imterah/nix-infra
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

feature: Add Synapse and Tailscale

Browse source
This commit is contained in:
Tera << 8 2025-05-09 22:44:15 -04:00
parent b743a17022
commit 21c29fcfd0
Signed by: imterah
GPG key ID: 8FA7DD57BA6CEA37
6 changed files with 271 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

8
hosts/andromeda/configuration.nix
View file

@ -20,6 +20,7 @@
./stacks/traefik/docker-compose.nix
./stacks/caddy/docker-compose.nix
## Internal
./stacks/tailscale/docker-compose.nix
./stacks/portainer/docker-compose.nix
./stacks/passbolt/docker-compose.nix
./stacks/pterodactyl/docker-compose.nix
@ -28,6 +29,7 @@
./stacks/terah.dev/docker-compose.nix
./stacks/mcaptcha/docker-compose.nix
./stacks/forgejo/docker-compose.nix
./stacks/synapse/docker-compose.nix
];
users.mutableUsers = false;
@ -90,6 +92,12 @@
};
};
# Tailscale fixer-uppers
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
"net.ipv6.conf.all.forwarding" = 1;
};
# Volumes
fileSystems."/mnt/NASBox" = {
device = "192.168.0.3:/mnt/Diskette/KubeData";

147
hosts/andromeda/stacks/synapse/docker-compose.nix Normal file
View file

@ -0,0 +1,147 @@
# Auto-generated using compose2nix v0.3.1.
{ config, pkgs, lib, ... }:
{
imports = [
../../../../system/sops.nix
];
# Containers
virtualisation.oci-containers.containers."synapse-db" = {
image = "docker.io/postgres:17.5";
environmentFiles = [ config.sops.secrets.synapse_db_docker_env.path ];
environment = {
"POSTGRES_INITDB_ARGS" = "--encoding=UTF-8 --lc-collate=C --lc-ctype=C";
"POSTGRES_USER" = "synapse";
};
volumes = [
"synapse_db:/var/lib/postgresql/data:rw"
];
log-driver = "journald";
extraOptions = [
"--network-alias=db"
"--network=synapse_default"
];
};
systemd.services."docker-synapse-db" = {
serviceConfig = {
Restart = lib.mkOverride 90 "no";
};
after = [
"docker-network-synapse_default.service"
"docker-volume-synapse_db.service"
];
requires = [
"docker-network-synapse_default.service"
"docker-volume-synapse_db.service"
];
partOf = [
"docker-compose-synapse-root.target"
];
wantedBy = [
"docker-compose-synapse-root.target"
];
};
virtualisation.oci-containers.containers."synapse-synapse" = {
image = "docker.io/matrixdotorg/synapse:latest";
environment = {
"SYNAPSE_CONFIG_PATH" = "/data/homeserver.yaml";
};
volumes = [
"synapse_synapse:/data:rw"
"/mnt/NASBox/synapse/uploads:/data/media_store:rw"
"${config.sops.secrets.synapse_synapse_docker_env.path}:/data/homeserver.yaml:ro"
"${config.sops.secrets.synapse_synapse_signing_docker_env.path}:/data/matrix.terah.dev.signing.key:ro"
];
labels = {
"traefik.enable" = "true";
"traefik.http.routers.http-synapse.entryPoints" = "http";
"traefik.http.routers.http-synapse.rule" = "Host(`matrix.terah.dev`)";
};
dependsOn = [
"synapse-db"
];
log-driver = "journald";
extraOptions = [
"--network-alias=synapse"
"--network=synapse_default"
];
};
systemd.services."docker-synapse-synapse" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
RestartMaxDelaySec = lib.mkOverride 90 "1m";
RestartSec = lib.mkOverride 90 "100ms";
RestartSteps = lib.mkOverride 90 9;
};
after = [
"docker-network-synapse_default.service"
"docker-volume-synapse_synapse.service"
];
requires = [
"docker-network-synapse_default.service"
"docker-volume-synapse_synapse.service"
];
partOf = [
"docker-compose-synapse-root.target"
];
wantedBy = [
"docker-compose-synapse-root.target"
];
};
# Networks
systemd.services."docker-network-synapse_default" = {
path = [ pkgs.docker ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "docker network rm -f synapse_default";
};
script = ''
docker network inspect synapse_default || docker network create synapse_default
'';
partOf = [ "docker-compose-synapse-root.target" ];
wantedBy = [ "docker-compose-synapse-root.target" ];
};
# Volumes
systemd.services."docker-volume-synapse_db" = {
path = [ pkgs.docker ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
docker volume inspect synapse_db || docker volume create synapse_db
'';
partOf = [ "docker-compose-synapse-root.target" ];
wantedBy = [ "docker-compose-synapse-root.target" ];
};
systemd.services."docker-volume-synapse_synapse" = {
path = [ pkgs.docker ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
docker volume inspect synapse_synapse || docker volume create synapse_synapse
'';
partOf = [ "docker-compose-synapse-root.target" ];
wantedBy = [ "docker-compose-synapse-root.target" ];
};
# Root service
# When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources.
systemd.targets."docker-compose-synapse-root" = {
unitConfig = {
Description = "Root target generated by compose2nix.";
};
wantedBy = [ "multi-user.target" ];
};
}

91
hosts/andromeda/stacks/tailscale/docker-compose.nix Normal file
View file

@ -0,0 +1,91 @@
# Auto-generated using compose2nix v0.3.1.
{ config, pkgs, lib, ... }:
{
imports = [
../../../../system/sops.nix
];
# Containers
virtualisation.oci-containers.containers."tailscale-tailscale" = {
image = "tailscale/tailscale:latest";
environmentFiles = [ config.sops.secrets.tailscale_docker_env.path ];
environment = {
"TS_EXTRA_ARGS" = "--advertise-tags=tag:container --advertise-routes=192.168.0.0/24 --advertise-routes=192.168.1.0/24 --advertise-routes=192.168.2.0/24 --advertise-routes=192.168.3.0/24 --advertise-routes=192.168.4.0/24 --advertise-exit-node";
"TS_STATE_DIR" = "/var/lib/tailscale";
"TS_USERSPACE" = "false";
};
volumes = [
"tailscale_tailscale:/var/lib/tailscale:rw"
];
log-driver = "journald";
extraOptions = [
"--cap-add=net_admin"
"--device=/dev/net/tun:/dev/net/tun:rwm"
"--network-alias=tailscale"
"--network=tailscale_default"
];
};
systemd.services."docker-tailscale-tailscale" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
RestartMaxDelaySec = lib.mkOverride 90 "1m";
RestartSec = lib.mkOverride 90 "100ms";
RestartSteps = lib.mkOverride 90 9;
};
after = [
"docker-network-tailscale_default.service"
"docker-volume-tailscale_tailscale.service"
];
requires = [
"docker-network-tailscale_default.service"
"docker-volume-tailscale_tailscale.service"
];
partOf = [
"docker-compose-tailscale-root.target"
];
wantedBy = [
"docker-compose-tailscale-root.target"
];
};
# Networks
systemd.services."docker-network-tailscale_default" = {
path = [ pkgs.docker ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "docker network rm -f tailscale_default";
};
script = ''
docker network inspect tailscale_default || docker network create tailscale_default
'';
partOf = [ "docker-compose-tailscale-root.target" ];
wantedBy = [ "docker-compose-tailscale-root.target" ];
};
# Volumes
systemd.services."docker-volume-tailscale_tailscale" = {
path = [ pkgs.docker ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
docker volume inspect tailscale_tailscale || docker volume create tailscale_tailscale
'';
partOf = [ "docker-compose-tailscale-root.target" ];
wantedBy = [ "docker-compose-tailscale-root.target" ];
};
# Root service
# When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources.
systemd.targets."docker-compose-tailscale-root" = {
unitConfig = {
Description = "Root target generated by compose2nix.";
};
wantedBy = [ "multi-user.target" ];
};
}