Refactor

18 files changed, 216 insertions, 255 deletions

diff --git a/flake.nix b/flake.nix
index 17fc916..1273d08 100755
--- a/flake.nix
+++ b/flake.nix
@@ -12,6 +12,15 @@
     home-manager =  {
       url = "github:nix-community/home-manager/master";
     };
+    conduit = {
+      url = "gitlab:famedly/conduit";
+
+      # Assuming you have an input for nixpkgs called `nixpkgs`. If you experience
+      # build failures while using this, try commenting/deleting this line. This
+      # will probably also require you to always build from source.
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
   };
 
   outputs = { self, nixpkgs, home-manager, botcore-v4 }: {
@@ -21,48 +30,12 @@
         modules = [
           ./host/Rory-nginx/configuration.nix
           ./hardware-configuration.nix
-          ./host/Rory-discordbots/software.nix
-          ./host/Rory-synapse/software.nix
-	  ./host/Rory-postgres/software.nix
-          home-manager.nixosModules.home-manager
-        ];
-        specialArgs = {
-          inherit botcore-v4;
-          inherit home-manager;
-        };
-      };
-      Rory-postgres = nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules = [
-          ./host/Rory-postgres/configuration.nix
-          ./hardware-configuration.nix
-          home-manager.nixosModules.home-manager
-        ];
-        specialArgs = {
-          inherit home-manager;
-        };
-      };
-      Rory-synapse = nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules = [
-          ./host/Rory-synapse/configuration.nix
-          ./hardware-configuration.nix
-          home-manager.nixosModules.home-manager
-        ];
-        specialArgs = {
-          inherit home-manager;
-        };
-      };
-      Rory-discordbots = nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules = [
-          ./host/Rory-discordbots/configuration.nix
-          ./hardware-configuration.nix
           home-manager.nixosModules.home-manager
         ];
         specialArgs = {
           inherit botcore-v4;
           inherit home-manager;
+          inherit conduit;
         };
       };
       Rory-devenv = nixpkgs.lib.nixosSystem {
@@ -76,7 +49,6 @@
           inherit home-manager;
         };
       };
-      
     };
   };
 }
diff --git a/host/Rory-discordbots/configuration.nix b/host/Rory-discordbots/configuration.nix
deleted file mode 100755
index dbc509c..0000000
--- a/host/Rory-discordbots/configuration.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ config, pkgs, lib, botcore-v4, ... }:
-
-{
-  imports =
-    [
-      ../../modules/base-server.nix
-      ./software.nix
-    ];
-
-  networking = {
-    hostName = "Rory-discordbots";
-    interfaces.ens18.ipv4.addresses = [ { 
-      address = "192.168.1.50";
-      prefixLength = 24;
-    } ];
-    interfaces.ens19.ipv4.addresses = [ {
-      address = "10.10.10.50";
-      prefixLength = 16;
-    } ];
-  };
-
-  system.stateVersion = "22.11"; # DO NOT EDIT!
-}
\ No newline at end of file
diff --git a/host/Rory-nginx/configuration.nix b/host/Rory-nginx/configuration.nix
index 2f2f7cc..2c33448 100755
--- a/host/Rory-nginx/configuration.nix
+++ b/host/Rory-nginx/configuration.nix
@@ -6,6 +6,11 @@
       ../../modules/base-server.nix
       ../../modules/users/levi.nix
       ../../modules/users/db2k.nix
+
+      ../../modules/services/nginx.nix
+      ../../modules/services/postgres.nix
+      ../../modules/services/synapse.nix
+
       ./software.nix
     ];
   users.groups.ocp = {};
diff --git a/host/Rory-nginx/hosts/rory.gay/conduit.nix b/host/Rory-nginx/hosts/rory.gay/conduit.nix
new file mode 100755
index 0000000..8c293d7
--- /dev/null
+++ b/host/Rory-nginx/hosts/rory.gay/conduit.nix
@@ -0,0 +1,25 @@
+{
+  enableACME = true;
+  addSSL = true;
+  locations."/_matrix" = {
+    proxyPass = "http://192.168.1.5:6167"; 
+    extraConfig = ''
+      if ($request_method = 'OPTIONS') {
+        more_set_headers 'Access-Control-Allow-Origin: *';
+        more_set_headers 'Access-Control-Allow-Methods: *';
+        #
+        # Custom headers and headers various browsers *should* be OK with but aren't
