forked from Drift/pvv-nixos-config
Compare commits
7 Commits
replace-kn
...
mediawiki-
Author | SHA1 | Date | |
---|---|---|---|
7d7fb21004 | |||
28e3f5672c | |||
8ced91a285
|
|||
2c42b120a6 | |||
27ba3f7a7f | |||
c1c58122ea | |||
7ac960c5ff
|
31
flake.lock
generated
31
flake.lock
generated
@@ -7,11 +7,11 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1699099781,
|
"lastModified": 1700927249,
|
||||||
"narHash": "sha256-2WAs839yL6xmIPBLNVwbft46BDh0/RAjq1bAKNRqeR4=",
|
"narHash": "sha256-iqmIWiEng890/ru7ZBf4nUezFPyRm2fjRTvuwwxqk2o=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "disko",
|
"repo": "disko",
|
||||||
"rev": "548962c50b8afad7b8c820c1d6e21dc8394d6e65",
|
"rev": "3cb78c93e6a02f494aaf6aeb37481c27a2e2ee22",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -75,16 +75,17 @@
|
|||||||
"original": {
|
"original": {
|
||||||
"owner": "dali99",
|
"owner": "dali99",
|
||||||
"repo": "nixos-matrix-modules",
|
"repo": "nixos-matrix-modules",
|
||||||
|
"rev": "e09814657187c8ed1a5fe1646df6d8da1eb2dee9",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs": {
|
"nixpkgs": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1699110214,
|
"lastModified": 1701362232,
|
||||||
"narHash": "sha256-L2TU4RgtiqF69W8Gacg2jEkEYJrW+Kp0Mp4plwQh5b8=",
|
"narHash": "sha256-GVdzxL0lhEadqs3hfRLuj+L1OJFGiL/L7gCcelgBlsw=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "78f3a4ae19f0e99d5323dd2e3853916b8ee4afee",
|
"rev": "d2332963662edffacfddfad59ff4f709dde80ffe",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -110,11 +111,11 @@
|
|||||||
},
|
},
|
||||||
"nixpkgs-stable": {
|
"nixpkgs-stable": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1699110214,
|
"lastModified": 1700905716,
|
||||||
"narHash": "sha256-L2TU4RgtiqF69W8Gacg2jEkEYJrW+Kp0Mp4plwQh5b8=",
|
"narHash": "sha256-w1vHn2MbGfdC+CrP3xLZ3scsI06N0iQLU7eTHIVEFGw=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "78f3a4ae19f0e99d5323dd2e3853916b8ee4afee",
|
"rev": "dfb95385d21475da10b63da74ae96d89ab352431",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -126,11 +127,11 @@
|
|||||||
},
|
},
|
||||||
"nixpkgs-unstable": {
|
"nixpkgs-unstable": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1699128932,
|
"lastModified": 1701368325,
|
||||||
"narHash": "sha256-4Hn/fpR/FRucpXQqMI0OSgxiu2ImowmR0dThAycPt/4=",
|
"narHash": "sha256-3OqZyi2EdopJxpxwrySPyCTuCvfBY4oXTLVgQ4B6qDg=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "0d2d729bf7091df906a78b69f90620f933ea963f",
|
"rev": "3934dbde4f4a0e266825348bc4ad1bdd00a8d6a3",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -179,11 +180,11 @@
|
|||||||
"nixpkgs-stable": "nixpkgs-stable"
|
"nixpkgs-stable": "nixpkgs-stable"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1699153251,
|
"lastModified": 1701127353,
|
||||||
"narHash": "sha256-CGx98mbAy9svKTa1dzlrVmkJwgGSXpAQUdMh7U0szts=",
|
"narHash": "sha256-qVNX0wOl0b7+I35aRu78xUphOyELh+mtUp1KBx89K1Q=",
|
||||||
"owner": "Mic92",
|
"owner": "Mic92",
|
||||||
"repo": "sops-nix",
|
"repo": "sops-nix",
|
||||||
"rev": "5bc2cde6e53241e7df0e8f5df5872223983efa72",
|
