From 00c9e35779cbb298d6395a6e2c2534007a92976f Mon Sep 17 00:00:00 2001 From: Preston Pan Date: Fri, 21 Mar 2025 04:52:46 -0700 Subject: add a ton of VPS upgrades; update website; live life --- nix/data/deploy-matterbridge.sh | 25 ++ nix/data/matterbridge.toml | 25 ++ nix/data/motd.txt | 8 + nix/flake.lock | 36 +-- nix/modules/configuration.nix | 31 ++- nix/modules/default.nix | 1 + nix/modules/home/default.nix | 1 + nix/modules/home/emacs.nix | 2 +- nix/modules/home/mpd.nix | 14 + nix/modules/icecast.nix | 21 ++ nix/modules/inspircd.nix | 539 ++++++++++++++++++++++++++++++++++++ nix/modules/ircd.nix | 12 + nix/modules/maddy.nix | 18 ++ nix/modules/matterbridge.nix | 7 + nix/modules/murmur.nix | 6 +- nix/modules/nginx.nix | 18 +- nix/modules/ngircd.nix | 28 ++ nix/modules/secrets.nix | 1 - nix/modules/znc.nix | 31 +++ nix/secrets/secrets.yaml | 7 +- nix/systems/spontaneity/default.nix | 21 +- 21 files changed, 804 insertions(+), 48 deletions(-) create mode 100755 nix/data/deploy-matterbridge.sh create mode 100644 nix/data/matterbridge.toml create mode 100644 nix/data/motd.txt create mode 100644 nix/modules/icecast.nix create mode 100644 nix/modules/inspircd.nix create mode 100644 nix/modules/ircd.nix create mode 100644 nix/modules/maddy.nix create mode 100644 nix/modules/matterbridge.nix create mode 100644 nix/modules/ngircd.nix create mode 100644 nix/modules/znc.nix (limited to 'nix') diff --git a/nix/data/deploy-matterbridge.sh b/nix/data/deploy-matterbridge.sh new file mode 100755 index 0000000..a0758ec --- /dev/null +++ b/nix/data/deploy-matterbridge.sh @@ -0,0 +1,25 @@ +set -e # Exit on error + +# Ensure required environment variables are set +#: "${MATTERBRIDGE_DISCORD_TOKEN:?Need to set MATTERBRIDGE_DISCORD_TOKEN}" +: "${MATTERBRIDGE_MATRIX_PASS:?Need to set MATTERBRIDGE_MATRIX_PASS}" + +# Define paths +TEMPLATE_CONFIG="matterbridge.toml" +GENERATED_CONFIG="matterbridge.built.toml" +REMOTE_SERVER="root@nullring.xyz" +REMOTE_PATH="/etc/matterbridge.toml" + +# Generate config file +sed "s|\${MATTERBRIDGE_MATRIX_PASS}|$MATTERBRIDGE_MATRIX_PASS|g" $TEMPLATE_CONFIG > $GENERATED_CONFIG + +# Securely transfer to server +scp "$GENERATED_CONFIG" "$REMOTE_SERVER:$REMOTE_PATH" + +# Restart Matterbridge service +ssh "$REMOTE_SERVER" "sudo systemctl restart matterbridge" + +# delete config file with secrets from repo +shred -u "$GENERATED_CONFIG" + +echo "✅ Matterbridge config deployed successfully!" diff --git a/nix/data/matterbridge.toml b/nix/data/matterbridge.toml new file mode 100644 index 0000000..aebb8c2 --- /dev/null +++ b/nix/data/matterbridge.toml @@ -0,0 +1,25 @@ +[matrix.mymatrix] +Server="https://matrix.ret2pop.net" +Login="bridge" +Password="${MATTERBRIDGE_MATRIX_PASS}" +RemoteNickFormat="[{PROTOCOL}] <{NICK}> " +NoHomeServerSuffix=true + +[irc.myirc] +Server="nullring.xyz:6697" +Nick="bridge" +RemoteNickFormat="[{PROTOCOL}] <{NICK}> " +UseTLS=true +SkipTLSVerify=true + +[[gateway]] +name="gateway1" +enable=true + +[[gateway.inout]] +account="matrix.mymatrix" +channel="!BQZli4UPBNC5w6ntXu:matrix.ret2pop.net" + +[[gateway.inout]] +account="irc.myirc" +channel="#nullring" \ No newline at end of file diff --git a/nix/data/motd.txt b/nix/data/motd.txt new file mode 100644 index 