mikl/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
159 commits 1 branch 0 tags 533 KiB
Commit graph

11 commits

Author SHA1 Message Date
mikl
87faa84104 heather: add pi-web service + Caddy vhost pi.iscg.dev with basicauth 
pi-web (agegr/pi-web, npm @agegr/pi-web) — web UI для pi coding agent.
systemd service на 127.0.0.1:30141, Caddy pi.iscg.dev терминирует TLS +
basicauth (bcrypt, пароль в pass iscg.dev/pi-web/auth).
nodejs в systemPackages; pi и pi-web ставятся в ~/.npm-global вручную.
 2026-07-13 13:21:34 +03:00
mikl
fe5c01062e heather: add homepage dashboard (home.iscg.dev) 
gethomepage/homepage container with all heather services listed:
forgejo, syncthing, tuwunel-admin, tuwunel, cinny, jitsi,
silverbullet, teable. Configs baked via pkgs.writeText (ro bind mount).
Caddy vhost home.iscg.dev -> 127.0.0.1:3002.
 2026-07-13 03:04:42 +03:00
mikl
cd018a24c2 heather: install jitsi from scratch per official docs (minimal) 
Per https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker
and official docker-compose.yml. Minimal config, no copying from old install.

- 4 services: web/prosody/jicofo/jvb (stable-11031, docker hub)
- read_only + tmpfs per official compose
- Named volumes: jitsi-{web,prosody,prosody-data,jicofo,jvb,transcripts}
- Network meet-jitsi, prosody alias xmpp.meet.jitsi
- Reverse proxy: DISABLE_HTTPS=1, Caddy v2 auto-WebSocket (no manual header_up)
- JVB_ADVERTISE_IPS=51.250.45.111, :10000/udp public
- Auth: internal (ENABLE_AUTH=1, AUTH_TYPE=internal). NO GUESTS — template bug
  in prosody: guest domain lacks websocket module → disconnect loop
- Secrets NEW in /var/lib/jitsi-secrets/jitsi.env (root:docker 0640):
  JICOFO_COMPONENT_SECRET, JICOFO_AUTH_PASSWORD, JVB_AUTH_PASSWORD
- Firewall: 10000/udp (NixOS + YC SG)
 2026-07-13 00:56:13 +03:00
mikl
55cd7158a5 heather: fully remove jitsi (clean slate for fresh install) 
Removed jitsi from arion-compose.nix, caddy.nix, default.nix.
Wiped on heather: containers, volumes, images, secrets, LE cert.
Removed YC SG rule 10000/udp. Will reinstall from scratch following docs only.
 2026-07-13 00:28:59 +03:00
mikl
8709321ca3 heather: install jitsi meet from scratch (web/prosody/jicofo/jvb) 
Fresh install per https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker
- Images on GHCR: ghcr.io/jitsi/*:stable-11031
- Named volumes: jitsi-{web,prosody,jicofo,jvb,transcripts}
- Network meet-jitsi (bridge) with prosody alias xmpp.meet.jitsi
- Reverse proxy mode (DISABLE_HTTPS=1), Caddy terminates TLS
- Internal auth (ENABLE_AUTH=1, AUTH_TYPE=internal)
- JVB_ADVERTISE_IPS=51.250.45.111, :10000/udp public
- Secrets NEW in /var/lib/jitsi-secrets/jitsi.env (root:docker 0640):
  JICOFO_COMPONENT_SECRET, JICOFO_AUTH_PASSWORD, JVB_AUTH_PASSWORD
- Caddy vhost jitsi.iscg.dev with /xmpp-websocket + /colibri-ws upgrade routes
- Firewall: 10000/udp (jvb). Coturn not included (optional, add later for NAT)
- No jigasi/jibri/transcriber (minimal stack)
 2026-07-12 22:42:36 +03:00
mikl
fd605c51ce heather: remove jitsi stack (web/prosody/jicofo/jvb/coturn) 
Fully remove jitsi from arion-compose.nix, caddy.nix, default.nix.
Will be reinstalled from scratch.
 2026-07-12 22:35:03 +03:00
mikl
ee8ce3f99f heather: enable jitsi meet stack (jitsi.iscg.dev) 
Стек: web + prosody + jicofo + jvb + coturn. Перенесено с jul11 (2026-07-12):
- config (web/prosody/jicofo/jvb) → named volumes heather_jitsi-{web,prosody,jicofo,jvb,transcripts}
- prosody user mikl.dat сохранён (internal auth)
- образ PIN: stable-11031 (как на jul11, НЕ :latest)
- пароли (jicofo/jvb/jigasi/jibri/turn) НОВЫЕ, в pass iscg.dev/jitsi/
- env-файл /var/lib/jitsi-secrets/jitsi.env (root:docker 0640)
- coturn в host network (real client IPs), realm=turn.iscg.dev
- JVB 10000/udp публично (YC SG уже ANY ANY open)
- Caddy: WebSocket routes /xmpp-websocket, /colibri-ws (hop-by-hop upgrade)
- DISABLE_HTTPS=1 (Caddy терминирует TLS)
 2026-07-12 21:56:37 +03:00
mikl
e99b6e1c28 heather: fix syncthing host-check error behind Caddy reverse proxy 
Syncthing отдаёт 403 'Host check error' когда Host header не совпадает с
адресом прослушивания (127.0.0.1:8384) — это DNS rebinding protection.
Caddy подменяет Host на бэкенде через header_up Host 127.0.0.1:8384.
 2026-07-12 18:19:22 +03:00
mikl
483454bf17 heather: rotate sync.iscg.dev basicauth password 
Старый хеш был скопирован с iscg-dev, пароль неизвестен. Новый пароль
в mindful-стиле. Сгенерирован через caddy hash-password (bcrypt cost 14).
 2026-07-12 18:05:22 +03:00
mikl
4eb5a1e61c heather: switch caddy to production ACME (DNS moved to heather) 2026-07-12 13:21:25 +03:00
mikl
220d1f651c heather: replace k3s with docker+arion+caddy+syncthing 
- remove k3s.nix (1.3GB overhead unjustified for single-node)
- add docker.nix (docker + arion CLI, mikl in docker group)
- add caddy.nix (edge proxy, TLS via ACME staging, host-based routing)
- add syncthing.nix (sync daemon + strelaysrv via systemd, /srv/syncthing)
- add arion-compose.nix (forgejo first, others stubbed as TODO)
- add arion flake input + nixos module
- default.nix: wire up arion project as systemd service (serviceName=heather)

Architecture: Caddy (host) terminates TLS, routes to host services (syncthing)
and docker containers (arion, 127.0.0.1:PORT). Named volumes everywhere except
silverbullet (bind /srv/syncthing/herbarium).
 2026-07-12 12:23:05 +03:00