Merge pull request 'base: stabilize system.build.toplevel.outPath for vmVariant' (!105) from no-flake-in-vm into main

Reviewed-on: #105
Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>

.mailmap

@@ -0,0 +1,25 @@
+Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> <daniel.olsen99@gmail.com>
+Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel <danio@pvv.ntnu.no>
+Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Lovbrotte Olsen <danio@pvv.ntnu.no>
+Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Olsen <danio@pvv.ntnu.no>
+Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> danio <danio@pvv.ntnu.no>
+Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Olsen <danio@bicep.pvv.ntnu.no>
+
+
+Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> h7x4 <h7x4@nani.wtf>
+Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Øystein Tveit <oysteikt@pvv.ntnu.no>
+Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> oysteikt <oysteikt@pvv.ntnu.no>
+Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Øystein <oysteikt@pvv.org>
+Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
+
+Felix Albrigtsen <felixalb@pvv.ntnu.no> <felix@albrigtsen.it>
+Felix Albrigtsen <felixalb@pvv.ntnu.no> <felixalbrigtsen@gmail.com>
+Felix Albrigtsen <felixalb@pvv.ntnu.no> felixalb <felixalb@pvv.ntnu.no>
+
+Peder Bergebakken Sundt <pederbs@pvv.ntnu.no> <pbsds@hotmail.com>
+
+Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian G L <adrian@lauterer.it>
+Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian Gunnar Lauterer <adrian@lauterer.it>
+
+Fredrik Robertsen <frero@pvv.ntnu.no> frero <frero@pvv.ntnu.no>
+Fredrik Robertsen <frero@pvv.ntnu.no> fredrikr79 <fredrikrobertsen7@gmail.com>

.sops.yaml

@@ -13,6 +13,8 @@ keys:
   - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
   - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
   - &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
+  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
+  - &host_kommode age1mt4d0hg5g76qp7j0884llemy0k2ymr5up8vfudz6vzvsflk5nptqqd32ly
 
 creation_rules:
   # Global secrets
@@ -43,6 +45,18 @@ creation_rules:
       pgp:
       - *user_oysteikt
 
+  - path_regex: secrets/kommode/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_kommode
+      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      pgp:
+      - *user_oysteikt
+
   - path_regex: secrets/jokum/[^/]+\.yaml$
     key_groups:
     - age:
@@ -78,3 +92,15 @@ creation_rules:
       - *user_pederbs_bjarte
       pgp:
       - *user_oysteikt
+
+  - path_regex: secrets/ustetind/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_ustetind
+      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      pgp:
+      - *user_oysteikt

README.MD

@@ -26,10 +26,14 @@ Det er sikkert lurt å lage en PR først om du ikke er vandt til nix enda.
 Innen 24h skal alle systemene hente ned den nye konfigurasjonen og deploye den.
 
 Du kan tvinge en maskin til å oppdatere seg før dette ved å kjøre:
-`nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git --upgrade`
+`nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --upgrade --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git`
 
 som root på maskinen.
 
+Hvis du ikke har lyst til å oppdatere alle pakkene (og kanskje måtte vente en stund!) kan du kjøre
+
+`nixos-rebuild switch --override-input nixpkgs nixpkgs --override-input nixpkgs-unstable nixpkgs-unstable --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git`
+
 ## Seksjonen for hemmeligheter
 
 For at hemmeligheter ikke skal deles med hele verden i git - eller å være world

base.nix

@@ -1,150 +0,0 @@
-{ config, lib, pkgs, inputs, values, ... }:
-
-{
-  imports = [
-    ./users
-    ./modules/snakeoil-certs.nix
-  ];
-
-  networking.domain = "pvv.ntnu.no";
-  networking.useDHCP = false;
-  # networking.search = [ "pvv.ntnu.no" "pvv.org" ];
-  # networking.nameservers = lib.mkDefault [ "129.241.0.200" "129.241.0.201" ];
-  # networking.tempAddresses = lib.mkDefault "disabled";
-  # networking.defaultGateway = values.hosts.gateway;
-
-  systemd.network.enable = true;
-
-  services.resolved = {
-    enable = lib.mkDefault true;
-    dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
-  };
-
-  time.timeZone = "Europe/Oslo";
-
-  i18n.defaultLocale = "en_US.UTF-8";
-  console = {
-    font = "Lat2-Terminus16";
-    keyMap = "no";
-  };
-
-  system.autoUpgrade = {
-    enable = true;
-    flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
-    flags = [
-      "--update-input" "nixpkgs"
-      "--update-input" "nixpkgs-unstable"
-      "--no-write-lock-file"
-    ];
-  };
-  nix.gc.automatic = true;
-  nix.gc.options = "--delete-older-than 2d";
-
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
-
-  /* This makes commandline tools like
-  ** nix run nixpkgs#hello
-  ** and nix-shell -p hello
-  ** use the same channel the system
-  ** was built with
-  */
-  nix.registry = {
-    nixpkgs.flake = inputs.nixpkgs;
-  };
-  nix.nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
-
-  environment.systemPackages = with pkgs; [
-    file
-    git
-    gnupg
-    htop
-    nano
-    ripgrep
-    rsync
-    screen
-    tmux
-    vim
-    wget
-
-    kitty.terminfo
-  ];
-
-  programs.zsh.enable = true;
-
-  users.groups."drift".name = "drift";
-
-  # Trusted users on the nix builder machines
-  users.groups."nix-builder-users".name = "nix-builder-users";
-
-  # Let's not thermal throttle
-  services.thermald.enable = lib.mkIf (lib.all (x: x) [
-      (config.nixpkgs.system == "x86_64-linux")
-      (!config.boot.isContainer or false)
-    ]) true;
-
-  services.openssh = {
-    enable = true;
-    extraConfig = ''
-      PubkeyAcceptedAlgorithms=+ssh-rsa
-      Match Group wheel
-        PasswordAuthentication no
-      Match All
-    '';
-    settings.PermitRootLogin = "yes";
-  };
-
-  # nginx return 444 for all nonexistent virtualhosts
-
-  systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
-
-  environment.snakeoil-certs = lib.mkIf config.services.nginx.enable {
-    "/etc/certs/nginx" = {
-      owner = "nginx";
-      group = "nginx";
-    };
-  };
-
-  services.nginx = {
-    recommendedTlsSettings = true;
-    recommendedProxySettings = true;
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-
-    appendConfig = ''
-      pcre_jit on;
-      worker_processes auto;
-      worker_rlimit_nofile 100000;
-    '';
-    eventsConfig = ''
-      worker_connections 2048;
-      use epoll;
-      multi_accept on;
-    '';
-  };
-
-  systemd.services.nginx.serviceConfig = lib.mkIf config.services.nginx.enable {
-    LimitNOFILE = 65536;
-  };
-
-  services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
-    sslCertificate = "/etc/certs/nginx.crt";
-    sslCertificateKey = "/etc/certs/nginx.key";
-    addSSL = true;
-    extraConfig = "return 444;";
-  };
-
-  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
-
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "drift@pvv.ntnu.no";
-  };
-  # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
-  virtualisation.vmVariant = {
-    security.acme.defaults.server = "https://127.0.0.1";
-    security.acme.preliminarySelfsigned = true;
-
-    users.users.root.initialPassword = "root";
-  };
-
-}

base/default.nix

@@ -0,0 +1,80 @@
+{ pkgs, lib, fp, ... }:
+
+{
+  imports = [
+    (fp /users)
+    (fp /modules/snakeoil-certs.nix)
+
+    ./networking.nix
+    ./nix.nix
+    ./vm.nix
+
+    ./services/acme.nix
+    ./services/uptimed.nix
+    ./services/auto-upgrade.nix
+    ./services/dbus.nix
+    ./services/fwupd.nix
+    ./services/irqbalance.nix
+    ./services/logrotate.nix
+    ./services/nginx.nix
+    ./services/openssh.nix
+    ./services/postfix.nix
+    ./services/smartd.nix
+    ./services/thermald.nix
+    ./services/userborn.nix
+    ./services/userdbd.nix
+  ];
+
+  boot.tmp.cleanOnBoot = lib.mkDefault true;
+  boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
+
+  time.timeZone = "Europe/Oslo";
+
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "no";
+  };
+
+  environment.systemPackages = with pkgs; [
+    file
+    git
+    gnupg
+    htop
+    nano
+    ripgrep
+    rsync
+    screen
+    tmux
+    vim
+    wget
+
+    kitty.terminfo
+  ];
+
+  # .bash_profile already works, but lets also use .bashrc like literally every other distro
+  # https://man.archlinux.org/man/core/bash/bash.1.en#INVOCATION
+  # home-manager usually handles this for you: https://github.com/nix-community/home-manager/blob/22a36aa709de7dd42b562a433b9cefecf104a6ee/modules/programs/bash.nix#L203-L209
+  # btw, programs.bash.shellInit just goes into environment.shellInit which in turn goes into /etc/profile, spooky shit
+  programs.bash.shellInit = ''
+   if [ -n "''${BASH_VERSION:-}" ]; then
+     if [[ ! -f ~/.bash_profile && ! -f ~/.bash_login ]]; then
+      [[ -f ~/.bashrc ]] && . ~/.bashrc
+     fi
+   fi
+  '';
+
+  programs.zsh.enable = true;
+
+  security.lockKernelModules = true;
+  security.protectKernelImage = true;
+  security.sudo.execWheelOnly = true;
+  security.sudo.extraConfig = ''
+    Defaults lecture = never
+  '';
+
+  users.groups."drift".name = "drift";
+
+  # Trusted users on the nix builder machines
+  users.groups."nix-builder-users".name = "nix-builder-users";
+}

base/networking.nix

@@ -0,0 +1,13 @@
+{ lib, values, ... }:
+{
+  systemd.network.enable = true;
+  networking.domain = "pvv.ntnu.no";
+  networking.useDHCP = false;
+
+  # The rest of the networking configuration is usually sourced from /values.nix
+
+  services.resolved = {
+    enable = lib.mkDefault true;
+    dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
+  };
+}

base/nix.nix

@@ -0,0 +1,39 @@
+{ lib, config, inputs, ... }:
+{
+  nix = {
+    gc = {
+      automatic = true;
+      options = "--delete-older-than 2d";
+    };
+    optimise.automatic = true;
+
+    settings = {
+      allow-dirty = true;
+      builders-use-substitutes = true;
+      experimental-features = [ "nix-command" "flakes" ];
+      log-lines = 50;
+      use-xdg-base-directories = true;
+    };
+
+    /* This makes commandline tools like
+    ** nix run nixpkgs#hello
+    ** and nix-shell -p hello
+    ** use the same channel the system
+    ** was built with
+    */
+    registry = lib.mkMerge [
+      {
+        "nixpkgs".flake = inputs.nixpkgs;
+        "nixpkgs-unstable".flake = inputs.nixpkgs-unstable;
+      }
+      # We avoid the reference to self in vmVariant to get a stable system .outPath for equivalence testing
+      (lib.mkIf (!config.virtualisation.isVmVariant) {
+        "pvv-nix".flake = inputs.self;
+      })
+    ];
+    nixPath = [
+      "nixpkgs=${inputs.nixpkgs}"
+      "unstable=${inputs.nixpkgs-unstable}"
+    ];
+  };
+}

base/services/acme.nix

@@ -0,0 +1,15 @@
+{ ... }:
+{
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "drift@pvv.ntnu.no";
+  };
+
+  # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
+  virtualisation.vmVariant = {
+    security.acme.defaults.server = "https://127.0.0.1";
+    security.acme.preliminarySelfsigned = true;
+
+    users.users.root.initialPassword = "root";
+  };
+}

base/services/auto-upgrade.nix

@@ -0,0 +1,39 @@
+{ config, inputs, pkgs, lib, ... }:
+
+let
+  inputUrls = lib.mapAttrs (input: value: value.url) (import "${inputs.self}/flake.nix").inputs;
+in
+
+{
+  system.autoUpgrade = {
+    enable = true;
+    flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
+    flags = [
+      "--refresh"
+      "--no-write-lock-file"
+      # --update-input is deprecated since nix 2.22, and removed in lix 2.90
+      # as such we instead use --override-input combined with --refresh
+      # https://git.lix.systems/lix-project/lix/issues/400
+    ] ++ (lib.pipe inputUrls [
+      (lib.intersectAttrs {
+        nixpkgs = { };
+        nixpkgs-unstable = { };
+      })
+      (lib.mapAttrsToList (input: url: ["--override-input" input url]))
+      lib.concatLists
+    ]);
+  };
+
+  # workaround for https://github.com/NixOS/nix/issues/6895
+  # via https://git.lix.systems/lix-project/lix/issues/400
+  environment.etc = lib.mkIf (!config.virtualisation.isVmVariant) {
+    "current-system-flake-inputs.json".source
+      = pkgs.writers.writeJSON "flake-inputs.json" (
+        lib.flip lib.mapAttrs inputs (name: input:
+          # inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
+          lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
+            // { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
+        )
+      );
+  };
+}

base/services/dbus.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  services.dbus = {
+    enable = true;
+    implementation = "broker";
+  };
+}

base/services/fwupd.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.fwupd.enable = true;
+}

base/services/irqbalance.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.irqbalance.enable = true;
+}

base/services/logrotate.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  systemd.services.logrotate = {
+    documentation = [ "man:logrotate(8)" "man:logrotate.conf(5)" ];
+    unitConfig.RequiresMountsFor = "/var/log";
+    serviceConfig.ReadWritePaths = [ "/var/log" ];
+  };
+}

base/services/nginx.nix

@@ -0,0 +1,48 @@
+{ config, lib, ... }:
+{
+  # nginx return 444 for all nonexistent virtualhosts
+
+  systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
+
+  environment.snakeoil-certs = lib.mkIf config.services.nginx.enable {
+    "/etc/certs/nginx" = {
+      owner = "nginx";
+      group = "nginx";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
+
+  services.nginx = {
+    recommendedTlsSettings = true;
+    recommendedProxySettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+
+    appendConfig = ''
+      # pcre_jit on;
+      worker_processes auto;
+      worker_rlimit_nofile 100000;
+    '';
+    eventsConfig = ''
+      worker_connections 2048;
+      use epoll;
+      # multi_accept on;
+    '';
+  };
+
+  systemd.services.nginx.serviceConfig = lib.mkIf config.services.nginx.enable {
+    LimitNOFILE = 65536;
+    # We use jit my dudes
+    MemoryDenyWriteExecute = lib.mkForce false;
+    # What the fuck do we use that where the defaults are not enough???
+    SystemCallFilter = lib.mkForce null;
+  };
+
+  services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
+    sslCertificate = "/etc/certs/nginx.crt";
+    sslCertificateKey = "/etc/certs/nginx.key";
+    addSSL = true;
+    extraConfig = "return 444;";
+  };
+}

base/services/openssh.nix

@@ -0,0 +1,21 @@
+{ ... }:
+{
+  services.openssh = {
+    enable = true;
+    startWhenNeeded = true;
+    extraConfig = ''
+      PubkeyAcceptedAlgorithms=+ssh-rsa
+      Match Group wheel
+        PasswordAuthentication no
+      Match All
+    '';
+    settings.PermitRootLogin = "yes";
+
+  };
+    users.users."root".openssh.authorizedKeys.keys = [
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqVt4LCe0YIttr9swFxjkjn37ZDY9JxwVC+2gvfSINDJorOCtqPjDOTD2fTS1Gz08QCwpnLWq2kyvRchu6WgriAbSACpbZZBgxRaF/FVh3oiMVFGnNKGnv6/fdo/vZtu8mUVuqtmTrgLYpZdbR4oD3XiBlDKs7Cv5hPqt95lnP6MNFvE8mICCfd1PwhsABd2IQ5laz3u77/RXhNFJL0Kf2/+6gk9awcLuwHrPdvq7c3BxRHbc9UMRQENyjyQPa7aLe+uJBFLKP51I8VBuDpDacuibQx7nMt6N2UJ2KWI0JxRMHuJNq4S5jidR82aOw9gzGbTv30SKNLMqsZ0xj4LtdqCXDiZF6Lr09PsJYsvnBUFWa14HGcThKDtgwQwBryNViYmfv//0h9+RLZiU0ab+NEwSs7Zh5iAD+vhx64QqNX3tR7Le4SWXh8W0eShU9N78qYdSkiC3Ui7htxeqOocXM/P4AwbnHsLELIvkHdvgchCPvl8ygZa4WJTEWv16+ICskJcAKWGuqjvXAFuwjJJmPp9xLW9O0DFfQhMELiGamQR9wK07yYQVr34iah6qZO7cwhSKyEPFrVPIaNtfDhsjED639F7vmktf26SWNJHWfW0wOHILjI6TgqUvy0JDd8W8w0CHlAfz6Fs2l99NNgNF8dB3vBASbxS0hu/y0PVu/xQ== openstack-sleipner"
+
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCbgJ0Uwh9VSVhfId7l9i5/jk4CvAK5rbkiab8R+moF root@sleipner"
+    ];
+}
+

base/services/postfix.nix

@@ -0,0 +1,23 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.postfix;
+in
+{
+  services.postfix = {
+    enable = true;
+
+    hostname = "${config.networking.hostName}.pvv.ntnu.no";
+    domain = "pvv.ntnu.no";
+
+    relayHost = "smtp.pvv.ntnu.no";
+    relayPort = 465;
+
+    config = {
+      smtp_tls_wrappermode = "yes";
+      smtp_tls_security_level = "encrypt";
+    };
+
+    # Nothing should be delivered to this machine
+    destination = [ ];
+  };
+}

base/services/smartd.nix

@@ -0,0 +1,20 @@
+{ config, pkgs, lib, ... }:
+{
+  services.smartd = {
+    enable = lib.mkDefault true;
+    notifications = {
+      mail = {
+        enable = true;
+        sender = "root@pvv.ntnu.no";
+        recipient = "root@pvv.ntnu.no";
+      };
+      wall.enable = false;
+    };
+  };
+
+  environment.systemPackages = lib.optionals config.services.smartd.enable (with pkgs; [
+    smartmontools
+  ]);
+
+  systemd.services.smartd.unitConfig.ConditionVirtualization = "no";
+}

base/services/thermald.nix

@@ -0,0 +1,8 @@
+{ config, lib, ... }:
+{
+  # Let's not thermal throttle
+  services.thermald.enable = lib.mkIf (lib.all (x: x) [
+      (config.nixpkgs.system == "x86_64-linux")
+      (!config.boot.isContainer or false)
+    ]) true;
+}

base/services/uptimed.nix

@@ -0,0 +1,59 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.uptimed;
+in
+{
+  options.services.uptimed.settings = lib.mkOption {
+    description = "";
+    default = { };
+    type = lib.types.submodule {
+      freeformType = with lib.types; attrsOf (either str (listOf str));
+    };
+  };
+
+  config = {
+    services.uptimed = {
+      enable = true;
+
+      settings = let
+        stateDir = "/var/lib/uptimed";
+      in {
+        PIDFILE = "${stateDir}/pid";
+        SENDMAIL = lib.mkDefault "${pkgs.system-sendmail}/bin/sendmail -t";
+      };
+    };
+
+    systemd.services.uptimed = lib.mkIf (cfg.enable) {
+      serviceConfig = let
+        uptimed = pkgs.uptimed.overrideAttrs (prev: {
+          postPatch = ''
+             substituteInPlace Makefile.am \
+               --replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
+             substituteInPlace src/Makefile.am \
+               --replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
+          '';
+        });
+
+      in {
+        Type = "notify";
+
+        ExecStart = lib.mkForce "${uptimed}/sbin/uptimed -f";
+
+        BindReadOnlyPaths = let
+          configFile = lib.pipe cfg.settings [
+            (lib.mapAttrsToList
+              (k: v:
+                if builtins.isList v
+                  then lib.mapConcatStringsSep "\n" (v': "${k}=${v'}") v
+                  else "${k}=${v}")
+            )
+            (lib.concatStringsSep "\n")
+            (pkgs.writeText "uptimed.conf")
+          ];
+        in [
+          "${configFile}:/var/lib/uptimed/uptimed.conf"
+        ];
+      };
+    };
+  };
+}

base/services/userborn.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.userborn.enable = true;
+}

base/services/userdbd.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.userdbd.enable = true;
+}

base/vm.nix

@@ -0,0 +1,15 @@
+{ lib, ... }:
+
+# This enables
+#     lib.mkIf (!config.virtualisation.isVmVariant) { ... }
+
+{
+  options.virtualisation.isVmVariant = lib.mkOption {
+    description = "`true` if system is build with 'nixos-rebuild build-vm'";
+    type = lib.types.bool;
+    default = false;
+  };
+  config.virtualisation.vmVariant = {
+    virtualisation.isVmVariant = true;
+  };
+}

