Compare commits

...

10 commits

21 changed files with 122 additions and 43 deletions

View file

@ -0,0 +1,32 @@
## Pour remonter locement un backup de PSQL fait par Nomad (backup-weekly.hcl)
```bash
export AWS_BUCKET=backups-pgbasebackup
export AWS_ENDPOINT=s3.deuxfleurs.shirokumo.net
export AWS_ACCESS_KEY_ID=$(consul kv get "secrets/postgres/backup/aws_access_key_id")
export AWS_SECRET_ACCESS_KEY=$(consul kv get secrets/postgres/backup/aws_secret_access_key)
export CRYPT_PUBLIC_KEY=$(consul kv get secrets/postgres/backup/crypt_public_key)
```
Et voilà le travail :
```bash
$ aws s3 --endpoint https://$AWS_ENDPOINT ls
2022-04-14 17:00:50 backups-pgbasebackup
$ aws s3 --endpoint https://$AWS_ENDPOINT ls s3://backups-pgbasebackup
PRE 2024-07-28 00:00:36.140539/
PRE 2024-08-04 00:00:21.291551/
PRE 2024-08-11 00:00:26.589762/
PRE 2024-08-18 00:00:40.873939/
PRE 2024-08-25 01:03:54.672763/
PRE 2024-09-01 00:00:20.019605/
PRE 2024-09-08 00:00:16.969740/
PRE 2024-09-15 00:00:37.951459/
PRE 2024-09-22 00:00:21.030452/
$ aws s3 --endpoint https://$AWS_ENDPOINT ls "s3://backups-pgbasebackup/2024-09-22 00:00:21.030452/"
2024-09-22 03:23:28 623490 backup_manifest
2024-09-22 03:25:32 6037121487 base.tar.gz
2024-09-22 03:25:33 19948939 pg_wal.tar.gz
```

View file

@ -44,6 +44,8 @@ if not client.bucket_exists(bucket):
abort(f"Bucket {bucket} does not exist or its access is forbidden, aborting") abort(f"Bucket {bucket} does not exist or its access is forbidden, aborting")
# Perform the backup locally # Perform the backup locally
# Via command-line:
# pg_basebackup --host=localhost --username=$PSQL_USER --pgdata=. --format=tar --wal-method=stream --gzip --compress=6 --progress --max-rate=5M
try: try:
ret = subprocess.run(["pg_basebackup", ret = subprocess.run(["pg_basebackup",
f"--host={psql_host}", f"--host={psql_host}",

View file

@ -71,16 +71,16 @@
}); });
in buildNpmPackage rec { in buildNpmPackage rec {
pname = "cryptpad"; pname = "cryptpad";
version = "2024.6.1"; version = "2024.9.0";
src = fetchFromGitHub { src = fetchFromGitHub {
owner = "cryptpad"; owner = "cryptpad";
repo = "cryptpad"; repo = "cryptpad";
rev = version; rev = version;
hash = "sha256-qwyXpTY8Ds7R5687PVGZa/rlEyrAZjNzJ4+VQZpF8v0="; hash = "sha256-OUtWaDVLRUbKS0apwY0aNq4MalGFv+fH9VA7LvWWYRs=";
}; };
npmDepsHash = "sha256-GSTPsXqe/rxiDh5OW2t+ZY1YRNgRSDxkJ0pvcLIFtFw="; npmDepsHash = "sha256-pK0b7q1kJja9l8ANwudbfo3jpldwuO56kuulS8X9A5s=";
inherit nodejs; inherit nodejs;

View file

@ -3,8 +3,8 @@
"nixpkgs": { "nixpkgs": {
"type": "Channel", "type": "Channel",
"name": "nixos-24.05", "name": "nixos-24.05",
"url": "https://releases.nixos.org/nixos/24.05/nixos-24.05.3311.a1cc729dcbc3/nixexprs.tar.xz", "url": "https://releases.nixos.org/nixos/24.05/nixos-24.05.5385.1719f27dd95f/nixexprs.tar.xz",
"hash": "13al93fac4xdxj0jllfby2v9klwqdhsf3yg10mnsm9ys84v7gsnn" "hash": "0f7i315g1z8kjh10hvj2zv7y2vfqxmwvd96hwlcrr8aig6qq5gzm"
} }
}, },
"version": 3 "version": 3

