Add ansible draupnir

4 files changed, 93 insertions, 0 deletions

diff --git a/host/Rory-ovh/configuration.nix b/host/Rory-ovh/configuration.nix

index 670db24..3ded494 100755
--- a/host/Rory-ovh/configuration.nix
+++ b/host/Rory-ovh/configuration.nix
@@ -91,6 +91,7 @@
       nixpkgs-DraupnirPkg
       ;
   };
+
   containers."draupnir-fedora" = import ./services/containers/draupnir-fedora/container.nix {
     inherit
       pkgs
@@ -100,6 +101,15 @@
       ;
   };
 
+  containers."draupnir-ansible" = import ./services/containers/draupnir-ansible/container.nix {
+    inherit
+      pkgs
+      lib
+      nixpkgs-Draupnir
+      nixpkgs-DraupnirPkg
+      ;
+  };
+
   system.stateVersion = "22.11"; # DO NOT EDIT!
 
   environment.systemPackages = with pkgs; [ waypipe ];
diff --git a/host/Rory-ovh/services/containers/draupnir-ansible/container.nix b/host/Rory-ovh/services/containers/draupnir-ansible/container.nix
new file mode 100644

index 0000000..5ab1aed
--- /dev/null
+++ b/host/Rory-ovh/services/containers/draupnir-ansible/container.nix
@@ -0,0 +1,37 @@
+{
+#  nixpkgs-Draupnir,
+#  nixpkgs-DraupnirPkg,
+  ...
+}:
+
+{
+  privateNetwork = true;
+  autoStart = true;
+  specialArgs = {
+#    inherit nixpkgs-Draupnir;
+#    inherit nixpkgs-DraupnirPkg;
+  };
+  config =
+    { lib, pkgs, ... }:
+    {
+      imports = [
+        ../shared.nix
+        ./root.nix
+        ./services/draupnir.nix
+#        "${nixpkgs-Draupnir}/nixos/modules/services/matrix/draupnir.nix"
+      ];
+#      nixpkgs.overlays = [
+#        (final: prev: {
+#          draupnir = nixpkgs-DraupnirPkg.legacyPackages.${pkgs.stdenv.hostPlatform.system}.draupnir;
+#        })
+#      ];
+    };
+  hostAddress = "192.168.100.1";
+  localAddress = "192.168.100.19";
+
+  bindMounts."draupnir-access-token" = {
+    hostPath = "/data/secrets/draupnir-ansible-access-token";
+    mountPoint = "/etc/draupnir-access-token";
+    isReadOnly = true;
+  };
+}
diff --git a/host/Rory-ovh/services/containers/draupnir-ansible/root.nix b/host/Rory-ovh/services/containers/draupnir-ansible/root.nix
new file mode 100644

index 0000000..0ebce9e
--- /dev/null
+++ b/host/Rory-ovh/services/containers/draupnir-ansible/root.nix
@@ -0,0 +1,16 @@
+{ ... }:
+
+{
+  networking.useHostResolvConf = true;
+
+  networking.hosts = {
+    "192.168.100.1" = [
+      "matrix.rory.gay"
+      "rory.gay"
+    ];
+  };
+
+  networking.firewall = {
+    enable = true;
+  };
+}
diff --git a/host/Rory-ovh/services/containers/draupnir-ansible/services/draupnir.nix b/host/Rory-ovh/services/containers/draupnir-ansible/services/draupnir.nix
new file mode 100644

index 0000000..c05b170
--- /dev/null
+++ b/host/Rory-ovh/services/containers/draupnir-ansible/services/draupnir.nix
@@ -0,0 +1,30 @@
+{ ... }:
+
+{
+  services.draupnir = {
+    enable = true;
+    secrets.accessToken = "/etc/draupnir-access-token";
+
+    settings = {
+      homeserverUrl = "https://matrix.rory.gay";
+      managementRoom = "#draupnir-ansible-mgmt:rory.gay";
+      recordIgnoredInvites = true; # We want to be aware of invites
+      autojoinOnlyIfManager = true; # ... but we don't want the bot to be invited to eg. Matrix HQ...
+      automaticallyRedactForReasons = [ "*" ]; # Always autoredact
+      fasterMembershipChecks = true;
+
+      backgroundDelayMS = 10; # delay isn't needed, I don't mind the performance hit
+      pollReports = false;
+
+      admin.enableMakeRoomAdminCommand = false;
+      commands.ban.defaultReasons = [ "spam" ];
+
+      protections = {
+        wordlist = {
+          words = [ "https://postimg.cc/" ];
+          minutesBeforeTrusting = 0;
+        };
+      };
+    };
+  };
+}