WIP: grevling/tuba: init

yolo lmao

.gitea/workflows/eval.yml

@@ -0,0 +1,13 @@
+name: "Eval nix flake"
+on:
+  pull_request:
+  push:
+jobs:
+  evals:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - run: apt-get update && apt-get -y install sudo
+    - uses: https://github.com/cachix/install-nix-action@v23
+    - run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
+    - run: nix flake check

README.MD

@@ -10,7 +10,13 @@ Etter å ha klonet prosjektet ned og gjort endringer kan du evaluere configene m
 
 før du bygger en maskin med:
 
-`nix build .#nixosConfigurations.<maskinavn>.config.system.build.toplevel`
+`nix build .#<maskinnavn>`
+
+hvis du vil være ekstra sikker på at alt bygger så kan du kjøre:
+
+`nix build .` for å bygge alle de viktige maskinene.
+
+NB: Dette kan ta opp til 30 minutter avhengig av hva som ligger i caches
 
 Husk å hvertfall stage nye filer om du har laget dem!
 

flake.lock

@@ -1,15 +1,55 @@
 {
   "nodes": {
+    "grzegorz": {
+      "inputs": {
+        "nixpkgs": [
+          "unstable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1696346665,
+        "narHash": "sha256-J6Tf6a/zhFZ8SereluHLrvgPsIVm2CGHHA8wrbhZB3Y=",
+        "owner": "Programvareverkstedet",
+        "repo": "grzegorz",
+        "rev": "9b9c3ac7d408ac7c6d67544b201e6b169afacb03",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Programvareverkstedet",
+        "repo": "grzegorz",
+        "type": "github"
+      }
+    },
+    "grzegorz-clients": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1693864994,
+        "narHash": "sha256-oLDiWdCKDtEfeGzfAuDTq+n9VWp6JCo67PEESEZ3y8E=",
+        "owner": "Programvareverkstedet",
+        "repo": "grzegorz-clients",
+        "rev": "a38a0b0fb31ad0ad78a91458cb2c7f77f686468f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Programvareverkstedet",
+        "repo": "grzegorz-clients",
+        "type": "github"
+      }
+    },
     "matrix-next": {
       "inputs": {
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1694383459,
+        "lastModified": 1697420972,
-        "narHash": "sha256-Y7VuBz74Go1QlvSLGXsXzPgOeeV73bbsDou3uXX9oa8=",
+        "narHash": "sha256-eFDasOzXAN8VswUntNBBwvKFyVKFvmwRNNVTDfGdB3M=",
         "owner": "dali99",
         "repo": "nixos-matrix-modules",
-        "rev": "66ff528912d95e6a2ee0aea6404a6b7e0d7fd83c",
+        "rev": "1e370b96223b94d52006249a60033caaea605c65",
         "type": "github"
       },
       "original": {
@@ -20,11 +60,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1694526311,
+        "lastModified": 1697706247,
-        "narHash": "sha256-Y9LCYQBNX7McW0o8x6wT9tx2qy9TVuF84fe62zrQzyA=",
+        "narHash": "sha256-nWLggeUxn/l8JrcQr9f+RfnCXp8cn0BN568PjMJh9ko=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "36bee398beca22e2428074e0a2e068d87f801718",
+        "rev": "4ee5b576ac2861a818950aea99f609d7a6fc02a3",
         "type": "github"
       },
       "original": {
@@ -51,11 +91,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1693675694,
+        "lastModified": 1697332183,
-        "narHash": "sha256-2pIOyQwGyy2FtFAUIb8YeKVmOCcPOTVphbAvmshudLE=",
+        "narHash": "sha256-ACYvYsgLETfEI2xM1jjp8ZLVNGGC0onoCGe+69VJGGE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5601118d39ca9105f8e7b39d4c221d3388c0419d",
+        "rev": "0e1cff585c1a85aeab059d3109f66134a8f76935",
         "type": "github"
       },
       "original": {
@@ -87,6 +127,8 @@
     },
     "root": {
       "inputs": {
+        "grzegorz": "grzegorz",
+        "grzegorz-clients": "grzegorz-clients",
         "matrix-next": "matrix-next",
         "nixpkgs": "nixpkgs",
         "pvv-calendar-bot": "pvv-calendar-bot",
@@ -102,11 +144,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1694495315,
+        "lastModified": 1697339241,
-        "narHash": "sha256-sZEYXs9T1NVHZSSbMqBEtEm2PGa7dEDcx0ttQkArORc=",
+        "narHash": "sha256-ITsFtEtRbCBeEH9XrES1dxZBkE1fyNNUfIyQjQ2AYQs=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "ea208e55f8742fdcc0986b256bdfa8986f5e4415",
+        "rev": "51186b8012068c417dac7c31fb12861726577898",
         "type": "github"
       },
       "original": {
@@ -117,11 +159,11 @@
     },
     "unstable": {
       "locked": {
-        "lastModified": 1694534540,
+        "lastModified": 1697713104,
-        "narHash": "sha256-Cc0Ku0qJZDDx/0kII+0xD94L25EKw4EQzOLm0R9iZO4=",
+        "narHash": "sha256-DN7YOyKMCpAVeZ44N42LrujtTkoerkS9+kTufQiuntY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f22a472661d66c655eae5b0a01ada71e4e13e405",
+        "rev": "6be2c349a30fcb489a3153dd331e9df387ab6449",
         "type": "github"
       },
       "original": {

flake.nix

@@ -12,16 +12,30 @@
     pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
 
     matrix-next.url = "github:dali99/nixos-matrix-modules";
+
+    grzegorz.url = "github:Programvareverkstedet/grzegorz";
+    grzegorz.inputs.nixpkgs.follows = "unstable";
+    grzegorz-clients.url = "github:Programvareverkstedet/grzegorz-clients";
+    grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs = { self, nixpkgs, matrix-next, pvv-calendar-bot, unstable, sops-nix, ... }@inputs:
   let
+    nixlib = nixpkgs.lib;
     systems = [
       "x86_64-linux"
       "aarch64-linux"
       "aarch64-darwin"
     ];
-    forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f system);
+    forAllSystems = f: nixlib.genAttrs systems (system: f system);
+    allMachines = nixlib.mapAttrsToList (name: _: name) self.nixosConfigurations;
+    importantMachines = [
+      "bekkalokk"
+      "bicep"
+      "brzeczyszczykiewicz"
+      "georg"
+      "ildkule"
+    ];
   in {
     nixosConfigurations = let
       nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
@@ -58,7 +72,7 @@
           ./hosts/bicep/configuration.nix
           sops-nix.nixosModules.sops
 