View file

@ -26,7 +26,7 @@ job "cryptpad" {
} }
config { config {
image = "kokakiwi/cryptpad:2024.6.1" image = "kokakiwi/cryptpad:2024.9.0"
ports = [ "http" ] ports = [ "http" ]
volumes = [ volumes = [

View file

@ -7,6 +7,7 @@ services:
args: args:
# https://github.com/jitsi/jitsi-meet # https://github.com/jitsi/jitsi-meet
MEET_TAG: stable/jitsi-meet_9646 MEET_TAG: stable/jitsi-meet_9646
NODE_MAJOR_VERSION: 22
image: superboum/amd64_jitsi_meet:v7 image: superboum/amd64_jitsi_meet:v7
jitsi-conference-focus: jitsi-conference-focus:

View file

@ -1,8 +1,9 @@
FROM debian:bookworm AS builder FROM debian:bookworm AS builder
ARG NODE_MAJOR_VERSION
RUN apt-get update && \ RUN apt-get update && \
apt-get install -y curl && \ apt-get install -y curl && \
curl -sL https://deb.nodesource.com/setup_22.x | bash - && \ curl -sL https://deb.nodesource.com/setup_${NODE_MAJOR_VERSION}.x | bash - && \
apt-get install -y git nodejs make git unzip apt-get install -y git nodejs make git unzip
ARG MEET_TAG ARG MEET_TAG

View file

@ -6,7 +6,7 @@ if [ -z "${JITSI_NAT_LOCAL_IP}" ]; then
fi fi
if [ -z "${JITSI_NAT_PUBLIC_IP}" ]; then if [ -z "${JITSI_NAT_PUBLIC_IP}" ]; then
JITSI_NAT_PUBLIC_IP=$(curl https://ifconfig.me) JITSI_NAT_PUBLIC_IP=$(curl -4 https://ifconfig.me)
fi fi
echo "NAT config: ${JITSI_NAT_LOCAL_IP} -> ${JITSI_NAT_PUBLIC_IP}" echo "NAT config: ${JITSI_NAT_LOCAL_IP} -> ${JITSI_NAT_PUBLIC_IP}"

View file

@ -115,7 +115,8 @@ videobridge {
# (e.g. health or debug stats) # (e.g. health or debug stats)
private { private {
# See JettyBundleActivatorConfig in Jicoco for values # See JettyBundleActivatorConfig in Jicoco for values
host = 127.0.0.1 host = 0.0.0.0
port = {{ env "NOMAD_PORT_management_port" }}
} }
} }
octo { octo {

View file

@ -20,7 +20,7 @@ job "jitsi" {
task "xmpp" { task "xmpp" {
driver = "docker" driver = "docker"
config { config {
image = "superboum/amd64_jitsi_xmpp:v11" image = "superboum/amd64_jitsi_xmpp:v12"
ports = [ "bosh_port", "xmpp_port" ] ports = [ "bosh_port", "xmpp_port" ]
network_mode = "host" network_mode = "host"
volumes = [ volumes = [
@ -101,7 +101,7 @@ EOF
task "front" { task "front" {
driver = "docker" driver = "docker"
config { config {
image = "superboum/amd64_jitsi_meet:v6" image = "superboum/amd64_jitsi_meet:v7"
network_mode = "host" network_mode = "host"
ports = [ "https_port" ] ports = [ "https_port" ]
volumes = [ volumes = [
@ -168,7 +168,7 @@ EOF
task "jicofo" { task "jicofo" {
driver = "docker" driver = "docker"
config { config {
image = "superboum/amd64_jitsi_conference_focus:v10" image = "superboum/amd64_jitsi_conference_focus:v11"
network_mode = "host" network_mode = "host"
volumes = [ volumes = [
"secrets/certs/jitsi.crt:/usr/local/share/ca-certificates/jitsi.crt", "secrets/certs/jitsi.crt:/usr/local/share/ca-certificates/jitsi.crt",
@ -203,14 +203,15 @@ EOF
group "data_plane" { group "data_plane" {
network { network {
port "video_port" { static = 8080 } port "video_port" { static = 8080 }
port "management_port" { static = 8000 }
} }
task "videobridge" { task "videobridge" {
driver = "docker" driver = "docker"
config { config {
image = "superboum/amd64_jitsi_videobridge:v21" image = "superboum/amd64_jitsi_videobridge:v22"
network_mode = "host" network_mode = "host"
ports = [ "video_port" ] ports = [ "video_port", "management_port" ]
ulimit { ulimit {
nofile = "1048576:1048576" nofile = "1048576:1048576"
nproc = "65536:65536" nproc = "65536:65536"
@ -259,9 +260,16 @@ EOF
port = "video_port" port = "video_port"
address_mode = "host" address_mode = "host"
name = "video-jitsi" name = "video-jitsi"
}
service {
tags = [ "jitsi" ]
port = "management_port"
address_mode = "host"
name = "management-video-jitsi"
check { check {
type = "tcp" type = "tcp"
port = "video_port" port = "management_port"
interval = "60s" interval = "60s"
timeout = "5s" timeout = "5s"
} }

