From b1b619e17b38b5917f3b09cd0a155406e0b4c128 Mon Sep 17 00:00:00 2001 From: teutat3s Date: Sat, 26 Oct 2024 02:03:31 +0200 Subject: [PATCH] matrix-authentication-service: init host underground to test mas, related to #242 --- flake.lock | 17 + flake.nix | 5 + hosts/default.nix | 24 + hosts/nachtigall/configuration.nix | 45 ++ hosts/underground/configuration.nix | 107 ++++ hosts/underground/default.nix | 16 + hosts/underground/hardware-configuration.nix | 34 ++ hosts/underground/networking.nix | 24 + modules/coturn/default.nix | 6 +- modules/matrix-irc/default.nix | 5 - modules/matrix/default.nix | 540 +++++++++--------- modules/nginx-matrix/default.nix | 55 +- .../nginx-matrix/element-client-config.nix | 6 +- overlays/default.nix | 1 + ... nachtigall-coturn-static-auth-secret.age} | 0 ...all-matrix-synapse-secret-config.yaml.age} | Bin ...nachtigall-matrix-synapse-signing-key.age} | Bin ...ll-matrix-synapse-sliding-sync-secret.age} | 0 secrets/secrets.nix | 14 +- ...thentication-service-secret-config.yml.age | Bin 0 -> 6263 bytes ...ound-matrix-synapse-secret-config.yaml.age | Bin 0 -> 4219 bytes terraform/dns.tf | 32 +- 22 files changed, 630 insertions(+), 301 deletions(-) create mode 100644 hosts/underground/configuration.nix create mode 100644 hosts/underground/default.nix create mode 100644 hosts/underground/hardware-configuration.nix create mode 100644 hosts/underground/networking.nix rename secrets/{coturn-static-auth-secret.age => nachtigall-coturn-static-auth-secret.age} (100%) rename secrets/{matrix-synapse-secret-config.yaml.age => nachtigall-matrix-synapse-secret-config.yaml.age} (100%) rename secrets/{matrix-synapse-signing-key.age => nachtigall-matrix-synapse-signing-key.age} (100%) rename secrets/{matrix-synapse-sliding-sync-secret.age => nachtigall-matrix-synapse-sliding-sync-secret.age} (100%) create mode 100644 secrets/underground-matrix-authentication-service-secret-config.yml.age create mode 100644 secrets/underground-matrix-synapse-secret-config.yaml.age diff --git a/flake.lock b/flake.lock index ae964ea..8c96268 100644 --- a/flake.lock +++ b/flake.lock @@ -234,6 +234,22 @@ "type": "github" } }, + "fork": { + "locked": { + "lastModified": 1729963002, + "narHash": "sha256-2zrYfd/qdfExU5zVwvH80uJnKc/dMeK6zp3O1UtW2Mo=", + "owner": "teutat3s", + "repo": "nixpkgs", + "rev": "005faaacbeede0296dec5c844f508027ab8a3ff6", + "type": "github" + }, + "original": { + "owner": "teutat3s", + "ref": "init-matrix-authentication-service-module", + "repo": "nixpkgs", + "type": "github" + } + }, "home-manager": { "inputs": { "nixpkgs": [ @@ -354,6 +370,7 @@ "element-stickers": "element-stickers", "element-themes": "element-themes", "flake-parts": "flake-parts", + "fork": "fork", "home-manager": "home-manager", "keycloak-theme-pub-solar": "keycloak-theme-pub-solar", "maunium-stickerpicker": "maunium-stickerpicker", diff --git a/flake.nix b/flake.nix index a417b49..923092c 100644 --- a/flake.nix +++ b/flake.nix @@ -3,6 +3,7 @@ # Track channels with commits tested and built by hydra nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05"; unstable.url = "github:nixos/nixpkgs/nixos-unstable"; + fork.url = "github:teutat3s/nixpkgs/init-matrix-authentication-service-module"; nix-darwin.url = "github:lnl7/nix-darwin/master"; nix-darwin.inputs.nixpkgs.follows = "nixpkgs"; @@ -152,6 +153,10 @@ hostname = "tankstelle.wg.pub.solar"; sshUser = username; }; + underground = { + hostname = "80.244.242.3"; + sshUser = username; + }; trinkgenossin = { hostname = "trinkgenossin.wg.pub.solar"; sshUser = username; diff --git a/hosts/default.nix b/hosts/default.nix index 6f159d0..e7a8f2e 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -178,6 +178,30 @@ self.nixosModules.nginx ]; }; + + underground = self.inputs.nixpkgs.lib.nixosSystem { + specialArgs = { + flake = { + inherit self inputs config; + }; + }; + modules = [ + self.inputs.agenix.nixosModules.default + self.nixosModules.home-manager + ./underground + self.nixosModules.overlays + self.nixosModules.unlock-luks-on-boot + self.nixosModules.core + + self.nixosModules.backups + self.nixosModules.keycloak + self.nixosModules.postgresql + self.nixosModules.matrix + self.nixosModules.matrix-irc + self.nixosModules.nginx + self.nixosModules.nginx-matrix + ]; + }; }; }; } diff --git a/hosts/nachtigall/configuration.nix b/hosts/nachtigall/configuration.nix index c226ed0..eb7e657 100644 --- a/hosts/nachtigall/configuration.nix +++ b/hosts/nachtigall/configuration.nix @@ -48,6 +48,7 @@ owner = "root"; }; + # keycloak age.secrets.keycloak-database-password = { file = "${flake.self}/secrets/keycloak-database-password.age"; mode = "600"; @@ -59,6 +60,50 @@ database-password-file = config.age.secrets.keycloak-database-password.path; }; + # matrix-synapse + age.secrets."nachtigall-matrix-synapse-signing-key" = { + file = "${flake.self}/secrets/nachtigall-matrix-synapse-signing-key.age"; + mode = "400"; + owner = "matrix-synapse"; + }; + + age.secrets."nachtigall-matrix-synapse-secret-config.yaml" = { + file = "${flake.self}/secrets/nachtigall-matrix-synapse-secret-config.yaml.age"; + mode = "400"; + owner = "matrix-synapse"; + }; + + age.secrets."nachtigall-matrix-synapse-sliding-sync-secret" = { + file = "${flake.self}/secrets/nachtigall-matrix-synapse-sliding-sync-secret.age"; + mode = "400"; + owner = "matrix-synapse"; + }; + + + pub-solar-os.matrix-synapse = { + enable = true; + signing_key_path = config.age.secrets."nachtigall-matrix-synapse-signing-key".path; + extra-config-files = [ + config.age.secrets."nachtigall-matrix-synapse-secret-config.yaml".path + + # The registration file is automatically generated after starting the + # appservice for the first time. + # cp /var/lib/mautrix-telegram/telegram-registration.yaml \ + # /var/lib/matrix-synapse/ + # chown matrix-synapse:matrix-synapse \ + # /var/lib/matrix-synapse/telegram-registration.yaml + "/var/lib/matrix-synapse/telegram-registration.yaml" + ]; + app-service-config-files = [ + "/var/lib/matrix-synapse/telegram-registration.yaml" + "/var/lib/matrix-appservice-irc/registration.yml" + # "/matrix-appservice-slack-registration.yaml" + # "/hookshot-registration.yml" + # "/matrix-mautrix-signal-registration.yaml" + # "/matrix-mautrix-telegram-registration.yaml" + ]; + }; + systemd.services.postgresql = { after = [ "var-lib-postgresql.mount" ]; requisite = [ "var-lib-postgresql.mount" ]; diff --git a/hosts/underground/configuration.nix b/hosts/underground/configuration.nix new file mode 100644 index 0000000..b53f5dd --- /dev/null +++ b/hosts/underground/configuration.nix @@ -0,0 +1,107 @@ +{ + flake, + config, + pkgs, + ... +}: +{ + # Use GRUB2 as the boot loader. + boot.loader.grub = { + enable = true; + devices = [ "/dev/vda" ]; + }; + + pub-solar-os.networking.domain = "test.pub.solar"; + + systemd.tmpfiles.rules = [ "f /tmp/dbf 1777 root root 10d password" ]; + + # keycloak + pub-solar-os.auth = { + enable = true; + database-password-file = "/tmp/dbf"; + }; + services.keycloak.database.createLocally = true; + + # matrix-synapse + # test.pub.solar /.well-known is required for federation + services.nginx.virtualHosts."${config.pub-solar-os.networking.domain}" = { + default = true; + enableACME = true; + forceSSL = true; + }; + + age.secrets."underground-matrix-synapse-secret-config.yaml" = { + file = "${flake.self}/secrets/underground-matrix-synapse-secret-config.yaml.age"; + mode = "400"; + owner = "matrix-synapse"; + }; + + age.secrets."underground-matrix-authentication-service-secret-config.yml" = { + file = "${flake.self}/secrets/underground-matrix-authentication-service-secret-config.yml.age"; + mode = "400"; + owner = "matrix-authentication-service"; + }; + + pub-solar-os.matrix-synapse = { + enable = true; + extra-config-files = [ + config.age.secrets."underground-matrix-synapse-secret-config.yaml".path + + # The registration file is automatically generated after starting the + # appservice for the first time. + # cp /var/lib/mautrix-telegram/telegram-registration.yaml \ + # /var/lib/matrix-synapse/ + # chown matrix-synapse:matrix-synapse \ + # /var/lib/matrix-synapse/telegram-registration.yaml + #"/var/lib/matrix-synapse/telegram-registration.yaml" + ]; + app-service-config-files = [ + "/var/lib/matrix-appservice-irc/registration.yml" + #"/var/lib/matrix-synapse/telegram-registration.yaml" + ]; + }; + + services.matrix-authentication-service = { + enable = true; + createDatabase = true; + extraConfigFiles = [ + config.age.secrets."underground-matrix-authentication-service-secret-config.yml".path + ]; + settings = { + http.public_base = "https://mas.${config.pub-solar-os.networking.domain}"; + http.issuer = "https://mas.${config.pub-solar-os.networking.domain}"; + http.listeners = [ + { + name = "web"; + resources = [ + { name = "discovery"; } + { name = "human"; } + { name = "oauth"; } + { name = "compat"; } + { name = "graphql"; } + { name = "assets"; path = "${config.services.matrix-authentication-service.package}/share/matrix-authentication-service/assets"; } + ]; + binds = [ + { host = "0.0.0.0"; port = 8090; } + ]; + proxy_protocol = false; + } + { + name = "internal"; + resources = [ + { name = "health"; } + ]; + binds = [ + { host = "0.0.0.0"; port = 8081; } + ]; + proxy_protocol = false; + } + ]; + passwords.enabled = false; + }; + }; + + services.openssh.openFirewall = true; + + system.stateVersion = "24.05"; +} diff --git a/hosts/underground/default.nix b/hosts/underground/default.nix new file mode 100644 index 0000000..5a612a4 --- /dev/null +++ b/hosts/underground/default.nix @@ -0,0 +1,16 @@ +{ flake, ... }: + +{ + imports = [ + # Include the results of the hardware scan. + ./hardware-configuration.nix + ./configuration.nix + + ./networking.nix + "${flake.inputs.fork}/nixos/modules/services//matrix/matrix-authentication-service.nix" + ]; + + disabledModules = [ + "services/matrix/matrix-authentication-service.nix " + ]; +} diff --git a/hosts/underground/hardware-configuration.nix b/hosts/underground/hardware-configuration.nix new file mode 100644 index 0000000..e4738a1 --- /dev/null +++ b/hosts/underground/hardware-configuration.nix @@ -0,0 +1,34 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + boot.initrd.luks.devices."cryptroot" = { + device = "/dev/disk/by-label/cryptroot"; + }; + + fileSystems."