ildkule/gatus/minecraft-checker: rewrite to use python-http-handlers module

flake.nix

@@ -173,6 +173,7 @@
                 sops-nix.nixosModules.sops
                 inputs.roowho2.nixosModules.default
                 self.nixosModules.rsync-pull-targets
+                self.nixosModules.python-http-handlers
               ])
               ++ modules;
           }
@@ -306,13 +307,14 @@
 
     nixosModules = {
       bluemap = ./modules/bluemap.nix;
+      drumknotty = ./modules/drumknotty;
       gickup = ./modules/gickup;
       matrix-ooye = ./modules/matrix-ooye.nix;
+      python-http-handlers = ./modules/python-http-handlers.nix;
       robots-txt = ./modules/robots-txt.nix;
       rsync-pull-targets = ./modules/rsync-pull-targets.nix;
       snakeoil-certs = ./modules/snakeoil-certs.nix;
       snappymail = ./modules/snappymail.nix;
-      drumknotty = ./modules/drumknotty;
     };
 
     devShells = forAllSystems (system: {

hosts/ildkule/services/monitoring/default.nix

@@ -2,10 +2,10 @@
 
 {
   imports = [
+    ./gatus
     ./grafana.nix
     ./loki.nix
     ./prometheus
     ./scrutiny.nix
-    ./uptime-kuma.nix
   ];
 }

hosts/ildkule/services/monitoring/gatus/default.nix

@@ -0,0 +1,155 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.gatus;
+in
+{
+  imports = [
+    ./minecraft-checker.nix
+  ];
+
+  services.gatus = {
+    enable = true;
+
+    settings = {
+      web = {
+        address = "127.0.0.1";
+        port = 19283;
+      };
+
+      storage = {
+        type = "sqlite";
+        path = "/var/lib/gatus/data.db";
+      };
+
+      ui = {
+        title = "PVV Nede!?";
+        header = "😭😭😭";
+        dashboard-heading = "PVV Nede!?";
+        dashboard-subheading = "Kan noen ringe drift?";
+      };
+
+      endpoints = let
+        mkMachine = name: {
+          inherit name;
+          group = "Machines";
+          url = "icmp://${name}.pvv.ntnu.no";
+          conditions = [
+            "[CONNECTED] == true"
+          ];
+        };
+
+        mkWebsite = name: url: {
+          inherit name url;
+          group = "Websites";
+          method = "GET";
+          conditions = [
+            "[STATUS] == 200"
+          ];
+        };
+
+        mkService = name: url: {
+          inherit name url;
+          group = "Services";
+          conditions = [
+            "[CONNECTED] == true"
+          ];
+        };
+      in (lib.sortOn (m: m.name) [
+        (mkMachine "ambidextrous")
+        (mkMachine "bekkalokk")
+        (mkMachine "bicep")
+        (mkMachine "bikkje")
+        (mkMachine "brzeczyszczykiewicz")
+        (mkMachine "georg")
+        (mkMachine "gluttony")
+        (mkMachine "ildkule")
+        (mkMachine "kana")
+        (mkMachine "kommode")
+        (mkMachine "lupine-1")
+        (mkMachine "lupine-2")
+        (mkMachine "lupine-3")
+        (mkMachine "lupine-4")
+        (mkMachine "lupine-5")
+        (mkMachine "skrot")
+        (mkMachine "temmie")
+        (mkMachine "wenche")
+
+        (mkMachine "balduzius")
+        (mkMachine "blossom")
+        (mkMachine "bubbles")
+        (mkMachine "buskerud")
+        (mkMachine "buttercup")
+        (mkMachine "demiurgen")
+        (mkMachine "drolsum")
+        (mkMachine "hildring")
+        (mkMachine "innovation")
+        (mkMachine "isvegg")
+        (mkMachine "knutsen")
+        (mkMachine "ludvigsen" // {
+          url = "icmp://ludvigsen-tap.pvv.ntnu.no";
+        })
+        (mkMachine "microbel")
+        (mkMachine "mirage")
+        (mkMachine "orchid")
+        (mkMachine "principal")
+        (mkMachine "sleipner")
+        (mkMachine "smask")
+        (mkMachine "tom")
+        (mkMachine "wegonke")
+      ]) ++ [
+        (mkWebsite "Bluemap" "https://minecraft.pvv.ntnu.no")
+        (mkWebsite "Element Web" "https://chat.pvv.ntnu.no")
+        (mkWebsite "Gitea" "https://git.pvv.ntnu.no/api/healthz" // {
+          conditions = [
+            "[STATUS] == 200"
+            "[BODY].status == pass"
+          ];
+        })
+        (mkWebsite "Grafana" "https://grafana.pvv.ntnu.no/api/health" // {
+          conditions = [
+            "[STATUS] == 200"
+            "[BODY].database == ok"
+          ];
+        })
+        (mkWebsite "Grzegorz - Brzeczyszczykiewicz" "https://brzeczyszczykiewicz.pvv.ntnu.no")
+        (mkWebsite "Grzegorz - Georg" "https://georg.pvv.ntnu.no")
+        (mkWebsite "IDP" "https://idp.pvv.ntnu.no")
+        (mkWebsite "Mailing Lists" "http://list.pvv.ntnu.no")
+        (mkWebsite "Mapcrafter" "http://isvegg.pvv.ntnu.no/kart")
+        (mkWebsite "PVV-Nettsiden" "https://www.pvv.ntnu.no")
+        (mkWebsite "Roundcube" "https://webmail.pvv.ntnu.no/roundcube")
+        (mkWebsite "Scrutiny" "https://scrutiny.pvv.ntnu.no")
+        (mkWebsite "Snappymail" "http://snappymail.pvv.ntnu.no")
+        (mkWebsite "Userweb - Temmie" "https://temmie.pvv.ntnu.no/~oysteikt")
+        (mkWebsite "Userweb - Tom" "https://www.pvv.ntnu.no/~oysteikt")
+        (mkWebsite "Vaultwarden" "https://pw.pvv.ntnu.no/alive")
+        (mkWebsite "Wiki" "https://wiki.pvv.ntnu.no/w/api.php?action=query&format=json")
+
+        (mkService "Gitea SSH" "ssh://git.pvv.ntnu.no:2222")
+        (mkService "QoTD" "tcp://bekkalokk.pvv.ntnu.no:17")
+        (mkService "Minecraft" "http://localhost:1337" // {
+          conditions = [
+            "[STATUS] == 200"
+            "[BODY].ok == true"
+          ];
+        })
+        (mkService "Email (SMTP)" "starttls://mail.pvv.ntnu.no:587")
+        (mkService "Email (POP3)" "tls://mail.pvv.ntnu.no:995")
+        (mkService "Email (IMAP)" "tls://mail.pvv.ntnu.no:993")
+        (mkService "Matrix Synapse" "https://matrix.pvv.ntnu.no/_matrix/client/versions" // {
+          method = "GET";
+          conditions = [
+            "[STATUS] == 200"
+          ];
+        })
+      ];
+    };
+  };
+
+  services.nginx.virtualHosts."status.pvv.ntnu.no" = lib.mkIf cfg.enable {
+    enableACME = true;
+    forceSSL = true;
+    kTLS = true;
+    locations."/".proxyPass = "http://localhost:${toString cfg.settings.web.port}";
+  };
+}

hosts/ildkule/services/monitoring/gatus/minecraft-checker.nix

@@ -0,0 +1,40 @@
+{ lib, pkgs, ... }:
+{
+  services.python-http-handlers."gatus-minecraft-checker" = {
+    listenStreams = [ "127.0.0.1:1337" ];
+    libraries = with pkgs.python3Packages; [
+      mcstatus
+    ];
+    handler = ''
+      import json
+      from mcstatus import JavaServer
+
+      class Handler(BaseHTTPRequestHandler):
+          def do_GET(self):
+              try:
+                  mcserver = JavaServer.lookup("minecraft.pvv.ntnu.no")
+                  status = mcserver.status()
+
+                  body = {
+                      "ok": True,
+                      "players": status.players.online,
+                      "version": status.version.name,
+                      "latency": status.latency,
+                  }
+
+                  data = json.dumps(body).encode()
+
+                  self.send_response(200)
+                  self.send_header("Content-Type", "application/json")
+                  self.send_header("Content-Length", str(len(data)))
+                  self.end_headers()
+                  self.wfile.write(data)
+
+              except Exception as e:
+                  data = json.dumps({"ok": False, "error": str(e)}).encode()
+                  self.send_response(500)
+                  self.end_headers()
+                  self.wfile.write(data)
+    '';
+  };
+}

hosts/ildkule/services/monitoring/uptime-kuma.nix

@@ -1,44 +0,0 @@
-{ config, pkgs, lib, values, ... }:
-let
-  cfg = config.services.uptime-kuma;
-  domain = "status.pvv.ntnu.no";
-  stateDir = "/data/monitoring/uptime-kuma";
-in {
-  services.uptime-kuma = {
-    enable = true;
-    settings = {
-      PORT = "5059";
-      HOST = "127.0.1.2";
-    };
-  };
-
-  services.nginx.virtualHosts.${domain} = {
-    enableACME = true;
-    forceSSL = true;
-    kTLS = true;
-    locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
-  };
-
-  fileSystems."/var/lib/private/uptime-kuma" = {
-    device = stateDir;
-    fsType = "bind";
-    options = [ "bind" ];
-  };
-
-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${stateDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXzcDm6cVr4NmWzUSroy33FlielKqaG83wY0RCMC0p/ uptime_kuma rsync backup";
-    };
-  };
-}

hosts/lupine/configuration.nix

@@ -48,7 +48,11 @@
       networks."20-br0" = {
         matchConfig.Name = "br0";
 
