feat: add radicle to bekkalokk

We don't have any servers with intranet IPs, and we want webhooks that
hook back to kommode to pass through its firewall.

base/default.nix

@@ -1,6 +1,7 @@
 {
   pkgs,
   lib,
+  inputs,
   fp,
   ...
 }:
@@ -35,6 +36,7 @@
     ./services/prometheus-node-exporter.nix
     ./services/prometheus-systemd-exporter.nix
     ./services/roowho2.nix
+    ./services/scrutiny-collector.nix
     ./services/smartd.nix
     ./services/thermald.nix
     ./services/uptimed.nix
@@ -42,6 +44,8 @@
     ./services/userdbd.nix
   ];
 
+  system.nixos.tags = lib.optionals (inputs.self.sourceInfo ? dirtyRev) [ "dirty" ];
+
   boot.tmp.cleanOnBoot = lib.mkDefault true;
   boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
 

base/services/polkit.nix

@@ -6,10 +6,13 @@ in
   security.polkit.enable = true;
 
   environment.etc."polkit-1/rules.d/9-nixos-overrides.rules".text = lib.mkIf cfg.enable ''
-    polkit.addAdminRule(function(action, subject) {
-        if(subject.isInGroup("wheel")) {
-            return ["unix-user:"+subject.user];
-        }
-    });
+    polkit.addRule(function(action, subject) {
+       if (
+           action.id.startsWith("org.freedesktop.systemd1.") &&
+           subject.isInGroup("wheel")
+       ) {
+           return polkit.Result.AUTH_SELF_KEEP;
+         }
+     });
   '';
 }

base/services/scrutiny-collector.nix

@@ -0,0 +1,11 @@
+{ config, ... }:
+{
+  services.scrutiny.collector = {
+    enable = !config.services.qemuGuest.enable;
+    settings = {
+      version = 1;
+      host.id = config.networking.hostName;
+      api.endpoint = "https://scrutiny.pvv.ntnu.no/";
+    };
+  };
+}

flake.lock

@@ -1,5 +1,27 @@
 {
   "nodes": {
+    "bro": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1779629827,
+        "narHash": "sha256-nrlB50/oelB8oFx9DhOoXI5z0VoTZGEA6XxYvkvpqDA=",
+        "ref": "main",
+        "rev": "7d0f35e12e4dec39f981c08fc33515589f41f4a5",
+        "revCount": 3,
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/bro.git"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/bro.git"
+      }
+    },
     "crane": {
       "locked": {
         "lastModified": 1776635034,
@@ -101,7 +123,7 @@
         "nixpkgs": [
           "nixpkgs-unstable"
         ],
-        "rust-overlay": "rust-overlay"
+        "rust-overlay": "rust-overlay_2"
       },
       "locked": {
         "lastModified": 1777019032,
@@ -165,7 +187,7 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "rust-overlay": "rust-overlay_2"
+        "rust-overlay": "rust-overlay_3"
       },
       "locked": {
         "lastModified": 1767906976,
@@ -294,11 +316,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764869785,
-        "narHash": "sha256-FGTIpC7gB4lbeL0bfYzn1Ge0PaCpd7VqWBLhJBx0i4A=",
+        "lastModified": 1779774845,
+        "narHash": "sha256-QJU1J4eupwjRrtvWGzRut0GY3woql92RS9O/acWkJkk=",
         "ref": "main",
-        "rev": "8ce7fb0b1918bdb3d1489a40d73895693955e8b2",
-        "revCount": 23,
+        "rev": "13667cd216db260ab549e6f1b6281aa230d2f9e0",
+        "revCount": 29,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
       },
@@ -315,11 +337,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778960428,
-        "narHash": "sha256-YAs3LbFGlBLJW3xHeoQfTq2GBBXTvuSKl2WXDtloczU=",
+        "lastModified": 1779903528,
+        "narHash": "sha256-4rajaHeBeQ4PjbNSpslE9G3A5mZM1J/64ls+VoufWZo=",
         "ref": "main",
-        "rev": "927748790b1f7159adfe32a3ad9ec01d22e9c5a2",
-        "revCount": 583,
+        "rev": "bba7413a1c611d4918fbef4d3aa55e465ca3f3fb",
+        "revCount": 585,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       },
@@ -352,6 +374,7 @@
     },
     "root": {
       "inputs": {
+        "bro": "bro",
         "dibbler": "dibbler",
         "disko": "disko",
         "gergle": "gergle",
@@ -377,7 +400,7 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "rust-overlay": "rust-overlay_3"
+        "rust-overlay": "rust-overlay_4"
       },
       "locked": {
         "lastModified": 1778600367,
@@ -396,6 +419,27 @@
       }
     },
     "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "bro",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779419951,
+        "narHash": "sha256-dMX0PUslUHPajP6o8FEoRdFv9afq/dec4POR0vVfjK4=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "5b5c521d6cae9ef4aa32f888eb2c0ce595c9be52",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_2": {
       "inputs": {
         "nixpkgs": [
           "greg-ng",
@@ -416,7 +460,7 @@
         "type": "github"
       }
     },
-    "rust-overlay_2": {
+    "rust-overlay_3": {
       "inputs": {
         "nixpkgs": [
           "minecraft-heatmap",
@@ -437,7 +481,7 @@
         "type": "github"
       }
     },
-    "rust-overlay_3": {
+    "rust-overlay_4": {
       "inputs": {
         "nixpkgs": [
           "roowho2",

flake.nix

@@ -47,6 +47,9 @@
 
     qotd.url = "git+https://git.pvv.ntnu.no/Projects/qotd.git?ref=main";
     qotd.inputs.nixpkgs.follows = "nixpkgs";
+
+    bro.url = "git+https://git.pvv.ntnu.no/Projects/bro.git?ref=main";
+    bro.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs = {
@@ -214,7 +217,14 @@
         };
         shark = stableNixosConfig "shark" {};
         wenche = stableNixosConfig "wenche" {};
-        temmie = stableNixosConfig "temmie" {};
+        temmie = stableNixosConfig "temmie" {
+          overlays = [
+            inputs.bro.overlays.default
+          ];
+          modules = [
+            inputs.bro.nixosModules.default
+          ];
+        };
         gluttony = stableNixosConfig "gluttony" {
           overlays = [
             (final: prev: { bluemap = final.callPackage ./packages/bluemap.nix {}; })
@@ -232,20 +242,6 @@
           ];
         };
 
