georg: enable spotifyd

.editorconfig

@@ -1,10 +0,0 @@
-root = true
-
-[*]
-end_of_line = lf
-insert_final_newline = true
-trim_trailing_whitespace = true
-
-[*.nix]
-indent_style = space
-indent_size = 2

.git-blame-ignore-revs

@@ -1 +0,0 @@
-e00008da1afe0d760badd34bbeddff36bb08c475

.gitignore

@@ -1,4 +1,3 @@
 result*
 /configuration.nix
 /.direnv/
-*.qcow2

base.nix

@@ -76,19 +76,10 @@
   # Trusted users on the nix builder machines
   users.groups."nix-builder-users".name = "nix-builder-users";
 
-  # Let's not thermal throttle
-  services.thermald.enable = lib.mkIf (lib.all (x: x) [
-      (config.nixpkgs.system == "x86_64-linux")
-      (!config.boot.isContainer or false)
-    ]) true;
-
   services.openssh = {
     enable = true;
     extraConfig = ''
       PubkeyAcceptedAlgorithms=+ssh-rsa
-      Match Group wheel
-        PasswordAuthentication no
-      Match All
     '';
     settings.PermitRootLogin = "yes";
   };
@@ -139,12 +130,4 @@
     acceptTerms = true;
     defaults.email = "drift@pvv.ntnu.no";
   };
-  # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
-  virtualisation.vmVariant = {
-    security.acme.defaults.server = "https://127.0.0.1";
-    security.acme.preliminarySelfsigned = true;
-
-    users.users.root.initialPassword = "root";
-  };
-
 }

flake.lock

@@ -1,26 +1,5 @@
 {
   "nodes": {
-    "dibbler": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1693682284,
-        "narHash": "sha256-FvVCkHH80YyUiqQlnGNr49rZRBniihF6YRpytguEkFQ=",
-        "ref": "refs/heads/master",
-        "rev": "8a6a0c12ba37e239684d2de1be12fd73903cfb2c",
-        "revCount": 193,
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
-      }
-    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -43,7 +22,7 @@
     },
     "fix-python": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils",
         "nixpkgs": [
           "grzegorz",
           "nixpkgs"
@@ -67,24 +46,6 @@
       "inputs": {
         "systems": "systems"
       },
-      "locked": {
-        "lastModified": 1692799911,
-        "narHash": "sha256-3eihraek4qL744EvQXsK1Ha6C3CR7nnT8X2qWap4RNk=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "f9e7cf818399d17d347f847525c5a5a8032e4e44",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_2"
-      },
       "locked": {
         "lastModified": 1689068808,
         "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
@@ -233,11 +194,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723850344,
+        "lastModified": 1693136143,
-        "narHash": "sha256-aT37O9l9eclWEnqxASVNBL1dKwDHZUOqdbA4VO9DJvw=",
+        "narHash": "sha256-amHprjftc3y/bg8yf4hITCLa+ez5HIi0yGfR7TU6UIc=",
         "ref": "refs/heads/main",
-        "rev": "38b66677ab8c01aee10cd59e745af9ce3ea88092",
+        "rev": "a32894b305f042d561500f5799226afd1faf5abb",
-        "revCount": 19,
+        "revCount": 9,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
       },
@@ -268,7 +229,6 @@
     },
     "root": {
       "inputs": {
-        "dibbler": "dibbler",
         "disko": "disko",
         "grzegorz": "grzegorz",
         "grzegorz-clients": "grzegorz-clients",
@@ -316,21 +276,6 @@
         "repo": "default",
         "type": "github"
       }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -17,9 +17,6 @@
     pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
     pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
 
-    dibbler.url = "git+https://git.pvv.ntnu.no/Projects/dibbler.git";
-    dibbler.inputs.nixpkgs.follows = "nixpkgs";
-
     matrix-next.url = "github:dali99/nixos-matrix-modules/v0.6.0";
     matrix-next.inputs.nixpkgs.follows = "nixpkgs";
 
