Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 oysteikt
|
c151e7fded
|
-14
@@ -20,7 +20,6 @@ keys:
|
||||
- &host_lupine-4 age1ml48zztcmnrdrhrdsjrlyxf09jtmjgz46u8td4zm59wn3fm4g57qs4wg0l
|
||||
- &host_lupine-5 age12gws5nws69vxryd3kt7q0ayngch90efmhqcrfhnnsmj00lkgxd4qsdkvqn
|
||||
- &host_skrot age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr
|
||||
- &host_temmie age10avsdvqger25z0lyzlq8v7xfzcmypkmjsswswaxwqnpnl6x9wcjq0uv2n7
|
||||
- &host_gluttony age12czfkvuw9pjk5qny5c6m2hjhd634cj9r4dsa3ss5zkux5h4vvc7s7k4urq
|
||||
|
||||
creation_rules:
|
||||
@@ -122,19 +121,6 @@ creation_rules:
|
||||
pgp:
|
||||
- *user_oysteikt
|
||||
|
||||
- path_regex: secrets/temmie/[^/]+\.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
- *host_temmie
|
||||
- *user_danio
|
||||
- *user_felixalb
|
||||
- *user_pederbs_sopp
|
||||
- *user_pederbs_nord
|
||||
- *user_pederbs_bjarte
|
||||
- *user_vegardbm
|
||||
pgp:
|
||||
- *user_oysteikt
|
||||
|
||||
- path_regex: secrets/gluttony/[^/]+\.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
inputs,
|
||||
fp,
|
||||
...
|
||||
}:
|
||||
@@ -36,7 +35,6 @@
|
||||
./services/prometheus-node-exporter.nix
|
||||
./services/prometheus-systemd-exporter.nix
|
||||
./services/roowho2.nix
|
||||
./services/scrutiny-collector.nix
|
||||
./services/smartd.nix
|
||||
./services/thermald.nix
|
||||
./services/uptimed.nix
|
||||
@@ -44,8 +42,6 @@
|
||||
./services/userdbd.nix
|
||||
];
|
||||
|
||||
system.nixos.tags = lib.optionals (inputs.self.sourceInfo ? dirtyRev) [ "dirty" ];
|
||||
|
||||
boot.tmp.cleanOnBoot = lib.mkDefault true;
|
||||
boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
|
||||
|
||||
|
||||
@@ -6,13 +6,10 @@ in
|
||||
security.polkit.enable = true;
|
||||
|
||||
environment.etc."polkit-1/rules.d/9-nixos-overrides.rules".text = lib.mkIf cfg.enable ''
|
||||
polkit.addRule(function(action, subject) {
|
||||
if (
|
||||
action.id.startsWith("org.freedesktop.systemd1.") &&
|
||||
subject.isInGroup("wheel")
|
||||
) {
|
||||
return polkit.Result.AUTH_SELF_KEEP;
|
||||
}
|
||||
});
|
||||
polkit.addAdminRule(function(action, subject) {
|
||||
if(subject.isInGroup("wheel")) {
|
||||
return ["unix-user:"+subject.user];
|
||||
}
|
||||
});
|
||||
'';
|
||||
}
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
{ config, ... }:
|
||||
{
|
||||
services.scrutiny.collector = {
|
||||
enable = !config.services.qemuGuest.enable;
|
||||
settings = {
|
||||
version = 1;
|
||||
host.id = config.networking.hostName;
|
||||
api.endpoint = "https://scrutiny.pvv.ntnu.no/";
|
||||
};
|
||||
};
|
||||
}
|
||||
Generated
+13
-79
@@ -1,27 +1,5 @@
|
||||
{
|
||||
"nodes": {
|
||||
"bro": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"rust-overlay": "rust-overlay"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1779629827,
|
||||
"narHash": "sha256-nrlB50/oelB8oFx9DhOoXI5z0VoTZGEA6XxYvkvpqDA=",
|
||||
"ref": "main",
|
||||
"rev": "7d0f35e12e4dec39f981c08fc33515589f41f4a5",
|
||||
"revCount": 3,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/bro.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/bro.git"
|
||||
}
|
||||
},
|
||||
"crane": {
|
||||
"locked": {
|
||||
"lastModified": 1776635034,
|
||||
@@ -123,7 +101,7 @@
|
||||
"nixpkgs": [
|
||||
"nixpkgs-unstable"
|
||||
],
|
||||
"rust-overlay": "rust-overlay_2"
|
||||
"rust-overlay": "rust-overlay"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1777019032,
|
||||
@@ -187,7 +165,7 @@
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"rust-overlay": "rust-overlay_3"
|
||||
"rust-overlay": "rust-overlay_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1767906976,
|
||||
@@ -309,27 +287,6 @@
|
||||
"url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
|
||||
}
|
||||
},
|
||||
"passwd2systemd-users": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1780062186,
|
||||
"narHash": "sha256-FSkwKO/56i9RddwSydK804fSnIvbczBnFJgr2/m+F9U=",
|
||||
"ref": "main",
|
||||
"rev": "db2b19f144af046161b7f9ca69ddaf3f06fcceea",
|
||||
"revCount": 13,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git"
|
||||
}
|
||||
},
|
||||
"pvv-calendar-bot": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -337,11 +294,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1779774845,
|
||||
"narHash": "sha256-QJU1J4eupwjRrtvWGzRut0GY3woql92RS9O/acWkJkk=",
|
||||
"lastModified": 1764869785,
|
||||
"narHash": "sha256-FGTIpC7gB4lbeL0bfYzn1Ge0PaCpd7VqWBLhJBx0i4A=",
|
||||
"ref": "main",
|
||||
"rev": "13667cd216db260ab549e6f1b6281aa230d2f9e0",
|
||||
"revCount": 29,
|
||||
"rev": "8ce7fb0b1918bdb3d1489a40d73895693955e8b2",
|
||||
"revCount": 23,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
|
||||
},
|
||||
@@ -358,11 +315,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1779903528,
|
||||
"narHash": "sha256-4rajaHeBeQ4PjbNSpslE9G3A5mZM1J/64ls+VoufWZo=",
|
||||
"lastModified": 1778960428,
|
||||
"narHash": "sha256-YAs3LbFGlBLJW3xHeoQfTq2GBBXTvuSKl2WXDtloczU=",
|
||||
"ref": "main",
|
||||
"rev": "bba7413a1c611d4918fbef4d3aa55e465ca3f3fb",
|
||||
"revCount": 585,
|
||||
"rev": "927748790b1f7159adfe32a3ad9ec01d22e9c5a2",
|
||||
"revCount": 583,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
||||
},
|
||||
@@ -395,7 +352,6 @@
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"bro": "bro",
|
||||
"dibbler": "dibbler",
|
||||
"disko": "disko",
|
||||
"gergle": "gergle",
|
||||
@@ -408,7 +364,6 @@
|
||||
"nix-topology": "nix-topology",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||
"passwd2systemd-users": "passwd2systemd-users",
|
||||
"pvv-calendar-bot": "pvv-calendar-bot",
|
||||
"pvv-nettsiden": "pvv-nettsiden",
|
||||
"qotd": "qotd",
|
||||
@@ -422,7 +377,7 @@
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"rust-overlay": "rust-overlay_4"
|
||||
"rust-overlay": "rust-overlay_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1778600367,
|
||||
@@ -441,27 +396,6 @@
|
||||
}
|
||||
},
|
||||
"rust-overlay": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"bro",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1779419951,
|
||||
"narHash": "sha256-dMX0PUslUHPajP6o8FEoRdFv9afq/dec4POR0vVfjK4=",
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"rev": "5b5c521d6cae9ef4aa32f888eb2c0ce595c9be52",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"rust-overlay_2": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"greg-ng",
|
||||
@@ -482,7 +416,7 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"rust-overlay_3": {
|
||||
"rust-overlay_2": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"minecraft-heatmap",
|
||||
@@ -503,7 +437,7 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"rust-overlay_4": {
|
||||
"rust-overlay_3": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"roowho2",
|
||||
|
||||
@@ -47,11 +47,6 @@
|
||||
|
||||
qotd.url = "git+https://git.pvv.ntnu.no/Projects/qotd.git?ref=main";
|
||||
qotd.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
bro.url = "git+https://git.pvv.ntnu.no/Projects/bro.git?ref=main";
|
||||
bro.inputs.nixpkgs.follows = "nixpkgs";
|
||||
passwd2systemd-users.url = "git+https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git?ref=main";
|
||||
passwd2systemd-users.inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
outputs = {
|
||||
@@ -219,15 +214,7 @@
|
||||
};
|
||||
shark = stableNixosConfig "shark" {};
|
||||
wenche = stableNixosConfig "wenche" {};
|
||||
temmie = stableNixosConfig "temmie" {
|
||||
