Compare commits
22 Commits
|
|
@ -1,9 +1,9 @@
|
|||
{ pkgs, lib, ... }:
|
||||
{ pkgs, lib, fp, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
../users
|
||||
../modules/snakeoil-certs.nix
|
||||
(fp /users)
|
||||
(fp /modules/snakeoil-certs.nix)
|
||||
|
||||
./networking.nix
|
||||
./nix.nix
|
||||
|
|
|
|||
|
|
@ -1,6 +1,16 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
services.smartd.enable = lib.mkDefault true;
|
||||
services.smartd = {
|
||||
enable = lib.mkDefault true;
|
||||
notifications = {
|
||||
mail = {
|
||||
enable = true;
|
||||
sender = "root@pvv.ntnu.no";
|
||||
recipient = "root@pvv.ntnu.no";
|
||||
};
|
||||
wall.enable = false;
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = lib.optionals config.services.smartd.enable (with pkgs; [
|
||||
smartmontools
|
||||
|
|
|
|||
127
flake.lock
127
flake.lock
|
|
@ -7,11 +7,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1725242307,
|
||||
"narHash": "sha256-a2iTMBngegEZvaNAzzxq5Gc5Vp3UWoGUqWtK11Txbic=",
|
||||
"lastModified": 1731746438,
|
||||
"narHash": "sha256-f3SSp1axoOk0NAI7oFdRzbxG2XPBSIXC+/DaAXnvS1A=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "96073e6423623d4a8027e9739d2af86d6422ea7a",
|
||||
"rev": "cb64993826fa7a477490be6ccb38ba1fa1e18fa8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -20,64 +20,25 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"fix-python": {
|
||||
"greg-ng": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils",
|
||||
"nixpkgs": [
|
||||
"grzegorz",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1725463969,
|
||||
"narHash": "sha256-d3c1TAlIN1PtK+oQP1wO6XbDfmR4SUp/C/4s7G46ARo=",
|
||||
"owner": "GuillaumeDesforges",
|
||||
"repo": "fix-python",
|
||||
"rev": "2926402234c3f99aa8e4608c51d9ffa73ea403c0",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "GuillaumeDesforges",
|
||||
"repo": "fix-python",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"inputs": {
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1689068808,
|
||||
"narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"id": "flake-utils",
|
||||
"type": "indirect"
|
||||
}
|
||||
},
|
||||
"grzegorz": {
|
||||
"inputs": {
|
||||
"fix-python": "fix-python",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
],
|
||||
"rust-overlay": "rust-overlay"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1726861911,
|
||||
"narHash": "sha256-pXPmVp4AgszzJXlLjj8r9NxoDvxoV4USGaiMwqCyb4M=",
|
||||
"ref": "refs/heads/master",
|
||||
"rev": "d10db19d7df5c5c2cd2dcb878376d5d681f6c2f2",
|
||||
"revCount": 94,
|
||||
"lastModified": 1730249639,
|
||||
"narHash": "sha256-G3URSlqCcb+GIvGyki+HHrDM5ZanX/dP9BtppD/SdfI=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "80e0447bcb79adad4f459ada5610f3eae987b4e3",
|
||||
"revCount": 34,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/grzegorz.git"
|
||||
"url": "https://git.pvv.ntnu.no/Projects/greg-ng.git"
|
||||
},
|
||||
"original": {
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/grzegorz.git"
|
||||
"url": "https://git.pvv.ntnu.no/Projects/greg-ng.git"
|
||||
}
|
||||
},
|
||||
"grzegorz-clients": {
|
||||
|
|
@ -158,11 +119,11 @@
|
|||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1725198597,
|
||||
"narHash": "sha256-w3sjCEbnc242ByJ18uebzgjFZY3QU7dZhmLwPsJIZJs=",
|
||||
"lastModified": 1731663789,
|
||||
"narHash": "sha256-x07g4NcqGP6mQn6AISXJaks9sQYDjZmTMBlKIvajvyc=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "3524b030c839db4ea4ba16737789c6fb8a1769c6",
|
||||
"rev": "035d434d48f4375ac5d3a620954cf5fda7dd7c36",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -174,11 +135,11 @@
|
|||
},
|
||||
"nixpkgs-stable": {
|
||||
"locked": {
|
||||
"lastModified": 1721524707,
|
||||
"narHash": "sha256-5NctRsoE54N86nWd0psae70YSLfrOek3Kv1e8KoXe/0=",
|
||||
"lastModified": 1730602179,
|
||||
"narHash": "sha256-efgLzQAWSzJuCLiCaQUCDu4NudNlHdg2NzGLX5GYaEY=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "556533a23879fc7e5f98dd2e0b31a6911a213171",
|
||||
"rev": "3c2f1c4ca372622cb2f9de8016c9a0b1cbd0f37c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -190,11 +151,11 @@
|
|||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1725183711,
|
||||
"narHash": "sha256-gkjg8FfjL92azt3gzZUm1+v+U4y+wbQE630uIf4Aybo=",
|
||||
"lastModified": 1731745710,
|
||||
"narHash": "sha256-SVeiClbgqL071JpAspOu0gCkPSAL51kSIRwo4C/pghA=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a2c345850e5e1d96c62e7fa8ca6c9d77ebad1c37",
|
||||
"rev": "dfaa4cb76c2d450d8f396bb6b9f43cede3ade129",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -247,7 +208,7 @@
|
|||
"root": {
|
||||
"inputs": {
|
||||
"disko": "disko",
|
||||
"grzegorz": "grzegorz",
|
||||
"greg-ng": "greg-ng",
|
||||
"grzegorz-clients": "grzegorz-clients",
|
||||
"matrix-next": "matrix-next",
|
||||
"minecraft-data": "minecraft-data",
|
||||
|
|
@ -259,6 +220,27 @@
|
|||
"sops-nix": "sops-nix"
|
||||
}
|
||||
},
|
||||