-        grevling = stableNixosConfig "grevling" {
-          modules = [
-            ./hosts/grevling/configuration.nix
-            sops-nix.nixosModules.sops
-          ];
-        };
-
-        tuba = stableNixosConfig "grevling" {
-          modules = [
-            ./hosts/tuba/configuration.nix
-            sops-nix.nixosModules.sops
-          ];
-        };
-
         brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
           modules = [
             inputs.grzegorz-clients.nixosModules.grzegorz-webui

hosts/bekkalokk/configuration.nix

@@ -7,6 +7,7 @@
 
     ./services/alps.nix
     ./services/bluemap.nix
+    ./services/radicle.nix
     ./services/idp-simplesamlphp
     ./services/kerberos.nix
     ./services/mediawiki

hosts/bekkalokk/services/mediawiki/default.nix

@@ -107,6 +107,7 @@ in {
         CodeEditor
         CodeMirror
         DeleteBatch
+        PdfHandler
         PluggableAuth
         Popups
         Scribunto
@@ -181,12 +182,17 @@ in {
       ];
 
       # Misc program paths
-      $wgFFmpegLocation = '${pkgs.ffmpeg}/bin/ffmpeg';
-      $wgExiftool = '${pkgs.exiftool}/bin/exiftool';
-      $wgExiv2Command = '${pkgs.exiv2}/bin/exiv2';
+      $wgFFmpegLocation = '${lib.getExe pkgs.ffmpeg}';
+      $wgExiftool = '${lib.getExe pkgs.exiftool}';
+      $wgExiv2Command = '${lib.getExe pkgs.exiv2}';
       # See https://gist.github.com/sergejmueller/088dce028b6dd120a16e
-      $wgJpegTran = '${pkgs.mozjpeg}/bin/jpegtran';
-      $wgGitBin = '${pkgs.git}/bin/git';
+      $wgJpegTran = '${lib.getExe' pkgs.mozjpeg "jpegtran"}';
+      $wgGitBin = '${lib.getExe pkgs.git}';
+      $wgDiff3 = '${lib.getExe' pkgs.diffutils "diff3"}';
+      $wgDiff = '${lib.getExe' pkgs.diffutils "diff"}';
+
+      $wgUseImageMagick = true;
+      $wgImageMagickConvertCommand = '${lib.getExe pkgs.imagemagick}';
 
       # Debugging
       $wgShowExceptionDetails = false;
@@ -211,6 +217,13 @@ in {
       # EXT:WikiEditor
       $wgWikiEditorRealtimePreview = true;
 
+      # EXT:PdfHandler
+      $wgPdfProcessor = '${lib.getExe pkgs.ghostscript_headless}';
+      $wgPdfPostProcessor = $wgImageMagickConvertCommand;
+      $wgPdfInfo = '${lib.getExe' pkgs.poppler-utils "pdfinfo"}';
+      $wgPdftoText = '${lib.getExe' pkgs.poppler-utils "pdftotext"}';
+
+      # Override key from hardcoded config in nixpkgs
       $wgSecretKey = file_get_contents("${config.sops.secrets."mediawiki/secret-key".path}");
     '';
   };

hosts/bekkalokk/services/radicle.nix

@@ -0,0 +1,42 @@
+{ config, lib, ... }:
+let
+  domain = "dav.pvv.ntnu.no";
+  radicalePort = 5232;
+in {
+  services.radicale = {
+    enable = true;
+
+    settings = {
+      server = {
+        hosts = [ "127.0.0.1:${toString radicalePort}" ];
+      };
+
+      auth = {
+        type = "imap";
+        imap_host = "imap.pvv.ntnu.no";
+        imap_security = "tls";
+      };
+
+      storage = {
+        filesystem_folder = "/var/lib/radicale/collections";
+      };
+    };
+  };
+
+  services.nginx.virtualHosts."${domain}" = {
+    forceSSL = true;
+    enableACME = true;
+    kTLS = true;
+
+    extraConfig = ''
+      client_max_body_size 128M;
+    '';
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString radicalePort}";
+      proxyWebsockets = true;
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ radicalePort ];
+}

hosts/bekkalokk/services/webmail/roundcube.nix

@@ -56,10 +56,10 @@ in
     locations."/roundcube" = {
       tryFiles = "$uri $uri/ =404";
       index = "index.php";
-      root = pkgs.runCommandLocal "roundcube-dir" { } ''
-        mkdir -p $out
-        ln -s ${cfg.package} $out/roundcube
-      '';
+      root = pkgs.linkFarm "roundcube-dir" {
+        roundcube = "${cfg.package}";
+      };
+
       extraConfig = ''
         location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
         # https://wiki.archlinux.org/title/Roundcube

hosts/bekkalokk/services/website/default.nix

@@ -119,6 +119,7 @@ in {
   services.nginx.virtualHosts."pvv.ntnu.no" = {
     globalRedirect = cfg.domainName;
     redirectCode = 307;
+    kTLS = true;
     forceSSL = true;
     useACMEHost = "www.pvv.ntnu.no";
   };
@@ -126,6 +127,7 @@ in {
   services.nginx.virtualHosts."www.pvv.org" = {
     globalRedirect = cfg.domainName;
     redirectCode = 307;
+    kTLS = true;
     forceSSL = true;
     useACMEHost = "www.pvv.ntnu.no";
   };
@@ -133,11 +135,13 @@ in {
   services.nginx.virtualHosts."pvv.org" = {
     globalRedirect = cfg.domainName;
     redirectCode = 307;
+    kTLS = true;
     forceSSL = true;
     useACMEHost = "www.pvv.ntnu.no";
   };
 
   services.nginx.virtualHosts.${cfg.domainName} = {
+    kTLS = true;
     locations = {
       # Proxy home directories
       "^~ /~" = {

hosts/bekkalokk/services/website/fetch-gallery.nix

@@ -37,47 +37,56 @@ in {
   };
 
   systemd.services.pvv-nettsiden-gallery-update = {
-    path = with pkgs; [ imagemagick gnutar gzip ];
-
-    script = ''
-      tar ${lib.cli.toCommandLineShellGNU { } {
-        extract = true;
-        file = "${transferDir}/gallery.tar.gz";
-        directory = ".";
-      }}
-
-      # Delete files and directories that exists in the gallery that don't exist in the tarball
-      filesToRemove=$(uniq -u <(sort <(find . -not -path './.thumbnails*') <(tar -tf '${transferDir}/gallery.tar.gz' | sed 's|/$||')))
-      while IFS= read -r fname; do
-        rm -f "$fname" ||:
-        rm -f ".thumbnails/$fname.png" ||:
-      done <<< "$filesToRemove"
-
-      find . -type d -empty -delete
-
-      mkdir -p .thumbnails
-      images=$(find . -type f -not -path './.thumbnails*')
-
-      while IFS= read -r fname; do
-        # Skip this file if an up-to-date thumbnail already exists
-        if [ -f ".thumbnails/$fname.png" ] && \
-          [ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
-        then
-          continue
-        fi
-
-        echo "Creating thumbnail for $fname"
-        mkdir -p "$(dirname ".thumbnails/$fname")"
-        magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
-        touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
-      done <<< "$images"
-    '';
-
     serviceConfig = {
       WorkingDirectory = galleryDir;
       User = config.services.pvv-nettsiden.user;
       Group = config.services.pvv-nettsiden.group;
 
