341 lines
10 KiB
Nix
341 lines
10 KiB
Nix
{ config, pkgs, unstable, ... }:
|
||
let
|
||
nextcloud_pw = (builtins.readFile /etc/nixos/nextcloud);
|
||
forgejo_pw = (builtins.readFile /etc/nixos/dbpw/forgejo);
|
||
matrix_pw = (builtins.readFile /etc/nixos/dbpw/matrix-synapse);
|
||
mautrix_signal_pw = (builtins.readFile /etc/nixos/dbpw/mautrix_signal);
|
||
mautrix_whatsapp_pw = (builtins.readFile /etc/nixos/dbpw/mautrix_whatsapp);
|
||
mautrix_discord_pw = (builtins.readFile /etc/nixos/dbpw/mautrix_discord);
|
||
|
||
fqdn = "matrix.${config.networking.domain}";
|
||
baseUrl = "https://${fqdn}";
|
||
clientConfig."m.homeserver".base_url = baseUrl;
|
||
serverConfig."m.server" = "${fqdn}:443";
|
||
mkWellKnown = data: ''
|
||
default_type application/json;
|
||
add_header Access-Control-Allow-Origin *;
|
||
return 200 '${builtins.toJSON data}';
|
||
'';
|
||
in
|
||
{
|
||
networking.hostName = "dashie";
|
||
networking.domain = "dashie.org";
|
||
imports = [
|
||
./hardware-configuration.nix
|
||
./mautrix-whatsapp.nix
|
||
./mautrix-discord.nix
|
||
];
|
||
|
||
# Use the systemd-boot EFI boot loader.
|
||
boot.loader.systemd-boot.enable = true;
|
||
boot.loader.efi.canTouchEfiVariables = true;
|
||
boot.supportedFilesystems = [ "ntfs" ];
|
||
|
||
# Set your time zone.
|
||
time.timeZone = "Europe/Zurich";
|
||
|
||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||
users.users.root.hashedPassword = "!";
|
||
users.users.dashie = {
|
||
isNormalUser = true;
|
||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||
packages = [
|
||
unstable.neovim
|
||
pkgs.fuse
|
||
pkgs.ntfs3g
|
||
pkgs.rsync
|
||
];
|
||
openssh.authorizedKeys.keyFiles = [
|
||
/home/dashie/server.pub
|
||
];
|
||
};
|
||
|
||
services.openssh = {
|
||
enable = true;
|
||
settings.PasswordAuthentication = false;
|
||
};
|
||
services.mautrix-whatsapp-dashie.enable = true;
|
||
services.mautrix-discord-dashie.enable = true;
|
||
services.matrix-synapse.enable = true;
|
||
services.mautrix-signal.enable = true;
|
||
services.matrix-synapse.settings = {
|
||
server_name = "matrix.dashie.org";
|
||
database.name = "psycopg2";
|
||
database.args.user = "matrix-synapse";
|
||
database.args.password = "${matrix_pw}";
|
||
public_baseurl = "https://matrix.dashie.org";
|
||
enable_registration = true;
|
||
enable_registration_without_verification = true;
|
||
suppress_key_server_warning = true;
|
||
max_upload_size = "1G";
|
||
listeners = [
|
||
{
|
||
port = 8008;
|
||
bind_addresses = [ "::1" ];
|
||
type = "http";
|
||
tls = false;
|
||
x_forwarded = true;
|
||
resources = [
|
||
{
|
||
names = [ "client" "federation" ];
|
||
compress = true;
|
||
}
|
||
];
|
||
}
|
||
];
|
||
};
|
||
services.mautrix-whatsapp-dashie.settings = {
|
||
appservice = {
|
||
id = "whatsapp";
|
||
database = {
|
||
type = "postgres";
|
||
uri = "postgresql:///mautrix_whatsapp?host=/run/postgresql&sslmode=disable&user=mautrix_whatsapp&password=${mautrix_whatsapp_pw}";
|
||
};
|
||
};
|
||
bridge = {
|
||
encryption = {
|
||
allow = true;
|
||
default = true;
|
||
required = true;
|
||
};
|
||
displayname_template = "{{if .BusinessName}}{{.BusinessName}}{{else if .PushName}}{{.PushName}}{{else}}{{.JID}}{{end}}";
|
||
permissions = {
|
||
"@fabio.lenherr:matrix.org" = "admin";
|
||
"@dashie:matrix.dashie.org" = "admin";
|
||
};
|
||
};
|
||
};
|
||
services.mautrix-signal.settings = {
|
||
appservice = {
|
||
id = "signal";
|
||
database = {
|
||
type = "postgres";
|
||
uri = "postgresql:///mautrix_signal?host=/run/postgresql&sslmode=disable&user=mautrix_signal&password=${mautrix_signal_pw}";
|
||
};
|
||
};
|
||
bridge = {
