b12f
0e65002520
tests/keycloak: certificate fetching with step-ca works
2024-08-24 16:21:48 +02:00
b12f
f087e088c6
tests: add working test for website
2024-08-23 22:50:22 +02:00
teutat3s
7f2bfd923f
loki: move data dir to /data disk with more room
Flake checks / Check (pull_request) Successful in 4m33s
2024-08-07 10:19:53 +02:00
teutat3s
79679720ff
tt-rss: lint with treefmt
Flake checks / Check (pull_request) Successful in 7m11s
2024-07-18 17:49:29 +02:00
teutat3s
0fc0c6d595
tt-rss: use git.tt-rss.org instead of gitlab
...
gitlab repo was throwing HTTP 500 errors
2024-07-18 17:35:05 +02:00
Benjamin Yule Bädorf
13c381ff3d
rss: fix auth build, fix nginx group rights, log to stdout
Flake checks / Check (pull_request) Failing after 1m12s
2024-07-17 18:50:06 +02:00
Benjamin Yule Bädorf
68be6b9303
tt-rss: fix secret paths, add plugin sha
2024-07-17 15:22:59 +02:00
Benjamin Yule Bädorf
cf830a9770
tt-rss: module init
2024-07-17 15:22:57 +02:00
teutat3s
26e96dfac5
mediawiki: update to v1.42.1
2024-07-15 18:51:10 +02:00
teutat3s
7ce66f38fc
grafana: update dashboard json, select nachtigall by default
Flake checks / Check (pull_request) Successful in 5m37s
2024-07-02 19:04:52 +02:00
teutat3s
2ebe4bd109
loki: fix invalid config max_look_back_period,
...
Flake checks / Check (pull_request) Successful in 14m21s
seems no longer used in loki 3
2024-06-23 15:19:20 +02:00
teutat3s
bc9ac6011e
flake: update to NixOS 24.05
...
Fix warnings:
trace: warning: The option `services.nextcloud.extraOptions' defined in `/nix/store/a53lc1l5wy9vbv1d3n93903dq0wjgvfj-source/flake.nix#nixosModules.nextcloud' has been renamed to `services.nextcloud.settings'.
trace: warning: The option `services.nextcloud.skeletonDirectory' defined in `/nix/store/a53lc1l5wy9vbv1d3n93903dq0wjgvfj-source/flake.nix#nixosModules.nextcloud' has been renamed to `services.nextcloud.settings.skeletondirectory'.
trace: warning: The option `services.nextcloud.config.overwriteProtocol' defined in `/nix/store/a53lc1l5wy9vbv1d3n93903dq0wjgvfj-source/flake.nix#nixosModules.nextcloud' has been renamed to `services.nextcloud.settings.overwriteprotocol'.
trace: warning: The option `services.matrix-synapse.sliding-sync' defined in `/nix/store/a53lc1l5wy9vbv1d3n93903dq0wjgvfj-source/flake.nix#nixosModules.matrix' has been renamed to `services.matrix-sliding-sync'.
Fix errors:
loki: fix config for version 3+
keycloak: declarative-user-profile feature is now enabled by default
error: A definition for option `programs.gnupg.agent.pinentryPackage' is not of type `null or package'. Definition values:
- In `/nix/store/a53lc1l5wy9vbv1d3n93903dq0wjgvfj-source/flake.nix#nixosModules.forgejo': "curses"
2024-06-23 15:19:18 +02:00
teutat3s
99f84268e7
nextcloud: fine tune for performance, following
...
