mikl
8709321ca3
Fresh install per https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker - Images on GHCR: ghcr.io/jitsi/*:stable-11031 - Named volumes: jitsi-{web,prosody,jicofo,jvb,transcripts} - Network meet-jitsi (bridge) with prosody alias xmpp.meet.jitsi - Reverse proxy mode (DISABLE_HTTPS=1), Caddy terminates TLS - Internal auth (ENABLE_AUTH=1, AUTH_TYPE=internal) - JVB_ADVERTISE_IPS=51.250.45.111, :10000/udp public - Secrets NEW in /var/lib/jitsi-secrets/jitsi.env (root:docker 0640): JICOFO_COMPONENT_SECRET, JICOFO_AUTH_PASSWORD, JVB_AUTH_PASSWORD - Caddy vhost jitsi.iscg.dev with /xmpp-websocket + /colibri-ws upgrade routes - Firewall: 10000/udp (jvb). Coturn not included (optional, add later for NAT) - No jigasi/jibri/transcriber (minimal stack)
300 lines
14 KiB
Nix
300 lines
14 KiB
Nix
# heather — Arion compose (nix-native docker-compose).
|
||
#
|
||
# Все web-apps в docker-контейнерах, описаны декларативно в nix.
|
||
# Запускается как systemd-сервис через virtualisation.arion.projects.heather.
|
||
#
|
||
# Порты проброшены на localhost (127.0.0.1:PORT) — Caddy на хосте терминирует
|
||
# TLS и роутит по Host (см. caddy.nix). Контейнеры НЕ выставлены наружу
|
||
# напрямую (кроме forgejo git ssh на :2222).
|
||
#
|
||
# Data: named volumes везде, кроме silverbullet (bind mount на syncthing
|
||
# sync'аемую папку /srv/syncthing/herbarium — исключение, см. комментарии).
|
||
#
|
||
# Backup: offen/docker-volume-backup как sidecar, nightly tar.gz всех named
|
||
# volumes → /var/backups (добавим последним).
|
||
#
|
||
# Порядок миграции: forgejo → tuwunel+admin → cinny → teable →
|
||
# silverbullet. Ниже forgejo как первый proof-of-concept, остальные добавим
|
||
# по мере миграции (секции заготовлены, закомментированы до теста).
|
||
|
||
{ pkgs, ... }:
|
||
|
||
{
|
||
# Обязательное имя проекта (COMPOSE_PROJECT_NAME). Объекты префиксуются им:
|
||
# heather_forgejo-data и т.д.
|
||
project.name = "heather";
|
||
|
||
# --- Named volumes (декларируем явно, никаких анонимных хэшей) ---
|
||
# docker volume create <name> при первом up. Видно в `docker volume ls`.
|
||
docker-compose.volumes = {
|
||
forgejo-data = {};
|
||
tuwunel-data = {};
|
||
tuwunel-media-cache = {};
|
||
teable-data = {};
|
||
teable-db = {};
|
||
teable-redis = {};
|
||
teable-assets = {};
|
||
# jitsi-стек (4 сервиса: web/prosody/jicofo/jvb). Coturn НЕ входит в
|
||
# официальный compose — добавляется опционально для NAT traversal (пока без него).
|
||
# Образы на GHCR (https://github.com/jitsi/docker-jitsi-meet, release stable-11031).
|
||
jitsi-web = {};
|
||
jitsi-prosody = {};
|
||
jitsi-jicofo = {};
|
||
jitsi-jvb = {};
|
||
jitsi-transcripts = {};
|
||
};
|
||
|
||
# --- Custom network для jitsi с DNS aliases ---
|
||
# Контейнеры jitsi общаются по FQDN (xmpp.meet.jitsi). Alias задан в
|
||
# service.networks у prosody. `networks` — top-level опция arion (как
|
||
# `services`), не в docker-compose. Имя без точки (docker-compose constraint).
|
||
networks.meet-jitsi.driver = "bridge";
|
||
services = {
|
||
# === Forgejo (git.iscg.dev) ===
|
||
# Первый сервис, proof-of-concept для цепочки arion→docker→Caddy.
|
||
forgejo = {
|
||
service.image = "codeberg.org/forgejo/forgejo:9";
|
||
service.container_name = "forgejo";
|
||
service.restart = "unless-stopped";
|
||
service.volumes = [ "forgejo-data:/data" ];
|
||
service.ports = [
|
||
"127.0.0.1:3030:3000" # web → Caddy git.iscg.dev
|
||
"2222:22" # git ssh (публично, как на jul11)
|
||
];
