From 334378bc5730f7758a3e45346f6641b4464fc97d Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 25 Nov 2023 12:42:10 +0100
Subject: sync-containers3: bind to bridge after startup

---
 krebs/3modules/sync-containers3.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

(limited to 'krebs')

diff --git a/krebs/3modules/sync-containers3.nix b/krebs/3modules/sync-containers3.nix
index 7bec27b0f..58446c82b 100644
--- a/krebs/3modules/sync-containers3.nix
+++ b/krebs/3modules/sync-containers3.nix
@@ -246,9 +246,11 @@ in {
         }; }
         { "container@${ctr.name}" = lib.mkIf ctr.runContainer {
           serviceConfig = {
-            ExecStop = pkgs.writers.writeDash "remove_interface" ''
-              ${pkgs.iproute2}/bin/ip link del vb-${ctr.name}
-            '';
+            ExecStartPost = [
+              (pkgs.writers.writeDash "bind-to-bridge" ''
+                ${pkgs.iproute2}/bin/ip link set "vb-$INSTANCE" master ctr0
+              '')
+            ];
           };
         }; }
       ]) (lib.attrValues cfg.containers)));
-- 
cgit v1.2.3


From c81b09c602a50bbd911abfb28abade77c2a8b6a6 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Wed, 29 Nov 2023 19:53:42 +0100
Subject: news.r: set ssh private key

---
 krebs/1systems/news/config.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'krebs')

diff --git a/krebs/1systems/news/config.nix b/krebs/1systems/news/config.nix
index b5a2b21ba..290870fce 100644
--- a/krebs/1systems/news/config.nix
+++ b/krebs/1systems/news/config.nix
@@ -14,6 +14,7 @@
   ];
 
   krebs.build.host = config.krebs.hosts.news;
+  krebs.hosts.news.ssh.privkey.path = "${config.krebs.secret.directory}/ssh.id_ed25519";
 
   boot.isContainer = true;
   networking.useDHCP = lib.mkForce true;
-- 
cgit v1.2.3


From 3c84e737106c8ff38676861fdc1f7737a4fc2f73 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Tue, 5 Dec 2023 15:20:49 +0100
Subject: sync-containers3: remove interface at container shutdown to avoid
 stuck containers

---
 krebs/3modules/sync-containers3.nix | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'krebs')

diff --git a/krebs/3modules/sync-containers3.nix b/krebs/3modules/sync-containers3.nix
index 58446c82b..cb239b955 100644
--- a/krebs/3modules/sync-containers3.nix
+++ b/krebs/3modules/sync-containers3.nix
@@ -246,6 +246,9 @@ in {
         }; }
         { "container@${ctr.name}" = lib.mkIf ctr.runContainer {
           serviceConfig = {
+            ExecStop = pkgs.writers.writeDash "remove_interface" ''
+              ${pkgs.iproute2}/bin/ip link del vb-${ctr.name}
+            '';
             ExecStartPost = [
               (pkgs.writers.writeDash "bind-to-bridge" ''
                 ${pkgs.iproute2}/bin/ip link set "vb-$INSTANCE" master ctr0
-- 
cgit v1.2.3


From 64996e6f37b370923629e1b9edcd25a05a59ab0a Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Wed, 6 Dec 2023 21:31:59 +0100
Subject: update krebs intermediate ca

---
 krebs/6assets/krebsAcmeCA.crt | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

(limited to 'krebs')

