diff --git a/README.md b/README.md index d890e4b..cafaadc 100644 --- a/README.md +++ b/README.md @@ -94,11 +94,11 @@ Not everyone has the expertise and time to run their own server. - Resource - A [resource for NixOps4](https://nixops.dev/manual/development/concept/resource.html) is any external entity that can be declared with NixOps4 expressions and manipulated with NixOps4, such as a virtual machine, an active NixOS configuration, a DNS entry, or customer database. + A [resource for NixOps4](https://nixops.dev/manual/development/concept/resource.html) is any external entity that can be declared with NixOps4 expressions and manipulated with NixOps4, such as a virtual machine, an active NixOS configuration, a DNS entry, or customer database. - Resource provider - A resource provider for NixOps4 is an executable that communicates between a resource and NixOps4 using a standardised protocol, allowing [CRUD operations](https://en.wikipedia.org/wiki/Create,_read,_update_and_delete) on the resources to be performed by NixOps4. + A resource provider for NixOps4 is an executable that communicates between a resource and NixOps4 using a standardised protocol, allowing [CRUD operations](https://en.wikipedia.org/wiki/Create,_read,_update_and_delete) on the resources to be performed by NixOps4. Refer to the [NixOps4 manual](https://nixops.dev/manual/development/resource-provider/index.html) for details. > Example: We need a resource provider for obtaining deployment secrets from a database. diff --git a/matrix/README.md b/matrix/README.md index 780f501..8b5dd22 100644 --- a/matrix/README.md +++ b/matrix/README.md @@ -46,7 +46,7 @@ These are the components we're going to use: ## Synapse This is the core component: the Matrix server itself, you should probably -install this first. +install this first. Because not every usecase is the same, we'll describe two different architectures: diff --git a/matrix/coturn/turnserver.conf b/matrix/coturn/turnserver.conf index 3b99ef7..cfff14d 100644 --- a/matrix/coturn/turnserver.conf +++ b/matrix/coturn/turnserver.conf @@ -78,10 +78,10 @@ denied-peer-ip=203.0.113.0-203.0.113.255 # TURN server allocates address family according TURN client requested address family. # If address family not requested explicitly by the client, then it falls back to this default. -# The standard RFC explicitly define that this default must be IPv4, -# so use other option values with care! -# Possible values: "ipv4" or "ipv6" or "keep" -# "keep" sets the allocation default address family according to +# The standard RFC explicitly define that this default must be IPv4, +# so use other option values with care! +# Possible values: "ipv4" or "ipv6" or "keep" +# "keep" sets the allocation default address family according to # the TURN client allocation request connection address family. allocation-default-address-family="ipv4" diff --git a/matrix/draupnir/README.md b/matrix/draupnir/README.md index 94fa8f3..bc4710c 100644 --- a/matrix/draupnir/README.md +++ b/matrix/draupnir/README.md @@ -86,7 +86,7 @@ nginx to forward requests for reports to Draupnir: location ~ ^/_matrix/client/(r0|v3)/rooms/([^/]*)/report/(.*)$ { # The r0 endpoint is deprecated but still used by many clients. # As of this writing, the v3 endpoint is the up-to-date version. - + # Alias the regexps, to ensure that they're not rewritten. set $room_id $2; set $event_id $3; @@ -101,7 +101,7 @@ location /_synapse/admin/v1/event_reports { proxy_set_header Host $host; client_max_body_size 50M; proxy_http_version 1.1; - + location ~ ^/_synapse/admin/v1/rooms/([^/]*)/context/(.