init ozai and ozai-webui services on bekkalokk

Reviewed-on: #40

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1712798444,
+        "lastModified": 1715445235,
-        "narHash": "sha256-aAksVB7zMfBQTz0q2Lw3o78HM3Bg2FRziX2D6qnh+sk=",
+        "narHash": "sha256-SUu+oIWn+xqQIOlwfwNfS9Sek4i1HKsrLJchsDReXwA=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "a297cb1cb0337ee10a7a0f9517954501d8f6f74d",
+        "rev": "159d87ea5b95bbdea46f0288a33c5e1570272725",
         "type": "github"
       },
       "original": {
@@ -20,18 +20,58 @@
         "type": "github"
       }
     },
+    "fix-python": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "grzegorz",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1713887124,
+        "narHash": "sha256-hGTSm0p9xXUYDgsAAr/ORZICo6T6u33vLfX3tILikaQ=",
+        "owner": "GuillaumeDesforges",
+        "repo": "fix-python",
+        "rev": "f7f4b33e22414071fc1f9cbf68072c413c3a7fdf",
+        "type": "github"
+      },
+      "original": {
+        "owner": "GuillaumeDesforges",
+        "repo": "fix-python",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1689068808,
+        "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
+        "type": "github"
+      },
+      "original": {
+        "id": "flake-utils",
+        "type": "indirect"
+      }
+    },
     "grzegorz": {
       "inputs": {
+        "fix-python": "fix-python",
         "nixpkgs": [
           "nixpkgs-unstable"
         ]
       },
       "locked": {
-        "lastModified": 1712875951,
+        "lastModified": 1715364232,
-        "narHash": "sha256-4kcRd2Q2XM4r+U2zp+LADjrzazKpWvs0WrMKPktEEkc=",
+        "narHash": "sha256-ZJC3SkanEgbV7p+LFhP+85CviRWOXJNHzZwR/Stb7hE=",
         "owner": "Programvareverkstedet",
         "repo": "grzegorz",
-        "rev": "9eaba26b1671e8810cb135997c867ac3550e685a",
+        "rev": "3841cda1cdcac470440b06838d56a2eb2256378c",
         "type": "github"
       },
       "original": {
@@ -47,11 +87,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1711853301,
+        "lastModified": 1715384651,
-        "narHash": "sha256-KxRNyW/fgq690bt3B+Nz4EKLoubybcuASYyMa41bAPE=",
+        "narHash": "sha256-7RhckgUTjqeCjWkhiCc1iB+5CBx9fl80d/3O4Jh+5kM=",
         "owner": "Programvareverkstedet",
         "repo": "grzegorz-clients",
-        "rev": "c38f2f22a6d47ae2da015351a45d13cbc1eb48e4",
+        "rev": "738a4f3dd887f7c3612e4e772b83cbfa3cde5693",
         "type": "github"
       },
       "original": {
@@ -87,11 +127,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1712621190,
+        "lastModified": 1714416973,
-        "narHash": "sha256-O8xtza+wPplTmSm0EAPk8Ud9sJ6huVNY6jU21FYHCp4=",
+        "narHash": "sha256-aZUcvXjdETUC6wVQpWDVjLUzwpDAEca8yR0ITDeK39o=",
         "ref": "refs/heads/main",
-        "rev": "812c1fc4061d534a8c7d35271ce32b6c76a9f385",
+        "rev": "2b23c0ba8aae68d3cb6789f0f6e4891cef26cc6d",
-        "revCount": 5,
+        "revCount": 6,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
       },
@@ -102,11 +142,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1712848736,
+        "lastModified": 1715410392,
-        "narHash": "sha256-CzZwhqyLlebljv1zFS2KWVH/3byHND0LfaO1jKsGuVo=",
+        "narHash": "sha256-ltp1jQps9tym0uWNl/lTniHSQngCtNIyzlymu+ZSyts=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1d6a23f11e44d0fb64b3237569b87658a9eb5643",
+        "rev": "9f8bf7503bd85d5208575f4bd81c8b1fc999a468",
         "type": "github"
       },
       "original": {
@@ -117,11 +157,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1712437997,
+        "lastModified": 1714858427,
-        "narHash": "sha256-g0whLLwRvgO2FsyhY8fNk+TWenS3jg5UdlWL4uqgFeo=",
+        "narHash": "sha256-tCxeDP4C1pWe2rYY3IIhdA40Ujz32Ufd4tcrHPSKx2M=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e38d7cb66ea4f7a0eb6681920615dfcc30fc2920",
+        "rev": "b980b91038fc4b09067ef97bbe5ad07eecca1e76",
         "type": "github"
       },
       "original": {
@@ -133,11 +173,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1712837137,
+        "lastModified": 1715435713,
-        "narHash": "sha256-9joaU/GD35J9Utb0ipelQbOcvsw5eoYTmSarLV3MbNk=",
+        "narHash": "sha256-lb2HqDQGfTdnCCpc1pgF6fkdgIOuBQ0nP8jjVSfLFqg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "681d4a87b26b1dcaae7ffe6cf88c9912c575415f",
+        "rev": "52b40f6c4be12742b1504ca2eb4527e597bf2526",
         "type": "github"
       },
       "original": {
@@ -173,11 +213,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1712834399,
+        "lastModified": 1716150352,
-        "narHash": "sha256-deNJvqboPk3bEoRZ/FyZnxscsf2BpS3/52JM4qXCNSA=",
+        "narHash": "sha256-c13lzYbLmbrcbEdPTYZYtlX2Qsz1W+2sLsIMGShPgwo=",
         "ref": "refs/heads/master",
-        "rev": "216e153f89f1dbdc4c98a7c1db2a40e52becc901",
+        "rev": "2cab4df4b119e08a1f90ea1c944652cd78b4d478",
-        "revCount": 451,
+        "revCount": 459,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       },
@@ -208,11 +248,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1712617241,
+        "lastModified": 1715244550,
-        "narHash": "sha256-a4hbls4vlLRMciv62YrYT/Xs/3Cubce8WFHPUDWwzf8=",
+        "narHash": "sha256-ffOZL3eaZz5Y1nQ9muC36wBCWwS1hSRLhUzlA9hV2oI=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "538c114cfdf1f0458f507087b1dcf018ce1c0c4c",
+        "rev": "0dc50257c00ee3c65fef3a255f6564cfbfe6eb7f",
         "type": "github"
       },
       "original": {
@@ -220,6 +260,21 @@
         "repo": "sops-nix",
         "type": "github"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -27,6 +27,12 @@
     grzegorz.inputs.nixpkgs.follows = "nixpkgs-unstable";
     grzegorz-clients.url = "github:Programvareverkstedet/grzegorz-clients";
     grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
+
+    ozai.url = "git+https://git.pvv.ntnu.no/Projects/ozai.git";
+    ozai.inputs.nixpkgs.follows = "nixpkgs";
+    ozai-webui.url = "git+https://git.pvv.ntnu.no/adriangl/ozai-webui.git";
+    ozai-webui.inputs.nixpkgs.follows = "nixpkgs";
+
   };
 
   outputs = { self, nixpkgs, nixpkgs-unstable, pvv-nettsiden, sops-nix, disko, ... }@inputs:
@@ -65,9 +71,7 @@
           pkgs = import nixpkgs {
             inherit system;
             overlays = [
-              (import ./overlays/nginx-test.nix
+              # Global overlays go here
-                (builtins.attrNames self.nixosConfigurations.${name}.config.security.acme.certs)
-              )
             ] ++ config.overlays or [ ];
           };
         }
@@ -142,8 +146,13 @@
 
         simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
 
-        # mediawiki-extensions = pkgs.callPackage ./packages/mediawiki-extensions { };
+      } //
-      } // nixlib.genAttrs allMachines
+      (nixlib.pipe null [
+        (_: pkgs.callPackage ./packages/mediawiki-extensions { })
+        (nixlib.flip builtins.removeAttrs ["override" "overrideDerivation"])
+        (nixlib.mapAttrs' (name: nixlib.nameValuePair "mediawiki-${name}"))
+      ])
+      // nixlib.genAttrs allMachines
         (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
     };
   };

hosts/bekkalokk/configuration.nix

@@ -6,13 +6,14 @@
     ../../base.nix
     ../../misc/metrics-exporters.nix
 
-    ./services/website
-    ./services/nginx.nix
     ./services/gitea/default.nix
-    ./services/kerberos
-    ./services/webmail
-    ./services/mediawiki
     ./services/idp-simplesamlphp
+    ./services/kerberos
+    ./services/mediawiki
+    ./services/nginx.nix
+    ./services/vaultwarden.nix
+    ./services/webmail
+    ./services/website
   ];
 
   sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;

hosts/bekkalokk/services/gitea/ci.nix

@@ -27,8 +27,5 @@ lib.mkMerge [
   (mkRunner "alpha")
   (mkRunner "beta")
   (mkRunner "epsilon")
-  {
+  { virtualisation.podman.enable = true; }
-    virtualisation.podman.enable = true;
-    networking.firewall.interfaces."podman+".allowedUDPPorts = [ 53 5353 ];
-  }
 ]

hosts/bekkalokk/services/gitea/default.nix

@@ -6,6 +6,7 @@ let
 in {
   imports = [
     ./ci.nix
+    ./import-users.nix
   ];
 
   sops.secrets = {
@@ -13,9 +14,10 @@ in {
       owner = "gitea";
       group = "gitea";
     };
-    "gitea/passwd-ssh-key" = { };
+    "gitea/email-password" = {
-    "gitea/ssh-known-hosts" = { };
+      owner = "gitea";
-    "gitea/import-user-env" = { };
+      group = "gitea";
+    };
   };
 
   services.gitea = {
@@ -31,13 +33,23 @@ in {
       createDatabase = false;
     };
 
+    mailerPasswordFile = config.sops.secrets."gitea/email-password".path;
+
     settings = {
       server = {
         DOMAIN   = domain;
         ROOT_URL = "https://${domain}/";
         PROTOCOL = "http+unix";
         SSH_PORT = sshPort;
-	      START_SSH_SERVER = true;
+        START_SSH_SERVER = true;
+      };
+      mailer = {
+        ENABLED = true;
+        FROM = "gitea@pvv.ntnu.no";
+        PROTOCOL = "smtp";
+        SMTP_ADDR = "smtp.pvv.ntnu.no";
+        SMTP_PORT = 587;
+        USER = "gitea@pvv.ntnu.no";
       };
       indexer.REPO_INDEXER_ENABLED = true;
       service.DISABLE_REGISTRATION = true;
@@ -52,8 +64,6 @@ in {
     };
   };
 
-  services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
-
   environment.systemPackages = [ cfg.package ];
 
   services.nginx.virtualHosts."${domain}" = {
@@ -70,38 +80,28 @@ in {
 
   networking.firewall.allowedTCPPorts = [ sshPort ];
 
-  # Automatically import users
+  # Extra customization
-  systemd.services.gitea-import-users = {
-    enable = true;
-    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /tmp/passwd-import'';
-    serviceConfig = {
-      ExecStart = pkgs.writers.writePython3 "gitea-import-users" { libraries = [ pkgs.python3Packages.requests ]; } (builtins.readFile ./gitea-import-users.py);
-      LoadCredential=[
-        "sshkey:${config.sops.secrets."gitea/passwd-ssh-key".path}"
-        "ssh-known-hosts:${config.sops.secrets."gitea/ssh-known-hosts".path}"
-      ];
-      DynamicUser="yes";
-      EnvironmentFile=config.sops.secrets."gitea/import-user-env".path;
-    };
-  };
 
-  systemd.timers.gitea-import-users = {
+  services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
-    requires = [ "gitea.service" ];
-    after = [ "gitea.service" ];
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnCalendar = "*-*-* 02:00:00";
-      Persistent = true;
-      Unit = "gitea-import-users.service";
-    };
-  };
 
-  system.activationScripts.linkGiteaLogo.text = let
+  systemd.services.install-gitea-customization = {
-    logo-svg = ../../../../assets/logo_blue_regular.svg;
+    description = "Install extra customization in gitea's CUSTOM_DIR";
-    logo-png = ../../../../assets/logo_blue_regular.png;
+    wantedBy = [ "gitea.service" ];
-  in ''
+    requiredBy = [ "gitea.service" ];
-    install -Dm444 ${logo-svg} ${cfg.stateDir}/custom/public/img/logo.svg
+
-    install -Dm444 ${logo-png} ${cfg.stateDir}/custom/public/img/logo.png
+    serviceConfig =  {
-    install -Dm444 ${./loading.apng} ${cfg.stateDir}/custom/public/img/loading.png
+      Type = "oneshot";
-  '';
+      User = cfg.user;
+      Group = cfg.group;
+    };
+
+    script = let
+      logo-svg = ../../../../assets/logo_blue_regular.svg;
+      logo-png = ../../../../assets/logo_blue_regular.png;
+    in ''
+      install -Dm444 ${logo-svg} ${cfg.customDir}/public/img/logo.svg
+      install -Dm444 ${logo-png} ${cfg.customDir}/public/img/logo.png
+      install -Dm444 ${./loading.apng} ${cfg.customDir}/public/img/loading.png
+    '';
+  };
 }

hosts/bekkalokk/services/gitea/import-users.nix

@@ -0,0 +1,38 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.gitea;
+in
+{
+  sops.secrets = {
+    "gitea/passwd-ssh-key" = { };
+    "gitea/ssh-known-hosts" = { };
+    "gitea/import-user-env" = { };
+  };
+
+  systemd.services.gitea-import-users = lib.mkIf cfg.enable {
+    enable = true;
+    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /tmp/passwd-import'';
+    serviceConfig = {
+      ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
+        libraries = with pkgs.python3Packages; [ requests ];
+      } (builtins.readFile ./gitea-import-users.py);
+      LoadCredential=[
+        "sshkey:${config.sops.secrets."gitea/passwd-ssh-key".path}"
+        "ssh-known-hosts:${config.sops.secrets."gitea/ssh-known-hosts".path}"
+      ];
+      DynamicUser="yes";
+      EnvironmentFile=config.sops.secrets."gitea/import-user-env".path;
+    };
+  };
+
+  systemd.timers.gitea-import-users = lib.mkIf cfg.enable {
+    requires = [ "gitea.service" ];
+    after = [ "gitea.service" ];
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "*-*-* 02:00:00";
+      Persistent = true;
+      Unit = "gitea-import-users.service";
+    };
+  };
+}

hosts/bekkalokk/services/mediawiki/default.nix

@@ -86,7 +86,8 @@ in {
     };
 
     extensions = {
-      inherit (pkgs.mediawiki-extensions) DeleteBatch UserMerge PluggableAuth SimpleSAMLphp VisualEditor;
+      #inherit (pkgs.mediawiki-extensions) DeleteBatch UserMerge PluggableAuth SimpleSAMLphp VisualEditor;
+      inherit (pkgs.mediawiki-extensions) UserMerge PluggableAuth SimpleSAMLphp VisualEditor;
     };
 
     extraConfig = ''

hosts/bekkalokk/services/ozai.nix

@@ -0,0 +1,25 @@
+{ config, pkgs, lib, ... }:
+let
+  domain = "azul.pvv.ntnu.no";
+in
+{
+
+  services.ozai.enable = true;
+  services.ozai.host = "0.0.0.0";
+  services.ozai.port = 8000;
+
+  services.ozai-webui = {
+    enable = true;
+    port = 8085;
+    host = "127.0.0.1";
+  };
+
+  services.nginx.virtualHosts."${domain}" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyWebsockets = true;
+        proxyPass = "http://${config.services.ozai.host}:${config.services.ozai.port}";
+      };
+  };
+}

hosts/bekkalokk/services/vaultwarden.nix

@@ -0,0 +1,68 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.vaultwarden;
+  domain = "pw.pvv.ntnu.no";
+  address = "127.0.1.2";
+  port = 3011;
+  wsPort = 3012;
+in {
+  sops.secrets."vaultwarden/environ" = {
+    owner = "vaultwarden";
+    group = "vaultwarden";
+  };
+
+  services.vaultwarden = {
+    enable = true;
+    dbBackend = "postgresql";
+    environmentFile = config.sops.secrets."vaultwarden/environ".path;
+    config = {
+      domain = "https://${domain}";
+
+      rocketAddress = address;
+      rocketPort = port;
+
+      websocketEnabled = true;
+      websocketAddress = address;
+      websocketPort = wsPort;
+
+      signupsAllowed = true;
+      signupsVerify = true;
+      signupsDomainsWhitelist = "pvv.ntnu.no";
+
+      smtpFrom = "vaultwarden@pvv.ntnu.no";
+      smtpFromName = "VaultWarden PVV";
+
+      smtpHost = "smtp.pvv.ntnu.no";
+      smtpUsername = "vaultwarden";
+      smtpSecurity = "force_tls";
+      smtpAuthMechanism = "Login";
+
+      # Configured in environ:
+      # databaseUrl = "postgresql://vaultwarden@/vaultwarden";
+      # smtpPassword = hemli
+    };
+  };
+
+  services.nginx.virtualHosts."${domain}" = {
+    forceSSL = true;
+    enableACME = true;
+    kTLS = true;
+
+    extraConfig = ''
+      client_max_body_size 128M;
+    '';
+
+    locations."/" = {
+      proxyPass = "http://${address}:${toString port}";
+      proxyWebsockets = true;
+    };
+    locations."/notifications/hub" = {
+      proxyPass = "http://${address}:${toString wsPort}";
+      proxyWebsockets = true;
+    };
+    locations."/notifications/hub/negotiate" = {
+      proxyPass = "http://${address}:${toString port}";
+      proxyWebsockets = true;
+    };
+  };
+}

hosts/bekkalokk/services/webmail/default.nix

@@ -2,6 +2,7 @@
 {
   imports = [
     ./roundcube.nix
+    ./snappymail.nix
   ];
 
   services.nginx.virtualHosts."webmail.pvv.ntnu.no" = {
@@ -10,9 +11,11 @@
     kTLS = true;
     locations = {
       "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
+
       "/afterlogic_lite".return = "302 https://webmail.pvv.ntnu.no/roundcube";
       "/squirrelmail".return = "302 https://webmail.pvv.ntnu.no/roundcube";
-      "/rainloop".return = "302 https://webmail.pvv.ntnu.no/roundcube";
+      "/rainloop".return = "302 https://snappymail.pvv.ntnu.no/";
+      "/snappymail".return = "302 https://snappymail.pvv.ntnu.no/";
     };
   };
 }

hosts/bekkalokk/services/webmail/snappymail.nix

@@ -0,0 +1,18 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.snappymail;
+in {
+  imports = [ ../../../../modules/snappymail.nix ];
+
+  services.snappymail = {
+    enable = true;
+    hostname = "snappymail.pvv.ntnu.no";
+  };
+
+  services.nginx.virtualHosts.${cfg.hostname} = {
+    forceSSL = true;
+    enableACME = true;
+    kTLS = true;
+  };
+}
+

hosts/bekkalokk/services/website/default.nix

@@ -18,7 +18,12 @@ in {
     restartUnits = [ "phpfpm-pvv-nettsiden.service" ];
   });
 
-  services.idp.sp-remote-metadata = [ "https://${cfg.domainName}/simplesaml/" ];
+  services.idp.sp-remote-metadata = [
+    "https://www.pvv.ntnu.no/simplesaml/"
+    "https://pvv.ntnu.no/simplesaml/"
+    "https://www.pvv.org/simplesaml/" 
+    "https://pvv.org/simplesaml/" 
+  ];
 
   services.pvv-nettsiden = {
     enable = true;

modules/snappymail.nix

@@ -0,0 +1,103 @@
+{ config, pkgs, lib, ... }:
+
+let
+  inherit (lib) mkDefault mkEnableOption mkForce mkIf mkOption mkPackageOption generators types;
+
+  cfg = config.services.snappymail;
+  maxUploadSize = "256M";
+in {
+  options.services.snappymail = {
+    enable = mkEnableOption "Snappymail";
+
+    package = mkPackageOption pkgs "snappymail" { };
+
+    dataDir = mkOption {
+      type = types.str;
+      default = "/var/lib/snappymail";
+      description = "State directory for snappymail";
+    };
+
+    hostname = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "mail.example.com";
+      description = "Enable nginx with this hostname, null disables nginx";
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "snappymail";
+      description = "System user under which snappymail runs";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "snappymail";
+      description = "System group under which snappymail runs";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.users = mkIf (cfg.user == "snappymail") {
+      snappymail = {
+        description = "Snappymail service";
+        group = cfg.group;
+        home = cfg.dataDir;
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = mkIf (cfg.group == "snappymail") {
+      snappymail = {};
+    };
+
+    services.phpfpm.pools.snappymail = {
+      user = cfg.user;
+      group = cfg.group;
+      phpOptions = generators.toKeyValue {} {
+        upload_max_filesize = maxUploadSize;
+        post_max_size = maxUploadSize;
+        memory_limit = maxUploadSize;
+      };
+
+      settings = {
+        "listen.owner" = config.services.nginx.user;
+        "listen.group" = config.services.nginx.group;
+        "pm" = "ondemand";
+        "pm.max_children" = 32;
+        "pm.process_idle_timeout" = "10s";
+        "pm.max_requests" = 500;
+      };
+    };
+
+    services.nginx = mkIf (cfg.hostname != null) {
+      virtualHosts."${cfg.hostname}" = {
+        locations."/".extraConfig = ''
+          index index.php;
+          autoindex on;
+          autoindex_exact_size off;
+          autoindex_localtime on;
+        '';
+        locations."^~ /data".extraConfig = ''
+          deny all;
+        '';
+        locations."~ \\.php$".extraConfig = ''
+          include ${config.services.nginx.package}/conf/fastcgi_params;
+
+          fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
+          fastcgi_pass unix:${config.services.phpfpm.pools.snappymail.socket};
+        '';
+        extraConfig = ''
+          client_max_body_size ${maxUploadSize};
+        '';
+
+        root = if (cfg.package == pkgs.snappymail) then
+          pkgs.snappymail.override {
+            dataPath = cfg.dataDir;
+          }
+        else cfg.package;
+      };
+    };
+  };
+}
+