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1715445235,
+        "lastModified": 1745502102,
-        "narHash": "sha256-SUu+oIWn+xqQIOlwfwNfS9Sek4i1HKsrLJchsDReXwA=",
+        "narHash": "sha256-LqhRwzvIVPEjH0TaPgwzqpyhW6DtCrvz7FnUJDoUZh8=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "159d87ea5b95bbdea46f0288a33c5e1570272725",
+        "rev": "ca27b88c88948d96feeee9ed814cbd34f53d0d70",
         "type": "github"
       },
       "original": {
@@ -20,64 +20,45 @@
         "type": "github"
       }
     },
-    "fix-python": {
+    "gergle": {
       "inputs": {
-        "flake-utils": "flake-utils",
         "nixpkgs": [
-          "grzegorz",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1713887124,
+        "lastModified": 1736621371,
-        "narHash": "sha256-hGTSm0p9xXUYDgsAAr/ORZICo6T6u33vLfX3tILikaQ=",
+        "narHash": "sha256-45UIQSQA7R5iU4YWvilo7mQbhY1Liql9bHBvYa3qRI0=",
-        "owner": "GuillaumeDesforges",
+        "ref": "refs/heads/main",
-        "repo": "fix-python",
+        "rev": "3729796c1213fe76e568ac28f1df8de4e596950b",
-        "rev": "f7f4b33e22414071fc1f9cbf68072c413c3a7fdf",
+        "revCount": 20,
-        "type": "github"
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
       },
       "original": {
-        "owner": "GuillaumeDesforges",
+        "type": "git",
-        "repo": "fix-python",
+        "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
-        "type": "github"
       }
     },
-    "flake-utils": {
+    "greg-ng": {
       "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1689068808,
-        "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
-        "type": "github"
-      },
-      "original": {
-        "id": "flake-utils",
-        "type": "indirect"
-      }
-    },
-    "grzegorz": {
-      "inputs": {
-        "fix-python": "fix-python",
         "nixpkgs": [
-          "nixpkgs-unstable"
+          "nixpkgs"
-        ]
+        ],
+        "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1715364232,
+        "lastModified": 1746563623,
-        "narHash": "sha256-ZJC3SkanEgbV7p+LFhP+85CviRWOXJNHzZwR/Stb7hE=",
+        "narHash": "sha256-5DxgNFpSgxft/sWraZnHIUlb4S3Io73SVS7FZCbWSUY=",
-        "owner": "Programvareverkstedet",
+        "ref": "refs/heads/main",
-        "repo": "grzegorz",
+        "rev": "4e0408887f80e61a90286ff630a7855b828ae421",
-        "rev": "3841cda1cdcac470440b06838d56a2eb2256378c",
+        "revCount": 45,
-        "type": "github"
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
       },
       "original": {
-        "owner": "Programvareverkstedet",
+        "type": "git",
-        "repo": "grzegorz",
+        "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
-        "type": "github"
       }
     },
     "grzegorz-clients": {
@@ -87,17 +68,17 @@
         ]
       },
       "locked": {
-        "lastModified": 1715384651,
+        "lastModified": 1736178795,
-        "narHash": "sha256-7RhckgUTjqeCjWkhiCc1iB+5CBx9fl80d/3O4Jh+5kM=",
+        "narHash": "sha256-mPdi8cgvIDYcgG3FRG7A4BOIMu2Jef96TPMnV00uXlM=",
-        "owner": "Programvareverkstedet",
+        "ref": "refs/heads/master",
-        "repo": "grzegorz-clients",
+        "rev": "fde738910de1fd8293535a6382c2f0c2749dd7c1",
-        "rev": "738a4f3dd887f7c3612e4e772b83cbfa3cde5693",
+        "revCount": 79,
-        "type": "github"
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
       },
       "original": {
-        "owner": "Programvareverkstedet",
+        "type": "git",
-        "repo": "grzegorz-clients",
+        "url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
-        "type": "github"
       }
     },
     "matrix-next": {
@@ -107,20 +88,35 @@
         ]
       },
       "locked": {
-        "lastModified": 1717234745,
+        "lastModified": 1735857245,
-        "narHash": "sha256-MFyKRdw4WQD6V3vRGbP6MYbtJhZp712zwzjW6YiOBYM=",
+        "narHash": "sha256-AKLLPrgXTxgzll3DqVUMa4QlPlRN3QceutgFBmEf8Nk=",
         "owner": "dali99",
         "repo": "nixos-matrix-modules",
-        "rev": "d7dc42c9bbb155c5e4aa2f0985d0df75ce978456",
+        "rev": "da9dc0479ffe22362793c87dc089035facf6ec4d",
         "type": "github"
       },
       "original": {
         "owner": "dali99",
-        "ref": "v0.6.0",
+        "ref": "0.7.0",
         "repo": "nixos-matrix-modules",
         "type": "github"
       }
     },
+    "minecraft-data": {
+      "locked": {
+        "lastModified": 1725277886,
+        "narHash": "sha256-Fw4VbbE3EfypQWSgPDFfvVH47BHeg3ptsO715NlUM8Q=",
+        "ref": "refs/heads/master",
+        "rev": "1b4087bd3322a2e2ba84271c8fcc013e6b641a58",
+        "revCount": 2,
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
+      }
+    },
     "nix-gitea-themes": {
       "inputs": {
         "nixpkgs": [
@@ -128,63 +124,43 @@
         ]
       },
       "locked": {
-        "lastModified": 1714416973,
+        "lastModified": 1743881366,
-        "narHash": "sha256-aZUcvXjdETUC6wVQpWDVjLUzwpDAEca8yR0ITDeK39o=",
+        "narHash": "sha256-ScGA2IHPk9ugf9bqEZnp+YB/OJgrkZblnG/XLEKvJAo=",
         "ref": "refs/heads/main",
-        "rev": "2b23c0ba8aae68d3cb6789f0f6e4891cef26cc6d",
+        "rev": "db2e4becf1b11e5dfd33de12a90a7d089fcf68ec",
-        "revCount": 6,
+        "revCount": 11,
         "type": "git",
-        "url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
+        "url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
       },
       "original": {
         "type": "git",
-        "url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
+        "url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1719520878,
+        "lastModified": 1748615477,
-        "narHash": "sha256-5BXzNOl2RVHcfS/oxaZDKOi7gVuTyWPibQG0DHd5sSc=",
+        "narHash": "sha256-8sjG4sNIonQPK2olCGvq3/j1qtjwPaTOFU5nkz1gj2Q=",
-        "owner": "NixOS",
+        "rev": "97d3ce1ceb663a24184aac92b7e9e8f5452111c1",
-        "repo": "nixpkgs",
+        "type": "tarball",
-        "rev": "a44bedbb48c367f0476e6a3a27bf28f6330faf23",
+        "url": "https://releases.nixos.org/nixos/24.11-small/nixos-24.11.718472.97d3ce1ceb66/nixexprs.tar.xz?rev=97d3ce1ceb663a24184aac92b7e9e8f5452111c1"
-        "type": "github"
       },
       "original": {
-        "id": "nixpkgs",
+        "type": "tarball",
-        "ref": "nixos-24.05-small",
+        "url": "https://nixos.org/channels/nixos-24.11-small/nixexprs.tar.xz"
-        "type": "indirect"
-      }
-    },
-    "nixpkgs-stable": {
-      "locked": {
-        "lastModified": 1714858427,
-        "narHash": "sha256-tCxeDP4C1pWe2rYY3IIhdA40Ujz32Ufd4tcrHPSKx2M=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "b980b91038fc4b09067ef97bbe5ad07eecca1e76",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "release-23.11",
-        "repo": "nixpkgs",
-        "type": "github"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1715435713,
+        "lastModified": 1748588304,
-        "narHash": "sha256-lb2HqDQGfTdnCCpc1pgF6fkdgIOuBQ0nP8jjVSfLFqg=",
+        "narHash": "sha256-YCnUqO9k39p0oMIBndxYTbu8m0fOA/KVcq3IekXPy9c=",
-        "owner": "NixOS",
+        "rev": "b8af95f4cf511c5f056b463c3a45d2b63c7cfb03",
-        "repo": "nixpkgs",
+        "type": "tarball",
-        "rev": "52b40f6c4be12742b1504ca2eb4527e597bf2526",
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-25.11pre807945.b8af95f4cf51/nixexprs.tar.xz?rev=b8af95f4cf511c5f056b463c3a45d2b63c7cfb03"
-        "type": "github"
       },
       "original": {
-        "id": "nixpkgs",
+        "type": "tarball",
-        "ref": "nixos-unstable-small",
+        "url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
-        "type": "indirect"
       }
     },
     "pvv-calendar-bot": {
@@ -207,25 +183,6 @@
         "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
       }
     },
-    "pvv-doorbell-bot": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "dirtyRev": "cec320746bbf5b5bc6618a145c1a997ebd0b5196-dirty",
-        "dirtyShortRev": "cec3207-dirty",
-        "lastModified": 1724515328,
-        "narHash": "sha256-Vj3ZJkCaLq+6d1LJtl7Hg5f7XV4NDPeNC1xEyu9QkOI=",
-        "type": "git",
-        "url": "file:///home/felixalb/doorbell-matrix-bot"
-      },
-      "original": {
-        "type": "git",
-        "url": "file:///home/felixalb/doorbell-matrix-bot"
-      }
-    },
     "pvv-nettsiden": {
       "inputs": {
         "nixpkgs": [
@@ -233,11 +190,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1722722932,
+        "lastModified": 1741738148,
-        "narHash": "sha256-K81a2GQpY2kRX+C9ek9r91THlZB674CqRTSMMb5IO7E=",
+        "narHash": "sha256-cJo6nbcJEOjkazkZ194NDnlsZe0W0wpxeUh2/886uC8=",
-        "ref": "refs/heads/master",
+        "ref": "refs/heads/main",
-        "rev": "6580cfe546c902cdf11e17b0b8aa30b3c412bb34",
+        "rev": "c1802e7cf27c7cf8b4890354c982a4eef5b11593",
-        "revCount": 465,
+        "revCount": 486,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       },
@@ -249,31 +206,52 @@
     "root": {
       "inputs": {
         "disko": "disko",
-        "grzegorz": "grzegorz",
+        "gergle": "gergle",
+        "greg-ng": "greg-ng",
         "grzegorz-clients": "grzegorz-clients",
         "matrix-next": "matrix-next",
+        "minecraft-data": "minecraft-data",
         "nix-gitea-themes": "nix-gitea-themes",
         "nixpkgs": "nixpkgs",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "pvv-calendar-bot": "pvv-calendar-bot",
-        "pvv-doorbell-bot": "pvv-doorbell-bot",
         "pvv-nettsiden": "pvv-nettsiden",
         "sops-nix": "sops-nix"
       }
     },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "greg-ng",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1746498961,
+        "narHash": "sha256-rp+oh/N88JKHu7ySPuGiA3lBUVIsrOtHbN2eWJdYCgk=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "24b00064cdd1d7ba25200c4a8565dc455dc732ba",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
     "sops-nix": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
-        ],
+        ]
-        "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1715244550,
+        "lastModified": 1745310711,
-        "narHash": "sha256-ffOZL3eaZz5Y1nQ9muC36wBCWwS1hSRLhUzlA9hV2oI=",
+        "narHash": "sha256-ePyTpKEJTgX0gvgNQWd7tQYQ3glIkbqcW778RpHlqgA=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "0dc50257c00ee3c65fef3a255f6564cfbfe6eb7f",
+        "rev": "5e3e92b16d6fdf9923425a8d4df7496b2434f39c",
         "type": "github"
       },
       "original": {
@@ -281,21 +259,6 @@
         "repo": "sops-nix",
         "type": "github"
       }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -2,8 +2,8 @@
   description = "PVV System flake";
 
   inputs = {
-    nixpkgs.url = "nixpkgs/nixos-24.05-small";
+    nixpkgs.url = "https://nixos.org/channels/nixos-24.11-small/nixexprs.tar.xz";
-    nixpkgs-unstable.url = "nixpkgs/nixos-unstable-small";
+    nixpkgs-unstable.url = "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz";
 
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
@@ -17,31 +17,31 @@
     pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
     pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
 
-    pvv-doorbell-bot.url = "git+https://git.pvv.ntnu.no/Projects/doorbell-matrix-bot.git";
+    matrix-next.url = "github:dali99/nixos-matrix-modules/0.7.0";
-    #pvv-doorbell-bot.url = "git+file:///home/felixalb/doorbell-matrix-bot";
-    pvv-doorbell-bot.inputs.nixpkgs.follows = "nixpkgs";
-
-    matrix-next.url = "github:dali99/nixos-matrix-modules/v0.6.0";
     matrix-next.inputs.nixpkgs.follows = "nixpkgs";
 
-    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git";
+    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git";
     nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";
 
-    grzegorz.url = "github:Programvareverkstedet/grzegorz";
+    greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git";
-    grzegorz.inputs.nixpkgs.follows = "nixpkgs-unstable";
+    greg-ng.inputs.nixpkgs.follows = "nixpkgs";
-    grzegorz-clients.url = "github:Programvareverkstedet/grzegorz-clients";
+    gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git";
+    gergle.inputs.nixpkgs.follows = "nixpkgs";
+    grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git";
     grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
+
+    minecraft-data.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git";
   };
 
   outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
   let
-    nixlib = nixpkgs.lib;
+    inherit (nixpkgs) lib;
     systems = [
       "x86_64-linux"
       "aarch64-linux"
       "aarch64-darwin"
     ];
-    forAllSystems = f: nixlib.genAttrs systems f;
+    forAllSystems = f: lib.genAttrs systems f;
     allMachines = builtins.attrNames self.nixosConfigurations;
     importantMachines = [
       "bekkalokk"
@@ -51,16 +51,17 @@
       "ildkule"
     ];
   in {
-    inherit inputs;
+    inputs = lib.mapAttrs (_: src: src.outPath) inputs;
 
     nixosConfigurations = let
       unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
-      nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
+      nixosConfig = nixpkgs: name: config: lib.nixosSystem (lib.recursiveUpdate
         rec {
           system = "x86_64-linux";
           specialArgs = {
-            inherit nixpkgs-unstable inputs;
+            inherit unstablePkgs inputs;
             values = import ./values.nix;
+            fp = path: ./${path};
           };
 
           modules = [
@@ -70,6 +71,11 @@
 
           pkgs = import nixpkgs {
             inherit system;
+            config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
+              [
+                "nvidia-x11"
+                "nvidia-settings"
+              ];
             overlays = [
               # Global overlays go here
             ] ++ config.overlays or [ ];
@@ -85,11 +91,10 @@
         modules = [
           inputs.matrix-next.nixosModules.default
           inputs.pvv-calendar-bot.nixosModules.default
-          inputs.pvv-doorbell-bot.nixosModules.default
+          self.nixosModules.gickup
         ];
         overlays = [
           inputs.pvv-calendar-bot.overlays.x86_64-linux.default
-          inputs.pvv-doorbell-bot.overlays.x86_64-linux.default
         ];
       };
       bekkalokk = stableNixosConfig "bekkalokk" {
@@ -98,12 +103,11 @@
             heimdal = unstablePkgs.heimdal;
             mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions { };
             simplesamlphp = final.callPackage ./packages/simplesamlphp { };
+            bluemap = final.callPackage ./packages/bluemap.nix { };
           })
-          inputs.nix-gitea-themes.overlays.default
           inputs.pvv-nettsiden.overlays.default
         ];
         modules = [
-          inputs.nix-gitea-themes.nixosModules.default
           inputs.pvv-nettsiden.nixosModules.default
         ];
       };
@@ -116,29 +120,65 @@
       ildkule = stableNixosConfig "ildkule" { };
       #ildkule-unstable = unstableNixosConfig "ildkule" { };
       shark = stableNixosConfig "shark" { };
+      wenche = stableNixosConfig "wenche" { };
+
+      kommode = stableNixosConfig "kommode" {
+        overlays = [
+          inputs.nix-gitea-themes.overlays.default
+        ];
+        modules = [
+          inputs.nix-gitea-themes.nixosModules.default
+        ];
+      };
+
+      ustetind = stableNixosConfig "ustetind" {
+        modules = [
+         "${nixpkgs}/nixos/modules/virtualisation/lxc-container.nix"
+        ];
+      };
 
       brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
         modules = [
-          inputs.grzegorz.nixosModules.grzegorz-kiosk
           inputs.grzegorz-clients.nixosModules.grzegorz-webui
+          inputs.gergle.nixosModules.default
+          inputs.greg-ng.nixosModules.default
+        ];
+        overlays = [
+          inputs.greg-ng.overlays.default
+          inputs.gergle.overlays.default
         ];
       };
       georg = stableNixosConfig "georg" {
         modules = [
-          inputs.grzegorz.nixosModules.grzegorz-kiosk
           inputs.grzegorz-clients.nixosModules.grzegorz-webui
+          inputs.gergle.nixosModules.default
+          inputs.greg-ng.nixosModules.default
+        ];
+        overlays = [
+          inputs.greg-ng.overlays.default
+          inputs.gergle.overlays.default
         ];
       };
-      buskerud = stableNixosConfig "buskerud" { };
     };
 
     nixosModules = {
       snakeoil-certs = ./modules/snakeoil-certs.nix;
       snappymail = ./modules/snappymail.nix;
+      robots-txt = ./modules/robots-txt.nix;
+      gickup = ./modules/gickup;
     };
 
     devShells = forAllSystems (system: {
-      default = nixpkgs.legacyPackages.${system}.callPackage ./shell.nix { };
+      default = nixpkgs-unstable.legacyPackages.${system}.callPackage ./shell.nix { };
+      cuda = let
+        cuda-pkgs = import nixpkgs-unstable {
+          inherit system;
+          config = {
+            allowUnfree = true;
+            cudaSupport = true;
+          };
+        };
+      in cuda-pkgs.callPackage ./shells/cuda.nix { };
     });
 
     packages = {
@@ -147,19 +187,19 @@
       in rec {
         default = important-machines;
         important-machines = pkgs.linkFarm "important-machines"
-          (nixlib.getAttrs importantMachines self.packages.x86_64-linux);
+          (lib.getAttrs importantMachines self.packages.x86_64-linux);
         all-machines = pkgs.linkFarm "all-machines"
-          (nixlib.getAttrs allMachines self.packages.x86_64-linux);
+          (lib.getAttrs allMachines self.packages.x86_64-linux);
 
         simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
 
       } //
-      (nixlib.pipe null [
+      (lib.pipe null [
         (_: pkgs.callPackage ./packages/mediawiki-extensions { })
-        (nixlib.flip builtins.removeAttrs ["override" "overrideDerivation"])
+        (lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
-        (nixlib.mapAttrs' (name: nixlib.nameValuePair "mediawiki-${name}"))
+        (lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
       ])
-      // nixlib.genAttrs allMachines
+      // lib.genAttrs allMachines
         (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
     };
   };

hosts/bekkalokk/configuration.nix

@@ -1,22 +1,24 @@
-{ pkgs, values, ... }:
+{ fp, pkgs, values, ... }:
 {
   imports = [
     ./hardware-configuration.nix
 
-    ../../base.nix
+    (fp /base)
-    ../../misc/metrics-exporters.nix
+    (fp /misc/metrics-exporters.nix)
 
-    ./services/gitea/default.nix
+    ./services/bluemap/default.nix
     ./services/idp-simplesamlphp
     ./services/kerberos
     ./services/mediawiki
     ./services/nginx.nix
+    ./services/phpfpm.nix
     ./services/vaultwarden.nix
     ./services/webmail
     ./services/website
+    ./services/well-known
   ];
 
-  sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
+  sops.defaultSopsFile = fp /secrets/bekkalokk/bekkalokk.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   sops.age.generateKey = true;
@@ -31,6 +33,8 @@
     address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
   };
 
