215 commits

Author	SHA1	Message	Date
teutat3s	941eff6d87	tankstelle: configure wireguard	2024-05-30 19:17:21 +02:00
teutat3s	0cb89a9fe8	fix: nachtigall wants keycloak	2024-05-15 19:20:06 +02:00
teutat3s	2ca0bd7c3e	style: run treefmt	2024-05-08 22:57:07 +02:00
Benjamin Yule Bädorf	ef94681e11	refactor: Move all apps into modules	2024-04-28 18:07:28 +02:00
Hendrik Sokolowski	10c86c6b20	nachtigall: obs-portal: remove tiles mount	2024-04-28 01:07:49 +02:00
Hendrik Sokolowski	1d6c5003e8	nachtigall: obs-portal: fix dependencies of docker network unit and portal	2024-04-28 01:05:43 +02:00
Benjamin Yule Bädorf	d280b29394	obs-portal: init obs-portal on nachtigall ... This follows the official installation instructions at https://github.com/openbikesensor/portal/blob/main/docs/production-deployment.md Unfortunately, the postgres database needs to have postgis enabled, so we'll have to start a second instance. To stay close to the official deployment instructions, this is running in docker. The secrets were taken from the old installation instance. During initial installation, we'll need to import data from the old instance into this one, which might take a while.	2024-04-27 22:45:07 +02:00
teutat3s	2fa3ccf28e	Revert "matrix-appservice-irc: remove unneeded syscall override" ... This reverts commit a11255b433.	2024-04-27 01:44:20 +02:00
teutat3s	a11255b433	matrix-appservice-irc: remove unneeded syscall override ... PR was merged and backported: https://github.com/NixOS/nixpkgs/pull/271740	2024-04-25 12:37:58 +02:00
Hendrik Sokolowski	a9411d05a8	set pruneOpts for restic backups to daily 7, weekly 4, monthly 3	2024-04-22 20:06:49 +02:00
teutat3s	c768203bed	nginx: set worker_processes to number of CPU cores ... and set worker_connections to 1024 https://nginx.org/en/docs/ngx_core_module.html#worker_processes https://nginx.org/en/docs/ngx_core_module.html#worker_connections	2024-04-14 17:39:56 +02:00
teutat3s	b6a54efd9a	fix: add comment with hostnames to wireguard peers	2024-04-12 22:36:17 +02:00
Benjamin Yule Bädorf	7e145040cc	wireguard: use IP addresses for wireguard endpoints ... Otherwise the hostnames written to the /etc/hosts file are already pointing at the wireguard IP-addresses, so they can never connect.	2024-04-12 22:31:28 +02:00
Benjamin Yule Bädorf	316ba9ef53	forgejo: also reroute ssh traffic for ipv6	2024-04-12 19:38:15 +00:00
teutat3s	afca75441c	Merge pull request 'forgejo: enable repo search (indexer), save login cookie for 365 days' (#142) from feat/forgejo-enable-search into main ... Reviewed-on: #142 Reviewed-by: b12f <b12f@noreply.git.pub.solar>	2024-04-06 16:07:42 +00:00
teutat3s	9698c47530	Merge pull request 'mastodon: clean media older than 7 days' (#143) from mastodon/auto-clean-7-days into main ... Reviewed-on: #143 Reviewed-by: b12f <b12f@noreply.git.pub.solar>	2024-04-06 16:07:34 +00:00
teutat3s	41e4d3427c	mastodon: clean media older than 7 days ... Currently we keep everything for 30 days, which is about 180GB	2024-04-05 23:50:04 +02:00
teutat3s	c5159dd66d	forgejo: enable repo search (indexer), save login ... cookie for 365 days instead of default 7 days. Caveat for the repo indexer is that repository size on disk will grow by factor of 6. Forgejo repositories currently use 4.7GB on disk, with 3.3GB being a nixpkgs fork.	2024-04-05 23:29:49 +02:00
Benjamin Yule Bädorf	16c6aa3b61	forgejo: make SSH keys declarative	2024-04-05 19:35:55 +00:00
teutat3s	315cbf5813	Merge pull request 'fix(nextcloud): define a maintenance window' (#135) from chore/nextcloud-config-maintenance-window into main ... Reviewed-on: #135 Reviewed-by: b12f <b12f@noreply.git.pub.solar>	2024-04-05 18:41:17 +00:00
Hendrik Sokolowski	b6b8d69852	nachtigall: forgejo: update firewall settings	2024-04-05 18:39:43 +02:00
Benjamin Yule Bädorf	e618b9f9c2	forgejo: use iptables routing instead of ssh patch	2024-04-05 17:00:28 +02:00
Benjamin Yule Bädorf	d7c9333ff4	forgejo: allow multiple host addresses for SSH	2024-04-05 14:26:56 +00:00
teutat3s	18a62b8d35	fix(nextcloud): define a maintenance window for ... resource intensive background jobs. Docs: https://docs.nextcloud.com/server/28/admin_manual/configuration_server/background_jobs_configuration.html > A value of 1 e.g. will only run these background jobs between 01:00am UTC and 05:00am UTC	2024-04-05 16:23:16 +02:00
Benjamin Yule Bädorf	f7eaef0d18	wireguard: fix flora-6 address and private key ... Reviewed-on: #129 Reviewed-by: Hendrik Sokolowski <hensoko@noreply.git.pub.solar> Co-authored-by: Benjamin Yule Bädorf <git@benjaminbaedorf.eu> Co-committed-by: Benjamin Yule Bädorf <git@benjaminbaedorf.eu>	2024-04-05 11:26:38 +00:00
Benjamin Yule Bädorf	621e9336ed	wireguard: add basic keys	2024-04-05 11:09:31 +00:00
