Add function to make paths from flake root

No more ../../../../../../
Merge pull request 'Ildkule: Move monitoring state directories to data volume' (!88 ) from ildkule-data-volume into main
2024-11-17 00:08:02 +01:00 · 2024-11-10 02:30:11 +01:00 · 2024-11-09 22:22:09 +01:00 · 2024-11-09 21:42:44 +01:00 · 2024-11-09 19:43:07 +01:00 · 2024-11-09 19:40:03 +01:00
36 changed files with 268 additions and 363 deletions
--- a/base/default.nix
+++ b/base/default.nix
@ -1,9 +1,9 @@
-{ pkgs, lib, ... }:
+{ pkgs, lib, fp, ... }:

 {
  imports = [
-    ../users
-    ../modules/snakeoil-certs.nix
+    (fp /users)
+    (fp /modules/snakeoil-certs.nix)

    ./networking.nix
    ./nix.nix
--- a/flake.lock
+++ b/flake.lock
@ -7,11 +7,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1728763831,
-        "narHash": "sha256-KOp33tls7jRAhcmu77aVxKpSMou8QgK0BC+Y3sYLuGo=",
+        "lastModified": 1731746438,
+        "narHash": "sha256-f3SSp1axoOk0NAI7oFdRzbxG2XPBSIXC+/DaAXnvS1A=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "b6215392ec3bd05e9ebfbb2f7945c414096fce8f",
+        "rev": "cb64993826fa7a477490be6ccb38ba1fa1e18fa8",
        "type": "github"
      },
      "original": {
@ -20,64 +20,25 @@
        "type": "github"
      }
    },
-    "fix-python": {
+    "greg-ng": {
      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "grzegorz",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1725463969,
-        "narHash": "sha256-d3c1TAlIN1PtK+oQP1wO6XbDfmR4SUp/C/4s7G46ARo=",
-        "owner": "GuillaumeDesforges",
-        "repo": "fix-python",
-        "rev": "2926402234c3f99aa8e4608c51d9ffa73ea403c0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "GuillaumeDesforges",
-        "repo": "fix-python",
-        "type": "github"
-      }
-    },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1689068808,
-        "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
-        "type": "github"
-      },
-      "original": {
-        "id": "flake-utils",
-        "type": "indirect"
-      }
-    },
-    "grzegorz": {
-      "inputs": {
-        "fix-python": "fix-python",
        "nixpkgs": [
          "nixpkgs"
-        ]
+        ],
+        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1726861911,
-        "narHash": "sha256-pXPmVp4AgszzJXlLjj8r9NxoDvxoV4USGaiMwqCyb4M=",
-        "ref": "refs/heads/master",
-        "rev": "d10db19d7df5c5c2cd2dcb878376d5d681f6c2f2",
-        "revCount": 94,
+        "lastModified": 1730249639,
+        "narHash": "sha256-G3URSlqCcb+GIvGyki+HHrDM5ZanX/dP9BtppD/SdfI=",
+        "ref": "refs/heads/main",
+        "rev": "80e0447bcb79adad4f459ada5610f3eae987b4e3",
+        "revCount": 34,
        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/grzegorz.git"
+        "url": "https://git.pvv.ntnu.no/Projects/greg-ng.git"
      },
      "original": {
        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/grzegorz.git"
+        "url": "https://git.pvv.ntnu.no/Projects/greg-ng.git"
      }
    },
    "grzegorz-clients": {
@ -158,11 +119,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1728843132,
-        "narHash": "sha256-VWIF1sMD6MJZyB+x5z0ZpirQdH8Cqb3avboq1VfSjRg=",
+        "lastModified": 1731663789,
+        "narHash": "sha256-x07g4NcqGP6mQn6AISXJaks9sQYDjZmTMBlKIvajvyc=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "414e01b61f0015e49353a6104824b9385a430a5d",
+        "rev": "035d434d48f4375ac5d3a620954cf5fda7dd7c36",
        "type": "github"
      },
      "original": {
@ -174,11 +135,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1728156290,
-        "narHash": "sha256-uogSvuAp+1BYtdu6UWuObjHqSbBohpyARXDWqgI12Ss=",
+        "lastModified": 1730602179,
+        "narHash": "sha256-efgLzQAWSzJuCLiCaQUCDu4NudNlHdg2NzGLX5GYaEY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "17ae88b569bb15590549ff478bab6494dde4a907",
+        "rev": "3c2f1c4ca372622cb2f9de8016c9a0b1cbd0f37c",
        "type": "github"
      },
      "original": {
@ -190,11 +151,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1728805616,
-        "narHash": "sha256-CfPKX2yaHwTOpGqcul89N12zjRfZ8GOSxG24/Ao9BcQ=",
+        "lastModified": 1731745710,
+        "narHash": "sha256-SVeiClbgqL071JpAspOu0gCkPSAL51kSIRwo4C/pghA=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "73057677e8557925e999ac54196423fa34418c24",
+        "rev": "dfaa4cb76c2d450d8f396bb6b9f43cede3ade129",
        "type": "github"
      },
      "original": {
@ -247,7 +208,7 @@
    "root": {
      "inputs": {
        "disko": "disko",
-        "grzegorz": "grzegorz",
+        "greg-ng": "greg-ng",
        "grzegorz-clients": "grzegorz-clients",
        "matrix-next": "matrix-next",
        "minecraft-data": "minecraft-data",
@ -259,6 +220,27 @@
        "sops-nix": "sops-nix"
      }
    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "greg-ng",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1729391507,
+        "narHash": "sha256-as0I9xieJUHf7kiK2a9znDsVZQTFWhM1pLivII43Gi0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "784981a9feeba406de38c1c9a3decf966d853cca",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
    "sops-nix": {
      "inputs": {
        "nixpkgs": [
@ -267,11 +249,11 @@
        "nixpkgs-stable": "nixpkgs-stable"
      },
      "locked": {
-        "lastModified": 1728345710,
-        "narHash": "sha256-lpunY1+bf90ts+sA2/FgxVNIegPDKCpEoWwOPu4ITTQ=",
+        "lastModified": 1731748189,
+        "narHash": "sha256-Zd/Uukvpcu26M6YGhpbsgqm6LUSLz+Q8mDZ5LOEGdiE=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "06535d0e3d0201e6a8080dd32dbfde339b94f01b",
+        "rev": "d2bd7f433b28db6bc7ae03d5eca43564da0af054",
        "type": "github"
      },
      "original": {
@ -279,21 +261,6 @@
        "repo": "sops-nix",
        "type": "github"
      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@ -23,8 +23,8 @@
    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git";
    nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";

