Compare commits
12 commits
97154256da
...
956c5bd258
Author | SHA1 | Date | |
---|---|---|---|
956c5bd258 | |||
89f9196ef0 | |||
e37c589654 | |||
b396835f88 | |||
ee760bfa1b | |||
3c6afa0c66 | |||
a398790ef4 | |||
e4a7fa8764 | |||
be1d739b40 | |||
a60cb7f60c | |||
586ab969a4 | |||
3c7b6a7163 |
18 changed files with 1696 additions and 143 deletions
configuration
default.nix
flake.lockflake.nixhardware-specific/hetzner
nginx.nixservices
sops.nixmodules/crowdsec
pkgs/crowdsec/_sources
|
@ -22,6 +22,7 @@
|
|||
./services/foundryvtt.nix
|
||||
./services/gitea.nix
|
||||
./services/metrics
|
||||
./services/minecraft.nix
|
||||
./services/nextcloud.nix
|
||||
./services/webserver.nix
|
||||
./services/wireguard.nix
|
||||
|
@ -70,8 +71,6 @@
|
|||
8448
|
||||
# starbound
|
||||
21025
|
||||
# Minecraft
|
||||
25565
|
||||
|
||||
config.services.coturn.listening-port
|
||||
config.services.coturn.tls-listening-port
|
||||
|
@ -80,9 +79,6 @@
|
|||
];
|
||||
|
||||
allowedUDPPorts = [
|
||||
# More minecraft
|
||||
25565
|
||||
|
||||
config.services.coturn.listening-port
|
||||
config.services.coturn.tls-listening-port
|
||||
config.services.coturn.alt-listening-port
|
||||
|
|
|
@ -80,6 +80,17 @@
|
|||
inherit mountOptions;
|
||||
mountpoint = "/var";
|
||||
};
|
||||
"/volume/var/lib/private/matrix-conduit" = {
|
||||
mountOptions = [
|
||||
# Explicitly don't compress here, since
|
||||
# conduwuit's database does compression by
|
||||
# itself, and relies on being able to read the
|
||||
# raw file data from disk (which is impossible
|
||||
# if btrfs compresses it)
|
||||
"noatime"
|
||||
];
|
||||
mountpoint = "/var/lib/private/matrix-conduit";
|
||||
};
|
||||
"/volume/nix-store" = {
|
||||
inherit mountOptions;
|
||||
mountpoint = "/nix";
|
||||
|
|
|
@ -53,7 +53,7 @@
|
|||
"*.tlater.com"
|
||||
];
|
||||
dnsProvider = "porkbun";
|
||||
group = "nginx";
|
||||
group = "ssl-cert";
|
||||
credentialFiles = {
|
||||
PORKBUN_API_KEY_FILE = config.sops.secrets."porkbun/api-key".path;
|
||||
PORKBUN_SECRET_API_KEY_FILE = config.sops.secrets."porkbun/secret-api-key".path;
|
||||
|
@ -61,6 +61,12 @@
|
|||
};
|
||||
};
|
||||
|
||||
users.groups.ssl-cert = { };
|
||||
|
||||
systemd.services.nginx.serviceConfig.SupplementaryGroups = [
|
||||
config.security.acme.certs."tlater.net".group
|
||||
];
|
||||
|
||||
services.backups.acme = {
|
||||
user = "acme";
|
||||
paths = lib.mapAttrsToList (
|
||||
|
|
|
@ -4,9 +4,13 @@
|
|||
|
||||
services.batteryManager = {
|
||||
enable = true;
|
||||
battery = "3ca39300-c523-4315-b9a3-d030f85a9373";
|
||||
|
||||
emailFile = "${config.sops.secrets."battery-manager/email".path}";
|
||||
passwordFile = "${config.sops.secrets."battery-manager/password".path}";
|
||||
|
||||
settings = {
|
||||
battery_id = "3ca39300-c523-4315-b9a3-d030f85a9373";
|
||||
log_level = "DEBUG";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
@ -1,4 +1,6 @@
|
|||
{
|
||||
pkgs,
|
||||
flake-inputs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
|
@ -18,10 +20,12 @@ in
|
|||
|
||||
services.matrix-conduit = {
|
||||
enable = true;
|
||||
package = flake-inputs.conduwuit.packages.${pkgs.system}.default;
|
||||
settings.global = {
|
||||
address = "127.0.0.1";
|
||||
server_name = domain;
|
||||
database_backend = "rocksdb";
|
||||
new_user_displayname_suffix = "🦆";
|
||||
allow_check_for_updates = true;
