From 367b3f9338794780665077e97d0037639762d6ab Mon Sep 17 00:00:00 2001 From: Nick Date: Fri, 21 Nov 2025 02:58:02 -0600 Subject: [PATCH 1/5] feat: based just balance command --- profiles/user0/files/misc/justfile.nix | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/profiles/user0/files/misc/justfile.nix b/profiles/user0/files/misc/justfile.nix index 6202e5e..1a77ad9 100755 --- a/profiles/user0/files/misc/justfile.nix +++ b/profiles/user0/files/misc/justfile.nix @@ -25,6 +25,14 @@ let ${name}: ssh -p ${builtins.toString ssh} root@localhost ''; + balanceHosts = lib.concatStringsSep ", " [ + ''{name: "ceres", ssh: "${devices.ceres.ip.address0}"}'' + ''{name: "eris", ssh: "${devices.eris.ip.address0}"}'' + ''{name: "mars", ssh: "${devices.mars.ip.address0}"}'' + ''{name: "deimos", ssh: "${devices.deimos.ip.address0}"}'' + ''{name: "phobos", ssh: "${devices.phobos.ip.address0}"}'' + ''{name: "lamda", ssh: "-o StrictHostKeyChecking=no denise@192.168.50.131"}'' + ]; systemRecords = command: lib.concatStrings [ @@ -33,6 +41,7 @@ let (command devices.mars.name devices.mars.ip.address0) (command devices.deimos.name devices.deimos.ip.address0) (command devices.phobos.name devices.phobos.ip.address0) + (command "lamba" "-o StrictHostKeyChecking=no denise@192.168.50.131") ]; instanceRecords = command: @@ -54,5 +63,11 @@ in ${remoteRebuild} ${sshCommand} ${microVMSshCommand} + balance: + #!/usr/bin/env nu + let results = [${balanceHosts}] | each { |h| let val = (^ssh ...($h.ssh | split row " ") 'nu -c "open /var/lib/defenseio-data/MidnightMiner/balances.json | get snapshots | last | get balance"' | into float); print $"($h.name):"; print $val; $val } + print "---" + print "total:" + $results | math sum ''; } From 81f72f5d9d4b7ea2361db1ce7799e0c58b474e18 Mon Sep 17 00:00:00 2001 From: Nick Date: Fri, 21 Nov 2025 03:17:14 -0600 Subject: [PATCH 2/5] feat: based just balance command --- modules/config/default.nix | 1 + modules/config/devices/config/lamdagibson.nix | 1 + profiles/user0/files/misc/justfile.nix | 12 ++++++------ 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/modules/config/default.nix b/modules/config/default.nix index 365cce4..84398dc 100755 --- a/modules/config/default.nix +++ b/modules/config/default.nix @@ -106,6 +106,7 @@ let ip = genOptions stringType "address"; label = stringType; name = stringType; + short = stringType; sync = genOptions stringType "address"; wireguard = genOptions stringType "ip"; } diff --git a/modules/config/devices/config/lamdagibson.nix b/modules/config/devices/config/lamdagibson.nix index 3f21c4f..36dac85 100755 --- a/modules/config/devices/config/lamdagibson.nix +++ b/modules/config/devices/config/lamdagibson.nix @@ -6,6 +6,7 @@ let in { name = "lamdagibson"; + short = "lamda"; ip = { address0 = lamdagibsonIP; }; diff --git a/profiles/user0/files/misc/justfile.nix b/profiles/user0/files/misc/justfile.nix index 1a77ad9..3a472fa 100755 --- a/profiles/user0/files/misc/justfile.nix +++ b/profiles/user0/files/misc/justfile.nix @@ -26,12 +26,12 @@ let ssh -p ${builtins.toString