base/auditd: init

base/default.nix

@@ -22,6 +22,7 @@
     ./vm.nix
 
     ./services/acme.nix
+    ./services/auditd.nix
     ./services/auto-upgrade.nix
     ./services/dbus.nix
     ./services/fluentbit.nix

base/mitigations.nix

@@ -21,18 +21,4 @@ in
   boot.blacklistedKernelModules = modulesToBan;
 
   boot.extraModprobeConfig = lib.concatMapStringsSep "\n" (mod: "install ${mod} ${lib.getExe' pkgs.coreutils "false"}") modulesToBan;
-
-  nixpkgs.overlays = [
-    (final: prev: {
-      matrix-synapse-unwrapped = prev.matrix-synapse-unwrapped.overrideAttrs (old: rec {
-        version = "1.157.2";
-        src = final.fetchFromGitHub {
-          owner = "element-hq";
-          repo = "synapse";
-          rev = "v${version}";
-          hash = "sha256-TUHcNAXrV43+J7jqfstlYdrZrwL5kDCh03yxO+vL/gw=";
-        };
-      });
-    })
-  ];
 }

base/services/auditd.nix

@@ -0,0 +1,56 @@
+{ config, lib, pkgs, ... }:
+{
+  security.audit = {
+    enable = lib.mkDefault true;
+
+    # NOTE: see auditctl(8) for the meaning of the different rule flags.
+    rules = [
+      # Kernel module loading/unloading
+      "-a always,exit -F arch=b64 -S init_module,finit_module,delete_module -k kernel-modules"
+
+      # Mount/unmount by real (non-service) users
+      "-a always,exit -F arch=b64 -S mount,umount2 -F auid>=1000 -F auid!=-1 -k mounts"
+
+      # DAC permission/ownership changes by real users
+      "-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=-1 -k perm-mod"
+      "-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=-1 -k perm-mod"
+      "-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=-1 -k perm-mod"
+
+      # Failed access attempts (permission denied) by real users
+      "-a always,exit -F arch=b64 -S open,openat,creat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k access"
+      "-a always,exit -F arch=b64 -S open,openat,creat,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k access"
+
+      # File deletion/rename by real users
+      "-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=-1 -k delete"
+
+      # Execution of privileged commands
+      "-w ${config.security.wrapperDir}/sudo -p x -k privileged-sudo"
+      "-w ${config.security.wrapperDir}/su -p x -k privileged-su"
+
+      # Read of files containing secrets.
+      "-w /var/lib/sops-nix/key.txt -p r -k secrets"
+      "-w /run/secrets -p r -k secrets"
+      "-w /etc/ssh/ssh_host_ed25519_key -p r -k secrets"
+      "-w /etc/ssh/ssh_host_rsa_key -p r -k secrets"
+
+      # NixOS generation switching
+      "-w /nix/var/nix/profiles -p wa -k nixos-generation-switch"
+
+      # Switching bootloader content
+      "-w /boot -p wa -k boot-tampering"
+
+      # Login records
+      "-w /var/lib/lastlog2 -p wa -k logins"
+
+      # Write or append to the audit trail
+      "-w /var/log/audit -p wa -k audit-log-tampering"
+      "-w ${lib.getExe' pkgs.audit "auditctl"} -p x -k audit-tools"
+    ];
+  };
+
+  security.auditd = {
+    enable = lib.mkDefault true;
+    plugins.syslog.active = true;
+    plugins.af_unix.active = true;
+  };
+}

base/services/journald-upload.nix

@@ -9,7 +9,7 @@ in
       URL = "https://journald.pvv.ntnu.no:${toString config.services.journald.remote.port}";
       ServerKeyFile = "-";
       ServerCertificateFile = "-";
-      TrustedCertificateFile = config.security.pki.caBundle;
+      TrustedCertificateFile = "-";
     };
   };
 

