Compare commits
23 Commits
fix-gitea-
...
elysium
Author | SHA1 | Date | |
---|---|---|---|
74b770545e | |||
71479d5ca0 | |||
cf01792269 | |||
afae0da0b6 | |||
35d745b156 | |||
218ee776c7 | |||
3a972f03f7
|
|||
96024efa28
|
|||
af54cc2df4
|
|||
6f6721ce07
|
|||
1c35da0295 | |||
5fb1b805a8 | |||
a38a12c429
|
|||
898e362a9f | |||
c267820426 | |||
a57b5f07f9 | |||
bcf2ceed32
|
|||
0a3d1e3696 | |||
45eea1a791 | |||
200224d2c1 | |||
b7b1c73bfa
|
|||
70603145cf
|
|||
5bed292a01
|
base.nixflake.lockflake.nix
hosts
modules
overlays
packages/mediawiki-extensions
default.nix
delete-batch
pluggable-auth
simple-saml-php
update-mediawiki-extensions.pyuser-merge
visual-editor
secrets/bekkalokk
1
base.nix
1
base.nix
@@ -67,6 +67,7 @@
|
|||||||
wget
|
wget
|
||||||
|
|
||||||
kitty.terminfo
|
kitty.terminfo
|
||||||
|
foot.terminfo
|
||||||
];
|
];
|
||||||
|
|
||||||
programs.zsh.enable = true;
|
programs.zsh.enable = true;
|
||||||
|
113
flake.lock
generated
113
flake.lock
generated
@@ -7,11 +7,11 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1712798444,
|
"lastModified": 1715445235,
|
||||||
"narHash": "sha256-aAksVB7zMfBQTz0q2Lw3o78HM3Bg2FRziX2D6qnh+sk=",
|
"narHash": "sha256-SUu+oIWn+xqQIOlwfwNfS9Sek4i1HKsrLJchsDReXwA=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "disko",
|
"repo": "disko",
|
||||||
"rev": "a297cb1cb0337ee10a7a0f9517954501d8f6f74d",
|
"rev": "159d87ea5b95bbdea46f0288a33c5e1570272725",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -20,18 +20,58 @@
|
|||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"fix-python": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-utils": "flake-utils",
|
||||||
|
"nixpkgs": [
|
||||||
|
"grzegorz",
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1713887124,
|
||||||
|
"narHash": "sha256-hGTSm0p9xXUYDgsAAr/ORZICo6T6u33vLfX3tILikaQ=",
|
||||||
|
"owner": "GuillaumeDesforges",
|
||||||
|
"repo": "fix-python",
|
||||||
|
"rev": "f7f4b33e22414071fc1f9cbf68072c413c3a7fdf",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "GuillaumeDesforges",
|
||||||
|
"repo": "fix-python",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"flake-utils": {
|
||||||
|
"inputs": {
|
||||||
|
"systems": "systems"
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1689068808,
|
||||||
|
"narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"id": "flake-utils",
|
||||||
|
"type": "indirect"
|
||||||
|
}
|
||||||
|
},
|
||||||
"grzegorz": {
|
"grzegorz": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
|
"fix-python": "fix-python",
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"nixpkgs-unstable"
|
"nixpkgs-unstable"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1712875951,
|
"lastModified": 1715364232,
|
||||||
"narHash": "sha256-4kcRd2Q2XM4r+U2zp+LADjrzazKpWvs0WrMKPktEEkc=",
|
"narHash": "sha256-ZJC3SkanEgbV7p+LFhP+85CviRWOXJNHzZwR/Stb7hE=",
|
||||||
"owner": "Programvareverkstedet",
|
"owner": "Programvareverkstedet",
|
||||||
"repo": "grzegorz",
|
"repo": "grzegorz",
|
||||||
"rev": "9eaba26b1671e8810cb135997c867ac3550e685a",
|
"rev": "3841cda1cdcac470440b06838d56a2eb2256378c",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -47,11 +87,11 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1711853301,
|
"lastModified": 1715384651,
|
||||||
"narHash": "sha256-KxRNyW/fgq690bt3B+Nz4EKLoubybcuASYyMa41bAPE=",
|
"narHash": "sha256-7RhckgUTjqeCjWkhiCc1iB+5CBx9fl80d/3O4Jh+5kM=",
|
||||||
"owner": "Programvareverkstedet",
|
"owner": "Programvareverkstedet",
|
||||||
"repo": "grzegorz-clients",
|
"repo": "grzegorz-clients",
|
||||||
"rev": "c38f2f22a6d47ae2da015351a45d13cbc1eb48e4",
|
"rev": "738a4f3dd887f7c3612e4e772b83cbfa3cde5693",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -87,11 +127,11 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1712621190,
|
"lastModified": 1714416973,
|
||||||
"narHash": "sha256-O8xtza+wPplTmSm0EAPk8Ud9sJ6huVNY6jU21FYHCp4=",
|
"narHash": "sha256-aZUcvXjdETUC6wVQpWDVjLUzwpDAEca8yR0ITDeK39o=",
|
||||||
"ref": "refs/heads/main",
|
"ref": "refs/heads/main",
|
||||||
"rev": "812c1fc4061d534a8c7d35271ce32b6c76a9f385",
|
"rev": "2b23c0ba8aae68d3cb6789f0f6e4891cef26cc6d",
|
||||||
"revCount": 5,
|
"revCount": 6,
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
|
"url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
|
||||||
},
|
},
|
||||||
@@ -102,11 +142,11 @@
|
|||||||
},
|
},
|
||||||
"nixpkgs": {
|
"nixpkgs": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1712848736,
|
"lastModified": 1715410392,
|
||||||
"narHash": "sha256-CzZwhqyLlebljv1zFS2KWVH/3byHND0LfaO1jKsGuVo=",
|
"narHash": "sha256-ltp1jQps9tym0uWNl/lTniHSQngCtNIyzlymu+ZSyts=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "1d6a23f11e44d0fb64b3237569b87658a9eb5643",
|
"rev": "9f8bf7503bd85d5208575f4bd81c8b1fc999a468",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -117,11 +157,11 @@
|
|||||||
},
|
},
|
||||||
"nixpkgs-stable": {
|
"nixpkgs-stable": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1712437997,
|
"lastModified": 1714858427,
|
||||||
"narHash": "sha256-g0whLLwRvgO2FsyhY8fNk+TWenS3jg5UdlWL4uqgFeo=",
|
"narHash": "sha256-tCxeDP4C1pWe2rYY3IIhdA40Ujz32Ufd4tcrHPSKx2M=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "e38d7cb66ea4f7a0eb6681920615dfcc30fc2920",
|
"rev": "b980b91038fc4b09067ef97bbe5ad07eecca1e76",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -133,11 +173,11 @@
|
|||||||
},
|
},
|
||||||
"nixpkgs-unstable": {
|
"nixpkgs-unstable": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1712837137,
|
"lastModified": 1715435713,
|
||||||
"narHash": "sha256-9joaU/GD35J9Utb0ipelQbOcvsw5eoYTmSarLV3MbNk=",
|
"narHash": "sha256-lb2HqDQGfTdnCCpc1pgF6fkdgIOuBQ0nP8jjVSfLFqg=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "681d4a87b26b1dcaae7ffe6cf88c9912c575415f",
|
"rev": "52b40f6c4be12742b1504ca2eb4527e597bf2526",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -173,11 +213,11 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1712834399,
|
"lastModified": 1716150352,
|
||||||
"narHash": "sha256-deNJvqboPk3bEoRZ/FyZnxscsf2BpS3/52JM4qXCNSA=",
|
"narHash": "sha256-c13lzYbLmbrcbEdPTYZYtlX2Qsz1W+2sLsIMGShPgwo=",
|
||||||
"ref": "refs/heads/master",
|
"ref": "refs/heads/master",
|
||||||
"rev": "216e153f89f1dbdc4c98a7c1db2a40e52becc901",
|
"rev": "2cab4df4b119e08a1f90ea1c944652cd78b4d478",
|
||||||
"revCount": 451,
|
"revCount": 459,
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
||||||
},
|
},
|
||||||
@@ -208,11 +248,11 @@
|
|||||||
"nixpkgs-stable": "nixpkgs-stable"
|
"nixpkgs-stable": "nixpkgs-stable"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1712617241,
|
"lastModified": 1715244550,
|
||||||
"narHash": "sha256-a4hbls4vlLRMciv62YrYT/Xs/3Cubce8WFHPUDWwzf8=",
|
"narHash": "sha256-ffOZL3eaZz5Y1nQ9muC36wBCWwS1hSRLhUzlA9hV2oI=",
|
||||||
"owner": "Mic92",
|
"owner": "Mic92",
|
||||||
"repo": "sops-nix",
|
"repo": "sops-nix",
|
||||||
"rev": "538c114cfdf1f0458f507087b1dcf018ce1c0c4c",
|
"rev": "0dc50257c00ee3c65fef3a255f6564cfbfe6eb7f",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -220,6 +260,21 @@
|
|||||||
"repo": "sops-nix",
|
"repo": "sops-nix",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
|
},
|
||||||
|
"systems": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1681028828,
|
||||||
|
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||||
|
"owner": "nix-systems",
|
||||||
|
"repo": "default",
|
||||||
|
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nix-systems",
|
||||||
|
