infrastructure

commit a325855d5dba06a681e00cba5f3ff2b6c6811140
parent 78ddb8cbef88016bf348b777f404f2be44443ad4
Author: Silas Brack <silasbrack@gmail.com>
Date:   Sun,  8 Mar 2026 15:38:52 +0100

Bump

Diffstat:
M
flake.lock
 | 
54
++++++++++++++++++++++++++++++++++++++++++++----------
M
nixos/configuration-debian-2gb-hel1-1.nix
 | 
22
+++++++++++++++++++---

2 files changed, 63 insertions(+), 13 deletions(-)
diff --git a/flake.lock b/flake.lock
@@ -1,15 +1,34 @@
 {
   "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "mkv": {
       "inputs": {
+        "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1772902815,
-        "narHash": "sha256-/NwbSIDQbpqiIDkHpYXxiN4ivZBZxJ3pvW6JktWMkzY=",
+        "lastModified": 1772975170,
+        "narHash": "sha256-CBcRiOMCqUblBwi6ij889SE8jZyHGOS4AuEXB53AKC0=",
         "ref": "refs/heads/main",
-        "rev": "c4c8fdd735b3cb9e47de6307032ef43d0a7a8c9d",
-        "revCount": 24,
+        "rev": "138ab7224010b819fa11ac38e6e148461c552f2e",
+        "revCount": 41,
         "type": "git",
         "url": "ssh://git@github.com/silasbrack/mkv"
       },
@@ -68,11 +87,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1769740369,
-        "narHash": "sha256-xKPyJoMoXfXpDM5DFDZDsi9PHArf2k5BJjvReYXoFpM=",
+        "lastModified": 1772736753,
+        "narHash": "sha256-au/m3+EuBLoSzWUCb64a/MZq6QUtOV8oC0D9tY2scPQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6308c3b21396534d8aaeac46179c14c439a89b8a",
+        "rev": "917fec990948658ef1ccd07cef2a1ef060786846",
         "type": "github"
       },
       "original": {
@@ -166,11 +185,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1770145881,
-        "narHash": "sha256-ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=",
+        "lastModified": 1772944399,
+        "narHash": "sha256-xTzsSd3r5HBeufSZ3fszAn0ldfKctvsYG7tT2YJg5gY=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c",
+        "rev": "c8e69670b316d6788e435a3aa0bda74eb1b82cc0",
         "type": "github"
       },
       "original": {
@@ -179,6 +198,21 @@
         "type": "github"
       }
     },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "uv2nix": {
       "inputs": {
         "nixpkgs": [
diff --git a/nixos/configuration-debian-2gb-hel1-1.nix b/nixos/configuration-debian-2gb-hel1-1.nix
@@ -1,6 +1,7 @@
 {
   pkgs,
   config,
+  lib,
   simple-web-app,
   mkv,
   ...
@@ -170,7 +171,11 @@
   systemd.services.mkv = {
     description = "mkv distributed key-value store";
     wantedBy = [ "multi-user.target" ];
-    after = [ "network-online.target" "wg-quick-wg0.service" "nginx.service" ];
+    after = [
+      "network-online.target"
+      "wg-quick-wg0.service"
+      "nginx.service"
+    ];
     wants = [ "network-online.target" ];
     requires = [ "wg-quick-wg0.service" ];
     environment = {
@@ -192,7 +197,10 @@
   # nginx WebDAV volume server for mkv (VPN only)
   services.nginx.virtualHosts."mkv-volume" = {
     listen = [
-      { addr = "10.100.0.7"; port = 8081; }
+      {
+        addr = "10.100.0.7";
+        port = 8081;
+      }
     ];
     root = "/mnt/volume-hel1-1/mkv";
     extraConfig = ''
@@ -204,6 +212,14 @@
     '';
   };
 
+  systemd.services.nginx.serviceConfig = {
+    ReadWritePaths = [ "/var/lib/mkv/volume" ];
+    ProtectSystem = lib.mkForce "full"; # downgrade from strict
+  };
+
   # Allow mkv and volume ports on VPN interface only
-  networking.firewall.interfaces.wg0.allowedTCPPorts = [ 3000 8081 ];
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [
+    3000
+    8081
+  ];
 }