upload-files

newinfra/nix/apps/upload-files/default.nix

@@ -0,0 +1,19 @@
+{ upload-files, pkgs, lib, config, ... }: {
+  age.secrets.upload_files_s3_secret.file = ../../secrets/upload_files_s3_secret.age;
+
+  systemd.services.upload-files = {
+    description = "upload.files.noratrieb.dev file uploader for files.noratrieb.dev";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+    environment = {
+      UPLOAD_FILES_NORATRIEB_DEV_BUCKET = "files.noratrieb.dev";
+      UPLOAD_FILES_NORATRIEB_DEV_ENDPOINT = "http://localhost:3900";
+      UPLOAD_FILES_NORATRIEB_DEV_REGION = "garage";
+    };
+    serviceConfig = {
+      DynamicUser = true;
+      ExecStart = "${lib.getExe (upload-files {inherit pkgs;})}";
+      EnvironmentFile = [ config.age.secrets.upload_files_s3_secret.path ];
+    };
+  };
+}

newinfra/nix/hive.nix

@@ -20,6 +20,7 @@
         pretense = import (fetchTarball "https://github.com/Noratrieb/pretense/archive/${my-projects-versions.pretense}.tar.gz");
         quotdd = import (fetchTarball "https://github.com/Noratrieb/quotdd/archive/${my-projects-versions.quotdd}.tar.gz");
         does-it-build = import (fetchTarball "https://github.com/Noratrieb/does-it-build/archive/${my-projects-versions.does-it-build}.tar.gz");
+        upload-files = import (fetchTarball "https://github.com/Noratrieb/upload.files.noratrieb.dev/archive/${my-projects-versions."upload.files.noratrieb.dev"}.tar.gz");
 
         inherit my-projects-versions;
 
@@ -183,6 +184,7 @@
       ./apps/killua
       ./apps/forgejo
       ./apps/openolat
+      ./apps/upload-files
     ];
 
     deployment.tags = [ "caddy" "eu" "apps" "website" ];

newinfra/nix/modules/caddy/vps1.Caddyfile

@@ -52,6 +52,12 @@ olat.noratrieb.dev:8088 {
 	reverse_proxy * localhost:5011
 }
 
+upload.files.noratrieb.dev {
+	log
+	encode zstd gzip
+	reverse_proxy * localhost:3050
+}
+
 ################################################################
 # redirects
 

newinfra/nix/modules/dns/noratrieb.dev.nix

@@ -57,7 +57,11 @@ let
         # --- website stuff
         blog = vps1;
         www = vps1;
-        files = combine [ vps1 vps3 vps4 ];
+        files = combine [ vps1 vps3 vps4 ] // {
+          subdomains = {
+            upload = vps1;
+          };
+        };
 
         # --- legacy crap
         old-docker = vps2;

newinfra/nix/modules/garage/README.md

@@ -25,6 +25,8 @@
     - key `backups` RW
 - `forgejo`
     - key `forgejo` RW
+- `files.noratrieb.dev`
+    - key `upload-files` RW
 
 ## keys
 

newinfra/nix/my-projects.json

@@ -4,5 +4,6 @@
   "slides": "0401f35c22b124b69447655f0c537badae9e223c",
   "pretense": "270b01fc1118dfd713c1c41530d1a7d98f04527d",
   "quotdd": "e922229e1d9e055be35dabd112bafc87a0686548",
-  "does-it-build": "81790825173d87f89656f66f12a123bc99e2f6f1"
+  "does-it-build": "81790825173d87f89656f66f12a123bc99e2f6f1",
+  "upload.files.noratrieb.dev": "84ae7746fd554b18351d377aab8ea6739493d156"
 }

newinfra/nix/secrets/docker_registry_password.age

@@ -1,7 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg +BQUq++K4fbTXFQXdZwoVKaeRY75C96A1vnn5gUo5WY
+-> ssh-ed25519 qM6TYg QziuzHQxmWyRdv8dUPBWTgnMxFtqR6ttP16Z3XdvD3Y
-jxUb+nX0t0OIhJxgdaOwTvviVnGoPlAKcmXIRW7FhEM
+Krxmha5J+gTU0DjzPDTDIwz1mW0Q84XR2FgQyPm4bf4
---- plPYamLI4c2gzNcPkNeEdh68k3i3STrazb5sTG7txUY
+--- t4Mea1Y35o5t2dhREnp8Zq1AyR4DAWMFW7Vv3CkgGKw
-Ň	GAv°ť(îĚ
+ìlTS+Ƴ6y­¿rîëOØné<6E>&c`Ï°Êü<>:û³7V»-tf±puw€I¥w“Âøå
-\ 9’N
-ŻťwJŮ`Yüé.ö˘–´Ăxâ.líî„q…9޵„3

