feat: wsl: some things
This commit is contained in:
@@ -17,8 +17,12 @@ in {
|
||||
options.hectic.archetype.base.enable = lib.mkEnableOption "Enable archetupe.dev";
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
programs.zsh.shellAliases = self.lib.sharedShellAliases;
|
||||
programs.zsh.enable = true;
|
||||
hectic = {
|
||||
program.zsh.enable = lib.mkDefault true;
|
||||
program.tmux.enable = lib.mkDefault true;
|
||||
program.nixvim.enable = lib.mkDefault true;
|
||||
};
|
||||
|
||||
users.defaultUserShell = pkgs.zsh;
|
||||
|
||||
# Enable flakes and new 'nix' command
|
||||
|
||||
@@ -11,6 +11,7 @@
|
||||
}: let
|
||||
cfg = config.hectic.archetype.dev;
|
||||
in {
|
||||
# necessary imports:
|
||||
imports = [
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
@@ -19,8 +20,6 @@ in {
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
hectic.archetype.base.enable = true;
|
||||
hectic.program.zsh.enable = true;
|
||||
hectic.program.nixvim.enable = true;
|
||||
|
||||
services.getty.autologinUser = "root";
|
||||
|
||||
|
||||
61
nixos/module/hectic/program/tmux.nix
Normal file
61
nixos/module/hectic/program/tmux.nix
Normal file
@@ -0,0 +1,61 @@
|
||||
{
|
||||
inputs,
|
||||
flake,
|
||||
self,
|
||||
}: {
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
cfg = config.hectic.program.tmux;
|
||||
in {
|
||||
imports = [
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
];
|
||||
|
||||
options.hectic.program.tmux.enable = lib.mkEnableOption "Enable hectic tmux config";
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
programs.tmux.enable = true;
|
||||
|
||||
# alias depends on newSession = true (auto-creates session on attach)
|
||||
programs.zsh.shellAliases.tmux = "tmux a";
|
||||
programs.bash.shellAliases.tmux = "tmux a";
|
||||
|
||||
home-manager.sharedModules = [
|
||||
{
|
||||
programs.tmux = {
|
||||
enable = true;
|
||||
plugins = with pkgs.tmuxPlugins; [ resurrect continuum ];
|
||||
keyMode = "vi";
|
||||
escapeTime = 500;
|
||||
historyLimit = 50000;
|
||||
newSession = true;
|
||||
extraConfig = ''
|
||||
# resurrect
|
||||
set -g @resurrect-strategy-vim 'session'
|
||||
set -g @resurrect-strategy-nvim 'session'
|
||||
set -g @resurrect-capture-pane-contents 'on'
|
||||
|
||||
resurrect_dir="$HOME/.tmux/resurrect"
|
||||
set -g @resurrect-dir $resurrect_dir
|
||||
set -g @resurrect-hook-post-save-all 'target=$(readlink -f $resurrect_dir/last); sed "s| --cmd .*-vim-pack-dir||g; s|/etc/profiles/per-user/$USER/bin/||g; s|/home/$USER/.nix-profile/bin/||g" $target | sponge $target'
|
||||
|
||||
# continuum
|
||||
set -g @continuum-restore 'on'
|
||||
set -g @continuum-boot 'on'
|
||||
set -g @continuum-save-interval '10'
|
||||
|
||||
bind-key -T copy-mode-vi v send-keys -X begin-selection
|
||||
bind-key -T copy-mode-vi C-v send-keys -X rectangle-toggle
|
||||
|
||||
bind-key O select-pane -t :.-
|
||||
'';
|
||||
};
|
||||
}
|
||||
];
|
||||
|
||||
home-manager.users.root.home.stateVersion = lib.mkDefault "25.05";
|
||||
};
|
||||
}
|
||||
108
nixos/module/hectic/service/element-rtc.nix
Normal file
108
nixos/module/hectic/service/element-rtc.nix
Normal file
@@ -0,0 +1,108 @@
|
||||
{
|
||||
inputs,
|
||||
flake,
|
||||
self,
|
||||
}:
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
cfg = config.hectic.services.matrix;
|
||||
in {
|
||||
config = lib.mkIf cfg.enable (let
|
||||
keyFile = "/run/livekit.key";
|
||||
in {
|
||||
services.livekit = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
settings.room.auto_create = false;
|
||||
inherit keyFile;
|
||||
};
|
||||
|
||||
services.lk-jwt-service = {
|
||||
enable = true;
|
||||
livekitUrl = "wss://${cfg.matrixDomain}/livekit/sfu";
|
||||
inherit keyFile;
|
||||
};
|
||||
|
||||
systemd.services.livekit-key = {
|
||||
before = [ "lk-jwt-service.service" "livekit.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
path = with pkgs; [ livekit coreutils gawk ];
|
||||
script = ''
|
||||
echo "Key missing, generating key"
|
||||
echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${keyFile}"
|
||||
'';
|
||||
serviceConfig.Type = "oneshot";
|
||||
unitConfig.ConditionPathExists = "!${keyFile}";
|
||||
};
|
||||
|
||||
systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS =
|
||||
cfg.matrixDomain;
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts.${cfg.matrixDomain} = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:8008";
|
||||
};
|
||||
|
||||
locations."=/.well-known/matrix/client" = {
|
||||
extraConfig = ''
|
||||
default_type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
'';
|
||||
return = ''200 '{
|
||||
"m.homeserver": {
|
||||
"base_url": "https://${cfg.matrixDomain}"
|
||||
},
|
||||
"m.identity_server": {
|
||||
"base_url": "https://vector.im"
|
||||
},
|
||||
"org.matrix.msc3575.proxy": {
|
||||
"url": "https://${cfg.matrixDomain}"
|
||||
},
|
||||
"org.matrix.msc4143.rtc_foci": [
|
||||
{
|
||||
"type": "livekit",
|
||||
"livekit_service_url": "https://${cfg.matrixDomain}/livekit/jwt"
|
||||
}
|
||||
]
|
||||
}' '';
|
||||
};
|
||||
|
||||
locations."^~ /livekit/jwt/" = {
|
||||
priority = 400;
|
||||
proxyPass = "http://[::1]:${toString config.services.lk-jwt-service.port}/";
|
||||
};
|
||||
|
||||
locations."^~ /livekit/sfu/" = {
|
||||
priority = 400;
|
||||
proxyPass = "http://[::1]:${toString config.services.livekit.settings.port}/";
|
||||
proxyWebsockets = true;
|
||||
extraConfig = ''
|
||||
proxy_send_timeout 120;
|
||||
proxy_read_timeout 120;
|
||||
proxy_buffering off;
|
||||
proxy_set_header Accept-Encoding gzip;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [
|
||||
8080
|
||||
7880
|
||||
7881
|
||||
];
|
||||
};
|
||||
});
|
||||
}
|
||||
32
nixos/module/hectic/service/element.nix
Normal file
32
nixos/module/hectic/service/element.nix
Normal file
@@ -0,0 +1,32 @@
|
||||
{
|
||||
inputs,
|
||||
flake,
|
||||
self,
|
||||
}:
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
cfg = config.hectic.services.matrix;
|
||||
in {
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.nginx.virtualHosts."element.${cfg.matrixDomain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
|
||||
root = pkgs.element-web.override {
|
||||
conf = {
|
||||
default_server_config = {
|
||||
"m.homeserver".base_url = "https://${cfg.matrixDomain}";
|
||||
"m.identity_server".base_url = "https://vector.im";
|
||||
};
|
||||
|
||||
default_theme = "dark";
|
||||
show_labs_settings = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
170
nixos/module/hectic/service/matrix.nix
Normal file
170
nixos/module/hectic/service/matrix.nix
Normal file
@@ -0,0 +1,170 @@
|
||||
{
|
||||
inputs,
|
||||
flake,
|
||||
self,
|
||||
}:
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
cfg = config.hectic.services.matrix;
|
||||
in {
|
||||
options = {
|
||||
hectic.services.matrix = {
|
||||
enable = lib.mkEnableOption "Matrix Synapse homeserver with PostgreSQL and nginx";
|
||||
secretsFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = ''
|
||||
path to env file with matrix secrets
|
||||
|
||||
content:
|
||||
registration_shared_secret:
|
||||
macroon_secret_key
|
||||
form_secret
|
||||
'';
|
||||
};
|
||||
postgresql = {
|
||||
port = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 5432;
|
||||
description = ''
|
||||
postgres port
|
||||
'';
|
||||
};
|
||||
initialEnvFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = ''
|
||||
path to env file with postgresql initial secrets
|
||||
|
||||
content:
|
||||
POSTGRESQL_PASSWORD=
|
||||
'';
|
||||
};
|
||||
};
|
||||
matrixDomain = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
domain to matrix
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.matrix-synapse = {
|
||||
enable = true;
|
||||
settings = {
|
||||
server_name = cfg.matrixDomain;
|
||||
public_baseurl = "https://${cfg.matrixDomain}";
|
||||
listeners = [
|
||||
{
|
||||
port = 8008;
|
||||
bind_addresses = [ "0.0.0.0" ];
|
||||
type = "http";
|
||||
tls = false;
|
||||
resources = [
|
||||
{
|
||||
names = [
|
||||
"client"
