Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 oysteikt
|
94841751e1
|
||
|
oysteikt
|
0131e5af6d
|
@@ -7,13 +7,16 @@ jobs:
|
||||
evals:
|
||||
runs-on: debian-latest
|
||||
steps:
|
||||
- name: Install sudo
|
||||
run: apt-get install --update --assume-yes sudo
|
||||
|
||||
- uses: actions/checkout@v6
|
||||
|
||||
- name: Install sudo
|
||||
run: apt-get update && apt-get -y install sudo
|
||||
|
||||
- uses: https://github.com/cachix/install-nix-action@v31
|
||||
|
||||
- name: Configure Nix
|
||||
run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
|
||||
|
||||
- name: Build topology graph
|
||||
run: nix build .#topology -L
|
||||
|
||||
|
||||
@@ -6,11 +6,8 @@ jobs:
|
||||
evals:
|
||||
runs-on: debian-latest
|
||||
steps:
|
||||
- name: Install sudo
|
||||
run: apt-get install --update --assume-yes sudo
|
||||
|
||||
- uses: actions/checkout@v6
|
||||
|
||||
- run: apt-get update && apt-get -y install sudo
|
||||
- uses: https://github.com/cachix/install-nix-action@v31
|
||||
|
||||
- run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
|
||||
- run: nix flake check
|
||||
|
||||
+21
-8
@@ -10,17 +10,18 @@ keys:
|
||||
- &user_vegardbm age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
|
||||
|
||||
# Hosts
|
||||
- &host_bakke age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
|
||||
- &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
|
||||
- &host_bicep age19nk55kcs7s0358jpkn75xnr57dfq6fq3p43nartvsprx0su22v7qcgcjdx
|
||||
- &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
|
||||
- &host_kommode age1mt4d0hg5g76qp7j0884llemy0k2ymr5up8vfudz6vzvsflk5nptqqd32ly
|
||||
- &host_lupine-1 age18lta9d683yekz487xwtd99da236d8mgk4ftlmv2jffx858p9qf2s9j868l
|
||||
- &host_lupine-2 age1e0a4ru707v637wzmuxqv0xywmlkhunzgyfy4mrkjc7a23qq8msgq7nqtvt
|
||||
- &host_lupine-3 age1wmrrhd5deatmgflkas636u3rzuk46u9knl02v4t39ncs37xqquhq9vwzye
|
||||
- &host_lupine-4 age1ml48zztcmnrdrhrdsjrlyxf09jtmjgz46u8td4zm59wn3fm4g57qs4wg0l
|
||||
- &host_lupine-5 age12gws5nws69vxryd3kt7q0ayngch90efmhqcrfhnnsmj00lkgxd4qsdkvqn
|
||||
- &host_lupine-1 age1fkrypl6fu4ldsa7te4g3v4qsegnk7sd6qhkquuwzh04vguy96qus08902e
|
||||
- &host_lupine-2 age1mu0ej57n4s30ghealhyju3enls83qyjua69986la35t2yh0q2s0seruz5n
|
||||
- &host_lupine-3 age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
|
||||
- &host_lupine-4 age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
|
||||
- &host_lupine-5 age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
|
||||
- &host_skrott age1hlvwswsljxsvrtp4leuw8a8rf8l2q6y06xvxtafvzpq54xm9aegs0kqw2e
|
||||
- &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
|
||||
- &host_skrot age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr
|
||||
|
||||
creation_rules:
|
||||
# Global secrets
|
||||
@@ -121,10 +122,10 @@ creation_rules:
|
||||
pgp:
|
||||
- *user_oysteikt
|
||||
|
||||
- path_regex: secrets/skrot/[^/]+\.yaml$
|
||||
- path_regex: secrets/bakke/[^/]+\.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
- *host_skrot
|
||||
- *host_bakke
|
||||
- *user_danio
|
||||
- *user_felixalb
|
||||
- *user_pederbs_sopp
|
||||
@@ -133,3 +134,15 @@ creation_rules:
|
||||
- *user_vegardbm
|
||||
pgp:
|
||||
- *user_oysteikt
|
||||
|
||||
- path_regex: secrets/skrott/[^/]+\.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
- *host_skrott
|
||||
- *user_danio
|
||||
- *user_felixalb
|
||||
- *user_pederbs_sopp
|
||||
- *user_pederbs_nord
|
||||
- *user_pederbs_bjarte
|
||||
pgp:
|
||||
- *user_oysteikt
|
||||
|
||||
@@ -43,7 +43,7 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
|
||||
| [kommode][kom] | Virtual | Gitea + Gitea pages |
|
||||
| [lupine][lup] | Physical | Gitea CI/CD runners |
|
||||
| shark | Virtual | Test host for authentication, absolutely horrendous |
|
||||
| [skrot][skr] | Physical | Kiosk, snacks and soda |
|
||||
| [skrott][skr] | Physical | Kiosk, snacks and soda |
|
||||
| [wenche][wen] | Virtual | Nix-builders, general purpose compute |
|
||||
|
||||
## Documentation
|
||||
@@ -60,5 +60,5 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
|
||||
[ild]: https://wiki.pvv.ntnu.no/wiki/Maskiner/ildkule
|
||||
[kom]: https://wiki.pvv.ntnu.no/wiki/Maskiner/kommode
|
||||
[lup]: https://wiki.pvv.ntnu.no/wiki/Maskiner/lupine
|
||||
[skr]: https://wiki.pvv.ntnu.no/wiki/Maskiner/Skrot
|
||||
[skr]: https://wiki.pvv.ntnu.no/wiki/Maskiner/Skrott
|
||||
[wen]: https://wiki.pvv.ntnu.no/wiki/Maskiner/wenche
|
||||
|
||||
+2
-3
@@ -10,10 +10,7 @@
|
||||
(fp /users)
|
||||
(fp /modules/snakeoil-certs.nix)
|
||||
|
||||
./mitigations.nix
|
||||
|
||||
./flake-input-exporter.nix
|
||||
./hardening.nix
|
||||
./networking.nix
|
||||
./nix.nix
|
||||
./programs.nix
|
||||
@@ -71,6 +68,8 @@
|
||||
fi
|
||||
'';
|
||||
|
||||
# security.lockKernelModules = true;
|
||||
security.protectKernelImage = true;
|
||||
security.sudo.execWheelOnly = true;
|
||||
security.sudo.extraConfig = ''
|
||||
Defaults lecture = never
|
||||
|
||||
@@ -1,64 +0,0 @@
|
||||
{ ... }:
|
||||
{
|
||||
boot.blacklistedKernelModules = [
|
||||
# Obscure network protocols
|
||||
"appletalk"
|
||||
"atm"
|
||||
"ax25"
|
||||
"batman-adv"
|
||||
"can"
|
||||
"netrom"
|
||||
"psnap"
|
||||
"rds"
|
||||
"rose"
|
||||
"sctp"
|
||||
"tipc"
|
||||
|
||||
# Filesystems we don't use
|
||||
"adfs"
|
||||
"affs"
|
||||
"befs"
|
||||
"bfs"
|
||||
"cifs"
|
||||
"cramfs"
|
||||
"efs"
|
||||
"exofs"
|
||||
"orangefs"
|
||||
"freevxfs"
|
||||
"gfs2"
|
||||
"hfs"
|
||||
"hfsplus"
|
||||
"hpfs"
|
||||
"jffs2"
|
||||
"jfs"
|
||||
"minix"
|
||||
"nilfs2"
|
||||
"ntfs"
|
||||
"omfs"
|
||||
"qnx4"
|
||||
"qnx6"
|
||||
"sysv"
|
||||
"ubifs"
|
||||
"ufs"
|
||||
|
||||
# Legacy hardware
|
||||
"pcspkr"
|
||||
"floppy"
|
||||
"parport"
|
||||
"ppdev"
|
||||
|
||||
# Other stuff we don't use
|
||||
"firewire-core"
|
||||
"firewire-ohci"
|
||||
"ksmbd"
|
||||
"ib_core"
|
||||
"l2tp_eth"
|
||||
"l2tp_netlink"
|
||||
"l2tp_ppp"
|
||||
"nfc"
|
||||
"soundwire"
|
||||
];
|
||||
|
||||
# security.lockKernelModules = true;
|
||||
security.protectKernelImage = true;
|
||||
}
|
||||
@@ -1,17 +0,0 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
boot.blacklistedKernelModules = [
|
||||
"rxrpc" # dirtyfrag
|
||||
"esp6" # dirtyfrag
|
||||
"esp4" # dirtyfrag
|
||||
];
|
||||
boot.extraModprobeConfig = ''
|
||||
# dirtyfrag
|
||||
install esp4 /bin/false
|
||||
# dirtyfrag
|
||||
install esp6 /bin/false
|
||||
# dirtyfrag
|
||||
install rxrpc /bin/false
|
||||
'';
|
||||
}
|
||||
@@ -19,9 +19,6 @@
|
||||
# Check computer specs
|
||||
lshw
|
||||
|
||||
# Check who is keeping open files
|
||||
lsof
|
||||
|
||||
# Scan for open ports with netstat
|
||||
net-tools
|
||||
|
||||
|
||||
@@ -151,7 +151,7 @@ is up to date, you can do the following:
|
||||
|
||||
```console
|
||||
# Fetch gpg (unless you have it already)
|
||||
nix shell nixpkgs#gnupg
|
||||
nix-shell -p gpg
|
||||
|
||||
# Import oysteikts key to the gpg keychain
|
||||
gpg --import ./keys/oysteikt.pub
|
||||
|
||||
Generated
+51
-68
@@ -1,20 +1,5 @@
|
||||
{
|
||||
"nodes": {
|
||||
"crane": {
|
||||
"locked": {
|
||||
"lastModified": 1776635034,
|
||||
"narHash": "sha256-OEOJrT3ZfwbChzODfIH4GzlNTtOFuZFWPtW7jIeR8xU=",
|
||||
"owner": "ipetkov",
|
||||
"repo": "crane",
|
||||
"rev": "dc7496d8ea6e526b1254b55d09b966e94673750f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "ipetkov",
|
||||
"repo": "crane",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"dibbler": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -22,11 +7,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1771267058,
|
||||
"narHash": "sha256-EEL4SmD1b3BPJPsSJJ4wDTXWMumJqbR+BLzhJJG0skE=",
|
||||
"lastModified": 1769510541,
|
||||
"narHash": "sha256-jxuQY0anT3YpwpnYB5w7p6EPS6UWIj4vGxzfsOJvC1I=",
|
||||
"ref": "main",
|
||||
"rev": "e3962d02c78b9c7b4d18148d931a9a4bf22e7902",
|
||||
"revCount": 254,
|
||||
"rev": "ec43f67e58f049a709fa2c19601b8c637f38126f",
|
||||
"revCount": 232,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
|
||||
},
|
||||
@@ -62,11 +47,11 @@
|
||||
"nixpkgs-lib": "nixpkgs-lib"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1772408722,
|
||||
"narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
|
||||
"lastModified": 1765835352,
|
||||
"narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
|
||||
"rev": "a34fae9c08a15ad73f295041fec82323541400a9",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -78,15 +63,15 @@
|
||||
"gergle": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs-unstable"
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1777067150,
|
||||
"narHash": "sha256-vqPz8jCS1zTQlvmgctUFpvnr6f9ISR5h7CPG/HgQvf0=",
|
||||
"lastModified": 1767906545,
|
||||
"narHash": "sha256-LOf08pcjEQFLs3dLPuep5d1bAXWOFcdfxuk3YMb5KWw=",
|
||||
"ref": "main",
|
||||
"rev": "b452a854fb78d6df9fe062b45e23a968657d115d",
|
||||
"revCount": 35,
|
||||
"rev": "e55cbe0ce0b20fc5952ed491fa8a553c8afb1bdd",
|
||||
"revCount": 23,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
|
||||
},
|
||||
@@ -99,15 +84,15 @@
|
||||
"greg-ng": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs-unstable"
|
||||
"nixpkgs"
|
||||
],
|
||||
"rust-overlay": "rust-overlay"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1777019032,
|
||||
"narHash": "sha256-29lw7THThWb5DW01rVRj1b816Apwz/P4m2wVWaSIadU=",
|
||||
"lastModified": 1767906494,
|
||||
"narHash": "sha256-Dd6gtdZfRMAD6JhdX0GdJwIHVaBikePSpQXhIdwLlWI=",
|
||||
"ref": "main",
|
||||
"rev": "55262afca46c96f75a834d4e00e30d5fb20affb6",
|
||||
"rev": "7258822e2e90fea2ea00b13b5542f63699e33a9e",
|
||||
"revCount": 61,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
|
||||
@@ -210,11 +195,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1770960722,
|
||||
"narHash": "sha256-IdhPsWFZUKSJh/nLjGLJvGM5d5Uta+k1FlVYPxTZi0E=",
|
||||
"lastModified": 1767906352,
|
||||
"narHash": "sha256-wYsH9MMAPFG3XTL+3DwI39XMG0F2fTmn/5lt265a3Es=",
|
||||
"ref": "main",
|
||||
"rev": "c2e4aca7e1ba27cd09eeaeab47010d32a11841b2",
|
||||
"revCount": 15,
|
||||
"rev": "d054c5d064b8ed6d53a0adb0cf6c0a72febe212e",
|
||||
"revCount": 13,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
|
||||
},
|
||||
@@ -232,11 +217,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1778407980,
|
||||
"narHash": "sha256-r980BhsReZQe6FkmyNZkwCZpvzARo5jZgTl8HxjAssY=",
|
||||
"lastModified": 1769018862,
|
||||
"narHash": "sha256-x3eMpPQhZwEDunyaUos084Hx41XwYTi2uHY4Yc4YNlk=",
|
||||
"owner": "oddlama",
|
||||
"repo": "nix-topology",
|
||||
"rev": "ca0a602f650306d00d6f3e3c76d0f4c48a5c5adc",
|
||||
"rev": "a15cac71d3399a4c2d1a3482ae62040a3a0aa07f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -248,11 +233,11 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1778544512,
|
||||
"narHash": "sha256-VIsPgfIpZ/01XUO6WN+o1NZbP5iKPKPHdHPWqfm4XIg=",
|
||||
"rev": "c417517f9d525181ee5619c683419d308ee29fe8",
|
||||
"lastModified": 1769484787,
|
||||
"narHash": "sha256-ufhG9uSA8cCEk/97D/7xQEKcO/ftr4IPRH+HQFaKNdE=",
|
||||
"rev": "999ca0e5484922624254294ea1adc2b90081579e",
|
||||
"type": "tarball",
|
||||
"url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.10745.c417517f9d52/nixexprs.tar.xz"
|
||||
"url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.4804.999ca0e54849/nixexprs.tar.xz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
@@ -261,11 +246,11 @@
|
||||
},
|
||||
"nixpkgs-lib": {
|
||||
"locked": {
|
||||
"lastModified": 1772328832,
|
||||
"narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=",
|
||||
"lastModified": 1765674936,
|
||||
"narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixpkgs.lib",
|
||||
"rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742",
|
||||
"rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -276,11 +261,11 @@
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1778586796,
|
||||
"narHash": "sha256-XmDljcG4x8slQDlsWOc77pCA1YVuYn8JGumkYlhfTxI=",
|
||||
"rev": "b25e938b89759b5f9466fc53c4a970244f84dc39",
|
||||
"lastModified": 1769434638,
|
||||
"narHash": "sha256-u19M4QdjvjEySkGhP4fUNyY6rqAbPCdQf/AFw04CkQU=",
|
||||
"rev": "9c2822d7024c032e66000a8b8a47e91b4e63ffc8",
|
||||
"type": "tarball",
|
||||
"url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre996582.b25e938b8975/nixexprs.tar.xz"
|
||||
"url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre935000.9c2822d7024c/nixexprs.tar.xz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
@@ -315,11 +300,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1778506874,
|
||||
"narHash": "sha256-s6ihgpgvaCDQsQQNfqNEDvh/oVHmrOhX1dDRsrA3qyI=",
|
||||
"lastModified": 1769009806,
|
||||
"narHash": "sha256-52xTtAOc9B+MBRMRZ8HI6ybNsRLMlHHLh+qwAbaJjRY=",
|
||||
"ref": "main",
|
||||
"rev": "07d132575a9aeb4939c70d40e1b7e493c40427fa",
|
||||
"revCount": 580,
|
||||
"rev": "aa8adfc6a4d5b6222752e2d15d4a6d3b3b85252e",
|
||||
"revCount": 575,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
||||
},
|
||||
@@ -373,24 +358,22 @@
|
||||
},
|
||||
"roowho2": {
|
||||
"inputs": {
|
||||
"crane": "crane",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"rust-overlay": "rust-overlay_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1778600367,
|
||||
"narHash": "sha256-YB0b2xUf4D8792D5Ay//7C3AjHyv+9yoy8K1mTe+wvE=",
|
||||
"lastModified": 1769325266,
|
||||
"narHash": "sha256-q2G2NG7I1tvfFK4GDnn3vt1CCg0GN4ncdo0NSY+Q2Nc=",
|
||||
"ref": "main",
|
||||
"rev": "8e5f2849ff7c9616100fe928261512a7ad647939",
|
||||
"revCount": 91,
|
||||
"rev": "23b163e828901cb981eec6f3262e922f437f850b",
|
||||
"revCount": 45,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"rev": "8e5f2849ff7c9616100fe928261512a7ad647939",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
