diff --git a/host/Rory-desktop/configuration.nix b/host/Rory-desktop/configuration.nix
index f0fb7a7..465936c 100644
--- a/host/Rory-desktop/configuration.nix
+++ b/host/Rory-desktop/configuration.nix
@@ -25,7 +25,7 @@ args@{
./optional/gui/wayland.nix
./printing.nix
- #./ollama.nix
+ ./ollama.nix
];
boot = {
@@ -152,7 +152,8 @@ args@{
gimp
# - Languages
- dotnet-sdk_8
+ #dotnet-sdk_8
+ dotnetCorePackages.sdk_9_0
#games
osu-lazer-bin
@@ -196,6 +197,7 @@ args@{
p11-kit
opensc
eid-mw
+ jitsi-meet-electron
];
environment.etc."pkcs11/modules/opensc-pkcs11".text = ''
module: ${pkgs.opensc}/lib/opensc-pkcs11.so
@@ -228,7 +230,8 @@ args@{
};
fonts = {
packages = with pkgs; [
- (nerdfonts.override { fonts = [ "JetBrainsMono" ]; })
+ #(nerdfonts.override { fonts = [ "JetBrainsMono" ]; })
+ nerd-fonts.jetbrains-mono
noto-fonts-monochrome-emoji
];
fontconfig.defaultFonts.monospace = with pkgs; [ "JetBrainsMonoNL Nerd Font,JetBrainsMonoNL NF:style=Regular" ];
@@ -245,6 +248,8 @@ args@{
permittedInsecurePackages = [
"electron-25.9.0"
"olm-3.2.16"
+ "dotnet-sdk-wrapped-7.0.410"
+ "dotnet-sdk-7.0.410"
];
};
};
diff --git a/host/Rory-desktop/ollama.nix b/host/Rory-desktop/ollama.nix
index 0670617..94ec8cc 100755
--- a/host/Rory-desktop/ollama.nix
+++ b/host/Rory-desktop/ollama.nix
@@ -21,7 +21,7 @@
#];
services.ollama = {
- enable = false;
+ enable = true;
home = "/data/ollama/home";
models = "/data/ollama/home/models";
environmentVariables = {
@@ -35,4 +35,8 @@
group = "ollama";
acceleration = "rocm";
};
+
+ #services.nextjs-ollama-llm-ui = {
+
+ #};
}
diff --git a/host/Rory-desktop/optional/hardware-specific/amd.nix b/host/Rory-desktop/optional/hardware-specific/amd.nix
index 3ae47d2..509ff14 100644
--- a/host/Rory-desktop/optional/hardware-specific/amd.nix
+++ b/host/Rory-desktop/optional/hardware-specific/amd.nix
@@ -32,9 +32,9 @@
enable32Bit = true;
extraPackages = with pkgs; [
rocmPackages.clr.icd
- amdvlk
+ #amdvlk
];
- extraPackages32 = with pkgs; [ driversi686Linux.amdvlk ];
+ #extraPackages32 = with pkgs; [ driversi686Linux.amdvlk ];
};
};
diff --git a/host/Rory-nginx/services/email/maddy.conf b/host/Rory-nginx/services/email/maddy.conf
new file mode 100644
index 0000000..1d3eb2f
--- /dev/null
+++ b/host/Rory-nginx/services/email/maddy.conf
@@ -0,0 +1,124 @@
+
+# Minimal configuration with TLS disabled, adapted from upstream example
+# configuration here https://github.com/foxcpp/maddy/blob/master/maddy.conf
+# Do not use this in production!
+
+auth.pass_table local_authdb {
+ table sql_table {
+ driver sqlite3
+ dsn credentials.db
+ table_name passwords
+ }
+}
+
+storage.imapsql local_mailboxes {
+ driver sqlite3
+ dsn imapsql.db
+}
+
+table.chain local_rewrites {
+ optional_step regexp "(.+)\+(.+)@(.+)" "$1@$3"
+ optional_step static {
+ entry postmaster root@$(primary_domain)
+ }
+ optional_step file /etc/maddy/aliases
+}
+
+msgpipeline local_routing {
+ destination postmaster $(local_domains) {
+ modify {
+ replace_rcpt &local_rewrites
+ }
+ deliver_to &local_mailboxes
+ }
+ default_destination {
+ reject 550 5.1.1 "User doesn't exist"
+ }
+}
+
+smtp tcp://0.0.0.0:25 {
+ limits {
+ all rate 20 1s
+ all concurrency 10
+ }
+ dmarc yes
+ check {
+ require_mx_record
+ dkim
+ spf
+ }
+ source $(local_domains) {
+ reject 501 5.1.8 "Use Submission for outgoing SMTP"
+ }
+ default_source {
+ destination postmaster $(local_domains) {
+ deliver_to &local_routing
+ }
+ default_destination {
+ reject 550 5.1.1 "User doesn't exist"
+ }
+ }
+}
+
+submission tls://0.0.0.0:465 tcp://0.0.0.0:587 {
+ limits {
+ all rate 50 1s
+ }
+ auth &local_authdb
+ source $(local_domains) {
+ check {
+ authorize_sender {
+ prepare_email &local_rewrites
+ user_to_email identity
+ }
+ }