overlays/nginx-test.nix

@@ -1,28 +0,0 @@
-acme-certs: final: prev:
-  let
-    lib = final.lib;
-    crt = "${final.path}/nixos/tests/common/acme/server/acme.test.cert.pem";
-    key = "${final.path}/nixos/tests/common/acme/server/acme.test.key.pem";
-  in {
-  writers = prev.writers // {
-    writeNginxConfig = name: text: final.runCommandLocal name {
-      nginxConfig = prev.writers.writeNginxConfig name text;
-      nativeBuildInputs = [ final.bubblewrap ];
-    } ''
-      ln -s "$nginxConfig" "$out"
-      set +o pipefail
-      bwrap \
-        --ro-bind "${crt}" "/etc/certs/nginx.crt" \
-        --ro-bind "${key}" "/etc/certs/nginx.key" \
-        --ro-bind "/nix" "/nix" \
-        --ro-bind "/etc/hosts" "/etc/hosts" \
-        --dir "/run/nginx" \
-        --dir "/tmp" \
-        --dir "/var/log/nginx" \
-        ${lib.concatMapStrings (name: "--ro-bind \"${crt}\" \"/var/lib/acme/${name}/fullchain.pem\" \\") acme-certs}
-        ${lib.concatMapStrings (name: "--ro-bind \"${key}\" \"/var/lib/acme/${name}/key.pem\" \\") acme-certs}
-        ${lib.concatMapStrings (name: "--ro-bind \"${crt}\" \"/var/lib/acme/${name}/chain.pem\" \\") acme-certs}
-        ${lib.getExe' final.nginx "nginx"} -t -c "$out" |& grep "syntax is ok"
-    '';
-  };
-}

packages/mediawiki-extensions/default.nix

@@ -1,8 +1,8 @@
 { pkgs, lib }:
-lib.makeScope pkgs.newScope (self: {
+{
-  DeleteBatch = self.callPackage ./delete-batch { };
+  DeleteBatch = pkgs.callPackage ./delete-batch { };
-  PluggableAuth = self.callPackage ./pluggable-auth { };
+  PluggableAuth = pkgs.callPackage ./pluggable-auth { };
-  SimpleSAMLphp = self.callPackage ./simple-saml-php { };
+  SimpleSAMLphp = pkgs.callPackage ./simple-saml-php { };
-  UserMerge = self.callPackage ./user-merge { };
+  UserMerge = pkgs.callPackage ./user-merge { };
-  VisualEditor = self.callPackage ./visual-editor { };
+  VisualEditor = pkgs.callPackage ./visual-editor { };
-})
+}

packages/mediawiki-extensions/delete-batch/default.nix

@@ -1,7 +1,13 @@
 { fetchzip }:
-
+let
+  commit = "a53af3b8269ed19ede3cf1fa811e7ec8cb00af92";
+  project-name = "UserMerge";
+  tracking-branch = "REL1_41";
+in
 fetchzip {
   name = "mediawiki-delete-batch";
-  url = "https://extdist.wmflabs.org/dist/extensions/DeleteBatch-REL1_41-5774fdd.tar.gz";
+  url = "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/${project-name}/+archive/${commit}.tar.gz";
-  hash = "sha256-ROkn93lf0mNXBvij9X2pMhd8LXZ0azOz7ZRaqZvhh8k=";
+  hash = "sha256-0ofCZhhv4aVTGq469Fdu7k0oVQu3kG3HFa8zaBbUr/M=";
+  stripRoot = false;
+  passthru = { inherit project-name tracking-branch; };
 }

packages/mediawiki-extensions/pluggable-auth/default.nix

@@ -1,7 +1,13 @@
 { fetchzip }:
-
+let
+  commit = "d5b3ad8f03b65d3746e025cdd7fe3254ad6e4026";
+  project-name = "PluggableAuth";
+  tracking-branch = "REL1_41";
+in
 fetchzip {
   name = "mediawiki-pluggable-auth-source";
-  url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_41-d5b3ad8.tar.gz";
+  url = "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/${project-name}/+archive/${commit}.tar.gz";
-  hash = "sha256-OLlkKeSlfNgWXWwDdINrYRZpYuSGRwzZHgU8EYW6rYU=";
+  hash = "sha256-mLepavgeaNUGYxrrCKVpybGO2ecjc3B5IU8q+gZTx2U=";
+  stripRoot = false;
+  passthru = { inherit project-name tracking-branch; };
 }

