forked from Drift/pvv-nixos-config
Compare commits
37 Commits
configure-
...
main
|
|
@ -0,0 +1,13 @@
|
||||||
|
name: "Eval nix flake"
|
||||||
|
on:
|
||||||
|
pull_request:
|
||||||
|
push:
|
||||||
|
jobs:
|
||||||
|
evals:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v3
|
||||||
|
- run: apt-get update && apt-get -y install sudo
|
||||||
|
- uses: https://github.com/cachix/install-nix-action@v23
|
||||||
|
- run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
|
||||||
|
- run: nix flake check
|
||||||
10
README.MD
10
README.MD
|
|
@ -10,7 +10,13 @@ Etter å ha klonet prosjektet ned og gjort endringer kan du evaluere configene m
|
||||||
|
|
||||||
før du bygger en maskin med:
|
før du bygger en maskin med:
|
||||||
|
|
||||||
`nix build .#nixosConfigurations.<maskinavn>.config.system.build.toplevel`
|
`nix build .#<maskinnavn>`
|
||||||
|
|
||||||
|
hvis du vil være ekstra sikker på at alt bygger så kan du kjøre:
|
||||||
|
|
||||||
|
`nix build .` for å bygge alle de viktige maskinene.
|
||||||
|
|
||||||
|
NB: Dette kan ta opp til 30 minutter avhengig av hva som ligger i caches
|
||||||
|
|
||||||
Husk å hvertfall stage nye filer om du har laget dem!
|
Husk å hvertfall stage nye filer om du har laget dem!
|
||||||
|
|
||||||
|
|
@ -20,7 +26,7 @@ Det er sikkert lurt å lage en PR først om du ikke er vandt til nix enda.
|
||||||
Innen 24h skal alle systemene hente ned den nye konfigurasjonen og deploye den.
|
Innen 24h skal alle systemene hente ned den nye konfigurasjonen og deploye den.
|
||||||
|
|
||||||
Du kan tvinge en maskin til å oppdatere seg før dette ved å kjøre:
|
Du kan tvinge en maskin til å oppdatere seg før dette ved å kjøre:
|
||||||
`nixos-rebuild switch --update-input nixpkgs --update-input unstable --no-write-lock-file --refresh --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git --upgrade`
|
`nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git --upgrade`
|
||||||
|
|
||||||
som root på maskinen.
|
som root på maskinen.
|
||||||
|
|
||||||
|
|
|
||||||
5
base.nix
5
base.nix
|
|
@ -32,7 +32,7 @@
|
||||||
flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
|
flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
|
||||||
flags = [
|
flags = [
|
||||||
"--update-input" "nixpkgs"
|
"--update-input" "nixpkgs"
|
||||||
"--update-input" "unstable"
|
"--update-input" "nixpkgs-unstable"
|
||||||
"--no-write-lock-file"
|
"--no-write-lock-file"
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
@ -71,6 +71,9 @@
|
||||||
|
|
||||||
users.groups."drift".name = "drift";
|
users.groups."drift".name = "drift";
|
||||||
|
|
||||||
|
# Trusted users on the nix builder machines
|
||||||
|
users.groups."nix-builder-users".name = "nix-builder-users";
|
||||||
|
|
||||||
services.openssh = {
|
services.openssh = {
|
||||||
enable = true;
|
enable = true;
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
|
|
|
||||||
128
flake.lock
128
flake.lock
|
|
@ -1,37 +1,97 @@
|
||||||
{
|
{
|
||||||
"nodes": {
|
"nodes": {
|
||||||
|
"disko": {
|
||||||
|
"inputs": {
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1700927249,
|
||||||
|
"narHash": "sha256-iqmIWiEng890/ru7ZBf4nUezFPyRm2fjRTvuwwxqk2o=",
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "disko",
|
||||||
|
"rev": "3cb78c93e6a02f494aaf6aeb37481c27a2e2ee22",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "disko",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"grzegorz": {
|
||||||
|
"inputs": {
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixpkgs-unstable"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1696346665,
|
||||||
|
"narHash": "sha256-J6Tf6a/zhFZ8SereluHLrvgPsIVm2CGHHA8wrbhZB3Y=",
|
||||||
|
"owner": "Programvareverkstedet",
|
||||||
|
"repo": "grzegorz",
|
||||||
|
"rev": "9b9c3ac7d408ac7c6d67544b201e6b169afacb03",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "Programvareverkstedet",
|
||||||
|
"repo": "grzegorz",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"grzegorz-clients": {
|
||||||
|
"inputs": {
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1693864994,
|
||||||
|
"narHash": "sha256-oLDiWdCKDtEfeGzfAuDTq+n9VWp6JCo67PEESEZ3y8E=",
|
||||||
|
"owner": "Programvareverkstedet",
|
||||||
|
"repo": "grzegorz-clients",
|
||||||
|
"rev": "a38a0b0fb31ad0ad78a91458cb2c7f77f686468f",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "Programvareverkstedet",
|
||||||
|
"repo": "grzegorz-clients",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"matrix-next": {
|
"matrix-next": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs-lib": "nixpkgs-lib"
|
"nixpkgs-lib": "nixpkgs-lib"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1694383459,
|
"lastModified": 1697936579,
|
||||||
"narHash": "sha256-Y7VuBz74Go1QlvSLGXsXzPgOeeV73bbsDou3uXX9oa8=",
|
"narHash": "sha256-nMyepKnwoHMzu2OpXvG2ZhU081TV9ENmWCo0vWxs6AI=",
|
||||||
"owner": "dali99",
|
"owner": "dali99",
|
||||||
"repo": "nixos-matrix-modules",
|
"repo": "nixos-matrix-modules",
|
||||||
"rev": "66ff528912d95e6a2ee0aea6404a6b7e0d7fd83c",
|
"rev": "e09814657187c8ed1a5fe1646df6d8da1eb2dee9",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "dali99",
|
"owner": "dali99",
|
||||||
"repo": "nixos-matrix-modules",
|
"repo": "nixos-matrix-modules",
|
||||||
|
"rev": "e09814657187c8ed1a5fe1646df6d8da1eb2dee9",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs": {
|
"nixpkgs": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1694526311,
|
"lastModified": 1701362232,
|
||||||
"narHash": "sha256-Y9LCYQBNX7McW0o8x6wT9tx2qy9TVuF84fe62zrQzyA=",
|
"narHash": "sha256-GVdzxL0lhEadqs3hfRLuj+L1OJFGiL/L7gCcelgBlsw=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "36bee398beca22e2428074e0a2e068d87f801718",
|
"rev": "d2332963662edffacfddfad59ff4f709dde80ffe",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "NixOS",
|
"id": "nixpkgs",
|
||||||
"ref": "nixos-23.05-small",
|
"ref": "nixos-23.05-small",
|
||||||
"repo": "nixpkgs",
|
"type": "indirect"
|
||||||
"type": "github"
|
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs-lib": {
|
"nixpkgs-lib": {
|
||||||
|
|
@ -51,11 +111,11 @@
|
||||||
},
|
},
|
||||||
"nixpkgs-stable": {
|
"nixpkgs-stable": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1693675694,
|
"lastModified": 1700905716,
|
||||||
"narHash": "sha256-2pIOyQwGyy2FtFAUIb8YeKVmOCcPOTVphbAvmshudLE=",
|
"narHash": "sha256-w1vHn2MbGfdC+CrP3xLZ3scsI06N0iQLU7eTHIVEFGw=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "5601118d39ca9105f8e7b39d4c221d3388c0419d",
|
"rev": "dfb95385d21475da10b63da74ae96d89ab352431",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
@ -65,6 +125,21 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"nixpkgs-unstable": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1701368325,
|
||||||
|
"narHash": "sha256-3OqZyi2EdopJxpxwrySPyCTuCvfBY4oXTLVgQ4B6qDg=",
|
||||||
|
"owner": "NixOS",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"rev": "3934dbde4f4a0e266825348bc4ad1bdd00a8d6a3",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"id": "nixpkgs",
|
||||||
|
"ref": "nixos-unstable-small",
|
