Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| c7cc9ab029 |
@@ -1,10 +0,0 @@
|
|||||||
root = true
|
|
||||||
|
|
||||||
[*]
|
|
||||||
end_of_line = lf
|
|
||||||
insert_final_newline = true
|
|
||||||
trim_trailing_whitespace = true
|
|
||||||
|
|
||||||
[*.nix]
|
|
||||||
indent_style = space
|
|
||||||
indent_size = 2
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
e00008da1afe0d760badd34bbeddff36bb08c475
|
|
||||||
1
.gitignore
vendored
1
.gitignore
vendored
@@ -1,4 +1,3 @@
|
|||||||
result*
|
result*
|
||||||
/configuration.nix
|
/configuration.nix
|
||||||
/.direnv/
|
/.direnv/
|
||||||
*.qcow2
|
|
||||||
|
|||||||
@@ -30,7 +30,7 @@ creation_rules:
|
|||||||
- *user_oysteikt
|
- *user_oysteikt
|
||||||
|
|
||||||
# Host specific secrets
|
# Host specific secrets
|
||||||
|
|
||||||
- path_regex: secrets/bekkalokk/[^/]+\.yaml$
|
- path_regex: secrets/bekkalokk/[^/]+\.yaml$
|
||||||
key_groups:
|
key_groups:
|
||||||
- age:
|
- age:
|
||||||
@@ -66,7 +66,7 @@ creation_rules:
|
|||||||
- *user_pederbs_bjarte
|
- *user_pederbs_bjarte
|
||||||
pgp:
|
pgp:
|
||||||
- *user_oysteikt
|
- *user_oysteikt
|
||||||
|
|
||||||
- path_regex: secrets/bicep/[^/]+\.yaml$
|
- path_regex: secrets/bicep/[^/]+\.yaml$
|
||||||
key_groups:
|
key_groups:
|
||||||
- age:
|
- age:
|
||||||
|
|||||||
17
base.nix
17
base.nix
@@ -76,19 +76,10 @@
|
|||||||
# Trusted users on the nix builder machines
|
# Trusted users on the nix builder machines
|
||||||
users.groups."nix-builder-users".name = "nix-builder-users";
|
users.groups."nix-builder-users".name = "nix-builder-users";
|
||||||
|
|
||||||
# Let's not thermal throttle
|
|
||||||
services.thermald.enable = lib.mkIf (lib.all (x: x) [
|
|
||||||
(config.nixpkgs.system == "x86_64-linux")
|
|
||||||
(!config.boot.isContainer or false)
|
|
||||||
]) true;
|
|
||||||
|
|
||||||
services.openssh = {
|
services.openssh = {
|
||||||
enable = true;
|
enable = true;
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
PubkeyAcceptedAlgorithms=+ssh-rsa
|
PubkeyAcceptedAlgorithms=+ssh-rsa
|
||||||
Match Group wheel
|
|
||||||
PasswordAuthentication no
|
|
||||||
Match All
|
|
||||||
'';
|
'';
|
||||||
settings.PermitRootLogin = "yes";
|
settings.PermitRootLogin = "yes";
|
||||||
};
|
};
|
||||||
@@ -139,12 +130,4 @@
|
|||||||
acceptTerms = true;
|
acceptTerms = true;
|
||||||
defaults.email = "drift@pvv.ntnu.no";
|
defaults.email = "drift@pvv.ntnu.no";
|
||||||
};
|
};
|
||||||
# Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
|
|
||||||
virtualisation.vmVariant = {
|
|
||||||
security.acme.defaults.server = "https://127.0.0.1";
|
|
||||||
security.acme.preliminarySelfsigned = true;
|
|
||||||
|
|
||||||
users.users.root.initialPassword = "root";
|
|
||||||
};
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|||||||
65
flake.lock
generated
65
flake.lock
generated
@@ -1,26 +1,5 @@
|
|||||||
{
|
{
|
||||||
"nodes": {
|
"nodes": {
|
||||||
"dibbler": {
|
|
||||||
"inputs": {
|
|
||||||
"flake-utils": "flake-utils",
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1693682284,
|
|
||||||
"narHash": "sha256-FvVCkHH80YyUiqQlnGNr49rZRBniihF6YRpytguEkFQ=",
|
|
||||||
"ref": "refs/heads/master",
|
|
||||||
"rev": "8a6a0c12ba37e239684d2de1be12fd73903cfb2c",
|
|
||||||
"revCount": 193,
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"disko": {
|
"disko": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
@@ -43,7 +22,7 @@
|
|||||||
},
|
},
|
||||||
"fix-python": {
|
"fix-python": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-utils": "flake-utils_2",
|
"flake-utils": "flake-utils",
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"grzegorz",
|
"grzegorz",
|
||||||
"nixpkgs"
|
"nixpkgs"
|
||||||
@@ -67,24 +46,6 @@
|
|||||||
"inputs": {
|
"inputs": {
|
||||||
"systems": "systems"
|
"systems": "systems"
|
||||||
},
|
},
|
||||||
"locked": {
|
|
||||||
"lastModified": 1692799911,
|
|
||||||
"narHash": "sha256-3eihraek4qL744EvQXsK1Ha6C3CR7nnT8X2qWap4RNk=",
|
|
||||||
"owner": "numtide",
|
|
||||||
"repo": "flake-utils",
|
|
||||||
"rev": "f9e7cf818399d17d347f847525c5a5a8032e4e44",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "numtide",
|
|
||||||
"repo": "flake-utils",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"flake-utils_2": {
|
|
||||||
"inputs": {
|
|
||||||
"systems": "systems_2"
|
|
||||||
},
|
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1689068808,
|
"lastModified": 1689068808,
|
||||||
"narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
|
"narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
|
||||||
@@ -233,11 +194,11 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1723850344,
|
"lastModified": 1693136143,
|
||||||
"narHash": "sha256-aT37O9l9eclWEnqxASVNBL1dKwDHZUOqdbA4VO9DJvw=",
|
"narHash": "sha256-amHprjftc3y/bg8yf4hITCLa+ez5HIi0yGfR7TU6UIc=",
|
||||||
"ref": "refs/heads/main",
|
"ref": "refs/heads/main",
|
||||||
"rev": "38b66677ab8c01aee10cd59e745af9ce3ea88092",
|
"rev": "a32894b305f042d561500f5799226afd1faf5abb",
|
||||||
"revCount": 19,
|
"revCount": 9,
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
|
"url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
|
||||||
},
|
},
|
||||||
@@ -268,7 +229,6 @@
|
|||||||
},
|
},
|
||||||
"root": {
|
"root": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"dibbler": "dibbler",
|
|
||||||
"disko": "disko",
|
"disko": "disko",
|
||||||
"grzegorz": "grzegorz",
|
"grzegorz": "grzegorz",
|
||||||
"grzegorz-clients": "grzegorz-clients",
|
"grzegorz-clients": "grzegorz-clients",
|
||||||
@@ -316,21 +276,6 @@
|
|||||||
"repo": "default",
|
"repo": "default",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
|
||||||
"systems_2": {
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1681028828,
|
|
||||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
|
||||||
"owner": "nix-systems",
|
|
||||||
"repo": "default",
|
|
||||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "nix-systems",
