flake/hosts/blacksteel/default.nix

322 lines
8.7 KiB
Nix
Raw Normal View History

{
pkgs,
lib,
config,
...
}: {
2024-02-13 04:01:59 +00:00
imports = [
# OS
# FIXME:
../../nixos/profiles/common/core
../../nixos/profiles/common/physical
../../nixos/profiles/common/mobile
2024-02-13 04:01:59 +00:00
../../nixos/profiles/common/opt-in/clash-meta-client
# Hardware
./hardware-configuration.nix
./anti-feature.nix
];
boot.loader.efi.canTouchEfiVariables = true;
boot.loader.systemd-boot.enable = true;
2024-02-13 04:01:59 +00:00
networking.hostName = "blacksteel";
time.timeZone = "Asia/Shanghai";
2024-04-22 18:35:50 +00:00
system.stateVersion = "23.11";
2024-02-13 04:01:59 +00:00
######## Secrets
sops = {
secrets = builtins.mapAttrs (_name: value: value // {sopsFile = ./secrets.yaml;}) {
"synapse/secret" = {
restartUnits = ["matrix-synapse.service"];
owner = config.systemd.services.matrix-synapse.serviceConfig.User;
};
"synapse/oidc" = {
restartUnits = ["matrix-synapse.service"];
owner = config.systemd.services.matrix-synapse.serviceConfig.User;
};
"syncv3/environment" = {
restartUnits = ["matrix-sliding-sync.service"];
};
"mastodon/environment" = {
restartUnits = ["mastodon-web.service"];
};
};
};
2024-02-15 16:58:18 +00:00
######## Services
environment.systemPackages = with pkgs; [qbittorrent];
services.tailscale = {
enable = true;
openFirewall = true;
};
2024-02-15 16:58:18 +00:00
services.frp = {
enable = true;
role = "client";
settings = {
serverAddr = "18.177.132.61"; # TODO: can I use a domain name?
serverPort = 7000;
auth.method = "token";
auth.token = "p4$m93060THuwtYaF0Jnr(RvYGZkI*Lqvh!kGXNesZCm4JQubMQlFDzr#F7rAycE"; # FIXME: secret!
proxies = [
{
name = "synapse";
type = "tcp";
localIP = "127.0.0.1";
localPort = 8100;
remotePort = 8600;
}
{
name = "syncv3";
type = "tcp";
localIP = "127.0.0.1";
remotePort = 8700;
plugin = {
type = "unix_domain_socket";
unixPath = "/run/matrix-sliding-sync/sync.sock";
};
}
{
name = "mastodon-web";
type = "tcp";
localIP = "127.0.0.1";
remotePort = 8900;
plugin = {
type = "unix_domain_socket";
unixPath = "/run/mastodon-web/web.socket";
};
}
{
name = "mastodon-streaming";
type = "tcp";
localIP = "127.0.0.1";
remotePort = 9000;
plugin = {
type = "unix_domain_socket";
unixPath = "/run/mastodon-streaming/streaming-1.socket";
};
}
{
name = "mastodon-system";
type = "tcp";
localIP = "127.0.0.1";
remotePort = 9100;
plugin = {
type = "static_file";
localPath = "/var/lib/mastodon/public-system";
};
}
];
};
};
systemd.services.frp.serviceConfig.SupplementaryGroups = ["mastodon"];
services.postgresql = {
enable = true;
settings = {
# Generated by pgTune
# https://pgtune.leopard.in.ua/#/
#
# DB Version: 15
# OS Type: linux
# DB Type: web
# Total Memory (RAM): 16 GB
# CPUs num: 8
# Data Storage: ssd
max_connections = 200;
shared_buffers = "4GB";
effective_cache_size = "12GB";
maintenance_work_mem = "1GB";
checkpoint_completion_target = 0.9;
wal_buffers = "16MB";
default_statistics_target = 100;
random_page_cost = "1.1";
effective_io_concurrency = 200;
work_mem = "5242kB";
huge_pages = "off";
min_wal_size = "1GB";
max_wal_size = "4GB";
max_worker_processes = 8;
max_parallel_workers_per_gather = 4;
max_parallel_workers = 8;
max_parallel_maintenance_workers = 4;
};
initialScript = pkgs.writeText "synapse-init.sql" ''
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
TEMPLATE template0
LC_COLLATE = "C"
LC_CTYPE = "C";
'';
};
services.postgresqlBackup = {
enable = true;
location = "/var/lib/backup/postgresql";
compression = "zstd";
startAt = "weekly";
};
2024-02-13 11:19:55 +00:00
services.minecraft-server = {
enable = true;
eula = true;
openFirewall = true;
# Aikar's flag
# https://aikar.co/2018/07/02/tuning-the-jvm-g1gc-garbage-collector-flags-for-minecraft/
# https://docs.papermc.io/paper/aikars-flags
jvmOpts = lib.concatStringsSep " " [