-          matrix-next.nixosModules.synapse
+          matrix-next.nixosModules.default
           pvv-calendar-bot.nixosModules.default
         ];
       };
@@ -66,10 +80,56 @@
       ildkule = stableNixosConfig "ildkule" { };
       #ildkule-unstable = unstableNixosConfig "ildkule" { };
       shark = stableNixosConfig "shark" { };
+
+      brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
+        modules = [
+          ./hosts/brzeczyszczykiewicz/configuration.nix
+          sops-nix.nixosModules.sops
+
+          inputs.grzegorz.nixosModules.grzegorz-kiosk
+          inputs.grzegorz-clients.nixosModules.grzegorz-webui
+        ];
+      };
+      georg = stableNixosConfig "georg" {
+        modules = [
+          ./hosts/georg/configuration.nix
+          sops-nix.nixosModules.sops
+
+          inputs.grzegorz.nixosModules.grzegorz-kiosk
+          inputs.grzegorz-clients.nixosModules.grzegorz-webui
+        ];
+      };
+
+      grevling = stableNixosConfig "grevling" {
+        modules = [
+          ./hosts/grevling/configuration.nix
+          sops-nix.nixosModules.sops
+        ];
+      };
+
+      tuba = stableNixosConfig "grevling" {
+        modules = [
+          ./hosts/tuba/configuration.nix
+          sops-nix.nixosModules.sops
+        ];
+      };
     };
 
     devShells = forAllSystems (system: {
       default = nixpkgs.legacyPackages.${system}.callPackage ./shell.nix { };
     });
+
+    packages = {
+      "x86_64-linux" = let
+        pkgs = nixpkgs.legacyPackages."x86_64-linux";
+      in rec {
+        default = important-machines;
+        important-machines = pkgs.linkFarm "important-machines"
+          (nixlib.getAttrs importantMachines self.packages.x86_64-linux);
+        all-machines = pkgs.linkFarm "all-machines"
+          (nixlib.getAttrs allMachines self.packages.x86_64-linux);
+      } // nixlib.genAttrs allMachines
+        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
+    };
   };
 }

hosts/bekkalokk/configuration.nix

@@ -5,6 +5,7 @@
 
     ../../base.nix
     ../../misc/metrics-exporters.nix
+    ../../modules/wackattack-ctf-stockfish
 
     #./services/keycloak.nix
 
@@ -12,7 +13,7 @@
     # ./services/website.nix
     ./services/nginx.nix
     ./services/gitea/default.nix
-    ./services/mediawiki.nix
+    # ./services/mediawiki.nix
   ];
 
   sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;

hosts/bekkalokk/services/gitea/default.nix

@@ -84,9 +84,9 @@ in {
   };
 
   systemd.timers.gitea-import-users = {
-    enable = true;
     requires = [ "gitea.service" ];
     after = [ "gitea.service" ];
+    wantedBy = [ "timers.target" ];
     timerConfig = {
       OnCalendar = "*-*-* 02:00:00";
       Persistent = true;

hosts/bekkalokk/services/mediawiki.nix

@@ -7,16 +7,17 @@
   # "mediawiki"
   group = config.users.users.${user}.group;
 in {
-  sops.secrets = let
+  sops.secrets = {
-    secret = opts: {
+    "mediawiki/password" = {
       restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
       owner = user;
       group = group;
-    } // opts;
+    };
-  in {
+    "keys/postgres/mediawiki" = {
-    "mediawiki/password" = secret { };
+      restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
-    "mediawiki/database" = secret { };
+      owner = user;
-    "mediawiki/oidc/clientsecret" = secret { };
+      group = group;
+    };
   };
 
   services.mediawiki = {
@@ -26,12 +27,13 @@ in {
     passwordSender = "drift@pvv.ntnu.no";
 
     database = {
-      type = "mysql";
+      type = "postgres";
-      host = "mysql.pvv.ntnu.no";
+      host = "postgres.pvv.ntnu.no";
+      port = config.services.postgresql.port;
+      passwordFile = config.sops.secrets."keys/postgres/mediawiki".path;
       createLocally = false;
-      user = "bekkalokk_mediawiki_test";
+      # TODO: create a normal database and copy over old data when the service is production ready
-      name = "bekkalokk_mediawiki_test";
+      name = "mediawiki_test";
-      passwordFile = config.sops.secrets."mediawiki/database".path;
     };
 
     # Host through nginx
@@ -40,51 +42,70 @@ in {
       listenUser = config.services.nginx.user;
       listenGroup = config.services.nginx.group;
     in {
-      # Worker settings
+      inherit user group;
       "pm" = "dynamic";
       "pm.max_children" = 32;
       "pm.max_requests" = 500;
       "pm.start_servers" = 2;
       "pm.min_spare_servers" = 2;
       "pm.max_spare_servers" = 4;
-
-      # Socket settings
       "listen.owner" = listenUser;
       "listen.group" = listenGroup;
-
-      # Misc
-      "env[PATH]" = lib.makeBinPath [ pkgs.php ];
-      # to accept *.html file
-      "security.limit_extensions" = "";
-      inherit user group;
-
-      # Debug logging
-      "catch_workers_output" = "yes";
-      "php_flag[display_errors]" = "on";
       "php_admin_value[error_log]" = "stderr";
       "php_admin_flag[log_errors]" = "on";
+      "env[PATH]" = lib.makeBinPath [ pkgs.php ];
+      "catch_workers_output" = true;
+      # to accept *.html file
+      "security.limit_extensions" = "";
     };
 
     extensions = {
       DeleteBatch = pkgs.fetchzip {
-        url = "https://extdist.wmflabs.org/dist/extensions/DeleteBatch-REL1_40-6852fb7.tar.gz";
+        url = "https://extdist.wmflabs.org/dist/extensions/DeleteBatch-REL1_39-995ea6f.tar.gz";
-        hash = "sha256-m6l8Cs6mFLu1qfovBFO2l8HhtYZXnpZkajWXNob2wbU=";
+	sha256 = "sha256-0F4GLCy2f5WcWIY2YgF1tVxgYbglR0VOsj/pMrW93b8=";
       };
       UserMerge = pkgs.fetchzip {
-        url = "https://extdist.wmflabs.org/dist/extensions/UserMerge-REL1_40-56f6dcf.tar.gz";
+        url = "https://extdist.wmflabs.org/dist/extensions/UserMerge-REL1_39-b10d50e.tar.gz";
-        hash = "sha256-zO7ti7fZPlJp3TXSJbYrXPRyElwO57zoU+RH7LBwVGU=";
+	sha256 = "sha256-bXhj1+OlOUJDbvEuc8iwqb1LLEu6cN6+C/7cAvnWPOQ=";
       };
       PluggableAuth = pkgs.fetchzip {
-        url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_40-8104ed9.tar.gz";
+        url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_39-1210fc3.tar.gz";
-        hash = "sha256-fFz9+pJ/Ucdg340I/JWe4S/W05oVSfns9EF84rxN8yI=";
+	sha256 = "sha256-F6bTMCzkK3kZwZGIsNE87WlZWqXXmTMhEjApO99YKR0=";
       };
-      OpenIDConnect = pkgs.fetchzip {
+      SimpleSAMLphp = pkgs.fetchzip {
-        url = "https://extdist.wmflabs.org/dist/extensions/OpenIDConnect-REL1_40-3edc735.tar.gz";
+        url = "https://extdist.wmflabs.org/dist/extensions/SimpleSAMLphp-REL1_39-dcf0acb.tar.gz";
-        hash = "sha256-Osp4m2Sp9uGNt3QEmRsw0LA3KQCQzqJosgy3AFs11hY=";
+        sha256 = "sha256-tCvFmb2+q2rxms+lRo5pgoI3h6GjCwXAR8XisPg03TQ=";
       };
     };
 