|
||||
|
||||
# Set up delegation: https://docs.conduit.rs/delegation.html#automatic-recommended
|
||||
# This is primarily to make sliding sync work
|
||||
|
@ -44,11 +48,18 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
# Pass in the TURN secret via EnvironmentFile, not supported by
|
||||
# upstream module currently.
|
||||
#
|
||||
# See also https://gitlab.com/famedly/conduit/-/issues/314
|
||||
systemd.services.conduit.serviceConfig.EnvironmentFile = config.sops.secrets."turn/env".path;
|
||||
systemd.services.conduit.serviceConfig = {
|
||||
ExecStart = lib.mkForce "${config.services.matrix-conduit.package}/bin/conduwuit";
|
||||
# Pass in the TURN secret via EnvironmentFile, not supported by
|
||||
# upstream module currently.
|
||||
#
|
||||
# See also https://gitlab.com/famedly/conduit/-/issues/314
|
||||
EnvironmentFile = config.sops.secrets."turn/env".path;
|
||||
};
|
||||
|
||||
systemd.services.coturn.serviceConfig.SupplementaryGroups = [
|
||||
config.security.acme.certs."tlater.net".group
|
||||
];
|
||||
|
||||
services.coturn = {
|
||||
enable = true;
|
||||
|
@ -59,11 +70,8 @@ in
|
|||
relay-ips = [ "116.202.158.55" ];
|
||||
|
||||
# SSL config
|
||||
#
|
||||
# TODO(tlater): Switch to letsencrypt once google fix:
|
||||
# https://github.com/vector-im/element-android/issues/1533
|
||||
pkey = config.sops.secrets."turn/ssl-key".path;
|
||||
cert = config.sops.secrets."turn/ssl-cert".path;
|
||||
pkey = "${config.security.acme.certs."tlater.net".directory}/key.pem";
|
||||
cert = "${config.security.acme.certs."tlater.net".directory}/fullchain.pem";
|
||||
|
||||
# Based on suggestions from
|
||||
# https://github.com/matrix-org/synapse/blob/develop/docs/turn-howto.md
|
||||
|
|
|
@ -138,7 +138,7 @@ in
|
|||
}
|
||||
];
|
||||
|
||||
metrics.enable = true;
|
||||
metrics.enabled = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
@ -5,5 +5,6 @@
|
|||
./exporters.nix
|
||||
./grafana.nix
|
||||
./victoriametrics.nix
|
||||
./victorialogs.nix
|
||||
];
|
||||
}
|
||||
|
|
|
@ -20,6 +20,16 @@ in
|
|||
timeout = "5s";
|
||||
http.preferred_ip_protocol = "ip4";
|
||||
};
|
||||
|
||||
turn_server = {
|
||||
prober = "tcp";
|
||||
timeout = "5s";
|
||||
tcp = {
|
||||
preferred_ip_protocol = "ip4";
|
||||
source_ip_address = "116.202.158.55";
|
||||
tls = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
|
@ -1,4 +1,9 @@
|
|||
{ config, ... }:
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
flake-inputs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
domain = "metrics.${config.services.nginx.domain}";
|
||||
in
|
||||
|
@ -28,6 +33,11 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
declarativePlugins = [
|
||||
pkgs.grafanaPlugins.victoriametrics-metrics-datasource
|
||||
flake-inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.grafanaPlugins.victoriametrics-logs-datasource
|
||||
];
|
||||
|
||||
provision = {
|
||||
enable = true;
|
||||
|
||||
|
@ -35,7 +45,16 @@ in
|
|||
{
|
||||
name = "Victoriametrics - tlater.net";
|
||||
url = "http://localhost:8428";
|
||||
type = "prometheus";
|
||||
type = "victoriametrics-metrics-datasource";
|
||||
access = "proxy";
|
||||
isDefault = true;
|
||||
}
|
||||
|
||||
{
|
||||
name = "Victorialogs - tlater.net";
|
||||
url = "http://${config.services.victorialogs.bindAddress}";
|
||||
type = "victoriametrics-logs-datasource";
|
||||
access = "proxy";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
|
34
configuration/services/metrics/victorialogs.nix
Normal file
34
configuration/services/metrics/victorialogs.nix
Normal file
|
@ -0,0 +1,34 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.services.victorialogs;
|
||||
in
|
||||
{
|
||||
options.services.victorialogs.bindAddress = lib.mkOption {
|
||||
readOnly = true;
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Final address on which victorialogs listens.