diff --git a/krebs/6assets/krebsAcmeCA.crt b/krebs/6assets/krebsAcmeCA.crt
index bf05b44f4..6f659d905 100644
--- a/krebs/6assets/krebsAcmeCA.crt
+++ b/krebs/6assets/krebsAcmeCA.crt
@@ -1,15 +1,15 @@
 -----BEGIN CERTIFICATE-----
-MIICWTCCAcKgAwIBAgIQIpBt0MsRpYd8LWNdb9MfITANBgkqhkiG9w0BAQsFADCB
-gTELMAkGA1UEBhMCWloxEjAQBgNVBAgMCXN0YXRlbGVzczEQMA4GA1UECgwHS3Jl
-YnNjbzELMAkGA1UECwwCS00xFjAUBgNVBAMMDUtyZWJzIFJvb3QgQ0ExJzAlBgkq
-hkiG9w0BCQEWGHJvb3QtY2FAc3ludGF4LWZlaGxlci5kZTAeFw0yMjEyMDYxODI2
-MDhaFw0yMzEyMDYxODI2MDhaMBgxFjAUBgNVBAMTDUtyZWJzIEFDTUUgQ0EwWTAT
-BgcqhkjOPQIBBggqhkjOPQMBBwNCAAT4KuemY4BowAbFjzCvi+PthBTWCtewnAbr
-qDSlA602QcuQVmqa1/3TaYag7KNDgeg5eshMRI9GN/boKTpgcLeZo4GAMH4wDgYD
-VR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFJYxArnj
-SEArwloaM5blBymFmcL2MB8GA1UdIwQYMBaAFIp6rTX6sDCnvIBfDOXBkGjcQZUv
-MBgGA1UdHgEB/wQOMAygCjADggFyMAOCAXcwDQYJKoZIhvcNAQELBQADgYEAekCt
-XrKwanrcy6+k3YfXWGiMJ47Ys7Mfa5UfIs7QiXv74MgtklLsX63D27hKn5rd7wk4
-20wXLMhb8ofrKnO4mt0VFRSGm9/cq9N/c/uuf4hMzhAJmusgkn02GG+cafqZ9ab9
-MjLmveT9WHphmgQTnJPEeYP2U2faHKIp6Gwv5qc=
+MIICWjCCAcOgAwIBAgIRAOACUgvw++4VwgQ7Iu1/iRkwDQYJKoZIhvcNAQELBQAw
+gYExCzAJBgNVBAYTAlpaMRIwEAYDVQQIDAlzdGF0ZWxlc3MxEDAOBgNVBAoMB0ty
+ZWJzY28xCzAJBgNVBAsMAktNMRYwFAYDVQQDDA1LcmVicyBSb290IENBMScwJQYJ
+KoZIhvcNAQkBFhhyb290LWNhQHN5bnRheC1mZWhsZXIuZGUwHhcNMjMxMjA2MjAy
+NTI1WhcNMjQxMjA1MjAyNTI1WjAYMRYwFAYDVQQDEw1LcmVicyBBQ01FIENBMFkw
+EwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAESHiqfjJYhLvY9pBWVi5gwDmZQ65F5KGV
+GSkOprlw4TJguHr6ToSC9MErHhDb80kyidcjWDi2WTJX1zg/OmTv2qOBgDB+MA4G
+A1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBTSCUQO
+B5ICY1kqFPQ299+Kn6zr8TAfBgNVHSMEGDAWgBSKeq01+rAwp7yAXwzlwZBo3EGV
+LzAYBgNVHR4BAf8EDjAMoAowA4IBcjADggF3MA0GCSqGSIb3DQEBCwUAA4GBAMY3
+hXVyUAYfNw+sb5NLZKkp5/Uu9ehcmVJV/CkWm5BKyEFsdCJ3PL5rnpockxNrOTy1
+/y0IWZ4UaV2jqVibKOTt3FWax1BHXuTBMSirAIKYdUnT969KTTs0atrDYYh1bBzy
+YIxiIU+Be343LFI5HTNewAyK2SYUO0QP0BkGUUGD
 -----END CERTIFICATE-----
-- 
cgit v1.2.3


From 520391482411604798cab4d24d48f6c1650718ea Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Mon, 11 Dec 2023 17:36:41 +0100
Subject: add mic92 as krebsminister

---
 krebs/2configs/default.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'krebs')

diff --git a/krebs/2configs/default.nix b/krebs/2configs/default.nix
index 905eaaef7..0d55a01fa 100644
--- a/krebs/2configs/default.nix
+++ b/krebs/2configs/default.nix
@@ -52,6 +52,7 @@ with import ../../lib/pure.nix { inherit lib; };
     config.krebs.users.makefu.pubkey
     config.krebs.users.tv.pubkey
     config.krebs.users.kmein.pubkey
+    config.krebs.users.mic92.pubkey
   ];
 
   # The NixOS release to be compatible with for stateful data such as databases.
-- 
cgit v1.2.3


From 61a5c464b894a3b78bd98998664f89b9611ecc1a Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Tue, 12 Dec 2023 11:39:16 +0100
Subject: remove dead nixpkgs-unstable.json

