Compare commits
4 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 oysteikt
|
7434f11922
|
||
|
oysteikt
|
9d1b0bc345
|
||
|
oysteikt
|
897f1244b6
|
||
|
oysteikt
|
3f1c470059
|
@@ -173,7 +173,6 @@
|
||||
sops-nix.nixosModules.sops
|
||||
inputs.roowho2.nixosModules.default
|
||||
self.nixosModules.rsync-pull-targets
|
||||
self.nixosModules.python-http-handlers
|
||||
])
|
||||
++ modules;
|
||||
}
|
||||
@@ -307,14 +306,13 @@
|
||||
|
||||
nixosModules = {
|
||||
bluemap = ./modules/bluemap.nix;
|
||||
drumknotty = ./modules/drumknotty;
|
||||
gickup = ./modules/gickup;
|
||||
matrix-ooye = ./modules/matrix-ooye.nix;
|
||||
python-http-handlers = ./modules/python-http-handlers.nix;
|
||||
robots-txt = ./modules/robots-txt.nix;
|
||||
rsync-pull-targets = ./modules/rsync-pull-targets.nix;
|
||||
snakeoil-certs = ./modules/snakeoil-certs.nix;
|
||||
snappymail = ./modules/snappymail.nix;
|
||||
drumknotty = ./modules/drumknotty;
|
||||
};
|
||||
|
||||
devShells = forAllSystems (system: {
|
||||
|
||||
@@ -2,10 +2,10 @@
|
||||
|
||||
{
|
||||
imports = [
|
||||
./gatus
|
||||
./grafana.nix
|
||||
./loki.nix
|
||||
./prometheus
|
||||
./scrutiny.nix
|
||||
./uptime-kuma.nix
|
||||
];
|
||||
}
|
||||
|
||||
@@ -1,155 +0,0 @@
|
||||
{ config, lib, ... }:
|
||||
let
|
||||
cfg = config.services.gatus;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./minecraft-checker.nix
|
||||
];
|
||||
|
||||
services.gatus = {
|
||||
enable = true;
|
||||
|
||||
settings = {
|
||||
web = {
|
||||
address = "127.0.0.1";
|
||||
port = 19283;
|
||||
};
|
||||
|
||||
storage = {
|
||||
type = "sqlite";
|
||||
path = "/var/lib/gatus/data.db";
|
||||
};
|
||||
|
||||
ui = {
|
||||
title = "PVV Nede!?";
|
||||
header = "😭😭😭";
|
||||
dashboard-heading = "PVV Nede!?";
|
||||
dashboard-subheading = "Kan noen ringe drift?";
|
||||
};
|
||||
|
||||
endpoints = let
|
||||
mkMachine = name: {
|
||||
inherit name;
|
||||
group = "Machines";
|
||||
url = "icmp://${name}.pvv.ntnu.no";
|
||||
conditions = [
|
||||
"[CONNECTED] == true"
|
||||
];
|
||||
};
|
||||
|
||||
mkWebsite = name: url: {
|
||||
inherit name url;
|
||||
group = "Websites";
|
||||
method = "GET";
|
||||
conditions = [
|
||||
"[STATUS] == 200"
|
||||
];
|
||||
};
|
||||
|
||||
mkService = name: url: {
|
||||
inherit name url;
|
||||
group = "Services";
|
||||
conditions = [
|
||||
"[CONNECTED] == true"
|
||||
];
|
||||
};
|
||||
in (lib.sortOn (m: m.name) [
|
||||
(mkMachine "ambidextrous")
|
||||
(mkMachine "bekkalokk")
|
||||
(mkMachine "bicep")
|
||||
(mkMachine "bikkje")
|
||||
(mkMachine "brzeczyszczykiewicz")
|
||||
(mkMachine "georg")
|
||||
(mkMachine "gluttony")
|
||||
(mkMachine "ildkule")
|
||||
(mkMachine "kana")
|
||||
(mkMachine "kommode")
|
||||
(mkMachine "lupine-1")
|
||||
(mkMachine "lupine-2")
|
||||
(mkMachine "lupine-3")
|
||||
(mkMachine "lupine-4")
|
||||
(mkMachine "lupine-5")
|
||||
(mkMachine "skrot")
|
||||
(mkMachine "temmie")
|
||||
(mkMachine "wenche")
|
||||
|
||||
(mkMachine "balduzius")
|
||||
(mkMachine "blossom")
|
||||
(mkMachine "bubbles")
|
||||
(mkMachine "buskerud")
|
