forked from Drift/pvv-nixos-config
Compare commits
1 Commits
richara-ad
...
configure-
Author | SHA1 | Date | |
---|---|---|---|
68f4eca6e4 |
.gitea/workflows
README.MDflake.lockflake.nixhosts
bekkalokk
bicep
services
matrix
brzeczyszczykiewicz
georg
modules
pkgs
minecraft-server-fabric
minecraft-server
secrets
users
values.nix@@ -1,13 +0,0 @@
|
|||||||
name: "Eval nix flake"
|
|
||||||
on:
|
|
||||||
pull_request:
|
|
||||||
push:
|
|
||||||
jobs:
|
|
||||||
evals:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v3
|
|
||||||
- run: apt-get update && apt-get -y install sudo
|
|
||||||
- uses: https://github.com/cachix/install-nix-action@v23
|
|
||||||
- run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
|
|
||||||
- run: nix flake check
|
|
@@ -10,13 +10,7 @@ Etter å ha klonet prosjektet ned og gjort endringer kan du evaluere configene m
|
|||||||
|
|
||||||
før du bygger en maskin med:
|
før du bygger en maskin med:
|
||||||
|
|
||||||
`nix build .#<maskinnavn>`
|
`nix build .#nixosConfigurations.<maskinavn>.config.system.build.toplevel`
|
||||||
|
|
||||||
hvis du vil være ekstra sikker på at alt bygger så kan du kjøre:
|
|
||||||
|
|
||||||
`nix build .` for å bygge alle de viktige maskinene.
|
|
||||||
|
|
||||||
NB: Dette kan ta opp til 30 minutter avhengig av hva som ligger i caches
|
|
||||||
|
|
||||||
Husk å hvertfall stage nye filer om du har laget dem!
|
Husk å hvertfall stage nye filer om du har laget dem!
|
||||||
|
|
||||||
|
72
flake.lock
generated
72
flake.lock
generated
@@ -1,55 +1,15 @@
|
|||||||
{
|
{
|
||||||
"nodes": {
|
"nodes": {
|
||||||
"grzegorz": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"unstable"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1696346665,
|
|
||||||
"narHash": "sha256-J6Tf6a/zhFZ8SereluHLrvgPsIVm2CGHHA8wrbhZB3Y=",
|
|
||||||
"owner": "Programvareverkstedet",
|
|
||||||
"repo": "grzegorz",
|
|
||||||
"rev": "9b9c3ac7d408ac7c6d67544b201e6b169afacb03",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "Programvareverkstedet",
|
|
||||||
"repo": "grzegorz",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"grzegorz-clients": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1693864994,
|
|
||||||
"narHash": "sha256-oLDiWdCKDtEfeGzfAuDTq+n9VWp6JCo67PEESEZ3y8E=",
|
|
||||||
"owner": "Programvareverkstedet",
|
|
||||||
"repo": "grzegorz-clients",
|
|
||||||
"rev": "a38a0b0fb31ad0ad78a91458cb2c7f77f686468f",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "Programvareverkstedet",
|
|
||||||
"repo": "grzegorz-clients",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"matrix-next": {
|
"matrix-next": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs-lib": "nixpkgs-lib"
|
"nixpkgs-lib": "nixpkgs-lib"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1697420972,
|
"lastModified": 1694383459,
|
||||||
"narHash": "sha256-eFDasOzXAN8VswUntNBBwvKFyVKFvmwRNNVTDfGdB3M=",
|
"narHash": "sha256-Y7VuBz74Go1QlvSLGXsXzPgOeeV73bbsDou3uXX9oa8=",
|
||||||
"owner": "dali99",
|
"owner": "dali99",
|
||||||
"repo": "nixos-matrix-modules",
|
"repo": "nixos-matrix-modules",
|
||||||
"rev": "1e370b96223b94d52006249a60033caaea605c65",
|
"rev": "66ff528912d95e6a2ee0aea6404a6b7e0d7fd83c",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -60,11 +20,11 @@
|
|||||||
},
|
},
|
||||||
"nixpkgs": {
|
"nixpkgs": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1697706247,
|
"lastModified": 1694526311,
|
||||||
"narHash": "sha256-nWLggeUxn/l8JrcQr9f+RfnCXp8cn0BN568PjMJh9ko=",
|
"narHash": "sha256-Y9LCYQBNX7McW0o8x6wT9tx2qy9TVuF84fe62zrQzyA=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "4ee5b576ac2861a818950aea99f609d7a6fc02a3",
|
"rev": "36bee398beca22e2428074e0a2e068d87f801718",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -91,11 +51,11 @@
|
|||||||
},
|
},
|
||||||
"nixpkgs-stable": {
|
"nixpkgs-stable": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1697332183,
|
"lastModified": 1693675694,
|
||||||
"narHash": "sha256-ACYvYsgLETfEI2xM1jjp8ZLVNGGC0onoCGe+69VJGGE=",
|
"narHash": "sha256-2pIOyQwGyy2FtFAUIb8YeKVmOCcPOTVphbAvmshudLE=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "0e1cff585c1a85aeab059d3109f66134a8f76935",
|
"rev": "5601118d39ca9105f8e7b39d4c221d3388c0419d",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -127,8 +87,6 @@
|
|||||||
},
|
},
|
||||||
"root": {
|
"root": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"grzegorz": "grzegorz",
|
|
||||||
"grzegorz-clients": "grzegorz-clients",
|
|
||||||
"matrix-next": "matrix-next",
|
"matrix-next": "matrix-next",
|
||||||
"nixpkgs": "nixpkgs",
|
"nixpkgs": "nixpkgs",
|
||||||
"pvv-calendar-bot": "pvv-calendar-bot",
|
"pvv-calendar-bot": "pvv-calendar-bot",
|
||||||
@@ -144,11 +102,11 @@
|
|||||||
"nixpkgs-stable": "nixpkgs-stable"
|
"nixpkgs-stable": "nixpkgs-stable"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1697339241,
|
"lastModified": 1694495315,
|
||||||
"narHash": "sha256-ITsFtEtRbCBeEH9XrES1dxZBkE1fyNNUfIyQjQ2AYQs=",
|
"narHash": "sha256-sZEYXs9T1NVHZSSbMqBEtEm2PGa7dEDcx0ttQkArORc=",
|
||||||
"owner": "Mic92",
|
"owner": "Mic92",
|
||||||
"repo": "sops-nix",
|
"repo": "sops-nix",
|
||||||
"rev": "51186b8012068c417dac7c31fb12861726577898",
|
"rev": "ea208e55f8742fdcc0986b256bdfa8986f5e4415",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -159,11 +117,11 @@
|
|||||||
},
|
},
|
||||||
"unstable": {
|
"unstable": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1697713104,
|
"lastModified": 1694534540,
|
||||||
"narHash": "sha256-DN7YOyKMCpAVeZ44N42LrujtTkoerkS9+kTufQiuntY=",
|
"narHash": "sha256-Cc0Ku0qJZDDx/0kII+0xD94L25EKw4EQzOLm0R9iZO4=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "6be2c349a30fcb489a3153dd331e9df387ab6449",
|
"rev": "f22a472661d66c655eae5b0a01ada71e4e13e405",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
50
flake.nix
50
flake.nix
@@ -12,30 +12,16 @@
|
|||||||
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
matrix-next.url = "github:dali99/nixos-matrix-modules";
|
matrix-next.url = "github:dali99/nixos-matrix-modules";
|
||||||
|
|
||||||
grzegorz.url = "github:Programvareverkstedet/grzegorz";
|
|
||||||
grzegorz.inputs.nixpkgs.follows = "unstable";
|
|
||||||
grzegorz-clients.url = "github:Programvareverkstedet/grzegorz-clients";
|
|
||||||
grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = { self, nixpkgs, matrix-next, pvv-calendar-bot, unstable, sops-nix, ... }@inputs:
|
outputs = { self, nixpkgs, matrix-next, pvv-calendar-bot, unstable, sops-nix, ... }@inputs:
|
||||||
let
|
let
|
||||||
nixlib = nixpkgs.lib;
|
|
||||||
systems = [
|
systems = [
|
||||||
"x86_64-linux"
|
"x86_64-linux"
|
||||||
"aarch64-linux"
|
"aarch64-linux"
|
||||||
"aarch64-darwin"
|
"aarch64-darwin"
|
||||||
];
|
];
|
||||||
forAllSystems = f: nixlib.genAttrs systems (system: f system);
|
forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f system);
|
||||||
allMachines = nixlib.mapAttrsToList (name: _: name) self.nixosConfigurations;
|
|
||||||
importantMachines = [
|
|
||||||
"bekkalokk"
|
|
||||||
"bicep"
|
|
||||||
"brzeczyszczykiewicz"
|
|
||||||
"georg"
|
|
||||||
"ildkule"
|
|
||||||
];
|
|
||||||
in {
|
in {
|
||||||
nixosConfigurations = let
|
nixosConfigurations = let
|
||||||
nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
|
nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
|
||||||
@@ -72,7 +58,7 @@
|
|||||||
./hosts/bicep/configuration.nix
|
./hosts/bicep/configuration.nix
|
||||||
sops-nix.nixosModules.sops
|
sops-nix.nixosModules.sops
|
||||||
|
|
||||||
matrix-next.nixosModules.default
|
matrix-next.nixosModules.synapse
|
||||||
pvv-calendar-bot.nixosModules.default
|
pvv-calendar-bot.nixosModules.default
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
@@ -80,42 +66,10 @@