*)$ { set $room_id $2; set $event_id $3; diff --git a/matrix/element-call/README.md b/matrix/element-call/README.md index 43d0e5f..2d42d72 100644 --- a/matrix/element-call/README.md +++ b/matrix/element-call/README.md @@ -308,7 +308,7 @@ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash Exit and login again to set some environment variables (yes, the installation changes .bashrc). Then install and upgrade: - + ``` nvm install 23 sudo apt install yarnpkg diff --git a/matrix/nginx/README.md b/matrix/nginx/README.md index 18b5538..ceef163 100644 --- a/matrix/nginx/README.md +++ b/matrix/nginx/README.md @@ -187,14 +187,14 @@ server { listen [::]:80; listen 443 ssl http2; listen [::]:443 ssl http2; - + ssl_certificate /etc/letsencrypt/live/element.example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/element.example.com/privkey.pem; include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/ssl/dhparams.pem; - + server_name element.example.com; - + location / { if ($scheme = http) { return 301 https://$host$request_uri; @@ -204,10 +204,10 @@ server { add_header X-XSS-Protection "1; mode=block"; add_header Content-Security-Policy "frame-ancestors 'self'"; } - + root /usr/share/element-web; index index.html; - + access_log /var/log/nginx/elementweb-access.log; error_log /var/log/nginx/elementweb-error.log; } @@ -225,16 +225,16 @@ another vhost, something like this: server { listen 443 ssl; listen [::]:443 ssl; - + ssl_certificate /etc/letsencrypt/live/admin.example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/admin.example.com/privkey.pem; include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/ssl/dhparams.pem; - + server_name admin.example.com; - + root /var/www/synapse-admin; - + access_log /var/log/nginx/admin-access.log; error_log /var/log/nginx/admin-error.log; } @@ -256,7 +256,7 @@ location ~ ^/_synapse/admin { allow 111.222.111.222; allow dead:beef::/64; deny all; - + proxy_pass http://localhost:8008; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-Proto $scheme; @@ -281,14 +281,14 @@ Then create a virtual host much like this: server { listen 443 ssl; listen [::]:443 ssl; - + ssl_certificate /etc/letsencrypt/live/livekit.example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/livekit.example.com/privkey.pem; include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/ssl/dhparams.pem; - + server_name livekit.example.com; - + # This is lk-jwt-service location ~ ^(/sfu/get|/healthz) { proxy_pass http://[::1]:8080; @@ -298,19 +298,19 @@ server { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } - + location / { proxy_pass http://[::1]:7880; proxy_set_header Connection "upgrade"; proxy_set_header Upgrade $http_upgrade; - + proxy_set_header Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } - + access_log /var/log/nginx/livekit-access.log; error_log /var/log/nginx/livekit-error.log; } @@ -326,34 +326,34 @@ should be the configuration to publish that: server { listen 443 ssl; listen [::]:443 ssl; - + ssl_certificate /etc/letsencrypt/live/call.example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/call.example.com/privkey.pem; include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/ssl/dhparams.pem; - + server_name call.example.com; - + root /var/www/element-call; - + location /assets { add_header Cache-Control "public, immutable, max-age=31536000"; } - + location /apple-app-site-association { default_type application/json; } - + location /^config.json$ { alias public/config.json; default_type application/json; } - + location / { try_files $uri /$uri /index.html; add_header Cache-Control "public, max-age=30, stale-while-revalidate=30"; } - + access_log /var/log/nginx/call-access.log; error_log /var/log/nginx/call-error.log; } diff --git a/matrix/nginx/conf/call.conf b/matrix/nginx/conf/call.conf index 7f542d4..2c75bc2 100644 --- a/matrix/nginx/conf/call.conf +++ b/matrix/nginx/conf/call.conf @@ -1,34 +1,34 @@ server { listen 443 ssl; listen [::]:443 ssl; - + ssl_certificate /etc/letsencrypt/live/call.example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/call.example.com/privkey.pem; include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/ssl/dhparams.pem; - + server_name call.example.com; - + root /var/www/element-call; - + location /assets { add_header Cache-Control "public, immutable, max-age=31536000"; } - + location /apple-app-site-association { default_type application/json; } - + location /^config.json$ { alias public/config.json; default_type application/json; } - + location / { try_files $uri /$uri /index.html; add_header Cache-Control "public, max-age=30, stale-while-revalidate=30"; } - + access_log /var/log/nginx/call-access.log; error_log /var/log/nginx/call-error.log; } diff --git a/matrix/nginx/conf/domain.conf b/matrix/nginx/conf/domain.conf index 264c3b3..ba83bd9 100644 --- a/matrix/nginx/conf/domain.conf +++ b/matrix/nginx/conf/domain.conf @@ -3,14 +3,14 @@ server { listen [::]:80; listen 443 ssl; listen [::]:443 ssl; - + ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/ssl/dhparams.pem; - + server_name example.com; - + location /.well-known/matrix/client { return 200 '{ "m.homeserver": {"base_url": "https://matrix.example.com"}, @@ -23,7 +23,7 @@ server { default_type application/json; add_header 'Access-Control-Allow-Origin' '*'; } - + location /.well-known/matrix/server { return 200 '{"m.server": "matrix.example.com"}'; default_type application/json; @@ -44,18 +44,18 @@ server { default_type application/json; } - + location /.well-known/element/element.json { return 200 '{"call": {"widget_url": "https://call.example.com"}}'; default_type application/json; } - + location / { if ($scheme = http) { return 301 https://$host$request_uri; } } - + access_log /var/log/nginx/example-access.log; error_log /var/log/nginx/example-error.log; } diff --git a/matrix/nginx/conf/elementweb.conf b/matrix/nginx/conf/elementweb.conf index 9784ffe..e89cd83 100644 --- a/matrix/nginx/conf/elementweb.conf +++ b/matrix/nginx/conf/elementweb.conf @@ -3,27 +3,27 @@ server { listen [::]:80; listen 443 ssl http2; listen [::]:443 ssl http2; - + ssl_certificate /etc/letsencrypt/live/element.example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/element.example.com/privkey.pem; include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/ssl/dhparams.pem; - + server_name element.example.com; - + location / { if ($scheme = http) { return 301 https://$host$request_uri; } add_header X-Frame-Options SAMEORIGIN; - add_header X-Content-Type-Options nosniff; + add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header Content-Security-Policy "frame-ancestors 'self'"; } - + root /usr/share/element-web; index index.html; - + access_log /var/log/nginx/elementweb-access.log; error_log /var/log/nginx/elementweb-error.log; } diff --git a/matrix/nginx/conf/livekit.conf b/matrix/nginx/conf/livekit.conf index 33a9691..9f0b3b1 100644 --- a/matrix/nginx/conf/livekit.conf +++ b/matrix/nginx/conf/livekit.conf @@ -1,14 +1,14 @@ server { listen 443 ssl; listen [::]:443 ssl; - + ssl_certificate /etc/letsencrypt/live/livekit.example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/livekit.example.com/privkey.pem; include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/ssl/dhparams.pem; - + server_name livekit.example.com; - + # This is lk-jwt-service location ~ ^(/sfu/get|/healthz) { proxy_pass http://[::1]:8080; @@ -18,20 +18,20 @@ server { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } - + location / { proxy_pass http://[::1]:7880; proxy_set_header Connection "upgrade"; proxy_set_header Upgrade $http_upgrade; #add_header Access-Control-Allow-Origin "*" always; - + proxy_set_header Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } - + access_log /var/log/nginx/livekit-access.log; error_log /var/log/nginx/livekit-error.log; } diff --git a/matrix/nginx/conf/revproxy.conf b/matrix/nginx/conf/revproxy.conf index d29cce0..277a436 100644 --- a/matrix/nginx/conf/revproxy.conf +++ b/matrix/nginx/conf/revproxy.conf @@ -17,7 +17,7 @@ server { location ~ ^/_matrix/client/(r0|v3)/rooms/([^/]*)/report/(.