matrix

.config/hypr/hyprland.conf

@@ -0,0 +1,498 @@
+#env=LIBSEAT_BACKEND,seatd
+# env = HYPRLAND_LOG_WLR,1
+#env = WLR_DRM_DEVICES,$HOME/.config/hypr/nvidia:$HOME/.config/hypr/amd
+#env = WLR_DRM_DEVICES,$HOME/.config/hypr/amd:$HOME/.config/hypr/nvidia
+# env = WLR_DRM_DEVICES,$HOME/.config/hypr/amd-render:$HOME/.config/hypr/nvidia-render
+#env = LIBVA_DRIVER_NAME,nvidia
+#env = XDG_SESSION_TYPE,wayland
+#env = GBM_BACKEND,nvidia-drm
+#env = __GLX_VENDOR_LIBRARY_NAME,nvidia
+#cursor { no_hardware_cursors = true }
+
+# env = AQ_DRM_DEVICES,/dev/dri/card1
+#env = AQ_NO_MODIFIERS,1
+#monitor=,preferred,auto,1
+
+
+#monitor=eDP-1,1920x1200@60.0,3564x0,1.0,cm,hdr,sdrbrightness,1.4,sdrsaturation,0.8,bitdepth,10
+# Generated by nwg-displays on 2026-02-17 at 11:54:19. Do not edit manually.
+
+#monitor=eDP-1,1920x1200@60.0,3564x0,1.0
+#monitor=HDMI-A-1,2560x1440@144.0,1004x0,1.0
+
+# env = LIBVA_DRIVER_NAME,nvidia
+# env = XDG_SESSION_TYPE,wayland
+# env = GBM_BACKEND,nvidia-drm
+# env = __GLX_VENDOR_LIBRARY_NAME,nvidia
+
+cursor {
+    no_hardware_cursors = true
+}
+
+#render {
+    #explicit_sync = false
+#}
+
+source = ~/.config/hypr/monitors.conf
+source = ~/.config/hypr/workspaces.conf
+#source = ~/.config/hypr/hyprland.colors.conf
+
+monitor=desc:ASUSTek COMPUTER INC VG27AQL5A T7LMQS022027,2560x1440@144.0,0x0,1.0,bitdepth,10
+monitor=eDP-1,1920x1200@60.0,2560x0,1.0,bitdepth,10,cm,srgb
+
+debug:disable_logs = false
+
+debug {
+	disable_logs = false
+}
+
+plugin {
+    hyprtrails {
+        color = rgba(ffaa00ff)
+    }
+    hyprexpo {
+        columns = 3
+        gap_size = 5
+        bg_col = rgb(111111)
+        workspace_method = center current # [center/first] [workspace] e.g. first 1 or center m+1
+
+#        enable_gesture = true # laptop touchpad
+#        gesture_fingers = 3  # 3 or 4
+#        gesture_distance = 300 # how far is the "max"
+#        gesture_positive = true # positive = swipe down. Negative = swipe up.
+    }
+}
+
+# See https://wiki.hyprland.org/Configuring/Monitors/
+#monitor=,preferred,auto,auto
+
+
+# See https://wiki.hyprland.org/Configuring/Keywords/ for more
+
+env = QT_QPA_PLATFORMTHEME,qt5ct
+env = QT_AUTO_SCREEN_SCALE_FACTOR,1
+env = QT_ENABLE_HIGHDPI_SCALING,1
+env = QT_QPA_PLATFORM,wayland;xcb
+env = XCURSOR_SIZE,24
+env = LIBVA_DRIVER_NAME,nvidia
+env = XDG_SESSION_TYPE,wayland
+env = __GLX_VENDOR_LIBRARY_NAME,nvidia
+#env = WLR_NO_HARDWARE_CURSORS,1
+env = WLR_DRM_DEVICES,/dev/dri/card1:/dev/dri/card0
+env = GDK_SCALE,1
+env = GDK_BACKEND,wayland,x11
+env = QT_WAYLAND_DISABLE_WINDOWDECORATION,1
+env = MOZ_ENABLE_WAYLAND,1
+env = XDG_SESSION_DESKTOP,Hyprland
+env = XDG_CURRENT_DESKTOP,Hyprland
+env = QT_ENABLE_FONTCONFIG_CACHE,1
+
+# Execute your favorite apps at launch
+# exec-once = waybar & hyprpaper & firefox
+