|
|
||||||
"repo": "default",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"root": "root",
|
"root": "root",
|
||||||
|
|||||||
22
flake.nix
22
flake.nix
@@ -17,9 +17,6 @@
|
|||||||
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
|
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
|
||||||
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
dibbler.url = "git+https://git.pvv.ntnu.no/Projects/dibbler.git";
|
|
||||||
dibbler.inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
|
|
||||||
matrix-next.url = "github:dali99/nixos-matrix-modules/v0.6.0";
|
matrix-next.url = "github:dali99/nixos-matrix-modules/v0.6.0";
|
||||||
matrix-next.inputs.nixpkgs.follows = "nixpkgs";
|
matrix-next.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
@@ -40,8 +37,8 @@
|
|||||||
"aarch64-linux"
|
"aarch64-linux"
|
||||||
"aarch64-darwin"
|
"aarch64-darwin"
|
||||||
];
|
];
|
||||||
forAllSystems = f: nixlib.genAttrs systems f;
|
forAllSystems = f: nixlib.genAttrs systems (system: f system);
|
||||||
allMachines = builtins.attrNames self.nixosConfigurations;
|
allMachines = nixlib.mapAttrsToList (name: _: name) self.nixosConfigurations;
|
||||||
importantMachines = [
|
importantMachines = [
|
||||||
"bekkalokk"
|
"bekkalokk"
|
||||||
"bicep"
|
"bicep"
|
||||||
@@ -50,8 +47,6 @@
|
|||||||
"ildkule"
|
"ildkule"
|
||||||
];
|
];
|
||||||
in {
|
in {
|
||||||
inherit inputs;
|
|
||||||
|
|
||||||
nixosConfigurations = let
|
nixosConfigurations = let
|
||||||
unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
|
unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
|
||||||
nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
|
nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
|
||||||
@@ -127,18 +122,6 @@
|
|||||||
];
|
];
|
||||||
};
|
};
|
||||||
buskerud = stableNixosConfig "buskerud" { };
|
buskerud = stableNixosConfig "buskerud" { };
|
||||||
skrott = stableNixosConfig "skrott" {
|
|
||||||
system = "aarch64-linux";
|
|
||||||
modules = [
|
|
||||||
(nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
|
|
||||||
inputs.dibbler.nixosModules.default
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
nixosModules = {
|
|
||||||
snakeoil-certs = ./modules/snakeoil-certs.nix;
|
|
||||||
snappymail = ./modules/snappymail.nix;
|
|
||||||
};
|
};
|
||||||
|
|
||||||
devShells = forAllSystems (system: {
|
devShells = forAllSystems (system: {
|
||||||
@@ -157,7 +140,6 @@
|
|||||||
|
|
||||||
simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
|
simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
|
||||||
|
|
||||||
skrot = self.nixosConfigurations.skrott.config.system.build.sdImage;
|
|
||||||
} //
|
} //
|
||||||
(nixlib.pipe null [
|
(nixlib.pipe null [
|
||||||
(_: pkgs.callPackage ./packages/mediawiki-extensions { })
|
(_: pkgs.callPackage ./packages/mediawiki-extensions { })
|
||||||
|
|||||||
@@ -15,9 +15,9 @@ let
|
|||||||
enable = true;
|
enable = true;
|
||||||
name = "git-runner-${name}"; url = "https://git.pvv.ntnu.no";
|
name = "git-runner-${name}"; url = "https://git.pvv.ntnu.no";
|
||||||
labels = [
|
labels = [
|
||||||
"debian-latest:docker://node:18-bullseye"
|
"debian-latest:docker://node:18-bullseye"
|
||||||
"ubuntu-latest:docker://node:18-bullseye"
|
"ubuntu-latest:docker://node:18-bullseye"
|
||||||
];
|
];
|
||||||
tokenFile = config.sops.secrets."gitea/runners/${name}".path;
|
tokenFile = config.sops.secrets."gitea/runners/${name}".path;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|||||||
@@ -135,16 +135,10 @@ in {
|
|||||||
script = let
|
script = let
|
||||||
logo-svg = ../../../../assets/logo_blue_regular.svg;
|
logo-svg = ../../../../assets/logo_blue_regular.svg;
|
||||||
logo-png = ../../../../assets/logo_blue_regular.png;
|
logo-png = ../../../../assets/logo_blue_regular.png;
|
||||||
extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
|
|
||||||
<a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
|
|
||||||
<a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
|
|
||||||
<a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
|
|
||||||
'';
|
|
||||||
in ''
|
in ''
|
||||||
install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
|
install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
|
||||||
install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
|
install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
|
||||||
install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
|
install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
|
||||||
install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
|
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -112,7 +112,7 @@ class PwAuth extends \SimpleSAML\Module\core\Auth\UserPassBase
|
|||||||
array_shift($groups);
|
array_shift($groups);
|
||||||
array_shift($groups);
|
array_shift($groups);
|
||||||
array_pop($groups);
|
array_pop($groups);
|
||||||
|
|
||||||
$info = posix_getpwnam($uid);
|
$info = posix_getpwnam($uid);
|
||||||
$group = $info['gid'];
|
$group = $info['gid'];
|
||||||
if (!in_array($group, $groups)) {
|
if (!in_array($group, $groups)) {
|
||||||
|
|||||||
@@ -58,7 +58,7 @@ $config = [
|
|||||||
/*
|
/*
|
||||||
* The following settings are *filesystem paths* which define where
|
* The following settings are *filesystem paths* which define where
|
||||||
* SimpleSAMLphp can find or write the following things:
|
* SimpleSAMLphp can find or write the following things:
|
||||||
* - 'cachedir': Where SimpleSAMLphp can write its cache.
|
* - 'cachedir': Where SimpleSAMLphp can write its cache.
|
||||||
* - 'loggingdir': Where to write logs. MUST be set to NULL when using a logging
|
* - 'loggingdir': Where to write logs. MUST be set to NULL when using a logging
|
||||||
* handler other than `file`.
|
* handler other than `file`.
|
||||||
* - 'datadir': Storage of general data.
|
* - 'datadir': Storage of general data.
