From 741a404ba8d4f8414f88984044c50493e4c3b39d Mon Sep 17 00:00:00 2001 From: mikl Date: Mon, 13 Jul 2026 02:01:59 +0300 Subject: [PATCH] heather: matrix tuwunel (homeserver) + cinny + tuwunel-admin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - tuwunel arion container: ghcr.io/matrix-construct/tuwunel:v1.7.1, server_name=iscg.dev, allow_federation, registration via token. Media on Yandex Object Storage (S3) bucket iscg-tuwunel-media. Config (tuwunel.toml w/ s3 secret + reg token) bind-mounted from /var/lib/tuwunel-secrets/ (outside git, root:docker 0640). - cinny arion container: ajbura/cinny:latest, config from /var/lib/tuwunel-secrets/cinny-config.json, default homeserver iscg.dev. - tuwunel-admin systemd service: static x86_64 binary (no public docker image) at /var/lib/tuwunel-admin/tuwunel-admin, binds 127.0.0.1:8009. Caddy admin.iscg.dev terminates TLS. Fresh install — no users/media migrated from old jul11. --- hosts/heather/arion-compose.nix | 57 ++++++++++++++++++--------------- hosts/heather/default.nix | 1 + hosts/heather/tuwunel-admin.nix | 34 ++++++++++++++++++++ 3 files changed, 67 insertions(+), 25 deletions(-) create mode 100644 hosts/heather/tuwunel-admin.nix diff --git a/hosts/heather/arion-compose.nix b/hosts/heather/arion-compose.nix index bbced41..7ce3bd9 100644 --- a/hosts/heather/arion-compose.nix +++ b/hosts/heather/arion-compose.nix @@ -66,31 +66,38 @@ }; }; - # === Matrix tuwunel + admin + cinny (iscg.dev, admin/chat.iscg.dev) === - # Добавить после forgejo. Crashloop на jul11 — нужно разобраться с - # конфигом/секретами до миграции. См. migration-inventory.md. - # - # tuwunel = { - # service.image = "ghcr.io/matrix-construct/tuwunel:v1.7.1"; - # service.container_name = "tuwunel"; - # service.restart = "unless-stopped"; - # service.volumes = [ - # "tuwunel-data:/data" - # "tuwunel-media-cache:/media-cache" - # ]; - # service.ports = [ "127.0.0.1:8008:8008" ]; - # # TODO: env vars, secrets (server_name, registration_shared_secret, ...) - # }; - - # cinny = { - # service.image = "ajbura/cinny:latest"; - # service.container_name = "cinny"; - # service.restart = "unless-stopped"; - # service.ports = [ "127.0.0.1:8080:80" ]; - # }; - - # tuwunel-admin был systemd на jul11 (knadh/tuwunel-admin). Если контейнер - # существует — добавить сюда, иначе оставить как NixOS-сервис или выкинуть. + # === Matrix tuwunel (homeserver) + cinny (web client) === + # iscg.dev → tuwunel:8008 (matrix client API + federation + well-known). + # chat.iscg.dev → cinny:80. admin.iscg.dev → tuwunel-admin (systemd, не контейнер, + # см. tuwunel-admin.nix — бинарник статический, публичного docker-образа нет). + # Поднято с нуля 2026-07-13: пользователей/медиа со старого jul11 НЕ переносим. + # Медиа — на Yandex Object Storage (S3-совместимый), bucket iscg-tuwunel-media. + # Конфиг tuwunel.toml (с s3 secret + registration token) вне git: + # /var/lib/tuwunel-secrets/tuwunel.toml (root:docker 0640, bind-mount ro) + # Cinny config: /var/lib/tuwunel-secrets/cinny-config.json (bind-mount ro). + tuwunel = { + service.image = "ghcr.io/matrix-construct/tuwunel:v1.7.1"; + service.container_name = "tuwunel"; + service.restart = "unless-stopped"; + service.volumes = [ + "tuwunel-data:/var/lib/tuwunel" + "tuwunel-media-cache:/var/cache/tuwunel" + "/var/lib/tuwunel-secrets/tuwunel.toml:/etc/tuwunel/tuwunel.toml:ro" + ]; + service.ports = [ "127.0.0.1:8008:8008" ]; + service.environment = { + TUWUNEL_CONFIG = "/etc/tuwunel/tuwunel.toml"; + }; + }; + cinny = { + service.image = "ajbura/cinny:latest"; + service.container_name = "cinny"; + service.restart = "unless-stopped"; + service.volumes = [ + "/var/lib/tuwunel-secrets/cinny-config.json:/app/config.json:ro" + ]; + service.ports = [ "127.0.0.1:8080:80" ]; + }; # === Teable (teable.iscg.dev) === # Стек: app + postgres + redis. Данные перенесены с iscg-dev (2026-07-12): diff --git a/hosts/heather/default.nix b/hosts/heather/default.nix index 0f12bf2..1d98f83 100644 --- a/hosts/heather/default.nix +++ b/hosts/heather/default.nix @@ -19,6 +19,7 @@ ./docker.nix # docker + arion CLI (контейнеры) ./caddy.nix # edge proxy, TLS, роутинг по доменам ./syncthing.nix # sync + relay + ./tuwunel-admin.nix # matrix admin web UI (systemd, статический бинарник) ]; # Arion-проект как systemd-сервис: arion-compose.nix → docker-compose → up. diff --git a/hosts/heather/tuwunel-admin.nix b/hosts/heather/tuwunel-admin.nix new file mode 100644 index 0000000..3bec457 --- /dev/null +++ b/hosts/heather/tuwunel-admin.nix @@ -0,0 +1,34 @@ +# heather — tuwunel-admin (web admin UI for tuwunel Matrix homeserver). +# +# https://github.com/matrix-construct/tuwunel-admin (приватный репо/сборка). +# Публичного docker-образа НЕТ — это статический x86_64 бинарник, собранный +# вручную (v0.0.0). Бинарник лежит вне nix-store: /var/lib/tuwunel-admin/tuwunel-admin +# (скопирован с iscg-dev-jul11 2026-07-13). При пересоздании heather с нуля — +# перескопировать с jul11 (или заново собрать из исходников). +# +# Логинится matrix-пользователем на homeserver https://iscg.dev (см. [matrix] +# в config.toml). Чтобы UI мог выполнять admin-команды, залогиненный юзер +# должен быть server admin tuwunel (`users make-admin` через --execute). +# +# Слушает 127.0.0.1:8009 → Caddy admin.iscg.dev терминирует TLS (см. caddy.nix). +# Конфиг: /var/lib/tuwunel-admin/config.toml (вне git, root:root 0644). + +{ config, pkgs, lib, ... }: +{ + systemd.services.tuwunel-admin = { + description = "tuwunel-admin (Matrix admin web UI)"; + after = [ "network-online.target" ]; + wants = [ "network-online.target" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + Type = "simple"; + ExecStart = "/var/lib/tuwunel-admin/tuwunel-admin --config /var/lib/tuwunel-admin/config.toml"; + WorkingDirectory = "/var/lib/tuwunel-admin"; + Restart = "on-failure"; + RestartSec = 5; + # Бинарник статический, рут-запуск ок (биндит 127.0.0.1:8009). + User = "root"; + Environment = [ "HOME=/var/lib/tuwunel-admin" ]; + }; + }; +}