1
0
Fork 0

nitter: dead

This commit is contained in:
Daniel Kempkens 2024-01-30 20:13:47 +01:00
parent 8cfe03d0a6
commit 8db405a9c4
Signed by: daniel
SSH key fingerprint: SHA256:Ks/MyhQYcPRQiwMKLAKquWCdCPe3JXlb1WttgnAoSeM
7 changed files with 0 additions and 97 deletions

View file

@ -111,15 +111,6 @@
group = "mosquitto"; group = "mosquitto";
}; };
nitter-config = {
file = ./nitter/config.age;
};
nitter-guest-accounts = {
file = ./nitter/guestAccounts.age;
mode = "555";
};
anonymous-overflow-config = { anonymous-overflow-config = {
file = ./anonymous-overflow/config.age; file = ./anonymous-overflow/config.age;
}; };

Binary file not shown.

View file

@ -47,9 +47,6 @@ in
"agenix/hosts/tanker/mosquitto/passwordWeewxProxy.age".publicKeys = tanker; "agenix/hosts/tanker/mosquitto/passwordWeewxProxy.age".publicKeys = tanker;
"agenix/hosts/tanker/mosquitto/passwordWeewx.age".publicKeys = tanker; "agenix/hosts/tanker/mosquitto/passwordWeewx.age".publicKeys = tanker;
"agenix/hosts/tanker/nitter/config.age".publicKeys = tanker;
"agenix/hosts/tanker/nitter/guestAccounts.age".publicKeys = tanker;
"agenix/hosts/tanker/anonymous-overflow/config.age".publicKeys = tanker; "agenix/hosts/tanker/anonymous-overflow/config.age".publicKeys = tanker;
"agenix/hosts/tanker/invidious/databasePassword.age".publicKeys = tanker; "agenix/hosts/tanker/invidious/databasePassword.age".publicKeys = tanker;

View file

@ -50,8 +50,6 @@ in
../nixos/miniflux.nix ../nixos/miniflux.nix
(import ../nixos/nitter.nix (args // { inherit secret; }))
(import ../nixos/ntfy-sh.nix (args // { inherit secret; })) (import ../nixos/ntfy-sh.nix (args // { inherit secret; }))
../nixos/rimgo.nix ../nixos/rimgo.nix

View file

@ -1,83 +0,0 @@
{ pkgs, config, secret, ... }:
let
nitter-pkg = pkgs.nitter;
in
{
# Based on: https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/services/misc/nitter.nix
systemd.services.nitter = {
description = "Nitter (An alternative Twitter front-end)";
wantedBy = [ "multi-user.target" ];
requires = [ "redis-nitter.service" ];
wants = [ "network-online.target" ];
after = [ "network-online.target" "redis-nitter.service" ];
serviceConfig = {
DynamicUser = true;
StateDirectory = "nitter";
LoadCredential = [ "config:${config.age.secrets.nitter-config.path}" ];
Environment = [
"NITTER_CONF_FILE=%d/config"
"NITTER_ACCOUNTS_FILE=/var/lib/nitter/guest_accounts.json"
];
# Some parts of Nitter expect `public` folder in working directory,
# see https://github.com/zedeus/nitter/issues/414
WorkingDirectory = "${nitter-pkg}/share/nitter";
ExecStart = "${nitter-pkg}/bin/nitter";
Restart = "on-failure";
RestartSec = "5s";
# Hardening
CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ];
LockPersonality = true;
MemoryDenyWriteExecute = true;
PrivateDevices = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
UMask = "0077";
};
};
services.redis.servers.nitter = {
enable = true;
bind = "127.0.0.1";
port = 6380;
databases = 1;
save = [ ];
appendFsync = "no";
};
services.nginx.virtualHosts."${secret.nginx.hostnames.nitter}" = {
listenAddresses = [ "100.64.10.2" "[fd7a:115c:a1e0:1010::2]" ];
quic = true;
http3 = true;
root = "${nitter-pkg}/share/nitter/public/";
onlySSL = true;
useACMEHost = "daniel.sx";
locations."/" = {
tryFiles = "$uri @proxy";
};
locations."@proxy" = {
recommendedProxySettings = true;
proxyPass = "http://127.0.0.1:8001";
};
};
}