|
|||||||
ildkule = stableNixosConfig "ildkule" { };
|
ildkule = stableNixosConfig "ildkule" { };
|
||||||
#ildkule-unstable = unstableNixosConfig "ildkule" { };
|
#ildkule-unstable = unstableNixosConfig "ildkule" { };
|
||||||
shark = stableNixosConfig "shark" { };
|
shark = stableNixosConfig "shark" { };
|
||||||
|
|
||||||
brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
|
|
||||||
modules = [
|
|
||||||
./hosts/brzeczyszczykiewicz/configuration.nix
|
|
||||||
sops-nix.nixosModules.sops
|
|
||||||
|
|
||||||
inputs.grzegorz.nixosModules.grzegorz-kiosk
|
|
||||||
inputs.grzegorz-clients.nixosModules.grzegorz-webui
|
|
||||||
];
|
|
||||||
};
|
|
||||||
georg = stableNixosConfig "georg" {
|
|
||||||
modules = [
|
|
||||||
./hosts/georg/configuration.nix
|
|
||||||
sops-nix.nixosModules.sops
|
|
||||||
|
|
||||||
inputs.grzegorz.nixosModules.grzegorz-kiosk
|
|
||||||
inputs.grzegorz-clients.nixosModules.grzegorz-webui
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
devShells = forAllSystems (system: {
|
devShells = forAllSystems (system: {
|
||||||
default = nixpkgs.legacyPackages.${system}.callPackage ./shell.nix { };
|
default = nixpkgs.legacyPackages.${system}.callPackage ./shell.nix { };
|
||||||
});
|
});
|
||||||
|
|
||||||
packages = {
|
|
||||||
"x86_64-linux" = let
|
|
||||||
pkgs = nixpkgs.legacyPackages."x86_64-linux";
|
|
||||||
in rec {
|
|
||||||
default = important-machines;
|
|
||||||
important-machines = pkgs.linkFarm "important-machines"
|
|
||||||
(nixlib.getAttrs importantMachines self.packages.x86_64-linux);
|
|
||||||
all-machines = pkgs.linkFarm "all-machines"
|
|
||||||
(nixlib.getAttrs allMachines self.packages.x86_64-linux);
|
|
||||||
} // nixlib.genAttrs allMachines
|
|
||||||
(machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
@@ -5,7 +5,6 @@
|
|||||||
|
|
||||||
../../base.nix
|
../../base.nix
|
||||||
../../misc/metrics-exporters.nix
|
../../misc/metrics-exporters.nix
|
||||||
../../modules/wackattack-ctf-stockfish
|
|
||||||
|
|
||||||
#./services/keycloak.nix
|
#./services/keycloak.nix
|
||||||
|
|
||||||
@@ -13,8 +12,7 @@
|
|||||||
# ./services/website.nix
|
# ./services/website.nix
|
||||||
./services/nginx.nix
|
./services/nginx.nix
|
||||||
./services/gitea/default.nix
|
./services/gitea/default.nix
|
||||||
./services/webmail
|
./services/mediawiki.nix
|
||||||
# ./services/mediawiki.nix
|
|
||||||
];
|
];
|
||||||
|
|
||||||
sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
|
sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
|
||||||
|
@@ -84,9 +84,9 @@ in {
|
|||||||
};
|
};
|
||||||
|
|
||||||
systemd.timers.gitea-import-users = {
|
systemd.timers.gitea-import-users = {
|
||||||
|
enable = true;
|
||||||
requires = [ "gitea.service" ];
|
requires = [ "gitea.service" ];
|
||||||
after = [ "gitea.service" ];
|
after = [ "gitea.service" ];
|
||||||
wantedBy = [ "timers.target" ];
|
|
||||||
timerConfig = {
|
timerConfig = {
|
||||||
OnCalendar = "*-*-* 02:00:00";
|
OnCalendar = "*-*-* 02:00:00";
|
||||||
Persistent = true;
|
Persistent = true;
|
||||||
|
@@ -7,17 +7,16 @@
|
|||||||
# "mediawiki"
|
# "mediawiki"
|
||||||
group = config.users.users.${user}.group;
|
group = config.users.users.${user}.group;
|
||||||
in {
|
in {
|
||||||
sops.secrets = {
|
sops.secrets = let
|
||||||
"mediawiki/password" = {
|
secret = opts: {
|
||||||
restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
|
restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
|
||||||
owner = user;
|
owner = user;
|
||||||
group = group;
|
group = group;
|
||||||
};
|
} // opts;
|
||||||
"keys/postgres/mediawiki" = {
|
in {
|
||||||
restartUnits = [ "mediawiki-init.service" "phpfpm-mediawiki.service" ];
|
"mediawiki/password" = secret { };
|
||||||
owner = user;
|
"mediawiki/database" = secret { };
|
||||||
group = group;
|
"mediawiki/oidc/clientsecret" = secret { };
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
services.mediawiki = {
|
services.mediawiki = {
|
||||||
@@ -27,13 +26,12 @@ in {
|
|||||||
passwordSender = "drift@pvv.ntnu.no";
|
passwordSender = "drift@pvv.ntnu.no";
|
||||||
|
|
||||||
database = {
|
database = {
|
||||||
type = "postgres";
|
type = "mysql";
|
||||||
host = "postgres.pvv.ntnu.no";
|
host = "mysql.pvv.ntnu.no";
|
||||||
port = config.services.postgresql.port;
|
|
||||||
passwordFile = config.sops.secrets."keys/postgres/mediawiki".path;
|
|
||||||
createLocally = false;
|
createLocally = false;
|
||||||
# TODO: create a normal database and copy over old data when the service is production ready
|
user = "bekkalokk_mediawiki_test";
|
||||||
name = "mediawiki_test";
|
name = "bekkalokk_mediawiki_test";
|
||||||
|
passwordFile = config.sops.secrets."mediawiki/database".path;
|
||||||
};
|
};
|
||||||
|
|
||||||
# Host through nginx
|
# Host through nginx
|
||||||
@@ -42,70 +40,51 @@ in {
|
|||||||
listenUser = config.services.nginx.user;
|
listenUser = config.services.nginx.user;
|
||||||
listenGroup = config.services.nginx.group;
|
listenGroup = config.services.nginx.group;
|
||||||
in {
|
in {
|
||||||
inherit user group;
|
# Worker settings
|
||||||
"pm" = "dynamic";
|
"pm" = "dynamic";
|
||||||
"pm.max_children" = 32;
|
"pm.max_children" = 32;
|
||||||
"pm.max_requests" = 500;
|
"pm.max_requests" = 500;
|
||||||
"pm.start_servers" = 2;
|
"pm.start_servers" = 2;
|
||||||
"pm.min_spare_servers" = 2;
|
"pm.min_spare_servers" = 2;
|
||||||
"pm.max_spare_servers" = 4;
|
"pm.max_spare_servers" = 4;
|
||||||
|
|
||||||
|
# Socket settings
|
||||||
"listen.owner" = listenUser;
|
"listen.owner" = listenUser;
|
||||||
"listen.group" = listenGroup;
|
"listen.group" = listenGroup;
|
||||||
"php_admin_value[error_log]" = "stderr";
|
|
||||||
"php_admin_flag[log_errors]" = "on";
|
# Misc
|
||||||
"env[PATH]" = lib.makeBinPath [ pkgs.php ];
|
"env[PATH]" = lib.makeBinPath [ pkgs.php ];
|
||||||
"catch_workers_output" = true;
|
|
||||||
# to accept *.html file
|
# to accept *.html file
|
||||||
"security.limit_extensions" = "";
|
"security.limit_extensions" = "";
|
||||||
|
inherit user group;
|
||||||
|
|
||||||
|
# Debug logging
|
||||||
|
"catch_workers_output" = "yes";
|
||||||
|
"php_flag[display_errors]" = "on";
|
||||||
|
"php_admin_value[error_log]" = "stderr";
|
||||||
|
"php_admin_flag[log_errors]" = "on";
|
||||||
};
|
};
|
||||||
|
|
||||||
extensions = {
|
extensions = {
|
||||||
DeleteBatch = pkgs.fetchzip {
|
DeleteBatch = pkgs.fetchzip {
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/DeleteBatch-REL1_39-995ea6f.tar.gz";
|
url = "https://extdist.wmflabs.org/dist/extensions/DeleteBatch-REL1_40-6852fb7.tar.gz";
|
||||||
sha256 = "sha256-0F4GLCy2f5WcWIY2YgF1tVxgYbglR0VOsj/pMrW93b8=";
|
hash = "sha256-m6l8Cs6mFLu1qfovBFO2l8HhtYZXnpZkajWXNob2wbU=";
|
||||||
};
|
};
|
||||||
UserMerge = pkgs.fetchzip {
|
UserMerge = pkgs.fetchzip {
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/UserMerge-REL1_39-b10d50e.tar.gz";
|
url = "https://extdist.wmflabs.org/dist/extensions/UserMerge-REL1_40-56f6dcf.tar.gz";
|
||||||
sha256 = "sha256-bXhj1+OlOUJDbvEuc8iwqb1LLEu6cN6+C/7cAvnWPOQ=";
|
hash = "sha256-zO7ti7fZPlJp3TXSJbYrXPRyElwO57zoU+RH7LBwVGU=";
|
||||||
};
|
};
|
||||||
PluggableAuth = pkgs.fetchzip {
|
PluggableAuth = pkgs.fetchzip {
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_39-1210fc3.tar.gz";
|
url = "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_40-8104ed9.tar.gz";
|
||||||
sha256 = "sha256-F6bTMCzkK3kZwZGIsNE87WlZWqXXmTMhEjApO99YKR0=";
|
hash = "sha256-fFz9+pJ/Ucdg340I/JWe4S/W05oVSfns9EF84rxN8yI=";
|
||||||
};
|
};
|
||||||
SimpleSAMLphp = pkgs.fetchzip {
|
OpenIDConnect = pkgs.fetchzip {
|
||||||
url = "https://extdist.wmflabs.org/dist/extensions/SimpleSAMLphp-REL1_39-dcf0acb.tar.gz";
|
