Compare commits
3 Commits
gitea-robo
...
dagali-hei
| Author | SHA1 | Date | |
|---|---|---|---|
051dd82f57
|
|||
|
735d590f85
|
|||
|
57a2bf8bf1
|
@@ -10,8 +10,6 @@
|
||||
|
||||
./services/acme.nix
|
||||
./services/auto-upgrade.nix
|
||||
./services/dbus.nix
|
||||
./services/fwupd.nix
|
||||
./services/irqbalance.nix
|
||||
./services/logrotate.nix
|
||||
./services/nginx.nix
|
||||
@@ -19,12 +17,9 @@
|
||||
./services/postfix.nix
|
||||
./services/smartd.nix
|
||||
./services/thermald.nix
|
||||
./services/userborn.nix
|
||||
./services/userdbd.nix
|
||||
];
|
||||
|
||||
boot.tmp.cleanOnBoot = lib.mkDefault true;
|
||||
boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
|
||||
|
||||
time.timeZone = "Europe/Oslo";
|
||||
|
||||
@@ -52,8 +47,6 @@
|
||||
|
||||
programs.zsh.enable = true;
|
||||
|
||||
security.lockKernelModules = true;
|
||||
security.protectKernelImage = true;
|
||||
security.sudo.execWheelOnly = true;
|
||||
security.sudo.extraConfig = ''
|
||||
Defaults lecture = never
|
||||
|
||||
@@ -3,6 +3,10 @@
|
||||
systemd.network.enable = true;
|
||||
networking.domain = "pvv.ntnu.no";
|
||||
networking.useDHCP = false;
|
||||
# networking.search = [ "pvv.ntnu.no" "pvv.org" ];
|
||||
# networking.nameservers = lib.mkDefault [ "129.241.0.200" "129.241.0.201" ];
|
||||
# networking.tempAddresses = lib.mkDefault "disabled";
|
||||
# networking.defaultGateway = values.hosts.gateway;
|
||||
|
||||
# The rest of the networking configuration is usually sourced from /values.nix
|
||||
|
||||
|
||||
@@ -5,10 +5,10 @@
|
||||
automatic = true;
|
||||
options = "--delete-older-than 2d";
|
||||
};
|
||||
optimise.automatic = true;
|
||||
|
||||
settings = {
|
||||
allow-dirty = true;
|
||||
auto-optimise-store = true;
|
||||
builders-use-substitutes = true;
|
||||
experimental-features = [ "nix-command" "flakes" ];
|
||||
log-lines = 50;
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.dbus = {
|
||||
enable = true;
|
||||
implementation = "broker";
|
||||
};
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.fwupd.enable = true;
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.userborn.enable = true;
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.userdbd.enable = true;
|
||||
}
|
||||
46
flake.lock
generated
46
flake.lock
generated
@@ -7,11 +7,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1741786315,
|
||||
"narHash": "sha256-VT65AE2syHVj6v/DGB496bqBnu1PXrrzwlw07/Zpllc=",
|
||||
"lastModified": 1740485968,
|
||||
"narHash": "sha256-WK+PZHbfDjLyveXAxpnrfagiFgZWaTJglewBWniTn2Y=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "0d8c6ad4a43906d14abd5c60e0ffe7b587b213de",
|
||||
"rev": "19c1140419c4f1cdf88ad4c1cfb6605597628940",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -88,16 +88,16 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1735857245,
|
||||
"narHash": "sha256-AKLLPrgXTxgzll3DqVUMa4QlPlRN3QceutgFBmEf8Nk=",
|
||||
"lastModified": 1727410897,
|
||||
"narHash": "sha256-tWsyxvf421ieWUJYgjV7m1eTdr2ZkO3vId7vmtvfFpQ=",
|
||||
"owner": "dali99",
|
||||
"repo": "nixos-matrix-modules",
|
||||
"rev": "da9dc0479ffe22362793c87dc089035facf6ec4d",
|
||||
"rev": "ff787d410cba17882cd7b6e2e22cc88d4064193c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "dali99",
|
||||
"ref": "0.7.0",
|
||||
"ref": "v0.6.1",
|
||||
"repo": "nixos-matrix-modules",
|
||||
"type": "github"
|
||||
}
|
||||
@@ -110,11 +110,11 @@
|
||||
"rev": "1b4087bd3322a2e2ba84271c8fcc013e6b641a58",
|
||||
"revCount": 2,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
