d07e7c3d90
Moves the Prosody server, xmpp-web frontends (chat/plaza), and Forgejo's wiki-update webhook notifier from pinix to blunix, co-located with Traefik/ACME so TLS comes straight from Traefik's cert store instead of the old manual copy process. pinix's prosody/xmpp-web/webhook modules stay in place but deactivated as a fallback, matching the earlier Forgejo migration's pattern. Implements docs/intent/xmpp-umzug-pinix-blunix.md. Deployed and verified live on blunix (nixos-rebuild switch, chat/plaza returning 200, prosody healthy, agent XMPP listeners reconnected). Two first-bootstrap bugs found and fixed during that verification, both specific to bringing Prosody up on a host it never ran on before: - prosody-certs-sync.service used to call a blocking `systemctl reload-or-restart prosody.service` whenever the cert file differed from what's installed -- including on first activation, where prosody.service's own start job is still queued behind this unit (Requires+After), deadlocking forever. Now only reloads an already-running Prosody; ordering alone brings up a fresh one with the cert just installed. - hosts/blunix/localServices/secrets.nix force-owned the global `bindPW` secret to root with the (previously correct) rationale that it belongs to a pinix-only service. Prosody now runs on blunix too and needs to read it directly as its own LDAP bind config include, so that override no longer applies to it. pinix's own deploy (data migration, DNS/webhook cutover) is separate follow-up work, not part of this commit. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ANg2L2xUmNJ45t9mcv6HVT
46 lines
1.4 KiB
Nix
46 lines
1.4 KiB
Nix
# Replaces traefik/xmpp-web.nix (TCP-TLS passthrough for the web
|
|
# frontends) and upload-prosody.nix (HTTP loadbalancer to pinix) now that
|
|
# Prosody and its web frontends run locally (docs/intent/
|
|
# xmpp-umzug-pinix-blunix.md, 2026-09-06). Both were remote-backend
|
|
# passthroughs; a normal HTTP router is enough for a local one, the same
|
|
# shape as traefik/forgejo.nix.
|
|
{ config, ... }:
|
|
{
|
|
services.traefik.dynamicConfigOptions.http = {
|
|
routers = {
|
|
xmpp-web-plaza = {
|
|
rule = "Host(`plaza.${config.domain}`)";
|
|
tls.certResolver = "cloudflare";
|
|
service = "xmpp-web";
|
|
entryPoints = [ "websecure" ];
|
|
};
|
|
|
|
xmpp-web-chat = {
|
|
rule = "Host(`chat.${config.domain}`)";
|
|
tls.certResolver = "cloudflare";
|
|
service = "xmpp-web";
|
|
entryPoints = [ "websecure" ];
|
|
};
|
|
|
|
upload = {
|
|
rule = "Host(`upload.${config.domain}`)";
|
|
tls.certResolver = "cloudflare";
|
|
service = "upload";
|
|
entryPoints = [ "websecure" ];
|
|
};
|
|
};
|
|
|
|
services = {
|
|
# Both hostnames terminate on the same nginx, name-based (Host
|
|
# header) vhosting on one loopback port -- one shared backend
|
|
# service is enough, as it was with SNI before.
|
|
xmpp-web.loadBalancer.servers = [
|
|
{ url = "http://127.0.0.1:8080/"; }
|
|
];
|
|
|
|
upload.loadBalancer.servers = [
|
|
{ url = "http://127.0.0.1:5280/"; }
|
|
];
|
|
};
|
|
};
|
|
}
|