summaryrefslogtreecommitdiff
path: root/Biz/Cloud
diff options
context:
space:
mode:
Diffstat (limited to 'Biz/Cloud')
-rw-r--r--Biz/Cloud/chat.nix100
-rw-r--r--Biz/Cloud/git.nix17
-rw-r--r--Biz/Cloud/hardware.nix6
-rw-r--r--Biz/Cloud/mail.nix43
-rw-r--r--Biz/Cloud/networking.nix36
-rw-r--r--Biz/Cloud/web.nix41
-rw-r--r--Biz/Cloud/znc.nix66
7 files changed, 309 insertions, 0 deletions
diff --git a/Biz/Cloud/chat.nix b/Biz/Cloud/chat.nix
new file mode 100644
index 0000000..e23b73e
--- /dev/null
+++ b/Biz/Cloud/chat.nix
@@ -0,0 +1,100 @@
+{ config, pkgs, ... }:
+#
+# a homeserver for matrix.org.
+#
+# - nixos manual: https://nixos.org/nixos/manual/index.html#module-services-matrix
+#
+# to create new users:
+#
+# nix run nixpkgs.matrix-synapse
+# register_new_matrix_user -k <registration_shared_secret> http://localhost:<matrix_port>
+#
+let
+ fqdn = "matrix.${config.networking.domain}";
+ riot = "chat.${config.networking.domain}";
+ matrix_port = 8448;
+in {
+ # matrix-synapse server. for what the settings mean, see:
+ # https://nixos.org/nixos/manual/index.html#module-services-matrix
+ #
+ services.matrix-synapse = {
+ enable = true;
+ server_name = config.networking.domain;
+ registration_shared_secret = "AkGRWSQLga3RoKRFnHhKoeCEIeZzu31y4TRzMRkMyRbBnETkVTSxilf24qySLzQn";
+ listeners = [
+ {
+ port = matrix_port;
+ bind_address = "::1";
+ type = "http";
+ tls = false;
+ x_forwarded = true;
+ resources = [
+ {
+ names = [ "client" "federation" ];
+ compress = false;
+ }
+ ];
+ }
+ ];
+ };
+ # matrix needs a database
+ #
+ services.postgresql.enable = true;
+ # web proxy for the matrix server
+ #
+ services.nginx = {
+ enable = true;
+ recommendedTlsSettings = true;
+ recommendedOptimisation = true;
+ recommendedGzipSettings = true;
+ recommendedProxySettings = true;
+ virtualHosts = {
+ # route to matrix-synapse
+ "${config.networking.domain}" = {
+ locations."= /.well-known/matrix/server".extraConfig =
+ let
+ server = { "m.server" = "${fqdn}:443"; };
+ in ''
+ add_header Content-Type application/json;
+ return 200 '${builtins.toJSON server}';
+ '';
+ locations."= /.well-known/matrix/client".extraConfig =
+ let
+ client = {
+ "m.homeserver" = { "base_url" = "https://${fqdn}"; } ;
+ "m.identity_server" = { "base_url" = "https://vector.im"; };
+ };
+ in ''
+ add_header Content-Type application/json;
+ add_header Access-Control-Allow-Origin *;
+ return 200 '${builtins.toJSON client}';
+ '';
+ };
+ # reverse proxy for matrix client-server and server-server communication
+ "${fqdn}" = {
+ enableACME = true;
+ forceSSL = true;
+ locations."/".extraConfig = ''
+ return 404;
+ '';
+ locations."/_matrix" = {
+ proxyPass = "http://[::1]:${toString matrix_port}";
+ };
+ };
+ };
+ };
+ # riot client, available at chat.simatime.com
