fixup! sops/lupine: add CA + 2 keypairs for OpenVPN

flake.nix

@@ -173,7 +173,6 @@
                 sops-nix.nixosModules.sops
                 inputs.roowho2.nixosModules.default
                 self.nixosModules.rsync-pull-targets
-                self.nixosModules.python-http-handlers
               ])
               ++ modules;
           }
@@ -307,14 +306,13 @@
 
     nixosModules = {
       bluemap = ./modules/bluemap.nix;
-      drumknotty = ./modules/drumknotty;
       gickup = ./modules/gickup;
       matrix-ooye = ./modules/matrix-ooye.nix;
-      python-http-handlers = ./modules/python-http-handlers.nix;
       robots-txt = ./modules/robots-txt.nix;
       rsync-pull-targets = ./modules/rsync-pull-targets.nix;
       snakeoil-certs = ./modules/snakeoil-certs.nix;
       snappymail = ./modules/snappymail.nix;
+      drumknotty = ./modules/drumknotty;
     };
 
     devShells = forAllSystems (system: {

hosts/ildkule/services/monitoring/default.nix

@@ -2,10 +2,10 @@
 
 {
   imports = [
-    ./gatus
     ./grafana.nix
     ./loki.nix
     ./prometheus
     ./scrutiny.nix
+    ./uptime-kuma.nix
   ];
 }

hosts/ildkule/services/monitoring/gatus/default.nix

@@ -1,155 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.services.gatus;
-in
-{
-  imports = [
-    ./minecraft-checker.nix
-  ];
-
-  services.gatus = {
-    enable = true;
-
-    settings = {
-      web = {
-        address = "127.0.0.1";
-        port = 19283;
-      };
-
-      storage = {
-        type = "sqlite";
-        path = "/var/lib/gatus/data.db";
-      };
-
-      ui = {
-        title = "PVV Nede!?";
-        header = "😭😭😭";
-        dashboard-heading = "PVV Nede!?";
-        dashboard-subheading = "Kan noen ringe drift?";
-      };
-
-      endpoints = let
-        mkMachine = name: {
-          inherit name;
-          group = "Machines";
-          url = "icmp://${name}.pvv.ntnu.no";
-          conditions = [
-            "[CONNECTED] == true"
-          ];
-        };
-
-        mkWebsite = name: url: {
-          inherit name url;
-          group = "Websites";
-          method = "GET";
-          conditions = [
-            "[STATUS] == 200"
-          ];
-        };
-
-        mkService = name: url: {
-          inherit name url;
-          group = "Services";
-          conditions = [
-            "[CONNECTED] == true"
-          ];
-        };
-      in (lib.sortOn (m: m.name) [
-        (mkMachine "ambidextrous")
-        (mkMachine "bekkalokk")
-        (mkMachine "bicep")
-        (mkMachine "bikkje")
-        (mkMachine "brzeczyszczykiewicz")
-        (mkMachine "georg")
-        (mkMachine "gluttony")
-        (mkMachine "ildkule")
-        (mkMachine "kana")
-        (mkMachine "kommode")
-        (mkMachine "lupine-1")
-        (mkMachine "lupine-2")
-        (mkMachine "lupine-3")
-        (mkMachine "lupine-4")
-        (mkMachine "lupine-5")
-        (mkMachine "skrot")
-        (mkMachine "temmie")
-        (mkMachine "wenche")
-
-        (mkMachine "balduzius")
-        (mkMachine "blossom")
-        (mkMachine "bubbles")
-        (mkMachine "buskerud")
-        (mkMachine "buttercup")
-        (mkMachine "demiurgen")
-        (mkMachine "drolsum")
-        (mkMachine "hildring")
-        (mkMachine "innovation")
-        (mkMachine "isvegg")
-        (mkMachine "knutsen")
-        (mkMachine "ludvigsen" // {
-          url = "icmp://ludvigsen-tap.pvv.ntnu.no";
-        })
-        (mkMachine "microbel")
-        (mkMachine "mirage")
-        (mkMachine "orchid")
-        (mkMachine "principal")
-        (mkMachine "sleipner")
-        (mkMachine "smask")
-        (mkMachine "tom")
-        (mkMachine "wegonke")
-      ]) ++ [
-        (mkWebsite "Bluemap" "https://minecraft.pvv.ntnu.no")
-        (mkWebsite "Element Web" "https://chat.pvv.ntnu.no")
-        (mkWebsite "Gitea" "https://git.pvv.ntnu.no/api/healthz" // {
-          conditions = [
-            "[STATUS] == 200"
-            "[BODY].status == pass"
-          ];
-        })
-        (mkWebsite "Grafana" "https://grafana.pvv.ntnu.no/api/health" // {
-          conditions = [
-            "[STATUS] == 200"
-            "[BODY].database == ok"
-          ];
-        })
-        (mkWebsite "Grzegorz - Brzeczyszczykiewicz" "https://brzeczyszczykiewicz.pvv.ntnu.no")
-        (mkWebsite "Grzegorz - Georg" "https://georg.pvv.ntnu.no")
-        (mkWebsite "IDP" "https://idp.pvv.ntnu.no")
-        (mkWebsite "Mailing Lists" "http://list.pvv.ntnu.no")
-        (mkWebsite "Mapcrafter" "http://isvegg.pvv.ntnu.no/kart")
-        (mkWebsite "PVV-Nettsiden" "https://www.pvv.ntnu.no")
-        (mkWebsite "Roundcube" "https://webmail.pvv.ntnu.no/roundcube")
-        (mkWebsite "Scrutiny" "https://scrutiny.pvv.ntnu.no")
-        (mkWebsite "Snappymail" "http://snappymail.pvv.ntnu.no")
-        (mkWebsite "Userweb - Temmie" "https://temmie.pvv.ntnu.no/~oysteikt")
-        (mkWebsite "Userweb - Tom" "https://www.pvv.ntnu.no/~oysteikt")
-        (mkWebsite "Vaultwarden" "https://pw.pvv.ntnu.no/alive")
-        (mkWebsite "Wiki" "https://wiki.pvv.ntnu.no/w/api.php?action=query&format=json")
-
-        (mkService "Gitea SSH" "ssh://git.pvv.ntnu.no:2222")
-        (mkService "QoTD" "tcp://bekkalokk.pvv.ntnu.no:17")
-        (mkService "Minecraft" "http://localhost:1337" // {
-          conditions = [
-            "[STATUS] == 200"
-            "[BODY].ok == true"
-          ];
-        })
-        (mkService "Email (SMTP)" "starttls://mail.pvv.ntnu.no:587")
-        (mkService "Email (POP3)" "tls://mail.pvv.ntnu.no:995")
-        (mkService "Email (IMAP)" "tls://mail.pvv.ntnu.no:993")
-        (mkService "Matrix Synapse" "https://matrix.pvv.ntnu.no/_matrix/client/versions" // {
-          method = "GET";
-          conditions = [
-            "[STATUS] == 200"
-          ];
-        })
-      ];
-    };
-  };
-
-  services.nginx.virtualHosts."status.pvv.ntnu.no" = lib.mkIf cfg.enable {
-    enableACME = true;
-    forceSSL = true;
-    kTLS = true;
-    locations."/".proxyPass = "http://localhost:${toString cfg.settings.web.port}";
-  };
-}

