Tweaked some URLs

Makefile

@@ -1,18 +1,10 @@
-.PHONY: help certs switch
+.PHONY: lock update build
 
-help:
+build:
-	@grep -E '^[a-zA-Z_-]+:.*##' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*## "}; {printf "  \033[36m%-20s\033[0m %s\n", $$1, $$2}'
-
-switch:
 	sudo nixos-rebuild switch --flake .#haschel
 
-certs:
+lock:
-	@for unit in $$(systemctl list-units 'acme-order-renew-*' --all --plain --no-legend --state=inactive --state=failed | awk '{print $$1}'); do \
+	nix flake lock
-		domain=$$(echo "$$unit" | sed 's/acme-order-renew-//;s/\.service//'); \
+
-		if [ ! -f "/var/lib/acme/$$domain/fullchain.pem" ]; then \
+update:
-			echo "Requesting cert for $$domain..."; \
+	nix flake update
-			sudo systemctl start "$$unit" & \
-		fi; \
-	done; \
-	wait; \
-	echo "Done. Check status with: systemctl list-units 'acme-order-renew-*' --all --state=failed"

configuration.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   imports = [
@@ -9,11 +9,15 @@
     ./modules/users.nix
     ./modules/hardware.nix
     ./modules/services.nix
-    ./modules/nginx.nix
+    ./modules/proxy.nix
     ./modules/matrix.nix
+    ./modules/fail2ban.nix
   ];
 
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
 
   environment.systemPackages = with pkgs; [
     git

flake.lock

@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1772624091,
+        "narHash": "sha256-QKyJ0QGWBn6r0invrMAK8dmJoBYWoOWy7lN+UHzW1jc=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "80bdc1e5ce51f56b19791b52b2901187931f5353",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -2,7 +2,7 @@
   description = "Haschel Proxy Server";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
   };
 
   outputs = { self, nixpkgs, ... }@inputs:

hardware-configuration.nix

@@ -1,28 +1,37 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{ lib, modulesPath, ... }:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
-    ];
+  ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/7a81e9fe-a727-4979-b63f-209ec593bd1d";
+    device = "/dev/disk/by-uuid/7a81e9fe-a727-4979-b63f-209ec593bd1d";
-      fsType = "ext4";
+    fsType = "ext4";
-    };
+  };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/FFAB-FF4F";
+    device = "/dev/disk/by-uuid/FFAB-FF4F";
-      fsType = "vfat";
+    fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
+    options = [
-    };
+      "fmask=0022"
+      "dmask=0022"
+    ];
+  };
 
   swapDevices = [ ];
 

modules/boot.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   boot.loader.grub = {
@@ -9,7 +9,7 @@
 
   boot.kernelPackages = pkgs.linuxPackages_latest;
   boot.kernelModules = [ "tcp_bbr" ];
-  
+
   boot.kernel.sysctl = {
     "net.core.default_qdisc" = "fq";
     "net.ipv4.tcp_congestion_control" = "bbr";

modules/fail2ban.nix

@@ -0,0 +1,71 @@
+{ ... }:
+
+{
+  services.fail2ban = {
+    enable = true;
+
+    bantime = "1h";
+    bantime-increment = {
+      enable = true;
+      maxtime = "168h";
+      factor = "4";
+    };
+
+    maxretry = 5;
+
+    ignoreIP = [
+      "127.0.0.0/8"
+      "::1"
+      "100.64.0.0/10"
+    ];
+
+    jails = {
+      sshd = {
+        settings = {
+          enabled = true;
+          port = "22";
+          filter = "sshd[mode=aggressive]";
+          maxretry = 5;
+          findtime = "10m";
+          bantime = "1h";
+        };
+      };
+
+      nginx-botsearch = {
+        settings = {
+          enabled = true;
+          port = "http,https";
+          filter = "nginx-botsearch";
+          logpath = "/var/log/nginx/access.log";
+          maxretry = 5;
+          findtime = "10m";
+          bantime = "1h";
+        };
+      };
+
+      nginx-http-auth = {
+        settings = {
+          enabled = true;
+          port = "http,https";
+          filter = "nginx-http-auth";
+          logpath = "/var/log/nginx/error.log";
+          maxretry = 5;
+          findtime = "10m";
+          bantime = "1h";
+        };
+      };
+
+      nginx-bad-request = {
+        settings = {
+          enabled = true;
+          port = "http,https";
+          filter = "nginx-bad-request";
+          logpath = "/var/log/nginx/access.log";
+          maxretry = 15;
+          findtime = "10m";
+          bantime = "30m";
+        };
+      };
+    };
+  };
+}