|
||
service.environment = {
|
||
# Домен для клонов: ssh://git@git.iscg.dev:2222/...
|
||
FORGEJO__server__DOMAIN = "git.iscg.dev";
|
||
FORGEJO__server__ROOT_URL = "https://git.iscg.dev/";
|
||
FORGEJO__server__SSH_DOMAIN = "git.iscg.dev";
|
||
FORGEJO__server__SSH_PORT = "2222";
|
||
};
|
||
};
|
||
|
||
# === Matrix tuwunel + admin + cinny (iscg.dev, admin/chat.iscg.dev) ===
|
||
# Добавить после forgejo. Crashloop на jul11 — нужно разобраться с
|
||
# конфигом/секретами до миграции. См. migration-inventory.md.
|
||
#
|
||
# tuwunel = {
|
||
# service.image = "ghcr.io/matrix-construct/tuwunel:v1.7.1";
|
||
# service.container_name = "tuwunel";
|
||
# service.restart = "unless-stopped";
|
||
# service.volumes = [
|
||
# "tuwunel-data:/data"
|
||
# "tuwunel-media-cache:/media-cache"
|
||
# ];
|
||
# service.ports = [ "127.0.0.1:8008:8008" ];
|
||
# # TODO: env vars, secrets (server_name, registration_shared_secret, ...)
|
||
# };
|
||
|
||
# cinny = {
|
||
# service.image = "ajbura/cinny:latest";
|
||
# service.container_name = "cinny";
|
||
# service.restart = "unless-stopped";
|
||
# service.ports = [ "127.0.0.1:8080:80" ];
|
||
# };
|
||
|
||
# tuwunel-admin был systemd на jul11 (knadh/tuwunel-admin). Если контейнер
|
||
# существует — добавить сюда, иначе оставить как NixOS-сервис или выкинуть.
|
||
|
||
# === Teable (teable.iscg.dev) ===
|
||
# Стек: app + postgres + redis. Данные перенесены с iscg-dev (2026-07-12):
|
||
# - postgres восстановлен из pg_dump (18M, consistent, без остановки источника)
|
||
# - .assets (3.2G, 4392 файлов) в named volume heather_teable-assets
|
||
# - teable-data (local-storage) пустой — наполняется при работе
|
||
# - redis пустой — кэш, перестраивается
|
||
# Секреты (POSTGRES_PASSWORD, SECRET_KEY) новые, в pass iscg.dev/teable/.
|
||
# НЕ пушить env-файл в forgejo — secrets.
|
||
teable = {
|
||
# Пин по digest: :latest (release 2198, 2026-07-11) сломал роутинг —
|
||
# Next.js отдаёт 404 на / и /health, assets под /plugin/. Образ на iscg-dev
|
||
# (март 2026, digest baddd95f) работает: / → 307 → /space. Пиним его.
|
||
# TODO: разобраться с роутингом новой версии (возможно нужны NEXT_PUBLIC_* env).
|
||
service.image = "teableio/teable@sha256:baddd95f6c944334a30d17bddb209c4af04b52e619811a4c3997ae3adb8ad42e";
|
||
service.container_name = "teable";
|
||
service.restart = "unless-stopped";
|
||
service.ports = [ "127.0.0.1:2345:3000" ];
|
||
service.volumes = [
|
||
"teable-data:/app/.local-storage"
|
||
"teable-assets:/app/.assets"
|
||
];
|
||
service.depends_on = [ "teable-db" "teable-redis" ];
|
||
service.env_file = [ "/var/lib/teable-secrets/teable.env" ];
|
||
service.environment = {
|
||
POSTGRES_HOST = "teable-db";
|
||
POSTGRES_PORT = "5432";
|
||
POSTGRES_DB = "teable";
|
||
POSTGRES_USER = "teable";
|
||
REDIS_URL = "redis://teable-redis:6379";
|
||
PUBLIC_DOMAIN = "teable.iscg.dev";
|
||
PUBLIC_ORIGIN = "https://teable.iscg.dev";
|
||
};
|
||
};
|
||
teable-db = {
|
||
service.image = "postgres:15-alpine";
|
||
service.container_name = "teable-db";
|
||
service.restart = "unless-stopped";
|
||
service.volumes = [ "teable-db:/var/lib/postgresql/data" ];
|
||
service.env_file = [ "/var/lib/teable-secrets/teable.env" ];
|
||
};
|
||
teable-redis = {
|
||
service.image = "redis:alpine";
|
||
service.container_name = "teable-redis";
|
||
service.restart = "unless-stopped";
|
||
service.command = "redis-server --appendonly yes";
|
||
service.volumes = [ "teable-redis:/data" ];
|
||
};
