~

hosts/hastur/spec.nix

@@ -118,17 +118,17 @@
 
         dae.enable = true;
         sing-box.enable = true;
-        beesd.filesystems = {
-          os = {
-            spec = "LABEL=nixos";
-            hashTableSizeMB = 1024; # 256 *2 *2
-            verbosity = "crit";
-            extraOptions = [
-              "--loadavg-target"
-              "5.0"
-            ];
-          };
-        };
+        # beesd.filesystems = {
+        #   os = {
+        #     spec = "LABEL=nixos";
+        #     hashTableSizeMB = 1024; # 256 *2 *2
+        #     verbosity = "crit";
+        #     extraOptions = [
+        #       "--loadavg-target"
+        #       "5.0"
+        #     ];
+        #   };
+        # };
         restic.backups.solid = {
           passwordFile = config.age.secrets.wg.path;
           repositoryFile = config.age.secrets.restic-repo.path;

hosts/lib.nix

@@ -61,7 +61,7 @@ in
     toString (pkgs.lib.getExe (pkgs.nuenv.writeScriptBin
       {
         name = "post-ntfy-msg";
-        script = "cat /run/agenix/ntfy-token | str trim | http post --password $in --headers [${header}] https://ntfy.nyaw.xyz/${level} ${body}";
+        script = "http post --password $in --headers [${header}] https://ntfy.nyaw.xyz/${level} ${body}";
       }));
 
   base =

hosts/nodens/caddy.nix

@@ -12,17 +12,49 @@
                 {
                   handle = [{
                     handler = "subroute";
-                    routes = [{
-                      handle = [{
-                        handler = "reverse_proxy";
-                        upstreams = [{
-                          dial = "10.0.1.2:6167";
+                    routes = [
+                      {
+                        handle = [{
+                          handler = "reverse_proxy";
+                          upstreams = [{
+                            dial = "10.0.1.2:6167";
+                          }];
                         }];
-                      }];
-                      match = [{
-                        path = [ "/_matrix/*" ];
-                      }];
-                    }];
+                        match = [{
+                          path = [ "/_matrix/*" ];
+                        }];
+                      }
+                      {
+                        handle = [
+                          {
+                            handler = "headers";
+                            response.set = {
+                              X-Frame-Options = [ "SAMEORIGIN" ];
+                              X-Content-Type-Options = [ "nosniff" ];
+                              X-XSS-Protection = [ "1; mode=block" ];
+                              Content-Security-Policy = [ "frame-ancestors 'self'" ];
+                            };
+                          }
+                          (
+                            let
+                              conf = {
+                                default_server_config = {
+                                  "m.homeserver" = {
+                                    base_url = "https://matrix.nyaw.xyz";
+                                    server_name = "nyaw.xyz";
+                                  };
+                                };
+                                show_labs_settings = true;
+                              };
+                            in
+                            {
+                              handler = "file_server";
+                              root = "${pkgs.element-web.override { inherit conf; }}";
+                            }
+                          )
+                        ];
+                      }
+                    ];
                   }];
                   match = [{
                     host = [ "matrix.nyaw.xyz" ];

hosts/nodens/spec.nix

@@ -45,7 +45,7 @@
         settings = {
           listen-http = ":2586";
           behind-proxy = true;
-          auth-default-access = "deny-all";
+          auth-default-access = "read-write";
           base-url = "http://ntfy.nyaw.xyz";
         };
       };

justfile

@@ -81,7 +81,7 @@ rekey:
 
 overwrite-s3:
     mc mirror --overwrite --remove /home/{{ me }}/Sec/ r2/sec/Sec
-    mc mirror --overwrite --remove /etc/nixos/sec/ r2/sec/credentials
+    mc mirror --overwrite --remove {{loc}}/sec/ r2/sec/credentials
 
 overwrite-local:
     mc mirror --overwrite --remove r2/sec/Sec /home/{{ me }}/Sec/