-    extraConfig = ''
+    extraConfig = let
+
+      SimpleSAMLphpRepo = pkgs.stdenvNoCC.mkDerivation rec {
+        pname = "configuredSimpleSAML";
+	version = "2.0.4";
+        src = pkgs.fetchzip {
+          url = "https://github.com/simplesamlphp/simplesamlphp/releases/download/v${version}/simplesamlphp-${version}.tar.gz";
+          sha256 = "sha256-pfMV/VmqqxgtG7Nx4s8MW4tWSaxOkVPtCRJwxV6RDSE=";
+        };
+
+	buildPhase = ''
+          cat > config/authsources.php << EOF
+          <?php
+          $config = array(
+            'default-sp' => array(
+              'saml:SP',
+              'idp' => 'https://idp.pvv.ntnu.no/',
+            ),
+          );
+	  EOF
+	'';
+
+	installPhase = ''
+	  cp -r . $out
+	'';
+      };
+
+    in ''
       $wgServer = "https://bekkalokk.pvv.ntnu.no";
       $wgLocaltimezone = "Europe/Oslo";
 
@@ -94,60 +115,61 @@ in {
       $wgEmailAuthentication = false;
       $wgGroupPermissions['*']['createaccount'] = false;
       $wgGroupPermissions['*']['autocreateaccount'] = true;
-      $wgPluggableAuth_EnableAutoLogin = false;
+      $wgPluggableAuth_EnableAutoLogin = true;
-
-      # SSO config
-      $wgPluggableAuth_Config[] = [
-          'plugin' => 'OpenIDConnect',
-          'data' => [
-              'providerURL' => 'https://git.pvv.ntnu.no/login/oauth/authorize',
-              'clientID' => 'be86ec39-d89c-4973-a163-633339539db2',
-              'clientsecret' => file_get_contents('${config.sops.secrets."mediawiki/oidc/clientsecret".path}')
-          ]
-      ];
 
       # Disable anonymous editing
       $wgGroupPermissions['*']['edit'] = false;
 
       # Styling
-      $wgLogos = [
+      $wgLogo = "/PNG/PVV-logo.png";
-        'svg' => "${../../../assets/logo_blue_regular.svg}",
-      ];
       $wgDefaultSkin = "monobook";
 
-      # Enable debugging
-      error_reporting( -1 );
-      ini_set( 'display_errors', 1 );
-
       # Misc
       $wgEmergencyContact = "${cfg.passwordSender}";
       $wgShowIPinHeader = false;
       $wgUseTeX = false;
       $wgLocalInterwiki = $wgSitename;
 
+      # SimpleSAML
+      $wgSimpleSAMLphp_InstallDir = "${SimpleSAMLphpRepo}";
+      $wgSimpleSAMLphp_AuthSourceId = "default-sp";
+      $wgSimpleSAMLphp_RealNameAttribute = "cn";
+      $wgSimpleSAMLphp_EmailAttribute = "mail";
+      $wgSimpleSAMLphp_UsernameAttribute = "uid";
+
       # Fix https://github.com/NixOS/nixpkgs/issues/183097
       $wgDBserver = "${toString cfg.database.host}";
     '';
   };
 
-  # services.nginx.virtualHosts."wiki.pvv.ntnu.no" = {
+  # Override because of https://github.com/NixOS/nixpkgs/issues/183097
-  services.nginx.virtualHosts."bekkalokk.pvv.ntnu.no" = {
+  systemd.services.mediawiki-init.script = let
-    forceSSL = true;
+    # According to module
-    enableACME = true;
+    stateDir = "/var/lib/mediawiki";
-    root = "${cfg.finalPackage}/share/mediawiki";
+    pkg = cfg.finalPackage;
-    locations = {
+    mediawikiConfig = config.services.phpfpm.pools.mediawiki.phpEnv.MEDIAWIKI_CONFIG;
-      "/" = {
+    inherit (lib) optionalString mkForce;
-        recommendedProxySettings = true;
+  in mkForce ''
-        extraConfig = ''
+    if ! test -e "${stateDir}/secret.key"; then
-          fastcgi_split_path_info ^(.+\.php)(/.+)$;
+      tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c 64 > ${stateDir}/secret.key
-          fastcgi_index index.php;
+    fi
-          fastcgi_pass unix:${config.services.phpfpm.pools.mediawiki.socket};
-          include ${pkgs.nginx}/conf/fastcgi_params;
-          include ${pkgs.nginx}/conf/fastcgi.conf;
-        '';
-      };
-      "/images".root = config.services.mediawiki.uploadsDir;
-    };
 
-  };
+    echo "exit( wfGetDB( DB_MASTER )->tableExists( 'user' ) ? 1 : 0 );" | \
+    ${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/eval.php --conf ${mediawikiConfig} && \
+    ${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/install.php \
+      --confpath /tmp \
+      --scriptpath / \
+      --dbserver "${cfg.database.host}" \
+      --dbport ${toString cfg.database.port} \
+      --dbname ${cfg.database.name} \
+      ${optionalString (cfg.database.tablePrefix != null) "--dbprefix ${cfg.database.tablePrefix}"} \
+      --dbuser ${cfg.database.user} \
+      ${optionalString (cfg.database.passwordFile != null) "--dbpassfile ${cfg.database.passwordFile}"} \
+      --passfile ${cfg.passwordFile} \
+      --dbtype ${cfg.database.type} \
+      ${cfg.name} \
+      admin
+
+    ${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/update.php --conf ${mediawikiConfig} --quick
+  '';
 }

hosts/bicep/services/matrix/smtp-authenticator/default.nix

@@ -0,0 +1,17 @@
+{ lib, buildPythonPackage, fetchFromGitHub }:
+
+buildPythonPackage rec {
+  pname = "matrix-synapse-smtp-auth";
+  version = "0.1.0";
+
+  src = ./.;
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "An SMTP auth provider for Synapse";
+    homepage = "pvv.ntnu.no";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ dandellion ];
+  };
+}

hosts/bicep/services/matrix/smtp-authenticator/setup.py

@@ -0,0 +1,11 @@
+from setuptools import setup
+
+setup(
+    name="matrix-synapse-smtp-auth",
+    version="0.1.0",
+    py_modules=['smtp_auth_provider'],
+    author="Daniel Løvbrøtte Olsen",
+    author_email="danio@pvv.ntnu.no",
+    description="An SMTP auth provider for Synapse",
+    license="AGPL-3.0-only"
+)

hosts/bicep/services/matrix/smtp-authenticator/smtp_auth_provider.py

@@ -0,0 +1,45 @@
+from typing import Awaitable, Callable, Optional, Tuple
+
+from smtplib import SMTP_SSL as SMTP
+
+import synapse
+from synapse import module_api
+
+
+class SMTPAuthProvider:
+    def __init__(self, config: dict, api: module_api):
+        self.api = api
+
+        self.config = config
+
+        api.register_password_auth_provider_callbacks(
+            auth_checkers={
+                ("m.login.password", ("password",)): self.check_pass,
+            },
+        )
+
+    async def check_pass(
+        self,
+        username: str,
+        login_type: str,
+        login_dict: "synapse.module_api.JsonDict",
+    ):
+        if login_type != "m.login.password":
+            return None
+
+        result = False
+        with SMTP(self.config["smtp_host"]) as smtp:
+            password = login_dict.get("password")
+            try:
+                smtp.login(username, password)
+                result = True
+            except:
+                return None
+
+        if result == True:
+            userid = self.api.get_qualified_user_id(username)
+            if not self.api.check_user_exists(userid):
+                self.api.register_user(username)
+            return (userid, None)
+        else:
+            return None

hosts/bicep/services/matrix/synapse.nix

@@ -22,9 +22,18 @@ in {
     group = config.users.users.matrix-synapse.group;
   };
 