"rev": "b1edbf5c0464b4cced90a3ba6f999e671f0af631",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@@ -14,7 +14,8 @@
|
|||||||
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
|
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
|
||||||
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
matrix-next.url = "github:dali99/nixos-matrix-modules";
|
# Last release compatible with 23.05
|
||||||
|
matrix-next.url = "github:dali99/nixos-matrix-modules/e09814657187c8ed1a5fe1646df6d8da1eb2dee9";
|
||||||
|
|
||||||
grzegorz.url = "github:Programvareverkstedet/grzegorz";
|
grzegorz.url = "github:Programvareverkstedet/grzegorz";
|
||||||
grzegorz.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
grzegorz.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||||
@@ -111,6 +112,12 @@
|
|||||||
inputs.grzegorz-clients.nixosModules.grzegorz-webui
|
inputs.grzegorz-clients.nixosModules.grzegorz-webui
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
buskerud = stableNixosConfig "buskerud" {
|
||||||
|
modules = [
|
||||||
|
./hosts/buskerud/configuration.nix
|
||||||
|
sops-nix.nixosModules.sops
|
||||||
|
];
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
devShells = forAllSystems (system: {
|
devShells = forAllSystems (system: {
|
||||||
|
@@ -13,7 +13,7 @@
|
|||||||
./services/nginx.nix
|
./services/nginx.nix
|
||||||
./services/gitea/default.nix
|
./services/gitea/default.nix
|
||||||
./services/webmail
|
./services/webmail
|
||||||
# ./services/mediawiki.nix
|
./services/mediawiki.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
|
sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
|
||||||
|
@@ -1,4 +1,4 @@
|
|||||||
{ pkgs, lib, config, values, ... }: let
|
{ pkgs, lib, config, values, pkgs-unstable, ... }: let
|
||||||
cfg = config.services.mediawiki;
|
cfg = config.services.mediawiki;
|
||||||
|
|
||||||
# "mediawiki"
|
# "mediawiki"
|
||||||
@@ -13,7 +13,7 @@ in {
|
|||||||
owner = user;
|
owner = user;
|
||||||
group = group;
|
group = group;
|
||||||
};
|
};
|
||||||
"keys/postgres/mediawiki" = {
|
"mediawiki/database" = {
|
||||||
restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
|
restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
|
||||||
owner = user;
|
owner = user;
|
||||||
group = group;
|
group = group;
|
||||||
@@ -30,7 +30,7 @@ in {
|
|||||||
type = "postgres";
|
type = "postgres";
|
||||||
host = "postgres.pvv.ntnu.no";
|
host = "postgres.pvv.ntnu.no";
|
||||||
port = config.services.postgresql.port;
|
port = config.services.postgresql.port;
|
||||||
passwordFile = config.sops.secrets."keys/postgres/mediawiki".path;
|
passwordFile = config.sops.secrets."mediawiki/database".path;
|
||||||
createLocally = false;
|
createLocally = false;
|
||||||
# TODO: create a normal database and copy over old data when the service is production ready
|
# TODO: create a normal database and copy over old data when the service is production ready
|
||||||
name = "mediawiki_test";
|
name = "mediawiki_test";
|
||||||
@@ -61,35 +61,45 @@ in {
|
|||||||
|
|
||||||
extensions = {
|
extensions = {
|
||||||
DeleteBatch = pkgs.fetchzip {
|
DeleteBatch = pkgs.fetchzip {