-        address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
+        address = with values.hosts.${lupineName}; [
+          (ipv4 + "/25")
+          (ipv6 + "/64")
+          values.services.knutsen-vpn
+        ];
         networkConfig.LLDP = false;
 
         dns = ["129.241.0.200" "129.241.0.201" "2001:700:300:1900::200" "2001:700:300:1900::201"];

hosts/lupine/services/openvpn.nix

@@ -1,4 +1,4 @@
-{ pkgs, lib, values, ... }:
+{ config, pkgs, lib, values, ... }:
 let
   renderConfig = attrs: lib.pipe attrs [
     (lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
@@ -20,10 +20,18 @@ let
   ];
 in
 {
+  sops.secrets = {
+    "openvpn/ca/crt" = { };
+    "openvpn/server/crt" = { };
+    "openvpn/server/key" = { };
+  };
+
   services.openvpn.servers."ov-tunnel" = {
     config = renderConfig {
+      mode = "server";
+
       # TODO: use aliases
-      local = values.services.knutsen-vpn;
+      local = "0.0.0.0";
       port = 1194;
       proto = "udp";
 
@@ -32,11 +40,10 @@ in
 
       script-security = 0;
 
-      # TODO: set up
+      ca = config.sops.secrets."openvpn/ca/crt".path;
-      # ca = "";
+      cert = config.sops.secrets."openvpn/server/crt".path;
-      # cert = "";
+      key = config.sops.secrets."openvpn/server/key".path;
-      # key = "";
+      dh = "none";
-      # dh = "";
 
       # Maintain a record of client <-> virtual IP address
       # associations in this file.  If OpenVPN goes down or
@@ -58,7 +65,6 @@ in
       ];
 
       keepalive = "10 120";
-      data-ciphers = "none";
 
       user = "nobody";
       group = "nobody";
@@ -67,7 +73,7 @@ in
 
       client-config-dir = pkgs.writeTextDir "ludvigsen" ''
         # Sett IP-adr. for tap0 til ludvigsens PVV-addresse.
-        ifconfig-push ${values.services.ludvigsen-vpn} 255.255.255.128
+        ifconfig-push ${values.services.ludvigsen-tap} 255.255.255.128
 
         # Hvordan skal man faa dette til aa funke, tro?
         # ifconfig-ipv6-push 2001:700:300:1900::xxx/64
@@ -79,9 +85,17 @@ in
       persist-key = true;
       persist-tun = true;
 
+      tls-version-min = "1.2";
+      tls-version-max = "1.2";
+
       verb = 5;
 
       explicit-exit-notify = 1;
     };
   };
+
+  networking.firewall = {
+    allowedTCPPorts = [ 1194 ];
+    allowedUDPPorts = [ 1194 ];
+  };
 }

