1
0
Fork 0

Compare commits

...

203 Commits
main ... main

Author SHA1 Message Date
Felix Albrigtsen aa884353c7 Merge pull request 'Add ipv6 gateway' (!82) from ipv6-fix into main
Reviewed-on: Drift/pvv-nixos-config#82
Reviewed-by: Daniel Lovbrotte Olsen <danio@pvv.ntnu.no>
2024-09-28 21:44:55 +02:00
Felix Albrigtsen 2147b56864 Add ipv6 gateway 2024-09-28 21:35:57 +02:00
Daniel Lovbrotte Olsen a7fe2aabc5 bicep/matrix/coturn: disable ipv6 to fix the service running at all
coturn is just fundamentally broken, look at trying eturnal instead
2024-09-27 07:30:48 +02:00
Daniel Lovbrotte Olsen cd23e35aac bicep/matrix: update module and remove deprecated options 2024-09-27 06:38:12 +02:00
Peder Bergebakken Sundt 06668cda79 Merge pull request 'flake.lock: Update' (!81) from sounding into main
Reviewed-on: Drift/pvv-nixos-config#81
Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
2024-09-21 22:19:36 +02:00
Peder Bergebakken Sundt 2861f939b7 Merge pull request 'auto-upgrade: store flake input refs' (!80) from retain-flake-inputs into main
Reviewed-on: Drift/pvv-nixos-config#80
Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
2024-09-21 22:19:18 +02:00
Peder Bergebakken Sundt 166b80988a flake.lock: Update
Flake lock file updates:

• Updated input 'grzegorz':
    'github:Programvareverkstedet/grzegorz/0481aef6553ae9aee86e4edb4ca0ed4f2eba2058' (2024-05-18)
  → 'git+https://git.pvv.ntnu.no/Projects/grzegorz.git?ref=refs/heads/master&rev=d10db19d7df5c5c2cd2dcb878376d5d681f6c2f2' (2024-09-20)
• Updated input 'grzegorz/fix-python':
    'github:GuillaumeDesforges/fix-python/f7f4b33e22414071fc1f9cbf68072c413c3a7fdf' (2024-04-23)
  → 'github:GuillaumeDesforges/fix-python/2926402234c3f99aa8e4608c51d9ffa73ea403c0' (2024-09-04)
• Updated input 'grzegorz-clients':
    'github:Programvareverkstedet/grzegorz-clients/b9444658fbb39cd1bf1c61ee5a1d5f0641c49abe' (2024-05-19)
  → 'git+https://git.pvv.ntnu.no/Projects/grzegorz-clients.git?ref=refs/heads/master&rev=546d921ec46735dbf876e36f4af8df1064d09432' (2024-09-20)
2024-09-20 22:49:19 +02:00
Peder Bergebakken Sundt 4913b22ab9 auto-upgrade: store flake input refs 2024-09-16 02:51:20 +02:00
Peder Bergebakken Sundt 4e81647fb6 auto-upgrade: `--update-input` -> `--override-input` 2024-09-15 19:14:03 +02:00
Felix Albrigtsen 5a76b62700 Merge pull request 'add gitea metrics' (!78) from gitea-metric into main
Reviewed-on: Drift/pvv-nixos-config#78
Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
2024-09-14 20:33:28 +02:00
Felix Albrigtsen 0f77a42e34 Grafana: Add Gitea Dashbaord [sic] 2024-09-14 20:28:35 +02:00
Felix Albrigtsen c64d28fc26 Prometheus: Monitor gitea metrics 2024-09-14 20:21:12 +02:00
Dung-Bai Yen 179d0743ce gitea: export metric issue #101 2024-09-14 19:26:25 +02:00
Daniel Lovbrotte Olsen 47fa3759c3 buskerud: remove
This is now a proxmox machine :grr:
2024-09-05 18:00:42 +02:00
Daniel Lovbrotte Olsen 3a37fefd4d fixup! Merge pull request 'Fix Ildkule/Openstack networking' (!75) from fix-openstack-networking into main 2024-09-05 14:24:40 +02:00
Daniel Lovbrotte Olsen 47d7b88a05 ildkule/prometheus: consolidate scrape jobs and label with hostname for base info 2024-09-05 14:14:28 +02:00
Daniel Lovbrotte Olsen 78456063ba Merge pull request 'Fix Ildkule/Openstack networking' (!75) from fix-openstack-networking into main
Reviewed-on: Drift/pvv-nixos-config#75
2024-09-05 01:58:50 +02:00
Felix Albrigtsen ca287b95c9 Ildkule/openstack: fix networking
Removes systemd-networkd, and configures proper ipv4 and ipv6 in
openstack.
2024-09-05 00:24:22 +02:00
Daniel Lovbrotte Olsen 7e95b77e15 grzegorz: follow stable nix channel
It broke because sanic
2024-09-03 13:28:13 +02:00
Daniel Lovbrotte Olsen 669733309b ildkule: get systemd stats from more machines 2024-09-03 13:10:36 +02:00
Daniel Lovbrotte Olsen 4ed12573ff ildkule: fix system activation by disabling smartd 2024-09-03 13:07:58 +02:00
Daniel Lovbrotte Olsen 8418cc016c fix biceps systemd units failing on activation 2024-09-03 13:00:12 +02:00
Daniel Lovbrotte Olsen b4c602e31c metrics: install systemd exporter 2024-09-02 23:12:24 +02:00
Daniel Lovbrotte Olsen 3a0b8e270d bekkalokk/idp: Disallow bots 2024-09-02 23:11:44 +02:00
Daniel Lovbrotte Olsen 9505223dc9 justfile: fix flake input updating 2024-09-02 19:33:15 +02:00
Daniel Lovbrotte Olsen 201784fa21 bluemap on bekkalokk 💀 2024-09-02 15:11:32 +02:00
Daniel Lovbrotte Olsen ccefcb01fa flake.lock update 2024-09-02 14:12:39 +02:00
Daniel Lovbrotte Olsen f7e2c74f89 base: enable rebuilding nixos-config without updating the channels used 2024-09-01 22:10:58 +02:00
Felix Albrigtsen 161265d346 Bekkalokk/Nettsiden: deploy #78 2024-09-01 20:13:56 +02:00
Oystein Kristoffer Tveit f85d18769f
common: clean `/tmp` on boot by default 2024-09-01 03:29:46 +02:00
Oystein Kristoffer Tveit b47a626427
common/openssh: socket activate 2024-09-01 03:21:13 +02:00
Oystein Kristoffer Tveit 4d65b9fd1d
common/sudo: misc config 2024-09-01 03:17:15 +02:00
Oystein Kristoffer Tveit f3e094520e
common/postfix: init 2024-09-01 03:13:18 +02:00
Oystein Kristoffer Tveit 69f98933a4
common/smartd: add `smartctl` to environment packages 2024-09-01 01:55:38 +02:00
Oystein Kristoffer Tveit bf2959c68d
common/nix: flesh out 2024-09-01 01:44:59 +02:00
Oystein Kristoffer Tveit 17f0268d12
common/irqbalance: init 2024-09-01 01:39:35 +02:00
Oystein Kristoffer Tveit ebce0eb67a
common/smartd: init 2024-09-01 01:23:15 +02:00
Oystein Kristoffer Tveit b48230e811
bekkalokk/btrfs: scrubbalubba dubdub 2024-09-01 01:04:28 +02:00
Daniel Lovbrotte Olsen 914eb35c5a add a route for /_synapse/admin, point mjolnir at it
This is whitelisted to just bicep