overlays = [
|
||||
inputs.bro.overlays.default
|
||||
inputs.passwd2systemd-users.overlays.default
|
||||
];
|
||||
modules = [
|
||||
inputs.bro.nixosModules.default
|
||||
];
|
||||
};
|
||||
temmie = stableNixosConfig "temmie" {};
|
||||
gluttony = stableNixosConfig "gluttony" {
|
||||
overlays = [
|
||||
(final: prev: { bluemap = final.callPackage ./packages/bluemap.nix {}; })
|
||||
|
||||
@@ -107,7 +107,6 @@ in {
|
||||
CodeEditor
|
||||
CodeMirror
|
||||
DeleteBatch
|
||||
PdfHandler
|
||||
PluggableAuth
|
||||
Popups
|
||||
Scribunto
|
||||
@@ -182,17 +181,12 @@ in {
|
||||
];
|
||||
|
||||
# Misc program paths
|
||||
$wgFFmpegLocation = '${lib.getExe pkgs.ffmpeg}';
|
||||
$wgExiftool = '${lib.getExe pkgs.exiftool}';
|
||||
$wgExiv2Command = '${lib.getExe pkgs.exiv2}';
|
||||
$wgFFmpegLocation = '${pkgs.ffmpeg}/bin/ffmpeg';
|
||||
$wgExiftool = '${pkgs.exiftool}/bin/exiftool';
|
||||
$wgExiv2Command = '${pkgs.exiv2}/bin/exiv2';
|
||||
# See https://gist.github.com/sergejmueller/088dce028b6dd120a16e
|
||||
$wgJpegTran = '${lib.getExe' pkgs.mozjpeg "jpegtran"}';
|
||||
$wgGitBin = '${lib.getExe pkgs.git}';
|
||||
$wgDiff3 = '${lib.getExe' pkgs.diffutils "diff3"}';
|
||||
$wgDiff = '${lib.getExe' pkgs.diffutils "diff"}';
|
||||
|
||||
$wgUseImageMagick = true;
|
||||
$wgImageMagickConvertCommand = '${lib.getExe pkgs.imagemagick}';
|
||||
$wgJpegTran = '${pkgs.mozjpeg}/bin/jpegtran';
|
||||
$wgGitBin = '${pkgs.git}/bin/git';
|
||||
|
||||
# Debugging
|
||||
$wgShowExceptionDetails = false;
|
||||
@@ -217,13 +211,6 @@ in {
|
||||
# EXT:WikiEditor
|
||||
$wgWikiEditorRealtimePreview = true;
|
||||
|
||||
# EXT:PdfHandler
|
||||
$wgPdfProcessor = '${lib.getExe pkgs.ghostscript_headless}';
|
||||
$wgPdfPostProcessor = $wgImageMagickConvertCommand;
|
||||
$wgPdfInfo = '${lib.getExe' pkgs.poppler-utils "pdfinfo"}';
|
||||
$wgPdftoText = '${lib.getExe' pkgs.poppler-utils "pdftotext"}';
|
||||
|
||||
# Override key from hardcoded config in nixpkgs
|
||||
$wgSecretKey = file_get_contents("${config.sops.secrets."mediawiki/secret-key".path}");
|
||||
'';
|
||||
};
|
||||
|
||||
@@ -56,10 +56,10 @@ in
|
||||
locations."/roundcube" = {
|
||||
tryFiles = "$uri $uri/ =404";
|
||||
index = "index.php";
|
||||
root = pkgs.linkFarm "roundcube-dir" {
|
||||
roundcube = "${cfg.package}";
|
||||
};
|
||||
|
||||
root = pkgs.runCommandLocal "roundcube-dir" { } ''
|
||||
mkdir -p $out
|
||||
ln -s ${cfg.package} $out/roundcube
|
||||
'';
|
||||
extraConfig = ''
|
||||
location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
|
||||
# https://wiki.archlinux.org/title/Roundcube
|
||||
|
||||
@@ -60,8 +60,10 @@ in {
|
||||
DOOR_SECRET = includeFromSops "door_secret";
|
||||
|
||||
DB = {
|
||||
DSN = "mysql:dbname=www-data_nettside;host=mysql.pvv.ntnu.no";
|
||||
USER = "www-data_nettsi";
|
||||
# DSN = "mysql:dbname=www-data_nettside;host=mysql.pvv.ntnu.no";
|
||||
# USER = "www-data_nettsi";
|
||||
DSN = "pgsql:dbname=pvv_nettsiden;host=postgres.pvv.ntnu.no";
|
||||
USER = "pvv_nettsiden";
|
||||
PASS = includeFromSops "mysql_password";
|
||||
};
|
||||
|
||||
@@ -81,6 +83,7 @@ in {
|
||||
|
||||
services.phpfpm.pools."pvv-nettsiden".settings = {
|
||||
"php_admin_value[error_log]" = "syslog";
|
||||
"php_flag[display_errors]" = true;
|
||||
"php_admin_flag[log_errors]" = true;
|
||||
"catch_workers_output" = true;
|
||||
|
||||
@@ -119,7 +122,6 @@ in {
|
||||
services.nginx.virtualHosts."pvv.ntnu.no" = {
|
||||
globalRedirect = cfg.domainName;
|
||||
redirectCode = 307;
|
||||
kTLS = true;
|
||||
forceSSL = true;
|
||||
useACMEHost = "www.pvv.ntnu.no";
|
||||
};
|
||||
@@ -127,7 +129,6 @@ in {
|
||||
services.nginx.virtualHosts."www.pvv.org" = {
|
||||
globalRedirect = cfg.domainName;
|
||||
redirectCode = 307;
|
||||
kTLS = true;
|
||||
forceSSL = true;
|
||||
useACMEHost = "www.pvv.ntnu.no";
|
||||
};
|
||||
@@ -135,13 +136,11 @@ in {
|
||||
services.nginx.virtualHosts."pvv.org" = {
|
||||
globalRedirect = cfg.domainName;
|
||||
redirectCode = 307;
|
||||
kTLS = true;
|
||||
forceSSL = true;
|
||||
useACMEHost = "www.pvv.ntnu.no";
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts.${cfg.domainName} = {
|
||||
kTLS = true;
|
||||
locations = {
|
||||
# Proxy home directories
|
||||
"^~ /~" = {
|
||||
|
||||
@@ -37,56 +37,47 @@ in {
|
||||
};
|
||||
|
||||
systemd.services.pvv-nettsiden-gallery-update = {
|
||||
path = with pkgs; [ imagemagick gnutar gzip ];
|
||||
|
||||
script = ''
|
||||
tar ${lib.cli.toCommandLineShellGNU { } {
|
||||
extract = true;
|
||||
file = "${transferDir}/gallery.tar.gz";
|
||||
directory = ".";
|
||||
}}
|
||||
|
||||
# Delete files and directories that exists in the gallery that don't exist in the tarball
|
||||
filesToRemove=$(uniq -u <(sort <(find . -not -path './.thumbnails*') <(tar -tf '${transferDir}/gallery.tar.gz' | sed 's|/$||')))
|
||||
while IFS= read -r fname; do
|
||||
rm -f "$fname" ||:
|
||||
rm -f ".thumbnails/$fname.png" ||:
|
||||
done <<< "$filesToRemove"
|
||||
|
||||
find . -type d -empty -delete
|
||||
|
||||
mkdir -p .thumbnails
|
||||
images=$(find . -type f -not -path './.thumbnails*')
|
||||
|
||||
while IFS= read -r fname; do
|
||||
# Skip this file if an up-to-date thumbnail already exists
|
||||
if [ -f ".thumbnails/$fname.png" ] && \
|
||||
[ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
|
||||
then
|
||||
continue
|
||||
fi
|
||||
|
||||
echo "Creating thumbnail for $fname"
|
||||
mkdir -p "$(dirname ".thumbnails/$fname")"
|
||||
magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
|
||||
touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
|
||||
done <<< "$images"
|
||||
'';
|
||||
|
||||
serviceConfig = {
|
||||
WorkingDirectory = galleryDir;
|
||||
User = config.services.pvv-nettsiden.user;
|
||||
Group = config.services.pvv-nettsiden.group;
|
||||
|
||||
ExecStart = lib.getExe (pkgs.writeShellApplication {
|
||||
name = "pvv-nettsiden-gallery-update-exec-start.sh";
|
||||
runtimeInputs = with pkgs; [
|
||||
coreutils
|
||||
findutils
|
||||
gnused
|
||||
gnutar
|
||||
gzip
|
||||
imagemagick
|
||||
];
|
||||
text = ''
|
||||
tar ${lib.cli.toCommandLineShellGNU { } {
|
||||
extract = true;
|
||||
file = "${transferDir}/gallery.tar.gz";
|
||||
directory = ".";
|
||||
}}
|
||||
|
||||
# Delete files and directories that exists in the gallery that don't exist in the tarball
|
||||
filesToRemove="$(uniq -u <(sort <(find . -not -path './.thumbnails*') <(tar -tf '${transferDir}/gallery.tar.gz' | sed 's|/$||')))"
|
||||
while IFS= read -r fname; do
|
||||
rm -f "$fname" ||:
|
||||
rm -f ".thumbnails/$fname.png" ||:
|
||||
done <<< "$filesToRemove"
|
||||
|
||||
find . -type d -empty -delete
|
||||
|
||||
mkdir -p .thumbnails
|
||||
images="$(find . -type f -not -path './.thumbnails*')"
|
||||
|
||||
while IFS= read -r fname; do
|
||||
# Skip this file if an up-to-date thumbnail already exists
|
||||
if [ -f ".thumbnails/$fname.png" ] && \
|
||||
[ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
|
||||
then
|
||||
continue
|
||||
fi
|
||||
|
||||
echo "Creating thumbnail for $fname"
|
||||
mkdir -p "$(dirname ".thumbnails/$fname")"
|
||||
magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
|
||||
touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
|
||||
done <<< "$images"
|
||||
'';
|
||||
});
|
||||
|
||||
AmbientCapabilities = [ "" ];
|
||||
CapabilityBoundingSet = [ "" ];
|
||||
DeviceAllow = [ "" ];
|
||||
|
||||
@@ -83,7 +83,6 @@ in
