mirror of
https://git.sr.ht/~magic_rb/cluster
synced 2024-12-07 07:24:47 +01:00
Matrix setup
Signed-off-by: main <magic_rb@redalder.org>
This commit is contained in:
parent
53ad89a03a
commit
b6b9e09535
9 changed files with 402 additions and 50 deletions
|
@ -1,7 +1,7 @@
|
|||
{ nglib, nixpkgs }:
|
||||
nglib.makeSystem {
|
||||
system = "x86_64-linux";
|
||||
name = "nixng-gitea";
|
||||
name = "synapse";
|
||||
inherit nixpkgs;
|
||||
config = ({ pkgs, ... }:
|
||||
{
|
||||
|
|
42
containers/heisenbridge.nix
Normal file
42
containers/heisenbridge.nix
Normal file
|
@ -0,0 +1,42 @@
|
|||
{ nglib, nixpkgs }:
|
||||
nglib.makeSystem {
|
||||
system = "x86_64-linux";
|
||||
name = "heisenbridge";
|
||||
inherit nixpkgs;
|
||||
config = ({ pkgs, ... }:
|
||||
{
|
||||
dumb-init = {
|
||||
enable = true;
|
||||
type.services = { };
|
||||
};
|
||||
|
||||
init.services.heisenbridge = {
|
||||
enabled = true;
|
||||
# heisenbridge needs to retry the connection and task restarting does not work currently
|
||||
shutdownOnExit = false;
|
||||
script =
|
||||
let
|
||||
config =
|
||||
''
|
||||
-l 127.0.0.1 \
|
||||
-p 9898 \
|
||||
-o @magic_rb:matrix.redalder.org \
|
||||
'';
|
||||
homeserverURI = "https://matrix.redalder.org/";
|
||||
in
|
||||
pkgs.writeShellScript "heisenbridge"
|
||||
''
|
||||
REGISTRATION_FILE="/var/lib/registrations/heisenbridge.yaml"
|
||||
|
||||
[ -e "$REGISTRATION_FILE" ] || \
|
||||
${pkgs.heisenbridge}/bin/heisenbridge '${homeserverURI}' \
|
||||
-c "$REGISTRATION_FILE" \
|
||||
${config} \
|
||||
--generate
|
||||
${pkgs.heisenbridge}/bin/heisenbridge '${homeserverURI}' \
|
||||
-c "$REGISTRATION_FILE" \
|
||||
${config}
|
||||
'';
|
||||
};
|
||||
});
|
||||
}
|
|
@ -1,7 +1,7 @@
|
|||
{ nglib, nixpkgs }:
|
||||
nglib.makeSystem {
|
||||
system = "x86_64-linux";
|
||||
name = "nixng-gitea";
|
||||
name = "mautrix-facebook";
|
||||
inherit nixpkgs;
|
||||
config = ({ pkgs, ... }:
|
||||
{
|
||||
|
|
|
@ -48,6 +48,7 @@
|
|||
baikal = import ./containers/baikal.nix base;
|
||||
conduit = import ./containers/conduit.nix base;
|
||||
mautrix-facebook = import ./containers/mautrix-facebook.nix base;
|
||||
heisenbridge = import ./containers/heisenbridge.nix base;
|
||||
};
|
||||
|
||||
hydraJobs =
|
||||
|
|
|
@ -18,8 +18,16 @@ upstream reicio {
|
|||
server {{ env "NOMAD_UPSTREAM_ADDR_reicio" }};
|
||||
}
|
||||
|
||||
upstream matrix-synapse {
|
||||
server {{ env "NOMAD_UPSTREAM_ADDR_matrix_synapse" }};
|
||||
}
|
||||
|
||||
upstream matrix-mautrix-facebook {
|
||||
server {{ env "NOMAD_UPSTREAM_ADDR_matrix-mautrix-facebook" }};
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen 443 ssl http2;
|
||||
|
||||
server_name _;
|
||||
|
||||
|
@ -29,7 +37,7 @@ server {
|
|||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen 443 ssl http2;
|
||||
|
||||
server_name gitea.redalder.org;
|
||||
|
||||
|
@ -45,7 +53,7 @@ server {
|
|||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen 443 ssl http2;
|
||||
|
||||
server_name hydra.redalder.org;
|
||||
|
||||
|
@ -59,7 +67,7 @@ server {
|
