Compare commits
17 Commits
dagali-hei
...
nix-topolo
| Author | SHA1 | Date | |
|---|---|---|---|
| b20119ff8d | |||
| 9ad30e9921 | |||
| 9a81d570bb | |||
c8bf3b7c01
|
|||
|
069da36895
|
|||
|
83f83a91b7
|
|||
|
6372a4111e
|
|||
|
bdfb7384c2
|
|||
|
ace351c0a7
|
|||
|
cd5c2c0e01
|
|||
|
2be9eb16fe
|
|||
|
64bd33a213
|
|||
|
7b5e114944
|
|||
|
ee8965e18c
|
|||
|
7125fd2478
|
|||
|
0c1762619a
|
|||
|
84d1ae13c0
|
@@ -10,6 +10,8 @@
|
||||
|
||||
./services/acme.nix
|
||||
./services/auto-upgrade.nix
|
||||
./services/dbus.nix
|
||||
./services/fwupd.nix
|
||||
./services/irqbalance.nix
|
||||
./services/logrotate.nix
|
||||
./services/nginx.nix
|
||||
@@ -17,9 +19,12 @@
|
||||
./services/postfix.nix
|
||||
./services/smartd.nix
|
||||
./services/thermald.nix
|
||||
./services/userborn.nix
|
||||
./services/userdbd.nix
|
||||
];
|
||||
|
||||
boot.tmp.cleanOnBoot = lib.mkDefault true;
|
||||
boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
|
||||
|
||||
time.timeZone = "Europe/Oslo";
|
||||
|
||||
@@ -47,6 +52,8 @@
|
||||
|
||||
programs.zsh.enable = true;
|
||||
|
||||
security.lockKernelModules = true;
|
||||
security.protectKernelImage = true;
|
||||
security.sudo.execWheelOnly = true;
|
||||
security.sudo.extraConfig = ''
|
||||
Defaults lecture = never
|
||||
|
||||
@@ -3,10 +3,6 @@
|
||||
systemd.network.enable = true;
|
||||
networking.domain = "pvv.ntnu.no";
|
||||
networking.useDHCP = false;
|
||||
# networking.search = [ "pvv.ntnu.no" "pvv.org" ];
|
||||
# networking.nameservers = lib.mkDefault [ "129.241.0.200" "129.241.0.201" ];
|
||||
# networking.tempAddresses = lib.mkDefault "disabled";
|
||||
# networking.defaultGateway = values.hosts.gateway;
|
||||
|
||||
# The rest of the networking configuration is usually sourced from /values.nix
|
||||
|
||||
|
||||
@@ -5,10 +5,10 @@
|
||||
automatic = true;
|
||||
options = "--delete-older-than 2d";
|
||||
};
|
||||
optimise.automatic = true;
|
||||
|
||||
settings = {
|
||||
allow-dirty = true;
|
||||
auto-optimise-store = true;
|
||||
builders-use-substitutes = true;
|
||||
experimental-features = [ "nix-command" "flakes" ];
|
||||
log-lines = 50;
|
||||
|
||||
7
base/services/dbus.nix
Normal file
7
base/services/dbus.nix
Normal file
@@ -0,0 +1,7 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.dbus = {
|
||||
enable = true;
|
||||
implementation = "broker";
|
||||
};
|
||||
}
|
||||
4
base/services/fwupd.nix
Normal file
4
base/services/fwupd.nix
Normal file
@@ -0,0 +1,4 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.fwupd.enable = true;
|
||||
}
|
||||
4
base/services/userborn.nix
Normal file
4
base/services/userborn.nix
Normal file
@@ -0,0 +1,4 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.userborn.enable = true;
|
||||
}
|
||||
4
base/services/userdbd.nix
Normal file
4
base/services/userdbd.nix
Normal file
@@ -0,0 +1,4 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.userdbd.enable = true;
|
||||
}
|
||||
206
flake.lock
generated
206
flake.lock
generated
@@ -1,5 +1,26 @@
|
||||
{
|
||||
"nodes": {
|
||||
"devshell": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nix-topology",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1728330715,
|
||||
"narHash": "sha256-xRJ2nPOXb//u1jaBnDP56M7v5ldavjbtR6lfGqSvcKg=",
|
||||
"owner": "numtide",
|
||||
"repo": "devshell",
|
||||
"rev": "dd6b80932022cea34a019e2bb32f6fa9e494dfef",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "devshell",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"disko": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -7,11 +28,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1740485968,
|
||||
"narHash": "sha256-WK+PZHbfDjLyveXAxpnrfagiFgZWaTJglewBWniTn2Y=",
|
||||
"lastModified": 1741786315,
|
||||
"narHash": "sha256-VT65AE2syHVj6v/DGB496bqBnu1PXrrzwlw07/Zpllc=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "19c1140419c4f1cdf88ad4c1cfb6605597628940",
|
||||
"rev": "0d8c6ad4a43906d14abd5c60e0ffe7b587b213de",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -20,6 +41,40 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1696426674,
|
||||
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"inputs": {
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1726560853,
|
||||
"narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"gergle": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -29,17 +84,40 @@
|
||||
"locked": {
|
||||
"lastModified": 1736621371,
|
||||
"narHash": "sha256-45UIQSQA7R5iU4YWvilo7mQbhY1Liql9bHBvYa3qRI0=",
|
||||
"ref": "refs/heads/main",
|
||||
"ref": "main",
|
||||
"rev": "3729796c1213fe76e568ac28f1df8de4e596950b",
|
||||
"revCount": 20,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
|
||||
}
|
||||
},
