feat: add radicle to bekkalokk

base/default.nix

@@ -46,10 +46,6 @@
 
   system.nixos.tags = lib.optionals (inputs.self.sourceInfo ? dirtyRev) [ "dirty" ];
 
-  specialisation."auto-upgrade".configuration = {
-    system.nixos.tags = [ "auto" ];
-  };
-
   boot.tmp.cleanOnBoot = lib.mkDefault true;
   boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
 

base/services/auto-upgrade.nix

@@ -13,7 +13,6 @@ in
 
       "--refresh"
       "--no-write-lock-file"
-      "--specialisation auto-upgrade"
       # --update-input is deprecated since nix 2.22, and removed in lix 2.90
       # as such we instead use --override-input combined with --refresh
       # https://git.lix.systems/lix-project/lix/issues/400

hosts/bekkalokk/configuration.nix

@@ -7,7 +7,7 @@
 
     ./services/alps.nix
     ./services/bluemap.nix
-    ./services/radicale.nix
+    ./services/radicle.nix
     ./services/idp-simplesamlphp
     ./services/kerberos.nix
     ./services/mediawiki

hosts/bekkalokk/services/radicle.nix

@@ -37,4 +37,6 @@ in {
       proxyWebsockets = true;
     };
   };
+
+  networking.firewall.allowedTCPPorts = [ radicalePort ];
 }

hosts/bekkalokk/services/webmail/default.nix

@@ -10,9 +10,8 @@
     enableACME = true;
     kTLS = true;
     locations = {
-      # "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
+      "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
 
-      "/roundcube".return = "302 https://webmail.pvv.ntnu.no/";
       "/afterlogic_lite".return = "302 https://webmail.pvv.ntnu.no/roundcube";
       "/squirrelmail".return = "302 https://webmail.pvv.ntnu.no/roundcube";
       "/rainloop".return = "302 https://snappymail.pvv.ntnu.no/";

hosts/bekkalokk/services/webmail/roundcube.nix

@@ -29,7 +29,7 @@ in
 
     dicts = with pkgs.aspellDicts; [ en en-computers nb nn fr de it ];
     maxAttachmentSize = 20;
-    hostName = domain;
+    hostName = "roundcubeplaceholder.example.com";
 
     database = {
       host = "postgres.pvv.ntnu.no";
@@ -49,9 +49,44 @@ in
     '';
   };
 
-  # TODO: move this back to `webmail.pvv.ntnu.no/roundcube` subpath
+  services.nginx.virtualHosts."roundcubeplaceholder.example.com" = lib.mkForce { };
 
   services.nginx.virtualHosts.${domain} = {
     kTLS = true;
+    locations."/roundcube" = {
+      tryFiles = "$uri $uri/ =404";
+      index = "index.php";
+      root = pkgs.linkFarm "roundcube-dir" {
+        roundcube = "${cfg.package}";
+      };
+
+      extraConfig = ''
+        location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
+        # https://wiki.archlinux.org/title/Roundcube
+        "README"
+        "INSTALL"
+        "LICENSE"
+        "CHANGELOG"
+        "UPGRADING"
+        "bin"
+        "SQL"
+        ".+\\.md"
+        "\\."
+        "config"
+        "temp"
+        "logs"
+        ]})/? {
+          deny all;
+        }
+
+        location ~ ^/roundcube/(.+\.php)(/?.*)$ {
+          fastcgi_split_path_info ^/roundcube(/.+\.php)(/.+)$;
+          include ${config.services.nginx.package}/conf/fastcgi_params;
+          include ${config.services.nginx.package}/conf/fastcgi.conf;
+          fastcgi_index index.php;
+          fastcgi_pass unix:${config.services.phpfpm.pools.roundcube.socket};
+        }
+      '';
+    };
   };
 }

hosts/lupine/configuration.nix

@@ -9,12 +9,6 @@
 
   sops.defaultSopsFile = fp /secrets/lupine/lupine.yaml;
 
-  boot.binfmt.emulatedSystems = [
-    "aarch64-linux"
-    "armv7l-linux"
-    "i686-linux"
-  ];
-
   systemd.network.networks."30-enp0s31f6" = values.defaultNetworkConfig // {
     matchConfig.Name = "enp0s31f6";
     address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];