|
||||
}
|
||||
@@ -403,11 +386,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1777000482,
|
||||
"narHash": "sha256-CZ5FKUSA8FCJf0h9GWdPJXoVVDL9H5yC74GkVc5ubIM=",
|
||||
"lastModified": 1767840362,
|
||||
"narHash": "sha256-ZtsFqUhilubohNZ1TgpQIFsi4biZTwRH9rjZsDRDik8=",
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"rev": "403c09094a877e6c4816462d00b1a56ff8198e06",
|
||||
"rev": "d159ea1fc321c60f88a616ac28bab660092a227d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -445,11 +428,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1776914043,
|
||||
"narHash": "sha256-qug5r56yW1qOsjSI99l3Jm15JNT9CvS2otkXNRNtrPI=",
|
||||
"lastModified": 1769309768,
|
||||
"narHash": "sha256-AbOIlNO+JoqRJkK1VrnDXhxuX6CrdtIu2hSuy4pxi3g=",
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"rev": "2d35c4358d7de3a0e606a6e8b27925d981c01cc3",
|
||||
"rev": "140c9dc582cb73ada2d63a2180524fcaa744fad5",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -465,11 +448,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1777944972,
|
||||
"narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
|
||||
"lastModified": 1769469829,
|
||||
"narHash": "sha256-wFcr32ZqspCxk4+FvIxIL0AZktRs6DuF8oOsLt59YBU=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
|
||||
"rev": "c5eebd4eb2e3372fe12a8d70a248a6ee9dd02eff",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
@@ -32,13 +32,13 @@
|
||||
minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
|
||||
minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=8e5f2849ff7c9616100fe928261512a7ad647939";
|
||||
roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main";
|
||||
roowho2.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";
|
||||
greg-ng.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||
greg-ng.inputs.nixpkgs.follows = "nixpkgs";
|
||||
gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git?ref=main";
|
||||
gergle.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||
gergle.inputs.nixpkgs.follows = "nixpkgs";
|
||||
grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git?ref=master";
|
||||
grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
@@ -62,11 +62,9 @@
|
||||
importantMachines = [
|
||||
"bekkalokk"
|
||||
"bicep"
|
||||
"brzeczyszczykiewicz"
|
||||
"georg"
|
||||
"ildkule"
|
||||
"kommode"
|
||||
"lupine-1"
|
||||
"skrot"
|
||||
];
|
||||
in {
|
||||
inputs = lib.mapAttrs (_: src: src.outPath) inputs;
|
||||
@@ -96,6 +94,7 @@
|
||||
}:
|
||||
let
|
||||
commonPkgsConfig = {
|
||||
inherit localSystem crossSystem;
|
||||
config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
|
||||
[
|
||||
"nvidia-x11"
|
||||
@@ -105,11 +104,8 @@
|
||||
# Global overlays go here
|
||||
inputs.roowho2.overlays.default
|
||||
]) ++ overlays;
|
||||
} // (if localSystem != crossSystem then {
|
||||
inherit localSystem crossSystem;
|
||||
} else {
|
||||
system = crossSystem;
|
||||
});
|
||||
};
|
||||
|
||||
pkgs = import nixpkgs commonPkgsConfig;
|
||||
unstablePkgs = import nixpkgs-unstable commonPkgsConfig;
|
||||
in
|
||||
@@ -149,6 +145,11 @@
|
||||
stableNixosConfig = name: extraArgs:
|
||||
nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
|
||||
in {
|
||||
bakke = stableNixosConfig "bakke" {
|
||||
modules = [
|
||||
inputs.disko.nixosModules.disko
|
||||
];
|
||||
};
|
||||
bicep = stableNixosConfig "bicep" {
|
||||
modules = [
|
||||
inputs.matrix-next.nixosModules.default
|
||||
@@ -183,13 +184,6 @@
|
||||
};
|
||||
ildkule = stableNixosConfig "ildkule" { };
|
||||
#ildkule-unstable = unstableNixosConfig "ildkule" { };
|
||||
skrot = stableNixosConfig "skrot" {
|
||||
modules = [
|
||||
inputs.disko.nixosModules.disko
|
||||
inputs.dibbler.nixosModules.default
|
||||
];
|
||||
overlays = [inputs.dibbler.overlays.default];
|
||||
};
|
||||
shark = stableNixosConfig "shark" { };
|
||||
wenche = stableNixosConfig "wenche" { };
|
||||
temmie = stableNixosConfig "temmie" { };
|
||||
@@ -235,6 +229,38 @@
|
||||
};
|
||||
}
|
||||
//
|
||||
(let
|
||||
skrottConfig = {
|
||||
modules = [
|
||||
(nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
|
||||
inputs.dibbler.nixosModules.default
|
||||
];
|
||||
overlays = [
|
||||
inputs.dibbler.overlays.default
|
||||
(final: prev: {
|
||||
# NOTE: Yeetus (these break crosscompile ¯\_(ツ)_/¯)
|
||||
atool = prev.emptyDirectory;
|
||||
micro = prev.emptyDirectory;
|
||||
ncdu = prev.emptyDirectory;
|
||||
})
|
||||
];
|
||||
};
|
||||
in {
|
||||
skrott = self.nixosConfigurations.skrott-native;
|
||||
skrott-native = stableNixosConfig "skrott" (skrottConfig // {
|
||||
localSystem = "aarch64-linux";
|
||||
crossSystem = "aarch64-linux";
|
||||
});
|
||||
skrott-cross = stableNixosConfig "skrott" (skrottConfig // {
|
||||
localSystem = "x86_64-linux";
|
||||
crossSystem = "aarch64-linux";
|
||||
});
|
||||
skrott-x86_64 = stableNixosConfig "skrott" (skrottConfig // {
|
||||
localSystem = "x86_64-linux";
|
||||
crossSystem = "x86_64-linux";
|
||||
});
|
||||
})
|
||||
//
|
||||
(let
|
||||
machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
|
||||
stableLupineNixosConfig = name: extraArgs:
|
||||
@@ -305,6 +331,16 @@
|
||||
lib.genAttrs allMachines
|
||||
(machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
|
||||
//
|
||||
# Skrott is exception
|
||||
{
|
||||
skrott = self.packages.${system}.skrott-native-sd;
|
||||
skrott-native = self.nixosConfigurations.skrott-native.config.system.build.toplevel;
|
||||
skrott-native-sd = self.nixosConfigurations.skrott-native.config.system.build.sdImage;
|
||||
skrott-cross = self.nixosConfigurations.skrott-cross.config.system.build.toplevel;
|
||||
skrott-cross-sd = self.nixosConfigurations.skrott-cross.config.system.build.sdImage;
|
||||
skrott-x86_64 = self.nixosConfigurations.skrott-x86_64.config.system.build.toplevel;
|
||||
}
|
||||
//
|
||||
# Nix-topology
|
||||
(let
|
||||
topology' = import inputs.nix-topology {
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
{ config, pkgs, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
../../base
|
||||
./filesystems.nix
|
||||
];
|
||||
|
||||
networking.hostId = "99609ffc";
|
||||
systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "enp2s0";
|
||||
address = with values.hosts.bakke; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||
};
|
||||
|
||||
# Don't change (even during upgrades) unless you know what you are doing.
|
||||
# See https://search.nixos.org/options?show=system.stateVersion
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
@@ -0,0 +1,83 @@
|
||||
{
|
||||
# https://github.com/nix-community/disko/blob/master/example/boot-raid1.nix
|
||||
# Note: Disko was used to create the initial md raid, but is no longer in active use on this host.
|
||||
disko.devices = {
|
||||
disk = {
|
||||
one = {
|
||||
type = "disk";
|
||||
device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E2EER6N6";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
size = "500M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "mdraid";
|
||||
name = "boot";
|
||||
};
|
||||
};
|
||||
mdadm = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "mdraid";
|
||||
name = "raid1";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
two = {
|
||||
type = "disk";
|
||||
device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E7LPLU71";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
size = "500M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "mdraid";
|
||||
name = "boot";
|
||||
};
|
||||
};
|
||||
mdadm = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "mdraid";
|
||||
name = "raid1";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
mdadm = {
|
||||
boot = {
|
||||
type = "mdadm";
|
||||
level = 1;
|
||||
metadata = "1.0";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
};
|
||||
};
|
||||
raid1 = {
|
||||
type = "mdadm";
|
||||
level = 1;
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions.primary = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,26 @@
|
||||
{ pkgs,... }:
|
||||
{
|
||||
# Boot drives:
|
||||
boot.swraid.enable = true;
|
||||
|
||||
# ZFS Data pool:
|
||||
boot = {
|
||||
zfs = {
|
||||
extraPools = [ "tank" ];
|
||||
requestEncryptionCredentials = false;
|
||||
};
|
||||
supportedFilesystems.zfs = true;
|
||||
# Use stable linux packages, these work with zfs
|
||||
kernelPackages = pkgs.linuxPackages;
|
||||
};
|
||||
services.zfs.autoScrub = {
|
||||
enable = true;
|
||||
interval = "Wed *-*-8..14 00:00:00";
|
||||
};
|
||||
|
||||
# NFS Exports:
|
||||
#TODO
|
||||
|
||||
# NFS Import mounts:
|
||||
#TODO
|
||||
}
|
||||
@@ -0,0 +1,52 @@
|
||||
# Do not modify this file! It was generated by 'nixos-generate-config'
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=root" ];
|
||||
};
|
||||
|
||||
fileSystems."/home" =
|
||||
{ device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=home" ];
|
||||
};
|
||||
|
||||
fileSystems."/nix" =
|
||||
{ device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=nix" "noatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/sdc2";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault false;
|
||||
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -56,7 +56,6 @@ in {
|
||||
rrsyncArgs.ro = true;
|
||||
authorizedKeysAttrs = [
|
||||
"restrict"
|
||||
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
|
||||
"no-agent-forwarding"
|
||||
"no-port-forwarding"
|
||||
"no-pty"
|
||||
@@ -162,24 +161,6 @@ in {
|
||||
$wgDBserver = "${toString cfg.database.host}";
|
||||
$wgAllowCopyUploads = true;
|
||||
|
||||
# Files
|
||||
$wgFileExtensions = [
|
||||
'bmp',
|
||||
'gif',
|
||||
'jpeg',
|
||||
'jpg',
|
||||
'mp3',
|
||||
'odg',
|
||||
'odp',
|
||||
'ods',
|
||||
'odt',
|
||||
'pdf',
|
||||
'png',
|
||||
'tiff',
|
||||
'webm',
|
||||
'webp',
|
||||
];
|
||||
|
||||
# Misc program paths
|
||||
$wgFFmpegLocation = '${pkgs.ffmpeg}/bin/ffmpeg';
|
||||
$wgExiftool = '${pkgs.exiftool}/bin/exiftool';
|
||||
@@ -275,7 +256,6 @@ in {
|
||||
serviceConfig = {
|
||||
BindReadOnlyPaths = [ "/run/credentials/mediawiki-init.service/secret-key:/var/lib/mediawiki/secret.key" ];
|
||||
LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
|
||||
UMask = lib.mkForce "0007";
|
||||
};
|
||||
};
|
||||
|
||||
@@ -284,7 +264,6 @@ in {
|
||||
serviceConfig = {
|
||||
BindReadOnlyPaths = [ "/run/credentials/phpfpm-mediawiki.service/secret-key:/var/lib/mediawiki/secret.key" ];
|
||||
LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
|
||||
UMask = lib.mkForce "0007";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, pkgs, lib, values, ... }:
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.services.vaultwarden;
|
||||
domain = "pw.pvv.ntnu.no";
|
||||
@@ -99,21 +99,4 @@ in {
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services.rsync-pull-targets = {
|
||||
enable = true;
|
||||
locations."/var/lib/vaultwarden" = {
|
||||
user = "root";
|
||||
rrsyncArgs.ro = true;
|
||||
authorizedKeysAttrs = [
|
||||
"restrict"
|
||||
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
|
||||
"no-agent-forwarding"
|
||||
"no-port-forwarding"
|
||||
"no-pty"
|
||||
"no-X11-forwarding"
|
||||
];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB2cDaW52gBtLVaNqoGijvN2ZAVkAWlII5AXUzT3Dswj vaultwarden rsync backup";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, lib, fp, pkgs, values, ... }:
|
||||
{ config, lib, fp, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.snappymail;
|
||||
in {
|
||||
@@ -14,21 +14,5 @@ in {
|
||||
enableACME = true;
|
||||
kTLS = true;
|
||||
};
|
||||
|
||||
services.rsync-pull-targets = {
|
||||
enable = true;
|
||||
locations.${cfg.dataDir} = {
|
||||
user = "root";
|
||||
rrsyncArgs.ro = true;
|
||||
authorizedKeysAttrs = [
|
||||
"restrict"
|
||||
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
|
||||
"no-agent-forwarding"
|
||||
"no-port-forwarding"
|
||||
"no-pty"
|
||||
"no-X11-forwarding"
|
||||
];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJENMnuNsHEeA91oX+cj7Qpex2defSXP/lxznxCAqV03 snappymail rsync backup";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
@@ -80,40 +80,9 @@ in {
|
||||
};
|
||||
|
||||
services.phpfpm.pools."pvv-nettsiden".settings = {
|
||||
"php_admin_value[error_log]" = "syslog";
|
||||
# "php_admin_value[error_log]" = "stderr";
|
||||
"php_admin_flag[log_errors]" = true;
|
||||
"catch_workers_output" = true;
|
||||
|
||||
"php_admin_value[max_execution_time]" = "30";
|
||||
"request_terminate_timeout" = "60s";
|
||||
|
||||
"php_admin_value[sendmail_path]" = let
|
||||
fakeSendmail = pkgs.writeShellApplication {
|
||||
name = "fake-sendmail";
|
||||
text = ''
|
||||
TIMESTAMP="$(date +%Y-%m-%d-%H-%M-%S-%N)"
|
||||
(
|
||||
echo "SENDMAIL ARGS:"
|
||||
echo "$@"
|
||||
echo "SENDMAIL STDIN:"
|
||||
cat -
|
||||
) > "/var/lib/pvv-nettsiden/emails/$TIMESTAMP.mail"
|
||||
'';
|
||||
};
|
||||
in lib.getExe fakeSendmail;
|
||||
|
||||
"php_admin_value[disable_functions]" = lib.concatStringsSep "," [
|
||||
"curl_exec"
|
||||
"curl_multi_exec"
|
||||
"exec"
|
||||
"parse_ini_file"
|
||||
"passthru"
|
||||
"popen"
|
||||
"proc_open"
|
||||
"shell_exec"
|
||||
"show_source"
|
||||
"system"
|
||||
];
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."pvv.ntnu.no" = {
|
||||
|
||||
@@ -1,14 +1,8 @@
|
||||
{ pkgs, lib, config, values, ... }:
|
||||
{ pkgs, lib, config, ... }:
|
||||
let
|
||||
galleryDir = config.services.pvv-nettsiden.settings.GALLERY.DIR;
|
||||
transferDir = "${config.services.pvv-nettsiden.settings.GALLERY.DIR}-transfer";