|||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen 443 ssl http2;
|
||||
|
||||
server_name redalder.org nixng.org;
|
||||
|
||||
|
@ -80,4 +88,31 @@ server {
|
|||
include /local/headers.conf;
|
||||
proxy_pass http://website;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen 8448 ssl http2;
|
||||
|
||||
server_name matrix.redalder.org;
|
||||
merge_slashes off;
|
||||
|
||||
location /_matrix/ {
|
||||
proxy_pass http://matrix-synapse$request_uri;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_buffering off;
|
||||
}
|
||||
|
||||
location /mufb/ {
|
||||
proxy_pass http://matrix-mautrix-facebook$request_uri;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_buffering off;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 404;
|
||||
}
|
||||
|
||||
include /local/security.conf;
|
||||
include /local/ssl.conf;
|
||||
}
|
|
@ -40,6 +40,12 @@ job "ingress" {
|
|||
host_network = "public"
|
||||
}
|
||||
|
||||
port "http-matrix" {
|
||||
static = 8448
|
||||
to = 8448
|
||||
host_network = "public"
|
||||
}
|
||||
|
||||
port "https" {
|
||||
static = 443
|
||||
to = 443
|
||||
|
@ -119,13 +125,33 @@ job "ingress" {
|
|||
mode = "local"
|
||||
}
|
||||
}
|
||||
|
||||
upstreams {
|
||||
destination_name = "matrix-synapse"
|
||||
local_bind_port = 6167
|
||||
datacenter = "homelab-1"
|
||||
|
||||
mesh_gateway {
|
||||
mode = "local"
|
||||
}
|
||||
}
|
||||
|
||||
upstreams {
|
||||
destination_name = "matrix-mautrix-facebook"
|
||||
local_bind_port = 29319
|
||||
datacenter = "homelab-1"
|
||||
|
||||
mesh_gateway {
|
||||
mode = "local"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
task "nginx" {
|
||||
driver = "docker"
|
||||
driver = "containerd-driver"
|
||||
|
||||
volume_mount {
|
||||
volume = "ingress-letsencrypt"
|
||||
|
@ -133,21 +159,15 @@ job "ingress" {
|
|||
read_only = false
|
||||
}
|
||||
|
||||
# artifact {
|
||||
# source = "http://hydra/build/99/download/1/image.tar.gz"
|
||||
# }
|
||||
|
||||
config {
|
||||
# load = "nixng-ingress.tar.gz"
|
||||
image = "nixng-ingress:local"
|
||||
|
||||
ports = ["http", "https", "minecraft"]
|
||||
memory_hard_limit = 128
|
||||
flake_ref = "${var.flake_ref}#nixngSystems.ingressToothpick.config.system.build.toplevel"
|
||||
flake_sha = var.flake_sha
|
||||
entrypoint = [ "init" ]
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 200
|
||||
memory = 32
|
||||
memory = 128
|
||||
}
|
||||
|
||||
template {
|
||||
|
|
|
@ -1,9 +1,9 @@
|
|||
resource "nomad_volume" "conduit-data" {
|
||||
resource "nomad_volume" "matrix-synapse" {
|
||||
type = "csi"
|
||||
plugin_id = "nfs"
|
||||
volume_id = "conduit-data"
|
||||
name = "conduit-data"
|
||||
external_id = "conduit-data"
|
||||
plugin_id = "org.democratic-csi.nfs"
|
||||
volume_id = "matrix-synapse"
|
||||
name = "matrix-synapse"
|
||||
external_id = "matrix-synapse"
|
||||
|
||||
capability {
|
||||
access_mode = "single-node-writer"
|
||||
|
@ -12,22 +12,92 @@ resource "nomad_volume" "conduit-data" {
|
|||
|
||||
context = {
|
||||
server = "blowhole.hosts.in.redalder.org"
|
||||
share = "/var/nfs/conduit-data"