-    grzegorz.url = "git+https://git.pvv.ntnu.no/Projects/grzegorz.git";
-    grzegorz.inputs.nixpkgs.follows = "nixpkgs";
+    greg-ng.url = "git+https://git.pvv.ntnu.no/Projects/greg-ng.git";
+    greg-ng.inputs.nixpkgs.follows = "nixpkgs";
    grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Projects/grzegorz-clients.git";
    grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";

@ -59,6 +59,7 @@
          specialArgs = {
            inherit unstablePkgs inputs;
            values = import ./values.nix;
+            fp = path: ./${path};
          };

          modules = [
@ -79,11 +80,6 @@
      stableNixosConfig = nixosConfig nixpkgs;
      unstableNixosConfig = nixosConfig nixpkgs-unstable;
    in {
-      bakke = stableNixosConfig "bakke" {
-        modules = [
-          disko.nixosModules.disko
-        ];
-      };
      bicep = stableNixosConfig "bicep" {
        modules = [
          inputs.matrix-next.nixosModules.default
@ -121,14 +117,20 @@

      brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
        modules = [
-          inputs.grzegorz.nixosModules.grzegorz-kiosk
          inputs.grzegorz-clients.nixosModules.grzegorz-webui
+          inputs.greg-ng.nixosModules.default
+        ];
+        overlays = [
+          inputs.greg-ng.overlays.default
        ];
      };
      georg = stableNixosConfig "georg" {
        modules = [
-          inputs.grzegorz.nixosModules.grzegorz-kiosk
          inputs.grzegorz-clients.nixosModules.grzegorz-webui
+          inputs.greg-ng.nixosModules.default
+        ];
+        overlays = [
+          inputs.greg-ng.overlays.default
        ];
      };
    };
--- a/hosts/bakke/configuration.nix
+++ b/hosts/bakke/configuration.nix
@ -1,26 +0,0 @@
-{ config, pkgs, values, ... }:
-{
-  imports = [
-      ./hardware-configuration.nix
-      ../../base
-      ../../misc/metrics-exporters.nix
-      ./filesystems.nix
-    ];
-
-  sops.defaultSopsFile = ../../secrets/bakke/bakke.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
-  sops.age.generateKey = true;
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  networking.hostName = "bakke";
-  networking.hostId = "99609ffc";
-  systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
-    matchConfig.Name = "enp2s0";
-    address = with values.hosts.bakke; [ (ipv4 + "/25") (ipv6 + "/64") ];
-  };
-
-  system.stateVersion = "24.05";
-}
--- a/hosts/bakke/disks.nix
+++ b/hosts/bakke/disks.nix
@ -1,83 +0,0 @@
-{
-  # https://github.com/nix-community/disko/blob/master/example/boot-raid1.nix
-  # Note: Disko was used to create the initial md raid, but is no longer in active use on this host.
-  disko.devices = {
-    disk = {
-      one = {
-        type = "disk";
-        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E2EER6N6";
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "500M";
-              type = "EF00";
-              content = {
-                type = "mdraid";
-                name = "boot";
-              };
-            };
-            mdadm = {
-              size = "100%";
-              content = {
-                type = "mdraid";
-                name = "raid1";
-              };
-            };
-          };
-        };
-      };
-      two = {
-        type = "disk";
-        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E7LPLU71";
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "500M";
-              type = "EF00";
-              content = {
-                type = "mdraid";
-                name = "boot";
-              };
-            };