|
||||||
|
|||||||
@@ -22,62 +22,62 @@ let
|
|||||||
# openssl req -newkey rsa:4096 -new -x509 -days 365 -nodes -out idp.crt -keyout idp.pem
|
# openssl req -newkey rsa:4096 -new -x509 -days 365 -nodes -out idp.crt -keyout idp.pem
|
||||||
"metadata/saml20-idp-hosted.php" = pkgs.writeText "saml20-idp-remote.php" ''
|
"metadata/saml20-idp-hosted.php" = pkgs.writeText "saml20-idp-remote.php" ''
|
||||||
<?php
|
<?php
|
||||||
$metadata['https://idp.pvv.ntnu.no/'] = array(
|
$metadata['https://idp.pvv.ntnu.no/'] = array(
|
||||||
'host' => '__DEFAULT__',
|
'host' => '__DEFAULT__',
|
||||||
'privatekey' => '${config.sops.secrets."idp/privatekey".path}',
|
'privatekey' => '${config.sops.secrets."idp/privatekey".path}',
|
||||||
'certificate' => '${./idp.crt}',
|
'certificate' => '${./idp.crt}',
|
||||||
'auth' => 'pwauth',
|
'auth' => 'pwauth',
|
||||||
);
|
);
|
||||||
?>
|
?>
|
||||||
'';
|
'';
|
||||||
|
|
||||||
"metadata/saml20-sp-remote.php" = pkgs.writeText "saml20-sp-remote.php" ''
|
"metadata/saml20-sp-remote.php" = pkgs.writeText "saml20-sp-remote.php" ''
|
||||||
<?php
|
<?php
|
||||||
${ lib.pipe config.services.idp.sp-remote-metadata [
|
${ lib.pipe config.services.idp.sp-remote-metadata [
|
||||||
(map (url: ''
|
(map (url: ''
|
||||||
$metadata['${url}'] = [
|
$metadata['${url}'] = [
|
||||||
'SingleLogoutService' => [
|
'SingleLogoutService' => [
|
||||||
[
|
[
|
||||||
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
|
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
|
||||||
'Location' => '${url}module.php/saml/sp/saml2-logout.php/default-sp',
|
'Location' => '${url}module.php/saml/sp/saml2-logout.php/default-sp',
|
||||||
],
|
],
|
||||||
[
|
[
|
||||||
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP',
|
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP',
|
||||||
'Location' => '${url}module.php/saml/sp/saml2-logout.php/default-sp',
|
'Location' => '${url}module.php/saml/sp/saml2-logout.php/default-sp',
|
||||||
],
|
],
|
||||||
],
|
],
|
||||||
'AssertionConsumerService' => [
|
'AssertionConsumerService' => [
|
||||||
[
|
[
|
||||||
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
|
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
|
||||||
'Location' => '${url}module.php/saml/sp/saml2-acs.php/default-sp',
|
'Location' => '${url}module.php/saml/sp/saml2-acs.php/default-sp',
|
||||||
'index' => 0,
|
'index' => 0,
|
||||||
],
|
],
|
||||||
[
|
[
|
||||||
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact',
|
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact',
|
||||||
'Location' => '${url}module.php/saml/sp/saml2-acs.php/default-sp',
|
'Location' => '${url}module.php/saml/sp/saml2-acs.php/default-sp',
|
||||||
'index' => 1,
|
'index' => 1,
|
||||||
],
|
],
|
||||||
],
|
],
|
||||||
];
|
];
|
||||||
''))
|
''))
|
||||||
(lib.concatStringsSep "\n")
|
(lib.concatStringsSep "\n")
|
||||||
]}
|
]}
|
||||||
?>
|
?>
|
||||||
'';
|
'';
|
||||||
|
|
||||||
"config/authsources.php" = pkgs.writeText "idp-authsources.php" ''
|
"config/authsources.php" = pkgs.writeText "idp-authsources.php" ''
|
||||||
<?php
|
<?php
|
||||||
$config = array(
|
$config = array(
|
||||||
'admin' => array(
|
'admin' => array(
|
||||||
'core:AdminPassword'
|
'core:AdminPassword'
|
||||||
),
|
),
|
||||||
'pwauth' => array(
|
'pwauth' => array(
|
||||||
'authpwauth:PwAuth',
|
'authpwauth:PwAuth',
|
||||||
'pwauth_bin_path' => '${lib.getExe pwAuthScript}',
|
'pwauth_bin_path' => '${lib.getExe pwAuthScript}',
|
||||||
'mail_domain' => '@pvv.ntnu.no',
|
'mail_domain' => '@pvv.ntnu.no',
|
||||||
),
|
),
|
||||||
);
|
);
|
||||||
?>
|
?>
|
||||||
'';
|
'';
|
||||||
|
|
||||||
"config/config.php" = pkgs.runCommandLocal "simplesamlphp-config.php" { } ''
|
"config/config.php" = pkgs.runCommandLocal "simplesamlphp-config.php" { } ''
|
||||||
@@ -108,7 +108,7 @@ in
|
|||||||
List of urls point to (simplesamlphp) service profiders, which the idp should trust.
|
List of urls point to (simplesamlphp) service profiders, which the idp should trust.
|
||||||
|
|
||||||
:::{.note}
|
:::{.note}
|
||||||
Make sure the url ends with a `/`
|
Make sure the url ends with a `/`
|
||||||
:::
|
:::
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
@@ -132,7 +132,7 @@ in
|
|||||||
owner = "idp";
|
owner = "idp";
|
||||||
group = "idp";
|
group = "idp";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
users.groups."idp" = { };
|
users.groups."idp" = { };
|
||||||
users.users."idp" = {
|
users.users."idp" = {
|
||||||
@@ -199,9 +199,9 @@ in
|
|||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
"^~ /simplesaml/".extraConfig = ''
|
"^~ /simplesaml/".extraConfig = ''
|
||||||
rewrite ^/simplesaml/(.*)$ /$1 redirect;
|
rewrite ^/simplesaml/(.*)$ /$1 redirect;
|
||||||
return 404;
|
return 404;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|||||||
@@ -879,15 +879,15 @@ let
|
|||||||
|
|
||||||
inherit (pkgs) pam_krb5 pam_ccreds;
|
inherit (pkgs) pam_krb5 pam_ccreds;
|
||||||
|
|
||||||
use_ldap = config.users.ldap.enable && config.users.ldap.loginPam;
|
use_ldap = (config.users.ldap.enable && config.users.ldap.loginPam);
|
||||||
pam_ldap = if config.users.ldap.daemon.enable then pkgs.nss_pam_ldapd else pkgs.pam_ldap;
|
pam_ldap = if config.users.ldap.daemon.enable then pkgs.nss_pam_ldapd else pkgs.pam_ldap;
|
||||||
|
|
||||||
# Create a limits.conf(5) file.
|
# Create a limits.conf(5) file.
|
||||||
makeLimitsConf = limits:
|
makeLimitsConf = limits:
|
||||||
pkgs.writeText "limits.conf"
|
pkgs.writeText "limits.conf"
|
||||||
(concatMapStrings ({ domain, type, item, value }:
|
(concatMapStrings ({ domain, type, item, value }:
|
||||||
"${domain} ${type} ${item} ${toString value}\n")
|
"${domain} ${type} ${item} ${toString value}\n")
|
||||||
limits);
|
limits);
|
||||||
|
|
||||||
limitsType = with lib.types; listOf (submodule ({ ... }: {
|
limitsType = with lib.types; listOf (submodule ({ ... }: {
|
||||||
options = {
|
options = {
|
||||||
@@ -935,8 +935,8 @@ let
|
|||||||
}));
|
}));
|
||||||
|
|
||||||
motd = if config.users.motdFile == null
|
motd = if config.users.motdFile == null
|
||||||
then pkgs.writeText "motd" config.users.motd
|
then pkgs.writeText "motd" config.users.motd
|
||||||
else config.users.motdFile;
|
else config.users.motdFile;
|
||||||
|
|
||||||
makePAMService = name: service:
|
makePAMService = name: service:
|
||||||
{ name = "pam.d/${name}";
|
{ name = "pam.d/${name}";
|
||||||
@@ -976,20 +976,20 @@ in
|
|||||||
item = "maxlogins";
|
item = "maxlogins";
|
||||||
value = "4";
|
value = "4";
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
description = lib.mdDoc ''
|
description = lib.mdDoc ''
|
||||||
Define resource limits that should apply to users or groups.
|
Define resource limits that should apply to users or groups.
|
||||||
Each item in the list should be an attribute set with a
|
Each item in the list should be an attribute set with a
|
||||||
{var}`domain`, {var}`type`,
|
{var}`domain`, {var}`type`,
|
||||||
{var}`item`, and {var}`value`
|
{var}`item`, and {var}`value`
|
||||||
attribute. The syntax and semantics of these attributes
|
attribute. The syntax and semantics of these attributes
|
||||||
must be that described in {manpage}`limits.conf(5)`.
|
must be that described in {manpage}`limits.conf(5)`.
|
||||||
|
|
||||||
Note that these limits do not apply to systemd services,
|
Note that these limits do not apply to systemd services,
|
||||||
whose limits can be changed via {option}`systemd.extraConfig`
|
whose limits can be changed via {option}`systemd.extraConfig`
|
||||||
instead.
|
instead.
