bekkalokk/mediawiki: install PdfHandler extension

base/default.nix

@@ -35,6 +35,7 @@
     ./services/prometheus-node-exporter.nix
     ./services/prometheus-systemd-exporter.nix
     ./services/roowho2.nix
+    ./services/scrutiny-collector.nix
     ./services/smartd.nix
     ./services/thermald.nix
     ./services/uptimed.nix

base/services/polkit.nix

@@ -6,10 +6,13 @@ in
   security.polkit.enable = true;
 
   environment.etc."polkit-1/rules.d/9-nixos-overrides.rules".text = lib.mkIf cfg.enable ''
-    polkit.addAdminRule(function(action, subject) {
+    polkit.addRule(function(action, subject) {
-        if(subject.isInGroup("wheel")) {
+       if (
-            return ["unix-user:"+subject.user];
+           action.id.startsWith("org.freedesktop.systemd1.") &&
-        }
+           subject.isInGroup("wheel")
-    });
+       ) {
+           return polkit.Result.AUTH_SELF_KEEP;
+         }
+     });
   '';
 }

base/services/scrutiny-collector.nix

@@ -0,0 +1,11 @@
+{ config, ... }:
+{
+  services.scrutiny.collector = {
+    enable = !config.services.qemuGuest.enable;
+    settings = {
+      version = 1;
+      host.id = config.networking.hostName;
+      api.endpoint = "https://scrutiny.pvv.ntnu.no/";
+    };
+  };
+}

flake.lock

@@ -316,11 +316,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764869785,
+        "lastModified": 1779774845,
-        "narHash": "sha256-FGTIpC7gB4lbeL0bfYzn1Ge0PaCpd7VqWBLhJBx0i4A=",
+        "narHash": "sha256-QJU1J4eupwjRrtvWGzRut0GY3woql92RS9O/acWkJkk=",
         "ref": "main",
-        "rev": "8ce7fb0b1918bdb3d1489a40d73895693955e8b2",
+        "rev": "13667cd216db260ab549e6f1b6281aa230d2f9e0",
-        "revCount": 23,
+        "revCount": 29,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
       },

hosts/bekkalokk/services/mediawiki/default.nix

@@ -107,6 +107,7 @@ in {
         CodeEditor
         CodeMirror
         DeleteBatch
+        PdfHandler
         PluggableAuth
         Popups
         Scribunto
@@ -181,12 +182,17 @@ in {
       ];
 
       # Misc program paths
-      $wgFFmpegLocation = '${pkgs.ffmpeg}/bin/ffmpeg';
+      $wgFFmpegLocation = '${lib.getExe pkgs.ffmpeg}';
-      $wgExiftool = '${pkgs.exiftool}/bin/exiftool';
+      $wgExiftool = '${lib.getExe pkgs.exiftool}';
-      $wgExiv2Command = '${pkgs.exiv2}/bin/exiv2';
+      $wgExiv2Command = '${lib.getExe pkgs.exiv2}';
       # See https://gist.github.com/sergejmueller/088dce028b6dd120a16e
-      $wgJpegTran = '${pkgs.mozjpeg}/bin/jpegtran';
+      $wgJpegTran = '${lib.getExe' pkgs.mozjpeg "jpegtran"}';
-      $wgGitBin = '${pkgs.git}/bin/git';
+      $wgGitBin = '${lib.getExe pkgs.git}';
+      $wgDiff3 = '${lib.getExe' pkgs.diffutils "diff3"}';
+      $wgDiff = '${lib.getExe' pkgs.diffutils "diff"}';
+
+      $wgUseImageMagick = true;
+      $wgImageMagickConvertCommand = '${lib.getExe pkgs.imagemagick}';
 
       # Debugging
       $wgShowExceptionDetails = false;
@@ -211,6 +217,13 @@ in {
       # EXT:WikiEditor
       $wgWikiEditorRealtimePreview = true;
 