As a side-effect it's also much easier to use synapse-admin now
2024-09-01 00:34:42 +02:00
Oystein Kristoffer Tveit 8610a59f35
base.nix: split into multiple files 2024-08-31 22:28:17 +02:00
Oystein Kristoffer Tveit bd42412b94 bekkalokk/gitea/import-users: refactor + add members to groups 2024-08-27 22:07:29 +02:00
Daniel Lovbrotte Olsen ef3b146b58 bekkalokk/gitea: don't autowatch all members to all projects 2024-08-27 09:26:00 +02:00
Oystein Kristoffer Tveit bb4662b345 modules/snakeoil-certs: fix lmao 2024-08-26 20:43:34 +02:00
Oystein Kristoffer Tveit 5b1c04e4b8 bicep/postgres: use snakeoil certs 2024-08-26 20:43:34 +02:00
Oystein Kristoffer Tveit 3fa7f67027 bekkalokk/gitea-web: host pages 2024-08-26 20:36:03 +02:00
Oystein Kristoffer Tveit b0f555667c bekkalokk/gitea: set up gitea-web sync units 2024-08-26 20:36:03 +02:00
Oystein Kristoffer Tveit ef418bf125
base/logrotate: systemd hardening + more 2024-08-22 23:00:45 +02:00
Oystein Kristoffer Tveit 945d53cdb4
bekkalokk/vaultwarden: systemd hardening 2024-08-22 22:59:32 +02:00
Oystein Kristoffer Tveit cf3b62e01e
bekkalokk/phpfpm-*: systemd hardening 2024-08-22 22:58:48 +02:00
Oystein Kristoffer Tveit c12a47cee0
flake.nix: bump calendar bot 2024-08-17 01:19:46 +02:00
Oystein Kristoffer Tveit b9ef27565f
Bump calendar-bot 2024-08-16 09:16:26 +02:00
Oystein Kristoffer Tveit f5c99b58c8
bicep/calendar-bot: reactivate 2024-08-15 23:22:50 +02:00
Peder Bergebakken Sundt c780f7954c Merge pull request 'justfile: add recipe `run-vm`' (!64) from run-vm into main
Reviewed-on: Drift/pvv-nixos-config#64
Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
2024-08-15 21:14:29 +02:00
Oystein Kristoffer Tveit d64d8edd68 bekkalokk/gitea: add some extra tabs 2024-08-14 17:36:19 +02:00
Peder Bergebakken Sundt 4de7bd09bd Merge pull request 'enable thermald on physical machines' (!61) from thermald into main
Reviewed-on: Drift/pvv-nixos-config#61
Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
2024-08-14 17:31:44 +02:00
Peder Bergebakken Sundt 0f5c48902b Merge pull request 'users: disable password login for users in @wheel' (!62) from fix-deploy into main
Reviewed-on: Drift/pvv-nixos-config#62
Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
2024-08-14 17:31:08 +02:00
Peder Bergebakken Sundt 2ff69dfec6 justfile: add recipe `run-vm` 2024-08-14 17:25:55 +02:00
Peder Bergebakken Sundt 36a8868f94 users: disable password login for users in @wheel 2024-08-11 03:42:26 +02:00
Peder Bergebakken Sundt fe3e5d6a3d enable thermald on physical machines 2024-08-10 23:55:29 +02:00
Peder Bergebakken Sundt 2f3bcaf124 shell.nix: fix typo 2024-08-10 18:15:31 +02:00
Peder Bergebakken Sundt c6684d5146 Merge pull request 'justfile: init' (!56) from justfile into main
Reviewed-on: Drift/pvv-nixos-config#56
Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
2024-08-07 12:22:04 +02:00
Peder Bergebakken Sundt f6cb934ffb Merge pull request 'flake.nix: simplify allMachines' (!59) from attrnames into main
Reviewed-on: Drift/pvv-nixos-config#59
Reviewed-by: Daniel Lovbrotte Olsen <danio@pvv.ntnu.no>
2024-08-04 23:44:54 +02:00
Peder Bergebakken Sundt 9625258942 Merge pull request 'flake.nix: export snakeoil-certs and snappymail nixos modules' (!58) from export-modules into main
Reviewed-on: Drift/pvv-nixos-config#58
Reviewed-by: Daniel Lovbrotte Olsen <danio@pvv.ntnu.no>
2024-08-04 23:44:19 +02:00
Peder Bergebakken Sundt 34637e383a justfile: add update-inputs recipe 2024-08-04 17:19:40 +02:00
Peder Bergebakken Sundt 0bfa6ac329 flake.nix: export inputs 2024-08-04 17:19:33 +02:00
Peder Bergebakken Sundt 2c3261de74 flake.nix: simplify allMachines 2024-08-04 17:11:21 +02:00
Peder Bergebakken Sundt c2e6f294ea flake.nix: export snakeoil-certs and snappymail nixos modules 2024-08-04 16:48:21 +02:00
Peder Bergebakken Sundt 41e94695f0 Merge pull request 'editorconfig' (!55) from editorconfig into main
Reviewed-on: Drift/pvv-nixos-config#55
Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
2024-08-04 16:20:23 +02:00
Peder Bergebakken Sundt c6b4ea9929 add .git-blame-ignore-revs 2024-08-04 04:39:17 +02:00
Peder Bergebakken Sundt 9dbf5d56f5 fix whitespacing issues 2024-08-04 04:37:23 +02:00
Peder Bergebakken Sundt 64b5bb548b editorconfig: init 2024-08-04 04:35:25 +02:00
Peder Bergebakken Sundt 261c8e0811 Merge pull request 'Run statix' (!54) from statix into main
Reviewed-on: Drift/pvv-nixos-config#54
Reviewed-by: Daniel Lovbrotte Olsen <danio@pvv.ntnu.no>
2024-08-04 04:26:23 +02:00
Peder Bergebakken Sundt 4476cdcbbc justfile: init 2024-08-04 03:28:17 +02:00
Peder Bergebakken Sundt f475243b94 Merge pull request 'sops: add pederbs' (!51) from pederbs-sops into main
Reviewed-on: Drift/pvv-nixos-config#51
Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
2024-08-04 02:56:31 +02:00
Peder Bergebakken Sundt f382109b4a Merge pull request 'users: add pederbs' (!49) from user-pederbs into main
Reviewed-on: Drift/pvv-nixos-config#49
Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
2024-08-04 02:46:59 +02:00
Peder Bergebakken Sundt e5e3100639 Merge pull request 'direnv: yes' (!50) from direnv into main
Reviewed-on: Drift/pvv-nixos-config#50
Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
2024-08-04 02:46:18 +02:00
Peder Bergebakken Sundt 5853e42c1b Merge pull request 'SimpleSamlPHP: use concatLines' (!53) from concatlines into main
Reviewed-on: Drift/pvv-nixos-config#53
Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
2024-08-04 02:46:01 +02:00
Peder Bergebakken Sundt d59aa08986 Merge pull request 'shell.nix: remove cc' (!52) from shell-cc into main
Reviewed-on: Drift/pvv-nixos-config#52
Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
2024-08-04 02:44:52 +02:00
Oystein Kristoffer Tveit 95a5603f27
secrets: run `sops updatekeys` on everything 2024-08-04 02:04:29 +02:00
Peder Bergebakken Sundt 1714681532 `statix fix` 2024-08-04 01:46:00 +02:00
Peder Bergebakken Sundt 314c7960d1 statix: init 2024-08-04 01:45:20 +02:00
Peder Bergebakken Sundt 43d353190c SimpleSamlPHP: use concatLines 2024-08-04 01:42:32 +02:00
Peder Bergebakken Sundt eb74d011db shell.nix: remove cc 2024-08-04 01:30:02 +02:00
Peder Bergebakken Sundt b52de48455 sops: add pederbs 2024-08-04 01:24:54 +02:00
Peder Bergebakken Sundt 510f385f4a direnv: yes 2024-08-04 01:19:22 +02:00
Peder Bergebakken Sundt e25ba96096 users: add pederbs 2024-08-04 00:58:11 +02:00
Oystein Kristoffer Tveit 53040bada1
flake.lock: update pvv-nettsiden 2024-08-04 00:09:32 +02:00
Felix Albrigtsen 2030d4de39 fix-openstack-networking (!47)
Fix networking in Openstack.

