111 lines
2.4 KiB
Nix
111 lines
2.4 KiB
Nix
{
|
|
inputs,
|
|
flake,
|
|
self,
|
|
}: {
|
|
lib,
|
|
pkgs,
|
|
modulesPath,
|
|
config,
|
|
...
|
|
}: let
|
|
xrayPort = 10086;
|
|
matrixDomain = "accord.tube";
|
|
in {
|
|
# TODO:
|
|
# white list
|
|
# torent
|
|
# rate limit
|
|
# ping - game and speak
|
|
|
|
imports = [
|
|
self.nixosModules.hectic
|
|
inputs.sops-nix.nixosModules.sops
|
|
./voice-tune.nix
|
|
./matrix.nix
|
|
./element-rtc.nix
|
|
./element.nix
|
|
];
|
|
|
|
currentServer = {
|
|
matrix = {
|
|
secretsFile = config.sops.secrets."matrix/secrets".path;
|
|
turnSecretFile = config.sops.secrets."matrix/turn-secret".path;
|
|
postgresql = {
|
|
port = 5432;
|
|
initialEnvFile = config.sops.secrets."init-postgresql".path;
|
|
};
|
|
matrixDomain = "accord.tube";
|
|
};
|
|
};
|
|
|
|
services.xray = {
|
|
enable = true;
|
|
settingsFile = config.sops.secrets."config".path;
|
|
};
|
|
|
|
users.users.root.openssh.authorizedKeys.keys = [
|
|
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOn1KflaIX1RU9YS/qLb0GInmndYxx2vTLZC9OA+eXZl''
|
|
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBKPbIJATVyAw7F7vBZbHkCODXFo5gvDyqhuU0gnNUNH''
|
|
];
|
|
|
|
boot.loader.grub.device = "/dev/vda";
|
|
boot.initrd.availableKernelModules = [
|
|
"ata_piix"
|
|
"uhci_hcd"
|
|
"xen_blkfront"
|
|
] ++ (if pkgs.system != "aarch64-linux" then [ "vmw_pvscsi" ] else []);
|
|
boot.initrd.kernelModules = ["nvme"];
|
|
|
|
disko.devices = {
|
|
disk.vda = {
|
|
device = lib.mkDefault "/dev/vda";
|
|
content = {
|
|
type = "table";
|
|
format = "msdos";
|
|
partitions = [
|
|
{
|
|
name = "root";
|
|
part-type = "primary";
|
|
fs-type = "ext4";
|
|
bootable = true;
|
|
content = {
|
|
type = "filesystem";
|
|
format = "ext4";
|
|
mountpoint = "/";
|
|
};
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
|
|
hectic = {
|
|
archetype.base.enable = true;
|
|
archetype.dev.enable = true;
|
|
};
|
|
|
|
sops = {
|
|
gnupg.sshKeyPaths = [ ];
|
|
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
defaultSopsFile = ../../../sus/bfs.xray.yaml;
|
|
|
|
secrets."config" = {};
|
|
secrets."init-postgresql" = {};
|
|
secrets."matrix/secrets" = {};
|
|
secrets."matrix/turn-secret" = {
|
|
owner = "turnserver";
|
|
group = "turnserver";
|
|
mode = "0400";
|
|
};
|
|
};
|
|
|
|
networking.firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [
|
|
xrayPort
|
|
80 443 # for acme
|
|
];
|
|
};
|
|
}
|