@@ -40,8 +37,8 @@
       "aarch64-linux"
       "aarch64-darwin"
     ];
-    forAllSystems = f: nixlib.genAttrs systems f;
+    forAllSystems = f: nixlib.genAttrs systems (system: f system);
-    allMachines = builtins.attrNames self.nixosConfigurations;
+    allMachines = nixlib.mapAttrsToList (name: _: name) self.nixosConfigurations;
     importantMachines = [
       "bekkalokk"
       "bicep"
@@ -50,8 +47,6 @@
       "ildkule"
     ];
   in {
-    inherit inputs;
-
     nixosConfigurations = let
       unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
       nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
@@ -127,18 +122,6 @@
         ];
       };
       buskerud = stableNixosConfig "buskerud" { };
-      skrott = stableNixosConfig "skrott" {
-        system = "aarch64-linux";
-        modules = [
-          (nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
-          inputs.dibbler.nixosModules.default
-        ];
-      };
-    };
-
-    nixosModules = {
-      snakeoil-certs = ./modules/snakeoil-certs.nix;
-      snappymail = ./modules/snappymail.nix;
     };
 
     devShells = forAllSystems (system: {
@@ -157,7 +140,6 @@
 
         simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
 
-        skrot = self.nixosConfigurations.skrott.config.system.build.sdImage;
       } //
       (nixlib.pipe null [
         (_: pkgs.callPackage ./packages/mediawiki-extensions { })

hosts/bekkalokk/services/gitea/ci.nix

@@ -15,9 +15,9 @@ let
         enable = true;
         name = "git-runner-${name}"; url = "https://git.pvv.ntnu.no";
         labels = [
-          "debian-latest:docker://node:18-bullseye"
+	  "debian-latest:docker://node:18-bullseye"
-          "ubuntu-latest:docker://node:18-bullseye"
+	  "ubuntu-latest:docker://node:18-bullseye"
-        ];
+	];
         tokenFile = config.sops.secrets."gitea/runners/${name}".path;
       };
     };

hosts/bekkalokk/services/gitea/default.nix

@@ -135,16 +135,10 @@ in {
     script = let
       logo-svg = ../../../../assets/logo_blue_regular.svg;
       logo-png = ../../../../assets/logo_blue_regular.png;
-      extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
-        <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
-        <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
-        <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
-      '';
     in ''
       install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
       install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
       install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
-      install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
     '';
   };
 }

hosts/bekkalokk/services/idp-simplesamlphp/default.nix

@@ -22,62 +22,62 @@ let
       # openssl req -newkey rsa:4096 -new -x509 -days 365 -nodes -out idp.crt -keyout idp.pem
       "metadata/saml20-idp-hosted.php" = pkgs.writeText "saml20-idp-remote.php" ''
         <?php
-        $metadata['https://idp.pvv.ntnu.no/'] = array(
+	  $metadata['https://idp.pvv.ntnu.no/'] = array(
-          'host' => '__DEFAULT__',
+	    'host' => '__DEFAULT__',
-          'privatekey' => '${config.sops.secrets."idp/privatekey".path}',
+	    'privatekey' => '${config.sops.secrets."idp/privatekey".path}',
-          'certificate' => '${./idp.crt}',
+	    'certificate' => '${./idp.crt}',
-          'auth' => 'pwauth',
+	    'auth' => 'pwauth',
-        );
+	  );
-        ?>
+	?>
       '';
 