+  sops.secrets."matrix/sliding-sync/env" = {
+    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    key = "sliding-sync/env";
+  };
+
   services.matrix-synapse-next = {
     enable = true;
 
+    plugins = [
+      (pkgs.python3Packages.callPackage ./smtp-authenticator { })
+    ];
+
     dataDir = "/data/synapse";
 
     workers.federationSenders = 2;
@@ -34,6 +43,8 @@ in {
     workers.eventPersisters = 2;
     workers.useUserDirectoryWorker = true;
 
+    enableSlidingSync = true;
+
     enableNginx = true;
 
     settings = {
@@ -81,7 +92,15 @@ in {
       enable_registration = false;
       registration_shared_secret_path = config.sops.secrets."matrix/synapse/user_registration".path;
 
-      password_config.enabled = lib.mkForce false;
+      password_config.enabled = true;
+
+      modules = [
+        { module = "smtp_auth_provider.SMTPAuthProvider";
+          config = {
+            smtp_host = "smtp.pvv.ntnu.no";
+          };
+        }
+      ];
 
       trusted_key_servers = [
         { server_name = "matrix.org"; }
@@ -192,6 +211,9 @@ in {
     };
   };
 
+  services.matrix-synapse.sliding-sync.environmentFile = config.sops.secrets."matrix/sliding-sync/env".path;
+
+
   services.redis.servers."".enable = true;
   
   services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [({

hosts/brzeczyszczykiewicz/configuration.nix

@@ -0,0 +1,36 @@
+{ config, pkgs, values, ... }:
+{
+  imports = [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ../../base.nix
+      ../../misc/metrics-exporters.nix
+
+      ../../modules/grzegorz.nix
+    ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "brzeczyszczykiewicz";
+
+  systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
+    matchConfig.Name = "eno1";
+    address = with values.hosts.brzeczyszczykiewicz; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  };
+
+  # List packages installed in system profile
+  environment.systemPackages = with pkgs; [
+  ];
+
+  # List services that you want to enable:
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+
+}

hosts/brzeczyszczykiewicz/hardware-configuration.nix

@@ -0,0 +1,39 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/82E3-3D03";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/d0bf9a21-44bc-44a3-ae55-8f0971875883"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/georg/configuration.nix

@@ -0,0 +1,36 @@
+{ config, pkgs, values, ... }:
+{
+  imports = [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ../../base.nix
+      ../../misc/metrics-exporters.nix
+
+      ../../modules/grzegorz.nix
+    ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "georg";
+
+  systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
+    matchConfig.Name = "eno1";
+    address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  };
+
+  # List packages installed in system profile
+  environment.systemPackages = with pkgs; [
+  ];
+
+  # List services that you want to enable:
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+
+}

hosts/georg/hardware-configuration.nix

@@ -0,0 +1,40 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/145E-7362";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s2.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/grevling/configuration.nix

@@ -0,0 +1,36 @@
+{ config, pkgs, values, ... }:
+{
+  imports = [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ../../base.nix
+      ../../misc/metrics-exporters.nix
+
+      ./services/openvpn
+    ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "grevling";
+
+  # systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
+  #   matchConfig.Name = "eno1";
+  #   address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  # };
+
+  # List packages installed in system profile
+  environment.systemPackages = with pkgs; [
+  ];
+
+  # List services that you want to enable:
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+
+}

hosts/grevling/hardware-configuration.nix

@@ -0,0 +1,40 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/145E-7362";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s2.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/grevling/services/openvpn/default.nix

@@ -0,0 +1,77 @@
+{ pkgs, lib, values, ... }:
+{
+  services.openvpn.servers."ov-tunnel" = {
+    config = let
+      conf = {
+        # TODO: use aliases
+        local = "129.241.210.191";
+        port = 1194;
+        proto = "udp";
+        dev = "tap";
+
+        # TODO: set up
+        ca = "";
+        cert = "";
+        key = "";
+        dh = "";
+
+        # Maintain a record of client <-> virtual IP address
+        # associations in this file.  If OpenVPN goes down or
+        # is restarted, reconnecting clients can be assigned
+        # the same virtual IP address from the pool that was
+        # previously assigned.
+        ifconfig-pool-persist = ./ipp.txt;
+
+        server-bridge = builtins.concatStringsSep " " [
+          "129.241.210.129"
+          "255.255.255.128"
+          "129.241.210.253"
+          "129.241.210.254"
+        ];
+
+        keepalive = "10 120";
+        cipher = "none";
+
+        user = "nobody";
+        group = "nobody";
+
+        status = "/var/log/openvpn-status.log";
+
+        client-config-dir = pkgs.writeTextDir "tuba" ''
+          # Sett IP-adr. for tap0 til tubas PVV-adr.
+          ifconfig-push ${values.services.tuba-tap} 255.255.255.128
+          # Hvordan skal man faa dette til aa funke, tro?
+          #ifconfig-ipv6-push 2001:700:300:1900::xxx/64
+          
+          # La tuba bruke std. PVV-gateway til all trafikk (unntatt
+          # VPN-tunnellen).
+          push "redirect-gateway"
+        '';
+
+        persist-key = true;
+        persist-tun = true;
+
+        verb = 5;
+
+        explicit-exit-notify = 1;
+      };
+    in lib.pipe conf [
+      (lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
+      (builtins.mapAttrs (_: value:
+        if builtins.isList value then builtins.concatStringsSep " " (map toString value)
+        else if value == true then value
+        else if builtins.any (f: f value) [
+          builtins.isString
+          builtins.isInt
+          builtins.isFloat
+          lib.isPath
+          lib.isDerivation
+        ] then toString value
+        else throw "Unknown value in grevling openvpn config, deading now\n${value}"
+      ))
+      (lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
+      (builtins.concatStringsSep "\n")
+      (x: x + "\n\n")
+    ];
+  };
+}

hosts/tuba/configuration.nix

@@ -0,0 +1,36 @@
+{ config, pkgs, values, ... }:
+{
+  imports = [
+      # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ../../base.nix
+      ../../misc/metrics-exporters.nix
+
+      ./services/openvpn
+    ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "tuba";
+
+  # systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
+  #   matchConfig.Name = "eno1";
+  #   address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  # };
+
+  # List packages installed in system profile
+  environment.systemPackages = with pkgs; [
+  ];
+
+  # List services that you want to enable:
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+
+}

hosts/tuba/hardware-configuration.nix

@@ -0,0 +1,40 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/145E-7362";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s2.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/tuba/services/openvpn/default.nix