+      # EXT:PdfHandler
+      $wgPdfProcessor = '${lib.getExe pkgs.ghostscript_headless}';
+      $wgPdfPostProcessor = $wgImageMagickConvertCommand;
+      $wgPdfInfo = '${lib.getExe' pkgs.poppler-utils "pdfinfo"}';
+      $wgPdftoText = '${lib.getExe' pkgs.poppler-utils "pdftotext"}';
+
+      # Override key from hardcoded config in nixpkgs
       $wgSecretKey = file_get_contents("${config.sops.secrets."mediawiki/secret-key".path}");
     '';
   };

hosts/bekkalokk/services/website/default.nix

@@ -119,6 +119,7 @@ in {
   services.nginx.virtualHosts."pvv.ntnu.no" = {
     globalRedirect = cfg.domainName;
     redirectCode = 307;
+    kTLS = true;
     forceSSL = true;
     useACMEHost = "www.pvv.ntnu.no";
   };
@@ -126,6 +127,7 @@ in {
   services.nginx.virtualHosts."www.pvv.org" = {
     globalRedirect = cfg.domainName;
     redirectCode = 307;
+    kTLS = true;
     forceSSL = true;
     useACMEHost = "www.pvv.ntnu.no";
   };
@@ -133,11 +135,13 @@ in {
   services.nginx.virtualHosts."pvv.org" = {
     globalRedirect = cfg.domainName;
     redirectCode = 307;
+    kTLS = true;
     forceSSL = true;
     useACMEHost = "www.pvv.ntnu.no";
   };
 
   services.nginx.virtualHosts.${cfg.domainName} = {
+    kTLS = true;
     locations = {
       # Proxy home directories
       "^~ /~" = {

hosts/bicep/services/git-mirrors/default.nix

@@ -83,6 +83,7 @@ in
   };
 
   services.nginx.virtualHosts."mirrors.pvv.ntnu.no" = {
+    kTLS = true;
     forceSSL = true;
     enableACME = true;
 

hosts/bicep/services/matrix/hookshot/default.nix

@@ -146,6 +146,7 @@ in
   };
 
   services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
+    kTLS = true;
     enableACME = true;
     addSSL = true;
     locations."/" = {

hosts/bicep/services/matrix/out-of-your-element.nix

@@ -80,6 +80,7 @@ in
   };
 
   services.nginx.virtualHosts."ooye.pvv.ntnu.no" = {
+    kTLS = true;
     forceSSL = true;
     enableACME = true;
     locations."/".proxyPass = "http://localhost:${cfg.socket}";

hosts/ildkule/services/monitoring/default.nix

@@ -5,6 +5,7 @@
     ./grafana.nix
     ./loki.nix
     ./prometheus
+    ./scrutiny.nix
     ./uptime-kuma.nix
   ];
 }

hosts/ildkule/services/monitoring/scrutiny.nix

@@ -0,0 +1,40 @@
+{ config, values, ... }:
+let
+  cfg = config.services.scrutiny;
+in
+{
+  services.scrutiny = {
+    enable = true;
+    settings = {
+      web.listen = {
+        host = "127.0.0.1";
+        port = 18293;
+        basepath = "";
+      };
+
+      # notify.urls = [
+      #   "matrix://username:password@host:port/[?rooms=!roomID1[,roomAlias2]]"
+      # ];
+    };
+  };
+
+  services.nginx.virtualHosts."scrutiny.pvv.ntnu.no" = {
+    kTLS = true;
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://${cfg.settings.web.listen.host}:${toString cfg.settings.web.listen.port}";
+    };
+
+    # TODO: allow website access to the outside world, but restrict input api
+    extraConfig = ''
+      allow ${values.hosts.ildkule.ipv4}/32;
+      allow ${values.hosts.ildkule.ipv6}/128;
+      allow 127.0.0.1/32;
+      allow ::1/128;
+      allow ${values.ipv4-space};
+      allow ${values.ipv6-space};
+      deny all;
+    '';
+  };
+}