|
||
encryption = {
|
||
allow = true;
|
||
default = true;
|
||
required = true;
|
||
};
|
||
displayname_template = "{{or .ProfileName .PhoneNumber \"Unknown user\"}}";
|
||
permissions = {
|
||
"@fabio.lenherr:matrix.org" = "admin";
|
||
"@dashie:matrix.dashie.org" = "admin";
|
||
};
|
||
};
|
||
};
|
||
services.mautrix-discord-dashie.settings = {
|
||
appservice = {
|
||
id = "discord";
|
||
database = {
|
||
type = "postgres";
|
||
uri = "postgresql:///mautrix_discord?host=/run/postgresql&sslmode=disable&user=mautrix_discord&password=${mautrix_discord_pw}";
|
||
};
|
||
};
|
||
bridge = {
|
||
displayname_template = "{{or .GlobalName .Username}}{{if .Bot}} (bot){{end}}";
|
||
permissions = {
|
||
"@fabio.lenherr:matrix.org" = "admin";
|
||
"@dashie:matrix.dashie.org" = "admin";
|
||
};
|
||
};
|
||
};
|
||
services.nginx = {
|
||
enable = true;
|
||
recommendedGzipSettings = true;
|
||
recommendedOptimisation = true;
|
||
recommendedProxySettings = true;
|
||
recommendedTlsSettings = true;
|
||
};
|
||
services.nginx.virtualHosts."dashie.org" = {
|
||
addSSL = true;
|
||
enableACME = true;
|
||
root = "/var/www/dashie.org/";
|
||
};
|
||
security.acme.certs."dashie.org".extraDomainNames = [ "cloud.dashie.org" "matrix.dashie.org" "git.dashie.org" "navi.dashie.org" ];
|
||
services.nginx.virtualHosts."cloud.dashie.org" = {
|
||
addSSL = true;
|
||
enableACME = true;
|
||
locations."/*".proxyPass = "http://127.0.0.1:12002";
|
||
};
|
||
services.nginx.virtualHosts."git.dashie.org" = {
|
||
forceSSL = true;
|
||
enableACME = true;
|
||
locations."/".proxyPass = "http://127.0.0.1:3000";
|
||
};
|
||
services.nginx.virtualHosts."navi.dashie.org" = {
|
||
addSSL = true;
|
||
enableACME = true;
|
||
locations."/".proxyPass = "http://127.0.0.1:4533";
|
||
};
|
||
|
||
services.nginx.virtualHosts."localhost" = {
|
||
listen = [
|
||
{
|
||
addr = "0.0.0.0";
|
||
port = 8448;
|
||
}
|
||
];
|
||
locations."/".proxyPass = "http://[::1]:8008";
|
||
};
|
||
|
||
services.nginx.virtualHosts."matrix.dashie.org" = {
|
||
forceSSL = true;
|
||
enableACME = true;
|
||
locations."/".extraConfig = ''
|
||
return 404;
|
||
'';
|
||
locations."/_matrix" = {
|
||
proxyPass = "http://[::1]:8008";
|
||
};
|
||
locations."/_synapse/client".proxyPass = "http://[::1]:8008";
|
||
|
||
locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
|
||
# This is usually needed for homeserver discovery (from e.g. other Matrix clients).
|
||
# Further reference can be found in the upstream docs at
|
||
# https://spec.matrix.org/latest/client-server-api/#getwell-knownmatrixclient
|
||
locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
|
||
extraConfig =
|
||
"client_max_body_size 2G;"
|
||
;
|
||
};
|
||
|
||
services.nextcloud.enable = true;
|
||
services.nextcloud.hostName = "cloud.dashie.org";
|
||
services.nextcloud.https = true;
|
||
services.nextcloud.config = {
|
||
adminpassFile = "/etc/nixos/file2";
|
||
dbuser = "nextcloud";
|
||
dbhost = "/run/postgresql";
|
||
dbname = "nextcloud";
|
||
dbtype = "pgsql";
|
||
dbpassFile = "/etc/nixos/nextcloud";
|
||
};
|
||
services.nextcloud.settings = {
|
||
port = 12001;
|
||
trusted_domains = [ "cloud.dashie.org" "192.168.1.23" ];
|
||
};
|
||
services.forgejo = {
|
||
enable = true;
|
||
database.passwordFile = /etc/nixos/dbpw/forgejo;
|
||
settings = {
|
||
server.DOMAIN = "git.dashie.org";
|
||
server.SSH_PORT = 12008;
|
||
server.SSH_LISTEN_PORT = 12008;
|
||
server.START_SSH_SERVER = true;
|
||
service.DISABLE_REGISTRATION = true;
|
||
};
|
||
};
|
||
services.navidrome.enable = true;
|
||
services.navidrome.settings = {
|
||