+ #
+ # note that riot and matrix-synapse must be on separate fqdn's to
+ # protect from XSS attacks:
+ # https://github.com/vector-im/riot-web#important-security-note
+ #
+ services.nginx.virtualHosts."${riot}" = {
+ enableACME = true;
+ forceSSL = true;
+ serverAliases = [
+ "chat.${config.networking.domain}"
+ ];
+ root = pkgs.riot-web;
+ };
+}
diff --git a/Biz/Cloud/git.nix b/Biz/Cloud/git.nix
new file mode 100644
index 0000000..370f52a
--- /dev/null
+++ b/Biz/Cloud/git.nix
@@ -0,0 +1,17 @@
+{ pkgs, ... }:
+
+{
+ services = {
+ gitolite = {
+ enable = true;
+ enableGitAnnex = true;
+ dataDir = "/srv/git";
+ user = "git";
+ group = "git";
+ extraGitoliteRc = ''
+ $RC{SITE_INFO} = 'a computer is a bicycle for the mind.';
+ '';
+ adminPubkey = builtins.readFile ../keys/ben.pub;
+ };
+ };
+}
diff --git a/Biz/Cloud/hardware.nix b/Biz/Cloud/hardware.nix
new file mode 100644
index 0000000..8c88cb7
--- /dev/null
+++ b/Biz/Cloud/hardware.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+ imports = [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ];
+ boot.loader.grub.device = "/dev/vda";
+ fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; };
+}
diff --git a/Biz/Cloud/mail.nix b/Biz/Cloud/mail.nix
new file mode 100644
index 0000000..81bddc2
--- /dev/null
+++ b/Biz/Cloud/mail.nix
@@ -0,0 +1,43 @@
+{ ... }:
+
+{
+ mailserver = {
+ enable = true;
+ monitoring = {
+ enable = false;
+ alertAddress = "bsima@me.com";
+ };
+ fqdn = "simatime.com";
+ domains = [ "simatime.com" "bsima.me" ];
+ certificateScheme = 3; # let's encrypt
+ enableImap = true;
+ enablePop3 = true;
+ enableImapSsl = true;
+ enablePop3Ssl = true;
+ enableManageSieve = true;
+ virusScanning = false; # ur on ur own
+ localDnsResolver = true;
+
+ loginAccounts = {
+ "ben@simatime.com" = {
+ hashedPassword = "$6$Xr180W0PqprtaFB0$9S/Ug1Yz11CaWO7UdVJxQLZWfRUE3/rarB0driXkXALugEeQDLIjG2STGQBLU23//JtK3Mz8Kwsvg1/Zo0vD2/";
+ aliases = [
+ # my default email
+ "ben@bsima.me"
+ # admin stuff
+ "postmaster@simatime.com"
+ "abuse@simatime.com"
+ ];
+ catchAll = [ "simatime.com" "bsima.me" ];
+ quota = "5G";
+ };
+ "nick@simatime.com" = {
+ hashedPassword = "$6$31P/Mg8k8Pezy1e$Fn1tDyssf.1EgxmLYFsQpSq6RP4wbEvP/UlBlXQhyKA9FnmFtJteXsbJM1naa8Kyylo8vZM9zmeoSthHS1slA1";
+ aliases = [
+ "nicolai@simatime.com"
+ ];
+ quota = "1G";
+ };
+ };
+ };
+}
diff --git a/Biz/Cloud/networking.nix b/Biz/Cloud/networking.nix
new file mode 100644
index 0000000..d943c13
--- /dev/null
+++ b/Biz/Cloud/networking.nix
@@ -0,0 +1,36 @@
+{ lib, config, ... }:
+
+{
+ networking = {
+
+ firewall = {
+ allowedTCPPorts = [ 22 80 443 ];
+ };
+
+ # This following was populated at runtime with the networking details
+ # gathered from the active system.
