Merge branch 'main' into sleipner-authorised-keys

Reviewed-on: #83

base/networking.nix

@@ -1,16 +1,13 @@
 { lib, values, ... }:
 {
+  systemd.network.enable = true;
   networking.domain = "pvv.ntnu.no";
   networking.useDHCP = false;
-  # networking.search = [ "pvv.ntnu.no" "pvv.org" ];
-  # networking.nameservers = lib.mkDefault [ "129.241.0.200" "129.241.0.201" ];
-  # networking.tempAddresses = lib.mkDefault "disabled";
-  # networking.defaultGateway = values.hosts.gateway;
 
-  systemd.network.enable = true;
+  # The rest of the networking configuration is usually sourced from /values.nix
 
   services.resolved = {
     enable = lib.mkDefault true;
     dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
   };
-}
+}

base/services/auto-upgrade.nix

@@ -1,12 +1,26 @@
-{ ... }:
+{ inputs, pkgs, lib, ... }:
 {
   system.autoUpgrade = {
     enable = true;
     flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
     flags = [
-      "--update-input" "nixpkgs"
+      # --update-input is deprecated since nix 2.22, and removed in lix 2.90
-      "--update-input" "nixpkgs-unstable"
+      # https://git.lix.systems/lix-project/lix/issues/400
+      "--refresh"
+      "--override-input" "nixpkgs" "github:nixos/nixpkgs/nixos-24.05-small"
+      "--override-input" "nixpkgs-unstable" "github:nixos/nixpkgs/nixos-unstable-small"
       "--no-write-lock-file"
     ];
   };
-}
+
+  # workaround for https://github.com/NixOS/nix/issues/6895
+  # via https://git.lix.systems/lix-project/lix/issues/400
+  environment.etc."current-system-flake-inputs.json".source
+    = pkgs.writers.writeJSON "flake-inputs.json" (
+      lib.flip lib.mapAttrs inputs (name: input:
+        # inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
+        lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
+          // { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
+      )
+    );
+}

base/services/openssh.nix

@@ -10,5 +10,12 @@
       Match All
     '';
     settings.PermitRootLogin = "yes";
+
+    users.users."root".openssh.authorizedKeys.keys = [
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqVt4LCe0YIttr9swFxjkjn37ZDY9JxwVC+2gvfSINDJorOCtqPjDOTD2fTS1Gz08QCwpnLWq2kyvRchu6WgriAbSACpbZZBgxRaF/FVh3oiMVFGnNKGnv6/fdo/vZtu8mUVuqtmTrgLYpZdbR4oD3XiBlDKs7Cv5hPqt95lnP6MNFvE8mICCfd1PwhsABd2IQ5laz3u77/RXhNFJL0Kf2/+6gk9awcLuwHrPdvq7c3BxRHbc9UMRQENyjyQPa7aLe+uJBFLKP51I8VBuDpDacuibQx7nMt6N2UJ2KWI0JxRMHuJNq4S5jidR82aOw9gzGbTv30SKNLMqsZ0xj4LtdqCXDiZF6Lr09PsJYsvnBUFWa14HGcThKDtgwQwBryNViYmfv//0h9+RLZiU0ab+NEwSs7Zh5iAD+vhx64QqNX3tR7Le4SWXh8W0eShU9N78qYdSkiC3Ui7htxeqOocXM/P4AwbnHsLELIvkHdvgchCPvl8ygZa4WJTEWv16+ICskJcAKWGuqjvXAFuwjJJmPp9xLW9O0DFfQhMELiGamQR9wK07yYQVr34iah6qZO7cwhSKyEPFrVPIaNtfDhsjED639F7vmktf26SWNJHWfW0wOHILjI6TgqUvy0JDd8W8w0CHlAfz6Fs2l99NNgNF8dB3vBASbxS0hu/y0PVu/xQ== openstack-sleipner"
+
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCbgJ0Uwh9VSVhfId7l9i5/jk4CvAK5rbkiab8R+moF root@sleipner"
+    ];
   };
-}
+}
+

