Compare commits
1 Commits
main
...
gitea-show
| Author | SHA1 | Date | |
|---|---|---|---|
11855f4c5f
|
.mailmapjustfile
base
flake.lockflake.nixhosts
bekkalokk/services
bicep
georg
kommode/services/gitea
wenche
modules
gickup
grzegorz.nixpackages
secrets/bicep
shells
users
values.nix
25
.mailmap
25
.mailmap
@ -1,25 +0,0 @@
|
||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> <daniel.olsen99@gmail.com>
|
||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel <danio@pvv.ntnu.no>
|
||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Lovbrotte Olsen <danio@pvv.ntnu.no>
|
||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Olsen <danio@pvv.ntnu.no>
|
||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> danio <danio@pvv.ntnu.no>
|
||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Olsen <danio@bicep.pvv.ntnu.no>
|
||||
|
||||
|
||||
Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> h7x4 <h7x4@nani.wtf>
|
||||
Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Øystein Tveit <oysteikt@pvv.ntnu.no>
|
||||
Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> oysteikt <oysteikt@pvv.ntnu.no>
|
||||
Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Øystein <oysteikt@pvv.org>
|
||||
Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
|
||||
|
||||
Felix Albrigtsen <felixalb@pvv.ntnu.no> <felix@albrigtsen.it>
|
||||
Felix Albrigtsen <felixalb@pvv.ntnu.no> <felixalbrigtsen@gmail.com>
|
||||
Felix Albrigtsen <felixalb@pvv.ntnu.no> felixalb <felixalb@pvv.ntnu.no>
|
||||
|
||||
Peder Bergebakken Sundt <pederbs@pvv.ntnu.no> <pbsds@hotmail.com>
|
||||
|
||||
Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian G L <adrian@lauterer.it>
|
||||
Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian Gunnar Lauterer <adrian@lauterer.it>
|
||||
|
||||
Fredrik Robertsen <frero@pvv.ntnu.no> frero <frero@pvv.ntnu.no>
|
||||
Fredrik Robertsen <frero@pvv.ntnu.no> fredrikr79 <fredrikrobertsen7@gmail.com>
|
||||
@ -7,10 +7,8 @@
|
||||
|
||||
./networking.nix
|
||||
./nix.nix
|
||||
./vm.nix
|
||||
|
||||
./services/acme.nix
|
||||
./services/uptimed.nix
|
||||
./services/auto-upgrade.nix
|
||||
./services/dbus.nix
|
||||
./services/fwupd.nix
|
||||
@ -52,18 +50,6 @@
|
||||
kitty.terminfo
|
||||
];
|
||||
|
||||
# .bash_profile already works, but lets also use .bashrc like literally every other distro
|
||||
# https://man.archlinux.org/man/core/bash/bash.1.en#INVOCATION
|
||||
# home-manager usually handles this for you: https://github.com/nix-community/home-manager/blob/22a36aa709de7dd42b562a433b9cefecf104a6ee/modules/programs/bash.nix#L203-L209
|
||||
# btw, programs.bash.shellInit just goes into environment.shellInit which in turn goes into /etc/profile, spooky shit
|
||||
programs.bash.shellInit = ''
|
||||
if [ -n "''${BASH_VERSION:-}" ]; then
|
||||
if [[ ! -f ~/.bash_profile && ! -f ~/.bash_login ]]; then
|
||||
[[ -f ~/.bashrc ]] && . ~/.bashrc
|
||||
fi
|
||||
fi
|
||||
'';
|
||||
|
||||
programs.zsh.enable = true;
|
||||
|
||||
security.lockKernelModules = true;
|
||||
@ -78,3 +64,4 @@
|
||||
# Trusted users on the nix builder machines
|
||||
users.groups."nix-builder-users".name = "nix-builder-users";
|
||||
}
|
||||
|
||||
|
||||
17
base/nix.nix
17
base/nix.nix
@ -1,4 +1,4 @@
|
||||
{ lib, config, inputs, ... }:
|
||||
{ inputs, ... }:
|
||||
{
|
||||
nix = {
|
||||
gc = {
|
||||
@ -21,16 +21,11 @@
|
||||
** use the same channel the system
|
||||
** was built with
|
||||
*/
|
||||
registry = lib.mkMerge [
|
||||
{
|
||||
"nixpkgs".flake = inputs.nixpkgs;
|
||||
"nixpkgs-unstable".flake = inputs.nixpkgs-unstable;
|
||||
}
|
||||
# We avoid the reference to self in vmVariant to get a stable system .outPath for equivalence testing
|
||||
(lib.mkIf (!config.virtualisation.isVmVariant) {
|
||||
"pvv-nix".flake = inputs.self;
|
||||
})
|
||||
];
|
||||
registry = {
|
||||
"nixpkgs".flake = inputs.nixpkgs;
|
||||
"nixpkgs-unstable".flake = inputs.nixpkgs-unstable;
|
||||
"pvv-nix".flake = inputs.self;
|
||||
};
|
||||
nixPath = [
|
||||
"nixpkgs=${inputs.nixpkgs}"
|
||||
"unstable=${inputs.nixpkgs-unstable}"
|
||||
|
||||
@ -1,39 +1,26 @@
|
||||
{ config, inputs, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
inputUrls = lib.mapAttrs (input: value: value.url) (import "${inputs.self}/flake.nix").inputs;
|
||||
in
|
||||
|
||||
{ inputs, pkgs, lib, ... }:
|
||||
{
|
||||
system.autoUpgrade = {
|
||||
enable = true;
|
||||
flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
|
||||
flags = [
|
||||
"--refresh"
|
||||
"--no-write-lock-file"
|
||||
# --update-input is deprecated since nix 2.22, and removed in lix 2.90
|
||||
# as such we instead use --override-input combined with --refresh
|
||||
# https://git.lix.systems/lix-project/lix/issues/400
|
||||
] ++ (lib.pipe inputUrls [
|
||||
(lib.intersectAttrs {
|
||||
nixpkgs = { };
|
||||
nixpkgs-unstable = { };
|
||||
})
|
||||
(lib.mapAttrsToList (input: url: ["--override-input" input url]))
|
||||
lib.concatLists
|
||||
]);
|
||||
"--refresh"
|
||||
"--override-input" "nixpkgs" "github:nixos/nixpkgs/nixos-24.11-small"
|
||||
"--override-input" "nixpkgs-unstable" "github:nixos/nixpkgs/nixos-unstable-small"
|
||||
"--no-write-lock-file"
|
||||
];
|
||||
};
|
||||
|
||||
# workaround for https://github.com/NixOS/nix/issues/6895
|
||||
# via https://git.lix.systems/lix-project/lix/issues/400
|
||||
environment.etc = lib.mkIf (!config.virtualisation.isVmVariant) {
|
||||
"current-system-flake-inputs.json".source
|
||||
= pkgs.writers.writeJSON "flake-inputs.json" (
|
||||
lib.flip lib.mapAttrs inputs (name: input:
|
||||
# inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
|
||||
lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
|
||||
// { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
|
||||
)
|
||||
);
|
||||
};
|
||||