||||
(mkMachine "buttercup")
|
||||
(mkMachine "demiurgen")
|
||||
(mkMachine "drolsum")
|
||||
(mkMachine "hildring")
|
||||
(mkMachine "innovation")
|
||||
(mkMachine "isvegg")
|
||||
(mkMachine "knutsen")
|
||||
(mkMachine "ludvigsen" // {
|
||||
url = "icmp://ludvigsen-tap.pvv.ntnu.no";
|
||||
})
|
||||
(mkMachine "microbel")
|
||||
(mkMachine "mirage")
|
||||
(mkMachine "orchid")
|
||||
(mkMachine "principal")
|
||||
(mkMachine "sleipner")
|
||||
(mkMachine "smask")
|
||||
(mkMachine "tom")
|
||||
(mkMachine "wegonke")
|
||||
]) ++ [
|
||||
(mkWebsite "Bluemap" "https://minecraft.pvv.ntnu.no")
|
||||
(mkWebsite "Element Web" "https://chat.pvv.ntnu.no")
|
||||
(mkWebsite "Gitea" "https://git.pvv.ntnu.no/api/healthz" // {
|
||||
conditions = [
|
||||
"[STATUS] == 200"
|
||||
"[BODY].status == pass"
|
||||
];
|
||||
})
|
||||
(mkWebsite "Grafana" "https://grafana.pvv.ntnu.no/api/health" // {
|
||||
conditions = [
|
||||
"[STATUS] == 200"
|
||||
"[BODY].database == ok"
|
||||
];
|
||||
})
|
||||
(mkWebsite "Grzegorz - Brzeczyszczykiewicz" "https://brzeczyszczykiewicz.pvv.ntnu.no")
|
||||
(mkWebsite "Grzegorz - Georg" "https://georg.pvv.ntnu.no")
|
||||
(mkWebsite "IDP" "https://idp.pvv.ntnu.no")
|
||||
(mkWebsite "Mailing Lists" "http://list.pvv.ntnu.no")
|
||||
(mkWebsite "Mapcrafter" "http://isvegg.pvv.ntnu.no/kart")
|
||||
(mkWebsite "PVV-Nettsiden" "https://www.pvv.ntnu.no")
|
||||
(mkWebsite "Roundcube" "https://webmail.pvv.ntnu.no/roundcube")
|
||||
(mkWebsite "Scrutiny" "https://scrutiny.pvv.ntnu.no")
|
||||
(mkWebsite "Snappymail" "http://snappymail.pvv.ntnu.no")
|
||||
(mkWebsite "Userweb - Temmie" "https://temmie.pvv.ntnu.no/~oysteikt")
|
||||
(mkWebsite "Userweb - Tom" "https://www.pvv.ntnu.no/~oysteikt")
|
||||
(mkWebsite "Vaultwarden" "https://pw.pvv.ntnu.no/alive")
|
||||
(mkWebsite "Wiki" "https://wiki.pvv.ntnu.no/w/api.php?action=query&format=json")
|
||||
|
||||
(mkService "Gitea SSH" "ssh://git.pvv.ntnu.no:2222")
|
||||
(mkService "QoTD" "tcp://bekkalokk.pvv.ntnu.no:17")
|
||||
(mkService "Minecraft" "http://localhost:1337" // {
|
||||
conditions = [
|
||||
"[STATUS] == 200"
|
||||
"[BODY].ok == true"
|
||||
];
|
||||
})
|
||||
(mkService "Email (SMTP)" "starttls://mail.pvv.ntnu.no:587")
|
||||
(mkService "Email (POP3)" "tls://mail.pvv.ntnu.no:995")
|
||||
(mkService "Email (IMAP)" "tls://mail.pvv.ntnu.no:993")
|
||||
(mkService "Matrix Synapse" "https://matrix.pvv.ntnu.no/_matrix/client/versions" // {
|
||||
method = "GET";
|
||||
conditions = [
|
||||
"[STATUS] == 200"
|
||||
];
|
||||
})
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."status.pvv.ntnu.no" = lib.mkIf cfg.enable {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
kTLS = true;
|
||||
locations."/".proxyPass = "http://localhost:${toString cfg.settings.web.port}";
|
||||
};
|
||||
}
|
||||
@@ -1,40 +0,0 @@
|
||||
{ lib, pkgs, ... }:
|
||||
{
|
||||
services.python-http-handlers."gatus-minecraft-checker" = {
|
||||
listenStreams = [ "127.0.0.1:1337" ];
|
||||
libraries = with pkgs.python3Packages; [
|
||||
mcstatus
|
||||
];
|
||||
handler = ''
|
||||
import json
|
