Update hosts/bekkalokk/services/idp-simplesamlphp/default.nix

.gitea/workflows/build-topology-graph.yml

@@ -7,13 +7,16 @@ jobs:
   evals:
     runs-on: debian-latest
     steps:
-    - name: Install sudo
-      run: apt-get install --update --assume-yes sudo
-
     - uses: actions/checkout@v6
 
+    - name: Install sudo
+      run: apt-get update && apt-get -y install sudo
+
     - uses: https://github.com/cachix/install-nix-action@v31
 
+    - name: Configure Nix
+      run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
+
     - name: Build topology graph
       run: nix build .#topology -L
 

.gitea/workflows/eval.yml

@@ -6,11 +6,8 @@ jobs:
   evals:
     runs-on: debian-latest
     steps:
-    - name: Install sudo
-      run: apt-get install --update --assume-yes sudo
-
     - uses: actions/checkout@v6
-
+    - run: apt-get update && apt-get -y install sudo
     - uses: https://github.com/cachix/install-nix-action@v31
-
+    - run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
     - run: nix flake check

.sops.yaml

@@ -10,18 +10,19 @@ keys:
   - &user_vegardbm age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
 
   # Hosts
+  - &host_bakke age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
   - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
   - &host_bicep age19nk55kcs7s0358jpkn75xnr57dfq6fq3p43nartvsprx0su22v7qcgcjdx
-  - &host_ildkule age102e6y8gah0ntr6fxqnkpepc8ar29p6ls7ks9ka7v8w87q8scm9yqmc2u8d
+  - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
   - &host_kommode age1mt4d0hg5g76qp7j0884llemy0k2ymr5up8vfudz6vzvsflk5nptqqd32ly
-  - &host_lupine-1 age18lta9d683yekz487xwtd99da236d8mgk4ftlmv2jffx858p9qf2s9j868l
+  - &host_lupine-1 age1fkrypl6fu4ldsa7te4g3v4qsegnk7sd6qhkquuwzh04vguy96qus08902e
-  - &host_lupine-2 age1e0a4ru707v637wzmuxqv0xywmlkhunzgyfy4mrkjc7a23qq8msgq7nqtvt
+  - &host_lupine-2 age1mu0ej57n4s30ghealhyju3enls83qyjua69986la35t2yh0q2s0seruz5n
-  - &host_lupine-3 age1wmrrhd5deatmgflkas636u3rzuk46u9knl02v4t39ncs37xqquhq9vwzye
+  - &host_lupine-3 age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
-  - &host_lupine-4 age1ml48zztcmnrdrhrdsjrlyxf09jtmjgz46u8td4zm59wn3fm4g57qs4wg0l
+  - &host_lupine-4 age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
-  - &host_lupine-5 age12gws5nws69vxryd3kt7q0ayngch90efmhqcrfhnnsmj00lkgxd4qsdkvqn
+  - &host_lupine-5 age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
+  - &host_skrott age1lpkju2e053aaddpgsr4ef83epclf4c9tp4m98d35ft2fswr8p4tq2ua0mf
+  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
   - &host_skrot age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr
-  - &host_temmie age10avsdvqger25z0lyzlq8v7xfzcmypkmjsswswaxwqnpnl6x9wcjq0uv2n7
-  - &host_gluttony age12czfkvuw9pjk5qny5c6m2hjhd634cj9r4dsa3ss5zkux5h4vvc7s7k4urq
 
 creation_rules:
   # Global secrets
@@ -92,6 +93,19 @@ creation_rules:
       pgp:
       - *user_oysteikt
 
+  - path_regex: secrets/ustetind/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_ustetind
+      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      - *user_vegardbm
+      pgp:
+      - *user_oysteikt
+
   - path_regex: secrets/lupine/[^/]+\.yaml$
     key_groups:
     - age:
@@ -109,6 +123,31 @@ creation_rules:
       pgp:
       - *user_oysteikt
 
+  - path_regex: secrets/bakke/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_bakke
+      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      - *user_vegardbm
+      pgp:
+      - *user_oysteikt
+
+  - path_regex: secrets/skrott/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_skrott
+      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      - *user_vegardbm
+      pgp:
+      - *user_oysteikt
   - path_regex: secrets/skrot/[^/]+\.yaml$
     key_groups:
     - age:
@@ -121,29 +160,3 @@ creation_rules:
       - *user_vegardbm
       pgp:
       - *user_oysteikt
-
-  - path_regex: secrets/temmie/[^/]+\.yaml$
-    key_groups:
-    - age:
-      - *host_temmie
-      - *user_danio
-      - *user_felixalb
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
-      - *user_vegardbm
-      pgp:
-      - *user_oysteikt
-
-  - path_regex: secrets/gluttony/[^/]+\.yaml$
-    key_groups:
-    - age:
-      - *host_gluttony
-      - *user_danio
-      - *user_felixalb
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
-      - *user_vegardbm
-      pgp:
-      - *user_oysteikt

README.md

@@ -39,13 +39,11 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
 |  bikkje                    | Virtual  | Experimental login box                                    |
 | [brzeczyszczykiewicz][brz] | Physical | Shared music player                                       |
 | [georg][geo]               | Physical | Shared music player                                       |
-| [gluttony][glu]            | Virtual  | General purpose compute                                   |
 | [ildkule][ild]             | Virtual  | Logging and monitoring host, prometheus, grafana, ...     |
 | [kommode][kom]             | Virtual  | Gitea + Gitea pages                                       |
 | [lupine][lup]              | Physical | Gitea CI/CD runners                                       |
 |  shark                     | Virtual  | Test host for authentication, absolutely horrendous       |
-| [skrot][skr]               | Physical | Kiosk, snacks and soda                                    |
+| [skrot/skrott][skr]        | Physical | Kiosk, snacks and soda                                    |
-| [temmie][tem]              | Virtual  | User websites                                             |
 | [wenche][wen]              | Virtual  | Nix-builders, general purpose compute                     |
 
 ## Documentation
@@ -59,10 +57,8 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
 [bic]: https://wiki.pvv.ntnu.no/wiki/Maskiner/bicep
 [brz]: https://wiki.pvv.ntnu.no/wiki/Maskiner/brzęczyszczykiewicz
 [geo]: https://wiki.pvv.ntnu.no/wiki/Maskiner/georg
-[glu]: https://wiki.pvv.ntnu.no/wiki/Maskiner/gluttony
 [ild]: https://wiki.pvv.ntnu.no/wiki/Maskiner/ildkule
 [kom]: https://wiki.pvv.ntnu.no/wiki/Maskiner/kommode
 [lup]: https://wiki.pvv.ntnu.no/wiki/Maskiner/lupine
-[skr]: https://wiki.pvv.ntnu.no/wiki/Maskiner/Skrot
+[skr]: https://wiki.pvv.ntnu.no/wiki/Maskiner/Skrott
-[tem]: https://wiki.pvv.ntnu.no/wiki/Maskiner/temmie
 [wen]: https://wiki.pvv.ntnu.no/wiki/Maskiner/wenche

base/default.nix

@@ -1,8 +1,6 @@
 {
-  config,
   pkgs,
   lib,
-  inputs,
   fp,
   ...
 }:
@@ -12,9 +10,7 @@
     (fp /users)
     (fp /modules/snakeoil-certs.nix)
 
-    ./mitigations.nix
+    ./flake-input-exporter.nix
-
-    ./hardening.nix
     ./networking.nix
     ./nix.nix
     ./programs.nix
@@ -24,7 +20,6 @@
     ./services/acme.nix
     ./services/auto-upgrade.nix
     ./services/dbus.nix
-    ./services/fluentbit.nix
     ./services/fwupd.nix
     ./services/irqbalance.nix
     ./services/journald-upload.nix
@@ -33,34 +28,23 @@
     ./services/openssh.nix
     ./services/polkit.nix
     ./services/postfix.nix
-    ./services/prometheus-flake-input-exporter.nix
     ./services/prometheus-node-exporter.nix
     ./services/prometheus-systemd-exporter.nix
+    ./services/promtail.nix
     ./services/roowho2.nix
-    ./services/rsyslogd.nix
-    ./services/scrutiny-collector.nix
     ./services/smartd.nix
     ./services/thermald.nix
-    ./services/timesyncd.nix
     ./services/uptimed.nix
     ./services/userborn.nix
     ./services/userdbd.nix
   ];
 
-  system.nixos.tags = lib.optionals (inputs.self.sourceInfo ? dirtyRev) [ "dirty" ];
-
-  specialisation."auto-upgrade".configuration = {
-    system.nixos.tags = [ "auto" ];
-  };
-
   boot.tmp.cleanOnBoot = lib.mkDefault true;
   boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
 
   boot.loader.systemd-boot.enable = lib.mkDefault true;
   boot.loader.efi.canTouchEfiVariables = lib.mkDefault true;
 
-  services.btrfs.autoScrub.enable = lib.mkDefault (lib.any ({ fsType, ... }: fsType == "btrfs") (lib.attrValues config.fileSystems));
-
   time.timeZone = "Europe/Oslo";
 
   i18n.defaultLocale = "en_US.UTF-8";
@@ -84,16 +68,18 @@
     fi
   '';
 
+  # security.lockKernelModules = true;
+  security.protectKernelImage = true;
   security.sudo.execWheelOnly = true;
   security.sudo.extraConfig = ''
     Defaults lecture = never
   '';
 
   # These are servers, sleep is for the weak
-  systemd.sleep.settings.Sleep = {
+  systemd.sleep.extraConfig = lib.mkDefault ''
-    AllowSuspend = lib.mkDefault false;
+    AllowSuspend=no
-    AllowHibernation = lib.mkDefault false;
+    AllowHibernation=no
-  };
+  '';
 
   # users.mutableUsers = lib.mkDefault false;
 

base/flake-input-exporter.nix

@@ -0,0 +1,55 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  values,
+  ...
+}:
+let
+  data = lib.flip lib.mapAttrs inputs (
+    name: input: {
+      inherit (input)
+        lastModified
+        ;
+    }
+  );
+  folder = pkgs.writeTextDir "share/flake-inputs" (
+    lib.concatMapStringsSep "\n" (
+      { name, value }: ''nixos_last_modified_input{flake="${name}"} ${toString value.lastModified}''
+    ) (lib.attrsToList data)
+  );
+  port = 9102;
+in
+{
+  services.nginx.virtualHosts."${config.networking.fqdn}-nixos-metrics" = {
+    serverName = config.networking.fqdn;
+    serverAliases = [
+      "${config.networking.hostName}.pvv.org"
+    ];
+    locations."/metrics" = {
+      root = "${folder}/share";
+      tryFiles = "/flake-inputs =404";
+      extraConfig = ''
+        default_type text/plain;
+      '';
+    };
+    listen = [
+      {
+        inherit port;
+        addr = "0.0.0.0";
+      }
+    ];
+    extraConfig = ''
+      allow ${values.hosts.ildkule.ipv4}/32;
+      allow ${values.hosts.ildkule.ipv6}/128;
+      allow 127.0.0.1/32;
+      allow ::1/128;
+      allow ${values.ipv4-space};
+      allow ${values.ipv6-space};
+      deny all;
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [ port ];
+}

base/hardening.nix

@@ -1,71 +0,0 @@
-{ ... }:
-{
-  boot.blacklistedKernelModules = [
-    # Obscure network protocols
-    "appletalk"
-    "atm"
-    "ax25"
-    "batman-adv"
-    "can"
-    "dccp"
-    "ipx"
-    "llc"
-    "n-hdlc"
-    "netrom"
-    "p8022"
-    "p8023"
-    "psnap"
-    "rds"
-    "rose"
-    "sctp"
-    "tipc"
-
-    # Filesystems we don't use
-    "adfs"
-    "affs"
-    "befs"
-    "bfs"
-    "cifs"
-    "cramfs"
-    "efs"
-    "exofs"
-    "freevxfs"
-    "gfs2"
-    "hfs"
-    "hfsplus"
-    "hpfs"
-    "jffs2"
-    "jfs"
-    "minix"
-    "nilfs2"
-    "ntfs"
-    "omfs"
-    "orangefs"
-    "qnx4"
-    "qnx6"
-    "sysv"
-    "ubifs"
-    "udf"
-    "ufs"
-
-    # Legacy hardware
-    "pcspkr"
-    "floppy"
-    "parport"
-    "ppdev"
-
-    # Other stuff we don't use
-    "firewire-core"
-    "firewire-ohci"
-    "ksmbd"
-    "ib_core"
-    "l2tp_eth"
-    "l2tp_netlink"
-    "l2tp_ppp"
-    "nfc"
-    "soundwire"
-  ];
-
-  # security.lockKernelModules = true;
-  security.protectKernelImage = true;
-}

base/mitigations.nix

@@ -1,24 +0,0 @@
-{ pkgs, lib, ... }:
-let
-  modulesToBan = [
-    # copy.fail
-    "af_alg"
-    "algif_aead"
-    "algif_hash"
-    "algif_rng"
-    "algif_skcipher"
-
-    # dirtyfrag / Fragnesia
-    "esp4"
-    "esp6"
-    "rxrpc"
-
-    # PinTheft
-    "rds"
-  ];
-in
-{
-  boot.blacklistedKernelModules = modulesToBan;
-
-  boot.extraModprobeConfig = lib.concatMapStringsSep "\n" (mod: "install ${mod} ${lib.getExe' pkgs.coreutils "false"}") modulesToBan;
-}

base/networking.nix

@@ -8,6 +8,6 @@
 
   services.resolved = {
     enable = lib.mkDefault true;
-    settings.Resolve.DNSSEC = false; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
+    dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
   };
 }

base/services/acme.nix

@@ -2,7 +2,7 @@
 {
   security.acme = {
     acceptTerms = true;
-    defaults.email = "drift@pvv.ntnu.no";
+    defaults.email = "acme-drift@pvv.ntnu.no";
   };
 
   # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:

base/services/auto-upgrade.nix

@@ -13,7 +13,6 @@ in
 
       "--refresh"
       "--no-write-lock-file"
-      "--specialisation auto-upgrade"
       # --update-input is deprecated since nix 2.22, and removed in lix 2.90
       # as such we instead use --override-input combined with --refresh
       # https://git.lix.systems/lix-project/lix/issues/400

base/services/fluentbit.nix

@@ -1,135 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.services.fluent-bit;
-in
-{
-  services.fluent-bit = {
-    enable = lib.mkDefault true;
-    settings = {
-      service = {
-        flush = 1;
-        log_level = "warn";
-
-        http_server = "on";
-        http_listen = "127.0.0.1";
-        http_port = 28183;
-
-        # filesystem-backed buffering so logs survives potential outages.
-        "storage.path" = "/var/lib/fluent-bit/storage";
-        "storage.sync" = "normal";
-        "storage.max_chunks_up" = 64;
-        "storage.backlog.mem_limit" = "16M";
-      };
-
-      pipeline = {
-        inputs = [{
-          name = "systemd";
-          tag = "journal.*";
-
-          db = "/var/lib/fluent-bit/journal.db";
-          read_from_tail = true;
-          strip_underscores = true;
-          lowercase = true;
-          max_entries = 1000;
-          "storage.type" = "filesystem";
-        }];
-
-        filters = [{
-          name = "modify";
-          match = "journal.*";
-          rename = [
-            "hostname host"
-            "priority level"
-            "systemd_unit unit"
-          ];
-        }] ++ (lib.mapAttrsToList (k: v: {
-          name = "modify";
-          match = "journal.*";
-          condition = "Key_value_equals level ${k}";
-          set = "level ${v}";
-        }) {
-          "7" = "debug";
-          "6" = "info";
-          "5" = "notice";
-          "4" = "warning";
-          "3" = "error";
-          "2" = "crit";
-          "1" = "alert";
-          "0" = "emergency";
-        });
-
-        outputs = [{
-          name = "loki";
-          match = "*";
-
-          host = "ildkule.pvv.ntnu.no";
-          port = 3100;
-          uri = "/loki/api/v1/push";
-          compress = "gzip";
-
-          labels = lib.concatStringsSep ", " [
-            "job=systemd-journal"
-          ];
-          label_keys = lib.concatMapStringsSep "," (k: "$" + k) [
-            "host"
-            "unit"
-            "level"
-          ];
-
-          # JSON is probably fine for now, then we just extract the keys we want with the grafana web ui
-          # line_format = "key_value";
-          # drop_single_key = true;
-
-          "storage.total_limit_size" = "256M";
-        }];
-      };
-    };
-  };
-
-  systemd.services.fluent-bit = lib.mkIf cfg.enable {
-    serviceConfig = {
-      StateDirectory = "fluent-bit";
-
-      # NOTE: This hardening might be way too strong for general purpose use, don't upstream this.
-      AmbientCapabilities = [ "" ];
-      CapabilityBoundingSet = [ "" ];
-      DeviceAllow = [ "" ];
-      LockPersonality = true;
-      # Lua JIT, maybe other things
-      MemoryDenyWriteExecute = false;
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      PrivateTmp = true;
-      PrivateUsers = true;
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-        "~@resources"
-      ];
-      UMask = "0077";
-
-      BindReadOnlyPaths = [
-        "/run/systemd/journal"
-      ];
-    };
-  };
-}

base/services/journald-upload.nix

@@ -6,7 +6,8 @@ in
   services.journald.upload = {
     enable = lib.mkDefault true;
     settings.Upload = {
-      URL = "https://journald.pvv.ntnu.no:${toString config.services.journald.remote.port}";
+      # URL = "https://journald.pvv.ntnu.no:${toString config.services.journald.remote.port}";
+      URL = "https://${values.hosts.ildkule.ipv4}:${toString config.services.journald.remote.port}";
       ServerKeyFile = "-";
       ServerCertificateFile = "-";
       TrustedCertificateFile = "-";

base/services/nginx.nix

@@ -1,5 +1,18 @@
 { config, lib, ... }:
 {
+  # nginx return 444 for all nonexistent virtualhosts
+
+  systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
+
+  environment.snakeoil-certs = lib.mkIf config.services.nginx.enable {
+    "/etc/certs/nginx" = {
+      owner = "nginx";
+      group = "nginx";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
+
   services.nginx = {
     recommendedTlsSettings = true;
     recommendedProxySettings = true;
@@ -47,8 +60,17 @@
           ];
         }
       ];
-    };
+      sslCertificate = "/etc/certs/nginx.crt";
+      sslCertificateKey = "/etc/certs/nginx.key";
+      addSSL = true;
+      extraConfig = "return 444;";
     };
 
-  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
+    ${config.networking.fqdn} = {
+      sslCertificate = lib.mkDefault "/etc/certs/nginx.crt";
+      sslCertificateKey = lib.mkDefault "/etc/certs/nginx.key";
+      addSSL = lib.mkDefault true;
+      extraConfig = lib.mkDefault "return 444;";
+    };
+  };
 }

base/services/polkit.nix

@@ -6,12 +6,9 @@ in
   security.polkit.enable = true;
 
   environment.etc."polkit-1/rules.d/9-nixos-overrides.rules".text = lib.mkIf cfg.enable ''
-    polkit.addRule(function(action, subject) {
+    polkit.addAdminRule(function(action, subject) {
-       if (
+        if(subject.isInGroup("wheel")) {
-           action.id.startsWith("org.freedesktop.systemd1.") &&
+            return ["unix-user:"+subject.user];
-           subject.isInGroup("wheel")
-       ) {
-           return polkit.Result.AUTH_SELF_KEEP;
         }
     });
   '';

base/services/prometheus-flake-input-exporter.nix

@@ -1,47 +0,0 @@
-{
-  config,
-  inputs,
-  lib,
-  pkgs,
-  values,
-  ...
-}:
-let
-  data = lib.flip lib.mapAttrs inputs (
-    name: input: {
-      inherit (input)
-        lastModified
-        ;
-    }
-  );
-  folder = pkgs.writeTextDir "share/flake-inputs" (
-    lib.concatMapStringsSep "\n" (
-      { name, value }: ''nixos_last_modified_input{flake="${name}"} ${toString value.lastModified}''
-    ) (lib.attrsToList data)
-  );
-in
-{
-  services.nginx = {
-    enable = lib.mkDefault true;
-
-    virtualHosts.${config.networking.fqdn} = lib.mkIf config.services.nginx.enable {
-      forceSSL = true;
-      enableACME = true;
-      kTLS = true;
-
-      locations."/prometheus-nixos-flake-input-exporter/metrics" = {
-        root = "${folder}/share";
-        tryFiles = "/flake-inputs =404";
-        extraConfig = ''
-          default_type text/plain;
-
-          allow 127.0.0.1;
-          allow ::1;
-          allow ${values.hosts.ildkule.ipv4};
-          allow ${values.hosts.ildkule.ipv6};
-          deny all;
-        '';
-      };
-    };
-  };
-}

base/services/prometheus-node-exporter.nix

@@ -5,30 +5,19 @@ in
 {
   services.prometheus.exporters.node = {
     enable = lib.mkDefault true;
-    listenAddress = "127.0.0.1";
     port = 9100;
     enabledCollectors = [ "systemd" ];
   };
 
-  services.nginx = {
+  systemd.services.prometheus-node-exporter.serviceConfig = lib.mkIf cfg.enable {
-    enable = lib.mkDefault true;
+    IPAddressDeny = "any";
-
+    IPAddressAllow = [
-    virtualHosts.${config.networking.fqdn} = lib.mkIf config.services.nginx.enable {
+      "127.0.0.1"
-      forceSSL = true;
+      "::1"
-      enableACME = true;
+      values.hosts.ildkule.ipv4
-      kTLS = true;
+      values.hosts.ildkule.ipv6
-
+    ];
-      locations."/prometheus-node-exporter/metrics" = {
-        proxyPass = "http://localhost:${toString cfg.port}/metrics";
-
-        extraConfig = ''
-          allow 127.0.0.1;
-          allow ::1;
-          allow ${values.hosts.ildkule.ipv4};
-          allow ${values.hosts.ildkule.ipv6};
-          deny all;
-        '';
-      };
-    };
   };
+
+  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
 }

base/services/prometheus-systemd-exporter.nix

@@ -5,7 +5,6 @@ in
 {
   services.prometheus.exporters.systemd = {
     enable = lib.mkDefault true;
-    listenAddress = "127.0.0.1";
     port = 9101;
     extraFlags = [
       "--systemd.collector.enable-restart-count"
@@ -13,25 +12,15 @@ in
     ];
   };
 