||||||
|
"type": "indirect"
|
||||||
|
}
|
||||||
|
},
|
||||||
"pvv-calendar-bot": {
|
"pvv-calendar-bot": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
|
|
@ -87,11 +162,14 @@
|
||||||
},
|
},
|
||||||
"root": {
|
"root": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
|
"disko": "disko",
|
||||||
|
"grzegorz": "grzegorz",
|
||||||
|
"grzegorz-clients": "grzegorz-clients",
|
||||||
"matrix-next": "matrix-next",
|
"matrix-next": "matrix-next",
|
||||||
"nixpkgs": "nixpkgs",
|
"nixpkgs": "nixpkgs",
|
||||||
|
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||||
"pvv-calendar-bot": "pvv-calendar-bot",
|
"pvv-calendar-bot": "pvv-calendar-bot",
|
||||||
"sops-nix": "sops-nix",
|
"sops-nix": "sops-nix"
|
||||||
"unstable": "unstable"
|
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"sops-nix": {
|
"sops-nix": {
|
||||||
|
|
@ -102,11 +180,11 @@
|
||||||
"nixpkgs-stable": "nixpkgs-stable"
|
"nixpkgs-stable": "nixpkgs-stable"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1694495315,
|
"lastModified": 1701127353,
|
||||||
"narHash": "sha256-sZEYXs9T1NVHZSSbMqBEtEm2PGa7dEDcx0ttQkArORc=",
|
"narHash": "sha256-qVNX0wOl0b7+I35aRu78xUphOyELh+mtUp1KBx89K1Q=",
|
||||||
"owner": "Mic92",
|
"owner": "Mic92",
|
||||||
"repo": "sops-nix",
|
"repo": "sops-nix",
|
||||||
"rev": "ea208e55f8742fdcc0986b256bdfa8986f5e4415",
|
"rev": "b1edbf5c0464b4cced90a3ba6f999e671f0af631",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
@ -114,22 +192,6 @@
|
||||||
"repo": "sops-nix",
|
"repo": "sops-nix",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
|
||||||
"unstable": {
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1694534540,
|
|
||||||
"narHash": "sha256-Cc0Ku0qJZDDx/0kII+0xD94L25EKw4EQzOLm0R9iZO4=",
|
|
||||||
"owner": "NixOS",
|
|
||||||
"repo": "nixpkgs",
|
|
||||||
"rev": "f22a472661d66c655eae5b0a01ada71e4e13e405",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "NixOS",
|
|
||||||
"ref": "nixos-unstable-small",
|
|
||||||
"repo": "nixpkgs",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"root": "root",
|
"root": "root",
|
||||||
|
|
|
||||||
85
flake.nix
85
flake.nix
|
|
@ -2,33 +2,51 @@
|
||||||
description = "PVV System flake";
|
description = "PVV System flake";
|
||||||
|
|
||||||
inputs = {
|
inputs = {
|
||||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.05-small";
|
nixpkgs.url = "nixpkgs/nixos-23.05-small";
|
||||||
unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
|
nixpkgs-unstable.url = "nixpkgs/nixos-unstable-small";
|
||||||
|
|
||||||
sops-nix.url = "github:Mic92/sops-nix";
|
sops-nix.url = "github:Mic92/sops-nix";
|
||||||
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
|
disko.url = "github:nix-community/disko";
|
||||||
|
disko.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
|
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
|
||||||
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
matrix-next.url = "github:dali99/nixos-matrix-modules";
|
# Last release compatible with 23.05
|
||||||
|
matrix-next.url = "github:dali99/nixos-matrix-modules/e09814657187c8ed1a5fe1646df6d8da1eb2dee9";
|
||||||
|
|
||||||
|
grzegorz.url = "github:Programvareverkstedet/grzegorz";
|
||||||
|
grzegorz.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||||
|
grzegorz-clients.url = "github:Programvareverkstedet/grzegorz-clients";
|
||||||
|
grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = { self, nixpkgs, matrix-next, pvv-calendar-bot, unstable, sops-nix, ... }@inputs:
|
outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
|
||||||
let
|
let
|
||||||
|
nixlib = nixpkgs.lib;
|
||||||
systems = [
|
systems = [
|
||||||
"x86_64-linux"
|
"x86_64-linux"
|
||||||
"aarch64-linux"
|
"aarch64-linux"
|
||||||
"aarch64-darwin"
|
"aarch64-darwin"
|
||||||
];
|
];
|
||||||
forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f system);
|
forAllSystems = f: nixlib.genAttrs systems (system: f system);
|
||||||
|
allMachines = nixlib.mapAttrsToList (name: _: name) self.nixosConfigurations;
|
||||||
|
importantMachines = [
|
||||||
|
"bekkalokk"
|
||||||
|
"bicep"
|
||||||
|
"brzeczyszczykiewicz"
|
||||||
|
"georg"
|
||||||
|
"ildkule"
|
||||||
|
];
|
||||||
in {
|
in {
|
||||||
nixosConfigurations = let
|
nixosConfigurations = let
|
||||||
nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
|
nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
|
||||||
rec {
|
rec {
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
specialArgs = {
|
specialArgs = {
|
||||||
inherit unstable inputs;
|
inherit nixpkgs-unstable inputs;
|
||||||
values = import ./values.nix;
|
values = import ./values.nix;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -43,7 +61,7 @@
|
||||||
(final: prev: {
|
(final: prev: {
|
||||||
mx-puppet-discord = prev.mx-puppet-discord.override { nodejs_14 = final.nodejs_18; };
|
mx-puppet-discord = prev.mx-puppet-discord.override { nodejs_14 = final.nodejs_18; };
|
||||||
})
|
})
|
||||||
pvv-calendar-bot.overlays.${system}.default
|
inputs.pvv-calendar-bot.overlays.${system}.default
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
@ -51,25 +69,72 @@
|
||||||
);
|
);
|
||||||
|
|
||||||
stableNixosConfig = nixosConfig nixpkgs;
|
stableNixosConfig = nixosConfig nixpkgs;
|
||||||
unstableNixosConfig = nixosConfig unstable;
|
unstableNixosConfig = nixosConfig nixpkgs-unstable;
|
||||||
in {
|
in {
|
||||||
bicep = stableNixosConfig "bicep" {
|
bicep = stableNixosConfig "bicep" {
|
||||||
modules = [
|
modules = [
|
||||||
./hosts/bicep/configuration.nix
|
./hosts/bicep/configuration.nix
|
||||||
sops-nix.nixosModules.sops
|
sops-nix.nixosModules.sops
|
||||||
|
|
||||||
matrix-next.nixosModules.synapse
|
inputs.matrix-next.nixosModules.default
|
||||||
pvv-calendar-bot.nixosModules.default
|
inputs.pvv-calendar-bot.nixosModules.default
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
bekkalokk = stableNixosConfig "bekkalokk" { };
|
bekkalokk = stableNixosConfig "bekkalokk" { };
|
||||||
|
bob = stableNixosConfig "bob" {
|
||||||
|
modules = [
|
||||||
|
./hosts/bob/configuration.nix
|
||||||
|
sops-nix.nixosModules.sops
|
||||||
|
|
||||||
|
disko.nixosModules.disko
|
||||||
|
{ disko.devices.disk.disk1.device = "/dev/vda"; }
|
||||||
|
];
|
||||||
|
};
|
||||||
ildkule = stableNixosConfig "ildkule" { };
|
ildkule = stableNixosConfig "ildkule" { };
|
||||||
#ildkule-unstable = unstableNixosConfig "ildkule" { };
|
#ildkule-unstable = unstableNixosConfig "ildkule" { };
|
||||||
shark = stableNixosConfig "shark" { };
|
shark = stableNixosConfig "shark" { };
|
||||||
|
|
||||||
|
brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
|
||||||
|
modules = [
|
||||||
|
./hosts/brzeczyszczykiewicz/configuration.nix
|
||||||
|
sops-nix.nixosModules.sops
|
||||||
|
|
||||||
|
inputs.grzegorz.nixosModules.grzegorz-kiosk
|
||||||
|
inputs.grzegorz-clients.nixosModules.grzegorz-webui
|
||||||
|
];
|
||||||
|
};
|
||||||
|
georg = stableNixosConfig "georg" {
|
||||||
|
modules = [
|
||||||
|
./hosts/georg/configuration.nix
|
||||||
|
sops-nix.nixosModules.sops
|
||||||
|
|