"repo": "default",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"root": "root",
|
"root": "root",
|
||||||
|
15
flake.nix
15
flake.nix
@@ -65,9 +65,7 @@
|
|||||||
pkgs = import nixpkgs {
|
pkgs = import nixpkgs {
|
||||||
inherit system;
|
inherit system;
|
||||||
overlays = [
|
overlays = [
|
||||||
(import ./overlays/nginx-test.nix
|
# Global overlays go here
|
||||||
(builtins.attrNames self.nixosConfigurations.${name}.config.security.acme.certs)
|
|
||||||
)
|
|
||||||
] ++ config.overlays or [ ];
|
] ++ config.overlays or [ ];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
@@ -110,6 +108,8 @@
|
|||||||
ildkule = stableNixosConfig "ildkule" { };
|
ildkule = stableNixosConfig "ildkule" { };
|
||||||
#ildkule-unstable = unstableNixosConfig "ildkule" { };
|
#ildkule-unstable = unstableNixosConfig "ildkule" { };
|
||||||
shark = stableNixosConfig "shark" { };
|
shark = stableNixosConfig "shark" { };
|
||||||
|
|
||||||
|
elysium = stableNixosConfig "elysium" { };
|
||||||
|
|
||||||
brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
|
brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
|
||||||
modules = [
|
modules = [
|
||||||
@@ -142,8 +142,13 @@
|
|||||||
|
|
||||||
simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
|
simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
|
||||||
|
|
||||||
# mediawiki-extensions = pkgs.callPackage ./packages/mediawiki-extensions { };
|
} //
|
||||||
} // nixlib.genAttrs allMachines
|
(nixlib.pipe null [
|
||||||
|
(_: pkgs.callPackage ./packages/mediawiki-extensions { })
|
||||||
|
(nixlib.flip builtins.removeAttrs ["override" "overrideDerivation"])
|
||||||
|
(nixlib.mapAttrs' (name: nixlib.nameValuePair "mediawiki-${name}"))
|
||||||
|
])
|
||||||
|
// nixlib.genAttrs allMachines
|
||||||
(machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
|
(machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
@@ -6,13 +6,14 @@
|
|||||||
../../base.nix
|
../../base.nix
|
||||||
../../misc/metrics-exporters.nix
|
../../misc/metrics-exporters.nix
|
||||||
|
|
||||||
./services/website
|
|
||||||
./services/nginx.nix
|
|
||||||
./services/gitea/default.nix
|
./services/gitea/default.nix
|
||||||
./services/kerberos
|
|
||||||
./services/webmail
|
|
||||||
./services/mediawiki
|
|
||||||
./services/idp-simplesamlphp
|
./services/idp-simplesamlphp
|
||||||
|
./services/kerberos
|
||||||
|
./services/mediawiki
|
||||||
|
./services/nginx.nix
|
||||||
|
./services/vaultwarden.nix
|
||||||
|
./services/webmail
|
||||||
|
./services/website
|
||||||
];
|
];
|
||||||
|
|
||||||
sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
|
sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
|
||||||
|
@@ -6,6 +6,7 @@ let
|
|||||||
in {
|
in {
|
||||||
imports = [
|
imports = [
|
||||||
./ci.nix
|
./ci.nix
|
||||||
|
./import-users.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
sops.secrets = {
|
sops.secrets = {
|
||||||
@@ -13,9 +14,10 @@ in {
|
|||||||
owner = "gitea";
|
owner = "gitea";
|
||||||
group = "gitea";
|
group = "gitea";
|
||||||
};
|
};
|
||||||
"gitea/passwd-ssh-key" = { };
|
"gitea/email-password" = {
|
||||||
"gitea/ssh-known-hosts" = { };
|
owner = "gitea";
|
||||||
"gitea/import-user-env" = { };
|
group = "gitea";
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
services.gitea = {
|
services.gitea = {
|
||||||
@@ -31,13 +33,23 @@ in {
|
|||||||
createDatabase = false;
|
createDatabase = false;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
mailerPasswordFile = config.sops.secrets."gitea/email-password".path;
|
||||||
|
|
||||||
settings = {
|
settings = {
|
||||||
server = {
|
server = {
|
||||||
DOMAIN = domain;
|
DOMAIN = domain;
|
||||||
ROOT_URL = "https://${domain}/";
|
ROOT_URL = "https://${domain}/";
|
||||||
PROTOCOL = "http+unix";
|
PROTOCOL = "http+unix";
|
||||||
SSH_PORT = sshPort;
|
SSH_PORT = sshPort;
|
||||||
START_SSH_SERVER = true;
|
START_SSH_SERVER = true;
|
||||||
|
};
|
||||||
|
mailer = {
|
||||||
|
ENABLED = true;
|
||||||
|
FROM = "gitea@pvv.ntnu.no";
|
||||||
|
PROTOCOL = "smtp";
|
||||||
|
SMTP_ADDR = "smtp.pvv.ntnu.no";
|
||||||
|
SMTP_PORT = 587;
|
||||||
|
USER = "gitea@pvv.ntnu.no";
|
||||||
};
|
};
|
||||||
indexer.REPO_INDEXER_ENABLED = true;
|
indexer.REPO_INDEXER_ENABLED = true;
|
||||||
service.DISABLE_REGISTRATION = true;
|
service.DISABLE_REGISTRATION = true;
|
||||||
@@ -52,8 +64,6 @@ in {
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
|
|
||||||
|
|
||||||
environment.systemPackages = [ cfg.package ];
|
environment.systemPackages = [ cfg.package ];
|
||||||
|
|
||||||
services.nginx.virtualHosts."${domain}" = {
|
services.nginx.virtualHosts."${domain}" = {
|
||||||
@@ -70,38 +80,28 @@ in {
|
|||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ sshPort ];
|
networking.firewall.allowedTCPPorts = [ sshPort ];
|
||||||
|
|
||||||
# Automatically import users
|
# Extra customization
|
||||||
systemd.services.gitea-import-users = {
|
|
||||||
enable = true;
|
|
||||||
preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /tmp/passwd-import'';
|
|
||||||
serviceConfig = {
|
|
||||||
ExecStart = pkgs.writers.writePython3 "gitea-import-users" { libraries = [ pkgs.python3Packages.requests ]; } (builtins.readFile ./gitea-import-users.py);
|
|
||||||
LoadCredential=[
|
|
||||||
"sshkey:${config.sops.secrets."gitea/passwd-ssh-key".path}"
|
|
||||||
"ssh-known-hosts:${config.sops.secrets."gitea/ssh-known-hosts".path}"
|
|
||||||
];
|
|
||||||
DynamicUser="yes";
|
|
||||||
EnvironmentFile=config.sops.secrets."gitea/import-user-env".path;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.timers.gitea-import-users = {
|
services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
|
||||||
requires = [ "gitea.service" ];
|
|
||||||
after = [ "gitea.service" ];
|
|
||||||
wantedBy = [ "timers.target" ];
|
|
||||||
timerConfig = {
|
|
||||||
OnCalendar = "*-*-* 02:00:00";
|
|
||||||
Persistent = true;
|
|
||||||
Unit = "gitea-import-users.service";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
system.activationScripts.linkGiteaLogo.text = let
|
systemd.services.install-gitea-customization = {
|
||||||
logo-svg = ../../../../assets/logo_blue_regular.svg;
|
description = "Install extra customization in gitea's CUSTOM_DIR";
|
||||||
logo-png = ../../../../assets/logo_blue_regular.png;
|
wantedBy = [ "gitea.service" ];
|
||||||
in ''
|
requiredBy = [ "gitea.service" ];
|
||||||
install -Dm444 ${logo-svg} ${cfg.stateDir}/custom/public/img/logo.svg
|
|
||||||
install -Dm444 ${logo-png} ${cfg.stateDir}/custom/public/img/logo.png
|
serviceConfig = {
|
||||||
install -Dm444 ${./loading.apng} ${cfg.stateDir}/custom/public/img/loading.png
|
Type = "oneshot";
|
||||||
'';
|
User = cfg.user;
|
||||||
|
Group = cfg.group;
|
||||||
|
};
|
||||||
|
|
||||||
|
script = let
|
||||||
|
logo-svg = ../../../../assets/logo_blue_regular.svg;
|
||||||
|
logo-png = ../../../../assets/logo_blue_regular.png;
|
||||||
|
in ''
|
||||||
|
install -Dm444 ${logo-svg} ${cfg.customDir}/public/img/logo.svg
|
||||||
|
install -Dm444 ${logo-png} ${cfg.customDir}/public/img/logo.png
|
||||||
|
install -Dm444 ${./loading.apng} ${cfg.customDir}/public/img/loading.png
|
||||||
|
'';
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
38
hosts/bekkalokk/services/gitea/import-users.nix
Normal file
38
hosts/bekkalokk/services/gitea/import-users.nix
Normal file
@@ -0,0 +1,38 @@
|
|||||||
|
{ config, pkgs, lib, ... }:
|
||||||
|
let
|
||||||
|