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
security.pam.services = mkOption {
|
security.pam.services = mkOption {
|
||||||
@@ -1507,10 +1507,10 @@ in
|
|||||||
runuser = { rootOK = true; unixAuth = false; setEnvironment = false; };
|
runuser = { rootOK = true; unixAuth = false; setEnvironment = false; };
|
||||||
|
|
||||||
/* FIXME: should runuser -l start a systemd session? Currently
|
/* FIXME: should runuser -l start a systemd session? Currently
|
||||||
it complains "Cannot create session: Already running in a
|
it complains "Cannot create session: Already running in a
|
||||||
session". */
|
session". */
|
||||||
runuser-l = { rootOK = true; unixAuth = false; };
|
runuser-l = { rootOK = true; unixAuth = false; };
|
||||||
} // optionalAttrs config.security.pam.enableFscrypt {
|
} // optionalAttrs (config.security.pam.enableFscrypt) {
|
||||||
# Allow fscrypt to verify login passphrase
|
# Allow fscrypt to verify login passphrase
|
||||||
fscrypt = {};
|
fscrypt = {};
|
||||||
};
|
};
|
||||||
|
|||||||
@@ -199,7 +199,7 @@ in {
|
|||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
location ~ ^/simplesaml/(?<phpfile>.+?\.php)(?<pathinfo>/.*)?$ {
|
location ~ ^/simplesaml/(?<phpfile>.+?\.php)(?<pathinfo>/.*)?$ {
|
||||||
include ${pkgs.nginx}/conf/fastcgi_params;
|
include ${pkgs.nginx}/conf/fastcgi_params;
|
||||||
fastcgi_pass unix:${config.services.phpfpm.pools.mediawiki.socket};
|
fastcgi_pass unix:${config.services.phpfpm.pools.mediawiki.socket};
|
||||||
fastcgi_param SCRIPT_FILENAME ${simplesamlphp}/share/php/simplesamlphp/public/$phpfile;
|
fastcgi_param SCRIPT_FILENAME ${simplesamlphp}/share/php/simplesamlphp/public/$phpfile;
|
||||||
|
|
||||||
# Must be prepended with the baseurlpath
|
# Must be prepended with the baseurlpath
|
||||||
|
|||||||
@@ -58,7 +58,7 @@ $config = [
|
|||||||
/*
|
/*
|
||||||
* The following settings are *filesystem paths* which define where
|
* The following settings are *filesystem paths* which define where
|
||||||
* SimpleSAMLphp can find or write the following things:
|
* SimpleSAMLphp can find or write the following things:
|
||||||
* - 'cachedir': Where SimpleSAMLphp can write its cache.
|
* - 'cachedir': Where SimpleSAMLphp can write its cache.
|
||||||
* - 'loggingdir': Where to write logs. MUST be set to NULL when using a logging
|
* - 'loggingdir': Where to write logs. MUST be set to NULL when using a logging
|
||||||
* handler other than `file`.
|
* handler other than `file`.
|
||||||
* - 'datadir': Storage of general data.
|
* - 'datadir': Storage of general data.
|
||||||
|
|||||||
@@ -4,7 +4,7 @@ with lib;
|
|||||||
let
|
let
|
||||||
cfg = config.services.roundcube;
|
cfg = config.services.roundcube;
|
||||||
domain = "webmail.pvv.ntnu.no";
|
domain = "webmail.pvv.ntnu.no";
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
services.roundcube = {
|
services.roundcube = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|||||||
@@ -21,8 +21,8 @@ in {
|
|||||||
services.idp.sp-remote-metadata = [
|
services.idp.sp-remote-metadata = [
|
||||||
"https://www.pvv.ntnu.no/simplesaml/"
|
"https://www.pvv.ntnu.no/simplesaml/"
|
||||||
"https://pvv.ntnu.no/simplesaml/"
|
"https://pvv.ntnu.no/simplesaml/"
|
||||||
"https://www.pvv.org/simplesaml/"
|
"https://www.pvv.org/simplesaml/"
|
||||||
"https://pvv.org/simplesaml/"
|
"https://pvv.org/simplesaml/"
|
||||||
];
|
];
|
||||||
|
|
||||||
services.pvv-nettsiden = {
|
services.pvv-nettsiden = {
|
||||||
@@ -43,7 +43,7 @@ in {
|
|||||||
'idp' => 'https://idp.pvv.ntnu.no/',
|
'idp' => 'https://idp.pvv.ntnu.no/',
|
||||||
),
|
),
|
||||||
);
|
);
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|||||||
@@ -46,7 +46,7 @@ in {
|
|||||||
while IFS= read fname; do
|
while IFS= read fname; do
|
||||||
# Skip this file if an up-to-date thumbnail already exists
|
# Skip this file if an up-to-date thumbnail already exists
|
||||||
if [ -f ".thumbnails/$fname.png" ] && \
|
if [ -f ".thumbnails/$fname.png" ] && \
|
||||||
[ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
|
[ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
|
||||||
then
|
then
|
||||||
continue
|
continue
|
||||||
fi
|
fi
|
||||||
@@ -54,7 +54,7 @@ in {
|
|||||||
echo "Creating thumbnail for $fname"
|
echo "Creating thumbnail for $fname"
|
||||||
mkdir -p $(dirname ".thumbnails/$fname")
|
mkdir -p $(dirname ".thumbnails/$fname")
|
||||||
convert -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
|
convert -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
|
||||||
touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
|
touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
|
||||||
done <<< "$images"
|
done <<< "$images"
|
||||||
'';
|
'';
|
||||||
|
|
||||||
|
|||||||
@@ -12,7 +12,8 @@
|
|||||||
./services/mysql.nix
|
./services/mysql.nix
|
||||||
./services/postgres.nix
|
./services/postgres.nix
|
||||||
./services/mysql.nix
|
./services/mysql.nix
|
||||||
./services/calendar-bot.nix
|
# TODO: fix the calendar bot
|
||||||
|
# ./services/calendar-bot.nix
|
||||||
|
|
||||||
./services/matrix
|
./services/matrix
|
||||||
];
|
];
|
||||||
|
|||||||
@@ -2,19 +2,11 @@
|
|||||||
let
|
let
|
||||||
cfg = config.services.pvv-calendar-bot;
|
cfg = config.services.pvv-calendar-bot;
|
||||||
in {
|
in {
|
||||||
sops.secrets = {
|
sops.secrets."calendar-bot/matrix_token" = {
|
||||||
"calendar-bot/matrix_token" = {
|
sopsFile = ../../../secrets/bicep/bicep.yaml;
|
||||||
sopsFile = ../../../secrets/bicep/bicep.yaml;
|
key = "calendar-bot/matrix_token";
|
||||||
key = "calendar-bot/matrix_token";
|
owner = cfg.user;
|
||||||
owner = cfg.user;
|
group = cfg.group;
|
||||||
group = cfg.group;
|
|
||||||
};
|
|
||||||
"calendar-bot/mysql_password" = {
|
|
||||||
sopsFile = ../../../secrets/bicep/bicep.yaml;
|
|
||||||
key = "calendar-bot/mysql_password";
|
|
||||||
owner = cfg.user;
|
|
||||||
group = cfg.group;
