bikkje: various package additions

bikje: add kerberos auth
base: add motd
2024-06-22 17:35:32 +02:00 · 2024-03-30 21:15:46 +01:00 · 2024-02-19 15:55:42 +01:00 · 2024-02-19 15:48:10 +01:00 · 2024-02-18 22:34:00 +01:00
115 changed files with 1249 additions and 5976 deletions
--- a/.editorconfig
+++ b/.editorconfig
@ -1,10 +0,0 @@
-root = true
-
-[*]
-end_of_line = lf
-insert_final_newline = true
-trim_trailing_whitespace = true
-
-[*.nix]
-indent_style = space
-indent_size = 2
--- a/.envrc
+++ b/.envrc
@ -1 +0,0 @@
-use flake
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@ -1 +0,0 @@
-e00008da1afe0d760badd34bbeddff36bb08c475
--- a/.gitignore
+++ b/.gitignore
@ -1,4 +1,2 @@
 result*
 /configuration.nix
-/.direnv/
-*.qcow2
--- a/.sops.yaml
+++ b/.sops.yaml
@ -3,14 +3,10 @@ keys:
  - &user_danio age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
  - &user_felixalb age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
  - &user_oysteikt F7D37890228A907440E1FD4846B9228E814A2AAC
-  - &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
-  - &user_pederbs_sopp age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
-  - &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
-  - &user_pederbs_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5

  # Hosts
  - &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
-  - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
+  - &host_ildkule age1hn45n46ypyrvypv0mwfnpt9ddrlmw34dwlpf33n8v67jexr3lucq6ahc9x
  - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
  - &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2

@ -22,24 +18,17 @@ creation_rules:
      - *host_jokum
      - *user_danio
      - *user_felixalb
-      - *user_eirikwit
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
      pgp:
      - *user_oysteikt

  # Host specific secrets
-
+  
  - path_regex: secrets/bekkalokk/[^/]+\.yaml$
    key_groups:
    - age:
      - *host_bekkalokk
      - *user_danio
      - *user_felixalb
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
      pgp:
      - *user_oysteikt

@ -49,9 +38,6 @@ creation_rules:
      - *host_jokum
      - *user_danio
      - *user_felixalb
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
      pgp:
      - *user_oysteikt

@ -61,20 +47,14 @@ creation_rules:
      - *host_ildkule
      - *user_danio
      - *user_felixalb
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
      pgp:
      - *user_oysteikt
-
+  
  - path_regex: secrets/bicep/[^/]+\.yaml$
    key_groups:
    - age:
      - *host_bicep
      - *user_danio
      - *user_felixalb
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
      pgp:
      - *user_oysteikt
--- a/base.nix
+++ b/base.nix
@ -0,0 +1,87 @@
+{ config, lib, pkgs, inputs, values, ... }:
+
+{
+  imports = [
+    ./users
+  ];
+
+  networking.domain = "pvv.ntnu.no";
+  networking.useDHCP = false;
+  # networking.search = [ "pvv.ntnu.no" "pvv.org" ];
+  # networking.nameservers = lib.mkDefault [ "129.241.0.200" "129.241.0.201" ];
+  # networking.tempAddresses = lib.mkDefault "disabled";
+  # networking.defaultGateway = values.hosts.gateway;
+
+  systemd.network.enable = true;
+
+  services.resolved = {
+    enable = lib.mkDefault true;
+    dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
+  };
+
+  time.timeZone = "Europe/Oslo";
+
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "no";
+  };
+
+  system.autoUpgrade = {
+    enable = true;
+    flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
+    flags = [
+      "--update-input" "nixpkgs"
+      "--update-input" "nixpkgs-unstable"
+      "--no-write-lock-file"
+    ];
+  };
+  nix.gc.automatic = true;
+  nix.gc.options = "--delete-older-than 2d";
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+  /* This makes commandline tools like
+  ** nix run nixpkgs#hello
+  ** and nix-shell -p hello
+  ** use the same channel the system
+  ** was built with
+  */
+  nix.registry = {
+    nixpkgs.flake = inputs.nixpkgs;
+  };
+  nix.nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
+
+  environment.systemPackages = with pkgs; [
+    file
+    git
+    gnupg
+    htop
+    nano
+    rsync
+    screen
+    tmux
+    vim
+    wget
+
+    kitty.terminfo
+  ];
+
+  programs.zsh.enable = true;
+
+  users.groups."drift".name = "drift";
+
+  # Trusted users on the nix builder machines
+  users.groups."nix-builder-users".name = "nix-builder-users";
+  users.motd = builtins.readFile ./misc/motd;
+
+  services.openssh = {
+    enable = true;
+    extraConfig = ''
+      PubkeyAcceptedAlgorithms=+ssh-rsa
+    '';
+    settings.PermitRootLogin = "yes";
+  };
+
+
+}
--- a/base/default.nix
+++ b/base/default.nix
@ -1,60 +0,0 @@
-{ pkgs, lib, ... }:
-
-{
-  imports = [
-    ../users
-    ../modules/snakeoil-certs.nix
-
-    ./networking.nix
-    ./nix.nix
-
-    ./services/acme.nix
-    ./services/auto-upgrade.nix
-    ./services/irqbalance.nix
-    ./services/logrotate.nix
-    ./services/nginx.nix
-    ./services/openssh.nix
-    ./services/postfix.nix
-    ./services/smartd.nix
-    ./services/thermald.nix
-  ];
-
-  boot.tmp.cleanOnBoot = lib.mkDefault true;
-
-  time.timeZone = "Europe/Oslo";
-
-  i18n.defaultLocale = "en_US.UTF-8";
-  console = {
-    font = "Lat2-Terminus16";
-    keyMap = "no";
-  };
-
-  environment.systemPackages = with pkgs; [
-    file
-    git
-    gnupg
-    htop
-    nano
-    ripgrep
-    rsync
-    screen
-    tmux
-    vim
-    wget
-
-    kitty.terminfo
-  ];
-
-  programs.zsh.enable = true;
-
-  security.sudo.execWheelOnly = true;
-  security.sudo.extraConfig = ''
-    Defaults lecture = never
-  '';
-
-  users.groups."drift".name = "drift";
-
-  # Trusted users on the nix builder machines
-  users.groups."nix-builder-users".name = "nix-builder-users";
-}
-
--- a/base/networking.nix
+++ b/base/networking.nix
@ -1,16 +0,0 @@
-{ lib, values, ... }:
-{
-  networking.domain = "pvv.ntnu.no";
-  networking.useDHCP = false;
-  # networking.search = [ "pvv.ntnu.no" "pvv.org" ];
-  # networking.nameservers = lib.mkDefault [ "129.241.0.200" "129.241.0.201" ];
-  # networking.tempAddresses = lib.mkDefault "disabled";
-  # networking.defaultGateway = values.hosts.gateway;
-
-  systemd.network.enable = true;
-
-  services.resolved = {
-    enable = lib.mkDefault true;
-    dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
-  };
-}
--- a/base/nix.nix
+++ b/base/nix.nix
@ -1,30 +0,0 @@
-{ inputs, ... }:
-{
-  nix = {
-    gc = {
-      automatic = true;
-      options = "--delete-older-than 2d";
-    };
-
-    settings = {
-      allow-dirty = true;
-      auto-optimise-store = true;
-      builders-use-substitutes = true;
-      experimental-features = [ "nix-command" "flakes" ];
-      log-lines = 50;
-      use-xdg-base-directories = true;
-    };
-
-    /* This makes commandline tools like
-    ** nix run nixpkgs#hello
-    ** and nix-shell -p hello
-    ** use the same channel the system
-    ** was built with
-    */
-    registry = {
-      "nixpkgs".flake = inputs.nixpkgs;
-      "pvv-nix".flake = inputs.self;
-    };
-    nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
-  };
-}
--- a/base/services/acme.nix
+++ b/base/services/acme.nix
@ -1,15 +0,0 @@
-{ ... }:
-{
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "drift@pvv.ntnu.no";
-  };
-
-  # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
-  virtualisation.vmVariant = {
-    security.acme.defaults.server = "https://127.0.0.1";
-    security.acme.preliminarySelfsigned = true;
-
-    users.users.root.initialPassword = "root";
-  };
-}
--- a/base/services/auto-upgrade.nix
+++ b/base/services/auto-upgrade.nix
@ -1,12 +0,0 @@
-{ ... }:
-{
-  system.autoUpgrade = {
-    enable = true;
-    flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
-    flags = [
-      "--update-input" "nixpkgs"
-      "--update-input" "nixpkgs-unstable"
-      "--no-write-lock-file"
-    ];
-  };
-}
--- a/base/services/irqbalance.nix
+++ b/base/services/irqbalance.nix
@ -1,4 +0,0 @@
-{ ... }:
-{
-  services.irqbalance.enable = true;
-}
--- a/base/services/logrotate.nix
+++ b/base/services/logrotate.nix
@ -1,42 +0,0 @@
-{ ... }:
-{
-  # source: https://github.com/logrotate/logrotate/blob/main/examples/logrotate.service
-  systemd.services.logrotate = {
-    documentation = [ "man:logrotate(8)" "man:logrotate.conf(5)" ];
-    unitConfig.RequiresMountsFor = "/var/log";
-    serviceConfig = {
-      Nice = 19;
-      IOSchedulingClass = "best-effort";
-      IOSchedulingPriority = 7;
-
-      ReadWritePaths = [ "/var/log" ];
-
-      AmbientCapabilities = [ "" ];
-      CapabilityBoundingSet = [ "" ];
-      DeviceAllow = [ "" ];
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      NoNewPrivileges = true; # disable for third party rotate scripts
-      PrivateDevices = true;
-      PrivateNetwork = true; # disable for mail delivery
-      PrivateTmp = true;
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true; # disable for userdir logs
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "full";
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true; # disable for creating setgid directories
-      SocketBindDeny = [ "any" ];
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-      ];
-    };
-  };
-}
--- a/base/services/nginx.nix
+++ b/base/services/nginx.nix
@ -1,44 +0,0 @@
-{ config, lib, ... }:
-{
-  # nginx return 444 for all nonexistent virtualhosts
-
-  systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
-
-  environment.snakeoil-certs = lib.mkIf config.services.nginx.enable {
-    "/etc/certs/nginx" = {
-      owner = "nginx";
-      group = "nginx";
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
-
-  services.nginx = {
-    recommendedTlsSettings = true;
-    recommendedProxySettings = true;
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-
-    appendConfig = ''
-      pcre_jit on;
-      worker_processes auto;
-      worker_rlimit_nofile 100000;
-    '';
-    eventsConfig = ''
-      worker_connections 2048;
-      use epoll;
-      multi_accept on;
-    '';
-  };
-
-  systemd.services.nginx.serviceConfig = lib.mkIf config.services.nginx.enable {
-    LimitNOFILE = 65536;
-  };
-
-  services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
-    sslCertificate = "/etc/certs/nginx.crt";
-    sslCertificateKey = "/etc/certs/nginx.key";
-    addSSL = true;
-    extraConfig = "return 444;";
-  };
-}
--- a/base/services/openssh.nix
+++ b/base/services/openssh.nix
@ -1,14 +0,0 @@
-{ ... }:
-{
-  services.openssh = {
-    enable = true;
-    startWhenNeeded = true;
-    extraConfig = ''
-      PubkeyAcceptedAlgorithms=+ssh-rsa
-      Match Group wheel
-        PasswordAuthentication no
-      Match All
-    '';
-    settings.PermitRootLogin = "yes";
-  };
-}
--- a/base/services/postfix.nix
+++ b/base/services/postfix.nix
@ -1,23 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.services.postfix;
-in
-{
-  services.postfix = {
-    enable = true;
-
-    hostname = "${config.networking.hostName}.pvv.ntnu.no";
-    domain = "pvv.ntnu.no";
-
-    relayHost = "smtp.pvv.ntnu.no";
-    relayPort = 465;
-
-    config = {
-      smtp_tls_wrappermode = "yes";
-      smtp_tls_security_level = "encrypt";
-    };
-
-    # Nothing should be delivered to this machine
-    destination = [ ];
-  };
-}
--- a/base/services/smartd.nix
+++ b/base/services/smartd.nix
@ -1,8 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  services.smartd.enable = lib.mkDefault true;
-
-  environment.systemPackages = lib.optionals config.services.smartd.enable (with pkgs; [
-    smartmontools
-  ]);
-}
--- a/base/services/thermald.nix
+++ b/base/services/thermald.nix
@ -1,8 +0,0 @@
-{ config, lib, ... }:
-{
-  # Let's not thermal throttle
-  services.thermald.enable = lib.mkIf (lib.all (x: x) [
-      (config.nixpkgs.system == "x86_64-linux")
-      (!config.boot.isContainer or false)
-    ]) true;
-}
--- a/flake.lock
+++ b/flake.lock
@ -7,11 +7,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1715445235,
-        "narHash": "sha256-SUu+oIWn+xqQIOlwfwNfS9Sek4i1HKsrLJchsDReXwA=",
+        "lastModified": 1702569759,
+        "narHash": "sha256-Ze3AdEEsVZBRJ4wn13EZpV1Uubkzi59TkC4j2G9xoFI=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "159d87ea5b95bbdea46f0288a33c5e1570272725",
+        "rev": "98ab91109716871f50ea8cb0e0ac7cc1e1e14714",
        "type": "github"
      },
      "original": {
@ -20,58 +20,18 @@
        "type": "github"
      }
    },
-    "fix-python": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "grzegorz",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1713887124,
-        "narHash": "sha256-hGTSm0p9xXUYDgsAAr/ORZICo6T6u33vLfX3tILikaQ=",
-        "owner": "GuillaumeDesforges",
-        "repo": "fix-python",
-        "rev": "f7f4b33e22414071fc1f9cbf68072c413c3a7fdf",
-        "type": "github"
-      },
-      "original": {
-        "owner": "GuillaumeDesforges",
-        "repo": "fix-python",
-        "type": "github"
-      }
-    },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1689068808,
-        "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
-        "type": "github"
-      },
-      "original": {
-        "id": "flake-utils",
-        "type": "indirect"
-      }
-    },
    "grzegorz": {
      "inputs": {
-        "fix-python": "fix-python",
        "nixpkgs": [
          "nixpkgs-unstable"
        ]
      },
      "locked": {
-        "lastModified": 1715364232,
-        "narHash": "sha256-ZJC3SkanEgbV7p+LFhP+85CviRWOXJNHzZwR/Stb7hE=",
+        "lastModified": 1696346665,
+        "narHash": "sha256-J6Tf6a/zhFZ8SereluHLrvgPsIVm2CGHHA8wrbhZB3Y=",
        "owner": "Programvareverkstedet",
        "repo": "grzegorz",
-        "rev": "3841cda1cdcac470440b06838d56a2eb2256378c",
+        "rev": "9b9c3ac7d408ac7c6d67544b201e6b169afacb03",
        "type": "github"
      },
      "original": {
@ -87,11 +47,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1715384651,
-        "narHash": "sha256-7RhckgUTjqeCjWkhiCc1iB+5CBx9fl80d/3O4Jh+5kM=",
+        "lastModified": 1693864994,
+        "narHash": "sha256-oLDiWdCKDtEfeGzfAuDTq+n9VWp6JCo67PEESEZ3y8E=",
        "owner": "Programvareverkstedet",
        "repo": "grzegorz-clients",
-        "rev": "738a4f3dd887f7c3612e4e772b83cbfa3cde5693",
+        "rev": "a38a0b0fb31ad0ad78a91458cb2c7f77f686468f",
        "type": "github"
      },
      "original": {
@ -102,83 +62,75 @@
    },
    "matrix-next": {
      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
+        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1717234745,
-        "narHash": "sha256-MFyKRdw4WQD6V3vRGbP6MYbtJhZp712zwzjW6YiOBYM=",
+        "lastModified": 1701507532,
+        "narHash": "sha256-Zzv8OFB7iilzDGe6z2t/j8qRtR23TN3N8LssGsvRWEA=",
        "owner": "dali99",
        "repo": "nixos-matrix-modules",
-        "rev": "d7dc42c9bbb155c5e4aa2f0985d0df75ce978456",
+        "rev": "046194cdadc50d81255a9c57789381ed1153e2b1",
        "type": "github"
      },
      "original": {
        "owner": "dali99",
-        "ref": "v0.6.0",
        "repo": "nixos-matrix-modules",
        "type": "github"
      }
    },
-    "nix-gitea-themes": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1714416973,
-        "narHash": "sha256-aZUcvXjdETUC6wVQpWDVjLUzwpDAEca8yR0ITDeK39o=",
-        "ref": "refs/heads/main",
-        "rev": "2b23c0ba8aae68d3cb6789f0f6e4891cef26cc6d",
-        "revCount": 6,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
-      }
-    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1719520878,
-        "narHash": "sha256-5BXzNOl2RVHcfS/oxaZDKOi7gVuTyWPibQG0DHd5sSc=",
+        "lastModified": 1702601832,
+        "narHash": "sha256-z+GyetKtwj7ZVZrRcI73N8Xy1B3JGAqDyPniBFRpIgo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "a44bedbb48c367f0476e6a3a27bf28f6330faf23",
+        "rev": "dff64d4ba6e9dc3f0a4ef8737f372a528d5bc8d1",
        "type": "github"
      },
      "original": {
        "id": "nixpkgs",
-        "ref": "nixos-24.05-small",
+        "ref": "nixos-23.11-small",
        "type": "indirect"
      }
    },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1673743903,
+        "narHash": "sha256-sloY6KYyVOozJ1CkbgJPpZ99TKIjIvM+04V48C04sMQ=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "7555e2dfcbac1533f047021f1744ac8871150f9f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1714858427,
-        "narHash": "sha256-tCxeDP4C1pWe2rYY3IIhdA40Ujz32Ufd4tcrHPSKx2M=",
+        "lastModified": 1702148972,
+        "narHash": "sha256-h2jODFP6n+ABrUWcGRSVPRFfLOkM9TJ2pO+h+9JcaL0=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "b980b91038fc4b09067ef97bbe5ad07eecca1e76",
+        "rev": "b8f33c044e51de6dde3ad80a9676945e0e4e3227",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "release-23.11",
+        "ref": "release-23.05",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1715435713,
-        "narHash": "sha256-lb2HqDQGfTdnCCpc1pgF6fkdgIOuBQ0nP8jjVSfLFqg=",
+        "lastModified": 1702635820,
+        "narHash": "sha256-rClms9NTmSL/WIN5VmEccVhUExMkjCrRNswxU9QGNNo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "52b40f6c4be12742b1504ca2eb4527e597bf2526",
+        "rev": "02357adddd0889782362d999628de9d309d202dc",
        "type": "github"
      },
      "original": {
@ -194,11 +146,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1723850344,
-        "narHash": "sha256-aT37O9l9eclWEnqxASVNBL1dKwDHZUOqdbA4VO9DJvw=",
+        "lastModified": 1693136143,
+        "narHash": "sha256-amHprjftc3y/bg8yf4hITCLa+ez5HIi0yGfR7TU6UIc=",
        "ref": "refs/heads/main",
-        "rev": "38b66677ab8c01aee10cd59e745af9ce3ea88092",
-        "revCount": 19,
+        "rev": "a32894b305f042d561500f5799226afd1faf5abb",
+        "revCount": 9,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
      },
@ -207,37 +159,15 @@
        "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
      }
    },
-    "pvv-nettsiden": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1722722932,
-        "narHash": "sha256-K81a2GQpY2kRX+C9ek9r91THlZB674CqRTSMMb5IO7E=",
-        "ref": "refs/heads/master",
-        "rev": "6580cfe546c902cdf11e17b0b8aa30b3c412bb34",
-        "revCount": 465,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
-      }
-    },
    "root": {
      "inputs": {
        "disko": "disko",
        "grzegorz": "grzegorz",
        "grzegorz-clients": "grzegorz-clients",
        "matrix-next": "matrix-next",
-        "nix-gitea-themes": "nix-gitea-themes",
        "nixpkgs": "nixpkgs",
        "nixpkgs-unstable": "nixpkgs-unstable",
        "pvv-calendar-bot": "pvv-calendar-bot",
-        "pvv-nettsiden": "pvv-nettsiden",
        "sops-nix": "sops-nix"
      }
    },
@ -249,11 +179,11 @@
        "nixpkgs-stable": "nixpkgs-stable"
      },
      "locked": {
-        "lastModified": 1715244550,
-        "narHash": "sha256-ffOZL3eaZz5Y1nQ9muC36wBCWwS1hSRLhUzlA9hV2oI=",
+        "lastModified": 1702177193,
+        "narHash": "sha256-J2409SyXROoUHYXVy9h4Pj0VU8ReLuy/mzBc9iK4DBg=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "0dc50257c00ee3c65fef3a255f6564cfbfe6eb7f",
+        "rev": "d806e546f96c88cd9f7d91c1c19ebc99ba6277d9",
        "type": "github"
      },
      "original": {
@ -261,21 +191,6 @@
        "repo": "sops-nix",
        "type": "github"
      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@ -2,7 +2,7 @@
  description = "PVV System flake";

  inputs = {
-    nixpkgs.url = "nixpkgs/nixos-24.05-small";
+    nixpkgs.url = "nixpkgs/nixos-23.11-small";
    nixpkgs-unstable.url = "nixpkgs/nixos-unstable-small";

    sops-nix.url = "github:Mic92/sops-nix";
@ -11,17 +11,10 @@
    disko.url = "github:nix-community/disko";
    disko.inputs.nixpkgs.follows = "nixpkgs";

