xengi/infra
0
1
Fork 0
Code Pull requests Activity Actions

fixup postgres and hedgedoc

Browse source
This commit is contained in:
XenGi 2026-02-14 01:44:06 +01:00
parent 6a23fdc3f2
commit af01cffa4d
Signed by: xengi
SSH key fingerprint: SHA256:jxWM2RTHvxxcncXycwwWkP7HCWb4VREN05UGJTbIPZg
10 changed files with 52 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

14
flake.nix
View file

@ -70,6 +70,12 @@
owner = "matrix-synapse";
group = "matrix-synapse";
};
matrix_db_password = {
file = ./secrets/matrix_db_password.age;
mode = "440";
owner = "matrix-synapse";
group = "matrix-synapse";
};
draupnir_access_token = {
file = ./secrets/draupnir_access_token.age;
mode = "440";
@ -100,6 +106,14 @@
modules = [
agenix.nixosModules.default
{ environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
{
age.secrets.hedgedoc_db_password = {
file = ./secrets/hedgedoc_db_password.age;
owner = "hedgedoc";
group = "hedgedoc";
mode = "0440";
};
}
./hosts/md
];
};

1
hosts/common.nix
View file

@ -128,3 +128,4 @@
};
};
}

2
hosts/md/default.nix
View file

@ -6,7 +6,7 @@
../../services/openssh.nix
./hedgedoc.nix
../../services/nginx.nix
./nginx
./nginx.nix
./postgres.nix
];

12
hosts/md/hedgedoc.nix
View file

@ -4,15 +4,11 @@
services.hedgedoc = {
enable = true;
settings = {
domain = "${config.networking.fqdn}";
#environmentFile = config.age.secrets.hedgedoc_settings.path;
domain = "md.${config.networking.domain}";
environmentFile = config.age.secrets.hedgedoc_db_password.path;
dbURL = "postgres://hedgedoc:\${DB_PASSWORD}@sql.berlin.ccc.de:5432/hedgedoc";
db.dialect = "postgresql";
protocolUseSSL = true;
db = {
dialect = "postgresql";
host = "/run/postgresql";
username = "hedgedoc";
database = "hedgedoc";
};
enableStatsApi = true;
};
};

21
hosts/md/nginx.nix
View file

@ -4,7 +4,7 @@ let
cfg = config.services.hedgedoc.settings;
in
{
nginx.virtualHosts."${config.networking.fqdn}" = {
services.nginx.virtualHosts."md.${config.networking.domain}" = {
default = true;
quic = true;
kTLS = true;
@ -14,6 +14,9 @@ in
"/" = {
proxyPass = "http://${cfg.host}:${toString cfg.port}";
recommendedProxySettings = true;
extraConfig = ''
#add_header Content-Security-Policy "frame-src 'self'; default-src 'self'; script-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; form-action 'self'; upgrade-insecure-requests;" always;
'';
};
"/socket.io/" = {
proxyPass = "http://${cfg.host}:${toString cfg.port}";
@ -23,16 +26,20 @@ in
"/metrics" = {
proxyPass = "http://${cfg.host}:${toString cfg.port}";
recommendedProxySettings = true;
#allow 195.160.173.255;
#allow 2001:678:760:cccb::ffff;
#deny all;
extraConfig = ''
allow 195.160.173.14;
allow 2001:678:760:cccb::14;
deny all;
'';
};
"/status" = {
proxyPass = "http://${cfg.host}:${toString cfg.port}";
recommendedProxySettings = true;
#allow 195.160.173.255;
#allow 2001:678:760:cccb::ffff;
#deny all;
extraConfig = ''
allow 195.160.173.14;
allow 2001:678:760:cccb::14;
deny all;
'';
};
};
};

23
hosts/md/postgres.nix
View file

@ -1,23 +0,0 @@
{ config, pkgs, ... }:
{
services = {
postgresql = {
enable = true;
package = pkgs.postgresql_18;
enableJIT = true;
initdbArgs = [
"--locale=C"
"--encoding=UTF8"
];
ensureUsers = [{ name = cfg.db.username; ensureDBOwnership = true; }];
ensureDatabases = [ cfg.db.database ];
};
postgresqlBackup = {
enable = true;
startAt = "*-*-* 09:00:00";
compression = "zstd";
};
};
}

5
hosts/sql/postgres.nix
View file

@ -58,6 +58,11 @@ in
ensureDatabases = map (e: e.database) entries;
authentication = "${builtins.concatStringsSep "\n" (map (e: e.auth) entries)}";
};
postgresqlBackup = {
enable = true;
startAt = "*-*-* 09:00:00";
compression = "zstd";
};
};
systemd.services.postgresql.postStart = ''
${config.services.postgresql.package}/bin/psql \

BIN
secrets/hedgedoc_db_password.age Normal file
View file

Binary file not shown.

13
secrets/secrets.nix
View file

@ -18,18 +18,27 @@ let
_md = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdFkdEEDXo8+k5YZpI1O2GqZlxcpCDtxqVun35duITm root@md";
_sql = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPcSXjDSyVVVdJbpheOhT0fIuOGFk+jsHhjrAVnBNLQV root@sql";
_www = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID4TJCMuJZn03soKuxxv6ywFKiXfhLf9Ab03fbMqNaBJ root@www";
_monitoring = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID4TJCMuJZn03soKuxxv6ywFKiXfhLf9Ab03fbMqNaBJ root@monitoring";
in
{
"matrix_admin_password.age".publicKeys = users;
"draupnir_access_token.age".publicKeys = users ++ [ _matrix ];
"matrix_signing_key.age".publicKeys = users ++ [ _matrix ];
"matrix_registration_shared_secret.age".publicKeys = users ++ [ _matrix ];
"matrix_db_password.age".publicKeys = users ++ [ _matrix ];
"pushover_app_token.age".publicKeys = users ++ [ _matrix ];
"pushover_user_key.age".publicKeys = users ++ [ _matrix ];
"grafana_admin_password.age".publicKeys = users ++ [ _matrix ];
"grafana_secret_key.age".publicKeys = users ++ [ _matrix ];
"hedgedoc_db_password.age".publicKeys = users ++ [ _md ];
"grafana_admin_password.age".publicKeys = users ++ [ _monitoring ];
"grafana_secret_key.age".publicKeys = users ++ [ _monitoring ];
"postgres-matrix-synapse.age".publicKeys = users ++ [ _sql _matrix ];
"postgres-hedgedoc.age".publicKeys = users ++ [ _sql _md ];
"www-staging-htpasswd.age".publicKeys = users ++ [ _www ];
}

4
services/postgres.nix
View file

@ -1,4 +1,4 @@
{ pkgs, ... }:
{ pkgs, lib, ... }:
{
services = {
@ -10,7 +10,7 @@
"--locale=C"
"--encoding=UTF8"
];
settings.listen_addresses = "*";
settings.listen_addresses = lib.mkDefault "*";
};
postgresqlBackup = {
enable = true;