-  services.nginx = {
+  systemd.services.prometheus-systemd-exporter.serviceConfig = {
-    enable = lib.mkDefault true;
+    IPAddressDeny = "any";
-
+    IPAddressAllow = [
-    virtualHosts.${config.networking.fqdn} = lib.mkIf config.services.nginx.enable {
+      "127.0.0.1"
-      forceSSL = true;
+      "::1"
-      enableACME = true;
+      values.hosts.ildkule.ipv4
-      kTLS = true;
+      values.hosts.ildkule.ipv6
-
+    ];
-      locations."/prometheus-systemd-exporter/metrics" = {
-        proxyPass = "http://localhost:${toString cfg.port}/metrics";
-
-        extraConfig = ''
-          allow 127.0.0.1;
-          allow ::1;
-          allow ${values.hosts.ildkule.ipv4};
-          allow ${values.hosts.ildkule.ipv6};
-          deny all;
-        '';
-      };
-    };
   };
+
+  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
 }

base/services/promtail.nix

@@ -0,0 +1,38 @@
+{ config, lib, values, ... }:
+let
+  cfg = config.services.prometheus.exporters.node;
+in
+{
+  services.promtail = {
+    enable = lib.mkDefault true;
+    configuration = {
+      server = {
+        http_listen_port = 28183;
+        grpc_listen_port = 0;
+      };
+      clients = [{
+        url = "http://ildkule.pvv.ntnu.no:3100/loki/api/v1/push";
+      }];
+      scrape_configs = [{
+        job_name = "systemd-journal";
+        journal = {
+          max_age = "12h";
+          labels = {
+            job = "systemd-journal";
+            host = config.networking.hostName;
+          };
+        };
+        relabel_configs = [
+          {
+            source_labels = [ "__journal__systemd_unit" ];
+            target_label = "unit";
+          }
+          {
+            source_labels = [ "__journal_priority_keyword" ];
+            target_label = "level";
+          }
+        ];
+      }];
+    };
+  };
+}

base/services/rsyslogd.nix

@@ -1,13 +0,0 @@
-{ ... }:
-{
-  services.rsyslogd = {
-    enable = true;
-    defaultConfig = ''
-      *.* @loghost.pvv.ntnu.no
-    '';
-  };
-
-  services.journald.extraConfig = ''
-    ForwardToSyslog=yes
-  '';
-}

base/services/scrutiny-collector.nix

@@ -1,11 +0,0 @@
-{ config, ... }:
-{
-  services.scrutiny.collector = {
-    enable = !config.services.qemuGuest.enable;
-    settings = {
-      version = 1;
-      host.id = config.networking.hostName;
-      api.endpoint = "https://scrutiny.pvv.ntnu.no/";
-    };
-  };
-}

base/services/timesyncd.nix

@@ -1,12 +0,0 @@
-{ ... }:
-{
-  services.timesyncd = {
-    servers = [ "ntp.ntnu.no" ];
-    fallbackServers = [
-      "0.pool.ntp.org"
-      "1.pool.ntp.org"
-      "0.no.pool.ntp.org"
-    ];
-  };
-}
-

flake.lock

@@ -1,42 +1,5 @@
 {
   "nodes": {
-    "bro": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "rust-overlay": "rust-overlay"
-      },
-      "locked": {
-        "lastModified": 1779629827,
-        "narHash": "sha256-nrlB50/oelB8oFx9DhOoXI5z0VoTZGEA6XxYvkvpqDA=",
-        "ref": "main",
-        "rev": "7d0f35e12e4dec39f981c08fc33515589f41f4a5",
-        "revCount": 3,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/bro.git"
-      },
-      "original": {
-        "ref": "main",
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/bro.git"
-      }
-    },
-    "crane": {
-      "locked": {
-        "lastModified": 1776635034,
-        "narHash": "sha256-OEOJrT3ZfwbChzODfIH4GzlNTtOFuZFWPtW7jIeR8xU=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "dc7496d8ea6e526b1254b55d09b966e94673750f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
     "dibbler": {
       "inputs": {
         "nixpkgs": [
@@ -44,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771267058,
+        "lastModified": 1770133120,
-        "narHash": "sha256-EEL4SmD1b3BPJPsSJJ4wDTXWMumJqbR+BLzhJJG0skE=",
+        "narHash": "sha256-RuAWONXb+U3omSsuIPCrPcgj0XYqv+2djG0cnPGEyKg=",
         "ref": "main",
-        "rev": "e3962d02c78b9c7b4d18148d931a9a4bf22e7902",
+        "rev": "3123b8b474319bc75ee780e0357dcdea69dc85e6",
-        "revCount": 254,
+        "revCount": 244,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
       },
@@ -65,16 +28,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1768920986,
+        "lastModified": 1736864502,
-        "narHash": "sha256-CNzzBsRhq7gg4BMBuTDObiWDH/rFYHEuDRVOwCcwXw4=",
+        "narHash": "sha256-ItkIZyebGvNH2dK9jVGzJHGPtb6BSWLN8Gmef16NeY0=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "de5708739256238fb912c62f03988815db89ec9a",
+        "rev": "0141aabed359f063de7413f80d906e1d98c0c123",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "v1.13.0",
+        "ref": "v1.11.0",
         "repo": "disko",
         "type": "github"
       }
@@ -84,11 +47,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1772408722,
+        "lastModified": 1765835352,
-        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
         "type": "github"
       },
       "original": {
@@ -100,15 +63,15 @@
     "gergle": {
       "inputs": {
         "nixpkgs": [
-          "nixpkgs-unstable"
+          "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1777067150,
+        "lastModified": 1767906545,
-        "narHash": "sha256-vqPz8jCS1zTQlvmgctUFpvnr6f9ISR5h7CPG/HgQvf0=",
+        "narHash": "sha256-LOf08pcjEQFLs3dLPuep5d1bAXWOFcdfxuk3YMb5KWw=",
         "ref": "main",
-        "rev": "b452a854fb78d6df9fe062b45e23a968657d115d",
+        "rev": "e55cbe0ce0b20fc5952ed491fa8a553c8afb1bdd",
-        "revCount": 35,
+        "revCount": 23,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
       },
@@ -121,15 +84,15 @@
     "greg-ng": {
       "inputs": {
         "nixpkgs": [
-          "nixpkgs-unstable"
+          "nixpkgs"
         ],
-        "rust-overlay": "rust-overlay_2"
+        "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1777019032,
+        "lastModified": 1767906494,
-        "narHash": "sha256-29lw7THThWb5DW01rVRj1b816Apwz/P4m2wVWaSIadU=",
+        "narHash": "sha256-Dd6gtdZfRMAD6JhdX0GdJwIHVaBikePSpQXhIdwLlWI=",
         "ref": "main",
-        "rev": "55262afca46c96f75a834d4e00e30d5fb20affb6",
+        "rev": "7258822e2e90fea2ea00b13b5542f63699e33a9e",
         "revCount": 61,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
@@ -161,27 +124,6 @@
         "url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
       }
     },
-    "libdib": {
-      "inputs": {
-        "nixpkgs": [
-          "worblehat",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1769338528,
-        "narHash": "sha256-t18ZoSt9kaI1yde26ok5s7aFLkap1Q9+/2icVh2zuaE=",
-        "ref": "refs/heads/main",
-        "rev": "7218348163fd8d84df4a6f682c634793e67a3fed",
-        "revCount": 13,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/libdib.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/libdib.git"
-      }
-    },
     "matrix-next": {
       "inputs": {
         "nixpkgs": [
@@ -208,7 +150,7 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "rust-overlay": "rust-overlay_3"
+        "rust-overlay": "rust-overlay_2"
       },
       "locked": {
         "lastModified": 1767906976,
@@ -275,11 +217,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778407980,
+        "lastModified": 1769018862,
-        "narHash": "sha256-r980BhsReZQe6FkmyNZkwCZpvzARo5jZgTl8HxjAssY=",
+        "narHash": "sha256-x3eMpPQhZwEDunyaUos084Hx41XwYTi2uHY4Yc4YNlk=",
         "owner": "oddlama",
         "repo": "nix-topology",
-        "rev": "ca0a602f650306d00d6f3e3c76d0f4c48a5c5adc",
+        "rev": "a15cac71d3399a4c2d1a3482ae62040a3a0aa07f",
         "type": "github"
       },
       "original": {
@@ -291,24 +233,24 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1779622335,
+        "lastModified": 1769724120,
-        "narHash": "sha256-06G98ieM6l+OI7EMhlvchgDBDn+DvIWCNj40LDhKpmc=",
+        "narHash": "sha256-oQBM04hQk1kotfv4qmIG1tHmuwODd1+hqRJE5TELeCE=",
-        "rev": "705e9929918b43bd7b715dc0a878ac870449bb03",
+        "rev": "8ec59ed5093c2a742d7744e9ecf58f358aa4a87d",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05beta1.705e9929918b/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.4961.8ec59ed5093c/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://nixos.org/channels/nixos-26.05-small/nixexprs.tar.xz"
+        "url": "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz"
       }
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1772328832,
+        "lastModified": 1765674936,
-        "narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=",
+        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742",
+        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
         "type": "github"
       },
       "original": {
@@ -319,38 +261,17 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1778586796,
+        "lastModified": 1769813739,
-        "narHash": "sha256-XmDljcG4x8slQDlsWOc77pCA1YVuYn8JGumkYlhfTxI=",
+        "narHash": "sha256-RmNWW1DQczvDwBHu11P0hGwJZxbngdoymVu7qkwq/2M=",
-        "rev": "b25e938b89759b5f9466fc53c4a970244f84dc39",
+        "rev": "16a3cae5c2487b1afa240e5f2c1811f172419558",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre996582.b25e938b8975/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre937548.16a3cae5c248/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
         "url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
       }
     },
-    "passwd2systemd-users": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1780764154,
-        "narHash": "sha256-Xvf9aBNLYDnbDKdtFjp5GEA/rZwVczHZWbJ0hac8Vv4=",
-        "ref": "main",
-        "rev": "8b4541be73ee3bd6c60525b2f42605efe89398c9",
-        "revCount": 14,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git"
-      },
-      "original": {
-        "ref": "main",
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git"
-      }
-    },
     "pvv-calendar-bot": {
       "inputs": {
         "nixpkgs": [
@@ -358,11 +279,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779774845,
+        "lastModified": 1764869785,
-        "narHash": "sha256-QJU1J4eupwjRrtvWGzRut0GY3woql92RS9O/acWkJkk=",
+        "narHash": "sha256-FGTIpC7gB4lbeL0bfYzn1Ge0PaCpd7VqWBLhJBx0i4A=",
         "ref": "main",
-        "rev": "13667cd216db260ab549e6f1b6281aa230d2f9e0",
+        "rev": "8ce7fb0b1918bdb3d1489a40d73895693955e8b2",
-        "revCount": 29,
+        "revCount": 23,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
       },
@@ -379,11 +300,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779903528,
+        "lastModified": 1769009806,
-        "narHash": "sha256-4rajaHeBeQ4PjbNSpslE9G3A5mZM1J/64ls+VoufWZo=",
+        "narHash": "sha256-52xTtAOc9B+MBRMRZ8HI6ybNsRLMlHHLh+qwAbaJjRY=",
         "ref": "main",
-        "rev": "bba7413a1c611d4918fbef4d3aa55e465ca3f3fb",
+        "rev": "aa8adfc6a4d5b6222752e2d15d4a6d3b3b85252e",
-        "revCount": 585,
+        "revCount": 575,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       },
@@ -416,7 +337,6 @@
     },
     "root": {
       "inputs": {
-        "bro": "bro",
         "dibbler": "dibbler",
         "disko": "disko",
         "gergle": "gergle",
@@ -429,35 +349,31 @@
         "nix-topology": "nix-topology",
         "nixpkgs": "nixpkgs",
         "nixpkgs-unstable": "nixpkgs-unstable",
-        "passwd2systemd-users": "passwd2systemd-users",
         "pvv-calendar-bot": "pvv-calendar-bot",
         "pvv-nettsiden": "pvv-nettsiden",
         "qotd": "qotd",
         "roowho2": "roowho2",
-        "sops-nix": "sops-nix",
+        "sops-nix": "sops-nix"
-        "worblehat": "worblehat"
       }
     },
     "roowho2": {
       "inputs": {
-        "crane": "crane",
         "nixpkgs": [
           "nixpkgs"
         ],
-        "rust-overlay": "rust-overlay_4"
+        "rust-overlay": "rust-overlay_3"
       },
       "locked": {
-        "lastModified": 1778600367,
+        "lastModified": 1769834595,
-        "narHash": "sha256-YB0b2xUf4D8792D5Ay//7C3AjHyv+9yoy8K1mTe+wvE=",
+        "narHash": "sha256-P1jrO7BxHyIKDuOXHuUb7bi4H2TuYnACW5eqf1gG47g=",
         "ref": "main",
-        "rev": "8e5f2849ff7c9616100fe928261512a7ad647939",
+        "rev": "def4eec2d59a69b4638b3f25d6d713b703b2fa56",
-        "revCount": 91,
+        "revCount": 49,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
       },
       "original": {
         "ref": "main",
-        "rev": "8e5f2849ff7c9616100fe928261512a7ad647939",
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
       }
@@ -465,16 +381,16 @@
     "rust-overlay": {
       "inputs": {
         "nixpkgs": [
-          "bro",
+          "greg-ng",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1779419951,
+        "lastModified": 1767840362,
-        "narHash": "sha256-dMX0PUslUHPajP6o8FEoRdFv9afq/dec4POR0vVfjK4=",
+        "narHash": "sha256-ZtsFqUhilubohNZ1TgpQIFsi4biZTwRH9rjZsDRDik8=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "5b5c521d6cae9ef4aa32f888eb2c0ce595c9be52",
+        "rev": "d159ea1fc321c60f88a616ac28bab660092a227d",
         "type": "github"
       },
       "original": {
@@ -484,27 +400,6 @@
       }
     },
     "rust-overlay_2": {
-      "inputs": {
-        "nixpkgs": [
-          "greg-ng",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1777000482,
-        "narHash": "sha256-CZ5FKUSA8FCJf0h9GWdPJXoVVDL9H5yC74GkVc5ubIM=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "403c09094a877e6c4816462d00b1a56ff8198e06",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "rust-overlay_3": {
       "inputs": {
         "nixpkgs": [
           "minecraft-heatmap",
@@ -525,7 +420,7 @@
         "type": "github"
       }
     },
-    "rust-overlay_4": {
+    "rust-overlay_3": {
       "inputs": {
         "nixpkgs": [
           "roowho2",
@@ -533,11 +428,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776914043,
+        "lastModified": 1769309768,
-        "narHash": "sha256-qug5r56yW1qOsjSI99l3Jm15JNT9CvS2otkXNRNtrPI=",
+        "narHash": "sha256-AbOIlNO+JoqRJkK1VrnDXhxuX6CrdtIu2hSuy4pxi3g=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "2d35c4358d7de3a0e606a6e8b27925d981c01cc3",
+        "rev": "140c9dc582cb73ada2d63a2180524fcaa744fad5",
         "type": "github"
       },
       "original": {
@@ -553,11 +448,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777944972,
+        "lastModified": 1769469829,
-        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
+        "narHash": "sha256-wFcr32ZqspCxk4+FvIxIL0AZktRs6DuF8oOsLt59YBU=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
+        "rev": "c5eebd4eb2e3372fe12a8d70a248a6ee9dd02eff",
         "type": "github"
       },
       "original": {
@@ -566,28 +461,6 @@
         "repo": "sops-nix",
         "type": "github"
       }
-    },
-    "worblehat": {
-      "inputs": {
-        "libdib": "libdib",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1773932847,
-        "narHash": "sha256-IklIAdlonrmO8/lkDxNIVz9+ORL4pcVotMTxeyvxzoc=",
-        "ref": "main",
-        "rev": "0871a319f51d3cb0d1abb5b11edb768b39906d3f",
-        "revCount": 104,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
-      },
-      "original": {
-        "ref": "main",
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -2,13 +2,13 @@
   description = "PVV System flake";
 
   inputs = {
-    nixpkgs.url = "https://nixos.org/channels/nixos-26.05-small/nixexprs.tar.xz";
+    nixpkgs.url = "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz";
     nixpkgs-unstable.url = "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz";
 
     sops-nix.url = "github:Mic92/sops-nix/master";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
 
-    disko.url = "github:nix-community/disko/v1.13.0";
+    disko.url = "github:nix-community/disko/v1.11.0";
     disko.inputs.nixpkgs.follows = "nixpkgs";
 
     nix-topology.url = "github:oddlama/nix-topology/main";
@@ -23,9 +23,6 @@
     dibbler.url = "git+https://git.pvv.ntnu.no/Projects/dibbler.git?ref=main";
     dibbler.inputs.nixpkgs.follows = "nixpkgs";
 
-    worblehat.url = "git+https://git.pvv.ntnu.no/Projects/worblehat.git?ref=main";
-    worblehat.inputs.nixpkgs.follows = "nixpkgs";
-
     matrix-next.url = "github:dali99/nixos-matrix-modules/v0.8.0";
     matrix-next.inputs.nixpkgs.follows = "nixpkgs";
 
@@ -35,13 +32,13 @@
     minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
     minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";
 
-    roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=8e5f2849ff7c9616100fe928261512a7ad647939";
+    roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main";
     roowho2.inputs.nixpkgs.follows = "nixpkgs";
 
     greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";
-    greg-ng.inputs.nixpkgs.follows = "nixpkgs-unstable";
+    greg-ng.inputs.nixpkgs.follows = "nixpkgs";
     gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git?ref=main";
-    gergle.inputs.nixpkgs.follows = "nixpkgs-unstable";
+    gergle.inputs.nixpkgs.follows = "nixpkgs";
     grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git?ref=master";
     grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
 
@@ -50,21 +47,10 @@
 
     qotd.url = "git+https://git.pvv.ntnu.no/Projects/qotd.git?ref=main";
     qotd.inputs.nixpkgs.follows = "nixpkgs";
-
-    bro.url = "git+https://git.pvv.ntnu.no/Projects/bro.git?ref=main";
-    bro.inputs.nixpkgs.follows = "nixpkgs";
-    passwd2systemd-users.url = "git+https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git?ref=main";
-    passwd2systemd-users.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = {
+  outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
-    self,
+  let
-    nixpkgs,
-    nixpkgs-unstable,
-    sops-nix,
-    disko,
-    ...
-  } @ inputs: let
     inherit (nixpkgs) lib;
     systems = [
       "x86_64-linux"
@@ -76,105 +62,75 @@
     importantMachines = [
       "bekkalokk"
       "bicep"
+      "brzeczyszczykiewicz"
       "georg"
       "ildkule"
-      "kommode"
-      "lupine-1"
-      "skrot"
     ];
   in {
     inputs = lib.mapAttrs (_: src: src.outPath) inputs;
 
-    pkgs = forAllSystems (system:
+    pkgs = forAllSystems (system: import nixpkgs {
-      import nixpkgs {
       inherit system;
-        config.allowUnfreePredicate = pkg:
+      config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
-          builtins.elem (lib.getName pkg)
         [
           "nvidia-x11"
           "nvidia-settings"
-            "nvidia-kernel-modules"
         ];
     });
 
-    apps = forAllSystems (system: let
-      pkgs = nixpkgs.legacyPackages.${system};
-    in {
-      gitea-workflows = {
-        type = "app";
-        meta.description = "Run all gitea workflows locally";
-        program = toString (pkgs.writeShellScript "pvv-nixos-config-run-gitea-worflows" ''
-          ${lib.getExe pkgs.gitea-actions-runner} exec -i node:current-trixie
-        '');
-      };
-    });
-
     nixosConfigurations = let
-      nixosConfig = nixpkgs: name: configurationPath: extraArgs @ {
+      nixosConfig =
+        nixpkgs:
+        name:
+        configurationPath:
+        extraArgs@{
           localSystem ? "x86_64-linux", # buildPlatform
           crossSystem ? "x86_64-linux", # hostPlatform
-        specialArgs ? {},
+          specialArgs ? { },
-        modules ? [],
+          modules ? [ ],
-        overlays ? [],
+          overlays ? [ ],
           enableDefaults ? true,
           ...
-      }: let
+        }:
-        commonPkgsConfig =
+        let
-          {
+          commonPkgsConfig = {
-            config.allowUnfreePredicate = pkg:
+            inherit localSystem crossSystem;
-              builtins.elem (lib.getName pkg)
+            config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
               [
                 "nvidia-x11"
                 "nvidia-settings"
-                "nvidia-kernel-modules"
               ];
-            overlays =
+            overlays = (lib.optionals enableDefaults [
-              (lib.optionals enableDefaults [
               # Global overlays go here
               inputs.roowho2.overlays.default
-              ])
+            ]) ++ overlays;
-              ++ overlays;
+          };
-          }
+
-          // (
-            if localSystem != crossSystem
-            then {
-              inherit localSystem crossSystem;
-            }
-            else {
-              system = crossSystem;
-            }
-          );
           pkgs = import nixpkgs commonPkgsConfig;
           unstablePkgs = import nixpkgs-unstable commonPkgsConfig;
         in
-        lib.nixosSystem (
+        lib.nixosSystem (lib.recursiveUpdate
-          lib.recursiveUpdate
         {
           system = crossSystem;
 
           inherit pkgs;
 
-            specialArgs =
+          specialArgs = {
-              {
             inherit inputs unstablePkgs;
             values = import ./values.nix;
             fp = path: ./${path};
-              }
+          } // specialArgs;
-              // specialArgs;
 
-            modules =
+          modules = [
-              [
             {
               networking.hostName = lib.mkDefault name;
             }
             configurationPath
-              ]
+          ] ++ (lib.optionals enableDefaults [
-              ++ (lib.optionals enableDefaults [
             sops-nix.nixosModules.sops
             inputs.roowho2.nixosModules.default
             self.nixosModules.rsync-pull-targets
-              ])
+          ]) ++ modules;
-              ++ modules;
         }
         (builtins.removeAttrs extraArgs [
           "localSystem"
@@ -188,8 +144,12 @@
 
       stableNixosConfig = name: extraArgs:
           nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
-    in
+    in {
-      {
+      bakke = stableNixosConfig "bakke" {
+        modules = [
+          inputs.disko.nixosModules.disko
+        ];
+      };
       bicep = stableNixosConfig "bicep" {
         modules = [
           inputs.matrix-next.nixosModules.default
@@ -204,61 +164,38 @@
           (final: prev: {
             inherit (self.packages.${prev.stdenv.hostPlatform.system}) out-of-your-element;
           })
-            (final: prev: {
-              # See https://git.pvv.ntnu.no/Drift/issues/issues/369
-              mjolnir = prev.mjolnir.override {
-                nodejs = prev.nodejs_22;
-              };
-            })
         ];
       };
       bekkalokk = stableNixosConfig "bekkalokk" {
         overlays = [
           (final: prev: {
-              mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions {};
+            mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions { };
-              simplesamlphp = final.callPackage ./packages/simplesamlphp {};
+            simplesamlphp = final.callPackage ./packages/simplesamlphp { };
+            simplesamlphptheme = final.callPackage ./packages/simplesamlphptheme { };
+            bluemap = final.callPackage ./packages/bluemap.nix { };
           })
           inputs.pvv-nettsiden.overlays.default
           inputs.qotd.overlays.default
         ];
         modules = [
           inputs.pvv-nettsiden.nixosModules.default
+          self.nixosModules.bluemap
           inputs.qotd.nixosModules.default
         ];
       };
-        ildkule = stableNixosConfig "ildkule" {
+      ildkule = stableNixosConfig "ildkule" { };
-          modules = [
+      #ildkule-unstable = unstableNixosConfig "ildkule" { };
-            inputs.disko.nixosModules.disko
-          ];
-        };
       skrot = stableNixosConfig "skrot" {
         modules = [
-            self.nixosModules.drumknotty
           inputs.disko.nixosModules.disko
+          inputs.dibbler.nixosModules.default
         ];
-          overlays =
+        overlays = [inputs.dibbler.overlays.default];
-          [
-            inputs.dibbler.overlays.default
-            inputs.worblehat.overlays.default
-          ];
-        };
-        shark = stableNixosConfig "shark" {};
-        wenche = stableNixosConfig "wenche" {};
-        temmie = stableNixosConfig "temmie" {
-          overlays = [
-            inputs.bro.overlays.default
-            inputs.passwd2systemd-users.overlays.default
-          ];
-          modules = [
-            inputs.bro.nixosModules.default
-          ];
-        };
-        gluttony = stableNixosConfig "gluttony" {
-          overlays = [
-            (final: prev: { bluemap = final.callPackage ./packages/bluemap.nix {}; })
-          ];
-          modules = [ self.nixosModules.bluemap ];
       };
+      shark = stableNixosConfig "shark" { };
+      wenche = stableNixosConfig "wenche" { };
+      temmie = stableNixosConfig "temmie" { };
+      gluttony = stableNixosConfig "gluttony" { };
 
       kommode = stableNixosConfig "kommode" {
         overlays = [
@@ -270,6 +207,12 @@
         ];
       };
 
+      ustetind = stableNixosConfig "ustetind" {
+        modules = [
+         "${nixpkgs}/nixos/modules/virtualisation/lxc-container.nix"
+        ];
+      };
+
       brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
         modules = [
           inputs.grzegorz-clients.nixosModules.grzegorz-webui
@@ -293,14 +236,45 @@
         ];
       };
     }
-      // (let
+    //
+    (let
+      skrottConfig = {
+        modules = [
+          (nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
+          inputs.dibbler.nixosModules.default
+        ];
+        overlays = [
+          inputs.dibbler.overlays.default
+          (final: prev: {
+            # NOTE: Yeetus (these break crosscompile ¯\_(ツ)_/¯)
+            atool = prev.emptyDirectory;
+            micro = prev.emptyDirectory;
+            ncdu = prev.emptyDirectory;
+          })
+        ];
+      };
+    in {
+      skrott = self.nixosConfigurations.skrott-native;
+      skrott-native = stableNixosConfig "skrott" (skrottConfig // {
+        localSystem = "aarch64-linux";
+        crossSystem = "aarch64-linux";
+      });
+      skrott-cross = stableNixosConfig "skrott" (skrottConfig // {
+        localSystem = "x86_64-linux";
+        crossSystem = "aarch64-linux";
+      });
+      skrott-x86_64 = stableNixosConfig "skrott" (skrottConfig // {
+        localSystem = "x86_64-linux";
+        crossSystem = "x86_64-linux";
+      });
+    })
+    //
+    (let
       machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
       stableLupineNixosConfig = name: extraArgs:
           nixosConfig nixpkgs name ./hosts/lupine/configuration.nix extraArgs;
-      in
+    in lib.genAttrs machineNames (name: stableLupineNixosConfig name {
-        lib.genAttrs machineNames (name:
+      modules = [{ networking.hostName = name; }];
-          stableLupineNixosConfig name {
-            modules = [{networking.hostName = name;}];
       specialArgs.lupineName = name;
     }));
 