|
||||
in {
|
||||
users.users.${config.services.pvv-nettsiden.user} = {
|
||||
# NOTE: the user unfortunately needs a registered shell for rrsync to function...
|
||||
# is there anything we can do to remove this?
|
||||
useDefaultShell = true;
|
||||
};
|
||||
|
||||
# This is pushed from microbel:/var/www/www-gallery/build-gallery.sh
|
||||
services.rsync-pull-targets = {
|
||||
enable = true;
|
||||
@@ -17,7 +11,6 @@ in {
|
||||
rrsyncArgs.wo = true;
|
||||
authorizedKeysAttrs = [
|
||||
"restrict"
|
||||
"from=\"microbel.pvv.ntnu.no,${values.hosts.microbel.ipv6},${values.hosts.microbel.ipv4}\""
|
||||
"no-agent-forwarding"
|
||||
"no-port-forwarding"
|
||||
"no-pty"
|
||||
@@ -40,15 +33,15 @@ in {
|
||||
path = with pkgs; [ imagemagick gnutar gzip ];
|
||||
|
||||
script = ''
|
||||
tar ${lib.cli.toCommandLineShellGNU { } {
|
||||
tar ${lib.cli.toGNUCommandLineShell {} {
|
||||
extract = true;
|
||||
file = "${transferDir}/gallery.tar.gz";
|
||||
directory = ".";
|
||||
}}
|
||||
|
||||
# Delete files and directories that exists in the gallery that don't exist in the tarball
|
||||
filesToRemove=$(uniq -u <(sort <(find . -not -path './.thumbnails*') <(tar -tf '${transferDir}/gallery.tar.gz' | sed 's|/$||')))
|
||||
while IFS= read -r fname; do
|
||||
filesToRemove=$(uniq -u <(sort <(find . -not -path "./.thumbnails*") <(tar -tf ${transferDir}/gallery.tar.gz | sed 's|/$||')))
|
||||
while IFS= read fname; do
|
||||
rm -f "$fname" ||:
|
||||
rm -f ".thumbnails/$fname.png" ||:
|
||||
done <<< "$filesToRemove"
|
||||
@@ -56,9 +49,9 @@ in {
|
||||
find . -type d -empty -delete
|
||||
|
||||
mkdir -p .thumbnails
|
||||
images=$(find . -type f -not -path './.thumbnails*')
|
||||
images=$(find . -type f -not -path "./.thumbnails*")
|
||||
|
||||
while IFS= read -r fname; do
|
||||
while IFS= read fname; do
|
||||
# Skip this file if an up-to-date thumbnail already exists
|
||||
if [ -f ".thumbnails/$fname.png" ] && \
|
||||
[ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
|
||||
@@ -67,7 +60,7 @@ in {
|
||||
fi
|
||||
|
||||
echo "Creating thumbnail for $fname"
|
||||
mkdir -p "$(dirname ".thumbnails/$fname")"
|
||||
mkdir -p $(dirname ".thumbnails/$fname")
|
||||
magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
|
||||
touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
|
||||
done <<< "$images"
|
||||
|
||||
@@ -43,7 +43,7 @@ in
|
||||
keyFile = config.sops.templates."matrix-livekit-keyfile".path;
|
||||
};
|
||||
|
||||
systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = lib.mkIf cfg.enable (builtins.concatStringsSep "," [ "pvv.ntnu.no" "dodsorf.as" ]);
|
||||
systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = lib.mkIf cfg.enable matrixDomain;
|
||||
|
||||
services.nginx.virtualHosts.${matrixDomain} = lib.mkIf cfg.enable {
|
||||
locations."^~ /livekit/jwt/" = {
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, pkgs, lib, values, fp, ... }:
|
||||
{ config, pkgs, fp, ... }:
|
||||
let
|
||||
cfg = config.services.matrix-ooye;
|
||||
in
|
||||
@@ -28,23 +28,6 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
services.rsync-pull-targets = lib.mkIf cfg.enable {
|
||||
enable = true;
|
||||
locations."/var/lib/private/matrix-ooye" = {
|
||||
user = "root";
|
||||
rrsyncArgs.ro = true;
|
||||
authorizedKeysAttrs = [
|
||||
"restrict"
|
||||
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
|
||||
"no-agent-forwarding"
|
||||
"no-port-forwarding"
|
||||
"no-pty"
|
||||
"no-X11-forwarding"
|
||||
];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE5koYfor5+kKB30Dugj3dAWvmj8h/akQQ2XYDvLobFL matrix_ooye rsync backup";
|
||||
};
|
||||
};
|
||||
|
||||
services.matrix-ooye = {
|
||||
enable = true;
|
||||
homeserver = "https://matrix.pvv.ntnu.no";
|
||||
|
||||
@@ -34,7 +34,6 @@ in {
|
||||
rrsyncArgs.ro = true;
|
||||
authorizedKeysAttrs = [
|
||||
"restrict"
|
||||
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
|
||||
"no-agent-forwarding"
|
||||
"no-port-forwarding"
|
||||
"no-pty"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, lib, pkgs, values, ... }:
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.mysql;
|
||||
backupDir = "/data/mysql-backups";
|
||||
@@ -22,7 +22,6 @@ in
|
||||
rrsyncArgs.ro = true;
|
||||
authorizedKeysAttrs = [
|
||||
"restrict"
|
||||
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
|
||||
"no-agent-forwarding"
|
||||
"no-port-forwarding"
|
||||
"no-pty"
|
||||
@@ -57,8 +56,8 @@ in
|
||||
rm "$STATE_DIRECTORY/mysql-dump-latest.sql.zst" ||:
|
||||
ln -T "$OUT_FILE" "$STATE_DIRECTORY/mysql-dump-latest.sql.zst"
|
||||
|
||||
while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt '${toString (rotations + 1)}' ]; do
|
||||
rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
|
||||
while [ $(find -type f -printf '.' "$STATE_DIRECTORY" | wc -c) -gt ${toString (rotations + 1)} ]; do
|
||||
rm $(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)
|
||||
done
|
||||
'';
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, lib, pkgs, values, ... }:
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.postgresql;
|
||||
backupDir = "/data/postgresql-backups";
|
||||
@@ -23,7 +23,6 @@ in
|
||||
rrsyncArgs.ro = true;
|
||||
authorizedKeysAttrs = [
|
||||
"restrict"
|
||||
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
|
||||
"no-agent-forwarding"
|
||||
"no-port-forwarding"
|
||||
"no-pty"
|
||||
@@ -58,8 +57,8 @@ in
|
||||
rm "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst" ||:
|
||||
ln -T "$OUT_FILE" "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst"
|
||||
|
||||
while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt '${toString (rotations + 1)}' ]; do
|
||||
rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
|
||||
while [ $(find -type f -printf '.' "$STATE_DIRECTORY" | wc -c) -gt ${toString (rotations + 1)} ]; do
|
||||
rm $(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)
|
||||
done
|
||||
'';
|
||||
|
||||
|
||||
@@ -31,7 +31,7 @@
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/933A-3005";
|
||||
device = "/dev/disk/by-uuid/D00A-B488";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"fmask=0077"
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -13,7 +13,7 @@
|
||||
]
|
||||
},
|
||||
"description": "",
|
||||
"editable": false,
|
||||
"editable": true,
|
||||
"gnetId": 11323,
|
||||
"graphTooltip": 1,
|
||||
"id": 31,
|
||||
@@ -1899,7 +1899,7 @@
|
||||
"dashes": false,
|
||||
"datasource": "$datasource",
|
||||
"decimals": 0,
|
||||
"description": "***System Memory***: Total Memory for the system.\\\n***InnoDB Buffer Pool Data***: InnoDB maintains a storage area called the buffer pool for caching data and indexes in memory.\\\n***TokuDB Cache Size***: Similar in function to the InnoDB Buffer Pool, TokuDB will allocate 50% of the installed RAM for its own cache.\\\n***Key Buffer Size***: Index blocks for MYISAM tables are buffered and are shared by all threads. key_buffer_size is the size of the buffer used for index blocks.\\\n***Adaptive Hash Index Size***: When InnoDB notices that some index values are being accessed very frequently, it builds a hash index for them in memory on top of B-Tree indexes.\\\n ***Query Cache Size***: The query cache stores the text of a SELECT statement together with the corresponding result that was sent to the client. The query cache has huge scalability problems in that only one thread can do an operation in the query cache at the same time.\\\n***InnoDB Dictionary Size***: The data dictionary is InnoDB ‘s internal catalog of tables. InnoDB stores the data dictionary on disk, and loads entries into memory while the server is running.\\\n***InnoDB Log Buffer Size***: The MySQL InnoDB log buffer allows transactions to run without having to write the log to disk before the transactions commit.",
|
||||
"description": "***System Memory***: Total Memory for the system.\\\n***InnoDB Buffer Pool Data***: InnoDB maintains a storage area called the buffer pool for caching data and indexes in memory.\\\n***TokuDB Cache Size***: Similar in function to the InnoDB Buffer Pool, TokuDB will allocate 50% of the installed RAM for its own cache.\\\n***Key Buffer Size***: Index blocks for MYISAM tables are buffered and are shared by all threads. key_buffer_size is the size of the buffer used for index blocks.\\\n***Adaptive Hash Index Size***: When InnoDB notices that some index values are being accessed very frequently, it builds a hash index for them in memory on top of B-Tree indexes.\\\n ***Query Cache Size***: The query cache stores the text of a SELECT statement together with the corresponding result that was sent to the client. The query cache has huge scalability problems in that only one thread can do an operation in the query cache at the same time.\\\n***InnoDB Dictionary Size***: The data dictionary is InnoDB 's internal catalog of tables. InnoDB stores the data dictionary on disk, and loads entries into memory while the server is running.\\\n***InnoDB Log Buffer Size***: The MySQL InnoDB log buffer allows transactions to run without having to write the log to disk before the transactions commit.",
|
||||
"editable": true,
|
||||
"error": false,
|
||||
"fieldConfig": {
|
||||
@@ -3690,7 +3690,7 @@
|
||||
},
|
||||
"hide": 0,
|
||||
"includeAll": false,
|
||||
"label": "Data source",
|
||||
"label": "Data Source",
|
||||
"multi": false,
|
||||
"name": "datasource",
|
||||
"options": [],
|
||||
@@ -3713,12 +3713,12 @@
|
||||
"definition": "label_values(mysql_up, job)",
|
||||
"hide": 0,
|
||||
"includeAll": true,
|
||||
"label": "Job",
|
||||
"label": "job",
|
||||
"multi": true,
|
||||
"name": "job",
|
||||
"options": [],
|
||||
"query": "label_values(mysql_up, job)",
|
||||
"refresh": 2,
|
||||
"refresh": 1,
|
||||
"regex": "",
|
||||
"skipUrlSync": false,
|
||||
"sort": 0,
|
||||
@@ -3742,12 +3742,12 @@
|
||||
"definition": "label_values(mysql_up, instance)",
|
||||
"hide": 0,
|
||||
"includeAll": true,
|
||||
"label": "Instance",
|
||||
"label": "instance",
|
||||
"multi": true,
|
||||
"name": "instance",
|
||||
"options": [],
|
||||
"query": "label_values(mysql_up, instance)",
|
||||
"refresh": 2,
|
||||
"refresh": 1,
|
||||
"regex": "",
|
||||
"skipUrlSync": false,
|
||||
"sort": 0,
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -328,7 +328,7 @@
|
||||
"rgba(50, 172, 45, 0.97)"
|
||||
],
|
||||
"datasource": "${DS_PROMETHEUS}",
|
||||
"format": "short",
|
||||
"format": "decbytes",
|
||||
"gauge": {
|
||||
"maxValue": 100,
|
||||
"minValue": 0,
|
||||
@@ -411,7 +411,7 @@
|
||||
"rgba(50, 172, 45, 0.97)"
|
||||
],
|
||||
"datasource": "${DS_PROMETHEUS}",
|
||||
"format": "short",
|
||||
"format": "decbytes",
|
||||
"gauge": {
|
||||
"maxValue": 100,
|
||||
"minValue": 0,
|
||||
@@ -1410,7 +1410,7 @@
|
||||
"tableColumn": "",
|
||||
"targets": [
|
||||
{
|
||||
"expr": "pg_settings_seq_page_cost{instance=\"$instance\"}",
|
||||
"expr": "pg_settings_seq_page_cost",
|
||||
"format": "time_series",
|
||||
"intervalFactor": 1,
|
||||
"refId": "A"
|
||||
@@ -1872,7 +1872,7 @@
|
||||
},
|
||||
"yaxes": [
|
||||
{
|
||||
"format": "short",
|
||||
"format": "bytes",
|
||||
"label": null,
|
||||
"logBase": 1,
|
||||
"max": null,
|
||||
@@ -1966,7 +1966,7 @@
|
||||
},
|
||||
"yaxes": [
|
||||
{
|
||||
"format": "short",
|
||||
"format": "bytes",
|
||||
"label": null,
|
||||
"logBase": 1,
|
||||
"max": null,
|
||||
@@ -2060,7 +2060,7 @@
|
||||
},
|
||||
"yaxes": [
|
||||
{
|
||||
"format": "short",
|
||||
"format": "bytes",
|
||||
"label": null,
|
||||
"logBase": 1,
|
||||
"max": null,
|
||||
@@ -2251,7 +2251,7 @@
|
||||
},
|
||||
"yaxes": [
|
||||
{
|
||||
"format": "short",
|
||||
"format": "bytes",
|
||||
"label": null,
|
||||
"logBase": 1,
|
||||
"max": null,
|
||||
@@ -2439,7 +2439,7 @@
|
||||
},
|
||||
"yaxes": [
|
||||
{
|
||||
"format": "short",
|
||||
"format": "bytes",
|
||||
"label": null,
|
||||
"logBase": 1,
|
||||
"max": null,
|
||||
@@ -2589,35 +2589,35 @@
|
||||
"steppedLine": false,
|
||||
"targets": [
|
||||
{
|
||||
"expr": "irate(pg_stat_bgwriter_buffers_backend_total{instance=\"$instance\"}[5m])",
|
||||
"expr": "irate(pg_stat_bgwriter_buffers_backend{instance=\"$instance\"}[5m])",
|
||||
"format": "time_series",
|
||||
"intervalFactor": 1,
|
||||
"legendFormat": "buffers_backend",
|
||||
"refId": "A"
|
||||
},
|
||||
{
|
||||
"expr": "irate(pg_stat_bgwriter_buffers_alloc_total{instance=\"$instance\"}[5m])",
|
||||
"expr": "irate(pg_stat_bgwriter_buffers_alloc{instance=\"$instance\"}[5m])",
|
||||
"format": "time_series",
|
||||
"intervalFactor": 1,
|
||||
"legendFormat": "buffers_alloc",
|
||||
"refId": "B"
|
||||
},
|
||||
{
|
||||
"expr": "irate(pg_stat_bgwriter_buffers_backend_fsync_total{instance=\"$instance\"}[5m])",
|
||||
"expr": "irate(pg_stat_bgwriter_buffers_backend_fsync{instance=\"$instance\"}[5m])",
|
||||
"format": "time_series",
|
||||
"intervalFactor": 1,
|
||||
"legendFormat": "backend_fsync",
|
||||
"refId": "C"
|
||||
},
|
||||
{
|
||||
"expr": "irate(pg_stat_bgwriter_buffers_checkpoint_total{instance=\"$instance\"}[5m])",
|
||||
"expr": "irate(pg_stat_bgwriter_buffers_checkpoint{instance=\"$instance\"}[5m])",
|
||||
"format": "time_series",
|
||||
"intervalFactor": 1,
|
||||
"legendFormat": "buffers_checkpoint",
|
||||
"refId": "D"
|
||||
},
|
||||
{
|
||||
"expr": "irate(pg_stat_bgwriter_buffers_clean_total{instance=\"$instance\"}[5m])",
|
||||
"expr": "irate(pg_stat_bgwriter_buffers_clean{instance=\"$instance\"}[5m])",
|
||||
"format": "time_series",
|
||||
"intervalFactor": 1,
|
||||
"legendFormat": "buffers_clean",
|
||||
@@ -2886,14 +2886,14 @@
|
||||
"steppedLine": false,
|
||||
"targets": [
|
||||
{
|
||||
"expr": "irate(pg_stat_bgwriter_checkpoint_write_time_total{instance=\"$instance\"}[5m])",
|
||||
"expr": "irate(pg_stat_bgwriter_checkpoint_write_time{instance=\"$instance\"}[5m])",
|
||||
"format": "time_series",
|
||||
"intervalFactor": 1,
|
||||
"legendFormat": "write_time - Total amount of time that has been spent in the portion of checkpoint processing where files are written to disk.",
|
||||
"refId": "B"
|
||||
},
|
||||
{
|
||||
"expr": "irate(pg_stat_bgwriter_checkpoint_sync_time_total{instance=\"$instance\"}[5m])",
|
||||
"expr": "irate(pg_stat_bgwriter_checkpoint_sync_time{instance=\"$instance\"}[5m])",
|
||||
"format": "time_series",
|
||||
"intervalFactor": 1,
|
||||
"legendFormat": "sync_time - Total amount of time that has been spent in the portion of checkpoint processing where files are synchronized to disk.",
|
||||
@@ -3164,4 +3164,4 @@
|
||||
"title": "PostgreSQL Database",
|
||||
"uid": "000000039",
|
||||
"version": 1
|
||||
}
|
||||
}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -47,13 +47,13 @@ in {
|
||||
{
|
||||
name = "Node Exporter Full";
|
||||
type = "file";
|
||||
url = "https://grafana.com/api/dashboards/1860/revisions/42/download";
|
||||
url = "https://grafana.com/api/dashboards/1860/revisions/29/download";
|
||||
options.path = dashboards/node-exporter-full.json;
|
||||
}
|
||||
{
|
||||
name = "Matrix Synapse";
|
||||
type = "file";
|
||||
url = "https://github.com/element-hq/synapse/raw/refs/heads/develop/contrib/grafana/synapse.json";
|
||||
url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
|
||||
options.path = dashboards/synapse.json;
|
||||
}
|
||||
{
|
||||
@@ -65,9 +65,15 @@ in {
|
||||
{
|
||||
name = "Postgresql";
|
||||
type = "file";
|
||||
url = "https://grafana.com/api/dashboards/9628/revisions/8/download";
|
||||
url = "https://grafana.com/api/dashboards/9628/revisions/7/download";
|
||||
options.path = dashboards/postgres.json;
|
||||
}
|
||||
{
|
||||
name = "Go Processes (gogs)";
|
||||
type = "file";
|
||||
url = "https://grafana.com/api/dashboards/240/revisions/3/download";
|
||||
options.path = dashboards/go-processes.json;
|
||||
}
|
||||
{
|
||||
name = "Gitea Dashboard";
|
||||
type = "file";
|
||||
|
||||
@@ -30,6 +30,8 @@ in {
|
||||
(mkHostScrapeConfig "ustetind" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
||||
(mkHostScrapeConfig "wenche" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
||||
|
||||
(mkHostScrapeConfig "skrott" [ defaultNodeExporterPort defaultSystemdExporterPort ])
|
||||
|
||||
(mkHostScrapeConfig "hildring" [ defaultNodeExporterPort ])
|
||||
(mkHostScrapeConfig "isvegg" [ defaultNodeExporterPort ])
|
||||
(mkHostScrapeConfig "microbel" [ defaultNodeExporterPort ])
|
||||
|
||||
@@ -10,59 +10,6 @@ in
|
||||
catppuccin = pkgs.gitea-theme-catppuccin;
|
||||
};
|
||||
|
||||
services.gitea.settings = {
|
||||
ui = {
|
||||
DEFAULT_THEME = "gitea-auto";
|
||||
REACTIONS = lib.concatStringsSep "," [
|
||||
"+1"
|
||||
"-1"
|
||||
"laugh"
|
||||
"confused"
|
||||
"heart"
|
||||
"hooray"
|
||||
"rocket"
|
||||
"eyes"
|
||||
"100"
|
||||
"anger"
|
||||
"astonished"
|
||||
"no_good"
|
||||
"ok_hand"
|
||||
"pensive"
|
||||
"pizza"
|
||||
"point_up"
|
||||
"sob"
|
||||
"skull"
|
||||
"upside_down_face"
|
||||
"shrug"
|
||||
"huh"
|
||||
"bruh"
|
||||
"okiedokie"
|
||||
"grr"
|
||||
];
|
||||
|
||||
CUSTOM_EMOJIS = lib.concatStringsSep "," [
|
||||
"bruh"
|
||||
"grr"
|
||||
"huh"
|
||||
"ohyeah"
|
||||
];
|
||||
};
|
||||
"ui.meta" = {
|
||||
AUTHOR = "Programvareverkstedet";
|
||||
DESCRIPTION = "Bokstavelig talt programvareverkstedet";
|
||||
KEYWORDS = lib.concatStringsSep "," [
|
||||
"git"
|
||||
"hackerspace"
|
||||
"nix"
|
||||
"open source"
|
||||
"foss"
|
||||
"organization"
|
||||
"software"
|
||||
"student"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.gitea-customization = lib.mkIf cfg.enable {
|
||||
description = "Install extra customization in gitea's CUSTOM_DIR";
|
||||
wantedBy = [ "gitea.service" ];
|
||||
@@ -99,23 +46,18 @@ in
|
||||
];
|
||||
} ''
|
||||
# Bigger icons
|
||||
install -Dm444 '${cfg.package.src}/templates/repo/icon.tmpl' "$out/repo/icon.tmpl"
|
||||
install -Dm444 "${cfg.package.src}/templates/repo/icon.tmpl" "$out/repo/icon.tmpl"
|
||||
sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
|
||||
'';
|
||||
in ''
|
||||
install -Dm444 '${logo-svg}' '${cfg.customDir}/public/assets/img/logo.svg'
|
||||
install -Dm444 '${logo-png}' '${cfg.customDir}/public/assets/img/logo.png'
|
||||
install -Dm444 '${./loading.apng}' '${cfg.customDir}/public/assets/img/loading.png'
|
||||
install -Dm444 '${extraLinks}' '${cfg.customDir}/templates/custom/extra_links.tmpl'
|
||||
install -Dm444 '${extraLinksFooter}' '${cfg.customDir}/templates/custom/extra_links_footer.tmpl'
|
||||
install -Dm444 '${project-labels}' '${cfg.customDir}/options/label/project-labels.yaml'
|
||||
install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
|
||||
install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
|
||||
install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
|
||||
install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
|
||||
install -Dm444 ${extraLinksFooter} ${cfg.customDir}/templates/custom/extra_links_footer.tmpl
|
||||
install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml
|
||||
|
||||
install -Dm644 '${./emotes/bruh.png}' '${cfg.customDir}/public/assets/img/emoji/bruh.png'
|
||||
install -Dm644 '${./emotes/huh.gif}' '${cfg.customDir}/public/assets/img/emoji/huh.png'
|
||||
install -Dm644 '${./emotes/grr.png}' '${cfg.customDir}/public/assets/img/emoji/grr.png'
|
||||
install -Dm644 '${./emotes/okiedokie.jpg}' '${cfg.customDir}/public/assets/img/emoji/okiedokie.png'
|
||||
|
||||
'${lib.getExe pkgs.rsync}' -a '${customTemplates}/' '${cfg.customDir}/templates/'
|
||||
"${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 7.3 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 28 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 206 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 145 KiB |
@@ -83,24 +83,11 @@ in {
|
||||
AUTO_WATCH_NEW_REPOS = false;
|
||||
};
|
||||
admin.DEFAULT_EMAIL_NOTIFICATIONS = "onmention";
|
||||
session.COOKIE_SECURE = true;
|
||||
security = {
|
||||
SECRET_KEY = lib.mkForce "";
|
||||
SECRET_KEY_URI = "file:${config.sops.secrets."gitea/secret-key".path}";
|
||||
};
|
||||
cache = {
|
||||
ADAPTER = "redis";
|
||||
HOST = "redis+socket://${config.services.redis.servers.gitea.unixSocket}?db=0";
|
||||
ITEM_TTL = "72h";
|
||||
};
|
||||
session = {
|
||||
COOKIE_SECURE = true;
|
||||
PROVIDER = "redis";
|
||||
PROVIDER_CONFIG = "redis+socket://${config.services.redis.servers.gitea.unixSocket}?db=1";
|
||||
};
|
||||
queue = {
|
||||
TYPE = "redis";
|
||||
CONN_STR = "redis+socket://${config.services.redis.servers.gitea.unixSocket}?db=2";
|
||||
};
|
||||
database.LOG_SQL = false;
|
||||
repository = {
|
||||
PREFERRED_LICENSES = lib.concatStringsSep "," [
|
||||
@@ -131,14 +118,41 @@ in {
|
||||
"repo.pulls"
|
||||
"repo.releases"
|
||||
];
|
||||
ALLOW_FORK_INTO_SAME_OWNER = true;
|
||||
};
|
||||
picture = {
|
||||
DISABLE_GRAVATAR = true;
|
||||
ENABLE_FEDERATED_AVATAR = false;
|
||||
|
||||
AVATAR_MAX_FILE_SIZE = 1024 * 1024 * 5;
|
||||
# NOTE: go any bigger than this, and gitea will freeze your gif >:(
|
||||
AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 2;
|
||||
};
|
||||
actions.ENABLED = true;
|
||||
ui = {
|
||||
REACTIONS = lib.concatStringsSep "," [
|
||||
"+1"
|
||||
"-1"
|
||||
"laugh"
|
||||
"confused"
|
||||
"heart"
|
||||
"hooray"
|
||||
"rocket"
|
||||
"eyes"
|
||||
"100"
|
||||
"anger"
|
||||
"astonished"
|
||||
"no_good"
|
||||
"ok_hand"
|
||||
"pensive"
|
||||
"pizza"
|
||||
"point_up"
|
||||
"sob"
|
||||
"skull"
|
||||
"upside_down_face"
|
||||
"shrug"
|
||||
];
|
||||
};
|
||||
"ui.meta".DESCRIPTION = "Bokstavelig talt programvareverkstedet";
|
||||
};
|
||||
|
||||
dump = {
|
||||
@@ -150,26 +164,12 @@ in {
|
||||
|
||||
environment.systemPackages = [ cfg.package ];
|
||||
|
||||
systemd.services.gitea = lib.mkIf cfg.enable {
|
||||
wants = [ "redis-gitea.service" ];
|
||||
after = [ "redis-gitea.service" ];
|
||||
systemd.services.gitea.serviceConfig.CPUSchedulingPolicy = "batch";
|
||||
|
||||
serviceConfig = {
|
||||
CPUSchedulingPolicy = "batch";
|
||||
CacheDirectory = "gitea/repo-archive";
|
||||
BindPaths = [
|
||||
"%C/gitea/repo-archive:${cfg.stateDir}/data/repo-archive"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services.redis.servers.gitea = lib.mkIf cfg.enable {
|
||||
enable = true;
|
||||
user = config.services.gitea.user;
|
||||
save = [ ];
|
||||
openFirewall = false;
|
||||
port = 5698;
|
||||
};
|
||||
systemd.services.gitea.serviceConfig.CacheDirectory = "gitea/repo-archive";
|
||||
systemd.services.gitea.serviceConfig.BindPaths = [
|
||||
"%C/gitea/repo-archive:${cfg.stateDir}/data/repo-archive"
|
||||
];
|
||||
|
||||
services.nginx.virtualHosts."${domain}" = {
|
||||
forceSSL = true;
|
||||
@@ -202,7 +202,6 @@ in {
|
||||
rrsyncArgs.ro = true;
|
||||
authorizedKeysAttrs = [
|
||||
"restrict"
|
||||
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
|
||||
"no-agent-forwarding"
|
||||
"no-port-forwarding"
|
||||
"no-pty"
|
||||
@@ -214,7 +213,7 @@ in {
|
||||
|
||||
systemd.services.gitea-dump = {
|
||||
serviceConfig.ExecStart = let
|
||||
args = lib.cli.toCommandLineShellGNU { } {
|
||||
args = lib.cli.toGNUCommandLineShell { } {
|
||||
type = cfg.dump.type;