       "metadata/saml20-sp-remote.php" = pkgs.writeText "saml20-sp-remote.php" ''
         <?php
-          ${ lib.pipe config.services.idp.sp-remote-metadata [
+	  ${ lib.pipe config.services.idp.sp-remote-metadata [
-            (map (url: ''
+             (map (url: ''
-              $metadata['${url}'] = [
+               $metadata['${url}'] = [
-                'SingleLogoutService' => [
+                   'SingleLogoutService' => [
-                  [
+                       [
-                    'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
+                           'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
-                    'Location' => '${url}module.php/saml/sp/saml2-logout.php/default-sp',
+                           'Location' => '${url}module.php/saml/sp/saml2-logout.php/default-sp',
-                  ],
+                       ],
-                  [
+                       [
-                    'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP',
+                           'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP',
-                    'Location' => '${url}module.php/saml/sp/saml2-logout.php/default-sp',
+                           'Location' => '${url}module.php/saml/sp/saml2-logout.php/default-sp',
-                  ],
+                       ],
-                ],
+                   ],
-                'AssertionConsumerService' => [
+                   'AssertionConsumerService' => [
-                  [
+                       [
-                    'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
+                           'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
-                    'Location' => '${url}module.php/saml/sp/saml2-acs.php/default-sp',
+                           'Location' => '${url}module.php/saml/sp/saml2-acs.php/default-sp',
-                    'index' => 0,
+                           'index' => 0,
-                  ],
+                       ],
-                  [
+                       [
-                    'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact',
+                           'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact',
-                    'Location' => '${url}module.php/saml/sp/saml2-acs.php/default-sp',
+                           'Location' => '${url}module.php/saml/sp/saml2-acs.php/default-sp',
-                    'index' => 1,
+                           'index' => 1,
-                  ],
+                       ],
-                ],
+                   ],
-              ];
+               ];
-            ''))
+	     ''))
-            (lib.concatStringsSep "\n")
+	     (lib.concatStringsSep "\n")
-          ]}
+	  ]}
-        ?>
+	?>
       '';
 
       "config/authsources.php" = pkgs.writeText "idp-authsources.php" ''
         <?php
           $config = array(
-            'admin' => array(
+	    'admin' => array(
-              'core:AdminPassword'
+	      'core:AdminPassword'
-            ),
+	    ),
             'pwauth' => array(
-              'authpwauth:PwAuth',
+               'authpwauth:PwAuth',
-              'pwauth_bin_path' => '${lib.getExe pwAuthScript}',
+               'pwauth_bin_path' => '${lib.getExe pwAuthScript}',
-              'mail_domain' => '@pvv.ntnu.no',
+               'mail_domain' => '@pvv.ntnu.no',
             ),
           );
-        ?>
+	?>
       '';
 
       "config/config.php" = pkgs.runCommandLocal "simplesamlphp-config.php" { } ''
@@ -108,7 +108,7 @@ in
       List of urls point to (simplesamlphp) service profiders, which the idp should trust.
 
       :::{.note}
-      Make sure the url ends with a `/`
+	Make sure the url ends with a `/`
       :::
     '';
   };
@@ -199,9 +199,9 @@ in
           '';
         };
         "^~ /simplesaml/".extraConfig = ''
-          rewrite ^/simplesaml/(.*)$ /$1 redirect;
+	  rewrite ^/simplesaml/(.*)$ /$1 redirect;
-          return 404;
+	  return 404;
-        '';
+	'';
       };
     };
   };

hosts/bekkalokk/services/kerberos/pam.nix

@@ -879,15 +879,15 @@ let
 
   inherit (pkgs) pam_krb5 pam_ccreds;
 
-  use_ldap = config.users.ldap.enable && config.users.ldap.loginPam;
+  use_ldap = (config.users.ldap.enable && config.users.ldap.loginPam);
   pam_ldap = if config.users.ldap.daemon.enable then pkgs.nss_pam_ldapd else pkgs.pam_ldap;
 