"rust-overlay": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"greg-ng",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1729391507,
|
||||
"narHash": "sha256-as0I9xieJUHf7kiK2a9znDsVZQTFWhM1pLivII43Gi0=",
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"rev": "784981a9feeba406de38c1c9a3decf966d853cca",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"sops-nix": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
|
|
@ -267,11 +249,11 @@
|
|||
"nixpkgs-stable": "nixpkgs-stable"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1725201042,
|
||||
"narHash": "sha256-lj5pxOwidP0W//E7IvyhbhXrnEUW99I07+QpERnzTS4=",
|
||||
"lastModified": 1731748189,
|
||||
"narHash": "sha256-Zd/Uukvpcu26M6YGhpbsgqm6LUSLz+Q8mDZ5LOEGdiE=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "5db5921e40ae382d6716dce591ea23b0a39d96f7",
|
||||
"rev": "d2bd7f433b28db6bc7ae03d5eca43564da0af054",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -279,21 +261,6 @@
|
|||
"repo": "sops-nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
|
|
|
|||
15
flake.nix
15
flake.nix
|
|
@ -23,8 +23,8 @@
|
|||
nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git";
|
||||
nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
grzegorz.url = "git+https://git.pvv.ntnu.no/Projects/grzegorz.git";
|
||||
grzegorz.inputs.nixpkgs.follows = "nixpkgs";
|
||||
greg-ng.url = "git+https://git.pvv.ntnu.no/Projects/greg-ng.git";
|
||||
greg-ng.inputs.nixpkgs.follows = "nixpkgs";
|
||||
grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Projects/grzegorz-clients.git";
|
||||
grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
|
|
@ -59,6 +59,7 @@
|
|||
specialArgs = {
|
||||
inherit unstablePkgs inputs;
|
||||
values = import ./values.nix;
|
||||
fp = path: ./${path};
|
||||
};
|
||||
|
||||
modules = [
|
||||
|
|
@ -116,14 +117,20 @@
|
|||
|
||||
brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
|
||||
modules = [
|
||||
inputs.grzegorz.nixosModules.grzegorz-kiosk
|
||||
inputs.grzegorz-clients.nixosModules.grzegorz-webui
|
||||
inputs.greg-ng.nixosModules.default
|
||||
];
|
||||
overlays = [
|
||||
inputs.greg-ng.overlays.default
|
||||
];
|
||||
};
|
||||
georg = stableNixosConfig "georg" {
|
||||
modules = [
|
||||
inputs.grzegorz.nixosModules.grzegorz-kiosk
|
||||
inputs.grzegorz-clients.nixosModules.grzegorz-webui
|
||||
inputs.greg-ng.nixosModules.default
|
||||
];
|
||||
overlays = [
|
||||
inputs.greg-ng.overlays.default
|
||||
];
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
{ pkgs, values, ... }:
|
||||
{ fp, pkgs, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
|
||||
../../base
|
||||
../../misc/metrics-exporters.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
|
||||
./services/bluemap/default.nix
|
||||
./services/gitea/default.nix
|
||||
|
|
@ -16,9 +16,10 @@
|
|||
./services/vaultwarden.nix
|
||||
./services/webmail
|
||||
./services/website
|
||||
./services/well-known
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
|
||||
sops.defaultSopsFile = fp /secrets/bekkalokk/bekkalokk.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, values, pkgs, lib, ... }:
|
||||
{ config, values, fp, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.services.gitea;
|
||||
domain = "git.pvv.ntnu.no";
|
||||
|
|
@ -6,6 +6,7 @@ let
|
|||
in {
|
||||
imports = [
|
||||
./ci.nix
|
||||
./gpg.nix
|
||||
./import-users
|
||||
./web-secret-provider
|
||||
];
|
||||
|
|
@ -173,8 +174,8 @@ in {
|
|||
};
|
||||
|
||||
script = let
|
||||
logo-svg = ../../../../assets/logo_blue_regular.svg;
|
||||
logo-png = ../../../../assets/logo_blue_regular.png;
|
||||
logo-svg = fp /assets/logo_blue_regular.svg;
|
||||
logo-png = fp /assets/logo_blue_regular.png;
|
||||
extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
|
||||
<a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
|
||||
<a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
|
||||
|
|
|
|||
|
|
@ -0,0 +1,38 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.services.gitea;
|
||||
GNUPGHOME = "${config.users.users.gitea.home}/gnupg";
|
||||
in
|
||||
{
|
||||
sops.secrets."gitea/gpg-signing-key" = {
|
||||
owner = cfg.user;
|
||||
inherit (cfg) group;
|
||||
};
|
||||
|
||||
systemd.services.gitea.environment = { inherit GNUPGHOME; };
|
||||
|
||||
systemd.tmpfiles.settings."20-gitea-gnugpg".${GNUPGHOME}.d = {
|
||||
inherit (cfg) user group;
|
||||
mode = "700";
|
||||
};
|
||||
|
||||
systemd.services.gitea-ensure-gnupg-homedir = {
|
||||
description = "Import gpg key for gitea";
|
||||
environment = { inherit GNUPGHOME; };
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = cfg.user;
|
||||
PrivateNetwork = true;
|
||||
};
|
||||
script = ''
|
||||
${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key".path}
|
||||
'';
|
||||
};
|
||||
|
||||
services.gitea.settings."repository.signing" = {
|
||||
SIGNING_KEY = "0549C43374D2253C";
|
||||
SIGNING_NAME = "PVV Git";
|
||||
SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