cfg = config.services.gitea;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
sops.secrets = {
|
||||||
|
"gitea/passwd-ssh-key" = { };
|
||||||
|
"gitea/ssh-known-hosts" = { };
|
||||||
|
"gitea/import-user-env" = { };
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.gitea-import-users = lib.mkIf cfg.enable {
|
||||||
|
enable = true;
|
||||||
|
preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /tmp/passwd-import'';
|
||||||
|
serviceConfig = {
|
||||||
|
ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
|
||||||
|
libraries = with pkgs.python3Packages; [ requests ];
|
||||||
|
} (builtins.readFile ./gitea-import-users.py);
|
||||||
|
LoadCredential=[
|
||||||
|
"sshkey:${config.sops.secrets."gitea/passwd-ssh-key".path}"
|
||||||
|
"ssh-known-hosts:${config.sops.secrets."gitea/ssh-known-hosts".path}"
|
||||||
|
];
|
||||||
|
DynamicUser="yes";
|
||||||
|
EnvironmentFile=config.sops.secrets."gitea/import-user-env".path;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.timers.gitea-import-users = lib.mkIf cfg.enable {
|
||||||
|
requires = [ "gitea.service" ];
|
||||||
|
after = [ "gitea.service" ];
|
||||||
|
wantedBy = [ "timers.target" ];
|
||||||
|
timerConfig = {
|
||||||
|
OnCalendar = "*-*-* 02:00:00";
|
||||||
|
Persistent = true;
|
||||||
|
Unit = "gitea-import-users.service";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
@@ -86,7 +86,8 @@ in {
|
|||||||
};
|
};
|
||||||
|
|
||||||
extensions = {
|
extensions = {
|
||||||
inherit (pkgs.mediawiki-extensions) DeleteBatch UserMerge PluggableAuth SimpleSAMLphp VisualEditor;
|
#inherit (pkgs.mediawiki-extensions) DeleteBatch UserMerge PluggableAuth SimpleSAMLphp VisualEditor;
|
||||||
|
inherit (pkgs.mediawiki-extensions) UserMerge PluggableAuth SimpleSAMLphp VisualEditor;
|
||||||
};
|
};
|
||||||
|
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
|
68
hosts/bekkalokk/services/vaultwarden.nix
Normal file
68
hosts/bekkalokk/services/vaultwarden.nix
Normal file
@@ -0,0 +1,68 @@
|
|||||||
|
{ config, pkgs, lib, ... }:
|
||||||
|
let
|
||||||
|
cfg = config.services.vaultwarden;
|
||||||
|
domain = "pw.pvv.ntnu.no";
|
||||||
|
address = "127.0.1.2";
|
||||||
|
port = 3011;
|
||||||
|
wsPort = 3012;
|
||||||
|
in {
|
||||||
|
sops.secrets."vaultwarden/environ" = {
|
||||||
|
owner = "vaultwarden";
|
||||||
|
group = "vaultwarden";
|
||||||
|
};
|
||||||
|
|
||||||
|
services.vaultwarden = {
|
||||||
|
enable = true;
|
||||||
|
dbBackend = "postgresql";
|
||||||
|
environmentFile = config.sops.secrets."vaultwarden/environ".path;
|
||||||
|
config = {
|
||||||
|
domain = "https://${domain}";
|
||||||
|
|
||||||
|
rocketAddress = address;
|
||||||
|
rocketPort = port;
|
||||||
|
|
||||||
|
websocketEnabled = true;
|
||||||
|
websocketAddress = address;
|
||||||
|
websocketPort = wsPort;
|
||||||
|
|
||||||
|
signupsAllowed = true;
|
||||||
|
signupsVerify = true;
|
||||||
|
signupsDomainsWhitelist = "pvv.ntnu.no";
|
||||||
|
|
||||||
|
smtpFrom = "vaultwarden@pvv.ntnu.no";
|
||||||
|
smtpFromName = "VaultWarden PVV";
|
||||||
|
|
||||||
|
smtpHost = "smtp.pvv.ntnu.no";
|
||||||
|
smtpUsername = "vaultwarden";
|
||||||
|
smtpSecurity = "force_tls";
|
||||||
|
smtpAuthMechanism = "Login";
|
||||||
|
|
||||||
|
# Configured in environ:
|
||||||
|
# databaseUrl = "postgresql://vaultwarden@/vaultwarden";
|
||||||
|
# smtpPassword = hemli
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."${domain}" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
kTLS = true;
|
||||||
|
|
||||||
|
extraConfig = ''
|
||||||
|
client_max_body_size 128M;
|
||||||
|
'';
|
||||||
|
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://${address}:${toString port}";
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
|
locations."/notifications/hub" = {
|
||||||
|
proxyPass = "http://${address}:${toString wsPort}";
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
|
locations."/notifications/hub/negotiate" = {
|
||||||
|
proxyPass = "http://${address}:${toString port}";
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
@@ -2,6 +2,7 @@
|
|||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
./roundcube.nix
|
./roundcube.nix
|
||||||
|
./snappymail.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
services.nginx.virtualHosts."webmail.pvv.ntnu.no" = {
|
services.nginx.virtualHosts."webmail.pvv.ntnu.no" = {
|
||||||
@@ -10,9 +11,11 @@
|
|||||||
kTLS = true;
|
kTLS = true;
|
||||||
locations = {
|
locations = {
|
||||||
"= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
|
"= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
|
||||||
|
|
||||||
"/afterlogic_lite".return = "302 https://webmail.pvv.ntnu.no/roundcube";
|
"/afterlogic_lite".return = "302 https://webmail.pvv.ntnu.no/roundcube";
|
||||||
"/squirrelmail".return = "302 https://webmail.pvv.ntnu.no/roundcube";
|
"/squirrelmail".return = "302 https://webmail.pvv.ntnu.no/roundcube";
|
||||||
"/rainloop".return = "302 https://webmail.pvv.ntnu.no/roundcube";
|
"/rainloop".return = "302 https://snappymail.pvv.ntnu.no/";
|
||||||
|
"/snappymail".return = "302 https://snappymail.pvv.ntnu.no/";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
18
hosts/bekkalokk/services/webmail/snappymail.nix
Normal file
18
hosts/bekkalokk/services/webmail/snappymail.nix
Normal file
@@ -0,0 +1,18 @@
|
|||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
let
|
||||||
|
cfg = config.services.snappymail;
|
||||||
|
in {
|
||||||
|
imports = [ ../../../../modules/snappymail.nix ];
|
||||||
|
|
||||||
|
services.snappymail = {
|
||||||
|
enable = true;
|
||||||
|
hostname = "snappymail.pvv.ntnu.no";
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx.virtualHosts.${cfg.hostname} = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
kTLS = true;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@@ -18,7 +18,12 @@ in {
|
|||||||
restartUnits = [ "phpfpm-pvv-nettsiden.service" ];
|
restartUnits = [ "phpfpm-pvv-nettsiden.service" ];
|
||||||
});
|
});
|
||||||
|
|
||||||
services.idp.sp-remote-metadata = [ "https://${cfg.domainName}/simplesaml/" ];
|
services.idp.sp-remote-metadata = [
|
||||||
|
"https://www.pvv.ntnu.no/simplesaml/"
|
||||||
|
"https://pvv.ntnu.no/simplesaml/"
|
||||||
|
"https://www.pvv.org/simplesaml/"
|
||||||
|
"https://pvv.org/simplesaml/"
|
||||||
|
];
|
||||||
|
|
||||||
services.pvv-nettsiden = {
|
services.pvv-nettsiden = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
133
hosts/elysium/base.nix
Normal file
133
hosts/elysium/base.nix
Normal file
@@ -0,0 +1,133 @@
|
|||||||
|
{ config, lib, pkgs, inputs, values, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./modules/snakeoil-certs.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
networking.domain = "pvv.ntnu.no";
|
||||||
|
networking.useDHCP = false;
|
||||||
|
# networking.search = [ "pvv.ntnu.no" "pvv.org" ];
|
||||||
|
# networking.nameservers = lib.mkDefault [ "129.241.0.200" "129.241.0.201" ];
|
||||||
|
# networking.tempAddresses = lib.mkDefault "disabled";
|
||||||
|
# networking.defaultGateway = values.hosts.gateway;
|
||||||
|
|
||||||
|
systemd.network.enable = true;
|
||||||
|
|
||||||
|
services.resolved = {
|
||||||
|
enable = lib.mkDefault true;
|
||||||
|
dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
|
||||||
|
};
|
||||||
|
|
||||||
|
time.timeZone = "Europe/Oslo";
|
||||||
|
|
||||||
|
i18n.defaultLocale = "en_US.UTF-8";
|
||||||
|
console = {
|
||||||
|
font = "Lat2-Terminus16";
|
||||||
|
keyMap = "no";
|
||||||
|
