forked from Drift/pvv-nixos-config
Compare commits
1 Commits
| Author | SHA1 | Date |
|---|---|---|
 Felix Albrigtsen
|
2f66325e25 |
|
|
@ -1,13 +0,0 @@
|
||||||
name: "Eval nix flake"
|
|
||||||
on:
|
|
||||||
pull_request:
|
|
||||||
push:
|
|
||||||
jobs:
|
|
||||||
evals:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v3
|
|
||||||
- run: apt-get update && apt-get -y install sudo
|
|
||||||
- uses: https://github.com/cachix/install-nix-action@v23
|
|
||||||
- run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
|
|
||||||
- run: nix flake check
|
|
||||||
11
.sops.yaml
11
.sops.yaml
|
|
@ -7,7 +7,7 @@ keys:
|
||||||
# Hosts
|
# Hosts
|
||||||
- &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
|
- &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
|
||||||
- &host_ildkule age1hn45n46ypyrvypv0mwfnpt9ddrlmw34dwlpf33n8v67jexr3lucq6ahc9x
|
- &host_ildkule age1hn45n46ypyrvypv0mwfnpt9ddrlmw34dwlpf33n8v67jexr3lucq6ahc9x
|
||||||
- &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
|
- &host_bekkalokk age13t2nnr6yukmtda6wn2uggfcj0dmwce8347y8w6xzt4yje6wlgscqnahuqm
|
||||||
- &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
|
- &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
|
||||||
|
|
||||||
creation_rules:
|
creation_rules:
|
||||||
|
|
@ -49,12 +49,3 @@ creation_rules:
|
||||||
- *user_felixalb
|
- *user_felixalb
|
||||||
pgp:
|
pgp:
|
||||||
- *user_oysteikt
|
- *user_oysteikt
|
||||||
|
|
||||||
- path_regex: secrets/bicep/[^/]+\.yaml$
|
|
||||||
key_groups:
|
|
||||||
- age:
|
|
||||||
- *host_bicep
|
|
||||||
- *user_danio
|
|
||||||
- *user_felixalb
|
|
||||||
pgp:
|
|
||||||
- *user_oysteikt
|
|
||||||
|
|
|
||||||
16
README.MD
16
README.MD
|
|
@ -4,19 +4,9 @@
|
||||||
|
|
||||||
Før du endrer på ting husk å ikke putte ting som skal være hemmelig uten å først lese seksjonen for hemmeligheter!
|
Før du endrer på ting husk å ikke putte ting som skal være hemmelig uten å først lese seksjonen for hemmeligheter!
|
||||||
|
|
||||||
Etter å ha klonet prosjektet ned og gjort endringer kan du evaluere configene med:
|
Etter å ha klonet prosjektet ned og gjort endringer kan du bygge med:
|
||||||
|
|
||||||
`nix flake check --keep-going`
|
`nix build .#nixosConfigurations.jokum.config.system.build.toplevel`
|
||||||
|
|
||||||
før du bygger en maskin med:
|
|
||||||
|
|
||||||
`nix build .#<maskinnavn>`
|
|
||||||
|
|
||||||
hvis du vil være ekstra sikker på at alt bygger så kan du kjøre:
|
|
||||||
|
|
||||||
`nix build .` for å bygge alle de viktige maskinene.
|
|
||||||
|
|
||||||
NB: Dette kan ta opp til 30 minutter avhengig av hva som ligger i caches
|
|
||||||
|
|
||||||
Husk å hvertfall stage nye filer om du har laget dem!
|
Husk å hvertfall stage nye filer om du har laget dem!
|
||||||
|
|
||||||
|
|
@ -26,7 +16,7 @@ Det er sikkert lurt å lage en PR først om du ikke er vandt til nix enda.
|
||||||
Innen 24h skal alle systemene hente ned den nye konfigurasjonen og deploye den.
|
Innen 24h skal alle systemene hente ned den nye konfigurasjonen og deploye den.
|
||||||
|
|
||||||
Du kan tvinge en maskin til å oppdatere seg før dette ved å kjøre:
|
Du kan tvinge en maskin til å oppdatere seg før dette ved å kjøre:
|
||||||
`nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git --upgrade`
|
`nixos-rebuild switch --update-input nixpkgs --update-input unstable --no-write-lock-file --refresh --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git --upgrade`
|
||||||
|
|
||||||
som root på maskinen.
|
som root på maskinen.
|
||||||
|
|
||||||
|
|
|
||||||
Binary file not shown.
|
Before Width: | Height: | Size: 254 KiB |
|
|
@ -1,172 +0,0 @@
|
||||||
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
|
|
||||||
<!-- Created with Inkscape (http://www.inkscape.org/) -->
|
|
||||||
|
|
||||||
<svg
|
|
||||||
width="200mm"
|
|
||||||
height="200mm"
|
|
||||||
viewBox="0 0 200 200"
|
|
||||||
version="1.1"
|
|
||||||
id="svg5"
|
|
||||||
inkscape:version="1.1.2 (b8e25be833, 2022-02-05)"
|
|
||||||
sodipodi:docname="logo_blue_thicc.svg"
|
|
||||||
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
|
|
||||||
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
|
|
||||||
xmlns="http://www.w3.org/2000/svg"
|
|
||||||
xmlns:svg="http://www.w3.org/2000/svg">
|
|
||||||
<sodipodi:namedview
|
|
||||||
id="namedview7"
|
|
||||||
pagecolor="#505050"
|
|
||||||
bordercolor="#ffffff"
|
|
||||||
borderopacity="1"
|
|
||||||
inkscape:pageshadow="0"
|
|
||||||
inkscape:pageopacity="0"
|
|
||||||
inkscape:pagecheckerboard="1"
|
|
||||||
inkscape:document-units="mm"
|
|
||||||
showgrid="false"
|
|
||||||
inkscape:zoom="3.9730533"
|
|
||||||
inkscape:cx="359.54715"
|
|
||||||
inkscape:cy="690.40101"
|
|
||||||
inkscape:window-width="1920"
|
|
||||||
inkscape:window-height="1057"
|
|
||||||
inkscape:window-x="-8"
|
|
||||||
inkscape:window-y="-8"
|
|
||||||
inkscape:window-maximized="1"
|
|
||||||
inkscape:current-layer="Layer_4"
|
|
||||||
width="200mm" />
|
|
||||||
<defs
|
|
||||||
id="defs2" />
|
|
||||||
<g
|
|
||||||
inkscape:label="Layer 1"
|
|
||||||
inkscape:groupmode="layer"
|
|
||||||
id="layer1">
|
|
||||||
<g
|
|
||||||
id="g98"
|
|
||||||
transform="scale(0.25)">
|
|
||||||
<g
|
|
||||||
id="Layer_2"
|
|
||||||
style="fill:#283681;fill-opacity:1">
|
|
||||||
<rect
|
|
||||||
y="0"
|
|
||||||
class="st0"
|
|
||||||
width="800"
|
|
||||||
height="800"
|
|
||||||
id="rect4"
|
|
||||||
x="0"
|
|
||||||
style="fill:#283681;fill-opacity:1"
|
|
||||||
inkscape:export-filename="C:\Users\al3xk\OneDrive - NTNU\PVV\Gogs\PR\logoer\logo_blue.png"
|
|
||||||
inkscape:export-xdpi="480"
|
|
||||||
inkscape:export-ydpi="480" />
|
|
||||||
</g>
|
|
||||||
<g
|
|
||||||
id="Layer_4"
|
|
||||||
style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1">
|
|
||||||
<line
|
|
||||||
class="st1"
|
|
||||||
x1="478.39999"
|
|
||||||
y1="720.29999"
|
|
||||||
x2="313.20001"
|
|
||||||
y2="720.29999"
|
|
||||||
id="line9"
|
|
||||||
style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
|
|
||||||
<path
|
|
||||||
class="st1"
|
|
||||||
d="M 478.4,720.3"
|
|
||||||
id="path11"
|
|
||||||
style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
|
|
||||||
<polyline
|
|
||||||
class="st2"
|
|
||||||
points="717.1,223.3 717.1,720.3 497.3,720.3 "
|
|
||||||
id="polyline13"
|
|
||||||
style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
|
|
||||||
<path
|
|
||||||
class="st2"
|
|
||||||
d="m 498.39888,720.3 c 0,-5.6 -4.5,-10.1 -10.1,-10.1 -5.6,0 -10.1,4.5 -10.1,10.1 h -163.8 c 0,-5.6 -4.5,-10.1 -10.1,-10.1 -5.6,0 -10.1,4.5 -10.1,10.1 -69.7592,0 -145.68417,0 -217.599996,0 V 79.7 H 717.09888 v 120 0 h -17.3 v 24.8 h 17.3"
|
|
||||||
id="path15"
|
|
||||||
style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-linecap:square;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
|
|
||||||
sodipodi:nodetypes="csccsccccccccc" />
|
|
||||||
</g>
|
|
||||||
<g
|
|
||||||
id="Layer_3"
|
|
||||||
style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:10;stroke-dasharray:none;stroke-opacity:1">
|
|
||||||
<circle
|
|
||||||
class="st2"
|
|
||||||
cx="396.79999"
|
|
||||||
cy="400"
|
|
||||||
id="circle18"
|
|
||||||
style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:10;stroke-dasharray:none;stroke-opacity:1"
|
|
||||||
r="320.29999" />
|
|
||||||
</g>
|
|
||||||
<g
|
|
||||||
id="Layer_1"
|
|
||||||
style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1">
|
|
||||||
<polyline
|
|
||||||
class="st2"
|
|
||||||
points="514.5,173.5 170.2,173.5 170.3,626.6 623.3,626.5 623.3,215.7 584.4,173.4 557,173.4 548,180.6 526.5,180.7 "
|
|
||||||
id="polyline21"
|
|
||||||
style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-linejoin:bevel;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
|
|
||||||
<path
|
|
||||||
class="st2"
|
|
||||||
d="m 526.5,331.8 c 0,7.6 -5.4,13.7 -12,13.7 H 227.7 c -6.6,0 -12,-6.1 -12,-13.7 V 187.2 c 0,-7.6 5.4,-13.7 12,-13.7 h 286.8 c 6.6,0 12,6.1 12,13.7 z"
|
|
||||||
id="path27"
|
|
||||||
style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
|
|
||||||
<path
|
|
||||||
class="st2"
|
|
||||||
d="m 526.7,333.6 c 0,6.6 -5.4,12 -12,12 H 296.8 c -6.6,0 -12,-5.4 -12,-12 V 185.5 c 0,-6.6 5.4,-12 12,-12 h 217.9 c 6.6,0 12,5.4 12,12 z"
|
|
||||||
id="path29"
|
|
||||||
style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
|
|
||||||
<path
|
|
||||||
class="st2"
|
|
||||||
d="m 577.9,613.7 c 0,6.6 -5.4,12 -12,12 H 227.7 c -6.6,0 -12,-5.4 -12,-12 V 381.1 c 0,-6.6 5.4,-12 12,-12 h 338.2 c 6.6,0 12,5.4 12,12 z"
|
|
||||||
id="path31"
|
|
||||||
style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
|
|
||||||
<rect
|
|
||||||
x="179.89999"
|
|
||||||
y="590.20001"
|
|
||||||
class="st2"
|
|
||||||
width="25.700001"
|
|
||||||
height="23"
|
|
||||||
id="rect33"
|
|
||||||
style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
|
|
||||||
<rect
|
|
||||||
x="587.59998"
|
|
||||||
y="590.20001"
|
|
||||||
class="st2"
|
|
||||||
width="25.700001"
|
|
||||||
height="23"
|
|
||||||
id="rect35"
|
|
||||||
style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
|
|
||||||
<rect
|
|
||||||
x="433.60001"
|
|
||||||
y="193.5"
|
|
||||||
class="st2"
|
|
||||||
width="64.900002"
|
|
||||||
height="137.8"
|
|
||||||
id="rect37"
|
|
||||||
style="fill:#283681;fill-opacity:0;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
|
|
||||||
</g>
|
|
||||||
<path
|
|
||||||
d="m 274.9401,541.572 c 0,3.528 2.772,6.426 6.3,6.426 3.528,0 6.426,-2.898 6.426,-6.426 v -30.996 h 30.87 c 10.458,0 19.152,-8.694 19.152,-19.152 v -22.68 c 0,-10.332 -8.694,-19.026 -19.152,-19.026 h -43.596 z m 12.726,-43.722 v -35.406 h 30.87 c 3.276,0 6.426,2.898 6.426,6.3 v 22.68 c 0,3.528 -3.024,6.426 -6.426,6.426 z"
|
|
||||||
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:126px;font-family:OCRA;-inkscape-font-specification:OCRA;fill:#ffffff;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:10;stroke-dasharray:none;stroke-opacity:1"
|
|
||||||
id="path55-2" />
|
|
||||||
<path
|
|
||||||
d="m 365.99479,478.824 25.326,65.142 c 1.008,2.394 3.276,4.032 6.048,4.032 2.646,0 4.914,-1.638 5.922,-4.032 l 25.452,-65.268 v -22.68 c 0,-3.402 -2.898,-6.3 -6.426,-6.3 -3.528,0 -6.3,2.898 -6.3,6.3 v 20.286 l -18.648,47.628 -18.648,-47.628 v -20.286 c 0,-3.402 -2.898,-6.3 -6.426,-6.3 -3.528,0 -6.3,2.898 -6.3,6.3 z"
|
|
||||||
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:126px;font-family:OCRA;-inkscape-font-specification:OCRA;fill:#ffffff;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:10;stroke-dasharray:none;stroke-opacity:1"
|
|
||||||
id="path57-8" />
|
|
||||||
<path
|
|
||||||
d="m 457.04947,478.824 25.326,65.142 c 1.008,2.394 3.276,4.032 6.048,4.032 2.646,0 4.914,-1.638 5.922,-4.032 l 25.452,-65.268 v -22.68 c 0,-3.402 -2.898,-6.3 -6.426,-6.3 -3.528,0 -6.3,2.898 -6.3,6.3 v 20.286 l -18.648,47.628 -18.648,-47.628 v -20.286 c 0,-3.402 -2.898,-6.3 -6.426,-6.3 -3.528,0 -6.3,2.898 -6.3,6.3 z"
|
|
||||||
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:126px;font-family:OCRA;-inkscape-font-specification:OCRA;fill:#ffffff;stroke:#ffffff;stroke-width:4.2;stroke-miterlimit:10;stroke-dasharray:none;stroke-opacity:1"
|
|
||||||
id="path59-1" />
|
|
||||||
</g>
|
|
||||||
</g>
|
|
||||||
<style
|
|
||||||
type="text/css"
|
|
||||||
id="style2">
|
|
||||||
.st0{fill:#ffffff;}
|
|
||||||
.st1{fill:none;stroke:#ffffff;stroke-width:2;stroke-miterlimit:10;}
|
|
||||||
.st2{fill:none;stroke:#000000;stroke-width:2;stroke-miterlimit:10;}
|
|
||||||
.st3{fill:none;}
|
|
||||||
.st4{stroke:#000000;stroke-miterlimit:10;}
|
|
||||||
.st5{font-family:'OCRAStd';}
|
|
||||||
.st6{font-size:126px;}
|
|
||||||
</style>
|
|
||||||
</svg>
|
|
||||||
|
Before Width: | Height: | Size: 8.2 KiB |
11
base.nix
11
base.nix
|
|
@ -13,7 +13,7 @@
|
||||||
# networking.defaultGateway = values.hosts.gateway;
|
# networking.defaultGateway = values.hosts.gateway;
|
||||||
|
|
||||||
systemd.network.enable = true;
|
systemd.network.enable = true;
|
||||||
|
|
||||||
services.resolved = {
|
services.resolved = {
|
||||||
enable = lib.mkDefault true;
|
enable = lib.mkDefault true;
|
||||||
dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
|
dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
|
||||||
|
|
@ -32,7 +32,7 @@
|
||||||
flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
|
flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
|
||||||
flags = [
|
flags = [
|
||||||
"--update-input" "nixpkgs"
|
"--update-input" "nixpkgs"
|
||||||
"--update-input" "nixpkgs-unstable"
|
"--update-input" "unstable"
|
||||||
"--no-write-lock-file"
|
"--no-write-lock-file"
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
@ -67,19 +67,14 @@
|
||||||
kitty.terminfo
|
kitty.terminfo
|
||||||
];
|
];
|
||||||
|
|
||||||
programs.zsh.enable = true;
|
|
||||||
|
|
||||||
users.groups."drift".name = "drift";
|
users.groups."drift".name = "drift";
|
||||||
|
|
||||||
# Trusted users on the nix builder machines
|
|
||||||
users.groups."nix-builder-users".name = "nix-builder-users";
|
|
||||||
|
|
||||||
services.openssh = {
|
services.openssh = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
permitRootLogin = "yes";
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
PubkeyAcceptedAlgorithms=+ssh-rsa
|
PubkeyAcceptedAlgorithms=+ssh-rsa
|
||||||
'';
|
'';
|
||||||
settings.PermitRootLogin = "yes";
|
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
||||||
|
|
|
||||||
153
flake.lock
153
flake.lock
|
|
@ -1,97 +1,37 @@
|
||||||
{
|
{
|
||||||
"nodes": {
|
"nodes": {
|
||||||
"disko": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1700927249,
|
|
||||||
"narHash": "sha256-iqmIWiEng890/ru7ZBf4nUezFPyRm2fjRTvuwwxqk2o=",
|
|
||||||
"owner": "nix-community",
|
|
||||||
"repo": "disko",
|
|
||||||
"rev": "3cb78c93e6a02f494aaf6aeb37481c27a2e2ee22",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "nix-community",
|
|
||||||
"repo": "disko",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"grzegorz": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs-unstable"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1696346665,
|
|
||||||
"narHash": "sha256-J6Tf6a/zhFZ8SereluHLrvgPsIVm2CGHHA8wrbhZB3Y=",
|
|
||||||
"owner": "Programvareverkstedet",
|
|
||||||
"repo": "grzegorz",
|
|
||||||
"rev": "9b9c3ac7d408ac7c6d67544b201e6b169afacb03",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "Programvareverkstedet",
|
|
||||||
"repo": "grzegorz",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"grzegorz-clients": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1693864994,
|
|
||||||
"narHash": "sha256-oLDiWdCKDtEfeGzfAuDTq+n9VWp6JCo67PEESEZ3y8E=",
|
|
||||||
"owner": "Programvareverkstedet",
|
|
||||||
"repo": "grzegorz-clients",
|
|
||||||
"rev": "a38a0b0fb31ad0ad78a91458cb2c7f77f686468f",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "Programvareverkstedet",
|
|
||||||
"repo": "grzegorz-clients",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"matrix-next": {
|
"matrix-next": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs-lib": "nixpkgs-lib"
|
"nixpkgs-lib": "nixpkgs-lib"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1697936579,
|
"lastModified": 1676674799,
|
||||||
"narHash": "sha256-nMyepKnwoHMzu2OpXvG2ZhU081TV9ENmWCo0vWxs6AI=",
|
"narHash": "sha256-NaZWOgNrco5OT0J5VrWg02SCkKz8RV1sxRjh0/MWMEc=",
|
||||||
"owner": "dali99",
|
"owner": "dali99",
|
||||||
"repo": "nixos-matrix-modules",
|
"repo": "nixos-matrix-modules",
|
||||||
"rev": "e09814657187c8ed1a5fe1646df6d8da1eb2dee9",
|
"rev": "362496f4aacb680406db3fad36f98d38e8285b30",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "dali99",
|
"owner": "dali99",
|
||||||
"repo": "nixos-matrix-modules",
|
"repo": "nixos-matrix-modules",
|
||||||
"rev": "e09814657187c8ed1a5fe1646df6d8da1eb2dee9",
|
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs": {
|
"nixpkgs": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1701362232,
|
"lastModified": 1680879128,
|
||||||
"narHash": "sha256-GVdzxL0lhEadqs3hfRLuj+L1OJFGiL/L7gCcelgBlsw=",
|
"narHash": "sha256-ISFCCZ3/Dw5WK/6kFKwqA6gIEaOjqU/5NoB6Vge87sE=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "d2332963662edffacfddfad59ff4f709dde80ffe",
|
"rev": "fa98075869eb8264052548dde5c2ce9e68cf4cf1",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"id": "nixpkgs",
|
"owner": "NixOS",
|
||||||
"ref": "nixos-23.05-small",
|
"ref": "nixos-22.11-small",
|
||||||
"type": "indirect"
|
"repo": "nixpkgs",
|
||||||
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs-lib": {
|
"nixpkgs-lib": {
|
||||||
|
|
@ -111,65 +51,26 @@
|
||||||
},
|
},
|
||||||
"nixpkgs-stable": {
|
"nixpkgs-stable": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1700905716,
|
"lastModified": 1680390120,
|
||||||
"narHash": "sha256-w1vHn2MbGfdC+CrP3xLZ3scsI06N0iQLU7eTHIVEFGw=",
|
"narHash": "sha256-RyDJcG/7mfimadlo8vO0QjW22mvYH1+cCqMuigUntr8=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "dfb95385d21475da10b63da74ae96d89ab352431",
|
"rev": "c1e2efaca8d8a3db6a36f652765d6c6ba7bb8fae",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"ref": "release-23.05",
|
"ref": "release-22.11",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs-unstable": {
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1701368325,
|
|
||||||
"narHash": "sha256-3OqZyi2EdopJxpxwrySPyCTuCvfBY4oXTLVgQ4B6qDg=",
|
|
||||||
"owner": "NixOS",
|
|
||||||
"repo": "nixpkgs",
|
|
||||||
"rev": "3934dbde4f4a0e266825348bc4ad1bdd00a8d6a3",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"id": "nixpkgs",
|
|
||||||
"ref": "nixos-unstable-small",
|
|
||||||
"type": "indirect"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"pvv-calendar-bot": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1693136143,
|
|
||||||
"narHash": "sha256-amHprjftc3y/bg8yf4hITCLa+ez5HIi0yGfR7TU6UIc=",
|
|
||||||
"ref": "refs/heads/main",
|
|
||||||
"rev": "a32894b305f042d561500f5799226afd1faf5abb",
|
|
||||||
"revCount": 9,
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"root": {
|
"root": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"disko": "disko",
|
|
||||||
"grzegorz": "grzegorz",
|
|
||||||
"grzegorz-clients": "grzegorz-clients",
|
|
||||||
"matrix-next": "matrix-next",
|
"matrix-next": "matrix-next",
|
||||||
"nixpkgs": "nixpkgs",
|
"nixpkgs": "nixpkgs",
|
||||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
"sops-nix": "sops-nix",
|
||||||
"pvv-calendar-bot": "pvv-calendar-bot",
|
"unstable": "unstable"
|
||||||
"sops-nix": "sops-nix"
|
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"sops-nix": {
|
"sops-nix": {
|
||||||
|
|
@ -180,11 +81,11 @@
|
||||||
"nixpkgs-stable": "nixpkgs-stable"
|
"nixpkgs-stable": "nixpkgs-stable"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1701127353,
|
"lastModified": 1680404136,
|
||||||
"narHash": "sha256-qVNX0wOl0b7+I35aRu78xUphOyELh+mtUp1KBx89K1Q=",
|
"narHash": "sha256-06D8HJmRv4DdpEQGblMhx2Vm81SBWM61XBBIx7QQfo0=",
|
||||||
"owner": "Mic92",
|
"owner": "Mic92",
|
||||||
"repo": "sops-nix",
|
"repo": "sops-nix",
|
||||||
"rev": "b1edbf5c0464b4cced90a3ba6f999e671f0af631",
|
"rev": "b93eb910f768f9788737bfed596a598557e5625d",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