packages/mediawiki-extensions/simple-saml-php/default.nix

@@ -1,7 +1,13 @@
 { fetchzip }:
-
+let
+  commit = "9ae0678d77a9175285a1cfadd5adf28379dbdb3d";
+  project-name = "SimpleSAMLphp";
+  tracking-branch = "REL1_41";
+in
 fetchzip {
   name = "mediawiki-simple-saml-php-source";
-  url = "https://extdist.wmflabs.org/dist/extensions/SimpleSAMLphp-REL1_41-9ae0678.tar.gz";
+  url = "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/${project-name}/+archive/${commit}.tar.gz";
-  hash = "sha256-AmCaG5QXMJvi3N6zFyWylwYDt8GvyIk/0GFpM1Y0vkY=";
+  hash = "sha256-s6Uw1fNzGBF0HEMl0LIRLhJkOHugrCE0aTnqawYi/pE=";
+  stripRoot = false;
+  passthru = { inherit project-name tracking-branch; };
 }

packages/mediawiki-extensions/update-mediawiki-extensions.py

@@ -7,36 +7,54 @@ import re
 import subprocess
 from collections import defaultdict
 from pprint import pprint
+from dataclasses import dataclass
 
 import bs4
 import requests
 
-BASE_URL = "https://extdist.wmflabs.org/dist/extensions"
+BASE_URL = "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions"
 
-def fetch_plugin_list(skip_master=True) -> dict[str, list[str]]:
+@dataclass
-    content = requests.get(BASE_URL).text
+class PluginMetadata:
+    project_name: str
+    tracking_branch: str
+    commit: str
+
+
+def get_metadata(file_content: str) -> dict[str,str] | None:
+    commit_search = re.search(f'commit = "([^"]*?)";', file_content)
+    tracking_branch_search = re.search(f'tracking-branch = "([^"]+?)";', file_content)
+    project_name_search = re.search(f'project-name = "([^"]+?)";', file_content)
+    if commit_search is None:
+        print("Could not find commit in file:")
+        print(file_content)
+        return None
+    if tracking_branch_search is None:
+        print("Could not find tracking branch in file:")
+        print(file_content)
+        return None
+    if project_name_search is None:
+        print("Could not find project name in file:")
+        print(file_content)
+        return None
+    return PluginMetadata(
+        commit = commit_search.group(1),
+        tracking_branch = tracking_branch_search.group(1),
+        project_name = project_name_search.group(1),
+    )
+
+
+def get_newest_commit(project_name: str, tracking_branch: str) -> str:
+    content = requests.get(f"{BASE_URL}/{project_name}/+log/refs/heads/{tracking_branch}/").text
     soup = bs4.BeautifulSoup(content, features="html.parser")
-    result = defaultdict(list)
+    a = soup.find('li').findChild('a')
-    for a in soup.find_all('a'):
+    commit_sha = a['href'].split('/')[-1]
-        if skip_master and 'master' in a.text:
+    return commit_sha
-            continue
-        split = a.text.split('-')
-        result[split[0]].append(a.text)
-    return result
 
-def update(package_file: Path, plugin_list: dict[str, list[str]]) -> None:
-    assert package_file.is_file()
-    with open(package_file) as file:
-        content = file.read()
-
-    tarball = re.search(f'url = "{BASE_URL}/(.+\.tar\.gz)";', content).group(1)
-    split = tarball.split('-')
-    updated_tarball = plugin_list[split[0]][-1]
-
-    _hash = re.search(f'hash = "(.+?)";', content).group(1)
 
+def get_nix_hash(tar_gz_url: str) -> str:
     out, err = subprocess.Popen(
-        ["nix-prefetch-url", "--unpack", "--type", "sha256", f"{BASE_URL}/{updated_tarball}"],
+        ["nix-prefetch-url", "--unpack", "--type", "sha256", tar_gz_url],
         stdout=subprocess.PIPE,
         stderr=subprocess.PIPE
     ).communicate()
@@ -46,21 +64,43 @@ def update(package_file: Path, plugin_list: dict[str, list[str]]) -> None:
         stderr=subprocess.PIPE
     ).communicate()
 
-    updated_hash = out.decode().strip()
+    return out.decode().strip()
 
-    if tarball == updated_tarball and _hash == updated_hash:
+
+def set_commit_and_hash(file_content: str, commit: str, sha256: str) -> str:
+    result = file_content
+    result = re.sub('commit = "[^"]*";', f'commit = "{commit}";', result)
+    result = re.sub('hash = "[^"]*";', f'hash = "{sha256}";', result)
+    return result
+
+def update(package_file: Path) -> None:
+    with open(package_file) as file:
+        file_content = file.read()
+
+    metadata = get_metadata(file_content)
+    if metadata is None:
+        return
+    if metadata.commit == "":
+        metadata.commit = "<none>"
+
+    new_commit = get_newest_commit(metadata.project_name, metadata.tracking_branch)
+    if new_commit == metadata.commit:
         return
 
