mirror of
https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git
synced 2026-02-20 17:07:51 +01:00
Compare commits
2 Commits
3a0ea9c338
...
nom
| Author | SHA1 | Date | |
|---|---|---|---|
|
31f2f445f3 | ||
|
|
bce1f0e912 |
@@ -1,32 +0,0 @@
|
|||||||
name: "Build topology graph"
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
branches:
|
|
||||||
- main
|
|
||||||
jobs:
|
|
||||||
evals:
|
|
||||||
runs-on: debian-latest
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v6
|
|
||||||
|
|
||||||
- name: Install sudo
|
|
||||||
run: apt-get update && apt-get -y install sudo
|
|
||||||
|
|
||||||
- uses: https://github.com/cachix/install-nix-action@v31
|
|
||||||
|
|
||||||
- name: Configure Nix
|
|
||||||
run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
|
|
||||||
|
|
||||||
- name: Build topology graph
|
|
||||||
run: nix build .#topology -L
|
|
||||||
|
|
||||||
- name: Upload topology graph
|
|
||||||
uses: https://git.pvv.ntnu.no/Projects/rsync-action@v2
|
|
||||||
with:
|
|
||||||
source: result/*.svg
|
|
||||||
quote-source: false
|
|
||||||
target: ${{ gitea.ref_name }}/topology_graph/
|
|
||||||
username: gitea-web
|
|
||||||
ssh-key: ${{ secrets.WEB_SYNC_SSH_KEY }}
|
|
||||||
host: pages.pvv.ntnu.no
|
|
||||||
known-hosts: "pages.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2QjfFB+city1SYqltkVqWACfo1j37k+oQQfj13mtgg"
|
|
||||||
@@ -4,10 +4,10 @@ on:
|
|||||||
push:
|
push:
|
||||||
jobs:
|
jobs:
|
||||||
evals:
|
evals:
|
||||||
runs-on: debian-latest
|
runs-on: ubuntu-latest
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v6
|
- uses: actions/checkout@v3
|
||||||
- run: apt-get update && apt-get -y install sudo
|
- run: apt-get update && apt-get -y install sudo
|
||||||
- uses: https://github.com/cachix/install-nix-action@v31
|
- uses: https://github.com/cachix/install-nix-action@v23
|
||||||
- run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
|
- run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
|
||||||
- run: nix flake check
|
- run: nix flake check
|
||||||
|
|||||||
82
.sops.yaml
82
.sops.yaml
@@ -1,39 +1,33 @@
|
|||||||
keys:
|
keys:
|
||||||
# Users
|
# Users
|
||||||
- &user_danio age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
|
- &user_danio age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
|
||||||
- &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
|
|
||||||
- &user_felixalb age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
- &user_felixalb age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
||||||
- &user_oysteikt F7D37890228A907440E1FD4846B9228E814A2AAC
|
- &user_oysteikt F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||||
- &user_pederbs_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
- &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
|
||||||
- &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
|
||||||
- &user_pederbs_sopp age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
- &user_pederbs_sopp age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
||||||
- &user_vegardbm age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
|
- &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
||||||
|
- &user_pederbs_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
||||||
|
|
||||||
# Hosts
|
# Hosts
|
||||||
- &host_bakke age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
|
- &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
|
||||||
- &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
|
|
||||||
- &host_bicep age19nk55kcs7s0358jpkn75xnr57dfq6fq3p43nartvsprx0su22v7qcgcjdx
|
|
||||||
- &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
|
- &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
|
||||||
- &host_kommode age1mt4d0hg5g76qp7j0884llemy0k2ymr5up8vfudz6vzvsflk5nptqqd32ly
|
- &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
|
||||||
- &host_lupine-1 age1fkrypl6fu4ldsa7te4g3v4qsegnk7sd6qhkquuwzh04vguy96qus08902e
|
- &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
|
||||||
- &host_lupine-2 age1mu0ej57n4s30ghealhyju3enls83qyjua69986la35t2yh0q2s0seruz5n
|
|
||||||
- &host_lupine-3 age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
|
|
||||||
- &host_lupine-4 age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
|
|
||||||
- &host_lupine-5 age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
|
|
||||||
- &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
|
- &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
|
||||||
|
- &host_kommode age1mt4d0hg5g76qp7j0884llemy0k2ymr5up8vfudz6vzvsflk5nptqqd32ly
|
||||||
|
|
||||||
creation_rules:
|
creation_rules:
|
||||||
# Global secrets
|
# Global secrets
|
||||||
- path_regex: secrets/[^/]+\.yaml$
|
- path_regex: secrets/[^/]+\.yaml$
|
||||||
key_groups:
|
key_groups:
|
||||||
- age:
|
- age:
|
||||||
|
- *host_jokum
|
||||||
- *user_danio
|
- *user_danio
|
||||||
- *user_felixalb
|
- *user_felixalb
|
||||||
- *user_eirikwit
|
- *user_eirikwit
|
||||||
- *user_pederbs_sopp
|
- *user_pederbs_sopp
|
||||||
- *user_pederbs_nord
|
- *user_pederbs_nord
|
||||||
- *user_pederbs_bjarte
|
- *user_pederbs_bjarte
|
||||||
- *user_vegardbm
|
|
||||||
pgp:
|
pgp:
|
||||||
- *user_oysteikt
|
- *user_oysteikt
|
||||||
|
|
||||||
@@ -48,7 +42,6 @@ creation_rules:
|
|||||||
- *user_pederbs_sopp
|
- *user_pederbs_sopp
|
||||||
- *user_pederbs_nord
|
- *user_pederbs_nord
|
||||||
- *user_pederbs_bjarte
|
- *user_pederbs_bjarte
|
||||||
- *user_vegardbm
|
|
||||||
pgp:
|
pgp:
|
||||||
- *user_oysteikt
|
- *user_oysteikt
|
||||||
|
|
||||||
@@ -61,7 +54,18 @@ creation_rules:
|
|||||||
- *user_pederbs_sopp
|
- *user_pederbs_sopp
|
||||||
- *user_pederbs_nord
|
- *user_pederbs_nord
|
||||||
- *user_pederbs_bjarte
|
- *user_pederbs_bjarte
|
||||||
- *user_vegardbm
|
pgp:
|
||||||
|
- *user_oysteikt
|
||||||
|
|
||||||
|
- path_regex: secrets/jokum/[^/]+\.yaml$
|
||||||
|
key_groups:
|
||||||
|
- age:
|
||||||
|
- *host_jokum
|
||||||
|
- *user_danio
|
||||||
|
- *user_felixalb
|
||||||
|
- *user_pederbs_sopp
|
||||||
|
- *user_pederbs_nord
|
||||||
|
- *user_pederbs_bjarte
|
||||||
pgp:
|
pgp:
|
||||||
- *user_oysteikt
|
- *user_oysteikt
|
||||||
|
|
||||||
@@ -74,7 +78,6 @@ creation_rules:
|
|||||||
- *user_pederbs_sopp
|
- *user_pederbs_sopp
|
||||||
- *user_pederbs_nord
|
- *user_pederbs_nord
|
||||||
- *user_pederbs_bjarte
|
- *user_pederbs_bjarte
|
||||||
- *user_vegardbm
|
|
||||||
pgp:
|
pgp:
|
||||||
- *user_oysteikt
|
- *user_oysteikt
|
||||||
|
|
||||||
@@ -87,7 +90,6 @@ creation_rules:
|
|||||||
- *user_pederbs_sopp
|
- *user_pederbs_sopp
|
||||||
- *user_pederbs_nord
|
- *user_pederbs_nord
|
||||||
- *user_pederbs_bjarte
|
- *user_pederbs_bjarte
|
||||||
- *user_vegardbm
|
|
||||||
pgp:
|
pgp:
|
||||||
- *user_oysteikt
|
- *user_oysteikt
|
||||||
|
|
||||||
@@ -95,48 +97,6 @@ creation_rules:
|
|||||||
key_groups:
|
key_groups:
|
||||||
- age:
|
- age:
|
||||||
- *host_ustetind
|
- *host_ustetind
|
||||||
- *user_danio
|
|
||||||
- *user_felixalb
|
|
||||||
- *user_pederbs_sopp
|
|
||||||
- *user_pederbs_nord
|
|
||||||
- *user_pederbs_bjarte
|
|
||||||
- *user_vegardbm
|
|
||||||
pgp:
|
|
||||||
- *user_oysteikt
|
|
||||||
|
|
||||||
- path_regex: secrets/lupine/[^/]+\.yaml$
|
|
||||||
key_groups:
|
|
||||||
- age:
|
|
||||||
- *host_lupine-1
|
|
||||||
- *host_lupine-2
|
|
||||||
- *host_lupine-3
|
|
||||||
- *host_lupine-4
|
|
||||||
- *host_lupine-5
|
|
||||||
- *user_danio
|
|
||||||
- *user_felixalb
|
|
||||||
- *user_pederbs_sopp
|
|
||||||
- *user_pederbs_nord
|
|
||||||
- *user_pederbs_bjarte
|
|
||||||
- *user_vegardbm
|
|
||||||
pgp:
|
|
||||||
- *user_oysteikt
|
|
||||||
|
|
||||||
- path_regex: secrets/bakke/[^/]+\.yaml$
|
|
||||||
key_groups:
|
|
||||||
- age:
|
|
||||||
- *host_bakke
|
|
||||||
- *user_danio
|
|
||||||
- *user_felixalb
|
|
||||||
- *user_pederbs_sopp
|
|
||||||
- *user_pederbs_nord
|
|
||||||
- *user_pederbs_bjarte
|
|
||||||
- *user_vegardbm
|
|
||||||
pgp:
|
|
||||||
- *user_oysteikt
|
|
||||||
|
|
||||||
- path_regex: secrets/skrott/[^/]+\.yaml$
|
|
||||||
key_groups:
|
|
||||||
- age:
|
|
||||||
- *user_danio
|
- *user_danio
|
||||||
- *user_felixalb
|
- *user_felixalb
|
||||||
- *user_pederbs_sopp
|
- *user_pederbs_sopp
|
||||||
|
|||||||
61
README.MD
Normal file
61
README.MD
Normal file
@@ -0,0 +1,61 @@
|
|||||||
|
# PVV NixOS configs
|
||||||
|
|
||||||
|
## Hvordan endre på ting
|
||||||
|
|
||||||
|
Før du endrer på ting husk å ikke putte ting som skal være hemmelig uten å først lese seksjonen for hemmeligheter!
|
||||||
|
|
||||||
|
Etter å ha klonet prosjektet ned og gjort endringer kan du evaluere configene med:
|
||||||
|
|
||||||
|
`nix flake check --keep-going`
|
||||||
|
|
||||||
|
før du bygger en maskin med:
|
||||||
|
|
||||||
|
`nix build .#<maskinnavn>`
|
||||||
|
|
||||||
|
hvis du vil være ekstra sikker på at alt bygger så kan du kjøre:
|
||||||
|
|
||||||
|
`nix build .` for å bygge alle de viktige maskinene.
|
||||||
|
|
||||||
|
NB: Dette kan ta opp til 30 minutter avhengig av hva som ligger i caches
|
||||||
|
|
||||||
|
Husk å hvertfall stage nye filer om du har laget dem!
|
||||||
|
|
||||||
|
Om alt bygger fint commit det og push til git repoet.
|
||||||
|
Det er sikkert lurt å lage en PR først om du ikke er vandt til nix enda.
|
||||||
|
|
||||||
|
Innen 24h skal alle systemene hente ned den nye konfigurasjonen og deploye den.
|
||||||
|
|
||||||
|
Du kan tvinge en maskin til å oppdatere seg før dette ved å kjøre:
|
||||||
|
`nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --upgrade --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git`
|
||||||
|
|
||||||
|
som root på maskinen.
|
||||||
|
|
||||||
|
Hvis du ikke har lyst til å oppdatere alle pakkene (og kanskje måtte vente en stund!) kan du kjøre
|
||||||
|
|
||||||
|
`nixos-rebuild switch --override-input nixpkgs nixpkgs --override-input nixpkgs-unstable nixpkgs-unstable --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git`
|
||||||
|
|
||||||
|
## Seksjonen for hemmeligheter
|
||||||
|
|
||||||
|
For at hemmeligheter ikke skal deles med hele verden i git - eller å være world
|
||||||
|
readable i nix-storen, bruker vi [sops-nix](https://github.com/Mic92/sops-nix)
|
||||||
|
|
||||||
|
For å legge til secrets kan du kjøre f.eks. `sops secrets/jokum/jokum.yaml`
|
||||||
|
Dette vil dekryptere filen og gi deg en text-editor du kan bruke for endre hemmelighetene.
|
||||||
|
|
||||||
|
Et nix shell med dette verktøyet inkludert ligger i flaket og shell.nix og kan aktiveres med:
|
||||||
|
|
||||||
|
`nix-shell` eller `nix develop`. Vi anbefaler det siste.
|
||||||
|
I tilegg kan du sette opp [direnv](https://direnv.net/) slik at dette skjer automatisk
|
||||||
|
|
||||||
|
for å få tilgang til å lese/skrive hemmeligheter må du spørre noen/noe som har tilgang til hemmelighetene
|
||||||
|
om å legge til age eller pgp nøkkelen din i [`.sops.yaml`](https://git.pvv.ntnu.no/Drift/pvv-nixos-config/src/main/.sops.yaml)
|
||||||
|
|
||||||
|
Denne kan du generere fra ssh-nøkkelene dine eller lage en egen nøkkel.
|
||||||
|
|
||||||
|
### Legge til flere keys
|
||||||
|
|
||||||
|
Gjør det som gir mening i .sops.yml
|
||||||
|
|
||||||
|
Etter det kjør `sops updatekeys secrets/host/file.yml`
|
||||||
|
|
||||||
|
MERK at det ikke er `sops -r` som BARE roterer nøkklene for de som allerede er i secretfila
|
||||||
62
README.md
62
README.md
@@ -1,62 +0,0 @@
|
|||||||
# PVV NixOS config
|
|
||||||
|
|
||||||
This repository contains the NixOS configurations for Programvareverkstedet's server closet.
|
|
||||||
In addition to machine configurations, it also contains a bunch of shared modules, packages, and
|
|
||||||
more.
|
|
||||||
|
|
||||||
> [!WARNING]
|
|
||||||
> Please read [Development - working on the PVV machines](./docs/development.md) before making
|
|
||||||
> any changes, and [Secret management and `sops-nix`](./docs/secret-management.md) before adding
|
|
||||||
> any credentials such as passwords, API tokens, etc. to the configuration.
|
|
||||||
|
|
||||||
## Deploying to machines
|
|
||||||
|
|
||||||
> [!WARNING]
|
|
||||||
> Be careful to think about state when testing changes against the machines. Sometimes, a certain change
|
|
||||||
> can lead to irreversible changes to the data stored on the machine. An example would be a set of database
|
|
||||||
> migrations applied when testing a newer version of a service. Unless that service also comes with downwards
|
|
||||||
> migrations, you can not go back to the previous version without losing data.
|
|
||||||
|
|
||||||
To deploy the changes to a machine, you should first SSH into the machine, and clone the pvv-nixos-config
|
|
||||||
repository unless you have already done so. After that, checkout the branch you want to deploy from, and rebuild:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Run this while in the pvv-nixos-config directory
|
|
||||||
sudo nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --flake .# --upgrade
|
|
||||||
```
|
|
||||||
|
|
||||||
This will rebuild the NixOS system on the current branch and switch the system configuration to reflect the new changes.
|
|
||||||
|
|
||||||
Note that unless you eventually merge the current changes into `main`, the machine will rebuild itself automatically and
|
|
||||||
revert the changes on the next nightly rebuild (tends to happen when everybody is asleep).
|
|
||||||
|
|
||||||
## Machine overview
|
|
||||||
|
|
||||||
| Name | Type | Description |
|
|
||||||
|----------------------------|----------|-----------------------------------------------------------|
|
|
||||||
| [bekkalokk][bek] | Physical | Our main web host, webmail, wiki, idp, minecraft map, ... |
|
|
||||||
| [bicep][bic] | Virtual | Database host, matrix, git mirrors, ... |
|
|
||||||
| bikkje | Virtual | Experimental login box |
|
|
||||||
| [brzeczyszczykiewicz][brz] | Physical | Shared music player |
|
|
||||||
| [georg][geo] | Physical | Shared music player |
|
|
||||||
| [ildkule][ild] | Virtual | Logging and monitoring host, prometheus, grafana, ... |
|
|
||||||
| [kommode][kom] | Virtual | Gitea + Gitea pages |
|
|
||||||
| [lupine][lup] | Physical | Gitea CI/CD runners |
|
|
||||||
| shark | Virtual | Test host for authentication, absolutely horrendous |
|
|
||||||
| [wenche][wen] | Virtual | Nix-builders, general purpose compute |
|
|
||||||
|
|
||||||
## Documentation
|
|
||||||
|
|
||||||
- [Development - working on the PVV machines](./docs/development.md)
|
|
||||||
- [Miscellaneous development notes](./docs/development-misc.md)
|
|
||||||
- [User management](./docs/users.md)
|
|
||||||
- [Secret management and `sops-nix`](./docs/secret-management.md)
|
|
||||||
|
|
||||||
[bek]: https://wiki.pvv.ntnu.no/wiki/Maskiner/bekkalokk
|
|
||||||
[bic]: https://wiki.pvv.ntnu.no/wiki/Maskiner/bicep
|
|
||||||
[brz]: https://wiki.pvv.ntnu.no/wiki/Maskiner/brzęczyszczykiewicz
|
|
||||||
[geo]: https://wiki.pvv.ntnu.no/wiki/Maskiner/georg
|
|
||||||
[ild]: https://wiki.pvv.ntnu.no/wiki/Maskiner/ildkule
|
|
||||||
[kom]: https://wiki.pvv.ntnu.no/wiki/Maskiner/kommode
|
|
||||||
[lup]: https://wiki.pvv.ntnu.no/wiki/Maskiner/lupine
|
|
||||||
[wen]: https://wiki.pvv.ntnu.no/wiki/Maskiner/wenche
|
|
||||||
@@ -1,9 +1,4 @@
|
|||||||
{
|
{ pkgs, lib, fp, ... }:
|
||||||
pkgs,
|
|
||||||
lib,
|
|
||||||
fp,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
|
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
@@ -13,26 +8,19 @@
|
|||||||
./networking.nix
|
./networking.nix
|
||||||
./nix.nix
|
./nix.nix
|
||||||
./vm.nix
|
./vm.nix
|
||||||
./flake-input-exporter.nix
|
|
||||||
|
|
||||||
./services/acme.nix
|
./services/acme.nix
|
||||||
|
./services/uptimed.nix
|
||||||
./services/auto-upgrade.nix
|
./services/auto-upgrade.nix
|
||||||
./services/dbus.nix
|
./services/dbus.nix
|
||||||
./services/fwupd.nix
|
./services/fwupd.nix
|
||||||
./services/irqbalance.nix
|
./services/irqbalance.nix
|
||||||
./services/journald-upload.nix
|
|
||||||
./services/logrotate.nix
|
./services/logrotate.nix
|
||||||
./services/nginx.nix
|
./services/nginx.nix
|
||||||
./services/openssh.nix
|
./services/openssh.nix
|
||||||
./services/polkit.nix
|
|
||||||
./services/postfix.nix
|
./services/postfix.nix
|
||||||
./services/prometheus-node-exporter.nix
|
|
||||||
./services/prometheus-systemd-exporter.nix
|
|
||||||
./services/promtail.nix
|
|
||||||
./services/roowho2.nix
|
|
||||||
./services/smartd.nix
|
./services/smartd.nix
|
||||||
./services/thermald.nix
|
./services/thermald.nix
|
||||||
./services/uptimed.nix
|
|
||||||
./services/userborn.nix
|
./services/userborn.nix
|
||||||
./services/userdbd.nix
|
./services/userdbd.nix
|
||||||
];
|
];
|
||||||
@@ -54,7 +42,6 @@
|
|||||||
gnupg
|
gnupg
|
||||||
htop
|
htop
|
||||||
nano
|
nano
|
||||||
net-tools
|
|
||||||
ripgrep
|
ripgrep
|
||||||
rsync
|
rsync
|
||||||
screen
|
screen
|
||||||
@@ -70,16 +57,16 @@
|
|||||||
# home-manager usually handles this for you: https://github.com/nix-community/home-manager/blob/22a36aa709de7dd42b562a433b9cefecf104a6ee/modules/programs/bash.nix#L203-L209
|
# home-manager usually handles this for you: https://github.com/nix-community/home-manager/blob/22a36aa709de7dd42b562a433b9cefecf104a6ee/modules/programs/bash.nix#L203-L209
|
||||||
# btw, programs.bash.shellInit just goes into environment.shellInit which in turn goes into /etc/profile, spooky shit
|
# btw, programs.bash.shellInit just goes into environment.shellInit which in turn goes into /etc/profile, spooky shit
|
||||||
programs.bash.shellInit = ''
|
programs.bash.shellInit = ''
|
||||||
if [ -n "''${BASH_VERSION:-}" ]; then
|
if [ -n "''${BASH_VERSION:-}" ]; then
|
||||||
if [[ ! -f ~/.bash_profile && ! -f ~/.bash_login ]]; then
|
if [[ ! -f ~/.bash_profile && ! -f ~/.bash_login ]]; then
|
||||||
[[ -f ~/.bashrc ]] && . ~/.bashrc
|
[[ -f ~/.bashrc ]] && . ~/.bashrc
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
'';
|
'';
|
||||||
|
|
||||||
programs.zsh.enable = true;
|
programs.zsh.enable = true;
|
||||||
|
|
||||||
# security.lockKernelModules = true;
|
security.lockKernelModules = true;
|
||||||
security.protectKernelImage = true;
|
security.protectKernelImage = true;
|
||||||
security.sudo.execWheelOnly = true;
|
security.sudo.execWheelOnly = true;
|
||||||
security.sudo.extraConfig = ''
|
security.sudo.extraConfig = ''
|
||||||
|
|||||||
@@ -1,55 +0,0 @@
|
|||||||
{
|
|
||||||
config,
|
|
||||||
inputs,
|
|
||||||
lib,
|
|
||||||
pkgs,
|
|
||||||
values,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
let
|
|
||||||
data = lib.flip lib.mapAttrs inputs (
|
|
||||||
name: input: {
|
|
||||||
inherit (input)
|
|
||||||
lastModified
|
|
||||||
;
|
|
||||||
}
|
|
||||||
);
|
|
||||||
folder = pkgs.writeTextDir "share/flake-inputs" (
|
|
||||||
lib.concatMapStringsSep "\n" (
|
|
||||||
{ name, value }: ''nixos_last_modified_input{flake="${name}"} ${toString value.lastModified}''
|
|
||||||
) (lib.attrsToList data)
|
|
||||||
);
|
|
||||||
port = 9102;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
services.nginx.virtualHosts."${config.networking.fqdn}-nixos-metrics" = {
|
|
||||||
serverName = config.networking.fqdn;
|
|
||||||
serverAliases = [
|
|
||||||
"${config.networking.hostName}.pvv.org"
|
|
||||||
];
|
|
||||||
locations."/metrics" = {
|
|
||||||
root = "${folder}/share";
|
|
||||||
tryFiles = "/flake-inputs =404";
|
|
||||||
extraConfig = ''
|
|
||||||
default_type text/plain;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
listen = [
|
|
||||||
{
|
|
||||||
inherit port;
|
|
||||||
addr = "0.0.0.0";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
extraConfig = ''
|
|
||||||
allow ${values.hosts.ildkule.ipv4}/32;
|
|
||||||
allow ${values.hosts.ildkule.ipv6}/128;
|
|
||||||
allow 127.0.0.1/32;
|
|
||||||
allow ::1/128;
|
|
||||||
allow ${values.ipv4-space};
|
|
||||||
allow ${values.ipv6-space};
|
|
||||||
deny all;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ port ];
|
|
||||||
}
|
|
||||||
20
base/nix.nix
20
base/nix.nix
@@ -1,4 +1,4 @@
|
|||||||
{ lib, config, inputs, ... }:
|
{ inputs, ... }:
|
||||||
{
|
{
|
||||||
nix = {
|
nix = {
|
||||||
gc = {
|
gc = {
|
||||||
@@ -9,9 +9,8 @@
|
|||||||
|
|
||||||
settings = {
|
settings = {
|
||||||
allow-dirty = true;
|
allow-dirty = true;
|
||||||
auto-allocate-uids = true;
|
|
||||||
builders-use-substitutes = true;
|
builders-use-substitutes = true;
|
||||||
experimental-features = [ "nix-command" "flakes" "auto-allocate-uids" ];
|
experimental-features = [ "nix-command" "flakes" ];
|
||||||
log-lines = 50;
|
log-lines = 50;
|
||||||
use-xdg-base-directories = true;
|
use-xdg-base-directories = true;
|
||||||
};
|
};
|
||||||
@@ -22,16 +21,11 @@
|
|||||||
** use the same channel the system
|
** use the same channel the system
|
||||||
** was built with
|
** was built with
|
||||||
*/
|
*/
|
||||||
registry = lib.mkMerge [
|
registry = {
|
||||||
{
|
"nixpkgs".flake = inputs.nixpkgs;
|
||||||
"nixpkgs".flake = inputs.nixpkgs;
|
"nixpkgs-unstable".flake = inputs.nixpkgs-unstable;
|
||||||
"nixpkgs-unstable".flake = inputs.nixpkgs-unstable;
|
"pvv-nix".flake = inputs.self;
|
||||||
}
|
};
|
||||||
# We avoid the reference to self in vmVariant to get a stable system .outPath for equivalence testing
|
|
||||||
(lib.mkIf (!config.virtualisation.isVmVariant) {
|
|
||||||
"pvv-nix".flake = inputs.self;
|
|
||||||
})
|
|
||||||
];
|
|
||||||
nixPath = [
|
nixPath = [
|
||||||
"nixpkgs=${inputs.nixpkgs}"
|
"nixpkgs=${inputs.nixpkgs}"
|
||||||
"unstable=${inputs.nixpkgs-unstable}"
|
"unstable=${inputs.nixpkgs-unstable}"
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
{ config, inputs, pkgs, lib, ... }:
|
{ inputs, pkgs, lib, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
inputUrls = lib.mapAttrs (input: value: value.url) (import "${inputs.self}/flake.nix").inputs;
|
inputUrls = lib.mapAttrs (input: value: value.url) (import "${inputs.self}/flake.nix").inputs;
|
||||||
@@ -9,8 +9,6 @@ in
|
|||||||
enable = true;
|
enable = true;
|
||||||
flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
|
flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
|
||||||
flags = [
|
flags = [
|
||||||
"-L"
|
|
||||||
|
|
||||||
"--refresh"
|
"--refresh"
|
||||||
"--no-write-lock-file"
|
"--no-write-lock-file"
|
||||||
# --update-input is deprecated since nix 2.22, and removed in lix 2.90
|
# --update-input is deprecated since nix 2.22, and removed in lix 2.90
|
||||||
@@ -28,14 +26,12 @@ in
|
|||||||
|
|
||||||
# workaround for https://github.com/NixOS/nix/issues/6895
|
# workaround for https://github.com/NixOS/nix/issues/6895
|
||||||
# via https://git.lix.systems/lix-project/lix/issues/400
|
# via https://git.lix.systems/lix-project/lix/issues/400
|
||||||
environment.etc = lib.mkIf (!config.virtualisation.isVmVariant) {
|
environment.etc."current-system-flake-inputs.json".source
|
||||||
"current-system-flake-inputs.json".source
|
= pkgs.writers.writeJSON "flake-inputs.json" (
|
||||||
= pkgs.writers.writeJSON "flake-inputs.json" (
|
lib.flip lib.mapAttrs inputs (name: input:
|
||||||
lib.flip lib.mapAttrs inputs (name: input:
|
# inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
|
||||||
# inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
|
lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
|
||||||
lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
|
// { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
|
||||||
// { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
|
)
|
||||||
)
|
);
|
||||||
);
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,24 +0,0 @@
|
|||||||
{ config, lib, values, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.journald.upload;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
services.journald.upload = {
|
|
||||||
enable = lib.mkDefault true;
|
|
||||||
settings.Upload = {
|
|
||||||
# URL = "https://journald.pvv.ntnu.no:${toString config.services.journald.remote.port}";
|
|
||||||
URL = "https://${values.hosts.ildkule.ipv4}:${toString config.services.journald.remote.port}";
|
|
||||||
ServerKeyFile = "-";
|
|
||||||
ServerCertificateFile = "-";
|
|
||||||
TrustedCertificateFile = "-";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services."systemd-journal-upload".serviceConfig = lib.mkIf cfg.enable {
|
|
||||||
IPAddressDeny = "any";
|
|
||||||
IPAddressAllow = [
|
|
||||||
values.hosts.ildkule.ipv4
|
|
||||||
values.hosts.ildkule.ipv6
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -40,25 +40,6 @@
|
|||||||
};
|
};
|
||||||
|
|
||||||
services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
|
services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
|
||||||
listen = [
|
|
||||||
{
|
|
||||||
addr = "0.0.0.0";
|
|
||||||
extraParameters = [
|
|
||||||
"default_server"
|
|
||||||
# Seemingly the default value of net.core.somaxconn
|
|
||||||
"backlog=4096"
|
|
||||||
"deferred"
|
|
||||||
];
|
|
||||||
}
|
|
||||||
{
|
|
||||||
addr = "[::0]";
|
|
||||||
extraParameters = [
|
|
||||||
"default_server"
|
|
||||||
"backlog=4096"
|
|
||||||
"deferred"
|
|
||||||
];
|
|
||||||
}
|
|
||||||
];
|
|
||||||
sslCertificate = "/etc/certs/nginx.crt";
|
sslCertificate = "/etc/certs/nginx.crt";
|
||||||
sslCertificateKey = "/etc/certs/nginx.key";
|
sslCertificateKey = "/etc/certs/nginx.key";
|
||||||
addSSL = true;
|
addSSL = true;
|
||||||
|
|||||||
@@ -1,15 +0,0 @@
|
|||||||
{ config, lib, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.security.polkit;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
security.polkit.enable = true;
|
|
||||||
|
|
||||||
environment.etc."polkit-1/rules.d/9-nixos-overrides.rules".text = lib.mkIf cfg.enable ''
|
|
||||||
polkit.addAdminRule(function(action, subject) {
|
|
||||||
if(subject.isInGroup("wheel")) {
|
|
||||||
return ["unix-user:"+subject.user];
|
|
||||||
}
|
|
||||||
});
|
|
||||||
'';
|
|
||||||
}
|
|
||||||
@@ -6,17 +6,18 @@ in
|
|||||||
services.postfix = {
|
services.postfix = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
settings.main = {
|
hostname = "${config.networking.hostName}.pvv.ntnu.no";
|
||||||
myhostname = "${config.networking.hostName}.pvv.ntnu.no";
|
domain = "pvv.ntnu.no";
|
||||||
mydomain = "pvv.ntnu.no";
|
|
||||||
|
|
||||||
# Nothing should be delivered to this machine
|
relayHost = "smtp.pvv.ntnu.no";
|
||||||
mydestination = [ ];
|
relayPort = 465;
|
||||||
|
|
||||||
relayhost = [ "smtp.pvv.ntnu.no:465" ];
|
|
||||||
|
|
||||||
|
config = {
|
||||||
smtp_tls_wrappermode = "yes";
|
smtp_tls_wrappermode = "yes";
|
||||||
smtp_tls_security_level = "encrypt";
|
smtp_tls_security_level = "encrypt";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
# Nothing should be delivered to this machine
|
||||||
|
destination = [ ];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
{ config, lib, values, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.prometheus.exporters.node;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
services.prometheus.exporters.node = {
|
|
||||||
enable = lib.mkDefault true;
|
|
||||||
port = 9100;
|
|
||||||
enabledCollectors = [ "systemd" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.prometheus-node-exporter.serviceConfig = lib.mkIf cfg.enable {
|
|
||||||
IPAddressDeny = "any";
|
|
||||||
IPAddressAllow = [
|
|
||||||
"127.0.0.1"
|
|
||||||
"::1"
|
|
||||||
values.hosts.ildkule.ipv4
|
|
||||||
values.hosts.ildkule.ipv6
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
|
|
||||||
}
|
|
||||||
@@ -1,26 +0,0 @@
|
|||||||
{ config, lib, values, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.prometheus.exporters.systemd;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
services.prometheus.exporters.systemd = {
|
|
||||||
enable = lib.mkDefault true;
|
|
||||||
port = 9101;
|
|
||||||
extraFlags = [
|
|
||||||
"--systemd.collector.enable-restart-count"
|
|
||||||
"--systemd.collector.enable-ip-accounting"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.prometheus-systemd-exporter.serviceConfig = {
|
|
||||||
IPAddressDeny = "any";
|
|
||||||
IPAddressAllow = [
|
|
||||||
"127.0.0.1"
|
|
||||||
"::1"
|
|
||||||
values.hosts.ildkule.ipv4
|
|
||||||
values.hosts.ildkule.ipv6
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
|
|
||||||
}
|
|
||||||
@@ -1,38 +0,0 @@
|
|||||||
{ config, lib, values, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.prometheus.exporters.node;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
services.promtail = {
|
|
||||||
enable = lib.mkDefault true;
|
|
||||||
configuration = {
|
|
||||||
server = {
|
|
||||||
http_listen_port = 28183;
|
|
||||||
grpc_listen_port = 0;
|
|
||||||
};
|
|
||||||
clients = [{
|
|
||||||
url = "http://ildkule.pvv.ntnu.no:3100/loki/api/v1/push";
|
|
||||||
}];
|
|
||||||
scrape_configs = [{
|
|
||||||
job_name = "systemd-journal";
|
|
||||||
journal = {
|
|
||||||
max_age = "12h";
|
|
||||||
labels = {
|
|
||||||
job = "systemd-journal";
|
|
||||||
host = config.networking.hostName;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
relabel_configs = [
|
|
||||||
{
|
|
||||||
source_labels = [ "__journal__systemd_unit" ];
|
|
||||||
target_label = "unit";
|
|
||||||
}
|
|
||||||
{
|
|
||||||
source_labels = [ "__journal_priority_keyword" ];
|
|
||||||
target_label = "level";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
}];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
{ lib, values, ... }:
|
|
||||||
{
|
|
||||||
services.roowho2.enable = lib.mkDefault true;
|
|
||||||
|
|
||||||
systemd.sockets.roowho2-rwhod.socketConfig = {
|
|
||||||
IPAddressDeny = "any";
|
|
||||||
IPAddressAllow = [
|
|
||||||
"127.0.0.1"
|
|
||||||
values.ipv4-space
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,103 +0,0 @@
|
|||||||
# Miscellaneous development notes
|
|
||||||
|
|
||||||
This document contains a bunch of information that is not particularly specific to the pvv nixos config,
|
|
||||||
but concerns technologies we use often or gotchas to be aware of when working with NixOS. A lot of the information
|
|
||||||
here is already public information spread around the internet, but we've collected some of the items we use often
|
|
||||||
here.