-            mdadm = {
-              size = "100%";
-              content = {
-                type = "mdraid";
-                name = "raid1";
-              };
-            };
-          };
-        };
-      };
-    };
-    mdadm = {
-      boot = {
-        type = "mdadm";
-        level = 1;
-        metadata = "1.0";
-        content = {
-          type = "filesystem";
-          format = "vfat";
-          mountpoint = "/boot";
-        };
-      };
-      raid1 = {
-        type = "mdadm";
-        level = 1;
-        content = {
-          type = "gpt";
-          partitions.primary = {
-            size = "100%";
-            content = {
-              type = "filesystem";
-              format = "ext4";
-              mountpoint = "/";
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/hosts/bakke/filesystems.nix
+++ b/hosts/bakke/filesystems.nix
@ -1,26 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  # Boot drives:
-  boot.swraid.enable = true;
-
-  # ZFS Data pool:
-  environment.systemPackages = with pkgs; [ zfs ];
-  boot = {
-    zfs = {
-      extraPools = [ "tank" ];
-      requestEncryptionCredentials = false;
-    };
-    supportedFilesystems = [ "zfs" ];
-    kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
-  };
-  services.zfs.autoScrub = {
-    enable = true;
-    interval = "Wed *-*-8..14 00:00:00";
-  };
-
-  # NFS Exports:
-  #TODO
-
-  # NFS Import mounts:
-  #TODO
-}
--- a/hosts/bakke/hardware-configuration.nix
+++ b/hosts/bakke/hardware-configuration.nix
@ -1,33 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/873e1891-d9f8-470f-9c57-e1b4c8b7bf0e";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E7LPLU71-part1";
-      fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
-    };
-
-  swapDevices = [ ];
-
-  networking.useDHCP = lib.mkDefault false;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}
--- a/hosts/bekkalokk/configuration.nix
+++ b/hosts/bekkalokk/configuration.nix
@ -1,10 +1,10 @@
-{ pkgs, values, ... }:
+{ fp, pkgs, values, ... }:
 {
  imports = [
    ./hardware-configuration.nix

-    ../../base
-    ../../misc/metrics-exporters.nix
+    (fp /base)
+    (fp /misc/metrics-exporters.nix)

    ./services/bluemap/default.nix
    ./services/gitea/default.nix
@ -16,9 +16,10 @@
    ./services/vaultwarden.nix
    ./services/webmail
    ./services/website
+    ./services/well-known
  ];

-  sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
+  sops.defaultSopsFile = fp /secrets/bekkalokk/bekkalokk.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
--- a/hosts/bekkalokk/services/gitea/default.nix
+++ b/hosts/bekkalokk/services/gitea/default.nix
@ -1,4 +1,4 @@
-{ config, values, pkgs, lib, ... }:
+{ config, values, fp, pkgs, lib, ... }:
 let
  cfg = config.services.gitea;
  domain = "git.pvv.ntnu.no";
@ -173,8 +173,8 @@ in {
    };

    script = let
-      logo-svg = ../../../../assets/logo_blue_regular.svg;
-      logo-png = ../../../../assets/logo_blue_regular.png;
+      logo-svg = fp /assets/logo_blue_regular.svg;
+      logo-png = fp /assets/logo_blue_regular.png;
      extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
        <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
        <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
--- a/hosts/bekkalokk/services/mediawiki/default.nix
+++ b/hosts/bekkalokk/services/mediawiki/default.nix
@ -1,4 +1,4 @@
-{ pkgs, lib, config, values, pkgs-unstable, ... }: let
+{ pkgs, lib, fp, config, values, pkgs-unstable, ... }: let
  cfg = config.services.mediawiki;