@@ -0,0 +1,54 @@
+{ lib, values, ... }:
+{
+  services.openvpn.servers."ov-tunnel" = {
+    config = let
+      conf = {
+        # TODO: use aliases
+        client = true;
+        dev = "tap";
+        proto = "udp";
+        remote = "129.241.210.191 1194";
+
+        resolv-retry = "infinite";
+        nobind = true;
+
+        # # TODO: set up
+        ca = "";
+        cert = "";
+        key = "";
+        remote-cert-tls = "server";
+        cipher = "none";
+
+        user = "nobody";
+        group = "nobody";
+
+        status = "/var/log/openvpn-status.log";
+
+        persist-key = true;
+        persist-tun = true;
+
+        verb = 5;
+
+        # script-security = 2;
+        # up = "systemctl restart rwhod";
+      };
+    in lib.pipe conf [
+      (lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
+      (builtins.mapAttrs (_: value:
+        if builtins.isList value then builtins.concatStringsSep " " (map toString value)
+        else if value == true then value
+        else if builtins.any (f: f value) [
+          builtins.isString
+          builtins.isInt
+          builtins.isFloat
+          lib.isPath
+          lib.isDerivation
+        ] then toString value
+        else throw "Unknown value in tuba openvpn config, deading now\n${value}"
+      ))
+      (lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
+      (builtins.concatStringsSep "\n")
+      (x: x + "\n\n")
+    ];
+  };
+}

modules/grzegorz.nix

@@ -0,0 +1,62 @@
+{config, lib, pkgs, ...}:
+let
+  grg = config.services.grzegorz;
+  grgw = config.services.grzegorz-webui;
+in {
+  services.pipewire.enable = true;
+  services.pipewire.alsa.enable = true;
+  services.pipewire.alsa.support32Bit = true;
+  services.pipewire.pulse.enable = true;
+
+  users.users.pvv = {
+    isNormalUser = true;
+    description = "pvv";
+  };
+
+  services.grzegorz.enable = true;
+  services.grzegorz.listenAddr = "localhost";
+  services.grzegorz.listenPort = 31337;
+
+  services.grzegorz-webui.enable = true;
+  services.grzegorz-webui.listenAddr = "localhost";
+  services.grzegorz-webui.listenPort = 42069;
+  services.grzegorz-webui.listenWebsocketPort = 42042;
+  services.grzegorz-webui.hostName = "${config.networking.fqdn}";
+  services.grzegorz-webui.apiBase = "http://${toString grg.listenAddr}:${toString grg.listenPort}/api";
+
+  security.acme.acceptTerms = true;
+  security.acme.defaults.email = "pederbs@pvv.ntnu.no";
+
+  services.nginx.enable = true;
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  services.nginx.virtualHosts."${config.networking.fqdn}" = {
+    forceSSL = true;
+    enableACME = true;
+    serverAliases = [
+      "${config.networking.hostName}.pvv.org"
+    ];
+    extraConfig = ''
+      allow 129.241.210.128/25;
+      allow 2001:700:300:1900::/64;
+      deny all;
+    '';
+
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenPort}";
+    };
+    # https://github.com/rawpython/remi/issues/216
+    locations."/websocket" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenWebsocketPort}";
+      proxyWebsockets = true;
+    };
+    locations."/api" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
+    };
+    locations."/docs" = {
+      proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
+    };
+  };
+
+}
+

modules/wackattack-ctf-stockfish/chess.py

@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+from stockfish import *
+from inputimeout import inputimeout
+import time
+from datetime import datetime
+import random
+
+thinking_time = 1000
+
+game = Stockfish(path="./stockfish", depth=15, parameters={"Threads": 1, "Minimum Thinking Time": thinking_time, "UCI_Chess960": True})
+
+def create_random_position():
+    pos = "/pppppppp/8/8/8/8/PPPPPPPP/"
+    rank8 = ["r","r","b","q","k","b","n","n"]
+
+    while rank8.index("k") < [i for i, n in enumerate(rank8) if n == "r"][0] or rank8.index("k") > [i for i, n in enumerate(rank8) if n == "r"][1] or [i for i, n in enumerate(rank8) if n == "b"][0] % 2 == [i for i, n in enumerate(rank8) if n == "b"][1] % 2:
+        random.seed(datetime.now().microsecond)
+        random.shuffle(rank8)
+
+    rank1 = [c.upper() for c in rank8]
+    pos = "".join(rank8) + pos + "".join(rank1) + " w KQkq - 0 1"
+    game.set_fen_position(pos)
+
+def player_won():
+    with open("flag.txt") as file:
+        flag = file.read()
+    print(flag)
+    exit()
+
+def get_fast_player_move():
+    try:
+        time_over = inputimeout(prompt='Your move: ', timeout=5)
+    except Exception:
+        time_over = 'Too slow, you lost!'
+        print(time_over)
+        exit()
+    return time_over
+
+def check_game_status():
+    evaluation = game.get_evaluation()
+    turn = game.get_fen_position().split(" ")[1]
+    if evaluation["type"] == "mate" and evaluation["value"] == 0 and turn == "w":
+        print("Wow, you beat me!")
+        player_won()
+    elif evaluation["type"] == "mate" and evaluation["value"] == 0 and turn == "b":
+        print("Hah, I won again")
+        exit()
+    if evaluation["type"] == "draw":
+        print("It's a draw!")
+        print("Impressive, but I am still undefeated.")
+        exit()
+
+if __name__ == "__main__":
+    create_random_position()
+    print("Welcome to fischer chess.\nYou get 5 seconds per move. Good luck")
+    print(game.get_board_visual())
+    print("Heres the position for this game, Ill give you a few seconds to look at it before we start.")
+    time.sleep(3)
+    while True:
+        server_move = game.get_best_move_time(thinking_time)
+        game.make_moves_from_current_position([server_move])
+        check_game_status()
+        print(game.get_board_visual())
+        print(f"My move: {server_move}")
+        player_move = get_fast_player_move()
+        if type(player_move) != str or len([player_move]) != 1:
+            print("Illegal input")
+            exit()
+        try:
+            game.make_moves_from_current_position([player_move])
+            check_game_status()
+        except:
+            print("Couldn't comprehend that")
+            exit()