};
|
||||||
|
|
||||||
|
system.autoUpgrade = {
|
||||||
|
enable = true;
|
||||||
|
flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
|
||||||
|
flags = [
|
||||||
|
"--update-input" "nixpkgs"
|
||||||
|
"--update-input" "nixpkgs-unstable"
|
||||||
|
"--no-write-lock-file"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
nix.gc.automatic = true;
|
||||||
|
nix.gc.options = "--delete-older-than 2d";
|
||||||
|
|
||||||
|
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||||
|
|
||||||
|
/* This makes commandline tools like
|
||||||
|
** nix run nixpkgs#hello
|
||||||
|
** and nix-shell -p hello
|
||||||
|
** use the same channel the system
|
||||||
|
** was built with
|
||||||
|
*/
|
||||||
|
nix.registry = {
|
||||||
|
nixpkgs.flake = inputs.nixpkgs;
|
||||||
|
};
|
||||||
|
nix.nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
|
||||||
|
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
file
|
||||||
|
git
|
||||||
|
gnupg
|
||||||
|
htop
|
||||||
|
nano
|
||||||
|
ripgrep
|
||||||
|
rsync
|
||||||
|
screen
|
||||||
|
tmux
|
||||||
|
vim
|
||||||
|
wget
|
||||||
|
|
||||||
|
kitty.terminfo
|
||||||
|
foot.terminfo
|
||||||
|
];
|
||||||
|
|
||||||
|
programs.zsh.enable = true;
|
||||||
|
|
||||||
|
users.groups."drift".name = "drift";
|
||||||
|
|
||||||
|
# Trusted users on the nix builder machines
|
||||||
|
users.groups."nix-builder-users".name = "nix-builder-users";
|
||||||
|
|
||||||
|
services.openssh = {
|
||||||
|
enable = true;
|
||||||
|
extraConfig = ''
|
||||||
|
PubkeyAcceptedAlgorithms=+ssh-rsa
|
||||||
|
'';
|
||||||
|
settings.PermitRootLogin = "yes";
|
||||||
|
};
|
||||||
|
|
||||||
|
# nginx return 444 for all nonexistent virtualhosts
|
||||||
|
|
||||||
|
systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
|
||||||
|
|
||||||
|
environment.snakeoil-certs = lib.mkIf config.services.nginx.enable {
|
||||||
|
"/etc/certs/nginx" = {
|
||||||
|
owner = "nginx";
|
||||||
|
group = "nginx";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx = {
|
||||||
|
recommendedTlsSettings = true;
|
||||||
|
recommendedProxySettings = true;
|
||||||
|
recommendedOptimisation = true;
|
||||||
|
recommendedGzipSettings = true;
|
||||||
|
|
||||||
|
appendConfig = ''
|
||||||
|
pcre_jit on;
|
||||||
|
worker_processes auto;
|
||||||
|
worker_rlimit_nofile 100000;
|
||||||
|
'';
|
||||||
|
eventsConfig = ''
|
||||||
|
worker_connections 2048;
|
||||||
|
use epoll;
|
||||||
|
multi_accept on;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.nginx.serviceConfig = lib.mkIf config.services.nginx.enable {
|
||||||
|
LimitNOFILE = 65536;
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
|
||||||
|
sslCertificate = "/etc/certs/nginx.crt";
|
||||||
|
sslCertificateKey = "/etc/certs/nginx.key";
|
||||||
|
addSSL = true;
|
||||||
|
extraConfig = "return 444;";
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
|
||||||
|
|
||||||
|
security.acme = {
|
||||||
|
acceptTerms = true;
|
||||||
|
defaults.email = "drift@pvv.ntnu.no";
|
||||||
|
};
|
||||||
|
}
|
167
hosts/elysium/configuration.nix
Normal file
167
hosts/elysium/configuration.nix
Normal file
@@ -0,0 +1,167 @@
|
|||||||
|
{ config, pkgs, values, ... }:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
# Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
./nvidia.nix
|
||||||
|
./base.nix
|
||||||
|
../../misc/metrics-exporters.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
sops.defaultSopsFile = ../../secrets/elysium/elysium.yaml;
|
||||||
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||||
|
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||||
|
sops.age.generateKey = true;
|
||||||
|
|
||||||
|
boot.loader.systemd-boot.enable = true;
|
||||||
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
|
||||||
|
networking.hostName = "elysium"; # Define your hostname.
|
||||||
|
|
||||||
|
#update this to actual network card.
|
||||||
|
systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
|
||||||
|
matchConfig.Name = "ens18";
|
||||||
|
address = with values.hosts.elysium; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||||
|
};
|
||||||
|
|
||||||
|
# List packages installed in system profile
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
zsh
|
||||||
|
bash
|
||||||
|
fish
|
||||||
|
tcsh
|
||||||
|
|
||||||
|
alpine
|
||||||
|
mutt
|
||||||
|
mutt-ics
|
||||||
|
mutt-wizard
|
||||||
|
notmuch
|
||||||
|
mailutils
|
||||||
|
procmail
|
||||||
|
|
||||||
|
irssi
|
||||||
|
weechat
|
||||||
|
weechatScripts.edit
|
||||||
|
|
||||||
|
coreutils-full
|
||||||
|
diffutils
|
||||||
|
findutils
|
||||||
|
ripgrep
|
||||||
|
cvs
|
||||||
|
gawk
|
||||||
|
git
|
||||||
|
gnupg
|
||||||
|
gnused
|
||||||
|
groff
|
||||||
|
less
|
||||||
|
p7zip
|
||||||
|
rcs
|
||||||
|
screen
|
||||||
|
tmux
|
||||||
|
tree
|
||||||
|
unzip
|
||||||
|
zip
|
||||||
|
|
||||||
|
emacs
|
||||||
|
helix
|
||||||
|
joe
|
||||||
|
micro
|
||||||
|
nano
|
||||||
|
neovim
|
||||||
|
|
||||||
|
autossh
|
||||||
|
inetutils
|
||||||
|
lynx
|
||||||
|
mosh
|
||||||
|
rsync
|
||||||
|
w3m
|
||||||
|
|
||||||
|
clang
|
||||||
|
gcc
|
||||||
|
guile
|
||||||
|
lua
|
||||||
|
perl
|
||||||
|
php
|
||||||
|
python3
|
||||||
|
(python3.withPackages (ps: with ps; [
|
||||||
|
numpy
|
||||||
|
sympy
|
||||||
|
scipy
|
||||||
|
requests
|
||||||
|
imageio
|
||||||
|
pillow
|
||||||
|
httpx
|
||||||
|
pycryptodome
|
||||||
|
pandas
|
||||||
|
matplotlib
|
||||||
|
]))
|
||||||
|
ruby
|
||||||
|
tcl
|
||||||
|
|
||||||
|
|
||||||
|
openscad
|
||||||
|
cura
|
||||||
|
where-is-my-sddm-theme
|
||||||
|
firefox
|
||||||
|
|
||||||
|
];
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
fonts.packages = with pkgs; [
|
||||||
|
noto-fonts
|
||||||
|
noto-fonts-cjk
|
||||||
|
noto-fonts-emoji
|
||||||
|
liberation_ttf
|
||||||
|
fira-code
|
||||||
|
fira-code-symbols
|
||||||
|
mplus-outline-fonts.githubRelease
|
||||||
|
dina-font
|
||||||
|
proggyfonts
|
||||||
|
nerdfonts
|
||||||
|
ubuntu_font_family
|
||||||
|
|
||||||
|
];
|
||||||
|
|
||||||
|
# Enable CUPS to print documents.
|
||||||
|
services.printing.enable = true;
|
||||||
|
|
||||||
|
security.polkit.enable = true;
|
||||||
|
|
||||||
|
services.displayManager = {
|
||||||
|
enable = true;
|
||||||
|
sessionPackages = with pkgs; [ sway ];
|
||||||
|
sddm = {
|
||||||
|
enable = true;
|
||||||
|
theme = "${pkgs.where-is-my-sddm-theme}";
|
||||||
|
wayland.enable = true;
|
||||||
|
wayland.compositor = "kwin";
|
||||||
|
autoNumlock = true;
|
||||||
|
enableHidpi = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.desktopManager.plasma6.enable = true;
|
||||||
|
services.desktopManager.plasma6.enableQt5Integration = true;
|
||||||
|
|
||||||
|
qt.platformTheme = "kde";
|
||||||
|
|
||||||
|
# Configure keymap in X11
|
||||||
|
services.xserver.xkb = {
|
||||||
|
layout = "us,no";
|
||||||
|
variant = ",";
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
# List services that you want to enable:
|
||||||
|
|
||||||
|
# This value determines the NixOS release from which the default
|
||||||
|
# settings for stateful data, like file locations and database versions
|
||||||
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
# this value at the release version of the first install of this system.
|
||||||
|
# Before changing this value read the documentation for this option
|
||||||
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
|
system.stateVersion = "23.05"; # Did you read the comment?