  # "mediawiki"
@ -210,8 +210,8 @@ in {
        '';
      };

-      "= /PNG/PVV-logo.svg".alias = ../../../../assets/logo_blue_regular.svg;
-      "= /PNG/PVV-logo.png".alias = ../../../../assets/logo_blue_regular.png;
+      "= /PNG/PVV-logo.svg".alias = fp /assets/logo_blue_regular.svg;
+      "= /PNG/PVV-logo.png".alias = fp /assets/logo_blue_regular.png;
      "= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
        buildInputs = with pkgs; [ imagemagick ];
      } ''
@ -219,7 +219,7 @@ in {
          -resize x64 \
          -gravity center \
          -crop 64x64+0+0 \
-          ${../../../../assets/logo_blue_regular.png} \
+          ${fp /assets/logo_blue_regular.png} \
          -flatten \
          -colors 256 \
          -background transparent \
--- a/hosts/bekkalokk/services/webmail/snappymail.nix
+++ b/hosts/bekkalokk/services/webmail/snappymail.nix
@ -1,8 +1,8 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, fp, pkgs, ... }:
 let
  cfg = config.services.snappymail;
 in {
-  imports = [ ../../../../modules/snappymail.nix ];
+  imports = [ (fp /modules/snappymail.nix) ];

  services.snappymail = {
    enable = true;
--- a/hosts/bekkalokk/services/website/default.nix
+++ b/hosts/bekkalokk/services/website/default.nix
@ -116,16 +116,6 @@ in {
      "/drift".return = "301 https://wiki.pvv.ntnu.no/wiki/Drift";
      "/diverse/abuse.php".return = "301 https://wiki.pvv.ntnu.no/wiki/CERT/Abuse";
      "/nerds/".return = "301 https://wiki.pvv.ntnu.no/wiki/Nerdepizza";
-
-      # Proxy the matrix well-known files
-      # Host has be set before proxy_pass
-      # The header must be set so nginx on the other side routes it to the right place
-      "^~ /.well-known/matrix/" = {
-        extraConfig = ''
-          proxy_set_header Host matrix.pvv.ntnu.no;
-          proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
-        '';
-      };
    };
  };
 }
--- a/hosts/bekkalokk/services/website/fetch-gallery.nix
+++ b/hosts/bekkalokk/services/website/fetch-gallery.nix
@ -62,6 +62,33 @@ in {
      WorkingDirectory = galleryDir;
      User = config.services.pvv-nettsiden.user;
      Group = config.services.pvv-nettsiden.group;
+
+      AmbientCapabilities = [ "" ];
+      CapabilityBoundingSet = [ "" ];
+      DeviceAllow = [ "" ];
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true; # disable for third party rotate scripts
+      PrivateDevices = true;
+      PrivateNetwork = true; # disable for mail delivery
+      PrivateTmp = true;
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true; # disable for userdir logs
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "full";
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true; # disable for creating setgid directories
+      SocketBindDeny = [ "any" ];
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+      ];
    };
  };
 }
--- a/hosts/bekkalokk/services/well-known/default.nix
+++ b/hosts/bekkalokk/services/well-known/default.nix
@ -0,0 +1,18 @@
+{ ... }:
+{
+  services.nginx.virtualHosts."www.pvv.ntnu.no".locations = {
+    "^~ /.well-known/" = {
+      alias = (toString ./root) + "/";
+    };
+
+    # Proxy the matrix well-known files
+    # Host has be set before proxy_pass
+    # The header must be set so nginx on the other side routes it to the right place
+    "^~ /.well-known/matrix/" = {
+      extraConfig = ''
+        proxy_set_header Host matrix.pvv.ntnu.no;
+        proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
+      '';
+    };
+  };
+}
--- a/hosts/bekkalokk/services/well-known/root/autoconfig/mail/config-v1.1.xml
+++ b/hosts/bekkalokk/services/well-known/root/autoconfig/mail/config-v1.1.xml
@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+<clientConfig version="1.1">
+  <emailProvider id="pvv.ntnu.no">
+    <domain>pvv.ntnu.no</domain>
+    <domain>pvv.org</domain>
+
+    <displayName>Programvareverkstedet</displayName>
+
+    <incomingServer type="imap">
+      <hostname>imap.pvv.ntnu.no</hostname>
+      <port>993</port>
+      <socketType>SSL</socketType>
+      <username>%EMAILLOCALPART%</username>
+      <authentication>password-cleartext</authentication>
+    </incomingServer>
+
+    <outgoingServer type="smtp">
+      <hostname>smtp.pvv.ntnu.no</hostname>
+      <port>587</port>
+      <socketType>STARTTLS</socketType>
+      <username>%EMAILLOCALPART%</username>
+      <authentication>password-cleartext</authentication>
+      <useGlobalPreferredServer>true</useGlobalPreferredServer>
+    </outgoingServer>
+
+    <documentation url="https://www.pvv.ntnu.no/pvv/Drift/Mail/IMAP_POP3">
+       <descr lang="en">Setup programvareverkstedet email user with IMAP or POP3</descr>
+       <descr lang="nb">Sett opp programvareverkstedet email bruker med IMAP eller POP3</descr>
+    </documentation>
+  </emailProvider>
+</clientConfig>
--- a/hosts/bekkalokk/services/well-known/root/security.txt
+++ b/hosts/bekkalokk/services/well-known/root/security.txt
@ -0,0 +1,12 @@
+Contact: mailto:drift@pvv.ntnu.no
+Contact: mailto:cert@pvv.ntnu.no
+# drift@pvv.ntnu.no is read by more people and have a quicker reaction time,
+# but cert@pvv.ntnu.no can be used for more severe issues.
+
+Preferred-Languages: no, en
+
+Expires: 2032-12-31T23:59:59.000Z
+# This file was last updated 2024-09-14.
+
+# You can find a wikipage for our security policies at:
+# https://wiki.pvv.ntnu.no/wiki/CERT
--- a/hosts/bicep/configuration.nix
+++ b/hosts/bicep/configuration.nix
@ -1,10 +1,10 @@
-{ pkgs, values, ... }:
+{ fp, pkgs, values, ... }:
 {
  imports = [
    ./hardware-configuration.nix