|
|
||||||
|
|
||||||
## The firewall
|
|
||||||
|
|
||||||
`networking.firewall` is a NixOS module that configures `iptables` rules on the machine. It is enabled by default on
|
|
||||||
all of our machines, and it can be easy to forget about it when setting up new services, especially when we are the
|
|
||||||
ones creating the NixOS module.
|
|
||||||
|
|
||||||
When setting up a new service that listens on a TCP or UDP port, make sure to add the appropriate ports to either
|
|
||||||
`networking.firewall.allowedTCPPorts` or `networking.firewall.allowedUDPPorts`.
|
|
||||||
|
|
||||||
You can list out the current firewall rules by running `sudo iptables -L -n -v` on the machine.
|
|
||||||
|
|
||||||
## Finding stuff
|
|
||||||
|
|
||||||
Finding stuff, both underlying implementation and usage is absolutely crucial when working on nix.
|
|
||||||
Oftentimes, the documentation will be outdated, lacking or just plain out wrong. These are some of
|
|
||||||
the techniques we have found to be quite good when working with nix.
|
|
||||||
|
|
||||||
### [ripgrep](https://github.com/BurntSushi/ripgrep)
|
|
||||||
|
|
||||||
ripgrep (or `rg` for short) is a tool that lets you recursively grep for regex patters in a directory.
|
|
||||||
|
|
||||||
It is great for finding references to configuration, and where and how certain things are used. It is
|
|
||||||
especially great when working with [nixpkgs](https://github.com/NixOS/nixpkgs), which is quite large.
|
|
||||||
|
|
||||||
### GitHub Search
|
|
||||||
|
|
||||||
When trying to set up a new service or reconfigure something, it is very common that someone has done it
|
|
||||||
before you, but it has never been documented anywhere. A lot of Nix code exists on GitHub, and you can
|
|
||||||
easily query it by using the `lang:nix` filter in the search bar.
|
|
||||||
|
|
||||||
For example: https://github.com/search?q=lang%3Anix+dibbler&type=code
|
|
||||||
|
|
||||||
## rsync
|
|
||||||
|
|
||||||
`rsync` is a tool for synchronizing files between machines. It is very useful when transferring large
|
|
||||||
amounts of data from a to b. We use it for multiple things, often when data is produced or stored on
|
|
||||||
one machine, and we want to process or convert it on another. For example, we use it to transfer gitea
|
|
||||||
artifacts, to transfer gallery pictures, to transfer minecraft world data for map rendering, and more.
|
|
||||||
|
|
||||||
Along with `rsync`, we often use a lesser known tool called `rrsync`, which you can use inside an ssh
|
|
||||||
configuration (`authorized_keys` file) to restrict what paths a user can access when connecting over ssh.
|
|
||||||
This is useful both as a security measure, but also to avoid accidental overwrites of files outside the intended
|
|
||||||
path. `rrsync` will use chroot to restrict what paths the user can access, as well as refuse to run arbitrary commands.
|
|
||||||
|
|
||||||
## `nix repl`
|
|
||||||
|
|
||||||
`nix repl` is an interactive REPL for the Nix language. It is very useful for experimenting with Nix code,
|
|
||||||
and testing out small snippets of code to make sure it behaves as expected. You can also use it to explore
|
|
||||||
NixOS machine configurations, to interactively see that the configuration evaluates to what you expect.
|
|
||||||
|
|
||||||
```
|
|
||||||
# While in the pvv-nixos-config directory
|
|
||||||
nix repl .
|
|
||||||
|
|
||||||
# Upon writing out the config path and clickin [Tab], you will get autocompletion suggestions:
|
|
||||||
nix-repl> nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts._
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.bekkalokk.pvv.ntnu.no-nixos-metrics
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.idp.pvv.ntnu.no
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.minecraft.pvv.ntnu.no
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.pvv.ntnu.no
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.pvv.org
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.pw.pvv.ntnu.no
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.roundcubeplaceholder.example.com
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.snappymail.pvv.ntnu.no
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.webmail.pvv.ntnu.no
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.wiki.pvv.ntnu.no
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.www.pvv.ntnu.no
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.www.pvv.org
|
|
||||||
```
|
|
||||||
|
|
||||||
## `nix why-depends`
|
|
||||||
|
|
||||||
If you ever wonder why a certain package is being used as a dependency of another package,
|
|
||||||
or another machine, you can use `nix why-depends` to find the dependency path from one package to another.
|
|
||||||
This is often useful after updating nixpkgs and finding an error saying that a certain package is insecure,
|
|
||||||
broken or whatnot. You can do something like the following
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Why does bekkalokk depend on openssl?
|
|
||||||
nix why-depends .#nixosConfigurations.bekkalokk.config.system.build.toplevel .#nixosConfigurations.bekkalokk.pkgs.openssl
|
|
||||||
|
|
||||||
# Why does bekkalokk's minecraft-server depend on zlib? (this is not real)
|
|
||||||
nix why-depends .#nixosConfigurations.bekkalokk.pkgs.minecraft-server .#nixosConfigurations.bekkalokk.pkgs.zlib
|
|
||||||
```
|
|
||||||
|
|
||||||
## php-fpm
|
|
||||||
|
|
||||||
php-fpm (FastCGI Process Manager) is a PHP implementation that is designed for speed and production use. We host a bunch
|
|
||||||
of different PHP applications (including our own website), and so we use php-fpm quite a bit. php-fpm typically exposes a
|
|
||||||
unix socket that nginx will connect to, and php-fpm will then render php upon web requests forwarded from nginx and return
|
|
||||||
it.
|
|
||||||
|
|
||||||
php-fpm has a tendency to be a bit hard to debug. It is not always very willing to spit out error messages and logs, and so
|
|
||||||
it can be a bit hard to figure out what's up when something goes wrong. You should see some of the commented stuff laying around
|
|
||||||
in the website code on bekkalokk for examples of how to configure php-fpm for better logging and error reporting.
|
|
||||||
@@ -1,169 +0,0 @@
|
|||||||
# Development - working on the PVV machines
|
|
||||||
|
|
||||||
This document outlines the process of editing our NixOS configurations, and testing and deploying said changes
|
|
||||||
to the machines. Most of the information written here is specific to the PVV NixOS configuration, and the topics
|
|
||||||
will not really cover the nix code itself in detail. You can find some more resources for that by either following
|
|
||||||
the links from the *Upstream documentation* section below, or in [Miscellaneous development notes](./development-misc.md).
|
|
||||||
|
|
||||||
## Editing nix files
|
|
||||||
|
|
||||||
> [!WARNING]
|
|
||||||
> Before editing any nix files, make sure to read [Secret management and `sops-nix`](./secret-management.md)!
|
|
||||||
> We do not want to add any secrets in plaintext to the nix files, and certainly not commit and publish
|
|
||||||
> them into the common public.
|
|
||||||
|
|
||||||
The files are plaintext code, written in the [`Nix` language](https://nix.dev/manual/nix/stable/language/).
|
|
||||||
|
|
||||||
Below is a list of important files and directories, and a description of what they contain.
|
|
||||||
|
|
||||||
### `flake.nix`
|
|
||||||
|
|
||||||
The `flake.nix` file is a [nix flake](https://wiki.nixos.org/wiki/Flakes) and makes up the entrypoint of the
|
|
||||||
entire configuration. It declares what inputs are used (similar to dependencies), as well as what outputs the
|
|
||||||
flake exposes. In our case, the most important outputs are the `nixosConfigurations` (our machine configs), but
|
|
||||||
we also expose custom modules, packages, devshells, and more. You can run `nix flake show` to get an overview of
|
|
||||||
the outputs (however you will need to [enable the `nix-flakes` experimental option](https://wiki.nixos.org/wiki/Flakes#Setup)).
|
|
||||||
|
|
||||||
You will find that a lot of the flake inputs are the different PVV projects that we develop, imported to be hosted
|
|
||||||
on the NixOS machines. This makes it easy to deploy changes to these projects, as we can just update the flake input
|
|
||||||
to point to a new commit or version, and then rebuild the machines.
|
|
||||||
|
|
||||||
A NixOS configuration is usually made with the `nixpkgs.lib.nixosSystem` function, however we have a few custom wrapper
|
|
||||||
functions named `nixosConfig` and `stableNixosConfig` that abstracts away some common configuration we want on all our machines.
|
|
||||||
|
|
||||||
### `values.nix`
|
|
||||||
|
|
||||||
`values.nix` is a somewhat rare pattern in NixOS configurations around the internet. It contains a bunch of constant values
|
|
||||||
that we use throughout the configuration, such as IP addresses, DNS names, paths and more. This not only makes it easier to
|
|
||||||
change the values should we need to, but it also makes the configuration more readable. Instead of caring what exact IP any
|
|
||||||
machine has, you can write `values.machines.name.ipv4` and abstract the details away.
|
|
||||||
|
|
||||||
### `base`
|
|
||||||
|
|
||||||
The `base` directory contains a bunch of NixOS configuration that is common for all or most machines. Some of the config
|
|
||||||
you will find here sets defaults for certain services without enabling them, so that when they are enabled in a machine config,
|
|
||||||
we don't need to repeat the same defaults over again. Other parts actually enable certain services that we want on all machines,
|
|
||||||
such as `openssh` or the auto upgrade timer.
|
|
||||||
|
|
||||||
### Vendoring `modules` and `packages`
|
|
||||||
|
|
||||||
Sometimes, we either find that the packages or modules provided by `nixpkgs` is not sufficient for us,
|
|
||||||
or that they are bugged in some way that can not be easily overrided. There are also cases where the
|
|
||||||
modules or packages does not exist. In these cases, we tend to either copy and modify the modules and
|
|
||||||
packages from nixpkgs, or create our own. These modules and packages end up in the top-level `modules`
|
|
||||||
and `packages` directories. They are usually exposed in `flake.nix` as flake outputs `nixosModules.<name>`
|
|
||||||
and `packages.<platform>.<name>`, and they are usually also added to the machines that need them in the flake.
|
|
||||||
|
|
||||||
In order to override or add an extra package, the easiest way is to use an [`overlay`](https://wiki.nixos.org/wiki/Overlays).
|
|
||||||
This makes it so that the package from `pkgs.<name>` now refers to the modified variant of the package.
|
|
||||||
|
|
||||||
In order to add a module, you can just register it in the modules of the nixos machine.
|
|
||||||
In order to override a module, you also have to use `disabledModules = [ "<path-relative-to-nixpkgs/modules>" ];`.
|
|
||||||
Use `rg` to find examples of the latter.
|
|
||||||
|
|
||||||
Do note that if you believe a new module to be of high enough quality, or the change you are making to be
|
|
||||||
relevant for every nix user, you should strongly consider also creating a PR towards nixpkgs. However,
|
|
||||||
getting changes made there has a bit higher threshold and takes more time than making changes in the PVV config,
|
|
||||||
so feel free to make the changes here first. We can always remove the changes again once the upstreaming is finished.
|
|
||||||
|
|
||||||
### `users`, `secrets` and `keys`
|
|
||||||
|
|
||||||
For `users`, see [User management](./users.md)
|
|
||||||
|
|
||||||
For `secrets` and `keys`, see [Secret management and `sops-nix`](./secret-management.md)
|
|
||||||
|
|
||||||
### Collaboration
|
|
||||||
|
|
||||||
We use our gitea to collaborate on changes to the nix configuration. Every PVV maintenance member should have
|
|
||||||
access to the repository. The usual workflow is that we create a branch for the change we want to make, do a bunch
|
|
||||||
of commits and changes, and then open a merge request for review (or just rebase on master if you know what you are doing).
|
|
||||||
|
|
||||||
### Upstream documentation
|
|
||||||
|
|
||||||
Here are different sources of documentation and stuff that you might find useful while
|
|
||||||
writing, editing and debugging nix code.
|
|
||||||
|
|
||||||
- [nixpkgs repository](https://github.com/NixOS/nixpkgs)
|
|
||||||
|
|
||||||
This is particularly useful to read the source code, as well as upstreaming pieces of code that we think
|
|
||||||
everyone would want
|
|
||||||
|
|
||||||
- [NixOS search](https://search.nixos.org/)
|
|
||||||
|
|
||||||
This is useful for searching for both packages and NixOS options.
|
|
||||||
|
|
||||||
- [nixpkgs documentation](https://nixos.org/manual/nixpkgs/stable/)
|
|
||||||
- [NixOS documentation](https://nixos.org/manual/nixos/stable/)
|
|
||||||
- [nix (the tool) documentation](https://nix.dev/manual/nix/stable/)
|
|
||||||
|
|
||||||
All of the three above make up the official documentation with all technical
|
|
||||||
details about the different pieces that makes up NixOS.
|
|
||||||
|
|
||||||
- [The official NixOS wiki](https://wiki.nixos.org)
|
|
||||||
|
|
||||||
User-contributed guides, tips and tricks, and whatever else.
|
|
||||||
|
|
||||||
- [nix.dev](https://nix.dev)
|
|
||||||
|
|
||||||
Additional stuff
|
|
||||||
|
|
||||||
- [Noogle](https://noogle.dev)
|
|
||||||
|
|
||||||
This is useful when looking for nix functions and packaging helpers.
|
|
||||||
|
|
||||||
## Testing and deploying changes
|
|
||||||
|
|
||||||
After editing the nix files on a certain branch, you will want to test and deploy the changes to the machines.
|
|
||||||
Unfortunately, we don't really have a good setup for testing for runtime correctness locally, but we can at least
|
|
||||||
make sure that the code evaluates and builds correctly before deploying.
|
|
||||||
|
|
||||||
To just check that the code evaluates without errors, you can run:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
nix flake check
|
|
||||||
# Or if you want to keep getting all errors before it quits:
|
|
||||||
nix flake check --keep-going
|
|
||||||
```
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> If you are making changes that involves creating new nix files, remember to `git add` those files before running
|
|
||||||
> any nix commands. Nix refuses to acknowledge files that are not either commited or at least staged. It will spit
|
|
||||||
> out an error message about not finding the file in question.
|
|
||||||
|
|
||||||
### Building machine configurations
|
|
||||||
|
|
||||||
To build any specific machine configuration and look at the output, you can run:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
nix build .#nixosConfigurations.<machine-name>.config.system.build.toplevel
|
|
||||||
# or just
|
|
||||||
nix build .#<machine-name>
|
|
||||||
```
|
|
||||||
|
|
||||||
This will create a symlink name `./result` to a directory containing the built NixOS system. It is oftentimes
|
|
||||||
the case that config files for certain services only end up in the nix store without being put into `/etc`. If you wish
|
|
||||||
to read those files, you can often find them by looking at the systemd unit files in `./result/etc/systemd/system/`.
|
|
||||||
(if you are using vim, `gf` or go-to-file while the cursor is over a file path is a useful trick while doing this).
|
|
||||||
|
|
||||||
If you have edited something that affects multiple machines, you can also build all important machines at once by running:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
nix build .#
|
|
||||||
```
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> Building all machines at once can take a long time, depending on what has changed and whether you have already
|
|
||||||
> built some of the machines recently. Be prepared to wait for up to an hour to build all machines from scratch
|
|
||||||
> if this is the first time.
|
|
||||||
|
|
||||||
### Forcefully reset to `main`
|
|
||||||
|
|
||||||
If you ever want to reset a machine to the `main` branch, you can do so by running:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --upgrade --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git
|
|
||||||
```
|
|
||||||
|
|
||||||
This will ignore the current branch and just pull the latest `main` from the git repository directly from gitea.
|
|
||||||
You can also use this command if there are updates on the `main` branch that you want to deploy to the machine without
|
|
||||||
waiting for the nightly rebuild.
|
|
||||||
@@ -1,160 +0,0 @@
|
|||||||
# Secret management and `sops-nix`
|
|
||||||
|
|
||||||
Nix config is love, nix config is life, and publishing said config to the
|
|
||||||
internet is not only a good deed and kinda cool, but also encourages properly
|
|
||||||
secured configuration as opposed to [security through obscurity](https://en.wikipedia.org/wiki/Security_through_obscurity).
|
|
||||||
That being said, there are some details of the config that we really shouldn't
|
|
||||||
share with the general public. In particular, there are so-called *secrets*, that is
|
|
||||||
API keys, passwords, tokens, cookie secrets, salts, peppers and jalapenos that we'd
|
|
||||||
rather keep to ourselves. However, it is not entirely trivial to do so in the NixOS config.
|
|
||||||
For one, we'd have to keep these secrets out of the public git repo somehow, and secondly
|
|
||||||
everything that is configured via nix ends up as world readable files (i.e. any user on the
|
|
||||||
system can read the file) in `/nix/store`.
|
|
||||||
|
|
||||||
In order to solve this, we use a NixOS module called [`sops-nix`](https://github.com/Mic92/sops-nix)
|
|
||||||
which uses a technology called [`sops`](https://github.com/getsops/sops) behind the scenes.
|
|
||||||
The idea is simple: we encrypt these secrets with a bunch of different keys and store the
|
|
||||||
encrypted files in the git repo. First of all, we encrypt the secrets a bunch of time with
|
|
||||||
PVV maintenance member's keys, so that we can decrypt and edit the contents. Secondly, we
|
|
||||||
encrypt the secrets with the [host keys]() of the NixOS machines, so that they can decrypt
|
|
||||||
the secrets. The secrets will be decrypted and stored in a well-known location (usually `/run/secrets`)
|
|
||||||
so that they do not end up in the nix store, and are not world readable.
|
|
||||||
|
|
||||||
This way, we can both keep the secrets in the git repository and let multiple people edit them,
|
|
||||||
but also ensure that they don't end up in the wrong hands.
|
|
||||||
|
|
||||||
## Adding a new machine
|
|
||||||
|
|
||||||
In order to add a new machine to the nix-sops setup, you should do the following:
|
|
||||||
|
|
||||||
```console
|
|
||||||
# Create host keys (if they don't already exist)
|
|
||||||
ssh-keygen -A -b 4096
|
|
||||||
|
|
||||||
# Derive an age-key from the public host key
|
|
||||||
nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
|
|
||||||
|
|
||||||
# Register the age key in .sops.yaml
|
|
||||||
vim .sops.yaml
|
|
||||||
```
|
|
||||||
|
|
||||||
The contents of `.sops.yaml` should look like this:
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
keys:
|
|
||||||
# Users
|
|
||||||
...
|
|
||||||
|
|
||||||
# Hosts
|
|
||||||
...
|
|
||||||
- &host_<machine_name> <public_age_key>
|
|
||||||
|
|
||||||
creation_rules:
|
|
||||||
...
|
|
||||||
|
|
||||||
- path_regex: secrets/<machine_name>/[^/]+\.yaml$
|
|
||||||
key_groups:
|
|
||||||
- age:
|
|
||||||
- *host_<machine_name>
|
|
||||||
- ... user keys
|
|
||||||
- pgp:
|
|
||||||
- ... user keys
|
|
||||||
```
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> Take care that all the keys in the `age` and `pgp` sections are prefixed
|
|
||||||
> with a `-`, or else sops might try to encrypt the secrets in a way where
|
|
||||||
> you need both keys present to decrypt the content. Also, it tends to throw
|
|
||||||
> interesting errors when it fails to do so.
|
|
||||||
|
|
||||||
```console
|
|
||||||
# While cd-ed into the repository, run this to get a shell with the `sops` tool present
|
|
||||||
nix-shell
|
|
||||||
```
|
|
||||||
|
|
||||||
Now you should also be able to edit secrets for this machine by running:
|
|
||||||
|
|
||||||
```
|
|
||||||
sops secrets/<machine_name>/<machine_name>.yaml
|
|
||||||
```
|
|
||||||
|
|
||||||
## Adding a user
|
|
||||||
|
|
||||||
Adding a user is quite similar to adding a new machine.
|
|
||||||
This guide assumes you have already set up SSH keys.
|
|
||||||
|
|
||||||
```
|
|
||||||
# Derive an age-key from your key
|
|
||||||
# (edit the path to the key if it is named something else)
|
|
||||||
nix-shell -p ssh-to-age --run 'cat ~/.ssh/id_ed25519.pub | ssh-to-age'
|
|
||||||
|
|
||||||
# Register the age key in .sops.yaml
|
|
||||||
vim .sops.yaml
|
|
||||||
```
|
|
||||||
|
|
||||||
The contents of `.sops.yaml` should look like this:
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
keys:
|
|
||||||
# Users
|
|
||||||
...
|
|
||||||
- &user_<user_name> <public_age_key>
|
|
||||||
|
|
||||||
# Hosts
|
|
||||||
...
|
|
||||||
|
|
||||||
creation_rules:
|
|
||||||
...
|
|
||||||
|
|
||||||
# Do this for all the machines you are planning to edit
|
|
||||||
# (or just do it for all machines)
|
|
||||||
- path_regex: secrets/<machine_name>/[^/]+\.yaml$
|
|
||||||
key_groups:
|
|
||||||
- age:
|
|
||||||
- *host_<machine_name>
|
|
||||||
- ... user keys
|
|
||||||
- *host_<user_name>
|
|
||||||
- pgp:
|
|
||||||
- ... user keys
|
|
||||||
```
|
|
||||||
|
|
||||||
Now that sops is properly configured to recognize the key, you need someone
|
|
||||||
who already has access to decrypt all the secrets and re-encrypt them with your
|
|
||||||
key. At this point, you should probably [open a PR](https://docs.gitea.com/usage/issues-prs/pull-request)
|
|
||||||
and ask someone in PVV maintenance if they can checkout the PR branch, run the following
|
|
||||||
command and push the diff back into the PR (and maybe even ask them to merge if you're feeling
|
|
||||||
particularly needy).
|
|
||||||
|
|
||||||
```console
|
|
||||||
sops updatekeys secrets/*/*.yaml
|
|
||||||
```
|
|
||||||
|
|
||||||
## Updating keys
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> At some point, we found this flag called `sops -r` that seemed to be described to do what
|
|
||||||
> `sops updatekeys` does, do not be fooled. This only rotates the "inner key" for those who
|
|
||||||
> already have the secrets encrypted with their key.
|
|
||||||
|
|
||||||
Updating keys is done with this command:
|
|
||||||
|
|
||||||
```console
|
|
||||||
sops updatekeys secrets/*/*.yaml
|
|
||||||
```
|
|
||||||
|
|
||||||
However, there is a small catch. [oysteikt](https://git.pvv.ntnu.no/oysteikt) has kinda been
|
|
||||||
getting gray hairs lately, and refuses to use modern technology - he is still stuck using GPG.
|
|
||||||
This means that to be able to re-encrypt the sops secrets, you will need to have a gpg keychain
|
|
||||||
with his latest public key available. The key has an expiry date, so if he forgets to update it,
|
|
||||||
you should send him and angry email and tag him a bunch of times in a gitea issue. If the key
|
|
||||||
is up to date, you can do the following:
|
|
||||||
|
|
||||||
```console
|
|
||||||
# Fetch gpg (unless you have it already)
|
|
||||||
nix-shell -p gpg
|
|
||||||
|
|
||||||
# Import oysteikts key to the gpg keychain
|
|
||||||
gpg --import ./keys/oysteikt.pub
|
|
||||||
```
|
|
||||||
|
|
||||||
Now you should be able to run the `sops updatekeys` command again.
|
|
||||||
@@ -1,50 +0,0 @@
|
|||||||
# User management
|
|
||||||
|
|
||||||
Due to some complications with how NixOS creates users compared to how we used to
|
|
||||||
create users with the salt-based setup, the NixOS machine users are created and
|
|
||||||
managed separately. We tend to create users on-demand, whenever someone in PVV
|
|
||||||
maintenance want to work on the NixOS machines.
|
|
||||||
|
|
||||||
## Setting up a new user
|
|
||||||
|
|
||||||
You can find the files for the existing users, and thereby examples of user files
|
|
||||||
in the [`users`](../users) directory. When creating a new file here, you should name it
|
|
||||||
`your-username.nix`, and add *at least* the following contents:
|
|
||||||
|
|
||||||
```nix
|
|
||||||
{ pkgs, ... }:
|
|
||||||
{
|
|
||||||
users.users."<username>" = {
|
|
||||||
isNormalUser = true;
|
|
||||||
extraGroups = [
|
|
||||||
"wheel" # In case you wanna use sudo (you probably do)
|
|
||||||
"nix-builder-users" # Arbitrary access to write to the nix store
|
|
||||||
];
|
|
||||||
|
|
||||||
# Any packages you frequently use to manage servers go here.
|
|
||||||
# Please don't pull gigantonormous packages here unless you
|
|
||||||
# absolutely need them, and remember that any package can be
|
|
||||||
# pulled via nix-shell if you only use it once in a blue moon.
|
|
||||||
packages = with pkgs; [
|
|
||||||
bottom
|
|
||||||
eza
|
|
||||||
];
|
|
||||||
|
|
||||||
# Not strictly needed, but we recommend adding your public SSH
|
|
||||||
# key here. If it is not present, you will have to log into the
|
|
||||||
# machine as 'root' before setting your password for every NixOS
|
|
||||||
# machine you have not logged into yet.
|
|
||||||
openssh.authorizedKeys.keys = [
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjiQ0wg4lpC7YBMAAHoGmgwqHOBi+EUz5mmCymGlIyT my-key"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
The file will be picked up automatically, so creating the file and adding the
|
|
||||||
contents should be enough to get you registered. You should
|
|
||||||
[open a PR](https://docs.gitea.com/usage/issues-prs/pull-request) with the new
|
|
||||||
code so the machines will be rebuilt with your user present.
|
|
||||||
|
|
||||||
See also [Secret Management](./secret-management.md) for how to add your keys to the
|
|
||||||
system that lets us add secrets (API keys, password, etc.) to the NixOS config.
