f4de4a26f6695e0340444c719c",
+            "rev": "8f102f5ac79af59d3024ca2771b65ec87411ac02",
-            "sha256": "sha256-/jhsqumekdOHDbHjBP8KvAICsSNhCg5ejMT3jSRiROo=",
+            "sha256": "sha256-8K1HkBg0++Au1dr2KMrl9b2ruqXdo+vqWngOCwL11Mo=",
             "type": "github"
         },
-        "version": "eebc5f71379ea8f4de4a26f6695e0340444c719c"
+        "version": "8f102f5ac79af59d3024ca2771b65ec87411ac02"
     }
 }

pkgs/crowdsec/_sources/generated.nix

@@ -14,14 +14,14 @@
   };
   crowdsec-hub = {
     pname = "crowdsec-hub";
-    version = "eebc5f71379ea8f4de4a26f6695e0340444c719c";
+    version = "8f102f5ac79af59d3024ca2771b65ec87411ac02";
     src = fetchFromGitHub {
       owner = "crowdsecurity";
       repo = "hub";
-      rev = "eebc5f71379ea8f4de4a26f6695e0340444c719c";
+      rev = "8f102f5ac79af59d3024ca2771b65ec87411ac02";
       fetchSubmodules = false;
-      sha256 = "sha256-/jhsqumekdOHDbHjBP8KvAICsSNhCg5ejMT3jSRiROo=";
+      sha256 = "sha256-8K1HkBg0++Au1dr2KMrl9b2ruqXdo+vqWngOCwL11Mo=";
     };
-    date = "2025-04-04";
+    date = "2025-01-30";
   };
 }