Benjamin Yule Bädorf	eacf60974c	wireguard: initial commit	2024-04-05 11:09:31 +00:00
Benjamin Yule Bädorf	9433a8aea7	mediawiki: update to v1.41.1	2024-03-30 00:10:09 +01:00
b12f	6aea728583	Merge branch 'main' into feat/security-txt	2024-03-25 15:38:30 +00:00
Benjamin Yule Bädorf	b9cffad02a	matrix: set forgotten_room_retention_period to 7d ... This commit sets the value for the synapse config option `forgotten_room_retention_period` to 7 days. This was previously unset, meaning rooms that had no more local users were never purged from the database. The new value makes sure that 7 days after the last local user left a room, it will be permanently deleted from the database. https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html?highlight=forgotten_room_retention_period#forgotten_room_retention_period	2024-03-24 18:24:30 +01:00
Benjamin Yule Bädorf	2bb2247716	website: add security.txt ... Ref: pub-solar/legal#11	2024-03-23 11:07:04 +01:00
teutat3s	c49ffb2d5b	fix: nginx duplicate default server ... nginx: [emerg] a duplicate default server for 0.0.0.0:80 in /etc/nginx/nginx.conf:665	2024-02-25 23:02:00 +01:00
Benjamin Yule Bädorf	de04556191	nginx/miom: disable logging	2024-02-25 21:41:06 +00:00
Benjamin Yule Bädorf	0e89b7f210	nginx/miom: init miom.space website ... This adds an nginx configuration for https://miom.space/. MiOM is a creative collective in Cologne that frequently hosts our hakken.irl hackathons. They're already using our cloud to organize. This service is a bit more specific than most pub.solar services and falls into a similar category as the obs-portal. On the old miom website all logging was turned off, we might want to do the same thing in nginx here as well then.	2024-02-25 21:41:06 +00:00
Benjamin Yule Bädorf	24b77b6de5	nginx/pub.solar: disable logging for homepage	2024-02-25 18:51:24 +01:00
teutat3s	842ec945f4	forgejo: appName option has been renamed ... trace: warning: The option `services.forgejo.appName' defined in `/nix/store/z68x68rbw9sg4d7mcjrjd6aq598rmrwf-source/hosts/nachtigall/apps/forgejo.nix' has been renamed to `services.forgejo.settings.DEFAULT.APP_NAME'.	2024-02-07 19:02:04 +01:00
teutat3s	d67190d175	feat: init tmate-ssh-server ... https://tmate.io	2024-02-07 19:01:36 +01:00
teutat3s	f43ba01ee6	feat: use forgejo NixOS module with gitea user ... https://nixos.org/manual/nixos/stable/#module-forgejo-migration-gitea	2024-02-06 12:19:45 +01:00
teutat3s	4ce188edec	metrics(matrix-synapse): enable internal MAU metrics ... https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#mau_stats_only	2024-02-01 15:51:55 +01:00
teutat3s	031bab4a4e	fix(nextcloud): interned_strings_buffer should be ... powers of 2	2024-02-01 11:21:10 +01:00
teutat3s	576ceb6875	fix(matrix-synapse): mail hostname, missing tls ... setting on metrics listener	2024-01-30 19:42:48 +01:00
teutat3s	69b976607f	fix(matrix-synapse): make sure to find element in ... list of config.services.matrix-synapse.settings.listeners that sets type = "metrics" instead of just using the first element in the list	2024-01-29 00:44:53 +01:00
teutat3s	62429bca08	fix(matrix-synapse): make sure to find element in ... list of config.services.matrix-synapse.settings.listeners.*.resources that sets names = "client" instead of just using the first element in the list of listeners	2024-01-29 00:44:53 +01:00
teutat3s	3cfdd9d20a	refactor(matrix-synapse): get first listener port	2024-01-29 00:44:52 +01:00
teutat3s	2f75ae7e62	feat(matrix-synapse): enable metrics ... Following: https://github.com/matrix-org/synapse/blob/develop/docs/metrics-howto.md	2024-01-29 00:44:13 +01:00
teutat3s	815033c764	treewide: apply nixpkgs-fmt ... Used command: nixpkgs-fmt .	2024-01-27 20:29:30 +01:00
teutat3s	b3b3725c9f	feat: php opcache tuning for nextcloud ... https://docs.nextcloud.com/server/latest/admin_manual/installation/server_tuning.html#:~:text=opcache.jit%20%3D%201255%20opcache.jit_buffer_size%20%3D%20128m	2024-01-25 20:19:32 +01:00
teutat3s	be668fbb17	fix: nextcloud likes interned strings buffer > 8 ... 7cf6f51516 made a wrong assumption	2024-01-23 22:18:58 +01:00
teutat3s	ffdf55993f	fix(nginx): [warn] could not build optimal proxy_headers_hash ... nginx: [warn] could not build optimal proxy_headers_hash, you should increase either proxy_headers_hash_max_size: 2048 or proxy_headers_hash_bucket_size: 64; ignoring proxy_headers_hash_bucket_size	2024-01-17 15:16:06 +01:00
teutat3s	94ae6c9302	fix(mastodon): use working unix sockets for streaming api ... The streaming API is currently unusable because we still pass traffic to the old unix socket path. Since c82195d9e8 (diff-157b1ef68573bbec951d6e551513a555e2d1ca7a161a68f1978b11d39a0bef1eR789-R803) there are multiple unix sockets involved.	2024-01-17 10:32:03 +01:00