||||||
|
inputs.grzegorz.nixosModules.grzegorz-kiosk
|
||||||
|
inputs.grzegorz-clients.nixosModules.grzegorz-webui
|
||||||
|
];
|
||||||
|
};
|
||||||
|
buskerud = stableNixosConfig "buskerud" {
|
||||||
|
modules = [
|
||||||
|
./hosts/buskerud/configuration.nix
|
||||||
|
sops-nix.nixosModules.sops
|
||||||
|
];
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
devShells = forAllSystems (system: {
|
devShells = forAllSystems (system: {
|
||||||
default = nixpkgs.legacyPackages.${system}.callPackage ./shell.nix { };
|
default = nixpkgs.legacyPackages.${system}.callPackage ./shell.nix { };
|
||||||
});
|
});
|
||||||
|
|
||||||
|
packages = {
|
||||||
|
"x86_64-linux" = let
|
||||||
|
pkgs = nixpkgs.legacyPackages."x86_64-linux";
|
||||||
|
in rec {
|
||||||
|
default = important-machines;
|
||||||
|
important-machines = pkgs.linkFarm "important-machines"
|
||||||
|
(nixlib.getAttrs importantMachines self.packages.x86_64-linux);
|
||||||
|
all-machines = pkgs.linkFarm "all-machines"
|
||||||
|
(nixlib.getAttrs allMachines self.packages.x86_64-linux);
|
||||||
|
} // nixlib.genAttrs allMachines
|
||||||
|
(machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
|
||||||
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -10,8 +10,9 @@
|
||||||
|
|
||||||
# TODO: set up authentication for the following:
|
# TODO: set up authentication for the following:
|
||||||
# ./services/website.nix
|
# ./services/website.nix
|
||||||
./services/nginx.nix
|
./services/nginx
|
||||||
./services/gitea/default.nix
|
./services/gitea/default.nix
|
||||||
|
./services/webmail
|
||||||
# ./services/mediawiki.nix
|
# ./services/mediawiki.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -84,9 +84,9 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.timers.gitea-import-users = {
|
systemd.timers.gitea-import-users = {
|
||||||
enable = true;
|
|
||||||
requires = [ "gitea.service" ];
|
requires = [ "gitea.service" ];
|
||||||
after = [ "gitea.service" ];
|
after = [ "gitea.service" ];
|
||||||
|
wantedBy = [ "timers.target" ];
|
||||||
timerConfig = {
|
timerConfig = {
|
||||||
OnCalendar = "*-*-* 02:00:00";
|
OnCalendar = "*-*-* 02:00:00";
|
||||||
Persistent = true;
|
Persistent = true;
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,9 @@
|
||||||
{ pkgs, config, ... }:
|
{ pkgs, config, ... }:
|
||||||
{
|
{
|
||||||
|
imports = [
|
||||||
|
./ingress.nix
|
||||||
|
];
|
||||||
|
|
||||||
security.acme = {
|
security.acme = {
|
||||||
acceptTerms = true;
|
acceptTerms = true;
|
||||||
defaults.email = "drift@pvv.ntnu.no";
|
defaults.email = "drift@pvv.ntnu.no";
|
||||||
|
|
@ -0,0 +1,55 @@
|
||||||
|
{ config, lib, ... }:
|
||||||
|
{
|
||||||
|
services.nginx.virtualHosts = {
|
||||||
|
"www2.pvv.ntnu.no" = {
|
||||||
|
serverAliases = [ "www2.pvv.org" "pvv.ntnu.no" "pvv.org" ];
|
||||||
|
addSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
|
||||||
|
locations = {
|
||||||
|
# Proxy home directories
|
||||||
|
"/~" = {
|
||||||
|
extraConfig = ''
|
||||||
|
proxy_redirect off;
|
||||||
|
proxy_pass https://tom.pvv.ntnu.no;
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
# Redirect old wiki entries
|
||||||
|
"/disk".return = "301 https://www.pvv.ntnu.no/pvv/Diskkjøp";
|
||||||
|
"/dok/boker.php".return = "301 https://www.pvv.ntnu.no/pvv/Bokhyllen";
|
||||||
|
"/styret/lover/".return = "301 https://www.pvv.ntnu.no/pvv/Lover";
|
||||||
|
"/styret/".return = "301 https://www.pvv.ntnu.no/pvv/Styret";
|
||||||
|
"/info/".return = "301 https://www.pvv.ntnu.no/pvv/";
|
||||||
|
"/info/maskinpark/".return = "301 https://www.pvv.ntnu.no/pvv/Maskiner";
|
||||||
|
"/medlemssider/meldinn.php".return = "301 https://www.pvv.ntnu.no/pvv/Medlemskontingent";
|
||||||
|
"/diverse/medlems-sider.php".return = "301 https://www.pvv.ntnu.no/pvv/Medlemssider";
|
||||||
|
"/cert/".return = "301 https://www.pvv.ntnu.no/pvv/CERT";
|
||||||
|
"/drift".return = "301 https://www.pvv.ntnu.no/pvv/Drift";
|
||||||
|
"/diverse/abuse.php".return = "301 https://www.pvv.ntnu.no/pvv/CERT/Abuse";
|
||||||
|
"/nerds/".return = "301 https://www.pvv.ntnu.no/pvv/Nerdepizza";
|
||||||
|
|
||||||
|
# TODO: Redirect webmail
|
||||||
|
"/webmail".return = "301 https://webmail.pvv.ntnu.no/squirrelmail";
|
||||||
|
|
||||||
|
# Redirect everything else to the main website
|
||||||
|
"/".return = "301 https://www.pvv.ntnu.no$request_uri";
|
||||||
|
|
||||||
|
# Proxy the matrix well-known files
|
||||||
|
# Host has be set before proxy_pass
|
||||||
|
# The header must be set so nginx on the other side routes it to the right place
|
||||||
|
"/.well-known/matrix/" = {
|
||||||
|
extraConfig = ''
|
||||||
|
proxy_set_header Host matrix.pvv.ntnu.no;
|
||||||
|
proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
|
@ -0,0 +1,15 @@
|
||||||
|
{ config, values, pkgs, lib, ... }:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./roundcube.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."webmail2.pvv.ntnu.no" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
#locations."/" = lib.mkForce { };
|
||||||
|
locations."= /" = {
|
||||||
|
return = "301 https://www.pvv.ntnu.no/mail/";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,74 @@
|
||||||
|
{ config, pkgs, lib, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
let
|
||||||
|
cfg = config.services.roundcube;
|
||||||
|
domain = "webmail2.pvv.ntnu.no";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
services.roundcube = {
|
||||||
|
enable = true;
|
||||||
|
|
||||||
|
package = pkgs.roundcube.withPlugins (plugins: with plugins; [
|
||||||
|
persistent_login
|
||||||
|
thunderbird_labels
|
||||||
|
contextmenu
|
||||||
|
custom_from
|
||||||
|
]);
|
||||||
|
|
||||||
|
dicts = with pkgs.aspellDicts; [ en en-science en-computers nb nn fr de it ];
|
||||||
|
maxAttachmentSize = 20;
|
||||||
|
hostName = "roundcubeplaceholder.example.com";
|
||||||
|
|
||||||
|
extraConfig = ''
|
||||||
|
$config['enable_installer'] = false;
|
||||||
|
$config['default_host'] = "ssl://imap.pvv.ntnu.no";
|
||||||
|
$config['default_port'] = 993;
|
||||||
|
$config['smtp_server'] = "ssl://smtp.pvv.ntnu.no";
|
||||||
|
$config['smtp_port'] = 465;
|
||||||
|
$config['mail_domain'] = "pvv.ntnu.no";
|
||||||
|
$config['smtp_user'] = "%u";
|
||||||
|
$config['support_url'] = "";
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."roundcubeplaceholder.example.com" = lib.mkForce { };
|
||||||
|
|
||||||
|
services.nginx.virtualHosts.${domain} = {
|
||||||
|
locations."/roundcube" = {
|
||||||
|
tryFiles = "$uri $uri/ =404";
|
||||||
|
index = "index.php";
|
||||||
|
root = pkgs.runCommandLocal "roundcube-dir" { } ''
|
||||||
|
mkdir -p $out
|
||||||
|
ln -s ${cfg.package} $out/roundcube
|
||||||
|
'';
|
||||||
|
extraConfig = ''
|
||||||
|
location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
|
||||||
|
# https://wiki.archlinux.org/title/Roundcube
|
||||||
|
"README"
|
||||||
|
"INSTALL"
|
||||||
|
"LICENSE"
|
||||||
|
"CHANGELOG"
|
||||||
|
"UPGRADING"
|
||||||
|
"bin"
|
||||||
|
"SQL"
|
||||||
|
".+\\.md"
|
||||||
|
"\\."