@ -192,6 +93,22 @@
|
||||||
"repo": "sops-nix",
|
"repo": "sops-nix",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
|
},
|
||||||
|
"unstable": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1680882415,
|
||||||
|
"narHash": "sha256-trt2pwLDu1+kEtp3bx2DiYgg8CFWNbes+ujdAtSBO/U=",
|
||||||
|
"owner": "NixOS",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"rev": "cd07e0258cf73e1bcbd0c9abc5513baa091ee801",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "NixOS",
|
||||||
|
"ref": "nixos-unstable-small",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"root": "root",
|
"root": "root",
|
||||||
|
|
|
||||||
120
flake.nix
120
flake.nix
|
|
@ -2,139 +2,51 @@
|
||||||
description = "PVV System flake";
|
description = "PVV System flake";
|
||||||
|
|
||||||
inputs = {
|
inputs = {
|
||||||
nixpkgs.url = "nixpkgs/nixos-23.05-small";
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11-small";
|
||||||
nixpkgs-unstable.url = "nixpkgs/nixos-unstable-small";
|
unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
|
||||||
|
|
||||||
sops-nix.url = "github:Mic92/sops-nix";
|
sops-nix.url = "github:Mic92/sops-nix";
|
||||||
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
disko.url = "github:nix-community/disko";
|
matrix-next.url = "github:dali99/nixos-matrix-modules";
|
||||||
disko.inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
|
|
||||||
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
|
|
||||||
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
|
|
||||||
# Last release compatible with 23.05
|
|
||||||
matrix-next.url = "github:dali99/nixos-matrix-modules/e09814657187c8ed1a5fe1646df6d8da1eb2dee9";
|
|
||||||
|
|
||||||
grzegorz.url = "github:Programvareverkstedet/grzegorz";
|
|
||||||
grzegorz.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
|
||||||
grzegorz-clients.url = "github:Programvareverkstedet/grzegorz-clients";
|
|
||||||
grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
|
outputs = { self, nixpkgs, matrix-next, unstable, sops-nix, ... }@inputs:
|
||||||
let
|
let
|
||||||
nixlib = nixpkgs.lib;
|
|
||||||
systems = [
|
systems = [
|
||||||
"x86_64-linux"
|
"x86_64-linux"
|
||||||
"aarch64-linux"
|
"aarch64-linux"
|
||||||
"aarch64-darwin"
|
|
||||||
];
|
|
||||||
forAllSystems = f: nixlib.genAttrs systems (system: f system);
|
|
||||||
allMachines = nixlib.mapAttrsToList (name: _: name) self.nixosConfigurations;
|
|
||||||
importantMachines = [
|
|
||||||
"bekkalokk"
|
|
||||||
"bicep"
|
|
||||||
"brzeczyszczykiewicz"
|
|
||||||
"georg"
|
|
||||||
"ildkule"
|
|
||||||
];
|
];
|
||||||
|
forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f system);
|
||||||
in {
|
in {
|
||||||
nixosConfigurations = let
|
nixosConfigurations = let
|
||||||
nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
|
nixosConfig = name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
|
||||||
|
config
|
||||||
rec {
|
rec {
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
specialArgs = {
|
specialArgs = {
|
||||||
inherit nixpkgs-unstable inputs;
|
inherit unstable inputs;
|
||||||
values = import ./values.nix;
|
values = import ./values.nix;
|
||||||
};
|
};
|
||||||
|
|
||||||
modules = [
|
modules = [
|
||||||
./hosts/${name}/configuration.nix
|
./hosts/${name}/configuration.nix
|
||||||
sops-nix.nixosModules.sops
|
sops-nix.nixosModules.sops
|
||||||
|
matrix-next.nixosModules.synapse
|
||||||
];
|
];
|
||||||
|
});
|
||||||
|
|
||||||
pkgs = import nixpkgs {
|
|
||||||
inherit system;
|
|
||||||
overlays = [
|
|
||||||
(final: prev: {
|
|
||||||
mx-puppet-discord = prev.mx-puppet-discord.override { nodejs_14 = final.nodejs_18; };
|
|
||||||
})
|
|
||||||
inputs.pvv-calendar-bot.overlays.${system}.default
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
config
|
|
||||||
);
|
|
||||||
|
|
||||||
stableNixosConfig = nixosConfig nixpkgs;
|
|
||||||
unstableNixosConfig = nixosConfig nixpkgs-unstable;
|
|
||||||
in {
|
in {
|
||||||
bicep = stableNixosConfig "bicep" {
|
bicep = nixosConfig "bicep" { };
|
||||||
modules = [
|
bekkalokk = nixosConfig "bekkalokk" { };
|
||||||
./hosts/bicep/configuration.nix
|
greddost = nixosConfig "greddost" { };
|
||||||
sops-nix.nixosModules.sops
|
ildkule = nixosConfig "ildkule" { };
|
||||||
|
jokum = nixosConfig "jokum" {
|
||||||
inputs.matrix-next.nixosModules.default
|
modules = [ matrix-next.nixosModules.synapse ];
|
||||||
inputs.pvv-calendar-bot.nixosModules.default
|
|
||||||
];
|
|
||||||
};
|
|
||||||
bekkalokk = stableNixosConfig "bekkalokk" { };
|
|
||||||
bob = stableNixosConfig "bob" {
|
|
||||||
modules = [
|
|
||||||
./hosts/bob/configuration.nix
|
|
||||||
sops-nix.nixosModules.sops
|
|
||||||
|
|
||||||
disko.nixosModules.disko
|
|
||||||
{ disko.devices.disk.disk1.device = "/dev/vda"; }
|
|
||||||
];
|
|
||||||
};
|
|
||||||
ildkule = stableNixosConfig "ildkule" { };
|
|
||||||
#ildkule-unstable = unstableNixosConfig "ildkule" { };
|
|
||||||
shark = stableNixosConfig "shark" { };
|
|
||||||
|
|
||||||
brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
|
|
||||||
modules = [
|
|
||||||
./hosts/brzeczyszczykiewicz/configuration.nix
|
|
||||||
sops-nix.nixosModules.sops
|
|
||||||
|
|
||||||
inputs.grzegorz.nixosModules.grzegorz-kiosk
|
|
||||||
inputs.grzegorz-clients.nixosModules.grzegorz-webui
|
|
||||||
];
|
|
||||||
};
|
|
||||||
georg = stableNixosConfig "georg" {
|
|
||||||
modules = [
|
|
||||||
./hosts/georg/configuration.nix
|
|
||||||
sops-nix.nixosModules.sops
|
|
||||||
|
|
||||||
inputs.grzegorz.nixosModules.grzegorz-kiosk
|
|
||||||
inputs.grzegorz-clients.nixosModules.grzegorz-webui
|
|
||||||
];
|
|
||||||
};
|
|
||||||
buskerud = stableNixosConfig "buskerud" {
|
|
||||||
modules = [
|
|
||||||
./hosts/buskerud/configuration.nix
|
|
||||||
sops-nix.nixosModules.sops
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
devShells = forAllSystems (system: {
|
devShells = forAllSystems (system: {
|
||||||
default = nixpkgs.legacyPackages.${system}.callPackage ./shell.nix { };
|
default = nixpkgs.legacyPackages.${system}.callPackage ./shell.nix { };
|
||||||
});
|
});
|
||||||
|
|
||||||
packages = {
|
|
||||||
"x86_64-linux" = let
|
|
||||||
pkgs = nixpkgs.legacyPackages."x86_64-linux";
|
|
||||||
in rec {
|
|
||||||
default = important-machines;
|
|
||||||
important-machines = pkgs.linkFarm "important-machines"
|
|
||||||
(nixlib.getAttrs importantMachines self.packages.x86_64-linux);
|
|
||||||
all-machines = pkgs.linkFarm "all-machines"
|
|
||||||
(nixlib.getAttrs allMachines self.packages.x86_64-linux);
|
|
||||||
} // nixlib.genAttrs allMachines
|
|
||||||
(machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -4,15 +4,11 @@
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
|
|
||||||
../../base.nix
|
../../base.nix
|
||||||
../../misc/metrics-exporters.nix
|
|
||||||
|
|
||||||
#./services/keycloak.nix
|
|
||||||
|
|
||||||
# TODO: set up authentication for the following:
|
# TODO: set up authentication for the following:
|
||||||
# ./services/website.nix
|
# ./services/website.nix
|
||||||
./services/nginx
|
./services/nginx.nix
|
||||||
./services/gitea/default.nix
|
./services/gitea.nix
|
||||||
./services/webmail
|
|
||||||
# ./services/mediawiki.nix
|
# ./services/mediawiki.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|
@ -24,12 +20,10 @@
|
||||||
boot.loader.systemd-boot.enable = true;
|
boot.loader.systemd-boot.enable = true;
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
|
||||||
virtualisation.podman.enable = true;
|
|
||||||
|
|
||||||
networking.hostName = "bekkalokk";
|
networking.hostName = "bekkalokk";
|
||||||
|
|
||||||
systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
|
systemd.network.networks."30-ens33" = values.defaultNetworkConfig // {
|
||||||
matchConfig.Name = "enp2s0";
|
matchConfig.Name = "ens33";
|
||||||
address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -4,27 +4,25 @@
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
{ config, lib, pkgs, modulesPath, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
imports =
|
imports = [ ];
|
||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
boot.initrd.availableKernelModules = [ "ata_piix" "mptspi" "uhci_hcd" "ehci_pci" "sd_mod" "sr_mod" ];
|
||||||
boot.initrd.kernelModules = [ ];
|
boot.initrd.kernelModules = [ ];
|
||||||
boot.kernelModules = [ "kvm-intel" ];
|
boot.kernelModules = [ ];
|
||||||
boot.extraModulePackages = [ ];
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
fileSystems."/" =
|
fileSystems."/" =
|
||||||
{ device = "/dev/sda1";
|
{ device = "/dev/disk/by-uuid/cdcafe3a-01d8-4bdf-9a3d-78705b581090";
|
||||||
fsType = "btrfs";
|
fsType = "ext4";
|
||||||
};
|
};
|
||||||
|
|
||||||
fileSystems."/boot" =
|
fileSystems."/boot" =
|
||||||
{ device = "/dev/disk/by-uuid/CE63-3B9B";
|
{ device = "/dev/disk/by-uuid/1CB4-280D";
|
||||||
fsType = "vfat";
|
fsType = "vfat";
|
||||||
};
|
};
|
||||||
|
|
||||||
swapDevices =
|
swapDevices =
|
||||||
[ { device = "/dev/disk/by-uuid/2df10c7b-0dec-45c6-a728-533f7da7f4b9"; }
|
[ { device = "/dev/disk/by-uuid/3eaace48-91ec-4d46-be86-fd26877d8b86"; }
|
||||||
];
|
];
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
|
|
@ -32,8 +30,7 @@
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
networking.useDHCP = lib.mkDefault true;
|
networking.useDHCP = lib.mkDefault true;
|
||||||
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
# networking.interfaces.ens33.useDHCP = lib.mkDefault true;
|
||||||
# networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,57 @@
|
||||||
|
{ config, values, pkgs, ... }:
|
||||||
|
let
|
||||||
|
cfg = config.services.gitea;
|
||||||
|
in {
|
||||||
|
sops.secrets."gitea/dbpassword" = { };
|
||||||
|
|
||||||
|
services.gitea = {
|
||||||
|
enable = true;
|
||||||
|
user = "git";
|
||||||
|
rootUrl = "https://gitea.pvv.ntnu.no/";
|
||||||
|
stateDir = "/data/gitea";
|
||||||
|
appName = "PVV Git";
|
||||||
|
|
||||||
|
enableUnixSocket = true;
|
||||||
|
|
||||||
|
database = {
|
||||||
|
type = "postgres";
|
||||||
|
host = values.hosts.bicep.ipv4;
|
||||||
|
port = 5432;
|
||||||
|
passwordFile = config.sops.secrets."gitea/dbpassword".path;
|
||||||
|
createDatabase = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
settings = {
|
||||||
|
service.DISABLE_REGISTRATION = true;
|
||||||
|
session.COOKIE_SECURE = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx.virtualHosts = {
|
||||||
|
"gitea.pvv.ntnu.no" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://unix:/run/gitea/gitea.sock";
|
||||||
|
proxyWebsockets = true;
|
||||||
|
recommendedProxySettings = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
"git2.pvv.ntnu.no" = {
|
||||||
|
globalRedirect = "gitea.pvv.ntnu.no";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
users.users.git = {
|
||||||
|
description = "Gitea service";
|
||||||
|
home = cfg.stateDir;
|
||||||
|
#useDefaultShell = true;
|
||||||
|
|
||||||
|
group = "gitea";
|
||||||
|
isSystemUser = true;
|
||||||
|
#uid = config.ids.uids.git;
|
||||||
|
packages = [ pkgs.gitea ];
|
||||||
|
};
|
||||||
|
|
||||||
|
}
|
||||||
|
|
@ -1,30 +0,0 @@
|
||||||
{ config, lib, values, ... }:
|
|
||||||
let
|
|
||||||
mkRunner = name: {
|
|
||||||
# This is unfortunately state, and has to be generated one at a time :(
|
|
||||||
# To do that, comment out all except one of the runners, fill in its token
|
|
||||||
# inside the sops file, rebuild the system, and only after this runner has
|
|
||||||
# successfully registered will gitea give you the next token.
|
|
||||||
# - oysteikt Sep 2023
|
|
||||||
sops.secrets."gitea/runners/${name}".restartUnits = [
|
|
||||||
"gitea-runner-${name}.service"
|
|
||||||
];
|
|
||||||
|
|
||||||
services.gitea-actions-runner.instances = {
|
|
||||||
${name} = {
|
|
||||||
enable = true;
|
|
||||||
name = "git-runner-${name}"; url = "https://git.pvv.ntnu.no";
|
|
||||||
labels = [
|
|
||||||
"debian-latest:docker://node:18-bullseye"
|
|
||||||
"ubuntu-latest:docker://node:18-bullseye"
|
|
||||||
];
|
|
||||||
tokenFile = config.sops.secrets."gitea/runners/${name}".path;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
in
|
|
||||||
lib.mkMerge [
|
|
||||||
(mkRunner "alpha")
|
|
||||||
(mkRunner "beta")
|
|
||||||
(mkRunner "epsilon")
|
|
||||||
]
|
|
||||||
|
|
@ -1,105 +0,0 @@
|
||||||
{ config, values, pkgs, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.gitea;
|
|
||||||
domain = "git.pvv.ntnu.no";
|
|
||||||
sshPort = 2222;
|
|
||||||
in {
|
|
||||||
imports = [
|
|
||||||
./ci.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
sops.secrets = {
|
|
||||||
"gitea/database" = {
|
|
||||||
owner = "gitea";
|
|
||||||
group = "gitea";
|
|
||||||
};
|
|
||||||
"gitea/passwd-ssh-key" = { };
|
|
||||||
"gitea/ssh-known-hosts" = { };
|
|
||||||
"gitea/import-user-env" = { };
|
|
||||||
};
|
|
||||||
|
|
||||||
services.gitea = {
|
|
||||||
enable = true;
|
|
||||||
stateDir = "/data/gitea";
|
|
||||||
appName = "PVV Git";
|
|
||||||
|
|
||||||
database = {
|
|
||||||
type = "postgres";
|
|
||||||
host = "postgres.pvv.ntnu.no";
|
|
||||||
port = config.services.postgresql.port;
|
|
||||||
passwordFile = config.sops.secrets."gitea/database".path;
|
|
||||||
createDatabase = false;
|
|
||||||
};
|
|
||||||
|
|
||||||
settings = {
|
|
||||||
server = {
|
|
||||||
DOMAIN = domain;
|
|
||||||
ROOT_URL = "https://${domain}/";
|
|
||||||
PROTOCOL = "http+unix";
|
|
||||||
SSH_PORT = sshPort;
|
|
||||||
START_SSH_SERVER = true;
|
|
||||||
};
|
|
||||||
indexer.REPO_INDEXER_ENABLED = true;
|
|
||||||
service.DISABLE_REGISTRATION = true;
|
|
||||||
session.COOKIE_SECURE = true;
|
|
||||||
database.LOG_SQL = false;
|
|
||||||
picture = {
|
|
||||||
DISABLE_GRAVATAR = true;
|
|
||||||
ENABLE_FEDERATED_AVATAR = false;
|
|
||||||
};
|
|
||||||
actions.ENABLED = true;
|
|
||||||
"ui.meta".DESCRIPTION = "Bokstavelig talt programvareverkstedet";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
environment.systemPackages = [ cfg.package ];
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."${domain}" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
locations."/" = {
|
|
||||||
proxyPass = "http://unix:${cfg.settings.server.HTTP_ADDR}";
|
|
||||||
recommendedProxySettings = true;
|
|
||||||
extraConfig = ''
|
|
||||||
client_max_body_size 512M;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ sshPort ];
|
|
||||||
|
|
||||||
# Automatically import users
|
|
||||||
systemd.services.gitea-import-users = {
|
|
||||||
enable = true;
|
|
||||||
preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /tmp/passwd-import'';
|
|
||||||
serviceConfig = {
|
|
||||||
ExecStart = pkgs.writers.writePython3 "gitea-import-users" { libraries = [ pkgs.python3Packages.requests ]; } (builtins.readFile ./gitea-import-users.py);
|
|
||||||
LoadCredential=[
|
|
||||||
"sshkey:${config.sops.secrets."gitea/passwd-ssh-key".path}"
|
|
||||||
"ssh-known-hosts:${config.sops.secrets."gitea/ssh-known-hosts".path}"
|
|
||||||
];
|
|
||||||
DynamicUser="yes";
|
|
||||||
EnvironmentFile=config.sops.secrets."gitea/import-user-env".path;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.timers.gitea-import-users = {
|
|
||||||
requires = [ "gitea.service" ];
|
|
||||||
after = [ "gitea.service" ];
|
|
||||||
wantedBy = [ "timers.target" ];
|
|
||||||
timerConfig = {
|
|
||||||
OnCalendar = "*-*-* 02:00:00";
|
|
||||||
Persistent = true;
|
|
||||||
Unit = "gitea-import-users.service";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
system.activationScripts.linkGiteaLogo.text = let
|
|
||||||
logo-svg = ../../../../assets/logo_blue_regular.svg;
|
|
||||||
logo-png = ../../../../assets/logo_blue_regular.png;
|
|
||||||
in ''
|
|
||||||
install -Dm444 ${logo-svg} ${cfg.stateDir}/custom/public/img/logo.svg
|
|
||||||
install -Dm444 ${logo-png} ${cfg.stateDir}/custom/public/img/logo.png
|
|
||||||
install -Dm444 ${./loading.apng} ${cfg.stateDir}/custom/public/img/loading.png
|
|
||||||
'';
|
|
||||||
}
|
|
||||||
|
|
@ -1,94 +0,0 @@
|
||||||
import requests
|
|
||||||
import secrets
|
|
||||||
import os
|
|
||||||
|
|
||||||
EMAIL_DOMAIN = os.getenv('EMAIL_DOMAIN')
|
|
||||||
if EMAIL_DOMAIN is None:
|
|
||||||
EMAIL_DOMAIN = 'pvv.ntnu.no'
|
|
||||||
|
|
||||||
API_TOKEN = os.getenv('API_TOKEN')
|
|
||||||
if API_TOKEN is None:
|
|
||||||
raise Exception('API_TOKEN not set')
|
|
||||||
|
|
||||||
GITEA_API_URL = os.getenv('GITEA_API_URL')
|
|
||||||
if GITEA_API_URL is None:
|
|
||||||
GITEA_API_URL = 'https://git.pvv.ntnu.no/api/v1'
|
|
||||||
|
|
||||||
BANNED_SHELLS = [
|
|
||||||
"/usr/bin/nologin",
|
|
||||||
"/usr/sbin/nologin",
|
|
||||||
"/sbin/nologin",
|
|
||||||
"/bin/false",
|
|
||||||
"/bin/msgsh",
|
|
||||||
]
|
|
||||||
|
|
||||||
existing_users = {}
|
|
||||||
|
|
||||||
|
|
||||||
# This function should only ever be called when adding users
|
|
||||||
# from the passwd file
|
|
||||||
def add_user(username, name):
|
|
||||||
user = {
|
|
||||||
"full_name": name,
|
|
||||||
"username": username,
|
|
||||||
"login_name": username,
|
|
||||||
"visibility": "public",
|
|
||||||
"source_id": 1, # 1 = SMTP
|
|
||||||
}
|
|
||||||
|
|
||||||
if username not in existing_users:
|
|
||||||
user["password"] = secrets.token_urlsafe(32)
|
|
||||||
user["must_change_password"] = False
|
|
||||||
user["visibility"] = "private"
|
|
||||||
user["email"] = username + '@' + EMAIL_DOMAIN
|
|
||||||
|
|
||||||
r = requests.post(GITEA_API_URL + '/admin/users', json=user,
|
|
||||||
headers={'Authorization': 'token ' + API_TOKEN})
|
|
||||||
if r.status_code != 201:
|
|
||||||
print('ERR: Failed to create user ' + username + ': ' + r.text)
|
|
||||||
return
|
|
||||||
|
|
||||||
print('Created user ' + username)
|
|
||||||
existing_users[username] = user
|
|
||||||
|
|
||||||
else:
|
|
||||||
r = requests.patch(GITEA_API_URL + f'/admin/users/{username}',
|
|
||||||
json=user,
|
|
||||||
headers={'Authorization': 'token ' + API_TOKEN})
|
|
||||||
if r.status_code != 200:
|
|
||||||
print('ERR: Failed to update user ' + username + ': ' + r.text)
|
|
||||||
return
|
|
||||||
|
|
||||||
print('Updated user ' + username)
|
|
||||||
|
|
||||||
|
|
||||||
def main():
|
|
||||||
# Fetch existing users
|
|
||||||
r = requests.get(GITEA_API_URL + '/admin/users',
|
|
||||||
headers={'Authorization': 'token ' + API_TOKEN})
|
|
||||||
|
|
||||||
if r.status_code != 200:
|
|
||||||
raise Exception('Failed to get users: ' + r.text)
|
|
||||||
|
|
||||||
for user in r.json():
|
|
||||||
existing_users[user['login']] = user
|
|
||||||
|
|
||||||
# Read the file, add each user
|
|
||||||
with open("/tmp/passwd-import", 'r') as f:
|
|
||||||
for line in f.readlines():
|
|
||||||
uid = int(line.split(':')[2])
|
|
||||||
if uid < 1000:
|
|
||||||
continue
|
|
||||||
|
|
||||||
shell = line.split(':')[-1]
|
|
||||||
if shell in BANNED_SHELLS:
|
|
||||||
continue
|
|
||||||
|
|
||||||
username = line.split(':')[0]
|
|
||||||
name = line.split(':')[4].split(',')[0]
|
|
||||||
|
|
||||||
add_user(username, name)
|
|
||||||
|
|
||||||
|
|
||||||
if __name__ == '__main__':
|
|
||||||
main()
|
|
||||||
Binary file not shown.