*)$ { # The r0 endpoint is deprecated but still used by many clients. # As of this writing, the v3 endpoint is the up-to-date version. - + # Alias the regexps, to ensure that they're not rewritten. set $room_id $2; set $event_id $3; @@ -53,7 +53,7 @@ server { client_max_body_size 50M; proxy_http_version 1.1; } - + # The rest of the admin endpoint shouldn't be public location ~ ^/_synapse/admin { allow 127.0.0.1; diff --git a/matrix/nginx/conf/synapse-admin.conf b/matrix/nginx/conf/synapse-admin.conf index 2005841..a1ad40d 100644 --- a/matrix/nginx/conf/synapse-admin.conf +++ b/matrix/nginx/conf/synapse-admin.conf @@ -1,16 +1,16 @@ server { listen 443 ssl; listen [::]:443 ssl; - + ssl_certificate /etc/letsencrypt/live/admin.example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/admin.example.com/privkey.pem; include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/ssl/dhparams.pem; - + server_name admin.example.com; - + root /var/www/synapse-admin; - + access_log /var/log/nginx/admin-access.log; error_log /var/log/nginx/admin-error.log; } diff --git a/matrix/nginx/workers/README.md b/matrix/nginx/workers/README.md index e01edb0..659f376 100644 --- a/matrix/nginx/workers/README.md +++ b/matrix/nginx/workers/README.md @@ -282,7 +282,7 @@ Now that we have defined the workers and/or worker pools, we have to forward the right traffic to the right workers. The Synapse documentation about [available worker types](https://element-hq.github.io/synapse/latest/workers.html#available-worker-applications) -lists which endpoints a specific worker type can handle. +lists which endpoints a specific worker type can handle. ## Login @@ -323,7 +323,7 @@ requests: ``` We forward those to our 2 worker pools making sure the heavy initial syncs go -to the `initial_sync` pool, and the normal ones to `normal_sync`. We use the +to the `initial_sync` pool, and the normal ones to `normal_sync`. We use the variable `$sync`for that, which we defined in maps.conf. ``` diff --git a/matrix/nginx/workers/maps.conf b/matrix/nginx/workers/maps.conf index 702da84..376c808 100644 --- a/matrix/nginx/workers/maps.conf +++ b/matrix/nginx/workers/maps.conf @@ -2,7 +2,7 @@ # should be stored under /etc/nginx/conf.d so that it is loaded whenever nginx starts. # List of allowed origins, can only send one. -map $http_origin $allow_origin { +map $http_origin $allow_origin { ~^https?://element.example.com$ $http_origin; ~^https?://call.example.com$ $http_origin; ~^https?://someserver.example.com$ $http_origin; diff --git a/matrix/synapse/README.md b/matrix/synapse/README.md index bd9c6f7..8658658 100644 --- a/matrix/synapse/README.md +++ b/matrix/synapse/README.md @@ -192,7 +192,7 @@ See the included files for more elaborate examples, and check Synapse should probably be able to send out e-mails; notifications for those who want that, and password reset for those who need one. -You configure this under the section `email` (yes, really). +You configure this under the section `email` (yes, really). First of all, you need an SMTP-server that is configured to send e-mail for your domain. Configuring that is out of scope, we'll assume we can use the @@ -294,7 +294,7 @@ password_config: With this bit, we configure Synapse to let users pick and change their own passwords, as long as they meet the configured conditions. Mind you: `pepper` is -a secret random string that should *NEVER* be changed after initial setup. +a secret random string that should *NEVER* be changed after initial setup. But in a bigger environment you'll probably want to use some authentication backend, such as LDAP. LDAP is configured by means of a module (see diff --git a/matrix/synapse/conf.d/authentication.yaml b/matrix/synapse/conf.d/authentication.yaml index 2c0c015..47292f9 100644 --- a/matrix/synapse/conf.d/authentication.yaml +++ b/matrix/synapse/conf.d/authentication.yaml @@ -4,7 +4,7 @@ password_config: policy: enabled: only_for_reauth localdb_enabled: false - + password_providers: - module: "ldap_auth_provider.LdapAuthProvider" config: diff --git a/matrix/synapse/workers/README.md b/matrix/synapse/workers/README.md