   # Create a limits.conf(5) file.
   makeLimitsConf = limits:
     pkgs.writeText "limits.conf"
-      (concatMapStrings ({ domain, type, item, value }:
+       (concatMapStrings ({ domain, type, item, value }:
-        "${domain} ${type} ${item} ${toString value}\n")
+         "${domain} ${type} ${item} ${toString value}\n")
-        limits);
+         limits);
 
   limitsType = with lib.types; listOf (submodule ({ ... }: {
     options = {
@@ -935,8 +935,8 @@ let
   }));
 
   motd = if config.users.motdFile == null
-    then pkgs.writeText "motd" config.users.motd
+         then pkgs.writeText "motd" config.users.motd
-    else config.users.motdFile;
+         else config.users.motdFile;
 
   makePAMService = name: service:
     { name = "pam.d/${name}";
@@ -976,20 +976,20 @@ in
             item   = "maxlogins";
             value  = "4";
           }
-        ];
+       ];
 
-      description = lib.mdDoc ''
+     description = lib.mdDoc ''
-        Define resource limits that should apply to users or groups.
+       Define resource limits that should apply to users or groups.
-        Each item in the list should be an attribute set with a
+       Each item in the list should be an attribute set with a
-        {var}`domain`, {var}`type`,
+       {var}`domain`, {var}`type`,
-        {var}`item`, and {var}`value`
+       {var}`item`, and {var}`value`
-        attribute.  The syntax and semantics of these attributes
+       attribute.  The syntax and semantics of these attributes
-        must be that described in {manpage}`limits.conf(5)`.
+       must be that described in {manpage}`limits.conf(5)`.
 
-        Note that these limits do not apply to systemd services,
+       Note that these limits do not apply to systemd services,
-        whose limits can be changed via {option}`systemd.extraConfig`
+       whose limits can be changed via {option}`systemd.extraConfig`
-        instead.
+       instead.
-      '';
+     '';
     };
 
     security.pam.services = mkOption {
@@ -1507,10 +1507,10 @@ in
         runuser = { rootOK = true; unixAuth = false; setEnvironment = false; };
 
         /* FIXME: should runuser -l start a systemd session? Currently
-            it complains "Cannot create session: Already running in a
+           it complains "Cannot create session: Already running in a
-            session". */
+           session". */
         runuser-l = { rootOK = true; unixAuth = false; };
-      } // optionalAttrs config.security.pam.enableFscrypt {
+      } // optionalAttrs (config.security.pam.enableFscrypt) {
         # Allow fscrypt to verify login passphrase
         fscrypt = {};
       };

hosts/bekkalokk/services/website/default.nix

@@ -43,7 +43,7 @@ in {
                   'idp' => 'https://idp.pvv.ntnu.no/',
               ),
           );
-        '';
+	'';
       };
     };
 

hosts/bekkalokk/services/website/fetch-gallery.nix

@@ -46,7 +46,7 @@ in {
       while IFS= read fname; do
         # Skip this file if an up-to-date thumbnail already exists
         if [ -f ".thumbnails/$fname.png" ] && \
-          [ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
+           [ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
         then
           continue
         fi
@@ -54,7 +54,7 @@ in {
         echo "Creating thumbnail for $fname"
         mkdir -p $(dirname ".thumbnails/$fname")
         convert -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
-        touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
+	touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
       done <<< "$images"
     '';
 

hosts/bicep/configuration.nix

@@ -12,7 +12,8 @@
     ./services/mysql.nix
     ./services/postgres.nix
     ./services/mysql.nix
-    ./services/calendar-bot.nix
+    # TODO: fix the calendar bot
+    # ./services/calendar-bot.nix
 
     ./services/matrix
   ];

hosts/bicep/services/calendar-bot.nix

@@ -2,19 +2,11 @@
 let
   cfg = config.services.pvv-calendar-bot;
 in {
-  sops.secrets = {
+  sops.secrets."calendar-bot/matrix_token" = {
-    "calendar-bot/matrix_token" = {
+    sopsFile = ../../../secrets/bicep/bicep.yaml;
-      sopsFile = ../../../secrets/bicep/bicep.yaml;
+    key = "calendar-bot/matrix_token";
-      key = "calendar-bot/matrix_token";
+    owner = cfg.user;
-      owner = cfg.user;
+    group = cfg.group;
-      group = cfg.group;
-    };
-    "calendar-bot/mysql_password" = {
-      sopsFile = ../../../secrets/bicep/bicep.yaml;
-      key = "calendar-bot/mysql_password";
-      owner = cfg.user;
-      group = cfg.group;
-    };
   };
 
