diff --git a/.sops.yaml b/.sops.yaml index 479ff22..dc3cb40 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -137,7 +137,7 @@ creation_rules: - age: - *admin_cow - *host_reverse-proxy - path_regex: secrets/(irc.yaml|oauth2-proxy.yaml|miniflux.env|radicale.htpasswd|atproto.env)$ + path_regex: secrets/(irc.yaml|oauth2-proxy.yaml|miniflux.env|radicale.htpasswd|atproto.env|opencloud.env)$ - key_groups: - age: - *admin_cow diff --git a/hosts/reverse-proxy/Caddyfile b/hosts/reverse-proxy/Caddyfile index 816143c..b365c63 100644 --- a/hosts/reverse-proxy/Caddyfile +++ b/hosts/reverse-proxy/Caddyfile @@ -84,10 +84,6 @@ element.cow.computer { } opencloud.cow.computer { - reverse_proxy https://127.0.0.1:8087 { - transport http { - tls_insecure_skip_verify - } - } + reverse_proxy :8087 } diff --git a/hosts/reverse-proxy/default.nix b/hosts/reverse-proxy/default.nix index b3f8d0b..b79b70f 100644 --- a/hosts/reverse-proxy/default.nix +++ b/hosts/reverse-proxy/default.nix @@ -41,6 +41,12 @@ key = ""; }; + sops.secrets.opencloud-env = { + sopsFile = ../../secrets/opencloud.env; + format = "dotenv"; + key = ""; + }; + fileSystems."/boot".device = lib.mkForce "/dev/vdb1"; services.oauth2-proxy = { @@ -185,6 +191,10 @@ ''; }; + virtualHosts."collabora.opencloud.cow.computer".extraConfig = '' + reverse_proxy localhost:9980 + ''; + virtualHosts."mootube.xyz" = { extraConfig = '' respond "Comooooing soon!" @@ -267,11 +277,120 @@ enable = true; environment = { PROXY_TLS = "false"; + OC_ADD_RUN_SERVICES = "collaboration"; + FRONTEND_APP_HANDLER_SECURE_VIEW_APP_ADDR = "eu.opencloud.api.collaboration"; + + COLLABORATIO_WOPI_SRC = ""; + COLLABORA_DOMAIN = "collabora.opencloud.cow.computer"; + COLLABORATION_WOPI_SRC = "https://opencloud.cow.computer"; + COLLABORATION_APP_NAME = "CollaboraOnline"; + COLLABORATION_APP_PRODUCT = "Collabora"; + COLLABORATION_APP_ADDR = "https://collabora.opencloud.cow.computer"; + COLLABORATION_APP_ICON = "https://collabora.opencloud.cow.computer/favicon.ico"; + PROXY_CSP_CONFIG_FILE_LOCATION = "${pkgs.writers.writeYAML "csp.yaml" { + directives = { + child-src = [ "'self'" ]; + connect-src = [ + "'self'" + "blob:" + "https://raw.githubusercontent.com/opencloud-eu/awesome-apps/" + "https://update.opencloud.eu/" + "https://tile.openstreetmap.org/" + ]; + default-src = [ "'none'" ]; + font-src = [ "'self'" ]; + frame-ancestors = [ "'self'" ]; + frame-src = [ + "'self'" + "blob:" + "https://embed.diagrams.net/" + "https://collabora.opencloud.cow.computer/" + "https://docs.opencloud.eu" + ]; + img-src = [ + "'self'" + "data:" + "blob:" + "https://raw.githubusercontent.com/opencloud-eu/awesome-apps/" + "https://tile.openstreetmap.org/" + "https://collabora.opencloud.cow.computer/" + ]; + manifest-src = [ "'self'" ]; + media-src = [ "'self'" ]; + object-src = [ + "'self'" + "blob:" + ]; + script-src = [ + "'self'" + "'unsafe-inline'" + ]; + style-src = [ + "'self'" + "'unsafe-inline'" + ]; + worker-src = [ + "'self'" + "blob:" + ]; + }; + }}"; }; + environmentFile = config.sops.secrets.opencloud-env.path; url = "https://opencloud.cow.computer"; port = 8087; }; + services.collabora-online = { + enable = true; + port = 9980; # default + settings = { + ssl = { + enable = false; + termination = true; + }; + + net = { + listen = "loopback"; + post_allow.host = [ "::1" ]; + }; + + storage.wopi.host = { + + "@allow" = true; + domain = [ "opencloud.cow.computer" ]; + }; + + # Set FQDN of server + server_name = "collabora.opencloud.cow.computer"; + }; + + }; + systemd.services.collabora-proofkey = { + before = [ "coolwsd.service" ]; + requiredBy = [ "coolwsd.service" ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + StateDirectory = "cool"; + RuntimeDirectory = "coolwsd-config"; + User = "cool"; + Group = "cool"; + }; + script = '' + ln -s ${config.services.collabora-online.package}/etc/coolwsd/* "$RUNTIME_DIRECTORY/" + if [ ! -f "$STATE_DIRECTORY/proof_key" ]; then + ${pkgs.openssh}/bin/ssh-keygen -t rsa -N "" -m PEM -f "$STATE_DIRECTORY/proof_key" + fi + ln -sf "$STATE_DIRECTORY/proof_key" "$RUNTIME_DIRECTORY/proof_key" + ln -sf "$STATE_DIRECTORY/proof_key.pub" "$RUNTIME_DIRECTORY/proof_key.pub" + ''; + }; + + systemd.services.coolwsd.serviceConfig.BindReadOnlyPaths = [ + "/run/coolwsd-config:${config.services.collabora-online.package}/etc/coolwsd" + ]; + services.vaultwarden = { enable = true; config = { diff --git a/hosts/vps2/Caddyfile b/hosts/vps2/Caddyfile deleted file mode 100644 index f773f1b..0000000 --- a/hosts/vps2/Caddyfile +++ /dev/null @@ -1,16 +0,0 @@ -vps2.cow.computer { - root * /var/www/vps2 - file_server -} - -jwt.matrixrtc.cow.computer { - reverse_proxy :8080 -} - -matrixrtc.cow.computer { - reverse_proxy :7880 -} - -turn.cow.computer { -} - diff --git a/hosts/vps2/default.nix b/hosts/vps2/default.nix index 9a0e687..20faa65 100644 --- a/hosts/vps2/default.nix +++ b/hosts/vps2/default.nix @@ -77,6 +77,23 @@ "net.ipv6.conf.all.router_solicitations" = -1; }; + services.bird-lg = { + frontend = { + enable = true; + domain = ""; + servers = [ + "sea<::1>" + "home" + ]; + }; + + proxy = { + enable = true; + listenAddresses = "[::1]:8000"; + }; + + }; + services.bird = { enable = true; # TODO config = '' @@ -204,7 +221,7 @@ } protocol bgp highdef_v6 from dnpeers { - neighbor fe80::1080:112%wg3 as 4242421080; + neighbor fe80::1080:35%wg3 as 4242421080; } ''; @@ -267,18 +284,18 @@ }; addresses = [ { - address = "fe80::1080:112"; + address = "fe80::1080:35"; local = "fe80::3222:2"; } ]; wireguard = { listen_port = 51852; private_key = "!include ${config.sops.secrets.wgkey-a.path}"; - peers."6g9a5XuPZhKvhQrxeogmfBlP1YkO/DBRA9niMg7RADY=" = { + peers."O4qWRgbJVdOM8ktyUQyT1s11WkR16JTgtnn42m9A2R8=" = { allowedips = [ "::/0" ]; - endpoint = "ash.peer.highdef.network:23222"; + endpoint = "sea.peer.highdef.network:23222"; }; }; }; @@ -357,7 +374,21 @@ services.caddy = { enable = true; - configFile = ./Caddyfile; + virtualHosts."lg.sea.dn42.cow.computer".extraConfig = '' + reverse_proxy :5000 + ''; + virtualHosts."vps2.cow.computer".extraConfig = '' + root * /var/www/vps2 + file_server + ''; + virtualHosts."jwt.matrixrtc.cow.computer".extraConfig = '' + reverse_proxy :8080 + ''; + + virtualHosts."matrixrtc.cow.computer".extraConfig = '' + reverse_proxy :7880 + ''; + virtualHosts."turn.cow.computer".extraConfig = ""; }; services.livekit = { diff --git a/secrets/opencloud.env b/secrets/opencloud.env new file mode 100644 index 0000000..14dfac8 --- /dev/null +++ b/secrets/opencloud.env @@ -0,0 +1,13 @@ +IDM_CREATE_DEMO_USERS=ENC[AES256_GCM,data:9pmynXo=,iv:6Ek5hyL/0phJqjsWh1rZBBAx9vSlXEChpYdyCeDi3jY=,tag:8lXp1RVEylMYaQWkyk18jA==,type:str] +IDM_ADMIN_PASSWORD=ENC[AES256_GCM,data:QboqH8NLNYU8ipUpOl50xov58JY=,iv:BkQ1ihYDq5Hf6RGrQyYgonftjSvBU6UExVo1XCP95lc=,tag:s3W5akedgdYYHohypcGPsw==,type:str] +INITIAL_ADMIN_PASSWORD=ENC[AES256_GCM,data:q63ByZT+qEeTuF45yGRxjhQHJHI=,iv:tQlQBDSguj5m53J9dq3Ev6vZamzVmGNr+Xds2CchKZs=,tag:nsnlpwhnxXnaL2TWIi8eKg==,type:str] +OC_SERVICE_ACCOUNT_ID=ENC[AES256_GCM,data:Ha5YauYZe0MDESrfGGDqEzg5TXdEhLQH8MUyeww6XSunMrbz,iv:IqMg1ingScLeJSK21GFwFUdaEMP2WMzi6EvJrn9dJSs=,tag:vWwDrbN9PmQd2tEOB5uQhg==,type:str] +OC_SERVICE_ACCOUNT_SECRET=ENC[AES256_GCM,data:tCr+f/TsStU1f0wRNo9FnJwNmnuTYZAeKQEoSFIEUyDyP0PsxcNBbQ8Cox15fnM4,iv:lQ1Keg05mgsRoG24rxkffZDiUqKBt1sNOB8TLUkc2YU=,tag:gH7FUdo6gsNLH+XeDZvzlQ==,type:str] +sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaTUxvRWc2ck9kTk5oV0Qx\nYkZmR2VYNi9GMFV5NTZNeGNCYW9UMmdTd1g4CkQxNlVDdnE5TmFCQVJLd3FvOENN\nZEs2cHo5eUhKL2ZMekpjUDhZWEtlYTgKLS0tIFREOEg2OUo0ZUUyN1NmNVE3SlIv\nYVNkY0RtcE52eXF2T2hYR3ErRVl1OTAK1W63a5QkoyVx6+2asReq3L/kKYHhTmD1\nI3zkQSEo3qxEcfVeSUpbSIu0jd9Pmv8we42HjjeyhOm5YsLM664FZQ==\n-----END AGE ENCRYPTED FILE-----\n +sops_age__list_0__map_recipient=age1ns8t9fgkrzg7htv7x25gam3gqpjathlk5p5zr6k4cas27y0c8ypqntq8c3 +sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhZVpXaTdiaTZ2M3dQS0Uz\nTXIxc2hXWG04Z2tYOHpRZjIrWXR1NUtoR2d3CmZzeFZzOU1FWDFYRHB3TlNpT05Y\nS2dnNzF6cU9PaGNiNm9zMWU3V3l1ejQKLS0tIDNCN3B4VC8xZUdvM0ZWbS9scmpo\ncUZNZit5M1d5Z1RGS3NJSEp3YjJ4bDAKFej2XmPQODj6gj8FmRkhVbT5Tn+bshpV\nCUh7g1HbvAtc9C0NiE3eCOp5tMSBznF8MIq3vSAiVymsIgWJIq838g==\n-----END AGE ENCRYPTED FILE-----\n +sops_age__list_1__map_recipient=age1dp6dn76d736pp5ljayvjq6t03pqhraz0wd0njfllkugz4dg7e9mql3r4xh +sops_lastmodified=2026-07-12T00:20:40Z +sops_mac=ENC[AES256_GCM,data:ARp0z55onI2+A9iS8SYbuxKXgrKQGxfMkLoWbQyHNNXF56lJrz+HRUD16QVXZFNEku6mGXUJyBo89jvkqjd4hDy0BQMWKtW683QTsGLWqSBApDcb69Eab30Tf+B4xSS4YFcaXlELbEFh0sSUgsu0pg5CJT6TgBS48WRJpsQB81M=,iv:Ze462n58sVNKXGjnImpu6VyUCZ6l5jANZNAdLxAu79g=,tag:2n2dZLyTYjhy4JNtkITRLg==,type:str] +sops_unencrypted_suffix=_unencrypted +sops_version=3.13.1 diff --git a/zones/cow.computer.nix b/zones/cow.computer.nix index 3266e5e..1fd891b 100644 --- a/zones/cow.computer.nix +++ b/zones/cow.computer.nix @@ -3,7 +3,7 @@ with dns.lib.combinators; { SOA = { adminEmail = "cow@cowingtonpost.com"; - serial = 2026062300; + serial = 2026071102; nameServer = "ns1.cow.computer."; }; @@ -44,6 +44,15 @@ with dns.lib.combinators; op.subdomains = { auth = host ips.home3.v4 ips.home3.v6; }; + dn42.subdomains = { + sea = { + CNAME = [ (cname "vps2.cow.computer.") ]; + subdomains = { + "*".CNAME = [ (cname "vps2.cow.computer.") ]; + }; + }; + home.CNAME = [ (cname "home1.cow.computer.") ]; + }; vps3 = host ips.vps3.v4 ips.vps3.v6; vps4 = host ips.vps4.v4 ips.vps4.v6; @@ -73,10 +82,16 @@ with dns.lib.combinators; subdomains."*".CNAME = [ (cname "home2.cow.computer.") ]; }; radicale.CNAME = [ (cname "home1.cow.computer.") ]; - opencloud.CNAME = [ (cname "home1.cow.computer.") ]; + opencloud = { + CNAME = [ (cname "home1.cow.computer.") ]; + subdomains.collabora.CNAME = [ (cname "home1.cow.computer.") ]; + }; rss.CNAME = [ (cname "home1.cow.computer.") ]; - matrixrtc.CNAME = [ (cname "vps2.cow.computer.") ]; + matrixrtc = { + CNAME = [ (cname "vps2.cow.computer.") ]; + subdomains.jwt.CNAME = [ (cname "vps2.cow.computer.") ]; + }; turn.CNAME = [ (cname "vps2.cow.computer.") ]; chat.CNAME = [ (cname "vps2.cow.computer.") ]; upload.CNAME = [ (cname "vps3.cow.computer.") ];