@@ -312,7 +286,6 @@
       rsync-pull-targets = ./modules/rsync-pull-targets.nix;
       snakeoil-certs = ./modules/snakeoil-certs.nix;
       snappymail = ./modules/snappymail.nix;
-      drumknotty = ./modules/drumknotty;
     };
 
     devShells = forAllSystems (system: {
@@ -325,8 +298,7 @@
             })
           ];
         };
-      in
+      in pkgs.callPackage ./shell.nix { };
-        pkgs.callPackage ./shell.nix {};
       cuda = let
         cuda-pkgs = import nixpkgs-unstable {
           inherit system;
@@ -335,34 +307,30 @@
             cudaSupport = true;
           };
         };
-      in
+      in cuda-pkgs.callPackage ./shells/cuda.nix { };
-        cuda-pkgs.callPackage ./shells/cuda.nix {};
     });
 
     packages = {
       "x86_64-linux" = let
         system = "x86_64-linux";
         pkgs = nixpkgs.legacyPackages.${system};
-      in
+      in rec {
-        rec {
         default = important-machines;
-          important-machines =
+        important-machines = pkgs.linkFarm "important-machines"
-            pkgs.linkFarm "important-machines"
           (lib.getAttrs importantMachines self.packages.${system});
-          all-machines =
+        all-machines = pkgs.linkFarm "all-machines"
-            pkgs.linkFarm "all-machines"
           (lib.getAttrs allMachines self.packages.${system});
 
-          simplesamlphp = pkgs.callPackage ./packages/simplesamlphp {};
+        simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
 
-          bluemap = pkgs.callPackage ./packages/bluemap.nix {};
+        bluemap = pkgs.callPackage ./packages/bluemap.nix { };
 
-          out-of-your-element = pkgs.callPackage ./packages/ooye/package.nix {};
+        out-of-your-element = pkgs.callPackage ./packages/ooye/package.nix { };
       }
       //
       # Mediawiki extensions
       (lib.pipe null [
-          (_: pkgs.callPackage ./packages/mediawiki-extensions {})
+        (_: pkgs.callPackage ./packages/mediawiki-extensions { })
         (lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
         (lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
       ])
@@ -371,6 +339,16 @@
       lib.genAttrs allMachines
         (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
       //
+      # Skrott is exception
+      {
+        skrott = self.packages.${system}.skrott-native-sd;
+        skrott-native = self.nixosConfigurations.skrott-native.config.system.build.toplevel;
+        skrott-native-sd = self.nixosConfigurations.skrott-native.config.system.build.sdImage;
+        skrott-cross = self.nixosConfigurations.skrott-cross.config.system.build.toplevel;
+        skrott-cross-sd = self.nixosConfigurations.skrott-cross.config.system.build.sdImage;
+        skrott-x86_64 = self.nixosConfigurations.skrott-x86_64.config.system.build.toplevel;
+      }
+      //
       # Nix-topology
       (let
         topology' = import inputs.nix-topology {
@@ -391,8 +369,7 @@
           modules = [
             ./topology
             {
-                nixosConfigurations = lib.mapAttrs (_name: nixosCfg:
+              nixosConfigurations = lib.mapAttrs (_name: nixosCfg: nixosCfg.extendModules {
-                  nixosCfg.extendModules {
                 modules = [
                   inputs.nix-topology.nixosModules.default
                   ./topology/service-extractors/greg-ng.nix
@@ -400,16 +377,14 @@
                   ./topology/service-extractors/mysql.nix
                   ./topology/service-extractors/gitea-runners.nix
                 ];
-                  })
+              }) self.nixosConfigurations;
-                self.nixosConfigurations;
             }
           ];
         };
       in {
         topology = topology'.config.output;
-          topology-png =
+        topology-png = pkgs.runCommand "pvv-config-topology-png" {
-            pkgs.runCommand "pvv-config-topology-png" {
+          nativeBuildInputs = [ pkgs.writableTmpDirAsHomeHook ];
-              nativeBuildInputs = [pkgs.writableTmpDirAsHomeHook];
         } ''
           mkdir -p "$out"
           for file in '${topology'.config.output}'/*.svg; do

hosts/bakke/configuration.nix

@@ -0,0 +1,18 @@
+{ config, pkgs, values, ... }:
+{
+  imports = [
+      ./hardware-configuration.nix
+      ../../base
+      ./filesystems.nix
+    ];
+
+  networking.hostId = "99609ffc";
+  systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
+    matchConfig.Name = "enp2s0";
+    address = with values.hosts.bakke; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  };
+
+  # Don't change (even during upgrades) unless you know what you are doing.
+  # See https://search.nixos.org/options?show=system.stateVersion
+  system.stateVersion = "24.05";
+}

hosts/bakke/disks.nix

@@ -0,0 +1,83 @@
+{
+  # https://github.com/nix-community/disko/blob/master/example/boot-raid1.nix
+  # Note: Disko was used to create the initial md raid, but is no longer in active use on this host.
+  disko.devices = {
+    disk = {
+      one = {
+        type = "disk";
+        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E2EER6N6";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "500M";
+              type = "EF00";
+              content = {
+                type = "mdraid";
+                name = "boot";
+              };
+            };
+            mdadm = {
+              size = "100%";
+              content = {
+                type = "mdraid";
+                name = "raid1";
+              };
+            };
+          };
+        };
+      };
+      two = {
+        type = "disk";
+        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E7LPLU71";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "500M";
+              type = "EF00";
+              content = {
+                type = "mdraid";
+                name = "boot";
+              };
+            };
+            mdadm = {
+              size = "100%";
+              content = {
+                type = "mdraid";
+                name = "raid1";
+              };
+            };
+          };
+        };
+      };
+    };
+    mdadm = {
+      boot = {
+        type = "mdadm";
+        level = 1;
+        metadata = "1.0";
+        content = {
+          type = "filesystem";
+          format = "vfat";
+          mountpoint = "/boot";
+        };
+      };
+      raid1 = {
+        type = "mdadm";
+        level = 1;
+        content = {
+          type = "gpt";
+          partitions.primary = {
+            size = "100%";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/bakke/filesystems.nix

@@ -0,0 +1,26 @@
+{ pkgs,... }:
+{
+  # Boot drives:
+  boot.swraid.enable = true;
+
+  # ZFS Data pool:
+  boot = {
+    zfs = {
+      extraPools = [ "tank" ];
+      requestEncryptionCredentials = false;
+    };
+    supportedFilesystems.zfs = true;
+    # Use stable linux packages, these work with zfs
+    kernelPackages = pkgs.linuxPackages;
+  };
+  services.zfs.autoScrub = {
+    enable = true;
+    interval = "Wed *-*-8..14 00:00:00";
+  };
+
+  # NFS Exports:
+  #TODO
+
+  # NFS Import mounts:
+  #TODO
+}

hosts/bakke/hardware-configuration.nix

@@ -0,0 +1,52 @@
+# Do not modify this file!  It was generated by 'nixos-generate-config'
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+      fsType = "btrfs";
+      options = [ "subvol=root" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+      fsType = "btrfs";
+      options = [ "subvol=home" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+      fsType = "btrfs";
+      options = [ "subvol=nix" "noatime" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/sdc2";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault false;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/bekkalokk/configuration.nix

@@ -7,7 +7,6 @@
 
     ./services/alps.nix
     ./services/bluemap.nix
-    ./services/radicale.nix
     ./services/idp-simplesamlphp
     ./services/kerberos.nix
     ./services/mediawiki
@@ -25,6 +24,8 @@
     address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
   };
 
+  services.btrfs.autoScrub.enable = true;
+
   # Don't change (even during upgrades) unless you know what you are doing.
   # See https://search.nixos.org/options?show=system.stateVersion
   system.stateVersion = "25.11";

hosts/bekkalokk/services/bluemap.nix

@@ -1,10 +1,105 @@
-{ values, ... }:
+{ config, lib, pkgs, inputs, ... }:
 let
-  webExport = "/var/lib/bluemap/web";
+  vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
+  format = pkgs.formats.hocon { };
 in {
-  # NOTE: our version of the module gets added in flake.nix
+  # NOTE: our versino of the module gets added in flake.nix
   disabledModules = [ "services/web-apps/bluemap.nix" ];
 
+  sops.secrets."bluemap/ssh-key" = { };
+  sops.secrets."bluemap/ssh-known-hosts" = { };
+
+  services.bluemap = {
+    enable = true;
+
+    eula = true;
+    onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
+
+    host = "minecraft.pvv.ntnu.no";
+
+    maps = let
+      inherit (inputs.minecraft-kartverket.packages.${pkgs.stdenv.hostPlatform.system}) bluemap-export;
+    in {
+      "verden" = {
+        extraHoconMarkersFile = "${bluemap-export}/overworld.hocon";
+        settings = {
+          world = vanillaSurvival;
+          dimension = "minecraft:overworld";
+          name = "Verden";
+          sorting = 0;
+          start-pos = {
+            x = 0;
+            z = 0;
+          };
+          ambient-light = 0.1;
+          cave-detection-ocean-floor = -5;
+        };
+      };
+      "underverden" = {
+        extraHoconMarkersFile = "${bluemap-export}/nether.hocon";
+        settings = {
+          world = vanillaSurvival;
+          dimension = "minecraft:the_nether";
+          name = "Underverden";
+          sorting = 100;
+          start-pos = {
+            x = 0;
+            z = 0;
+          };
+          sky-color = "#290000";
+          void-color = "#150000";
+          sky-light = 1;
+          ambient-light = 0.6;
+          remove-caves-below-y = -10000;
+          cave-detection-ocean-floor = -5;
+          cave-detection-uses-block-light = true;
+          render-mask = [{
+            max-y = 90;
+          }];
+        };
+      };
+      "enden" = {
+        extraHoconMarkersFile = "${bluemap-export}/the-end.hocon";
+        settings = {
+          world = vanillaSurvival;
+          dimension = "minecraft:the_end";
+          name = "Enden";
+          sorting = 200;
+          start-pos = {
+            x = 0;
+            z = 0;
+          };
+          sky-color = "#080010";
+          void-color = "#080010";
+          sky-light = 1;
+          ambient-light = 0.6;
+          remove-caves-below-y = -10000;
+          cave-detection-ocean-floor = -5;
+        };
+      };
+    };
+  };
+
+  systemd.services."render-bluemap-maps" = {
+    serviceConfig = {
+      StateDirectory = [ "bluemap/world" ];
+      ExecStartPre = let
+        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
+          archive = true;
+          compress = true;
+          verbose = true;
+          no-owner = true;
+          no-group = true;
+          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
+        };
+      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
+      LoadCredential = [
+        "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
+        "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
+      ];
+    };
+  };
+
   services.nginx.virtualHosts."minecraft.pvv.ntnu.no" = {
     enableACME = true;
     forceSSL = true;
@@ -20,30 +115,6 @@ in {
       quic_retry on;
       add_header Alt-Svc 'h3=":$server_port"; ma=86400';
     '';
-    root = webExport;
-    locations = {
-      "~* ^/maps/[^/]*/tiles/".extraConfig = ''
-        error_page 404 = @empty;
-      '';
-      "@empty".return = "204";
-    };
-  };
-
-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${webExport} = {
-      user = "root";
-      rrsyncArgs.wo = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"gluttony.pvv.ntnu.no,${values.hosts.gluttony.ipv6},${values.hosts.gluttony.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH5jrqMovXlWaFWZAV/aKyQReHvUQp5kb+7Ja4gnevSr root@gluttony bluemap";
-    };
   };
 
   networking.firewall.allowedUDPPorts = [ 443 ];

hosts/bekkalokk/services/idp-simplesamlphp/config.php

@@ -858,7 +858,11 @@ $config = [
     /*
      * Which theme directory should be used?
      */
-    'theme.use' => 'default',
+    'module.enable' => [
+	    'pvv' => TRUE,
+    ],
+
+    'theme.use' => 'ssp-theme:pvv',
 
     /*
      * Set this option to the text you would like to appear at the header of each page. Set to false if you don't want

hosts/bekkalokk/services/idp-simplesamlphp/default.nix

@@ -97,6 +97,7 @@ let
       '';
 
       "modules/authpwauth/src/Auth/Source/PwAuth.php" = ./authpwauth.php;
+      #"modules/ssp-theme" = pkgs.simplesamlphptheme;
     };
   };
 in

hosts/bekkalokk/services/mediawiki/default.nix

@@ -107,7 +107,6 @@ in {
         CodeEditor
         CodeMirror
         DeleteBatch
-        PdfHandler
         PluggableAuth
         Popups
         Scribunto
@@ -182,17 +181,12 @@ in {
       ];
 
       # Misc program paths
-      $wgFFmpegLocation = '${lib.getExe pkgs.ffmpeg}';
+      $wgFFmpegLocation = '${pkgs.ffmpeg}/bin/ffmpeg';
-      $wgExiftool = '${lib.getExe pkgs.exiftool}';
+      $wgExiftool = '${pkgs.exiftool}/bin/exiftool';
-      $wgExiv2Command = '${lib.getExe pkgs.exiv2}';
+      $wgExiv2Command = '${pkgs.exiv2}/bin/exiv2';
       # See https://gist.github.com/sergejmueller/088dce028b6dd120a16e
-      $wgJpegTran = '${lib.getExe' pkgs.mozjpeg "jpegtran"}';
+      $wgJpegTran = '${pkgs.mozjpeg}/bin/jpegtran';
-      $wgGitBin = '${lib.getExe pkgs.git}';
+      $wgGitBin = '${pkgs.git}/bin/git';
-      $wgDiff3 = '${lib.getExe' pkgs.diffutils "diff3"}';
-      $wgDiff = '${lib.getExe' pkgs.diffutils "diff"}';
-
-      $wgUseImageMagick = true;
-      $wgImageMagickConvertCommand = '${lib.getExe pkgs.imagemagick}';
 
       # Debugging
       $wgShowExceptionDetails = false;
@@ -216,15 +210,6 @@ in {
 
       # EXT:WikiEditor
       $wgWikiEditorRealtimePreview = true;
-
-      # EXT:PdfHandler
-      $wgPdfProcessor = '${lib.getExe pkgs.ghostscript_headless}';
-      $wgPdfPostProcessor = $wgImageMagickConvertCommand;
-      $wgPdfInfo = '${lib.getExe' pkgs.poppler-utils "pdfinfo"}';
-      $wgPdftoText = '${lib.getExe' pkgs.poppler-utils "pdftotext"}';
-
-      # Override key from hardcoded config in nixpkgs
-      $wgSecretKey = file_get_contents("${config.sops.secrets."mediawiki/secret-key".path}");
     '';
   };
 
@@ -288,6 +273,8 @@ in {
   systemd.services.mediawiki-init = lib.mkIf cfg.enable {
     after = [ "sops-install-secrets.service" ];
     serviceConfig = {
+      BindReadOnlyPaths = [ "/run/credentials/mediawiki-init.service/secret-key:/var/lib/mediawiki/secret.key" ];
+      LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
       UMask = lib.mkForce "0007";
     };
   };
@@ -295,6 +282,8 @@ in {
   systemd.services.phpfpm-mediawiki = lib.mkIf cfg.enable {
     after = [ "sops-install-secrets.service" ];
     serviceConfig = {
+      BindReadOnlyPaths = [ "/run/credentials/phpfpm-mediawiki.service/secret-key:/var/lib/mediawiki/secret.key" ];
+      LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
       UMask = lib.mkForce "0007";
     };
   };

hosts/bekkalokk/services/radicale.nix

@@ -1,40 +0,0 @@
-{ config, lib, ... }:
-let
-  domain = "dav.pvv.ntnu.no";
-  radicalePort = 5232;
-in {
-  services.radicale = {
-    enable = true;
-
-    settings = {
-      server = {
-        hosts = [ "127.0.0.1:${toString radicalePort}" ];
-      };
-
-      auth = {
-        type = "imap";
-        imap_host = "imap.pvv.ntnu.no";
-        imap_security = "tls";
-      };
-
-      storage = {
-        filesystem_folder = "/var/lib/radicale/collections";
-      };
-    };
-  };
-
-  services.nginx.virtualHosts."${domain}" = {
-    forceSSL = true;
-    enableACME = true;
-    kTLS = true;
-
-    extraConfig = ''
-      client_max_body_size 128M;
-    '';
-
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:${toString radicalePort}";
-      proxyWebsockets = true;
-    };
-  };
-}

hosts/bekkalokk/services/vaultwarden.nix

@@ -6,58 +6,40 @@ let
   port = 3011;
   wsPort = 3012;
 in {
-  sops.secrets."vaultwarden/rsa_key.pem" = {
+  sops.secrets."vaultwarden/environ" = {
     owner = "vaultwarden";
     group = "vaultwarden";
-    mode = "440";
-    restartUnits = [ "vaultwarden.service" ];
-  };
-  sops.secrets."vaultwarden/rsa_key.pub.pem" = {
-    owner = "vaultwarden";
-    group = "vaultwarden";
-    mode = "440";
-    restartUnits = [ "vaultwarden.service" ];
-  };
-  sops.secrets."vaultwarden/env/DATABASE_PASSWORD" = { };
-  sops.secrets."vaultwarden/env/SMTP_PASSWORD" = { };
-  sops.templates."vaultwarden/environment_file" = {
-    owner = "vaultwarden";
-    group = "vaultwarden";
-    mode = "440";
-    restartUnits = [ "vaultwarden.service" ];
-    content = ''
-        DATABASE_URL=postgresql://vaultwarden:${config.sops.placeholder."vaultwarden/env/DATABASE_PASSWORD"}@postgres.pvv.ntnu.no/vaultwarden
-        SMTP_PASSWORD=${config.sops.placeholder."vaultwarden/env/SMTP_PASSWORD"}
-    '';
   };
 
   services.vaultwarden = {
     enable = true;
     dbBackend = "postgresql";
-    environmentFile = config.sops.templates."vaultwarden/environment_file".path;
+    environmentFile = config.sops.secrets."vaultwarden/environ".path;
     config = {
-      DOMAIN = "https://${domain}";
+      domain = "https://${domain}";
 
-      ROCKET_ADDRESS = address;
+      rocketAddress = address;
-      ROCKET_PORT = port;
+      rocketPort = port;
 
-      WEBSOCKET_ENABLED = true;
+      websocketEnabled = true;
-      WEBSOCKET_ADDRESS = address;
+      websocketAddress = address;
-      WEBSOCKET_PORT = wsPort;
+      websocketPort = wsPort;
 
-      SIGNUPS_ALLOWED = true;
+      signupsAllowed = true;
-      SIGNUPS_VERIFY = true;
+      signupsVerify = true;
-      SIGNUPS_DOMAINS_WHITELIST = "pvv.ntnu.no";
+      signupsDomainsWhitelist = "pvv.ntnu.no";
 
-      SMTP_FROM = "vaultwarden@pvv.ntnu.no";
+      smtpFrom = "vaultwarden@pvv.ntnu.no";
-      SMTP_FROM_NAME = "VaultWarden PVV";
+      smtpFromName = "VaultWarden PVV";
 
-      SMTP_HOST = "smtp.pvv.ntnu.no";
+      smtpHost = "smtp.pvv.ntnu.no";
-      SMTP_USERNAME = "vaultwarden";
+      smtpUsername = "vaultwarden";
-      SMTP_SECURITY = "force_tls";
+      smtpSecurity = "force_tls";
-      SMTP_AUTH_MECHANISM = "Login";
+      smtpAuthMechanism = "Login";
 
-      RSA_KEY_FILENAME = lib.removeSuffix ".pem" config.sops.secrets."vaultwarden/rsa_key.pem".path;
+      # Configured in environ:
+      # databaseUrl = "postgresql://vaultwarden@/vaultwarden";
+      # smtpPassword = hemli
     };
   };
 
@@ -84,6 +66,40 @@ in {
     };
   };
 
+  systemd.services.vaultwarden = lib.mkIf cfg.enable {
+    serviceConfig = {
+      AmbientCapabilities = [ "" ];
+      CapabilityBoundingSet = [ "" ];
+      DeviceAllow = [ "" ];
+      LockPersonality = true;
+      NoNewPrivileges = true;
+      # MemoryDenyWriteExecute = true;
+      PrivateMounts = true;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RemoveIPC = true;
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+      ];
+    };
+  };
+
   services.rsync-pull-targets = {
     enable = true;
     locations."/var/lib/vaultwarden" = {

hosts/bekkalokk/services/webmail/default.nix

@@ -10,9 +10,8 @@
     enableACME = true;
     kTLS = true;
     locations = {
-      # "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
+      "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
 
-      "/roundcube".return = "302 https://webmail.pvv.ntnu.no/";
       "/afterlogic_lite".return = "302 https://webmail.pvv.ntnu.no/roundcube";
       "/squirrelmail".return = "302 https://webmail.pvv.ntnu.no/roundcube";
       "/rainloop".return = "302 https://snappymail.pvv.ntnu.no/";

hosts/bekkalokk/services/webmail/roundcube.nix

@@ -9,12 +9,6 @@ in
   sops.secrets."roundcube/postgres_password" = {
     owner = "nginx";
     group = "nginx";
-    restartUnits = [ "phpfpm-roundcube.service" ];
-  };
-  sops.secrets."roundcube/des_key" = {
-    owner = "nginx";
-    group = "nginx";
-    restartUnits = [ "phpfpm-roundcube.service" ];
   };
 
   services.roundcube = {
@@ -29,7 +23,7 @@ in
 
     dicts = with pkgs.aspellDicts; [ en en-computers nb nn fr de it ];
     maxAttachmentSize = 20;
-    hostName = domain;
+    hostName = "roundcubeplaceholder.example.com";
 
     database = {
       host = "postgres.pvv.ntnu.no";
@@ -45,13 +39,47 @@ in
       $config['mail_domain'] = "pvv.ntnu.no";
       $config['smtp_user'] = "%u";
       $config['support_url'] = "";
-      $config['des_key'] = "${config.sops.secrets."roundcube/des_key".path}";
     '';
   };
 
-  # TODO: move this back to `webmail.pvv.ntnu.no/roundcube` subpath
+  services.nginx.virtualHosts."roundcubeplaceholder.example.com" = lib.mkForce { };
 
   services.nginx.virtualHosts.${domain} = {
     kTLS = true;
+    locations."/roundcube" = {
+      tryFiles = "$uri $uri/ =404";
+      index = "index.php";
+      root = pkgs.runCommandLocal "roundcube-dir" { } ''
+        mkdir -p $out
+        ln -s ${cfg.package} $out/roundcube
+      '';
+      extraConfig = ''
+        location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
+        # https://wiki.archlinux.org/title/Roundcube
+        "README"
+        "INSTALL"
+        "LICENSE"
+        "CHANGELOG"
+        "UPGRADING"
+        "bin"
+        "SQL"
+        ".+\\.md"
+        "\\."
+        "config"
+        "temp"
+        "logs"
+        ]})/? {
+          deny all;
+        }
+
+        location ~ ^/roundcube/(.+\.php)(/?.*)$ {
+          fastcgi_split_path_info ^/roundcube(/.+\.php)(/.+)$;
+          include ${config.services.nginx.package}/conf/fastcgi_params;
+          include ${config.services.nginx.package}/conf/fastcgi.conf;
+          fastcgi_index index.php;
+          fastcgi_pass unix:${config.services.phpfpm.pools.roundcube.socket};
+        }
+      '';
+    };
   };
 }

hosts/bekkalokk/services/website/default.nix

@@ -80,46 +80,14 @@ in {
   };
 
   services.phpfpm.pools."pvv-nettsiden".settings = {
-    "php_admin_value[error_log]" = "syslog";
+    # "php_admin_value[error_log]" = "stderr";
     "php_admin_flag[log_errors]" = true;
     "catch_workers_output" = true;
-
-    "php_admin_value[max_execution_time]" = "30";
-    "request_terminate_timeout" = "60s";
-
-    "php_admin_value[sendmail_path]" = let
-      fakeSendmail = pkgs.writeShellApplication {
-        name = "fake-sendmail";
-        text = ''
-          TIMESTAMP="$(date +%Y-%m-%d-%H-%M-%S-%N)"
-          (
-            echo "SENDMAIL ARGS:"
-            echo "$@"
-            echo "SENDMAIL STDIN:"
-            cat -
-          ) > "/var/lib/pvv-nettsiden/emails/$TIMESTAMP.mail"
-        '';
-      };
-    in lib.getExe fakeSendmail;
-
-    "php_admin_value[disable_functions]" = lib.concatStringsSep "," [
-      "curl_exec"
-      "curl_multi_exec"
-      "exec"
-      "parse_ini_file"
-      "passthru"
-      "popen"
-      "proc_open"
-      "shell_exec"
-      "show_source"
-      "system"
-    ];
   };
 
   services.nginx.virtualHosts."pvv.ntnu.no" = {
     globalRedirect = cfg.domainName;
     redirectCode = 307;
-    kTLS = true;
     forceSSL = true;
     useACMEHost = "www.pvv.ntnu.no";
   };
@@ -127,7 +95,6 @@ in {
   services.nginx.virtualHosts."www.pvv.org" = {
     globalRedirect = cfg.domainName;
     redirectCode = 307;
-    kTLS = true;
     forceSSL = true;
     useACMEHost = "www.pvv.ntnu.no";
   };
@@ -135,13 +102,11 @@ in {
   services.nginx.virtualHosts."pvv.org" = {
     globalRedirect = cfg.domainName;
     redirectCode = 307;
-    kTLS = true;
     forceSSL = true;
     useACMEHost = "www.pvv.ntnu.no";
   };
 
   services.nginx.virtualHosts.${cfg.domainName} = {
-    kTLS = true;
     locations = {
       # Proxy home directories
       "^~ /~" = {

hosts/bekkalokk/services/website/fetch-gallery.nix

@@ -37,31 +37,18 @@ in {
   };
 
   systemd.services.pvv-nettsiden-gallery-update = {
-    serviceConfig = {
+    path = with pkgs; [ imagemagick gnutar gzip ];
-      WorkingDirectory = galleryDir;
-      User = config.services.pvv-nettsiden.user;
-      Group = config.services.pvv-nettsiden.group;
 
