Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 oysteikt
|
a2078c590a
|
@@ -101,8 +101,6 @@
|
||||
|
||||
# users.mutableUsers = lib.mkDefault false;
|
||||
|
||||
users.users.root.initialHashedPassword = "$y$j9T$ahP6GAdttD17OMBo7Yqeh.$Ad7qBcFvTL7HrJ9uTtrQzksN3220Nj9t/CrP6DwgK34"; # generated using mkpasswd, see huttiheita root on vaultwarden
|
||||
|
||||
users.groups."drift".name = "drift";
|
||||
|
||||
# Trusted users on the nix builder machines
|
||||
|
||||
@@ -8,5 +8,6 @@
|
||||
# Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
|
||||
virtualisation.vmVariant = {
|
||||
security.acme.defaults.server = "https://127.0.0.1";
|
||||
users.users.root.initialPassword = "root";
|
||||
};
|
||||
}
|
||||
|
||||
@@ -62,10 +62,8 @@ in
|
||||
name = "loki";
|
||||
match = "*";
|
||||
|
||||
host = "loki.pvv.ntnu.no";
|
||||
port = 443;
|
||||
tls = "on";
|
||||
"tls.verify" = "on";
|
||||
host = "ildkule.pvv.ntnu.no";
|
||||
port = 3100;
|
||||
uri = "/loki/api/v1/push";
|
||||
compress = "gzip";
|
||||
|
||||
|
||||
Generated
+9
-9
@@ -189,16 +189,16 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1782122067,
|
||||
"narHash": "sha256-95q3DiYOTHjQGbqR0I1w4ETrH+smtddqW0bBxaB/Egg=",
|
||||
"lastModified": 1764844095,
|
||||
"narHash": "sha256-Drf1orxsmFDzO+UbPo85gHjXW7QzAM+6oTPvI7vOSik=",
|
||||
"owner": "dali99",
|
||||
"repo": "nixos-matrix-modules",
|
||||
"rev": "0e0fd9f6a407b08dd5e180a2ff6c3808461e2c47",
|
||||
"rev": "25b9f31ef1dbc3987b4c716de716239f2b283701",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "dali99",
|
||||
"ref": "master",
|
||||
"ref": "v0.8.0",
|
||||
"repo": "nixos-matrix-modules",
|
||||
"type": "github"
|
||||
}
|
||||
@@ -447,17 +447,17 @@
|
||||
"rust-overlay": "rust-overlay_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1782275838,
|
||||
"narHash": "sha256-CW84hEFcypvEegQp+4zZZ4lCnPT7Qn27OpKiQBxiWS8=",
|
||||
"lastModified": 1778600367,
|
||||
"narHash": "sha256-YB0b2xUf4D8792D5Ay//7C3AjHyv+9yoy8K1mTe+wvE=",
|
||||
"ref": "main",
|
||||
"rev": "71d2b72c34352a79dbee8ebf23ce64f39aead692",
|
||||
"revCount": 102,
|
||||
"rev": "8e5f2849ff7c9616100fe928261512a7ad647939",
|
||||
"revCount": 91,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"rev": "71d2b72c34352a79dbee8ebf23ce64f39aead692",
|
||||
"rev": "8e5f2849ff7c9616100fe928261512a7ad647939",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
|
||||
}
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
worblehat.url = "git+https://git.pvv.ntnu.no/Projects/worblehat.git?ref=main";
|
||||
worblehat.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
matrix-next.url = "github:dali99/nixos-matrix-modules/master";
|
||||
matrix-next.url = "github:dali99/nixos-matrix-modules/v0.8.0";
|
||||
matrix-next.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git?ref=main";
|
||||
@@ -35,7 +35,7 @@
|
||||
minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
|
||||
minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=71d2b72c34352a79dbee8ebf23ce64f39aead692";
|
||||
roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=8e5f2849ff7c9616100fe928261512a7ad647939";
|
||||
roowho2.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";
|
||||
|
||||
@@ -16,7 +16,6 @@
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/sda1";
|
||||
fsType = "btrfs";
|
||||
options = [ "relatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
|
||||
@@ -74,7 +74,7 @@ in {
|
||||
name = "psycopg2";
|
||||
args = {
|
||||
host = "/var/run/postgresql";
|
||||
database = "synapse";
|
||||
dbname = "synapse";
|
||||
user = "matrix-synapse";
|
||||
cp_min = 1;
|
||||
cp_max = 5;
|
||||
|
||||
@@ -127,27 +127,4 @@ in
|
||||
|
||||
networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
|
||||
networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
|
||||
|
||||
environment.systemPackages = [
|
||||
(pkgs.writeShellApplication {
|
||||
name = "postgres-update-collations.sh";
|
||||
runtimeInputs = [
|
||||
config.systemd.package
|
||||
cfg.package
|
||||
];
|
||||
text = ''
|
||||
run0 --user=postgres psql <${pkgs.writeText "postgres-update-collations.sql" ''
|
||||
CREATE FUNCTION exec(text) returns text language plpgsql volatile
|
||||
AS $f$
|
||||
BEGIN
|
||||
EXECUTE $1;
|
||||
RETURN $1;
|
||||
END;
|
||||
$f$;
|
||||
|
||||
SELECT exec('ALTER DATABASE "' || datname || '" REFRESH COLLATION VERSION') FROM pg_database WHERE datistemplate = false;
|
||||
''}
|
||||
'';
|
||||
})
|
||||
];
|
||||
}
|
||||
|
||||
@@ -16,7 +16,6 @@
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
|
||||
fsType = "ext4";
|
||||
options = [ "relatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
|
||||
@@ -16,7 +16,6 @@
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
|
||||
fsType = "ext4";
|
||||
options = [ "relatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
|
||||
@@ -28,7 +28,6 @@
|
||||
fileSystems."/" = {
|
||||
device = "/dev/mapper/pool-root";
|
||||
fsType = "ext4";
|
||||
options = [ "relatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, pkgs, values, ... }:
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.loki;
|
||||
@@ -9,8 +9,8 @@ in {
|
||||
configuration = {
|
||||
auth_enabled = false;
|
||||
server = {
|
||||
http_listen_port = 31832;
|
||||
http_listen_address = "127.0.0.1";
|
||||
http_listen_port = 3100;
|
||||
http_listen_address = "0.0.0.0";
|
||||
grpc_listen_port = 9096;
|
||||
};
|
||||
|
||||
@@ -81,25 +81,5 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."loki.pvv.ntnu.no" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
kTLS = true;
|
||||
|
||||
locations = {
|
||||
"/".return = "403";
|
||||
"/loki/api/v1/push" = {
|
||||
proxyPass = "http://${cfg.configuration.server.http_listen_address}:${toString cfg.configuration.server.http_listen_port}/loki/api/v1/push";
|
||||
extraConfig = ''
|
||||
allow 127.0.0.1;
|
||||
allow ::1;
|
||||
allow ${values.ipv4-space};
|
||||
allow ${values.ipv6-space};
|
||||
allow ${values.ntnu.ipv4-space};
|
||||
allow ${values.ntnu.ipv6-space};
|
||||
deny all;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [ cfg.configuration.server.http_listen_port ];
|
||||
}
|
||||
|
||||
@@ -48,7 +48,6 @@
|
||||
|
||||
# swap.swapfile.size = "4G";
|
||||
mountpoint = "/";
|
||||
mountOptions = [ "relatime" ];
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
@@ -136,7 +136,7 @@ in {
|
||||
picture = {
|
||||
AVATAR_MAX_FILE_SIZE = 1024 * 1024 * 5;
|
||||
# NOTE: go any bigger than this, and gitea will freeze your gif >:(
|
||||
AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 4;
|
||||
AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 2;
|
||||
};
|
||||
actions.ENABLED = true;
|
||||
webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," [
|
||||
|
||||
@@ -16,7 +16,6 @@
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/224c45db-9fdc-45d4-b3ad-aaf20b3efa8a";
|
||||
fsType = "ext4";
|
||||
options = [ "relatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
|
||||
@@ -31,7 +31,6 @@
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/";
|
||||
mountOptions = [ "relatime" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -16,7 +16,6 @@
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/c3aed415-0054-4ac5-8d29-75a99cc26451";
|
||||
fsType = "btrfs";
|
||||
options = [ "relatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
|
||||
@@ -88,8 +88,9 @@ in
|
||||
[[ -d "$dir" ]] || continue
|
||||
|
||||
uid="$(stat -c '%u' "$dir")"
|
||||
username="$(basename "$dir")"
|
||||
|
||||
mountpoint="/run/pvvhome/by-uid/$uid"
|
||||
mountpoint="/run/pvvhome/by-uid/$uid/$1/$username"
|
||||
mkdir -p "$mountpoint"
|
||||
|
||||
unit_name=$(systemd-escape --path --suffix=mount "$mountpoint")
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
{
|
||||
imports = [
|
||||
./fcgiwrap.nix
|
||||
./httpd.nix
|
||||
./log-processor.nix
|
||||
./mail.nix
|
||||
|
||||
@@ -0,0 +1,85 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
mcfg = config.services.pvv-userweb;
|
||||
in
|
||||
{
|
||||