+      ExecStart = lib.getExe (pkgs.writeShellApplication {
+        name = "pvv-nettsiden-gallery-update-exec-start.sh";
+        runtimeInputs = with pkgs; [
+          coreutils
+          findutils
+          gnused
+          gnutar
+          gzip
+          imagemagick
+        ];
+        text = ''
+          tar ${lib.cli.toCommandLineShellGNU { } {
+            extract = true;
+            file = "${transferDir}/gallery.tar.gz";
+            directory = ".";
+          }}
+
+          # Delete files and directories that exists in the gallery that don't exist in the tarball
+          filesToRemove="$(uniq -u <(sort <(find . -not -path './.thumbnails*') <(tar -tf '${transferDir}/gallery.tar.gz' | sed 's|/$||')))"
+          while IFS= read -r fname; do
+            rm -f "$fname" ||:
+            rm -f ".thumbnails/$fname.png" ||:
+          done <<< "$filesToRemove"
+
+          find . -type d -empty -delete
+
+          mkdir -p .thumbnails
+          images="$(find . -type f -not -path './.thumbnails*')"
+
+          while IFS= read -r fname; do
+            # Skip this file if an up-to-date thumbnail already exists
+            if [ -f ".thumbnails/$fname.png" ] && \
+              [ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
+            then
+              continue
+            fi
+
+            echo "Creating thumbnail for $fname"
+            mkdir -p "$(dirname ".thumbnails/$fname")"
+            magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
+            touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
+          done <<< "$images"
+        '';
+      });
+
       AmbientCapabilities = [ "" ];
       CapabilityBoundingSet = [ "" ];
       DeviceAllow = [ "" ];

hosts/bicep/services/git-mirrors/default.nix

@@ -83,6 +83,7 @@ in
   };
 
   services.nginx.virtualHosts."mirrors.pvv.ntnu.no" = {
+    kTLS = true;
     forceSSL = true;
     enableACME = true;
 

hosts/bicep/services/matrix/hookshot/default.nix

@@ -22,6 +22,7 @@ in
   sops.templates."hookshot-registration.yaml" = {
     owner = config.users.users.matrix-synapse.name;
     group = config.users.groups.keys-matrix-registrations.name;
+    mode = "0440";
     restartUnits = [ "matrix-hookshot.service" ];
     content = ''
       id: matrix-hookshot
@@ -49,12 +50,59 @@ in
 
   systemd.services.matrix-hookshot = {
     serviceConfig = {
+      DynamicUser = true;
       SupplementaryGroups = [
         config.users.groups.keys-matrix-registrations.name
       ];
       LoadCredential = [
         "passkey.pem:${config.sops.secrets."matrix/hookshot/passkey".path}"
       ];
+
+      RuntimeDirectory = [ "matrix-hookshot/root-mnt" ];
+      RootDirectory = "/run/matrix-hookshot/root-mnt";
+      BindReadOnlyPaths = [
+        config.sops.templates."hookshot-registration.yaml".path
+        builtins.storeDir
+        "/etc"
+        "/run/nscd"
+        "/var/run/nscd"
+      ];
+
+      AmbientCapabilities = "";
+      CapabilityBoundingSet = "";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = false; # node needs this
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateMounts = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      RemoveIPC = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+        "~@resources"
+      ];
+      UMask = "0077";
     };
   };
 
@@ -146,6 +194,7 @@ in
   };
 
   services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
+    kTLS = true;
     enableACME = true;
     addSSL = true;
     locations."/" = {

hosts/bicep/services/matrix/mjolnir.nix

@@ -54,4 +54,53 @@
     # TODO: Fix upstream module in nixpkgs
     pantalaimon.username = "bot_admin";
   };
+
+  systemd.services.mjolnir.serviceConfig = {
+    DynamicUser = true;
+    RuntimeDirectory = [ "mjolnir/root-mnt" ];
+    RootDirectory = "/run/mjolnir/root-mnt";
+    BindReadOnlyPaths = [
+      config.sops.secrets."matrix/mjolnir/access_token".path
+      builtins.storeDir
+      "/etc"
+      "/run/nscd"
+      "/var/run/nscd"
+    ];
+
+    AmbientCapabilities = "";
+    CapabilityBoundingSet = "";
+    LockPersonality = true;
+    MemoryDenyWriteExecute = false; # node needs this
+    NoNewPrivileges = true;
+    PrivateDevices = true;
+    PrivateMounts = true;
+    PrivateTmp = true;
+    PrivateUsers = true;
+    ProcSubset = "pid";
+    ProtectClock = true;
+    ProtectControlGroups = true;
+    ProtectHome = true;
+    ProtectHostname = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    ProtectSystem = "strict";
+    RemoveIPC = true;
+    RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+      "AF_UNIX"
+    ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    SystemCallFilter = [
+      "@system-service"
+      "~@privileged"
+      "~@resources"
+    ];
+    UMask = "0077";
+  };
 }

hosts/bicep/services/matrix/out-of-your-element.nix

@@ -56,6 +56,55 @@ in
     enableSynapseIntegration = false;
   };
 