environment.etc."current-system-flake-inputs.json".source
|
||||
= pkgs.writers.writeJSON "flake-inputs.json" (
|
||||
lib.flip lib.mapAttrs inputs (name: input:
|
||||
# inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
|
||||
lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
|
||||
// { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
@ -20,14 +20,14 @@
|
||||
recommendedGzipSettings = true;
|
||||
|
||||
appendConfig = ''
|
||||
# pcre_jit on;
|
||||
pcre_jit on;
|
||||
worker_processes auto;
|
||||
worker_rlimit_nofile 100000;
|
||||
'';
|
||||
eventsConfig = ''
|
||||
worker_connections 2048;
|
||||
use epoll;
|
||||
# multi_accept on;
|
||||
multi_accept on;
|
||||
'';
|
||||
};
|
||||
|
||||
|
||||
@ -1,59 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.services.uptimed;
|
||||
in
|
||||
{
|
||||
options.services.uptimed.settings = lib.mkOption {
|
||||
description = "";
|
||||
default = { };
|
||||
type = lib.types.submodule {
|
||||
freeformType = with lib.types; attrsOf (either str (listOf str));
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
services.uptimed = {
|
||||
enable = true;
|
||||
|
||||
settings = let
|
||||
stateDir = "/var/lib/uptimed";
|
||||
in {
|
||||
PIDFILE = "${stateDir}/pid";
|
||||
SENDMAIL = lib.mkDefault "${pkgs.system-sendmail}/bin/sendmail -t";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.uptimed = lib.mkIf (cfg.enable) {
|
||||
serviceConfig = let
|
||||
uptimed = pkgs.uptimed.overrideAttrs (prev: {
|
||||
postPatch = ''
|
||||
substituteInPlace Makefile.am \
|
||||
--replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
|
||||
substituteInPlace src/Makefile.am \
|
||||
--replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
|
||||
'';
|
||||
});
|
||||
|
||||
in {
|
||||
Type = "notify";
|
||||
|
||||
ExecStart = lib.mkForce "${uptimed}/sbin/uptimed -f";
|
||||
|
||||
BindReadOnlyPaths = let
|
||||
configFile = lib.pipe cfg.settings [
|
||||
(lib.mapAttrsToList
|
||||
(k: v:
|
||||
if builtins.isList v
|
||||
then lib.mapConcatStringsSep "\n" (v': "${k}=${v'}") v
|
||||
else "${k}=${v}")
|
||||
)
|
||||
(lib.concatStringsSep "\n")
|
||||
(pkgs.writeText "uptimed.conf")
|
||||
];
|
||||
in [
|
||||
"${configFile}:/var/lib/uptimed/uptimed.conf"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
15
base/vm.nix
15
base/vm.nix
@ -1,15 +0,0 @@
|
||||
{ lib, ... }:
|
||||
|
||||
# This enables
|
||||
# lib.mkIf (!config.virtualisation.isVmVariant) { ... }
|
||||
|
||||
{
|
||||
options.virtualisation.isVmVariant = lib.mkOption {
|
||||
description = "`true` if system is build with 'nixos-rebuild build-vm'";
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
};
|
||||
config.virtualisation.vmVariant = {
|
||||
virtualisation.isVmVariant = true;
|
||||
};
|
||||
}
|
||||
72
flake.lock
generated
72
flake.lock
generated
@ -7,11 +7,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1745502102,
|
||||
"narHash": "sha256-LqhRwzvIVPEjH0TaPgwzqpyhW6DtCrvz7FnUJDoUZh8=",
|
||||
"lastModified": 1741786315,
|
||||
"narHash": "sha256-VT65AE2syHVj6v/DGB496bqBnu1PXrrzwlw07/Zpllc=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "ca27b88c88948d96feeee9ed814cbd34f53d0d70",
|
||||
"rev": "0d8c6ad4a43906d14abd5c60e0ffe7b587b213de",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -48,11 +48,11 @@
|
||||
"rust-overlay": "rust-overlay"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1746563623,
|
||||
"narHash": "sha256-5DxgNFpSgxft/sWraZnHIUlb4S3Io73SVS7FZCbWSUY=",
|
||||
"lastModified": 1736545379,
|
||||
"narHash": "sha256-PeTTmGumdOX3rd6OKI7QMCrZovCDkrckZbcHr+znxWA=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "4e0408887f80e61a90286ff630a7855b828ae421",
|
||||
"revCount": 45,
|
||||
"rev": "74f5316121776db2769385927ec0d0c2cc2b23e4",
|
||||
"revCount": 42,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
|
||||
},
|
||||
@ -124,43 +124,49 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1743881366,
|
||||
"narHash": "sha256-ScGA2IHPk9ugf9bqEZnp+YB/OJgrkZblnG/XLEKvJAo=",
|
||||
"lastModified": 1736531400,
|
||||
"narHash": "sha256-+X/HVI1AwoPcud28wI35XRrc1kDgkYdDUGABJBAkxDI=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "db2e4becf1b11e5dfd33de12a90a7d089fcf68ec",
|
||||
"revCount": 11,
|
||||
"rev": "e4dafd06b3d7e9e6e07617766e9c3743134571b7",
|
||||
"revCount": 7,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
|
||||
"url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
|
||||
},
|
||||
"original": {
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
|
||||
"url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1748615477,
|
||||
"narHash": "sha256-8sjG4sNIonQPK2olCGvq3/j1qtjwPaTOFU5nkz1gj2Q=",
|
||||
"rev": "97d3ce1ceb663a24184aac92b7e9e8f5452111c1",
|
||||
"type": "tarball",
|
||||
"url": "https://releases.nixos.org/nixos/24.11-small/nixos-24.11.718472.97d3ce1ceb66/nixexprs.tar.xz?rev=97d3ce1ceb663a24184aac92b7e9e8f5452111c1"
|
||||
"lastModified": 1741969460,
|
||||
"narHash": "sha256-SCNxTTBfMJV7XuTcLUfdAd6cgCGsazzi+DoPrceQrZ0=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "68612419aa6c9fd5b178b81e6fabbdf46d300ea4",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
"url": "https://nixos.org/channels/nixos-24.11-small/nixexprs.tar.xz"
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-24.11-small",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1748588304,
|
||||
"narHash": "sha256-YCnUqO9k39p0oMIBndxYTbu8m0fOA/KVcq3IekXPy9c=",
|
||||
"rev": "b8af95f4cf511c5f056b463c3a45d2b63c7cfb03",
|
||||
"type": "tarball",
|
||||
"url": "https://releases.nixos.org/nixos/unstable-small/nixos-25.11pre807945.b8af95f4cf51/nixexprs.tar.xz?rev=b8af95f4cf511c5f056b463c3a45d2b63c7cfb03"
|
||||
"lastModified": 1741960758,
|
||||