config = lib.mkIf mcfg.enable {
|
||||
systemd.slices.system-userweb-fcgiwrap = { };
|
||||
|
||||
# NOTE: expected %i here is the UID of the user
|
||||
systemd.sockets."userweb-fcgiwrap@" = {
|
||||
description = "UserWeb fcgiwrap server for user %i";
|
||||
socketConfig = {
|
||||
ListenStream = "/run/userweb-fcgiwrap/%i.sock";
|
||||
RemoveOnStop = true;
|
||||
|
||||
SocketUser = "wwwrun";
|
||||
SocketGroup = "wwwrun";
|
||||
SocketMode = "0660";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."userweb-fcgiwrap@" = {
|
||||
after = [
|
||||
"httpd-passwd-sync.service"
|
||||
];
|
||||
requires = [
|
||||
"httpd-passwd-sync.service"
|
||||
];
|
||||
documentation = [ "man:fcgiwrap(8)" ];
|
||||
|
||||
unitConfig = {
|
||||
AssertPathExists = "/run/pvvhome/by-uid/%i";
|
||||
};
|
||||
|
||||
serviceConfig = {
|
||||
|
||||
Slice = "system-userweb-fcgiwrap.slice";
|
||||
Type = "simple";
|
||||
User = "%i";
|
||||
|
||||
ExecStart = "${lib.getExe pkgs.fcgiwrap}";
|
||||
|
||||
RuntimeDirectoryMode = "0750";
|
||||
RuntimeDirectory = [
|
||||
"fcgiwrap/%i/root-mnt"
|
||||
];
|
||||
RootDirectory = "/run/fcgiwrap/%i/root-mnt";
|
||||
MountAPIVFS = true;
|
||||
BindReadOnlyPaths = [
|
||||
builtins.storeDir
|
||||
"/etc"
|
||||
|
||||
# TODO: set up minimal fake passwd + group in `ExecStartPre` instead
|
||||
"/var/lib/httpd-passwd-sync/passwd:/etc/passwd"
|
||||
"/var/lib/httpd-passwd-sync/group:/etc/group"
|
||||
|
||||
"${pkgs.writeText "userweb-fake-nsswitch.conf" ''
|
||||
passwd: files
|
||||
group: files
|
||||
shadow: files
|
||||
sudoers: files
|
||||
|
||||
hosts: mymachines resolve [!UNAVAIL=return] files myhostname dns
|
||||
networks: files
|
||||
|
||||
ethers: files
|
||||
services: files
|
||||
protocols: files
|
||||
rpc: files
|
||||
|
||||
subuid: files
|
||||
subgid: files
|
||||
''}:/etc/nsswitch.conf"
|
||||
] ++ lib.optionals mcfg.debugMode [
|
||||
"/bin"
|
||||
] ++ mcfg.fhsBindPaths;
|
||||
|
||||
# TODO: handle /amd/homepvv${l}
|
||||
BindPaths = [
|
||||
"/run/pvvhome/by-uid/%i:/home/pvv"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -277,30 +277,7 @@ in
|
||||
"/dev/null"
|
||||
"/var/lib/acme"
|
||||
"/var/run/nscd"
|
||||
"${mcfg.fhsEnv}/bin:/bin"
|
||||
"${mcfg.fhsEnv}/sbin:/sbin"
|
||||
"${mcfg.fhsEnv}/lib:/lib"
|
||||
"${mcfg.fhsEnv}/share:/share"
|
||||
] ++ (lib.mapCartesianProduct ({ parent, child }: "${mcfg.fhsEnv}${child}:${parent}${child}") {
|
||||
parent = [
|
||||
"/local"
|
||||
"/opt"
|
||||
"/opt/local"
|
||||
"/store"
|
||||
"/store/gnu"
|
||||
"/usr"
|
||||
"/usr/local"
|
||||
"/run/current-system/sw"
|
||||
];
|
||||
child = [
|
||||
"/bin"
|
||||
"/sbin"
|
||||
"/lib"
|
||||
"/libexec"
|
||||
"/include"
|
||||
"/share"
|
||||
];
|
||||
});
|
||||
] ++ mcfg.fhsBindPaths;
|
||||
BindPaths = (lib.mapCartesianProduct ({ directoryFn, letter }: "/run/pvvhome/${letter}:${directoryFn letter}${letter}") {
|
||||
directoryFn = [
|
||||
(_: "/home/pvv/")
|
||||
|
||||
@@ -106,6 +106,36 @@ in
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
fhsBindPaths = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
readOnly = true;
|
||||
default = [
|
||||
"${cfg.fhsEnv}/bin:/bin"
|
||||
"${cfg.fhsEnv}/sbin:/sbin"
|
||||
"${cfg.fhsEnv}/lib:/lib"
|
||||
"${cfg.fhsEnv}/share:/share"
|
||||
] ++ (lib.mapCartesianProduct ({ parent, child }: "${cfg.fhsEnv}${child}:${parent}${child}") {
|
||||
parent = [
|
||||
"/local"
|
||||
"/opt"
|
||||
"/opt/local"
|
||||
"/store"
|
||||
"/store/gnu"
|
||||
"/usr"
|
||||
"/usr/local"
|
||||
"/run/current-system/sw"
|
||||
];
|
||||
child = [
|
||||
"/bin"
|
||||
"/sbin"
|
||||
"/lib"
|
||||
"/libexec"
|
||||
"/include"
|
||||
"/share"
|
||||
];
|
||||
});
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
@@ -13,7 +13,6 @@
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/4e8ecdd2-d453-4fff-b952-f06da00f3b85";
|
||||
fsType = "ext4";
|
||||
options = [ "relatime" ];
|
||||
};
|
||||
|
||||
swapDevices = [ {
|
||||
|
||||
Reference in New Issue
Block a user