+  systemd.services."matrix-ooye" = {
+    serviceConfig = {
+      RuntimeDirectory = [ "matrix-ooye/root-mnt" ];
+      RootDirectory = "/run/matrix-ooye/root-mnt";
+      BindReadOnlyPaths = [
+        builtins.storeDir
+        "/etc"
+        "/run/nscd"
+        "/var/run/nscd"
+      ];
+
+      AmbientCapabilities = "";
+      CapabilityBoundingSet = "";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = false; # node needs this
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateMounts = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      RemoveIPC = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+        "~@resources"
+      ];
+      UMask = "0077";
+    };
+  };
+
   systemd.services."matrix-synapse" = {
     after = [
       "matrix-ooye-pre-start.service"
@@ -80,6 +129,7 @@ in
   };
 
   services.nginx.virtualHosts."ooye.pvv.ntnu.no" = {
+    kTLS = true;
     forceSSL = true;
     enableACME = true;
     locations."/".proxyPass = "http://localhost:${cfg.socket}";

hosts/bicep/services/minecraft-heatmap.nix

@@ -23,27 +23,28 @@ in
   };
 
   systemd.services.minecraft-heatmap-ingest-logs = lib.mkIf cfg.enable {
-    serviceConfig.LoadCredential = [
-      "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
-    ];
-
-    preStart = let
-      knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
-        innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
-        innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
-        innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
-      '';
-    in ''
-      mkdir -p '${cfg.minecraftLogsDir}'
-      "${lib.getExe pkgs.rsync}" \
-      --archive \
-      --verbose \
-      --progress \
-      --no-owner \
-      --no-group \
-      --rsh="${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=\"${knownHostsFile}\" -i \"$CREDENTIALS_DIRECTORY\"/sshkey" \
-      root@innovation.pvv.ntnu.no:/ \
-      '${cfg.minecraftLogsDir}'/
-    '';
+    serviceConfig = {
+      LoadCredential = [
+        "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
+      ];
+      ExecStartPre = let
+        knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
+          innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
+          innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
+          innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
+        '';
+        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
+          archive = true;
+          verbose = true;
+          progress = true;
+          no-owner = true;
+          no-group = true;
+        };
+        sshCommand = ''${pkgs.openssh}/bin/ssh -o UserKnownHostsFile='${knownHostsFile}' -i \"$CREDENTIALS_DIRECTORY\"/sshkey'';
+      in [
+        "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.minecraftLogsDir}'"
+        "${lib.getExe pkgs.rsync} ${rsyncArgs} --rsh=\"${sshCommand}\" root@innovation.pvv.ntnu.no:/ '${cfg.minecraftLogsDir}'/"
+      ];
+    };
   };
 }

hosts/grevling/configuration.nix

@@ -1,36 +0,0 @@
-{ config, pkgs, values, ... }:
-{
-  imports = [
-      # Include the results of the hardware scan.
-      ./hardware-configuration.nix
-      ../../base.nix
-      ../../misc/metrics-exporters.nix
-
-      ./services/openvpn
-    ];
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  networking.hostName = "grevling";
-
-  # systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
-  #   matchConfig.Name = "eno1";
-  #   address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
-  # };
-
-  # List packages installed in system profile
-  environment.systemPackages = with pkgs; [
-  ];
-
-  # List services that you want to enable:
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.05"; # Did you read the comment?
-
-}

hosts/grevling/hardware-configuration.nix

@@ -1,40 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/145E-7362";
-      fsType = "vfat";
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
-    ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp2s2.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/grevling/services/openvpn/default.nix

@@ -1,77 +0,0 @@
-{ pkgs, lib, values, ... }:
-{
-  services.openvpn.servers."ov-tunnel" = {
-    config = let
-      conf = {
-        # TODO: use aliases
-        local = "129.241.210.191";
-        port = 1194;
-        proto = "udp";
-        dev = "tap";
-
-        # TODO: set up
-        ca = "";
-        cert = "";
-        key = "";
-        dh = "";
-
-        # Maintain a record of client <-> virtual IP address
-        # associations in this file.  If OpenVPN goes down or
-        # is restarted, reconnecting clients can be assigned
-        # the same virtual IP address from the pool that was
-        # previously assigned.
-        ifconfig-pool-persist = ./ipp.txt;
-
-        server-bridge = builtins.concatStringsSep " " [
-          "129.241.210.129"
-          "255.255.255.128"
-          "129.241.210.253"
-          "129.241.210.254"
-        ];
-
-        keepalive = "10 120";
-        cipher = "none";
-
-        user = "nobody";
-        group = "nobody";
-
-        status = "/var/log/openvpn-status.log";
-
-        client-config-dir = pkgs.writeTextDir "tuba" ''
-          # Sett IP-adr. for tap0 til tubas PVV-adr.
-          ifconfig-push ${values.services.tuba-tap} 255.255.255.128
-          # Hvordan skal man faa dette til aa funke, tro?
-          #ifconfig-ipv6-push 2001:700:300:1900::xxx/64
-          
-          # La tuba bruke std. PVV-gateway til all trafikk (unntatt
-          # VPN-tunnellen).
-          push "redirect-gateway"
-        '';
-
-        persist-key = true;
-        persist-tun = true;
-
-        verb = 5;
-
-        explicit-exit-notify = 1;
-      };
-    in lib.pipe conf [
-      (lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
-      (builtins.mapAttrs (_: value:
-        if builtins.isList value then builtins.concatStringsSep " " (map toString value)
-        else if value == true then value
-        else if builtins.any (f: f value) [
-          builtins.isString
-          builtins.isInt
-          builtins.isFloat
-          lib.isPath
-          lib.isDerivation
-        ] then toString value
-        else throw "Unknown value in grevling openvpn config, deading now\n${value}"
-      ))
-      (lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
-      (builtins.concatStringsSep "\n")
-      (x: x + "\n\n")
-    ];
-  };
-}

hosts/ildkule/services/monitoring/default.nix

@@ -5,6 +5,7 @@
     ./grafana.nix
     ./loki.nix
     ./prometheus
+    ./scrutiny.nix
     ./uptime-kuma.nix
   ];
 }

hosts/ildkule/services/monitoring/scrutiny.nix

@@ -0,0 +1,40 @@
+{ config, values, ... }:
+let
+  cfg = config.services.scrutiny;
+in
+{
+  services.scrutiny = {
+    enable = true;
+    settings = {
+      web.listen = {
+        host = "127.0.0.1";
+        port = 18293;
+        basepath = "";
+      };
+
+      # notify.urls = [
+      #   "matrix://username:password@host:port/[?rooms=!roomID1[,roomAlias2]]"
+      # ];
+    };
+  };
+
+  services.nginx.virtualHosts."scrutiny.pvv.ntnu.no" = {
+    kTLS = true;
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://${cfg.settings.web.listen.host}:${toString cfg.settings.web.listen.port}";
+    };
+
+    # TODO: allow website access to the outside world, but restrict input api
+    extraConfig = ''
+      allow ${values.hosts.ildkule.ipv4}/32;
+      allow ${values.hosts.ildkule.ipv6}/128;
+      allow 127.0.0.1/32;
+      allow ::1/128;
+      allow ${values.ipv4-space};
+      allow ${values.ipv6-space};
+      deny all;
+    '';
+  };
+}