"narHash": "sha256-pSGMbfkxF7TSeco54W+B1q+g22YCVp1qXHgtrdgtyR4=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "845dc1e9cbc2e48640b8968af58b4a19db67aa8f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
"url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-unstable-small",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"pvv-calendar-bot": {
|
||||
@ -227,11 +233,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1746498961,
|
||||
"narHash": "sha256-rp+oh/N88JKHu7ySPuGiA3lBUVIsrOtHbN2eWJdYCgk=",
|
||||
"lastModified": 1729391507,
|
||||
"narHash": "sha256-as0I9xieJUHf7kiK2a9znDsVZQTFWhM1pLivII43Gi0=",
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"rev": "24b00064cdd1d7ba25200c4a8565dc455dc732ba",
|
||||
"rev": "784981a9feeba406de38c1c9a3decf966d853cca",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -247,11 +253,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1745310711,
|
||||
"narHash": "sha256-ePyTpKEJTgX0gvgNQWd7tQYQ3glIkbqcW778RpHlqgA=",
|
||||
"lastModified": 1741861888,
|
||||
"narHash": "sha256-ynOgXAyToeE1UdLNfrUn/hL7MN0OpIS2BtNdLjpjPf0=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "5e3e92b16d6fdf9923425a8d4df7496b2434f39c",
|
||||
"rev": "d016ce0365b87d848a57c12ffcfdc71da7a2b55f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
25
flake.nix
25
flake.nix
@ -2,8 +2,8 @@
|
||||
description = "PVV System flake";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "https://nixos.org/channels/nixos-24.11-small/nixexprs.tar.xz";
|
||||
nixpkgs-unstable.url = "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz";
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11-small"; # remember to also update the url in base/services/auto-upgrade.nix
|
||||
nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
|
||||
|
||||
sops-nix.url = "github:Mic92/sops-nix";
|
||||
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
||||
@ -20,7 +20,7 @@
|
||||
matrix-next.url = "github:dali99/nixos-matrix-modules/0.7.0";
|
||||
matrix-next.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git";
|
||||
nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git";
|
||||
nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git";
|
||||
@ -71,11 +71,6 @@
|
||||
|
||||
pkgs = import nixpkgs {
|
||||
inherit system;
|
||||
config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
|
||||
[
|
||||
"nvidia-x11"
|
||||
"nvidia-settings"
|
||||
];
|
||||
overlays = [
|
||||
# Global overlays go here
|
||||
] ++ config.overlays or [ ];
|
||||
@ -91,7 +86,6 @@
|
||||
modules = [
|
||||
inputs.matrix-next.nixosModules.default
|
||||
inputs.pvv-calendar-bot.nixosModules.default
|
||||
self.nixosModules.gickup
|
||||
];
|
||||
overlays = [
|
||||
inputs.pvv-calendar-bot.overlays.x86_64-linux.default
|
||||
@ -120,7 +114,6 @@
|
||||
ildkule = stableNixosConfig "ildkule" { };
|
||||
#ildkule-unstable = unstableNixosConfig "ildkule" { };
|
||||
shark = stableNixosConfig "shark" { };
|
||||
wenche = stableNixosConfig "wenche" { };
|
||||
|
||||
kommode = stableNixosConfig "kommode" {
|
||||
overlays = [
|
||||
@ -165,20 +158,10 @@
|
||||
snakeoil-certs = ./modules/snakeoil-certs.nix;
|
||||
snappymail = ./modules/snappymail.nix;
|
||||
robots-txt = ./modules/robots-txt.nix;
|
||||
gickup = ./modules/gickup;
|
||||
};
|
||||
|
||||
devShells = forAllSystems (system: {
|
||||
default = nixpkgs-unstable.legacyPackages.${system}.callPackage ./shell.nix { };
|
||||
cuda = let
|
||||
cuda-pkgs = import nixpkgs-unstable {
|
||||
inherit system;
|
||||
config = {
|
||||
allowUnfree = true;
|
||||
cudaSupport = true;
|
||||
};
|
||||
};
|
||||
in cuda-pkgs.callPackage ./shells/cuda.nix { };
|
||||
default = nixpkgs.legacyPackages.${system}.callPackage ./shell.nix { };
|
||||
});
|
||||
|
||||
packages = {
|
||||
|
||||
@ -214,11 +214,11 @@ in {
|
||||
"= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
|
||||
buildInputs = with pkgs; [ imagemagick ];
|
||||
} ''
|
||||
magick \
|
||||
${fp /assets/logo_blue_regular.png} \
|
||||
convert \
|
||||
-resize x64 \
|
||||
-gravity center \
|
||||
-crop 64x64+0+0 \
|
||||
${fp /assets/logo_blue_regular.png} \
|
||||
-flatten \
|
||||
-colors 256 \
|
||||
-background transparent \
|
||||
|
||||
@ -67,12 +67,7 @@ in {
|
||||
ADMIN_NAME = "PVV Drift";
|
||||
ADMIN_EMAIL = "drift@pvv.ntnu.no";
|
||||
ADMIN_PASSWORD = includeFromSops "simplesamlphp/admin_password";
|
||||
TRUSTED_DOMAINS = [
|
||||
"www.pvv.ntnu.no"
|
||||
"pvv.ntnu.no"
|
||||
"www.pvv.org"
|
||||
"pvv.org"
|
||||
];
|
||||
TRUSTED_DOMAINS = [ cfg.domainName ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@ -53,7 +53,7 @@ in {
|
||||
|
||||
echo "Creating thumbnail for $fname"
|
||||
mkdir -p $(dirname ".thumbnails/$fname")
|
||||
magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
|
||||
convert -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
|
||||
touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
|
||||
done <<< "$images"
|
||||
'';
|
||||
|
||||
@ -7,10 +7,10 @@
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
./services/nginx
|
||||
|
||||
./services/calendar-bot.nix
|
||||
./services/git-mirrors
|
||||
./services/mysql.nix
|
||||
./services/postgres.nix
|
||||
./services/mysql.nix
|
||||
./services/calendar-bot.nix
|
||||
|
||||
./services/matrix
|
||||
];
|
||||
|
||||
@ -1,100 +0,0 @@
|
||||
{ config, pkgs, lib, fp, ... }:
|
||||
let
|
||||
cfg = config.services.gickup;
|
||||
in
|
||||
{
|
||||
sops.secrets."gickup/github-token" = {
|
||||
owner = "gickup";
|
||||
};
|
||||
|
||||
services.gickup = {
|
||||
enable = true;
|
||||
|
||||
dataDir = "/data/gickup";
|
||||
|
||||
destinationSettings = {
|
||||
structured = true;
|
||||
zip = false;
|
||||
keep = 10;
|
||||
bare = true;
|
||||
lfs = false;
|
||||
};
|
||||
|
||||
instances = let
|
||||
defaultGithubConfig = {
|
||||
settings.token_file = config.sops.secrets."gickup/github-token".path;
|
||||
};