modules/wackattack-ctf-stockfish/default.nix

@@ -0,0 +1,108 @@
+{ config, pkgs, lib, ... }: let
+  stockfish = with pkgs.python3Packages; buildPythonPackage rec {
+    pname = "stockfish";
+    version = "3.28.0";
+    disabled = pythonOlder "3.7";
+
+    src = pkgs.fetchFromGitHub {
+      owner = "zhelyabuzhsky";
+      repo = pname;
+      rev = version;
+      hash = "sha256-XLgVjLV2QXeTYPjP/lwc0LH850LKJsymFlrAMkAn8HU=";
+    };
+
+    format = "setuptools";
+    nativeBuildInputs = [
+      setuptools
+    ];
+
+    propagatedBuildInputs = [
+      pytest-runner
+    ];
+
+    doCheck = false;
+  };
+
+  inputimeout = with pkgs.python3Packages; buildPythonPackage rec {
+    pname = "inputimeout";
+    version = "1.0.4";
+    src = pkgs.fetchFromGitHub {
+      owner = "johejo";
+      repo = pname;
+      rev = "v${version}";
+      hash = "sha256-Fh1CaqJOK58nURt4imkhCmZKG2eJlP/Hi10SarUJ+Fs=";
+    };
+
+    format = "setuptools";
+    nativeBuildInputs = [ setuptools ];
+
+    doCheck = false;
+  };
+
+  script = pkgs.writers.writePython3 "chess" {
+    libraries = [
+      stockfish
+      inputimeout   
+    ];
+
+    # Fy!
+    flakeIgnore = [ "F403" "F405" "E231" "E265" "E302" "E305" "E501" "E722" ];
+  } (builtins.replaceStrings [''path="./stockfish"''] [''path="${pkgs.stockfish}/bin/stockfish"''] (builtins.readFile ./chess.py));
+in
+{
+  sops.secrets."keys/wackattack_ctf/flag" = { };
+
+  systemd.sockets."wackattack-ctf-stockfish" = {
+    description = "Save some azure credit for the rest of us";
+    partOf = [ "wackattack-ctf-stockfish.service" ];
+    wantedBy = [ "sockets.target" ];
+
+    socketConfig = {
+      ListenStream = "0.0.0.0:9999";
+      Accept = true;
+    };
+  };
+
+  systemd.services."wackattack-ctf-stockfish@" = {
+    description = "Save some azure credit for the rest of us";
+    after = [ "network.target" ];
+    requires = [ "wackattack-ctf-stockfish.socket" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "simple";
+      DynamicUser = true;
+      WorkingDirectory = "%d";
+      Restart = "always";
+      StandardInput = "socket";
+      LoadCredential = "flag.txt:${config.sops.secrets."keys/wackattack_ctf/flag".path}";
+
+      Exec = script;
+
+      # systemd hardening go barr
+      ProcSubset = "pid";
+      ProtectProc = "invisible";
+      AmbientCapabilities = "";
+      CapabilityBoundingSet = "";
+      NoNewPrivileges = true;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      PrivateTmp = true;
+      PrivateDevices = true;
+      PrivateUsers = true;
+      ProtectHostname = true;
+      ProtectClock = true;
+      ProtectKernelTunables = true;
+      ProtectKernelModules = true;
+      ProtectKernelLogs = true;
+      ProtectControlGroups = true;
+      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+      RestrictNamespaces = true;
+      LockPersonality = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      RemoveIPC = true;
+      PrivateMounts = true;
+      SystemCallArchitectures = "native";
+    };
+  };
+}

pkgs/minecraft-server-fabric/default.nix

@@ -1,43 +0,0 @@
-{ callPackage, writeTextFile, writeShellScriptBin, minecraft-server, jre_headless }:
-
-let
-  loader = callPackage ./generate-loader.nix {};
-  log4j = writeTextFile {
-    name = "log4j.xml";
-    text = ''
-      <?xml version="1.0" encoding="UTF-8"?>
-      <Configuration status="WARN" packages="com.mojang.util">
-          <Appenders>
-              <Console name="SysOut" target="SYSTEM_OUT">
-                  <PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg%n" />
-              </Console>
-              <Queue name="ServerGuiConsole">
-                  <PatternLayout pattern="[%d{HH:mm:ss} %level]: %msg%n" />
-              </Queue>
-              <RollingRandomAccessFile name="File" fileName="logs/latest.log" filePattern="logs/%d{yyyy-MM-dd}-%i.log.gz">
-                  <PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg%n" />
-                  <Policies>
-                      <TimeBasedTriggeringPolicy />
-                      <OnStartupTriggeringPolicy />
-                  </Policies>
-                  <DefaultRolloverStrategy max="1000"/>
-              </RollingRandomAccessFile>
-          </Appenders>
-          <Loggers>
-              <Root level="info">
-                  <filters>
-                      <MarkerFilter marker="NETWORK_PACKETS" onMatch="DENY" onMismatch="NEUTRAL" />
-                  </filters>
-                  <AppenderRef ref="SysOut"/>
-                  <AppenderRef ref="File"/>
-                  <AppenderRef ref="ServerGuiConsole"/>
-              </Root>
-          </Loggers>
-      </Configuration>
-    '';
-  };
-in
-writeShellScriptBin "minecraft-server" ''
-  echo "serverJar=${minecraft-server}/lib/minecraft/server.jar" >> fabric-server-launcher.properties
-  exec ${jre_headless}/bin/java -Dlog4j.configurationFile=${log4j} $@ -jar ${loader} nogui
-''

pkgs/minecraft-server-fabric/generate-loader.nix

@@ -1,38 +0,0 @@
-{ lib, fetchurl, stdenv, unzip, zip, jre_headless }:
-
-let
-  lock = import ./lock.nix;
-  libraries = lib.forEach lock.libraries fetchurl;
-in
-stdenv.mkDerivation {
-  name = "fabric-server-launch.jar";
-  nativeBuildInputs = [ unzip zip jre_headless ];
-
-  libraries = libraries;
-
-  buildPhase = ''
-    for i in $libraries; do
-      unzip -o $i
-    done
-
-    cat > META-INF/MANIFEST.MF << EOF
-    Manifest-Version: 1.0
-    Main-Class: net.fabricmc.loader.impl.launch.server.FabricServerLauncher
-    Name: org/objectweb/asm/
-    Implementation-Version: 9.2
-    EOF
-
-    cat > fabric-server-launch.properties << EOF
-    launch.mainClass=net.fabricmc.loader.impl.launch.knot.KnotServer
-    EOF
-  '';
-
-  installPhase = ''
-    jar cmvf META-INF/MANIFEST.MF "server.jar" .
-    zip -d server.jar 'META-INF/*.SF' 'META-INF/*.RSA' 'META-INF/*.DSA'
-    cp server.jar "$out"
-  '';
-
-  phases = [ "buildPhase" "installPhase" ];
-}
-

pkgs/minecraft-server-fabric/generate-lock-nix.sh

@@ -1,22 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash curl jq
-curl https://meta.fabricmc.net/v2/versions/loader/1.18.1/0.12.12/server/json \
-| jq -r '
-  .mainClass,
-  (.libraries[]
-  | .url as $url
-  | .name | split(":") as [$dir, $name, $version]
-  |"\($name)-\($version).zip|\($url)\($dir|sub("\\.";"/";"g"))/\($name)/\($version)/\($name)-\($version).jar"
-  )' \
-| {
-    echo '{'
-    read mainClass;
-    echo "  mainClass = \"$mainClass\";"
-    echo "  libraries = ["
-    while IFS="|" read name url; do
-        hash=$(nix-prefetch-url $url);
-        echo "    { name = \"$name\"; sha256 = \"$hash\"; url = \"$url\"; }"
-    done
-    echo "  ];"
-    echo '}'
-}