Flake checks / Check (pull_request) Successful in 4m1s
https://docs.nextcloud.com/server/latest/admin_manual/installation/server_tuning.html
2024-06-23 15:01:37 +02:00
teutat3s
f38aa289ea
matrix-synapse: enable more useful logging
2024-06-23 15:00:40 +02:00
teutat3s
d21ae91c3e
postgresql: tune
Flake checks / Check (pull_request) Successful in 13m50s
2024-06-22 16:42:38 +02:00
teutat3s
e2691988bf
nextcloud: use port 465 and TLS/SSL for mail transfer
Flake checks / Check (pull_request) Successful in 3m56s
2024-06-08 23:54:05 +02:00
teutat3s
d3fedd84e9
loki: tune settings, enable cache
2024-06-08 23:53:43 +02:00
teutat3s
6ea916603c
networking: set networking.domain in core module
Flake checks / Check (pull_request) Successful in 4m0s
2024-06-06 19:30:11 +02:00
teutat3s
bae41b07a8
promtail: use hostName to set label
2024-06-06 19:29:42 +02:00
teutat3s
eaed05c834
style: apply treefmt
Flake checks / Check (pull_request) Successful in 4m41s
2024-06-06 12:56:55 +02:00
teutat3s
4350cbf7c4
tankstelle: add promtail, prometheus node-exporter
...
for monitoring, configure wireguard between flora-6 and tankstelle
2024-06-06 12:53:49 +02:00
teutat3s
b93608a8fa
metronom: add promtail, prometheus node-exporter
...
configure wireguard to push logs to and scrape metrics from flora-6
open firewall for node-exporter port on wg-ssh interface
2024-06-06 12:52:55 +02:00
teutat3s
6aa18b0a2c
flake: update inputs
...
Flake checks / Check (pull_request) Successful in 14m32s
• Updated input 'element-themes':
'github:aaronraimist/element-themes/2368b58c16d2c4aabb82a245f036d228cbb6e5f5' (2024-02-12)
→ 'github:aaronraimist/element-themes/6ed3a981191cbd59f03ea530f16e096b9a4c278c' (2024-05-28)
• Updated input 'flake-parts':
'github:hercules-ci/flake-parts/8dc45382d5206bd292f9c2768b8058a8fd8311d9' (2024-05-16)
→ 'github:hercules-ci/flake-parts/2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8' (2024-06-01)
• Updated input 'flake-parts/nixpkgs-lib':
'50eb7ecf4ceb9ceca17d
2024-06-05 02:08:13 +02:00
teutat3s
e93a56e594
nginx: use square brackets for IPv6 address
Flake checks / Check (pull_request) Successful in 4m0s
2024-06-05 01:59:54 +02:00
teutat3s
27c239b985
loki: allow port 3100 in firewall for wg-ssh interface
2024-06-05 01:59:44 +02:00
teutat3s
61ea0ad7c2
networking: add internal IPv6 wireguard IPs to /etc/hosts
Flake checks / Check (pull_request) Successful in 3m8s
2024-06-03 12:33:51 +02:00
teutat3s
56f692740e
networking: use *.wg.pub.solar in /etc/hosts
...
instead of overriding IPs for existing DNS records, to reduce suprises
when DNS records are different depending on the host.
Add metronom + tankstelle internal wireguard IPs, too.
2024-06-03 12:28:33 +02:00
teutat3s
20ebf92f1f
loki, promtail, prometheus: remove basic auth, use
...
wireguard to secure connections
2024-06-01 16:51:14 +02:00
teutat3s
9a9dccf5bb
mail: move NixOS module to modules
2024-05-31 16:52:04 +02:00
teutat3s
9d8026a31a
mail(treewide): update mail.greenbaum.zone -> mail.pub.solar
2024-05-31 16:52:04 +02:00
teutat3s
2eeef069a2
alerts: alert for uptime after 90 days instead
Flake checks / Check (pull_request) Successful in 3m22s
2024-05-27 16:45:58 +02:00
teutat3s
1235a4f878
Merge pull request 'style: avoid usage of top-level "with lib;"' ( #195 ) from style-avoid-top-level-lib into main
...
Reviewed-on: #195
Reviewed-by: Hendrik Sokolowski <hensoko@noreply.git.pub.solar>
2024-05-27 10:03:43 +00:00
teutat3s
708cf947de
backups: remove droppie
...