hosts/ildkule/services/monitoring/uptime-kuma.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, values, ... }:
 let
   cfg = config.services.uptime-kuma;
   domain = "status.pvv.ntnu.no";
@@ -24,4 +24,21 @@ in {
     fsType = "bind";
     options = [ "bind" ];
   };
+
+  services.rsync-pull-targets = {
+    enable = true;
+    locations.${stateDir} = {
+      user = "root";
+      rrsyncArgs.ro = true;
+      authorizedKeysAttrs = [
+        "restrict"
+        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
+        "no-agent-forwarding"
+        "no-port-forwarding"
+        "no-pty"
+        "no-X11-forwarding"
+      ];
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXzcDm6cVr4NmWzUSroy33FlielKqaG83wY0RCMC0p/ uptime_kuma rsync backup";
+    };
+  };
 }

hosts/kommode/services/gitea/gpg.nix

@@ -50,6 +50,8 @@ in
     SIGNING_NAME = "PVV Git";
     SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
     INITIAL_COMMIT = "always";
+    MERGES = lib.concatStringsSep "," [ "always" ];
+    CRUD_ACTIONS = lib.concatStringsSep "," [ "always" ];
     WIKI = "always";
   };
 }

hosts/lupine/configuration.nix

@@ -18,9 +18,6 @@
     anyInterface = true;
   };
 
-  # There are no smart devices
-  services.smartd.enable = false;
-
   # Don't change (even during upgrades) unless you know what you are doing.
   # See https://search.nixos.org/options?show=system.stateVersion
   system.stateVersion = "25.05";

hosts/temmie/services/userweb/apache-log-processor/.gitignore

@@ -1 +0,0 @@
-target

hosts/temmie/services/userweb/apache-log-processor/Cargo.lock

@@ -1,171 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "apache-log-processor"
-version = "0.1.0"
-dependencies = [
- "nix",
- "time",
-]
-
-[[package]]
-name = "bitflags"
-version = "2.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
-
-[[package]]
-name = "cfg_aliases"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
-
-[[package]]
-name = "deranged"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
-dependencies = [
- "powerfmt",
-]
-
-[[package]]
-name = "itoa"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
-
-[[package]]
-name = "libc"
-version = "0.2.186"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
-
-[[package]]
-name = "nix"
-version = "0.31.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
-dependencies = [
- "bitflags",
- "cfg-if",
- "cfg_aliases",
- "libc",
-]
-
-[[package]]
-name = "num-conv"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
-
-[[package]]
-name = "num_threads"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "powerfmt"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.106"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "serde_core"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.117"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "time"
-version = "0.3.47"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
-dependencies = [
- "deranged",
- "itoa",
- "libc",
- "num-conv",
- "num_threads",
- "powerfmt",
- "serde_core",
- "time-core",
- "time-macros",
-]
-
-[[package]]
-name = "time-core"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
-
-[[package]]
-name = "time-macros"
-version = "0.2.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
-dependencies = [
- "num-conv",
- "time-core",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"

hosts/temmie/services/userweb/apache-log-processor/Cargo.toml

@@ -1,19 +0,0 @@
-[package]
-name = "apache-log-processor"
-version = "0.1.0"
-edition = "2024"
-autobins = false
-license = "MIT"
-authors = [
-  "projects@pvv.ntnu.no",
-]
-
-[dependencies]
-nix = { version = "0.31.3", features = ["event", "fs", "user"] }
-time = { version = "0.3.47", features = ["formatting", "local-offset"] }
-
-
-[[bin]]
-name = "apache-log-processor"
-bench = false
-path = "src/main.rs"