|
||||
INITIAL_COMMIT = "always";
|
||||
};
|
||||
}
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
{ pkgs, lib, config, values, pkgs-unstable, ... }: let
|
||||
{ pkgs, lib, fp, config, values, pkgs-unstable, ... }: let
|
||||
cfg = config.services.mediawiki;
|
||||
|
||||
# "mediawiki"
|
||||
|
|
@ -210,8 +210,8 @@ in {
|
|||
'';
|
||||
};
|
||||
|
||||
"= /PNG/PVV-logo.svg".alias = ../../../../assets/logo_blue_regular.svg;
|
||||
"= /PNG/PVV-logo.png".alias = ../../../../assets/logo_blue_regular.png;
|
||||
"= /PNG/PVV-logo.svg".alias = fp /assets/logo_blue_regular.svg;
|
||||
"= /PNG/PVV-logo.png".alias = fp /assets/logo_blue_regular.png;
|
||||
"= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
|
||||
buildInputs = with pkgs; [ imagemagick ];
|
||||
} ''
|
||||
|
|
@ -219,7 +219,7 @@ in {
|
|||
-resize x64 \
|
||||
-gravity center \
|
||||
-crop 64x64+0+0 \
|
||||
${../../../../assets/logo_blue_regular.png} \
|
||||
${fp /assets/logo_blue_regular.png} \
|
||||
-flatten \
|
||||
-colors 256 \
|
||||
-background transparent \
|
||||
|
|
|
|||
|
|
@ -1,8 +1,8 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
{ config, lib, fp, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.snappymail;
|
||||
in {
|
||||
imports = [ ../../../../modules/snappymail.nix ];
|
||||
imports = [ (fp /modules/snappymail.nix) ];
|
||||
|
||||
services.snappymail = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -116,16 +116,6 @@ in {
|
|||
"/drift".return = "301 https://wiki.pvv.ntnu.no/wiki/Drift";
|
||||
"/diverse/abuse.php".return = "301 https://wiki.pvv.ntnu.no/wiki/CERT/Abuse";
|
||||
"/nerds/".return = "301 https://wiki.pvv.ntnu.no/wiki/Nerdepizza";
|
||||
|
||||
# Proxy the matrix well-known files
|
||||
# Host has be set before proxy_pass
|
||||
# The header must be set so nginx on the other side routes it to the right place
|
||||
"^~ /.well-known/matrix/" = {
|
||||
extraConfig = ''
|
||||
proxy_set_header Host matrix.pvv.ntnu.no;
|
||||
proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -62,6 +62,33 @@ in {
|
|||
WorkingDirectory = galleryDir;
|
||||
User = config.services.pvv-nettsiden.user;
|
||||
Group = config.services.pvv-nettsiden.group;
|
||||
|
||||
AmbientCapabilities = [ "" ];
|
||||
CapabilityBoundingSet = [ "" ];
|
||||
DeviceAllow = [ "" ];
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
NoNewPrivileges = true; # disable for third party rotate scripts
|
||||
PrivateDevices = true;
|
||||
PrivateNetwork = true; # disable for mail delivery
|
||||
PrivateTmp = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true; # disable for userdir logs
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
ProtectSystem = "full";
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true; # disable for creating setgid directories
|
||||
SocketBindDeny = [ "any" ];
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,18 @@
|
|||
{ ... }:
|
||||
{
|
||||
services.nginx.virtualHosts."www.pvv.ntnu.no".locations = {
|
||||
"^~ /.well-known/" = {
|
||||
alias = (toString ./root) + "/";
|
||||
};
|
||||
|
||||
# Proxy the matrix well-known files
|
||||
# Host has be set before proxy_pass
|
||||
# The header must be set so nginx on the other side routes it to the right place
|
||||
"^~ /.well-known/matrix/" = {
|
||||
extraConfig = ''
|
||||
proxy_set_header Host matrix.pvv.ntnu.no;
|
||||
proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
<?xml version="1.0"?>
|
||||
<clientConfig version="1.1">
|
||||
<emailProvider id="pvv.ntnu.no">
|
||||
<domain>pvv.ntnu.no</domain>
|
||||
<domain>pvv.org</domain>
|
||||
|
||||
<displayName>Programvareverkstedet</displayName>
|
||||
|
||||
<incomingServer type="imap">
|
||||
<hostname>imap.pvv.ntnu.no</hostname>
|
||||
<port>993</port>
|
||||
<socketType>SSL</socketType>
|
||||
<username>%EMAILLOCALPART%</username>
|
||||
<authentication>password-cleartext</authentication>
|
||||
</incomingServer>
|
||||
|
||||
<outgoingServer type="smtp">
|
||||
<hostname>smtp.pvv.ntnu.no</hostname>
|
||||
<port>587</port>
|
||||
<socketType>STARTTLS</socketType>
|
||||
<username>%EMAILLOCALPART%</username>
|
||||
<authentication>password-cleartext</authentication>
|
||||
<useGlobalPreferredServer>true</useGlobalPreferredServer>
|
||||
</outgoingServer>
|
||||
|
||||
<documentation url="https://www.pvv.ntnu.no/pvv/Drift/Mail/IMAP_POP3">
|
||||
<descr lang="en">Setup programvareverkstedet email user with IMAP or POP3</descr>
|
||||
<descr lang="nb">Sett opp programvareverkstedet email bruker med IMAP eller POP3</descr>
|
||||
</documentation>
|
||||
</emailProvider>
|
||||
</clientConfig>
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
Contact: mailto:drift@pvv.ntnu.no
|
||||
Contact: mailto:cert@pvv.ntnu.no
|
||||
# drift@pvv.ntnu.no is read by more people and have a quicker reaction time,
|
||||
# but cert@pvv.ntnu.no can be used for more severe issues.
|
||||
|
||||