Flake checks / Check (pull_request) Successful in 3m22s
There were no backups to droppie since December 2023. We can always add
it back, if desired.
2024-05-19 15:31:20 +02:00
teutat3s
c015a1ec2e
style: avoid usage of top-level "with lib";
...
Flake checks / Check (pull_request) Successful in 3m2s
See: https://github.com/NixOS/nixpkgs/issues/208242
2024-05-19 15:27:19 +02:00
teutat3s
67b9b84e01
backups: reduce chances for lock race
...
Flake checks / Check (pull_request) Successful in 2m16s
Start one backup per hour each night
2024-05-15 21:00:41 +02:00
teutat3s
e52324209f
alertmanager: fix SMTP secret
Flake checks / Check (pull_request) Successful in 2m17s
2024-05-15 17:15:46 +02:00
teutat3s
bd4241e71d
caddy: use alerts.pub.solar domain for vhost
Flake checks / Check (pull_request) Successful in 20m47s
2024-05-15 16:17:54 +02:00
teutat3s
d1a68a7c13
secrets: fix too open permissions
2024-05-15 16:01:44 +02:00
teutat3s
9245fa6797
alertmanager: finalize init
2024-05-15 16:01:44 +02:00
teutat3s
a8a8155114
style: treefmt with nixfmt-rfc-style
2024-05-15 16:01:44 +02:00
Pablo Ovelleiro Corral
11f5557a7a
Add reverseproxy for alerts.pub.solar
...
Co-authored-by: teutat3s <teutat3s@noreply.git.pub.solar>
2024-05-15 16:01:43 +02:00
Pablo Ovelleiro Corral
7e2bcfc5cf
Add alertmanager config
2024-05-15 16:01:42 +02:00
teutat3s
2ca0bd7c3e
style: run treefmt
Flake checks / Check (pull_request) Successful in 2m36s
2024-05-08 22:57:07 +02:00
Benjamin Yule Bädorf
68278ad983
refactor: use options for config parts
...
Flake checks / Check (pull_request) Successful in 5m52s
This works towards having reusable modules
* `config.pub-solar-os.networking.domain` is used for the main domain
* `config.pub-solar-os.privacyPolicUrl` links towards the privacy policy
* `config.pub-solar-os.imprintUrl` links towards the imprint
* `config.pub-solar-os.auth.enable` enables the keycloak installation.
This is needed because `config.pub-solar-os.auth` has to be available
everywhere, but we do not want to install keycloak everywhere.
* `config.pub-solar-os.auth.realm` sets the keycloak realm name
2024-05-08 19:47:47 +02:00
teutat3s
ff9703e542
matrix: init stickerpicker
Flake checks / Check (pull_request) Successful in 12m57s
2024-05-07 17:47:55 +02:00
teutat3s
c738f2d41f
modules: remove leftover apps dir
Flake checks / Check (pull_request) Successful in 18m22s
2024-04-30 00:57:46 +02:00
Pablo Ovelleiro Corral
512ab12de1
Put modules into uniform folders
Flake checks / Check (pull_request) Successful in 6m2s
2024-04-28 19:17:09 +02:00
Benjamin Yule Bädorf
ef94681e11
refactor: Move all apps into modules
Flake checks / Check (pull_request) Successful in 6m5s
2024-04-28 18:07:28 +02:00
teutat3s
8743ea7b0c
networking: add wireguard hosts to /etc/hosts
...
Also re-enable DNSSEC, it's reported fixed in systemd-resolved
2024-04-12 19:54:09 +00:00
Benjamin Yule Bädorf
b1519c8f22
ssh: only allow ssh on wireguard interface
Flake checks / Check (pull_request) Successful in 8m16s
2024-04-05 14:28:18 +02:00
b12f
teutat3s
Pablo Ovelleiro Corral