|
||||
|
||||
# This should be declarative on nixos, no need to backup.
|
||||
|
||||
@@ -28,7 +28,7 @@ in
|
||||
users.users."gitea-web" = {
|
||||
group = "gitea-web";
|
||||
isSystemUser = true;
|
||||
useDefaultShell = true;
|
||||
shell = pkgs.bash;
|
||||
};
|
||||
|
||||
sops.secrets."gitea/web-secret-provider/token" = {
|
||||
@@ -53,7 +53,7 @@ in
|
||||
Slice = "system-giteaweb.slice";
|
||||
Type = "oneshot";
|
||||
ExecStart = let
|
||||
args = lib.cli.toCommandLineShellGNU { } {
|
||||
args = lib.cli.toGNUCommandLineShell { } {
|
||||
org = "%i";
|
||||
token-path = "%d/token";
|
||||
api-url = "${giteaCfg.settings.server.ROOT_URL}api/v1";
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
{ fp, values, lib, lupineName, ... }:
|
||||
{ fp, values, lupineName, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration/${lupineName}.nix
|
||||
|
||||
(fp /base)
|
||||
|
||||
./services/gitea-runner.nix
|
||||
];
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# Do not modify this file! It was generated by 'nixos-generate-config'
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
@@ -14,28 +14,27 @@
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/e88adbb7-de01-4f9b-b338-fffed743c259";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@root" "compress=zstd" ];
|
||||
};
|
||||
|
||||
fileSystems."/nix" =
|
||||
{ device = "/dev/disk/by-uuid/e88adbb7-de01-4f9b-b338-fffed743c259";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@nix" "compress=zstd" "noatime" ];
|
||||
{ device = "/dev/disk/by-uuid/a949e2e8-d973-4925-83e4-bcd815e65af7";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/81D6-38D3";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
options = [ "fmask=0077" "dmask=0077" ];
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/82c2d7fa-7cd0-4398-8cf6-c892bc56264b"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
||||
|
||||
@@ -14,27 +14,27 @@
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/ab2e1a13-8e95-48d8-970c-64fa2fab52d0";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@root" "compress=zstd" ];
|
||||
};
|
||||
|
||||
fileSystems."/nix" =
|
||||
{ device = "/dev/disk/by-uuid/ab2e1a13-8e95-48d8-970c-64fa2fab52d0";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@nix" "noatime" "compress=zstd" ];
|
||||
{ device = "/dev/disk/by-uuid/aa81d439-800b-403d-ac10-9d2aac3619d0";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/4A34-6AE5";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
options = [ "fmask=0077" "dmask=0077" ];
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/efb7cd0c-c1ae-4a86-8bc2-8e7fd0066650"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# Do not modify this file! It was generated by 'nixos-generate-config'
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
@@ -14,28 +14,27 @@
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/0a5bda7c-af55-4d3d-9135-7f7cbb78004d";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@root" "compress=zstd" ];
|
||||
};
|
||||
|
||||
fileSystems."/nix" =
|
||||
{ device = "/dev/disk/by-uuid/0a5bda7c-af55-4d3d-9135-7f7cbb78004d";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@nix" "noatime" "compress=zstd" ];
|
||||
{ device = "/dev/disk/by-uuid/39ba059b-3205-4701-a832-e72c0122cb88";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/63FA-297B";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
options = [ "fmask=0077" "dmask=0077" ];
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/9c72eb54-ea8c-4b09-808a-8be9b9a33869"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
||||
|
||||
@@ -14,27 +14,21 @@
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/fcd51970-f040-4c45-94cf-2b372d4599a2";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@root" "compress=zstd" ];
|
||||
};
|
||||
|
||||
fileSystems."/nix" =
|
||||
{ device = "/dev/disk/by-uuid/fcd51970-f040-4c45-94cf-2b372d4599a2";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@nix" "noatime" "compress=zstd" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/A22E-E41A";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
{ device = "/dev/disk/by-uuid/c7bbb293-a0a3-4995-8892-0ec63e8c67dd";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/a86ffda8-8ecb-42a1-bf9f-926072e90ca5"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# Do not modify this file! It was generated by 'nixos-generate-config'
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
@@ -14,27 +14,27 @@
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/85830e14-e2c8-4f04-95fa-d6ab22840bc7";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@root" "compress=zstd" ];
|
||||
};
|
||||
|
||||
fileSystems."/nix" =
|
||||
{ device = "/dev/disk/by-uuid/85830e14-e2c8-4f04-95fa-d6ab22840bc7";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=@nix" "noatime" "compress=zstd" ];
|
||||
{ device = "/dev/disk/by-uuid/5f8418ad-8ec1-4f9e-939e-f3a4c36ef343";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/F372-37DF";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
options = [ "fmask=0077" "dmask=0077" ];
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/27bf292d-bbb3-48c4-a86e-456e0f1f648f"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
||||
@@ -39,22 +39,17 @@
|
||||
"debian-bullseye-slim:docker://node:current-bullseye-slim"
|
||||
|
||||
"alpine-latest:docker://node:current-alpine"
|
||||
"alpine-3.23:docker://node:current-alpine3.23"
|
||||
"alpine-3.22:docker://node:current-alpine3.22"
|
||||
"alpine-3.21:docker://node:current-alpine3.21"
|
||||
|
||||
# See https://gitea.com/gitea/runner-images
|
||||
"ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
|
||||
"ubuntu-26.04:docker://docker.gitea.com/runner-images:ubuntu-26.04"
|
||||
"ubuntu-resolute:docker://docker.gitea.com/runner-images:ubuntu-26.04"
|
||||
"ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
|
||||
"ubuntu-noble:docker://docker.gitea.com/runner-images:ubuntu-24.04"
|
||||
"ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
|
||||
"ubuntu-jammy:docker://docker.gitea.com/runner-images:ubuntu-22.04"
|
||||
|
||||
"ubuntu-latest-slim:docker://docker.gitea.com/runner-images:ubuntu-latest-slim"
|
||||
"ubuntu-26.04-slim:docker://docker.gitea.com/runner-images:ubuntu-26.04-slim"
|
||||
"ubuntu-resolute-slim:docker://docker.gitea.com/runner-images:ubuntu-26.04-slim"
|
||||
"ubuntu-24.04-slim:docker://docker.gitea.com/runner-images:ubuntu-24.04-slim"
|
||||
"ubuntu-noble-slim:docker://docker.gitea.com/runner-images:ubuntu-24.04-slim"
|
||||
"ubuntu-22.04-slim:docker://docker.gitea.com/runner-images:ubuntu-22.04-slim"
|
||||
|
||||
@@ -1,63 +0,0 @@
|
||||
{
|
||||
fp,
|
||||
lib,
|
||||
config,
|
||||
values,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./disk-config.nix
|
||||
(fp /base)
|
||||
];
|
||||
|
||||
boot.consoleLogLevel = 0;
|
||||
|
||||
sops.defaultSopsFile = fp /secrets/skrot/skrot.yaml;
|
||||
|
||||
systemd.network.networks."enp2s0" = values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "enp2s0";
|
||||
address = with values.hosts.skrot; [
|
||||
(ipv4 + "/25")
|
||||
(ipv6 + "/64")
|
||||
];
|
||||
};
|
||||
|
||||
sops.secrets = {
|
||||
"dibbler/postgresql/password" = {
|
||||
owner = "dibbler";
|
||||
group = "dibbler";
|
||||
};
|
||||
};
|
||||
|
||||
services.dibbler = {
|
||||
enable = true;
|
||||
kioskMode = true;
|
||||
limitScreenWidth = 80;
|
||||
limitScreenHeight = 42;
|
||||
|
||||
settings = {
|
||||
general.quit_allowed = false;
|
||||
database = {
|
||||
type = "postgresql";
|
||||
postgresql = {
|
||||
username = "pvv_vv";
|
||||
dbname = "pvv_vv";
|
||||
host = "postgres.pvv.ntnu.no";
|
||||
password_file = config.sops.secrets."dibbler/postgresql/password".path;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."serial-getty@ttyUSB0" = lib.mkIf (!config.virtualisation.isVmVariant) {
|
||||
enable = true;
|
||||
wantedBy = [ "getty.target" ]; # to start at boot
|
||||
serviceConfig.Restart = "always"; # restart when session is closed
|
||||
};
|
||||
|
||||
system.stateVersion = "25.11"; # Did you read the comment? Nah bro
|
||||
}
|
||||
@@ -1,41 +0,0 @@
|
||||
{
|
||||
disko.devices = {
|
||||
disk = {
|
||||
main = {
|
||||
device = "/dev/sda";
|
||||
type = "disk";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
type = "EF00";
|
||||
size = "1G";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [ "umask=0077" ];
|
||||
};
|
||||
};
|
||||
plainSwap = {
|
||||
size = "8G";
|
||||
content = {
|
||||
type = "swap";
|
||||
discardPolicy = "both";
|
||||
resumeDevice = false;
|
||||
};
|
||||
};
|
||||
root = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,15 +0,0 @@
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -0,0 +1,112 @@
|
||||
{ config, pkgs, lib, modulesPath, fp, values, ... }: {
|
||||
imports = [
|
||||
(modulesPath + "/profiles/perlless.nix")
|
||||
|
||||
(fp /base)
|
||||
];
|
||||
|
||||
# Disable import of a bunch of tools we don't need from nixpkgs.
|
||||
disabledModules = [ "profiles/base.nix" ];
|
||||
|
||||
sops.defaultSopsFile = fp /secrets/skrott/skrott.yaml;
|
||||
|
||||
boot = {
|
||||
consoleLogLevel = 0;
|
||||
enableContainers = false;
|
||||
loader.grub.enable = false;
|
||||
loader.systemd-boot.enable = false;
|
||||
kernelPackages = pkgs.linuxPackages;
|
||||
};
|
||||
|
||||
hardware = {
|
||||
enableAllHardware = lib.mkForce false;
|
||||
firmware = [ pkgs.raspberrypiWirelessFirmware ];
|
||||
};
|
||||
|
||||
# Now turn off a bunch of stuff lol
|
||||
# TODO: can we reduce further?
|
||||
# See also https://nixcademy.com/posts/minimizing-nixos-images/
|
||||
system.autoUpgrade.enable = lib.mkForce false;
|
||||
services.irqbalance.enable = lib.mkForce false;
|
||||
services.logrotate.enable = lib.mkForce false;
|
||||
services.nginx.enable = lib.mkForce false;
|
||||
services.postfix.enable = lib.mkForce false;
|
||||
services.smartd.enable = lib.mkForce false;
|
||||
services.udisks2.enable = lib.mkForce false;
|
||||
services.thermald.enable = lib.mkForce false;
|
||||
services.promtail.enable = lib.mkForce false;
|
||||
# There aren't really that many firmware updates for rbpi3 anyway
|
||||
services.fwupd.enable = lib.mkForce false;
|
||||
|
||||
documentation.enable = lib.mkForce false;
|
||||
|
||||
environment.enableAllTerminfo = lib.mkForce false;
|
||||
|
||||
programs.neovim.enable = lib.mkForce false;
|
||||
programs.zsh.enable = lib.mkForce false;
|
||||
programs.git.package = pkgs.gitMinimal;
|
||||
|
||||
nix.registry = lib.mkForce { };
|
||||
nix.nixPath = lib.mkForce [ ];
|
||||
|
||||
sops.secrets = {
|
||||
"dibbler/postgresql/password" = {
|
||||
owner = "dibbler";
|
||||
group = "dibbler";
|
||||
};
|
||||
};
|
||||
|
||||
# zramSwap.enable = true;
|
||||
|
||||
networking = {
|
||||
hostName = "skrot";
|
||||
defaultGateway = values.hosts.gateway;
|
||||
defaultGateway6 = values.hosts.gateway6;
|
||||
interfaces.eth0 = {
|
||||
useDHCP = false;
|
||||
ipv4.addresses = [{
|
||||
address = values.hosts.skrott.ipv4;
|
||||
prefixLength = 25;
|
||||
}];
|
||||
ipv6.addresses = [{
|
||||
address = values.hosts.skrott.ipv6;
|
||||
prefixLength = 25;
|
||||
}];
|
||||
};
|
||||
};
|
||||
|
||||
services.dibbler = {
|
||||
enable = true;
|
||||
kioskMode = true;
|
||||
limitScreenWidth = 80;
|
||||
limitScreenHeight = 42;
|
||||
|
||||
settings = {
|
||||
general.quit_allowed = false;
|
||||
database = {
|
||||
type = "postgresql";
|
||||
postgresql = {
|
||||
username = "pvv_vv";
|
||||
dbname = "pvv_vv";
|
||||
host = "postgres.pvv.ntnu.no";
|
||||
password_file = config.sops.secrets."dibbler/postgresql/password".path;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# https://github.com/NixOS/nixpkgs/issues/84105
|
||||
boot.kernelParams = lib.mkIf (!config.virtualisation.isVmVariant) [
|
||||
"console=ttyUSB0,9600"
|
||||
# "console=tty1" # Already part of the module
|
||||
];
|
||||
systemd.services."serial-getty@ttyUSB0" = lib.mkIf (!config.virtualisation.isVmVariant) {
|
||||
enable = true;
|
||||
wantedBy = [ "getty.target" ]; # to start at boot
|
||||
serviceConfig.Restart = "always"; # restart when session is closed
|
||||
};