hosts/ildkule/services/monitoring/uptime-kuma.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, values, ... }:
 let
   cfg = config.services.uptime-kuma;
   domain = "status.pvv.ntnu.no";
@@ -24,4 +24,21 @@ in {
     fsType = "bind";
     options = [ "bind" ];
   };
+
+  services.rsync-pull-targets = {
+    enable = true;
+    locations.${stateDir} = {
+      user = "root";
+      rrsyncArgs.ro = true;
+      authorizedKeysAttrs = [
+        "restrict"
+        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
+        "no-agent-forwarding"
+        "no-port-forwarding"
+        "no-pty"
+        "no-X11-forwarding"
+      ];
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXzcDm6cVr4NmWzUSroy33FlielKqaG83wY0RCMC0p/ uptime_kuma rsync backup";
+    };
+  };
 }

hosts/kommode/services/gitea/customization/default.nix

@@ -72,50 +72,52 @@ in
       Type = "oneshot";
       User = cfg.user;
       Group = cfg.group;
+      PrivateNetwork = true;
+
+      ExecStart = let
+        logo-svg = fp /assets/logo_blue_regular.svg;
+        logo-png = fp /assets/logo_blue_regular.png;
+
+        extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
+          <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
+        '';
+
+        extraLinksFooter = pkgs.writeText "gitea-extra-links-footer.tmpl" ''
+          <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
+          <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
+          <a class="item" href="https://wiki.pvv.ntnu.no/wiki/Tjenester/Kodelager">PVV Gitea Howto</a>
+        '';
+
+        project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
+          labels = lib.importJSON ./labels/projects.json;
+        };
+
+        customTemplates = pkgs.runCommandLocal "gitea-templates" {
+          nativeBuildInputs = with pkgs; [
+            coreutils
+            gnused
+          ];
+        } ''
+          # Bigger icons
+          install -Dm444 '${cfg.package.src}/templates/repo/icon.tmpl' "$out/repo/icon.tmpl"
+          sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
+        '';
+        install = lib.getExe' pkgs.coreutils "install";
+      in [
+        "${install} -Dm444 '${logo-svg}' '${cfg.customDir}/public/assets/img/logo.svg'"
+        "${install} -Dm444 '${logo-png}' '${cfg.customDir}/public/assets/img/logo.png'"
+        "${install} -Dm444 '${./loading.apng}' '${cfg.customDir}/public/assets/img/loading.png'"
+        "${install} -Dm444 '${extraLinks}' '${cfg.customDir}/templates/custom/extra_links.tmpl'"
+        "${install} -Dm444 '${extraLinksFooter}' '${cfg.customDir}/templates/custom/extra_links_footer.tmpl'"
+        "${install} -Dm444 '${project-labels}' '${cfg.customDir}/options/label/project-labels.yaml'"
+
+        "${install} -Dm644 '${./emotes/bruh.png}' '${cfg.customDir}/public/assets/img/emoji/bruh.png'"
+        "${install} -Dm644 '${./emotes/huh.gif}' '${cfg.customDir}/public/assets/img/emoji/huh.png'"
+        "${install} -Dm644 '${./emotes/grr.png}' '${cfg.customDir}/public/assets/img/emoji/grr.png'"
+        "${install} -Dm644 '${./emotes/okiedokie.jpg}' '${cfg.customDir}/public/assets/img/emoji/okiedokie.png'"
+
+        "${lib.getExe pkgs.rsync} -a '${customTemplates}/' '${cfg.customDir}/templates/'"
+      ];
     };
-
-    script = let
-      logo-svg = fp /assets/logo_blue_regular.svg;
-      logo-png = fp /assets/logo_blue_regular.png;
-
-      extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
-        <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
-      '';
-
-      extraLinksFooter = pkgs.writeText "gitea-extra-links-footer.tmpl" ''
-        <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
-        <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
-        <a class="item" href="https://wiki.pvv.ntnu.no/wiki/Tjenester/Kodelager">PVV Gitea Howto</a>
-      '';
-
-      project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
-        labels = lib.importJSON ./labels/projects.json;
-      };
-
-      customTemplates = pkgs.runCommandLocal "gitea-templates" {
-        nativeBuildInputs = with pkgs; [
-          coreutils
-          gnused
-        ];
-      } ''
-        # Bigger icons
-        install -Dm444 '${cfg.package.src}/templates/repo/icon.tmpl' "$out/repo/icon.tmpl"
-        sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
-      '';
-    in ''
-      install -Dm444 '${logo-svg}' '${cfg.customDir}/public/assets/img/logo.svg'
-      install -Dm444 '${logo-png}' '${cfg.customDir}/public/assets/img/logo.png'
-      install -Dm444 '${./loading.apng}' '${cfg.customDir}/public/assets/img/loading.png'
-      install -Dm444 '${extraLinks}' '${cfg.customDir}/templates/custom/extra_links.tmpl'
-      install -Dm444 '${extraLinksFooter}' '${cfg.customDir}/templates/custom/extra_links_footer.tmpl'
-      install -Dm444 '${project-labels}' '${cfg.customDir}/options/label/project-labels.yaml'
-
-      install -Dm644 '${./emotes/bruh.png}' '${cfg.customDir}/public/assets/img/emoji/bruh.png'
-      install -Dm644 '${./emotes/huh.gif}' '${cfg.customDir}/public/assets/img/emoji/huh.png'
-      install -Dm644 '${./emotes/grr.png}' '${cfg.customDir}/public/assets/img/emoji/grr.png'
-      install -Dm644 '${./emotes/okiedokie.jpg}' '${cfg.customDir}/public/assets/img/emoji/okiedokie.png'
-
-      '${lib.getExe pkgs.rsync}' -a '${customTemplates}/' '${cfg.customDir}/templates/'
-    '';
   };
 }

hosts/kommode/services/gitea/default.nix

@@ -139,6 +139,9 @@ in {
         AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 2;
       };
       actions.ENABLED = true;
+      webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," [
+        "external"
+      ];
     };
 
