bicep/synapse: fix dbname option

Co-authored-by: Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>

base/default.nix

@@ -101,6 +101,8 @@
 
   # users.mutableUsers = lib.mkDefault false;
 
+  users.users.root.initialHashedPassword = "$y$j9T$ahP6GAdttD17OMBo7Yqeh.$Ad7qBcFvTL7HrJ9uTtrQzksN3220Nj9t/CrP6DwgK34"; # generated using mkpasswd, see huttiheita root on vaultwarden
+
   users.groups."drift".name = "drift";
 
   # Trusted users on the nix builder machines

base/services/acme.nix

@@ -8,6 +8,5 @@
   # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
   virtualisation.vmVariant = {
     security.acme.defaults.server = "https://127.0.0.1";
-    users.users.root.initialPassword = "root";
   };
 }

base/services/fluentbit.nix

@@ -62,8 +62,10 @@ in
           name = "loki";
           match = "*";
 
-          host = "ildkule.pvv.ntnu.no";
-          port = 3100;
+          host = "loki.pvv.ntnu.no";
+          port = 443;
+          tls = "on";
+          "tls.verify" = "on";
           uri = "/loki/api/v1/push";
           compress = "gzip";
 

flake.lock

@@ -189,16 +189,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1764844095,
-        "narHash": "sha256-Drf1orxsmFDzO+UbPo85gHjXW7QzAM+6oTPvI7vOSik=",
+        "lastModified": 1782122067,
+        "narHash": "sha256-95q3DiYOTHjQGbqR0I1w4ETrH+smtddqW0bBxaB/Egg=",
         "owner": "dali99",
         "repo": "nixos-matrix-modules",
-        "rev": "25b9f31ef1dbc3987b4c716de716239f2b283701",
+        "rev": "0e0fd9f6a407b08dd5e180a2ff6c3808461e2c47",
         "type": "github"
       },
       "original": {
         "owner": "dali99",
-        "ref": "v0.8.0",
+        "ref": "master",
         "repo": "nixos-matrix-modules",
         "type": "github"
       }

flake.nix

@@ -26,7 +26,7 @@
     worblehat.url = "git+https://git.pvv.ntnu.no/Projects/worblehat.git?ref=main";
     worblehat.inputs.nixpkgs.follows = "nixpkgs";
 
-    matrix-next.url = "github:dali99/nixos-matrix-modules/v0.8.0";
+    matrix-next.url = "github:dali99/nixos-matrix-modules/master";
     matrix-next.inputs.nixpkgs.follows = "nixpkgs";
 
     nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git?ref=main";

hosts/bicep/services/matrix/synapse.nix

@@ -74,7 +74,7 @@ in {
         name = "psycopg2";
         args = {
           host = "/var/run/postgresql";
-          dbname = "synapse";
+          database = "synapse";
           user = "matrix-synapse";
           cp_min = 1;
           cp_max = 5;

hosts/bicep/services/postgresql/default.nix

@@ -127,4 +127,27 @@ in
 
   networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
   networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
+
+  environment.systemPackages = [
+    (pkgs.writeShellApplication {
+      name = "postgres-update-collations.sh";
+      runtimeInputs = [
+        config.systemd.package
+        cfg.package
+      ];
+      text = ''
+        run0 --user=postgres psql <${pkgs.writeText "postgres-update-collations.sql" ''
+          CREATE FUNCTION exec(text) returns text language plpgsql volatile
+            AS $f$
+              BEGIN
+                EXECUTE $1;
+                RETURN $1;
+              END;
+          $f$;
+
+          SELECT exec('ALTER DATABASE "' || datname || '" REFRESH COLLATION VERSION') FROM pg_database WHERE datistemplate = false;
+        ''}
+      '';
+    })
+  ];
 }

hosts/ildkule/services/monitoring/loki.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, values, ... }:
 
 let
   cfg = config.services.loki;
@@ -9,8 +9,8 @@ in {
     configuration = {
       auth_enabled = false;
       server = {
-        http_listen_port = 3100;
-        http_listen_address = "0.0.0.0";
+        http_listen_port = 31832;
+        http_listen_address = "127.0.0.1";
         grpc_listen_port = 9096;
       };
 
@@ -81,5 +81,25 @@ in {
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ cfg.configuration.server.http_listen_port ];
+  services.nginx.virtualHosts."loki.pvv.ntnu.no" = {
+    forceSSL = true;
+    enableACME = true;
+    kTLS = true;
+
+    locations = {
+      "/".return = "403";
+      "/loki/api/v1/push" = {
+        proxyPass = "http://${cfg.configuration.server.http_listen_address}:${toString cfg.configuration.server.http_listen_port}/loki/api/v1/push";
+        extraConfig = ''
+          allow 127.0.0.1;
+          allow ::1;
+          allow ${values.ipv4-space};
+          allow ${values.ipv6-space};
+          allow ${values.ntnu.ipv4-space};
+          allow ${values.ntnu.ipv6-space};
+          deny all;
+        '';
+      };
+    };
+  };
 }