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."mirrors.pvv.ntnu.no" = {
|
||||
kTLS = true;
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
|
||||
|
||||
@@ -22,7 +22,6 @@ in
|
||||
sops.templates."hookshot-registration.yaml" = {
|
||||
owner = config.users.users.matrix-synapse.name;
|
||||
group = config.users.groups.keys-matrix-registrations.name;
|
||||
mode = "0440";
|
||||
restartUnits = [ "matrix-hookshot.service" ];
|
||||
content = ''
|
||||
id: matrix-hookshot
|
||||
@@ -50,59 +49,12 @@ in
|
||||
|
||||
systemd.services.matrix-hookshot = {
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
SupplementaryGroups = [
|
||||
config.users.groups.keys-matrix-registrations.name
|
||||
];
|
||||
LoadCredential = [
|
||||
"passkey.pem:${config.sops.secrets."matrix/hookshot/passkey".path}"
|
||||
];
|
||||
|
||||
RuntimeDirectory = [ "matrix-hookshot/root-mnt" ];
|
||||
RootDirectory = "/run/matrix-hookshot/root-mnt";
|
||||
BindReadOnlyPaths = [
|
||||
config.sops.templates."hookshot-registration.yaml".path
|
||||
builtins.storeDir
|
||||
"/etc"
|
||||
"/run/nscd"
|
||||
"/var/run/nscd"
|
||||
];
|
||||
|
||||
AmbientCapabilities = "";
|
||||
CapabilityBoundingSet = "";
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = false; # node needs this
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateMounts = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProcSubset = "pid";
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
ProtectSystem = "strict";
|
||||
RemoveIPC = true;
|
||||
RestrictAddressFamilies = [
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
"AF_UNIX"
|
||||
];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@privileged"
|
||||
"~@resources"
|
||||
];
|
||||
UMask = "0077";
|
||||
};
|
||||
};
|
||||
|
||||
@@ -194,7 +146,6 @@ in
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
|
||||
kTLS = true;
|
||||
enableACME = true;
|
||||
addSSL = true;
|
||||
locations."/" = {
|
||||
|
||||
@@ -54,53 +54,4 @@
|
||||
# TODO: Fix upstream module in nixpkgs
|
||||
pantalaimon.username = "bot_admin";
|
||||
};
|
||||
|
||||
systemd.services.mjolnir.serviceConfig = {
|
||||
DynamicUser = true;
|
||||
RuntimeDirectory = [ "mjolnir/root-mnt" ];
|
||||
RootDirectory = "/run/mjolnir/root-mnt";
|
||||
BindReadOnlyPaths = [
|
||||
config.sops.secrets."matrix/mjolnir/access_token".path
|
||||
builtins.storeDir
|
||||
"/etc"
|
||||
"/run/nscd"
|
||||
"/var/run/nscd"
|
||||
];
|
||||
|
||||
AmbientCapabilities = "";
|
||||
CapabilityBoundingSet = "";
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = false; # node needs this
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateMounts = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProcSubset = "pid";
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
ProtectSystem = "strict";
|
||||
RemoveIPC = true;
|
||||
RestrictAddressFamilies = [
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
"AF_UNIX"
|
||||
];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@privileged"
|
||||
"~@resources"
|
||||
];
|
||||
UMask = "0077";
|
||||
};
|
||||
}
|
||||
|
||||
@@ -56,55 +56,6 @@ in
|
||||
enableSynapseIntegration = false;
|
||||
};
|
||||
|
||||
systemd.services."matrix-ooye" = {
|
||||
serviceConfig = {
|
||||
RuntimeDirectory = [ "matrix-ooye/root-mnt" ];
|
||||
RootDirectory = "/run/matrix-ooye/root-mnt";
|
||||
BindReadOnlyPaths = [
|
||||
builtins.storeDir
|
||||
"/etc"
|
||||
"/run/nscd"
|
||||
"/var/run/nscd"
|
||||
];
|
||||
|
||||
AmbientCapabilities = "";
|
||||
CapabilityBoundingSet = "";
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = false; # node needs this
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateMounts = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProcSubset = "pid";
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
ProtectSystem = "strict";
|
||||
RemoveIPC = true;
|
||||
RestrictAddressFamilies = [
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
"AF_UNIX"
|
||||
];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@privileged"
|
||||
"~@resources"
|
||||
];
|
||||
UMask = "0077";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."matrix-synapse" = {
|
||||
after = [
|
||||
"matrix-ooye-pre-start.service"
|
||||
@@ -129,7 +80,6 @@ in
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."ooye.pvv.ntnu.no" = {
|
||||
kTLS = true;
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/".proxyPass = "http://localhost:${cfg.socket}";
|
||||
|
||||
@@ -23,28 +23,27 @@ in
|
||||
};
|
||||
|
||||
systemd.services.minecraft-heatmap-ingest-logs = lib.mkIf cfg.enable {
|
||||
serviceConfig = {
|
||||
LoadCredential = [
|
||||
"sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
|
||||
];
|
||||
ExecStartPre = let
|
||||
knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
|
||||
innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
|
||||
innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
|
||||
innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
|
||||
'';
|
||||
rsyncArgs = lib.cli.toCommandLineShellGNU { } {
|
||||
archive = true;
|
||||
verbose = true;
|
||||
progress = true;
|
||||
no-owner = true;
|
||||
no-group = true;
|
||||
};
|
||||
sshCommand = ''${pkgs.openssh}/bin/ssh -o UserKnownHostsFile='${knownHostsFile}' -i \"$CREDENTIALS_DIRECTORY\"/sshkey'';
|
||||
in [
|
||||
"${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.minecraftLogsDir}'"
|
||||
"${lib.getExe pkgs.rsync} ${rsyncArgs} --rsh=\"${sshCommand}\" root@innovation.pvv.ntnu.no:/ '${cfg.minecraftLogsDir}'/"
|
||||
];
|
||||
};
|
||||
serviceConfig.LoadCredential = [
|
||||
"sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
|
||||
];
|
||||
|
||||
preStart = let
|
||||
knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
|
||||
innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
|
||||
innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
|
||||
innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
|
||||
'';
|
||||
in ''
|
||||
mkdir -p '${cfg.minecraftLogsDir}'
|
||||
"${lib.getExe pkgs.rsync}" \
|
||||
--archive \
|
||||
--verbose \
|
||||
--progress \
|
||||
--no-owner \
|
||||
--no-group \
|
||||
--rsh="${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=\"${knownHostsFile}\" -i \"$CREDENTIALS_DIRECTORY\"/sshkey" \
|
||||
root@innovation.pvv.ntnu.no:/ \
|
||||
'${cfg.minecraftLogsDir}'/
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
||||
@@ -5,7 +5,6 @@
|
||||
./grafana.nix
|
||||
./loki.nix
|
||||
./prometheus
|
||||
./scrutiny.nix
|
||||
./uptime-kuma.nix
|
||||
];
|
||||
}
|
||||
|
||||
@@ -1,40 +0,0 @@
|
||||
{ config, values, ... }:
|
||||
let
|
||||
cfg = config.services.scrutiny;
|
||||
in
|
||||
{
|
||||
services.scrutiny = {
|
||||
enable = true;
|
||||
settings = {
|
||||
web.listen = {
|
||||
host = "127.0.0.1";
|
||||
port = 18293;
|
||||
basepath = "";
|
||||
};
|
||||
|
||||
# notify.urls = [
|
||||
# "matrix://username:password@host:port/[?rooms=!roomID1[,roomAlias2]]"
|
||||
# ];
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."scrutiny.pvv.ntnu.no" = {
|
||||
kTLS = true;
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://${cfg.settings.web.listen.host}:${toString cfg.settings.web.listen.port}";
|
||||
};
|
||||
|
||||
# TODO: allow website access to the outside world, but restrict input api
|
||||
extraConfig = ''
|
||||
allow ${values.hosts.ildkule.ipv4}/32;
|
||||
allow ${values.hosts.ildkule.ipv6}/128;