+        #
+        more_set_headers 'Access-Control-Allow-Headers: *';
+        #
+        # Tell client that this pre-flight info is valid for 20 days
+        #
+        more_set_headers 'Access-Control-Max-Age: 1728000';
+        more_set_headers 'Content-Type: text/plain; charset=utf-8';
+        more_set_headers 'Content-Length: 0';
+        return 204;
+      }
+    '';
+  };
+  #locations."/_synapse/client".proxyPass = "http://192.168.1.5:8008";   
+}
diff --git a/host/Rory-nginx/post-rebuild.sh b/host/Rory-nginx/post-rebuild.sh
index ea6e013..0ea1293 100755
--- a/host/Rory-nginx/post-rebuild.sh
+++ b/host/Rory-nginx/post-rebuild.sh
@@ -8,7 +8,7 @@ REACHABLE_DOMAIN='http://localhost:8008'
 # -- LICENSE: CNPL v7+ - https://thufie.lain.haus/files/CNPLv7.md
 # Modified from Nyaaori (https://nyaaori.cat) <+@nyaaori.cat>
 # Explicit authorisation to use the code has been granted by the original author
-#  for use by members of the Rory system (https://rory.gay)
+#  for use by members of the Rory& system (https://rory.gay)
 
 
 # the magic function:
diff --git a/host/Rory-discordbots/software.nix b/host/Rory-nginx/services/discordbots.nix
index b0b9cf2..b0b9cf2 100755
--- a/host/Rory-discordbots/software.nix
+++ b/host/Rory-nginx/services/discordbots.nix
diff --git a/host/Rory-nginx/services/matrix/conduit.nix b/host/Rory-nginx/services/matrix/conduit.nix
new file mode 100755
index 0000000..77ba1fb
--- /dev/null
+++ b/host/Rory-nginx/services/matrix/conduit.nix
@@ -0,0 +1,20 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports =
+    [
+      ../../modules/base-server.nix
+    ];
+
+  services.matrix-conduit = {
+    enable = true;
+    settings.global = {
+      server_name = "conduit.rory.gay";
+    };
+    database_backend = "rocksdb";
+    enable_lightning_bolt = true;
+    max_concurrent_requests = 1000;
+  };
+  system.stateVersion = "22.11"; # DO NOT EDIT!
+}
+
diff --git a/host/Rory-nginx/services/matrix/coturn.nix b/host/Rory-nginx/services/matrix/coturn.nix
new file mode 100755
index 0000000..434dd52
--- /dev/null
+++ b/host/Rory-nginx/services/matrix/coturn.nix
@@ -0,0 +1,54 @@
+{ config, pkgs, lib, ... }:
+
+{
+
+  # coturn (WebRTC)
+  services.coturn = rec {
+    enable = false; # Alicia - figure out secret first...
+    no-cli = true;
+    no-tcp-relay = true;
+    min-port = 49000;
+    max-port = 50000;
+    use-auth-secret = true;
+    static-auth-secret = "will be world readable for local users :(";
+    realm = "turn.example.com";
+    # Alicia - figure out how to get this to work, since nginx runs on separate machine...
+    #cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
+    #pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
+    extraConfig = ''
+      # for debugging
+      verbose
+      # ban private IP ranges
+      no-multicast-peers
+      denied-peer-ip=0.0.0.0-0.255.255.255
+      denied-peer-ip=10.0.0.0-10.255.255.255
+      denied-peer-ip=100.64.0.0-100.127.255.255
+      denied-peer-ip=127.0.0.0-127.255.255.255
+      denied-peer-ip=169.254.0.0-169.254.255.255
+      denied-peer-ip=172.16.0.0-172.31.255.255
+      denied-peer-ip=192.0.0.0-192.0.0.255
+      denied-peer-ip=192.0.2.0-192.0.2.255
+      denied-peer-ip=192.88.99.0-192.88.99.255
+      denied-peer-ip=192.168.0.0-192.168.255.255
+      denied-peer-ip=198.18.0.0-198.19.255.255
+      denied-peer-ip=198.51.100.0-198.51.100.255
+      denied-peer-ip=203.0.113.0-203.0.113.255
+      denied-peer-ip=240.0.0.0-255.255.255.255
+      denied-peer-ip=::1
+      denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
+      denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
+      denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
+      denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+    '';
+  };
+  #services.matrix-synapse = with config.services.coturn; {
+  #  turn_uris = ["turn:${realm}:3478?transport=udp" "turn:${realm}:3478?transport=tcp"];
+  #  turn_shared_secret = static-auth-secret;
+  #  turn_user_lifetime = "1h";
+  #};
+  system.stateVersion = "22.11"; # DO NOT EDIT!