pkgs/minecraft-server-fabric/lock.nix

@@ -1,16 +0,0 @@
-{
-  mainClass = "net.fabricmc.loader.impl.launch.knot.KnotServer";
-  libraries = [
-    { name = "tiny-mappings-parser-0.3.0+build.17.zip"; sha256 = "19kvhxfk5v01f2rvl7j02vqhn3nd2bh5jsgbk44rpzqv9f6074db"; url = "https://maven.fabricmc.net/net/fabricmc/tiny-mappings-parser/0.3.0+build.17/tiny-mappings-parser-0.3.0+build.17.jar"; }
-    { name = "sponge-mixin-0.10.7+mixin.0.8.4.zip"; sha256 = "18m5wksd9vjp676cxapkggnz8s3f8j89phln8gy5n8vxlrli8n0d"; url = "https://maven.fabricmc.net/net/fabricmc/sponge-mixin/0.10.7+mixin.0.8.4/sponge-mixin-0.10.7+mixin.0.8.4.jar"; }
-    { name = "tiny-remapper-0.6.0.zip"; sha256 = "1ynjfxg7cj9rd9c4l450w7yp20p2csjdpnk3mcx5bdkjzhbgvgzf"; url = "https://maven.fabricmc.net/net/fabricmc/tiny-remapper/0.6.0/tiny-remapper-0.6.0.jar"; }
-    { name = "access-widener-2.0.1.zip"; sha256 = "0a7s4x6dbaa9p59ps7pidzwrs0xwy5i17s35xrgh58i26szlsaxm"; url = "https://maven.fabricmc.net/net/fabricmc/access-widener/2.0.1/access-widener-2.0.1.jar"; }
-    { name = "asm-9.2.zip"; sha256 = "1xa7kccwmcqcdw1xly6n2frzhk56m8ma9v7h764g73ckf56zxm5r"; url = "https://maven.fabricmc.net/org/ow2/asm/asm/9.2/asm-9.2.jar"; }
-    { name = "asm-analysis-9.2.zip"; sha256 = "1i1kyirizs5sm2v0f06sdz86mbmyn61vjr9d9p8p5h1i2x9bx3w7"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-analysis/9.2/asm-analysis-9.2.jar"; }
-    { name = "asm-commons-9.2.zip"; sha256 = "19p04mr14ahndba65v4krbvf4p5syf8wz0fp5i9bnf5270qyak5y"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-commons/9.2/asm-commons-9.2.jar"; }
-    { name = "asm-tree-9.2.zip"; sha256 = "04g0zb7v65iz4k2m2grdpbv8jjryrzkkw7ww23yfp94i6399pgxa"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-tree/9.2/asm-tree-9.2.jar"; }
-    { name = "asm-util-9.2.zip"; sha256 = "16759v4hh3ijpf4cglrxybz29x2hiylhsa388y09m2mf679kqnzz"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-util/9.2/asm-util-9.2.jar"; }
-    { name = "intermediary-1.18.1.zip"; sha256 = "1rfz2gazvnivn6hlqiyjpiaycz8va87n5czy1p6w3lnrlfggj2i9"; url = "https://maven.fabricmc.net/net/fabricmc/intermediary/1.18.1/intermediary-1.18.1.jar"; }
-    { name = "fabric-loader-0.12.12.zip"; sha256 = "070dpcp7kcj4xr75wp1j6pb1bgfzllwg8xmqk3sk79jfqiqwzizw"; url = "https://maven.fabricmc.net/net/fabricmc/fabric-loader/0.12.12/fabric-loader-0.12.12.jar"; }
-  ];
-}

pkgs/minecraft-server/1_18_1.nix

@@ -1,38 +0,0 @@
-{ lib, stdenv, fetchurl, nixosTests, jre_headless }:
-stdenv.mkDerivation {
-  pname = "minecraft-server";
-  version = "1.18.1";
-
-  src = fetchurl {
-    url = "https://launcher.mojang.com/v1/objects/125e5adf40c659fd3bce3e66e67a16bb49ecc1b9/server.jar";
-    # sha1 because that comes from mojang via api
-    sha1 = "125e5adf40c659fd3bce3e66e67a16bb49ecc1b9";
-  };
-
-  preferLocalBuild = true;
-
-  installPhase = ''
-    mkdir -p $out/bin $out/lib/minecraft
-    cp -v $src $out/lib/minecraft/server.jar
-    cat > $out/bin/minecraft-server << EOF
-    #!/bin/sh
-    exec ${jre_headless}/bin/java \$@ -jar $out/lib/minecraft/server.jar nogui
-    EOF
-    chmod +x $out/bin/minecraft-server
-  '';
-
-  dontUnpack = true;
-
-  passthru = {
-    tests = { inherit (nixosTests) minecraft-server; };
-    updateScript = ./update.sh;
-  };
-
-  meta = with lib; {
-    description = "Minecraft Server";
-    homepage = "https://minecraft.net";
-    license = licenses.unfreeRedistributable;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ thoughtpolice tomberek costrouc ];
-  };
-}

secrets/bekkalokk/bekkalokk.yaml

@@ -11,10 +11,11 @@ gitea:
 mediawiki:
     password: ENC[AES256_GCM,data:HsBuA1E7187roGnKuFPfPDYxA16GFjAUucgUtrdUFmcOzmTNiFH+NWY2ZQ==,iv:vDYUmmZftcrkDtJxNYKAJSx9j+AQcmQarC62QRHR4IM=,tag:3TKjNrGRivFWoK3djC748g==,type:str]
     database: ENC[AES256_GCM,data:EvVK3Mo6cZiIZS+gTxixU4r9SXN41VqwaWOtortZRNH+WPJ4xcYvzYMJNg==,iv:JtFTRLn3fzKIfgAPRqRgQjct7EdkEHtiyQKPy8/sZ2Q=,tag:nqzseG6BC0X5UNI/3kZZ3A==,type:str]
-    oidc:
-        clientsecret: ENC[AES256_GCM,data:bh016Qlijs5hoNY1iYsx6uEa5oEG9aX4T9BMiqnDRhSh7iVXpj9A6glcr8OGmWN7Om7yXE4AdlY=,iv:BnZjxbK6oB1eALx3RidpkwzU8xz1x0luwZC7ioqTjQE=,tag:HX8uUevimnAcqBH8NaMQXA==,type:str]
 keycloak:
     database: ENC[AES256_GCM,data:76+AZnNR5EiturTP7BdOCKE90bFFkfGlRtviSP5NHxPbb3RfFPJEMlwtzA==,iv:nS7VTossHdlrHjPeethhX+Ysp9ukrb5JD7kjG28OFpY=,tag:OMpiEv9nQA7v6lWJfNxEEw==,type:str]
+keys:
+    wackattack_ctf:
+        flag: ENC[AES256_GCM,data:cZCaGb/u/OZgAvXnuJPL3XqmnIa26Rl2IUpWpG/fpt/dJ7+/KssXVa6A5G6ObQhF7deCmTxuoVP8JU+DQzYRr0ftvKhLJ87rgzrE3j+UkA==,iv:3uFkNqXlVj94klU20yPIUd8tIeyUIfp0++2wkdIkiYM=,tag:OZMyEt118u10F5vSUFZE7A==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -48,8 +49,8 @@ sops:
             akVjeTNTeGorZjJQOVlMeCtPRUVYL3MK+VMvGxrbzGz4Q3sdaDDWjal+OiK+JYKX
             GHiMXVHQJZu/RrlxMjHKN6V3iaqxZpuvLAEJ2Lzy5EOHPtuiiRyeHQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-09-17T21:12:05Z"
+    lastmodified: "2023-10-26T19:59:04Z"
-    mac: ENC[AES256_GCM,data:wfq3FTwwJh2eHbw5PW32IEp4jWeSQLaBLJzrbgfXUPP8VuPK3Q7puQtchsQ3Xrv2+c9FI536luhwaUPfgn+/JE8rn8KEhabMPrX2lYMVH8I4OkCYEivpbWNfmm3gfNU2SrEFZ2jBBLLCWDgBAA7SfyApiQiyZ3qpJ2aZCfgaUoM=,iv:5/R2tnjiQ6BPgU+eAChm2EsWuGurqumnzl4pfjZclLw=,tag:xdECs8muNv9c/68IRbWzCw==,type:str]
+    mac: ENC[AES256_GCM,data:uH0RfKBjjbYvxjl4XyoXWvwUpi+W7IQZjBdC5UoslotToTw0xnici2fKxPNZ9aFJsukLMPLC+tsT/shUqW373f/NyhsJt0Vb2YtuozFQyQstZQEpnm4WuVoFR/MEjAra/PaM4ATHSGgDuHa7qrpdKTLnrMOai5ZqxLfFbLws3dA=,iv:47hHzrnfZG5NtCN0HjziZdDBJTr451/kvY95GpB3G2M=,tag:3TCs7DSeWB6NujDUlQVGjA==,type:str]
     pgp:
         - created_at: "2023-05-21T00:28:40Z"
           enc: |
@@ -72,4 +73,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1

