jet/extremist-software
jet/extremist-software
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: format and fix noisebell config

Browse source
This commit is contained in:
Jet 2026-03-23 00:04:46 -07:00
parent 3e78c835cc
commit d0b29c1244
No known key found for this signature in database
10 changed files with 211 additions and 101 deletions
Download patch file Download diff file Expand all files Collapse all files

43
agenix.nix
View file

@ -1,13 +1,38 @@
let let
server = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAING219cDKTDLaZefmqvOHfXvYloA/ErsCGE0pM022vlB"; server = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAING219cDKTDLaZefmqvOHfXvYloA/ErsCGE0pM022vlB";
jet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE40ISu3ydCqfdpb26JYD5cIN0Fu0id/FDS+xjB5zpqu"; jet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE40ISu3ydCqfdpb26JYD5cIN0Fu0id/FDS+xjB5zpqu";
in { in
"secrets/forgejo-db.age".publicKeys = [ server jet ]; {
"secrets/stalwart-admin.age".publicKeys = [ server jet ]; "secrets/forgejo-db.age".publicKeys = [
"secrets/searx-env.age".publicKeys = [ server jet ]; server
"secrets/tailscale-key.age".publicKeys = [ server jet ]; jet
"secrets/grafana-secret.age".publicKeys = [ server jet ]; ];
"secrets/matrix-macaroon.age".publicKeys = [ server jet ]; "secrets/stalwart-admin.age".publicKeys = [
"secrets/ntfy-admin-hash.age".publicKeys = [ server jet ]; server
"secrets/mymx-webhook.age".publicKeys = [ server jet ]; jet
];
"secrets/searx-env.age".publicKeys = [
server
jet
];
"secrets/tailscale-key.age".publicKeys = [
server
jet
];
"secrets/grafana-secret.age".publicKeys = [
server
jet
];
"secrets/matrix-macaroon.age".publicKeys = [
server
jet
];
"secrets/ntfy-admin-hash.age".publicKeys = [
server
jet
];
"secrets/mymx-webhook.age".publicKeys = [
server
jet
];
} }

49
configuration.nix
View file

@ -1,4 +1,9 @@
{ config, pkgs, modulesPath, ... }: {
config,
pkgs,
modulesPath,
...
}:
{ {
imports = [ imports = [
@ -19,13 +24,25 @@
# Agenix secrets # Agenix secrets
age.secrets = { age.secrets = {
forgejo-db.file = ./secrets/forgejo-db.age; forgejo-db.file = ./secrets/forgejo-db.age;
stalwart-admin = { file = ./secrets/stalwart-admin.age; owner = "stalwart-mail"; }; stalwart-admin = {
file = ./secrets/stalwart-admin.age;
owner = "stalwart-mail";
};
searx-env.file = ./secrets/searx-env.age; searx-env.file = ./secrets/searx-env.age;
tailscale-key.file = ./secrets/tailscale-key.age; tailscale-key.file = ./secrets/tailscale-key.age;
grafana-secret = { file = ./secrets/grafana-secret.age; owner = "grafana"; }; grafana-secret = {
matrix-macaroon = { file = ./secrets/matrix-macaroon.age; owner = "matrix-synapse"; }; file = ./secrets/grafana-secret.age;
owner = "grafana";
};
matrix-macaroon = {
file = ./secrets/matrix-macaroon.age;
owner = "matrix-synapse";
};
ntfy-admin-hash.file = ./secrets/ntfy-admin-hash.age; ntfy-admin-hash.file = ./secrets/ntfy-admin-hash.age;
mymx-webhook = { file = ./secrets/mymx-webhook.age; owner = "mymx"; }; mymx-webhook = {
file = ./secrets/mymx-webhook.age;
owner = "mymx";
};
}; };
# Bootloader # Bootloader
@ -35,8 +52,11 @@
# Networking # Networking
networking.hostName = "extremist-software"; networking.hostName = "extremist-software";
networking.firewall.allowedTCPPorts = [ 22 80 443 ]; # SSH, HTTP, HTTPS networking.firewall.allowedTCPPorts = [
22
80
443
]; # SSH, HTTP, HTTPS
# Tailscale # Tailscale
services.tailscale.enable = true; services.tailscale.enable = true;
# We assume the user will authenticate manually or via a one-time key service # We assume the user will authenticate manually or via a one-time key service
@ -52,10 +72,12 @@
enable = true; enable = true;
settings.PasswordAuthentication = false; settings.PasswordAuthentication = false;
settings.PermitRootLogin = "prohibit-password"; settings.PermitRootLogin = "prohibit-password";
hostKeys = [{ hostKeys = [
{
path = "/etc/ssh/ssh_host_ed25519_key"; path = "/etc/ssh/ssh_host_ed25519_key";
type = "ed25519"; type = "ed25519";
}]; }
];
}; };
# Fail2ban # Fail2ban
@ -94,7 +116,10 @@
# System # System
system.stateVersion = "24.05"; system.stateVersion = "24.05";
nix.settings.experimental-features = [ "nix-command" "flakes" ]; nix.settings.experimental-features = [
"nix-command"
"flakes"
];
nix.settings.max-jobs = "auto"; nix.settings.max-jobs = "auto";
nix.settings.cores = 0; nix.settings.cores = 0;
services.postgresql.package = pkgs.postgresql_15; services.postgresql.package = pkgs.postgresql_15;
@ -110,8 +135,8 @@
services.tailscale.authKeyFile = config.age.secrets.tailscale-key.path; services.tailscale.authKeyFile = config.age.secrets.tailscale-key.path;
# MyMX # MyMX
services.jetpham-website.enable = true; services.jetpham-website.enable = false;
services.jetpham-website.tor.enable = true; services.jetpham-website.tor.enable = false;
services.mymx = { services.mymx = {
enable = true; enable = true;