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
services.pvv-calendar-bot = {
|
services.pvv-calendar-bot = {
|
||||||
@@ -26,11 +18,6 @@ in {
|
|||||||
user = "@bot_calendar:pvv.ntnu.no";
|
user = "@bot_calendar:pvv.ntnu.no";
|
||||||
channel = "!gkNLUIhYVpEyLatcRz:pvv.ntnu.no";
|
channel = "!gkNLUIhYVpEyLatcRz:pvv.ntnu.no";
|
||||||
};
|
};
|
||||||
database = {
|
|
||||||
host = "mysql.pvv.ntnu.no";
|
|
||||||
user = "calendar-bot";
|
|
||||||
passwordFile = config.sops.secrets."calendar-bot/mysql_password".path;
|
|
||||||
};
|
|
||||||
secretsFile = config.sops.secrets."calendar-bot/matrix_token".path;
|
secretsFile = config.sops.secrets."calendar-bot/matrix_token".path;
|
||||||
onCalendar = "*-*-* 09:00:00";
|
onCalendar = "*-*-* 09:00:00";
|
||||||
};
|
};
|
||||||
|
|||||||
@@ -26,7 +26,7 @@
|
|||||||
|
|
||||||
"turns:turn.pvv.ntnu.no:5349?transport=tcp"
|
"turns:turn.pvv.ntnu.no:5349?transport=tcp"
|
||||||
"turns:turn.pvv.ntnu.no:5349?transport=udp"
|
"turns:turn.pvv.ntnu.no:5349?transport=udp"
|
||||||
|
|
||||||
"turns:turn.pvv.ntnu.no:3478?transport=udp"
|
"turns:turn.pvv.ntnu.no:3478?transport=udp"
|
||||||
"turns:turn.pvv.ntnu.no:3478?transport=tcp"
|
"turns:turn.pvv.ntnu.no:3478?transport=tcp"
|
||||||
"turn:turn.pvv.ntnu.no:3478?transport=udp"
|
"turn:turn.pvv.ntnu.no:3478?transport=udp"
|
||||||
@@ -69,7 +69,7 @@
|
|||||||
|
|
||||||
tls-listening-port = 443;
|
tls-listening-port = 443;
|
||||||
alt-tls-listening-port = 5349;
|
alt-tls-listening-port = 5349;
|
||||||
|
|
||||||
listening-port = 3478;
|
listening-port = 3478;
|
||||||
|
|
||||||
min-port = 49000;
|
min-port = 49000;
|
||||||
@@ -116,7 +116,7 @@
|
|||||||
#total-quota=1200
|
#total-quota=1200
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall = {
|
networking.firewall = {
|
||||||
interfaces.enp6s0f0 = let
|
interfaces.enp6s0f0 = let
|
||||||
range = with config.services.coturn; [ {
|
range = with config.services.coturn; [ {
|
||||||
|
|||||||
@@ -12,6 +12,6 @@
|
|||||||
./discord.nix
|
./discord.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -11,7 +11,7 @@
|
|||||||
services.mjolnir = {
|
services.mjolnir = {
|
||||||
enable = true;
|
enable = true;
|
||||||
pantalaimon.enable = false;
|
pantalaimon.enable = false;
|
||||||
homeserverUrl = "http://127.0.0.1:8008";
|
homeserverUrl = http://127.0.0.1:8008;
|
||||||
accessTokenFile = config.sops.secrets."matrix/mjolnir/access_token".path;
|
accessTokenFile = config.sops.secrets."matrix/mjolnir/access_token".path;
|
||||||
managementRoom = "!gsdeCoWjvYRBrzuiRq:pvv.ntnu.no";
|
managementRoom = "!gsdeCoWjvYRBrzuiRq:pvv.ntnu.no";
|
||||||
protectedRooms = map (a: "https://matrix.to/#/${a}") [
|
protectedRooms = map (a: "https://matrix.to/#/${a}") [
|
||||||
|
|||||||
@@ -141,12 +141,12 @@ in {
|
|||||||
|
|
||||||
|
|
||||||
services.redis.servers."".enable = true;
|
services.redis.servers."".enable = true;
|
||||||
|
|
||||||
services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
|
services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
|
||||||
{
|
({
|
||||||
kTLS = true;
|
kTLS = true;
|
||||||
}
|
})
|
||||||
{
|
({
|
||||||
locations."/.well-known/matrix/server" = {
|
locations."/.well-known/matrix/server" = {
|
||||||
return = ''
|
return = ''
|
||||||
200 '{"m.server": "matrix.pvv.ntnu.no:443"}'
|
200 '{"m.server": "matrix.pvv.ntnu.no:443"}'
|
||||||
@@ -156,16 +156,16 @@ in {
|
|||||||
add_header Access-Control-Allow-Origin *;
|
add_header Access-Control-Allow-Origin *;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
}
|
})
|
||||||
{
|
({
|
||||||
locations = let
|
locations = let
|
||||||
connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
|
connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
|
||||||
socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString c.port}";
|
socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString (c.port)}";
|
||||||
|
|
||||||
metricsPath = w: "/metrics/${w.type}/${toString w.index}";
|
metricsPath = w: "/metrics/${w.type}/${toString w.index}";
|
||||||
proxyPath = w: "http://${socketAddress w}/_synapse/metrics";
|
proxyPath = w: "http://${socketAddress w}/_synapse/metrics";
|
||||||
in lib.mapAttrs' (n: v: lib.nameValuePair
|
in lib.mapAttrs' (n: v: lib.nameValuePair
|
||||||
(metricsPath v) {
|
(metricsPath v) ({
|
||||||
proxyPass = proxyPath v;
|
proxyPass = proxyPath v;
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
allow ${values.hosts.ildkule.ipv4};
|
allow ${values.hosts.ildkule.ipv4};
|
||||||
@@ -174,10 +174,10 @@ in {
|
|||||||
allow ${values.hosts.ildkule.ipv6_global};
|
allow ${values.hosts.ildkule.ipv6_global};
|
||||||
deny all;
|
deny all;
|
||||||
'';
|
'';
|
||||||
})
|
}))
|
||||||
cfg.workers.instances;
|
cfg.workers.instances;
|
||||||
}
|
})
|
||||||
{
|
({
|
||||||
locations."/metrics/master/1" = {
|
locations."/metrics/master/1" = {
|
||||||
proxyPass = "http://127.0.0.1:9000/_synapse/metrics";
|
proxyPass = "http://127.0.0.1:9000/_synapse/metrics";
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
@@ -202,5 +202,5 @@ in {
|
|||||||
labels = { };
|
labels = { };
|
||||||
}]) + "/";
|
}]) + "/";
|
||||||
};
|
};
|
||||||
}];
|
})];
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -15,12 +15,12 @@
|
|||||||
mysqld = {
|
mysqld = {
|
||||||
# PVV allows a lot of connections at the same time
|
# PVV allows a lot of connections at the same time
|
||||||
max_connect_errors = 10000;
|
max_connect_errors = 10000;
|
||||||
bind-address = values.services.mysql.ipv4;
|
bind-address = values.services.mysql.ipv4;
|
||||||
skip-networking = 0;
|
skip-networking = 0;
|
||||||
|
|
||||||
# This was needed in order to be able to use all of the old users
|
# This was needed in order to be able to use all of the old users
|
||||||
# during migration from knakelibrak to bicep in Sep. 2023
|
# during migration from knakelibrak to bicep in Sep. 2023
|
