mikl/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
174 commits 1 branch 0 tags 533 KiB
Commit graph

16 commits

Author SHA1 Message Date
mikl
56bb3d7f7c feat(mesh): add selected Telegram and OpenRouter egress policy 2026-08-03 08:41:57 +03:00
mikl
724948de7e feat(mesh): add Sol-style lilac client pool 2026-08-03 08:30:35 +03:00
mikl
9abae8d2f5 fix(mesh): create heather identity interface with systemd 2026-08-03 00:36:52 +03:00
mikl
55bb222eb5 fix(mesh): rotate hyacinth peer key 2026-08-03 00:34:10 +03:00
mikl
69bdc051f6 feat(mesh): add heather WireGuard backbone peer 2026-08-03 00:17:36 +03:00
mikl
87faa84104 heather: add pi-web service + Caddy vhost pi.iscg.dev with basicauth 
pi-web (agegr/pi-web, npm @agegr/pi-web) — web UI для pi coding agent.
systemd service на 127.0.0.1:30141, Caddy pi.iscg.dev терминирует TLS +
basicauth (bcrypt, пароль в pass iscg.dev/pi-web/auth).
nodejs в systemPackages; pi и pi-web ставятся в ~/.npm-global вручную.
 2026-07-13 13:21:34 +03:00
mikl
6e84e26d2d heather: xray VLESS+Reality proxy on :8443 
Add xray-core container (ghcr.io/xtls/xray-core) to arion compose.
VLESS + Reality + xtls-rprx-vision, masquerades as www.microsoft.com.
Config (UUID + Reality privateKey) at /var/lib/xray-secrets/config.json
(outside git, root:docker 0640). Public port 8443, not behind Caddy.
Secrets in pass iscg.dev/xray/. Client: v2RayTun / v2rayN.
 2026-07-13 03:05:48 +03:00
mikl
741a404ba8 heather: matrix tuwunel (homeserver) + cinny + tuwunel-admin 
- tuwunel arion container: ghcr.io/matrix-construct/tuwunel:v1.7.1,
  server_name=iscg.dev, allow_federation, registration via token.
  Media on Yandex Object Storage (S3) bucket iscg-tuwunel-media.
  Config (tuwunel.toml w/ s3 secret + reg token) bind-mounted from
  /var/lib/tuwunel-secrets/ (outside git, root:docker 0640).
- cinny arion container: ajbura/cinny:latest, config from
  /var/lib/tuwunel-secrets/cinny-config.json, default homeserver iscg.dev.
- tuwunel-admin systemd service: static x86_64 binary (no public docker
  image) at /var/lib/tuwunel-admin/tuwunel-admin, binds 127.0.0.1:8009.
  Caddy admin.iscg.dev terminates TLS.

Fresh install — no users/media migrated from old jul11.
 2026-07-13 02:01:59 +03:00
mikl
3d2f432619 heather: add coturn TURN relay for jitsi (clients behind symmetric NAT) 
- coturn/coturn:4.7 in host network (real client IPs, NAT traversal)
- static-auth-secret shared with jitsi-web TURN_CREDENTIALS (in jitsi.env)
- RTP relay 49152-65535/udp, listening-port 3478
- realm turn.iscg.dev, external-ip 51.250.45.111
- no-tls/no-dtls (TLS on 5349 disabled, udp-only for now)
- jitsi-web env: TURN_HOST/PORT/TRANSPORT
- NixOS firewall: 3478 tcp+udp, 49152-65535/udp range
- YC SG already has 3478/5349/49152-65535 from initial setup
 2026-07-13 01:19:55 +03:00
mikl
cd018a24c2 heather: install jitsi from scratch per official docs (minimal) 
Per https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker
and official docker-compose.yml. Minimal config, no copying from old install.

