From 6d1bd782a85f6bb62ae7ed7f554beaf8433d010c Mon Sep 17 00:00:00 2001 From: chris Date: Wed, 25 Feb 2026 07:35:42 +0000 Subject: [PATCH 1/4] chore(secrets): set secret "zitadel/users" for machine "ulmo" --- systems/x86_64-linux/ulmo/secrets.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/systems/x86_64-linux/ulmo/secrets.yml b/systems/x86_64-linux/ulmo/secrets.yml index 10fa4c9..729bed1 100644 --- a/systems/x86_64-linux/ulmo/secrets.yml +++ b/systems/x86_64-linux/ulmo/secrets.yml @@ -4,7 +4,7 @@ email: zitadel: masterKey: ENC[AES256_GCM,data:4MPvBo407qrS7NF4oUTf84tZoPkSRmiHdD7qpkYeHME=,iv:H2NIAN0xBUDqnyco9gA3zYAsKtSeA/JpqYrPhc1eqc0=,tag:6OFGDfsucG5gDerImgpuXA==,type:str] nix: {} - users: ENC[AES256_GCM,data:GeuYaMNy5UICpYsJs95YCzKjtZxMQDpTTKjU9BDTTBToFir9Rn04QxNi6Wj1I3h2FcS63kbHWaP/W307kDoOQPBZrvrQMi2zSc8+/ivYGmAMhzt2kYXECKt7+YDf9cn9f3D6KV0NSh5UqlpZvDfYXSc/6q2gHOMV3bPvMEf+uxxUEf06kzLH7HpnjExgmUcOM6uVNAudf7HgJ1h/JzUzHq/XLPoVAuyj2TbaHwvRCk+YqLJZw1D+8z3MkpZsdNF57quEZfDPahg371l1wzvZMH5sfFuSzUajD3lbIGRiV0o9PpmBp4qwnU63EkFy1wqhMjXjoviPqouRyZb+fDzxkDoyMuhAYjHcIuSlAs3/5htO2CzOCQL1t6cfEGaxG5U4ocHH0b0C5wvqNG5u9NDLbP7AjBS3a9TLPfmjijNBd4xwt/eYCpDkXirv/m/PVQLvbNzzf+zDWDApldxmv5rCxTLR,iv:FqShjMhe8Yzh2RiC991mVhATYZD2rdW3m0js9gQsKC4=,tag:8P7nEFVVY32IFP9C5H4cZA==,type:str] + users: ENC[AES256_GCM,data:w/2Vdq0EHXaJ5u/aA/reSCtwRHreWm1U1WoJT927xV81zoN0ytoYOwush610caZu8vVXkL4b0hysK77dyWJkdkYpwLY8xG9pLkYlU3lN5E/2tgEjB7Dd7oY7TFTCNuypmIzYh6V74KiHMeA0vlyWUp9lLNt40Ro3MZLT42DyTYjF6YBoUHUp0fS0rKypILJGobJBrwz2YWagXj80IqaaUmmsIcYAaM2u3dQviLlRkIyUxPd1wjFoMc/OMp5Y8A4ZHroCN0wJitGeEEP33GD+MUy58u05pA430AD5Mo4H2V7b3t0qIkOQ8a0BgSVA8UqmrcY/TfikuIZ1kTyCxvD7kmjPq5tG+bhtHt85wgk1XffVO3NDTK7UrltO8R6KolQ5bBgcKgl7YnFTN5qSAT+xrYg8oZaPrGQBTx6eEVETKHKe4oSDkGlAle86lenhF+jm3k2ALmH9X3P/TpAtfRhuU+sUKqhrqQ2Nf4M7LfBtd7lyt2ESqilKokcl51gWCY+1B75dCEIdb/BPmpwzJBGFOI2nZqhxFnVa8TyMpT7C2TxK7rCBPDt5NnNvWYc4+8sRXHBz7s2R5NTk4gaJODlo3HvyL0MV,iv:XlO48HKJWRgwsozmgXstfirwb5CUY+ywelbgLlcx/n4=,tag:GuQMkL2mpNkTJIep79x0zw==,type:str] forgejo: action_runner_token: ENC[AES256_GCM,data:yJ6OnRq5kinbuhvH06K5o3l86EafuBoojMwg/qhP+cgeH+BwPeE+Ng==,iv:IeXJahPxgLNIUFmkgp495tLVh8UyQBmJ2SnVEUhlhHs=,tag:XYQi613CxSp8AQeilJMrsg==,type:str] synapse: @@ -59,7 +59,7 @@ sops: TTRWaHhpNWlkVDFmMFN4ZTNHMUxyNVkKV693pzTKRkZboQCMPr9IyMGSgxfuHXcb Y6BNcp6Qg6PWtX5QI7wRkPNINAK1TEbRBba+b8h6gMmVU4DliQyFiQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-02-24T07:24:41Z" - mac: ENC[AES256_GCM,data:wmTua89j8OYC4lw5nmDgKQy2A31KbI5M8jQxqNicHUEZFnDjo2aloNrpwKz5/lM5EomPvvJEAm2eyV04EmfYqKqmAXbcj2wTl4f6Afzb1X/+uABCvlaHquTXbx6lU8IyA31nHKeBspRX0mED86wrXasOsG34YJdDTa/lAKymjzk=,iv:Qea6St+3XfoVHAuWczK/rF2lEeKQBguRGpfGybdf7lA=,tag:yFufTgb7AG5dhrQH47Y0tA==,type:str] + lastmodified: "2026-02-25T07:35:41Z" + mac: ENC[AES256_GCM,data:UKAWLSj/OpyCGj1U9rhCX2rQr5E2CXodU+Z5RZddTdFis1+1opw7GLr+2s4OTRbREdZsNP3JSoXycgCssf4na88p/PTZh/VUa9ymbRr9eTacJq6ZkqRC5J8WyDK6gI+Qv4gv5CxdxZd92vUa4uXlwrZ4VsYepvrrkatCe9YTA9w=,iv:dkm+hkdyzJsIXp4uB36wYa/uzl8VA7LwhmvQT3hQlog=,tag:zHxeEze6RVfTCcduVkwuoQ==,type:str] unencrypted_suffix: _unencrypted version: 3.11.0 From 20968322027e6e8846e699f6c591a3ef7de7c4a9 Mon Sep 17 00:00:00 2001 From: Chris Kruining Date: Wed, 25 Feb 2026 08:39:14 +0100 Subject: [PATCH 2/4] Move Minecraft and Palworld modules to default.nix files Add sops secret for Palworld password --- .../{minecraft.nix => minecraft/default.nix} | 56 ++++++++++++------- modules/nixos/services/games/palworld.nix | 25 --------- .../nixos/services/games/palworld/default.nix | 30 ++++++++++ 3 files changed, 67 insertions(+), 44 deletions(-) rename modules/nixos/services/games/{minecraft.nix => minecraft/default.nix} (77%) delete mode 100644 modules/nixos/services/games/palworld.nix create mode 100644 modules/nixos/services/games/palworld/default.nix diff --git a/modules/nixos/services/games/minecraft.nix b/modules/nixos/services/games/minecraft/default.nix similarity index 77% rename from modules/nixos/services/games/minecraft.nix rename to modules/nixos/services/games/minecraft/default.nix index 7f408ae..84567b3 100644 --- a/modules/nixos/services/games/minecraft.nix +++ b/modules/nixos/services/games/minecraft/default.nix @@ -1,11 +1,16 @@ -{ inputs, config, lib, pkgs, namespace, ... }: -let +{ + inputs, + config, + lib, + pkgs, + namespace, + ... +}: let inherit (lib) mkIf mkEnableOption mkOption; inherit (lib.types) str; cfg = config.${namespace}.services.games.minecraft; -in -{ +in { imports = [ inputs.nix-minecraft.nixosModules.minecraft-servers ]; @@ -25,7 +30,7 @@ in }; config = mkIf cfg.enable { - user.users.${cfg.user} = { + users.users.${cfg.user} = { isSystemUser = true; group = cfg.group; }; @@ -77,7 +82,7 @@ in inherit whitelist; inherit jvmOpts; - package = pkgs.fabricServers.fabric-1_21_4.override { loaderVersion = "0.16.10"; }; + package = pkgs.fabricServers.fabric-1_21_4.override {loaderVersion = "0.16.10";}; serverProperties = { gamemode = "survival"; @@ -103,8 +108,14 @@ in inherit (pkgs) linkFarmFromDrvs fetchurl; in { mods = linkFarmFromDrvs "mods" (attrValues { - FabricApi = fetchurl { url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/ZNwYCTsk/fabric-api-0.118.0%2B1.21.4.jar"; sha512 = "1e0d31b6663dc2c7be648f3a5a9cf7b698b9a0fd0f7ae16d1d3f32d943d7c5205ff63a4f81b0c4e94a8997482cce026b7ca486e99d9ce35ac069aeb29b02a30d"; }; - Terralith = fetchurl { url = "https://cdn.modrinth.com/data/8oi3bsk5/versions/MuJMtPGQ/Terralith_1.21.x_v2.5.8.jar"; sha512 = "f862ed5435ce4c11a97d2ea5c40eee9f817c908f3223b5fd3e3fff0562a55111d7429dc73a2f1ca0b1af7b1ff6fa0470ed6efebb5de13336c40bb70fb357dd60"; }; + FabricApi = fetchurl { + url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/ZNwYCTsk/fabric-api-0.118.0%2B1.21.4.jar"; + sha512 = "1e0d31b6663dc2c7be648f3a5a9cf7b698b9a0fd0f7ae16d1d3f32d943d7c5205ff63a4f81b0c4e94a8997482cce026b7ca486e99d9ce35ac069aeb29b02a30d"; + }; + Terralith = fetchurl { + url = "https://cdn.modrinth.com/data/8oi3bsk5/versions/MuJMtPGQ/Terralith_1.21.x_v2.5.8.jar"; + sha512 = "f862ed5435ce4c11a97d2ea5c40eee9f817c908f3223b5fd3e3fff0562a55111d7429dc73a2f1ca0b1af7b1ff6fa0470ed6efebb5de13336c40bb70fb357dd60"; + }; # DistantHorizons = fetchurl { url = "https://cdn.modrinth.com/data/uCdwusMi/versions/jptcCdp2/DistantHorizons-2.2.1-a-1.20.4-forge-fabric.jar"; sha512 = "47368d91099d0b5f364339a69f4e425f8fb1e3a7c3250a8b649da76135e68a22f1a76b191c87e15a5cdc0a1d36bc57f2fa825490d96711d09d96807be97d575d"; }; }); }; @@ -125,7 +136,7 @@ in inherit whitelist; inherit jvmOpts; - package = pkgs.fabricServers.fabric-1_19_2.override { loaderVersion = "0.16.9"; }; + package = pkgs.fabricServers.fabric-1_19_2.override {loaderVersion = "0.16.9";}; serverProperties = { gamemode = "survival"; @@ -147,24 +158,31 @@ in inherit (lib) concatMapAttrs; readDirRec = src: dir: fn: - concatMapAttrs (name: type: if type == "directory" - then (readDirRec src "${dir}/${name}" fn) - else { "${dir}/${name}" = (fn "${dir}/${name}"); } + concatMapAttrs ( + name: type: + if type == "directory" + then (readDirRec src "${dir}/${name}" fn) + else {"${dir}/${name}" = fn "${dir}/${name}";} ) (readDir "${src}/${dir}"); copyDir = dir: readDirRec src dir (x: "${src}/${x}"); - in { - "ops.json" = { - value = ops; - }; - } - // (copyDir "config"); + in + { + "ops.json" = { + value = ops; + }; + } + // (copyDir "config"); symlinks = let inherit (builtins) attrNames readDir map; inherit (pkgs) linkFarm; - linkFarmFromDir = name: dir: linkFarm name (map (x: { name = x; path = "${src}/${dir}/${x}"; }) (attrNames (readDir "${src}/${dir}"))); + linkFarmFromDir = name: dir: + linkFarm name (map (x: { + name = x; + path = "${src}/${dir}/${x}"; + }) (attrNames (readDir "${src}/${dir}"))); in { Deftu = linkFarmFromDir "tekxit-deftu" "Deftu"; TKXAddons = linkFarmFromDir "tekxit-TKXAddons" "TKXAddons"; diff --git a/modules/nixos/services/games/palworld.nix b/modules/nixos/services/games/palworld.nix deleted file mode 100644 index dea16b3..0000000 --- a/modules/nixos/services/games/palworld.nix +++ /dev/null @@ -1,25 +0,0 @@ -{ config, lib, namespace, ... }: -let - inherit (lib) mkIf mkEnableOption; - - cfg = config.${namespace}.services.games.palworld; -in -{ - options.${namespace}.services.games.palworld = { - enable = mkEnableOption "Palworld"; - }; - - config = mkIf cfg.enable { -# kaas = (pkgs.mkSteamServer rec { -# name = "Palworld"; -# src = pkgs.fetchSteam { -# inherit name; -# appId = "2394010"; -# hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="; -# }; -# -# sartCmd = "PalServer.sh"; -# hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="; -# }); - }; -} diff --git a/modules/nixos/services/games/palworld/default.nix b/modules/nixos/services/games/palworld/default.nix new file mode 100644 index 0000000..152891d --- /dev/null +++ b/modules/nixos/services/games/palworld/default.nix @@ -0,0 +1,30 @@ +{ + config, + lib, + namespace, + ... +}: let + inherit (lib) mkIf mkEnableOption; + + cfg = config.