+ nameservers = [
+ "67.207.67.2"
+ "67.207.67.3"
+ ];
+ defaultGateway = "159.89.128.1";
+ defaultGateway6 = "2604:a880:2:d0::1";
+ dhcpcd.enable = false;
+ usePredictableInterfaceNames = lib.mkForce true;
+ interfaces = {
+ eth0 = {
+ ipv4.addresses = [
+ { address="159.89.128.69"; prefixLength=20; }
+ { address="10.46.0.6"; prefixLength=16; }
+ ];
+ ipv6.addresses = [
+ { address="2604:a880:2:d0::35:c001"; prefixLength = 64; }
+ { address="fe80::e899:c0ff:fe9c:e194"; prefixLength = 64; }
+ ];
+ };
+ };
+ };
+ services.udev.extraRules = ''
+ ATTR{address}=="ea:99:c0:9c:e1:94", NAME="eth0"
+ '';
+}
diff --git a/Biz/Cloud/web.nix b/Biz/Cloud/web.nix
new file mode 100644
index 0000000..22d7199
--- /dev/null
+++ b/Biz/Cloud/web.nix
@@ -0,0 +1,41 @@
+{ ... }:
+
+let
+ bensIp = "73.222.221.62";
+in
+{
+ services = {
+ nginx = {
+ enable = true;
+ recommendedGzipSettings = true;
+ recommendedOptimisation = true;
+ recommendedProxySettings = true;
+ recommendedTlsSettings = true;
+ virtualHosts = {
+ "bsima.me".root = "/home/ben/public_html/";
+ "www.bsima.me".root = "/home/ben/public_html/";
+ "simatime.com".locations."/".root = "/srv/www/";
+ "firefoxsync.simatime.com".locations."/".proxyPass = "http://localhost:5001";
+ "hero.simatime.com".locations."/".proxyPass = "http://${bensIp}:3001";
+ "tv.simatime.com".locations."/".proxyPass = "http://${bensIp}:8096"; # emby runs on port 8096
+ "deluge.simatime.com".locations."/".proxyPass = "http://${bensIp}:8112";
+
+ "notebook.simatime.com".locations = {
+ "/" = {
+ proxyPass = "http://${bensIp}:3099";
+ proxyWebsockets = true;
+ extraConfig = ''
+ proxy_buffering off;
+ proxy_read_timeout 86400;
+
+ '';
+ };
+ "/(api/kernels/[^/]+/channels|terminals/websocket)/" = {
+ proxyPass = "http://${bensIp}:3099";
+ proxyWebsockets = true;
+ };
+ };
+ };
+ };
+ };
+}
diff --git a/Biz/Cloud/znc.nix b/Biz/Cloud/znc.nix
new file mode 100644
index 0000000..9b1a28d
--- /dev/null
+++ b/Biz/Cloud/znc.nix
@@ -0,0 +1,66 @@
+/*
+
+N.B.: generate znc passwords with 'nix-shell -p znc --command "znc --makepass"'
+
+- https://wiki.znc.in/Configuration
+
+*/
+
+{ ... }:
+
+{
+ services = {
+ znc = {
+ enable = true;
+ mutable = false;
+ useLegacyConfig = false;
+ openFirewall = true;
+ config = {
+ LoadModule = [ "adminlog" ];
+ User.bsima = {
+ Admin = true;
+ Nick = "bsima";
+ AltNick = "bsima1";
+ LoadModule = [ "chansaver" "controlpanel" "log" ];
+ Network.freenode = {
+ Server = "chat.freenode.net +6697";
+ LoadModule = [ "simple_away" "nickserv" "sasl" ];
+ Chan = {
+ "#ai" = {};
+ "#biz" = { Modes = "+Sp"; };
+ "#bsima" = { Modes = "+Sp"; };
+ "##categorytheory" = { Detached = true; };
+ "#clojure" = { Detached = true; };
+ "#coq" = { Detached = true; };
+ "#emacs" = { Detached = true; };
+ "#guile" = { Detached = true; };
+ "#guix" = { Detached = true; };
+ "#haskell" = {};
+ "#haskell-miso" = { Detached = true; };
+ "#hledger" = {};
+ "#hnix" = { Detached = true; };
+ "#home-manager" = { Detached = true; };
+ "#ledger" = {};
+ "#nix-darwin" = { Detached = true; };
+ "#nixos" = {};
+ "#org-mode" = {};
+ "#scheme" = { Detached = true; };
+ "#servant" = { Detached = true; };
+ "#sr.ht" = { Detached = true; };
+ "#xmonad" = { Detached = true; };
+ };
+ };
+ Network.efnet = {
+ Server = "irc.efnet.info +6697";
+ LoadModule = [ "simple_away" ];
+ };
+ Pass.password = {
+ Method = "sha256";
+ Hash = "bead16d806e7bf5cbbc31d572b20f01e2b253eb60e2497ce465df56306becd02";
+ Salt = "/GhmBMc+E6b7qd8muFEe";
+ };
+ };
+ };
+ };
+ };
+}
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-27 21:09:59 +0000