747 lines
24 KiB
Nix
747 lines
24 KiB
Nix
{ self, linux-hardened, ... }: { lib, config, pkgs, ... }:
|
||
|
||
with lib; let
|
||
ports = {
|
||
acme = 1360;
|
||
nginx = 8080;
|
||
synapse = 8008;
|
||
unbound = 8484;
|
||
};
|
||
|
||
security-txt = pkgs.writeText "security.txt" ''
|
||
-----BEGIN SSH SIGNED MESSAGE-----
|
||
Canonical: https://solitary.social/.well-known/security.txt
|
||
Contact: mailto:mvs@nya.yt
|
||
Encryption: data:application/x-age-public-key,age1dexxdduwl37hsfdxde6le0satatrfv4geva0cxt8qqw3n46vgavsanuewp
|
||
Preferred-Languages: en, de
|
||
-----END SSH SIGNED MESSAGE-----
|
||
-----BEGIN SSH SIGNATURE-----
|
||
U1NIU0lHAAAAAQAAAEoAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgJzM8dH
|
||
Bj0wDAMaVwHRCAw4mNyksmFVTdyi+tb1EFLrYAAAAEc3NoOgAAAARmaWxlAAAAAAAAAAZz
|
||
aGE1MTIAAABnAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAQNoPCgqiDsNs8+
|
||
PyhjKdWF3P0TkA3gXH9fRSCRJvlMTz5hlhusz6ipEnKb8q/fYIwiuPsIJQseevg1kFZTe3
|
||
vAoBAAADlA==
|
||
-----END SSH SIGNATURE-----
|
||
'';
|
||
in {
|
||
imports = with self.nixosModules; [
|
||
default
|
||
headless
|
||
acme-ocsp
|
||
];
|
||
|
||
boot.loader.grub = {
|
||
enable = true;
|
||
device = "/dev/vda";
|
||
};
|
||
|
||
boot.kernelParams = [
|
||
"hugepagesz=1G" "hugepages=1"
|
||
];
|
||
|
||
boot.kernelPackages = let
|
||
inherit (linux-hardened.packages.x86_64-linux) paravirt;
|
||
in pkgs.linuxPackagesFor (paravirt.override {
|
||
instSetArch = "x86-64-v3";
|
||
extraConfig = with linux-hardened.lib.kernel; {
|
||
NR_CPUS = 8;
|
||
|
||
BTRFS_FS = true;
|
||
BTRFS_FS_POSIX_ACL = true;
|
||
|
||
CRYPTO_ZSTD = true;
|
||
};
|
||
});
|
||
|
||
environment.etc."machine-id".text = "1c97ae368741530de77aad42b5a6ae42";
|
||
|
||
ephemeral.device = "UUID=07a91cc3-4dd4-48e6-81d7-eb5d31fcf720";
|
||
ephemeral.boot.device = "UUID=24c72e0c-b467-4def-a641-ae09100465f0";
|
||
ephemeral.boot.fsType = "ext4";
|
||
|
||
i18n.supportedLocales = [ "C.UTF-8/UTF-8" "en_EU.UTF-8/UTF-8" "en_GB.UTF-8/UTF-8" ];
|
||
|
||
networking = {
|
||
hostName = "solitary";
|
||
domain = "social";
|
||
firewall.allowedTCPPorts = [ 22 80 443 853 ];
|
||
firewall.allowedUDPPorts = [ 443 ];
|
||
};
|
||
|
||
security.acme = {
|
||
certs.${config.networking.fqdn} = {
|
||
email = "mvs@nya.yt";
|
||
listenHTTP = "127.0.0.1:${toString ports.acme}";
|
||
reloadServices = [ "haproxy.service" "unbound.service" ];
|
||
extraDomainNames = [
|
||
"cache.solitary.social"
|
||
"matrix.solitary.social"
|
||
"media.solitary.social"
|
||
"resolve.solitary.social"
|
||
];
|
||
};
|
||
};
|
||
|
||
services.akkoma.enable = true;
|
||
services.akkoma.extraPackages = with pkgs; [ exiftool ffmpeg-headless imagemagick ];
|
||
services.akkoma.extraStatic."emoji/blobs.gg" = pkgs.akkoma-emoji.blobs_gg;
|
||
services.akkoma.extraStatic."static/terms-of-service.html" = pkgs.writeText "terms-of-service.html" ''
|
||
<h2>Commitments</h2>
|
||