||||
from mcstatus import JavaServer
|
||||
|
||||
class Handler(BaseHTTPRequestHandler):
|
||||
def do_GET(self):
|
||||
try:
|
||||
mcserver = JavaServer.lookup("minecraft.pvv.ntnu.no")
|
||||
status = mcserver.status()
|
||||
|
||||
body = {
|
||||
"ok": True,
|
||||
"players": status.players.online,
|
||||
"version": status.version.name,
|
||||
"latency": status.latency,
|
||||
}
|
||||
|
||||
data = json.dumps(body).encode()
|
||||
|
||||
self.send_response(200)
|
||||
self.send_header("Content-Type", "application/json")
|
||||
self.send_header("Content-Length", str(len(data)))
|
||||
self.end_headers()
|
||||
self.wfile.write(data)
|
||||
|
||||
except Exception as e:
|
||||
data = json.dumps({"ok": False, "error": str(e)}).encode()
|
||||
self.send_response(500)
|
||||
self.end_headers()
|
||||
self.wfile.write(data)
|
||||
'';
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
{ config, pkgs, lib, values, ... }:
|
||||
let
|
||||
cfg = config.services.uptime-kuma;
|
||||
domain = "status.pvv.ntnu.no";
|
||||
stateDir = "/data/monitoring/uptime-kuma";
|
||||
in {
|
||||
services.uptime-kuma = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PORT = "5059";
|
||||
HOST = "127.0.1.2";
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts.${domain} = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
kTLS = true;
|
||||
locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/private/uptime-kuma" = {
|
||||
device = stateDir;
|
||||
fsType = "bind";
|
||||
options = [ "bind" ];
|
||||
};
|
||||
|
||||
services.rsync-pull-targets = {
|
||||
enable = true;
|
||||
locations.${stateDir} = {
|
||||
user = "root";
|
||||
rrsyncArgs.ro = true;
|
||||
authorizedKeysAttrs = [
|
||||
"restrict"
|
||||
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
|
||||
"no-agent-forwarding"
|
||||
"no-port-forwarding"
|
||||
"no-pty"
|
||||
"no-X11-forwarding"
|
||||
];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXzcDm6cVr4NmWzUSroy33FlielKqaG83wY0RCMC0p/ uptime_kuma rsync backup";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -28,10 +28,8 @@ in
|
||||
|
||||
services.openvpn.servers."ov-tunnel" = {
|
||||
config = renderConfig {
|
||||
mode = "server";
|
||||
|
||||
# TODO: use aliases
|
||||
local = "0.0.0.0";
|
||||
local = values.services.knutsen-vpn;
|
||||
port = 1194;
|
||||
proto = "udp";
|
||||
|
||||
@@ -65,6 +63,7 @@ in
|
||||
];
|
||||
|
||||
keepalive = "10 120";
|
||||
data-ciphers = "none";
|
||||
|
||||
user = "nobody";
|
||||
group = "nobody";
|
||||
@@ -85,17 +84,9 @@ in
|
||||
persist-key = true;
|
||||
persist-tun = true;
|
||||
|
||||
tls-version-min = "1.2";
|
||||
tls-version-max = "1.2";
|
||||
|
||||
verb = 5;
|
||||
|
||||
explicit-exit-notify = 1;
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
allowedTCPPorts = [ 1194 ];
|
||||
allowedUDPPorts = [ 1194 ];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,224 +0,0 @@
|
||||
{ config, options, lib, pkgs, utils, ... }:
|
||||
let
|
||||
cfg = config.services.python-http-handlers;
|
||||
in
|
||||
{
|
||||
options.services.python-http-handlers = lib.mkOption {
|