View file

@ -52,7 +52,7 @@ But maybe this value is deprecated: the check is still here but it is not used a
start a maintainance container start a maintainance container
``` ```
docker run --rm -it -v `pwd`/prosody/certs/:/var/lib/prosody/ -v `pwd`/prosody/prosody.cfg.lua:/etc/prosody/prosody.cfg.lua:ro --user root superboum/amd64_jitsi_xmpp:v11 bash docker run --rm -it -v `pwd`/prosody/certs/:/var/lib/prosody/ -v `pwd`/prosody/prosody.cfg.lua:/etc/prosody/prosody.cfg.lua:ro --user root superboum/amd64_jitsi_xmpp:v12 bash
``` ```
then generate certificates from inside this container then generate certificates from inside this container

View file

@ -1,7 +1,7 @@
version: '3.4' version: '3.4'
services: services:
jitsi-xmpp: jitsi-xmpp:
image: superboum/amd64_jitsi_xmpp:v11 image: superboum/amd64_jitsi_xmpp:v12
volumes: volumes:
- "./prosody/prosody.cfg.lua:/etc/prosody/prosody.cfg.lua:ro" - "./prosody/prosody.cfg.lua:/etc/prosody/prosody.cfg.lua:ro"
- "./prosody/certs/jitsi.crt:/var/lib/prosody/jitsi.crt:ro" - "./prosody/certs/jitsi.crt:/var/lib/prosody/jitsi.crt:ro"
@ -11,16 +11,19 @@ services:
environment: environment:
- JICOFO_AUTH_PASSWORD=jicofopass - JICOFO_AUTH_PASSWORD=jicofopass
- JVB_AUTH_PASSWORD=jvbpass - JVB_AUTH_PASSWORD=jvbpass
ports:
- "5222:5222/tcp"
jitsi-conference-focus: jitsi-conference-focus:
image: superboum/amd64_jitsi_conference_focus:v10 image: superboum/amd64_jitsi_conference_focus:v11
volumes: volumes:
- "./prosody/certs/jitsi.crt:/usr/local/share/ca-certificates/jitsi.crt:ro" - "./prosody/certs/jitsi.crt:/usr/local/share/ca-certificates/jitsi.crt:ro"
- "./prosody/certs/auth.jitsi.crt:/usr/local/share/ca-certificates/auth.jitsi.crt:ro" - "./prosody/certs/auth.jitsi.crt:/usr/local/share/ca-certificates/auth.jitsi.crt:ro"
- "./jicofo/jicofo.conf:/etc/jitsi/jicofo.conf:ro" - "./jicofo/jicofo.conf:/etc/jitsi/jicofo.conf:ro"
jitsi-videobridge: jitsi-videobridge:
image: superboum/amd64_jitsi_videobridge:v21 image: superboum/amd64_jitsi_videobridge:v22
network_mode: "host"
volumes: volumes:
- "./prosody/certs/jitsi.crt:/usr/local/share/ca-certificates/jitsi.crt:ro" - "./prosody/certs/jitsi.crt:/usr/local/share/ca-certificates/jitsi.crt:ro"
- "./prosody/certs/auth.jitsi.crt:/usr/local/share/ca-certificates/auth.jitsi.crt:ro" - "./prosody/certs/auth.jitsi.crt:/usr/local/share/ca-certificates/auth.jitsi.crt:ro"
@ -31,7 +34,7 @@ services:
- "10000:10000/udp" - "10000:10000/udp"
jitsi-meet: jitsi-meet:
image: superboum/amd64_jitsi_meet:v6 image: superboum/amd64_jitsi_meet:v7
volumes: volumes:
- "./prosody/certs/jitsi.crt:/etc/nginx/jitsi.crt:ro" - "./prosody/certs/jitsi.crt:/etc/nginx/jitsi.crt:ro"
- "./prosody/certs/jitsi.key:/etc/nginx/jitsi.key:ro" - "./prosody/certs/jitsi.key:/etc/nginx/jitsi.key:ro"

