mikl/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
148 commits 1 branch 0 tags 533 KiB
Commit graph

28 commits

Author SHA1 Message Date
mikl
78c39d6f5d heather: homepage teable icon -> local /images/teable.png (420px GH avatar) 
teable has no dashboard-icons entry and favicon is 16x16 .ico. Use the
teableio GitHub avatar (420x420 png) placed in /var/lib/homepage-images/.
Next.js caches static file list at container start, so adding images
requires docker restart homepage.
 2026-07-13 03:44:26 +03:00
mikl
fca00e1368 heather: homepage live container status via docker-socket-proxy 
tecnativa/docker-socket-proxy (read-only, CONTAINERS=1, POST=0) exposes
docker API to homepage over compose network. Per-service server/container
in services.yaml → green dot status. statusStyle: dot. Syncthing and
tuwunel-admin are systemd, no container status.
 2026-07-13 03:34:58 +03:00
mikl
c070b2a972 heather: homepage fixes - bookmark href format, jitsi-meet icon, teable favicon 
bookmarks.yaml needs href: key (was bare URL → new URL() crash).
jitsi.png -> jitsi-meet.png (proper brand icon in dashboard-icons).
teable has no dashboard-icons entry -> use teable.iscg.dev/favicon.ico.
 2026-07-13 03:32:32 +03:00
mikl
1ccc59dd8d heather: homepage background image + frosted cardBlur 
Background photo (mounted ro from /var/lib/homepage-images into
/app/public/images). cardBlur: md for matte semi-transparent service
cards. opacity 70 to soften the photo.
 2026-07-13 03:20:29 +03:00
mikl
190c93156e heather: xray - override command to -config (image default is -confdir) 2026-07-13 03:15:26 +03:00
mikl
d3d132e225 heather: set HOMEPAGE_ALLOWED_HOSTS for host validation 2026-07-13 03:09:18 +03:00
mikl
fe5c01062e heather: add homepage dashboard (home.iscg.dev) 
gethomepage/homepage container with all heather services listed:
forgejo, syncthing, tuwunel-admin, tuwunel, cinny, jitsi,
silverbullet, teable. Configs baked via pkgs.writeText (ro bind mount).
Caddy vhost home.iscg.dev -> 127.0.0.1:3002.
 2026-07-13 03:04:42 +03:00
mikl
741a404ba8 heather: matrix tuwunel (homeserver) + cinny + tuwunel-admin 
- tuwunel arion container: ghcr.io/matrix-construct/tuwunel:v1.7.1,
  server_name=iscg.dev, allow_federation, registration via token.
  Media on Yandex Object Storage (S3) bucket iscg-tuwunel-media.
  Config (tuwunel.toml w/ s3 secret + reg token) bind-mounted from
  /var/lib/tuwunel-secrets/ (outside git, root:docker 0640).
- cinny arion container: ajbura/cinny:latest, config from
  /var/lib/tuwunel-secrets/cinny-config.json, default homeserver iscg.dev.
- tuwunel-admin systemd service: static x86_64 binary (no public docker
  image) at /var/lib/tuwunel-admin/tuwunel-admin, binds 127.0.0.1:8009.
  Caddy admin.iscg.dev terminates TLS.

Fresh install — no users/media migrated from old jul11.
 2026-07-13 02:01:59 +03:00
mikl
61e71b3ee4 heather: enable jitsi guest access (lobby) + patch prosody guest websocket 
- ENABLE_GUESTS=1 in web/prosody/jicofo: unauthenticated users join via
  guest.meet.jitsi domain, wait in lobby until moderator (mikl) admits
- Patched prosody template mounted at /defaults/conf.d/jitsi-meet.cfg.lua:
  adds 'websocket' module to guest VirtualHost (upstream bug — guest domain
  only had 'smacks', no 'websocket' → wss disconnect loop)
- Template at /var/lib/jitsi-secrets/jitsi-meet.cfg.lua.template (root:root 0644)
- Fixes: mobile/anonymous users couldn't join, got disconnect loop
 2026-07-13 01:37:20 +03:00
mikl
3d2f432619 heather: add coturn TURN relay for jitsi (clients behind symmetric NAT) 
- coturn/coturn:4.7 in host network (real client IPs, NAT traversal)
- static-auth-secret shared with jitsi-web TURN_CREDENTIALS (in jitsi.env)
- RTP relay 49152-65535/udp, listening-port 3478
- realm turn.iscg.dev, external-ip 51.250.45.111
- no-tls/no-dtls (TLS on 5349 disabled, udp-only for now)
- jitsi-web env: TURN_HOST/PORT/TRANSPORT
- NixOS firewall: 3478 tcp+udp, 49152-65535/udp range
- YC SG already has 3478/5349/49152-65535 from initial setup
 2026-07-13 01:19:55 +03:00
mikl
897ea4bed2 heather: jitsi-jvb add network alias 'jvb' (nginx colibri-ws proxy needs it) 
nginx template in jitsi-web hardcodes proxy_pass http://jvb:9090 for
/colibri-ws/jvb/* but service is named jitsi-jvb → DNS NXDOMAIN → 502.
Official compose names service 'jvb'; arion service key is jitsi-jvb so
add network alias 'jvb' to fix bridge channel.
 2026-07-13 01:12:30 +03:00
mikl
6c536852ad heather: jitsi drop read_only/tmpfs (arion schema doesn't support them) 2026-07-13 00:57:36 +03:00
mikl
cd018a24c2 heather: install jitsi from scratch per official docs (minimal) 
Per https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker
and official docker-compose.yml. Minimal config, no copying from old install.