|
||||
defaultGitlabConfig = {
|
||||
# settings.token_file = ...
|
||||
};
|
||||
in {
|
||||
"github:Git-Mediawiki/Git-Mediawiki" = defaultGithubConfig;
|
||||
"github:NixOS/nixpkgs" = defaultGithubConfig;
|
||||
"github:go-gitea/gitea" = defaultGithubConfig;
|
||||
"github:heimdal/heimdal" = defaultGithubConfig;
|
||||
"github:saltstack/salt" = defaultGithubConfig;
|
||||
"github:typst/typst" = defaultGithubConfig;
|
||||
"github:unmojang/FjordLauncher" = defaultGithubConfig;
|
||||
"github:unmojang/drasl" = defaultGithubConfig;
|
||||
"github:yushijinhun/authlib-injector" = defaultGithubConfig;
|
||||
|
||||
"gitlab:mx-puppet/discord/better-discord.js" = defaultGitlabConfig;
|
||||
"gitlab:mx-puppet/discord/discord-markdown" = defaultGitlabConfig;
|
||||
"gitlab:mx-puppet/discord/matrix-discord-parser" = defaultGitlabConfig;
|
||||
"gitlab:mx-puppet/discord/mx-puppet-discord" = defaultGitlabConfig;
|
||||
"gitlab:mx-puppet/mx-puppet-bridge" = defaultGitlabConfig;
|
||||
|
||||
"any:glibc" = {
|
||||
settings.url = "https://sourceware.org/git/glibc.git";
|
||||
};
|
||||
|
||||
"any:out-of-your-element" = {
|
||||
settings.url = "https://gitdab.com/cadence/out-of-your-element.git";
|
||||
};
|
||||
|
||||
"any:out-of-your-element-module" = {
|
||||
settings.url = "https://cgit.rory.gay/nix/OOYE-module.git";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.cgit = let
|
||||
domain = "mirrors.pvv.ntnu.no";
|
||||
in {
|
||||
${domain} = {
|
||||
enable = true;
|
||||
package = pkgs.callPackage (fp /packages/cgit.nix) { };
|
||||
group = "gickup";
|
||||
scanPath = "${cfg.dataDir}/linktree";
|
||||
settings = {
|
||||
enable-commit-graph = true;
|
||||
enable-follow-links = true;
|
||||
enable-http-clone = true;
|
||||
enable-remote-branches = true;
|
||||
clone-url = "https://${domain}/$CGIT_REPO_URL";
|
||||
remove-suffix = true;
|
||||
root-title = "PVVSPPP";
|
||||
root-desc = "PVV Speiler Praktisk og Prominent Programvare";
|
||||
snapshots = "all";
|
||||
logo = "/PVV-logo.png";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."mirrors.pvv.ntnu.no" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
|
||||
locations."= /PVV-logo.png".alias = let
|
||||
small-pvv-logo = pkgs.runCommandLocal "pvv-logo-96x96" {
|
||||
nativeBuildInputs = [ pkgs.imagemagick ];
|
||||
} ''
|
||||
magick '${fp /assets/logo_blue_regular.svg}' -resize 96x96 PNG:"$out"
|
||||
'';
|
||||
in toString small-pvv-logo;
|
||||
};
|
||||
|
||||
systemd.services."fcgiwrap-cgit-mirrors.pvv.ntnu.no" = {
|
||||
serviceConfig.BindReadOnlyPaths = [ cfg.dataDir ];
|
||||
};
|
||||
}
|
||||
@ -8,7 +8,7 @@
|
||||
|
||||
(fp /modules/grzegorz.nix)
|
||||
];
|
||||
services.spotifyd.enable = true;
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
|
||||
@ -3,12 +3,7 @@ let
|
||||
cfg = config.services.gitea;
|
||||
in
|
||||
{
|
||||
services.gitea-themes = {
|
||||
monokai = pkgs.gitea-theme-monokai;
|
||||
earl-grey = pkgs.gitea-theme-earl-grey;
|
||||
pitch-black = pkgs.gitea-theme-pitch-black;
|
||||
catppuccin = pkgs.gitea-theme-catppuccin;
|
||||
};
|
||||
services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
|
||||
|
||||
systemd.services.gitea-customization = lib.mkIf cfg.enable {
|
||||
description = "Install extra customization in gitea's CUSTOM_DIR";
|
||||
@ -43,6 +38,10 @@ in
|
||||
# Bigger icons
|
||||
install -Dm444 "${cfg.package.src}/templates/repo/icon.tmpl" "$out/repo/icon.tmpl"
|
||||
sed -i -e 's/24/48/g' "$out/repo/icon.tmpl"
|
||||
|
||||
# Show license in list view
|
||||
patch -i ${./licenses-in-repo-list.diff} "${cfg.package.src}/templates/explore/repo_list.tmpl" -o repo_list.tmpl
|
||||
install -Dm444 repo_list.tmpl "$out/explore/repo_list.tmpl"
|
||||
'';
|
||||
in ''
|
||||
install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
|
||||
|
||||
@ -0,0 +1,6 @@
|
||||
33a34,38
|
||||
> {{if .DetectedRepoLicenses}}
|
||||
> <a class="flex-text-inline" href="{{.RepoLink}}/src/{{.Repository.DefaultBranch}}/{{PathEscapeSegments .LicenseFileName}}" title="{{StringUtils.Join .DetectedRepoLicenses ", "}}">
|
||||
> {{svg "octicon-law"}} {{if eq (len .DetectedRepoLicenses) 1}}{{index .DetectedRepoLicenses 0}}{{else}}{{ctx.Locale.Tr "repo.multiple_licenses"}}{{end}}
|
||||
> </a>
|
||||
> {{end}}
|
||||
@ -49,10 +49,6 @@ in {
|
||||
START_LFS_SERVER = true;
|
||||
LANDING_PAGE = "explore";
|
||||
};
|
||||
"git.timeout" = {
|
||||
MIGRATE = 3600;
|
||||
MIRROR = 1800;
|
||||
};
|
||||
mailer = {
|
||||
ENABLED = true;
|
||||
FROM = "gitea@pvv.ntnu.no";
|
||||
@ -140,7 +136,6 @@ in {
|
||||
|
||||
dump = {
|
||||
enable = true;
|
||||
interval = "weekly";
|
||||
type = "tar.gz";
|
||||
};
|
||||
};
|
||||
|
||||
@ -1,39 +0,0 @@
|
||||
{ config, fp, pkgs, values, lib, ... }:
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
|
||||
(fp /misc/builder.nix)
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = fp /secrets/wenche/wenche.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
|
||||
networking.hostName = "wenche"; # Define your hostname.