View file

@ -62,7 +62,7 @@ videobridge {
configs { configs {
unique-xmpp-server { unique-xmpp-server {
hostname="jitsi-xmpp" hostname="172.17.0.1"
domain = "auth.jitsi" domain = "auth.jitsi"
username = "jvb" username = "jvb"
password = "jvbpass" password = "jvbpass"

View file

@ -22,7 +22,7 @@ var config = {
}, },
// BOSH URL. FIXME: use XEP-0156 to discover it. // BOSH URL. FIXME: use XEP-0156 to discover it.
bosh: '//192.168.1.143/http-bind', bosh: '//[2a0c:e303:0:2a00::de6]/http-bind',
// Websocket URL // Websocket URL
// websocket: 'wss://jitsi-meet.example.com/xmpp-websocket', // websocket: 'wss://jitsi-meet.example.com/xmpp-websocket',

View file

@ -0,0 +1,14 @@
# Informations relatives à la config Matrix
## Ressources
- La doc de Synapse est là : https://element-hq.github.io/synapse/latest/welcome_and_overview.html
### Métriques
- La page pour configurer les metrics : https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html?highlight=metrics#metrics
- La page pour le tutoriel sur configurer les metrics avec Prometheus : https://element-hq.github.io/synapse/latest/metrics-howto.html?highlight=metrics#how-to-monitor-synapse-metrics-using-prometheus
---
> Avec Nix on n'aurait pas tous ces problèmes.

View file

@ -6,18 +6,18 @@ services:
context: ./riotweb context: ./riotweb
args: args:
# https://github.com/vector-im/element-web/releases # https://github.com/vector-im/element-web/releases
VERSION: 1.11.49 VERSION: v1.11.78
image: lxpz/amd64_elementweb:v35 image: particallydone/amd64_elementweb:v36
synapse: synapse:
build: build:
context: ./matrix-synapse context: ./matrix-synapse
args: args:
# https://github.com/matrix-org/synapse/releases # https://github.com/matrix-org/synapse/releases
VERSION: 1.95.1 VERSION: v1.104.0
# https://github.com/matrix-org/synapse-s3-storage-provider/commits/main # https://github.com/matrix-org/synapse-s3-storage-provider/commits/main
# Update with the latest commit on main each time you update the synapse version # Update with the latest commit on main each time you update the synapse version
# otherwise synapse may fail to launch due to incompatibility issues # otherwise synapse may fail to launch due to incompatibility issues
# see this issue for an example: https://github.com/matrix-org/synapse-s3-storage-provider/issues/64 # see this issue for an example: https://github.com/matrix-org/synapse-s3-storage-provider/issues/64
S3_VERSION: v1.2.1 S3_VERSION: 2c46a764f700e6439afa11c00db827ddf21a9e89
image: lxpz/amd64_synapse:v58 image: particallydone/amd64_synapse:v60

View file

@ -1,4 +1,4 @@
FROM amd64/debian:bookworm as builder FROM amd64/debian:trixie AS builder
ARG VERSION ARG VERSION
ARG S3_VERSION ARG S3_VERSION
@ -22,21 +22,25 @@ RUN apt-get update && \
libpq-dev \ libpq-dev \
virtualenv \ virtualenv \
libxslt1-dev \ libxslt1-dev \
git && \ git
virtualenv /root/matrix-env -p /usr/bin/python3 && \
RUN virtualenv /root/matrix-env -p /usr/bin/python3 && \
. /root/matrix-env/bin/activate && \ . /root/matrix-env/bin/activate && \
pip3 install \ pip3 install \
https://github.com/matrix-org/synapse/archive/v${VERSION}.tar.gz#egg=matrix-synapse[matrix-synapse-ldap3,postgres,resources.consent,saml2,url_preview] && \ https://github.com/element-hq/synapse/archive/${VERSION}.tar.gz#egg=matrix-synapse[matrix-synapse-ldap3,postgres,resources.consent,saml2,url_preview] && \
pip3 install \ pip3 install \
git+https://github.com/matrix-org/synapse-s3-storage-provider.git@${S3_VERSION} git+https://github.com/matrix-org/synapse-s3-storage-provider.git@${S3_VERSION}
FROM amd64/debian:bookworm # WARNING: trixie n'est pas une LTS
# mais on est obligé d'avoir la même version que le builder
# et le builder veut une version de rustc qui n'est pas dans bookworm (dernière LTS at the time of writing)
FROM amd64/debian:trixie
RUN apt-get update && \ RUN apt-get update && \
apt-get -qq -y full-upgrade && \ apt-get -qq -y full-upgrade && \
apt-get install -y \ apt-get install -y \
python3 \ python3 \
python3-distutils \ python3-setuptools \
libffi8 \ libffi8 \
libjpeg62-turbo \ libjpeg62-turbo \
libssl3 \ libssl3 \