modules/hardware.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ ... }:
 
 {
   hardware.enableRedistributableFirmware = true;

modules/locale.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ ... }:
 
 let
   settings = import ../settings.nix;

modules/matrix.nix

@@ -1,7 +1,7 @@
-{ config, pkgs, lib, ... }:
+{ pkgs, ... }:
 
 let
-  livekitKeyFile = "/run/livekit.key";
+  livekitKeyFile = "/var/lib/livekit/livekit.key";
   serverName = "atri.dad";
   matrixDomain = "matrix.atri.dad";
   matrixRtcDomain = "matrixrtc.atri.dad";
@@ -12,13 +12,19 @@ in
     settings = {
       global = {
         server_name = serverName;
-        address = [ "127.0.0.1" "::1" ];
+        address = [
+          "127.0.0.1"
+          "::1"
+        ];
         port = [ 6167 ];
         max_request_size = 104857600;
         allow_registration = false;
         allow_encryption = true;
         allow_federation = true;
-        trusted_servers = [ "matrix.org" "chat.blahaj.zone" ];
+        trusted_servers = [
+          "matrix.org"
+          "chat.blahaj.zone"
+        ];
         ip_range_denylist = [
           "127.0.0.0/8"
           "10.0.0.0/8"
@@ -33,13 +39,21 @@ in
           "fc00::/7"
         ];
 
+        zstd_compression = true;
+        gzip_compression = true;
+        brotli_compression = true;
+
+        allow_local_presence = true;
+        allow_incoming_presence = true;
+        allow_outgoing_presence = true;
+
         well_known = {
           server = "${matrixDomain}:443";
           client = "https://${matrixDomain}";
           rtc_transports = [
             {
               type = "livekit";
-              livekit_service_url = "https://${matrixRtcDomain}";
+              livekit_service_url = "https://${matrixDomain}/livekit/jwt";
             }
           ];
         };
@@ -55,9 +69,21 @@ in
       rtc = {
         port_range_start = 50000;
         port_range_end = 60000;
+        tcp_port = 7881;
         use_external_ip = true;
+        allow_tcp_fallback = true;
+      };
+      room.auto_create = true;
+      turn = {
+        enabled = true;
+        domain = matrixRtcDomain;
+        tls_port = 5349;
+        udp_port = 3478;
+        relay_range_start = 50000;
+        relay_range_end = 60000;
+        cert_file = "/run/credentials/livekit.service/turn-cert";
+        key_file = "/run/credentials/livekit.service/turn-key";
       };
-      room.auto_create = false;
     };
     keyFile = livekitKeyFile;
   };
@@ -70,22 +96,49 @@ in
 
   systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = serverName;
 