-      ExecStart = lib.getExe (pkgs.writeShellApplication {
+    script = ''
-        name = "pvv-nettsiden-gallery-update-exec-start.sh";
+      tar ${lib.cli.toGNUCommandLineShell {} {
-        runtimeInputs = with pkgs; [
-          coreutils
-          findutils
-          gnused
-          gnutar
-          gzip
-          imagemagick
-        ];
-        text = ''
-          tar ${lib.cli.toCommandLineShellGNU { } {
         extract = true;
         file = "${transferDir}/gallery.tar.gz";
         directory = ".";
       }}
 
       # Delete files and directories that exists in the gallery that don't exist in the tarball
-          filesToRemove="$(uniq -u <(sort <(find . -not -path './.thumbnails*') <(tar -tf '${transferDir}/gallery.tar.gz' | sed 's|/$||')))"
+      filesToRemove=$(uniq -u <(sort <(find . -not -path "./.thumbnails*") <(tar -tf ${transferDir}/gallery.tar.gz | sed 's|/$||')))
-          while IFS= read -r fname; do
+      while IFS= read fname; do
         rm -f "$fname" ||:
         rm -f ".thumbnails/$fname.png" ||:
       done <<< "$filesToRemove"
@@ -69,9 +56,9 @@ in {
       find . -type d -empty -delete
 
       mkdir -p .thumbnails
-          images="$(find . -type f -not -path './.thumbnails*')"
+      images=$(find . -type f -not -path "./.thumbnails*")
 
-          while IFS= read -r fname; do
+      while IFS= read fname; do
         # Skip this file if an up-to-date thumbnail already exists
         if [ -f ".thumbnails/$fname.png" ] && \
           [ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
@@ -80,12 +67,16 @@ in {
         fi
 
         echo "Creating thumbnail for $fname"
-            mkdir -p "$(dirname ".thumbnails/$fname")"
+        mkdir -p $(dirname ".thumbnails/$fname")
         magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
         touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
       done <<< "$images"
     '';
-      });
+
+    serviceConfig = {
+      WorkingDirectory = galleryDir;
+      User = config.services.pvv-nettsiden.user;
+      Group = config.services.pvv-nettsiden.group;
 
       AmbientCapabilities = [ "" ];
       CapabilityBoundingSet = [ "" ];

hosts/bicep/services/git-mirrors/default.nix

@@ -83,7 +83,6 @@ in
   };
 
   services.nginx.virtualHosts."mirrors.pvv.ntnu.no" = {
-    kTLS = true;
     forceSSL = true;
     enableACME = true;
 

hosts/bicep/services/matrix/hookshot/default.nix

@@ -22,7 +22,6 @@ in
   sops.templates."hookshot-registration.yaml" = {
     owner = config.users.users.matrix-synapse.name;
     group = config.users.groups.keys-matrix-registrations.name;
-    mode = "0440";
     restartUnits = [ "matrix-hookshot.service" ];
     content = ''
       id: matrix-hookshot
@@ -50,59 +49,12 @@ in
 
   systemd.services.matrix-hookshot = {
     serviceConfig = {
-      DynamicUser = true;
       SupplementaryGroups = [
         config.users.groups.keys-matrix-registrations.name
       ];
       LoadCredential = [
         "passkey.pem:${config.sops.secrets."matrix/hookshot/passkey".path}"
       ];
-
-      RuntimeDirectory = [ "matrix-hookshot/root-mnt" ];
-      RootDirectory = "/run/matrix-hookshot/root-mnt";
-      BindReadOnlyPaths = [
-        config.sops.templates."hookshot-registration.yaml".path
-        builtins.storeDir
-        "/etc"
-        "/run/nscd"
-        "/var/run/nscd"
-      ];
-
-      AmbientCapabilities = "";
-      CapabilityBoundingSet = "";
-      LockPersonality = true;
-      MemoryDenyWriteExecute = false; # node needs this
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      PrivateTmp = true;
-      PrivateUsers = true;
-      ProcSubset = "pid";
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      RemoveIPC = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-        "~@resources"
-      ];
-      UMask = "0077";
     };
   };
 
@@ -194,7 +146,6 @@ in
   };
 
   services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
-    kTLS = true;
     enableACME = true;
     addSSL = true;
     locations."/" = {

hosts/bicep/services/matrix/mjolnir.nix

@@ -54,53 +54,4 @@
     # TODO: Fix upstream module in nixpkgs
     pantalaimon.username = "bot_admin";
   };
-
-  systemd.services.mjolnir.serviceConfig = {
-    DynamicUser = true;
-    RuntimeDirectory = [ "mjolnir/root-mnt" ];
-    RootDirectory = "/run/mjolnir/root-mnt";
-    BindReadOnlyPaths = [
-      config.sops.secrets."matrix/mjolnir/access_token".path
-      builtins.storeDir
-      "/etc"
-      "/run/nscd"
-      "/var/run/nscd"
-    ];
-
-    AmbientCapabilities = "";
-    CapabilityBoundingSet = "";
-    LockPersonality = true;
-    MemoryDenyWriteExecute = false; # node needs this
-    NoNewPrivileges = true;
-    PrivateDevices = true;
-    PrivateMounts = true;
-    PrivateTmp = true;
-    PrivateUsers = true;
-    ProcSubset = "pid";
-    ProtectClock = true;
-    ProtectControlGroups = true;
-    ProtectHome = true;
-    ProtectHostname = true;
-    ProtectKernelLogs = true;
-    ProtectKernelModules = true;
-    ProtectKernelTunables = true;
-    ProtectProc = "invisible";
-    ProtectSystem = "strict";
-    RemoveIPC = true;
-    RestrictAddressFamilies = [
-      "AF_INET"
-      "AF_INET6"
-      "AF_UNIX"
-    ];
-    RestrictNamespaces = true;
-    RestrictRealtime = true;
-    RestrictSUIDSGID = true;
-    SystemCallArchitectures = "native";
-    SystemCallFilter = [
-      "@system-service"
-      "~@privileged"
-      "~@resources"
-    ];
-    UMask = "0077";
-  };
 }

hosts/bicep/services/matrix/out-of-your-element.nix

@@ -56,55 +56,6 @@ in
     enableSynapseIntegration = false;
   };
 
-  systemd.services."matrix-ooye" = {
-    serviceConfig = {
-      RuntimeDirectory = [ "matrix-ooye/root-mnt" ];
-      RootDirectory = "/run/matrix-ooye/root-mnt";
-      BindReadOnlyPaths = [
-        builtins.storeDir
-        "/etc"
-        "/run/nscd"
-        "/var/run/nscd"
-      ];
-
-      AmbientCapabilities = "";
-      CapabilityBoundingSet = "";
-      LockPersonality = true;
-      MemoryDenyWriteExecute = false; # node needs this
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      PrivateTmp = true;
-      PrivateUsers = true;
-      ProcSubset = "pid";
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      RemoveIPC = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-        "~@resources"
-      ];
-      UMask = "0077";
-    };
-  };
-
   systemd.services."matrix-synapse" = {
     after = [
       "matrix-ooye-pre-start.service"
@@ -129,7 +80,6 @@ in
   };
 
   services.nginx.virtualHosts."ooye.pvv.ntnu.no" = {
-    kTLS = true;
     forceSSL = true;
     enableACME = true;
     locations."/".proxyPass = "http://localhost:${cfg.socket}";

hosts/bicep/services/minecraft-heatmap.nix

@@ -23,28 +23,27 @@ in
   };
 
   systemd.services.minecraft-heatmap-ingest-logs = lib.mkIf cfg.enable {
-    serviceConfig = {
+    serviceConfig.LoadCredential = [
-      LoadCredential = [
       "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
     ];
-      ExecStartPre = let
+
+    preStart = let
       knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
         innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
         innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
         innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
       '';
-        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
+    in ''
-          archive = true;
+      mkdir -p '${cfg.minecraftLogsDir}'
-          verbose = true;
+      "${lib.getExe pkgs.rsync}" \
-          progress = true;
+      --archive \
-          no-owner = true;
+      --verbose \
-          no-group = true;
+      --progress \
-        };
+      --no-owner \
-        sshCommand = ''${pkgs.openssh}/bin/ssh -o UserKnownHostsFile='${knownHostsFile}' -i \"$CREDENTIALS_DIRECTORY\"/sshkey'';
+      --no-group \
-      in [
+      --rsh="${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=\"${knownHostsFile}\" -i \"$CREDENTIALS_DIRECTORY\"/sshkey" \
-        "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.minecraftLogsDir}'"
+      root@innovation.pvv.ntnu.no:/ \
-        "${lib.getExe pkgs.rsync} ${rsyncArgs} --rsh=\"${sshCommand}\" root@innovation.pvv.ntnu.no:/ '${cfg.minecraftLogsDir}'/"
+      '${cfg.minecraftLogsDir}'/
-      ];
+    '';
-    };
   };
 }

hosts/bicep/services/mysql/backup.nix

@@ -57,7 +57,7 @@ in
       rm "$STATE_DIRECTORY/mysql-dump-latest.sql.zst" ||:
       ln -T "$OUT_FILE" "$STATE_DIRECTORY/mysql-dump-latest.sql.zst"
 
-      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt '${toString (rotations + 1)}' ]; do
+      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt ${toString (rotations + 1)} ]; do
         rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
       done
     '';

hosts/bicep/services/mysql/default.nix

@@ -23,9 +23,6 @@ in
         bind-address = values.services.mysql.ipv4;
         skip-networking = 0;
 
-        # Useful for the mysqld prometheus exporter
-        userstat = 1;
-
         # This was needed in order to be able to use all of the old users
         # during migration from knakelibrak to bicep in Sep. 2023
         secure_auth = 0;
@@ -74,16 +71,4 @@ in
       ];
     };
   };
-
-  services.logrotate = lib.mkIf (cfg.settings.mysqld.slow-query-log == 1) {
-    enable = true;
-    settings.mysql-slowlog = {
-      files = [ cfg.settings.mysqld.slow-query-log-file ];
-      frequency = "weekly";
-      rotate = 12;
-      create = "0660 mysql mysql";
-      minsize = "1M";
-      compress = true;
-    };
-  };
 }

hosts/bicep/services/postgresql/backup.nix

@@ -58,7 +58,7 @@ in
       rm "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst" ||:
       ln -T "$OUT_FILE" "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst"
 
-      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt '${toString (rotations + 1)}' ]; do
+      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt ${toString (rotations + 1)} ]; do
         rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
       done
     '';

hosts/bicep/services/postgresql/cleanup-timers.nix

@@ -1,37 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.postgresql;
-in
-{
-  config = lib.mkIf cfg.enable {
-    systemd.services = {
-      postgresql-repack = {
-        requires = [ "postgresql.service" ];
-        after = [ "postgresql.target" ];
-        description = "Repack all PostgreSQL databases";
-        startAt = "Mon 06:00:00";
-        serviceConfig = {
-          Type = "oneshot";
-          User = "postgres";
-          Group = "postgres";
-
-          ExecStart = "${lib.getExe cfg.package.pkgs.pg_repack} --host=/run/postgresql --no-kill-backend --wait-timeout=30 --all";
-        };
-      };
-
-      postgresql-vacuum-analyze = {
-        requires = [ "postgresql.service" ];
-        after = [ "postgresql.target" ];
-        description = "Vacuum and analyze all PostgreSQL databases";
-        startAt = "Tue 06:00:00";
-        serviceConfig = {
-          Type = "oneshot";
-          User = "postgres";
-          Group = "postgres";
-
-          ExecStart = "${lib.getExe' cfg.package "psql"} --port=${builtins.toString cfg.settings.port} -tAc 'VACUUM ANALYZE'";
-        };
-      };
-    };
-  };
-}

hosts/bicep/services/postgresql/default.nix

@@ -3,15 +3,11 @@ let
   cfg = config.services.postgresql;
 in
 {
-  imports = [
+  imports = [ ./backup.nix ];
-    ./backup.nix
-    ./cleanup-timers.nix
-  ];
 
   services.postgresql = {
     enable = true;
     package = pkgs.postgresql_18;
-    extensions = ps: with ps; [ pg_repack ];
     enableTCPIP = true;
 
     authentication = ''

hosts/bikkje/configuration.nix

@@ -29,29 +29,7 @@
         firewall = {
           enable = true;
           # Allow SSH and HTTP and ports for email and irc
-          allowedTCPPorts = [
+          allowedTCPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
-            22 # SSH
-            80 # HTTP
-
-            # IRC
-            194 # IRC
-            994 # IRC (TLS)
-            6697 # IRC (SSL)
-            6665
-            6666
-            6667
-            6668
-            6669
-
-            # EMAIL
-            25  # STMP
-            465 # STMP (SSL)
-            587 # STMP (TLS/STARTTLS)
-            110 # POP3
-            995 # POP3 (SSL/TLS)
-            143 # IMAP
-            993 # IMAP (SSL/TLS)
-          ];
           allowedUDPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
         };
         # Use systemd-resolved inside the container

hosts/gluttony/configuration.nix

@@ -7,7 +7,6 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ./services/bluemap.nix
     (fp /base)
   ];
 

hosts/gluttony/hardware-configuration.nix

@@ -22,7 +22,7 @@
     "sd_mod"
   ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
-  boot.kernelModules = [ "kvm-intel" ];
+  boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" = {
@@ -31,7 +31,7 @@
   };
 
   fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/BD97-FCA0";
+    device = "/dev/disk/by-uuid/933A-3005";
     fsType = "vfat";
     options = [
       "fmask=0077"

hosts/gluttony/services/bluemap.nix

@@ -1,113 +0,0 @@
-{ config, lib, pkgs, inputs, ... }:
-let
-  vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
-in {
-  # NOTE: our version of the module gets added in flake.nix
-  disabledModules = [ "services/web-apps/bluemap.nix" ];
-
-  sops.secrets."bluemap/ssh-key" = { };
-  sops.secrets."bluemap/ssh-known-hosts" = { };
-
-  services.bluemap = {
-    enable = true;
-
-    eula = true;
-    onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
-
-    enableNginx = false;
-
-    host = "minecraft.pvv.ntnu.no";
-
-    maps = let
-      inherit (inputs.minecraft-kartverket.packages.${pkgs.stdenv.hostPlatform.system}) bluemap-export;
-    in {
-      "verden" = {
-        extraHoconMarkersFile = "${bluemap-export}/overworld.hocon";
-        settings = {
-          world = vanillaSurvival;
-          dimension = "minecraft:overworld";
-          name = "Verden";
-          sorting = 0;
-          start-pos = {
-            x = 0;
-            z = 0;
-          };
-          ambient-light = 0.1;
-          cave-detection-ocean-floor = -5;
-        };
-      };
-      "underverden" = {
-        extraHoconMarkersFile = "${bluemap-export}/nether.hocon";
-        settings = {
-          world = vanillaSurvival;
-          dimension = "minecraft:the_nether";
-          name = "Underverden";
-          sorting = 100;
-          start-pos = {
-            x = 0;
-            z = 0;
-          };
-          sky-color = "#290000";
-          void-color = "#150000";
-          sky-light = 1;
-          ambient-light = 0.6;
-          remove-caves-below-y = -10000;
-          cave-detection-ocean-floor = -5;
-          cave-detection-uses-block-light = true;
-          render-mask = [{
-            max-y = 90;
-          }];
-        };
-      };
-      "enden" = {
-        extraHoconMarkersFile = "${bluemap-export}/the-end.hocon";
-        settings = {
-          world = vanillaSurvival;
-          dimension = "minecraft:the_end";
-          name = "Enden";
-          sorting = 200;
-          start-pos = {
-            x = 0;
-            z = 0;
-          };
-          sky-color = "#080010";
-          void-color = "#080010";
-          sky-light = 1;
-          ambient-light = 0.6;
-          remove-caves-below-y = -10000;
-          cave-detection-ocean-floor = -5;
-        };
-      };
-    };
-  };
-
-  systemd.services."render-bluemap-maps" = {
-    serviceConfig = {
-      StateDirectory = [ "bluemap/world" ];
-      ExecStartPre = let
-        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
-          archive = true;
-          compress = true;
-          verbose = true;
-          no-owner = true;
-          no-group = true;
-          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
-        };
-      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
-      ExecStartPost = let
-        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
-          archive = true;
-          compress = true;
-          verbose = true;
-          no-owner = true;
-          no-group = true;
-          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
-        };
-      in "${lib.getExe pkgs.rsync} ${rsyncArgs} --groupmap=root:nginx ${config.services.bluemap.webRoot}/ root@bekkalokk.pvv.ntnu.no:/";
-      LoadCredential = [
-        "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
-        "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
-      ];
-    };
-  };
-}

hosts/ildkule/configuration.nix

@@ -1,14 +1,8 @@
+{ config, fp, pkgs, lib, values, ... }:
 {
-  config,
-  fp,
-  pkgs,
-  lib,
-  values,
-  ...
-}: {
   imports = [
+      # Include the results of the hardware scan.
       ./hardware-configuration.nix
-    ./disks.nix
       (fp /base)
 
       ./services/monitoring
@@ -16,8 +10,8 @@
       ./services/journald-remote.nix
     ];
 
-  boot.loader.grub.enable = true;
+  boot.loader.systemd-boot.enable = false;
-  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.grub.device = "/dev/vda";
   boot.tmp.cleanOnBoot = true;
   zramSwap.enable = true;
 
@@ -33,22 +27,13 @@
     nameservers = values.defaultNetworkConfig.dns;
     defaultGateway.address = hostConf.ipv4_internal_gw;
 
-    interfaces."ens3" = {
+    interfaces."ens4" = {
       ipv4.addresses = [
-        {
+        { address = hostConf.ipv4;          prefixLength = 32; }
-          address = hostConf.ipv4;
+        { address = hostConf.ipv4_internal; prefixLength = 24; }
-          prefixLength = 32;
-        }
-        {
-          address = hostConf.ipv4_internal;
-          prefixLength = 24;
-        }
       ];
       ipv6.addresses = [
-        {
+        { address = hostConf.ipv6;          prefixLength = 64; }
-          address = hostConf.ipv6;
-          prefixLength = 64;
-        }
       ];
     };
   };

hosts/ildkule/disks.nix

@@ -1,27 +0,0 @@
-{
-  disko.devices = {
-    disk = {
-      sda = {
-        device = "/dev/sda";
-        type = "disk";
-        content = {
-          type = "gpt";
-          partitions = {
-            bios = {
-              size = "1M";
-              type = "EF02";
-            };
-            root = {
-              size = "100%";
-              content = {
-                type = "filesystem";
-                format = "ext4";
-                mountpoint = "/";
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}

hosts/ildkule/hardware-configuration.nix

@@ -1,24 +1,16 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
+{ modulesPath, lib, ... }:
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
-  imports =
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
-    ];
+  boot.initrd.kernelModules = [ "nvme" ];
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/e35eb4ce-aac3-4f91-8383-6e7cd8bbf942";
+    fsType = "ext4";
+  };
+  fileSystems."/data" = {
+    device = "/dev/disk/by-uuid/0a4c1234-02d3-4b53-aeca-d95c4c8d534b";
+    fsType = "ext4";
+  };
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
   networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.ens3.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

hosts/ildkule/services/monitoring/default.nix

@@ -5,7 +5,6 @@
     ./grafana.nix
     ./loki.nix
     ./prometheus
-    ./scrutiny.nix
     ./uptime-kuma.nix
   ];
 }

hosts/ildkule/services/monitoring/prometheus/default.nix

@@ -21,7 +21,6 @@ in {
 
   fileSystems."/var/lib/prometheus2" = {
     device = stateDir;
-    fsType = "bind";
     options = [ "bind" ];
   };
 }

hosts/ildkule/services/monitoring/prometheus/exim.nix

@@ -1,12 +1,14 @@
 { ... }:
 {
-  services.prometheus.scrapeConfigs = [{
+  services.prometheus = {
+    scrapeConfigs = [
+      {
         job_name = "exim";
         scrape_interval = "15s";
-    scheme = "http";
-
         static_configs = [{
           targets = [ "microbel.pvv.ntnu.no:9636" ];
         }];
-  }];
+      }
+    ];
+  };
 }

hosts/ildkule/services/monitoring/prometheus/machines.nix

@@ -6,63 +6,35 @@
     targets = map (port: "${name}.pvv.ntnu.no:${toString port}") ports;
   };
 
-  nixosMachines = [
-    "ildkule"
-    "bekkalokk"
-    "bicep"
-    "brzeczyszczykiewicz"
-    "georg"
-    "gluttony"
-    "kommode"
-    "lupine-1"
-    "lupine-2"
-    "lupine-3"
-    "lupine-4"
-    "lupine-5"
-    # TODO: export prometheus stats via apache on temmie
-    # "temmie"
-    "wenche"
-  ];
-
   defaultNodeExporterPort = 9100;
+  defaultSystemdExporterPort = 9101;
+  defaultNixosExporterPort = 9102;
 in {
-  services.prometheus.scrapeConfigs = [
+  services.prometheus.scrapeConfigs = [{
-    {
+    job_name = "base_info";
-      job_name = "nixos-node";
-      scheme = "https";
-      metrics_path = "/prometheus-node-exporter/metrics";
-      static_configs = map (name: {
-        labels.hostname = name;
-        targets = [ "${name}.pvv.ntnu.no:443" ];
-      }) nixosMachines;
-    }
-    {
-      job_name = "nixos-systemd";
-      scheme = "https";
-      metrics_path = "/prometheus-systemd-exporter/metrics";
-      static_configs = map (name: {
-        labels.hostname = name;
-        targets = [ "${name}.pvv.ntnu.no:443" ];
-      }) nixosMachines;
-    }
-    {
-      job_name = "nixos-flake-input";
-      scheme = "https";
-      metrics_path = "/prometheus-nixos-flake-input-exporter/metrics";
-      static_configs = map (name: {
-        labels.hostname = name;
-        targets = [ "${name}.pvv.ntnu.no:443" ];
-      }) nixosMachines;
-    }
-    {
-      job_name = "non-nixos-node";
-      scheme = "http";
-      metrics_path = "/metrics";
     static_configs = [
+      (mkHostScrapeConfig "ildkule" [ cfg.exporters.node.port cfg.exporters.systemd.port defaultNixosExporterPort ])
+
+      (mkHostScrapeConfig "bekkalokk" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "bicep" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "brzeczyszczykiewicz" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "georg" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "gluttony" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "kommode" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "lupine-1" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "lupine-2" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "lupine-3" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "lupine-4" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "lupine-5" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "temmie" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "ustetind" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+      (mkHostScrapeConfig "wenche" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+
+      (mkHostScrapeConfig "skrott" [ defaultNodeExporterPort defaultSystemdExporterPort ])
+
       (mkHostScrapeConfig "hildring" [ defaultNodeExporterPort ])
       (mkHostScrapeConfig "isvegg" [ defaultNodeExporterPort ])
       (mkHostScrapeConfig "microbel" [ defaultNodeExporterPort ])
     ];
-    }
+  }];
-  ];
 }

hosts/ildkule/services/monitoring/scrutiny.nix

@@ -1,40 +0,0 @@
-{ config, values, ... }:
-let
-  cfg = config.services.scrutiny;
-in
-{
-  services.scrutiny = {
-    enable = true;
-    settings = {
-      web.listen = {
-        host = "127.0.0.1";
-        port = 18293;
-        basepath = "";
-      };
-
-      # notify.urls = [
-      #   "matrix://username:password@host:port/[?rooms=!roomID1[,roomAlias2]]"
-      # ];
-    };
-  };
-
-  services.nginx.virtualHosts."scrutiny.pvv.ntnu.no" = {
-    kTLS = true;
-    enableACME = true;
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://${cfg.settings.web.listen.host}:${toString cfg.settings.web.listen.port}";
-    };
-
-    # TODO: allow website access to the outside world, but restrict input api
-    extraConfig = ''
-      allow ${values.hosts.ildkule.ipv4}/32;
-      allow ${values.hosts.ildkule.ipv6}/128;
-      allow 127.0.0.1/32;
-      allow ::1/128;
-      allow ${values.ipv4-space};
-      allow ${values.ipv6-space};
-      deny all;
-    '';
-  };
-}

hosts/ildkule/services/monitoring/uptime-kuma.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, values, ... }:
+{ config, pkgs, lib, ... }:
 let
   cfg = config.services.uptime-kuma;
   domain = "status.pvv.ntnu.no";
@@ -19,26 +19,8 @@ in {
     locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
   };
 