+# Import the completed Hyprland session environment before launching long-lived helpers.
+exec-once=dbus-update-activation-environment --systemd --all
+exec-once=systemctl --user import-environment WAYLAND_DISPLAY DISPLAY XDG_CURRENT_DESKTOP XDG_SESSION_DESKTOP XDG_SESSION_TYPE WLR_DRM_DEVICES LIBVA_DRIVER_NAME __GLX_VENDOR_LIBRARY_NAME QT_QPA_PLATFORM QT_QPA_PLATFORMTHEME GDK_BACKEND MOZ_ENABLE_WAYLAND PATH XDG_DATA_DIRS XDG_CONFIG_DIRS DBUS_SESSION_BUS_ADDRESS
+
+# KDE auth agent
+
+# exec-once=/usr/lib/polkit-kde-authentication-agent-1
+exec-once = systemctl --user start hyprpolkitagent
+exec-once=otd-daemon
+exec-once=lorri daemon
+exec-once=/etc/pam_init
+
+#exec-once=wlsunset -S 6:00 -s 21:30
+# exec-once=swaybg -m fill -i ~/.config/hypr/wallpapers/sunflowers.jpg
+#exec-once = swww-daemon
+# "$(cat ~/.local/state/quickshell/user/generated/wallpaper/path.txt)"
+#exec-once = sleep 0.5; swww img ~/.config/hypr/wallpapers/sunflowers.jpg --transition-step 100 --transition-fps 120 --transition-type grow --transition-angle 30 --transition-duration 1
+# exec-once=waybar
+# exec-once=quickshell -c ii
+exec-once=blueman-applet
+# exec-once=dunst
+exec-once=udev-block-notify
+#exec-once=~/.config/hypr/scripts/sleep.sh
+exec-once=echo us > /tmp/kb_layout
+#exec-once=hyprctl setcursor Sweet 30
+#exec-once=sleep 10;aw-qt& sleep 2; awatcher
+exec-once = nm-applet --indicator # systray app for Network/Wifi
+exec-once=kdeconnect-indicator
+exec-once = hyprpm reload -n
+exec-once = wl-paste --type text --watch cliphist store
+exec-once = wl-paste --type image --watch cliphist store
+exec-once = fcitx5
+exec-once = easyeffects --gapplication-service
+exec-once = voxtype daemon
+exec-once = openrgb --startminimized
+exec-once = dms run
+
+#$swaylock = swaylock --screenshots --clock --indicator --effect-blur 6x6 --fade-in 0.2 --ring-color 4e9dc2 --key-hl-color 71b0ce
+$swaylock = hyprlock
+# exec-once=hypridle
+
+# exec-once=swayidle -w timeout 300 '$swaylock --grace 2' before-sleep '$swaylock'
+# Needs repackaging...
+# exec-once=/usr/lib/pam_kwallet_init
+
+#monitor=eDP-1,highrr,0x0,1.25
+#monitor=eDP-2,highrr,0x0,1.25
+#monitor=desc:AOC 24G2W1G4 0x0000297D,highrr,auto,1
+#monitor=HDMI-A-1,highrr,2048x0,1
+#monitor=HDMI-A-1,highrr,auto,1
+#monitor=,preferred,auto,1
+# TV frame
+#monitor=HDMI-A-1,addreserved,50,50,50,50
+#monitor=HDMI-A-1,preferred,auto,1,transform,2
+#monitor=HDMI-A-1,preferred,auto,1,mirror,eDP-2
+
+#workspace = 10,monitor:HDMI-A-1,default:true
+
+xwayland {
+    force_zero_scaling = true
+}
+
+# Source a file (multi-file configs)
+# source = ~/.config/hypr/myColors.conf
+
+# For all categories, see https://wiki.hyprland.org/Configuring/Variables/
+input {
+    kb_layout=us,cz
+    kb_variant=,qwerty
+    kb_model=
+    kb_options=grp:win_space_toggle
+    kb_rules=
+
+    numlock_by_default=trues
+
+    follow_mouse=1