|
||||||
|
|
||||||
|
}
|
42
hosts/elysium/hardware-configuration.nix
Normal file
42
hosts/elysium/hardware-configuration.nix
Normal file
@@ -0,0 +1,42 @@
|
|||||||
|
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||||
|
# and may be overwritten by future invocations. Please make changes
|
||||||
|
# to /etc/nixos/configuration.nix instead.
|
||||||
|
{ config, lib, pkgs, modulesPath, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
#imports =
|
||||||
|
# [ (modulesPath + "/profiles/qemu-guest.nix")
|
||||||
|
# ];
|
||||||
|
imports =
|
||||||
|
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||||
|
];
|
||||||
|
|
||||||
|
|
||||||
|
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
||||||
|
boot.initrd.kernelModules = [ ];
|
||||||
|
boot.kernelModules = [ ];
|
||||||
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
|
fileSystems."/" =
|
||||||
|
{ device = "/dev/disk/by-uuid/224c45db-9fdc-45d4-b3ad-aaf20b3efa8a";
|
||||||
|
fsType = "ext4";
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems."/boot" =
|
||||||
|
{ device = "/dev/disk/by-uuid/CC37-F5FE";
|
||||||
|
fsType = "vfat";
|
||||||
|
};
|
||||||
|
|
||||||
|
swapDevices =
|
||||||
|
[ { device = "/dev/disk/by-uuid/a1ce3234-78b1-4565-9643-f4a05004424f"; }
|
||||||
|
];
|
||||||
|
|
||||||
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
|
networking.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
}
|
52
hosts/elysium/nvidia.nix
Normal file
52
hosts/elysium/nvidia.nix
Normal file
@@ -0,0 +1,52 @@
|
|||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
{
|
||||||
|
# Enable OpenGL
|
||||||
|
hardware.opengl = {
|
||||||
|
enable = true;
|
||||||
|
driSupport = true;
|
||||||
|
driSupport32Bit = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
# Load nvidia driver for Xorg and Wayland
|
||||||
|
services.xserver.videoDrivers = ["nvidia"];
|
||||||
|
#boot with nvidia kernel module
|
||||||
|
boot.initrd.kernelModules = [ "nvidia" ];
|
||||||
|
hardware.nvidia = {
|
||||||
|
# Modesetting is required.
|
||||||
|
modesetting.enable = true;
|
||||||
|
# Nvidia power management. Experimental, and can cause sleep/suspend to fail.
|
||||||
|
#powerManagement.enable = true;
|
||||||
|
# Fine-grained power management. Turns off GPU when not in use.
|
||||||
|
# Experimental and only works on modern Nvidia GPUs (Turing or newer).
|
||||||
|
#powerManagement.finegrained = true;
|
||||||
|
|
||||||
|
# Use the NVidia open source kernel module (not to be confused with the
|
||||||
|
# independent third-party "nouveau" open source driver).
|
||||||
|
# Support is limited to the Turing and later architectures. Full list of
|
||||||
|
# supported GPUs is at:
|
||||||
|
# https://github.com/NVIDIA/open-gpu-kernel-modules#compatible-gpus
|
||||||
|
# Only available from driver 515.43.04+
|
||||||
|
# Currently alpha-quality/buggy, so false is currently the recommended setting.
|
||||||
|
open = false;
|
||||||
|
|
||||||
|
# Enable the Nvidia settings menu,
|
||||||
|
# accessible via `nvidia-settings`.
|
||||||
|
nvidiaSettings = true;
|
||||||
|
|
||||||
|
# Optionally, you may need to select the appropriate driver version for your specific GPU.
|
||||||
|
package = config.boot.kernelPackages.nvidiaPackages.legacy_470;
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
# Enable the CUDA toolkit
|
||||||
|
#install packages
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
#cudaPackages.cudnn
|
||||||
|
#cudaPackages.cudatoolkit
|
||||||
|
|
||||||
|
nvtopPackages.nvidia
|
||||||
|
|
||||||
|
];
|
||||||
|
|
||||||
|
|
||||||
|
}
|
103
modules/snappymail.nix
Normal file
103
modules/snappymail.nix
Normal file
@@ -0,0 +1,103 @@
|
|||||||
|
{ config, pkgs, lib, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
inherit (lib) mkDefault mkEnableOption mkForce mkIf mkOption mkPackageOption generators types;
|
||||||
|
|
||||||
|
cfg = config.services.snappymail;
|
||||||
|
maxUploadSize = "256M";
|
||||||
|
in {
|
||||||
|
options.services.snappymail = {
|
||||||
|
enable = mkEnableOption "Snappymail";
|
||||||
|
|
||||||
|
package = mkPackageOption pkgs "snappymail" { };
|
||||||
|
|
||||||
|
dataDir = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = "/var/lib/snappymail";
|
||||||
|
description = "State directory for snappymail";
|
||||||
|
};
|
||||||
|
|
||||||
|
hostname = mkOption {
|
||||||
|
type = types.nullOr types.str;
|
||||||
|
default = null;
|
||||||
|
example = "mail.example.com";
|
||||||
|
description = "Enable nginx with this hostname, null disables nginx";
|
||||||
|
};
|
||||||
|
|
||||||
|
user = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = "snappymail";
|
||||||
|
description = "System user under which snappymail runs";
|
||||||
|
};
|
||||||
|
|
||||||
|
group = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = "snappymail";
|
||||||
|
description = "System group under which snappymail runs";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
users.users = mkIf (cfg.user == "snappymail") {
|
||||||
|
snappymail = {
|
||||||
|
description = "Snappymail service";
|
||||||
|
group = cfg.group;
|
||||||
|
home = cfg.dataDir;
|
||||||
|
isSystemUser = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
users.groups = mkIf (cfg.group == "snappymail") {
|
||||||
|
snappymail = {};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.phpfpm.pools.snappymail = {
|
||||||
|
user = cfg.user;
|
||||||
|
group = cfg.group;
|
||||||
|
phpOptions = generators.toKeyValue {} {
|
||||||
|
upload_max_filesize = maxUploadSize;
|
||||||
|
post_max_size = maxUploadSize;
|
||||||
|
memory_limit = maxUploadSize;
|
||||||
|
};
|
||||||
|
|
||||||
|
settings = {
|
||||||
|
"listen.owner" = config.services.nginx.user;
|
||||||
|
"listen.group" = config.services.nginx.group;
|
||||||
|
"pm" = "ondemand";
|
||||||
|
"pm.max_children" = 32;
|
||||||
|
"pm.process_idle_timeout" = "10s";
|
||||||
|
"pm.max_requests" = 500;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx = mkIf (cfg.hostname != null) {
|
||||||
|
virtualHosts."${cfg.hostname}" = {
|
||||||
|
locations."/".extraConfig = ''
|
||||||
|
index index.php;
|
||||||
|
autoindex on;
|
||||||
|
autoindex_exact_size off;
|
||||||
|
autoindex_localtime on;
|
||||||
|
'';
|
||||||
|
locations."^~ /data".extraConfig = ''
|
||||||
|
deny all;
|
||||||
|
'';
