remove opia infrastructure
12 files changed, 3 insertions(+), 418 deletions(-)
M flake.lock → flake.lock
@@ -195,24 +195,6 @@ "repo": "flake-utils", "type": "github" } }, - "flake-utils_5": { - "inputs": { - "systems": "systems_7" - }, - "locked": { - "lastModified": 1731533236, - "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "flake-utils", - "type": "github" - } - }, "gitignore": { "inputs": { "nixpkgs": [@@ -285,31 +267,6 @@ "repo": "gomod2nix", "type": "github" } }, - "gomod2nix_3": { - "inputs": { - "flake-utils": [ - "tg-auth", - "flake-utils" - ], - "nixpkgs": [ - "tg-auth", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1770585520, - "narHash": "sha256-yBz9Ozd5Wb56i3e3cHZ8WcbzCQ9RlVaiW18qDYA/AzA=", - "owner": "nix-community", - "repo": "gomod2nix", - "rev": "1201ddd1279c35497754f016ef33d5e060f3da8d", - "type": "github" - }, - "original": { - "owner": "nix-community", - "repo": "gomod2nix", - "type": "github" - } - }, "home-manager": { "inputs": { "nixpkgs": [@@ -355,7 +312,7 @@ }, "impermanence": { "inputs": { "home-manager": "home-manager_2", - "nixpkgs": "nixpkgs_6" + "nixpkgs": "nixpkgs_5" }, "locked": { "lastModified": 1769548169,@@ -529,22 +486,6 @@ } }, "nixpkgs_5": { "locked": { - "lastModified": 1770562336, - "narHash": "sha256-ub1gpAONMFsT/GU2hV6ZWJjur8rJ6kKxdm9IlCT0j84=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "d6c71932130818840fc8fe9509cf50be8c64634f", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "nixos-unstable", - "repo": "nixpkgs", - "type": "github" - } - }, - "nixpkgs_6": { - "locked": { "lastModified": 1768564909, "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=", "owner": "nixos",@@ -559,7 +500,7 @@ "repo": "nixpkgs", "type": "github" } }, - "nixpkgs_7": { + "nixpkgs_6": { "locked": { "lastModified": 1778737229, "narHash": "sha256-6xWoytx8jFW4PF1GjRm/i/53trbpKGfz6zjzQGBr4cI=",@@ -690,7 +631,6 @@ "rosetta-builder": "rosetta-builder", "scriptura": "scriptura", "searchix": "searchix", "srvos": "srvos", - "tg-auth": "tg-auth", "vpsadminos": "vpsadminos" } },@@ -885,39 +825,6 @@ "repo": "default", "type": "github" } }, - "systems_7": { - "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", - "owner": "nix-systems", - "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" - } - }, - "tg-auth": { - "inputs": { - "flake-utils": "flake-utils_5", - "gomod2nix": "gomod2nix_3", - "nixpkgs": "nixpkgs_5" - }, - "locked": { - "lastModified": 1773585135, - "narHash": "sha256-1NO3lNwGBV1Atlq9fbCxT+gRipRUXGvUTAB45LQBLoQ=", - "rev": "a81eb46a5298e315eb64a4094ca0eb93489ff935", - "type": "tarball", - "url": "https://codeberg.org/api/v1/repos/opia/tg-auth/archive/a81eb46a5298e315eb64a4094ca0eb93489ff935.tar.gz?rev=a81eb46a5298e315eb64a4094ca0eb93489ff935" - }, - "original": { - "type": "tarball", - "url": "https://codeberg.org/opia/tg-auth/archive/main.tar.gz" - } - }, "treefmt-nix": { "inputs": { "nixpkgs": [@@ -967,7 +874,7 @@ }, "vpsadminos": { "inputs": { "impermanence": "impermanence", - "nixpkgs": "nixpkgs_7", + "nixpkgs": "nixpkgs_6", "nixpkgsUnstable": "nixpkgsUnstable" }, "locked": {
D secrets/opia-codeberg-runner.age
@@ -1,7 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 knHzXw qyUYJJsJa/bejZxyGphz0Zuqu0ns9q1V/i9He+vmKyA -he21Qt5x+V9XabkiatrwCOj0HxI4cTcKZrHuum/1qAA --> piv-p256 VBDKjg AwZIxUdvwWVcO0mjd9dO7TaYQAwf9pGTcE1N+dSrlAqr -mTQDuFxKBsRsdMttSig79u2uyv/N3mQwLKrB17b1zTw ---- 1W39QjSZm0q0s9fym3mfiwsW9Rrfa6N7ch6L32/hxOA -x Hٵ5p1w wFb1M8s(;g5IJFGV_ PQK?Ϲ[
M secrets/secrets.nix → secrets/secrets.nix
@@ -27,8 +27,6 @@ powerdns = [ smrk ]; readeck = [ smrk ]; open-webui = [ smrk ]; codeberg-runner = [ smrk ]; - opia-codeberg-runner = [ smrk ]; - tg-archive = [ smrk ]; vpsfreectl = [ smrk ];
