xin/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

biotite: move all services to biotite except kanidm

Browse source
This commit is contained in:
xinyangli 2024-12-05 13:28:22 +08:00
parent 7bc5db676d
commit 756357552a
Signed by: xin
SSH key fingerprint: SHA256:UU5pRTl7NiLFJbWJZa+snLylZSXIz5rgHmwjzv8v4oE
13 changed files with 78 additions and 52 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
machines/biotite/default.nix
View file

@ -35,7 +35,6 @@
commonSettings = {
auth.enable = true;
autoupgrade.enable = true;
};
custom.monitoring = {

5
machines/biotite/services/gotosocial.nix
View file

@ -1,4 +1,7 @@
{ config, ... }:
let
inherit (config.my-lib.settings) idpUrl;
in
{
sops.secrets."gotosocial/oidc_client_secret" = {
owner = "gotosocial";
@ -23,7 +26,7 @@
instance-expose-public-timeline = true;
oidc-enabled = true;
oidc-idp-name = "Kanidm";
oidc-issuer = "https://auth.xinyang.life/oauth2/openid/gotosocial";
oidc-issuer = "${idpUrl}/oauth2/openid/gotosocial";
oidc-client-id = "gotosocial";
oidc-link-existing = true;
};

26
machines/biotite/services/synapse.nix
View file

@ -1,5 +1,11 @@
{ config, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
let
inherit (config.my-lib.settings) idpUrl synapseDelegateUrl synapseUrl;
port-synapse = 6823;
in
{
@ -27,7 +33,7 @@ in
enable = true;
settings = {
server_name = "xiny.li";
public_baseurl = "https://synapse.xiny.li";
public_baseurl = synapseDelegateUrl;
database = {
name = "psycopg2";
args = {
@ -71,11 +77,11 @@ in
oidc_providers = [
{
idp_id = "Kanidm";
idp_name = "auth.xinyang.life";
issuer = "https://auth.xinyang.life/oauth2/openid/synapse";
authorization_endpoint = "https://auth.xinyang.life/ui/oauth2";
token_endpoint = "https://auth.xinyang.life/oauth2/token";
userinfo_endpoint = "https://auth.xinyang.life/oauth2/openid/synapse/userinfo";
idp_name = lib.removePrefix "https://" idpUrl;
issuer = "${idpUrl}/oauth2/openid/synapse";
authorization_endpoint = "${idpUrl}/ui/oauth2";
token_endpoint = "${idpUrl}/oauth2/token";
userinfo_endpoint = "${idpUrl}/oauth2/openid/synapse/userinfo";
client_id = "synapse";
client_secret_path = config.sops.secrets."synapse/oidc_client_secret".path;
scopes = [
@ -95,13 +101,13 @@ in
};
services.caddy = {
virtualHosts."https://xiny.li".extraConfig = ''
virtualHosts.${synapseUrl}.extraConfig = ''
header /.well-known/matrix/* Content-Type application/json
header /.well-known/matrix/* Access-Control-Allow-Origin *
respond /.well-known/matrix/server `{"m.server":"synapse.xiny.li:443"}`
respond /.well-known/matrix/client `{"m.homeserver":{"base_url":"https://synapse.xiny.li/"}}`
respond /.well-known/matrix/client `{"m.homeserver":{"base_url":"${synapseDelegateUrl}"}}`
'';
virtualHosts."https://synapse.xiny.li".extraConfig = ''
virtualHosts.${synapseDelegateUrl}.extraConfig = ''
reverse_proxy /_matrix/* 127.0.0.1:${toString port-synapse}
reverse_proxy /_synapse/client/* 127.0.0.1:${toString port-synapse}
'';

9
machines/massicot/default.nix
View file

@ -15,18 +15,9 @@
defaultSopsFile = ./secrets.yaml;
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets = {
storage_box_mount = {
owner = "root";
};
gts_env = {
owner = "gotosocial";
};
"miniflux/oauth2_secret" = {
owner = "root";
};
"forgejo/env" = {
owner = "forgejo";
};
};
};

12
machines/massicot/kanidm-provision.nix
View file

@ -1,10 +1,12 @@
{ pkgs, ... }:
{ pkgs, config, ... }:
let
inherit (config.my-lib.settings)
gotosocialUrl
minifluxUrl
hedgedocDomain
forgejoDomain
grafanaUrl
synapseDelegateUrl
;
in
{
@ -200,8 +202,8 @@ in
};
grafana = {
displayName = "Grafana";
originUrl = "https://grafana.xinyang.life/login/generic_oauth";
originLanding = "https://grafana.xinyang.life/";
originUrl = "${grafanaUrl}/login/generic_oauth";
originLanding = "${grafanaUrl}/";
scopeMaps = {
grafana-users = [
"openid"
@ -223,8 +225,8 @@ in
};
synapse = {
displayName = "Synapse";
originUrl = "https://synapse.xiny.li/_synapse/client/oidc/callback";
originLanding = "https://synapse.xiny.li/";
originUrl = "${synapseDelegateUrl}/_synapse/client/oidc/callback";
originLanding = "${synapseDelegateUrl}/";
scopeMaps = {
synapse-users = [
"openid"

