From 6e96b2b968f2af75219839ed3e2d341c405b0eff Mon Sep 17 00:00:00 2001 From: naturallaw77 Date: Fri, 27 Mar 2026 20:45:09 -0500 Subject: [PATCH] removed agenix --- configuration.nix | 14 +--- flake.nix | 11 ++-- modules/core/matrix-secret.nix | 27 ++++++++ modules/modules.nix | 1 + modules/synapse.nix | 115 ++++++++++++--------------------- 5 files changed, 76 insertions(+), 92 deletions(-) create mode 100644 modules/core/matrix-secret.nix diff --git a/configuration.nix b/configuration.nix index 19bd4ac..d90b42c 100644 --- a/configuration.nix +++ b/configuration.nix @@ -103,7 +103,7 @@ libargon2 gnome-terminal libreoffice-fresh dig firefox element-desktop wp-cli axel lk-jwt-service livekit-libwebrtc livekit-cli livekit - matrix-synapse + matrix-synapse age ]; # ── Shell ────────────────────────────────────────────────── @@ -126,15 +126,6 @@ ''; }; - # ── Agenix ───────────────────────────────────────────────── - age.identityPaths = [ "/root/.ssh/agenix/agenix-secret-keys" ]; - age.secrets.matrix_reg_secret = { - file = /var/lib/agenix-secrets/matrix_reg_secret.age; - mode = "770"; - owner = "matrix-synapse"; - group = "matrix-synapse"; - }; - # ── Backups ──────────────────────────────────────────────── services.rsnapshot = { enable = true; @@ -153,7 +144,7 @@ backup /etc/nix-bitcoin-secrets/ localhost/ }; }; - # ── Cron (base system crons only) ───────────────────────── + # ── Cron ─────────────────────────────────────────────────── services.cron = { enable = true; systemCronJobs = [ @@ -165,6 +156,7 @@ backup /etc/nix-bitcoin-secrets/ localhost/ # ── Tor ──────────────────────────────────────────────────── services.tor = { enable = true; client.enable = true; torsocks.enable = true; }; + services.privoxy.enableTor = true; # ── SSH ──────────────────────────────────────────────────── services.openssh = { diff --git a/flake.nix b/flake.nix index 748b9a5..2d273c9 100755 --- a/flake.nix +++ b/flake.nix @@ -3,16 +3,14 @@ inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; - nix-bitcoin.url = "github:fort-nix/nix-bitcoin/release"; - agenix.url = "github:ryantm/agenix"; - agenix.inputs.darwin.follows = ""; + nix-bitcoin.url = "github:fort-nix/nix-bitcoin/release"; nixvim.url = "github:nix-community/nixvim"; btc-clients.url = "github:emmanuelrosa/btc-clients-nix"; nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.11"; bip110.url = "github:emmanuelrosa/bitcoin-knots-bip-110-nix"; }; - outputs = { self, nixpkgs, nix-bitcoin, nixvim, agenix, btc-clients, nixpkgs-stable, bip110, ... }: + outputs = { self, nixpkgs, nix-bitcoin, nixvim, btc-clients, nixpkgs-stable, bip110, ... }: let overlay-stable = final: prev: { @@ -22,8 +20,8 @@ }; }; in - { - + { + nixosConfigurations.nixos = nixpkgs.lib.nixosSystem { modules = [ { nixpkgs.hostPlatform = "x86_64-linux"; } @@ -36,7 +34,6 @@ }) ./configuration.nix nix-bitcoin.nixosModules.default - agenix.nixosModules.default nixvim.nixosModules.nixvim ]; config = { diff --git a/modules/core/matrix-secret.nix b/modules/core/matrix-secret.nix new file mode 100644 index 0000000..70500ab --- /dev/null +++ b/modules/core/matrix-secret.nix @@ -0,0 +1,27 @@ +{ config, pkgs, lib, ... }: + +{ + # ── Generate Matrix registration secret at runtime ────────── + systemd.services.matrix-synapse-secret-init = { + description = "Generate Matrix Synapse registration secret if missing"; + wantedBy = [ "multi-user.target" ]; + before = [ "matrix-synapse.service" ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + }; + path = [ pkgs.pwgen pkgs.coreutils ]; + script = '' + SECRET_FILE="/var/lib/matrix-synapse/registration-secret" + if [ ! -f "$SECRET_FILE" ]; then + mkdir -p /var/lib/matrix-synapse + pwgen -s 64 1 > "$SECRET_FILE" + chown matrix-synapse:matrix-synapse "$SECRET_FILE" + chmod 600 "$SECRET_FILE" + echo "Generated Matrix registration secret" + else + echo "Matrix registration secret already exists, skipping" + fi + ''; + }; +} \ No newline at end of file diff --git a/modules/modules.nix b/modules/modules.nix index 1fef452..0db8221 100755 --- a/modules/modules.nix +++ b/modules/modules.nix @@ -7,6 +7,7 @@ ./core/role-logic.nix ./core/caddy.nix ./core/njalla.nix + ./core/matrix-secret.nix ./core/sovran-manage-domains.nix # ── Always on (no flag) ─────────────────────────────────── diff --git a/modules/synapse.nix b/modules/synapse.nix index 2a259c1..3b810b7 100755 --- a/modules/synapse.nix +++ b/modules/synapse.nix @@ -2,9 +2,7 @@ lib.mkIf config.sovran_systemsOS.services.synapse { - # ── PostgreSQL database for Matrix ────────────────────────── services.postgresql = { - enable = true; ensureDatabases = [ "matrix-synapse" ]; ensureUsers = [ { @@ -14,47 +12,33 @@ lib.mkIf config.sovran_systemsOS.services.synapse { ]; }; - # ── Auto-generate DB password and initialize ──────────────── systemd.services.matrix-synapse-db-init = { - description = "Initialize Matrix Synapse PostgreSQL database with auto-generated password"; - after = [ "postgresql.service" ]; - requires = [ "postgresql.service" ]; - before = [ "matrix-synapse.service" ]; + description = "Generate Matrix Synapse DB password if missing"; wantedBy = [ "multi-user.target" ]; + before = [ "matrix-synapse.service" ]; serviceConfig = { Type = "oneshot"; RemainAfterExit = true; }; - path = [ config.services.postgresql.package pkgs.pwgen pkgs.coreutils ]; + path = [ pkgs.pwgen ]; script = '' - set -euo pipefail - - SECRET_DIR="/var/lib/secrets" - SECRET_FILE="$SECRET_DIR/matrix_db_secret" - - mkdir -p "$SECRET_DIR" - + SECRET_FILE="/var/lib/matrix-synapse/db-password" if [ ! -f "$SECRET_FILE" ]; then - pwgen -s 64 1 > "$SECRET_FILE" - chmod 600 "$SECRET_FILE" + mkdir -p /var/lib/matrix-synapse + pwgen -s 32 1 > "$SECRET_FILE" chown matrix-synapse:matrix-synapse "$SECRET_FILE" - fi - - DB_PASS=$(cat "$SECRET_FILE") - - psql -U postgres -c "ALTER ROLE \"matrix-synapse\" WITH LOGIN PASSWORD '$DB_PASS';" - - if ! psql -U postgres -lqt | cut -d \| -f 1 | grep -qw "matrix-synapse"; then - psql -U postgres -c "CREATE DATABASE \"matrix-synapse\" WITH OWNER \"matrix-synapse\" TEMPLATE template0 LC_COLLATE = 'C' LC_CTYPE = 'C';" + chmod 600 "$SECRET_FILE" + echo "Generated new DB password at $SECRET_FILE" + else + echo "DB password already exists, skipping" fi ''; }; - # ── Generate Synapse runtime config from domain files ─────── systemd.services.matrix-synapse-runtime-config = { - description = "Generate Matrix Synapse runtime config from domain files"; + description = "Generate Synapse runtime config from domain files"; before = [ "matrix-synapse.service" ]; - after = [ "matrix-synapse-db-init.service" ]; + after = [ "matrix-synapse-db-init.service" "matrix-synapse-secret-init.service" ]; requiredBy = [ "matrix-synapse.service" ]; wantedBy = [ "multi-user.target" ]; serviceConfig = { @@ -66,70 +50,50 @@ lib.mkIf config.sovran_systemsOS.services.synapse { }; path = [ pkgs.coreutils ]; script = '' - set -euo pipefail - MATRIX=$(cat /var/lib/domains/matrix) - RUNTIME_DIR="/run/matrix-synapse" - mkdir -p "$RUNTIME_DIR" - # Include TURN config if coturn secret exists (deployed machines) - if [ -f /var/lib/secrets/coturn_static_auth_secret ]; then - COTURN_SECRET=$(cat /var/lib/secrets/coturn_static_auth_secret) - cat > "$RUNTIME_DIR/runtime-config.yaml" < "$RUNTIME_DIR/runtime-config.yaml" < /run/matrix-synapse/runtime-config.yaml <