||||||
secure_auth = 0;
|
secure_auth = 0;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|||||||
@@ -35,10 +35,10 @@
|
|||||||
# Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
|
# Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
|
||||||
useHostResolvConf = mkForce false;
|
useHostResolvConf = mkForce false;
|
||||||
};
|
};
|
||||||
|
|
||||||
system.stateVersion = "23.11";
|
system.stateVersion = "23.11";
|
||||||
services.resolved.enable = true;
|
services.resolved.enable = true;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
};
|
};
|
||||||
@@ -7,6 +7,7 @@
|
|||||||
../../misc/metrics-exporters.nix
|
../../misc/metrics-exporters.nix
|
||||||
|
|
||||||
../../modules/grzegorz.nix
|
../../modules/grzegorz.nix
|
||||||
|
../../modules/spotifyd.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
boot.loader.systemd-boot.enable = true;
|
boot.loader.systemd-boot.enable = true;
|
||||||
|
|||||||
@@ -23187,4 +23187,4 @@
|
|||||||
"uid": "rYdddlPWk",
|
"uid": "rYdddlPWk",
|
||||||
"version": 9,
|
"version": 9,
|
||||||
"weekStart": ""
|
"weekStart": ""
|
||||||
}
|
}
|
||||||
@@ -3164,4 +3164,4 @@
|
|||||||
"title": "PostgreSQL Database",
|
"title": "PostgreSQL Database",
|
||||||
"uid": "000000039",
|
"uid": "000000039",
|
||||||
"version": 1
|
"version": 1
|
||||||
}
|
}
|
||||||
@@ -34,13 +34,13 @@ in {
|
|||||||
{
|
{
|
||||||
name = "Ildkule Prometheus";
|
name = "Ildkule Prometheus";
|
||||||
type = "prometheus";
|
type = "prometheus";
|
||||||
url = "http://${config.services.prometheus.listenAddress}:${toString config.services.prometheus.port}";
|
url = ("http://${config.services.prometheus.listenAddress}:${toString config.services.prometheus.port}");
|
||||||
isDefault = true;
|
isDefault = true;
|
||||||
}
|
}
|
||||||
{
|
{
|
||||||
name = "Ildkule loki";
|
name = "Ildkule loki";
|
||||||
type = "loki";
|
type = "loki";
|
||||||
url = "http://${config.services.loki.configuration.server.http_listen_address}:${toString config.services.loki.configuration.server.http_listen_port}";
|
url = ("http://${config.services.loki.configuration.server.http_listen_address}:${toString config.services.loki.configuration.server.http_listen_port}");
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
dashboards.settings.providers = [
|
dashboards.settings.providers = [
|
||||||
@@ -56,13 +56,13 @@ in {
|
|||||||
url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
|
url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
|
||||||
options.path = dashboards/synapse.json;
|
options.path = dashboards/synapse.json;
|
||||||
}
|
}
|
||||||
# TODO: enable once https://github.com/NixOS/nixpkgs/pull/242365 gets merged
|
# TODO: enable once https://github.com/NixOS/nixpkgs/pull/242365 gets merged
|
||||||
# {
|
# {
|
||||||
# name = "MySQL";
|
# name = "MySQL";
|
||||||
# type = "file";
|
# type = "file";
|
||||||
# url = "https://raw.githubusercontent.com/prometheus/mysqld_exporter/main/mysqld-mixin/dashboards/mysql-overview.json";
|
# url = "https://raw.githubusercontent.com/prometheus/mysqld_exporter/main/mysqld-mixin/dashboards/mysql-overview.json";
|
||||||
# options.path = dashboards/mysql.json;
|
# options.path = dashboards/mysql.json;
|
||||||
# }
|
# }
|
||||||
{
|
{
|
||||||
name = "Postgresql";
|
name = "Postgresql";
|
||||||
type = "file";
|
type = "file";
|
||||||
|
|||||||
@@ -58,7 +58,7 @@ in {
|
|||||||
};
|
};
|
||||||
|
|
||||||
limits_config = {
|
limits_config = {
|
||||||
allow_structured_metadata = false;
|
allow_structured_metadata = false;
|
||||||
reject_old_samples = true;
|
reject_old_samples = true;
|
||||||
reject_old_samples_max_age = "72h";
|
reject_old_samples_max_age = "72h";
|
||||||
};
|
};
|
||||||
|
|||||||
@@ -38,7 +38,7 @@ in {
|
|||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.prometheus-postgres-exporter-knakelibrak.serviceConfig = let
|
systemd.services.prometheus-postgres-exporter-knakelibrak.serviceConfig = let
|
||||||
localCfg = config.services.prometheus.exporters.postgres;
|
localCfg = config.services.prometheus.exporters.postgres;
|
||||||
in lib.recursiveUpdate config.systemd.services.prometheus-postgres-exporter.serviceConfig {
|
in lib.recursiveUpdate config.systemd.services.prometheus-postgres-exporter.serviceConfig {
|
||||||
EnvironmentFile = config.sops.secrets."keys/postgres/postgres_exporter_knakelibrak_env".path;
|
EnvironmentFile = config.sops.secrets."keys/postgres/postgres_exporter_knakelibrak_env".path;
|
||||||
ExecStart = ''
|
ExecStart = ''
|
||||||
|
|||||||
@@ -1,10 +0,0 @@
|
|||||||
{ lib, values, ... }: {
|
|
||||||
system.stateVersion = "22.05";
|
|
||||||
|
|
||||||
systemd.network.networks."30-all" = values.defaultNetworkConfig // {
|
|
||||||
matchConfig.Name = "eth0";
|
|
||||||
address = with values.hosts.skrott; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.hostName = lib.mkForce "skrot";
|
|
||||||
}
|
|
||||||
25
justfile
25
justfile
@@ -1,25 +0,0 @@
|
|||||||
export GUM_FILTER_HEIGHT := "15"
|
|
||||||
nom := `if command -v nom >/dev/null; then echo nom; else echo nix; fi`
|
|
||||||
|
|
||||||
@_default:
|
|
||||||
just "$(gum choose --ordered --header "Pick a recipie..." $(just --summary --unsorted))"
|
|
||||||
|
|
||||||
check:
|
|
||||||
nix flake check --keep-going
|
|
||||||
|
|
||||||
build-machine machine=`just _a_machine`:
|
|
||||||
{{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel
|
|
||||||
|
|
||||||
run-vm machine=`just _a_machine`:
|
|
||||||
nixos-rebuild build-vm --flake .#{{ machine }}
|
|
||||||
QEMU_NET_OPTS="hostfwd=tcp::8080-:80,hostfwd=tcp::8081-:443,hostfwd=tcp::2222-:22" ./result/bin/run-*-vm
|
|
||||||
|
|
||||||
@update-inputs:
|
|
||||||
nix eval .#inputs --apply builtins.attrNames --json \
|
|
||||||
| jq '.[]' -r \
|
|
||||||
| gum choose --no-limit --height=15 \
|
|
||||||
| xargs nix flake update --commit-lock-file
|
|
||||||
|
|
||||||
|
|