|
||||
'';
|
||||
};
|
||||
|
||||
config = {
|
||||
services.victorialogs = {
|
||||
enable = true;
|
||||
bindAddress =
|
||||
(lib.optionalString (lib.hasPrefix ":" cfg.listenAddress) "127.0.0.1") + cfg.listenAddress;
|
||||
};
|
||||
|
||||
services.journald.upload = {
|
||||
enable = true;
|
||||
settings.Upload = {
|
||||
URL = "http://${cfg.bindAddress}/insert/journald";
|
||||
NetworkTimeoutSec = "20s";
|
||||
};
|
||||
};
|
||||
systemd.services."systemd-journal-upload".after = [ "victorialogs.service" ];
|
||||
};
|
||||
}
|
|
@ -40,6 +40,30 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
blackbox_turn = {
|
||||
targets = [ "turn.tlater.net:${toString config.services.coturn.tls-listening-port}" ];
|
||||
|
||||
extraSettings = {
|
||||
metrics_path = "/probe";
|
||||
params.module = [ "turn_server" ];
|
||||
|
||||
relabel_configs = [
|
||||
{
|
||||
source_labels = [ "__address__" ];
|
||||
target_label = "__param_target";
|
||||
}
|
||||
{
|
||||
source_labels = [ "__param_target" ];
|
||||
target_label = "instance";
|
||||
}
|
||||
{
|
||||
target_label = "__address__";
|
||||
replacement = "${blackbox_host}:${toString blackbox_port}";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
blackbox_exporter.targets = [ "${blackbox_host}:${toString blackbox_port}" ];
|
||||
|
||||
coturn.targets = [ "127.0.0.1:9641" ];
|
||||
|
@ -63,6 +87,8 @@ in
|
|||
# Configured in the hookshot listeners, but it's hard to filter
|
||||
# the correct values out of that config.
|
||||
matrixHookshot.targets = [ "127.0.0.1:9001" ];
|
||||
|
||||
victorialogs.targets = [ config.services.victorialogs.bindAddress ];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
83
configuration/services/minecraft.nix
Normal file
83
configuration/services/minecraft.nix
Normal file
|
@ -0,0 +1,83 @@
|
|||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
{
|
||||
services.minecraft-server = {
|
||||
enable = true;
|
||||
eula = true;
|
||||
# jvmOpts are set using a file for forge
|
||||
# jvmOpts = "-Xmx8G -Xms8G";
|
||||
openFirewall = true;
|
||||
|
||||
declarative = true;
|
||||
|
||||
whitelist = {
|
||||
tlater = "140d177a-966f-41b8-a4c0-e305babd291b";
|
||||
romino25 = "59cd1648-14a4-4bcf-8f5a-2e1bde678f2c";
|
||||
lasi25 = "0ab6e3d1-544a-47e7-8538-2e6c248e49a4";
|
||||
};
|
||||
|
||||
serverProperties = {
|
||||
allow-flight = true;
|
||||
difficulty = "hard";
|
||||
motd = "tlater.net";
|
||||
spawn-protection = 1;
|
||||
white-list = true;
|
||||
enable-query = true;
|
||||
enable-status = true;
