54 Commits

Author	SHA1	Message	Date
oysteikt	aa2712005a	temmie/nfs-mounts: create by-uid bindmounts	2026-06-17 13:43:19 +09:00
oysteikt	89921b533b	temmie/userweb: further harden log-processor	2026-06-17 12:31:02 +09:00
oysteikt	75f87ffab8	temmie/userweb: run passwd sync in different unit	2026-06-17 12:15:23 +09:00
oysteikt	b910cf9563	temmie/userweb: suppress erroneous access log for documentRoot	2026-06-17 08:57:55 +09:00
oysteikt	d23adbd4c2	temmie/userweb: deny access to documentRoot	2026-06-17 08:49:44 +09:00
oysteikt	48c0a4e504	temmie/userweb: fix directory denylist enforcement	2026-06-17 08:23:08 +09:00
oysteikt	d84cc73819	temmie/userweb: handle more .php\d suffixes	2026-06-16 19:07:58 +09:00
oysteikt	b738f08c09	temmie/userweb: render path denylist into Directory/Files directives	2026-06-16 19:07:57 +09:00
oysteikt	8252bba3ad	temmie/userweb: enable httpd trace on debugMode	2026-06-16 19:07:57 +09:00
oysteikt	a776a5a5fe	temmie/userweb: explicitly override mod_perl and mod_userdir	2026-06-16 19:07:57 +09:00
oysteikt	ed57744ec3	temmie/userweb: add more patterns to denylist	2026-06-16 16:07:32 +09:00
oysteikt	226db1f46e	temmie/userweb: add more DirectoryIndex variants	2026-06-16 16:07:32 +09:00
oysteikt	51e1656177	temmie/userweb: disable ~pvv	2026-06-16 15:53:52 +09:00
oysteikt	47d2dcf9ff	temmie/userweb: add bro server to userweb slice	2026-06-16 03:37:28 +09:00
oysteikt	254b1d9b14	temmie/userweb: split into more modules	2026-06-16 03:33:28 +09:00
oysteikt	2301672a21	temmie/userweb: run log processors as separate systemd units ... This lets us divide up some of the logic making httpd itself less brittle, and also reduces the amount of privileges for httpd.	2026-06-16 02:56:28 +09:00
oysteikt	e80189c6eb	temmie/userweb: stop cating passwd on startup	2026-06-13 01:41:05 +09:00
oysteikt	56a51e4c6f	temmie/userweb: mount homedirs under /amd	2026-06-13 01:39:20 +09:00
oysteikt	f54109f6f3	temmie/userweb: set handlers for php and perl scripts	2026-06-13 01:26:27 +09:00
oysteikt	b848e0f1cc	temmie/userweb: add log processor for apache	2026-06-07 06:03:18 +09:00
oysteikt	c671329b93	temmie/userweb: inject users from passwd into httpd sandbox	2026-06-07 05:28:24 +09:00
oysteikt	18ab1ef982	temmie/userweb: set -i and -t in sendmail wrapper	2026-05-25 18:49:57 +09:00
oysteikt	5023edeb13	temmie/userweb: install mod_perl with custom env	2026-05-25 18:24:23 +09:00
oysteikt	0d8c26c548	temmie/userweb: send propagatedBuildInputs through perl env wrapper	2026-05-25 17:05:02 +09:00
oysteikt	bd244e7797	temmie/userweb: add www2 server alias	2026-05-25 16:24:35 +09:00
oysteikt	e9220bb31e	temmie/userweb: use www-datas UID + GID for backwards compat	2026-05-25 15:25:26 +09:00
oysteikt	6beb9c62c3	temmie/userweb: use bro to proxy sendmail requests out of sandbox	2026-05-25 15:02:40 +09:00
oysteikt	b98e8679e6	temmie/userweb: set same phpOptions for env and apache	2026-05-11 14:54:56 +09:00
oysteikt	ea092ec0b3	temmie/userweb: pass userdir user to sendmail through custom envvar	2026-05-11 14:26:47 +09:00
oysteikt	5e50b617fb	temmie/userweb: switch from postfix to nullmailer	2026-05-11 13:52:58 +09:00
oysteikt	258c5a7b25	temmie/userweb: set up sendmail wrapper	2026-05-11 12:26:39 +09:00
oysteikt	b9eda3dc56	temmie/userweb: reduce package list	2026-05-11 10:17:09 +09:00
oysteikt	b009da31af	temmie/userweb: deny a bunch of spooky directories by default ... It should still be possible for the user to re-enable these with `.htaccess`	2026-05-10 03:33:43 +09:00
oysteikt	e9a267e2a3	temmie/userweb: ignore collisions in fhs env	2026-05-10 03:02:27 +09:00
oysteikt	338c2f2531	temmie/userweb: adjust perl and php env ... This adds and removes a few packages to make the environments closer to how they are on tom	2026-05-10 03:02:26 +09:00
oysteikt	b712f3cda3	temmie/userweb: add a few more packages	2026-01-31 21:53:12 +09:00
oysteikt	cc272a724c	temmie/userweb: add directory index search path	2026-01-31 21:30:23 +09:00
oysteikt	fcaa97884e	temmie/userweb: add a bunch more normal packages	2026-01-31 21:20:26 +09:00
oysteikt	11f2cf504f	temmie/userweb: add a bunch more perl packages	2026-01-31 20:31:03 +09:00
oysteikt	7ab16bc949	temmie/userweb: restrict log access	2026-01-31 19:08:02 +09:00
oysteikt	c4d5cfde56	temmie/userweb: add legacy-cgi to the python package set	2026-01-31 18:53:44 +09:00
oysteikt	100d09f6b7	temmie/userweb: get first iteration working	2026-01-31 18:41:17 +09:00
oysteikt	3b0742bfac	temmie: combine homedirs in overlayfs	2026-01-31 18:41:17 +09:00
oysteikt	95f6463171	temmie: set up httpd	2026-01-22 19:41:52 +09:00
oysteikt	ba6c1c8205	temmie/nfs-mounts: generate systemd units ourselves	2026-01-22 19:10:30 +09:00
oysteikt	1d47409d96	base: configure sops	2026-01-22 16:48:59 +09:00
oysteikt	5f94345a91	hosts/various: enable qemu guest agent, disable smartd for vms by default	2026-01-22 16:05:36 +09:00
oysteikt	28baf322ce	hosts/various: formatting, add consistent warnings to stateVersion	2026-01-22 15:57:12 +09:00
oysteikt	12477aeb34	flake.nix: set default hostname for most nixos hosts	2026-01-22 15:49:50 +09:00
oysteikt	89ea5b321a	hosts/various: use systemd-boot as default bootloader	2026-01-22 15:49:50 +09:00