+  services.btrfs.autoScrub.enable = true;
+
   # Do not change, even during upgrades.
   # See https://search.nixos.org/options?show=system.stateVersion
   system.stateVersion = "22.11";

hosts/bekkalokk/services/bluemap/default.nix

@@ -0,0 +1,85 @@
+{ config, lib, pkgs, inputs, ... }:
+let
+  vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
+in {
+  imports = [
+    ./module.nix # From danio, pending upstreaming
+  ];
+
+  disabledModules = [ "services/web-apps/bluemap.nix" ];
+
+  sops.secrets."bluemap/ssh-key" = { };
+  sops.secrets."bluemap/ssh-known-hosts" = { };
+
+  services.bluemap = {
+    enable = true;
+    package = pkgs.callPackage ./package.nix { };
+    
+    eula = true;
+    onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
+
+    host = "minecraft.pvv.ntnu.no";
+
+    maps = {
+      "verden" = {
+        settings = {
+          world = vanillaSurvival;
+          sorting = 0;
+          ambient-light = 0.1;
+          cave-detection-ocean-floor = -5;
+          marker-sets = inputs.minecraft-data.map-markers.vanillaSurvival.verden;
+        };
+      };
+      "underverden" = {
+        settings = {
+          world = "${vanillaSurvival}/DIM-1";
+          sorting = 100;
+          sky-color = "#290000";
+          void-color = "#150000";
+          ambient-light = 0.6;
+          world-sky-light = 0;
+          remove-caves-below-y = -10000;
+          cave-detection-ocean-floor = -5;
+          cave-detection-uses-block-light = true;
+          max-y = 90;
+          marker-sets = inputs.minecraft-data.map-markers.vanillaSurvival.underverden;
+        };
+      };
+      "enden" = {
+        settings = {
+          world = "${vanillaSurvival}/DIM1";
+          sorting = 200;
+          sky-color = "#080010";
+          void-color = "#080010";
+          ambient-light = 0.6;
+          world-sky-light = 0;
+          remove-caves-below-y = -10000;
+          cave-detection-ocean-floor = -5;
+        };
+      };
+    };
+  };
+
+  services.nginx.virtualHosts."minecraft.pvv.ntnu.no" = {
+    enableACME = true;
+    forceSSL = true;
+  };
+
+  # TODO: render somewhere else lmao
+  systemd.services."render-bluemap-maps" = {
+    preStart = ''
+      mkdir -p /var/lib/bluemap/world
+      ${pkgs.rsync}/bin/rsync \
+        -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" \
+        -avz --no-owner --no-group \
+        root@innovation.pvv.ntnu.no:/ \
+        ${vanillaSurvival}
+    '';
+    serviceConfig = {
+      LoadCredential = [
+        "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
+        "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
+      ];
+    };
+  };
+}

hosts/bekkalokk/services/bluemap/module.nix

@@ -0,0 +1,351 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.bluemap;
+  format = pkgs.formats.hocon { };
+
+  coreConfig = format.generate "core.conf" cfg.coreSettings;
+  webappConfig = format.generate "webapp.conf" cfg.webappSettings;
+  webserverConfig = format.generate "webserver.conf" cfg.webserverSettings;
+
+  storageFolder = pkgs.linkFarm "storage"
+    (lib.attrsets.mapAttrs' (name: value:
+      lib.nameValuePair "${name}.conf"
+        (format.generate "${name}.conf" value))
+      cfg.storage);
+
+  mapsFolder = pkgs.linkFarm "maps"
+    (lib.attrsets.mapAttrs' (name: value:
+      lib.nameValuePair "${name}.conf"
+        (format.generate "${name}.conf" value.settings))
+      cfg.maps);
+
+  webappConfigFolder = pkgs.linkFarm "bluemap-config" {
+    "maps" = mapsFolder;
+    "storages" = storageFolder;
+    "core.conf" = coreConfig;
+    "webapp.conf" = webappConfig;
+    "webserver.conf" = webserverConfig;
+    "packs" = cfg.resourcepacks;
+  };
+
+  renderConfigFolder = name: value: pkgs.linkFarm "bluemap-${name}-config" {
+    "maps" = pkgs.linkFarm "maps" {
+      "${name}.conf" = (format.generate "${name}.conf" value.settings);
+    };
+    "storages" = storageFolder;
+    "core.conf" = coreConfig;
+    "webapp.conf" = format.generate "webapp.conf" (cfg.webappSettings // { "update-settings-file" = false; });
+    "webserver.conf" = webserverConfig;
+    "packs" = value.resourcepacks;
+  };
+
+  inherit (lib) mkOption;
+in {
+  options.services.bluemap = {
+    enable = lib.mkEnableOption "bluemap";
+    package = lib.mkPackageOption pkgs "bluemap" { };
+
+    eula = mkOption {
+      type = lib.types.bool;
+      description = ''
+        By changing this option to true you confirm that you own a copy of minecraft Java Edition,
+        and that you agree to minecrafts EULA.
+      '';
+      default = false;
+    };
+
+    defaultWorld = mkOption {
+      type = lib.types.path;
+      description = ''
+        The world used by the default map ruleset.
+        If you configure your own maps you do not need to set this.
+      '';
+      example = lib.literalExpression "\${config.services.minecraft.dataDir}/world";
+    };
+
+    enableRender = mkOption {
+      type = lib.types.bool;
+      description = "Enable rendering";
+      default = true;
+    };
+
+    webRoot = mkOption {
+      type = lib.types.path;
+      default = "/var/lib/bluemap/web";
+      description = "The directory for saving and serving the webapp and the maps";
+    };
+
+    enableNginx = mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Enable configuring a virtualHost for serving the bluemap webapp";
+    };
+
+    host = mkOption {
+      type = lib.types.str;
+      default = "bluemap.${config.networking.domain}";
+      defaultText = lib.literalExpression "bluemap.\${config.networking.domain}";
+      description = "Domain to configure nginx for";
+    };
+
+    onCalendar = mkOption {
+      type = lib.types.str;
+      description = ''
+        How often to trigger rendering the map,
+        in the format of a systemd timer onCalendar configuration.
+        See {manpage}`systemd.timer(5)`.
+      '';
+      default = "*-*-* 03:10:00";
+    };
+
+    coreSettings = mkOption {
+      type = lib.types.submodule {
+        freeformType = format.type;
+        options = {
+          data = mkOption {
+            type = lib.types.path;
+            description = "Folder for where bluemap stores its data";
+            default = "/var/lib/bluemap";
+          };
+          metrics = lib.mkEnableOption "Sending usage metrics containing the version of bluemap in use";
+        };
+      };
+      description = "Settings for the core.conf file, [see upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/core.conf).";
+    };
+
+    webappSettings = mkOption {
+      type = lib.types.submodule {
+        freeformType = format.type;
+      };
+      default = {
+        enabled = true;
+        webroot = cfg.webRoot;
+      };
+      defaultText = lib.literalExpression ''
+        {
+          enabled = true;
+          webroot = config.services.bluemap.webRoot;
+        }
+      '';
+      description = "Settings for the webapp.conf file, see [upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/webapp.conf).";
+    };
+
+    webserverSettings = mkOption {
+      type = lib.types.submodule {
+        freeformType = format.type;
+        options = {
+          enabled = mkOption {
+            type = lib.types.bool;
+            description = ''
+              Enable bluemap's built-in webserver.
+              Disabled by default in nixos for use of nginx directly.
+            '';
+            default = false;
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Settings for the webserver.conf file, usually not required.
+        [See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/webserver.conf).
+      '';
+    };
+
+    maps = mkOption {
+      type = lib.types.attrsOf (lib.types.submodule {
+        options = {
+          resourcepacks = mkOption {
+            type = lib.types.path;
+            default = cfg.resourcepacks;
+            defaultText = lib.literalExpression "config.services.bluemap.resourcepacks";
+            description = "A set of resourcepacks/mods/bluemap-addons to extract models from loaded in alphabetical order";
+          };
+          settings = mkOption {
+            type = (lib.types.submodule {
+              freeformType = format.type;
+              options = {
+                world = mkOption {
+                  type = lib.types.path;
+                  description = "Path to world folder containing the dimension to render";
+                };
+              };
+            });
+            description = ''
+              Settings for files in `maps/`.
+              See the default for an example with good options for the different world types.
+              For valid values [consult upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/maps/map.conf).
+            '';
+          };
+        };
+      });
+      default = {
+        "overworld".settings = {
+          world = "${cfg.defaultWorld}";
+          ambient-light = 0.1;
+          cave-detection-ocean-floor = -5;
+        };
+
+        "nether".settings = {
+          world = "${cfg.defaultWorld}/DIM-1";
+          sorting = 100;
+          sky-color = "#290000";
+          void-color = "#150000";
+          ambient-light = 0.6;
+          world-sky-light = 0;
+          remove-caves-below-y = -10000;
+          cave-detection-ocean-floor = -5;
+          cave-detection-uses-block-light = true;
+          max-y = 90;
+        };
+
+        "end".settings = {
+          world = "${cfg.defaultWorld}/DIM1";
+          sorting = 200;
+          sky-color = "#080010";
+          void-color = "#080010";
+          ambient-light = 0.6;
+          world-sky-light = 0;
+          remove-caves-below-y = -10000;
+          cave-detection-ocean-floor = -5;
+        };
+      };
+      defaultText = lib.literalExpression ''
+        {
+          "overworld".settings = {
+            world = "''${cfg.defaultWorld}";
+            ambient-light = 0.1;
+            cave-detection-ocean-floor = -5;
+          };
+
+          "nether".settings = {
+            world = "''${cfg.defaultWorld}/DIM-1";
+            sorting = 100;
+            sky-color = "#290000";
+            void-color = "#150000";
+            ambient-light = 0.6;
+            world-sky-light = 0;
+            remove-caves-below-y = -10000;
+            cave-detection-ocean-floor = -5;
+            cave-detection-uses-block-light = true;
+            max-y = 90;
+          };
+
+          "end".settings = {
+            world = "''${cfg.defaultWorld}/DIM1";
+            sorting = 200;
+            sky-color = "#080010";
+            void-color = "#080010";
+            ambient-light = 0.6;
+            world-sky-light = 0;
+            remove-caves-below-y = -10000;
+            cave-detection-ocean-floor = -5;
+          };
+        };
+      '';
+      description = ''
+        map-specific configuration.
+        These correspond to views in the webapp and are usually
+        different dimension of a world or different render settings of the same dimension.
+        If you set anything in this option you must configure all dimensions yourself!
+      '';
+    };
+
+    storage = mkOption {
+      type = lib.types.attrsOf (lib.types.submodule {
+        freeformType = format.type;
+        options = {
+          storage-type = mkOption {
+            type = lib.types.enum [ "FILE" "SQL" ];
+            description = "Type of storage config";
+            default = "FILE";
+          };
+        };
+      });
+      description = ''
+        Where the rendered map will be stored.
+        Unless you are doing something advanced you should probably leave this alone and configure webRoot instead.
+        [See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/tree/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/storages)
+      '';
+      default = {
+        "file" = {
+          root = "${cfg.webRoot}/maps";
+        };
+      };
+      defaultText = lib.literalExpression ''
+        {
+          "file" = {
+            root = "''${config.services.bluemap.webRoot}/maps";
+          };
+        }
+      '';
+    };
+
+    resourcepacks = mkOption {
+      type = lib.types.path;
+      default = pkgs.linkFarm "resourcepacks" { };
+      description = ''
+        A set of resourcepacks/mods to extract models from loaded in alphabetical order.
+        Can be overriden on a per-map basis with `services.bluemap.maps.<name>.resourcepacks`.
+      '';
+    };
+  };
+
+
+  config = lib.mkIf cfg.enable {
+    assertions =
+      [ { assertion = config.services.bluemap.eula;
+          message = ''
+            You have enabled bluemap but have not accepted minecraft's EULA.
+            You can achieve this through setting `services.bluemap.eula = true`
+          '';
+        }
+      ];
+
+    services.bluemap.coreSettings.accept-download = cfg.eula;
+
+    systemd.services."render-bluemap-maps" = lib.mkIf cfg.enableRender {
+      serviceConfig = {
+        Type = "oneshot";
+        Group = "nginx";
+        UMask = "026";
+      };
+      script = ''
+        # If web folder doesnt exist generate it
+        test -f "${cfg.webRoot}" || ${lib.getExe cfg.package} -c ${webappConfigFolder} -gs
+
+        # Render each minecraft map
+        ${lib.strings.concatStringsSep "\n" (lib.attrsets.mapAttrsToList
+          (name: value: "${lib.getExe cfg.package} -c ${renderConfigFolder name value} -r")
+          cfg.maps)}
+
+        # Generate updated webapp
+        ${lib.getExe cfg.package} -c ${webappConfigFolder} -gs
+      '';
+    };
+
+    systemd.timers."render-bluemap-maps" = lib.mkIf cfg.enableRender {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = cfg.onCalendar;
+        Persistent = true;
+        Unit = "render-bluemap-maps.service";
+      };
+    };
+
+    services.nginx.virtualHosts = lib.mkIf cfg.enableNginx {
+      "${cfg.host}" = {
+        root = config.services.bluemap.webRoot;
+        locations = {
+          "~* ^/maps/[^/]*/tiles/".extraConfig = ''
+            error_page 404 = @empty;
+          '';
+          "@empty".return = "204";
+        };
+      };
+    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ dandellion h7x4 ];
+  };
+}

hosts/bekkalokk/services/bluemap/package.nix

@@ -0,0 +1,30 @@
+{ lib, stdenvNoCC, fetchurl, makeWrapper, jre }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "bluemap";
+  version = "5.7";
+
+  src = fetchurl {
+    url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
+    hash = "sha256-8udZYJgrr4bi2mjRYrASd8JwUoUVZW1tZpOLRgafAIw=";
+  };
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+    makeWrapper ${jre}/bin/java $out/bin/bluemap --add-flags "-jar $src"
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "3D minecraft map renderer";
+    homepage = "https://bluemap.bluecolored.de/";
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dandellion h7x4 ];
+    mainProgram = "bluemap";
+  };
+}

hosts/bekkalokk/services/gitea/gitea-import-users.py

@@ -1,94 +0,0 @@
-import requests
-import secrets
-import os
-
-EMAIL_DOMAIN = os.getenv('EMAIL_DOMAIN')
-if EMAIL_DOMAIN is None:
-    EMAIL_DOMAIN = 'pvv.ntnu.no'
-
-API_TOKEN = os.getenv('API_TOKEN')
-if API_TOKEN is None:
-    raise Exception('API_TOKEN not set')
-
-GITEA_API_URL = os.getenv('GITEA_API_URL')
-if GITEA_API_URL is None:
-    GITEA_API_URL = 'https://git.pvv.ntnu.no/api/v1'
-
-BANNED_SHELLS = [
-    "/usr/bin/nologin",
-    "/usr/sbin/nologin",
-    "/sbin/nologin",
-    "/bin/false",
-    "/bin/msgsh",
-]
-
-existing_users = {}
-
-
-# This function should only ever be called when adding users
-# from the passwd file
-def add_user(username, name):
-    user = {
-            "full_name": name,
-            "username": username,
-            "login_name": username,
-            "source_id": 1,  # 1 = SMTP
-    }
-
-    if username not in existing_users:
-        user["password"] = secrets.token_urlsafe(32)
-        user["must_change_password"] = False
-        user["visibility"] = "private"
-        user["email"] = username + '@' + EMAIL_DOMAIN
-
-        r = requests.post(GITEA_API_URL + '/admin/users', json=user,
-                          headers={'Authorization': 'token ' + API_TOKEN})
-        if r.status_code != 201:
-            print('ERR: Failed to create user ' + username + ': ' + r.text)
-            return
-
-        print('Created user ' + username)
-        existing_users[username] = user
-
-    else:
-        user["visibility"] = existing_users[username]["visibility"]
-        r = requests.patch(GITEA_API_URL + f'/admin/users/{username}',
-                           json=user,
-                           headers={'Authorization': 'token ' + API_TOKEN})
-        if r.status_code != 200:
-            print('ERR: Failed to update user ' + username + ': ' + r.text)
-            return
-
-        print('Updated user ' + username)
-
-
-def main():
-    # Fetch existing users
-    r = requests.get(GITEA_API_URL + '/admin/users',
-                     headers={'Authorization': 'token ' + API_TOKEN})
-
-    if r.status_code != 200:
-        raise Exception('Failed to get users: ' + r.text)
-
-    for user in r.json():
-        existing_users[user['login']] = user
-
-    # Read the file, add each user
-    with open("/tmp/passwd-import", 'r') as f:
-        for line in f.readlines():
-            uid = int(line.split(':')[2])
-            if uid < 1000:
-                continue
-
-            shell = line.split(':')[-1]
-            if shell in BANNED_SHELLS:
-                continue
-
-            username = line.split(':')[0]
-            name = line.split(':')[4].split(',')[0]
-
-            add_user(username, name)
-
-
-if __name__ == '__main__':
-    main()

hosts/bekkalokk/services/idp-simplesamlphp/default.nix

@@ -202,6 +202,12 @@ in
           rewrite ^/simplesaml/(.*)$ /$1 redirect;
           return 404;
         '';
+        "/robots.txt" = {
+          root = pkgs.writeTextDir "robots.txt" ''
+            User-agent: *
+            Disallow: /
+          '';
+        };
       };
     };
   };

hosts/bekkalokk/services/mediawiki/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, lib, config, values, pkgs-unstable, ... }: let
+{ pkgs, lib, fp, config, values, pkgs-unstable, ... }: let
   cfg = config.services.mediawiki;
 
   # "mediawiki"
@@ -61,7 +61,6 @@ in {
       user = "mediawiki";
       passwordFile = config.sops.secrets."mediawiki/postgres_password".path;
       createLocally = false;
-      # TODO: create a normal database and copy over old data when the service is production ready
       name = "mediawiki";
     };
 
@@ -210,16 +209,16 @@ in {
         '';
       };
 
-      "= /PNG/PVV-logo.svg".alias = ../../../../assets/logo_blue_regular.svg;
+      "= /PNG/PVV-logo.svg".alias = fp /assets/logo_blue_regular.svg;
-      "= /PNG/PVV-logo.png".alias = ../../../../assets/logo_blue_regular.png;
+      "= /PNG/PVV-logo.png".alias = fp /assets/logo_blue_regular.png;
       "= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
         buildInputs = with pkgs; [ imagemagick ];
       } ''
-        convert \
+        magick \
+          ${fp /assets/logo_blue_regular.png} \
           -resize x64 \
           -gravity center \
           -crop 64x64+0+0 \
-          ${../../../../assets/logo_blue_regular.png} \
           -flatten \
           -colors 256 \
           -background transparent \

hosts/bekkalokk/services/phpfpm.nix

@@ -0,0 +1,51 @@
+{ lib, ... }:
+let
+  pools = map (pool: "phpfpm-${pool}") [
+    "idp"
+    "mediawiki"
+    "pvv-nettsiden"
+    "roundcube"
+    "snappymail"
+  ];
+in
+{
+  # Source: https://www.pierreblazquez.com/2023/06/17/how-to-harden-apache-php-fpm-daemons-using-systemd/
+  systemd.services = lib.genAttrs pools (_: {
+    serviceConfig = let
+      caps = [
+        "CAP_NET_BIND_SERVICE"
+        "CAP_SETGID"
+        "CAP_SETUID"
+        "CAP_CHOWN"
+        "CAP_KILL"
+        "CAP_IPC_LOCK"
+        "CAP_DAC_OVERRIDE"
+      ];
+    in {
+      AmbientCapabilities = caps;
+      CapabilityBoundingSet = caps;
+      DeviceAllow = [ "" ];
+      LockPersonality = true;
+      MemoryDenyWriteExecute = false;
+      NoNewPrivileges = true;
+      PrivateMounts = true;
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      RemoveIPC = true;
+      UMask = "0077";
+      RestrictNamespaces = "~mnt";
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      KeyringMode = "private";
+      SystemCallFilter = [
+        "@system-service"
+      ];
+    };
+  });
+}

hosts/bekkalokk/services/vaultwarden.nix

@@ -65,4 +65,38 @@ in {
       proxyWebsockets = true;
     };
   };
+
+  systemd.services.vaultwarden = lib.mkIf cfg.enable {
+    serviceConfig = {
+      AmbientCapabilities = [ "" ];
+      CapabilityBoundingSet = [ "" ];
+      DeviceAllow = [ "" ];
+      LockPersonality = true;
+      NoNewPrivileges = true;
+      # MemoryDenyWriteExecute = true;
+      PrivateMounts = true;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RemoveIPC = true;
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+      ];
+    };
+  };
 }

hosts/bekkalokk/services/webmail/roundcube.nix

@@ -6,6 +6,11 @@ let
   domain = "webmail.pvv.ntnu.no";
 in
 {
+  sops.secrets."roundcube/postgres_password" = {
+    owner = "nginx";
+    group = "nginx";
+  };
+
   services.roundcube = {
     enable = true;
 
@@ -16,10 +21,15 @@ in
       custom_from
     ]);
 
-    dicts = with pkgs.aspellDicts; [ en en-science en-computers nb nn fr de it ];
+    dicts = with pkgs.aspellDicts; [ en en-computers nb nn fr de it ];
     maxAttachmentSize = 20;
     hostName = "roundcubeplaceholder.example.com";
 
+    database = {
+      host = "postgres.pvv.ntnu.no";
+      passwordFile = config.sops.secrets."roundcube/postgres_password".path;
+    };
+
     extraConfig = ''
       $config['enable_installer'] = false;
       $config['default_host'] = "ssl://imap.pvv.ntnu.no";

hosts/bekkalokk/services/webmail/snappymail.nix

@@ -1,8 +1,8 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, fp, pkgs, ... }:
 let
   cfg = config.services.snappymail;
 in {
-  imports = [ ../../../../modules/snappymail.nix ];
+  imports = [ (fp /modules/snappymail.nix) ];
 
   services.snappymail = {
     enable = true;

hosts/bekkalokk/services/website/default.nix

@@ -67,7 +67,12 @@ in {
         ADMIN_NAME = "PVV Drift";
         ADMIN_EMAIL = "drift@pvv.ntnu.no";
         ADMIN_PASSWORD = includeFromSops "simplesamlphp/admin_password";
-        TRUSTED_DOMAINS = [ cfg.domainName ];
+        TRUSTED_DOMAINS = [
+          "www.pvv.ntnu.no"
+          "pvv.ntnu.no"
+          "www.pvv.org"
+          "pvv.org"
+        ];
       };
     };
   };
@@ -116,16 +121,6 @@ in {
       "/drift".return = "301 https://wiki.pvv.ntnu.no/wiki/Drift";
       "/diverse/abuse.php".return = "301 https://wiki.pvv.ntnu.no/wiki/CERT/Abuse";
       "/nerds/".return = "301 https://wiki.pvv.ntnu.no/wiki/Nerdepizza";
-
-      # Proxy the matrix well-known files
-      # Host has be set before proxy_pass
-      # The header must be set so nginx on the other side routes it to the right place
-      "^~ /.well-known/matrix/" = {
-        extraConfig = ''
-          proxy_set_header Host matrix.pvv.ntnu.no;
-          proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
-        '';
-      };
     };
   };
 }

hosts/bekkalokk/services/website/fetch-gallery.nix

@@ -53,7 +53,7 @@ in {
 
         echo "Creating thumbnail for $fname"
         mkdir -p $(dirname ".thumbnails/$fname")
-        convert -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
+        magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
         touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
       done <<< "$images"
     '';
@@ -62,6 +62,33 @@ in {
       WorkingDirectory = galleryDir;
       User = config.services.pvv-nettsiden.user;
       Group = config.services.pvv-nettsiden.group;
+
+      AmbientCapabilities = [ "" ];
+      CapabilityBoundingSet = [ "" ];
+      DeviceAllow = [ "" ];
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true; # disable for third party rotate scripts
+      PrivateDevices = true;
+      PrivateNetwork = true; # disable for mail delivery
+      PrivateTmp = true;
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true; # disable for userdir logs
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "full";
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true; # disable for creating setgid directories
+      SocketBindDeny = [ "any" ];
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+      ];
     };
   };
 }

hosts/bekkalokk/services/well-known/default.nix

@@ -0,0 +1,18 @@
+{ ... }:
+{
+  services.nginx.virtualHosts."www.pvv.ntnu.no".locations = {
+    "^~ /.well-known/" = {
+      alias = (toString ./root) + "/";
+    };
+
+    # Proxy the matrix well-known files
+    # Host has be set before proxy_pass
+    # The header must be set so nginx on the other side routes it to the right place
+    "^~ /.well-known/matrix/" = {
+      extraConfig = ''
+        proxy_set_header Host matrix.pvv.ntnu.no;
+        proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
+      '';
+    };
+  };
+}

hosts/bekkalokk/services/well-known/root/autoconfig/mail/config-v1.1.xml

@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+<clientConfig version="1.1">
+  <emailProvider id="pvv.ntnu.no">
+    <domain>pvv.ntnu.no</domain>
+    <domain>pvv.org</domain>
+
+    <displayName>Programvareverkstedet</displayName>
+
+    <incomingServer type="imap">
+      <hostname>imap.pvv.ntnu.no</hostname>
+      <port>993</port>
+      <socketType>SSL</socketType>
+      <username>%EMAILLOCALPART%</username>
+      <authentication>password-cleartext</authentication>
+    </incomingServer>
+
+    <outgoingServer type="smtp">
+      <hostname>smtp.pvv.ntnu.no</hostname>
+      <port>587</port>
+      <socketType>STARTTLS</socketType>
+      <username>%EMAILLOCALPART%</username>
+      <authentication>password-cleartext</authentication>
+      <useGlobalPreferredServer>true</useGlobalPreferredServer>
+    </outgoingServer>
+
+    <documentation url="https://www.pvv.ntnu.no/pvv/Drift/Mail/IMAP_POP3">
+       <descr lang="en">Setup programvareverkstedet email user with IMAP or POP3</descr>
+       <descr lang="nb">Sett opp programvareverkstedet email bruker med IMAP eller POP3</descr>
+    </documentation>
+  </emailProvider>
+</clientConfig>

hosts/bekkalokk/services/well-known/root/security.txt

@@ -0,0 +1,12 @@
+Contact: mailto:drift@pvv.ntnu.no
+Contact: mailto:cert@pvv.ntnu.no
+# drift@pvv.ntnu.no is read by more people and have a quicker reaction time,
+# but cert@pvv.ntnu.no can be used for more severe issues.
+
+Preferred-Languages: no, en
+
+Expires: 2032-12-31T23:59:59.000Z
+# This file was last updated 2024-09-14.
+
+# You can find a wikipage for our security policies at:
+# https://wiki.pvv.ntnu.no/wiki/CERT

hosts/bicep/acmeCert.nix

@@ -1,24 +0,0 @@
-{ values, ... }:
-{
-  users.groups.acme.members = [ "nginx" ];
-
-  security.acme.certs."postgres.pvv.ntnu.no" = {
-    group = "acme";
-    extraDomainNames = [
-      # "postgres.pvv.org"
-      "bicep.pvv.ntnu.no"
-      # "bicep.pvv.org"
-      # values.hosts.bicep.ipv4
-      # values.hosts.bicep.ipv6
-    ];
-  };
-
-  services.nginx = {
-    enable = true;
-    virtualHosts."postgres.pvv.ntnu.no" = {
-      forceSSL = true;
-      enableACME = true;
-      # useACMEHost = "postgres.pvv.ntnu.no";
-    };
-  };
-}

hosts/bicep/configuration.nix

@@ -1,24 +1,21 @@
-{ pkgs, values, ... }:
+{ fp, pkgs, values, ... }:
 {
   imports = [
     ./hardware-configuration.nix
 
-    ../../base.nix
+    (fp /base)
-    ../../misc/metrics-exporters.nix
+    (fp /misc/metrics-exporters.nix)
     ./services/nginx
 
-    ./acmeCert.nix
-
     ./services/calendar-bot.nix
-    ./services/doorbell-bot.nix
+    ./services/git-mirrors
-    ./services/mysql.nix
     ./services/mysql.nix
     ./services/postgres.nix
 
     ./services/matrix
   ];
 
-  sops.defaultSopsFile = ../../secrets/bicep/bicep.yaml;
+  sops.defaultSopsFile = fp /secrets/bicep/bicep.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   sops.age.generateKey = true;
@@ -37,6 +34,9 @@
     anyInterface = true;
   };
 
+  # There are no smart devices
+  services.smartd.enable = false;
+
   # Do not change, even during upgrades.
   # See https://search.nixos.org/options?show=system.stateVersion
   system.stateVersion = "22.11";

hosts/bicep/services/calendar-bot.nix

@@ -1,16 +1,16 @@
-{ config, lib, pkgs, ... }:
+{ config, fp, lib, pkgs, ... }:
 let
   cfg = config.services.pvv-calendar-bot;
 in {
   sops.secrets = {
     "calendar-bot/matrix_token" = {
-      sopsFile = ../../../secrets/bicep/bicep.yaml;
+      sopsFile = fp /secrets/bicep/bicep.yaml;
       key = "calendar-bot/matrix_token";
       owner = cfg.user;
       group = cfg.group;
     };
     "calendar-bot/mysql_password" = {
-      sopsFile = ../../../secrets/bicep/bicep.yaml;
+      sopsFile = fp /secrets/bicep/bicep.yaml;
       key = "calendar-bot/mysql_password";
       owner = cfg.user;
       group = cfg.group;

hosts/bicep/services/doorbell-bot.nix

@@ -1,16 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.pvv-doorbell-bot;
-in {
-  sops.secrets."doorbell-bot/config-json" = {
-    owner = cfg.user;
-    group = cfg.group;
-  };
-
-  services.pvv-doorbell-bot = {
-    enable = true;
-    settings = {
-      configFile = config.sops.secrets."doorbell-bot/config-json".path;
-    };
-  };
-}

hosts/bicep/services/git-mirrors/default.nix

@@ -0,0 +1,100 @@
+{ config, pkgs, lib, fp, ... }:
+let
+  cfg = config.services.gickup;
+in
+{
+  sops.secrets."gickup/github-token" = {
+    owner = "gickup";
+  };
+
+  services.gickup = {
+    enable = true;
+
+    dataDir = "/data/gickup";
+
+    destinationSettings = {
+      structured = true;
+      zip = false;
+      keep = 10;
+      bare = true;
+      lfs = false;
+    };
+
+    instances = let
+      defaultGithubConfig = {
+        settings.token_file = config.sops.secrets."gickup/github-token".path;
+      };
+      defaultGitlabConfig = {
+        # settings.token_file = ...
+      };
+    in {
+      "github:Git-Mediawiki/Git-Mediawiki" = defaultGithubConfig;
+      "github:NixOS/nixpkgs" = defaultGithubConfig;
+      "github:go-gitea/gitea" = defaultGithubConfig;
+      "github:heimdal/heimdal" = defaultGithubConfig;
+      "github:saltstack/salt" = defaultGithubConfig;
+      "github:typst/typst" = defaultGithubConfig;
+      "github:unmojang/FjordLauncher" = defaultGithubConfig;
+      "github:unmojang/drasl" = defaultGithubConfig;
+      "github:yushijinhun/authlib-injector" = defaultGithubConfig;
+
+      "gitlab:mx-puppet/discord/better-discord.js" = defaultGitlabConfig;
+      "gitlab:mx-puppet/discord/discord-markdown" = defaultGitlabConfig;
+      "gitlab:mx-puppet/discord/matrix-discord-parser" = defaultGitlabConfig;
+      "gitlab:mx-puppet/discord/mx-puppet-discord" = defaultGitlabConfig;
+      "gitlab:mx-puppet/mx-puppet-bridge" = defaultGitlabConfig;
+
+      "any:glibc" = {
+        settings.url = "https://sourceware.org/git/glibc.git";
+      };
+
+      "any:out-of-your-element" = {
+        settings.url = "https://gitdab.com/cadence/out-of-your-element.git";
+      };
+
+      "any:out-of-your-element-module" = {
+        settings.url = "https://cgit.rory.gay/nix/OOYE-module.git";
+      };
+    };
+  };
+
+  services.cgit = let
+    domain = "mirrors.pvv.ntnu.no";
+  in {
+    ${domain} = {
+      enable = true;
+      package = pkgs.callPackage (fp /packages/cgit.nix) { };
+      group = "gickup";
+      scanPath = "${cfg.dataDir}/linktree";
+      settings = {
+        enable-commit-graph = true;
+        enable-follow-links = true;
+        enable-http-clone = true;
+        enable-remote-branches = true;
+        clone-url = "https://${domain}/$CGIT_REPO_URL";
+        remove-suffix = true;
+        root-title = "PVVSPPP";
+        root-desc = "PVV Speiler Praktisk og Prominent Programvare";
+        snapshots = "all";
+        logo = "/PVV-logo.png";
+      };
+    };
+  };
+
+  services.nginx.virtualHosts."mirrors.pvv.ntnu.no" = {
+    forceSSL = true;
+    enableACME = true;
+
+    locations."= /PVV-logo.png".alias = let
+      small-pvv-logo = pkgs.runCommandLocal "pvv-logo-96x96" {
+        nativeBuildInputs = [ pkgs.imagemagick ];
+      } ''
+        magick '${fp /assets/logo_blue_regular.svg}' -resize 96x96 PNG:"$out"
+      '';
+    in toString small-pvv-logo;
+  };
+
+  systemd.services."fcgiwrap-cgit-mirrors.pvv.ntnu.no" = {
+    serviceConfig.BindReadOnlyPaths = [ cfg.dataDir ];
+  };
+}

hosts/bicep/services/matrix/coturn.nix

@@ -1,14 +1,14 @@
-{ config, lib, pkgs, secrets, ... }:
+{ config, lib, fp, pkgs, secrets, values, ... }:
 
 {
   sops.secrets."matrix/synapse/turnconfig" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "synapse/turnconfig";
     owner = config.users.users.matrix-synapse.name;
     group = config.users.users.matrix-synapse.group;
   };
   sops.secrets."matrix/coturn/static-auth-secret" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "coturn/static-auth-secret";
     owner = config.users.users.turnserver.name;
     group = config.users.users.turnserver.group;
@@ -48,6 +48,9 @@
 
   users.users.turnserver.extraGroups = [ "acme" ];
 
+  # It needs this to be allowed to access the files with the acme group
+  systemd.services.coturn.serviceConfig.PrivateUsers = lib.mkForce false;
+
   systemd.services."acme-${config.services.coturn.realm}".serviceConfig = {
     AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
   };
@@ -60,12 +63,14 @@
     pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
 
     use-auth-secret = true;
-    # World readable but I  dont think it's that bad
     static-auth-secret-file = config.sops.secrets."matrix/coturn/static-auth-secret".path;
 
     secure-stun = true;
 
-    listening-ips = [ "129.241.210.213" "2001:700:300:1900::213" ];
+    listening-ips = [
+      values.services.turn.ipv4
+      values.services.turn.ipv6
+    ];
 
     tls-listening-port = 443;
     alt-tls-listening-port = 5349;

hosts/bicep/services/matrix/default.nix

@@ -10,6 +10,7 @@
     ./mjolnir.nix
 
     ./discord.nix
+    ./hookshot
   ];
 
 

hosts/bicep/services/matrix/discord.nix

@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, lib, fp, ... }:
 
 let
   cfg = config.services.mx-puppet-discord;
@@ -6,15 +6,42 @@ in
 {
   users.groups.keys-matrix-registrations = { };
 
-  sops.secrets."matrix/registrations/mx-puppet-discord" = {
+  sops.secrets."matrix/discord/as_token" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
-    key = "registrations/mx-puppet-discord";
+    key = "discord/as_token";
+  };
+  sops.secrets."matrix/discord/hs_token" = {
+    sopsFile = fp /secrets/bicep/matrix.yaml;
+    key = "discord/hs_token";
+  };
+
+  sops.templates."discord-registration.yaml" = {
     owner = config.users.users.matrix-synapse.name;
     group = config.users.groups.keys-matrix-registrations.name;
+    content = ''
+      as_token: "${config.sops.placeholder."matrix/discord/as_token"}"
+      hs_token: "${config.sops.placeholder."matrix/discord/hs_token"}"
+      id: discord-puppet
+      namespaces:
+        users:
+          - exclusive: true
+            regex: '@_discordpuppet_.*'
+        rooms: []
+        aliases:
+          - exclusive: true
+            regex: '#_discordpuppet_.*'
+      protocols: []
+      rate_limited: false
+      sender_localpart: _discordpuppet_bot
+      url: 'http://localhost:8434'
+      de.sorunome.msc2409.push_ephemeral: true
+    '';
   };
 
   systemd.services.mx-puppet-discord = {
-    serviceConfig.SupplementaryGroups = [ config.users.groups.keys-matrix-registrations.name ];
+    serviceConfig.SupplementaryGroups = [
+      config.users.groups.keys-matrix-registrations.name
+    ];
   };
 
 
@@ -29,11 +56,16 @@ in
     relay.whitelist = [ ".*" ];
     selfService.whitelist = [ "@danio:pvv\\.ntnu\\.no" "@dandellion:dodsorf\\.as" ];
   };
-  services.mx-puppet-discord.serviceDependencies = [ "matrix-synapse.target" "nginx.service" ];
+  services.mx-puppet-discord.serviceDependencies = [
+    "matrix-synapse.target"
+    "nginx.service"
+  ];
 
 
   services.matrix-synapse-next.settings = {
-    app_service_config_files = [ config.sops.secrets."matrix/registrations/mx-puppet-discord".path ];
+    app_service_config_files = [
+      config.sops.templates."discord-registration.yaml".path
+    ];
     use_appservice_legacy_authorization = true;
   };
 

hosts/bicep/services/matrix/hookshot/default.nix

@@ -0,0 +1,135 @@
+{ config, lib, fp, unstablePkgs, inputs, ... }:
+
+let
+  cfg = config.services.matrix-hookshot;
+  webhookListenAddress = "127.0.0.1";
+  webhookListenPort = 8435;
+in
+{
+  sops.secrets."matrix/hookshot/as_token" = {
+    sopsFile = fp /secrets/bicep/matrix.yaml;
+    key = "hookshot/as_token";
+  };
+  sops.secrets."matrix/hookshot/hs_token" = {
+    sopsFile = fp /secrets/bicep/matrix.yaml;
+    key = "hookshot/hs_token";
+  };
+
+  sops.templates."hookshot-registration.yaml" = {
+    owner = config.users.users.matrix-synapse.name;
+    group = config.users.groups.keys-matrix-registrations.name;
+    content = ''
+      id: matrix-hookshot
+      as_token: "${config.sops.placeholder."matrix/hookshot/as_token"}"
+      hs_token: "${config.sops.placeholder."matrix/hookshot/hs_token"}"
+      namespaces:
+        rooms: []
+        users:
+          - regex: "@_webhooks_.*:pvv.ntnu.no"
+            exclusive: true
+          - regex: "@bot_feeds:pvv.ntnu.no"
+            exclusive: true
+        aliases: []
+
+      sender_localpart: hookshot
+      url: "http://${cfg.settings.bridge.bindAddress}:${toString cfg.settings.bridge.port}"
+      rate_limited: false
+
+      # If enabling encryption
+      de.sorunome.msc2409.push_ephemeral: true
+      push_ephemeral: true
+      org.matrix.msc3202: true
+    '';
+  };
+
+  systemd.services.matrix-hookshot = {
+    serviceConfig.SupplementaryGroups = [
+      config.users.groups.keys-matrix-registrations.name
+    ];
+  };
+
+  services.matrix-hookshot = {
+    enable = true;
+    package = unstablePkgs.matrix-hookshot;
+    registrationFile = config.sops.templates."hookshot-registration.yaml".path;
+    settings = {
+      bridge = {
+        bindAddress = "127.0.0.1";
+        domain = "pvv.ntnu.no";
+        url = "https://matrix.pvv.ntnu.no";
+        mediaUrl = "https://matrix.pvv.ntnu.no";
+        port = 9993;
+      };
+      listeners = [
+        {
+          bindAddress = webhookListenAddress;
+          port = webhookListenPort;
+          resources = [
+            "webhooks"
+            # "metrics"
+            # "provisioning"
+            "widgets"
+          ];
+        }
+      ];
+      generic = {
+        enabled = true;
+        outbound = true;
+        urlPrefix = "https://hookshot.pvv.ntnu.no/webhook/";
+        userIdPrefix = "_webhooks_";
+        allowJsTransformationFunctions = false;
+        waitForComplete = false;
+      };
+      feeds = {
+        enabled = true;
+        pollIntervalSeconds = 600;
+      };
+      
+      serviceBots = [
+        { localpart = "bot_feeds";
+          displayname = "Aya";
+          avatar = ./feeds.png;
+          prefix = "!aya";
+          service = "feeds";
+        }
+      ];
+
+      permissions = [
+        # Users of the PVV Server
+        { actor = "pvv.ntnu.no";
+          services = [ { service = "*"; level = "commands"; } ];
+        }
+        # Members of Medlem space (for people with their own hs)
+        { actor = "!pZOTJQinWyyTWaeOgK:pvv.ntnu.no";
+          services = [ { service = "*"; level = "commands"; } ];
+        }
+        # Members of Drift
+        { actor = "!eYgeufLrninXxQpYml:pvv.ntnu.no";
+          services = [ { service = "*"; level = "admin"; } ];
+        }
+        # Dan bootstrap
+        { actor = "@dandellion:dodsorf.as";
+          services = [ { service = "*"; level = "admin"; } ];
+        }
+      ];
+    };
+  };
+
+  services.matrix-hookshot.serviceDependencies = [
+    "matrix-synapse.target"
+    "nginx.service"
+  ];
+
+  services.matrix-synapse-next.settings = {
+    app_service_config_files = [
+      config.sops.templates."hookshot-registration.yaml".path
+    ];
+  };
+
+  services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://${webhookListenAddress}:${toString webhookListenPort}";
+    };
+  };
+}

hosts/bicep/services/matrix/mjolnir.nix

@@ -1,8 +1,8 @@
-{ config, lib, ... }:
+{ config, lib, fp, ... }:
 
 {
   sops.secrets."matrix/mjolnir/access_token" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "mjolnir/access_token";
     owner = config.users.users.mjolnir.name;
     group = config.users.users.mjolnir.group;
@@ -11,7 +11,7 @@
   services.mjolnir = {
     enable = true;
     pantalaimon.enable = false;
-    homeserverUrl = "http://127.0.0.1:8008";
+    homeserverUrl = "https://matrix.pvv.ntnu.no";
     accessTokenFile = config.sops.secrets."matrix/mjolnir/access_token".path;
     managementRoom = "!gsdeCoWjvYRBrzuiRq:pvv.ntnu.no";
     protectedRooms = map (a: "https://matrix.to/#/${a}") [

hosts/bicep/services/matrix/synapse.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, values, inputs, ... }:
+{ config, lib, fp, pkgs, values, inputs, ... }:
 
 let
   cfg = config.services.matrix-synapse-next;
@@ -10,23 +10,18 @@ let
 in {
   sops.secrets."matrix/synapse/signing_key" = {
     key = "synapse/signing_key";
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     owner = config.users.users.matrix-synapse.name;
     group = config.users.users.matrix-synapse.group;
   };
 
   sops.secrets."matrix/synapse/user_registration" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "synapse/signing_key";
     owner = config.users.users.matrix-synapse.name;
     group = config.users.users.matrix-synapse.group;
   };
 
-  sops.secrets."matrix/sliding-sync/env" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
-    key = "sliding-sync/env";
-  };
-
   services.matrix-synapse-next = {
     enable = true;
 
@@ -43,8 +38,6 @@ in {
     workers.eventPersisters = 2;
     workers.useUserDirectoryWorker = true;
 
-    enableSlidingSync = true;
-
     enableNginx = true;
 
     settings = {
@@ -137,9 +130,6 @@ in {
     };
   };
 
-  services.matrix-synapse.sliding-sync.environmentFile = config.sops.secrets."matrix/sliding-sync/env".path;
-
-
   services.redis.servers."".enable = true;
 
   services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
@@ -157,6 +147,18 @@ in {
       '';
     };
   }
+  {
+    locations."/_synapse/admin" = {
+      proxyPass = "http://$synapse_backend";
+      extraConfig = ''
+        allow 127.0.0.1;
+        allow ::1;
+        allow ${values.hosts.bicep.ipv4};
+        allow ${values.hosts.bicep.ipv6};
+        deny all;
+      '';
+    };
+  }
   {
     locations = let
       connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
@@ -170,8 +172,6 @@ in {
         extraConfig = ''
           allow ${values.hosts.ildkule.ipv4};
           allow ${values.hosts.ildkule.ipv6};
-          allow ${values.hosts.ildkule.ipv4_global};
-          allow ${values.hosts.ildkule.ipv6_global};
           deny all;
         '';
       })
@@ -183,8 +183,6 @@ in {
       extraConfig = ''
         allow ${values.hosts.ildkule.ipv4};
         allow ${values.hosts.ildkule.ipv6};
-        allow ${values.hosts.ildkule.ipv4_global};
-        allow ${values.hosts.ildkule.ipv6_global};
         deny all;
       '';
     };

hosts/bicep/services/postgres.nix

@@ -1,7 +1,4 @@
 { config, pkgs, ... }:
-let
-  sslCert = config.security.acme.certs."postgres.pvv.ntnu.no";
-in
 {
   services.postgresql = {
     enable = true;
@@ -79,12 +76,16 @@ in
 
   systemd.services.postgresql.serviceConfig = {
     LoadCredential = [
-      "cert:${sslCert.directory}/cert.pem"
+      "cert:/etc/certs/postgres.crt"
-      "key:${sslCert.directory}/key.pem"
+      "key:/etc/certs/postgres.key"
     ];
   };
 
-  users.groups.acme.members = [ "postgres" ];
+  environment.snakeoil-certs."/etc/certs/postgres" = {
+    owner = "postgres";
+    group = "postgres";
+    subject = "/C=NO/O=Programvareverkstedet/CN=postgres.pvv.ntnu.no/emailAddress=drift@pvv.ntnu.no";
+  };
 
   networking.firewall.allowedTCPPorts = [ 5432 ];
   networking.firewall.allowedUDPPorts = [ 5432 ];

hosts/bob/configuration.nix

@@ -1,16 +1,16 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
   imports = [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ../../base.nix
+      (fp /base)
-      ../../misc/metrics-exporters.nix
+      (fp /misc/metrics-exporters.nix)
       ./disks.nix
 
-      ../../misc/builder.nix
+      (fp /misc/builder.nix)
     ];
 
-  sops.defaultSopsFile = ../../secrets/bob/bob.yaml;
+  sops.defaultSopsFile = fp /secrets/bob/bob.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   sops.age.generateKey = true;

hosts/brzeczyszczykiewicz/configuration.nix

@@ -1,10 +1,10 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
   imports = [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ../../base.nix
+      (fp /base)
-      ../../misc/metrics-exporters.nix
+      (fp /misc/metrics-exporters.nix)
 
       ./services/grzegorz.nix
     ];

hosts/brzeczyszczykiewicz/services/grzegorz.nix

@@ -1,6 +1,6 @@
-{ config, ... }:
+{ config, fp, ... }:
 {
-  imports = [ ../../../modules/grzegorz.nix ];
+  imports = [ (fp /modules/grzegorz.nix) ];
 
   services.nginx.virtualHosts."${config.networking.fqdn}" = {
     serverAliases = [

hosts/buskerud/configuration.nix

@@ -1,38 +0,0 @@
-{ config, pkgs, values, ... }:
-{
-  imports = [
-    ./hardware-configuration.nix
-    ../../base.nix
-    ../../misc/metrics-exporters.nix
-
-    ./services/libvirt.nix
-  ];
-
-  # buskerud does not support efi?
-  # boot.loader.systemd-boot.enable = true;
-  # boot.loader.efi.canTouchEfiVariables = true;
-  boot.loader.grub.enable = true;
-  boot.loader.grub.device = "/dev/sdb";
-
-  networking.hostName = "buskerud";
-  networking.search = [ "pvv.ntnu.no" "pvv.org" ];
-  networking.nameservers = [ "129.241.0.200" "129.241.0.201" ];
-  networking.tempAddresses = "disabled";
-
-  systemd.network.networks."enp3s0f0" = values.defaultNetworkConfig // {
-    matchConfig.Name = "enp3s0f0";
-    address = with values.hosts.buskerud; [ (ipv4 + "/25") (ipv6 + "/64") ];
-  };
-
-  # List packages installed in system profile
-  environment.systemPackages = with pkgs; [
-  ];
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.05"; # Did you read the comment?
-}

hosts/buskerud/hardware-configuration.nix

@@ -1,37 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ata_piix" "hpsa" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/ed9654fe-575a-4fb3-b6ff-1b059479acff";
-      fsType = "ext4";
-    };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp14s0f0.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp14s0f1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp3s0f0.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp3s0f1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp4s0f0.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp4s0f1.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/buskerud/services/libvirt.nix

@@ -1,10 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  virtualisation.libvirtd.enable = true;
-  programs.dconf.enable = true;
-  boot.kernelModules = [ "kvm-intel" ];
-
-  # On a gui-enabled machine, connect with:
-  # $ virt-manager --connect "qemu+ssh://buskerud/system?socket=/var/run/libvirt/libvirt-sock"
-}
-

hosts/georg/configuration.nix

@@ -1,14 +1,14 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
   imports = [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ../../base.nix
+      (fp /base)
-      ../../misc/metrics-exporters.nix
+      (fp /misc/metrics-exporters.nix)
 
-      ../../modules/grzegorz.nix
+      (fp /modules/grzegorz.nix)
     ];
-
+  services.spotifyd.enable = true;
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 

hosts/ildkule/configuration.nix

@@ -1,16 +1,16 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, lib, values, ... }:
 {
   imports = [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ../../base.nix
+      (fp /base)
-      ../../misc/metrics-exporters.nix
+      (fp /misc/metrics-exporters.nix)
 
       ./services/monitoring
       ./services/nginx
     ];
 
-  sops.defaultSopsFile = ../../secrets/ildkule/ildkule.yaml;
+  sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   sops.age.generateKey = true;
@@ -19,33 +19,37 @@
   boot.tmp.cleanOnBoot = true;
   zramSwap.enable = true;
 
-  networking.hostName = "ildkule"; # Define your hostname.
+  # Openstack Neutron and systemd-networkd are not best friends, use something else:
+  systemd.network.enable = lib.mkForce false;
+  networking = let
+    hostConf = values.hosts.ildkule;
+  in {
+    hostName = "ildkule";
+    tempAddresses = "disabled";
+    useDHCP = lib.mkForce true;
 
-  # Main connection, using the global/floatig IP, for communications with the world
+    search = values.defaultNetworkConfig.domains;
-  systemd.network.networks."30-ntnu-global" = values.openstackGlobalNetworkConfig // {
+    nameservers = values.defaultNetworkConfig.dns;
-    matchConfig.Name = "ens4";
+    defaultGateway.address = hostConf.ipv4_internal_gw;
 
-    # Add the global addresses in addition to the local address learned from DHCP
+    interfaces."ens4" = {
-    addresses = [
+      ipv4.addresses = [
-      { addressConfig.Address = "${values.hosts.ildkule.ipv4_global}/32"; }
+        { address = hostConf.ipv4;          prefixLength = 32; }
-      { addressConfig.Address = "${values.hosts.ildkule.ipv6_global}/128"; }
+        { address = hostConf.ipv4_internal; prefixLength = 24; }
-    ];
+      ];
-  };
+      ipv6.addresses = [
-
+        { address = hostConf.ipv6;          prefixLength = 64; }
-  # Secondary connection only for use within the university network
+      ];
-  systemd.network.networks."40-ntnu-internal" = values.openstackLocalNetworkConfig // {
+    };
-    matchConfig.Name = "ens3";
-    # Add the ntnu-internal addresses in addition to the local address learned from DHCP
-    addresses = [
-      { addressConfig.Address = "${values.hosts.ildkule.ipv4}/32"; }
-      { addressConfig.Address = "${values.hosts.ildkule.ipv6}/128"; }
-    ];
   };
 
   # List packages installed in system profile
   environment.systemPackages = with pkgs; [
   ];
 
+  # No devices with SMART
+  services.smartd.enable = false;
+
   system.stateVersion = "23.11"; # Did you read the comment?
 
 }

hosts/ildkule/hardware-configuration.nix

@@ -3,7 +3,14 @@
   imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
   boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
   boot.initrd.kernelModules = [ "nvme" ];
-  fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/e35eb4ce-aac3-4f91-8383-6e7cd8bbf942";
+    fsType = "ext4";
+  };
+  fileSystems."/data" = {
+    device = "/dev/disk/by-uuid/0a4c1234-02d3-4b53-aeca-d95c4c8d534b";
+    fsType = "ext4";
+  };
 
   networking.useDHCP = lib.mkDefault true;
 }

hosts/ildkule/services/monitoring/grafana.nix

@@ -56,13 +56,12 @@ in {
           url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
           options.path = dashboards/synapse.json;
         }
-        # TODO: enable once https://github.com/NixOS/nixpkgs/pull/242365 gets merged
+        {
-        # {
+          name = "MySQL";
-        #   name = "MySQL";
+          type = "file";
-        #   type = "file";
+          url = "https://raw.githubusercontent.com/prometheus/mysqld_exporter/main/mysqld-mixin/dashboards/mysql-overview.json";
-        #   url = "https://raw.githubusercontent.com/prometheus/mysqld_exporter/main/mysqld-mixin/dashboards/mysql-overview.json";
+          options.path = dashboards/mysql.json;
-        #   options.path = dashboards/mysql.json;
+        }
-        # }
         {
           name = "Postgresql";
           type = "file";
@@ -75,6 +74,12 @@ in {
           url = "https://grafana.com/api/dashboards/240/revisions/3/download";
           options.path = dashboards/go-processes.json;
         }
+        {
+          name = "Gitea Dashboard";
+          type = "file";
+          url = "https://grafana.com/api/dashboards/17802/revisions/3/download";
+          options.path = dashboards/gitea-dashboard.json;
+        }
       ];
 
     };

hosts/ildkule/services/monitoring/loki.nix

@@ -2,6 +2,7 @@
 
 let
   cfg = config.services.loki;
+  stateDir = "/data/monitoring/loki";
 in {
   services.loki = {
     enable = true;
@@ -16,7 +17,7 @@ in {
       ingester = {
         wal = {
           enabled = true;
-          dir = "/var/lib/loki/wal";
+          dir = "${stateDir}/wal";
         };
         lifecycler = {
           address = "127.0.0.1";
@@ -48,12 +49,12 @@ in {
 
       storage_config = {
         boltdb_shipper = {
-          active_index_directory = "/var/lib/loki/boltdb-shipper-index";
+          active_index_directory = "${stateDir}/boltdb-shipper-index";
-          cache_location = "/var/lib/loki/boltdb-shipper-cache";
+          cache_location = "${stateDir}/boltdb-shipper-cache";
           cache_ttl = "24h";
         };
         filesystem = {
-          directory = "/var/lib/loki/chunks";
+          directory = "${stateDir}/chunks";
         };
       };
 
@@ -64,14 +65,14 @@ in {
       };
 
       compactor = {
-        working_directory = "/var/lib/loki/compactor";
+        working_directory = "${stateDir}/compactor";
       };
 
       # ruler = {
       #   storage = {
       #     type = "local";
       #     local = {
-      #       directory = "/var/lib/loki/rules";
+      #       directory = "${stateDir}/rules";
       #     };
       #   };
       #   rule_path = "/etc/loki/rules";

hosts/ildkule/services/monitoring/prometheus/default.nix

@@ -1,18 +1,25 @@
-{ config, ... }: {
+{ config, ... }: let
+  stateDir = "/data/monitoring/prometheus";
+in {
   imports = [
-    ./gogs.nix
+    ./gitea.nix
     ./matrix-synapse.nix
-    # TODO: enable once https://github.com/NixOS/nixpkgs/pull/242365 gets merged
+    ./mysqld.nix
-    # ./mysqld.nix
-    ./node.nix
     ./postgres.nix
+    ./machines.nix
   ];
 
   services.prometheus = {
     enable = true;
+
     listenAddress = "127.0.0.1";
     port = 9001;
 
     ruleFiles = [ rules/synapse-v2.rules ];
   };
+
+  fileSystems."/var/lib/prometheus2" = {
+    device = stateDir;
+    options = [ "bind" ];
+  };
 }

hosts/ildkule/services/monitoring/prometheus/gitea.nix

@@ -0,0 +1,16 @@
+{ ... }:
+{
+  services.prometheus.scrapeConfigs = [{
+    job_name = "gitea";
+    scrape_interval = "60s";
+    scheme = "https";
+
+    static_configs = [
+      {
+        targets = [
+          "git.pvv.ntnu.no:443"
+        ];
+      }
+    ];
+  }];
+}

hosts/ildkule/services/monitoring/prometheus/gogs.nix

@@ -1,16 +0,0 @@
-{ config, ... }: let
-  cfg = config.services.prometheus;
-in {
-  services.prometheus.scrapeConfigs = [{
-    job_name = "git-gogs";
-    scheme = "https";
-    metrics_path = "/-/metrics";
-    static_configs = [
-      {
-        targets = [
-          "essendrop.pvv.ntnu.no:443"
-        ];
-      }
-    ];
-  }];
-}

hosts/ildkule/services/monitoring/prometheus/machines.nix

@@ -0,0 +1,66 @@
+{ config, ... }: let
+  cfg = config.services.prometheus;
+in {
+  services.prometheus.scrapeConfigs = [{
+    job_name = "base_info";
+    static_configs = [
+      { labels.hostname = "ildkule";
+        targets = [
+          "ildkule.pvv.ntnu.no:${toString cfg.exporters.node.port}"
+          "ildkule.pvv.ntnu.no:${toString cfg.exporters.systemd.port}"
+        ];
+      }
+      { labels.hostname = "bekkalokk";
+        targets = [
+          "bekkalokk.pvv.ntnu.no:9100"
+          "bekkalokk.pvv.ntnu.no:9101"
+        ];
+      }
+      { labels.hostname = "kommode";
+        targets = [
+          "kommode.pvv.ntnu.no:9100"
+          "kommode.pvv.ntnu.no:9101"
+        ];
+      }
+      { labels.hostname = "bicep";
+        targets = [
+          "bicep.pvv.ntnu.no:9100"
+          "bicep.pvv.ntnu.no:9101"
+        ];
+      }
+      { labels.hostname = "brzeczyszczykiewicz";
+        targets = [
+          "brzeczyszczykiewicz.pvv.ntnu.no:9100"
+          "brzeczyszczykiewicz.pvv.ntnu.no:9101"
+        ];
+      }
+      { labels.hostname = "georg";
+        targets = [
+          "georg.pvv.ntnu.no:9100"
+          "georg.pvv.ntnu.no:9101"
+        ];
+      }
+      { labels.hostname = "ustetind";
+        targets = [
+          "ustetind.pvv.ntnu.no:9100"
+          "ustetind.pvv.ntnu.no:9101"
+        ];
+      }
+      { labels.hostname =  "hildring";
+        targets = [
+          "hildring.pvv.ntnu.no:9100"
+        ];
+      }
+      { labels.hostname =  "isvegg";
+        targets = [
+          "isvegg.pvv.ntnu.no:9100"
+        ];
+      }
+      { labels.hostname =  "microbel";
+        targets = [
+          "microbel.pvv.ntnu.no:9100"
+        ];
+      }
+    ];
+  }];
+}

hosts/ildkule/services/monitoring/prometheus/mysqld.nix

@@ -1,7 +1,22 @@
 { config, ... }: let
   cfg = config.services.prometheus;
 in {
-  sops.secrets."config/mysqld_exporter" = { };
+  sops = {
+    secrets."config/mysqld_exporter_password" = { };
+
+    templates."mysqld_exporter.conf" = {
+      restartUnits = [ "prometheus-mysqld-exporter.service" ];
+      content = let
+        inherit (config.sops) placeholder;
+      in ''
+        [client]
+        host = bicep.pvv.ntnu.no
+        port = 3306
+        user = prometheus_mysqld_exporter
+        password = ${placeholder."config/mysqld_exporter_password"}
+      '';
+    };
+  };
 
   services.prometheus = {
     scrapeConfigs = [{
@@ -19,7 +34,7 @@ in {
 
     exporters.mysqld = {
       enable = true;
-      configFilePath = config.sops.secrets."config/mysqld_exporter".path;
+      configFile = config.sops.templates."mysqld_exporter.conf".path;
     };
   };
 }

hosts/ildkule/services/monitoring/prometheus/node.nix

@@ -1,22 +0,0 @@
-{ config, ... }: let
-  cfg = config.services.prometheus;
-in {
-  services.prometheus.scrapeConfigs = [{
-    job_name = "node";
-    static_configs = [
-      {
-        targets = [
-          "ildkule.pvv.ntnu.no:${toString cfg.exporters.node.port}"
-          "microbel.pvv.ntnu.no:9100"
-          "isvegg.pvv.ntnu.no:9100"
-          "knakelibrak.pvv.ntnu.no:9100"
-          "hildring.pvv.ntnu.no:9100"
-          "bicep.pvv.ntnu.no:9100"
-          "essendrop.pvv.ntnu.no:9100"
-          "andresbu.pvv.ntnu.no:9100"
-          "bekkalokk.pvv.ntnu.no:9100"
-        ];
-      }
-    ];
-  }];
-}

hosts/ildkule/services/monitoring/uptime-kuma.nix

@@ -2,6 +2,7 @@
 let
   cfg = config.services.uptime-kuma;
   domain = "status.pvv.ntnu.no";
+  stateDir = "/data/monitoring/uptime-kuma";
 in {
   services.uptime-kuma = {
     enable = true;
@@ -17,4 +18,9 @@ in {
     kTLS = true;
     locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
   };
+
+  fileSystems."/var/lib/uptime-kuma" = {
+    device = stateDir;
+    options = [ "bind" ];
+  };
 }

hosts/kommode/configuration.nix

@@ -0,0 +1,34 @@
+{ pkgs, values, fp, ... }:
+{
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    (fp /base)
+    (fp /misc/metrics-exporters.nix)
+
+    ./services/gitea
+    ./services/nginx.nix
+  ];
+
+  sops.defaultSopsFile = fp /secrets/kommode/kommode.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "kommode"; # Define your hostname.
+
+  systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
+    matchConfig.Name = "ens18";
+    address = with values.hosts.kommode; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  };
+
+  services.btrfs.autoScrub.enable = true;
+
+  environment.systemPackages = with pkgs; [];
+
+  system.stateVersion = "24.11";
+}
+

hosts/kommode/hardware-configuration.nix

@@ -0,0 +1,39 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/d421538f-a260-44ae-8e03-47cac369dcc1";
+      fsType = "btrfs";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/86CD-4C23";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/4cfbb41e-801f-40dd-8c58-0a0c1a6025f6"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/kommode/services/gitea/customization/default.nix

@@ -0,0 +1,57 @@
+{ config, pkgs, lib, fp, ... }:
+let
+  cfg = config.services.gitea;
+in
+{
+  services.gitea-themes = {
+    monokai = pkgs.gitea-theme-monokai;
+    earl-grey = pkgs.gitea-theme-earl-grey;
+    pitch-black = pkgs.gitea-theme-pitch-black;
+    catppuccin = pkgs.gitea-theme-catppuccin;
+  };
+
+  systemd.services.gitea-customization = lib.mkIf cfg.enable {
+    description = "Install extra customization in gitea's CUSTOM_DIR";
+    wantedBy = [ "gitea.service" ];
+    requiredBy = [ "gitea.service" ];
+
+    serviceConfig =  {
+      Type = "oneshot";
+      User = cfg.user;
+      Group = cfg.group;
+    };
+
+    script = let
+      logo-svg = fp /assets/logo_blue_regular.svg;
+      logo-png = fp /assets/logo_blue_regular.png;
+      extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
+        <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
+        <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
+        <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
+      '';
+
+      project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
+        labels = lib.importJSON ./labels/projects.json;
+      };
+
+      customTemplates = pkgs.runCommandLocal "gitea-templates" {
+        nativeBuildInputs = with pkgs; [
+          coreutils
+          gnused
+        ];
+      } ''
+        # Bigger icons
+        install -Dm444 "${cfg.package.src}/templates/repo/icon.tmpl" "$out/repo/icon.tmpl"
+        sed -i -e 's/24/48/g' "$out/repo/icon.tmpl"
+      '';
+    in ''
+      install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
+      install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
+      install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
+      install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
+      install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml
+
+      "${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
+    '';
+  };
+}

hosts/kommode/services/gitea/customization/labels/projects.json

@@ -0,0 +1,116 @@
+[
+  {
+    "name": "art",
+    "exclusive": false,
+    "color": "#006b75",
+    "description": "Requires some creativity"
+  },
+  {
+    "name": "big",
+    "exclusive": false,
+    "color": "#754bc4",
+    "description": "This is gonna take a while"
+  },
+  {
+    "name": "blocked",
+    "exclusive": false,
+    "color": "#850021",
+    "description": "This issue/PR depends on one or more other issues/PRs"
+  },
+  {
+    "name": "bug",
+    "exclusive": false,
+    "color": "#f05048",
+    "description": "Something brokey"
+  },
+  {
+    "name": "ci-cd",
+    "exclusive": false,
+    "color": "#d1ff78",
+    "description": "Continuous integrals and continuous derivation"
+  },
+  {
+    "name": "crash report",
+    "exclusive": false,
+    "color": "#ed1111",
+    "description": "Report an oopsie"
+  },
+  {
+    "name": "disputed",
+    "exclusive": false,
+    "color": "#5319e7",
+    "description": "Kranglefanter"
+  },
+  {
+    "name": "documentation",
+    "exclusive": false,
+    "color": "#fbca04",
+    "description": "Documentation changes required"
+  },
+  {
+    "name": "duplicate",
+    "exclusive": false,
+    "color": "#cccccc",
+    "description": "This issue or pull request already exists"
+  },
+  {
+    "name": "feature request",
+    "exclusive": false,
+    "color": "#0052cc",
+    "description": ""
+  },
+  {
+    "name": "good first issue",
+    "exclusive": false,
+    "color": "#009800",
+    "description": "Get your hands dirty with a new project here"
+  },
+  {
+    "name": "me gusta",
+    "exclusive": false,
+    "color": "#30ff36",
+    "description": "( ͡° ͜ʖ ͡°)"
+  },
+  {
+    "name": "packaging",
+    "exclusive": false,
+    "color": "#bf642b",
+    "description": ""
+  },
+  {
+    "name": "question",
+    "exclusive": false,
+    "color": "#cc317c",
+    "description": ""
+  },
+  {
+    "name": "security",
+    "exclusive": false,
+    "color": "#ed1111",
+    "description": "Skommel"
+  },
+  {
+    "name": "techdebt spring cleaning",
+    "exclusive": false,
+    "color": "#8c6217",
+    "description": "The code is smelly 👃"
+  },
+  {
+    "name": "testing",
+    "exclusive": false,
+    "color": "#52b373",
+    "description": "Poke it and see if it explodes"
+  },
+  {
+    "name": "ui/ux",
+    "exclusive": false,
+    "color": "#f28852",
+    "description": "User complaints about ergonomics and economics and whatever"
+  },
+  {
+    "name": "wontfix",
+    "exclusive": false,
+    "color": "#ffffff",
+    "description": "Nei, vil ikke"
+  }
+]

hosts/kommode/services/gitea/default.nix

@@ -1,12 +1,14 @@
-{ config, values, pkgs, lib, ... }:
+{ config, values, lib, unstablePkgs, ... }:
 let
   cfg = config.services.gitea;
   domain = "git.pvv.ntnu.no";
   sshPort  = 2222;
 in {
   imports = [
-    ./ci.nix
+    ./customization
-    ./import-users.nix
+    ./gpg.nix
+    ./import-users
+    ./web-secret-provider
   ];
 
   sops.secrets = {
@@ -24,6 +26,8 @@ in {
     enable = true;
     appName = "PVV Git";
 
+    package = unstablePkgs.gitea;
+
     database = {
       type = "postgres";
       host = "postgres.pvv.ntnu.no";
@@ -45,6 +49,10 @@ in {
         START_LFS_SERVER = true;
         LANDING_PAGE = "explore";
       };
+      "git.timeout" = {
+        MIGRATE = 3600;
+        MIRROR = 1800;
+      };
       mailer = {
         ENABLED = true;
         FROM = "gitea@pvv.ntnu.no";
@@ -54,10 +62,16 @@ in {
         USER = "gitea@pvv.ntnu.no";
         SUBJECT_PREFIX = "[pvv-git]";
       };
+      metrics = {
+        ENABLED = true;
+        ENABLED_ISSUE_BY_LABEL = true;
+        ENABLED_ISSUE_BY_REPOSITORY = true;
+      };
       indexer.REPO_INDEXER_ENABLED = true;
       service = {
         DISABLE_REGISTRATION = true;
         ENABLE_NOTIFY_MAIL = true;
+        AUTO_WATCH_NEW_REPOS = false;
       };
       admin.DEFAULT_EMAIL_NOTIFICATIONS = "onmention";
       session.COOKIE_SECURE = true;
@@ -97,54 +111,65 @@ in {
         ENABLE_FEDERATED_AVATAR = false;
       };
       actions.ENABLED = true;
+      ui = {
+        REACTIONS = lib.concatStringsSep "," [
+          "+1"
+          "-1"
+          "laugh"
+          "confused"
+          "heart"
+          "hooray"
+          "rocket"
+          "eyes"
+          "100"
+          "anger"
+          "astonished"
+          "no_good"
+          "ok_hand"
+          "pensive"
+          "pizza"
+          "point_up"
+          "sob"
+          "skull"
+          "upside_down_face"
+          "shrug"
+        ];
+      };
       "ui.meta".DESCRIPTION = "Bokstavelig talt programvareverkstedet";
     };
+
+    dump = {
+      enable = true;
+      interval = "weekly";
+      type = "tar.gz";
+    };
   };
 
   environment.systemPackages = [ cfg.package ];
 
+  systemd.services.gitea.serviceConfig.CPUSchedulingPolicy = "batch";
+
   services.nginx.virtualHosts."${domain}" = {
     forceSSL = true;
     enableACME = true;
     kTLS = true;
-    locations."/" = {
+    locations = {
-      proxyPass = "http://unix:${cfg.settings.server.HTTP_ADDR}";
+      "/" = {
-      extraConfig = ''
+        proxyPass = "http://unix:${cfg.settings.server.HTTP_ADDR}";
-        client_max_body_size 512M;
+        extraConfig = ''
-      '';
+          client_max_body_size 512M;
+        '';
+      };
+      "/metrics" = {
+        proxyPass = "http://unix:${cfg.settings.server.HTTP_ADDR}";
+        extraConfig = ''
+          allow ${values.hosts.ildkule.ipv4}/32;
+          allow ${values.hosts.ildkule.ipv6}/128;
+          deny all;
+        '';
+      };
     };
   };
 
   networking.firewall.allowedTCPPorts = [ sshPort ];
-
-  # Extra customization
-
-  services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
-
-  systemd.services.install-gitea-customization = {
-    description = "Install extra customization in gitea's CUSTOM_DIR";
-    wantedBy = [ "gitea.service" ];
-    requiredBy = [ "gitea.service" ];
-
-    serviceConfig =  {
-      Type = "oneshot";
-      User = cfg.user;
-      Group = cfg.group;
-    };
-
-    script = let
-      logo-svg = ../../../../assets/logo_blue_regular.svg;
-      logo-png = ../../../../assets/logo_blue_regular.png;
-      extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
-        <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
-        <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
-        <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
-      '';
-    in ''
-      install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
-      install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
-      install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
-      install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
-    '';
-  };
 }

hosts/kommode/services/gitea/gpg.nix

@@ -0,0 +1,38 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.gitea;
+  GNUPGHOME = "${config.users.users.gitea.home}/gnupg";
+in
+{
+  sops.secrets."gitea/gpg-signing-key" = {
+    owner = cfg.user;
+    inherit (cfg) group;
+  };
+
+  systemd.services.gitea.environment = { inherit GNUPGHOME; };
+
+  systemd.tmpfiles.settings."20-gitea-gnugpg".${GNUPGHOME}.d = {
+    inherit (cfg) user group;
+    mode = "700";
+  };
+
+  systemd.services.gitea-ensure-gnupg-homedir = {
+    description = "Import gpg key for gitea";
+    environment = { inherit GNUPGHOME; };
+    serviceConfig = {
+      Type = "oneshot";
+      User = cfg.user;
+      PrivateNetwork = true;
+    };
+    script = ''
+      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key".path}
+    '';
+  };
+
+  services.gitea.settings."repository.signing" = {
+    SIGNING_KEY = "0549C43374D2253C";
+    SIGNING_NAME = "PVV Git";
+    SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
+    INITIAL_COMMIT = "always";
+  };
+}

hosts/kommode/services/gitea/import-users/default.nix

@@ -14,6 +14,9 @@ in
     preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /tmp/passwd-import'';
     serviceConfig = {
       ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
+        flakeIgnore = [
+          "E501" # Line over 80 chars lol
+        ];
         libraries = with pkgs.python3Packages; [ requests ];
       } (builtins.readFile ./gitea-import-users.py);
       LoadCredential=[

hosts/kommode/services/gitea/import-users/gitea-import-users.py

@@ -0,0 +1,199 @@
+import requests
+import secrets
+import os
+
+
+EMAIL_DOMAIN = os.getenv('EMAIL_DOMAIN')
+if EMAIL_DOMAIN is None:
+    EMAIL_DOMAIN = 'pvv.ntnu.no'
+
+
+API_TOKEN = os.getenv('API_TOKEN')
+if API_TOKEN is None:
+    raise Exception('API_TOKEN not set')
+
+
+GITEA_API_URL = os.getenv('GITEA_API_URL')
+if GITEA_API_URL is None:
+    GITEA_API_URL = 'https://git.pvv.ntnu.no/api/v1'
+
+
+def gitea_list_all_users() -> dict[str, dict[str, any]] | None:
+    r = requests.get(
+        GITEA_API_URL + '/admin/users',
+        headers={'Authorization': 'token ' + API_TOKEN}
+    )
+
+    if r.status_code != 200:
+        print('Failed to get users:', r.text)
+        return None
+
+    return {user['login']: user for user in r.json()}
+
+
+def gitea_create_user(username: str, userdata: dict[str, any]) -> bool:
+    r = requests.post(
+        GITEA_API_URL + '/admin/users',
+        json=userdata,
+        headers={'Authorization': 'token ' + API_TOKEN},
+    )
+
+    if r.status_code != 201:
+        print(f'ERR: Failed to create user {username}:', r.text)
+        return False
+
+    return True
+
+
+def gitea_edit_user(username: str, userdata: dict[str, any]) -> bool:
+    r = requests.patch(
+        GITEA_API_URL + f'/admin/users/{username}',
+        json=userdata,
+        headers={'Authorization': 'token ' + API_TOKEN},
+    )
+
+    if r.status_code != 200:
+        print(f'ERR: Failed to update user {username}:', r.text)
+        return False
+
+    return True
+
+
+def gitea_list_teams_for_organization(org: str) -> dict[str, any] | None:
+    r = requests.get(
+        GITEA_API_URL + f'/orgs/{org}/teams',
+        headers={'Authorization': 'token ' + API_TOKEN},
+    )
+
+    if r.status_code != 200:
+        print(f"ERR: Failed to list teams for {org}:", r.text)
+        return None
+
+    return {team['name']: team for team in r.json()}
+
+
+def gitea_add_user_to_organization_team(username: str, team_id: int) -> bool:
+    r = requests.put(
+        GITEA_API_URL + f'/teams/{team_id}/members/{username}',
+        headers={'Authorization': 'token ' + API_TOKEN},
+    )
+
+    if r.status_code != 204:
+        print(f'ERR: Failed to add user {username} to org team {team_id}:', r.text)
+        return False
+
+    return True
+
+
+# If a passwd user has one of the following shells,
+# it is most likely not a PVV user, but rather a system user.
+# Users with these shells should thus be ignored.
+BANNED_SHELLS = [
+    "/usr/bin/nologin",
+    "/usr/sbin/nologin",
+    "/sbin/nologin",
+    "/bin/false",
+    "/bin/msgsh",
+]
+
+
+# Reads out a passwd-file line for line, and filters out
+# real PVV users (as opposed to system users meant for daemons and such)
+def passwd_file_parser(passwd_path):
+    with open(passwd_path, 'r') as f:
+        for line in f.readlines():
+            uid = int(line.split(':')[2])
+            if uid < 1000:
+                continue
+
+            shell = line.split(':')[-1]
+            if shell in BANNED_SHELLS:
+                continue
+
+            username = line.split(':')[0]
+            name = line.split(':')[4].split(',')[0]
+            yield (username, name)
+
+
+# This function either creates a new user in gitea
+# and fills it out with some default information if
+# it does not exist, or ensures that the default information
+# is correct if the user already exists. All user information
+# (including non-default fields) is pulled from gitea and added
+# to the `existing_users` dict
+def add_or_patch_gitea_user(
+    username: str,
+    name: str,
+    existing_users: dict[str, dict[str, any]],
+) -> None:
+    user = {
+        "full_name": name,
+        "username": username,
+        "login_name": username,
+        "source_id": 1,  # 1 = SMTP
+    }
+
+    if username not in existing_users:
+        user["password"] = secrets.token_urlsafe(32)
+        user["must_change_password"] = False
+        user["visibility"] = "private"
+        user["email"] = username + '@' + EMAIL_DOMAIN
+
+        if not gitea_create_user(username, user):
+            return
+
+        print('Created user', username)
+        existing_users[username] = user
+
+    else:
+        user["visibility"] = existing_users[username]["visibility"]
+
+        if not gitea_edit_user(username, user):
+            return
+
+        print('Updated user', username)
+
+
+# This function adds a user to a gitea team (part of organization)
+# if the user is not already part of said team.
+def ensure_gitea_user_is_part_of_team(
+    username: str,
+    org: str,
+    team_name: str,
+) -> None:
+    teams = gitea_list_teams_for_organization(org)
+
+    if teams is None:
+        return
+
+    if team_name not in teams:
+        print(f'ERR: could not find team "{team_name}" in organization "{org}"')
+
+    gitea_add_user_to_organization_team(username, teams[team_name]['id'])
+
+    print(f'User {username} is now part of {org}/{team_name}')
+
+
+# List of teams that all users should be part of by default
+COMMON_USER_TEAMS = [
+    ("Projects", "Members"),
+    ("Grzegorz", "Members"),
+    ("Kurs", "Members"),
+]
+
+
+def main():
+    existing_users = gitea_list_all_users()
+    if existing_users is None:
+        exit(1)
+
+    for username, name in passwd_file_parser("/tmp/passwd-import"):
+        print(f"Processing {username}")
+        add_or_patch_gitea_user(username, name, existing_users)
+        for org, team_name in COMMON_USER_TEAMS:
+            ensure_gitea_user_is_part_of_team(username, org, team_name)
+        print()
+
+
+if __name__ == '__main__':
+    main()

hosts/kommode/services/gitea/web-secret-provider/default.nix

@@ -0,0 +1,117 @@
+{ config, pkgs, lib, ... }:
+let
+  organizations = [
+    "Drift"
+    "Projects"
+    "Grzegorz"
+    "Kurs"
+  ];
+
+  giteaCfg = config.services.gitea;
+
+  giteaWebSecretProviderScript = pkgs.writers.writePython3 "gitea-web-secret-provider" {
+    libraries = with pkgs.python3Packages; [ requests ];
+    flakeIgnore = [
+      "E501" # Line over 80 chars lol
+      "E201" # "whitespace after {"
+      "E202" # "whitespace after }"
+      "E251" # unexpected spaces around keyword / parameter equals
+      "W391" # Newline at end of file
+    ];
+    makeWrapperArgs = [
+      "--prefix PATH : ${(lib.makeBinPath [ pkgs.openssh ])}"
+    ];
+  } (builtins.readFile ./gitea-web-secret-provider.py);
+in
+{
+  users.groups."gitea-web" = { };
+  users.users."gitea-web" = {
+    group = "gitea-web";
+    isSystemUser = true;
+    shell = pkgs.bash;
+  };
+
+  sops.secrets."gitea/web-secret-provider/token" = {
+    owner = "gitea-web";
+    group = "gitea-web";
+    restartUnits = [
+      "gitea-web-secret-provider@"
+    ] ++ (map (org: "gitea-web-secret-provider@${org}") organizations);
+  };
+
+  systemd.slices.system-giteaweb = {
+    description = "Gitea web directories";
+  };
+
+  # https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html#Specifiers
+  # %i - instance name (after the @)
+  # %d - secrets directory
+  systemd.services."gitea-web-secret-provider@" = {
+    description = "Ensure all repos in %i has an SSH key to push web content";
+    requires = [ "gitea.service" "network.target" ];
+    serviceConfig = {
+      Slice = "system-giteaweb.slice";
+      Type = "oneshot";
+      ExecStart = let
+        args = lib.cli.toGNUCommandLineShell { } {
+          org = "%i";
+          token-path = "%d/token";
+          api-url = "${giteaCfg.settings.server.ROOT_URL}api/v1";
+          key-dir = "/var/lib/gitea-web/keys/%i";
+          authorized-keys-path = "/var/lib/gitea-web/authorized_keys.d/%i";
+          rrsync-script = pkgs.writeShellScript "rrsync-chown" ''
+            mkdir -p "$1"
+            ${lib.getExe pkgs.rrsync} -wo "$1"
+            ${pkgs.coreutils}/bin/chown -R gitea-web:gitea-web "$1"
+          '';
+          web-dir = "/var/lib/gitea-web/web";
+        };
+      in "${giteaWebSecretProviderScript} ${args}";
+
+      User = "gitea-web";
+      Group = "gitea-web";
+
+      StateDirectory = "gitea-web";
+      StateDirectoryMode = "0750";
+      LoadCredential = [
+        "token:${config.sops.secrets."gitea/web-secret-provider/token".path}"
+      ];
+
+      NoNewPrivileges = true;
+      PrivateTmp = true;
+      PrivateDevices = true;
+      ProtectSystem = true;
+      ProtectHome = true;
+      ProtectControlGroups = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      MemoryDenyWriteExecute = true;
+      LockPersonality = true;
+    };
+  };
+
+  systemd.timers."gitea-web-secret-provider@" = {
+    description = "Ensure all repos in %i has an SSH key to push web content";
+    timerConfig = {
+      RandomizedDelaySec = "1h";
+      Persistent = true;
+      Unit = "gitea-web-secret-provider@%i.service";
+      OnCalendar = "daily";
+    };
+  };
+
+  systemd.targets.timers.wants = map (org: "gitea-web-secret-provider@${org}.timer") organizations;
+
+  services.openssh.authorizedKeysFiles = map (org: "/var/lib/gitea-web/authorized_keys.d/${org}") organizations;
+
+  users.users.nginx.extraGroups = [ "gitea-web" ];
+  services.nginx.virtualHosts."pages.pvv.ntnu.no" = {
+    kTLS = true;
+    forceSSL = true;
+    enableACME = true;
+    root = "/var/lib/gitea-web/web";
+  };
+}

hosts/kommode/services/gitea/web-secret-provider/gitea-web-secret-provider.py

@@ -0,0 +1,126 @@
+import argparse
+import hashlib
+import os
+import requests
+import subprocess
+from pathlib import Path
+
+
+def parse_args():
+    parser = argparse.ArgumentParser(description="Generate SSH keys for Gitea repositories and add them as secrets")
+    parser.add_argument("--org", required=True, type=str, help="The organization to generate keys for")
+    parser.add_argument("--token-path", metavar='PATH', required=True, type=Path, help="Path to a file containing the Gitea API token")
+    parser.add_argument("--api-url", metavar='URL', type=str, help="The URL of the Gitea API", default="https://git.pvv.ntnu.no/api/v1")
+    parser.add_argument("--key-dir", metavar='PATH', type=Path, help="The directory to store the generated keys in", default="/run/gitea-web-secret-provider")
+    parser.add_argument("--authorized-keys-path", metavar='PATH', type=Path, help="The path to the resulting authorized_keys file", default="/etc/ssh/authorized_keys.d/gitea-web-secret-provider")
+    parser.add_argument("--rrsync-script", metavar='PATH', type=Path, help="The path to a rrsync script, taking the destination path as its single argument")
+    parser.add_argument("--web-dir", metavar='PATH', type=Path, help="The directory to sync the repositories to", default="/var/www")
+    parser.add_argument("--force", action="store_true", help="Overwrite existing keys")
+    return parser.parse_args()
+
+
+def add_secret(args: argparse.Namespace, token: str, repo: str, name: str, secret: str):
+    result = requests.put(
+        f"{args.api_url}/repos/{args.org}/{repo}/actions/secrets/{name}",
+        json = { 'data': secret },
+        headers = { 'Authorization': 'token ' + token },
+    )
+    if result.status_code not in (201, 204):
+        raise Exception(f"Failed to add secret: {result.json()}")
+
+
+def get_org_repo_list(args: argparse.Namespace, token: str):
+    result = requests.get(
+        f"{args.api_url}/orgs/{args.org}/repos",
+        headers = { 'Authorization': 'token ' + token },
+    )
+
+    results = [repo["name"] for repo in result.json()]
+    target = int(result.headers['X-Total-Count'])
+
+    i = 2
+    while len(results) < target:
+        result = requests.get(
+            f"{args.api_url}/orgs/{args.org}/repos",
+            params = { 'page': i },
+            headers = { 'Authorization': 'token ' + token },
+        )
+        results += [repo["name"] for repo in result.json()]
+        i += 1
+
+    return results
+
+
+def generate_ssh_key(args: argparse.Namespace, repository: str):
+    keyname = hashlib.sha256(args.org.encode() + repository.encode()).hexdigest()
+    key_path = args.key_dir / keyname
+    if not key_path.is_file() or args.force:
+        subprocess.run(
+            [
+                "ssh-keygen",
+                *("-t", "ed25519"),
+                *("-f", key_path),
+                *("-N", ""),
+                *("-C", f"{args.org}/{repository}"),
+            ],
+            check=True,
+            stdin=subprocess.DEVNULL,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+        )
+        print(f"Generated SSH key for `{args.org}/{repository}`")
+
+    with open(key_path, "r") as f:
+        private_key = f.read()
+
+    pub_key_path = args.key_dir / (keyname + '.pub')
+    with open(pub_key_path, "r") as f:
+        public_key = f.read()
+
+    return private_key, public_key
+
+
+SSH_OPTS = ",".join([
+    "restrict",
+    "no-agent-forwarding",
+    "no-port-forwarding",
+    "no-pty",
+    "no-X11-forwarding",
+])
+
+
+def generate_authorized_keys(args: argparse.Namespace, repo_public_keys: list[tuple[str, str]]):
+    lines = []
+    for repo, public_key in repo_public_keys:
+        command = f"{args.rrsync_script} {args.web_dir}/{args.org}/{repo}"
+        lines.append(f'command="{command}",{SSH_OPTS} {public_key}')
+
+    with open(args.authorized_keys_path, "w") as f:
+        f.writelines(lines)
+
+
+def main():
+    args = parse_args()
+
+    with open(args.token_path, "r") as f:
+        token = f.read().strip()
+
+    os.makedirs(args.key_dir, 0o700, exist_ok=True)
+    os.makedirs(args.authorized_keys_path.parent, 0o700, exist_ok=True)
+
+    repos = get_org_repo_list(args, token)
+    print(f'Found {len(repos)} repositories in `{args.org}`')
+
+    repo_public_keys = []
+    for repo in repos:
+        print(f"Locating key for `{args.org}/{repo}`")
+        private_key, public_key = generate_ssh_key(args, repo)
+        add_secret(args, token, repo, "WEB_SYNC_SSH_KEY", private_key)
+        repo_public_keys.append((repo, public_key))
+
+    generate_authorized_keys(args, repo_public_keys)
+    print(f"Wrote authorized_keys file to `{args.authorized_keys_path}`")
+
+
+if __name__ == "__main__":
+    main()

hosts/kommode/services/nginx.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.nginx.enable = true;
+}

hosts/shark/configuration.nix

@@ -1,13 +1,13 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
   imports = [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ../../base.nix
+      (fp /base)
-      ../../misc/metrics-exporters.nix
+      (fp /misc/metrics-exporters.nix)
     ];
 