|
||||
|
||||
# Allows the server to write chunks without hogging the main
|
||||
# thread...
|
||||
sync-chunk-writes = false;
|
||||
# Disables chat reporting, because we don't need any of that
|
||||
# drama on a lil' friends-only server.
|
||||
enforce-secure-profile = false;
|
||||
};
|
||||
|
||||
package = pkgs.writeShellApplication {
|
||||
name = "minecraft-server";
|
||||
runtimeInputs = with pkgs; [ jdk17_headless ];
|
||||
|
||||
text = ''
|
||||
exec /var/lib/minecraft/run.sh $@
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.minecraft-server = {
|
||||
path = with pkgs; [ jdk17_headless ];
|
||||
|
||||
# Since we read from our own HTTP server, we need to wait for it
|
||||
# to be up
|
||||
after = [ "nginx.service" ];
|
||||
|
||||
serviceConfig = {
|
||||
# Use packwiz to install mods
|
||||
ExecStartPre = [
|
||||
"${pkgs.jdk17_headless}/bin/java -jar ${config.services.minecraft-server.dataDir}/packwiz-installer-bootstrap.jar -g -s server 'https://minecraft.${config.services.nginx.domain}/cobblemon-pack/pack.toml'"
|
||||
];
|
||||
# Forge requires some bonus JVM options, which they include in a
|
||||
# little `run.sh` script
|
||||
ExecStart = lib.mkForce "${config.services.minecraft-server.dataDir}/run.sh --nogui";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.settings."10-minecraft" = {
|
||||
"/srv/minecraft".d = {
|
||||
user = "nginx";
|
||||
group = "minecraft";
|
||||
mode = "0775";
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."minecraft.${config.services.nginx.domain}" = {
|
||||
forceSSL = true;
|
||||
useACMEHost = "tlater.net";
|
||||
enableHSTS = true;
|
||||
|
||||
root = "/srv/minecraft";
|
||||
};
|
||||
}
|
|
@ -1,18 +1,11 @@
|
|||
{ config, lib, ... }:
|
||||
{
|
||||
sops = {
|
||||
defaultSopsFile = ../keys/production.yaml;
|
||||
|
||||
secrets = {
|
||||
"battery-manager/email" = lib.mkIf config.services.batteryManager.enable {
|
||||
owner = "battery-manager";
|
||||
group = "battery-manager";
|
||||
};
|
||||
"battery-manager/email" = { };
|
||||
|
||||
"battery-manager/password" = lib.mkIf config.services.batteryManager.enable {
|
||||
owner = "battery-manager";
|
||||
group = "battery-manager";
|
||||
};
|
||||
"battery-manager/password" = { };
|
||||
|
||||
# Gitea
|
||||
"forgejo/metrics-token" = {
|
||||
|
|
1556
flake.lock
generated
1556
flake.lock
generated
File diff suppressed because it is too large
Load diff
|
@ -4,6 +4,10 @@
|
|||
inputs = {
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11-small";
|
||||
nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable-small";
|
||||
conduwuit = {
|
||||
url = "github:girlbossceo/conduwuit";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
disko = {
|
||||
url = "github:nix-community/disko";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
@ -26,8 +30,6 @@
|
|||
url = "git+ssh://git@github.com/sonnenshift/battery-manager";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