+}
+
diff --git a/host/Rory-nginx/services/matrix/draupnir.nix b/host/Rory-nginx/services/matrix/draupnir.nix
new file mode 100755
index 0000000..19a2f16
--- /dev/null
+++ b/host/Rory-nginx/services/matrix/draupnir.nix
@@ -0,0 +1,53 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports =
+    [
+      ../../modules/base-server.nix
+    ];
+
+  # Alicia - doesnt work yet... until in nixpkgs...
+  services.draupnir = {
+    enable = true;
+    
+    pantalaimon = {
+      enable = true;
+      username = "draupnir";
+      passwordFile = "/etc/draupnir-password";
+      options = {
+        homeserver = "http://localhost:8008";
+        ssl = false;
+      };
+      
+    };
+    managementRoom = "#draupnir-mgmt:rory.gay";
+    homeserverUrl = "http://localhost:8008";
+    verboseLogging = false;
+    settings = {
+      recordIgnoredInvites = false;
+      automaticallyRedactForReasons = [ "*" ];
+      fasterMembershipChecks = true;
+      backgroundDelayMS = 100;
+      pollReports = true;
+      admin.enableMakeRoomAdminCommand = true;
+      commands.ban.defaultReasons = [
+        "spam"
+        "harassment"
+        "transphobia"
+        "scam"
+      ];
+      protections = {
+        wordlist = {
+          words = [
+            "tranny"
+            "faggot"
+          ];
+          minutesBeforeTrusting = 0;
+        };
+      };
+    };
+  };
+
+  system.stateVersion = "22.11"; # DO NOT EDIT!
+}
+
diff --git a/host/Rory-nginx/services/matrix/matrix-appservice-discord.nix b/host/Rory-nginx/services/matrix/matrix-appservice-discord.nix
new file mode 100755
index 0000000..3f2225f
--- /dev/null
+++ b/host/Rory-nginx/services/matrix/matrix-appservice-discord.nix
@@ -0,0 +1,26 @@
+{ config, pkgs, lib, ... }:
+
+{
+  # Discord bridge
+   services.matrix-appservice-discord = {
+    enable = false; # Alicia - figure out secret first...
+    environmentFile = /etc/keyring/matrix-appservice-discord/tokens.env;
+    # The appservice is pre-configured to use SQLite by default.
+    # It's also possible to use PostgreSQL.
+    settings = {
+      bridge = {
+        domain = "rory.gay";
+        homeserverUrl = "https://matrix.rory.gay";
+      };
+
+      # The service uses SQLite by default, but it's also possible to use
+      # PostgreSQL instead:
+      database = {
+        #  filename = ""; # empty value to disable sqlite
+        connString = "postgres://postgres@127.0.0.1/matrix-appservice-discord";
+      };
+    };
+   };
+  system.stateVersion = "22.11"; # DO NOT EDIT!
+}
+
diff --git a/host/Rory-nginx/services/matrix/root.nix b/host/Rory-nginx/services/matrix/root.nix
new file mode 100755
index 0000000..f9a9d49
--- /dev/null
+++ b/host/Rory-nginx/services/matrix/root.nix
@@ -0,0 +1,13 @@
+{ config, pkgs, lib, botcore-v4, ... }:
+
+{
+  imports =
+    [
+      ./synapse.nix
+      ./coturn.nix
+      ./matrix-appservice-discord.nix
+      ./draupnir.nix
+    ];
+
+  system.stateVersion = "22.11"; # DO NOT EDIT!
+}
\ No newline at end of file
diff --git a/host/Rory-synapse/software.nix b/host/Rory-nginx/services/matrix/synapse.nix
index 5db557b..b69af7a 100755
--- a/host/Rory-synapse/software.nix
+++ b/host/Rory-nginx/services/matrix/synapse.nix
@@ -6,76 +6,6 @@
       ../../modules/base-server.nix
     ];
 
-  # coturn (WebRTC)
-  services.coturn = rec {
-    enable = false; # Alicia - figure out secret first...
