d07e7c3d90
Moves the Prosody server, xmpp-web frontends (chat/plaza), and Forgejo's wiki-update webhook notifier from pinix to blunix, co-located with Traefik/ACME so TLS comes straight from Traefik's cert store instead of the old manual copy process. pinix's prosody/xmpp-web/webhook modules stay in place but deactivated as a fallback, matching the earlier Forgejo migration's pattern. Implements docs/intent/xmpp-umzug-pinix-blunix.md. Deployed and verified live on blunix (nixos-rebuild switch, chat/plaza returning 200, prosody healthy, agent XMPP listeners reconnected). Two first-bootstrap bugs found and fixed during that verification, both specific to bringing Prosody up on a host it never ran on before: - prosody-certs-sync.service used to call a blocking `systemctl reload-or-restart prosody.service` whenever the cert file differed from what's installed -- including on first activation, where prosody.service's own start job is still queued behind this unit (Requires+After), deadlocking forever. Now only reloads an already-running Prosody; ordering alone brings up a fresh one with the cert just installed. - hosts/blunix/localServices/secrets.nix force-owned the global `bindPW` secret to root with the (previously correct) rationale that it belongs to a pinix-only service. Prosody now runs on blunix too and needs to read it directly as its own LDAP bind config include, so that override no longer applies to it. pinix's own deploy (data migration, DNS/webhook cutover) is separate follow-up work, not part of this commit. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ANg2L2xUmNJ45t9mcv6HVT
2.4 KiB
2.4 KiB
blunix services
Imported from default.nix. blunix is the Connector: reverse proxy,
identity, mesh control, and the two statically-hosted sites that need to
stay reachable independent of pinix.
| File/dir | Service |
|---|---|
traefik/ |
Reverse proxy — router config, split into routes-external.nix/routes-internal.nix plus per-service dynamic config (dex.nix, forgejo.nix, cal.nix, prosody.nix); see default.nix for the base setup |
dex.nix, service-dex.nix |
OIDC provider (Dex), authenticates against LLDAP |
lldap.nix |
LDAP user/group directory with the shared 0ff.space background |
oauth2-proxy.nix |
OIDC gate in front of the launcher site |
adguard.nix |
DNS, including the internal-route rewrites (see docs/networking.md on the wiki) |
headscale.nix |
Tailscale mesh control plane |
tailscale.nix |
This host's own tailnet client |
website.nix, launcher.nix |
Static sites hosted directly on blunix (lukasrosier.com, 0ff.space) so they stay up independent of pinix |
fileserver-external.nix |
Public file mirror (data.${domain}); its generated directory listings use the shared 0ff.space background |
wordpress.nix |
WordPress instance |
webhook.nix |
Auto-pull receiver for website/launcher on push |
agent-codex/ |
XMPP-reachable Codex agent (Agent + Builder roles), see its own README |
orga-agent.nix, orga-agent/ |
Secret-isolated, read-only CalDAV/IMAP helpers and strictly non-executable write previews for the visible Orga agent |
prosody/setup-prosody.nix, xmpp-web.nix |
XMPP server (c2s/s2s/MUC/HTTP upload) and its two web frontends (chat, plaza), moved here from pinix; see prosody/README.md |
nixbuild.nix |
nixbuild.net remote-builder registration (opt-in, not automatic) |
restic.nix |
Backups |
fail2ban.nix |
Brute-force protection |
packages.nix, packages-stable.nix, secrets.nix |
Host plumbing, not user-facing services |
Not currently wired into default.nix at all: emptyCerts.nix (commented
out), sshd.nix (a tailnet-bound sshd listener that isn't imported
anywhere — the global sshd.nix from hosts/globalServices/ is what's
actually active). Dead config, not deployed. forgejo.nix is wired in
and active as of 2026-09-06 — Forgejo itself moved here from pinix; the
line above describing it as "an earlier attempt ... superseded by pinix"
was stale and has been corrected.