${namespace}.services.games.palworld; +in { + options.${namespace}.services.games.palworld = { + enable = mkEnableOption "Palworld"; + }; + + config = mkIf cfg.enable { + # kaas = (pkgs.mkSteamServer rec { + # name = "Palworld"; + # src = pkgs.fetchSteam { + # inherit name; + # appId = "2394010"; + # hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="; + # }; + # + # sartCmd = "PalServer.sh"; + # hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="; + # }); + + sops.secrets."palworld/password" = {}; + }; +} From a2071e16a29d440c0d9a78eec56e7dcd15dd5a1f Mon Sep 17 00:00:00 2001 From: chris Date: Wed, 25 Feb 2026 07:59:25 +0000 Subject: [PATCH 3/4] chore(secrets): removed secret "some" from machine "aule" --- systems/x86_64-linux/aule/secrets.yml | 33 +++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 systems/x86_64-linux/aule/secrets.yml diff --git a/systems/x86_64-linux/aule/secrets.yml b/systems/x86_64-linux/aule/secrets.yml new file mode 100644 index 0000000..7069c7b --- /dev/null +++ b/systems/x86_64-linux/aule/secrets.yml @@ -0,0 +1,33 @@ +sops: + age: + - recipient: age19qfpf980tadguqq44zf6xwvjvl428dyrj46ha3n6aeqddwhtnuqqml7etq + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZMC9nRjVFWnZlMHJJK0Nl + dWFTR0FCUGNBYXIrUHlIUUphZll2QU9IOEZrCitFS3JvK3hYYmpEZ05aRStpdUd1 + L3JjNDl1Z2hQQ3FuNUZNM1hCRUtQUG8KLS0tIEg4VVEvVjZYN3JHSXljQW1xS3E4 + eVpyM1lSWExndlZhMkw2Vis4dVhjSVUKbk+z1h3Hb1A6SEbZ3g5vYui/FfkMyfxx + Zm67JenYittHvQggTIErAgJatTocfVB6Zy4FqJtPCOevTVrRTRkwAg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1ewes0f5snqx3sh5ul6fa6qtxzhd25829v6mf5rx2wnheat6fefps5rme2x + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtOGJXWi9vUzdFbkx2NmVa + YnhITlNMc1RRRXoyOFNPN1B4VWQ5ZDUwNDFBCnVmdDFyUnptekxhOUlwdVcyRjFI + cHRSRkoyWnFVUDJMcXpVcmM5bjRKMkkKLS0tIDROWXR1UFFUa0NxcUtkdEwxQ2Vl + OW50OE9RMWpyT1AvS0QzZ3JVNDViYlkK77H0Uq3eRy0CHgH4bhdo7FVEJpKeR/DB + KZonll74qqsyW4n+hIbIybjaqtF3RBN4kj5ARuIGFmH8sAl6jSyHXA== + -----END AGE ENCRYPTED FILE----- + - recipient: age1jmrmdw4kmjeu9d6z74r2unqt7wpgsx24vqejmdjretsnsn8g4drsl3m98w + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZOURoRmk4QldEZExTRDYx + cXluYkg4OUFUNDNrQUNiNWRwKzhEQkdaemxzCnM3b25GYm5TM3NuNnBsVWRmQzNL + bTRabmx2UzBkN1dadlhwajN5RDIxVW8KLS0tIDhSQ1o4RGZBdlVHaHRKQWFyazU0 + N0lnMjMvREpmNWZvTUdiT0tjMk4vTk0KmIN1a3gjmFzaEwJBu41sw5Z61UgiO5fc + /pkS22BeVonuB12SmJX+77A1CxFz1EwM8HSShFKlpN2hPCJFJL7Nng== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-02-25T07:59:24Z" + mac: ENC[AES256_GCM,data:64AkqWb97nUciWtOOHP/SZhUeo/5ahxa0cN14ILw/jmToFkn8uDrSfY8/ibqBB0mmfhwGzcnI/5QpCLVzCSgG1J68bdPeSsYTZPwy2/0S0ven+GeqYHMfJ2Q1eJE7TONyOEvSdYdUWG+ff5t0qhSet9F2BgFnMSKcNeAaxIY6KU=,iv:aMQXbKk8oKSLBHIZyJLJahu5HHEMysmhcgfpDdZG+Ak=,tag:hqBVXis8MdqRorxttYeQaw==,type:str] + unencrypted_suffix: _unencrypted + version: 3.11.0 From d3a394dfd9d5960cccaaff6e8e9371be23840353 Mon Sep 17 00:00:00 2001 From: Chris Kruining Date: Tue, 3 Mar 2026 14:59:58 +0100 Subject: [PATCH 4/4] Add LiveKit, coturn, and JWT service to Matrix module - Integrate LiveKit SFU, coturn TURN server, and lk-jwt-service for Element Call support in the Matrix Synapse module - Add firewall rules for new services and ports - Add key generation systemd service for LiveKit JWT - Extend Synapse config with TURN URIs and experimental features - Update Caddy config for new endpoints and well-known support - Improve OIDC config with additional scopes and user mapping - Add Grafana secret_key to SOPS secrets and config - Refactor and modularize secret checking in justfile scripts --- .just/machine.just | 1 + .just/vars.just | 69 +++++-- .../services/communication/matrix/default.nix | 183 +++++++++++++++++- .../observability/grafana/default.nix | 8 + 4 files changed, 234 insertions(+), 27 deletions(-) diff --git a/.just/machine.just b/.just/machine.just index 098d879..8d0d37f 100644 --- a/.just/machine.just +++ b/.just/machine.just @@ -7,5 +7,6 @@ [doc('Update the target machine')] [no-exit-message] @update machine: + cd .. && just vars _check {{ machine }} just assert '-d "../systems/x86_64-linux/{{ machine }}"' "Machine {{ machine }} does not exist, must be one of: $(ls ../systems/x86_64-linux/ | sed ':a;N;$!ba;s/\n/, /g')" nixos-rebuild switch -L --sudo --target-host {{ machine }} --build-host {{ machine }} --flake ..#{{ machine }} --log-format internal-json -v |& nom --json diff --git a/.just/vars.just b/.just/vars.just index 1ddfbfd..2c16d1b 100644 --- a/.just/vars.just +++ b/.just/vars.just @@ -23,7 +23,7 @@ edit machine: echo "Done" -[doc('Get var value by {key} of {machine}')] +[doc('Get var by {key} from {machine}')] get machine key: sops decrypt {{ base_path }}/{{ machine }}/secrets.yml | yq ".$(echo "{{ key }}" | sed -E 's/\//./g')" @@ -38,25 +38,52 @@ remove machine key: [script] check: + cd .. + for machine in $(ls {{ base_path }}); do - [ -f "{{ base_path }}/$machine/secrets.yml" ] || continue - [ -f "{{ base_path }}/$machine/default.nix" ] || continue - - echo "Processing $machine" - - mapfile -t missing < <(jq -nr \ - --rawfile defined <(nix eval --json --apply 'builtins.attrNames' ..#nixosConfigurations.$machine.config.sops.secrets 2>/dev/null) \ - --rawfile configured <(sops decrypt {{ base_path }}/$machine/secrets.yml | yq '.') \ - ' - $defined | fromjson as $def - | $configured - | fromjson - | paths(scalars) - | join("/") - | select(. | IN($def[]) | not) - ') - - if (( ${#missing[@]} > 0 )); then - printf 'missing the following %d secret(s):\n%s\n\n' "${#missing[@]}" "$(printf -- '- %s\n' "${missing[@]}")" - fi + just vars _check "$machine" done + +[no-exit-message] +[script] +_check machine: + # If the default nix file is missing, + # we can skip this folder as we are + # missing the files used to compare + # the defined vs the configured secrets + if [ ! -f "{{ base_path }}/{{ machine }}/default.nix" ]; then + printf "\r• %-8sskipped\n" "{{ machine }}" + exit 0 + fi + + exec 3< <(jq -nr \ + --rawfile defined <(nix eval --json ..