245 commits

Author	SHA1	Message	Date
teutat3s	ecbde09d6a	mail: add more @pub.solar mail accounts	2024-05-30 19:19:39 +02:00
Hendrik Sokolowski	157ddf4ec2	initial work on mail	2024-05-30 19:19:37 +02:00
teutat3s	941eff6d87	tankstelle: configure wireguard	2024-05-30 19:17:21 +02:00
teutat3s	5aa1276e85	ci: add nix to PATH	2024-05-30 19:04:40 +02:00
teutat3s	cc70a740a1	ci: run actions runner as normal user	2024-05-30 19:04:40 +02:00
teutat3s	866785ef47	style: format using treefmt	2024-05-30 19:04:40 +02:00
teutat3s	692c152406	gitea-actions-runner: fix PATH in systemd	2024-05-30 19:04:40 +02:00
teutat3s	e71cbfc461	ci: add self-hosted forgejo-actions-runner ... wip: add git.pub.solar to /etc/hosts ci: add devshell with Node.js for forgejo actions ci: add PATH ci: add HOME	2024-05-30 19:04:13 +02:00
Hendrik Sokolowski	946585d1ca	initial commit of tankstelle	2024-05-29 14:08:59 +02:00
teutat3s	0cb89a9fe8	fix: nachtigall wants keycloak	2024-05-15 19:20:06 +02:00
teutat3s	2ca0bd7c3e	style: run treefmt	2024-05-08 22:57:07 +02:00
Benjamin Yule Bädorf	68278ad983	refactor: use options for config parts ... This works towards having reusable modules * `config.pub-solar-os.networking.domain` is used for the main domain * `config.pub-solar-os.privacyPolicUrl` links towards the privacy policy * `config.pub-solar-os.imprintUrl` links towards the imprint * `config.pub-solar-os.auth.enable` enables the keycloak installation. This is needed because `config.pub-solar-os.auth` has to be available everywhere, but we do not want to install keycloak everywhere. * `config.pub-solar-os.auth.realm` sets the keycloak realm name	2024-05-08 19:47:47 +02:00
Benjamin Yule Bädorf	ef94681e11	refactor: Move all apps into modules	2024-04-28 18:07:28 +02:00
Hendrik Sokolowski	10c86c6b20	nachtigall: obs-portal: remove tiles mount	2024-04-28 01:07:49 +02:00
Hendrik Sokolowski	1d6c5003e8	nachtigall: obs-portal: fix dependencies of docker network unit and portal	2024-04-28 01:05:43 +02:00
Benjamin Yule Bädorf	d280b29394	obs-portal: init obs-portal on nachtigall ... This follows the official installation instructions at https://github.com/openbikesensor/portal/blob/main/docs/production-deployment.md Unfortunately, the postgres database needs to have postgis enabled, so we'll have to start a second instance. To stay close to the official deployment instructions, this is running in docker. The secrets were taken from the old installation instance. During initial installation, we'll need to import data from the old instance into this one, which might take a while.	2024-04-27 22:45:07 +02:00
teutat3s	2fa3ccf28e	Revert "matrix-appservice-irc: remove unneeded syscall override" ... This reverts commit a11255b433.	2024-04-27 01:44:20 +02:00
teutat3s	a11255b433	matrix-appservice-irc: remove unneeded syscall override ... PR was merged and backported: https://github.com/NixOS/nixpkgs/pull/271740	2024-04-25 12:37:58 +02:00
teutat3s	fa9ce9d435	gitea-actions-runner: don't run as systemd DynamicUser ... to enable usage of cache outside of /var/lib/private	2024-04-23 15:42:33 +02:00
teutat3s	9541e5029e	flora-6: move forgejo-runner cache directory to /data	2024-04-23 15:12:11 +02:00
teutat3s	c86e22b292	ci: update forgejo-runner to version 3.4.1 ... https://github.com/NixOS/nixpkgs/pull/301383	2024-04-23 00:38:53 +02:00
Hendrik Sokolowski	a9411d05a8	set pruneOpts for restic backups to daily 7, weekly 4, monthly 3	2024-04-22 20:06:49 +02:00
teutat3s	c07d24f6a7	flora-6: add wg-ssh to ignored interfaces ... for systemd-wait-online to start successfully	2024-04-14 23:22:53 +02:00
teutat3s	c768203bed	nginx: set worker_processes to number of CPU cores ... and set worker_connections to 1024 https://nginx.org/en/docs/ngx_core_module.html#worker_processes https://nginx.org/en/docs/ngx_core_module.html#worker_connections	2024-04-14 17:39:56 +02:00
teutat3s	b6a54efd9a	fix: add comment with hostnames to wireguard peers	2024-04-12 22:36:17 +02:00
Benjamin Yule Bädorf	7e145040cc	wireguard: use IP addresses for wireguard endpoints ... Otherwise the hostnames written to the /etc/hosts file are already pointing at the wireguard IP-addresses, so they can never connect.	2024-04-12 22:31:28 +02:00
teutat3s	8743ea7b0c	networking: add wireguard hosts to /etc/hosts ... Also re-enable DNSSEC, it's reported fixed in systemd-resolved	2024-04-12 19:54:09 +00:00