|
||||
|
||||
# Don't change (even during upgrades) unless you know what you are doing.
|
||||
# See https://search.nixos.org/options?show=system.stateVersion
|
||||
system.stateVersion = "25.11";
|
||||
}
|
||||
@@ -6,7 +6,7 @@
|
||||
(fp /base)
|
||||
|
||||
./services/nfs-mounts.nix
|
||||
./services/userweb
|
||||
./services/userweb.nix
|
||||
];
|
||||
|
||||
systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
|
||||
|
||||
@@ -4,151 +4,60 @@ let
|
||||
|
||||
homeLetters = [ "a" "b" "c" "d" "h" "i" "j" "k" "l" "m" "z" ];
|
||||
|
||||
phpOptions = lib.concatStringsSep "\n" (lib.mapAttrsToList (k: v: "${k} = ${v}"){
|
||||
display_errors = "Off";
|
||||
display_startup_errors = "Off";
|
||||
post_max_size = "40M";
|
||||
upload_max_filesize = "40M";
|
||||
});
|
||||
|
||||
# https://nixos.org/manual/nixpkgs/stable/#ssec-php-user-guide-installing-with-extensions
|
||||
phpEnv = pkgs.php.buildEnv {
|
||||
extensions = { all, ... }: with all; [
|
||||
bz2
|
||||
curl
|
||||
decimal
|
||||
gd
|
||||
imagick
|
||||
mysqli
|
||||
mysqlnd
|
||||
pgsql
|
||||
posix
|
||||
protobuf sqlite3
|
||||
uuid
|
||||
xml
|
||||
xsl
|
||||
zlib
|
||||
zstd
|
||||
|
||||
pdo
|
||||
pdo_mysql
|
||||
pdo_pgsql
|
||||
pdo_sqlite
|
||||
opcache
|
||||
];
|
||||
|
||||
extraConfig = phpOptions;
|
||||
extraConfig = ''
|
||||
display_errors=0
|
||||
post_max_size = 40M
|
||||
upload_max_filesize = 40M
|
||||
extension=sysvsem.so
|
||||
'';
|
||||
};
|
||||
|
||||
perlEnv = pkgs.perl.withPackages (ps: with ps; [
|
||||
pkgs.exiftool
|
||||
pkgs.ikiwiki
|
||||
pkgs.irssi
|
||||
pkgs.nix.libs.nix-perl-bindings
|
||||
|
||||
TextPDF
|
||||
CGI
|
||||
DBDPg
|
||||
DBDSQLite
|
||||
DBDmysql
|
||||
DBI
|
||||
Git
|
||||
ImageMagick
|
||||
JSON
|
||||
TemplateToolkit
|
||||
LWP
|
||||
XMLLibXML
|
||||
]);
|
||||
|
||||
# https://nixos.org/manual/nixpkgs/stable/#python.buildenv-function
|
||||
pythonEnv = pkgs.python3.buildEnv.override {
|
||||
extraLibs = with pkgs.python3Packages; [
|
||||
legacy-cgi
|
||||
|
||||
matplotlib
|
||||
requests
|
||||
];
|
||||
ignoreCollisions = true;
|
||||
};
|
||||
|
||||
sendmailWrapper = pkgs.writeShellApplication {
|
||||
name = "sendmail";
|
||||
runtimeInputs = [ ];
|
||||
text = ''
|
||||
args=("$@")
|
||||
|
||||
if [[ -z "$USERDIR_USER" ]] && [[ "$USERDIR_USER" != "pvv" ]]; then
|
||||
# Prepend -fusername to the argument list, so bounces go to the user
|
||||
args=("-f$USERDIR_USER" "''${args[@]}")
|
||||
fi
|
||||
|
||||
exec '${lib.getExe pkgs.system-sendmail}' "''${args[@]}"
|
||||
'';
|
||||
};
|
||||
|
||||
# https://nixos.org/manual/nixpkgs/stable/#sec-building-environment
|
||||
fhsEnv = pkgs.buildEnv {
|
||||
name = "userweb-env";
|
||||
ignoreCollisions = true;
|
||||
paths = with pkgs; [
|
||||
bash
|
||||
|
||||
sendmailWrapper
|
||||
coreutils-full
|
||||
|
||||
perlEnv
|
||||
pythonEnv
|
||||
phpEnv
|
||||
]
|
||||
++ (with phpEnv.packages; [
|
||||
# composer
|
||||
])
|
||||
++ [
|
||||
# Useful packages for homepages
|
||||
exiftool
|
||||
gnuplot
|
||||
ikiwiki-full
|
||||
imagemagick
|
||||
jhead
|
||||
ruby
|
||||
sbcl
|
||||
sourceHighlight
|
||||
pythonEnv
|
||||
|
||||
# Missing packages from tom
|
||||
# blosxom
|
||||
# pyblosxom
|
||||
# mediawiki (TODO: do people host their own mediawikis in userweb?)
|
||||
# nanoblogger
|
||||
|
||||
# Version control
|
||||
cvs
|
||||
rcs
|
||||
git
|
||||
|
||||
# Compression/Archival
|
||||
bzip2
|
||||
gnutar
|
||||
gzip
|
||||
lz4
|
||||
unzip
|
||||
xz
|
||||
zip
|
||||
zstd
|
||||
|
||||
# Other tools you might expect to find on a normal system
|
||||
acl
|
||||
coreutils-full
|
||||
curl
|
||||
diffutils
|
||||
file
|
||||
findutils
|
||||
gawk
|
||||
gnugrep
|
||||
gnumake
|
||||
gnupg
|
||||
gnused
|
||||
less
|
||||
man
|
||||
gawk
|
||||
file
|
||||
diffutils
|
||||
gnugrep
|
||||
util-linux
|
||||
vim
|
||||
wget
|
||||
which
|
||||
xdg-utils
|
||||
iproute2
|
||||
curl
|
||||
less
|
||||
|
||||
gnuplot
|
||||
system-sendmail
|
||||
];
|
||||
|
||||
extraOutputsToInstall = [
|
||||
@@ -158,10 +67,6 @@ let
|
||||
};
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./mail.nix
|
||||
];
|
||||
|
||||
services.httpd = {
|
||||
enable = true;
|
||||
adminAddr = "drift@pvv.ntnu.no";
|
||||
@@ -176,7 +81,6 @@ in
|
||||
|
||||
enablePHP = true;
|
||||
phpPackage = phpEnv;
|
||||
inherit phpOptions;
|
||||
|
||||
enablePerl = true;
|
||||
|
||||
@@ -212,33 +116,12 @@ in
|
||||
UserDir ${lib.concatMapStringsSep " " (l: "/home/pvv/${l}/*/web-docs") homeLetters}
|
||||
UserDir disabled root
|
||||
AddHandler cgi-script .cgi
|
||||
DirectoryIndex index.html index.html.var index.php index.php3 index.cgi index.phtml index.shtml meg.html
|
||||
SetEnvIf Request_URI "^/~([^/]+)" USERDIR_USER=$1
|
||||
|
||||
<Directory "/home/pvv/?/*/web-docs">
|
||||
Options MultiViews Indexes SymLinksIfOwnerMatch ExecCGI IncludesNoExec
|
||||
AllowOverride All
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
<DirectoryMatch "^/home/pvv/.*/web-docs/(${lib.concatStringsSep "|" [
|
||||
"\\.git"
|
||||
"\\.hg"
|
||||
"\\.svn"
|
||||
"\\.ssh"
|
||||
"\\.env"
|
||||
"\\.envrc"
|
||||
"\\.bzr"
|
||||
"\\.venv"
|
||||
"CVS"
|
||||
"RCS"
|
||||
".*\\.swp"
|
||||
".*\\.bak"
|
||||
".*~"
|
||||
]})(/|$)">
|
||||
AllowOverride All
|
||||
Require all denied
|
||||
</DirectoryMatch>
|
||||
'';
|
||||
};
|
||||
};
|
||||
@@ -276,7 +159,6 @@ in
|
||||
|
||||
ConfigurationDirectory = [ "httpd" ];
|
||||
LogsDirectory = [ "httpd" ];
|
||||
LogsDirectoryMode = "0700";
|
||||
|
||||
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
|
||||
LockPersonality = true;
|
||||
@@ -1,12 +0,0 @@
|
||||
{ config, lib, ... }:
|
||||
{
|
||||
services.postfix.enable = lib.mkForce false;
|
||||
|
||||
services.nullmailer = {
|
||||
enable = true;
|
||||
config = {
|
||||
me = config.networking.fqdn;
|
||||
remotes = "mail.pvv.ntnu.no smtp --port=25";
|
||||
};
|
||||
};
|
||||
}
|
||||
+15
-15
@@ -77,29 +77,29 @@ in
|
||||
|
||||
id
|
||||
echo "Before if statement"
|
||||
stat "''${REGISTRATION_FILE}"
|
||||
stat ''${REGISTRATION_FILE}
|
||||
|
||||
if [[ ! -f "''${REGISTRATION_FILE}" ]]; then
|
||||
if [[ ! -f ''${REGISTRATION_FILE} ]]; then
|
||||
echo "No registration file found at '$REGISTRATION_FILE'"
|
||||
cp --no-preserve=mode,ownership "${baseConfig}" "''${REGISTRATION_FILE}"
|
||||
cp --no-preserve=mode,ownership ${baseConfig} ''${REGISTRATION_FILE}
|
||||
fi
|
||||
|
||||
echo "After if statement"
|
||||
stat "''${REGISTRATION_FILE}"
|
||||
stat ''${REGISTRATION_FILE}
|
||||
|
||||
AS_TOKEN="$('${lib.getExe pkgs.jq}' -r .as_token "''${REGISTRATION_FILE}")"
|
||||
HS_TOKEN="$('${lib.getExe pkgs.jq}' -r .hs_token "''${REGISTRATION_FILE}")"
|
||||
DISCORD_TOKEN="$(cat /run/credentials/matrix-ooye-pre-start.service/discord_token)"
|
||||
DISCORD_CLIENT_SECRET="$(cat /run/credentials/matrix-ooye-pre-start.service/discord_client_secret)"
|
||||
AS_TOKEN=$(${lib.getExe pkgs.jq} -r .as_token ''${REGISTRATION_FILE})
|
||||
HS_TOKEN=$(${lib.getExe pkgs.jq} -r .hs_token ''${REGISTRATION_FILE})
|
||||
DISCORD_TOKEN=$(cat /run/credentials/matrix-ooye-pre-start.service/discord_token)
|
||||
DISCORD_CLIENT_SECRET=$(cat /run/credentials/matrix-ooye-pre-start.service/discord_client_secret)
|
||||
|
||||
# Check if we have all required tokens
|
||||
if [[ -z "$AS_TOKEN" || "$AS_TOKEN" == "null" ]]; then
|
||||
AS_TOKEN="$('${lib.getExe pkgs.openssl}' rand -hex 64)"
|
||||
AS_TOKEN=$(${lib.getExe pkgs.openssl} rand -hex 64)
|
||||
echo "Generated new AS token: ''${AS_TOKEN}"
|
||||
fi
|
||||
|
||||
if [[ -z "$HS_TOKEN" || "$HS_TOKEN" == "null" ]]; then
|
||||
HS_TOKEN="$('${lib.getExe pkgs.openssl}' rand -hex 64)"
|
||||
HS_TOKEN=$(${lib.getExe pkgs.openssl} rand -hex 64)
|
||||
echo "Generated new HS token: ''${HS_TOKEN}"
|
||||
fi
|
||||
|
||||
@@ -115,13 +115,13 @@ in
|
||||
exit 1
|
||||
fi
|
||||
|
||||
shred -u "''${REGISTRATION_FILE}"
|
||||
cp --no-preserve=mode,ownership "${baseConfig}" "''${REGISTRATION_FILE}"
|
||||
shred -u ''${REGISTRATION_FILE}
|
||||
cp --no-preserve=mode,ownership ${baseConfig} ''${REGISTRATION_FILE}
|
||||
|
||||
'${lib.getExe pkgs.jq}' '.as_token = "'$AS_TOKEN'" | .hs_token = "'$HS_TOKEN'" | .ooye.discord_token = "'$DISCORD_TOKEN'" | .ooye.discord_client_secret = "'$DISCORD_CLIENT_SECRET'"' "''${REGISTRATION_FILE}" > "''${REGISTRATION_FILE}.tmp"
|
||||
${lib.getExe pkgs.jq} '.as_token = "'$AS_TOKEN'" | .hs_token = "'$HS_TOKEN'" | .ooye.discord_token = "'$DISCORD_TOKEN'" | .ooye.discord_client_secret = "'$DISCORD_CLIENT_SECRET'"' ''${REGISTRATION_FILE} > ''${REGISTRATION_FILE}.tmp
|
||||
|
||||
shred -u "''${REGISTRATION_FILE}"
|
||||
mv "''${REGISTRATION_FILE}.tmp" "''${REGISTRATION_FILE}"
|
||||
shred -u ''${REGISTRATION_FILE}
|
||||
mv ''${REGISTRATION_FILE}.tmp ''${REGISTRATION_FILE}
|
||||
'';
|
||||
|
||||
in
|
||||
|
||||
+10
-10
@@ -51,24 +51,24 @@ in
|
||||
script = let
|
||||
openssl = lib.getExe pkgs.openssl;
|
||||
in lib.concatMapStringsSep "\n" ({ name, value }: ''
|
||||
mkdir -p "$(dirname '${value.certificate}')" "$(dirname '${value.certificateKey}')"
|
||||
if ! ${openssl} x509 -checkend 86400 -noout -in '${value.certificate}'
|
||||
mkdir -p $(dirname "${value.certificate}") $(dirname "${value.certificateKey}")
|
||||
if ! ${openssl} x509 -checkend 86400 -noout -in ${value.certificate}
|
||||
then
|
||||
echo "Regenerating '${value.certificate}'"
|
||||
${openssl} req \
|
||||
-newkey rsa:4096 \
|
||||
-new -x509 \
|
||||
-days '${toString value.daysValid}' \
|
||||
-days "${toString value.daysValid}" \
|
||||
-nodes \
|
||||
-subj '${value.subject}' \
|
||||
-out '${value.certificate}' \
|
||||
-keyout '${value.certificateKey}' \
|
||||
-subj "${value.subject}" \
|
||||
-out "${value.certificate}" \
|
||||
-keyout "${value.certificateKey}" \
|
||||
${lib.escapeShellArgs value.extraOpenSSLArgs}
|
||||
fi
|
||||
chown '${value.owner}:${value.group}' '${value.certificate}'
|
||||
chown '${value.owner}:${value.group}' '${value.certificateKey}'
|
||||
chmod '${value.mode}' '${value.certificate}'
|
||||
chmod '${value.mode}' '${value.certificateKey}'
|
||||
chown "${value.owner}:${value.group}" "${value.certificate}"
|
||||
chown "${value.owner}:${value.group}" "${value.certificateKey}"
|
||||
chmod "${value.mode}" "${value.certificate}"
|
||||
chmod "${value.mode}" "${value.certificateKey}"
|
||||
|
||||
echo "\n-----------------\n"
|
||||
'') (lib.attrsToList cfg);
|
||||
|
||||
+5
-10
@@ -1,14 +1,12 @@
|
||||
{ lib, stdenvNoCC, fetchurl, makeWrapper, javaPackages }:
|
||||
let
|
||||
jre = javaPackages.compiler.temurin-bin.jre-25;
|
||||
in
|
||||
{ lib, stdenvNoCC, fetchurl, makeWrapper, jre }:
|
||||
|
||||
stdenvNoCC.mkDerivation rec {
|
||||
pname = "bluemap";
|
||||
version = "5.20";
|
||||
version = "5.15";
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
|
||||
hash = "sha256-txDN/vG429BHT09TrSB8uQhmB8irrmvvOXX4OX3OSC0=";
|
||||
hash = "sha256-g50V/4LtHaHNRMTt+PK/ZTf4Tber2D6ZHJvuAXQLaFI=";
|
||||
};
|
||||
|
||||
dontUnpack = true;
|
||||
@@ -17,10 +15,7 @@ stdenvNoCC.mkDerivation rec {
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
|
||||