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/DeleteBatch-REL1_39-995ea6f.tar.gz";
|
name = "mediawiki-delete-batch-source";
|
||||||
sha256 = "sha256-0F4GLCy2f5WcWIY2YgF1tVxgYbglR0VOsj/pMrW93b8=";
|
url = "https://extdist.wmflabs.org/dist/extensions/DeleteBatch-REL1_40-4fe36dc.tar.gz";
|
||||||
|
hash = "sha256-jmRkjHFQR9cjPr1eBHVDLHm0xO4OPn9HYiYwrkBT/aA=";
|
||||||
};
|
};
|
||||||
UserMerge = pkgs.fetchzip {
|
UserMerge = pkgs.fetchzip {
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/UserMerge-REL1_39-b10d50e.tar.gz";
|
name = "mediawiki-user-merge-source";
|
||||||
sha256 = "sha256-bXhj1+OlOUJDbvEuc8iwqb1LLEu6cN6+C/7cAvnWPOQ=";
|
url = "https://extdist.wmflabs.org/dist/extensions/UserMerge-REL1_40-7407806.tar.gz";
|
||||||
|
hash = "sha256-NHAw79pDxjia46J5DIGV9AoF9UazSahT8DZgUUn/pQE=";
|
||||||
};
|
};
|
||||||
PluggableAuth = pkgs.fetchzip {
|
PluggableAuth = pkgs.fetchzip {
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_39-1210fc3.tar.gz";
|
name = "mediawiki-pluggable-auth-source";
|
||||||
sha256 = "sha256-F6bTMCzkK3kZwZGIsNE87WlZWqXXmTMhEjApO99YKR0=";
|
url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_40-eb10a76.tar.gz";
|
||||||
|
hash = "sha256-GFmtQc0SeBpvI+7iHOVw77JR2h+hwPxo8+wZ9RED8a8=";
|
||||||
};
|
};
|
||||||
SimpleSAMLphp = pkgs.fetchzip {
|
SimpleSAMLphp = pkgs.fetchzip {
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/SimpleSAMLphp-REL1_39-dcf0acb.tar.gz";
|
name = "mediawiki-simple-saml-php-source";
|
||||||
sha256 = "sha256-tCvFmb2+q2rxms+lRo5pgoI3h6GjCwXAR8XisPg03TQ=";
|
url = "https://extdist.wmflabs.org/dist/extensions/SimpleSAMLphp-REL1_40-8043943.tar.gz";
|
||||||
|
hash = "sha256-HJHcrv/FNqPJegrHo4VPVjw0alkyHwetFZiLwjHsf6Y=";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
extraConfig = let
|
extraConfig = let
|
||||||
|
SimpleSAMLphpRepo = pkgs-unstable.php.buildComposerProject rec {
|
||||||
SimpleSAMLphpRepo = pkgs.stdenvNoCC.mkDerivation rec {
|
|
||||||
pname = "configuredSimpleSAML";
|
pname = "configuredSimpleSAML";
|
||||||
version = "2.0.4";
|
version = "2.1.0-rc1";
|
||||||
src = pkgs.fetchzip {
|
src = pkgs.fetchFromGitHub {
|
||||||
url = "https://github.com/simplesamlphp/simplesamlphp/releases/download/v${version}/simplesamlphp-${version}.tar.gz";
|
owner = "simplesamlphp";
|
||||||
sha256 = "sha256-pfMV/VmqqxgtG7Nx4s8MW4tWSaxOkVPtCRJwxV6RDSE=";
|
repo = "simplesamlphp";
|
||||||
|
# name = "simple-saml-php-source";
|
||||||
|
# url = "https://github.com/simplesamlphp/simplesamlphp/releases/download/v${version}/simplesamlphp-${version}.tar.gz";
|
||||||
|
rev = "v${version}";
|
||||||
|
hash = "sha256-E7S6T/EfuhNbe697OiklZ77wMRkOb/ABJXoL5MphMCY=";
|
||||||
};
|
};
|
||||||
|
|
||||||
buildPhase = ''
|
composerStrictValidation = false;
|
||||||
cat > config/authsources.php << EOF
|
|
||||||
|
vendorHash = "sha256-vr9mWXN9v6tGNvPtxQ+pgf7OYj8dedzWfxt6Xw1nCm0=";
|
||||||
|
|
||||||
|
configAuthsourcesPhp = ''
|
||||||
<?php
|
<?php
|
||||||
$config = array(
|
$config = array(
|
||||||
'default-sp' => array(
|
'default-sp' => array(
|
||||||
@@ -97,11 +107,51 @@ in {
|
|||||||
'idp' => 'https://idp.pvv.ntnu.no/',
|
'idp' => 'https://idp.pvv.ntnu.no/',
