sab

homes/x86_64-linux/matt@matt-nixos/default.nix

@@ -1,5 +1,4 @@
 {
-  inputs,
   lib,
   pkgs,
   namespace,

modules/nixos/services/arrs/default.nix

@@ -81,7 +81,8 @@ let
         secretFiles = [
           config.sops.templates."sabnzbd.ini".path
         ];
-        settings = {
+        configFile = null;
+        settings = lib.mkForce {
           misc = {
             host = "0.0.0.0";
             port = 8280;

modules/nixos/services/coturn/default.nix

@@ -56,17 +56,26 @@ let
         '';
       };
       networking.firewall = {
-        interfaces.enp197s0 = let
+        interfaces.enp197s0 =
-          range = with config.services.coturn; [ {
+          let
+            range = with config.services.coturn; [
+              {
                 from = min-port;
                 to = max-port;
-        } ];
+              }
+            ];
           in
           {
             allowedUDPPortRanges = range;
-          allowedUDPPorts = [ 3478 5349 ];
+            allowedUDPPorts = [
+              3478
+              5349
+            ];
             allowedTCPPortRanges = [ ];
-          allowedTCPPorts = [ 3478 5349 ];
+            allowedTCPPorts = [
+              3478
+              5349
+            ];
           };
       };
     };

modules/nixos/services/matrix/default.nix

@@ -68,7 +68,7 @@ let
         settings = {
           server_name = "mjallen.dev";
           public_baseurl = "https://matrix.mjallen.dev";
-          serve_server_wellknown = true;
+          serve_server_wellknown = false;
 
           listeners = [
             {
@@ -106,7 +106,7 @@ let
 
           # Registration settings
           enable_registration = false; # Set to true initially to create admin user
-          enable_registration_without_verification = false;
+          enable_registration_without_verification = lib.mkForce false;
 
           # Media settings
           max_upload_size = "50M";
@@ -119,7 +119,10 @@ let
               server_name = "matrix.org";
             }
           ];
-          turn_uris = ["turn:${config.services.coturn.realm}:3478?transport=udp" "turn:${config.services.coturn.realm}:3478?transport=tcp"];
+          turn_uris = [
+            "turn:${config.services.coturn.realm}:3478?transport=udp"
+            "turn:${config.services.coturn.realm}:3478?transport=tcp"
+          ];
           turn_shared_secret = config.services.coturn.static-auth-secret;
           turn_user_lifetime = "1h";
         };
@@ -144,5 +147,8 @@ let
   };
 in
 {
-  imports = [ matrixConfig ];
+  imports = [
+    matrixConfig
+    ./livekit.nix
+  ];
 }

modules/nixos/services/matrix/livekit.nix

@@ -1,10 +1,16 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  namespace,
+  ...
+}:
 let
-  cfg = config.${namespace}.services.${name};
+  cfg = config.${namespace}.services.matrix;
 
   keyFile = "/run/livekit.key";
 
-  file = pkgs.writeText "file.txt" ''
+  file = pkgs.writeText ".well-known.json" ''
     {
       "m.homeserver": {
         "base_url": "https://matrix.mjallen.dev"
@@ -24,6 +30,7 @@ let
   '';
 in
 {
+  config = lib.mkIf cfg.enable {
     services.livekit = {
       enable = true;
       openFirewall = true;
@@ -32,11 +39,11 @@ in
     };
     services.lk-jwt-service = {
       enable = true;
+      port = 8585;
       # can be on the same virtualHost as synapse
       livekitUrl = "wss://mjallen.dev/livekit/sfu";
       inherit keyFile;
     };
-  config = lib.mkIf cfg.enable {
     # generate the key when needed
     systemd.services.livekit-key = {
       before = [
@@ -58,13 +65,28 @@ in
     };
     # restrict access to livekit room creation to a homeserver
     systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = "mjallen.dev";
-    services.nginx.virtualHosts = {
+    services.nginx = {
+      enable = true;
+      defaultHTTPListenPort = 8188;
+      virtualHosts = {
         "matrix.mjallen.dev".locations = {
-        "^~ /.well-known/matrix/client" = {
+          "= /.well-known/matrix/client" = {
             alias = file;
-          extraConfig = "default_type text/plain;";
+            extraConfig = ''
+              default_type application/json;
+              add_header Access-Control-Allow-Origin "*";
+            '';
+          };
         };
         "mjallen.dev".locations = {
+          "= /.well-known/matrix/client" = {
+            alias = file;
+            extraConfig = ''
+              default_type application/json;
+              add_header Access-Control-Allow-Origin "*";
+            '';
+          };
+
           "^~ /livekit/jwt/" = {
             priority = 400;
             proxyPass = "http://[::1]:${toString config.services.lk-jwt-service.port}/";
@@ -85,6 +107,7 @@ in
             proxyWebsockets = true;
           };
         };
-    }
+      };
+    };
   };
 }

modules/nixos/services/traefik/default.nix

@@ -296,6 +296,11 @@ in
                 url = hassUrl;
               }
             ];
+            nginx.loadBalancer.servers = [
+              {
+                url = "http://localhost:8188";
+              }
+            ];
           }
           // reverseProxyServiceConfigs;
 
@@ -312,6 +317,30 @@ in
               tls.certResolver = "letsencrypt";
             };
 
+            matrix2 = {
+              entryPoints = [ "websecure" ];
+              rule = "Host(`matrix.mjallen.dev`) && PathPrefix(`/.well-known/matrix/`)";
+              service = "nginx";
+              middlewares = [
+                "crowdsec"
+                "whitelist-geoblock"
+              ];
+              priority = 1;
+              tls.certResolver = "letsencrypt";
+            };
+
+            matrix3 = {
+              entryPoints = [ "websecure" ];
+              rule = "Host(`mjallen.dev`) && PathPrefix(`/.well-known/matrix/`)";
+              service = "nginx";
+              middlewares = [
+                "crowdsec"
+                "whitelist-geoblock"
+              ];
+              priority = 1;
+              tls.certResolver = "letsencrypt";
+            };
+
             cache = {
               entryPoints = [ "websecure" ];
               rule = "Host(`cache.${domain}`)";

packages/librepods-beta/default.nix

@@ -9,7 +9,6 @@
   wayland,
   libxkbcommon,
   libGL,
-  xorg,
   expat,
   fontconfig,
   freetype,

systems/x86_64-linux/jallen-nas/default.nix

@@ -334,12 +334,17 @@ in
       tpm2-tools
       tpm2-tss
     ];
-    # persistence."/media/nas/main/persist" = {
+    persistence."/media/nas/main/persist" = {
-    #   hideMounts = true;
+      hideMounts = true;
-    #   directories = [
+      directories = [
-
+        {
-    #   ];
+          directory = "/var/lib/sabnzbd";
-    # };
+          user = "sabnzbd";
+          group = "sabnzbd";
+          mode = "u=rwx,g=rx,o=rx";
+        }
+      ];
+    };
   };
 
   networking.firewall.checkReversePath = false;