h7x4 and oysteikt
afc6b3182e
ildkule/prometheus/phpfpm: scrape from bekkalokk
2026-07-27 13:58:47 +02:00
h7x4 and oysteikt
7ebf1130a9
bekkalokk/prometheus-phpfpm-exporter: init
2026-07-27 13:58:47 +02:00
h7x4 and oysteikt
f9d39adf53
base/journald-upload: verify server cert against CA bundle
2026-07-27 13:50:39 +02:00
h7x4 and oysteikt
65705237ab
modules/python-http-handlers: better daemon handling
...
This commit extends the python http handler template with the following
things:
- Integration with systemd notify
- Named systemd sockets, to avoid depending on expected FD number
- Graceful and customizable handling of SIGHUP reloads
- Graceful shutdown on SIGTERM with timeout
- Multithreaded HTTP server, one thread per request
- Better error message on undefined handler
2026-07-27 13:50:19 +02:00
h7x4 and oysteikt
ab518714a5
bekkalokk/well-known: advertise TLS SMTP in autoconfig/mail
2026-07-25 23:24:57 +02:00
h7x4
4f6c731d25
flake.lock: bump pvv-nettsiden
2026-07-25 20:51:24 +09:00
h7x4
ee718563c8
bicep/postgresql: don't open udp 5432 in firewall
2026-07-25 07:35:42 +09:00
h7x4
fcc06d47c2
base/sshd: accept some useful envvars
2026-07-24 16:03:54 +09:00
h7x4 and oysteikt
d13df223bf
bicep/mysql: add timed jobs for analyze and optimize
2026-07-22 15:09:10 +02:00
h7x4
1c4e8e7662
base/postfix: remove, base:nullmailer: init
2026-07-22 21:12:00 +09:00
h7x4
207bd1975e
kommode/gitea: add robots.txt
2026-07-22 21:02:22 +09:00
h7x4 and oysteikt
28794691bf
bicep/{postgres,mysql}: bindmount data storage with noatime
2026-07-22 13:01:02 +02:00
h7x4
1ff34d7aab
secrets: add passwords for gatus dbms checkers
2026-07-21 18:44:51 +09:00
h7x4
3d551fab52
ildkule/gatus: add healthcheck for mariadb
2026-07-21 18:44:51 +09:00
h7x4
a99a83c0d8
ildkule/gatus: add healthcheck for postgresql
2026-07-21 18:44:50 +09:00
h7x4
9a837d210d
bicep/postgres: log connections/disconnections
2026-07-21 16:39:25 +09:00
h7x4
d3c9fabbc2
base/irqbalance: only start on multi-socket machines
2026-07-21 16:38:38 +09:00
h7x4
950b163869
bicep/postgresql: use scram-sha-256 as default password algorithm
2026-07-21 16:32:49 +09:00
h7x4
9bd81430a4
topology: remove (now) redundant mysql service extractor
2026-07-20 23:20:02 +09:00
h7x4
9b38b4b8d3
flake.lock: bump
2026-07-20 22:30:39 +09:00
h7x4
6abc05dc4d
treewide: have rwhod ignore always logged-in users
2026-07-20 21:51:57 +09:00
h7x4
2e3ac911cb
skrot: split drumknotty service details into separate file
2026-07-20 21:39:16 +09:00
h7x4
16b0d05d27
flake.lock: bump roowho2
2026-07-20 21:34:29 +09:00
h7x4
fe19bb9bdb
ildkule/gatus/minecraft-checker: rewrite to use python-http-handlers module
2026-07-20 19:37:28 +09:00
h7x4
f4f9836deb
modules/python-http-handlers: init
2026-07-20 19:37:26 +09:00
h7x4
fb7e350ac7
flake.lock: bump dibbler
2026-07-18 18:44:28 +09:00
h7x4
3c3bf6b10f
modules/drumknotty: provide state directories for all services
2026-07-18 18:42:26 +09:00
h7x4
b0e3d90c20
ildkule/gatus/minecraft-checker: init
2026-07-07 16:26:26 +09:00
h7x4
111c3e21bd
ildkule/gatus: init
2026-07-07 16:26:06 +09:00
h7x4
decd8b04c1
ildkule/uptime-kuma: remove
2026-07-06 05:31:50 +09:00
h7x4
4b8be337e0
lupine5/openvpn: additional config, open firewall
2026-07-06 02:37:17 +09:00
h7x4
fcfcb07e59