|
Before Width: | Height: | Size: 1.1 MiB |
|
|
@ -1,24 +0,0 @@
|
||||||
{ pkgs, config, values, ... }:
|
|
||||||
{
|
|
||||||
sops.secrets."keys/postgres/keycloak" = {
|
|
||||||
owner = "keycloak";
|
|
||||||
group = "keycloak";
|
|
||||||
restartUnits = [ "keycloak.service" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
services.keycloak = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
settings = {
|
|
||||||
hostname = "auth.pvv.ntnu.no";
|
|
||||||
# hostname-strict-backchannel = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
database = {
|
|
||||||
host = values.hosts.bicep.ipv4;
|
|
||||||
createLocally = false;
|
|
||||||
passwordFile = config.sops.secrets."keys/postgres/keycloak".path;
|
|
||||||
caCert = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,175 +1,23 @@
|
||||||
{ pkgs, lib, config, values, ... }: let
|
{ values, config, ... }:
|
||||||
cfg = config.services.mediawiki;
|
{
|
||||||
|
|
||||||
# "mediawiki"
|
|
||||||
user = config.systemd.services.mediawiki-init.serviceConfig.User;
|
|
||||||
|
|
||||||
# "mediawiki"
|
|
||||||
group = config.users.users.${user}.group;
|
|
||||||
in {
|
|
||||||
sops.secrets = {
|
sops.secrets = {
|
||||||
"mediawiki/password" = {
|
"mediawiki/password" = { };
|
||||||
restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
|
"postgres/mediawiki/password" = { };
|
||||||
owner = user;
|
|
||||||
group = group;
|
|
||||||
};
|
|
||||||
"keys/postgres/mediawiki" = {
|
|
||||||
restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
|
|
||||||
owner = user;
|
|
||||||
group = group;
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
services.mediawiki = {
|
services.mediawiki = {
|
||||||
enable = true;
|
enable = true;
|
||||||
name = "Programvareverkstedet";
|
name = "PVV";
|
||||||
passwordFile = config.sops.secrets."mediawiki/password".path;
|
passwordFile = config.sops.secrets."mediawiki/password".path;
|
||||||
passwordSender = "drift@pvv.ntnu.no";
|
|
||||||
|
virtualHost = {
|
||||||
|
};
|
||||||
|
|
||||||
database = {
|
database = {
|
||||||
type = "postgres";
|
type = "postgres";
|
||||||
host = "postgres.pvv.ntnu.no";
|
host = values.bicep.ipv4;
|
||||||
port = config.services.postgresql.port;
|
port = config.services.postgresql.port;
|
||||||
passwordFile = config.sops.secrets."keys/postgres/mediawiki".path;
|
passwordFile = config.sops.secrets."postgres/mediawiki/password".path;
|
||||||
createLocally = false;
|
|
||||||
# TODO: create a normal database and copy over old data when the service is production ready
|
|
||||||
name = "mediawiki_test";
|
|
||||||
};
|
};
|
||||||
|
|
||||||
# Host through nginx
|
|
||||||
webserver = "none";
|
|
||||||
poolConfig = let
|
|
||||||
listenUser = config.services.nginx.user;
|
|
||||||
listenGroup = config.services.nginx.group;
|
|
||||||
in {
|
|
||||||
inherit user group;
|
|
||||||
"pm" = "dynamic";
|
|
||||||
"pm.max_children" = 32;
|
|
||||||
"pm.max_requests" = 500;
|
|
||||||
"pm.start_servers" = 2;
|
|
||||||
"pm.min_spare_servers" = 2;
|
|
||||||
"pm.max_spare_servers" = 4;
|
|
||||||
"listen.owner" = listenUser;
|
|
||||||
"listen.group" = listenGroup;
|
|
||||||
"php_admin_value[error_log]" = "stderr";
|
|
||||||
"php_admin_flag[log_errors]" = "on";
|
|
||||||
"env[PATH]" = lib.makeBinPath [ pkgs.php ];
|
|
||||||
"catch_workers_output" = true;
|
|
||||||
# to accept *.html file
|
|
||||||
"security.limit_extensions" = "";
|
|
||||||
};
|
|
||||||
|
|
||||||
extensions = {
|
|
||||||
DeleteBatch = pkgs.fetchzip {
|
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/DeleteBatch-REL1_39-995ea6f.tar.gz";
|
|
||||||
sha256 = "sha256-0F4GLCy2f5WcWIY2YgF1tVxgYbglR0VOsj/pMrW93b8=";
|
|
||||||
};
|
|
||||||
UserMerge = pkgs.fetchzip {
|
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/UserMerge-REL1_39-b10d50e.tar.gz";
|
|
||||||
sha256 = "sha256-bXhj1+OlOUJDbvEuc8iwqb1LLEu6cN6+C/7cAvnWPOQ=";
|
|
||||||
};
|
|
||||||
PluggableAuth = pkgs.fetchzip {
|
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_39-1210fc3.tar.gz";
|
|
||||||
sha256 = "sha256-F6bTMCzkK3kZwZGIsNE87WlZWqXXmTMhEjApO99YKR0=";
|
|
||||||
};
|
|
||||||
SimpleSAMLphp = pkgs.fetchzip {
|
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/SimpleSAMLphp-REL1_39-dcf0acb.tar.gz";
|
|
||||||
sha256 = "sha256-tCvFmb2+q2rxms+lRo5pgoI3h6GjCwXAR8XisPg03TQ=";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
extraConfig = let
|
|
||||||
|
|
||||||
SimpleSAMLphpRepo = pkgs.stdenvNoCC.mkDerivation rec {
|
|
||||||
pname = "configuredSimpleSAML";
|
|
||||||
version = "2.0.4";
|
|
||||||
src = pkgs.fetchzip {
|
|
||||||
url = "https://github.com/simplesamlphp/simplesamlphp/releases/download/v${version}/simplesamlphp-${version}.tar.gz";
|
|
||||||
sha256 = "sha256-pfMV/VmqqxgtG7Nx4s8MW4tWSaxOkVPtCRJwxV6RDSE=";
|
|
||||||
};
|
|
||||||
|
|
||||||
buildPhase = ''
|
|
||||||
cat > config/authsources.php << EOF
|
|
||||||
<?php
|
|
||||||
$config = array(
|
|
||||||
'default-sp' => array(
|
|
||||||
'saml:SP',
|
|
||||||
'idp' => 'https://idp.pvv.ntnu.no/',
|
|
||||||
),
|
|
||||||
);
|
|
||||||
EOF
|
|
||||||
'';
|
|
||||||
|
|
||||||
installPhase = ''
|
|
||||||
cp -r . $out
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
in ''
|
|
||||||
$wgServer = "https://bekkalokk.pvv.ntnu.no";
|
|
||||||
$wgLocaltimezone = "Europe/Oslo";
|
|
||||||
|
|
||||||
# Only allow login through SSO
|
|
||||||
$wgEnableEmail = false;
|
|
||||||
$wgEnableUserEmail = false;
|
|
||||||
$wgEmailAuthentication = false;
|
|
||||||
$wgGroupPermissions['*']['createaccount'] = false;
|
|
||||||
$wgGroupPermissions['*']['autocreateaccount'] = true;
|
|
||||||
$wgPluggableAuth_EnableAutoLogin = true;
|
|
||||||
|
|
||||||
# Disable anonymous editing
|
|
||||||
$wgGroupPermissions['*']['edit'] = false;
|
|
||||||
|
|
||||||
# Styling
|
|
||||||
$wgLogo = "/PNG/PVV-logo.png";
|
|
||||||
$wgDefaultSkin = "monobook";
|
|
||||||
|
|
||||||
# Misc
|
|
||||||
$wgEmergencyContact = "${cfg.passwordSender}";
|
|
||||||
$wgShowIPinHeader = false;
|
|
||||||
$wgUseTeX = false;
|
|
||||||
$wgLocalInterwiki = $wgSitename;
|
|
||||||
|
|
||||||
# SimpleSAML
|
|
||||||
$wgSimpleSAMLphp_InstallDir = "${SimpleSAMLphpRepo}";
|
|
||||||
$wgSimpleSAMLphp_AuthSourceId = "default-sp";
|
|
||||||
$wgSimpleSAMLphp_RealNameAttribute = "cn";
|
|
||||||
$wgSimpleSAMLphp_EmailAttribute = "mail";
|
|
||||||
$wgSimpleSAMLphp_UsernameAttribute = "uid";
|
|
||||||
|
|
||||||
# Fix https://github.com/NixOS/nixpkgs/issues/183097
|
|
||||||
$wgDBserver = "${toString cfg.database.host}";
|
|
||||||
'';
|
|
||||||
};
|
};
|
||||||
|
|
||||||
# Override because of https://github.com/NixOS/nixpkgs/issues/183097
|
|
||||||
systemd.services.mediawiki-init.script = let
|
|
||||||
# According to module
|
|
||||||
stateDir = "/var/lib/mediawiki";
|
|
||||||
pkg = cfg.finalPackage;
|
|
||||||
mediawikiConfig = config.services.phpfpm.pools.mediawiki.phpEnv.MEDIAWIKI_CONFIG;
|
|
||||||
inherit (lib) optionalString mkForce;
|
|
||||||
in mkForce ''
|
|
||||||
if ! test -e "${stateDir}/secret.key"; then
|
|
||||||
tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c 64 > ${stateDir}/secret.key
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "exit( wfGetDB( DB_MASTER )->tableExists( 'user' ) ? 1 : 0 );" | \
|
|
||||||
${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/eval.php --conf ${mediawikiConfig} && \
|
|
||||||
${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/install.php \
|
|
||||||
--confpath /tmp \
|
|
||||||
--scriptpath / \
|
|
||||||
--dbserver "${cfg.database.host}" \
|
|
||||||
--dbport ${toString cfg.database.port} \
|
|
||||||
--dbname ${cfg.database.name} \
|
|
||||||
${optionalString (cfg.database.tablePrefix != null) "--dbprefix ${cfg.database.tablePrefix}"} \
|
|
||||||
--dbuser ${cfg.database.user} \
|
|
||||||
${optionalString (cfg.database.passwordFile != null) "--dbpassfile ${cfg.database.passwordFile}"} \
|
|
||||||
--passfile ${cfg.passwordFile} \
|
|
||||||
--dbtype ${cfg.database.type} \
|
|
||||||
${cfg.name} \
|
|
||||||
admin
|
|
||||||
|
|
||||||
${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/update.php --conf ${mediawikiConfig} --quick
|
|
||||||
'';
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,28 @@
|
||||||
|
{ config, ... }:
|
||||||
|
{
|
||||||
|
security.acme = {
|
||||||
|
acceptTerms = true;
|
||||||
|
defaults.email = "danio@pvv.ntnu.no";
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
|
||||||
|
recommendedTlsSettings = true;
|
||||||
|
recommendedProxySettings = true;
|
||||||
|
recommendedOptimisation = true;
|
||||||
|
recommendedGzipSettings = true;
|
||||||
|
|
||||||
|
# virtualHosts = {
|
||||||
|
# "www.pvv.ntnu.no" = {
|
||||||
|
# forceSSL = true;
|
||||||
|
|
||||||
|
# locations = {
|
||||||
|
# "/pvv" = {
|
||||||
|
# proxyPass = "http://localhost:${config.services.mediawiki.virtualHost.listen.pvv.port}";
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -1,22 +0,0 @@
|
||||||
{ pkgs, config, ... }:
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
./ingress.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
security.acme = {
|
|
||||||
acceptTerms = true;
|
|
||||||
defaults.email = "drift@pvv.ntnu.no";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
recommendedTlsSettings = true;
|
|
||||||
recommendedProxySettings = true;
|
|
||||||
recommendedOptimisation = true;
|
|
||||||
recommendedGzipSettings = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
|
||||||
}
|
|
||||||
|
|
@ -1,55 +0,0 @@
|
||||||
{ config, lib, ... }:
|
|
||||||
{
|
|
||||||
services.nginx.virtualHosts = {
|
|
||||||
"www2.pvv.ntnu.no" = {
|
|
||||||
serverAliases = [ "www2.pvv.org" "pvv.ntnu.no" "pvv.org" ];
|
|
||||||
addSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
|
|
||||||
locations = {
|
|
||||||
# Proxy home directories
|
|
||||||
"/~" = {
|
|
||||||
extraConfig = ''
|
|
||||||
proxy_redirect off;
|
|
||||||
proxy_pass https://tom.pvv.ntnu.no;
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
# Redirect old wiki entries
|
|
||||||
"/disk".return = "301 https://www.pvv.ntnu.no/pvv/Diskkjøp";
|
|
||||||
"/dok/boker.php".return = "301 https://www.pvv.ntnu.no/pvv/Bokhyllen";
|
|
||||||
"/styret/lover/".return = "301 https://www.pvv.ntnu.no/pvv/Lover";
|
|
||||||
"/styret/".return = "301 https://www.pvv.ntnu.no/pvv/Styret";
|
|
||||||
"/info/".return = "301 https://www.pvv.ntnu.no/pvv/";
|
|
||||||
"/info/maskinpark/".return = "301 https://www.pvv.ntnu.no/pvv/Maskiner";
|
|
||||||
"/medlemssider/meldinn.php".return = "301 https://www.pvv.ntnu.no/pvv/Medlemskontingent";
|
|
||||||
"/diverse/medlems-sider.php".return = "301 https://www.pvv.ntnu.no/pvv/Medlemssider";
|
|
||||||
"/cert/".return = "301 https://www.pvv.ntnu.no/pvv/CERT";
|
|
||||||
"/drift".return = "301 https://www.pvv.ntnu.no/pvv/Drift";
|
|
||||||
"/diverse/abuse.php".return = "301 https://www.pvv.ntnu.no/pvv/CERT/Abuse";
|
|
||||||
"/nerds/".return = "301 https://www.pvv.ntnu.no/pvv/Nerdepizza";
|
|
||||||
|
|
||||||
# TODO: Redirect webmail
|
|
||||||
"/webmail".return = "301 https://webmail.pvv.ntnu.no/squirrelmail";
|
|
||||||
|
|
||||||
# Redirect everything else to the main website
|
|
||||||
"/".return = "301 https://www.pvv.ntnu.no$request_uri";
|
|
||||||
|
|
||||||
# Proxy the matrix well-known files
|
|
||||||
# Host has be set before proxy_pass
|
|
||||||
# The header must be set so nginx on the other side routes it to the right place
|
|
||||||
"/.well-known/matrix/" = {
|
|
||||||
extraConfig = ''
|
|
||||||
proxy_set_header Host matrix.pvv.ntnu.no;
|
|
||||||
proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
@ -1,15 +0,0 @@
|
||||||
{ config, values, pkgs, lib, ... }:
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
./roundcube.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."webmail2.pvv.ntnu.no" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
#locations."/" = lib.mkForce { };
|
|
||||||
locations."= /" = {
|
|
||||||
return = "301 https://www.pvv.ntnu.no/mail/";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,74 +0,0 @@
|
||||||
{ config, pkgs, lib, ... }:
|
|
||||||
|
|
||||||
with lib;
|
|
||||||
let
|
|
||||||
cfg = config.services.roundcube;
|
|
||||||
domain = "webmail2.pvv.ntnu.no";
|
|
||||||
in
|
|
||||||
{
|
|
||||||
services.roundcube = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
package = pkgs.roundcube.withPlugins (plugins: with plugins; [
|
|
||||||
persistent_login
|
|
||||||
thunderbird_labels
|
|
||||||
contextmenu
|
|
||||||
custom_from
|
|
||||||
]);
|
|
||||||
|
|
||||||
dicts = with pkgs.aspellDicts; [ en en-science en-computers nb nn fr de it ];
|
|
||||||
maxAttachmentSize = 20;
|
|
||||||
hostName = "roundcubeplaceholder.example.com";
|
|
||||||
|
|
||||||
extraConfig = ''
|
|
||||||
$config['enable_installer'] = false;
|
|
||||||
$config['default_host'] = "ssl://imap.pvv.ntnu.no";
|
|
||||||
$config['default_port'] = 993;
|
|
||||||
$config['smtp_server'] = "ssl://smtp.pvv.ntnu.no";
|
|
||||||
$config['smtp_port'] = 465;
|
|
||||||
$config['mail_domain'] = "pvv.ntnu.no";
|
|
||||||
$config['smtp_user'] = "%u";
|
|
||||||
$config['support_url'] = "";
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."roundcubeplaceholder.example.com" = lib.mkForce { };
|
|
||||||
|
|
||||||
services.nginx.virtualHosts.${domain} = {
|
|
||||||
locations."/roundcube" = {
|
|
||||||
tryFiles = "$uri $uri/ =404";
|
|
||||||
index = "index.php";
|
|
||||||
root = pkgs.runCommandLocal "roundcube-dir" { } ''
|
|
||||||
mkdir -p $out
|
|
||||||
ln -s ${cfg.package} $out/roundcube
|
|
||||||
'';
|
|
||||||
extraConfig = ''
|
|
||||||
location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
|
|
||||||
# https://wiki.archlinux.org/title/Roundcube
|
|
||||||
"README"
|
|
||||||
"INSTALL"
|
|
||||||
"LICENSE"
|
|
||||||
"CHANGELOG"
|
|
||||||
"UPGRADING"
|
|
||||||
"bin"
|
|
||||||
"SQL"
|
|
||||||
".+\\.md"
|
|
||||||
"\\."
|
|
||||||
"config"
|
|
||||||
"temp"
|
|
||||||
"logs"
|
|
||||||
]})/? {
|
|
||||||
deny all;
|
|
||||||
}
|
|
||||||
|
|
||||||
location ~ ^/roundcube/(.+\.php)(/?.*)$ {
|
|
||||||
fastcgi_split_path_info ^/roundcube(/.+\.php)(/.+)$;
|
|
||||||
include ${config.services.nginx.package}/conf/fastcgi_params;
|
|
||||||
include ${config.services.nginx.package}/conf/fastcgi.conf;
|
|
||||||
fastcgi_index index.php;
|
|
||||||
fastcgi_pass unix:${config.services.phpfpm.pools.roundcube.socket};
|
|
||||||
}
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,24 +0,0 @@
|
||||||
{ values, ... }:
|
|
||||||
{
|
|
||||||
users.groups.acme.members = [ "nginx" ];
|
|
||||||
|
|
||||||
security.acme.certs."postgres.pvv.ntnu.no" = {
|
|
||||||
group = "acme";
|
|
||||||
extraDomainNames = [
|
|
||||||
# "postgres.pvv.org"
|
|
||||||
"bicep.pvv.ntnu.no"
|
|
||||||
# "bicep.pvv.org"
|
|
||||||
# values.hosts.bicep.ipv4
|
|
||||||
# values.hosts.bicep.ipv6
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx = {
|
|
||||||
enable = true;
|
|
||||||
virtualHosts."postgres.pvv.ntnu.no" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
# useACMEHost = "postgres.pvv.ntnu.no";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -4,17 +4,9 @@
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
|
|
||||||
../../base.nix
|
../../base.nix
|
||||||
../../misc/metrics-exporters.nix
|
|
||||||
./services/nginx
|
|
||||||
|
|
||||||
./acmeCert.nix
|
|
||||||
|
|
||||||
./services/mysql.nix
|
|
||||||
./services/postgres.nix
|
./services/postgres.nix
|
||||||
./services/mysql.nix
|
./services/jokum.nix
|
||||||
./services/calendar-bot.nix
|
|
||||||
|
|
||||||
./services/matrix
|
|
||||||
];
|
];
|
||||||
|
|
||||||
sops.defaultSopsFile = ../../secrets/bicep/bicep.yaml;
|
sops.defaultSopsFile = ../../secrets/bicep/bicep.yaml;
|
||||||
|
|
@ -23,16 +15,17 @@
|
||||||
sops.age.generateKey = true;
|
sops.age.generateKey = true;
|
||||||
|
|
||||||
boot.loader.grub.enable = true;
|
boot.loader.grub.enable = true;
|
||||||
|
boot.loader.grub.version = 2;
|
||||||
boot.loader.grub.device = "/dev/disk/by-id/scsi-3600508b1001cb1a8751c137b30610682";
|
boot.loader.grub.device = "/dev/disk/by-id/scsi-3600508b1001cb1a8751c137b30610682";
|
||||||
|
|
||||||
networking.hostName = "bicep";
|
networking.hostName = "bicep";
|
||||||
|
|
||||||
systemd.network.networks."30-enp6s0f0" = values.defaultNetworkConfig // {
|
systemd.network.networks."30-enp6s0f0" = values.defaultNetworkConfig // {
|
||||||
matchConfig.Name = "enp6s0f0";
|
matchConfig.Name = "enp6s0f0";
|
||||||
address = with values.hosts.bicep; [ (ipv4 + "/25") (ipv6 + "/64") ]
|
address = with values.hosts.bicep; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||||
++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
|
|
||||||
};
|
};
|
||||||
systemd.network.wait-online = {
|
systemd.network.wait-online = {
|
||||||
|
ignoredInterfaces = [ "enp6s0f1" ];
|
||||||
anyInterface = true;
|
anyInterface = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,25 +0,0 @@
|
||||||
{ config, lib, pkgs, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.pvv-calendar-bot;
|
|
||||||
in {
|
|
||||||
sops.secrets."calendar-bot/matrix_token" = {
|
|
||||||
sopsFile = ../../../secrets/bicep/bicep.yaml;
|
|
||||||
key = "calendar-bot/matrix_token";
|
|
||||||
owner = cfg.user;
|
|
||||||
group = cfg.group;
|
|
||||||
};
|
|
||||||
|
|
||||||
services.pvv-calendar-bot = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
settings = {
|
|
||||||
matrix = {
|
|
||||||
homeserver = "https://matrix.pvv.ntnu.no";
|
|
||||||
user = "@bot_calendar:pvv.ntnu.no";
|
|
||||||
channel = "!gkNLUIhYVpEyLatcRz:pvv.ntnu.no";
|
|
||||||
};
|
|
||||||
secretsFile = config.sops.secrets."calendar-bot/matrix_token".path;
|
|
||||||
onCalendar = "*-*-* 09:00:00";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -0,0 +1,51 @@
|
||||||
|
{config, lib, pkgs, inputs, values, ...}:
|
||||||
|
|
||||||
|
{
|
||||||
|
# lfmao
|
||||||
|
containers.jokum = {
|
||||||
|
autoStart = true;
|
||||||
|
# wtf
|
||||||
|
#path = inputs.self.nixosConfigurations.jokum.config.system.build.toplevel;
|
||||||
|
interfaces = [ "enp6s0f1" ];
|
||||||
|
bindMounts = {
|
||||||
|
"/data" = { hostPath = "/data/jokum"; isReadOnly = false; };
|
||||||
|
};
|
||||||
|
config = {config, pkgs, ...}: let
|
||||||
|
inherit values inputs;
|
||||||
|
in {
|
||||||
|
imports = [
|
||||||
|
inputs.sops-nix.nixosModules.sops
|
||||||
|
inputs.matrix-next.nixosModules.synapse
|
||||||
|
|
||||||
|
../../jokum/services/matrix
|
||||||
|
../../jokum/services/nginx
|
||||||
|
];
|
||||||
|
|
||||||
|
_module.args = {
|
||||||
|
inherit values inputs;
|
||||||
|
};
|
||||||
|
|
||||||
|
sops.defaultSopsFile = ../../../secrets/jokum/jokum.yaml;
|
||||||
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||||
|
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||||
|
sops.age.generateKey = true;
|
||||||
|
|
||||||
|
services.openssh = {
|
||||||
|
enable = true;
|
||||||
|
permitRootLogin = "yes";
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.enable = true;
|
||||||
|
|
||||||
|
networking.useHostResolvConf = false;
|
||||||
|
|
||||||
|
systemd.network.networks."30-enp6s0f1" = values.defaultNetworkConfig // {
|
||||||
|
matchConfig.Name = "enp6s0f1";
|
||||||
|
address = with values.hosts.jokum; [ (ipv4 + "/25") (ipv6 + "/64") ]
|
||||||
|
++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
|
||||||
|
};
|
||||||
|
|
||||||
|
system.stateVersion = "21.05";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -1,17 +0,0 @@
|
||||||
{ lib, buildPythonPackage, fetchFromGitHub }:
|
|
||||||
|
|
||||||
buildPythonPackage rec {
|
|
||||||
pname = "matrix-synapse-smtp-auth";
|
|
||||||
version = "0.1.0";
|
|
||||||
|
|
||||||
src = ./.;
|
|
||||||
|
|
||||||
doCheck = false;
|
|
||||||
|
|
||||||
meta = with lib; {
|
|
||||||
description = "An SMTP auth provider for Synapse";
|
|
||||||
homepage = "pvv.ntnu.no";
|
|
||||||
license = licenses.agpl3Only;
|
|
||||||
maintainers = with maintainers; [ dandellion ];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
from setuptools import setup
|
|
||||||
|
|
||||||
setup(
|
|
||||||
name="matrix-synapse-smtp-auth",
|
|
||||||
version="0.1.0",
|
|
||||||
py_modules=['smtp_auth_provider'],
|
|
||||||
author="Daniel Løvbrøtte Olsen",
|
|
||||||
author_email="danio@pvv.ntnu.no",
|
|
||||||
description="An SMTP auth provider for Synapse",
|
|
||||||
license="AGPL-3.0-only"
|
|
||||||
)
|
|
||||||
|
|
@ -1,50 +0,0 @@
|
||||||
from typing import Awaitable, Callable, Optional, Tuple
|
|
||||||
|
|
||||||
from smtplib import SMTP_SSL as SMTP
|
|
||||||
|
|
||||||
import synapse
|
|
||||||
from synapse import module_api
|
|
||||||
|
|
||||||
import re
|
|
||||||
|
|
||||||
class SMTPAuthProvider:
|
|
||||||
def __init__(self, config: dict, api: module_api):
|
|
||||||
self.api = api
|
|
||||||
|
|
||||||
self.config = config
|
|
||||||
|
|
||||||
api.register_password_auth_provider_callbacks(
|
|
||||||
auth_checkers={
|
|
||||||
("m.login.password", ("password",)): self.check_pass,
|
|
||||||
},
|
|
||||||
)
|
|
||||||
|
|
||||||
async def check_pass(
|
|
||||||
self,
|
|
||||||
username: str,
|
|
||||||
login_type: str,
|
|
||||||
login_dict: "synapse.module_api.JsonDict",
|
|
||||||
):
|
|
||||||
if login_type != "m.login.password":
|
|
||||||
return None
|
|
||||||
|
|
||||||
# Convert `@username:server` to `username`
|
|
||||||
match = re.match(r'^@([\da-z\-\.=_\/\+]+):[\w\d\.:\[\]]+$', username)
|
|
||||||
username = match.group(1) if match else username
|
|
||||||
|
|
||||||
result = False
|
|
||||||
with SMTP(self.config["smtp_host"]) as smtp:
|
|
||||||
password = login_dict.get("password")
|
|
||||||
try:
|
|
||||||
smtp.login(username, password)
|
|
||||||
result = True
|
|
||||||
except:
|
|
||||||
return None
|
|
||||||
|
|
||||||
if result == True:
|
|
||||||
userid = self.api.get_qualified_user_id(username)
|
|
||||||
if not self.api.check_user_exists(userid):
|
|
||||||
self.api.register_user(username)
|
|
||||||
return (userid, None)
|
|
||||||
else:
|
|
||||||
return None
|
|
||||||
|
|
@ -1,53 +0,0 @@
|
||||||
{ pkgs, lib, config, values, ... }:
|
|
||||||
{
|
|
||||||
sops.secrets."mysql/password" = {
|
|
||||||
owner = "mysql";
|
|
||||||
group = "mysql";
|
|
||||||
};
|
|
||||||
|
|
||||||
users.mysql.passwordFile = config.sops.secrets."mysql/password".path;
|
|
||||||
|
|
||||||
services.mysql = {
|
|
||||||
enable = true;
|
|
||||||
dataDir = "/data/mysql";
|
|
||||||
package = pkgs.mariadb;
|
|
||||||
settings = {
|
|
||||||
mysqld = {
|
|
||||||
# PVV allows a lot of connections at the same time
|
|
||||||
max_connect_errors = 10000;
|
|
||||||
bind-address = values.services.mysql.ipv4;
|
|
||||||
skip-networking = 0;
|
|
||||||
|
|
||||||
# This was needed in order to be able to use all of the old users
|
|
||||||
# during migration from knakelibrak to bicep in Sep. 2023
|
|
||||||
secure_auth = 0;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# Note: This user also has MAX_USER_CONNECTIONS set to 3, and