#nixosConfigurations.{{ machine }}.config.sops.secrets 2>/dev/null) \ + --rawfile configured <([ -f "{{ base_path }}/{{ machine }}/secrets.yml" ] && sops decrypt {{ base_path }}/{{ machine }}/secrets.yml | yq '.' || echo "{}") \ + ' + [ $configured | fromjson | paths(scalars) | join("/") ] as $conf + | $defined + | fromjson + | map(.key | select(. | IN($conf[]) | not)) + | unique + | .[] + ') + + pid=$! # Process Id of the previous running command + spin='⠇⠋⠙⠸⢰⣠⣄⡆' + + i=0 + while kill -0 $pid 2>/dev/null + do + i=$(( (i+1) %${#spin} )) + printf "\r${spin:$i:1} %s" "{{ machine }}" + sleep .1 + done + + mapfile -t missing <&3 + + if (( ${#missing[@]} > 0 )); then + printf '\r✗ %-8smissing %d secret(s):\n%s\n' "{{ machine }}" "${#missing[@]}" "$(printf -- ' %s\n' "${missing[@]}")" + exit 1 + else + printf "\r✓ %-8sup to date\n" "{{ machine }}" + fi diff --git a/modules/nixos/services/communication/matrix/default.nix b/modules/nixos/services/communication/matrix/default.nix index ccdbbaa..8bb79fe 100644 --- a/modules/nixos/services/communication/matrix/default.nix +++ b/modules/nixos/services/communication/matrix/default.nix @@ -15,6 +15,7 @@ port = 4001; database = "synapse"; + keyFile = "/var/lib/element-call/key"; in { options.${namespace}.services.communication.matrix = { enable = mkEnableOption "Matrix server (Synapse)"; @@ -26,8 +27,6 @@ in { # virtualisation.podman.enable = true; }; - networking.firewall.allowedTCPPorts = [4001]; - services = { matrix-synapse = { enable = true; @@ -55,8 +54,27 @@ in { password_config.enabled = true; backchannel_logout_enabled = true; + # Element Call options + max_event_delay_duration = "24h"; + rc_message = { + per_second = 0.5; + burst_count = 30; + }; + rc_delayed_event_mgmt = { + per_second = 1; + burst_count = 20; + }; + turn_uris = ["turn:turn.${domain}:4004?transport=udp" "turn:turn.${domain}:4004?transport=tcp"]; + experimental_features = { + # MSC2965: OAuth 2.0 Authorization Server Metadata discovery msc2965_enabled = true; + + # MSC3266: Room summary API. Used for knocking over federation + msc3266_enabled = true; + # MSC4222 needed for syncv2 state_after. This allow clients to + # correctly track the state of the room. + msc4222_enabled = true; }; sso = { @@ -181,33 +199,180 @@ in { caddy = { enable = true; + # globalConfig = '' + # layer4 { + # 127.0.0.1:4004 + # route { + # proxy { + # upstream synapse:4004 + # } + # } + # } + # 127.0.0.1:4005 + # route { + # proxy { + # upstream synapse:4005 + # } + # } + # } + # } + # ''; virtualHosts = let server = { "m.server" = "${fqn}:443"; }; client = { "m.homeserver".base_url = "https://${fqn}"; - "m.identity_server".base_url = "https://auth.kruining.eu"; + "m.identity_server".base_url = "https://auth.