-    pvv-nettsiden.url = "git+https://git.pvv.ntnu.no/Projects/nettsiden.git";
-    pvv-nettsiden.inputs.nixpkgs.follows = "nixpkgs";
-
    pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
    pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";

-    matrix-next.url = "github:dali99/nixos-matrix-modules/v0.6.0";
-    matrix-next.inputs.nixpkgs.follows = "nixpkgs";
-
-    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git";
-    nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";
+    matrix-next.url = "github:dali99/nixos-matrix-modules";

    grzegorz.url = "github:Programvareverkstedet/grzegorz";
    grzegorz.inputs.nixpkgs.follows = "nixpkgs-unstable";
@ -37,8 +30,8 @@
      "aarch64-linux"
      "aarch64-darwin"
    ];
-    forAllSystems = f: nixlib.genAttrs systems f;
-    allMachines = builtins.attrNames self.nixosConfigurations;
+    forAllSystems = f: nixlib.genAttrs systems (system: f system);
+    allMachines = nixlib.mapAttrsToList (name: _: name) self.nixosConfigurations;
    importantMachines = [
      "bekkalokk"
      "bicep"
@ -47,10 +40,7 @@
      "ildkule"
    ];
  in {
-    inherit inputs;
-
    nixosConfigurations = let
-      unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
      nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
        rec {
          system = "x86_64-linux";
@ -62,16 +52,16 @@
          modules = [
            ./hosts/${name}/configuration.nix
            sops-nix.nixosModules.sops
-          ] ++ config.modules or [];
+          ];

          pkgs = import nixpkgs {
            inherit system;
            overlays = [
-              # Global overlays go here
-            ] ++ config.overlays or [ ];
+              inputs.pvv-calendar-bot.overlays.${system}.default
+            ];
          };
        }
-        (removeAttrs config [ "modules" "overlays" ])
+        config
      );

      stableNixosConfig = nixosConfig nixpkgs;
@ -79,30 +69,19 @@
    in {
      bicep = stableNixosConfig "bicep" {
        modules = [
+          ./hosts/bicep/configuration.nix
+          sops-nix.nixosModules.sops
+
          inputs.matrix-next.nixosModules.default
          inputs.pvv-calendar-bot.nixosModules.default
        ];
-        overlays = [
-          inputs.pvv-calendar-bot.overlays.x86_64-linux.default
-        ];
-      };
-      bekkalokk = stableNixosConfig "bekkalokk" {
-        overlays = [
-          (final: prev: {
-            heimdal = unstablePkgs.heimdal;
-            mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions { };
-            simplesamlphp = final.callPackage ./packages/simplesamlphp { };
-          })
-          inputs.nix-gitea-themes.overlays.default
-          inputs.pvv-nettsiden.overlays.default
-        ];
-        modules = [
-          inputs.nix-gitea-themes.nixosModules.default
-          inputs.pvv-nettsiden.nixosModules.default
-        ];
      };
+      bekkalokk = stableNixosConfig "bekkalokk" { };
      bob = stableNixosConfig "bob" {
        modules = [
+          ./hosts/bob/configuration.nix
+          sops-nix.nixosModules.sops
+
          disko.nixosModules.disko
          { disko.devices.disk.disk1.device = "/dev/vda"; }
        ];
@ -113,22 +92,28 @@

      brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
        modules = [
+          ./hosts/brzeczyszczykiewicz/configuration.nix
+          sops-nix.nixosModules.sops
+
          inputs.grzegorz.nixosModules.grzegorz-kiosk
          inputs.grzegorz-clients.nixosModules.grzegorz-webui
        ];
      };
      georg = stableNixosConfig "georg" {
        modules = [
+          ./hosts/georg/configuration.nix
+          sops-nix.nixosModules.sops
+
          inputs.grzegorz.nixosModules.grzegorz-kiosk
          inputs.grzegorz-clients.nixosModules.grzegorz-webui
        ];
      };
-      buskerud = stableNixosConfig "buskerud" { };
-    };
-
-    nixosModules = {
-      snakeoil-certs = ./modules/snakeoil-certs.nix;
-      snappymail = ./modules/snappymail.nix;
+      buskerud = stableNixosConfig "buskerud" {
+        modules = [
+          ./hosts/buskerud/configuration.nix
+          sops-nix.nixosModules.sops
+        ];
+      };
    };

    devShells = forAllSystems (system: {
@ -144,16 +129,7 @@
          (nixlib.getAttrs importantMachines self.packages.x86_64-linux);
        all-machines = pkgs.linkFarm "all-machines"
          (nixlib.getAttrs allMachines self.packages.x86_64-linux);
-
-        simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
-
-      } //
-      (nixlib.pipe null [
-        (_: pkgs.callPackage ./packages/mediawiki-extensions { })
-        (nixlib.flip builtins.removeAttrs ["override" "overrideDerivation"])
-        (nixlib.mapAttrs' (name: nixlib.nameValuePair "mediawiki-${name}"))
-      ])
-      // nixlib.genAttrs allMachines
+      } // nixlib.genAttrs allMachines
        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
    };
  };
--- a/hosts/bekkalokk/configuration.nix
+++ b/hosts/bekkalokk/configuration.nix
@ -3,18 +3,17 @@
  imports = [
    ./hardware-configuration.nix

-    ../../base
+    ../../base.nix
    ../../misc/metrics-exporters.nix

+    #./services/keycloak.nix
+
+    # TODO: set up authentication for the following:
+    # ./services/website.nix
+    ./services/nginx
    ./services/gitea/default.nix
-    ./services/idp-simplesamlphp
-    ./services/kerberos
-    ./services/mediawiki
-    ./services/nginx.nix
-    ./services/phpfpm.nix
-    ./services/vaultwarden.nix
    ./services/webmail
-    ./services/website
+    # ./services/mediawiki.nix
  ];

  sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
@ -25,6 +24,8 @@
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

+  virtualisation.podman.enable = true;
+
  networking.hostName = "bekkalokk";

  systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
@ -32,8 +33,6 @@
    address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };

-  services.btrfs.autoScrub.enable = true;
-
  # Do not change, even during upgrades.
  # See https://search.nixos.org/options?show=system.stateVersion
  system.stateVersion = "22.11";
--- a/hosts/bekkalokk/services/gitea/ci.nix
+++ b/hosts/bekkalokk/services/gitea/ci.nix
@ -15,9 +15,9 @@ let
        enable = true;
        name = "git-runner-${name}"; url = "https://git.pvv.ntnu.no";
        labels = [
-          "debian-latest:docker://node:18-bullseye"
-          "ubuntu-latest:docker://node:18-bullseye"
-        ];
+	  "debian-latest:docker://node:18-bullseye"
+	  "ubuntu-latest:docker://node:18-bullseye"
+	];
        tokenFile = config.sops.secrets."gitea/runners/${name}".path;
      };
    };
@ -27,5 +27,4 @@ lib.mkMerge [
  (mkRunner "alpha")
  (mkRunner "beta")
  (mkRunner "epsilon")
-  { virtualisation.podman.enable = true; }
 ]
--- a/hosts/bekkalokk/services/gitea/default.nix
+++ b/hosts/bekkalokk/services/gitea/default.nix
@ -1,4 +1,4 @@
-{ config, values, pkgs, lib, ... }:
+{ config, values, pkgs, ... }:
 let
  cfg = config.services.gitea;
  domain = "git.pvv.ntnu.no";
@ -6,8 +6,6 @@ let
 in {
  imports = [
    ./ci.nix
-    ./import-users
-    ./web-secret-provider
  ];

  sops.secrets = {
@ -15,85 +13,36 @@ in {
      owner = "gitea";
      group = "gitea";
    };
-    "gitea/email-password" = {
-      owner = "gitea";
-      group = "gitea";
-    };
+    "gitea/passwd-ssh-key" = { };
+    "gitea/ssh-known-hosts" = { };
+    "gitea/import-user-env" = { };
  };

  services.gitea = {
    enable = true;
+    stateDir = "/data/gitea";
    appName = "PVV Git";

    database = {
      type = "postgres";
      host = "postgres.pvv.ntnu.no";
-      port = config.services.postgresql.settings.port;
+      port = config.services.postgresql.port;
      passwordFile = config.sops.secrets."gitea/database".path;
      createDatabase = false;
    };

-    mailerPasswordFile = config.sops.secrets."gitea/email-password".path;
-
-    # https://docs.gitea.com/administration/config-cheat-sheet
    settings = {
      server = {
        DOMAIN   = domain;
        ROOT_URL = "https://${domain}/";
        PROTOCOL = "http+unix";
        SSH_PORT = sshPort;
-        START_SSH_SERVER = true;
-        START_LFS_SERVER = true;
-        LANDING_PAGE = "explore";
-      };
-      mailer = {
-        ENABLED = true;
-        FROM = "gitea@pvv.ntnu.no";
-        PROTOCOL = "smtp";
-        SMTP_ADDR = "smtp.pvv.ntnu.no";
-        SMTP_PORT = 587;
-        USER = "gitea@pvv.ntnu.no";
-        SUBJECT_PREFIX = "[pvv-git]";
+	      START_SSH_SERVER = true;
      };
      indexer.REPO_INDEXER_ENABLED = true;
-      service = {
-        DISABLE_REGISTRATION = true;
-        ENABLE_NOTIFY_MAIL = true;
-        AUTO_WATCH_NEW_REPOS = false;
-      };
-      admin.DEFAULT_EMAIL_NOTIFICATIONS = "onmention";
+      service.DISABLE_REGISTRATION = true;
      session.COOKIE_SECURE = true;
      database.LOG_SQL = false;
-      repository = {
-        PREFERRED_LICENSES = lib.concatStringsSep "," [
-          "AGPL-3.0-only"
-          "AGPL-3.0-or-later"
-          "Apache-2.0"
-          "BSD-3-Clause"
-          "CC-BY-4.0"
-          "CC-BY-NC-4.0"
-          "CC-BY-NC-ND-4.0"
-          "CC-BY-NC-SA-4.0"
-          "CC-BY-ND-4.0"
-          "CC-BY-SA-4.0"
-          "CC0-1.0"
-          "GPL-2.0-only"
-          "GPL-3.0-only"
-          "GPL-3.0-or-later"
-          "LGPL-3.0-linking-exception"
-          "LGPL-3.0-only"
-          "LGPL-3.0-or-later"
-          "MIT"
-          "MPL-2.0"
-          "Unlicense"
-        ];
-        DEFAULT_REPO_UNITS = lib.concatStringsSep "," [
-          "repo.code"
-          "repo.issues"
-          "repo.pulls"
-          "repo.releases"
-        ];
-      };
      picture = {
        DISABLE_GRAVATAR = true;
        ENABLE_FEDERATED_AVATAR = false;
@ -108,9 +57,9 @@ in {
  services.nginx.virtualHosts."${domain}" = {
    forceSSL = true;
    enableACME = true;
-    kTLS = true;
    locations."/" = {
      proxyPass = "http://unix:${cfg.settings.server.HTTP_ADDR}";
+      recommendedProxySettings = true;
      extraConfig = ''
        client_max_body_size 512M;
      '';
@ -119,34 +68,38 @@ in {

  networking.firewall.allowedTCPPorts = [ sshPort ];

-  # Extra customization
-
-  services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
-
-  systemd.services.install-gitea-customization = {
-    description = "Install extra customization in gitea's CUSTOM_DIR";
-    wantedBy = [ "gitea.service" ];
-    requiredBy = [ "gitea.service" ];
-
-    serviceConfig =  {
-      Type = "oneshot";
-      User = cfg.user;
-      Group = cfg.group;
+  # Automatically import users
+  systemd.services.gitea-import-users = {
+    enable = true;
+    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /tmp/passwd-import'';
+    serviceConfig = {
+      ExecStart = pkgs.writers.writePython3 "gitea-import-users" { libraries = [ pkgs.python3Packages.requests ]; } (builtins.readFile ./gitea-import-users.py);
+      LoadCredential=[
+        "sshkey:${config.sops.secrets."gitea/passwd-ssh-key".path}"
+        "ssh-known-hosts:${config.sops.secrets."gitea/ssh-known-hosts".path}"
+      ];
+      DynamicUser="yes";
+      EnvironmentFile=config.sops.secrets."gitea/import-user-env".path;
    };
-
-    script = let
-      logo-svg = ../../../../assets/logo_blue_regular.svg;
-      logo-png = ../../../../assets/logo_blue_regular.png;
-      extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
-        <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
-        <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
-        <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
-      '';
-    in ''
-      install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
-      install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
-      install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
-      install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
-    '';
  };
+
+  systemd.timers.gitea-import-users = {
+    requires = [ "gitea.service" ];
+    after = [ "gitea.service" ];
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "*-*-* 02:00:00";
+      Persistent = true;
+      Unit = "gitea-import-users.service";
+    };
+  };
+
+  system.activationScripts.linkGiteaLogo.text = let
+    logo-svg = ../../../../assets/logo_blue_regular.svg;
+    logo-png = ../../../../assets/logo_blue_regular.png;
+  in ''
+    install -Dm444 ${logo-svg} ${cfg.stateDir}/custom/public/img/logo.svg
+    install -Dm444 ${logo-png} ${cfg.stateDir}/custom/public/img/logo.png
+    install -Dm444 ${./loading.apng} ${cfg.stateDir}/custom/public/img/loading.png
+  '';
 }
--- a/hosts/bekkalokk/services/gitea/gitea-import-users.py
+++ b/hosts/bekkalokk/services/gitea/gitea-import-users.py
@ -0,0 +1,93 @@
+import requests
+import secrets
+import os
+
+EMAIL_DOMAIN = os.getenv('EMAIL_DOMAIN')
+if EMAIL_DOMAIN is None:
+    EMAIL_DOMAIN = 'pvv.ntnu.no'
+
+API_TOKEN = os.getenv('API_TOKEN')
+if API_TOKEN is None:
+    raise Exception('API_TOKEN not set')
+
+GITEA_API_URL = os.getenv('GITEA_API_URL')
+if GITEA_API_URL is None:
+    GITEA_API_URL = 'https://git.pvv.ntnu.no/api/v1'
+
+BANNED_SHELLS = [
+    "/usr/bin/nologin",
+    "/usr/sbin/nologin",
+    "/sbin/nologin",
+    "/bin/false",
+    "/bin/msgsh",
+]
+
+existing_users = {}
+
+
+# This function should only ever be called when adding users
+# from the passwd file
+def add_user(username, name):
+    user = {
+            "full_name": name,
+            "username": username,
+            "login_name": username,
+            "source_id": 1,  # 1 = SMTP
+    }
+
+    if username not in existing_users:
+        user["password"] = secrets.token_urlsafe(32)
+        user["must_change_password"] = False
+        user["visibility"] = "private"
+        user["email"] = username + '@' + EMAIL_DOMAIN
+
+        r = requests.post(GITEA_API_URL + '/admin/users', json=user,
+                          headers={'Authorization': 'token ' + API_TOKEN})
+        if r.status_code != 201:
+            print('ERR: Failed to create user ' + username + ': ' + r.text)
+            return
+
+        print('Created user ' + username)
+        existing_users[username] = user
+
+    else:
+        r = requests.patch(GITEA_API_URL + f'/admin/users/{username}',
+                           json=user,
+                           headers={'Authorization': 'token ' + API_TOKEN})
+        if r.status_code != 200:
+            print('ERR: Failed to update user ' + username + ': ' + r.text)
+            return
+
+        print('Updated user ' + username)
+
+
+def main():
+    # Fetch existing users
+    r = requests.get(GITEA_API_URL + '/admin/users',
+                     headers={'Authorization': 'token ' + API_TOKEN})
+
+    if r.status_code != 200:
+        raise Exception('Failed to get users: ' + r.text)
+
+    for user in r.json():
+        existing_users[user['login']] = user
+
+    # Read the file, add each user
+    with open("/tmp/passwd-import", 'r') as f:
+        for line in f.readlines():
+            uid = int(line.split(':')[2])
+            if uid < 1000:
+                continue
+
+            shell = line.split(':')[-1]
+            if shell in BANNED_SHELLS:
+                continue
+
+            username = line.split(':')[0]
+            name = line.split(':')[4].split(',')[0]
+
+            add_user(username, name)
+
+
+if __name__ == '__main__':
+    main()
--- a/hosts/bekkalokk/services/gitea/import-users/default.nix
+++ b/hosts/bekkalokk/services/gitea/import-users/default.nix
@ -1,41 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.services.gitea;
-in
-{
-  sops.secrets = {
-    "gitea/passwd-ssh-key" = { };
-    "gitea/ssh-known-hosts" = { };
-    "gitea/import-user-env" = { };
-  };
-
-  systemd.services.gitea-import-users = lib.mkIf cfg.enable {
-    enable = true;
-    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /tmp/passwd-import'';
-    serviceConfig = {
-      ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
-        flakeIgnore = [
-          "E501" # Line over 80 chars lol
-        ];
-        libraries = with pkgs.python3Packages; [ requests ];
-      } (builtins.readFile ./gitea-import-users.py);
-      LoadCredential=[
-        "sshkey:${config.sops.secrets."gitea/passwd-ssh-key".path}"
-        "ssh-known-hosts:${config.sops.secrets."gitea/ssh-known-hosts".path}"
-      ];
-      DynamicUser="yes";
-      EnvironmentFile=config.sops.secrets."gitea/import-user-env".path;
-    };
-  };
-
-  systemd.timers.gitea-import-users = lib.mkIf cfg.enable {
-    requires = [ "gitea.service" ];
-    after = [ "gitea.service" ];
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnCalendar = "*-*-* 02:00:00";
-      Persistent = true;
-      Unit = "gitea-import-users.service";
-    };
-  };
-}
--- a/hosts/bekkalokk/services/gitea/import-users/gitea-import-users.py
+++ b/hosts/bekkalokk/services/gitea/import-users/gitea-import-users.py
@ -1,198 +0,0 @@
-import requests
-import secrets
-import os
-
-
-EMAIL_DOMAIN = os.getenv('EMAIL_DOMAIN')
-if EMAIL_DOMAIN is None:
-    EMAIL_DOMAIN = 'pvv.ntnu.no'
-
-
-API_TOKEN = os.getenv('API_TOKEN')
-if API_TOKEN is None:
-    raise Exception('API_TOKEN not set')
-
-
-GITEA_API_URL = os.getenv('GITEA_API_URL')
-if GITEA_API_URL is None:
-    GITEA_API_URL = 'https://git.pvv.ntnu.no/api/v1'
-
-
-def gitea_list_all_users() -> dict[str, dict[str, any]] | None:
-    r = requests.get(
-        GITEA_API_URL + '/admin/users',
-        headers={'Authorization': 'token ' + API_TOKEN}
-    )
-
-    if r.status_code != 200:
-        print('Failed to get users:', r.text)
-        return None
-
-    return {user['login']: user for user in r.json()}
-
-
-def gitea_create_user(username: str, userdata: dict[str, any]) -> bool:
-    r = requests.post(
-        GITEA_API_URL + '/admin/users',
-        json=userdata,
-        headers={'Authorization': 'token ' + API_TOKEN},
-    )
-
-    if r.status_code != 201:
-        print(f'ERR: Failed to create user {username}:', r.text)
-        return False
-
-    return True
-
-
-def gitea_edit_user(username: str, userdata: dict[str, any]) -> bool:
-    r = requests.patch(
-        GITEA_API_URL + f'/admin/users/{username}',
-        json=userdata,
-        headers={'Authorization': 'token ' + API_TOKEN},
-    )
-
-    if r.status_code != 200:
-        print(f'ERR: Failed to update user {username}:', r.text)
-        return False
-
-    return True
-
-
-def gitea_list_teams_for_organization(org: str) -> dict[str, any] | None:
-    r = requests.get(
-        GITEA_API_URL + f'/orgs/{org}/teams',
-        headers={'Authorization': 'token ' + API_TOKEN},
-    )
-
-    if r.status_code != 200:
-        print(f"ERR: Failed to list teams for {org}:", r.text)
-        return None
-
-    return {team['name']: team for team in r.json()}
-
-
-def gitea_add_user_to_organization_team(username: str, team_id: int) -> bool:
-    r = requests.put(
-        GITEA_API_URL + f'/teams/{team_id}/members/{username}',
-        headers={'Authorization': 'token ' + API_TOKEN},
-    )
-
-    if r.status_code != 204:
-        print(f'ERR: Failed to add user {username} to org team {team_id}:', r.text)
-        return False
-
-    return True
-
-
-# If a passwd user has one of the following shells,
-# it is most likely not a PVV user, but rather a system user.
-# Users with these shells should thus be ignored.
-BANNED_SHELLS = [
-    "/usr/bin/nologin",
-    "/usr/sbin/nologin",
-    "/sbin/nologin",
-    "/bin/false",
-    "/bin/msgsh",
-]
-
-
-# Reads out a passwd-file line for line, and filters out
-# real PVV users (as opposed to system users meant for daemons and such)
-def passwd_file_parser(passwd_path):
-    with open(passwd_path, 'r') as f:
-        for line in f.readlines():
-            uid = int(line.split(':')[2])
-            if uid < 1000:
-                continue
-
-            shell = line.split(':')[-1]
-            if shell in BANNED_SHELLS:
-                continue
-
-            username = line.split(':')[0]
-            name = line.split(':')[4].split(',')[0]
-            yield (username, name)
-
-
-# This function either creates a new user in gitea
-# and fills it out with some default information if
-# it does not exist, or ensures that the default information
-# is correct if the user already exists. All user information
-# (including non-default fields) is pulled from gitea and added
-# to the `existing_users` dict
-def add_or_patch_gitea_user(
-    username: str,
-    name: str,
-    existing_users: dict[str, dict[str, any]],
-) -> None:
-    user = {
-        "full_name": name,
-        "username": username,
-        "login_name": username,
-        "source_id": 1,  # 1 = SMTP
-    }
-
-    if username not in existing_users:
-        user["password"] = secrets.token_urlsafe(32)
-        user["must_change_password"] = False
-        user["visibility"] = "private"
-        user["email"] = username + '@' + EMAIL_DOMAIN
-
-        if not gitea_create_user(username, user):
-            return
-
-        print('Created user', username)
-        existing_users[username] = user
-
-    else:
-        user["visibility"] = existing_users[username]["visibility"]
-
-        if not gitea_edit_user(username, user):
-            return
-
-        print('Updated user', username)
-
-
-# This function adds a user to a gitea team (part of organization)
-# if the user is not already part of said team.
-def ensure_gitea_user_is_part_of_team(
-    username: str,
-    org: str,
-    team_name: str,
-) -> None:
-    teams = gitea_list_teams_for_organization(org)
-
-    if teams is None:
-        return
-
-    if team_name not in teams:
-        print(f'ERR: could not find team "{team_name}" in organization "{org}"')
-
-    gitea_add_user_to_organization_team(username, teams[team_name]['id'])
-
-    print(f'User {username} is now part of {org}/{team_name}')
-
-
-# List of teams that all users should be part of by default
-COMMON_USER_TEAMS = [
-    ("Projects", "Members"),
-    ("Kurs", "Members"),
-]
-
-
-def main():
-    existing_users = gitea_list_all_users()
-    if existing_users is None:
-        exit(1)
-
-    for username, name in passwd_file_parser("/tmp/passwd-import"):
-        print(f"Processing {username}")
-        add_or_patch_gitea_user(username, name, existing_users)
-        for org, team_name in COMMON_USER_TEAMS:
-            ensure_gitea_user_is_part_of_team(username, org, team_name)
-        print()
-
-
-if __name__ == '__main__':
-    main()
--- a/hosts/bekkalokk/services/gitea/web-secret-provider/default.nix
+++ b/hosts/bekkalokk/services/gitea/web-secret-provider/default.nix
@ -1,114 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  organizations = [
-    "Drift"
-    "Projects"
-    "Kurs"
-  ];
-
-  giteaCfg = config.services.gitea;
-
-  giteaWebSecretProviderScript = pkgs.writers.writePython3 "gitea-web-secret-provider" {
-    libraries = with pkgs.python3Packages; [ requests ];
-    flakeIgnore = [
-      "E501" # Line over 80 chars lol
-      "E201" # "whitespace after {"
-      "E202" # "whitespace after }"
-      "E251" # unexpected spaces around keyword / parameter equals
-      "W391" # Newline at end of file
-    ];
-    makeWrapperArgs = [
-      "--prefix PATH : ${(lib.makeBinPath [ pkgs.openssh ])}"
-    ];
-  } (builtins.readFile ./gitea-web-secret-provider.py);
-in
-{
-  users.groups."gitea-web" = { };
-  users.users."gitea-web" = {
-    group = "gitea-web";
-    isSystemUser = true;
-  };
-
-  sops.secrets."gitea/web-secret-provider/token" = {
-    owner = "gitea-web";
-    group = "gitea-web";
-    restartUnits = [
-      "gitea-web-secret-provider@"
-    ] ++ (map (org: "gitea-web-secret-provider@${org}") organizations);
-  };
-
-  systemd.slices.system-giteaweb = {
-    description = "Gitea web directories";
-  };
-
-  # https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html#Specifiers
-  # %i - instance name (after the @)
-  # %d - secrets directory
-  systemd.services."gitea-web-secret-provider@" = {
-    description = "Ensure all repos in %i has an SSH key to push web content";
-    requires = [ "gitea.service" "network.target" ];
-    serviceConfig = {
-      Slice = "system-giteaweb.slice";
-      Type = "oneshot";
-      ExecStart = let
-        args = lib.cli.toGNUCommandLineShell { } {
-          org = "%i";
-          token-path = "%d/token";
-          api-url = "${giteaCfg.settings.server.ROOT_URL}api/v1";
-          key-dir = "/var/lib/gitea-web/keys/%i";
-          authorized-keys-path = "/var/lib/gitea-web/authorized_keys.d/%i";
-          rrsync-script = pkgs.writeShellScript "rrsync-chown" ''
-            ${lib.getExe pkgs.rrsync} -wo "$1"
-            ${pkgs.coreutils}/bin/chown -R gitea-web:gitea-web "$1"
-          '';
-          web-dir = "/var/lib/gitea-web/web";
-        };
-      in "${giteaWebSecretProviderScript} ${args}";
-
-      User = "gitea-web";
-      Group = "gitea-web";
-
-      StateDirectory = "gitea-web";
-      StateDirectoryMode = "0750";
-      LoadCredential = [
-        "token:${config.sops.secrets."gitea/web-secret-provider/token".path}"
-      ];
-
-      NoNewPrivileges = true;
-      PrivateTmp = true;
-      PrivateDevices = true;
-      ProtectSystem = true;
-      ProtectHome = true;
-      ProtectControlGroups = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      MemoryDenyWriteExecute = true;
-      LockPersonality = true;
-    };
-  };
-
-  systemd.timers."gitea-web-secret-provider@" = {
-    description = "Ensure all repos in %i has an SSH key to push web content";
-    timerConfig = {
-      RandomizedDelaySec = "1h";
-      Persistent = true;
-      Unit = "gitea-web-secret-provider@%i.service";
-      OnCalendar = "daily";
-    };
-  };
-
-  systemd.targets.timers.wants = map (org: "gitea-web-secret-provider@${org}.timer") organizations;
-
-  services.openssh.authorizedKeysFiles = map (org: "/var/lib/gitea-web/authorized_keys.d/${org}") organizations;
-
-  users.users.nginx.extraGroups = [ "gitea-web" ];
-  services.nginx.virtualHosts."pages.pvv.ntnu.no" = {
-    kTLS = true;
-    forceSSL = true;
-    enableACME = true;
-    root = "/var/lib/gitea-web/web";
-  };
-}
--- a/hosts/bekkalokk/services/gitea/web-secret-provider/gitea-web-secret-provider.py
+++ b/hosts/bekkalokk/services/gitea/web-secret-provider/gitea-web-secret-provider.py
@ -1,112 +0,0 @@
-import argparse
-import hashlib
-import os
-import requests
-import subprocess
-from pathlib import Path
-
-
-def parse_args():
-    parser = argparse.ArgumentParser(description="Generate SSH keys for Gitea repositories and add them as secrets")
-    parser.add_argument("--org", required=True, type=str, help="The organization to generate keys for")
-    parser.add_argument("--token-path", metavar='PATH', required=True, type=Path, help="Path to a file containing the Gitea API token")
-    parser.add_argument("--api-url", metavar='URL', type=str, help="The URL of the Gitea API", default="https://git.pvv.ntnu.no/api/v1")
-    parser.add_argument("--key-dir", metavar='PATH', type=Path, help="The directory to store the generated keys in", default="/run/gitea-web-secret-provider")
-    parser.add_argument("--authorized-keys-path", metavar='PATH', type=Path, help="The path to the resulting authorized_keys file", default="/etc/ssh/authorized_keys.d/gitea-web-secret-provider")
-    parser.add_argument("--rrsync-script", metavar='PATH', type=Path, help="The path to a rrsync script, taking the destination path as its single argument")
-    parser.add_argument("--web-dir", metavar='PATH', type=Path, help="The directory to sync the repositories to", default="/var/www")
-    parser.add_argument("--force", action="store_true", help="Overwrite existing keys")
-    return parser.parse_args()
-
-
-def add_secret(args: argparse.Namespace, token: str, repo: str, name: str, secret: str):
-    result = requests.put(
-        f"{args.api_url}/repos/{args.org}/{repo}/actions/secrets/{name}",
-        json = { 'data': secret },
-        headers = { 'Authorization': 'token ' + token },
-    )
-    if result.status_code not in (201, 204):
-        raise Exception(f"Failed to add secret: {result.json()}")
-
-
-def get_org_repo_list(args: argparse.Namespace, token: str):
-    result = requests.get(
-        f"{args.api_url}/orgs/{args.org}/repos",
-        headers = { 'Authorization': 'token ' + token },
-    )
-    return [repo["name"] for repo in result.json()]
-
-
-def generate_ssh_key(args: argparse.Namespace, repository: str):
-    keyname = hashlib.sha256(args.org.encode() + repository.encode()).hexdigest()
-    key_path = args.key_dir / keyname
-    if not key_path.is_file() or args.force:
-        subprocess.run(
-            [
-                "ssh-keygen",
-                *("-t", "ed25519"),
-                *("-f", key_path),
-                *("-N", ""),
-                *("-C", f"{args.org}/{repository}"),
-            ],
-            check=True,
-            stdin=subprocess.DEVNULL,
-            stdout=subprocess.PIPE,
-            stderr=subprocess.PIPE,
-        )
-        print(f"Generated SSH key for `{args.org}/{repository}`")
-
-    with open(key_path, "r") as f:
-        private_key = f.read()
-
-    pub_key_path = args.key_dir / (keyname + '.pub')
-    with open(pub_key_path, "r") as f:
-        public_key = f.read()
-
-    return private_key, public_key
-
-
-SSH_OPTS = ",".join([
-    "restrict",
-    "no-agent-forwarding",
-    "no-port-forwarding",
-    "no-pty",
-    "no-X11-forwarding",
-])
-
-
-def generate_authorized_keys(args: argparse.Namespace, repo_public_keys: list[tuple[str, str]]):
-    lines = []
-    for repo, public_key in repo_public_keys:
-        command = f"{args.rrsync_script} {args.web_dir}/{args.org}/{repo}"
-        lines.append(f'command="{command}",{SSH_OPTS} {public_key}')
-
-    with open(args.authorized_keys_path, "w") as f:
-        f.writelines(lines)
-
-
-def main():
-    args = parse_args()
-
-    with open(args.token_path, "r") as f:
-        token = f.read().strip()
-
-    os.makedirs(args.key_dir, 0o700, exist_ok=True)
-    os.makedirs(args.authorized_keys_path.parent, 0o700, exist_ok=True)
-
-    repos = get_org_repo_list(args, token)
-    print(f'Found {len(repos)} repositories in `{args.org}`')
-
-    repo_public_keys = []
-    for repo in repos:
-        print(f"Locating key for `{args.org}/{repo}`")
-        private_key, public_key = generate_ssh_key(args, repo)
-        add_secret(args, token, repo, "WEB_SYNC_SSH_KEY", private_key)
-        repo_public_keys.append((repo, public_key))
-
-    generate_authorized_keys(args, repo_public_keys)
-    print(f"Wrote authorized_keys file to `{args.authorized_keys_path}`")
-
-
-if __name__ == "__main__":
-    main()
--- a/hosts/bekkalokk/services/idp-simplesamlphp/authpwauth.php
+++ b/hosts/bekkalokk/services/idp-simplesamlphp/authpwauth.php
@ -1,135 +0,0 @@
-<?php
-
-/**
- * Authenticate using HTTP login.
- *
- * @author Yorn de Jong
- * @author Oystein Kristoffer Tveit
- * @package simpleSAMLphp
- */
-
-namespace SimpleSAML\Module\authpwauth\Auth\Source;
-
-class PwAuth extends \SimpleSAML\Module\core\Auth\UserPassBase
-{
-    protected $pwauth_bin_path;
-    protected $mail_domain;
-
-    public function __construct(array $info, array &$config) {
-            assert('is_array($info)');
-            assert('is_array($config)');
-
-            /* Call the parent constructor first, as required by the interface. */
-            parent::__construct($info, $config);
-
-            $this->pwauth_bin_path = $config['pwauth_bin_path'];
-            if (array_key_exists('mail_domain', $config)) {
-                    $this->mail_domain = '@' . ltrim($config['mail_domain'], '@');
-            }
-    }
-
-    public function login(string $username, string $password): array {
-            $username = strtolower( $username );
-
-	    if (!file_exists($this->pwauth_bin_path)) {
-                    die("Could not find pwauth binary");
-                    return false;
-	    }
-
-	    if (!is_executable($this->pwauth_bin_path)) {
-                    die("pwauth binary is not executable");
-                    return false;
-	    }
-
-            $handle = popen($this->pwauth_bin_path, 'w');
-            if ($handle === FALSE) {
-                    die("Error opening pipe to pwauth");
-                    return false;
-            }
-
-            $data = "$username\n$password\n";
-            if (fwrite($handle, $data) !== strlen($data)) {
-                    die("Error writing to pwauth pipe");
-                    return false;
-            }
-
-            # Is the password valid?
-            $result = pclose( $handle );
-            if ($result !== 0) {
-                    if (!in_array($result, [1, 2, 3, 4, 5, 6, 7], true)) {
-                            die("pwauth returned $result for username $username");
-                    }
-                    throw new \SimpleSAML\Error\Error('WRONGUSERPASS');
-            }
-            /*
-            $ldap = ldap_connect('129.241.210.159', 389);
-            ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
-            ldap_start_tls($ldap);
-            ldap_bind($ldap, 'passordendrer@pvv.ntnu.no', 'Oi7aekoh');
-            $search = ldap_search($ldap, 'DC=pvv,DC=ntnu,DC=no', '(sAMAccountName='.ldap_escape($username, '', LDAP_ESCAPE_FILTER).')');
-            $entry = ldap_first_entry($ldap, $search);
-            $dn = ldap_get_dn($ldap, $entry);
-            $newpassword = mb_convert_encoding("\"$password\"", 'UTF-16LE', 'UTF-8');
-            ldap_modify_batch($ldap, $dn, [
-                    #[
-                    #       'modtype' => LDAP_MODIFY_BATCH_REMOVE,
-                    #       'attrib' => 'unicodePwd',
-                    #       'values' => [$password],
-                    #],
-                    [
-                            #'modtype' => LDAP_MODIFY_BATCH_ADD,
-                            'modtype' => LDAP_MODIFY_BATCH_REPLACE,
-                            'attrib' => 'unicodePwd',
-                            'values' => [$newpassword],
-                    ],
-            ]);
-            */
-
-            #0  -  Login OK.
-            #1  -  Nonexistant login or (for some configurations) incorrect password.
-            #2  -  Incorrect password (for some configurations).
-            #3  -  Uid number is below MIN_UNIX_UID value configured in config.h.
-            #4  -  Login ID has expired.
-            #5  -  Login's password has expired.
-            #6  -  Logins to system have been turned off (usually by /etc/nologin file).
-            #7  -  Limit on number of bad logins exceeded.
-            #50 -  pwauth was not run with real uid SERVER_UID.  If you get this
-            #      this error code, you probably have SERVER_UID set incorrectly
-            #      in pwauth's config.h file.
-            #51 -  pwauth was not given a login & password to check.  The means
-            #      the passing of data from mod_auth_external to pwauth is messed
-            #      up.  Most likely one is trying to pass data via environment
-            #      variables, while the other is trying to pass data via a pipe.
-            #52 -  one of several possible internal errors occured.
-
-
-            $uid = $username;
-	    # TODO: Reinstate this code once passwd is working...
-	    /*
-            $cn = trim(shell_exec('getent passwd '.escapeshellarg($uid).' | cut -d: -f5 | cut -d, -f1'));
-
-            $groups = preg_split('_\\s_', shell_exec('groups '.escapeshellarg($uid)));
-            array_shift($groups);
-            array_shift($groups);
-            array_pop($groups);
-
-            $info = posix_getpwnam($uid);
-            $group = $info['gid'];
-            if (!in_array($group, $groups)) {
-                    $groups[] = $group;
-            }
-	    */
-	    $cn = "Unknown McUnknown";
-	    $groups = array();
-
-            $result = array(
-                    'uid' => array($uid),
-                    'cn' => array($cn),
-                    'group' => $groups,
-            );
-            if (isset($this->mail_domain)) {
-                    $result['mail'] = array($uid.$this->mail_domain);
-            }
-            return $result;
-    }
-}
--- a/hosts/bekkalokk/services/idp-simplesamlphp/config.php
+++ b/hosts/bekkalokk/services/idp-simplesamlphp/config.php
--- a/hosts/bekkalokk/services/idp-simplesamlphp/default.nix
+++ b/hosts/bekkalokk/services/idp-simplesamlphp/default.nix
@ -1,208 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  pwAuthScript = pkgs.writeShellApplication {
-    name = "pwauth";
-    runtimeInputs = with pkgs; [ coreutils heimdal ];
-    text = ''
-      read -r user1
-      user2="$(echo -n "$user1" | tr -c -d '0123456789abcdefghijklmnopqrstuvwxyz')"
-      if test "$user1" != "$user2"
-      then
-        read -r _
-        exit 2
-      fi
-      kinit --password-file=STDIN "''${user1}@PVV.NTNU.NO" >/dev/null 2>/dev/null
-      kdestroy >/dev/null 2>/dev/null
-    '';
-  };
-
-  package = pkgs.simplesamlphp.override {
-    extra_files = {
-      # NOTE: Using self signed certificate created 30. march 2024, with command:
-      # openssl req -newkey rsa:4096 -new -x509 -days 365 -nodes -out idp.crt -keyout idp.pem
-      "metadata/saml20-idp-hosted.php" = pkgs.writeText "saml20-idp-remote.php" ''
-        <?php
-        $metadata['https://idp.pvv.ntnu.no/'] = array(
-          'host' => '__DEFAULT__',
-          'privatekey' => '${config.sops.secrets."idp/privatekey".path}',
-          'certificate' => '${./idp.crt}',
-          'auth' => 'pwauth',
-        );
-        ?>
-      '';
-
-      "metadata/saml20-sp-remote.php" = pkgs.writeText "saml20-sp-remote.php" ''
-        <?php
-          ${ lib.pipe config.services.idp.sp-remote-metadata [
-            (map (url: ''
-              $metadata['${url}'] = [
-                'SingleLogoutService' => [
-                  [
-                    'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
-                    'Location' => '${url}module.php/saml/sp/saml2-logout.php/default-sp',
-                  ],
-                  [
-                    'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP',
-                    'Location' => '${url}module.php/saml/sp/saml2-logout.php/default-sp',
-                  ],
-                ],
-                'AssertionConsumerService' => [
-                  [
-                    'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-                    'Location' => '${url}module.php/saml/sp/saml2-acs.php/default-sp',
-                    'index' => 0,
-                  ],
-                  [
-                    'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact',
-                    'Location' => '${url}module.php/saml/sp/saml2-acs.php/default-sp',
-                    'index' => 1,
-                  ],
-                ],
-              ];
-            ''))
-            (lib.concatStringsSep "\n")
-          ]}
-        ?>
-      '';
-
-      "config/authsources.php" = pkgs.writeText "idp-authsources.php" ''
-        <?php
-          $config = array(
-            'admin' => array(
-              'core:AdminPassword'
-            ),
-            'pwauth' => array(
-              'authpwauth:PwAuth',
-              'pwauth_bin_path' => '${lib.getExe pwAuthScript}',
-              'mail_domain' => '@pvv.ntnu.no',
-            ),
-          );
-        ?>
-      '';
-
-      "config/config.php" = pkgs.runCommandLocal "simplesamlphp-config.php" { } ''
-        cp ${./config.php} "$out"
-
-        substituteInPlace "$out" \
-          --replace-warn '$SAML_COOKIE_SECURE' 'true' \
-          --replace-warn '$SAML_COOKIE_SALT' 'file_get_contents("${config.sops.secrets."idp/cookie_salt".path}")' \
-          --replace-warn '$SAML_ADMIN_NAME' '"Drift"' \
-          --replace-warn '$SAML_ADMIN_EMAIL' '"drift@pvv.ntnu.no"' \
-          --replace-warn '$SAML_ADMIN_PASSWORD' 'file_get_contents("${config.sops.secrets."idp/admin_password".path}")' \
-          --replace-warn '$SAML_TRUSTED_DOMAINS' 'array( "idp.pvv.ntnu.no" )' \
-          --replace-warn '$SAML_DATABASE_DSN' '"pgsql:host=postgres.pvv.ntnu.no;port=5432;dbname=idp"' \
-          --replace-warn '$SAML_DATABASE_USERNAME' '"idp"' \
-          --replace-warn '$SAML_DATABASE_PASSWORD' 'file_get_contents("${config.sops.secrets."idp/postgres_password".path}")' \
-          --replace-warn '$CACHE_DIRECTORY' '/var/cache/idp'
-      '';
-
-      "modules/authpwauth/src/Auth/Source/PwAuth.php" = ./authpwauth.php;
-    };
-  };
-in
-{
-  options.services.idp.sp-remote-metadata = lib.mkOption {
-    type = with lib.types; listOf str;
-    default = [ ];
-    description = ''
-      List of urls point to (simplesamlphp) service profiders, which the idp should trust.
-
-      :::{.note}
-      Make sure the url ends with a `/`
-      :::
-    '';
-  };
-
-  config = {
-    sops.secrets = {
-      "idp/privatekey" = {
-        owner = "idp";
-        group = "idp";
-        mode = "0770";
-      };
-      "idp/admin_password" = {
-        owner = "idp";
-        group = "idp";
-      };
-      "idp/postgres_password" = {
-        owner = "idp";
-        group = "idp";
-      };
-      "idp/cookie_salt" = {
-        owner = "idp";
-        group = "idp";
-      };
-    };
-
-    users.groups."idp" = { };
-    users.users."idp" = {
-      description = "PVV Identity Provider Service User";
-      group = "idp";
-      createHome = false;
-      isSystemUser = true;
-    };
-
-    systemd.tmpfiles.settings."10-idp" = {
-      "/var/cache/idp".d = {
-        user = "idp";
-        group = "idp";
-        mode = "0770";
-      };
-      "/var/lib/idp".d = {
-        user = "idp";
-        group = "idp";
-        mode = "0770";
-      };
-    };
-
-    services.phpfpm.pools.idp = {
-      user = "idp";
-      group = "idp";
-      settings = let
-        listenUser = config.services.nginx.user;
-        listenGroup = config.services.nginx.group;
-      in {
-        "pm" = "dynamic";
-        "pm.max_children" = 32;
-        "pm.max_requests" = 500;
-        "pm.start_servers" = 2;
-        "pm.min_spare_servers" = 2;
-        "pm.max_spare_servers" = 4;
-        "listen.owner" = listenUser;
-        "listen.group" = listenGroup;
-
-        "catch_workers_output" = true;
-        "php_admin_flag[log_errors]" = true;
-        # "php_admin_value[error_log]" = "stderr";
-      };
-    };
-
-    services.nginx.virtualHosts."idp.pvv.ntnu.no" = {
-      forceSSL = true;
-      enableACME = true;
-      kTLS = true;
-      root = "${package}/share/php/simplesamlphp/public";
-      locations =  {
-        # based on https://simplesamlphp.org/docs/stable/simplesamlphp-install.html#configuring-nginx
-        "/" = {
-          alias = "${package}/share/php/simplesamlphp/public/";
-          index = "index.php";
-
-          extraConfig = ''
-            location ~ ^/(?<phpfile>.+?\.php)(?<pathinfo>/.*)?$ {
-              include ${pkgs.nginx}/conf/fastcgi_params;
-              fastcgi_pass unix:${config.services.phpfpm.pools.idp.socket};
-              fastcgi_param SCRIPT_FILENAME ${package}/share/php/simplesamlphp/public/$phpfile;
-              fastcgi_param SCRIPT_NAME /$phpfile;
-              fastcgi_param PATH_INFO $pathinfo if_not_empty;
-            }
-          '';
-        };
-        "^~ /simplesaml/".extraConfig = ''
-          rewrite ^/simplesaml/(.*)$ /$1 redirect;
-          return 404;
-        '';
-      };
-    };
-  };
-}
--- a/hosts/bekkalokk/services/idp-simplesamlphp/idp.crt
+++ b/hosts/bekkalokk/services/idp-simplesamlphp/idp.crt
@ -1,33 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIFqTCCA5GgAwIBAgIUL2+PMM9rE9wI5W2yNnJ2CmfGxh0wDQYJKoZIhvcNAQEL
-BQAwZDELMAkGA1UEBhMCTk8xEzARBgNVBAgMClNvbWUtU3RhdGUxHjAcBgNVBAoM
-FVByb2dyYW12YXJldmVya3N0ZWRldDEgMB4GCSqGSIb3DQEJARYRZHJpZnRAcHZ2
-Lm50bnUubm8wHhcNMjQwMzMwMDAyNjQ0WhcNMjUwMzMwMDAyNjQ0WjBkMQswCQYD
-VQQGEwJOTzETMBEGA1UECAwKU29tZS1TdGF0ZTEeMBwGA1UECgwVUHJvZ3JhbXZh
-cmV2ZXJrc3RlZGV0MSAwHgYJKoZIhvcNAQkBFhFkcmlmdEBwdnYubnRudS5ubzCC
-AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAL/0l0jdV+PoVxdd21F+2NLm
-JN6sZmSJexOSk/sFjhhF4WMtjOfDAQYjt3hlLPyYl//jCe9WteavvtdCx1tHJitd
-xjOUJ/leVjHzBttCVZR+iTlQtpsZ2TbRMJ5Fcfl82njlPecV4umJvnnFXawE4Qee
-dE2OM8ODjjrK1cNaHR74tyZCwmdOxNHXZ7RN22p9kZjLD18LQyNr5igaDBeaZkyk
-Gxbg4tbP51x9JFRLF7kUlyAc83geFnw6v/wBahr49m/X4y7xE0rdPb2L0moUjmOO
-Zyl3hvxMI3+g/0FVMM5eKmfIIP2rIVEAa6MWMx0vPjC6h2fIyxkUqg5C8aFlpqav
-+8f2rUc+JfdiFsIZNrylBXsleGzS+/wY1uB/pAy5Vg9WCp+eC75EtWMt0k2f442G
-rhKa3lAZ6GIYrtEiQiNGM1aT1Cs1nqTtslfnHiuAKBefLjCXgq9uvL2yRodwe9/m
-oZiqYnLHy/v1xfnF5rKTcRmOleU3tc+nlN6tZSGC1nZgMpqpoqdcbJXAkvaJ2Km4
-sl0YS28VQnztgzuVPNdnv8lcS6HmkaGaNWbepKgWeaH5oT7O6u99wZIv88m+tf5m
-Eu197YVpcclnojQCYKauWcQFsXS20egsVP87Qk0e2SHmGTUQp6YEYX6RLjkg7/vS
-BelDBbCldraNVEiC0jmpAgMBAAGjUzBRMB0GA1UdDgQWBBSL0yofG5NEmzFIRuqC
-xmyiuZW6DTAfBgNVHSMEGDAWgBSL0yofG5NEmzFIRuqCxmyiuZW6DTAPBgNVHRMB
-Af8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4ICAQAZZVs7BLk/NLq3f4Ik8qH3IoDN
-2m4XXRZS+xxw5RwctgSnik7AffgAfv8QQm2co8UYkHbB0whaG1PDz+L7wB1hVkWn
-DVUaJcKQnn0x+sNU5LoTbjI0PlaST7PO5D0OMFab8FSNxpzzpbUcgZUhelc99Ri/
-2Gh8mf4b3Y3Uzq6YKFsuFM65OuJhH8f1w6onai9x28t6tERHUSUfJ2keXzU4ytCV
-EitWXwhe759VLqmdP4BATwlCOCuwa5aDeGcWRIqFpYIn0SOAmVV3o4V71JdZc1jE
-fuOo/PbiHZ+R9ZGbh98aMidb0moL1ZDhmir9KbedezNyki6JJ72mVclhLqUajFxr
-T39FXd5e2+QBMHPPhVFznQoHWnHEbZigTt61b0cg/TsxaxOkF4Ilmr/2DmSWysWK
-TF5eq8hp6/53qVbXXSzrCjxd3wzGnRabsEVPX/L2hYDx81hluovJQCtskqTq1joI
-W2R7AO5Sdyc6NfOR85kl0HXzHa+0Slsf8ZDs5nCz/mOOPoAGl7IxF7xQ6kPO7V+U
-HdGE2tkblM/TrAObJH0HXySeJGI7Vfya+D1Y8IqGtyZtWyx1DmlA/OezGGf5D3rG
-88LywHQQ2mQ+8aosBTE4+HQ+apLKZBprqQKuiDjT1RSUbfUHQkYuL+D1oIVmklAc
-UxTpf01QJnZkMqf5NQ==
-----END CERTIFICATE-----
--- a/hosts/bekkalokk/services/idp-simplesamlphp/metadata.php.nix
+++ b/hosts/bekkalokk/services/idp-simplesamlphp/metadata.php.nix
@ -1,22 +0,0 @@
-''
-  <?php
-  $metadata['https://idp.pvv.ntnu.no/'] = [
-      'metadata-set' => 'saml20-idp-hosted',
-      'entityid' => 'https://idp.pvv.ntnu.no/',
-      'SingleSignOnService' => [
-          [
-              'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
-              'Location' => 'https://idp.pvv.ntnu.no/module.php/saml/idp/singleSignOnService',
-          ],
-      ],
-      'SingleLogoutService' => [
-          [
-              'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
-              'Location' => 'https://idp.pvv.ntnu.no/module.php/saml/idp/singleLogout',
-          ],
-      ],
-      'NameIDFormat' => [ 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' ],
-      'certificate' => '${./idp.crt}',
-  ];
-  ?>
-''
--- a/hosts/bekkalokk/services/keycloak.nix
+++ b/hosts/bekkalokk/services/keycloak.nix
@ -0,0 +1,24 @@
+{ pkgs, config, values, ... }:
+{
+  sops.secrets."keys/postgres/keycloak" = {
+    owner = "keycloak";
+    group = "keycloak";
+    restartUnits = [ "keycloak.service" ];
+  };
+
+  services.keycloak = {
+    enable = true;
+
+    settings = {
+      hostname = "auth.pvv.ntnu.no";
+      # hostname-strict-backchannel = true;
+    };
+
+    database = {
+      host = values.hosts.bicep.ipv4;
+      createLocally = false;
+      passwordFile = config.sops.secrets."keys/postgres/keycloak".path;
+      caCert = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+    };
+  };
+}
--- a/hosts/bekkalokk/services/mediawiki.nix
+++ b/hosts/bekkalokk/services/mediawiki.nix
@ -0,0 +1,175 @@
+{ pkgs, lib, config, values, ... }: let
+  cfg = config.services.mediawiki;
+
+  # "mediawiki"
+  user = config.systemd.services.mediawiki-init.serviceConfig.User;
+
+  # "mediawiki"
+  group = config.users.users.${user}.group;
+in {
+  sops.secrets = {
+    "mediawiki/password" = {
+      restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
+      owner = user;
+      group = group;
+    };
+    "keys/postgres/mediawiki" = {
+      restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
+      owner = user;
+      group = group;
+    };
+  };
+
+  services.mediawiki = {
+    enable = true;
+    name = "Programvareverkstedet";
+    passwordFile = config.sops.secrets."mediawiki/password".path;
+    passwordSender = "drift@pvv.ntnu.no";
+
+    database = {
+      type = "postgres";
+      host = "postgres.pvv.ntnu.no";
+      port = config.services.postgresql.port;
+      passwordFile = config.sops.secrets."keys/postgres/mediawiki".path;
+      createLocally = false;
+      # TODO: create a normal database and copy over old data when the service is production ready
+      name = "mediawiki_test";
+    };
+
+    # Host through nginx
+    webserver = "none";
+    poolConfig = let
+      listenUser = config.services.nginx.user;
+      listenGroup = config.services.nginx.group;
+    in {
+      inherit user group;
+      "pm" = "dynamic";
+      "pm.max_children" = 32;
+      "pm.max_requests" = 500;
+      "pm.start_servers" = 2;
+      "pm.min_spare_servers" = 2;
+      "pm.max_spare_servers" = 4;
+      "listen.owner" = listenUser;
+      "listen.group" = listenGroup;
+      "php_admin_value[error_log]" = "stderr";
+      "php_admin_flag[log_errors]" = "on";
+      "env[PATH]" = lib.makeBinPath [ pkgs.php ];
+      "catch_workers_output" = true;
+      # to accept *.html file
+      "security.limit_extensions" = "";
+    };
+
+    extensions = {
+      DeleteBatch = pkgs.fetchzip {
+        url = "https://extdist.wmflabs.org/dist/extensions/DeleteBatch-REL1_39-995ea6f.tar.gz";
+	sha256 = "sha256-0F4GLCy2f5WcWIY2YgF1tVxgYbglR0VOsj/pMrW93b8=";
+      };
+      UserMerge = pkgs.fetchzip {
+        url = "https://extdist.wmflabs.org/dist/extensions/UserMerge-REL1_39-b10d50e.tar.gz";
+	sha256 = "sha256-bXhj1+OlOUJDbvEuc8iwqb1LLEu6cN6+C/7cAvnWPOQ=";
+      };
+      PluggableAuth = pkgs.fetchzip {
+        url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_39-1210fc3.tar.gz";
+	sha256 = "sha256-F6bTMCzkK3kZwZGIsNE87WlZWqXXmTMhEjApO99YKR0=";
+      };
+      SimpleSAMLphp = pkgs.fetchzip {
+        url = "https://extdist.wmflabs.org/dist/extensions/SimpleSAMLphp-REL1_39-dcf0acb.tar.gz";
+        sha256 = "sha256-tCvFmb2+q2rxms+lRo5pgoI3h6GjCwXAR8XisPg03TQ=";
+      };
+    };
+
+    extraConfig = let
+
+      SimpleSAMLphpRepo = pkgs.stdenvNoCC.mkDerivation rec {
+        pname = "configuredSimpleSAML";
+	version = "2.0.4";
+        src = pkgs.fetchzip {
+          url = "https://github.com/simplesamlphp/simplesamlphp/releases/download/v${version}/simplesamlphp-${version}.tar.gz";
+          sha256 = "sha256-pfMV/VmqqxgtG7Nx4s8MW4tWSaxOkVPtCRJwxV6RDSE=";
+        };
+
+	buildPhase = ''
+          cat > config/authsources.php << EOF
+          <?php
+          $config = array(
+            'default-sp' => array(
+              'saml:SP',
+              'idp' => 'https://idp.pvv.ntnu.no/',
+            ),
+          );
+	  EOF
+	'';
+
+	installPhase = ''
+	  cp -r . $out
+	'';
+      };
+
+    in ''
+      $wgServer = "https://bekkalokk.pvv.ntnu.no";
+      $wgLocaltimezone = "Europe/Oslo";
+
+      # Only allow login through SSO
+      $wgEnableEmail = false;
+      $wgEnableUserEmail = false;
+      $wgEmailAuthentication = false;
+      $wgGroupPermissions['*']['createaccount'] = false;
+      $wgGroupPermissions['*']['autocreateaccount'] = true;
+      $wgPluggableAuth_EnableAutoLogin = true;
+
+      # Disable anonymous editing
+      $wgGroupPermissions['*']['edit'] = false;
+
+      # Styling
+      $wgLogo = "/PNG/PVV-logo.png";
+      $wgDefaultSkin = "monobook";
+
+      # Misc
+      $wgEmergencyContact = "${cfg.passwordSender}";
+      $wgShowIPinHeader = false;
+      $wgUseTeX = false;
+      $wgLocalInterwiki = $wgSitename;
+
+      # SimpleSAML
+      $wgSimpleSAMLphp_InstallDir = "${SimpleSAMLphpRepo}";
+      $wgSimpleSAMLphp_AuthSourceId = "default-sp";
+      $wgSimpleSAMLphp_RealNameAttribute = "cn";
+      $wgSimpleSAMLphp_EmailAttribute = "mail";
+      $wgSimpleSAMLphp_UsernameAttribute = "uid";
+
+      # Fix https://github.com/NixOS/nixpkgs/issues/183097
+      $wgDBserver = "${toString cfg.database.host}";
+    '';
+  };
+
+  # Override because of https://github.com/NixOS/nixpkgs/issues/183097
+  systemd.services.mediawiki-init.script = let
+    # According to module
+    stateDir = "/var/lib/mediawiki";
+    pkg = cfg.finalPackage;
+    mediawikiConfig = config.services.phpfpm.pools.mediawiki.phpEnv.MEDIAWIKI_CONFIG;
+    inherit (lib) optionalString mkForce;
+  in mkForce ''
+    if ! test -e "${stateDir}/secret.key"; then
+      tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c 64 > ${stateDir}/secret.key
+    fi
+
+    echo "exit( wfGetDB( DB_MASTER )->tableExists( 'user' ) ? 1 : 0 );" | \
+    ${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/eval.php --conf ${mediawikiConfig} && \
+    ${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/install.php \
+      --confpath /tmp \
+      --scriptpath / \
+      --dbserver "${cfg.database.host}" \
+      --dbport ${toString cfg.database.port} \
+      --dbname ${cfg.database.name} \
+      ${optionalString (cfg.database.tablePrefix != null) "--dbprefix ${cfg.database.tablePrefix}"} \
+      --dbuser ${cfg.database.user} \
+      ${optionalString (cfg.database.passwordFile != null) "--dbpassfile ${cfg.database.passwordFile}"} \
+      --passfile ${cfg.passwordFile} \
+      --dbtype ${cfg.database.type} \
+      ${cfg.name} \
+      admin
+
+    ${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/update.php --conf ${mediawikiConfig} --quick
+  '';
+}
--- a/hosts/bekkalokk/services/mediawiki/default.nix
+++ b/hosts/bekkalokk/services/mediawiki/default.nix
@ -1,231 +0,0 @@
-{ pkgs, lib, config, values, pkgs-unstable, ... }: let
-  cfg = config.services.mediawiki;
-
-  # "mediawiki"
-  user = config.systemd.services.mediawiki-init.serviceConfig.User;
-
-  # "mediawiki"
-  group = config.users.users.${user}.group;
-
-  simplesamlphp = pkgs.simplesamlphp.override {
-    extra_files = {
-      "metadata/saml20-idp-remote.php" = pkgs.writeText "mediawiki-saml20-idp-remote.php" (import ../idp-simplesamlphp/metadata.php.nix);
-
-      "config/authsources.php" = ./simplesaml-authsources.php;
-
-      "config/config.php" = pkgs.runCommandLocal "mediawiki-simplesamlphp-config.php" { } ''
-        cp ${./simplesaml-config.php} "$out"
-
-        substituteInPlace "$out" \
-          --replace-warn '$SAML_COOKIE_SECURE' 'true' \
-          --replace-warn '$SAML_COOKIE_SALT' 'file_get_contents("${config.sops.secrets."mediawiki/simplesamlphp/cookie_salt".path}")' \
-          --replace-warn '$SAML_ADMIN_NAME' '"Drift"' \
-          --replace-warn '$SAML_ADMIN_EMAIL' '"drift@pvv.ntnu.no"' \
-          --replace-warn '$SAML_ADMIN_PASSWORD' 'file_get_contents("${config.sops.secrets."mediawiki/simplesamlphp/admin_password".path}")' \
-          --replace-warn '$SAML_TRUSTED_DOMAINS' 'array( "wiki.pvv.ntnu.no" )' \
-          --replace-warn '$SAML_DATABASE_DSN' '"pgsql:host=postgres.pvv.ntnu.no;port=5432;dbname=mediawiki_simplesamlphp"' \
-          --replace-warn '$SAML_DATABASE_USERNAME' '"mediawiki_simplesamlphp"' \
-          --replace-warn '$SAML_DATABASE_PASSWORD' 'file_get_contents("${config.sops.secrets."mediawiki/simplesamlphp/postgres_password".path}")' \
-          --replace-warn '$CACHE_DIRECTORY' '/var/cache/mediawiki/idp'
-      '';
-    };
-  };
-in {
-  services.idp.sp-remote-metadata = [ "https://wiki.pvv.ntnu.no/simplesaml/" ];
-
-  sops.secrets = lib.pipe [
-    "mediawiki/password"
-    "mediawiki/postgres_password"
-    "mediawiki/simplesamlphp/postgres_password"
-    "mediawiki/simplesamlphp/cookie_salt"
-    "mediawiki/simplesamlphp/admin_password"
-  ] [
-    (map (key: lib.nameValuePair key {
-      owner = user;
-      group = group;
-      restartUnits = [ "phpfpm-mediawiki.service" ];
-    }))
-    lib.listToAttrs
-  ];
-
-  services.mediawiki = {
-    enable = true;
-    name = "Programvareverkstedet";
-    passwordFile = config.sops.secrets."mediawiki/password".path;
-    passwordSender = "drift@pvv.ntnu.no";
-
-    database = {
-      type = "mysql";
-      host = "mysql.pvv.ntnu.no";
-      port = 3306;
-      user = "mediawiki";
-      passwordFile = config.sops.secrets."mediawiki/postgres_password".path;
-      createLocally = false;
-      # TODO: create a normal database and copy over old data when the service is production ready
-      name = "mediawiki";
-    };
-
-    webserver = "nginx";
-    nginx.hostName = "wiki.pvv.ntnu.no";
-
-    poolConfig = {
-      inherit user group;
-      "pm" = "dynamic";
-      "pm.max_children" = 32;
-      "pm.max_requests" = 500;
-      "pm.start_servers" = 2;
-      "pm.min_spare_servers" = 2;
-      "pm.max_spare_servers" = 4;
-
-      "catch_workers_output" = true;
-      "php_admin_flag[log_errors]" = true;
-      # "php_admin_value[error_log]" = "stderr";
-
-      # to accept *.html file
-      "security.limit_extensions" = "";
-    };
-
-    extensions = {
-      inherit (pkgs.mediawiki-extensions)
-        CodeEditor
-        CodeMirror
-        DeleteBatch
-        PluggableAuth
-        Popups
-        Scribunto
-        SimpleSAMLphp
-        TemplateData
-        TemplateStyles
-        UserMerge
-        VisualEditor
-        WikiEditor
-        ;
-    };
-
-    extraConfig = ''
-      $wgServer = "https://wiki.pvv.ntnu.no";
-      $wgLocaltimezone = "Europe/Oslo";
-
-      # Only allow login through SSO
-      $wgEnableEmail = false;
-      $wgEnableUserEmail = false;
-      $wgEmailAuthentication = false;
-      $wgGroupPermissions['*']['createaccount'] = false;
-      $wgGroupPermissions['*']['autocreateaccount'] = true;
-      $wgPluggableAuth_EnableAutoLogin = false;
-
-      # Misc. permissions
-      $wgGroupPermissions['*']['edit'] = false;
-      $wgGroupPermissions['*']['read'] = true;
-
-      # Allow subdirectories in article URLs
-      $wgNamespacesWithSubpages[NS_MAIN] = true;
-
-      # Styling
-      $wgLogos = array(
-        "2x" => "/PNG/PVV-logo.png",
-        "icon" => "/PNG/PVV-logo.svg",
-      );
-      $wgDefaultSkin = "vector-2022";
-      # from https://github.com/wikimedia/mediawiki-skins-Vector/blob/master/skin.json
-      $wgVectorDefaultSidebarVisibleForAnonymousUser = true;
-      $wgVectorResponsive = true;
-
-      # Misc
-      $wgEmergencyContact = "${cfg.passwordSender}";
-      $wgUseTeX = false;
-      $wgLocalInterwiki = $wgSitename;
-      # Fix https://github.com/NixOS/nixpkgs/issues/183097
-      $wgDBserver = "${toString cfg.database.host}";
-      $wgAllowCopyUploads = true;
-
-      # Misc program paths
-      $wgFFmpegLocation = '${pkgs.ffmpeg}/bin/ffmpeg';
-      $wgExiftool = '${pkgs.exiftool}/bin/exiftool';
-      $wgExiv2Command = '${pkgs.exiv2}/bin/exiv2';
-      # See https://gist.github.com/sergejmueller/088dce028b6dd120a16e
-      $wgJpegTran = '${pkgs.mozjpeg}/bin/jpegtran';
-      $wgGitBin = '${pkgs.git}/bin/git';
-
-      # Debugging
-      $wgShowExceptionDetails = false;
-      $wgShowIPinHeader = false;
-
-      # EXT:{SimpleSAML,PluggableAuth}
-      $wgSimpleSAMLphp_InstallDir = "${simplesamlphp}/share/php/simplesamlphp/";
-      $wgPluggableAuth_Config['Log in using SAML'] = [
-        'plugin' => 'SimpleSAMLphp',
-        'data' => [
-          'authSourceId' => 'default-sp',
-          'usernameAttribute' => 'uid',
-          'emailAttribute' => 'mail',
-          'realNameAttribute' => 'cn',
-        ]
-      ];
-
-      # EXT:Scribunto
-      $wgScribuntoDefaultEngine = 'luastandalone';
-      $wgScribuntoEngineConf['luastandalone']['luaPath'] = '${pkgs.lua}/bin';
-
-      # EXT:WikiEditor
-      $wgWikiEditorRealtimePreview = true;
-    '';
-  };
-
-  # Cache directory for simplesamlphp
-  # systemd.services.phpfpm-mediawiki.serviceConfig.CacheDirectory = "mediawiki/simplesamlphp";
-  systemd.tmpfiles.settings."10-mediawiki"."/var/cache/mediawiki/simplesamlphp".d = {
-    user = "mediawiki";
-    group = "mediawiki";
-    mode = "0770";
-  };
-
-  users.groups.mediawiki.members = [ "nginx" ];
-
-  services.nginx.virtualHosts."wiki.pvv.ntnu.no" = {
-    kTLS = true;
-    forceSSL = true;
-    enableACME = true;
-    locations =  {
-      "= /wiki/Main_Page" = lib.mkForce {
-        return = "301 /wiki/Programvareverkstedet";
-      };
-
-      # based on https://simplesamlphp.org/docs/stable/simplesamlphp-install.html#configuring-nginx
-      "^~ /simplesaml/" = {
-        alias = "${simplesamlphp}/share/php/simplesamlphp/public/";
-        index = "index.php";
-
-        extraConfig = ''
-          location ~ ^/simplesaml/(?<phpfile>.+?\.php)(?<pathinfo>/.*)?$ {
-            include ${pkgs.nginx}/conf/fastcgi_params;
-            fastcgi_pass unix:${config.services.phpfpm.pools.mediawiki.socket};
-            fastcgi_param SCRIPT_FILENAME ${simplesamlphp}/share/php/simplesamlphp/public/$phpfile;
-
-            # Must be prepended with the baseurlpath
-            fastcgi_param SCRIPT_NAME /simplesaml/$phpfile;
-
-            fastcgi_param PATH_INFO $pathinfo if_not_empty;
-          }
-        '';
-      };
-
-      "= /PNG/PVV-logo.svg".alias = ../../../../assets/logo_blue_regular.svg;
-      "= /PNG/PVV-logo.png".alias = ../../../../assets/logo_blue_regular.png;
-      "= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
-        buildInputs = with pkgs; [ imagemagick ];
-      } ''
-        convert \
-          -resize x64 \
-          -gravity center \
-          -crop 64x64+0+0 \
-          ${../../../../assets/logo_blue_regular.png} \
-          -flatten \
-          -colors 256 \
-          -background transparent \
-          $out
-      '';
-    };
-
-  };
-}
--- a/hosts/bekkalokk/services/mediawiki/simplesaml-authsources.php
+++ b/hosts/bekkalokk/services/mediawiki/simplesaml-authsources.php
@ -1,11 +0,0 @@
-<?php
-$config = array(
-    'admin' => array(
-      'core:AdminPassword'
-    ),
-    'default-sp' => array(
-        'saml:SP',
-        'entityID' => 'https://wiki.pvv.ntnu.no/simplesaml/',
-        'idp' => 'https://idp.pvv.ntnu.no/',
-    ),
-);
--- a/hosts/bekkalokk/services/mediawiki/simplesaml-config.php
+++ b/hosts/bekkalokk/services/mediawiki/simplesaml-config.php
--- a/hosts/bekkalokk/services/nginx.nix
+++ b/hosts/bekkalokk/services/nginx.nix
@ -1,4 +0,0 @@
-{ pkgs, config, ... }:
-{
-  services.nginx.enable = true;
-}
--- a/hosts/bekkalokk/services/nginx/default.nix
+++ b/hosts/bekkalokk/services/nginx/default.nix
@ -0,0 +1,22 @@
+{ pkgs, config, ... }:
+{
+  imports = [
+    ./ingress.nix
+  ];
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "drift@pvv.ntnu.no";
+  };
+
+  services.nginx = {
+    enable = true;
+
+    recommendedTlsSettings = true;
+    recommendedProxySettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}
--- a/hosts/bekkalokk/services/nginx/ingress.nix
+++ b/hosts/bekkalokk/services/nginx/ingress.nix
@ -0,0 +1,55 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts = {
+    "www2.pvv.ntnu.no" = {
+      serverAliases = [ "www2.pvv.org" "pvv.ntnu.no" "pvv.org" ];
+      addSSL = true;
+      enableACME = true;
+
+      locations = {
+        # Proxy home directories
+        "/~" = {
+          extraConfig = ''
+            proxy_redirect off;
+            proxy_pass https://tom.pvv.ntnu.no;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+          '';
+        };
+
+        # Redirect old wiki entries
+        "/disk".return = "301 https://www.pvv.ntnu.no/pvv/Diskkjøp";
+        "/dok/boker.php".return = "301 https://www.pvv.ntnu.no/pvv/Bokhyllen";
+        "/styret/lover/".return = "301 https://www.pvv.ntnu.no/pvv/Lover";
+        "/styret/".return = "301 https://www.pvv.ntnu.no/pvv/Styret";
+        "/info/".return = "301 https://www.pvv.ntnu.no/pvv/";
+        "/info/maskinpark/".return = "301 https://www.pvv.ntnu.no/pvv/Maskiner";
+        "/medlemssider/meldinn.php".return = "301 https://www.pvv.ntnu.no/pvv/Medlemskontingent";
+        "/diverse/medlems-sider.php".return = "301 https://www.pvv.ntnu.no/pvv/Medlemssider";
+        "/cert/".return = "301 https://www.pvv.ntnu.no/pvv/CERT";
+        "/drift".return = "301 https://www.pvv.ntnu.no/pvv/Drift";
+        "/diverse/abuse.php".return = "301 https://www.pvv.ntnu.no/pvv/CERT/Abuse";
+        "/nerds/".return = "301 https://www.pvv.ntnu.no/pvv/Nerdepizza";
+
+        # TODO: Redirect webmail
+        "/webmail".return = "301 https://webmail.pvv.ntnu.no/squirrelmail";
+
+        # Redirect everything else to the main website
+        "/".return = "301 https://www.pvv.ntnu.no$request_uri";
+
+        # Proxy the matrix well-known files
+        # Host has be set before proxy_pass
+        # The header must be set so nginx on the other side routes it to the right place
+        "/.well-known/matrix/" = {
+          extraConfig = ''
+            proxy_set_header Host matrix.pvv.ntnu.no;
+            proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
+          '';
+        };
+      };
+    };
+  };
+}
+
--- a/hosts/bekkalokk/services/phpfpm.nix
+++ b/hosts/bekkalokk/services/phpfpm.nix
@ -1,51 +0,0 @@
-{ lib, ... }:
-let
-  pools = map (pool: "phpfpm-${pool}") [
-    "idp"
-    "mediawiki"
-    "pvv-nettsiden"
-    "roundcube"
-    "snappymail"
-  ];
-in
-{
-  # Source: https://www.pierreblazquez.com/2023/06/17/how-to-harden-apache-php-fpm-daemons-using-systemd/
-  systemd.services = lib.genAttrs pools (_: {
-    serviceConfig = let
-      caps = [
-        "CAP_NET_BIND_SERVICE"
-        "CAP_SETGID"
-        "CAP_SETUID"
-        "CAP_CHOWN"
-        "CAP_KILL"
-        "CAP_IPC_LOCK"
-        "CAP_DAC_OVERRIDE"
-      ];
-    in {
-      AmbientCapabilities = caps;
-      CapabilityBoundingSet = caps;
-      DeviceAllow = [ "" ];
-      LockPersonality = true;
-      MemoryDenyWriteExecute = false;
-      NoNewPrivileges = true;
-      PrivateMounts = true;
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      RemoveIPC = true;
-      UMask = "0077";
-      RestrictNamespaces = "~mnt";
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      KeyringMode = "private";
-      SystemCallFilter = [
-        "@system-service"
-      ];
-    };
-  });
-}
--- a/hosts/bekkalokk/services/vaultwarden.nix
+++ b/hosts/bekkalokk/services/vaultwarden.nix
@ -1,104 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.services.vaultwarden;
-  domain = "pw.pvv.ntnu.no";
-  address = "127.0.1.2";
-  port = 3011;
-  wsPort = 3012;
-in {
-  sops.secrets."vaultwarden/environ" = {
-    owner = "vaultwarden";
-    group = "vaultwarden";
-  };
-
-  services.vaultwarden = {
-    enable = true;
-    dbBackend = "postgresql";
-    environmentFile = config.sops.secrets."vaultwarden/environ".path;
-    config = {
-      domain = "https://${domain}";
-
-      rocketAddress = address;
-      rocketPort = port;
-
-      websocketEnabled = true;
-      websocketAddress = address;
-      websocketPort = wsPort;
-
-      signupsAllowed = true;
-      signupsVerify = true;
-      signupsDomainsWhitelist = "pvv.ntnu.no";
-
-      smtpFrom = "vaultwarden@pvv.ntnu.no";
-      smtpFromName = "VaultWarden PVV";
-
-      smtpHost = "smtp.pvv.ntnu.no";
-      smtpUsername = "vaultwarden";
-      smtpSecurity = "force_tls";
-      smtpAuthMechanism = "Login";
-
-      # Configured in environ:
-      # databaseUrl = "postgresql://vaultwarden@/vaultwarden";
-      # smtpPassword = hemli
-    };
-  };
-
-  services.nginx.virtualHosts."${domain}" = {
-    forceSSL = true;
-    enableACME = true;
-    kTLS = true;
-
-    extraConfig = ''
-      client_max_body_size 128M;
-    '';
-
-    locations."/" = {
-      proxyPass = "http://${address}:${toString port}";
-      proxyWebsockets = true;
-    };
-    locations."/notifications/hub" = {
-      proxyPass = "http://${address}:${toString wsPort}";
-      proxyWebsockets = true;
-    };
-    locations."/notifications/hub/negotiate" = {
-      proxyPass = "http://${address}:${toString port}";
-      proxyWebsockets = true;
-    };
-  };
-
-  systemd.services.vaultwarden = lib.mkIf cfg.enable {
-    serviceConfig = {
-      AmbientCapabilities = [ "" ];
-      CapabilityBoundingSet = [ "" ];
-      DeviceAllow = [ "" ];
-      LockPersonality = true;
-      NoNewPrivileges = true;
-      # MemoryDenyWriteExecute = true;
-      PrivateMounts = true;
-      PrivateUsers = true;
-      ProcSubset = "pid";
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-      ];
-      RemoveIPC = true;
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-      ];
-      UMask = "0007";
-    };
-  };
-}
--- a/hosts/bekkalokk/services/webmail/default.nix
+++ b/hosts/bekkalokk/services/webmail/default.nix
@ -2,20 +2,14 @@
 {
  imports = [
    ./roundcube.nix
-    ./snappymail.nix
  ];

-  services.nginx.virtualHosts."webmail.pvv.ntnu.no" = {
+  services.nginx.virtualHosts."webmail2.pvv.ntnu.no" = {
    forceSSL = true;
    enableACME = true;
-    kTLS = true;
-    locations = {
-      "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
-
-      "/afterlogic_lite".return = "302 https://webmail.pvv.ntnu.no/roundcube";
-      "/squirrelmail".return = "302 https://webmail.pvv.ntnu.no/roundcube";
-      "/rainloop".return = "302 https://snappymail.pvv.ntnu.no/";
-      "/snappymail".return = "302 https://snappymail.pvv.ntnu.no/";
+    #locations."/" = lib.mkForce { };
+    locations."= /" = {
+      return = "301 https://www.pvv.ntnu.no/mail/";
    };
  };
 }
--- a/hosts/bekkalokk/services/webmail/roundcube.nix
+++ b/hosts/bekkalokk/services/webmail/roundcube.nix
@ -3,8 +3,8 @@
 with lib;
 let
  cfg = config.services.roundcube;
-  domain = "webmail.pvv.ntnu.no";
-in
+  domain = "webmail2.pvv.ntnu.no";
+in 
 {
  services.roundcube = {
    enable = true;
@ -35,7 +35,6 @@ in
  services.nginx.virtualHosts."roundcubeplaceholder.example.com" = lib.mkForce { };