url = "https://extdist.wmflabs.org/dist/extensions/OpenIDConnect-REL1_40-3edc735.tar.gz";
|
||||||
sha256 = "sha256-tCvFmb2+q2rxms+lRo5pgoI3h6GjCwXAR8XisPg03TQ=";
|
hash = "sha256-Osp4m2Sp9uGNt3QEmRsw0LA3KQCQzqJosgy3AFs11hY=";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
extraConfig = let
|
extraConfig = ''
|
||||||
|
|
||||||
SimpleSAMLphpRepo = pkgs.stdenvNoCC.mkDerivation rec {
|
|
||||||
pname = "configuredSimpleSAML";
|
|
||||||
version = "2.0.4";
|
|
||||||
src = pkgs.fetchzip {
|
|
||||||
url = "https://github.com/simplesamlphp/simplesamlphp/releases/download/v${version}/simplesamlphp-${version}.tar.gz";
|
|
||||||
sha256 = "sha256-pfMV/VmqqxgtG7Nx4s8MW4tWSaxOkVPtCRJwxV6RDSE=";
|
|
||||||
};
|
|
||||||
|
|
||||||
buildPhase = ''
|
|
||||||
cat > config/authsources.php << EOF
|
|
||||||
<?php
|
|
||||||
$config = array(
|
|
||||||
'default-sp' => array(
|
|
||||||
'saml:SP',
|
|
||||||
'idp' => 'https://idp.pvv.ntnu.no/',
|
|
||||||
),
|
|
||||||
);
|
|
||||||
EOF
|
|
||||||
'';
|
|
||||||
|
|
||||||
installPhase = ''
|
|
||||||
cp -r . $out
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
in ''
|
|
||||||
$wgServer = "https://bekkalokk.pvv.ntnu.no";
|
$wgServer = "https://bekkalokk.pvv.ntnu.no";
|
||||||
$wgLocaltimezone = "Europe/Oslo";
|
$wgLocaltimezone = "Europe/Oslo";
|
||||||
|
|
||||||
@@ -115,61 +94,60 @@ in {
|
|||||||
$wgEmailAuthentication = false;
|
$wgEmailAuthentication = false;
|
||||||
$wgGroupPermissions['*']['createaccount'] = false;
|
$wgGroupPermissions['*']['createaccount'] = false;
|
||||||
$wgGroupPermissions['*']['autocreateaccount'] = true;
|
$wgGroupPermissions['*']['autocreateaccount'] = true;
|
||||||
$wgPluggableAuth_EnableAutoLogin = true;
|
$wgPluggableAuth_EnableAutoLogin = false;
|
||||||
|
|
||||||
|
# SSO config
|
||||||
|
$wgPluggableAuth_Config[] = [
|
||||||
|
'plugin' => 'OpenIDConnect',
|
||||||
|
'data' => [
|
||||||
|
'providerURL' => 'https://git.pvv.ntnu.no/login/oauth/authorize',
|
||||||
|
'clientID' => 'be86ec39-d89c-4973-a163-633339539db2',
|
||||||
|
'clientsecret' => file_get_contents('${config.sops.secrets."mediawiki/oidc/clientsecret".path}')
|
||||||
|
]
|
||||||
|
];
|
||||||
|
|
||||||
# Disable anonymous editing
|
# Disable anonymous editing
|
||||||
$wgGroupPermissions['*']['edit'] = false;
|
$wgGroupPermissions['*']['edit'] = false;
|
||||||
|
|
||||||
# Styling
|
# Styling
|
||||||
$wgLogo = "/PNG/PVV-logo.png";
|
$wgLogos = [
|
||||||
|
'svg' => "${../../../assets/logo_blue_regular.svg}",
|
||||||
|
];
|
||||||
$wgDefaultSkin = "monobook";
|
$wgDefaultSkin = "monobook";
|
||||||
|
|
||||||
|
# Enable debugging
|
||||||
|
error_reporting( -1 );
|
||||||
|
ini_set( 'display_errors', 1 );
|
||||||
|
|
||||||
# Misc
|
# Misc
|
||||||
$wgEmergencyContact = "${cfg.passwordSender}";
|
$wgEmergencyContact = "${cfg.passwordSender}";
|
||||||
$wgShowIPinHeader = false;
|
$wgShowIPinHeader = false;
|
||||||
$wgUseTeX = false;
|
$wgUseTeX = false;
|
||||||
$wgLocalInterwiki = $wgSitename;
|
$wgLocalInterwiki = $wgSitename;
|
||||||
|
|
||||||
# SimpleSAML
|
|
||||||
$wgSimpleSAMLphp_InstallDir = "${SimpleSAMLphpRepo}";
|
|
||||||
$wgSimpleSAMLphp_AuthSourceId = "default-sp";
|
|
||||||
$wgSimpleSAMLphp_RealNameAttribute = "cn";
|
|
||||||
$wgSimpleSAMLphp_EmailAttribute = "mail";
|
|
||||||
$wgSimpleSAMLphp_UsernameAttribute = "uid";
|
|
||||||
|
|
||||||
# Fix https://github.com/NixOS/nixpkgs/issues/183097
|
# Fix https://github.com/NixOS/nixpkgs/issues/183097
|
||||||
$wgDBserver = "${toString cfg.database.host}";
|
$wgDBserver = "${toString cfg.database.host}";
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
# Override because of https://github.com/NixOS/nixpkgs/issues/183097
|
# services.nginx.virtualHosts."wiki.pvv.ntnu.no" = {
|
||||||
systemd.services.mediawiki-init.script = let
|
services.nginx.virtualHosts."bekkalokk.pvv.ntnu.no" = {
|
||||||
# According to module
|
forceSSL = true;
|
||||||
stateDir = "/var/lib/mediawiki";
|
enableACME = true;
|
||||||
pkg = cfg.finalPackage;
|
root = "${cfg.finalPackage}/share/mediawiki";
|
||||||
mediawikiConfig = config.services.phpfpm.pools.mediawiki.phpEnv.MEDIAWIKI_CONFIG;
|
locations = {
|
||||||
inherit (lib) optionalString mkForce;
|
"/" = {
|
||||||
in mkForce ''
|
recommendedProxySettings = true;
|
||||||
if ! test -e "${stateDir}/secret.key"; then
|
extraConfig = ''
|
||||||
tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c 64 > ${stateDir}/secret.key
|
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||||
fi
|
fastcgi_index index.php;
|
||||||
|
fastcgi_pass unix:${config.services.phpfpm.pools.mediawiki.socket};
|
||||||
echo "exit( wfGetDB( DB_MASTER )->tableExists( 'user' ) ? 1 : 0 );" | \
|
include ${pkgs.nginx}/conf/fastcgi_params;
|
||||||
${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/eval.php --conf ${mediawikiConfig} && \
|
include ${pkgs.nginx}/conf/fastcgi.conf;
|
||||||
${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/install.php \
|
'';
|
||||||
--confpath /tmp \
|
};
|
||||||
--scriptpath / \
|
"/images".root = config.services.mediawiki.uploadsDir;
|
||||||
--dbserver "${cfg.database.host}" \
|
};
|
||||||
--dbport ${toString cfg.database.port} \
|
|
||||||
--dbname ${cfg.database.name} \
|
};
|
||||||
${optionalString (cfg.database.tablePrefix != null) "--dbprefix ${cfg.database.tablePrefix}"} \
|
|
||||||
--dbuser ${cfg.database.user} \
|
|
||||||
${optionalString (cfg.database.passwordFile != null) "--dbpassfile ${cfg.database.passwordFile}"} \
|
|
||||||
--passfile ${cfg.passwordFile} \
|
|
||||||
--dbtype ${cfg.database.type} \
|
|
||||||
${cfg.name} \
|
|
||||||
admin
|
|
||||||
|
|
||||||
${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/update.php --conf ${mediawikiConfig} --quick
|
|
||||||
'';
|
|
||||||
}
|
}
|
||||||
|
@@ -1,6 +0,0 @@
|
|||||||
{ config, values, pkgs, ... }:
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
./roundcube.nix
|
|
||||||
];
|
|
||||||
}
|
|
@@ -1,34 +0,0 @@
|
|||||||
{ config, pkgs, lib, ... }:
|
|
||||||
|
|
||||||
with lib;
|
|
||||||
let
|
|
||||||
cfg = config.services.roundcube;
|
|
||||||
domain = "roundcube.pvv.ntnu.no";
|
|
||||||
in
|
|
||||||
{
|
|
||||||
services.roundcube = {
|
|
||||||
enable = true;
|
|
||||||
package = pkgs.roundcube.withPlugins (plugins: [ plugins.persistent_login plugins.thunderbird_labels plugins.contextmenu plugins.custom_from]);
|
|
||||||
dicts = with pkgs.aspellDicts; [ en en-science en-computers nb nn fr de it];
|
|
||||||
maxAttachmentSize = 20;
|
|
||||||
# this is the url of the vhost, not necessarily the same as the fqdn of the mailserver
|
|
||||||
hostName = domain;
|
|
||||||
|
|
||||||
extraConfig = ''
|
|
||||||
# starttls needed for authentication, so the fqdn required to match
|
|
||||||
# the certificate
|
|
||||||
$config['enable_installer'] = false;
|
|
||||||
$config['default_host'] = "ssl://imap.pvv.ntnu.no";
|
|
||||||
$config['default_port'] = 993;
|
|
||||||
#$config['smtp_server'] = "tls://smtp.pvv.ntnu.no";
|
|
||||||
#$config['smtp_port'] = 25;
|
|
||||||
$config['smtp_server'] = "ssl://smtp.pvv.ntnu.no";
|
|
||||||
$config['smtp_port'] = 465;
|
|
||||||
# $config['smtp_user'] = "%u@pvv.ntnu.no";
|
|
||||||
$config['mail_domain'] = "pvv.ntnu.no";
|
|
||||||
$config['smtp_user'] = "%u";
|
|
||||||
# $config['smtp_pass'] = "%p";
|
|
||||||
$config['support_url'] = "";
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
}
|
|
@@ -1,17 +0,0 @@
|
|||||||
{ lib, buildPythonPackage, fetchFromGitHub }:
|
|
||||||
|
|
||||||
buildPythonPackage rec {
|
|
||||||
pname = "matrix-synapse-smtp-auth";
|
|
||||||
version = "0.1.0";
|
|
||||||
|
|
||||||
src = ./.;
|
|
||||||
|
|
||||||
doCheck = false;
|
|
||||||
|
|
||||||