|
||||
allow 127.0.0.1/32;
|
||||
allow ::1/128;
|
||||
allow ${values.ipv4-space};
|
||||
allow ${values.ipv6-space};
|
||||
deny all;
|
||||
'';
|
||||
};
|
||||
}
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, pkgs, lib, values, ... }:
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.services.uptime-kuma;
|
||||
domain = "status.pvv.ntnu.no";
|
||||
@@ -24,21 +24,4 @@ in {
|
||||
fsType = "bind";
|
||||
options = [ "bind" ];
|
||||
};
|
||||
|
||||
services.rsync-pull-targets = {
|
||||
enable = true;
|
||||
locations.${stateDir} = {
|
||||
user = "root";
|
||||
rrsyncArgs.ro = true;
|
||||
authorizedKeysAttrs = [
|
||||
"restrict"
|
||||
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
|
||||
"no-agent-forwarding"
|
||||
"no-port-forwarding"
|
||||
"no-pty"
|
||||
"no-X11-forwarding"
|
||||
];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXzcDm6cVr4NmWzUSroy33FlielKqaG83wY0RCMC0p/ uptime_kuma rsync backup";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -72,52 +72,50 @@ in
|
||||
Type = "oneshot";
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
PrivateNetwork = true;
|
||||
|
||||
ExecStart = let
|
||||
logo-svg = fp /assets/logo_blue_regular.svg;
|
||||
logo-png = fp /assets/logo_blue_regular.png;
|
||||
|
||||
extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
|
||||
<a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
|
||||
'';
|
||||
|
||||
extraLinksFooter = pkgs.writeText "gitea-extra-links-footer.tmpl" ''
|
||||
<a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
|
||||
<a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
|
||||
<a class="item" href="https://wiki.pvv.ntnu.no/wiki/Tjenester/Kodelager">PVV Gitea Howto</a>
|
||||
'';
|
||||
|
||||
project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
|
||||
labels = lib.importJSON ./labels/projects.json;
|
||||
};
|
||||
|
||||
customTemplates = pkgs.runCommandLocal "gitea-templates" {
|
||||
nativeBuildInputs = with pkgs; [
|
||||
coreutils
|
||||
gnused
|
||||
];
|
||||
} ''
|
||||
# Bigger icons
|
||||
install -Dm444 '${cfg.package.src}/templates/repo/icon.tmpl' "$out/repo/icon.tmpl"
|
||||
sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
|
||||
'';
|
||||
install = lib.getExe' pkgs.coreutils "install";
|
||||
in [
|
||||
"${install} -Dm444 '${logo-svg}' '${cfg.customDir}/public/assets/img/logo.svg'"
|
||||
"${install} -Dm444 '${logo-png}' '${cfg.customDir}/public/assets/img/logo.png'"
|
||||
"${install} -Dm444 '${./loading.apng}' '${cfg.customDir}/public/assets/img/loading.png'"
|
||||
"${install} -Dm444 '${extraLinks}' '${cfg.customDir}/templates/custom/extra_links.tmpl'"
|
||||
"${install} -Dm444 '${extraLinksFooter}' '${cfg.customDir}/templates/custom/extra_links_footer.tmpl'"
|
||||
"${install} -Dm444 '${project-labels}' '${cfg.customDir}/options/label/project-labels.yaml'"
|
||||
|
||||
"${install} -Dm644 '${./emotes/bruh.png}' '${cfg.customDir}/public/assets/img/emoji/bruh.png'"
|
||||
"${install} -Dm644 '${./emotes/huh.gif}' '${cfg.customDir}/public/assets/img/emoji/huh.png'"
|
||||
"${install} -Dm644 '${./emotes/grr.png}' '${cfg.customDir}/public/assets/img/emoji/grr.png'"
|
||||
"${install} -Dm644 '${./emotes/okiedokie.jpg}' '${cfg.customDir}/public/assets/img/emoji/okiedokie.png'"
|
||||
|
||||
"${lib.getExe pkgs.rsync} -a '${customTemplates}/' '${cfg.customDir}/templates/'"
|
||||
];
|
||||
};
|
||||
|
||||
script = let
|
||||
logo-svg = fp /assets/logo_blue_regular.svg;
|
||||
logo-png = fp /assets/logo_blue_regular.png;
|
||||
|
||||
extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
|
||||
<a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
|
||||
'';
|
||||
|
||||
extraLinksFooter = pkgs.writeText "gitea-extra-links-footer.tmpl" ''
|
||||
<a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
|
||||
<a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
|
||||
<a class="item" href="https://wiki.pvv.ntnu.no/wiki/Tjenester/Kodelager">PVV Gitea Howto</a>
|
||||
'';
|
||||
|
||||
project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
|
||||
labels = lib.importJSON ./labels/projects.json;
|
||||
};
|
||||
|
||||
customTemplates = pkgs.runCommandLocal "gitea-templates" {
|
||||
nativeBuildInputs = with pkgs; [
|
||||
coreutils
|
||||
gnused
|
||||
];
|
||||
} ''
|
||||
# Bigger icons
|
||||
install -Dm444 '${cfg.package.src}/templates/repo/icon.tmpl' "$out/repo/icon.tmpl"
|
||||
sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
|
||||
'';
|
||||
in ''
|
||||
install -Dm444 '${logo-svg}' '${cfg.customDir}/public/assets/img/logo.svg'
|
||||
install -Dm444 '${logo-png}' '${cfg.customDir}/public/assets/img/logo.png'
|
||||
install -Dm444 '${./loading.apng}' '${cfg.customDir}/public/assets/img/loading.png'
|
||||
install -Dm444 '${extraLinks}' '${cfg.customDir}/templates/custom/extra_links.tmpl'
|
||||
install -Dm444 '${extraLinksFooter}' '${cfg.customDir}/templates/custom/extra_links_footer.tmpl'
|
||||
install -Dm444 '${project-labels}' '${cfg.customDir}/options/label/project-labels.yaml'
|
||||
|
||||
install -Dm644 '${./emotes/bruh.png}' '${cfg.customDir}/public/assets/img/emoji/bruh.png'
|
||||
install -Dm644 '${./emotes/huh.gif}' '${cfg.customDir}/public/assets/img/emoji/huh.png'
|
||||
install -Dm644 '${./emotes/grr.png}' '${cfg.customDir}/public/assets/img/emoji/grr.png'
|
||||
install -Dm644 '${./emotes/okiedokie.jpg}' '${cfg.customDir}/public/assets/img/emoji/okiedokie.png'
|
||||
|
||||
'${lib.getExe pkgs.rsync}' -a '${customTemplates}/' '${cfg.customDir}/templates/'
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
||||
@@ -139,9 +139,6 @@ in {
|
||||
AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 2;
|
||||
};
|
||||
actions.ENABLED = true;
|
||||
webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," [
|
||||
"external"
|
||||
];
|
||||
};
|
||||
|
||||
dump = {
|
||||
|
||||
@@ -38,11 +38,11 @@ in
|
||||
Type = "oneshot";
|
||||
User = cfg.user;
|
||||
PrivateNetwork = true;
|
||||
ExecStart = [
|
||||
"${lib.getExe pkgs.gnupg} --import '${config.sops.secrets."gitea/gpg-signing-key-public".path}'"
|
||||
"${lib.getExe pkgs.gnupg} --import '${config.sops.secrets."gitea/gpg-signing-key-private".path}'"
|
||||
];
|
||||
};
|
||||
script = ''
|
||||
${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-public".path}
|
||||
${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-private".path}
|
||||
'';
|
||||
};
|
||||
|
||||
services.gitea.settings."repository.signing" = {
|
||||
@@ -50,8 +50,6 @@ in
|
||||
SIGNING_NAME = "PVV Git";
|
||||
SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
|
||||
INITIAL_COMMIT = "always";
|
||||
MERGES = lib.concatStringsSep "," [ "always" ];
|
||||
CRUD_ACTIONS = lib.concatStringsSep "," [ "always" ];
|
||||
WIKI = "always";
|
||||
};
|
||||
}
|
||||
|
||||
@@ -11,9 +11,9 @@ in
|
||||
|
||||
systemd.services.gitea-import-users = lib.mkIf cfg.enable {
|
||||
enable = true;
|
||||
preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
|
||||
environment.PASSWD_FILE_PATH = "/run/gitea-import-users/passwd";
|
||||
serviceConfig = {
|
||||
ExecStartPre = ''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
|
||||
ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
|
||||
flakeIgnore = [
|
||||
"E501" # Line over 80 chars lol
|
||||
|
||||
@@ -18,6 +18,9 @@
|
||||
anyInterface = true;
|
||||
};
|
||||
|
||||
# There are no smart devices
|
||||
services.smartd.enable = false;