|
||||
"url": "https://git.pvv.ntnu.no/Drift/minecraft-data.git"
|
||||
},
|
||||
"original": {
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
|
||||
"url": "https://git.pvv.ntnu.no/Drift/minecraft-data.git"
|
||||
}
|
||||
},
|
||||
"nix-gitea-themes": {
|
||||
@@ -139,11 +139,11 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1741969460,
|
||||
"narHash": "sha256-SCNxTTBfMJV7XuTcLUfdAd6cgCGsazzi+DoPrceQrZ0=",
|
||||
"lastModified": 1740782485,
|
||||
"narHash": "sha256-GkDJDqHYlPKZFdyxzZHtljxNRsosKB1GCrblqlvLFgo=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "68612419aa6c9fd5b178b81e6fabbdf46d300ea4",
|
||||
"rev": "dd5c2540983641bbaabdfc665931592d4c9989e8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -155,11 +155,11 @@
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1741960758,
|
||||
"narHash": "sha256-pSGMbfkxF7TSeco54W+B1q+g22YCVp1qXHgtrdgtyR4=",
|
||||
"lastModified": 1740848276,
|
||||
"narHash": "sha256-bYeI3FEs824X+MJYksKboNlmglehzplqzn+XvcojWMc=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "845dc1e9cbc2e48640b8968af58b4a19db67aa8f",
|
||||
"rev": "e9b0ff70ddc61c42548501b0fafb86bb49cca858",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -196,11 +196,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1741738148,
|
||||
"narHash": "sha256-cJo6nbcJEOjkazkZ194NDnlsZe0W0wpxeUh2/886uC8=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "c1802e7cf27c7cf8b4890354c982a4eef5b11593",
|
||||
"revCount": 486,
|
||||
"lastModified": 1737151758,
|
||||
"narHash": "sha256-yZBsefIarFUEhFRj+rCGMp9Zvag3MCafqV/JfGVRVwc=",
|
||||
"ref": "refs/heads/master",
|
||||
"rev": "a4ebe6ded0c8c124561a41cb329ff30891914b5e",
|
||||
"revCount": 475,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
||||
},
|
||||
@@ -253,11 +253,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1741861888,
|
||||
"narHash": "sha256-ynOgXAyToeE1UdLNfrUn/hL7MN0OpIS2BtNdLjpjPf0=",
|
||||
"lastModified": 1739262228,
|
||||
"narHash": "sha256-7JAGezJ0Dn5qIyA2+T4Dt/xQgAbhCglh6lzCekTVMeU=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "d016ce0365b87d848a57c12ffcfdc71da7a2b55f",
|
||||
"rev": "07af005bb7d60c7f118d9d9f5530485da5d1e975",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
|
||||
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
matrix-next.url = "github:dali99/nixos-matrix-modules/0.7.0";
|
||||
matrix-next.url = "github:dali99/nixos-matrix-modules/v0.6.1";
|
||||
matrix-next.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git";
|
||||
@@ -30,7 +30,7 @@
|
||||
grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git";
|
||||
grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
minecraft-data.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git";
|
||||
minecraft-data.url = "git+https://git.pvv.ntnu.no/Drift/minecraft-data.git";
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
|
||||
@@ -105,7 +105,6 @@
|
||||
modules = [
|
||||
inputs.nix-gitea-themes.nixosModules.default
|
||||
inputs.pvv-nettsiden.nixosModules.default
|
||||
self.nixosModules.robots-txt
|
||||
];
|
||||
};
|
||||
bob = stableNixosConfig "bob" {
|
||||
@@ -146,12 +145,13 @@
|
||||
inputs.gergle.overlays.default
|
||||
];
|
||||
};
|
||||
|
||||
dagali = unstableNixosConfig "dagali" { };
|
||||
};
|
||||
|
||||
nixosModules = {
|
||||
snakeoil-certs = ./modules/snakeoil-certs.nix;
|
||||
snappymail = ./modules/snappymail.nix;
|
||||
robots-txt = ./modules/robots-txt.nix;
|
||||
};
|
||||
|
||||
devShells = forAllSystems (system: {
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, values, lib, unstablePkgs, ... }:
|
||||
{ config, values, lib, ... }:
|
||||
let
|
||||
cfg = config.services.gitea;
|
||||
domain = "git.pvv.ntnu.no";
|
||||
@@ -26,8 +26,6 @@ in {
|
||||
enable = true;
|
||||
appName = "PVV Git";
|
||||
|
||||
package = unstablePkgs.gitea;
|
||||
|
||||
database = {
|
||||
type = "postgres";
|
||||
host = "postgres.pvv.ntnu.no";
|
||||
@@ -163,108 +161,5 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
environment.robots-txt."gitea" = {
|
||||
virtualHost = domain;
|
||||
rules = [
|
||||
{
|
||||
pre_comment = ''
|
||||
Gitea internals
|
||||
|
||||
See these for more information:
|
||||
- https://gitea.com/robots.txt
|
||||
- https://codeberg.org/robots.txt
|
||||
'';
|
||||
User-agent = "*";
|
||||
Disallow = [
|
||||
"/api/*"
|
||||
"/avatars"
|
||||
"/*/*/src/commit/*"
|
||||
"/*/*/commit/*"
|
||||
"/*/*/*/refs/*"
|
||||
"/*/*/*/star"
|
||||
"/*/*/*/watch"
|
||||
"/*/*/labels"
|
||||
"/*/*/activity/*"
|
||||
"/vendor/*"
|
||||
"/swagger.*.json"
|
||||
"/repo/create"
|
||||
"/repo/migrate"
|
||||
"/org/create"
|
||||
"/*/*/fork"
|
||||
"/*/*/watchers"
|
||||
"/*/*/stargazers"
|
||||
"/*/*/forks"
|
||||
"*/.git/"
|
||||
"/*.git"
|
||||
"/*.atom"
|
||||
"/*.rss"
|
||||
];
|
||||
}
|
||||
{
|
||||
pre_comment = "Language Spam";
|
||||
Disallow = "/*?lang=";
|
||||
}
|
||||
{
|
||||
pre_comment = ''
|
||||
AI bots
|
||||
|
||||
Sourced from:
|
||||
- https://www.vg.no/robots.txt
|
||||
- https://codeberg.org/robots.txt
|
||||
'';
|
||||
User-agent = [
|
||||
"AI2Bot"
|
||||
"Ai2Bot-Dolma"
|
||||
"Amazonbot"
|
||||
"Applebot-Extended"
|
||||
"Bytespider"
|
||||
"CCBot"
|
||||
"ChatGPT-User"
|
||||
"Claude-Web"
|
||||
"ClaudeBot"
|
||||
"Crawlspace"
|
||||
"Diffbot"
|
||||
"FacebookBot"
|
||||
"FriendlyCrawler"
|
||||
"GPTBot"
|
||||
"Google-Extended"
|
||||
"ICC-Crawler"
|
||||
"ImagesiftBot"
|
||||
"Kangaroo Bot"
|
||||
"Meta-ExternalAgent"
|
||||
"OAI-SearchBot"
|
||||
"Omgili"
|
||||
"Omgilibot"
|
||||
"PanguBot"
|
||||
"PerplexityBot"
|
||||
"PetalBot"
|
||||
"Scrapy"
|
||||
"SemrushBot-OCOB"
|
||||
"Sidetrade indexer bot"
|
||||
"Timpibot"
|
||||
"VelenPublicWebCrawler"
|
||||
"Webzio-Extended"
|
||||
"YouBot"
|
||||
"anthropic-ai"
|
||||
"cohere-ai"
|
||||
"cohere-training-data-crawler"
|
||||
"facebookexternalhit"
|
||||
"iaskspider/2.0"
|
||||
"img2dataset"
|
||||
"meta-externalagent"
|
||||
"omgili"
|
||||
"omgilibot"
|
||||
];
|
||||
Disallow = "/";
|
||||
}
|
||||
{
|
||||
Crawl-delay = "2";
|
||||
}
|
||||
{
|
||||
Sitemap = "https://${domain}/sitemap.xml";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ sshPort ];
|
||||
}
|
||||
|
||||
78
hosts/dagali/TODO.md
Normal file
78
hosts/dagali/TODO.md
Normal file
@@ -0,0 +1,78 @@
|
||||
# Tracking document for new PVV kerberos auth stack
|
||||
|
||||
|
||||
|
||||
<div align="center">
|
||||
Bensinstasjon på heimdal
|
||||
</div>
|
||||
|
||||
### TODO:
|
||||
|
||||
- [ ] setup heimdal
|
||||
- [x] ensure running with systemd
|
||||
- [x] compile smbk5pwd (part of openldap)
|
||||
- [ ] set `modify -a -disallow-all-tix,requires-pre-auth default` declaratively
|
||||
- [ ] fully initialize PVV.NTNU.NO
|
||||
- [x] `kadmin -l init PVV.NTNU.NO`
|
||||
- [x] add oysteikt/admin@PVV.NTNU.NO principal
|
||||
- [x] add oysteikt@PVV.NTNU.NO principal
|
||||
- [x] add krbtgt/PVV.NTNU.NO@PVV.NTNU.NO principal?
|
||||
- why is this needed, and where is it documented?
|
||||
- `kadmin check` seems to work under sudo?
|
||||
- (it is included by default, just included as error message
|
||||
in a weird state)
|
||||
|
||||
- [x] Ensure client is working correctly
|
||||
- [x] Ensure kinit works on darbu
|
||||
- [x] Ensure kpasswd works on darbu
|
||||
- [x] Ensure kadmin get <user> (and other restricted commands) works on darbu
|
||||
|
||||
- [ ] Ensure kdc is working correctly
|
||||
- [x] Ensure kinit works on dagali
|
||||
- [x] Ensure kpasswd works on dagali
|
||||
- [ ] Ensure kadmin get <user> (and other restricte commands) works on dagali
|
||||
|
||||
- [x] Fix FQDN
|
||||
- https://github.com/NixOS/nixpkgs/issues/94011
|
||||
- https://github.com/NixOS/nixpkgs/issues/261269
|
||||
- Possibly fixed by disabling systemd-resolved
|
||||
|
||||
- [ ] setup cyrus sasl
|
||||
- [x] ensure running with systemd
|
||||
- [x] verify GSSAPI support plugin is installed
|
||||
- `nix-shell -p cyrus_sasl --command pluginviewer`
|
||||
- [x] create "host/localhost@PVV.NTNU.NO" and export to keytab
|
||||
- [x] verify cyrus sasl is able to talk to heimdal
|
||||
- `sudo testsaslauthd -u oysteikt -p <password>`
|
||||
- [ ] provide ldap principal to cyrus sasl through keytab
|
||||
|
||||
- [ ] setup openldap
|
||||
- [x] ensure running with systemd
|
||||
- [ ] verify openldap is able to talk to cyrus sasl
|
||||
- [ ] create user for oysteikt in openldap
|
||||
- [ ] authenticate openldap login through sasl
|
||||
- does this require creating an ldap user?
|
||||
|
||||
- [ ] fix smbk5pwd integration
|
||||
- [x] add smbk5pwd schemas to openldap
|
||||
- [x] create openldap db for smbk5pwd with overlays
|
||||
- [ ] test to ensure that user sync is working
|
||||
- [ ] test as user source (replace passwd)
|
||||
- [ ] test as PAM auth source
|
||||
- [ ] test as auth source for 3rd party appliation
|
||||
|
||||
- [ ] Set up ldap administration panel
|
||||
- Doesn't seem like there are many good ones out there. Maybe phpLDAPAdmin?
|
||||
|
||||
- [ ] Set up kerberos SRV DNS entry
|
||||
|
||||
### Information and URLS
|
||||
|
||||
- OpenLDAP SASL: https://www.openldap.org/doc/admin24/sasl.html
|
||||
- Use a keytab: https://kb.iu.edu/d/aumh
|
||||
- 2 ways for openldap to auth: https://security.stackexchange.com/questions/65093/how-to-test-ldap-that-authenticates-with-kerberos
|
||||
- Cyrus guide OpenLDAP + SASL + GSSAPI: https://www.cyrusimap.org/sasl/sasl/faqs/openldap-sasl-gssapi.html
|
||||
- Configuring GSSAPI and Cyrus SASL: https://web.mit.edu/darwin/src/modules/passwordserver_sasl/cyrus_sasl/doc/gssapi.html
|
||||
- PVV Kerberos docs: https://wiki.pvv.ntnu.no/wiki/Drift/Kerberos
|
||||
- OpenLDAP smbk5pwd source: https://git.openldap.org/nivanova/openldap/-/tree/master/contrib/slapd-modules/smbk5pwd
|
||||
- saslauthd(8): https://linux.die.net/man/8/saslauthd
|
||||
51
hosts/dagali/configuration.nix
Normal file
51
hosts/dagali/configuration.nix
Normal file
@@ -0,0 +1,51 @@
|
||||
|
||||
{ config, pkgs, values, lib, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
../../base.nix
|
||||
../../misc/metrics-exporters.nix
|
||||
|
||||
./services/heimdal.nix
|
||||
#./services/openldap.nix
|
||||
./services/cyrus-sasl.nix
|
||||
];
|
||||
|
||||
# buskerud does not support efi?
|
||||
# boot.loader.systemd-boot.enable = true;
|
||||
# boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
|
||||
# resolved messes up FQDN coming from nscd
|
||||
services.resolved.enable = false;
|
||||
|
||||
networking.hostName = "dagali";
|
||||
networking.domain = lib.mkForce "pvv.local";
|
||||
networking.hosts = {
|
||||
"129.241.210.185" = [ "dagali.pvv.local" ];
|
||||
};
|
||||
#networking.search = [ "pvv.ntnu.no" "pvv.org" ];
|
||||
networking.nameservers = [ "129.241.0.200" "129.241.0.201" ];
|
||||
networking.tempAddresses = "disabled";
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
systemd.network.networks."ens18" = values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "ens18";
|
||||
address = with values.hosts.dagali; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||
};
|
||||
|
||||
# List packages installed in system profile
|
||||
environment.systemPackages = with pkgs; [
|
||||
# TODO: consider adding to base.nix
|
||||
nix-output-monitor
|
||||
];
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "24.05"; # Did you read the comment?
|
||||
}
|
||||
33
hosts/dagali/hardware-configuration.nix
Normal file
33
hosts/dagali/hardware-configuration.nix
Normal file
@@ -0,0 +1,33 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/4de345e2-be41-4d10-9b90-823b2c77e9b3";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/aa4b9a97-a7d8-4608-9f67-4ad084f1baf7"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
}
|
||||
21
hosts/dagali/services/cyrus-sasl.nix
Normal file
21
hosts/dagali/services/cyrus-sasl.nix
Normal file
@@ -0,0 +1,21 @@
|
||||
{ config, ... }:
|
||||
let
|
||||
cfg = config.services.saslauthd;
|
||||
in
|
||||
{
|
||||
# TODO: This is seemingly required for openldap to authenticate
|
||||
# against kerberos, but I have no idea how to configure it as
|
||||
# such. Does it need a keytab? There's a binary "testsaslauthd"
|
||||
# that follows with `pkgs.cyrus_sasl` that might be useful.
|
||||
services.saslauthd = {
|
||||
enable = true;
|
||||
mechanism = "kerberos5";
|
||||
config = ''
|
||||
mech_list: gs2-krb5 gssapi
|
||||
keytab: /etc/krb5.keytab
|
||||
'';
|
||||
};
|
||||
|
||||
# TODO: maybe the upstream module should consider doing this?
|
||||
environment.systemPackages = [ cfg.package ];
|
||||
}
|
||||
100
hosts/dagali/services/heimdal.nix
Normal file
100
hosts/dagali/services/heimdal.nix
Normal file
@@ -0,0 +1,100 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
realm = "PVV.LOCAL";
|
||||
cfg = config.security.krb5;
|
||||
in
|
||||
{
|
||||
security.krb5 = {
|
||||
enable = true;
|
||||
|
||||
# NOTE: This is required in order to build smbk5pwd, because of some nested includes.
|
||||
# We should open an issue upstream (heimdal, not nixpkgs), but this patch
|
||||
# will do for now.
|
||||
package = pkgs.heimdal.overrideAttrs (prev: {
|
||||
postInstall = prev.postInstall + ''
|
||||
cp include/heim_threads.h $dev/include
|
||||
'';
|
||||
});
|
||||
|
||||
settings = {
|
||||
realms.${realm} = {
|
||||
kdc = [ "dagali.${lib.toLower realm}" ];
|
||||
admin_server = "dagali.${lib.toLower realm}";
|
||||
kpasswd_server = "dagali.${lib.toLower realm}";
|
||||
default_domain = lib.toLower realm;
|
||||
primary_kdc = "dagali.${lib.toLower realm}";
|
||||
};
|
||||
|
||||
kadmin.default_keys = lib.concatStringsSep " " [
|
||||
"aes256-cts-hmac-sha1-96:pw-salt"
|
||||
"aes128-cts-hmac-sha1-96:pw-salt"
|
||||
];
|
||||
|
||||
libdefaults.default_etypes = lib.concatStringsSep " " [
|
||||
"aes256-cts-hmac-sha1-96"
|
||||
"aes128-cts-hmac-sha1-96"
|
||||
];
|
||||
|
||||
libdefaults = {
|
||||
default_realm = realm;
|
||||
dns_lookup_kdc = false;
|
||||
dns_lookup_realm = false;
|
||||
};
|
||||
|
||||
domain_realm = {
|
||||
"${lib.toLower realm}" = realm;
|
||||
".${lib.toLower realm}" = realm;
|
||||
};
|
||||
|
||||
logging = {
|
||||
# kdc = "CONSOLE";
|
||||
kdc = "SYSLOG:DEBUG:AUTH";
|
||||
admin_server = "SYSLOG:DEBUG:AUTH";
|
||||
default = "SYSLOG:DEBUG:AUTH";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.kerberos_server = {
|
||||
enable = true;
|
||||
settings = {
|
||||
realms.${realm} = {
|
||||
dbname = "/var/lib/heimdal/heimdal";
|
||||
mkey = "/var/lib/heimdal/m-key";
|
||||
acl = [
|
||||
{
|
||||
principal = "kadmin/admin";
|
||||
access = "all";
|
||||
}
|
||||
{
|
||||
principal = "felixalb/admin";
|
||||
access = "all";
|
||||
}
|
||||
{
|
||||
principal = "oysteikt/admin";
|
||||
access = "all";
|
||||
}
|
||||
];
|
||||
};
|
||||