modules/python-http-handlers.nix

@@ -0,0 +1,224 @@
+{ config, options, lib, pkgs, utils, ... }:
+let
+  cfg = config.services.python-http-handlers;
+in
+{
+  options.services.python-http-handlers = lib.mkOption {
+    default = { };
+    type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
+      options = {
+        enable = lib.mkEnableOption "" // {
+          default = true;
+          description = "Whether to enable this python HTTP handler.";
+        };
+
+        name = lib.mkOption {
+          type = lib.types.str;
+          default = "phh-${name}";
+          defaultText = "phh-<name>";
+          description = ''
+            The name of this HTTP handler.
+
+            This will be used for the systemd service among other things.
+          '';
+        };
+
+        listenStreams = lib.mkOption {
+          type = with lib.types; listOf str;
+          default = [
+            "/run/phh-${name}.socket"
+          ];
+          defaultText = lib.literalExpression ''
+            [
+              "/run/phh-<name>.socket"
+            ]
+          '';
+          description = ''
+            For each item in this list, a `ListenStream`
+            option in the `[Socket]` section will be created.
+          '';
+        };
+
+        socketConfig = lib.mkOption {
+          type = utils.systemdUtils.unitOptions.unitOption;
+          default = { };
+          description = ''
+            Config for the systemd socket's `[Socket]` section.
+
+            See {manpage}`systemd.socket(5)` for details.
+          '';
+        };
+
+        serviceConfig = lib.mkOption {
+          type = utils.systemdUtils.unitOptions.unitOption;
+          default = { };
+          description = ''
+            Config for the systemd service's `[Service]` section.
+
+            See {manpage}`systemd.exec(5)` and {manpage}`systemd.service(5)` for details.
+          '';
+        };
+
+        enableDefaultHardening = lib.mkEnableOption "" // {
+          default = true;
+          description = ''
+            Whether to enable a set of recommended systemd hardening directives.
+
+            If this breaks the service, you can either override the offending directives
+            through {option}`serviceConfig`, or disable this option altogether.
+          '';
+        };
+
+        libraries = lib.mkOption {
+          type = with lib.types; listOf package;
+          default = [ ];
+          example = lib.literalExpression ''
+            with pkgs.python3Packages; [
+              matplotlib
+              numpy
+              pillow
+            ]
+          '';
+          description = ''
+            Extra python libraries to make available to the service.
+          '';
+        };
+
+        flakeIgnore = lib.mkOption {
+          type = with lib.types; listOf str;
+          default = [
+            "E111" # indentation is not a multiple of four
+            "E201" # whitespace after (
+            "E202" # whitespace after )
+            "E203" # whitespace before :
+            "E211" # whitespace before (
+            "E251" # unexpected spaces around keyword / parameter equals
+            "E301" # expected 1 blank line, found 0
+            "E302" # expected 2 blank lines, found 0
+            "E303" # too many blank lines
+            "E305" # expected 2 blank lines after end of function or class
+            "E306" # expected 1 blank line before a nested definition
+            "E501" # max line length
+            "E704" # multiple statements on one line (def)
+          ];
+          description = ''
+            A list of flake8 rules to ignore while linting the python code.
+
+            An opinionated list of bogus rules (according to module author) is provided as default.
+          '';
+        };
+
+        handler = lib.mkOption {
+          type = lib.types.lines;
+          default = ''
+            import json
+
+            class Handler(BaseHTTPRequestHandler):
+                def do_GET(self):
+                    body = {"ok": True}
+                    data = json.dumps(body).encode()
+                    self.send_response(200)
+                    self.send_header("Content-Type", "application/json")
+                    self.send_header("Content-Length", str(len(data)))
+                    self.end_headers()
+                    self.wfile.write(data)
+          '';
+          description = ''
+            Python code including the HTTP handler for the server.
+
+            You can include as many imports and functions as you'd like here, but you will need
+            to at least provide a `class Handler(BaseHTTPRequestHandler)` to handle incoming HTTP requests.
+          '';
+        };
+      };
+    }));
+  };
+
+  config = {
+    systemd.sockets = lib.pipe cfg [
+      lib.attrValues
+      (lib.filter (v: v.enable))
+      (vs: lib.genAttrs' vs (v: {
+        inherit (v) name;
+        value = {
+          wantedBy = [ "sockets.target" ];
+          inherit (v) listenStreams;
+          socketConfig = {
+            Accept = false;
+          } // v.socketConfig;
+        };
+      }))
+    ];
+
+    systemd.services = lib.pipe cfg [
+      lib.attrValues
+      (lib.filter (v: v.enable))
+      (vs: lib.genAttrs' vs (v: {
+        inherit (v) name;
+        value = {
+          serviceConfig = {
+            Type = "simple";
+            DynamicUser = true;
+
+            ExecStart = let
+              package = pkgs.writers.writePython3Bin "${v.name}-bin" {
+                inherit (v) libraries flakeIgnore;
+              } ''
+                import socket
+                from http.server import HTTPServer, BaseHTTPRequestHandler
+
+                ${v.handler}
+
+                class NoBindHTTPServer(HTTPServer):
+                    def server_bind(): pass
+                    def server_activate(): pass
+
+                def main():
+                    httpd = NoBindHTTPServer(
+                        ("", 0),
+                        Handler,
+                        bind_and_activate=False,
+                    )
+                    httpd.socket = socket.fromfd(3, socket.AF_INET, socket.SOCK_STREAM)
+                    httpd.serve_forever()
+
+                if __name__ == '__main__':
+                    main()
+              '';
+            in lib.getExe package;
+          } // (lib.optionalAttrs v.enableDefaultHardening {
+            AmbientCapabilities = [ "" ];
+            CapabilityBoundingSet = [ "" ];
+            DeviceAllow = [ "" ];
+            LockPersonality = true;
+            NoNewPrivileges = true;
+            PrivateDevices = true;
+            PrivateTmp = true;
+            ProcSubset = "pid";
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectHome = true;
+            ProtectHostname = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectProc = "invisible";
+            ProtectSystem = "strict";
+            RemoveIPC = true;
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            SocketBindDeny = "any";
+            SystemCallArchitectures = "native";
+            SystemCallFilter = [
+               "@system-service"
+               "~@privileged"
+               "~@resources"
+            ];
+            UMask = "0077";
+          }) // v.serviceConfig;
+        };
+      }))
+    ];
+  };
+}