flake.lock

@@ -126,11 +126,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1784709844,
+        "lastModified": 1784553736,
-        "narHash": "sha256-5PW5+UEFFjsru5FiDg9ZRUjQyo7AVyc+nesQlBSqM6c=",
+        "narHash": "sha256-W1pPlTHmp+EvONwf8Qa5NvCiuyV4LC/yNDdc27RSpuA=",
         "ref": "main",
-        "rev": "a8fb5df19d1cdcc3ac29cdb8ad192c1d578761f0",
+        "rev": "e06daaef1f48160254c202c59b060ac6f1da9f38",
-        "revCount": 63,
+        "revCount": 62,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
       },
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1785211367,
+        "lastModified": 1784526640,
-        "narHash": "sha256-LCMjGYtOaXMLCj5aRf/YHGPF32t5MhOqfwEuLbDo1sc=",
+        "narHash": "sha256-UDnuu3uM64qjfVvsGSislJgP1j15FiFiDiKOjbGTv9Q=",
-        "rev": "3770c18e5fe45a754c62d4d5081126195d9ab2ee",
+        "rev": "036c2421db75172aeef4bb83921988891d4773c9",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.6345.3770c18e5fe4/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.5692.036c2421db75/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -319,11 +319,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1785210918,
+        "lastModified": 1784536202,
-        "narHash": "sha256-gnVHwvnrk8Rh/44ryN50iuqoNzLqpNvSw9ZSNC9C4XM=",
+        "narHash": "sha256-7CmHmK10lEXBgymS0DeYj4/4STLpzRWCc/5BfoIxHQo=",
-        "rev": "29a3e341634615ff16f700e9a1fdbc9c42f0198c",
+        "rev": "94f12be79cb7f961726a0157b4168bc722befeac",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.11pre1042951.29a3e3416346/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.11pre1037880.94f12be79cb7/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -379,11 +379,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784979981,
+        "lastModified": 1782759909,
-        "narHash": "sha256-OnvjEXYU/InjJYH2+iIrvHWIjHnc5J9f84qWhrgAWlY=",
+        "narHash": "sha256-gktjBeZyoRvVBkm2cO1tD99fdQ34iUDyB6iecRdorm4=",
         "ref": "main",
-        "rev": "ffb8ed0c9df2444727e49f16f7e43ea70184dc4b",
+        "rev": "ad6c79fb713884a4a2df8aab30914cd0c1c2e6cb",
-        "revCount": 590,
+        "revCount": 587,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       },
@@ -447,17 +447,17 @@
         "rust-overlay": "rust-overlay_4"
       },
       "locked": {
-        "lastModified": 1785060737,
+        "lastModified": 1784550731,
-        "narHash": "sha256-tlOCUK+X1Um1y/pP/vToGrygn1wmrtUDKrvQquPLVfA=",
+        "narHash": "sha256-KDrBGT98fQWlnEBmTvIijPq4n4sVLcETBu8EuL486SM=",
         "ref": "main",
-        "rev": "35fe97baa795d1564c79b013d8a36ee01698f47b",
+        "rev": "c0c0e47c8a45673c62462cadf38a489b72fd39ec",
-        "revCount": 126,
+        "revCount": 112,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
       },
       "original": {
         "ref": "main",
-        "rev": "35fe97baa795d1564c79b013d8a36ee01698f47b",
+        "rev": "c0c0e47c8a45673c62462cadf38a489b72fd39ec",
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
       }
@@ -575,11 +575,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785100355,
+        "lastModified": 1780762731,
-        "narHash": "sha256-wBGnYrF7Kfs4vk3djspT3RdQqsYiqm60fKn7/J3vH4I=",
+        "narHash": "sha256-EuDaLnasWN0mpi995n+fAQQfPGBhqNW4fNjlQRpHt58=",
         "ref": "main",
-        "rev": "611f6ac1a304cc319fc85876d3f0301f49ce458e",
+        "rev": "931bd2d63e285e767c8c81c103dda3c0a63f2965",
-        "revCount": 120,
+        "revCount": 108,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
       },

flake.nix

@@ -35,7 +35,7 @@
     minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
     minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";
 
-    roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=35fe97baa795d1564c79b013d8a36ee01698f47b";
+    roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=c0c0e47c8a45673c62462cadf38a489b72fd39ec";
     roowho2.inputs.nixpkgs.follows = "nixpkgs";
 
     greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";

hosts/bekkalokk/configuration.nix

@@ -13,7 +13,6 @@
     ./services/mediawiki
     ./services/nginx.nix
     ./services/phpfpm.nix
-    ./services/prometheus-phpfpm-exporter.nix
     ./services/vaultwarden.nix
     ./services/webmail
     ./services/website