0000000..ffcd31f --- /dev/null +++ b/nix/data/motd.txt @@ -0,0 +1,8 @@ +Welcome to the NullRing experience! +The main channel is #nullring; we're glad to have you! + +Rules: +1. Don't be annoying. +2. No illegal content. +And if you're here to have constructive, philisophical and theoretical +conversations, this is the place for you! diff --git a/nix/flake.lock b/nix/flake.lock index 0515e11..67c9ad1 100644 --- a/nix/flake.lock +++ b/nix/flake.lock @@ -49,11 +49,11 @@ ] }, "locked": { - "lastModified": 1740485968, - "narHash": "sha256-WK+PZHbfDjLyveXAxpnrfagiFgZWaTJglewBWniTn2Y=", + "lastModified": 1741786315, + "narHash": "sha256-VT65AE2syHVj6v/DGB496bqBnu1PXrrzwlw07/Zpllc=", "owner": "nix-community", "repo": "disko", - "rev": "19c1140419c4f1cdf88ad4c1cfb6605597628940", + "rev": "0d8c6ad4a43906d14abd5c60e0ffe7b587b213de", "type": "github" }, "original": { @@ -328,11 +328,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1740743217, - "narHash": "sha256-brsCRzLqimpyhORma84c3W2xPbIidZlIc3JGIuQVSNI=", + "lastModified": 1741724370, + "narHash": "sha256-WsD+8uodhl58jzKKcPH4jH9dLTLFWZpVmGq4W1XDVF4=", "owner": "nixos", "repo": "nixpkgs", - "rev": "b27ba4eb322d9d2bf2dc9ada9fd59442f50c8d7c", + "rev": "95600680c021743fd87b3e2fe13be7c290e1cac4", "type": "github" }, "original": { @@ -360,11 +360,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1740695751, - "narHash": "sha256-D+R+kFxy1KsheiIzkkx/6L63wEHBYX21OIwlFV8JvDs=", + "lastModified": 1741851582, + "narHash": "sha256-cPfs8qMccim2RBgtKGF+x9IBCduRvd/N5F4nYpU0TVE=", "owner": "nixos", "repo": "nixpkgs", - "rev": "6313551cd05425cd5b3e63fe47dbc324eabb15e4", + "rev": "6607cf789e541e7873d40d3a8f7815ea92204f32", "type": "github" }, "original": { @@ -376,11 +376,11 @@ }, "nixpkgs_3": { "locked": { - "lastModified": 1731763621, - "narHash": "sha256-ddcX4lQL0X05AYkrkV2LMFgGdRvgap7Ho8kgon3iWZk=", + "lastModified": 1741708242, + "narHash": "sha256-cNRqdQD4sZpN7JLqxVOze4+WsWTmv2DGH0wNCOVwrWc=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "c69a9bffbecde46b4b939465422ddc59493d3e4d", + "rev": "b62d2a95c72fb068aecd374a7262b37ed92df82b", "type": "github" }, "original": { @@ -397,11 +397,11 @@ "treefmt-nix": "treefmt-nix_2" }, "locked": { - "lastModified": 1740915906, - "narHash": "sha256-29HktIztPUFv9MQA9afzVnWnUMdmmu0nqK7z8Q9givY=", + "lastModified": 1741887947, + "narHash": "sha256-QQojmc7+HVYEZq4Ksim7y8KYobkIhqZ/oivd5Gnr8sA=", "owner": "nix-community", "repo": "NUR", - "rev": "24505e0253c0ea54d50355c53bfd7a8d55c9cf4b", + "rev": "2ac2be6a5936459018f10608b723487468a13f56", "type": "github" }, "original": { @@ -524,11 +524,11 @@ "nixpkgs": "nixpkgs_3" }, "locked": { - "lastModified": 1739262228, - "narHash": "sha256-7JAGezJ0Dn5qIyA2+T4Dt/xQgAbhCglh6lzCekTVMeU=", + "lastModified": 1741861888, + "narHash": "sha256-ynOgXAyToeE1UdLNfrUn/hL7MN0OpIS2BtNdLjpjPf0=", "owner": "Mic92", "repo": "sops-nix", - "rev": "07af005bb7d60c7f118d9d9f5530485da5d1e975", + "rev": "d016ce0365b87d848a57c12ffcfdc71da7a2b55f", "type": "github" }, "original": { diff --git a/nix/modules/configuration.nix b/nix/modules/configuration.nix index 732f83c..ad244b8 100644 --- a/nix/modules/configuration.nix +++ b/nix/modules/configuration.nix @@ -1,6 +1,7 @@ { config, pkgs, lib, ... }: { imports = [ + ./matterbridge.nix ./xserver.nix ./ssh.nix ./pipewire.nix @@ -10,14 +11,14 @@ ./cuda.nix ./nginx.nix ./git-daemon.nix - ./postfix.nix - ./dovecot.nix ./ollama.nix ./i2pd.nix ./gitweb.nix ./conduit.nix ./bitcoin.nix ./murmur.nix + ./ngircd.nix + ./znc.nix ]; documentation = { @@ -315,12 +316,28 @@ users.groups.nginx = lib.mkDefault {}; users.groups.git = lib.mkDefault {}; + users.groups.ircd = lib.mkDefault {}; + users.users = { - nginx.group = "nginx"; - nginx.isSystemUser = lib.mkDefault true; - nginx.extraGroups = [ - "acme" - ]; + ngircd = { + isSystemUser = lib.mkDefault true; + extraGroups = [ "acme" "nginx" ]; + }; + + ircd = { + isSystemUser = lib.mkDefault true; + group = "ircd"; + home = "/home/ircd"; + }; + + nginx = { + group = "nginx"; + isSystemUser = lib.mkDefault true; + extraGroups = [ + "acme" + ]; + }; + root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICts6+MQiMwpA+DfFQxjIN214Jn0pCw/2BDvOzPhR/H2 preston@continuity-dell" ]; diff --git a/nix/modules/default.nix b/nix/modules/default.nix index 00a188b..4bd4161 100644 --- a/nix/modules/default.nix +++ b/nix/modules/default.nix @@ -27,6 +27,7 @@ linux-manual man-pages man-pages-posix + iproute2 ]); boot.loader.grub = lib.mkIf config.monorepo.profiles.grub.enable { enable = true; diff --git a/nix/modules/home/default.nix b/nix/modules/home/default.nix index fa18632..72fcc31 100644 --- a/nix/modules/home/default.nix +++ b/nix/modules/home/default.nix @@ -84,6 +84,7 @@ ++ (if config.monorepo.profiles.workstation.enable then (with pkgs; [ open-webui + mumble ]) else []) ++ (if config.monorepo.profiles.lang-js.enable then (with pkgs; [ diff --git a/nix/modules/home/emacs.nix b/nix/modules/home/emacs.nix index 4358ca3..71e234c 100644 --- a/nix/modules/home/emacs.nix +++ b/nix/modules/home/emacs.nix @@ -3,7 +3,7 @@ programs.emacs = { enable = lib.mkDefault config.monorepo.profiles.graphics.enable; - package = pkgs.emacs29-pgtk; + package = pkgs.emacs30-pgtk; extraConfig = '' (setq debug-on-error t) (org-babel-load-file diff --git a/nix/modules/home/mpd.nix b/nix/modules/home/mpd.nix index 087b19a..3ab9d2d 100644 --- a/nix/modules/home/mpd.nix +++ b/nix/modules/home/mpd.nix @@ -24,6 +24,20 @@ always_on "yes" # prevent MPD from disconnecting all listeners when playback is stopped. tags "yes" # httpd supports sending tags to listening streams. } +audio_output { + type "shout" + encoding "ogg" + name "my cool stream" + host "localhost" + port "8000" + mount "/example.ogg" + user "source" + password "" + + bitrate "64" + format "44100:16:1" + description "Nullring public radio" +} ''; }; } diff --git a/nix/modules/icecast.nix b/nix/modules/icecast.nix new file mode 100644 index 0000000..0cef018 --- /dev/null +++ b/nix/modules/icecast.nix @@ -0,0 +1,21 @@ +{ lib, config, ... }: +{ + services.icecast = { + enable = lib.mkDefault config.monorepo.profiles.server.enable; + listen.address = "0.0.0.0"; + extraConfig = '' + + 0 + /stream.m3u + 3600 + + + +