secrets/bicep/matrix.yaml

@@ -2,6 +2,8 @@ synapse:
     turnconfig: ENC[AES256_GCM,data:mASRjYa4C9WRow4x0XYRrlCE5LMJUYaId+o62r1qhsyJPa2LzrI=,iv:5vYdubvMDjLS6soiWx2DzkEAATb9NFbSS/Jhuuz1yI8=,tag:wOW07CQMDbOiZNervee/pg==,type:str]
     user_registration: ENC[AES256_GCM,data:ZDZfEEvyw8pg0WzhrdC8747ed+ZR2ZA8/WypJd/iDkmIy2RmxOeI0sE=,iv:l61mOlvzpCql4fC/eubBSU6px21et2WcpxQ6rFl14iw=,tag:sVDEAa3xipKIi/6isCjWew==,type:str]
     signing_key: ENC[AES256_GCM,data:6UpfiRlX9pRM7zhdm7Mc8y8EItLzugWkHSgE0tGpEmudCTa1wc60oNbYfhKDWU81DT/U148pZOoX1A==,iv:UlqCPicPm5eNBz1xBMI3A3Rn4t/GtldNIDdMH5MMnLw=,tag:HHaw6iMjEAv5b9mjHSVpwA==,type:str]
+sliding-sync:
+    env: ENC[AES256_GCM,data:DsU1qKTy5sn06Y0S5kFUqZHML20n6HdHUdXsQRUw,iv:/TNTc+StAZbf6pBY9CeXdxkx8E+3bak/wOqHyBNMprU=,tag:er5u4FRlSmUZrOT/sj+RhQ==,type:str]
 coturn:
     static-auth-secret: ENC[AES256_GCM,data:y5cG/LyrorkDH+8YrgcV7DY=,iv:ca90q2J3+NOy51mUBy4TMKfYMgWL4hxWDdsKIuxRBgU=,tag:hpFCns1lpi07paHyGB7tGQ==,type:str]
 mjolnir:
@@ -41,8 +43,8 @@ sops:
             cGxZVnFhdXRka2drTGdkVk1iM0pFL1kK2ry7b2cLYPfntWi/BV3K2O+mHt3242Ef
             sI2JLLQYHeAhxjFdCzP1RDR+Wu/pRxZje6xuTZ9I9TKNmm+LhAXHQw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-09-15T04:40:21Z"
+    lastmodified: "2023-10-22T00:31:46Z"
-    mac: ENC[AES256_GCM,data:ZJVHLbpSu/nIzl5FJfRdg2ymRN5M+zJXNUpi1hBt2MBmvK+1ed2ElhMe5x7pyasSDdaUtXDo7ghkUF7vE46Wo6Z9dvlAvhwWm7Y2AWfUe5SFVwzqlOCjSKRPFrQrL7PcDBtMj4twtwhc4XsfJoUSuigWW2m21BKtEZSuuxLRqLA=,iv:ufFbfMaNHydbkwq6lxN1dQJldkAbtqais/CZFkoDhb4=,tag:uMj0LaiU0obIlw/+HJJdKg==,type:str]
+    mac: ENC[AES256_GCM,data:UpnaUfRxvdyzBy5x4EC3w5LQ1qWxILTQhpyVPd9whTzQMAivAHT0pVmP9aE4T9w3NcWTaghp+f70GmQXx/OCC6DsRCWtU9pFHRj12YUowM3yB5lVTOomOLZQ9m4gUXw5I2GZHWBJn8CyosDcBMlXz2tiR91v/8Ulh6sDSAO86U0=,iv:5GcgRvbpqDEslZruKHM/TcMaF52A5X7AK41DEbrsRIQ=,tag:ndDgCRyX1aDRnzEUNmpoMw==,type:str]
     pgp:
         - created_at: "2023-05-06T21:31:39Z"
           enc: |

users/adriangl.nix

@@ -0,0 +1,20 @@
+{ pkgs, ... }:
+{
+  users.users.adriangl = {
+    isNormalUser = true;
+    description = "(0_0)";
+    extraGroups = [
+      "wheel"
+      "drift"
+    ];
+
+    packages = with pkgs; [
+      exa
+      neovim
+    ];
+
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFa5y7KyLn2tjxed1czMbyM5scnEpo9v/GfnhL/28ckM legolas"
+    ];
+  };
+}

values.nix

@@ -4,7 +4,7 @@ let
   pvv-ipv6 = suffix: "2001:700:300:1900::${toString suffix}";
 in rec {
   ipv4-space = pvv-ipv4 "128/25";
-  ipv6-space = pvv-ipv4 "/64";
+  ipv6-space = pvv-ipv6 "/64";
 
   services = {
     matrix = {
@@ -21,6 +21,12 @@ in rec {
       ipv4 = pvv-ipv4 213;
       ipv6 = pvv-ipv6 213;
     };
+    grevling-tap = {
+      ipv4 = pvv-ipv4 251;
+    };
+    tuba-tap = {
+      ipv4 = pvv-ipv4 252;
+    };
   };
 
   hosts = {
@@ -41,6 +47,22 @@ in rec {
       ipv4 = pvv-ipv4 196;
       ipv6 = pvv-ipv6 196;
     };
+    brzeczyszczykiewicz = {
+      ipv4 = pvv-ipv4 205;
+      ipv6 = pvv-ipv6 "1:50"; # Wtf peder why
+    };
+    georg = {
+      ipv4 = pvv-ipv4 204;
+      ipv6 = pvv-ipv6 "1:4f"; # Wtf øystein og daniel why
+    };
+    grevling = {
+      ipv4 = pvv-ipv4 198;
+      ipv6 = pvv-ipv6 198;
+    };
+    tuba = {
+      ipv4 = pvv-ipv4 199;
+      ipv6 = pvv-ipv6 199;
+    };
   };
 
   defaultNetworkConfig = {