diff options
| -rw-r--r-- | flake.lock | 173 | ||||
| -rw-r--r-- | flake.nix | 4 | ||||
| -rw-r--r-- | hosts/omega-relay/default.nix | 13 | ||||
| -rw-r--r-- | services/continuwuity.nix | 108 | ||||
| -rw-r--r-- | services/email.nix | 2 |
5 files changed, 297 insertions, 3 deletions
@@ -1,7 +1,65 @@ { "nodes": { + "advisory-db": { + "flake": false, + "locked": { + "lastModified": 1766324728, + "narHash": "sha256-9C+WyE5U3y5w4WQXxmb0ylRyMMsPyzxielWXSHrcDpE=", + "owner": "rustsec", + "repo": "advisory-db", + "rev": "c88b88c62bda077be8aa621d4e89d8701e39cb5d", + "type": "github" + }, + "original": { + "owner": "rustsec", + "repo": "advisory-db", + "type": "github" + } + }, + "continuwuity": { + "inputs": { + "advisory-db": "advisory-db", + "crane": "crane", + "fenix": "fenix", + "flake-compat": "flake-compat", + "flake-parts": "flake-parts", + "nixpkgs": [ + "nixpkgs" + ], + "treefmt-nix": "treefmt-nix" + }, + "locked": { + "lastModified": 1771196666, + "narHash": "sha256-mEdhnyzuW2fTP/dBpJE6EnvTH2fbQXOOwZgjJ1trQmU=", + "ref": "refs/heads/main", + "rev": "55ccfdb9733347f1985206e782d6fd89e46c15c3", + "revCount": 6089, + "type": "git", + "url": "https://forgejo.ellis.link/continuwuation/continuwuity" + }, + "original": { + "rev": "55ccfdb9733347f1985206e782d6fd89e46c15c3", + "type": "git", + "url": "https://forgejo.ellis.link/continuwuation/continuwuity" + } + }, "crane": { "locked": { + "lastModified": 1766194365, + "narHash": "sha256-4AFsUZ0kl6MXSm4BaQgItD0VGlEKR3iq7gIaL7TjBvc=", + "owner": "ipetkov", + "repo": "crane", + "rev": "7d8ec2c71771937ab99790b45e6d9b93d15d9379", + "type": "github" + }, + "original": { + "owner": "ipetkov", + "repo": "crane", + "type": "github" + } + }, + "crane_2": { + "locked": { "lastModified": 1762538466, "narHash": "sha256-8zrIPl6J+wLm9MH5ksHcW7BUHo7jSNOu0/hA0ohOOaM=", "owner": "ipetkov", @@ -36,6 +94,63 @@ "type": "github" } }, + "fenix": { + "inputs": { + "nixpkgs": [ + "continuwuity", + "nixpkgs" + ], + "rust-analyzer-src": "rust-analyzer-src" + }, + "locked": { + "lastModified": 1766299592, + "narHash": "sha256-7u+q5hexu2eAxL2VjhskHvaUKg+GexmelIR2ve9Nbb4=", + "owner": "nix-community", + "repo": "fenix", + "rev": "381579dee168d5ced412e2990e9637ecc7cf1c5d", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "fenix", + "type": "github" + } + }, + "flake-compat": { + "flake": false, + "locked": { + "lastModified": 1765121682, + "narHash": "sha256-4VBOP18BFeiPkyhy9o4ssBNQEvfvv1kXkasAYd0+rrA=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "65f23138d8d09a92e30f1e5c87611b23ef451bf3", + "type": "github" + }, + "original": { + "owner": "edolstra", + "ref": "master", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-parts": { + "inputs": { + "nixpkgs-lib": "nixpkgs-lib" + }, + "locked": { + "lastModified": 1765835352, + "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "a34fae9c08a15ad73f295041fec82323541400a9", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, "flake-utils": { "inputs": { "systems": "systems" @@ -90,6 +205,21 @@ "type": "github" } }, + "nixpkgs-lib": { + "locked": { + "lastModified": 1765674936, + "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=", + "owner": "nix-community", + "repo": "nixpkgs.lib", + "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "nixpkgs.lib", + "type": "github" + } + }, "nixpkgs-stable": { "locked": { "lastModified": 1767313136, @@ -108,13 +238,31 @@ }, "root": { "inputs": { + "continuwuity": "continuwuity", "disko": "disko", "home-manager": "home-manager", "nixpkgs": "nixpkgs", "nixpkgs-stable": "nixpkgs-stable", "sops-nix": "sops-nix", "tatuin": "tatuin", - "treefmt-nix": "treefmt-nix" + "treefmt-nix": "treefmt-nix_2" + } + }, + "rust-analyzer-src": { + "flake": false, + "locked": { + "lastModified": 1766253897, + "narHash": "sha256-ChK07B1aOlJ4QzWXpJo+y8IGAxp1V9yQ2YloJ+RgHRw=", + "owner": "rust-lang", + "repo": "rust-analyzer", + "rev": "765b7bdb432b3740f2d564afccfae831d5a972e4", + "type": "github" + }, + "original": { + "owner": "rust-lang", + "ref": "nightly", + "repo": "rust-analyzer", + "type": "github" } }, "sops-nix": { @@ -154,7 +302,7 @@ }, "tatuin": { "inputs": { - "crane": "crane", + "crane": "crane_2", "flake-utils": "flake-utils", "nixpkgs": [ "nixpkgs" @@ -178,6 +326,27 @@ "treefmt-nix": { "inputs": { "nixpkgs": [ + "continuwuity", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1766000401, + "narHash": "sha256-+cqN4PJz9y0JQXfAK5J1drd0U05D5fcAGhzhfVrDlsI=", + "owner": "numtide", + "repo": "treefmt-nix", + "rev": "42d96e75aa56a3f70cab7e7dc4a32868db28e8fd", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "treefmt-nix", + "type": "github" + } + }, + "treefmt-nix_2": { + "inputs": { + "nixpkgs": [ "nixpkgs" ] }, @@ -29,6 +29,10 @@ url = "github:numtide/treefmt-nix"; inputs.nixpkgs.follows = "nixpkgs"; }; + continuwuity = { + url = "git+https://forgejo.ellis.link/continuwuation/continuwuity?rev=55ccfdb9733347f1985206e782d6fd89e46c15c3"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; outputs = diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix index 95e03e4..9ec806d 100644 --- a/hosts/omega-relay/default.nix +++ b/hosts/omega-relay/default.nix @@ -16,6 +16,7 @@ ../../services/uptimekuma.nix ../../services/freshrss.nix ../../services/wakapi.nix + ../../services/continuwuity.nix ]; addons = { @@ -46,6 +47,18 @@ domain = if isVM then "mail.omega-relay.local" else "mail.wilkuu.xyz"; doACME = !isVM; }; + continuwuity = { + enable = true; + allowRegistration = false; + allowFederation = !isVM; + trustedServers = [ + "matrix.org" + "utwente.io" + ]; + fdqn = if isVM then "omega-relay.local" else "wilkuu.xyz"; + host-domain = if isVM then "matrix.omega-relay.local" else "matrix.wilkuu.xyz"; + doACME = !isVM; + }; vaultwarden = { enable = true; diff --git a/services/continuwuity.nix b/services/continuwuity.nix new file mode 100644 index 0000000..e373cec --- /dev/null +++ b/services/continuwuity.nix @@ -0,0 +1,108 @@ +{ + pkgs, + config, + lib, + inputs, + ... +}: +let + cfg = config.wilkuu.services.continuwuity; + hostname = config.netowrking.hostName; + inherit (lib) mkOption types mkEnableOption; +in +{ + options.wilkuu.services.continuwuity = { + host-domain = mkOption { + type = types.str; + default = "matrix.${hostname}.local"; + example = "matrix.wilkuu.xyz"; + description = "The hosting address of the server"; + }; + fdqn = mkOption { + type = types.str; + default = "${hostname}.local"; + example = "wilkuu.xyz"; + description = "The domain displayed in the addresses for users/rooms"; + }; + + doACME = mkEnableOption "Enable ACME for stalwart here"; + enable = mkEnableOption "Enable the matrix server"; + dataDir = mkOption { + type = types.path; + description = "Storage localtion for Stalwart user data"; + default = "/srv/data/continuwuity"; + example = "/srv/data/continuwuity"; + }; + allowRegistration = mkEnableOption "allow random people to register"; + allowFederation = mkEnableOption "allow other servers to federate"; + trustedServers = mkOption { + type = types.listOf types.str; + default = [ ]; + example = [ "matrix.org" ]; + description = "The trusted matrix servers."; + }; + + }; + config = lib.mkIf cfg.enable { + services.matrix-continuwuity = { + enable = cfg.enable; + package = inputs.continuwuity.packages.${pkgs.stdenv.hostPlatform.system}.default; + settings.global = { + # Hosted at cfg.domain, server fdqn is fdqn. + server_name = cfg.fdqn; + # Remove the trans flag, it is a nice feature but not my style. + new_user_displayname_suffix = ""; + + # Configure matrix stuffs + allow_registration = cfg.allowRegistration; + allow_encryption = true; + allow_federation = cfg.allowFederation; + trusted_servers = cfg.trustedServers; + + # Host the server on a unix-socket and use nginx to connect to that socket. + address = null; + unix_socket_path = "/run/continuwuity/continuwuity.sock"; + unix_socket_perms = 660; + + # You can run this once to create a user called harbinger which is admin. + # This might not be needed to bootstrap c10y in the later versions. + # It will crash c10y if the user already exists (Idk what the workaround is) + # admin_execute = [ + # "users create-user harbinger" + # "users make-user-admin harbinger" + # ]; + + # well-known setup + well_known = { + client = "https://${cfg.host-domain}"; + server = "${cfg.host-domain}:443"; + support_email = "jakub@wilkuu.xyz"; + }; + }; + }; + + services.nginx.virtualHosts = + let + socket = "http://unix://${config.services.matrix-continuwuity.settings.global.unix_socket_path}"; + in + { + # well-known discovery + # TODO: Might need to enforce https here, if it already is not. + ${cfg.fdqn}.locations."/.well_known/matrix/".proxyPass = socket; + + # The matrix server + ${cfg.host-domain} = { + enableACME = cfg.doACME; + forceSSL = cfg.doACME; + + locations."/_matrix".proxyPass = socket; + }; + + }; + # Let nginx access the socket. + systemd.services.nginx.serviceConfig.SupplementaryGroups = [ + config.services.matrix-continuwuity.group + ]; + + }; +} diff --git a/services/email.nix b/services/email.nix index 3f7cb9f..f050b2b 100644 --- a/services/email.nix +++ b/services/email.nix @@ -89,7 +89,7 @@ in "mail-v1.xml" "autoconfig/mail" ]) - // (lib.genAttrs [ "/.well_known/caldav" "/.well_known/webdav" ] ( + // (lib.genAttrs [ "/.well-known/caldav" "/.well-known/webdav" ] ( uri: (makeHttpRedirect "${cfg.domain}${uri}") cfg.doACME )); }) |