Direct TLS connections for clients allow for faster connection
establishment, and disabling HTTPS in Prosody fixes use of components
which expect to be exposed via a reverse proxy (such as Nginx).
This extends SSL/TLS configuration for client connections to allow for a
set of additional ciphers over the current "intermediate" set of
defaults applied, in support of older clients.
This brings a number of changes and improvements, and moves from MariaDB
to SQLite for storage, which requires manual migration for pre-existing
deployments using `prosody-migrator`.
Symbolic links are now synchronized verbatim (i.e. the links themselves,
not their destinations) to allow for restoring our pattern of linking to
the latest backup file.
In addition, the destination remote and path can now be configured
individually in drop-in files, but still default to the encrypted
remote.
Pointers to the latest backup are useful for restore operations, but
should be ignored in all other cases, and thus are more appropriately
handled as symbolic links.
This commit adds a new systemd service, `rclone-sync@.service`,
templated against the absolute path of a directory to keep in sync with
a (presumably) remote store.
Support for Backblaze B2 endpoints has been set up by default, but the
specific remote type can be configured via the `RCLONE_REMOTE_TYPE` host
variable. In addition, a default-passthrough remote that encrypts data
against a static password and salt has been defined under the `crypt`
name, and can also be used as the `RCLONE_DEST` of choice.
We no longer copy service directories into `/etc/coreos-home-server` if
these have not had their respective `spec.bu` files included; these
directories are not needed in these cases, and would be erroneously
considered as eligible in subsequent `coreos-home-server-update`
invocations.
Container volume backups will now be skipped if no changes have been
made in source files against the latest backup. In addition the default
timer has been changed for performing backups once a day, at 02:00,
likely a time where there's less traffic on the server.
This commit contains a fairly large diff for a fairly small change:
moving the `config/common` directory to `host/base` to better reflect
its intended use, and promoting `config/service` to the root directory.
These changes unlock some improvements in `coreos-home-server-update`
processes, which will (assuming `/etc/coreos-home-server/base` exists)
keep host-wide systemd services in sync in addition to service-specific
ones.
Changes have been make to the `Makefile` and a few other places where
`config/common` was referenced, but most of this work is renames that
are not intended to break compatibility with new or running servers.
Most importantly, this helps make WebRTC calls in XMPP more reliable
when either (or both) endpoints are behind NAT (as is the case with most
mobile devices), and avoids depending on a third-party service.
Default configuration has been applied in the virtual environment file;
this allows for setting up most host-dependent configuration easily.
This service allows for easy serving of static content in a volume,
typically HTML files in directory structures mapping to the navigation
structure for the content served.
This commit extends the pre-existing `git` service with static HTML
generation for public repositories (i.e. repositories placed under the
`public` directory), which can then be served via existing mechanisms.
In support of these changes, public repositories can be made available
for cloning via the `git://` protocol, which listens on port 9418 by
default. Only public repositories will be considered, and user access
has been set up to ensure that private repositories are not made
accessible by accident.
This commit updates the default resolver configuration for Nginx servers
to not attempt to resolve IPv6 addresses, and only holds resolved IPs
for a maximum of 60 seconds, in order to avoid issues with stale cache.
Our previous setup did not ensure that the default server was actually
the default (though doing this for port 443 remains an open question).
In addition, we now have Nginx close the connection immediately rather
than respond with a 204.
This commit integrates WriteFreely as a systemd service, set up as a
single-user instance by default (as is probably appropriate for a
home-server setup); a default administrator is set up, and whoever
is managing the home-server is expected to update the username and
password after first login.
Though WriteFreely expects to have a hostname set up for the instance,
we do not listen on any specific hostname by default. It is expected,
rather, that the `nginx-proxy-http` service is used with a drop-in for
using the correct `writefreely` upstream.
Configuration for this will continue to evolve as required.