+  systemd.services.livekit.serviceConfig.LoadCredential = [
+    "turn-cert:/var/lib/acme/${matrixRtcDomain}/fullchain.pem"
+    "turn-key:/var/lib/acme/${matrixRtcDomain}/key.pem"
+  ];
+  systemd.services.livekit.after = [ "acme-${matrixRtcDomain}.service" ];
+  systemd.services.livekit.requires = [ "acme-${matrixRtcDomain}.service" ];
+
   systemd.services.livekit-key = {
-    before = [ "lk-jwt-service.service" "livekit.service" ];
+    before = [
+      "lk-jwt-service.service"
+      "livekit.service"
+    ];
     wantedBy = [ "multi-user.target" ];
-    path = with pkgs; [ livekit coreutils gawk ];
+    path = with pkgs; [
+      livekit
+      coreutils
+      gawk
+    ];
     script = ''
       echo "Key missing, generating key"
+      install -d -m 0700 "$(dirname "${livekitKeyFile}")"
+      install -m 0600 /dev/null "${livekitKeyFile}"
       echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${livekitKeyFile}"
     '';
-    serviceConfig.Type = "oneshot";
+    serviceConfig = {
+      Type = "oneshot";
+      UMask = "0177";
+    };
     unitConfig.ConditionPathExists = "!${livekitKeyFile}";
   };
 
   networking.firewall = {
-    allowedTCPPorts = [ 7880 7881 ];
+    allowedTCPPorts = [
+      7880
+      7881
+      5349
+    ];
+    allowedUDPPorts = [ 3478 ];
     allowedUDPPortRanges = [
-      { from = 50000; to = 60000; }
+      {
+        from = 50000;
+        to = 60000;
+      }
     ];
   };
 }

modules/networking.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ ... }:
 
 let
   settings = import ../settings.nix;
@@ -7,10 +7,4 @@ in
   networking.hostName = settings.hostname;
 
   networking.networkmanager.enable = true;
-
-  networking.firewall = {
-    enable = true;
-    allowedTCPPorts = [ 22 80 443 ];
-    allowedUDPPorts = [ ];
-  };
 }