-  sops.defaultSopsFile = ../../secrets/shark/shark.yaml;
+  sops.defaultSopsFile = fp /secrets/shark/shark.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.age.keyFile = "/var/lib/sops-nix/key.txt";
   sops.age.generateKey = true;

hosts/ustetind/configuration.nix

@@ -0,0 +1,44 @@
+{ config, fp, pkgs, lib, values, ... }:
+
+{
+  imports = [
+    (fp /base)
+    (fp /misc/metrics-exporters.nix)
+
+    ./services/gitea-runners.nix
+  ];
+
+  sops.defaultSopsFile = fp /secrets/ustetind/ustetind.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  networking.hostName = "ustetind";
+
+  networking.useHostResolvConf = lib.mkForce false;
+
+  systemd.network.networks = {
+    "30-lxc-eth" = values.defaultNetworkConfig // {
+      matchConfig = {
+        Type = "ether";
+        Kind = "veth";
+        Name = [
+          "eth*"
+        ];
+      };
+      address = with values.hosts.ustetind; [ (ipv4 + "/25") (ipv6 + "/64") ];
+    };
+    "40-podman-veth" = values.defaultNetworkConfig // {
+      matchConfig = {
+        Type = "ether";
+        Kind = "veth";
+        Name = [
+          "veth*"
+        ];
+      };
+      DHCP = "yes";
+    };
+  };
+
+  system.stateVersion = "24.11";
+}

hosts/ustetind/services/gitea-runners.nix

@@ -15,8 +15,8 @@ let
         enable = true;
         name = "git-runner-${name}"; url = "https://git.pvv.ntnu.no";
         labels = [
-          "debian-latest:docker://node:18-bullseye"
+          "debian-latest:docker://node:current-bookworm"
-          "ubuntu-latest:docker://node:18-bullseye"
+          "ubuntu-latest:docker://node:current-bookworm"
         ];
         tokenFile = config.sops.secrets."gitea/runners/${name}".path;
       };
@@ -27,5 +27,15 @@ lib.mkMerge [
   (mkRunner "alpha")
   (mkRunner "beta")
   (mkRunner "epsilon")
-  { virtualisation.podman.enable = true; }
+  {
+    virtualisation.podman = {
+      enable = true;
+      defaultNetwork.settings.dns_enabled = true;
+      autoPrune.enable = true;
+    };
+
+    networking.dhcpcd.IPv6rs = false;
+
+    networking.firewall.interfaces."podman+".allowedUDPPorts = [53 5353];
+  }
 ]

hosts/wenche/configuration.nix

@@ -0,0 +1,39 @@
+{ config, fp, pkgs, values, lib, ... }:
+{
+  imports = [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      (fp /base)
+      (fp /misc/metrics-exporters.nix)
+
+      (fp /misc/builder.nix)
+    ];
+
+  sops.defaultSopsFile = fp /secrets/wenche/wenche.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  boot.loader.grub.device = "/dev/sda";
+
+  networking.hostName = "wenche"; # Define your hostname.
+
+  systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
+    matchConfig.Name = "ens18";
+    address = with values.hosts.wenche; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  };
+
+  hardware.graphics.enable = true;
+  services.xserver.videoDrivers = [ "nvidia" ];
+  hardware.nvidia = {
+    modesetting.enable = true;
+    open = false;
+    package = config.boot.kernelPackages.nvidiaPackages.production;
+  };
+
+  # List packages installed in system profile
+  environment.systemPackages = with pkgs; [
+  ];
+
+  system.stateVersion = "24.11"; # Did you read the comment?
+}

hosts/wenche/hardware-configuration.nix

@@ -0,0 +1,27 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "nvidia"  ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/4e8ecdd2-d453-4fff-b952-f06da00f3b85";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ {
+    device = "/var/lib/swapfile";
+    size = 16*1024;
+  } ];
+
+  networking.useDHCP = lib.mkDefault false;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

justfile

@@ -1,25 +1,56 @@
+set positional-arguments # makes variables accesible as $1 $2 $@
 export GUM_FILTER_HEIGHT := "15"
-nom := `if command -v nom >/dev/null; then echo nom; else echo nix; fi`
+nom := `if [[ -t 1 ]] && command -v nom >/dev/null; then echo nom; else echo nix; fi`
+nix_eval_opts := "--log-format raw --option warn-dirty false"
 
 @_default:
   just "$(gum choose --ordered --header "Pick a recipie..." $(just --summary --unsorted))"
 
-check:
+check *_:
-  nix flake check --keep-going
+  nix flake check --keep-going "$@"
 
-build-machine machine=`just _a_machine`:
+build-machine machine=`just _a_machine` *_:
-  {{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel
+  {{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel "${@:2}"
 
-run-vm machine=`just _a_machine`:
+run-vm machine=`just _a_machine` *_:
-  nixos-rebuild build-vm --flake .#{{ machine }}
+  nixos-rebuild build-vm --flake .#{{ machine }} "${@:2}"
   QEMU_NET_OPTS="hostfwd=tcp::8080-:80,hostfwd=tcp::8081-:443,hostfwd=tcp::2222-:22" ./result/bin/run-*-vm
 
-@update-inputs:
+@update-inputs *_:
-  nix eval .#inputs --apply builtins.attrNames --json \
+  @git reset flake.lock
-    | jq '.[]' -r \
+  @git restore flake.lock
-    | gum choose --no-limit --height=15 \
+  nix eval {{nix_eval_opts}} --file flake.nix --apply 'x: builtins.attrNames x.inputs' --json \
-    | xargs nix flake update --commit-lock-file
+    | { printf "%s\n" --commit-lock-file; jq '.[]' -r | grep -vxF "self" ||:; } \
+    | gum choose --no-limit --header "Choose extra arguments:" \
+    | tee >(xargs -d'\n' echo + nix flake update "$@" >&2) \
+    | xargs -d'\n' nix flake update "$@"
+
+@repl $machine=`just _a_machine` *_:
+  set -v; nixos-rebuild --flake .#"$machine" repl "${@:2}"
+
+@eval $machine=`just _a_machine` $attrpath="system.build.toplevel.outPath" *_:
+  set -v; nix eval {{nix_eval_opts}} ".#nixosConfigurations.\"$machine\".config.$attrpath" --show-trace "${@:3}"
+
+@eval-vm $machine=`just _a_machine` $attrpath="system.build.toplevel.outPath" *_:
+  just eval "$machine" "virtualisation.vmVariant.$attrpath" "${@:3}"
 
 
+# helpers
+
+[no-exit-message]
 _a_machine:
-  nix eval .#nixosConfigurations --apply builtins.attrNames --json | jq .[] -r | gum filter
+  #!/usr/bin/env -S sh -euo pipefail
+  machines="$(
+    nix eval {{nix_eval_opts}} .#nixosConfigurations --apply builtins.attrNames --json | jq .[] -r
+  )"
+  [ -n "$machines" ] || { echo >&2 "ERROR: no machines found"; false; }
+  if [ -s .direnv/vars/last-machine.txt ]; then
+    machines="$(
+      grep <<<"$machines" -xF  "$(cat .direnv/vars/last-machine.txt)" ||:
+      grep <<<"$machines" -xFv "$(cat .direnv/vars/last-machine.txt)" ||:
+    )"
+  fi
+  choice="$(gum filter <<<"$machines")"
+  mkdir -p .direnv/vars
+  cat <<<"$choice" >.direnv/vars/last-machine.txt
+  cat <<<"$choice"

keys/oysteikt.pub

@@ -8,34 +8,47 @@ FgIDAQACHgECF4AACgkQRrkijoFKKqxIlQD9F0EedrFpHAVuaVas9ZWRZb4xv3zM
 N3g0IDxoN3g0QG5hbmkud3RmPoiTBBMWCgA7AhsBBQsJCAcDBRUKCQgLBRYCAwEA
 Ah4BAheAFiEE99N4kCKKkHRA4f1IRrkijoFKKqwFAmL7l8ACGQEACgkQRrkijoFK
 KqxI4wD9EIGpb3Gt5s5e8waH7XaLSlquOrW1RID3sSuzWI4DvikBAMncfBbtkpzH
-EYU2Ufm8VxzgJDnyeB+lcdeSJXWaIwYLtCZoN3g0IChhbHRlcm5hdGl2ZSkgPGg3
+EYU2Ufm8VxzgJDnyeB+lcdeSJXWaIwYLiJAEExYKADgWIQT303iQIoqQdEDh/UhG
-eDQuYWx0QG5hbmkud3RmPoiQBBMWCgA4FiEE99N4kCKKkHRA4f1IRrkijoFKKqwF
+uSKOgUoqrAUCYuaF5AIbAQULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRBGuSKO
-AmL7j0oCGwEFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQRrkijoFKKqytywD+
+gUoqrKWiAQC1yFpodz5PGsZbFgihEA0UQ5jcoXBojoAlVRgmkwm41gEA782rsvyl
-IdHIxbjRcDEJYOqFX1r4wrymTvnjz/kp0zUSrymwMUoBAP8huPK/YpujNF6/cwwB
+87ExoluDD3eV/Z5ILp7Ex6JeaE3JUix8Sgi0Jmg3eDQgKGFsdGVybmF0aXZlKSA8
-3A5WwpWjjV+F/uq2ejqFOocNuDMEYuaGRxYJKwYBBAHaRw8BAQdAsmc0GTQIszpk
+aDd4NC5hbHRAbmFuaS53dGY+iJAEExYKADgWIQT303iQIoqQdEDh/UhGuSKOgUoq
-jDYwgSt6zI81P2+k9WvBg6IEISnyuVWI9QQYFgoAJhYhBPfTeJAiipB0QOH9SEa5
+rAUCYvuPSgIbAQULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRBGuSKOgUoqrK3L
-Io6BSiqsBQJi5oZHAhsCBQkDwmcAAIEJEEa5Io6BSiqsdiAEGRYKAB0WIQTzzahs
+AP4h0cjFuNFwMQlg6oVfWvjCvKZO+ePP+SnTNRKvKbAxSgEA/yG48r9im6M0Xr9z
-xVqfENegaYGfL32CUPNRRgUCYuaGRwAKCRCfL32CUPNRRhWYAQCzfkYeJt9t02jO
+DAHcDlbClaONX4X+6rZ6OoU6hw24MwRi5oZHFgkrBgEEAdpHDwEBB0CyZzQZNAiz
-c3SXwk1e1dGj9ydEXSprSr8/2PWu7gD+KD/FJWzPbnMhtudoGfCIzNFaazcz/QqT
+OmSMNjCBK3rMjzU/b6T1a8GDogQhKfK5VYj1BBgWCgAmFiEE99N4kCKKkHRA4f1I
-ZeBs6Q+AkQ7ueQD/ZqQMkaCrd8o2L02h89U6bFxy86nyTurGAUVx92F8jUwBAKa7
+RrkijoFKKqwFAmLmhkcCGwIFCQPCZwAAgQkQRrkijoFKKqx2IAQZFgoAHRYhBPPN
-Zp/0vR5bR4o57C7NTxB5kbmteF0AXS9R7sxSA/AEuQINBGLmhnoBEADa1yBK0NKx
+qGzFWp8Q16BpgZ8vfYJQ81FGBQJi5oZHAAoJEJ8vfYJQ81FGFZgBALN+Rh4m323T
-VIto3hSh21hooYpWcEXWqMPXHO34rcAhktVFOOHIl2bFGScQAZXtjAcqUmMyC+PM
+aM5zdJfCTV7V0aP3J0RdKmtKvz/Y9a7uAP4oP8UlbM9ucyG252gZ8IjM0VprNzP9
-s1DZoocFk+9PJt17hAa/s6CRrw8vK+1fVqhj0XOLtevGV9iC6IRvhPxzTsOaeOss
+CpNl4GzpD4CRDu55AP9mpAyRoKt3yjYvTaHz1TpsXHLzqfJO6sYBRXH3YXyNTAEA
-gMGIU8xDmMKT2nGHGNUkqOXGld63E3NKsK3lnl+BCdpJ0f3GEB7aSQ+pk6k1uzOD
+prtmn/S9HltHijnsLs1PEHmRua14XQBdL1HuzFID8ASI9QQYFgoAJgIbAhYhBPfT
-XX/mhAUJmL1MkVZ6jJA3vhsre0Kfa9p+C5mP4hLJ6jF+oESvA4HC+LuCSGm66gID
+eJAiipB0QOH9SEa5Io6BSiqsBQJmqp4CBQkFpUs7AIF2IAQZFgoAHRYhBPPNqGzF
-MC39jnLo6hwYEEjfPXD7CUAN4S2eISSFd+ZclN2vYcrKYgsCZS0hBFOgDhKKCHBu
+Wp8Q16BpgZ8vfYJQ81FGBQJi5oZHAAoJEJ8vfYJQ81FGFZgBALN+Rh4m323TaM5z
-MwP12AIM8y8L64/eOWFpR7s2StAPjjYbZeZECHLWZt1zGVvkS7Xp6lsAg6/T8Eys
+dJfCTV7V0aP3J0RdKmtKvz/Y9a7uAP4oP8UlbM9ucyG252gZ8IjM0VprNzP9CpNl
-KG7vTl2Qq9W0BmzNgk2ODTZkhv0gqqXppdr8eRiq+h0qMfJptG0GycOvqb9PoEO2
+4GzpD4CRDgkQRrkijoFKKqwYoQEAz0D3G/dD6DBYBf7p6pGYqXd2X0Dv8nmnalol
-dfNCjjII8VfaSGfSEYo8UwsqYTtfgdoNnFCXKd1r7QmvrdbNsFDRmkv+wWJoipwU
+Z6SxfUMA/jT/XjPh7c4Ui8nZO7XDzYWrbV/eZwGMd1zXq2mU42MLuQINBGLmhnoB
-aVquyb2KN652jSlpwMECW6fSEsT/5C3mJLgAmi6l6yosw6HdIY6jgpCGtxnHW2zR
+EADa1yBK0NKxVIto3hSh21hooYpWcEXWqMPXHO34rcAhktVFOOHIl2bFGScQAZXt
-eIS6ezZdtxYBCkEHK70yASyaIHrLLDknw+DuKvXAWOAecob8GNBHOjXZe3LzBt2r
+jAcqUmMyC+PMs1DZoocFk+9PJt17hAa/s6CRrw8vK+1fVqhj0XOLtevGV9iC6IRv
-VgOCRa+W7milNgjUCsz+R3rM8XfR+wNEGwARAQABiH4EGBYKACYWIQT303iQIoqQ
+hPxzTsOaeOssgMGIU8xDmMKT2nGHGNUkqOXGld63E3NKsK3lnl+BCdpJ0f3GEB7a
-dEDh/UhGuSKOgUoqrAUCYuaGegIbDAUJA8JnAAAKCRBGuSKOgUoqrDE0AQDBxRsm
+SQ+pk6k1uzODXX/mhAUJmL1MkVZ6jJA3vhsre0Kfa9p+C5mP4hLJ6jF+oESvA4HC
-W9L60mxGCp1CpNWBXD2T6D605PlNiNCcM+cOCgD/c2OitSSG50M0YRbyh1LPYL6Y
++LuCSGm66gIDMC39jnLo6hwYEEjfPXD7CUAN4S2eISSFd+ZclN2vYcrKYgsCZS0h
-QePL0dQkYsjm6XVmrAK4MwRi5obFFgkrBgEEAdpHDwEBB0BYP2r4I9LGW8ai+fLW
+BFOgDhKKCHBuMwP12AIM8y8L64/eOWFpR7s2StAPjjYbZeZECHLWZt1zGVvkS7Xp
-RKXGonni9TljqFVN5mV/yuxlPoh+BBgWCgAmFiEE99N4kCKKkHRA4f1IRrkijoFK
+6lsAg6/T8EysKG7vTl2Qq9W0BmzNgk2ODTZkhv0gqqXppdr8eRiq+h0qMfJptG0G
-KqwFAmLmhsUCGyAFCQPCZwAACgkQRrkijoFKKqzeYwD/emjtDBD0EiCnS2mvfopa
+ycOvqb9PoEO2dfNCjjII8VfaSGfSEYo8UwsqYTtfgdoNnFCXKd1r7QmvrdbNsFDR
-T6foJSfXbiCe83UdFNebTjQBANFqnkXPCYb9dFIyM/0N1JXH7yj81VuslSqPi4NR
+mkv+wWJoipwUaVquyb2KN652jSlpwMECW6fSEsT/5C3mJLgAmi6l6yosw6HdIY6j
-SNkE
+gpCGtxnHW2zReIS6ezZdtxYBCkEHK70yASyaIHrLLDknw+DuKvXAWOAecob8GNBH
-=oTMO
+OjXZe3LzBt2rVgOCRa+W7milNgjUCsz+R3rM8XfR+wNEGwARAQABiH4EGBYKACYW
+IQT303iQIoqQdEDh/UhGuSKOgUoqrAUCYuaGegIbDAUJA8JnAAAKCRBGuSKOgUoq
+rDE0AQDBxRsmW9L60mxGCp1CpNWBXD2T6D605PlNiNCcM+cOCgD/c2OitSSG50M0
+YRbyh1LPYL6YQePL0dQkYsjm6XVmrAKIfgQYFgoAJgIbDBYhBPfTeJAiipB0QOH9
+SEa5Io6BSiqsBQJmqp4FBQkFpUsIAAoJEEa5Io6BSiqsydsA/ihBulpSSLg4B9pJ
+sffqphMht7yT3Dnz57iexUEgj3jBAQDedI+gwpZlMjV6IdH/Epz244j82Ta04cqk
+SOz2Y63LBrgzBGLmhsUWCSsGAQQB2kcPAQEHQFg/avgj0sZbxqL58tZEpcaieeL1
+OWOoVU3mZX/K7GU+iH4EGBYKACYWIQT303iQIoqQdEDh/UhGuSKOgUoqrAUCYuaG
+xQIbIAUJA8JnAAAKCRBGuSKOgUoqrN5jAP96aO0MEPQSIKdLaa9+ilpPp+glJ9du
+IJ7zdR0U15tONAEA0WqeRc8Jhv10UjIz/Q3UlcfvKPzVW6yVKo+Lg1FI2QSIfgQY
+FgoAJgIbIBYhBPfTeJAiipB0QOH9SEa5Io6BSiqsBQJmqp4GBQkFpUq9AAoJEEa5
+Io6BSiqsjF0BAJn0EBEJfszskYiZzMshFHW5k0QUF+Ak3JNh2UG+M6FJAQCQVY/l
+DkrvOytuFnKbkDrCaTrtLh/JAmBXpSERIejmDw==
+=7cFp
 -----END PGP PUBLIC KEY BLOCK-----

misc/builder.nix

@@ -2,4 +2,10 @@
 
 {
   nix.settings.trusted-users = [ "@nix-builder-users" ];
+  nix.daemonCPUSchedPolicy = "batch";
+
+  boot.binfmt.emulatedSystems = [
+    "aarch64-linux"
+    "armv7l-linux"
+  ];
 }

misc/metrics-exporters.nix

@@ -14,13 +14,31 @@
       "::1"
       values.hosts.ildkule.ipv4
       values.hosts.ildkule.ipv6
-      values.hosts.ildkule.ipv4_global
-      values.hosts.ildkule.ipv6_global
     ];
   };
 
