mikl/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

heather: matrix tuwunel (homeserver) + cinny + tuwunel-admin

Browse source 
- tuwunel arion container: ghcr.io/matrix-construct/tuwunel:v1.7.1,
  server_name=iscg.dev, allow_federation, registration via token.
  Media on Yandex Object Storage (S3) bucket iscg-tuwunel-media.
  Config (tuwunel.toml w/ s3 secret + reg token) bind-mounted from
  /var/lib/tuwunel-secrets/ (outside git, root:docker 0640).
- cinny arion container: ajbura/cinny:latest, config from
  /var/lib/tuwunel-secrets/cinny-config.json, default homeserver iscg.dev.
- tuwunel-admin systemd service: static x86_64 binary (no public docker
  image) at /var/lib/tuwunel-admin/tuwunel-admin, binds 127.0.0.1:8009.
  Caddy admin.iscg.dev terminates TLS.

Fresh install — no users/media migrated from old jul11.
This commit is contained in:
mikl 2026-07-13 02:01:59 +03:00
commit 741a404ba8
3 changed files with 67 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

57
hosts/heather/arion-compose.nix
View file

@ -66,31 +66,38 @@
};
};
# === Matrix tuwunel + admin + cinny (iscg.dev, admin/chat.iscg.dev) ===
# Добавить после forgejo. Crashloop на jul11 — нужно разобраться с
# конфигом/секретами до миграции. См. migration-inventory.md.
#
# tuwunel = {
# service.image = "ghcr.io/matrix-construct/tuwunel:v1.7.1";
# service.container_name = "tuwunel";
# service.restart = "unless-stopped";
# service.volumes = [
# "tuwunel-data:/data"
# "tuwunel-media-cache:/media-cache"
# ];
# service.ports = [ "127.0.0.1:8008:8008" ];
# # TODO: env vars, secrets (server_name, registration_shared_secret, ...)
# };
# cinny = {
# service.image = "ajbura/cinny:latest";
# service.container_name = "cinny";
# service.restart = "unless-stopped";
# service.ports = [ "127.0.0.1:8080:80" ];
# };
# tuwunel-admin был systemd на jul11 (knadh/tuwunel-admin). Если контейнер
# существует — добавить сюда, иначе оставить как NixOS-сервис или выкинуть.
# === Matrix tuwunel (homeserver) + cinny (web client) ===
# iscg.dev → tuwunel:8008 (matrix client API + federation + well-known).
# chat.iscg.dev → cinny:80. admin.iscg.dev → tuwunel-admin (systemd, не контейнер,
# см. tuwunel-admin.nix — бинарник статический, публичного docker-образа нет).
# Поднято с нуля 2026-07-13: пользователей/медиа со старого jul11 НЕ переносим.
# Медиа — на Yandex Object Storage (S3-совместимый), bucket iscg-tuwunel-media.
# Конфиг tuwunel.toml (с s3 secret + registration token) вне git:
# /var/lib/tuwunel-secrets/tuwunel.toml (root:docker 0640, bind-mount ro)
# Cinny config: /var/lib/tuwunel-secrets/cinny-config.json (bind-mount ro).
tuwunel = {
service.image = "ghcr.io/matrix-construct/tuwunel:v1.7.1";
service.container_name = "tuwunel";
service.restart = "unless-stopped";
service.volumes = [
"tuwunel-data:/var/lib/tuwunel"
"tuwunel-media-cache:/var/cache/tuwunel"
"/var/lib/tuwunel-secrets/tuwunel.toml:/etc/tuwunel/tuwunel.toml:ro"
];
service.ports = [ "127.0.0.1:8008:8008" ];
service.environment = {
TUWUNEL_CONFIG = "/etc/tuwunel/tuwunel.toml";
};
};
cinny = {
service.image = "ajbura/cinny:latest";
service.container_name = "cinny";
service.restart = "unless-stopped";
service.volumes = [
"/var/lib/tuwunel-secrets/cinny-config.json:/app/config.json:ro"
];
service.ports = [ "127.0.0.1:8080:80" ];
};
# === Teable (teable.iscg.dev) ===
# Стек: app + postgres + redis. Данные перенесены с iscg-dev (2026-07-12):