This rewrites the systemd-networkd config, fixing both dhcp and manual address/route configurations.
Now, everything should behave predictably, routing NTNU-internal and NTNU-global addresses separately and properly across both ipv4 and ipv6.

Reviewed-on: Drift/pvv-nixos-config#47
2024-07-31 11:23:00 +02:00
Felix Albrigtsen c7797bdd04 Merge pull request 'SimpleSAMLPHP/MediaWiki: Update deprecated --replace' (!48) from fix-replace-warn into main
Reviewed-on: Drift/pvv-nixos-config#48
Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
2024-07-28 23:30:44 +02:00
Felix Albrigtsen 615b5fc1f1 SimpleSAMLPHP/MediaWiki: Update deprecated --replace 2024-07-28 23:28:33 +02:00
Oystein Kristoffer Tveit a0a837e26d Merge pull request 'bekkalokk/gitea: direct non-logged-in users to the explore tab' (!46) from gitea-explore into main
Reviewed-on: Drift/pvv-nixos-config#46
Reviewed-by: Felix Albrigtsen <felixalb@pvv.ntnu.no>
Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
2024-07-28 23:10:38 +02:00
Daniel Lovbrotte Olsen 8f3013dc00 bekkalokk/gitea: direct non-logged-in users to the explore tab
This is a much more interesting page rather than trying to sell gitea
2024-07-19 21:19:06 +02:00
Daniel Lovbrotte Olsen 78caceddce flake: remove nettsiden from output function scope
This is referred to by inputs anyways
2024-07-18 16:24:42 +02:00
Oystein Kristoffer Tveit 868764e0cd bekkalokk/mediawiki: misc configuration 2024-07-10 19:04:55 +02:00
Oystein Kristoffer Tveit 7c3ff2068d bekkalokk/mediawiki: add some more extensions 2024-07-10 19:04:36 +02:00
Oystein Kristoffer Tveit 9d3f1381bf packages/mediawiki-extensions: refactor 2024-07-10 18:59:16 +02:00
Oystein Kristoffer Tveit f3a29429aa bekkalokk/gitea: set default email notification preference to 'onmention' 2024-07-10 00:18:01 +02:00
Oystein Kristoffer Tveit 1591fdb7cc bekkalokk/mediawiki: re-enable DeleteBatch extension 2024-07-08 19:56:43 +02:00
Oystein Kristoffer Tveit ed28ba28f3 bekkalokk/mediawiki: leave togglable debug flags for future use 2024-07-08 19:55:52 +02:00
Oystein Kristoffer Tveit 52b46667b1 packages/mediawiki-extensions: use fetchgit 2024-07-08 19:54:42 +02:00
Oystein Kristoffer Tveit d0f63b2fc8 packages/mediawiki-extensions: bump all 2024-07-08 16:55:01 +02:00
Oystein Kristoffer Tveit 0301691b1c
gitea: enable notification mails 2024-07-04 20:41:46 +02:00
Oystein Kristoffer Tveit 946555e408
gitea: add subject prefix to mail 2024-07-04 20:36:44 +02:00
Oystein Kristoffer Tveit e02062417a
gitea: move state back to /var/lib 2024-07-04 20:31:51 +02:00
Oystein Kristoffer Tveit b2806d78af
gitea: enable lfs 2024-07-04 20:30:55 +02:00
Oystein Kristoffer Tveit de2c7ea6f1
gitea: install custom images to correct dir 2024-07-04 20:29:50 +02:00
Felix Albrigtsen 106081c967 Merge pull request 'all: Update to nixos-24.05' (!43) from 24.05-for-real into main
Reviewed-on: Drift/pvv-nixos-config#43
2024-06-30 01:55:41 +02:00
Felix Albrigtsen ca2deed668 WIP: all: Update to nixos-24.05 2024-06-30 01:55:25 +02:00
Oystein Kristoffer Tveit bb2f7899db Merge pull request 'bekkalokk/gitea: set default licenses and repo units' (!44) from gitea-set-misc-repo-settings into main
Reviewed-on: Drift/pvv-nixos-config#44
2024-06-29 23:16:17 +02:00
Oystein Kristoffer Tveit c2b35a7ae4
bekkalokk/gitea: set default licenses and repo units 2024-06-29 23:14:41 +02:00
Felix Albrigtsen c88c3f87e0 buskerud: add libvirtd 2024-06-22 17:36:30 +02:00
Felix Albrigtsen c5bad75edc bekkalokk/nettsiden: Update nettsiden to disable recurring events 2024-06-19 22:15:36 +02:00
Felix Albrigtsen 71479d5ca0 quickfix: bekkalokk/mediawiki: remove DeleteBatch 2024-05-27 11:02:35 +02:00
Felix Albrigtsen cf01792269 bekkalokk/vaultarden: Add kTLS 2024-05-26 10:50:29 +02:00
Felix Albrigtsen afae0da0b6 Merge pull request 'bekkalokk: add vaultwarden' (!40) from bekkalokk-vaultwarden into main
Reviewed-on: Drift/pvv-nixos-config#40
2024-05-26 04:21:28 +02:00
Felix Albrigtsen 35d745b156 bekkalokk: add vaultwarden 2024-05-26 04:19:17 +02:00
Oystein Kristoffer Tveit 218ee776c7 Merge pull request 'packages/mediawiki-extensions: use stable url' (!35) from fix-mediawiki-extensions-url into main
Reviewed-on: Drift/pvv-nixos-config#35
2024-05-26 02:45:04 +02:00
Oystein Kristoffer Tveit 3a972f03f7
flake: move mediawiki-extensions back to packages 2024-05-26 02:42:31 +02:00
Daniel Lovbrotte Olsen 96024efa28
flake: move mediawiki-extensions to legacyPackages 2024-05-26 02:42:31 +02:00
Daniel Lovbrotte Olsen af54cc2df4
packages/mediawiki/pluggable-auth: fix typo 2024-05-26 02:42:31 +02:00
Oystein Kristoffer Tveit 6f6721ce07
packages/mediawiki-extensions: use stable url 2024-05-26 02:42:28 +02:00
Felix Albrigtsen 1c35da0295 Merge pull request 'bekkalokk: add snappymail' (!39) from bekkalokk-snappymail into main
Reviewed-on: Drift/pvv-nixos-config#39
2024-05-26 01:52:17 +02:00
Felix Albrigtsen 5fb1b805a8 bekkalokk: add snappymail 2024-05-26 01:07:27 +02:00
Oystein Kristoffer Tveit a38a12c429
flake.lock: update pvv-nettsiden 2024-05-19 22:27:59 +02:00
Daniel Lovbrotte Olsen 898e362a9f Merge pull request 'bekkalokk/website: add sp metadata for all domains' (!34) from add-sp-metadata-for-all-website-domains into main
Reviewed-on: Drift/pvv-nixos-config#34
2024-05-14 05:27:44 +02:00
Daniel Lovbrotte Olsen c267820426 overlays/nginx-test: drop 2024-05-13 07:04:00 +02:00
Oystein Kristoffer Tveit a57b5f07f9 Merge pull request 'gitea: setup mail' (!38) from gitea-setup-mail into main
Reviewed-on: Drift/pvv-nixos-config#38
2024-05-12 02:27:37 +02:00
Oystein Kristoffer Tveit bcf2ceed32
gitea: setup mail 2024-05-12 02:26:13 +02:00
Daniel Lovbrotte Olsen 0a3d1e3696 overlays/nginx-test
just start replacing shit, we're not even testing the actual config now
This sucks
nginx should make a proper validation tool that doesnt do DNS request on every hostname mentioned in the config file.
Not to mention trying to actually listen on the ip-address and port
Why?? Why is TEST failing because it can't bind to the SAME address nginx is probably in production listening on already??
2024-05-12 02:22:12 +02:00
Daniel Lovbrotte Olsen 45eea1a791 update flake.lock 2024-05-12 02:22:12 +02:00
Oystein Kristoffer Tveit 200224d2c1 Merge pull request 'bekkalokk: misc gitea cleanup' (!33) from misc-gitea-cleanup into main
Reviewed-on: Drift/pvv-nixos-config#33
2024-05-12 02:12:55 +02:00
Daniel Lovbrotte Olsen dcf29b76b8 bicep/matrix: allow global address of new ildkule to access metrics
Eval nix flake / evals (push) Successful in 1h30m46s Details
2024-04-24 03:03:53 +02:00
Felix Albrigtsen 55e8f01d1d Upgrade ildkule (!36)
Eval nix flake / evals (push) Failing after 3h12m29s Details
This PR is made while moving Ildkule from PVE on joshua, to Openstack on stack.it.ntnu.no.