|
||||||
|
"config"
|
||||||
|
"temp"
|
||||||
|
"logs"
|
||||||
|
]})/? {
|
||||||
|
deny all;
|
||||||
|
}
|
||||||
|
|
||||||
|
location ~ ^/roundcube/(.+\.php)(/?.*)$ {
|
||||||
|
fastcgi_split_path_info ^/roundcube(/.+\.php)(/.+)$;
|
||||||
|
include ${config.services.nginx.package}/conf/fastcgi_params;
|
||||||
|
include ${config.services.nginx.package}/conf/fastcgi.conf;
|
||||||
|
fastcgi_index index.php;
|
||||||
|
fastcgi_pass unix:${config.services.phpfpm.pools.roundcube.socket};
|
||||||
|
}
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,17 @@
|
||||||
|
{ lib, buildPythonPackage, fetchFromGitHub }:
|
||||||
|
|
||||||
|
buildPythonPackage rec {
|
||||||
|
pname = "matrix-synapse-smtp-auth";
|
||||||
|
version = "0.1.0";
|
||||||
|
|
||||||
|
src = ./.;
|
||||||
|
|
||||||
|
doCheck = false;
|
||||||
|
|
||||||
|
meta = with lib; {
|
||||||
|
description = "An SMTP auth provider for Synapse";
|
||||||
|
homepage = "pvv.ntnu.no";
|
||||||
|
license = licenses.agpl3Only;
|
||||||
|
maintainers = with maintainers; [ dandellion ];
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
from setuptools import setup
|
||||||
|
|
||||||
|
setup(
|
||||||
|
name="matrix-synapse-smtp-auth",
|
||||||
|
version="0.1.0",
|
||||||
|
py_modules=['smtp_auth_provider'],
|
||||||
|
author="Daniel Løvbrøtte Olsen",
|
||||||
|
author_email="danio@pvv.ntnu.no",
|
||||||
|
description="An SMTP auth provider for Synapse",
|
||||||
|
license="AGPL-3.0-only"
|
||||||
|
)
|
||||||
|
|
@ -0,0 +1,50 @@
|
||||||
|
from typing import Awaitable, Callable, Optional, Tuple
|
||||||
|
|
||||||
|
from smtplib import SMTP_SSL as SMTP
|
||||||
|
|
||||||
|
import synapse
|
||||||
|
from synapse import module_api
|
||||||
|
|
||||||
|
import re
|
||||||
|
|
||||||
|
class SMTPAuthProvider:
|
||||||
|
def __init__(self, config: dict, api: module_api):
|
||||||
|
self.api = api
|
||||||
|
|
||||||
|
self.config = config
|
||||||
|
|
||||||
|
api.register_password_auth_provider_callbacks(
|
||||||
|
auth_checkers={
|
||||||
|
("m.login.password", ("password",)): self.check_pass,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
|
||||||
|
async def check_pass(
|
||||||
|
self,
|
||||||
|
username: str,
|
||||||
|
login_type: str,
|
||||||
|
login_dict: "synapse.module_api.JsonDict",
|
||||||
|
):
|
||||||
|
if login_type != "m.login.password":
|
||||||
|
return None
|
||||||
|
|
||||||
|
# Convert `@username:server` to `username`
|
||||||
|
match = re.match(r'^@([\da-z\-\.=_\/\+]+):[\w\d\.:\[\]]+$', username)
|
||||||
|
username = match.group(1) if match else username
|
||||||
|
|
||||||
|
result = False
|
||||||
|
with SMTP(self.config["smtp_host"]) as smtp:
|
||||||
|
password = login_dict.get("password")
|
||||||
|
try:
|
||||||
|
smtp.login(username, password)
|
||||||
|
result = True
|
||||||
|
except:
|
||||||
|
return None
|
||||||
|
|
||||||
|
if result == True:
|
||||||
|
userid = self.api.get_qualified_user_id(username)
|
||||||
|
if not self.api.check_user_exists(userid):
|
||||||
|
self.api.register_user(username)
|
||||||
|
return (userid, None)
|
||||||
|
else:
|
||||||
|
return None
|
||||||
|
|
@ -22,9 +22,18 @@ in {
|
||||||
group = config.users.users.matrix-synapse.group;
|
group = config.users.users.matrix-synapse.group;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
sops.secrets."matrix/sliding-sync/env" = {
|
||||||
|
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||||
|
key = "sliding-sync/env";
|
||||||
|
};
|
||||||
|
|
||||||
services.matrix-synapse-next = {
|
services.matrix-synapse-next = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
|
plugins = [
|
||||||
|
(pkgs.python3Packages.callPackage ./smtp-authenticator { })
|
||||||
|
];
|
||||||
|
|
||||||
dataDir = "/data/synapse";
|
dataDir = "/data/synapse";
|
||||||
|
|
||||||
workers.federationSenders = 2;
|
workers.federationSenders = 2;
|
||||||
|
|
@ -34,6 +43,8 @@ in {
|
||||||
workers.eventPersisters = 2;
|
workers.eventPersisters = 2;
|
||||||
workers.useUserDirectoryWorker = true;
|
workers.useUserDirectoryWorker = true;
|
||||||
|
|
||||||
|
enableSlidingSync = true;
|
||||||
|
|
||||||
enableNginx = true;
|
enableNginx = true;
|
||||||
|
|
||||||
settings = {
|
settings = {
|
||||||
|
|
@ -81,7 +92,15 @@ in {
|
||||||
enable_registration = false;
|
enable_registration = false;
|
||||||
registration_shared_secret_path = config.sops.secrets."matrix/synapse/user_registration".path;
|
registration_shared_secret_path = config.sops.secrets."matrix/synapse/user_registration".path;
|
||||||
|
|
||||||
password_config.enabled = lib.mkForce false;
|
password_config.enabled = true;
|
||||||
|
|
||||||
|
modules = [
|
||||||
|
{ module = "smtp_auth_provider.SMTPAuthProvider";
|
||||||
|
config = {
|
||||||
|
smtp_host = "smtp.pvv.ntnu.no";
|
||||||
|
};
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
trusted_key_servers = [
|
trusted_key_servers = [
|
||||||
{ server_name = "matrix.org"; }
|
{ server_name = "matrix.org"; }
|
||||||
|
|
@ -192,9 +211,24 @@ in {
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
services.matrix-synapse.sliding-sync.environmentFile = config.sops.secrets."matrix/sliding-sync/env".path;
|
||||||
|
|
||||||
|
|
||||||
services.redis.servers."".enable = true;
|
services.redis.servers."".enable = true;
|
||||||
|
|
||||||
services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [({
|
services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
|
||||||
|
({
|
||||||
|
locations."/.well-known/matrix/server" = {
|
||||||
|
return = ''
|
||||||
|
200 '{"m.server": "matrix.pvv.ntnu.no:443"}'
|
||||||
|
'';
|
||||||
|
extraConfig = ''
|
||||||
|
default_type application/json;
|
||||||
|
add_header Access-Control-Allow-Origin *;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
})
|
||||||
|
({
|
||||||
locations = let
|
locations = let
|
||||||
connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
|
connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
|
||||||
socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString (c.port)}";
|
socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString (c.port)}";
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,46 @@
|
||||||
|
{ config, pkgs, values, ... }:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
# Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
../../base.nix
|
||||||
|
../../misc/metrics-exporters.nix
|
||||||
|
./disks.nix
|
||||||
|
|
||||||
|
../../misc/builder.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
sops.defaultSopsFile = ../../secrets/bob/bob.yaml;
|
||||||
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||||
|
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||||
|
sops.age.generateKey = true;
|
||||||
|
|
||||||
|
boot.loader.grub = {
|
||||||
|
enable = true;
|
||||||
|
efiSupport = true;
|
||||||
|
efiInstallAsRemovable = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.hostName = "bob"; # Define your hostname.
|
||||||
|
|
||||||
|
systemd.network.networks."30-all" = values.defaultNetworkConfig // {
|
||||||
|
matchConfig.Name = "en*";
|
||||||
|
DHCP = "yes";
|
||||||
|
gateway = [ ];
|
||||||
|
};
|
||||||
|
|
||||||
|
# List packages installed in system profile
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
];
|
||||||
|
|
||||||
|
# List services that you want to enable:
|
||||||
|
|
||||||
|
# This value determines the NixOS release from which the default
|
||||||
|
# settings for stateful data, like file locations and database versions
|
||||||
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
# this value at the release version of the first install of this system.
|
||||||
|
# Before changing this value read the documentation for this option
|
||||||
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
|
system.stateVersion = "23.05"; # Did you read the comment?
|
||||||
|
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,39 @@
|
||||||
|
# Example to create a bios compatible gpt partition
|
||||||
|
{ lib, ... }:
|
||||||
|
{
|
||||||
|
disko.devices = {
|
||||||
|
disk.disk1 = {
|
||||||
|
device = lib.mkDefault "/dev/sda";
|
||||||
|
type = "disk";
|
||||||
|
content = {
|
||||||
|
type = "gpt";
|
||||||
|
partitions = {
|
||||||
|
boot = {
|
||||||
|
name = "boot";
|
||||||
|
size = "1M";
|
||||||
|
type = "EF02";
|
||||||
|
};
|
||||||
|
esp = {
|
||||||
|
name = "ESP";
|
||||||
|
size = "500M";
|
||||||
|
type = "EF00";
|
||||||
|
content = {
|
||||||
|
type = "filesystem";
|
||||||
|
format = "vfat";
|
||||||
|
mountpoint = "/boot";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
root = {
|
||||||
|
name = "root";
|
||||||
|
size = "100%";
|
||||||
|
content = {
|
||||||
|
type = "filesystem";
|
||||||
|
format = "ext4";
|
||||||
|
mountpoint = "/";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,24 @@
|
||||||
|
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||||
|
# and may be overwritten by future invocations. Please make changes
|
||||||
|
# to /etc/nixos/configuration.nix instead.
|
||||||
|
{ config, lib, pkgs, modulesPath, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_blk" ];
|
||||||
|
boot.initrd.kernelModules = [ ];
|
||||||
|
boot.kernelModules = [ ];
|
||||||
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
|
networking.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.ens3.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,36 @@
|
||||||
|
{ config, pkgs, values, ... }:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
# Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
../../base.nix
|
||||||
|
../../misc/metrics-exporters.nix
|
||||||
|
|
||||||
|
./services/grzegorz.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.loader.systemd-boot.enable = true;
|
||||||
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
|
||||||
|
networking.hostName = "brzeczyszczykiewicz";
|
||||||
|
|
||||||
|
systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
|
||||||
|
matchConfig.Name = "eno1";
|
||||||
|
address = with values.hosts.brzeczyszczykiewicz; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||||
|
};
|
||||||
|
|
||||||
|
# List packages installed in system profile
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
];
|
||||||
|
|
||||||
|
# List services that you want to enable:
|
||||||
|
|
||||||
|
# This value determines the NixOS release from which the default
|
||||||
|
# settings for stateful data, like file locations and database versions
|
||||||
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
# this value at the release version of the first install of this system.
|
||||||
|
# Before changing this value read the documentation for this option
|
||||||
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
|
system.stateVersion = "23.05"; # Did you read the comment?