-    ../../base
-    ../../misc/metrics-exporters.nix
+    (fp /base)
+    (fp /misc/metrics-exporters.nix)
    ./services/nginx

    ./services/mysql.nix
@ -15,7 +15,7 @@
    ./services/matrix
  ];

-  sops.defaultSopsFile = ../../secrets/bicep/bicep.yaml;
+  sops.defaultSopsFile = fp /secrets/bicep/bicep.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
--- a/hosts/bicep/services/calendar-bot.nix
+++ b/hosts/bicep/services/calendar-bot.nix
@ -1,16 +1,16 @@
-{ config, lib, pkgs, ... }:
+{ config, fp, lib, pkgs, ... }:
 let
  cfg = config.services.pvv-calendar-bot;
 in {
  sops.secrets = {
    "calendar-bot/matrix_token" = {
-      sopsFile = ../../../secrets/bicep/bicep.yaml;
+      sopsFile = fp /secrets/bicep/bicep.yaml;
      key = "calendar-bot/matrix_token";
      owner = cfg.user;
      group = cfg.group;
    };
    "calendar-bot/mysql_password" = {
-      sopsFile = ../../../secrets/bicep/bicep.yaml;
+      sopsFile = fp /secrets/bicep/bicep.yaml;
      key = "calendar-bot/mysql_password";
      owner = cfg.user;
      group = cfg.group;
--- a/hosts/bicep/services/matrix/coturn.nix
+++ b/hosts/bicep/services/matrix/coturn.nix
@ -1,14 +1,14 @@
-{ config, lib, pkgs, secrets, values, ... }:
+{ config, lib, fp, pkgs, secrets, values, ... }:

 {
  sops.secrets."matrix/synapse/turnconfig" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "synapse/turnconfig";
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
  };
  sops.secrets."matrix/coturn/static-auth-secret" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "coturn/static-auth-secret";
    owner = config.users.users.turnserver.name;
    group = config.users.users.turnserver.group;
--- a/hosts/bicep/services/matrix/discord.nix
+++ b/hosts/bicep/services/matrix/discord.nix
@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, lib, fp, ... }:

 let
  cfg = config.services.mx-puppet-discord;
@ -7,11 +7,11 @@ in
  users.groups.keys-matrix-registrations = { };

  sops.secrets."matrix/discord/as_token" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "discord/as_token";
  };
  sops.secrets."matrix/discord/hs_token" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "discord/hs_token";
  };

--- a/hosts/bicep/services/matrix/hookshot/default.nix
+++ b/hosts/bicep/services/matrix/hookshot/default.nix
@ -1,4 +1,4 @@
-{ config, lib, unstablePkgs, inputs, ... }:
+{ config, lib, fp, unstablePkgs, inputs, ... }:

 let
  cfg = config.services.matrix-hookshot;
@ -11,11 +11,11 @@ in
  ];

  sops.secrets."matrix/hookshot/as_token" = {
-    sopsFile = ../../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "hookshot/as_token";
  };
  sops.secrets."matrix/hookshot/hs_token" = {
-    sopsFile = ../../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "hookshot/hs_token";
  };