hosts/temmie/services/userweb/apache-log-processor/default.nix

@@ -1,33 +0,0 @@
-{
-  lib
-, rustPlatform
-, stdenv
-}:
-let
-  cargoToml = fromTOML (builtins.readFile ./Cargo.toml);
-  cargoLock = ./Cargo.lock;
-  mainProgram = (lib.head cargoToml.bin).name;
-  pname = cargoToml.package.name;
-in
-rustPlatform.buildRustPackage {
-  inherit pname;
-  inherit (cargoToml.package) version;
-  src = lib.fileset.toSource {
-    root = ./.;
-    fileset = lib.fileset.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
-
-  cargoLock.lockFile = cargoLock;
-
-  doCheck = true;
-
-  meta = with lib; {
-    license = licenses.mit;
-    platforms = platforms.linux;
-    inherit mainProgram;
-  };
-}

hosts/temmie/services/userweb/apache-log-processor/src/main.rs

@@ -1,322 +0,0 @@
-use nix::{
-    errno::Errno,
-    fcntl::{FcntlArg, OFlag, fcntl, open},
-    sys::{
-        epoll::{Epoll, EpollCreateFlags, EpollEvent, EpollFlags, EpollTimeout},
-        stat::Mode,
-    },
-    // unistd::{User, getegid, geteuid, read, setegid, seteuid, write},
-    unistd::{User, read, write},
-};
-use std::{
-    collections::VecDeque,
-    os::fd::{AsFd, BorrowedFd, OwnedFd},
-    path::PathBuf,
-    process::exit,
-};
-use time::{OffsetDateTime, format_description};
-
-const READ_BUFFER_SIZE: usize = 8 * 1024;
-
-#[derive(Debug, Clone, Copy)]
-enum LogMode {
-    Access,
-    Error,
-}
-
-fn main() -> Result<(), String> {
-    let log_mode = match std::env::args().nth(1).as_deref() {
-        Some("access") => LogMode::Access,
-        Some("error") => LogMode::Error,
-        Some(other) => {
-            return Err(format!(
-                "invalid log mode `{other}`; expected `access` or `error`"
-            ));
-        }
-        None => return Err("missing log mode argument; expected `access` or `error`".to_string()),
-    };
-
-    let tee_file = match log_mode {
-        LogMode::Access => None,
-        LogMode::Error => Some(
-            open(
-                &PathBuf::from("/var/log/httpd/error.log"),
-                OFlag::O_WRONLY | OFlag::O_APPEND | OFlag::O_CREAT | OFlag::O_CLOEXEC,
-                Mode::S_IRUSR | Mode::S_IWUSR,
-            )
-            .map_err(|error| format!("failed to open error log for teeing: {error}"))?,
-        ),
-    };
-
-    let stdin = std::io::stdin();
-
-    fcntl(stdin.as_fd(), FcntlArg::F_GETFL)
-        .map(OFlag::from_bits_retain)
-        .map(|flags| FcntlArg::F_SETFL(flags | OFlag::O_NONBLOCK))
-        .and_then(|flags| fcntl(stdin.as_fd(), flags))
-        .map_err(|error| format!("failed to make stdin nonblocking: {error}"))?;
-
-    let epoll = Epoll::new(EpollCreateFlags::EPOLL_CLOEXEC)
-        .map_err(|error| format!("failed to create epoll instance: {error}"))?;
-
-    epoll
-        .add(
-            stdin.as_fd(),
-            EpollEvent::new(
-                EpollFlags::EPOLLIN | EpollFlags::EPOLLERR | EpollFlags::EPOLLHUP,
-                0,
-            ),
-        )
-        .map_err(|error| format!("failed to register stdin with epoll: {error}"))?;
-
-    if let Err(error) = event_loop(log_mode, epoll, stdin.as_fd(), tee_file) {
-        eprintln!("Error: {error}");
-        exit(1);
-    }
-
-    Ok(())
-}
-
-fn event_loop(
-    log_mode: LogMode,
-    epoll: Epoll,
-    stdin_fd: BorrowedFd<'_>,
-    mut tee_file: Option<OwnedFd>,
-) -> Result<(), String> {
-    let mut events = [EpollEvent::empty(); 1];
-    let mut pending = VecDeque::new();
-
-    loop {
-        let ready = loop {
-            match epoll.wait(&mut events, EpollTimeout::NONE) {
-                Ok(ready) => break ready,
-                Err(Errno::EINTR) => continue,
-                Err(error) => {