Benjamin Yule Bädorf	316ba9ef53	forgejo: also reroute ssh traffic for ipv6	2024-04-12 19:38:15 +00:00
teutat3s	afca75441c	Merge pull request 'forgejo: enable repo search (indexer), save login cookie for 365 days' (#142) from feat/forgejo-enable-search into main ... Reviewed-on: #142 Reviewed-by: b12f <b12f@noreply.git.pub.solar>	2024-04-06 16:07:42 +00:00
teutat3s	9698c47530	Merge pull request 'mastodon: clean media older than 7 days' (#143) from mastodon/auto-clean-7-days into main ... Reviewed-on: #143 Reviewed-by: b12f <b12f@noreply.git.pub.solar>	2024-04-06 16:07:34 +00:00
teutat3s	41e4d3427c	mastodon: clean media older than 7 days ... Currently we keep everything for 30 days, which is about 180GB	2024-04-05 23:50:04 +02:00
teutat3s	c5159dd66d	forgejo: enable repo search (indexer), save login ... cookie for 365 days instead of default 7 days. Caveat for the repo indexer is that repository size on disk will grow by factor of 6. Forgejo repositories currently use 4.7GB on disk, with 3.3GB being a nixpkgs fork.	2024-04-05 23:29:49 +02:00
Benjamin Yule Bädorf	16c6aa3b61	forgejo: make SSH keys declarative	2024-04-05 19:35:55 +00:00
teutat3s	315cbf5813	Merge pull request 'fix(nextcloud): define a maintenance window' (#135) from chore/nextcloud-config-maintenance-window into main ... Reviewed-on: #135 Reviewed-by: b12f <b12f@noreply.git.pub.solar>	2024-04-05 18:41:17 +00:00
Hendrik Sokolowski	b6b8d69852	nachtigall: forgejo: update firewall settings	2024-04-05 18:39:43 +02:00
Benjamin Yule Bädorf	e618b9f9c2	forgejo: use iptables routing instead of ssh patch	2024-04-05 17:00:28 +02:00
Benjamin Yule Bädorf	d7c9333ff4	forgejo: allow multiple host addresses for SSH	2024-04-05 14:26:56 +00:00
teutat3s	18a62b8d35	fix(nextcloud): define a maintenance window for ... resource intensive background jobs. Docs: https://docs.nextcloud.com/server/28/admin_manual/configuration_server/background_jobs_configuration.html > A value of 1 e.g. will only run these background jobs between 01:00am UTC and 05:00am UTC	2024-04-05 16:23:16 +02:00
Benjamin Yule Bädorf	f7eaef0d18	wireguard: fix flora-6 address and private key ... Reviewed-on: #129 Reviewed-by: Hendrik Sokolowski <hensoko@noreply.git.pub.solar> Co-authored-by: Benjamin Yule Bädorf <git@benjaminbaedorf.eu> Co-committed-by: Benjamin Yule Bädorf <git@benjaminbaedorf.eu>	2024-04-05 11:26:38 +00:00
Benjamin Yule Bädorf	621e9336ed	wireguard: add basic keys	2024-04-05 11:09:31 +00:00
Benjamin Yule Bädorf	eacf60974c	wireguard: initial commit	2024-04-05 11:09:31 +00:00
Benjamin Yule Bädorf	9433a8aea7	mediawiki: update to v1.41.1	2024-03-30 00:10:09 +01:00
b12f	6aea728583	Merge branch 'main' into feat/security-txt	2024-03-25 15:38:30 +00:00
Benjamin Yule Bädorf	b9cffad02a	matrix: set forgotten_room_retention_period to 7d ... This commit sets the value for the synapse config option `forgotten_room_retention_period` to 7 days. This was previously unset, meaning rooms that had no more local users were never purged from the database. The new value makes sure that 7 days after the last local user left a room, it will be permanently deleted from the database. https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html?highlight=forgotten_room_retention_period#forgotten_room_retention_period	2024-03-24 18:24:30 +01:00
Benjamin Yule Bädorf	2bb2247716	website: add security.txt ... Ref: pub-solar/legal#11	2024-03-23 11:07:04 +01:00
teutat3s	45e91d7ef1	fix: drone port should bind to localhost	2024-03-21 10:44:40 +01:00
teutat3s	c49ffb2d5b	fix: nginx duplicate default server ... nginx: [emerg] a duplicate default server for 0.0.0.0:80 in /etc/nginx/nginx.conf:665	2024-02-25 23:02:00 +01:00
Benjamin Yule Bädorf	de04556191	nginx/miom: disable logging	2024-02-25 21:41:06 +00:00
Benjamin Yule Bädorf	0e89b7f210	nginx/miom: init miom.space website ... This adds an nginx configuration for https://miom.space/. MiOM is a creative collective in Cologne that frequently hosts our hakken.irl hackathons. They're already using our cloud to organize. This service is a bit more specific than most pub.solar services and falls into a similar category as the obs-portal. On the old miom website all logging was turned off, we might want to do the same thing in nginx here as well then.	2024-02-25 21:41:06 +00:00
Benjamin Yule Bädorf	24b77b6de5	nginx/pub.solar: disable logging for homepage	2024-02-25 18:51:24 +01:00