# kadmin.default_keys = lib.concatStringsSep " " [
|
||||
# "aes256-cts-hmac-sha1-96:pw-salt"
|
||||
# "aes128-cts-hmac-sha1-96:pw-salt"
|
||||
# ];
|
||||
|
||||
# libdefaults.default_etypes = lib.concatStringsSep " " [
|
||||
# "aes256-cts-hmac-sha1-96"
|
||||
# "aes128-cts-hmac-sha1-96"
|
||||
# ];
|
||||
|
||||
# password_quality.min_length = 8;
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 88 464 749 ];
|
||||
networking.firewall.allowedUDPPorts = [ 88 464 749 ];
|
||||
|
||||
networking.hosts = {
|
||||
"127.0.0.2" = lib.mkForce [ ];
|
||||
"::1" = lib.mkForce [ ];
|
||||
};
|
||||
}
|
||||
121
hosts/dagali/services/openldap.nix
Normal file
121
hosts/dagali/services/openldap.nix
Normal file
@@ -0,0 +1,121 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
services.openldap = let
|
||||
dn = "dc=pvv,dc=ntnu,dc=no";
|
||||
cfg = config.services.openldap;
|
||||
|
||||
heimdal = config.security.krb5.package;
|
||||
in {
|
||||
enable = true;
|
||||
|
||||
# NOTE: this is a custom build of openldap with support for
|
||||
# perl and kerberos.
|
||||
package = pkgs.openldap.overrideAttrs (prev: {
|
||||
# https://github.com/openldap/openldap/blob/master/configure
|
||||
configureFlags = prev.configureFlags ++ [
|
||||
# Connect to slapd via UNIX socket
|
||||
"--enable-local"
|
||||
# Cyrus SASL
|
||||
"--enable-spasswd"
|
||||
# Reverse hostname lookups
|
||||
"--enable-rlookups"
|
||||
# perl
|
||||
"--enable-perl"
|
||||
];
|
||||
|
||||
buildInputs = prev.buildInputs ++ [
|
||||
pkgs.perl
|
||||
# NOTE: do not upstream this, it might not work with
|
||||
# MIT in the same way
|
||||
heimdal
|
||||
];
|
||||
|
||||
extraContribModules = prev.extraContribModules ++ [
|
||||
# https://git.openldap.org/openldap/openldap/-/tree/master/contrib/slapd-modules
|
||||
"smbk5pwd"
|
||||
];
|
||||
});
|
||||
|
||||
settings = {
|
||||
attrs = {
|
||||
olcLogLevel = [ "stats" "config" "args" ];
|
||||
|
||||
# olcAuthzRegexp = ''
|
||||
# gidNumber=.*\\\+uidNumber=0,cn=peercred,cn=external,cn=auth
|
||||
# "uid=heimdal,${dn2}"
|
||||
# '';
|
||||
|
||||
# olcSaslSecProps = "minssf=0";
|
||||
};
|
||||
|
||||
children = {
|
||||
"cn=schema".includes = let
|
||||
# NOTE: needed for smbk5pwd.so module
|
||||
schemaToLdif = name: path: pkgs.runCommandNoCC name {
|
||||
buildInputs = with pkgs; [ schema2ldif ];
|
||||
} ''
|
||||
schema2ldif "${path}" > $out
|
||||
'';
|
||||
|
||||
hdb-ldif = schemaToLdif "hdb.ldif" "${heimdal.src}/lib/hdb/hdb.schema";
|
||||
samba-ldif = schemaToLdif "samba.ldif" "${heimdal.src}/tests/ldap/samba.schema";
|
||||
in [
|
||||
"${cfg.package}/etc/schema/core.ldif"
|
||||
"${cfg.package}/etc/schema/cosine.ldif"
|
||||
"${cfg.package}/etc/schema/nis.ldif"
|
||||
"${cfg.package}/etc/schema/inetorgperson.ldif"
|
||||
"${hdb-ldif}"
|
||||
"${samba-ldif}"
|
||||
];
|
||||
|
||||
# NOTE: installation of smbk5pwd.so module
|
||||
# https://git.openldap.org/openldap/openldap/-/tree/master/contrib/slapd-modules/smbk5pwd
|
||||
"cn=module{0}".attrs = {
|
||||
objectClass = [ "olcModuleList" ];
|
||||
olcModuleLoad = [ "${cfg.package}/lib/modules/smbk5pwd.so" ];
|
||||
};
|
||||
|
||||
# NOTE: activation of smbk5pwd.so module for {1}mdb
|
||||
"olcOverlay={0}smbk5pwd,olcDatabase={1}mdb".attrs = {
|
||||
objectClass = [ "olcOverlayConfig" "olcSmbK5PwdConfig" ];
|
||||
olcOverlay = "{0}smbk5pwd";
|
||||
olcSmbK5PwdEnable = [ "krb5" "samba" ];
|