|
|
||||||
# a password which can be found in /secrets/ildkule/ildkule.yaml
|
|
||||||
# We have also changed both the host and auth plugin of this user
|
|
||||||
# to be 'ildkule.pvv.ntnu.no' and 'mysql_native_password' respectively.
|
|
||||||
ensureUsers = [{
|
|
||||||
name = "prometheus_mysqld_exporter";
|
|
||||||
ensurePermissions = {
|
|
||||||
"*.*" = "PROCESS, REPLICATION CLIENT, SELECT, SLAVE MONITOR";
|
|
||||||
};
|
|
||||||
}];
|
|
||||||
};
|
|
||||||
|
|
||||||
services.mysqlBackup = {
|
|
||||||
enable = true;
|
|
||||||
location = "/var/lib/mysql/backups";
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 3306 ];
|
|
||||||
|
|
||||||
systemd.services.mysql.serviceConfig = {
|
|
||||||
IPAddressDeny = "any";
|
|
||||||
IPAddressAllow = [
|
|
||||||
values.ipv4-space
|
|
||||||
values.ipv6-space
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,7 +1,4 @@
|
||||||
{ config, pkgs, ... }:
|
{ pkgs, ... }:
|
||||||
let
|
|
||||||
sslCert = config.security.acme.certs."postgres.pvv.ntnu.no";
|
|
||||||
in
|
|
||||||
{
|
{
|
||||||
services.postgresql = {
|
services.postgresql = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
@ -22,10 +19,10 @@ in
|
||||||
superuser_reserved_connections = 3;
|
superuser_reserved_connections = 3;
|
||||||
|
|
||||||
# Memory Settings
|
# Memory Settings
|
||||||
shared_buffers = "8192 MB";
|
shared_buffers = "2048 MB";
|
||||||
work_mem = "32 MB";
|
work_mem = "32 MB";
|
||||||
maintenance_work_mem = "420 MB";
|
maintenance_work_mem = "320 MB";
|
||||||
effective_cache_size = "22 GB";
|
effective_cache_size = "6 GB";
|
||||||
effective_io_concurrency = 100;
|
effective_io_concurrency = 100;
|
||||||
random_page_cost = 1.25;
|
random_page_cost = 1.25;
|
||||||
|
|
||||||
|
|
@ -65,33 +62,14 @@ in
|
||||||
# Advanced features
|
# Advanced features
|
||||||
enable_partitionwise_join = true;
|
enable_partitionwise_join = true;
|
||||||
enable_partitionwise_aggregate = true;
|
enable_partitionwise_aggregate = true;
|
||||||
|
jit = true;
|
||||||
max_slot_wal_keep_size = "1000 MB";
|
max_slot_wal_keep_size = "1000 MB";
|
||||||
track_wal_io_timing = true;
|
track_wal_io_timing = true;
|
||||||
maintenance_io_concurrency = 100;
|
maintenance_io_concurrency = 100;
|
||||||
wal_recycle = true;
|
wal_recycle = true;
|
||||||
|
|
||||||
# SSL
|
|
||||||
ssl = true;
|
|
||||||
ssl_cert_file = "/run/credentials/postgresql.service/cert";
|
|
||||||
ssl_key_file = "/run/credentials/postgresql.service/key";
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.postgresql.serviceConfig = {
|
|
||||||
LoadCredential = [
|
|
||||||
"cert:${sslCert.directory}/cert.pem"
|
|
||||||
"key:${sslCert.directory}/key.pem"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
users.groups.acme.members = [ "postgres" ];
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 5432 ];
|
networking.firewall.allowedTCPPorts = [ 5432 ];
|
||||||
networking.firewall.allowedUDPPorts = [ 5432 ];
|
networking.firewall.allowedUDPPorts = [ 5432 ];
|
||||||
|
|
||||||
services.postgresqlBackup = {
|
|
||||||
enable = true;
|
|
||||||
location = "/var/lib/postgres/backups";
|
|
||||||
backupAll = true;
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,46 +0,0 @@
|
||||||
{ config, pkgs, values, ... }:
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
# Include the results of the hardware scan.
|
|
||||||
./hardware-configuration.nix
|
|
||||||
../../base.nix
|
|
||||||
../../misc/metrics-exporters.nix
|
|
||||||
./disks.nix
|
|
||||||
|
|
||||||
../../misc/builder.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
sops.defaultSopsFile = ../../secrets/bob/bob.yaml;
|
|
||||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
||||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
|
||||||
sops.age.generateKey = true;
|
|
||||||
|
|
||||||
boot.loader.grub = {
|
|
||||||
enable = true;
|
|
||||||
efiSupport = true;
|
|
||||||
efiInstallAsRemovable = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.hostName = "bob"; # Define your hostname.
|
|
||||||
|
|
||||||
systemd.network.networks."30-all" = values.defaultNetworkConfig // {
|
|
||||||
matchConfig.Name = "en*";
|
|
||||||
DHCP = "yes";
|
|
||||||
gateway = [ ];
|
|
||||||
};
|
|
||||||
|
|
||||||
# List packages installed in system profile
|
|
||||||
environment.systemPackages = with pkgs; [
|
|
||||||
];
|
|
||||||
|
|
||||||
# List services that you want to enable:
|
|
||||||
|
|
||||||
# This value determines the NixOS release from which the default
|
|
||||||
# settings for stateful data, like file locations and database versions
|
|
||||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
|
||||||
# this value at the release version of the first install of this system.
|
|
||||||
# Before changing this value read the documentation for this option
|
|
||||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|
||||||
system.stateVersion = "23.05"; # Did you read the comment?
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
@ -1,39 +0,0 @@
|
||||||
# Example to create a bios compatible gpt partition
|
|
||||||
{ lib, ... }:
|
|
||||||
{
|
|
||||||
disko.devices = {
|
|
||||||
disk.disk1 = {
|
|
||||||
device = lib.mkDefault "/dev/sda";
|
|
||||||
type = "disk";
|
|
||||||
content = {
|
|
||||||
type = "gpt";
|
|
||||||
partitions = {
|
|
||||||
boot = {
|
|
||||||
name = "boot";
|
|
||||||
size = "1M";
|
|
||||||
type = "EF02";
|
|
||||||
};
|
|
||||||
esp = {
|
|
||||||
name = "ESP";
|
|
||||||
size = "500M";
|
|
||||||
type = "EF00";
|
|
||||||
content = {
|
|
||||||
type = "filesystem";
|
|
||||||
format = "vfat";
|
|
||||||
mountpoint = "/boot";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
root = {
|
|
||||||
name = "root";
|
|
||||||
size = "100%";
|
|
||||||
content = {
|
|
||||||
type = "filesystem";
|
|
||||||
format = "ext4";
|
|
||||||
mountpoint = "/";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,24 +0,0 @@
|
||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_blk" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.ens3.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
}
|
|
||||||
|
|
@ -1,36 +0,0 @@
|
||||||
{ config, pkgs, values, ... }:
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
# Include the results of the hardware scan.
|
|
||||||
./hardware-configuration.nix
|
|
||||||
../../base.nix
|
|
||||||
../../misc/metrics-exporters.nix
|
|
||||||
|
|
||||||
./services/grzegorz.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.loader.systemd-boot.enable = true;
|
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
|
||||||
|
|
||||||
networking.hostName = "brzeczyszczykiewicz";
|
|
||||||
|
|
||||||
systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
|
|
||||||
matchConfig.Name = "eno1";
|
|
||||||
address = with values.hosts.brzeczyszczykiewicz; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
|
||||||
};
|
|
||||||
|
|
||||||
# List packages installed in system profile
|
|
||||||
environment.systemPackages = with pkgs; [
|
|
||||||
];
|
|
||||||
|
|
||||||
# List services that you want to enable:
|
|
||||||
|
|
||||||
# This value determines the NixOS release from which the default
|
|
||||||
# settings for stateful data, like file locations and database versions
|
|
||||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
|
||||||
# this value at the release version of the first install of this system.
|
|
||||||
# Before changing this value read the documentation for this option
|
|
||||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|
||||||
system.stateVersion = "23.05"; # Did you read the comment?
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
@ -1,39 +0,0 @@
|
||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ "kvm-intel" ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" =
|
|
||||||
{ device = "/dev/disk/by-uuid/82E3-3D03";
|
|
||||||
fsType = "vfat";
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices =
|
|
||||||
[ { device = "/dev/disk/by-uuid/d0bf9a21-44bc-44a3-ae55-8f0971875883"; }
|
|
||||||
];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
{ config, ... }:
|
|
||||||
{
|
|
||||||
imports = [ ../../../modules/grzegorz.nix ];
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."${config.networking.fqdn}" = {
|
|
||||||
serverAliases = [
|
|
||||||
"bokhylle.pvv.ntnu.no"
|
|
||||||
"bokhylle.pvv.org"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,50 +0,0 @@
|
||||||
{ config, pkgs, values, ... }:
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
# Include the results of the hardware scan.
|
|
||||||
./hardware-configuration.nix
|
|
||||||
../../base.nix
|
|
||||||
../../misc/metrics-exporters.nix
|
|
||||||
|
|
||||||
./services/openvpn-client.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
# buskerud does not support efi?
|
|
||||||
# boot.loader.systemd-boot.enable = true;
|
|
||||||
# boot.loader.efi.canTouchEfiVariables = true;
|
|
||||||
boot.loader.grub.enable = true;
|
|
||||||
boot.loader.grub.device = "/dev/sda";
|
|
||||||
|
|
||||||
networking.hostName = "buskerud";
|
|
||||||
networking.search = [ "pvv.ntnu.no" "pvv.org" ];
|
|
||||||
networking.nameservers = [ "129.241.0.200" "129.241.0.201" ];
|
|
||||||
networking.tempAddresses = "disabled";
|
|
||||||
|
|
||||||
systemd.network.networks."enp3s0f0" = values.defaultNetworkConfig // {
|
|
||||||
matchConfig.Name = "enp3s0f0";
|
|
||||||
address = with values.hosts.buskerud; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
|
||||||
};
|
|
||||||
|
|
||||||
# Buskerud should use the default gateway received from DHCP
|
|
||||||
networking.interfaces.enp14s0f1.useDHCP = true;
|
|
||||||
|
|
||||||
# networking.interfaces.tun = {
|
|
||||||
# virtual = true;
|
|
||||||
# ipv4.adresses = [ {address="129.241.210.252"; prefixLength=25; } ];
|
|
||||||
# };
|
|
||||||
|
|
||||||
# List packages installed in system profile
|
|
||||||
environment.systemPackages = with pkgs; [
|
|
||||||
];
|
|
||||||
|
|
||||||
# List services that you want to enable:
|
|
||||||
|
|
||||||
# This value determines the NixOS release from which the default
|
|
||||||
# settings for stateful data, like file locations and database versions
|
|
||||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
|
||||||
# this value at the release version of the first install of this system.
|
|
||||||
# Before changing this value read the documentation for this option
|
|
||||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|
||||||
system.stateVersion = "23.05"; # Did you read the comment?
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
@ -1,37 +0,0 @@
|
||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ata_piix" "hpsa" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ "kvm-intel" ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/ed9654fe-575a-4fb3-b6ff-1b059479acff";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices = [ ];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.enp14s0f0.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.enp14s0f1.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.enp3s0f0.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.enp3s0f1.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.enp4s0f0.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.enp4s0f1.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
|
||||||
}
|
|
||||||
|
|
@ -1,109 +0,0 @@
|
||||||
{ lib, values, ... }:
|
|
||||||
{
|
|
||||||
services.openvpn.servers."ov-tunnel" = {
|
|
||||||
config = let
|
|
||||||
conf = {
|
|
||||||
# TODO: use aliases
|
|
||||||
client = true;
|
|
||||||
dev = "tap";
|
|
||||||
proto = "udp";
|
|
||||||
#remote = "129.241.210.253 1194";
|
|
||||||
remote = "129.241.210.191 1194";
|
|
||||||
|
|
||||||
resolv-retry = "infinite";
|
|
||||||
nobind = true;
|
|
||||||
|
|
||||||
ca = "/etc/openvpn/ca.pem";
|
|
||||||
cert = "/etc/openvpn/crt.pem";
|
|
||||||
key = "/etc/openvpn/key.pem";
|
|
||||||
remote-cert-tls = "server";
|
|
||||||
cipher = "none";
|
|
||||||
|
|
||||||
user = "nobody";
|
|
||||||
group = "nobody";
|
|
||||||
|
|
||||||
status = "/var/log/openvpn-status.log";
|
|
||||||
|
|
||||||
persist-key = true;
|
|
||||||
persist-tun = true;
|
|
||||||
|
|
||||||
verb = 5;
|
|
||||||
|
|
||||||
# script-security = 2;
|
|
||||||
# up = "systemctl restart rwhod";
|
|
||||||
};
|
|
||||||
in lib.pipe conf [
|
|
||||||
(lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
|
|
||||||
(builtins.mapAttrs (_: value:
|
|
||||||
if builtins.isList value then builtins.concatStringsSep " " (map toString value)
|
|
||||||
else if value == true then value
|
|
||||||
else if builtins.any (f: f value) [
|
|
||||||
builtins.isString
|
|
||||||
builtins.isInt
|
|
||||||
builtins.isFloat
|
|
||||||
lib.isPath
|
|
||||||
lib.isDerivation
|
|
||||||
] then toString value
|
|
||||||
else throw "Unknown value in buskerud openvpn config, deading now\n${value}"
|
|
||||||
))
|
|
||||||
(lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
|
|
||||||
(builtins.concatStringsSep "\n")
|
|
||||||
(x: x + "\n\n")
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.network.networks."enp14s0f1" = {
|
|
||||||
matchConfig.Name = "enp14s0f1";
|
|
||||||
networkConfig = {
|
|
||||||
DefaultRouteOnDevice = true;
|
|
||||||
};
|
|
||||||
routes = [
|
|
||||||
{ routeConfig = {
|
|
||||||
Type = "unicast";
|
|
||||||
Destination = values.hosts.knutsen.ipv4 + "/32";
|
|
||||||
Metric = 50;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.network.netdevs."br0" = {
|
|
||||||
netdevConfig = {
|
|
||||||
Kind = "bridge";
|
|
||||||
Name = "br0";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.network.networks."br0" = {
|
|
||||||
matchConfig.Name = "br0";
|
|
||||||
routes = [
|
|
||||||
{ routeConfig = {
|
|
||||||
Type = "unicast";
|
|
||||||
Destination = values.ipv4-space;
|
|
||||||
Metric = 100;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.network.networks."enp3s0f0" = {
|
|
||||||
matchConfig.Name = "enp3s0f0";
|
|
||||||
networkConfig.DefaultRouteOnDevice = false;
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.network.networks."enp3s0f1" = {
|
|
||||||
matchConfig.Name = "enp3s0f1";
|
|
||||||
bridge = [ "br0" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.network.networks."tap0" = {
|
|
||||||
matchConfig.Name = "tap0";
|
|
||||||
bridge = [ "br0" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
#networking.nat = {
|
|
||||||
# enable = true;
|
|
||||||
# externalInterface = "enp14s0f1";
|
|
||||||
# internalInterfaces = [ "tun" ];
|
|
||||||
#};
|
|
||||||
}
|
|
||||||
|
|
@ -1,36 +0,0 @@
|
||||||
{ config, pkgs, values, ... }:
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
# Include the results of the hardware scan.
|
|
||||||
./hardware-configuration.nix
|
|
||||||
../../base.nix
|
|
||||||
../../misc/metrics-exporters.nix
|
|
||||||
|
|
||||||
../../modules/grzegorz.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.loader.systemd-boot.enable = true;
|
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
|
||||||
|
|
||||||
networking.hostName = "georg";
|
|
||||||
|
|
||||||
systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
|
|
||||||
matchConfig.Name = "eno1";
|
|
||||||
address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
|
||||||
};
|
|
||||||
|
|
||||||
# List packages installed in system profile
|
|
||||||
environment.systemPackages = with pkgs; [
|
|
||||||
];
|
|
||||||
|
|
||||||
# List services that you want to enable:
|
|
||||||
|
|
||||||
# This value determines the NixOS release from which the default
|
|
||||||
# settings for stateful data, like file locations and database versions
|
|
||||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
|
||||||
# this value at the release version of the first install of this system.
|
|
||||||
# Before changing this value read the documentation for this option
|
|
||||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|
||||||
system.stateVersion = "23.05"; # Did you read the comment?
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
@ -1,40 +0,0 @@
|
||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ "kvm-intel" ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" =
|
|
||||||
{ device = "/dev/disk/by-uuid/145E-7362";
|
|
||||||
fsType = "vfat";
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices =
|
|
||||||
[ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
|
|
||||||
];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.enp2s2.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
|
||||||
}
|
|
||||||
|
|
@ -0,0 +1,66 @@
|
||||||
|
# Edit this configuration file to define what should be installed on
|
||||||
|
# your system. Help is available in the configuration.nix(5) man page
|
||||||
|
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||||
|
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ # Include the results of the hardware scan.
|
||||||
|
../../hardware-configuration.nix
|
||||||
|
|
||||||
|
../../base.nix
|
||||||
|
|
||||||
|
../../services/minecraft
|
||||||
|
];
|
||||||
|
|
||||||
|
nixpkgs.config.packageOverrides = pkgs: {
|
||||||
|
unstable = (import <nixos-unstable>) { };
|
||||||
|
};
|
||||||
|
|
||||||
|
# Use the GRUB 2 boot loader.
|
||||||
|
boot.loader.grub.enable = true;
|
||||||
|
boot.loader.grub.version = 2;
|
||||||
|
# boot.loader.grub.efiSupport = true;
|
||||||
|
# boot.loader.grub.efiInstallAsRemovable = true;
|
||||||
|
# boot.loader.efi.efiSysMountPoint = "/boot/efi";
|
||||||
|
# Define on which hard drive you want to install Grub.
|
||||||
|
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
|
||||||
|
|
||||||
|
networking.hostName = "greddost"; # Define your hostname.
|
||||||
|
|
||||||
|
networking.interfaces.ens18.useDHCP = false;
|
||||||
|
|
||||||
|
networking.defaultGateway = "129.241.210.129";
|
||||||
|
networking.interfaces.ens18.ipv4 = {
|
||||||
|
addresses = [
|
||||||
|
{
|
||||||
|
address = "129.241.210.174";
|
||||||
|
prefixLength = 25;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
networking.interfaces.ens18.ipv6 = {
|
||||||
|
addresses = [
|
||||||
|
{
|
||||||
|
address = "2001:700:300:1900::174";
|
||||||
|
prefixLength = 64;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
networking.nameservers = [ "129.241.0.200" "129.241.0.201" ];
|
||||||
|
|
||||||
|
# Open ports in the firewall.
|
||||||
|
networking.firewall.allowedTCPPorts = [ 25565 ];
|
||||||
|
networking.firewall.allowedUDPPorts = [ 25565 ];
|
||||||
|
|
||||||
|
# This value determines the NixOS release from which the default
|
||||||
|
# settings for stateful data, like file locations and database versions
|
||||||
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
# this value at the release version of the first install of this system.
|
||||||
|
# Before changing this value read the documentation for this option
|
||||||
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
|
system.stateVersion = "21.11"; # Did you read the comment?
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
|
@ -0,0 +1,158 @@
|
||||||
|
{config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
|
||||||
|
imports = [ ./minecraft-server-fabric.nix ];
|
||||||
|
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
mcron
|
||||||
|
];
|
||||||
|
|
||||||
|
pvv.minecraft-server-fabric = {
|
||||||
|
enable = true;
|
||||||
|
eula = true;
|
||||||
|
|
||||||
|
package = pkgs.callPackage ../../pkgs/minecraft-server-fabric { minecraft-server = (pkgs.callPackage ../../pkgs/minecraft-server/1_18_1.nix { }); };
|
||||||
|
jvmOpts = "-Xms10G -Xmx10G -XX:+UnlockExperimentalVMOptions -XX:+UseZGC -XX:+DisableExplicitGC -XX:+AlwaysPreTouch -XX:+ParallelRefProcEnabled";
|
||||||
|
|
||||||
|
serverProperties = {
|
||||||
|
view-distance = 12;
|
||||||
|
simulation-distance = 12;
|
||||||
|
|
||||||
|
enable-command-block = true;
|
||||||
|
|
||||||
|
gamemode = "survival";
|
||||||
|
difficulty = "normal";
|
||||||
|
|
||||||
|
white-list = true;
|
||||||
|
|
||||||
|
enable-rcon = true;
|
||||||
|
"rcon.password" = "pvv";
|
||||||
|
};
|
||||||
|
|
||||||
|
dataDir = "/fast/minecraft-pvv";
|
||||||
|
|
||||||
|
mods = [
|
||||||
|
(pkgs.fetchurl { # Fabric API is a common dependency for fabric based mods
|
||||||
|
url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/0.44.0+1.18/fabric-api-0.44.0+1.18.jar";
|
||||||
|
sha256 = "0mlmj7mj073a48s8zgc1km0jwkphz01c1fvivn4mw37lbm2p4834";
|
||||||
|
})
|
||||||
|
(pkgs.fetchurl { # Lithium is a 100% vanilla compatible optimization mod
|
||||||
|
url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/mc1.18.1-0.7.6/lithium-fabric-mc1.18.1-0.7.6.jar";
|
||||||
|
sha256 = "1fw1ikg578v4i6bmry7810a3q53h8yspxa3awdz7d746g91g8lf7";
|
||||||
|
})
|
||||||
|
(pkgs.fetchurl { # Starlight is the lighting engine of papermc
|
||||||
|
url = "https://cdn.modrinth.com/data/H8CaAYZC/versions/Starlight%201.0.0%201.18.x/starlight-1.0.0+fabric.d0a3220.jar";
|
||||||
|
sha256 = "0bv9im45hhc8n6x57lakh2rms0g5qb7qfx8qpx8n6mbrjjz6gla1";
|
||||||
|
})
|
||||||
|
(pkgs.fetchurl { # Krypton is a linux optimized optimizer for minecrafts networking system
|
||||||
|
url = "https://cdn.modrinth.com/data/fQEb0iXm/versions/0.1.6/krypton-0.1.6.jar";
|
||||||
|
sha256 = "1ribvbww4msrfdnzlxipk8kpzz7fnwnd4q6ln6mpjlhihcjb3hni";
|
||||||
|
})
|
||||||
|
(pkgs.fetchurl { # C2ME is a parallelizer for chunk loading and generation, experimental!!!