nixpkgs-crowdsec.url = "github:tlater/nixpkgs/tlater/fix-crowdsec";
|
||||
};
|
||||
|
||||
outputs =
|
||||
|
@ -106,7 +108,6 @@
|
|||
in
|
||||
{
|
||||
default = vm.config.system.build.vm;
|
||||
crowdsec = pkgs.callPackage "${inputs.nixpkgs-crowdsec}/pkgs/by-name/cr/crowdsec/package.nix" { };
|
||||
crowdsec-hub = localPkgs.crowdsec.hub;
|
||||
crowdsec-firewall-bouncer = localPkgs.crowdsec.firewall-bouncer;
|
||||
};
|
||||
|
|
|
@ -1,5 +1,4 @@
|
|||
{
|
||||
flake-inputs,
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
|
@ -9,8 +8,6 @@ let
|
|||
cfg = config.security.crowdsec;
|
||||
settingsFormat = pkgs.formats.yaml { };
|
||||
|
||||
crowdsec = flake-inputs.self.packages.${pkgs.system}.crowdsec;
|
||||
|
||||
hub = pkgs.fetchFromGitHub {
|
||||
owner = "crowdsecurity";
|
||||
repo = "hub";
|
||||
|
@ -19,14 +16,14 @@ let
|
|||
};
|
||||
|
||||
cscli = pkgs.writeShellScriptBin "cscli" ''
|
||||
export PATH="$PATH:${crowdsec}/bin/"
|
||||
export PATH="$PATH:${cfg.package}/bin/"
|
||||
|
||||
sudo=exec
|
||||
if [ "$USER" != "crowdsec" ]; then
|
||||
sudo='exec /run/wrappers/bin/sudo -u crowdsec'
|
||||
fi
|
||||
|
||||
$sudo ${crowdsec}/bin/cscli "$@"
|
||||
$sudo ${cfg.package}/bin/cscli "$@"
|
||||
'';
|
||||
|
||||
acquisitions = ''
|
||||
|
@ -53,7 +50,7 @@ in
|
|||
|
||||
package = lib.mkOption {
|
||||
type = package;
|
||||
default = crowdsec;
|
||||
default = pkgs.crowdsec;
|
||||
};
|
||||
|
||||
stateDirectory = lib.mkOption {
|
||||
|
|
|
@ -21,7 +21,7 @@
|
|||
},
|
||||
"crowdsec-hub": {
|
||||
"cargoLocks": null,
|
||||
"date": "2025-01-30",
|
||||
"date": "2025-04-04",
|
||||
"extract": null,
|
||||
"name": "crowdsec-hub",
|
||||
"passthru": null,
|
||||
|
@ -33,10 +33,10 @@
|
|||
"name": null,
|
||||
"owner": "crowdsecurity",
|
||||
"repo": "hub",
|
||||
"rev": "8f102f5ac79af59d3024ca2771b65ec87411ac02",
|
||||
"sha256": "sha256-8K1HkBg0++Au1dr2KMrl9b2ruqXdo+vqWngOCwL11Mo=",
|
||||
"rev": "eebc5f71379ea8f4de4a26f6695e0340444c719c",
|
||||
"sha256": "sha256-/jhsqumekdOHDbHjBP8KvAICsSNhCg5ejMT3jSRiROo=",
|
||||
"type": "github"
|
||||
},
|
||||
"version": "8f102f5ac79af59d3024ca2771b65ec87411ac02"
|
||||
"version": "eebc5f71379ea8f4de4a26f6695e0340444c719c"
|
||||
}
|
||||
}
|
|
@ -14,14 +14,14 @@
|
|||
};
|
||||
crowdsec-hub = {
|
||||
pname = "crowdsec-hub";
|
||||
version = "8f102f5ac79af59d3024ca2771b65ec87411ac02";
|
||||
version = "eebc5f71379ea8f4de4a26f6695e0340444c719c";
|
||||
src = fetchFromGitHub {
|
||||
owner = "crowdsecurity";
|
||||
repo = "hub";
|
||||
rev = "8f102f5ac79af59d3024ca2771b65ec87411ac02";
|
||||
rev = "eebc5f71379ea8f4de4a26f6695e0340444c719c";
|
||||
fetchSubmodules = false;
|
||||
sha256 = "sha256-8K1HkBg0++Au1dr2KMrl9b2ruqXdo+vqWngOCwL11Mo=";
|
||||
sha256 = "sha256-/jhsqumekdOHDbHjBP8KvAICsSNhCg5ejMT3jSRiROo=";
|
||||
};
|
||||
date = "2025-01-30";
|
||||
date = "2025-04-04";
|
||||
};
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue