Add function to make paths from flake root

No more ../../../../../../
Merge pull request 'Ildkule: Move monitoring state directories to data volume' (!88 ) from ildkule-data-volume into main
2024-11-17 00:08:02 +01:00 · 2024-11-10 02:30:11 +01:00 · 2024-11-09 22:22:09 +01:00 · 2024-11-09 21:42:44 +01:00 · 2024-11-09 19:43:07 +01:00 · 2024-11-09 19:40:03 +01:00
36 changed files with 609 additions and 193 deletions
--- a/base/default.nix
+++ b/base/default.nix
@ -1,9 +1,9 @@
-{ pkgs, lib, ... }:
+{ pkgs, lib, fp, ... }:

 {
  imports = [
-    ../users
-    ../modules/snakeoil-certs.nix
+    (fp /users)
+    (fp /modules/snakeoil-certs.nix)

    ./networking.nix
    ./nix.nix
--- a/base/services/openssh.nix
+++ b/base/services/openssh.nix
@ -10,5 +10,12 @@
      Match All
    '';
    settings.PermitRootLogin = "yes";
+
  };
-}
+    users.users."root".openssh.authorizedKeys.keys = [
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqVt4LCe0YIttr9swFxjkjn37ZDY9JxwVC+2gvfSINDJorOCtqPjDOTD2fTS1Gz08QCwpnLWq2kyvRchu6WgriAbSACpbZZBgxRaF/FVh3oiMVFGnNKGnv6/fdo/vZtu8mUVuqtmTrgLYpZdbR4oD3XiBlDKs7Cv5hPqt95lnP6MNFvE8mICCfd1PwhsABd2IQ5laz3u77/RXhNFJL0Kf2/+6gk9awcLuwHrPdvq7c3BxRHbc9UMRQENyjyQPa7aLe+uJBFLKP51I8VBuDpDacuibQx7nMt6N2UJ2KWI0JxRMHuJNq4S5jidR82aOw9gzGbTv30SKNLMqsZ0xj4LtdqCXDiZF6Lr09PsJYsvnBUFWa14HGcThKDtgwQwBryNViYmfv//0h9+RLZiU0ab+NEwSs7Zh5iAD+vhx64QqNX3tR7Le4SWXh8W0eShU9N78qYdSkiC3Ui7htxeqOocXM/P4AwbnHsLELIvkHdvgchCPvl8ygZa4WJTEWv16+ICskJcAKWGuqjvXAFuwjJJmPp9xLW9O0DFfQhMELiGamQR9wK07yYQVr34iah6qZO7cwhSKyEPFrVPIaNtfDhsjED639F7vmktf26SWNJHWfW0wOHILjI6TgqUvy0JDd8W8w0CHlAfz6Fs2l99NNgNF8dB3vBASbxS0hu/y0PVu/xQ== openstack-sleipner"
+
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCbgJ0Uwh9VSVhfId7l9i5/jk4CvAK5rbkiab8R+moF root@sleipner"
+    ];
+}
+
--- a/flake.lock
+++ b/flake.lock
@ -7,11 +7,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1725242307,
-        "narHash": "sha256-a2iTMBngegEZvaNAzzxq5Gc5Vp3UWoGUqWtK11Txbic=",
+        "lastModified": 1731746438,
+        "narHash": "sha256-f3SSp1axoOk0NAI7oFdRzbxG2XPBSIXC+/DaAXnvS1A=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "96073e6423623d4a8027e9739d2af86d6422ea7a",
+        "rev": "cb64993826fa7a477490be6ccb38ba1fa1e18fa8",
        "type": "github"
      },
      "original": {
@ -20,64 +20,25 @@
        "type": "github"
      }
    },
-    "fix-python": {
+    "greg-ng": {
      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "grzegorz",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1725463969,
-        "narHash": "sha256-d3c1TAlIN1PtK+oQP1wO6XbDfmR4SUp/C/4s7G46ARo=",
-        "owner": "GuillaumeDesforges",
-        "repo": "fix-python",
-        "rev": "2926402234c3f99aa8e4608c51d9ffa73ea403c0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "GuillaumeDesforges",
-        "repo": "fix-python",
-        "type": "github"
-      }
-    },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1689068808,
-        "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
-        "type": "github"
-      },
-      "original": {
-        "id": "flake-utils",
-        "type": "indirect"
-      }
-    },
-    "grzegorz": {
-      "inputs": {
-        "fix-python": "fix-python",
        "nixpkgs": [
          "nixpkgs"
-        ]
+        ],
+        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1726861911,
-        "narHash": "sha256-pXPmVp4AgszzJXlLjj8r9NxoDvxoV4USGaiMwqCyb4M=",
-        "ref": "refs/heads/master",
-        "rev": "d10db19d7df5c5c2cd2dcb878376d5d681f6c2f2",
-        "revCount": 94,
+        "lastModified": 1730249639,
+        "narHash": "sha256-G3URSlqCcb+GIvGyki+HHrDM5ZanX/dP9BtppD/SdfI=",
+        "ref": "refs/heads/main",
+        "rev": "80e0447bcb79adad4f459ada5610f3eae987b4e3",
+        "revCount": 34,
        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/grzegorz.git"
+        "url": "https://git.pvv.ntnu.no/Projects/greg-ng.git"
      },
      "original": {
        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/grzegorz.git"
+        "url": "https://git.pvv.ntnu.no/Projects/greg-ng.git"
      }
    },
    "grzegorz-clients": {
@ -158,11 +119,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1725198597,
-        "narHash": "sha256-w3sjCEbnc242ByJ18uebzgjFZY3QU7dZhmLwPsJIZJs=",
+        "lastModified": 1731663789,
+        "narHash": "sha256-x07g4NcqGP6mQn6AISXJaks9sQYDjZmTMBlKIvajvyc=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "3524b030c839db4ea4ba16737789c6fb8a1769c6",
+        "rev": "035d434d48f4375ac5d3a620954cf5fda7dd7c36",
        "type": "github"
      },
      "original": {
@ -174,11 +135,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1721524707,
-        "narHash": "sha256-5NctRsoE54N86nWd0psae70YSLfrOek3Kv1e8KoXe/0=",
+        "lastModified": 1730602179,
+        "narHash": "sha256-efgLzQAWSzJuCLiCaQUCDu4NudNlHdg2NzGLX5GYaEY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "556533a23879fc7e5f98dd2e0b31a6911a213171",
+        "rev": "3c2f1c4ca372622cb2f9de8016c9a0b1cbd0f37c",
        "type": "github"
      },
      "original": {
@ -190,11 +151,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1725183711,
-        "narHash": "sha256-gkjg8FfjL92azt3gzZUm1+v+U4y+wbQE630uIf4Aybo=",
+        "lastModified": 1731745710,
+        "narHash": "sha256-SVeiClbgqL071JpAspOu0gCkPSAL51kSIRwo4C/pghA=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "a2c345850e5e1d96c62e7fa8ca6c9d77ebad1c37",
+        "rev": "dfaa4cb76c2d450d8f396bb6b9f43cede3ade129",
        "type": "github"
      },
      "original": {
@ -247,7 +208,7 @@
    "root": {
      "inputs": {
        "disko": "disko",
-        "grzegorz": "grzegorz",
+        "greg-ng": "greg-ng",
        "grzegorz-clients": "grzegorz-clients",
        "matrix-next": "matrix-next",
        "minecraft-data": "minecraft-data",
@ -259,6 +220,27 @@
        "sops-nix": "sops-nix"
      }
    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "greg-ng",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1729391507,
+        "narHash": "sha256-as0I9xieJUHf7kiK2a9znDsVZQTFWhM1pLivII43Gi0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "784981a9feeba406de38c1c9a3decf966d853cca",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
    "sops-nix": {
      "inputs": {
        "nixpkgs": [
@ -267,11 +249,11 @@
        "nixpkgs-stable": "nixpkgs-stable"
      },
      "locked": {
-        "lastModified": 1725201042,
-        "narHash": "sha256-lj5pxOwidP0W//E7IvyhbhXrnEUW99I07+QpERnzTS4=",
+        "lastModified": 1731748189,
+        "narHash": "sha256-Zd/Uukvpcu26M6YGhpbsgqm6LUSLz+Q8mDZ5LOEGdiE=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "5db5921e40ae382d6716dce591ea23b0a39d96f7",
+        "rev": "d2bd7f433b28db6bc7ae03d5eca43564da0af054",
        "type": "github"
      },
      "original": {
@ -279,21 +261,6 @@
        "repo": "sops-nix",
        "type": "github"
      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@ -23,8 +23,8 @@
    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git";
    nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";