  services.nginx.virtualHosts.${domain} = {
-    kTLS = true;
    locations."/roundcube" = {
      tryFiles = "$uri $uri/ =404";
      index = "index.php";
--- a/hosts/bekkalokk/services/webmail/snappymail.nix
+++ b/hosts/bekkalokk/services/webmail/snappymail.nix
@ -1,18 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.snappymail;
-in {
-  imports = [ ../../../../modules/snappymail.nix ];
-
-  services.snappymail = {
-    enable = true;
-    hostname = "snappymail.pvv.ntnu.no";
-  };
-
-  services.nginx.virtualHosts.${cfg.hostname} = {
-    forceSSL = true;
-    enableACME = true;
-    kTLS = true;
-  };
-}
-
--- a/hosts/bekkalokk/services/website.nix
+++ b/hosts/bekkalokk/services/website.nix
@ -0,0 +1,4 @@
+{ ... }:
+{
+
+}
--- a/hosts/bekkalokk/services/website/default.nix
+++ b/hosts/bekkalokk/services/website/default.nix
@ -1,131 +0,0 @@
-{ pkgs, lib, config, ... }:
-let
-  format = pkgs.formats.php { };
-  cfg = config.services.pvv-nettsiden;
-in {
-  imports = [
-    ./fetch-gallery.nix
-  ];
-
-  sops.secrets = lib.genAttrs [
-    "nettsiden/door_secret"
-    "nettsiden/mysql_password"
-    "nettsiden/simplesamlphp/admin_password"
-    "nettsiden/simplesamlphp/cookie_salt"
-  ] (_: {
-    owner = config.services.phpfpm.pools.pvv-nettsiden.user;
-    group = config.services.phpfpm.pools.pvv-nettsiden.group;
-    restartUnits = [ "phpfpm-pvv-nettsiden.service" ];
-  });
-
-  services.idp.sp-remote-metadata = [
-    "https://www.pvv.ntnu.no/simplesaml/"
-    "https://pvv.ntnu.no/simplesaml/"
-    "https://www.pvv.org/simplesaml/"
-    "https://pvv.org/simplesaml/"
-  ];
-
-  services.pvv-nettsiden = {
-    enable = true;
-
-    package = pkgs.pvv-nettsiden.override {
-      extra_files = {
-        "${pkgs.pvv-nettsiden.passthru.simplesamlphpPath}/metadata/saml20-idp-remote.php" = pkgs.writeText "pvv-nettsiden-saml20-idp-remote.php" (import ../idp-simplesamlphp/metadata.php.nix);
-        "${pkgs.pvv-nettsiden.passthru.simplesamlphpPath}/config/authsources.php" = pkgs.writeText "pvv-nettsiden-authsources.php" ''
-          <?php
-          $config = array(
-              'admin' => array(
-                'core:AdminPassword'
-              ),
-              'default-sp' => array(
-                  'saml:SP',
-                  'entityID' => 'https://${cfg.domainName}/simplesaml/',
-                  'idp' => 'https://idp.pvv.ntnu.no/',
-              ),
-          );
-        '';
-      };
-    };
-
-    domainName = "www.pvv.ntnu.no";
-
-    settings = let
-      includeFromSops = path: format.lib.mkRaw "file_get_contents('${config.sops.secrets."nettsiden/${path}".path}')";
-    in {
-      DOOR_SECRET = includeFromSops "door_secret";
-
-      DB = {
-        DSN = "mysql:dbname=www-data_nettside;host=mysql.pvv.ntnu.no";
-        USER = "www-data_nettsi";
-        PASS = includeFromSops "mysql_password";
-      };
-
-      # TODO: set up postgres session for simplesamlphp
-      SAML = {
-        COOKIE_SALT = includeFromSops "simplesamlphp/cookie_salt";
-        COOKIE_SECURE = true;
-        ADMIN_NAME = "PVV Drift";
-        ADMIN_EMAIL = "drift@pvv.ntnu.no";
-        ADMIN_PASSWORD = includeFromSops "simplesamlphp/admin_password";
-        TRUSTED_DOMAINS = [ cfg.domainName ];
-      };
-    };
-  };
-
-  services.phpfpm.pools."pvv-nettsiden".settings = {
-    # "php_admin_value[error_log]" = "stderr";
-    "php_admin_flag[log_errors]" = true;
-    "catch_workers_output" = true;
-  };
-
-  services.nginx.virtualHosts.${cfg.domainName} = {
-    serverAliases = [
-      "pvv.ntnu.no"
-      "www.pvv.org"
-      "pvv.org"
-    ];
-
-    locations = {
-      # Proxy home directories
-      "^~ /~" = {
-        extraConfig = ''
-          proxy_redirect off;
-          proxy_pass https://tom.pvv.ntnu.no;
-          proxy_set_header Host $host;
-          proxy_set_header X-Real-IP $remote_addr;
-          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-          proxy_set_header X-Forwarded-Proto $scheme;
-        '';
-      };
-
-      # Redirect the old webmail/wiki paths from spikkjeposche
-      "^~ /webmail".return = "301 https://webmail.pvv.ntnu.no";
-      "~ /pvv/([^\\n\\r]*)".return = "301 https://wiki.pvv.ntnu.no/wiki/$1";
-      "= /pvv".return = "301 https://wiki.pvv.ntnu.no/";
-
-      # Redirect old wiki entries
-      "/disk".return = "301 https://wiki.pvv.ntnu.no/wiki/Diskkjøp";
-      "/dok/boker.php".return = "301 https://wiki.pvv.ntnu.no/wiki/Bokhyllen";
-      "/styret/lover/".return = "301 https://wiki.pvv.ntnu.no/wiki/Lover";
-      "/styret/".return = "301 https://wiki.pvv.ntnu.no/wiki/Styret";
-      "/info/".return = "301 https://wiki.pvv.ntnu.no/wiki/";
-      "/info/maskinpark/".return = "301 https://wiki.pvv.ntnu.no/wiki/Maskiner";
-      "/medlemssider/meldinn.php".return = "301 https://wiki.pvv.ntnu.no/wiki/Medlemskontingent";
-      "/diverse/medlems-sider.php".return = "301 https://wiki.pvv.ntnu.no/wiki/Medlemssider";
-      "/cert/".return = "301 https://wiki.pvv.ntnu.no/wiki/CERT";
-      "/drift".return = "301 https://wiki.pvv.ntnu.no/wiki/Drift";
-      "/diverse/abuse.php".return = "301 https://wiki.pvv.ntnu.no/wiki/CERT/Abuse";
-      "/nerds/".return = "301 https://wiki.pvv.ntnu.no/wiki/Nerdepizza";
-
-      # Proxy the matrix well-known files
-      # Host has be set before proxy_pass
-      # The header must be set so nginx on the other side routes it to the right place
-      "^~ /.well-known/matrix/" = {
-        extraConfig = ''
-          proxy_set_header Host matrix.pvv.ntnu.no;
-          proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
-        '';
-      };
-    };
-  };
-}
--- a/hosts/bekkalokk/services/website/fetch-gallery.nix
+++ b/hosts/bekkalokk/services/website/fetch-gallery.nix
@ -1,67 +0,0 @@
-{ pkgs, lib, config, ... }:
-let
-  galleryDir = config.services.pvv-nettsiden.settings.GALLERY.DIR;
-  transferDir = "${config.services.pvv-nettsiden.settings.GALLERY.DIR}-transfer";
-in {
-  users.users.${config.services.pvv-nettsiden.user} = {
-    useDefaultShell = true;
-
-    # This is pushed from microbel:/var/www/www-gallery/build-gallery.sh
-    openssh.authorizedKeys.keys = [
-    ''command="${pkgs.rrsync}/bin/rrsync -wo ${transferDir}",restrict,no-agent-forwarding,no-port-forwarding,no-pty,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjHhC2dikhWs/gG+m7qP1eSohWzTehn4ToNzDSOImyR gallery-publish''
-    ];
-  };
-
-  systemd.paths.pvv-nettsiden-gallery-update = {
-    wantedBy = [ "multi-user.target" ];
-    pathConfig = {
-      PathChanged = "${transferDir}/gallery.tar.gz";
-      Unit = "pvv-nettsiden-gallery-update.service";
-      MakeDirectory = true;
-    };
-  };
-
-  systemd.services.pvv-nettsiden-gallery-update = {
-    path = with pkgs; [ imagemagick gnutar gzip ];
-
-    script = ''
-      tar ${lib.cli.toGNUCommandLineShell {} {
-        extract = true;
-        file = "${transferDir}/gallery.tar.gz";
-        directory = ".";
-      }}
-
-      # Delete files and directories that exists in the gallery that don't exist in the tarball
-      filesToRemove=$(uniq -u <(sort <(find . -not -path "./.thumbnails*") <(tar -tf ${transferDir}/gallery.tar.gz | sed 's|/$||')))
-      while IFS= read fname; do
-        rm -f "$fname" ||:
-        rm -f ".thumbnails/$fname.png" ||:
-      done <<< "$filesToRemove"
-
-      find . -type d -empty -delete
-
-      mkdir -p .thumbnails
-      images=$(find . -type f -not -path "./.thumbnails*")
-
-      while IFS= read fname; do
-        # Skip this file if an up-to-date thumbnail already exists
-        if [ -f ".thumbnails/$fname.png" ] && \
-          [ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
-        then
-          continue
-        fi
-
-        echo "Creating thumbnail for $fname"
-        mkdir -p $(dirname ".thumbnails/$fname")
-        convert -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
-        touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
-      done <<< "$images"
-    '';
-
-    serviceConfig = {
-      WorkingDirectory = galleryDir;
-      User = config.services.pvv-nettsiden.user;
-      Group = config.services.pvv-nettsiden.group;
-    };
-  };
-}
--- a/hosts/bicep/configuration.nix
+++ b/hosts/bicep/configuration.nix
@ -3,7 +3,7 @@
  imports = [
    ./hardware-configuration.nix