|
||||
"gitignore": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nix-topology",
|
||||
"pre-commit-hooks",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1709087332,
|
||||
"narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "gitignore.nix",
|
||||
"rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "hercules-ci",
|
||||
"repo": "gitignore.nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"greg-ng": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -50,13 +128,14 @@
|
||||
"locked": {
|
||||
"lastModified": 1736545379,
|
||||
"narHash": "sha256-PeTTmGumdOX3rd6OKI7QMCrZovCDkrckZbcHr+znxWA=",
|
||||
"ref": "refs/heads/main",
|
||||
"ref": "main",
|
||||
"rev": "74f5316121776db2769385927ec0d0c2cc2b23e4",
|
||||
"revCount": 42,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
|
||||
}
|
||||
@@ -70,7 +149,7 @@
|
||||
"locked": {
|
||||
"lastModified": 1736178795,
|
||||
"narHash": "sha256-mPdi8cgvIDYcgG3FRG7A4BOIMu2Jef96TPMnV00uXlM=",
|
||||
"ref": "refs/heads/master",
|
||||
"ref": "master",
|
||||
"rev": "fde738910de1fd8293535a6382c2f0c2749dd7c1",
|
||||
"revCount": 79,
|
||||
"type": "git",
|
||||
@@ -88,16 +167,16 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1727410897,
|
||||
"narHash": "sha256-tWsyxvf421ieWUJYgjV7m1eTdr2ZkO3vId7vmtvfFpQ=",
|
||||
"lastModified": 1735857245,
|
||||
"narHash": "sha256-AKLLPrgXTxgzll3DqVUMa4QlPlRN3QceutgFBmEf8Nk=",
|
||||
"owner": "dali99",
|
||||
"repo": "nixos-matrix-modules",
|
||||
"rev": "ff787d410cba17882cd7b6e2e22cc88d4064193c",
|
||||
"rev": "da9dc0479ffe22362793c87dc089035facf6ec4d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "dali99",
|
||||
"ref": "v0.6.1",
|
||||
"ref": "0.7.0",
|
||||
"repo": "nixos-matrix-modules",
|
||||
"type": "github"
|
||||
}
|
||||
@@ -106,15 +185,15 @@
|
||||
"locked": {
|
||||
"lastModified": 1725277886,
|
||||
"narHash": "sha256-Fw4VbbE3EfypQWSgPDFfvVH47BHeg3ptsO715NlUM8Q=",
|
||||
"ref": "refs/heads/master",
|
||||
"ref": "master",
|
||||
"rev": "1b4087bd3322a2e2ba84271c8fcc013e6b641a58",
|
||||
"revCount": 2,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Drift/minecraft-data.git"
|
||||
"url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
|
||||
},
|
||||
"original": {
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Drift/minecraft-data.git"
|
||||
"url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
|
||||
}
|
||||
},
|
||||
"nix-gitea-themes": {
|
||||
@@ -126,24 +205,48 @@
|
||||
"locked": {
|
||||
"lastModified": 1736531400,
|
||||
"narHash": "sha256-+X/HVI1AwoPcud28wI35XRrc1kDgkYdDUGABJBAkxDI=",
|
||||
"ref": "refs/heads/main",
|
||||
"ref": "main",
|
||||
"rev": "e4dafd06b3d7e9e6e07617766e9c3743134571b7",
|
||||
"revCount": 7,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
|
||||
}
|
||||
},
|
||||
"nix-topology": {
|
||||
"inputs": {
|
||||
"devshell": "devshell",
|
||||
"flake-utils": "flake-utils",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"pre-commit-hooks": "pre-commit-hooks"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1738246091,
|
||||
"narHash": "sha256-2+KkZsRO+XlOFbXbRgMZbRtlqn5MBNYj4HNmZ/2Tojg=",
|
||||
"owner": "oddlama",
|
||||
"repo": "nix-topology",
|
||||
"rev": "5526269fa3eedf4f4bc00c0bf7a03db31d24b029",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "oddlama",
|
||||
"repo": "nix-topology",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1740782485,
|
||||
"narHash": "sha256-GkDJDqHYlPKZFdyxzZHtljxNRsosKB1GCrblqlvLFgo=",
|
||||
"lastModified": 1741969460,
|
||||
"narHash": "sha256-SCNxTTBfMJV7XuTcLUfdAd6cgCGsazzi+DoPrceQrZ0=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "dd5c2540983641bbaabdfc665931592d4c9989e8",
|
||||
"rev": "68612419aa6c9fd5b178b81e6fabbdf46d300ea4",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -155,11 +258,11 @@
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1740848276,
|
||||
"narHash": "sha256-bYeI3FEs824X+MJYksKboNlmglehzplqzn+XvcojWMc=",
|
||||
"lastModified": 1742051767,
|
||||
"narHash": "sha256-JpyjnalnIqJ7cvP8HzaoJN9/i2bDx83dToodHHjGuNg=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "e9b0ff70ddc61c42548501b0fafb86bb49cca858",
|
||||
"rev": "ec886d10b507760c90ed01e2eac7f0679d0a47ae",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -169,6 +272,33 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"pre-commit-hooks": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
"gitignore": "gitignore",
|
||||
"nixpkgs": [
|
||||
"nix-topology",
|
||||
"nixpkgs"
|
||||
],
|
||||
"nixpkgs-stable": [
|
||||
"nix-topology",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1730797577,
|
||||
"narHash": "sha256-SrID5yVpyUfknUTGWgYkTyvdr9J1LxUym4om3SVGPkg=",
|
||||
"owner": "cachix",