hosts/ildkule/services/monitoring/gatus/minecraft-checker.nix

@@ -1,40 +0,0 @@
-{ lib, pkgs, ... }:
-{
-  services.python-http-handlers."gatus-minecraft-checker" = {
-    listenStreams = [ "127.0.0.1:1337" ];
-    libraries = with pkgs.python3Packages; [
-      mcstatus
-    ];
-    handler = ''
-      import json
-      from mcstatus import JavaServer
-
-      class Handler(BaseHTTPRequestHandler):
-          def do_GET(self):
-              try:
-                  mcserver = JavaServer.lookup("minecraft.pvv.ntnu.no")
-                  status = mcserver.status()
-
-                  body = {
-                      "ok": True,
-                      "players": status.players.online,
-                      "version": status.version.name,
-                      "latency": status.latency,
-                  }
-
-                  data = json.dumps(body).encode()
-
-                  self.send_response(200)
-                  self.send_header("Content-Type", "application/json")
-                  self.send_header("Content-Length", str(len(data)))
-                  self.end_headers()
-                  self.wfile.write(data)
-
-              except Exception as e:
-                  data = json.dumps({"ok": False, "error": str(e)}).encode()
-                  self.send_response(500)
-                  self.end_headers()
-                  self.wfile.write(data)
-    '';
-  };
-}