     dump = {

hosts/kommode/services/gitea/gpg.nix

@@ -38,11 +38,11 @@ in
       Type = "oneshot";
       User = cfg.user;
       PrivateNetwork = true;
+      ExecStart = [
+        "${lib.getExe pkgs.gnupg} --import '${config.sops.secrets."gitea/gpg-signing-key-public".path}'"
+        "${lib.getExe pkgs.gnupg} --import '${config.sops.secrets."gitea/gpg-signing-key-private".path}'"
+      ];
     };
-    script = ''
-      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-public".path}
-      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-private".path}
-    '';
   };
 
   services.gitea.settings."repository.signing" = {
@@ -50,6 +50,8 @@ in
     SIGNING_NAME = "PVV Git";
     SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
     INITIAL_COMMIT = "always";
+    MERGES = lib.concatStringsSep "," [ "always" ];
+    CRUD_ACTIONS = lib.concatStringsSep "," [ "always" ];
     WIKI = "always";
   };
 }

hosts/kommode/services/gitea/import-users/default.nix

@@ -11,9 +11,9 @@ in
 
   systemd.services.gitea-import-users = lib.mkIf cfg.enable {
     enable = true;
-    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
     environment.PASSWD_FILE_PATH = "/run/gitea-import-users/passwd";
     serviceConfig = {
+      ExecStartPre = ''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
       ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
         flakeIgnore = [
           "E501" # Line over 80 chars lol

hosts/lupine/configuration.nix

@@ -18,9 +18,6 @@
     anyInterface = true;
   };
 
-  # There are no smart devices
-  services.smartd.enable = false;
-
   # Don't change (even during upgrades) unless you know what you are doing.
   # See https://search.nixos.org/options?show=system.stateVersion
   system.stateVersion = "25.05";

hosts/temmie/services/userweb/default.nix

@@ -39,7 +39,7 @@ let
     extraConfig = phpOptions;
   };
 
-  perlEnv = pkgs.perl.withPackages (ps: with ps; [
+  perlEnv = (pkgs.perl.withPackages (ps: with ps; [
     pkgs.exiftool
     pkgs.ikiwiki
     pkgs.irssi
@@ -54,7 +54,14 @@ let
     ImageMagick
     JSON
     TemplateToolkit
-  ]);
+  ])).overrideAttrs (prev: {
+    # NOTE: `pkgs.perl.propagatedBuildInputs` don't actually propagate through the
+    #       wrapper derivation created by `withPackages`. This should compensate
+    #       for that.
+    postBuild = prev.postBuild + ''
+      cp -r '${pkgs.perl}/nix-support' "$out"/nix-support
+    '';
+  });
 
   # https://nixos.org/manual/nixpkgs/stable/#python.buildenv-function
   pythonEnv = pkgs.python3.buildEnv.override {
@@ -67,21 +74,6 @@ let
     ignoreCollisions = true;
   };
 
-  sendmailWrapper = pkgs.writeShellApplication {
-    name = "sendmail";
-    runtimeInputs = [ ];
-    text = ''
-      args=("$@")
-
-      if [[ -z "$USERDIR_USER" ]] && [[ "$USERDIR_USER" != "pvv" ]]; then
-          # Prepend -fusername to the argument list, so bounces go to the user
-          args=("-f$USERDIR_USER" "''${args[@]}")
-      fi
-
-      exec '${lib.getExe pkgs.system-sendmail}' "''${args[@]}"
-    '';
-  };
-
   # https://nixos.org/manual/nixpkgs/stable/#sec-building-environment
   fhsEnv = pkgs.buildEnv {
     name = "userweb-env";
@@ -89,7 +81,7 @@ let
     paths = with pkgs; [
       bash
 
-      sendmailWrapper
+      config.services.bro.instances.userweb-sendmail.client.package
 
       perlEnv
       pythonEnv
@@ -184,17 +176,21 @@ in
     extraModules = [
       "systemd"
       "userdir"
-      # TODO: I think the compilation steps of pkgs.apacheHttpdPackages.mod_perl might have some
-      #       incorrect or restrictive assumptions upstream, either nixpkgs or source
-      # {
-      #   name = "perl";
-      #   path = let
-      #     mod_perl = pkgs.apacheHttpdPackages.mod_perl.override {
-      #       apacheHttpd = cfg.package.out;
-      #       perl = perlEnv;
-      #     };
-      #   in "${mod_perl}/modules/mod_perl.so";
-      # }
+      {
+        name = "perl";
+        path = let
+          mod_perl = pkgs.symlinkJoin {
+            name = "userweb_modperl_with_custom_perl_env";
+            ignoreCollisions = true;
+            paths = [
+              (pkgs.apacheHttpdPackages.mod_perl.override {
+                apacheHttpd = cfg.package.out;
+              })
+              perlEnv
+            ];
+          };
+        in "${mod_perl}/modules/mod_perl.so";
+      }
     ];
 
     extraConfig = ''
@@ -203,11 +199,14 @@ in
       ScriptLog ${cfg.logDir}/cgi.log
     '';
 
-    # virtualHosts."userweb.pvv.ntnu.no" = {
     virtualHosts."temmie.pvv.ntnu.no" = {
       forceSSL = true;
       enableACME = true;
 
+      serverAliases = [
+        "www2.pvv.ntnu.no"
+      ];
+
       extraConfig = ''
         UserDir ${lib.concatMapStringsSep " " (l: "/home/pvv/${l}/*/web-docs") homeLetters}
         UserDir disabled root
@@ -258,6 +257,14 @@ in
   #   ];
   # };
 
+  # NOTE: 54 -> 33, this is the UID/GID we used for www-data on tom in the past.
+  #       Any files accessed by or created by httpd will do so over NFS with this
+  #       UID/GID pair as its credentials.
+  #       This overlaps with the hardcoded `disnix` uid in nixpkgs, but we *probably*
+  #       won't be using that for the foreseeable future.
+  users.users."wwwrun".uid = lib.mkForce 33;
+  users.groups."wwwrun".gid = lib.mkForce 33;
+
   systemd.services.httpd = {
     after = [ "pvv-homedirs.target" ];
     requires = [ "pvv-homedirs.target" ];

hosts/temmie/services/userweb/mail.nix

@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 {
   services.postfix.enable = lib.mkForce false;
 
@@ -9,4 +9,111 @@
       remotes = "mail.pvv.ntnu.no smtp --port=25";
     };
   };
+
+  services.bro = {
+    enable = true;
+
+    instances.userweb-sendmail = {
+      enable = true;
+
+      client = {
+        settings.BRO_FILE_FLAGS = [
+          "-C"
+        ];
+      };
+
+      server = {
+        settings = {
+          executable = let
+            sendmailWrapper = pkgs.writeShellApplication {
+              name = "sendmail";
+              runtimeInputs = [ ];
+              bashOptions = [
+                "errexit"
+                "pipefail"
+              ];
+              text = ''
+                args=("$@")
+
+                if [[ -z "$USERDIR_USER" ]] && [[ "$USERDIR_USER" != "pvv" ]]; then
+                    # Prepend -fusername to the argument list, so bounces go to the user
+                    args=("-f$USERDIR_USER" "''${args[@]}")
+                fi
+
+                exec '${lib.getExe pkgs.system-sendmail}' -t -i "''${args[@]}"
+              '';
+            };
+          in lib.getExe sendmailWrapper;
+          allowed-env = [ "USERDIR_USER" ];
+        };
+      };
+    };
+  };
+
+  environment.systemPackages = [
+    (config.services.bro.instances.userweb-sendmail.client.package.overrideAttrs (prev: {
+      buildCommand = prev.buildCommand + ''
+        mv "$out/bin/sendmail" "$out/bin/bro-sendmail"
+      '';
+    }))
+  ];
+
+  users.users.nullmailer-user = {
+    enable = true;
+    isSystemUser = true;
+    group = "nullmailer-user";
+  };
+
+  users.groups.nullmailer-user = { };
+
+  systemd.services.bro-userweb-sendmail = {
+    serviceConfig = {
+      User = "nullmailer-user";
+      Group = "nullmailer-user";
+
+      ReadWritePaths = [
+        "/var/spool/nullmailer"
+      ];
+
+      AmbientCapabilities = "";
+      CapabilityBoundingSet = "";
+      NoNewPrivileges = false;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      PrivateTmp = true;
+      PrivateDevices = true;
+      PrivateUsers = false;
+      ProtectHostname = true;
+      ProtectClock = true;
+      ProtectKernelTunables = true;
+      ProtectKernelModules = true;
+      ProtectKernelLogs = true;
+      ProtectControlGroups = true;
+      RestrictAddressFamilies = [
+        "AF_UNIX"
+        "AF_INET"
+        "AF_INET6"
+        "AF_NETLINK"
+      ];
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      PrivateMounts = true;
+      ProcSubset = "pid";
+      ProtectProc = "invisible";
+      RemoveIPC = true;
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@resources"
+      ];
+      UMask = "0077";
+    };
+  };
+
+  systemd.services.httpd.serviceConfig = {
+    BindPaths = [ (lib.head config.systemd.sockets.bro-userweb-sendmail.listenStreams) ];
+  };
 }

hosts/tuba/configuration.nix

@@ -1,36 +0,0 @@
-{ config, pkgs, values, ... }:
-{
-  imports = [
-      # Include the results of the hardware scan.
-      ./hardware-configuration.nix
-      ../../base.nix
-      ../../misc/metrics-exporters.nix
-
-      ./services/openvpn
-    ];
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  networking.hostName = "tuba";
-
-  # systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
-  #   matchConfig.Name = "eno1";
-  #   address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
-  # };
-
-  # List packages installed in system profile
-  environment.systemPackages = with pkgs; [
-  ];
-
-  # List services that you want to enable:
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.05"; # Did you read the comment?
-
-}

hosts/tuba/hardware-configuration.nix

@@ -1,40 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/145E-7362";
-      fsType = "vfat";
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
-    ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp2s2.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/tuba/services/openvpn/default.nix

@@ -1,54 +0,0 @@
-{ lib, values, ... }:
-{
-  services.openvpn.servers."ov-tunnel" = {
-    config = let
-      conf = {
-        # TODO: use aliases
-        client = true;
-        dev = "tap";
-        proto = "udp";
-        remote = "129.241.210.191 1194";
-
-        resolv-retry = "infinite";
-        nobind = true;
-
-        # # TODO: set up
-        ca = "";
-        cert = "";
-        key = "";
-        remote-cert-tls = "server";
-        cipher = "none";
-
-        user = "nobody";
-        group = "nobody";
-
-        status = "/var/log/openvpn-status.log";
-
-        persist-key = true;
-        persist-tun = true;
-
-        verb = 5;
-
-        # script-security = 2;
-        # up = "systemctl restart rwhod";
-      };
-    in lib.pipe conf [
-      (lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
-      (builtins.mapAttrs (_: value:
-        if builtins.isList value then builtins.concatStringsSep " " (map toString value)
-        else if value == true then value
-        else if builtins.any (f: f value) [
-          builtins.isString
-          builtins.isInt
-          builtins.isFloat
-          lib.isPath
-          lib.isDerivation
-        ] then toString value
-        else throw "Unknown value in tuba openvpn config, deading now\n${value}"
-      ))
-      (lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
-      (builtins.concatStringsSep "\n")
-      (x: x + "\n\n")
-    ];
-  };
-}

modules/grzegorz.nix

@@ -16,7 +16,7 @@ in {
   };
 
   systemd.user.services.restart-greg-ng = {
-    script = "systemctl --user restart greg-ng.service";
+    serviceConfig.ExecStart = "${lib.getExe' pkgs.systemd "systemctl"} --user restart greg-ng.service";
     startAt = "*-*-* 06:30:00";
   };
 

modules/matrix-ooye.nix

@@ -171,6 +171,9 @@ in
         requires = [ "matrix-ooye-pre-start.service" ];
         wantedBy = [ "multi-user.target" ];
 