|
||||||
|
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,39 @@
|
||||||
|
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||||
|
# and may be overwritten by future invocations. Please make changes
|
||||||
|
# to /etc/nixos/configuration.nix instead.
|
||||||
|
{ config, lib, pkgs, modulesPath, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
|
||||||
|
boot.initrd.kernelModules = [ ];
|
||||||
|
boot.kernelModules = [ "kvm-intel" ];
|
||||||
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
|
fileSystems."/" =
|
||||||
|
{ device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
|
||||||
|
fsType = "ext4";
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems."/boot" =
|
||||||
|
{ device = "/dev/disk/by-uuid/82E3-3D03";
|
||||||
|
fsType = "vfat";
|
||||||
|
};
|
||||||
|
|
||||||
|
swapDevices =
|
||||||
|
[ { device = "/dev/disk/by-uuid/d0bf9a21-44bc-44a3-ae55-8f0971875883"; }
|
||||||
|
];
|
||||||
|
|
||||||
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
|
networking.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
{ config, ... }:
|
||||||
|
{
|
||||||
|
imports = [ ../../../modules/grzegorz.nix ];
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."${config.networking.fqdn}" = {
|
||||||
|
serverAliases = [
|
||||||
|
"bokhylle.pvv.ntnu.no"
|
||||||
|
"bokhylle.pvv.org"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,50 @@
|
||||||
|
{ config, pkgs, values, ... }:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
# Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
../../base.nix
|
||||||
|
../../misc/metrics-exporters.nix
|
||||||
|
|
||||||
|
./services/openvpn-client.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
# buskerud does not support efi?
|
||||||
|
# boot.loader.systemd-boot.enable = true;
|
||||||
|
# boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
boot.loader.grub.enable = true;
|
||||||
|
boot.loader.grub.device = "/dev/sda";
|
||||||
|
|
||||||
|
networking.hostName = "buskerud";
|
||||||
|
networking.search = [ "pvv.ntnu.no" "pvv.org" ];
|
||||||
|
networking.nameservers = [ "129.241.0.200" "129.241.0.201" ];
|
||||||
|
networking.tempAddresses = "disabled";
|
||||||
|
|
||||||
|
systemd.network.networks."enp3s0f0" = values.defaultNetworkConfig // {
|
||||||
|
matchConfig.Name = "enp3s0f0";
|
||||||
|
address = with values.hosts.buskerud; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||||
|
};
|
||||||
|
|
||||||
|
# Buskerud should use the default gateway received from DHCP
|
||||||
|
networking.interfaces.enp14s0f1.useDHCP = true;
|
||||||
|
|
||||||
|
# networking.interfaces.tun = {
|
||||||
|
# virtual = true;
|
||||||
|
# ipv4.adresses = [ {address="129.241.210.252"; prefixLength=25; } ];
|
||||||
|
# };
|
||||||
|
|
||||||
|
# List packages installed in system profile
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
];
|
||||||
|
|
||||||
|
# List services that you want to enable:
|
||||||
|
|
||||||
|
# This value determines the NixOS release from which the default
|
||||||
|
# settings for stateful data, like file locations and database versions
|
||||||
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
# this value at the release version of the first install of this system.
|
||||||
|
# Before changing this value read the documentation for this option
|
||||||
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
|
system.stateVersion = "23.05"; # Did you read the comment?
|
||||||
|
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,37 @@
|
||||||
|
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||||
|
# and may be overwritten by future invocations. Please make changes
|
||||||
|
# to /etc/nixos/configuration.nix instead.
|
||||||
|
{ config, lib, pkgs, modulesPath, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ata_piix" "hpsa" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
|
||||||
|
boot.initrd.kernelModules = [ ];
|
||||||
|
boot.kernelModules = [ "kvm-intel" ];
|
||||||
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
|
fileSystems."/" =
|
||||||
|
{ device = "/dev/disk/by-uuid/ed9654fe-575a-4fb3-b6ff-1b059479acff";
|
||||||
|
fsType = "ext4";
|
||||||
|
};
|
||||||
|
|
||||||
|
swapDevices = [ ];
|
||||||
|
|
||||||
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
|
networking.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp14s0f0.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp14s0f1.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp3s0f0.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp3s0f1.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp4s0f0.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp4s0f1.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,109 @@
|
||||||
|
{ lib, values, ... }:
|
||||||
|
{
|
||||||
|
services.openvpn.servers."ov-tunnel" = {
|
||||||
|
config = let
|
||||||
|
conf = {
|
||||||
|
# TODO: use aliases
|
||||||
|
client = true;
|
||||||
|
dev = "tap";
|
||||||
|
proto = "udp";
|
||||||
|
#remote = "129.241.210.253 1194";
|
||||||
|
remote = "129.241.210.191 1194";
|
||||||
|
|
||||||
|
resolv-retry = "infinite";
|
||||||
|
nobind = true;
|
||||||
|
|
||||||
|
ca = "/etc/openvpn/ca.pem";
|
||||||
|
cert = "/etc/openvpn/crt.pem";
|
||||||
|
key = "/etc/openvpn/key.pem";
|
||||||
|
remote-cert-tls = "server";
|
||||||
|
cipher = "none";
|
||||||
|
|
||||||
|
user = "nobody";
|
||||||
|
group = "nobody";
|
||||||
|
|
||||||
|
status = "/var/log/openvpn-status.log";
|
||||||
|
|
||||||
|
persist-key = true;
|
||||||
|
persist-tun = true;
|
||||||
|
|
||||||
|
verb = 5;
|
||||||
|
|
||||||
|
# script-security = 2;
|
||||||
|
# up = "systemctl restart rwhod";
|
||||||
|
};
|
||||||
|
in lib.pipe conf [
|
||||||
|
(lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
|
||||||
|
(builtins.mapAttrs (_: value:
|
||||||
|
if builtins.isList value then builtins.concatStringsSep " " (map toString value)
|
||||||
|
else if value == true then value
|
||||||
|
else if builtins.any (f: f value) [
|
||||||
|
builtins.isString
|
||||||
|
builtins.isInt
|
||||||
|
builtins.isFloat
|
||||||
|
lib.isPath
|
||||||
|
lib.isDerivation
|
||||||
|
] then toString value
|
||||||
|
else throw "Unknown value in buskerud openvpn config, deading now\n${value}"
|
||||||
|
))
|
||||||
|
(lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
|
||||||
|
(builtins.concatStringsSep "\n")
|
||||||
|
(x: x + "\n\n")
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.networks."enp14s0f1" = {
|
||||||
|
matchConfig.Name = "enp14s0f1";
|
||||||
|
networkConfig = {
|
||||||
|
DefaultRouteOnDevice = true;
|
||||||
|
};
|
||||||
|
routes = [
|
||||||
|
{ routeConfig = {
|
||||||
|
Type = "unicast";
|
||||||
|
Destination = values.hosts.knutsen.ipv4 + "/32";
|
||||||
|
Metric = 50;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.netdevs."br0" = {
|
||||||
|
netdevConfig = {
|
||||||
|
Kind = "bridge";
|
||||||
|
Name = "br0";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.networks."br0" = {
|
||||||
|
matchConfig.Name = "br0";
|
||||||
|
routes = [
|
||||||
|
{ routeConfig = {
|
||||||
|
Type = "unicast";
|
||||||
|
Destination = values.ipv4-space;
|
||||||
|
Metric = 100;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.networks."enp3s0f0" = {
|
||||||
|
matchConfig.Name = "enp3s0f0";
|
||||||
|
networkConfig.DefaultRouteOnDevice = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.networks."enp3s0f1" = {
|
||||||
|
matchConfig.Name = "enp3s0f1";
|
||||||
|
bridge = [ "br0" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.networks."tap0" = {
|
||||||
|
matchConfig.Name = "tap0";
|
||||||
|
bridge = [ "br0" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
#networking.nat = {
|
||||||
|
# enable = true;
|
||||||
|
# externalInterface = "enp14s0f1";
|
||||||
|
# internalInterfaces = [ "tun" ];
|
||||||
|
#};
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,36 @@
|
||||||
|
{ config, pkgs, values, ... }:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
# Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
../../base.nix
|
||||||
|
../../misc/metrics-exporters.nix
|
||||||
|
|
||||||
|
../../modules/grzegorz.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.loader.systemd-boot.enable = true;
|
||||||
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
|
||||||
|
networking.hostName = "georg";
|
||||||
|
|
||||||
|
systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
|
||||||
|
matchConfig.Name = "eno1";
|
||||||
|
address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||||
|
};
|
||||||
|
|
||||||
|
# List packages installed in system profile
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
];
|
||||||
|
|
||||||
|
# List services that you want to enable:
|
||||||
|
|
||||||
|
# This value determines the NixOS release from which the default
|
||||||
|
# settings for stateful data, like file locations and database versions
|
||||||
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
# this value at the release version of the first install of this system.
|
||||||
|
# Before changing this value read the documentation for this option
|
||||||
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
|
system.stateVersion = "23.05"; # Did you read the comment?