|
||||
|
||||
# Don't change (even during upgrades) unless you know what you are doing.
|
||||
# See https://search.nixos.org/options?show=system.stateVersion
|
||||
system.stateVersion = "25.05";
|
||||
|
||||
@@ -39,7 +39,7 @@ let
|
||||
extraConfig = phpOptions;
|
||||
};
|
||||
|
||||
perlEnv = (pkgs.perl.withPackages (ps: with ps; [
|
||||
perlEnv = pkgs.perl.withPackages (ps: with ps; [
|
||||
pkgs.exiftool
|
||||
pkgs.ikiwiki
|
||||
pkgs.irssi
|
||||
@@ -54,14 +54,7 @@ let
|
||||
ImageMagick
|
||||
JSON
|
||||
TemplateToolkit
|
||||
])).overrideAttrs (prev: {
|
||||
# NOTE: `pkgs.perl.propagatedBuildInputs` don't actually propagate through the
|
||||
# wrapper derivation created by `withPackages`. This should compensate
|
||||
# for that.
|
||||
postBuild = prev.postBuild + ''
|
||||
cp -r '${pkgs.perl}/nix-support' "$out"/nix-support
|
||||
'';
|
||||
});
|
||||
]);
|
||||
|
||||
# https://nixos.org/manual/nixpkgs/stable/#python.buildenv-function
|
||||
pythonEnv = pkgs.python3.buildEnv.override {
|
||||
@@ -74,6 +67,21 @@ let
|
||||
ignoreCollisions = true;
|
||||
};
|
||||
|
||||
sendmailWrapper = pkgs.writeShellApplication {
|
||||
name = "sendmail";
|
||||
runtimeInputs = [ ];
|
||||
text = ''
|
||||
args=("$@")
|
||||
|
||||
if [[ -z "$USERDIR_USER" ]] && [[ "$USERDIR_USER" != "pvv" ]]; then
|
||||
# Prepend -fusername to the argument list, so bounces go to the user
|
||||
args=("-f$USERDIR_USER" "''${args[@]}")
|
||||
fi
|
||||
|
||||
exec '${lib.getExe pkgs.system-sendmail}' "''${args[@]}"
|
||||
'';
|
||||
};
|
||||
|
||||
# https://nixos.org/manual/nixpkgs/stable/#sec-building-environment
|
||||
fhsEnv = pkgs.buildEnv {
|
||||
name = "userweb-env";
|
||||
@@ -81,7 +89,7 @@ let
|
||||
paths = with pkgs; [
|
||||
bash
|
||||
|
||||
config.services.bro.instances.userweb-sendmail.client.package
|
||||
sendmailWrapper
|
||||
|
||||
perlEnv
|
||||
pythonEnv
|
||||
@@ -154,11 +162,6 @@ in
|
||||
./mail.nix
|
||||
];
|
||||
|
||||
sops.secrets = {
|
||||
"httpd/passwd-ssh-key" = { };
|
||||
"httpd/ssh-known-hosts" = { };
|
||||
};
|
||||
|
||||
services.httpd = {
|
||||
enable = true;
|
||||
adminAddr = "drift@pvv.ntnu.no";
|
||||
@@ -181,21 +184,17 @@ in
|
||||
extraModules = [
|
||||
"systemd"
|
||||
"userdir"
|
||||
{
|
||||
name = "perl";
|
||||
path = let
|
||||
mod_perl = pkgs.symlinkJoin {
|
||||
name = "userweb_modperl_with_custom_perl_env";
|
||||
ignoreCollisions = true;
|
||||
paths = [
|
||||
(pkgs.apacheHttpdPackages.mod_perl.override {
|
||||
apacheHttpd = cfg.package.out;
|
||||
})
|
||||
perlEnv
|
||||
];
|
||||
};
|
||||
in "${mod_perl}/modules/mod_perl.so";
|
||||
}
|
||||
# TODO: I think the compilation steps of pkgs.apacheHttpdPackages.mod_perl might have some
|
||||
# incorrect or restrictive assumptions upstream, either nixpkgs or source
|
||||
# {
|
||||
# name = "perl";
|
||||
# path = let
|
||||
# mod_perl = pkgs.apacheHttpdPackages.mod_perl.override {
|
||||
# apacheHttpd = cfg.package.out;
|
||||
# perl = perlEnv;
|
||||
# };
|
||||
# in "${mod_perl}/modules/mod_perl.so";
|
||||
# }
|
||||
];
|
||||
|
||||
extraConfig = ''
|
||||
@@ -204,14 +203,11 @@ in
|
||||
ScriptLog ${cfg.logDir}/cgi.log
|
||||
'';
|
||||
|
||||
# virtualHosts."userweb.pvv.ntnu.no" = {
|
||||
virtualHosts."temmie.pvv.ntnu.no" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
|
||||
serverAliases = [
|
||||
"www2.pvv.ntnu.no"
|
||||
];
|
||||
|
||||
extraConfig = ''
|
||||
UserDir ${lib.concatMapStringsSep " " (l: "/home/pvv/${l}/*/web-docs") homeLetters}
|
||||
UserDir disabled root
|
||||
@@ -262,14 +258,6 @@ in
|
||||
# ];
|
||||
# };
|
||||
|
||||
# NOTE: 54 -> 33, this is the UID/GID we used for www-data on tom in the past.
|
||||
# Any files accessed by or created by httpd will do so over NFS with this
|
||||
# UID/GID pair as its credentials.
|
||||
# This overlaps with the hardcoded `disnix` uid in nixpkgs, but we *probably*
|
||||
# won't be using that for the foreseeable future.
|
||||
users.users."wwwrun".uid = lib.mkForce 33;
|
||||
users.groups."wwwrun".gid = lib.mkForce 33;
|
||||
|
||||
systemd.services.httpd = {
|
||||
after = [ "pvv-homedirs.target" ];
|
||||
requires = [ "pvv-homedirs.target" ];
|
||||
@@ -281,49 +269,11 @@ in
|
||||
serviceConfig = {
|
||||
Type = lib.mkForce "notify";
|
||||
|
||||
ExecStartPre = let
|
||||
rsyncCommand = ''${lib.getExe pkgs.rsync} -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey" -avz'';
|
||||
in lib.mkForce [
|
||||
(lib.getExe (pkgs.writeShellApplication {
|
||||
name = "http-exec-start-pre-remove-old-semaphores";
|
||||
text = ''
|
||||
# Get rid of old semaphores. These tend to accumulate across
|
||||
# server restarts, eventually preventing it from restarting
|
||||
# successfully.
|
||||
for i in $(${pkgs.util-linux}/bin/ipcs -s | grep ' ${cfg.user} ' | cut -f2 -d ' '); do
|
||||
${pkgs.util-linux}/bin/ipcrm -s "$i"
|
||||
done
|
||||
'';
|
||||
}))
|
||||
"${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/passwd /run/httpd/pamunix-sync/"
|
||||
"${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/group /run/httpd/pamunix-sync/"
|
||||
# "${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/shadow /run/httpd/pamunix-sync/"
|
||||
(let
|
||||
args = lib.cli.toCommandLineShellGNU { } {
|
||||
passwd-file = "/run/httpd/pamunix-sync/passwd";
|
||||
group-file = "/run/httpd/pamunix-sync/group";
|
||||
shadow-file = pkgs.emptyFile;
|
||||
email-domain = "pvv.ntnu.no";
|
||||
ignore-user-file = toString ./ignore_user_file.txt;
|
||||
ignore-group-file = toString ./ignore_group_file.txt;
|
||||
set-default-umask = "0077";
|
||||
set-default-mount-no-devices = "true";
|
||||
set-default-mount-no-suid = "true";
|
||||
set-default-mount-no-execute = "false";
|
||||
};
|
||||
in ''${lib.getExe pkgs.passwd2systemd-users} ${args}'')
|
||||
"${lib.getExe' pkgs.coreutils "shred"} /run/httpd/pamunix-sync/passwd /run/httpd/pamunix-sync/group"
|
||||
];
|
||||
ExecStart = lib.mkForce "${cfg.package}/bin/httpd -D FOREGROUND -f /etc/httpd/httpd.conf -k start";
|
||||
ExecReload = lib.mkForce "${cfg.package}/bin/httpd -f /etc/httpd/httpd.conf -k graceful";
|
||||
ExecStop = lib.mkForce "";
|
||||
KillMode = "mixed";
|
||||
|
||||
LoadCredential=[
|
||||
"sshkey:${config.sops.secrets."httpd/passwd-ssh-key".path}"
|
||||
"ssh-known-hosts:${config.sops.secrets."httpd/ssh-known-hosts".path}"
|
||||
];
|
||||
|
||||
ConfigurationDirectory = [ "httpd" ];
|
||||
LogsDirectory = [ "httpd" ];
|
||||
LogsDirectoryMode = "0700";
|
||||
@@ -361,11 +311,7 @@ in
|
||||
];
|
||||
UMask = "0077";
|
||||
|
||||
RuntimeDirectory = [
|
||||
"httpd/root-mnt"
|
||||
"httpd/pamunix-sync"
|
||||
"httpd/systemd-userdb"
|
||||
];
|
||||
RuntimeDirectory = [ "httpd/root-mnt" ];
|
||||
RootDirectory = "/run/httpd/root-mnt";
|
||||
MountAPIVFS = true;
|
||||
BindReadOnlyPaths = [
|
||||
|
||||
@@ -1,91 +0,0 @@
|
||||
Debian-exim
|
||||
_cvsadmin
|
||||
_ssh
|
||||
adm
|
||||
audio
|
||||
avahi
|
||||
backup
|
||||
bin
|
||||
cdrom
|
||||
cl-builder
|
||||
clamav
|
||||
clock
|
||||
colord
|
||||
courier
|
||||
crontab
|
||||
daemon
|
||||
debian-spamd
|
||||
dialout
|
||||
dip
|
||||
dirmngr
|
||||
disk
|
||||
dovecot
|
||||
fax
|
||||
floppy
|
||||
fuse
|
||||
games
|
||||
geoclue
|
||||
gnats
|
||||
input
|
||||
irc
|
||||
kmem
|
||||
kvm
|
||||
list
|
||||
lock
|
||||
lp
|
||||
lpadmin
|
||||
mail
|
||||
man
|
||||
messagebus
|
||||
mlocate
|
||||
munin
|
||||
netdev
|
||||
news
|
||||
nogroup
|
||||
ntp
|
||||
ntpsec
|
||||
oident
|
||||
opendkim
|
||||
operator
|
||||
plocate
|
||||
plugdev
|
||||
polkitd
|
||||
postdrop
|
||||
postfix
|
||||
postgres
|
||||
prometheus
|
||||
prometheus-exporter
|
||||
proxy
|
||||
rdma
|
||||
root
|
||||
# runit
|
||||
salt
|
||||
sambashare
|
||||
saned
|
||||
sasl
|
||||
scanner
|
||||
sgx
|
||||
shadow
|
||||
src
|
||||
ssl-cert
|
||||
staff
|
||||
stunnel4
|
||||
sudo
|
||||
sys
|
||||
systemd-coredump
|
||||
systemd-journal
|
||||
systemd-network
|
||||
systemd-resolve
|
||||
systemd-timesync
|
||||
tape
|
||||
tcpdump
|
||||
tty
|
||||
users
|
||||
utempter
|
||||
utmp
|
||||
uucp
|
||||
uuidd
|
||||
video
|
||||
voice
|
||||
winbindd_priv
|
||||
www-data
|
||||
@@ -1,74 +0,0 @@
|
||||
# System Users
|
||||
Debian-exim
|
||||
_apt
|
||||
_rpc
|
||||
avahi
|
||||
backup
|
||||
bin
|
||||
cl-builder
|
||||
clamav
|
||||
colord
|
||||
courier
|
||||
daemon
|
||||
debian-spamd
|
||||
debian-spamd
|
||||
dirmngr
|
||||
distccd
|
||||
dovecot
|
||||
dovenull
|
||||
driftsupport
|
||||
fetchmail
|
||||
games
|
||||
geoclue
|
||||
gitea
|
||||
gnats
|
||||
hplip
|
||||
irc
|
||||
list
|
||||
lp
|
||||
mail
|
||||
mail2news
|
||||
mailnews
|
||||
man
|
||||
messagebus
|
||||
munin
|
||||
news
|
||||
nobody
|
||||
noone
|
||||
ntp
|
||||
ntpsec
|
||||
oident
|
||||
opendkim
|
||||
polkitd
|
||||
postfix
|
||||
postgres
|
||||
prometheus
|
||||
prometheus-exporter
|
||||
proxy
|
||||
root
|
||||
rwhod
|
||||
salt
|
||||
saned
|
||||
spamd
|
||||
sshd
|
||||
statd
|
||||
stunnel4
|
||||
sync
|
||||
sys
|
||||
systemd-coredump
|
||||
systemd-network
|
||||
systemd-resolve
|
||||
systemd-timesync
|
||||
tcpdump
|
||||
uucp
|
||||
uuidd
|
||||
vaultwarden
|
||||
www-data
|
||||
|
||||
# Misc
|
||||
nuccc04
|
||||
nuccc
|
||||
kybkokos
|
||||
kybkokos2
|
||||
testbruker2309
|
||||
testbruker2404
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
{ config, lib, ... }:
|
||||
{
|
||||
services.postfix.enable = lib.mkForce false;
|
||||
|
||||
@@ -9,111 +9,4 @@
|
||||
remotes = "mail.pvv.ntnu.no smtp --port=25";
|
||||
};
|
||||
};
|
||||
|
||||
services.bro = {
|
||||
enable = true;
|
||||
|
||||
instances.userweb-sendmail = {
|
||||
enable = true;
|
||||
|
||||
client = {
|
||||
settings.BRO_FILE_FLAGS = [
|
||||
"-C"
|
||||
];
|
||||
};
|
||||
|
||||
server = {
|
||||
settings = {
|
||||
executable = let
|
||||
sendmailWrapper = pkgs.writeShellApplication {
|
||||
name = "sendmail";
|
||||
runtimeInputs = [ ];
|
||||
bashOptions = [
|
||||
"errexit"
|
||||
"pipefail"
|
||||
];
|
||||
text = ''
|
||||
args=("$@")
|
||||
|
||||
if [[ -z "$USERDIR_USER" ]] && [[ "$USERDIR_USER" != "pvv" ]]; then
|
||||
# Prepend -fusername to the argument list, so bounces go to the user
|
||||
args=("-f$USERDIR_USER" "''${args[@]}")
|
||||
fi
|
||||
|
||||
exec '${lib.getExe pkgs.system-sendmail}' -t -i "''${args[@]}"
|
||||
'';
|
||||
};
|
||||
in lib.getExe sendmailWrapper;
|
||||
allowed-env = [ "USERDIR_USER" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = [
|
||||
(config.services.bro.instances.userweb-sendmail.client.package.overrideAttrs (prev: {
|
||||
buildCommand = prev.buildCommand + ''
|
||||
mv "$out/bin/sendmail" "$out/bin/bro-sendmail"
|
||||
'';
|
||||
}))
|
||||
];
|
||||
|
||||
users.users.nullmailer-user = {
|
||||
enable = true;
|
||||
isSystemUser = true;
|
||||
group = "nullmailer-user";
|
||||
};
|
||||
|
||||
users.groups.nullmailer-user = { };
|
||||
|
||||
systemd.services.bro-userweb-sendmail = {
|
||||
serviceConfig = {
|
||||
User = "nullmailer-user";
|
||||
Group = "nullmailer-user";
|
||||
|
||||
ReadWritePaths = [
|
||||
"/var/spool/nullmailer"
|
||||
];
|
||||
|
||||
AmbientCapabilities = "";
|
||||
CapabilityBoundingSet = "";
|
||||
NoNewPrivileges = false;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
PrivateTmp = true;
|
||||
PrivateDevices = true;
|
||||
PrivateUsers = false;
|
||||
ProtectHostname = true;
|
||||
ProtectClock = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectControlGroups = true;
|
||||
RestrictAddressFamilies = [
|
||||
"AF_UNIX"
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
"AF_NETLINK"
|
||||
];
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
PrivateMounts = true;
|
||||
ProcSubset = "pid";
|
||||
ProtectProc = "invisible";
|
||||
RemoveIPC = true;
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@resources"
|
||||
];
|
||||
UMask = "0077";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.httpd.serviceConfig = {
|
||||
BindPaths = [ (lib.head config.systemd.sockets.bro-userweb-sendmail.listenStreams) ];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -16,7 +16,7 @@ in {
|
||||
};
|
||||
|
||||
systemd.user.services.restart-greg-ng = {
|
||||
serviceConfig.ExecStart = "${lib.getExe' pkgs.systemd "systemctl"} --user restart greg-ng.service";
|
||||
script = "systemctl --user restart greg-ng.service";
|
||||
startAt = "*-*-* 06:30:00";
|
||||
};
|
||||
|
||||
|
||||
@@ -171,9 +171,6 @@ in
|
||||
requires = [ "matrix-ooye-pre-start.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
startLimitIntervalSec = 5;
|
||||
startLimitBurst = 5;
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = lib.getExe config.services.matrix-ooye.package;
|
||||
WorkingDirectory = "/var/lib/matrix-ooye";
|
||||
@@ -185,6 +182,8 @@ in
|
||||
#PrivateDevices = true;
|
||||
Restart = "on-failure";
|
||||
RestartSec = "5s";
|
||||
StartLimitIntervalSec = "5s";
|
||||
StartLimitBurst = "5";
|
||||
DynamicUser = true;
|
||||
};
|
||||
};
|
||||
|
||||
@@ -38,23 +38,18 @@ lib.mergeAttrsList [
|
||||
})
|
||||
(mw-ext {
|
||||
name = "CodeMirror";
|
||||
commit = "7ab826eff8c4097589a3199c40c507717af23234";
|
||||
hash = "sha256-kMIyGW9J4OSGSetByel7hEGgxPRJmQ53it6ndpYA/Hs=";
|
||||
commit = "f06dfd40a08562a841ddf11b4ae3444ef06c98c7";
|
||||
hash = "sha256-5zXkBjOwFdoQezkPRJ2AcBZLZEEpGG6FawO2K3KzllI=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "DeleteBatch";
|
||||
commit = "b5920283cfe78b86a63a1037a81651c58ce764da";
|
||||
hash = "sha256-LwuVX2s5Q4uc6o7hlTjFzRTwvSCwTk74gBpX0HoLDMA=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "PdfHandler";
|
||||
commit = "dc1a3ca04ac6ec7d7de7ce5355803510508a2575";
|
||||
hash = "sha256-ltAQZtfTMMLRPATA7rclSNW8Yz4ctGc30CxlL3SRBWU=";
|
||||
commit = "9bc75a753efefedfc88c598fb01f18a7e4b61f00";
|
||||
hash = "sha256-1xA758fsvoioN9xuq0hRqZKtPXMQViVLtuRINDtowdk=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "PluggableAuth";
|
||||
commit = "4b57a23e32d72bd3f74184ff2734aa483a5b0c63";
|
||||
hash = "sha256-ZGw0Wgz0Sg04YDcOzkOGywmfQ6s6Ex17QbjmUDO1D8c=";
|
||||
commit = "64133683b73d8eeea8069fe7ed9cb7237fd5c212";
|
||||
hash = "sha256-wqpfgVLenZp6XC510nrsrbvK1IMEPcWVYq5YuAOt5+c=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "Popups";
|
||||
@@ -63,38 +58,38 @@ lib.mergeAttrsList [
|
||||
})
|
||||
(mw-ext {
|
||||
name = "Scribunto";
|
||||
commit = "35c85c96167922adc98e62dd6573789d906dd7d7";
|
||||
hash = "sha256-FEWADJW53cDOlLseM62VL66PENv/jNnwuCMo2Pb02ek=";
|
||||
commit = "cbab0c740e03c8e6184fd647d95e24e0826d20cb";
|
||||
hash = "sha256-vXS3+wrUBVtPsETa19pMvud9sALGt4Ao9mM5rQRbBQc=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "SimpleSAMLphp";
|
||||
kebab-name = "simple-saml-php";
|
||||
commit = "70778bb02f972abbb51e6ba3e0f6545b00dcab00";
|
||||
hash = "sha256-wfmFJKy+ih84qFM9DVcCQFAZBx45s7Hl0lRnseMPhGY=";
|
||||
commit = "fc5ad4501434fe85198f0b1f0087d798efa91f9f";
|
||||
hash = "sha256-se0krTglo1fShJXj38bPLhw65tZC5P54Ywt7oeZrLes=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "TemplateData";
|
||||
commit = "cca3b3430067f2161bf65de822f70dd38fe07bba";
|
||||
hash = "sha256-OxLwiF8FlWizkpDF9GXYfjehKtrltX8ihiCE+fNJpgw=";
|
||||
commit = "d37b02f6ed194138ac7193a0782bbf6efb9164f8";
|
||||
hash = "sha256-NpzVBzX7qfXkIE+jh33ndooS9GE8ZF3/Jynm22in7IQ=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "TemplateStyles";
|
||||
commit = "101a159dd0190759a16551a86800144c18b6ff5c";
|
||||
hash = "sha256-IGQQVAx8/76ivHq9b97ec1AlFoqbRl7uhXhwoFimsG4=";
|
||||
commit = "f85614c26a0057a9f418342f89214a04c9de9988";
|
||||
hash = "sha256-XZOtM3iadjE5vavsjkx7kfJNhLZlnnFt1CN+mv6XVHQ=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "UserMerge";
|
||||
commit = "6c0d105e07538c34bfde989bd26fa1945f8d1b79";
|
||||
hash = "sha256-w058Ihk0I98hIG1tkVJGy1bzbv7XXyUksGexXgCN540=";
|
||||
commit = "2f2432c909a36691ca0002daf6fb304d6c182beb";
|
||||
hash = "sha256-ZP8Tp6u+uJxx3I39YGMmkP0sTnjAQUSaxImAJaRv+Ek=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "VisualEditor";
|
||||
commit = "8d8c6d7f179a5f799e1fa8cba207d81f58f722d2";
|
||||
hash = "sha256-wbYHXi2vD521EMzUl7ttinG4YdLv/DwYvVUew7dka0g=";
|
||||
commit = "1508d49d0dd71fdc1d18badd23671441b3bc327b";
|
||||
hash = "sha256-VNiCVNrCAImAr1tS9T28KPPzzNsKPz5ELFRIBtng+So=";
|
||||
})
|
||||
(mw-ext {
|
||||
name = "WikiEditor";
|
||||