|
||||
|
||||
systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "ens18";
|
||||
address = with values.hosts.wenche; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||
};
|
||||
|
||||
hardware.graphics.enable = true;
|
||||
services.xserver.videoDrivers = [ "nvidia" ];
|
||||
hardware.nvidia = {
|
||||
modesetting.enable = true;
|
||||
open = false;
|
||||
package = config.boot.kernelPackages.nvidiaPackages.production;
|
||||
};
|
||||
|
||||
# List packages installed in system profile
|
||||
environment.systemPackages = with pkgs; [
|
||||
];
|
||||
|
||||
system.stateVersion = "24.11"; # Did you read the comment?
|
||||
}
|
||||
@ -1,27 +0,0 @@
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "nvidia" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/4e8ecdd2-d453-4fff-b952-f06da00f3b85";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices = [ {
|
||||
device = "/var/lib/swapfile";
|
||||
size = 16*1024;
|
||||
} ];
|
||||
|
||||
networking.useDHCP = lib.mkDefault false;
|
||||
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
}
|
||||
57
justfile
57
justfile
@ -1,56 +1,25 @@
|
||||
set positional-arguments # makes variables accesible as $1 $2 $@
|
||||
export GUM_FILTER_HEIGHT := "15"
|
||||
nom := `if [[ -t 1 ]] && command -v nom >/dev/null; then echo nom; else echo nix; fi`
|
||||
nix_eval_opts := "--log-format raw --option warn-dirty false"
|
||||
nom := `if command -v nom >/dev/null; then echo nom; else echo nix; fi`
|
||||
|
||||
@_default:
|
||||
just "$(gum choose --ordered --header "Pick a recipie..." $(just --summary --unsorted))"
|
||||
|
||||
check *_:
|
||||
nix flake check --keep-going "$@"
|
||||
check:
|
||||
nix flake check --keep-going
|
||||
|
||||
build-machine machine=`just _a_machine` *_:
|
||||
{{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel "${@:2}"
|
||||
build-machine machine=`just _a_machine`:
|
||||
{{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel
|
||||
|
||||
run-vm machine=`just _a_machine` *_:
|
||||
nixos-rebuild build-vm --flake .#{{ machine }} "${@:2}"
|
||||
run-vm machine=`just _a_machine`:
|
||||
nixos-rebuild build-vm --flake .#{{ machine }}
|
||||
QEMU_NET_OPTS="hostfwd=tcp::8080-:80,hostfwd=tcp::8081-:443,hostfwd=tcp::2222-:22" ./result/bin/run-*-vm
|
||||
|
||||
@update-inputs *_:
|
||||
@git reset flake.lock
|
||||
@git restore flake.lock
|
||||
nix eval {{nix_eval_opts}} --file flake.nix --apply 'x: builtins.attrNames x.inputs' --json \
|
||||
| { printf "%s\n" --commit-lock-file; jq '.[]' -r | grep -vxF "self" ||:; } \
|
||||
| gum choose --no-limit --header "Choose extra arguments:" \
|
||||
| tee >(xargs -d'\n' echo + nix flake update "$@" >&2) \
|
||||
| xargs -d'\n' nix flake update "$@"
|
||||
|
||||
@repl $machine=`just _a_machine` *_:
|
||||
set -v; nixos-rebuild --flake .#"$machine" repl "${@:2}"
|
||||
|
||||
@eval $machine=`just _a_machine` $attrpath="system.build.toplevel.outPath" *_:
|
||||
set -v; nix eval {{nix_eval_opts}} ".#nixosConfigurations.\"$machine\".config.$attrpath" --show-trace "${@:3}"
|
||||
|
||||
@eval-vm $machine=`just _a_machine` $attrpath="system.build.toplevel.outPath" *_:
|
||||
just eval "$machine" "virtualisation.vmVariant.$attrpath" "${@:3}"
|
||||
@update-inputs:
|
||||
nix eval .#inputs --apply builtins.attrNames --json \
|
||||
| jq '.[]' -r \
|
||||
| gum choose --no-limit --height=15 \
|
||||
| xargs -L 1 nix flake lock --update-input
|
||||
|
||||
|
||||
# helpers
|
||||
|
||||
[no-exit-message]
|
||||
_a_machine:
|
||||
#!/usr/bin/env -S sh -euo pipefail
|
||||
machines="$(
|
||||
nix eval {{nix_eval_opts}} .#nixosConfigurations --apply builtins.attrNames --json | jq .[] -r
|
||||
)"
|
||||
[ -n "$machines" ] || { echo >&2 "ERROR: no machines found"; false; }
|
||||
if [ -s .direnv/vars/last-machine.txt ]; then
|
||||
machines="$(
|
||||
grep <<<"$machines" -xF "$(cat .direnv/vars/last-machine.txt)" ||:
|
||||
grep <<<"$machines" -xFv "$(cat .direnv/vars/last-machine.txt)" ||:
|
||||
)"
|
||||
fi
|
||||
choice="$(gum filter <<<"$machines")"
|
||||
mkdir -p .direnv/vars
|
||||
cat <<<"$choice" >.direnv/vars/last-machine.txt
|
||||
cat <<<"$choice"
|
||||
nix eval .#nixosConfigurations --apply builtins.attrNames --json | jq .[] -r | gum filter
|
||||
|
||||
@ -1,310 +0,0 @@
|
||||
{ config, pkgs, lib, utils, ... }:
|
||||
let
|
||||
cfg = config.services.gickup;
|
||||
format = pkgs.formats.yaml { };
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./set-description.nix
|
||||
./hardlink-files.nix
|
||||
./import-from-toml.nix
|
||||
./update-linktree.nix
|
||||
];
|
||||
|
||||
options.services.gickup = {
|
||||
enable = lib.mkEnableOption "gickup, a git repository mirroring service";
|
||||
|
||||
package = lib.mkPackageOption pkgs "gickup" { };
|
||||
gitPackage = lib.mkPackageOption pkgs "git" { };
|
||||
gitLfsPackage = lib.mkPackageOption pkgs "git-lfs" { };
|
||||
|
||||
dataDir = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "The directory to mirror repositories to.";
|
||||
default = "/var/lib/gickup";
|
||||
example = "/data/gickup";
|
||||
};
|
||||
|
||||
destinationSettings = lib.mkOption {
|
||||
description = ''
|
||||
Settings for destination local, see gickup configuration file
|
||||
|
||||
Note that `path` will be set automatically to `/var/lib/gickup`
|
||||
'';
|
||||
type = lib.types.submodule {
|
||||
freeformType = format.type;
|
||||
};
|
||||
default = { };
|
||||
example = {
|
||||
structured = true;
|
||||
zip = false;
|
||||
keep = 10;
|
||||
bare = true;
|
||||
lfs = true;
|
||||
};
|
||||
};
|
||||
|
||||
instances = lib.mkOption {
|
||||
type = lib.types.attrsOf (lib.types.submodule (submoduleInputs@{ name, ... }: let
|
||||
submoduleName = name;
|
||||
|
||||
nameParts = rec {
|
||||
repoType = builtins.head (lib.splitString ":" submoduleName);
|
||||
|
||||
owner = if repoType == "any"
|
||||
then null
|
||||
else lib.pipe submoduleName [
|
||||
(lib.removePrefix "${repoType}:")
|
||||
(lib.splitString "/")
|
||||
builtins.head
|
||||
];
|
||||
|
||||
repo = if repoType == "any"
|
||||
then null
|
||||
else lib.pipe submoduleName [
|
||||
(lib.removePrefix "${repoType}:")
|
||||
(lib.splitString "/")
|
||||
lib.last
|
||||
];
|
||||
|
||||
slug = if repoType == "any"
|
||||
then lib.toLower (builtins.replaceStrings [ ":" "/" ] [ "-" "-" ] submoduleName)
|
||||
else "${lib.toLower repoType}-${lib.toLower owner}-${lib.toLower repo}";
|
||||
};
|
||||
in {
|
||||
options = {
|
||||
interval = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "daily";
|
||||
example = "weekly";
|
||||
description = ''
|
||||
Specification (in the format described by {manpage}`systemd.time(7)`) of the time
|
||||
interval at which to run the service.