|
|
||||||
331
flake.lock
generated
331
flake.lock
generated
@@ -1,27 +1,5 @@
|
|||||||
{
|
{
|
||||||
"nodes": {
|
"nodes": {
|
||||||
"dibbler": {
|
|
||||||
"inputs": {
|
|
||||||
"flake-utils": "flake-utils",
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1768138611,
|
|
||||||
"narHash": "sha256-KfZX6wpuwE2IRKLjh0DrEviE4f6kqLJWwKIE5QJSqa4=",
|
|
||||||
"ref": "main",
|
|
||||||
"rev": "cb385097dcda5fb9772f903688d078b30a66ccd4",
|
|
||||||
"revCount": 221,
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"ref": "main",
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"disko": {
|
"disko": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
@@ -29,55 +7,19 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1736864502,
|
"lastModified": 1745502102,
|
||||||
"narHash": "sha256-ItkIZyebGvNH2dK9jVGzJHGPtb6BSWLN8Gmef16NeY0=",
|
"narHash": "sha256-LqhRwzvIVPEjH0TaPgwzqpyhW6DtCrvz7FnUJDoUZh8=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "disko",
|
"repo": "disko",
|
||||||
"rev": "0141aabed359f063de7413f80d906e1d98c0c123",
|
"rev": "ca27b88c88948d96feeee9ed814cbd34f53d0d70",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"ref": "v1.11.0",
|
|
||||||
"repo": "disko",
|
"repo": "disko",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"flake-parts": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs-lib": "nixpkgs-lib"
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1765835352,
|
|
||||||
"narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
|
|
||||||
"owner": "hercules-ci",
|
|
||||||
"repo": "flake-parts",
|
|
||||||
"rev": "a34fae9c08a15ad73f295041fec82323541400a9",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "hercules-ci",
|
|
||||||
"repo": "flake-parts",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"flake-utils": {
|
|
||||||
"inputs": {
|
|
||||||
"systems": "systems"
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1731533236,
|
|
||||||
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
|
|
||||||
"owner": "numtide",
|
|
||||||
"repo": "flake-utils",
|
|
||||||
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"id": "flake-utils",
|
|
||||||
"type": "indirect"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"gergle": {
|
"gergle": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
@@ -85,16 +27,15 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1767906545,
|
"lastModified": 1736621371,
|
||||||
"narHash": "sha256-LOf08pcjEQFLs3dLPuep5d1bAXWOFcdfxuk3YMb5KWw=",
|
"narHash": "sha256-45UIQSQA7R5iU4YWvilo7mQbhY1Liql9bHBvYa3qRI0=",
|
||||||
"ref": "main",
|
"ref": "refs/heads/main",
|
||||||
"rev": "e55cbe0ce0b20fc5952ed491fa8a553c8afb1bdd",
|
"rev": "3729796c1213fe76e568ac28f1df8de4e596950b",
|
||||||
"revCount": 23,
|
"revCount": 20,
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
|
"url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"ref": "main",
|
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
|
"url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
|
||||||
}
|
}
|
||||||
@@ -107,16 +48,15 @@
|
|||||||
"rust-overlay": "rust-overlay"
|
"rust-overlay": "rust-overlay"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1767906494,
|
"lastModified": 1746563623,
|
||||||
"narHash": "sha256-Dd6gtdZfRMAD6JhdX0GdJwIHVaBikePSpQXhIdwLlWI=",
|
"narHash": "sha256-5DxgNFpSgxft/sWraZnHIUlb4S3Io73SVS7FZCbWSUY=",
|
||||||
"ref": "main",
|
"ref": "refs/heads/main",
|
||||||
"rev": "7258822e2e90fea2ea00b13b5542f63699e33a9e",
|
"rev": "4e0408887f80e61a90286ff630a7855b828ae421",
|
||||||
"revCount": 61,
|
"revCount": 45,
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
|
"url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"ref": "main",
|
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
|
"url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
|
||||||
}
|
}
|
||||||
@@ -128,16 +68,15 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1764867811,
|
"lastModified": 1736178795,
|
||||||
"narHash": "sha256-UWHiwr8tIcGcVxMLvAdNxDbQ8QuHf3REHboyxvFkYEI=",
|
"narHash": "sha256-mPdi8cgvIDYcgG3FRG7A4BOIMu2Jef96TPMnV00uXlM=",
|
||||||
"ref": "master",
|
"ref": "refs/heads/master",
|
||||||
"rev": "c9983e947efe047ea9d6f97157a1f90e49d0eab3",
|
"rev": "fde738910de1fd8293535a6382c2f0c2749dd7c1",
|
||||||
"revCount": 81,
|
"revCount": 79,
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
|
"url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"ref": "master",
|
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
|
"url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
|
||||||
}
|
}
|
||||||
@@ -149,59 +88,31 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1764844095,
|
"lastModified": 1735857245,
|
||||||
"narHash": "sha256-Drf1orxsmFDzO+UbPo85gHjXW7QzAM+6oTPvI7vOSik=",
|
"narHash": "sha256-AKLLPrgXTxgzll3DqVUMa4QlPlRN3QceutgFBmEf8Nk=",
|
||||||
"owner": "dali99",
|
"owner": "dali99",
|
||||||
"repo": "nixos-matrix-modules",
|
"repo": "nixos-matrix-modules",
|
||||||
"rev": "25b9f31ef1dbc3987b4c716de716239f2b283701",
|
"rev": "da9dc0479ffe22362793c87dc089035facf6ec4d",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "dali99",
|
"owner": "dali99",
|
||||||
"ref": "v0.8.0",
|
"ref": "0.7.0",
|
||||||
"repo": "nixos-matrix-modules",
|
"repo": "nixos-matrix-modules",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"minecraft-heatmap": {
|
"minecraft-data": {
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs"
|
|
||||||
],
|
|
||||||
"rust-overlay": "rust-overlay_2"
|
|
||||||
},
|
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1767906976,
|
"lastModified": 1725277886,
|
||||||
"narHash": "sha256-igCg8I83eO+noF00raXVJqDxzLS2SrZN8fK5bnvO+xI=",
|
"narHash": "sha256-Fw4VbbE3EfypQWSgPDFfvVH47BHeg3ptsO715NlUM8Q=",
|
||||||
"ref": "main",
|
"ref": "refs/heads/master",
|
||||||
"rev": "626bc9b6bae6a997b347cdbe84080240884f2955",
|
"rev": "1b4087bd3322a2e2ba84271c8fcc013e6b641a58",
|
||||||
"revCount": 17,
|
"revCount": 2,
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"ref": "main",
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"minecraft-kartverket": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1768589887,
|
|
||||||
"narHash": "sha256-I5dIvg8BlytWngsqaA4t6/erfcy9zFCeETF1T0AXYPc=",
|
|
||||||
"ref": "main",
|
|
||||||
"rev": "a74844b8773fa2f47834775d180e28f8946a1e2c",
|
|
||||||
"revCount": 36,
|
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
|
"url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"ref": "main",
|
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
|
"url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
|
||||||
}
|
}
|
||||||
@@ -213,77 +124,39 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1767906352,
|
"lastModified": 1743881366,
|
||||||
"narHash": "sha256-wYsH9MMAPFG3XTL+3DwI39XMG0F2fTmn/5lt265a3Es=",
|
"narHash": "sha256-ScGA2IHPk9ugf9bqEZnp+YB/OJgrkZblnG/XLEKvJAo=",
|
||||||
"ref": "main",
|
"ref": "refs/heads/main",
|
||||||
"rev": "d054c5d064b8ed6d53a0adb0cf6c0a72febe212e",
|
"rev": "db2e4becf1b11e5dfd33de12a90a7d089fcf68ec",
|
||||||
"revCount": 13,
|
"revCount": 11,
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
|
"url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"ref": "main",
|
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
|
"url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nix-topology": {
|
|
||||||
"inputs": {
|
|
||||||
"flake-parts": "flake-parts",
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1768068512,
|
|
||||||
"narHash": "sha256-pH5wkcNOiXy4MBjDTe6A1gml+7m+ULC3lYMBPMqdS1w=",
|
|
||||||
"owner": "oddlama",
|
|
||||||
"repo": "nix-topology",
|
|
||||||
"rev": "4367a2093c5ff74fc478466aebf41d47ce0cacb4",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "oddlama",
|
|
||||||
"ref": "main",
|
|
||||||
"repo": "nix-topology",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"nixpkgs": {
|
"nixpkgs": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1768555036,
|
"lastModified": 1748615477,
|
||||||
"narHash": "sha256-qJTh3xrFsqrXDzUmjPGV0VC70vpsq/YP25Jo6Fh7PTs=",
|
"narHash": "sha256-8sjG4sNIonQPK2olCGvq3/j1qtjwPaTOFU5nkz1gj2Q=",
|
||||||
"rev": "1d2851ebcd64734ef057e8c80e05dd5600323792",
|
"rev": "97d3ce1ceb663a24184aac92b7e9e8f5452111c1",
|
||||||
"type": "tarball",
|
"type": "tarball",
|
||||||
"url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.4104.1d2851ebcd64/nixexprs.tar.xz"
|
"url": "https://releases.nixos.org/nixos/24.11-small/nixos-24.11.718472.97d3ce1ceb66/nixexprs.tar.xz?rev=97d3ce1ceb663a24184aac92b7e9e8f5452111c1"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"type": "tarball",
|
"type": "tarball",
|
||||||
"url": "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz"
|
"url": "https://nixos.org/channels/nixos-24.11-small/nixexprs.tar.xz"
|
||||||
}
|
|
||||||
},
|
|
||||||
"nixpkgs-lib": {
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1765674936,
|
|
||||||
"narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
|
|
||||||
"owner": "nix-community",
|
|
||||||
"repo": "nixpkgs.lib",
|
|
||||||
"rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "nix-community",
|
|
||||||
"repo": "nixpkgs.lib",
|
|
||||||
"type": "github"
|
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs-unstable": {
|
"nixpkgs-unstable": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1768553552,
|
"lastModified": 1748588304,
|
||||||
"narHash": "sha256-YeNMZDAxdQUMLcqZmoc+/WzYrJxTEg6Y7uNALUcF1dE=",
|
"narHash": "sha256-YCnUqO9k39p0oMIBndxYTbu8m0fOA/KVcq3IekXPy9c=",
|
||||||
"rev": "a6b8b0f0ceb6d4f5da70808e26c68044099460fd",
|
"rev": "b8af95f4cf511c5f056b463c3a45d2b63c7cfb03",
|
||||||
"type": "tarball",
|
"type": "tarball",
|
||||||
"url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre928681.a6b8b0f0ceb6/nixexprs.tar.xz"
|
"url": "https://releases.nixos.org/nixos/unstable-small/nixos-25.11pre807945.b8af95f4cf51/nixexprs.tar.xz?rev=b8af95f4cf511c5f056b463c3a45d2b63c7cfb03"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"type": "tarball",
|
"type": "tarball",
|
||||||
@@ -297,16 +170,15 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1764869785,
|
"lastModified": 1723850344,
|
||||||
"narHash": "sha256-FGTIpC7gB4lbeL0bfYzn1Ge0PaCpd7VqWBLhJBx0i4A=",
|
"narHash": "sha256-aT37O9l9eclWEnqxASVNBL1dKwDHZUOqdbA4VO9DJvw=",
|
||||||
"ref": "main",
|
"ref": "refs/heads/main",
|
||||||
"rev": "8ce7fb0b1918bdb3d1489a40d73895693955e8b2",
|
"rev": "38b66677ab8c01aee10cd59e745af9ce3ea88092",
|
||||||
"revCount": 23,
|
"revCount": 19,
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
|
"url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"ref": "main",
|
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
|
"url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
|
||||||
}
|
}
|
||||||
@@ -318,62 +190,35 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1768302565,
|
"lastModified": 1741738148,
|
||||||
"narHash": "sha256-VoH5i72/8EP53ApaNKMZD2OgkEn79nPxuxhaP9dPfLA=",
|
"narHash": "sha256-cJo6nbcJEOjkazkZ194NDnlsZe0W0wpxeUh2/886uC8=",
|
||||||
"ref": "main",
|
"ref": "refs/heads/main",
|
||||||
"rev": "f3c13b1aee073a83238ef13aceccd7dfce13d1fa",
|
"rev": "c1802e7cf27c7cf8b4890354c982a4eef5b11593",
|
||||||
"revCount": 570,
|
"revCount": 486,
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"ref": "main",
|
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"root": {
|
"root": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"dibbler": "dibbler",
|
|
||||||
"disko": "disko",
|
"disko": "disko",
|
||||||
"gergle": "gergle",
|
"gergle": "gergle",
|
||||||
"greg-ng": "greg-ng",
|
"greg-ng": "greg-ng",
|
||||||
"grzegorz-clients": "grzegorz-clients",
|
"grzegorz-clients": "grzegorz-clients",
|
||||||
"matrix-next": "matrix-next",
|
"matrix-next": "matrix-next",
|
||||||
"minecraft-heatmap": "minecraft-heatmap",
|
"minecraft-data": "minecraft-data",
|
||||||
"minecraft-kartverket": "minecraft-kartverket",
|
|
||||||
"nix-gitea-themes": "nix-gitea-themes",
|
"nix-gitea-themes": "nix-gitea-themes",
|
||||||
"nix-topology": "nix-topology",
|
|
||||||
"nixpkgs": "nixpkgs",
|
"nixpkgs": "nixpkgs",
|
||||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||||
"pvv-calendar-bot": "pvv-calendar-bot",
|
"pvv-calendar-bot": "pvv-calendar-bot",
|
||||||
"pvv-nettsiden": "pvv-nettsiden",
|
"pvv-nettsiden": "pvv-nettsiden",
|
||||||
"roowho2": "roowho2",
|
|
||||||
"sops-nix": "sops-nix"
|
"sops-nix": "sops-nix"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"roowho2": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs"
|
|
||||||
],
|
|
||||||
"rust-overlay": "rust-overlay_3"
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1768140181,
|
|
||||||
"narHash": "sha256-HfZzup5/jlu8X5vMUglTovVTSwhHGHwwV1YOFIL/ksA=",
|
|
||||||
"ref": "main",
|
|
||||||
"rev": "834463ed64773939798589ee6fd4adfe3a97dddd",
|
|
||||||
"revCount": 43,
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"ref": "main",
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"rust-overlay": {
|
"rust-overlay": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
@@ -382,53 +227,11 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1767840362,
|
"lastModified": 1746498961,
|
||||||
"narHash": "sha256-ZtsFqUhilubohNZ1TgpQIFsi4biZTwRH9rjZsDRDik8=",
|
"narHash": "sha256-rp+oh/N88JKHu7ySPuGiA3lBUVIsrOtHbN2eWJdYCgk=",
|
||||||
"owner": "oxalica",
|
"owner": "oxalica",
|
||||||
"repo": "rust-overlay",
|
"repo": "rust-overlay",
|
||||||
"rev": "d159ea1fc321c60f88a616ac28bab660092a227d",
|
"rev": "24b00064cdd1d7ba25200c4a8565dc455dc732ba",
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "oxalica",
|
|
||||||
"repo": "rust-overlay",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"rust-overlay_2": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"minecraft-heatmap",
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1766371695,
|
|
||||||
"narHash": "sha256-W7CX9vy7H2Jj3E8NI4djHyF8iHSxKpb2c/7uNQ/vGFU=",
|
|
||||||
"owner": "oxalica",
|
|
||||||
"repo": "rust-overlay",
|
|
||||||
"rev": "d81285ba8199b00dc31847258cae3c655b605e8c",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "oxalica",
|
|
||||||
"repo": "rust-overlay",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"rust-overlay_3": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"roowho2",
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1767322002,
|
|
||||||
"narHash": "sha256-yHKXXw2OWfIFsyTjduB4EyFwR0SYYF0hK8xI9z4NIn0=",
|
|
||||||
"owner": "oxalica",
|
|
||||||
"repo": "rust-overlay",
|
|
||||||
"rev": "03c6e38661c02a27ca006a284813afdc461e9f7e",
|
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@@ -444,34 +247,18 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1768481291,
|
"lastModified": 1745310711,
|
||||||
"narHash": "sha256-NjKtkJraCZEnLHAJxLTI+BfdU//9coAz9p5TqveZwPU=",
|
"narHash": "sha256-ePyTpKEJTgX0gvgNQWd7tQYQ3glIkbqcW778RpHlqgA=",
|
||||||
"owner": "Mic92",
|
"owner": "Mic92",
|
||||||
"repo": "sops-nix",
|
"repo": "sops-nix",
|
||||||
"rev": "e085e303dfcce21adcb5fec535d65aacb066f101",
|
"rev": "5e3e92b16d6fdf9923425a8d4df7496b2434f39c",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "Mic92",
|
"owner": "Mic92",
|
||||||
"ref": "master",
|
|
||||||
"repo": "sops-nix",
|
"repo": "sops-nix",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
|
||||||
"systems": {
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1681028828,
|
|
||||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
|
||||||
"owner": "nix-systems",
|
|
||||||
"repo": "default",
|
|
||||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "nix-systems",
|
|
||||||
"repo": "default",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"root": "root",
|
"root": "root",
|
||||||
|
|||||||
200
flake.nix
200
flake.nix
@@ -2,48 +2,35 @@
|
|||||||
description = "PVV System flake";
|
description = "PVV System flake";
|
||||||
|
|
||||||
inputs = {
|
inputs = {
|
||||||
nixpkgs.url = "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz";
|
nixpkgs.url = "https://nixos.org/channels/nixos-24.11-small/nixexprs.tar.xz";
|
||||||
nixpkgs-unstable.url = "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz";
|
nixpkgs-unstable.url = "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz";
|
||||||
|
|
||||||
sops-nix.url = "github:Mic92/sops-nix/master";
|
sops-nix.url = "github:Mic92/sops-nix";
|
||||||
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
disko.url = "github:nix-community/disko/v1.11.0";
|
disko.url = "github:nix-community/disko";
|
||||||
disko.inputs.nixpkgs.follows = "nixpkgs";
|
disko.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
nix-topology.url = "github:oddlama/nix-topology/main";
|
pvv-nettsiden.url = "git+https://git.pvv.ntnu.no/Projects/nettsiden.git";
|
||||||
nix-topology.inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
|
|
||||||
pvv-nettsiden.url = "git+https://git.pvv.ntnu.no/Projects/nettsiden.git?ref=main";
|
|
||||||
pvv-nettsiden.inputs.nixpkgs.follows = "nixpkgs";
|
pvv-nettsiden.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git?ref=main";
|
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
|
||||||
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
dibbler.url = "git+https://git.pvv.ntnu.no/Projects/dibbler.git?ref=main";
|
matrix-next.url = "github:dali99/nixos-matrix-modules/0.7.0";
|
||||||
dibbler.inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
|
|
||||||
matrix-next.url = "github:dali99/nixos-matrix-modules/v0.8.0";
|
|
||||||
matrix-next.inputs.nixpkgs.follows = "nixpkgs";
|
matrix-next.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git?ref=main";
|
nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git";
|
||||||
nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";
|
nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
|
greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git";
|
||||||
minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
|
|
||||||
roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main";
|
|
||||||
roowho2.inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
|
|
||||||
greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";
|
|
||||||
greg-ng.inputs.nixpkgs.follows = "nixpkgs";
|
greg-ng.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git?ref=main";
|
gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git";
|
||||||
gergle.inputs.nixpkgs.follows = "nixpkgs";
|
gergle.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git?ref=master";
|
grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git";
|
||||||
grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
|
grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
minecraft-kartverket.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git?ref=main";
|
minecraft-data.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git";
|
||||||
minecraft-kartverket.inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
|
outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
|
||||||
@@ -66,47 +53,21 @@
|
|||||||
in {
|
in {
|
||||||
inputs = lib.mapAttrs (_: src: src.outPath) inputs;
|
inputs = lib.mapAttrs (_: src: src.outPath) inputs;
|
||||||
|
|
||||||
pkgs = forAllSystems (system:
|
|
||||||
import nixpkgs {
|
|
||||||
inherit system;
|
|
||||||
config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
|
|
||||||
[
|
|
||||||
"nvidia-x11"
|
|
||||||
"nvidia-settings"
|
|
||||||
];
|
|
||||||
});
|
|
||||||
|
|
||||||
nixosConfigurations = let
|
nixosConfigurations = let
|
||||||
unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
|
unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
|
||||||
|
nixosConfig = nixpkgs: name: config: lib.nixosSystem (lib.recursiveUpdate
|
||||||
nixosConfig =
|
rec {
|
||||||
nixpkgs:
|
system = "x86_64-linux";
|
||||||
name:
|
|
||||||
configurationPath:
|
|
||||||
extraArgs@{
|
|
||||||
system ? "x86_64-linux",
|
|
||||||
specialArgs ? { },
|
|
||||||
modules ? [ ],
|
|
||||||
overlays ? [ ],
|
|
||||||
enableDefaults ? true,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
lib.nixosSystem (lib.recursiveUpdate
|
|
||||||
{
|
|
||||||
inherit system;
|
|
||||||
|
|
||||||
specialArgs = {
|
specialArgs = {
|
||||||
inherit unstablePkgs inputs;
|
inherit unstablePkgs inputs;
|
||||||
values = import ./values.nix;
|
values = import ./values.nix;
|
||||||
fp = path: ./${path};
|
fp = path: ./${path};
|
||||||
} // specialArgs;
|
};
|
||||||
|
|
||||||
modules = [
|
modules = [
|
||||||
configurationPath
|
./hosts/${name}/configuration.nix
|
||||||
] ++ (lib.optionals enableDefaults [
|
|
||||||
sops-nix.nixosModules.sops
|
sops-nix.nixosModules.sops
|
||||||
inputs.roowho2.nixosModules.default
|
] ++ config.modules or [];
|
||||||
]) ++ modules;
|
|
||||||
|
|
||||||
pkgs = import nixpkgs {
|
pkgs = import nixpkgs {
|
||||||
inherit system;
|
inherit system;
|
||||||
@@ -115,43 +76,25 @@
|
|||||||
"nvidia-x11"
|
"nvidia-x11"
|
||||||
"nvidia-settings"
|
"nvidia-settings"
|
||||||
];
|
];
|
||||||
overlays = (lib.optionals enableDefaults [
|
overlays = [
|
||||||
# Global overlays go here
|
# Global overlays go here
|
||||||
inputs.roowho2.overlays.default
|
] ++ config.overlays or [ ];
|
||||||
]) ++ overlays;
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
(builtins.removeAttrs extraArgs [
|
(removeAttrs config [ "modules" "overlays" ])
|
||||||
"system"
|
|
||||||
"modules"
|
|
||||||
"overlays"
|
|
||||||
"specialArgs"
|
|
||||||
"enableDefaults"
|
|
||||||
])
|
|
||||||
);
|
);
|
||||||
|
|
||||||
stableNixosConfig = name: extraArgs:
|
stableNixosConfig = nixosConfig nixpkgs;
|
||||||
nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
|
unstableNixosConfig = nixosConfig nixpkgs-unstable;
|
||||||
in {
|
in {
|
||||||
bakke = stableNixosConfig "bakke" {
|
|
||||||
modules = [
|
|
||||||
disko.nixosModules.disko
|
|
||||||
];
|
|
||||||
};
|
|
||||||
bicep = stableNixosConfig "bicep" {
|
bicep = stableNixosConfig "bicep" {
|
||||||
modules = [
|
modules = [
|
||||||
inputs.matrix-next.nixosModules.default
|
inputs.matrix-next.nixosModules.default
|
||||||
inputs.pvv-calendar-bot.nixosModules.default
|
inputs.pvv-calendar-bot.nixosModules.default
|
||||||
inputs.minecraft-heatmap.nixosModules.default
|
|
||||||
self.nixosModules.gickup
|
self.nixosModules.gickup
|
||||||
self.nixosModules.matrix-ooye
|
|
||||||
];
|
];
|
||||||
overlays = [
|
overlays = [
|
||||||
inputs.pvv-calendar-bot.overlays.default
|
inputs.pvv-calendar-bot.overlays.x86_64-linux.default
|
||||||
inputs.minecraft-heatmap.overlays.default
|
|
||||||
(final: prev: {
|
|
||||||
inherit (self.packages.${prev.stdenv.hostPlatform.system}) out-of-your-element;
|
|
||||||
})
|
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
bekkalokk = stableNixosConfig "bekkalokk" {
|
bekkalokk = stableNixosConfig "bekkalokk" {
|
||||||
@@ -166,14 +109,18 @@
|
|||||||
];
|
];
|
||||||
modules = [
|
modules = [
|
||||||
inputs.pvv-nettsiden.nixosModules.default
|
inputs.pvv-nettsiden.nixosModules.default
|
||||||
self.nixosModules.bluemap
|
];
|
||||||
|
};
|
||||||
|
bob = stableNixosConfig "bob" {
|
||||||
|
modules = [
|
||||||
|
disko.nixosModules.disko
|
||||||
|
{ disko.devices.disk.disk1.device = "/dev/vda"; }
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
ildkule = stableNixosConfig "ildkule" { };
|
ildkule = stableNixosConfig "ildkule" { };
|
||||||
#ildkule-unstable = unstableNixosConfig "ildkule" { };
|
#ildkule-unstable = unstableNixosConfig "ildkule" { };
|
||||||
shark = stableNixosConfig "shark" { };
|
shark = stableNixosConfig "shark" { };
|
||||||
wenche = stableNixosConfig "wenche" { };
|
wenche = stableNixosConfig "wenche" { };
|
||||||
temmie = stableNixosConfig "temmie" { };
|
|
||||||
|
|
||||||
kommode = stableNixosConfig "kommode" {
|
kommode = stableNixosConfig "kommode" {
|
||||||
overlays = [
|
overlays = [
|
||||||
@@ -212,40 +159,19 @@
|
|||||||
inputs.gergle.overlays.default
|
inputs.gergle.overlays.default
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
skrott = stableNixosConfig "skrott" {
|
};
|
||||||
system = "aarch64-linux";
|
|
||||||
modules = [
|
|
||||||
(nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
|
|
||||||
inputs.dibbler.nixosModules.default
|
|
||||||
];
|
|
||||||
overlays = [
|
|
||||||
inputs.dibbler.overlays.default
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
//
|
|
||||||
(let
|
|
||||||
machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
|
|
||||||
stableLupineNixosConfig = name: extraArgs:
|
|
||||||
nixosConfig nixpkgs name ./hosts/lupine/configuration.nix extraArgs;
|
|
||||||
in lib.genAttrs machineNames (name: stableLupineNixosConfig name {
|
|
||||||
modules = [{ networking.hostName = name; }];
|
|
||||||
specialArgs.lupineName = name;
|
|
||||||
}));
|
|
||||||
|
|
||||||
nixosModules = {
|
nixosModules = {
|
||||||
bluemap = ./modules/bluemap.nix;
|
|
||||||
snakeoil-certs = ./modules/snakeoil-certs.nix;
|
snakeoil-certs = ./modules/snakeoil-certs.nix;
|
||||||
snappymail = ./modules/snappymail.nix;
|
snappymail = ./modules/snappymail.nix;
|
||||||
robots-txt = ./modules/robots-txt.nix;
|
robots-txt = ./modules/robots-txt.nix;
|
||||||
gickup = ./modules/gickup;
|
gickup = ./modules/gickup;
|
||||||
matrix-ooye = ./modules/matrix-ooye.nix;
|
|
||||||
};
|
};
|
||||||
|
|
||||||
devShells = forAllSystems (system: {
|
devShells = forAllSystems (system: {
|
||||||
default = nixpkgs-unstable.legacyPackages.${system}.callPackage ./shell.nix { };
|
default = nixpkgs.legacyPackages.${system}.callPackage ./shell.nix { };
|
||||||
cuda = let
|
cuda = let
|
||||||
cuda-pkgs = import nixpkgs-unstable {
|
cuda-pkgs = import nixpkgs {
|
||||||
inherit system;
|
inherit system;
|
||||||
config = {
|
config = {
|
||||||
allowUnfree = true;
|
allowUnfree = true;
|
||||||
@@ -267,70 +193,14 @@
|
|||||||
|
|
||||||
simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
|
simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
|
||||||
|
|
||||||
bluemap = pkgs.callPackage ./packages/bluemap.nix { };
|
} //
|
||||||
|
|
||||||
out-of-your-element = pkgs.callPackage ./packages/out-of-your-element.nix { };
|
|
||||||
}
|
|
||||||
//
|
|
||||||
# Mediawiki extensions
|
|
||||||
(lib.pipe null [
|
(lib.pipe null [
|
||||||
(_: pkgs.callPackage ./packages/mediawiki-extensions { })
|
(_: pkgs.callPackage ./packages/mediawiki-extensions { })
|
||||||
(lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
|
(lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
|
||||||
(lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
|
(lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
|
||||||
])
|
])
|
||||||
//
|
// lib.genAttrs allMachines
|
||||||
# Machines
|
(machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
|
||||||
lib.genAttrs allMachines
|
|
||||||
(machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
|
|
||||||
//
|
|
||||||
# Skrott is exception
|
|
||||||
{
|
|
||||||
skrott = self.nixosConfigurations.skrott.config.system.build.sdImage;
|
|
||||||
}
|
|
||||||
//
|
|
||||||
# Nix-topology
|
|
||||||
(let
|
|
||||||
topology' = import inputs.nix-topology {
|
|
||||||
pkgs = import nixpkgs {
|
|
||||||
system = "x86_64-linux";
|
|
||||||
overlays = [
|
|
||||||
inputs.nix-topology.overlays.default
|
|
||||||
(final: prev: {
|
|
||||||
inherit (nixpkgs-unstable.legacyPackages.x86_64-linux) super-tiny-icons;
|
|
||||||
})
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
specialArgs = {
|
|
||||||
values = import ./values.nix;
|
|
||||||
};
|
|
||||||
|
|
||||||
modules = [
|
|
||||||
./topology
|
|
||||||
{
|
|
||||||
nixosConfigurations = lib.mapAttrs (_name: nixosCfg: nixosCfg.extendModules {
|
|
||||||
modules = [
|
|
||||||
inputs.nix-topology.nixosModules.default
|
|
||||||
./topology/service-extractors/greg-ng.nix
|
|
||||||
./topology/service-extractors/postgresql.nix
|
|
||||||
./topology/service-extractors/mysql.nix
|
|
||||||
./topology/service-extractors/gitea-runners.nix
|
|
||||||
];
|
|
||||||
}) self.nixosConfigurations;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
in {
|
|
||||||
topology = topology'.config.output;
|
|
||||||
topology-png = pkgs.runCommand "pvv-config-topology-png" {
|
|
||||||
nativeBuildInputs = [ pkgs.writableTmpDirAsHomeHook ];
|
|
||||||
} ''
|
|
||||||
mkdir -p "$out"
|
|
||||||
for file in '${topology'.config.output}'/*.svg; do
|
|
||||||
${lib.getExe pkgs.imagemagick} -density 300 -background none "$file" "$out"/"$(basename "''${file%.svg}.png")"
|
|
||||||
done
|
|
||||||
'';
|
|
||||||
});
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,25 +0,0 @@
|
|||||||
{ config, pkgs, values, ... }:
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
./hardware-configuration.nix
|
|
||||||
../../base
|
|
||||||
./filesystems.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
sops.defaultSopsFile = ../../secrets/bakke/bakke.yaml;
|
|
||||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
||||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
|
||||||
sops.age.generateKey = true;
|
|
||||||
|
|
||||||
boot.loader.systemd-boot.enable = true;
|
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
|
||||||
|
|
||||||
networking.hostName = "bakke";
|
|
||||||
networking.hostId = "99609ffc";
|
|
||||||
systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
|
|
||||||
matchConfig.Name = "enp2s0";
|
|
||||||
address = with values.hosts.bakke; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
|
||||||
};
|
|
||||||
|
|
||||||
system.stateVersion = "24.05";