-                    return Err(format!("epoll wait failed: {error}"));
-                }
-            }
-        };
-
-        if ready == 0 {
-            continue;
-        }
-
-        let mut scratch = [0u8; READ_BUFFER_SIZE];
-
-        let eof = loop {
-            match read(stdin_fd, &mut scratch) {
-                Ok(0) => break true,
-                Ok(read_bytes) => pending.extend(scratch[..read_bytes].iter().copied()),
-                Err(Errno::EINTR) => continue,
-                Err(Errno::EAGAIN) => break false,
-                Err(error) => {
-                    return Err(format!("failed to read from stdin: {error}"));
-                }
-            }
-        };
-
-        while let Some(newline_index) = pending.iter().position(|byte| *byte == b'\n') {
-            let line = pending.make_contiguous();
-            process_line(log_mode, &line[..=newline_index], &mut tee_file)?;
-            pending.drain(..=newline_index);
-        }
-
-        if eof {
-            if !pending.is_empty() {
-                process_line(log_mode, pending.make_contiguous(), &mut tee_file)?;
-                pending.clear();
-            }
-            return Ok(());
-        }
-    }
-}
-
-fn process_line(
-    log_mode: LogMode,
-    line: &[u8],
-    tee_file: &mut Option<OwnedFd>,
-) -> Result<(), String> {
-    if let Some(tee_file) = tee_file.as_ref() {
-        write_all_fd(tee_file, line).map_err(|error| {
-            format!("failed to append to APACHE_LOG_PROCESSOR_TEE_FILE: {error}")
-        })?;
-    }
-
-    if let Some(user) =
-        parse_username_from_line(line).and_then(|name| User::from_name(name).ok().flatten())
-    {
-        // let identity = EffectiveIdentity::switch_to(&user).map_err(|error| {
-        //     format!(
-        //         "failed to switch effective identity to {} (uid {}, gid {}): {error}",
-        //         user.name, user.uid, user.gid
-        //     )
-        // })?;
-
-        let result: Result<(), String> = (|| {
-            let dir = user.dir.join("nobackup/weblogs");
-
-            if !dir.is_dir() {
-                return Err(format!(
-                    "logs directory {} does not exist for user {}",
-                    dir.display(),
-                    user.name
-                ));
-            }
-
-            let now = OffsetDateTime::now_local()
-                .unwrap_or_else(|_| OffsetDateTime::now_utc())
-                .format(&format_description::parse("[year]-[month]-[day]").unwrap())
-                .map_err(|error| {
-                    format!("failed to format current date for log file name: {error}")
-                })?;
-
-            let logfile = dir.join(match log_mode {
-                LogMode::Access => format!("access-{now}.log"),
-                LogMode::Error => format!("error-{now}.log"),
-            });
-
-            let fd = open(
-                &logfile,
-                OFlag::O_WRONLY | OFlag::O_APPEND | OFlag::O_CREAT | OFlag::O_CLOEXEC,
-                Mode::S_IRUSR
-                    | Mode::S_IWUSR
-                    | Mode::S_IRGRP
-                    | Mode::S_IROTH
-                    | Mode::S_IWGRP
-                    | Mode::S_IWOTH,
-            )
-            .map_err(|error| format!("failed to open log file for user {}: {error}", user.name))?;
-
-            write_all_fd(fd.as_fd(), line).map_err(|error| {
-                format!(
-                    "failed to append to log file for user {}: {error}",
-                    user.name
-                )
-            })?;
-
-            Ok(())
-        })();
-
-        if let Err(error) = result {
