h7x4
384534bf86
treewide: add missing systemd ordering directives
...
In particular, we were missing `sops-install-secrets.service` in a ton
of places, and `network-online.target` for some homebrewn services.
This has caused failure of some services on machine startup.
2026-07-22 17:56:06 +09:00
h7x4
aa2712005a
temmie/nfs-mounts: create by-uid bindmounts
2026-06-17 13:43:19 +09:00
h7x4
89921b533b
temmie/userweb: further harden log-processor
2026-06-17 12:31:02 +09:00
h7x4
75f87ffab8
temmie/userweb: run passwd sync in different unit
2026-06-17 12:15:23 +09:00
h7x4
b910cf9563
temmie/userweb: suppress erroneous access log for documentRoot
2026-06-17 08:57:55 +09:00
h7x4
d23adbd4c2
temmie/userweb: deny access to documentRoot
2026-06-17 08:49:44 +09:00
h7x4
48c0a4e504
temmie/userweb: fix directory denylist enforcement
2026-06-17 08:23:08 +09:00
h7x4
d84cc73819
temmie/userweb: handle more .php\d suffixes
2026-06-16 19:07:58 +09:00
h7x4
b738f08c09
temmie/userweb: render path denylist into Directory/Files directives
2026-06-16 19:07:57 +09:00
h7x4
8252bba3ad
temmie/userweb: enable httpd trace on debugMode
2026-06-16 19:07:57 +09:00
h7x4
a776a5a5fe
temmie/userweb: explicitly override mod_perl and mod_userdir
2026-06-16 19:07:57 +09:00
h7x4
ed57744ec3
temmie/userweb: add more patterns to denylist
2026-06-16 16:07:32 +09:00
h7x4
226db1f46e
temmie/userweb: add more DirectoryIndex variants
2026-06-16 16:07:32 +09:00
h7x4
51e1656177
temmie/userweb: disable ~pvv
2026-06-16 15:53:52 +09:00
h7x4
47d2dcf9ff
temmie/userweb: add bro server to userweb slice
2026-06-16 03:37:28 +09:00
h7x4
254b1d9b14
temmie/userweb: split into more modules
2026-06-16 03:33:28 +09:00
h7x4
2301672a21
temmie/userweb: run log processors as separate systemd units
...
This lets us divide up some of the logic making httpd itself less
brittle, and also reduces the amount of privileges for httpd.
2026-06-16 02:56:28 +09:00
h7x4
e80189c6eb
temmie/userweb: stop cating passwd on startup
2026-06-13 01:41:05 +09:00
h7x4
56a51e4c6f
temmie/userweb: mount homedirs under /amd
2026-06-13 01:39:20 +09:00
h7x4
f54109f6f3
temmie/userweb: set handlers for php and perl scripts
2026-06-13 01:26:27 +09:00
h7x4
b848e0f1cc
temmie/userweb: add log processor for apache
2026-06-07 06:03:18 +09:00
h7x4
c671329b93
temmie/userweb: inject users from passwd into httpd sandbox
2026-06-07 05:28:24 +09:00
h7x4
18ab1ef982
temmie/userweb: set -i and -t in sendmail wrapper
2026-05-25 18:49:57 +09:00
h7x4
5023edeb13
temmie/userweb: install mod_perl with custom env
2026-05-25 18:24:23 +09:00
h7x4
0d8c26c548
temmie/userweb: send propagatedBuildInputs through perl env wrapper
2026-05-25 17:05:02 +09:00
h7x4
bd244e7797
temmie/userweb: add www2 server alias
2026-05-25 16:24:35 +09:00
h7x4
e9220bb31e
temmie/userweb: use www-datas UID + GID for backwards compat
2026-05-25 15:25:26 +09:00
h7x4
6beb9c62c3
temmie/userweb: use bro to proxy sendmail requests out of sandbox
2026-05-25 15:02:40 +09:00
oysteikt and h7x4
b98e8679e6
temmie/userweb: set same phpOptions for env and apache
2026-05-11 14:54:56 +09:00
h7x4
ea092ec0b3
temmie/userweb: pass userdir user to sendmail through custom envvar
2026-05-11 14:26:47 +09:00
h7x4
5e50b617fb
temmie/userweb: switch from postfix to nullmailer
2026-05-11 13:52:58 +09:00
h7x4
258c5a7b25
temmie/userweb: set up sendmail wrapper
2026-05-11 12:26:39 +09:00
h7x4
b9eda3dc56
temmie/userweb: reduce package list
2026-05-11 10:17:09 +09:00
h7x4
b009da31af
temmie/userweb: deny a bunch of spooky directories by default
...
It should still be possible for the user to re-enable these with
`.htaccess`
2026-05-10 03:33:43 +09:00
h7x4
e9a267e2a3
temmie/userweb: ignore collisions in fhs env
2026-05-10 03:02:27 +09:00
h7x4
338c2f2531
temmie/userweb: adjust perl and php env
...
This adds and removes a few packages to make the environments closer to
how they are on tom
2026-05-10 03:02:26 +09:00
h7x4
b712f3cda3
temmie/userweb: add a few more packages
2026-01-31 21:53:12 +09:00
h7x4
cc272a724c
temmie/userweb: add directory index search path
2026-01-31 21:30:23 +09:00
h7x4
fcaa97884e
temmie/userweb: add a bunch more normal packages
2026-01-31 21:20:26 +09:00
h7x4
11f2cf504f
temmie/userweb: add a bunch more perl packages
2026-01-31 20:31:03 +09:00
h7x4
7ab16bc949
temmie/userweb: restrict log access
2026-01-31 19:08:02 +09:00
h7x4
c4d5cfde56
temmie/userweb: add legacy-cgi to the python package set
2026-01-31 18:53:44 +09:00
h7x4
100d09f6b7
temmie/userweb: get first iteration working
2026-01-31 18:41:17 +09:00
h7x4
3b0742bfac
temmie: combine homedirs in overlayfs
2026-01-31 18:41:17 +09:00
h7x4
95f6463171
temmie: set up httpd
2026-01-22 19:41:52 +09:00
h7x4
ba6c1c8205
temmie/nfs-mounts: generate systemd units ourselves
2026-01-22 19:10:30 +09:00
h7x4
5d0b2c6e0a
temmie: mount nfs shares from microbel
2026-01-15 00:47:53 +09:00
h7x4
oysteiktandh7x4