-  fileSystems."/var/lib/private/uptime-kuma" = {
+  fileSystems."/var/lib/uptime-kuma" = {
     device = stateDir;
-    fsType = "bind";
     options = [ "bind" ];
   };
-
-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${stateDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXzcDm6cVr4NmWzUSroy33FlielKqaG83wY0RCMC0p/ uptime_kuma rsync backup";
-    };
-  };
 }

hosts/kommode/configuration.nix

@@ -15,6 +15,8 @@
     address = with values.hosts.kommode; [ (ipv4 + "/25") (ipv6 + "/64") ];
   };
 
+  services.btrfs.autoScrub.enable = true;
+
   services.qemuGuest.enable = true;
 
   # Don't change (even during upgrades) unless you know what you are doing.

hosts/kommode/services/gitea/customization/default.nix

@@ -72,9 +72,9 @@ in
       Type = "oneshot";
       User = cfg.user;
       Group = cfg.group;
-      PrivateNetwork = true;
+    };
 
-      ExecStart = let
+    script = let
       logo-svg = fp /assets/logo_blue_regular.svg;
       logo-png = fp /assets/logo_blue_regular.png;
 
@@ -99,25 +99,23 @@ in
         ];
       } ''
         # Bigger icons
-          install -Dm444 '${cfg.package.src}/templates/repo/icon.tmpl' "$out/repo/icon.tmpl"
+        install -Dm444 "${cfg.package.src}/templates/repo/icon.tmpl" "$out/repo/icon.tmpl"
         sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
       '';
-        install = lib.getExe' pkgs.coreutils "install";
+    in ''
-      in [
+      install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
-        "${install} -Dm444 '${logo-svg}' '${cfg.customDir}/public/assets/img/logo.svg'"
+      install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
-        "${install} -Dm444 '${logo-png}' '${cfg.customDir}/public/assets/img/logo.png'"
+      install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
-        "${install} -Dm444 '${./loading.apng}' '${cfg.customDir}/public/assets/img/loading.png'"
+      install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
-        "${install} -Dm444 '${extraLinks}' '${cfg.customDir}/templates/custom/extra_links.tmpl'"
+      install -Dm444 ${extraLinksFooter} ${cfg.customDir}/templates/custom/extra_links_footer.tmpl
-        "${install} -Dm444 '${extraLinksFooter}' '${cfg.customDir}/templates/custom/extra_links_footer.tmpl'"
+      install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml
-        "${install} -Dm444 '${project-labels}' '${cfg.customDir}/options/label/project-labels.yaml'"
 
-        "${install} -Dm644 '${./emotes/bruh.png}' '${cfg.customDir}/public/assets/img/emoji/bruh.png'"
+      install -Dm644 ${./emotes/bruh.png} ${cfg.customDir}/public/assets/img/emoji/bruh.png
-        "${install} -Dm644 '${./emotes/huh.gif}' '${cfg.customDir}/public/assets/img/emoji/huh.png'"
+      install -Dm644 ${./emotes/huh.gif} ${cfg.customDir}/public/assets/img/emoji/huh.png
-        "${install} -Dm644 '${./emotes/grr.png}' '${cfg.customDir}/public/assets/img/emoji/grr.png'"
+      install -Dm644 ${./emotes/grr.png} ${cfg.customDir}/public/assets/img/emoji/grr.png
-        "${install} -Dm644 '${./emotes/okiedokie.jpg}' '${cfg.customDir}/public/assets/img/emoji/okiedokie.png'"
+      install -Dm644 ${./emotes/okiedokie.jpg} ${cfg.customDir}/public/assets/img/emoji/okiedokie.png
 
-        "${lib.getExe pkgs.rsync} -a '${customTemplates}/' '${cfg.customDir}/templates/'"
+      "${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
-      ];
+    '';
-    };
   };
 }

hosts/kommode/services/gitea/default.nix

@@ -131,17 +131,16 @@ in {
           "repo.pulls"
           "repo.releases"
         ];
-        ALLOW_FORK_INTO_SAME_OWNER = true;
       };
       picture = {
+        DISABLE_GRAVATAR = true;
+        ENABLE_FEDERATED_AVATAR = false;
+
         AVATAR_MAX_FILE_SIZE = 1024 * 1024 * 5;
         # NOTE: go any bigger than this, and gitea will freeze your gif >:(
         AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 2;
       };
       actions.ENABLED = true;
-      webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," [
-        "external"
-      ];
     };
 
     dump = {
@@ -217,7 +216,7 @@ in {
 
   systemd.services.gitea-dump = {
     serviceConfig.ExecStart = let
-      args = lib.cli.toCommandLineShellGNU { } {
+      args = lib.cli.toGNUCommandLineShell { } {
         type = cfg.dump.type;
 
         # This should be declarative on nixos, no need to backup.
@@ -229,11 +228,16 @@ in {
         # Logs are stored in the systemd journal
         skip-log = true;
       };
-    in lib.mkForce "${lib.getExe cfg.package} dump ${args}";
+    in lib.mkForce "${lib.getExe cfg.package} ${args}";
 
-    # Only keep a single backup file at a time.
+    # Only keep n backup files at a time
-    postStop = ''
+    postStop = let
-      ${lib.getExe' pkgs.coreutils "mv"} '${cfg.dump.backupDir}'/gitea-dump-*.tar.gz gitea-dump.tar.gz
+      cu = prog: "'${lib.getExe' pkgs.coreutils prog}'";
+      backupCount = 3;
+    in ''
+      for file in $(${cu "ls"} -t1 '${cfg.dump.backupDir}' | ${cu "sort"} --reverse | ${cu "tail"} -n+${toString (backupCount + 1)}); do
+        ${cu "rm"} "$file"
+      done
       '';
   };
 }

hosts/kommode/services/gitea/gpg.nix

@@ -38,11 +38,11 @@ in
       Type = "oneshot";
       User = cfg.user;
       PrivateNetwork = true;
-      ExecStart = [
-        "${lib.getExe pkgs.gnupg} --import '${config.sops.secrets."gitea/gpg-signing-key-public".path}'"
-        "${lib.getExe pkgs.gnupg} --import '${config.sops.secrets."gitea/gpg-signing-key-private".path}'"
-      ];
     };
+    script = ''
+      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-public".path}
+      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-private".path}
+    '';
   };
 
   services.gitea.settings."repository.signing" = {
@@ -50,8 +50,6 @@ in
     SIGNING_NAME = "PVV Git";
     SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
     INITIAL_COMMIT = "always";
-    MERGES = lib.concatStringsSep "," [ "always" ];
-    CRUD_ACTIONS = lib.concatStringsSep "," [ "always" ];
     WIKI = "always";
   };
 }

hosts/kommode/services/gitea/import-users/default.nix

@@ -11,9 +11,9 @@ in
 
   systemd.services.gitea-import-users = lib.mkIf cfg.enable {
     enable = true;
+    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
     environment.PASSWD_FILE_PATH = "/run/gitea-import-users/passwd";
     serviceConfig = {
-      ExecStartPre = ''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
       ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
         flakeIgnore = [
           "E501" # Line over 80 chars lol

hosts/kommode/services/gitea/web-secret-provider/default.nix

@@ -53,7 +53,7 @@ in
       Slice = "system-giteaweb.slice";
       Type = "oneshot";
       ExecStart = let
-        args = lib.cli.toCommandLineShellGNU { } {
+        args = lib.cli.toGNUCommandLineShell { } {
           org = "%i";
           token-path = "%d/token";
           api-url = "${giteaCfg.settings.server.ROOT_URL}api/v1";

hosts/lupine/configuration.nix

@@ -1,20 +1,15 @@
-{ fp, values, lib, lupineName, ... }:
+{ fp, values, lupineName, ... }:
 {
   imports = [
     ./hardware-configuration/${lupineName}.nix
 
     (fp /base)
+
     ./services/gitea-runner.nix
   ];
 
   sops.defaultSopsFile = fp /secrets/lupine/lupine.yaml;
 
-  boot.binfmt.emulatedSystems = [
-    "aarch64-linux"
-    "armv7l-linux"
-    "i686-linux"
-  ];
-
   systemd.network.networks."30-enp0s31f6" = values.defaultNetworkConfig // {
     matchConfig.Name = "enp0s31f6";
     address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
@@ -24,6 +19,9 @@
     anyInterface = true;
   };
 
+  # There are no smart devices
+  services.smartd.enable = false;
+
   # Don't change (even during upgrades) unless you know what you are doing.
   # See https://search.nixos.org/options?show=system.stateVersion
   system.stateVersion = "25.05";

hosts/lupine/hardware-configuration/lupine-1.nix

@@ -14,28 +14,27 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/e88adbb7-de01-4f9b-b338-fffed743c259";
+    { device = "/dev/disk/by-uuid/a949e2e8-d973-4925-83e4-bcd815e65af7";
-      fsType = "btrfs";
+      fsType = "ext4";
-      options = [ "subvol=@root" "compress=zstd" ];
-    };
-
-  fileSystems."/nix" =
-    { device = "/dev/disk/by-uuid/e88adbb7-de01-4f9b-b338-fffed743c259";
-      fsType = "btrfs";
-      options = [ "subvol=@nix" "compress=zstd" "noatime" ];
     };
 
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/81D6-38D3";
       fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
+      options = [ "fmask=0077" "dmask=0077" ];
     };
 
   swapDevices =
     [ { device = "/dev/disk/by-uuid/82c2d7fa-7cd0-4398-8cf6-c892bc56264b"; }
     ];
 
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
+
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
-

hosts/lupine/hardware-configuration/lupine-2.nix

@@ -14,27 +14,27 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/ab2e1a13-8e95-48d8-970c-64fa2fab52d0";
+    { device = "/dev/disk/by-uuid/aa81d439-800b-403d-ac10-9d2aac3619d0";
-      fsType = "btrfs";
+      fsType = "ext4";
-      options = [ "subvol=@root" "compress=zstd" ];
-    };
-
-  fileSystems."/nix" =
-    { device = "/dev/disk/by-uuid/ab2e1a13-8e95-48d8-970c-64fa2fab52d0";
-      fsType = "btrfs";
-      options = [ "subvol=@nix" "noatime" "compress=zstd" ];
     };
 
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/4A34-6AE5";
       fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
+      options = [ "fmask=0077" "dmask=0077" ];
     };
 
   swapDevices =
     [ { device = "/dev/disk/by-uuid/efb7cd0c-c1ae-4a86-8bc2-8e7fd0066650"; }
     ];
 
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
+
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/lupine/hardware-configuration/lupine-3.nix

@@ -14,28 +14,27 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/0a5bda7c-af55-4d3d-9135-7f7cbb78004d";
+    { device = "/dev/disk/by-uuid/39ba059b-3205-4701-a832-e72c0122cb88";
-      fsType = "btrfs";
+      fsType = "ext4";
-      options = [ "subvol=@root" "compress=zstd" ];
-    };
-
-  fileSystems."/nix" =
-    { device = "/dev/disk/by-uuid/0a5bda7c-af55-4d3d-9135-7f7cbb78004d";
-      fsType = "btrfs";
-      options = [ "subvol=@nix" "noatime" "compress=zstd" ];
     };
 
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/63FA-297B";
       fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
+      options = [ "fmask=0077" "dmask=0077" ];
     };
 
   swapDevices =
     [ { device = "/dev/disk/by-uuid/9c72eb54-ea8c-4b09-808a-8be9b9a33869"; }
     ];
 
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
+
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
-

hosts/lupine/hardware-configuration/lupine-4.nix

@@ -14,27 +14,21 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/fcd51970-f040-4c45-94cf-2b372d4599a2";
+    { device = "/dev/disk/by-uuid/c7bbb293-a0a3-4995-8892-0ec63e8c67dd";
-      fsType = "btrfs";
+      fsType = "ext4";
-      options = [ "subvol=@root" "compress=zstd" ];
-    };
-
-  fileSystems."/nix" =
-    { device = "/dev/disk/by-uuid/fcd51970-f040-4c45-94cf-2b372d4599a2";
-      fsType = "btrfs";
-      options = [ "subvol=@nix" "noatime" "compress=zstd" ];
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/A22E-E41A";
-      fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
     };
 
   swapDevices =
     [ { device = "/dev/disk/by-uuid/a86ffda8-8ecb-42a1-bf9f-926072e90ca5"; }
     ];
 
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
+
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/lupine/hardware-configuration/lupine-5.nix

@@ -14,27 +14,27 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/85830e14-e2c8-4f04-95fa-d6ab22840bc7";
+    { device = "/dev/disk/by-uuid/5f8418ad-8ec1-4f9e-939e-f3a4c36ef343";
-      fsType = "btrfs";
+      fsType = "ext4";
-      options = [ "subvol=@root" "compress=zstd" ];
-    };
-
-  fileSystems."/nix" =
-    { device = "/dev/disk/by-uuid/85830e14-e2c8-4f04-95fa-d6ab22840bc7";
-      fsType = "btrfs";
-      options = [ "subvol=@nix" "noatime" "compress=zstd" ];
     };
 
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/F372-37DF";
       fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
+      options = [ "fmask=0077" "dmask=0077" ];
     };
 
   swapDevices =
     [ { device = "/dev/disk/by-uuid/27bf292d-bbb3-48c4-a86e-456e0f1f648f"; }
     ];
 
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
+
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/lupine/services/gitea-runner.nix

@@ -39,22 +39,17 @@
         "debian-bullseye-slim:docker://node:current-bullseye-slim"
 
         "alpine-latest:docker://node:current-alpine"
-        "alpine-3.23:docker://node:current-alpine3.23"
         "alpine-3.22:docker://node:current-alpine3.22"
         "alpine-3.21:docker://node:current-alpine3.21"
 
         # See https://gitea.com/gitea/runner-images
         "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
-        "ubuntu-26.04:docker://docker.gitea.com/runner-images:ubuntu-26.04"
-        "ubuntu-resolute:docker://docker.gitea.com/runner-images:ubuntu-26.04"
         "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
         "ubuntu-noble:docker://docker.gitea.com/runner-images:ubuntu-24.04"
         "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
         "ubuntu-jammy:docker://docker.gitea.com/runner-images:ubuntu-22.04"
 
         "ubuntu-latest-slim:docker://docker.gitea.com/runner-images:ubuntu-latest-slim"
-        "ubuntu-26.04-slim:docker://docker.gitea.com/runner-images:ubuntu-26.04-slim"
-        "ubuntu-resolute-slim:docker://docker.gitea.com/runner-images:ubuntu-26.04-slim"
         "ubuntu-24.04-slim:docker://docker.gitea.com/runner-images:ubuntu-24.04-slim"
         "ubuntu-noble-slim:docker://docker.gitea.com/runner-images:ubuntu-24.04-slim"
         "ubuntu-22.04-slim:docker://docker.gitea.com/runner-images:ubuntu-22.04-slim"

hosts/skrot/configuration.nix

@@ -28,26 +28,17 @@
 
   sops.secrets = {
     "dibbler/postgresql/password" = {
-      owner = "drumknotty";
+      owner = "dibbler";
-      group = "drumknotty";
+      group = "dibbler";
-    };
-    "worblehat/postgresql/password" = {
-      owner = "drumknotty";
-      group = "drumknotty";
     };
   };
 
-  services.drumknotty = {
+  services.dibbler = {
     enable = true;
     kioskMode = true;
+    limitScreenWidth = 80;
+    limitScreenHeight = 42;
 
-    screen = {
-      limitWidth = 80;
-      limitHeight = 42;
-    };
-
-    dibbler = {
-      enable = true;
     settings = {
       general.quit_allowed = false;
       database = {
@@ -62,23 +53,6 @@
     };
   };
 
-    worblehat = {
-      enable = true;
-      settings = {
-        general.quit_allowed = false;
-        database = {
-          type = "postgresql";
-          postgresql = {
-            username = "worblehat";
-            dbname = "worblehat";
-            host = "postgres.pvv.ntnu.no";
-            password = config.sops.secrets."worblehat/postgresql/password".path;
-          };
-        };
-      };
-    };
-  };
-
   systemd.services."serial-getty@ttyUSB0" = lib.mkIf (!config.virtualisation.isVmVariant) {
     enable = true;
     wantedBy = [ "getty.target" ]; # to start at boot

hosts/skrott/configuration.nix

@@ -0,0 +1,112 @@
+{ config, pkgs, lib, modulesPath, fp, values, ... }: {
+  imports = [
+    (modulesPath + "/profiles/perlless.nix")
+
+    (fp /base)
+  ];
+
+  # Disable import of a bunch of tools we don't need from nixpkgs.
+  disabledModules = [ "profiles/base.nix" ];
+
+  sops.defaultSopsFile = fp /secrets/skrott/skrott.yaml;
+
+  boot = {
+    consoleLogLevel = 0;
+    enableContainers = false;
+    loader.grub.enable = false;
+    loader.systemd-boot.enable = false;
+    kernelPackages = pkgs.linuxPackages;
+  };
+
+  hardware = {
+    enableAllHardware = lib.mkForce false;
+    firmware = [ pkgs.raspberrypiWirelessFirmware ];
+  };
+
+  # Now turn off a bunch of stuff lol
+  # TODO: can we reduce further?
+  # See also https://nixcademy.com/posts/minimizing-nixos-images/
+  system.autoUpgrade.enable = lib.mkForce false;
+  services.irqbalance.enable = lib.mkForce false;
+  services.logrotate.enable = lib.mkForce false;
+  services.nginx.enable = lib.mkForce false;
+  services.postfix.enable = lib.mkForce false;
+  services.smartd.enable = lib.mkForce false;
+  services.udisks2.enable = lib.mkForce false;
+  services.thermald.enable = lib.mkForce false;
+  services.promtail.enable = lib.mkForce false;
+  # There aren't really that many firmware updates for rbpi3 anyway
+  services.fwupd.enable = lib.mkForce false;
+
+  documentation.enable = lib.mkForce false;
+
+  environment.enableAllTerminfo = lib.mkForce false;
+
+  programs.neovim.enable = lib.mkForce false;
+  programs.zsh.enable = lib.mkForce false;
+  programs.git.package = pkgs.gitMinimal;
+
+  nix.registry = lib.mkForce { };
+  nix.nixPath = lib.mkForce [ ];
+
+  sops.secrets = {
+    "dibbler/postgresql/password" = {
+      owner = "dibbler";
+      group = "dibbler";
+    };
+  };
+
+  # zramSwap.enable = true;
+
+  networking = {
+    hostName = "skrott";
+    defaultGateway = values.hosts.gateway;
+    defaultGateway6 = values.hosts.gateway6;
+    interfaces.eth0 = {
+      useDHCP = false;
+      ipv4.addresses = [{
+        address = values.hosts.skrott.ipv4;
+        prefixLength = 25;
+      }];
+      ipv6.addresses = [{
+        address = values.hosts.skrott.ipv6;
+        prefixLength = 25;
+      }];
+    };
+  };
+
+  services.dibbler = {
+    enable = true;
+    kioskMode = true;
+    limitScreenWidth = 80;
+    limitScreenHeight = 42;
+
+    settings = {
+      general.quit_allowed = false;
+      database = {
+        type = "postgresql";
+        postgresql = {
+          username = "pvv_vv";
+          dbname = "pvv_vv";
+          host = "postgres.pvv.ntnu.no";
+          password_file = config.sops.secrets."dibbler/postgresql/password".path;
+        };
+      };
+    };
+  };
+
+  # https://github.com/NixOS/nixpkgs/issues/84105
+  boot.kernelParams = lib.mkIf (!config.virtualisation.isVmVariant) [
+    "console=ttyUSB0,9600"
+    # "console=tty1" # Already part of the module
+  ];
+  systemd.services."serial-getty@ttyUSB0" = lib.mkIf (!config.virtualisation.isVmVariant) {
+    enable = true;
+    wantedBy = [ "getty.target" ]; # to start at boot
+    serviceConfig.Restart = "always"; # restart when session is closed
+  };
+
+  # Don't change (even during upgrades) unless you know what you are doing.
+  # See https://search.nixos.org/options?show=system.stateVersion
+  system.stateVersion = "25.11";
+}

hosts/temmie/configuration.nix

@@ -6,7 +6,7 @@
     (fp /base)
 