<p>This was originally a single‐user instance and therefore I decided to formulate what would be <em>Terms of Service</em> for a multi‐user user instance as commitments. These are still incomplete and subject to expansion in the future.</p>
|
||
<ul>
|
||
<li>I shall observe and respect your boundaries.</li>
|
||
<li>I shall respect your right to disengage, and support you if you wish to disengage from others.</li>
|
||
<li>I shall accept that you may not want to be confronted with certain content and tag my posts appropriately.</li>
|
||
</ul>
|
||
'';
|
||
|
||
services.akkoma.extraStatic."favicon.png" = let
|
||
rev = "697a8211b0f427a921e7935a35d14bb3e32d0a2c";
|
||
in pkgs.stdenvNoCC.mkDerivation {
|
||
name = "favicon.png";
|
||
|
||
src = pkgs.fetchurl {
|
||
url = "https://raw.githubusercontent.com/TilCreator/NixOwO/${rev}/NixOwO_plain.svg";
|
||
hash = "sha256-tWhHMfJ3Od58N9H5yOKPMfM56hYWSOnr/TGCBi8bo9E=";
|
||
};
|
||
|
||
nativeBuildInputs = with pkgs; [ librsvg ];
|
||
|
||
dontUnpack = true;
|
||
installPhase = ''
|
||
rsvg-convert -o $out -w 96 -h 96 $src
|
||
'';
|
||
};
|
||
|
||
services.akkoma.dist.extraFlags = [
|
||
"-MMlp" "on"
|
||
"-MMsco" "true"
|
||
"-MMscs" "1024"
|
||
];
|
||
|
||
services.akkoma.config = let
|
||
elixir = pkgs.formats.elixirConf { };
|
||
attrsToTuples = lib.mapAttrsToList (name: value: elixir.lib.mkTuple [ name value ]);
|
||
in with elixir.lib; {
|
||
":pleroma" = {
|
||
":instance" = {
|
||
name = "solitary.social";
|
||
email = "mvs+solitary.social@nya.yt";
|
||
notify_email = "akkoma@solitary.social";
|
||
description = "Single‐user fediverse instance";
|
||
instance_thumbnail = "/instance/thumbnail.avif";
|
||
limit = 5120;
|
||
description_limit = 5120;
|
||
remote_limit = 131072;
|
||
upload_limit = 160 * 1024 * 1024;
|
||
avatar_upload_limit = 2097152;
|
||
background_upload_limit = 4194304;
|
||
banner_upload_limit = 4194304;
|
||
registrations_open = false;
|
||
account_approval_required = true;
|
||
remote_post_retention_days = 180;
|
||
user_bio_length = 5120;
|
||
user_name_length = 64;
|
||
max_account_fields = 8;
|
||
cleanup_attachments = true;
|
||
local_bubble = [
|
||
"florp.social"
|
||
];
|
||
};
|
||
|
||
"Pleroma.Web.Endpoint" = {
|
||
secret_key_base._secret = "/var/lib/secrets/akkoma/key-base";
|
||
signing_salt._secret = "/var/lib/secrets/akkoma/signing-salt";
|
||
live_view.signing_salt._secret = "/var/lib/secrets/akkoma/liveview-salt";
|
||
};
|
||
|
||
"Pleroma.Emails.Mailer" = {
|
||
enabled = true;
|
||
adapter = mkRaw "Swoosh.Adapters.SMTP";
|
||
relay = "localhost";
|
||
dkim = {
|
||
a = "ed25519-sha256";
|
||
s = "akkoma";
|
||
d = config.networking.fqdn;
|
||
private_key = mkTuple [
|
||
(mkAtom ":pem_plain")
|
||
(mkRaw ''File.read!("/var/lib/akkoma/dkim.pem")'')
|
||
];
|
||
};
|
||
};
|
||
|
||
":database".rum_enabled = true;
|
||
|
||
":media_proxy" = {
|
||
enabled = true;
|
||
base_url = "https://cache.solitary.social";
|
||
proxy_opts.redirect_on_failure = true;
|
||
proxy_opts.max_body_length = 64 * 1024 * 1024;
|
||
};
|
||
|
||
":media_preview_proxy" = {
|
||