- The main monitoring dashboard is moved from https://ildkule.pvv.ntnu.no to https://grafana.pvv.ntnu.no.
- A new service is added: uptime-kuma on https://uptime.pvv.ntnu.no.
- The (hardware) configuration for ildkule is updated to fit the new virtualization environment, boot loader, network interfaces, etc.
- Metrics exporters on other hosts should be updated to allow connections from the new host

As this is the first proper server running on openstack, and therefore outside our main IP range, we might discover challenges in our network structure. For example, the database servers usually only allow connections from this range, so Ildkule can no longer access it. This should be explored, documented and/or fixed as we move more services.

Reviewed-on: Drift/pvv-nixos-config#36
Co-authored-by: Felix Albrigtsen <felix@albrigtsen.it>
Co-committed-by: Felix Albrigtsen <felix@albrigtsen.it>
2024-04-21 23:36:25 +02:00
Oystein Kristoffer Tveit b7b1c73bfa
bekkalokk/gitea: use systemd unit for gitea customization
Eval nix flake / evals (pull_request) Failing after 47s Details
Eval nix flake / evals (push) Failing after 14m41s Details
2024-04-16 01:02:21 +02:00
Oystein Kristoffer Tveit 19d5ddc688 Merge pull request 'bekkalokk: remove keycloak' (!30) from bekkalokk-remove-keycloak into main
Eval nix flake / evals (push) Failing after 1m49s Details
Reviewed-on: Drift/pvv-nixos-config#30
2024-04-15 00:00:17 +02:00
Oystein Kristoffer Tveit 6851879a03
bekkalokk: remove keycloak
Eval nix flake / evals (pull_request) Failing after 1m39s Details
Eval nix flake / evals (push) Failing after 1m41s Details
2024-04-14 23:59:46 +02:00
Oystein Kristoffer Tveit 70603145cf
bekkalokk/website: add sp metadata for all domains
Eval nix flake / evals (pull_request) Failing after 1m49s Details
Eval nix flake / evals (push) Failing after 41s Details
2024-04-14 17:06:01 +02:00
Felix Albrigtsen 1e4195ea9d bekkalokk: pvv-nettsiden-gallery: Improve thumbnail generation
Eval nix flake / evals (push) Failing after 1m46s Details
2024-04-14 02:04:45 +02:00
Daniel Lovbrotte Olsen ee335e3712 bicep/synapse: fix registering users via smtp
Eval nix flake / evals (push) Failing after 2m0s Details
2024-04-14 01:52:17 +02:00
Daniel Lovbrotte Olsen ffbf855f24 update flake for grzegorz
Eval nix flake / evals (push) Failing after 1m52s Details
2024-04-12 02:35:49 +02:00
Daniel Lovbrotte Olsen 28e7a63d33 update flake lock and remove non-derivations from flake ouput
Eval nix flake / evals (push) Failing after 1m47s Details
2024-04-12 00:42:29 +02:00
Daniel Lovbrotte Olsen 01f0e63a49 use getExe' to silence errors 2024-04-12 00:41:57 +02:00
Daniel Lovbrotte Olsen ae4ace9fa2 Merge pull request 'treewide: run nginx -t on all nginx config files' (!32) from test-nginx-overlay into main
Eval nix flake / evals (push) Failing after 1m46s Details
Reviewed-on: Drift/pvv-nixos-config#32
2024-04-11 23:39:42 +02:00
Daniel Lovbrotte Olsen 8c72088d9c dynamically get configured acme certs for nginx test
Eval nix flake / evals (push) Failing after 1m44s Details
Eval nix flake / evals (pull_request) Failing after 1m51s Details
2024-04-11 23:29:05 +02:00
Daniel Lovbrotte Olsen 0056029da7 treewide: bubblewrap nginx test 2024-04-11 23:28:54 +02:00
Daniel Lovbrotte Olsen 9b4fbd847f treewide: run nginx -t on all nginx config files 2024-04-11 23:28:54 +02:00
Oystein Kristoffer Tveit 5bed292a01
bekkalokk/gitea: move user import stuff to separate nix file 2024-04-11 21:47:44 +02:00
Oystein Kristoffer Tveit 36b7087a3f
base.nix: hotfix for hotfix for nginx on bicep (3352e48f)
Eval nix flake / evals (push) Failing after 1m49s Details
Turns out the settings were in biceps local nginx config
2024-04-11 20:41:02 +02:00
Oystein Kristoffer Tveit 1919da7a1c bicep/matrix: remove SAML authentication
Eval nix flake / evals (push) Failing after 1m50s Details
2024-04-11 19:55:10 +02:00
Oystein Kristoffer Tveit 0950fedf98 bekkalokk/website: fix some nginx location directives
Eval nix flake / evals (push) Failing after 1m50s Details
2024-04-11 13:21:11 +02:00
Oystein Kristoffer Tveit 614c2d624c
bekkalokk/webmail: add redirects for old webmail locations
Eval nix flake / evals (push) Failing after 1m45s Details
2024-04-11 10:47:13 +02:00
Oystein Kristoffer Tveit 3352e48f47
base.nix: hotfix for nginx on bicep
Eval nix flake / evals (push) Failing after 1m51s Details
the matrix-synapse-next module seems to already add some of the nginx
options we set in base.nix, making it fail. These should only be set if
they're not already set by this module
2024-04-11 10:30:14 +02:00
Daniel Lovbrotte Olsen db211c2304 bekkalokk/website: don't try to listen for ntnu.org