|
||||||
|
locations."~ \\.php$".extraConfig = ''
|
||||||
|
include ${config.services.nginx.package}/conf/fastcgi_params;
|
||||||
|
|
||||||
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||||
|
fastcgi_pass unix:${config.services.phpfpm.pools.snappymail.socket};
|
||||||
|
'';
|
||||||
|
extraConfig = ''
|
||||||
|
client_max_body_size ${maxUploadSize};
|
||||||
|
'';
|
||||||
|
|
||||||
|
root = if (cfg.package == pkgs.snappymail) then
|
||||||
|
pkgs.snappymail.override {
|
||||||
|
dataPath = cfg.dataDir;
|
||||||
|
}
|
||||||
|
else cfg.package;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@@ -1,28 +0,0 @@
|
|||||||
acme-certs: final: prev:
|
|
||||||
let
|
|
||||||
lib = final.lib;
|
|
||||||
crt = "${final.path}/nixos/tests/common/acme/server/acme.test.cert.pem";
|
|
||||||
key = "${final.path}/nixos/tests/common/acme/server/acme.test.key.pem";
|
|
||||||
in {
|
|
||||||
writers = prev.writers // {
|
|
||||||
writeNginxConfig = name: text: final.runCommandLocal name {
|
|
||||||
nginxConfig = prev.writers.writeNginxConfig name text;
|
|
||||||
nativeBuildInputs = [ final.bubblewrap ];
|
|
||||||
} ''
|
|
||||||
ln -s "$nginxConfig" "$out"
|
|
||||||
set +o pipefail
|
|
||||||
bwrap \
|
|
||||||
--ro-bind "${crt}" "/etc/certs/nginx.crt" \
|
|
||||||
--ro-bind "${key}" "/etc/certs/nginx.key" \
|
|
||||||
--ro-bind "/nix" "/nix" \
|
|
||||||
--ro-bind "/etc/hosts" "/etc/hosts" \
|
|
||||||
--dir "/run/nginx" \
|
|
||||||
--dir "/tmp" \
|
|
||||||
--dir "/var/log/nginx" \
|
|
||||||
${lib.concatMapStrings (name: "--ro-bind \"${crt}\" \"/var/lib/acme/${name}/fullchain.pem\" \\") acme-certs}
|
|
||||||
${lib.concatMapStrings (name: "--ro-bind \"${key}\" \"/var/lib/acme/${name}/key.pem\" \\") acme-certs}
|
|
||||||
${lib.concatMapStrings (name: "--ro-bind \"${crt}\" \"/var/lib/acme/${name}/chain.pem\" \\") acme-certs}
|
|
||||||
${lib.getExe' final.nginx "nginx"} -t -c "$out" |& grep "syntax is ok"
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
}
|
|
@@ -1,8 +1,8 @@
|
|||||||
{ pkgs, lib }:
|
{ pkgs, lib }:
|
||||||
lib.makeScope pkgs.newScope (self: {
|
{
|
||||||
DeleteBatch = self.callPackage ./delete-batch { };
|
DeleteBatch = pkgs.callPackage ./delete-batch { };
|
||||||
PluggableAuth = self.callPackage ./pluggable-auth { };
|
PluggableAuth = pkgs.callPackage ./pluggable-auth { };
|
||||||
SimpleSAMLphp = self.callPackage ./simple-saml-php { };
|
SimpleSAMLphp = pkgs.callPackage ./simple-saml-php { };
|
||||||
UserMerge = self.callPackage ./user-merge { };
|
UserMerge = pkgs.callPackage ./user-merge { };
|
||||||
VisualEditor = self.callPackage ./visual-editor { };
|
VisualEditor = pkgs.callPackage ./visual-editor { };
|
||||||
})
|
}
|
||||||
|
@@ -1,7 +1,13 @@
|
|||||||
{ fetchzip }:
|
{ fetchzip }:
|
||||||
|
let
|
||||||
|
commit = "a53af3b8269ed19ede3cf1fa811e7ec8cb00af92";
|
||||||
|
project-name = "UserMerge";
|
||||||
|
tracking-branch = "REL1_41";
|
||||||
|
in
|
||||||
fetchzip {
|
fetchzip {
|
||||||
name = "mediawiki-delete-batch";
|
name = "mediawiki-delete-batch";
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/DeleteBatch-REL1_41-5774fdd.tar.gz";
|
url = "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/${project-name}/+archive/${commit}.tar.gz";
|
||||||
hash = "sha256-ROkn93lf0mNXBvij9X2pMhd8LXZ0azOz7ZRaqZvhh8k=";
|
hash = "sha256-0ofCZhhv4aVTGq469Fdu7k0oVQu3kG3HFa8zaBbUr/M=";
|
||||||
|
stripRoot = false;
|
||||||
|
passthru = { inherit project-name tracking-branch; };
|
||||||
}
|
}
|
||||||
|
@@ -1,7 +1,13 @@
|
|||||||
{ fetchzip }:
|
{ fetchzip }:
|
||||||
|
let
|
||||||
|
commit = "d5b3ad8f03b65d3746e025cdd7fe3254ad6e4026";
|
||||||
|
project-name = "PluggableAuth";
|
||||||
|
tracking-branch = "REL1_41";
|
||||||
|
in
|
||||||
fetchzip {
|
fetchzip {
|
||||||
name = "mediawiki-pluggable-auth-source";
|
name = "mediawiki-pluggable-auth-source";
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_41-d5b3ad8.tar.gz";
|
url = "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/${project-name}/+archive/${commit}.tar.gz";
|
||||||
hash = "sha256-OLlkKeSlfNgWXWwDdINrYRZpYuSGRwzZHgU8EYW6rYU=";
|
hash = "sha256-mLepavgeaNUGYxrrCKVpybGO2ecjc3B5IU8q+gZTx2U=";
|
||||||
|
stripRoot = false;
|
||||||
|
passthru = { inherit project-name tracking-branch; };
|
||||||
}
|
}
|
||||||
|
@@ -1,7 +1,13 @@
|
|||||||
{ fetchzip }:
|
{ fetchzip }:
|
||||||
|
let
|
||||||
|
commit = "9ae0678d77a9175285a1cfadd5adf28379dbdb3d";
|
||||||
|
project-name = "SimpleSAMLphp";
|
||||||
|
tracking-branch = "REL1_41";
|
||||||
|
in
|
||||||
fetchzip {
|
fetchzip {
|
||||||
name = "mediawiki-simple-saml-php-source";
|
name = "mediawiki-simple-saml-php-source";
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/SimpleSAMLphp-REL1_41-9ae0678.tar.gz";
|
url = "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/${project-name}/+archive/${commit}.tar.gz";
|
||||||
hash = "sha256-AmCaG5QXMJvi3N6zFyWylwYDt8GvyIk/0GFpM1Y0vkY=";
|
hash = "sha256-s6Uw1fNzGBF0HEMl0LIRLhJkOHugrCE0aTnqawYi/pE=";
|
||||||
|
stripRoot = false;
|
||||||
|
passthru = { inherit project-name tracking-branch; };
|
||||||
}
|
}
|
||||||
|
@@ -7,36 +7,54 @@ import re
|
|||||||
import subprocess
|
import subprocess
|
||||||
from collections import defaultdict
|
from collections import defaultdict
|
||||||
from pprint import pprint
|
from pprint import pprint
|
||||||
|
from dataclasses import dataclass
|
||||||
|
|
||||||
import bs4
|
import bs4
|
||||||
import requests
|
import requests
|
||||||
|
|
||||||
BASE_URL = "https://extdist.wmflabs.org/dist/extensions"
|
BASE_URL = "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions"
|
||||||
|
|
||||||
def fetch_plugin_list(skip_master=True) -> dict[str, list[str]]:
|
@dataclass
|
||||||
content = requests.get(BASE_URL).text
|
class PluginMetadata:
|
||||||
|
project_name: str
|
||||||
|
tracking_branch: str
|
||||||
|
commit: str
|
||||||
|
|
||||||
|
|
||||||
|
def get_metadata(file_content: str) -> dict[str,str] | None:
|
||||||
|
commit_search = re.search(f'commit = "([^"]*?)";', file_content)
|
||||||
|
tracking_branch_search = re.search(f'tracking-branch = "([^"]+?)";', file_content)
|
||||||
|
project_name_search = re.search(f'project-name = "([^"]+?)";', file_content)
|
||||||
|
if commit_search is None:
|
||||||
|
print("Could not find commit in file:")
|
||||||
|
print(file_content)
|
||||||
|
return None
|
||||||
|
if tracking_branch_search is None:
|
||||||
|
print("Could not find tracking branch in file:")
|
||||||
|
print(file_content)
|
||||||
|
return None
|
||||||
|
if project_name_search is None:
|
||||||
|
print("Could not find project name in file:")
|
||||||
|
print(file_content)
|
||||||
|
return None
|
||||||
|
return PluginMetadata(
|
||||||
|
commit = commit_search.group(1),
|
||||||
|
tracking_branch = tracking_branch_search.group(1),
|
||||||
|
project_name = project_name_search.group(1),
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
def get_newest_commit(project_name: str, tracking_branch: str) -> str:
|
||||||
|
content = requests.get(f"{BASE_URL}/{project_name}/+log/refs/heads/{tracking_branch}/").text
|
||||||
soup = bs4.BeautifulSoup(content, features="html.parser")
|
soup = bs4.BeautifulSoup(content, features="html.parser")
|
||||||
result = defaultdict(list)
|
a = soup.find('li').findChild('a')
|
||||||
for a in soup.find_all('a'):
|
commit_sha = a['href'].split('/')[-1]
|
||||||
if skip_master and 'master' in a.text:
|
return commit_sha
|
||||||
continue
|
|
||||||
split = a.text.split('-')
|
|
||||||
result[split[0]].append(a.text)
|
|
||||||
return result
|
|
||||||
|
|
||||||
def update(package_file: Path, plugin_list: dict[str, list[str]]) -> None:
|
|
||||||
assert package_file.is_file()
|
|
||||||
with open(package_file) as file:
|
|
||||||
content = file.read()
|
|
||||||
|
|
||||||
tarball = re.search(f'url = "{BASE_URL}/(.+\.tar\.gz)";', content).group(1)
|
|
||||||
split = tarball.split('-')
|
|
||||||
updated_tarball = plugin_list[split[0]][-1]
|
|
||||||
|
|
||||||
_hash = re.search(f'hash = "(.+?)";', content).group(1)
|
|
||||||
|
|
||||||
|
def get_nix_hash(tar_gz_url: str) -> str:
|
||||||
out, err = subprocess.Popen(
|
out, err = subprocess.Popen(
|
||||||
["nix-prefetch-url", "--unpack", "--type", "sha256", f"{BASE_URL}/{updated_tarball}"],
|
["nix-prefetch-url", "--unpack", "--type", "sha256", tar_gz_url],
|
||||||
stdout=subprocess.PIPE,
|
stdout=subprocess.PIPE,
|
||||||
stderr=subprocess.PIPE
|
stderr=subprocess.PIPE
|
||||||
).communicate()
|
).communicate()
|
||||||
@@ -46,21 +64,43 @@ def update(package_file: Path, plugin_list: dict[str, list[str]]) -> None:
|
|||||||
stderr=subprocess.PIPE
|
stderr=subprocess.PIPE
|
||||||
).communicate()
|
).communicate()
|
||||||
|
|
||||||
updated_hash = out.decode().strip()
|
return out.decode().strip()
|
||||||
|
|
||||||
if tarball == updated_tarball and _hash == updated_hash:
|
|
||||||
|
def set_commit_and_hash(file_content: str, commit: str, sha256: str) -> str:
|
||||||
|
result = file_content
|
||||||
|
result = re.sub('commit = "[^"]*";', f'commit = "{commit}";', result)
|
||||||
|
result = re.sub('hash = "[^"]*";', f'hash = "{sha256}";', result)
|
||||||
|
return result
|
||||||
|
|
||||||
|
def update(package_file: Path) -> None:
|
||||||
|
with open(package_file) as file:
|
||||||
|
file_content = file.read()
|
||||||
|
|
||||||
|
metadata = get_metadata(file_content)
|
||||||
|
if metadata is None:
|
||||||
|
return
|
||||||
|
if metadata.commit == "":
|
||||||
|
metadata.commit = "<none>"
|
||||||
|
|
||||||
|
new_commit = get_newest_commit(metadata.project_name, metadata.tracking_branch)
|
||||||
|
if new_commit == metadata.commit:
|
||||||
return
|
return
|
||||||
|
|
||||||
print(f"Updating: {tarball} ({_hash[7:14]}) -> {updated_tarball} ({updated_hash[7:14]})")
|
new_url = f"{BASE_URL}/{metadata.project_name}/+archive/{new_commit}.tar.gz"
|
||||||
|
new_hash = get_nix_hash(new_url)
|
||||||
|
|
||||||
|
print(f"Updating {metadata.project_name}: {metadata.commit} -> {new_commit}")
|
||||||
|
|
||||||
|
new_file_content = set_commit_and_hash(file_content, new_commit, new_hash)
|
||||||
|
|
||||||
updated_text = re.sub(f'url = "{BASE_URL}/.+?\.tar\.gz";', f'url = "{BASE_URL}/{updated_tarball}";', content)
|
|
||||||
updated_text = re.sub('hash = ".+";', f'hash = "{updated_hash}";', updated_text)
|
|
||||||
with open(package_file, 'w') as file:
|
with open(package_file, 'w') as file:
|
||||||
file.write(updated_text)
|
file.write(new_file_content)
|
||||||
|
|
||||||
|
|
||||||
if __name__ == "__main__":
|
if __name__ == "__main__":
|
||||||
plugin_list = fetch_plugin_list()
|
|
||||||
|
|
||||||
for direntry in os.scandir(Path(__file__).parent):
|
for direntry in os.scandir(Path(__file__).parent):
|
||||||
if direntry.is_dir():
|
if direntry.is_dir():
|
||||||
update(Path(direntry) / "default.nix", plugin_list)
|
package_file = Path(direntry) / "default.nix"
|
||||||
|
assert package_file.is_file()
|
||||||
|
update(package_file)
|
||||||
|
@@ -1,7 +1,13 @@
|
|||||||
{ fetchzip }:
|
{ fetchzip }:
|
||||||
|
let
|
||||||
|
commit = "a53af3b8269ed19ede3cf1fa811e7ec8cb00af92";
|
||||||
|
project-name = "UserMerge";
|
||||||
|
tracking-branch = "REL1_41";
|
||||||
|
in
|
||||||
fetchzip {
|
fetchzip {
|
||||||
name = "mediawiki-user-merge-source";
|
name = "mediawiki-user-merge-source";
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/UserMerge-REL1_41-a53af3b.tar.gz";
|
url = "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/${project-name}/+archive/${commit}.tar.gz";
|
||||||
hash = "sha256-TxUkEqMW79thYl1la2r+w9laRnd3uSYYg1xDB+1he1g=";
|
hash = "sha256-0ofCZhhv4aVTGq469Fdu7k0oVQu3kG3HFa8zaBbUr/M=";
|
||||||
|
stripRoot = false;
|
||||||
|
passthru = { inherit project-name tracking-branch; };
|
||||||
}
|
}
|
||||||
|
@@ -1,7 +1,13 @@
|
|||||||
{ fetchzip }:
|
{ fetchzip }:
|
||||||
|
let
|
||||||
|
commit = "bb92d4b0bb81cebd73a3dbabfb497213dac349f2";
|
||||||
|
project-name = "VisualEditor";
|
||||||
|
tracking-branch = "REL1_40";
|
||||||
|
in
|
||||||
fetchzip {
|
fetchzip {
|
||||||
name = "mediawiki-visual-editor-source";
|
name = "mediawiki-visual-editor-source";
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/VisualEditor-REL1_40-5f8c97e.tar.gz";
|
url = "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/${project-name}/+archive/${commit}.tar.gz";
|
||||||
hash = "sha256-oBMmEDKsFxrD0tpN2dy264IXK164BrZWrNK3v3FNX6w=";
|
hash = "sha256-lShpSoR+NLfdd5i7soM6J40pq+MzCMG0M1tSYsS+jAg=";
|
||||||
|
stripRoot = false;
|
||||||
|
passthru = { inherit project-name tracking-branch; };
|
||||||
}
|
}
|
||||||
|
@@ -1,6 +1,7 @@
|
|||||||
gitea:
|
gitea:
|
||||||
password: ENC[AES256_GCM,data:hlNzdU1ope0t50/3aztyLeXjMHd2vFPpwURX+Iu8f49DOqgSnEMtV+KtLA==,iv:qljRnSnchL5cFmaUAfCH9GQYQxcy5cyWejgk1x6bFgI=,tag:tIhboFU5kZsj5oAQR3hLbw==,type:str]
|
password: ENC[AES256_GCM,data:hlNzdU1ope0t50/3aztyLeXjMHd2vFPpwURX+Iu8f49DOqgSnEMtV+KtLA==,iv:qljRnSnchL5cFmaUAfCH9GQYQxcy5cyWejgk1x6bFgI=,tag:tIhboFU5kZsj5oAQR3hLbw==,type:str]
|
||||||
database: ENC[AES256_GCM,data:UlS33IdCEyeSvT6ngpmnkBWHuSEqsB//DT+3b7C+UwbD8UXWJlsLf1X8/w==,iv:mPRW5ldyZaHP+y/0vC2JGSLZmlkhgmkvXPk4LazkSDs=,tag:gGk6Z/nbPvzE1zG+tJC8Sw==,type:str]
|
database: ENC[AES256_GCM,data:UlS33IdCEyeSvT6ngpmnkBWHuSEqsB//DT+3b7C+UwbD8UXWJlsLf1X8/w==,iv:mPRW5ldyZaHP+y/0vC2JGSLZmlkhgmkvXPk4LazkSDs=,tag:gGk6Z/nbPvzE1zG+tJC8Sw==,type:str]
|
||||||
|
email-password: ENC[AES256_GCM,data:KRwC+aL1aPvJuXt91Oq1ttATMnFTnuUy,iv:ats8TygB/2pORkaTZzPOLufZ9UmvVAKoRcWNvYF1z6w=,tag:Do0fA+4cZ3+l7JJyu8hjBg==,type:str]
|
||||||
passwd-ssh-key: ENC[AES256_GCM,data:L0lF0wvpayss1NU9m3A45cH0bCMQzODTFVrq6EPd1JHx54wIcoaRBYLmxXKXASzBlCg9zlwXMUIk3OQcS3kdzMKL0iqcSL2iicAcKjFIHyrWLqXgwV5pRSP/tRPcVw8KW8gz0bh33EgESs5ReddZ3VZ0Cy1s2YupMRQvBXr89k1+Hv70OWB6P06hvxhv/zKcMGI1N/dWLroMgrQuT9imw4+/Q1RqwzTYeEU+eUn24AM9GjcBg4qf3OI+6g0nXUat/upIYE28iF5J3lbUSmDSmirBLc8xgHLdOyyJPTObWYWYxlSL78T7IqiMm9lI3rtBlpJDDcn/YxZpVqN5bg2154GISNK+uR0TVSLdJ+drdGHIfIX3G78XSxf2L9rbJyRn8MQlgStfdBIQicLavQKVMrmj+XQfvEMez23WbPLjH4oViBQFI+GrOHOGy/f16cz8Sn4n+69OcsOeTxs3tKYdfq6r1XLYSJ/fe/zvxBpaZiyGXljsuyEdIyBL2A8D6uSXe3Nd3/DAdBtceFfIdN1olCdutixzVWgxaJnrel161z5A/4w=,iv:Uy46yY3jFYSvpxrgCHxRMUksnWfhf5DViLMvCXVMMl4=,tag:wFEJ5+icFrOKkc56gY0A5g==,type:str]
|
passwd-ssh-key: ENC[AES256_GCM,data:L0lF0wvpayss1NU9m3A45cH0bCMQzODTFVrq6EPd1JHx54wIcoaRBYLmxXKXASzBlCg9zlwXMUIk3OQcS3kdzMKL0iqcSL2iicAcKjFIHyrWLqXgwV5pRSP/tRPcVw8KW8gz0bh33EgESs5ReddZ3VZ0Cy1s2YupMRQvBXr89k1+Hv70OWB6P06hvxhv/zKcMGI1N/dWLroMgrQuT9imw4+/Q1RqwzTYeEU+eUn24AM9GjcBg4qf3OI+6g0nXUat/upIYE28iF5J3lbUSmDSmirBLc8xgHLdOyyJPTObWYWYxlSL78T7IqiMm9lI3rtBlpJDDcn/YxZpVqN5bg2154GISNK+uR0TVSLdJ+drdGHIfIX3G78XSxf2L9rbJyRn8MQlgStfdBIQicLavQKVMrmj+XQfvEMez23WbPLjH4oViBQFI+GrOHOGy/f16cz8Sn4n+69OcsOeTxs3tKYdfq6r1XLYSJ/fe/zvxBpaZiyGXljsuyEdIyBL2A8D6uSXe3Nd3/DAdBtceFfIdN1olCdutixzVWgxaJnrel161z5A/4w=,iv:Uy46yY3jFYSvpxrgCHxRMUksnWfhf5DViLMvCXVMMl4=,tag:wFEJ5+icFrOKkc56gY0A5g==,type:str]
|
||||||
ssh-known-hosts: ENC[AES256_GCM,data:zlRLoelQeumMxGqPmgMTB69X1RVWXIs2jWwc67lk0wrdNOHUs5UzV5TUA1JnQ43RslBU92+js7DkyvE5enGzw7zZE5F1ZYdGv/eCgvkTMC9BoLfzHzP6OzayPLYEt3xJ5PRocN8JUAD55cuu4LgsuebuydHPi2oWOfpbSUBKSeCh6dvk5Pp1XRDprPS5SzGLW8Xjq98QlzmfGv50meI9CDJZVF9Wq/72gkyfgtb3YVdr,iv:AF06TBitHegfWk6w07CdkHklh4ripQCmA45vswDQgss=,tag:zKh7WVXMJN2o9ZIwIkby3Q==,type:str]
|
ssh-known-hosts: ENC[AES256_GCM,data:zlRLoelQeumMxGqPmgMTB69X1RVWXIs2jWwc67lk0wrdNOHUs5UzV5TUA1JnQ43RslBU92+js7DkyvE5enGzw7zZE5F1ZYdGv/eCgvkTMC9BoLfzHzP6OzayPLYEt3xJ5PRocN8JUAD55cuu4LgsuebuydHPi2oWOfpbSUBKSeCh6dvk5Pp1XRDprPS5SzGLW8Xjq98QlzmfGv50meI9CDJZVF9Wq/72gkyfgtb3YVdr,iv:AF06TBitHegfWk6w07CdkHklh4ripQCmA45vswDQgss=,tag:zKh7WVXMJN2o9ZIwIkby3Q==,type:str]
|
||||||
import-user-env: ENC[AES256_GCM,data:vfaqjGEnUM9VtOPvBurz7nFwzGZt3L2EqijrQej4wiOcGCrRA4tN6kBV6NmhHqlFPsw=,iv:viPGkyOOacCWcgTu25da4qH7DC4wz2qdeC1W2WcMUdI=,tag:BllNqGQoaxqUo3lTz9LGnw==,type:str]
|
import-user-env: ENC[AES256_GCM,data:vfaqjGEnUM9VtOPvBurz7nFwzGZt3L2EqijrQej4wiOcGCrRA4tN6kBV6NmhHqlFPsw=,iv:viPGkyOOacCWcgTu25da4qH7DC4wz2qdeC1W2WcMUdI=,tag:BllNqGQoaxqUo3lTz9LGnw==,type:str]
|
||||||
@@ -27,6 +28,8 @@ nettsiden:
|
|||||||
postgres_password: ENC[AES256_GCM,data:SvbrdHF4vQ94DgoEfy67QS5oziAsMT8H,iv:LOHBqMecA6mgV3NMfmfTh3zDGiDve+t3+uaO53dIxt4=,tag:9ffz84ozIqytNdGB1COMhA==,type:str]
|
postgres_password: ENC[AES256_GCM,data:SvbrdHF4vQ94DgoEfy67QS5oziAsMT8H,iv:LOHBqMecA6mgV3NMfmfTh3zDGiDve+t3+uaO53dIxt4=,tag:9ffz84ozIqytNdGB1COMhA==,type:str]
|
||||||
cookie_salt: ENC[AES256_GCM,data:VmODSLOP1YDBrpHdk/49qx9BS+aveEYDQ1D24d4zCi06kZsCENCr+vdPAnTeM1pw98RTr3yZAEQTh4s90b6v8Q==,iv:vRClu6neyYPFdtD63kjnvK2iNOIHMbh+9qEGph7CI60=,tag:66fgppVxY0egs4+9XfDBPA==,type:str]
|
cookie_salt: ENC[AES256_GCM,data:VmODSLOP1YDBrpHdk/49qx9BS+aveEYDQ1D24d4zCi06kZsCENCr+vdPAnTeM1pw98RTr3yZAEQTh4s90b6v8Q==,iv:vRClu6neyYPFdtD63kjnvK2iNOIHMbh+9qEGph7CI60=,tag:66fgppVxY0egs4+9XfDBPA==,type:str]
|
||||||
admin_password: ENC[AES256_GCM,data:SADr/zN3F0tW339kSK1nD9Pb38rw7hz8,iv:s5jgl1djXd5JKwx1WG/w2Q4STMMpjJP91qxOwAoNcL0=,tag:N8bKnO9N0ei06HDkSGt6XQ==,type:str]
|
admin_password: ENC[AES256_GCM,data:SADr/zN3F0tW339kSK1nD9Pb38rw7hz8,iv:s5jgl1djXd5JKwx1WG/w2Q4STMMpjJP91qxOwAoNcL0=,tag:N8bKnO9N0ei06HDkSGt6XQ==,type:str]
|
||||||
|
vaultwarden:
|
||||||
|
environ: ENC[AES256_GCM,data:CST5I8x8qAkrTy/wbMLL6aFSPDPIU7aWsD1L1MnIATRmk7fcUhfTSFds7quJmIpb2znsIT/WxNI/V/7UW+9ZdPKI64hfPR8MtvrJcbOhU5Fe2IiytFymFbhcOgWAXjbGzs7knQmpfMxSl98sU71oLkRuFdkousdnh4VQFZhUCYM=,iv:Is6xQ7DGdcAQgrrXCS9NbJk67O2uR82rbKOXBTzZHWw=,tag:XVEjCEM5t8qJl6jL89zrkw==,type:str]
|
||||||
sops:
|
sops:
|
||||||
kms: []
|
kms: []
|
||||||
gcp_kms: []
|
gcp_kms: []
|
||||||
@@ -60,8 +63,8 @@ sops:
|
|||||||
akVjeTNTeGorZjJQOVlMeCtPRUVYL3MK+VMvGxrbzGz4Q3sdaDDWjal+OiK+JYKX
|
akVjeTNTeGorZjJQOVlMeCtPRUVYL3MK+VMvGxrbzGz4Q3sdaDDWjal+OiK+JYKX
|
||||||
GHiMXVHQJZu/RrlxMjHKN6V3iaqxZpuvLAEJ2Lzy5EOHPtuiiRyeHQ==
|
GHiMXVHQJZu/RrlxMjHKN6V3iaqxZpuvLAEJ2Lzy5EOHPtuiiRyeHQ==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
lastmodified: "2024-04-14T21:58:31Z"
|
lastmodified: "2024-05-26T02:07:41Z"
|
||||||
mac: ENC[AES256_GCM,data:+o7YvaaKTjN/uZT5mv3z9FgIbXwG4NPJePWwRmtkBINn9X+vrCmYOXqWhKw7qfInn4Ftcg0FA7cYFZe5Pv8MNp+f8v1yoiLrVX12cxmEYtqTXJz7pNeD2st1YjGJKihNi2/fyCCf4YBCGN+8Ze//HeVf7/tfWNB+ysyC9g9Tze4=,iv:C6XBCVXn8GuNeaWGdJRnUIh1us0i8fSoxu9Sx7Feb58=,tag:W0RLPPv7eP5kCNrhMG3z7A==,type:str]
|
mac: ENC[AES256_GCM,data:CRaJefV1zcJc6eyzyjTLgd0+Wv46VT8o4iz2YAGU+c2b/Cr97Tj290LoEO6UXTI3uFwVfzii2yZ2l+4FK3nVVriD4Cx1O/9qWcnLa5gfK30U0zof6AsJx8qtGu1t6oiPlGUCF7sT0BW9Wp8cPumrY6cZp9QbhmIDV0o0aJNUNN4=,iv:8OSYV1eG6kYlJD4ovZZhcD1GaYnmy7vHPa/+7egM1nE=,tag:OPI13rpDh2l1ViFj8TBFWg==,type:str]
|
||||||
pgp:
|
pgp:
|
||||||
- created_at: "2023-05-21T00:28:40Z"
|
- created_at: "2023-05-21T00:28:40Z"
|
||||||
enc: |
|
enc: |
|
||||||
@@ -85,3 +88,4 @@ sops:
|
|||||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||||
unencrypted_suffix: _unencrypted
|
unencrypted_suffix: _unencrypted
|
||||||
version: 3.8.1
|
version: 3.8.1
|
||||||
|
|
||||||
|
Reference in New Issue
Block a user