m3ta-chiron
447d02293d
Root cause chain of recurring Matrix outages (2026-08-16):
1. DNS on m3-hermes resolves exclusively via the Netbird-managed
resolver. When the Netbird nameserver group is unreachable
(observed 14:03-15:24), matrix.m3ta.dev fails to resolve.
2. A gateway restart during that window fails the Matrix login, and
without MATRIX_ACCESS_TOKEN the gateway drops Matrix permanently
from its reconnect queue ('no bot credential on queued config').
Recovery happens only on the next restart - with working DNS.
3. The stable-token setup from 2026-08-14 was wiped because it was
only written to the regenerated .env, not to the agenix secret.
Changes:
- Pin matrix.m3ta.dev to the m3-atlas public IP (TLS termination)
so the Matrix connection survives Netbird DNS outages.
- Declare MATRIX_DEVICE_ID=HERMES01 in the module environment so the
device id survives .env regeneration. The matching
MATRIX_ACCESS_TOKEN must be added to secrets/hermes-env.age
(separate manual step: agenix edit + re-encrypt).
74 lines
1.7 KiB
Nix
74 lines
1.7 KiB
Nix
{pkgs, ...}: {
|
|
imports = [
|
|
./disko-config.nix
|
|
./hardware-configuration.nix
|
|
];
|
|
|
|
# Bootloader.
|
|
boot.loader.grub = {
|
|
efiSupport = true;
|
|
efiInstallAsRemovable = true;
|
|
};
|
|
|
|
networking.hostName = "m3-hermes";
|
|
networking.hostId = "a1b2c3d4"; # TODO: Generate unique hostId
|
|
networking.networkmanager.enable = true;
|
|
|
|
# Matrix homeserver pin: DNS on this host resolves exclusively via the
|
|
# Netbird-managed resolver (see /etc/resolv.conf → wt0). When the Netbird
|
|
# nameserver group is unreachable, matrix.m3ta.dev fails to resolve and the
|
|
# gateway cannot log in (observed 2026-08-16). Pinning the public IP of
|
|
# m3-atlas (TLS termination for matrix.m3ta.dev) makes the Matrix connection
|
|
# independent of Netbird DNS health. Update here if the m3-atlas public IP
|
|
# ever changes.
|
|
networking.hosts = {
|
|
"152.53.85.162" = ["matrix.m3ta.dev"];
|
|
};
|
|
|
|
time.timeZone = "Europe/Berlin";
|
|
i18n.defaultLocale = "en_US.UTF-8";
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
neovim
|
|
git
|
|
tea
|
|
ghostty.terminfo
|
|
uv
|
|
];
|
|
|
|
services.openssh = {
|
|
enable = true;
|
|
settings = {
|
|
PermitRootLogin = "no";
|
|
PasswordAuthentication = false;
|
|
};
|
|
};
|
|
|
|
security.sudo.extraRules = [
|
|
{
|
|
users = ["hermes"];
|
|
commands = [
|
|
{
|
|
command = "/run/current-system/sw/bin/podman";
|
|
options = ["NOPASSWD"];
|
|
}
|
|
];
|
|
}
|
|
];
|
|
|
|
services.fstrim = {
|
|
enable = true;
|
|
interval = "weekly";
|
|
};
|
|
|
|
# Firewall: outbound only, SSH inbound
|
|
networking.firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [22]; # SSH only
|
|
allowedUDPPorts = [];
|
|
allowPing = false;
|
|
};
|
|
|
|
system.stateVersion = "25.05";
|
|
}
|