|
||||||
),
|
),
|
||||||
);
|
);
|
||||||
EOF
|
'';
|
||||||
'';
|
|
||||||
|
|
||||||
installPhase = ''
|
# TODO: this could be fetched automagically with these:
|
||||||
cp -r . $out
|
# - https://simplesamlphp.org/docs/contrib_modules/metarefresh/simplesamlphp-automated_metadata.html
|
||||||
|
# - https://idp.pvv.ntnu.no/simplesaml/saml2/idp/metadata.php
|
||||||
|
metadataSaml20IdpRemotePhp = ''
|
||||||
|
<?php
|
||||||
|
$metadata['https://idp.pvv.ntnu.no/'] = array (
|
||||||
|
'metadata-set' => 'saml20-idp-remote',
|
||||||
|
'entityid' => 'https://idp.pvv.ntnu.no/',
|
||||||
|
'SingleSignOnService' =>
|
||||||
|
array (
|
||||||
|
0 =>
|
||||||
|
array (
|
||||||
|
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
|
||||||
|
'Location' => 'https://idp.pvv.ntnu.no/simplesaml/saml2/idp/SSOService.php',
|
||||||
|
),
|
||||||
|
),
|
||||||
|
'SingleLogoutService' =>
|
||||||
|
array (
|
||||||
|
0 =>
|
||||||
|
array (
|
||||||
|
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
|
||||||
|
'Location' => 'https://idp.pvv.ntnu.no/simplesaml/saml2/idp/SingleLogoutService.php',
|
||||||
|
),
|
||||||
|
),
|
||||||
|
'certData' => 'pvvcert.pem',
|
||||||
|
'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
|
||||||
|
);
|
||||||
|
'';
|
||||||
|
|
||||||
|
pvvcert = ''
|
||||||
|
MIIDpTCCAo2gAwIBAgIJAJIgibrB7NvsMA0GCSqGSIb3DQEBCwUAMGkxCzAJBgNVBAYTAk5PMR4wHAYDVQQKDBVQcm9ncmFtdmFyZXZlcmtzdGVkZXQxGDAWBgNVBAMMD2lkcC5wdnYubnRudS5ubzEgMB4GCSqGSIb3DQEJARYRZHJpZnRAcHZ2Lm50bnUubm8wHhcNMTcxMTEzMjI0NTQyWhcNMjcxMTEzMjI0NTQyWjBpMQswCQYDVQQGEwJOTzEeMBwGA1UECgwVUHJvZ3JhbXZhcmV2ZXJrc3RlZGV0MRgwFgYDVQQDDA9pZHAucHZ2Lm50bnUubm8xIDAeBgkqhkiG9w0BCQEWEWRyaWZ0QHB2di5udG51Lm5vMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAveLujCsgVCRA360y5yezy8FcSPhaqodggDqY12UTkYOMQLBFaph6uUL4oCUlXZqxScrAYVRt9yw+7BYpcm0p51VZzVCsfMxRVkn+O1eUvsaXq3f13f87QHKYP2f0uqkGf5PvnKIdSaI/ix8WJhD8XT+h0OkHEcaBvUtSG7zbEhvG21WPHwgw2rvZSneArQ8tOitZC0u8VXSfdhtf6ynRseo0xC95634UwQAZivhQ2v4A6Tp57QG5DCXIJ9/z3PkINx3KB/hOeh0EP6Dpbp+7V0/t9778E3whpm4llrH144kzROhA7EgUgkZOjAVjxGCYlcj3xQPnnItihVOZ5B5qLwIDAQABo1AwTjAdBgNVHQ4EFgQUPLhrB+Qb/Kzz7Car9GJkKmEkz6swHwYDVR0jBBgwFoAUPLhrB+Qb/Kzz7Car9GJkKmEkz6swDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAd+4E6t0j8/p8rbZE8y/gZ9GsiRhxkR4l6JbMRUfEpqHKi415qstChRcP2Lo3Yd5qdmj9tLDWoPsqet1QgyTTmQTgUmPhhMOQDqSh90LuqEJseKWafXGS/SfWLH6MWVmzDV5YofJEw2ThPiU58GiS06OLS2poq1eAesa2LQ22J8yYisXM4sxImIFte+LYQ1+1evfBWcvU1vrGsQ0VLJHdef9WoXp1swUFhq4Zk0c7gjHiB1CFVlExAAlk9L6W3CVXmKIYlf4eUnEBGkC061Ir42+uhAMWO9Y/L1NEuboTyd2KAI/6JdKdzpmfk7zPVxWlNxNCZ7OPNuvOKp6VlpB2EA==
|
||||||
|
'';
|
||||||
|
|
||||||
|
passAsFile = [
|
||||||
|
"configAuthsourcesPhp"
|
||||||
|
"metadataSaml20IdpRemotePhp"
|
||||||
|
"pvvcert"
|
||||||
|
];
|
||||||
|
|
||||||
|
postPatch = ''
|
||||||
|
install -Dm444 "$configAuthsourcesPhpPath" "config/authsources.php"
|
||||||
|
install -Dm444 "$metadataSaml20IdpRemotePhpPath" "metadata/saml20-idp-remote.php"
|
||||||
|
install -Dm444 "$pvvcertPath" "cert/pvvcert.pem"
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -172,4 +222,23 @@ in {
|
|||||||
|
|
||||||