meta = with lib; {
|
|
||||||
description = "An SMTP auth provider for Synapse";
|
|
||||||
homepage = "pvv.ntnu.no";
|
|
||||||
license = licenses.agpl3Only;
|
|
||||||
maintainers = with maintainers; [ dandellion ];
|
|
||||||
};
|
|
||||||
}
|
|
@@ -1,11 +0,0 @@
|
|||||||
from setuptools import setup
|
|
||||||
|
|
||||||
setup(
|
|
||||||
name="matrix-synapse-smtp-auth",
|
|
||||||
version="0.1.0",
|
|
||||||
py_modules=['smtp_auth_provider'],
|
|
||||||
author="Daniel Løvbrøtte Olsen",
|
|
||||||
author_email="danio@pvv.ntnu.no",
|
|
||||||
description="An SMTP auth provider for Synapse",
|
|
||||||
license="AGPL-3.0-only"
|
|
||||||
)
|
|
@@ -1,45 +0,0 @@
|
|||||||
from typing import Awaitable, Callable, Optional, Tuple
|
|
||||||
|
|
||||||
from smtplib import SMTP_SSL as SMTP
|
|
||||||
|
|
||||||
import synapse
|
|
||||||
from synapse import module_api
|
|
||||||
|
|
||||||
|
|
||||||
class SMTPAuthProvider:
|
|
||||||
def __init__(self, config: dict, api: module_api):
|
|
||||||
self.api = api
|
|
||||||
|
|
||||||
self.config = config
|
|
||||||
|
|
||||||
api.register_password_auth_provider_callbacks(
|
|
||||||
auth_checkers={
|
|
||||||
("m.login.password", ("password",)): self.check_pass,
|
|
||||||
},
|
|
||||||
)
|
|
||||||
|
|
||||||
async def check_pass(
|
|
||||||
self,
|
|
||||||
username: str,
|
|
||||||
login_type: str,
|
|
||||||
login_dict: "synapse.module_api.JsonDict",
|
|
||||||
):
|
|
||||||
if login_type != "m.login.password":
|
|
||||||
return None
|
|
||||||
|
|
||||||
result = False
|
|
||||||
with SMTP(self.config["smtp_host"]) as smtp:
|
|
||||||
password = login_dict.get("password")
|
|
||||||
try:
|
|
||||||
smtp.login(username, password)
|
|
||||||
result = True
|
|
||||||
except:
|
|
||||||
return None
|
|
||||||
|
|
||||||
if result == True:
|
|
||||||
userid = self.api.get_qualified_user_id(username)
|
|
||||||
if not self.api.check_user_exists(userid):
|
|
||||||
self.api.register_user(username)
|
|
||||||
return (userid, None)
|
|
||||||
else:
|
|
||||||
return None
|
|
@@ -22,18 +22,9 @@ in {
|
|||||||
group = config.users.users.matrix-synapse.group;
|
group = config.users.users.matrix-synapse.group;
|
||||||
};
|
};
|
||||||
|
|
||||||
sops.secrets."matrix/sliding-sync/env" = {
|
|
||||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
|
||||||
key = "sliding-sync/env";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.matrix-synapse-next = {
|
services.matrix-synapse-next = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
plugins = [
|
|
||||||
(pkgs.python3Packages.callPackage ./smtp-authenticator { })
|
|
||||||
];
|
|
||||||
|
|
||||||
dataDir = "/data/synapse";
|
dataDir = "/data/synapse";
|
||||||
|
|
||||||
workers.federationSenders = 2;
|
workers.federationSenders = 2;
|
||||||
@@ -43,8 +34,6 @@ in {
|
|||||||
workers.eventPersisters = 2;
|
workers.eventPersisters = 2;
|
||||||
workers.useUserDirectoryWorker = true;
|
workers.useUserDirectoryWorker = true;
|
||||||
|
|
||||||
enableSlidingSync = true;
|
|
||||||
|
|
||||||
enableNginx = true;
|
enableNginx = true;
|
||||||
|
|
||||||
settings = {
|
settings = {
|
||||||
@@ -92,15 +81,7 @@ in {
|
|||||||
enable_registration = false;
|
enable_registration = false;
|
||||||
registration_shared_secret_path = config.sops.secrets."matrix/synapse/user_registration".path;
|
registration_shared_secret_path = config.sops.secrets."matrix/synapse/user_registration".path;
|
||||||
|
|
||||||
password_config.enabled = true;
|
password_config.enabled = lib.mkForce false;
|
||||||
|
|
||||||
modules = [
|
|
||||||
{ module = "smtp_auth_provider.SMTPAuthProvider";
|
|
||||||
config = {
|
|
||||||
smtp_host = "smtp.pvv.ntnu.no";
|
|
||||||
};
|
|
||||||
}
|
|
||||||
];
|
|
||||||
|
|
||||||
trusted_key_servers = [
|
trusted_key_servers = [
|
||||||
{ server_name = "matrix.org"; }
|
{ server_name = "matrix.org"; }
|
||||||
@@ -211,9 +192,6 @@ in {
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
services.matrix-synapse.sliding-sync.environmentFile = config.sops.secrets."matrix/sliding-sync/env".path;
|
|
||||||
|
|
||||||
|
|
||||||
services.redis.servers."".enable = true;
|
services.redis.servers."".enable = true;
|
||||||
|
|
||||||
services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [({
|
services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [({
|
||||||
|
@@ -1,36 +0,0 @@
|
|||||||
{ config, pkgs, values, ... }:
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
# Include the results of the hardware scan.
|
|
||||||
./hardware-configuration.nix
|
|
||||||
../../base.nix
|
|
||||||
../../misc/metrics-exporters.nix
|
|
||||||
|
|
||||||
../../modules/grzegorz.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.loader.systemd-boot.enable = true;
|
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
|
||||||
|
|
||||||
networking.hostName = "brzeczyszczykiewicz";
|
|
||||||
|
|
||||||
systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
|
|
||||||
matchConfig.Name = "eno1";
|
|
||||||
address = with values.hosts.brzeczyszczykiewicz; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
|
||||||
};
|
|
||||||
|
|
||||||
# List packages installed in system profile
|
|
||||||
environment.systemPackages = with pkgs; [
|
|
||||||
];
|
|
||||||
|
|
||||||
# List services that you want to enable:
|
|
||||||
|
|
||||||
# This value determines the NixOS release from which the default
|
|
||||||
# settings for stateful data, like file locations and database versions
|
|
||||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
|
||||||
# this value at the release version of the first install of this system.
|
|
||||||
# Before changing this value read the documentation for this option
|
|
||||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|
||||||
system.stateVersion = "23.05"; # Did you read the comment?
|
|
||||||
|
|
||||||
}
|
|
@@ -1,39 +0,0 @@
|
|||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ "kvm-intel" ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" =
|
|
||||||
{ device = "/dev/disk/by-uuid/82E3-3D03";
|
|
||||||
fsType = "vfat";
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices =
|
|
||||||
[ { device = "/dev/disk/by-uuid/d0bf9a21-44bc-44a3-ae55-8f0971875883"; }
|
|
||||||
];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
|
||||||
}
|
|
@@ -1,36 +0,0 @@
|
|||||||
{ config, pkgs, values, ... }:
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
# Include the results of the hardware scan.
|
|
||||||
./hardware-configuration.nix
|
|
||||||
../../base.nix
|
|
||||||
../../misc/metrics-exporters.nix
|
|
||||||
|
|
||||||
../../modules/grzegorz.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.loader.systemd-boot.enable = true;
|
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
|
||||||
|
|
||||||
networking.hostName = "georg";
|
|
||||||
|
|
||||||
systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
|
|
||||||
matchConfig.Name = "eno1";
|
|
||||||
address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
|
||||||
};
|
|
||||||
|
|
||||||
# List packages installed in system profile
|
|
||||||
environment.systemPackages = with pkgs; [
|
|
||||||
];
|
|
||||||
|
|
||||||
# List services that you want to enable:
|
|
||||||
|
|
||||||
# This value determines the NixOS release from which the default
|
|
||||||
# settings for stateful data, like file locations and database versions
|
|
||||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
|
||||||
# this value at the release version of the first install of this system.
|
|
||||||
# Before changing this value read the documentation for this option
|
|
||||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|
||||||
system.stateVersion = "23.05"; # Did you read the comment?