/" = + { device = "/dev/disk/by-label/root"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-label/boot"; + fsType = "ext4"; + }; + + swapDevices = + [ { device = "/dev/disk/by-label/swap"; } + ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/hosts/underground/networking.nix b/hosts/underground/networking.nix new file mode 100644 index 0000000..3085c7b --- /dev/null +++ b/hosts/underground/networking.nix @@ -0,0 +1,24 @@ +{ + config, + pkgs, + flake, + ... +}: +{ + + networking.hostName = "underground"; + + networking = { + defaultGateway = { + address = "80.244.242.1"; + interface = "enp1s0"; + }; + nameservers = ["95.129.51.51" "80.244.244.244"]; + interfaces.enp1s0 = { + useDHCP = false; + ipv4.addresses = [ + { address = "80.244.242.3"; prefixLength = 29; } + ]; + }; + }; +} diff --git a/modules/coturn/default.nix b/modules/coturn/default.nix index d8635aa..a7d3e86 100644 --- a/modules/coturn/default.nix +++ b/modules/coturn/default.nix @@ -5,8 +5,8 @@ ... }: { - age.secrets."coturn-static-auth-secret" = { - file = "${flake.self}/secrets/coturn-static-auth-secret.age"; + age.secrets."nachtigall-coturn-static-auth-secret" = { + file = "${flake.self}/secrets/nachtigall-coturn-static-auth-secret.age"; mode = "400"; owner = "turnserver"; }; @@ -18,7 +18,7 @@ min-port = 49000; max-port = 50000; use-auth-secret = true; - static-auth-secret-file = "/run/agenix/coturn-static-auth-secret"; + static-auth-secret-file = "/run/agenix/nachtigall-coturn-static-auth-secret"; realm = "turn.${config.pub-solar-os.networking.domain}"; cert = "${config.security.acme.certs.${realm}.directory}/full.pem"; pkey = "${config.security.acme.certs.${realm}.directory}/key.pem"; diff --git a/modules/matrix-irc/default.nix b/modules/matrix-irc/default.nix index f64d25c..02217d2 100644 --- a/modules/matrix-irc/default.nix +++ b/modules/matrix-irc/default.nix @@ -16,11 +16,6 @@ let synapseClientPort = "${toString listenerWithClient.port}"; in { - systemd.services.matrix-appservice-irc.serviceConfig.SystemCallFilter = lib.mkForce [ - "@system-service @pkey" - "~@privileged @resources" - "@chown" - ]; services.matrix-appservice-irc = { enable = true; localpart = "irc_bot"; diff --git a/modules/matrix/default.nix b/modules/matrix/default.nix index 3165911..d8518d3 100644 --- a/modules/matrix/default.nix +++ b/modules/matrix/default.nix @@ -1,6 +1,7 @@ { flake, config, + lib, pkgs, ... }: @@ -9,304 +10,291 @@ let serverDomain = "${config.pub-solar-os.networking.domain}"; in { - age.secrets."matrix-synapse-signing-key" = { - file = "${flake.self}/secrets/matrix-synapse-signing-key.age"; - mode = "400"; - owner = "matrix-synapse"; + options.pub-solar-os.matrix-synapse = { + enable = lib.mkEnableOption "Enable matrix-synapse to run on the node"; + + app-service-config-files = lib.mkOption { + description = "List of app service config files"; + type = lib.types.listOf lib.types.str; + default = []; + }; + + extra-config-files = lib.mkOption { + description = "List of extra synapse config files"; + type = lib.types.listOf lib.types.str; + default = []; + }; + + signing_key_path = lib.mkOption { + description = "Path to file containing the signing key"; + type = lib.types.str; + default = "${config.services.matrix-synapse.dataDir}/homeserver.signing.key"; + }; }; - age.secrets."matrix-synapse-secret-config.yaml" = { - file = "${flake.self}/secrets/matrix-synapse-secret-config.yaml.age"; - mode = "400"; - owner = "matrix-synapse"; - }; - - age.secrets."matrix-synapse-sliding-sync-secret" = { - file = "${flake.self}/secrets/matrix-synapse-sliding-sync-secret.age"; - mode = "400"; - owner = "matrix-synapse"; - }; - - services.matrix-synapse = { - enable = true; - settings = { - server_name = serverDomain; - public_baseurl = "https://${publicDomain}/"; - database = { - name = "psycopg2"; - args = { - host = "/run/postgresql"; - cp_max = 10; - cp_min = 5; - database = "matrix"; + config = lib.mkIf config.pub-solar-os.matrix-synapse.enable { + services.matrix-synapse = { + enable = true; + settings = { + server_name = serverDomain; + public_baseurl = "https://${publicDomain}/"; + database = { + name = "psycopg2"; + args = { + host = "/run/postgresql"; + cp_max = 10; + cp_min = 5; + database = "matrix"; + }; + allow_unsafe_locale = false; + txn_limit = 0; }; - allow_unsafe_locale = false; - txn_limit = 0; - }; - listeners = [ - { - bind_addresses = [ "127.0.0.1" ]; - port = 8008; - resources = [ - { - compress = true; - names = [ "client" ]; - } - { - compress = false; - names = [ "federation" ]; - } - ]; - tls = false; - type = "http"; - x_forwarded = true; - } - { - bind_addresses = [ "127.0.0.1" ]; - port = 8012; - resources = [ { names = [ "metrics" ]; } ]; - tls = false; - type = "metrics"; - } - ]; + listeners = [ + { + bind_addresses = [ "127.0.0.1" ]; + port = 8008; + resources = [ + { + compress = true; + names = [ "client" ]; + } + { + compress = false; + names = [ "federation" ]; + } + ]; + tls = false; + type = "http"; + x_forwarded = true; + } + { + bind_addresses = [ "127.0.0.1" ]; + port = 8012; + resources = [ { names = [ "metrics" ]; } ]; + tls = false; + type = "metrics"; + } + ]; - account_threepid_delegates.msisdn = ""; - alias_creation_rules = [ - { - action = "allow"; - alias = "*"; - room_id = "*"; - user_id = "*"; - } - ]; - allow_guest_access = false; - allow_public_rooms_over_federation = true; - allow_public_rooms_without_auth = false; - auto_join_rooms = [ - "#community:${serverDomain}" - "#general:${serverDomain}" - ]; + account_threepid_delegates.msisdn = ""; + alias_creation_rules = [ + { + action = "allow"; + alias = "*"; + room_id = "*"; + user_id = "*"; + } + ]; + allow_guest_access = false; + allow_public_rooms_over_federation = true; + allow_public_rooms_without_auth = false; + auto_join_rooms = [ + "#community:${serverDomain}" + "#general:${serverDomain}" + ]; - autocreate_auto_join_rooms = true; - caches.global_factor = 0.5; + autocreate_auto_join_rooms = true; + caches.global_factor = 0.5; - default_room_version = "10"; - disable_msisdn_registration = true; - enable_media_repo = true; - enable_metrics = true; - mau_stats_only = true; - enable_registration = false; - enable_registration_captcha = false; - enable_registration_without_verification = false; - enable_room_list_search = true; - encryption_enabled_by_default_for_room_type = "off"; - event_cache_size = "100K"; - federation_rr_transactions_per_room_per_second = 50; - federation_client_minimum_tls_version = "1.2"; - forget_rooms_on_leave = true; - include_profile_data_on_invite = true; - instance_map = { }; - limit_profile_requests_to_users_who_share_rooms = false; + default_room_version = "10"; + disable_msisdn_registration = true; + enable_media_repo = true; + enable_metrics = true; + mau_stats_only = true; + enable_registration = false; + enable_registration_captcha = false; + enable_registration_without_verification = false; + enable_room_list_search = true; + encryption_enabled_by_default_for_room_type = "off"; + event_cache_size = "100K"; + federation_rr_transactions_per_room_per_second = 50; + federation_client_minimum_tls_version = "1.2"; + forget_rooms_on_leave = true; + include_profile_data_on_invite = true; + instance_map = { }; + limit_profile_requests_to_users_who_share_rooms = false; - max_spider_size = "10M"; - max_upload_size = "50M"; - media_storage_providers = [ ]; + max_spider_size = "10M"; + max_upload_size = "50M"; + media_storage_providers = [ ]; - password_config = { - enabled = false; - localdb_enabled = false; - pepper = ""; - }; + password_config = { + enabled = false; + localdb_enabled = false; + pepper = ""; + }; - presence.enabled = true; - push.include_content = false; + presence.enabled = true; + push.include_content = false; - rc_admin_redaction = { - burst_count = 50; - per_second = 1; - }; - rc_federation = { - concurrent = 3; - reject_limit = 50; - sleep_delay = 500; - sleep_limit = 10; - window_size = 1000; - }; - rc_invites = { - per_issuer = { + rc_admin_redaction = { + burst_count = 50; + per_second = 1; + }; + rc_federation = { + concurrent = 3; + reject_limit = 50; + sleep_delay = 500; + sleep_limit = 10; + window_size = 1000; + }; + rc_invites = { + per_issuer = { + burst_count = 10; + per_second = 0.3; + }; + per_room = { + burst_count = 10; + per_second = 0.3; + }; + per_user = { + burst_count = 5; + per_second = 3.0e-3; + }; + }; + rc_joins = { + local = { + burst_count = 10; + per_second = 0.1; + }; + remote = { + burst_count = 10; + per_second = 1.0e-2; + }; + }; + rc_login = { + account = { + burst_count = 3; + per_second = 0.17; + }; + address = { + burst_count = 3; + per_second = 0.17; + }; + failed_attempts = { + burst_count = 3; + per_second = 0.17; + }; + }; + rc_message = { burst_count = 10; - per_second = 0.3; + per_second = 0.2; }; - per_room = { - burst_count = 10; - per_second = 0.3; - }; - per_user = { - burst_count = 5; - per_second = 3.0e-3; - }; - }; - rc_joins = { - local = { - burst_count = 10; - per_second = 0.1; - }; - remote = { - burst_count = 10; - per_second = 1.0e-2; - }; - }; - rc_login = { - account = { + rc_registration = { burst_count = 3; per_second = 0.17; }; - address = { - burst_count = 3; - per_second = 0.17; - }; - failed_attempts = { - burst_count = 3; - per_second = 0.17; + redaction_retention_period = "7d"; + forgotten_room_retention_period = "7d"; + redis.enabled = false; + registration_requires_token = false; + registrations_require_3pid = [ "email" ]; + report_stats = false; + require_auth_for_profile_requests = false; + room_list_publication_rules = [ + { + action = "allow"; + alias = "*"; + room_id = "*"; + user_id = "*"; + } + ]; + + signing_key_path = config.pub-solar-os.matrix-synapse.signing_key_path; + + stream_writers = { }; + trusted_key_servers = [ { server_name = "matrix.org"; } ]; + suppress_key_server_warning = true; + + turn_allow_guests = false; + turn_uris = [ + "turn:${config.services.coturn.realm}:3478?transport=udp" + "turn:${config.services.coturn.realm}:3478?transport=tcp" + ]; + turn_user_lifetime = "1h"; + + url_preview_accept_language = [ + "en-US" + "en" + ]; + url_preview_enabled = true; + url_preview_ip_range_blacklist = [ + "127.0.0.0/8" + "10.0.0.0/8" + "172.16.0.0/12" + "192.168.0.0/16" + "100.64.0.0/10" + "192.0.0.0/24" + "169.254.0.0/16" + "192.88.99.0/24" + "198.18.0.0/15" + "192.0.2.0/24" + "198.51.100.0/24" + "203.0.113.0/24" + "224.0.0.0/4" + "::1/128" + "fe80::/10" + "fc00::/7" + "2001:db8::/32" + "ff00::/8" + "fec0::/10" + ]; + + user_directory = { + prefer_local_users = false; + search_all_users = false; }; + user_ips_max_age = "28d"; + + app_service_config_files = config.pub-solar-os.matrix-synapse.app-service-config-files; }; - rc_message = { - burst_count = 10; - per_second = 0.2; - }; - rc_registration = { - burst_count = 3; - per_second = 0.17; - }; - redaction_retention_period = "7d"; - forgotten_room_retention_period = "7d"; - redis.enabled = false; - registration_requires_token = false; - registrations_require_3pid = [ "email" ]; - report_stats = false; - require_auth_for_profile_requests = false; - room_list_publication_rules = [ - { - action = "allow"; - alias = "*"; - room_id = "*"; - user_id = "*"; - } + + withJemalloc = true; + + extraConfigFiles = config.pub-solar-os.matrix-synapse.extra-config-files; + + extras = [ + "oidc" + "redis" ]; - signing_key_path = "/run/agenix/matrix-synapse-signing-key"; - - stream_writers = { }; - trusted_key_servers = [ { server_name = "matrix.org"; } ]; - suppress_key_server_warning = true; - - turn_allow_guests = false; - turn_uris = [ - "turn:${config.services.coturn.realm}:3478?transport=udp" - "turn:${config.services.coturn.realm}:3478?transport=tcp" - ]; - turn_user_lifetime = "1h"; - - url_preview_accept_language = [ - "en-US" - "en" - ]; - url_preview_enabled = true; - url_preview_ip_range_blacklist = [ - "127.0.0.0/8" - "10.0.0.0/8" - "172.16.0.0/12" - "192.168.0.0/16" - "100.64.0.0/10" - "192.0.0.0/24" - "169.254.0.0/16" - "192.88.99.0/24" - "198.18.0.0/15" - "192.0.2.0/24" - "198.51.100.0/24" - "203.0.113.0/24" - "224.0.0.0/4" - "::1/128" - "fe80::/10" - "fc00::/7" - "2001:db8::/32" - "ff00::/8" - "fec0::/10" - ]; - - user_directory = { - prefer_local_users = false; - search_all_users = false; - }; - user_ips_max_age = "28d"; - - app_service_config_files = [ - "/var/lib/matrix-synapse/telegram-registration.yaml" - "/var/lib/matrix-appservice-irc/registration.yml" - # "/matrix-appservice-slack-registration.yaml" - # "/hookshot-registration.yml" - # "/matrix-mautrix-signal-registration.yaml" - # "/matrix-mautrix-telegram-registration.yaml" - ]; + plugins = [ config.services.matrix-synapse.package.plugins.matrix-synapse-shared-secret-auth ]; }; - withJemalloc = true; + #services.matrix-sliding-sync = { + # enable = true; + # settings = { + # SYNCV3_SERVER = "https://${publicDomain}"; + # SYNCV3_BINDADDR = "127.0.0.1:8011"; + # # The bind addr for Prometheus metrics, which will be accessible at + # # /metrics at this address + # SYNCV3_PROM = "127.0.0.1:9100"; + # }; + # environmentFile = config.age.secrets."matrix-synapse-sliding-sync-secret".path; + #}; - extraConfigFiles = [ - "/run/agenix/matrix-synapse-secret-config.yaml" - - # The registration file is automatically generated after starting the - # appservice for the first time. - # cp /var/lib/mautrix-telegram/telegram-registration.yaml \ - # /var/lib/matrix-synapse/ - # chown matrix-synapse:matrix-synapse \ - # /var/lib/matrix-synapse/telegram-registration.yaml - "/var/lib/matrix-synapse/telegram-registration.yaml" - ]; - - extras = [ - "oidc" - "redis" - ]; - - plugins = [ config.services.matrix-synapse.package.plugins.matrix-synapse-shared-secret-auth ]; - }; - - services.matrix-sliding-sync = { - enable = true; - settings = { - SYNCV3_SERVER = "https://${publicDomain}"; - SYNCV3_BINDADDR = "127.0.0.1:8011"; - # The bind addr for Prometheus metrics, which will be accessible at - # /metrics at this address - SYNCV3_PROM = "127.0.0.1:9100"; + pub-solar-os.backups.restic.matrix-synapse = { + paths = [ + "/var/lib/matrix-synapse" + "/var/lib/matrix-appservice-irc" + "/var/lib/mautrix-telegram" + "/tmp/matrix-synapse-backup.sql" + ]; + timerConfig = { + OnCalendar = "*-*-* 05:00:00 Etc/UTC"; + }; + initialize = true; + backupPrepareCommand = '' + ${pkgs.sudo}/bin/sudo -u postgres ${pkgs.postgresql}/bin/pg_dump -d matrix > /tmp/matrix-synapse-backup.sql + ''; + backupCleanupCommand = '' + rm /tmp/matrix-synapse-backup.sql + ''; + pruneOpts = [ + "--keep-daily 7" + "--keep-weekly 4" + "--keep-monthly 3" + ]; }; - environmentFile = config.age.secrets."matrix-synapse-sliding-sync-secret".path; - }; - - services.restic.backups.matrix-synapse-storagebox = { - paths = [ - "/var/lib/matrix-synapse" - "/var/lib/matrix-appservice-irc" - "/var/lib/mautrix-telegram" - "/tmp/matrix-synapse-backup.sql" - ]; - timerConfig = { - OnCalendar = "*-*-* 05:00:00 Etc/UTC"; - }; - initialize = true; - passwordFile = config.age.secrets."restic-repo-storagebox-nachtigall".path; - repository = "sftp:u377325@u377325.your-storagebox.de:/backups"; - backupPrepareCommand = '' - ${pkgs.sudo}/bin/sudo -u postgres ${pkgs.postgresql}/bin/pg_dump -d matrix > /tmp/matrix-synapse-backup.sql - ''; - backupCleanupCommand = '' - rm /tmp/matrix-synapse-backup.sql - ''; - pruneOpts = [ - "--keep-daily 7" - "--keep-weekly 4" - "--keep-monthly 3" - ]; }; } diff --git a/modules/nginx-matrix/default.nix b/modules/nginx-matrix/default.nix index 0e236dc..603de36 100644 --- a/modules/nginx-matrix/default.nix +++ b/modules/nginx-matrix/default.nix @@ -10,11 +10,14 @@ let add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-XSS-Protection "1; mode=block"; ''; - clientConfig = import ./element-client-config.nix { inherit lib pkgs; }; + clientConfig = import ./element-client-config.nix { inherit config lib pkgs; }; wellKnownClient = domain: { "m.homeserver".base_url = "https://matrix.