|
||||||
|
url = "https://cdn.modrinth.com/data/VSNURh3q/versions/0.2.0+alpha.5.104%201.18.1/c2me-fabric-mc1.18.1-0.2.0+alpha.5.104-all.jar";
|
||||||
|
sha256 = "13zrpsg61fynqnnlm7dvy3ihxk8khlcqsif68ak14z7kgm4py6nw";
|
||||||
|
})
|
||||||
|
(pkgs.fetchurl { # Spark is a profiler for minecraft
|
||||||
|
url = "https://ci.lucko.me/job/spark/251/artifact/spark-fabric/build/libs/spark-fabric.jar";
|
||||||
|
sha256 = "1clvi5v7a14ba23jbka9baz99h6wcfjbadc8kkj712fmy2h0sx07";
|
||||||
|
})
|
||||||
|
#(pkgs.fetchurl { # Carpetmod gives you tps views in the tab menu,
|
||||||
|
# # but also adds a lot of optional serverside vanilla+ features (which we arent using).
|
||||||
|
# # So probably want something else
|
||||||
|
# url = "https://github.com/gnembon/fabric-carpet/releases/download/1.4.56/fabric-carpet-1.18-1.4.56+v211130.jar";
|
||||||
|
# sha256 = "0rvl2yb8xymla8c052j07gqkqfkz4h5pxf6aip2v9v0h8r84p9hf";
|
||||||
|
#})
|
||||||
|
];
|
||||||
|
|
||||||
|
whitelist = {
|
||||||
|
gunalx = "913a21ae-3a11-4178-a192-401490ca0891";
|
||||||
|
eirikwitt = "1689e626-1cc8-4b91-81c4-0632fd34eb19";
|
||||||
|
Rockj = "202c0c91-a4e0-4b45-8c1b-fc51a8956c0a";
|
||||||
|
paddishar = "326845aa-4b45-4cd9-8108-7816e10a9828";
|
||||||
|
nordyorn = "f253cddf-a520-42ab-85d3-713992746e42";
|
||||||
|
hell04 = "c681df2a-6a30-4c66-b70d-742eb68bbc04";
|
||||||
|
steinarh = "bd8c419e-e6dc-4fc5-ac62-b92f98c1abc9";
|
||||||
|
EastTown2000 = "f273ed2e-d3ba-43fc-aff4-3e800cdf25e1";
|
||||||
|
DirDanner = "5b5476a2-1138-476b-9ff1-1f39f834a428";
|
||||||
|
asgeirbj = "dbd5d89f-3d8a-4662-ad15-6c4802d0098f";
|
||||||
|
Linke03 = "0dbc661d-898a-47ff-a371-32b7bd76b78b";
|
||||||
|
somaen = "cc0bdd13-4304-4160-80e7-8f043446fa83";
|
||||||
|
einaman = "39f45df3-423d-4274-9ef9-c9b7575e3804";
|
||||||
|
liseu = "c8f4d9d8-3140-4c35-9f66-22bc351bb7e6";
|
||||||
|
torsteno = "ae1e7b15-a0de-4244-9f73-25b68427e34a";
|
||||||
|
simtind = "39c03c95-d628-4ccc-843d-ce1332462d9e";
|
||||||
|
aellaie = "c585605d-24bb-4d75-ba9c-0064f6a39328";
|
||||||
|
PerKjelsvik = "5df69f17-27c9-4426-bcae-88b435dfae73";
|
||||||
|
CelestialCry = "9e34d192-364e-4566-883a-afc868c4224d";
|
||||||
|
terjesc = "993d70e8-6f9b-4094-813c-050d1a90be62";
|
||||||
|
maxelost = "bf465915-871a-4e3e-a80c-061117b86b23";
|
||||||
|
"4ce1" = "8a9b4926-0de8-43f0-bcde-df1442dee1d0";
|
||||||
|
exponential = "1ebcca9d-0964-48f3-9154-126a9a7e64f6";
|
||||||
|
Dodsorbot = "3baa9d58-32e4-465e-80bc-9dcb34e23e1d";
|
||||||
|
HFANTOM = "cd74d407-7fb0-4454-b3f4-c0b4341fde18";
|
||||||
|
Ghostmaker = "96465eee-e665-49ab-9346-f12d5a040624";
|
||||||
|
soonhalle = "61a8e674-7c7a-4120-80d1-4453a5993350";
|
||||||
|
MasterMocca = "481e6dac-9a17-4212-9664-645c3abe232f";
|
||||||
|
soulprayfree = "cfb1fb23-5115-4fe2-9af9-00a02aea9bf8";
|
||||||
|
calibwam = "0d5d5209-bb7c-4006-9451-fb85d7d52618";
|
||||||
|
Skuggen = "f0ccee0b-741a-413a-b8e6-d04552b9d78a";
|
||||||
|
Sivertsen3 = "cefac1a6-52a7-4781-be80-e7520f758554";
|
||||||
|
vafflonaut = "4d864d5c-74e2-4f29-b57d-50dea76aaabd";
|
||||||
|
Dhila = "c71d6c23-14d7-4daf-ae59-cbf0caf45681";
|
||||||
|
remorino = "2972ab22-96b3-462d-ab4d-9b6b1775b9bb";
|
||||||
|
SamuelxJackson = "f140e4aa-0a19-48ab-b892-79b24bd82c1e";
|
||||||
|
ToanBuiDuc = "a3c54742-4caf-4334-8bbb-6402a8eb4268";
|
||||||
|
Joces123 = "ecbcfbf9-9bcc-49f0-9435-f2ac2b3217c1";
|
||||||
|
brunsviken = "75ff5f0e-8adf-4807-a7f0-4cb66f81cb7f";
|
||||||
|
oscarsb1 = "9460015a-65cc-4a2f-9f91-b940b6ce7996";
|
||||||
|
CVi = "6f5691ce-9f9c-4310-84aa-759d2f9e138e";
|
||||||
|
Tawos = "0b98e55c-10cf-4b23-85d3-d15407431ace";
|
||||||
|
evenhunn = "8751581b-cc5f-4f8b-ae1e-34d90127e074";
|
||||||
|
q41 = "a080e5b4-10ee-4d6f-957e-aa5053bb1046";
|
||||||
|
jesper001 = "fbdf3ceb-eaa9-4aeb-94c2-a587cde41774";
|
||||||
|
finninde = "f58afd00-28cd-48dd-a74a-6c1d76b57f66";
|
||||||
|
GameGuru999 = "535f2188-a4a4-4e54-bec6-74977bee09ab";
|
||||||
|
MinusOneKelvin = "b6b973bf-1e35-4a58-803b-a555fd90a172";
|
||||||
|
SuperRagna = "e2c32136-e510-41b1-84c0-41baeccfb0b9";
|
||||||
|
Zamazaki = "d4411eca-401a-4565-9451-5ced6f48f23f";
|
||||||
|
supertheodor = "610c4e86-0ecc-4e7a-bffc-35a2e7d90aa6";
|
||||||
|
Minelost = "22ae2a1f-cfd9-4f10-9e41-e7becd34aba8";
|
||||||
|
Bjand = "aed136b6-17f7-4ce1-8a7b-a09eb1694ccf";
|
||||||
|
Dandellion = "f393413b-59fc-49d7-a5c4-83a5d177132c";
|
||||||
|
Shogori = "f9d571bd-5754-46e8-aef8-e89b38a6be9b";
|
||||||
|
Caragath = "f8d34f3a-55c3-4adc-b8d8-73a277f979e8";
|
||||||
|
Shmaapqueen = "425f2eef-1a9d-4626-9ba3-cd58156943dc";
|
||||||
|
Liquidlif3 = "420482b3-885f-4951-ba1e-30c22438a7e0";
|
||||||
|
newtonseple = "7d8bf9ca-0499-4cb7-9d6a-daabf80482b6";
|
||||||
|
nainis = "2eaf3736-decc-4e11-9a44-af2df0ee7c81";
|
||||||
|
Devolan = "87016228-76b2-434f-a963-33b005ae9e42";
|
||||||
|
zSkyler = "c92169e4-ca14-4bd5-9ea2-410fe956abe2";
|
||||||
|
Cryovat = "7127d743-873e-464b-927a-d23b9ad5b74a";
|
||||||
|
cybrhuman = "14a67926-cff0-4542-a111-7f557d10cc67";
|
||||||
|
stinl = "3a08be01-1e74-4d68-88d1-07d0eb23356f";
|
||||||
|
Mirithing = "7b327f51-4f1b-4606-88c7-378eff1b92b1";
|
||||||
|
"_dextra" = "4b7b4ee7-eb5b-48fd-88c3-1cc68f06acda";
|
||||||
|
Soraryuu = "0d5ffe48-e64f-4d6d-9432-f374ea8ec10c";
|
||||||
|
klarken1 = "d6967cb8-2bc6-4db7-a093-f0770cce47df";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = [ 25565 ];
|
||||||
|
networking.firewall.allowedUDPPorts = [ 25565 ];
|
||||||
|
|
||||||
|
systemd.services."minecraft-backup" = {
|
||||||
|
serviceConfig.Type = "oneshot";
|
||||||
|
script = ''
|
||||||
|
${pkgs.mcrcon}/bin/mcrcon -p pvv "say Starting Backup" "save-off" "save-all"
|
||||||
|
${pkgs.rsync}/bin/rsync -aiz --delete ${config.pvv.minecraft-server-fabric.dataDir}/world /fast/backup # Where to put backup
|
||||||
|
${pkgs.mcrcon}/bin/mcrcon -p pvv "save-all" "say Completed Backup" "save-on" "save-all"
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.timers."minecraft-backup" = {
|
||||||
|
wantedBy = ["timers.target"];
|
||||||
|
timerConfig.OnCalendar = [ "hourly" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,180 @@
|
||||||
|
{ lib, pkgs, config, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
|
cfg = config.pvv.minecraft-server-fabric;
|
||||||
|
|
||||||
|
# We don't allow eula=false anyways
|
||||||
|
eulaFile = builtins.toFile "eula.txt" ''
|
||||||
|
# eula.txt managed by NixOS Configuration
|
||||||
|
eula=true
|
||||||
|
'';
|
||||||
|
|
||||||
|
whitelistFile = pkgs.writeText "whitelist.json"
|
||||||
|
(builtins.toJSON
|
||||||
|
(mapAttrsToList (n: v: { name = n; uuid = v; }) cfg.whitelist));
|
||||||
|
|
||||||
|
cfgToString = v: if builtins.isBool v then boolToString v else toString v;
|
||||||
|
|
||||||
|
serverPropertiesFile = pkgs.writeText "server.properties" (''
|
||||||
|
# server.properties managed by NixOS configuration
|
||||||
|
'' + concatStringsSep "\n" (mapAttrsToList
|
||||||
|
(n: v: "${n}=${cfgToString v}") cfg.serverProperties));
|
||||||
|
|
||||||
|
defaultServerPort = 25565;
|
||||||
|
|
||||||
|
serverPort = cfg.serverProperties.server-port or defaultServerPort;
|
||||||
|
|
||||||
|
rconPort = if cfg.serverProperties.enable-rcon or false
|
||||||
|
then cfg.serverProperties."rcon.port" or 25575
|
||||||
|
else null;
|
||||||
|
|
||||||
|
queryPort = if cfg.serverProperties.enable-query or false
|
||||||
|
then cfg.serverProperties."query.port" or 25565
|
||||||
|
else null;
|
||||||
|
|
||||||
|
in
|
||||||
|
{
|
||||||
|
|
||||||
|
options.pvv.minecraft-server-fabric = {
|
||||||
|
enable = mkEnableOption "minecraft-server-fabric";
|
||||||
|
|
||||||
|
package = mkOption {
|
||||||
|
type = types.package;
|
||||||
|
};
|
||||||
|
|
||||||
|
eula = mkOption {
|
||||||
|
type = types.bool;
|
||||||
|
default = false;
|
||||||
|
description = ''
|
||||||
|
Whether you agree to
|
||||||
|
<link xlink:href="https://account.mojang.com/documents/minecraft_eula">
|
||||||
|
Mojangs EULA</link>. This option must be set to
|
||||||
|
<literal>true</literal> to run Minecraft server.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
dataDir = mkOption {
|
||||||
|
type = types.path;
|
||||||
|
default = "/var/lib/minecraft-fabric";
|
||||||
|
description = ''
|
||||||
|
Directory to store Minecraft database and other state/data files.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
whitelist = mkOption {
|
||||||
|
type = let
|
||||||
|
minecraftUUID = types.strMatching
|
||||||
|
"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}" // {
|
||||||
|
description = "Minecraft UUID";
|
||||||
|
};
|
||||||
|
in types.attrsOf minecraftUUID;
|
||||||
|
default = {};
|
||||||
|
description = ''
|
||||||
|
Whitelisted players, only has an effect when
|
||||||
|
<option>services.minecraft-server.declarative</option> is
|
||||||
|
<literal>true</literal> and the whitelist is enabled
|
||||||
|
via <option>services.minecraft-server.serverProperties</option> by
|
||||||
|
setting <literal>white-list</literal> to <literal>true</literal>.
|
||||||
|
This is a mapping from Minecraft usernames to UUIDs.
|
||||||
|
You can use <link xlink:href="https://mcuuid.net/"/> to get a
|
||||||
|
Minecraft UUID for a username.
|
||||||
|
'';
|
||||||
|
example = literalExpression ''
|
||||||
|
{
|
||||||
|
username1 = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
|
||||||
|
username2 = "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy";
|
||||||
|
};
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
serverProperties = mkOption {
|
||||||
|
type = with types; attrsOf (oneOf [ bool int str ]);
|
||||||
|
default = {};
|
||||||
|
example = literalExpression ''
|
||||||
|
{
|
||||||
|
server-port = 43000;
|
||||||
|
difficulty = 3;
|
||||||
|
gamemode = 1;
|
||||||
|
max-players = 5;
|
||||||
|
motd = "NixOS Minecraft server!";
|
||||||
|
white-list = true;
|
||||||
|
enable-rcon = true;
|
||||||
|
"rcon.password" = "hunter2";
|
||||||
|
}
|
||||||
|
'';
|
||||||
|
description = ''
|
||||||
|
Minecraft server properties for the server.properties file. Only has
|
||||||
|
an effect when <option>services.minecraft-server.declarative</option>
|
||||||
|
is set to <literal>true</literal>. See
|
||||||
|
<link xlink:href="https://minecraft.gamepedia.com/Server.properties#Java_Edition_3"/>
|
||||||
|
for documentation on these values.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
jvmOpts = mkOption {
|
||||||
|
type = types.separatedString " ";
|
||||||
|
default = "-Xmx2048M -Xms2048M";
|
||||||
|
# Example options from https://minecraft.gamepedia.com/Tutorials/Server_startup_script
|
||||||
|
example = "-Xmx2048M -Xms4092M -XX:+UseG1GC -XX:+CMSIncrementalPacing "
|
||||||
|
+ "-XX:+CMSClassUnloadingEnabled -XX:ParallelGCThreads=2 "
|
||||||
|
+ "-XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=10";
|
||||||
|
description = "JVM options for the Minecraft server.";
|
||||||
|
};
|
||||||
|
|
||||||
|
mods = mkOption {
|
||||||
|
type = types.listOf types.package;
|
||||||
|
example = literalExpression ''
|
||||||
|
[
|
||||||
|
(pkgs.fetchurl {
|
||||||
|
url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/0.44.0+1.18/fabric-api-0.44.0+1.18.jar";
|
||||||
|
sha256 = "0mlmj7mj073a48s8zgc1km0jwkphz01c1fvivn4mw37lbm2p4834";
|
||||||
|
})
|
||||||
|
];
|
||||||
|
'';
|
||||||
|
description = "List of mods to put in the mods folder";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
users.users.minecraft = {
|
||||||
|
description = "Minecraft server service user";
|
||||||
|
home = cfg.dataDir;
|
||||||
|
createHome = true;
|
||||||
|
isSystemUser = true;
|
||||||
|
group = "minecraft";
|
||||||
|
};
|
||||||
|
users.groups.minecraft = {};
|
||||||
|
|
||||||
|
systemd.services.minecraft-server-fabric = {
|
||||||
|
description = "Minecraft Server Service";
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
after = [ "network.target" ];
|
||||||
|
|
||||||
|
serviceConfig = {
|
||||||
|
ExecStart = "${cfg.package}/bin/minecraft-server ${cfg.jvmOpts}";
|
||||||
|
Restart = "always";
|
||||||
|
User = "minecraft";
|
||||||
|
WorkingDirectory = cfg.dataDir;
|
||||||
|
};
|
||||||
|
|
||||||
|
preStart = ''
|
||||||
|
ln -sf ${eulaFile} eula.txt
|
||||||
|
ln -sf ${whitelistFile} whitelist.json
|
||||||
|
cp -f ${serverPropertiesFile} server.properties
|
||||||
|
|
||||||
|
ln -sfn ${pkgs.linkFarmFromDrvs "fabric-mods" cfg.mods} mods
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
assertions = [
|
||||||
|
{ assertion = cfg.eula;
|
||||||
|
message = "You must agree to Mojangs EULA to run minecraft-server."
|
||||||
|
+ " Read https://account.mojang.com/documents/minecraft_eula and"
|
||||||
|
+ " set `services.minecraft-server.eula` to `true` if you agree.";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
|
|
@ -64,13 +64,6 @@ in {
|
||||||
url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
|
url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
|
||||||
options.path = dashboards/synapse.json;
|
options.path = dashboards/synapse.json;
|
||||||
}
|
}
|
||||||
# TODO: enable once https://github.com/NixOS/nixpkgs/pull/242365 gets merged
|
|
||||||
# {
|
|
||||||
# name = "MySQL";
|
|
||||||
# type = "file";
|
|
||||||
# url = "https://raw.githubusercontent.com/prometheus/mysqld_exporter/main/mysqld-mixin/dashboards/mysql-overview.json";
|
|
||||||
# options.path = dashboards/mysql.json;
|
|
||||||
# }
|
|
||||||
{
|
{
|
||||||
name = "Postgresql";
|
name = "Postgresql";
|
||||||
type = "file";
|
type = "file";
|
||||||
|
|
|
||||||
|
|
@ -1,11 +1,9 @@
|
||||||
{ config, ... }: {
|
{ config, ... }: {
|
||||||
imports = [
|
imports = [
|
||||||
./gogs.nix
|
|
||||||
./matrix-synapse.nix
|
|
||||||
# TODO: enable once https://github.com/NixOS/nixpkgs/pull/242365 gets merged
|
|
||||||
# ./mysqld.nix
|
|
||||||
./node.nix
|
./node.nix
|
||||||
|
./matrix-synapse.nix
|
||||||
./postgres.nix
|
./postgres.nix
|
||||||
|
./gogs.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
services.prometheus = {
|
services.prometheus = {
|
||||||
|
|
|
||||||
|
|
@ -1,25 +0,0 @@
|
||||||
{ config, ... }: let
|
|
||||||
cfg = config.services.prometheus;
|
|
||||||
in {
|
|
||||||
sops.secrets."config/mysqld_exporter" = { };
|
|
||||||
|
|
||||||
services.prometheus = {
|
|
||||||
scrapeConfigs = [{
|
|
||||||
job_name = "mysql";
|
|
||||||
scheme = "http";
|
|
||||||
metrics_path = cfg.exporters.mysqld.telemetryPath;
|
|
||||||
static_configs = [
|
|
||||||
{
|
|
||||||
targets = [
|
|
||||||
"localhost:${toString cfg.exporters.mysqld.port}"
|
|
||||||
];
|
|
||||||
}
|
|
||||||
];
|
|
||||||
}];
|
|
||||||
|
|
||||||
exporters.mysqld = {
|
|
||||||
enable = true;
|
|
||||||
configFilePath = config.sops.secrets."config/mysqld_exporter".path;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -12,9 +12,9 @@ in {
|
||||||
"knakelibrak.pvv.ntnu.no:9100"
|
"knakelibrak.pvv.ntnu.no:9100"
|
||||||
"hildring.pvv.ntnu.no:9100"
|
"hildring.pvv.ntnu.no:9100"
|
||||||
"bicep.pvv.ntnu.no:9100"
|
"bicep.pvv.ntnu.no:9100"
|
||||||
|
"jokum.pvv.ntnu.no:9100"
|
||||||
"essendrop.pvv.ntnu.no:9100"
|
"essendrop.pvv.ntnu.no:9100"
|
||||||
"andresbu.pvv.ntnu.no:9100"
|
"andresbu.pvv.ntnu.no:9100"
|
||||||
"bekkalokk.pvv.ntnu.no:9100"
|
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,43 @@
|
||||||
|
{ config, pkgs, values, ... }:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
../../base.nix
|
||||||
|
# ../../misc/metrics-exporters.nix
|
||||||
|
../../misc/rust-motd.nix
|
||||||
|
|
||||||
|
# ./services/matrix
|
||||||
|
# ./services/nginx
|
||||||
|
];
|
||||||
|
|
||||||
|
# sops.defaultSopsFile = ../../secrets/jokum/jokum.yaml;
|
||||||
|
# sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||||
|
# sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||||
|
# sops.age.generateKey = true;
|
||||||
|
|
||||||
|
boot.kernel.enable = false;
|
||||||
|
boot.isContainer = true;
|
||||||
|
boot.loader.initScript.enable = true;
|
||||||
|
networking.useHostResolvConf = false;
|
||||||
|
|
||||||
|
networking.hostName = "jokum"; # Define your hostname.
|
||||||
|
|
||||||
|
systemd.network.networks."30-enp6s0f1" = values.defaultNetworkConfig // {
|
||||||
|
matchConfig.Name = "ens10f1";
|
||||||
|
address = with values.hosts.jokum; [ (ipv4 + "/25") (ipv6 + "/64") ]
|
||||||
|
++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
|
||||||
|
};
|
||||||
|
|
||||||
|
# List packages installed in system profile
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
];
|
||||||
|
|
||||||
|
# List services that you want to enable:
|
||||||
|
|
||||||
|
# This value determines the NixOS release from which the default
|
||||||
|
# settings for stateful data, like file locations and database versions
|
||||||
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
# this value at the release version of the first install of this system.
|
||||||
|
# Before changing this value read the documentation for this option
|
||||||
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
|
system.stateVersion = "21.05"; # Did you read the comment?