|
|
||||||
|
|
||||||
}
|
|
@@ -1,40 +0,0 @@
|
|||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ "kvm-intel" ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" =
|
|
||||||
{ device = "/dev/disk/by-uuid/145E-7362";
|
|
||||||
fsType = "vfat";
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices =
|
|
||||||
[ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
|
|
||||||
];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.enp2s2.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
|
||||||
}
|
|
@@ -1,62 +0,0 @@
|
|||||||
{config, lib, pkgs, ...}:
|
|
||||||
let
|
|
||||||
grg = config.services.grzegorz;
|
|
||||||
grgw = config.services.grzegorz-webui;
|
|
||||||
in {
|
|
||||||
services.pipewire.enable = true;
|
|
||||||
services.pipewire.alsa.enable = true;
|
|
||||||
services.pipewire.alsa.support32Bit = true;
|
|
||||||
services.pipewire.pulse.enable = true;
|
|
||||||
|
|
||||||
users.users.pvv = {
|
|
||||||
isNormalUser = true;
|
|
||||||
description = "pvv";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.grzegorz.enable = true;
|
|
||||||
services.grzegorz.listenAddr = "localhost";
|
|
||||||
services.grzegorz.listenPort = 31337;
|
|
||||||
|
|
||||||
services.grzegorz-webui.enable = true;
|
|
||||||
services.grzegorz-webui.listenAddr = "localhost";
|
|
||||||
services.grzegorz-webui.listenPort = 42069;
|
|
||||||
services.grzegorz-webui.listenWebsocketPort = 42042;
|
|
||||||
services.grzegorz-webui.hostName = "${config.networking.fqdn}";
|
|
||||||
services.grzegorz-webui.apiBase = "http://${toString grg.listenAddr}:${toString grg.listenPort}/api";
|
|
||||||
|
|
||||||
security.acme.acceptTerms = true;
|
|
||||||
security.acme.defaults.email = "pederbs@pvv.ntnu.no";
|
|
||||||
|
|
||||||
services.nginx.enable = true;
|
|
||||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."${config.networking.fqdn}" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
serverAliases = [
|
|
||||||
"${config.networking.hostName}.pvv.org"
|
|
||||||
];
|
|
||||||
extraConfig = ''
|
|
||||||
allow 129.241.210.128/25;
|
|
||||||
allow 2001:700:300:1900::/64;
|
|
||||||
deny all;
|
|
||||||
'';
|
|
||||||
|
|
||||||
locations."/" = {
|
|
||||||
proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenPort}";
|
|
||||||
};
|
|
||||||
# https://github.com/rawpython/remi/issues/216
|
|
||||||
locations."/websocket" = {
|
|
||||||
proxyPass = "http://localhost:${builtins.toString config.services.grzegorz-webui.listenWebsocketPort}";
|
|
||||||
proxyWebsockets = true;
|
|
||||||
};
|
|
||||||
locations."/api" = {
|
|
||||||
proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
|
|
||||||
};
|
|
||||||
locations."/docs" = {
|
|
||||||
proxyPass = "http://localhost:${builtins.toString config.services.grzegorz.listenPort}";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
@@ -1,74 +0,0 @@
|
|||||||
#!/usr/bin/env python3
|
|
||||||
from stockfish import *
|
|
||||||
from inputimeout import inputimeout
|
|
||||||
import time
|
|
||||||
from datetime import datetime
|
|
||||||
import random
|
|
||||||
|
|
||||||
thinking_time = 1000
|
|
||||||
|
|
||||||
game = Stockfish(path="./stockfish", depth=15, parameters={"Threads": 1, "Minimum Thinking Time": thinking_time, "UCI_Chess960": True})
|
|
||||||
|
|
||||||
def create_random_position():
|
|
||||||
pos = "/pppppppp/8/8/8/8/PPPPPPPP/"
|
|
||||||
rank8 = ["r","r","b","q","k","b","n","n"]
|
|
||||||
|
|
||||||
while rank8.index("k") < [i for i, n in enumerate(rank8) if n == "r"][0] or rank8.index("k") > [i for i, n in enumerate(rank8) if n == "r"][1] or [i for i, n in enumerate(rank8) if n == "b"][0] % 2 == [i for i, n in enumerate(rank8) if n == "b"][1] % 2:
|
|
||||||
random.seed(datetime.now().microsecond)
|
|
||||||
random.shuffle(rank8)
|
|
||||||
|
|
||||||
rank1 = [c.upper() for c in rank8]
|
|
||||||
pos = "".join(rank8) + pos + "".join(rank1) + " w KQkq - 0 1"
|
|
||||||
game.set_fen_position(pos)
|
|
||||||
|
|
||||||
def player_won():
|
|
||||||
with open("flag.txt") as file:
|
|
||||||
flag = file.read()
|
|
||||||
print(flag)
|
|
||||||
exit()
|
|
||||||
|
|
||||||
def get_fast_player_move():
|
|
||||||
try:
|
|
||||||
time_over = inputimeout(prompt='Your move: ', timeout=5)
|
|
||||||
except Exception:
|
|
||||||
time_over = 'Too slow, you lost!'
|
|
||||||
print(time_over)
|
|
||||||
exit()
|
|
||||||
return time_over
|
|
||||||
|
|
||||||
def check_game_status():
|
|
||||||
evaluation = game.get_evaluation()
|
|
||||||
turn = game.get_fen_position().split(" ")[1]
|
|
||||||
if evaluation["type"] == "mate" and evaluation["value"] == 0 and turn == "w":
|
|
||||||
print("Wow, you beat me!")
|
|
||||||
player_won()
|
|
||||||
elif evaluation["type"] == "mate" and evaluation["value"] == 0 and turn == "b":
|
|
||||||
print("Hah, I won again")
|
|
||||||
exit()
|
|
||||||
if evaluation["type"] == "draw":
|
|
||||||
print("It's a draw!")
|
|
||||||
print("Impressive, but I am still undefeated.")
|
|
||||||
exit()
|
|
||||||
|
|
||||||
if __name__ == "__main__":
|
|
||||||
create_random_position()
|
|
||||||
print("Welcome to fischer chess.\nYou get 5 seconds per move. Good luck")
|
|
||||||
print(game.get_board_visual())
|
|
||||||
print("Heres the position for this game, Ill give you a few seconds to look at it before we start.")
|
|
||||||
time.sleep(3)
|
|
||||||
while True:
|
|
||||||
server_move = game.get_best_move_time(thinking_time)
|
|
||||||
game.make_moves_from_current_position([server_move])
|
|
||||||
check_game_status()
|
|
||||||
print(game.get_board_visual())
|
|
||||||
print(f"My move: {server_move}")
|
|
||||||
player_move = get_fast_player_move()
|
|
||||||
if type(player_move) != str or len([player_move]) != 1:
|
|
||||||
print("Illegal input")
|
|
||||||
exit()
|
|
||||||
try:
|
|
||||||
game.make_moves_from_current_position([player_move])
|
|
||||||
check_game_status()
|
|
||||||
except:
|
|
||||||
print("Couldn't comprehend that")
|
|
||||||
exit()
|
|
@@ -1,108 +0,0 @@
|
|||||||
{ config, pkgs, lib, ... }: let
|
|
||||||
stockfish = with pkgs.python3Packages; buildPythonPackage rec {
|
|
||||||
pname = "stockfish";
|
|
||||||
version = "3.28.0";
|
|
||||||
disabled = pythonOlder "3.7";
|
|
||||||
|
|
||||||
src = pkgs.fetchFromGitHub {
|
|
||||||
owner = "zhelyabuzhsky";
|
|
||||||
repo = pname;
|
|
||||||
rev = version;
|
|
||||||
hash = "sha256-XLgVjLV2QXeTYPjP/lwc0LH850LKJsymFlrAMkAn8HU=";
|
|
||||||
};
|
|
||||||
|
|
||||||
format = "setuptools";
|
|
||||||
nativeBuildInputs = [
|
|
||||||
setuptools
|
|
||||||
];
|
|
||||||
|
|
||||||
propagatedBuildInputs = [
|
|
||||||
pytest-runner
|
|
||||||
];
|
|
||||||
|
|
||||||
doCheck = false;
|
|
||||||
};
|
|
||||||
|
|
||||||
inputimeout = with pkgs.python3Packages; buildPythonPackage rec {
|
|
||||||
pname = "inputimeout";
|
|
||||||
version = "1.0.4";
|
|
||||||
src = pkgs.fetchFromGitHub {
|
|
||||||
owner = "johejo";
|
|
||||||
repo = pname;
|
|
||||||
rev = "v${version}";
|
|
||||||
hash = "sha256-Fh1CaqJOK58nURt4imkhCmZKG2eJlP/Hi10SarUJ+Fs=";
|
|
||||||
};
|
|
||||||
|
|
||||||
format = "setuptools";
|
|
||||||
nativeBuildInputs = [ setuptools ];
|
|
||||||
|
|
||||||
doCheck = false;
|
|
||||||
};
|
|
||||||
|
|
||||||
script = pkgs.writers.writePython3 "chess" {
|
|
||||||
libraries = [
|
|
||||||
stockfish
|
|
||||||
inputimeout
|
|
||||||
];