-            eprintln!("Error processing log line for user {}: {error}", user.name);
-        }
-
-        // identity.restore().map_err(|error| {
-        //     format!(
-        //         "failed to restore original effective identity after handling {}: {error}",
-        //         user.name
-        //     )
-        // })?;
-    }
-
-    Ok(())
-}
-
-fn parse_username_from_line(line: &[u8]) -> Option<&str> {
-    line.splitn(8, |&b| b == b' ')
-        .nth(6)
-        .and_then(|path| {
-            path.strip_prefix(b"/~")
-                .and_then(|rest| rest.split(|&b| b == b'/').next())
-        })
-        .or_else(|| {
-            line.windows(b"/home/pvv/".len())
-                .enumerate()
-                .find_map(|(start, window)| {
-                    (window == b"/home/pvv/")
-                        .then_some(start + b"/home/pvv/".len())
-                        .and_then(|start| line.get(start..))
-                        .filter(|rest| rest.get(1) == Some(&b'/'))
-                        .and_then(|rest| rest.get(2..))
-                        .and_then(|rest| rest.split(|&b| b == b'/').next())
-                })
-        })
-        .filter(|segment| !segment.is_empty())
-        .and_then(|segment| std::str::from_utf8(segment).ok())
-}
-
-fn write_all_fd<Fd: AsFd>(fd: Fd, mut buffer: &[u8]) -> nix::Result<()> {
-    while !buffer.is_empty() {
-        match write(fd.as_fd(), buffer) {
-            Ok(0) => return Err(Errno::EIO),
-            Ok(written) => buffer = &buffer[written..],
-            Err(Errno::EINTR) => continue,
-            Err(error) => return Err(error),
-        }
-    }
-
-    Ok(())
-}
-
-// struct EffectiveIdentity {
-//     saved_euid: nix::unistd::Uid,
-//     saved_egid: nix::unistd::Gid,
-//     restored: bool,
-// }
-
-// impl EffectiveIdentity {
-//     fn switch_to(user: &User) -> nix::Result<Self> {
-//         let guard = Self {
-//             saved_euid: geteuid(),
-//             saved_egid: getegid(),
-//             restored: false,
-//         };
-
-//         setegid(user.gid)?;
-//         if let Err(error) = seteuid(user.uid) {
-//             let _ = setegid(guard.saved_egid);
-//             return Err(error);
-//         }
-
-//         Ok(guard)
-//     }
-
-//     fn restore(mut self) -> nix::Result<()> {
-//         let restore_uid = seteuid(self.saved_euid);
-//         let restore_gid = setegid(self.saved_egid);
-//         self.restored = true;
-
-//         restore_uid?;
-//         restore_gid?;
-//         Ok(())
-//     }
-// }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_parse_user_from_access_log() {
-        let inputs = [(
-            "1.2.3.4 - - [25/May/2026:10:07:24 +0200] \"GET /~oysteikt/ HTTP/2.0\" 200 3708",
-            "oysteikt",
-        )];
-
-        for (line, expected_user) in inputs {
-            let parsed_user = parse_username_from_line(line.as_bytes());
-            assert_eq!(
-                parsed_user,
-                Some(expected_user),
-                "Failed to parse user from line: {line}"
-            );
-        }
-    }
-
-    #[test]
-    fn test_parse_user_from_error_log() {
-        let inputs = [(
-            "[Sat May 09 20:45:21.480016 2026] [authz_core:error] [pid 3555:tid 3617] [remote 1::2:42000] AH01630: client denied by server configuration: /home/pvv/d/oysteikt/web-docs/.git",
-            "oysteikt",
-        )];
-
-        for (line, expected_user) in inputs {
-            let parsed_user = parse_username_from_line(line.as_bytes());
-            assert_eq!(
-                parsed_user,
-                Some(expected_user),
-                "Failed to parse user from line: {line}"
-            );
-        }
-    }
-}