+    float_switch_override_focus=true
+
+    touchpad {
+        natural_scroll = yes
+    }
+    touchdevice {
+        output = HDMI-A-1
+        transform = 2
+    }
+
+    sensitivity = 0 # -1.0 - 1.0, 0 means no modification.
+}
+
+general {
+    # See https://wiki.hyprland.org/Configuring/Variables/ for more
+
+    gaps_in = 5
+    gaps_out = 10
+    border_size = 1
+    # col.active_border = rgba(75DDDD50) rgba(09BC8A50) 45deg
+    # col.inactive_border = rgba(172A3AFF)
+
+    layout = master
+    resize_on_border = true
+}
+
+decoration {
+    # See https://wiki.hyprland.org/Configuring/Variables/ for more
+
+    rounding = 10
+
+    blur {
+        enabled = true
+        size = 2
+        passes = 4
+        new_optimizations = on
+        ignore_opacity = on
+        # xray = true
+    }
+
+    # drop_shadow = yes
+    # shadow_range = 4
+    # shadow_render_power = 3
+    # col.shadow = rgba(1a1a1aee)
+}
+
+animations {
+    enabled = yes
+    bezier = wind, 0.05, 0.9, 0.1, 1.05
+    bezier = winIn, 0.1, 1, 0.1, 1
+    bezier = winOut, 0.3, 0, 0, 1
+    bezier = liner, 1, 1, 1, 1
+    animation = windows, 1, 6, wind, slide
+    animation = windowsIn, 1, 6, winIn, popin 80%
+    animation = windowsOut, 1, 5, winOut, popin 80%
+    animation = windowsMove, 1, 5, wind, slide
+    animation = border, 1, 1, liner
+    animation = borderangle, 1, 30, liner, loop
+    animation = fade, 1, 10, default
+    animation = workspaces, 1, 5, wind
+}
+
+group {
+    groupbar {
+#        font_size = 10
+#        col.active = rgb(F7E733)
+#        col.inactive = rgba(F7E73330)
+    }
+#    col.border_active = rgba(75DDDDFF) rgba(75DDDD70) 45deg
+#    col.border_inactive = rgb(172A3A)
+}
+
+# dwindle {
+#     # See https://wiki.hyprland.org/Configuring/Dwindle-Layout/ for more
+#     preserve_split = yes # you probably want this
+# }
+
+master {
+    # See https://wiki.hyprland.org/Configuring/Master-Layout/ for more
+    #new_is_master = false
+}
+
+#gestures {
+    # See https://wiki.hyprland.org/Configuring/Variables/ for more
+#    workspace_swipe = true
+#}
+gesture = 3, horizontal, workspace
+gesture = 3, up, fullscreen
+gesture = 3, down, fullscreen, maximize
+
+# Example per-device config
+# See https://wiki.hyprland.org/Configuring/Keywords/#executing for more
+#device:epic-mouse-v1 {
+#    sensitivity = -0.5
+#}
+
+misc {
+    disable_hyprland_logo=true
+    disable_splash_rendering=true
+    mouse_move_enables_dpms=true
+}
+
+#windowrule=float,class:blueman
+#windowrule=float,class:Anydesk
+#windowrule=float,class:file_progress
+#windowrule=float,class:confirm
+#windowrule=float,class:dialog
+#windowrule=float,class:download
+#windowrule=float,class:notification
+#windowrule=float,class:error
+#windowrule=float,class:splash
+#windowrule=float,class:confirmreset
+#windowrule=float,title:Open File