 
-  networking.firewall.allowedTCPPorts = [ 9100 ];
+  services.prometheus.exporters.systemd = {
+    enable = true;
+    port = 9101;
+    extraFlags = [
+      "--systemd.collector.enable-restart-count"
+      "--systemd.collector.enable-ip-accounting"
+    ];
+  };
+
+  systemd.services.prometheus-systemd-exporter.serviceConfig = {
+    IPAddressDeny = "any";
+    IPAddressAllow = [
+      "127.0.0.1"
+      "::1"
+      values.hosts.ildkule.ipv4
+      values.hosts.ildkule.ipv6
+    ];
+  };
+  
+
+  networking.firewall.allowedTCPPorts = [ 9100 9101 ];
 
   services.promtail = {
     enable = true;

modules/gickup/default.nix

@@ -0,0 +1,310 @@
+{ config, pkgs, lib, utils, ... }:
+let
+  cfg = config.services.gickup;
+  format = pkgs.formats.yaml { };
+in
+{
+  imports = [
+    ./set-description.nix
+    ./hardlink-files.nix
+    ./import-from-toml.nix
+    ./update-linktree.nix
+  ];
+
+  options.services.gickup = {
+    enable = lib.mkEnableOption "gickup, a git repository mirroring service";
+
+    package = lib.mkPackageOption pkgs "gickup" { };
+    gitPackage = lib.mkPackageOption pkgs "git" { };
+    gitLfsPackage = lib.mkPackageOption pkgs "git-lfs" { };
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      description = "The directory to mirror repositories to.";
+      default = "/var/lib/gickup";
+      example = "/data/gickup";
+    };
+
+    destinationSettings = lib.mkOption {
+      description = ''
+        Settings for destination local, see gickup configuration file
+
+        Note that `path` will be set automatically to `/var/lib/gickup`
+      '';
+      type = lib.types.submodule {
+        freeformType = format.type;
+      };
+      default = { };
+      example = {
+        structured = true;
+        zip = false;
+        keep = 10;
+        bare = true;
+        lfs = true;
+      };
+    };
+
+    instances = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule (submoduleInputs@{ name, ... }: let
+        submoduleName = name;
+
+        nameParts = rec {
+          repoType = builtins.head (lib.splitString ":" submoduleName);
+
+          owner = if repoType == "any"
+                  then null
+                  else lib.pipe submoduleName [
+                    (lib.removePrefix "${repoType}:")
+                    (lib.splitString "/")
+                    builtins.head
+                  ];
+
+          repo = if repoType == "any"
+                 then null
+                 else lib.pipe submoduleName [
+                    (lib.removePrefix "${repoType}:")
+                    (lib.splitString "/")
+                    lib.last
+                  ];
+
+          slug = if repoType == "any"
+                 then lib.toLower (builtins.replaceStrings [ ":" "/" ] [ "-" "-" ] submoduleName)
+                 else "${lib.toLower repoType}-${lib.toLower owner}-${lib.toLower repo}";
+        };
+      in {
+        options = {
+          interval = lib.mkOption {
+            type = lib.types.str;
+            default = "daily";
+            example = "weekly";
+            description = ''
+              Specification (in the format described by {manpage}`systemd.time(7)`) of the time
+              interval at which to run the service.
+            '';
+          };
+
+          type = lib.mkOption {
+            type = lib.types.enum [
+              "github"
+              "gitlab"
+              "gitea"
+              "gogs"
+              "bitbucket"
+              "onedev"
+              "sourcehut"
+              "any"
+            ];
+            example = "github";
+            default = nameParts.repoType;
+            description = ''
+              The type of the repository to mirror.
+            '';
+          };
+
+          owner = lib.mkOption {
+            type = with lib.types; nullOr str;
+            example = "go-gitea";
+            default = nameParts.owner;
+            description = ''
+              The owner of the repository to mirror (if applicable)
+            '';
+          };
+
+          repo = lib.mkOption {
+            type = with lib.types; nullOr str;
+            example = "gitea";
+            default = nameParts.repo;
+            description = ''
+              The name of the repository to mirror (if applicable)
+            '';
+          };
+
+          slug = lib.mkOption {
+            type = lib.types.str;
+            default = nameParts.slug;
+            example = "github-go-gitea-gitea";
+            description = ''
+              The slug of the repository to mirror.
+            '';
+          };
+
+          description = lib.mkOption {
+            type = with lib.types; nullOr str;
+            example = "A project which does this and that";
+            description = ''
+              A description of the project. This isn't used directly by gickup for anything,
+              but can be useful if gickup is used together with cgit or similar.
+            '';
+          };
+
+          settings = lib.mkOption {
+            description = "Instance specific settings, see gickup configuration file";
+            type = lib.types.submodule {
+              freeformType = format.type;
+            };
+            default = { };
+            example = {
+              username = "gickup";
+              password = "hunter2";
+              wiki = true;
+              issues = true;
+            };
+          };
+        };
+      }));
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.gickup = {
+      isSystemUser = true;
+      group = "gickup";
+      home = "/var/lib/gickup";
+    };
+
+    users.groups.gickup = { };
+
+    services.gickup.destinationSettings.path = "/var/lib/gickup/raw";
+
+    systemd.tmpfiles.settings."10-gickup" = lib.mkIf (cfg.dataDir != "/var/lib/gickup") {
+      ${cfg.dataDir}.d = {
+        user = "gickup";
+        group = "gickup";
+        mode = "0755";
+      };
+    };
+
+    systemd.slices."system-gickup" = {
+      description = "Gickup git repository mirroring service";
+      after = [ "network.target" ];
+    };
+
+    systemd.targets.gickup = {
+      description = "Gickup git repository mirroring service";
+      wants = map ({ slug, ... }: "gickup@${slug}.service") (lib.attrValues cfg.instances);
+    };
+
+    systemd.timers = {
+      "gickup@" = {
+        description = "Gickup git repository mirroring service for %i";
+
+        timerConfig = {
+          OnCalendar = "daily";
+          RandomizedDelaySec = "1h";
+          Persistent = true;
+          AccuracySec = "1s";
+        };
+      };
+    }
+    //
+    # Overrides for mirrors which are not "daily"
+    (lib.pipe cfg.instances [
+      builtins.attrValues
+      (builtins.filter (instance: instance.interval != "daily"))
+      (map ({ slug, interval, ... }: {
+        name = "gickup@${slug}";
+        value = {
+          overrideStrategy = "asDropin";
+          timerConfig.OnCalendar = interval;
+        };
+      }))
+      builtins.listToAttrs
+    ]);
+
+    systemd.targets.timers.wants = map ({ slug, ... }: "gickup@${slug}.timer") (lib.attrValues cfg.instances);
+
+    systemd.services = {
+      "gickup@" = let
+        configDir = lib.pipe cfg.instances [
+          (lib.mapAttrsToList (name: instance: {
+            name = "${instance.slug}.yml";
+            path = format.generate "gickup-configuration-${name}.yml" {
+              destination.local = [ cfg.destinationSettings ];
+              source.${instance.type} = [
+                (
+                  (lib.optionalAttrs (instance.type != "any") {
+                    user = instance.owner;
+                    includeorgs = [ instance.owner ];
+                    include = [ instance.repo ];
+                  })
+                  //
+                  instance.settings
+                )
+              ];
+            };
+          }))
+          (pkgs.linkFarm "gickup-configuration-files")
+        ];
+      in {
+        description = "Gickup git repository mirroring service for %i";
+        after = [ "network.target" ];
+
+        path = [
+          cfg.gitPackage
+          cfg.gitLfsPackage
+        ];
+
+        restartIfChanged = false;
+
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "'${pkgs.gickup}/bin/gickup' '${configDir}/%i.yml'";
+          ExecStartPost = "";
+
+          User = "gickup";
+          Group = "gickup";
+
+          BindPaths = lib.optionals (cfg.dataDir != "/var/lib/gickup") [
+            "${cfg.dataDir}:/var/lib/gickup"
+          ];
+
+          Slice = "system-gickup.slice";
+
+          SyslogIdentifier = "gickup-%i";
+          StateDirectory = "gickup";
+          # WorkingDirectory = "gickup";
+          # RuntimeDirectory = "gickup";
+          # RuntimeDirectoryMode = "0700";
+
+          # https://discourse.nixos.org/t/how-to-prevent-custom-systemd-service-from-restarting-on-nixos-rebuild-switch/43431
+          RemainAfterExit = true;
+
+          # Hardening options
+          AmbientCapabilities = [];
+          LockPersonality = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateMounts = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          # ProtectProc = "invisible";
+          # ProtectSystem = "strict";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          # SystemCallFilter = [
+          #   "@system-service"
+          #   "~@resources"
+          #   "~@privileged"
+          # ];
+          UMask = "0002";
+          CapabilityBoundingSet = [];
+        };
+      };
+    };
+  };
+}

modules/gickup/hardlink-files.nix

@@ -0,0 +1,42 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.gickup;
+in
+{
+  config = lib.mkIf cfg.enable {
+    # TODO: add a service that will look at the backed up files and hardlink
+    #       the ones that have a matching hash together to save space. This can
+    #       either run routinely (i.e. trigger by systemd-timer), or be activated
+    #       whenever a gickup@<slug>.service finishes. The latter is probably better.
+
+    # systemd.services."gickup-hardlink" = {
+    #   serviceConfig = {
+    #     Type = "oneshot";
+    #     ExecStart = let
+    #       script = pkgs.writeShellApplication {
+    #         name = "gickup-hardlink-files.sh";
+    #         runtimeInputs = [ pkgs.coreutils pkgs.jdupes ];
+    #         text = ''
+
+    #         '';
+    #       };
+    #     in lib.getExe script;
+
+    #     User = "gickup";
+    #     Group = "gickup";
+
+    #     BindPaths = lib.optionals (cfg.dataDir != "/var/lib/gickup") [
+    #       "${cfg.dataDir}:/var/lib/gickup"
+    #     ];
+
+    #     Slice = "system-gickup.slice";
+
+    #     StateDirectory = "gickup";
+
+    #     # Hardening options
+    #     # TODO:
+    #     PrivateNetwork = true;
+    #   };
+    # };
+  };
+}

modules/gickup/import-from-toml.nix

@@ -0,0 +1,11 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.gickup;
+in
+{
+  config = lib.mkIf cfg.enable {
+    # TODO: import cfg.instances from a toml file to make it easier for non-nix users
+    #       to add repositories to mirror
+  };
+}

modules/gickup/set-description.nix

@@ -0,0 +1,9 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.gickup;
+in
+{
+  config = lib.mkIf cfg.enable {
+    # TODO: create .git/description files for each repo where cfg.instances.<instance>.description is set
+  };
+}

modules/gickup/update-linktree.nix

@@ -0,0 +1,84 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.gickup;
+in
+{
+  config = lib.mkIf cfg.enable {
+    # TODO: run upon completion of cloning a repository
+    systemd.timers."gickup-linktree" = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "daily";
+        Persistent = true;
+        Unit = "gickup-linktree.service";
+      };
+    };
+
+    # TODO: update symlink for one repo at a time (e.g. gickup-linktree@<instance>.service)
+    systemd.services."gickup-linktree" = {
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = let
+          script = pkgs.writeShellApplication {
+            name = "gickup-update-symlink-tree.sh";
+            runtimeInputs = [
+              pkgs.coreutils
+              pkgs.findutils
+            ];
+            text = ''
+              shopt -s nullglob
+
+              for repository in ./*/*/*; do
+                REPOSITORY_RELATIVE_DIRS=''${repository#"./"}
+
+                echo "Checking $REPOSITORY_RELATIVE_DIRS"
+
+                declare -a REVISIONS
+                readarray -t REVISIONS < <(find "$repository" -mindepth 1 -maxdepth 1 -printf "%f\n" | sort --numeric-sort --reverse)
+
+                if [[ "''${#REVISIONS[@]}" == 0 ]]; then
+                  echo "Found no revisions for $repository, continuing"
+                  continue
+                fi
+
+                LAST_REVISION="''${REVISIONS[0]}"
+                SYMLINK_PATH="../linktree/''${REPOSITORY_RELATIVE_DIRS}"
+
+                mkdir -p "$(dirname "$SYMLINK_PATH")"
+
+                EXPECTED_SYMLINK_TARGET=$(realpath "''${repository}/''${LAST_REVISION}")
+                EXISTING_SYMLINK_TARGET=$(realpath "$SYMLINK_PATH" || echo "<none>")
+
+                if [[ "$EXISTING_SYMLINK_TARGET" != "$EXPECTED_SYMLINK_TARGET" ]]; then
+                  echo "Updating symlink for $REPOSITORY_RELATIVE_DIRS"
+                  rm "$SYMLINK_PATH" ||:
+                  ln -rs "$EXPECTED_SYMLINK_TARGET" "$SYMLINK_PATH"
+                else
+                  echo "Symlink already up to date, continuing..."
+                fi
+
+                echo "---"
+              done
+            '';
+          };
+        in lib.getExe script;
+
+        User = "gickup";
+        Group = "gickup";
+
+        BindPaths = lib.optionals (cfg.dataDir != "/var/lib/gickup") [
+          "${cfg.dataDir}:/var/lib/gickup"
+        ];
+
+        Slice = "system-gickup.slice";
+
+        StateDirectory = "gickup";
+        WorkingDirectory = "/var/lib/gickup/raw";
+
+        # Hardening options
+        # TODO:
+        PrivateNetwork = true;
+      };
+    };
+  };
+}

modules/grzegorz.nix

@@ -1,59 +1,100 @@
 {config, lib, pkgs, ...}:
 let
-  grg = config.services.grzegorz;
+  grg = config.services.greg-ng;
   grgw = config.services.grzegorz-webui;
-in {
-  services.pipewire.enable = true;
-  services.pipewire.alsa.enable = true;
-  services.pipewire.alsa.support32Bit = true;
-  services.pipewire.pulse.enable = true;
 
-  users.users.pvv = {
+  machine = config.networking.hostName;
-    isNormalUser = true;
+in {
-    description = "pvv";
+  services.greg-ng = {
+    enable = true;
+    settings.host = "localhost";
+    settings.port = 31337;
+    enableSway = true;
+    enablePipewire = true;
   };
 
-  services.grzegorz.enable = true;
+  systemd.user.services.restart-greg-ng = {
-  services.grzegorz.listenAddr = "localhost";
+    script = "systemctl --user restart greg-ng.service";
-  services.grzegorz.listenPort = 31337;
+    startAt = "*-*-* 06:30:00";
+  };
 
-  services.grzegorz-webui.enable = true;
+  services.grzegorz-webui = {
-  services.grzegorz-webui.listenAddr = "localhost";
+    enable = true;
-  services.grzegorz-webui.listenPort = 42069;
+    listenAddr = "localhost";
-  services.grzegorz-webui.listenWebsocketPort = 42042;
+    listenPort = 42069;
-  services.grzegorz-webui.hostName = "${config.networking.fqdn}";
+    listenWebsocketPort = 42042;
-  services.grzegorz-webui.apiBase = "http://${toString grg.listenAddr}:${toString grg.listenPort}/api";
+    hostName = "${machine}-old.pvv.ntnu.no";
+    apiBase = "https://${machine}-backend.pvv.ntnu.no/api";
+  };
+
+  services.gergle = {
+    enable = true;
+    virtualHost = config.networking.fqdn;
+  };
 
   services.nginx.enable = true;
+  services.nginx.virtualHosts = {
+    ${config.networking.fqdn} = {
+      forceSSL = true;
+      enableACME = true;
+      kTLS = true;
+      serverAliases = [
+        "${machine}.pvv.org"
+      ];
+      extraConfig = ''
+        allow 129.241.210.128/25;
+        allow 2001:700:300:1900::/64;
+        deny all;
+      '';
+    };
 
-  services.nginx.virtualHosts."${config.networking.fqdn}" = {
+    "${machine}-backend.pvv.ntnu.no" = {
-    forceSSL = true;
+      forceSSL = true;
-    enableACME = true;
+      enableACME = true;
-    kTLS = true;
+      kTLS = true;
-    serverAliases = [
+      serverAliases = [
-      "${config.networking.hostName}.pvv.org"
+        "${machine}-backend.pvv.org"
-    ];
+      ];
-    extraConfig = ''
+      extraConfig = ''
-      allow 129.241.210.128/25;
+        allow 129.241.210.128/25;
-      allow 2001:700:300:1900::/64;
+        allow 2001:700:300:1900::/64;
-      deny all;
+        deny all;
-    '';
+      '';
 
-    locations."/" = {
+      locations."/" = {
-      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenPort}";
+        proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
+        proxyWebsockets = true;
+      };
     };
-    # https://github.com/rawpython/remi/issues/216
+
-    locations."/websocket" = {
+    "${machine}-old.pvv.ntnu.no" = {
-      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenWebsocketPort}";
+      forceSSL = true;
-      proxyWebsockets = true;
+      enableACME = true;
-    };
+      kTLS = true;
-    locations."/api" = {
+      serverAliases = [
-      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
+        "${machine}-old.pvv.org"
-    };
+      ];
-    locations."/docs" = {
+      extraConfig = ''
-      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
+        allow 129.241.210.128/25;
+        allow 2001:700:300:1900::/64;
+        deny all;
+      '';
+
+      locations."/" = {
+        proxyPass = "http://${grgw.listenAddr}:${toString grgw.listenPort}";
+      };
+      # https://github.com/rawpython/remi/issues/216
+      locations."/websocket" = {
+        proxyPass = "http://${grgw.listenAddr}:${toString grgw.listenWebsocketPort}";
+        proxyWebsockets = true;
+      };
+      locations."/api" = {
+        proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
+      };
+      locations."/docs" = {
+        proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
+      };
     };
   };
-
 }
 

modules/robots-txt.nix

@@ -0,0 +1,116 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.environment.robots-txt;
+
+  robots-txt-format = {
+    type = let
+      coercedStrToNonEmptyListOfStr = lib.types.coercedTo lib.types.str lib.singleton (lib.types.nonEmptyListOf lib.types.str);
+    in lib.types.listOf (lib.types.submodule {
+      freeformType = lib.types.attrsOf coercedStrToNonEmptyListOfStr;
+      options = {
+        pre_comment = lib.mkOption {
+          description = "Comment to add before the rule";
+          type = lib.types.lines;
+          default = "";
+        };
+        post_comment = lib.mkOption {
+          description = "Comment to add after the rule";
+          type = lib.types.lines;
+          default = "";
+        };
+      };
+    });
+
+    generate = name: value: let
+      makeComment = comment: lib.pipe comment [
+        (lib.splitString "\n")
+        (lib.map (line: if line == "" then "#" else "# ${line}"))
+        (lib.concatStringsSep "\n")
+      ];
+
+      ruleToString = rule: let
+        user_agent = rule.User-agent or [];
+        pre_comment = rule.pre_comment;
+        post_comment = rule.post_comment;
+        rest = builtins.removeAttrs rule [ "User-agent" "pre_comment" "post_comment" ];
+      in lib.concatStringsSep "\n" (lib.filter (x: x != null) [
+        (if (pre_comment != "") then makeComment pre_comment else null)
+        (let
+          user-agents = lib.concatMapStringsSep "\n" (value: "User-agent: ${value}") user_agent;
+        in
+          if user_agent == [] then null else user-agents
+        )
+        (lib.pipe rest [
+          (lib.mapAttrsToList (ruleName: map (value: "${ruleName}: ${value}")))
+          lib.concatLists
+          (lib.concatStringsSep "\n")
+        ])
+        (if (post_comment != "") then makeComment post_comment else null)
+      ]);
+
+      content = lib.concatMapStringsSep "\n\n" ruleToString value;
+    in pkgs.writeText name content;
+  };
+in
+{
+  options.environment.robots-txt = lib.mkOption {
+    default = { };
+    description = ''
+      Different instances of robots.txt to use with web services.
+    '';
+    type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
+      options = {
+        enable = lib.mkEnableOption "this instance of robots.txt" // {
+          default = true;
+        };
+
+        path = lib.mkOption {
+          description = "The resulting path of the dir containing the robots.txt file";
+          type = lib.types.path;
+          readOnly = true;
+          default = "/etc/robots-txt/${name}";
+        };
+
+        rules = lib.mkOption {
+          description = "Rules to include in robots.txt";
+          default = [ ];
+          example = [
+            { User-agent = "Googlebot"; Disallow = "/no-googlebot"; }
+            { User-agent = "Bingbot"; Disallow = [ "/no-bingbot" "/no-bingbot2" ]; }
+          ];
+          type = robots-txt-format.type;
+        };
+
+        virtualHost = lib.mkOption {
+          description = "An nginx virtual host to add the robots.txt to";
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+      };
+    }));
+  };
+
+  config = {
+    environment.etc = lib.mapAttrs' (name: value: {
+      name = "robots-txt/${name}/robots.txt";
+      value.source = robots-txt-format.generate name value.rules;
+    }) cfg;
+
+    services.nginx.virtualHosts = lib.pipe cfg [
+      (lib.filterAttrs (_: value: value.virtualHost != null))
+      (lib.mapAttrs' (name: value: {
+        name = value.virtualHost;
+        value = {
+          locations = {
+            "= /robots.txt" = {
+              extraConfig = ''
+                add_header Content-Type text/plain;
+              '';
+              root = cfg.${name}.path;
+            };
+          };
+        };
+      }))
+    ];
+  };
+}