mirror of
https://gitlab.com/upRootNutrition/dotfiles.git
synced 2025-12-14 02:20:53 -06:00
test: setting up nas structure
This commit is contained in:
Nick
parent
8cd193ec49
commit
4225970826
747 changed files with 2938 additions and 4347 deletions
20
modules/nixos/homelab/guests/mastodon/config/config/chars.patch
Executable file
20
modules/nixos/homelab/guests/mastodon/config/config/chars.patch
Executable file
|
|
@ -0,0 +1,20 @@
|
|||
diff --git a/app/javascript/mastodon/features/compose/containers/compose_form_container.js b/app/javascript/mastodon/features/compose/containers/compose_form_container.js
|
||||
--- a/app/javascript/mastodon/features/compose/containers/compose_form_container.js
|
||||
+++ b/app/javascript/mastodon/features/compose/containers/compose_form_container.js
|
||||
@@ -32,5 +32,5 @@
|
||||
isInReply: state.getIn(['compose', 'in_reply_to']) !== null,
|
||||
lang: state.getIn(['compose', 'language']),
|
||||
- maxChars: state.getIn(['server', 'server', 'configuration', 'statuses', 'max_characters'], 500),
|
||||
+ maxChars: state.getIn(['server', 'server', 'configuration', 'statuses', 'max_characters'], 5000),
|
||||
});
|
||||
|
||||
diff --git a/app/validators/status_length_validator.rb b/app/validators/status_length_validator.rb
|
||||
--- a/app/validators/status_length_validator.rb
|
||||
+++ b/app/validators/status_length_validator.rb
|
||||
@@ -2,6 +2,6 @@
|
||||
|
||||
class StatusLengthValidator < ActiveModel::Validator
|
||||
- MAX_CHARS = 500
|
||||
+ MAX_CHARS = 5000
|
||||
URL_PLACEHOLDER_CHARS = 23
|
||||
URL_PLACEHOLDER = 'x' * 23
|
||||
6075
modules/nixos/homelab/guests/mastodon/config/config/twitter.txt
Executable file
6075
modules/nixos/homelab/guests/mastodon/config/config/twitter.txt
Executable file
File diff suppressed because one or more lines are too long
499
modules/nixos/homelab/guests/mastodon/config/default.nix
Executable file
499
modules/nixos/homelab/guests/mastodon/config/default.nix
Executable file
|
|
@ -0,0 +1,499 @@
|
|||
{
|
||||
flake,
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
serviceCfg = instances.mastodon;
|
||||
smtpCfg = instances.smtp;
|
||||
|
||||
in
|
||||
{
|
||||
mastodonVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
ssh,
|
||||
mnt,
|
||||
host,
|
||||
}:
|
||||
{
|
||||
# If you need to start fresh for some reason, run these to create the new Admin account:
|
||||
# sudo -u mastodon mastodon-tootctl accounts create nick --email=nick@localhost --confirmed --role=Owner
|
||||
# sudo -u mastodon mastodon-tootctl accounts approve nick
|
||||
# If you fuck up and lose the password, use this:
|
||||
# sudo mastodon-tootctl accounts modify --reset-password nick
|
||||
# If you really fuck up and name yourself wrong, use this shit
|
||||
# sudo mastodon-tootctl accounts modify username --remove-role
|
||||
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
mastodon = prev.mastodon.overrideAttrs (oldAttrs: {
|
||||
patches = (oldAttrs.patches or [ ]) ++ [
|
||||
./config/chars.patch
|
||||
];
|
||||
});
|
||||
})
|
||||
];
|
||||
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
|
||||
services = {
|
||||
${serviceCfg.name} = {
|
||||
enable = true;
|
||||
localDomain = host;
|
||||
secretKeyBaseFile = "/etc/mastodon-secrets/${user}-pass";
|
||||
streamingProcesses = 7;
|
||||
trustedProxy = "127.0.0.1";
|
||||
automaticMigrations = true;
|
||||
database = {
|
||||
createLocally = true;
|
||||
name = serviceCfg.name;
|
||||
host = "/run/postgresql";
|
||||
user = serviceCfg.name;
|
||||
passwordFile = "/etc/mastodon-secrets/${user}-database";
|
||||
};
|
||||
extraConfig = {
|
||||
SINGLE_USER_MODE = "false";
|
||||
SMTP_AUTH_METHOD = "plain";
|
||||
SMTP_DELIVERY_METHOD = "smtp";
|
||||
SMTP_ENABLE_STARTTLS_AUTO = "true";
|
||||
SMTP_SSL = "false";
|
||||
};
|
||||
|
||||
# if you're starting from scratch, you gotta cd into /var/lib/mastodon and run:
|
||||