${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/update.php --conf ${mediawikiConfig} --quick
|
${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/update.php --conf ${mediawikiConfig} --quick
|
||||||
'';
|
'';
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."bekkalokk.pvv.ntnu.no" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
root = "${config.services.mediawiki.finalPackage}/share/mediawiki";
|
||||||
|
locations = {
|
||||||
|
"/" = {
|
||||||
|
extraConfig = ''
|
||||||
|
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||||
|
fastcgi_index index.php;
|
||||||
|
fastcgi_pass unix:${config.services.phpfpm.pools.mediawiki.socket};
|
||||||
|
include ${pkgs.nginx}/conf/fastcgi_params;
|
||||||
|
include ${pkgs.nginx}/conf/fastcgi.conf;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
"/images".root = config.services.mediawiki.uploadsDir;
|
||||||
|
};
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
@@ -5,6 +5,7 @@ from smtplib import SMTP_SSL as SMTP
|
|||||||
import synapse
|
import synapse
|
||||||
from synapse import module_api
|
from synapse import module_api
|
||||||
|
|
||||||
|
import re
|
||||||
|
|
||||||
class SMTPAuthProvider:
|
class SMTPAuthProvider:
|
||||||
def __init__(self, config: dict, api: module_api):
|
def __init__(self, config: dict, api: module_api):
|
||||||
@@ -27,6 +28,10 @@ class SMTPAuthProvider:
|
|||||||
if login_type != "m.login.password":
|
if login_type != "m.login.password":
|
||||||
return None
|
return None
|
||||||
|
|
||||||
|
# Convert `@username:server` to `username`
|
||||||
|
match = re.match(r'^@([\da-z\-\.=_\/\+]+):[\w\d\.:\[\]]+$', username)
|
||||||
|
username = match.group(1) if match else username
|
||||||
|
|
||||||
result = False
|
result = False
|
||||||
with SMTP(self.config["smtp_host"]) as smtp:
|
with SMTP(self.config["smtp_host"]) as smtp:
|
||||||
password = login_dict.get("password")
|
password = login_dict.get("password")
|
||||||
|
@@ -216,7 +216,19 @@ in {
|
|||||||
|
|
||||||
services.redis.servers."".enable = true;
|
services.redis.servers."".enable = true;
|
||||||
|
|
||||||
services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [({
|
services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
|
||||||
|
({
|
||||||
|
locations."/.well-known/matrix/server" = {
|
||||||
|
return = ''
|
||||||
|
200 '{"m.server": "matrix.pvv.ntnu.no:443"}'
|
||||||
|
'';
|
||||||
|
extraConfig = ''
|
||||||
|
default_type application/json;
|
||||||
|
add_header Access-Control-Allow-Origin *;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
})
|
||||||
|
({
|
||||||
locations = let
|
locations = let
|
||||||
connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
|
connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
|
||||||
socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString (c.port)}";
|
socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString (c.port)}";
|
||||||
|
50
hosts/buskerud/configuration.nix
Normal file
50
hosts/buskerud/configuration.nix
Normal file
@@ -0,0 +1,50 @@
|
|||||||
|
{ config, pkgs, values, ... }:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
# Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
../../base.nix
|
||||||
|
../../misc/metrics-exporters.nix
|
||||||
|
|
||||||
|
./services/openvpn-client.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
# buskerud does not support efi?
|
||||||
|
# boot.loader.systemd-boot.enable = true;
|
||||||
|
# boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
boot.loader.grub.enable = true;
|
||||||
|
boot.loader.grub.device = "/dev/sda";
|
||||||
|
|
||||||
|
networking.hostName = "buskerud";
|
||||||
|
networking.search = [ "pvv.ntnu.no" "pvv.org" ];
|
||||||
|
networking.nameservers = [ "129.241.0.200" "129.241.0.201" ];
|
||||||
|
networking.tempAddresses = "disabled";
|
||||||
|
|
||||||
|
systemd.network.networks."enp3s0f0" = values.defaultNetworkConfig // {
|
||||||
|
matchConfig.Name = "enp3s0f0";
|
||||||
|
address = with values.hosts.buskerud; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||||
|
};
|
||||||
|
|
||||||
|
# Buskerud should use the default gateway received from DHCP
|
||||||
|
networking.interfaces.enp14s0f1.useDHCP = true;
|
||||||
|
|
||||||
|
# networking.interfaces.tun = {
|
||||||
|
# virtual = true;
|
||||||
|
# ipv4.adresses = [ {address="129.241.210.252"; prefixLength=25; } ];
|
||||||
|
# };
|
||||||
|
|
||||||
|
# List packages installed in system profile
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
];
|
||||||
|
|
||||||
|
# List services that you want to enable:
|
||||||
|
|
||||||
|
# This value determines the NixOS release from which the default
|
||||||
|
# settings for stateful data, like file locations and database versions
|
||||||
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
# this value at the release version of the first install of this system.
|
||||||
|
# Before changing this value read the documentation for this option
|
||||||
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
|
system.stateVersion = "23.05"; # Did you read the comment?
|
||||||
|
|
||||||
|
}
|
37
hosts/buskerud/hardware-configuration.nix
Normal file
37
hosts/buskerud/hardware-configuration.nix
Normal file
@@ -0,0 +1,37 @@
|
|||||||
|
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||||
|
# and may be overwritten by future invocations. Please make changes
|
||||||
|
# to /etc/nixos/configuration.nix instead.
|
||||||
|
{ config, lib, pkgs, modulesPath, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ata_piix" "hpsa" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
|
||||||
|
boot.initrd.kernelModules = [ ];
|
||||||
|
boot.kernelModules = [ "kvm-intel" ];
|
||||||
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
|
fileSystems."/" =
|
||||||
|
{ device = "/dev/disk/by-uuid/ed9654fe-575a-4fb3-b6ff-1b059479acff";
|
||||||
|
fsType = "ext4";
|
||||||
|
};
|
||||||
|
|
||||||
|
swapDevices = [ ];
|
||||||
|
|
||||||
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
|
networking.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp14s0f0.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp14s0f1.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp3s0f0.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp3s0f1.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp4s0f0.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp4s0f1.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
|
}
|
109
hosts/buskerud/services/openvpn-client.nix
Normal file
109
hosts/buskerud/services/openvpn-client.nix
Normal file
@@ -0,0 +1,109 @@
|
|||||||
|
{ lib, values, ... }:
|
||||||
|
{
|
||||||
|
services.openvpn.servers."ov-tunnel" = {
|
||||||
|
config = let
|
||||||
|
conf = {
|
||||||
|
# TODO: use aliases
|
||||||
|
client = true;
|
||||||
|
dev = "tap";
|
||||||
|
proto = "udp";
|
||||||
|
#remote = "129.241.210.253 1194";
|
||||||
|
remote = "129.241.210.191 1194";
|
||||||
|
|
||||||
|