15
flake.nix
View file

@ -23,7 +23,14 @@
agenix.inputs.nixpkgs.follows = "nixpkgs"; agenix.inputs.nixpkgs.follows = "nixpkgs";
}; };
outputs = { self, nixpkgs, disko, ... }@inputs: { outputs =
{
self,
nixpkgs,
disko,
...
}@inputs:
{
nixosConfigurations.extremist-software = nixpkgs.lib.nixosSystem { nixosConfigurations.extremist-software = nixpkgs.lib.nixosSystem {
system = "x86_64-linux"; system = "x86_64-linux";
specialArgs = { inherit inputs; }; specialArgs = { inherit inputs; };
@ -40,7 +47,8 @@
]; ];
}; };
devShells.x86_64-linux.default = let devShells.x86_64-linux.default =
let
pkgs = nixpkgs.legacyPackages.x86_64-linux; pkgs = nixpkgs.legacyPackages.x86_64-linux;
deploy = pkgs.writeShellScriptBin "nhs" '' deploy = pkgs.writeShellScriptBin "nhs" ''
nh os switch --hostname extremist-software --target-host root@extremist-software path:. "$@" nh os switch --hostname extremist-software --target-host root@extremist-software path:. "$@"
@ -60,7 +68,8 @@
fi fi
exit $failed exit $failed
''; '';
in pkgs.mkShell { in
pkgs.mkShell {
packages = [ packages = [
pkgs.nh pkgs.nh
inputs.agenix.packages.x86_64-linux.default inputs.agenix.packages.x86_64-linux.default

1
modules/caddy.nix
View file

@ -129,7 +129,6 @@
''; '';
}; };
"matrix.extremist.software" = { "matrix.extremist.software" = {
extraConfig = '' extraConfig = ''
rate_limit { rate_limit {

12
modules/matrix.nix
View file

@ -17,7 +17,10 @@
x_forwarded = true; x_forwarded = true;
resources = [ resources = [
{ {
names = [ "client" "federation" ]; names = [
"client"
"federation"
];
compress = false; compress = false;
} }
]; ];
@ -42,10 +45,11 @@
services.postgresql = { services.postgresql = {
enable = true; enable = true;
ensureDatabases = [ "matrix-synapse" ]; ensureDatabases = [ "matrix-synapse" ];
ensureUsers = [{ ensureUsers = [
{
name = "matrix-synapse"; name = "matrix-synapse";
ensureDBOwnership = true; ensureDBOwnership = true;
}]; }
];
}; };
} }