Preferred-Languages: no, en
|
||||
|
||||
Expires: 2032-12-31T23:59:59.000Z
|
||||
# This file was last updated 2024-09-14.
|
||||
|
||||
# You can find a wikipage for our security policies at:
|
||||
# https://wiki.pvv.ntnu.no/wiki/CERT
|
||||
|
|
@ -1,10 +1,10 @@
|
|||
{ pkgs, values, ... }:
|
||||
{ fp, pkgs, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
|
||||
../../base
|
||||
../../misc/metrics-exporters.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
./services/nginx
|
||||
|
||||
./services/mysql.nix
|
||||
|
|
@ -15,7 +15,7 @@
|
|||
./services/matrix
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = ../../secrets/bicep/bicep.yaml;
|
||||
sops.defaultSopsFile = fp /secrets/bicep/bicep.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
|
|
|||
|
|
@ -1,16 +1,16 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
{ config, fp, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.pvv-calendar-bot;
|
||||
in {
|
||||
sops.secrets = {
|
||||
"calendar-bot/matrix_token" = {
|
||||
sopsFile = ../../../secrets/bicep/bicep.yaml;
|
||||
sopsFile = fp /secrets/bicep/bicep.yaml;
|
||||
key = "calendar-bot/matrix_token";
|
||||
owner = cfg.user;
|
||||
group = cfg.group;
|
||||
};
|
||||
"calendar-bot/mysql_password" = {
|
||||
sopsFile = ../../../secrets/bicep/bicep.yaml;
|
||||
sopsFile = fp /secrets/bicep/bicep.yaml;
|
||||
key = "calendar-bot/mysql_password";
|
||||
owner = cfg.user;
|
||||
group = cfg.group;
|
||||
|
|
|
|||
|
|
@ -1,14 +1,14 @@
|
|||
{ config, lib, pkgs, secrets, values, ... }:
|
||||
{ config, lib, fp, pkgs, secrets, values, ... }:
|
||||
|
||||
{
|
||||
sops.secrets."matrix/synapse/turnconfig" = {
|
||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "synapse/turnconfig";
|
||||
owner = config.users.users.matrix-synapse.name;
|
||||
group = config.users.users.matrix-synapse.group;
|
||||
};
|
||||
sops.secrets."matrix/coturn/static-auth-secret" = {
|
||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "coturn/static-auth-secret";
|
||||
owner = config.users.users.turnserver.name;
|
||||
group = config.users.users.turnserver.group;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, lib, ... }:
|
||||
{ config, lib, fp, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.mx-puppet-discord;
|
||||
|
|
@ -6,15 +6,42 @@ in
|
|||
{
|
||||
users.groups.keys-matrix-registrations = { };
|
||||
|
||||
sops.secrets."matrix/registrations/mx-puppet-discord" = {
|
||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||
key = "registrations/mx-puppet-discord";
|
||||
sops.secrets."matrix/discord/as_token" = {
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "discord/as_token";
|
||||
};
|
||||
sops.secrets."matrix/discord/hs_token" = {
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "discord/hs_token";
|
||||
};
|
||||
|
||||
sops.templates."discord-registration.yaml" = {
|
||||
owner = config.users.users.matrix-synapse.name;
|
||||
group = config.users.groups.keys-matrix-registrations.name;
|
||||
content = ''
|
||||
as_token: "${config.sops.placeholder."matrix/discord/as_token"}"
|
||||
hs_token: "${config.sops.placeholder."matrix/discord/hs_token"}"
|
||||
id: discord-puppet
|
||||
namespaces:
|
||||
users:
|
||||
- exclusive: true
|
||||
regex: '@_discordpuppet_.*'
|
||||
rooms: []
|
||||
aliases:
|
||||
- exclusive: true
|
||||
regex: '#_discordpuppet_.*'
|
||||
protocols: []
|
||||
rate_limited: false
|
||||
sender_localpart: _discordpuppet_bot
|
||||
url: 'http://localhost:8434'
|
||||
de.sorunome.msc2409.push_ephemeral: true
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.services.mx-puppet-discord = {
|
||||
serviceConfig.SupplementaryGroups = [ config.users.groups.keys-matrix-registrations.name ];
|
||||
serviceConfig.SupplementaryGroups = [
|
||||
config.users.groups.keys-matrix-registrations.name
|
||||
];
|
||||
};
|
||||
|
||||
|
||||
|
|
@ -29,11 +56,16 @@ in
|
|||
relay.whitelist = [ ".*" ];
|
||||
selfService.whitelist = [ "@danio:pvv\\.ntnu\\.no" "@dandellion:dodsorf\\.as" ];
|
||||
};
|
||||
services.mx-puppet-discord.serviceDependencies = [ "matrix-synapse.target" "nginx.service" ];
|
||||
services.mx-puppet-discord.serviceDependencies = [
|
||||
"matrix-synapse.target"
|
||||
"nginx.service"
|
||||
];
|
||||
|
||||
|
||||
services.matrix-synapse-next.settings = {
|
||||
app_service_config_files = [ config.sops.secrets."matrix/registrations/mx-puppet-discord".path ];
|
||||
app_service_config_files = [
|
||||
config.sops.templates."discord-registration.yaml".path
|
||||
];
|
||||
use_appservice_legacy_authorization = true;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, lib, unstablePkgs, inputs, ... }:
|
||||
{ config, lib, fp, unstablePkgs, inputs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.matrix-hookshot;
|
||||
|
|
@ -10,21 +10,52 @@ in
|
|||
./module.nix
|
||||
];
|
||||
|
||||
sops.secrets."matrix/registrations/matrix-hookshot" = {
|
||||
sopsFile = ../../../../../secrets/bicep/matrix.yaml;