"-Xms2G"
"-Xmx2G"
"-XX:+UseG1GC"
"-XX:+ParallelRefProcEnabled"
"-XX:MaxGCPauseMillis=200"
"-XX:+UnlockExperimentalVMOptions"
"-XX:+DisableExplicitGC"
"-XX:+AlwaysPreTouch"
"-XX:G1NewSizePercent=30"
"-XX:G1MaxNewSizePercent=40"
"-XX:G1HeapRegionSize=8M"
"-XX:G1ReservePercent=20"
"-XX:G1HeapWastePercent=5"
"-XX:G1MixedGCCountTarget=4"
"-XX:InitiatingHeapOccupancyPercent=15"
"-XX:G1MixedGCLiveThresholdPercent=90"
"-XX:G1RSetUpdatingPauseTimePercent=5"
"-XX:SurvivorRatio=32"
"-XX:+PerfDisableSharedMem"
"-XX:MaxTenuringThreshold=1"
"-Dusing.aikars.flags=https://mcflags.emc.gs"
"-Daikars.new.flags=true"
];
2024-02-13 11:19:55 +00:00
declarative = true;
serverProperties = {
motd = "NixOS Minecraft server!";
white-list = true;
2024-02-15 16:58:18 +00:00
2024-02-13 11:19:55 +00:00
difficulty = 3;
gamemode = 0;
max-players = 5;
};
whitelist = {
"Guanran928" = "86dbb6c5-8d8b-4c45-b8eb-b3fdf03bfb27";
"i_love_ravens" = "2788dd4b-b010-4a2f-9b5c-aad0c0e0cba5";
};
};
2024-02-15 16:58:18 +00:00
services.samba = {
enable = true;
openFirewall = true;
shares."share" = {
path = "/srv/samba/share";
"read only" = "no";
};
};
2024-02-15 16:58:18 +00:00
services.samba-wsdd = {
enable = true;
openFirewall = true;
};
2024-02-15 16:58:18 +00:00
systemd.tmpfiles.rules = [
"d /srv/samba/share 0700 guanranwang root"
];
2024-02-17 13:45:58 +00:00
services.matrix-synapse = {
enable = true;
withJemalloc = true;
extraConfigFiles = [config.sops.secrets."synapse/secret".path];
settings = {
server_name = "ny4.dev";
public_baseurl = "https://matrix.ny4.dev";
presence.enabled = false; # tradeoff
listeners = [
{
port = 8100;
bind_addresses = ["127.0.0.1"];
type = "http";
tls = false;
x_forwarded = true;
resources = [
{
names = ["client" "federation"];
compress = true;
}
];
}
];
# https://element-hq.github.io/synapse/latest/openid.html#keycloak
oidc_providers = [
{
idp_id = "keycloak";
idp_name = "id.ny4.dev";
issuer = "https://id.ny4.dev/realms/master";
client_id = "synapse";
client_secret_path = config.sops.secrets."synapse/oidc".path;
scopes = ["openid" "profile"];
user_mapping_provider.config = {
localpart_template = "{{ user.preferred_username }}";
display_name_template = "{{ user.name }}";
};
backchannel_logout_enabled = true;
allow_existing_users = true;
}
];
};
};
systemd.services.matrix-synapse.environment = config.networking.proxy.envVars;
services.matrix-sliding-sync = {
enable = true;
environmentFile = config.sops.secrets."syncv3/environment".path;
settings = {
SYNCV3_SERVER = "http://127.0.0.1:8100";
SYNCV3_BINDADDR = "/run/matrix-sliding-sync/sync.sock";
};
};
systemd.services.matrix-sliding-sync.serviceConfig.RuntimeDirectory = ["matrix-sliding-sync"];
services.mastodon = {
enable = true;
localDomain = "ny4.dev";
streamingProcesses = 1;
mediaAutoRemove.olderThanDays = 14;
# FIXME: this doesn't exist
smtp = {
createLocally = false;
fromAddress = "mastodon@ny4.dev";
};
extraConfig = rec {
SINGLE_USER_MODE = "true";
WEB_DOMAIN = "mastodon.ny4.dev";
# keycloak
OMNIAUTH_ONLY = "true";
OIDC_ENABLED = "true";
OIDC_CLIENT_ID = "mastodon";
# OIDC_CLIENT_SECRET # EnvironmentFile
OIDC_DISCOVERY = "true";
OIDC_DISPLAY_NAME = "id.ny4.dev";
OIDC_ISSUER = "https://id.ny4.dev/realms/master";
OIDC_REDIRECT_URI = "https://${WEB_DOMAIN}/auth/auth/openid_connect/callback";
OIDC_SCOPE = "openid,profile,email";
OIDC_SECURITY_ASSUME_EMAIL_IS_VERIFIED = "true";
OIDC_UID_FIELD = "preferred_username";
};
};
systemd.services.mastodon-web = {
environment = config.networking.proxy.envVars;
serviceConfig.EnvironmentFile = [config.sops.secrets."mastodon/environment".path];
};
systemd.services.mastodon-sidekiq-all.environment = config.networking.proxy.envVars;
2024-02-13 04:01:59 +00:00
}