- 4 services: web/prosody/jicofo/jvb (stable-11031, docker hub)
- read_only + tmpfs per official compose
- Named volumes: jitsi-{web,prosody,prosody-data,jicofo,jvb,transcripts}
- Network meet-jitsi, prosody alias xmpp.meet.jitsi
- Reverse proxy: DISABLE_HTTPS=1, Caddy v2 auto-WebSocket (no manual header_up)
- JVB_ADVERTISE_IPS=51.250.45.111, :10000/udp public
- Auth: internal (ENABLE_AUTH=1, AUTH_TYPE=internal). NO GUESTS — template bug
  in prosody: guest domain lacks websocket module → disconnect loop
- Secrets NEW in /var/lib/jitsi-secrets/jitsi.env (root:docker 0640):
  JICOFO_COMPONENT_SECRET, JICOFO_AUTH_PASSWORD, JVB_AUTH_PASSWORD
- Firewall: 10000/udp (NixOS + YC SG)
 2026-07-13 00:56:13 +03:00
mikl
55cd7158a5 heather: fully remove jitsi (clean slate for fresh install) 
Removed jitsi from arion-compose.nix, caddy.nix, default.nix.
Wiped on heather: containers, volumes, images, secrets, LE cert.
Removed YC SG rule 10000/udp. Will reinstall from scratch following docs only.
 2026-07-13 00:28:59 +03:00
mikl
8709321ca3 heather: install jitsi meet from scratch (web/prosody/jicofo/jvb) 
Fresh install per https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker
- Images on GHCR: ghcr.io/jitsi/*:stable-11031
- Named volumes: jitsi-{web,prosody,jicofo,jvb,transcripts}
- Network meet-jitsi (bridge) with prosody alias xmpp.meet.jitsi
- Reverse proxy mode (DISABLE_HTTPS=1), Caddy terminates TLS
- Internal auth (ENABLE_AUTH=1, AUTH_TYPE=internal)
- JVB_ADVERTISE_IPS=51.250.45.111, :10000/udp public
- Secrets NEW in /var/lib/jitsi-secrets/jitsi.env (root:docker 0640):
  JICOFO_COMPONENT_SECRET, JICOFO_AUTH_PASSWORD, JVB_AUTH_PASSWORD
- Caddy vhost jitsi.iscg.dev with /xmpp-websocket + /colibri-ws upgrade routes
- Firewall: 10000/udp (jvb). Coturn not included (optional, add later for NAT)
- No jigasi/jibri/transcriber (minimal stack)
 2026-07-12 22:42:36 +03:00
mikl
fd605c51ce heather: remove jitsi stack (web/prosody/jicofo/jvb/coturn) 
Fully remove jitsi from arion-compose.nix, caddy.nix, default.nix.
Will be reinstalled from scratch.
 2026-07-12 22:35:03 +03:00
mikl
220d1f651c heather: replace k3s with docker+arion+caddy+syncthing 
- remove k3s.nix (1.3GB overhead unjustified for single-node)
- add docker.nix (docker + arion CLI, mikl in docker group)
- add caddy.nix (edge proxy, TLS via ACME staging, host-based routing)
- add syncthing.nix (sync daemon + strelaysrv via systemd, /srv/syncthing)
- add arion-compose.nix (forgejo first, others stubbed as TODO)
- add arion flake input + nixos module
- default.nix: wire up arion project as systemd service (serviceName=heather)

Architecture: Caddy (host) terminates TLS, routes to host services (syncthing)
and docker containers (arion, 127.0.0.1:PORT). Named volumes everywhere except
silverbullet (bind /srv/syncthing/herbarium).
 2026-07-12 12:23:05 +03:00
mikl
2cbca9a665 heather: add root rescue ssh key (mikl.keys) to avoid lockout 2026-07-11 22:57:29 +03:00
mikl
79260cec6f heather: switch to make-disk-image (qcow2 for YC), drop disko 
- Rename muscari -> heather (YC VM). rosemary reserved for future EU server.
- Add hosts/heather/image.nix: YC guest profile + qcow2 build target based on
  nixos/lib/make-disk-image.nix (the nixpkgs-standard cloud image builder).
  partitionTableType=legacy (MBR + single ext4 root, label nixos), GRUB in MBR
  on /dev/vda, virtio drivers, console=ttyS0, cloud-init (Ec2 datasource) so
  poppy ssh key auto-lands from YC metadata, growPartition.
- Drop disko flake input + disk-config.nix (was only for nixos-anywhere runtime
  install; replaced by make-disk-image build-time approach, no kexec).
- Add home/server.nix: minimal headless home for NixOS hosts (no ollama/
  texliveFull/kitty/syncthing/pass). flake mkNixos uses it instead of full ./home.
- k3s.nix: drop dead firewall block (firewall off in image.nix -> trustedInterfaces
  was a no-op). Cilium manages pod networking via BPF.
- image.baseName=heather, configurationLimit=1, remove virtio dups (qemu-guest
  profile already provides most).
- Fix sha256 pin on forgejo mikl.keys (was stale, would break fetchurl).
- home/zsh.nix: source yandex-cloud yc completion.
 2026-07-11 21:13:38 +03:00