flake.lock

@@ -29,11 +29,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1713887124,
+        "lastModified": 1725463969,
-        "narHash": "sha256-hGTSm0p9xXUYDgsAAr/ORZICo6T6u33vLfX3tILikaQ=",
+        "narHash": "sha256-d3c1TAlIN1PtK+oQP1wO6XbDfmR4SUp/C/4s7G46ARo=",
         "owner": "GuillaumeDesforges",
         "repo": "fix-python",
-        "rev": "f7f4b33e22414071fc1f9cbf68072c413c3a7fdf",
+        "rev": "2926402234c3f99aa8e4608c51d9ffa73ea403c0",
         "type": "github"
       },
       "original": {
@@ -67,17 +67,17 @@
         ]
       },
       "locked": {
-        "lastModified": 1716065905,
+        "lastModified": 1726861911,
-        "narHash": "sha256-08uhxBzfakfhl/ooc+gMzDupWKYvTeyQZwuvB1SBS7A=",
+        "narHash": "sha256-pXPmVp4AgszzJXlLjj8r9NxoDvxoV4USGaiMwqCyb4M=",
-        "owner": "Programvareverkstedet",
+        "ref": "refs/heads/master",
-        "repo": "grzegorz",
+        "rev": "d10db19d7df5c5c2cd2dcb878376d5d681f6c2f2",
-        "rev": "0481aef6553ae9aee86e4edb4ca0ed4f2eba2058",
+        "revCount": 94,
-        "type": "github"
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/grzegorz.git"
       },
       "original": {
-        "owner": "Programvareverkstedet",
+        "type": "git",
-        "repo": "grzegorz",
+        "url": "https://git.pvv.ntnu.no/Projects/grzegorz.git"
-        "type": "github"
       }
     },
     "grzegorz-clients": {
@@ -87,17 +87,17 @@
         ]
       },
       "locked": {
-        "lastModified": 1716115695,
+        "lastModified": 1726861934,
-        "narHash": "sha256-aI65l4x+U5v3i/nfn6N3eW5IZodmf4pyAByE7vTJh8I=",
+        "narHash": "sha256-lOzPDwktd+pwszUTbpUdQg6iCzInS11fHLfkjmnvJrM=",
-        "owner": "Programvareverkstedet",
+        "ref": "refs/heads/master",
-        "repo": "grzegorz-clients",
+        "rev": "546d921ec46735dbf876e36f4af8df1064d09432",
-        "rev": "b9444658fbb39cd1bf1c61ee5a1d5f0641c49abe",
+        "revCount": 78,
-        "type": "github"
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/grzegorz-clients.git"
       },
       "original": {
-        "owner": "Programvareverkstedet",
+        "type": "git",
-        "repo": "grzegorz-clients",
+        "url": "https://git.pvv.ntnu.no/Projects/grzegorz-clients.git"
-        "type": "github"
       }
     },
     "matrix-next": {
@@ -107,16 +107,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1717234745,
+        "lastModified": 1727410897,
-        "narHash": "sha256-MFyKRdw4WQD6V3vRGbP6MYbtJhZp712zwzjW6YiOBYM=",
+        "narHash": "sha256-tWsyxvf421ieWUJYgjV7m1eTdr2ZkO3vId7vmtvfFpQ=",
         "owner": "dali99",
         "repo": "nixos-matrix-modules",
-        "rev": "d7dc42c9bbb155c5e4aa2f0985d0df75ce978456",
+        "rev": "ff787d410cba17882cd7b6e2e22cc88d4064193c",
         "type": "github"
       },
       "original": {
         "owner": "dali99",
-        "ref": "v0.6.0",
+        "ref": "v0.6.1",
         "repo": "nixos-matrix-modules",
         "type": "github"
       }
@@ -166,9 +166,10 @@
         "type": "github"
       },
       "original": {
-        "id": "nixpkgs",
+        "owner": "NixOS",
         "ref": "nixos-24.05-small",
-        "type": "indirect"
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "nixpkgs-stable": {
@@ -197,9 +198,10 @@
         "type": "github"
       },
       "original": {
-        "id": "nixpkgs",
+        "owner": "NixOS",
         "ref": "nixos-unstable-small",
-        "type": "indirect"
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "pvv-calendar-bot": {

flake.nix

@@ -2,8 +2,8 @@
   description = "PVV System flake";
 
   inputs = {
-    nixpkgs.url = "nixpkgs/nixos-24.05-small";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05-small"; # remember to also update the url in base/services/auto-upgrade.nix
-    nixpkgs-unstable.url = "nixpkgs/nixos-unstable-small";
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
 