|
||||
key = "registrations/matrix-hookshot";
|
||||
sops.secrets."matrix/hookshot/as_token" = {
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "hookshot/as_token";
|
||||
};
|
||||
sops.secrets."matrix/hookshot/hs_token" = {
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "hookshot/hs_token";
|
||||
};
|
||||
|
||||
sops.templates."hookshot-registration.yaml" = {
|
||||
owner = config.users.users.matrix-synapse.name;
|
||||
group = config.users.groups.keys-matrix-registrations.name;
|
||||
content = ''
|
||||
id: matrix-hookshot
|
||||
as_token: "${config.sops.placeholder."matrix/hookshot/as_token"}"
|
||||
hs_token: "${config.sops.placeholder."matrix/hookshot/hs_token"}"
|
||||
namespaces:
|
||||
rooms: []
|
||||
users:
|
||||
- regex: "@_webhooks_.*:pvv.ntnu.no"
|
||||
exclusive: true
|
||||
- regex: "@bot_feeds:pvv.ntnu.no"
|
||||
exclusive: true
|
||||
aliases: []
|
||||
|
||||
sender_localpart: hookshot
|
||||
url: "http://${cfg.settings.bridge.bindAddress}:${toString cfg.settings.bridge.port}"
|
||||
rate_limited: false
|
||||
|
||||
# If enabling encryption
|
||||
de.sorunome.msc2409.push_ephemeral: true
|
||||
push_ephemeral: true
|
||||
org.matrix.msc3202: true
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.services.matrix-hookshot = {
|
||||
serviceConfig.SupplementaryGroups = [ config.users.groups.keys-matrix-registrations.name ];
|
||||
serviceConfig.SupplementaryGroups = [
|
||||
config.users.groups.keys-matrix-registrations.name
|
||||
];
|
||||
};
|
||||
|
||||
services.matrix-hookshot = {
|
||||
enable = true;
|
||||
package = unstablePkgs.matrix-hookshot;
|
||||
registrationFile = config.sops.secrets."matrix/registrations/matrix-hookshot".path;
|
||||
registrationFile = config.sops.templates."hookshot-registration.yaml".path;
|
||||
settings = {
|
||||
bridge = {
|
||||
bindAddress = "127.0.0.1";
|
||||
|
|
@ -88,10 +119,15 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
services.matrix-hookshot.serviceDependencies = [ "matrix-synapse.target" "nginx.service" ];
|
||||
services.matrix-hookshot.serviceDependencies = [
|
||||
"matrix-synapse.target"
|
||||
"nginx.service"
|
||||
];
|
||||
|
||||
services.matrix-synapse-next.settings = {
|
||||
app_service_config_files = [ config.sops.secrets."matrix/registrations/matrix-hookshot".path ];
|
||||
app_service_config_files = [
|
||||
config.sops.templates."hookshot-registration.yaml".path
|
||||
];
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
|
||||
|
|
|
|||
|
|
@ -1,8 +1,8 @@
|
|||
{ config, lib, ... }:
|
||||
{ config, lib, fp, ... }:
|
||||
|
||||
{
|
||||
sops.secrets."matrix/mjolnir/access_token" = {
|
||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "mjolnir/access_token";
|
||||
owner = config.users.users.mjolnir.name;
|
||||
group = config.users.users.mjolnir.group;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, lib, pkgs, values, inputs, ... }:
|
||||
{ config, lib, fp, pkgs, values, inputs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.matrix-synapse-next;
|
||||
|
|
@ -10,13 +10,13 @@ let
|
|||
in {
|
||||
sops.secrets."matrix/synapse/signing_key" = {
|
||||
key = "synapse/signing_key";
|
||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
owner = config.users.users.matrix-synapse.name;
|
||||
group = config.users.users.matrix-synapse.group;
|
||||
};
|
||||
|
||||
sops.secrets."matrix/synapse/user_registration" = {
|
||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "synapse/signing_key";
|
||||
owner = config.users.users.matrix-synapse.name;
|
||||
group = config.users.users.matrix-synapse.group;
|
||||
|
|
|
|||
|
|
@ -1,16 +1,16 @@
|
|||
{ config, pkgs, values, ... }:
|
||||
{ config, fp, pkgs, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
../../base
|
||||
../../misc/metrics-exporters.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
./disks.nix
|
||||
|
||||
../../misc/builder.nix
|
||||
(fp /misc/builder.nix)
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = ../../secrets/bob/bob.yaml;
|
||||
sops.defaultSopsFile = fp /secrets/bob/bob.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
{ config, pkgs, values, ... }:
|
||||
{ config, fp, pkgs, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
../../base
|
||||
../../misc/metrics-exporters.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
|
||||
./services/grzegorz.nix
|
||||
];
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, ... }:
|
||||
{ config, fp, ... }:
|
||||
{
|
||||
imports = [ ../../../modules/grzegorz.nix ];
|
||||
imports = [ (fp /modules/grzegorz.nix) ];
|
||||
|
||||
services.nginx.virtualHosts."${config.networking.fqdn}" = {
|
||||
serverAliases = [
|
||||
|
|
|
|||
|
|
@ -1,12 +1,12 @@
|
|||
{ config, pkgs, values, ... }:
|
||||
{ config, fp, pkgs, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
../../base
|
||||
../../misc/metrics-exporters.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
|