makeWrapper ${jre}/bin/java $out/bin/bluemap \
|
||||
--add-flags "-jar $src"
|
||||
|
||||
makeWrapper ${jre}/bin/java $out/bin/bluemap --add-flags "-jar $src"
|
||||
runHook postInstall
|
||||
'';
|
||||
|
||||
|
||||
@@ -33,63 +33,63 @@ in
|
||||
lib.mergeAttrsList [
|
||||
(mw-ext {
|
||||
name = "CodeEditor";
|
||||
commit = "2db9c9cef35d88a0696b926e8e4ea2d479d0d73a";
|
||||
hash = "sha256-f0tWJl/4hml+RCp7OoIpQ4WSGKE3/z8DTYOAOHbLA9A=";
|
||||
commit = "83e1d0c13f34746f0d7049e38b00e9ab0a47c23f";
|
||||
hash = "sha256-qH9fSQZGA+z6tBSh1DaTKLcujqA6K/vQmZML9w5X8mU=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "CodeMirror";
|
||||
commit = "b16e614c3c4ba68c346b8dd7393ab005ab127441";
|
||||
hash = "sha256-J/TJPo5Oxgpy6UQINivLKl8jzJp4k/mKv6br3kcCSMQ=";
|
||||
commit = "af2b08b9ad2b89a64b2626cf80b026c5b45e9922";
|
||||
hash = "sha256-CxXPwCKUlF9Tg4JhwLaKQyvt43owq75jCugVtb3VX+I=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "DeleteBatch";
|
||||
commit = "1b947c0f80249cf052b58138f830b379edf080bc";
|
||||
hash = "sha256-629RCz+38m2pfyJe/CrYutRoDyN1HzD0KzDdC2wwqlI=";
|
||||
commit = "3d6f2fd0e3efdae1087dd0cc8b1f96fe0edf734f";
|
||||
hash = "sha256-iD9EjDIW7AGpZan74SIRcr54dV8W7xMKIDjatjdVkKs=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "PluggableAuth";
|
||||
commit = "56893b8ee9ecd03eaee256e08c38bc82657ee0a1";
|
||||
hash = "sha256-gvoJey7YLMk+toutQTdWxpaedNDr59E+3xXWmXWCGl0=";
|
||||
commit = "85e96acd1ac0ebcdaa29c20eae721767a938f426";
|
||||
hash = "sha256-bMVhrg8FsfWhXF605Cj5TgI0A6Jy/MIQ5aaUcLQQ0Ss=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "Popups";
|
||||
commit = "6732d8d195bd8312779d8514e92bad372ef63096";
|
||||
hash = "sha256-XZzhA9UjAOUMcoGYYwiqRg2uInZ927JOZ9/IrZtarJU=";
|
||||
commit = "410e2343c32a7b18dcdc2bbd995b0bfdf3bf5f37";
|
||||
hash = "sha256-u2AlR75x54rCpiK9Mz00D9odJCn8fmi6DRU4QKmKqSc=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "Scribunto";
|
||||
commit = "fc9658623bd37fad352e326ce81b2a08ef55f04d";
|
||||
hash = "sha256-P9WQk8O9qP+vXsBS9A5eXX+bRhnfqHetbkXwU3+c1Vk=";
|
||||
commit = "904f323f343dba5ff6a6cdd143c4a8ef5b7d2c55";
|
||||
hash = "sha256-ZOVYhjMMyWbqwZOBb39hMIRmzzCPEnz2y8Q2jgyeERw=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "SimpleSAMLphp";
|
||||
kebab-name = "simple-saml-php";
|
||||
commit = "4c615a9203860bb908f2476a5467573e3287d224";
|
||||
hash = "sha256-zNKvzInhdW3B101Hcghk/8m0Y+Qk/7XN7n0i/x/5hSE=";
|
||||
commit = "a2f77374713473d594e368de24539aebcc1a800a";
|
||||
hash = "sha256-5+t3VQFKcrIffDNPJ4RWBIWS6K1gTOcEleYWmM6xWms=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "TemplateData";
|
||||
commit = "6884b10e603dce82ee39632f839ee5ccd8a6fbe3";
|
||||
hash = "sha256-jcLe3r5fPIrQlp89N+PdIUSC7bkdd7pTmiYppSpdKVQ=";
|
||||
commit = "76a6a04bd13a606923847ba68750b5d98372cacd";
|
||||
hash = "sha256-X2+U5PMqzkSljw2ypIvJUSaPDaonTkQx89OgKzf5scw=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "TemplateStyles";
|
||||
commit = "f0401a6b82528c8fd5a0375f1e55e72d1211f2ab";
|
||||
hash = "sha256-tEcCNBz/i9OaE3mNrqw0J2K336BAf6it30TLhQkbtKs=";
|
||||
commit = "7de60a8da6576d7930f293d19ef83529abf52704";
|
||||
hash = "sha256-iPmFDoO5V4964CVyd1mBSQcNlW34odbvpm2CfDBlPBU=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "UserMerge";
|
||||
commit = "6c138ffc65991766fd58ff4739fcb7febf097146";
|
||||
hash = "sha256-366Nb0ilmXixWgk5NgCuoxj82Mf0iRu1bC/L/eofAxU=";
|
||||
commit = "71eb53ff4289ac4efaa31685ab8b6483c165a584";
|
||||
hash = "sha256-OfKSEPgctfr659oh5jf99T0Rzqn+60JhNaZq+2gfubk=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "VisualEditor";
|
||||
commit = "9cfcca3195bf88225844f136da90ab7a1f6dd0b9";
|
||||
hash = "sha256-jHw3RnUB3bQa1OvmzhEBqadZlFPWH62iGl5BLXi3nZ4=";
|
||||
commit = "a6a63f53605c4d596c3df1dcc2583ffd3eb8d929";
|
||||
hash = "sha256-4d8picO66uzKoxh1TdyvKLHebc6ZL7N2DdXLV2vgBL4=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "WikiEditor";
|
||||
commit = "fe5329ba7a8c71ac8236cd0e940a64de2645b780";
|
||||
hash = "sha256-no6kH7esqKiZv34btidzy2zLd75SBVb8EaYVhfRPQSI=";
|
||||
commit = "0a5719bb95326123dd0fee1f88658358321ed7be";
|
||||
hash = "sha256-eQMyjhdm1E6TkktIHad1NMeMo8QNoO8z4A05FYOMCwQ=";
|
||||
})
|
||||
]
|
||||
|
||||
@@ -83,7 +83,7 @@ def get_newest_commit(project_name: str, tracking_branch: str) -> str:
|
||||
content = requests.get(f"{BASE_WEB_URL}/{project_name}/+log/refs/heads/{tracking_branch}/").text
|
||||
soup = bs4.BeautifulSoup(content, features="html.parser")
|
||||
try:
|
||||
a = soup.find('li').find('a')
|
||||
a = soup.find('li').findChild('a')
|
||||
commit_sha = a['href'].split('/')[-1]
|
||||
except AttributeError:
|
||||
print(f"ERROR: Could not parse page for {project_name}:")
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -10,19 +10,22 @@ let
|
||||
in
|
||||
buildNpmPackage {
|
||||
pname = "delete-your-element";
|
||||
version = "3.5.1";
|
||||
version = "3.3-unstable-2026-01-21";
|
||||
src = fetchFromGitea {
|
||||
domain = "git.pvv.ntnu.no";
|
||||
owner = "Drift";
|
||||
repo = "delete-your-element";
|
||||
rev = "80ac1d9d79207b6327975a264fcd9747b99a2a5d";
|
||||
hash = "sha256-fcBpUZ+WEMUXyyo/uaArl4D1NJmK95isWqhFSt6HzUU=";
|
||||
rev = "04d7872acb933254c0a4703064b2e08de31cfeb4";
|
||||
hash = "sha256-CkKt+8VYjIhNM76c3mTf7X6d4ob8tB2w8T6xYS7+LuY=";
|
||||
};
|
||||
|
||||
inherit nodejs;
|
||||
|
||||
npmDepsHash = "sha256-EYxJi6ObJQOLyiJq4C3mV6I62ns9l64ZHcdoQxmN5Ao=";
|
||||
patches = [ ./fix-lockfile.patch ];
|
||||
|
||||
npmDepsHash = "sha256-tiGXr86x9QNAwhZcxSOox6sP9allyz9QSH3XOZOb3z8=";
|
||||
dontNpmBuild = true;
|
||||
makeCacheWritable = true;
|
||||
|
||||
nativeBuildInputs = [ makeWrapper ];
|
||||
|
||||
|
||||
@@ -8,18 +8,18 @@
|
||||
|
||||
php.buildComposerProject rec {
|
||||
pname = "simplesamlphp";
|
||||
version = "2.5.0";
|
||||
version = "2.4.3";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "simplesamlphp";
|
||||
repo = "simplesamlphp";
|
||||
tag = "v${version}";
|
||||
hash = "sha256-Md07vWhB/5MDUH+SPQEs8PYiUrkEgAyqQl+LO+ap0Sw=";
|
||||
hash = "sha256-vv4gzcnPfMapd8gER2Vsng1SBloHKWrJJltnw2HUnX4=";
|
||||
};
|
||||
|
||||
composerStrictValidation = false;
|
||||
|
||||
vendorHash = "sha256-GrEoGJXEyI1Ib+06GIuo5eRwxQ0UMKeX5RswShu2CHM=";
|
||||
vendorHash = "sha256-vu3Iz6fRk3Gnh9Psn46jgRYKkmqGte+5xHBRmvdgKG4=";
|
||||
|
||||
# TODO: metadata could be fetched automagically with these:
|
||||
# - https://simplesamlphp.org/docs/contrib_modules/metarefresh/simplesamlphp-automated_metadata.html
|
||||
|
||||
@@ -0,0 +1,99 @@
|
||||
hello: ENC[AES256_GCM,data:+GWORSIf9TxmJLw1ytZwPbve2yz5H9ewVE5sOpQzkrRpct6Wes+vTE19Ij8W1g==,iv:C/WhXNBBM/bidC9xynZzk34nYXF3mUjAd4nPXpUlYHs=,tag:OJXSwuI8aNDnHFFTkwyGBQ==,type:str]
|
||||
example_key: ENC[AES256_GCM,data:ojSsrFYo5YD0YtiqcA==,iv:nvNtG6c0OqnQovzWQLMjcn9vbQ4PPYSv2B43Y8z0h5s=,tag:+h7YUNRA2MTvwGJq1VZW8g==,type:str]
|
||||
#ENC[AES256_GCM,data:6EvhlBtrl5wqyf6UAGwY8Q==,iv:fzLUjBzyuT17FcP8jlmLrsKW46pu6/lAvAVLHBxje6k=,tag:n+qR1NUqa91uFRIpALKlmw==,type:comment]
|
||||
example_array:
|
||||
- ENC[AES256_GCM,data:A38KXABxJzMoKitKpHo=,iv:OlRap3R//9tvKdPLz7uP+lvBa/fD0W8xFzdxIKKFi4E=,tag:QKizPN1fYOv5zZlMVgTIOQ==,type:str]
|
||||
- ENC[AES256_GCM,data:8X2iVkHQtQMReopWdgM=,iv:2Wq3QOadwd3G3ROXNe7JQD4AL/5H/WV19TBEbxijG/8=,tag:tikKT9Wvzm4Vz5aoy6w9WQ==,type:str]
|
||||
example_number: ENC[AES256_GCM,data:0K05hiSPh2Ok1A==,iv:IVRo61xkKugv4OiPm0vt9ODm5DC1DzJFdlgQJb1TfTg=,tag:o3xXygVEUD4jaGSJr0Nxtw==,type:float]
|
||||
example_booleans:
|
||||
- ENC[AES256_GCM,data:zoykmQ==,iv:1JGy1Cg5GdAiod9qPSzW+wsG6rUgUJyYMEE4k576Tlk=,tag:RUCbytPpo78bqlAVEUsbLg==,type:bool]
|
||||
sops:
|
||||
age:
|
||||
- recipient: age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsOE50MkkxV1p0UlVUT0dE
|
||||
WCtLMEk0ZSttY25UMjNHSHB1QzJ4N2l5WnpFCkNpdmlCY1VxWVo0ZStVclZ0amo4
|
||||
dGhSRWY1SElRZXZzdWo5UDNjUHMzUjAKLS0tIDI3elNXSXJHQU5qb3hCSHYwWnoy
|
||||
N3BhNmJQZjIrbWlVRytxZ3dFMjBtL1kKn7/DTPfJtdBomSplnBomYhsxJbX7kJQa
|
||||
1Qsr+bmugWxHFIPhoDwPIBpChQkLvAo8exQpduos18FsXgvMmB0guQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXdnNSSEJoaUQwdTNTMDY4
|
||||
QUxuLzRIWVNkM25QNTZ5VTBwQlYvT2p3SURzCnJmd2g1YUY0cmdLL3FkQTQ4NURL
|
||||
YncyY3VROTFUeDc5ZlB1aWdXVGNNdjgKLS0tIEtXeDdRLzl4RXhpS2o5ZUE4YkpI
|
||||
RjBObVhlWncrRnVidEtGN2N0ZitzNlUK/ooEeWCY5nDgny43q45wvl/e6qq/X4B/
|
||||
7Q/DPj13BcrWRgoCYeHlq6VlIerz5ERNgxyR/qKuVSGAVroSVY6spA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoRy9CaHY1WEEzOXdUSjd2
|
||||
aFlGU3NGcW5MeHg3U2d0UEk0SXJIcmg4RVFzCkpwODhBWld6T1VNS2haSkpxL0hn
|
||||
b0VRWVNFcTE5c0t3VkFZQ1R1d2dnbmMKLS0tIDdNMHBrU0RRSmlBZUJobXQxZUt2
|
||||
MzZSYlM5bjYzUlRYNXkzNzZlWmx3L0UKkH6WOXHFRRbCprSjxcONSVUN/9NEQvtS
|
||||
Jg+dJSMviq6GvUfUNmNvPJHfyy+CYT6a2Zd+4NdYCetRLsRJPc6p3A==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUckpiMzYrU1NnNFJ4MGps
|
||||
OEt0c0o3Ty9QejhEM29wZFMrNTNyMHlHWlRBCnBHUUdvcmxoL0FqVEtBSHlma25P
|
||||
c2tITUtZTGVzOGdidC84OUYvRlpxSjAKLS0tIFNMVmdiWmJNZUdLS1g3T3ZINUh6
|
||||
Mjg5RHdKYnV3Z2V0L3E3ZlA2WDB0WlkKJr4Vg6rnKqGpL6N143QYfLqS4lQIED/J
|
||||
SYQds8mCiyCNGvV6ON4k096jXcuMAZ1w+0bA16AHlTXnqgIgfaHpKA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHL1QvSUlWUTN4OTBKOURa
|
||||
VkVVb29McWgxa3gwb2lkVTdSZmUrVVZpSERjCm9oTTFRckg3SUM1a0tJRVlaU3RL
|
||||
dUtsU0FpY1JyNkx6K1U1MWcrSjNYbUUKLS0tICtvTjJVdG1PSXF4TVltZ204SnVu
|
||||
VE9aT3l2dGgxMWNHUXQ0bDN2RjVOek0KwOa/vczHZa+SRr8j6KvkfZZ0kajxXOq0
|
||||
5AoDz2Mtcs+qBctTuogdLCZoL2ZpRVV7v1dGI+Fm1cVLoutV19IvTQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWVFp0ZlRhU29DNUhMSmRy
|
||||
Y3VVV2pmajJmaU9qN0tHR1E3ekFMS3o0K2pRClIwek5GYzNNZEliK2ZTT1NVZklQ
|
||||
YWpqY3poN0E1ZTVOTVRhL3FQSVZmZW8KLS0tIHpuWktoa1EwcXc1bEJJYk5VbEw3
|
||||
blE2VXBuTDdlbHJTVjRzOWdyem1UWTQKg5uZRhcLpmiVcadqdJoscqsBD2u6UGx+
|
||||
qT0IoSVOzsBlJw2t9rH1zR7WfRSlCXT1NYzu9aTWGqQaB8qvEtyk4g==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFdjhMM1ZpM2xFVXlvOXZK
|
||||
MlRZT2U5YzhMUVR1L0FqVVdiSTFTYUpyN25rCjB6ajMwTnNTaWk5d21vM0Zza243
|
||||
dHhSOHM0c3cwS1c5dGxhbzBNVm9DeFEKLS0tIEpOY1lWVE04UkNYNDdCcUdnTUhI
|
||||
NC9xOENWZUNyay9SeXRjSUdkMlE4UXcKiygSIWelRUZQPbiK2ASQya7poe1KCXmo
|
||||
XIlgOaUe1+lvY8s2bjdud0+7QlPOKeyciCSFNNqIxzHMYSEKwNCbpg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2025-03-15T21:42:17Z"
|
||||
mac: ENC[AES256_GCM,data:2gH/ZaxSA6ShRu53dxj7V3jk7FsVdYS+PSHQyFT8qMvKM1hsQ/nWrKt00PUl9I7Gb4uomP9Ga3SyphYOXRBzKoV+x52oEWOJE3Q4iPrwdCkyHlxEezhTd/ZRQVatG6dvHpLuDNS9Dyph4f7Mw5USI+m4WeVdgCvHTydw+4KIfP4=,iv:yimfq96WVsagvKr8HTg1RdZBSrVGcCWPvv8XOXkOfcg=,tag:zHzdrE0PX5+AeD2lpqeJVQ==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-01-16T06:34:38Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA0av/duuklWYAQ/+O1tft/OfS52K8cmcQE7I7aFb85P2L+7u1TdmTjHwNFkC
|
||||
3jhvzPkNDQDkMIc5EPZKX5WLUS8F1UaqCw4b8zZtqoTqKDpu0S92KL500iXwBxft
|
||||
D3cRMFFb6GBoSlPJVBt6LMRJjGLWCkBihlYL1AknoVV7VERj8m1cvcstdp3qbEd7
|
||||
c+X6t5B+7N0/QPdh2KyrHWXyCzFc/6emVjNGy2EoXRt7idFF2yTbafobCs/hZ8LZ
|
||||
RJyhpGyR9QPtAwFP9Und62tCd4ZwG5FazZBLevRrmD7AOW1WnQhyYvxBvqQp/Oz+
|
||||
lFmhcirLw5CaC1AbF2k3uNoAHXVWyexaQeu2gsNYXq+lpsdCWT8WtrAtNCyC2StI
|
||||
PtdrdQ9oikJptmoWQ0zEBXKXdV8AhukLSX0wtis74KbmcS+2YyNKvQksGF2ZfHBh
|
||||
U9ycfJr1kwm7TAg5Lg6XOmKrdOJkPoIcUCk2QW7MfS3nwwMLt3BjhhpRVUfeUmjB
|
||||