||||||
_a_machine:
|
|
||||||
nix eval .#nixosConfigurations --apply builtins.attrNames --json | jq .[] -r | gum filter
|
|
||||||
@@ -32,7 +32,7 @@
|
|||||||
color = "red";
|
color = "red";
|
||||||
command = "hostname | ${pkgs.toilet}/bin/toilet -f mono9";
|
command = "hostname | ${pkgs.toilet}/bin/toilet -f mono9";
|
||||||
};
|
};
|
||||||
|
|
||||||
service_status = {
|
service_status = {
|
||||||
Accounts = "accounts-daemon";
|
Accounts = "accounts-daemon";
|
||||||
Cron = "cron";
|
Cron = "cron";
|
||||||
@@ -40,16 +40,16 @@
|
|||||||
Matrix = "matrix-synapse";
|
Matrix = "matrix-synapse";
|
||||||
sshd = "sshd";
|
sshd = "sshd";
|
||||||
};
|
};
|
||||||
|
|
||||||
uptime = {
|
uptime = {
|
||||||
prefix = "Uptime: ";
|
prefix = "Uptime: ";
|
||||||
};
|
};
|
||||||
|
|
||||||
# Not relevant for server
|
# Not relevant for server
|
||||||
# user_service_status = {
|
# user_service_status = {
|
||||||
# Gpg-agent = "gpg-agent";
|
# Gpg-agent = "gpg-agent";
|
||||||
# };
|
# };
|
||||||
|
|
||||||
filesystems = let
|
filesystems = let
|
||||||
inherit (lib.attrsets) attrNames listToAttrs nameValuePair;
|
inherit (lib.attrsets) attrNames listToAttrs nameValuePair;
|
||||||
inherit (lib.lists) imap1;
|
inherit (lib.lists) imap1;
|
||||||
@@ -61,7 +61,7 @@
|
|||||||
getName = i: v: if (v.label != null) then v.label else "<? ${toString i}>";
|
getName = i: v: if (v.label != null) then v.label else "<? ${toString i}>";
|
||||||
in
|
in
|
||||||
imap1Attrs' (i: n: v: nameValuePair (getName i v) n) fileSystems;
|
imap1Attrs' (i: n: v: nameValuePair (getName i v) n) fileSystems;
|
||||||
|
|
||||||
memory = {
|
memory = {
|
||||||
swap_pos = "beside"; # or "below" or "none"
|
swap_pos = "beside"; # or "below" or "none"
|
||||||
};
|
};
|
||||||
@@ -70,14 +70,14 @@
|
|||||||
inherit (lib.lists) imap1;
|
inherit (lib.lists) imap1;
|
||||||
inherit (lib.attrsets) filterAttrs nameValuePair attrValues listToAttrs;
|
inherit (lib.attrsets) filterAttrs nameValuePair attrValues listToAttrs;
|
||||||
inherit (config.users) users;
|
inherit (config.users) users;
|
||||||
|
|
||||||
normalUsers = filterAttrs (n: v: v.isNormalUser || n == "root") users;
|
normalUsers = filterAttrs (n: v: v.isNormalUser || n == "root") users;
|
||||||
userNPVs = imap1 (index: user: nameValuePair user.name index) (attrValues normalUsers);
|
userNPVs = imap1 (index: user: nameValuePair user.name index) (attrValues normalUsers);
|
||||||
in listToAttrs userNPVs;
|
in listToAttrs userNPVs;
|
||||||
|
|
||||||
last_run = {};
|
last_run = {};
|
||||||
};
|
};
|
||||||
|
|
||||||
toml = pkgs.formats.toml {};
|
toml = pkgs.formats.toml {};
|
||||||
|
|
||||||
in toml.generate "rust-motd.toml" cfg;
|
in toml.generate "rust-motd.toml" cfg;
|
||||||
|
|||||||
@@ -36,10 +36,10 @@ in
|
|||||||
type = lib.types.str;
|
type = lib.types.str;
|
||||||
default = "${name}.key";
|
default = "${name}.key";
|
||||||
};
|
};
|
||||||
subject = lib.mkOption {
|
subject = lib.mkOption {
|
||||||
type = lib.types.str;
|
type = lib.types.str;
|
||||||
default = "/C=NO/O=Programvareverkstedet/CN=*.pvv.ntnu.no/emailAddress=drift@pvv.ntnu.no";
|
default = "/C=NO/O=Programvareverkstedet/CN=*.pvv.ntnu.no/emailAddress=drift@pvv.ntnu.no";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}));
|
}));
|
||||||
};
|
};
|
||||||
@@ -54,16 +54,16 @@ in
|
|||||||
mkdir -p $(dirname "${value.certificate}") $(dirname "${value.certificateKey}")
|
mkdir -p $(dirname "${value.certificate}") $(dirname "${value.certificateKey}")
|
||||||
if ! ${openssl} x509 -checkend 86400 -noout -in ${value.certificate}
|
if ! ${openssl} x509 -checkend 86400 -noout -in ${value.certificate}
|
||||||
then
|
then
|
||||||
echo "Regenerating '${value.certificate}'"
|
echo "Regenerating '${value.certificate}'"
|
||||||
${openssl} req \
|
${openssl} req \
|
||||||
-newkey rsa:4096 \
|
-newkey rsa:4096 \
|
||||||
-new -x509 \
|
-new -x509 \
|
||||||
-days "${toString value.daysValid}" \
|
-days "${toString value.daysValid}" \
|
||||||
-nodes \
|
-nodes \
|
||||||
-subj "${value.subject}" \
|
-subj "${value.subject}" \
|
||||||
-out "${value.certificate}" \
|
-out "${value.certificate}" \
|
||||||
-keyout "${value.certificateKey}" \
|
-keyout "${value.certificateKey}" \
|
||||||
${lib.escapeShellArgs value.extraOpenSSLArgs}
|
${lib.escapeShellArgs value.extraOpenSSLArgs}
|
||||||
fi
|
fi
|
||||||
chown "${value.owner}:${value.group}" "${value.certificate}"
|
chown "${value.owner}:${value.group}" "${value.certificate}"
|
||||||
chown "${value.owner}:${value.group}" "${value.certificateKey}"
|
chown "${value.owner}:${value.group}" "${value.certificateKey}"
|
||||||
|
|||||||
44
modules/spotifyd.nix
Normal file
44
modules/spotifyd.nix
Normal file
@@ -0,0 +1,44 @@
|
|||||||
|
{ lib, config, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
|
||||||
|
services.spotifyd.enable = true;
|
||||||
|
# https://docs.spotifyd.rs/config/File.html
|
||||||
|
services.spotifyd.settings = {
|
||||||
|
device_name = "${config.networking.hostName}-spotifyd";
|
||||||
|
device_type = "t_v"; # in ["unknown" "computer" "tablet" "smartphone" "speaker" "t_v"],
|
||||||
|
bitrate = 160; # in [96 160 320]
|
||||||
|
volume_normalisation = true;
|
||||||
|
zeroconf_port = 44677; # instead of user/password
|
||||||
|
|
||||||
|
# this is the place you add blinkenlights
|
||||||
|
#on_song_change_hook = "rm -rf / --no-preserve-root";
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.spotifyd.serviceConfig = {
|
||||||
|
SupplementaryGroups = [
|
||||||
|
"audio"
|
||||||
|
"pipewire"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
services.avahi.enable = true;
|
||||||
|
services.avahi.publish.enable = true;
|
||||||
|
services.avahi.publish.addresses = true;
|
||||||
|
services.avahi.publish.domain = true;
|
||||||
|
services.avahi.extraServiceFiles.spotifyd = ''
|
||||||
|
<?xml version="1.0" standalone='no'?><!--*-nxml-*-->