|
|
||||||
}
|
|
||||||
@@ -1,83 +0,0 @@
|
|||||||
{
|
|
||||||
# https://github.com/nix-community/disko/blob/master/example/boot-raid1.nix
|
|
||||||
# Note: Disko was used to create the initial md raid, but is no longer in active use on this host.
|
|
||||||
disko.devices = {
|
|
||||||
disk = {
|
|
||||||
one = {
|
|
||||||
type = "disk";
|
|
||||||
device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E2EER6N6";
|
|
||||||
content = {
|
|
||||||
type = "gpt";
|
|
||||||
partitions = {
|
|
||||||
ESP = {
|
|
||||||
size = "500M";
|
|
||||||
type = "EF00";
|
|
||||||
content = {
|
|
||||||
type = "mdraid";
|
|
||||||
name = "boot";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
mdadm = {
|
|
||||||
size = "100%";
|
|
||||||
content = {
|
|
||||||
type = "mdraid";
|
|
||||||
name = "raid1";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
two = {
|
|
||||||
type = "disk";
|
|
||||||
device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E7LPLU71";
|
|
||||||
content = {
|
|
||||||
type = "gpt";
|
|
||||||
partitions = {
|
|
||||||
ESP = {
|
|
||||||
size = "500M";
|
|
||||||
type = "EF00";
|
|
||||||
content = {
|
|
||||||
type = "mdraid";
|
|
||||||
name = "boot";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
mdadm = {
|
|
||||||
size = "100%";
|
|
||||||
content = {
|
|
||||||
type = "mdraid";
|
|
||||||
name = "raid1";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
mdadm = {
|
|
||||||
boot = {
|
|
||||||
type = "mdadm";
|
|
||||||
level = 1;
|
|
||||||
metadata = "1.0";
|
|
||||||
content = {
|
|
||||||
type = "filesystem";
|
|
||||||
format = "vfat";
|
|
||||||
mountpoint = "/boot";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
raid1 = {
|
|
||||||
type = "mdadm";
|
|
||||||
level = 1;
|
|
||||||
content = {
|
|
||||||
type = "gpt";
|
|
||||||
partitions.primary = {
|
|
||||||
size = "100%";
|
|
||||||
content = {
|
|
||||||
type = "filesystem";
|
|
||||||
format = "ext4";
|
|
||||||
mountpoint = "/";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,26 +0,0 @@
|
|||||||
{ config, pkgs, lib, ... }:
|
|
||||||
{
|
|
||||||
# Boot drives:
|
|
||||||
boot.swraid.enable = true;
|
|
||||||
|
|
||||||
# ZFS Data pool:
|
|
||||||
environment.systemPackages = with pkgs; [ zfs ];
|
|
||||||
boot = {
|
|
||||||
zfs = {
|
|
||||||
extraPools = [ "tank" ];
|
|
||||||
requestEncryptionCredentials = false;
|
|
||||||
};
|
|
||||||
supportedFilesystems = [ "zfs" ];
|
|
||||||
kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
|
|
||||||
};
|
|
||||||
services.zfs.autoScrub = {
|
|
||||||
enable = true;
|
|
||||||
interval = "Wed *-*-8..14 00:00:00";
|
|
||||||
};
|
|
||||||
|
|
||||||
# NFS Exports:
|
|
||||||
#TODO
|
|
||||||
|
|
||||||
# NFS Import mounts:
|
|
||||||
#TODO
|
|
||||||
}
|
|
||||||
@@ -1,52 +0,0 @@
|
|||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ "kvm-intel" ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
|
|
||||||
fsType = "btrfs";
|
|
||||||
options = [ "subvol=root" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/home" =
|
|
||||||
{ device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
|
|
||||||
fsType = "btrfs";
|
|
||||||
options = [ "subvol=home" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/nix" =
|
|
||||||
{ device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
|
|
||||||
fsType = "btrfs";
|
|
||||||
options = [ "subvol=nix" "noatime" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" =
|
|
||||||
{ device = "/dev/sdc2";
|
|
||||||
fsType = "vfat";
|
|
||||||
options = [ "fmask=0022" "dmask=0022" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices = [ ];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault false;
|
|
||||||
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
|
||||||
}
|
|
||||||
@@ -4,11 +4,11 @@
|
|||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
|
|
||||||
(fp /base)
|
(fp /base)
|
||||||
|
(fp /misc/metrics-exporters.nix)
|
||||||
|
|
||||||
./services/alps.nix
|
./services/bluemap/default.nix
|
||||||
./services/bluemap.nix
|
|
||||||
./services/idp-simplesamlphp
|
./services/idp-simplesamlphp
|
||||||
./services/kerberos.nix
|
./services/kerberos
|
||||||
./services/mediawiki
|
./services/mediawiki
|
||||||
./services/nginx.nix
|
./services/nginx.nix
|
||||||
./services/phpfpm.nix
|
./services/phpfpm.nix
|
||||||
|
|||||||
@@ -1,22 +0,0 @@
|
|||||||
{ config, lib, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.alps;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
services.alps = {
|
|
||||||
enable = true;
|
|
||||||
theme = "sourcehut";
|
|
||||||
smtps.host = "smtp.pvv.ntnu.no";
|
|
||||||
imaps.host = "imap.pvv.ntnu.no";
|
|
||||||
bindIP = "127.0.0.1";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."alps.pvv.ntnu.no" = lib.mkIf cfg.enable {
|
|
||||||
enableACME = true;
|
|
||||||
forceSSL = true;
|
|
||||||
kTLS = true;
|
|
||||||
locations."/" = {
|
|
||||||
proxyPass = "http://${cfg.bindIP}:${toString cfg.port}";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,121 +0,0 @@
|
|||||||
{ config, lib, pkgs, inputs, ... }:
|
|
||||||
let
|
|
||||||
vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
|
|
||||||
format = pkgs.formats.hocon { };
|
|
||||||
in {
|
|
||||||
# NOTE: our versino of the module gets added in flake.nix
|
|
||||||
disabledModules = [ "services/web-apps/bluemap.nix" ];
|
|
||||||
|
|
||||||
sops.secrets."bluemap/ssh-key" = { };
|
|
||||||
sops.secrets."bluemap/ssh-known-hosts" = { };
|
|
||||||
|
|
||||||
services.bluemap = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
eula = true;
|
|
||||||
onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
|
|
||||||
|
|
||||||
host = "minecraft.pvv.ntnu.no";
|
|
||||||
|
|
||||||
maps = let
|
|
||||||
inherit (inputs.minecraft-kartverket.packages.${pkgs.stdenv.hostPlatform.system}) bluemap-export;
|
|
||||||
in {
|
|
||||||
"verden" = {
|
|
||||||
extraHoconMarkersFile = "${bluemap-export}/overworld.hocon";
|
|
||||||
settings = {
|
|
||||||
world = vanillaSurvival;
|
|
||||||
dimension = "minecraft:overworld";
|
|
||||||
name = "Verden";
|
|
||||||
sorting = 0;
|
|
||||||
start-pos = {
|
|
||||||
x = 0;
|
|
||||||
z = 0;
|
|
||||||
};
|
|
||||||
ambient-light = 0.1;
|
|
||||||
cave-detection-ocean-floor = -5;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
"underverden" = {
|
|
||||||
extraHoconMarkersFile = "${bluemap-export}/nether.hocon";
|
|
||||||
settings = {
|
|
||||||
world = vanillaSurvival;
|
|
||||||
dimension = "minecraft:the_nether";
|
|
||||||
name = "Underverden";
|
|
||||||
sorting = 100;
|
|
||||||
start-pos = {
|
|
||||||
x = 0;
|
|
||||||
z = 0;
|
|
||||||
};
|
|
||||||
sky-color = "#290000";
|
|
||||||
void-color = "#150000";
|
|
||||||
sky-light = 1;
|
|
||||||
ambient-light = 0.6;
|
|
||||||
remove-caves-below-y = -10000;
|
|
||||||
cave-detection-ocean-floor = -5;
|
|
||||||
cave-detection-uses-block-light = true;
|
|
||||||
render-mask = [{
|
|
||||||
max-y = 90;
|
|
||||||
}];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
"enden" = {
|
|
||||||
extraHoconMarkersFile = "${bluemap-export}/the-end.hocon";
|
|
||||||
settings = {
|
|
||||||
world = vanillaSurvival;
|
|
||||||
dimension = "minecraft:the_end";
|
|
||||||
name = "Enden";
|
|
||||||
sorting = 200;
|
|
||||||
start-pos = {
|
|
||||||
x = 0;
|
|
||||||
z = 0;
|
|
||||||
};
|
|
||||||
sky-color = "#080010";
|
|
||||||
void-color = "#080010";
|
|
||||||
sky-light = 1;
|
|
||||||
ambient-light = 0.6;
|
|
||||||
remove-caves-below-y = -10000;
|
|
||||||
cave-detection-ocean-floor = -5;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services."render-bluemap-maps" = {
|
|
||||||
serviceConfig = {
|
|
||||||
StateDirectory = [ "bluemap/world" ];
|
|
||||||
ExecStartPre = let
|
|
||||||
rsyncArgs = lib.cli.toCommandLineShellGNU { } {
|
|
||||||
archive = true;
|
|
||||||
compress = true;
|
|
||||||
verbose = true;
|
|
||||||
no-owner = true;
|
|
||||||
no-group = true;
|
|
||||||
rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
|
|
||||||
};
|
|
||||||
in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
|
|
||||||
LoadCredential = [
|
|
||||||
"sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
|
|
||||||
"ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."minecraft.pvv.ntnu.no" = {
|
|
||||||
enableACME = true;
|
|
||||||
forceSSL = true;
|
|
||||||
kTLS = true;
|
|
||||||
http3 = true;
|
|
||||||
quic = true;
|
|
||||||
http3_hq = true;
|
|
||||||
extraConfig = ''
|
|
||||||
# Enabling QUIC 0-RTT
|
|
||||||
ssl_early_data on;
|
|
||||||
|
|
||||||
quic_gso on;
|
|
||||||
quic_retry on;
|
|
||||||
add_header Alt-Svc 'h3=":$server_port"; ma=86400';
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedUDPPorts = [ 443 ];
|
|
||||||
}
|
|
||||||
85
hosts/bekkalokk/services/bluemap/default.nix
Normal file
85
hosts/bekkalokk/services/bluemap/default.nix
Normal file
@@ -0,0 +1,85 @@
|
|||||||
|
{ config, lib, pkgs, inputs, ... }:
|
||||||
|
let
|
||||||
|
vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
|
||||||
|
in {
|
||||||
|
imports = [
|
||||||
|
./module.nix # From danio, pending upstreaming
|
||||||
|
];
|
||||||
|
|
||||||
|
disabledModules = [ "services/web-apps/bluemap.nix" ];
|
||||||
|
|
||||||
|
sops.secrets."bluemap/ssh-key" = { };
|
||||||
|
sops.secrets."bluemap/ssh-known-hosts" = { };
|
||||||
|
|
||||||
|
services.bluemap = {
|
||||||
|
enable = true;
|
||||||
|
package = pkgs.callPackage ./package.nix { };
|
||||||
|
|
||||||
|
eula = true;
|
||||||
|
onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
|
||||||
|
|
||||||
|
host = "minecraft.pvv.ntnu.no";
|
||||||
|
|
||||||
|
maps = {
|
||||||
|
"verden" = {
|
||||||
|
settings = {
|
||||||
|
world = vanillaSurvival;
|
||||||
|
sorting = 0;
|
||||||
|
ambient-light = 0.1;
|
||||||
|
cave-detection-ocean-floor = -5;
|
||||||
|
marker-sets = inputs.minecraft-data.map-markers.vanillaSurvival.verden;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"underverden" = {
|
||||||
|
settings = {
|
||||||
|
world = "${vanillaSurvival}/DIM-1";
|
||||||
|
sorting = 100;
|
||||||
|
sky-color = "#290000";
|
||||||
|
void-color = "#150000";
|
||||||
|
ambient-light = 0.6;
|
||||||
|
world-sky-light = 0;
|
||||||
|
remove-caves-below-y = -10000;
|
||||||
|
cave-detection-ocean-floor = -5;
|
||||||
|
cave-detection-uses-block-light = true;
|
||||||
|
max-y = 90;
|
||||||
|
marker-sets = inputs.minecraft-data.map-markers.vanillaSurvival.underverden;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"enden" = {
|
||||||
|
settings = {
|
||||||
|
world = "${vanillaSurvival}/DIM1";
|
||||||
|
sorting = 200;
|
||||||
|
sky-color = "#080010";
|
||||||
|
void-color = "#080010";
|
||||||
|
ambient-light = 0.6;
|
||||||
|
world-sky-light = 0;
|
||||||
|
remove-caves-below-y = -10000;
|
||||||
|
cave-detection-ocean-floor = -5;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."minecraft.pvv.ntnu.no" = {
|
||||||
|
enableACME = true;
|
||||||
|
forceSSL = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
# TODO: render somewhere else lmao
|
||||||
|
systemd.services."render-bluemap-maps" = {
|
||||||
|
preStart = ''
|
||||||
|
mkdir -p /var/lib/bluemap/world
|
||||||
|
${pkgs.rsync}/bin/rsync \
|
||||||
|
-e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" \
|
||||||
|
-avz --no-owner --no-group \
|
||||||
|
root@innovation.pvv.ntnu.no:/ \
|
||||||
|
${vanillaSurvival}
|
||||||
|
'';
|
||||||
|
serviceConfig = {
|
||||||
|
LoadCredential = [
|
||||||
|
"sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
|
||||||
|
"ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -13,32 +13,11 @@ let
|
|||||||
(format.generate "${name}.conf" value))
|
(format.generate "${name}.conf" value))
|
||||||
cfg.storage);
|
cfg.storage);
|
||||||
|
|
||||||
generateMapConfigWithMarkerData = name: { extraHoconMarkersFile, settings, ... }:
|
mapsFolder = pkgs.linkFarm "maps"
|
||||||
assert (extraHoconMarkersFile == null) != ((settings.marker-sets or { }) == { });
|
(lib.attrsets.mapAttrs' (name: value:
|
||||||
lib.pipe settings (
|
lib.nameValuePair "${name}.conf"
|
||||||
(lib.optionals (extraHoconMarkersFile != null) [
|
(format.generate "${name}.conf" value.settings))
|
||||||
(settings: lib.recursiveUpdate settings {
|
cfg.maps);
|
||||||
marker-placeholder = "###ASDF###";
|
|
||||||
})
|
|
||||||
]) ++ [
|
|
||||||
(format.generate "${name}.conf")
|
|
||||||
] ++ (lib.optionals (extraHoconMarkersFile != null) [
|
|
||||||
(hoconFile: pkgs.runCommand "${name}-patched.conf" { } ''
|
|
||||||
mkdir -p "$(dirname "$out")"
|
|
||||||
cp '${hoconFile}' "$out"
|
|
||||||
substituteInPlace "$out" \
|
|
||||||
--replace-fail '"marker-placeholder" = "###ASDF###"' "\"marker-sets\" = $(cat '${extraHoconMarkersFile}')"
|
|
||||||
'')
|
|
||||||
])
|
|
||||||
);
|
|
||||||
|
|
||||||
mapsFolder = lib.pipe cfg.maps [
|
|
||||||
(lib.attrsets.mapAttrs' (name: value: {
|
|
||||||
name = "${name}.conf";
|
|
||||||
value = generateMapConfigWithMarkerData name value;
|
|
||||||
}))
|
|
||||||
(pkgs.linkFarm "maps")
|
|
||||||
];
|
|
||||||
|
|
||||||
webappConfigFolder = pkgs.linkFarm "bluemap-config" {
|
webappConfigFolder = pkgs.linkFarm "bluemap-config" {
|
||||||
"maps" = mapsFolder;
|
"maps" = mapsFolder;
|
||||||
@@ -46,18 +25,18 @@ let
|
|||||||
"core.conf" = coreConfig;
|
"core.conf" = coreConfig;
|
||||||
"webapp.conf" = webappConfig;
|
"webapp.conf" = webappConfig;
|
||||||
"webserver.conf" = webserverConfig;
|
"webserver.conf" = webserverConfig;
|
||||||
"packs" = cfg.packs;
|
"packs" = cfg.resourcepacks;
|
||||||
};
|
};
|
||||||
|
|
||||||
renderConfigFolder = name: value: pkgs.linkFarm "bluemap-${name}-config" {
|
renderConfigFolder = name: value: pkgs.linkFarm "bluemap-${name}-config" {
|
||||||
"maps" = pkgs.linkFarm "maps" {
|
"maps" = pkgs.linkFarm "maps" {
|
||||||
"${name}.conf" = generateMapConfigWithMarkerData name value;
|
"${name}.conf" = (format.generate "${name}.conf" value.settings);
|
||||||
};
|
};
|
||||||
"storages" = storageFolder;
|
"storages" = storageFolder;
|
||||||
"core.conf" = coreConfig;
|
"core.conf" = coreConfig;
|
||||||
"webapp.conf" = format.generate "webapp.conf" (cfg.webappSettings // { "update-settings-file" = false; });
|
"webapp.conf" = format.generate "webapp.conf" (cfg.webappSettings // { "update-settings-file" = false; });
|
||||||
"webserver.conf" = webserverConfig;
|
"webserver.conf" = webserverConfig;
|
||||||
"packs" = value.packs;
|
"packs" = value.resourcepacks;
|
||||||
};
|
};
|
||||||
|
|
||||||
inherit (lib) mkOption;
|
inherit (lib) mkOption;
|
||||||
@@ -131,7 +110,7 @@ in {
|
|||||||
metrics = lib.mkEnableOption "Sending usage metrics containing the version of bluemap in use";
|
metrics = lib.mkEnableOption "Sending usage metrics containing the version of bluemap in use";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
description = "Settings for the core.conf file, [see upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/common/src/main/resources/de/bluecolored/bluemap/config/core.conf).";
|
description = "Settings for the core.conf file, [see upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/core.conf).";
|
||||||
};
|
};
|
||||||
|
|
||||||
webappSettings = mkOption {
|
webappSettings = mkOption {
|
||||||
@@ -148,7 +127,7 @@ in {
|
|||||||
webroot = config.services.bluemap.webRoot;
|
webroot = config.services.bluemap.webRoot;
|
||||||
}
|
}
|
||||||
'';
|
'';
|
||||||
description = "Settings for the webapp.conf file, see [upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/common/src/main/resources/de/bluecolored/bluemap/config/webapp.conf).";
|
description = "Settings for the webapp.conf file, see [upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/webapp.conf).";
|
||||||
};
|
};
|
||||||
|
|
||||||
webserverSettings = mkOption {
|
webserverSettings = mkOption {
|
||||||
@@ -168,31 +147,19 @@ in {
|
|||||||
default = { };
|
default = { };
|
||||||
description = ''
|
description = ''
|
||||||
Settings for the webserver.conf file, usually not required.
|
Settings for the webserver.conf file, usually not required.
|
||||||
[See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/common/src/main/resources/de/bluecolored/bluemap/config/webserver.conf).
|
[See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/webserver.conf).
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
maps = mkOption {
|
maps = mkOption {
|
||||||
type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
|
type = lib.types.attrsOf (lib.types.submodule {
|
||||||
options = {
|
options = {
|
||||||
packs = mkOption {
|
resourcepacks = mkOption {
|
||||||
type = lib.types.path;
|
type = lib.types.path;
|
||||||
default = cfg.packs;
|
default = cfg.resourcepacks;
|
||||||
defaultText = lib.literalExpression "config.services.bluemap.packs";
|
defaultText = lib.literalExpression "config.services.bluemap.resourcepacks";
|
||||||
description = "A set of resourcepacks, datapacks, and mods to extract resources from, loaded in alphabetical order.";
|
description = "A set of resourcepacks/mods/bluemap-addons to extract models from loaded in alphabetical order";
|
||||||
};
|
};
|
||||||
|
|
||||||
extraHoconMarkersFile = mkOption {
|
|
||||||
type = lib.types.nullOr lib.types.path;
|
|
||||||
default = null;
|
|
||||||
description = ''
|
|
||||||
Path to a hocon file containing marker data.
|
|
||||||
The content of this file will be injected into the map config file in a separate derivation.
|
|
||||||
|
|
||||||
DO NOT SEND THIS TO NIXPKGS, IT'S AN UGLY HACK.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
settings = mkOption {
|
settings = mkOption {
|
||||||
type = (lib.types.submodule {
|
type = (lib.types.submodule {
|
||||||
freeformType = format.type;
|
freeformType = format.type;
|
||||||
@@ -201,74 +168,43 @@ in {
|
|||||||
type = lib.types.path;
|
type = lib.types.path;
|
||||||
description = "Path to world folder containing the dimension to render";
|
description = "Path to world folder containing the dimension to render";
|
||||||
};
|
};
|
||||||
name = mkOption {
|
|
||||||
type = lib.types.str;
|
|
||||||
description = "The display name of this map (how this map will be named on the webapp)";
|
|
||||||
default = name;
|
|
||||||
defaultText = lib.literalExpression "<name>";
|
|
||||||
};
|
|
||||||
render-mask = mkOption {
|
|
||||||
type = with lib.types; listOf (attrsOf format.type);
|
|
||||||
description = "Limits for the map render";
|
|
||||||
default = [ ];
|
|
||||||
example = [
|
|
||||||
{
|
|
||||||
min-x = -4000;
|
|
||||||
max-x = 4000;
|
|
||||||
min-z = -4000;
|
|
||||||
max-z = 4000;
|
|
||||||
min-y = 50;
|
|
||||||
max-y = 100;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
subtract = true;
|
|
||||||
min-y = 90;
|
|
||||||
max-y = 127;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
});
|
});
|
||||||
description = ''
|
description = ''
|
||||||
Settings for files in `maps/`.
|
Settings for files in `maps/`.
|
||||||
See the default for an example with good options for the different world types.
|
See the default for an example with good options for the different world types.
|
||||||
For valid values [consult upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/common/src/main/resources/de/bluecolored/bluemap/config/maps/map.conf).
|
For valid values [consult upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/maps/map.conf).
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}));
|
});
|
||||||
default = {
|
default = {
|
||||||
"overworld".settings = {
|
"overworld".settings = {
|
||||||
world = cfg.defaultWorld;
|
world = "${cfg.defaultWorld}";
|
||||||
dimension = "minecraft:overworld";
|
|
||||||
name = "Overworld";
|
|
||||||
ambient-light = 0.1;
|
ambient-light = 0.1;
|
||||||
cave-detection-ocean-floor = -5;
|
cave-detection-ocean-floor = -5;
|
||||||
};
|
};
|
||||||
|
|
||||||
"nether".settings = {
|
"nether".settings = {
|
||||||
world = cfg.defaultWorld;
|
world = "${cfg.defaultWorld}/DIM-1";
|
||||||
dimension = "minecraft:the_nether";
|
|
||||||
name = "Nether";
|
|
||||||
sorting = 100;
|
sorting = 100;
|
||||||
sky-color = "#290000";
|
sky-color = "#290000";
|
||||||
void-color = "#150000";
|
void-color = "#150000";
|
||||||
sky-light = 1;
|
|
||||||
ambient-light = 0.6;
|
ambient-light = 0.6;
|
||||||
|
world-sky-light = 0;
|
||||||
remove-caves-below-y = -10000;
|
remove-caves-below-y = -10000;
|
||||||
cave-detection-ocean-floor = -5;
|
cave-detection-ocean-floor = -5;
|
||||||
cave-detection-uses-block-light = true;
|
cave-detection-uses-block-light = true;
|
||||||
|
max-y = 90;
|
||||||
};
|
};
|
||||||
|
|
||||||
"end".settings = {
|
"end".settings = {
|
||||||
world = cfg.defaultWorld;
|
world = "${cfg.defaultWorld}/DIM1";
|
||||||
dimension = "minecraft:the_end";
|
|
||||||
name = "The End";
|
|
||||||
sorting = 200;
|
sorting = 200;
|
||||||
sky-color = "#080010";
|
sky-color = "#080010";
|
||||||
void-color = "#080010";
|
void-color = "#080010";
|
||||||
sky-light = 1;
|
|
||||||
ambient-light = 0.6;
|
ambient-light = 0.6;
|
||||||
|
world-sky-light = 0;
|
||||||
remove-caves-below-y = -10000;
|
remove-caves-below-y = -10000;
|
||||||
cave-detection-ocean-floor = -5;
|
cave-detection-ocean-floor = -5;
|
||||||
};
|
};
|
||||||
@@ -276,36 +212,31 @@ in {
|
|||||||
defaultText = lib.literalExpression ''
|
defaultText = lib.literalExpression ''
|
||||||
{
|
{
|
||||||
"overworld".settings = {
|
"overworld".settings = {
|
||||||
world = cfg.defaultWorld;
|
world = "''${cfg.defaultWorld}";
|
||||||
name = "Overworld";
|
|
||||||
dimension = "minecraft:overworld";
|
|
||||||
ambient-light = 0.1;
|
ambient-light = 0.1;
|
||||||
cave-detection-ocean-floor = -5;
|
cave-detection-ocean-floor = -5;
|
||||||
};
|
};
|
||||||
|
|
||||||
"nether".settings = {
|
"nether".settings = {
|
||||||
world = cfg.defaultWorld;
|
world = "''${cfg.defaultWorld}/DIM-1";
|
||||||
dimension = "minecraft:the_nether";
|
|
||||||
name = "Nether";
|
|
||||||
sorting = 100;
|
sorting = 100;
|
||||||
sky-color = "#290000";
|
sky-color = "#290000";
|
||||||
void-color = "#150000";
|
void-color = "#150000";
|
||||||
sky-light = 1;
|
|
||||||
ambient-light = 0.6;
|
ambient-light = 0.6;
|
||||||
|
world-sky-light = 0;
|
||||||
remove-caves-below-y = -10000;
|
remove-caves-below-y = -10000;
|
||||||
cave-detection-ocean-floor = -5;
|
cave-detection-ocean-floor = -5;
|
||||||
cave-detection-uses-block-light = true;
|
cave-detection-uses-block-light = true;
|
||||||
|
max-y = 90;
|
||||||
};
|
};
|
||||||
|
|
||||||
"end".settings = {
|
"end".settings = {
|
||||||
world = cfg.defaultWorld;
|
world = "''${cfg.defaultWorld}/DIM1";
|
||||||
name = "The End";
|
|
||||||
dimension = "minecraft:the_end";
|
|
||||||
sorting = 200;
|
sorting = 200;
|
||||||
sky-color = "#080010";
|
sky-color = "#080010";
|
||||||
void-color = "#080010";
|
void-color = "#080010";
|
||||||
sky-light = 1;
|
|
||||||
ambient-light = 0.6;
|
ambient-light = 0.6;
|
||||||
|
world-sky-light = 0;
|
||||||
remove-caves-below-y = -10000;
|
remove-caves-below-y = -10000;
|
||||||
cave-detection-ocean-floor = -5;
|
cave-detection-ocean-floor = -5;
|
||||||
};
|
};
|
||||||
@@ -333,7 +264,7 @@ in {
|
|||||||
description = ''
|
description = ''
|
||||||
Where the rendered map will be stored.
|
Where the rendered map will be stored.
|
||||||
Unless you are doing something advanced you should probably leave this alone and configure webRoot instead.
|
Unless you are doing something advanced you should probably leave this alone and configure webRoot instead.
|
||||||
[See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/tree/master/common/src/main/resources/de/bluecolored/bluemap/config/storages)
|
[See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/tree/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/storages)
|
||||||
'';
|
'';
|
||||||
default = {
|
default = {
|
||||||
"file" = {
|
"file" = {
|
||||||
@@ -349,12 +280,12 @@ in {
|
|||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
packs = mkOption {
|
resourcepacks = mkOption {
|
||||||
type = lib.types.path;
|
type = lib.types.path;
|
||||||
default = pkgs.linkFarm "packs" { };
|
default = pkgs.linkFarm "resourcepacks" { };
|
||||||
description = ''
|
description = ''
|
||||||
A set of resourcepacks, datapacks, and mods to extract resources from, loaded in alphabetical order.
|
A set of resourcepacks/mods to extract models from loaded in alphabetical order.
|
||||||
Can be overriden on a per-map basis with `services.bluemap.maps.<name>.packs`.
|
Can be overriden on a per-map basis with `services.bluemap.maps.<name>.resourcepacks`.
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
@@ -375,23 +306,21 @@ in {
|
|||||||
systemd.services."render-bluemap-maps" = lib.mkIf cfg.enableRender {
|
systemd.services."render-bluemap-maps" = lib.mkIf cfg.enableRender {
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
Type = "oneshot";
|
Type = "oneshot";
|
||||||
CPUSchedulingPolicy = "batch";
|
|
||||||
Group = "nginx";
|
Group = "nginx";
|
||||||
UMask = "026";
|
UMask = "026";
|
||||||
ExecStart = [
|
|
||||||
# If web folder doesnt exist generate it
|
|
||||||
''|test -f "${cfg.webRoot}" || ${lib.getExe cfg.package} -c ${webappConfigFolder} -gs''
|
|
||||||
]
|
|
||||||
++
|
|
||||||
# Render each minecraft map
|
|
||||||
lib.attrsets.mapAttrsToList
|
|
||||||
(name: value: "${lib.getExe cfg.package} -c ${renderConfigFolder name value} -r")
|
|
||||||
cfg.maps
|
|
||||||
++ [
|
|
||||||
# Generate updated webapp
|
|
||||||
"${lib.getExe cfg.package} -c ${webappConfigFolder} -gs"
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
|
script = ''
|
||||||
|
# If web folder doesnt exist generate it
|
||||||
|
test -f "${cfg.webRoot}" || ${lib.getExe cfg.package} -c ${webappConfigFolder} -gs
|
||||||
|
|
||||||
|
# Render each minecraft map
|
||||||
|
${lib.strings.concatStringsSep "\n" (lib.attrsets.mapAttrsToList
|
||||||
|
(name: value: "${lib.getExe cfg.package} -c ${renderConfigFolder name value} -r")
|
||||||
|
cfg.maps)}
|
||||||
|
|
||||||
|
# Generate updated webapp
|
||||||
|
${lib.getExe cfg.package} -c ${webappConfigFolder} -gs
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.timers."render-bluemap-maps" = lib.mkIf cfg.enableRender {
|
systemd.timers."render-bluemap-maps" = lib.mkIf cfg.enableRender {
|
||||||
30
hosts/bekkalokk/services/bluemap/package.nix
Normal file
30
hosts/bekkalokk/services/bluemap/package.nix
Normal file
@@ -0,0 +1,30 @@
|
|||||||
|
{ lib, stdenvNoCC, fetchurl, makeWrapper, jre }:
|
||||||
|
|
||||||
|
stdenvNoCC.mkDerivation rec {
|
||||||
|
pname = "bluemap";
|
||||||
|
version = "5.7";
|
||||||
|
|
||||||
|
src = fetchurl {
|
||||||
|
url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
|
||||||
|
hash = "sha256-8udZYJgrr4bi2mjRYrASd8JwUoUVZW1tZpOLRgafAIw=";
|
||||||
|
};
|
||||||
|
|
||||||
|
dontUnpack = true;
|
||||||
|
|
||||||
|
nativeBuildInputs = [ makeWrapper ];
|
||||||
|
|
||||||
|
installPhase = ''
|
||||||
|
runHook preInstall
|
||||||
|
makeWrapper ${jre}/bin/java $out/bin/bluemap --add-flags "-jar $src"
|
||||||
|
runHook postInstall
|
||||||
|
'';
|
||||||
|
|
||||||
|
meta = {
|
||||||
|
description = "3D minecraft map renderer";
|
||||||
|
homepage = "https://bluemap.bluecolored.de/";
|
||||||
|
sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
|
||||||
|
license = lib.licenses.mit;
|
||||||
|
maintainers = with lib.maintainers; [ dandellion h7x4 ];
|
||||||
|
mainProgram = "bluemap";
|
||||||
|
};
|
||||||
|
}
|
||||||
88
hosts/bekkalokk/services/kerberos/krb5-conf-format.nix
Normal file
88
hosts/bekkalokk/services/kerberos/krb5-conf-format.nix
Normal file
@@ -0,0 +1,88 @@
|
|||||||
|
{ pkgs, lib, ... }:
|
||||||
|
|
||||||
|
# Based on
|
||||||
|
# - https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html
|
||||||
|
# - https://manpages.debian.org/unstable/heimdal-docs/krb5.conf.5heimdal.en.html
|
||||||
|
|
||||||
|
let
|
||||||
|
inherit (lib) boolToString concatMapStringsSep concatStringsSep filter
|
||||||
|
isAttrs isBool isList mapAttrsToList mdDoc mkOption singleton splitString;
|
||||||
|
inherit (lib.types) attrsOf bool coercedTo either int listOf oneOf path
|
||||||
|
str submodule;
|
||||||
|
in
|
||||||
|
{ }: {
|
||||||
|
type = let
|
||||||
|
section = attrsOf relation;
|
||||||
|
relation = either (attrsOf value) value;
|
||||||
|
value = either (listOf atom) atom;
|
||||||
|
atom = oneOf [int str bool];
|
||||||
|
in submodule {
|
||||||
|
freeformType = attrsOf section;
|
||||||
|
options = {
|
||||||
|
include = mkOption {
|
||||||
|
default = [ ];
|
||||||
|
description = mdDoc ''
|
||||||
|
Files to include in the Kerberos configuration.
|
||||||
|
'';
|
||||||
|
type = coercedTo path singleton (listOf path);
|
||||||
|
};
|
||||||
|
includedir = mkOption {
|
||||||
|
default = [ ];
|
||||||
|
description = mdDoc ''
|
||||||
|
Directories containing files to include in the Kerberos configuration.
|
||||||
|
'';
|
||||||
|
type = coercedTo path singleton (listOf path);
|
||||||
|
};
|
||||||
|
module = mkOption {
|
||||||
|
default = [ ];
|
||||||
|
description = mdDoc ''
|
||||||
|
Modules to obtain Kerberos configuration from.
|
||||||
|
'';
|
||||||
|
type = coercedTo path singleton (listOf path);
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
generate = let
|
||||||
|
indent = str: concatMapStringsSep "\n" (line: " " + line) (splitString "\n" str);
|
||||||
|
|
||||||
|
formatToplevel = args @ {
|
||||||
|
include ? [ ],
|
||||||
|
includedir ? [ ],
|
||||||
|
module ? [ ],
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
sections = removeAttrs args [ "include" "includedir" "module" ];
|
||||||
|
in concatStringsSep "\n" (filter (x: x != "") [
|
||||||
|
(concatStringsSep "\n" (mapAttrsToList formatSection sections))
|
||||||
|
(concatMapStringsSep "\n" (m: "module ${m}") module)
|
||||||
|
(concatMapStringsSep "\n" (i: "include ${i}") include)
|
||||||
|
(concatMapStringsSep "\n" (i: "includedir ${i}") includedir)
|
||||||
|
]);
|
||||||
|
|
||||||
|
formatSection = name: section: ''
|
||||||
|
[${name}]
|
||||||
|
${indent (concatStringsSep "\n" (mapAttrsToList formatRelation section))}
|
||||||
|
'';
|
||||||
|
|
||||||
|
formatRelation = name: relation:
|
||||||
|
if isAttrs relation
|
||||||
|
then ''
|
||||||
|
${name} = {
|
||||||
|
${indent (concatStringsSep "\n" (mapAttrsToList formatValue relation))}
|
||||||
|
}''
|
||||||
|
else formatValue name relation;
|
||||||
|
|
||||||
|
formatValue = name: value:
|
||||||
|
if isList value
|
||||||
|
then concatMapStringsSep "\n" (formatAtom name) value
|
||||||
|
else formatAtom name value;
|
||||||
|
|
||||||
|
formatAtom = name: atom: let
|
||||||
|
v = if isBool atom then boolToString atom else toString atom;
|
||||||
|
in "${name} = ${v}";
|
||||||
|
in
|
||||||
|
name: value: pkgs.writeText name ''
|
||||||
|
${formatToplevel value}
|
||||||
|
'';
|
||||||
|
}
|
||||||
90
hosts/bekkalokk/services/kerberos/krb5.nix
Normal file
90
hosts/bekkalokk/services/kerberos/krb5.nix
Normal file
@@ -0,0 +1,90 @@
|
|||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
let
|
||||||
|
inherit (lib) mdDoc mkIf mkOption mkPackageOption mkRemovedOptionModule;
|
||||||
|
inherit (lib.types) bool;
|
||||||
|
|
||||||
|
mkRemovedOptionModule' = name: reason: mkRemovedOptionModule ["krb5" name] reason;
|
||||||
|
mkRemovedOptionModuleCfg = name: mkRemovedOptionModule' name ''
|
||||||
|
The option `krb5.${name}' has been removed. Use
|
||||||
|
`security.krb5.settings.${name}' for structured configuration.
|
||||||
|
'';
|
||||||
|
|
||||||
|
cfg = config.security.krb5;
|
||||||
|
format = import ./krb5-conf-format.nix { inherit pkgs lib; } { };
|
||||||
|
in {
|
||||||
|
imports = [
|
||||||
|
(mkRemovedOptionModuleCfg "libdefaults")
|
||||||
|
(mkRemovedOptionModuleCfg "realms")
|
||||||
|
(mkRemovedOptionModuleCfg "domain_realm")
|
||||||
|
(mkRemovedOptionModuleCfg "capaths")
|
||||||
|
(mkRemovedOptionModuleCfg "appdefaults")
|
||||||
|
(mkRemovedOptionModuleCfg "plugins")
|
||||||
|
(mkRemovedOptionModuleCfg "config")
|
||||||
|
(mkRemovedOptionModuleCfg "extraConfig")
|
||||||
|
(mkRemovedOptionModule' "kerberos" ''
|
||||||
|
The option `krb5.kerberos' has been moved to `security.krb5.package'.
|
||||||
|
'')
|
||||||
|
];
|
||||||
|
|
||||||
|
options = {
|
||||||
|
security.krb5 = {
|
||||||
|
enable = mkOption {
|
||||||
|
default = false;
|
||||||
|
description = mdDoc "Enable and configure Kerberos utilities";
|
||||||
|
type = bool;
|
||||||
|
};
|
||||||
|
|
||||||
|
package = mkPackageOption pkgs "krb5" {
|
||||||
|
example = "heimdal";
|
||||||
|
};
|
||||||
|
|
||||||
|
settings = mkOption {
|
||||||
|
default = { };
|
||||||
|
type = format.type;
|
||||||
|
description = mdDoc ''
|
||||||
|
Structured contents of the {file}`krb5.conf` file. See
|
||||||
|
{manpage}`krb5.conf(5)` for details about configuration.