+#windowrule=float,title:branchdialog
+#windowrule=tile,title:*vivaldi*
+
+# can be more specific (:bar, :mediaControls, etc)
+layerrule = blur on, match:namespace quickshell:bar
+layerrule = ignore_alpha .2, match:namespace quickshell:bar
+layerrule = blur on, match:namespace quickshell:popup
+layerrule = ignore_alpha .2, match:namespace quickshell:popup
+layerrule = blur on, match:namespace quickshell:notificationPopup
+layerrule = ignore_alpha .2, match:namespace quickshell:notificationPopup
+layerrule = blur on, match:namespace quickshell:overview
+layerrule = blur_popups on, match:namespace quickshell:overview
+layerrule = ignore_alpha .2, match:namespace quickshell:overview
+layerrule = blur on, match:namespace quickshell:sidebarLeft
+layerrule = blur_popups on, match:namespace quickshell:sidebarLeft
+layerrule = ignore_alpha .2, match:namespace quickshell:sidebarLeft
+layerrule = blur on, match:namespace quickshell:sidebarRight
+layerrule = blur_popups on, match:namespace quickshell:sidebarRight
+layerrule = ignore_alpha .2, match:namespace quickshell:sidebarRight
+
+layerrule {
+    name="blur dms"
+    match:namespace = dms:(color-picker|clipboard|spotlight|settings)
+    blur = on
+    ignore_alpha = 0
+}
+
+# layerrule = noanim, match:namespace ^(dms)$
+
+blurls=gtk-layer-shell
+blurls=lockscreen
+blurls = rofi
+
+$dir =  ~/.config
+#! quickshell
+bindr = SUPER+ALT, R, exec, pkill rofi || $dir/rofi/bin/launcher
+# bind = SUPER, r, global, quickshell:overviewSearchToggle
+# bind = SUPER, r, exec, dms ipc call spotlight toggle
+bind = SUPER+ALT, P, exec, pkill rofi || $dir/rofi/bin/powermenu
+# bind = SUPER, p, exec, dms ipc call powermenu open
+# bind = SUPER, tab, exec, dms ipc call hypr toggleOverview
+# bind = SUPER, p, global, quickshell:sessionToggle
+# bind = SUPER, m, global, quickshell:mediaControlsToggle
+# bind = SUPER, grave, global, quickshell:sidebarLeftToggle
+# bind = SUPER, b, global, quickshell:sidebarRightToggle
+# bind = SUPER, slash, global, quickshell:cheatsheetToggle
+# bind = SUPER, tab, global, quickshell:overviewToggle
+# bindrt = SUPER, SUPER_L, global, quickshell:workspaceNumber
+# bindd = Super, h, Clipboard history >> clipboard, global, quickshell:overviewClipboardToggle # Clipboard history >> clipboard
+# bindd = Super, Period, Emoji >> clipboard, global, quickshell:overviewEmojiToggle # Emoji >> clipboard
+
+bind = , XF86AudioRecord, exec, voxtype record-toggle
+#bind = SUPER, O, exec, voxtype record-toggle
+bind = SUPER, O, exec, voxtype record start
+bindr = SUPER, O, exec, voxtype record stop
+#bind = SUPER, V, exec, voxtype record start
+#bindr = SUPER, V, exec, voxtype record stop
+
+$mainMod = SUPER
+
+#! programs
+bind = $mainMod, T, exec, kitty
+bind=$mainMod,K,exec,kitty
+bind=SUPER,B,exec,vivaldi-stable
+bind = super+ctrl, q, exit,