Jjjs+jUXEusnmwmvGGgEU2pT944FLuFClSI8JTnIZ61YkjF7zAtrURvsNKlqu/UG
|
||||
JLrWR+dnnh1YK0qQEcqt6giNSX2IWrw5SpJ8Jekt0TWfB1HDHybQUyFC/n/je/XK
|
||||
0ouAeDL9oqh0eRU3ng4KKhOXNn+WO3/HrnG//KFwokc//BNNvP8qM0CTtPQbQ1HS
|
||||
XgFjhTfzV0T4LyUryuict4rLVI+DDbzWGRp0umdobvQE1CGLhKCanrd2/Ng6fAny
|
||||
9G09vYF5zK95uzqFBCTh1zFr6+rhfbMI501TwBu1KxOaJdYs3vzLiTGWoyI48JM=
|
||||
=5fyo
|
||||
-----END PGP MESSAGE-----
|
||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.8.1
|
||||
+75
-75
@@ -7,126 +7,126 @@ gitea:
|
||||
lupine-5: ENC[AES256_GCM,data:+PYUtLBx9MdIebR0nWSNGKKCyKcGpI62BXj7AN1iV4wU4+2awrWZ2Q==,iv:PALEU/sYebhPTO4ZXEm2uV6z9hN678ZxqOSnaHVlyro=,tag:Enb08N6TYlOh+x70pcpJYA==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- recipient: age18lta9d683yekz487xwtd99da236d8mgk4ftlmv2jffx858p9qf2s9j868l
|
||||
- recipient: age1fkrypl6fu4ldsa7te4g3v4qsegnk7sd6qhkquuwzh04vguy96qus08902e
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRDdtTmdvRDRPaU53Mjd3
|
||||
S25SeU5rUnZibmh2Y01HZUVhZjVWUVBJVXlvCm1uaURNYURGRUhhc25vSmFodEJC
|
||||
RnRob3VLNHYycDlMRkwya3JJK092UlUKLS0tIFMwMExQZTVxVDAwYzRSaDhTRC80
|
||||
VU5jeTBFcGYvNE9tVUVuNmV5WjMycjgKF9GIvJTczigKH+dbTAOHK0S966/QE/7M
|
||||
HtgdJi9roiyDwI9k56r35/MP3eURffXBWTmc8WZRHTxnhzo1GBpg0A==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXOTAzdEFVNmRWUFNzY211
|
||||
NUpoMnpoVmpCeFIzU3JacDIxcjNYUTBCZTFrCnpFMUtydndyUDY3emdVVEp4dUpy
|
||||
ZWhTRGEvdG9pQ2JvQ3pGL2s0M3Z1WHcKLS0tIExjaWh3MHk5WEZVQS9lYnkyemxE
|
||||
UjhRL0swUnBJNmNzaGtUMjE2WlZ2VDAKYV8T2iXVEr77e0vuV8e8xpbhStxUoM9l
|
||||
Jpn3XiYuoWHk/bmQyjQIQzjB4oqx4TqEnHccSmN3XtUIPGr296zwMg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1e0a4ru707v637wzmuxqv0xywmlkhunzgyfy4mrkjc7a23qq8msgq7nqtvt
|
||||
- recipient: age1mu0ej57n4s30ghealhyju3enls83qyjua69986la35t2yh0q2s0seruz5n
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqMGtpL3JJaDN2Qm95b1cz
|
||||
VEF2bHU3VjJLNUQya25lL01qYkFreFpTVGdBCkdHdnBUUjlXOU4yTkE5ZTF2OFll
|
||||
UXNQTWsrQ2FGV21kRkllY2E5S0NRS1kKLS0tIGY1aHkyVE5XbHpLbGVBUVFmNlVy
|
||||
VDcvTUY5YVEvOWFQOG5ULzFlQU9IMTAKQ601N8YNayuYrkZqqsKqlsnHN4rSMzN1
|
||||
sesAmJVuj7ZddGQlzIJC9cydXkssmY5oDIj92J7DXTzhFQlO0o9tfA==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuVVdmdEdZcTYxajVHQmtF
|
||||
L1pad0ZxVUdlWXVjNHl3eEIxZlNtdlY2WGlBCi9NUUVEakZLV044dldDSkZzaFhS
|
||||
U3FJanBaL0JGV3AyS2daTFNrM0J1M1EKLS0tIGs5ZjRZcVREenN0L2RPaWp5c0s1
|
||||
U3AxOEpvdmozU3RRMGYzZGZOZGVhSWsKHEz+eL/fHgLUuixFIeA2dUAjZekzRIHy
|
||||
NgYmzaWhY7IlPg4mZRIW7hW+ckfr9brdgOR3Gn5Fp3tPbAL9GO7bnQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1wmrrhd5deatmgflkas636u3rzuk46u9knl02v4t39ncs37xqquhq9vwzye
|
||||
- recipient: age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5ZFV6cWN3OEloVmIrWG9Z
|
||||
U0RxNVF0RlJ6UDNMK0psQjVKUkJiR0JUMWxBCll3NHpFempRcCtSYUQzWi9kclFP
|
||||
Z3k5MXdCcTMxT21GL3E3Yk5md0o2cjAKLS0tIFZML05kSm1sVnIyRmpsSmdGbG8z
|
||||
SllNcDVzSE4wTTB5NTNTYXJoemlIMUEKbJwinjEIjgwlShvUr+Jcfay0ha8Ndo6L
|
||||
KM0QvKlcsx5Z6pqyYt6TvnlhyhcljN1IFfoUO5r3E9lYSyanv3HJRA==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5THp4MkRiUGd0VDVERjU2
|
||||
bmR5OWlkTFFmQUM2QmRNWU5DSUI3eFV4djBVCnF3dTV1aGlMUTd2UWlyUWtXcnlG
|
||||
TFFRdUp4dnpXZ2FLSGZoRUsvRlR6ekUKLS0tIDVBMC9oUnBuQXpkcEZHSUd0NzNp
|
||||
U2czY3YxRG10aW9hVGJsbkJwWTEwV0kKaNQRm6qmIIbztzrmw6nZSA131lxw7PA9
|
||||
MBPmPQmskIbGJ/bQCfZ7Sp/Pe51sL3moA8tWMqGZEVa+xuxa/KEKSQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1ml48zztcmnrdrhrdsjrlyxf09jtmjgz46u8td4zm59wn3fm4g57qs4wg0l
|
||||
- recipient: age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3SG15dS9JNmRETjBZL001
|
||||
VnNSN1o1ZENwdStLdnMxaGp2OVg4WFVUWmpvClJESk9KVi8rdkU5Q0ZHSnhOell2
|
||||
K1UzMWpOMVUwUFc1STdVUjNsekt6L1UKLS0tIEIyTG9UMWs0UjZIZUpvMFA0ZWlZ
|
||||
THhnZWZNckdTOXNpSjVDUEFWQW8rOE0K5ts7BAbcZ7L3cId+jjbC8ZDOnCEAjFW7
|
||||
lizGlAPolgH6uNpPczneeFBczfU8nnWOcJTpPXQDxXiWv7y0aemJRQ==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmYUJkQkhJbjU4a3ZNbzJM
|
||||
NGFXS2ZDSjM0Nk9BVVVCNUx0Um9mbmVXT21BCmRjL0pNcUs1NWdxYkQyc25nMG53
|
||||
c1lkaHVyRnloRGZmWk82K3RZVzNnTjAKLS0tIERndWk2TFJWSFUraldwczFOVm13
|
||||
NWRDWGdMNXFraE5ueTM0ZG9hMHpKTjgK4xTJKPcrk3EHwMoXlTHzqeDgx9ZJl962
|
||||
8lyQMOSeICyXLzRgKQWuXssDMuev0CZfvnXeWp8megmXuU5Eq1GW5A==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age12gws5nws69vxryd3kt7q0ayngch90efmhqcrfhnnsmj00lkgxd4qsdkvqn
|
||||
- recipient: age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLQUEwa0cvcndUbnlpTlYr
|
||||
ZUtEdlRKcmlrQU1USlZVeXNXejhBSUdLdGxNCmpzRHpoM1VNemo5angweW9QMGJ2
|
||||
ZGpqZHpWeUwzZWl2NWJnbTBGYlcxZ2MKLS0tIHZJT05EZmI2NGRsZ05sL0Y1VmY1
|
||||
Q1p0b2dJMXNhRFdYdHV3UFhUQzVmQVEK/3E/fDJcuwN8UJq05Dg0YLHhFRLjl4i7
|
||||
98dDpycvPV8Py82q4pNpvI+goZ2T19QcxArSLNLQwd3TqIYvLHB+FA==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUY1p6QjViNmdHcjY2and5
|
||||
aEYvOXpxWEtqUnRTNEgxeE44NzZ3VW00OEZFCjJVN0Q4c0FJNEZEaDVXZlNkMTlr
|
||||
cGQ1WWhMY0JCTEVLUDNGMHZFZDAvOU0KLS0tIDE4ZklUMWtKL3JlbzlrUXdvekJt
|
||||
cjhrRmQrQ3g0UG8wKzZHMllidmRaQ0EKVG9D8Fh7xMzNPXecdX6zTfank2/ZNnjl
|
||||
mwxCXnM2e5udtviQURJstLvlCElNtvdY5WdMkUoCXwHoMspPwGByFw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxOEhSZzhkZ25rL1dZVlRw
|
||||
R0JMaUR2VXQ5cnYvdjRwQjU5VWYwcGRYbUMwClVBYi9nOHZkejBxamxKeHJSZmFC
|
||||
NUFuQkVxS3VCMVZaMERYUG5Ba2FyTjQKLS0tIE5BTlN5MnYzTnlZbXpmNXBOL0NZ
|
||||
TGpFN2xCTWcybnBBL0o2MVFoQzNRMkEKtprwI3p45huVaLJvqTNLU1k17uSObJaA
|
||||
QEL/qzgLr//fSxiMQfJRtvqpcGuL/kTnmU56tJdLVCDAfFvW0OH9gQ==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3NGpoWUVmK2ttVno2cG44
|
||||
aGRVSStsc280cGFZL0xERUdrNjJVV01HemdBCmZBSEg0V3FHNVEzWDBId1RYck4w
|
||||
dEd3WnVhUk0wdHRxOE9WUnpaUThLa2MKLS0tIHhWbXJmZ1Y4RWZ3Y1g3dTI0MzMw
|
||||
eGdwemRYSCtoM0FseXhLd0Fzc1dzUG8KdPDyA/XJSgjHFycEwSg7KWX4fMA30CDq
|
||||
GIWYDVDicgzbxjNKcQdGzFvL02B1igogHtuIJn1qE/bNrK6L9PQ3pA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZTWVYY3hPMi85QjhYQWlW
|
||||
R0s0bnVpNEFmalFBS3lISmtWanNPcEpPRlF3CjY2TnliWGJocWtkbjZZQUpPZ3dS
|
||||
TUlDS3JVb09CZ3pUNGZvQkVFMHIreW8KLS0tIE0wS1Q0THdocmw2RGZ1RWtvbjY1
|
||||
a3hmLzNiY2ZQdk5TQzExOGJPeTd0U0kKVqulWO1BniSTpYHa7fYwG0oj+hq+clGq
|
||||
/XlvYUYNIApaAid3G9LrZNL7g3mhq1ANuDGMY7n0Z6/xhysTZwRzEQ==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxTG81cS96bWtOWHJTK0RC
|
||||
WlAzWWdiZkhncWRBVXZtVXdQeTR4WEl5MVJ3CkY5NEpnMmdpVnh1eXBCajhPT1Rr
|
||||
ZWpkUm40WHpFcVdQcStWWVZWZU41VjgKLS0tIGRyUnBsb3FnRE9IL3RkTktjN3dO
|
||||
ZEY3d0I3WVVhQUNPcmhKYW1sVlBGSmsKTsZwHdholYxIhOn49WTdb3pnjT8oTkH5
|
||||
mfayWji2cOBRRRB9X40OaVg8SCIhVAQNdvbn64XaJWqWbXFtXamgLw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsNkM5ZjRIK2FKL1B3S0tl
|
||||
ZUdzMC9ONStkYnZZRm1VQy9FMVJkNk9SY1IwCnJFTVRTL1FkRlAySmF1ZDdBVUxz
|
||||
M1lOdEhnRjI4blNhL1FYVEJubmQ5YVEKLS0tIEtLWktCQVp1eW10SnhkaUJDYnNv
|
||||
cDdvRVl6a3VhZXhwUkl6eHo0OGxxUDQK5/Z3OCFIb4HOBBxHj0B7a0AuPXgPbuh5
|
||||
TPGvfJpa3Ow/eJSpEdXOm6chTrvPsgGHKYZS75SAgHMP8SHHIPuxuQ==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhejJHU2N3cVF0TnNqZytD
|
||||
UERpTmNnT0FJMysvbVYvNGM5ejNVcE5wemhjCjhyYVpsaDJlNHI2aVg1eXZtV21a
|
||||
eHVFL1ljWXRkYlFrTkgvWHhKS2NZOHcKLS0tIEVLRFhKR0tyeUJ3Z3ZoREY2c2VI
|
||||
c29MWkcvUFlzU0VCTnFTV01rWkxDVGsKcyKsGo6Ep7f2dBwaUYoMsqSqQrn3Obzm
|
||||
sDovKBx+Y7+Yn6fnxy3ISQ9FUjupMtKffiO2AAK7AAI3MFjDOUb9zg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzVXhHTE83aDFvN3U3Tncz
|
||||
TzlYSVB1NzdvQVY5bU1yZTRhU0V1bXgyZ21RCm1WekpqcHE3cG5sRkM4Z2k4UzFK
|
||||
TlZMOFFrb3BBZ0d3dDMzUzFueDJiZFUKLS0tIHkraEY4STNWbDZmQm4rUnFHWU5a
|
||||
bHpyUUM4NlN3VDhVYVhFNVYyeElqVDQKm44tte4aQ5/0XVMd7IvnahRxdrSePHKn
|
||||
f6EUC0tBdSAifbe8JdCvTz2DDbUbXRxDxZCJ35ATyB0K1AEgcVEVvA==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPVGVOcE9TdVFDYURFeEE5
|
||||
M0t1Zm95SUZpNzdFR0N3UVYwdG1yOWErUTNBCjB4WWtRdXNJV1FVd0xNODUzTDZD
|
||||
ZXRteEpwendneS95alVhckJyMXZucXMKLS0tIDZLNFdGUTNMTm5KUkF2TWxPNk1O
|
||||
V0FISGRYNmZ0N3dXc3RHdGNpQldOVE0Kkc7MRhVvpKlIVGKRvvPGyW/DzatxM7+Z
|
||||
VP4kAf0Vu6DyKZINDXH5XQh6qxeAccYXhv/QhxdSuCW4bjplMMBSnw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3VTZXR2hZT2FERFNhNXVs
|
||||
MkREdWxxNWNvZy9jRkp0d2YwNm5IRDY3Zm44CjZ0SC9NWE40TmFtR2NSMUZtMmV2
|
||||
MXJ1SjI0V2lBWElXS1FHUTNRa3g5MVEKLS0tIGhnYW1yd3h5Zk1UYXpzZG1XeUdF
|
||||
Q2VuWG8yOE1ob1Ayd2Z6NllhNnMxK2MK1BzxHusN/Ad0+2ExwK/q8qyPObDL+112
|
||||
o5/LeOh2vA3KQOG7QmlfhOK8NEID2dcWXoK3Kg8H24rowZq+WQryqg==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrVDZVbDBOR0d2VDJHY0Q5
|
||||
VkdETUV2dFVWcUM0N3pwU0dlekJqYzZPZEhZCkZWd0dVS25jYm5Eb1hES3Z5SmFk
|
||||
WnVEYmFtRURTa2FUYXhpQkNLUnhjbFUKLS0tIForS3RPcFkvenJNaW9wMFAyOEpP
|
||||
c2g3UlRHc1ljVGZaWVRlTUVORzNoczQKFvxD6ty10YobBU2BuyVpDsqGI1nie4Oh
|
||||
eQbvBEqfTN3zR38ujT6/tLfyNrtj71oGzI9M+vUUGbrmob+/y2VABg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXblVrSXJjVUVtaWltVzQy
|
||||
OGFDR05TNTJEY2M3dUQ5bEtnaVF2dnd3VVdjCmFlL3MwVEFrYml5UE54U3Z5bUNU
|
||||
dVRiUmlZS1lEMms2YzNxRjQ2NzAxdW8KLS0tIFhKS2hZS1Y4a2E0SzY2dHFPTUk0
|
||||
MTc3MVhaU0s5anZPdUg4RlFiZmU4MHcKepCAfP8iMOJ39LL4S8XA18pXAYZgcdLO
|
||||
xNV7kAcdXpywk/ffnWAukwI32LegGQ+efNtysCeESNKomSDtXKtm6Q==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOblRZRERwT1k0cUVkeXlF
|
||||
bXZ6VnU1TmE2dFlaU1IwMXV0V09FZjR1bUFFCnFUa0hzeXhvTjlaSk9lZFZHT1d2
|
||||
RU5NQXJBb1FISTVnSFJheEZLTFNWa28KLS0tIFEzUWFvOXE4WGRkWmxtd1hvUGZu
|
||||
QlBkaCsxdlEyT1hhbVA0c3J4bkhHU0EKbdPpiKgu416P0Ciacs3wkH0OAeHKyzQE
|
||||
ekyNhHHKT7IqJSvEl47PpTIsgk99SrLgImNKY8sDieOqDVuM0bhgTA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2025-12-04T05:53:51Z"
|
||||
mac: ENC[AES256_GCM,data:o55keAaJEXVOAGvoMp8FWvtlxMgfF/qR50FGnNM1whYz+5+naRJ1dAOW9NKYHWbtOa/ZXEMTkjoFrTJidAaIXza1Ot8llbTGYh56fsnu0FKZfVM+rvecRDhXKWxiAqyiLUvtUfA2fSg9LGveh2U+0dulcU25sb3Wf0RcFrtM3xI=,iv:3/UllekmGIaluv8y8I6Azd/52dJzk+C5ah6XLJj7Zik=,tag:T5ILXiC5hK++0jGOnHCMYA==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-04-18T16:25:16Z"
|
||||
- created_at: "2026-01-16T06:34:51Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA0av/duuklWYAQ/+KtiEJNL7M4M8NH+UhisZPM5q7RecKdQde4yjJF5YrXey
|
||||
SNcy98WJJrX4p5ZBccLxJ6IW6UNIxFz7JX227jQDCAbPvGBh0uCJTpSosChJHs7s
|
||||
GUt/7CHfyV2+Z0FJS6iN6AZrE6Kjkkc3Uyp/Wt1va56gQ8Xx9hZHhjjgXEiORYWZ
|
||||
bU7DKvX5n5A7GNkrBTZ/+YKtRqT/m6ZPVWfVnY0rY9KhzfvmmyOpQrB7n/DcdUbf
|
||||
+OhAP7p3UdEWquh9OJOiDRUqo7ykGCw/dYltmt2I9JcGiyKsLyyTTtFWgZSnUCsm
|
||||
DFCGXkFwPOsxE1WxRpl0mR7P77rMvHxJEukUNUW0DMPUjzaaHH8LINukgpOD0hpQ
|
||||
yvfFjRKUG4Ygi4mSmETylll7pD9XBRfihTjJ5vh4VQH5PAHecWtIXgYSso12Zx6v
|
||||
nmvgZTmikSBImEqS/MOM5Zx+esmjlEsgKuXP9HmIwBwHExLGF7U93OGswF3vEW+X
|
||||
GuMguPfwmW/w4fFX8t2Ln9uA/E06SlD7wG9sZji1NkwW/h0/3BEOdcg5MTyQQdNe
|
||||
mn5pyFKoH88Km2ktjVRq10ImUa2ZLyL/6RTHZ+BryXvRDtBW0zzbZhPHVvpCLKbZ
|
||||
lkLSEwVhGFfWaRWfGsEx28MGMKicirZjw/RsRXq19alruLW3entRRRkFV71zeMXS
|
||||
XgESJpGWxo709IBQvsooJ/2VRHnGZNkvJipWc9pPmRYQLrxP9jxX34jcmjkNYX08
|
||||
wcmJ+ioRqPV1qvYfxdnKTtth4g7ePZywDo6FUgiCwaEa8jhR8ISsDM2DCDAg/LA=
|
||||
=3HI1
|
||||
hQIMA0av/duuklWYAQ//S5CPlAJka09zfxhQCKY9SnHOlkNL3mQxSN9EcxiKFgQD
|
||||
G2/qlFze7CiswTr608TXNQ/lPb+SJHgLrJvcBwISh0MCKKOZtyNjfSIIdR1A/JTE
|
||||
OaA/JCJ76j2W7YWYrL18dY57n7DOMmhf/BZj0hI4PtDqh+dB2vX/U2i3kWdODb/K
|
||||
fowmPrqustOLGAXOhuKegtQ8K5KLsP3NHjrp5TiOYmI7fDVkwvBnqXj52n94pw3n
|
||||
o+HpvmyWFSm7QExGsjbbMbtDEmJJ/u8arx+Tb+ELumrz7QgwXt9ZGoPpJnmz9SsC
|
||||
4MoTF8Ul4HRwMoMyGEQAzb1J32THFKWSUtWaLjNDOW91l/eiLpY0Kk5f1BTVcD4W
|
||||