||||
olcSmbK5PwdMustChange = toString (60 * 60 * 24 * 10000);
|
||||
};
|
||||
|
||||
"olcDatabase={1}mdb".attrs = {
|
||||
objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
|
||||
|
||||
olcDatabase = "{1}mdb";
|
||||
|
||||
olcSuffix = dn;
|
||||
|
||||
# TODO: PW is supposed to be a secret, but it's probably fine for testing
|
||||
olcRootDN = "cn=users,${dn}";
|
||||
|
||||
# TODO: replace with proper secret
|
||||
olcRootPW.path = pkgs.writeText "olcRootPW" "pass";
|
||||
|
||||
olcDbDirectory = "/var/lib/openldap/test-smbk5pwd-db";
|
||||
olcDbIndex = "objectClass eq";
|
||||
|
||||
olcAccess = [
|
||||
''{0}to attrs=userPassword,shadowLastChange
|
||||
by dn.exact=cn=users,${dn} write
|
||||
by self write
|
||||
by anonymous auth
|
||||
by * none''
|
||||
|
||||
''{1}to dn.base=""
|
||||
by * read''
|
||||
|
||||
/* allow read on anything else */
|
||||
# ''{2}to *
|
||||
# by cn=users,${dn} write by dn.exact=gidNumber=0+uidNumber=0+cn=peercred,cn=external write
|
||||
# by * read''
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -2,10 +2,4 @@
|
||||
|
||||
{
|
||||
nix.settings.trusted-users = [ "@nix-builder-users" ];
|
||||
nix.daemonCPUSchedPolicy = "batch";
|
||||
|
||||
boot.binfmt.emulatedSystems = [
|
||||
"aarch64-linux"
|
||||
"armv7l-linux"
|
||||
];
|
||||
}
|
||||
|
||||
@@ -1,116 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.environment.robots-txt;
|
||||
|
||||
robots-txt-format = {
|
||||
type = let
|
||||
coercedStrToNonEmptyListOfStr = lib.types.coercedTo lib.types.str lib.singleton (lib.types.nonEmptyListOf lib.types.str);
|
||||
in lib.types.listOf (lib.types.submodule {
|
||||
freeformType = lib.types.attrsOf coercedStrToNonEmptyListOfStr;
|
||||
options = {
|
||||
pre_comment = lib.mkOption {
|
||||
description = "Comment to add before the rule";
|
||||
type = lib.types.lines;
|
||||
default = "";
|
||||
};
|
||||
post_comment = lib.mkOption {
|
||||
description = "Comment to add after the rule";
|
||||
type = lib.types.lines;
|
||||
default = "";
|
||||
};
|
||||
};
|
||||
});
|
||||
|
||||
generate = name: value: let
|
||||
makeComment = comment: lib.pipe comment [
|
||||
(lib.splitString "\n")
|
||||
(lib.map (line: if line == "" then "#" else "# ${line}"))
|
||||
(lib.concatStringsSep "\n")
|
||||
];
|
||||
|
||||
ruleToString = rule: let
|
||||
user_agent = rule.User-agent or [];
|
||||
pre_comment = rule.pre_comment;
|
||||
post_comment = rule.post_comment;
|
||||
rest = builtins.removeAttrs rule [ "User-agent" "pre_comment" "post_comment" ];
|
||||
in lib.concatStringsSep "\n" (lib.filter (x: x != null) [
|
||||
(if (pre_comment != "") then makeComment pre_comment else null)
|
||||
(let
|
||||
user-agents = lib.concatMapStringsSep "\n" (value: "User-agent: ${value}") user_agent;
|
||||
in
|
||||
if user_agent == [] then null else user-agents
|
||||
)
|
||||
(lib.pipe rest [
|
||||
(lib.mapAttrsToList (ruleName: map (value: "${ruleName}: ${value}")))
|
||||
lib.concatLists
|
||||
(lib.concatStringsSep "\n")
|
||||
])
|
||||
(if (post_comment != "") then makeComment post_comment else null)
|
||||
]);
|
||||
|
||||
content = lib.concatMapStringsSep "\n\n" ruleToString value;
|
||||
in pkgs.writeText name content;
|
||||
};
|
||||
in
|
||||
{
|
||||
options.environment.robots-txt = lib.mkOption {
|
||||
default = { };
|
||||
description = ''
|
||||
Different instances of robots.txt to use with web services.