|
||||
share = "/var/nfs/matrix/synapse"
|
||||
node_attach_driver = "nfs"
|
||||
provisioner_driver = "node-manual"
|
||||
}
|
||||
|
||||
mount_options {
|
||||
fs_type = "nfs"
|
||||
mount_flags = [ "nolock", "hard" ]
|
||||
mount_flags = [ "nfsvers=3", "hard", "async" ]
|
||||
}
|
||||
}
|
||||
|
||||
resource "nomad_volume" "matrix-registrations" {
|
||||
type = "csi"
|
||||
plugin_id = "org.democratic-csi.nfs"
|
||||
volume_id = "matrix-registrations"
|
||||
name = "matrix-registrations"
|
||||
external_id = "matrix-registrations"
|
||||
|
||||
capability {
|
||||
access_mode = "multi-node-multi-writer"
|
||||
attachment_mode = "file-system"
|
||||
}
|
||||
|
||||
context = {
|
||||
server = "blowhole.hosts.in.redalder.org"
|
||||
share = "/var/nfs/matrix/registrations"
|
||||
node_attach_driver = "nfs"
|
||||
provisioner_driver = "node-manual"
|
||||
}
|
||||
|
||||
mount_options {
|
||||
fs_type = "nfs"
|
||||
mount_flags = [ "nfsvers=3", "hard", "async" ]
|
||||
}
|
||||
}
|
||||
|
||||
resource "nomad_volume" "matrix-mautrix-facebook" {
|
||||
type = "csi"
|
||||
plugin_id = "org.democratic-csi.nfs"
|
||||
volume_id = "matrix-mautrix-facebook"
|
||||
name = "matrix-mautrix-facebook"
|
||||
external_id = "matrix-mautrix-facebook"
|
||||
|
||||
capability {
|
||||
access_mode = "single-node-writer"
|
||||
attachment_mode = "file-system"
|
||||
}
|
||||
|
||||
context = {
|
||||
server = "blowhole.hosts.in.redalder.org"
|
||||
share = "/var/nfs/matrix/mautrix-facebook"
|
||||
node_attach_driver = "nfs"
|
||||
provisioner_driver = "node-manual"
|
||||
}
|
||||
|
||||
mount_options {
|
||||
fs_type = "nfs"
|
||||
mount_flags = [ "nfsvers=3", "hard", "async" ]
|
||||
}
|
||||
}
|
||||
|
||||
resource "vault_policy" "matrix-mautrix-facebook-policy" {
|
||||
name = "matrix-mautrix-facebook-policy"
|
||||
policy = <<EOF
|
||||
path "kv/data/matrix/mautrix-facebook" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
EOF
|
||||
}
|
||||
|
||||
resource "vault_policy" "matrix-synapse-policy" {
|
||||
name = "matrix-synapse-policy"
|
||||
policy = <<EOF
|
||||
path "kv/data/matrix/synapse" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
EOF
|
||||
}
|
||||
|
||||
resource "nomad_job" "conduit" {
|
||||
jobspec = file("${path.module}/job/conduit.hcl")
|
||||
|
||||
hcl2 {
|
||||
enabled = true
|
||||
vars = {
|
||||
flake_ref = "${var.flake_host_alt}?rev=${var.flake_rev}"
|
||||
flake_ref = "${var.flake_host}?ref=${var.flake_ref}&rev=${var.flake_rev}"
|
||||
flake_sha = var.flake_sha
|
||||
}
|
||||
}
|
||||
|
|
|
@ -6,22 +6,31 @@ variable "flake_sha" {
|
|||
type = string
|
||||
}
|
||||
|
||||
job "conduit" {
|
||||
job "matrix" {
|
||||
datacenters = [ "homelab-1" ]
|
||||
type = "service"
|
||||
|
||||
group "svc" {
|
||||
group "mautrix-facebook" {
|
||||
count = 1
|
||||
|
||||
volume "conduit-data" {
|
||||
volume "matrix-mautrix-facebook" {
|
||||
type = "csi"
|
||||
source = "conduit-data"
|
||||
source = "matrix-mautrix-facebook"
|
||||
read_only = false
|
||||
|
||||
attachment_mode = "file-system"
|
||||