|
||||||
|
<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
|
||||||
|
<service-group>
|
||||||
|
<name replace-wildcards="yes">%h</name>
|
||||||
|
<service>
|
||||||
|
<type>_spotify-connect._tcp</type>
|
||||||
|
<port>${builtins.toString config.services.spotifyd.settings.zeroconf_port}</port>
|
||||||
|
</service>
|
||||||
|
</service-group>
|
||||||
|
'';
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = [ config.services.spotifyd.settings.zeroconf_port ];
|
||||||
|
networking.firewall.allowedUDPPorts = [ 5353 ]; # mDNS
|
||||||
|
|
||||||
|
}
|
||||||
@@ -1,6 +1,5 @@
|
|||||||
calendar-bot:
|
calendar-bot:
|
||||||
matrix_token: ENC[AES256_GCM,data:zJv9sw6pEzb9hxKT682wsD87HC9iejbps2wl2Z5QW1XZUSBHdcqyg1pxd+jFKTeKGQ==,iv:zDbvF1H98NsECjCtGXS+Y9HIhXowzz9HF9mltqnArog=,tag:/ftcOSQ13ElkVJBxYIMUGQ==,type:str]
|
matrix_token: ENC[AES256_GCM,data:zJv9sw6pEzb9hxKT682wsD87HC9iejbps2wl2Z5QW1XZUSBHdcqyg1pxd+jFKTeKGQ==,iv:zDbvF1H98NsECjCtGXS+Y9HIhXowzz9HF9mltqnArog=,tag:/ftcOSQ13ElkVJBxYIMUGQ==,type:str]
|
||||||
mysql_password: ENC[AES256_GCM,data:Gqag8yOgPH3ntoT5TmaqJWv1j+si2qIyz5Ryfw5E2A==,iv:kQDcxnPfwJQcFovI4f87UDt18F8ah3z5xeY86KmdCyY=,tag:A1sCSNXJziAmtUWohqwJgg==,type:str]
|
|
||||||
mysql:
|
mysql:
|
||||||
password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
|
password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
|
||||||
sops:
|
sops:
|
||||||
@@ -63,8 +62,8 @@ sops:
|
|||||||
cTh5bnJ3WW90aXRCSUp6NHFYeU1tZ0kK4afdtJwGNu6wLRI0fuu+mBVeqVeB0rgX
|
cTh5bnJ3WW90aXRCSUp6NHFYeU1tZ0kK4afdtJwGNu6wLRI0fuu+mBVeqVeB0rgX
|
||||||
0q5hwyzjiRnHnyjF38CmcGgydSfDRmF6P+WIMbCwXC6LwfRhAmBGPg==
|
0q5hwyzjiRnHnyjF38CmcGgydSfDRmF6P+WIMbCwXC6LwfRhAmBGPg==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
lastmodified: "2024-08-15T21:18:33Z"
|
lastmodified: "2023-09-05T23:28:56Z"
|
||||||
mac: ENC[AES256_GCM,data:uR5HgeDAYqoqB9kk1V6p0T30+v6WpQJi4+qIeCDRnoUPnQKUVR10hvBhICck+E+Uh8p+tGhM6Uf3YrAJAV0ZCUiNJjtwDJQQLUDT53vdOAXN4xADCQqNuhgVwVMaruoTheEiwOswRuhFeEwy0gBj3Ze2pu47lueHYclmEzumLeQ=,iv:t0UyXN2YaR2m7M/pV2wTLJG5wVfqTIUs7wSQMmyeTVw=,tag:O7dIffzrDAXz3kGx5uazhw==,type:str]
|
mac: ENC[AES256_GCM,data:pCWTkmCQgBOqhejK2sCLQ3H8bRXmXlToQxYmOG0IWDo2eGiZOLuIkZ1/1grYgfxAGiD4ysJod0nJuvo+eAsMeYAy6QJVtrOqO2d9V2NEdzLckXyYvwyJyZoFbNC5EW9471V0m4jLRSh5821ckNo/wtWFR11wfO15tI3MqtD1rtA=,iv:QDnckPl0LegaH0b7V4WAtmVXaL4LN+k3uKHQI2dkW7E=,tag:mScUQBR0ZHl1pi/YztrvFg==,type:str]
|
||||||
pgp:
|
pgp:
|
||||||
- created_at: "2024-08-04T00:03:40Z"
|
- created_at: "2024-08-04T00:03:40Z"
|
||||||
enc: |-
|
enc: |-
|
||||||
@@ -87,4 +86,4 @@ sops:
|
|||||||
-----END PGP MESSAGE-----
|
-----END PGP MESSAGE-----
|
||||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||||
unencrypted_suffix: _unencrypted
|
unencrypted_suffix: _unencrypted
|
||||||
version: 3.9.0
|
version: 3.7.3
|
||||||
|
|||||||
@@ -1,14 +1,9 @@
|
|||||||
{ pkgs ? import <nixpkgs> {} }:
|
{ pkgs ? import <nixpkgs> {} }:
|
||||||
pkgs.mkShellNoCC {
|
pkgs.mkShellNoCC {
|
||||||
packages = with pkgs; [
|
packages = with pkgs; [
|
||||||
just
|
|
||||||
jq
|
|
||||||
gum
|
|
||||||
sops
|
sops
|
||||||
gnupg
|
gnupg
|
||||||
statix
|
|
||||||
openstackclient
|
openstackclient
|
||||||
editorconfig-checker
|
|
||||||
];
|
];
|
||||||
|
|
||||||
shellHook = ''
|
shellHook = ''
|
||||||
|
|||||||
24
statix.toml
24
statix.toml
@@ -1,24 +0,0 @@
|
|||||||
ignore = [".direnv"]
|
|
||||||
nix_version = '2.18' # '2.4'
|
|
||||||
disabled = [
|
|
||||||
# "bool_comparison", # W01
|
|
||||||
# "empty_let_in", # W02
|
|
||||||
"manual_inherit", # W03
|
|
||||||
"manual_inherit_from", # W04
|
|
||||||
# "legacy_let_syntax", # W05
|
|
||||||
"collapsible_let_in", # W06
|
|
||||||
# "eta_reduction", # W07
|
|
||||||
# "useless_parens", # W08
|
|
||||||
"empty_pattern", # W10
|
|
||||||
# "redundant_pattern_bind", # W11
|
|
||||||
# "unquoted_uri", # W12
|
|
||||||
# "deprecated_is_null", # W13
|
|
||||||
# "empty_inherit", # W14
|
|
||||||
# "faster_groupby", # W15
|
|
||||||
# "faster_zipattrswith", # W16
|
|
||||||
# "deprecated_to_path", # W17
|
|
||||||
# "bool_simplification", # W18
|
|
||||||
# "useless_has_attr", # W19
|
|
||||||
"repeated_keys", # W20
|
|
||||||
"empty_list_concat", # W23
|
|
||||||
]
|
|
||||||
@@ -3,10 +3,10 @@
|
|||||||
{
|
{
|
||||||
users.users.amalieem = {
|
users.users.amalieem = {
|
||||||
isNormalUser = true;
|
isNormalUser = true;
|
||||||
extraGroups = [ "wheel" ];
|
extraGroups = [ "wheel" ];
|
||||||
shell = pkgs.zsh;
|
shell = pkgs.zsh;
|
||||||
openssh.authorizedKeys.keys = [
|
openssh.authorizedKeys.keys = [
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPsMtFIj4Dem/onwMoWYbosOcU4y7A5nTjVwqWaU33E1 amalieem@matey-aug22"
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPsMtFIj4Dem/onwMoWYbosOcU4y7A5nTjVwqWaU33E1 amalieem@matey-aug22"
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
@@ -3,7 +3,7 @@
|
|||||||
{
|
{
|
||||||
users.users.jonmro = {
|
users.users.jonmro = {
|
||||||
isNormalUser = true;
|
isNormalUser = true;
|
||||||
extraGroups = [ "wheel" "drift" "nix-builder-users" ];
|
extraGroups = [ "wheel" "drift" "nix-builder-users" ];
|
||||||
shell = pkgs.zsh;
|
shell = pkgs.zsh;
|
||||||
openssh.authorizedKeys.keys = [
|
openssh.authorizedKeys.keys = [
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEm5PfYmfl/0fnAP/3coVlvTw3/TYNLT6r/NwJHZbLAK jonrodtang@gmail.com"
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEm5PfYmfl/0fnAP/3coVlvTw3/TYNLT6r/NwJHZbLAK jonrodtang@gmail.com"
|
||||||
|
|||||||
@@ -63,10 +63,6 @@ in rec {
|
|||||||
ipv4 = pvv-ipv4 231;
|
ipv4 = pvv-ipv4 231;
|
||||||
ipv6 = pvv-ipv6 231;
|
ipv6 = pvv-ipv6 231;
|
||||||
};
|
};
|
||||||
skrott = {
|
|
||||||
ipv4 = pvv-ipv4 235;
|
|
||||||
ipv6 = pvv-ipv6 235;
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
defaultNetworkConfig = {
|
defaultNetworkConfig = {
|
||||||
|
|||||||
Reference in New Issue
Block a user