|
||||
"repo": "pre-commit-hooks.nix",
|
||||
"rev": "1864030ed24a2b8b4e4d386a5eeaf0c5369e50a9",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "cachix",
|
||||
"repo": "pre-commit-hooks.nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"pvv-calendar-bot": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -178,13 +308,14 @@
|
||||
"locked": {
|
||||
"lastModified": 1723850344,
|
||||
"narHash": "sha256-aT37O9l9eclWEnqxASVNBL1dKwDHZUOqdbA4VO9DJvw=",
|
||||
"ref": "refs/heads/main",
|
||||
"ref": "main",
|
||||
"rev": "38b66677ab8c01aee10cd59e745af9ce3ea88092",
|
||||
"revCount": 19,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
|
||||
}
|
||||
@@ -196,15 +327,16 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1737151758,
|
||||
"narHash": "sha256-yZBsefIarFUEhFRj+rCGMp9Zvag3MCafqV/JfGVRVwc=",
|
||||
"ref": "refs/heads/master",
|
||||
"rev": "a4ebe6ded0c8c124561a41cb329ff30891914b5e",
|
||||
"revCount": 475,
|
||||
"lastModified": 1741738148,
|
||||
"narHash": "sha256-cJo6nbcJEOjkazkZ194NDnlsZe0W0wpxeUh2/886uC8=",
|
||||
"ref": "main",
|
||||
"rev": "c1802e7cf27c7cf8b4890354c982a4eef5b11593",
|
||||
"revCount": 486,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
||||
}
|
||||
@@ -218,6 +350,7 @@
|
||||
"matrix-next": "matrix-next",
|
||||
"minecraft-data": "minecraft-data",
|
||||
"nix-gitea-themes": "nix-gitea-themes",
|
||||
"nix-topology": "nix-topology",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||
"pvv-calendar-bot": "pvv-calendar-bot",
|
||||
@@ -253,11 +386,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1739262228,
|
||||
"narHash": "sha256-7JAGezJ0Dn5qIyA2+T4Dt/xQgAbhCglh6lzCekTVMeU=",
|
||||
"lastModified": 1741861888,
|
||||
"narHash": "sha256-ynOgXAyToeE1UdLNfrUn/hL7MN0OpIS2BtNdLjpjPf0=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "07af005bb7d60c7f118d9d9f5530485da5d1e975",
|
||||
"rev": "d016ce0365b87d848a57c12ffcfdc71da7a2b55f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -265,6 +398,21 @@
|
||||
"repo": "sops-nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
|
||||
34
flake.nix
34
flake.nix
@@ -11,26 +11,29 @@
|
||||
disko.url = "github:nix-community/disko";
|
||||
disko.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
pvv-nettsiden.url = "git+https://git.pvv.ntnu.no/Projects/nettsiden.git";
|
||||
nix-topology.url = "github:oddlama/nix-topology";
|
||||
nix-topology.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
pvv-nettsiden.url = "git+https://git.pvv.ntnu.no/Projects/nettsiden.git?ref=main";
|
||||
pvv-nettsiden.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
|
||||
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git?ref=main";
|
||||
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
matrix-next.url = "github:dali99/nixos-matrix-modules/v0.6.1";
|
||||
matrix-next.url = "github:dali99/nixos-matrix-modules/0.7.0";
|
||||
matrix-next.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git";
|
||||
nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git?ref=main";
|
||||
nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git";
|
||||
greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";
|
||||
greg-ng.inputs.nixpkgs.follows = "nixpkgs";
|
||||
gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git";
|
||||
gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git?ref=main";
|
||||
gergle.inputs.nixpkgs.follows = "nixpkgs";
|
||||
grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git";
|
||||
grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
minecraft-data.url = "git+https://git.pvv.ntnu.no/Drift/minecraft-data.git";
|
||||
minecraft-data.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git";
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
|
||||
@@ -67,6 +70,7 @@
|
||||
modules = [
|
||||
./hosts/${name}/configuration.nix
|
||||
sops-nix.nixosModules.sops
|
||||
inputs.nix-topology.nixosModules.default
|
||||
] ++ config.modules or [];
|
||||
|
||||
pkgs = import nixpkgs {
|
||||
@@ -145,13 +149,12 @@
|
||||
inputs.gergle.overlays.default
|
||||
];
|
||||
};
|
||||
|
||||
dagali = unstableNixosConfig "dagali" { };
|
||||
};
|
||||
|
||||
nixosModules = {
|
||||
snakeoil-certs = ./modules/snakeoil-certs.nix;
|
||||
snappymail = ./modules/snappymail.nix;
|
||||
robots-txt = ./modules/robots-txt.nix;
|
||||
};
|
||||
|
||||
devShells = forAllSystems (system: {
|
||||
@@ -179,5 +182,18 @@
|
||||
// lib.genAttrs allMachines
|
||||
(machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
|
||||
};
|
||||
|
||||
topology.x86_64-linux = import inputs.nix-topology {
|
||||
pkgs = import nixpkgs {
|
||||
system = "x86_64-linux";
|
||||
overlays = [inputs.nix-topology.overlays.default];