access_mode = "single-node-writer"
|
||||
}
|
||||
|
||||
volume "matrix-registrations" {
|
||||
type = "csi"
|
||||
source = "matrix-registrations"
|
||||
read_only = false
|
||||
|
||||
attachment_mode = "file-system"
|
||||
access_mode = "multi-node-multi-writer"
|
||||
}
|
||||
|
||||
restart {
|
||||
attempts = 5
|
||||
delay = "5s"
|
||||
|
@ -32,29 +41,190 @@ job "conduit" {
|
|||
}
|
||||
|
||||
service {
|
||||
name = "conduit"
|
||||
port = "6167"
|
||||
name = "matrix-mautrix-facebook"
|
||||
port = "29319"
|
||||
|
||||
check {
|
||||
type = "http"
|
||||
address_mode = "alloc"
|
||||
path = "/"
|
||||
port = "6167"
|
||||
interval = "2s"
|
||||
timeout = "2s"
|
||||
}
|
||||
# check {
|
||||
# type = "http"
|
||||
# address_mode = "alloc"
|
||||
# path = "/public"
|
||||
# port = "29319"
|
||||
# interval = "2s"
|
||||
# timeout = "2s"
|
||||
# }
|
||||
|
||||
connect {
|
||||
sidecar_service {}
|
||||
}
|
||||
}
|
||||
|
||||
task "app" {
|
||||
task "mautrix-facebook" {
|
||||
driver = "containerd-driver"
|
||||
|
||||
volume_mount {
|
||||
volume = "conduit-data"
|
||||
destination = "/var/lib/matrix-conduit"
|
||||
volume = "matrix-mautrix-facebook"
|
||||
destination = "/var/lib/mautrix-facebook"
|
||||
read_only = false
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
volume = "matrix-registrations"
|
||||
destination = "/var/lib/registrations"
|
||||
read_only = false
|
||||
}
|
||||
|
||||
config {
|
||||
flake_ref = "${var.flake_ref}#nixngSystems.mautrix-facebook.config.system.build.toplevel"
|
||||
flake_sha = var.flake_sha
|
||||
entrypoint = [ "init" ]
|
||||
}
|
||||
|
||||
vault {
|
||||
policies = ["matrix-mautrix-facebook-policy"]
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
{{ with secret "kv/data/matrix/mautrix-facebook" }}
|
||||
MAUTRIX_FACEBOOK_APPSERVICE_AS_TOKEN={{ .Data.data.as_token }}
|
||||
MAUTRIX_FACEBOOK_APPSERVICE_HS_TOKEN={{ .Data.data.hs_token }}
|
||||
{{ end }}
|
||||
EOF
|
||||
destination = "secrets/environment"
|
||||
env = true
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 256
|
||||
memory = 256
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
group "heisenbridge" {
|
||||
count = 1
|
||||
|
||||
volume "matrix-registrations" {
|
||||
type = "csi"
|
||||
source = "matrix-registrations"
|
||||
read_only = false
|
||||
|
||||
attachment_mode = "file-system"
|
||||
access_mode = "multi-node-multi-writer"
|
||||
}
|
||||
|
||||
restart {
|
||||
attempts = 5
|
||||
delay = "5s"
|
||||
}
|
||||
|
||||
network {
|
||||
mode = "bridge"
|
||||
}
|
||||
|
||||
service {
|
||||
name = "matrix-heisenbridge"
|
||||
port = "9898"
|
||||
|
||||
connect {
|
||||
sidecar_service {}
|
||||
}
|
||||
}
|
||||
|
||||
task "heisenbridge" {
|
||||
driver = "containerd-driver"
|
||||
|
||||
volume_mount {
|
||||
volume = "matrix-registrations"
|
||||
destination = "/var/lib/registrations"
|
||||
read_only = false
|
||||
}
|
||||
|
||||
config {
|
||||
flake_ref = "${var.flake_ref}#nixngSystems.heisenbridge.config.system.build.toplevel"
|
||||
flake_sha = var.flake_sha
|
||||
entrypoint = [ "init" ]