+ + +''; + }; + admin.password = "changeme"; +} diff --git a/nix/modules/inspircd.nix b/nix/modules/inspircd.nix new file mode 100644 index 0000000..bf3e9ba --- /dev/null +++ b/nix/modules/inspircd.nix @@ -0,0 +1,539 @@ +{ lib, config, ... }: +{ + services.inspircd = { + enable = lib.mkDefault config.monorepo.profiles.server.enable; + modules = [ "ssl_openssl" ]; + config = '' + + + + + + + + + + + #hash="sha256" + + # diepass: Password for opers to use if they need to shutdown (die) + # a server. + diepass="" + + # restartpass: Password for opers to use if they need to restart + # a server. + restartpass=""> + + + + +#-#-#-#-#-#-#-#-#-#-#-#- CIDR CONFIGURATION -#-#-#-#-#-#-#-#-#-#-#- +# # +# CIDR configuration allows detection of clones and applying of # +# throttle limits across a CIDR range. (A CIDR range is a group of # +# IPs, for example, the CIDR range 192.168.1.0-192.168.1.255 may be # +# represented as 192.168.1.0/24). This means that abuse across an ISP # +# is detected and curtailed much easier. Here is a good chart that # +# shows how many IPs the different CIDRs correspond to: # +# http://en.wikipedia.org/wiki/CIDR#Prefix_aggregation # +# # + + + + + +#-#-#-#-#-#-#-#-#-#-#-#-#-#-# DNS SERVER -#-#-#-#-#-#-#-#-#-#-#-#-#-#-# +# If these values are not defined, InspIRCd uses the default DNS resolver +# of your system. + + + +# An example of using an IPv6 nameserver +# + +#-#-#-#-#-#-#-#-#-#-#-#-#-#-# PID FILE -#-#-#-#-#-#-#-#-#-#-#-#-#-#-# +# # +# Define the path to the PID file here. The PID file can be used to # +# rehash the ircd from the shell or to terminate the ircd from the # +# shell using shell scripts, perl scripts, etc... and to monitor the # +# ircd's state via cron jobs. If this is a relative path, it will be # +# relative to the configuration directory, and if it is not defined, # +# the default of 'inspircd.pid' is used. # +# # + +# + +#-#-#-#-#-#-#-#-#-#-#-#-#- BANLIST LIMITS #-#-#-#-#-#-#-#-#-#-#-#-#-#-# +# # +# Use these tags to customise the ban limits on a per channel basis. # +# The tags are read from top to bottom, and any tag found which # +# matches the channels name applies the banlimit to that channel. # +# It is advisable to put an entry with the channel as '*' at the # +# bottom of the list. If none are specified or no maxbans tag is # +# matched, the banlist size defaults to 64 entries. # +# # + + + + +#-#-#-#-#-#-#-#-#-#-#- DISABLED FEATURES -#-#-#-#-#-#-#-#-#-#-#-#-#-# +# # +# This tag is optional, and specifies one or more features which are # +# not available to non-operators. # +# # +# For example you may wish to disable NICK and prevent non-opers from # +# changing their nicknames. # +# Note that any disabled commands take effect only after the user has # +# 'registered' (e.g. after the initial USER/NICK/PASS on connection) # +# so for example disabling NICK will not cripple your network. # +# # +# You can also define if you want to disable any channelmodes # +# or usermodes from your users. # +# # +# `fakenonexistant' will make the ircd pretend that nonexistant # +# commands simply don't exist to non-opers ("no such command"). # +# # +# + + +#-#-#-#-#-#-#-#-#-#-#-#-#-#-#- RTFM LINE -#-#-#-#-#-#-#-#-#-#-#-#-#-# +# # +# Just remove this... Its here to make you read ALL of the config # +# file options ;) # + +# + + + +#-#-#-#-#-#-#-#-#-#-#-#-#- SERVER OPTIONS -#-#-#-#-#-#-#-#-#-#-#-#-# +# # +# Settings to define which features are usable on your server. # +# # + + + + # suffixpart: What (if anything) users' part