-    grzegorz.url = "git+https://git.pvv.ntnu.no/Projects/grzegorz.git";
-    grzegorz.inputs.nixpkgs.follows = "nixpkgs";
+    greg-ng.url = "git+https://git.pvv.ntnu.no/Projects/greg-ng.git";
+    greg-ng.inputs.nixpkgs.follows = "nixpkgs";
    grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Projects/grzegorz-clients.git";
    grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";

@ -57,8 +57,9 @@
        rec {
          system = "x86_64-linux";
          specialArgs = {
-            inherit nixpkgs-unstable inputs;
+            inherit unstablePkgs inputs;
            values = import ./values.nix;
+            fp = path: ./${path};
          };

          modules = [
@ -116,14 +117,20 @@

      brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
        modules = [
-          inputs.grzegorz.nixosModules.grzegorz-kiosk
          inputs.grzegorz-clients.nixosModules.grzegorz-webui
+          inputs.greg-ng.nixosModules.default
+        ];
+        overlays = [
+          inputs.greg-ng.overlays.default
        ];
      };
      georg = stableNixosConfig "georg" {
        modules = [
-          inputs.grzegorz.nixosModules.grzegorz-kiosk
          inputs.grzegorz-clients.nixosModules.grzegorz-webui
+          inputs.greg-ng.nixosModules.default
+        ];
+        overlays = [
+          inputs.greg-ng.overlays.default
        ];
      };
    };
--- a/hosts/bekkalokk/configuration.nix
+++ b/hosts/bekkalokk/configuration.nix
@ -1,10 +1,10 @@
-{ pkgs, values, ... }:
+{ fp, pkgs, values, ... }:
 {
  imports = [
    ./hardware-configuration.nix

-    ../../base
-    ../../misc/metrics-exporters.nix
+    (fp /base)
+    (fp /misc/metrics-exporters.nix)

    ./services/bluemap/default.nix
    ./services/gitea/default.nix
@ -16,9 +16,10 @@
    ./services/vaultwarden.nix
    ./services/webmail
    ./services/website
+    ./services/well-known
  ];

-  sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
+  sops.defaultSopsFile = fp /secrets/bekkalokk/bekkalokk.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
--- a/hosts/bekkalokk/services/gitea/default.nix
+++ b/hosts/bekkalokk/services/gitea/default.nix
@ -1,4 +1,4 @@
-{ config, values, pkgs, lib, ... }:
+{ config, values, fp, pkgs, lib, ... }:
 let
  cfg = config.services.gitea;
  domain = "git.pvv.ntnu.no";
@ -104,6 +104,30 @@ in {
        ENABLE_FEDERATED_AVATAR = false;
      };
      actions.ENABLED = true;
+      ui = {
+        REACTIONS = lib.concatStringsSep "," [
+          "+1"
+          "-1"
+          "laugh"
+          "confused"
+          "heart"
+          "hooray"
+          "rocket"
+          "eyes"
+          "100"
+          "anger"
+          "astonished"
+          "no_good"
+          "ok_hand"
+          "pensive"
+          "pizza"
+          "point_up"
+          "sob"
+          "skull"
+          "upside_down_face"
+          "shrug"
+        ];
+      };
      "ui.meta".DESCRIPTION = "Bokstavelig talt programvareverkstedet";
    };
  };
@ -149,8 +173,8 @@ in {
    };

    script = let
-      logo-svg = ../../../../assets/logo_blue_regular.svg;
-      logo-png = ../../../../assets/logo_blue_regular.png;
+      logo-svg = fp /assets/logo_blue_regular.svg;
+      logo-png = fp /assets/logo_blue_regular.png;
      extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
        <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
        <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
--- a/hosts/bekkalokk/services/mediawiki/default.nix
+++ b/hosts/bekkalokk/services/mediawiki/default.nix
@ -1,4 +1,4 @@
-{ pkgs, lib, config, values, pkgs-unstable, ... }: let
+{ pkgs, lib, fp, config, values, pkgs-unstable, ... }: let
  cfg = config.services.mediawiki;

  # "mediawiki"
@ -210,8 +210,8 @@ in {
        '';
      };

-      "= /PNG/PVV-logo.svg".alias = ../../../../assets/logo_blue_regular.svg;
-      "= /PNG/PVV-logo.png".alias = ../../../../assets/logo_blue_regular.png;
+      "= /PNG/PVV-logo.svg".alias = fp /assets/logo_blue_regular.svg;
+      "= /PNG/PVV-logo.png".alias = fp /assets/logo_blue_regular.png;
      "= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
        buildInputs = with pkgs; [ imagemagick ];
      } ''
@ -219,7 +219,7 @@ in {
          -resize x64 \
          -gravity center \
          -crop 64x64+0+0 \
-          ${../../../../assets/logo_blue_regular.png} \
+          ${fp /assets/logo_blue_regular.png} \
          -flatten \
          -colors 256 \
          -background transparent \
--- a/hosts/bekkalokk/services/webmail/snappymail.nix
+++ b/hosts/bekkalokk/services/webmail/snappymail.nix
@ -1,8 +1,8 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, fp, pkgs, ... }:
 let
  cfg = config.services.snappymail;
 in {
-  imports = [ ../../../../modules/snappymail.nix ];
+  imports = [ (fp /modules/snappymail.nix) ];

  services.snappymail = {
    enable = true;
--- a/hosts/bekkalokk/services/website/default.nix
+++ b/hosts/bekkalokk/services/website/default.nix
@ -116,16 +116,6 @@ in {
      "/drift".return = "301 https://wiki.pvv.ntnu.no/wiki/Drift";
      "/diverse/abuse.php".return = "301 https://wiki.pvv.ntnu.no/wiki/CERT/Abuse";
      "/nerds/".return = "301 https://wiki.pvv.ntnu.no/wiki/Nerdepizza";
-
-      # Proxy the matrix well-known files
-      # Host has be set before proxy_pass
-      # The header must be set so nginx on the other side routes it to the right place
-      "^~ /.well-known/matrix/" = {
-        extraConfig = ''
-          proxy_set_header Host matrix.pvv.ntnu.no;
-          proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
-        '';
-      };
    };
  };
 }
--- a/hosts/bekkalokk/services/website/fetch-gallery.nix
+++ b/hosts/bekkalokk/services/website/fetch-gallery.nix
@ -62,6 +62,33 @@ in {
      WorkingDirectory = galleryDir;
      User = config.services.pvv-nettsiden.user;
      Group = config.services.pvv-nettsiden.group;
+
+      AmbientCapabilities = [ "" ];
+      CapabilityBoundingSet = [ "" ];
+      DeviceAllow = [ "" ];
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true; # disable for third party rotate scripts
+      PrivateDevices = true;
+      PrivateNetwork = true; # disable for mail delivery
+      PrivateTmp = true;
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true; # disable for userdir logs
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "full";
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true; # disable for creating setgid directories
+      SocketBindDeny = [ "any" ];
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+      ];
    };
  };
 }
--- a/hosts/bekkalokk/services/well-known/default.nix
+++ b/hosts/bekkalokk/services/well-known/default.nix
@ -0,0 +1,18 @@
+{ ... }:
+{
+  services.nginx.virtualHosts."www.pvv.ntnu.no".locations = {
+    "^~ /.well-known/" = {
+      alias = (toString ./root) + "/";
+    };
+
+    # Proxy the matrix well-known files
+    # Host has be set before proxy_pass
+    # The header must be set so nginx on the other side routes it to the right place
+    "^~ /.well-known/matrix/" = {
+      extraConfig = ''
+        proxy_set_header Host matrix.pvv.ntnu.no;
+        proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
+      '';
+    };
+  };
+}
--- a/hosts/bekkalokk/services/well-known/root/autoconfig/mail/config-v1.1.xml
+++ b/hosts/bekkalokk/services/well-known/root/autoconfig/mail/config-v1.1.xml
@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+<clientConfig version="1.1">
+  <emailProvider id="pvv.ntnu.no">
+    <domain>pvv.ntnu.no</domain>
+    <domain>pvv.org</domain>
+
+    <displayName>Programvareverkstedet</displayName>
+
+    <incomingServer type="imap">
+      <hostname>imap.pvv.ntnu.no</hostname>
+      <port>993</port>
+      <socketType>SSL</socketType>
+      <username>%EMAILLOCALPART%</username>
+      <authentication>password-cleartext</authentication>
+    </incomingServer>
+
+    <outgoingServer type="smtp">
+      <hostname>smtp.pvv.ntnu.no</hostname>
+      <port>587</port>
+      <socketType>STARTTLS</socketType>
+      <username>%EMAILLOCALPART%</username>
+      <authentication>password-cleartext</authentication>
+      <useGlobalPreferredServer>true</useGlobalPreferredServer>
+    </outgoingServer>
+
+    <documentation url="https://www.pvv.ntnu.no/pvv/Drift/Mail/IMAP_POP3">
+       <descr lang="en">Setup programvareverkstedet email user with IMAP or POP3</descr>
+       <descr lang="nb">Sett opp programvareverkstedet email bruker med IMAP eller POP3</descr>
+    </documentation>
+  </emailProvider>
+</clientConfig>
--- a/hosts/bekkalokk/services/well-known/root/security.txt
+++ b/hosts/bekkalokk/services/well-known/root/security.txt
@ -0,0 +1,12 @@
+Contact: mailto:drift@pvv.ntnu.no
+Contact: mailto:cert@pvv.ntnu.no
+# drift@pvv.ntnu.no is read by more people and have a quicker reaction time,
+# but cert@pvv.ntnu.no can be used for more severe issues.
+
+Preferred-Languages: no, en
+
+Expires: 2032-12-31T23:59:59.000Z
+# This file was last updated 2024-09-14.
+
+# You can find a wikipage for our security policies at:
+# https://wiki.pvv.ntnu.no/wiki/CERT
--- a/hosts/bicep/configuration.nix
+++ b/hosts/bicep/configuration.nix
@ -1,10 +1,10 @@
-{ pkgs, values, ... }:
+{ fp, pkgs, values, ... }:
 {
  imports = [
    ./hardware-configuration.nix

-    ../../base
-    ../../misc/metrics-exporters.nix
+    (fp /base)
+    (fp /misc/metrics-exporters.nix)
    ./services/nginx

    ./services/mysql.nix
@ -15,7 +15,7 @@
    ./services/matrix
  ];