${domain}"; "m.identity_server".base_url = "https://matrix.${domain}"; - "org.matrix.msc3575.proxy".url = "https://matrix.${domain}"; + "org.matrix.msc2965.authentication" = { + issuer = "https://mas.${domain}/"; + account = "https://mas.${domain}/account"; + }; "im.vector.riot.e2ee".default = true; "io.element.e2ee" = { default = true; @@ -85,6 +88,27 @@ in root = pkgs.element-stickerpicker; }; + "mas.${config.pub-solar-os.networking.domain}" = { + root = "/dev/null"; + + forceSSL = lib.mkDefault true; + enableACME = lib.mkDefault true; + + locations = { + "/" = { + proxyPass = "http://127.0.0.1:8090"; + + extraConfig = '' + ${commonHeaders} + proxy_http_version 1.1; + + # Forward the client IP address + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + ''; + }; + }; + }; + "matrix.${config.pub-solar-os.networking.domain}" = { root = "/dev/null"; @@ -99,28 +123,41 @@ in locations = { # For telegram "/c3c3f34b-29fb-5feb-86e5-98c75ec8214b" = { + priority = 100; proxyPass = "http://127.0.0.1:8009"; extraConfig = commonHeaders; }; - # sliding-sync - "~ ^/(client/|_matrix/client/unstable/org.matrix.msc3575/sync)" = { - proxyPass = "http://127.0.0.1:8011"; - extraConfig = commonHeaders; + # Forward to the auth service + "~ ^/_matrix/client/(.*)/(login|logout|refresh)" = { + priority = 100; + proxyPass = "http://127.0.0.1:8090"; + + extraConfig = '' + ${commonHeaders} + proxy_http_version 1.1; + + # Forward the client IP address + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + ''; }; - "~* ^(/_matrix|/_synapse/client|/_synapse/oidc)" = { + # Forward to Synapse + # as per https://element-hq.github.io/synapse/latest/reverse_proxy.html#nginx + "~ ^(/_matrix|/_synapse/client)" = { + priority = 200; proxyPass = "http://127.0.0.1:8008"; extraConfig = '' ${commonHeaders} + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $host; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; client_body_buffer_size 25M; client_max_body_size 50M; proxy_max_temp_file_size 0; + proxy_http_version 1.1; ''; }; }; diff --git a/modules/nginx-matrix/element-client-config.nix b/modules/nginx-matrix/element-client-config.nix index b3eaf9b..617d3bc 100644 --- a/modules/nginx-matrix/element-client-config.nix +++ b/modules/nginx-matrix/element-client-config.nix @@ -1,9 +1,9 @@ -{ pkgs, lib, ... }: +{ config, pkgs, lib, ... }: { default_server_config = { "m.homeserver" = { - base_url = "https://matrix.pub.solar"; - server_name = "pub.solar"; + base_url = "https://matrix.${config.pub-solar-os.networking.domain}"; + server_name = "${config.pub-solar-os.networking.domain}"; }; "m.identity_server" = { base_url = ""; diff --git a/overlays/default.nix b/overlays/default.nix index 50ede5d..33f0e1d 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -17,6 +17,7 @@ inherit (inputs) element-stickers maunium-stickerpicker; }; mastodon = unstable.mastodon; + matrix-authentication-service = unstable.matrix-authentication-service; } ) ]; diff --git a/secrets/coturn-static-auth-secret.age b/secrets/nachtigall-coturn-static-auth-secret.age similarity index 100% rename from secrets/coturn-static-auth-secret.age rename to secrets/nachtigall-coturn-static-auth-secret.age diff --git a/secrets/matrix-synapse-secret-config.yaml.age b/secrets/nachtigall-matrix-synapse-secret-config.yaml.age similarity index 100% rename from secrets/matrix-synapse-secret-config.yaml.age rename to secrets/nachtigall-matrix-synapse-secret-config.yaml.age diff --git a/secrets/matrix-synapse-signing-key.age b/secrets/nachtigall-matrix-synapse-signing-key.age similarity index 100% rename from secrets/matrix-synapse-signing-key.age rename to secrets/nachtigall-matrix-synapse-signing-key.age diff --git a/secrets/matrix-synapse-sliding-sync-secret.age b/secrets/nachtigall-matrix-synapse-sliding-sync-secret.age similarity index 100% rename from secrets/matrix-synapse-sliding-sync-secret.age rename to secrets/nachtigall-matrix-synapse-sliding-sync-secret.age diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 999cec9..402fc79 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -7,6 +7,7 @@ let trinkgenossin-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDZXRDpom/LtyoCxvRuoONARKxIT6wNUwEyUjzHRE7DG root@trinkgenossin"; delite-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKo7zlfQhcJ5/okFTOoOstZtmEL1iNlHxQ4q2baEcWT root@delite"; blue-shell-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP9g9X0a/MaVtbh44IeLxcq+McuYec0GYAdLsseBpk5f root@blue-shell"; + underground-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGF3PtA89yhVkmN7aJI6gqXK8DW9L7kI71IgiK4TAEwI root@underground"; adminKeys = builtins.foldl' ( keys: login: keys ++ (builtins.attrValues login.secretEncryptionKeys) @@ -24,6 +25,8 @@ let blueshellKeys = [ blue-shell-host ]; + undergroundKeys = [ underground-host ]; + garageKeys = [ trinkgenossin-host delite-host @@ -62,9 +65,12 @@ in "forgejo-ssh-private-key.age".publicKeys = nachtigallKeys ++ adminKeys; "matrix-mautrix-telegram-env-file.age".publicKeys = nachtigallKeys ++ adminKeys; - "matrix-synapse-signing-key.age".publicKeys = nachtigallKeys ++ adminKeys; - "matrix-synapse-secret-config.yaml.age".publicKeys = nachtigallKeys ++ adminKeys; - "matrix-synapse-sliding-sync-secret.age".publicKeys = nachtigallKeys ++ adminKeys; + "nachtigall-matrix-synapse-signing-key.age".publicKeys = nachtigallKeys ++ adminKeys; + "nachtigall-matrix-synapse-secret-config.yaml.age".publicKeys = nachtigallKeys ++ adminKeys; + "nachtigall-matrix-synapse-sliding-sync-secret.age".publicKeys = nachtigallKeys ++ adminKeys; + + "underground-matrix-synapse-secret-config.yaml.age".publicKeys = undergroundKeys ++ adminKeys; + "underground-matrix-authentication-service-secret-config.yml.age".publicKeys = undergroundKeys ++ adminKeys; "nextcloud-secrets.age".publicKeys = nachtigallKeys ++ adminKeys; "nextcloud-admin-pass.age".publicKeys = nachtigallKeys ++ adminKeys; @@ -84,7 +90,7 @@ in "mediawiki-oidc-client-secret.age".publicKeys = nachtigallKeys ++ adminKeys; "mediawiki-secret-key.age".publicKeys = nachtigallKeys ++ adminKeys; - "coturn-static-auth-secret.age".publicKeys = nachtigallKeys ++ adminKeys; + "nachtigall-coturn-static-auth-secret.age".publicKeys = nachtigallKeys ++ adminKeys; "grafana-admin-password.age".publicKeys = trinkgenossinKeys ++ adminKeys; "grafana-keycloak-client-secret.age".publicKeys = trinkgenossinKeys ++ adminKeys; diff --git a/secrets/underground-matrix-authentication-service-secret-config.yml.age b/secrets/underground-matrix-authentication-service-secret-config.yml.age new file mode 100644 index 0000000000000000000000000000000000000000..eaab469c83d3200a67f0b3f539330957499b9aed GIT binary patch literal 6263 zcmZXVcT^9G|Nk>?^0u=_%BWkS_g-YY_ul&*^4@#zw`*rhSxHLSqlAb`G8#%s;b!Yr zmr|reLiF|fo%1>8JN|#2^Ej{9>+yQNWE#~1m04l;S)DqIImTkw0Nr4~f+b-NhjxKV z34z1G=rAhU4uNUHOfrnp3&H6mW|cw*WcqawF4Zn3x>>~ERdO`Tjxu9l0wTo%K>_3z zwMj=(+es7xRPR8@nPf1+1C(GzXf+N&Q}fLZ29<5X@flXk|E9Sl3Ov&jrsF|5R5X=< zF-r_&zM3MltH}r$0_0O_;1oPk$R>+me5a3YG&%qTh6te$(!~OkPs1U4RBSw-g$D^m zbf1oH!HHmQv|r89K?Ot!>OVBQLl&ln^T`$sK;k0lKxhHnB%ra`HYDC}p)2er1kGr) z5ojC-N#`X&X*iBhg?AI=OaqH=_1oooun~eIi6tzy5dacJ!=hQ@LRs8sg$F6NNpUI<2JN?zAQYaP z6oTw|K6bB_}d^8gpYqV2{7`c%PBZ2)Y8W-wCgB)I#-;7j>Q3NIn#>3F4 zI1~xX;A7Y(2|)$WD>x9VU+8ujqWJHj3XM|ZYxp1 zKzpHH8Q%*8Q4K_?fMT>#y}*GKK5(i}Xkm(In9-K+#Z^ zfa`LBqG1Lg(eqn$o5swySs*F{j!BTwv;c!uAth?vMy`b_^ztEOB^t}8=$J+!(#Uke zr5c*bfR)1)EF6$1r2?gFB^)FZJ2=sBH-)B$*{A@AO9hkRv}hz7?GZ5{V2s^klhH&N z5!D8@sLdn+5n<6wMR2851;MdVCM6XC64)_PklkTXK!hj&jKxJ6X)Kgct0Cx+c$(3o z?Pq4Z>)RSD+U zXzXaLRG>BJC`^nA#6jtybd5%06riK&cIEFCFzpNhj3Qh+|Z2NcXXBKk3WOKB{EE8!l6gVFUlu9H(jtwL>%SBk7 zgk?oINM0@Zx5r)+9!B9u<5@0@Po&`TB^)yp4#5yb5)WC2hk-FPClp08xgcODNu-9$ z+|_wIB!`)%N3!5tyc?>*n;~)* zTMMJm6c(Obg2L*Z3Z?+5kpPSe0~iG2d+mBA-Yhf|EK&nUEvLF^N}JXI)o9Hej8Shx z5=k7*|MS?Yb1$$$;D|6c*U$bP{TP^xj#8l9WQg7YM}g%ss?w-;W0_>93Iz2VU@`}a zfde88Y!*WWa54lAJD+LRDbaQ$U8AsBC<2w5XV+N;0`l*?W^;We2uCG@^Ev;6<+s^@ zy5B4Z(xPMw$wrP?sACZMu0I+%k%*J)2v0{!AYsN!iHaw3b!@^i5k$_;eGvGY7-j7ggD4734!wMZf zJ|+z0)kuw8iUk8h3uwe>C!c4rJM@06#liB5%oZ3?0;6Jhc%qLZ0LYONDNRi>`N&oo ziOj?DC}N1rLH0SUToaLu7QF=x z#yXHRE+0$qpmk6JkHEysX&$Tx1VDq8Hj5OES8!cWrIXD7!f*;3TS!;V6L963INFw&{6qccg@@R;frsY_D5(?ns zW8vm=H!ckVEqm|VU-WlTfpPK5Nktjs3Z9;}u~H)wJN7Ti`4^3>nvv2KGk+d@@Bzoi znQ<=@3k_wHpR9>VI}yCb>#3N5arbII>GXiL5DY#;#c(^Q(q#$DN)UroO3f8H)dg9{KGBXxO?QC>X2tQ1d>*cnF*>gG=s|l!sqyFCU@bHvpBaj;({0K?de6;=2 zoxfuP?{*{)ZyFq1mh<68()#<){*ApnwkOLkPg%6_jW+q%yteeF#c{HALDW&@!OA8od->R)A5*T9kscAXvm+)5xKDw-mc%K z5BL_$hT^5&-aVbtL7(>YZ)iUHvv$we@!!IZjsLVPS$eG_c2(kYX%Riz*orT?NwxG& zTzx*)N+|dm#vgyLXxns&WbacEe0xZS=y(DR~qtLMSYI%7rzX;a% z{B?2k(+j0@f`a$QVSBWkiZhwB>y-V+OY=(yw*CEj`r1ut#q(s_m9HMsDm&3^Sx7p0v`(y!!>{% z_0=eVw>|WB!u4Tw!8xOTM$M6?&x=zX9Q?GSlW{Wp-PE<`ps^ngBk*&+RTXr0`V%Bw zr_0LILi%R@QBv{b?(BWV++%Y}QzquKvd52hS%w7ANxqf~s^T4oEsA(k!MdhTF(p3& zzA9ftMQpv(^3T9Q+VIBS5sgbi7f1n7Tc%E&y(XhK_-nw?RI1cOY*0F{wr={IH7CYi zxVg49z_6Q<+nAgbn9_b4>peQuxi@pqnXf?u7_;zs;Y@8`Zn@{YXYCKk1pJ=@v;@i7`eOJL%uH9Z3j*qPb4@i!X1luEZ>9vh-oBN_ zS%_^V_9*U*tbUp?5cIlBWZJm+6D8+$$+fB9BEclokC9m=F-zCShP?mmt(lvfTy?3e zaEBu*Q*>_NWBY)$_IKlziv*Aq)ff@3dVzI||Y-n4lF4(taY`i)6IpWu!kM}P>%vtww<~>M!`HBPe zAr~~OPCd)M5a`--AAaIf;jmJCV4at5$0yeWE-sv@0$P}!{+f%*p%Zp2O4_7}zhn!w z!}T5iO#IR33f@;Xz`8V5w5Ja?cG!dyz3N!${6jb!iql?+@@gk1R1oV(s17n4d=9sdU-U;4|ddFAsPZeP_<1&b1-1@2_3WO#OM1J$v?#%Lg7st|-*j z|Jpfy*SKZ-6CR{i&y45XJb!i4j&)I|5XGIRTY#Cp{*=DMA<%y(T|Ch#ebW|~8N1hw zp4Te3r|biL|9YL@V~OKz1b1ycADUK>zD4L{546O1xAvVy{?lF(q8AigjGdp^JuKv9 zM1CFRz`FzQF4wlVBy>++{AqS!ddc3fTPudYsVWz(hLpa3sLYY`s7;el=m;?&{%|6u zW<%A)MbDi%NlP*oZ^)Ik!NwNjSVVpb_DFYotZtZVv+sxOx&s)8R>(woqgBjmIPzl(|-+% z$~9k`uRHh7ng}V%kN=JVREPo9#fPqi9AOQr|22}yphPYiv8m~K(-};|?Ukm^s_)lU zCu9tx{EEI27%;DYboXTZ0$6kS;Hmpz3&Z0Ujs3Z4-9GP&)OW|k_KJ3P+Z*HdK@E}V z4<9yG7F8Da-{Kd9fn#F#HPnqq=OqU#XHDzIZ;2ixt$XuFIP68D>;txa&9RfPp=+iW zuU=_iclIK9Tt~dFLa*EMxKsFG<{IMCIY;hKx$=2F&8SRkNLY^khz)4@mlyD=q8ZXS z^wEjW14A8S+Ko{O2e3_aZ}g81IfQj4E0l=3lpIMO{j{f@oOb58rWaQt9y* z10gqL*%`?