ssh} root@localhost ''; balanceHosts = lib.concatStringsSep ", " [ - ''{name: "ceres", ssh: "${devices.ceres.ip.address0}"}'' - ''{name: "eris", ssh: "${devices.eris.ip.address0}"}'' - ''{name: "mars", ssh: "${devices.mars.ip.address0}"}'' - ''{name: "deimos", ssh: "${devices.deimos.ip.address0}"}'' - ''{name: "phobos", ssh: "${devices.phobos.ip.address0}"}'' - ''{name: "lamda", ssh: "-o StrictHostKeyChecking=no denise@192.168.50.131"}'' + ''{name: "${devices.ceres.name}", ssh: "${devices.ceres.ip.address0}"}'' + ''{name: "${devices.eris.name}", ssh: "${devices.eris.ip.address0}"}'' + ''{name: "${devices.mars.name}", ssh: "${devices.mars.ip.address0}"}'' + ''{name: "${devices.deimos.name}", ssh: "${devices.deimos.ip.address0}"}'' + ''{name: "${devices.phobos.name}", ssh: "${devices.phobos.ip.address0}"}'' + ''{name: "${devices.lamdagibson.short}", ssh: "-o StrictHostKeyChecking=no denise@${devices.lamdagibson.ip.address0}"}'' ]; systemRecords = command: From 8904a9cad41230c595b4e6bb2a7d1a29d06004ca Mon Sep 17 00:00:00 2001 From: Nick Date: Fri, 21 Nov 2025 04:11:42 -0600 Subject: [PATCH 3/5] feat: added fedifetcher --- modules/nixos/guests/mastodon/default.nix | 100 +++++++++++++++++----- secrets/secrets.yaml | 5 +- 2 files changed, 83 insertions(+), 22 deletions(-) diff --git a/modules/nixos/guests/mastodon/default.nix b/modules/nixos/guests/mastodon/default.nix index 5158ac3..d9229b7 100755 --- a/modules/nixos/guests/mastodon/default.nix +++ b/modules/nixos/guests/mastodon/default.nix @@ -14,18 +14,48 @@ let host = serviceCfg.domains.url0; dns0 = instances.web.dns.provider0; dns0Path = "dns/${dns0}"; + + fedifetcherConfig = pkgs.writeText "fedifetcher-config.json" ( + builtins.toJSON { + server = host; + home-timeline-length = 200; + max-followings = 80; + from-notifications = 1; + max-bookmarks = 80; + max-favourites = 40; + backfill-with-context = 1; + backfill-mentioned-users = 1; + remember-users-for-hours = 168; + remember-hosts-for-days = 30; + http-timeout = 5; + lock-hours = 24; + log-level = "INFO"; + } + ); + + fedifetcherPython = pkgs.python3.withPackages ( + ps: with ps; [ + requests + pytz + beautifulsoup4 + ] + ); + + fedifetcherSrc = pkgs.fetchFromGitHub { + owner = "nanos"; + repo = "FediFetcher"; + rev = "main"; + sha256 = "sha256-J7psV/mA7okuuO7/aXVVWS9p63eMncG2CEEGN38ip0="; + }; in { # If you need to start fresh for some reason, run these to create the new Admin account: # sudo -u mastodon mastodon-tootctl accounts create nick --email=nick@localhost --confirmed --role=Owner # sudo -u mastodon mastodon-tootctl accounts approve nick - # If you fuck up and lose the password, use this: # sudo mastodon-tootctl accounts modify --reset-password nick - # If you really fuck up and name yourself wrong, use this shit # sudo mastodon-tootctl accounts modify username --remove-role - # nixpkgs.overlays = [ # ( # final: prev: { @@ -39,7 +69,6 @@ in # } # ) # ]; - microvm.vms = { ${serviceCfg.name} = { autostart = true; @@ -132,14 +161,12 @@ in root /var/lib/mastodon/public-system } } - handle /api/v1/streaming/* { reverse_proxy