john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

soteria notes updates

Browse Source
This commit is contained in:
John Lancaster
2026-07-01 00:25:50 -05:00
parent b13b774738
commit aff22e3a0f
1 changed files with 21 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/instructions/soteria-host.instructions.md
+21 -13
View File
@@ -21,6 +21,7 @@ When editing `modules/hosts/soteria/default.nix`, preserve this composition unle
- Import `nixos.step-ssh-host` to enable host SSH cert integration. - Import `nixos.step-ssh-host` to enable host SSH cert integration.
- Import `nixos.janus-ca` so Step client trust material and defaults remain available. - Import `nixos.janus-ca` so Step client trust material and defaults remain available.
- Import `nixos.restic-server` so the RESTic REST server implementation lives in the shared module rather than inline host wiring.
- Keep `step-ssh-host.hostname = hostname;` so cert principals match host naming. - Keep `step-ssh-host.hostname = hostname;` so cert principals match host naming.
## SSH Cert Mechanics On Soteria ## SSH Cert Mechanics On Soteria
@@ -65,31 +66,38 @@ Current implementation note:
## Restic REST Server On Soteria ## Restic REST Server On Soteria
Soteria's RESTic REST server is defined directly in the host module, not through the shared `nixos.restic-server` helper. Trace it this way: Soteria's RESTic REST server is implemented by the shared `nixos.restic-server` module and configured by host-local `resticServer` values. Trace it this way:
1. `modules/hosts/soteria/default.nix` configures `services.restic.server` inline with: 1. `modules/hosts/soteria/default.nix` imports `nixos.restic-server` and configures the host-local `resticServer` option set with:
- `enable = true` - `enable = true`
- `dataDir = "/mnt/restic"`
- `privateRepos = true` - `privateRepos = true`
- `listenAddress = "0.0.0.0:8000"` - `listenAddress = "0.0.0.0:8000"`
- `extraFlags = [ "--no-auth" "--tls" "--tls-cert=${config.mtls.certFile}" "--tls-key=${config.mtls.keyFile}" ]` - `tls.certFile = config.mtls.certFile`
2. The host opens the matching TCP port separately via `networking.firewall.allowedTCPPorts = [ 8000 ]`. - `tls.keyFile = config.mtls.keyFile`
3. TLS for the REST server is provided by the same mTLS certificate/key files used elsewhere on the host: 2. `modules/features/restic.nix` maps those `resticServer` options into `services.restic.server` and appends TLS flags when both TLS paths are set.
- `--tls-cert=${config.mtls.certFile}` 3. The shared module keeps the server base behavior in one place:
- `--tls-key=${config.mtls.keyFile}` - `services.restic.server.enable = true`
4. The mTLS renewal hook includes `restic-rest-server.service` in `mtls.renew.reloadUnits`, so certificate rotation reloads the REST server alongside Forgejo. - `services.restic.server.dataDir = cfg.dataDir`
5. `loginText.extraServiceStatus` exposes the running unit as `restic-rest-server.service`, which is the service name to keep in mind for status and reload behavior. - `services.restic.server.listenAddress = cfg.listenAddress`
- `services.restic.server.privateRepos = cfg.privateRepos`
- `services.restic.server.extraFlags = cfg.extraFlags ++ tlsFlags`
4. `modules/features/restic.nix` also opens the matching TCP port through `networking.firewall.allowedTCPPorts`, deriving it from `resticServer.listenAddress`.
5. The mTLS renewal hook includes `restic-rest-server.service` in `mtls.renew.reloadUnits`, so certificate rotation reloads the REST server alongside Forgejo.
6. `loginText.extraServiceStatus` exposes the running unit as `restic-rest-server.service`, which is the service name to keep in mind for status and reload behavior.
### Storage Location ### Storage Location
- Soteria does not set `services.restic.server.dataDir` in its host definition. - Soteria explicitly sets `resticServer.dataDir = "/mnt/restic"`.
- Because Soteria does not import `nixos.restic-server`, it also does not inherit the repo helper's `/mnt/restic` override from `modules/features/restic.nix`. - The shared module maps that value into `services.restic.server.dataDir`, so `/mnt/restic` is now the intended repository storage location for this host.
- That means repository storage follows the underlying NixOS `services.restic.server` default data directory unless the host explicitly sets `dataDir` later. - The shared module also derives the firewall port from `resticServer.listenAddress`, so Soteria no longer needs a separate `networking.firewall.allowedTCPPorts = [ 8000 ]` line.
- If storage needs to move later, change the `resticServer.dataDir` input or the shared module contract, not ad hoc service cleanup logic.
- `privateRepos = true` constrains repo exposure behavior, but it does not define storage location by itself. - `privateRepos = true` constrains repo exposure behavior, but it does not define storage location by itself.
Current implementation note: Current implementation note:
- The REST server is TLS-protected but currently passed `--no-auth`, so client access control relies on transport/security model rather than rest-server password auth. - The REST server is TLS-protected but currently passed `--no-auth`, so client access control relies on transport/security model rather than rest-server password auth.
- If you want Soteria to use `/mnt/restic`, either set `services.restic.server.dataDir = "/mnt/restic"` in the host or switch to the shared `nixos.restic-server` module and then reconcile port/TLS differences. - The shared module default listen address is not Soteria's deployed value; Soteria deliberately overrides it to `0.0.0.0:8000` in the host.
## Forgejo Implementation On Soteria ## Forgejo Implementation On Soteria