--- a/hosts/bicep/services/matrix/mjolnir.nix
+++ b/hosts/bicep/services/matrix/mjolnir.nix
@ -1,8 +1,8 @@
-{ config, lib, ... }:
+{ config, lib, fp, ... }:

 {
  sops.secrets."matrix/mjolnir/access_token" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "mjolnir/access_token";
    owner = config.users.users.mjolnir.name;
    group = config.users.users.mjolnir.group;
--- a/hosts/bicep/services/matrix/synapse.nix
+++ b/hosts/bicep/services/matrix/synapse.nix
@ -1,4 +1,4 @@
-{ config, lib, pkgs, values, inputs, ... }:
+{ config, lib, fp, pkgs, values, inputs, ... }:

 let
  cfg = config.services.matrix-synapse-next;
@ -10,13 +10,13 @@ let
 in {
  sops.secrets."matrix/synapse/signing_key" = {
    key = "synapse/signing_key";
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
  };

  sops.secrets."matrix/synapse/user_registration" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "synapse/signing_key";
    owner = config.users.users.matrix-synapse.name;
    group = config.users.users.matrix-synapse.group;
--- a/hosts/bob/configuration.nix
+++ b/hosts/bob/configuration.nix
@ -1,16 +1,16 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      ../../base
-      ../../misc/metrics-exporters.nix
+      (fp /base)
+      (fp /misc/metrics-exporters.nix)
      ./disks.nix

-      ../../misc/builder.nix
+      (fp /misc/builder.nix)
    ];

-  sops.defaultSopsFile = ../../secrets/bob/bob.yaml;
+  sops.defaultSopsFile = fp /secrets/bob/bob.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
--- a/hosts/brzeczyszczykiewicz/configuration.nix
+++ b/hosts/brzeczyszczykiewicz/configuration.nix
@ -1,10 +1,10 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      ../../base
-      ../../misc/metrics-exporters.nix
+      (fp /base)
+      (fp /misc/metrics-exporters.nix)

      ./services/grzegorz.nix
    ];
--- a/hosts/brzeczyszczykiewicz/services/grzegorz.nix
+++ b/hosts/brzeczyszczykiewicz/services/grzegorz.nix
@ -1,6 +1,6 @@
-{ config, ... }:
+{ config, fp, ... }:
 {
-  imports = [ ../../../modules/grzegorz.nix ];
+  imports = [ (fp /modules/grzegorz.nix) ];

  services.nginx.virtualHosts."${config.networking.fqdn}" = {
    serverAliases = [
--- a/hosts/georg/configuration.nix
+++ b/hosts/georg/configuration.nix
@ -1,12 +1,12 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      ../../base
-      ../../misc/metrics-exporters.nix
+      (fp /base)
+      (fp /misc/metrics-exporters.nix)

-      ../../modules/grzegorz.nix
+      (fp /modules/grzegorz.nix)
    ];

  boot.loader.systemd-boot.enable = true;
--- a/hosts/ildkule/configuration.nix
+++ b/hosts/ildkule/configuration.nix
@ -1,16 +1,16 @@
-{ config, pkgs, lib, values, ... }:
+{ config, fp, pkgs, lib, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      ../../base
-      ../../misc/metrics-exporters.nix
+      (fp /base)
+      (fp /misc/metrics-exporters.nix)

      ./services/monitoring
      ./services/nginx
    ];

-  sops.defaultSopsFile = ../../secrets/ildkule/ildkule.yaml;
+  sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
--- a/hosts/ildkule/hardware-configuration.nix
+++ b/hosts/ildkule/hardware-configuration.nix
@ -3,7 +3,14 @@
  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
  boot.initrd.kernelModules = [ "nvme" ];
-  fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/e35eb4ce-aac3-4f91-8383-6e7cd8bbf942";
+    fsType = "ext4";
+  };
+  fileSystems."/data" = {
+    device = "/dev/disk/by-uuid/0a4c1234-02d3-4b53-aeca-d95c4c8d534b";
+    fsType = "ext4";
+  };

  networking.useDHCP = lib.mkDefault true;
 }
--- a/hosts/ildkule/services/monitoring/loki.nix
+++ b/hosts/ildkule/services/monitoring/loki.nix
@ -2,6 +2,7 @@

 let
  cfg = config.services.loki;
+  stateDir = "/data/monitoring/loki";
 in {
  services.loki = {
    enable = true;
@ -16,7 +17,7 @@ in {
      ingester = {
        wal = {
          enabled = true;
-          dir = "/var/lib/loki/wal";
+          dir = "${stateDir}/wal";
        };
        lifecycler = {
          address = "127.0.0.1";
@ -48,12 +49,12 @@ in {

      storage_config = {
        boltdb_shipper = {
-          active_index_directory = "/var/lib/loki/boltdb-shipper-index";
-          cache_location = "/var/lib/loki/boltdb-shipper-cache";
+          active_index_directory = "${stateDir}/boltdb-shipper-index";
+          cache_location = "${stateDir}/boltdb-shipper-cache";
          cache_ttl = "24h";
        };
        filesystem = {
-          directory = "/var/lib/loki/chunks";
+          directory = "${stateDir}/chunks";
        };
      };