unix//run/mastodon-streaming/streaming.socket { header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto} header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host} } } - route * { file_server * { root ${pkgs.mastodon}/public @@ -150,19 +177,15 @@ in header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host} } } - handle_errors { root * ${pkgs.mastodon}/public rewrite 500.html file_server } - encode gzip - header /* { Strict-Transport-Security "max-age=31536000;" } - header /emoji/* Cache-Control "public, max-age=31536000, immutable" header /packs/* Cache-Control "public, max-age=31536000, immutable" header /system/accounts/avatars/* Cache-Control "public, max-age=31536000, immutable" @@ -171,11 +194,9 @@ in }; }; }; - postgresql = { enable = true; }; - openssh = { enable = true; settings = { @@ -184,14 +205,12 @@ in }; }; }; - users.users.${serviceCfg.name}.extraGroups = [ "postgres" ]; users.users.caddy.extraGroups = [ serviceCfg.name ]; - networking.firewall.allowedTCPPorts = [ 22 # SSH 80 # Caddy @@ -201,7 +220,6 @@ in 2525 # SMTP 5432 # Postgres ]; - systemd = { services = { mastodon-init-dirs = { @@ -234,23 +252,57 @@ in description = "Copy secrets from virtiofs to local filesystem"; before = [ "mastodon-init-dirs.service" ]; requiredBy = [ "mastodon-init-dirs.service" ]; - serviceConfig = { Type = "oneshot"; RemainAfterExit = true; }; - script = '' mkdir -p /etc/mastodon-secrets cp /run/secrets/pass /etc/mastodon-secrets/pass cp /run/secrets/database /etc/mastodon-secrets/database cp /run/secrets/redis /etc/mastodon-secrets/redis cp /run/secrets/smtp /etc/mastodon-secrets/smtp + cp /run/secrets/fedifetcher-token /etc/mastodon-secrets/fedifetcher-token chmod 755 /etc/mastodon-secrets chmod 644 /etc/mastodon-secrets/* ''; }; + + fedifetcher = { + description = "FediFetcher Service"; + after = [ + "network.target" + "mastodon-web.service" + ]; + serviceConfig = { + Type = "oneshot"; + User = serviceCfg.name; + WorkingDirectory = "/var/lib/fedifetcher"; + ExecStart = + let + script = pkgs.writeShellScript "fedifetcher-run" '' + set -e + export ACCESS_TOKEN=$(cat /etc/mastodon-secrets/fedifetcher-token) + ${fedifetcherPython}/bin/python ${fedifetcherSrc}/find_posts.py \ + -c=${fedifetcherConfig} \ + --access-token="$ACCESS_TOKEN" + ''; + in + "${script}"; + }; + }; }; + + timers.fedifetcher = { + description = "FediFetcher Timer"; + wantedBy = [ "timers.target" ]; + timerConfig = { + OnCalendar = "*:0/15"; # Run every 15 minutes + Persistent = true; + Unit = "fedifetcher.service"; + }; + }; + network = { enable = true; networks."20-lan" = { @@ -268,6 +320,7 @@ in ]; }; }; + services = { mastodon-init-db = { serviceConfig = { @@ -276,6 +329,7 @@ in }; systemd-tmpfiles-setup.after = [ "var-lib-mastodon.mount" ]; }; + tmpfiles.rules = [ "d /var/lib/mastodon 0755 mastodon mastodon -" "Z /var/lib/mastodon 0755 mastodon mastodon -" @@ -286,6 +340,7 @@ in "d /var/lib/mastodon/public-system/media_attachments 0755 mastodon mastodon -" "d /var/lib/mastodon/public-system/media_attachments/files 0755 