resolv-retry = "infinite";
|
||||||
|
nobind = true;
|
||||||
|
|
||||||
|
ca = "/etc/openvpn/ca.pem";
|
||||||
|
cert = "/etc/openvpn/crt.pem";
|
||||||
|
key = "/etc/openvpn/key.pem";
|
||||||
|
remote-cert-tls = "server";
|
||||||
|
cipher = "none";
|
||||||
|
|
||||||
|
user = "nobody";
|
||||||
|
group = "nobody";
|
||||||
|
|
||||||
|
status = "/var/log/openvpn-status.log";
|
||||||
|
|
||||||
|
persist-key = true;
|
||||||
|
persist-tun = true;
|
||||||
|
|
||||||
|
verb = 5;
|
||||||
|
|
||||||
|
# script-security = 2;
|
||||||
|
# up = "systemctl restart rwhod";
|
||||||
|
};
|
||||||
|
in lib.pipe conf [
|
||||||
|
(lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
|
||||||
|
(builtins.mapAttrs (_: value:
|
||||||
|
if builtins.isList value then builtins.concatStringsSep " " (map toString value)
|
||||||
|
else if value == true then value
|
||||||
|
else if builtins.any (f: f value) [
|
||||||
|
builtins.isString
|
||||||
|
builtins.isInt
|
||||||
|
builtins.isFloat
|
||||||
|
lib.isPath
|
||||||
|
lib.isDerivation
|
||||||
|
] then toString value
|
||||||
|
else throw "Unknown value in buskerud openvpn config, deading now\n${value}"
|
||||||
|
))
|
||||||
|
(lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
|
||||||
|
(builtins.concatStringsSep "\n")
|
||||||
|
(x: x + "\n\n")
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.networks."enp14s0f1" = {
|
||||||
|
matchConfig.Name = "enp14s0f1";
|
||||||
|
networkConfig = {
|
||||||
|
DefaultRouteOnDevice = true;
|
||||||
|
};
|
||||||
|
routes = [
|
||||||
|
{ routeConfig = {
|
||||||
|
Type = "unicast";
|
||||||
|
Destination = values.hosts.knutsen.ipv4 + "/32";
|
||||||
|
Metric = 50;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.netdevs."br0" = {
|
||||||
|
netdevConfig = {
|
||||||
|
Kind = "bridge";
|
||||||
|
Name = "br0";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.networks."br0" = {
|
||||||
|
matchConfig.Name = "br0";
|
||||||
|
routes = [
|
||||||
|
{ routeConfig = {
|
||||||
|
Type = "unicast";
|
||||||
|
Destination = values.ipv4-space;
|
||||||
|
Metric = 100;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.networks."enp3s0f0" = {
|
||||||
|
matchConfig.Name = "enp3s0f0";
|
||||||
|
networkConfig.DefaultRouteOnDevice = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.networks."enp3s0f1" = {
|
||||||
|
matchConfig.Name = "enp3s0f1";
|
||||||
|
bridge = [ "br0" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.networks."tap0" = {
|
||||||
|
matchConfig.Name = "tap0";
|
||||||
|
bridge = [ "br0" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
#networking.nat = {
|
||||||
|
# enable = true;
|
||||||
|
# externalInterface = "enp14s0f1";
|
||||||
|
# internalInterfaces = [ "tun" ];
|
||||||
|
#};
|
||||||
|
}
|
@@ -6,6 +6,7 @@
|
|||||||
extraGroups = [
|
extraGroups = [
|
||||||
"wheel"
|
"wheel"
|
||||||
"drift"
|
"drift"
|
||||||
|
"nix-builder-users"
|
||||||
];
|
];
|
||||||
|
|
||||||
packages = with pkgs; [
|
packages = with pkgs; [
|
||||||
|
@@ -41,6 +41,9 @@ in rec {
|
|||||||
ipv4 = "129.241.152.254";
|
ipv4 = "129.241.152.254";
|
||||||
# ipv6 = ;
|
# ipv6 = ;
|
||||||
};
|
};
|
||||||
|
knutsen = {
|
||||||
|
ipv4 = pvv-ipv4 191;
|
||||||
|
};
|
||||||
shark = {
|
shark = {
|
||||||
ipv4 = pvv-ipv4 196;
|
ipv4 = pvv-ipv4 196;
|
||||||
ipv6 = pvv-ipv6 196;
|
ipv6 = pvv-ipv6 196;
|
||||||
@@ -53,6 +56,10 @@ in rec {
|
|||||||
ipv4 = pvv-ipv4 204;
|
ipv4 = pvv-ipv4 204;
|
||||||
ipv6 = pvv-ipv6 "1:4f"; # Wtf øystein og daniel why
|
ipv6 = pvv-ipv6 "1:4f"; # Wtf øystein og daniel why
|
||||||
};
|
};
|
||||||
|
buskerud = {
|
||||||
|
ipv4 = pvv-ipv4 231;
|
||||||
|
ipv6 = pvv-ipv6 231;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
defaultNetworkConfig = {
|
defaultNetworkConfig = {
|
||||||
|
Reference in New Issue
Block a user