   services.pvv-calendar-bot = {
@@ -26,11 +18,6 @@ in {
         user = "@bot_calendar:pvv.ntnu.no";
         channel = "!gkNLUIhYVpEyLatcRz:pvv.ntnu.no";
       };
-      database = {
-        host = "mysql.pvv.ntnu.no";
-        user = "calendar-bot";
-        passwordFile = config.sops.secrets."calendar-bot/mysql_password".path;
-      };
       secretsFile = config.sops.secrets."calendar-bot/matrix_token".path;
       onCalendar = "*-*-* 09:00:00";
     };

hosts/bicep/services/matrix/mjolnir.nix

@@ -11,7 +11,7 @@
   services.mjolnir = {
     enable = true;
     pantalaimon.enable = false;
-    homeserverUrl = "http://127.0.0.1:8008";
+    homeserverUrl = http://127.0.0.1:8008;
     accessTokenFile = config.sops.secrets."matrix/mjolnir/access_token".path;
     managementRoom = "!gsdeCoWjvYRBrzuiRq:pvv.ntnu.no";
     protectedRooms = map (a: "https://matrix.to/#/${a}") [

hosts/bicep/services/matrix/synapse.nix

@@ -143,10 +143,10 @@ in {
   services.redis.servers."".enable = true;
   
   services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
-  {
+  ({
     kTLS = true;
-  }
+  })
-  {
+  ({
     locations."/.well-known/matrix/server" = {
       return = ''
         200 '{"m.server": "matrix.pvv.ntnu.no:443"}'
@@ -156,16 +156,16 @@ in {
         add_header Access-Control-Allow-Origin *;
       '';
     };
-  }
+  })
-  {
+  ({
     locations = let
       connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
-      socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString c.port}";
+      socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString (c.port)}";
 
       metricsPath = w: "/metrics/${w.type}/${toString w.index}";
       proxyPath = w: "http://${socketAddress w}/_synapse/metrics";
     in lib.mapAttrs' (n: v: lib.nameValuePair
-      (metricsPath v) {
+      (metricsPath v) ({
         proxyPass = proxyPath v;
         extraConfig = ''
           allow ${values.hosts.ildkule.ipv4};
@@ -174,10 +174,10 @@ in {
           allow ${values.hosts.ildkule.ipv6_global};
           deny all;
         '';
-      })
+      }))
       cfg.workers.instances;
-  }
+  })
-  {
+  ({
     locations."/metrics/master/1" = {
       proxyPass = "http://127.0.0.1:9000/_synapse/metrics";
       extraConfig = ''
@@ -202,5 +202,5 @@ in {
             labels = { };
           }]) + "/";
     };
-  }];
+  })];
 }

hosts/bicep/services/mysql.nix

@@ -15,12 +15,12 @@
       mysqld = {
         # PVV allows a lot of connections at the same time
         max_connect_errors = 10000;
-        bind-address = values.services.mysql.ipv4;
+	bind-address = values.services.mysql.ipv4;
-        skip-networking = 0;
+	skip-networking = 0;
 