enabled = true;
|
||
thumbnail_max_width = 1920;
|
||
thumbnail_max_height = 1080;
|
||
min_content_length = 128 * 1024;
|
||
};
|
||
|
||
"Pleroma.Upload".base_url = "https://media.solitary.social";
|
||
|
||
"Pleroma.Upload".filters = map mkRaw [
|
||
"Pleroma.Upload.Filter.Exiftool.ReadDescription"
|
||
"Pleroma.Upload.Filter.Exiftool.StripMetadata"
|
||
"Pleroma.Upload.Filter.Dedupe"
|
||
"Pleroma.Upload.Filter.AnonymizeFilename"
|
||
];
|
||
|
||
":mrf".policies = map mkRaw [
|
||
"Pleroma.Web.ActivityPub.MRF.SimplePolicy"
|
||
"Pleroma.Web.ActivityPub.MRF.ObjectAgePolicy"
|
||
];
|
||
|
||
":mrf_simple" = {
|
||
reject = attrsToTuples {
|
||
"bae.st" = "harassment";
|
||
"brighteon.social" = "incompatible";
|
||
"detroitriotcity.com" = "incompatible";
|
||
"freeatlantis.com" = "incompatible";
|
||
"freespeechextremist.com" = "incompatible";
|
||
"gab.com" = "incompatible";
|
||
"gleasonator.com" = "incompatible";
|
||
"kitsunemimi.club" = "incompatible";
|
||
"poa.st" = "incompatible";
|
||
"seal.cafe" = "harassment";
|
||
"social.quodverum.com" = "incompatible";
|
||
"spinster.xyz" = "incompatible";
|
||
"truthsocial.co.in" = "incompatible";
|
||
"varishangout.net" = "incompatible";
|
||
|
||
"activitypub-troll.cf" = "security";
|
||
"misskey-forkbomb.cf" = "security";
|
||
"repl.co" = "security";
|
||
};
|
||
|
||
followers_only = attrsToTuples {
|
||
"bitcoinhackers.org" = "annoying";
|
||
};
|
||
};
|
||
|
||
":mrf_object_age".threshold = 90 * 24 * 3600;
|
||
|
||
":frontend_configurations" = {
|
||
pleroma_fe = mkMap {
|
||
collapseMessageWithSubject = true;
|
||
hideSiteFavicon = true;
|
||
streaming = true;
|
||
webPushNotifications = true;
|
||
useStreamingApi = true;
|
||
scopeCopy = true;
|
||
showFeaturesPanel = false;
|
||
subjectLineBehavior = "masto";
|
||
alwaysShowSubjectInput = true;
|
||
postContentType = "text/markdown";
|
||
modalOnRepeat = true;
|
||
minimalScopesMode = true;
|
||
redirectRootNoLogin = "/mkl";
|
||
translationLanguage = "EN";
|
||
};
|
||
};
|
||
|
||
":restrict_unauthenticated" = {
|
||
timelines = mkMap {
|
||
local = false;
|
||
federated = true;
|
||
};
|
||
};
|
||
|
||
":translator" = {
|
||
enabled = true;
|
||
module = mkRaw "Pleroma.Akkoma.Translators.DeepL";
|
||
};
|
||
|
||
":deepl" = {
|
||
tier = mkAtom ":free";
|
||
api_key._secret = "/var/lib/secrets/akkoma/deepl";
|
||
};
|
||
};
|
||
|
||
":web_push_encryption".":vapid_details" = {
|
||
subject = "mailto:mvs+solitary.social@nya.yt";
|
||
public_key = "BPwdJZjBeZw_ZkWU_RQ48RdPI2pHIhMAYaNJc6xut4nQRi2YSaKnfP_kLrXzRjETQh5VJsDI-azYCeEhtk-C33s";
|
||
private_key._secret = "/var/lib/secrets/akkoma/vapid";
|
||
};
|
||
|
||
":joken".":default_signer"._secret = "/var/lib/secrets/akkoma/jwt-signer";
|
||
};
|
||
|
||
services.haproxy.enable = true;
|
||
services.haproxy.config =
|
||
let
|
||
ciphers = "ECDHE+CHACHA20:ECDHE+AESGCM";
|
||
cipherSuites = "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256";
|
||
options = "ssl-min-ver TLSv1.2 no-tls-tickets";
|
