From 76d8f5dac37772a88473cd39a77b72ef56489435 Mon Sep 17 00:00:00 2001 From: toufic ar Date: Tue, 15 Sep 2026 16:57:23 +0300 Subject: move to ntfy-sh --- adonis/autopush/default.nix | 125 -------------------------------------------- adonis/default.nix | 2 +- adonis/push/default.nix | 55 +++++++++++++++++++ 3 files changed, 56 insertions(+), 126 deletions(-) delete mode 100644 adonis/autopush/default.nix create mode 100644 adonis/push/default.nix (limited to 'adonis') diff --git a/adonis/autopush/default.nix b/adonis/autopush/default.nix deleted file mode 100644 index 292abaf..0000000 --- a/adonis/autopush/default.nix +++ /dev/null @@ -1,125 +0,0 @@ -{ - config, - pkgs, - ... -}: let - domain = "push.${config.customOps.domain.fqdn}"; - port = 8082; - redisPort = 6369; - endpointPort = 443; - autopush = pkgs.autopush-rs; -in { - sops.secrets = { - "autopush/autoconnect" = {}; - "autopush/autoendpoint" = {}; - "autopush/mollysocket" = {}; - }; - - environment.systemPackages = [autopush]; - services.redis.servers."autopush" = { - enable = true; - port = redisPort; - }; - systemd.services = let - logLevel = "info"; - rustLog = - "autopush=${logLevel}," - + "autopush_common=${logLevel}," - + "autoendpoint=${logLevel}," - + "autoconnect=${logLevel}," - + "slog_mozlog_json=info,warn"; - in { - autopush-autoconnect = { - environment = { - AUTOCONNECT__DB_DSN = "redis://127.0.0.1:${builtins.toString redisPort}"; - AUTOCONNECT__ENDPOINT_SCHEME = "https"; - AUTOCONNECT__ENDPOINT_HOSTNAME = "updates.${domain}"; - AUTOCONNECT__ENDPOINT_PORT = builtins.toString endpointPort; - AUTOCONNECT__ROUTER_HOSTNAME = "127.0.0.1"; - RUST_LOG = rustLog; - }; - wantedBy = ["multi-user.target"]; - serviceConfig = { - EnvironmentFile = config.sops.secrets."autopush/autoconnect".path; - ExecStart = "${autopush}/bin/autoconnect"; - }; - }; - autopush-autoendpoint = { - environment = { - AUTOEND__DB_DSN = "redis://127.0.0.1:${builtins.toString redisPort}"; - AUTOEND__HOST = "127.0.0.1"; - AUTOEND__PORT = builtins.toString port; - AUTOEND__ENDPOINT_URL = "https://updates.${domain}"; - AUTOEND__HUMAN_LOGS = "true"; - RUST_LOG = rustLog; - }; - wantedBy = ["multi-user.target"]; - serviceConfig = { - EnvironmentFile = config.sops.secrets."autopush/autoendpoint".path; - ExecStart = "${autopush}/bin/autoendpoint"; - }; - }; - }; - - services.mollysocket = { - enable = true; - settings = { - allowed_endpoints = [ - "https://${domain}" - "https://updates.${domain}" - ]; - webserver = true; - }; - environmentFile = config.sops.secrets."autopush/mollysocket".path; - }; - - services.nginx.virtualHosts.${domain} = { - forceSSL = true; - enableACME = true; - locations."/" = { - proxyPass = "http://127.0.0.1:8080"; - extraConfig = '' - proxy_http_version 1.1; - proxy_set_header Host $host; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_connect_timeout 3m; - proxy_send_timeout 3m; - proxy_read_timeout 3m; - client_max_body_size 0; - proxy_buffering off; - proxy_request_buffering off; - proxy_redirect off; - ''; - }; - }; - services.nginx.virtualHosts."updates.${domain}" = { - forceSSL = true; - enableACME = true; - locations."/" = { - proxyPass = "http://127.0.0.1:${builtins.toString port}"; - extraConfig = '' - proxy_http_version 1.1; - proxy_set_header Host $host; - proxy_connect_timeout 3m; - proxy_send_timeout 3m; - proxy_read_timeout 3m; - client_max_body_size 0; - ''; - }; - }; - services.nginx.virtualHosts."mollysocket.${domain}" = { - forceSSL = true; - enableACME = true; - locations."/" = { - proxyPass = "http://127.0.0.1:8020"; - extraConfig = '' - proxy_set_header Host $host; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - ''; - }; - }; -} diff --git a/adonis/default.nix b/adonis/default.nix index c97d3ee..74ba9b5 100644 --- a/adonis/default.nix +++ b/adonis/default.nix @@ -3,7 +3,7 @@ ./network.nix ./aur ./captiveportal - ./autopush + ./push ./tor ]; system.stateVersion = "25.11"; diff --git a/adonis/push/default.nix b/adonis/push/default.nix new file mode 100644 index 0000000..1dc8f1a --- /dev/null +++ b/adonis/push/default.nix @@ -0,0 +1,55 @@ +{config, ...}: let + domain = "push.${config.customOps.domain.fqdn}"; + ntfyPort = "8080"; + mollyPort = "8020"; + nginxConf = '' + proxy_set_header Host $host; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + ''; +in { + sops.secrets = { + "push/mollysocket" = {}; + }; + + services.ntfy-sh = { + enable = true; + settings = { + listen-http = ":${ntfyPort}"; + base-url = "https://${domain}"; + behind-proxy = true; + auth-file = "/var/lib/ntfy/auth.db"; + auth-access = ["*:up*:write-only"]; + }; + }; + + services.mollysocket = { + enable = true; + settings = { + allowed_endpoints = [ + "https://${domain}" + ]; + webserver = true; + }; + environmentFile = config.sops.secrets."push/mollysocket".path; + }; + + services.nginx.virtualHosts.${domain} = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://127.0.0.1:${ntfyPort}"; + extraConfig = nginxConf; + }; + }; + + services.nginx.virtualHosts."mollysocket.${domain}" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://127.0.0.1:${mollyPort}"; + extraConfig = nginxConf; + }; + }; +} -- cgit v1.3.1