common.nix

@@ -47,7 +47,6 @@
     parted
     unzip
     tree
-    smartmontools
   ];
   
   fileSystems."/var/cache" = {

flake.nix

@@ -37,7 +37,7 @@
           nix.registry.unstable.flake = nixos-unstable;
         }
 
-        home-manager.nixosModules.home-manager
+#        home-manager.nixosModules.home-manager
         ./hosts/architect/default.nix
       ];
     };

hosts/architect/default.nix

@@ -28,7 +28,6 @@ in
       ./plex.nix
       ./dns.nix
       ./minecraft.nix
-      ./plex.nix
     ];
 
     time.timeZone                                  = "Europe/Rome";
@@ -122,10 +121,6 @@ in
         ${germano-wg}         germano.devs.giugl.io
         ${dodino-wg}          dodino.devs.giugl.io
         ${tommy-wg}           tommy.devs.giugl.io
-        ${alain-wg}           alain.devs.giugl.io
-        ${dima-wg}            dima.devs.giugl.io
-        ${boogino-wg}         boogino.devs.giugl.io
-        ${mikey-wg}           mikey.devs.giugl.io
 
         # Blacklist
         0.0.0.0                metrics.plex.tv
@@ -169,7 +164,6 @@ in
       zfs.autoScrub.enable = true;
       xserver.videoDrivers = [ "nvidia" ];
       openssh.enable = true;
-      smartd.enable = true;
     };
 
     environment.variables = {

hosts/architect/matrix.nix

@@ -6,11 +6,11 @@ with import ./network.nix;
     matrix-synapse = {
       enable = true;
       server_name = "${matrixdomain}";
-      database_name = "synapse";
+      database_type = "sqlite3";
       public_baseurl = "https://${matrixdomain}";
       registration_shared_secret = "runas!";
       dynamic_thumbnails = true;
-      #enable_registration = true;
+      enable_registration = true;
       app_service_config_files = [ 
         "/var/lib/matrix-synapse/discord-registration.yaml" 
         "/var/lib/matrix-synapse/telegram-registration.yaml" 
@@ -39,19 +39,6 @@ with import ./network.nix;
       ];
     };
 
-    postgresql = {
-      enable = true;
-      ensureDatabases = [ "synapse" ];
-      ensureUsers = [
-        {
-          name = "matrix-synapse";
-          ensurePermissions = {
-            "DATABASE synapse" = "ALL PRIVILEGES";
-          };
-        }
-      ];
-    };
-
     nginx.virtualHosts = {
       # server
       ${matrixdomain} = {

hosts/architect/network.nix

@@ -37,12 +37,10 @@ rec {
   tommy-wg         = "10.3.0.21";
   alain-wg         = "10.3.0.22";
   dima-wg          = "10.3.0.23";
-  mikey-wg         = "10.3.0.24";
   eleonora-wg      = "10.3.0.100";
   broccolino-wg    = "10.3.0.200";
   hotpottino-wg    = "10.3.0.201";
   dodino-wg        = "10.3.0.202";
-  boogino-wg       = "10.3.0.203";
 
   # groups
   gdevices-wg      = [ galuminum-wg oneplus-wg ipad-wg gbeast-wg peppiniell-wg padulino-wg angelino-wg ];

hosts/architect/plex.nix

@@ -4,7 +4,18 @@ with import ./network.nix;
 {
   services.plex = {
     enable = true;
-    package = pkgs.unstable.plex;
+    package = pkgs.plex.overrideAttrs (x: let
+        # see https://www.plex.tv/media-server-downloads/ for 64bit rpm
+        version = "1.24.1.4931-1a38e63c6";
+        sha1 = "7d0751f7efaa7b5fc9ac2a3cdb130712db6b6d89";
+      in {
+        name = "plex-${version}";
+        src = pkgs.fetchurl {
+          url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
+          inherit sha1;
+        };
+      }
+    );
   };
 
   services.nginx = {
@@ -14,7 +25,12 @@ with import ./network.nix;
       forceSSL = true;
       enableACME = true;
       http2 = true;
+
       extraConfig = ''
+        allow 10.0.0.0/24;
+        allow 10.3.0.0/24;
+        deny all;
+
       #Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause
         send_timeout 100m;
 
@@ -71,7 +87,7 @@ with import ./network.nix;
         proxy_buffering off;
       '';
       locations."/" = {
-        proxyPass = "https://localhost:32400";
+        proxyPass = "http://localhost:32400/";
       };
     };
   };

hosts/architect/wireguard.nix

@@ -177,18 +177,6 @@ with import ./network.nix;
           allowedIPs = [dima-wg];
           publicKey = "svzWYIZ6v+cLCp/emGG7mx2YpBJqw2fqjVuHZy7b6H0=";
         }
-
-        {
-          # boogino
-          allowedIPs = [boogino-wg];
-          publicKey = "p21tD9S04+b+TC27a1CvkJL7V6fcfjOpVU7Ke1FzV3A=";
-        }
-
-        {
-          # mikey
-          allowedIPs = [mikey-wg];
-          publicKey = "ewbDdX3z7nxG2aPIf9TogXkhxPlGipLFcy6XfyDC6gI=";
-        }
       ];
     };
   };