-    print(f"Updating: {tarball} ({_hash[7:14]}) -> {updated_tarball} ({updated_hash[7:14]})")
+    new_url = f"{BASE_URL}/{metadata.project_name}/+archive/{new_commit}.tar.gz"
+    new_hash = get_nix_hash(new_url)
+
+    print(f"Updating {metadata.project_name}: {metadata.commit} -> {new_commit}")
+
+    new_file_content = set_commit_and_hash(file_content, new_commit, new_hash)
 
-    updated_text = re.sub(f'url = "{BASE_URL}/.+?\.tar\.gz";', f'url = "{BASE_URL}/{updated_tarball}";', content)
-    updated_text = re.sub('hash = ".+";', f'hash = "{updated_hash}";', updated_text)
     with open(package_file, 'w') as file:
-        file.write(updated_text)
+        file.write(new_file_content)
+
 
 if __name__ == "__main__":
-    plugin_list = fetch_plugin_list()
-
     for direntry in os.scandir(Path(__file__).parent):
         if direntry.is_dir():
-            update(Path(direntry) / "default.nix", plugin_list)
+            package_file = Path(direntry) / "default.nix"
+            assert package_file.is_file()
+            update(package_file)

packages/mediawiki-extensions/user-merge/default.nix

@@ -1,7 +1,13 @@
 { fetchzip }:
-
+let
+  commit = "a53af3b8269ed19ede3cf1fa811e7ec8cb00af92";
+  project-name = "UserMerge";
+  tracking-branch = "REL1_41";
+in
 fetchzip {
   name = "mediawiki-user-merge-source";
-  url = "https://extdist.wmflabs.org/dist/extensions/UserMerge-REL1_41-a53af3b.tar.gz";
+  url = "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/${project-name}/+archive/${commit}.tar.gz";
-  hash = "sha256-TxUkEqMW79thYl1la2r+w9laRnd3uSYYg1xDB+1he1g=";
+  hash = "sha256-0ofCZhhv4aVTGq469Fdu7k0oVQu3kG3HFa8zaBbUr/M=";
+  stripRoot = false;
+  passthru = { inherit project-name tracking-branch; };
 }

packages/mediawiki-extensions/visual-editor/default.nix

@@ -1,7 +1,13 @@
 { fetchzip }:
-
+let
+  commit = "bb92d4b0bb81cebd73a3dbabfb497213dac349f2";
+  project-name = "VisualEditor";
+  tracking-branch = "REL1_40";
+in
 fetchzip {
   name = "mediawiki-visual-editor-source";
-  url = "https://extdist.wmflabs.org/dist/extensions/VisualEditor-REL1_40-5f8c97e.tar.gz";
+  url = "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/${project-name}/+archive/${commit}.tar.gz";
-  hash = "sha256-oBMmEDKsFxrD0tpN2dy264IXK164BrZWrNK3v3FNX6w=";
+  hash = "sha256-lShpSoR+NLfdd5i7soM6J40pq+MzCMG0M1tSYsS+jAg=";
+  stripRoot = false;
+  passthru = { inherit project-name tracking-branch; };
 }