|
||||||
|
}
|
||||||
|
|
@ -2,14 +2,10 @@
|
||||||
|
|
||||||
{
|
{
|
||||||
sops.secrets."matrix/synapse/turnconfig" = {
|
sops.secrets."matrix/synapse/turnconfig" = {
|
||||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
|
||||||
key = "synapse/turnconfig";
|
|
||||||
owner = config.users.users.matrix-synapse.name;
|
owner = config.users.users.matrix-synapse.name;
|
||||||
group = config.users.users.matrix-synapse.group;
|
group = config.users.users.matrix-synapse.group;
|
||||||
};
|
};
|
||||||
sops.secrets."matrix/coturn/static-auth-secret" = {
|
sops.secrets."matrix/coturn/static-auth-secret" = {
|
||||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
|
||||||
key = "coturn/static-auth-secret";
|
|
||||||
owner = config.users.users.turnserver.name;
|
owner = config.users.users.turnserver.name;
|
||||||
group = config.users.users.turnserver.group;
|
group = config.users.users.turnserver.group;
|
||||||
};
|
};
|
||||||
|
|
@ -118,7 +114,7 @@
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall = {
|
networking.firewall = {
|
||||||
interfaces.enp6s0f0 = let
|
interfaces.ens18 = let
|
||||||
range = with config.services.coturn; [ {
|
range = with config.services.coturn; [ {
|
||||||
from = min-port;
|
from = min-port;
|
||||||
to = max-port;
|
to = max-port;
|
||||||
|
|
@ -7,8 +7,6 @@ in
|
||||||
users.groups.keys-matrix-registrations = { };
|
users.groups.keys-matrix-registrations = { };
|
||||||
|
|
||||||
sops.secrets."matrix/registrations/mx-puppet-discord" = {
|
sops.secrets."matrix/registrations/mx-puppet-discord" = {
|
||||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
|
||||||
key = "registrations/mx-puppet-discord";
|
|
||||||
owner = config.users.users.matrix-synapse.name;
|
owner = config.users.users.matrix-synapse.name;
|
||||||
group = config.users.groups.keys-matrix-registrations.name;
|
group = config.users.groups.keys-matrix-registrations.name;
|
||||||
};
|
};
|
||||||
|
|
@ -32,9 +30,6 @@ in
|
||||||
services.mx-puppet-discord.serviceDependencies = [ "matrix-synapse.target" "nginx.service" ];
|
services.mx-puppet-discord.serviceDependencies = [ "matrix-synapse.target" "nginx.service" ];
|
||||||
|
|
||||||
|
|
||||||
services.matrix-synapse-next.settings = {
|
services.matrix-synapse-next.settings.app_service_config_files = [ config.sops.secrets."matrix/registrations/mx-puppet-discord".path ];
|
||||||
app_service_config_files = [ config.sops.secrets."matrix/registrations/mx-puppet-discord".path ];
|
|
||||||
use_appservice_legacy_authorization = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
@ -2,8 +2,6 @@
|
||||||
|
|
||||||
{
|
{
|
||||||
sops.secrets."matrix/mjolnir/access_token" = {
|
sops.secrets."matrix/mjolnir/access_token" = {
|
||||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
|
||||||
key = "mjolnir/access_token";
|
|
||||||
owner = config.users.users.mjolnir.name;
|
owner = config.users.users.mjolnir.name;
|
||||||
group = config.users.users.mjolnir.group;
|
group = config.users.users.mjolnir.group;
|
||||||
};
|
};
|
||||||
|
|
@ -8,32 +8,24 @@ let
|
||||||
imap0Attrs = with lib; f: set:
|
imap0Attrs = with lib; f: set:
|
||||||
listToAttrs (imap0 (i: attr: nameValuePair attr (f i attr set.${attr})) (attrNames set));
|
listToAttrs (imap0 (i: attr: nameValuePair attr (f i attr set.${attr})) (attrNames set));
|
||||||
in {
|
in {
|
||||||
|
sops.secrets."matrix/synapse/dbconfig" = {
|
||||||
|
owner = config.users.users.matrix-synapse.name;
|
||||||
|
group = config.users.users.matrix-synapse.group;
|
||||||
|
};
|
||||||
|
|
||||||
sops.secrets."matrix/synapse/signing_key" = {
|
sops.secrets."matrix/synapse/signing_key" = {
|
||||||
key = "synapse/signing_key";
|
|
||||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
|
||||||
owner = config.users.users.matrix-synapse.name;
|
owner = config.users.users.matrix-synapse.name;
|
||||||
group = config.users.users.matrix-synapse.group;
|
group = config.users.users.matrix-synapse.group;
|
||||||
};
|
};
|
||||||
|
|
||||||
sops.secrets."matrix/synapse/user_registration" = {
|
sops.secrets."matrix/synapse/user_registration" = {
|
||||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
|
||||||
key = "synapse/signing_key";
|
|
||||||
owner = config.users.users.matrix-synapse.name;
|
owner = config.users.users.matrix-synapse.name;
|
||||||
group = config.users.users.matrix-synapse.group;
|
group = config.users.users.matrix-synapse.group;
|
||||||
};
|
};
|
||||||
|
|
||||||
sops.secrets."matrix/sliding-sync/env" = {
|
|
||||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
|
||||||
key = "sliding-sync/env";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.matrix-synapse-next = {
|
services.matrix-synapse-next = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
plugins = [
|
|
||||||
(pkgs.python3Packages.callPackage ./smtp-authenticator { })
|
|
||||||
];
|
|
||||||
|
|
||||||
dataDir = "/data/synapse";
|
dataDir = "/data/synapse";
|
||||||
|
|
||||||
workers.federationSenders = 2;
|
workers.federationSenders = 2;
|
||||||
|
|
@ -43,10 +35,13 @@ in {
|
||||||
workers.eventPersisters = 2;
|
workers.eventPersisters = 2;
|
||||||
workers.useUserDirectoryWorker = true;
|
workers.useUserDirectoryWorker = true;
|
||||||
|
|
||||||
enableSlidingSync = true;
|
|
||||||
|
|
||||||
enableNginx = true;
|
enableNginx = true;
|
||||||
|
|
||||||
|
extraConfigFiles = [
|
||||||
|
config.sops.secrets."matrix/synapse/dbconfig".path
|
||||||
|
config.sops.secrets."matrix/synapse/user_registration".path
|
||||||
|
];
|
||||||
|
|
||||||
settings = {
|
settings = {
|
||||||
server_name = "pvv.ntnu.no";
|
server_name = "pvv.ntnu.no";
|
||||||
public_baseurl = "https://matrix.pvv.ntnu.no";
|
public_baseurl = "https://matrix.pvv.ntnu.no";
|
||||||
|
|
@ -55,20 +50,8 @@ in {
|
||||||
|
|
||||||
media_store_path = "${cfg.dataDir}/media";
|
media_store_path = "${cfg.dataDir}/media";
|
||||||
|
|
||||||
database = {
|
|
||||||
name = "psycopg2";
|
|
||||||
args = {
|
|
||||||
host = "/var/run/postgresql";
|
|
||||||
dbname = "synapse";
|
|
||||||
user = "matrix-synapse";
|
|
||||||
cp_min = 1;
|
|
||||||
cp_max = 5;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
presence.enabled = false;
|
presence.enabled = false;
|
||||||
|
|
||||||
event_cache_size = "20K"; # Default is 10K but I can't find the factor for this cache
|
|
||||||
caches = {
|
caches = {
|
||||||
per_cache_factors = {
|
per_cache_factors = {
|
||||||
_event_auth_cache = 2.0;
|
_event_auth_cache = 2.0;
|
||||||
|
|
@ -90,17 +73,8 @@ in {
|
||||||
mau_stats_only = true;
|
mau_stats_only = true;
|
||||||
|
|
||||||
enable_registration = false;
|
enable_registration = false;
|
||||||
registration_shared_secret_path = config.sops.secrets."matrix/synapse/user_registration".path;
|
|
||||||
|
|
||||||
password_config.enabled = true;
|
password_config.enabled = lib.mkForce false;
|
||||||
|
|
||||||
modules = [
|
|
||||||
{ module = "smtp_auth_provider.SMTPAuthProvider";
|
|
||||||
config = {
|
|
||||||
smtp_host = "smtp.pvv.ntnu.no";
|
|
||||||
};
|
|
||||||
}
|
|
||||||
];
|
|
||||||
|
|
||||||
trusted_key_servers = [
|
trusted_key_servers = [
|
||||||
{ server_name = "matrix.org"; }
|
{ server_name = "matrix.org"; }
|
||||||
|
|
@ -211,24 +185,9 @@ in {
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
services.matrix-synapse.sliding-sync.environmentFile = config.sops.secrets."matrix/sliding-sync/env".path;
|
|
||||||
|
|
||||||
|
|
||||||
services.redis.servers."".enable = true;
|
services.redis.servers."".enable = true;
|
||||||
|
|
||||||
services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
|
services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [({
|
||||||
({
|
|
||||||
locations."/.well-known/matrix/server" = {
|
|
||||||
return = ''
|
|
||||||
200 '{"m.server": "matrix.pvv.ntnu.no:443"}'
|
|
||||||
'';
|
|
||||||
extraConfig = ''
|
|
||||||
default_type application/json;
|
|
||||||
add_header Access-Control-Allow-Origin *;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
})
|
|
||||||
({
|
|
||||||
locations = let
|
locations = let
|
||||||
connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
|
connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
|
||||||
socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString (c.port)}";
|
socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString (c.port)}";
|
||||||
|
|
@ -11,35 +11,19 @@
|
||||||
enableReload = true;
|
enableReload = true;
|
||||||
|
|
||||||
defaultListenAddresses = [
|
defaultListenAddresses = [
|
||||||
values.hosts.bicep.ipv4
|
values.hosts.jokum.ipv4
|
||||||
"[${values.hosts.bicep.ipv6}]"
|
"[${values.hosts.jokum.ipv6}]"
|
||||||
|
|
||||||
"127.0.0.1"
|
"127.0.0.1"
|
||||||
"127.0.0.2"
|
"127.0.0.2"
|
||||||
"[::1]"
|
"[::1]"
|
||||||
];
|
];
|
||||||
|
|
||||||
appendConfig = ''
|
|
||||||
pcre_jit on;
|
|
||||||
worker_processes 8;
|
|
||||||
worker_rlimit_nofile 8192;
|
|
||||||
'';
|
|
||||||
|
|
||||||
eventsConfig = ''
|
|
||||||
multi_accept on;
|
|
||||||
worker_connections 4096;
|
|
||||||
'';
|
|
||||||
|
|
||||||
recommendedProxySettings = true;
|
recommendedProxySettings = true;
|
||||||
recommendedTlsSettings = true;
|
recommendedTlsSettings = true;
|
||||||
recommendedGzipSettings = true;
|
recommendedGzipSettings = true;
|
||||||
recommendedBrotliSettings = true;
|
|
||||||
recommendedOptimisation = true;
|
recommendedOptimisation = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||||
|
|
||||||
systemd.services.nginx.serviceConfig = {
|
|
||||||
LimitNOFILE = 65536;
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
|
@ -1,39 +0,0 @@
|
||||||
{ config, pkgs, values, ... }:
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
# Include the results of the hardware scan.
|
|
||||||
./hardware-configuration.nix
|
|
||||||
../../base.nix
|
|
||||||
../../misc/metrics-exporters.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
sops.defaultSopsFile = ../../secrets/shark/shark.yaml;
|
|
||||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
||||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
|
||||||
sops.age.generateKey = true;
|
|
||||||
|
|
||||||
boot.loader.systemd-boot.enable = true;
|
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
|
||||||
|
|
||||||
networking.hostName = "shark"; # Define your hostname.
|
|
||||||
|
|
||||||
systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
|
|
||||||
matchConfig.Name = "ens18";
|
|
||||||
address = with values.hosts.shark; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
|
||||||
};
|
|
||||||
|
|
||||||
# List packages installed in system profile
|
|
||||||
environment.systemPackages = with pkgs; [
|
|
||||||
];
|
|
||||||
|
|
||||||
# List services that you want to enable:
|
|
||||||
|
|
||||||
# This value determines the NixOS release from which the default
|
|
||||||
# settings for stateful data, like file locations and database versions
|
|
||||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
|
||||||
# this value at the release version of the first install of this system.
|
|
||||||
# Before changing this value read the documentation for this option
|
|
||||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|
||||||
system.stateVersion = "23.05"; # Did you read the comment?
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
@ -1,38 +0,0 @@
|
||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/224c45db-9fdc-45d4-b3ad-aaf20b3efa8a";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" =
|
|
||||||
{ device = "/dev/disk/by-uuid/CC37-F5FE";
|
|
||||||
fsType = "vfat";
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices =
|
|
||||||
[ { device = "/dev/disk/by-uuid/a1ce3234-78b1-4565-9643-f4a05004424f"; }
|
|
||||||
];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
}
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
{ ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
nix.settings.trusted-users = [ "@nix-builder-users" ];
|
|
||||||
}
|
|
||||||
|
|
@ -1,62 +0,0 @@
|
||||||
{config, lib, pkgs, ...}:
|
|
||||||
let
|
|
||||||
grg = config.services.grzegorz;
|
|
||||||
grgw = config.services.grzegorz-webui;
|
|
||||||
in {
|
|
||||||
services.pipewire.enable = true;
|
|
||||||
services.pipewire.alsa.enable = true;
|
|
||||||
services.pipewire.alsa.support32Bit = true;
|
|
||||||
services.pipewire.pulse.enable = true;
|
|
||||||
|
|
||||||
users.users.pvv = {
|
|
||||||
isNormalUser = true;
|
|
||||||
description = "pvv";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.grzegorz.enable = true;
|
|
||||||
services.grzegorz.listenAddr = "localhost";
|
|
||||||
services.grzegorz.listenPort = 31337;
|
|
||||||
|
|
||||||
services.grzegorz-webui.enable = true;
|
|
||||||
services.grzegorz-webui.listenAddr = "localhost";
|
|
||||||
services.grzegorz-webui.listenPort = 42069;
|
|
||||||
services.grzegorz-webui.listenWebsocketPort = 42042;
|
|
||||||
services.grzegorz-webui.hostName = "${config.networking.fqdn}";
|
|
||||||
services.grzegorz-webui.apiBase = "http://${toString grg.listenAddr}:${toString grg.listenPort}/api";
|
|
||||||
|
|
||||||
security.acme.acceptTerms = true;
|
|
||||||
security.acme.defaults.email = "pederbs@pvv.ntnu.no";
|
|
||||||
|
|
||||||
services.nginx.enable = true;
|
|
||||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."${config.networking.fqdn}" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
serverAliases = [
|
|
||||||
"${config.networking.hostName}.pvv.org"
|
|
||||||
];
|
|
||||||
extraConfig = ''
|
|
||||||
allow 129.241.210.128/25;
|
|
||||||
allow 2001:700:300:1900::/64;
|
|
||||||
deny all;
|
|
||||||
'';
|
|
||||||
|
|
||||||
locations."/" = {
|
|
||||||
proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenPort}";
|
|
||||||
};
|
|
||||||
# https://github.com/rawpython/remi/issues/216
|
|
||||||
locations."/websocket" = {
|
|
||||||
proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenWebsocketPort}";
|
|
||||||
proxyWebsockets = true;
|
|
||||||
};
|
|
||||||
locations."/api" = {
|
|
||||||
proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
|
|
||||||
};
|
|
||||||
locations."/docs" = {
|
|
||||||
proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
@ -0,0 +1,43 @@
|
||||||
|
{ callPackage, writeTextFile, writeShellScriptBin, minecraft-server, jre_headless }:
|
||||||
|
|
||||||
|
let
|
||||||
|
loader = callPackage ./generate-loader.nix {};
|
||||||
|
log4j = writeTextFile {
|
||||||
|
name = "log4j.xml";
|
||||||
|
text = ''
|
||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<Configuration status="WARN" packages="com.mojang.util">
|
||||||
|
<Appenders>
|
||||||
|
<Console name="SysOut" target="SYSTEM_OUT">
|
||||||
|
<PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg%n" />
|
||||||
|
</Console>
|
||||||
|
<Queue name="ServerGuiConsole">
|
||||||
|
<PatternLayout pattern="[%d{HH:mm:ss} %level]: %msg%n" />
|
||||||
|
</Queue>
|
||||||
|
<RollingRandomAccessFile name="File" fileName="logs/latest.log" filePattern="logs/%d{yyyy-MM-dd}-%i.log.gz">
|
||||||
|
<PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg%n" />
|
||||||
|
<Policies>
|
||||||
|
<TimeBasedTriggeringPolicy />
|
||||||
|
<OnStartupTriggeringPolicy />
|
||||||
|
</Policies>
|
||||||
|
<DefaultRolloverStrategy max="1000"/>
|
||||||
|
</RollingRandomAccessFile>
|
||||||
|
</Appenders>
|
||||||
|
<Loggers>
|
||||||
|
<Root level="info">
|
||||||
|
<filters>
|
||||||
|
<MarkerFilter marker="NETWORK_PACKETS" onMatch="DENY" onMismatch="NEUTRAL" />
|
||||||
|
</filters>
|
||||||
|
<AppenderRef ref="SysOut"/>
|
||||||
|
<AppenderRef ref="File"/>
|
||||||
|
<AppenderRef ref="ServerGuiConsole"/>
|
||||||
|
</Root>
|
||||||
|
</Loggers>
|
||||||
|
</Configuration>
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
in
|
||||||
|
writeShellScriptBin "minecraft-server" ''
|
||||||
|
echo "serverJar=${minecraft-server}/lib/minecraft/server.jar" >> fabric-server-launcher.properties
|
||||||
|
exec ${jre_headless}/bin/java -Dlog4j.configurationFile=${log4j} $@ -jar ${loader} nogui
|
||||||
|
''
|
||||||
|
|
@ -0,0 +1,38 @@
|
||||||
|
{ lib, fetchurl, stdenv, unzip, zip, jre_headless }:
|
||||||
|
|
||||||
|
let
|
||||||
|
lock = import ./lock.nix;
|
||||||
|
libraries = lib.forEach lock.libraries fetchurl;
|
||||||
|
in
|
||||||
|
stdenv.mkDerivation {
|
||||||
|