commit = "f53000f0499858fe74e4f5008b2f5e467d9d9382";
|
||||
hash = "sha256-+HTXZEVCwMD8z6c1kCZA3k686HzNd30pJljzRvf+gMg=";
|
||||
commit = "aba5e7c6701877a6b43583709751658fec606d47";
|
||||
hash = "sha256-XmbQy0NXuY3oVGkkgC233kkzfBfx32HDylloGYXU/Nc=";
|
||||
})
|
||||
]
|
||||
|
||||
@@ -1,93 +0,0 @@
|
||||
httpd:
|
||||
passwd-ssh-key: ENC[AES256_GCM,data:fXfqlhNbAIdacm7s4yirp+XS7gWhsp4jrD5yRzsU8lP+oueqS8cCkQGV4MB83OKa/D3wm1zxvjRsys9uxa+4kKL2/xOetDex5WXH7xAjzMaE0jHRNCjJMYM44L9+n3oc2c6rXz2DZ+4TEdGfJOru3pUIZx2LVYO/NB+FXSW59632PFhkuSypmpeeXRFn13ksd27W5x9fB4lOw9nrdyQkfuqvl0pD9uC6zef/sZ12rfre1JHyhN+jiowzWjJuzA9iiJpjNcek2wTyymVYZNxngfugnCkTKtWcfl+BOTgyhpEtGmL3mLs3n9r6bD725IAuoXUSzBEJqE1dCw93AvlPyrUwOXLM5lOX4h9IYS/0Izfc4w+qC+ID02XU0/cFufT8ODfTK08xF5QAOp5AdLxbcvMq3KadVPesD/5K75mzWtfC+UM4lo8TfphqnEtetL/P0DBXIJIsyY04gyTWsUVCfjcwWcliW6p3pcZZ+rkqObFs9n06uMWQq8qULa85yLq+mMsyPlBW1HE+TIV8jrLtVBqPkfXp85ZtllMOJRpeEOf/l48=,iv:1BE0moa2a4k2yqVBboS/EbNiFGLTu4Df/tnXBassls4=,tag:iPUOAEhqKbF9umsyBLaoJg==,type:str]
|
||||
ssh-known-hosts: ENC[AES256_GCM,data:E2NiTUQokUDHzkfmTh5eECHZxt8v/Ug63ETA/CcO8358EpPeaFI1tAFt3q0o5rTCAUlB5cJ1ZOxX4mTeIH370wnwFN6emg+iAaK3VM+AL3Tp8Acb5EwErSOTKjAwrS5vwqb3oTYMzj42bKBk0b/qPWspGnoUfDI481+p99PS8eqpNCcGaNEDNk0BPwDvngwuur9o2RTmuWwxZO+s3wqlktQPkCguii8/FD3x3O8eow+v,iv:tJNxoY4UsRrB9k/fX9jLUc4hC3bioekpgKu4aa2o/4Q=,tag:DLj9rqse33D8PDLMxF/heQ==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrMStZRlNCem0zRWgvMytj
|
||||
b2tGR0M4SmF2Z1dYR2RBK1ZTUEx4c3NhMmlnCkVwcStqZ0RPRm1EK01lTWJpUmd2
|
||||
Qis2WlU2ZUpFcUVXZUdVaWVyQno4NFEKLS0tIGJZWmlSdEtaUnd1alZ6NURsSFY3
|
||||
VXJGank2UlBqY0hNZ1QvUGZUdVljaXMK9P4IVuSZ8uhDXDWMOkqABWImL4mu18AU
|
||||
7X+1t3nZVmPze3MOTBRWf483DBAM+69QDlio1uSzZjJQc1X0H6ePKQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age10avsdvqger25z0lyzlq8v7xfzcmypkmjsswswaxwqnpnl6x9wcjq0uv2n7
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJMGdHZ2xvdnVMbFAxYkhF
|
||||
WHRPWjg3OE4vU1RhTWxPc0cxNm1RU1BPem40CnRHc0gyQVNxelBnZERMNlp2YnFk
|
||||
U0xpbHN6RlVHZHdkZktnK0hCMFQ1aGcKLS0tIDVtODVvNzN0NFJ3UGFYdkpLTmZR
|
||||
R0FvdzE5NDhUNFpWZTYreklCMmhCWmcKuD5nNqDSP4SK3E1AsnZtE4jzYgxfgHau
|
||||
nmPKA2dgsPoA2rug/kGB9uXeUUA0oL26FyjlPi6NYDVvN4u1IHgPSw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3SUdGMUgwSEV2SUhkMEJm
|
||||
MWJ5Y1VMdWsyK1NWYmxUK3N1cHoydWp5eUVrCllZK3hKZjNDYzMwQTFENTg2aFFi
|
||||
dXpkWGZkT0hiWGRQdjltNXZ6ZkN2S1EKLS0tIFREeDFVZkZEV0phM3dRYUVRSSsx
|
||||
UVpkZ3hTd0JuWm16WnFFREt4S0hxMjAKbihmtr3/d/BbX21zkZWNarCNa4cYCM9B
|
||||
HGwcEfP4fnevWdM4LbXXBBmfoVUErKjK5tiMwocVZXZrsHBYI4amPA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3d3g2aHUrT0d5Kzl1RmVk
|
||||
MUh4eW8vTS9qbkZ3WHNYMjFHSlZLV2M1aVgwCllWTDFwZDV1QTFkQkVrUnN0bSto
|
||||
aTlvVTVaOWVldDJjSHMyaFhLNXlBcUEKLS0tIHZ6d0ZZWlo5SVJ3a0VNbjRFYnkz
|
||||
dDFFT1JVN2N1cjg2TW5xOUZKZDVzZkUKjtRmm87B4AECzS8mmL6rUyVfNYlsem1w
|
||||
HDFw4p0Nt9JWFFWEWamnTQ+Bq2UPsueBW4Ei/WyDj5d4EyNptoJrDQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2aWs5V0xhTzJlMi9PNks0
|
||||
ZUNiOFB5TDZQUVBnVThRQjdzYTJ0Uml1blJzCjhUdTdpRURsVlIrUkxnUXVhM3Vn
|
||||
cmJSL0x2Y29aMnltcWhiYmhLem1ldGsKLS0tIFpMa1lmZjZPQ0FvSUhTbUhzRlM5
|
||||
bHNqMm1xRGdMd2NOdVo0Y0xFLzJCbGcKnSMBn2kp/RGDr5NL+qMoWqqdCdSu4wFz
|
||||
GjjUS43nW0++TVXusGIj60sDJtK623N4srpubykZtYfEO1c1cAURpg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnU2d6bFRqMk5jZ3lDdzA5
|
||||
WFpsNVdLL2lXRGZ5ZjRIdGs5VjRVZ1JKdDJJCmxQeHZsZk9OQ1g4dG00MVNGeFF2
|
||||
OURQUndCOTM3eUh1SnRaOGFKMi80TjQKLS0tIEE2eE8vK1dnN0dnbGNqaWZqdzJx
|
||||
WGhRM2R0VzV1SlpxeGVWOXNCeWlzcVUK/nD3DWVDjVbWJmP33OC4LSKA3qrjN0hb
|
||||
kZV4U44y+8uLtBVm3WnkZd/cg5wqoD/1agG7aCc9DMmOmxHUfdfrJw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtczYrL3NrM295NEd4N3V0
|
||||
WndPRXltZFhOUU1LdGVNM05LRzV5blhmU1JRClBpU0g2K0FJbFE0RVEyVW1ZRTJU
|
||||
d2ZoeTM0QWx1NE9wSjc3c0tUa3Z3VlkKLS0tIEVrQStXSWRTUkJvK2paTU1EUkcy
|
||||
ZWtMdDRhTWdLZnI2T2ZmS2VXdjFpZVkK1LAo54bl2QIx08rMJ0A8Q5bVXWcaoFPo
|
||||
Y0/PSyL+vMa2Ab6b4vD6GNY5/KAE5XPlvBEKBrIe2oIAMJw38KUq8g==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
|
||||
lastmodified: "2026-05-29T13:54:14Z"
|
||||
mac: ENC[AES256_GCM,data:g1PT225ggTfHuzU9qaNfNrhIVqtTWRCSm7iFDTlCZTDr4PPGbRtUH5fIJSY1F+2mu+H2XRM9ueenhqTyyyDJGsq+Oqp6Ae4E7vp2Uo4qH8O2d/u78EL2zNVestTvCnJGJ5lPWrN2i41pqOWbNx+dXt0O+sdgS890IQkj4i8VrRU=,iv:CjBKRSCMpAT+gWEFjvqb5OBy5u6ZsDelsCg5lGNOsN0=,tag:k1ia0wkw3YQfeFdv0GTX6g==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-05-29T13:54:02Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA0av/duuklWYARAAq4qDoGJmeum8aPwO6TGOO+iIKNE3rqIdCsUsTs+SF3VL
|
||||
ejSW3yB9hw5ptg3CCUH0tZRuZyvQ3fkXFh08hSBfBhICSr9NS2vllXp4ILlhNG0P
|
||||
gEIq67+daK2YyWBcV3Rh8OMz5niGYDKF6WZjzlkFxinUFcqVtQrVKw9pti+Crhs9
|
||||
QgZbTz5+Cph/ACSLufSUV2yyjv+zO+VhyMpHR4x/B/el/T921vAQAdGx9DprC1ed
|
||||
cse2kg9ouhMQI+Aii5oSnDCAuVZGZQN23WXQBQp66l4gFmR3Av85miguEF5Gf8YW
|
||||
44GiixHyul5583NDsMQuoPu1gzE8CqUPMVFVGzp5BsXbb4HzmEslxkpi7obCs7wx
|
||||
fCplc2L+mLa4hTBJXYcCcRbsbopjDnYLNLfl4nvYHW5utimNej4EBdzQQg3DNf8J
|
||||
zdNXlwHXUBgU8ayAyOwThQIP4s+VDSh2ASSWwEmqNMr5nkocIl7UO3J9MzkLNuc1
|
||||
0S4b8rM9om755SlQTeLrOy/4aloZwCMFxQOeIoJ0fxNlgap1BS1FQ68leA+uiCcc
|
||||
vCFVMlYUOwMl2wqkQ84pY3SEL6z96o9wpOyRERk/yfjBWnGjqjANNz4uSXggo4B9
|
||||
LTLIqO+Li26+geyTATIMJU5SeMdP5s+Lvc2qzn0c4qr67hVo9H5Df2qzijsqIqrS
|
||||
XgHQdNafa0JYSH07UKFvfmcDYU/sWRi7QrFD3/zn5HPUN2XNQj4P9OF93NV8tAqK
|
||||
pFqgdJCybDSp4sQujjQOZkJ3tpVnlq/G/QjiAY2TpbYxzPUDWP0Pu0yGxVIrJ5Q=
|
||||
=atHd
|
||||
-----END PGP MESSAGE-----
|
||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.0
|
||||
+2
-2
@@ -55,11 +55,11 @@ in rec {
|
||||
};
|
||||
brzeczyszczykiewicz = {
|
||||
ipv4 = pvv-ipv4 205;
|
||||
ipv6 = pvv-ipv6 205;
|
||||
ipv6 = pvv-ipv6 "1:50"; # Wtf peder why
|
||||
};
|
||||
georg = {
|
||||
ipv4 = pvv-ipv4 204;
|
||||
ipv6 = pvv-ipv6 204;
|
||||
ipv6 = pvv-ipv6 "1:4f"; # Wtf øystein og daniel why
|
||||
};
|
||||
kommode = {
|
||||
ipv4 = pvv-ipv4 223;
|
||||
|
||||
Reference in New Issue
Block a user