|
||||
}; # Only this package set must include nix-topology.overlays.default
|
||||
modules = [
|
||||
# Your own file to define global topology. Works in principle like a nixos module but uses different options.
|
||||
./topology.nix
|
||||
# Inline module to inform topology of your existing NixOS hosts.
|
||||
{ nixosConfigurations = self.nixosConfigurations; }
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, values, lib, ... }:
|
||||
{ config, values, lib, unstablePkgs, ... }:
|
||||
let
|
||||
cfg = config.services.gitea;
|
||||
domain = "git.pvv.ntnu.no";
|
||||
@@ -26,6 +26,8 @@ in {
|
||||
enable = true;
|
||||
appName = "PVV Git";
|
||||
|
||||
package = unstablePkgs.gitea;
|
||||
|
||||
database = {
|
||||
type = "postgres";
|
||||
host = "postgres.pvv.ntnu.no";
|
||||
|
||||
@@ -1,78 +0,0 @@
|
||||
# Tracking document for new PVV kerberos auth stack
|
||||
|
||||
|
||||
|
||||
<div align="center">
|
||||
Bensinstasjon på heimdal
|
||||
</div>
|
||||
|
||||
### TODO:
|
||||
|
||||
- [ ] setup heimdal
|
||||
- [x] ensure running with systemd
|
||||
- [x] compile smbk5pwd (part of openldap)
|
||||
- [ ] set `modify -a -disallow-all-tix,requires-pre-auth default` declaratively
|
||||
- [ ] fully initialize PVV.NTNU.NO
|
||||
- [x] `kadmin -l init PVV.NTNU.NO`
|
||||
- [x] add oysteikt/admin@PVV.NTNU.NO principal
|
||||
- [x] add oysteikt@PVV.NTNU.NO principal
|
||||
- [x] add krbtgt/PVV.NTNU.NO@PVV.NTNU.NO principal?
|
||||
- why is this needed, and where is it documented?
|
||||
- `kadmin check` seems to work under sudo?
|
||||
- (it is included by default, just included as error message
|
||||
in a weird state)
|
||||
|
||||
- [x] Ensure client is working correctly
|
||||
- [x] Ensure kinit works on darbu
|
||||
- [x] Ensure kpasswd works on darbu
|
||||
- [x] Ensure kadmin get <user> (and other restricted commands) works on darbu
|
||||
|
||||
- [ ] Ensure kdc is working correctly
|
||||
- [x] Ensure kinit works on dagali
|
||||
- [x] Ensure kpasswd works on dagali
|
||||
- [ ] Ensure kadmin get <user> (and other restricte commands) works on dagali
|
||||
|
||||
- [x] Fix FQDN
|
||||
- https://github.com/NixOS/nixpkgs/issues/94011
|
||||
- https://github.com/NixOS/nixpkgs/issues/261269
|
||||
- Possibly fixed by disabling systemd-resolved
|
||||
|
||||
- [ ] setup cyrus sasl
|
||||
- [x] ensure running with systemd
|
||||
- [x] verify GSSAPI support plugin is installed
|
||||
- `nix-shell -p cyrus_sasl --command pluginviewer`
|
||||
- [x] create "host/localhost@PVV.NTNU.NO" and export to keytab
|
||||
- [x] verify cyrus sasl is able to talk to heimdal
|
||||
- `sudo testsaslauthd -u oysteikt -p <password>`
|
||||
- [ ] provide ldap principal to cyrus sasl through keytab
|
||||
|
||||
- [ ] setup openldap
|
||||
- [x] ensure running with systemd
|
||||
- [ ] verify openldap is able to talk to cyrus sasl
|
||||
- [ ] create user for oysteikt in openldap
|
||||
- [ ] authenticate openldap login through sasl
|
||||
- does this require creating an ldap user?
|
||||
|
||||
- [ ] fix smbk5pwd integration
|
||||
- [x] add smbk5pwd schemas to openldap
|
||||
- [x] create openldap db for smbk5pwd with overlays
|
||||
- [ ] test to ensure that user sync is working
|
||||
- [ ] test as user source (replace passwd)
|
||||
- [ ] test as PAM auth source
|
||||
- [ ] test as auth source for 3rd party appliation
|
||||
|
||||
- [ ] Set up ldap administration panel
|
||||
- Doesn't seem like there are many good ones out there. Maybe phpLDAPAdmin?
|
||||
|
||||
- [ ] Set up kerberos SRV DNS entry
|
||||
|
||||
### Information and URLS
|
||||
|
||||
- OpenLDAP SASL: https://www.openldap.org/doc/admin24/sasl.html
|
||||
- Use a keytab: https://kb.iu.edu/d/aumh
|
||||
- 2 ways for openldap to auth: https://security.stackexchange.com/questions/65093/how-to-test-ldap-that-authenticates-with-kerberos
|
||||
- Cyrus guide OpenLDAP + SASL + GSSAPI: https://www.cyrusimap.org/sasl/sasl/faqs/openldap-sasl-gssapi.html
|
||||
- Configuring GSSAPI and Cyrus SASL: https://web.mit.edu/darwin/src/modules/passwordserver_sasl/cyrus_sasl/doc/gssapi.html
|
||||
- PVV Kerberos docs: https://wiki.pvv.ntnu.no/wiki/Drift/Kerberos
|
||||
- OpenLDAP smbk5pwd source: https://git.openldap.org/nivanova/openldap/-/tree/master/contrib/slapd-modules/smbk5pwd
|
||||
- saslauthd(8): https://linux.die.net/man/8/saslauthd
|
||||
@@ -1,51 +0,0 @@
|
||||
|
||||
{ config, pkgs, values, lib, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
../../base.nix
|
||||
../../misc/metrics-exporters.nix
|
||||
|
||||
./services/heimdal.nix
|
||||
#./services/openldap.nix
|
||||
./services/cyrus-sasl.nix
|
||||
];
|
||||
|
||||
# buskerud does not support efi?
|
||||
# boot.loader.systemd-boot.enable = true;
|
||||
# boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
|
||||
# resolved messes up FQDN coming from nscd
|
||||
services.resolved.enable = false;
|
||||
|
||||
networking.hostName = "dagali";
|
||||
networking.domain = lib.mkForce "pvv.local";
|
||||
networking.hosts = {
|
||||
"129.241.210.185" = [ "dagali.pvv.local" ];
|
||||
};
|
||||
#networking.search = [ "pvv.ntnu.no" "pvv.org" ];
|
||||
networking.nameservers = [ "129.241.0.200" "129.241.0.201" ];
|
||||
networking.tempAddresses = "disabled";
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
systemd.network.networks."ens18" = values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "ens18";
|
||||
address = with values.hosts.dagali; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||
};
|
||||
|
||||
# List packages installed in system profile
|
||||
environment.systemPackages = with pkgs; [
|
||||
# TODO: consider adding to base.nix
|
||||
nix-output-monitor
|
||||
];
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "24.05"; # Did you read the comment?