||||
default = { };
|
||||
type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
|
||||
options = {
|
||||
enable = lib.mkEnableOption "" // {
|
||||
default = true;
|
||||
description = "Whether to enable this python HTTP handler.";
|
||||
};
|
||||
|
||||
name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "phh-${name}";
|
||||
defaultText = "phh-<name>";
|
||||
description = ''
|
||||
The name of this HTTP handler.
|
||||
|
||||
This will be used for the systemd service among other things.
|
||||
'';
|
||||
};
|
||||
|
||||
listenStreams = lib.mkOption {
|
||||
type = with lib.types; listOf str;
|
||||
default = [
|
||||
"/run/phh-${name}.socket"
|
||||
];
|
||||
defaultText = lib.literalExpression ''
|
||||
[
|
||||
"/run/phh-<name>.socket"
|
||||
]
|
||||
'';
|
||||
description = ''
|
||||
For each item in this list, a `ListenStream`
|
||||
option in the `[Socket]` section will be created.
|
||||
'';
|
||||
};
|
||||
|
||||
socketConfig = lib.mkOption {
|
||||
type = utils.systemdUtils.unitOptions.unitOption;
|
||||
default = { };
|
||||
description = ''
|
||||
Config for the systemd socket's `[Socket]` section.
|
||||
|
||||
See {manpage}`systemd.socket(5)` for details.
|
||||
'';
|
||||
};
|
||||
|
||||
serviceConfig = lib.mkOption {
|
||||
type = utils.systemdUtils.unitOptions.unitOption;
|
||||
default = { };
|
||||
description = ''
|
||||
Config for the systemd service's `[Service]` section.
|
||||
|
||||
See {manpage}`systemd.exec(5)` and {manpage}`systemd.service(5)` for details.
|
||||
'';
|
||||
};
|
||||
|
||||
enableDefaultHardening = lib.mkEnableOption "" // {
|
||||
default = true;
|
||||
description = ''
|
||||
Whether to enable a set of recommended systemd hardening directives.
|
||||
|
||||
If this breaks the service, you can either override the offending directives
|
||||
through {option}`serviceConfig`, or disable this option altogether.
|
||||
'';
|
||||
};
|
||||
|
||||
libraries = lib.mkOption {
|
||||
type = with lib.types; listOf package;
|
||||
default = [ ];
|
||||
example = lib.literalExpression ''
|
||||
with pkgs.python3Packages; [
|
||||
matplotlib
|
||||
numpy
|
||||
pillow
|
||||
]
|
||||
'';
|
||||
description = ''
|
||||
Extra python libraries to make available to the service.
|
||||
'';
|
||||
};
|
||||
|
||||
flakeIgnore = lib.mkOption {
|
||||
type = with lib.types; listOf str;
|
||||
default = [
|
||||
"E111" # indentation is not a multiple of four
|
||||
"E201" # whitespace after (
|
||||
"E202" # whitespace after )
|
||||
"E203" # whitespace before :
|
||||
"E211" # whitespace before (
|
||||
"E251" # unexpected spaces around keyword / parameter equals
|
||||
"E301" # expected 1 blank line, found 0
|
||||
"E302" # expected 2 blank lines, found 0
|
||||
"E303" # too many blank lines
|
||||
"E305" # expected 2 blank lines after end of function or class
|
||||
"E306" # expected 1 blank line before a nested definition
|
||||
"E501" # max line length
|
||||
"E704" # multiple statements on one line (def)
|
||||
];
|
||||
description = ''
|
||||
A list of flake8 rules to ignore while linting the python code.