+bind = $mainMod, E, exec, cosmic-files
+bind = $mainMod+SHIFT, E, exec, dolphin
+#! current window management
+bind = $mainMod, Q, killactive,
+# bind = $mainMod, V, togglefloating,
+#bind = $mainMod, R, exec, rofi -show drun
+#bind = $mainMod, P, pseudo, # dwindle
+bind = SUPER, G, togglegroup
+bind=SUPER,V,togglefloating,
+bind=SUPER,F,fullscreen,
+bind=SUPER,A,swapactiveworkspaces,current +1
+
+# bind = SUPER, grave, hyprexpo:expo, toggle
+
+#! media keys
+bindle=, XF86MonBrightnessUp, exec, xbacklight -inc 10
+bindle=, XF86MonBrightnessDown, exec, xbacklight -dec 10
+
+# bindle=, XF86AudioRaiseVolume, exec, wpctl set-volume @DEFAULT_SINK@ 5%+;canberra-gtk-play -i audio-volume-change -d "volumeChange"
+# bindle=, XF86AudioLowerVolume, exec, wpctl set-volume @DEFAULT_SINK@ 5%-;canberra-gtk-play -i audio-volume-change -d "volumeChange"
+bindl=, XF86AudioMute, exec, wpctl set-mute @DEFAULT_SINK@ toggle
+bindl=, XF86AudioMicMute, exec, wpctl set-mute @DEFAULT_SOURCE@ toggle
+
+bindl=, XF86AudioPlay, exec, playerctl play-pause # the stupid key is called play , but it toggles
+bindl=, XF86AudioNext, exec, playerctl next
+bindl=, XF86AudioPrev, exec, playerctl previous
+
+#! focus
+bind = SUPER+ALT, left, movefocus, l
+bind = SUPER+ALT, right, movefocus, r
+bind = SUPER+ALT, up, movefocus, u
+bind = SUPER+ALT, down, movefocus, d
+bind = SUPER+SHIFT, left,changegroupactive,b
+bind = SUPER+SHIFT,right,changegroupactive,f
+
+#! workspaces
+bind = $mainMod, 1, workspace, 1
+bind = $mainMod, 2, workspace, 2
+bind = $mainMod, 3, workspace, 3
+bind = $mainMod, 4, workspace, 4
+bind = $mainMod, 5, workspace, 5
+bind = $mainMod, 6, workspace, 6
+bind = $mainMod, 7, workspace, 7
+bind = $mainMod, 8, workspace, 8
+bind = $mainMod, 9, workspace, 9
+bind = $mainMod, 0, workspace, 10
+
+bind = $mainMod+ALT, 1, workspace, 10
+bind = $mainMod+ALT, 2, workspace, 11
+bind = $mainMod+ALT, 3, workspace, 12
+bind = $mainMod+ALT, 4, workspace, 13
+bind = $mainMod+ALT, 5, workspace, 14
+bind = $mainMod+ALT, 6, workspace, 15
+bind = $mainMod+ALT, 7, workspace, 16
+bind = $mainMod+ALT, 8, workspace, 17
+bind = $mainMod+ALT, 9, workspace, 18
+bind = $mainMod+ALT, 0, workspace, 19
+
+
+bind = SUPER+CONTROL, right, workspace, +1
+bind = SUPER+CONTROL, left, workspace, -1
+bind = super+control+shift,left,movetoworkspace,-1
+bind = super+control+shift,right,movetoworkspace,+1
+
+#! window movement
+bind = SUPER, right, movewindow, mon:+1
+bind = SUPER, left, movewindow, mon:-1
+
+bind = ALT, tab, cyclenext,
+bind = ALT+SHIFT, tab, cyclenext, prev
+
+#! screenshots
+# bind = ,Print,exec,grim - | wl-copy
+bind = ,Print,exec,hyprshot --clipboard-only --mode active --mode output
+# bind = SUPER+SHIFT,S,exec,spectacle --copy-image --region --background # no gui
+# bind = SUPER+SHIFT,S,exec,grim -g "$(slurp)" - | wl-copy
