add host: janeway

.sops.yaml

@@ -26,3 +26,9 @@ creation_rules:
       - *host_sarek
       - *user_felixalb_old
       - *user_felixalb
+
+  - path_regex: secrets/janeway/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *user_felixalb_old
+      - *user_felixalb

flake.lock

@@ -62,11 +62,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1696697597,
+        "lastModified": 1696983906,
-        "narHash": "sha256-q26Qv4DQ+h6IeozF2o1secyQG0jt2VUT3V0K58jr3pg=",
+        "narHash": "sha256-L7GyeErguS7Pg4h8nK0wGlcUTbfUMDu+HMf1UcyP72k=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5a237aecb57296f67276ac9ab296a41c23981f56",
+        "rev": "bd1cde45c77891214131cbbea5b1203e485a9d51",
         "type": "github"
       },
       "original": {
@@ -125,11 +125,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1696734395,
+        "lastModified": 1697064251,
-        "narHash": "sha256-O/g/wwBqqSS7RQ53bE6Ssf0pXVTCYfN7NnJDhKfggQY=",
+        "narHash": "sha256-xxp2sB+4vqB6S6zC/L5J8LlRKgVbgIZOcYl9/TDrEzI=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "d7380c38d407eaf06d111832f4368ba3486b800e",
+        "rev": "f995ea159252a53b25fa99824f2891e3b479d511",
         "type": "github"
       },
       "original": {
@@ -140,11 +140,11 @@
     },
     "unstable": {
       "locked": {
-        "lastModified": 1696604326,
+        "lastModified": 1697059129,
-        "narHash": "sha256-YXUNI0kLEcI5g8lqGMb0nh67fY9f2YoJsILafh6zlMo=",
+        "narHash": "sha256-9NJcFF9CEYPvHJ5ckE8kvINvI84SZZ87PvqMbH6pro0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "87828a0e03d1418e848d3dd3f3014a632e4a4f64",
+        "rev": "5e4c2ada4fcd54b99d56d7bd62f384511a7e2593",
         "type": "github"
       },
       "original": {

flake.nix

@@ -83,6 +83,20 @@
             }
           ];
         };
+        janeway = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          specialArgs = {
+            inherit inputs;
+          };
+          modules = [
+            # Overlays-module makes "pkgs.unstable" available in configuration.nix
+            ({ config, pkgs, ... }: { nixpkgs.overlays = [ overlay-unstable ]; })
+
+            ./hosts/janeway/configuration.nix
+            sops-nix.nixosModules.sops
+            matrix-synapse-next.nixosModules.default
+          ];
+        };
         redshirt = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
           specialArgs = {

hosts/janeway/configuration.nix

@@ -0,0 +1,39 @@
+{ config, pkgs, lib, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/virtualisation/proxmox-lxc.nix")
+      ../../base.nix
+      ../../common/metrics-exporters.nix
+
+      ./services/nginx.nix
+      ./services/postgresql.nix
+      ./services/matrix-synapse.nix
+  ];
+
+  # Boot and console is handled by proxmoxLXC.
+  boot.loader.systemd-boot.enable = lib.mkForce false; # Enabled in base.nix, forced off here.
+
+  # Override proxmox networking
+  proxmoxLXC.manageNetwork = true;
+  networking = {
+    hostName = "janeway";
+    defaultGateway = "192.168.10.1";
+    interfaces."eth0".ipv4 = {
+      addresses = [
+        { address = "192.168.10.183"; prefixLength = 24; }
+      ];
+    };
+    hostId = "bed956ff";
+  };
+
+  environment.systemPackages = with pkgs; [
+    bottom
+  ];
+
+  sops.defaultSopsFile = ../../secrets/janeway/janeway.yaml;
+
+  system.stateVersion = "23.05";
+}
+

hosts/janeway/services/matrix-synapse.nix

@@ -0,0 +1,86 @@
+{ config, pkgs, lib, ... }:
+let
+  main_ip = "127.0.1.2";
+in
+{
+  sops.secrets."matrix/synapse/registrationsecret" = {
+    restartUnits = [ "matrix-synapse.service" ];
+    owner = "matrix-synapse";
+    group = "matrix-synapse";
+  };
+
+  services.matrix-synapse-next = {
+    enable = true;
+    enableNginx = true;
+
+    workers = {
+      federationSenders = 1;
+      federationReceivers = 2;
+      initialSyncers = 1;
+      normalSyncers = 1;
+      eventPersisters = 1;
+      useUserDirectoryWorker = true;
+    };
+
+    extraConfigFiles = [
+      config.sops.secrets."matrix/synapse/registrationsecret".path
+    ];
+
+    settings = {
+      server_name = "feal.no";
+      public_baseurl = "https://matrix.feal.no";
+      database.name = "psycopg2";
+      autocreate_auto_join_rooms = false;
+      max_upload_size = "50M";
+
+      #registration_shared_secret = "do_not_put_secret_here_use_extraConfigFiles";
+
+      trusted_key_servers = [
+        {
+          server_name = "matrix.org";
+          verify_keys = {};
+        }
+      ];
+
+      enable_registration = false;
+      use_presence = true;
+
+      url_preview_enabled = true;
+      url_preview_ip_range_blacklist = [
+        # synapse example config
+        "127.0.0.0/8"
+        "10.0.0.0/8"
+        "172.16.0.0/12"
+        "192.168.0.0/16"
+        "100.64.0.0/10"
+        "192.0.0.0/24"
+        "169.254.0.0/16"
+        "192.88.99.0/24"
+        "198.18.0.0/15"
+        "192.0.2.0/24"
+        "198.51.100.0/24"
+        "203.0.113.0/24"
+        "224.0.0.0/4"
+        "::1/128"
+        "fe80::/10"
+        "fc00::/7"
+        "2001:db8::/32"
+        "ff00::/8"
+        "fec0::/10"
+      ];
+
+      tls_certificate_path = "/etc/ssl-snakeoil/matrix_feal_no.crt";
+      tls_private_key_path = "/etc/ssl-snakeoil/matrix_feal_no.key";
+
+    };
+  };
+
+  services.redis.servers."".enable = true;
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  services.nginx.virtualHosts."matrix.feal.no" = {
+    enableACME = lib.mkForce false;
+    forceSSL = lib.mkForce false;
+  };
+
+}