hosts/ildkule/services/monitoring/uptime-kuma.nix

@@ -0,0 +1,44 @@
+{ config, pkgs, lib, values, ... }:
+let
+  cfg = config.services.uptime-kuma;
+  domain = "status.pvv.ntnu.no";
+  stateDir = "/data/monitoring/uptime-kuma";
+in {
+  services.uptime-kuma = {
+    enable = true;
+    settings = {
+      PORT = "5059";
+      HOST = "127.0.1.2";
+    };
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    enableACME = true;
+    forceSSL = true;
+    kTLS = true;
+    locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
+  };
+
+  fileSystems."/var/lib/private/uptime-kuma" = {
+    device = stateDir;
+    fsType = "bind";
+    options = [ "bind" ];
+  };
+
+  services.rsync-pull-targets = {
+    enable = true;
+    locations.${stateDir} = {
+      user = "root";
+      rrsyncArgs.ro = true;
+      authorizedKeysAttrs = [
+        "restrict"
+        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
+        "no-agent-forwarding"
+        "no-port-forwarding"
+        "no-pty"
+        "no-X11-forwarding"
+      ];
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXzcDm6cVr4NmWzUSroy33FlielKqaG83wY0RCMC0p/ uptime_kuma rsync backup";
+    };
+  };
+}

hosts/lupine/services/openvpn.nix

@@ -28,10 +28,8 @@ in
 
   services.openvpn.servers."ov-tunnel" = {
     config = renderConfig {
-      mode = "server";
-
       # TODO: use aliases
-      local = "0.0.0.0";
+      local = values.services.knutsen-vpn;
       port = 1194;
       proto = "udp";
 
@@ -65,6 +63,7 @@ in
       ];
 
       keepalive = "10 120";
+      data-ciphers = "none";
 
       user = "nobody";
       group = "nobody";
@@ -85,17 +84,9 @@ in
       persist-key = true;
       persist-tun = true;
 
-      tls-version-min = "1.2";
-      tls-version-max = "1.2";
-
       verb = 5;
 
       explicit-exit-notify = 1;
     };
   };
-
-  networking.firewall = {
-    allowedTCPPorts = [ 1194 ];
-    allowedUDPPorts = [ 1194 ];
-  };
 }