     ./services/nfs-mounts.nix
-    ./services/userweb
+    ./services/userweb.nix
   ];
 
   systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {

hosts/temmie/services/userweb.nix

@@ -0,0 +1,344 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.httpd;
+
+  homeLetters = [ "a" "b" "c" "d" "h" "i" "j" "k" "l" "m" "z" ];
+
+  # https://nixos.org/manual/nixpkgs/stable/#ssec-php-user-guide-installing-with-extensions
+  phpEnv = pkgs.php.buildEnv {
+    extensions = { all, ... }: with all; [
+      imagick
+      opcache
+      protobuf
+    ];
+
+    extraConfig = ''
+      display_errors=0
+      post_max_size = 40M
+      upload_max_filesize = 40M
+    '';
+  };
+
+  perlEnv = pkgs.perl.withPackages (ps: with ps; [
+    pkgs.exiftool
+    pkgs.ikiwiki
+    pkgs.irssi
+    pkgs.nix.libs.nix-perl-bindings
+
+    AlgorithmDiff
+    AnyEvent
+    AnyEventI3
+    ArchiveZip
+    CGI
+    CPAN
+    CPANPLUS
+    DBDPg
+    DBDSQLite
+    DBI
+    EmailAddress
+    EmailSimple
+    Env
+    Git
+    HTMLMason
+    HTMLParser
+    HTMLTagset
+    HTTPDAV
+    HTTPDaemon
+    ImageMagick
+    JSON
+    LWP
+    MozillaCA
+    PathTiny
+    Switch
+    SysSyslog
+    TestPostgreSQL
+    TextPDF
+    TieFile
+    Tk
+    URI
+    XMLLibXML
+  ]);
+
+  # https://nixos.org/manual/nixpkgs/stable/#python.buildenv-function
+  pythonEnv = pkgs.python3.buildEnv.override {
+    extraLibs = with pkgs.python3Packages; [
+      legacy-cgi
+
+      matplotlib
+      requests
+    ];
+    ignoreCollisions = true;
+  };
+
+  # https://nixos.org/manual/nixpkgs/stable/#sec-building-environment
+  fhsEnv = pkgs.buildEnv {
+    name = "userweb-env";
+    paths = with pkgs; [
+      bash
+
+      perlEnv
+      pythonEnv
+
+      phpEnv
+    ]
+    ++ (with phpEnv.packages; [
+      # composer
+    ])
+    ++ [
+      acl
+      aspell
+      autoconf
+      autotrash
+      bazel
+      bintools
+      bison
+      bsd-finger
+      catdoc
+      ccache
+      clang
+      cmake
+      coreutils-full
+      curl
+      devcontainer
+      diffutils
+      emacs
+      # exiftags
+      exiftool
+      ffmpeg
+      file
+      findutils
+      gawk
+      gcc
+      glibc
+      gnugrep
+      gnumake
+      gnupg
+      gnuplot
+      gnused
+      gnutar
+      gzip
+      html-tidy
+      imagemagick
+      inetutils
+      iproute2
+      jhead
+      less
+      libgcc
+      lndir
+      mailutils
+      man # TODO: does this one want a mandb instance?
+      meson
+      more
+      mpc
+      mpi
+      mplayer
+      ninja
+      nix
+      openssh
+      openssl
+      patchelf
+      pkg-config
+      ppp
+      procmail
+      procps
+      qemu
+      rc
+      rhash
+      rsync
+      ruby # TODO: does this one want systemwide packages?
+      salt
+      sccache
+      sourceHighlight
+      spamassassin
+      strace
+      subversion
+      system-sendmail
+      systemdMinimal
+      texliveMedium
+      tmux
+      unzip
+      util-linux
+      valgrind
+      vim
+      wget
+      which
+      wine
+      xdg-utils
+      zip
+      zstd
+    ];
+
+    extraOutputsToInstall = [
+      "man"
+      "doc"
+    ];
+  };
+in
+{
+  services.httpd = {
+    enable = true;
+    adminAddr = "drift@pvv.ntnu.no";
+
+    # TODO: consider upstreaming systemd support
+    # TODO: mod_log_journald in v2.5
+    package = pkgs.apacheHttpd.overrideAttrs (prev: {
+      nativeBuildInputs = prev.nativeBuildInputs ++ [ pkgs.pkg-config ];
+      buildInputs = prev.buildInputs ++ [ pkgs.systemdLibs ];
+      configureFlags = prev.configureFlags ++ [ "--enable-systemd" ];
+    });
+
+    enablePHP = true;
+    phpPackage = phpEnv;
+
+    enablePerl = true;
+
+    # TODO: mod_log_journald in v2.5
+    extraModules = [
+      "systemd"
+      "userdir"
+      # TODO: I think the compilation steps of pkgs.apacheHttpdPackages.mod_perl might have some
+      #       incorrect or restrictive assumptions upstream, either nixpkgs or source
+      # {
+      #   name = "perl";
+      #   path = let
+      #     mod_perl = pkgs.apacheHttpdPackages.mod_perl.override {
+      #       apacheHttpd = cfg.package.out;
+      #       perl = perlEnv;
+      #     };
+      #   in "${mod_perl}/modules/mod_perl.so";
+      # }
+    ];
+
+    extraConfig = ''
+      TraceEnable on
+      LogLevel warn rewrite:trace3
+      ScriptLog ${cfg.logDir}/cgi.log
+    '';
+
+    # virtualHosts."userweb.pvv.ntnu.no" = {
+    virtualHosts."temmie.pvv.ntnu.no" = {
+      forceSSL = true;
+      enableACME = true;
+
+      extraConfig = ''
+        UserDir ${lib.concatMapStringsSep " " (l: "/home/pvv/${l}/*/web-docs") homeLetters}
+        UserDir disabled root
+        AddHandler cgi-script .cgi
+        DirectoryIndex index.html index.html.var index.php index.php3 index.cgi index.phtml index.shtml meg.html
+
+        <Directory "/home/pvv/?/*/web-docs">
+          Options MultiViews Indexes SymLinksIfOwnerMatch ExecCGI IncludesNoExec
+          AllowOverride All
+          Require all granted
+        </Directory>
+      '';
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+
+  # socket activation comes in v2.5
+  # systemd.sockets.httpd = {
+  #   wantedBy = [ "sockets.target" ];
+  #   description = "HTTPD socket";
+  #   listenStreams = [
+  #     "0.0.0.0:80"
+  #     "0.0.0.0:443"
+  #   ];
+  # };
+
+  systemd.services.httpd = {
+    after = [ "pvv-homedirs.target" ];
+    requires = [ "pvv-homedirs.target" ];
+
+    environment = {
+      PATH = lib.mkForce "/usr/bin";
+    };
+
+    serviceConfig = {
+      Type = lib.mkForce "notify";
+
+      ExecStart = lib.mkForce "${cfg.package}/bin/httpd -D FOREGROUND -f /etc/httpd/httpd.conf -k start";
+      ExecReload = lib.mkForce "${cfg.package}/bin/httpd -f /etc/httpd/httpd.conf -k graceful";
+      ExecStop = lib.mkForce "";
+      KillMode = "mixed";
+
+      ConfigurationDirectory = [ "httpd" ];
+      LogsDirectory = [ "httpd" ];
+      LogsDirectoryMode = "0700";
+
+      CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+      LockPersonality = true;
+      PrivateDevices = true;
+      PrivateTmp = true;
+      # NOTE: this removes CAP_NET_BIND_SERVICE...
+      # PrivateUsers = true;
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = "tmpfs";
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectSystem = true;
+      RemoveIPC = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+        "AF_NETLINK"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SocketBindDeny = "any";
+      SocketBindAllow = [
+        "tcp:80"
+        "tcp:443"
+      ];
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+         "@system-service"
+      ];
+      UMask = "0077";
+
+      RuntimeDirectory = [ "httpd/root-mnt" ];
+      RootDirectory = "/run/httpd/root-mnt";
+      MountAPIVFS = true;
+      BindReadOnlyPaths = [
+        builtins.storeDir
+        "/etc"
+        # NCSD socket
+        "/var/run"
+        "/var/lib/acme"
+
+        "${fhsEnv}/bin:/bin"
+        "${fhsEnv}/sbin:/sbin"
+        "${fhsEnv}/lib:/lib"
+        "${fhsEnv}/share:/share"
+      ] ++ (lib.mapCartesianProduct ({ parent, child }: "${fhsEnv}${child}:${parent}${child}") {
+        parent = [
+          "/local"
+          "/opt"
+          "/opt/local"
+          "/store"
+          "/store/gnu"
+          "/usr"
+          "/usr/local"
+        ];
+        child = [
+          "/bin"
+          "/sbin"
+          "/lib"
+          "/libexec"
+          "/include"
+          "/share"
+        ];
+      });
+      BindPaths = map (l: "/run/pvv-home-mounts/${l}:/home/pvv/${l}") homeLetters;
+    };
+  };
+
+  # TODO: create phpfpm pools with php environments that contain packages similar to those present on tom
+}

hosts/temmie/services/userweb/apache-log-processor/.gitignore

@@ -1 +0,0 @@
-target

hosts/temmie/services/userweb/apache-log-processor/Cargo.lock

@@ -1,171 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "apache-log-processor"
-version = "0.1.0"
-dependencies = [
- "nix",
- "time",
-]
-
-[[package]]
-name = "bitflags"
-version = "2.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
-
-[[package]]
-name = "cfg_aliases"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
-
-[[package]]
-name = "deranged"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
-dependencies = [
- "powerfmt",
-]
-
-[[package]]
-name = "itoa"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
-
-[[package]]
-name = "libc"
-version = "0.2.186"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
-
-[[package]]
-name = "nix"
-version = "0.31.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
-dependencies = [
- "bitflags",
- "cfg-if",
- "cfg_aliases",
- "libc",
-]
-
-[[package]]
-name = "num-conv"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
-
-[[package]]
-name = "num_threads"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "powerfmt"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.106"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "serde_core"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.117"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "time"
-version = "0.3.47"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
-dependencies = [
- "deranged",
- "itoa",
- "libc",
- "num-conv",
- "num_threads",
- "powerfmt",
- "serde_core",
- "time-core",
- "time-macros",
-]
-
-[[package]]
-name = "time-core"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
-
-[[package]]
-name = "time-macros"
-version = "0.2.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
-dependencies = [
- "num-conv",
- "time-core",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"

hosts/temmie/services/userweb/apache-log-processor/Cargo.toml

@@ -1,19 +0,0 @@
-[package]
-name = "apache-log-processor"
-version = "0.1.0"
-edition = "2024"
-autobins = false
-license = "MIT"
-authors = [
-  "projects@pvv.ntnu.no",
-]
-
-[dependencies]
-nix = { version = "0.31.3", features = ["event", "fs", "user"] }
-time = { version = "0.3.47", features = ["formatting", "local-offset"] }
-
-
-[[bin]]
-name = "apache-log-processor"
-bench = false
-path = "src/main.rs"

hosts/temmie/services/userweb/apache-log-processor/default.nix

@@ -1,33 +0,0 @@
-{
-  lib
-, rustPlatform
-, stdenv
-}:
-let
-  cargoToml = fromTOML (builtins.readFile ./Cargo.toml);
-  cargoLock = ./Cargo.lock;
-  mainProgram = (lib.head cargoToml.bin).name;
-  pname = cargoToml.package.name;
-in
-rustPlatform.buildRustPackage {
-  inherit pname;
-  inherit (cargoToml.package) version;
-  src = lib.fileset.toSource {
-    root = ./.;
-    fileset = lib.fileset.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
-
-  cargoLock.lockFile = cargoLock;
-
-  doCheck = true;
-
-  meta = with lib; {
-    license = licenses.mit;
-    platforms = platforms.linux;
-    inherit mainProgram;
-  };
-}

hosts/temmie/services/userweb/apache-log-processor/src/main.rs

@@ -1,321 +0,0 @@
-use nix::{
-    errno::Errno,
-    fcntl::{FcntlArg, OFlag, fcntl, open},
-    sys::{
-        epoll::{Epoll, EpollCreateFlags, EpollEvent, EpollFlags, EpollTimeout},
-        stat::Mode,
-    },
-    unistd::{User, getegid, geteuid, read, setegid, seteuid, write},
-};
-use std::{
-    collections::VecDeque,
-    os::fd::{AsFd, BorrowedFd, OwnedFd},
-    path::PathBuf,
-    process::exit,
-};
-use time::{OffsetDateTime, format_description};
-
-const READ_BUFFER_SIZE: usize = 8 * 1024;
-
-#[derive(Debug, Clone, Copy)]
-enum LogMode {
-    Access,
-    Error,
-}
-
-fn main() -> Result<(), String> {
-    let log_mode = match std::env::args().nth(1).as_deref() {
-        Some("access") => LogMode::Access,
-        Some("error") => LogMode::Error,
-        Some(other) => {
-            return Err(format!(
-                "invalid log mode `{other}`; expected `access` or `error`"
-            ));
-        }
-        None => return Err("missing log mode argument; expected `access` or `error`".to_string()),
-    };
-
-    let tee_file = match log_mode {
-        LogMode::Access => None,
-        LogMode::Error => Some(
-            open(
-                &PathBuf::from("/var/log/httpd/error.log"),
-                OFlag::O_WRONLY | OFlag::O_APPEND | OFlag::O_CREAT | OFlag::O_CLOEXEC,
-                Mode::S_IRUSR | Mode::S_IWUSR,
-            )
-            .map_err(|error| format!("failed to open error log for teeing: {error}"))?,
-        ),
-    };
-
-    let stdin = std::io::stdin();
-
-    fcntl(stdin.as_fd(), FcntlArg::F_GETFL)
-        .map(OFlag::from_bits_retain)
-        .map(|flags| FcntlArg::F_SETFL(flags | OFlag::O_NONBLOCK))
-        .and_then(|flags| fcntl(stdin.as_fd(), flags))
-        .map_err(|error| format!("failed to make stdin nonblocking: {error}"))?;
-
-    let epoll = Epoll::new(EpollCreateFlags::EPOLL_CLOEXEC)
-        .map_err(|error| format!("failed to create epoll instance: {error}"))?;
-
-    epoll
-        .add(
-            stdin.as_fd(),
-            EpollEvent::new(
-                EpollFlags::EPOLLIN | EpollFlags::EPOLLERR | EpollFlags::EPOLLHUP,
-                0,
-            ),
-        )
-        .map_err(|error| format!("failed to register stdin with epoll: {error}"))?;
-
-    if let Err(error) = event_loop(log_mode, epoll, stdin.as_fd(), tee_file) {
-        eprintln!("Error: {error}");
-        exit(1);
-    }
-
-    Ok(())
-}
-
-fn event_loop(
-    log_mode: LogMode,
-    epoll: Epoll,
-    stdin_fd: BorrowedFd<'_>,
-    mut tee_file: Option<OwnedFd>,
-) -> Result<(), String> {
-    let mut events = [EpollEvent::empty(); 1];
-    let mut pending = VecDeque::new();
-
-    loop {
-        let ready = loop {
-            match epoll.wait(&mut events, EpollTimeout::NONE) {
-                Ok(ready) => break ready,
-                Err(Errno::EINTR) => continue,
-                Err(error) => {
-                    return Err(format!("epoll wait failed: {error}"));
-                }
-            }
-        };
-
-        if ready == 0 {
-            continue;
-        }
-
-        let mut scratch = [0u8; READ_BUFFER_SIZE];
-
-        let eof = loop {
-            match read(stdin_fd, &mut scratch) {
-                Ok(0) => break true,
-                Ok(read_bytes) => pending.extend(scratch[..read_bytes].iter().copied()),
-                Err(Errno::EINTR) => continue,
-                Err(Errno::EAGAIN) => break false,
-                Err(error) => {
-                    return Err(format!("failed to read from stdin: {error}"));
-                }
-            }
-        };
-
-        while let Some(newline_index) = pending.iter().position(|byte| *byte == b'\n') {
-            let line = pending.make_contiguous();
-            process_line(log_mode, &line[..=newline_index], &mut tee_file)?;
-            pending.drain(..=newline_index);
-        }
-
-        if eof {
-            if !pending.is_empty() {
-                process_line(log_mode, pending.make_contiguous(), &mut tee_file)?;
-                pending.clear();
-            }
-            return Ok(());
-        }
-    }
-}
-
-fn process_line(
-    log_mode: LogMode,
-    line: &[u8],
-    tee_file: &mut Option<OwnedFd>,
-) -> Result<(), String> {
-    if let Some(tee_file) = tee_file.as_ref() {
-        write_all_fd(tee_file, line).map_err(|error| {
-            format!("failed to append to APACHE_LOG_PROCESSOR_TEE_FILE: {error}")
-        })?;
-    }
-
-    if let Some(user) =
-        parse_username_from_line(line).and_then(|name| User::from_name(name).ok().flatten())
-    {
-        let identity = EffectiveIdentity::switch_to(&user).map_err(|error| {
-            format!(
-                "failed to switch effective identity to {} (uid {}, gid {}): {error}",
-                user.name, user.uid, user.gid
-            )
-        })?;
-
-        let result: Result<(), String> = (|| {
-            let dir = user.dir.join("nobackup/weblogs");
-
-            if !dir.is_dir() {
-                return Err(format!(
-                    "logs directory {} does not exist for user {}",
-                    dir.display(),
-                    user.name
-                ));
-            }
-
-            let now = OffsetDateTime::now_local()
-                .unwrap_or_else(|_| OffsetDateTime::now_utc())
-                .format(&format_description::parse("[year]-[month]-[day]").unwrap())
-                .map_err(|error| {
-                    format!("failed to format current date for log file name: {error}")
-                })?;
-
-            let logfile = dir.join(match log_mode {
-                LogMode::Access => format!("access-{now}.log"),
-                LogMode::Error => format!("error-{now}.log"),
-            });
-
-            let fd = open(
-                &logfile,
-                OFlag::O_WRONLY | OFlag::O_APPEND | OFlag::O_CREAT | OFlag::O_CLOEXEC,
-                Mode::S_IRUSR
-                    | Mode::S_IWUSR
-                    | Mode::S_IRGRP
-                    | Mode::S_IROTH
-                    | Mode::S_IWGRP
-                    | Mode::S_IWOTH,
-            )
-            .map_err(|error| format!("failed to open log file for user {}: {error}", user.name))?;
-
-            write_all_fd(fd.as_fd(), line).map_err(|error| {
-                format!(
-                    "failed to append to log file for user {}: {error}",
-                    user.name
-                )
-            })?;
-
-            Ok(())
-        })();
-
-        if let Err(error) = result {
-            eprintln!("Error processing log line for user {}: {error}", user.name);
-        }
-
-        identity.restore().map_err(|error| {
-            format!(
-                "failed to restore original effective identity after handling {}: {error}",
-                user.name
-            )
-        })?;
-    }
-
-    Ok(())
-}
-
-fn parse_username_from_line(line: &[u8]) -> Option<&str> {
-    line.splitn(8, |&b| b == b' ')
-        .nth(6)
-        .and_then(|path| {
-            path.strip_prefix(b"/~")
-                .and_then(|rest| rest.split(|&b| b == b'/').next())
-        })
-        .or_else(|| {
-            line.windows(b"/home/pvv/".len())
-                .enumerate()
-                .find_map(|(start, window)| {
-                    (window == b"/home/pvv/")
-                        .then_some(start + b"/home/pvv/".len())
-                        .and_then(|start| line.get(start..))
-                        .filter(|rest| rest.get(1) == Some(&b'/'))
-                        .and_then(|rest| rest.get(2..))
-                        .and_then(|rest| rest.split(|&b| b == b'/').next())
-                })
-        })
-        .filter(|segment| !segment.is_empty())
-        .and_then(|segment| std::str::from_utf8(segment).ok())
-}
-
-fn write_all_fd<Fd: AsFd>(fd: Fd, mut buffer: &[u8]) -> nix::Result<()> {
-    while !buffer.is_empty() {
-        match write(fd.as_fd(), buffer) {
-            Ok(0) => return Err(Errno::EIO),
-            Ok(written) => buffer = &buffer[written..],
-            Err(Errno::EINTR) => continue,
-            Err(error) => return Err(error),
-        }
-    }
-
-    Ok(())
-}
-
-struct EffectiveIdentity {
-    saved_euid: nix::unistd::Uid,
-    saved_egid: nix::unistd::Gid,
-    restored: bool,
-}
-
-impl EffectiveIdentity {
-    fn switch_to(user: &User) -> nix::Result<Self> {
-        let guard = Self {
-            saved_euid: geteuid(),
-            saved_egid: getegid(),
-            restored: false,
-        };
-
-        setegid(user.gid)?;
-        if let Err(error) = seteuid(user.uid) {
-            let _ = setegid(guard.saved_egid);
-            return Err(error);
-        }
-
-        Ok(guard)
-    }
-
-    fn restore(mut self) -> nix::Result<()> {
-        let restore_uid = seteuid(self.saved_euid);
-        let restore_gid = setegid(self.saved_egid);
-        self.restored = true;
-
-        restore_uid?;
-        restore_gid?;
-        Ok(())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_parse_user_from_access_log() {
-        let inputs = [(
-            "1.2.3.4 - - [25/May/2026:10:07:24 +0200] \"GET /~oysteikt/ HTTP/2.0\" 200 3708",
-            "oysteikt",
-        )];
-
-        for (line, expected_user) in inputs {
-            let parsed_user = parse_username_from_line(line.as_bytes());
-            assert_eq!(
-                parsed_user,
-                Some(expected_user),
-                "Failed to parse user from line: {line}"
-            );
-        }
-    }
-
-    #[test]
-    fn test_parse_user_from_error_log() {
-        let inputs = [(
-            "[Sat May 09 20:45:21.480016 2026] [authz_core:error] [pid 3555:tid 3617] [remote 1::2:42000] AH01630: client denied by server configuration: /home/pvv/d/oysteikt/web-docs/.git",
-            "oysteikt",
-        )];
-
-        for (line, expected_user) in inputs {
-            let parsed_user = parse_username_from_line(line.as_bytes());
-            assert_eq!(
-                parsed_user,
-                Some(expected_user),
-                "Failed to parse user from line: {line}"
-            );
-        }
-    }
-}