-  sops.defaultSopsFile = ../../secrets/bicep/bicep.yaml;
+  sops.defaultSopsFile = fp /secrets/bicep/bicep.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
--- a/hosts/bicep/services/calendar-bot.nix
+++ b/hosts/bicep/services/calendar-bot.nix
@ -1,16 +1,16 @@
-{ config, lib, pkgs, ... }:
+{ config, fp, lib, pkgs, ... }:
 let
  cfg = config.services.pvv-calendar-bot;
 in {
  sops.secrets = {
    "calendar-bot/matrix_token" = {
-      sopsFile = ../../../secrets/bicep/bicep.yaml;
+      sopsFile = fp /secrets/bicep/bicep.yaml;
      key = "calendar-bot/matrix_token";
      owner = cfg.user;
      group = cfg.group;
    };
    "calendar-bot/mysql_password" = {
-      sopsFile = ../../../secrets/bicep/bicep.yaml;
+      sopsFile = fp /secrets/bicep/bicep.yaml;
      key = "calendar-bot/mysql_password";
      owner = cfg.user;
      group = cfg.group;
--- a/hosts/bicep/services/matrix/coturn.nix
+++ b/hosts/bicep/services/matrix/coturn.nix
@ -1,14 +1,14 @@
-{ config, lib, pkgs, secrets, values, ... }:
+{ config, lib, fp, pkgs, secrets, values, ... }:

 {
  sops.secrets."matrix/synapse/turnconfig" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "synapse/turnconfig";
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
  };
  sops.secrets."matrix/coturn/static-auth-secret" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "coturn/static-auth-secret";
    owner = config.users.users.turnserver.name;
    group = config.users.users.turnserver.group;
--- a/hosts/bicep/services/matrix/default.nix
+++ b/hosts/bicep/services/matrix/default.nix
@ -10,6 +10,7 @@
    ./mjolnir.nix

    ./discord.nix
+    ./hookshot
  ];


--- a/hosts/bicep/services/matrix/discord.nix
+++ b/hosts/bicep/services/matrix/discord.nix
@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, lib, fp, ... }:

 let
  cfg = config.services.mx-puppet-discord;
@ -6,15 +6,42 @@ in
 {
  users.groups.keys-matrix-registrations = { };

-  sops.secrets."matrix/registrations/mx-puppet-discord" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
-    key = "registrations/mx-puppet-discord";
+  sops.secrets."matrix/discord/as_token" = {
+    sopsFile = fp /secrets/bicep/matrix.yaml;
+    key = "discord/as_token";
+  };
+  sops.secrets."matrix/discord/hs_token" = {
+    sopsFile = fp /secrets/bicep/matrix.yaml;
+    key = "discord/hs_token";
+  };
+
+  sops.templates."discord-registration.yaml" = {
    owner = config.users.users.matrix-synapse.name;
    group = config.users.groups.keys-matrix-registrations.name;
+    content = ''
+      as_token: "${config.sops.placeholder."matrix/discord/as_token"}"
+      hs_token: "${config.sops.placeholder."matrix/discord/hs_token"}"
+      id: discord-puppet
+      namespaces:
+        users:
+          - exclusive: true
+            regex: '@_discordpuppet_.*'
+        rooms: []
+        aliases:
+          - exclusive: true
+            regex: '#_discordpuppet_.*'
+      protocols: []
+      rate_limited: false
+      sender_localpart: _discordpuppet_bot
+      url: 'http://localhost:8434'
+      de.sorunome.msc2409.push_ephemeral: true
+    '';
  };

  systemd.services.mx-puppet-discord = {
-    serviceConfig.SupplementaryGroups = [ config.users.groups.keys-matrix-registrations.name ];
+    serviceConfig.SupplementaryGroups = [
+      config.users.groups.keys-matrix-registrations.name
+    ];
  };


@ -29,11 +56,16 @@ in
    relay.whitelist = [ ".*" ];
    selfService.whitelist = [ "@danio:pvv\\.ntnu\\.no" "@dandellion:dodsorf\\.as" ];
  };
-  services.mx-puppet-discord.serviceDependencies = [ "matrix-synapse.target" "nginx.service" ];
+  services.mx-puppet-discord.serviceDependencies = [
+    "matrix-synapse.target"
+    "nginx.service"
+  ];


  services.matrix-synapse-next.settings = {
-    app_service_config_files = [ config.sops.secrets."matrix/registrations/mx-puppet-discord".path ];
+    app_service_config_files = [
+      config.sops.templates."discord-registration.yaml".path
+    ];
    use_appservice_legacy_authorization = true;
  };

--- a/hosts/bicep/services/matrix/hookshot/default.nix
+++ b/hosts/bicep/services/matrix/hookshot/default.nix
@ -0,0 +1,139 @@
+{ config, lib, fp, unstablePkgs, inputs, ... }:
+
+let
+  cfg = config.services.matrix-hookshot;
+  webhookListenAddress = "127.0.0.1";
+  webhookListenPort = 8435;
+in
+{
+  imports = [
+    ./module.nix
+  ];
+
+  sops.secrets."matrix/hookshot/as_token" = {
+    sopsFile = fp /secrets/bicep/matrix.yaml;
+    key = "hookshot/as_token";
+  };
+  sops.secrets."matrix/hookshot/hs_token" = {
+    sopsFile = fp /secrets/bicep/matrix.yaml;
+    key = "hookshot/hs_token";
+  };
+
+  sops.templates."hookshot-registration.yaml" = {
+    owner = config.users.users.matrix-synapse.name;
+    group = config.users.groups.keys-matrix-registrations.name;
+    content = ''
+      id: matrix-hookshot
+      as_token: "${config.sops.placeholder."matrix/hookshot/as_token"}"
+      hs_token: "${config.sops.placeholder."matrix/hookshot/hs_token"}"
+      namespaces:
+        rooms: []
+        users:
+          - regex: "@_webhooks_.*:pvv.ntnu.no"
+            exclusive: true
+          - regex: "@bot_feeds:pvv.ntnu.no"
+            exclusive: true
+        aliases: []
+
+      sender_localpart: hookshot
+      url: "http://${cfg.settings.bridge.bindAddress}:${toString cfg.settings.bridge.port}"
+      rate_limited: false
+
+      # If enabling encryption
+      de.sorunome.msc2409.push_ephemeral: true
+      push_ephemeral: true
+      org.matrix.msc3202: true
+    '';
+  };
+
+  systemd.services.matrix-hookshot = {
+    serviceConfig.SupplementaryGroups = [
+      config.users.groups.keys-matrix-registrations.name
+    ];
+  };
+
+  services.matrix-hookshot = {
+    enable = true;
+    package = unstablePkgs.matrix-hookshot;
+    registrationFile = config.sops.templates."hookshot-registration.yaml".path;
+    settings = {
+      bridge = {
+        bindAddress = "127.0.0.1";
+        domain = "pvv.ntnu.no";
+        url = "https://matrix.pvv.ntnu.no";
+        mediaUrl = "https://matrix.pvv.ntnu.no";
+        port = 9993;
+      };
+      listeners = [
+        {
+          bindAddress = webhookListenAddress;
+          port = webhookListenPort;
+          resources = [
+            "webhooks"
+            # "metrics"
+            # "provisioning"
+            "widgets"
+          ];
+        }
+      ];
+      generic = {
+        enabled = true;
+        outbound = true;
+        urlPrefix = "https://hookshot.pvv.ntnu.no/webhook/";
+        userIdPrefix = "_webhooks_";
+        allowJsTransformationFunctions = false;
+        waitForComplete = false;
+      };
+      feeds = {
+        enabled = true;
+        pollIntervalSeconds = 600;
+      };
+      
+      serviceBots = [
+        { localpart = "bot_feeds";
+          displayname = "Aya";
+          avatar = ./feeds.png;
+          prefix = "!aya";
+          service = "feeds";
+        }
+      ];
+
+      permissions = [
+        # Users of the PVV Server
+        { actor = "pvv.ntnu.no";
+          services = [ { service = "*"; level = "commands"; } ];
+        }
+        # Members of Medlem space (for people with their own hs)
+        { actor = "!pZOTJQinWyyTWaeOgK:pvv.ntnu.no";
+          services = [ { service = "*"; level = "commands"; } ];
+        }
+        # Members of Drift
+        { actor = "!eYgeufLrninXxQpYml:pvv.ntnu.no";
+          services = [ { service = "*"; level = "admin"; } ];
+        }
+        # Dan bootstrap
+        { actor = "@dandellion:dodsorf.as";
+          services = [ { service = "*"; level = "admin"; } ];
+        }
+      ];
+    };
+  };
+
+  services.matrix-hookshot.serviceDependencies = [
+    "matrix-synapse.target"
+    "nginx.service"
+  ];
+
+  services.matrix-synapse-next.settings = {
+    app_service_config_files = [
+      config.sops.templates."hookshot-registration.yaml".path
+    ];
+  };
+
+  services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://${webhookListenAddress}:${toString webhookListenPort}";
+    };
+  };
+}
--- a/hosts/bicep/services/matrix/hookshot/feeds.png
+++ b/hosts/bicep/services/matrix/hookshot/feeds.png
--- a/hosts/bicep/services/matrix/hookshot/module.nix
+++ b/hosts/bicep/services/matrix/hookshot/module.nix
@ -0,0 +1,127 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.matrix-hookshot;
+  settingsFormat = pkgs.formats.yaml { };
+  configFile = settingsFormat.generate "matrix-hookshot-config.yml" cfg.settings;
+in
+{
+  options = {
+    services.matrix-hookshot = {
+      enable = lib.mkEnableOption "matrix-hookshot, a bridge between Matrix and project management services";
+
+      package = lib.mkPackageOption pkgs "matrix-hookshot" { };
+
+      registrationFile = lib.mkOption {
+        type = lib.types.path;
+        description = ''
+          Appservice registration file.
+          As it contains secret tokens, you may not want to add this to the publicly readable Nix store.
+        '';
+        example = lib.literalExpression ''
+          pkgs.writeText "matrix-hookshot-registration" \'\'
+            id: matrix-hookshot
+            as_token: aaaaaaaaaa
+            hs_token: aaaaaaaaaa
+            namespaces:
+              rooms: []
+              users:
+                - regex: "@_webhooks_.*:foobar"
+                  exclusive: true
+
+            sender_localpart: hookshot
+            url: "http://localhost:9993"
+            rate_limited: false
+            \'\'
+        '';
+      };
+
+      settings = lib.mkOption {
+        description = ''
+          {file}`config.yml` configuration as a Nix attribute set.
+
+          For details please see the [documentation](https://matrix-org.github.io/matrix-hookshot/latest/setup/sample-configuration.html).
+        '';
+        example = {
+          bridge = {
+            domain = "example.com";
+            url = "http://localhost:8008";
+            mediaUrl = "https://example.com";
+            port = 9993;
+            bindAddress = "127.0.0.1";
+          };
+          listeners = [
+            {
+              port = 9000;
+              bindAddress = "0.0.0.0";
+              resources = [ "webhooks" ];
+            }
+            {
+              port = 9001;
+              bindAddress = "localhost";
+              resources = [
+                "metrics"
+                "provisioning"
+              ];
+            }
+          ];
+        };
+        default = { };
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+          options = {
+            passFile = lib.mkOption {
+              type = lib.types.path;
+              default = "/var/lib/matrix-hookshot/passkey.pem";
+              description = ''
+                A passkey used to encrypt tokens stored inside the bridge.
+                File will be generated if not found.
+              '';
+            };
+          };
+        };
+      };
+
+      serviceDependencies = lib.mkOption {
+        type = with lib.types; listOf str;
+        default = lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
+        defaultText = lib.literalExpression ''
+          lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
+        '';
+        description = ''
+          List of Systemd services to require and wait for when starting the application service,
+          such as the Matrix homeserver if it's running on the same host.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.matrix-hookshot = {
+      description = "a bridge between Matrix and multiple project management services";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ] ++ cfg.serviceDependencies;
+      after = [ "network-online.target" ] ++ cfg.serviceDependencies;
+
+      preStart = ''
+        if [ ! -f '${cfg.settings.passFile}' ]; then
+          mkdir -p $(dirname '${cfg.settings.passFile}')
+          ${pkgs.openssl}/bin/openssl genpkey -out '${cfg.settings.passFile}' -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:4096
+        fi
+      '';
+
+      serviceConfig = {
+        Type = "simple";
+        Restart = "always";
+        ExecStart = "${cfg.package}/bin/matrix-hookshot ${configFile} ${cfg.registrationFile}";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ flandweber ];
+}
--- a/hosts/bicep/services/matrix/mjolnir.nix
+++ b/hosts/bicep/services/matrix/mjolnir.nix
@ -1,8 +1,8 @@
-{ config, lib, ... }:
+{ config, lib, fp, ... }:

 {
  sops.secrets."matrix/mjolnir/access_token" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "mjolnir/access_token";
    owner = config.users.users.mjolnir.name;
    group = config.users.users.mjolnir.group;
--- a/hosts/bicep/services/matrix/synapse.nix
+++ b/hosts/bicep/services/matrix/synapse.nix
@ -1,4 +1,4 @@
-{ config, lib, pkgs, values, inputs, ... }:
+{ config, lib, fp, pkgs, values, inputs, ... }:

 let
  cfg = config.services.matrix-synapse-next;
@ -10,13 +10,13 @@ let
 in {
  sops.secrets."matrix/synapse/signing_key" = {
    key = "synapse/signing_key";
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
  };

  sops.secrets."matrix/synapse/user_registration" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "synapse/signing_key";
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
--- a/hosts/bob/configuration.nix
+++ b/hosts/bob/configuration.nix
@ -1,16 +1,16 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      ../../base
-      ../../misc/metrics-exporters.nix
+      (fp /base)
+      (fp /misc/metrics-exporters.nix)
      ./disks.nix

-      ../../misc/builder.nix
+      (fp /misc/builder.nix)
    ];

-  sops.defaultSopsFile = ../../secrets/bob/bob.yaml;
+  sops.defaultSopsFile = fp /secrets/bob/bob.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
--- a/hosts/brzeczyszczykiewicz/configuration.nix
+++ b/hosts/brzeczyszczykiewicz/configuration.nix
@ -1,10 +1,10 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      ../../base
-      ../../misc/metrics-exporters.nix
+      (fp /base)
+      (fp /misc/metrics-exporters.nix)

      ./services/grzegorz.nix
    ];
--- a/hosts/brzeczyszczykiewicz/services/grzegorz.nix
+++ b/hosts/brzeczyszczykiewicz/services/grzegorz.nix
@ -1,6 +1,6 @@
-{ config, ... }:
+{ config, fp, ... }:
 {
-  imports = [ ../../../modules/grzegorz.nix ];
+  imports = [ (fp /modules/grzegorz.nix) ];

  services.nginx.virtualHosts."${config.networking.fqdn}" = {
    serverAliases = [
--- a/hosts/georg/configuration.nix
+++ b/hosts/georg/configuration.nix
@ -1,12 +1,12 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      ../../base
-      ../../misc/metrics-exporters.nix
+      (fp /base)
+      (fp /misc/metrics-exporters.nix)

-      ../../modules/grzegorz.nix
+      (fp /modules/grzegorz.nix)
    ];

  boot.loader.systemd-boot.enable = true;
--- a/hosts/ildkule/configuration.nix
+++ b/hosts/ildkule/configuration.nix
@ -1,16 +1,16 @@
-{ config, pkgs, lib, values, ... }:
+{ config, fp, pkgs, lib, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      ../../base
-      ../../misc/metrics-exporters.nix
+      (fp /base)
+      (fp /misc/metrics-exporters.nix)

      ./services/monitoring
      ./services/nginx
    ];

-  sops.defaultSopsFile = ../../secrets/ildkule/ildkule.yaml;
+  sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
--- a/hosts/ildkule/hardware-configuration.nix
+++ b/hosts/ildkule/hardware-configuration.nix
@ -3,7 +3,14 @@
  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
  boot.initrd.kernelModules = [ "nvme" ];
-  fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/e35eb4ce-aac3-4f91-8383-6e7cd8bbf942";
+    fsType = "ext4";
+  };
+  fileSystems."/data" = {
+    device = "/dev/disk/by-uuid/0a4c1234-02d3-4b53-aeca-d95c4c8d534b";
+    fsType = "ext4";
+  };

  networking.useDHCP = lib.mkDefault true;
 }
--- a/hosts/ildkule/services/monitoring/loki.nix
+++ b/hosts/ildkule/services/monitoring/loki.nix
@ -2,6 +2,7 @@

 let
  cfg = config.services.loki;
+  stateDir = "/data/monitoring/loki";
 in {
  services.loki = {
    enable = true;
@ -16,7 +17,7 @@ in {
      ingester = {
        wal = {
          enabled = true;
-          dir = "/var/lib/loki/wal";
+          dir = "${stateDir}/wal";
        };
        lifecycler = {
          address = "127.0.0.1";
@ -48,12 +49,12 @@ in {

      storage_config = {
        boltdb_shipper = {
-          active_index_directory = "/var/lib/loki/boltdb-shipper-index";
-          cache_location = "/var/lib/loki/boltdb-shipper-cache";
+          active_index_directory = "${stateDir}/boltdb-shipper-index";
+          cache_location = "${stateDir}/boltdb-shipper-cache";
          cache_ttl = "24h";
        };
        filesystem = {
-          directory = "/var/lib/loki/chunks";
+          directory = "${stateDir}/chunks";
        };
      };

@ -64,14 +65,14 @@ in {
      };

      compactor = {
-        working_directory = "/var/lib/loki/compactor";
+        working_directory = "${stateDir}/compactor";
      };

      # ruler = {
      #   storage = {
      #     type = "local";
      #     local = {
-      #       directory = "/var/lib/loki/rules";
+      #       directory = "${stateDir}/rules";
      #     };
      #   };
      #   rule_path = "/etc/loki/rules";
--- a/hosts/ildkule/services/monitoring/prometheus/default.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/default.nix
@ -1,4 +1,6 @@
-{ config, ... }: {
+{ config, ... }: let
+  stateDir = "/data/monitoring/prometheus";
+in {
  imports = [
    ./gitea.nix
    ./matrix-synapse.nix
@ -10,9 +12,15 @@

  services.prometheus = {
    enable = true;
+
    listenAddress = "127.0.0.1";
    port = 9001;

    ruleFiles = [ rules/synapse-v2.rules ];
  };
+
+  fileSystems."/var/lib/prometheus2" = {
+    device = stateDir;
+    options = [ "bind" ];
+  };
 }
--- a/hosts/ildkule/services/monitoring/uptime-kuma.nix
+++ b/hosts/ildkule/services/monitoring/uptime-kuma.nix
@ -2,6 +2,7 @@
 let
  cfg = config.services.uptime-kuma;
  domain = "status.pvv.ntnu.no";
+  stateDir = "/data/monitoring/uptime-kuma";
 in {
  services.uptime-kuma = {
    enable = true;
@ -17,4 +18,9 @@ in {
    kTLS = true;
    locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
  };
+
+  fileSystems."/var/lib/uptime-kuma" = {
+    device = stateDir;
+    options = [ "bind" ];
+  };
 }
--- a/hosts/shark/configuration.nix
+++ b/hosts/shark/configuration.nix
@ -1,13 +1,13 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      ../../base
-      ../../misc/metrics-exporters.nix
+      (fp /base)
+      (fp /misc/metrics-exporters.nix)
    ];

-  sops.defaultSopsFile = ../../secrets/shark/shark.yaml;
+  sops.defaultSopsFile = fp /secrets/shark/shark.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
--- a/modules/grzegorz.nix
+++ b/modules/grzegorz.nix
@ -1,31 +1,26 @@
 {config, lib, pkgs, ...}:
 let
-  grg = config.services.grzegorz;
+  grg = config.services.greg-ng;
  grgw = config.services.grzegorz-webui;
 in {
-  services.pipewire.enable = true;
-  services.pipewire.alsa.enable = true;
-  services.pipewire.alsa.support32Bit = true;
-  services.pipewire.pulse.enable = true;
-
-  users.users.pvv = {
-    isNormalUser = true;
-    description = "pvv";
+  services.greg-ng = {
+    enable = true;
+    settings.host = "localhost";
+    settings.port = 31337;
+    enableSway = true;
+    enablePipewire = true;
  };