index da35119..2f8aebc 100644 --- a/matrix/synapse/workers/README.md +++ b/matrix/synapse/workers/README.md @@ -153,7 +153,7 @@ listeners: type: http resources: - names: - - replication + - replication ``` This means Synapse will create two sockets under `/run/matrix-synapse`: one diff --git a/website/assets/scss/custom.scss b/website/assets/scss/custom.scss index ec78b3a..ae59615 100755 --- a/website/assets/scss/custom.scss +++ b/website/assets/scss/custom.scss @@ -3,54 +3,54 @@ display: flex; justify-content: space-between; } - + .column { flex-basis: calc(50% - 10px); /* Adjust width as necessary */ } - + .list { list-style-type: none; padding: 0; } - + .list-item { margin-bottom: 10px; } - + .link { text-decoration: none; color: inherit; } - + .title { font-weight: bold; } - + .hr-list { border: 0; border-top: 1px solid #ccc; margin-top: 5px; margin-bottom: 5px; } - + .list-item { display: flex; justify-content: space-between; align-items: center; } - + .content { flex: 1; } - + .link { text-align: left; } - + .time { text-align: right; } - + .grid-container { display: grid; @@ -78,12 +78,12 @@ .read-more-link { color: #FF6E00; /* Use the variable defined in theme.json */ } - + .center-wrapper { display: flex; justify-content: center; align-items: center; - + } .grid-container-small { @@ -102,7 +102,7 @@ display: flex; justify-content: center; - + } .hr-list2 { @@ -115,7 +115,7 @@ .header-with-image2 { text-align: center; } - + .header-with-image2 img { display: inline-block; diff --git a/website/content_/_index.md b/website/content_/_index.md index 20884aa..baba528 100755 --- a/website/content_/_index.md +++ b/website/content_/_index.md @@ -34,7 +34,7 @@ features3: button: enable: true label: "Learn more" - link: "/oid" + link: "/oid" - title: "Tweag" image: "/images/users.svg" @@ -42,7 +42,7 @@ features3: button: enable: true label: "Learn more" - link: "/tweag" + link: "/tweag" - title: "NORDUnet" image: "/images/users.svg" @@ -50,7 +50,7 @@ features3: button: enable: true label: "Learn more" - link: "/nordunet" + link: "/nordunet" features: - title: "Fediversity Grants" @@ -59,7 +59,7 @@ features: button: enable: true label: "Learn more" - link: "/grants" + link: "/grants" features2: - title: "Individuals" diff --git a/website/layouts/blog/list.html b/website/layouts/blog/list.html index 87c9364..b899d21 100644 --- a/website/layouts/blog/list.html +++ b/website/layouts/blog/list.html @@ -18,5 +18,5 @@ - + {{ end }} diff --git a/website/layouts/blog/single.html b/website/layouts/blog/single.html index c25421d..975de70 100644 --- a/website/layouts/blog/single.html +++ b/website/layouts/blog/single.html @@ -58,7 +58,7 @@ - + diff --git a/website/layouts/contact/list.html b/website/layouts/contact/list.html index f7c67ea..f6ee6fc 100755 --- a/website/layouts/contact/list.html +++ b/website/layouts/contact/list.html @@ -61,4 +61,4 @@ -{{ end }} \ No newline at end of file +{{ end }} \ No newline at end of file diff --git a/website/layouts/events/list.html b/website/layouts/events/list.html index 7dbb085..f0657e1 100644 --- a/website/layouts/events/list.html +++ b/website/layouts/events/list.html @@ -14,14 +14,14 @@ {{ .Title }}
- +
{{ end }} - + {{ end }} diff --git a/website/layouts/events/single.html b/website/layouts/events/single.html index 811e6a2..dcd5155 100644 --- a/website/layouts/events/single.html +++ b/website/layouts/events/single.html @@ -63,7 +63,7 @@ - + diff --git a/website/layouts/index.html b/website/layouts/index.html index ecc7437..2667b3e 100755 --- a/website/layouts/index.html +++ b/website/layouts/index.html @@ -45,7 +45,7 @@
{{ range $i, $e := .Params.features3 }} - +
@@ -89,7 +89,7 @@ >

{{ .title | markdownify }}

{{ .content | markdownify }}

-
    +
      {{ range .bulletpoints }}
    • @@ -147,7 +147,7 @@ {{ if gt (len (where .Site.RegularPages "Section" "blog")) 0 }}
      -
      +
      - +
      • @@ -189,7 +189,7 @@ {{ .Title }}
- +