diff --git a/agenix/hosts/tanker/config.nix b/agenix/hosts/tanker/config.nix index 737d0e3..2dfb53a 100644 --- a/agenix/hosts/tanker/config.nix +++ b/agenix/hosts/tanker/config.nix @@ -111,15 +111,6 @@ group = "mosquitto"; }; - nitter-config = { - file = ./nitter/config.age; - }; - - nitter-guest-accounts = { - file = ./nitter/guestAccounts.age; - mode = "555"; - }; - anonymous-overflow-config = { file = ./anonymous-overflow/config.age; }; diff --git a/agenix/hosts/tanker/nitter/config.age b/agenix/hosts/tanker/nitter/config.age deleted file mode 100644 index 76e3ea3..0000000 Binary files a/agenix/hosts/tanker/nitter/config.age and /dev/null differ diff --git a/agenix/hosts/tanker/nitter/guestAccounts.age b/agenix/hosts/tanker/nitter/guestAccounts.age deleted file mode 100644 index 8d937f6..0000000 Binary files a/agenix/hosts/tanker/nitter/guestAccounts.age and /dev/null differ diff --git a/secret/hosts/tanker.nix b/secret/hosts/tanker.nix index 02de2bb..cee26db 100644 Binary files a/secret/hosts/tanker.nix and b/secret/hosts/tanker.nix differ diff --git a/secrets.nix b/secrets.nix index 1ace413..30f13d8 100644 --- a/secrets.nix +++ b/secrets.nix @@ -47,9 +47,6 @@ in "agenix/hosts/tanker/mosquitto/passwordWeewxProxy.age".publicKeys = tanker; "agenix/hosts/tanker/mosquitto/passwordWeewx.age".publicKeys = tanker; - "agenix/hosts/tanker/nitter/config.age".publicKeys = tanker; - "agenix/hosts/tanker/nitter/guestAccounts.age".publicKeys = tanker; - "agenix/hosts/tanker/anonymous-overflow/config.age".publicKeys = tanker; "agenix/hosts/tanker/invidious/databasePassword.age".publicKeys = tanker; diff --git a/system/hosts/tanker.nix b/system/hosts/tanker.nix index 5ea8341..34143a3 100644 --- a/system/hosts/tanker.nix +++ b/system/hosts/tanker.nix @@ -50,8 +50,6 @@ in ../nixos/miniflux.nix - (import ../nixos/nitter.nix (args // { inherit secret; })) - (import ../nixos/ntfy-sh.nix (args // { inherit secret; })) ../nixos/rimgo.nix diff --git a/system/nixos/nitter.nix b/system/nixos/nitter.nix deleted file mode 100644 index 0570ca7..0000000 --- a/system/nixos/nitter.nix +++ /dev/null @@ -1,83 +0,0 @@ -{ pkgs, config, secret, ... }: - -let - nitter-pkg = pkgs.nitter; -in -{ - # Based on: https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/services/misc/nitter.nix - - systemd.services.nitter = { - description = "Nitter (An alternative Twitter front-end)"; - wantedBy = [ "multi-user.target" ]; - requires = [ "redis-nitter.service" ]; - wants = [ "network-online.target" ]; - after = [ "network-online.target" "redis-nitter.service" ]; - serviceConfig = { - DynamicUser = true; - StateDirectory = "nitter"; - LoadCredential = [ "config:${config.age.secrets.nitter-config.path}" ]; - Environment = [ - "NITTER_CONF_FILE=%d/config" - "NITTER_ACCOUNTS_FILE=/var/lib/nitter/guest_accounts.json" - ]; - # Some parts of Nitter expect `public` folder in working directory, - # see https://github.com/zedeus/nitter/issues/414 - WorkingDirectory = "${nitter-pkg}/share/nitter"; - ExecStart = "${nitter-pkg}/bin/nitter"; - Restart = "on-failure"; - RestartSec = "5s"; - # Hardening - CapabilityBoundingSet = [ "" ]; - DeviceAllow = [ "" ]; - LockPersonality = true; - MemoryDenyWriteExecute = true; - PrivateDevices = true; - PrivateUsers = true; - ProcSubset = "pid"; - ProtectClock = true; - ProtectControlGroups = true; - ProtectHome = true; - ProtectHostname = true; - ProtectKernelLogs = true; - ProtectKernelModules = true; - ProtectKernelTunables = true; - ProtectProc = "invisible"; - RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; - RestrictNamespaces = true; - RestrictRealtime = true; - RestrictSUIDSGID = true; - SystemCallArchitectures = "native"; - SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ]; - UMask = "0077"; - }; - }; - - services.redis.servers.nitter = { - enable = true; - bind = "127.0.0.1"; - port = 6380; - - databases = 1; - save = [ ]; - appendFsync = "no"; - }; - - services.nginx.virtualHosts."${secret.nginx.hostnames.nitter}" = { - listenAddresses = [ "100.64.10.2" "[fd7a:115c:a1e0:1010::2]" ]; - quic = true; - http3 = true; - - root = "${nitter-pkg}/share/nitter/public/"; - onlySSL = true; - useACMEHost = "daniel.sx"; - - locations."/" = { - tryFiles = "$uri @proxy"; - }; - - locations."@proxy" = { - recommendedProxySettings = true; - proxyPass = "http://127.0.0.1:8001"; - }; - }; -}