modules/nginx.nix

@@ -1,435 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-let
-  serverName = "atri.dad";
-  matrixDomain = "matrix.atri.dad";
-
-  wellKnownServer = builtins.toJSON {
-    "m.server" = "${matrixDomain}:443";
-  };
-
-  wellKnownClient = builtins.toJSON {
-    "m.homeserver" = {
-      base_url = "https://${matrixDomain}";
-    };
-  };
-in
-{
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "me@atri.dad";
-  };
-
-  services.nginx = {
-    enable = true;
-
-    recommendedGzipSettings = true;
-    recommendedOptimisation = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-
-    # Fuck AI
-    clientMaxBodySize = "3g";
-
-    commonHttpConfig = ''
-      more_clear_headers Server;
-      more_clear_headers X-Powered-By;
-
-      map $http_user_agent $fuckai {
-          default 0;
-
-          "~*GPTBot" 1;
-          "~*ChatGPT-User" 1;
-          "~*OAI-SearchBot" 1;
-          "~*ChatGPT-Browser" 1;
-          "~*ClaudeBot" 1;
-          "~*Claude-Web" 1;
-          "~*anthropic-ai" 1;
-          "~*Anthropic-Claude" 1;
-          "~*xAI-Bot" 1;
-          "~*DeepseekBot" 1;
-          "~*Google-Extended" 1;
-          "~*Gemini-Ai" 1;
-          "~*Gemini-Deep-Research" 1;
-          "~*Google-CloudVertexBot" 1;
-          "~*Google-NotebookLM" 1;
-          "~*GoogleAgent-Mariner" 1;
-          "~*Bard-Ai" 1;
-          "~*FacebookBot" 1;
-          "~*Meta-ExternalAgent" 1;
-          "~*meta-webindexer" 1;
-          "~*Applebot-Extended" 1;
-          "~*bingbot" 1;
-          "~*CCBot" 1;
-          "~*PerplexityBot" 1;
-          "~*Perplexity-User" 1;
-          "~*Bytespider" 1;
-          "~*Diffbot" 1;
-          "~*Amazonbot" 1;
-          "~*cohere-ai" 1;
-          "~*Cohere-Command" 1;
-          "~*YouBot" 1;
-          "~*Omgilibot" 1;
-          "~*ImagesiftBot" 1;
-          "~*AI2Bot" 1;
-          "~*Andibot" 1;
-          "~*bigsur.ai" 1;
-          "~*Brightbot" 1;
-          "~*TerraCotta" 1;
-          "~*Character-AI" 1;
-          "~*Devin" 1;
-          "~*Crawlspace" 1;
-          "~*DuckAssistBot" 1;
-          "~*FirecrawlAgent" 1;
-          "~*Groq-Bot" 1;
-          "~*HuggingFace-Bot" 1;
-          "~*IbouBot" 1;
-          "~*MistralAI-User" 1;
-          "~*Replicate-Bot" 1;
-          "~*RunPod-Bot" 1;
-          "~*TimpiBot" 1;
-          "~*Together-Bot" 1;
-          "~*Kangaroo Bot" 1;
-          "~*PanguBot" 1;
-          "~*Cotoyogi" 1;
-          "~*Webzio-Extended" 1;
-      }
-    '';
-
-    # Stream Hosts
-    streamConfig = ''
-      # Port 69
-      server {
-        listen 69;
-        listen 69 udp;
-        proxy_pass lloyd.tadpole-pain.ts.net:69;
-      }
-
-      # Port 420
-      server {
-        listen 420;
-        listen 420 udp;
-        proxy_pass lloyd.tadpole-pain.ts.net:420;
-      }
-
-      # Minecraft / Game Ports
-      server {
-        listen 25565;
-        listen 25565 udp;
-        proxy_pass lloyd.tadpole-pain.ts.net:25565;
-      }
-      server {
-        listen 25566;
-        listen 25566 udp;
-        proxy_pass lloyd.tadpole-pain.ts.net:25566;
-      }
-      server {
-        listen 25567;
-        listen 25567 udp;
-        proxy_pass lloyd.tadpole-pain.ts.net:25567;
-      }
-    '';
-
-    # Proxy Hosts
-    virtualHosts = {
-      # atri.dad hosts
-      "atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:3000";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-        locations."= /.well-known/matrix/server" = {
-          extraConfig = ''
-            default_type application/json;
-            return 200 '${wellKnownServer}';
-          '';
-        };
-        locations."= /.well-known/matrix/client" = {
-          extraConfig = ''
-            default_type application/json;
-            add_header Access-Control-Allow-Origin "*";
-            return 200 '${wellKnownClient}';
-          '';
-        };
-      };
-      "analytics.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30060";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "archive.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30288";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "ascently.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:8838";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "bsky.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:31173";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "chef.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30111";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "democlimb.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:8008";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "fedi.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:8181";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "gist.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:1227";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "git.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30010";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "links.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30243";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "media.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30013";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "memos.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30311";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "mermaid.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:8280";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "msrc.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:3311";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "n8n.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30109";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "ocr.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30070";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "openclimb.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:1337";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "photos.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30041";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "pods.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:8828";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "requests.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30042";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "ripkyle.org" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:4321";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "s3.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30188";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "search.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30053";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "sync.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:20910";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "travel.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30251";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "travelapi.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30250";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "vault.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30032";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-
-      "matrix.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-
-        locations."/" = {
-          proxyPass = "http://[::1]:6167";
-          proxyWebsockets = true;
-          extraConfig = ''
-            client_max_body_size 100M;
-          '';
-        };
-      };
-
-      "matrixrtc.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-
-        locations."~ ^(/sfu/get|/healthz)" = {
-          priority = 400;
-          proxyPass = "http://[::1]:${toString config.services.lk-jwt-service.port}";
-          extraConfig = ''
-            proxy_set_header Host $host;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-          '';
-        };
-
-        locations."/" = {
-          proxyPass = "http://[::1]:${toString config.services.livekit.settings.port}";
-          proxyWebsockets = true;
-          extraConfig = ''
-            proxy_send_timeout 120;
-            proxy_read_timeout 120;
-            proxy_buffering off;
-            proxy_set_header Accept-Encoding gzip;
-          '';
-        };
-      };
-
-      "atash.dev" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:6969";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "chronus.atash.dev" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:7337";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-    };
-  };
-
-  # Open Ports
-  networking.firewall.allowedTCPPorts = [ 80 443 69 420 25565 25566 25567 ];
-  networking.firewall.allowedUDPPorts = [ 69 420 25565 25566 25567 ];
-}