|
||||
}
|
||||
@@ -1,33 +0,0 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/4de345e2-be41-4d10-9b90-823b2c77e9b3";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/aa4b9a97-a7d8-4608-9f67-4ad084f1baf7"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
}
|
||||
@@ -1,21 +0,0 @@
|
||||
{ config, ... }:
|
||||
let
|
||||
cfg = config.services.saslauthd;
|
||||
in
|
||||
{
|
||||
# TODO: This is seemingly required for openldap to authenticate
|
||||
# against kerberos, but I have no idea how to configure it as
|
||||
# such. Does it need a keytab? There's a binary "testsaslauthd"
|
||||
# that follows with `pkgs.cyrus_sasl` that might be useful.
|
||||
services.saslauthd = {
|
||||
enable = true;
|
||||
mechanism = "kerberos5";
|
||||
config = ''
|
||||
mech_list: gs2-krb5 gssapi
|
||||
keytab: /etc/krb5.keytab
|
||||
'';
|
||||
};
|
||||
|
||||
# TODO: maybe the upstream module should consider doing this?
|
||||
environment.systemPackages = [ cfg.package ];
|
||||
}
|
||||
@@ -1,100 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
realm = "PVV.LOCAL";
|
||||
cfg = config.security.krb5;
|
||||
in
|
||||
{
|
||||
security.krb5 = {
|
||||
enable = true;
|
||||
|
||||
# NOTE: This is required in order to build smbk5pwd, because of some nested includes.
|
||||
# We should open an issue upstream (heimdal, not nixpkgs), but this patch
|
||||
# will do for now.
|
||||
package = pkgs.heimdal.overrideAttrs (prev: {
|
||||
postInstall = prev.postInstall + ''
|
||||
cp include/heim_threads.h $dev/include
|
||||
'';
|
||||
});
|
||||
|
||||
settings = {
|
||||
realms.${realm} = {
|
||||
kdc = [ "dagali.${lib.toLower realm}" ];
|
||||
admin_server = "dagali.${lib.toLower realm}";
|
||||
kpasswd_server = "dagali.${lib.toLower realm}";
|
||||
default_domain = lib.toLower realm;
|
||||
primary_kdc = "dagali.${lib.toLower realm}";
|
||||
};
|
||||
|
||||
kadmin.default_keys = lib.concatStringsSep " " [
|
||||
"aes256-cts-hmac-sha1-96:pw-salt"
|
||||
"aes128-cts-hmac-sha1-96:pw-salt"
|
||||
];
|
||||
|
||||
libdefaults.default_etypes = lib.concatStringsSep " " [
|
||||
"aes256-cts-hmac-sha1-96"
|
||||
"aes128-cts-hmac-sha1-96"
|
||||
];
|
||||
|
||||
libdefaults = {
|
||||
default_realm = realm;
|
||||
dns_lookup_kdc = false;
|
||||
dns_lookup_realm = false;
|
||||
};
|
||||
|
||||
domain_realm = {
|
||||
"${lib.toLower realm}" = realm;
|
||||
".${lib.toLower realm}" = realm;
|
||||
};
|
||||
|
||||
logging = {
|
||||
# kdc = "CONSOLE";
|
||||
kdc = "SYSLOG:DEBUG:AUTH";
|
||||
admin_server = "SYSLOG:DEBUG:AUTH";
|
||||
default = "SYSLOG:DEBUG:AUTH";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.kerberos_server = {
|
||||
enable = true;
|
||||
settings = {
|
||||
realms.${realm} = {
|
||||
dbname = "/var/lib/heimdal/heimdal";
|
||||
mkey = "/var/lib/heimdal/m-key";
|
||||
acl = [
|
||||
{
|
||||
principal = "kadmin/admin";
|
||||
access = "all";
|
||||
}
|
||||
{
|
||||
principal = "felixalb/admin";
|
||||
access = "all";
|
||||
}
|
||||
{
|
||||
principal = "oysteikt/admin";
|
||||
access = "all";
|
||||
}
|
||||
];
|
||||
};
|
||||
# kadmin.default_keys = lib.concatStringsSep " " [
|
||||
# "aes256-cts-hmac-sha1-96:pw-salt"
|
||||
# "aes128-cts-hmac-sha1-96:pw-salt"
|
||||
# ];
|
||||
|
||||
# libdefaults.default_etypes = lib.concatStringsSep " " [
|
||||
# "aes256-cts-hmac-sha1-96"
|
||||
# "aes128-cts-hmac-sha1-96"
|
||||
# ];
|
||||
|
||||
# password_quality.min_length = 8;
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 88 464 749 ];
|
||||
networking.firewall.allowedUDPPorts = [ 88 464 749 ];
|
||||
|
||||
networking.hosts = {
|
||||
"127.0.0.2" = lib.mkForce [ ];
|
||||
"::1" = lib.mkForce [ ];
|
||||
};
|
||||
}
|
||||
@@ -1,121 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
services.openldap = let
|
||||
dn = "dc=pvv,dc=ntnu,dc=no";
|
||||
cfg = config.services.openldap;
|
||||
|
||||
heimdal = config.security.krb5.package;
|
||||
in {
|
||||
enable = true;