name = "fabric-server-launch.jar";
|
||||||
|
nativeBuildInputs = [ unzip zip jre_headless ];
|
||||||
|
|
||||||
|
libraries = libraries;
|
||||||
|
|
||||||
|
buildPhase = ''
|
||||||
|
for i in $libraries; do
|
||||||
|
unzip -o $i
|
||||||
|
done
|
||||||
|
|
||||||
|
cat > META-INF/MANIFEST.MF << EOF
|
||||||
|
Manifest-Version: 1.0
|
||||||
|
Main-Class: net.fabricmc.loader.impl.launch.server.FabricServerLauncher
|
||||||
|
Name: org/objectweb/asm/
|
||||||
|
Implementation-Version: 9.2
|
||||||
|
EOF
|
||||||
|
|
||||||
|
cat > fabric-server-launch.properties << EOF
|
||||||
|
launch.mainClass=net.fabricmc.loader.impl.launch.knot.KnotServer
|
||||||
|
EOF
|
||||||
|
'';
|
||||||
|
|
||||||
|
installPhase = ''
|
||||||
|
jar cmvf META-INF/MANIFEST.MF "server.jar" .
|
||||||
|
zip -d server.jar 'META-INF/*.SF' 'META-INF/*.RSA' 'META-INF/*.DSA'
|
||||||
|
cp server.jar "$out"
|
||||||
|
'';
|
||||||
|
|
||||||
|
phases = [ "buildPhase" "installPhase" ];
|
||||||
|
}
|
||||||
|
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
#!/usr/bin/env nix-shell
|
||||||
|
#!nix-shell -i bash -p bash curl jq
|
||||||
|
curl https://meta.fabricmc.net/v2/versions/loader/1.18.1/0.12.12/server/json \
|
||||||
|
| jq -r '
|
||||||
|
.mainClass,
|
||||||
|
(.libraries[]
|
||||||
|
| .url as $url
|
||||||
|
| .name | split(":") as [$dir, $name, $version]
|
||||||
|
|"\($name)-\($version).zip|\($url)\($dir|sub("\\.";"/";"g"))/\($name)/\($version)/\($name)-\($version).jar"
|
||||||
|
)' \
|
||||||
|
| {
|
||||||
|
echo '{'
|
||||||
|
read mainClass;
|
||||||
|
echo " mainClass = \"$mainClass\";"
|
||||||
|
echo " libraries = ["
|
||||||
|
while IFS="|" read name url; do
|
||||||
|
hash=$(nix-prefetch-url $url);
|
||||||
|
echo " { name = \"$name\"; sha256 = \"$hash\"; url = \"$url\"; }"
|
||||||
|
done
|
||||||
|
echo " ];"
|
||||||
|
echo '}'
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
{
|
||||||
|
mainClass = "net.fabricmc.loader.impl.launch.knot.KnotServer";
|
||||||
|
libraries = [
|
||||||
|
{ name = "tiny-mappings-parser-0.3.0+build.17.zip"; sha256 = "19kvhxfk5v01f2rvl7j02vqhn3nd2bh5jsgbk44rpzqv9f6074db"; url = "https://maven.fabricmc.net/net/fabricmc/tiny-mappings-parser/0.3.0+build.17/tiny-mappings-parser-0.3.0+build.17.jar"; }
|
||||||
|
{ name = "sponge-mixin-0.10.7+mixin.0.8.4.zip"; sha256 = "18m5wksd9vjp676cxapkggnz8s3f8j89phln8gy5n8vxlrli8n0d"; url = "https://maven.fabricmc.net/net/fabricmc/sponge-mixin/0.10.7+mixin.0.8.4/sponge-mixin-0.10.7+mixin.0.8.4.jar"; }
|
||||||
|
{ name = "tiny-remapper-0.6.0.zip"; sha256 = "1ynjfxg7cj9rd9c4l450w7yp20p2csjdpnk3mcx5bdkjzhbgvgzf"; url = "https://maven.fabricmc.net/net/fabricmc/tiny-remapper/0.6.0/tiny-remapper-0.6.0.jar"; }
|
||||||
|
{ name = "access-widener-2.0.1.zip"; sha256 = "0a7s4x6dbaa9p59ps7pidzwrs0xwy5i17s35xrgh58i26szlsaxm"; url = "https://maven.fabricmc.net/net/fabricmc/access-widener/2.0.1/access-widener-2.0.1.jar"; }
|
||||||
|
{ name = "asm-9.2.zip"; sha256 = "1xa7kccwmcqcdw1xly6n2frzhk56m8ma9v7h764g73ckf56zxm5r"; url = "https://maven.fabricmc.net/org/ow2/asm/asm/9.2/asm-9.2.jar"; }
|
||||||
|
{ name = "asm-analysis-9.2.zip"; sha256 = "1i1kyirizs5sm2v0f06sdz86mbmyn61vjr9d9p8p5h1i2x9bx3w7"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-analysis/9.2/asm-analysis-9.2.jar"; }
|
||||||
|
{ name = "asm-commons-9.2.zip"; sha256 = "19p04mr14ahndba65v4krbvf4p5syf8wz0fp5i9bnf5270qyak5y"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-commons/9.2/asm-commons-9.2.jar"; }
|
||||||
|
{ name = "asm-tree-9.2.zip"; sha256 = "04g0zb7v65iz4k2m2grdpbv8jjryrzkkw7ww23yfp94i6399pgxa"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-tree/9.2/asm-tree-9.2.jar"; }
|
||||||
|
{ name = "asm-util-9.2.zip"; sha256 = "16759v4hh3ijpf4cglrxybz29x2hiylhsa388y09m2mf679kqnzz"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-util/9.2/asm-util-9.2.jar"; }
|
||||||
|
{ name = "intermediary-1.18.1.zip"; sha256 = "1rfz2gazvnivn6hlqiyjpiaycz8va87n5czy1p6w3lnrlfggj2i9"; url = "https://maven.fabricmc.net/net/fabricmc/intermediary/1.18.1/intermediary-1.18.1.jar"; }
|
||||||
|
{ name = "fabric-loader-0.12.12.zip"; sha256 = "070dpcp7kcj4xr75wp1j6pb1bgfzllwg8xmqk3sk79jfqiqwzizw"; url = "https://maven.fabricmc.net/net/fabricmc/fabric-loader/0.12.12/fabric-loader-0.12.12.jar"; }
|
||||||
|
];
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,38 @@
|
||||||
|
{ lib, stdenv, fetchurl, nixosTests, jre_headless }:
|
||||||
|
stdenv.mkDerivation {
|
||||||
|
pname = "minecraft-server";
|
||||||
|
version = "1.18.1";
|
||||||
|
|
||||||
|
src = fetchurl {
|
||||||
|
url = "https://launcher.mojang.com/v1/objects/125e5adf40c659fd3bce3e66e67a16bb49ecc1b9/server.jar";
|
||||||
|
# sha1 because that comes from mojang via api
|
||||||
|
sha1 = "125e5adf40c659fd3bce3e66e67a16bb49ecc1b9";
|
||||||
|
};
|
||||||
|
|
||||||
|
preferLocalBuild = true;
|
||||||
|
|
||||||
|
installPhase = ''
|
||||||
|
mkdir -p $out/bin $out/lib/minecraft
|
||||||
|
cp -v $src $out/lib/minecraft/server.jar
|
||||||
|
cat > $out/bin/minecraft-server << EOF
|
||||||
|
#!/bin/sh
|
||||||
|
exec ${jre_headless}/bin/java \$@ -jar $out/lib/minecraft/server.jar nogui
|
||||||
|
EOF
|
||||||
|
chmod +x $out/bin/minecraft-server
|
||||||
|
'';
|
||||||
|
|
||||||
|
dontUnpack = true;
|
||||||
|
|
||||||
|
passthru = {
|
||||||
|
tests = { inherit (nixosTests) minecraft-server; };
|
||||||
|
updateScript = ./update.sh;
|
||||||
|
};
|
||||||
|
|
||||||
|
meta = with lib; {
|
||||||
|
description = "Minecraft Server";
|
||||||
|
homepage = "https://minecraft.net";
|
||||||
|
license = licenses.unfreeRedistributable;
|
||||||
|
platforms = platforms.unix;
|
||||||
|
maintainers = with maintainers; [ thoughtpolice tomberek costrouc ];
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -1,72 +1,63 @@
|
||||||
gitea:
|
gitea:
|
||||||
password: ENC[AES256_GCM,data:hlNzdU1ope0t50/3aztyLeXjMHd2vFPpwURX+Iu8f49DOqgSnEMtV+KtLA==,iv:qljRnSnchL5cFmaUAfCH9GQYQxcy5cyWejgk1x6bFgI=,tag:tIhboFU5kZsj5oAQR3hLbw==,type:str]
|
dbpassword: ENC[AES256_GCM,data:Tx7bFpHjXev1Q3G5Rdq5/Pg5XVro7hQFyG/FJUsiGeJOezymfk1V84VXPQ==,iv:msn8d2sarb2r+nSy1Qk1IOtkXhKDOXjcUO5dFpln1e4=,tag:Wtm1Q5FzTt1WA+uQjaVQKA==,type:str]
|
||||||
database: ENC[AES256_GCM,data:UlS33IdCEyeSvT6ngpmnkBWHuSEqsB//DT+3b7C+UwbD8UXWJlsLf1X8/w==,iv:mPRW5ldyZaHP+y/0vC2JGSLZmlkhgmkvXPk4LazkSDs=,tag:gGk6Z/nbPvzE1zG+tJC8Sw==,type:str]
|
|
||||||
passwd-ssh-key: ENC[AES256_GCM,data:L0lF0wvpayss1NU9m3A45cH0bCMQzODTFVrq6EPd1JHx54wIcoaRBYLmxXKXASzBlCg9zlwXMUIk3OQcS3kdzMKL0iqcSL2iicAcKjFIHyrWLqXgwV5pRSP/tRPcVw8KW8gz0bh33EgESs5ReddZ3VZ0Cy1s2YupMRQvBXr89k1+Hv70OWB6P06hvxhv/zKcMGI1N/dWLroMgrQuT9imw4+/Q1RqwzTYeEU+eUn24AM9GjcBg4qf3OI+6g0nXUat/upIYE28iF5J3lbUSmDSmirBLc8xgHLdOyyJPTObWYWYxlSL78T7IqiMm9lI3rtBlpJDDcn/YxZpVqN5bg2154GISNK+uR0TVSLdJ+drdGHIfIX3G78XSxf2L9rbJyRn8MQlgStfdBIQicLavQKVMrmj+XQfvEMez23WbPLjH4oViBQFI+GrOHOGy/f16cz8Sn4n+69OcsOeTxs3tKYdfq6r1XLYSJ/fe/zvxBpaZiyGXljsuyEdIyBL2A8D6uSXe3Nd3/DAdBtceFfIdN1olCdutixzVWgxaJnrel161z5A/4w=,iv:Uy46yY3jFYSvpxrgCHxRMUksnWfhf5DViLMvCXVMMl4=,tag:wFEJ5+icFrOKkc56gY0A5g==,type:str]
|
|
||||||
ssh-known-hosts: ENC[AES256_GCM,data:zlRLoelQeumMxGqPmgMTB69X1RVWXIs2jWwc67lk0wrdNOHUs5UzV5TUA1JnQ43RslBU92+js7DkyvE5enGzw7zZE5F1ZYdGv/eCgvkTMC9BoLfzHzP6OzayPLYEt3xJ5PRocN8JUAD55cuu4LgsuebuydHPi2oWOfpbSUBKSeCh6dvk5Pp1XRDprPS5SzGLW8Xjq98QlzmfGv50meI9CDJZVF9Wq/72gkyfgtb3YVdr,iv:AF06TBitHegfWk6w07CdkHklh4ripQCmA45vswDQgss=,tag:zKh7WVXMJN2o9ZIwIkby3Q==,type:str]
|
|
||||||
import-user-env: ENC[AES256_GCM,data:vfaqjGEnUM9VtOPvBurz7nFwzGZt3L2EqijrQej4wiOcGCrRA4tN6kBV6NmhHqlFPsw=,iv:viPGkyOOacCWcgTu25da4qH7DC4wz2qdeC1W2WcMUdI=,tag:BllNqGQoaxqUo3lTz9LGnw==,type:str]
|
|
||||||
runners:
|
|
||||||
alpha: ENC[AES256_GCM,data:gARxCufePz+EMVwEwRsL2iZUfh9HUowWqtb7Juz3fImeeAdbt+k3DvL/Nwgegg==,iv:3fEaWd7v7uLGTy2J7EFQGfN0ztI0uCOJRz5Mw8V5UOU=,tag:Aa6LwWeW2hfDz1SqEhUJpA==,type:str]
|
|
||||||
beta: ENC[AES256_GCM,data:DVjS78IKWiWgf+PuijCZKx4ZaEJGhQr7vl+lc7QOg1JlA4p9Kux/tOD8+f2+jA==,iv:tk3Xk7lKWNdZ035+QVIhxXy2iJbHwunI4jRFM4It46E=,tag:9Mr6o//svYEyYhSvzkOXMg==,type:str]
|
|
||||||
epsilon: ENC[AES256_GCM,data:JMnZVBdiy+5oPyXgDpfYvy7qLzIEfHy09fQSBDpNG4zDXTil2pSKBKxk09h5xg==,iv:/8oXKJW6+sMBjDt51MqVAWjQPM5nk02Lv5QqbZsZ5ms=,tag:+Rx7ursfVWc0EcExCLgLhQ==,type:str]
|
|
||||||
mediawiki:
|
mediawiki:
|
||||||
password: ENC[AES256_GCM,data:HsBuA1E7187roGnKuFPfPDYxA16GFjAUucgUtrdUFmcOzmTNiFH+NWY2ZQ==,iv:vDYUmmZftcrkDtJxNYKAJSx9j+AQcmQarC62QRHR4IM=,tag:3TKjNrGRivFWoK3djC748g==,type:str]
|
password: ENC[AES256_GCM,data:HsBuA1E7187roGnKuFPfPDYxA16GFjAUucgUtrdUFmcOzmTNiFH+NWY2ZQ==,iv:vDYUmmZftcrkDtJxNYKAJSx9j+AQcmQarC62QRHR4IM=,tag:3TKjNrGRivFWoK3djC748g==,type:str]
|
||||||
database: ENC[AES256_GCM,data:EvVK3Mo6cZiIZS+gTxixU4r9SXN41VqwaWOtortZRNH+WPJ4xcYvzYMJNg==,iv:JtFTRLn3fzKIfgAPRqRgQjct7EdkEHtiyQKPy8/sZ2Q=,tag:nqzseG6BC0X5UNI/3kZZ3A==,type:str]
|
postgres:
|
||||||
keycloak:
|
mediawiki: ENC[AES256_GCM,data:JsDjfDrbJHejPDZFn6TyPkDnMIX9Go62ZmRy7P+N1Ncaz5tintspO1YtIA==,iv:7EgzkRf8GP/pIMxxEkI3fzKjxr1sT4vwsqshRtkeYU0=,tag:l3DO/0sicTolInEl2mJNSA==,type:str]
|
||||||
database: ENC[AES256_GCM,data:76+AZnNR5EiturTP7BdOCKE90bFFkfGlRtviSP5NHxPbb3RfFPJEMlwtzA==,iv:nS7VTossHdlrHjPeethhX+Ysp9ukrb5JD7kjG28OFpY=,tag:OMpiEv9nQA7v6lWJfNxEEw==,type:str]
|
|
||||||
sops:
|
sops:
|
||||||
kms: []
|
kms: []
|
||||||
gcp_kms: []
|
gcp_kms: []
|
||||||
azure_kv: []
|
azure_kv: []
|
||||||
hc_vault: []
|
hc_vault: []
|
||||||
age:
|
age:
|
||||||
- recipient: age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
|
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDbDc0NXZqYko1Z25qYkhq
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSYUR4TjA3WU96TzV6R1V5
|
||||||
T2p4cGZ1bTZRS25YdjJ0K3JhSklCT1NwSHhzCi9MVnM2YTRuUERwTVlaM2lxNEtp
|
TFpPUW1CdnRZck50bzJSb3VnUXFYUDhxM2hJCmI2Q0p3ZVZGS0U4UmNaQ0Z3Vmgv
|
||||||
Mk9hcDREcTErZXJtSEI0aE1PV2NDV1EKLS0tIDY2MEN6a3NWb3JpeU5JVkhoOFVR
|
MkNyS1hVUWs5UjZ3cTJRU0pWbmFSeEkKLS0tIGlIRGYxTjgzWmVWbXRwTjhHdnRx
|
||||||
MjVqdHg0SnF5N3VEV2U4a2dvbTZjem8K8J6KQMJwpiC8gqlgi29x3dpSORAmuVQ6
|
U3JMU1ZUT1ZhT2xSbHRLVXgzODB1NXcKJ2LTJB2oKffW+aZgkEEwp+xhAY0FpnBl
|
||||||
cX5jXggOoz5vME6BMQ3s/bglZG2pdEgWpGZVbc4x2iMwUWgJLHdgXg==
|
5GqUdZrgkNOV0pvgVAOoXMyCdZbndYLS+dUzggnF91HJOr87wRH4uw==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
|
- recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1SHMrVmxsL0orQlk3dy9H
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzUmpzTVdlRlg0OHBFQ2lq
|
||||||
NDMzWEZYMXhkamVkTy84VGEzUm1BU3lNY2dNCkNwOGJteVQzYlZESGlScTg0RnFx
|
eDdmOUlxbzcxakFsS2JHK3JqU0tNTC9mOGhRCjNCbFcxWTFzeTkxcHZLQjBpb2c1
|
||||||
emNXbmZhL3BHWThPRUI4MVIzMU1POTgKLS0tIHRmQ0llR1NCSm9KMHZsOGJXYmxk
|
V3VHeGhuTkhNbGlsVVlMallPcTVIK0kKLS0tIHRISitSQXBENVY3ejdYa3pXRmJ1
|
||||||
eGpDUlFHdEZmWkZHTEw4Mmk2UWRnUU0Ki5GK2mzDIc2iTryjn6lf5lMqVZcCcxQ2
|
TVNBRXQvUmRPdlMreGtzZUNUcnM4aEkKAp/Ofix26q1eeHszIJa4yYF9ycwWodeV
|
||||||
a3Y/o/NMFDhMZpLlEljuWQVnuOyJZ3RSDCFN9BSEkxg05PaoSluUzQ==
|
216hz9YUYb9aZCoJJzGPceb/ER17yvqFHQlhgEb9EiKaH3vbIu+WRQ==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
- recipient: age13t2nnr6yukmtda6wn2uggfcj0dmwce8347y8w6xzt4yje6wlgscqnahuqm
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZY2ZiazhzdkxNZFZldjBV
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUVC9Cd01HaWpyUm5mdTh4
|
||||||
SjBCR2lXdFZZUUpJTnJVWUVMNTcybGQvbmpNClVDOEdMK0JIOUEvaVYxcm4yeVp4
|
Uk5mSlBLQTlydkpQc0Irakxmalg1WU92U0JjCnhFbDFNaThIVEVNMldiT3BtL2cw
|
||||||
dVY5b292WVE5L2JXNGQvSENiTjBWVkkKLS0tIGIvdzBxMVNYbGN4ZXBBNDg1bFNB
|
UU4rNEhvTXkzWXlMWUZGeEdJaTg0WjQKLS0tIEZlWkI3SzFOT1NoQWpIM2poMXE4
|
||||||
akVjeTNTeGorZjJQOVlMeCtPRUVYL3MK+VMvGxrbzGz4Q3sdaDDWjal+OiK+JYKX
|
RHN4RDJWWGV2ZDJzVUo1VVorNzhlMGMKCwdWOZOnibpbB5mZSCBGhj+yUZvk/vuK
|
||||||
GHiMXVHQJZu/RrlxMjHKN6V3iaqxZpuvLAEJ2Lzy5EOHPtuiiRyeHQ==
|
hsiDo74vmsmNZ/zmN6cw60hNwhZ4NgtfXcKG8Axe+1rPUwEcrvWHIQ==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
lastmodified: "2023-09-17T02:02:24Z"
|
lastmodified: "2023-04-22T23:00:19Z"
|
||||||
mac: ENC[AES256_GCM,data:Lkvj9UOdE/WZtFReMs6n8ucFuJNPb76ZhPHFpYAEqYEe8d9FdMPMzq05DBAJe9IqpFS0jc9SWxJUPHfGgoMR8nPciZuR/mpJ+4s/cRkPbApwBPcLlvatE/qkbcxzoLlb1vN0gth5G/U7UEfk5Pp9gIz6Yo4sEIS3Za42tId1MpI=,iv:s3VELgU/RJ98/lbQV3vPtOLXtwFzB3KlY7bMKbAzp/g=,tag:D8s0XyGnd8UhbCseB/TyFg==,type:str]
|
mac: ENC[AES256_GCM,data:/c9N6/qSzeqjzNq1buR5Z7YLp/H1wDgpnpw5G8CcTJkggzn/mDfvyNg/k/TAJl5CzH/mh20yeHTjOGOiTXubkhJya+WT01g0PVinU3+GxTUZOxkaF0rHTCRzuiSbbrJzhtvMmmgbbYSkaGBZ8+Y3VvC8qnNKzadO+QozqZbLuWY=,iv:FiMABv8OBDRJeI6VsuapFS3qOlDP+TzJE8rrYSV/F7A=,tag:GAv2Pk5U7igVAyhch+ZEeA==,type:str]
|
||||||
pgp:
|
pgp:
|
||||||
- created_at: "2023-05-21T00:28:40Z"
|
- created_at: "2023-01-28T23:37:44Z"
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN PGP MESSAGE-----
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
hQIMA0av/duuklWYAQ//TewS5bITIo3bx0HEM0p8bwnSJAmNqGJmuILXg4k8eszF
|
hQIMA0av/duuklWYAQ//foXRhar7kfr0PbxVjk2uWzGBoXpffjZPCoaM3D8RhIM8
|
||||||
JHS9eCfU/Vz4Z8eMDJjntFIWvNCl0QOycvp37uNaqPedDE3v1nNpCxOZ76vLT9I5
|
kod/LMqUUkCvGjBFrmKiN2BCKf3SLDjnZp55J7zQ8x3Go133JdOAB/zZDaT+oxv1
|
||||||
smXKpRmfgYxQAkWQRJ6aUV+DoVjSY/hT9JWD7u4uWgavG5D7/3SwiJC3uM0/8mxM
|
kGQneeXRqeD51/25nFTq+ZZSzBP8fXJgmlsR/1ZM1/IjKF5m5JzD2duqNKV3fqto
|
||||||
gwbp5eVEO0mTvXZsmqIRJ00NKX+RIMuUZFvzu3ajGywZfQxFs7zUhx7Lc6ry/MYI
|
IwdiqvrkMiCQICmvKxwwtbdP8+29eUbnfdOi9MO8wcXuObwz84mmpgjT30mNCWF8
|
||||||
FFrbXssgpH8U9dHMgBsGzeyQS4qQLGFHJuNBBzz48U+Dr5EgHqZ2ZXZschW+40qX
|
Ha7PlcdjpRpYHwUp66+yO4uZ9nOAs7ygzcxKLOMwyaHDv9QJYHtXDUvLv50Jnucw
|
||||||
TH8d4qyOROTiHKpKp3+nUoRiz1JPkJ0rqHg+9hOrFNpl1NZQ6w1UOc+0Ki6ZAwMd
|
KhukMJHTURzeNgUEtTu7kR0WCEBl4IyZ6GUJhc2bX3JEbYi9xZqMHgh+lf1usd1q
|
||||||
yNF733/I+OaI2b4nxhG+la6U9Z1fOat3BPRoxp8ZlLRrPq8ljxV78TMVfv7/lPO6
|
bDPe3xUEKKgAPXeZRzqCQoy/MuIPErMWpqAQePtL3KOafX+vTve0lfPtLKKbne8+
|
||||||
MZopBmSOeV19t/QypYi2pl+QYRaVs2QaBFotulob+KbKpWC4T2tMEMnPngsTxOhk
|
Tv3eaj3chC255wq6CaJjHO+PI1nt2k29KC6XXxTzkwbRxgT6wVP9uIszeRdREpyX
|
||||||
26VY5ahIp01QbewPxylpY6r1jx1tb8KcMmsGlaLrgOo9Q526bh5QGRDx9NCj064c
|
+//TCsvnAwd2l3ojzXwIEv3F6/xeYpj7hur59BopDRX3yEUNZhgfDa+l6+BIHoDZ
|
||||||
uJ2ed7hY9tNHs6qN/94rcr1hOAq5kVh+36UvJBZYQuxwIXIws4Xw+obzoKVAAqEC
|
TY3ocQrIxH40CF4IxL6dDR8OOut9vlDpfZTora7MLiQbTU1t5huGY0zBH1LpQ4u9
|
||||||
qEZWL1NB0hXynom7Vc2e2MzT2guogXDHvlCDHjtt9ekGcmU+tQ/JdgTOJ93hEInS
|
B/DnBKIuEhZf6eoH5DNHLnzuFYT6Q8QUHfHsM5KOnSEtx2oS2Txd/Ag7dS4FTPPS
|
||||||
XgEjcd1xpnzebDo9SpNBq/J/uSKAKLPOI2y+LZzvs6oiFtc4QLcgGors38x9SiAP
|
XgEe6r+BP6ItZlDVBHN9EPkgS96xpQ5EIacTxX7qmA0ToGySIyMC3PVJkO8muIIK
|
||||||
JSiQnUAC9XZtiugGdCOVy6MG1x3smAafW6kcH7yr+vWoJoQLbbF60PhuhAJ0N4Q=
|
/Lmmp6yaBOQN0kqQ26dTuVOMfMzI8zqnOW03Lm35nGnl3x8mGDH48j4Y05pS85k=
|
||||||
=3iQC
|
=t11j
|
||||||
-----END PGP MESSAGE-----
|
-----END PGP MESSAGE-----
|
||||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||||
unencrypted_suffix: _unencrypted
|
unencrypted_suffix: _unencrypted
|
||||||
|
|
|
||||||
|
|
@ -1,62 +0,0 @@
|
||||||
calendar-bot:
|
|
||||||
matrix_token: ENC[AES256_GCM,data:zJv9sw6pEzb9hxKT682wsD87HC9iejbps2wl2Z5QW1XZUSBHdcqyg1pxd+jFKTeKGQ==,iv:zDbvF1H98NsECjCtGXS+Y9HIhXowzz9HF9mltqnArog=,tag:/ftcOSQ13ElkVJBxYIMUGQ==,type:str]
|
|
||||||
mysql:
|
|
||||||
password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
|
|
||||||
sops:
|
|
||||||
kms: []
|
|
||||||
gcp_kms: []
|
|
||||||
azure_kv: []
|
|
||||||
hc_vault: []
|
|
||||||
age:
|
|
||||||
- recipient: age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2RFpLOEtUQ0ZLeUdmTGxl
|
|
||||||
VXlTOG82Ly8vdjdldnB0dGFzTkdxUHNML1VJCmxDWHhyMHYrbmtMVWVJYTdrWjVn
|
|
||||||
aE5qWWtHWSszYnNWc3l2VmFwUGl4R3MKLS0tIG9ocThFNm1pcUtMNHNlMlFsS2lx
|
|
||||||
MDhubWVxamxlSVk0dUtIWnhyUlBNM00KRunPljgLCHkwn4HCPGpkNbLitCIF7hYL
|
|
||||||
jRYVzu+Wddd13A4QfvHvAI7bJB5Zsv/xwmggVlICG1pky7gPNDwGcA==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvem5LODRyU0VlcElOS0tY
|
|
||||||
a1FaNHc0SDJLQ1llalBqQ2VEQjZpbUFyd0hNCldQNUpTdFZ5NTlxWU9icXN2Mm5a
|
|
||||||
S0JQOUkvdEZRK3NBOGpEZkJleTB1TXMKLS0tIHdVcFRETFlBVWI3TTZYZGJMMkcv
|
|
||||||
RkRXTTVURDRFNjFvci8zRVpqbkxVclEKW86hoVO0grt2x5YMt/YnmDI6J0QFKjZZ
|
|
||||||
Mnmd/Z1S6a+rajCy0GkeM+Q8AbBqBrNei2H5Xp1PlxNyicGib6+Ngg==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4bHNiY3ZCNHZsYlUrOHMy
|
|
||||||
OG55QjVmQVUxbXl0bkdNQ0FEais5Sng0ZkRBCm5KdmMvNmN6VmdsREZrbGd4ZFpM
|
|
||||||
VVpsQk43MlBxU042ZkE4L1hHK1R4RVEKLS0tIGttL01XcG1IUnBMbUVqKzJMK09o
|
|
||||||
QmVlRnJhSk4xYWFVbGVxdlFxSDlXSGMKJvjMDaX4Aa98gT+GPjGaKKdnG67jNG3C
|
|
||||||