|
||||||
|
'';
|
||||||
|
example = {
|
||||||
|
include = [ "/run/secrets/secret-krb5.conf" ];
|
||||||
|
includedir = [ "/run/secrets/secret-krb5.conf.d" ];
|
||||||
|
|
||||||
|
libdefaults = {
|
||||||
|
default_realm = "ATHENA.MIT.EDU";
|
||||||
|
};
|
||||||
|
|
||||||
|
realms = {
|
||||||
|
"ATHENA.MIT.EDU" = {
|
||||||
|
admin_server = "athena.mit.edu";
|
||||||
|
kdc = [
|
||||||
|
"athena01.mit.edu"
|
||||||
|
"athena02.mit.edu"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
domain_realm = {
|
||||||
|
"mit.edu" = "ATHENA.MIT.EDU";
|
||||||
|
};
|
||||||
|
|
||||||
|
logging = {
|
||||||
|
kdc = "SYSLOG:NOTICE";
|
||||||
|
admin_server = "SYSLOG:NOTICE";
|
||||||
|
default = "SYSLOG:NOTICE";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
environment = {
|
||||||
|
systemPackages = [ cfg.package ];
|
||||||
|
etc."krb5.conf".source = format.generate "krb5.conf" cfg.settings;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
meta.maintainers = builtins.attrValues {
|
||||||
|
inherit (lib.maintainers) dblsaiko h7x4;
|
||||||
|
};
|
||||||
|
}
|
||||||
1543
hosts/bekkalokk/services/kerberos/pam.nix
Normal file
1543
hosts/bekkalokk/services/kerberos/pam.nix
Normal file
File diff suppressed because it is too large
Load Diff
@@ -130,12 +130,6 @@ in {
|
|||||||
$wgVectorDefaultSidebarVisibleForAnonymousUser = true;
|
$wgVectorDefaultSidebarVisibleForAnonymousUser = true;
|
||||||
$wgVectorResponsive = true;
|
$wgVectorResponsive = true;
|
||||||
|
|
||||||
# Experimental dark mode support for Vector 2022
|
|
||||||
$wgVectorNightMode['beta'] = true;
|
|
||||||
$wgVectorNightMode['logged_out'] = true;
|
|
||||||
$wgVectorNightMode['logged_in'] = true;
|
|
||||||
$wgDefaultUserOptions['vector-theme'] = 'os';
|
|
||||||
|
|
||||||
# Misc
|
# Misc
|
||||||
$wgEmergencyContact = "${cfg.passwordSender}";
|
$wgEmergencyContact = "${cfg.passwordSender}";
|
||||||
$wgUseTeX = false;
|
$wgUseTeX = false;
|
||||||
|
|||||||
@@ -18,16 +18,11 @@ in {
|
|||||||
restartUnits = [ "phpfpm-pvv-nettsiden.service" ];
|
restartUnits = [ "phpfpm-pvv-nettsiden.service" ];
|
||||||
});
|
});
|
||||||
|
|
||||||
security.acme.certs."www.pvv.ntnu.no" = {
|
|
||||||
extraDomainNames = [
|
|
||||||
"pvv.ntnu.no"
|
|
||||||
"www.pvv.org"
|
|
||||||
"pvv.org"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
services.idp.sp-remote-metadata = [
|
services.idp.sp-remote-metadata = [
|
||||||
"https://www.pvv.ntnu.no/simplesaml/"
|
"https://www.pvv.ntnu.no/simplesaml/"
|
||||||
|
"https://pvv.ntnu.no/simplesaml/"
|
||||||
|
"https://www.pvv.org/simplesaml/"
|
||||||
|
"https://pvv.org/simplesaml/"
|
||||||
];
|
];
|
||||||
|
|
||||||
services.pvv-nettsiden = {
|
services.pvv-nettsiden = {
|
||||||
@@ -74,6 +69,9 @@ in {
|
|||||||
ADMIN_PASSWORD = includeFromSops "simplesamlphp/admin_password";
|
ADMIN_PASSWORD = includeFromSops "simplesamlphp/admin_password";
|
||||||
TRUSTED_DOMAINS = [
|
TRUSTED_DOMAINS = [
|
||||||
"www.pvv.ntnu.no"
|
"www.pvv.ntnu.no"
|
||||||
|
"pvv.ntnu.no"
|
||||||
|
"www.pvv.org"
|
||||||
|
"pvv.org"
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
@@ -85,28 +83,13 @@ in {
|
|||||||
"catch_workers_output" = true;
|
"catch_workers_output" = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
services.nginx.virtualHosts."pvv.ntnu.no" = {
|
|
||||||
globalRedirect = cfg.domainName;
|
|
||||||
redirectCode = 307;
|
|
||||||
forceSSL = true;
|
|
||||||
useACMEHost = "www.pvv.ntnu.no";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."www.pvv.org" = {
|
|
||||||
globalRedirect = cfg.domainName;
|
|
||||||
redirectCode = 307;
|
|
||||||
forceSSL = true;
|
|
||||||
useACMEHost = "www.pvv.ntnu.no";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."pvv.org" = {
|
|
||||||
globalRedirect = cfg.domainName;
|
|
||||||
redirectCode = 307;
|
|
||||||
forceSSL = true;
|
|
||||||
useACMEHost = "www.pvv.ntnu.no";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts.${cfg.domainName} = {
|
services.nginx.virtualHosts.${cfg.domainName} = {
|
||||||
|
serverAliases = [
|
||||||
|
"pvv.ntnu.no"
|
||||||
|
"www.pvv.org"
|
||||||
|
"pvv.org"
|
||||||
|
];
|
||||||
|
|
||||||
locations = {
|
locations = {
|
||||||
# Proxy home directories
|
# Proxy home directories
|
||||||
"^~ /~" = {
|
"^~ /~" = {
|
||||||
|
|||||||
@@ -4,11 +4,11 @@
|
|||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
|
|
||||||
(fp /base)
|
(fp /base)
|
||||||
|
(fp /misc/metrics-exporters.nix)
|
||||||
./services/nginx
|
./services/nginx
|
||||||
|
|
||||||
./services/calendar-bot.nix
|
./services/calendar-bot.nix
|
||||||
#./services/git-mirrors
|
./services/git-mirrors
|
||||||
./services/minecraft-heatmap.nix
|
|
||||||
./services/mysql.nix
|
./services/mysql.nix
|
||||||
./services/postgres.nix
|
./services/postgres.nix
|
||||||
|
|
||||||
@@ -20,15 +20,13 @@
|
|||||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||||
sops.age.generateKey = true;
|
sops.age.generateKey = true;
|
||||||
|
|
||||||
boot.loader.systemd-boot.enable = true;
|
boot.loader.grub.enable = true;
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
boot.loader.grub.device = "/dev/disk/by-id/scsi-3600508b1001cb1a8751c137b30610682";
|
||||||
|
|
||||||
networking.hostName = "bicep";
|
networking.hostName = "bicep";
|
||||||
|
|
||||||
#systemd.network.networks."30-enp6s0f0" = values.defaultNetworkConfig // {
|
systemd.network.networks."30-enp6s0f0" = values.defaultNetworkConfig // {
|
||||||
systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
|
matchConfig.Name = "enp6s0f0";
|
||||||
#matchConfig.Name = "enp6s0f0";
|
|
||||||
matchConfig.Name = "ens18";
|
|
||||||
address = with values.hosts.bicep; [ (ipv4 + "/25") (ipv6 + "/64") ]
|
address = with values.hosts.bicep; [ (ipv4 + "/25") (ipv6 + "/64") ]
|
||||||
++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
|
++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
|
||||||
};
|
};
|
||||||
@@ -39,13 +37,6 @@
|
|||||||
# There are no smart devices
|
# There are no smart devices
|
||||||
services.smartd.enable = false;
|
services.smartd.enable = false;
|
||||||
|
|
||||||
# we are a vm now
|
|
||||||
services.qemuGuest.enable = true;
|
|
||||||
|
|
||||||
# Enable the OpenSSH daemon.
|
|
||||||
services.openssh.enable = true;
|
|
||||||
services.sshguard.enable = true;
|
|
||||||
|
|
||||||
# Do not change, even during upgrades.
|
# Do not change, even during upgrades.
|
||||||
# See https://search.nixos.org/options?show=system.stateVersion
|
# See https://search.nixos.org/options?show=system.stateVersion
|
||||||
system.stateVersion = "22.11";
|
system.stateVersion = "22.11";
|
||||||
|
|||||||
@@ -5,29 +5,22 @@
|
|||||||
|
|
||||||
{
|
{
|
||||||
imports =
|
imports =
|
||||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||||
];
|
];
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ahci" "sd_mod" "sr_mod" ];
|
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "hpsa" "ohci_pci" "usbhid" "sd_mod" ];
|
||||||
boot.initrd.kernelModules = [ ];
|
boot.initrd.kernelModules = [ ];
|
||||||
boot.kernelModules = [ ];
|
boot.kernelModules = [ "kvm-intel" ];
|
||||||
boot.extraModulePackages = [ ];
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
fileSystems."/" =
|
fileSystems."/" =
|
||||||
{ device = "/dev/disk/by-uuid/20e06202-7a09-47cc-8ef6-5e7afe19453a";
|
{ device = "/dev/disk/by-uuid/31a67903-dc00-448a-a24a-36e820318fe5";
|
||||||
fsType = "ext4";
|
fsType = "ext4";
|
||||||
};
|
};
|
||||||
|
|
||||||
# temp data disk, only 128gb not enough until we can add another disk to the system.
|
|
||||||
fileSystems."/data" =
|
fileSystems."/data" =
|
||||||
{ device = "/dev/disk/by-uuid/c81af266-0781-4084-b8eb-c2587cbcf1ba";
|
{ device = "/dev/disk/by-uuid/79e93eed-ad95-45c9-b115-4ef92afcc8c0";
|
||||||
fsType = "ext4";
|
fsType = "f2fs";
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" =
|
|
||||||
{ device = "/dev/disk/by-uuid/198B-E363";
|
|
||||||
fsType = "vfat";
|
|
||||||
options = [ "fmask=0022" "dmask=0022" ];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
swapDevices = [ ];
|
swapDevices = [ ];
|
||||||
@@ -37,7 +30,11 @@
|
|||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
networking.useDHCP = lib.mkDefault true;
|
networking.useDHCP = lib.mkDefault true;
|
||||||
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
|
# networking.interfaces.enp6s0f0.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp6s0f1.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp6s0f2.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp6s0f3.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -66,7 +66,6 @@ in
|
|||||||
package = pkgs.callPackage (fp /packages/cgit.nix) { };
|
package = pkgs.callPackage (fp /packages/cgit.nix) { };
|
||||||
group = "gickup";
|
group = "gickup";
|
||||||
scanPath = "${cfg.dataDir}/linktree";
|
scanPath = "${cfg.dataDir}/linktree";
|
||||||
gitHttpBackend.checkExportOkFiles = false;
|
|
||||||
settings = {
|
settings = {
|
||||||
enable-commit-graph = true;
|
enable-commit-graph = true;
|
||||||
enable-follow-links = true;
|
enable-follow-links = true;
|
||||||
|
|||||||
@@ -6,14 +6,12 @@
|
|||||||
key = "synapse/turnconfig";
|
key = "synapse/turnconfig";
|
||||||
owner = config.users.users.matrix-synapse.name;
|
owner = config.users.users.matrix-synapse.name;
|
||||||
group = config.users.users.matrix-synapse.group;
|
group = config.users.users.matrix-synapse.group;
|
||||||
restartUnits = [ "coturn.service" ];
|
|
||||||
};
|
};
|
||||||
sops.secrets."matrix/coturn/static-auth-secret" = {
|
sops.secrets."matrix/coturn/static-auth-secret" = {
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||||
key = "coturn/static-auth-secret";
|
key = "coturn/static-auth-secret";
|
||||||
owner = config.users.users.turnserver.name;
|
owner = config.users.users.turnserver.name;
|
||||||
group = config.users.users.turnserver.group;
|
group = config.users.users.turnserver.group;
|
||||||
restartUnits = [ "coturn.service" ];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
services.matrix-synapse-next = {
|
services.matrix-synapse-next = {
|
||||||
@@ -44,7 +42,7 @@
|
|||||||
|
|
||||||
security.acme.certs.${config.services.coturn.realm} = {
|
security.acme.certs.${config.services.coturn.realm} = {
|
||||||
email = "drift@pvv.ntnu.no";
|
email = "drift@pvv.ntnu.no";
|
||||||
listenHTTP = "${values.services.turn.ipv4}:80";
|
listenHTTP = "129.241.210.213:80";
|
||||||
reloadServices = [ "coturn.service" ];
|
reloadServices = [ "coturn.service" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|||||||
@@ -9,8 +9,7 @@
|
|||||||
./coturn.nix
|
./coturn.nix
|
||||||
./mjolnir.nix
|
./mjolnir.nix
|
||||||
|
|
||||||
# ./discord.nix
|
./discord.nix
|
||||||
./out-of-your-element.nix
|
|
||||||
./hookshot
|
./hookshot
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|||||||
@@ -45,7 +45,7 @@ in
|
|||||||
};
|
};
|
||||||
|
|
||||||
|
|
||||||
services.mx-puppet-discord.enable = false;
|
services.mx-puppet-discord.enable = true;
|
||||||
services.mx-puppet-discord.settings = {
|
services.mx-puppet-discord.settings = {
|
||||||
bridge = {
|
bridge = {
|
||||||
bindAddress = "localhost";
|
bindAddress = "localhost";
|
||||||
|
|||||||
@@ -18,7 +18,6 @@ in
|
|||||||
sops.templates."hookshot-registration.yaml" = {
|
sops.templates."hookshot-registration.yaml" = {
|
||||||
owner = config.users.users.matrix-synapse.name;
|
owner = config.users.users.matrix-synapse.name;
|
||||||
group = config.users.groups.keys-matrix-registrations.name;
|
group = config.users.groups.keys-matrix-registrations.name;
|
||||||
restartUnits = [ "matrix-hookshot.service" ];
|
|
||||||
content = ''
|
content = ''
|
||||||
id: matrix-hookshot
|
id: matrix-hookshot
|
||||||
as_token: "${config.sops.placeholder."matrix/hookshot/as_token"}"
|
as_token: "${config.sops.placeholder."matrix/hookshot/as_token"}"
|
||||||
@@ -78,7 +77,7 @@ in
|
|||||||
outbound = true;
|
outbound = true;
|
||||||
urlPrefix = "https://hookshot.pvv.ntnu.no/webhook/";
|
urlPrefix = "https://hookshot.pvv.ntnu.no/webhook/";
|
||||||
userIdPrefix = "_webhooks_";
|
userIdPrefix = "_webhooks_";
|
||||||
allowJsTransformationFunctions = true;
|
allowJsTransformationFunctions = false;
|
||||||
waitForComplete = false;
|
waitForComplete = false;
|
||||||
};
|
};
|
||||||
feeds = {
|
feeds = {
|
||||||
@@ -95,11 +94,6 @@ in
|
|||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
widgets = {
|
|
||||||
roomSetupWidget.addOnInvite = false;
|
|
||||||
publicUrl = "https://hookshot.pvv.ntnu.no/widgetapi/v1/static";
|
|
||||||
};
|
|
||||||
|
|
||||||
permissions = [
|
permissions = [
|
||||||
# Users of the PVV Server
|
# Users of the PVV Server
|
||||||
{ actor = "pvv.ntnu.no";
|
{ actor = "pvv.ntnu.no";
|
||||||
@@ -134,7 +128,6 @@ in
|
|||||||
|
|
||||||
services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
|
services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
addSSL = true;
|
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = "http://${webhookListenAddress}:${toString webhookListenPort}";
|
proxyPass = "http://${webhookListenAddress}:${toString webhookListenPort}";
|
||||||
};
|
};
|
||||||
|
|||||||
@@ -6,7 +6,6 @@
|
|||||||
key = "mjolnir/access_token";
|
key = "mjolnir/access_token";
|
||||||
owner = config.users.users.mjolnir.name;
|
owner = config.users.users.mjolnir.name;
|
||||||
group = config.users.users.mjolnir.group;
|
group = config.users.users.mjolnir.group;
|
||||||
restartUnits = [ "mjolnir.service" ];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
services.mjolnir = {
|
services.mjolnir = {
|
||||||
|
|||||||
@@ -1,70 +0,0 @@
|
|||||||
{ config, pkgs, fp, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.matrix-ooye;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
users.groups.keys-matrix-registrations = { };
|
|
||||||
|
|
||||||
sops.secrets = {
|
|
||||||
"matrix/ooye/as_token" = {
|
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
|
||||||
key = "ooye/as_token";
|
|
||||||
restartUnits = [ "matrix-ooye.service" ];
|
|
||||||
};
|
|
||||||
"matrix/ooye/hs_token" = {
|
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
|
||||||
key = "ooye/hs_token";
|
|
||||||
restartUnits = [ "matrix-ooye.service" ];
|
|
||||||
};
|
|
||||||
"matrix/ooye/discord_token" = {
|
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
|
||||||
key = "ooye/discord_token";
|
|
||||||
restartUnits = [ "matrix-ooye.service" ];
|
|
||||||
};
|
|
||||||
"matrix/ooye/discord_client_secret" = {
|
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
|
||||||
key = "ooye/discord_client_secret";
|
|
||||||
restartUnits = [ "matrix-ooye.service" ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.matrix-ooye = {
|
|
||||||
enable = true;
|
|
||||||
homeserver = "https://matrix.pvv.ntnu.no";
|
|
||||||
homeserverName = "pvv.ntnu.no";
|
|
||||||
discordTokenPath = config.sops.secrets."matrix/ooye/discord_token".path;
|
|
||||||
discordClientSecretPath = config.sops.secrets."matrix/ooye/discord_client_secret".path;
|
|
||||||
bridgeOrigin = "https://ooye.pvv.ntnu.no";
|
|
||||||
|
|
||||||
enableSynapseIntegration = false;
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services."matrix-synapse" = {
|
|
||||||
after = [
|
|
||||||
"matrix-ooye-pre-start.service"
|
|
||||||
"network-online.target"
|
|
||||||
];
|
|
||||||
requires = [ "matrix-ooye-pre-start.service" ];
|
|
||||||
serviceConfig = {
|
|
||||||
LoadCredential = [
|
|
||||||
"matrix-ooye-registration:/var/lib/matrix-ooye/registration.yaml"
|
|
||||||
];
|
|
||||||
ExecStartPre = [
|
|
||||||
"+${pkgs.coreutils}/bin/cp /run/credentials/matrix-synapse.service/matrix-ooye-registration ${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
|
|
||||||
"+${pkgs.coreutils}/bin/chown matrix-synapse:keys-matrix-registrations ${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.matrix-synapse-next.settings = {
|
|
||||||
app_service_config_files = [
|
|
||||||
"${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."ooye.pvv.ntnu.no" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
locations."/".proxyPass = "http://localhost:${cfg.socket}";
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,4 +1,4 @@
|
|||||||
{ lib, buildPythonPackage, fetchFromGitHub, setuptools }:
|
{ lib, buildPythonPackage, fetchFromGitHub }:
|
||||||
|
|
||||||
buildPythonPackage rec {
|
buildPythonPackage rec {
|
||||||
pname = "matrix-synapse-smtp-auth";
|
pname = "matrix-synapse-smtp-auth";
|
||||||
@@ -6,9 +6,6 @@ buildPythonPackage rec {
|
|||||||
|
|
||||||
src = ./.;
|
src = ./.;
|
||||||
|
|
||||||
pyproject = true;
|
|
||||||
build-system = [ setuptools ];
|
|
||||||
|
|
||||||
doCheck = false;
|
doCheck = false;
|
||||||
|
|
||||||
meta = with lib; {
|
meta = with lib; {
|
||||||
|
|||||||
@@ -124,8 +124,8 @@ in {
|
|||||||
"fec0::/10"
|
"fec0::/10"
|
||||||
|
|
||||||
# NTNU
|
# NTNU
|
||||||
values.ntnu.ipv4-space
|
"129.241.0.0/16"
|
||||||
values.ntnu.ipv6-space
|
"2001:700:300::/44"
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|||||||
@@ -1,49 +0,0 @@
|
|||||||
{ config, lib, pkgs, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.minecraft-heatmap;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
sops.secrets."minecraft-heatmap/ssh-key/private" = {
|
|
||||||
mode = "600";
|
|
||||||
};
|
|
||||||
|
|
||||||
sops.secrets."minecraft-heatmap/postgres-passwd" = {
|
|
||||||
mode = "600";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.minecraft-heatmap = {
|
|
||||||
enable = true;
|
|
||||||
database = {
|
|
||||||
host = "postgres.pvv.ntnu.no";
|
|
||||||
port = 5432;
|
|
||||||
name = "minecraft_heatmap";
|
|
||||||
user = "minecraft_heatmap";
|
|
||||||
passwordFile = config.sops.secrets."minecraft-heatmap/postgres-passwd".path;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.minecraft-heatmap-ingest-logs = {
|
|
||||||
serviceConfig.LoadCredential = [
|
|
||||||
"sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
|
|
||||||
];
|
|
||||||
|
|
||||||
preStart = let
|
|
||||||
knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
|
|
||||||
innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
|
|
||||||
innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
|
|
||||||
innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
|
|
||||||
'';
|
|
||||||
in ''
|
|
||||||
mkdir -p '${cfg.minecraftLogsDir}'
|
|
||||||
"${lib.getExe pkgs.rsync}" \
|
|
||||||
--archive \
|
|
||||||
--verbose \
|
|
||||||
--progress \
|
|
||||||
--no-owner \
|
|
||||||
--no-group \
|
|
||||||
--rsh="${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=\"${knownHostsFile}\" -i \"$CREDENTIALS_DIRECTORY\"/sshkey" \
|
|
||||||
root@innovation.pvv.ntnu.no:/ \
|
|
||||||
'${cfg.minecraftLogsDir}'/
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -48,8 +48,6 @@
|
|||||||
IPAddressAllow = [
|
IPAddressAllow = [
|
||||||
values.ipv4-space
|
values.ipv4-space
|
||||||
values.ipv6-space
|
values.ipv6-space
|
||||||
values.hosts.ildkule.ipv4
|
|
||||||
values.hosts.ildkule.ipv6
|
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,15 +1,15 @@
|
|||||||
{ config, pkgs, values, ... }:
|
{ config, pkgs, ... }:
|
||||||
{
|
{
|
||||||
services.postgresql = {
|
services.postgresql = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = pkgs.postgresql_15;
|
package = pkgs.postgresql_15;
|
||||||
enableTCPIP = true;
|
enableTCPIP = true;
|
||||||
|
|
||||||
|
dataDir = "/data/postgresql";
|
||||||
|
|
||||||
authentication = ''
|
authentication = ''
|
||||||
host all all ${values.ipv4-space} md5
|
host all all 129.241.210.128/25 md5
|
||||||
host all all ${values.ipv6-space} md5
|
host all all 2001:700:300:1900::/64 md5
|
||||||
host all all ${values.hosts.ildkule.ipv4}/32 md5
|
|
||||||
host all all ${values.hosts.ildkule.ipv6}/32 md5
|
|
||||||
'';
|
'';
|
||||||
|
|
||||||
# Hilsen https://pgconfigurator.cybertec-postgresql.com/
|
# Hilsen https://pgconfigurator.cybertec-postgresql.com/
|
||||||
@@ -74,40 +74,11 @@
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.tmpfiles.settings."10-postgresql"."/data/postgresql".d = {
|
systemd.services.postgresql.serviceConfig = {
|
||||||
user = config.systemd.services.postgresql.serviceConfig.User;
|
LoadCredential = [
|
||||||
group = config.systemd.services.postgresql.serviceConfig.Group;
|
"cert:/etc/certs/postgres.crt"
|
||||||
mode = "0700";
|
"key:/etc/certs/postgres.key"
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.postgresql-setup = {
|
|
||||||
after = [
|
|
||||||
"systemd-tmpfiles-setup.service"
|
|
||||||
"systemd-tmpfiles-resetup.service"
|
|
||||||
];
|
];
|
||||||
serviceConfig = {
|
|
||||||
LoadCredential = [
|
|
||||||
"cert:/etc/certs/postgres.crt"
|
|
||||||
"key:/etc/certs/postgres.key"
|
|
||||||
];
|
|
||||||
|
|
||||||
BindPaths = [ "/data/postgresql:/var/lib/postgresql" ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.postgresql = {
|
|
||||||
after = [
|
|
||||||
"systemd-tmpfiles-setup.service"
|
|
||||||
"systemd-tmpfiles-resetup.service"
|
|
||||||
];
|
|
||||||
serviceConfig = {
|
|
||||||
LoadCredential = [
|
|
||||||
"cert:/etc/certs/postgres.crt"
|
|
||||||
"key:/etc/certs/postgres.key"
|
|
||||||
];
|
|
||||||
|
|
||||||
BindPaths = [ "/data/postgresql:/var/lib/postgresql" ];
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
environment.snakeoil-certs."/etc/certs/postgres" = {
|
environment.snakeoil-certs."/etc/certs/postgres" = {
|
||||||
|
|||||||
@@ -4,23 +4,29 @@
|
|||||||
# Include the results of the hardware scan.
|
# Include the results of the hardware scan.
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
(fp /base)
|
(fp /base)
|
||||||
|
(fp /misc/metrics-exporters.nix)
|
||||||
|
./disks.nix
|
||||||
|
|
||||||
./services/nfs-mounts.nix
|
(fp /misc/builder.nix)
|
||||||
];
|
];
|
||||||
|
|
||||||
# sops.defaultSopsFile = fp /secrets/shark/shark.yaml;
|
sops.defaultSopsFile = fp /secrets/bob/bob.yaml;
|
||||||
# sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||||
# sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||||
# sops.age.generateKey = true;
|
sops.age.generateKey = true;
|
||||||
|
|
||||||
boot.loader.systemd-boot.enable = true;
|
boot.loader.grub = {
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
enable = true;
|
||||||
|
efiSupport = true;
|
||||||
|
efiInstallAsRemovable = true;
|
||||||
|
};
|
||||||
|
|
||||||
networking.hostName = "temmie"; # Define your hostname.
|
networking.hostName = "bob"; # Define your hostname.
|
||||||
|
|
||||||
systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
|
systemd.network.networks."30-all" = values.defaultNetworkConfig // {
|
||||||
matchConfig.Name = "ens18";
|
matchConfig.Name = "en*";
|
||||||
address = with values.hosts.temmie; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
DHCP = "yes";
|
||||||
|
gateway = [ ];
|
||||||
};
|
};
|
||||||
|
|
||||||
# List packages installed in system profile
|
# List packages installed in system profile
|
||||||
@@ -35,5 +41,6 @@
|
|||||||
# this value at the release version of the first install of this system.
|
# this value at the release version of the first install of this system.
|
||||||
# Before changing this value read the documentation for this option
|
# Before changing this value read the documentation for this option
|
||||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
system.stateVersion = "25.11"; # Did you read the comment?
|
system.stateVersion = "23.05"; # Did you read the comment?
|
||||||
|
|
||||||
}
|
}
|
||||||
39
hosts/bob/disks.nix
Normal file
39
hosts/bob/disks.nix
Normal file
@@ -0,0 +1,39 @@
|
|||||||
|
# Example to create a bios compatible gpt partition
|
||||||
|
{ lib, ... }:
|
||||||
|
{
|
||||||
|
disko.devices = {
|
||||||
|
disk.disk1 = {
|
||||||
|
device = lib.mkDefault "/dev/sda";
|
||||||
|
type = "disk";
|
||||||
|
content = {
|
||||||
|
type = "gpt";
|
||||||
|
partitions = {
|
||||||
|
boot = {
|
||||||
|
name = "boot";
|
||||||
|
size = "1M";
|
||||||
|
type = "EF02";
|
||||||
|
};
|
||||||
|
esp = {
|
||||||
|
name = "ESP";
|
||||||
|
size = "500M";
|
||||||
|
type = "EF00";
|
||||||
|
content = {
|
||||||
|
type = "filesystem";
|
||||||
|
format = "vfat";
|
||||||
|
mountpoint = "/boot";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
root = {
|
||||||
|
name = "root";
|
||||||
|
size = "100%";
|
||||||
|
content = {
|
||||||
|
type = "filesystem";
|
||||||
|
format = "ext4";
|
||||||
|
mountpoint = "/";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -5,30 +5,20 @@
|
|||||||
|
|
||||||
{
|
{
|
||||||
imports =
|
imports =
|
||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||||
];
|
];
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
|
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_blk" ];
|
||||||
boot.initrd.kernelModules = [ ];
|
boot.initrd.kernelModules = [ ];
|
||||||
boot.kernelModules = [ "kvm-intel" ];
|
boot.kernelModules = [ ];
|
||||||
boot.extraModulePackages = [ ];
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/c7bbb293-a0a3-4995-8892-0ec63e8c67dd";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices =
|
|
||||||
[ { device = "/dev/disk/by-uuid/a86ffda8-8ecb-42a1-bf9f-926072e90ca5"; }
|
|
||||||
];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
networking.useDHCP = lib.mkDefault true;
|
networking.useDHCP = lib.mkDefault true;
|
||||||
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
|
# networking.interfaces.ens3.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
|
||||||
}
|
}
|
||||||
@@ -4,6 +4,7 @@
|
|||||||
# Include the results of the hardware scan.
|
# Include the results of the hardware scan.
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
(fp /base)
|
(fp /base)
|
||||||
|
(fp /misc/metrics-exporters.nix)
|
||||||
|
|
||||||
./services/grzegorz.nix
|
./services/grzegorz.nix
|
||||||
];
|
];
|
||||||
|
|||||||
@@ -4,10 +4,11 @@
|
|||||||
# Include the results of the hardware scan.
|
# Include the results of the hardware scan.
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
(fp /base)
|
(fp /base)
|
||||||
|
(fp /misc/metrics-exporters.nix)
|
||||||
|
|
||||||
(fp /modules/grzegorz.nix)
|
(fp /modules/grzegorz.nix)
|
||||||
];
|
];
|
||||||
|
services.spotifyd.enable = true;
|
||||||
boot.loader.systemd-boot.enable = true;
|
boot.loader.systemd-boot.enable = true;
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
|
||||||
@@ -24,26 +25,6 @@
|
|||||||
|
|
||||||
# List services that you want to enable:
|
# List services that you want to enable:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
services.spotifyd = {
|
|
||||||
enable = true;
|
|
||||||
settings.global = {
|
|
||||||
device_name = "georg";
|
|
||||||
use_mpris = false;
|
|
||||||
#dbus_type = "system";
|
|
||||||
#zeroconf_port = 1234;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [
|
|
||||||
# config.services.spotifyd.settings.zeroconf_port
|
|
||||||
5353 # spotifyd is its own mDNS service wtf
|
|
||||||
];
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# This value determines the NixOS release from which the default
|
# This value determines the NixOS release from which the default
|
||||||
# settings for stateful data, like file locations and database versions
|
# settings for stateful data, like file locations and database versions
|
||||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
|||||||
@@ -4,10 +4,10 @@
|
|||||||
# Include the results of the hardware scan.
|
# Include the results of the hardware scan.
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
(fp /base)
|
(fp /base)
|
||||||
|
(fp /misc/metrics-exporters.nix)
|
||||||
|
|
||||||
./services/monitoring
|
./services/monitoring
|
||||||
./services/nginx
|
./services/nginx
|
||||||
./services/journald-remote.nix
|
|
||||||
];
|
];
|
||||||
|
|
||||||
sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml;
|
sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml;
|
||||||
|
|||||||
@@ -1,58 +0,0 @@
|
|||||||
{ config, lib, values, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.journald.remote;
|
|
||||||
domainName = "journald.pvv.ntnu.no";
|
|
||||||
in
|
|
||||||
{
|
|
||||||
security.acme.certs.${domainName} = {
|
|
||||||
webroot = "/var/lib/acme/acme-challenge/";
|
|
||||||
group = config.services.nginx.group;
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx = {
|
|
||||||
enable = true;
|
|
||||||
virtualHosts.${domainName} = {
|
|
||||||
forceSSL = true;
|
|
||||||
useACMEHost = "${domainName}";
|
|
||||||
locations."/.well-known/".root = "/var/lib/acme/acme-challenge/";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.journald.upload.enable = lib.mkForce false;
|
|
||||||
|
|
||||||
services.journald.remote = {
|
|
||||||
enable = true;
|
|
||||||
settings.Remote = let
|
|
||||||
inherit (config.security.acme.certs.${domainName}) directory;
|
|
||||||
in {
|
|
||||||
ServerKeyFile = "/run/credentials/systemd-journal-remote.service/key.pem";
|
|
||||||
ServerCertificateFile = "/run/credentials/systemd-journal-remote.service/cert.pem";
|
|
||||||
TrustedCertificateFile = "-";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.sockets."systemd-journal-remote" = {
|
|
||||||
socketConfig = {
|
|
||||||
IPAddressDeny = "any";
|
|
||||||
IPAddressAllow = [
|
|
||||||
"127.0.0.1"
|
|
||||||
"::1"
|
|
||||||
values.ipv4-space
|
|
||||||
values.ipv6-space
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ cfg.port ];
|
|
||||||
|
|
||||||
systemd.services."systemd-journal-remote" = {
|
|
||||||
socketConfig = {
|
|
||||||
LoadCredential = let
|
|
||||||
inherit (config.security.acme.certs.${domainName}) directory;
|
|
||||||
in [
|
|
||||||
"key.pem:${directory}/key.pem"
|
|
||||||
"cert.pem:${directory}/cert.pem"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -2,12 +2,11 @@
|
|||||||
stateDir = "/data/monitoring/prometheus";
|
stateDir = "/data/monitoring/prometheus";
|
||||||
in {
|
in {
|
||||||
imports = [
|
imports = [
|
||||||
./exim.nix
|
|
||||||
./gitea.nix
|
./gitea.nix
|
||||||
./machines.nix
|
|
||||||
./matrix-synapse.nix
|
./matrix-synapse.nix
|
||||||
./mysqld.nix
|
./mysqld.nix
|
||||||
./postgres.nix
|
./postgres.nix
|
||||||
|
./machines.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
services.prometheus = {
|
services.prometheus = {
|
||||||
|
|||||||
@@ -1,14 +0,0 @@
|
|||||||
{ ... }:
|
|
||||||
{
|
|
||||||
services.prometheus = {
|
|
||||||
scrapeConfigs = [
|
|
||||||
{
|
|
||||||
job_name = "exim";
|
|
||||||
scrape_interval = "15s";
|
|
||||||
static_configs = [{
|
|
||||||
targets = [ "microbel.pvv.ntnu.no:9636" ];
|
|
||||||
}];
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,37 +1,66 @@
|
|||||||
{ config, ... }: let
|
{ config, ... }: let
|
||||||
cfg = config.services.prometheus;
|
cfg = config.services.prometheus;
|
||||||
|
|
||||||
mkHostScrapeConfig = name: ports: {
|
|
||||||
labels.hostname = name;
|
|
||||||
targets = map (port: "${name}.pvv.ntnu.no:${toString port}") ports;
|
|
||||||
};
|
|
||||||
|
|
||||||
defaultNodeExporterPort = 9100;
|
|
||||||
defaultSystemdExporterPort = 9101;
|
|
||||||
defaultNixosExporterPort = 9102;
|
|
||||||
in {
|
in {
|
||||||
services.prometheus.scrapeConfigs = [{
|
services.prometheus.scrapeConfigs = [{
|
||||||
job_name = "base_info";
|
job_name = "base_info";
|
||||||
static_configs = [
|
static_configs = [
|
||||||
(mkHostScrapeConfig "ildkule" [ cfg.exporters.node.port cfg.exporters.systemd.port defaultNixosExporterPort ])
|
{ labels.hostname = "ildkule";
|
||||||
|
targets = [
|
||||||
(mkHostScrapeConfig "bekkalokk" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
"ildkule.pvv.ntnu.no:${toString cfg.exporters.node.port}"
|
||||||
(mkHostScrapeConfig "bicep" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
"ildkule.pvv.ntnu.no:${toString cfg.exporters.systemd.port}"
|
||||||
(mkHostScrapeConfig "brzeczyszczykiewicz" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
];
|
||||||
(mkHostScrapeConfig "georg" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
}
|
||||||
(mkHostScrapeConfig "kommode" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
{ labels.hostname = "bekkalokk";
|
||||||
(mkHostScrapeConfig "ustetind" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
targets = [
|
||||||
(mkHostScrapeConfig "wenche" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
"bekkalokk.pvv.ntnu.no:9100"
|
||||||
|
"bekkalokk.pvv.ntnu.no:9101"
|
||||||
(mkHostScrapeConfig "lupine-1" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
];
|
||||||
# (mkHostScrapeConfig "lupine-2" [ defaultNodeExporterPort defaultSystemdExporterPort ])
|
}
|
||||||
(mkHostScrapeConfig "lupine-3" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
{ labels.hostname = "kommode";
|
||||||
(mkHostScrapeConfig "lupine-4" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
targets = [
|
||||||
(mkHostScrapeConfig "lupine-5" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
"kommode.pvv.ntnu.no:9100"
|
||||||
|
"kommode.pvv.ntnu.no:9101"
|
||||||
(mkHostScrapeConfig "hildring" [ defaultNodeExporterPort ])
|
];
|
||||||
(mkHostScrapeConfig "isvegg" [ defaultNodeExporterPort ])
|
}
|
||||||
(mkHostScrapeConfig "microbel" [ defaultNodeExporterPort ])
|
{ labels.hostname = "bicep";
|
||||||
|
targets = [
|
||||||
|
"bicep.pvv.ntnu.no:9100"
|
||||||
|
"bicep.pvv.ntnu.no:9101"
|
||||||
|
];
|
||||||
|
}
|
||||||
|
{ labels.hostname = "brzeczyszczykiewicz";
|
||||||
|
targets = [
|
||||||
|
"brzeczyszczykiewicz.pvv.ntnu.no:9100"
|
||||||
|
"brzeczyszczykiewicz.pvv.ntnu.no:9101"
|
||||||
|
];
|
||||||
|
}
|
||||||
|
{ labels.hostname = "georg";
|
||||||
|
targets = [
|
||||||
|
"georg.pvv.ntnu.no:9100"
|
||||||
|
"georg.pvv.ntnu.no:9101"
|
||||||
|
];
|
||||||
|
}
|
||||||
|
{ labels.hostname = "ustetind";
|
||||||
|
targets = [
|
||||||
|
"ustetind.pvv.ntnu.no:9100"
|
||||||
|
"ustetind.pvv.ntnu.no:9101"
|
||||||
|
];
|
||||||
|
}
|
||||||
|
{ labels.hostname = "hildring";
|
||||||
|
targets = [
|
||||||
|
"hildring.pvv.ntnu.no:9100"
|
||||||
|
];
|
||||||
|
}
|
||||||
|
{ labels.hostname = "isvegg";
|
||||||
|
targets = [
|
||||||
|
"isvegg.pvv.ntnu.no:9100"
|
||||||
|
];
|
||||||
|
}
|
||||||
|
{ labels.hostname = "microbel";
|
||||||
|
targets = [
|
||||||
|
"microbel.pvv.ntnu.no:9100"
|
||||||
|
];
|
||||||
|
}
|
||||||
];
|
];
|
||||||
}];
|
}];
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -10,7 +10,7 @@ in {
|
|||||||
inherit (config.sops) placeholder;
|
inherit (config.sops) placeholder;
|
||||||
in ''
|
in ''
|
||||||
[client]
|
[client]