|
||||
'';
|
||||
type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
|
||||
options = {
|
||||
enable = lib.mkEnableOption "this instance of robots.txt" // {
|
||||
default = true;
|
||||
};
|
||||
|
||||
path = lib.mkOption {
|
||||
description = "The resulting path of the dir containing the robots.txt file";
|
||||
type = lib.types.path;
|
||||
readOnly = true;
|
||||
default = "/etc/robots-txt/${name}";
|
||||
};
|
||||
|
||||
rules = lib.mkOption {
|
||||
description = "Rules to include in robots.txt";
|
||||
default = [ ];
|
||||
example = [
|
||||
{ User-agent = "Googlebot"; Disallow = "/no-googlebot"; }
|
||||
{ User-agent = "Bingbot"; Disallow = [ "/no-bingbot" "/no-bingbot2" ]; }
|
||||
];
|
||||
type = robots-txt-format.type;
|
||||
};
|
||||
|
||||
virtualHost = lib.mkOption {
|
||||
description = "An nginx virtual host to add the robots.txt to";
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = null;
|
||||
};
|
||||
};
|
||||
}));
|
||||
};
|
||||
|
||||
config = {
|
||||
environment.etc = lib.mapAttrs' (name: value: {
|
||||
name = "robots-txt/${name}/robots.txt";
|
||||
value.source = robots-txt-format.generate name value.rules;
|
||||
}) cfg;
|
||||
|
||||
services.nginx.virtualHosts = lib.pipe cfg [
|
||||
(lib.filterAttrs (_: value: value.virtualHost != null))
|
||||
(lib.mapAttrs' (name: value: {
|
||||
name = value.virtualHost;
|
||||
value = {
|
||||
locations = {
|
||||
"= /robots.txt" = {
|
||||
extraConfig = ''
|
||||
add_header Content-Type text/plain;
|
||||
'';
|
||||
root = cfg.${name}.path;
|
||||
};
|
||||
};
|
||||
};
|
||||
}))
|
||||
];
|
||||
};
|
||||
}
|
||||
20
shell.nix
20
shell.nix
@@ -11,14 +11,14 @@ pkgs.mkShellNoCC {
|
||||
editorconfig-checker
|
||||
];
|
||||
|
||||
env = {
|
||||
OS_AUTH_URL = "https://api.stack.it.ntnu.no:5000";
|
||||
OS_PROJECT_ID = "b78432a088954cdc850976db13cfd61c";
|
||||
OS_PROJECT_NAME = "STUDORG_Programvareverkstedet";
|
||||
OS_USER_DOMAIN_NAME = "NTNU";
|
||||
OS_PROJECT_DOMAIN_ID = "d3f99bcdaf974685ad0c74c2e5d259db";
|
||||
OS_REGION_NAME = "NTNU-IT";
|
||||
OS_INTERFACE = "public";
|
||||
OS_IDENTITY_API_VERSION = "3";
|
||||
};
|
||||
shellHook = ''
|
||||
export OS_AUTH_URL=https://api.stack.it.ntnu.no:5000
|
||||
export OS_PROJECT_ID=b78432a088954cdc850976db13cfd61c
|
||||
export OS_PROJECT_NAME="STUDORG_Programvareverkstedet"
|
||||
export OS_USER_DOMAIN_NAME="NTNU"
|
||||
export OS_PROJECT_DOMAIN_ID="d3f99bcdaf974685ad0c74c2e5d259db"
|
||||
export OS_REGION_NAME="NTNU-IT"
|
||||
export OS_INTERFACE=public
|
||||
export OS_IDENTITY_API_VERSION=3
|
||||
'';
|
||||
}
|
||||
|
||||
@@ -31,6 +31,10 @@ in rec {
|
||||
ipv4 = pvv-ipv4 168;
|
||||
ipv6 = pvv-ipv6 168;
|
||||
};
|
||||
dagali = {
|
||||
ipv4 = pvv-ipv4 185;
|
||||
ipv6 = pvv-ipv6 185;
|
||||
};
|
||||
ildkule = {
|
||||
ipv4 = "129.241.153.213";
|
||||
ipv4_internal = "192.168.12.209";
|
||||
|
||||
Reference in New Issue
Block a user