|
|
||||||
|
|
||||||
# Fy!
|
|
||||||
flakeIgnore = [ "F403" "F405" "E231" "E265" "E302" "E305" "E501" "E722" ];
|
|
||||||
} (builtins.replaceStrings [''path="./stockfish"''] [''path="${pkgs.stockfish}/bin/stockfish"''] (builtins.readFile ./chess.py));
|
|
||||||
in
|
|
||||||
{
|
|
||||||
sops.secrets."keys/wackattack_ctf/flag" = { };
|
|
||||||
|
|
||||||
systemd.sockets."wackattack-ctf-stockfish" = {
|
|
||||||
description = "Save some azure credit for the rest of us";
|
|
||||||
partOf = [ "wackattack-ctf-stockfish.service" ];
|
|
||||||
wantedBy = [ "sockets.target" ];
|
|
||||||
|
|
||||||
socketConfig = {
|
|
||||||
ListenStream = "0.0.0.0:9999";
|
|
||||||
Accept = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services."wackattack-ctf-stockfish@" = {
|
|
||||||
description = "Save some azure credit for the rest of us";
|
|
||||||
after = [ "network.target" ];
|
|
||||||
requires = [ "wackattack-ctf-stockfish.socket" ];
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
serviceConfig = {
|
|
||||||
Type = "simple";
|
|
||||||
DynamicUser = true;
|
|
||||||
WorkingDirectory = "%d";
|
|
||||||
Restart = "always";
|
|
||||||
StandardInput = "socket";
|
|
||||||
LoadCredential = "flag.txt:${config.sops.secrets."keys/wackattack_ctf/flag".path}";
|
|
||||||
|
|
||||||
Exec = script;
|
|
||||||
|
|
||||||
# systemd hardening go barr
|
|
||||||
ProcSubset = "pid";
|
|
||||||
ProtectProc = "invisible";
|
|
||||||
AmbientCapabilities = "";
|
|
||||||
CapabilityBoundingSet = "";
|
|
||||||
NoNewPrivileges = true;
|
|
||||||
ProtectSystem = "strict";
|
|
||||||
ProtectHome = true;
|
|
||||||
PrivateTmp = true;
|
|
||||||
PrivateDevices = true;
|
|
||||||
PrivateUsers = true;
|
|
||||||
ProtectHostname = true;
|
|
||||||
ProtectClock = true;
|
|
||||||
ProtectKernelTunables = true;
|
|
||||||
ProtectKernelModules = true;
|
|
||||||
ProtectKernelLogs = true;
|
|
||||||
ProtectControlGroups = true;
|
|
||||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
|
|
||||||
RestrictNamespaces = true;
|
|
||||||
LockPersonality = true;
|
|
||||||
RestrictRealtime = true;
|
|
||||||
RestrictSUIDSGID = true;
|
|
||||||
RemoveIPC = true;
|
|
||||||
PrivateMounts = true;
|
|
||||||
SystemCallArchitectures = "native";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
43
pkgs/minecraft-server-fabric/default.nix
Normal file
43
pkgs/minecraft-server-fabric/default.nix
Normal file
@@ -0,0 +1,43 @@
|
|||||||
|
{ callPackage, writeTextFile, writeShellScriptBin, minecraft-server, jre_headless }:
|
||||||
|
|
||||||
|
let
|
||||||
|
loader = callPackage ./generate-loader.nix {};
|
||||||
|
log4j = writeTextFile {
|
||||||
|
name = "log4j.xml";
|
||||||
|
text = ''
|
||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<Configuration status="WARN" packages="com.mojang.util">
|
||||||
|
<Appenders>
|
||||||
|
<Console name="SysOut" target="SYSTEM_OUT">
|
||||||
|
<PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg%n" />
|
||||||
|
</Console>
|
||||||
|
<Queue name="ServerGuiConsole">
|
||||||
|
<PatternLayout pattern="[%d{HH:mm:ss} %level]: %msg%n" />
|
||||||
|
</Queue>
|
||||||
|
<RollingRandomAccessFile name="File" fileName="logs/latest.log" filePattern="logs/%d{yyyy-MM-dd}-%i.log.gz">
|
||||||
|
<PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg%n" />
|
||||||
|
<Policies>
|
||||||
|
<TimeBasedTriggeringPolicy />
|
||||||
|
<OnStartupTriggeringPolicy />
|
||||||
|
</Policies>
|
||||||
|
<DefaultRolloverStrategy max="1000"/>
|
||||||
|
</RollingRandomAccessFile>
|
||||||
|
</Appenders>
|
||||||
|
<Loggers>
|
||||||
|
<Root level="info">
|
||||||
|
<filters>
|
||||||
|
<MarkerFilter marker="NETWORK_PACKETS" onMatch="DENY" onMismatch="NEUTRAL" />
|
||||||
|
</filters>
|
||||||
|
<AppenderRef ref="SysOut"/>
|
||||||
|
<AppenderRef ref="File"/>
|
||||||
|
<AppenderRef ref="ServerGuiConsole"/>
|
||||||
|
</Root>
|
||||||
|
</Loggers>
|
||||||
|
</Configuration>
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
in
|
||||||
|
writeShellScriptBin "minecraft-server" ''
|
||||||
|
echo "serverJar=${minecraft-server}/lib/minecraft/server.jar" >> fabric-server-launcher.properties
|
||||||
|
exec ${jre_headless}/bin/java -Dlog4j.configurationFile=${log4j} $@ -jar ${loader} nogui
|
||||||
|
''
|
38
pkgs/minecraft-server-fabric/generate-loader.nix
Normal file
38
pkgs/minecraft-server-fabric/generate-loader.nix
Normal file
@@ -0,0 +1,38 @@
|
|||||||
|
{ lib, fetchurl, stdenv, unzip, zip, jre_headless }:
|
||||||
|
|
||||||
|
let
|
||||||
|
lock = import ./lock.nix;
|
||||||
|
libraries = lib.forEach lock.libraries fetchurl;
|
||||||
|
in
|
||||||
|
stdenv.mkDerivation {
|
||||||
|
name = "fabric-server-launch.jar";
|
||||||
|
nativeBuildInputs = [ unzip zip jre_headless ];
|
||||||
|
|
||||||
|
libraries = libraries;
|
||||||
|
|
||||||
|
buildPhase = ''
|
||||||
|
for i in $libraries; do
|
||||||
|
unzip -o $i
|
||||||
|
done
|
||||||
|
|
||||||
|
cat > META-INF/MANIFEST.MF << EOF
|
||||||
|
Manifest-Version: 1.0
|
||||||
|
Main-Class: net.fabricmc.loader.impl.launch.server.FabricServerLauncher
|
||||||
|
Name: org/objectweb/asm/
|
||||||
|
Implementation-Version: 9.2
|
||||||
|
EOF
|
||||||
|
|
||||||
|
cat > fabric-server-launch.properties << EOF
|
||||||
|
launch.mainClass=net.fabricmc.loader.impl.launch.knot.KnotServer
|
||||||
|
EOF
|
||||||
|
'';
|
||||||
|
|
||||||
|
installPhase = ''
|
||||||
|
jar cmvf META-INF/MANIFEST.MF "server.jar" .
|
||||||
|
zip -d server.jar 'META-INF/*.SF' 'META-INF/*.RSA' 'META-INF/*.DSA'
|
||||||
|
cp server.jar "$out"
|
||||||
|
'';
|
||||||
|
|
||||||
|
phases = [ "buildPhase" "installPhase" ];
|
||||||
|
}
|
||||||
|
|
22
pkgs/minecraft-server-fabric/generate-lock-nix.sh
Executable file
22
pkgs/minecraft-server-fabric/generate-lock-nix.sh
Executable file
@@ -0,0 +1,22 @@
|
|||||||
|
#!/usr/bin/env nix-shell
|
||||||
|
#!nix-shell -i bash -p bash curl jq
|
||||||
|
curl https://meta.fabricmc.net/v2/versions/loader/1.18.1/0.12.12/server/json \
|
||||||
|
| jq -r '
|
||||||
|
.mainClass,
|
||||||
|
(.libraries[]
|
||||||
|
| .url as $url
|
||||||
|
| .name | split(":") as [$dir, $name, $version]
|
||||||
|
|"\($name)-\($version).zip|\($url)\($dir|sub("\\.";"/";"g"))/\($name)/\($version)/\($name)-\($version).jar"