|
||||
'';
|
||||
};
|
||||
|
||||
type = lib.mkOption {
|
||||
type = lib.types.enum [
|
||||
"github"
|
||||
"gitlab"
|
||||
"gitea"
|
||||
"gogs"
|
||||
"bitbucket"
|
||||
"onedev"
|
||||
"sourcehut"
|
||||
"any"
|
||||
];
|
||||
example = "github";
|
||||
default = nameParts.repoType;
|
||||
description = ''
|
||||
The type of the repository to mirror.
|
||||
'';
|
||||
};
|
||||
|
||||
owner = lib.mkOption {
|
||||
type = with lib.types; nullOr str;
|
||||
example = "go-gitea";
|
||||
default = nameParts.owner;
|
||||
description = ''
|
||||
The owner of the repository to mirror (if applicable)
|
||||
'';
|
||||
};
|
||||
|
||||
repo = lib.mkOption {
|
||||
type = with lib.types; nullOr str;
|
||||
example = "gitea";
|
||||
default = nameParts.repo;
|
||||
description = ''
|
||||
The name of the repository to mirror (if applicable)
|
||||
'';
|
||||
};
|
||||
|
||||
slug = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = nameParts.slug;
|
||||
example = "github-go-gitea-gitea";
|
||||
description = ''
|
||||
The slug of the repository to mirror.
|
||||
'';
|
||||
};
|
||||
|
||||
description = lib.mkOption {
|
||||
type = with lib.types; nullOr str;
|
||||
example = "A project which does this and that";
|
||||
description = ''
|
||||
A description of the project. This isn't used directly by gickup for anything,
|
||||
but can be useful if gickup is used together with cgit or similar.
|
||||
'';
|
||||
};
|
||||
|
||||
settings = lib.mkOption {
|
||||
description = "Instance specific settings, see gickup configuration file";
|
||||
type = lib.types.submodule {
|
||||
freeformType = format.type;
|
||||
};
|
||||
default = { };
|
||||
example = {
|
||||
username = "gickup";
|
||||
password = "hunter2";
|
||||
wiki = true;
|
||||
issues = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}));
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
users.users.gickup = {
|
||||
isSystemUser = true;
|
||||
group = "gickup";
|
||||
home = "/var/lib/gickup";
|
||||
};
|
||||
|
||||
users.groups.gickup = { };
|
||||
|
||||
services.gickup.destinationSettings.path = "/var/lib/gickup/raw";
|
||||
|
||||
systemd.tmpfiles.settings."10-gickup" = lib.mkIf (cfg.dataDir != "/var/lib/gickup") {
|
||||
${cfg.dataDir}.d = {
|
||||
user = "gickup";
|
||||
group = "gickup";
|
||||
mode = "0755";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.slices."system-gickup" = {
|
||||
description = "Gickup git repository mirroring service";
|
||||
after = [ "network.target" ];
|
||||
};
|
||||
|
||||
systemd.targets.gickup = {
|
||||
description = "Gickup git repository mirroring service";
|
||||
wants = map ({ slug, ... }: "gickup@${slug}.service") (lib.attrValues cfg.instances);
|
||||
};
|
||||
|
||||
systemd.timers = {
|
||||
"gickup@" = {
|
||||
description = "Gickup git repository mirroring service for %i";
|
||||
|
||||
timerConfig = {
|
||||
OnCalendar = "daily";
|
||||
RandomizedDelaySec = "1h";
|
||||
Persistent = true;
|
||||
AccuracySec = "1s";
|
||||
};
|
||||
};
|
||||
}
|
||||
//
|
||||
# Overrides for mirrors which are not "daily"
|
||||
(lib.pipe cfg.instances [
|
||||
builtins.attrValues
|
||||
(builtins.filter (instance: instance.interval != "daily"))
|
||||
(map ({ slug, interval, ... }: {
|
||||
name = "gickup@${slug}";
|
||||
value = {
|
||||
overrideStrategy = "asDropin";
|
||||
timerConfig.OnCalendar = interval;
|
||||
};
|
||||
}))
|
||||
builtins.listToAttrs
|
||||
]);
|
||||
|
||||
systemd.targets.timers.wants = map ({ slug, ... }: "gickup@${slug}.timer") (lib.attrValues cfg.instances);
|
||||
|
||||
systemd.services = {
|
||||
"gickup@" = let
|
||||
configDir = lib.pipe cfg.instances [
|
||||
(lib.mapAttrsToList (name: instance: {
|
||||
name = "${instance.slug}.yml";
|
||||
path = format.generate "gickup-configuration-${name}.yml" {
|
||||
destination.local = [ cfg.destinationSettings ];
|
||||
source.${instance.type} = [
|
||||
(
|
||||
(lib.optionalAttrs (instance.type != "any") {
|
||||
user = instance.owner;
|
||||
includeorgs = [ instance.owner ];
|
||||
include = [ instance.repo ];
|
||||
})
|
||||
//
|
||||
instance.settings
|
||||
)
|
||||
];
|
||||
};
|
||||
}))
|
||||
(pkgs.linkFarm "gickup-configuration-files")
|
||||
];
|
||||
in {
|
||||
description = "Gickup git repository mirroring service for %i";
|
||||
after = [ "network.target" ];
|
||||
|
||||
path = [
|
||||
cfg.gitPackage
|
||||
cfg.gitLfsPackage
|
||||
];
|
||||
|
||||
restartIfChanged = false;
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = "'${pkgs.gickup}/bin/gickup' '${configDir}/%i.yml'";
|
||||
ExecStartPost = "";
|
||||
|
||||
User = "gickup";
|
||||
Group = "gickup";
|
||||
|
||||
BindPaths = lib.optionals (cfg.dataDir != "/var/lib/gickup") [
|
||||
"${cfg.dataDir}:/var/lib/gickup"
|
||||
];
|
||||
|
||||
Slice = "system-gickup.slice";
|
||||
|
||||
SyslogIdentifier = "gickup-%i";
|
||||
StateDirectory = "gickup";
|
||||
# WorkingDirectory = "gickup";
|
||||
# RuntimeDirectory = "gickup";
|
||||
# RuntimeDirectoryMode = "0700";
|
||||
|
||||
# https://discourse.nixos.org/t/how-to-prevent-custom-systemd-service-from-restarting-on-nixos-rebuild-switch/43431
|
||||
RemainAfterExit = true;
|
||||
|
||||
# Hardening options
|
||||
AmbientCapabilities = [];
|
||||
LockPersonality = true;
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateMounts = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProcSubset = "pid";
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
# ProtectProc = "invisible";
|
||||
# ProtectSystem = "strict";
|
||||
RemoveIPC = true;
|
||||
RestrictAddressFamilies = [
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
# SystemCallFilter = [
|
||||
# "@system-service"
|
||||
# "~@resources"
|
||||
# "~@privileged"
|
||||
# ];
|
||||
UMask = "0002";
|
||||
CapabilityBoundingSet = [];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@ -1,42 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.gickup;