|
||
|
||
# === Jitsi Meet (jitsi.iscg.dev) ===
|
||
# Установлено с нуля 2026-07-12 по официальным докам:
|
||
# https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker
|
||
# Репо: https://github.com/jitsi/docker-jitsi-meet (release stable-11031).
|
||
# Образы на GHCR: ghcr.io/jitsi/* (JITSI_IMAGE_REPO default).
|
||
# Минимальный стек: web/prosody/jicofo/jvb. Coturn НЕ входит в официальный
|
||
# compose — подключается опционально для NAT traversal (пока без него,
|
||
# JVB на :10000/udp + STUN достаточно для большинства клиентов).
|
||
# - Data: named volumes (web/prosody/jicofo/jvb + transcripts).
|
||
# - Секреты НОВЫЕ (JICOFO_COMPONENT_SECRET, JICOFO_AUTH_PASSWORD,
|
||
# JVB_AUTH_PASSWORD) в /var/lib/jitsi-secrets/jitsi.env (root:docker 0640).
|
||
# - Caddy терминирует TLS (DISABLE_HTTPS=1), web внутренне HTTP.
|
||
# - WebSocket routes (/xmpp-websocket, /colibri-ws) — в caddy.nix.
|
||
# - JVB_ADVERTISE_IPS = 51.250.45.111 (публичный IP heather).
|
||
# - Authentication: internal (users через prosodyctl в контейнере prosody).
|
||
# Документация: https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker
|
||
jitsi-web = {
|
||
service.image = "ghcr.io/jitsi/web:stable-11031";
|
||
service.container_name = "jitsi-web";
|
||
service.restart = "unless-stopped";
|
||
service.ports = [ "127.0.0.1:8000:80" ];
|
||
service.volumes = [
|
||
"jitsi-web:/config"
|
||
"jitsi-web:/var/spool/cron/crontabs"
|
||
"jitsi-transcripts:/usr/share/jitsi-meet/transcripts"
|
||
];
|
||
service.depends_on = [ "jitsi-jvb" ];
|
||
service.networks = [ "meet-jitsi" ];
|
||
service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ];
|
||
service.environment = {
|
||
PUBLIC_URL = "https://jitsi.iscg.dev";
|
||
# Reverse proxy mode (Caddy терминирует TLS)
|
||
DISABLE_HTTPS = "1";
|
||
ENABLE_HTTP_REDIRECT = "0";
|
||
ENABLE_HSTS = "0";
|
||
ENABLE_LETSENCRYPT = "0";
|
||
TZ = "Europe/Moscow";
|
||
HTTP_PORT = "8000";
|
||
JVB_ADVERTISE_IPS = "51.250.45.111";
|
||
DOCKER_HOST_ADDRESS = "51.250.45.111";
|
||
# Брендинг
|
||
APP_NAME = "mikl meet";
|
||
PROVIDER_NAME = "mikl meet";
|
||
SHOW_JITSI_WATERMARK = "false";
|
||
SHOW_POWERED_BY = "false";
|
||
DISABLE_JOIN_LEAVE_NOTIFICATIONS = "true";
|
||
DISABLE_VIDEO_BACKGROUND = "true";
|
||
# Authentication: internal (users через prosodyctl register)
|
||
ENABLE_AUTH = "1";
|
||
AUTH_TYPE = "internal";
|
||
ENABLE_GUESTS = "1";
|
||
# WebSocket для signalling/bridge (reverse proxy friendly)
|
||
ENABLE_XMPP_WEBSOCKET = "1";
|
||
ENABLE_COLIBRI_WEBSOCKET = "1";
|
||
# Качество видео
|
||
RESOLUTION = "1080";
|
||
RESOLUTION_MIN = "360";
|
||
ENABLE_SIMULCAST = "true";
|
||
ENABLE_P2P = "true";
|
||
ENABLE_CODEC_VP8 = "1";
|
||
ENABLE_CODEC_VP9 = "1";
|
||
ENABLE_CODEC_H264 = "1";
|
||
ENABLE_CODEC_AV1 = "0";
|
||
};
|
||
};
|
||
|
||
jitsi-prosody = {
|
||
service.image = "ghcr.io/jitsi/prosody:stable-11031";
|
||
service.container_name = "jitsi-prosody";
|
||
service.restart = "unless-stopped";
|
||
service.expose = [ "5222" "5269" "5347" "5280" ];
|
||
service.volumes = [ "jitsi-prosody:/config" ];