newinfra/nix/secrets/garage_secrets.age

@@ -1,12 +1,12 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg dSNo/WHtuVibuLghfNnznYw6+zsMJOWvi7LitHSn3AY
+-> ssh-ed25519 qM6TYg B17o68OCsoljQLd4yLx1gZbt9zsFhQE8/QJeZ3Gx+AI
-pfZti2of1OZVOgVR+wXZrhGggtZ2W3jyUADDWVxQHfs
+ADxN8iqNN5ApzHMtIXMnMTN4qe/7ba+ZoqkpHDpq9dE
--> ssh-ed25519 XzACZQ d5+ZaKmyb1yTZJ0mvPYl6On9XaOp8Z59zNQXVtEj6F8
+-> ssh-ed25519 XzACZQ Jp5WvbUVmfecvN95vM6+DQmJicVf4u94Vm0mYtBVODw
-+Ku4GwagVLPZHzOpkaFPZ1i5NoB9Z+Eyd0tuY28yS5Y
+XAdVpk6bAwAU7OQxvedepr3g8HQo5sY5efy3lYhf1xA
--> ssh-ed25519 51bcvA PxNLpJLMnUrlyzKUairI6Y+f6BYn7N9e/OURoiHcWQk
+-> ssh-ed25519 51bcvA DUkgjLS805iAsnaCl3B8BOP6cdKOJCx0aK23UEDmTyw
-FsXdpP0pM+Xvst93kHIG+KsDlwrRRks4jxl+Q487Msc
+dUZhXJiYkCZvassxSg0Cgf9c+ta2Oc2PNhLdvHBP24M
--> ssh-ed25519 vT7ExA PE9zzE4bKcexXg6LuoQnUOJbvNlqQF//qm1fgB6sM0M
+-> ssh-ed25519 vT7ExA 0Z2/GFY2aqO2HJJet3CRSh3yxchGt7AYTzkl0D2aoEQ
-YSzgtZ+zGoTljLHrxeIY7MQV7xmLNDPFEeVrSq37QHA
+GuMqW7tbsEl/SskgN1hPa0B/aWtet/+pHxmbwsTzPCM
---- VGV6MkGwLwYmCq73bDzIJaRRTESJ9a1fieP1AJNiAUs
+--- vgf72fLRkTVRtJoxh+qfim9YYELE0W74L6ZVjpo+8vI
-
‹j\ËČ_I9Îd±UK÷ Ë ďF1^Ň<08>ođ±uŔÍJŰŰo
+åø=ê&óŸC»íÄŸŸ#À¥ÑÒ/nܤè´2Â9†ØÞøo[<5B>›S+uWʶ¢£4êÕf/hAÈþ#ïþOs_†RV£òEÆÆóÎûúÎVAlžTÏ/¤VΨtµøJNöËUë;ññnGúQïìÝ£ÖO{Áx[ #°¿›†íÏP¨Hß9P®€:z
-<EFBFBD>ąŁÄÉP"šltÖ±v%čőÚan›«©EëZX2’’ש«S;¤’	JĄ›$~žjcgŠ\«~5$Ö„ü*Ď	]§"˛·«
Ů ţńjS˛+qΗ@w編˚Ą‡ôNÁ’<C381>ż1€F@ľ’k©•×$_ýaÎÂ…;Zö|ĂX‡LżKhˇ0Ŕó6®±ěż"Ń<Ů‘
+ê‰û²å‚yX„Ñ`]%>¨+ÙÞ~)Ø`V–ïâxÛ°€i-ƒã¬Fýªš$xHå)ÒTMcZ

newinfra/nix/secrets/secrets.nix

@@ -23,6 +23,7 @@ in
   "s3_mc_admin_client.age".publicKeys = [ vps1 vps3 vps4 vps5 ];
   "killua_env.age".publicKeys = [ vps1 ];
   "forgejo_s3_key_secret.age".publicKeys = [ vps1 ];
+  "upload_files_s3_secret.age".publicKeys = [ vps1 ];
   "wg_private_dns1.age".publicKeys = [ dns1 ];
   "wg_private_dns2.age".publicKeys = [ dns2 ];
   "wg_private_vps1.age".publicKeys = [ vps1 ];

newinfra/nix/secrets/wg_private_vps1.age

@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg vC8XBZQGff/q/SEsiIb+pyhfE/2MCWbo1m+suXpzyhY
+-> ssh-ed25519 qM6TYg 4aRY2+KMkGoSJtRfdkTRwIj6bYGSQJvJjq669297MHE
-r2R02FSzrpiPyoAeiPqWNdXc0Jqd6v2rv4hxo89LqD8
+Kjf7jo93e4oMRKmN5u3Xa3CUpIp9bZPoUAGqjdgOulw
---- NBCfTZYGNmAHQOABVhlcsgbJmKpmeUM15FdKLQjVazw
+--- wapYiQbpT4gfZyI5cMnB4O+LdM9PvsUxM7nTv954nNg
-,t¬}˜ <20>¨¾“­| &¦“-À^uüÊU6Z_ì&Ú—Úuôe[wá—™–Ó	_ë²¢°
+õš<EFBFBD>ê÷¤eVn?Õ]¥ÁÁøÅ<C3B8>—3!l0•„†<E2809E>Ñâر°ñó«ëõó<¡ [œƒŸo¯¶ø[?Ý®ä<C2AE>¬í·¦ÓB'ìWò—(‡•
-£^£®\Ý(뜆gP‚y-j‹éš;ýùD

newinfra/nix/secrets/wg_private_vps3.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 XzACZQ FnGfRDdT9kQXeYzv7yzwI+1fVXmeseC6YVCCzeoeLCQ
+-> ssh-ed25519 XzACZQ J67LUjHa64q/z1K8zZpx1rsnoQ94NzhkeXEpfNr4ZVQ
-HydL6WRBzLmqAKNmf0kzBmZiFRQ8KM3dHEdx2676Nx0
+dy5Tre9IicxhLBHoqvQAZepG7bNg2dEXFT5iPRcWOcA
---- E7+8BYiNPPm3fI6FiEii2txlbsesfSXuE2Nxvb7Zlx4
+--- 9dJKhJeue6VNi0Sw05BX/t8jsxXyRIKz0K3/sy0kT7w
-™m»5q®÷ÞÁ~ú>R-­¡<C2AD>·ôeŒ~ÿ+$¦˜•TÌ5öPäõr´nH:$4ðj¦kþB÷$CqRuóïˆM˜mªF`‹þA4<41>·Ñe
+Ýh9ÎÛËi£·ÀÍs¡ØâM
=TnÕw€W)<29>õ€Ûòêã²›îÃ\ÇÕ<2*%æ_ëå×ܳ¿«ôgÇLñõN‹5c—D5ô@áÍ»ÂØ

newinfra/nix/secrets/wg_private_vps4.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 51bcvA IVcXj0PQpO6Rj7ovi4GgoQF77sRDdumHNavSVdQXcHI
+-> ssh-ed25519 51bcvA P7ouUh98Mfi9Jsu6MDWaWH0NB2alXRIK8hxBIs0Nylg
-O7j/05HqbjLvIYh9cT/iT8p6GMDn14vDOqU3Jh6tUIc
+tUZ1sWLlvPizsSWhK3fnVVhr4C9Ign5rwowxePGXFII
---- wt0viOUTFWu9ze3CcQ4i1xMrb+RLTOg2hcVsDwbzMzA
+--- PHPizXT8GPP9mIFg1paqqc8w3qsX63XpLkeT0APybik
-Çâ<C387>iÍ-_ñŒrË£Æ*=Öî@Ÿ“|D3éÕeå%ö´näÈ­YÈò'í×RŠ°h3î‡VËü%-=¡à¾W¸Óî‹;
¼icS
+—´B§?*8-nËLsÍj<‘ k*.@¯ªœé6K‡Ug ‹×'8¼
Ñ#Žòíhç.l~Sà3£%¶šÀ!ŸVYK•l¿R¾ ´Ôؘo

newinfra/nix/secrets/wg_private_vps5.age

@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 vT7ExA kxCR8CbPH5GgSS/ENXQ81zPQ+n041l7yV6zzQv1smwk
+-> ssh-ed25519 vT7ExA 9+j3VYkFAW1obbLc31nv+45SyPMqH1zZPkI+PU4lVH8
-mhn18RlBXbpMfZAHrUam5ktlV5Z28UIg8Ufk4H/tfSA
+G9QkkyTNH499EWhjiXCyXt7HgHlzJTZsaLiR+yOF18E
---- WXmrUK2YnQQqZQgoW219LEVgBoHa+N3NqO4cqsF9Pr8
+--- vq7bT3yTioJ1UsD7hSu5jyYKhOE6UMIMsosu4f5pK1w
-Ê>•0…:üh`´µÈ;¹D
+	
+Q±<>žž¹ýÁ˜ÅVÐé#<23>(7èýÎEYÉÛÅÌ\ú££Z¨?GÙ«ç_CÛI¦îЉgNi´V¯å‘e]•¢tx@¸w+
-æü쎽Å*TYÔüDà 9/<2F>9:Lw“ëQ÷çàNðßÆC³x'QHdÞcM<63>Ï£ú½úÄ8“à