# sudo -u mastodon mastodon-tootctl search deploy
|
||||
|
||||
elasticsearch = {
|
||||
preset = "single_node_cluster";
|
||||
host = "127.0.0.1";
|
||||
port = 9200;
|
||||
};
|
||||
mediaAutoRemove = {
|
||||
enable = true;
|
||||
olderThanDays = 14;
|
||||
};
|
||||
redis = {
|
||||
createLocally = true;
|
||||
enableUnixSocket = true;
|
||||
};
|
||||
sidekiqThreads = 25;
|
||||
sidekiqProcesses = {
|
||||
all = {
|
||||
jobClasses = [ ];
|
||||
threads = null;
|
||||
};
|
||||
default = {
|
||||
jobClasses = [ "default" ];
|
||||
threads = 5;
|
||||
};
|
||||
ingress = {
|
||||
jobClasses = [ "ingress" ];
|
||||
threads = 5;
|
||||
};
|
||||
push-pull = {
|
||||
jobClasses = [
|
||||
"push"
|
||||
"pull"
|
||||
];
|
||||
threads = 5;
|
||||
};
|
||||
mailers = {
|
||||
jobClasses = [ "mailers" ];
|
||||
threads = 5;
|
||||
};
|
||||
};
|
||||
smtp = {
|
||||
authenticate = true;
|
||||
createLocally = false;
|
||||
fromAddress = "upRootNutrition <${smtpCfg.interfaces.interface1.email}>";
|
||||
host = smtpCfg.interfaces.interface1.domain;
|
||||
passwordFile = "/etc/mastodon-secrets/${user}-smtp";
|
||||
port = smtpCfg.ports.port1;
|
||||
user = smtpCfg.interfaces.interface1.email;
|
||||
};
|
||||
};
|
||||
opensearch.enable = true;
|
||||
caddy = {
|
||||
enable = true;
|
||||
virtualHosts = {
|
||||
":80" = {
|
||||
extraConfig = ''
|
||||
handle_path /system/* {
|
||||
file_server * {
|
||||
root /var/lib/mastodon/public-system
|
||||
}
|
||||
}
|
||||
|
||||
handle /api/v1/streaming/* {
|
||||
reverse_proxy unix//run/mastodon-streaming/streaming.socket {
|
||||
header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
|
||||
header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host}
|
||||
}
|
||||
}
|
||||
|
||||
route * {
|
||||
file_server * {
|
||||
root ${pkgs.mastodon}/public
|
||||
pass_thru
|
||||
}
|
||||
reverse_proxy * unix//run/mastodon-web/web.socket {
|
||||
header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
|
||||
header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host}
|
||||
}
|
||||
}
|
||||
|
||||
handle_errors {
|
||||
root * ${pkgs.mastodon}/public
|
||||
rewrite 500.html
|
||||
file_server
|
||||
}
|
||||
|
||||
encode gzip
|
||||
|
||||
header /* {
|
||||
Strict-Transport-Security "max-age=31536000;"
|
||||
}
|
||||
|
||||
header /emoji/* Cache-Control "public, max-age=31536000, immutable"
|
||||
header /packs/* Cache-Control "public, max-age=31536000, immutable"
|
||||
header /system/accounts/avatars/* Cache-Control "public, max-age=31536000, immutable"
|
||||
header /system/media_attachments/files/* Cache-Control "public, max-age=31536000, immutable"
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
postgresql = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users.users = {
|
||||
${serviceCfg.name}.extraGroups = [ "postgres" ];
|
||||
caddy.extraGroups = [ serviceCfg.name ];
|
||||
fedifetcher = {
|
||||
isSystemUser = true;
|
||||
group = "fedifetcher";
|
||||
home = "/var/lib/fedifetcher";
|
||||
createHome = true;
|
||||
};
|
||||
};
|
||||
|
||||
users.groups.fedifetcher = { };
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22 # SSH
|
||||
80 # Caddy
|
||||
25 # SMTP
|
||||
139 # SMTP
|
||||
587 # SMTP
|
||||
2525 # SMTP
|
||||
5432 # Postgres
|
||||
];
|
||||
|
||||
systemd = {
|
||||
services = {
|
||||
mastodon-init-dirs.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-web.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-streaming-1.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-streaming-2.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-streaming-3.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-streaming-4.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-streaming-5.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-streaming-6.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-streaming-7.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-sidekiq-all.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-sidekiq-default.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-sidekiq-ingress.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-sidekiq-mailers.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
mastodon-sidekiq-push-pull.serviceConfig.PrivateMounts = lib.mkForce false;
|
||||
|
||||
mastodon-elastic-search = {
|
||||
description = "Recache elastic search";
|
||||
after = [
|
||||
"network-online.target"
|
||||
"mastodon-web.service"
|
||||
];
|
||||
wants = [ "network-online.target" ];
|
||||
serviceConfig = {
|
||||
WorkingDirectory = "/var/lib/${serviceCfg.name}";
|
||||
Type = "oneshot";
|
||||
};
|
||||
script = ''
|
||||
/run/current-system/sw/bin/mastodon-tootctl search deploy --only=instances accounts tags statuses public_statuses
|
||||
'';
|
||||
};
|
||||
|
||||
mastodon-copy-secrets = {
|
||||
description = "Copy secrets from virtiofs to local filesystem";
|
||||
before = [ "mastodon-init-dirs.service" ];
|
||||
requiredBy = [ "mastodon-init-dirs.service" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
|
||||
script = ''
|
||||
mkdir -p /etc/mastodon-secrets
|
||||
cp /run/secrets/${user}-pass /etc/mastodon-secrets/${user}-pass
|
||||
cp /run/secrets/${user}-database /etc/mastodon-secrets/${user}-database
|
||||
cp /run/secrets/${user}-redis /etc/mastodon-secrets/${user}-redis
|
||||
cp /run/secrets/${user}-smtp /etc/mastodon-secrets/${user}-smtp
|
||||
cp /run/secrets/${user}-fedifetcher-token /etc/mastodon-secrets/${user}-fedifetcher
|
||||
chmod 755 /etc/mastodon-secrets
|
||||
chmod 644 /etc/mastodon-secrets/*
|
||||
'';
|
||||
};
|
||||
|
||||
fedifetcher = {
|
||||
description = "FediFetcher - Fetch missing posts for Mastodon";
|
||||
after = [
|
||||
"network-online.target"
|
||||
"mastodon-web.service"
|
||||
];
|
||||
wants = [ "network-online.target" ];
|
||||
|
||||
serviceConfig =
|
||||
let
|
||||
fedifetcherConfig = pkgs.writeText "fedifetcher-config.json" (
|
||||
builtins.toJSON {
|
||||
server = "https://${host}";
|
||||
home-timeline-length = 200;
|
||||
max-followings = 80;
|
||||
from-notifications = 1;
|
||||
max-bookmarks = 80;
|
||||
max-favourites = 40;
|
||||
backfill-with-context = 1;
|
||||
backfill-mentioned-users = 1;
|
||||
remember-users-for-hours = 168;
|
||||
remember-hosts-for-days = 30;
|
||||
http-timeout = 5;
|
||||
lock-hours = 24;
|
||||
log-level = "INFO";
|
||||
}
|
||||
);
|
||||
in
|
||||
{
|
||||
Type = "oneshot";
|
||||
User = "fedifetcher";
|
||||
Group = "fedifetcher";
|
||||
WorkingDirectory = "/var/lib/fedifetcher";
|
||||
TimeoutStartSec = "300";
|
||||
PrivateTmp = true;
|
||||
NoNewPrivileges = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
ReadWritePaths = "/var/lib/fedifetcher";
|
||||
ExecStart =
|
||||
let
|
||||
script = pkgs.writeShellScript "fedifetcher-run" ''
|
||||
set -e
|
||||
|
||||
# Wait for Mastodon to be fully ready
|
||||
for i in {1..30}; do
|
||||
if ${pkgs.curl}/bin/curl -sf http://localhost:80/health >/dev/null 2>&1; then
|
||||
echo "Mastodon is ready"
|
||||
break
|
||||
fi
|
||||
echo "Waiting for Mastodon to be ready... ($i/30)"
|
||||
sleep 2
|
||||
done
|
||||
|
||||
export ACCESS_TOKEN=$(cat /etc/mastodon-secrets/${user}-fedifetcher)
|
||||
${pkgs.fedifetcher}/bin/fedifetcher \
|
||||
-c=${fedifetcherConfig} \
|
||||
--access-token="$ACCESS_TOKEN"
|
||||
'';
|
||||
in
|
||||
"${script}";
|
||||
};
|
||||
};
|
||||
|
||||
mastodon-init-db.serviceConfig.EnvironmentFile = "/var/lib/mastodon/.secrets_env";
|
||||
|
||||
systemd-tmpfiles-setup.after = [ "var-lib-mastodon.mount" ];
|
||||
|
||||
opensearch-install-plugins = {
|
||||
description = "Install OpenSearch plugins";
|
||||
before = [ "opensearch.service" ];
|
||||
requiredBy = [ "opensearch.service" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
PLUGIN_DIR="/var/lib/opensearch/plugins/analysis-icu"
|