hosts/temmie/services/userweb/default.nix

@@ -11,8 +11,6 @@ let
     upload_max_filesize = "40M";
   });
 
-  apache-log-processor = pkgs.callPackage ./apache-log-processor { };
-
   # https://nixos.org/manual/nixpkgs/stable/#ssec-php-user-guide-installing-with-extensions
   phpEnv = pkgs.php.buildEnv {
     extensions = { all, ... }: with all; [
@@ -195,11 +193,10 @@ in
       }
     ];
 
-    logPerVirtualHost = false;
-
     extraConfig = ''
       TraceEnable on
       LogLevel warn rewrite:trace3
+      ScriptLog ${cfg.logDir}/cgi.log
     '';
 
     virtualHosts."temmie.pvv.ntnu.no" = {
@@ -211,11 +208,6 @@ in
       ];
 
       extraConfig = ''
-        CustomLog "${cfg.logDir}/access.log" combined
-        CustomLog "|${lib.getExe apache-log-processor} access" combined
-        ErrorLog "|${lib.getExe apache-log-processor} error"
-        ScriptLog "${cfg.logDir}/cgi.log"
-
         UserDir ${lib.concatMapStringsSep " " (l: "/home/pvv/${l}/*/web-docs") homeLetters}
         UserDir disabled root
         AddHandler cgi-script .cgi

modules/matrix-ooye.nix

@@ -171,6 +171,9 @@ in
         requires = [ "matrix-ooye-pre-start.service" ];
         wantedBy = [ "multi-user.target" ];
 
+        startLimitIntervalSec = 5;
+        startLimitBurst = 5;
+
         serviceConfig = {
           ExecStart = lib.getExe config.services.matrix-ooye.package;
           WorkingDirectory = "/var/lib/matrix-ooye";
@@ -182,8 +185,6 @@ in
           #PrivateDevices = true;
           Restart = "on-failure";
           RestartSec = "5s";
-          StartLimitIntervalSec = "5s";
-          StartLimitBurst = "5";
           DynamicUser = true;
         };
       };

packages/mediawiki-extensions/default.nix

@@ -38,18 +38,23 @@ lib.mergeAttrsList [
   })
   (mw-ext {
     name = "CodeMirror";
-    commit = "f06dfd40a08562a841ddf11b4ae3444ef06c98c7";
+    commit = "7ab826eff8c4097589a3199c40c507717af23234";
-    hash = "sha256-5zXkBjOwFdoQezkPRJ2AcBZLZEEpGG6FawO2K3KzllI=";
+    hash = "sha256-kMIyGW9J4OSGSetByel7hEGgxPRJmQ53it6ndpYA/Hs=";
   })
   (mw-ext {
     name = "DeleteBatch";
-    commit = "9bc75a753efefedfc88c598fb01f18a7e4b61f00";
+    commit = "b5920283cfe78b86a63a1037a81651c58ce764da";
-    hash = "sha256-1xA758fsvoioN9xuq0hRqZKtPXMQViVLtuRINDtowdk=";
+    hash = "sha256-LwuVX2s5Q4uc6o7hlTjFzRTwvSCwTk74gBpX0HoLDMA=";
+  })
+  (mw-ext {
+    name = "PdfHandler";
+    commit = "dc1a3ca04ac6ec7d7de7ce5355803510508a2575";
+    hash = "sha256-ltAQZtfTMMLRPATA7rclSNW8Yz4ctGc30CxlL3SRBWU=";
   })
   (mw-ext {
     name = "PluggableAuth";
-    commit = "64133683b73d8eeea8069fe7ed9cb7237fd5c212";
+    commit = "4b57a23e32d72bd3f74184ff2734aa483a5b0c63";
-    hash = "sha256-wqpfgVLenZp6XC510nrsrbvK1IMEPcWVYq5YuAOt5+c=";
+    hash = "sha256-ZGw0Wgz0Sg04YDcOzkOGywmfQ6s6Ex17QbjmUDO1D8c=";
   })
   (mw-ext {
     name = "Popups";
@@ -58,38 +63,38 @@ lib.mergeAttrsList [
   })
   (mw-ext {
     name = "Scribunto";
-    commit = "cbab0c740e03c8e6184fd647d95e24e0826d20cb";
+    commit = "35c85c96167922adc98e62dd6573789d906dd7d7";
-    hash = "sha256-vXS3+wrUBVtPsETa19pMvud9sALGt4Ao9mM5rQRbBQc=";
+    hash = "sha256-FEWADJW53cDOlLseM62VL66PENv/jNnwuCMo2Pb02ek=";
   })
   (mw-ext {
     name = "SimpleSAMLphp";
     kebab-name = "simple-saml-php";
-    commit = "fc5ad4501434fe85198f0b1f0087d798efa91f9f";
+    commit = "70778bb02f972abbb51e6ba3e0f6545b00dcab00";
-    hash = "sha256-se0krTglo1fShJXj38bPLhw65tZC5P54Ywt7oeZrLes=";
+    hash = "sha256-wfmFJKy+ih84qFM9DVcCQFAZBx45s7Hl0lRnseMPhGY=";
   })
   (mw-ext {
     name = "TemplateData";
-    commit = "d37b02f6ed194138ac7193a0782bbf6efb9164f8";
+    commit = "cca3b3430067f2161bf65de822f70dd38fe07bba";
-    hash = "sha256-NpzVBzX7qfXkIE+jh33ndooS9GE8ZF3/Jynm22in7IQ=";
+    hash = "sha256-OxLwiF8FlWizkpDF9GXYfjehKtrltX8ihiCE+fNJpgw=";
   })
   (mw-ext {
     name = "TemplateStyles";
-    commit = "f85614c26a0057a9f418342f89214a04c9de9988";
+    commit = "101a159dd0190759a16551a86800144c18b6ff5c";
-    hash = "sha256-XZOtM3iadjE5vavsjkx7kfJNhLZlnnFt1CN+mv6XVHQ=";
+    hash = "sha256-IGQQVAx8/76ivHq9b97ec1AlFoqbRl7uhXhwoFimsG4=";
   })
   (mw-ext {
     name = "UserMerge";
-    commit = "2f2432c909a36691ca0002daf6fb304d6c182beb";
+    commit = "6c0d105e07538c34bfde989bd26fa1945f8d1b79";
-    hash = "sha256-ZP8Tp6u+uJxx3I39YGMmkP0sTnjAQUSaxImAJaRv+Ek=";
+    hash = "sha256-w058Ihk0I98hIG1tkVJGy1bzbv7XXyUksGexXgCN540=";
   })
   (mw-ext {
     name = "VisualEditor";
-    commit = "1508d49d0dd71fdc1d18badd23671441b3bc327b";
+    commit = "8d8c6d7f179a5f799e1fa8cba207d81f58f722d2";
-    hash = "sha256-VNiCVNrCAImAr1tS9T28KPPzzNsKPz5ELFRIBtng+So=";
+    hash = "sha256-wbYHXi2vD521EMzUl7ttinG4YdLv/DwYvVUew7dka0g=";
   })
   (mw-ext {
     name = "WikiEditor";
-    commit = "aba5e7c6701877a6b43583709751658fec606d47";
+    commit = "f53000f0499858fe74e4f5008b2f5e467d9d9382";
-    hash = "sha256-XmbQy0NXuY3oVGkkgC233kkzfBfx32HDylloGYXU/Nc=";
+    hash = "sha256-+HTXZEVCwMD8z6c1kCZA3k686HzNd30pJljzRvf+gMg=";
   })
 ]