hosts/bekkalokk/services/prometheus-phpfpm-exporter.nix

@@ -1,54 +0,0 @@
-{ config, lib, values, ... }:
-let
-  cfg = config.services.prometheus.exporters.php-fpm;
-  pools = [
-    "idp"
-    "mediawiki"
-    "pvv-nettsiden"
-    "roundcube"
-    "snappymail"
-  ];
-in
-{
-  services.phpfpm.pools = lib.genAttrs pools (_: {
-    settings."pm.status_path" = "/status";
-  });
-
-  services.prometheus.exporters.php-fpm = {
-    enable = true;
-    listenAddress = "127.0.0.1";
-    extraFlags = [
-      "--phpfpm.scrape-uri=${lib.concatMapStringsSep "," (name: "unix://${config.services.phpfpm.pools.${name}.socket};/status") pools}"
-    ];
-  };
-
-  systemd.services.prometheus-php-fpm-exporter.serviceConfig = {
-    Slice = "system-monitoring.slice";
-    SupplementaryGroups = [ config.services.nginx.group ];
-    RestrictAddressFamilies = lib.mkForce [
-      "AF_INET"
-      "AF_INET6"
-      "AF_UNIX"
-    ];
-  };
-
-  services.nginx = lib.mkIf cfg.enable {
-    virtualHosts."www.pvv.ntnu.no" = lib.mkIf config.services.nginx.enable {
-      forceSSL = true;
-      enableACME = true;
-      kTLS = true;
-
-      locations."/prometheus-php-fpm-exporter/metrics" = {
-        proxyPass = "http://localhost:${toString cfg.port}/metrics";
-
-        extraConfig = ''
-          allow 127.0.0.1;
-          allow ::1;
-          allow ${values.hosts.ildkule.ipv4};
-          allow ${values.hosts.ildkule.ipv6};
-          deny all;
-        '';
-      };
-    };
-  };
-}

hosts/bekkalokk/services/well-known/root/autoconfig/mail/config-v1.1.xml

@@ -16,8 +16,8 @@
 
     <outgoingServer type="smtp">
       <hostname>smtp.pvv.ntnu.no</hostname>
-      <port>465</port>
+      <port>587</port>
-      <socketType>SSL</socketType>
+      <socketType>STARTTLS</socketType>
       <username>%EMAILLOCALPART%</username>
       <authentication>password-cleartext</authentication>
       <useGlobalPreferredServer>true</useGlobalPreferredServer>

hosts/bicep/services/postgresql/default.nix

@@ -150,6 +150,7 @@ in
   };
 
   networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
+  networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
 
   environment.systemPackages = [
     (pkgs.writeShellApplication {

hosts/ildkule/services/monitoring/prometheus/default.nix

@@ -7,7 +7,6 @@ in {
     ./machines.nix
     ./matrix-synapse.nix
     ./mysqld.nix
-    ./phpfpm.nix
     ./postgres.nix
   ];
 

hosts/ildkule/services/monitoring/prometheus/phpfpm.nix

@@ -1,15 +0,0 @@
-{ ... }:
-{
-  services.prometheus.scrapeConfigs = [{
-    job_name = "phpfpm";
-    scheme = "https";
-    metrics_path = "/prometheus-php-fpm-exporter/metrics";
-
-    static_configs = [
-      {
-        labels.hostname = "bekkalokk";
-        targets = [ "www.pvv.ntnu.no:443" ];
-      }
-    ];
-  }];
-}

modules/python-http-handlers.nix

@@ -36,9 +36,6 @@ in
           description = ''
             For each item in this list, a `ListenStream`
             option in the `[Socket]` section will be created.
-
-            Only a single `ListenStream` is currently supported by the handler script; if
-            you need more than one, you'll have to adjust {option}`handler` accordingly.
           '';
         };
 
@@ -101,10 +98,8 @@ in
             "E303" # too many blank lines
             "E305" # expected 2 blank lines after end of function or class
             "E306" # expected 1 blank line before a nested definition
-            "E402" # module level import not at top of file
             "E501" # max line length
             "E704" # multiple statements on one line (def)
-            "F811" # redefined while unused
           ];
           description = ''
             A list of flake8 rules to ignore while linting the python code.
@@ -127,11 +122,6 @@ in
                     self.send_header("Content-Length", str(len(data)))
                     self.end_headers()
                     self.wfile.write(data)
-
-            def on_reload():
-                # This function is called when the service receives SIGHUP (e.g. via `systemctl reload`).
-                # You can use it to clear caches or re-read state. Completely optional
-                pass
           '';
           description = ''
             Python code including the HTTP handler for the server.
@@ -155,7 +145,6 @@ in
           inherit (v) listenStreams;
           socketConfig = {
             Accept = false;
-            FileDescriptorName = v.name;
           } // v.socketConfig;
         };
       }))
@@ -168,126 +157,30 @@ in
         inherit (v) name;
         value = {
           serviceConfig = {
-            Type = "notify-reload";
+            Type = "simple";
-            NotifyAccess = "main";
             DynamicUser = true;
-            TimeoutStopSec = "35s";
 
