fixup postgres and hedgedoc

flake.nix

@@ -70,6 +70,12 @@
                 owner = "matrix-synapse";
                 group = "matrix-synapse";
               };
+              matrix_db_password = {
+                file = ./secrets/matrix_db_password.age;
+                mode = "440";
+                owner = "matrix-synapse";
+                group = "matrix-synapse";
+              };
               draupnir_access_token = {
                 file = ./secrets/draupnir_access_token.age;
                 mode = "440";
@@ -100,6 +106,14 @@
         modules = [
           agenix.nixosModules.default
           { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
+          {
+            age.secrets.hedgedoc_db_password = {
+              file = ./secrets/hedgedoc_db_password.age;
+              owner = "hedgedoc";
+              group = "hedgedoc";
+              mode = "0440";
+            };
+          }
           ./hosts/md
         ];
       };

hosts/common.nix

@@ -128,3 +128,4 @@
     };
   };
 }
+

hosts/md/default.nix

@@ -6,7 +6,7 @@
     ../../services/openssh.nix
     ./hedgedoc.nix
     ../../services/nginx.nix
-    ./nginx
+    ./nginx.nix
     ./postgres.nix
   ];
 

hosts/md/hedgedoc.nix

@@ -4,15 +4,11 @@
   services.hedgedoc = {
     enable = true;
     settings = {
-      domain = "${config.networking.fqdn}";
+      domain = "md.${config.networking.domain}";
-      #environmentFile = config.age.secrets.hedgedoc_settings.path;
+      environmentFile = config.age.secrets.hedgedoc_db_password.path;
+      dbURL = "postgres://hedgedoc:\${DB_PASSWORD}@sql.berlin.ccc.de:5432/hedgedoc";
+      db.dialect = "postgresql";
       protocolUseSSL = true;
-      db = {
-        dialect = "postgresql";
-        host = "/run/postgresql";
-        username = "hedgedoc";
-        database = "hedgedoc";
-      };
       enableStatsApi = true;
     };
   };

hosts/md/nginx.nix

@@ -4,7 +4,7 @@ let
   cfg = config.services.hedgedoc.settings;
 in
 {
-  nginx.virtualHosts."${config.networking.fqdn}" = {
+  services.nginx.virtualHosts."md.${config.networking.domain}" = {
     default = true;
     quic = true;
     kTLS = true;
@@ -14,6 +14,9 @@ in
       "/" = {
         proxyPass = "http://${cfg.host}:${toString cfg.port}";
         recommendedProxySettings = true;
+        extraConfig = ''
+          #add_header Content-Security-Policy "frame-src 'self'; default-src 'self'; script-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; form-action 'self'; upgrade-insecure-requests;" always;
+        '';
       };
       "/socket.io/" = {
         proxyPass = "http://${cfg.host}:${toString cfg.port}";
@@ -23,16 +26,20 @@ in
       "/metrics" = {
         proxyPass = "http://${cfg.host}:${toString cfg.port}";
         recommendedProxySettings = true;
-        #allow 195.160.173.255;
+        extraConfig = ''
-        #allow 2001:678:760:cccb::ffff;
+          allow 195.160.173.14;
-        #deny all;
+          allow 2001:678:760:cccb::14;
+          deny all;
+        '';
       };
       "/status" = {
         proxyPass = "http://${cfg.host}:${toString cfg.port}";
         recommendedProxySettings = true;
-        #allow 195.160.173.255;
+        extraConfig = ''
-        #allow 2001:678:760:cccb::ffff;
+          allow 195.160.173.14;
-        #deny all;
+          allow 2001:678:760:cccb::14;
+          deny all;
+        '';
       };
     };
   };

hosts/md/postgres.nix

@@ -1,23 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  services = {
-    postgresql = {
-      enable = true;
-      package = pkgs.postgresql_18;
-      enableJIT = true;
-      initdbArgs = [
-        "--locale=C"
-        "--encoding=UTF8"
-      ];
-      ensureUsers = [{ name = cfg.db.username; ensureDBOwnership = true; }];
-      ensureDatabases = [ cfg.db.database ];
-    };
-    postgresqlBackup = {
-      enable = true;
-      startAt = "*-*-* 09:00:00";
-      compression = "zstd";
-    };
-  };
-}
-

hosts/sql/postgres.nix

@@ -58,6 +58,11 @@ in
       ensureDatabases = map (e: e.database) entries;
       authentication = "${builtins.concatStringsSep "\n" (map (e: e.auth) entries)}";
     };
+    postgresqlBackup = {
+      enable = true;
+      startAt = "*-*-* 09:00:00";
+      compression = "zstd";
+    };
   };
   systemd.services.postgresql.postStart = ''
     ${config.services.postgresql.package}/bin/psql \

secrets/secrets.nix

@@ -18,18 +18,27 @@ let
   _md = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdFkdEEDXo8+k5YZpI1O2GqZlxcpCDtxqVun35duITm root@md";
   _sql = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPcSXjDSyVVVdJbpheOhT0fIuOGFk+jsHhjrAVnBNLQV root@sql";
   _www = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID4TJCMuJZn03soKuxxv6ywFKiXfhLf9Ab03fbMqNaBJ root@www";
+  _monitoring = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID4TJCMuJZn03soKuxxv6ywFKiXfhLf9Ab03fbMqNaBJ root@monitoring";
 in
 {
   "matrix_admin_password.age".publicKeys = users;
+
   "draupnir_access_token.age".publicKeys = users ++ [ _matrix ];
   "matrix_signing_key.age".publicKeys = users ++ [ _matrix ];
   "matrix_registration_shared_secret.age".publicKeys = users ++ [ _matrix ];
+  "matrix_db_password.age".publicKeys = users ++ [ _matrix ];
+
   "pushover_app_token.age".publicKeys = users ++ [ _matrix ];
   "pushover_user_key.age".publicKeys = users ++ [ _matrix ];
-  "grafana_admin_password.age".publicKeys = users ++ [ _matrix ];
+
-  "grafana_secret_key.age".publicKeys = users ++ [ _matrix ];
+  "hedgedoc_db_password.age".publicKeys = users ++ [ _md ];
+
+  "grafana_admin_password.age".publicKeys = users ++ [ _monitoring ];
+  "grafana_secret_key.age".publicKeys = users ++ [ _monitoring ];
+
   "postgres-matrix-synapse.age".publicKeys = users ++ [ _sql _matrix ];
   "postgres-hedgedoc.age".publicKeys = users ++ [ _sql _md ];
+
   "www-staging-htpasswd.age".publicKeys = users ++ [ _www ];
 }
 

services/postgres.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, lib, ... }:
 
 {
   services = {
@@ -10,7 +10,7 @@
         "--locale=C"
         "--encoding=UTF8"
       ];
-      settings.listen_addresses = "*";
+      settings.listen_addresses = lib.mkDefault "*";
     };
     postgresqlBackup = {
       enable = true;