diff options
| -rw-r--r-- | adonis/autopush/default.nix | 125 | ||||
| -rw-r--r-- | adonis/default.nix | 2 | ||||
| -rw-r--r-- | adonis/push/default.nix | 55 | ||||
| -rw-r--r-- | secrets.yaml | 10 |
4 files changed, 60 insertions, 132 deletions
diff --git a/adonis/autopush/default.nix b/adonis/autopush/default.nix deleted file mode 100644 index 292abaf..0000000 --- a/adonis/autopush/default.nix +++ /dev/null @@ -1,125 +0,0 @@ -{ - config, - pkgs, - ... -}: let - domain = "push.${config.customOps.domain.fqdn}"; - port = 8082; - redisPort = 6369; - endpointPort = 443; - autopush = pkgs.autopush-rs; -in { - sops.secrets = { - "autopush/autoconnect" = {}; - "autopush/autoendpoint" = {}; - "autopush/mollysocket" = {}; - }; - - environment.systemPackages = [autopush]; - services.redis.servers."autopush" = { - enable = true; - port = redisPort; - }; - systemd.services = let - logLevel = "info"; - rustLog = - "autopush=${logLevel}," - + "autopush_common=${logLevel}," - + "autoendpoint=${logLevel}," - + "autoconnect=${logLevel}," - + "slog_mozlog_json=info,warn"; - in { - autopush-autoconnect = { - environment = { - AUTOCONNECT__DB_DSN = "redis://127.0.0.1:${builtins.toString redisPort}"; - AUTOCONNECT__ENDPOINT_SCHEME = "https"; - AUTOCONNECT__ENDPOINT_HOSTNAME = "updates.${domain}"; - AUTOCONNECT__ENDPOINT_PORT = builtins.toString endpointPort; - AUTOCONNECT__ROUTER_HOSTNAME = "127.0.0.1"; - RUST_LOG = rustLog; - }; - wantedBy = ["multi-user.target"]; - serviceConfig = { - EnvironmentFile = config.sops.secrets."autopush/autoconnect".path; - ExecStart = "${autopush}/bin/autoconnect"; - }; - }; - autopush-autoendpoint = { - environment = { - AUTOEND__DB_DSN = "redis://127.0.0.1:${builtins.toString redisPort}"; - AUTOEND__HOST = "127.0.0.1"; - AUTOEND__PORT = builtins.toString port; - AUTOEND__ENDPOINT_URL = "https://updates.${domain}"; - AUTOEND__HUMAN_LOGS = "true"; - RUST_LOG = rustLog; - }; - wantedBy = ["multi-user.target"]; - serviceConfig = { - EnvironmentFile = config.sops.secrets."autopush/autoendpoint".path; - ExecStart = "${autopush}/bin/autoendpoint"; - }; - }; - }; - - services.mollysocket = { - enable = true; - settings = { - allowed_endpoints = [ - "https://${domain}" - "https://updates.${domain}" - ]; - webserver = true; - }; - environmentFile = config.sops.secrets."autopush/mollysocket".path; - }; - - services.nginx.virtualHosts.${domain} = { - forceSSL = true; - enableACME = true; - locations."/" = { - proxyPass = "http://127.0.0.1:8080"; - extraConfig = '' - proxy_http_version 1.1; - proxy_set_header Host $host; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_connect_timeout 3m; - proxy_send_timeout 3m; - proxy_read_timeout 3m; - client_max_body_size 0; - proxy_buffering off; - proxy_request_buffering off; - proxy_redirect off; - ''; - }; - }; - services.nginx.virtualHosts."updates.${domain}" = { - forceSSL = true; - enableACME = true; - locations."