mastodon mastodon -" "d /var/lib/mastodon/public-system/site_uploads 0755 mastodon mastodon -" + "d /var/lib/fedifetcher 0755 mastodon mastodon -" ]; }; @@ -337,12 +392,17 @@ in source = "/run/secrets/${serviceCfg.name}"; tag = "host_secrets"; } + { + mountPoint = "/var/lib/fedifetcher"; + proto = "virtiofs"; + source = "${serviceCfg.mntPaths.path0}/fedifetcher"; + tag = "fedifetcher_data"; + } ]; }; }; }; }; - sops = { secrets = builtins.listToAttrs ( map @@ -359,6 +419,7 @@ in "database" "redis" "pass" + "fedifetcher-token" ] ); }; @@ -367,6 +428,7 @@ in "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -" "d ${serviceCfg.mntPaths.path0}/data 0751 microvm wheel - -" "d ${serviceCfg.mntPaths.path0}/database 0751 microvm wheel - -" + "d ${serviceCfg.mntPaths.path0}/fedifetcher 0751 microvm wheel - -" ]; services.caddy.virtualHosts."${host}" = { @@ -376,9 +438,7 @@ in header_up X-Real-IP {remote_host} header_up X-Forwarded-For {remote_host} } - tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key} - encode zstd gzip ''; }; diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 29d26de..99026a2 100755 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -11,6 +11,7 @@ mastodon: database: ENC[AES256_GCM,data:dYdLk9s4xZjHaIZCiKvLf/7HbcHVdMOk69JzYmXkX4lf,iv:IJKSR47LR08OuzPJZmfQnVUyOSjtUEmv0c/sGT9eIws=,tag:KUtW8ZKoZHBKvixVLYkNrQ==,type:str] redis: ENC[AES256_GCM,data:lrbTQAuay170fXNUGooG7bJg5lROItwUrnlKYBalo7Zp,iv:osaPJhqOpT5fm4ZYP7rbn0y/jzCfOu8+iPwO8KhRkuM=,tag:ByQjwCT7MtJjgpGWNAoffA==,type:str] pass: ENC[AES256_GCM,data:VlWIQQK89E4FaIUNXu1+sPuEbSQIVdYeGVWt8eztCMpikVsmeFd+G3XxS1Zm76m0tNFZjF7oHILpCudHU4M8k810ePwadcUOiglCP4P2Dkn1vrrB384T5Ed9gn8NHo3S1HlXczsNKmy6j8fP2CNKSb8Mar5VQBbajqryA73bB9pI,iv:EvlNrU4ImdYe5/HQytXCxqDui3Df3oIcC1vLkor7be4=,tag:lnkyjWHyEUTWPVqjwYx+cg==,type:str] + fedifetcher-token: ENC[AES256_GCM,data:1P4B5rs63eFFyTFdcwwQjedufURFPWy+EMFQ5TxFcXG/+FYODj9Gh6sZ2WI=,iv:Qd0abGcexrOqYGq4zOSiU9hMJAcoBWmiQEK5ujgls8s=,tag:8WfMSOqLLFO/RiXjyeaQYg==,type:str] peertube-smtp: ENC[AES256_GCM,data:rYwL0RNVvC9DUsSRJ5WpLX3VqT4zHYarxSe/tdRBHqs=,iv:cQKRbxdMOF+g84djLZcOk3hMYifucO+r0JxV8EnRjro=,tag:ZnN/LmQ/A3FR4bdJ9DYoEw==,type:str] peertube-database: ENC[AES256_GCM,data:nm0bHwTcT+ROZc2BC9jx+tXWjZ3689rdn4fdYW+7JTU=,iv:EeQVBAIXPut9gs+I9WpRf7L3f7ACTeTWycUFIKAneKk=,tag:QjGQmZ3zMAgB/WDbxTZVIQ==,type:str] peertube-redis: ENC[AES256_GCM,data:SQoPzPjgf4YN9dhvO0wo2DEra7cTgfZBx4vCBpNVSXI=,iv:mcCwYtE9E/Mb4V0j9NnU9WhaUMeBpX7BOcc8HGDiEvI=,tag:CsSiS4peZhnZ22uNtUC44w==,type:str] @@ -65,7 +66,7 @@ sops: bXBOa1VSakoyaWxpODJEOU11QUZCaUEK8Ch9Ten3DdrPHF1DTH2qei85AlHUOaLD aNfzakake7ej+MxJYdKEU0bcWofNMKzIlZa2uM10KZSENDP8d8qlig== -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-11-18T04:44:47Z" - mac: ENC[AES256_GCM,data:B7g1vWlTq3SgmEr5ZMRXMJDmZa9G0OMaNqQLciNVTEwbR8h98K/5qdUl9XieA2Pr5114XwpV838iniCOeQfW3R7YTfhATw71flr1p6mXdHPIErVSFdeCT+xLhRk2uxCQLfQGiiZDcsuFt82byEYhgeXgrgp6ivo/sQOLaXAnbSY=,iv:eK9F3/tLxiEJnumuU6zVDh34fvXl3skCb0e4woZ59kI=,tag:hcaf72tZ4WuL3oAR/nuuEA==,type:str] + lastmodified: "2025-11-21T10:02:04Z" + mac: ENC[AES256_GCM,data:5Q2J9yqR37J4S/PoOSK1btvUEmZZKEiSguWO2X/agiA4Xqqy1n6HMpyTJ1p2LYMiTDP1aFa1VaxKUObKjEPYOUpdzbteqCNvDR6mQAqh0BlOq+iUDZZW8d+vunmSeKgbEY9JJiEdUBNTyf4pu+vGhj37qWueksELsjQMojBDAt0=,iv:zlnZmYR/5hVqDlVA8azdoC0iO2pV/R27W6ZAXl96iPw=,tag:PX9VaSNl/Irahe65Ek2WQg==,type:str] unencrypted_suffix: _unencrypted version: 3.11.0 From 1469c9c4afea83f5cc99cb326d22b175101b5a38 Mon Sep 17 00:00:00 2001 From: Nick Date: Fri, 21 Nov 2025 04:16:50 -0600 Subject: [PATCH 4/5] feat: added fedifetcher --- secrets/secrets.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 99026a2..a28c440 100755 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -11,7 +11,7 @@ mastodon: database: ENC[AES256_GCM,data:dYdLk9s4xZjHaIZCiKvLf/7HbcHVdMOk69JzYmXkX4lf,iv:IJKSR47LR08OuzPJZmfQnVUyOSjtUEmv0c/sGT9eIws=,tag:KUtW8ZKoZHBKvixVLYkNrQ==,type:str] redis: ENC[AES256_GCM,data:lrbTQAuay170fXNUGooG7bJg5lROItwUrnlKYBalo7Zp,iv:osaPJhqOpT5fm4ZYP7rbn0y/jzCfOu8+iPwO8KhRkuM=,tag:ByQjwCT7MtJjgpGWNAoffA==,type:str] pass: ENC[AES256_GCM,data:VlWIQQK89E4FaIUNXu1+sPuEbSQIVdYeGVWt8eztCMpikVsmeFd+G3XxS1Zm76m0tNFZjF7oHILpCudHU4M8k810ePwadcUOiglCP4P2Dkn1vrrB384T5Ed9gn8NHo3S1HlXczsNKmy6j8fP2CNKSb8Mar5VQBbajqryA73bB9pI,iv:EvlNrU4ImdYe5/HQytXCxqDui3Df3oIcC1vLkor7be4=,tag:lnkyjWHyEUTWPVqjwYx+cg==,type:str] - fedifetcher-token: ENC[AES256_GCM,data:1P4B5rs63eFFyTFdcwwQjedufURFPWy+EMFQ5TxFcXG/+FYODj9Gh6sZ2WI=,iv:Qd0abGcexrOqYGq4zOSiU9hMJAcoBWmiQEK5ujgls8s=,tag:8WfMSOqLLFO/RiXjyeaQYg==,type:str] + fedifetcher-token: ENC[AES256_GCM,data:dKAzD+hDQgbhNosvR7xo8UWe8g8LtaTAvF4oHY9hw5ThXJKN/LplmfoDGSY=,iv:yXaRQGHiJDk+1kco9jTjzD/ava0k6YqcIefm2X/ouYA=,tag:ouqufvNfHA50Sg+IkSgSXw==,type:str] peertube-smtp: ENC[AES256_GCM,data:rYwL0RNVvC9DUsSRJ5WpLX3VqT4zHYarxSe/tdRBHqs=,iv:cQKRbxdMOF+g84djLZcOk3hMYifucO+r0JxV8EnRjro=,tag:ZnN/LmQ/A3FR4bdJ9DYoEw==,type:str] peertube-database: ENC[AES256_GCM,data:nm0bHwTcT+ROZc2BC9jx+tXWjZ3689rdn4fdYW+7JTU=,iv:EeQVBAIXPut9gs+I9WpRf7L3f7ACTeTWycUFIKAneKk=,tag:QjGQmZ3zMAgB/WDbxTZVIQ==,type:str] peertube-redis: ENC[AES256_GCM,data:SQoPzPjgf4YN9dhvO0wo2DEra7cTgfZBx4vCBpNVSXI=,iv:mcCwYtE9E/Mb4V0j9NnU9WhaUMeBpX7BOcc8HGDiEvI=,tag:CsSiS4peZhnZ22uNtUC44w==,type:str] @@ -66,7 +66,7 @@ sops: bXBOa1VSakoyaWxpODJEOU11QUZCaUEK8Ch9Ten3DdrPHF1DTH2qei85AlHUOaLD aNfzakake7ej+MxJYdKEU0bcWofNMKzIlZa2uM10KZSENDP8d8qlig== -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-11-21T10:02:04Z" - mac: ENC[AES256_GCM,data:5Q2J9yqR37J4S/PoOSK1btvUEmZZKEiSguWO2X/agiA4Xqqy1n6HMpyTJ1p2LYMiTDP1aFa1VaxKUObKjEPYOUpdzbteqCNvDR6mQAqh0BlOq+iUDZZW8d+vunmSeKgbEY9JJiEdUBNTyf4pu+vGhj37qWueksELsjQMojBDAt0=,iv:zlnZmYR/5hVqDlVA8azdoC0iO2pV/R27W6ZAXl96iPw=,tag:PX9VaSNl/Irahe65Ek2WQg==,type:str] + lastmodified: "2025-11-21T10:16:47Z" + mac: ENC[AES256_GCM,data:cgsHkgbaVkMYIaWPugPjX9yRbV6eBPcMmQnD1qRJbp647c/FF+KA4qJhB8eQD5/yA+u76in1LSEopRuKaXEGX9LRNzpUKknih/QN8bjHbbwpC2zKm/cxgkkING9Or5Fk821+RPhAb4ezZoUOl+lSG3LUl66GoDcbNAW3qxZhwO8=,iv:3rKoaAKKTskY47IqxZuKUDXeNFC58Av45nk/P/xYIzg=,tag:vfWE0td8UHxCquWW6WlqBg==,type:str] unencrypted_suffix: _unencrypted version: 3.11.0 From 1d257229305e9185f8c4630334e7cba6e3ef5522 Mon Sep 