|
||||||
|
)' \
|
||||||
|
| {
|
||||||
|
echo '{'
|
||||||
|
read mainClass;
|
||||||
|
echo " mainClass = \"$mainClass\";"
|
||||||
|
echo " libraries = ["
|
||||||
|
while IFS="|" read name url; do
|
||||||
|
hash=$(nix-prefetch-url $url);
|
||||||
|
echo " { name = \"$name\"; sha256 = \"$hash\"; url = \"$url\"; }"
|
||||||
|
done
|
||||||
|
echo " ];"
|
||||||
|
echo '}'
|
||||||
|
}
|
16
pkgs/minecraft-server-fabric/lock.nix
Normal file
16
pkgs/minecraft-server-fabric/lock.nix
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
{
|
||||||
|
mainClass = "net.fabricmc.loader.impl.launch.knot.KnotServer";
|
||||||
|
libraries = [
|
||||||
|
{ name = "tiny-mappings-parser-0.3.0+build.17.zip"; sha256 = "19kvhxfk5v01f2rvl7j02vqhn3nd2bh5jsgbk44rpzqv9f6074db"; url = "https://maven.fabricmc.net/net/fabricmc/tiny-mappings-parser/0.3.0+build.17/tiny-mappings-parser-0.3.0+build.17.jar"; }
|
||||||
|
{ name = "sponge-mixin-0.10.7+mixin.0.8.4.zip"; sha256 = "18m5wksd9vjp676cxapkggnz8s3f8j89phln8gy5n8vxlrli8n0d"; url = "https://maven.fabricmc.net/net/fabricmc/sponge-mixin/0.10.7+mixin.0.8.4/sponge-mixin-0.10.7+mixin.0.8.4.jar"; }
|
||||||
|
{ name = "tiny-remapper-0.6.0.zip"; sha256 = "1ynjfxg7cj9rd9c4l450w7yp20p2csjdpnk3mcx5bdkjzhbgvgzf"; url = "https://maven.fabricmc.net/net/fabricmc/tiny-remapper/0.6.0/tiny-remapper-0.6.0.jar"; }
|
||||||
|
{ name = "access-widener-2.0.1.zip"; sha256 = "0a7s4x6dbaa9p59ps7pidzwrs0xwy5i17s35xrgh58i26szlsaxm"; url = "https://maven.fabricmc.net/net/fabricmc/access-widener/2.0.1/access-widener-2.0.1.jar"; }
|
||||||
|
{ name = "asm-9.2.zip"; sha256 = "1xa7kccwmcqcdw1xly6n2frzhk56m8ma9v7h764g73ckf56zxm5r"; url = "https://maven.fabricmc.net/org/ow2/asm/asm/9.2/asm-9.2.jar"; }
|
||||||
|
{ name = "asm-analysis-9.2.zip"; sha256 = "1i1kyirizs5sm2v0f06sdz86mbmyn61vjr9d9p8p5h1i2x9bx3w7"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-analysis/9.2/asm-analysis-9.2.jar"; }
|
||||||
|
{ name = "asm-commons-9.2.zip"; sha256 = "19p04mr14ahndba65v4krbvf4p5syf8wz0fp5i9bnf5270qyak5y"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-commons/9.2/asm-commons-9.2.jar"; }
|
||||||
|
{ name = "asm-tree-9.2.zip"; sha256 = "04g0zb7v65iz4k2m2grdpbv8jjryrzkkw7ww23yfp94i6399pgxa"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-tree/9.2/asm-tree-9.2.jar"; }
|
||||||
|
{ name = "asm-util-9.2.zip"; sha256 = "16759v4hh3ijpf4cglrxybz29x2hiylhsa388y09m2mf679kqnzz"; url = "https://maven.fabricmc.net/org/ow2/asm/asm-util/9.2/asm-util-9.2.jar"; }
|
||||||
|
{ name = "intermediary-1.18.1.zip"; sha256 = "1rfz2gazvnivn6hlqiyjpiaycz8va87n5czy1p6w3lnrlfggj2i9"; url = "https://maven.fabricmc.net/net/fabricmc/intermediary/1.18.1/intermediary-1.18.1.jar"; }
|
||||||
|
{ name = "fabric-loader-0.12.12.zip"; sha256 = "070dpcp7kcj4xr75wp1j6pb1bgfzllwg8xmqk3sk79jfqiqwzizw"; url = "https://maven.fabricmc.net/net/fabricmc/fabric-loader/0.12.12/fabric-loader-0.12.12.jar"; }
|
||||||
|
];
|
||||||
|
}
|
38
pkgs/minecraft-server/1_18_1.nix
Normal file
38
pkgs/minecraft-server/1_18_1.nix
Normal file
@@ -0,0 +1,38 @@
|
|||||||
|
{ lib, stdenv, fetchurl, nixosTests, jre_headless }:
|
||||||
|
stdenv.mkDerivation {
|
||||||
|
pname = "minecraft-server";
|
||||||
|
version = "1.18.1";
|
||||||
|
|
||||||
|
src = fetchurl {
|
||||||
|
url = "https://launcher.mojang.com/v1/objects/125e5adf40c659fd3bce3e66e67a16bb49ecc1b9/server.jar";
|
||||||
|
# sha1 because that comes from mojang via api
|
||||||
|
sha1 = "125e5adf40c659fd3bce3e66e67a16bb49ecc1b9";
|
||||||
|
};
|
||||||
|
|
||||||
|
preferLocalBuild = true;
|
||||||
|
|
||||||
|
installPhase = ''
|
||||||
|
mkdir -p $out/bin $out/lib/minecraft
|
||||||
|
cp -v $src $out/lib/minecraft/server.jar
|
||||||
|
cat > $out/bin/minecraft-server << EOF
|
||||||
|
#!/bin/sh
|
||||||
|
exec ${jre_headless}/bin/java \$@ -jar $out/lib/minecraft/server.jar nogui
|
||||||
|
EOF
|
||||||
|
chmod +x $out/bin/minecraft-server
|
||||||
|
'';
|
||||||
|
|
||||||
|
dontUnpack = true;
|
||||||
|
|
||||||
|
passthru = {
|
||||||
|
tests = { inherit (nixosTests) minecraft-server; };
|
||||||
|
updateScript = ./update.sh;
|
||||||
|
};
|
||||||
|
|
||||||
|
meta = with lib; {
|
||||||
|
description = "Minecraft Server";
|
||||||
|
homepage = "https://minecraft.net";
|
||||||
|
license = licenses.unfreeRedistributable;
|
||||||
|
platforms = platforms.unix;
|
||||||
|
maintainers = with maintainers; [ thoughtpolice tomberek costrouc ];
|
||||||
|
};
|
||||||
|
}
|
@@ -11,11 +11,10 @@ gitea:
|
|||||||
mediawiki:
|
mediawiki:
|
||||||
password: ENC[AES256_GCM,data:HsBuA1E7187roGnKuFPfPDYxA16GFjAUucgUtrdUFmcOzmTNiFH+NWY2ZQ==,iv:vDYUmmZftcrkDtJxNYKAJSx9j+AQcmQarC62QRHR4IM=,tag:3TKjNrGRivFWoK3djC748g==,type:str]
|
password: ENC[AES256_GCM,data:HsBuA1E7187roGnKuFPfPDYxA16GFjAUucgUtrdUFmcOzmTNiFH+NWY2ZQ==,iv:vDYUmmZftcrkDtJxNYKAJSx9j+AQcmQarC62QRHR4IM=,tag:3TKjNrGRivFWoK3djC748g==,type:str]
|
||||||
database: ENC[AES256_GCM,data:EvVK3Mo6cZiIZS+gTxixU4r9SXN41VqwaWOtortZRNH+WPJ4xcYvzYMJNg==,iv:JtFTRLn3fzKIfgAPRqRgQjct7EdkEHtiyQKPy8/sZ2Q=,tag:nqzseG6BC0X5UNI/3kZZ3A==,type:str]
|
database: ENC[AES256_GCM,data:EvVK3Mo6cZiIZS+gTxixU4r9SXN41VqwaWOtortZRNH+WPJ4xcYvzYMJNg==,iv:JtFTRLn3fzKIfgAPRqRgQjct7EdkEHtiyQKPy8/sZ2Q=,tag:nqzseG6BC0X5UNI/3kZZ3A==,type:str]
|
||||||
|
oidc:
|
||||||
|
clientsecret: ENC[AES256_GCM,data:bh016Qlijs5hoNY1iYsx6uEa5oEG9aX4T9BMiqnDRhSh7iVXpj9A6glcr8OGmWN7Om7yXE4AdlY=,iv:BnZjxbK6oB1eALx3RidpkwzU8xz1x0luwZC7ioqTjQE=,tag:HX8uUevimnAcqBH8NaMQXA==,type:str]
|
||||||
keycloak:
|
keycloak:
|
||||||
database: ENC[AES256_GCM,data:76+AZnNR5EiturTP7BdOCKE90bFFkfGlRtviSP5NHxPbb3RfFPJEMlwtzA==,iv:nS7VTossHdlrHjPeethhX+Ysp9ukrb5JD7kjG28OFpY=,tag:OMpiEv9nQA7v6lWJfNxEEw==,type:str]
|
database: ENC[AES256_GCM,data:76+AZnNR5EiturTP7BdOCKE90bFFkfGlRtviSP5NHxPbb3RfFPJEMlwtzA==,iv:nS7VTossHdlrHjPeethhX+Ysp9ukrb5JD7kjG28OFpY=,tag:OMpiEv9nQA7v6lWJfNxEEw==,type:str]
|
||||||
keys:
|
|
||||||
wackattack_ctf:
|
|
||||||
flag: ENC[AES256_GCM,data:cZCaGb/u/OZgAvXnuJPL3XqmnIa26Rl2IUpWpG/fpt/dJ7+/KssXVa6A5G6ObQhF7deCmTxuoVP8JU+DQzYRr0ftvKhLJ87rgzrE3j+UkA==,iv:3uFkNqXlVj94klU20yPIUd8tIeyUIfp0++2wkdIkiYM=,tag:OZMyEt118u10F5vSUFZE7A==,type:str]
|
|
||||||
sops:
|
sops:
|
||||||
kms: []
|
kms: []
|
||||||
gcp_kms: []
|
gcp_kms: []
|
||||||