+bind = SUPER+SHIFT,S,exec,hyprshot --freeze --clipboard-only --mode region
+# bind = SUPER, L,exec,$swaylock
+
+#! move windows to workspaces
+bind = $mainMod SHIFT, 1, movetoworkspace, 1
+bind = $mainMod SHIFT, 2, movetoworkspace, 2
+bind = $mainMod SHIFT, 3, movetoworkspace, 3
+bind = $mainMod SHIFT, 4, movetoworkspace, 4
+bind = $mainMod SHIFT, 5, movetoworkspace, 5
+bind = $mainMod SHIFT, 6, movetoworkspace, 6
+bind = $mainMod SHIFT, 7, movetoworkspace, 7
+bind = $mainMod SHIFT, 8, movetoworkspace, 8
+bind = $mainMod SHIFT, 9, movetoworkspace, 9
+bind = $mainMod SHIFT, 0, movetoworkspace, 10
+
+#! mouse bindings
+bind = $mainMod, mouse_down, workspace, e+1
+bind = $mainMod, mouse_up, workspace, e-1
+
+bind = super alt, m, layoutmsg,swapwithmaster
+
+# Move/resize windows with mainMod + LMB/RMB and dragging
+bindm = $mainMod, mouse:272, movewindow
+bindm = $mainMod, mouse:273, resizewindow
+
+#! global keybinds
+bind = CTRL+ALT,1,pass,^(com\.obsproject\.Studio)$
+bind = CTRL+ALT,2,pass,^(com\.obsproject\.Studio)$
+
+#windowrulev2=opacity 0.9,class:Code
+#windowrulev2=opacity 0.9,class:Spotify
+
+#windowrulev2 = suppress_event maximize,class:^(vesktop)$
+
+#windowrulev2=workspace 10,class:Code # Open Code on secondary monitor
+
+#windowrulev2 = float,class:^(qt5ct)$
+#windowrulev2 = float,class:^(nwg-look)$
+#windowrulev2 = float,class:^(org.kde.ark)$
+#windowrulev2 = float,class:^(Signal)$ #Signal-Gtk
+#windowrulev2 = float,class:^(com.github.rafostar.Clapper)$ #Clapper-Gtk
+#windowrulev2 = float,class:^(app.drey.Warp)$ #Warp-Gtk
+#windowrulev2 = float,class:^(net.davidotek.pupgui2)$ #ProtonUp-Qt
+#windowrulev2 = float,class:^(yad)$ #Protontricks-Gtk
+#windowrulev2 = float,class:^(eog)$ #Imageviewer-Gtk
+#windowrulev2 = float,class:^(io.gitlab.theevilskeleton.Upscaler)$ #Upscaler-Gtk
+#windowrulev2 = float,class:^(pavucontrol)$
+#windowrulev2 = float,class:^(blueman-manager)$
+#windowrulev2 = float,class:^(nm-applet)$
+#windowrulev2 = float,class:^(nm-connection-editor)$
+#windowrulev2 = float,class:^(org.kde.polkit-kde-authentication-agent-1)$
+#windowrulev2 = tile,class:dev.warp.Warp
+
+# some themeing
+exec = gsettings set org.gnome.desktop.interface color-scheme 'prefer-dark'
+exec = gsettings set org.gnome.desktop.interface font-antialiasing 'rgba'
+exec = gsettings set org.gnome.desktop.interface font-hinting 'full'
+
+decoration {
+    dim_special = 0.3
+    blur {
+        special = true
+    }
+}
+
+
+#windowrule = nofullscreenrequest,flameshot
+#windowrule = float,title:flameshot
+#windowrule = monitor 1,title:flameshot
+#windowrule = move 0 0,title:flameshot
+#windowrule = noanim,title:flameshot
+
+#enable once dms fixes config; uses old hyprland syntax
+source = ~/.config/hypr/dms/colors.conf
+source = ~/.config/hypr/dms/binds.conf
+source = ~/.config/hypr/dms/layout.conf

