diff --git a/flake.lock b/flake.lock index 21fc9c1..0540f58 100644 --- a/flake.lock +++ b/flake.lock @@ -1056,11 +1056,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1711231723, - "narHash": "sha256-dARJQ8AJOv6U+sdRePkbcVyVbXJTi1tReCrkkOeusiA=", + "lastModified": 1711715736, + "narHash": "sha256-9slQ609YqT9bT/MNX9+5k5jltL9zgpn36DpFB7TkttM=", "owner": "nixos", "repo": "nixpkgs", - "rev": "e1d501922fd7351da4200e1275dfcf5faaad1220", + "rev": "807c549feabce7eddbf259dbdcec9e0600a0660d", "type": "github" }, "original": { @@ -1088,11 +1088,11 @@ }, "nixpkgs_11": { "locked": { - "lastModified": 1711124224, - "narHash": "sha256-l0zlN/3CiodvWDtfBOVxeTwYSRz93muVbXWSpaMjXxM=", + "lastModified": 1711668574, + "narHash": "sha256-u1dfs0ASQIEr1icTVrsKwg2xToIpn7ZXxW3RHfHxshg=", "owner": "nixos", "repo": "nixpkgs", - "rev": "56528ee42526794d413d6f244648aaee4a7b56c0", + "rev": "219951b495fc2eac67b1456824cc1ec1fd2ee659", "type": "github" }, "original": { @@ -1639,11 +1639,11 @@ "nixpkgs": "nixpkgs_12" }, "locked": { - "lastModified": 1710043304, - "narHash": "sha256-CrYHn6pIjvSUG2KPWXV7DWgZpmxV9ZdJv7UZuehVEvc=", + "lastModified": 1710691902, + "narHash": "sha256-Wx28gVRVPnES/JUT6m5V9TDeVkISIgYdghIy0noPOek=", "owner": "natsukagami", "repo": "youmubot", - "rev": "13683aa2297e7c3fb495a24987a96bd4dda09bbe", + "rev": "94dc225b86539a83be0c55c930cd6a4dab639f8d", "type": "github" }, "original": { diff --git a/home/modules/linux/graphical/default.nix b/home/modules/linux/graphical/default.nix index 24d3fed..5d4bf04 100644 --- a/home/modules/linux/graphical/default.nix +++ b/home/modules/linux/graphical/default.nix @@ -76,7 +76,7 @@ in ])); nki.programs.discord.enable = pkgs.stdenv.isx86_64; - nki.programs.discord.package = (pkgs.callPackage pkgs.unstable.vesktop.override { }).overrideAttrs (attrs: { + nki.programs.discord.package = (pkgs.callPackage pkgs.unstable.vesktop.override { stdenv = pkgs.gcc13Stdenv; }).overrideAttrs (attrs: { nativeBuildInputs = attrs.nativeBuildInputs ++ [ pkgs.nss_latest pkgs.makeWrapper ]; postInstall = '' makeWrapper $out/bin/vesktop $out/bin/discord diff --git a/modules/cloud/traefik/default.nix b/modules/cloud/traefik/default.nix index de30858..6a98728 100644 --- a/modules/cloud/traefik/default.nix +++ b/modules/cloud/traefik/default.nix @@ -20,6 +20,24 @@ let in valueType; + # https://www.cloudflare.com/ips/ + trustedIPs = + let + files = [ + (pkgs.fetchurl { + url = "https://www.cloudflare.com/ips-v4"; + hash = "sha256-8Cxtg7wBqwroV3Fg4DbXAMdFU1m84FTfiE5dfZ5Onns="; + }) + (pkgs.fetchurl { + url = "https://www.cloudflare.com/ips-v6"; + hash = "sha256-np054+g7rQDE3sr9U8Y/piAp89ldto3pN9K+KCNMoKk="; + }) + ]; + + readLines = path: lib.splitString "\n" (builtins.readFile path); + in + lib.concatMap readLines files; + cfg = config.cloud.traefik; in { @@ -57,6 +75,7 @@ in }; ## HTTPS entrypoint: ok! entrypoints.https.address = ":443"; + entrypoints.https.forwardedHeaders.trustedIPs = trustedIPs; ## IMAP and SMTP entrypoints.imap.address = ":993"; entrypoints.smtp-submission.address = ":587"; diff --git a/nki-personal-do/configuration.nix b/nki-personal-do/configuration.nix index 79601ee..25eb642 100644 --- a/nki-personal-do/configuration.nix +++ b/nki-personal-do/configuration.nix @@ -20,6 +20,7 @@ ./phanpy.nix ./invidious.nix ./owncast.nix + ./peertube.nix ]; common.linux.enable = false; # Don't enable the "common linux" module, this is a special machine. diff --git a/nki-personal-do/peertube.nix b/nki-personal-do/peertube.nix new file mode 100644 index 0000000..1366ff5 --- /dev/null +++ b/nki-personal-do/peertube.nix @@ -0,0 +1,80 @@ +{ config, lib, pkgs, ... }: +let + secrets = config.sops.secrets; + cfg = config.services.peertube; + + host = "peertube.dtth.ch"; + port = 19878; +in +{ + sops.secrets."peertube" = { owner = cfg.user; }; + sops.secrets."peertube-env" = { owner = cfg.user; }; + # database + cloud.postgresql.databases = [ "peertube" ]; + # traefik + cloud.traefik.hosts.peertube = { + inherit port host; + noCloudflare = true; + }; + + services.peertube = { + enable = true; + enableWebHttps = true; + listenWeb = 443; + listenHttp = port; + localDomain = host; + + secrets.secretsFile = secrets."peertube".path; + serviceEnvironmentFile = secrets."peertube-env".path; + + # Databases + redis.createLocally = true; + database = { + host = "/run/postgresql"; + }; + + # S3 + settings.object_storage = { + enabled = true; + + region = "auto"; + + proxy.proxify_private_files = false; + + web_videos = { + bucket_name = "dtthtube"; + prefix = "web-videos/"; + base_url = "https://content.peertube.dtth.ch"; + }; + streaming_playlists = { + bucket_name = "dtthtube"; + prefix = "hls-playlists/"; + base_url = "https://content.peertube.dtth.ch"; + }; + }; + + # Storage + settings.client.videos = { + resumable_upload.max_chunk_size = "90MB"; + }; + settings.storage = { + storyboards = "/var/lib/peertube/storage/storyboards/"; + tmp = "/mnt/data/peertube/tmp/"; + tmp_persistent = "/mnt/data/peertube/tmp_persistent/"; + web_videos = "/mnt/data/peertube/web-videos/"; + }; + + # Trust proxy + settings.trust_proxy = [ "loopback" ] ++ config.services.traefik.staticConfigOptions.entrypoints.https.forwardedHeaders.trustedIPs; + + # Federation + settings.federation = { + sign_federated_fetches = true; + videos.federate_unlisted = true; + videos.cleanup_remote_interactions = true; + }; + + dataDirs = [ "/var/lib/peertube" "/mnt/data/peertube" ]; + }; +} + diff --git a/nki-personal-do/secrets/secrets.yaml b/nki-personal-do/secrets/secrets.yaml index 9bc0dcf..4d132be 100644 --- a/nki-personal-do/secrets/secrets.yaml +++ b/nki-personal-do/secrets/secrets.yaml @@ -38,6 +38,8 @@ matrix-synapse-dtth: vaultwarden-env: ENC[AES256_GCM,data:BhUj7o+CiBW/EWIpp2WWmjsGgaGGQdksK5otdRUNQyObGuk0OxZsfzx7B24fMqDN5aPac/q2uAedkLGMUSdtqW42NjUo6XCo+ADrB9BWYeVstwKeYT9WAA40NMAP3L0c4i26Ice1C0Bh7K8CZAvG0lyzGeMCmt8lMRabePngEhLetAfW5EEV69x6h1yvVUgtcIuA35AiBMu2kQQllTmAF4GryleOBzOFhP6CiDopwpk+7qYq30YzOMJJNdH5w+MU+VogmRnBs7Z537Uf2IbT/zJjW0jFvBGLe9jetq6KNTB/Cnz2Jm7+c8UB,iv:ItcMYZB+XoQQcST4/+QfaQl6DPW1/Neh691xTzdm31s=,tag:fzifm2gVvLR4bvK64VNi2A==,type:str] invidious: ENC[AES256_GCM,data:pCRlBaHRJyOHj2t04V6DkGVAPuAc8hz+Sn24nQ3IvcXNIdaYijpy,iv:ZPrP6guN7oyOfys7tmIAX1M86cpHUwp9wh3OSHdPSHM=,tag:oxo2TZk/UOB0xKlpapNCVg==,type:str] invidious-rotator-env: ENC[AES256_GCM,data:Q5c/sga+Nn0C7bKkTphob3tWNvKE1Zz0CIbXIayc73cfEsUgOIZdrm8BlAW7,iv:f0ccZsjNJ9UQCcfN/lZQdtxSg9ADFuykb8qw07c1xFI=,tag:4mUzgOHOE16FPhSTlbx+Rw==,type:str] +peertube: ENC[AES256_GCM,data:YWySVZVTC26qPMcgSV5v4Vp1u69jGt7VV2ElQBSxvG/R589PCJRDgBqjjLBLMrrnP/wo6o6xNoyLCSfzMQYoFnM=,iv:97gNEJ84u4Mt5GTlVV29MNHUHQRkaMK47ULNUx+HTUE=,tag:LGVWeaTaSQ3GgaIpav66EA==,type:str] +peertube-env: ENC[AES256_GCM,data:AOAaojV5b2VRvOXKVTkFvFcGpMP2U5oGONZIyrWd17xFdFNY9gIXUwvQsj+VbzAj6a0gzoUgnY15lS3iMmjk2ZvO11bz1fooPByqb5pVaBUTRTv7f0lJzI+EQ0SWmcwbpmPJUSaOCY+v+0gSh3dBBIoZD1em4RYRoX1m9092XqjXmhjYa+y/2mp8V8sbnHZnM9eLaNQDx3p8nJq/Qnw7kreUbKsMSq8TMhpEBK8Q1/h58kUarDYfoTsJWnaizgbF6vLuenU4GZsvwqIQYTddh/mhdJYr1uNr5LolozoqxYReh7G2jRFmFe2BNwhZ9NHdVLIPwDT6tcVi0go3WQt/KX1NXf6mzJzqog==,iv:UWPe0wUC1ZfFBVLnksycoy0/e31t/jJyE73Av+Y0UjY=,tag:7+vpJtvrSaZjX7wQa20fkw==,type:str] sops: kms: [] gcp_kms: [] @@ -71,8 +73,8 @@ sops: by9kZFlTRVdCZFkxYTVVb0RIRk8zUlkKCqMw9oL9RaYBV5Hhy3o8Nm5xmGrPH8Sd hv36sxRFFNZT/DCKaHaSRbT3mfpBZSTXJt1dgl4nZe6whH54t/1KmA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-02-14T00:30:02Z" - mac: ENC[AES256_GCM,data:ObYeCKufpLE+atS3Iv8f6hkfq3AbwrYZcsgN/efk98F45tm9BFBbmzT4hWw1nHvA7Qw9fv+y/CjAZOb7/EIGaTdBtBP5pWMlZ8rTCpiY5UZr79p6O+/HNIZgmhd9iWH1k8Xarc118C0vfc7QgcJbTq0y+5DnaI/qdWBXn/RFOLg=,iv:SJBjGzwzMJBaUHyS9PQAxKJuuQp6Rkd6GtIqqwD1+C0=,tag:/dRybluTO+R43ZQhIX8Y5g==,type:str] + lastmodified: "2024-03-29T21:19:24Z" + mac: ENC[AES256_GCM,data:IxriC26V1jmtD8NSqSB0s7YfUgclBBAfnqnCQ7LdKNTBXzjcZPJyHzI76ZPKmRYtqlQEdnuHU+xX+CH+dBXsqNR2st8EKm8FSkrguNAKEpJeSWU97g3rlFTgKPMCeduxOp6lp25yHmYCOJ1k+1FKqYvEs3rbT8eEKJ+kGQA4S84=,iv:NXcZ29bL3/jSWmssS1066j7gzP4/hjyjy0i7AwrTB2M=,tag:rv4LdgDznx26SCsWUjaPgw==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.8.1 diff --git a/overlay.nix b/overlay.nix index 527948e..7dbc40a 100644 --- a/overlay.nix +++ b/overlay.nix @@ -11,6 +11,8 @@ let # Typst updates really quickly. typst = final.unstable.typst; typst-lsp = final.unstable.typst-lsp; + + peertube = final.unstable.peertube; }; overlay-imported = final: prev: { sway = prev.sway.override { sway-unwrapped = final.swayfx-unwrapped; };