@ -64,14 +65,14 @@ in {
      };

      compactor = {
-        working_directory = "/var/lib/loki/compactor";
+        working_directory = "${stateDir}/compactor";
      };

      # ruler = {
      #   storage = {
      #     type = "local";
      #     local = {
-      #       directory = "/var/lib/loki/rules";
+      #       directory = "${stateDir}/rules";
      #     };
      #   };
      #   rule_path = "/etc/loki/rules";
--- a/hosts/ildkule/services/monitoring/prometheus/default.nix
+++ b/hosts/ildkule/services/monitoring/prometheus/default.nix
@ -1,4 +1,6 @@
-{ config, ... }: {
+{ config, ... }: let
+  stateDir = "/data/monitoring/prometheus";
+in {
  imports = [
    ./gitea.nix
    ./matrix-synapse.nix
@ -10,9 +12,15 @@

  services.prometheus = {
    enable = true;
+
    listenAddress = "127.0.0.1";
    port = 9001;

    ruleFiles = [ rules/synapse-v2.rules ];
  };
+
+  fileSystems."/var/lib/prometheus2" = {
+    device = stateDir;
+    options = [ "bind" ];
+  };
 }
--- a/hosts/ildkule/services/monitoring/uptime-kuma.nix
+++ b/hosts/ildkule/services/monitoring/uptime-kuma.nix
@ -2,6 +2,7 @@
 let
  cfg = config.services.uptime-kuma;
  domain = "status.pvv.ntnu.no";
+  stateDir = "/data/monitoring/uptime-kuma";
 in {
  services.uptime-kuma = {
    enable = true;
@ -17,4 +18,9 @@ in {
    kTLS = true;
    locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
  };
+
+  fileSystems."/var/lib/uptime-kuma" = {
+    device = stateDir;
+    options = [ "bind" ];
+  };
 }
--- a/hosts/shark/configuration.nix
+++ b/hosts/shark/configuration.nix
@ -1,13 +1,13 @@
-{ config, pkgs, values, ... }:
+{ config, fp, pkgs, values, ... }:
 {
  imports = [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      ../../base
-      ../../misc/metrics-exporters.nix
+      (fp /base)
+      (fp /misc/metrics-exporters.nix)
    ];

-  sops.defaultSopsFile = ../../secrets/shark/shark.yaml;
+  sops.defaultSopsFile = fp /secrets/shark/shark.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;
--- a/modules/grzegorz.nix
+++ b/modules/grzegorz.nix
@ -1,31 +1,26 @@
 {config, lib, pkgs, ...}:
 let
-  grg = config.services.grzegorz;
+  grg = config.services.greg-ng;
  grgw = config.services.grzegorz-webui;
 in {
-  services.pipewire.enable = true;
-  services.pipewire.alsa.enable = true;
-  services.pipewire.alsa.support32Bit = true;
-  services.pipewire.pulse.enable = true;
-
-  users.users.pvv = {
-    isNormalUser = true;
-    description = "pvv";
+  services.greg-ng = {
+    enable = true;
+    settings.host = "localhost";
+    settings.port = 31337;
+    enableSway = true;
+    enablePipewire = true;
  };

-  services.grzegorz.enable = true;
-  services.grzegorz.listenAddr = "localhost";
-  services.grzegorz.listenPort = 31337;
-
-  services.grzegorz-webui.enable = true;
-  services.grzegorz-webui.listenAddr = "localhost";
-  services.grzegorz-webui.listenPort = 42069;
-  services.grzegorz-webui.listenWebsocketPort = 42042;
-  services.grzegorz-webui.hostName = "${config.networking.fqdn}";
-  services.grzegorz-webui.apiBase = "http://${toString grg.listenAddr}:${toString grg.listenPort}/api";
+  services.grzegorz-webui = {
+    enable = true;
+    listenAddr = "localhost";
+    listenPort = 42069;
+    listenWebsocketPort = 42042;
+    hostName = "${config.networking.fqdn}";
+    apiBase = "http://${grg.settings.host}:${toString grg.settings.port}/api";
+  };