hosts/janeway/services/nginx.nix

@@ -0,0 +1,19 @@
+{ config, values, ... }:
+{
+  services.nginx = {
+    enable = true;
+    enableReload = true;
+
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  /* security.acme = { */
+  /*   acceptTerms = true; */
+  /*   email = "felix@albrigtsen.it"; */
+  /* }; */
+}

hosts/janeway/services/postgresql.nix

@@ -0,0 +1,22 @@
+{ config, pkgs, lib, ... }:
+{
+  services.postgresql = {
+    enable = true;
+    enableTCPIP = true; # Expose on the network
+    authentication = pkgs.lib.mkOverride 10 ''
+     local all all trust
+     host all all 127.0.0.1/32 trust
+     host all all ::1/128 trust
+    '';
+  };
+
+  services.postgresqlBackup = {
+    enable = true;
+    location = "/backup/postgresql/";
+    startAt = "*-*-* 03:15:00";
+    backupAll = true;
+  };
+
+
+  environment.systemPackages = [ config.services.postgresql.package ];
+}

secrets/janeway/janeway.yaml

@@ -0,0 +1,32 @@
+matrix:
+    synapse:
+        registrationsecret: ENC[AES256_GCM,data:hXLNFkvMe21RlT1wgQvsBeyxtn+0yLK5bYUeMQbV/1bVtl6nvoInZ1qP7wz8MoWhFiAq1ZwxE2bjDfxXdkL8YSvNHlhdbFD1nJBP51mci9SQE/xLaMh7Aqtos0swdKw=,iv:uIxuhhaTpCRQQ/fP16J50cKCSbAD+KYO3a2kb70BX2M=,tag:EqD5jeZvCcJJCrBcG0YjsA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1n6j9umxfn5ekvmsrqngdhux0y994yh72sd5xdt6sxec86k4dyu9shsgjkw
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1VllZUGR6d3dpSlczS1cx
+            ejZCMEhDaDJ3ZEIxR1NWV3NXQXhDVERNUlIwCjU4TWNBbmNpc2x4MHNibVBJWk5s
+            Sk5aamZVcnZGSThLTXI1Vkh0UFVBNkUKLS0tIDdHYWhjK3pBM3VydldzdTBTcEVz
+            YUhoWTJ4SnBRb1ZzVUhxdnBCTEFnTUEK72ofuMzrLBzFmA0fO9hX5vhtzcbJse+q
+            qK1YKKv12iF1TZ9+Ty73W5Dlum51YWfUD0/BX+/QwQob9AmszlQ7vg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1nj7ju6f3jfvzw4c0sxywthjmztwp7rwqceun8xw2tlfrt7qymatser4vqf
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArWEFrN0xJY2ltcENKbzgv
+            V1BiVm9URll0QlUzVVlpV2RNNDdlcGJ5eFRrCnJabTVEVFFMK0xUalJtWjJuSnNF
+            TW5iVkl4WXp0VU5BVkZWSTdINWRBMmsKLS0tIC9aaUZWWXNKRUpnNGR4TDM1Rmpx
+            d3VYdmJjQys3NWN6KzJNSTFqQ0hOR0kKKLYpphnephuK9Pbp7yzwtGeXadYciogn
+            nQs4qiNooRGpC7wjcuwH6OUBbFsnLWrt3lQjP00Xs8uEFFtcx7wotw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-10-13T22:50:20Z"
+    mac: ENC[AES256_GCM,data:ktGFV+oNBMIKNCVLXZtrxn8HbvgjmXTRmAWuDQaNyMIIWvnTvd5IQBivG1kCimVr96RFl6RWTMWH4nqHVFlo0jxQfx8KUVXmaO7dfp4Ri+ZKMLu33HmLfwHiStnYRwPCAtwG/AXx9SXl0SAL5S+xHSl4mnShbyYfLAHibccYros=,iv:JeMtQ5uxYzpqr1eHZrLTNqhizjOCaixNg8VFcwjY2Y8=,tag:gHfRDBezAwzCqmEhayVYEg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3