---
 krebs/nixpkgs-unstable.json      | 12 ------------
 krebs/update-nixpkgs-unstable.sh |  9 ---------
 2 files changed, 21 deletions(-)
 delete mode 100644 krebs/nixpkgs-unstable.json
 delete mode 100755 krebs/update-nixpkgs-unstable.sh

(limited to 'krebs')

diff --git a/krebs/nixpkgs-unstable.json b/krebs/nixpkgs-unstable.json
deleted file mode 100644
index 2233cd20b..000000000
--- a/krebs/nixpkgs-unstable.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "url": "https://github.com/NixOS/nixpkgs",
-  "rev": "aa8aa7e2ea35ce655297e8322dc82bf77a31d04b",
-  "date": "2023-09-01T18:51:16+08:00",
-  "path": "/nix/store/10xskkarnksmn1fahylswv0y4216c73w-nixpkgs",
-  "sha256": "0bbv3y86kfpn02zh5vvdbkmnqyzagzbc1gzpvvlb6qbvgg639bf9",
-  "hash": "sha256-ya00zHt7YbPo3ve/wNZ/6nts61xt7wK/APa6aZAfey0=",
-  "fetchLFS": false,
-  "fetchSubmodules": false,
-  "deepClone": false,
-  "leaveDotGit": false
-}
diff --git a/krebs/update-nixpkgs-unstable.sh b/krebs/update-nixpkgs-unstable.sh
deleted file mode 100755
index ab04914c1..000000000
--- a/krebs/update-nixpkgs-unstable.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/bin/sh
-dir=$(dirname $0)
-oldrev=$(cat $dir/nixpkgs-unstable.json | jq -r .rev | sed 's/\(.\{7\}\).*/\1/')
-nix-shell -p nix-prefetch-git --run 'nix-prefetch-git \
-  --url https://github.com/NixOS/nixpkgs \
-  --rev refs/heads/nixos-unstable' \
-> $dir/nixpkgs-unstable.json
-newrev=$(cat $dir/nixpkgs-unstable.json | jq -r .rev | sed 's/\(.\{7\}\).*/\1/')
-git commit $dir/nixpkgs-unstable.json -m "nixpkgs-unstable: $oldrev -> $newrev"
-- 
cgit v1.2.3


From 874de0795b1b6747e6625b5bbeb148a2a54444df Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Tue, 12 Dec 2023 11:39:52 +0100
Subject: replace nixpkgs.json with flake.lock

---
 krebs/krops.nix         |  8 ++++----
 krebs/nixpkgs.json      | 12 ------------
 krebs/update-nixpkgs.sh |  9 ---------
 3 files changed, 4 insertions(+), 25 deletions(-)
 delete mode 100644 krebs/nixpkgs.json
 delete mode 100755 krebs/update-nixpkgs.sh

(limited to 'krebs')

diff --git a/krebs/krops.nix b/krebs/krops.nix
index aeb2413a4..c55865d54 100644
--- a/krebs/krops.nix
+++ b/krebs/krops.nix
@@ -10,8 +10,8 @@
   krebs-source = { test ? false }: rec {
     nixpkgs = if test then {
       derivation = let
-        rev = (lib.importJSON ./nixpkgs.json).rev;
-        sha256 = (lib.importJSON ./nixpkgs.json).sha256;
+        rev = (lib.importJSON ../flake.lock).nodes.nixpkgs.locked.rev;
+        sha256 = (lib.importJSON ../flake.lock).nixpkgs.locked.narHash;
       in ''
         with import (builtins.fetchTarball {
           url = "https://github.com/nixos/nixpkgs/archive/${rev}.tar.gz";
@@ -26,8 +26,8 @@
       '';
     } else {
       git = {
-        ref = (lib.importJSON ./nixpkgs.json).rev;
-        url = https://github.com/NixOS/nixpkgs;
+        ref = (lib.importJSON ../flake.lock).nodes.nixpkgs.locked.rev;
+        url = "https://github.com/NixOS/nixpkgs";
         shallow = true;
       };
     };
diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json
deleted file mode 100644
index 0b6021ed0..000000000
--- a/krebs/nixpkgs.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "url": "https://github.com/NixOS/nixpkgs",
-  "rev": "9075cba53e86dc318d159aee55dc9a7c9a4829c1",
-  "date": "2023-09-02T08:28:47+02:00",
-  "path": "/nix/store/605bv7zssv38j0ii8rbnxkv1m0f0b53p-nixpkgs",
-  "sha256": "0kymzp32d31c0hny2b2f7zfn49nzrxlm963xbm4v0axka6abym36",
-  "hash": "sha256-ZlS/lFGzK7BJXX2YVGnP3yZi3T9OLOEtBCyMJsb91U8=",
-  "fetchLFS": false,
-  "fetchSubmodules": false,
-  "deepClone": false,
-  "leaveDotGit": false
-}
diff --git a/krebs/update-nixpkgs.sh b/krebs/update-nixpkgs.sh
deleted file mode 100755
index 465548f44..000000000
--- a/krebs/update-nixpkgs.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/bin/sh
-dir=$(dirname $0)
-oldrev=$(cat $dir/nixpkgs.json | jq -r .rev | sed 's/\(.\{7\}\).*/\1/')
-nix-shell -p nix-prefetch-git --run 'nix-prefetch-git \
-  --url https://github.com/NixOS/nixpkgs \
-  --rev refs/heads/nixos-23.05' \
-> $dir/nixpkgs.json
-newrev=$(cat $dir/nixpkgs.json | jq -r .rev | sed 's/\(.\{7\}\).*/\1/')
-git commit $dir/nixpkgs.json -m "nixpkgs: $oldrev -> $newrev"
-- 
cgit v1.2.3