||
acmeDir = config.security.acme.certs.${config.networking.fqdn}.directory;
|
||
compTypes = [
|
||
"application/javascript"
|
||
"application/json"
|
||
"image/svg+xml"
|
||
"text/css"
|
||
"text/html"
|
||
"text/javascript"
|
||
"text/plain"
|
||
];
|
||
in ''
|
||
global
|
||
expose-experimental-directives
|
||
|
||
log stderr format short alert notice
|
||
|
||
maxconn 9216
|
||
nbthread 2
|
||
cpu-map auto:1/all 0-63
|
||
|
||
ssl-default-bind-ciphers ${ciphers}
|
||
ssl-default-bind-ciphersuites ${cipherSuites}
|
||
ssl-default-bind-options prefer-client-ciphers ${options}
|
||
|
||
ssl-default-server-ciphers ${ciphers}
|
||
ssl-default-server-ciphersuites ${cipherSuites}
|
||
ssl-default-server-options ${options}
|
||
|
||
defaults
|
||
log global
|
||
mode http
|
||
option abortonclose
|
||
option checkcache
|
||
option forwardfor
|
||
option http-keep-alive
|
||
option http-restrict-req-hdr-names reject
|
||
option httpchk
|
||
option splice-auto
|
||
option tcp-smart-connect
|
||
|
||
timeout connect 5s
|
||
timeout client 30s
|
||
timeout http-request 5s
|
||
timeout client-fin 5s
|
||
timeout tunnel 1h
|
||
timeout server 30s
|
||
timeout check 5s
|
||
|
||
cache default
|
||
total-max-size 16
|
||
max-age 240
|
||
|
||
frontend http
|
||
bind :::443 v4v6 defer-accept tfo ssl crt ${acmeDir}/full.pem allow-0rtt alpn h2,http/1.1
|
||
bind quic6@:443 v4v6 ssl crt ${acmeDir}/full.pem allow-0rtt alpn h3
|
||
bind :::80 v4v6 defer-accept tfo
|
||
|
||
acl replay-safe method GET HEAD OPTIONS req.body_size eq 0
|
||
|
||
acl host-solitary hdr(host),host_only solitary.social
|
||
acl host-cache hdr(host),host_only cache.solitary.social
|
||
acl host-media hdr(host),host_only media.solitary.social
|
||
acl host-matrix hdr(host),host_only matrix.solitary.social
|
||
acl host-resolve hdr(host),host_only resolve.solitary.social
|
||
|
||
acl path-acme path_reg ^/\.well-known/acme-challenge(/.*)?$
|
||
acl path-well-known path_beg /.well-known/
|
||
acl path-security.txt path /.well-known/security.txt
|
||
acl path-matrix-well-known path_reg ^/\.well-known/matrix(/.*)?$
|
||
acl path-proxy path_reg ^/proxy(/.*)?$
|
||
acl path-media path_reg ^/media(/.*)?$
|
||
|
||
#http-request normalize-uri fragment-strip
|
||
#http-request normalize-uri path-strip-dot
|
||
#http-request normalize-uri path-strip-dotdot full
|
||
#http-request normalize-uri path-merge-slashes
|
||
#http-request normalize-uri percent-decode-unreserved strict
|
||
#http-request normalize-uri percent-to-uppercase strict
|
||
#http-request normalize-uri query-sort-by-name
|
||
|
||
http-request redirect scheme https code 301 unless { ssl_fc } or path-acme
|
||
http-request wait-for-handshake unless replay-safe
|
||
|
||
http-request set-priority-class int(-1) if host-resolve
|
||
http-request set-priority-class int(1) if host-solitary
|
||
http-request set-priority-class int(2) if host-media
|
||
http-request set-priority-class int(3) if host-cache
|
||
http-request set-priority-class int(-2) if path-well-known