|
||||||
|
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,40 @@
|
||||||
|
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||||
|
# and may be overwritten by future invocations. Please make changes
|
||||||
|
# to /etc/nixos/configuration.nix instead.
|
||||||
|
{ config, lib, pkgs, modulesPath, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
|
||||||
|
boot.initrd.kernelModules = [ ];
|
||||||
|
boot.kernelModules = [ "kvm-intel" ];
|
||||||
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
|
fileSystems."/" =
|
||||||
|
{ device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
|
||||||
|
fsType = "ext4";
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems."/boot" =
|
||||||
|
{ device = "/dev/disk/by-uuid/145E-7362";
|
||||||
|
fsType = "vfat";
|
||||||
|
};
|
||||||
|
|
||||||
|
swapDevices =
|
||||||
|
[ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
|
||||||
|
];
|
||||||
|
|
||||||
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
|
networking.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp2s2.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
|
}
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ config, unstable, ... }: let
|
{ config, ... }: let
|
||||||
cfg = config.services.prometheus;
|
cfg = config.services.prometheus;
|
||||||
in {
|
in {
|
||||||
sops.secrets."config/mysqld_exporter" = { };
|
sops.secrets."config/mysqld_exporter" = { };
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
nix.settings.trusted-users = [ "@nix-builder-users" ];
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,62 @@
|
||||||
|
{config, lib, pkgs, ...}:
|
||||||
|
let
|
||||||
|
grg = config.services.grzegorz;
|
||||||
|
grgw = config.services.grzegorz-webui;
|
||||||
|
in {
|
||||||
|
services.pipewire.enable = true;
|
||||||
|
services.pipewire.alsa.enable = true;
|
||||||
|
services.pipewire.alsa.support32Bit = true;
|
||||||
|
services.pipewire.pulse.enable = true;
|
||||||
|
|
||||||
|
users.users.pvv = {
|
||||||
|
isNormalUser = true;
|
||||||
|
description = "pvv";
|
||||||
|
};
|
||||||
|
|
||||||
|
services.grzegorz.enable = true;
|
||||||
|
services.grzegorz.listenAddr = "localhost";
|
||||||
|
services.grzegorz.listenPort = 31337;
|
||||||
|
|
||||||
|
services.grzegorz-webui.enable = true;
|
||||||
|
services.grzegorz-webui.listenAddr = "localhost";
|
||||||
|
services.grzegorz-webui.listenPort = 42069;
|
||||||
|
services.grzegorz-webui.listenWebsocketPort = 42042;
|
||||||
|
services.grzegorz-webui.hostName = "${config.networking.fqdn}";
|
||||||
|
services.grzegorz-webui.apiBase = "http://${toString grg.listenAddr}:${toString grg.listenPort}/api";
|
||||||
|
|
||||||
|
security.acme.acceptTerms = true;
|
||||||
|
security.acme.defaults.email = "pederbs@pvv.ntnu.no";
|
||||||
|
|
||||||
|
services.nginx.enable = true;
|
||||||
|
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."${config.networking.fqdn}" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
serverAliases = [
|
||||||
|
"${config.networking.hostName}.pvv.org"
|
||||||
|
];
|
||||||
|
extraConfig = ''
|
||||||
|
allow 129.241.210.128/25;
|
||||||
|
allow 2001:700:300:1900::/64;
|
||||||
|
deny all;
|
||||||
|
'';
|
||||||
|
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenPort}";
|
||||||
|
};
|
||||||
|
# https://github.com/rawpython/remi/issues/216
|
||||||
|
locations."/websocket" = {
|
||||||
|
proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenWebsocketPort}";
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
|
locations."/api" = {
|
||||||
|
proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
|
||||||
|
};
|
||||||
|
locations."/docs" = {
|
||||||
|
proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
|
@ -1,43 +0,0 @@
|
||||||
{ callPackage, writeTextFile, writeShellScriptBin, minecraft-server, jre_headless }:
|
|
||||||
|
|
||||||
let
|
|
||||||
loader = callPackage ./generate-loader.nix {};
|
|
||||||
log4j = writeTextFile {
|
|
||||||
name = "log4j.xml";
|
|
||||||
text = ''
|
|
||||||
<?xml version="1.0" encoding="UTF-8"?>
|
|
||||||
<Configuration status="WARN" packages="com.mojang.util">
|
|
||||||
<Appenders>
|
|
||||||
<Console name="SysOut" target="SYSTEM_OUT">
|
|
||||||
<PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg%n" />
|
|
||||||
</Console>
|
|
||||||
<Queue name="ServerGuiConsole">
|
|
||||||
<PatternLayout pattern="[%d{HH:mm:ss} %level]: %msg%n" />
|
|
||||||
</Queue>
|
|
||||||
<RollingRandomAccessFile name="File" fileName="logs/latest.log" filePattern="logs/%d{yyyy-MM-dd}-%i.log.gz">
|
|
||||||
<PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg%n" />
|
|
||||||
<Policies>
|
|
||||||
<TimeBasedTriggeringPolicy />
|
|
||||||
<OnStartupTriggeringPolicy />
|
|
||||||
</Policies>
|
|
||||||
<DefaultRolloverStrategy max="1000"/>
|
|
||||||
</RollingRandomAccessFile>
|
|
||||||
</Appenders>
|
|
||||||
<Loggers>
|
|
||||||
<Root level="info">
|
|
||||||
<filters>
|
|
||||||
<MarkerFilter marker="NETWORK_PACKETS" onMatch="DENY" onMismatch="NEUTRAL" />
|
|
||||||
</filters>
|
|
||||||
<AppenderRef ref="SysOut"/>
|
|
||||||
<AppenderRef ref="File"/>
|
|
||||||
<AppenderRef ref="ServerGuiConsole"/>
|
|
||||||
</Root>
|
|
||||||
</Loggers>
|
|
||||||
</Configuration>
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
in
|
|
||||||
writeShellScriptBin "minecraft-server" ''
|
|
||||||
echo "serverJar=${minecraft-server}/lib/minecraft/server.jar" >> fabric-server-launcher.properties
|
|
||||||
exec ${jre_headless}/bin/java -Dlog4j.configurationFile=${log4j} $@ -jar ${loader} nogui
|
|
||||||
''
|
|
||||||
|
|
@ -1,38 +0,0 @@
|
||||||
{ lib, fetchurl, stdenv, unzip, zip, jre_headless }:
|
|
||||||
|
|
||||||
let
|
|
||||||
lock = import ./lock.nix;
|
|
||||||
libraries = lib.forEach lock.libraries fetchurl;
|
|
||||||
in
|
|
||||||
stdenv.mkDerivation {
|
|
||||||
name = "fabric-server-launch.jar";
|
|
||||||
nativeBuildInputs = [ unzip zip jre_headless ];
|
|
||||||
|
|
||||||
libraries = libraries;
|
|
||||||
|
|
||||||
buildPhase = ''
|
|
||||||
for i in $libraries; do
|
|
||||||
unzip -o $i
|
|
||||||
done
|
|
||||||
|
|
||||||
cat > META-INF/MANIFEST.MF << EOF
|
|
||||||
Manifest-Version: 1.0
|
|
||||||
Main-Class: net.fabricmc.loader.impl.launch.server.FabricServerLauncher
|
|
||||||
Name: org/objectweb/asm/
|
|
||||||
Implementation-Version: 9.2
|
|
||||||
EOF
|
|
||||||
|
|
||||||
cat > fabric-server-launch.properties << EOF
|
|
||||||
launch.mainClass=net.fabricmc.loader.impl.launch.knot.KnotServer
|
|
||||||
EOF
|
|
||||||
'';
|
|
||||||
|
|
||||||
installPhase = ''
|
|
||||||
jar cmvf META-INF/MANIFEST.MF "server.jar" .
