superconfig/machines/neoprism/ at 844eb05b64f33f402e2ce0ee7862c80bcd9bda93 · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / machines / neoprism

1 folder 5 files

at 844eb05b64f33f402e2ce0ee7862c80bcd9bda93

Hermes configs.services.matrix: remove the zulip bridge 2d ago

Update facts/secrets for service mycelium in machine neoprism

2 years ago

machines.neoprism: replace pocket-id with zitadel on id.lassul.us Zitadel 2.71 from nixpkgs as a federated IdP with open self-registration: registration, external IdPs and passkeys allowed in the default login policy, first instance "lassul.us" with admin user lass (lass@lassul.us). The masterkey and the admin's initial password come from the zitadel clan vars generator, the password via an extra steps file so it never hits the store. Postgres via peer auth over the local socket. ensureDatabases/ensureUsers create the database and owner role, so the zitadel role gets no CREATEROLE/CREATEDB (on PG15 CREATEROLE is close to superuser). That needs `init zitadel` + start-from-setup instead of the module's start-from-init, whose init always tries CREATE USER/CREATE DATABASE and fails on the permission check before the "already exists" check. nginx terminates TLS and talks h2c to Zitadel via grpc_pass, as Zitadel's reverse-proxy docs require for its gRPC APIs. Machine identification by hostname, since the default private-IP/GCP-webhook probes don't fit neoprism. The database is pg_dumped by the borg preHook; gatus checks /debug/healthz. Zitadel 2.71 does not work with PostgreSQL 18 (migration 34_add_cache_schema creates unlogged partitioned tables), neoprism runs 15.

3 days ago

configs.services.matrix: remove the zulip bridge We don't use the Matrix-Zulip bridge anymore, and its dependency python3.14-zulip-emoji-mapping fails to build with the current nixpkgs, which blocks the flake update.

2 days ago

radicle: run a public allow-all seed on neoprism (radicle.lassul.us, 80G quota) Extend 2configs/radicle.nix into a public seed: allow-all seeding (scope=all), listen 0.0.0.0:8776 + externalAddresses radicle.lassul.us:8776, radicle-httpd behind an nginx vhost (radicle.lassul.us, ACME). Drop the tor proxy + onion preferred seeds. Move the config off xerxes onto neoprism, and put the node state on tank at /var/lib/radicle with an 80G ZFS quota (radicle has no built-in byte quota; the dataset bounds it).

2 months ago

machines.neoprism: add facter.json

2 years ago

configs.kartei: drop krebs.users The option only fed lassul.us/ssh.pub, lassul.us/gpg.pub and makefu's key for the download user. ssh.pub now lists every key lass logs in with on neoprism, gpg.pub serves keys/pgp/yubi_pgp.pgp, and makefu's key is read from kartei directly.

1 week ago