|
||||
|
||||
An opinionated list of bogus rules (according to module author) is provided as default.
|
||||
'';
|
||||
};
|
||||
|
||||
handler = lib.mkOption {
|
||||
type = lib.types.lines;
|
||||
default = ''
|
||||
import json
|
||||
|
||||
class Handler(BaseHTTPRequestHandler):
|
||||
def do_GET(self):
|
||||
body = {"ok": True}
|
||||
data = json.dumps(body).encode()
|
||||
self.send_response(200)
|
||||
self.send_header("Content-Type", "application/json")
|
||||
self.send_header("Content-Length", str(len(data)))
|
||||
self.end_headers()
|
||||
self.wfile.write(data)
|
||||
'';
|
||||
description = ''
|
||||
Python code including the HTTP handler for the server.
|
||||
|
||||
You can include as many imports and functions as you'd like here, but you will need
|
||||
to at least provide a `class Handler(BaseHTTPRequestHandler)` to handle incoming HTTP requests.
|
||||
'';
|
||||
};
|
||||
};
|
||||
}));
|
||||
};
|
||||
|
||||
config = {
|
||||
systemd.sockets = lib.pipe cfg [
|
||||
lib.attrValues
|
||||
(lib.filter (v: v.enable))
|
||||
(vs: lib.genAttrs' vs (v: {
|
||||
inherit (v) name;
|
||||
value = {
|
||||
wantedBy = [ "sockets.target" ];
|
||||
inherit (v) listenStreams;
|
||||
socketConfig = {
|
||||
Accept = false;
|
||||
} // v.socketConfig;
|
||||
};
|
||||
}))
|
||||
];
|
||||
|
||||
systemd.services = lib.pipe cfg [
|
||||
lib.attrValues
|
||||
(lib.filter (v: v.enable))
|
||||
(vs: lib.genAttrs' vs (v: {
|
||||
inherit (v) name;
|
||||
value = {
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
DynamicUser = true;
|
||||
|
||||
ExecStart = let
|
||||
package = pkgs.writers.writePython3Bin "${v.name}-bin" {
|
||||
inherit (v) libraries flakeIgnore;
|
||||
} ''
|
||||
import socket
|
||||
from http.server import HTTPServer, BaseHTTPRequestHandler
|
||||
|
||||
${v.handler}
|
||||
|
||||
class NoBindHTTPServer(HTTPServer):
|
||||
def server_bind(): pass
|
||||
def server_activate(): pass
|
||||
|
||||
def main():
|
||||
httpd = NoBindHTTPServer(
|
||||
("", 0),
|
||||
Handler,
|
||||
bind_and_activate=False,
|
||||
)
|
||||
httpd.socket = socket.fromfd(3, socket.AF_INET, socket.SOCK_STREAM)
|
||||
httpd.serve_forever()
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
'';
|
||||
in lib.getExe package;
|
||||
} // (lib.optionalAttrs v.enableDefaultHardening {
|
||||
AmbientCapabilities = [ "" ];
|
||||
CapabilityBoundingSet = [ "" ];
|
||||
DeviceAllow = [ "" ];
|
||||
LockPersonality = true;
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateTmp = true;
|
||||
ProcSubset = "pid";
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
ProtectSystem = "strict";
|
||||
RemoveIPC = true;
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SocketBindDeny = "any";
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@privileged"
|
||||
"~@resources"
|
||||
];
|
||||
UMask = "0077";
|
||||
}) // v.serviceConfig;
|
||||
};
|
||||
}))
|
||||
];
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user