modules/python-http-handlers.nix

@@ -1,224 +0,0 @@
-{ config, options, lib, pkgs, utils, ... }:
-let
-  cfg = config.services.python-http-handlers;
-in
-{
-  options.services.python-http-handlers = lib.mkOption {
-    default = { };
-    type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
-      options = {
-        enable = lib.mkEnableOption "" // {
-          default = true;
-          description = "Whether to enable this python HTTP handler.";
-        };
-
-        name = lib.mkOption {
-          type = lib.types.str;
-          default = "phh-${name}";
-          defaultText = "phh-<name>";
-          description = ''
-            The name of this HTTP handler.
-
-            This will be used for the systemd service among other things.
-          '';
-        };
-
-        listenStreams = lib.mkOption {
-          type = with lib.types; listOf str;
-          default = [
-            "/run/phh-${name}.socket"
-          ];
-          defaultText = lib.literalExpression ''
-            [
-              "/run/phh-<name>.socket"
-            ]
-          '';
-          description = ''
-            For each item in this list, a `ListenStream`
-            option in the `[Socket]` section will be created.
-          '';
-        };
-
-        socketConfig = lib.mkOption {
-          type = utils.systemdUtils.unitOptions.unitOption;
-          default = { };
-          description = ''
-            Config for the systemd socket's `[Socket]` section.
-
-            See {manpage}`systemd.socket(5)` for details.
-          '';
-        };
-
-        serviceConfig = lib.mkOption {
-          type = utils.systemdUtils.unitOptions.unitOption;
-          default = { };
-          description = ''
-            Config for the systemd service's `[Service]` section.
-
-            See {manpage}`systemd.exec(5)` and {manpage}`systemd.service(5)` for details.
-          '';
-        };
-
-        enableDefaultHardening = lib.mkEnableOption "" // {
-          default = true;
-          description = ''
-            Whether to enable a set of recommended systemd hardening directives.
-
-            If this breaks the service, you can either override the offending directives
-            through {option}`serviceConfig`, or disable this option altogether.
-          '';
-        };
-
-        libraries = lib.mkOption {
-          type = with lib.types; listOf package;
-          default = [ ];
-          example = lib.literalExpression ''
-            with pkgs.python3Packages; [
-              matplotlib
-              numpy
-              pillow
-            ]
-          '';
-          description = ''
-            Extra python libraries to make available to the service.
-          '';
-        };
-
-        flakeIgnore = lib.mkOption {
-          type = with lib.types; listOf str;
-          default = [
-            "E111" # indentation is not a multiple of four
-            "E201" # whitespace after (
-            "E202" # whitespace after )
-            "E203" # whitespace before :
-            "E211" # whitespace before (
-            "E251" # unexpected spaces around keyword / parameter equals
-            "E301" # expected 1 blank line, found 0
-            "E302" # expected 2 blank lines, found 0
-            "E303" # too many blank lines
-            "E305" # expected 2 blank lines after end of function or class
-            "E306" # expected 1 blank line before a nested definition
-            "E501" # max line length
-            "E704" # multiple statements on one line (def)
-          ];
-          description = ''
-            A list of flake8 rules to ignore while linting the python code.
-
-            An opinionated list of bogus rules (according to module author) is provided as default.
-          '';
-        };
-
-        handler = lib.mkOption {
-          type = lib.types.lines;
-          default = ''
-            import json
-
-            class Handler(BaseHTTPRequestHandler):
-                def do_GET(self):
-                    body = {"ok": True}
-                    data = json.dumps(body).encode()
-                    self.send_response(200)
-                    self.send_header("Content-Type", "application/json")
-                    self.send_header("Content-Length", str(len(data)))
-                    self.end_headers()
-                    self.wfile.write(data)
-          '';
-          description = ''
-            Python code including the HTTP handler for the server.
-
-            You can include as many imports and functions as you'd like here, but you will need
-            to at least provide a `class Handler(BaseHTTPRequestHandler)` to handle incoming HTTP requests.
-          '';
-        };
-      };
-    }));
-  };
-
-  config = {
-    systemd.sockets = lib.pipe cfg [
-      lib.attrValues
-      (lib.filter (v: v.enable))
-      (vs: lib.genAttrs' vs (v: {
-        inherit (v) name;
-        value = {
-          wantedBy = [ "sockets.target" ];
-          inherit (v) listenStreams;
-          socketConfig = {
-            Accept = false;
-          } // v.socketConfig;
-        };
-      }))
-    ];
-
-    systemd.services = lib.pipe cfg [
-      lib.attrValues
-      (lib.filter (v: v.enable))
-      (vs: lib.genAttrs' vs (v: {
-        inherit (v) name;
-        value = {
-          serviceConfig = {
-            Type = "simple";
-            DynamicUser = true;
-
-            ExecStart = let
-              package = pkgs.writers.writePython3Bin "${v.name}-bin" {
-                inherit (v) libraries flakeIgnore;
-              } ''
-                import socket
-                from http.server import HTTPServer, BaseHTTPRequestHandler
-
-                ${v.handler}
-
-                class NoBindHTTPServer(HTTPServer):
-                    def server_bind(): pass
-                    def server_activate(): pass
-
-                def main():
-                    httpd = NoBindHTTPServer(
-                        ("", 0),
-                        Handler,
-                        bind_and_activate=False,
-                    )
-                    httpd.socket = socket.fromfd(3, socket.AF_INET, socket.SOCK_STREAM)
-                    httpd.serve_forever()
-
-                if __name__ == '__main__':
-                    main()
-              '';
-            in lib.getExe package;
-          } // (lib.optionalAttrs v.enableDefaultHardening {
-            AmbientCapabilities = [ "" ];
-            CapabilityBoundingSet = [ "" ];
-            DeviceAllow = [ "" ];
-            LockPersonality = true;
-            NoNewPrivileges = true;
-            PrivateDevices = true;
-            PrivateTmp = true;
-            ProcSubset = "pid";
-            ProtectClock = true;
-            ProtectControlGroups = true;
-            ProtectHome = true;
-            ProtectHostname = true;
-            ProtectKernelLogs = true;
-            ProtectKernelModules = true;
-            ProtectKernelTunables = true;
-            ProtectProc = "invisible";
-            ProtectSystem = "strict";
-            RemoveIPC = true;
-            RestrictNamespaces = true;
-            RestrictRealtime = true;
-            RestrictSUIDSGID = true;
-            SocketBindDeny = "any";
-            SystemCallArchitectures = "native";
-            SystemCallFilter = [
-               "@system-service"
-               "~@privileged"
-               "~@resources"
-            ];
-            UMask = "0077";
-          }) // v.serviceConfig;
-        };
-      }))
-    ];
-  };
-}