GsA63BsSqnIDB4Tisz4ZRhaRGY6sxyXHDSnHzVQmKrv3kwTJm8ODA18gu+HZ021h
|
||||
ShG+m81PYrGkeqYwJHnEMfSo4XY4/lHdsZ0yldF8eSjZ2raPbsw+lmadot8mc1eE
|
||||
leiEJOP6+ZOs60dJ+dOwaeCb5CDjFaCrq6c0+6ESWpN354tN9L9DZGLlYIt2AlcM
|
||||
/N/5DO5F81jxlBbxI4IFwRvBDBwO81eQlVtjQB5V1+dbeIaZYS6GN72xHUSjICNJ
|
||||
0Wv8iDwxKRjQI2uol7KmPN0Vr9siMIMAP4yCppnmdxF5VcGbLWNu9lZfxlj5o4fS
|
||||
XgHq8TJTMWKGF2Yq25/5rKmIb/8cCOU8XLNZ3xT4X2dErqV+nWtmXgmNySCphn+C
|
||||
xK/cKHseztzXzffdqCrJCaeo2KmTou+gMyDEmJrVLhrcIMayptt9dc0dgJ12N3s=
|
||||
=pLWS
|
||||
-----END PGP MESSAGE-----
|
||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||
unencrypted_suffix: _unencrypted
|
||||
|
||||
@@ -1,93 +0,0 @@
|
||||
dibbler:
|
||||
postgresql:
|
||||
password: ENC[AES256_GCM,data:3X9A3jOpFVRuBg0gRiCEsZVKfLI=,iv:XC7LBNUhALk9IEhItV8fO5p/m7VKL0REBY1W2IZt7G4=,tag:l18R7EhbOlucZHFQiEvpHw==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- recipient: age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvTk5YU3Z2Yy9HS1R4ME5I
|
||||
UU1PRWVncHJYcXY5RlFpOWVQUWZsdy93ZDFBCnlxWkpaL1g5WmNSckNYd202WE40
|
||||
RkwwSEM1YUNNZmozejlrdW8yY1JiekkKLS0tIHVWY0JKZm9CNWhzVGl4cG82UXZs
|
||||
ZnllQzJiK1ZkRmFndmtYdW9IclFWY1EK82f1iGt3nt8dJnEQlMujNqConf6Qq6GX
|
||||
hqoqPoc2EM4kun28Bbpq4pAY7eEPRrWFqOkjYVvgIRoS88D7xT3LWg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5WTJIOUcxRlBuNmRrNUZo
|
||||
MXFxeVJBTEhDK00yTUw1U2dHckNFYWZKWkhNCnYxYmtrUEVvd1RaYUI5WTRTRW16
|
||||
S2NhbDdpdDZhSkVWeUhjZDhKd3ZpTmcKLS0tIFovWm5lOXBzcnN3Zm5GQlBhNmlp
|
||||
eTB4WldMNW9GNUwwaEUzRThsemxRVzQKGpa0J2PBzDRdHijm0e3nFAaxQCHUjz+L
|
||||
KataXJEMCijJ6k+7vpb5QMxe2jB1J2PMxNGFp0bWAy2Al3p/Ez2Kww==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZaW1ZSXhVeFVTQW9WYzVh
|
||||
WkVUM2JkOU5VNU9oQXE2Y2pvcFlOWTdvbnpJClduS0RHL2xja291a2doQ0wzbzhQ
|
||||
NmJOSGVvQUdxM3IvaS8zRW1VbVhvYmsKLS0tIHoyOUdvT0xXWXo3SWcyQ1lqTmJS
|
||||
ZUdnS2RvOXI1dGNYQTl6ZHE1cUdMWHMK4ycAJQLyKCgJIzjQ02bPjz4Ct9eO6ivw
|
||||
kfWhyMaoWwM9PhFcwSak0cLpX0C/IOzSzO78pf3WhG16pV7aXapdog==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqaml0OVlhcUJSU1hSY3lP
|
||||
bkM0cUV4Z2ZLeERHZ3BUNExuYS9KSU5CekQ4CmQ3SE1vdDBtdFJ6czZYR3U5Tk1X
|
||||
SFJmTVlERjBzV0hFalFLMmVLQzNNdXMKLS0tIDdJLzZveFdnYTI0azk1UXJZLzZF
|
||||
Sy9XbjhwOFR6SFpaNHZLd3ZxdmxOVUEKBBbGmdVVlKHxO+/iODznLP3+dJGppybW
|
||||
+1k9uenVHzie+pDKcrQpSyX2WDnmgg7hUAUiXPuz1eEWmwbRJnU/5w==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXK01vOVV5YlhsZ2ljYS91
|
||||
OUVEaEpTbXFKOHVNVDVoMTlrS05wRmsyM2dvCjZHOXlCUGowd0J4UlQzSzM5dWJ0
|
||||
eU50SHdtZ2ZyUE1JVHdvODFxWDYvRWsKLS0tIDhlRVQ0Mm5Ua0J2aExqMzRyUGlP
|
||||
RUR6Yi9SUDFCUkZmRk5hYTVFeGloZXcKY/XtaSoW8Pu2wS4oistLSc0T5JvMnt+w
|
||||
s3yfe/zx9/1K6OtbeljF9FZVOB/dOamvk+Qlfl0T5qush7/WgGzErA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOM0pFb2tRTURtWmp6elRN
|
||||
M0xtajlzMTNPMnppcGhJMVlsNHdwWmNGbFVFCnlxM1JQTkR2elAvdytKUEJ3djBS
|
||||
UnlhL0tLLzY3Z05RU3phNDZIOGtTMFEKLS0tIEpOZDUxU1JQVXJTbmVFQlVkOUcy
|
||||
eWlyWGhaS1JCNitUSVVScFk2WGEvOG8K2rpYPGx5jhyyRK4UkeJR96wDFr4Frzsr
|
||||
QWz7fYZRWKWf0H0qn+bm9IfVJiBAlS5i16D1FnipZVmdWefFaZSEPg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJVFV0WVZrK0wzbnhkcmcz
|
||||
c2lIdVlKcFpoYjZIWlNPN0M5N2g2WG9YdlRJCjg5YlNoSzQ5YW5yRUVSeTEzRThY
|
||||
WklKQzlzRXdrUUlFNzF4M1BFZCtPT28KLS0tIDlUOTVIQVZJNFJwTnQxN0Z1ZlQx
|
||||
MmxPMWNPYzJiOFRqY2VYczhvRm5IR3cKpUVV+zsMolsHI2YK9YqC6ecNT6QXv0TV
|
||||
d1SpXRAexZBeWCCHBjSdvQBl8AT4EwrAIP2M2o++6i5DaGoGiEIWZQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2026-02-10T20:02:28Z"
|
||||
mac: ENC[AES256_GCM,data:i8CjVxoD7zdkLNJlI9DCo/tDV5DUI7JdpozLtYZzI7Cu51GayaE2Y3Wg4de6P0L7C3FER04WfRe/h+G9PLZICX/CfSipQysyrEq3Pjt9IKsjytDhP9VYJ36QFGF0PuHUQAMSLts/tAoAvLue6MP+V82l5js9ghvyBrzyBGxoyJw=,iv:QFNxvCYxrSkwy7iT+2BEacNPftDXju1cibprVPDjic0=,tag:496E+oCy/VwTylyaWhQD+A==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-02-10T20:01:32Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA0av/duuklWYARAAnSjSeI8BybEl1PwNt3KTGcUjpCI+XZPWgNWuvjIymVBv
|
||||
ZgNESNktJB4loNvd/+TIADE7TqGFQK9ev6IPRoDHHkSMdmJ9Bc/lu2HPO+rJa1yD
|
||||
vLXbjf8vRa+GkBDV8DTrPPFvSrHY+jv9vQIzY3nQPKMlyV58E85N262q/2gJUfm9
|
||||
cy/dYE2BUWMQC1DfiGbBRC4xGHhp94XccOMBkIpchP+BL90ZVpocnxeSrSjBsSLE
|
||||
wuhMQPRQSI4PFm8ZYajf6tF001HDa5zaqF1lqkTxtxypDDUr8BVb9n/ObaD8omDI
|
||||
QHQUiPmVgpDs7w2Ph5UgJxK1c+dOcG+mXsl1CHOLldA29sNzDBuh94PKfRl1B3cY
|
||||
KPoPIqntdn59zzRDbuVJxWeJal7Ffynwsrx4h7w7muIR/FYeaFphsokE5Q6gqwTO
|
||||
ZqWY2tuQ0CFRtMl7HB7ZVdSsKv6D5DlesXPXdrhQBKRrNylBpSBmcZH8KRAuHGNj
|
||||
4GFZRN++GFuq54d7wB689kn+F7+pbNom7CDILXiCrz8+9DjFw0maDRoas8OaUyW6
|
||||
kfyJe/YnK94EyCPitkJWYc9uvA2t9y25Rm9uUSvh7WnTFAEK9mJLOal4VgHbqCtg
|
||||
zSGbdw79U4H0Umbi5eSCvEYNtv7eBzKaS/t6irfDRr1WajNhThcd1wmnvjZYxl3S
|
||||
XgHOucYvQvxXjqG0B0Qbd12ucYthPO1+gozEzWxJx2wtiL3gClPYOaiteRlO/XQA
|
||||
WTG6A36X3IxB6qW8lEx12geyjHxFYb82BjyrBnnlj+YcViIBpPQqd8Dz6sl4Rls=
|
||||
=tCoI
|
||||
-----END PGP MESSAGE-----
|
||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.11.0
|
||||
@@ -0,0 +1,84 @@
|
||||
dibbler:
|
||||
postgresql:
|
||||
password: ENC[AES256_GCM,data:2n85TO709GJc7/qoYp2RXO8Ttfo=,iv:5ZCZPEQQXPGYfDd1qPhDwDfm1Gds1M8PEX9IiCsHcrw=,tag:PAseyFBAe56pLj5Uv8Jd7A==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- recipient: age1hlvwswsljxsvrtp4leuw8a8rf8l2q6y06xvxtafvzpq54xm9aegs0kqw2e
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4WllOQ1dRSUJ6a1pvNFg2
|
||||
N0YrQVBtMFZKRml0dG5PUGVhcU9VUXVHc25nClNFSXowUVRRVVhNeHUrTVVZRGRC
|
||||
YkpVYlcrZm1NTE1IT1pSTDdOZGNHYlEKLS0tIHlJbkNBb3o0TlJlbEtsQ2ZsYlJn
|
||||
Wis3T2V5QVYvQi9laUdoaE1DbUZZZE0K/liRzp6TJeufyTzemv+zBTOwzkeJRID4
|
||||
ZviYwwODWopB9/rCd8sIQaNXvEtvuXNWwcV1/p8DsJ9NHwqtdYHpmw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByY0dTMWc2VEVRdTJyOXo4
|
||||
R3BYb1VETHI2RktGVnVJUzg4WUsxbTNsK2tVCjVqVml3d29lK21wUXFnRm5GNHdX
|
||||
blV4NEFZU01ZS3Qwc2FSMlVDRlU0SEEKLS0tIExwWXFJZGRTaTBSbjZtdTBXSXNJ
|
||||
TUhJWkIrdGg5UDdDQkdnQk50YTQ0M0UKqoMwtPlOSIqMcLvII/EVuZGrNDeULJHK
|
||||
l7xCzQM0n72E/zxPuO7koVXVcUNwn4kNQCRLOHLcuqx2ZRD8Oc+zNA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxNy8rcHpJclk1b0h2T0dw
|
||||
U0pBYlJvQXlZTG1PeTRCV2hONEJlUWFqdUIwClJ4QnQyOGt4d1NEcVZYek9JUC9X
|
||||
UW0wNjArK2YvZDRMMGpRU1N1dk9jSDQKLS0tIGJMbkZxLzZBVm4wNXVTNFpoRDNo
|
||||
a3dwemI2Wlh2RE8zN0xsbmY5YnJUeTAKhkSpB4RgrfbDpK7IwLs1KGXCj8v0Rze3
|
||||
YZh3BHW2WZLS7uQcIe/tnpIHwPrQnadKeYIw7xBmXu9dWyim9/5RyQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxUnA5SXNucGN4bi9zeGlU
|
||||
TzJPUGk5SWVONFVVYnNnejJBdFJmL3d1S0Y0Ci9SOVZmVUMzRWNicGN2dE5aRy80
|
||||
MFh3MUNTSE5EWEhQcUFsUENDdWlWYkkKLS0tIDYrb2RzVm9OTHlzKzBCdEtPYnF3
|
||||
L2VmNm5ITEUwUVJ3WXRmVGZnY0RSNE0KraXjJSZ9HKV8SO93khWVjBJcEYQLI0Rm
|
||||
lQuagfkZ5oaedsPGNqaXWo/cd3g2SZOfhmmRxY9R9gxmnjpP4L6gGg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKTlgxOGJwbDYrbXNDWmNY
|
||||
YzZGTTdlQXBFRUEySW1Rd0Z4bi90akZIOGpBCjdseUJIeGlJZVB1WDNFeU5LZDE0
|
||||
cExQSFBPTWlUbVRjREdJaXROTjRwWTgKLS0tIENPM2VnZGtyaUowZmx5ZVdZVjRz
|
||||
SW9kSTVBbDJUWHBzV0xBYTlReGloSkEKq6Q3HVKRnw2B0CUvgXlUkQUBgmCNLP80
|
||||
fY5/ePAWZKt4P6TxzPNFH3aANWcnVC2/QxF2RgYfDXKKp1AVlAIlTA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvS2gzN0ZyakcyVjlYRUZU
|
||||
OFNmUHhsTysxV0JIV1JlM3hLNW9KRm9oY0gwCkh3SWxUV3ZqRXluVVRyRC9OQzVa
|
||||
ODE0NnE2ZHdZc1Qrdkp0YWZFZ0xnMWMKLS0tIFFsNElqVlZ3Sm56b2ZNcEpQMXo4
|
||||
RGJCWmpyd1g1NC9Ud3I3TWRBZ2llblEKVrHE0kPVjapor98D4Z1gCtQsuWS/iAuE
|
||||
5cje1AZdpYVdHoRtzRxKwPekfm9xa/knzFckjjO0JizTQWTPYg0gsQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2026-01-25T14:03:57Z"
|
||||
mac: ENC[AES256_GCM,data:RBf3LjVNSclsPN7I4QPaDUjWbKlaccjk3rzsRNdRe3+OvJSd7MsS9RfpUFCqUtO7ZkkocXHmkHA8z8LNxs6vejT9czMsLLQD14qHZS6fFdTnToOx3Kt5UuviPO/2UryVI+6HWORkH1aqFJhzkSMop2TO5mzuOTfbCEBLYUUuS6s=,iv:NQs8O1hIbjzGBTZo+gCuisj3edraFGk/Y146HmfPmQY=,tag:4g9IXw2UFC5V9EIHuWJqdA==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-01-26T04:52:39Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA0av/duuklWYARAAtSg5bRhk7DN14CpdTtG9XPwQfZAP2EvCpFqXcU1LnIqi
|
||||
odRqr1vzFlgXH/A/36C/c/JN7M0673PWivUidiMU38/WExgzxPTe/mpwoTHqRRgG
|
||||
aSP5or2UjhwbN7M844JGbTMNAIUh9bVG2/Qm6cLFhv2HalAVhhnWsbIdJIjUmpjU
|
||||
cMjCfxO36uTVp1SajeJKd9x9n+AbWY84SzN/7HYrFcJQomOyb6FcioIwHcIe2YdN
|
||||
GEdNkA13+hTNBR2ZYW3wrPxr39qK4R3mEJambwZLhQfRwUaqIB6PqvXICdqeLbRc
|
||||
2OfzR5oN5HE3Z7QGwDDM8x8diegLYUyTyY3yhJ8PcCs44mXL2XN6XGefgNWuxxDd
|
||||
o8189NRNXD2xloiIcbBJQ6Mpix+qlEI4VRnaxiGI3huv/vpKqSxBZFCu4x4kxGwj
|
||||
OuaX3cPsvjzj0WEFsAvmrUB/Qdabfhhdm1TgY1PqoXfCudyLuDYqRg8sjIIUjmtA
|
||||
/EyXTO6Ah+vc/NP3mLcHeFAh91Lzvxvm6jEmpN7/jg9zbIzs0jNeVchFYxxVZuRn
|
||||
J6ySrkQ5x4FC1DdJlxv36uOLdbsosgia8q3WHOfbt/Lyp/n1RuQX2Kjysi/C79ap
|
||||
xYaozqRmuJIy4Ph4PbhA737PFS4GEyKsHfvskWeGvpGiu/XHP+R+AfE45Mac1O/S
|
||||
XgEgpNsTDb4GS70fjYBjaSyLcgCeAhqt4Mm4O3UTrYWLfziVLMI7vl9zTznGmY9n
|
||||
fS70cnezoSWVj9Nfz+EmmsRWwAYRebzqLWaAtPmrrS5IbWZkLgpay7ga1y9cACo=
|
||||
=0Z+d
|
||||
-----END PGP MESSAGE-----
|
||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.11.0
|
||||
@@ -228,7 +228,7 @@ in {
|
||||
(mkConnection "demiurgen" "eno1")
|
||||
(mkConnection "sanctuary" "ethernet_0")
|
||||
(mkConnection "torskas" "eth0")
|
||||
(mkConnection "skrot" "enp2s0")
|
||||
(mkConnection "skrot" "eth0")
|
||||
(mkConnection "homeassistant" "eth0")
|
||||
(mkConnection "orchid" "eth0")
|
||||
(mkConnection "principal" "em0")
|
||||
@@ -270,4 +270,10 @@ in {
|
||||
|
||||
interfaces.ens18.network = "pvv";
|
||||
};
|
||||
nodes.bakke = {
|
||||
guestType = "openstack";
|
||||
parent = config.nodes.stackit.id;
|
||||
|
||||
interfaces.enp2s0.network = "pvv";
|
||||
};
|
||||
}
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
users.users.alfhj = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
shell = if config.programs.zsh.enable then pkgs.zsh else pkgs.bash;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMCAYE0U3sFizm/NSbKCs0jEhZ1mpAWPcijFevejiFL1 alfhj"
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
users.users.amalieem = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
shell = if config.programs.zsh.enable then pkgs.zsh else pkgs.bash;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPsMtFIj4Dem/onwMoWYbosOcU4y7A5nTjVwqWaU33E1 amalieem@matey-aug22"
|
||||
];
|
||||
};
|
||||
}
|
||||
+8
-8
@@ -32,6 +32,10 @@ in rec {
|
||||
gateway = pvv-ipv4 129;
|
||||
gateway6 = pvv-ipv6 1;
|
||||
|
||||
bakke = {
|
||||
ipv4 = pvv-ipv4 173;
|
||||
ipv6 = pvv-ipv6 173;
|
||||
};
|
||||
bekkalokk = {
|
||||
ipv4 = pvv-ipv4 168;
|
||||
ipv6 = pvv-ipv6 168;
|
||||
@@ -69,17 +73,13 @@ in rec {
|
||||
ipv4 = pvv-ipv4 179;
|
||||
ipv6 = pvv-ipv6 "1:2";
|
||||
};
|
||||
principal = {
|
||||
ipv4 = pvv-ipv4 233;
|
||||
ipv6 = pvv-ipv6 "4:233";
|
||||
};
|
||||
ustetind = {
|
||||
ipv4 = pvv-ipv4 234;
|
||||
ipv6 = pvv-ipv6 234;
|
||||
};
|
||||
skrot = {
|
||||
ipv4 = pvv-ipv4 237;
|
||||
ipv6 = pvv-ipv6 237;
|
||||
skrott = {
|
||||
ipv4 = pvv-ipv4 235;
|
||||
ipv6 = pvv-ipv6 235;
|
||||
};
|
||||
temmie = {
|
||||
ipv4 = pvv-ipv4 167;
|
||||
@@ -87,7 +87,7 @@ in rec {
|
||||
};
|
||||
gluttony = {
|
||||
ipv4 = "129.241.100.118";
|
||||
ipv4_internal = "192.168.20.77";
|
||||
ipv4_internal = "192.168.20.11";
|
||||
ipv4_internal_gw = "192.168.20.1";
|
||||
ipv6 = "2001:700:305:aa07::3b3";
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user