+ destination postmaster $(local_domains) {
+ deliver_to &local_routing
+ }
+ default_destination {
+ modify {
+ dkim $(primary_domain) $(local_domains) default
+ }
+ deliver_to &remote_queue
+ }
+ }
+ default_source {
+ reject 501 5.1.8 "Non-local sender domain"
+ }
+}
+
+target.remote outbound_delivery {
+ limits {
+ destination rate 20 1s
+ destination concurrency 10
+ }
+ mx_auth {
+ dane
+ mtasts {
+ cache fs
+ fs_dir mtasts_cache/
+ }
+ local_policy {
+ min_tls_level encrypted
+ min_mx_level none
+ }
+ }
+}
+
+target.queue remote_queue {
+ target &outbound_delivery
+ autogenerated_msg_domain $(primary_domain)
+ bounce {
+ destination postmaster $(local_domains) {
+ deliver_to &local_routing
+ }
+ default_destination {
+ reject 550 5.0.0 "Refusing to send DSNs to non-local addresses"
+ }
+ }
+}
+
+imap tls://0.0.0.0:993 tcp://0.0.0.0:143 {
+ auth &local_authdb
+ storage &local_mailboxes
+}
\ No newline at end of file
diff --git a/host/Rory-nginx/services/email/maddy.nix b/host/Rory-nginx/services/email/maddy.nix
index 0dfc2e4..8f89405 100644
--- a/host/Rory-nginx/services/email/maddy.nix
+++ b/host/Rory-nginx/services/email/maddy.nix
@@ -15,15 +15,17 @@
ensureCredentials = {
"root@rory.gay".passwordFile = "/var/lib/maddy/passwd/root";
};
- config =
+ config = #builtins.readFile ./maddy.conf;
builtins.replaceStrings
[
"imap tcp://0.0.0.0:143"
"submission tcp://0.0.0.0:587"
+ "entry postmaster postmaster@$(primary_domain)"
]
[
"imap tls://0.0.0.0:993 tcp://0.0.0.0:143"
"submission tls://0.0.0.0:465 tcp://0.0.0.0:587"
+ "entry postmaster root@$(primary_domain)"
]
options.services.maddy.config.default;
diff --git a/host/Rory-nginx/services/matrix/synapse/workers/federation-reader.nix b/host/Rory-nginx/services/matrix/synapse/workers/federation-reader.nix
index 5b3d4bf..fd75817 100644
--- a/host/Rory-nginx/services/matrix/synapse/workers/federation-reader.nix
+++ b/host/Rory-nginx/services/matrix/synapse/workers/federation-reader.nix
@@ -21,7 +21,7 @@ let
"~ ^/_matrix/federation/(v1|v2)/send_leave/"
"~ ^/_matrix/federation/v1/make_knock/"
"~ ^/_matrix/federation/v1/send_knock/"
- "~ ^/_matrix/federation/(v1|v2)/invite/"
+ # "~ ^/_matrix/federation/(v1|v2)/invite/" # Needs special handling, define manually
"~ ^/_matrix/federation/(v1|v2)/query_auth/"
"~ ^/_matrix/federation/(v1|v2)/event_auth/"
"~ ^/_matrix/federation/v1/timestamp_to_event/"
@@ -134,6 +134,14 @@ in
)
)
);
+
+ virtualHosts."${cfg.nginxVirtualHostName}".locations."~ ^/_matrix/federation/(v1|v2)/invite/" = {
+ proxyPass = "http://${workerName}-federation";
+ extraConfig = ''
+ proxy_http_version 1.1;
+ proxy_set_header Connection "";
+ '';
+ };
};
};
}
diff --git a/host/Rory-nginx/services/matrix/synapse/workers/module.nix b/host/Rory-nginx/services/matrix/synapse/workers/module.nix
index 32f2095..d761421 100644
--- a/host/Rory-nginx/services/matrix/synapse/workers/module.nix
+++ b/host/Rory-nginx/services/matrix/synapse/workers/module.nix
@@ -68,6 +68,12 @@ in
default = null;
description = "The virtual host name for the nginx server";
};
+
+ allowedRemoteInviteOrigins = lib.mkOption {
+ type = lib.types.listOf lib.types.str;
+ default = [];
+ description = "List of allowed remote invite origins";
+ };
};
config = {
@@ -110,5 +116,20 @@ in
message = "Only one shared stream writer is supported";
}
];
+
+ # Matrix utility maps
+ services.nginx.httpConfig = ''
+ # Map authorization header to origin name
+ map $http_authorization $mx_origin_name {
+ default "";
+ "~*X-Matrix origin=(?<origin>[^,]+)" $origin;
+ }
+
+ # Map origin name to whether it can invite
+ map $mx_origin_name $mx_can_invite {
+ default 0;
+ ${lib.concatMapStringsSep "\n" (origin: " \"${origin}\" 1;") cfg.allowedRemoteInviteOrigins}
+ }
+ '';
};
}
|