17 00:00:00 2001 From: Nick Date: Fri, 21 Nov 2025 06:02:56 -0600 Subject: [PATCH 5/5] feat: removed fedifetcher --- modules/nixos/guests/mastodon/default.nix | 100 +++++----------------- 1 file changed, 20 insertions(+), 80 deletions(-) diff --git a/modules/nixos/guests/mastodon/default.nix b/modules/nixos/guests/mastodon/default.nix index d9229b7..5158ac3 100755 --- a/modules/nixos/guests/mastodon/default.nix +++ b/modules/nixos/guests/mastodon/default.nix @@ -14,48 +14,18 @@ let host = serviceCfg.domains.url0; dns0 = instances.web.dns.provider0; dns0Path = "dns/${dns0}"; - - fedifetcherConfig = pkgs.writeText "fedifetcher-config.json" ( - builtins.toJSON { - server = host; - home-timeline-length = 200; - max-followings = 80; - from-notifications = 1; - max-bookmarks = 80; - max-favourites = 40; - backfill-with-context = 1; - backfill-mentioned-users = 1; - remember-users-for-hours = 168; - remember-hosts-for-days = 30; - http-timeout = 5; - lock-hours = 24; - log-level = "INFO"; - } - ); - - fedifetcherPython = pkgs.python3.withPackages ( - ps: with ps; [ - requests - pytz - beautifulsoup4 - ] - ); - - fedifetcherSrc = pkgs.fetchFromGitHub { - owner = "nanos"; - repo = "FediFetcher"; - rev = "main"; - sha256 = "sha256-J7psV/mA7okuuO7/aXVVWS9p63eMncG2CEEGN38ip0="; - }; in { # If you need to start fresh for some reason, run these to create the new Admin account: # sudo -u mastodon mastodon-tootctl accounts create nick --email=nick@localhost --confirmed --role=Owner # sudo -u mastodon mastodon-tootctl accounts approve nick + # If you fuck up and lose the password, use this: # sudo mastodon-tootctl accounts modify --reset-password nick + # If you really fuck up and name yourself wrong, use this shit # sudo mastodon-tootctl accounts modify username --remove-role + # nixpkgs.overlays = [ # ( # final: prev: { @@ -69,6 +39,7 @@ in # } # ) # ]; + microvm.vms = { ${serviceCfg.name} = { autostart = true; @@ -161,12 +132,14 @@ in root /var/lib/mastodon/public-system } } + handle /api/v1/streaming/* { reverse_proxy unix//run/mastodon-streaming/streaming.socket { header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto} header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host} } } + route * { file_server * { root ${pkgs.mastodon}/public @@ -177,15 +150,19 @@ in header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host} } } + handle_errors { root * ${pkgs.mastodon}/public rewrite 500.html file_server } + encode gzip + header /* { Strict-Transport-Security "max-age=31536000;" } + header /emoji/* Cache-Control "public, max-age=31536000, immutable" header /packs/* Cache-Control "public, max-age=31536000, immutable" header /system/accounts/avatars/* Cache-Control "public, max-age=31536000, immutable" @@ -194,9 +171,11 @@ in }; }; }; + postgresql = { enable = true; }; + openssh = { enable = true; settings = { @@ -205,12 +184,14 @@ in }; }; }; + users.users.