message + # should be suffixed with. + suffixpart=""" + + # fixedquit: Set all users' quit messages to this value. + #fixedquit="" + + # fixedpart: Set all users' part messages in all channels + # to this value. + #fixedpart="" + + # syntaxhints: If enabled, if a user fails to send the correct parameters + # for a command, the ircd will give back some help text of what + # the correct parameters are. + syntaxhints="no" + + # cyclehosts: If enabled, when a user gets a host set, it will cycle + # them in all their channels. If not, it will simply change their host + # without cycling them. + cyclehosts="yes" + + # cyclehostsfromuser: If enabled, the source of the mode change for + # cyclehosts will be the user who cycled. This can look nicer, but + # triggers anti-takeover mechanisms of some obsolete bots. + cyclehostsfromuser="no" + + # ircumsgprefix: Use undernet-style message prefixing for NOTICE and + # PRIVMSG. If enabled, it will add users' prefix to the line, if not, + # it will just message the user normally. + ircumsgprefix="no" + + # announcets: If set to yes, when the timestamp on a channel changes, all users + # in the channel will be sent a NOTICE about it. + announcets="yes" + + # allowmismatch: Setting this option to yes will allow servers to link even + # if they don't have the same "optionally common" modules loaded. Setting this to + # yes may introduce some desyncs and unwanted behaviour. + allowmismatch="no" + + # defaultbind: Sets the default for tags without an address. Choices are + # ipv4 or ipv6; if not specified, IPv6 will be used if your system has support, + # falling back to IPv4 otherwise. + defaultbind="auto" + + # hostintopic: If enabled, channels will show the host of the topic setter + # in the topic. If set to no, it will only show the nick of the topic setter. + hostintopic="yes" + + # pingwarning: If a server does not respond to a ping within x seconds, + # it will send a notice to opers with snomask +l informing that the server + # is about to ping timeout. + pingwarning="15" + + # serverpingfreq: How often pings are sent between servers (in seconds). + serverpingfreq="60" + + # defaultmodes: What modes are set on a empty channel when a user + # joins it and it is unregistered. + defaultmodes="nt" + + # moronbanner: This is the text that is sent to a user when they are + # banned from the server. + moronbanner="You're banned! Email abuse@example.com with the ERROR line below for help." + + # exemptchanops: exemptions for channel access restrictions based on prefix. + exemptchanops="nonick:v flood:o" + + # invitebypassmodes: This allows /invite to bypass other channel modes. + # (Such as +k, +j, +l, etc.) + invitebypassmodes="yes" + + # nosnoticestack: This prevents snotices from 'stacking' and giving you + # the message saying '(last message repeated X times)'. Defaults to no. + nosnoticestack="no" + + # welcomenotice: When turned on, this sends a NOTICE to connecting users + # with the text Welcome to ! after successful registration. + # Defaults to yes. + welcomenotice="yes"> + + +#-#-#-#-#-#-#-#-#-#-#-# PERFORMANCE CONFIGURATION #-#-#-#-#-#-#-#-#-#-# +# # + + + +#-#-#-#-#-#-#-#-#-#-#-# SECURITY CONFIGURATION #-#-#-#-#-#-#-#-#-#-#-# +# # + +