From c441ad385478b29c763d3acc430c6596add9c98a Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Tue, 12 Dec 2023 11:54:18 +0100
Subject: mastodon: set streamingProcesses

---
 krebs/2configs/mastodon.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'krebs')

diff --git a/krebs/2configs/mastodon.nix b/krebs/2configs/mastodon.nix
index af308b2c7..2a3dc8419 100644
--- a/krebs/2configs/mastodon.nix
+++ b/krebs/2configs/mastodon.nix
@@ -13,6 +13,7 @@
     enable = true;
     localDomain = "social.krebsco.de";
     configureNginx = true;
+    streamingProcesses = 3;
     trustedProxy = config.krebs.hosts.prism.nets.retiolum.ip6.addr;
     smtp.createLocally = false;
     smtp.fromAddress = "derp";
-- 
cgit v1.2.3


From d20f33ca775ca553aff70d069d39de635c1287f9 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Tue, 12 Dec 2023 12:18:18 +0100
Subject: mastodon: upgrade postgresql 11 -> 16

---
 krebs/2configs/mastodon.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'krebs')

diff --git a/krebs/2configs/mastodon.nix b/krebs/2configs/mastodon.nix
index 2a3dc8419..ab400955e 100644
--- a/krebs/2configs/mastodon.nix
+++ b/krebs/2configs/mastodon.nix
@@ -3,7 +3,7 @@
   services.postgresql = {
     enable = true;
     dataDir = "/var/state/postgresql/${config.services.postgresql.package.psqlSchema}";
-    package = pkgs.postgresql_11;
+    package = pkgs.postgresql_16;
   };
   systemd.tmpfiles.rules = [
     "d /var/state/postgresql 0700 postgres postgres -"
-- 
cgit v1.2.3


From 6ce52ce8e14dfa0a0197d137f858d98028597edd Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Tue, 12 Dec 2023 12:38:50 +0100
Subject: krops: fix flake.lock reference for ci

---
 krebs/krops.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'krebs')

diff --git a/krebs/krops.nix b/krebs/krops.nix
index c55865d54..eba966b4f 100644
--- a/krebs/krops.nix
+++ b/krebs/krops.nix
@@ -11,7 +11,7 @@
     nixpkgs = if test then {
       derivation = let
         rev = (lib.importJSON ../flake.lock).nodes.nixpkgs.locked.rev;
-        sha256 = (lib.importJSON ../flake.lock).nixpkgs.locked.narHash;
+        sha256 = (lib.importJSON ../flake.lock).nodes.nixpkgs.locked.narHash;
       in ''
         with import (builtins.fetchTarball {
           url = "https://github.com/nixos/nixpkgs/archive/${rev}.tar.gz";
-- 
cgit v1.2.3


From 316e8431c2723e258f9939dfe182f6ce3e7b0b89 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Tue, 12 Dec 2023 13:09:09 +0100
Subject: default: open retiolum ports