|
|
||||||
zip -d server.jar 'META-INF/*.SF' 'META-INF/*.RSA' 'META-INF/*.DSA'
|
|
||||||
cp server.jar "$out"
|
|
||||||
'';
|
|
||||||
|
|
||||||
phases = [ "buildPhase" "installPhase" ];
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
@ -1,22 +0,0 @@
|
||||||
#!/usr/bin/env nix-shell
|
|
||||||
#!nix-shell -i bash -p bash curl jq
|
|
||||||
curl https://meta.fabricmc.net/v2/versions/loader/1.18.1/0.12.12/server/json \
|
|
||||||
| jq -r '
|
|
||||||
.mainClass,
|
|
||||||
(.libraries[]
|
|
||||||
| .url as $url
|
|
||||||
| .name | split(":") as [$dir, $name, $version]
|
|
||||||
|"\($name)-\($version).zip|\($url)\($dir|sub("\\.";"/";"g"))/\($name)/\($version)/\($name)-\($version).jar"
|
|
||||||
)' \
|
|
||||||
| {
|
|
||||||
echo '{'
|
|
||||||
read mainClass;
|
|
||||||
echo " mainClass = \"$mainClass\";"
|
|
||||||
echo " libraries = ["
|
|
||||||
while IFS="|" read name url; do
|
|
||||||
hash=$(nix-prefetch-url $url);
|
|
||||||
echo " { name = \"$name\"; sha256 = \"$hash\"; url = \"$url\"; }"
|
|
||||||
done
|
|
||||||
echo " ];"
|
|
||||||
echo '}'
|
|
||||||
}
|
|
||||||
|
|
@ -1,16 +0,0 @@
|
||||||
{
|
|
||||||
mainClass = "net.fabricmc.loader.impl.launch.knot.KnotServer";
|
|
||||||
libraries = [
|
|
||||||
{ name = "tiny-mappings-parser-0.3.0+build.17.zip"; sha256 = "19kvhxfk5v01f2rvl7j02vqhn3nd2bh5jsgbk44rpzqv9f6074db"; url = "https://maven.fabricmc.net/net/fabricmc/tiny-mappings-parser/0.3.0+build.17/tiny-mappings-parser-0.3.0+build.17.jar"; }
|
|
||||||
{ name = "sponge-mixin-0.10.7+mixin.0.8.4.zip"; sha256 = "18m5wksd9vjp676cxapkggnz8s3f8j89phln8gy5n8vxlrli8n0d"; url = "https://maven.fabricmc.net/net/fabricmc/sponge-mixin/0.10.7+mixin.0.8.4/sponge-mixin-0.10.7+mixin.0.8.4.jar"; }
|
|
||||||
{ name = "tiny-remapper-0.6.0.zip"; sha256 = "1ynjfxg7cj9rd9c4l450w7yp20p2csjdpnk3mcx5bdkjzhbgvgzf"; url = "https://maven.fabricmc.net/net/fabricmc/tiny-remapper/0.6.0/tiny-remapper-0.6.0.jar"; }
|
|
||||||
{ name = "access-widener-2.0.1.zip"; sha256 = "0a7s4x6dbaa9p59ps7pidzwrs0xwy5i17s35xrgh58i26szlsaxm"; url = "https://maven.fabricmc.net/net/fabricmc/access-widener/2.0.1/access-widener-2.0.1.jar"; }
|
|
||||||
{ name = "asm-9.2.zip"; sha256 = "1xa7kccwmcqcdw1xly6n2frzhk56m8ma9v7h764g73ckf56zxm5r"; url = "https://maven.fabricmc.net/org/ow2/asm/asm/9.2/asm-9.2.jar"; }
|
|
||||||
{ name = "asm-analysis-9.2.zip"; sha256 = "1i1kyirizs5sm2v0f06sdz86mbmyn61vjr9d9p8p5h1i2x9bx3w7"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-analysis/9.2/asm-analysis-9.2.jar"; }
|
|
||||||
{ name = "asm-commons-9.2.zip"; sha256 = "19p04mr14ahndba65v4krbvf4p5syf8wz0fp5i9bnf5270qyak5y"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-commons/9.2/asm-commons-9.2.jar"; }
|
|
||||||
{ name = "asm-tree-9.2.zip"; sha256 = "04g0zb7v65iz4k2m2grdpbv8jjryrzkkw7ww23yfp94i6399pgxa"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-tree/9.2/asm-tree-9.2.jar"; }
|
|
||||||
{ name = "asm-util-9.2.zip"; sha256 = "16759v4hh3ijpf4cglrxybz29x2hiylhsa388y09m2mf679kqnzz"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-util/9.2/asm-util-9.2.jar"; }
|
|
||||||
{ name = "intermediary-1.18.1.zip"; sha256 = "1rfz2gazvnivn6hlqiyjpiaycz8va87n5czy1p6w3lnrlfggj2i9"; url = "https://maven.fabricmc.net/net/fabricmc/intermediary/1.18.1/intermediary-1.18.1.jar"; }
|
|
||||||
{ name = "fabric-loader-0.12.12.zip"; sha256 = "070dpcp7kcj4xr75wp1j6pb1bgfzllwg8xmqk3sk79jfqiqwzizw"; url = "https://maven.fabricmc.net/net/fabricmc/fabric-loader/0.12.12/fabric-loader-0.12.12.jar"; }
|
|
||||||
];
|
|
||||||
}
|
|
||||||
|
|
@ -1,38 +0,0 @@
|
||||||
{ lib, stdenv, fetchurl, nixosTests, jre_headless }:
|
|
||||||
stdenv.mkDerivation {
|
|
||||||
pname = "minecraft-server";
|
|
||||||
version = "1.18.1";
|
|
||||||
|
|
||||||
src = fetchurl {
|
|
||||||
url = "https://launcher.mojang.com/v1/objects/125e5adf40c659fd3bce3e66e67a16bb49ecc1b9/server.jar";
|
|
||||||
# sha1 because that comes from mojang via api
|
|
||||||
sha1 = "125e5adf40c659fd3bce3e66e67a16bb49ecc1b9";
|
|
||||||
};
|
|
||||||
|
|
||||||
preferLocalBuild = true;
|
|
||||||
|
|
||||||
installPhase = ''
|
|
||||||
mkdir -p $out/bin $out/lib/minecraft
|
|
||||||
cp -v $src $out/lib/minecraft/server.jar
|
|
||||||
cat > $out/bin/minecraft-server << EOF
|
|
||||||
#!/bin/sh
|
|
||||||
exec ${jre_headless}/bin/java \$@ -jar $out/lib/minecraft/server.jar nogui
|
|
||||||
EOF
|
|
||||||
chmod +x $out/bin/minecraft-server
|
|
||||||
'';
|
|
||||||
|
|
||||||
dontUnpack = true;
|
|
||||||
|
|
||||||
passthru = {
|
|
||||||
tests = { inherit (nixosTests) minecraft-server; };
|
|
||||||
updateScript = ./update.sh;
|
|
||||||
};
|
|
||||||
|
|
||||||
meta = with lib; {
|
|
||||||
description = "Minecraft Server";
|
|
||||||
homepage = "https://minecraft.net";
|
|
||||||
license = licenses.unfreeRedistributable;
|
|
||||||
platforms = platforms.unix;
|
|
||||||
maintainers = with maintainers; [ thoughtpolice tomberek costrouc ];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -2,6 +2,8 @@ synapse:
|
||||||
turnconfig: ENC[AES256_GCM,data:mASRjYa4C9WRow4x0XYRrlCE5LMJUYaId+o62r1qhsyJPa2LzrI=,iv:5vYdubvMDjLS6soiWx2DzkEAATb9NFbSS/Jhuuz1yI8=,tag:wOW07CQMDbOiZNervee/pg==,type:str]
|
turnconfig: ENC[AES256_GCM,data:mASRjYa4C9WRow4x0XYRrlCE5LMJUYaId+o62r1qhsyJPa2LzrI=,iv:5vYdubvMDjLS6soiWx2DzkEAATb9NFbSS/Jhuuz1yI8=,tag:wOW07CQMDbOiZNervee/pg==,type:str]
|
||||||
user_registration: ENC[AES256_GCM,data:ZDZfEEvyw8pg0WzhrdC8747ed+ZR2ZA8/WypJd/iDkmIy2RmxOeI0sE=,iv:l61mOlvzpCql4fC/eubBSU6px21et2WcpxQ6rFl14iw=,tag:sVDEAa3xipKIi/6isCjWew==,type:str]
|
user_registration: ENC[AES256_GCM,data:ZDZfEEvyw8pg0WzhrdC8747ed+ZR2ZA8/WypJd/iDkmIy2RmxOeI0sE=,iv:l61mOlvzpCql4fC/eubBSU6px21et2WcpxQ6rFl14iw=,tag:sVDEAa3xipKIi/6isCjWew==,type:str]
|
||||||
signing_key: ENC[AES256_GCM,data:6UpfiRlX9pRM7zhdm7Mc8y8EItLzugWkHSgE0tGpEmudCTa1wc60oNbYfhKDWU81DT/U148pZOoX1A==,iv:UlqCPicPm5eNBz1xBMI3A3Rn4t/GtldNIDdMH5MMnLw=,tag:HHaw6iMjEAv5b9mjHSVpwA==,type:str]
|
signing_key: ENC[AES256_GCM,data:6UpfiRlX9pRM7zhdm7Mc8y8EItLzugWkHSgE0tGpEmudCTa1wc60oNbYfhKDWU81DT/U148pZOoX1A==,iv:UlqCPicPm5eNBz1xBMI3A3Rn4t/GtldNIDdMH5MMnLw=,tag:HHaw6iMjEAv5b9mjHSVpwA==,type:str]
|
||||||
|
sliding-sync:
|
||||||
|
env: ENC[AES256_GCM,data:DsU1qKTy5sn06Y0S5kFUqZHML20n6HdHUdXsQRUw,iv:/TNTc+StAZbf6pBY9CeXdxkx8E+3bak/wOqHyBNMprU=,tag:er5u4FRlSmUZrOT/sj+RhQ==,type:str]