.config/kitty/kitty.conf

@@ -1,5 +1,4 @@
-font_family Fira Code Retina
-font_features FiraCode-Retina +zero
+font_family postscript_name=FiraCodeNF-Ret features=+zero
 background_opacity 0.6
 shell nu
 #map ctrl+shift+c copy_to_clipboard

flake.nix

@@ -107,10 +107,17 @@
       # Export sysbox package overlay for external use
       overlays.default = final: prev: {
         sysbox = final.callPackage ./pkgs/sysbox/package.nix { };
+        tuwunel-admin = final.callPackage ./pkgs/tuwunel-admin/package.nix { };
       };
 
       # Export sysbox NixOS module for external use
       nixosModules.sysbox = import ./modules/sysbox.nix;
+      nixosModules.tuwunel-admin = import ./modules/tuwunel-admin.nix;
+
+      packages.x86_64-linux = rec {
+        tuwunel-admin = nixpkgs.legacyPackages.x86_64-linux.callPackage ./pkgs/tuwunel-admin/package.nix { };
+        default = tuwunel-admin;
+      };
 
       nixosConfigurations.fern = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";

modules/tuwunel-admin.nix

@@ -0,0 +1,83 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.tuwunel-admin;
+  tomlFormat = pkgs.formats.toml { };
+  configFile = tomlFormat.generate "tuwunel-admin.toml" cfg.settings;
+in
+{
+  options.services.tuwunel-admin = {
+    enable = lib.mkEnableOption "tuwunel-admin web UI";
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.callPackage ../pkgs/tuwunel-admin/package.nix { };
+      defaultText = lib.literalExpression "pkgs.callPackage ../pkgs/tuwunel-admin/package.nix { }";
+      description = "The tuwunel-admin package to use.";
+    };
+
+    settings = lib.mkOption {
+      type = tomlFormat.type;
+      default = { };
+      example = {
+        server.bind = "127.0.0.1:8009";
+        matrix = {
+          homeservers = [ "https://matrix.example.com" ];
+          allow_any_server = false;
+          admin_bot = "@tuwunel:matrix.example.com";
+          admin_room_alias = "#admins:matrix.example.com";
+          device_id = "tuwunel-admin";
+          device_display_name = "tuwunel-admin";
+        };
+      };
+      description = ''
+        Configuration written to tuwunel-admin's TOML configuration file.
+        See <https://github.com/knadh/tuwunel-admin/blob/master/config.sample.toml>.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.tuwunel-admin = {
+      description = "tuwunel Matrix administration UI";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${lib.getExe cfg.package} --config ${configFile}";
+        Restart = "on-failure";
+        RestartSec = "5s";
+
+        DynamicUser = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" ];
+        UMask = "0077";
+      };
+    };
+  };
+}

pkgs/tuwunel-admin/package.nix

@@ -0,0 +1,28 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "tuwunel-admin";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "knadh";
+    repo = "tuwunel-admin";
+    tag = "v${version}";
+    hash = "sha256-60yPa+B6PYzOoCjQyeqdy5vdF5BCFNVv2CTofPi6lRQ=";
+  };
+
+  cargoHash = "sha256-TpC+5/Ox04aQpUSssMnaVadq7+sroW9mJViVFGNsVIk=";
+
+  env.VERSION = "v${version}";
+
+  meta = {
+    description = "Web admin UI for the tuwunel Matrix server";
+    homepage = "https://github.com/knadh/tuwunel-admin";
+    license = lib.licenses.asl20;
+    mainProgram = "tuwunel-admin";
+  };
+}

servers/eisen/configuration.nix

@@ -35,8 +35,10 @@ let
     prometheus-llama-swap = 9409;
     prometheus = 9090;
     livekit-jwt = 8080;
+    tuwunel-admin = 8009;
   };
-  matrixServerName = "matrix.badapple.cz";
+  matrixServerName = "badapple.cz";
+  matrixHost = "matrix.badapple.cz";
   livekitKeyFile = "/var/lib/livekit/keys";
 in
 {
@@ -53,6 +55,7 @@ in
     nix-index-database.nixosModules.nix-index
     ./hardware-configuration.nix
     ../../modules/llama-swap-exporter.nix
+    ../../modules/tuwunel-admin.nix
   ];
 