${serviceCfg.name}.extraGroups = [ "postgres" ]; users.users.caddy.extraGroups = [ serviceCfg.name ]; + networking.firewall.allowedTCPPorts = [ 22 # SSH 80 # Caddy @@ -220,6 +201,7 @@ in 2525 # SMTP 5432 # Postgres ]; + systemd = { services = { mastodon-init-dirs = { @@ -252,57 +234,23 @@ in description = "Copy secrets from virtiofs to local filesystem"; before = [ "mastodon-init-dirs.service" ]; requiredBy = [ "mastodon-init-dirs.service" ]; + serviceConfig = { Type = "oneshot"; RemainAfterExit = true; }; + script = '' mkdir -p /etc/mastodon-secrets cp /run/secrets/pass /etc/mastodon-secrets/pass cp /run/secrets/database /etc/mastodon-secrets/database cp /run/secrets/redis /etc/mastodon-secrets/redis cp /run/secrets/smtp /etc/mastodon-secrets/smtp - cp /run/secrets/fedifetcher-token /etc/mastodon-secrets/fedifetcher-token chmod 755 /etc/mastodon-secrets chmod 644 /etc/mastodon-secrets/* ''; }; - - fedifetcher = { - description = "FediFetcher Service"; - after = [ - "network.target" - "mastodon-web.service" - ]; - serviceConfig = { - Type = "oneshot"; - User = serviceCfg.name; - WorkingDirectory = "/var/lib/fedifetcher"; - ExecStart = - let - script = pkgs.writeShellScript "fedifetcher-run" '' - set -e - export ACCESS_TOKEN=$(cat /etc/mastodon-secrets/fedifetcher-token) - ${fedifetcherPython}/bin/python ${fedifetcherSrc}/find_posts.py \ - -c=${fedifetcherConfig} \ - --access-token="$ACCESS_TOKEN" - ''; - in - "${script}"; - }; - }; }; - - timers.fedifetcher = { - description = "FediFetcher Timer"; - wantedBy = [ "timers.target" ]; - timerConfig = { - OnCalendar = "*:0/15"; # Run every 15 minutes - Persistent = true; - Unit = "fedifetcher.service"; - }; - }; - network = { enable = true; networks."20-lan" = { @@ -320,7 +268,6 @@ in ]; }; }; - services = { mastodon-init-db = { serviceConfig = { @@ -329,7 +276,6 @@ in }; systemd-tmpfiles-setup.after = [ "var-lib-mastodon.mount" ]; }; - tmpfiles.rules = [ "d /var/lib/mastodon 0755 mastodon mastodon -" "Z /var/lib/mastodon 0755 mastodon mastodon -" @@ -340,7 +286,6 @@ in "d /var/lib/mastodon/public-system/media_attachments 0755 mastodon mastodon -" "d /var/lib/mastodon/public-system/media_attachments/files 0755 mastodon mastodon -" "d /var/lib/mastodon/public-system/site_uploads 0755 mastodon mastodon -" - "d /var/lib/fedifetcher 0755 mastodon mastodon -" ]; }; @@ -392,17 +337,12 @@ in source = "/run/secrets/${serviceCfg.name}"; tag = "host_secrets"; } - { - mountPoint = "/var/lib/fedifetcher"; - proto = "virtiofs"; - source = "${serviceCfg.mntPaths.path0}/fedifetcher"; - tag = "fedifetcher_data"; - } ]; }; }; }; }; + sops = { secrets = builtins.listToAttrs ( map @@ -419,7 +359,6 @@ in "database" "redis" "pass" - "fedifetcher-token" ] ); }; @@ -428,7 +367,6 @@ in "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -" "d ${serviceCfg.mntPaths.path0}/data 0751 microvm wheel - -" "d ${serviceCfg.mntPaths.path0}/database 0751 microvm wheel - -" - "d ${serviceCfg.mntPaths.path0}/fedifetcher 0751 microvm wheel - -" ]; services.caddy.virtualHosts."${host}" = { @@ -438,7 +376,9 @@ in header_up X-Real-IP {remote_host} header_up X-Forwarded-For {remote_host} } + tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key} + encode zstd gzip ''; };