Eval nix flake / evals (push) Failing after 1m48s Details
2024-04-11 05:31:33 +02:00
Felix Albrigtsen 4f322ec0b1 Merge pull request 'finalize-www-migration' (!31) from finalize-www-migration into main
Eval nix flake / evals (push) Failing after 1m40s Details
Reviewed-on: Drift/pvv-nixos-config#31
2024-04-11 00:57:20 +02:00
Felix Albrigtsen 79bf307ef2 bekkalokk: Reconfigure www ingress
Eval nix flake / evals (push) Failing after 1m46s Details
Eval nix flake / evals (pull_request) Failing after 1m52s Details
2024-04-11 00:48:07 +02:00
Felix Albrigtsen 4d50efc6db Finalize www/idp/webmail migration from spikkjeposche to bekkalokk
Eval nix flake / evals (push) Failing after 1m48s Details
2024-04-10 23:31:04 +02:00
Felix Albrigtsen 145a840a2c Merge pull request 'Setup pvv-nettsiden on www2.pvv.ntnu.no' (!27) from www2 into main
Eval nix flake / evals (push) Failing after 1m47s Details
Reviewed-on: Drift/pvv-nixos-config#27
2024-04-10 23:05:37 +02:00
Felix Albrigtsen 2bbc851e0e Point inputs/nettsiden to master after Projects/nettsiden#53
Eval nix flake / evals (push) Failing after 1m48s Details
Eval nix flake / evals (pull_request) Failing after 1m48s Details
2024-04-10 23:04:20 +02:00
Oystein Kristoffer Tveit 9577477460 bekkalokk/nettsiden: add secrets 2024-04-10 23:04:20 +02:00
Felix Albrigtsen fc19a8f1e1 bekkalokk: Automatically unpack pvv-nettsiden/gallery and generate thumbnails 2024-04-10 23:04:20 +02:00
Oystein Kristoffer Tveit 8657e77514 bekkalokk: set up pvv-nettsiden 2024-04-10 23:04:18 +02:00
Felix Albrigtsen 03c9638098 Merge pull request 'treewide: nginx optimizations' (!29) from treewide-nginx-optimizations into main
Eval nix flake / evals (push) Failing after 1m47s Details
Reviewed-on: Drift/pvv-nixos-config#29
2024-04-10 22:54:39 +02:00
Oystein Kristoffer Tveit 065992620e treewide: nginx optimizations
Eval nix flake / evals (push) Failing after 1m47s Details
Eval nix flake / evals (pull_request) Failing after 1m54s Details
2024-04-10 22:06:44 +02:00
Adrian Gunnar Lauterer e22c7d5b4d added terminfo for foot to adriangl
Eval nix flake / evals (push) Failing after 1m46s Details
2024-04-09 20:46:14 +02:00
Oystein Kristoffer Tveit 4fcc1fd5e9 flake.lock: update nix-gitea-themes
Eval nix flake / evals (push) Failing after 1m47s Details
2024-04-09 20:33:38 +02:00
Oystein Kristoffer Tveit 05a1f049dc Merge pull request 'gitea: add theming module' (!28) from init-gitea-themes into main
Eval nix flake / evals (push) Failing after 2m13s Details
Reviewed-on: Drift/pvv-nixos-config#28
2024-04-09 20:32:29 +02:00
Oystein Kristoffer Tveit fbbc54328b gitea: add theming module
Eval nix flake / evals (push) Failing after 1m51s Details
Eval nix flake / evals (pull_request) Failing after 1m54s Details
2024-04-09 01:52:57 +02:00
Adrian Gunnar Lauterer d8e13ff67c Update users/adriangl.nix
Eval nix flake / evals (push) Failing after 1m50s Details
2024-04-08 21:21:24 +02:00
Oystein Kristoffer Tveit 42fd371c3b
mediawiki: restart phpfpm on updated secrets
Eval nix flake / evals (push) Failing after 2m11s Details
2024-04-06 23:57:37 +02:00
Oystein Kristoffer Tveit f25a4e5c02 Merge pull request 'mediawiki: add VisualEditor' (#26) from mediawiki-add-visual-editor into main
Eval nix flake / evals (push) Failing after 1m47s Details
Reviewed-on: Drift/pvv-nixos-config#26
2024-04-06 21:19:41 +02:00
Oystein Kristoffer Tveit 6e1b06731f bekkalokk: add VisualEditor to mediawiki extensions
Eval nix flake / evals (push) Failing after 1m53s Details
Eval nix flake / evals (pull_request) Failing after 1m42s Details
2024-04-06 21:09:01 +02:00
Oystein Kristoffer Tveit 161ef284be packages: add mediawiki-extensions.VisualEditor 2024-04-06 21:08:32 +02:00
Felix Albrigtsen 2cb7e06369
bekkalokk/mediawiki: fix path, upgrade security
Eval nix flake / evals (push) Failing after 1m54s Details
2024-04-03 08:29:19 +02:00
Oystein Kristoffer Tveit a55c908fe7
bekkalokk/mediawiki: change domain from wiki2 to wiki
Eval nix flake / evals (push) Failing after 1m48s Details
2024-04-02 19:54:28 +02:00
Oystein Kristoffer Tveit 06bd93e5d1 Merge pull request 'bekkalokk: set up idp + mediawiki' (#25) from mediawiki-on-bekkalokk into main
Eval nix flake / evals (push) Failing after 1m56s Details
Reviewed-on: Drift/pvv-nixos-config#25
2024-04-02 00:00:24 +02:00
Oystein Kristoffer Tveit d531419f35 bekkalokk: init mediawiki
Eval nix flake / evals (pull_request) Failing after 1m46s Details
Eval nix flake / evals (push) Failing after 1m53s Details
Co-authored-by: Jørn Åne <yorinad@pvv.ntnu.no>
2024-04-01 23:57:39 +02:00
Oystein Kristoffer Tveit 806b18ede8 bekkalokk: init idp-simplesamlphp 2024-04-01 23:57:39 +02:00