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
@@ -17,15 +17,15 @@
     pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
     pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
 
-    matrix-next.url = "github:dali99/nixos-matrix-modules/v0.6.0";
+    matrix-next.url = "github:dali99/nixos-matrix-modules/v0.6.1";
     matrix-next.inputs.nixpkgs.follows = "nixpkgs";
 
     nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git";
     nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";
 
-    grzegorz.url = "github:Programvareverkstedet/grzegorz";
+    grzegorz.url = "git+https://git.pvv.ntnu.no/Projects/grzegorz.git";
     grzegorz.inputs.nixpkgs.follows = "nixpkgs";
-    grzegorz-clients.url = "github:Programvareverkstedet/grzegorz-clients";
+    grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Projects/grzegorz-clients.git";
     grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
 
     minecraft-data.url = "git+https://git.pvv.ntnu.no/Drift/minecraft-data.git";

hosts/bicep/services/matrix/coturn.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, secrets, ... }:
+{ config, lib, pkgs, secrets, values, ... }:
 
 {
   sops.secrets."matrix/synapse/turnconfig" = {
@@ -60,12 +60,14 @@
     pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
 
     use-auth-secret = true;
-    # World readable but I  dont think it's that bad
     static-auth-secret-file = config.sops.secrets."matrix/coturn/static-auth-secret".path;
 
     secure-stun = true;
 
-    listening-ips = [ "129.241.210.213" "2001:700:300:1900::213" ];
+    listening-ips = [
+      values.services.turn.ipv4
+      # values.services.turn.ipv6
+    ];
 
     tls-listening-port = 443;
     alt-tls-listening-port = 5349;

hosts/bicep/services/matrix/synapse.nix

@@ -22,11 +22,6 @@ in {
     group = config.users.users.matrix-synapse.group;
   };
 
-  sops.secrets."matrix/sliding-sync/env" = {
-    sopsFile = ../../../../secrets/bicep/matrix.yaml;
-    key = "sliding-sync/env";
-  };
-
   services.matrix-synapse-next = {
     enable = true;
 
@@ -43,8 +38,6 @@ in {
     workers.eventPersisters = 2;
     workers.useUserDirectoryWorker = true;
 
-    enableSlidingSync = true;
-
     enableNginx = true;
 
     settings = {
@@ -137,9 +130,6 @@ in {
     };
   };
 
-  services.matrix-synapse.sliding-sync.environmentFile = config.sops.secrets."matrix/sliding-sync/env".path;
-
-
   services.redis.servers."".enable = true;
 