@@ -49,8 +48,8 @@ sops:
|
|||||||
akVjeTNTeGorZjJQOVlMeCtPRUVYL3MK+VMvGxrbzGz4Q3sdaDDWjal+OiK+JYKX
|
akVjeTNTeGorZjJQOVlMeCtPRUVYL3MK+VMvGxrbzGz4Q3sdaDDWjal+OiK+JYKX
|
||||||
GHiMXVHQJZu/RrlxMjHKN6V3iaqxZpuvLAEJ2Lzy5EOHPtuiiRyeHQ==
|
GHiMXVHQJZu/RrlxMjHKN6V3iaqxZpuvLAEJ2Lzy5EOHPtuiiRyeHQ==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
lastmodified: "2023-10-26T19:59:04Z"
|
lastmodified: "2023-09-17T21:12:05Z"
|
||||||
mac: ENC[AES256_GCM,data:uH0RfKBjjbYvxjl4XyoXWvwUpi+W7IQZjBdC5UoslotToTw0xnici2fKxPNZ9aFJsukLMPLC+tsT/shUqW373f/NyhsJt0Vb2YtuozFQyQstZQEpnm4WuVoFR/MEjAra/PaM4ATHSGgDuHa7qrpdKTLnrMOai5ZqxLfFbLws3dA=,iv:47hHzrnfZG5NtCN0HjziZdDBJTr451/kvY95GpB3G2M=,tag:3TCs7DSeWB6NujDUlQVGjA==,type:str]
|
mac: ENC[AES256_GCM,data:wfq3FTwwJh2eHbw5PW32IEp4jWeSQLaBLJzrbgfXUPP8VuPK3Q7puQtchsQ3Xrv2+c9FI536luhwaUPfgn+/JE8rn8KEhabMPrX2lYMVH8I4OkCYEivpbWNfmm3gfNU2SrEFZ2jBBLLCWDgBAA7SfyApiQiyZ3qpJ2aZCfgaUoM=,iv:5/R2tnjiQ6BPgU+eAChm2EsWuGurqumnzl4pfjZclLw=,tag:xdECs8muNv9c/68IRbWzCw==,type:str]
|
||||||
pgp:
|
pgp:
|
||||||
- created_at: "2023-05-21T00:28:40Z"
|
- created_at: "2023-05-21T00:28:40Z"
|
||||||
enc: |
|
enc: |
|
||||||
@@ -73,4 +72,4 @@ sops:
|
|||||||
-----END PGP MESSAGE-----
|
-----END PGP MESSAGE-----
|
||||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||||
unencrypted_suffix: _unencrypted
|
unencrypted_suffix: _unencrypted
|
||||||
version: 3.8.1
|
version: 3.7.3
|
||||||
|
@@ -2,8 +2,6 @@ synapse:
|
|||||||
turnconfig: ENC[AES256_GCM,data:mASRjYa4C9WRow4x0XYRrlCE5LMJUYaId+o62r1qhsyJPa2LzrI=,iv:5vYdubvMDjLS6soiWx2DzkEAATb9NFbSS/Jhuuz1yI8=,tag:wOW07CQMDbOiZNervee/pg==,type:str]
|
turnconfig: ENC[AES256_GCM,data:mASRjYa4C9WRow4x0XYRrlCE5LMJUYaId+o62r1qhsyJPa2LzrI=,iv:5vYdubvMDjLS6soiWx2DzkEAATb9NFbSS/Jhuuz1yI8=,tag:wOW07CQMDbOiZNervee/pg==,type:str]
|
||||||
user_registration: ENC[AES256_GCM,data:ZDZfEEvyw8pg0WzhrdC8747ed+ZR2ZA8/WypJd/iDkmIy2RmxOeI0sE=,iv:l61mOlvzpCql4fC/eubBSU6px21et2WcpxQ6rFl14iw=,tag:sVDEAa3xipKIi/6isCjWew==,type:str]
|
user_registration: ENC[AES256_GCM,data:ZDZfEEvyw8pg0WzhrdC8747ed+ZR2ZA8/WypJd/iDkmIy2RmxOeI0sE=,iv:l61mOlvzpCql4fC/eubBSU6px21et2WcpxQ6rFl14iw=,tag:sVDEAa3xipKIi/6isCjWew==,type:str]
|
||||||
signing_key: ENC[AES256_GCM,data:6UpfiRlX9pRM7zhdm7Mc8y8EItLzugWkHSgE0tGpEmudCTa1wc60oNbYfhKDWU81DT/U148pZOoX1A==,iv:UlqCPicPm5eNBz1xBMI3A3Rn4t/GtldNIDdMH5MMnLw=,tag:HHaw6iMjEAv5b9mjHSVpwA==,type:str]
|
signing_key: ENC[AES256_GCM,data:6UpfiRlX9pRM7zhdm7Mc8y8EItLzugWkHSgE0tGpEmudCTa1wc60oNbYfhKDWU81DT/U148pZOoX1A==,iv:UlqCPicPm5eNBz1xBMI3A3Rn4t/GtldNIDdMH5MMnLw=,tag:HHaw6iMjEAv5b9mjHSVpwA==,type:str]
|
||||||
sliding-sync:
|
|
||||||
env: ENC[AES256_GCM,data:DsU1qKTy5sn06Y0S5kFUqZHML20n6HdHUdXsQRUw,iv:/TNTc+StAZbf6pBY9CeXdxkx8E+3bak/wOqHyBNMprU=,tag:er5u4FRlSmUZrOT/sj+RhQ==,type:str]
|
|
||||||
coturn:
|
coturn:
|
||||||
static-auth-secret: ENC[AES256_GCM,data:y5cG/LyrorkDH+8YrgcV7DY=,iv:ca90q2J3+NOy51mUBy4TMKfYMgWL4hxWDdsKIuxRBgU=,tag:hpFCns1lpi07paHyGB7tGQ==,type:str]
|
static-auth-secret: ENC[AES256_GCM,data:y5cG/LyrorkDH+8YrgcV7DY=,iv:ca90q2J3+NOy51mUBy4TMKfYMgWL4hxWDdsKIuxRBgU=,tag:hpFCns1lpi07paHyGB7tGQ==,type:str]
|
||||||
mjolnir:
|
mjolnir:
|
||||||
@@ -43,8 +41,8 @@ sops:
|
|||||||
cGxZVnFhdXRka2drTGdkVk1iM0pFL1kK2ry7b2cLYPfntWi/BV3K2O+mHt3242Ef
|
cGxZVnFhdXRka2drTGdkVk1iM0pFL1kK2ry7b2cLYPfntWi/BV3K2O+mHt3242Ef
|
||||||
sI2JLLQYHeAhxjFdCzP1RDR+Wu/pRxZje6xuTZ9I9TKNmm+LhAXHQw==
|
sI2JLLQYHeAhxjFdCzP1RDR+Wu/pRxZje6xuTZ9I9TKNmm+LhAXHQw==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
lastmodified: "2023-10-22T00:31:46Z"
|
lastmodified: "2023-09-15T04:40:21Z"
|
||||||
mac: ENC[AES256_GCM,data:UpnaUfRxvdyzBy5x4EC3w5LQ1qWxILTQhpyVPd9whTzQMAivAHT0pVmP9aE4T9w3NcWTaghp+f70GmQXx/OCC6DsRCWtU9pFHRj12YUowM3yB5lVTOomOLZQ9m4gUXw5I2GZHWBJn8CyosDcBMlXz2tiR91v/8Ulh6sDSAO86U0=,iv:5GcgRvbpqDEslZruKHM/TcMaF52A5X7AK41DEbrsRIQ=,tag:ndDgCRyX1aDRnzEUNmpoMw==,type:str]
|
mac: ENC[AES256_GCM,data:ZJVHLbpSu/nIzl5FJfRdg2ymRN5M+zJXNUpi1hBt2MBmvK+1ed2ElhMe5x7pyasSDdaUtXDo7ghkUF7vE46Wo6Z9dvlAvhwWm7Y2AWfUe5SFVwzqlOCjSKRPFrQrL7PcDBtMj4twtwhc4XsfJoUSuigWW2m21BKtEZSuuxLRqLA=,iv:ufFbfMaNHydbkwq6lxN1dQJldkAbtqais/CZFkoDhb4=,tag:uMj0LaiU0obIlw/+HJJdKg==,type:str]
|
||||||
pgp:
|
pgp:
|
||||||
- created_at: "2023-05-06T21:31:39Z"
|
- created_at: "2023-05-06T21:31:39Z"
|
||||||
enc: |
|
enc: |
|
||||||
|
@@ -1,20 +0,0 @@
|
|||||||
{ pkgs, ... }:
|
|
||||||
{
|
|
||||||
users.users.adriangl = {
|
|
||||||
isNormalUser = true;
|
|
||||||
description = "(0_0)";
|
|
||||||
extraGroups = [
|
|
||||||
"wheel"
|
|
||||||
"drift"
|
|
||||||
];
|
|
||||||
|
|
||||||
packages = with pkgs; [
|
|
||||||
exa
|
|
||||||
neovim
|
|
||||||
];
|
|
||||||
|
|
||||||
openssh.authorizedKeys.keys = [
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFa5y7KyLn2tjxed1czMbyM5scnEpo9v/GfnhL/28ckM legolas"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
@@ -1,19 +0,0 @@
|
|||||||
{ pkgs, ... }:
|
|
||||||
{
|
|
||||||
users.users.richarah = {
|
|
||||||
isNormalUser = true;
|
|
||||||
description = "";
|
|
||||||
extraGroups = [
|
|
||||||
"wheel"
|
|
||||||
"drift"
|
|
||||||
];
|
|
||||||
|
|
||||||
packages = with pkgs; [
|
|
||||||
docker
|
|
||||||
];
|
|
||||||
|
|
||||||
openssh.authorizedKeys.keys = [
|
|
||||||
""
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
10
values.nix
10
values.nix
@@ -4,7 +4,7 @@ let
|
|||||||
pvv-ipv6 = suffix: "2001:700:300:1900::${toString suffix}";
|
pvv-ipv6 = suffix: "2001:700:300:1900::${toString suffix}";
|
||||||
in rec {
|
in rec {
|
||||||
ipv4-space = pvv-ipv4 "128/25";
|
ipv4-space = pvv-ipv4 "128/25";
|
||||||
ipv6-space = pvv-ipv6 "/64";
|
ipv6-space = pvv-ipv4 "/64";
|
||||||
|
|
||||||
services = {
|
services = {
|
||||||
matrix = {
|
matrix = {
|
||||||
@@ -41,14 +41,6 @@ in rec {
|
|||||||
ipv4 = pvv-ipv4 196;
|
ipv4 = pvv-ipv4 196;
|
||||||
ipv6 = pvv-ipv6 196;
|
ipv6 = pvv-ipv6 196;
|
||||||
};
|
};
|
||||||
brzeczyszczykiewicz = {
|
|
||||||
ipv4 = pvv-ipv4 205;
|
|
||||||
ipv6 = pvv-ipv6 "1:50"; # Wtf peder why
|
|
||||||
};
|
|
||||||
georg = {
|
|
||||||
ipv4 = pvv-ipv4 204;
|
|
||||||
ipv6 = pvv-ipv6 "1:4f"; # Wtf øystein og daniel why
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
defaultNetworkConfig = {
|
defaultNetworkConfig = {
|
||||||
|
Reference in New Issue
Block a user