Oystein Kristoffer Tveit c612975b60 base/nginx: 444 requests to nonexistent virtualhosts 2024-04-01 23:57:39 +02:00
Oystein Kristoffer Tveit 9495682f57 bekkalokk: package mediawiki extensions outside of module 2024-04-01 00:39:12 +02:00
Oystein Kristoffer Tveit d39047b8cb packages: init simplesamlphp 2024-04-01 00:38:51 +02:00
Oystein Kristoffer Tveit 266ce9ed08 bekkalokk: set up kerberos client 2024-04-01 00:38:49 +02:00
Felix Albrigtsen 07c480d004 base: add ripgrep
Eval nix flake / evals (push) Failing after 1m53s Details
2024-03-30 21:07:00 +01:00
Oystein Kristoffer Tveit 64c7e3e365 flake.nix: fix usage of common nixos module/overlay list 2024-03-29 01:51:37 +01:00
Daniel Lovbrotte Olsen fe4dd21acb add eirikwit to sops
Eval nix flake / evals (push) Failing after 1m44s Details
2024-03-16 22:38:16 +01:00
Daniel Lovbrotte Olsen 0336744124 flake update: matrix module bug fix
Eval nix flake / evals (push) Failing after 1m55s Details
2024-03-13 07:41:12 +01:00
Daniel Lovbrotte Olsen b4d6e00622 Update flake.lock to get new matrix module
Eval nix flake / evals (push) Failing after 1m51s Details
2024-03-13 06:33:43 +01:00
Daniel Lovbrotte Olsen 7c6d4d31c7 bicep/matrix/element: update room directories
Eval nix flake / evals (push) Failing after 1m44s Details
2024-03-05 05:52:31 +01:00
Daniel Lovbrotte Olsen 9f46be1ca1 bicep/matrix: update element lab flags and room directoriy listings
Eval nix flake / evals (push) Failing after 1m44s Details
2024-03-05 05:28:23 +01:00
Jo Vassbotn Remvik 545583cf04 bekkalokk/gitea: Do not change the user visibility
Eval nix flake / evals (push) Failing after 1m55s Details
2024-03-03 00:29:24 +01:00
Felix Albrigtsen 62b269637a bekkalokk/gitea: unset visibility when updating users
Eval nix flake / evals (push) Failing after 1m50s Details
2024-02-12 11:24:14 +01:00
Adrian Gunnar Lauterer 7fd9a1e646
started on bikkje container for new loginbox - work in progress
Eval nix flake / evals (push) Failing after 1m47s Details
2024-01-07 01:21:11 +01:00
Daniel Lovbrotte Olsen 4ea90380ad bicep/matrix: use synapse package from stable
Eval nix flake / evals (push) Failing after 1m52s Details
It's fixed now
2023-12-16 00:22:02 +01:00
Daniel Lovbrotte Olsen bcd5292f78 update flake.lock
Eval nix flake / evals (push) Failing after 1m46s Details
2023-12-13 20:02:09 +01:00
Felix Albrigtsen 1ab1b3a84e Merge pull request 'Buskerud: Comment out openvpn-client' (#23) from buskerud-no-vpn into main
Eval nix flake / evals (push) Failing after 1m48s Details
Reviewed-on: Drift/pvv-nixos-config#23
2023-12-12 18:09:31 +01:00
Felix Albrigtsen 80ef1ce4fa Buskerud: Remove OV-link, general cleanup
Eval nix flake / evals (push) Failing after 1m43s Details
Eval nix flake / evals (pull_request) Failing after 1m42s Details
2023-12-12 15:27:20 +01:00
Felix Albrigtsen 2b834eee14 Buskerud: Comment out openvpn-client
Eval nix flake / evals (pull_request) Failing after 1m42s Details
Eval nix flake / evals (push) Failing after 1m40s Details
2023-12-12 11:39:33 +01:00
Daniel Lovbrotte Olsen 9ed2ca8883 Merge pull request 'Update users/jonmro.nix' (#21) from jonmro/pvv-nixos-config:main into main
Eval nix flake / evals (push) Failing after 1m50s Details
Reviewed-on: Drift/pvv-nixos-config#21
2023-12-10 05:46:20 +01:00
Daniel Lovbrotte Olsen fe12e5441a Merge pull request '🎉 nixpkgs 23.11' (#20) from upgrade-to-nixpkgs-23-11 into main
Eval nix flake / evals (push) Failing after 1m43s Details
Reviewed-on: Drift/pvv-nixos-config#20
2023-12-10 05:43:01 +01:00
Daniel Lovbrotte Olsen 2b305678df update flake.lock
Eval nix flake / evals (pull_request) Failing after 1m43s Details
Eval nix flake / evals (push) Failing after 1m48s Details
2023-12-10 05:41:45 +01:00
Daniel Lovbrotte Olsen dd8b677a79 buskerud: bootloader - 3.3TB, OS - 256GB 👍
Eval nix flake / evals (pull_request) Failing after 1m49s Details
Eval nix flake / evals (push) Failing after 1m57s Details
2023-12-10 05:27:58 +01:00
Daniel Lovbrotte Olsen eabd8df3d8 bicep/matrix: use package with fixed pythonEnv
Eval nix flake / evals (pull_request) Failing after 1m46s Details
Eval nix flake / evals (push) Failing after 1m52s Details
2023-12-10 04:32:26 +01:00
Eirik Witterso 8a0ebe761e Add user eirikwit
Eval nix flake / evals (pull_request) Failing after 1m43s Details
Eval nix flake / evals (push) Failing after 1m48s Details
2023-12-10 02:00:18 +01:00
Oystein Kristoffer Tveit 0b5e03471f
upgrade to nixpkgs 23.11
Eval nix flake / evals (push) Failing after 3h8m33s Details
Eval nix flake / evals (pull_request) Failing after 3h5m17s Details
2023-12-05 00:36:09 +01:00
123 changed files with 9767 additions and 1358 deletions