-  services.grzegorz.enable = true;
-  services.grzegorz.listenAddr = "localhost";
-  services.grzegorz.listenPort = 31337;
-
-  services.grzegorz-webui.enable = true;
-  services.grzegorz-webui.listenAddr = "localhost";
-  services.grzegorz-webui.listenPort = 42069;
-  services.grzegorz-webui.listenWebsocketPort = 42042;
-  services.grzegorz-webui.hostName = "${config.networking.fqdn}";
-  services.grzegorz-webui.apiBase = "http://${toString grg.listenAddr}:${toString grg.listenPort}/api";
+  services.grzegorz-webui = {
+    enable = true;
+    listenAddr = "localhost";
+    listenPort = 42069;
+    listenWebsocketPort = 42042;
+    hostName = "${config.networking.fqdn}";
+    apiBase = "http://${grg.settings.host}:${toString grg.settings.port}/api";
+  };

  services.nginx.enable = true;
-
  services.nginx.virtualHosts."${config.networking.fqdn}" = {
    forceSSL = true;
    enableACME = true;
@ -40,20 +35,19 @@ in {
    '';

    locations."/" = {
-      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenPort}";
+      proxyPass = "http://${grgw.listenAddr}:${toString grgw.listenPort}";
    };
    # https://github.com/rawpython/remi/issues/216
    locations."/websocket" = {
-      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenWebsocketPort}";
+      proxyPass = "http://${grgw.listenAddr}:${toString grgw.listenWebsocketPort}";
      proxyWebsockets = true;
    };
    locations."/api" = {
-      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
+      proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
    };
    locations."/docs" = {
-      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
+      proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
    };
  };
-
 }

--- a/secrets/bicep/matrix.yaml
+++ b/secrets/bicep/matrix.yaml
@ -6,8 +6,12 @@ coturn:
    static-auth-secret: ENC[AES256_GCM,data:y5cG/LyrorkDH+8YrgcV7DY=,iv:ca90q2J3+NOy51mUBy4TMKfYMgWL4hxWDdsKIuxRBgU=,tag:hpFCns1lpi07paHyGB7tGQ==,type:str]
 mjolnir:
    access_token: ENC[AES256_GCM,data:ERFqZjK7MRD0xWt91FNCIxP1YC6Qj54QgnckHlCTtcQVLWaM1h2h9lHS+K8=,iv:1d7vmFkXAPcsmumzlmOT31amdrKLWtL5sJiS8G9g+LE=,tag:2l0vWzJ6P12ofuBdf5CCWw==,type:str]
-registrations:
-    mx-puppet-discord: ENC[AES256_GCM,data:FleyXxgOmc05nTP6M2DBJlacufN3p/05eZm4kB8+K4ci0k24o3zli988wlM/kyeZmxu4pgQlJ3lNLte4uip2hBXHWG5t5Ldzmr7bNCUD+r7nM+I1lfNkrDROPZ54bHysmn9O5CHpEa16rSo6RJgncIPqsLJxTwjC7qZlkOpzqvMhkq/MHCVOpvg0M/6AUR+AlSZoggujBMoXLznQNQapN13foEsbuo/QxjszM/ObGmhYMVyaS+TDBXzQLA8Yuj50Q/gZCIINWZ4G2qmgsGxxNR4I+usUQml/jxCtIXS4zn/ettXfL9G4Fdm2F9u1v11DehtTGa5xoxDq94M9rIxOqeJpvgEQEyyKAyFUIrlINfGl7tAj4Zu7+9Z8JTRAnppjM1q8iInwn/Z2L9KgB0YFi/Go1whgXly+TH6hpreo7m5klXV/ff/aV3ghOgFCGA8nBrZFqE8Uw268q9tV1s1dxCb6TbpGf19V5c9MD6BsCIVeoq+j9I/I8iZpzg2Reb4IlHhMDwbwsL2w2ks30wiZ9XO/CFrXDY4uBlI=,iv:3vvkGvldS8Raibg6tzlV8VY1O9NCLxSuNX/lwi1QgiA=,tag:D/noIsE3xlOiYM6Pk+cc8Q==,type:str]
+discord:
+    as_token: ENC[AES256_GCM,data:cnPZjBbODZUA1p0kLNeWpKh1oGkDPxDw/g7163XnoRCIgpqk,iv:Uu4L36uDPMBgzdXE2Lt9U0qrBSl3Xuufh1313BD8B/U=,tag:nTm6s7IGd4vNzZ95mfxDpA==,type:str]
+    hs_token: ENC[AES256_GCM,data:UzcaNsJtJPKvFT4gQDNfat0nmyJzmQ6OcSI73pANibzOVrWl,iv:ujgRM2jb1rbeloPB4UPLBEvQ7uue4a+bHiqsZAHIqtk=,tag:uIfuaTWSTeVvpQx5o28HPA==,type:str]
+hookshot:
+    as_token: ENC[AES256_GCM,data:L4vEw5r4RhcgritOeDTLHN5E/dM=,iv:pC8BLzxf6NaVAGsotoq6chOceBVdMLvrsQn1LGw9H9w=,tag:SI3CDFHAvgQZEvf/oms3EA==,type:str]
+    hs_token: ENC[AES256_GCM,data:2ufSJfYzzAB5IO+edwKSra5d/+M=,iv:cmTycGzNL+IeRRKZGbkhTtiksYTtbxED0k0B5haFw7k=,tag:FmWe5sGi9rlapUeAE6lKvg==,type:str]
 sops:
    kms: []
    gcp_kms: []
@ -68,8 +72,8 @@ sops:
            WEh5NFN6SFF1TlltdWFWTGw4MHRHUkUKrKIvC87xjEmwxPQhH8dN+ZuaJTCgPY28
            pR62KxmoKFICLTHPpYP3euiAx5M9BWvgvCnA/US/5klpk8MtlreNFA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-09-27T04:34:10Z"
-    mac: ENC[AES256_GCM,data:FACb/Ow4s6dqjghAphCa1ZwIwX7+CRhIudQ9UlDtxB+4Bdpa/T0l73oaMa5lmmyCEyuVM3HXOFcm4I/urLtvaN+QQoqRYnUHKkdNYFhayGpeckZUNu7JWsFsQWk0kfKZEDqHIBoee7xBVzrVtRJeKVWv+JPlch4NVOakm3MitZA=,iv:rvve5MRDpDD/FblN8KaQ2PvxsYZSQPSw5oDfyko/Nvs=,tag:vuB0jYmO6AiNtZuSJ3ipBQ==,type:str]
+    lastmodified: "2024-10-13T23:30:01Z"
+    mac: ENC[AES256_GCM,data:vdsAZmg7gPqzeucBhLhPemtRVkcxRecIdB6PXZ4paU+Uv5UorBKcTZ3jseN2cLi6ot3ycTIm+UI6uhlCy87vAJVynVJhuJS+ICFRS2+DfoVyuttLjZQGC2sr3+dEBHxIH7sZJSo9PIzbIWw3qHrpOPAZj0//1pFyp/k15k3vidM=,iv:jWtV+WAPt08lgdrVvtXOl35rDB4QflkZWuGBW1+ESyw=,tag:YxSHncZZOAW5uDxXtb/krw==,type:str]
    pgp:
        - created_at: "2024-08-04T00:03:46Z"
          enc: |-
--- a/users/alfhj.nix
+++ b/users/alfhj.nix
@ -0,0 +1,13 @@
+{pkgs, ...}:
+
+{
+  users.users.alfhj = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    shell = pkgs.zsh;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMCAYE0U3sFizm/NSbKCs0jEhZ1mpAWPcijFevejiFL1 alfhj"
+    ];
+  };
+}
+
Author	SHA1	Message	Date
Daniel Lovbrotte Olsen	3bdfb4c297	Add function to make paths from flake root No more ../../../../../../	2024-11-17 00:08:02 +01:00
Felix Albrigtsen	8285d91401	Merge pull request 'Ildkule: Move monitoring state directories to data volume' (!88 ) from ildkule-data-volume into main Reviewed-on: #88 Reviewed-by: Daniel Lovbrotte Olsen <danio@pvv.ntnu.no>	2024-11-10 02:30:11 +01:00
Alf Helge Jakobsen	b07cd5fbf6	systemd hardening for pvv-nettsiden-gallery-update.service (!90 ) #133 Reviewed-on: #90 Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Co-authored-by: Alf Helge Jakobsen <alfhj@stud.ntnu.no> Co-committed-by: Alf Helge Jakobsen <alfhj@stud.ntnu.no>	2024-11-09 22:22:09 +01:00
Felix Albrigtsen	2d52ebce52	Ildkule: hardware-config: use UUIDs	2024-11-09 21:42:44 +01:00
Oystein Kristoffer Tveit	464576e856	flake.lock: bump greg-ng	2024-11-09 19:43:07 +01:00
Oystein Kristoffer Tveit	df35715978	Merge pull request 'Add alfhj.nix' (!89 ) from newusersconfig into main Reviewed-on: #89 Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>	2024-11-09 19:40:03 +01:00
Alf Helge Jakobsen	165ff56948	Add alfhj.nix	2024-11-09 19:35:19 +01:00
Felix Albrigtsen	11f6ef0572	Ildkule: Move monitoring state directories to data volume	2024-11-09 15:21:12 +01:00
Oystein Kristoffer Tveit	815f48c30d	flake.lock: bump greg-ng	2024-10-22 19:50:29 +02:00
Oystein Kristoffer Tveit	4985bac3ba	flake.lock: bump greg-ng	2024-10-20 23:18:35 +02:00
Oystein Kristoffer Tveit	9e41c3374d	Merge pull request 'bekkalokk/nginx: host `.well-known`' (!79 ) from move-well-known-to-bekkalokk into main Reviewed-on: #79 Reviewed-by: Daniel Lovbrotte Olsen <danio@pvv.ntnu.no>	2024-10-20 01:35:22 +02:00
Oystein Kristoffer Tveit	f39fee4213	bekkalokk/nginx: host `.well-known`	2024-10-20 01:34:41 +02:00
Oystein Kristoffer Tveit	4c77c9fc67	Merge pull request 'greg-ng 🎉' (!86 ) from greg-ng-working-branch into main Reviewed-on: #86 Reviewed-by: Felix Albrigtsen <felixalb@pvv.ntnu.no>	2024-10-20 01:30:26 +02:00
Oystein Kristoffer Tveit	7938e8135f	flake.lock: bump	2024-10-19 23:31:29 +02:00
Oystein Kristoffer Tveit	cbc3490882	modules/grzegorz: use greg-ng	2024-10-19 23:31:28 +02:00
Daniel Lovbrotte Olsen	47ed79986c	bicep/matrix: use sops templates for appservice registrations	2024-10-14 15:46:58 +02:00
Daniel Lovbrotte Olsen	5aed665cc8	flake update	2024-10-14 00:24:29 +02:00
Daniel Lovbrotte Olsen	2c86a2d812	bicep/matrix/hookshot: More configuration	2024-10-14 00:13:15 +02:00
Daniel Lovbrotte Olsen	d4fd3f8332	bicep/matrix/hookshot: add nginx	2024-10-13 06:03:26 +02:00
Joakim Pettersvold	c1833eb07c	bicep/matrix/hookshot: Configure matrix-hookshot Co-authored-by: Daniel Olsen <daniel.olsen99@gmail.com>	2024-10-13 05:50:22 +02:00
Finn Landweber	5ee23ef2e2	bicep/matrix/hookshot: Backported from nixpkgs Co-authored-by: Joakim Pettersvold <joakimpokemeg@hotmail.no>	2024-10-13 05:50:22 +02:00
Oystein Kristoffer Tveit	f5c16f46f1	Merge pull request 'disable-postgres-on-bekkalokk' (!85 ) from disable-postgres-on-bekkalokk into main Reviewed-on: #85 Reviewed-by: Daniel Lovbrotte Olsen <danio@pvv.ntnu.no>	2024-10-13 02:34:45 +02:00
Daniel Lovbrotte Olsen	c56d157c3f	add registration secret	2024-10-12 23:49:10 +02:00
Daniel Lovbrotte Olsen	6c9e651e59	bekkalokk/gitea: Add important emoji reactions	2024-10-12 22:42:59 +02:00
Adrian Gunnar Lauterer	f56e73548c	base: openssh fix	2024-10-12 22:32:18 +02:00
Adrian Gunnar Lauterer	c62ea129ed	Merge pull request 'base openssh added sleipner ssh keys' (!83 ) from sleipner-authorised-keys into main Reviewed-on: #83	2024-10-12 21:48:08 +02:00
Adrian Gunnar Lauterer	4b41ddcf5d	base: openssh added sleipner ssh keys	2024-10-12 21:47:31 +02:00