|
||
|
||
http-response set-tos 20 if host-resolve # AF22 (low‐latency, med drop)
|
||
http-response set-tos 10 if host-matrix # AF11 (high‐throughput, low drop)
|
||
http-response set-tos 12 if host-solitary # AF12 (high‐throughput, med drop)
|
||
http-response set-tos 14 if host-media # AF13 (high‐throughput, high drop)
|
||
http-response set-tos 14 if host-cache # AF13 (high‐throughput, high drop)
|
||
http-response set-tos 20 if path-well-known # AF22 (low‐latency, med drop)
|
||
|
||
http-request cache-use default
|
||
http-request set-header X-Forwarded-Proto %[ssl_fc,iif(https,http)]
|
||
|
||
http-response set-header Alt-Svc "h3=\":443\"; ma=7776000; persist=1, h2=\":443\"; ma=7776000; persist=1"
|
||
http-response set-header Cross-Origin-Embedder-Policy require-corp unless { res.hdr(Cross-Origin-Embedder-Policy) -m found }
|
||
http-response set-header Cross-Origin-Opener-Policy same-site unless { res.hdr(Cross-Origin-Opener-Policy) -m found }
|
||
http-response set-header Cross-Origin-Resource-Policy same-site unless { res.hdr(Cross-Origin-Resource-Policy) -m found }
|
||
http-response set-header Content-Security-Policy "default-src 'self'; frame-ancestors 'none'" unless { res.hdr(Content-Security-Policy) -m found }
|
||
http-response set-header Referrer-Policy same-origin unless { res.hdr(Referrer-Policy) -m found }
|
||
http-response set-header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
|
||
http-response set-header X-Frame-Options DENY
|
||
http-response set-header X-Content-Type-Options nosniff
|
||
http-response set-header X-XSS-Protection "1; mode=block"
|
||
|
||
compression algo gzip
|
||
compression type ${concatStringsSep " " compTypes}
|
||
http-response cache-store default
|
||
|
||
http-request redirect code 308 location https://media.solitary.social%[capture.req.uri,regsub("^/media","")] if host-solitary path-media
|
||
http-request redirect code 308 location https://media.solitary.social%[capture.req.uri,regsub("^/media","")] if host-media path-media
|
||
http-request redirect code 308 location https://cache.solitary.social%[capture.req.uri] if host-solitary path-proxy
|
||
http-request set-path "/media%[path]" if host-media !path-acme !path-media
|
||
|
||
use_backend acme if path-acme
|
||
use_backend security.txt if path-security.txt
|
||
use_backend unbound if host-resolve
|
||
use_backend synapse if host-matrix
|
||
use_backend wellknown-matrix if host-solitary path-matrix-well-known
|
||
use_backend nginx if host-cache
|
||
use_backend akkoma if host-solitary
|
||
use_backend akkoma if host-media
|
||
default_backend notfound
|
||
|
||
backend acme
|
||
server acme 127.0.0.1:${toString ports.acme}
|
||
retry-on all-retryable-errors
|
||
|
||
backend akkoma
|
||
server akkoma /run/akkoma/socket
|
||
|
||
backend nginx
|
||
server nginx [::1]:${toString ports.nginx} tfo proto h2
|
||
retry-on conn-failure empty-response response-timeout
|
||
|
||
backend synapse
|
||
server synapse [::1]:${toString ports.synapse}
|
||
|
||
backend unbound
|
||
server unbound [::1]:${toString ports.unbound} tfo ssl ssl-min-ver TLSv1.3 alpn h2 allow-0rtt ca-file ${acmeDir}/chain.pem
|
||
retry-on conn-failure empty-response response-timeout 0rtt-rejected
|
||
|
||
backend security.txt
|
||
http-request return status 200 content-type text/plain file ${security-txt} if { path /.well-known/security.txt }
|
||
|
||
backend wellknown-matrix
|
||
http-request return status 200 content-type application/json file ${pkgs.writeText "client.json" (builtins.toJSON {
|
||
"m.homeserver".base_url = config.services.matrix-synapse.settings.public_baseurl;
|
||
"m.identity_server".base_url = "https://vector.im";
|
||
})} if { path /.well-known/matrix/client }
|
||
|
||
http-request return status 200 content-type application/json file ${pkgs.writeText "server.json" (builtins.toJSON {
|
||
"m.server" = "matrix.solitary.social:443";
|
||
})} if { path /.well-known/matrix/server }
|
||
|
||
backend notfound
|
||
http-request return status 404
|
||
'';
|
||
|
||
services.matrix-synapse.enable = true;
|
||
services.matrix-synapse.settings = {
|
||
database_type = "psycopg2";
|
||
server_name = "solitary.social";
|
||
public_baseurl = "https://matrix.solitary.social/";
|
||
default_identity_server = "https://vector.im";
|
||
enable_registration = false;
|
||
|
||
listeners = [ {
|
||
bind_addresses = [ "::1" ];
|
||
port = ports.synapse;
|
||
type = "http";
|
||
tls = false;
|
||
x_forwarded = true;
|
||
|
||
resources = [ {
|
||
names = [ "client" "federation" ];
|
||
compress = true;
|
||
} ];
|
||
} ];
|
||
|
||
log_config = ./log_config.yaml;
|
||
};
|
||
|
||
services.nginx = {
|
||
enable = true;
|
||
|
||
package = pkgs.tengine;
|
||
|
||
recommendedGzipSettings = true;
|
||
recommendedOptimisation = true;
|
||
recommendedProxySettings = true;
|
||
|
||
commonHttpConfig = ''
|
||
charset utf-8;
|
||
proxy_cache_path /var/cache/nginx/cache/akkoma_media_cache
|
||
levels= keys_zone=akkoma_media_cache:16m max_size=16g
|
||
inactive=1y use_temp_path=off;
|
||
access_log off;
|
||
|
||
set_real_ip_from ::1;
|
||
real_ip_header X-Forwarded-For;
|
||
'';
|
||
};
|
||
|
||
services.nginx.virtualHosts."cache.solitary.social" = {
|
||
listen = [ {
|
||
addr = "[::1]";
|
||
port = ports.nginx;
|
||
extraParameters = [ "http2" "fastopen=512" ];
|
||
} ];
|
||
locations."/" = {
|
||
proxyPass = "http://unix:/run/akkoma/socket";
|
||
extraConfig = ''
|
||
proxy_cache akkoma_media_cache;
|
||
slice 1m;
|
||
proxy_cache_key $host$uri$is_args$args$slice_range;
|
||
proxy_set_header Range $slice_range;
|
||
|
||
proxy_buffering on;
|
||
proxy_cache_lock on;
|
||
proxy_ignore_client_abort on;
|
||
|
||
proxy_cache_valid 200 1y;
|
||
proxy_cache_valid 206 301 304 1h;
|
||
|
||
proxy_cache_use_stale error timeout invalid_header updating;
|
||
'';
|
||
};
|
||
};
|
||
|
||
services.postfix = {
|
||
enable = true;
|
||
destination = [ ];
|
||
localRecipients = [ ];
|
||
networks = [ "localhost" ];
|
||
hostname = config.networking.fqdn;
|
||
masterConfig.smtp_inet.name = mkForce "localhost:smtp";
|
||
};
|
||
|
||
services.postgresql = {
|
||
enable = true;
|
||
package = pkgs.postgresql_16;
|
||
|
||
extraPlugins = with pkgs.postgresql_16.pkgs; [
|
||
rum
|
||
];
|
||
|
||
settings = {
|
||
max_connections = 128;
|
||
|
||
shared_buffers = "768MB";
|
||
huge_pages = "try";
|
||
huge_page_size = "2MB";
|
||
work_mem = "16MB";
|
||
|
||
effective_io_concurrency = 128;
|
||
|
||
wal_compression = "zstd";
|
||
};
|
||
|
||
initialScript = pkgs.writeText "init.psql" ''
|
||
CREATE ROLE "matrix-synapse";
|
||
CREATE DATABASE "matrix-synapse" OWNER "matrix-synapse"
|
||
TEMPLATE template0
|
||
ENCODING 'utf8'
|
||
LOCALE 'C';
|
||
'';
|
||
};
|
||
|
||
services.unbound = {
|
||
enable = true;
|
||
|
||
package = pkgs.unbound-with-systemd.override {
|
||
withDoH = true;
|
||
withTFO = true;
|
||
};
|
||
|
||
enableRootTrustAnchor = true;
|
||
};
|
||
|
||
|
||
services.unbound.settings = {
|
||
server = let
|
||
acmeDir = config.security.acme.certs.${config.networking.fqdn}.directory;
|
||
num-threads = 2;
|
||
in {
|
||
inherit num-threads;
|
||
|
||
interface = [
|
||
"::1@53"
|
||
"127.0.0.1@53"
|
||
|
||
"::1@${toString ports.unbound}"
|
||
|
||
"::@853"
|
||
"0.0.0.0@853"
|
||
];
|
||
|
||
so-reuseport = true;
|
||
ip-dscp = 20;
|
||
outgoing-range = 8192;
|
||
edns-buffer-size = 1472;
|
||
udp-upstream-without-downstream = true;
|
||
num-queries-per-thread = 4096;
|
||
incoming-num-tcp = 1024;
|
||
outgoing-num-tcp = 16;
|
||
stream-wait-size = "64m";
|
||
msg-cache-size = "128m";
|
||
msg-cache-slabs = num-threads;
|
||
rrset-cache-size = "256m";
|
||
rrset-cache-slabs = num-threads;
|
||
infra-cache-slabs = num-threads;
|
||
key-cache-slabs = num-threads;
|
||
cache-min-ttl = 60;
|
||
cache-max-negative-ttl = 360;
|
||
prefer-ip6 = true;
|
||
tls-service-pem = "${acmeDir}/fullchain.pem";
|
||
tls-service-key = "${acmeDir}/key.pem";
|
||
https-port = ports.unbound;
|
||
http-query-buffer-size = "64m";
|
||
http-response-buffer-size = "64m";
|
||
access-control = [ "::/0 allow" "0.0.0.0/0 allow" ];
|
||
harden-dnssec-stripped = true;
|
||
hide-identity = true;
|
||
hide-version = true;
|
||
prefetch = true;
|
||
prefetch-key = true;
|
||
serve-expired-client-timeout = 1800;
|
||
};
|
||
};
|
||
|
||
systemd = let
|
||
backendServices = [
|
||
"akkoma.service"
|
||
"matrix-synapse.service"
|
||
"nginx.service"
|
||
"unbound.service"
|
||
];
|
||
in {
|
||
services.akkoma.confinement.enable = false;
|
||
services.akkoma.serviceConfig.BindReadOnlyPaths = [ "/var/lib/akkoma:/var/lib/akkoma:norbind" ];
|
||
|
||
services.haproxy = {
|
||
confinement.enable = false;
|
||
|
||
wants = [ "acme-finished-${config.networking.fqdn}.service" ]
|
||
++ backendServices;
|
||
after = [ "acme-selfsigned-${config.networking.fqdn}.service" ]
|
||
++ backendServices;
|
||
before = [ "acme-${config.networking.fqdn}.service" ];
|
||
|
||
reloadTriggers = [ "${config.security.acme.certs.${config.networking.fqdn}.directory}/cert.ocsp" ];