-    ../../base
+    ../../base.nix
    ../../misc/metrics-exporters.nix
    ./services/nginx

@ -12,7 +12,8 @@
    ./services/mysql.nix
    ./services/postgres.nix
    ./services/mysql.nix
-    ./services/calendar-bot.nix
+    # TODO: fix the calendar bot
+    # ./services/calendar-bot.nix

    ./services/matrix
  ];
--- a/hosts/bicep/services/calendar-bot.nix
+++ b/hosts/bicep/services/calendar-bot.nix
@ -2,19 +2,11 @@
 let
  cfg = config.services.pvv-calendar-bot;
 in {
-  sops.secrets = {
-    "calendar-bot/matrix_token" = {
-      sopsFile = ../../../secrets/bicep/bicep.yaml;
-      key = "calendar-bot/matrix_token";
-      owner = cfg.user;
-      group = cfg.group;
-    };
-    "calendar-bot/mysql_password" = {
-      sopsFile = ../../../secrets/bicep/bicep.yaml;
-      key = "calendar-bot/mysql_password";
-      owner = cfg.user;
-      group = cfg.group;
-    };
+  sops.secrets."calendar-bot/matrix_token" = {
+    sopsFile = ../../../secrets/bicep/bicep.yaml;
+    key = "calendar-bot/matrix_token";
+    owner = cfg.user;
+    group = cfg.group;
  };

  services.pvv-calendar-bot = {
@ -26,11 +18,6 @@ in {
        user = "@bot_calendar:pvv.ntnu.no";
        channel = "!gkNLUIhYVpEyLatcRz:pvv.ntnu.no";
      };
-      database = {
-        host = "mysql.pvv.ntnu.no";
-        user = "calendar-bot";
-        passwordFile = config.sops.secrets."calendar-bot/mysql_password".path;
-      };
      secretsFile = config.sops.secrets."calendar-bot/matrix_token".path;
      onCalendar = "*-*-* 09:00:00";
    };
--- a/hosts/bicep/services/matrix/coturn.nix
+++ b/hosts/bicep/services/matrix/coturn.nix
@ -26,7 +26,7 @@

        "turns:turn.pvv.ntnu.no:5349?transport=tcp"
        "turns:turn.pvv.ntnu.no:5349?transport=udp"
-
+        
        "turns:turn.pvv.ntnu.no:3478?transport=udp"
        "turns:turn.pvv.ntnu.no:3478?transport=tcp"
        "turn:turn.pvv.ntnu.no:3478?transport=udp"
@ -69,7 +69,7 @@

    tls-listening-port = 443;
    alt-tls-listening-port = 5349;
-
+ 
    listening-port = 3478;

    min-port = 49000;
@ -116,7 +116,7 @@
      #total-quota=1200
    '';
  };
-
+  
  networking.firewall = {
    interfaces.enp6s0f0 = let
      range = with config.services.coturn; [ {
--- a/hosts/bicep/services/matrix/default.nix
+++ b/hosts/bicep/services/matrix/default.nix
@ -12,6 +12,6 @@
    ./discord.nix
  ];

-
+  

 }
--- a/hosts/bicep/services/matrix/element.nix
+++ b/hosts/bicep/services/matrix/element.nix
@ -5,7 +5,6 @@ in {
  services.nginx.virtualHosts."chat.pvv.ntnu.no" = {
    enableACME = true;
    forceSSL = true;
-    kTLS = true;

    root = pkgs.element-web.override {
      conf = {
@ -25,26 +24,21 @@ in {
        features = {
          feature_latex_maths = true;
          feature_pinning = true;
-          feature_render_reaction_images = true;
          feature_state_counters = true;
-          # element call group calls
-          feature_group_calls = true;
+          feature_custom_status = false;
        };
        default_theme = "dark";
-        # Servers in this list should provide some sort of valuable scoping
-        # matrix.org is not useful compared to matrixrooms.info,
-        # because it has so many general members, rooms of all topics are on it.
-        # Something matrixrooms.info is already providing.
        room_directory.servers = [
          "pvv.ntnu.no"
-          "matrixrooms.info" # Searches all public room directories
-          "matrix.omegav.no" # Friends
-          "gitter.im" # gitter rooms
-          "mozilla.org" # mozilla and friends
-          "kde.org" # KDE rooms
-          "fosdem.org" # FOSDEM
-          "dodsorf.as" # PVV Member
-          "nani.wtf" # PVV Member
+          "matrix.omegav.no"
+          "matrix.org"
+          "libera.chat"
+          "gitter.im"
+          "mozilla.org"
+          "kde.org"
+          "t2bot.io"
+          "fosdem.org"
+          "dodsorf.as"
        ];
        enable_presence_by_hs_url = {
          "https://matrix.org" = false;
--- a/hosts/bicep/services/matrix/mjolnir.nix
+++ b/hosts/bicep/services/matrix/mjolnir.nix
@ -11,7 +11,7 @@
  services.mjolnir = {
    enable = true;
    pantalaimon.enable = false;
-    homeserverUrl = "https://matrix.pvv.ntnu.no";
+    homeserverUrl = http://127.0.0.1:8008;
    accessTokenFile = config.sops.secrets."matrix/mjolnir/access_token".path;
    managementRoom = "!gsdeCoWjvYRBrzuiRq:pvv.ntnu.no";
    protectedRooms = map (a: "https://matrix.to/#/${a}") [
--- a/hosts/bicep/services/matrix/smtp-authenticator/smtp_auth_provider.py
+++ b/hosts/bicep/services/matrix/smtp-authenticator/smtp_auth_provider.py
@ -7,9 +7,6 @@ from synapse import module_api

 import re

-import logging
-logger = logging.getLogger(__name__)
-
 class SMTPAuthProvider:
    def __init__(self, config: dict, api: module_api):
        self.api = api
@ -46,13 +43,8 @@ class SMTPAuthProvider:

        if result == True:
            userid = self.api.get_qualified_user_id(username)
-
-            userid = await self.api.check_user_exists(userid)
-            if not userid:
-                logger.info(f"user did not exist, registering {username}")
-                userid = await self.api.register_user(username)
-                logger.info(f"registered userid: {userid}")
+            if not self.api.check_user_exists(userid):
+                self.api.register_user(username)
            return (userid, None)
        else:
-            logger.info("returning None")
            return None
--- a/hosts/bicep/services/matrix/synapse.nix
+++ b/hosts/bicep/services/matrix/synapse.nix
@ -134,6 +134,80 @@ in {
        "129.241.0.0/16"
        "2001:700:300::/44"
      ];
+
+      saml2_config = {
+        sp_config.metadata.remote = [
+          { url = "https://idp.pvv.ntnu.no/simplesaml/saml2/idp/metadata.php"; }
+        ];
+
+        description = [ "Matrix Synapse SP" "en" ];
+        name = [ "Matrix Synapse SP" "en" ];
+
+        ui_info = {
+          display_name = [
+            {
+              lang = "en";
+              text = "PVV Matrix login";
+            }
+          ];
+          description = [
+            {
+              lang = "en";
+              text = "Matrix is a modern free and open federated chat protocol";
+            }
+          ];
+          #information_url = [
+          #  {
+          #    lang = "en";
+          #    text = "";
+          #  };
+          #];
+          #privacy_statement_url = [
+          #  {
+          #    lang = "en";
+          #    text = "";
+          #  };
+          #];
+          keywords = [
+            {
+              lang = "en";
+              text = [ "Matrix" "Element" ];
+            }
+          ];
+          #logo = [
+          #  {
+          #    lang = "en";
+          #    text = "";
+          #    width = "";
+          #    height = "";
+          #  }
+          #];
+        };
+
+        organization = {
+          name = "Programvareverkstedet";
+          display_name = [ "Programvareverkstedet" "en" ];
+          url = "https://www.pvv.ntnu.no";
+        };
+        contact_person = [
+          { given_name = "Drift";
+            sur_name = "King";
+            email_adress = [ "drift@pvv.ntnu.no" ];
+            contact_type = "technical";
+          }
+        ];
+
+        user_mapping_provider = {
+          config = {
+            mxid_source_attribute =  "uid"; # What is this supposed to be?
+            mxid_mapping = "hexencode";
+          };
+        };
+
+        #attribute_requirements = [
+        #  {attribute = "userGroup"; value = "medlem";} # Do we have this?
+        #];
+      };
    };
  };

@ -141,12 +215,9 @@ in {


  services.redis.servers."".enable = true;
-
+  
  services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
-  {
-    kTLS = true;
-  }
-  {
+  ({
    locations."/.well-known/matrix/server" = {
      return = ''
        200 '{"m.server": "matrix.pvv.ntnu.no:443"}'
@ -156,47 +227,31 @@ in {
        add_header Access-Control-Allow-Origin *;
      '';
    };
-  }
-  {
-    locations."/_synapse/admin" = {
-      proxyPass = "http://$synapse_backend";
-      extraConfig = ''
-        allow 127.0.0.1;
-        allow ::1;
-        allow ${values.hosts.bicep.ipv4};
-        allow ${values.hosts.bicep.ipv6};
-        deny all;
-      '';
-    };
-  }
-  {
+  })
+  ({
    locations = let
      connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
-      socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString c.port}";
+      socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString (c.port)}";

      metricsPath = w: "/metrics/${w.type}/${toString w.index}";
      proxyPath = w: "http://${socketAddress w}/_synapse/metrics";
    in lib.mapAttrs' (n: v: lib.nameValuePair
-      (metricsPath v) {
+      (metricsPath v) ({
        proxyPass = proxyPath v;
        extraConfig = ''
          allow ${values.hosts.ildkule.ipv4};
          allow ${values.hosts.ildkule.ipv6};
-          allow ${values.hosts.ildkule.ipv4_global};
-          allow ${values.hosts.ildkule.ipv6_global};
          deny all;
        '';
-      })
+      }))
      cfg.workers.instances;
-  }
-  {
+  })
+  ({
    locations."/metrics/master/1" = {
      proxyPass = "http://127.0.0.1:9000/_synapse/metrics";
      extraConfig = ''
        allow ${values.hosts.ildkule.ipv4};
        allow ${values.hosts.ildkule.ipv6};
-        allow ${values.hosts.ildkule.ipv4_global};
-        allow ${values.hosts.ildkule.ipv6_global};
        deny all;
      '';
    };
@ -214,5 +269,5 @@ in {
            labels = { };
          }]) + "/";
    };
-  }];
+  })];
 }
--- a/hosts/bicep/services/mysql.nix
+++ b/hosts/bicep/services/mysql.nix
@ -1,7 +1,4 @@
 { pkgs, lib, config, values, ... }:
-let
-  backupDir = "/var/lib/mysql/backups";
-in
 {
  sops.secrets."mysql/password" = {
    owner = "mysql";
@ -18,12 +15,12 @@ in
      mysqld = {
        # PVV allows a lot of connections at the same time
        max_connect_errors = 10000;
-        bind-address = values.services.mysql.ipv4;
-        skip-networking = 0;
+	bind-address = values.services.mysql.ipv4;
+	skip-networking = 0;

-        # This was needed in order to be able to use all of the old users
-        # during migration from knakelibrak to bicep in Sep. 2023
-        secure_auth = 0;
+	# This was needed in order to be able to use all of the old users
+	# during migration from knakelibrak to bicep in Sep. 2023
+	secure_auth = 0;
      };
    };

@ -39,6 +36,11 @@ in
    }];
  };

