delf/eris: init mjolnir
Cole Helbling committed
May 30, 2023 at 12:55 UTC
83de3feb0bf4a83ffab40e9bfd505b763a43fb0d
2 files changed
+44
delft/eris.nix
+1
@@ -10,6 +10,7 @@ in
10
./eris/github-project-monitor.nix
11
./eris/alertmanager-matrix-forwarder.nix
12
./eris/channel-monitor.nix
13
+ ./eris/mjolnir.nix
14
];
15
deployment.targetEnv = "hetzner";
16
deployment.hetzner.mainIPv4 = "138.201.32.77";
delft/eris/mjolnir.nix
new
+43
@@ -0,0 +1,43 @@
1
+{ config, lib, ... }:
2
+{
3
+ deployment.keys = {
4
+ "mjolnir.password" = {
5
+ keyFile = /home/deploy/src/nixos-org-configurations/keys/mjolnir-password;
6
+ user = config.systemd.services.mjolnir.serviceConfig.User;
7
+ group = "keys";
8
+ permissions = "0600";
9
+ };
10
+ };
11
+
12
+ systemd.services.mjolnir.serviceConfig.SupplementaryGroups = [ "keys" ];
13
+ # pantalaimon takes ages to start up, so mjolnir could hit the systemd burst
14
+ # limit and then just be down forever. We don't want mjolnir to ever go down,
15
+ # so disable rate-limiting and allow it to flap until pantalaimon is alive.
16
+ systemd.services.mjolnir.serviceConfig.Restart = lib.mkForce "always";
17
+ systemd.services.mjolnir.serviceConfig.RestartSec = 3;
18
+ systemd.services.mjolnir.unitConfig.StartLimitIntervalSec = 0;
19
+
20
+ services.pantalaimon-headless.instances.mjolnir.listenAddress = "::1";
21
+
22
+ services.mjolnir = {
23
+ enable = true;
24
+ homeserverUrl = "https://nixos.ems.host:443";
25
+
26
+ pantalaimon = {
27
+ enable = true;
28
+ username = "mjolnir";
29
+ passwordFile = "/run/keys/mjolnir.password";
30
+ options = {
31
+ listenAddress = "[::1]";
32
+ };
33
+ };
34
+
35
+ managementRoom = "#moderators:nixos.org";
36
+
37
+ settings = {
38
+ noop = false;
39
+ protectAllJoinedRooms = true;
40
+ fasterMembershipChecks = true;
41
+ };
42
+ };
43
+}