|
||||
|
||||
# NOTE: this is a custom build of openldap with support for
|
||||
# perl and kerberos.
|
||||
package = pkgs.openldap.overrideAttrs (prev: {
|
||||
# https://github.com/openldap/openldap/blob/master/configure
|
||||
configureFlags = prev.configureFlags ++ [
|
||||
# Connect to slapd via UNIX socket
|
||||
"--enable-local"
|
||||
# Cyrus SASL
|
||||
"--enable-spasswd"
|
||||
# Reverse hostname lookups
|
||||
"--enable-rlookups"
|
||||
# perl
|
||||
"--enable-perl"
|
||||
];
|
||||
|
||||
buildInputs = prev.buildInputs ++ [
|
||||
pkgs.perl
|
||||
# NOTE: do not upstream this, it might not work with
|
||||
# MIT in the same way
|
||||
heimdal
|
||||
];
|
||||
|
||||
extraContribModules = prev.extraContribModules ++ [
|
||||
# https://git.openldap.org/openldap/openldap/-/tree/master/contrib/slapd-modules
|
||||
"smbk5pwd"
|
||||
];
|
||||
});
|
||||
|
||||
settings = {
|
||||
attrs = {
|
||||
olcLogLevel = [ "stats" "config" "args" ];
|
||||
|
||||
# olcAuthzRegexp = ''
|
||||
# gidNumber=.*\\\+uidNumber=0,cn=peercred,cn=external,cn=auth
|
||||
# "uid=heimdal,${dn2}"
|
||||
# '';
|
||||
|
||||
# olcSaslSecProps = "minssf=0";
|
||||
};
|
||||
|
||||
children = {
|
||||
"cn=schema".includes = let
|
||||
# NOTE: needed for smbk5pwd.so module
|
||||
schemaToLdif = name: path: pkgs.runCommandNoCC name {
|
||||
buildInputs = with pkgs; [ schema2ldif ];
|
||||
} ''
|
||||
schema2ldif "${path}" > $out
|
||||
'';
|
||||
|
||||
hdb-ldif = schemaToLdif "hdb.ldif" "${heimdal.src}/lib/hdb/hdb.schema";
|
||||
samba-ldif = schemaToLdif "samba.ldif" "${heimdal.src}/tests/ldap/samba.schema";
|
||||
in [
|
||||
"${cfg.package}/etc/schema/core.ldif"
|
||||
"${cfg.package}/etc/schema/cosine.ldif"
|
||||
"${cfg.package}/etc/schema/nis.ldif"
|
||||
"${cfg.package}/etc/schema/inetorgperson.ldif"
|
||||
"${hdb-ldif}"
|
||||
"${samba-ldif}"
|
||||
];
|
||||
|
||||
# NOTE: installation of smbk5pwd.so module
|
||||
# https://git.openldap.org/openldap/openldap/-/tree/master/contrib/slapd-modules/smbk5pwd
|
||||
"cn=module{0}".attrs = {
|
||||
objectClass = [ "olcModuleList" ];
|
||||
olcModuleLoad = [ "${cfg.package}/lib/modules/smbk5pwd.so" ];
|
||||
};
|
||||
|
||||
# NOTE: activation of smbk5pwd.so module for {1}mdb
|
||||
"olcOverlay={0}smbk5pwd,olcDatabase={1}mdb".attrs = {
|
||||
objectClass = [ "olcOverlayConfig" "olcSmbK5PwdConfig" ];
|
||||
olcOverlay = "{0}smbk5pwd";
|
||||
olcSmbK5PwdEnable = [ "krb5" "samba" ];
|
||||
olcSmbK5PwdMustChange = toString (60 * 60 * 24 * 10000);
|
||||
};
|
||||
|
||||
"olcDatabase={1}mdb".attrs = {
|
||||
objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
|
||||
|
||||
olcDatabase = "{1}mdb";
|
||||
|
||||
olcSuffix = dn;
|
||||
|
||||
# TODO: PW is supposed to be a secret, but it's probably fine for testing
|
||||
olcRootDN = "cn=users,${dn}";
|
||||
|
||||
# TODO: replace with proper secret
|
||||
olcRootPW.path = pkgs.writeText "olcRootPW" "pass";
|
||||
|
||||
olcDbDirectory = "/var/lib/openldap/test-smbk5pwd-db";
|
||||
olcDbIndex = "objectClass eq";
|
||||
|
||||
olcAccess = [
|
||||
''{0}to attrs=userPassword,shadowLastChange
|
||||
by dn.exact=cn=users,${dn} write
|
||||
by self write
|
||||
by anonymous auth
|
||||
by * none''
|
||||
|
||||
''{1}to dn.base=""
|
||||
by * read''
|
||||
|
||||
/* allow read on anything else */
|
||||
# ''{2}to *
|
||||
# by cn=users,${dn} write by dn.exact=gidNumber=0+uidNumber=0+cn=peercred,cn=external write
|
||||
# by * read''
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -2,4 +2,10 @@
|
||||
|
||||
{
|
||||
nix.settings.trusted-users = [ "@nix-builder-users" ];
|
||||
nix.daemonCPUSchedPolicy = "batch";
|
||||
|
||||
boot.binfmt.emulatedSystems = [
|
||||
"aarch64-linux"
|
||||
"armv7l-linux"
|
||||
];
|
||||
}
|
||||
|
||||
116
modules/robots-txt.nix
Normal file
116
modules/robots-txt.nix
Normal file
@@ -0,0 +1,116 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.environment.robots-txt;
|
||||
|
||||
robots-txt-format = {
|
||||
type = let
|
||||
coercedStrToNonEmptyListOfStr = lib.types.coercedTo lib.types.str lib.singleton (lib.types.nonEmptyListOf lib.types.str);
|
||||
in lib.types.listOf (lib.types.submodule {
|
||||
freeformType = lib.types.attrsOf coercedStrToNonEmptyListOfStr;
|
||||
options = {
|
||||
pre_comment = lib.mkOption {
|
||||
description = "Comment to add before the rule";
|
||||
type = lib.types.lines;
|
||||
default = "";
|
||||
};
|
||||
post_comment = lib.mkOption {
|
||||
description = "Comment to add after the rule";
|
||||
type = lib.types.lines;
|
||||
default = "";
|
||||
};
|
||||
};
|
||||
});
|
||||
|
||||
generate = name: value: let
|
||||
makeComment = comment: lib.pipe comment [
|
||||
(lib.splitString "\n")
|
||||
(lib.map (line: if line == "" then "#" else "# ${line}"))
|
||||
(lib.concatStringsSep "\n")
|
||||
];
|
||||
|
||||
ruleToString = rule: let
|
||||
user_agent = rule.User-agent or [];
|
||||
pre_comment = rule.pre_comment;
|
||||
post_comment = rule.post_comment;
|
||||
rest = builtins.removeAttrs rule [ "User-agent" "pre_comment" "post_comment" ];
|
||||
in lib.concatStringsSep "\n" (lib.filter (x: x != null) [
|
||||
(if (pre_comment != "") then makeComment pre_comment else null)
|
||||
(let
|
||||
user-agents = lib.concatMapStringsSep "\n" (value: "User-agent: ${value}") user_agent;
|
||||
in
|
||||
if user_agent == [] then null else user-agents
|
||||
)
|
||||
(lib.pipe rest [
|
||||
(lib.mapAttrsToList (ruleName: map (value: "${ruleName}: ${value}")))
|
||||
lib.concatLists
|
||||
(lib.concatStringsSep "\n")
|
||||
])
|
||||
(if (post_comment != "") then makeComment post_comment else null)
|
||||
]);
|
||||
|
||||
content = lib.concatMapStringsSep "\n\n" ruleToString value;
|
||||
in pkgs.writeText name content;
|
||||
};
|
||||
in
|
||||
{
|
||||
options.environment.robots-txt = lib.mkOption {
|
||||
default = { };
|
||||
description = ''
|
||||
Different instances of robots.txt to use with web services.
|
||||
'';
|
||||
type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
|
||||
options = {
|
||||
enable = lib.mkEnableOption "this instance of robots.txt" // {
|
||||
default = true;
|
||||
};
|
||||
|
||||
path = lib.mkOption {
|
||||
description = "The resulting path of the dir containing the robots.txt file";
|
||||
type = lib.types.path;
|
||||
readOnly = true;
|
||||
default = "/etc/robots-txt/${name}";
|
||||
};
|
||||
|
||||
rules = lib.mkOption {
|
||||
description = "Rules to include in robots.txt";
|
||||
default = [ ];
|
||||
example = [
|
||||
{ User-agent = "Googlebot"; Disallow = "/no-googlebot"; }
|
||||
{ User-agent = "Bingbot"; Disallow = [ "/no-bingbot" "/no-bingbot2" ]; }
|
||||
];
|
||||
type = robots-txt-format.type;
|
||||
};
|
||||
|
||||
virtualHost = lib.mkOption {
|
||||
description = "An nginx virtual host to add the robots.txt to";
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = null;
|
||||
};
|
||||
};
|
||||
}));
|
||||
};
|
||||
|
||||
config = {
|
||||
environment.etc = lib.mapAttrs' (name: value: {
|
||||
name = "robots-txt/${name}/robots.txt";
|
||||
value.source = robots-txt-format.generate name value.rules;
|
||||
}) cfg;
|
||||
|
||||
services.nginx.virtualHosts = lib.pipe cfg [
|
||||
(lib.filterAttrs (_: value: value.virtualHost != null))
|
||||
(lib.mapAttrs' (name: value: {
|
||||
name = value.virtualHost;
|
||||
value = {
|
||||
locations = {
|
||||
"= /robots.txt" = {
|
||||
extraConfig = ''
|
||||
add_header Content-Type text/plain;
|
||||
'';
|
||||
root = cfg.${name}.path;
|
||||
};
|
||||
};
|
||||
};
|
||||
}))
|
||||
];
|
||||
};
|
||||
}
|
||||
20
shell.nix
20
shell.nix
@@ -11,14 +11,14 @@ pkgs.mkShellNoCC {
|
||||
editorconfig-checker
|
||||
];
|
||||
|
||||
shellHook = ''
|
||||
export OS_AUTH_URL=https://api.stack.it.ntnu.no:5000
|
||||
export OS_PROJECT_ID=b78432a088954cdc850976db13cfd61c
|
||||
export OS_PROJECT_NAME="STUDORG_Programvareverkstedet"
|
||||
export OS_USER_DOMAIN_NAME="NTNU"
|
||||
export OS_PROJECT_DOMAIN_ID="d3f99bcdaf974685ad0c74c2e5d259db"
|
||||
export OS_REGION_NAME="NTNU-IT"
|
||||
export OS_INTERFACE=public
|
||||
export OS_IDENTITY_API_VERSION=3
|
||||
'';
|
||||
env = {
|
||||
OS_AUTH_URL = "https://api.stack.it.ntnu.no:5000";
|
||||
OS_PROJECT_ID = "b78432a088954cdc850976db13cfd61c";
|
||||
OS_PROJECT_NAME = "STUDORG_Programvareverkstedet";