+  services.mysqlBackup = {
+    enable = true;
+    location = "/var/lib/mysql/backups";
+  };
+
  networking.firewall.allowedTCPPorts = [ 3306 ];

  systemd.services.mysql.serviceConfig = {
@ -48,58 +50,4 @@ in
      values.ipv6-space
    ];
  };
-
-  # NOTE: instead of having the upstream nixpkgs postgres backup unit trigger
-  #       another unit, it was easier to just make one ourselves
-  systemd.services."backup-mysql" = {
-    description = "Backup MySQL data";
-    requires = [ "mysql.service" ];
-
-    path = [
-      pkgs.coreutils
-      pkgs.rsync
-      pkgs.gzip
-      config.services.mysql.package
-    ];
-
-    script = let
-      rotations = 10;
-      # rsyncTarget = "root@isvegg.pvv.ntnu.no:/mnt/backup1/bicep/mysql";
-      rsyncTarget = "/data/backup/mysql";
-    in ''
-      set -eo pipefail
-
-      mysqldump --all-databases | gzip -c -9 --rsyncable > "${backupDir}/$(date --iso-8601)-dump.sql.gz"
-
-      while [ $(ls -1 "${backupDir}" | wc -l) -gt ${toString rotations} ]; do
-        rm $(find "${backupDir}" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)
-      done
-
-      rsync -avz --delete "${backupDir}" '${rsyncTarget}'
-    '';
-
-    serviceConfig = {
-      Type = "oneshot";
-      User = "mysql";
-      Group = "mysql";
-      UMask = "0077";
-
-      Nice = 19;
-      IOSchedulingClass = "best-effort";
-      IOSchedulingPriority = 7;
-
-      ReadWritePaths = [
-        backupDir
-        "/data/backup/mysql" # NOTE: should not be part of this option once rsyncTarget is remote
-      ];
-    };
-
-    startAt = "*-*-* 02:15:00";
-  };
-
-  systemd.tmpfiles.settings."10-mysql-backup".${backupDir}.d = {
-    user = "mysql";
-    group = "mysql";
-    mode = "700";
-  };
 }
--- a/hosts/bicep/services/nginx/default.nix
+++ b/hosts/bicep/services/nginx/default.nix
@ -1,8 +1,15 @@
 { config, values, ... }:
 {
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "danio@pvv.ntnu.no";
+  };
+
  services.nginx = {
    enable = true;
+
    enableReload = true;
+
    defaultListenAddresses = [
      values.hosts.bicep.ipv4
      "[${values.hosts.bicep.ipv6}]"
@ -11,5 +18,28 @@
      "127.0.0.2"
      "[::1]"
    ];
+
+    appendConfig = ''
+      pcre_jit on;
+      worker_processes 8;
+      worker_rlimit_nofile 8192;
+    '';
+
+    eventsConfig = ''
+      multi_accept on;
+      worker_connections 4096;
+    '';
+
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    recommendedGzipSettings = true;
+    recommendedBrotliSettings = true;
+    recommendedOptimisation = true;
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  systemd.services.nginx.serviceConfig = {
+    LimitNOFILE = 65536;
  };
 }
--- a/hosts/bicep/services/postgres.nix
+++ b/hosts/bicep/services/postgres.nix
@ -1,6 +1,6 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, ... }:
 let
-  backupDir = "/var/lib/postgresql/backups";
+  sslCert = config.security.acme.certs."postgres.pvv.ntnu.no";
 in
 {
  services.postgresql = {
@ -79,71 +79,19 @@ in

  systemd.services.postgresql.serviceConfig = {
    LoadCredential = [
-      "cert:/etc/certs/postgres.crt"
-      "key:/etc/certs/postgres.key"
+      "cert:${sslCert.directory}/cert.pem"
+      "key:${sslCert.directory}/key.pem"
    ];
  };

-  environment.snakeoil-certs."/etc/certs/postgres" = {
-    owner = "postgres";
-    group = "postgres";
-    subject = "/C=NO/O=Programvareverkstedet/CN=postgres.pvv.ntnu.no/emailAddress=drift@pvv.ntnu.no";
-  };
+  users.groups.acme.members = [ "postgres" ];

  networking.firewall.allowedTCPPorts = [ 5432 ];
  networking.firewall.allowedUDPPorts = [ 5432 ];

-  # NOTE: instead of having the upstream nixpkgs postgres backup unit trigger
-  #       another unit, it was easier to just make one ourselves
-  systemd.services."backup-postgresql" = {
-    description = "Backup PostgreSQL data";
-    requires = [ "postgresql.service" ];
-
-    path = [
-      pkgs.coreutils
-      pkgs.rsync
-      pkgs.gzip
-      config.services.postgresql.package
-    ];
-
-    script = let
-      rotations = 10;
-      # rsyncTarget = "root@isvegg.pvv.ntnu.no:/mnt/backup1/bicep/postgresql";
-      rsyncTarget = "/data/backup/postgresql";
-    in ''
-      set -eo pipefail
-
-      pg_dumpall -U postgres | gzip -c -9 --rsyncable > "${backupDir}/$(date --iso-8601)-dump.sql.gz"
-
-      while [ $(ls -1 "${backupDir}" | wc -l) -gt ${toString rotations} ]; do
-        rm $(find "${backupDir}" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)
-      done
-
-      rsync -avz --delete "${backupDir}" '${rsyncTarget}'
-    '';
-
-    serviceConfig = {
-      Type = "oneshot";
-      User = "postgres";
-      Group = "postgres";
-      UMask = "0077";
-
-      Nice = 19;
-      IOSchedulingClass = "best-effort";
-      IOSchedulingPriority = 7;
-
-      ReadWritePaths = [
-        backupDir
-        "/data/backup/postgresql" # NOTE: should not be part of this option once rsyncTarget is remote
-      ];
-    };
-
-    startAt = "*-*-* 01:15:00";
-  };
-
-  systemd.tmpfiles.settings."10-postgresql-backup".${backupDir}.d = {
-    user = "postgres";
-    group = "postgres";
-    mode = "700";
+  services.postgresqlBackup = {
+    enable = true;
+    location = "/var/lib/postgres/backups";
+    backupAll = true;
  };
 }
--- a/hosts/bikkje/configuration.nix
+++ b/hosts/bikkje/configuration.nix
@ -1,44 +0,0 @@
-{ config, pkgs, values, ... }:
-{
-    networking.nat = {
-    enable = true;
-    internalInterfaces = ["ve-+"];
-    externalInterface = "ens3";
-    # Lazy IPv6 connectivity for the container
-    enableIPv6 = true;
-  };
-
-  containers.bikkje = {
-    autoStart = true;
-    config = { config, pkgs, ... }: {
-      #import packages
-      packages = with pkgs; [
-          alpine
-          mutt
-          mutt-ics
-          mutt-wizard
-          weechat
-          weechatScripts.edit
-          hexchat
-          irssi
-          pidgin
-      ];
-
-      networking = {
-        firewall = {
-          enable = true;
-          # Allow SSH and HTTP and ports for email and irc
-          allowedTCPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
-          allowedUDPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
-        };
-        # Use systemd-resolved inside the container
-        # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
-        useHostResolvConf = mkForce false;
-      };
-
-      system.stateVersion = "23.11";
-      services.resolved.enable = true;
-    };
-  };
-
-};
--- a/hosts/bob/configuration.nix
+++ b/hosts/bob/configuration.nix
@ -3,7 +3,7 @@
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      ../../base
+      ../../base.nix
      ../../misc/metrics-exporters.nix
      ./disks.nix

--- a/hosts/brzeczyszczykiewicz/configuration.nix
+++ b/hosts/brzeczyszczykiewicz/configuration.nix
@ -3,7 +3,7 @@
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      ../../base
+      ../../base.nix
      ../../misc/metrics-exporters.nix

      ./services/grzegorz.nix
--- a/hosts/buskerud/bikkje/default.nix
+++ b/hosts/buskerud/bikkje/default.nix
@ -0,0 +1,125 @@
+{ config, pkgs, values, lib, ... }:
+{
+  containers.bikkje = {
+    autoStart = true;
+    interfaces = [ "enp4s0f0" ];
+
+    config = { config, pkgs, ... }: {
+      imports = [
+        ../../../modules/home-areas.nix
+        ./services/kerberos
+      ];
+
+      environment.systemPackages = with pkgs; [
+          zsh
+          bash
+          fish
+          tcsh
+
+          alpine
+          mutt
+          mutt-ics
+          mutt-wizard
+          notmuch
+          mailutils
+          procmail
+
+          irssi
+          weechat
+          weechatScripts.edit
+
+          coreutils-full
+          diffutils
+          findutils
+          ripgrep
+          cvs
+          gawk
+          git
+          gnupg
+          gnused
+          groff
+          less
+          p7zip
+          rcs
+          screen
+          tmux
+          tree
+          unzip
+          zip
+
+          emacs
+          helix
+          joe
+          micro
+          nano
+          neovim
+
+          autossh
+          inetutils
+          lynx
+          mosh
+          rsync
+          w3m
+
+          clang
+          gcc
+          guile
+          lua
+          perl
+          php
+          python3
+          (python3.withPackages (ps: with ps; [
+            numpy
+            sympy
+            scipy
+            requests
+            imageio
+            pillow
+            httpx
+            pycryptodome
+            pandas
+            matplotlib
+          ]))
+          ruby
+          tcl
+      ];
+
+      services.openssh = {
+        enable = true;
+        ports = [ 22 80 443 ];
+        openFirewall = true;
+        extraConfig = ''
+          PubkeyAcceptedAlgorithms=+ssh-rsa
+       '';
+
+        settings = {
+          GatewayPorts = "yes";
+          PermitRootLogin = "yes";
+        };
+      };
+
+      users.motd = builtins.readFile ../../../misc/motd;
+
+      networking = {
+        firewall.enable = true;
+        # Use systemd-resolved inside the container
+        # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
+        useHostResolvConf = lib.mkForce false;
+        hostName = "bikkje";
+      };
+
+      systemd.network.enable = true;
+      systemd.network.networks."30-enp4s0f0" = values.defaultNetworkConfig // {
+        matchConfig.Name = "enp4s0f0";
+        address = with values.hosts.bikkje; [ (ipv4 + "/25") (ipv6 + "/64") ];
+      };
+      
+      system.stateVersion = "23.11";
+      services.resolved.enable = true;
+    };
+  };
+
+  # TODO
+  # - Kerberos Authentication
+  # - Mail Transfer Agent
+}
--- a/hosts/buskerud/bikkje/services/kerberos/default.nix
+++ b/hosts/buskerud/bikkje/services/kerberos/default.nix
@ -1,5 +1,18 @@
 { config, pkgs, lib, ... }:
 {
+  #######################
+  # TODO: remove these once nixos 24.05 gets released
+  #######################
+  imports = [
+    ./krb5.nix
+    ./pam.nix
+  ];
+  disabledModules = [
+    "config/krb5/default.nix"
+    "security/pam.nix"
+  ];
+  #######################
+
  security.krb5 = {
    enable = true;
    settings = {
--- a/hosts/buskerud/bikkje/services/kerberos/krb5-conf-format.nix
+++ b/hosts/buskerud/bikkje/services/kerberos/krb5-conf-format.nix
--- a/hosts/buskerud/bikkje/services/kerberos/krb5.nix
+++ b/hosts/buskerud/bikkje/services/kerberos/krb5.nix
--- a/hosts/buskerud/bikkje/services/kerberos/pam.nix
+++ b/hosts/buskerud/bikkje/services/kerberos/pam.nix
@ -879,15 +879,15 @@ let

  inherit (pkgs) pam_krb5 pam_ccreds;

-  use_ldap = config.users.ldap.enable && config.users.ldap.loginPam;
+  use_ldap = (config.users.ldap.enable && config.users.ldap.loginPam);
  pam_ldap = if config.users.ldap.daemon.enable then pkgs.nss_pam_ldapd else pkgs.pam_ldap;

  # Create a limits.conf(5) file.
  makeLimitsConf = limits:
    pkgs.writeText "limits.conf"
-      (concatMapStrings ({ domain, type, item, value }:
-        "${domain} ${type} ${item} ${toString value}\n")
-        limits);
+       (concatMapStrings ({ domain, type, item, value }:
+         "${domain} ${type} ${item} ${toString value}\n")
+         limits);

  limitsType = with lib.types; listOf (submodule ({ ... }: {
    options = {
@ -935,8 +935,8 @@ let
  }));

  motd = if config.users.motdFile == null
-    then pkgs.writeText "motd" config.users.motd
-    else config.users.motdFile;
+         then pkgs.writeText "motd" config.users.motd
+         else config.users.motdFile;

  makePAMService = name: service:
    { name = "pam.d/${name}";
@ -976,20 +976,20 @@ in
            item   = "maxlogins";
            value  = "4";
          }
-        ];
+       ];

-      description = lib.mdDoc ''
-        Define resource limits that should apply to users or groups.
-        Each item in the list should be an attribute set with a
-        {var}`domain`, {var}`type`,
-        {var}`item`, and {var}`value`
-        attribute.  The syntax and semantics of these attributes
-        must be that described in {manpage}`limits.conf(5)`.
+     description = lib.mdDoc ''
+       Define resource limits that should apply to users or groups.
+       Each item in the list should be an attribute set with a
+       {var}`domain`, {var}`type`,
+       {var}`item`, and {var}`value`
+       attribute.  The syntax and semantics of these attributes
+       must be that described in {manpage}`limits.conf(5)`.

-        Note that these limits do not apply to systemd services,
-        whose limits can be changed via {option}`systemd.extraConfig`
-        instead.
-      '';
+       Note that these limits do not apply to systemd services,
+       whose limits can be changed via {option}`systemd.extraConfig`
+       instead.
+     '';
    };

    security.pam.services = mkOption {
@ -1507,10 +1507,10 @@ in
        runuser = { rootOK = true; unixAuth = false; setEnvironment = false; };

        /* FIXME: should runuser -l start a systemd session? Currently
-            it complains "Cannot create session: Already running in a
-            session". */
+           it complains "Cannot create session: Already running in a
+           session". */
        runuser-l = { rootOK = true; unixAuth = false; };
-      } // optionalAttrs config.security.pam.enableFscrypt {
+      } // optionalAttrs (config.security.pam.enableFscrypt) {
        # Allow fscrypt to verify login passphrase
        fscrypt = {};
      };
--- a/hosts/buskerud/configuration.nix
+++ b/hosts/buskerud/configuration.nix
@ -2,10 +2,10 @@
 {
  imports = [
    ./hardware-configuration.nix
-    ../../base
+    ../../base.nix
    ../../misc/metrics-exporters.nix

-    ./services/libvirt.nix
+    ./bikkje
  ];

  # buskerud does not support efi?
--- a/hosts/buskerud/services/libvirt.nix
+++ b/hosts/buskerud/services/libvirt.nix
@ -1,10 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  virtualisation.libvirtd.enable = true;
-  programs.dconf.enable = true;
-  boot.kernelModules = [ "kvm-intel" ];
-
-  # On a gui-enabled machine, connect with:
-  # $ virt-manager --connect "qemu+ssh://buskerud/system?socket=/var/run/libvirt/libvirt-sock"
-}
-
--- a/hosts/georg/configuration.nix
+++ b/hosts/georg/configuration.nix
@ -3,7 +3,7 @@
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      ../../base
+      ../../base.nix
      ../../misc/metrics-exporters.nix

      ../../modules/grzegorz.nix
--- a/hosts/ildkule/configuration.nix
+++ b/hosts/ildkule/configuration.nix
@ -3,11 +3,11 @@
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      ../../base
+      ../../base.nix
      ../../misc/metrics-exporters.nix

-      ./services/monitoring
      ./services/nginx
+      ./services/metrics
    ];

  sops.defaultSopsFile = ../../secrets/ildkule/ildkule.yaml;
@ -15,37 +15,28 @@
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;

-  boot.loader.grub.device = "/dev/vda";
-  boot.tmp.cleanOnBoot = true;
-  zramSwap.enable = true;
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;

  networking.hostName = "ildkule"; # Define your hostname.

-  # Main connection, using the global/floatig IP, for communications with the world
-  systemd.network.networks."30-ntnu-global" = values.openstackGlobalNetworkConfig // {
-    matchConfig.Name = "ens4";
-
-    # Add the global addresses in addition to the local address learned from DHCP
-    addresses = [
-      { addressConfig.Address = "${values.hosts.ildkule.ipv4_global}/32"; }
-      { addressConfig.Address = "${values.hosts.ildkule.ipv6_global}/128"; }
-    ];
-  };
-
-  # Secondary connection only for use within the university network
-  systemd.network.networks."40-ntnu-internal" = values.openstackLocalNetworkConfig // {
-    matchConfig.Name = "ens3";
-    # Add the ntnu-internal addresses in addition to the local address learned from DHCP
-    addresses = [
-      { addressConfig.Address = "${values.hosts.ildkule.ipv4}/32"; }
-      { addressConfig.Address = "${values.hosts.ildkule.ipv6}/128"; }
-    ];
+  systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
+    matchConfig.Name = "ens18";
+    address = with values.hosts.ildkule; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };

  # List packages installed in system profile
  environment.systemPackages = with pkgs; [
  ];

-  system.stateVersion = "23.11"; # Did you read the comment?
+  # List services that you want to enable:
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "21.11"; # Did you read the comment?

 }
--- a/hosts/ildkule/hardware-configuration.nix
+++ b/hosts/ildkule/hardware-configuration.nix
@ -1,9 +1,37 @@
-{ modulesPath, lib, ... }:
-{
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
-  boot.initrd.kernelModules = [ "nvme" ];
-  fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; };
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:

+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/afe70fe4-681a-4675-8cbd-e5d08cdcf5b5";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/B71A-E5CD";
+      fsType = "vfat";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/ildkule/services/monitoring/dashboards/go-processes.json
+++ b/hosts/ildkule/services/monitoring/dashboards/go-processes.json
--- a/hosts/ildkule/services/monitoring/dashboards/mysql.json
+++ b/hosts/ildkule/services/monitoring/dashboards/mysql.json
--- a/hosts/ildkule/services/monitoring/dashboards/node-exporter-full.json
+++ b/hosts/ildkule/services/monitoring/dashboards/node-exporter-full.json
@ -23187,4 +23187,4 @@
  "uid": "rYdddlPWk",
  "version": 9,
  "weekStart": ""
-}
+}
--- a/hosts/ildkule/services/monitoring/dashboards/postgres.json
+++ b/hosts/ildkule/services/monitoring/dashboards/postgres.json
@ -3164,4 +3164,4 @@
  "title": "PostgreSQL Database",
  "uid": "000000039",
  "version": 1
-}
+}
--- a/hosts/ildkule/services/monitoring/dashboards/synapse.json
+++ b/hosts/ildkule/services/monitoring/dashboards/synapse.json
--- a/hosts/ildkule/services/monitoring/default.nix
+++ b/hosts/ildkule/services/monitoring/default.nix
@ -2,9 +2,8 @@

 {
  imports = [
+    ./prometheus
    ./grafana.nix
    ./loki.nix
-    ./prometheus
-    ./uptime-kuma.nix
  ];
 }
--- a/hosts/ildkule/services/monitoring/grafana.nix
+++ b/hosts/ildkule/services/monitoring/grafana.nix
@ -7,6 +7,7 @@ in {
  in {
    "keys/grafana/secret_key" = { inherit owner group; };
    "keys/grafana/admin_password" = { inherit owner group; };
+    "keys/postgres/grafana" = { inherit owner group; };
  };

  services.grafana = {
@ -17,7 +18,7 @@ in {
      secretFile = path: "$__file{${path}}";
    in {
      server = {
-        domain = "grafana.pvv.ntnu.no";
+        domain = "ildkule.pvv.ntnu.no";
        http_port = 2342;
        http_addr = "127.0.0.1";
      };
@ -26,6 +27,13 @@ in {
        secret_key = secretFile config.sops.secrets."keys/grafana/secret_key".path;
        admin_password = secretFile config.sops.secrets."keys/grafana/admin_password".path;
      };
+
+      database = {
+        type = "postgres";
+        user = "grafana";
+        host = "${values.hosts.bicep.ipv4}:5432";
+        password = secretFile config.sops.secrets."keys/postgres/grafana".path;
+      };
    };

    provision = {
@ -34,13 +42,13 @@ in {
        {
          name = "Ildkule Prometheus";
          type = "prometheus";
-          url = "http://${config.services.prometheus.listenAddress}:${toString config.services.prometheus.port}";
-          isDefault = true;
+          url = ("http://${config.services.prometheus.listenAddress}:${toString config.services.prometheus.port}");
+         isDefault = true;
        }
        {
          name = "Ildkule loki";
          type = "loki";
-          url = "http://${config.services.loki.configuration.server.http_listen_address}:${toString config.services.loki.configuration.server.http_listen_port}";
+          url = ("http://${config.services.loki.configuration.server.http_listen_address}:${toString config.services.loki.configuration.server.http_listen_port}");
        }
      ];
      dashboards.settings.providers = [
@ -56,13 +64,13 @@ in {
          url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
          options.path = dashboards/synapse.json;
        }
-        # TODO: enable once https://github.com/NixOS/nixpkgs/pull/242365 gets merged
-        # {
-        #   name = "MySQL";
-        #   type = "file";
-        #   url = "https://raw.githubusercontent.com/prometheus/mysqld_exporter/main/mysqld-mixin/dashboards/mysql-overview.json";
-        #   options.path = dashboards/mysql.json;
-        # }
+	# TODO: enable once https://github.com/NixOS/nixpkgs/pull/242365 gets merged
+	# {
+	#   name = "MySQL";
+	#   type = "file";
+	#   url = "https://raw.githubusercontent.com/prometheus/mysqld_exporter/main/mysqld-mixin/dashboards/mysql-overview.json";
+	#   options.path = dashboards/mysql.json;
+	# }
        {
          name = "Postgresql";
          type = "file";
@ -83,7 +91,6 @@ in {
  services.nginx.virtualHosts.${cfg.settings.server.domain} = {
    enableACME = true;
    forceSSL = true;
-    kTLS = true;
    locations = {
      "/" = {
        proxyPass = "http://127.0.0.1:${toString cfg.settings.server.http_port}";
--- a/hosts/ildkule/services/monitoring/loki.nix
+++ b/hosts/ildkule/services/monitoring/loki.nix
@ -50,6 +50,7 @@ in {
        boltdb_shipper = {
          active_index_directory = "/var/lib/loki/boltdb-shipper-index";
          cache_location = "/var/lib/loki/boltdb-shipper-cache";
+          shared_store = "filesystem";
          cache_ttl = "24h";
        };
        filesystem = {
@ -58,13 +59,14 @@ in {
      };

      limits_config = {
-        allow_structured_metadata = false;
+        enforce_metric_name = false;
        reject_old_samples = true;
        reject_old_samples_max_age = "72h";
      };

      compactor = {
        working_directory = "/var/lib/loki/compactor";
+        shared_store = "filesystem";
      };