lupine5: register knutsen-vpn ip
2026-07-06 02:37:16 +09:00
h7x4
1e66049c79
lupine5/openvpn: use certs
2026-07-06 02:37:16 +09:00
h7x4
928ddde344
sops/lupine: add CA + 2 keypairs for OpenVPN
2026-07-06 02:37:16 +09:00
h7x4
3aa8d0b418
lupine5/openvpn: init
2026-07-05 01:31:15 +09:00
h7x4
293f28abb1
lupine5: set up bridge and tap netdevs
2026-07-05 01:01:35 +09:00
h7x4
f4b1f090e4
flake.lock: bump various
2026-06-30 04:15:37 +09:00
h7x4
7c684e42f0
treewide: fix rsync <-> rrsync communication
2026-06-30 02:41:40 +09:00
h7x4
90bfda9066
kommode/gitea: bump AVATAR_MAX_ORIGIN_SIZE from 2MB to 4MB
2026-06-24 14:33:20 +09:00
h7x4
522d8f18cb
flake.{nix,lock}: bump roowho2
2026-06-24 13:38:03 +09:00
h7x4
5e613a03fc
treewide: set relatime for most root mounts
2026-06-23 01:12:16 +09:00
h7x4
170fb2a980
bicep/synapse: fix dbname option
2026-06-22 18:55:14 +09:00
h7x4
3e627472e9
flake.{nix,lock}: bump matrix-next
2026-06-22 18:55:13 +09:00
h7x4
3fee83ec05
ildkule/loki: restrict incoming connections to pvv + ntnu
2026-06-22 01:23:16 +09:00
h7x4
a1f02fc39d
{ildkule/loki,base/fluentbit}: send data over https
2026-06-22 01:23:16 +09:00
h7x4
cdc3ad488b
bicep/postgres: add script for updating all collations
2026-06-22 01:12:59 +09:00
h7x4
aa2712005a
temmie/nfs-mounts: create by-uid bindmounts
2026-06-17 13:43:19 +09:00
h7x4
89921b533b
temmie/userweb: further harden log-processor
2026-06-17 12:31:02 +09:00
h7x4
75f87ffab8
temmie/userweb: run passwd sync in different unit
2026-06-17 12:15:23 +09:00
h7x4
b910cf9563
temmie/userweb: suppress erroneous access log for documentRoot
2026-06-17 08:57:55 +09:00
h7x4
d23adbd4c2
temmie/userweb: deny access to documentRoot
2026-06-17 08:49:44 +09:00
h7x4
48c0a4e504
temmie/userweb: fix directory denylist enforcement
2026-06-17 08:23:08 +09:00
h7x4
374d9b1bc7
flake.nix: passthru machine config, pkgs and config.system.build
...
This shortens down the path needed to build both overlayed packages and
all the other machine derivations. Here are some examples:
```
nix build .#machine.etc
nix build '.#machine.units."nginx.service".unit'
nix build .#machine.pkgs.overlayed-package
nix build .#machine.config.services.nginx.package
```
2026-06-17 08:10:17 +09:00
h7x4
d84cc73819
temmie/userweb: handle more .php\d suffixes
2026-06-16 19:07:58 +09:00
h7x4
b738f08c09
temmie/userweb: render path denylist into Directory/Files directives
2026-06-16 19:07:57 +09:00
h7x4
8252bba3ad
temmie/userweb: enable httpd trace on debugMode
2026-06-16 19:07:57 +09:00
h7x4
a776a5a5fe
temmie/userweb: explicitly override mod_perl and mod_userdir
2026-06-16 19:07:57 +09:00
h7x4
ed57744ec3
temmie/userweb: add more patterns to denylist
2026-06-16 16:07:32 +09:00
h7x4
226db1f46e
temmie/userweb: add more DirectoryIndex variants
2026-06-16 16:07:32 +09:00
h7x4
51e1656177
temmie/userweb: disable ~pvv
2026-06-16 15:53:52 +09:00
h7x4
47d2dcf9ff
temmie/userweb: add bro server to userweb slice
2026-06-16 03:37:28 +09:00
h7x4
254b1d9b14
temmie/userweb: split into more modules
2026-06-16 03:33:28 +09:00
h7x4
2301672a21
temmie/userweb: run log processors as separate systemd units
...
This lets us divide up some of the logic making httpd itself less
brittle, and also reduces the amount of privileges for httpd.