=y>N3!=$H9BhV_0f0i{!Wde_A~-n1N%Ir%_ZA~8y-pL zZZgfNE;U3Pfz;Oi0)?blXvL^^zK)oK&4C+tW_V84B?OIp-?F{SxidX4IW>P#_;z{5 z=ia2j5u7mr!Gjijgw!^XB9k{4Is@7nTRrQF*@N~}cJi~9Erl7g@Kbu%A9F539cr9; z5{3xQdZC@nd@ylULFKakuz-ULBWLL~E8aDAnRXsI7M2A(-!n>CFbmK%EPrUiTT1rK z!y?>O7M*qJrlT;`-oBznHZu3ic751zO10$V=luZvizAblrd(fgXBKkRgI$g5wpmwN zSLIin%?6!pq6}Yx%mBb?62$fXSB>c-K*o*GDB`F_Wl^2 z^D4Uc_>!`Z)5|`bsM=Jy?Ru*svq+h{g@hWl?@+{!i@7}XEh))zv>x3eg4S1(OOJIM^k8SzBQhdM?6VW0&{dj3<&)TeQZ6$$^ zr0<`h{gd)t$AeTcq30Up53jQyx2{?^zi~zRH{B-yj~OoNVcRE!pE_k0u(oZ#kigXD z#R>C|nG+%(bgtO**YIz$vwzh`o;VVEypnXqQGD=W^_1Sv9`%X^SMRirxK?kvHEi00 z{%5qN+--jc1O+W0F?m{3iE#JWgWEpL!UtW6T-6_AnC`h&vH;Q&acqwD^iF7tPOY`beI z1w0!AxcMrLM)BUP?+*lY>`2~wzb1U_yLll)iyPk$4(_R>3~9R(wQ{|5&H9x~IEUl* z7hTbhCMX?c=1f*B5JV;|?mXPr%l-(k~Fq-Iy<1+FKX zC!}p}7_e=YK3`wQJ;vWfdt-(CX(A7=rqm!M=b-zjTbD26JRYvtRz65{bM?HC+_0LW zZz#!K!1d};4P7Jcu(B)dN$^$UI*f$lSO&?a^(w5OXiZT_Mpt`K}GXW z!QW48mW0$*$U@g3=6`;+EAMsMr~KwR-q)mKS8FDngMx~rcW1YZ>Jt@o%vxJX`q4p+ zjRf0|6JM3@ZKWYU%!*RPY|V=}pVW3>b@jWqsDT*um}^shhIj8}eW%Y%W6W>3U0qIQ zZ`m#>rkD&1C)^BZJ-#JtMv^CR?E}`0JW&bj*p%AKi<|$fIrq|J$qeqNAN={TA3X%9 z>zla7{H}M){w-W;@6Nff`&rVP0oD7vD*c!LKs-4QK35dpd^#w-$~f$DO%HbH$>xoT zJ%4$|+}p4+Ddi%v0*svK5c52cg^$DYr|Tzm<9JI_-G^!IWtl6kgMW>iMw(Y2$4x=L z7&bDY{=nSU>$ zcs(&K^z7Ge!-CEvlb)IM28c;!GBc@@Oft!Yz6dUYyTBqv zK#*NP%9W+9pa`-oy)WgmNH2mk1p#Tw$M>D%IrqEwA9#Q7dEV!J9zTJX;PGIJqtjF( z{$3(Q2v`xXWOy;dkR><`I@pCswAOf5WD7gt|DGo>YPMpoi1*-ALLb0sp3@7=Lj{>d++!p4sJQCE{=xBBhiy;5A3g zL|jKP1eeX^ykd2bF-W3vjVA3*IlWduBvINe#sCPXBCHMK6G1O8;E$-B(XhoJbLS-% zztiYvqQ<{f*}XuNb+N1zfVG9Mh=%Gl?0HFM@7=KK0)$DN*&_KYJp6i;N^23j3E4W zIA?}4Qioqadg7Q-9FFIbj5lv1@t8aib8;qJnX%a1W_QG;do>OuPz@Zjq%9mT=U3w# z>lU*SIwFP?sGL-JlrSn3d0Ez+@F4~U&x1xC5O6Ru3G4|XASjZ?_!cwcBq70$Y4nY2t1qD3%qI(l*lX4U?QZ~3B!=jM9UrOm>&)a0f>&o z^hus5KqOO9+QoQ6ag&^~XQQYvpmV~QN{rbgCWg__m^Lbo;&BrQ>%9!$F2&QhUtwZl zv(iFGc_vNXk`OzsYz}c#DVNqOm3gD2L7EjOY=VqKNEwn?C}+!wXeeaTv7k5{l>40= zfRGtgIOq}c0x`Z->(ATBFwnQr@&l zseE-!ht!kd<@J7CMCAaOcI(X=&H(@_3JWO1umbi4Vp?U;<<$6dR!E8l9k!Is4Wn9V zOqtbK!upt&if4G34iBQTv>C}J5+a1rb8)>n`g24NqH!qkps5MBpR}FI+k)KQ#8wS;0!;U0Z(WlZ0GlWL84i6I`TuLz#H}R}#p;{~=WSlUg!^AcrDNxw7F@Z3`q<9 zES)50ZKE}!E3E|-9kn^~X0DfL@Y zlr@To1p1U9g+myV^Gfncvjvqzpp=3V>I@N{%s+4axR8A z{~s%#ObV!1EC7p|v4|`v&ccX>MB%K#iIG~hNG+9HXs1r?PEukhD?>yn2TvXio7^%6 zLgYD$4|1%P6oUv(B~>}C;#CghRWOMHmnuHMy zm8-N6!-Fk}s5qk3%SoTe6eq=m&?^cf3d|R`x@F;*C7{cDai2AUu>aNAkc;6QU@?(b z#C&R(R-YsyfF^A46TXyA>2NS^y-S_-hs0c3gj;ke6`|*)O&X6`AH_izrpU+Tj7g2e zRIEzGVT1wCCG-wem@mVEp+u7TPbK+c7Z9};JG^KhWWixcCLs!vN(_{0As-aNy&;v( zisWochumco3)Qxqo@dcoG7c&g(~tqoYSLg9xkw=q0%{Ft$`Gz7jQW#^PRp`Un}SzT zQc?`1WGESrXl-V9CgzmVh$~5m5Fo389d;_q8nLuSk<)7xagCFAr}@D{^4I&Wf2ZKc z$jWI z1Ii~Gu1_s5on3aLWB9irgKL@W*k|yCUc7Ya!|drt#T|REZ<2-tJcI$Bd*4*Ffst#(c=#(;A`WVy1Bx8YXZcw|XIlj&dmN^Z7jcd9e`vvNiL%H9Qqh5NrKIAKTI)@ql7 zy-UCLv-kE`28`%l39SLK1*Vyu>7s|=ZGDY&|67y5hF$kZT@)|*OPBjGar1G%d69l) z4XTbG?`_(Q?w=h5Hyv8Au4wP1l9@m6{pF436Zai*t&omNecE!?pJnx3FTaV6-CF|8 z+EO^JRP;zbz%5dxq6M>%i~v z%f@H-8p>x}FJ6^wdFQ+3)%KI^^QT7k)O6{xdGV~rW&4}YoX-~m=Z9A`EqPSZhFN~M z_3fpTr#5c-_QIJRFD@R7KKgFjw&bnF^IlwE5tzI8>UwAJa^Q`+E-OB-+;DnLv!cgk z6}44g>G}0r2e$3K1z4MF^@eQipS!0|e`o)$Oo_PudZ(VFHrDVLz#WjJ$%~p*ptgpTFV%WN~?>&;8tmjSnrh3LtpVybL ze{^WGv3kd`tE;-}rt*C~R=zFKU*$P}d!Q1-H=9m)O+7Omfa`siwz|`_4GYm_3lHwv zb>Y;QZii1Coms?`@_U{?JMHZ0)R@uDN1r}ZIICeLSgSZ+dGI7d6cn7B`(#05-u!jV z#QjgN>agA|Z|@wvVR8?7>M!kf|7dbTQ^mCr?KV3GPty}q+U^suG}M zJN&;fISul;axbaAr$GdkU@{N_TL46jRZzkTfjC=apgL}z*Y*6Ks>PuUb?nco!GkRx_G>)e zA9_|j@S{a77RGm6z_(61T3$+x9sS05Z{z%aQ#=HEeBkWPOTXN+;`iLLfn&+iJA2Pb z=1J&I&z~E6g{Zx4*NXd~A0A(}Qt~3xxGizN4c)Aty-h8dy}JWB_WRC>@Mp_^-BvJa zj(srywI3|XzAYCiKJxdUSJv!@4*F}qHXNOJ^TY2`A9v04EiQOqrcV9v&cXqu3yTJ= z-f8@De)55=w0iQ)InDzQhA){nazw?$fwXqeXV<3mneyqhlOwJ)>G}-*38P$%6aRSY zx5y^K6oqBY{u3sNt+GHYT3SQs-+Ka~Z_~)?c2SLfQM(pO^-^DyHf%$WszkKk1(GoK;3SHm1s`4q)um0UXcEE`tM;b#?9XG4`@XOX; zjUb9|ym)uRu~kJ+iy}W4Ega_QeAYho;>z{Rth%OwkB$$YyX4!0U6!zi2Ie0e@162k zvY$L_@#EbwPYb3$YSsVg#z`Z8se#)y)Iw{9ohz>s3#iqXZ~Oc7I?-%=Q+2mZ8F)sY zqk}7M{~S;?l+C@=YO{G=;8sZ3`t-v37C+xmj#~fe{c~HMOqM?>obXJ2*IhOHy?vK2 z_2+Hh`Jt9w^Pn#?tYp*vSH>CMjJ*P+p Q51QL~#-^6TukLRDKWNaec>n+a literal 0 HcmV?d00001 diff --git a/terraform/dns.tf b/terraform/dns.tf index d4a8d43..5372c39 100644 --- a/terraform/dns.tf +++ b/terraform/dns.tf @@ -332,10 +332,40 @@ resource "namecheap_domain_records" "pub-solar" { type = "AAAA" address = "2a01:4f8:172:1c25::1" } + record { + hostname = "underground" + type = "A" + address = "80.244.242.3" + } + record { + hostname = "test" + type = "CNAME" + address = "underground.pub.solar." + } + record { + hostname = "mas.test" + type = "CNAME" + address = "underground.pub.solar." + } record { hostname = "matrix.test" type = "CNAME" - address = "nachtigall.pub.solar." + address = "underground.pub.solar." + } + record { + hostname = "chat.test" + type = "CNAME" + address = "underground.pub.solar." + } + record { + hostname = "stickers.chat.test" + type = "CNAME" + address = "underground.pub.solar." + } + record { + hostname = "auth.test" + type = "CNAME" + address = "underground.pub.solar." } # SRV records can only be changed via NameCheap Web UI # add comment