-        # This was needed in order to be able to use all of the old users
+	# This was needed in order to be able to use all of the old users
-        # during migration from knakelibrak to bicep in Sep. 2023
+	# during migration from knakelibrak to bicep in Sep. 2023
-        secure_auth = 0;
+	secure_auth = 0;
       };
     };
 

hosts/georg/configuration.nix

@@ -7,6 +7,7 @@
       ../../misc/metrics-exporters.nix
 
       ../../modules/grzegorz.nix
+      ../../modules/spotifyd.nix
     ];
 
   boot.loader.systemd-boot.enable = true;

hosts/ildkule/services/monitoring/grafana.nix

@@ -34,13 +34,13 @@ in {
         {
           name = "Ildkule Prometheus";
           type = "prometheus";
-          url = "http://${config.services.prometheus.listenAddress}:${toString config.services.prometheus.port}";
+          url = ("http://${config.services.prometheus.listenAddress}:${toString config.services.prometheus.port}");
-          isDefault = true;
+         isDefault = true;
         }
         {
           name = "Ildkule loki";
           type = "loki";
-          url = "http://${config.services.loki.configuration.server.http_listen_address}:${toString config.services.loki.configuration.server.http_listen_port}";
+          url = ("http://${config.services.loki.configuration.server.http_listen_address}:${toString config.services.loki.configuration.server.http_listen_port}");
         }
       ];
       dashboards.settings.providers = [
@@ -56,13 +56,13 @@ in {
           url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
           options.path = dashboards/synapse.json;
         }
-        # TODO: enable once https://github.com/NixOS/nixpkgs/pull/242365 gets merged
+	# TODO: enable once https://github.com/NixOS/nixpkgs/pull/242365 gets merged
-        # {
+	# {
-        #   name = "MySQL";
+	#   name = "MySQL";
-        #   type = "file";
+	#   type = "file";
-        #   url = "https://raw.githubusercontent.com/prometheus/mysqld_exporter/main/mysqld-mixin/dashboards/mysql-overview.json";
+	#   url = "https://raw.githubusercontent.com/prometheus/mysqld_exporter/main/mysqld-mixin/dashboards/mysql-overview.json";
-        #   options.path = dashboards/mysql.json;
+	#   options.path = dashboards/mysql.json;
-        # }
+	# }
         {
           name = "Postgresql";
           type = "file";

hosts/ildkule/services/monitoring/loki.nix

@@ -58,7 +58,7 @@ in {
       };
 
       limits_config = {
-        allow_structured_metadata = false;
+	allow_structured_metadata = false;
         reject_old_samples = true;
         reject_old_samples_max_age = "72h";
       };

hosts/skrott/configuration.nix

@@ -1,10 +0,0 @@
-{ lib, values, ... }: {
-  system.stateVersion = "22.05";
-
-  systemd.network.networks."30-all" = values.defaultNetworkConfig // {
-    matchConfig.Name = "eth0";
-    address = with values.hosts.skrott; [ (ipv4 + "/25") (ipv6 + "/64") ];
-  };
-
-  networking.hostName = lib.mkForce "skrot";
-}

justfile

@@ -1,25 +0,0 @@
-export GUM_FILTER_HEIGHT := "15"
-nom := `if command -v nom >/dev/null; then echo nom; else echo nix; fi`
-
-@_default:
-  just "$(gum choose --ordered --header "Pick a recipie..." $(just --summary --unsorted))"
-
-check:
-  nix flake check --keep-going
-
-build-machine machine=`just _a_machine`:
-  {{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel
-
-run-vm machine=`just _a_machine`:
-  nixos-rebuild build-vm --flake .#{{ machine }}
-  QEMU_NET_OPTS="hostfwd=tcp::8080-:80,hostfwd=tcp::8081-:443,hostfwd=tcp::2222-:22" ./result/bin/run-*-vm
-
-@update-inputs:
-  nix eval .#inputs --apply builtins.attrNames --json \
-    | jq '.[]' -r \
-    | gum choose --no-limit --height=15 \
-    | xargs nix flake update --commit-lock-file
-
-
-_a_machine:
-  nix eval .#nixosConfigurations --apply builtins.attrNames --json | jq .[] -r | gum filter

modules/snakeoil-certs.nix

@@ -36,10 +36,10 @@ in
           type = lib.types.str;
           default = "${name}.key";
         };
-        subject = lib.mkOption {
+	subject = lib.mkOption {
-          type = lib.types.str;
+	  type = lib.types.str;
-          default = "/C=NO/O=Programvareverkstedet/CN=*.pvv.ntnu.no/emailAddress=drift@pvv.ntnu.no";
+	  default = "/C=NO/O=Programvareverkstedet/CN=*.pvv.ntnu.no/emailAddress=drift@pvv.ntnu.no";
-        };
+	};
       };
     }));
   };
@@ -54,16 +54,16 @@ in
         mkdir -p $(dirname "${value.certificate}") $(dirname "${value.certificateKey}")
         if ! ${openssl} x509 -checkend 86400 -noout -in ${value.certificate}
         then
-          echo "Regenerating '${value.certificate}'"
+           echo "Regenerating '${value.certificate}'"
-          ${openssl} req \
+           ${openssl} req \
-            -newkey rsa:4096 \
+             -newkey rsa:4096 \
-            -new -x509 \
+             -new -x509 \
-            -days "${toString value.daysValid}" \
+             -days "${toString value.daysValid}" \
-            -nodes \
+             -nodes \
-            -subj "${value.subject}" \
+             -subj "${value.subject}" \
-            -out "${value.certificate}" \
+             -out "${value.certificate}" \
-            -keyout "${value.certificateKey}" \
+             -keyout "${value.certificateKey}" \
-            ${lib.escapeShellArgs value.extraOpenSSLArgs}
+             ${lib.escapeShellArgs value.extraOpenSSLArgs}
         fi
         chown "${value.owner}:${value.group}" "${value.certificate}"
         chown "${value.owner}:${value.group}" "${value.certificateKey}"

modules/spotifyd.nix

@@ -0,0 +1,44 @@
+{ lib, config, ... }:
+
+{
+
+  services.spotifyd.enable = true;
+  # https://docs.spotifyd.rs/config/File.html
+  services.spotifyd.settings = {
+    device_name = "${config.networking.hostName}-spotifyd";
+    device_type = "t_v"; # in ["unknown" "computer" "tablet" "smartphone" "speaker" "t_v"],
+    bitrate = 160; # in [96 160 320]
+    volume_normalisation = true;
+    zeroconf_port = 44677; # instead of user/password
+
+    # this is the place you add blinkenlights
+    #on_song_change_hook = "rm -rf / --no-preserve-root";
+  };
+
+  systemd.services.spotifyd.serviceConfig = {
+    SupplementaryGroups = [
+      "audio"
+      "pipewire"
+    ];
+  };
+
+  services.avahi.enable = true;
+  services.avahi.publish.enable = true;
+  services.avahi.publish.addresses = true;
+  services.avahi.publish.domain = true;
+  services.avahi.extraServiceFiles.spotifyd = ''
+    <?xml version="1.0" standalone='no'?><!--*-nxml-*-->
+    <!DOCTYPE service-group SYSTEM "avahi-service.dtd">
+    <service-group>
+      <name replace-wildcards="yes">%h</name>
+      <service>
+        <type>_spotify-connect._tcp</type>
+        <port>${builtins.toString config.services.spotifyd.settings.zeroconf_port}</port>
+      </service>
+    </service-group>
+  '';
+
+  networking.firewall.allowedTCPPorts = [ config.services.spotifyd.settings.zeroconf_port ];
+  networking.firewall.allowedUDPPorts = [ 5353 ]; # mDNS
+
+}