2026-06-16 02:56:28 +09:00
h7x4
b533b09c8f
base/various: add to slice system-monitoring
2026-06-13 04:45:39 +09:00
h7x4
526b55c49a
{ildkule/prometheus,base}: send stats over HTTPS through nginx
2026-06-13 02:54:28 +09:00
h7x4
e80189c6eb
temmie/userweb: stop cating passwd on startup
2026-06-13 01:41:05 +09:00
h7x4
56a51e4c6f
temmie/userweb: mount homedirs under /amd
2026-06-13 01:39:20 +09:00
h7x4
f54109f6f3
temmie/userweb: set handlers for php and perl scripts
2026-06-13 01:26:27 +09:00
h7x4
b57a935b4c
base/rsyslogd: init
2026-06-08 12:58:37 +09:00
h7x4
b4582a160f
skrot/dibbler: rotate database password
2026-06-07 17:58:33 +09:00
h7x4
ac094d350d
base/timesyncd: specify ntp servers
2026-06-07 17:52:54 +09:00
h7x4
b848e0f1cc
temmie/userweb: add log processor for apache
2026-06-07 06:03:18 +09:00
h7x4
c671329b93
temmie/userweb: inject users from passwd into httpd sandbox
2026-06-07 05:28:24 +09:00
h7x4
cafc95db8f
bicep/mjolnir: use nodejs v22
2026-06-06 04:43:58 +09:00
h7x4
2d6b09cb32
bikkje: label ports in firewall port list
2026-06-06 04:08:16 +09:00
h7x4
ce0af2f6e4
flake.nix: add app for building gitea workflows locally
2026-06-06 04:05:26 +09:00
h7x4
88892115b5
base: enable autoScrub for all btrfs machine by default
2026-06-06 04:05:26 +09:00
h7x4 and Vegard Bieker Matthey
8a290d30e7
modules/drumknotty: split into several parts
...
This also fixes a few issues, such as enabling `createLocalDatabase` for
multiple programs, and wraps all the screen logic within a screenrc
file. Some assertions were also added to avoid some easy-to-make
mistakes.
2026-06-05 14:21:35 +02:00
h7x4
fcd81aed00
packages/ooye: 3.5.1 -> 3.6.0
2026-06-04 19:17:29 +09:00
h7x4
966081ebfc
bicep/mysql: enable userstat
2026-06-03 15:31:27 +09:00
h7x4
39d313579c
bicep/mysql: rotate slow query logs
2026-06-03 15:21:18 +09:00
h7x4
3386153b8b
ildkule/prometheus/exim: make scheme explicit
2026-06-03 13:35:13 +09:00
h7x4
56906241f6
bekkalokk/roundcube: temporary fix for webmail redirects
2026-06-01 03:52:09 +09:00
h7x4
3fe71d21f6
bekkalokk/roundcube: webdir moved to public_html within package
2026-06-01 02:57:43 +09:00
h7x4
074d240595
base: tag generation as auto if built by auto upgrade service
2026-06-01 01:00:50 +09:00
h7x4
1ce3372683
lupine/binfmt: enable
2026-06-01 01:00:50 +09:00
h7x4
e05eab4ddf
{georg,brzeczyszczykiewicz}: use sane IPv6 addresses
2026-05-29 16:04:52 +09:00
h7x4
64843087be
kommode/gitea: only allow webhooks to external hosts
...
We don't have any servers with intranet IPs, and we want webhooks that
hook back to kommode to pass through its firewall.
2026-05-29 12:58:26 +09:00
h7x4
0c45345050
bicep/matrix-ooye harden
2026-05-28 16:07:36 +09:00
h7x4
788f23bf04
bicep/matrix-hookshot: harden
2026-05-28 15:58:04 +09:00
h7x4
8416014aeb
bicep/mjolnir: harden
2026-05-28 15:58:04 +09:00
h7x4
654eeb83d8
base: tag generation as dirty if built from uncommitted source code
2026-05-28 04:39:49 +09:00
h7x4
5bf0de1d0d
bekkalokk/website/fetch-gallery: use proper shellscript builder
2026-05-28 03:58:08 +09:00
h7x4
a550bbf1e0
bekkalokk/roundcube: use specialized builder for nginx root dir
2026-05-28 03:46:59 +09:00
h7x4
6d9bd8256f
kommode/gitea/install-customization: disable networking
2026-05-28 03:15:47 +09:00
h7x4
5c859d9809
kommode/gitea/install-customization: remove ExecStart bash wrapper
2026-05-28 03:15:06 +09:00
h7x4
68481b999b
modules/grzegorz: remove ExecStart bash wrapper
2026-05-28 03:09:38 +09:00
h7x4
dfbed75cd9
kommode/gitea/gpg: remove ExecStart bash wrapper
2026-05-28 03:06:07 +09:00
h7x4
6237a0a0e7
bicep/minecraft-heatmap: remove ExecStartPre bash wrapper
2026-05-28 03:03:38 +09:00
h7x4
bd2263a0a9
kommode/gitea/import-users: remove ExecStartPre bash wrapper
2026-05-28 03:02:59 +09:00
h7x4andoysteikt