-    no-cli = true;
-    no-tcp-relay = true;
-    min-port = 49000;
-    max-port = 50000;
-    use-auth-secret = true;
-    static-auth-secret = "will be world readable for local users :(";
-    realm = "turn.example.com";
-    # Alicia - figure out how to get this to work, since nginx runs on separate machine...
-    #cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
-    #pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
-    extraConfig = ''
-      # for debugging
-      verbose
-      # ban private IP ranges
-      no-multicast-peers
-      denied-peer-ip=0.0.0.0-0.255.255.255
-      denied-peer-ip=10.0.0.0-10.255.255.255
-      denied-peer-ip=100.64.0.0-100.127.255.255
-      denied-peer-ip=127.0.0.0-127.255.255.255
-      denied-peer-ip=169.254.0.0-169.254.255.255
-      denied-peer-ip=172.16.0.0-172.31.255.255
-      denied-peer-ip=192.0.0.0-192.0.0.255
-      denied-peer-ip=192.0.2.0-192.0.2.255
-      denied-peer-ip=192.88.99.0-192.88.99.255
-      denied-peer-ip=192.168.0.0-192.168.255.255
-      denied-peer-ip=198.18.0.0-198.19.255.255
-      denied-peer-ip=198.51.100.0-198.51.100.255
-      denied-peer-ip=203.0.113.0-203.0.113.255
-      denied-peer-ip=240.0.0.0-255.255.255.255
-      denied-peer-ip=::1
-      denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
-      denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
-      denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
-      denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
-      denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-      denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-      denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-    '';
-  };
-
-  #services.matrix-synapse = with config.services.coturn; {
-  #  turn_uris = ["turn:${realm}:3478?transport=udp" "turn:${realm}:3478?transport=tcp"];
-  #  turn_shared_secret = static-auth-secret;
-  #  turn_user_lifetime = "1h";
-  #};
-
-  # Discord bridge
-   services.matrix-appservice-discord = {
-    enable = false; # Alicia - figure out secret first...
-    environmentFile = /etc/keyring/matrix-appservice-discord/tokens.env;
-    # The appservice is pre-configured to use SQLite by default.
-    # It's also possible to use PostgreSQL.
-    settings = {
-      bridge = {
-        domain = "rory.gay";
-        homeserverUrl = "https://matrix.rory.gay";
-      };
-
-      # The service uses SQLite by default, but it's also possible to use
-      # PostgreSQL instead:
-      database = {
-        #  filename = ""; # empty value to disable sqlite
-        connString = "postgres://postgres@127.0.0.1/matrix-appservice-discord";
-      };
-    };
-   };
-
   services.matrix-synapse = {
     enable = true;
     withJemalloc = true;
@@ -252,48 +182,6 @@
 #      ];
   };
 
-  # Alicia - doesnt work yet... until in nixpkgs...
-  services.draupnir = {
-    enable = true;
-    
-    pantalaimon = {
-      enable = true;
-      username = "draupnir";
-      passwordFile = "/etc/draupnir-password";
-      options = {
-        homeserver = "http://localhost:8008";
-        ssl = false;
-      };
-      
-    };
-    managementRoom = "#draupnir-mgmt:rory.gay";
-    homeserverUrl = "http://localhost:8008";
-    verboseLogging = false;
-    settings = {
-      recordIgnoredInvites = false;
-      automaticallyRedactForReasons = [ "*" ];
-      fasterMembershipChecks = true;
-      backgroundDelayMS = 100;
-      pollReports = true;
-      admin.enableMakeRoomAdminCommand = true;
-      commands.ban.defaultReasons = [
-        "spam"
-        "harassment"
-        "transphobia"
-        "scam"
-      ];
-      protections = {
-        wordlist = {
-          words = [
-            "tranny"
-            "faggot"
-          ];
-          minutesBeforeTrusting = 0;
-        };
-      };
-    };
-  };
-
     systemd.services.matrix-synapse-reg-token = {
       description = "Random registration token for Synapse.";
       before = ["matrix-synapse.service"]; # So the registration can be used by Synapse
diff --git a/host/Rory-postgres/software.nix b/host/Rory-nginx/services/postgres.nix
index 7b75435..7b75435 100755
--- a/host/Rory-postgres/software.nix
+++ b/host/Rory-nginx/services/postgres.nix
diff --git a/host/Rory-postgres/configuration.nix b/host/Rory-postgres/configuration.nix
deleted file mode 100755
index f399f78..0000000
--- a/host/Rory-postgres/configuration.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  imports =
-    [
-      ../../modules/base-server.nix
-      ./software.nix
-    ];
-
-  networking = {
-    hostName = "Rory-postgres";
-    interfaces.ens18.ipv4.addresses = [ { 
-      address = "192.168.1.3";
-      prefixLength = 24;
-    } ];
-    interfaces.ens19.ipv4.addresses = [ {
-      address = "10.10.10.3";
-      prefixLength = 16;
-    } ];
-  };
-
-  system.stateVersion = "22.11"; # DO NOT EDIT!