|
||||||
coturn:
|
coturn:
|
||||||
static-auth-secret: ENC[AES256_GCM,data:y5cG/LyrorkDH+8YrgcV7DY=,iv:ca90q2J3+NOy51mUBy4TMKfYMgWL4hxWDdsKIuxRBgU=,tag:hpFCns1lpi07paHyGB7tGQ==,type:str]
|
static-auth-secret: ENC[AES256_GCM,data:y5cG/LyrorkDH+8YrgcV7DY=,iv:ca90q2J3+NOy51mUBy4TMKfYMgWL4hxWDdsKIuxRBgU=,tag:hpFCns1lpi07paHyGB7tGQ==,type:str]
|
||||||
mjolnir:
|
mjolnir:
|
||||||
|
|
@ -41,8 +43,8 @@ sops:
|
||||||
cGxZVnFhdXRka2drTGdkVk1iM0pFL1kK2ry7b2cLYPfntWi/BV3K2O+mHt3242Ef
|
cGxZVnFhdXRka2drTGdkVk1iM0pFL1kK2ry7b2cLYPfntWi/BV3K2O+mHt3242Ef
|
||||||
sI2JLLQYHeAhxjFdCzP1RDR+Wu/pRxZje6xuTZ9I9TKNmm+LhAXHQw==
|
sI2JLLQYHeAhxjFdCzP1RDR+Wu/pRxZje6xuTZ9I9TKNmm+LhAXHQw==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
lastmodified: "2023-09-15T04:40:21Z"
|
lastmodified: "2023-10-22T00:31:46Z"
|
||||||
mac: ENC[AES256_GCM,data:ZJVHLbpSu/nIzl5FJfRdg2ymRN5M+zJXNUpi1hBt2MBmvK+1ed2ElhMe5x7pyasSDdaUtXDo7ghkUF7vE46Wo6Z9dvlAvhwWm7Y2AWfUe5SFVwzqlOCjSKRPFrQrL7PcDBtMj4twtwhc4XsfJoUSuigWW2m21BKtEZSuuxLRqLA=,iv:ufFbfMaNHydbkwq6lxN1dQJldkAbtqais/CZFkoDhb4=,tag:uMj0LaiU0obIlw/+HJJdKg==,type:str]
|
mac: ENC[AES256_GCM,data:UpnaUfRxvdyzBy5x4EC3w5LQ1qWxILTQhpyVPd9whTzQMAivAHT0pVmP9aE4T9w3NcWTaghp+f70GmQXx/OCC6DsRCWtU9pFHRj12YUowM3yB5lVTOomOLZQ9m4gUXw5I2GZHWBJn8CyosDcBMlXz2tiR91v/8Ulh6sDSAO86U0=,iv:5GcgRvbpqDEslZruKHM/TcMaF52A5X7AK41DEbrsRIQ=,tag:ndDgCRyX1aDRnzEUNmpoMw==,type:str]
|
||||||
pgp:
|
pgp:
|
||||||
- created_at: "2023-05-06T21:31:39Z"
|
- created_at: "2023-05-06T21:31:39Z"
|
||||||
enc: |
|
enc: |
|
||||||
|
|
|
||||||
12
shell.nix
12
shell.nix
|
|
@ -3,5 +3,17 @@ pkgs.mkShell {
|
||||||
nativeBuildInputs = with pkgs; [
|
nativeBuildInputs = with pkgs; [
|
||||||
sops
|
sops
|
||||||
gnupg
|
gnupg
|
||||||
|
openstackclient
|
||||||
];
|
];
|
||||||
|
|
||||||
|
shellHook = ''
|
||||||
|
export OS_AUTH_URL=https://api.stack.it.ntnu.no:5000
|
||||||
|
export OS_PROJECT_ID=b78432a088954cdc850976db13cfd61c
|
||||||
|
export OS_PROJECT_NAME="STUDORG_Programvareverkstedet"
|
||||||
|
export OS_USER_DOMAIN_NAME="NTNU"
|
||||||
|
export OS_PROJECT_DOMAIN_ID="d3f99bcdaf974685ad0c74c2e5d259db"
|
||||||
|
export OS_REGION_NAME="NTNU-IT"
|
||||||
|
export OS_INTERFACE=public
|
||||||
|
export OS_IDENTITY_API_VERSION=3
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
{ pkgs, ... }:
|
||||||
|
{
|
||||||
|
users.users.adriangl = {
|
||||||
|
isNormalUser = true;
|
||||||
|
description = "(0_0)";
|
||||||
|
extraGroups = [
|
||||||
|
"wheel"
|
||||||
|
"drift"
|
||||||
|
];
|
||||||
|
|
||||||
|
packages = with pkgs; [
|
||||||
|
exa
|
||||||
|
neovim
|
||||||
|
];
|
||||||
|
|
||||||
|
openssh.authorizedKeys.keys = [
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFa5y7KyLn2tjxed1czMbyM5scnEpo9v/GfnhL/28ckM legolas"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -3,7 +3,12 @@
|
||||||
{
|
{
|
||||||
users.users.danio = {
|
users.users.danio = {
|
||||||
isNormalUser = true;
|
isNormalUser = true;
|
||||||
extraGroups = [ "drift" ]; # Enable ‘sudo’ for the user.
|
extraGroups = [ "drift" "nix-builder-users" ];
|
||||||
shell = pkgs.zsh;
|
shell = pkgs.zsh;
|
||||||
|
|
||||||
|
openssh.authorizedKeys.keys = [
|
||||||
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCp8iMOx3eTiG5AmDh2KjKcigf7xdRKn9M7iZQ4RqP0np0UN2NUbu+VAMJmkWFyi3JpxmLuhszU0F1xY+3qM3ARduy1cs89B/bBE85xlOeYhcYVmpcgPR5xduS+TuHTBzFAgp+IU7/lgxdjcJ3PH4K0ruGRcX1xrytmk/vdY8IeSk3GVWDRrRbH6brO4cCCFjX0zJ7G6hBQueTPQoOy3jrUvgpRkzZY4ZCuljXtxbuX5X/2qWAkp8ca0iTQ5FzNA5JUyj+DWeEzjIEz6GrckOdV2LjWpT9+CtOqoPZOUudE1J9mJk4snNlMQjE06It7Kr50bpwoPqnxjo7ZjlHFLezl"
|
||||||
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDpGSDczzDOhTETCj+uB5e3/9QbOCaVW1knM+n1ey0n6LXH7uiPPmzuZiqfzmfbB1z4bjM2zpn3D6Et6zRCrBUjhTZqf/5GoNlvhVA6QYmBmBp98b8oY7juj5cmu55voxD0S5rC1mQMnWAAf8e8OPbkhs9Lt0XlOYdotLNIZQubzWqE2DK45g/h17ELJs+jkNXoalFjLvLXWzE/C+3pYoeNJVGHfVMTIwt7o64E6JXhxuYTYdSIuzd+BjntkSCXzcAzBFMRwkdlFVoBtLUMMcMQl39kcXv7lAQ8pv+8b1j1N9WuQVf1qEAcZguaimI1ifbXP5d841pZPApCj5KXectIEldfTrcwg8rZpd2UfYS/3XCcOuidBGprY7XsU/jz8wHbH68UjUrsLyaOMnG2ChYztnf63vm3gRs3Fc6FqTycpgYOPDeZBVTcMyPGgtiZvhnTeY20xFS5lK6M+dmgaDqH24kPLiwYSpUF2NK+Rg/2bZxvt/GaSr4U6fJGi3FCJOM= root@DanixLaptop"
|
||||||
|
];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
{pkgs, ...}:
|
||||||
|
|
||||||
|
{
|
||||||
|
users.users.jonmro = {
|
||||||
|
isNormalUser = true;
|
||||||
|
extraGroups = [ "wheel" "drift" "nix-builder-users" ];
|
||||||
|
shell = pkgs.zsh;
|
||||||
|
openssh.authorizedKeys.keys = [
|
||||||
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEm5PfYmfl/0fnAP/3coVlvTw3/TYNLT6r/NwJHZbLAK jonrodtang@gmail.com"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -6,6 +6,7 @@
|
||||||
extraGroups = [
|
extraGroups = [
|
||||||
"wheel"
|
"wheel"
|
||||||
"drift"
|
"drift"
|
||||||
|
"nix-builder-users"
|
||||||
];
|
];
|
||||||
|
|
||||||
packages = with pkgs; [
|
packages = with pkgs; [
|
||||||
|
|
|
||||||
21
values.nix
21
values.nix
|
|
@ -4,7 +4,7 @@ let
|
||||||
pvv-ipv6 = suffix: "2001:700:300:1900::${toString suffix}";
|
pvv-ipv6 = suffix: "2001:700:300:1900::${toString suffix}";
|
||||||
in rec {
|
in rec {
|
||||||
ipv4-space = pvv-ipv4 "128/25";
|
ipv4-space = pvv-ipv4 "128/25";
|
||||||
ipv6-space = pvv-ipv4 "/64";
|
ipv6-space = pvv-ipv6 "/64";
|
||||||
|
|
||||||
services = {
|
services = {
|
||||||
matrix = {
|
matrix = {
|
||||||
|
|
@ -37,10 +37,29 @@ in rec {
|
||||||
ipv4 = pvv-ipv4 209;
|
ipv4 = pvv-ipv4 209;
|
||||||
ipv6 = pvv-ipv6 209;
|
ipv6 = pvv-ipv6 209;
|
||||||
};
|
};
|
||||||
|
bob = {
|
||||||
|
ipv4 = "129.241.152.254";
|
||||||
|
# ipv6 = ;
|
||||||
|
};
|
||||||
|
knutsen = {
|
||||||
|
ipv4 = pvv-ipv4 191;
|
||||||
|
};
|
||||||
shark = {
|
shark = {
|
||||||
ipv4 = pvv-ipv4 196;
|
ipv4 = pvv-ipv4 196;
|
||||||
ipv6 = pvv-ipv6 196;
|
ipv6 = pvv-ipv6 196;
|
||||||
};
|
};
|
||||||
|
brzeczyszczykiewicz = {
|
||||||
|
ipv4 = pvv-ipv4 205;
|
||||||
|
ipv6 = pvv-ipv6 "1:50"; # Wtf peder why
|
||||||
|
};
|
||||||
|
georg = {
|
||||||
|
ipv4 = pvv-ipv4 204;
|
||||||
|
ipv6 = pvv-ipv6 "1:4f"; # Wtf øystein og daniel why
|
||||||
|
};
|
||||||
|
buskerud = {
|
||||||
|
ipv4 = pvv-ipv4 231;
|
||||||
|
ipv6 = pvv-ipv6 231;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
defaultNetworkConfig = {
|
defaultNetworkConfig = {
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue