64246a6615
Successfully deployed ops-jrz1 Matrix platform to production VPS using extracted modules from ops-base. Validated deployment workflow following ops-base best practices: boot -> reboot -> verify. Changes: - Pin sops-nix to June 2024 version for nixpkgs 24.05 compatibility - Configure sops secrets for Matrix registration token and ACME email - Add encrypted secrets.yaml (safe to commit, encrypted with age) - Document deployment process and lessons learned All services verified running: - Matrix homeserver (matrix-continuwuity): conduwuit 0.5.0-rc.8 - nginx: Proxying Matrix and Forgejo - PostgreSQL 15.10: Database services - Forgejo 7.0.12: Git platform Generated with Claude Code Co-Authored-By: Claude <noreply@anthropic.com>
75 lines
1.6 KiB
Nix
75 lines
1.6 KiB
Nix
{ config, pkgs, pkgs-unstable, ... }:
|
|
|
|
{
|
|
# ops-jrz1 production VPS configuration
|
|
# Imports extracted Matrix modules from ops-base
|
|
|
|
imports = [
|
|
# Hardware configuration
|
|
../hardware-configuration.nix
|
|
|
|
# Matrix platform modules
|
|
../modules/matrix-continuwuity.nix
|
|
../modules/mautrix-slack.nix
|
|
../modules/mautrix-whatsapp.nix
|
|
../modules/mautrix-gmessages.nix
|
|
../modules/dev-services.nix
|
|
../modules/security/fail2ban.nix
|
|
../modules/security/ssh-hardening.nix
|
|
../modules/matrix-secrets
|
|
];
|
|
|
|
# System configuration
|
|
networking.hostName = "jrz1";
|
|
|
|
# sops-nix secrets management
|
|
sops.defaultSopsFile = ../secrets/secrets.yaml;
|
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
|
|
sops.secrets.matrix-registration-token = {
|
|
owner = "continuwuity";
|
|
group = "continuwuity";
|
|
mode = "0440";
|
|
};
|
|
|
|
sops.secrets.acme-email = {
|
|
owner = "root";
|
|
mode = "0444";
|
|
};
|
|
|
|
# Matrix homeserver configuration
|
|
services.matrix-homeserver = {
|
|
enable = true;
|
|
domain = "clarun.xyz";
|
|
port = 8008;
|
|
enableRegistration = true;
|
|
enableFederation = false;
|
|
};
|
|
|
|
# Development platform services (Matrix, Forgejo, bridges)
|
|
services.dev-platform = {
|
|
enable = true;
|
|
domain = "clarun.xyz";
|
|
|
|
matrix = {
|
|
enable = true;
|
|
serverName = "clarun.xyz";
|
|
port = 8008;
|
|
};
|
|
|
|
forgejo = {
|
|
enable = true;
|
|
subdomain = "git";
|
|
port = 3000;
|
|
};
|
|
|
|
slackBridge = {
|
|
enable = true;
|
|
workspace = "delpadtech";
|
|
port = 29319;
|
|
};
|
|
};
|
|
|
|
system.stateVersion = "24.05";
|
|
}
|