||||
if [ ! -d "$PLUGIN_DIR" ]; then
|
||||
# Create the plugins directory if it doesn't exist
|
||||
mkdir -p /var/lib/opensearch/plugins
|
||||
|
||||
# Install using the proper OpenSearch plugin command
|
||||
export OPENSEARCH_JAVA_HOME="${pkgs.jdk17}/lib/openjdk"
|
||||
${pkgs.opensearch}/bin/opensearch-plugin install --batch analysis-icu || {
|
||||
echo "Plugin installation failed, but continuing anyway"
|
||||
exit 0
|
||||
}
|
||||
fi
|
||||
'';
|
||||
};
|
||||
};
|
||||
timers = {
|
||||
mastodon-elastic-search = {
|
||||
description = "Timer for Mastodon elastic search recaching";
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnBootSec = "10min";
|
||||
OnUnitActiveSec = "60min";
|
||||
Unit = "mastodon-elastic-search.service";
|
||||
};
|
||||
};
|
||||
|
||||
fedifetcher = {
|
||||
description = "Timer for FediFetcher";
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnBootSec = "10min";
|
||||
OnUnitActiveSec = "15min";
|
||||
Unit = "fedifetcher.service";
|
||||
Persistent = true;
|
||||
AccuracySec = "1min";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s6";
|
||||
addresses = [ { Address = "${ip}/24"; } ];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
tmpfiles.rules = [
|
||||
"d /var/lib/mastodon 0755 mastodon mastodon -"
|
||||
"Z /var/lib/mastodon 0755 mastodon mastodon -"
|
||||
"Z /var/lib/postgresql 0755 postgres postgres -"
|
||||
"d /var/cache/mastodon/precompile 0755 mastodon mastodon -"
|
||||
"d /var/lib/mastodon/public-system 0755 mastodon mastodon -"
|
||||
"d /var/lib/mastodon/public-system/accounts 0755 mastodon mastodon -"
|
||||
"d /var/lib/mastodon/public-system/media_attachments 0755 mastodon mastodon -"
|
||||
"d /var/lib/mastodon/public-system/media_attachments/files 0755 mastodon mastodon -"
|
||||
"d /var/lib/mastodon/public-system/site_uploads 0755 mastodon mastodon -"
|
||||
"d /var/lib/fedifetcher 0755 fedifetcher fedifetcher -"
|
||||
];
|
||||
};
|
||||
|
||||
microvm = {
|
||||
vcpu = 2;
|
||||
mem = 1024 * 6;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-md-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vmuser-cloud";
|
||||
mac = userMac;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}/data";
|
||||
tag = "${serviceCfg.name}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/postgresql";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}/database";
|
||||
tag = "${serviceCfg.name}_${user}_database";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
sops = {
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(secret: {
|
||||
name = "${serviceCfg.name}/${user}-${secret}";
|
||||
value = {
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0644";
|
||||
};
|
||||
})
|
||||
[
|
||||
"smtp"
|
||||
"database"
|
||||
"redis"
|
||||
"pass"
|
||||
"fedifetcher"
|
||||
]
|
||||
);
|
||||
};
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
|
||||
"d ${mnt}/${serviceCfg.name}/data 0751 microvm wheel - -"
|
||||
"d ${mnt}/${serviceCfg.name}/database 0751 microvm wheel - -"
|
||||
];
|
||||
};
|
||||
}
|
||||
25
modules/nixos/homelab/guests/mastodon/default.nix
Normal file
25
modules/nixos/homelab/guests/mastodon/default.nix
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
{
|
||||
flake,
|
||||
pkgs,
|
||||
labHelpers,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ./config { inherit flake pkgs; }) mastodonVM;
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
|
||||
interface0Cfg = instances.mastodon.interfaces.interface0;
|
||||
|
||||
mastodonNick = mastodonVM {
|
||||
user = user0;
|
||||
ip = interface0Cfg.microvm.ip;
|
||||
mac = interface0Cfg.microvm.mac;
|
||||
userMac = interface0Cfg.microvm.macUser;
|
||||
ssh = interface0Cfg.microvm.ssh;
|
||||
mnt = "";
|
||||
host = interface0Cfg.domain;
|
||||
};
|
||||
in
|
||||
mastodonNick
|
||||
# // mastodonStacie // mastodonGarnet
|
||||
Loading…
Add table
Add a link
Reference in a new issue