secrets/bicep/bicep.yaml

@@ -1,6 +1,5 @@
 calendar-bot:
     matrix_token: ENC[AES256_GCM,data:zJv9sw6pEzb9hxKT682wsD87HC9iejbps2wl2Z5QW1XZUSBHdcqyg1pxd+jFKTeKGQ==,iv:zDbvF1H98NsECjCtGXS+Y9HIhXowzz9HF9mltqnArog=,tag:/ftcOSQ13ElkVJBxYIMUGQ==,type:str]
-    mysql_password: ENC[AES256_GCM,data:Gqag8yOgPH3ntoT5TmaqJWv1j+si2qIyz5Ryfw5E2A==,iv:kQDcxnPfwJQcFovI4f87UDt18F8ah3z5xeY86KmdCyY=,tag:A1sCSNXJziAmtUWohqwJgg==,type:str]
 mysql:
     password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
 sops:
@@ -63,8 +62,8 @@ sops:
             cTh5bnJ3WW90aXRCSUp6NHFYeU1tZ0kK4afdtJwGNu6wLRI0fuu+mBVeqVeB0rgX
             0q5hwyzjiRnHnyjF38CmcGgydSfDRmF6P+WIMbCwXC6LwfRhAmBGPg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-15T21:18:33Z"
+    lastmodified: "2023-09-05T23:28:56Z"
-    mac: ENC[AES256_GCM,data:uR5HgeDAYqoqB9kk1V6p0T30+v6WpQJi4+qIeCDRnoUPnQKUVR10hvBhICck+E+Uh8p+tGhM6Uf3YrAJAV0ZCUiNJjtwDJQQLUDT53vdOAXN4xADCQqNuhgVwVMaruoTheEiwOswRuhFeEwy0gBj3Ze2pu47lueHYclmEzumLeQ=,iv:t0UyXN2YaR2m7M/pV2wTLJG5wVfqTIUs7wSQMmyeTVw=,tag:O7dIffzrDAXz3kGx5uazhw==,type:str]
+    mac: ENC[AES256_GCM,data:pCWTkmCQgBOqhejK2sCLQ3H8bRXmXlToQxYmOG0IWDo2eGiZOLuIkZ1/1grYgfxAGiD4ysJod0nJuvo+eAsMeYAy6QJVtrOqO2d9V2NEdzLckXyYvwyJyZoFbNC5EW9471V0m4jLRSh5821ckNo/wtWFR11wfO15tI3MqtD1rtA=,iv:QDnckPl0LegaH0b7V4WAtmVXaL4LN+k3uKHQI2dkW7E=,tag:mScUQBR0ZHl1pi/YztrvFg==,type:str]
     pgp:
         - created_at: "2024-08-04T00:03:40Z"
           enc: |-
@@ -87,4 +86,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.7.3

shell.nix

@@ -1,14 +1,9 @@
 { pkgs ? import <nixpkgs> {} }:
 pkgs.mkShellNoCC {
   packages = with pkgs; [
-    just
-    jq
-    gum
     sops
     gnupg
-    statix
     openstackclient
-    editorconfig-checker
   ];
 
   shellHook = ''

statix.toml

@@ -1,24 +0,0 @@
-ignore = [".direnv"]
-nix_version = '2.18' # '2.4'
-disabled = [
-    # "bool_comparison", # W01
-    # "empty_let_in", # W02
-    "manual_inherit", # W03
-    "manual_inherit_from", # W04
-    # "legacy_let_syntax", # W05
-    "collapsible_let_in", # W06
-    # "eta_reduction", # W07
-    # "useless_parens", # W08
-    "empty_pattern", # W10
-    # "redundant_pattern_bind", # W11
-    # "unquoted_uri", # W12
-    # "deprecated_is_null", # W13
-    # "empty_inherit", # W14
-    # "faster_groupby", # W15
-    # "faster_zipattrswith", # W16
-    # "deprecated_to_path", # W17
-    # "bool_simplification", # W18
-    # "useless_has_attr", # W19
-    "repeated_keys", # W20
-    "empty_list_concat", # W23
-]

values.nix

@@ -63,10 +63,6 @@ in rec {
       ipv4 = pvv-ipv4 231;
       ipv6 = pvv-ipv6 231;
     };
-    skrott = {
-      ipv4 = pvv-ipv4 235;
-      ipv6 = pvv-ipv6 235;
-    };
   };
 
   defaultNetworkConfig = {