||||
../../modules/grzegorz.nix
|
||||
(fp /modules/grzegorz.nix)
|
||||
];
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
|
|
|
|||
|
|
@ -1,16 +1,16 @@
|
|||
{ config, pkgs, lib, values, ... }:
|
||||
{ config, fp, pkgs, lib, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
../../base
|
||||
../../misc/metrics-exporters.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
|
||||
./services/monitoring
|
||||
./services/nginx
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = ../../secrets/ildkule/ildkule.yaml;
|
||||
sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
|
|
|||
|
|
@ -3,7 +3,14 @@
|
|||
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
|
||||
boot.initrd.kernelModules = [ "nvme" ];
|
||||
fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; };
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/e35eb4ce-aac3-4f91-8383-6e7cd8bbf942";
|
||||
fsType = "ext4";
|
||||
};
|
||||
fileSystems."/data" = {
|
||||
device = "/dev/disk/by-uuid/0a4c1234-02d3-4b53-aeca-d95c4c8d534b";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@
|
|||
|
||||
let
|
||||
cfg = config.services.loki;
|
||||
stateDir = "/data/monitoring/loki";
|
||||
in {
|
||||
services.loki = {
|
||||
enable = true;
|
||||
|
|
@ -16,7 +17,7 @@ in {
|
|||
ingester = {
|
||||
wal = {
|
||||
enabled = true;
|
||||
dir = "/var/lib/loki/wal";
|
||||
dir = "${stateDir}/wal";
|
||||
};
|
||||
lifecycler = {
|
||||
address = "127.0.0.1";
|
||||
|
|
@ -48,12 +49,12 @@ in {
|
|||
|
||||
storage_config = {
|
||||
boltdb_shipper = {
|
||||
active_index_directory = "/var/lib/loki/boltdb-shipper-index";
|
||||
cache_location = "/var/lib/loki/boltdb-shipper-cache";
|
||||
active_index_directory = "${stateDir}/boltdb-shipper-index";
|
||||
cache_location = "${stateDir}/boltdb-shipper-cache";
|
||||
cache_ttl = "24h";
|
||||
};
|
||||
filesystem = {
|
||||
directory = "/var/lib/loki/chunks";
|
||||
directory = "${stateDir}/chunks";
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -64,14 +65,14 @@ in {
|
|||
};
|
||||
|
||||
compactor = {
|
||||
working_directory = "/var/lib/loki/compactor";
|
||||
working_directory = "${stateDir}/compactor";
|
||||
};
|
||||
|
||||
# ruler = {
|
||||
# storage = {
|
||||
# type = "local";
|
||||
# local = {
|
||||
# directory = "/var/lib/loki/rules";
|
||||
# directory = "${stateDir}/rules";
|
||||
# };
|
||||
# };
|
||||
# rule_path = "/etc/loki/rules";
|
||||
|
|
|
|||
|
|
@ -1,4 +1,6 @@
|
|||
{ config, ... }: {
|
||||
{ config, ... }: let
|
||||
stateDir = "/data/monitoring/prometheus";
|
||||
in {
|
||||
imports = [
|
||||
./gitea.nix
|
||||
./matrix-synapse.nix
|
||||
|
|
@ -10,9 +12,15 @@
|
|||
|
||||
services.prometheus = {
|
||||
enable = true;
|
||||
|
||||
listenAddress = "127.0.0.1";
|
||||
port = 9001;
|
||||
|
||||
ruleFiles = [ rules/synapse-v2.rules ];
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/prometheus2" = {
|
||||
device = stateDir;
|
||||
options = [ "bind" ];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@
|
|||
let
|
||||
cfg = config.services.uptime-kuma;
|
||||
domain = "status.pvv.ntnu.no";
|
||||
stateDir = "/data/monitoring/uptime-kuma";
|
||||
in {
|
||||
services.uptime-kuma = {
|
||||
enable = true;
|
||||
|
|
@ -17,4 +18,9 @@ in {
|
|||
kTLS = true;
|
||||
locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/uptime-kuma" = {
|
||||
device = stateDir;
|
||||
options = [ "bind" ];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,13 +1,13 @@
|
|||
{ config, pkgs, values, ... }:
|
||||
{ config, fp, pkgs, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
../../base
|
||||
../../misc/metrics-exporters.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = ../../secrets/shark/shark.yaml;
|
||||
sops.defaultSopsFile = fp /secrets/shark/shark.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
|
|
|||
|
|
@ -1,31 +1,26 @@
|
|||
{config, lib, pkgs, ...}:
|
||||
let
|
||||
grg = config.services.grzegorz;
|
||||
grg = config.services.greg-ng;
|
||||
grgw = config.services.grzegorz-webui;
|
||||
in {
|
||||
services.pipewire.enable = true;
|
||||
services.pipewire.alsa.enable = true;
|
||||
services.pipewire.alsa.support32Bit = true;
|
||||
services.pipewire.pulse.enable = true;
|
||||
|
||||
users.users.pvv = {
|
||||
isNormalUser = true;
|
||||
description = "pvv";
|
||||
services.greg-ng = {
|
||||
enable = true;
|
||||
settings.host = "localhost";
|
||||
settings.port = 31337;
|
||||
enableSway = true;
|
||||
enablePipewire = true;
|
||||
};
|
||||
|
||||
services.grzegorz.enable = true;
|
||||
services.grzegorz.listenAddr = "localhost";
|
||||
services.grzegorz.listenPort = 31337;
|
||||
|
||||
services.grzegorz-webui.enable = true;
|
||||
services.grzegorz-webui.listenAddr = "localhost";
|
||||
services.grzegorz-webui.listenPort = 42069;
|
||||
services.grzegorz-webui.listenWebsocketPort = 42042;
|
||||
services.grzegorz-webui.hostName = "${config.networking.fqdn}";
|
||||