|
||||
OS_USER_DOMAIN_NAME = "NTNU";
|
||||
OS_PROJECT_DOMAIN_ID = "d3f99bcdaf974685ad0c74c2e5d259db";
|
||||
OS_REGION_NAME = "NTNU-IT";
|
||||
OS_INTERFACE = "public";
|
||||
OS_IDENTITY_API_VERSION = "3";
|
||||
};
|
||||
}
|
||||
|
||||
120
topology.nix
Normal file
120
topology.nix
Normal file
@@ -0,0 +1,120 @@
|
||||
{ config, ... }:
|
||||
let
|
||||
inherit
|
||||
(config.lib.topology)
|
||||
mkInternet
|
||||
mkRouter
|
||||
mkSwitch
|
||||
mkDevice
|
||||
mkConnection
|
||||
mkConnectionRev;
|
||||
values = import ./values.nix;
|
||||
in {
|
||||
|
||||
### Networks
|
||||
|
||||
networks.pvv = {
|
||||
name = "PVV Network";
|
||||
cidrv4 = values.ipv4-space;
|
||||
cidrv6 = values.ipv6-space;
|
||||
};
|
||||
|
||||
networks.site-vpn = {
|
||||
name = "OpenVPN Site to Site";
|
||||
style = {
|
||||
primaryColor = "#9dd68d";
|
||||
secondaryColor = null;
|
||||
pattern = "dashed";
|
||||
};
|
||||
};
|
||||
|
||||
networks.ntnu = {
|
||||
name = "NTNU";
|
||||
};
|
||||
|
||||
nodes.internet = mkInternet {
|
||||
connections = mkConnection "ntnu" "wan1";
|
||||
};
|
||||
|
||||
nodes.ntnu = mkRouter "NTNU" {
|
||||
interfaceGroups = [ ["wan1"] ["eth1" "eth2" "eth3"] ];
|
||||
connections.eth1 = mkConnection "ntnu-pvv-router" "wan1";
|
||||
connections.eth2 = mkConnection "ntnu-veggen" "wan1";
|
||||
connections.eth3 = mkConnection "stackit" "*";
|
||||
interfaces.eth1.network = "ntnu";
|
||||
};
|
||||
|
||||
### Brus
|
||||
|
||||
nodes.ntnu-pvv-router = mkRouter "NTNU PVV Gateway" {
|
||||
interfaceGroups = [ ["wan1"] ["eth1"] ];
|
||||
connections.eth1 = mkConnection "brus-switch" "eth1";
|
||||
interfaces.eth1.network = "pvv";
|
||||
};
|
||||
|
||||
nodes.brus-switch = mkSwitch "Brus Switch" {
|
||||
interfaceGroups = [ ["eth1" "eth2" "eth3" "eth4" "eth5" "eth6" "eth7"] ];
|
||||
connections.eth2 = mkConnection "bekkalokk" "enp2s0";
|
||||
connections.eth3 = mkConnection "bicep" "enp6s0f0";
|
||||
# connections.eth4 = mkConnection "buskerud" "enp3s0f0";
|
||||
connections.eth5 = mkConnection "knutsen" "eth1";
|
||||
connections.eth7 = mkConnection "joshua" "eth1";
|
||||
};
|
||||
|
||||
nodes.knutsen = mkRouter "knutsen" {
|
||||
interfaceGroups = [ ["eth1"] ["eth2"] ["vpn1"] ];
|
||||
connections.eth2 = mkConnectionRev "brus-switch" "eth6";
|
||||
# connections.vpn1 = mkConnection "ludvigsen" "vpn1";
|
||||
interfaces.vpn1.network = "site-vpn";
|
||||
interfaces.vpn1.virtual = true;
|
||||
};
|
||||
|
||||
nodes.joshua = mkDevice "joshua" {
|
||||
interfaceGroups = [ ["eth1"] ];
|
||||
};
|
||||
|
||||
nodes.shark = {
|
||||
guestType = "proxmox";
|
||||
parent = config.nodes.joshua.id;
|
||||
};
|
||||
|
||||
|
||||
### PVV
|
||||
|
||||
nodes.ntnu-veggen = mkRouter "NTNU-Veggen" {
|
||||
interfaceGroups = [ ["wan1"] ["eth1"] ];
|
||||
connections.eth1 = mkConnection "ludvigsen" "eth1";
|
||||
};
|
||||
|
||||
nodes.ludvigsen = mkRouter "ludvigsen" {
|
||||
interfaceGroups = [ ["eth1"] ["eth2"] ["vpn1"] ];
|
||||
connections.eth2 = mkConnection "pvv-switch" "eth1";
|
||||
interfaces.vpn1.network = "site-vpn";
|
||||
interfaces.vpn1.virtual = true;
|
||||
interfaces.eth1.network = "ntnu";
|
||||
interfaces.eth2.network = "pvv";
|
||||
};
|
||||
|
||||
nodes.pvv-switch = mkSwitch "PVV Switch (Terminalrommet)" {
|
||||
interfaceGroups = [ ["eth1" "eth2" "eth3"] ];
|
||||
connections.eth2 = mkConnection "brzeczyszczykiewicz" "eno1";
|
||||
connections.eth3 = mkConnection "georg" "eno1";
|
||||
};
|
||||
|
||||
|
||||
### Openstack
|
||||
|
||||
nodes.stackit = mkDevice "stackit" {
|
||||
interfaceGroups = [ ["*"] ];
|
||||
};
|
||||
|
||||
nodes.ildkule = {
|
||||
guestType = "openstack";
|
||||
parent = config.nodes.stackit.id;
|
||||
};
|
||||
nodes.bob = {
|
||||
guestType = "openstack";
|
||||
parent = config.nodes.stackit.id;
|
||||
};
|
||||
|
||||
}
|
||||
@@ -31,10 +31,6 @@ in rec {
|
||||
ipv4 = pvv-ipv4 168;
|
||||
ipv6 = pvv-ipv6 168;
|
||||
};
|
||||
dagali = {
|
||||
ipv4 = pvv-ipv4 185;
|
||||
ipv6 = pvv-ipv6 185;
|
||||
};
|
||||
ildkule = {
|
||||
ipv4 = "129.241.153.213";
|
||||
ipv4_internal = "192.168.12.209";
|
||||
|
||||
Reference in New Issue
Block a user