+        startLimitIntervalSec = 5;
+        startLimitBurst = 5;
+
         serviceConfig = {
           ExecStart = lib.getExe config.services.matrix-ooye.package;
           WorkingDirectory = "/var/lib/matrix-ooye";
@@ -182,8 +185,6 @@ in
           #PrivateDevices = true;
           Restart = "on-failure";
           RestartSec = "5s";
-          StartLimitIntervalSec = "5s";
-          StartLimitBurst = "5";
           DynamicUser = true;
         };
       };

packages/mediawiki-extensions/default.nix

@@ -38,18 +38,23 @@ lib.mergeAttrsList [
   })
   (mw-ext {
     name = "CodeMirror";
-    commit = "f06dfd40a08562a841ddf11b4ae3444ef06c98c7";
-    hash = "sha256-5zXkBjOwFdoQezkPRJ2AcBZLZEEpGG6FawO2K3KzllI=";
+    commit = "7ab826eff8c4097589a3199c40c507717af23234";
+    hash = "sha256-kMIyGW9J4OSGSetByel7hEGgxPRJmQ53it6ndpYA/Hs=";
   })
   (mw-ext {
     name = "DeleteBatch";
-    commit = "9bc75a753efefedfc88c598fb01f18a7e4b61f00";
-    hash = "sha256-1xA758fsvoioN9xuq0hRqZKtPXMQViVLtuRINDtowdk=";
+    commit = "b5920283cfe78b86a63a1037a81651c58ce764da";
+    hash = "sha256-LwuVX2s5Q4uc6o7hlTjFzRTwvSCwTk74gBpX0HoLDMA=";
+  })
+  (mw-ext {
+    name = "PdfHandler";
+    commit = "dc1a3ca04ac6ec7d7de7ce5355803510508a2575";
+    hash = "sha256-ltAQZtfTMMLRPATA7rclSNW8Yz4ctGc30CxlL3SRBWU=";
   })
   (mw-ext {
     name = "PluggableAuth";
-    commit = "64133683b73d8eeea8069fe7ed9cb7237fd5c212";
-    hash = "sha256-wqpfgVLenZp6XC510nrsrbvK1IMEPcWVYq5YuAOt5+c=";
+    commit = "4b57a23e32d72bd3f74184ff2734aa483a5b0c63";
+    hash = "sha256-ZGw0Wgz0Sg04YDcOzkOGywmfQ6s6Ex17QbjmUDO1D8c=";
   })
   (mw-ext {
     name = "Popups";
@@ -58,38 +63,38 @@ lib.mergeAttrsList [
   })
   (mw-ext {
     name = "Scribunto";
-    commit = "cbab0c740e03c8e6184fd647d95e24e0826d20cb";
-    hash = "sha256-vXS3+wrUBVtPsETa19pMvud9sALGt4Ao9mM5rQRbBQc=";
+    commit = "35c85c96167922adc98e62dd6573789d906dd7d7";
+    hash = "sha256-FEWADJW53cDOlLseM62VL66PENv/jNnwuCMo2Pb02ek=";
   })
   (mw-ext {
     name = "SimpleSAMLphp";
     kebab-name = "simple-saml-php";
-    commit = "fc5ad4501434fe85198f0b1f0087d798efa91f9f";
-    hash = "sha256-se0krTglo1fShJXj38bPLhw65tZC5P54Ywt7oeZrLes=";
+    commit = "70778bb02f972abbb51e6ba3e0f6545b00dcab00";
+    hash = "sha256-wfmFJKy+ih84qFM9DVcCQFAZBx45s7Hl0lRnseMPhGY=";
   })
   (mw-ext {
     name = "TemplateData";
-    commit = "d37b02f6ed194138ac7193a0782bbf6efb9164f8";
-    hash = "sha256-NpzVBzX7qfXkIE+jh33ndooS9GE8ZF3/Jynm22in7IQ=";
+    commit = "cca3b3430067f2161bf65de822f70dd38fe07bba";
+    hash = "sha256-OxLwiF8FlWizkpDF9GXYfjehKtrltX8ihiCE+fNJpgw=";
   })
   (mw-ext {
     name = "TemplateStyles";
-    commit = "f85614c26a0057a9f418342f89214a04c9de9988";
-    hash = "sha256-XZOtM3iadjE5vavsjkx7kfJNhLZlnnFt1CN+mv6XVHQ=";
+    commit = "101a159dd0190759a16551a86800144c18b6ff5c";
+    hash = "sha256-IGQQVAx8/76ivHq9b97ec1AlFoqbRl7uhXhwoFimsG4=";
   })
   (mw-ext {
     name = "UserMerge";
-    commit = "2f2432c909a36691ca0002daf6fb304d6c182beb";
-    hash = "sha256-ZP8Tp6u+uJxx3I39YGMmkP0sTnjAQUSaxImAJaRv+Ek=";
+    commit = "6c0d105e07538c34bfde989bd26fa1945f8d1b79";
+    hash = "sha256-w058Ihk0I98hIG1tkVJGy1bzbv7XXyUksGexXgCN540=";
   })
   (mw-ext {
     name = "VisualEditor";
-    commit = "1508d49d0dd71fdc1d18badd23671441b3bc327b";
-    hash = "sha256-VNiCVNrCAImAr1tS9T28KPPzzNsKPz5ELFRIBtng+So=";
+    commit = "8d8c6d7f179a5f799e1fa8cba207d81f58f722d2";
+    hash = "sha256-wbYHXi2vD521EMzUl7ttinG4YdLv/DwYvVUew7dka0g=";
   })
   (mw-ext {
     name = "WikiEditor";
-    commit = "aba5e7c6701877a6b43583709751658fec606d47";
-    hash = "sha256-XmbQy0NXuY3oVGkkgC233kkzfBfx32HDylloGYXU/Nc=";
+    commit = "f53000f0499858fe74e4f5008b2f5e467d9d9382";
+    hash = "sha256-+HTXZEVCwMD8z6c1kCZA3k686HzNd30pJljzRvf+gMg=";
   })
 ]

values.nix

@@ -26,12 +26,6 @@ in rec {
       ipv4 = pvv-ipv4 213;
       ipv6 = pvv-ipv6 213;
     };
-    grevling-tap = {
-      ipv4 = pvv-ipv4 251;
-    };
-    tuba-tap = {
-      ipv4 = pvv-ipv4 252;
-    };
   };
 
   hosts = {
@@ -61,11 +55,11 @@ in rec {
     };
     brzeczyszczykiewicz = {
       ipv4 = pvv-ipv4 205;
-      ipv6 = pvv-ipv6 "1:50"; # Wtf peder why
+      ipv6 = pvv-ipv6 205;
     };
     georg = {
       ipv4 = pvv-ipv4 204;
-      ipv6 = pvv-ipv6 "1:4f"; # Wtf øystein og daniel why
+      ipv6 = pvv-ipv6 204;
     };
     kommode = {
       ipv4 = pvv-ipv4 223;
@@ -117,14 +111,6 @@ in rec {
       ipv4 = pvv-ipv4 228;
       ipv6 = pvv-ipv6 228;
     };
-    grevling = {
-      ipv4 = pvv-ipv4 198;
-      ipv6 = pvv-ipv6 198;
-    };
-    tuba = {
-      ipv4 = pvv-ipv4 199;
-      ipv6 = pvv-ipv6 199;
-    };
   };
 
   defaultNetworkConfig = {