D secrets/tg-archive.age
@@ -1,7 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 knHzXw P0PJJgZ++oJW0jAyvAl+UwzF8nwjDyFimhnIC86I1Ug -S7sHqCk1rYRIfNSJZG2F3A1XX1eaRr7JG759rt5sbU0 --> piv-p256 VBDKjg A9EBq4BwUoIUcv1zZ+SWegbySpPLIw7RDTEoRvxALLGz -5ZcvVYly0Rf+rr9+WTfAXKaWLtc1URbBgqhFoEkU4HY ---- AcFoA3k7VRGD6AVptdWEO27IfbJKnXxbO709Dkh51Uk -T20=mMO^ g=np|OК KV2\'@&4b×*Leœ,w\!DŽb
D secrets/tgauth.age
@@ -1,7 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 knHzXw g88Ckhi0ORYj+Tc+pup4Wy9RdHePsDo+SP81mAjoox8 -AhrPtng7I0jECnTTw1mWmyY8W/JgnXI5KnuJGWdUN/A --> piv-p256 VBDKjg AkhWOZMTQb/PVpnfREIiPLuGLVjZb5z22dmSDvbHkuG+ -wLTG9z9fbowDgT3EJfxQd/gUM03/Gc9+8pR7rsVF2GA ---- RpE3fOI6W4RlqKOu3V07GeXPN0a+V8apGegXKH1FnwI -a<3 Θ)W۞} [WŴ𥇔ʐ6 *9Anք lWo{>pQG; {,E 1|3L(jZD1g Cj Hk8sOͤ۷+SŢG^,aRq \
M system/hosts/smrk.nix → system/hosts/smrk.nix
@@ -34,12 +34,6 @@ ../roles/sso.nix ../roles/syncthing.nix ../roles/video-library.nix ../roles/webserver/reverse-proxy.nix - - ../roles/opia/archive.nix - ../roles/opia/auth.nix - ../roles/opia/calendar.nix - ../roles/opia/ci.nix - ../roles/opia/wiki.nix ]; system.stateVersion = "25.11";
D system/roles/opia/archive.nix
@@ -1,131 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - domain = "opia.ovh"; - subdomain = "archive"; - - pkg = pkgs.tg-archive; - format = pkgs.formats.yaml { }; - - groups = { - main = "Opia Community Group Chat"; - }; - - # see https://github.com/knadh/tg-archive/blob/master/tgarchive/example/config.yaml - genCfg = name: group: { - inherit group; - - download_media = true; - download_avatars = true; - avatar_size = [ - 64 - 64 - ]; - media_dir = "media"; - - media_mime_types = [ ]; - - proxy = { - enable = false; - }; - - fetch_batch_size = 2000; - fetch_wait = 5; - fetch_limit = 0; - - publish_dir = "${config.users.users.tg-archive.home}/sites/${name}"; - static_dir = "static"; - per_page = 500; - show_day_index = true; - - telegram_url = "https://t.me/{id}"; - show_sender_fullname = false; - timezone = ""; # https://github.com/knadh/tg-archive/issues/130 - - publish_rss_feed = false; - rss_feed_entries = 100; - - site_url = "https://${subdomain}.${domain}"; - site_name = "@{group} - Telegram group archive"; - site_description = "Public archive of Telegram messages."; - meta_description = "@{group} {date} - Telegram message archive."; - page_title = "Page {page} - {date} @{group} Telegram message archive."; - }; - - genScript = - name: group: - let - cfgFile = format.generate "tg-archive.yaml" (genCfg name group); - dir = "data/${name}"; - in - '' - if test ! -d "${dir}" - then - ${lib.getExe pkg} --config ${cfgFile} --new --path ${dir} - fi - cd "${dir}" - - export API_ID API_HASH - - ${lib.getExe pkg} --config ${cfgFile} --sync - - ${lib.getExe pkg} --config ${cfgFile} --build - ''; -in -{ - age.secrets.tg-archive.file = ../../../secrets/tg-archive.age; - - users.groups.tg-archive = { - members = [ "caddy" ]; - }; - users.users.tg-archive = { - home = "/var/lib/tg-archive"; - homeMode = "750"; - createHome = true; - isSystemUser = true; - group = "tg-archive"; - }; - - environment.systemPackages = [ pkgs.tg-archive ]; - - systemd.services.tg-archive = { - description = "Telegram Archive"; - serviceConfig = { - Type = "oneshot"; - WorkingDirectory = config.users.users.tg-archive.home; - EnvironmentFile = [ config.age.secrets.tg-archive.path ]; - User = "tg-archive"; - Group = "tg-archive"; - }; - - preStart = '' - if test ! -d data - then - mkdir data - fi - if test ! -d sites - then - mkdir sites - fi - ''; - script = lib.concatMapAttrsStringSep "\n" genScript groups; - }; - - services.caddy.virtualHosts = { - "${subdomain}.${domain}" = { - extraConfig = '' - import tg_auth - tls { - dns_challenge_override_domain _acme-challenge.${subdomain}.opia.${config.networking.domain} - } - encode - root ${config.users.users.tg-archive.home}/sites/ - file_server browse - ''; - }; - }; -}