|
||
|
||
serviceConfig = {
|
||
BindReadOnlyPaths = [
|
||
"/etc/haproxy.cfg"
|
||
"/etc/hosts"
|
||
"/etc/resolv.conf"
|
||
"/run/akkoma"
|
||
config.security.acme.certs."solitary.social".directory
|
||
security-txt
|
||
];
|
||
|
||
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
|
||
SocketBindAllow = [ "tcp:80" "tcp:443" "udp:443" ];
|
||
SocketBindDeny = "any";
|
||
};
|
||
};
|
||
|
||
services.nginx = {
|
||
confinement.enable = true;
|
||
after = [ "akkoma.service" ];
|
||
serviceConfig = {
|
||
BindReadOnlyPaths = [
|
||
"/etc/hosts"
|
||
"/etc/resolv.conf"
|
||
"/run"
|
||
];
|
||
|
||
BindPaths = [
|
||
"/var/cache/nginx"
|
||
];
|
||
|
||
ProtectSystem = mkForce false;
|
||
SocketBindAllow = [ "tcp:${toString ports.nginx}" ];
|
||
SocketBindDeny = "any";
|
||
RestrictNetworkInterfaces = [ "lo" ];
|
||
};
|
||
};
|
||
|
||
services.unbound = {
|
||
wants = [ "acme-finished-${config.networking.fqdn}.service" ];
|
||
after = [ "acme-selfsigned-${config.networking.fqdn}.service" ];
|
||
};
|
||
|
||
services.synapse-compress-state = {
|
||
confinement.enable = true;
|
||
|
||
after = [ "postgresql.service" ];
|
||
description = "Compress Synapse state tables";
|
||
serviceConfig = {
|
||
Type = "oneshot";
|
||
ExecStart = ''
|
||
${pkgs.matrix-synapse-tools.rust-synapse-compress-state}/bin/synapse_auto_compressor \
|
||
-p "host=/run/postgresql \
|
||
user=${config.services.matrix-synapse.settings.database.args.database} \
|
||
dbname=${config.services.matrix-synapse.settings.database.args.database}" \
|
||
-c 512 -n 128
|
||
'';
|
||
User = "matrix-synapse";
|
||
WorkingDirectory = "/tmp";
|
||
|
||
BindReadOnlyPaths = [
|
||
"/run/postgresql"
|
||
];
|
||
|
||
ProtectProc = "noaccess";
|
||
ProcSubset = "pid";
|
||
ProtectHome = true;
|
||
PrivateTmp = true;
|
||
PrivateDevices = true;
|
||
PrivateIPC = true;
|
||
ProtectHostname = true;
|
||
ProtectClock = true;
|
||
ProtectKernelTunables = true;
|
||
ProtectKernelModules = true;
|
||
ProtectKernelLogs = true;
|
||
ProtectControlGroups = true;
|
||
|
||
RestrictAddressFamilies = [ "AF_UNIX" ];
|
||
RestrictNamespaces = true;
|
||
LockPersonality = true;
|
||
RestrictRealtime = true;
|
||
RestrictSUIDSGID = true;
|
||
RemoveIPC = true;
|
||
|
||
CapabilityBoundingSet = null;
|
||
NoNewPrivileges = true;
|
||
SystemCallFilter = [ "@system-service" "~@resources" "~@privileged" ];
|
||
SystemCallArchitectures = "native";
|
||
|
||
UMask = "0077";
|
||
};
|
||
};
|
||
|
||
timers.synapse-compress-state = {
|
||
enable = true;
|
||
description = "Compress Synapse state tables daily";
|
||
timerConfig = {
|
||
OnCalendar = "04:00";
|
||
};
|
||
|
||
wantedBy = [ "timers.target" ];
|
||
};
|
||
};
|
||
|
||
users.users.${config.services.haproxy.user}.extraGroups = [ config.security.acme.certs.${config.networking.fqdn}.group ];
|
||
users.users.${config.services.unbound.user}.extraGroups = [ config.security.acme.certs.${config.networking.fqdn}.group ];
|
||
}
|