- 4 services: web/prosody/jicofo/jvb (stable-11031, docker hub)
- read_only + tmpfs per official compose
- Named volumes: jitsi-{web,prosody,prosody-data,jicofo,jvb,transcripts}
- Network meet-jitsi, prosody alias xmpp.meet.jitsi
- Reverse proxy: DISABLE_HTTPS=1, Caddy v2 auto-WebSocket (no manual header_up)
- JVB_ADVERTISE_IPS=51.250.45.111, :10000/udp public
- Auth: internal (ENABLE_AUTH=1, AUTH_TYPE=internal). NO GUESTS — template bug
  in prosody: guest domain lacks websocket module → disconnect loop
- Secrets NEW in /var/lib/jitsi-secrets/jitsi.env (root:docker 0640):
  JICOFO_COMPONENT_SECRET, JICOFO_AUTH_PASSWORD, JVB_AUTH_PASSWORD
- Firewall: 10000/udp (NixOS + YC SG)
 2026-07-13 00:56:13 +03:00
mikl
55cd7158a5 heather: fully remove jitsi (clean slate for fresh install) 
Removed jitsi from arion-compose.nix, caddy.nix, default.nix.
Wiped on heather: containers, volumes, images, secrets, LE cert.
Removed YC SG rule 10000/udp. Will reinstall from scratch following docs only.
 2026-07-13 00:28:59 +03:00
mikl
3b354c9ccc heather: jitsi-web drop crontabs volume mount (perms conflict with /config) 
Same named volume on /config and /var/spool/cron/crontabs inherited 1730
drwx-wx--T from crontabs dir — nginx (www-data) couldn't traverse /config,
Permission denied on config.js. Crontabs not needed; transcripts stay separate.
 2026-07-12 23:15:08 +03:00
mikl
37654cc825 heather: jitsi images via docker hub (ghcr.io/jitsi/* not found, private) 
env.example claims JITSI_IMAGE_REPO=ghcr.io/jitsi default but actual images
not found there (denied). docker.io/jitsi/*:stable-11031 works.
 2026-07-12 22:45:58 +03:00
mikl
8709321ca3 heather: install jitsi meet from scratch (web/prosody/jicofo/jvb) 
Fresh install per https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker
- Images on GHCR: ghcr.io/jitsi/*:stable-11031
- Named volumes: jitsi-{web,prosody,jicofo,jvb,transcripts}
- Network meet-jitsi (bridge) with prosody alias xmpp.meet.jitsi
- Reverse proxy mode (DISABLE_HTTPS=1), Caddy terminates TLS
- Internal auth (ENABLE_AUTH=1, AUTH_TYPE=internal)
- JVB_ADVERTISE_IPS=51.250.45.111, :10000/udp public
- Secrets NEW in /var/lib/jitsi-secrets/jitsi.env (root:docker 0640):
  JICOFO_COMPONENT_SECRET, JICOFO_AUTH_PASSWORD, JVB_AUTH_PASSWORD
- Caddy vhost jitsi.iscg.dev with /xmpp-websocket + /colibri-ws upgrade routes
- Firewall: 10000/udp (jvb). Coturn not included (optional, add later for NAT)
- No jigasi/jibri/transcriber (minimal stack)
 2026-07-12 22:42:36 +03:00
mikl
fd605c51ce heather: remove jitsi stack (web/prosody/jicofo/jvb/coturn) 
Fully remove jitsi from arion-compose.nix, caddy.nix, default.nix.
Will be reinstalled from scratch.
 2026-07-12 22:35:03 +03:00
mikl
57f2fe314b heather: jitsi — fix networks to top-level + meet-jitsi (no dots) 2026-07-12 22:12:33 +03:00
mikl
2d37b744e6 heather: jitsi — networks is top-level option (not docker-compose.networks) 
Arion: `networks` — top-level опция как `services`, не внутри docker-compose.
service.networks принимает listOf str или attrsOf с aliases. meet.jitsi → meet-jitsi
(имя без точки, docker-compose требование к network names).
 2026-07-12 22:08:34 +03:00
mikl
b697744a46 heather: jitsi — add meet.jitsi network with prosody alias xmpp.meet.jitsi 
Jicofo/jvb/web ищут prosody по FQDN xmpp.meet.jitsi (default docker-jitsi).
Custom bridge network даёт prosody DNS alias. Coturn в host network — вне.
 2026-07-12 22:01:19 +03:00
mikl
ee8ce3f99f heather: enable jitsi meet stack (jitsi.iscg.dev) 
Стек: web + prosody + jicofo + jvb + coturn. Перенесено с jul11 (2026-07-12):
- config (web/prosody/jicofo/jvb) → named volumes heather_jitsi-{web,prosody,jicofo,jvb,transcripts}
- prosody user mikl.dat сохранён (internal auth)
- образ PIN: stable-11031 (как на jul11, НЕ :latest)
- пароли (jicofo/jvb/jigasi/jibri/turn) НОВЫЕ, в pass iscg.dev/jitsi/
- env-файл /var/lib/jitsi-secrets/jitsi.env (root:docker 0640)
- coturn в host network (real client IPs), realm=turn.iscg.dev
- JVB 10000/udp публично (YC SG уже ANY ANY open)
- Caddy: WebSocket routes /xmpp-websocket, /colibri-ws (hop-by-hop upgrade)
- DISABLE_HTTPS=1 (Caddy терминирует TLS)
 2026-07-12 21:56:37 +03:00
mikl
cc6ef61d0a heather: pin teable to working image digest, revert port to 3000 
:latest (release 2198, 2026-07-11) сломал роутинг: Next.js отдаёт 404
на / и /health, assets под /plugin/. Пиним digest из iscg-dev (март 2026)
где / → 307 → /space работает. Старый образ слушает 3000 (не 3002).
 2026-07-12 20:46:53 +03:00
mikl
c079adba66 heather: teable listens on 3002, fix port mapping 2026-07-12 20:16:22 +03:00
mikl
3e3241683f heather: enable teable stack (teable.iscg.dev) 
app + postgres:15 + redis. Данные перенесены с iscg-dev (2026-07-12):
- postgres восстановлен из pg_dump (18M) с новым паролем
- .assets (3.2G, 4392 файлов) в named volume heather_teable-assets
- teable-data, redis пустые (наполнятся при старте)