modules/proxy.nix

@@ -0,0 +1,213 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  atriDotDad = "atri.dad";
+  atashDotDev = "atash.dev";
+
+  matrixDomain = "matrix.${atriDotDad}";
+  matrixRtcDomain = "matrixrtc.${atriDotDad}";
+
+  upstream = "lloyd.tadpole-pain.ts.net";
+  streamPorts = [
+    69
+    420
+    25565
+    25566
+    25567
+  ];
+
+  wellKnownServer = builtins.toJSON {
+    "m.server" = "${matrixDomain}:443";
+  };
+
+  wellKnownClient = builtins.toJSON {
+    "m.homeserver" = {
+      base_url = "https://${matrixDomain}";
+    };
+    "org.matrix.msc4143.rtc_foci" = [
+      {
+        type = "livekit";
+        livekit_service_url = "https://${matrixDomain}/livekit/jwt";
+      }
+    ];
+  };
+
+  mkProxy = port: config_preset: ''
+    import ${config_preset}
+    reverse_proxy http://${upstream}:${toString port}
+  '';
+
+  mkSocatService =
+    port: proto:
+    lib.nameValuePair "socat-${proto}-${toString port}" {
+      description = "Socat ${proto} proxy for port ${toString port}";
+      after = [
+        "network-online.target"
+        "tailscaled.service"
+      ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = "${pkgs.socat}/bin/socat ${lib.toUpper proto}-LISTEN:${toString port},fork,reuseaddr ${lib.toUpper proto}:${upstream}:${toString port}";
+        Restart = "on-failure";
+        RestartSec = "5s";
+        DynamicUser = true;
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+      };
+    };
+
+in
+{
+  services.caddy = {
+    enable = true;
+    email = "me@${atriDotDad}";
+
+    package = pkgs.caddy.withPlugins {
+      plugins = [ "pkg.jsn.cam/caddy-defender@v0.10.0" ];
+      hash = "sha256-DpCaOp9pXV3sdMz1hh/1SQ7ww7Fo4aAgLvFyQFgIJdI=";
+    };
+
+    extraConfig = ''
+      (common_config) {
+        encode zstd gzip
+
+        defender garbage {
+          ranges openai deepseek aliyun azurepubliccloud aws gcloud githubcopilot mistral oci vultr digitalocean linode cloudflare
+        }
+
+        header {
+          Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+          X-Content-Type-Options "nosniff"
+          X-Frame-Options "DENY"
+          Referrer-Policy "strict-origin-when-cross-origin"
+          Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://*.atri.dad https://*.atash.dev; font-src 'self' data:; connect-src 'self' wss: https://*.atri.dad https://*.atash.dev; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
+          -Server
+          -alt-svc
+        }
+      }
+
+      (relaxed_config) {
+        encode zstd gzip
+
+        header {
+          Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+          X-Content-Type-Options "nosniff"
+          X-Frame-Options "DENY"
+          Referrer-Policy "strict-origin-when-cross-origin"
+          Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' wss: https://*.atri.dad https://*.atash.dev; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
+          -Server
+          -alt-svc
+        }
+      }
+
+      ${atriDotDad} {
+        import common_config
+
+        handle /.well-known/matrix/server {
+          header Content-Type application/json
+          header X-Content-Type-Options nosniff
+          respond `${wellKnownServer}` 200
+        }
+
+        handle /.well-known/matrix/client {
+          header Content-Type application/json
+          header Access-Control-Allow-Origin "*"
+          header Vary Origin
+          header X-Content-Type-Options nosniff
+          respond `${wellKnownClient}` 200
+        }