---
 krebs/2configs/default.nix | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'krebs')

diff --git a/krebs/2configs/default.nix b/krebs/2configs/default.nix
index 0d55a01fa..dc02f54ae 100644
--- a/krebs/2configs/default.nix
+++ b/krebs/2configs/default.nix
@@ -9,6 +9,8 @@ with import ../../lib/pure.nix { inherit lib; };
   krebs.announce-activation.enable = true;
   krebs.enable = true;
   krebs.tinc.retiolum.enable = mkDefault true;
+  networking.firewall.allowedTCPPorts = [ 655 ];
+  networking.firewall.allowedUDPPorts = [ 655 ];
 
   # trust krebs ACME CA
   krebs.ssl.trustIntermediate = true;
-- 
cgit v1.2.3


From 75374a27f903538601a124e1b99c53815bb6c4a6 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Tue, 12 Dec 2023 13:22:20 +0100
Subject: default: add more retiolum options

---
 krebs/2configs/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

(limited to 'krebs')

diff --git a/krebs/2configs/default.nix b/krebs/2configs/default.nix
index dc02f54ae..5d64555c8 100644
--- a/krebs/2configs/default.nix
+++ b/krebs/2configs/default.nix
@@ -8,7 +8,15 @@ with import ../../lib/pure.nix { inherit lib; };
   ];
   krebs.announce-activation.enable = true;
   krebs.enable = true;
-  krebs.tinc.retiolum.enable = mkDefault true;
+
+  # retiolum
+  krebs.tinc.retiolum = {
+    enable = mkDefault true;
+    extraConfig = ''
+      AutoConnect = yes
+      LocalDiscovery = yes
+    '';
+  };
   networking.firewall.allowedTCPPorts = [ 655 ];
   networking.firewall.allowedUDPPorts = [ 655 ];
 
-- 
cgit v1.2.3


From 5beea992dd6df7e78f845131aa7f6cee2d49d963 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Tue, 12 Dec 2023 14:13:07 +0100
Subject: sync-containers3: print ping timeout reasons before container kill

---
 krebs/3modules/sync-containers3.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'krebs')

diff --git a/krebs/3modules/sync-containers3.nix b/krebs/3modules/sync-containers3.nix
index cb239b955..d3a65bd4c 100644
--- a/krebs/3modules/sync-containers3.nix
+++ b/krebs/3modules/sync-containers3.nix
@@ -155,7 +155,7 @@ in {
                         # echo 'container is reachable, continueing'
                         continue
                       else
-                        # echo 'container seems dead, killing'
+                        echo 'container seems dead, killing'
                         break
                       fi
                     else
-- 
cgit v1.2.3


From d165a0871caadf7686f5ca56a54ea0e95b2698eb Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Tue, 12 Dec 2023 14:13:22 +0100
Subject: mastodon-proxy: add acmeFallbackHost

---
 krebs/2configs/mastodon-proxy.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'krebs')

diff --git a/krebs/2configs/mastodon-proxy.nix b/krebs/2configs/mastodon-proxy.nix
index 4d359c3fe..35bf6020d 100644
--- a/krebs/2configs/mastodon-proxy.nix
+++ b/krebs/2configs/mastodon-proxy.nix
@@ -5,6 +5,7 @@
     virtualHosts."social.krebsco.de" = {
       forceSSL = true;
       enableACME = true;
+      acmeFallbackHost = "hotdog.r";
       locations."/" = {
         # TODO use this in 22.11
         # recommendedProxySettings = true;
-- 
cgit v1.2.3


From 25d035de777df95cd0c809e647d942a75d5a4906 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Tue, 12 Dec 2023 16:43:46 +0100
Subject: hotdog: add nginx config for acme in container

---
 krebs/1systems/hotdog/config.nix |  1 +
 krebs/2configs/nginx.nix         | 24 ++++++++++++++++++++++++
 2 files changed, 25 insertions(+)
 create mode 100644 krebs/2configs/nginx.nix

(limited to 'krebs')

diff --git a/krebs/1systems/hotdog/config.nix b/krebs/1systems/hotdog/config.nix
index 75a8a0da1..0a103ed1a 100644
--- a/krebs/1systems/hotdog/config.nix
+++ b/krebs/1systems/hotdog/config.nix
@@ -4,6 +4,7 @@
   imports = [
     ../../../krebs
     ../../../krebs/2configs
+    ../../../krebs/2configs/nginx.nix
 