services.grzegorz-webui.apiBase = "http://${toString grg.listenAddr}:${toString grg.listenPort}/api";
|
||||
services.grzegorz-webui = {
|
||||
enable = true;
|
||||
listenAddr = "localhost";
|
||||
listenPort = 42069;
|
||||
listenWebsocketPort = 42042;
|
||||
hostName = "${config.networking.fqdn}";
|
||||
apiBase = "http://${grg.settings.host}:${toString grg.settings.port}/api";
|
||||
};
|
||||
|
||||
services.nginx.enable = true;
|
||||
|
||||
services.nginx.virtualHosts."${config.networking.fqdn}" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
|
|
@ -40,20 +35,19 @@ in {
|
|||
'';
|
||||
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenPort}";
|
||||
proxyPass = "http://${grgw.listenAddr}:${toString grgw.listenPort}";
|
||||
};
|
||||
# https://github.com/rawpython/remi/issues/216
|
||||
locations."/websocket" = {
|
||||
proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenWebsocketPort}";
|
||||
proxyPass = "http://${grgw.listenAddr}:${toString grgw.listenWebsocketPort}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
locations."/api" = {
|
||||
proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
|
||||
proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
|
||||
};
|
||||
locations."/docs" = {
|
||||
proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
|
||||
proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -5,6 +5,7 @@ gitea:
|
|||
database: ENC[AES256_GCM,data:UlS33IdCEyeSvT6ngpmnkBWHuSEqsB//DT+3b7C+UwbD8UXWJlsLf1X8/w==,iv:mPRW5ldyZaHP+y/0vC2JGSLZmlkhgmkvXPk4LazkSDs=,tag:gGk6Z/nbPvzE1zG+tJC8Sw==,type:str]
|
||||
email-password: ENC[AES256_GCM,data:KRwC+aL1aPvJuXt91Oq1ttATMnFTnuUy,iv:ats8TygB/2pORkaTZzPOLufZ9UmvVAKoRcWNvYF1z6w=,tag:Do0fA+4cZ3+l7JJyu8hjBg==,type:str]
|
||||
passwd-ssh-key: ENC[AES256_GCM,data:L0lF0wvpayss1NU9m3A45cH0bCMQzODTFVrq6EPd1JHx54wIcoaRBYLmxXKXASzBlCg9zlwXMUIk3OQcS3kdzMKL0iqcSL2iicAcKjFIHyrWLqXgwV5pRSP/tRPcVw8KW8gz0bh33EgESs5ReddZ3VZ0Cy1s2YupMRQvBXr89k1+Hv70OWB6P06hvxhv/zKcMGI1N/dWLroMgrQuT9imw4+/Q1RqwzTYeEU+eUn24AM9GjcBg4qf3OI+6g0nXUat/upIYE28iF5J3lbUSmDSmirBLc8xgHLdOyyJPTObWYWYxlSL78T7IqiMm9lI3rtBlpJDDcn/YxZpVqN5bg2154GISNK+uR0TVSLdJ+drdGHIfIX3G78XSxf2L9rbJyRn8MQlgStfdBIQicLavQKVMrmj+XQfvEMez23WbPLjH4oViBQFI+GrOHOGy/f16cz8Sn4n+69OcsOeTxs3tKYdfq6r1XLYSJ/fe/zvxBpaZiyGXljsuyEdIyBL2A8D6uSXe3Nd3/DAdBtceFfIdN1olCdutixzVWgxaJnrel161z5A/4w=,iv:Uy46yY3jFYSvpxrgCHxRMUksnWfhf5DViLMvCXVMMl4=,tag:wFEJ5+icFrOKkc56gY0A5g==,type:str]
|
||||
gpg-signing-key: ENC[AES256_GCM,data:y/g1rpsEgiGEJ9BGii6te166ABpg1jgsyYMT1Ji5njLbT8/juBBMc7BFEM5BcIxKpQGijymsB+Htl8CZAN4Bl3FHSRyrnXGuMCnveJfw1qTVjMa6soriHv7EdTDFPCp3TYMbs1OgY/bhGJIvp8e4hCVd4F3x8eAlFmiwHhkxr62qQNHjH7SRNIyUNibf/TTttOeEcercxOy7FeUE99D+CWG4pnJNEYyRHDdddalgpSJyZIJvPpXoKmeCDk3futnxiZ15Vr7bDS5u4dqnE+no7DKoZ5fvk38f/77JH3w/Qom7NCYSG6L+unJ3r3RKuuGMRDjdz09TPZ4APpmrlyOElfGMmm134g6mdhgXmwNCo65Z7VOd1OKFA/uyZm2b7XsT3tCgRalE8gBa0R3MBMi3JK+5KUdS6ZUvYXDt8D8C68ldM3K9E7lyeeHn775rV6L4JIXcj/NL1O23sXtjeVuUPQmsUesgYlllRaiTSTfY7K+yOIG3wqqCuCDSAeILQICkvod4iw4xdVMQzd8eQtbD6bCjOzHwvBcu+rOSN6ti+xOQ7bJ9+6xhCgJJsiADkp2q09cUu8mDbUh+YJxfu+oZhPomOJVDMSqfS4qNXcVM9mbak/L9KPR4b83GqTpmXHnDMlGe4BHGXrkIUKPsBQ5TmdckXbpRDBQFrnjVvFT+Gfx3xwHxWc9fbxcFID2wp69EzQrGC77bDPCFxBT5vAVwffGYUezPQEo25bKRpCWxTFTpiIQfACrwzZc/O9cmwDgrYN7bTZyrrp8cbyBtllZGYmXxLDkDOzIqzpLG3b0yJC2jSnw0f1DkU6M2mD/j9FRTVW1MVymyLPiZQ7T9QyZ3MekHEEY1QqmyiJMIOekSzC5+3Us6Nl32MeBrIry6NuV8ewIQF5bcZEHtSmZ0k/wBtK0fpFHUuc/vETFuRUiQw/InhN5W8iH78vFvflxBfg61Qp7PzEx0k0axwEc6VAKbEg/uFNL+fhUKKt7sYiEBmwg2Vsj3pyZgdmjPZEsOQ86+psaxv+2feH94wog47jDHFRrc4iRC5w7kZ6UJXHfZt9lkBbwl4qNwiOLlPnUUcR+CpTBpPoKD9ulidQGfcYY49+iE+PM5dAI2CtisKpLQiwmrvjOzB1a/rC9QnH679frgH5Ebb57WRL4uSAVNRdIvIGzAF5MNwQOu+cxKoiW6ZmuNJSb547XUB1UO,iv:aKzrgAV30sLfPEpgdQ26ZzdM3+gYtoSpZ9mNyqCqf/M=,tag:vjywN4qxh2zsCE3RPG6Yrw==,type:str]
|
||||
ssh-known-hosts: ENC[AES256_GCM,data:zlRLoelQeumMxGqPmgMTB69X1RVWXIs2jWwc67lk0wrdNOHUs5UzV5TUA1JnQ43RslBU92+js7DkyvE5enGzw7zZE5F1ZYdGv/eCgvkTMC9BoLfzHzP6OzayPLYEt3xJ5PRocN8JUAD55cuu4LgsuebuydHPi2oWOfpbSUBKSeCh6dvk5Pp1XRDprPS5SzGLW8Xjq98QlzmfGv50meI9CDJZVF9Wq/72gkyfgtb3YVdr,iv:AF06TBitHegfWk6w07CdkHklh4ripQCmA45vswDQgss=,tag:zKh7WVXMJN2o9ZIwIkby3Q==,type:str]
|
||||
import-user-env: ENC[AES256_GCM,data:wArFwTd0ZoB4VXHPpichfnmykxGxN8y2EQsMgOPHv7zsm6A+m2rG9BWDGskQPr5Ns9o=,iv:gPUzYFSNoALJb1N0dsbNlgHIb7+xG7E9ANpmVNZURQ0=,tag:JghfRy2OcDFWKS9zX1XJ9A==,type:str]
|
||||
runners:
|
||||
|
|
@ -97,8 +98,8 @@ sops:
|
|||
UHpLRkdQTnhkeGlWVG9VS1hkWktyckEKAdwnA9URLYZ50lMtXrU9Q09d0L3Zfsyr
|
||||
4UsvjjdnFtsXwEZ9ZzOQrpiN0Oz24s3csw5KckDni6kslaloJZsLGg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2024-10-12T21:56:27Z"
|
||||
mac: ENC[AES256_GCM,data:bZ1BbVC6D+B6SFze2ReeCUcQamK/O14zH3YxCjWBwMC++w3niIiEx4Bq7Ulci5yuMld0luVsfUzHoqFN/+zvZbV2rGVk8lVRiTrpFoSZ78aUUgeHG9ROLXsR7T7rVhLWbl86y1G5LcKws7G55V0wAh6f58WjYYzwR8fnBmfW1Ko=,iv:7xtMdtXQB9uZirE/CkUSmeu0qnG++R7DUR7zn/Bo0lM=,tag:DH/BJPpAp//quDqKNXyHcg==,type:str]
|
||||
lastmodified: "2024-11-24T02:02:00Z"
|
||||