             ExecStart = let
               package = pkgs.writers.writePython3Bin "${v.name}-bin" {
                 inherit (v) libraries flakeIgnore;
               } ''
-                import os
-                import signal
                 import socket
-                import socketserver
-                import threading
-                import time
                 from http.server import HTTPServer, BaseHTTPRequestHandler
 
-                SOCKET_NAME = "${v.name}"
-                SHUTDOWN_TIMEOUT = 30
-
-                def sd_notify(message: str):
-                    addr = os.environ.get("NOTIFY_SOCKET")
-                    if not addr:
-                        return
-                    if addr[0] == "@":
-                        addr = "\0" + addr[1:]
-                    with socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM | socket.SOCK_CLOEXEC) as sock:
-                        sock.connect(addr)
-                        sock.sendall(message.encode())
-
-                def sd_listen_fd(name: str) -> int:
-                    if os.environ.get("LISTEN_PID") != str(os.getpid()):
-                        raise RuntimeError("No sockets were passed to this service by systemd")
-
-                    try:
-                        count = int(os.environ.get("LISTEN_FDS", "0"))
-                    except ValueError:
-                        count = 0
-
-                    raw_names = os.environ.get("LISTEN_FDNAMES")
-                    names = raw_names.split(":") if raw_names else []
-
-                    for i in range(count):
-                        if i < len(names) and names[i] == name:
-                            return 3 + i
-
-                    raise RuntimeError(
-                        "No systemd socket named %r was passed to this service; check the "
-                        "FileDescriptorName= of the corresponding .socket unit" % name
-                    )
-
-                class Server(socketserver.ThreadingMixIn, HTTPServer):
-                    daemon_threads = True
-
-                    def server_bind(): pass
-                    def server_activate(): pass
-
-                    def __init__(self, *args, **kwargs):
-                        super().__init__(*args, **kwargs)
-                        self._request_threads = []
-                        self._request_threads_lock = threading.Lock()
-
-                    def process_request(self, request, client_address):
-                        thread = threading.Thread(
-                            target=self.process_request_thread,
-                            args=(request, client_address),
-                        )
-                        thread.daemon = self.daemon_threads
-                        with self._request_threads_lock:
-                            self._request_threads.append(thread)
-                        thread.start()
-
-                    def join_request_threads(self, timeout):
-                        deadline = time.monotonic() + timeout
-                        with self._request_threads_lock:
-                            threads = list(self._request_threads)
-                        for thread in threads:
-                            thread.join(max(deadline - time.monotonic(), 0))
-
-                def handle_reload(signum, frame):
-                    monotonic_usec = time.clock_gettime_ns(time.CLOCK_MONOTONIC) // 1000
-                    sd_notify("RELOADING=1\nMONOTONIC_USEC=%d" % monotonic_usec)
-
-                    on_reload = globals().get("on_reload")
-                    if callable(on_reload):
-                        on_reload()
-
-                    sd_notify("READY=1")
-
-                shutdown_requested = threading.Event()
-
-                def handle_sigterm(signum, frame):
-                    sd_notify("STOPPING=1")
-                    shutdown_requested.set()
-
                 ${v.handler}
 
-                assert "Handler" in globals(), "You must define a class Handler(BaseHTTPRequestHandler) in the handler code"
+                class NoBindHTTPServer(HTTPServer):
+                    def server_bind(): pass
+                    def server_activate(): pass
 
                 def main():
-                    signal.signal(signal.SIGHUP, handle_reload)
+                    httpd = NoBindHTTPServer(
-                    signal.signal(signal.SIGTERM, handle_sigterm)
+                        ("", 0),
-
+                        Handler,
-                    fd = sd_listen_fd(SOCKET_NAME)
+                        bind_and_activate=False,
-
+                    )
-                    httpd = Server(("", 0), Handler, bind_and_activate=False)
+                    httpd.socket = socket.fromfd(3, socket.AF_INET, socket.SOCK_STREAM)
-                    httpd.socket = socket.socket(fileno=fd)
+                    httpd.serve_forever()
-
-                    server_thread = threading.Thread(target=httpd.serve_forever, name="http-server", daemon=True)
-                    server_thread.start()
-
-                    sd_notify("READY=1")
-                    shutdown_requested.wait()
-
-                    deadline = time.monotonic() + SHUTDOWN_TIMEOUT
-
-                    httpd.shutdown()
-                    server_thread.join(max(deadline - time.monotonic(), 0))
-                    httpd.join_request_threads(max(deadline - time.monotonic(), 0))
-                    httpd.server_close()
 
                 if __name__ == '__main__':
                     main()