7
machines/massicot/services/restic.nix
View file

@ -34,13 +34,6 @@ in
];
};
services.postgresqlBackup = {
enable = true;
compression = "zstd";
compressionLevel = 9;
location = "/backup/postgresql";
};
services.restic.backups.${config.networking.hostName} = {
extraBackupArgs = [
"--limit-upload=1024"

1
machines/thorite/default.nix
View file

@ -3,6 +3,7 @@
./hardware-configurations.nix
./monitoring.nix
./restic.nix
./ntfy.nix
];
config = {

13
machines/thorite/monitoring.nix
View file

@ -10,7 +10,8 @@ let
minifluxUrl
gotosocialUrl
hedgedocDomain
forgejoDomain
grafanaUrl
ntfyUrl
;
removeHttps = s: lib.removePrefix "https://" s;
in
@ -44,7 +45,7 @@ in
promtail.enable = true;
};
services.caddy.virtualHosts."https://grafana.xinyang.life".extraConfig =
services.caddy.virtualHosts.${grafanaUrl}.extraConfig =
with config.services.grafana.settings.server; ''
reverse_proxy http://${http_addr}:${toString http_port}
'';
@ -98,17 +99,13 @@ in
name = "hedgedoc";
address = hedgedocDomain;
}
{
name = "forgejo";
address = forgejoDomain;
}
{
name = "ntfy";
address = "ntfy.xinyang.life";
address = removeHttps ntfyUrl;
}
{
name = "grafana-eu";
address = "grafana.xinyang.life";
address = removeHttps grafanaUrl;
}
{
name = "loki";

29
machines/thorite/ntfy.nix Normal file
View file

@ -0,0 +1,29 @@
{ config, ... }:
let
inherit (config.my-lib.settings) ntfyUrl;
in
{
services.ntfy-sh = {
enable = true;
group = "caddy";
settings = {
listen-unix = "/var/run/ntfy-sh/ntfy.sock";
listen-unix-mode = 432; # octal 0660
base-url = ntfyUrl;
};
};
systemd.services.ntfy-sh.serviceConfig.RuntimeDirectory = "ntfy-sh";
services.caddy.virtualHosts.${ntfyUrl}.extraConfig = ''
reverse_proxy unix/${config.services.ntfy-sh.settings.listen-unix}
@httpget {
protocol http
method GET
path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
}
redir @httpget https://{host}{uri}
'';
}

2
machines/weilite/default.nix
View file

@ -69,7 +69,7 @@
};
custom.monitoring = {
loki.enable = true;
promtail.enable = true;
};
systemd.mounts = [

10
modules/nixos/monitor/default.nix
View file

@ -11,6 +11,7 @@ let
mkMerge
types
;
inherit (config.my-lib.settings) ntfyUrl;
cfg = config.custom.prometheus;
mkRulesOption = mkOption {
@ -121,12 +122,11 @@ in
name = "ntfy";
webhook_configs = [
{
url = "https://ntfy.xinyang.life/prometheus-alerts?tpl=yes&m=${lib.escapeURL ''
Alert {{.status}}
{{range .alerts}}-----{{range $k,$v := .labels}}
url = "${ntfyUrl}/prometheus-alerts?tpl=yes&m=${lib.escapeURL ''
{{range .alerts}}[{{ if eq .status "resolved" }}✅ RESOLVED{{ else }}{{ if eq .status "firing" }}🔥 FIRING{{end}}{{end}}]{{range $k,$v := .labels}}
{{$k}}={{$v}}{{end}}
{{end}}
''}";
{{end}}''}";
send_resolved = true;
}
];

11
modules/nixos/monitor/grafana.nix
View file

@ -1,5 +1,6 @@
{ config, lib, ... }:
let
inherit (config.my-lib.settings) grafanaUrl idpUrl;
cfg = config.custom.monitoring.grafana;
in
{
@ -13,17 +14,17 @@ in
server = {
http_addr = "127.0.0.1";
http_port = 3003;
root_url = "https://grafana.xinyang.life";
domain = "grafana.xinyang.life";
root_url = grafanaUrl;
domain = lib.removePrefix "https://" grafanaUrl;
};
"auth.generic_oauth" = {
enabled = true;
name = "Kanidm";
client_id = "grafana";
scopes = "openid,profile,email,groups";
auth_url = "https://auth.xinyang.life/ui/oauth2";
token_url = "https://auth.xinyang.life/oauth2/token";
api_url = "https://auth.xinyang.life/oauth2/openid/grafana/userinfo";
auth_url = "${idpUrl}/ui/oauth2";
token_url = "${idpUrl}/oauth2/token";
api_url = "${idpUrl}/oauth2/openid/grafana/userinfo";
use_pkce = true;
use_refresh_token = true;
allow_sign_up = true;

4
overlays/my-lib/settings.nix
View file

@ -8,5 +8,9 @@
forgejoDomain = "git.xiny.li";
forgejoGitDomain = "git.xiny.li";
vaultwardenUrl = "https://vaultwarden.xiny.li";
ntfyUrl = "https://ntfy.xiny.li";
grafanaUrl = "https://grafana.xiny.li";
synapseUrl = "https://xiny.li";
synapseDelegateUrl = "https://synapse.xiny.li";
};
}