     ../../../krebs/2configs/buildbot-stockholm.nix
     ../../../krebs/2configs/binary-cache/nixos.nix
diff --git a/krebs/2configs/nginx.nix b/krebs/2configs/nginx.nix
new file mode 100644
index 000000000..812093a7e
--- /dev/null
+++ b/krebs/2configs/nginx.nix
@@ -0,0 +1,24 @@
+{
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  security.acme.acceptTerms = true;
+  security.acme.defaults.email = "spam@krebsco.de";
+
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedTlsSettings = true;
+
+    enableReload = true;
+
+    virtualHosts.default = {
+      default = true;
+      locations."= /etc/os-release".extraConfig = ''
+        default_type text/plain;
+        alias /etc/os-release;
+      '';
+      # needed for acmeFallback in sync-containers, or other machines not reachable globally
+      locations."~ ^/.well-known/acme-challenge/".root = "/var/lib/acme/acme-challenge";
+    };
+  };
+}
-- 
cgit v1.2.3


From 04f538164ce11ce977a851b6de2a9d2c5f7a9adb Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Tue, 12 Dec 2023 19:12:20 +0100
Subject: fix ssl cert for social.krebsco.de

---
 krebs/2configs/mastodon-proxy.nix | 12 ++----------
 krebs/2configs/mastodon.nix       | 11 ++---------
 krebs/2configs/reaktor2.nix       |  2 ++
 3 files changed, 6 insertions(+), 19 deletions(-)

(limited to 'krebs')

diff --git a/krebs/2configs/mastodon-proxy.nix b/krebs/2configs/mastodon-proxy.nix
index 35bf6020d..b579a5031 100644
--- a/krebs/2configs/mastodon-proxy.nix
+++ b/krebs/2configs/mastodon-proxy.nix
@@ -8,17 +8,9 @@
       acmeFallbackHost = "hotdog.r";
       locations."/" = {
         # TODO use this in 22.11
-        # recommendedProxySettings = true;
-        proxyPass = "http://hotdog.r";
+        recommendedProxySettings = true;
+        proxyPass = "https://hotdog.r";
         proxyWebsockets = true;
-        extraConfig = ''
-          proxy_set_header        Host $host;
-          proxy_set_header        X-Real-IP $remote_addr;
-          proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
-          proxy_set_header        X-Forwarded-Proto $scheme;
-          proxy_set_header        X-Forwarded-Host $host;
-          proxy_set_header        X-Forwarded-Server $host;
-        '';
       };
     };
   };
diff --git a/krebs/2configs/mastodon.nix b/krebs/2configs/mastodon.nix
index ab400955e..ebc4207a0 100644
--- a/krebs/2configs/mastodon.nix
+++ b/krebs/2configs/mastodon.nix
@@ -19,18 +19,11 @@
     smtp.fromAddress = "derp";
   };
 
-  services.nginx.virtualHosts.${config.services.mastodon.localDomain} = {
-    forceSSL = lib.mkForce false;
-    enableACME = lib.mkForce false;
-    locations."@proxy".extraConfig = ''
-      proxy_redirect off;
-      proxy_pass_header Server;
-      proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
-    '';
-  };
+  security.acme.certs."social.krebsco.de".server = "https://acme-staging-v02.api.letsencrypt.org/directory";
 
   networking.firewall.allowedTCPPorts = [
     80
+    443
   ];
 
   environment.systemPackages = [
diff --git a/krebs/2configs/reaktor2.nix b/krebs/2configs/reaktor2.nix
index db7b794f4..e84827656 100644
--- a/krebs/2configs/reaktor2.nix
+++ b/krebs/2configs/reaktor2.nix
@@ -526,6 +526,8 @@ in {
       add_header 'Access-Control-Allow-Origin' '*';
       add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
     '';
+    # needed for acmeFallback in sync-containers, or other machines not reachable globally
+    locations."~ ^/.well-known/acme-challenge/".root = "/var/lib/acme/acme-challenge";
   };
 
   services.nginx.virtualHosts."bedge.r" = {
-- 
cgit v1.2.3