+
+        handle {
+          reverse_proxy http://${upstream}:3000
+        }
+      }
+
+      analytics.${atriDotDad} { ${mkProxy 30060 "common_config"} }
+      ascently.${atriDotDad} { ${mkProxy 8838 "common_config"} }
+      chef.${atriDotDad} { ${mkProxy 30111 "common_config"} }
+      democlimb.${atriDotDad} { ${mkProxy 8008 "common_config"} }
+      fedi.${atriDotDad} { ${mkProxy 8181 "common_config"} }
+      gist.${atriDotDad} { ${mkProxy 1227 "common_config"} }
+      git.${atriDotDad} { ${mkProxy 30010 "common_config"} }
+      links.${atriDotDad} { ${mkProxy 30243 "common_config"} }
+      memos.${atriDotDad} { ${mkProxy 30311 "common_config"} }
+      mermaid.${atriDotDad} { ${mkProxy 8280 "relaxed_config"} }
+      msrc.${atriDotDad} { ${mkProxy 3311 "common_config"} }
+      openclimb.${atriDotDad} { ${mkProxy 1337 "common_config"} }
+      photos.${atriDotDad} { ${mkProxy 30041 "common_config"} }
+      abs.${atriDotDad} { ${mkProxy 30067 "common_config"} }
+      s3.${atriDotDad} { ${mkProxy 30188 "common_config"} }
+      search.${atriDotDad} { ${mkProxy 30053 "relaxed_config"} }
+      vault.${atriDotDad} { ${mkProxy 30032 "common_config"} }
+      vids.${atriDotDad} { ${mkProxy 31008 "common_config"} }
+      music.${atriDotDad} { ${mkProxy 30043 "common_config"} }
+      books.${atriDotDad} { ${mkProxy 31067 "common_config"} }
+      tv.${atriDotDad} { ${mkProxy 30013 "common_config"} }
+
+      ripkyle.org { ${mkProxy 4321 "common_config"} }
+      ${atashDotDev} { ${mkProxy 6969 "common_config"} }
+      chronus.${atashDotDev} { ${mkProxy 7337 "common_config"} }
+
+      ${matrixDomain} {
+        request_body {
+          max_size 1GB
+        }
+
+        handle_path /livekit/jwt/* {
+          @allowed path /sfu/get /get_token /healthz
+          handle @allowed {
+            reverse_proxy http://[::1]:${toString config.services.lk-jwt-service.port}
+          }
+          handle {
+            respond 404
+          }
+        }
+
+        handle {
+          reverse_proxy http://[::1]:6167
+        }
+      }
+
+      ${matrixRtcDomain} {
+        handle /.well-known/acme-challenge/* {
+          root * /var/lib/acme/acme-challenge
+          file_server
+        }
+
+        handle {
+          reverse_proxy http://[::1]:${toString config.services.livekit.settings.port} {
+            flush_interval -1
+          }
+        }
+      }
+    '';
+  };
+
+  systemd.services = lib.listToAttrs (
+    (map (port: mkSocatService port "tcp") streamPorts)
+    ++ (map (port: mkSocatService port "udp") streamPorts)
+  );
+
+  networking.firewall = {
+    allowedTCPPorts = [
+      80
+      443
+    ]
+    ++ streamPorts;
+    allowedUDPPorts = streamPorts;
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "me@${atriDotDad}";
+
+    certs."${matrixRtcDomain}" = {
+      webroot = "/var/lib/acme/acme-challenge";
+    };
+  };
+}

modules/services.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ ... }:
 
 {
   services.openssh = {

modules/users.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ ... }:
 
 let
   settings = import ../settings.nix;
@@ -8,10 +8,14 @@ in
     isNormalUser = true;
     description = settings.userDescription;
     extraGroups = settings.userGroups;
-    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC"
+    ];
   };
 
-  users.users.root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC" ];
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC"
+  ];
 
   security.sudo.execWheelOnly = true;
 }