secrets/bekkalokk/bekkalokk.yaml

@@ -1,6 +1,7 @@
 gitea:
     password: ENC[AES256_GCM,data:hlNzdU1ope0t50/3aztyLeXjMHd2vFPpwURX+Iu8f49DOqgSnEMtV+KtLA==,iv:qljRnSnchL5cFmaUAfCH9GQYQxcy5cyWejgk1x6bFgI=,tag:tIhboFU5kZsj5oAQR3hLbw==,type:str]
     database: ENC[AES256_GCM,data:UlS33IdCEyeSvT6ngpmnkBWHuSEqsB//DT+3b7C+UwbD8UXWJlsLf1X8/w==,iv:mPRW5ldyZaHP+y/0vC2JGSLZmlkhgmkvXPk4LazkSDs=,tag:gGk6Z/nbPvzE1zG+tJC8Sw==,type:str]
+    email-password: ENC[AES256_GCM,data:KRwC+aL1aPvJuXt91Oq1ttATMnFTnuUy,iv:ats8TygB/2pORkaTZzPOLufZ9UmvVAKoRcWNvYF1z6w=,tag:Do0fA+4cZ3+l7JJyu8hjBg==,type:str]
     passwd-ssh-key: ENC[AES256_GCM,data:L0lF0wvpayss1NU9m3A45cH0bCMQzODTFVrq6EPd1JHx54wIcoaRBYLmxXKXASzBlCg9zlwXMUIk3OQcS3kdzMKL0iqcSL2iicAcKjFIHyrWLqXgwV5pRSP/tRPcVw8KW8gz0bh33EgESs5ReddZ3VZ0Cy1s2YupMRQvBXr89k1+Hv70OWB6P06hvxhv/zKcMGI1N/dWLroMgrQuT9imw4+/Q1RqwzTYeEU+eUn24AM9GjcBg4qf3OI+6g0nXUat/upIYE28iF5J3lbUSmDSmirBLc8xgHLdOyyJPTObWYWYxlSL78T7IqiMm9lI3rtBlpJDDcn/YxZpVqN5bg2154GISNK+uR0TVSLdJ+drdGHIfIX3G78XSxf2L9rbJyRn8MQlgStfdBIQicLavQKVMrmj+XQfvEMez23WbPLjH4oViBQFI+GrOHOGy/f16cz8Sn4n+69OcsOeTxs3tKYdfq6r1XLYSJ/fe/zvxBpaZiyGXljsuyEdIyBL2A8D6uSXe3Nd3/DAdBtceFfIdN1olCdutixzVWgxaJnrel161z5A/4w=,iv:Uy46yY3jFYSvpxrgCHxRMUksnWfhf5DViLMvCXVMMl4=,tag:wFEJ5+icFrOKkc56gY0A5g==,type:str]
     ssh-known-hosts: ENC[AES256_GCM,data:zlRLoelQeumMxGqPmgMTB69X1RVWXIs2jWwc67lk0wrdNOHUs5UzV5TUA1JnQ43RslBU92+js7DkyvE5enGzw7zZE5F1ZYdGv/eCgvkTMC9BoLfzHzP6OzayPLYEt3xJ5PRocN8JUAD55cuu4LgsuebuydHPi2oWOfpbSUBKSeCh6dvk5Pp1XRDprPS5SzGLW8Xjq98QlzmfGv50meI9CDJZVF9Wq/72gkyfgtb3YVdr,iv:AF06TBitHegfWk6w07CdkHklh4ripQCmA45vswDQgss=,tag:zKh7WVXMJN2o9ZIwIkby3Q==,type:str]
     import-user-env: ENC[AES256_GCM,data:vfaqjGEnUM9VtOPvBurz7nFwzGZt3L2EqijrQej4wiOcGCrRA4tN6kBV6NmhHqlFPsw=,iv:viPGkyOOacCWcgTu25da4qH7DC4wz2qdeC1W2WcMUdI=,tag:BllNqGQoaxqUo3lTz9LGnw==,type:str]
@@ -27,6 +28,8 @@ nettsiden:
         postgres_password: ENC[AES256_GCM,data:SvbrdHF4vQ94DgoEfy67QS5oziAsMT8H,iv:LOHBqMecA6mgV3NMfmfTh3zDGiDve+t3+uaO53dIxt4=,tag:9ffz84ozIqytNdGB1COMhA==,type:str]
         cookie_salt: ENC[AES256_GCM,data:VmODSLOP1YDBrpHdk/49qx9BS+aveEYDQ1D24d4zCi06kZsCENCr+vdPAnTeM1pw98RTr3yZAEQTh4s90b6v8Q==,iv:vRClu6neyYPFdtD63kjnvK2iNOIHMbh+9qEGph7CI60=,tag:66fgppVxY0egs4+9XfDBPA==,type:str]
         admin_password: ENC[AES256_GCM,data:SADr/zN3F0tW339kSK1nD9Pb38rw7hz8,iv:s5jgl1djXd5JKwx1WG/w2Q4STMMpjJP91qxOwAoNcL0=,tag:N8bKnO9N0ei06HDkSGt6XQ==,type:str]
+vaultwarden:
+    environ: ENC[AES256_GCM,data:CST5I8x8qAkrTy/wbMLL6aFSPDPIU7aWsD1L1MnIATRmk7fcUhfTSFds7quJmIpb2znsIT/WxNI/V/7UW+9ZdPKI64hfPR8MtvrJcbOhU5Fe2IiytFymFbhcOgWAXjbGzs7knQmpfMxSl98sU71oLkRuFdkousdnh4VQFZhUCYM=,iv:Is6xQ7DGdcAQgrrXCS9NbJk67O2uR82rbKOXBTzZHWw=,tag:XVEjCEM5t8qJl6jL89zrkw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -60,8 +63,8 @@ sops:
             akVjeTNTeGorZjJQOVlMeCtPRUVYL3MK+VMvGxrbzGz4Q3sdaDDWjal+OiK+JYKX
             GHiMXVHQJZu/RrlxMjHKN6V3iaqxZpuvLAEJ2Lzy5EOHPtuiiRyeHQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-04-14T21:58:31Z"
+    lastmodified: "2024-05-26T02:07:41Z"
-    mac: ENC[AES256_GCM,data:+o7YvaaKTjN/uZT5mv3z9FgIbXwG4NPJePWwRmtkBINn9X+vrCmYOXqWhKw7qfInn4Ftcg0FA7cYFZe5Pv8MNp+f8v1yoiLrVX12cxmEYtqTXJz7pNeD2st1YjGJKihNi2/fyCCf4YBCGN+8Ze//HeVf7/tfWNB+ysyC9g9Tze4=,iv:C6XBCVXn8GuNeaWGdJRnUIh1us0i8fSoxu9Sx7Feb58=,tag:W0RLPPv7eP5kCNrhMG3z7A==,type:str]
+    mac: ENC[AES256_GCM,data:CRaJefV1zcJc6eyzyjTLgd0+Wv46VT8o4iz2YAGU+c2b/Cr97Tj290LoEO6UXTI3uFwVfzii2yZ2l+4FK3nVVriD4Cx1O/9qWcnLa5gfK30U0zof6AsJx8qtGu1t6oiPlGUCF7sT0BW9Wp8cPumrY6cZp9QbhmIDV0o0aJNUNN4=,iv:8OSYV1eG6kYlJD4ovZZhcD1GaYnmy7vHPa/+7egM1nE=,tag:OPI13rpDh2l1ViFj8TBFWg==,type:str]
     pgp:
         - created_at: "2023-05-21T00:28:40Z"
           enc: |
@@ -85,3 +88,4 @@ sops:
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
     version: 3.8.1
+