10
.editorconfig Normal file
View File

@ -0,0 +1,10 @@
root = true
[*]
end_of_line = lf
insert_final_newline = true
trim_trailing_whitespace = true
[*.nix]
indent_style = space
indent_size = 2

1
.envrc Normal file
View File

@ -0,0 +1 @@
use flake

1
.git-blame-ignore-revs Normal file
View File

@ -0,0 +1 @@
e00008da1afe0d760badd34bbeddff36bb08c475

2
.gitignore vendored
View File

@ -1,2 +1,4 @@
result*
/configuration.nix
/.direnv/
*.qcow2

View File

@ -3,10 +3,14 @@ keys:
- &user_danio age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
- &user_felixalb age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
- &user_oysteikt F7D37890228A907440E1FD4846B9228E814A2AAC
- &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
- &user_pederbs_sopp age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
- &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
- &user_pederbs_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
# Hosts
- &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
- &host_ildkule age1hn45n46ypyrvypv0mwfnpt9ddrlmw34dwlpf33n8v67jexr3lucq6ahc9x
- &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
- &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
- &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
@ -18,17 +22,24 @@ creation_rules:
- *host_jokum
- *user_danio
- *user_felixalb
- *user_eirikwit
- *user_pederbs_sopp
- *user_pederbs_nord
- *user_pederbs_bjarte
pgp:
- *user_oysteikt
# Host specific secrets
- path_regex: secrets/bekkalokk/[^/]+\.yaml$
key_groups:
- age:
- *host_bekkalokk
- *user_danio
- *user_felixalb
- *user_pederbs_sopp
- *user_pederbs_nord
- *user_pederbs_bjarte
pgp:
- *user_oysteikt
@ -38,6 +49,9 @@ creation_rules:
- *host_jokum
- *user_danio
- *user_felixalb
- *user_pederbs_sopp
- *user_pederbs_nord
- *user_pederbs_bjarte
pgp:
- *user_oysteikt
@ -47,14 +61,20 @@ creation_rules:
- *host_ildkule
- *user_danio
- *user_felixalb
- *user_pederbs_sopp
- *user_pederbs_nord
- *user_pederbs_bjarte
pgp:
- *user_oysteikt
- path_regex: secrets/bicep/[^/]+\.yaml$
key_groups:
- age:
- *host_bicep
- *user_danio
- *user_felixalb
- *user_pederbs_sopp
- *user_pederbs_nord
- *user_pederbs_bjarte
pgp:
- *user_oysteikt

View File

@ -26,10 +26,14 @@ Det er sikkert lurt å lage en PR først om du ikke er vandt til nix enda.
Innen 24h skal alle systemene hente ned den nye konfigurasjonen og deploye den.
Du kan tvinge en maskin til å oppdatere seg før dette ved å kjøre:
`nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git --upgrade`
`nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --upgrade --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git`
som root på maskinen.
Hvis du ikke har lyst til å oppdatere alle pakkene (og kanskje måtte vente en stund!) kan du kjøre
`nixos-rebuild switch --override-input nixpkgs nixpkgs --override-input nixpkgs-unstable nixpkgs-unstable --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git`
## Seksjonen for hemmeligheter
For at hemmeligheter ikke skal deles med hele verden i git - eller å være world

View File

@ -1,86 +0,0 @@
{ config, lib, pkgs, inputs, values, ... }:
{
imports = [
./users
];
networking.domain = "pvv.ntnu.no";
networking.useDHCP = false;
# networking.search = [ "pvv.ntnu.no" "pvv.org" ];
# networking.nameservers = lib.mkDefault [ "129.241.0.200" "129.241.0.201" ];
# networking.tempAddresses = lib.mkDefault "disabled";
# networking.defaultGateway = values.hosts.gateway;
systemd.network.enable = true;
services.resolved = {
enable = lib.mkDefault true;
dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
};
time.timeZone = "Europe/Oslo";
i18n.defaultLocale = "en_US.UTF-8";
console = {
font = "Lat2-Terminus16";
keyMap = "no";
};
system.autoUpgrade = {
enable = true;
flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
flags = [
"--update-input" "nixpkgs"
"--update-input" "nixpkgs-unstable"
"--no-write-lock-file"
];
};
nix.gc.automatic = true;
nix.gc.options = "--delete-older-than 2d";
nix.settings.experimental-features = [ "nix-command" "flakes" ];
/* This makes commandline tools like
** nix run nixpkgs#hello
** and nix-shell -p hello
** use the same channel the system
** was built with
*/
nix.registry = {
nixpkgs.flake = inputs.nixpkgs;
};
nix.nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
environment.systemPackages = with pkgs; [
file
git
gnupg
htop
nano
rsync
screen
tmux
vim
wget
kitty.terminfo
];
programs.zsh.enable = true;
users.groups."drift".name = "drift";
# Trusted users on the nix builder machines
users.groups."nix-builder-users".name = "nix-builder-users";
services.openssh = {
enable = true;
extraConfig = ''
PubkeyAcceptedAlgorithms=+ssh-rsa
'';
settings.PermitRootLogin = "yes";
};
}

60
base/default.nix Normal file
View File

@ -0,0 +1,60 @@
{ pkgs, lib, ... }:
{
imports = [
../users
../modules/snakeoil-certs.nix
./networking.nix
./nix.nix
./services/acme.nix
./services/auto-upgrade.nix
./services/irqbalance.nix
./services/logrotate.nix
./services/nginx.nix
./services/openssh.nix
./services/postfix.nix
./services/smartd.nix
./services/thermald.nix
];
boot.tmp.cleanOnBoot = lib.mkDefault true;
time.timeZone = "Europe/Oslo";
i18n.defaultLocale = "en_US.UTF-8";
console = {
font = "Lat2-Terminus16";
keyMap = "no";
};
environment.systemPackages = with pkgs; [
file
git
gnupg
htop
nano
ripgrep
rsync
screen
tmux
vim
wget
kitty.terminfo
];
programs.zsh.enable = true;
security.sudo.execWheelOnly = true;
security.sudo.extraConfig = ''
Defaults lecture = never
'';
users.groups."drift".name = "drift";
# Trusted users on the nix builder machines
users.groups."nix-builder-users".name = "nix-builder-users";
}

13
base/networking.nix Normal file
View File

@ -0,0 +1,13 @@
{ lib, values, ... }:
{
systemd.network.enable = true;
networking.domain = "pvv.ntnu.no";
networking.useDHCP = false;
# The rest of the networking configuration is usually sourced from /values.nix
services.resolved = {
enable = lib.mkDefault true;
dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
};
}

34
base/nix.nix Normal file
View File

@ -0,0 +1,34 @@
{ inputs, ... }:
{
nix = {
gc = {
automatic = true;
options = "--delete-older-than 2d";
};
settings = {
allow-dirty = true;
auto-optimise-store = true;
builders-use-substitutes = true;
experimental-features = [ "nix-command" "flakes" ];
log-lines = 50;
use-xdg-base-directories = true;
};
/* This makes commandline tools like
** nix run nixpkgs#hello
** and nix-shell -p hello
** use the same channel the system
** was built with
*/
registry = {
"nixpkgs".flake = inputs.nixpkgs;
"nixpkgs-unstable".flake = inputs.nixpkgs-unstable;
"pvv-nix".flake = inputs.self;
};
nixPath = [
"nixpkgs=${inputs.nixpkgs}"
"unstable=${inputs.nixpkgs-unstable}"
];
};
}