   services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [

secrets/bicep/matrix.yaml

@@ -2,8 +2,6 @@ synapse:
     turnconfig: ENC[AES256_GCM,data:mASRjYa4C9WRow4x0XYRrlCE5LMJUYaId+o62r1qhsyJPa2LzrI=,iv:5vYdubvMDjLS6soiWx2DzkEAATb9NFbSS/Jhuuz1yI8=,tag:wOW07CQMDbOiZNervee/pg==,type:str]
     user_registration: ENC[AES256_GCM,data:ZDZfEEvyw8pg0WzhrdC8747ed+ZR2ZA8/WypJd/iDkmIy2RmxOeI0sE=,iv:l61mOlvzpCql4fC/eubBSU6px21et2WcpxQ6rFl14iw=,tag:sVDEAa3xipKIi/6isCjWew==,type:str]
     signing_key: ENC[AES256_GCM,data:6UpfiRlX9pRM7zhdm7Mc8y8EItLzugWkHSgE0tGpEmudCTa1wc60oNbYfhKDWU81DT/U148pZOoX1A==,iv:UlqCPicPm5eNBz1xBMI3A3Rn4t/GtldNIDdMH5MMnLw=,tag:HHaw6iMjEAv5b9mjHSVpwA==,type:str]
-sliding-sync:
-    env: ENC[AES256_GCM,data:DsU1qKTy5sn06Y0S5kFUqZHML20n6HdHUdXsQRUw,iv:/TNTc+StAZbf6pBY9CeXdxkx8E+3bak/wOqHyBNMprU=,tag:er5u4FRlSmUZrOT/sj+RhQ==,type:str]
 coturn:
     static-auth-secret: ENC[AES256_GCM,data:y5cG/LyrorkDH+8YrgcV7DY=,iv:ca90q2J3+NOy51mUBy4TMKfYMgWL4hxWDdsKIuxRBgU=,tag:hpFCns1lpi07paHyGB7tGQ==,type:str]
 mjolnir:
@@ -70,8 +68,8 @@ sops:
             WEh5NFN6SFF1TlltdWFWTGw4MHRHUkUKrKIvC87xjEmwxPQhH8dN+ZuaJTCgPY28
             pR62KxmoKFICLTHPpYP3euiAx5M9BWvgvCnA/US/5klpk8MtlreNFA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-10-22T00:31:46Z"
+    lastmodified: "2024-09-27T04:34:10Z"
-    mac: ENC[AES256_GCM,data:UpnaUfRxvdyzBy5x4EC3w5LQ1qWxILTQhpyVPd9whTzQMAivAHT0pVmP9aE4T9w3NcWTaghp+f70GmQXx/OCC6DsRCWtU9pFHRj12YUowM3yB5lVTOomOLZQ9m4gUXw5I2GZHWBJn8CyosDcBMlXz2tiR91v/8Ulh6sDSAO86U0=,iv:5GcgRvbpqDEslZruKHM/TcMaF52A5X7AK41DEbrsRIQ=,tag:ndDgCRyX1aDRnzEUNmpoMw==,type:str]
+    mac: ENC[AES256_GCM,data:FACb/Ow4s6dqjghAphCa1ZwIwX7+CRhIudQ9UlDtxB+4Bdpa/T0l73oaMa5lmmyCEyuVM3HXOFcm4I/urLtvaN+QQoqRYnUHKkdNYFhayGpeckZUNu7JWsFsQWk0kfKZEDqHIBoee7xBVzrVtRJeKVWv+JPlch4NVOakm3MitZA=,iv:rvve5MRDpDD/FblN8KaQ2PvxsYZSQPSw5oDfyko/Nvs=,tag:vuB0jYmO6AiNtZuSJ3ipBQ==,type:str]
     pgp:
         - created_at: "2024-08-04T00:03:46Z"
           enc: |-
@@ -94,4 +92,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1

users/danio.nix

@@ -3,7 +3,7 @@
 {
   users.users.danio = {
     isNormalUser = true;
-    extraGroups = [ "drift" "nix-builder-users" ];
+    extraGroups = [ "drift" "nix-builder-users" "wheel" ];
     shell = pkgs.zsh;
 
     openssh.authorizedKeys.keys = [

values.nix

@@ -25,6 +25,8 @@ in rec {
 
   hosts = {
     gateway = pvv-ipv4 129;
+    gateway6 = pvv-ipv6 1;
+
     bekkalokk = {
       ipv4 = pvv-ipv4 168;
       ipv6 = pvv-ipv6 168;
@@ -63,7 +65,7 @@ in rec {
   defaultNetworkConfig = {
     dns = [ "129.241.0.200" "129.241.0.201" "2001:700:300:1900::200" "2001:700:300:1900::201" ];
     domains = [ "pvv.ntnu.no" "pvv.org" ];
-    gateway = [ hosts.gateway ];
+    gateway = [ hosts.gateway hosts.gateway6 ];
 
     networkConfig.IPv6AcceptRA = "no";
     DHCP = "no";