894e7241f1
- Add speckit workflow infrastructure (.claude, .specify) - Create NixOS configuration skeleton (flake.nix, configuration.nix, hosts/ops-jrz1.nix) - Add sanitization scripts with 22 rules for personal info removal - Add validation scripts with gitleaks integration - Configure git hooks (pre-commit, pre-push) for security validation - Add project documentation (README, LICENSE) - Add comprehensive .gitignore for Nix, secrets, staging Phase 1 and Phase 2 complete. Foundation ready for module extraction from ops-base.
119 lines
3.8 KiB
Markdown
119 lines
3.8 KiB
Markdown
# ops-jrz1 NixOS Server Configuration
|
|
|
|
**Status**: Work in Progress - Matrix Platform Extraction
|
|
|
|
This repository contains the NixOS configuration for the ops-jrz1 dev/test server, including extracted Matrix homeserver modules and bridge configurations from the ops-base production environment.
|
|
|
|
## Overview
|
|
|
|
The ops-jrz1 server provides a Matrix homeserver (Continuwuity/Conduwuit) with bridges for:
|
|
- Slack (mautrix-slack)
|
|
- WhatsApp (mautrix-whatsapp)
|
|
- Google Messages (mautrix-gmessages)
|
|
|
|
Additional services:
|
|
- Security hardening (fail2ban, SSH hardening)
|
|
- Secrets management (sops-nix with age encryption)
|
|
|
|
## Current Status
|
|
|
|
**Phase**: Extracting and sanitizing modules from ops-base
|
|
|
|
- [x] Repository structure created
|
|
- [x] Skeleton configuration files (flake.nix, configuration.nix, hosts/ops-jrz1.nix)
|
|
- [x] Sanitization and validation scripts
|
|
- [x] Git hooks for security validation
|
|
- [ ] Module extraction from ops-base
|
|
- [ ] Documentation (deployment guides, bridge setup)
|
|
- [ ] Server deployment and testing
|
|
|
|
## Repository Structure
|
|
|
|
```
|
|
ops-jrz1/
|
|
├── flake.nix # Nix flake configuration
|
|
├── configuration.nix # Main NixOS configuration
|
|
├── hosts/
|
|
│ └── ops-jrz1.nix # Server-specific configuration
|
|
├── modules/ # Extracted Matrix platform modules (pending)
|
|
├── docs/ # Deployment and setup documentation (pending)
|
|
├── secrets/ # sops-nix encrypted secrets (gitignored)
|
|
├── scripts/ # Sanitization and validation scripts
|
|
│ ├── sanitize-files.sh
|
|
│ └── validate-sanitization.sh
|
|
└── specs/ # Project planning and specifications
|
|
└── 001-extract-matrix-platform/
|
|
|
|
```
|
|
|
|
## Planned Features
|
|
|
|
### Matrix Homeserver
|
|
- **Continuwuity/Conduwuit**: Lightweight Rust-based Matrix homeserver
|
|
- Federation support
|
|
- User registration with tokens
|
|
- Admin room for management
|
|
|
|
### Bridges
|
|
- **Slack**: Socket Mode authentication, workspace integration
|
|
- **WhatsApp**: QR code pairing, message synchronization
|
|
- **Google Messages**: Pairing flow, SMS/MMS support
|
|
|
|
### Security & Operations
|
|
- **fail2ban**: Intrusion prevention
|
|
- **SSH hardening**: Key-only authentication, restricted access
|
|
- **sops-nix**: Encrypted secrets management with age keys
|
|
- **Git hooks**: Pre-commit validation, pre-push build checks
|
|
|
|
## Development Workflow
|
|
|
|
### Prerequisites
|
|
- NixOS 24.05+ or Nix with flakes enabled
|
|
- SSH access to ops-jrz1 server
|
|
- Age encryption key for secrets management
|
|
|
|
### Building Locally
|
|
```bash
|
|
# Check flake validity
|
|
nix flake check
|
|
|
|
# Build ops-jrz1 configuration
|
|
nix build .#nixosConfigurations.ops-jrz1
|
|
|
|
# Deploy to server (when ready)
|
|
nixos-rebuild switch --flake .#ops-jrz1 --target-host root@ops-jrz1
|
|
```
|
|
|
|
### Sanitization Workflow
|
|
```bash
|
|
# Extract modules from ops-base
|
|
./scripts/sanitize-files.sh ~/proj/ops-base/modules staging/modules
|
|
|
|
# Validate sanitization
|
|
./scripts/validate-sanitization.sh staging/modules
|
|
|
|
# Move to permanent location
|
|
mv staging/modules/* modules/
|
|
```
|
|
|
|
## Security Notes
|
|
|
|
- **Never commit secrets**: All secrets managed via sops-nix, encrypted with age keys
|
|
- **Git hooks active**: Pre-commit hooks validate for personal information leakage
|
|
- **Sanitization enforced**: All extracted code must pass validation before commit
|
|
|
|
## License
|
|
|
|
MIT License (see LICENSE file)
|
|
|
|
## Related Documentation
|
|
|
|
- Project Specification: `specs/001-extract-matrix-platform/spec.md`
|
|
- Implementation Plan: `specs/001-extract-matrix-platform/plan.md`
|
|
- Task Breakdown: `specs/001-extract-matrix-platform/tasks.md`
|
|
- Sanitization Rules: `specs/001-extract-matrix-platform/contracts/sanitization-rules.yaml`
|
|
|
|
---
|
|
|
|
**Note**: This repository is currently in active development. Documentation and deployment guides will be added as modules are extracted and tested.
|