|
||
# network alias: prosody доступен как xmpp.meet.jitsi для jicofo/jvb/web
|
||
service.networks.meet-jitsi.aliases = [ "xmpp.meet.jitsi" ];
|
||
service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ];
|
||
service.environment = {
|
||
TZ = "Europe/Moscow";
|
||
ENABLE_AUTH = "1";
|
||
AUTH_TYPE = "internal";
|
||
ENABLE_GUESTS = "1";
|
||
ENABLE_XMPP_WEBSOCKET = "1";
|
||
ENABLE_IPV6 = "0";
|
||
PUBLIC_URL = "https://jitsi.iscg.dev";
|
||
};
|
||
};
|
||
|
||
jitsi-jicofo = {
|
||
service.image = "ghcr.io/jitsi/jicofo:stable-11031";
|
||
service.container_name = "jitsi-jicofo";
|
||
service.restart = "unless-stopped";
|
||
service.ports = [ "127.0.0.1:8888:8888" ];
|
||
service.volumes = [ "jitsi-jicofo:/config" ];
|
||
service.depends_on = [ "jitsi-prosody" ];
|
||
service.networks = [ "meet-jitsi" ];
|
||
service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ];
|
||
service.environment = {
|
||
TZ = "Europe/Moscow";
|
||
ENABLE_AUTH = "1";
|
||
AUTH_TYPE = "internal";
|
||
JICOFO_MAX_MEMORY = "1024m";
|
||
MAX_PARTICIPANTS = "10";
|
||
};
|
||
};
|
||
|
||
jitsi-jvb = {
|
||
service.image = "ghcr.io/jitsi/jvb:stable-11031";
|
||
service.container_name = "jitsi-jvb";
|
||
service.restart = "unless-stopped";
|
||
service.ports = [
|
||
"10000:10000/udp" # публично — media traffic
|
||
"127.0.0.1:8080:8080" # colibri REST (localhost only)
|
||
];
|
||
service.volumes = [ "jitsi-jvb:/config" ];
|
||
service.depends_on = [ "jitsi-prosody" ];
|
||
service.networks = [ "meet-jitsi" ];
|
||
service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ];
|
||
service.environment = {
|
||
TZ = "Europe/Moscow";
|
||
PUBLIC_URL = "https://jitsi.iscg.dev";
|
||
JVB_ADVERTISE_IPS = "51.250.45.111";
|
||
JVB_PORT = "10000";
|
||
JVB_DISABLE_STUN = "0";
|
||
VIDEOBRIDGE_MAX_MEMORY = "2048m";
|
||
DOCKER_HOST_ADDRESS = "51.250.45.111";
|
||
};
|
||
};
|
||
|
||
# === Silverbullet (note.iscg.dev) — ИСКЛЮЧЕНИЕ: bind mount ===
|
||
# Space = /srv/syncthing/herbarium (sync'ается syncthing на устройства).
|
||
# Единственный сервис без named volume — по твоему решению, чтобы notes
|
||
# были доступны и через web UI, и через obsidian/vscode на poppy.
|
||
# Конфликты syncthing (одновременная правка) решаются через .sync-conflict.
|
||
# Данные перенесены с iscg-dev (2026-07-12), auth-файл .silverbullet.auth.json
|
||
# в составе данных — silverbullet подхватит.
|
||
silverbullet = {
|
||
service.image = "zefhemel/silverbullet:latest";
|
||
service.container_name = "silverbullet";
|
||
service.restart = "unless-stopped";
|
||
service.ports = [ "127.0.0.1:3001:3000" ];
|
||
service.volumes = [
|
||
"/srv/syncthing/herbarium:/space" # bind mount, НЕ named volume
|
||
];
|
||
service.environment = {
|
||
SB_USER = "mikl:milkingfemboys";
|
||
SB_INDEX_PAGE = "flowers";
|
||
};
|
||
};
|
||
|
||
# === Backup sidecar (последним) ===
|
||
# offen/docker-volume-backup: nightly tar.gz всех named volumes.
|
||
# Монтирует volumes read-only, шлёт в /var/backups (или S3).
|
||
# TODO: добавить когда основные сервисы мигрированы.
|
||
};
|
||
}
|