15
base/services/acme.nix Normal file
View File

@ -0,0 +1,15 @@
{ ... }:
{
security.acme = {
acceptTerms = true;
defaults.email = "drift@pvv.ntnu.no";
};
# Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
virtualisation.vmVariant = {
security.acme.defaults.server = "https://127.0.0.1";
security.acme.preliminarySelfsigned = true;
users.users.root.initialPassword = "root";
};
}

View File

@ -0,0 +1,26 @@
{ inputs, pkgs, lib, ... }:
{
system.autoUpgrade = {
enable = true;
flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
flags = [
# --update-input is deprecated since nix 2.22, and removed in lix 2.90
# https://git.lix.systems/lix-project/lix/issues/400
"--refresh"
"--override-input" "nixpkgs" "github:nixos/nixpkgs/nixos-24.05-small"
"--override-input" "nixpkgs-unstable" "github:nixos/nixpkgs/nixos-unstable-small"
"--no-write-lock-file"
];
};
# workaround for https://github.com/NixOS/nix/issues/6895
# via https://git.lix.systems/lix-project/lix/issues/400
environment.etc."current-system-flake-inputs.json".source
= pkgs.writers.writeJSON "flake-inputs.json" (
lib.flip lib.mapAttrs inputs (name: input:
# inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
// { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
)
);
}

View File

@ -0,0 +1,4 @@
{ ... }:
{
services.irqbalance.enable = true;
}

View File

@ -0,0 +1,42 @@
{ ... }:
{
# source: https://github.com/logrotate/logrotate/blob/main/examples/logrotate.service
systemd.services.logrotate = {
documentation = [ "man:logrotate(8)" "man:logrotate.conf(5)" ];
unitConfig.RequiresMountsFor = "/var/log";
serviceConfig = {
Nice = 19;
IOSchedulingClass = "best-effort";
IOSchedulingPriority = 7;
ReadWritePaths = [ "/var/log" ];
AmbientCapabilities = [ "" ];
CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ];
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true; # disable for third party rotate scripts
PrivateDevices = true;
PrivateNetwork = true; # disable for mail delivery
PrivateTmp = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true; # disable for userdir logs
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "full";
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true; # disable for creating setgid directories
SocketBindDeny = [ "any" ];
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
];
};
};
}

44
base/services/nginx.nix Normal file
View File

@ -0,0 +1,44 @@
{ config, lib, ... }:
{
# nginx return 444 for all nonexistent virtualhosts
systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
environment.snakeoil-certs = lib.mkIf config.services.nginx.enable {
"/etc/certs/nginx" = {
owner = "nginx";
group = "nginx";
};
};
networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
services.nginx = {
recommendedTlsSettings = true;
recommendedProxySettings = true;
recommendedOptimisation = true;
recommendedGzipSettings = true;
appendConfig = ''
pcre_jit on;
worker_processes auto;
worker_rlimit_nofile 100000;
'';
eventsConfig = ''
worker_connections 2048;
use epoll;
multi_accept on;
'';
};
systemd.services.nginx.serviceConfig = lib.mkIf config.services.nginx.enable {
LimitNOFILE = 65536;
};
services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
sslCertificate = "/etc/certs/nginx.crt";
sslCertificateKey = "/etc/certs/nginx.key";
addSSL = true;
extraConfig = "return 444;";
};
}

14
base/services/openssh.nix Normal file
View File

@ -0,0 +1,14 @@
{ ... }:
{
services.openssh = {
enable = true;
startWhenNeeded = true;
extraConfig = ''
PubkeyAcceptedAlgorithms=+ssh-rsa
Match Group wheel
PasswordAuthentication no
Match All
'';
settings.PermitRootLogin = "yes";
};
}

23
base/services/postfix.nix Normal file
View File

@ -0,0 +1,23 @@
{ config, pkgs, lib, ... }:
let
cfg = config.services.postfix;
in
{
services.postfix = {
enable = true;
hostname = "${config.networking.hostName}.pvv.ntnu.no";
domain = "pvv.ntnu.no";
relayHost = "smtp.pvv.ntnu.no";
relayPort = 465;
config = {
smtp_tls_wrappermode = "yes";
smtp_tls_security_level = "encrypt";
};
# Nothing should be delivered to this machine
destination = [ ];
};
}

8
base/services/smartd.nix Normal file
View File

@ -0,0 +1,8 @@
{ config, pkgs, lib, ... }:
{
services.smartd.enable = lib.mkDefault true;
environment.systemPackages = lib.optionals config.services.smartd.enable (with pkgs; [
smartmontools
]);
}

View File

@ -0,0 +1,8 @@
{ config, lib, ... }:
{
# Let's not thermal throttle
services.thermald.enable = lib.mkIf (lib.all (x: x) [
(config.nixpkgs.system == "x86_64-linux")
(!config.boot.isContainer or false)
]) true;
}

View File

@ -7,11 +7,11 @@
]
},
"locked": {
"lastModified": 1700927249,
"narHash": "sha256-iqmIWiEng890/ru7ZBf4nUezFPyRm2fjRTvuwwxqk2o=",
"lastModified": 1725242307,
"narHash": "sha256-a2iTMBngegEZvaNAzzxq5Gc5Vp3UWoGUqWtK11Txbic=",
"owner": "nix-community",
"repo": "disko",
"rev": "3cb78c93e6a02f494aaf6aeb37481c27a2e2ee22",
"rev": "96073e6423623d4a8027e9739d2af86d6422ea7a",
"type": "github"
},
"original": {
@ -20,26 +20,66 @@
"type": "github"
}
},
"grzegorz": {
"fix-python": {
"inputs": {
"flake-utils": "flake-utils",
"nixpkgs": [
"nixpkgs-unstable"
"grzegorz",
"nixpkgs"
]
},
"locked": {
"lastModified": 1696346665,
"narHash": "sha256-J6Tf6a/zhFZ8SereluHLrvgPsIVm2CGHHA8wrbhZB3Y=",
"owner": "Programvareverkstedet",
"repo": "grzegorz",
"rev": "9b9c3ac7d408ac7c6d67544b201e6b169afacb03",
"lastModified": 1725463969,
"narHash": "sha256-d3c1TAlIN1PtK+oQP1wO6XbDfmR4SUp/C/4s7G46ARo=",
"owner": "GuillaumeDesforges",
"repo": "fix-python",
"rev": "2926402234c3f99aa8e4608c51d9ffa73ea403c0",
"type": "github"
},
"original": {
"owner": "Programvareverkstedet",
"repo": "grzegorz",
"owner": "GuillaumeDesforges",
"repo": "fix-python",
"type": "github"
}
},
"flake-utils": {
"inputs": {
"systems": "systems"
},
"locked": {
"lastModified": 1689068808,
"narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
"type": "github"
},
"original": {
"id": "flake-utils",
"type": "indirect"
}
},
"grzegorz": {
"inputs": {
"fix-python": "fix-python",
"nixpkgs": [