D system/roles/opia/auth.nix
@@ -1,58 +0,0 @@ -{ - config, - inputs, - ... -}: -let - domain = "opia.ovh"; - subdomain = "auth"; - port = 8083; -in -{ - imports = [ - inputs.tg-auth.nixosModules.tg-auth - ]; - - age.secrets.tgauth.file = ../../../secrets/tgauth.age; - - services.caddy = { - extraConfig = '' - (tg_auth) { - forward_auth localhost:${toString port} { - uri / - } - } - ''; - virtualHosts."${subdomain}.${domain}" = { - extraConfig = '' - tls { - dns_challenge_override_domain _acme-challenge.${subdomain}.opia.${config.networking.domain} - } - encode zstd gzip - reverse_proxy localhost:${toString port} - ''; - }; - }; - - services.tg-auth = { - enable = true; - - environment = { - PORT = toString port; - BOT_NAME = "OpiaCommunityBot"; # Username without @ - - SIGNIN_URL = "https://${subdomain}.${domain}/signin"; - SIGNIN_REDIRECT_CALLBACK_URL = "https://${subdomain}.${domain}/signin/callback"; - SIGNIN_AFTER_SIGNIN_URL = "https://${subdomain}.${domain}/"; - - AUTHZ_CHANNEL_IDS = "-1002285871016"; # may need "-100" in front, just "-" or neither - AUTHZ_CACHE = "5m"; - - AUTHN_COOKIE_NAME = "tgauth_session"; - AUTHN_COOKIE_DOMAIN = domain; - AUTHN_SESSION_TTL = "48h"; - }; - - environmentFile = config.age.secrets.tgauth.path; - }; -}
D system/roles/opia/calendar.nix
@@ -1,41 +0,0 @@ -{ config, pkgs, ... }: -let - domain = "opia.ovh"; - subdomain = "cal"; -in -{ - age.secrets.lauti.file = ../../../secrets/lauti.age; - - services.lauti = { - enable = true; - settings = { - LAUTI_ADDR = "localhost:3333"; - LAUTI_MAIL_ADDRESS = "lauti@${domain}"; - LAUTI_ADMIN_EMAIL = "lauti@${domain}"; - LAUTI_TIMEZONE = config.time.timeZone; - LAUTI_BASE_URL = "https://${subdomain}.${domain}"; - # LAUTI_ADMIN_PASSWORD = in secret - }; - secrets = [ config.age.secrets.lauti.path ]; - }; - # for debugging the database - environment.systemPackages = with pkgs; [ litecli ]; - - services.caddy = { - virtualHosts."${subdomain}.${domain}" = { - extraConfig = '' - tls { - dns_challenge_override_domain _acme-challenge.${subdomain}.opia.${config.networking.domain} - } - encode zstd gzip - - reverse_proxy ${config.services.lauti.settings.LAUTI_ADDR} { - header_up -Accept-Encoding - transport http { - compression off - } - } - ''; - }; - }; -}
D system/roles/opia/ci.nix
@@ -1,38 +0,0 @@ -{ - config, - pkgs, - lib, - ... -}: -let - nodeMajorVersion = lib.versions.major pkgs.nodejs.version; -in -{ - age.secrets.opia-codeberg.file = ../../../secrets/opia-codeberg-runner.age; - - services.gitea-actions-runner = { - instances.opia = { - name = config.networking.hostName; - enable = true; - url = "https://codeberg.org"; - tokenFile = config.age.secrets.opia-codeberg.path; - labels = [ - "docker:docker://node:${nodeMajorVersion}-alpine" - "alpine-latest:docker://node:${nodeMajorVersion}-alpine" - "nixos:host" - ]; - - hostPackages = with pkgs; [ - bash - coreutils - curl - gawk - config.programs.git.package - gnused - nix - nodejs - wget - ]; - }; - }; -}
D system/roles/opia/wiki.nix
@@ -1,24 +0,0 @@ -{ config, ... }: -let - domain = "opia.ovh"; - subdomain = "wiki"; -in -{ - services.gollum = { - enable = true; - emoji = true; - branch = "main"; - }; - - services.caddy.virtualHosts."${subdomain}.${domain}" = { - extraConfig = '' - tls { - dns_challenge_override_domain _acme-challenge.${subdomain}.opia.${config.networking.domain} - } - encode zstd gzip - reverse_proxy localhost:${toString config.services.gollum.port} - - import tg_auth - ''; - }; -}