nLsbxU4vNpFvjF4WI5vdvIQe5UGzoCYQZp3oHFnGq+Jp/hJ1HFF0GQ==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
lastmodified: "2023-09-05T23:28:56Z"
|
|
||||||
mac: ENC[AES256_GCM,data:pCWTkmCQgBOqhejK2sCLQ3H8bRXmXlToQxYmOG0IWDo2eGiZOLuIkZ1/1grYgfxAGiD4ysJod0nJuvo+eAsMeYAy6QJVtrOqO2d9V2NEdzLckXyYvwyJyZoFbNC5EW9471V0m4jLRSh5821ckNo/wtWFR11wfO15tI3MqtD1rtA=,iv:QDnckPl0LegaH0b7V4WAtmVXaL4LN+k3uKHQI2dkW7E=,tag:mScUQBR0ZHl1pi/YztrvFg==,type:str]
|
|
||||||
pgp:
|
|
||||||
- created_at: "2023-08-27T00:12:42Z"
|
|
||||||
enc: |
|
|
||||||
-----BEGIN PGP MESSAGE-----
|
|
||||||
|
|
||||||
hQIMA0av/duuklWYAQ//edQVXnTS4Xarwt14tF6yyhWM9/JFSVWW97lTO6xTNe5S
|
|
||||||
jNROmF/tHl29IPX0/QHXj/d4jMF/nteHdD53nD9s312CPOBv3SEwl4e7hfMf3rUN
|
|
||||||
4YOahX9J4ryoB+ZleK5leoYSsWaVBDJfERMkYT9Ta/xv4EC5zHBTlZDpLRuS04eZ
|
|
||||||
W5MG57TKBC0oifPvhCuv22OURNUp9t/bysSuKgU1v0Czu6ozuVgw9AO8G+PstFpW
|
|
||||||
7lyIMUNJQ7g3hiKDrrPPYcrKTeBbhxTINObe29nv00y0lycnfx3PxWrXpBoyv82y
|
|
||||||
xRgtalVvlYre1w6IFkqDFtpJD6N3zPFnPq4ZQ0nHN7A943Kxli5JnlkRH9Ak098K
|
|
||||||
PuykZ+V2X+qFNf4LS+Gnjx9wZKaLEChMaDhILUDKuUcwPIU5EiaaBOS1Y8NQ4Lha
|
|
||||||
pzyWzvpejV87Qvg2iog9UYLsK33GuxcFzYaklnknrI+9SotM7LRGQTVkVOwykh86
|
|
||||||
8d+Sake0J/1xjOcxUNbaYreTA3myyklVlvoybyNOdSzxGveEq3KvGgcORnQxYwe3
|
|
||||||
QDoCdVNTmU5ELwDPALVMenDr7VixN085oJkYqZJ6v5E0K1Bhtrb6PItoC5Kea55s
|
|
||||||
zWP+0rYxFx884cqpf8/JuC1Jbs1DpljqMMW9aD6A0htzOwEyHzDKWxy7zxCJrgjS
|
|
||||||
XgFHIr6sG1geqUzIhw8NzUpdOkdlQ6YFKP3MsUfxIqPHWVQWt1+LLvA5BX/wXIe6
|
|
||||||
kPTa9qXwmK7Hrh5TyPPEjrO16qT3UE0nvRAI0s79L6U+99xXfhKIXhg2OMSZCR8=
|
|
||||||
=xnr5
|
|
||||||
-----END PGP MESSAGE-----
|
|
||||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
|
||||||
unencrypted_suffix: _unencrypted
|
|
||||||
version: 3.7.3
|
|
||||||
|
|
@ -1,70 +0,0 @@
|
||||||
synapse:
|
|
||||||
turnconfig: ENC[AES256_GCM,data:mASRjYa4C9WRow4x0XYRrlCE5LMJUYaId+o62r1qhsyJPa2LzrI=,iv:5vYdubvMDjLS6soiWx2DzkEAATb9NFbSS/Jhuuz1yI8=,tag:wOW07CQMDbOiZNervee/pg==,type:str]
|
|
||||||
user_registration: ENC[AES256_GCM,data:ZDZfEEvyw8pg0WzhrdC8747ed+ZR2ZA8/WypJd/iDkmIy2RmxOeI0sE=,iv:l61mOlvzpCql4fC/eubBSU6px21et2WcpxQ6rFl14iw=,tag:sVDEAa3xipKIi/6isCjWew==,type:str]
|
|
||||||
signing_key: ENC[AES256_GCM,data:6UpfiRlX9pRM7zhdm7Mc8y8EItLzugWkHSgE0tGpEmudCTa1wc60oNbYfhKDWU81DT/U148pZOoX1A==,iv:UlqCPicPm5eNBz1xBMI3A3Rn4t/GtldNIDdMH5MMnLw=,tag:HHaw6iMjEAv5b9mjHSVpwA==,type:str]
|
|
||||||
sliding-sync:
|
|
||||||
env: ENC[AES256_GCM,data:DsU1qKTy5sn06Y0S5kFUqZHML20n6HdHUdXsQRUw,iv:/TNTc+StAZbf6pBY9CeXdxkx8E+3bak/wOqHyBNMprU=,tag:er5u4FRlSmUZrOT/sj+RhQ==,type:str]
|
|
||||||
coturn:
|
|
||||||
static-auth-secret: ENC[AES256_GCM,data:y5cG/LyrorkDH+8YrgcV7DY=,iv:ca90q2J3+NOy51mUBy4TMKfYMgWL4hxWDdsKIuxRBgU=,tag:hpFCns1lpi07paHyGB7tGQ==,type:str]
|
|
||||||
mjolnir:
|
|
||||||
access_token: ENC[AES256_GCM,data:ERFqZjK7MRD0xWt91FNCIxP1YC6Qj54QgnckHlCTtcQVLWaM1h2h9lHS+K8=,iv:1d7vmFkXAPcsmumzlmOT31amdrKLWtL5sJiS8G9g+LE=,tag:2l0vWzJ6P12ofuBdf5CCWw==,type:str]
|
|
||||||
registrations:
|
|
||||||
mx-puppet-discord: ENC[AES256_GCM,data:FleyXxgOmc05nTP6M2DBJlacufN3p/05eZm4kB8+K4ci0k24o3zli988wlM/kyeZmxu4pgQlJ3lNLte4uip2hBXHWG5t5Ldzmr7bNCUD+r7nM+I1lfNkrDROPZ54bHysmn9O5CHpEa16rSo6RJgncIPqsLJxTwjC7qZlkOpzqvMhkq/MHCVOpvg0M/6AUR+AlSZoggujBMoXLznQNQapN13foEsbuo/QxjszM/ObGmhYMVyaS+TDBXzQLA8Yuj50Q/gZCIINWZ4G2qmgsGxxNR4I+usUQml/jxCtIXS4zn/ettXfL9G4Fdm2F9u1v11DehtTGa5xoxDq94M9rIxOqeJpvgEQEyyKAyFUIrlINfGl7tAj4Zu7+9Z8JTRAnppjM1q8iInwn/Z2L9KgB0YFi/Go1whgXly+TH6hpreo7m5klXV/ff/aV3ghOgFCGA8nBrZFqE8Uw268q9tV1s1dxCb6TbpGf19V5c9MD6BsCIVeoq+j9I/I8iZpzg2Reb4IlHhMDwbwsL2w2ks30wiZ9XO/CFrXDY4uBlI=,iv:3vvkGvldS8Raibg6tzlV8VY1O9NCLxSuNX/lwi1QgiA=,tag:D/noIsE3xlOiYM6Pk+cc8Q==,type:str]
|
|
||||||
sops:
|
|
||||||
kms: []
|
|
||||||
gcp_kms: []
|
|
||||||
azure_kv: []
|
|
||||||
hc_vault: []
|
|
||||||
age:
|
|
||||||
- recipient: age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZ1dKNy93WmNTVkNzOE50
|
|
||||||
SGQ3d1NvcXlMeW9LQ3JCT05aQk5qSTNIUVR3CmlDeE1wTUUzQVZrREdEeDZSeW15
|
|
||||||
dEsyd0w5OUpabEZHNm54UDlmaU41V00KLS0tIGJZTXhVdUJJS0VIdGdnV21DUlhL
|
|
||||||
MjNrRytKUXBXZWhPN2dpUk4wYUJyemsK5sspkZA7AOkVtq4e8p7QhtG2yLZE2TG0
|
|
||||||
qOhodWBMqi9VWnwg6HTKtQK6hfZ17McB93J4wtciCFGB7Pa8d79TFw==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEZ1l6SDdpdXl2cFNubjBn
|
|
||||||
eTU0UCtGTWhFYWIybk0yaGswKyt2clJQekhZCkVkbXdrM1QwaGZ4TXFpOTE1eEJJ
|
|
||||||
dUZKampwMjFzQXJqUUx0RTVwQzFoVnMKLS0tIEErNjhFZzhrVTJucXgwSVp2RlFi
|
|
||||||
QllFM3MxbXBBbFNTQkNKWHhyQ09EVGcKJIJ3DB8YmhlL+6sNhp38PojDBcDItsR1
|
|
||||||
SKyJC3nTJjwtPD/8P0LivCTn9Gi0Yjd5HVIXq/76RF4aB85HLZLgSg==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwY2VLT3Ara1dXTk5EVXBi
|
|
||||||
b1l6ekd2cEp0TzgrclVNMmR6bXBtZ2Z5V3k0CjRkd0JIUzBCd2NvWDJDU0FyRzR6
|
|
||||||
MHJUSis3RHlBSm1raFRSaUY2NHpmWlkKLS0tIEk3VDhLSnU5YjRzNWFtb1ZMcy9o
|
|
||||||
cGxZVnFhdXRka2drTGdkVk1iM0pFL1kK2ry7b2cLYPfntWi/BV3K2O+mHt3242Ef
|
|
||||||
sI2JLLQYHeAhxjFdCzP1RDR+Wu/pRxZje6xuTZ9I9TKNmm+LhAXHQw==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
lastmodified: "2023-10-22T00:31:46Z"
|
|
||||||
mac: ENC[AES256_GCM,data:UpnaUfRxvdyzBy5x4EC3w5LQ1qWxILTQhpyVPd9whTzQMAivAHT0pVmP9aE4T9w3NcWTaghp+f70GmQXx/OCC6DsRCWtU9pFHRj12YUowM3yB5lVTOomOLZQ9m4gUXw5I2GZHWBJn8CyosDcBMlXz2tiR91v/8Ulh6sDSAO86U0=,iv:5GcgRvbpqDEslZruKHM/TcMaF52A5X7AK41DEbrsRIQ=,tag:ndDgCRyX1aDRnzEUNmpoMw==,type:str]
|
|
||||||
pgp:
|
|
||||||
- created_at: "2023-05-06T21:31:39Z"
|
|
||||||
enc: |
|
|
||||||
-----BEGIN PGP MESSAGE-----
|
|
||||||
|
|
||||||
hQIMA0av/duuklWYARAAmj8qTRTeTXx9PNtqOFwCGmLlKGhj860JPE3BUR2n3QOE
|
|
||||||
h9fdVJa9yqK7Lshyuf2t1HbgG+Ah4p4BaO5gYGsMLV9ybZpyNFuCgSZ3DZ4zSfxM
|
|
||||||
GSqelcHJF5qbV5gwoJvtyVFV3qtKD9FpOJwh9MfEVe98VkoISCQsPl3CHDH4ot0l
|
|
||||||
zKa56vOReHRmaCid2LNsN0nHlh1KPpwn7HdgaKyiPFexMFe4L/Q56UrlZx9XyPOb
|
|
||||||
AJ91ayfI6jWH8Hj0xxyqx0shdA74nJ/Y6ZB3JxLXnGuPvAlC3XJRQUImqYsa7p11
|
|
||||||
4Hus4hRAGEJGpmpxhazInHkWOT5ECtzxMd5LlUSq0AGYlEWJL+jtnrvy86HqpYRj
|
|
||||||
jpMfwsuwY7dJ0Tll05+goWqn0zB0yZjax71Ynky/ie5Iv8FKaUHHh2HWAzqjUaKg
|
|
||||||
6Yp3hzmMdP61fAm7ka4mxQLXQ0lrUbVnOk+pkaTrVrhcQial3W3lIgIhyo0EVi2V
|
|
||||||
Z7yEFkec7XZieMklhkL7tq9SJlWJYG1T+bavD7JSWjOXu+NlSP1hLKytM7xjp5jH
|
|
||||||
qZMEsjOaUEPvIO8Kd1f8MpLLe/+EhtmQJJMN8lwA8t/N+aOVYsW1GCspwX5mI+Ob
|
|
||||||
ZCIPkmeBz+UhJvqFD9QwWB44VWH7429VCg9hL+iWR2UfIUQHQhRFWD3604QBppzS
|
|
||||||
XgHEqjgLremZkvBsTAZsaLrTFlm7KwgjZsAkA5k+RZR5SH7xCXoSUSMnM8pWTway
|
|
||||||
24M8mPHKyshggzR5B50YME5BY1qVKtOMEmTjwN5gpn4CQDcsQ7A3eafZg7uGd64=
|
|
||||||
=4DU6
|
|
||||||
-----END PGP MESSAGE-----
|
|
||||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
|
||||||
unencrypted_suffix: _unencrypted
|
|
||||||
version: 3.7.3
|
|
||||||
|
|
@ -8,8 +8,6 @@
|
||||||
#ENC[AES256_GCM,data:IVFSM6VOWnR0YDRfecsDPlYr,iv:Jxe8pq3lxw5QUGKyspB8tWSquDSMo3mAJBAsQGKxSec=,tag:7bffwY98iTX4/De0coUIxA==,type:comment]
|
#ENC[AES256_GCM,data:IVFSM6VOWnR0YDRfecsDPlYr,iv:Jxe8pq3lxw5QUGKyspB8tWSquDSMo3mAJBAsQGKxSec=,tag:7bffwY98iTX4/De0coUIxA==,type:comment]
|
||||||
#ENC[AES256_GCM,data:pHSDnojWTLYXIKk=,iv:ph2xCpxbP3OiWm+B/MDboykPa2gtCWpP0b3j96YCDh4=,tag:u5hmvxHaa/m8GaSeYvONmg==,type:comment]
|
#ENC[AES256_GCM,data:pHSDnojWTLYXIKk=,iv:ph2xCpxbP3OiWm+B/MDboykPa2gtCWpP0b3j96YCDh4=,tag:u5hmvxHaa/m8GaSeYvONmg==,type:comment]
|
||||||
#ENC[AES256_GCM,data:Q0fCyyP0DJqUyJPo,iv:qwBE3c2VqF52Yq8POXhy2Qv2xJd82wL1aX4eVY6wL1w=,tag:IwmbD7XqIkemOTODBKpS0g==,type:comment]
|
#ENC[AES256_GCM,data:Q0fCyyP0DJqUyJPo,iv:qwBE3c2VqF52Yq8POXhy2Qv2xJd82wL1aX4eVY6wL1w=,tag:IwmbD7XqIkemOTODBKpS0g==,type:comment]
|
||||||
config:
|
|
||||||
mysqld_exporter: ENC[AES256_GCM,data:w4muNsWmsW1fPx9nqtDGPCZ9faO3W5Pagn/DfWrb5yf88GQOzOsN4z7TH3QeW0Xs6I5jDIktGmFml6RDxCjD8UX9eer1pvC7Kxyl2DQKLHwmsgx1DUFNTRUzE1Sgx8rZAJ8HM7DO7L/6aXS0ndY4J+huyhDDVd+cIetgiQ==,iv:Q4cZD9CKd/EDOm4bjAE2EOstwKpwexF2pxhMEF0/5/k=,tag:S0rOLJS+b9ualtxcHKdHlw==,type:str]
|
|
||||||
keys:
|
keys:
|
||||||
grafana:
|
grafana:
|
||||||
secret_key: ENC[AES256_GCM,data:+WoAJbDBEgKs0RoHT+7oEELAVQ+/2Xt+5RTMSXg23moCqVRx+Gzll9P5Drw=,iv:AkRn/Y20iEe5i1T+84wAgLCTFtAox2G3giyawAkltAw=,tag:BZbt5Wb5lYLIJBm/pfP4GQ==,type:str]
|
secret_key: ENC[AES256_GCM,data:+WoAJbDBEgKs0RoHT+7oEELAVQ+/2Xt+5RTMSXg23moCqVRx+Gzll9P5Drw=,iv:AkRn/Y20iEe5i1T+84wAgLCTFtAox2G3giyawAkltAw=,tag:BZbt5Wb5lYLIJBm/pfP4GQ==,type:str]
|
||||||
|
|
@ -51,8 +49,8 @@ sops:
|
||||||
a2hQVVprakt5NURpNXdQUjREczJKWTgKn60yrLqco9brlqigAolO8rEkww9z3y3u
|
a2hQVVprakt5NURpNXdQUjREczJKWTgKn60yrLqco9brlqigAolO8rEkww9z3y3u
|
||||||
KmefLVZCGfoko+fnKLVE9UKFS/tAowqgPS1qE76u1Mmkk6yqZoG9rg==
|
KmefLVZCGfoko+fnKLVE9UKFS/tAowqgPS1qE76u1Mmkk6yqZoG9rg==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
lastmodified: "2023-07-08T12:46:19Z"
|
lastmodified: "2023-01-26T00:16:54Z"
|
||||||
mac: ENC[AES256_GCM,data:bQWG/GgSIv5LdhGTsyx3ENOAywtYVKjzK6nxOnUEZvD+RSi6jxj9Wze7qOhXvgjKWCz/cZj5oSuMQNRyoI8p8xJdxf0+UNdX8uPT05HiKuF7CBcXzprjKri/H6yFp87epOM9fMdn7ZUACn/iT1IZBo+5OuMtDnqVUm/GEmMcsog=,iv:ll/vEeiXsD3crbbxEFsJlxGbm9dZDUPC4GeO95RZZX4=,tag:TGCA721vK9EY3xlY6zIeIg==,type:str]
|
mac: ENC[AES256_GCM,data:T13TG5fwXgAXUD4I8yIsdUQTA4MKZdEWkpVP1H734YBt5c0J0FJ5Ppxvf1n3hPcC6dcyCJ1NonbmmDBeKn0JUlxTlrK645O33RHLHlsMZGVijYyLyvxCxGo22SfdT2OdPv7tggyat9Cpd9bVLd7YdhPxTYDnZ3eNbIwx+5Fnw48=,iv:bYz6k1f30nlCjOuTRu3F2OE9iQIMd2eBGezXQx901zE=,tag:GHGGNlNg+huP6F3uyrbncQ==,type:str]
|
||||||
pgp:
|
pgp:
|
||||||
- created_at: "2023-01-21T19:52:08Z"
|
- created_at: "2023-01-21T19:52:08Z"
|
||||||
enc: |
|
enc: |
|
||||||
|
|
|
||||||
12
shell.nix
12
shell.nix
|
|
@ -3,17 +3,5 @@ pkgs.mkShell {
|
||||||
nativeBuildInputs = with pkgs; [
|
nativeBuildInputs = with pkgs; [
|
||||||
sops
|
sops
|
||||||
gnupg
|
gnupg
|
||||||
openstackclient
|
|
||||||
];
|
];
|
||||||
|
|
||||||
shellHook = ''
|
|
||||||
export OS_AUTH_URL=https://api.stack.it.ntnu.no:5000
|
|
||||||
export OS_PROJECT_ID=b78432a088954cdc850976db13cfd61c
|
|
||||||
export OS_PROJECT_NAME="STUDORG_Programvareverkstedet"
|
|
||||||
export OS_USER_DOMAIN_NAME="NTNU"
|
|
||||||
export OS_PROJECT_DOMAIN_ID="d3f99bcdaf974685ad0c74c2e5d259db"
|
|
||||||
export OS_REGION_NAME="NTNU-IT"
|
|
||||||
export OS_INTERFACE=public
|
|
||||||
export OS_IDENTITY_API_VERSION=3
|
|
||||||
'';
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
{ pkgs, ... }:
|
|
||||||
{
|
|
||||||
users.users.adriangl = {
|
|
||||||
isNormalUser = true;
|
|
||||||
description = "(0_0)";
|
|
||||||
extraGroups = [
|
|
||||||
"wheel"
|
|
||||||
"drift"
|
|
||||||
];
|
|
||||||
|
|
||||||
packages = with pkgs; [
|
|
||||||
exa
|
|
||||||
neovim
|
|
||||||
];
|
|
||||||
|
|
||||||
openssh.authorizedKeys.keys = [
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFa5y7KyLn2tjxed1czMbyM5scnEpo9v/GfnhL/28ckM legolas"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
{pkgs, ...}:
|
|
||||||
|
|
||||||
{
|
|
||||||
users.users.amalieem = {
|
|
||||||
isNormalUser = true;
|
|
||||||
extraGroups = [ "wheel" ];
|
|
||||||
shell = pkgs.zsh;
|
|
||||||
openssh.authorizedKeys.keys = [
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPsMtFIj4Dem/onwMoWYbosOcU4y7A5nTjVwqWaU33E1 amalieem@matey-aug22"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -3,12 +3,7 @@
|
||||||
{
|
{
|
||||||
users.users.danio = {
|
users.users.danio = {
|
||||||
isNormalUser = true;
|
isNormalUser = true;
|
||||||
extraGroups = [ "drift" "nix-builder-users" ];
|
extraGroups = [ "drift" ]; # Enable ‘sudo’ for the user.
|
||||||
shell = pkgs.zsh;
|
shell = pkgs.zsh;
|
||||||
|
|
||||||
openssh.authorizedKeys.keys = [
|
|
||||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCp8iMOx3eTiG5AmDh2KjKcigf7xdRKn9M7iZQ4RqP0np0UN2NUbu+VAMJmkWFyi3JpxmLuhszU0F1xY+3qM3ARduy1cs89B/bBE85xlOeYhcYVmpcgPR5xduS+TuHTBzFAgp+IU7/lgxdjcJ3PH4K0ruGRcX1xrytmk/vdY8IeSk3GVWDRrRbH6brO4cCCFjX0zJ7G6hBQueTPQoOy3jrUvgpRkzZY4ZCuljXtxbuX5X/2qWAkp8ca0iTQ5FzNA5JUyj+DWeEzjIEz6GrckOdV2LjWpT9+CtOqoPZOUudE1J9mJk4snNlMQjE06It7Kr50bpwoPqnxjo7ZjlHFLezl"
|
|
||||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDpGSDczzDOhTETCj+uB5e3/9QbOCaVW1knM+n1ey0n6LXH7uiPPmzuZiqfzmfbB1z4bjM2zpn3D6Et6zRCrBUjhTZqf/5GoNlvhVA6QYmBmBp98b8oY7juj5cmu55voxD0S5rC1mQMnWAAf8e8OPbkhs9Lt0XlOYdotLNIZQubzWqE2DK45g/h17ELJs+jkNXoalFjLvLXWzE/C+3pYoeNJVGHfVMTIwt7o64E6JXhxuYTYdSIuzd+BjntkSCXzcAzBFMRwkdlFVoBtLUMMcMQl39kcXv7lAQ8pv+8b1j1N9WuQVf1qEAcZguaimI1ifbXP5d841pZPApCj5KXectIEldfTrcwg8rZpd2UfYS/3XCcOuidBGprY7XsU/jz8wHbH68UjUrsLyaOMnG2ChYztnf63vm3gRs3Fc6FqTycpgYOPDeZBVTcMyPGgtiZvhnTeY20xFS5lK6M+dmgaDqH24kPLiwYSpUF2NK+Rg/2bZxvt/GaSr4U6fJGi3FCJOM= root@DanixLaptop"
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -6,7 +6,6 @@
|
||||||
shell = pkgs.zsh;
|
shell = pkgs.zsh;
|
||||||
openssh.authorizedKeys.keys = [
|
openssh.authorizedKeys.keys = [
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDKzPICGew7uN0cmvRmbwkwTCodTBUgEhkoftQnZuO4Q felixalbrigtsen@gmail.com"
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDKzPICGew7uN0cmvRmbwkwTCodTBUgEhkoftQnZuO4Q felixalbrigtsen@gmail.com"
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBTXSL0w7OUcz1LzEt1T3I3K5RgyNV+MYz0x/1RbpDHQ felixalb@worf"
|
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
{pkgs, ...}:
|
|
||||||
|
|
||||||
{
|
|
||||||
users.users.jonmro = {
|
|
||||||
isNormalUser = true;
|
|
||||||
extraGroups = [ "wheel" "drift" "nix-builder-users" ];
|
|
||||||
shell = pkgs.zsh;
|
|
||||||
openssh.authorizedKeys.keys = [
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEm5PfYmfl/0fnAP/3coVlvTw3/TYNLT6r/NwJHZbLAK jonrodtang@gmail.com"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -2,18 +2,16 @@
|
||||||
{
|
{
|
||||||
users.users.oysteikt = {
|
users.users.oysteikt = {
|
||||||
isNormalUser = true;
|
isNormalUser = true;
|
||||||
description = "basement dweller";
|
|
||||||
extraGroups = [
|
extraGroups = [
|
||||||
"wheel"
|
"wheel"
|
||||||
"drift"
|
"drift"
|
||||||
"nix-builder-users"
|
|
||||||
];
|
];
|
||||||
|
|
||||||
|
shell = pkgs.zsh;
|
||||||
packages = with pkgs; [
|
packages = with pkgs; [
|
||||||
bottom
|
bottom
|
||||||
exa
|
exa
|
||||||
neovim
|
neovim
|
||||||
diskonaut
|
|
||||||
ripgrep
|
ripgrep
|
||||||
tmux
|
tmux
|
||||||
];
|
];
|
||||||
|
|
|
||||||
41
values.nix
41
values.nix
|
|
@ -3,20 +3,12 @@ let
|
||||||
pvv-ipv4 = suffix: "129.241.210.${toString suffix}";
|
pvv-ipv4 = suffix: "129.241.210.${toString suffix}";
|
||||||
pvv-ipv6 = suffix: "2001:700:300:1900::${toString suffix}";
|
pvv-ipv6 = suffix: "2001:700:300:1900::${toString suffix}";
|
||||||
in rec {
|
in rec {
|
||||||
ipv4-space = pvv-ipv4 "128/25";
|
|
||||||
ipv6-space = pvv-ipv6 "/64";
|
|
||||||
|
|
||||||
services = {
|
services = {
|
||||||
matrix = {
|
matrix = {
|
||||||
inherit (hosts.bicep) ipv4 ipv6;
|
ipv4 = hosts.jokum.ipv4;
|
||||||
|
ipv6 = hosts.jokum.ipv6;
|
||||||
};
|
};
|
||||||
postgres = {
|
# Also on jokum
|
||||||
inherit (hosts.bicep) ipv4 ipv6;
|
|
||||||
};
|
|
||||||
mysql = {
|
|
||||||
inherit (hosts.bicep) ipv4 ipv6;
|
|
||||||
};
|
|
||||||
# Also on bicep
|
|
||||||
turn = {
|
turn = {
|
||||||
ipv4 = pvv-ipv4 213;
|
ipv4 = pvv-ipv4 213;
|
||||||
ipv6 = pvv-ipv6 213;
|
ipv6 = pvv-ipv6 213;
|
||||||
|
|
@ -29,6 +21,10 @@ in rec {
|
||||||
ipv4 = pvv-ipv4 168;
|
ipv4 = pvv-ipv4 168;
|
||||||
ipv6 = pvv-ipv6 168;
|
ipv6 = pvv-ipv6 168;
|
||||||
};
|
};
|
||||||
|
jokum = {
|
||||||
|
ipv4 = pvv-ipv4 169;
|
||||||
|
ipv6 = pvv-ipv6 169;
|
||||||
|
};
|
||||||
ildkule = {
|
ildkule = {
|
||||||
ipv4 = pvv-ipv4 187;
|
ipv4 = pvv-ipv4 187;
|
||||||
ipv6 = pvv-ipv6 "1:187";
|
ipv6 = pvv-ipv6 "1:187";
|
||||||
|
|
@ -37,29 +33,6 @@ in rec {
|
||||||
ipv4 = pvv-ipv4 209;
|
ipv4 = pvv-ipv4 209;
|
||||||
ipv6 = pvv-ipv6 209;
|
ipv6 = pvv-ipv6 209;
|
||||||
};
|
};
|
||||||
bob = {
|
|
||||||
ipv4 = "129.241.152.254";
|
|
||||||
# ipv6 = ;
|
|
||||||
};
|
|
||||||
knutsen = {
|
|
||||||
ipv4 = pvv-ipv4 191;
|
|
||||||
};
|
|
||||||
shark = {
|
|
||||||
ipv4 = pvv-ipv4 196;
|
|
||||||
ipv6 = pvv-ipv6 196;
|
|
||||||
};
|
|
||||||
brzeczyszczykiewicz = {
|
|
||||||
ipv4 = pvv-ipv4 205;
|
|
||||||
ipv6 = pvv-ipv6 "1:50"; # Wtf peder why
|
|
||||||
};
|
|
||||||
georg = {
|
|
||||||
ipv4 = pvv-ipv4 204;
|
|
||||||
ipv6 = pvv-ipv6 "1:4f"; # Wtf øystein og daniel why
|
|
||||||
};
|
|
||||||
buskerud = {
|
|
||||||
ipv4 = pvv-ipv4 231;
|
|
||||||
ipv6 = pvv-ipv6 231;
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
defaultNetworkConfig = {
|
defaultNetworkConfig = {
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue