diff options
| -rw-r--r-- | flake.lock | 51 | ||||
| -rw-r--r-- | flake.nix | 4 | ||||
| -rw-r--r-- | hosts/apocalypse/default.nix | 8 | ||||
| -rw-r--r-- | hosts/omega-relay/default.nix | 42 | ||||
| -rw-r--r-- | inventory.nix | 2 | ||||
| -rw-r--r-- | modules/vpn.nix | 8 | ||||
| -rw-r--r-- | secrets/omega-relay/livekit_keys.bin | 26 | ||||
| -rw-r--r-- | secrets/omega-relay/secrets.yaml | 45 | ||||
| -rw-r--r-- | services/continuwuity.nix | 226 | ||||
| -rw-r--r-- | services/mail2.nix | 1 |
10 files changed, 310 insertions, 103 deletions
@@ -28,11 +28,11 @@ ] }, "locked": { - "lastModified": 1785306346, - "narHash": "sha256-DScBkW0fOgpGPK2trNoX3ryLTlaC14+gglFo/BhGJ4g=", + "lastModified": 1785496534, + "narHash": "sha256-EASdusMYLuPhOCrE3LmsAGOvGhX3vnKBLxFvj9lI8tU=", "owner": "nix-community", "repo": "home-manager", - "rev": "e705714e918c3b11affcdd15db2cbe3a070420a0", + "rev": "e8827fbbb12015a8dd9f66285aec79d655bcb9f6", "type": "github" }, "original": { @@ -43,11 +43,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1785318670, - "narHash": "sha256-dN6Ou5x/+23FZLEpYP3IffO+NyJFzUlGumt1uu3MMaY=", + "lastModified": 1785454630, + "narHash": "sha256-LQy14TZp77TwbQf40gg1V3jo8FwJG0jGDkAH+zRHqg8=", "owner": "nixos", "repo": "nixpkgs", - "rev": "0954f7ee2f6bb3dc7d4e3d0d8bcb8fd4bde4cfc5", + "rev": "1559d3daa3ecc813a650b79375ea61b6741b8746", "type": "github" }, "original": { @@ -59,11 +59,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1784432872, - "narHash": "sha256-n3gKTBIV4ZA5VQpUakffBe3KGu4+mhPoA34rrqS0GkA=", + "lastModified": 1785386831, + "narHash": "sha256-sPS3CaXH8RAT3FZRuy4VcV47iuYIWMMfa0GbyJKC3o4=", "owner": "nixos", "repo": "nixpkgs", - "rev": "fd1462031fdee08f65fd0b4c6b64e22239a77870", + "rev": "21ea275a7c46aef9d4d6ddc962e6d562e9d94183", "type": "github" }, "original": { @@ -75,11 +75,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1784497964, - "narHash": "sha256-vlHUuqAcbcH2RKmHbPiuQzbv1pnzzavXnI62RD0bqCU=", + "lastModified": 1785454630, + "narHash": "sha256-LQy14TZp77TwbQf40gg1V3jo8FwJG0jGDkAH+zRHqg8=", "owner": "nixos", "repo": "nixpkgs", - "rev": "241313f4e8e508cb9b13278c2b0fa25b9ca27163", + "rev": "1559d3daa3ecc813a650b79375ea61b6741b8746", "type": "github" }, "original": { @@ -126,17 +126,14 @@ "treefmt-nix": "treefmt-nix" }, "locked": { - "lastModified": 1784587573, - "narHash": "sha256-U4H4MEWKWiprceDxulC45Byodszrvby9J3vbPT7mBSE=", - "owner": "Wilkuu-2", - "repo": "stalwart-nix", - "rev": "dc46a8fd741c320089c9d5fb8eef527c0a928f95", - "type": "github" + "lastModified": 1785513083, + "narHash": "sha256-MtGYzlIWhV8xQRkQhIz5eaxbbWeh7W3qRbkgvIIry6M=", + "path": "/store2/code/stalwart-nix", + "type": "path" }, "original": { - "owner": "Wilkuu-2", - "repo": "stalwart-nix", - "type": "github" + "path": "/store2/code/stalwart-nix", + "type": "path" } }, "treefmt-nix": { @@ -147,11 +144,11 @@ ] }, "locked": { - "lastModified": 1784369104, - "narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=", + "lastModified": 1785360170, + "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=", "owner": "numtide", "repo": "treefmt-nix", - "rev": "df3c0640565d04a0261253cdd89fce78ec50168a", + "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0", "type": "github" }, "original": { @@ -167,11 +164,11 @@ ] }, "locked": { - "lastModified": 1784369104, - "narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=", + "lastModified": 1785360170, + "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=", "owner": "numtide", "repo": "treefmt-nix", - "rev": "df3c0640565d04a0261253cdd89fce78ec50168a", + "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0", "type": "github" }, "original": { @@ -7,8 +7,8 @@ stalwart-nix = { # local testing - # url = "path:/store2/code/stalwart-nix"; - url = "github:Wilkuu-2/stalwart-nix"; + url = "path:/store2/code/stalwart-nix"; + # url = "github:Wilkuu-2/stalwart-nix"; # Letting stalwart-nix using it's own nixpkgs prevents unnecessary rebuilds at the cost of some disk space. # inputs.nixpkgs.follows = "nixpkgs"; # inputs.treefmt-nix.follows = "treefmt-nix"; diff --git a/hosts/apocalypse/default.nix b/hosts/apocalypse/default.nix index 238ab09..261cb49 100644 --- a/hosts/apocalypse/default.nix +++ b/hosts/apocalypse/default.nix @@ -1,4 +1,4 @@ -{ lib, ... }: +{ lib, pkgs, ... }: { imports = [ ./hardware-configuration.nix @@ -22,9 +22,13 @@ }; wilkuu.mjmap = { - enable = true; + enable = false; # users = ["wilkuu"]; }; + environment.systemPackages = with pkgs; [ + mjmap + freecad-wayland + ]; ## Addons for this system addons = { desktop.hyprland.enable = false; diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix index 79543c3..2e528ae 100644 --- a/hosts/omega-relay/default.nix +++ b/hosts/omega-relay/default.nix @@ -215,8 +215,48 @@ }; networking.hostName = "omega-relay"; - services.resolved = { + users.groups.unbound = {}; + services.unbound = { + enable = true; + group = "unbound"; + localControlSocketPath = "/run/unbound/unbound.ctl"; + settings = { + server = let lan_domains = ["home" "home.arpa" "wilkuu" "lan"]; in { + qname-minimisation = true; + private-domain = lan_domains; + domain-insecure = lan_domains; + unblock-lan-zones = true; + insecure-lan-zones = true; + }; + + forward-zone = [ + # { + # name = "home.wilkuu.xyz."; + # TODO: Maybe move the responsibility of home zones to omega-relay + # forward-addr = [ + # "192.168.88.1" + # ]; + # } + { + name = "."; + forward-tls-upstream = true; + forward-addr = [ + "1.1.1.1@853#cloudflare-dns.com" + "1.0.0.1@853#cloudflare-dns.com" + "8.8.8.8@853#dns.google" + "8.8.4.4@853#dns.google" + ]; + }]; + + }; + }; + services.prometheus.exporters.unbound = { enable = true; + + }; + + services.resolved = { + enable = lib.mkForce false; settings.Resolve.DNSOverTLS = "opportunistic"; }; diff --git a/inventory.nix b/inventory.nix index a476191..3e89531 100644 --- a/inventory.nix +++ b/inventory.nix @@ -12,6 +12,8 @@ "wireguard" "fail2ban" "node" + "systemd" + "unbound" ]; }; interfaces = { diff --git a/modules/vpn.nix b/modules/vpn.nix index e0edecc..b8d198b 100644 --- a/modules/vpn.nix +++ b/modules/vpn.nix @@ -17,7 +17,10 @@ in }; config = lib.mkMerge [ - ({ services.mullvad-vpn.enable = opt-mullvad.enable; }) + ({ + services.mullvad-vpn.enable = opt-mullvad.enable; + services.mullvad-vpn.gui.enable = opt-mullvad.enable && desktop.enable; + }) (lib.mkIf cfg.eduvpn.enable { networking.networkmanager.plugins = [ pkgs.networkmanager-openvpn ]; }) @@ -33,9 +36,6 @@ in }) (lib.mkIf desktop.enable ( lib.mkMerge [ - (lib.mkIf opt-mullvad.enable { - services.mullvad-vpn.package = pkgs.mullvad-vpn; - }) (lib.mkIf cfg.eduvpn.enable { environment.systemPackages = with pkgs; [ eduvpn-client diff --git a/secrets/omega-relay/livekit_keys.bin b/secrets/omega-relay/livekit_keys.bin new file mode 100644 index 0000000..81a9331 --- /dev/null +++ b/secrets/omega-relay/livekit_keys.bin @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:0J4WjKCxD5ptnYyQgkKcMMpJz6Xpbf8FWapFB/2pi2GZUqaAV1Vm5eJb1jooN/TL0UqjafjKJ3yGAyryHA==,iv:gN6DTbiuqlKoQxhScQUhPNIUAtoxZAyhsb8wbJYQLH4=,tag:Ws1Y8gScGmEc7+NcEH4Bzw==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsOGFOdnVJT0RiSGxybnlq\nRlR2UGxvWmtiTnJIbWh1Tk13dE5Fc2w4cXljCnJJSkFab2d1UkpNTW02dkhFeW55\nRjVTazBxMFB5b1IreE1SSlNWS2ppNkEKLS0tIFRSazJBTzhabFZXSVNieGRlbk5Q\nV1JoK2gyNUFmeVZMM0xYNTlNNnI3U0UKHQLMbltd9qZ4skIjZQe4VkZZclS9sDNG\nCCubUWS2wP7QxvMDY5M0xLrTudoGCyA3WHR6r0xiEWXeExGbGVrBTw==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVdkZvTE5OUVF1eElJZ2ta\nUHFZL1hjL3RYOGNZcG1Xb1pXUFVqbG80aGdvCktoS3FnTmVKWE03NjlrWWpmTHBm\nQkR2cmZRd2QyVFNYN0F0cGkzck5GNlEKLS0tIEpXV1d0R0ZTOEZMMm5BeHNKclo3\nNjdKMXpKUmh5VTZhaHpDSy91M2QvbncK/nQIXhfYh+wp4z7EIuXXdBoD8X+5/Hw6\nN/Vm6Zf8p6veFDyQmb7Z9FF4qpCghljBwg6+wSh14HZTgThnPFDnqw==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1n20lpr5x2aep3l3ta62x2c9cnuz3m495f2dmguqs08ezlqgu4vwsqfskyg" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWQ2NaL1pyOFRSUlI5RTYz\nL0s3bTVrT2wzYTdDYTRRTU9VOFVnQ2dGVUI0CnlrUUg2UXpGMkxYZXNsUEdJTndE\nNHBEdlMwYjhHNTI5NVlIS1RjbUhmQ3MKLS0tIFNDQnJXVXBYM2dBK2ozdnFKRG5p\nZ2Z3Wk8wYWtsNUVwSG9lT1hNcDQ1cm8KiPQLh3iM7k3uyuPJFEqIDKpauHYv9rn0\nm0ZL9w4FEm9PXyONmouhDteofoSDDLWhPNmgLt0hMHRgYhCbjsK/Ww==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age13x9grwfpqjgvjfcnwg5snuntp5emze85hqc8qwuz9nfphfe2pg4skl29r4" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5UGxRWTE0Q0VaU1UxVFpC\nWDllclpDbEJubkEwa1NJb2NTUXZ1L1NRdjMwCkdLTUtaSGMrV1VWKzRMcCtvOUpa\nZE94bEFpTDE2a0o4V05mSEhqaTJUc1EKLS0tIHQ1bk5xTXVyZEozRTRDVEQrSjE3\ncmdkZGI1ZFo2eEZDbXFnUmJHUE5CZUkKJcGJLM2dv8v0pMoBeiV+ZjLUNIbqpTh6\nwsFCby8oo8BLI/qyrDDd20NMkCazMgqSZXlae0rIkb/RX+yoPtvm4Q==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age18u22lycxtcasvlm298qwzwuc97z56kkhw8ssy9yx4gzlkskuwpyqdz80g4" + } + ], + "lastmodified": "2026-08-03T20:39:16Z", + "mac": "ENC[AES256_GCM,data:Ps5IhV/kiTnx97WjP2559/w8G+3Fo/2tFh1vK6mfr1j0G+i8PH8xs8pPut7y/LZncK4554dhyg9l/ZwlSDRq3GWmQZSJ/6HDFOZrv1tRmoxElLhK1GzlcY5uXIwc7VBMVAMvGjFw8GhHkAT1rlm2/qWt32a7m+YXz3KSUmJNTFQ=,iv://x8tP9dAeSjs2aYdAesUM/qA1J5Ju6az9LlOHxUIA0=,tag:C2AUgpMCfKIti3+l0MOLlg==,type:str]", + "version": "3.13.3" + } +} diff --git a/secrets/omega-relay/secrets.yaml b/secrets/omega-relay/secrets.yaml new file mode 100644 index 0000000..97c4802 --- /dev/null +++ b/secrets/omega-relay/secrets.yaml @@ -0,0 +1,45 @@ +continuwuity: + livekit-secrets: + lk-jwt-service: ENC[AES256_GCM,data:SjmivFrB4k5p6XILvR1gG5nDfovK1gujETEPwkm3Cz1FsxbVVkr29YPKvvA=,iv:Pxr7txJEXMFgRsAZrh7f4TBWn/9DKwInTmSpkdn3mFc=,tag:laNCg+K3PfUhuslUL5h86w==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNa0M5SHpsZjE0dm42RGdi + R2EvMWZBU3hYWW54VTdjaW84RTB5VWR6MXhNCjNWUWEvMHVoRmFzSFZJKzBybkV6 + T0txdWxMNzBBUjVGN2pUcU1WWUhKWFUKLS0tIERBS3NtVzIxME9PMlJhY2Fmb2pk + NnpnK1dzWDZSTGh5b0hJbnMwRklLMjQKu7jzl0dlFPnsXIVhYtI2Lw+Sio4lr8+w + rzUO96W4cjeWsDjyGP/JkfEDiMDpnvkGoT62xLaRameP2T5OBf3KFQ== + -----END AGE ENCRYPTED FILE----- + recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUL25IU3dGSCtPcHQxWkxn + eXZ4bEtyN3dPWmNrMTB5OFFxampjZm4rSzJzCjd3Rysyd2d3djJMamFUZ1c0S2hh + azNiRm9EaFBDNnBEekFrTlNyK1NPZVEKLS0tIGZJZytkc1JLYlYxdy81VWNqbVRw + MTB2NWlmeC93VjYrU044L2NPcGxMZVkKPQbTfk3b/0yhK8K+zU7sIzMabeeNP4va + nINrsVV/KVfb5u8/4NwRZL7dExK8ts+DS3a+UvX01jA0Tmh1prKoew== + -----END AGE ENCRYPTED FILE----- + recipient: age1n20lpr5x2aep3l3ta62x2c9cnuz3m495f2dmguqs08ezlqgu4vwsqfskyg + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZeExkVmZYMTM5bkZxa3ZF + dGFnVXRORUF4bkErMXFuNUlETUR6K1VBckdFCjZPZXBoaUdwMk52M1pyMFVmd2Qv + cW84M0ZnQVFPZUdmUzR1R0JvMHBlL0kKLS0tIFZ4NjBHeWlTSS9lOW84elBSWWRD + bUp5UVN3UWhhdVIxOG9zK1lISGNLT3cKLFALeIyQV0lsCKZPT8hkKVK8YOocYoND + rOimM6BUeLPNxNldd0ZkMdeR1MLoO7UBamEyImQq7JLZFMueIsauiQ== + -----END AGE ENCRYPTED FILE----- + recipient: age13x9grwfpqjgvjfcnwg5snuntp5emze85hqc8qwuz9nfphfe2pg4skl29r4 + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLVkM5V05wc296M24vMXNM + dmp6Vnd3ZjFMcnUwbGJaTWNIUTkxUUtLVDNnCjZ4SHh3TnRBVDMzZkZhOW1lMS9P + QjN1WGVhSG9hc0R5TW1WZXJvNVI1ZjQKLS0tIGRSMkR3L1dXL2VhSWdGL0ZzR2l2 + Z1NSOVR0TTkzSlZTeEgraWpqRFpFU0kKbG3FleJ2zYRsFTvz7GfC7aIvnOnTZuHp + TUX9ahneGJXLswxWCeTPOINPc43dwtRW/RExMH4pItHHGfojO1e6+Q== + -----END AGE ENCRYPTED FILE----- + recipient: age18u22lycxtcasvlm298qwzwuc97z56kkhw8ssy9yx4gzlkskuwpyqdz80g4 + lastmodified: "2026-08-03T20:36:29Z" + mac: ENC[AES256_GCM,data:hfFOsNqrI3D9/on1f359G6fbpn+n9TyfI9o/fOjNd7cznZtMOYX2tytDpyROIdmTHbzJcraNtqzf7AzYUXH2Cd+2vzssA0tI6qAfjGM91AL+T32szxWIyXZH+z2pb8OIA/SrDvaxp8hM9CtQqa2+EJm5XF1TXPKuAixAAeZeuWk=,iv:OHqJJJoBNw2FLfjt2Gjax1I3PtFrNfzotejiEPb0xz4=,tag:y27z9w5r4uyuVol6P5Tc4w==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.3 diff --git a/services/continuwuity.nix b/services/continuwuity.nix index 99ff392..2135c0f 100644 --- a/services/continuwuity.nix +++ b/services/continuwuity.nix @@ -12,10 +12,18 @@ in options.wilkuu.services.continuwuity = { host-domain = mkOption { type = types.str; - default = "matrix.${hostname}.local"; + default = "matrix.${cfg.fdqn}"; example = "matrix.wilkuu.xyz"; description = "The hosting address of the server"; }; + + livekit-domain = mkOption { + type = types.str; + default = "lk.${cfg.fdqn}"; + example = "matrix.wilkuu.xyz"; + description = "The hosting address of the server"; + }; + fdqn = mkOption { type = types.str; default = "${hostname}.local"; @@ -40,84 +48,168 @@ in description = "The trusted matrix servers."; }; + networkLayer = mkOption { + type = types.str; + default = "external"; + example = "internal"; + description = "layer for the firewall"; + }; + }; - config = lib.mkIf cfg.enable { - services.matrix-continuwuity = { - enable = cfg.enable; - # package = inputs.continuwuity.packages.