mac: ENC[AES256_GCM,data:hTye1yv7J/jEjLXtIyFPJZFuY3wol2tX1kZi7JtwTa6zs/JTg7piPL76/CkgWjVxGdv6DpSdlCt+AjIMQarbBpyKc/ux83zHrgI2BUZfYTtjwKLfoafsRjsjoz17ZRE55ozbjb6UHCCHLIJXUmHop35AeGwNcexx3UH267lpPZs=,iv:GhU0u7D9Dg/PqM4gEm7j9pPlCPGTxgWDMv0dNxr9HMk=,tag:fZHfgJdpKtT2mNaeOU7agg==,type:str]
|
||||
pgp:
|
||||
- created_at: "2024-08-04T00:03:28Z"
|
||||
enc: |-
|
||||
|
|
|
|||
|
|
@ -6,9 +6,12 @@ coturn:
|
|||
static-auth-secret: ENC[AES256_GCM,data:y5cG/LyrorkDH+8YrgcV7DY=,iv:ca90q2J3+NOy51mUBy4TMKfYMgWL4hxWDdsKIuxRBgU=,tag:hpFCns1lpi07paHyGB7tGQ==,type:str]
|
||||
mjolnir:
|
||||
access_token: ENC[AES256_GCM,data:ERFqZjK7MRD0xWt91FNCIxP1YC6Qj54QgnckHlCTtcQVLWaM1h2h9lHS+K8=,iv:1d7vmFkXAPcsmumzlmOT31amdrKLWtL5sJiS8G9g+LE=,tag:2l0vWzJ6P12ofuBdf5CCWw==,type:str]
|
||||
registrations:
|
||||
mx-puppet-discord: ENC[AES256_GCM,data:FleyXxgOmc05nTP6M2DBJlacufN3p/05eZm4kB8+K4ci0k24o3zli988wlM/kyeZmxu4pgQlJ3lNLte4uip2hBXHWG5t5Ldzmr7bNCUD+r7nM+I1lfNkrDROPZ54bHysmn9O5CHpEa16rSo6RJgncIPqsLJxTwjC7qZlkOpzqvMhkq/MHCVOpvg0M/6AUR+AlSZoggujBMoXLznQNQapN13foEsbuo/QxjszM/ObGmhYMVyaS+TDBXzQLA8Yuj50Q/gZCIINWZ4G2qmgsGxxNR4I+usUQml/jxCtIXS4zn/ettXfL9G4Fdm2F9u1v11DehtTGa5xoxDq94M9rIxOqeJpvgEQEyyKAyFUIrlINfGl7tAj4Zu7+9Z8JTRAnppjM1q8iInwn/Z2L9KgB0YFi/Go1whgXly+TH6hpreo7m5klXV/ff/aV3ghOgFCGA8nBrZFqE8Uw268q9tV1s1dxCb6TbpGf19V5c9MD6BsCIVeoq+j9I/I8iZpzg2Reb4IlHhMDwbwsL2w2ks30wiZ9XO/CFrXDY4uBlI=,iv:3vvkGvldS8Raibg6tzlV8VY1O9NCLxSuNX/lwi1QgiA=,tag:D/noIsE3xlOiYM6Pk+cc8Q==,type:str]
|
||||
matrix-hookshot: ENC[AES256_GCM,data:fBt9h6gRkEc7QLpeIJhOpizZwA9By89PjgEKNCOqrdnfbWfBk3ueol2W4DU1vcsjNpOpTsvwAm5KmoqhBIEpjGaycwtt9c399/dJGP6YQC3puk3c4Psz2C+SZJgk4erJ8GOeiUT7kjUkxAOgU+Hl+TteWSYylgd7PGVElJa0oXIbaxkpHZXuk42VlZl/bny4Fw3ckW19+2iuPbZtflmPrGNvGHuCSc6IwQC665/HmPJzENruLcqirICqgy7l9ZnkbrVqVabQTcLqa8GVM7zcpXzsoAMOuRdM3rvEPyaruPcBbemvlQnM1p/2NEnjDwbRKaZr1FtDpBnuEkQwHf1AQyOKZLJLEdqqDRiYrH27/Ps+voMQjZeB+IcPqbBBcdrF0DpFclWOKbNYWci2qW2Zpni242nJM4vVKQPfqi+UJSqhDjs1czDN2Z2stuyt+N1Nv3ykmfjSJz2/HeqYHTti6kkbxfcB2rDdwYWYNlrvTTsvzOewvhY8t0JImBHXiJtp2Zs/ej6p63cuto9RiU55JifJrQx8Fq0BEHeAzcmT39lHzXd/EQoCJqStz2/lnLMfzff5zlRkl4FgSaBoxoWs6DjLztysC/ibwcn92HI8pHRUc41jLslQLT//dV5QBOyW7F2JyCe/A4J5VEVphn3xLqLC/1xH0pwNaevWxR5hqPzm9XC9zn4UV3OMzVj76xDxywh3QaC3B7ZdHlOoyKNXeL5UDhmDjXbGyrxP1HdOAfITpafS9tbfCYROp31j0Q32PC5fUvEjbVYMq5do17/+MEfVdk4p695N3cqLnyoinh0u7KZZw7Im80mk0+zJrChy6D6dVAEZd/AQFgvcY2q3cbOWA/EuniCZrVFAp9u/mljPdeO3MZiJSc7MyElo2CD0YllZeE+KYoHQrIgWJZ6TiItVk3CyLGsYfqNDcJ+o6iicqAdsCiF9IeXO/BfscN2o5sbcvmAShdxCqCYYVtb3Fp6or7bIUf16fq1jkz4XkGwEj+VT9JTXjRbavx5O74VpnyIuTzI7oXYIU4ZUVI5Fkw==,iv:2ffGONfuT9GUVxEStQoZftYUFQc/HcnSLNpZG1t1oCM=,tag:idETgOr/XgfpueTt3gPLHQ==,type:str]
|
||||
discord:
|
||||
as_token: ENC[AES256_GCM,data:cnPZjBbODZUA1p0kLNeWpKh1oGkDPxDw/g7163XnoRCIgpqk,iv:Uu4L36uDPMBgzdXE2Lt9U0qrBSl3Xuufh1313BD8B/U=,tag:nTm6s7IGd4vNzZ95mfxDpA==,type:str]
|
||||
hs_token: ENC[AES256_GCM,data:UzcaNsJtJPKvFT4gQDNfat0nmyJzmQ6OcSI73pANibzOVrWl,iv:ujgRM2jb1rbeloPB4UPLBEvQ7uue4a+bHiqsZAHIqtk=,tag:uIfuaTWSTeVvpQx5o28HPA==,type:str]
|
||||
hookshot:
|
||||
as_token: ENC[AES256_GCM,data:L4vEw5r4RhcgritOeDTLHN5E/dM=,iv:pC8BLzxf6NaVAGsotoq6chOceBVdMLvrsQn1LGw9H9w=,tag:SI3CDFHAvgQZEvf/oms3EA==,type:str]
|
||||
hs_token: ENC[AES256_GCM,data:2ufSJfYzzAB5IO+edwKSra5d/+M=,iv:cmTycGzNL+IeRRKZGbkhTtiksYTtbxED0k0B5haFw7k=,tag:FmWe5sGi9rlapUeAE6lKvg==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
|
|
@ -69,8 +72,8 @@ sops:
|
|||
WEh5NFN6SFF1TlltdWFWTGw4MHRHUkUKrKIvC87xjEmwxPQhH8dN+ZuaJTCgPY28
|
||||
pR62KxmoKFICLTHPpYP3euiAx5M9BWvgvCnA/US/5klpk8MtlreNFA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2024-10-13T05:04:30Z"
|
||||
mac: ENC[AES256_GCM,data:Qtw6ZPxUIp28fw1xFR72Utt+aZZXcXOOJO9lwCsZEsqMKPCtxwNw2NumB4aEBuv16dL14boy/FRtwq0mu/DyA6zgnOeeEzxlcxtFAkqK2A03ZMGEIGYTdB3sBDb2Rm7gnK7J9ypoxb0EP40x18lErk7Cn54B28DPlCkY/tj4B/0=,iv:MRXfroBOUCeWKknjDTfUNNHH91cCkf3vUFAAP+UIN7Y=,tag:awdtYAtmMP2Y72m8PlmgwA==,type:str]
|
||||
lastmodified: "2024-10-13T23:30:01Z"
|
||||
mac: ENC[AES256_GCM,data:vdsAZmg7gPqzeucBhLhPemtRVkcxRecIdB6PXZ4paU+Uv5UorBKcTZ3jseN2cLi6ot3ycTIm+UI6uhlCy87vAJVynVJhuJS+ICFRS2+DfoVyuttLjZQGC2sr3+dEBHxIH7sZJSo9PIzbIWw3qHrpOPAZj0//1pFyp/k15k3vidM=,iv:jWtV+WAPt08lgdrVvtXOl35rDB4QflkZWuGBW1+ESyw=,tag:YxSHncZZOAW5uDxXtb/krw==,type:str]
|
||||
pgp:
|
||||
- created_at: "2024-08-04T00:03:46Z"
|
||||
enc: |-
|
||||
|
|
|
|||
|
|
@ -0,0 +1,13 @@
|
|||
{pkgs, ...}:
|
||||
|
||||
{
|
||||
users.users.alfhj = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
shell = pkgs.zsh;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMCAYE0U3sFizm/NSbKCs0jEhZ1mpAWPcijFevejiFL1 alfhj"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
{ pkgs, ... }:
|
||||
{
|
||||
users.users.frero = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" "drift" "nix-builder-users" ];
|
||||
shell = pkgs.zsh;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII09JbtSUMurvmHpJ7TmUQctXpNVhjFYhoJ3+1ZITmMx"
|
||||
];
|
||||
};
|
||||
}
|
||||
Loading…
Reference in New Issue