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
# TODO: add a service that will look at the backed up files and hardlink
|
||||
# the ones that have a matching hash together to save space. This can
|
||||
# either run routinely (i.e. trigger by systemd-timer), or be activated
|
||||
# whenever a gickup@<slug>.service finishes. The latter is probably better.
|
||||
|
||||
# systemd.services."gickup-hardlink" = {
|
||||
# serviceConfig = {
|
||||
# Type = "oneshot";
|
||||
# ExecStart = let
|
||||
# script = pkgs.writeShellApplication {
|
||||
# name = "gickup-hardlink-files.sh";
|
||||
# runtimeInputs = [ pkgs.coreutils pkgs.jdupes ];
|
||||
# text = ''
|
||||
|
||||
# '';
|
||||
# };
|
||||
# in lib.getExe script;
|
||||
|
||||
# User = "gickup";
|
||||
# Group = "gickup";
|
||||
|
||||
# BindPaths = lib.optionals (cfg.dataDir != "/var/lib/gickup") [
|
||||
# "${cfg.dataDir}:/var/lib/gickup"
|
||||
# ];
|
||||
|
||||
# Slice = "system-gickup.slice";
|
||||
|
||||
# StateDirectory = "gickup";
|
||||
|
||||
# # Hardening options
|
||||
# # TODO:
|
||||
# PrivateNetwork = true;
|
||||
# };
|
||||
# };
|
||||
};
|
||||
}
|
||||
@ -1,11 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.gickup;
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
# TODO: import cfg.instances from a toml file to make it easier for non-nix users
|
||||
# to add repositories to mirror
|
||||
};
|
||||
}
|
||||
@ -1,9 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.gickup;
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
# TODO: create .git/description files for each repo where cfg.instances.<instance>.description is set
|
||||
};
|
||||
}
|
||||
@ -1,84 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.gickup;
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
# TODO: run upon completion of cloning a repository
|
||||
systemd.timers."gickup-linktree" = {
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnCalendar = "daily";
|
||||
Persistent = true;
|
||||
Unit = "gickup-linktree.service";
|
||||
};
|
||||
};
|
||||
|
||||
# TODO: update symlink for one repo at a time (e.g. gickup-linktree@<instance>.service)
|
||||
systemd.services."gickup-linktree" = {
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = let
|
||||
script = pkgs.writeShellApplication {
|
||||
name = "gickup-update-symlink-tree.sh";
|
||||
runtimeInputs = [
|
||||
pkgs.coreutils
|
||||
pkgs.findutils
|
||||
];
|
||||
text = ''
|
||||
shopt -s nullglob
|
||||
|
||||
for repository in ./*/*/*; do
|
||||
REPOSITORY_RELATIVE_DIRS=''${repository#"./"}
|
||||
|
||||
echo "Checking $REPOSITORY_RELATIVE_DIRS"
|
||||
|
||||
declare -a REVISIONS
|
||||
readarray -t REVISIONS < <(find "$repository" -mindepth 1 -maxdepth 1 -printf "%f\n" | sort --numeric-sort --reverse)
|
||||
|
||||
if [[ "''${#REVISIONS[@]}" == 0 ]]; then
|
||||
echo "Found no revisions for $repository, continuing"
|
||||
continue
|
||||
fi
|
||||
|
||||
LAST_REVISION="''${REVISIONS[0]}"
|
||||
SYMLINK_PATH="../linktree/''${REPOSITORY_RELATIVE_DIRS}"
|
||||
|
||||
mkdir -p "$(dirname "$SYMLINK_PATH")"
|
||||
|
||||
EXPECTED_SYMLINK_TARGET=$(realpath "''${repository}/''${LAST_REVISION}")
|
||||
EXISTING_SYMLINK_TARGET=$(realpath "$SYMLINK_PATH" || echo "<none>")
|
||||
|
||||
if [[ "$EXISTING_SYMLINK_TARGET" != "$EXPECTED_SYMLINK_TARGET" ]]; then
|
||||
echo "Updating symlink for $REPOSITORY_RELATIVE_DIRS"
|
||||
rm "$SYMLINK_PATH" ||:
|
||||
ln -rs "$EXPECTED_SYMLINK_TARGET" "$SYMLINK_PATH"
|
||||
else
|
||||
echo "Symlink already up to date, continuing..."
|
||||
fi
|
||||
|
||||
echo "---"
|
||||
done
|
||||
'';
|
||||
};
|
||||
in lib.getExe script;
|
||||
|
||||
User = "gickup";
|
||||
Group = "gickup";
|
||||
|
||||
BindPaths = lib.optionals (cfg.dataDir != "/var/lib/gickup") [
|
||||
"${cfg.dataDir}:/var/lib/gickup"
|
||||
];
|
||||
|
||||
Slice = "system-gickup.slice";
|
||||
|
||||
StateDirectory = "gickup";
|
||||
WorkingDirectory = "/var/lib/gickup/raw";
|
||||
|
||||
# Hardening options
|
||||
# TODO:
|
||||
PrivateNetwork = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@ -13,11 +13,6 @@ in {
|
||||
enablePipewire = true;
|
||||
};
|
||||
|
||||
systemd.user.services.restart-greg-ng = {
|
||||
script = "systemctl --user restart greg-ng.service";
|
||||
startAt = "*-*-* 06:30:00";
|
||||
};
|
||||
|
||||
services.grzegorz-webui = {
|
||||
enable = true;
|
||||
listenAddr = "localhost";
|
||||
@ -46,15 +41,6 @@ in {
|
||||
allow 2001:700:300:1900::/64;
|
||||
deny all;
|
||||
'';
|
||||
|
||||
locations."/docs" = {
|
||||
proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
|
||||
};
|
||||
|
||||
locations."/api" = {
|
||||
proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
|
||||
"${machine}-backend.pvv.ntnu.no" = {
|
||||
|
||||
@ -1,21 +0,0 @@
|
||||
{ cgit, fetchurl, ... }:
|
||||
let
|
||||
pname = cgit.pname;
|
||||
commit = "09d24d7cd0b7e85633f2f43808b12871bb209d69";
|
||||
in
|
||||
cgit.overrideAttrs (_: {
|
||||
version = "1.2.3-unstable-2024.07.16";
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://git.zx2c4.com/cgit/snapshot/${pname}-${commit}.tar.xz";
|
||||
hash = "sha256-gfgjAXnWRqVCP+4cmYOVdB/3OFOLJl2WBOc3bFVDsjw=";
|
||||
};