  services.nginx.enable = true;
-
  services.nginx.virtualHosts."${config.networking.fqdn}" = {
    forceSSL = true;
    enableACME = true;
@ -40,20 +35,19 @@ in {
    '';

    locations."/" = {
-      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenPort}";
+      proxyPass = "http://${grgw.listenAddr}:${toString grgw.listenPort}";
    };
    # https://github.com/rawpython/remi/issues/216
    locations."/websocket" = {
-      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenWebsocketPort}";
+      proxyPass = "http://${grgw.listenAddr}:${toString grgw.listenWebsocketPort}";
      proxyWebsockets = true;
    };
    locations."/api" = {
-      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
+      proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
    };
    locations."/docs" = {
-      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
+      proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
    };
  };
-
 }

--- a/users/alfhj.nix
+++ b/users/alfhj.nix
@ -0,0 +1,13 @@
+{pkgs, ...}:
+
+{
+  users.users.alfhj = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    shell = pkgs.zsh;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMCAYE0U3sFizm/NSbKCs0jEhZ1mpAWPcijFevejiFL1 alfhj"
+    ];
+  };
+}
+
--- a/values.nix
+++ b/values.nix
@ -27,10 +27,6 @@ in rec {
    gateway = pvv-ipv4 129;
    gateway6 = pvv-ipv6 1;

-    bakke = {
-      ipv4 = pvv-ipv4 173;
-      ipv6 = pvv-ipv6 173;
-    };
    bekkalokk = {
      ipv4 = pvv-ipv4 168;
      ipv6 = pvv-ipv6 168;
Author	SHA1	Message	Date
Daniel Lovbrotte Olsen	3bdfb4c297	Add function to make paths from flake root No more ../../../../../../	2024-11-17 00:08:02 +01:00
Felix Albrigtsen	8285d91401	Merge pull request 'Ildkule: Move monitoring state directories to data volume' (!88 ) from ildkule-data-volume into main Reviewed-on: #88 Reviewed-by: Daniel Lovbrotte Olsen <danio@pvv.ntnu.no>	2024-11-10 02:30:11 +01:00
Alf Helge Jakobsen	b07cd5fbf6	systemd hardening for pvv-nettsiden-gallery-update.service (!90 ) #133 Reviewed-on: #90 Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Co-authored-by: Alf Helge Jakobsen <alfhj@stud.ntnu.no> Co-committed-by: Alf Helge Jakobsen <alfhj@stud.ntnu.no>	2024-11-09 22:22:09 +01:00
Felix Albrigtsen	2d52ebce52	Ildkule: hardware-config: use UUIDs	2024-11-09 21:42:44 +01:00
Oystein Kristoffer Tveit	464576e856	flake.lock: bump greg-ng	2024-11-09 19:43:07 +01:00
Oystein Kristoffer Tveit	df35715978	Merge pull request 'Add alfhj.nix' (!89 ) from newusersconfig into main Reviewed-on: #89 Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>	2024-11-09 19:40:03 +01:00
Alf Helge Jakobsen	165ff56948	Add alfhj.nix	2024-11-09 19:35:19 +01:00
Felix Albrigtsen	11f6ef0572	Ildkule: Move monitoring state directories to data volume	2024-11-09 15:21:12 +01:00
Oystein Kristoffer Tveit	815f48c30d	flake.lock: bump greg-ng	2024-10-22 19:50:29 +02:00
Oystein Kristoffer Tveit	4985bac3ba	flake.lock: bump greg-ng	2024-10-20 23:18:35 +02:00
Oystein Kristoffer Tveit	9e41c3374d	Merge pull request 'bekkalokk/nginx: host `.well-known`' (!79 ) from move-well-known-to-bekkalokk into main Reviewed-on: #79 Reviewed-by: Daniel Lovbrotte Olsen <danio@pvv.ntnu.no>	2024-10-20 01:35:22 +02:00
Oystein Kristoffer Tveit	f39fee4213	bekkalokk/nginx: host `.well-known`	2024-10-20 01:34:41 +02:00
Oystein Kristoffer Tveit	4c77c9fc67	Merge pull request 'greg-ng 🎉' (!86 ) from greg-ng-working-branch into main Reviewed-on: #86 Reviewed-by: Felix Albrigtsen <felixalb@pvv.ntnu.no>	2024-10-20 01:30:26 +02:00
Oystein Kristoffer Tveit	7938e8135f	flake.lock: bump	2024-10-19 23:31:29 +02:00
Oystein Kristoffer Tveit	cbc3490882	modules/grzegorz: use greg-ng	2024-10-19 23:31:28 +02:00