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 128
|
||||
memory = 128
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
group "synapse" {
|
||||
count = 1
|
||||
|
||||
volume "matrix-synapse" {
|
||||
type = "csi"
|
||||
source = "matrix-synapse"
|
||||
read_only = false
|
||||
|
||||
attachment_mode = "file-system"
|
||||
access_mode = "single-node-writer"
|
||||
}
|
||||
|
||||
volume "matrix-registrations" {
|
||||
type = "csi"
|
||||
source = "matrix-registrations"
|
||||
read_only = false
|
||||
|
||||
attachment_mode = "file-system"
|
||||
access_mode = "multi-node-multi-writer"
|
||||
}
|
||||
|
||||
restart {
|
||||
attempts = 5
|
||||
delay = "5s"
|
||||
}
|
||||
|
||||
network {
|
||||
mode = "bridge"
|
||||
}
|
||||
|
||||
service {
|
||||
name = "matrix-synapse"
|
||||
port = "6167"
|
||||
|
||||
check {
|
||||
type = "http"
|
||||
address_mode = "alloc"
|
||||
path = "/_matrix/client/versions"
|
||||
port = "6167"
|
||||
interval = "2s"
|
||||
timeout = "2s"
|
||||
}
|
||||
|
||||
connect {
|
||||
sidecar_service {
|
||||
proxy {
|
||||
upstreams {
|
||||
destination_name = "matrix-mautrix-facebook"
|
||||
local_bind_port = 29319
|
||||
}
|
||||
|
||||
upstreams {
|
||||
destination_name = "matrix-heisenbridge"
|
||||
local_bind_port = 9898
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
task "synapse" {
|
||||
driver = "containerd-driver"
|
||||
|
||||
volume_mount {
|
||||
volume = "matrix-synapse"
|
||||
destination = "/var/lib/synapse"
|
||||
read_only = false
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
volume = "matrix-registrations"
|
||||
destination = "/var/lib/registrations"
|
||||
read_only = false
|
||||
}
|
||||
|
||||
|
@ -65,8 +235,23 @@ job "conduit" {
|
|||
}
|
||||
|
||||
resources {
|
||||
cpu = 500
|
||||
memory = 1024
|
||||
cpu = 2048
|
||||
memory = 2048
|
||||
}
|
||||
|
||||
vault {
|
||||
policies = ["matrix-synapse-policy"]
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
{{ with secret "kv/data/matrix/synapse" }}
|
||||
registration_shared_secret: "{{ .Data.data.registration_shared_secret }}"
|
||||
macaroon_secret_key: "{{ .Data.data.macaroon_secret_key }}"
|
||||
form_secret: "{{ .Data.data.form_secret }}"
|
||||
{{ end }}
|
||||
EOF
|
||||
destination = "/secrets/extra.yaml"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
@ -1,6 +1,5 @@
|
|||
flake_rev = "1de7117dca94932945dab6cb92315a74edcf01d5"
|
||||
flake_ref = "home-assistant"
|
||||
# flake_host = "git+https://gitea.redalder.org/RedAlder/systems"
|
||||
flake_host = "git+https://git.irunx.org/MagicRB/ra-systems"
|
||||
flake_host_alt = "git+https://git.irunx.org/MagicRB/ra-systems"
|
||||
flake_sha = "sha256-QhVT7sAEzMNyYeInRNdI30JK6E7x1ksTZc1DSPNHNZ0="
|
||||
flake_rev = "a27a4c4e78928564383e165b3868aa4f63c451df"
|
||||
flake_ref = "conduit-wip"
|
||||
flake_host = "git+https://git.sr.ht/~magic_rb/cluster"
|
||||
flake_host_alt = "git+https://git.sr.ht/~magic_rb/cluster"
|
||||
flake_sha = "sha256-7b/9W8mDnqQv0DfH6if0IVbMWR8iEvor7Ktth/WkX9M="
|
||||
|
|
Loading…
Reference in a new issue