forked from lukas/nixos-config
2e8ee3758f
- hosts/pinix/localServices/prosody/modules/mod_turntaking.lua (new): enforces one-message-then-wait-for-reply on agent@bot.0ff.space per sender JID, bouncing extra messages with a policy-violation error. Wired via plugin_paths + modules_enabled on the bot.0ff.space vhost. - Replace the pinix agent-xmpp-listener.service with an agent-codex setup on blunix (hosts/blunix/localServices/agent-codex.nix + listener.py/worker.py/tests, agents/platform/AGENTS.md): XMPP messages to agent@ now feed a job queue processed by a worker instead of only being archived to journalctl. - secrets: agentXmpp now used by blunix (hosts/blunix/localServices/ secrets.nix) instead of only pinix; secretFiles.nix trimmed accordingly. - calendar: lukas's personal Radicale collection exposed read-only via a second ICS feed (radicale.nix rights rule + web.nix nginx location + calendar-web eventSources), matching the earlier cal.0ff.space/ calendar.0ff.space split. - docs/roadmap.md, prosody/README.md, secrets/README.md updated to match.
68 lines
2 KiB
Nix
68 lines
2 KiB
Nix
{ config, ... }:
|
|
{
|
|
users.users.radicale.extraGroups = [ "lldap" ];
|
|
|
|
services.radicale = {
|
|
enable = true;
|
|
settings = {
|
|
server = {
|
|
hosts = [ "${config.tailnetIPs.pinix}:5002" ];
|
|
};
|
|
auth = {
|
|
type = "ldap";
|
|
ldap_uri = "ldap://${config.tailnetIPs.blunix}:3890";
|
|
ldap_base = config.ldapBaseDN;
|
|
ldap_reader_dn = "uid=admin,ou=people,${config.ldapBaseDN}";
|
|
ldap_secret_file = config.age.secrets.lldapAdmin.path;
|
|
};
|
|
storage = {
|
|
filesystem_folder = "/var/lib/radicale/collections";
|
|
};
|
|
};
|
|
rights = {
|
|
"00-root" = {
|
|
user = ".+";
|
|
collection = "";
|
|
permissions = "R";
|
|
};
|
|
"10-shared-principal" = {
|
|
user = ".+";
|
|
collection = "calendar";
|
|
permissions = "R";
|
|
};
|
|
"20-shared-calendar-authenticated" = {
|
|
user = ".+";
|
|
collection = "calendar/public";
|
|
# All authenticated users can edit events, but cannot delete or
|
|
# overwrite the shared collection itself.
|
|
permissions = "rwdo";
|
|
};
|
|
"30-principal" = {
|
|
user = ".+";
|
|
collection = "{user}";
|
|
permissions = "RW";
|
|
};
|
|
"40-calendars" = {
|
|
user = ".+";
|
|
collection = "{user}/[^/]+";
|
|
permissions = "rw";
|
|
};
|
|
"90-public-calendar" = {
|
|
user = ".*";
|
|
collection = "calendar/public";
|
|
permissions = "r";
|
|
};
|
|
# lukas's personal "Kalender" collection (Apple-CalDAV-generated UUID,
|
|
# not the DEFAULT_TASK_CALENDAR_NAME one). Fragile: if this calendar
|
|
# is ever deleted and recreated in a CalDAV client, it gets a new
|
|
# random UUID and this rule silently stops matching -- re-check the
|
|
# UUID under /var/lib/radicale/collections/collection-root/lukas/ if
|
|
# the public feed goes empty after a client-side calendar reset.
|
|
"91-lukas-calendar-public" = {
|
|
user = ".*";
|
|
collection = "lukas/C6327392-6961-4753-A333-97ACE0A7CC82";
|
|
permissions = "r";
|
|
};
|
|
};
|
|
};
|
|
}
|