-}
-
diff --git a/host/Rory-synapse/configuration.nix b/host/Rory-synapse/configuration.nix
deleted file mode 100755
index 020a804..0000000
--- a/host/Rory-synapse/configuration.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  imports =
-    [
-      ../../modules/base-server.nix
-      ./software.nix
-    ];
-
-  networking = {
-    hostName = "Rory-synapse";
-    interfaces.ens18.ipv4.addresses = [ { 
-      address = "192.168.1.5";
-      prefixLength = 24;
-    } ];
-    interfaces.ens19.ipv4.addresses = [ {
-      address = "10.10.10.5";
-      prefixLength = 16;
-    } ];
-  };
-
-  system.stateVersion = "22.11"; # DO NOT EDIT!
-}
-
diff --git a/host/Rory-synapse/post-rebuild.sh b/host/Rory-synapse/post-rebuild.sh
deleted file mode 100755
index 27028d9..0000000
--- a/host/Rory-synapse/post-rebuild.sh
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused nix coreutils jq openssl
-#set -x
-REG_KEY=`cat /var/lib/matrix-synapse/registration_shared_secret.txt`
-LOCALPART='rory.gay'
-REACHABLE_DOMAIN='http://localhost:8008'
-
-# -- LICENSE: CNPL v7+ - https://thufie.lain.haus/files/CNPLv7.md
-# Modified from Nyaaori (https://nyaaori.cat) <+@nyaaori.cat>
-# Explicit authorisation to use the code has been granted by the original author
-#  for use by members of the Rory system (https://rory.gay)
-
-
-# the magic function:
-register(){
-	echo "Registering $1 with password $2"
-	_nonce=`curl http://localhost:8008/_synapse/admin/v1/register | jq -r .nonce`
-	#data: nonce, domain, username, password
-	_hmac=`printf '%s\0%s\0%s\0%s' "$_nonce" "$1" "$2" "admin" |  openssl dgst -sha1 -hmac "$REG_KEY" |  awk '{print $2}'`
-	curl -XPOST -d '{"nonce": "'"$_nonce"'", "username": "'"$1"'", "displayname": "'"$1"'", "password": "'"$2"'", "admin": true, "mac": "'"$_hmac"'"}' $REACHABLE_DOMAIN/_synapse/admin/v1/register | tee -a matrix-user-tokens.txt
-}
-
-# -- END OF LICENSED CODE
-
-
-
-PASSWD=`cat /etc/matrix-user-pass`
-for u in {draupnir,Alicia,Emma,Rory,root}
-do 
-	register $u $PASSWD
-done
diff --git a/host/Rory-synapse/pre-rebuild.sh b/host/Rory-synapse/pre-rebuild.sh
deleted file mode 100755
index 9d92682..0000000
--- a/host/Rory-synapse/pre-rebuild.sh
+++ /dev/null
@@ -1,2 +0,0 @@
-#!/usr/bin/env sh
-echo "PRE REBUILD TEST"
diff --git a/update.sh b/update.sh
index cbec982..6ce5622 100755
--- a/update.sh
+++ b/update.sh
@@ -1,3 +1,12 @@
 #!/usr/bin/env sh
+
+if [ -d "nixpkgs" ]; then
+    cd nixpkgs
+    git remote add upstream https://github.com/NixOS/nixpkgs || git remote set-url upstream https://github.com/NixOS/nixpkgs
+    git fetch --all -v
+    git rebase upstream/nixos-unstable -v
+    cd ..
+fi
+
 nix flake update
 ./build.sh / $HOSTNAME
\ No newline at end of file