hosts/temmie/services/userweb/default.nix

@@ -1,473 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.httpd;
-
-  # NOTE Enable this if you want to strace stuff in the sandbox...
-  debug = false;
-
-  homeLetters = [ "a" "b" "c" "d" "h" "i" "j" "k" "l" "m" "z" ];
-
-  phpOptions = lib.concatStringsSep "\n" (lib.mapAttrsToList (k: v: "${k} = ${v}"){
-    display_errors = "Off";
-    display_startup_errors = "Off";
-    post_max_size = "40M";
-    upload_max_filesize = "40M";
-  });
-
-  apache-log-processor = pkgs.callPackage ./apache-log-processor { };
-
-  # https://nixos.org/manual/nixpkgs/stable/#ssec-php-user-guide-installing-with-extensions
-  phpEnv = pkgs.php.buildEnv {
-    extensions = { all, ... }: with all; [
-      bz2
-      curl
-      decimal
-      gd
-      imagick
-      mysqli
-      mysqlnd
-      pgsql
-      posix
-      protobuf sqlite3
-      uuid
-      xml
-      xsl
-      zlib
-      zstd
-
-      pdo
-      pdo_mysql
-      pdo_pgsql
-      pdo_sqlite
-    ];
-
-    extraConfig = phpOptions;
-  };
-
-  perlEnv = (pkgs.perl.withPackages (ps: with ps; [
-    pkgs.exiftool
-    pkgs.ikiwiki
-    pkgs.irssi
-    pkgs.nix.libs.nix-perl-bindings
-
-    CGI
-    DBDPg
-    DBDSQLite
-    DBDmysql
-    DBI
-    Git
-    ImageMagick
-    JSON
-    TemplateToolkit
-  ])).overrideAttrs (prev: {
-    # NOTE: `pkgs.perl.propagatedBuildInputs` don't actually propagate through the
-    #       wrapper derivation created by `withPackages`. This should compensate
-    #       for that.
-    postBuild = prev.postBuild + ''
-      cp -r '${pkgs.perl}/nix-support' "$out"/nix-support
-    '';
-  });
-
-  # https://nixos.org/manual/nixpkgs/stable/#python.buildenv-function
-  pythonEnv = pkgs.python3.buildEnv.override {
-    extraLibs = with pkgs.python3Packages; [
-      legacy-cgi
-
-      matplotlib
-      requests
-    ];
-    ignoreCollisions = true;
-  };
-
-  # https://nixos.org/manual/nixpkgs/stable/#sec-building-environment
-  fhsEnv = pkgs.buildEnv {
-    name = "userweb-env";
-    ignoreCollisions = true;
-    paths = with pkgs; [
-      bash
-
-      config.services.bro.instances.userweb-sendmail.client.package
-
-      perlEnv
-      pythonEnv
-      phpEnv
-    ]
-    ++ (with phpEnv.packages; [
-      # composer
-    ])
-    ++ [
-      # Useful packages for homepages
-      exiftool
-      gnuplot
-      ikiwiki-full
-      imagemagick
-      jhead
-      ruby
-      sbcl
-      sourceHighlight
-
-      # Missing packages from tom
-      # blosxom
-      # pyblosxom
-      # mediawiki (TODO: do people host their own mediawikis in userweb?)
-      # nanoblogger
-
-      # Version control
-      cvs
-      rcs
-      git
-
-      # Compression/Archival
-      bzip2
-      gnutar
-      gzip
-      lz4
-      unzip
-      xz
-      zip
-      zstd
-
-      # Other tools you might expect to find on a normal system
-      acl
-      coreutils-full
-      curl
-      diffutils
-      file
-      findutils
-      gawk
-      gnugrep
-      gnumake
-      gnupg
-      gnused
-      less
-      man
-      util-linux
-      vim
-      wget
-      which
-      xdg-utils
-    ] ++ lib.optionals debug [
-      glibc.getent
-      strace
-      systemd
-    ];
-
-    extraOutputsToInstall = [
-      "man"
-      "doc"
-    ];
-  };
-in
-{
-  imports = [
-    ./mail.nix
-  ];
-
-  sops.secrets = {
-    "httpd/passwd-ssh-key" = { };
-    "httpd/ssh-known-hosts" = { };
-  };
-
-  services.httpd = {
-    enable = true;
-    adminAddr = "drift@pvv.ntnu.no";
-
-    # TODO: consider upstreaming systemd support
-    # TODO: mod_log_journald in v2.5
-    package = pkgs.apacheHttpd.overrideAttrs (prev: {
-      nativeBuildInputs = prev.nativeBuildInputs ++ [ pkgs.pkg-config ];
-      buildInputs = prev.buildInputs ++ [ pkgs.systemdLibs ];
-      configureFlags = prev.configureFlags ++ [ "--enable-systemd" ];
-    });
-
-    enablePHP = true;
-    phpPackage = phpEnv;
-    inherit phpOptions;
-
-    enablePerl = true;
-
-    # TODO: mod_log_journald in v2.5
-    extraModules = [
-      "systemd"
-      "userdir"
-      {
-        name = "perl";
-        path = let
-          mod_perl = pkgs.symlinkJoin {
-            name = "userweb_modperl_with_custom_perl_env";
-            ignoreCollisions = true;
-            paths = [
-              (pkgs.apacheHttpdPackages.mod_perl.override {
-                apacheHttpd = cfg.package.out;
-              })
-              perlEnv
-            ];
-          };
-        in "${mod_perl}/modules/mod_perl.so";
-      }
-    ];
-
-    logPerVirtualHost = false;
-
-    extraConfig = ''
-      TraceEnable on
-      LogLevel warn rewrite:trace3
-
-      <FilesMatch ".+\.ph(p[3457]?|t|tml)$">
-          SetHandler application/x-httpd-php
-      </FilesMatch>
-      <FilesMatch ".+\.phps$">
-          SetHandler application/x-httpd-php-source
-          Require all denied
-      </FilesMatch>
-      <FilesMatch "\.pl$">
-          SetHandler modperl
-          PerlResponseHandler ModPerl::Registry
-          Options +ExecCGI
-      </FilesMatch>
-    '';
-
-    virtualHosts."temmie.pvv.ntnu.no" = {
-      forceSSL = true;
-      enableACME = true;
-
-      serverAliases = [
-        "www2.pvv.ntnu.no"
-      ];
-
-      extraConfig = ''
-        CustomLog "${cfg.logDir}/access.log" combined
-        CustomLog "|${lib.getExe apache-log-processor} access" combined
-        ErrorLog "|${lib.getExe apache-log-processor} error"
-        ScriptLog "${cfg.logDir}/cgi.log"
-
-        UserDir ${lib.concatMapStringsSep " " (l: "/home/pvv/${l}/*/web-docs") homeLetters}
-        UserDir disabled root
-        AddHandler cgi-script .cgi
-        DirectoryIndex index.html index.html.var index.php index.php3 index.cgi index.phtml index.shtml meg.html
-        SetEnvIf Request_URI "^/~([^/]+)" USERDIR_USER=$1
-
-        <Directory "/home/pvv/?/*/web-docs">
-          Options MultiViews Indexes SymLinksIfOwnerMatch ExecCGI IncludesNoExec
-          AllowOverride All
-          Require all granted
-        </Directory>
-
-        <DirectoryMatch "^/home/pvv/.*/web-docs/(${lib.concatStringsSep "|" [
-          "\\.git"
-          "\\.hg"
-          "\\.svn"
-          "\\.ssh"
-          "\\.env"
-          "\\.envrc"
-          "\\.bzr"
-          "\\.venv"
-          "CVS"
-          "RCS"
-          ".*\\.swp"
-          ".*\\.bak"
-          ".*~"
-        ]})(/|$)">
-            AllowOverride All
-            Require all denied
-        </DirectoryMatch>
-      '';
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
-
-  # socket activation comes in v2.5
-  # systemd.sockets.httpd = {
-  #   wantedBy = [ "sockets.target" ];
-  #   description = "HTTPD socket";
-  #   listenStreams = [
-  #     "0.0.0.0:80"
-  #     "0.0.0.0:443"
-  #   ];
-  # };
-
-  # NOTE: 54 -> 33, this is the UID/GID we used for www-data on tom in the past.
-  #       Any files accessed by or created by httpd will do so over NFS with this
-  #       UID/GID pair as its credentials.
-  #       This overlaps with the hardcoded `disnix` uid in nixpkgs, but we *probably*
-  #       won't be using that for the foreseeable future.
-  users.users."wwwrun".uid = lib.mkForce 33;
-  users.groups."wwwrun".gid = lib.mkForce 33;
-
-  systemd.services.httpd = {
-    after = [ "pvv-homedirs.target" ];
-    requires = [ "pvv-homedirs.target" ];
-
-    environment = {
-      PATH = lib.mkForce "/usr/bin";
-    };
-
-    serviceConfig = {
-      Type = lib.mkForce "notify";
-
-      ExecStartPre = let
-        rsyncCommand = ''${lib.getExe pkgs.rsync} -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey" -avz'';
-      in lib.mkForce [
-        "${lib.getExe (pkgs.writeShellApplication {
-          name = "http-exec-start-pre-remove-old-semaphores";
-          text = ''
-            # Get rid of old semaphores.  These tend to accumulate across
-            # server restarts, eventually preventing it from restarting
-            # successfully.
-            for i in $(${pkgs.util-linux}/bin/ipcs -s | grep ' ${cfg.user} ' | cut -f2 -d ' '); do
-                ${pkgs.util-linux}/bin/ipcrm -s "$i"
-            done
-          '';
-        })}"
-
-        "${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/passwd /run/httpd/pamunix-in/"
-        "${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/group /run/httpd/pamunix-in/"
-
-        (let
-          args = lib.cli.toCommandLineShellGNU { } {
-            passwd-file = "/run/httpd/pamunix-in/passwd";
-            group-file = "/run/httpd/pamunix-in/group";
-            output-dir = "/run/httpd/pamunix-out";
-            shadow-file = pkgs.emptyFile;
-
-            output-passwd = true;
-
-            ignore-user-file = toString ./ignore_user_file.txt;
-            ignore-group-file = toString ./ignore_group_file.txt;
-          };
-        in ''${lib.getExe pkgs.passwd2systemd-users} ${args}'')
-        "${lib.getExe' pkgs.coreutils "shred"} -u /run/httpd/pamunix-in/passwd /run/httpd/pamunix-in/group"
-        ":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:0:System administrator:/root:/run/current-system/sw/bin/bash' /run/httpd/pamunix-out/passwd"
-        ":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:54:Apache httpd user:/var/empty:/run/current-system/sw/bin/bash' /run/httpd/pamunix-out/passwd"
-        ":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:' /run/httpd/pamunix-out/group"
-        ":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:' /run/httpd/pamunix-out/group"
-        "+${lib.getExe' pkgs.coreutils "chown"} root:root /run/httpd/pamunix-out/passwd /run/httpd/pamunix-out/group"
-        "+${lib.getExe' pkgs.coreutils "chmod"} 0644 /run/httpd/pamunix-out/passwd /run/httpd/pamunix-out/group"
-        "+${lib.getExe pkgs.mount} --bind /run/httpd/pamunix-out/passwd /etc/passwd"
-        "+${lib.getExe pkgs.mount} --bind /run/httpd/pamunix-out/group  /etc/group"
-      ];
-      ExecStart = lib.mkForce "${cfg.package}/bin/httpd -D FOREGROUND -f /etc/httpd/httpd.conf -k start";
-      ExecReload = lib.mkForce "${cfg.package}/bin/httpd -f /etc/httpd/httpd.conf -k graceful";
-      ExecStop = lib.mkForce "";
-      KillMode = "mixed";
-
-      LoadCredential=[
-        "sshkey:${config.sops.secrets."httpd/passwd-ssh-key".path}"
-        "ssh-known-hosts:${config.sops.secrets."httpd/ssh-known-hosts".path}"
-      ];
-
-      ConfigurationDirectory = [ "httpd" ];
-      LogsDirectory = [ "httpd" ];
-      LogsDirectoryMode = "0700";
-
-      AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_SETUID" "CAP_SETGID" ] ++ lib.optionals debug [ "CAP_SYS_PTRACE" ];
-      CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SETUID" "CAP_SETGID" ] ++ lib.optionals debug [ "CAP_SYS_PTRACE" ];
-      LockPersonality = !debug;
-      PrivateDevices = true;
-      PrivateTmp = true;
-      # NOTE: this removes CAP_NET_BIND_SERVICE...
-      # PrivateUsers = true;
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = "tmpfs";
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectSystem = true;
-      RemoveIPC = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-        "AF_NETLINK"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SocketBindDeny = "any";
-      SocketBindAllow = [
-        "tcp:80"
-        "tcp:443"
-      ];
-      SystemCallArchitectures = "native";
-      SystemCallFilter = lib.mkIf (!debug) [
-         "@system-service"
-         "@setuid"
-      ];
-      UMask = "0077";
-
-      RuntimeDirectoryMode = "0750";
-      RuntimeDirectory = [
-        "httpd/root-mnt"
-        "httpd/pamunix-in"
-        "httpd/pamunix-out"
-      ];
-      RootDirectory = "/run/httpd/root-mnt";
-      MountAPIVFS = true;
-      BindReadOnlyPaths = [
-        builtins.storeDir
-        "/etc"
-        "/dev/null"
-        "/etc/resolv.conf"
-        "/var/lib/acme"
-
-        "-/run/httpd/pamunix-out/passwd:/etc/passwd"
-        "-/run/httpd/pamunix-out/group:/etc/group"
-
-        "${pkgs.writeText "userweb-fake-nsswitch.conf" ''
-          passwd:    files
-          group:     files
-          shadow:    files
-          sudoers:   files
-
-          hosts:     mymachines resolve [!UNAVAIL=return] files myhostname dns
-          networks:  files
-
-          ethers:    files
-          services:  files
-          protocols: files
-          rpc:       files
-
-          subuid:    files
-          subgid:    files
-        ''}:/etc/nsswitch.conf"
-
-        "${fhsEnv}/bin:/bin"
-        "${fhsEnv}/sbin:/sbin"
-        "${fhsEnv}/lib:/lib"
-        "${fhsEnv}/share:/share"
-      ] ++ (lib.mapCartesianProduct ({ parent, child }: "${fhsEnv}${child}:${parent}${child}") {
-        parent = [
-          "/local"
-          "/opt"
-          "/opt/local"
-          "/store"
-          "/store/gnu"
-          "/usr"
-          "/usr/local"
-          "/run/current-system/sw"
-        ];
-        child = [
-          "/bin"
-          "/sbin"
-          "/lib"
-          "/libexec"
-          "/include"
-          "/share"
-        ];
-      });
-      BindPaths = lib.mapCartesianProduct ({ directoryFn, letter }: "/run/pvv-home-mounts/${letter}:${directoryFn letter}${letter}") {
-        directoryFn = [
-          (_: "/home/pvv/")
-          (l: "/amd/homepvv${l}/")
-        ];
-        letter = homeLetters;
-      };
-    };
-  };
-
-  # TODO: create phpfpm pools with php environments that contain packages similar to those present on tom
-}

hosts/temmie/services/userweb/ignore_group_file.txt

@@ -1,91 +0,0 @@
-Debian-exim
-_cvsadmin
-_ssh
-adm
-audio
-avahi
-backup
-bin
-cdrom
-cl-builder
-clamav
-clock
-colord
-courier
-crontab
-daemon
-debian-spamd
-dialout
-dip
-dirmngr
-disk
-dovecot
-fax
-floppy
-fuse
-games
-geoclue
-gnats
-input
-irc
-kmem
-kvm
-list
-lock
-lp
-lpadmin
-mail
-man
-messagebus
-mlocate
-munin
-netdev
-news
-nogroup
-ntp
-ntpsec
-oident
-opendkim
-operator
-plocate
-plugdev
-polkitd
-postdrop
-postfix
-postgres
-prometheus
-prometheus-exporter
-proxy
-rdma
-root
-# runit
-salt
-sambashare
-saned
-sasl
-scanner
-sgx
-shadow
-src
-ssl-cert
-staff
-stunnel4
-sudo
-sys
-systemd-coredump
-systemd-journal
-systemd-network
-systemd-resolve
-systemd-timesync
-tape
-tcpdump
-tty
-users
-utempter
-utmp
-uucp
-uuidd
-video
-voice
-winbindd_priv
-www-data

hosts/temmie/services/userweb/ignore_user_file.txt

@@ -1,74 +0,0 @@
-# System Users
-Debian-exim
-_apt
-_rpc
-avahi
-backup
-bin
-cl-builder
-clamav
-colord
-courier
-daemon
-debian-spamd
-debian-spamd
-dirmngr
-distccd
-dovecot
-dovenull
-driftsupport
-fetchmail
-games
-geoclue
-gitea
-gnats
-hplip
-irc
-list
-lp
-mail
-mail2news
-mailnews
-man
-messagebus
-munin
-news
-nobody
-noone
-ntp
-ntpsec
-oident
-opendkim
-polkitd
-postfix
-postgres
-prometheus
-prometheus-exporter
-proxy
-root
-rwhod
-salt
-saned
-spamd
-sshd
-statd
-stunnel4
-sync
-sys
-systemd-coredump
-systemd-network
-systemd-resolve
-systemd-timesync
-tcpdump
-uucp
-uuidd
-vaultwarden
-www-data
-
-# Misc
-nuccc04
-nuccc
-kybkokos
-kybkokos2
-testbruker2309
-testbruker2404

hosts/temmie/services/userweb/mail.nix

@@ -1,119 +0,0 @@
-{ config, lib, pkgs, ... }:
-{
-  services.postfix.enable = lib.mkForce false;
-
-  services.nullmailer = {
-    enable = true;
-    config = {
-      me = config.networking.fqdn;
-      remotes = "mail.pvv.ntnu.no smtp --port=25";
-    };
-  };
-
-  services.bro = {
-    enable = true;
-
-    instances.userweb-sendmail = {
-      enable = true;
-
-      client = {
-        settings.BRO_FILE_FLAGS = [
-          "-C"
-        ];
-      };
-
-      server = {
-        settings = {
-          executable = let
-            sendmailWrapper = pkgs.writeShellApplication {
-              name = "sendmail";
-              runtimeInputs = [ ];
-              bashOptions = [
-                "errexit"
-                "pipefail"
-              ];
-              text = ''
-                args=("$@")
-
-                if [[ -z "$USERDIR_USER" ]] && [[ "$USERDIR_USER" != "pvv" ]]; then
-                    # Prepend -fusername to the argument list, so bounces go to the user
-                    args=("-f$USERDIR_USER" "''${args[@]}")
-                fi
-
-                exec '${lib.getExe pkgs.system-sendmail}' -t -i "''${args[@]}"
-              '';
-            };
-          in lib.getExe sendmailWrapper;
-          allowed-env = [ "USERDIR_USER" ];
-        };
-      };
-    };
-  };
-
-  environment.systemPackages = [
-    (config.services.bro.instances.userweb-sendmail.client.package.overrideAttrs (prev: {
-      buildCommand = prev.buildCommand + ''
-        mv "$out/bin/sendmail" "$out/bin/bro-sendmail"
-      '';
-    }))
-  ];
-
-  users.users.nullmailer-user = {
-    enable = true;
-    isSystemUser = true;
-    group = "nullmailer-user";
-  };
-
-  users.groups.nullmailer-user = { };
-
-  systemd.services.bro-userweb-sendmail = {
-    serviceConfig = {
-      User = "nullmailer-user";
-      Group = "nullmailer-user";
-
-      ReadWritePaths = [
-        "/var/spool/nullmailer"
-      ];
-
-      AmbientCapabilities = "";
-      CapabilityBoundingSet = "";
-      NoNewPrivileges = false;
-      ProtectSystem = "strict";
-      ProtectHome = true;
-      PrivateTmp = true;
-      PrivateDevices = true;
-      PrivateUsers = false;
-      ProtectHostname = true;
-      ProtectClock = true;
-      ProtectKernelTunables = true;
-      ProtectKernelModules = true;
-      ProtectKernelLogs = true;
-      ProtectControlGroups = true;
-      RestrictAddressFamilies = [
-        "AF_UNIX"
-        "AF_INET"
-        "AF_INET6"
-        "AF_NETLINK"
-      ];
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      PrivateMounts = true;
-      ProcSubset = "pid";
-      ProtectProc = "invisible";
-      RemoveIPC = true;
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@resources"
-      ];
-      UMask = "0077";
-    };
-  };
-
-  systemd.services.httpd.serviceConfig = {
-    BindPaths = [ (lib.head config.systemd.sockets.bro-userweb-sendmail.listenStreams) ];
-  };
-}

hosts/ustetind/configuration.nix

@@ -0,0 +1,40 @@
+{ config, fp, pkgs, lib, values, ... }:
+
+{
+  imports = [
+    (fp /base)
+
+    ./services/gitea-runners.nix
+  ];
+
+  boot.loader.systemd-boot.enable = false;
+
+  networking.useHostResolvConf = lib.mkForce false;
+
+  systemd.network.networks = {
+    "30-lxc-eth" = values.defaultNetworkConfig // {
+      matchConfig = {
+        Type = "ether";
+        Kind = "veth";
+        Name = [
+          "eth*"
+        ];
+      };
+      address = with values.hosts.ustetind; [ (ipv4 + "/25") (ipv6 + "/64") ];
+    };
+    "40-podman-veth" = values.defaultNetworkConfig // {
+      matchConfig = {
+        Type = "ether";
+        Kind = "veth";
+        Name = [
+          "veth*"
+        ];
+      };
+      DHCP = "yes";
+    };
+  };
+
+  # Don't change (even during upgrades) unless you know what you are doing.
+  # See https://search.nixos.org/options?show=system.stateVersion
+  system.stateVersion = "24.11";
+}

hosts/ustetind/services/gitea-runners.nix

@@ -0,0 +1,41 @@
+{ config, lib, values, ... }:
+let
+  mkRunner = name: {
+    # This is unfortunately state, and has to be generated one at a time :(
+    # To do that, comment out all except one of the runners, fill in its token
+    # inside the sops file, rebuild the system, and only after this runner has
+    # successfully registered will gitea give you the next token.
+    # - oysteikt Sep 2023
+    sops.secrets."gitea/runners/${name}".restartUnits = [
+      "gitea-runner-${name}.service"
+    ];
+
+    services.gitea-actions-runner.instances = {
+      ${name} = {
+        enable = true;
+        name = "git-runner-${name}"; url = "https://git.pvv.ntnu.no";
+        labels = [
+          "debian-latest:docker://node:current-bookworm"
+          "ubuntu-latest:docker://node:current-bookworm"
+        ];
+        tokenFile = config.sops.secrets."gitea/runners/${name}".path;
+      };
+    };
+  };
+in
+lib.mkMerge [
+  (mkRunner "alpha")
+  (mkRunner "beta")
+  (mkRunner "epsilon")
+  {
+    virtualisation.podman = {
+      enable = true;
+      defaultNetwork.settings.dns_enabled = true;
+      autoPrune.enable = true;
+    };
+
+    networking.dhcpcd.IPv6rs = false;
+
+    networking.firewall.interfaces."podman+".allowedUDPPorts = [53 5353];
+  }
+]

modules/bluemap.nix

@@ -376,7 +376,7 @@ in {
       serviceConfig = {
         Type = "oneshot";
         CPUSchedulingPolicy = "batch";
-        Group = lib.mkIf cfg.enableNginx "nginx";
+        Group = "nginx";
         UMask = "026";
         ExecStart = [
           # If web folder doesnt exist generate it

modules/drumknotty/default.nix

@@ -1,198 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  cfg = config.services.drumknotty;
-in
-{
-  imports = [
-    ./dibbler.nix
-    ./worblehat.nix
-  ];
-
-  options.services.drumknotty = {
-    enable = lib.mkEnableOption "DrumknoTTY";
-
-    kioskMode = lib.mkEnableOption "" // {
-      description = ''
-        Whether to let dibbler take over the entire machine.
-
-        This will restrict the machine to a single TTY and make the program unquittable.
-        You can still get access to PTYs via SSH and similar, if enabled.
-      '';
-    };
-
-    screen = {
-      package = lib.mkPackageOption pkgs "screen" { };
-
-      sessionName = lib.mkOption {
-        type = lib.types.str;
-        default = "drumknotty";
-        example = "myscreensessionname";
-        description = ''
-          Sets the screen session name.
-        '';
-      };
-
-      limitHeight = lib.mkOption {
-        type = with lib.types; nullOr ints.unsigned;
-        default = null;
-        example = 42;
-        description = ''
-          If set, limits the height of the screen dibbler uses to the given number of lines.
-        '';
-      };
-
-      limitWidth = lib.mkOption {
-        type = with lib.types; nullOr ints.unsigned;
-        default = null;
-        example = 80;
-        description = ''
-          If set, limits the width of the screen dibbler uses to the given number of columns.
-        '';
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = cfg.enable -> lib.any (b: b) [
-          cfg.dibbler.enable
-          cfg.worblehat.enable
-        ];
-        message = "DrumknoTTY must have at least one service enabled";
-      }
-    ];
-
-    users = {
-      users.drumknotty = {
-        group = "drumknotty";
-        extraGroups = [ "lp" ];
-        isNormalUser = true;
-
-        # TODO: make this display the error log or error message in case that
-        #       the screen session service is bootlooping or otherwise off.
-        shell =
-          lib.mkIf cfg.kioskMode
-          (pkgs.writeShellScriptBin "login-shell"
-            "${lib.getExe' cfg.screen.package "screen"} -x ${cfg.screen.sessionName} -p dibbler"
-          // {
-            shellPath = "/bin/login-shell";
-          });
-      };
-      groups.drumknotty = { };
-    };
-
-    boot.kernelParams = lib.mkIf cfg.kioskMode [
-      "console=tty1"
-    ];
-
-    services.getty.autologinUser = lib.mkIf cfg.kioskMode "drumknotty";
-
-    systemd.services.drumknotty-screen-session = lib.mkIf cfg.kioskMode {
-      description = "Drumknotty Screen Session";
-      wantedBy = [
-        "default.target"
-      ];
-      after =
-        # TODO: this could be refined
-        if (cfg.dibbler.createLocalDatabase || cfg.worblehat.createLocalDatabase) then
-          [
-            "postgresql.service"
-            "dibbler-setup-database.service"
-            "worblehat-setup-database.service"
-          ]
-        else
-          [
-            "network.target"
-          ];
-
-      serviceConfig = {
-        Type = "forking";
-        RemainAfterExit = false;
-        Restart = "always";
-        RestartSec = "5s";
-        SuccessExitStatus = 1;
-
-        User = "drumknotty";
-        Group = "drumknotty";
-
-        ExecStartPre =
-          let
-            screenArgs = lib.escapeShellArgs [
-              # Send the specified command to a running screen session
-              "-X"
-
-              # Session name
-              "-S"
-              "${cfg.screen.sessionName}"
-
-              "kill"
-            ];
-          in
-          "-${lib.getExe' cfg.screen.package "screen"} ${screenArgs}";
-
-        ExecStart =
-          let
-            screenrc = let
-              convertToFile = lines: lib.pipe lines [
-                lib.concatLists
-                (lib.concatStringsSep "\n")
-                (pkgs.writeText "drumknotty-screenrc")
-              ];
-            in convertToFile [
-              (lib.optionals (cfg.screen.limitWidth != null) [
-                "screen width ${toString cfg.screen.limitWidth}"
-              ])
-              (lib.optionals (cfg.screen.limitHeight != null) [
-                "screen height ${toString cfg.screen.limitHeight}"
-              ])
-
-              (let
-                dibblerArgs = lib.cli.toCommandLineShellGNU { } {
-                  config = "/etc/dibbler/dibbler.toml";
-                };
-              in lib.optionals cfg.dibbler.enable [
-                "screen -t dibbler ${lib.getExe cfg.dibbler.package} ${dibblerArgs} loop"
-
-              ])
-
-              (let
-                worblehatArgs = lib.cli.toCommandLineShellGNU { } {
-                  config = "/etc/worblehat/config.toml";
-                };
-              in lib.optionals cfg.worblehat.enable [
-                "screen -t worblehat ${lib.getExe cfg.worblehat.package} ${worblehatArgs} cli"
-              ])
-
-              [ "select 0" ]
-            ];
-
-            screenArgs = lib.escapeShellArgs [
-              # -dm creates the screen in detached mode without accessing it
-              "-dm"
-
-              # Session name
-              "-S"
-              "${cfg.screen.sessionName}"
-
-              # Set optimal output mode instead of VT100 emulation
-              "-O"
-
-              # Enable login mode, updates utmp entries
-              "-l"
-
-              # Config file path
-              "-c"
-              "${screenrc}"
-            ];
-          in
-            "${lib.getExe' cfg.screen.package "screen"} ${screenArgs}";
-      };
-    };
-  };
-}

