randogoth/bucur
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

added oberon

Browse source
This commit is contained in:
randogoth 2026-07-04 17:39:55 +03:00
parent 4662c7d02a
commit 347f102b39
2 changed files with 90 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
flake.nix
View file

@ -32,6 +32,11 @@
jirorian.url = "git+ssh://git@codeberg.org/randogoth/jirorian.git";
jirorian.inputs.nixpkgs.follows = "nixpkgs";
# oberon lives in the private xfay monorepo (server/oberon). It pins its own
# nixpkgs (nixos-unstable, for Dart 3.11) and must NOT follow ours — 25.11's
# Dart 3.9 is too old for its resolved lockfile.
oberon.url = "git+ssh://git@codeberg.org/randogoth/xfay.git?dir=server/oberon";
};
outputs = { self, nixpkgs, sops-nix, ... }@inputs:
@ -56,6 +61,7 @@
./modules/services/static-sites
./modules/services/webhook-deploy.nix
./modules/services/jirorian.nix
./modules/services/oberon.nix
./modules/services/nip05.nix
./modules/services/torrent-tracker.nix
./modules/services/backup.nix

84
modules/services/oberon.nix Normal file
View file

@ -0,0 +1,84 @@
{ pkgs, inputs, config, ... }:
let
# Public domain for the fax backend — numbers REST + Sinch inbound webhook only.
# The outbound consumer is relay-driven and has no public route.
domain = "fax.xfay.app";
# Non-secret runtime configuration.
port = 8391;
relayUrl = "wss://relay.xfay.app/";
cdnUrl = "https://upload.xfay.app";
pkg = inputs.oberon.packages.${pkgs.system}.default;
# Wrapper that exports sops-managed secrets, then execs oberon (same pattern as
# jirorian.nix — EnvironmentFile loads too early for sops-nix).
startScript = pkgs.writeShellScript "oberon-start" ''
set -euo pipefail
export SINCH_PROJECT_ID=$(cat ${config.sops.secrets.oberon_sinch_project_id.path})
export SINCH_KEY_ID=$(cat ${config.sops.secrets.oberon_sinch_key_id.path})
export SINCH_KEY_SECRET=$(cat ${config.sops.secrets.oberon_sinch_key_secret.path})
export SINCH_FAX_SERVICE_ID=$(cat ${config.sops.secrets.oberon_sinch_service_id.path})
export SINCH_WEBHOOK_USER=$(cat ${config.sops.secrets.oberon_sinch_webhook_user.path})
export SINCH_WEBHOOK_PASS=$(cat ${config.sops.secrets.oberon_sinch_webhook_pass.path})
export FAX_INBOUND_NOSTR_PRIVKEY=$(cat ${config.sops.secrets.oberon_inbound_privkey.path})
export FAX_OUTBOUND_NOSTR_PRIVKEY=$(cat ${config.sops.secrets.oberon_outbound_privkey.path})
export OFFICIAL_FAX_NUMBER=$(cat ${config.sops.secrets.oberon_official_number.path})
export CDN_APP_SECRET=$(cat ${config.sops.secrets.oberon_cdn_app_secret.path})
exec ${pkg}/bin/oberon
'';
in
{
# Secrets — add corresponding keys to secrets/bucur.yaml via sops.
sops.secrets.oberon_sinch_project_id = { owner = "oberon"; };
sops.secrets.oberon_sinch_key_id = { owner = "oberon"; };
sops.secrets.oberon_sinch_key_secret = { owner = "oberon"; };
sops.secrets.oberon_sinch_service_id = { owner = "oberon"; };
sops.secrets.oberon_sinch_webhook_user = { owner = "oberon"; };
sops.secrets.oberon_sinch_webhook_pass = { owner = "oberon"; };
sops.secrets.oberon_inbound_privkey = { owner = "oberon"; };
sops.secrets.oberon_outbound_privkey = { owner = "oberon"; };
sops.secrets.oberon_official_number = { owner = "oberon"; };
sops.secrets.oberon_cdn_app_secret = { owner = "oberon"; };
users.users.oberon = {
isSystemUser = true;
group = "oberon";
home = "/var/lib/oberon";
};
users.groups.oberon = {};
systemd.services.oberon = {
description = "Oberon — xfay fax backend (Sinch ⇄ Nostr bridge)";
after = [ "network.target" "sops-nix.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
User = "oberon";
Group = "oberon";
StateDirectory = "oberon";
RuntimeDirectory = "oberon";
ExecStart = startScript;
Environment = [
"PORT=${toString port}"
"DB_PATH=/var/lib/oberon/oberon.db"
"RELAY_URLS=${relayUrl}"
"CDN_URL=${cdnUrl}"
"CDN_APP_NAME=xfay"
# Abuse controls (M4) — start conservative; empty prefix list = allow all.
"ALLOWED_DESTINATION_PREFIXES=+1"
"MAX_FAXES_PER_PUBKEY_PER_DAY=20"
"MAX_FAXES_PER_DESTINATION_PER_DAY=5"
];
Restart = "on-failure";
RestartSec = 5;
};
};
# Caddy reverse proxy fragment — picked up via the glob import in caddy.nix.
environment.etc."caddy/Caddyfile.d/oberon.caddyfile".text = ''
${domain} {
reverse_proxy localhost:${toString port}
}
'';
}