${pkgs.stdenv.hostPlatform.system}.default; - settings.global = { - # Hosted at cfg.domain, server fdqn is fdqn. - server_name = cfg.fdqn; - # Remove the trans flag, it is a nice feature but not my style. - new_user_displayname_suffix = ""; + config = lib.mkIf cfg.enable ( + let + keyFile = config.sops.secrets."continuwuity/livekit-keys".path; + keyGroup = "lk-keys"; + in + { + users.groups.${keyGroup} = { }; + sops.secrets."continuwuity/livekit-keys" = { + sopsFile = ../secrets/${config.networking.hostName}/livekit_keys.bin; + group = keyGroup; + key = ""; + format = "binary"; + }; - # Configure matrix stuffs - allow_registration = cfg.allowRegistration; - allow_encryption = true; - allow_federation = cfg.allowFederation; - trusted_servers = cfg.trustedServers; + wilkuu.firewall.layers.${cfg.networkLayer} = { + allowedTCPPorts = [ 7881 ]; + allowedUDPPortRanges = [ + { + from = 42000; + to = 42069; + } + ]; + }; + services.livekit = { + enable = true; + inherit keyFile; + settings = { + port = 10004; + # bind_addresses = [ "0.0.0.0" ]; + rtc = { + tcp_port = 7881; + port_range_start = 42000; + port_range_end = 42069; + }; + }; + }; - ip_lookup_strategy = 4; + # Ensure access to secrets + systemd.services.livekit.serviceConfig.SupplementaryGroups = [ keyGroup ]; + systemd.services.lk-jwt-service.serviceConfig.SupplementaryGroups = [ keyGroup ]; - # Host the server on a unix-socket and use nginx to connect to that socket. - address = null; - unix_socket_path = "/run/continuwuity/continuwuity.sock"; - unix_socket_perms = 660; + services.lk-jwt-service = { + enable = true; + port = 10003; + livekitUrl = "wss://${cfg.livekit-domain}"; + inherit keyFile; + }; + systemd.services.lk-jwt-service.environment = { + LIVEKIT_JWT_BIND = lib.mkForce "127.0.0.1:10003"; + LIVEKIT_FULL_ACCESS_HOMESERVERS = "wilkuu.xyz"; + }; - # You can run this once to create a user called harbinger which is admin. - # This might not be needed to bootstrap c10y in the later versions. - # It will crash c10y if the user already exists (Idk what the workaround is) - # admin_execute = [ - # "users create-user harbinger" - # "users make-user-admin harbinger" - # ]; + services.matrix-continuwuity = { + enable = cfg.enable; + # package = inputs.continuwuity.packages.${pkgs.stdenv.hostPlatform.system}.default; + settings.global = { + # Hosted at cfg.domain, server fdqn is fdqn. + server_name = cfg.fdqn; + # Remove the trans flag, it is a nice feature but not my style. + new_user_displayname_suffix = ""; - url_preview_domain_explicit_allowlist = [ - "i.imgur.com" - "cdn.discordapp.com" - "ooye.elisaado.com" - "media.tenor.com" - "media1.tenor.com" - "tenor.com" - "giphy.com" - "cdn.nest.rip" - "ssd-cdn.nest.rip" - "i.github.com" - "github.com" - "wilkuu.xyz" - ]; + # Configure matrix stuffs + allow_registration = cfg.allowRegistration; + allow_encryption = true; + allow_federation = cfg.allowFederation; + trusted_servers = cfg.trustedServers; + + ip_lookup_strategy = 4; + + # Host the server on a unix-socket and use nginx to connect to that socket. + address = null; + unix_socket_path = "/run/continuwuity/continuwuity.sock"; + unix_socket_perms = 660; + + # You can run this once to create a user called harbinger which is admin. + # This might not be needed to bootstrap c10y in the later versions. + # It will crash c10y if the user already exists (Idk what the workaround is) + # admin_execute = [ + # "users create-user harbinger" + # "users make-user-admin harbinger" + # ]; + + url_preview_domain_explicit_allowlist = [ + "i.imgur.com" + "cdn.discordapp.com" + "ooye.elisaado.com" + "media.tenor.com" + "media1.tenor.com" + "tenor.com" + "giphy.com" + "cdn.nest.rip" + "ssd-cdn.nest.rip" + "i.github.com" + "github.com" + "wilkuu.xyz" + ]; - # well-known setup - well_known = { - client = "https://${cfg.host-domain}"; - server = "${cfg.host-domain}:443"; - support_email = "jakub@wilkuu.xyz"; + # well-known setup + well_known = { + client = "https://${cfg.host-domain}"; + server = "${cfg.host-domain}:443"; + support_email = "jakub@wilkuu.xyz"; + }; + + # allow livekit/matrix_rtc + matrix_rtc.foci = [ + { + type = "livekit"; + livekit_service_url = "https://${cfg.livekit-domain}"; + } + ]; }; }; - }; - services.nginx.virtualHosts = - let - socket = "http://unix://${config.services.matrix-continuwuity.settings.global.unix_socket_path}"; - in - { - # well-known discovery - # TODO: Might need to enforce https here, if it already is not. - ${cfg.fdqn}.locations."/.well-known/matrix/".proxyPass = socket; + services.nginx.virtualHosts = + let + socket = "http://unix://${config.services.matrix-continuwuity.settings.global.unix_socket_path}"; + in + { + # well-known discovery + # TODO: Might need to enforce https here, if it already is not. + ${cfg.fdqn}.locations."/.well-known/matrix/".proxyPass = socket; - # The matrix server - ${cfg.host-domain} = { - enableACME = cfg.doACME; - forceSSL = cfg.doACME; + ${cfg.livekit-domain} = { + forceSSL = cfg.doACME; + useACMEHost = lib.mkIf cfg.doACME cfg.fdqn; + locations = { + "~ ^/(sfu/get|healthz|get_token)" = { + proxyPass = "http://${config.systemd.services.lk-jwt-service.environment.LIVEKIT_JWT_BIND}/$1"; + recommendedProxySettings = true; + }; + "/" = { + proxyPass = "http://localhost:${toString config.services.livekit.settings.port}/"; + recommendedProxySettings = true; + proxyWebsockets = true; + }; + }; + }; - locations."/_matrix".proxyPass = socket; - }; + # The matrix server + ${cfg.host-domain} = { + enableACME = cfg.doACME; + forceSSL = cfg.doACME; - }; - # Let nginx access the socket. - systemd.services.nginx.serviceConfig.SupplementaryGroups = [ - config.services.matrix-continuwuity.group - ]; + locations = { + "/_matrix".proxyPass = socket; + }; + }; + }; + # Let nginx access the socket. + systemd.services.nginx.serviceConfig.SupplementaryGroups = [ + config.services.matrix-continuwuity.group + ]; - }; + } + ); } diff --git a/services/mail2.nix b/services/mail2.nix index fe65991..b8e24cf 100644 --- a/services/mail2.nix +++ b/services/mail2.nix @@ -167,6 +167,7 @@ in configPlanPre = [ ]; idempotentCreate = cfg.extraCreate; configPlanPost = cfg.extraConfig; + useMimalloc = true; credentials = (lib.genAttrs secrets toCredfilePath) // (builtins.foldl' (a: b: a // b) ({ }) ( |