|
||||||
host = mysql.pvv.ntnu.no
|
host = bicep.pvv.ntnu.no
|
||||||
port = 3306
|
port = 3306
|
||||||
user = prometheus_mysqld_exporter
|
user = prometheus_mysqld_exporter
|
||||||
password = ${placeholder."config/mysqld_exporter_password"}
|
password = ${placeholder."config/mysqld_exporter_password"}
|
||||||
|
|||||||
@@ -4,6 +4,7 @@
|
|||||||
# Include the results of the hardware scan.
|
# Include the results of the hardware scan.
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
(fp /base)
|
(fp /base)
|
||||||
|
(fp /misc/metrics-exporters.nix)
|
||||||
|
|
||||||
./services/gitea
|
./services/gitea
|
||||||
./services/nginx.nix
|
./services/nginx.nix
|
||||||
@@ -30,3 +31,4 @@
|
|||||||
|
|
||||||
system.stateVersion = "24.11";
|
system.stateVersion = "24.11";
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -24,15 +24,10 @@ in
|
|||||||
script = let
|
script = let
|
||||||
logo-svg = fp /assets/logo_blue_regular.svg;
|
logo-svg = fp /assets/logo_blue_regular.svg;
|
||||||
logo-png = fp /assets/logo_blue_regular.png;
|
logo-png = fp /assets/logo_blue_regular.png;
|
||||||
|
|
||||||
extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
|
extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
|
||||||
<a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
|
|
||||||
'';
|
|
||||||
|
|
||||||
extraLinksFooter = pkgs.writeText "gitea-extra-links-footer.tmpl" ''
|
|
||||||
<a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
|
<a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
|
||||||
<a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
|
<a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
|
||||||
<a class="item" href="https://wiki.pvv.ntnu.no/wiki/Tjenester/Kodelager">PVV Gitea Howto</a>
|
<a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
|
||||||
'';
|
'';
|
||||||
|
|
||||||
project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
|
project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
|
||||||
@@ -47,14 +42,13 @@ in
|
|||||||
} ''
|
} ''
|
||||||
# Bigger icons
|
# Bigger icons
|
||||||
install -Dm444 "${cfg.package.src}/templates/repo/icon.tmpl" "$out/repo/icon.tmpl"
|
install -Dm444 "${cfg.package.src}/templates/repo/icon.tmpl" "$out/repo/icon.tmpl"
|
||||||
sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
|
sed -i -e 's/24/48/g' "$out/repo/icon.tmpl"
|
||||||
'';
|
'';
|
||||||
in ''
|
in ''
|
||||||
install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
|
install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
|
||||||
install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
|
install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
|
||||||
install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
|
install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
|
||||||
install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
|
install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
|
||||||
install -Dm444 ${extraLinksFooter} ${cfg.customDir}/templates/custom/extra_links_footer.tmpl
|
|
||||||
install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml
|
install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml
|
||||||
|
|
||||||
"${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
|
"${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
|
||||||
|
|||||||
@@ -35,12 +35,6 @@
|
|||||||
"color": "#ed1111",
|
"color": "#ed1111",
|
||||||
"description": "Report an oopsie"
|
"description": "Report an oopsie"
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"name": "developer experience",
|
|
||||||
"exclusive": false,
|
|
||||||
"color": "#eb6420",
|
|
||||||
"description": "Think about the developers"
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"name": "disputed",
|
"name": "disputed",
|
||||||
"exclusive": false,
|
"exclusive": false,
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
{ config, values, lib, pkgs, unstablePkgs, ... }:
|
{ config, values, lib, unstablePkgs, ... }:
|
||||||
let
|
let
|
||||||
cfg = config.services.gitea;
|
cfg = config.services.gitea;
|
||||||
domain = "git.pvv.ntnu.no";
|
domain = "git.pvv.ntnu.no";
|
||||||
@@ -11,18 +11,15 @@ in {
|
|||||||
./web-secret-provider
|
./web-secret-provider
|
||||||
];
|
];
|
||||||
|
|
||||||
sops.secrets = let
|
sops.secrets = {
|
||||||
defaultConfig = {
|
"gitea/database" = {
|
||||||
|
owner = "gitea";
|
||||||
|
group = "gitea";
|
||||||
|
};
|
||||||
|
"gitea/email-password" = {
|
||||||
owner = "gitea";
|
owner = "gitea";
|
||||||
group = "gitea";
|
group = "gitea";
|
||||||
restartUnits = [ "gitea.service" ];
|
|
||||||
};
|
};
|
||||||
in {
|
|
||||||
"gitea/database" = defaultConfig;
|
|
||||||
"gitea/email-password" = defaultConfig;
|
|
||||||
"gitea/lfs-jwt-secret" = defaultConfig;
|
|
||||||
"gitea/oauth2-jwt-secret" = defaultConfig;
|
|
||||||
"gitea/secret-key" = defaultConfig;
|
|
||||||
};
|
};
|
||||||
|
|
||||||
services.gitea = {
|
services.gitea = {
|
||||||
@@ -48,15 +45,9 @@ in {
|
|||||||
ROOT_URL = "https://${domain}/";
|
ROOT_URL = "https://${domain}/";
|
||||||
PROTOCOL = "http+unix";
|
PROTOCOL = "http+unix";
|
||||||
SSH_PORT = sshPort;
|
SSH_PORT = sshPort;
|
||||||
LANDING_PAGE = "explore";
|
|
||||||
START_SSH_SERVER = true;
|
START_SSH_SERVER = true;
|
||||||
START_LFS_SERVER = true;
|
START_LFS_SERVER = true;
|
||||||
LFS_JWT_SECRET = lib.mkForce "";
|
LANDING_PAGE = "explore";
|
||||||
LFS_JWT_SECRET_URI = "file:${config.sops.secrets."gitea/lfs-jwt-secret".path}";
|
|
||||||
};
|
|
||||||
oauth2 = {
|
|
||||||
JWT_SECRET = lib.mkForce "";
|
|
||||||
JWT_SECRET_URI = "file:${config.sops.secrets."gitea/oauth2-jwt-secret".path}";
|
|
||||||
};
|
};
|
||||||
"git.timeout" = {
|
"git.timeout" = {
|
||||||
MIGRATE = 3600;
|
MIGRATE = 3600;
|
||||||
@@ -84,10 +75,6 @@ in {
|
|||||||
};
|
};
|
||||||
admin.DEFAULT_EMAIL_NOTIFICATIONS = "onmention";
|
admin.DEFAULT_EMAIL_NOTIFICATIONS = "onmention";
|
||||||
session.COOKIE_SECURE = true;
|
session.COOKIE_SECURE = true;
|
||||||
security = {
|
|
||||||
SECRET_KEY = lib.mkForce "";
|
|
||||||
SECRET_KEY_URI = "file:${config.sops.secrets."gitea/secret-key".path}";
|
|
||||||
};
|
|
||||||
database.LOG_SQL = false;
|
database.LOG_SQL = false;
|
||||||
repository = {
|
repository = {
|
||||||
PREFERRED_LICENSES = lib.concatStringsSep "," [
|
PREFERRED_LICENSES = lib.concatStringsSep "," [
|
||||||
@@ -122,10 +109,6 @@ in {
|
|||||||
picture = {
|
picture = {
|
||||||
DISABLE_GRAVATAR = true;
|
DISABLE_GRAVATAR = true;
|
||||||
ENABLE_FEDERATED_AVATAR = false;
|
ENABLE_FEDERATED_AVATAR = false;
|
||||||
|
|
||||||
AVATAR_MAX_FILE_SIZE = 1024 * 1024 * 5;
|
|
||||||
# NOTE: go any bigger than this, and gitea will freeze your gif >:(
|
|
||||||
AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 2;
|
|
||||||
};
|
};
|
||||||
actions.ENABLED = true;
|
actions.ENABLED = true;
|
||||||
ui = {
|
ui = {
|
||||||
@@ -166,11 +149,6 @@ in {
|
|||||||
|
|
||||||
systemd.services.gitea.serviceConfig.CPUSchedulingPolicy = "batch";
|
systemd.services.gitea.serviceConfig.CPUSchedulingPolicy = "batch";
|
||||||
|
|
||||||
systemd.services.gitea.serviceConfig.CacheDirectory = "gitea/repo-archive";
|
|
||||||
systemd.services.gitea.serviceConfig.BindPaths = [
|
|
||||||
"%C/gitea/repo-archive:${cfg.stateDir}/data/repo-archive"
|
|
||||||
];
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."${domain}" = {
|
services.nginx.virtualHosts."${domain}" = {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
@@ -194,31 +172,4 @@ in {
|
|||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ sshPort ];
|
networking.firewall.allowedTCPPorts = [ sshPort ];
|
||||||
|
|
||||||
systemd.services.gitea-dump = {
|
|
||||||
serviceConfig.ExecStart = let
|
|
||||||
args = lib.cli.toGNUCommandLineShell { } {
|
|
||||||
type = cfg.dump.type;
|
|
||||||
|
|
||||||
# This should be declarative on nixos, no need to backup.
|
|
||||||
skip-custom-dir = true;
|
|
||||||
|
|
||||||
# This can be regenerated, no need to backup
|
|
||||||
skip-index = true;
|
|
||||||
|
|
||||||
# Logs are stored in the systemd journal
|
|
||||||
skip-log = true;
|
|
||||||
};
|
|
||||||
in lib.mkForce "${lib.getExe cfg.package} ${args}";
|
|
||||||
|
|
||||||
# Only keep n backup files at a time
|
|
||||||
postStop = let
|
|
||||||
cu = prog: "'${lib.getExe' pkgs.coreutils prog}'";
|
|
||||||
backupCount = 3;
|
|
||||||
in ''
|
|
||||||
for file in $(${cu "ls"} -t1 '${cfg.dump.backupDir}' | ${cu "sort"} --reverse | ${cu "tail"} -n+${toString (backupCount + 1)}); do
|
|
||||||
${cu "rm"} "$file"
|
|
||||||
done
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -4,23 +4,9 @@ let
|
|||||||
GNUPGHOME = "${config.users.users.gitea.home}/gnupg";
|
GNUPGHOME = "${config.users.users.gitea.home}/gnupg";
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
sops.secrets = {
|
sops.secrets."gitea/gpg-signing-key" = {
|
||||||
"gitea/gpg-signing-key-public" = {
|
owner = cfg.user;
|
||||||
owner = cfg.user;
|
inherit (cfg) group;
|
||||||
inherit (cfg) group;
|
|
||||||
restartUnits = [
|
|
||||||
"gitea.service"
|
|
||||||
"gitea-ensure-gnupg-homedir.service"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
"gitea/gpg-signing-key-private" = {
|
|
||||||
owner = cfg.user;
|
|
||||||
inherit (cfg) group;
|
|
||||||
restartUnits = [
|
|
||||||
"gitea.service"
|
|
||||||
"gitea-ensure-gnupg-homedir.service"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.gitea.environment = { inherit GNUPGHOME; };
|
systemd.services.gitea.environment = { inherit GNUPGHOME; };
|
||||||
@@ -32,7 +18,6 @@ in
|
|||||||
|
|
||||||
systemd.services.gitea-ensure-gnupg-homedir = {
|
systemd.services.gitea-ensure-gnupg-homedir = {
|
||||||
description = "Import gpg key for gitea";
|
description = "Import gpg key for gitea";
|
||||||
before = [ "gitea.service" ];
|
|
||||||
environment = { inherit GNUPGHOME; };
|
environment = { inherit GNUPGHOME; };
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
Type = "oneshot";
|
Type = "oneshot";
|
||||||
@@ -40,8 +25,7 @@ in
|
|||||||
PrivateNetwork = true;
|
PrivateNetwork = true;
|
||||||
};
|
};
|
||||||
script = ''
|
script = ''
|
||||||
${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-public".path}
|
${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key".path}
|
||||||
${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-private".path}
|
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -50,6 +34,5 @@ in
|
|||||||
SIGNING_NAME = "PVV Git";
|
SIGNING_NAME = "PVV Git";
|
||||||
SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
|
SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
|
||||||
INITIAL_COMMIT = "always";
|
INITIAL_COMMIT = "always";
|
||||||
WIKI = "always";
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -11,8 +11,7 @@ in
|
|||||||
|
|
||||||
systemd.services.gitea-import-users = lib.mkIf cfg.enable {
|
systemd.services.gitea-import-users = lib.mkIf cfg.enable {
|
||||||
enable = true;
|
enable = true;
|
||||||
preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
|
preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /tmp/passwd-import'';
|
||||||
environment.PASSWD_FILE_PATH = "/run/gitea-import-users/passwd";
|
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
|
ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
|
||||||
flakeIgnore = [
|
flakeIgnore = [
|
||||||
@@ -26,7 +25,6 @@ in
|
|||||||
];
|
];
|
||||||
DynamicUser="yes";
|
DynamicUser="yes";
|
||||||
EnvironmentFile=config.sops.secrets."gitea/import-user-env".path;
|
EnvironmentFile=config.sops.secrets."gitea/import-user-env".path;
|
||||||
RuntimeDirectory = "gitea-import-users";
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|||||||
@@ -17,10 +17,6 @@ GITEA_API_URL = os.getenv('GITEA_API_URL')
|
|||||||
if GITEA_API_URL is None:
|
if GITEA_API_URL is None:
|
||||||
GITEA_API_URL = 'https://git.pvv.ntnu.no/api/v1'
|
GITEA_API_URL = 'https://git.pvv.ntnu.no/api/v1'
|
||||||
|
|
||||||
PASSWD_FILE_PATH = os.getenv('PASSWD_FILE_PATH')
|
|
||||||
if PASSWD_FILE_PATH is None:
|
|
||||||
PASSWD_FILE_PATH = '/tmp/passwd-import'
|
|
||||||
|
|
||||||
|
|
||||||
def gitea_list_all_users() -> dict[str, dict[str, any]] | None:
|
def gitea_list_all_users() -> dict[str, dict[str, any]] | None:
|
||||||
r = requests.get(
|
r = requests.get(
|
||||||
@@ -191,8 +187,7 @@ def main():
|
|||||||
if existing_users is None:
|
if existing_users is None:
|
||||||
exit(1)
|
exit(1)
|
||||||
|
|
||||||
print(f"Reading passwd entries from {PASSWD_FILE_PATH}")
|
for username, name in passwd_file_parser("/tmp/passwd-import"):
|
||||||
for username, name in passwd_file_parser(PASSWD_FILE_PATH):
|
|
||||||
print(f"Processing {username}")
|
print(f"Processing {username}")
|
||||||
add_or_patch_gitea_user(username, name, existing_users)
|
add_or_patch_gitea_user(username, name, existing_users)
|
||||||
for org, team_name in COMMON_USER_TEAMS:
|
for org, team_name in COMMON_USER_TEAMS:
|
||||||
|
|||||||
@@ -1,34 +0,0 @@
|
|||||||
{ fp, values, lupineName, ... }:
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
./hardware-configuration/${lupineName}.nix
|
|
||||||
|
|
||||||
(fp /base)
|
|
||||||
|
|
||||||
./services/gitea-runner.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
sops.defaultSopsFile = fp /secrets/lupine/lupine.yaml;
|
|
||||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
||||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
|
||||||
sops.age.generateKey = true;
|
|
||||||
|
|
||||||
boot.loader.systemd-boot.enable = true;
|
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
|
||||||
|
|
||||||
systemd.network.networks."30-enp0s31f6" = values.defaultNetworkConfig // {
|
|
||||||
matchConfig.Name = "enp0s31f6";
|
|
||||||
address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
|
||||||
networkConfig.LLDP = false;
|
|
||||||
};
|
|
||||||
systemd.network.wait-online = {
|
|
||||||
anyInterface = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
# There are no smart devices
|
|
||||||
services.smartd.enable = false;
|
|
||||||
|
|
||||||
# Do not change, even during upgrades.
|
|
||||||
# See https://search.nixos.org/options?show=system.stateVersion
|
|
||||||
system.stateVersion = "25.05";
|
|
||||||
}
|
|
||||||
@@ -1,40 +0,0 @@
|
|||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ "kvm-intel" ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/a949e2e8-d973-4925-83e4-bcd815e65af7";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" =
|
|
||||||
{ device = "/dev/disk/by-uuid/81D6-38D3";
|
|
||||||
fsType = "vfat";
|
|
||||||
options = [ "fmask=0077" "dmask=0077" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices =
|
|
||||||
[ { device = "/dev/disk/by-uuid/82c2d7fa-7cd0-4398-8cf6-c892bc56264b"; }
|
|
||||||
];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
|
||||||
}
|
|
||||||
@@ -1,40 +0,0 @@
|
|||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ "kvm-intel" ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/aa81d439-800b-403d-ac10-9d2aac3619d0";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" =
|
|
||||||
{ device = "/dev/disk/by-uuid/4A34-6AE5";
|
|
||||||
fsType = "vfat";
|
|
||||||
options = [ "fmask=0077" "dmask=0077" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices =
|
|
||||||
[ { device = "/dev/disk/by-uuid/efb7cd0c-c1ae-4a86-8bc2-8e7fd0066650"; }
|
|
||||||
];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
|
||||||
}
|
|
||||||
@@ -1,40 +0,0 @@
|
|||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ "kvm-intel" ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/39ba059b-3205-4701-a832-e72c0122cb88";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" =
|
|
||||||
{ device = "/dev/disk/by-uuid/63FA-297B";
|
|
||||||
fsType = "vfat";
|
|
||||||
options = [ "fmask=0077" "dmask=0077" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices =
|
|
||||||
[ { device = "/dev/disk/by-uuid/9c72eb54-ea8c-4b09-808a-8be9b9a33869"; }
|
|
||||||
];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
|
||||||
}
|
|
||||||
@@ -1,40 +0,0 @@
|
|||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ "kvm-intel" ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/5f8418ad-8ec1-4f9e-939e-f3a4c36ef343";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" =
|
|
||||||
{ device = "/dev/disk/by-uuid/F372-37DF";
|
|
||||||
fsType = "vfat";
|
|
||||||
options = [ "fmask=0077" "dmask=0077" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices =
|
|
||||||
[ { device = "/dev/disk/by-uuid/27bf292d-bbb3-48c4-a86e-456e0f1f648f"; }
|
|
||||||
];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
|
||||||
}
|
|
||||||
@@ -1,71 +0,0 @@
|
|||||||
{ config, lupineName, ... }:
|
|
||||||
{
|
|
||||||
# This is unfortunately state, and has to be generated one at a time :(
|
|
||||||
# To do that, comment out all except one of the runners, fill in its token
|
|
||||||
# inside the sops file, rebuild the system, and only after this runner has
|
|
||||||
# successfully registered will gitea give you the next token.
|
|
||||||
# - oysteikt Sep 2023
|
|
||||||
sops = {
|
|
||||||
secrets."gitea/runners/token" = {
|
|
||||||
key = "gitea/runners/${lupineName}";
|
|
||||||
};
|
|
||||||
|
|
||||||
templates."gitea-runner-envfile" = {
|
|
||||||
restartUnits = [
|
|
||||||
"gitea-runner-${lupineName}.service"
|
|
||||||
];
|
|
||||||
content = ''
|
|
||||||
TOKEN="${config.sops.placeholder."gitea/runners/token"}"
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.gitea-actions-runner.instances = {
|
|
||||||
${lupineName} = {
|
|
||||||
enable = true;
|
|
||||||
name = "git-runner-${lupineName}";
|
|
||||||
url = "https://git.pvv.ntnu.no";
|
|
||||||
# NOTE: gitea actions runners need node inside their docker images,
|
|
||||||
# so we are a bit limited here.
|
|
||||||
labels = [
|
|
||||||
"debian-latest:docker://node:current-trixie"
|
|
||||||
"debian-trixie:docker://node:current-trixie"
|
|
||||||
"debian-bookworm:docker://node:current-bookworm"
|
|
||||||
"debian-bullseye:docker://node:current-bullseye"
|
|
||||||
|
|
||||||
"debian-latest-slim:docker://node:current-trixie-slim"
|
|
||||||
"debian-trixie-slim:docker://node:current-trixie-slim"
|
|
||||||
"debian-bookworm-slim:docker://node:current-bookworm-slim"
|
|
||||||
"debian-bullseye-slim:docker://node:current-bullseye-slim"
|
|
||||||
|
|
||||||
"alpine-latest:docker://node:current-alpine"
|
|
||||||
"alpine-3.22:docker://node:current-alpine3.22"
|
|
||||||
"alpine-3.21:docker://node:current-alpine3.21"
|
|
||||||
|
|
||||||
# See https://gitea.com/gitea/runner-images
|
|
||||||
"ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
|
|
||||||
"ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
|
|
||||||
"ubuntu-noble:docker://docker.gitea.com/runner-images:ubuntu-24.04"
|
|
||||||
"ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
|
|
||||||
"ubuntu-jammy:docker://docker.gitea.com/runner-images:ubuntu-22.04"
|
|
||||||
|
|
||||||
"ubuntu-latest-slim:docker://docker.gitea.com/runner-images:ubuntu-latest-slim"
|
|
||||||
"ubuntu-24.04-slim:docker://docker.gitea.com/runner-images:ubuntu-24.04-slim"
|
|
||||||
"ubuntu-noble-slim:docker://docker.gitea.com/runner-images:ubuntu-24.04-slim"
|
|
||||||
"ubuntu-22.04-slim:docker://docker.gitea.com/runner-images:ubuntu-22.04-slim"
|
|
||||||
"ubuntu-jammy-slim:docker://docker.gitea.com/runner-images:ubuntu-22.04-slim"
|
|
||||||
];
|
|
||||||
tokenFile = config.sops.templates."gitea-runner-envfile".path;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
virtualisation.podman = {
|
|
||||||
enable = true;
|
|
||||||
defaultNetwork.settings.dns_enabled = true;
|
|
||||||
autoPrune.enable = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.dhcpcd.IPv6rs = false;
|
|
||||||
|
|
||||||
networking.firewall.interfaces."podman+".allowedUDPPorts = [53 5353];
|
|
||||||
}
|
|
||||||
@@ -4,6 +4,7 @@
|
|||||||
# Include the results of the hardware scan.
|
# Include the results of the hardware scan.
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
(fp /base)
|
(fp /base)
|
||||||
|
(fp /misc/metrics-exporters.nix)
|
||||||
];
|
];
|
||||||
|
|
||||||
sops.defaultSopsFile = fp /secrets/shark/shark.yaml;
|
sops.defaultSopsFile = fp /secrets/shark/shark.yaml;
|
||||||
|
|||||||
@@ -1,73 +0,0 @@
|
|||||||
{ config, pkgs, lib, fp, ... }: {
|
|
||||||
imports = [
|
|
||||||
# ./hardware-configuration.nix
|
|
||||||
|
|
||||||
(fp /base)
|
|
||||||
];
|
|
||||||
|
|
||||||
boot = {
|
|
||||||
consoleLogLevel = 0;
|
|
||||||
enableContainers = false;
|
|
||||||
loader.grub.enable = false;
|
|
||||||
kernelPackages = pkgs.linuxPackages;
|
|
||||||
};
|
|
||||||
|
|
||||||
# Now turn off a bunch of stuff lol
|
|
||||||
system.autoUpgrade.enable = lib.mkForce false;
|
|
||||||
services.irqbalance.enable = lib.mkForce false;
|
|
||||||
services.logrotate.enable = lib.mkForce false;
|
|
||||||
services.nginx.enable = lib.mkForce false;
|
|
||||||
services.postfix.enable = lib.mkForce false;
|
|
||||||
|
|
||||||
# TODO: can we reduce further?
|
|
||||||
|
|
||||||
system.stateVersion = "25.05";
|
|
||||||
|
|
||||||
sops.defaultSopsFile = fp /secrets/skrott/skrott.yaml;
|
|
||||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
||||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
|
||||||
sops.age.generateKey = true;
|
|
||||||
|
|
||||||
sops.secrets = {
|
|
||||||
"dibbler/postgresql/url" = {
|
|
||||||
owner = "dibbler";
|
|
||||||
group = "dibbler";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# zramSwap.enable = true;
|
|
||||||
|
|
||||||
networking = {
|
|
||||||
hostName = "skrot";
|
|
||||||
interfaces.eth0 = {
|
|
||||||
useDHCP = false;
|
|
||||||
ipv4.addresses = [{
|
|
||||||
address = "129.241.210.235";
|
|
||||||
prefixLength = 25;
|
|
||||||
}];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.dibbler = {
|
|
||||||
enable = true;
|
|
||||||
kioskMode = true;
|
|
||||||
limitScreenWidth = 80;
|
|
||||||
limitScreenHeight = 42;
|
|
||||||
|
|
||||||
settings = {
|
|
||||||
general.quit_allowed = false;
|
|
||||||
database.url = config.sops.secrets."dibbler/postgresql/url".path;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# https://github.com/NixOS/nixpkgs/issues/84105
|
|
||||||
boot.kernelParams = [
|
|
||||||
"console=ttyUSB0,9600"
|
|
||||||
# "console=tty1" # Already part of the module
|
|
||||||
];
|
|
||||||
systemd.services."serial-getty@ttyUSB0" = {
|
|
||||||
enable = true;
|
|
||||||
wantedBy = [ "getty.target" ]; # to start at boot
|
|
||||||
serviceConfig.Restart = "always"; # restart when session is closed
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,30 +0,0 @@
|
|||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/c3aed415-0054-4ac5-8d29-75a99cc26451";
|
|
||||||
fsType = "btrfs";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" =
|
|
||||||
{ device = "/dev/disk/by-uuid/A367-83FD";
|
|
||||||
fsType = "vfat";
|
|
||||||
options = [ "fmask=0022" "dmask=0022" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices = [ ];
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
}
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
{ pkgs, lib, ... }:
|
|
||||||
{
|
|
||||||
fileSystems = let
|
|
||||||
# See microbel:/etc/exports
|
|
||||||
shorthandAreas = lib.listToAttrs (map
|
|
||||||
(l: lib.nameValuePair "/run/pvv-home-mounts/${l}" "homepvv${l}.pvv.ntnu.no:/export/home/pvv/${l}")
|
|
||||||
[ "a" "b" "c" "d" "h" "i" "j" "k" "l" "m" "z" ]);
|
|
||||||
in { }
|
|
||||||
//
|
|
||||||
(lib.mapAttrs (_: device: {
|
|
||||||
inherit device;
|
|
||||||
fsType = "nfs";
|
|
||||||
options = [
|
|
||||||
"nfsvers=3"
|
|
||||||
"noauto"
|
|
||||||
"proto=tcp"
|
|
||||||
"x-systemd.automount"
|
|
||||||
"x-systemd.idle-timeout=300"
|
|
||||||
];
|
|
||||||
}) shorthandAreas);
|
|
||||||
}
|
|
||||||
@@ -3,6 +3,7 @@
|
|||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
(fp /base)
|
(fp /base)
|
||||||
|
(fp /misc/metrics-exporters.nix)
|
||||||
|
|
||||||
./services/gitea-runners.nix
|
./services/gitea-runners.nix
|
||||||
];
|
];
