forked from
lass.pds.lassul.us/superconfig
This repository has no description
2configs/silverbullet: remove (not realtime multiplayer)
author
lassulus
date
(Jul 25, 2026, 11:28 PM CEST)
commit
71ff9a3d
71ff9a3df31b9aa448634fbe421c04e590fa7926
parent
8aae1e3d
8aae1e3d4201e09f04a27c594a82af172e058ef6
+1
-85
-80
2configs/silverbullet.nix
-80
2configs/silverbullet.nix
···
1
-
{
2
-
config,
3
-
lib,
4
-
...
5
-
}:
6
-
let
7
-
publicDomain = "wiki.lassul.us";
8
-
adminDomain = "wiki-rw.lassul.us";
9
-
spaceDir = "/var/lib/silverbullet";
10
-
publicPort = 3000;
11
-
adminPort = 3001;
12
-
user = "silverbullet";
13
-
group = "silverbullet";
14
-
in
15
-
{
16
-
# SilverBullet auth is all-or-nothing per instance and has no OIDC client, so
17
-
# we run two instances over the same space:
18
-
# - public (wiki.lassul.us): anonymous, SB_READ_ONLY
19
-
# - admin (wiki-rw.lassul.us): read-write, no built-in auth; gated by the
20
-
# shared oauth2-proxy -> pocket-id SSO
21
-
# (see 2configs/oauth2-proxy.nix).
22
-
23
-
# --- Public, anonymous, read-only instance (nixpkgs module) -------------
24
-
services.silverbullet = {
25
-
enable = true;
26
-
inherit user group;
27
-
listenAddress = "127.0.0.1";
28
-
listenPort = publicPort;
29
-
spaceDir = spaceDir;
30
-
};
31
-
systemd.services.silverbullet.environment = {
32
-
SB_READ_ONLY = "1";
33
-
SB_SHELL_BACKEND = "off";
34
-
};
35
-
36
-
# --- Admin, read-write instance (no built-in auth; SSO in front) --------
37
-
systemd.services.silverbullet-admin = {
38
-
description = "SilverBullet (admin, read-write)";
39
-
after = [ "network.target" ];
40
-
wantedBy = [ "multi-user.target" ];
41
-
environment = {
42
-
SB_SHELL_BACKEND = "off";
43
-
# Forward-auth (oauth2-proxy) and SilverBullet's PWA service worker fight
44
-
# over redirects/caching; disabling the service worker sends every request
45
-
# straight to the server so auth behaves predictably.
46
-
SB_DISABLE_SERVICE_WORKER = "1";
47
-
};
48
-
serviceConfig = {
49
-
Type = "simple";
50
-
User = user;
51
-
Group = group;
52
-
StateDirectory = "silverbullet";
53
-
ExecStart = "${lib.getExe config.services.silverbullet.package} --port ${toString adminPort} --hostname 127.0.0.1 '${spaceDir}'";
54
-
Restart = "on-failure";
55
-
};
56
-
};
57
-
58
-
# Gate the read-write instance behind the shared pocket-id SSO layer.
59
-
services.oauth2-proxy.nginx.virtualHosts.${adminDomain} = { };
60
-
61
-
# --- nginx vhosts -------------------------------------------------------
62
-
services.nginx.virtualHosts.${publicDomain} = {
63
-
enableACME = true;
64
-
forceSSL = true;
65
-
locations."/" = {
66
-
proxyPass = "http://127.0.0.1:${toString publicPort}";
67
-
proxyWebsockets = true;
68
-
};
69
-
};
70
-
# The oauth2-proxy nginx module merges auth_request + /oauth2/ endpoints into
71
-
# this vhost; we only add ACME/TLS and the backend proxy to the admin app.
72
-
services.nginx.virtualHosts.${adminDomain} = {
73
-
enableACME = true;
74
-
forceSSL = true;
75
-
locations."/" = {
76
-
proxyPass = "http://127.0.0.1:${toString adminPort}";
77
-
proxyWebsockets = true;
78
-
};
79
-
};
80
-
}
+1
-3
2configs/dns/lassul.us.zone
+1
-3
2configs/dns/lassul.us.zone
···
1
-
@ 3600 IN SOA lassul.us. ns1.lassul.us. 2026060705 7200 3600 86400 3600
1
+
@ 3600 IN SOA lassul.us. ns1.lassul.us. 2026060706 7200 3600 86400 3600
2
2
3
3
;;@ 3600 IN NS ns1
4
4
@ 3600 IN NS ns1
···
57
57
n2n IN CNAME neoprism
58
58
id IN CNAME neoprism
59
59
auth IN CNAME neoprism
60
-
wiki IN CNAME neoprism
61
-
wiki-rw IN CNAME neoprism
62
60
63
61
;; Mail
64
62
@ IN MX 3 mail
-2
machines/neoprism/config.nix
-2
machines/neoprism/config.nix
···
103
103
../../2configs/pocket-id.nix
104
104
# shared oauth2-proxy forward-auth against pocket-id (auth.lassul.us)
105
105
../../2configs/oauth2-proxy.nix
106
-
# silverbullet wiki: wiki.lassul.us (public read) + wiki-rw.lassul.us (SSO write)
107
-
../../2configs/silverbullet.nix
108
106
];
109
107
110
108
# lassul.us shouldn't be the default vhost here (nginx.nix already sets one)