MusicFolder = "/var/lib/nextcloud/data/DashieTM/files/Share/Music";
|
||
};
|
||
systemd.services."nextcloud-setup" = {
|
||
requires = [ "postgresql.service" ];
|
||
after = [ "postgresql.service" ];
|
||
};
|
||
services.postgresql = {
|
||
enable = true;
|
||
authentication = pkgs.lib.mkOverride 10 ''
|
||
#type database DBuser auth-method
|
||
local all all trust
|
||
host all all 127.0.0.1/32 trust
|
||
host all all ::1/128 trust
|
||
'';
|
||
initialScript = pkgs.writeText "backend-initScript" ''
|
||
CREATE DATABASE nextcloud;
|
||
CREATE USER nextcloud WITH ENCRYPTED PASSWORD '${nextcloud_pw}';
|
||
GRANT ALL PRIVILEGES ON DATABASE nextcloud TO nextcloud;
|
||
|
||
CREATE DATABASE forgejo;
|
||
CREATE USER forgejo WITH ENCRYPTED PASSWORD '${forgejo_pw}';
|
||
GRANT ALL PRIVILEGES ON DATABASE forgejo TO forgejo;
|
||
|
||
|
||
CREATE USER "matrix-synapse" WITH ENCRYPTED PASSWORD '${matrix_pw}'
|
||
SELECT 'CREATE DATABASE "matrix-synapse" LOCALE "C" ENCODING UTF8 TEMPLATE template0 OWNER "matrix-synapse"'
|
||
WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'matrix-synapse')\gexec
|
||
|
||
CREATE USER mautrix_whatsapp WITH ENCRYPTED PASSWORD '${mautrix_whatsapp_pw}'
|
||
SELECT 'CREATE DATABASE "mautrix_whatsapp" LOCALE "C" ENCODING UTF8 TEMPLATE template0 OWNER "mautrix_whatsapp"'
|
||
WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'mautrix_whatsapp')\gexec
|
||
|
||
CREATE USER mautrix_signal WITH ENCRYPTED PASSWORD '${mautrix_signal_pw}'
|
||
SELECT 'CREATE DATABASE "mautrix_signal" LOCALE "C" ENCODING UTF8 TEMPLATE template0 OWNER "mautrix_signal"'
|
||
WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'mautrix_signal')\gexec
|
||
|
||
CREATE USER mautrix_discord WITH ENCRYPTED PASSWORD '${mautrix_discord_pw}'
|
||
SELECT 'CREATE DATABASE "mautrix_discord" LOCALE "C" ENCODING UTF8 TEMPLATE template0 OWNER "mautrix_discord"'
|
||
WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'mautrix_discord')\gexec
|
||
'';
|
||
};
|
||
security.acme = {
|
||
acceptTerms = true;
|
||
defaults.email = "fabio.lenherr@gmail.com";
|
||
};
|
||
|
||
networking.firewall = {
|
||
enable = true;
|
||
allowedTCPPorts = [ 22 80 443 4534 8448 12002 12004 12006 12008 ];
|
||
};
|
||
networking.firewall.allowPing = true;
|
||
services.samba = {
|
||
enable = true;
|
||
securityType = "user";
|
||
openFirewall = true;
|
||
extraConfig = ''
|
||
workgroup = WORKGROUP
|
||
server string = smbnix
|
||
netbios name = smbnix
|
||
security = user
|
||
#use sendfile = yes
|
||
max protocol = smb3
|
||
# note: localhost is the ipv6 localhost ::1
|
||
hosts allow = 192.168.1. 127.0.0.1 localhost
|
||
hosts deny = 0.0.0.0/0
|
||
guest account = nobody
|
||
map to guest = bad user
|
||
'';
|
||
shares = {
|
||
public = {
|
||
path = "/mnt/Shares/Public";
|
||
browseable = "yes";
|
||
"read only" = "no";
|
||
"guest ok" = "yes";
|
||
"create mask" = "0644";
|
||
"directory mask" = "0755";
|
||
};
|
||
};
|
||
};
|
||
services.samba-wsdd = {
|
||
enable = true;
|
||
openFirewall = true;
|
||
};
|
||
services.cron = {
|
||
enable = true;
|
||
systemCronJobs = [
|
||
"0 4 * * FRI nobody rsync -ato /var/lib/nextcloud/data /mnt/dump3/nextcloud"
|
||
"0 4 * * FRI nobody pg_dympall > /mnt/dump3/sqdump.sql"
|
||
];
|
||
};
|
||
|
||
hardware.cpu.intel.updateMicrocode = true;
|
||
system.stateVersion = "24.05";
|
||
|
||
nix = {
|
||
extraOptions = ''
|
||
!include ${config.sops.secrets.access.path}
|
||
'';
|
||
};
|
||
|
||
sops = {
|
||
gnupg = {
|
||
home = "~/.gnupg";
|
||
sshKeyPaths = [ ];
|
||
};
|
||
defaultSopsFile = ../secrets/secrets.yaml;
|
||
secrets.access = { };
|
||
};
|
||
}
|