|
||||||
|
|||||||
@@ -4,16 +4,11 @@
|
|||||||
# Include the results of the hardware scan.
|
# Include the results of the hardware scan.
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
(fp /base)
|
(fp /base)
|
||||||
|
(fp /misc/metrics-exporters.nix)
|
||||||
|
|
||||||
|
(fp /misc/builder.nix)
|
||||||
];
|
];
|
||||||
|
|
||||||
nix.settings.trusted-users = [ "@nix-builder-users" ];
|
|
||||||
nix.daemonCPUSchedPolicy = "batch";
|
|
||||||
|
|
||||||
boot.binfmt.emulatedSystems = [
|
|
||||||
"aarch64-linux"
|
|
||||||
"armv7l-linux"
|
|
||||||
];
|
|
||||||
|
|
||||||
sops.defaultSopsFile = fp /secrets/wenche/wenche.yaml;
|
sops.defaultSopsFile = fp /secrets/wenche/wenche.yaml;
|
||||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||||
|
|||||||
4
justfile
4
justfile
@@ -1,6 +1,6 @@
|
|||||||
set positional-arguments # makes variables accesible as $1 $2 $@
|
set positional-arguments # makes variables accesible as $1 $2 $@
|
||||||
export GUM_FILTER_HEIGHT := "15"
|
export GUM_FILTER_HEIGHT := "15"
|
||||||
nom := `if [[ -t 1 ]] && command -v nom >/dev/null; then echo nom; else echo nix; fi`
|
nom := `if [[ -t 2 ]] && command -v nom >/dev/null; then echo nom; else echo nix; fi`
|
||||||
nix_eval_opts := "--log-format raw --option warn-dirty false"
|
nix_eval_opts := "--log-format raw --option warn-dirty false"
|
||||||
|
|
||||||
@_default:
|
@_default:
|
||||||
@@ -26,7 +26,7 @@ run-vm machine=`just _a_machine` *_:
|
|||||||
| xargs -d'\n' nix flake update "$@"
|
| xargs -d'\n' nix flake update "$@"
|
||||||
|
|
||||||
@repl $machine=`just _a_machine` *_:
|
@repl $machine=`just _a_machine` *_:
|
||||||
set -v; nixos-rebuild --flake .#"$machine" repl "${@:2}"
|
set -v; NIX_NO_NOM=1 nixos-rebuild --flake .#"$machine" repl "${@:2}"
|
||||||
|
|
||||||
@eval $machine=`just _a_machine` $attrpath="system.build.toplevel.outPath" *_:
|
@eval $machine=`just _a_machine` $attrpath="system.build.toplevel.outPath" *_:
|
||||||
set -v; nix eval {{nix_eval_opts}} ".#nixosConfigurations.\"$machine\".config.$attrpath" --show-trace "${@:3}"
|
set -v; nix eval {{nix_eval_opts}} ".#nixosConfigurations.\"$machine\".config.$attrpath" --show-trace "${@:3}"
|
||||||
|
|||||||
@@ -26,40 +26,29 @@ eJAiipB0QOH9SEa5Io6BSiqsBQJmqp4CBQkFpUs7AIF2IAQZFgoAHRYhBPPNqGzF
|
|||||||
Wp8Q16BpgZ8vfYJQ81FGBQJi5oZHAAoJEJ8vfYJQ81FGFZgBALN+Rh4m323TaM5z
|
Wp8Q16BpgZ8vfYJQ81FGBQJi5oZHAAoJEJ8vfYJQ81FGFZgBALN+Rh4m323TaM5z
|
||||||
dJfCTV7V0aP3J0RdKmtKvz/Y9a7uAP4oP8UlbM9ucyG252gZ8IjM0VprNzP9CpNl
|
dJfCTV7V0aP3J0RdKmtKvz/Y9a7uAP4oP8UlbM9ucyG252gZ8IjM0VprNzP9CpNl
|
||||||
4GzpD4CRDgkQRrkijoFKKqwYoQEAz0D3G/dD6DBYBf7p6pGYqXd2X0Dv8nmnalol
|
4GzpD4CRDgkQRrkijoFKKqwYoQEAz0D3G/dD6DBYBf7p6pGYqXd2X0Dv8nmnalol
|
||||||
Z6SxfUMA/jT/XjPh7c4Ui8nZO7XDzYWrbV/eZwGMd1zXq2mU42MLiPUEGBYKACYC
|
Z6SxfUMA/jT/XjPh7c4Ui8nZO7XDzYWrbV/eZwGMd1zXq2mU42MLuQINBGLmhnoB
|
||||||
GwIWIQT303iQIoqQdEDh/UhGuSKOgUoqrAUCaI6lzgUJCWqGhwCBdiAEGRYKAB0W
|
EADa1yBK0NKxVIto3hSh21hooYpWcEXWqMPXHO34rcAhktVFOOHIl2bFGScQAZXt
|
||||||
IQTzzahsxVqfENegaYGfL32CUPNRRgUCYuaGRwAKCRCfL32CUPNRRhWYAQCzfkYe
|
jAcqUmMyC+PMs1DZoocFk+9PJt17hAa/s6CRrw8vK+1fVqhj0XOLtevGV9iC6IRv
|
||||||
Jt9t02jOc3SXwk1e1dGj9ydEXSprSr8/2PWu7gD+KD/FJWzPbnMhtudoGfCIzNFa
|
hPxzTsOaeOssgMGIU8xDmMKT2nGHGNUkqOXGld63E3NKsK3lnl+BCdpJ0f3GEB7a
|
||||||
azcz/QqTZeBs6Q+AkQ4JEEa5Io6BSiqsCG0BALDNFlploZWjQ0Xn3B9fd+1sTUmY
|
SQ+pk6k1uzODXX/mhAUJmL1MkVZ6jJA3vhsre0Kfa9p+C5mP4hLJ6jF+oESvA4HC
|
||||||
+e0s95lEY7XqVkF2AQCkKzMd2mHsymyVtY32bSsZ0iJxHTmxomS0uQ/TGIugB7kC
|
+LuCSGm66gIDMC39jnLo6hwYEEjfPXD7CUAN4S2eISSFd+ZclN2vYcrKYgsCZS0h
|
||||||
DQRi5oZ6ARAA2tcgStDSsVSLaN4UodtYaKGKVnBF1qjD1xzt+K3AIZLVRTjhyJdm
|
BFOgDhKKCHBuMwP12AIM8y8L64/eOWFpR7s2StAPjjYbZeZECHLWZt1zGVvkS7Xp
|
||||||
xRknEAGV7YwHKlJjMgvjzLNQ2aKHBZPvTybde4QGv7Ogka8PLyvtX1aoY9Fzi7Xr
|
6lsAg6/T8EysKG7vTl2Qq9W0BmzNgk2ODTZkhv0gqqXppdr8eRiq+h0qMfJptG0G
|
||||||
xlfYguiEb4T8c07DmnjrLIDBiFPMQ5jCk9pxhxjVJKjlxpXetxNzSrCt5Z5fgQna
|
ycOvqb9PoEO2dfNCjjII8VfaSGfSEYo8UwsqYTtfgdoNnFCXKd1r7QmvrdbNsFDR
|
||||||
SdH9xhAe2kkPqZOpNbszg11/5oQFCZi9TJFWeoyQN74bK3tCn2vafguZj+ISyeox
|
mkv+wWJoipwUaVquyb2KN652jSlpwMECW6fSEsT/5C3mJLgAmi6l6yosw6HdIY6j
|
||||||
fqBErwOBwvi7gkhpuuoCAzAt/Y5y6OocGBBI3z1w+wlADeEtniEkhXfmXJTdr2HK
|
gpCGtxnHW2zReIS6ezZdtxYBCkEHK70yASyaIHrLLDknw+DuKvXAWOAecob8GNBH
|
||||||
ymILAmUtIQRToA4SighwbjMD9dgCDPMvC+uP3jlhaUe7NkrQD442G2XmRAhy1mbd
|
OjXZe3LzBt2rVgOCRa+W7milNgjUCsz+R3rM8XfR+wNEGwARAQABiH4EGBYKACYW
|
||||||
cxlb5Eu16epbAIOv0/BMrChu705dkKvVtAZszYJNjg02ZIb9IKql6aXa/HkYqvod
|
IQT303iQIoqQdEDh/UhGuSKOgUoqrAUCYuaGegIbDAUJA8JnAAAKCRBGuSKOgUoq
|
||||||
KjHyabRtBsnDr6m/T6BDtnXzQo4yCPFX2khn0hGKPFMLKmE7X4HaDZxQlynda+0J
|
rDE0AQDBxRsmW9L60mxGCp1CpNWBXD2T6D605PlNiNCcM+cOCgD/c2OitSSG50M0
|
||||||
r63WzbBQ0ZpL/sFiaIqcFGlarsm9ijeudo0pacDBAlun0hLE/+Qt5iS4AJoupesq
|
YRbyh1LPYL6YQePL0dQkYsjm6XVmrAKIfgQYFgoAJgIbDBYhBPfTeJAiipB0QOH9
|
||||||
LMOh3SGOo4KQhrcZx1ts0XiEuns2XbcWAQpBByu9MgEsmiB6yyw5J8Pg7ir1wFjg
|
SEa5Io6BSiqsBQJmqp4FBQkFpUsIAAoJEEa5Io6BSiqsydsA/ihBulpSSLg4B9pJ
|
||||||
HnKG/BjQRzo12Xty8wbdq1YDgkWvlu5opTYI1ArM/kd6zPF30fsDRBsAEQEAAYh+
|
sffqphMht7yT3Dnz57iexUEgj3jBAQDedI+gwpZlMjV6IdH/Epz244j82Ta04cqk
|
||||||
BBgWCgAmFiEE99N4kCKKkHRA4f1IRrkijoFKKqwFAmLmhnoCGwwFCQPCZwAACgkQ
|
SOz2Y63LBrgzBGLmhsUWCSsGAQQB2kcPAQEHQFg/avgj0sZbxqL58tZEpcaieeL1
|
||||||
RrkijoFKKqwxNAEAwcUbJlvS+tJsRgqdQqTVgVw9k+g+tOT5TYjQnDPnDgoA/3Nj
|
OWOoVU3mZX/K7GU+iH4EGBYKACYWIQT303iQIoqQdEDh/UhGuSKOgUoqrAUCYuaG
|
||||||
orUkhudDNGEW8odSz2C+mEHjy9HUJGLI5ul1ZqwCiH4EGBYKACYCGwwWIQT303iQ
|
xQIbIAUJA8JnAAAKCRBGuSKOgUoqrN5jAP96aO0MEPQSIKdLaa9+ilpPp+glJ9du
|
||||||
IoqQdEDh/UhGuSKOgUoqrAUCZqqeBQUJBaVLCAAKCRBGuSKOgUoqrMnbAP4oQbpa
|
IJ7zdR0U15tONAEA0WqeRc8Jhv10UjIz/Q3UlcfvKPzVW6yVKo+Lg1FI2QSIfgQY
|
||||||
Uki4OAfaSbH36qYTIbe8k9w58+e4nsVBII94wQEA3nSPoMKWZTI1eiHR/xKc9uOI
|
FgoAJgIbIBYhBPfTeJAiipB0QOH9SEa5Io6BSiqsBQJmqp4GBQkFpUq9AAoJEEa5
|
||||||
/Nk2tOHKpEjs9mOtywaIfgQYFgoAJgIbDBYhBPfTeJAiipB0QOH9SEa5Io6BSiqs
|
Io6BSiqsjF0BAJn0EBEJfszskYiZzMshFHW5k0QUF+Ak3JNh2UG+M6FJAQCQVY/l
|
||||||
BQJojqXOBQkJaoZUAAoJEEa5Io6BSiqsiXkBAJ0JTRmdQQpEK9KSh8V7FEkblIsm
|
DkrvOytuFnKbkDrCaTrtLh/JAmBXpSERIejmDw==
|
||||||
Ngko2cs+OhNSUgW9AQD0a7FHM3Dx32a7yD0zE3QwWi5VgeZZVIPyhItrOaANDbgz
|
=7cFp
|
||||||
BGLmhsUWCSsGAQQB2kcPAQEHQFg/avgj0sZbxqL58tZEpcaieeL1OWOoVU3mZX/K
|
|
||||||
7GU+iH4EGBYKACYWIQT303iQIoqQdEDh/UhGuSKOgUoqrAUCYuaGxQIbIAUJA8Jn
|
|
||||||
AAAKCRBGuSKOgUoqrN5jAP96aO0MEPQSIKdLaa9+ilpPp+glJ9duIJ7zdR0U15tO
|
|
||||||
NAEA0WqeRc8Jhv10UjIz/Q3UlcfvKPzVW6yVKo+Lg1FI2QSIfgQYFgoAJgIbIBYh
|
|
||||||
BPfTeJAiipB0QOH9SEa5Io6BSiqsBQJmqp4GBQkFpUq9AAoJEEa5Io6BSiqsjF0B
|
|
||||||
AJn0EBEJfszskYiZzMshFHW5k0QUF+Ak3JNh2UG+M6FJAQCQVY/lDkrvOytuFnKb
|
|
||||||
kDrCaTrtLh/JAmBXpSERIejmD4h+BBgWCgAmAhsgFiEE99N4kCKKkHRA4f1IRrki
|
|
||||||
joFKKqwFAmiOpc4FCQlqhgkACgkQRrkijoFKKqwSMAD/bbO/uwwdFEJVgcNRexZU
|
|
||||||
6aoSxAGI1vjS92hSyfxZ9AABAK8KYO8sBGGCiVu+vWUpoUYmp3lfYTJHtf+36WMc
|
|
||||||
D5MD
|
|
||||||
=Gubf
|
|
||||||
-----END PGP PUBLIC KEY BLOCK-----
|
-----END PGP PUBLIC KEY BLOCK-----
|
||||||
|
|||||||
11
misc/builder.nix
Normal file
11
misc/builder.nix
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
{ ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
nix.settings.trusted-users = [ "@nix-builder-users" ];
|
||||||
|
nix.daemonCPUSchedPolicy = "batch";
|
||||||
|
|
||||||
|
boot.binfmt.emulatedSystems = [
|
||||||
|
"aarch64-linux"
|
||||||
|
"armv7l-linux"
|
||||||
|
];
|
||||||
|
}
|
||||||
80
misc/metrics-exporters.nix
Normal file
80
misc/metrics-exporters.nix
Normal file
@@ -0,0 +1,80 @@
|
|||||||
|
{ config, pkgs, values, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
services.prometheus.exporters.node = {
|
||||||
|
enable = true;
|
||||||
|
port = 9100;
|
||||||
|
enabledCollectors = [ "systemd" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.prometheus-node-exporter.serviceConfig = {
|
||||||
|
IPAddressDeny = "any";
|
||||||
|
IPAddressAllow = [
|
||||||
|
"127.0.0.1"
|
||||||
|
"::1"
|
||||||
|
values.hosts.ildkule.ipv4
|
||||||
|
values.hosts.ildkule.ipv6
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
services.prometheus.exporters.systemd = {
|
||||||
|
enable = true;
|
||||||
|
port = 9101;
|
||||||
|
extraFlags = [
|
||||||
|
"--systemd.collector.enable-restart-count"
|
||||||
|
"--systemd.collector.enable-ip-accounting"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.prometheus-systemd-exporter.serviceConfig = {
|
||||||
|
IPAddressDeny = "any";
|
||||||
|
IPAddressAllow = [
|
||||||
|
"127.0.0.1"
|
||||||
|
"::1"
|
||||||
|
values.hosts.ildkule.ipv4
|
||||||
|
values.hosts.ildkule.ipv6
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = [ 9100 9101 ];
|
||||||
|
|
||||||
|
services.promtail = {
|
||||||
|
enable = true;
|
||||||
|
configuration = {
|
||||||
|
server = {
|
||||||
|
http_listen_port = 28183;
|
||||||
|
grpc_listen_port = 0;
|
||||||
|
};
|
||||||
|
clients = [
|
||||||
|
{
|
||||||
|
url = "http://ildkule.pvv.ntnu.no:3100/loki/api/v1/push";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
scrape_configs = [
|
||||||
|
{
|
||||||
|
job_name = "systemd-journal";
|
||||||
|
journal = {
|
||||||
|
max_age = "12h";
|
||||||
|
labels = {
|
||||||
|
job = "systemd-journal";
|
||||||
|
host = config.networking.hostName;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
relabel_configs = [
|
||||||
|
{
|
||||||
|
source_labels = [ "__journal__systemd_unit" ];
|
||||||
|
target_label = "unit";
|
||||||
|
}
|
||||||
|
{
|
||||||
|
source_labels = [ "__journal_priority_keyword" ];
|
||||||
|
target_label = "level";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
}
|
||||||
86
misc/rust-motd.nix
Normal file
86
misc/rust-motd.nix
Normal file
@@ -0,0 +1,86 @@
|
|||||||
|
{ pkgs, lib, config, ... }:
|
||||||
|
{
|
||||||
|
environment = {
|
||||||
|
systemPackages = with pkgs; [
|
||||||
|
rust-motd
|
||||||
|
toilet
|
||||||
|
];
|
||||||
|
|
||||||
|
loginShellInit = let
|
||||||
|
motd = "${pkgs.rust-motd}/bin/rust-motd /etc/${config.environment.etc.rustMotdConfig.target}";
|
||||||
|
in ''
|
||||||
|
# Assure stdout is a terminal, so headless programs won't be broken
|
||||||
|
if [ "x''${SSH_TTY}" != "x" ]; then
|
||||||
|
${motd}
|
||||||
|
fi
|
||||||
|
'';
|
||||||
|
|
||||||
|
etc.rustMotdConfig = {
|
||||||
|
target = "rust-motd-config.toml";
|
||||||
|
source = let
|
||||||
|
|
||||||
|
cfg = {
|
||||||
|
global = {
|
||||||
|
progress_full_character = "=";
|
||||||
|
progress_empty_character = "=";
|
||||||
|
progress_prefix = "[";
|
||||||
|
progress_suffix = "]";
|
||||||
|
time_format = "%Y-%m-%d %H:%M:%S";
|
||||||
|
};
|
||||||
|
|
||||||
|
banner = {
|
||||||
|
color = "red";
|
||||||
|
command = "hostname | ${pkgs.toilet}/bin/toilet -f mono9";
|
||||||
|
};
|
||||||
|
|
||||||
|
service_status = {
|
||||||
|
Accounts = "accounts-daemon";
|
||||||
|
Cron = "cron";
|
||||||
|
Docker = "docker";
|
||||||
|
Matrix = "matrix-synapse";
|
||||||
|
sshd = "sshd";
|
||||||
|
};
|
||||||
|
|
||||||
|
uptime = {
|
||||||
|
prefix = "Uptime: ";
|
||||||
|
};
|
||||||
|
|
||||||
|
# Not relevant for server
|
||||||
|
# user_service_status = {
|
||||||
|
# Gpg-agent = "gpg-agent";
|
||||||
|
# };
|
||||||
|
|
||||||
|
filesystems = let
|
||||||
|
inherit (lib.attrsets) attrNames listToAttrs nameValuePair;
|
||||||
|
inherit (lib.lists) imap1;
|
||||||
|
inherit (config) fileSystems;
|
||||||
|
|
||||||
|
imap1Attrs' = f: set:
|
||||||
|
listToAttrs (imap1 (i: attr: f i attr set.${attr}) (attrNames set));
|
||||||
|
|
||||||
|
getName = i: v: if (v.label != null) then v.label else "<? ${toString i}>";
|
||||||
|
in
|
||||||
|
imap1Attrs' (i: n: v: nameValuePair (getName i v) n) fileSystems;
|
||||||
|
|
||||||
|
memory = {
|
||||||
|
swap_pos = "beside"; # or "below" or "none"
|
||||||
|
};
|
||||||
|
|
||||||
|
last_login = let
|
||||||
|
inherit (lib.lists) imap1;
|
||||||
|
inherit (lib.attrsets) filterAttrs nameValuePair attrValues listToAttrs;
|
||||||
|
inherit (config.users) users;
|
||||||
|
|
||||||
|
normalUsers = filterAttrs (n: v: v.isNormalUser || n == "root") users;
|
||||||
|
userNPVs = imap1 (index: user: nameValuePair user.name index) (attrValues normalUsers);
|
||||||
|
in listToAttrs userNPVs;
|
||||||
|
|
||||||
|
last_run = {};
|
||||||
|
};
|
||||||
|
|
||||||
|
toml = pkgs.formats.toml {};
|
||||||
|
|
||||||
|
in toml.generate "rust-motd.toml" cfg;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -16,8 +16,6 @@ in
|
|||||||
|
|
||||||
# TODO: update symlink for one repo at a time (e.g. gickup-linktree@<instance>.service)
|
# TODO: update symlink for one repo at a time (e.g. gickup-linktree@<instance>.service)
|
||||||
systemd.services."gickup-linktree" = {
|
systemd.services."gickup-linktree" = {
|
||||||
after = map ({ slug, ... }: "gickup@${slug}.service") (lib.attrValues cfg.instances);
|
|
||||||
wantedBy = [ "gickup.target" ];
|
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
Type = "oneshot";
|
Type = "oneshot";
|
||||||
ExecStart = let
|
ExecStart = let
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
{config, lib, pkgs, unstablePkgs, values, ...}:
|
{config, lib, pkgs, ...}:
|
||||||
let
|
let
|
||||||
grg = config.services.greg-ng;
|
grg = config.services.greg-ng;
|
||||||
grgw = config.services.grzegorz-webui;
|
grgw = config.services.grzegorz-webui;
|
||||||
@@ -11,8 +11,6 @@ in {
|
|||||||
settings.port = 31337;
|
settings.port = 31337;
|
||||||
enableSway = true;
|
enableSway = true;
|
||||||
enablePipewire = true;
|
enablePipewire = true;
|
||||||
|
|
||||||
mpvPackage = unstablePkgs.mpv;
|
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.user.services.restart-greg-ng = {
|
systemd.user.services.restart-greg-ng = {
|
||||||
@@ -44,23 +42,10 @@ in {
|
|||||||
"${machine}.pvv.org"
|
"${machine}.pvv.org"
|
||||||
];
|
];
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
# pvv
|
allow 129.241.210.128/25;
|
||||||
allow ${values.ipv4-space};
|
allow 2001:700:300:1900::/64;
|
||||||
allow ${values.ipv6-space};
|
|
||||||
# ntnu
|
|
||||||
allow ${values.ntnu.ipv4-space};
|
|
||||||
allow ${values.ntnu.ipv6-space};
|
|
||||||
deny all;
|
deny all;
|
||||||
'';
|
'';
|
||||||
|
|
||||||
locations."/docs" = {
|
|
||||||
proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
|
|
||||||
};
|
|
||||||
|
|
||||||
locations."/api" = {
|
|
||||||
proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
|
|
||||||
proxyWebsockets = true;
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
"${machine}-backend.pvv.ntnu.no" = {
|
"${machine}-backend.pvv.ntnu.no" = {
|
||||||
@@ -71,12 +56,8 @@ in {
|
|||||||
"${machine}-backend.pvv.org"
|
"${machine}-backend.pvv.org"
|
||||||
];
|
];
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
# pvv
|
allow 129.241.210.128/25;
|
||||||
allow ${values.ipv4-space};
|
allow 2001:700:300:1900::/64;
|
||||||
allow ${values.ipv6-space};
|
|
||||||
# ntnu
|
|
||||||
allow ${values.ntnu.ipv4-space};
|
|
||||||
allow ${values.ntnu.ipv6-space};
|
|
||||||
deny all;
|
deny all;
|
||||||
'';
|
'';
|
||||||
|
|
||||||
@@ -94,12 +75,8 @@ in {
|
|||||||
"${machine}-old.pvv.org"
|
"${machine}-old.pvv.org"
|
||||||
];
|
];
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
# pvv
|
allow 129.241.210.128/25;
|
||||||
allow ${values.ipv4-space};
|
allow 2001:700:300:1900::/64;
|
||||||
allow ${values.ipv6-space};
|
|
||||||
# ntnu
|
|
||||||
allow ${values.ntnu.ipv4-space};
|
|
||||||
allow ${values.ntnu.ipv6-space};
|
|
||||||
deny all;
|
deny all;
|
||||||
'';
|
'';
|
||||||
|
|
||||||
|
|||||||
@@ -1,211 +0,0 @@
|
|||||||
# Original from: https://cgit.rory.gay/nix/OOYE-module.git/
|
|
||||||
|
|
||||||
{
|
|
||||||
config,
|
|
||||||
lib,
|
|
||||||
pkgs,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
let
|
|
||||||
cfg = config.services.matrix-ooye;
|
|
||||||
mkStringOption =
|
|
||||||
name: default:
|
|
||||||
lib.mkOption {
|
|
||||||
type = lib.types.str;
|
|
||||||
default = default;
|
|
||||||
};
|
|
||||||
in
|
|
||||||
{
|
|
||||||
options = {
|
|
||||||
services.matrix-ooye = {
|
|
||||||
enable = lib.mkEnableOption "Enable OOYE service";
|
|
||||||
package = lib.mkOption {
|
|
||||||
type = lib.types.package;
|
|
||||||
default = pkgs.out-of-your-element;
|
|
||||||
};
|
|
||||||
appserviceId = mkStringOption "The ID of the appservice." "ooye";
|
|
||||||
homeserver = mkStringOption "The homeserver to connect to." "http://localhost:8006";
|
|
||||||
homeserverName = mkStringOption "The name of the homeserver to connect to." "localhost";
|
|
||||||
namespace = mkStringOption "The prefix to use for the MXIDs/aliases of bridged users/rooms. Should end with a _!" "_ooye_";
|
|
||||||
discordTokenPath = mkStringOption "The path to the discord token file." "/etc/ooye-discord-token";
|
|
||||||
discordClientSecretPath = mkStringOption "The path to the discord token file." "/etc/ooye-discord-client-secret";
|
|
||||||
socket = mkStringOption "The socket to listen on, can either be a port number or a unix socket path." "6693";
|
|
||||||
bridgeOrigin = mkStringOption "The web frontend URL for the bridge, defaults to http://localhost:{socket}" "";
|
|
||||||
|
|
||||||
enableSynapseIntegration = lib.mkEnableOption "Enable Synapse integration";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
config = lib.mkIf cfg.enable (
|
|
||||||
let
|
|
||||||
baseConfig = pkgs.writeText "matrix-ooye-config.json" (
|
|
||||||
builtins.toJSON {
|
|
||||||
id = cfg.appserviceId;
|
|
||||||
namespaces = {
|
|
||||||
users = [
|
|
||||||
{
|
|
||||||
exclusive = true;
|
|
||||||
regex = "@${cfg.namespace}.*:${cfg.homeserverName}";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
aliases = [
|
|
||||||
{
|
|
||||||
exclusive = true;
|
|
||||||
regex = "#${cfg.namespace}.*:${cfg.homeserverName}";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
protocols = [ "discord" ];
|
|
||||||
sender_localpart = "${cfg.namespace}bot";
|
|
||||||
rate_limited = false;
|
|
||||||
socket = cfg.socket; # Can either be a TCP port or a unix socket path
|
|
||||||
url = if (lib.hasPrefix "/" cfg.socket) then "unix:${cfg.socket}" else "http://localhost:${cfg.socket}";
|
|
||||||
ooye = {
|
|
||||||
server_name = cfg.homeserverName;
|
|
||||||
namespace_prefix = cfg.namespace;
|
|
||||||
max_file_size = 5000000;
|
|
||||||
content_length_workaround = false;
|
|
||||||
include_user_id_in_mxid = true;
|
|
||||||
server_origin = cfg.homeserver;
|
|
||||||
bridge_origin = if (cfg.bridgeOrigin == "") then "http://localhost:${cfg.socket}" else cfg.bridgeOrigin;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
);
|
|
||||||
|
|
||||||
script = pkgs.writeScript "matrix-ooye-pre-start.sh" ''
|
|
||||||
#!${lib.getExe pkgs.bash}
|
|
||||||
REGISTRATION_FILE=registration.yaml
|
|
||||||
|
|
||||||
id
|
|
||||||
echo "Before if statement"
|
|
||||||
stat ''${REGISTRATION_FILE}
|
|
||||||
|
|
||||||
if [[ ! -f ''${REGISTRATION_FILE} ]]; then
|
|
||||||
echo "No registration file found at '$REGISTRATION_FILE'"
|
|
||||||
cp --no-preserve=mode,ownership ${baseConfig} ''${REGISTRATION_FILE}
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "After if statement"
|
|
||||||
stat ''${REGISTRATION_FILE}
|
|
||||||
|
|
||||||
AS_TOKEN=$(${lib.getExe pkgs.jq} -r .as_token ''${REGISTRATION_FILE})
|
|
||||||
HS_TOKEN=$(${lib.getExe pkgs.jq} -r .hs_token ''${REGISTRATION_FILE})
|
|
||||||
DISCORD_TOKEN=$(cat /run/credentials/matrix-ooye-pre-start.service/discord_token)
|
|
||||||
DISCORD_CLIENT_SECRET=$(cat /run/credentials/matrix-ooye-pre-start.service/discord_client_secret)
|
|
||||||
|
|
||||||
# Check if we have all required tokens
|
|
||||||
if [[ -z "$AS_TOKEN" || "$AS_TOKEN" == "null" ]]; then
|
|
||||||
AS_TOKEN=$(${lib.getExe pkgs.openssl} rand -hex 64)
|
|
||||||
echo "Generated new AS token: ''${AS_TOKEN}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ -z "$HS_TOKEN" || "$HS_TOKEN" == "null" ]]; then
|
|
||||||
HS_TOKEN=$(${lib.getExe pkgs.openssl} rand -hex 64)
|
|
||||||
echo "Generated new HS token: ''${HS_TOKEN}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ -z "$DISCORD_TOKEN" ]]; then
|
|
||||||
echo "No Discord token found at '${cfg.discordTokenPath}'"
|
|
||||||
echo "You can find this on the 'Bot' tab of your Discord application."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ -z "$DISCORD_CLIENT_SECRET" ]]; then
|
|
||||||
echo "No Discord client secret found at '${cfg.discordTokenPath}'"
|
|
||||||
echo "You can find this on the 'OAuth2' tab of your Discord application."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
shred -u ''${REGISTRATION_FILE}
|
|
||||||
cp --no-preserve=mode,ownership ${baseConfig} ''${REGISTRATION_FILE}
|
|
||||||
|
|
||||||
${lib.getExe pkgs.jq} '.as_token = "'$AS_TOKEN'" | .hs_token = "'$HS_TOKEN'" | .ooye.discord_token = "'$DISCORD_TOKEN'" | .ooye.discord_client_secret = "'$DISCORD_CLIENT_SECRET'"' ''${REGISTRATION_FILE} > ''${REGISTRATION_FILE}.tmp
|
|
||||||
|
|
||||||
shred -u ''${REGISTRATION_FILE}
|
|
||||||
mv ''${REGISTRATION_FILE}.tmp ''${REGISTRATION_FILE}
|
|
||||||
'';
|
|
||||||
|
|
||||||
in
|
|
||||||
{
|
|
||||||
warnings =
|
|
||||||
lib.optionals ((builtins.substring (lib.stringLength cfg.namespace - 1) 1 cfg.namespace) != "_") [
|
|
||||||
"OOYE namespace does not end with an underscore! This is recommended to have better ID formatting. Provided: '${cfg.namespace}'"
|
|
||||||
]
|
|
||||||
++ lib.optionals ((builtins.substring 0 1 cfg.namespace) != "_") [
|
|
||||||
"OOYE namespace does not start with an underscore! This is recommended to avoid conflicts with registered users. Provided: '${cfg.namespace}'"
|
|
||||||
];
|
|
||||||
|
|
||||||
environment.systemPackages = [ cfg.package ];
|
|
||||||
|
|
||||||
systemd.services."matrix-ooye-pre-start" = {
|
|
||||||
enable = true;
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
serviceConfig = {
|
|
||||||
ExecStart = script;
|
|
||||||
WorkingDirectory = "/var/lib/matrix-ooye";
|
|
||||||
StateDirectory = "matrix-ooye";
|
|
||||||
DynamicUser = true;
|
|
||||||
RemainAfterExit = true;
|
|
||||||
Type = "oneshot";
|
|
||||||
|
|
||||||
LoadCredential = [
|
|
||||||
"discord_token:${cfg.discordTokenPath}"
|
|
||||||
"discord_client_secret:${cfg.discordClientSecretPath}"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services."matrix-ooye" = {
|
|
||||||
enable = true;
|
|
||||||
description = "Out of Your Element - a Discord bridge for Matrix.";
|
|
||||||
|
|
||||||
wants = [
|
|
||||||
"network-online.target"
|
|
||||||
"matrix-synapse.service"
|
|
||||||
"conduit.service"
|
|
||||||
"dendrite.service"
|
|
||||||
];
|
|
||||||
after = [
|
|
||||||
"matrix-ooye-pre-start.service"
|
|
||||||
"network-online.target"
|
|
||||||
];
|
|
||||||
requires = [ "matrix-ooye-pre-start.service" ];
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
|
|
||||||
serviceConfig = {
|
|
||||||
ExecStart = lib.getExe config.services.matrix-ooye.package;
|
|
||||||
WorkingDirectory = "/var/lib/matrix-ooye";
|
|
||||||
StateDirectory = "matrix-ooye";
|
|
||||||
#ProtectSystem = "strict";
|
|
||||||
#ProtectHome = true;
|
|
||||||
#PrivateTmp = true;
|
|
||||||
#NoNewPrivileges = true;
|
|
||||||
#PrivateDevices = true;
|
|
||||||
Restart = "on-failure";
|
|
||||||
DynamicUser = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services."matrix-synapse" = lib.mkIf cfg.enableSynapseIntegration {
|
|
||||||
|
|
||||||
after = [
|
|
||||||
"matrix-ooye-pre-start.service"
|
|
||||||
"network-online.target"
|
|
||||||
];
|
|
||||||
requires = [ "matrix-ooye-pre-start.service" ];
|
|
||||||
serviceConfig = {
|
|
||||||
LoadCredential = [
|
|
||||||
"matrix-ooye-registration:/var/lib/matrix-ooye/registration.yaml"
|
|
||||||
];
|
|
||||||
ExecStartPre = [
|
|
||||||
"+${pkgs.coreutils}/bin/cp /run/credentials/matrix-synapse.service/matrix-ooye-registration ${config.services.matrix-synapse.dataDir}/ooye-registration.yaml"
|
|
||||||
"+${pkgs.coreutils}/bin/chown matrix-synapse:matrix-synapse ${config.services.matrix-synapse.dataDir}/ooye-registration.yaml"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.matrix-synapse.settings.app_service_config_files = lib.mkIf cfg.enableSynapseIntegration [
|
|
||||||
"${config.services.matrix-synapse.dataDir}/ooye-registration.yaml"
|
|
||||||
];
|
|
||||||
}
|
|
||||||
);
|
|
||||||
}
|
|
||||||
@@ -2,11 +2,11 @@
|
|||||||
|
|
||||||
stdenvNoCC.mkDerivation rec {
|
stdenvNoCC.mkDerivation rec {
|
||||||
pname = "bluemap";
|
pname = "bluemap";
|
||||||
version = "5.15";
|
version = "5.2";
|
||||||
|
|
||||||
src = fetchurl {
|
src = fetchurl {
|
||||||
url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
|
url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
|
||||||
hash = "sha256-g50V/4LtHaHNRMTt+PK/ZTf4Tber2D6ZHJvuAXQLaFI=";
|
hash = "sha256-4vld+NBwzBxdwbMtsKuqvO6immkbh4HB//6wdjXaxoU=";
|
||||||
};
|
};
|
||||||
|
|
||||||
dontUnpack = true;
|
dontUnpack = true;
|
||||||
|
|||||||
@@ -12,7 +12,7 @@ let
|
|||||||
name
|
name
|
||||||
, commit
|
, commit
|
||||||
, hash
|
, hash
|
||||||
, tracking-branch ? "REL1_44"
|
, tracking-branch ? "REL1_42"
|
||||||
, kebab-name ? kebab-case-name name
|
, kebab-name ? kebab-case-name name
|
||||||
, fetchgit ? pkgs.fetchgit
|
, fetchgit ? pkgs.fetchgit
|
||||||
}:
|
}:
|
||||||
@@ -33,63 +33,63 @@ in
|
|||||||
lib.mergeAttrsList [
|
lib.mergeAttrsList [
|
||||||
(mw-ext {
|
(mw-ext {
|
||||||
name = "CodeEditor";
|
name = "CodeEditor";
|
||||||
commit = "6e5b06e8cf2d040c0abb53ac3735f9f3c96a7a4f";
|
commit = "9f69f2cf7616342d236726608a702d651b611938";
|
||||||
hash = "sha256-Jee+Ws9REUohywhbuemixXKaTRc54+cIlyUNDCyYcEM=";
|
hash = "sha256-sRaYj34+7aghJUw18RoowzEiMx0aOANU1a7YT8jivBw=";
|
||||||
})
|
})
|
||||||
(mw-ext {
|
(mw-ext {
|
||||||
name = "CodeMirror";
|
name = "CodeMirror";
|
||||||
commit = "da9c5d4f03e6425f6f2cf68b75d21311e0f7e77e";
|
commit = "1a1048c770795789676adcf8a33c1b69f6f5d3ae";
|
||||||
hash = "sha256-aL+v9xeqKHGmQVUWVczh54BkReu+fP49PT1NP7eTC6k=";
|
hash = "sha256-Y5ePrtLNiko2uU/sesm8jdYmxZkYzQDHfkIG1Q0v47I=";
|
||||||
})
|
})
|
||||||
(mw-ext {
|
(mw-ext {
|
||||||
name = "DeleteBatch";
|
name = "DeleteBatch";
|
||||||
commit = "122072bbfb4eab96ed8c1451a3e74b5557054c58";
|
commit = "b76bb482e026453079104d00f9675b4ab851947e";
|
||||||
hash = "sha256-L6AXoyFJEZoAQpLO6knJvYtQ6JJPMtaa+WhpnwbJeNU=";
|
hash = "sha256-GebF9B3RVwpPw8CYKDDT6zHv/MrrzV6h2TEIvNlRmcw=";
|
||||||
})
|
})
|
||||||
(mw-ext {
|
(mw-ext {
|
||||||
name = "PluggableAuth";
|
name = "PluggableAuth";
|
||||||
commit = "5caf605b9dfdd482cb439d1ba2000cba37f8b018";
|
commit = "1da98f447fd8321316d4286d8106953a6665f1cc";
|
||||||
hash = "sha256-TYJqR9ZvaWJ7i1t0XfgUS05qqqCgxAH8tRTklz/Bmlg=";
|
hash = "sha256-DKDVcAfWL90FmZbSsdx1J5PkGu47EsDQmjlCpcgLCn4=";
|
||||||
})
|
})
|
||||||
(mw-ext {
|
(mw-ext {
|
||||||
name = "Popups";
|
name = "Popups";
|
||||||
commit = "7ed940a09f83f869cbc0bc20f3ca92f85b534951";
|
commit = "9b9e986316b9662b1b45ce307a58dd0320dd33cf";
|
||||||
hash = "sha256-pcDPcu4kSvMHfSOuShrod694TKI9Oo3AEpMP9DXp9oY=";
|
hash = "sha256-rSOZHT3yFIxA3tPhIvztwMSmSef/XHKmNfQl1JtGrUA=";
|
||||||
})
|
})
|
||||||
(mw-ext {
|
(mw-ext {
|
||||||
name = "Scribunto";
|
name = "Scribunto";
|
||||||
commit = "e755852a8e28a030a21ded2d5dd7270eb933b683";
|
commit = "eb6a987e90db47b09b0454fd06cddb69fdde9c40";
|
||||||
hash = "sha256-zyI5nSE+KuodJOWyV0CQM7G0GfkKEgfoF/czi2/qk98=";
|
hash = "sha256-Nr0ZLIrS5jnpiBgGnd90lzi6KshcsxeC+xGmNsB/g88=";
|
||||||
})
|
})
|
||||||
(mw-ext {
|
(mw-ext {
|
||||||
name = "SimpleSAMLphp";
|
name = "SimpleSAMLphp";
|
||||||
kebab-name = "simple-saml-php";
|
kebab-name = "simple-saml-php";
|
||||||
commit = "d41b4efd3cc44ca3f9f12e35385fc64337873c2a";
|
commit = "fd4d49cf48d16efdb91ae8128cdd507efe84d311";
|
||||||
hash = "sha256-wfzXtsEEEjQlW5QE4Rf8pasAW/KSJsLkrez13baxeqA=";
|
hash = "sha256-Qdtroew2j3AsZYlhAAUKQXXS2kUzUeQFnuR6ZHdFhAQ=";
|
||||||
})
|
})
|
||||||
(mw-ext {
|
(mw-ext {
|
||||||
name = "TemplateData";
|
name = "TemplateData";
|
||||||
commit = "fd7cf4d95a70ef564130266f2a6b18f33a2a2ff9";
|
commit = "836e3ca277301addd2578b2e746498ff6eb8e574";
|
||||||
hash = "sha256-5OhDPFhIi55Eh5+ovMP1QTjNBb9Sm/3vyArNCApAgSw=";
|
hash = "sha256-UMcRLYxYn+AormwTYjKjjZZjA806goMY2TRQ4KoS5fY=";
|
||||||
})
|
})
|
||||||
(mw-ext {
|
(mw-ext {
|
||||||
name = "TemplateStyles";
|
name = "TemplateStyles";
|
||||||
commit = "0f7b94a0b094edee1c2a9063a3c42a1bdc0282d9";
|
commit = "06a2587689eba0a17945fd9bd4bb61674d3a7853";
|
||||||
hash = "sha256-R406FgNcIip9St1hurtZoPPykRQXBrkJRKA9hapG81I=";
|
hash = "sha256-C7j0jCkMeVZiLKpk+55X+lLnbG4aeH+hWIm3P5fF4fw=";
|
||||||
})
|
})
|
||||||
(mw-ext {
|
(mw-ext {
|
||||||
name = "UserMerge";
|
name = "UserMerge";
|
||||||
commit = "d1917817dd287e7d883e879459d2d2d7bc6966f2";
|
commit = "41759d0c61377074d159f7d84130a095822bc7a3";
|
||||||
hash = "sha256-la3/AQ38DMsrZ2f24T/z3yKzIrbyi3w6FIB5YfxGK9U=";
|
hash = "sha256-pGjA7r30StRw4ff0QzzZYUhgD3dC3ZuiidoSEz8kA8Q=";
|
||||||
})
|
})
|
||||||
(mw-ext {
|
(mw-ext {
|
||||||
name = "VisualEditor";
|
name = "VisualEditor";
|
||||||
commit = "032364cfdff33818e6ae0dfa251fe3973b0ae4f3";
|
commit = "a128b11fe109aa882de5a40d2be0cdd0947ab11b";
|
||||||
hash = "sha256-AQDdq9r6rSo8h4u1ERonH14/1i1BgLGdzANEiQ065PU=";
|
hash = "sha256-bv1TkomouOxe+DKzthyLyppdEUFSXJ9uE0zsteVU+D4=";
|
||||||
})
|
})
|
||||||
(mw-ext {
|
(mw-ext {
|
||||||
name = "WikiEditor";
|
name = "WikiEditor";
|
||||||
commit = "cb9f7e06a9c59b6d3b31c653e5886b7f53583d01";
|
commit = "21383e39a4c9169000acd03edfbbeec4451d7974";
|
||||||
hash = "sha256-UWi3Ac+LCOLliLkXnS8YL0rD/HguuPH5MseqOm0z7s4=";
|
hash = "sha256-aPVpE6e4qLLliN9U5TA36e8tFrIt7Fl8RT1cGPUWoNI=";
|
||||||
})
|
})
|
||||||
]
|
]
|
||||||
|
|||||||
@@ -1,56 +0,0 @@
|
|||||||
{
|
|
||||||
lib,
|
|
||||||
fetchFromGitea,
|
|
||||||
makeWrapper,
|
|
||||||
nodejs,
|
|
||||||
buildNpmPackage,
|
|
||||||
fetchpatch,
|
|
||||||
}:
|
|
||||||
buildNpmPackage {
|
|
||||||
pname = "delete-your-element";
|
|
||||||
version = "3.3-unstable-2025-12-09";
|
|
||||||
src = fetchFromGitea {
|
|
||||||
domain = "git.pvv.ntnu.no";
|
|
||||||
owner = "Drift";
|
|
||||||
repo = "delete-your-element";
|
|
||||||
rev = "1c0c545a024ef7215a1a3483c10acce853f79765";
|
|
||||||
hash = "sha256-ow/PdlHfU7PCwsjJUEzoETzONs1KoKTRMRQ9ADN0tGk=";
|
|
||||||
};
|
|
||||||
|
|
||||||
patches = [
|
|
||||||
(fetchpatch {
|
|
||||||
name = "ooye-fix-package-lock-0001.patch";
|
|
||||||
url = "https://cgit.rory.gay/nix/OOYE-module.git/plain/pl.patch?h=ee126389d997ba14be3fe3ef360ba37b3617a9b2";
|
|
||||||
hash = "sha256-dP6WEHb0KksDraYML+jcR5DftH9BiXvwevUg38ALOrc=";
|
|
||||||
})
|
|
||||||
];
|
|
||||||
|
|
||||||
npmDepsHash = "sha256-OXOyO6LxK/WYYVysSxkol0ilMUZB+osLYUE5DpJlbps=";
|
|
||||||
# npmDepsHash = "sha256-Y+vgp7+7pIDm64AYSs8ltoAiON0EPpJInbmgn3/LkVA=";
|
|
||||||
dontNpmBuild = true;
|
|
||||||
makeCacheWritable = true;
|
|
||||||
|
|
||||||
nativeBuildInputs = [ makeWrapper ];
|
|
||||||
|
|
||||||
installPhase = ''
|
|
||||||
runHook preInstall
|
|
||||||
|
|
||||||
mkdir -p $out/share
|
|
||||||
cp -a . $out/share/ooye
|
|
||||||
makeWrapper ${nodejs}/bin/node $out/bin/matrix-ooye --add-flags $out/share/ooye/start.js
|
|
||||||
makeWrapper ${nodejs}/bin/node $out/bin/matrix-ooye-addbot --add-flags $out/share/ooye/addbot.js
|
|
||||||
|
|
||||||
runHook postInstall
|
|
||||||
'';
|
|
||||||
|
|
||||||
meta = with lib; {
|
|
||||||
description = "Matrix-Discord bridge with modern features.";
|
|
||||||
homepage = "https://gitdab.com/cadence/out-of-your-element";
|
|
||||||
longDescription = ''
|
|
||||||
Modern Matrix-to-Discord appservice bridge, created by @cadence:cadence.moe.