|
||||
# Ability speak between different matrix servers and get
|
||||
# global id, requires .well-known
|
||||
"federation"
|
||||
];
|
||||
compress = false;
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
|
||||
enable_registration = true;
|
||||
enable_registration_without_verification = true;
|
||||
|
||||
extraConfigFiles = [
|
||||
cfg.secretsFile
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.matrix-synapse
|
||||
];
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_17;
|
||||
|
||||
initdbArgs = [
|
||||
"--locale=C"
|
||||
"--encoding=UTF8"
|
||||
];
|
||||
|
||||
enableTCPIP = true;
|
||||
port = cfg.postgresql.port;
|
||||
authentication = builtins.concatStringsSep "\n" [
|
||||
"local all all trust"
|
||||
"host sameuser all 127.0.0.1/32 scram-sha-256"
|
||||
"host sameuser all ::1/128 scram-sha-256"
|
||||
"host all all ::1/128 scram-sha-256"
|
||||
"host all all 0.0.0.0/0 scram-sha-256"
|
||||
|
||||
"host replication postgres 127.0.0.1/32 scram-sha-256"
|
||||
"host replication postgres ::1/128 scram-sha-256"
|
||||
];
|
||||
|
||||
settings = {
|
||||
wal_level = "replica";
|
||||
max_wal_senders = 10;
|
||||
};
|
||||
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "matrix-synapse";
|
||||
ensureClauses.login = true;
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
|
||||
ensureDatabases = [
|
||||
"matrix-synapse"
|
||||
];
|
||||
|
||||
initialScript = pkgs.writeText "init-sql-script" ''
|
||||
-- setup password from env/sops
|
||||
DO $$#!${pkgs.dash}/bin/dash
|
||||
set -e
|
||||
. ${cfg.postgresql.initialEnvFile}
|
||||
psql -Atc "ALTER USER postgres WITH PASSWORD '$POSTGRESQL_PASSWORD'";
|
||||
$$ LANGUAGE plsh;
|
||||
|
||||
CREATE ROLE myuser LOGIN PASSWORD 'matrix-synapse';
|
||||
'';
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts.${cfg.matrixDomain} = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:8008";
|
||||
};
|
||||
locations."=/.well-known/matrix/server" = {
|
||||
extraConfig = ''
|
||||
default_type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
'';
|
||||
return = "200 '{\"m.server\": \"${cfg.matrixDomain}:443\"}'";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults = {
|
||||
email = "hectic.yukkop.it@gmail.com";
|
||||
enableDebugLogs = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
67
nixos/module/hectic/service/voice-tune.nix
Normal file
67
nixos/module/hectic/service/voice-tune.nix
Normal file
@@ -0,0 +1,67 @@
|
||||
{
|
||||
inputs,
|
||||
flake,
|
||||
self,
|
||||
}:
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
cfg = config.hectic.services.matrix;
|
||||
in {
|
||||
options = {
|
||||
hectic.services.matrix = {
|
||||
turnSecretFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = ''
|
||||
path to env file with matrix secrets
|
||||
|
||||
just raw secret
|
||||
'';
|
||||
};
|
||||
publicIp = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
public IP address of the server, used by coturn for
|
||||
listening and relay
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.coturn = rec {
|
||||
enable = true;
|
||||
realm = cfg.matrixDomain;
|
||||
use-auth-secret = true;
|
||||
static-auth-secret-file = cfg.turnSecretFile;
|
||||
cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
|
||||
pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
|
||||
listening-ips = [cfg.publicIp];
|
||||
no-tcp-relay = true;
|
||||
relay-ips = [cfg.publicIp];
|
||||
listening-port = 3478;
|
||||
tls-listening-port = 5349;
|
||||
no-cli = true;
|
||||
|
||||
extraConfig = ''
|
||||
verbose
|
||||
'';
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
allowedUDPPorts = [ 3478 5349 ];
|
||||
allowedTCPPorts = [ 3478 5349 ];
|
||||
allowedUDPPortRanges = [
|
||||
{ from = 49152; to = 65535; }
|
||||
];
|
||||
};
|
||||
|
||||
services.matrix-synapse.settings = {
|
||||
turn_uris = [
|
||||
"turn:${cfg.matrixDomain}:3478?transport=udp"
|
||||
"turn:${cfg.matrixDomain}:3478?transport=tcp"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user