   nix = {
@@ -104,8 +107,23 @@ in
         registration_token_file = "/etc/secrets/matrix-registration-token";
 
         well_known = {
-          client = "https://${matrixServerName}";
-          livekit_url = "wss://${matrixServerName}/livekit/sfu";
+          client = "https://${matrixHost}";
+          livekit_url = "https://${matrixHost}/livekit/jwt";
+        };
+      };
+    };
+
+    tuwunel-admin = {
+      enable = true;
+      settings = {
+        server.bind = "127.0.0.1:${toString internalPorts.tuwunel-admin}";
+        matrix = {
+          homeservers = [ "https://${matrixHost}" ];
+          allow_any_server = false;
+          admin_bot = "@tuwunel:${matrixServerName}";
+          admin_room_alias = "#admins:${matrixServerName}";
+          device_id = "tuwunel-admin";
+          device_display_name = "tuwunel-admin";
         };
       };
     };
@@ -120,6 +138,8 @@ in
         rtc = {
           tcp_port = 7881;
           use_external_ip = true;
+          port_range_start = 50100;
+          port_range_end = 50105;
         };
       };
     };
@@ -127,7 +147,7 @@ in
     lk-jwt-service = {
       enable = true;
       keyFile = livekitKeyFile;
-      livekitUrl = "wss://${matrixServerName}/livekit/sfu";
+      livekitUrl = "wss://${matrixHost}/livekit/sfu";
       port = internalPorts.livekit-jwt;
     };
 
@@ -343,23 +363,23 @@ in
           }) (builtins.attrNames ports)
         )
         // {
-          "${matrixServerName}:80" = {
+          "${matrixHost}:80" = {
             extraConfig = ''
               @matrixClientWellKnown path /.well-known/matrix/client
               handle @matrixClientWellKnown {
                 header Access-Control-Allow-Origin "*"
                 header Content-Type application/json
-                respond `{\"m.homeserver\":{\"base_url\":\"https://${matrixServerName}\"},\"org.matrix.msc4143.rtc_foci\":[{\"type\":\"livekit\",\"livekit_service_url\":\"https://${matrixServerName}/livekit/jwt\"}]}` 200
+                respond `{"m.homeserver":{"base_url":"https://${matrixHost}"},"org.matrix.msc4143.rtc_foci":[{"type":"livekit","livekit_service_url":"https://${matrixHost}/livekit/jwt"}]}` 200
               }
 
               @matrixServerWellKnown path /.well-known/matrix/server
               handle @matrixServerWellKnown {
                 header Access-Control-Allow-Origin "*"
                 header Content-Type application/json
-                respond `{\"m.server\":\"${matrixServerName}:443\"}` 200
+                respond `{"m.server":"${matrixHost}:443"}` 200
               }
 
-              @jwtService path /livekit/jwt/sfu/get /livekit/jwt/healthz
+              @jwtService path /livekit/jwt/sfu/get* /livekit/jwt/healthz* /livekit/jwt/get_token*
               handle @jwtService {
                 uri strip_prefix /livekit/jwt
                 reverse_proxy http://localhost:${toString internalPorts.livekit-jwt}
@@ -367,6 +387,7 @@ in
 
               @livekit path /livekit/sfu*
               handle @livekit {
+                uri strip_prefix /livekit/sfu
                 reverse_proxy http://localhost:${toString ports.livekit}
               }
 
@@ -375,6 +396,11 @@ in
               }
             '';
           };
+          "admin.${matrixHost}:80" = {
+            extraConfig = ''
+              reverse_proxy http://localhost:${toString internalPorts.tuwunel-admin}
+            '';
+          };
           "translations.danbulant.cloud:80, translations.rpi1.danbulant.cloud:80" = {
             extraConfig = ''
               reverse_proxy http://localhost:${toString ports.tolgee}