${domain}"; + "org.matrix.msc3575.proxy".url = "https://${domain}"; + "org.matrix.msc4143.rtc_foci" = [ + { + type = "livekit"; + livekit_service_url = "https://${domain}/livekit/jwt"; + } + ]; }; in { - "${domain}".extraConfig = '' + "${domain}, darkch.at".extraConfig = '' + # Route for lk-jwt-service + handle /livekit/jwt* { + uri strip_prefix /livekit/jwt + reverse_proxy http://[::1]:${toString config.services.lk-jwt-service.port} { + header_up Host {host} + header_up X-Forwarded-Server {host} + header_up X-Real-IP {remote_host} + header_up X-Forwarded-For {remote_host} + } + } + + handle_path /livekit/sfu* { + reverse_proxy http://[::1]:${toString config.services.livekit.settings.port} { + header_up Host {host} + header_up X-Forwarded-Server {host} + header_up X-Real-IP {remote_host} + header_up X-Forwarded-For {remote_host} + } + } + header /.well-known/matrix/* Content-Type application/json header /.well-known/matrix/* Access-Control-Allow-Origin * respond /.well-known/matrix/server `${toJSON server}` respond /.well-known/matrix/client `${toJSON client}` ''; "${fqn}".extraConfig = '' - reverse_proxy /_matrix/* http://::1:4001 - reverse_proxy /_synapse/client/* http://::1:4001 + reverse_proxy /_matrix/* http://::1:${toString port} + reverse_proxy /_synapse/client/* http://::1:${toString port} ''; }; }; + + livekit = { + enable = true; + openFirewall = true; + inherit keyFile; + + settings = { + port = 4002; + room.auto_create = false; + }; + }; + + lk-jwt-service = { + enable = true; + port = 4003; + # can be on the same virtualHost as synapse + livekitUrl = "wss://${domain}/livekit/sfu"; + inherit keyFile; + }; + + coturn = rec { + enable = true; + listening-port = 4004; + tls-listening-port = 40004; + no-cli = true; + no-tcp-relay = true; + min-port = 50000; + max-port = 50100; + use-auth-secret = true; + static-auth-secret-file = config.sops.secrets."coturn/secret".path; + realm = "turn.${domain}"; + # cert = "${config.security.acme.certs.${realm}.directory}/full.pem"; + # pkey = "${config.security.acme.certs.${realm}.directory}/key.pem"; + extraConfig = '' + # for debugging + verbose + # ban private IP ranges + no-multicast-peers + denied-peer-ip=0.0.0.0-0.255.255.255 + denied-peer-ip=10.0.0.0-10.255.255.255 + denied-peer-ip=100.64.0.0-100.127.255.255 + denied-peer-ip=127.0.0.0-127.255.255.255 + denied-peer-ip=169.254.0.0-169.254.255.255 + denied-peer-ip=172.16.0.0-172.31.255.255 + denied-peer-ip=192.0.0.0-192.0.0.255 + denied-peer-ip=192.0.2.0-192.0.2.255 + denied-peer-ip=192.88.99.0-192.88.99.255 + denied-peer-ip=192.168.0.0-192.168.255.255 + denied-peer-ip=198.18.0.0-198.19.255.255 + denied-peer-ip=198.51.100.0-198.51.100.255 + denied-peer-ip=203.0.113.0-203.0.113.255 + denied-peer-ip=240.0.0.0-255.255.255.255 + denied-peer-ip=::1 + denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff + denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255 + denied-peer-ip=100::-100::ffff:ffff:ffff:ffff + denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff + denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff + denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff + ''; + }; + }; + + networking.firewall = { + allowedTCPPortRanges = []; + allowedTCPPorts = [ + # Synapse + port + + # coTURN ports + config.services.coturn.listening-port + config.services.coturn.alt-listening-port + config.services.coturn.tls-listening-port + config.services.coturn.alt-tls-listening-port + ]; + allowedUDPPortRanges = with config.services.coturn; + lib.singleton { + from = min-port; + to = max-port; + }; + allowedUDPPorts = [ + # coTURN ports + config.services.coturn.listening-port + config.services.coturn.alt-listening-port + ]; + }; + + systemd = { + services.livekit-key = { + before = ["lk-jwt-service.service" "livekit.service"]; + wantedBy = ["multi-user.target"]; + path = with pkgs; [livekit coreutils gawk]; + script = '' + echo "Key missing, generating key" + echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${keyFile}" + ''; + serviceConfig.Type = "oneshot"; + unitConfig.ConditionPathExists = "!${keyFile}"; + }; + services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = "${domain}"; }; sops = { secrets = { "synapse/oidc_id" = {}; "synapse/oidc_secret" = {}; + "coturn/secret" = {}; }; templates = { @@ -222,13 +387,19 @@ in { scopes: - openid - profile + - email + - offline_access client_id: '${config.sops.placeholder."synapse/oidc_id"}' client_secret: '${config.sops.placeholder."synapse/oidc_secret"}' backchannel_logout_enabled: true + user_profile_method: userinfo_endpoint + allow_existing_users: true + enable_registration: true user_mapping_provider: config: localpart_template: "{{ user.preferred_username }}" display_name_template: "{{ user.name }}" + email_template: "{{ user.email }}" ''; restartUnits = ["matrix-synapse.service"]; }; diff --git a/modules/nixos/services/observability/grafana/default.nix b/modules/nixos/services/observability/grafana/default.nix index 05d3570..e2040d4 100644 --- a/modules/nixos/services/observability/grafana/default.nix +++ b/modules/nixos/services/observability/grafana/default.nix @@ -30,6 +30,10 @@ in { domain = "ulmo"; }; + security = { + secret_key = "$__file{${config.sops.secrets."grafana/secret_key".path}}"; + }; + auth = { disable_login_form = false; oauth_auto_login = true; @@ -133,6 +137,10 @@ in { sops = { secrets = { + "grafana/secret_key" = { + owner = "grafana"; + group = "grafana"; + }; "grafana/oidc_id" = { owner = "grafana"; group = "grafana";