5 files changed, 45 insertions, 21 deletions
diff --git a/krebs/2configs/default.nix b/krebs/2configs/default.nix
index 905eaaef7..5d64555c8 100644
--- a/krebs/2configs/default.nix
+++ b/krebs/2configs/default.nix
@@ -8,7 +8,17 @@ with import ../../lib/pure.nix { inherit lib; };
   ];
   krebs.announce-activation.enable = true;
   krebs.enable = true;
-  krebs.tinc.retiolum.enable = mkDefault true;
+
+  # retiolum
+  krebs.tinc.retiolum = {
+    enable = mkDefault true;
+    extraConfig = ''
+      AutoConnect = yes
+      LocalDiscovery = yes
+    '';
+  };
+  networking.firewall.allowedTCPPorts = [ 655 ];
+  networking.firewall.allowedUDPPorts = [ 655 ];
 
   # trust krebs ACME CA
   krebs.ssl.trustIntermediate = true;
@@ -52,6 +62,7 @@ with import ../../lib/pure.nix { inherit lib; };
     config.krebs.users.makefu.pubkey
     config.krebs.users.tv.pubkey
     config.krebs.users.kmein.pubkey
+    config.krebs.users.mic92.pubkey
   ];
 
   # The NixOS release to be compatible with for stateful data such as databases.
diff --git a/krebs/2configs/mastodon-proxy.nix b/krebs/2configs/mastodon-proxy.nix
index 4d359c3fe..b579a5031 100644
--- a/krebs/2configs/mastodon-proxy.nix
+++ b/krebs/2configs/mastodon-proxy.nix
@@ -5,19 +5,12 @@
     virtualHosts."social.krebsco.de" = {
       forceSSL = true;
       enableACME = true;
+      acmeFallbackHost = "hotdog.r";
       locations."/" = {
         # TODO use this in 22.11
-        # recommendedProxySettings = true;
-        proxyPass = "http://hotdog.r";
+        recommendedProxySettings = true;
+        proxyPass = "https://hotdog.r";
         proxyWebsockets = true;
-        extraConfig = ''
-          proxy_set_header        Host $host;
-          proxy_set_header        X-Real-IP $remote_addr;
-          proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
-          proxy_set_header        X-Forwarded-Proto $scheme;
-          proxy_set_header        X-Forwarded-Host $host;
-          proxy_set_header        X-Forwarded-Server $host;
-        '';
       };
     };
   };
diff --git a/krebs/2configs/mastodon.nix b/krebs/2configs/mastodon.nix
index af308b2c7..ebc4207a0 100644
--- a/krebs/2configs/mastodon.nix
+++ b/krebs/2configs/mastodon.nix
@@ -3,7 +3,7 @@
   services.postgresql = {
     enable = true;
     dataDir = "/var/state/postgresql/${config.services.postgresql.package.psqlSchema}";
-    package = pkgs.postgresql_11;
+    package = pkgs.postgresql_16;
   };
   systemd.tmpfiles.rules = [
     "d /var/state/postgresql 0700 postgres postgres -"
@@ -13,23 +13,17 @@
     enable = true;
     localDomain = "social.krebsco.de";
     configureNginx = true;
+    streamingProcesses = 3;
     trustedProxy = config.krebs.hosts.prism.nets.retiolum.ip6.addr;
     smtp.createLocally = false;
     smtp.fromAddress = "derp";
   };
 
-  services.nginx.virtualHosts.${config.services.mastodon.localDomain} = {
-    forceSSL = lib.mkForce false;
-    enableACME = lib.mkForce false;
-    locations."@proxy".extraConfig = ''
-      proxy_redirect off;
-      proxy_pass_header Server;
-      proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
-    '';
-  };
+  security.acme.certs."social.krebsco.de".server = "https://acme-staging-v02.api.letsencrypt.org/directory";
 
   networking.firewall.allowedTCPPorts = [
     80
+    443
   ];
 
   environment.systemPackages = [
diff --git a/krebs/2configs/nginx.nix b/krebs/2configs/nginx.nix
new file mode 100644
index 000000000..812093a7e
--- /dev/null
+++ b/krebs/2configs/nginx.nix
@@ -0,0 +1,24 @@
+{
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  security.acme.acceptTerms = true;
+  security.acme.defaults.email = "spam@krebsco.de";
+
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedTlsSettings = true;
+
+    enableReload = true;
+
+    virtualHosts.default = {
+      default = true;
+      locations."= /etc/os-release".extraConfig = ''
+        default_type text/plain;
+        alias /etc/os-release;
+      '';
+      # needed for acmeFallback in sync-containers, or other machines not reachable globally
+      locations."~ ^/.well-known/acme-challenge/".root = "/var/lib/acme/acme-challenge";
+    };
+  };
+}
diff --git a/krebs/2configs/reaktor2.nix b/krebs/2configs/reaktor2.nix
index db7b794f4..e84827656 100644
--- a/krebs/2configs/reaktor2.nix
+++ b/krebs/2configs/reaktor2.nix
@@ -526,6 +526,8 @@ in {
       add_header 'Access-Control-Allow-Origin' '*';
       add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
     '';
+    # needed for acmeFallback in sync-containers, or other machines not reachable globally
+    locations."~ ^/.well-known/acme-challenge/".root = "/var/lib/acme/acme-challenge";
   };
 
   services.nginx.virtualHosts."bedge.r" = {