6
modules/monitoring.nix
View file

@ -15,9 +15,11 @@
scrapeConfigs = [ scrapeConfigs = [
{ {
job_name = "node"; job_name = "node";
static_configs = [{ static_configs = [
{
targets = [ "127.0.0.1:9100" ]; targets = [ "127.0.0.1:9100" ];
}]; }
];
} }
]; ];
}; };

8
modules/noisebell.nix
View file

@ -1,4 +1,4 @@
{ ... }: { config, ... }:
{ {
services.noisebell-cache = { services.noisebell-cache = {
@ -6,6 +6,12 @@
port = 3005; port = 3005;
domain = "noisebell.extremist.software"; domain = "noisebell.extremist.software";
piAddress = "http://noisebell-pi"; piAddress = "http://noisebell-pi";
outboundWebhooks = [
{
url = "http://127.0.0.1:3004/webhook";
secretFile = config.age.secrets.noisebell-discord-webhook-secret.path;
}
];
}; };
services.noisebell-discord = { services.noisebell-discord = {

13
modules/ntfy.nix
View file

@ -1,4 +1,9 @@
{ config, pkgs, lib, ... }: {
config,
pkgs,
lib,
...
}:
{ {
services.ntfy-sh = { services.ntfy-sh = {
@ -19,13 +24,15 @@
# Patch the generated config at runtime to inject the admin bcrypt hash # Patch the generated config at runtime to inject the admin bcrypt hash
systemd.services.ntfy-sh = { systemd.services.ntfy-sh = {
serviceConfig.RuntimeDirectory = "ntfy-sh"; serviceConfig.RuntimeDirectory = "ntfy-sh";
serviceConfig.ExecStartPre = let serviceConfig.ExecStartPre =
let
script = pkgs.writeShellScript "ntfy-patch-config" '' script = pkgs.writeShellScript "ntfy-patch-config" ''
cp /etc/ntfy/server.yml /run/ntfy-sh/server.yml cp /etc/ntfy/server.yml /run/ntfy-sh/server.yml
HASH=$(cat ${config.age.secrets.ntfy-admin-hash.path}) HASH=$(cat ${config.age.secrets.ntfy-admin-hash.path})
printf '\nauth-users:\n - "jet:%s:admin"\n' "$HASH" >> /run/ntfy-sh/server.yml printf '\nauth-users:\n - "jet:%s:admin"\n' "$HASH" >> /run/ntfy-sh/server.yml
''; '';
in [ "+${script}" ]; in
[ "+${script}" ];
serviceConfig.ExecStart = lib.mkForce "${pkgs.ntfy-sh}/bin/ntfy serve --config /run/ntfy-sh/server.yml"; serviceConfig.ExecStart = lib.mkForce "${pkgs.ntfy-sh}/bin/ntfy serve --config /run/ntfy-sh/server.yml";
}; };
} }

47
modules/searx.nix
View file

@ -16,15 +16,48 @@
request_timeout = 1.5; request_timeout = 1.5;
}; };
ui = { ui = {
categories_as_tabs = [ "general" "images" ]; categories_as_tabs = [
"general"
"images"
];
}; };
engines = [ engines = [
{ name = "google"; engine = "google"; categories = "general"; disabled = false; } {
{ name = "wikipedia"; engine = "wikipedia"; categories = "general"; disabled = false; } name = "google";
{ name = "google images"; engine = "google_images"; categories = "images"; disabled = false; } engine = "google";
{ name = "duckduckgo images"; engine = "duckduckgo_images"; categories = "images"; disabled = false; } categories = "general";
{ name = "bing images"; engine = "bing_images"; categories = "images"; disabled = false; } disabled = false;
{ name = "qwant images"; engine = "qwant_images"; categories = "images"; disabled = false; } }
{
name = "wikipedia";
engine = "wikipedia";
categories = "general";
disabled = false;
}
{
name = "google images";
engine = "google_images";
categories = "images";
disabled = false;
}
{
name = "duckduckgo images";
engine = "duckduckgo_images";
categories = "images";
disabled = false;
}
{
name = "bing images";
engine = "bing_images";
categories = "images";
disabled = false;
}
{
name = "qwant images";
engine = "qwant_images";
categories = "images";
disabled = false;
}
]; ];
}; };
}; };