      # ruler = {
--- a/hosts/ildkule/services/monitoring/prometheus/default.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/default.nix
--- a/hosts/ildkule/services/monitoring/prometheus/gogs.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/gogs.nix
--- a/hosts/ildkule/services/monitoring/prometheus/matrix-synapse.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/matrix-synapse.nix
--- a/hosts/ildkule/services/monitoring/prometheus/mysqld.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/mysqld.nix
--- a/hosts/ildkule/services/monitoring/prometheus/node.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/node.nix
--- a/hosts/ildkule/services/monitoring/prometheus/postgres.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/postgres.nix
@ -38,7 +38,7 @@ in {
  };

  systemd.services.prometheus-postgres-exporter-knakelibrak.serviceConfig = let
-    localCfg = config.services.prometheus.exporters.postgres;
+    localCfg = config.services.prometheus.exporters.postgres; 
  in lib.recursiveUpdate config.systemd.services.prometheus-postgres-exporter.serviceConfig {
      EnvironmentFile = config.sops.secrets."keys/postgres/postgres_exporter_knakelibrak_env".path;
      ExecStart = ''
--- a/hosts/ildkule/services/monitoring/prometheus/rules/synapse-v2.rules
+++ b/hosts/ildkule/services/monitoring/prometheus/rules/synapse-v2.rules
--- a/hosts/ildkule/services/monitoring/uptime-kuma.nix
+++ b/hosts/ildkule/services/monitoring/uptime-kuma.nix
@ -1,20 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.services.uptime-kuma;
-  domain = "status.pvv.ntnu.no";
-in {
-  services.uptime-kuma = {
-    enable = true;
-    settings = {
-      PORT = "5059";
-      HOST = "127.0.1.2";
-    };
-  };
-
-  services.nginx.virtualHosts.${domain} = {
-    enableACME = true;
-    forceSSL = true;
-    kTLS = true;
-    locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
-  };
-}
--- a/hosts/ildkule/services/nginx/default.nix
+++ b/hosts/ildkule/services/nginx/default.nix
@ -1,7 +1,29 @@
 { config, values, ... }:
 {
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "drift@pvv.ntnu.no";
+  };
+
  services.nginx = {
    enable = true;
+
    enableReload = true;
+
+    defaultListenAddresses = [
+      values.hosts.ildkule.ipv4
+      "[${values.hosts.ildkule.ipv6}]"
+
+      "127.0.0.1"
+      "127.0.0.2"
+      "[::1]"
+    ];
+
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
 }
--- a/hosts/shark/configuration.nix
+++ b/hosts/shark/configuration.nix
@ -3,7 +3,7 @@
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      ../../base
+      ../../base.nix
      ../../misc/metrics-exporters.nix
    ];

--- a/25
+++ b/25
@ -1,25 +0,0 @@
-export GUM_FILTER_HEIGHT := "15"
-nom := `if command -v nom >/dev/null; then echo nom; else echo nix; fi`
-
-@_default:
-  just "$(gum choose --ordered --header "Pick a recipie..." $(just --summary --unsorted))"
-
-check:
-  nix flake check --keep-going
-
-build-machine machine=`just _a_machine`:
-  {{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel
-
-run-vm machine=`just _a_machine`:
-  nixos-rebuild build-vm --flake .#{{ machine }}
-  QEMU_NET_OPTS="hostfwd=tcp::8080-:80,hostfwd=tcp::8081-:443,hostfwd=tcp::2222-:22" ./result/bin/run-*-vm
-
-@update-inputs:
-  nix eval .#inputs --apply builtins.attrNames --json \
-    | jq '.[]' -r \
-    | gum choose --no-limit --height=15 \
-    | xargs nix flake update --commit-lock-file
-
-
-_a_machine:
-  nix eval .#nixosConfigurations --apply builtins.attrNames --json | jq .[] -r | gum filter
--- a/misc/metrics-exporters.nix
+++ b/misc/metrics-exporters.nix
@ -14,8 +14,6 @@
      "::1"
      values.hosts.ildkule.ipv4
      values.hosts.ildkule.ipv6
-      values.hosts.ildkule.ipv4_global
-      values.hosts.ildkule.ipv6_global
    ];
  };

--- a/misc/motd
+++ b/misc/motd
@ -0,0 +1,16 @@
+		 ███████████  █████   █████ █████   █████
+		░░███░░░░░███░░███   ░░███ ░░███   ░░███
+		 ░███    ░███ ░███    ░███  ░███    ░███
+		 ░██████████  ░███    ░███  ░███    ░███
+		 ░███░░░░░░   ░░███   ███   ░░███   ███
+		 ░███          ░░░█████░     ░░░█████░
+		 █████           ░░███         ░░███
+		░░░░░             ░░░           ░░░
+
+================= EN ==================|================== NB =================
+Welcome to a PVV machine, life is good.|Velkommen til en PVV-maskin,
+                                       |livet er deilig.
+If you are confused, try pvv.ntnu.no or|Hvis du er forvirret prøv pvv.ntnu.no
+our discord server.                    |eller vår discord-server.
+More info at pvv.ntnu.no/kontakt/      |Mer info på pvv.ntnu.no/kontakt/
+===============================================================================
--- a/misc/rust-motd.nix
+++ b/misc/rust-motd.nix
@ -32,7 +32,7 @@
            color = "red";
            command = "hostname | ${pkgs.toilet}/bin/toilet -f mono9";
          };
-
+          
          service_status = {
            Accounts = "accounts-daemon";
            Cron = "cron";
@ -40,16 +40,16 @@
            Matrix = "matrix-synapse";
            sshd = "sshd";
          };
-
+          
          uptime = {
            prefix = "Uptime: ";
          };
-
+          
          # Not relevant for server
          # user_service_status = {
          #   Gpg-agent = "gpg-agent";
          # };
-
+          
          filesystems = let
            inherit (lib.attrsets) attrNames listToAttrs nameValuePair;
            inherit (lib.lists) imap1;
@ -61,7 +61,7 @@
            getName = i: v: if (v.label != null) then v.label else "<? ${toString i}>";
          in
            imap1Attrs' (i: n: v: nameValuePair (getName i v) n) fileSystems;
-
+          
          memory = {
            swap_pos = "beside"; # or "below" or "none"
          };
@ -70,14 +70,14 @@
            inherit (lib.lists) imap1;
            inherit (lib.attrsets) filterAttrs nameValuePair attrValues listToAttrs;
            inherit (config.users) users;
-
+            
            normalUsers = filterAttrs (n: v: v.isNormalUser || n == "root") users;
            userNPVs = imap1 (index: user: nameValuePair user.name index) (attrValues normalUsers);
          in listToAttrs userNPVs;

          last_run = {};
        };
-
+      
        toml = pkgs.formats.toml {};

      in toml.generate "rust-motd.toml" cfg;
--- a/modules/grzegorz.nix
+++ b/modules/grzegorz.nix
@ -24,12 +24,15 @@ in {
  services.grzegorz-webui.hostName = "${config.networking.fqdn}";
  services.grzegorz-webui.apiBase = "http://${toString grg.listenAddr}:${toString grg.listenPort}/api";

+  security.acme.acceptTerms = true;
+  security.acme.defaults.email = "pederbs@pvv.ntnu.no";
+
  services.nginx.enable = true;
+  networking.firewall.allowedTCPPorts = [ 80 443 ];

  services.nginx.virtualHosts."${config.networking.fqdn}" = {
    forceSSL = true;
    enableACME = true;
-    kTLS = true;
    serverAliases = [
      "${config.networking.hostName}.pvv.org"
    ];
--- a/modules/home-areas.nix
+++ b/modules/home-areas.nix
@ -0,0 +1,20 @@
+{ pkgs, lib, ... }:
+{
+  fileSystems = let
+    # See microbel:/etc/exports
+    homeMounts = (lib.listToAttrs (map
+      (l: lib.nameValuePair "/home/pvv/${l}" "homepvv${l}.pvv.ntnu.no:/export/home/pvv/${l}")
+      [ "a" "b" "c" "d"  "h" "i" "j" "k" "l" "m" "z" ]));
+  in { }
+  //
+  (lib.mapAttrs (_: device: {
+    inherit device;
+    fsType = "nfs";
+    options = [
+      "nfsvers=3"
+      "proto=tcp"
+      "nofail"
+      "_netdev"
+    ];
+  }) homeMounts);
+}
--- a/modules/snakeoil-certs.nix
+++ b/modules/snakeoil-certs.nix
@ -1,85 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.environment.snakeoil-certs;
-in
-{
-  options.environment.snakeoil-certs = lib.mkOption {
-    default = { };
-    description = "Self signed certs, which are rotated regularly";
-    type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
-      options = {
-        owner = lib.mkOption {
-          type = lib.types.str;
-          default = "root";
-        };
-        group = lib.mkOption {
-          type = lib.types.str;
-          default = "root";
-        };
-        mode = lib.mkOption {
-          type = lib.types.str;
-          default = "0660";
-        };
-        daysValid = lib.mkOption {
-          type = lib.types.str;
-          default = "90";
-        };
-        extraOpenSSLArgs = lib.mkOption {
-          type = with lib.types; listOf str;
-          default = [ ];
-        };
-        certificate = lib.mkOption {
-          type = lib.types.str;
-          default = "${name}.crt";
-        };
-        certificateKey = lib.mkOption {
-          type = lib.types.str;
-          default = "${name}.key";
-        };
-        subject = lib.mkOption {
-          type = lib.types.str;
-          default = "/C=NO/O=Programvareverkstedet/CN=*.pvv.ntnu.no/emailAddress=drift@pvv.ntnu.no";
-        };
-      };
-    }));
-  };
-
-  config = {
-    systemd.services."generate-snakeoil-certs" = {
-      enable = true;
-      serviceConfig.Type = "oneshot";
-      script = let
-        openssl = lib.getExe pkgs.openssl;
-      in lib.concatMapStringsSep "\n" ({ name, value }: ''
-        mkdir -p $(dirname "${value.certificate}") $(dirname "${value.certificateKey}")
-        if ! ${openssl} x509 -checkend 86400 -noout -in ${value.certificate}
-        then
-          echo "Regenerating '${value.certificate}'"
-          ${openssl} req \
-            -newkey rsa:4096 \
-            -new -x509 \
-            -days "${toString value.daysValid}" \
-            -nodes \
-            -subj "${value.subject}" \
-            -out "${value.certificate}" \
-            -keyout "${value.certificateKey}" \
-            ${lib.escapeShellArgs value.extraOpenSSLArgs}
-        fi
-        chown "${value.owner}:${value.group}" "${value.certificate}"
-        chown "${value.owner}:${value.group}" "${value.certificateKey}"
-        chmod "${value.mode}" "${value.certificate}"
-        chmod "${value.mode}" "${value.certificateKey}"
-
-        echo "\n-----------------\n"
-      '') (lib.attrsToList cfg);
-    };
-    systemd.timers."generate-snakeoil-certs" = {
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnCalendar = "*-*-* 02:00:00";
-        Persistent = true;
-        Unit = "generate-snakeoil-certs.service";
-      };
-    };
-  };
-}
--- a/modules/snappymail.nix
+++ b/modules/snappymail.nix
@ -1,103 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-let
-  inherit (lib) mkDefault mkEnableOption mkForce mkIf mkOption mkPackageOption generators types;
-
-  cfg = config.services.snappymail;
-  maxUploadSize = "256M";
-in {
-  options.services.snappymail = {
-    enable = mkEnableOption "Snappymail";
-
-    package = mkPackageOption pkgs "snappymail" { };
-
-    dataDir = mkOption {
-      type = types.str;
-      default = "/var/lib/snappymail";
-      description = "State directory for snappymail";
-    };
-
-    hostname = mkOption {
-      type = types.nullOr types.str;
-      default = null;
-      example = "mail.example.com";
-      description = "Enable nginx with this hostname, null disables nginx";
-    };
-
-    user = mkOption {
-      type = types.str;
-      default = "snappymail";
-      description = "System user under which snappymail runs";
-    };
-
-    group = mkOption {
-      type = types.str;
-      default = "snappymail";
-      description = "System group under which snappymail runs";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    users.users = mkIf (cfg.user == "snappymail") {
-      snappymail = {
-        description = "Snappymail service";
-        group = cfg.group;
-        home = cfg.dataDir;
-        isSystemUser = true;
-      };
-    };
-
-    users.groups = mkIf (cfg.group == "snappymail") {
-      snappymail = {};
-    };
-
-    services.phpfpm.pools.snappymail = {
-      user = cfg.user;
-      group = cfg.group;
-      phpOptions = generators.toKeyValue {} {
-        upload_max_filesize = maxUploadSize;
-        post_max_size = maxUploadSize;
-        memory_limit = maxUploadSize;
-      };
-
-      settings = {
-        "listen.owner" = config.services.nginx.user;
-        "listen.group" = config.services.nginx.group;
-        "pm" = "ondemand";
-        "pm.max_children" = 32;
-        "pm.process_idle_timeout" = "10s";
-        "pm.max_requests" = 500;
-      };
-    };
-
-    services.nginx = mkIf (cfg.hostname != null) {
-      virtualHosts."${cfg.hostname}" = {
-        locations."/".extraConfig = ''
-          index index.php;
-          autoindex on;
-          autoindex_exact_size off;
-          autoindex_localtime on;
-        '';
-        locations."^~ /data".extraConfig = ''
-          deny all;
-        '';
-        locations."~ \\.php$".extraConfig = ''
-          include ${config.services.nginx.package}/conf/fastcgi_params;
-
-          fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
-          fastcgi_pass unix:${config.services.phpfpm.pools.snappymail.socket};
-        '';
-        extraConfig = ''
-          client_max_body_size ${maxUploadSize};
-        '';
-
-        root = if (cfg.package == pkgs.snappymail) then
-          pkgs.snappymail.override {
-            dataPath = cfg.dataDir;
-          }
-        else cfg.package;
-      };
-    };
-  };
-}
-
--- a/packages/mediawiki-extensions/default.nix
+++ b/packages/mediawiki-extensions/default.nix
@ -1,95 +0,0 @@
-{ pkgs, lib }:
-let
-  kebab-case-name = project-name: lib.pipe project-name [
-    (builtins.replaceStrings
-      lib.upperChars
-      (map (x: "-${x}") lib.lowerChars)
-    )
-    (lib.removePrefix "-")
-  ];
-
-  mw-ext = {
-    name
-  , commit
-  , hash
-  , tracking-branch ? "REL1_41"
-  , kebab-name ? kebab-case-name name
-  , fetchgit ? pkgs.fetchgit
-  }:
-  {
-    ${name} = (fetchgit {
-      name = "mediawiki-${kebab-name}-source";
-      url = "https://gerrit.wikimedia.org/r/mediawiki/extensions/${name}";
-      rev = commit;
-      inherit hash;
-    }).overrideAttrs (_: {
-      passthru = { inherit name kebab-name tracking-branch; };
-    });
-  };
-in
-# NOTE: to add another extension, you can add an mw-ext expression
-#       with an empty (or even wrong) commit and empty hash, and
-#       run the update script
-lib.mergeAttrsList [
-  (mw-ext {
-    name = "CodeEditor";
-    commit = "7d8447035e381d76387e38b92e4d1e2b8d373a01";
-    hash = "sha256-v2AlbP0vZma3qZyEAWGjZ/rLcvOpIMroyc1EixKjlAU=";
-  })
-  (mw-ext {
-    name = "CodeMirror";
-    commit = "a7b4541089f9b88a0b722d9d790e4cf0f13aa328";
-    hash = "sha256-clyzN3v3+J4GjdyhrCsytBrH7VR1tq5yd0rB+32eWCg=";
-  })
-  (mw-ext {
-    name = "DeleteBatch";
-    commit = "cad869fbd95637902673f744581b29e0f3e3f61a";
-    hash = "sha256-M1ek1WdO1/uTjeYlrk3Tz+nlb/fFZH+O0Ok7b10iKak=";
-  })
-  (mw-ext {
-    name = "PluggableAuth";
-    commit = "4111a57c34e25bde579cce5d14ea094021e450c8";
-    hash = "sha256-aPtN8A9gDxLlq2+EloRZBO0DfHtE0E5kbV/adk82jvM=";
-  })
-  (mw-ext {
-    name = "Popups";
-    commit = "f1bcadbd8b868f32ed189feff232c47966c2c49e";
-    hash = "sha256-PQAjq/X4ZYwnnZ6ADCp3uGWMIucJy0ZXxsTTbAyxlSE=";
-  })
-  (mw-ext {
-    name = "Scribunto";
-    commit = "7b99c95f588b06635ee3c487080d6cb04617d4b5";
-    hash = "sha256-pviueRHQAsSlv4AtnUpo2Cjci7CbJ5aM75taEXY+WrI=";
-  })
-  (mw-ext {
-    name = "SimpleSAMLphp";
-    kebab-name = "simple-saml-php";
-    commit = "ecb47191fecd1e0dc4c9d8b90a9118e393d82c23";
-    hash = "sha256-gKu+O49XrAVt6hXdt36Ru7snjsKX6g2CYJ0kk/d+CI8=";
-  })
-  (mw-ext {
-    name = "TemplateData";
-    commit = "1ec66ce80f8a4322138efa56864502d0ee069bad";
-    hash = "sha256-Lv3Lq9dYAtdgWcwelveTuOhkP38MTu0m5kmW8+ltRis=";
-  })
-  (mw-ext {
-    name = "TemplateStyles";
-    commit = "581180e898d6a942e2a65c8f13435a5d50fffa67";
-    hash = "sha256-zW8O0mzG4jYfQoKi2KzsP+8iwRCLnWgH7qfmDE2R+HU=";
-  })
-  (mw-ext {
-    name = "UserMerge";
-    commit = "c17c919bdb9b67bb69f80df43e9ee9d33b1ecf1b";
-    hash = "sha256-+mkzTCo8RVlGoFyfCrSb5YMh4J6Pbi1PZLFu5ps8bWY=";
-  })
-  (mw-ext {
-    name = "VisualEditor";
-    commit = "90bb3d455892e25317029ffd4bda93159e8faac8";
-    hash = "sha256-SZAVELQUKZtwSM6NVlxvIHdFPodko8fhZ/uwB0LCFDA=";
-  })
-  (mw-ext {
-    name = "WikiEditor";
-    commit = "8dba5b13246d7ae09193f87e6273432b3264de5f";
-    hash = "sha256-vF9PBuM+VfOIs/a2X1JcPn6WH4GqP/vUJDFkfXzWyFU=";
-  })
-]
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Felix Albrigtsen	e84318e59b	bikkje: various package additions	2024-06-22 17:35:32 +02:00
jovre	49c06b2abe	bikje: add kerberos auth	2024-03-30 21:15:46 +01:00
Felix Albrigtsen	8b44ddd56d	base: add motd	2024-02-19 15:55:42 +01:00
Felix Albrigtsen	c683a6d4c2	bikkje: mount home directories	2024-02-19 15:48:10 +01:00
Felix Albrigtsen	5e30f30ac2	bikkje: initialize on buskerud	2024-02-18 22:34:00 +01:00