/" = { - proxyPass = "http://127.0.0.1:${builtins.toString port}"; - extraConfig = '' - proxy_http_version 1.1; - proxy_set_header Host $host; - proxy_connect_timeout 3m; - proxy_send_timeout 3m; - proxy_read_timeout 3m; - client_max_body_size 0; - ''; - }; - }; - services.nginx.virtualHosts."mollysocket.${domain}" = { - forceSSL = true; - enableACME = true; - locations."/" = { - proxyPass = "http://127.0.0.1:8020"; - extraConfig = '' - proxy_set_header Host $host; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - ''; - }; - }; -} diff --git a/adonis/default.nix b/adonis/default.nix index c97d3ee..74ba9b5 100644 --- a/adonis/default.nix +++ b/adonis/default.nix @@ -3,7 +3,7 @@ ./network.nix ./aur ./captiveportal - ./autopush + ./push ./tor ]; system.stateVersion = "25.11"; diff --git a/adonis/push/default.nix b/adonis/push/default.nix new file mode 100644 index 0000000..1dc8f1a --- /dev/null +++ b/adonis/push/default.nix @@ -0,0 +1,55 @@ +{config, ...}: let + domain = "push.${config.customOps.domain.fqdn}"; + ntfyPort = "8080"; + mollyPort = "8020"; + nginxConf = '' + proxy_set_header Host $host; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + ''; +in { + sops.secrets = { + "push/mollysocket" = {}; + }; + + services.ntfy-sh = { + enable = true; + settings = { + listen-http = ":${ntfyPort}"; + base-url = "https://${domain}"; + behind-proxy = true; + auth-file = "/var/lib/ntfy/auth.db"; + auth-access = ["*:up*:write-only"]; + }; + }; + + services.mollysocket = { + enable = true; + settings = { + allowed_endpoints = [ + "https://${domain}" + ]; + webserver = true; + }; + environmentFile = config.sops.secrets."push/mollysocket".path; + }; + + services.nginx.virtualHosts.${domain} = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://127.0.0.1:${ntfyPort}"; + extraConfig = nginxConf; + }; + }; + + services.nginx.virtualHosts."mollysocket.${domain}" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://127.0.0.1:${mollyPort}"; + extraConfig = nginxConf; + }; + }; +} diff --git a/secrets.yaml b/secrets.yaml index e23fb91..c2aa0ce 100644 --- a/secrets.yaml +++ b/secrets.yaml @@ -8,10 +8,8 @@ msci: sshkey: ENC[AES256_GCM,data:b4xHoTnmkCYghRylcV2U63Sh/l7sM2YQ76GgHFxHp2HKxo3slRQkgEe6GSgEXD0vYHGoXDCBo7x4Vhvf58nvKOOveHtg+l4w+ypFQ+5DRIl4gLnHBEyIMFm3IXlwKnSV+qAxODKFWkbv9yIatWpJa2K8uXJ5+VbQ2tdDoWi4C51cuhDA7mRydxT4xcKdOFN6ajufFIeYeu867Pr8qUy53j8rYCsBaCIphtv/UW7r1noWKz7P8tt6pU+hpht7BrKu6sUq6lDG7GHnlQjp7Ypj7OQhm1isHHp/5uSabcJ+nkW6MOw39QUDgUEdtka1KN1FTdLaYnzr4OYXKmbvBATEgamgVwYVEbPWgc/0aIDgzn9hQhRII3x/VsoWKB4+TnMaUgvbRJ1ZU9FztMqeX4+gzvXta7ANwzESUvS8ce/kwMKbEAPvbc11YcAYdnxZEoPZ1qVQ3W72WZM6jBd45aDH8wOUxhVAJnw7pPx0xLqb68lFnT+tS2yavHRTUFovdCO3fBu6hl5P2pRe5S2kmkVG,iv:MvmVhJPFMegABugWuXUS3iNU5R26ZaaQARdXeye5Bzs=,tag:59ZGDZSQ+3RovxsgngQy7A==,type:str] gpgkey: ENC[AES256_GCM,data:9H3NfqjWiH7N1W6/4jQcfH8ML69V3Pt+8M1KyLvo2ITvX892x/ymvHS6df8JQ2NGzoPia/oZ9cFiDhku8mCX8rcH5o2Dn7CefEMeXpr5MpiZQj83Kz02a5VowbJcEx71ByIdosQl6y1qWFSomjv4xpdlJ1qI7eY168crjkBn/O/P12zDBC+rw6qiGWRsIKufHn+kLcVaw/Z5n0Gt0H2OvtKioyAcZGn1LIWWyzRCIe3UHUtI/6X4AKGuKDGr6kJQfe0xfSRIc1lancjpcvlHIIpJ5QCdbr2jj4Mx26tfgEHidCNAZQH0tckQUvnQGlrGo2eQwAG7CF1W0c1LAXq9N26yhvZRkrAfbGb1nOLJ8njYJR1UEre40TnPcP7sPn8j1z1XvBmPSF5fsTXL9+qvbvT2PBBrXrP6408oHHVLFUm9g50hoYVvf4ZxVXG65pxpN+wyB03vQTvPT/O27Y1ZWfanODWfdUfcSgkYMLS/AysnUmT3Mzbzn1WHBfvwLF1nNY1vC0tRdgfpvXs9XxT/YVPK5WvM1MDSfPvLDyR0BpwfM045bt24ieWU+zSNL9rb16A+F6sjj9JVvEEaRoxV+vP5kGmCx7+jr780RI6GGHXlPn1l1LNnRL3htycSxB6/XBi1sAcM01Ft4b6mOYnCHpFXRLpT82YlL0VqM2ysGDSiC3ROxktowcY5gc1ncvRldn1SpeTKlDTiNwWYDx2YcZrIZICNaSumZRavPiE3hIQiPlGixbj3LvknzV8HwaFXXFO7/50s5E7KFcMbpKEA2sRQVGggyy1gt8YKaW+twk+TKMRoVTqHHSmiPja1HIHbL/qfWx3zABoADeLL5d197yZmm8tzmZd3kbxSg4INtiBYcVqumoTKjcsDM0FkubisLVmUgiDJA1LztH2t/Q8XWipi+JFSmau27n+1g7o3Ev9JLAaVhVz/CXqJkyKXPTolHOO6BNQ2aKHc4yV6IkeXHFUHaq7SX/qApPchW+YPikkdbaSguBQ5j0hpoguj+0VZc02IxMVNUlhHcT0ivNHbtg==,iv:WIiNQzwBB5NShl3kmES0klcsvx5hDk1y/o1TMCscb8E=,tag:U41TaRxxrWgnK3FJfMEXsw==,type:str] gpgpwd: ENC[AES256_GCM,data:Mawtj2lOmKRk1jUtSWUb+oFoHTC/dXPkEi3iYiqaNoAms7GSKOPMikdzg0WUBtvTmQ==,iv:qZg4PBCv8Q6YtRygTsnLu/D9VzK4nVRgPET7qbII4xc=,tag:Ux6syzVGySLIwPcfJtDriA==,type:str] -autopush: - autoconnect: ENC[AES256_GCM,data:buWI+UAKsKL/H4FVJO277+URii4FalbXKBiNLhSZi51wJ9rbTRTCKUYXsRZ47k/2hSa5LEfHUDCUfBeBnUn50SD5JrGvyVB1,iv:GnVy3VNhpogvM2tfwqn7zT7MPNk3vojnr/q40coS/J4=,tag:lyagPBXHR686nSIDwbUHFQ==,type:str] - autoendpoint: ENC[AES256_GCM,data:SuYJ3ivJNydAAbFKRaVl79dZO4TS1UbmyHENZWCp34DS0p3YSoPoru5q71x/9VcjmEw1i5J3XGgfxZyX3OX+zWOArPZf,iv:IXTk+PsIc8p4rYYndkVe0M8g/YjZo8GbOQpnp+3yRQ4=,tag:zgMCVlMl91FgLSZl43eQkw==,type:str] - mollysocket: ENC[AES256_GCM,data:AlHJqlU4qU8HdeW0EIlp0O7pYddOXcdNioc/caucel3fEQEa6Tr8JnC3IKbCsNidQruAuMiYAf9LmsspWGdy3N0=,iv:kAHB1xxJB+oxQ3+pRlhRaTpQHBqMT1+2PG4TUeQvFwE=,tag:qxHOrOMysYYMpxfpt3gxBg==,type:str] +push: + mollysocket: ENC[AES256_GCM,data:eIJXb/8RvIxIYIjxp34EadStZfg+YaJOGLX+X5uItp1mRIbYQ6cqzSVfQj5H8d/YaThf2FKVMrbE0mBqX0kBYTc=,iv:d2JfZfeyJa7HlU0FPqlqOQ4mS8DTQX7bgzDWA0F3MF0=,tag:yssqkKQ1FmvWR6PfqabVgg==,type:str] sops: age: - enc: | @@ -41,7 +39,7 @@ sops: AjeKUiRMROq4PMJYmWXDjToBlvdOFq9oYNl+1mNlcQTMbEkCoqIfrw== -----END AGE ENCRYPTED FILE----- recipient: age1ra6vn99y233pxrlpcwpuwl7vc8ma5y4ucg5jlkfylh6kudsxzehqznqmet - lastmodified: "2026-08-06T11:31:39Z" - mac: ENC[AES256_GCM,data:ybRpKVJ3BeGGfsjP5OhWLu+f74aZl2zOq70D1M8dH1iwfV9Tntvr9uaOQROONBptlWzjQKrecr/vIyFdb37gli+NfVgbA4EtUKCsuSN5LijF+SZ8zJm+QLGGus8Ng9EaL3xCZam5vzOyBGBPLs8DItZ2N4ihjE6MYJhaQ84hO7U=,iv:V5KPY+3AnYTjmXlmqMwIobwku/sjeM5zG+hIU4krqZU=,tag:DK3DTn4MQygxNo+kyaAZVQ==,type:str] + lastmodified: "2026-09-15T13:47:46Z" + mac: ENC[AES256_GCM,data:MTlkZ6A0FjU1Q/VcVzmiJpPKG2ZbqJUT2I0HNSM6uE+UT5acMM4u9TiUBFT7Ngtgg6oddb8VdDuw+o+8JnMv+Z3Uchsi08Y8avucXh5XYkFx60LdSWNdfD3Xg9WqxzqQp1GO8ZgggXq0drm/S7EWqbjTiY344qfI60hoOeOkkjo=,iv:76z2RvOvNA2cCm+ml3dWmyR5jL15viaqWGZFIPAuy+Y=,tag:47O7VaaB4bV+HeOM+z9bvg==,type:str] unencrypted_suffix: _unencrypted version: 3.13.3 |