modules/drumknotty/dibbler.nix

@@ -1,113 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  mainCfg = config.services.drumknotty;
-  cfg = config.services.drumknotty.dibbler;
-
-  format = pkgs.formats.toml { };
-in
-{
-  options.services.drumknotty.dibbler = {
-    enable = lib.mkEnableOption "";
-
-    package = lib.mkPackageOption pkgs "dibbler" { };
-
-    settings = lib.mkOption {
-      description = "Configuration for dibbler";
-      default = { };
-      type = lib.types.submodule {
-        freeformType = format.type;
-      };
-    };
-
-    createLocalDatabase = lib.mkEnableOption "" // {
-      description = ''
-        Whether to set up a local postgres database automatically.
-
-        ::: {.note}
-        You must set up postgres manually before enabling this option.
-        :::
-      '';
-    };
-  };
-
-  config = lib.mkIf (mainCfg.enable && cfg.enable) {
-    assertions = [
-      {
-        assertion = cfg.createLocalDatabase -> config.services.postgresql.enable;
-        message = "PostgreSQL must be enabled for dibbler to create a local database";
-      }
-    ];
-
-    environment.systemPackages = [ cfg.package ];
-    environment.etc."dibbler/dibbler.toml".source = format.generate "dibbler.toml" cfg.settings;
-
-    services.drumknotty.dibbler.settings = {
-      limits = {
-        low_credit_warning_limit = lib.mkDefault (-100);
-        user_recent_transaction_limit = lib.mkDefault 100;
-      };
-
-      printer = {
-        label_type = lib.mkDefault "62";
-        label_rotate = lib.mkDefault false;
-      };
-
-      database = {
-        type = lib.mkIf cfg.createLocalDatabase "postgresql";
-        postgresql = {
-          username = lib.mkDefault "dibbler";
-          dbname = lib.mkDefault "dibbler";
-
-          host = lib.mkIf cfg.createLocalDatabase "/run/postgresql";
-        };
-      };
-    };
-
-    services.drumknotty.dibbler.settings.general = lib.mkIf mainCfg.kioskMode {
-      quit_allowed = false;
-      stop_allowed = false;
-    };
-
-    services.postgresql = lib.mkIf cfg.createLocalDatabase {
-      authentication = ''
-        local ${cfg.settings.database.postgresql.dbname} ${cfg.settings.database.postgresql.username} peer map=${cfg.settings.database.postgresql.username}
-      '';
-      identMap = ''
-        ${cfg.settings.database.postgresql.username} drumknotty ${cfg.settings.database.postgresql.username}
-      '';
-      ensureDatabases = [ cfg.settings.database.postgresql.dbname ];
-      ensureUsers = [{
-        name = cfg.settings.database.postgresql.username;
-        ensureDBOwnership = true;
-        ensureClauses.login = true;
-      }];
-    };
-
-    systemd.services.dibbler-setup-database = lib.mkIf cfg.createLocalDatabase {
-      description = "Dibbler database setup";
-
-      wantedBy = [ "default.target" ];
-      requiredBy = [ "drumknotty-screen-session.service" ];
-      before = [ "drumknotty-screen-session.service" ];
-      after = [ "postgresql.service" ];
-
-      unitConfig = {
-        ConditionPathExists = "!/var/lib/dibbler/.db-setup-done";
-      };
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = "${lib.getExe cfg.package} --config /etc/dibbler/dibbler.toml create-db";
-        ExecStartPost = "${lib.getExe' pkgs.coreutils "touch"} /var/lib/dibbler/.db-setup-done";
-        StateDirectory = "dibbler";
-
-        User = "drumknotty";
-        Group = "drumknotty";
-      };
-    };
-  };
-}

modules/drumknotty/worblehat.nix

@@ -1,209 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  mainCfg = config.services.drumknotty;
-  cfg = config.services.drumknotty.worblehat;
-
-  format = pkgs.formats.toml { };
-in
-{
-  options.services.drumknotty.worblehat = {
-    enable = lib.mkEnableOption "";
-
-    package = lib.mkPackageOption pkgs "worblehat" { };
-
-    settings = lib.mkOption {
-      description = "Configuration for worblehat";
-      default = { };
-      type = lib.types.submodule {
-        freeformType = format.type;
-      };
-    };
-
-    createLocalDatabase = lib.mkEnableOption "" // {
-      description = ''
-        Whether to set up a local postgres database automatically.
-
-        ::: {.note}
-        You must set up postgres manually before enabling this option.
-        :::
-      '';
-    };
-
-    deadline-daemon = {
-      enable = lib.mkEnableOption "" // {
-        description = ''
-          Whether to enable the worblehat deadline-daemon service,
-          which periodically checks for upcoming deadlines and notifies users.
-
-          Note that this service is independent of the main worblehat service,
-          and must be enabled separately.
-        '';
-      };
-
-      onCalendar = lib.mkOption {
-        type = lib.types.str;
-        description = ''
-          How often to trigger rendering the map,
-          in the format of a systemd timer onCalendar configuration.
-
-          See {manpage}`systemd.timer(5)`.
-        '';
-        default = "*-*-* 10:15:00";
-      };
-    };
-  };
-
-  config = lib.mkMerge [
-    {
-      assertions = [
-        {
-          assertion = cfg.createLocalDatabase -> config.services.postgresql.enable;
-          message = "PostgreSQL must be enabled for worblehat to create a local database";
-        }
-      ];
-
-      # TODO: Retrieve defaults from the example config file in the project code.
-      services.drumknotty.worblehat.settings = {
-        logging = {
-          debug = lib.mkDefault true;
-          debug_sql = lib.mkDefault false;
-        };
-
-        database = {
-          type = lib.mkDefault "sqlite";
-          sqlite.path = lib.mkDefault "./worblehat.sqlite";
-          postgresql = {
-            host = lib.mkDefault "localhost";
-            port = lib.mkDefault 5432;
-            username = lib.mkDefault "worblehat";
-            password = lib.mkDefault "/var/lib/worblehat/db-password";
-            database = lib.mkDefault "worblehat";
-          };
-        };
-
-        flask = {
-          TESTING = lib.mkDefault true;
-          DEBUG = lib.mkDefault true;
-          FLASK_ENV = lib.mkDefault "development";
-          SECRET_KEY = lib.mkDefault "change-me";
-        };
-
-        smtp = {
-          enabled = lib.mkDefault false;
-          host = lib.mkDefault "smtp.pvv.ntnu.no";
-          port = lib.mkDefault 587;
-          username = lib.mkDefault "worblehat";
-          password = lib.mkDefault "/var/lib/worblehat/smtp-password";
-          from = lib.mkDefault "worblehat@pvv.ntnu.no";
-          subject_prefix = lib.mkDefault "[Worblehat]";
-        };
-
-        deadline_daemon = {
-          enabled = lib.mkDefault true;
-          dryrun = lib.mkDefault false;
-          warn_days_before_borrowing_deadline = lib.mkDefault [
-            5
-            1
-          ];
-          days_before_queue_position_expires = lib.mkDefault 14;
-          warn_days_before_expiring_queue_position_deadline = lib.mkDefault [
-            3
-            1
-          ];
-        };
-      };
-    }
-
-    (lib.mkIf ((mainCfg.enable && cfg.enable) || cfg.deadline-daemon.enable) {
-      environment.systemPackages = [ cfg.package ];
-      environment.etc."worblehat/config.toml".source = format.generate "worblehat-config.toml" cfg.settings;
-    })
-
-    (lib.mkIf (mainCfg.enable && cfg.enable) {
-      services.drumknotty.worblehat.settings.general = lib.mkIf mainCfg.kioskMode {
-        quit_allowed = false;
-        stop_allowed = false;
-      };
-
-      services.drumknotty.worblehat.settings.database = lib.mkIf cfg.createLocalDatabase {
-        type = "postgresql";
-        postgresql.host = "/run/postgresql";
-      };
-
-      services.postgresql = lib.mkIf cfg.createLocalDatabase {
-        authentication = ''
-          local ${cfg.settings.database.postgresql.database} ${cfg.settings.database.postgresql.username} peer map=${cfg.settings.database.postgresql.username}
-        '';
-        identMap = ''
-          ${cfg.settings.database.postgresql.username} drumknotty ${cfg.settings.database.postgresql.username}
-        '';
-        ensureDatabases = [ cfg.settings.database.postgresql.database ];
-        ensureUsers = [{
-          name = cfg.settings.database.postgresql.username;
-          ensureDBOwnership = true;
-          ensureClauses.login = true;
-        }];
-      };
-
-      systemd.services.worblehat-setup-database = lib.mkIf cfg.createLocalDatabase {
-        description = "Worblehat database setup";
-
-        wantedBy = [ "default.target" ];
-        requiredBy = [ "drumknotty-screen-session.service" ];
-        before = [ "drumknotty-screen-session.service" ];
-        after = [ "postgresql.service" ];
-
-        unitConfig = {
-          ConditionPathExists = "!/var/lib/worblehat/.db-setup-done";
-        };
-        serviceConfig = {
-          Type = "oneshot";
-          ExecStart = "${lib.getExe cfg.package} --config /etc/worblehat/config.toml create-db";
-          ExecStartPost = "${lib.getExe' pkgs.coreutils "touch"} /var/lib/worblehat/.db-setup-done";
-          StateDirectory = "worblehat";
-
-          User = "drumknotty";
-          Group = "drumknotty";
-        };
-      };
-    })
-
-    (lib.mkIf cfg.deadline-daemon.enable {
-      systemd.timers.worblehat-deadline-daemon = lib.mkIf cfg.deadline-daemon.enable {
-        description = "Worblehat Deadline Daemon";
-        wantedBy = [ "timers.target" ];
-        timerConfig = {
-          OnCalendar = cfg.deadline-daemon.onCalendar;
-          Persistent = true;
-        };
-      };
-
-      systemd.services.worblehat-deadline-daemon = lib.mkIf cfg.deadline-daemon.enable {
-        description = "Worblehat Deadline Daemon";
-        wantedBy = [ "multi-user.target" ];
-        after = [ "network.target" ];
-        serviceConfig = {
-          Type = "oneshot";
-          CPUSchedulingPolicy = "idle";
-          IOSchedulingClass = "idle";
-
-          ExecStart =
-            let
-              worblehatArgs = lib.cli.toCommandLineShellGNU { } {
-                config = "/etc/worblehat/config.toml";
-              };
-            in
-            "${lib.getExe cfg.package} ${worblehatArgs} deadline-daemon";
-
-          User = "drumknotty";
-          Group = "drumknotty";
-        };
-      };
-    })
-  ];
-}

modules/grzegorz.nix

@@ -16,7 +16,7 @@ in {
   };
 
   systemd.user.services.restart-greg-ng = {
-    serviceConfig.ExecStart = "${lib.getExe' pkgs.systemd "systemctl"} --user restart greg-ng.service";
+    script = "systemctl --user restart greg-ng.service";
     startAt = "*-*-* 06:30:00";
   };
 

modules/matrix-ooye.nix

@@ -77,29 +77,29 @@ in
 
         id
         echo "Before if statement"
-        stat "''${REGISTRATION_FILE}"
+        stat ''${REGISTRATION_FILE}
 
-        if [[ ! -f "''${REGISTRATION_FILE}" ]]; then
+        if [[ ! -f ''${REGISTRATION_FILE} ]]; then
           echo "No registration file found at '$REGISTRATION_FILE'"
-          cp --no-preserve=mode,ownership "${baseConfig}" "''${REGISTRATION_FILE}"
+          cp --no-preserve=mode,ownership ${baseConfig} ''${REGISTRATION_FILE}
         fi
 
         echo "After if statement"
-        stat "''${REGISTRATION_FILE}"
+        stat ''${REGISTRATION_FILE}
 
-        AS_TOKEN="$('${lib.getExe pkgs.jq}' -r .as_token "''${REGISTRATION_FILE}")"
+        AS_TOKEN=$(${lib.getExe pkgs.jq} -r .as_token ''${REGISTRATION_FILE})
-        HS_TOKEN="$('${lib.getExe pkgs.jq}' -r .hs_token "''${REGISTRATION_FILE}")"
+        HS_TOKEN=$(${lib.getExe pkgs.jq} -r .hs_token ''${REGISTRATION_FILE})
-        DISCORD_TOKEN="$(cat /run/credentials/matrix-ooye-pre-start.service/discord_token)"
+        DISCORD_TOKEN=$(cat /run/credentials/matrix-ooye-pre-start.service/discord_token)
-        DISCORD_CLIENT_SECRET="$(cat /run/credentials/matrix-ooye-pre-start.service/discord_client_secret)"
+        DISCORD_CLIENT_SECRET=$(cat /run/credentials/matrix-ooye-pre-start.service/discord_client_secret)
 
         # Check if we have all required tokens
         if [[ -z "$AS_TOKEN" || "$AS_TOKEN" == "null" ]]; then
-          AS_TOKEN="$('${lib.getExe pkgs.openssl}' rand -hex 64)"
+          AS_TOKEN=$(${lib.getExe pkgs.openssl} rand -hex 64)
           echo "Generated new AS token: ''${AS_TOKEN}"
         fi
 
         if [[ -z "$HS_TOKEN" || "$HS_TOKEN" == "null" ]]; then
-          HS_TOKEN="$('${lib.getExe pkgs.openssl}' rand -hex 64)"
+          HS_TOKEN=$(${lib.getExe pkgs.openssl} rand -hex 64)
           echo "Generated new HS token: ''${HS_TOKEN}"
         fi
 
@@ -115,13 +115,13 @@ in
           exit 1
         fi
 
-        shred -u "''${REGISTRATION_FILE}"
+        shred -u ''${REGISTRATION_FILE}
-        cp --no-preserve=mode,ownership "${baseConfig}" "''${REGISTRATION_FILE}"
+        cp --no-preserve=mode,ownership ${baseConfig} ''${REGISTRATION_FILE}
 
-        '${lib.getExe pkgs.jq}' '.as_token = "'$AS_TOKEN'" | .hs_token = "'$HS_TOKEN'" | .ooye.discord_token = "'$DISCORD_TOKEN'" | .ooye.discord_client_secret = "'$DISCORD_CLIENT_SECRET'"' "''${REGISTRATION_FILE}" > "''${REGISTRATION_FILE}.tmp"
+        ${lib.getExe pkgs.jq} '.as_token = "'$AS_TOKEN'" | .hs_token = "'$HS_TOKEN'" | .ooye.discord_token = "'$DISCORD_TOKEN'" | .ooye.discord_client_secret = "'$DISCORD_CLIENT_SECRET'"' ''${REGISTRATION_FILE} > ''${REGISTRATION_FILE}.tmp
 
-        shred -u "''${REGISTRATION_FILE}"
+        shred -u ''${REGISTRATION_FILE}
-        mv "''${REGISTRATION_FILE}.tmp" "''${REGISTRATION_FILE}"
+        mv ''${REGISTRATION_FILE}.tmp ''${REGISTRATION_FILE}
       '';
 
     in
@@ -171,9 +171,6 @@ in
         requires = [ "matrix-ooye-pre-start.service" ];
         wantedBy = [ "multi-user.target" ];
 
-        startLimitIntervalSec = 5;
-        startLimitBurst = 5;
-
         serviceConfig = {
           ExecStart = lib.getExe config.services.matrix-ooye.package;
           WorkingDirectory = "/var/lib/matrix-ooye";
@@ -185,6 +182,8 @@ in
           #PrivateDevices = true;
           Restart = "on-failure";
           RestartSec = "5s";
+          StartLimitIntervalSec = "5s";
+          StartLimitBurst = "5";
           DynamicUser = true;
         };
       };

modules/snakeoil-certs.nix

@@ -51,24 +51,24 @@ in
       script = let
         openssl = lib.getExe pkgs.openssl;
       in lib.concatMapStringsSep "\n" ({ name, value }: ''
-        mkdir -p "$(dirname '${value.certificate}')" "$(dirname '${value.certificateKey}')"
+        mkdir -p $(dirname "${value.certificate}") $(dirname "${value.certificateKey}")
-        if ! ${openssl} x509 -checkend 86400 -noout -in '${value.certificate}'
+        if ! ${openssl} x509 -checkend 86400 -noout -in ${value.certificate}
         then
           echo "Regenerating '${value.certificate}'"
           ${openssl} req \
             -newkey rsa:4096 \
             -new -x509 \
-            -days '${toString value.daysValid}' \
+            -days "${toString value.daysValid}" \
             -nodes \
-            -subj '${value.subject}' \
+            -subj "${value.subject}" \
-            -out '${value.certificate}' \
+            -out "${value.certificate}" \
-            -keyout '${value.certificateKey}' \
+            -keyout "${value.certificateKey}" \
             ${lib.escapeShellArgs value.extraOpenSSLArgs}
         fi
-        chown '${value.owner}:${value.group}' '${value.certificate}'
+        chown "${value.owner}:${value.group}" "${value.certificate}"
-        chown '${value.owner}:${value.group}' '${value.certificateKey}'
+        chown "${value.owner}:${value.group}" "${value.certificateKey}"
-        chmod '${value.mode}' '${value.certificate}'
+        chmod "${value.mode}" "${value.certificate}"
-        chmod '${value.mode}' '${value.certificateKey}'
+        chmod "${value.mode}" "${value.certificateKey}"
 
         echo "\n-----------------\n"
       '') (lib.attrsToList cfg);

packages/bluemap.nix

@@ -1,14 +1,12 @@
-{ lib, stdenvNoCC, fetchurl, makeWrapper, javaPackages }:
+{ lib, stdenvNoCC, fetchurl, makeWrapper, jre }:
-let
+
-  jre = javaPackages.compiler.temurin-bin.jre-25;
-in
 stdenvNoCC.mkDerivation rec {
   pname = "bluemap";
-  version = "5.20";
+  version = "5.15";
 
   src = fetchurl {
     url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
-    hash = "sha256-txDN/vG429BHT09TrSB8uQhmB8irrmvvOXX4OX3OSC0=";
+    hash = "sha256-g50V/4LtHaHNRMTt+PK/ZTf4Tber2D6ZHJvuAXQLaFI=";
   };
 
   dontUnpack = true;
@@ -17,10 +15,7 @@ stdenvNoCC.mkDerivation rec {
 
   installPhase = ''
     runHook preInstall
-
+    makeWrapper ${jre}/bin/java $out/bin/bluemap --add-flags "-jar $src"
-    makeWrapper ${jre}/bin/java $out/bin/bluemap \
-      --add-flags "-jar $src"
-
     runHook postInstall
   '';
 

packages/mediawiki-extensions/default.nix

@@ -12,7 +12,7 @@ let
     name
   , commit
   , hash
-  , tracking-branch ? "REL1_45"
+  , tracking-branch ? "REL1_44"
   , kebab-name ? kebab-case-name name
   , fetchgit ? pkgs.fetchgit
   }:
@@ -33,68 +33,63 @@ in
 lib.mergeAttrsList [
   (mw-ext {
     name = "CodeEditor";
-    commit = "af7e82f24ba4b68393712fece6f1b5fa4bb049ec";
+    commit = "83e1d0c13f34746f0d7049e38b00e9ab0a47c23f";
-    hash = "sha256-XT8E4O6MEZYHSs6Q+A/dfYaUvJ4kY13Kd/cq30dA5NA=";
+    hash = "sha256-qH9fSQZGA+z6tBSh1DaTKLcujqA6K/vQmZML9w5X8mU=";
   })
   (mw-ext {
     name = "CodeMirror";
-    commit = "7ab826eff8c4097589a3199c40c507717af23234";
+    commit = "af2b08b9ad2b89a64b2626cf80b026c5b45e9922";
-    hash = "sha256-kMIyGW9J4OSGSetByel7hEGgxPRJmQ53it6ndpYA/Hs=";
+    hash = "sha256-CxXPwCKUlF9Tg4JhwLaKQyvt43owq75jCugVtb3VX+I=";
   })
   (mw-ext {
     name = "DeleteBatch";
-    commit = "b5920283cfe78b86a63a1037a81651c58ce764da";
+    commit = "3d6f2fd0e3efdae1087dd0cc8b1f96fe0edf734f";
-    hash = "sha256-LwuVX2s5Q4uc6o7hlTjFzRTwvSCwTk74gBpX0HoLDMA=";
+    hash = "sha256-iD9EjDIW7AGpZan74SIRcr54dV8W7xMKIDjatjdVkKs=";
-  })
-  (mw-ext {
-    name = "PdfHandler";
-    commit = "dc1a3ca04ac6ec7d7de7ce5355803510508a2575";
-    hash = "sha256-ltAQZtfTMMLRPATA7rclSNW8Yz4ctGc30CxlL3SRBWU=";
   })
   (mw-ext {
     name = "PluggableAuth";
-    commit = "4b57a23e32d72bd3f74184ff2734aa483a5b0c63";
+    commit = "85e96acd1ac0ebcdaa29c20eae721767a938f426";
-    hash = "sha256-ZGw0Wgz0Sg04YDcOzkOGywmfQ6s6Ex17QbjmUDO1D8c=";
+    hash = "sha256-bMVhrg8FsfWhXF605Cj5TgI0A6Jy/MIQ5aaUcLQQ0Ss=";
   })
   (mw-ext {
     name = "Popups";
-    commit = "f74a8639f57232898978d9f3792293eb2d370e40";
+    commit = "410e2343c32a7b18dcdc2bbd995b0bfdf3bf5f37";
-    hash = "sha256-uunUtN3M/ksW/kcbeIzDVTdb1P/PHTeTwaTsvspMLko=";
+    hash = "sha256-u2AlR75x54rCpiK9Mz00D9odJCn8fmi6DRU4QKmKqSc=";
   })
   (mw-ext {
     name = "Scribunto";
-    commit = "35c85c96167922adc98e62dd6573789d906dd7d7";
+    commit = "904f323f343dba5ff6a6cdd143c4a8ef5b7d2c55";
-    hash = "sha256-FEWADJW53cDOlLseM62VL66PENv/jNnwuCMo2Pb02ek=";
+    hash = "sha256-ZOVYhjMMyWbqwZOBb39hMIRmzzCPEnz2y8Q2jgyeERw=";
   })
   (mw-ext {
     name = "SimpleSAMLphp";
     kebab-name = "simple-saml-php";
-    commit = "70778bb02f972abbb51e6ba3e0f6545b00dcab00";
+    commit = "a2f77374713473d594e368de24539aebcc1a800a";
-    hash = "sha256-wfmFJKy+ih84qFM9DVcCQFAZBx45s7Hl0lRnseMPhGY=";
+    hash = "sha256-5+t3VQFKcrIffDNPJ4RWBIWS6K1gTOcEleYWmM6xWms=";
   })
   (mw-ext {
     name = "TemplateData";
-    commit = "cca3b3430067f2161bf65de822f70dd38fe07bba";
+    commit = "76a6a04bd13a606923847ba68750b5d98372cacd";
-    hash = "sha256-OxLwiF8FlWizkpDF9GXYfjehKtrltX8ihiCE+fNJpgw=";
+    hash = "sha256-X2+U5PMqzkSljw2ypIvJUSaPDaonTkQx89OgKzf5scw=";
   })
   (mw-ext {
     name = "TemplateStyles";
-    commit = "101a159dd0190759a16551a86800144c18b6ff5c";
+    commit = "7de60a8da6576d7930f293d19ef83529abf52704";
-    hash = "sha256-IGQQVAx8/76ivHq9b97ec1AlFoqbRl7uhXhwoFimsG4=";
+    hash = "sha256-iPmFDoO5V4964CVyd1mBSQcNlW34odbvpm2CfDBlPBU=";
   })
   (mw-ext {
     name = "UserMerge";
-    commit = "6c0d105e07538c34bfde989bd26fa1945f8d1b79";
+    commit = "71eb53ff4289ac4efaa31685ab8b6483c165a584";
-    hash = "sha256-w058Ihk0I98hIG1tkVJGy1bzbv7XXyUksGexXgCN540=";
+    hash = "sha256-OfKSEPgctfr659oh5jf99T0Rzqn+60JhNaZq+2gfubk=";
   })
   (mw-ext {
     name = "VisualEditor";
-    commit = "8d8c6d7f179a5f799e1fa8cba207d81f58f722d2";
+    commit = "a6a63f53605c4d596c3df1dcc2583ffd3eb8d929";
-    hash = "sha256-wbYHXi2vD521EMzUl7ttinG4YdLv/DwYvVUew7dka0g=";
+    hash = "sha256-4d8picO66uzKoxh1TdyvKLHebc6ZL7N2DdXLV2vgBL4=";
   })
   (mw-ext {
     name = "WikiEditor";
-    commit = "f53000f0499858fe74e4f5008b2f5e467d9d9382";
+    commit = "0a5719bb95326123dd0fee1f88658358321ed7be";
-    hash = "sha256-+HTXZEVCwMD8z6c1kCZA3k686HzNd30pJljzRvf+gMg=";
+    hash = "sha256-eQMyjhdm1E6TkktIHad1NMeMo8QNoO8z4A05FYOMCwQ=";
   })
 ]

packages/mediawiki-extensions/update-mediawiki-extensions.py

@@ -83,7 +83,7 @@ def get_newest_commit(project_name: str, tracking_branch: str) -> str:
     content = requests.get(f"{BASE_WEB_URL}/{project_name}/+log/refs/heads/{tracking_branch}/").text
     soup = bs4.BeautifulSoup(content, features="html.parser")
     try:
-        a = soup.find('li').find('a')
+        a = soup.find('li').findChild('a')
         commit_sha = a['href'].split('/')[-1]
     except AttributeError:
         print(f"ERROR: Could not parse page for {project_name}:")