View file

@ -1,13 +1,16 @@
FROM amd64/debian:buster as builder FROM amd64/debian:trixie as builder
ARG VERSION ARG VERSION
WORKDIR /root WORKDIR /root
RUN apt-get update && \ RUN apt-get update && \
apt-get install -y wget && \ apt-get install -y wget
wget https://github.com/vector-im/element-web/releases/download/v${VERSION}/element-v${VERSION}.tar.gz && \
tar xf element-v${VERSION}.tar.gz && \
mv element-v${VERSION}/ riot/
RUN wget https://github.com/element-hq/element-web/releases/download/${VERSION}/element-${VERSION}.tar.gz && \
tar xf element-${VERSION}.tar.gz && \
mv element-${VERSION}/ riot/
# Le conteneur de superboum contient uniquement un serveur web de 5 lignes.
# Ca vous ennuie ? On peut publier Riot dans un bucket web Garage, tkt, ça sera Tricot qui servira.
FROM superboum/amd64_webserver:v3 FROM superboum/amd64_webserver:v3
COPY --from=builder /root/riot /srv/http COPY --from=builder /root/riot /srv/http

View file

@ -15,7 +15,7 @@ job "matrix" {
driver = "docker" driver = "docker"
config { config {
image = "lxpz/amd64_synapse:v58" image = "particallydone/amd64_synapse:v60"
network_mode = "host" network_mode = "host"
readonly_rootfs = true readonly_rootfs = true
ports = [ "api_port" ] ports = [ "api_port" ]
@ -101,7 +101,7 @@ job "matrix" {
driver = "docker" driver = "docker"
config { config {
image = "lxpz/amd64_synapse:v58" image = "particallydone/amd64_synapse:v60"
readonly_rootfs = true readonly_rootfs = true
command = "/usr/local/bin/matrix-s3-async" command = "/usr/local/bin/matrix-s3-async"
work_dir = "/tmp" work_dir = "/tmp"
@ -137,7 +137,7 @@ EOH
task "riotweb" { task "riotweb" {
driver = "docker" driver = "docker"
config { config {
image = "lxpz/amd64_elementweb:v35" image = "particallydone/amd64_elementweb:v36"
ports = [ "web_port" ] ports = [ "web_port" ]
volumes = [ volumes = [
"secrets/config.json:/srv/http/config.json" "secrets/config.json:/srv/http/config.json"
@ -190,7 +190,7 @@ EOH
driver = "docker" driver = "docker"
config { config {
image = "ghcr.io/matrix-org/sliding-sync:v0.99.12" image = "ghcr.io/matrix-org/sliding-sync:v0.99.16"
ports = [ "syncv3_api", "syncv3_metrics" ] ports = [ "syncv3_api", "syncv3_metrics" ]
} }

View file

@ -26,6 +26,16 @@ scrape_configs:
cert_file: /etc/prometheus/consul-client.crt cert_file: /etc/prometheus/consul-client.crt
key_file: /etc/prometheus/consul-client.key key_file: /etc/prometheus/consul-client.key
- job_name: 'jitsi-videobridge'
consul_sd_configs:
- server: 'https://localhost:8501'
services:
- 'management-video-jitsi'
tls_config:
ca_file: /etc/prometheus/consul-ca.crt
cert_file: /etc/prometheus/consul-client.crt
key_file: /etc/prometheus/consul-client.key
- job_name: 'garage' - job_name: 'garage'
authorization: authorization:
type: Bearer type: Bearer

View file

@ -20,7 +20,7 @@ job "telemetry-storage" {
task "prometheus" { task "prometheus" {
driver = "docker" driver = "docker"
config { config {
image = "prom/prometheus:v2.46.0" image = "prom/prometheus:v2.50.1"
network_mode = "host" network_mode = "host"
ports = [ "prometheus" ] ports = [ "prometheus" ]
args = [ args = [