Секреты (POSTGRES_PASSWORD, SECRET_KEY, PRISMA_DATABASE_URL) новые,
в pass iscg.dev/teable/. env-файл /var/lib/teable-secrets/teable.env
на heather (вне git, root:docker 0640).
 2026-07-12 20:09:15 +03:00
mikl
260a6c64bf heather: enable silverbullet (note.iscg.dev) 
Bind mount /srv/syncthing/herbarium → /space. Данные перенесены с iscg-dev
(564K, 41 файл). Auth-файл .silverbullet.auth.json в составе данных.
SB_USER/SB_INDEX_PAGE из старого compose на iscg-dev.
 2026-07-12 18:51:11 +03:00
mikl
ebf74814bf heather: fix arion volumes declaration + syncthing configDir perms 
- arion-compose: project.name (required) + docker-compose.volumes (correct
  option, was docker-compose.raw.volumes which didn't exist)
- syncthing: tmpfiles for /var/lib/syncthing (configDir) owned by mikl,
  fixes 'mkdir /var/lib/syncthing: permission denied' when running as non-default user
 2026-07-12 12:39:26 +03:00
mikl
220d1f651c heather: replace k3s with docker+arion+caddy+syncthing 
- remove k3s.nix (1.3GB overhead unjustified for single-node)
- add docker.nix (docker + arion CLI, mikl in docker group)
- add caddy.nix (edge proxy, TLS via ACME staging, host-based routing)
- add syncthing.nix (sync daemon + strelaysrv via systemd, /srv/syncthing)
- add arion-compose.nix (forgejo first, others stubbed as TODO)
- add arion flake input + nixos module
- default.nix: wire up arion project as systemd service (serviceName=heather)

Architecture: Caddy (host) terminates TLS, routes to host services (syncthing)
and docker containers (arion, 127.0.0.1:PORT). Named volumes everywhere except
silverbullet (bind /srv/syncthing/herbarium).
 2026-07-12 12:23:05 +03:00