|
||||
|
||||
# cgit is tightly coupled with git and needs a git source tree to build.
|
||||
# IMPORTANT: Remember to check which git version cgit needs on every version
|
||||
# bump (look for "GIT_VER" in the top-level Makefile).
|
||||
gitSrc = fetchurl {
|
||||
url = "mirror://kernel/software/scm/git/git-2.46.0.tar.xz";
|
||||
hash = "sha256-fxI0YqKLfKPr4mB0hfcWhVTCsQ38FVx+xGMAZmrCf5U=";
|
||||
};
|
||||
})
|
||||
@ -3,8 +3,6 @@ calendar-bot:
|
||||
mysql_password: ENC[AES256_GCM,data:Gqag8yOgPH3ntoT5TmaqJWv1j+si2qIyz5Ryfw5E2A==,iv:kQDcxnPfwJQcFovI4f87UDt18F8ah3z5xeY86KmdCyY=,tag:A1sCSNXJziAmtUWohqwJgg==,type:str]
|
||||
mysql:
|
||||
password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
|
||||
gickup:
|
||||
github-token: ENC[AES256_GCM,data:H/yBDLIvEXunmaUha3c2vUWKLRIbl9QrC0t13AQDRCTnrvhabeiUFLNxZ/F+4B6sZ2aPSgZoB69WwnHvh1wLdiFp1qLWKW/jQPvzZOxE4n+jXrnSOutUWktbPzVj,iv:KFW4jRru93JIl9doVFtcNkJDWp89NlzWjPDflHxcL/U=,tag:YtgyRxkoZO9MkuP3DJh7zA==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
@ -65,8 +63,8 @@ sops:
|
||||
cTh5bnJ3WW90aXRCSUp6NHFYeU1tZ0kK4afdtJwGNu6wLRI0fuu+mBVeqVeB0rgX
|
||||
0q5hwyzjiRnHnyjF38CmcGgydSfDRmF6P+WIMbCwXC6LwfRhAmBGPg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2025-05-07T21:34:48Z"
|
||||
mac: ENC[AES256_GCM,data:n6GHD+nQmZL17WvUZiMCBLRHbtpoKU6U8o/Oraj0VSRi/pQ74QWGVEcIX87kFjBvR2C+UPd3KwXzjQHhjUfHpz9EjIGi6tXLTTo8K3ptd2wCL8MW418TVO4KV+BFmHGT4kwlbdoqaJ2SA7HcfXNaC68e/2CTXhtkLpIwGXtYWJA=,iv:iC5QX/JMwno4mBljPdorNmcQSD2wy/wOYvGrUoC2yzg=,tag:GuFNQ6+d6o9DYC6Do/IEqQ==,type:str]
|
||||
lastmodified: "2024-08-15T21:18:33Z"
|
||||
mac: ENC[AES256_GCM,data:uR5HgeDAYqoqB9kk1V6p0T30+v6WpQJi4+qIeCDRnoUPnQKUVR10hvBhICck+E+Uh8p+tGhM6Uf3YrAJAV0ZCUiNJjtwDJQQLUDT53vdOAXN4xADCQqNuhgVwVMaruoTheEiwOswRuhFeEwy0gBj3Ze2pu47lueHYclmEzumLeQ=,iv:t0UyXN2YaR2m7M/pV2wTLJG5wVfqTIUs7wSQMmyeTVw=,tag:O7dIffzrDAXz3kGx5uazhw==,type:str]
|
||||
pgp:
|
||||
- created_at: "2024-08-04T00:03:40Z"
|
||||
enc: |-
|
||||
@ -89,4 +87,4 @@ sops:
|
||||
-----END PGP MESSAGE-----
|
||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.9.4
|
||||
version: 3.9.0
|
||||
|
||||
@ -1,45 +0,0 @@
|
||||
# nix develop .#cuda
|
||||
# Copied from https://nixos.wiki/wiki/CUDA
|
||||
{ pkgs }:
|
||||
|
||||
pkgs.mkShell {
|
||||
name = "cuda-env-shell";
|
||||
buildInputs = with pkgs; [
|
||||
autoconf
|
||||
binutils
|
||||
curl
|
||||
freeglut
|
||||
git
|
||||
gitRepo
|
||||
gnumake
|
||||
gnupg
|
||||
gperf
|
||||
libGL
|
||||
libGLU
|
||||
m4
|
||||
ncurses5
|
||||
procps
|
||||
stdenv.cc
|
||||
unzip
|
||||
util-linux
|
||||
xorg.libX11
|
||||
xorg.libXext
|
||||
xorg.libXi
|
||||
xorg.libXmu
|
||||
xorg.libXrandr
|
||||
xorg.libXv
|
||||
zlib
|
||||
|
||||
cudatoolkit
|
||||
linuxPackages.nvidia_x11
|
||||
|
||||
# Other applications, like
|
||||
hashcat
|
||||
];
|
||||
|
||||
env = {
|
||||
CUDA_PATH = pkgs.cudatoolkit;
|
||||
EXTRA_LDFLAGS = "-L/lib -L${pkgs.linuxPackages.nvidia_x11}/lib";
|
||||
EXTRA_CCFLAGS = "-I/usr/include";
|
||||
};
|
||||
}
|
||||
@ -13,6 +13,7 @@
|
||||
bottom
|
||||
eza
|
||||
neovim
|
||||
diskonaut
|
||||
ripgrep
|
||||
tmux
|
||||
];
|
||||
|
||||
@ -68,10 +68,6 @@ in rec {
|
||||
ipv4 = pvv-ipv4 234;
|
||||
ipv6 = pvv-ipv6 234;
|
||||
};
|
||||
wenche = {
|
||||
ipv4 = pvv-ipv4 240;
|
||||
ipv6 = pvv-ipv6 240;
|
||||
};
|
||||
};
|
||||
|
||||
defaultNetworkConfig = {
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user