|
|
||||||
'';
|
|
||||||
license = licenses.gpl3;
|
|
||||||
# maintainers = with maintainers; [ RorySys ];
|
|
||||||
mainProgram = "matrix-ooye";
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -8,18 +8,18 @@
|
|||||||
|
|
||||||
php.buildComposerProject rec {
|
php.buildComposerProject rec {
|
||||||
pname = "simplesamlphp";
|
pname = "simplesamlphp";
|
||||||
version = "2.4.3";
|
version = "2.2.1";
|
||||||
|
|
||||||
src = fetchFromGitHub {
|
src = fetchFromGitHub {
|
||||||
owner = "simplesamlphp";
|
owner = "simplesamlphp";
|
||||||
repo = "simplesamlphp";
|
repo = "simplesamlphp";
|
||||||
tag = "v${version}";
|
rev = "v${version}";
|
||||||
hash = "sha256-vv4gzcnPfMapd8gER2Vsng1SBloHKWrJJltnw2HUnX4=";
|
hash = "sha256-jo7xma60M4VZgeDgyFumvJp1Sm+RP4XaugDkttQVB+k=";
|
||||||
};
|
};
|
||||||
|
|
||||||
composerStrictValidation = false;
|
composerStrictValidation = false;
|
||||||
|
|
||||||
vendorHash = "sha256-vu3Iz6fRk3Gnh9Psn46jgRYKkmqGte+5xHBRmvdgKG4=";
|
vendorHash = "sha256-n6lJ/Fb6xI124PkKJMbJBDiuISlukWQcHl043uHoBb4=";
|
||||||
|
|
||||||
# TODO: metadata could be fetched automagically with these:
|
# TODO: metadata could be fetched automagically with these:
|
||||||
# - https://simplesamlphp.org/docs/contrib_modules/metarefresh/simplesamlphp-automated_metadata.html
|
# - https://simplesamlphp.org/docs/contrib_modules/metarefresh/simplesamlphp-automated_metadata.html
|
||||||
|
|||||||
@@ -1,99 +0,0 @@
|
|||||||
hello: ENC[AES256_GCM,data:+GWORSIf9TxmJLw1ytZwPbve2yz5H9ewVE5sOpQzkrRpct6Wes+vTE19Ij8W1g==,iv:C/WhXNBBM/bidC9xynZzk34nYXF3mUjAd4nPXpUlYHs=,tag:OJXSwuI8aNDnHFFTkwyGBQ==,type:str]
|
|
||||||
example_key: ENC[AES256_GCM,data:ojSsrFYo5YD0YtiqcA==,iv:nvNtG6c0OqnQovzWQLMjcn9vbQ4PPYSv2B43Y8z0h5s=,tag:+h7YUNRA2MTvwGJq1VZW8g==,type:str]
|
|
||||||
#ENC[AES256_GCM,data:6EvhlBtrl5wqyf6UAGwY8Q==,iv:fzLUjBzyuT17FcP8jlmLrsKW46pu6/lAvAVLHBxje6k=,tag:n+qR1NUqa91uFRIpALKlmw==,type:comment]
|
|
||||||
example_array:
|
|
||||||
- ENC[AES256_GCM,data:A38KXABxJzMoKitKpHo=,iv:OlRap3R//9tvKdPLz7uP+lvBa/fD0W8xFzdxIKKFi4E=,tag:QKizPN1fYOv5zZlMVgTIOQ==,type:str]
|
|
||||||
- ENC[AES256_GCM,data:8X2iVkHQtQMReopWdgM=,iv:2Wq3QOadwd3G3ROXNe7JQD4AL/5H/WV19TBEbxijG/8=,tag:tikKT9Wvzm4Vz5aoy6w9WQ==,type:str]
|
|
||||||
example_number: ENC[AES256_GCM,data:0K05hiSPh2Ok1A==,iv:IVRo61xkKugv4OiPm0vt9ODm5DC1DzJFdlgQJb1TfTg=,tag:o3xXygVEUD4jaGSJr0Nxtw==,type:float]
|
|
||||||
example_booleans:
|
|
||||||
- ENC[AES256_GCM,data:zoykmQ==,iv:1JGy1Cg5GdAiod9qPSzW+wsG6rUgUJyYMEE4k576Tlk=,tag:RUCbytPpo78bqlAVEUsbLg==,type:bool]
|
|
||||||
sops:
|
|
||||||
age:
|
|
||||||
- recipient: age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsOE50MkkxV1p0UlVUT0dE
|
|
||||||
WCtLMEk0ZSttY25UMjNHSHB1QzJ4N2l5WnpFCkNpdmlCY1VxWVo0ZStVclZ0amo4
|
|
||||||
dGhSRWY1SElRZXZzdWo5UDNjUHMzUjAKLS0tIDI3elNXSXJHQU5qb3hCSHYwWnoy
|
|
||||||
N3BhNmJQZjIrbWlVRytxZ3dFMjBtL1kKn7/DTPfJtdBomSplnBomYhsxJbX7kJQa
|
|
||||||
1Qsr+bmugWxHFIPhoDwPIBpChQkLvAo8exQpduos18FsXgvMmB0guQ==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXdnNSSEJoaUQwdTNTMDY4
|
|
||||||
QUxuLzRIWVNkM25QNTZ5VTBwQlYvT2p3SURzCnJmd2g1YUY0cmdLL3FkQTQ4NURL
|
|
||||||
YncyY3VROTFUeDc5ZlB1aWdXVGNNdjgKLS0tIEtXeDdRLzl4RXhpS2o5ZUE4YkpI
|
|
||||||
RjBObVhlWncrRnVidEtGN2N0ZitzNlUK/ooEeWCY5nDgny43q45wvl/e6qq/X4B/
|
|
||||||
7Q/DPj13BcrWRgoCYeHlq6VlIerz5ERNgxyR/qKuVSGAVroSVY6spA==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoRy9CaHY1WEEzOXdUSjd2
|
|
||||||
aFlGU3NGcW5MeHg3U2d0UEk0SXJIcmg4RVFzCkpwODhBWld6T1VNS2haSkpxL0hn
|
|
||||||
b0VRWVNFcTE5c0t3VkFZQ1R1d2dnbmMKLS0tIDdNMHBrU0RRSmlBZUJobXQxZUt2
|
|
||||||
MzZSYlM5bjYzUlRYNXkzNzZlWmx3L0UKkH6WOXHFRRbCprSjxcONSVUN/9NEQvtS
|
|
||||||
Jg+dJSMviq6GvUfUNmNvPJHfyy+CYT6a2Zd+4NdYCetRLsRJPc6p3A==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUckpiMzYrU1NnNFJ4MGps
|
|
||||||
OEt0c0o3Ty9QejhEM29wZFMrNTNyMHlHWlRBCnBHUUdvcmxoL0FqVEtBSHlma25P
|
|
||||||
c2tITUtZTGVzOGdidC84OUYvRlpxSjAKLS0tIFNMVmdiWmJNZUdLS1g3T3ZINUh6
|
|
||||||
Mjg5RHdKYnV3Z2V0L3E3ZlA2WDB0WlkKJr4Vg6rnKqGpL6N143QYfLqS4lQIED/J
|
|
||||||
SYQds8mCiyCNGvV6ON4k096jXcuMAZ1w+0bA16AHlTXnqgIgfaHpKA==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHL1QvSUlWUTN4OTBKOURa
|
|
||||||
VkVVb29McWgxa3gwb2lkVTdSZmUrVVZpSERjCm9oTTFRckg3SUM1a0tJRVlaU3RL
|
|
||||||
dUtsU0FpY1JyNkx6K1U1MWcrSjNYbUUKLS0tICtvTjJVdG1PSXF4TVltZ204SnVu
|
|
||||||
VE9aT3l2dGgxMWNHUXQ0bDN2RjVOek0KwOa/vczHZa+SRr8j6KvkfZZ0kajxXOq0
|
|
||||||
5AoDz2Mtcs+qBctTuogdLCZoL2ZpRVV7v1dGI+Fm1cVLoutV19IvTQ==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWVFp0ZlRhU29DNUhMSmRy
|
|
||||||
Y3VVV2pmajJmaU9qN0tHR1E3ekFMS3o0K2pRClIwek5GYzNNZEliK2ZTT1NVZklQ
|
|
||||||
YWpqY3poN0E1ZTVOTVRhL3FQSVZmZW8KLS0tIHpuWktoa1EwcXc1bEJJYk5VbEw3
|
|
||||||
blE2VXBuTDdlbHJTVjRzOWdyem1UWTQKg5uZRhcLpmiVcadqdJoscqsBD2u6UGx+
|
|
||||||
qT0IoSVOzsBlJw2t9rH1zR7WfRSlCXT1NYzu9aTWGqQaB8qvEtyk4g==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFdjhMM1ZpM2xFVXlvOXZK
|
|
||||||
MlRZT2U5YzhMUVR1L0FqVVdiSTFTYUpyN25rCjB6ajMwTnNTaWk5d21vM0Zza243
|
|
||||||
dHhSOHM0c3cwS1c5dGxhbzBNVm9DeFEKLS0tIEpOY1lWVE04UkNYNDdCcUdnTUhI
|
|
||||||
NC9xOENWZUNyay9SeXRjSUdkMlE4UXcKiygSIWelRUZQPbiK2ASQya7poe1KCXmo
|
|
||||||
XIlgOaUe1+lvY8s2bjdud0+7QlPOKeyciCSFNNqIxzHMYSEKwNCbpg==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
lastmodified: "2025-03-15T21:42:17Z"
|
|
||||||
mac: ENC[AES256_GCM,data:2gH/ZaxSA6ShRu53dxj7V3jk7FsVdYS+PSHQyFT8qMvKM1hsQ/nWrKt00PUl9I7Gb4uomP9Ga3SyphYOXRBzKoV+x52oEWOJE3Q4iPrwdCkyHlxEezhTd/ZRQVatG6dvHpLuDNS9Dyph4f7Mw5USI+m4WeVdgCvHTydw+4KIfP4=,iv:yimfq96WVsagvKr8HTg1RdZBSrVGcCWPvv8XOXkOfcg=,tag:zHzdrE0PX5+AeD2lpqeJVQ==,type:str]
|
|
||||||
pgp:
|
|
||||||
- created_at: "2026-01-16T06:34:38Z"
|
|
||||||
enc: |-
|
|
||||||
-----BEGIN PGP MESSAGE-----
|
|
||||||
|
|
||||||
hQIMA0av/duuklWYAQ/+O1tft/OfS52K8cmcQE7I7aFb85P2L+7u1TdmTjHwNFkC
|
|
||||||
3jhvzPkNDQDkMIc5EPZKX5WLUS8F1UaqCw4b8zZtqoTqKDpu0S92KL500iXwBxft
|
|
||||||
D3cRMFFb6GBoSlPJVBt6LMRJjGLWCkBihlYL1AknoVV7VERj8m1cvcstdp3qbEd7
|
|
||||||
c+X6t5B+7N0/QPdh2KyrHWXyCzFc/6emVjNGy2EoXRt7idFF2yTbafobCs/hZ8LZ
|
|
||||||
RJyhpGyR9QPtAwFP9Und62tCd4ZwG5FazZBLevRrmD7AOW1WnQhyYvxBvqQp/Oz+
|
|
||||||
lFmhcirLw5CaC1AbF2k3uNoAHXVWyexaQeu2gsNYXq+lpsdCWT8WtrAtNCyC2StI
|
|
||||||
PtdrdQ9oikJptmoWQ0zEBXKXdV8AhukLSX0wtis74KbmcS+2YyNKvQksGF2ZfHBh
|
|
||||||
U9ycfJr1kwm7TAg5Lg6XOmKrdOJkPoIcUCk2QW7MfS3nwwMLt3BjhhpRVUfeUmjB
|
|
||||||
Jjjs+jUXEusnmwmvGGgEU2pT944FLuFClSI8JTnIZ61YkjF7zAtrURvsNKlqu/UG
|
|
||||||
JLrWR+dnnh1YK0qQEcqt6giNSX2IWrw5SpJ8Jekt0TWfB1HDHybQUyFC/n/je/XK
|
|
||||||
0ouAeDL9oqh0eRU3ng4KKhOXNn+WO3/HrnG//KFwokc//BNNvP8qM0CTtPQbQ1HS
|
|
||||||
XgFjhTfzV0T4LyUryuict4rLVI+DDbzWGRp0umdobvQE1CGLhKCanrd2/Ng6fAny
|
|
||||||
9G09vYF5zK95uzqFBCTh1zFr6+rhfbMI501TwBu1KxOaJdYs3vzLiTGWoyI48JM=
|
|
||||||
=5fyo
|
|
||||||
-----END PGP MESSAGE-----
|
|
||||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
|
||||||
unencrypted_suffix: _unencrypted
|
|
||||||
version: 3.8.1
|
|
||||||
@@ -35,91 +35,86 @@ bluemap:
|
|||||||
ssh-key: ENC[AES256_GCM,data:nPwsT4RYbMbGp2MChLUh6NXW4ckYr7SQcd6Gy2G8CEU+ugew5pt4d6GOK1fyekspDtet3EkPL2F1AsoPFBB2Rv0boARMslAhBqwWSsbBJTXeTEgAABSMxTPJRBtfJucvv426nyIj3uApoknz6mDCQh1OI6mER0fis7MPaM1506HlDlnIT0FV9EairEsaAmbd0yddByGJSccKIza2vW0qWqrz83P+xrakEONxFz0fJlkO5PRXCcQJVBCqWQfnaHNrWeBWv0QA7vAHlT0yjqJCpDRxN2KYrPWsz7sUbB4UZOtykCRM5kKFq73GUaOKqVECJQhcJi6tERhpJELwjjS8MSqvBD90UTKTshGugfuygTaOyUx4wou3atxMR2Rah9+uZ6mBrLAOLX3JKiAtyhFewPMWjd/UhbMPuzNageVBNz2EMpa4POSVwz5MyViKNSgr9cPcNGqmrnjvr/W/lnj6Ec+W80RiXQlADSE4Q6diLLwB9nlHvKs8NTDgv6sUafcPHpJ2+N4Jkb96dE14bMffQ385SI4vLDcQ8xCQ,iv:WdJIHRzjlm8bEldolCx1Q7pZJvjxGkNZALSOy3IjizU=,tag:5ZAikiqttq/76+thG+4LMw==,type:str]
|
ssh-key: ENC[AES256_GCM,data:nPwsT4RYbMbGp2MChLUh6NXW4ckYr7SQcd6Gy2G8CEU+ugew5pt4d6GOK1fyekspDtet3EkPL2F1AsoPFBB2Rv0boARMslAhBqwWSsbBJTXeTEgAABSMxTPJRBtfJucvv426nyIj3uApoknz6mDCQh1OI6mER0fis7MPaM1506HlDlnIT0FV9EairEsaAmbd0yddByGJSccKIza2vW0qWqrz83P+xrakEONxFz0fJlkO5PRXCcQJVBCqWQfnaHNrWeBWv0QA7vAHlT0yjqJCpDRxN2KYrPWsz7sUbB4UZOtykCRM5kKFq73GUaOKqVECJQhcJi6tERhpJELwjjS8MSqvBD90UTKTshGugfuygTaOyUx4wou3atxMR2Rah9+uZ6mBrLAOLX3JKiAtyhFewPMWjd/UhbMPuzNageVBNz2EMpa4POSVwz5MyViKNSgr9cPcNGqmrnjvr/W/lnj6Ec+W80RiXQlADSE4Q6diLLwB9nlHvKs8NTDgv6sUafcPHpJ2+N4Jkb96dE14bMffQ385SI4vLDcQ8xCQ,iv:WdJIHRzjlm8bEldolCx1Q7pZJvjxGkNZALSOy3IjizU=,tag:5ZAikiqttq/76+thG+4LMw==,type:str]
|
||||||
ssh-known-hosts: ENC[AES256_GCM,data:J6V+NJ9TvYUL2gmcqWWYt8X+n0M7i0RpDpBelWAbFMH64+e9ztHNnC491sm+RogDxqKk0kwQyX2Mz00iq3Gc3wDYyozGOdv3tBKrp7/LcfjUQ9T9hi0yTD3eNV0LAjlAWMTdlW65VGHqGst8ncKbUuVxbBASVlh3A321toZgD+xxUAtNz7qKFa6fDbOS0xLD1+CmTwVp+aPos//QIKzjuk1HqxfBNK82maKtD4JHPS+Y3be2wIEjGWq3H6JYN/RDojD88D/jzo9RwvEjpqLXoOVfy8uX/fbEsgkgfAmPiaG+ePCnchSExEe3a6Y0E+I6YIzvP+tGThJpu4HaT/yW2Rww/jvsxKrXSUhtBZI/SIX5ZAIFB3sFjJXQefJjfNpQTQWhbspLfdemafGaRiDnzVgKDhNL1HNMNsXKDfWa0SLs4//dqerom/QCCNsaqV+4HVzv5x44srChGERadQI/Wh4UG2R19xxbdyIsKPHzv7BhEKufJkjc5upBjWygQrGAkTRHugFpw2Tdkz9yUQSujMkaeRKhVkA+ZUAjwnY5TwqNZBj7U3K2JXoNVHAq194XmrA2dNghh0OmRrvKGwM3HKexX22SXT0bPlpdWRQpMbUgV+uHLMerlDpNMFTIueEBkaF/FWeSW2N5WUrUb1uJ91QcJ8JBgN1riuD1Oxv9RRPrY9VVNJMrYjpAAREN8i8brMTOCJ35s7jnqIei0dNmnNXOoQZPs9kUMeEtUc/Df1E8/aO2Y4yU9gHUuevXnAJWFAiu2IxssgPk6CcNxvapJEmlwkLK/JyuDsWwFxVOHfw5QIEsoDVWXt6eMhquqUgzJI1q7QrTWUQsBb5A5sQKYWQHempOaXuQn1bzA7mU3Gzsr8bNNc6tpy+6j3zTXYR067EX00yqPG+kqRn4QVIuhByxXP3cwXLUG9uD1lsqWrGzs6WCnHr7txhRBXf4WbBVmXModO3uf36cDYEwrUa6yBsARtSl8PJ0UadfY/xULcT5PFvu9+Hi2qj3vp4IU3JCJa9AvXB+11pbSdawprjuDhwQtPwkJ4CQyvZsom3/BOrmwYM5+EyMDIluEQ0z6eDE5buiIVbX6IvXnDCKbrnqVwavX2wqyiDduFLjRfWL/3U2O1yRim78smrDMJABJZvtW+a+GfmlnTd/gnFvS70Fmm/lgtY051ISL/iFx6toJRoBMMiI/Zvy13uQry+w/HbyFl42DIank8tf7kuN3E9M7ADGMubRJJ0AZOcQddrFnR4Gl2nU2+3RS5fLHaBf9QHK6W92/n//xmPkYqrkPacew4eBjUqM32jVGuBpDc964fK9kdtIdw8q5P1s/ph3I79Y24kGeuO1AVJuZvkaTv1Z7GgI9+K9TstKJ9XpRCidLpLSP+uHOWkqcNsQlt6ilTlfHj+MKoD85dKZ315QMmpiuYEvzCSP1aYTb9dpd61Su/IVuM3r2NuINNEZ166YlHQVsLNpDn8E5ahk3ZInOAg6/kaKTmjUI8KEvX4BR3PbbViAlJJb3suJ0oZBGPUlrW5uLRmADvf2mMDVO5zY7/m9DQwxjt4Miu0l8ZaUc0YJQ850lBKucQ==,iv:GI8w7h7xX8gMHuAoWUyrW+BQb85LNlASoYvGBPlCZaI=,tag:WnHNMevfFSMc0ikBZwWn/g==,type:str]
|
ssh-known-hosts: ENC[AES256_GCM,data:J6V+NJ9TvYUL2gmcqWWYt8X+n0M7i0RpDpBelWAbFMH64+e9ztHNnC491sm+RogDxqKk0kwQyX2Mz00iq3Gc3wDYyozGOdv3tBKrp7/LcfjUQ9T9hi0yTD3eNV0LAjlAWMTdlW65VGHqGst8ncKbUuVxbBASVlh3A321toZgD+xxUAtNz7qKFa6fDbOS0xLD1+CmTwVp+aPos//QIKzjuk1HqxfBNK82maKtD4JHPS+Y3be2wIEjGWq3H6JYN/RDojD88D/jzo9RwvEjpqLXoOVfy8uX/fbEsgkgfAmPiaG+ePCnchSExEe3a6Y0E+I6YIzvP+tGThJpu4HaT/yW2Rww/jvsxKrXSUhtBZI/SIX5ZAIFB3sFjJXQefJjfNpQTQWhbspLfdemafGaRiDnzVgKDhNL1HNMNsXKDfWa0SLs4//dqerom/QCCNsaqV+4HVzv5x44srChGERadQI/Wh4UG2R19xxbdyIsKPHzv7BhEKufJkjc5upBjWygQrGAkTRHugFpw2Tdkz9yUQSujMkaeRKhVkA+ZUAjwnY5TwqNZBj7U3K2JXoNVHAq194XmrA2dNghh0OmRrvKGwM3HKexX22SXT0bPlpdWRQpMbUgV+uHLMerlDpNMFTIueEBkaF/FWeSW2N5WUrUb1uJ91QcJ8JBgN1riuD1Oxv9RRPrY9VVNJMrYjpAAREN8i8brMTOCJ35s7jnqIei0dNmnNXOoQZPs9kUMeEtUc/Df1E8/aO2Y4yU9gHUuevXnAJWFAiu2IxssgPk6CcNxvapJEmlwkLK/JyuDsWwFxVOHfw5QIEsoDVWXt6eMhquqUgzJI1q7QrTWUQsBb5A5sQKYWQHempOaXuQn1bzA7mU3Gzsr8bNNc6tpy+6j3zTXYR067EX00yqPG+kqRn4QVIuhByxXP3cwXLUG9uD1lsqWrGzs6WCnHr7txhRBXf4WbBVmXModO3uf36cDYEwrUa6yBsARtSl8PJ0UadfY/xULcT5PFvu9+Hi2qj3vp4IU3JCJa9AvXB+11pbSdawprjuDhwQtPwkJ4CQyvZsom3/BOrmwYM5+EyMDIluEQ0z6eDE5buiIVbX6IvXnDCKbrnqVwavX2wqyiDduFLjRfWL/3U2O1yRim78smrDMJABJZvtW+a+GfmlnTd/gnFvS70Fmm/lgtY051ISL/iFx6toJRoBMMiI/Zvy13uQry+w/HbyFl42DIank8tf7kuN3E9M7ADGMubRJJ0AZOcQddrFnR4Gl2nU2+3RS5fLHaBf9QHK6W92/n//xmPkYqrkPacew4eBjUqM32jVGuBpDc964fK9kdtIdw8q5P1s/ph3I79Y24kGeuO1AVJuZvkaTv1Z7GgI9+K9TstKJ9XpRCidLpLSP+uHOWkqcNsQlt6ilTlfHj+MKoD85dKZ315QMmpiuYEvzCSP1aYTb9dpd61Su/IVuM3r2NuINNEZ166YlHQVsLNpDn8E5ahk3ZInOAg6/kaKTmjUI8KEvX4BR3PbbViAlJJb3suJ0oZBGPUlrW5uLRmADvf2mMDVO5zY7/m9DQwxjt4Miu0l8ZaUc0YJQ850lBKucQ==,iv:GI8w7h7xX8gMHuAoWUyrW+BQb85LNlASoYvGBPlCZaI=,tag:WnHNMevfFSMc0ikBZwWn/g==,type:str]
|
||||||
sops:
|
sops:
|
||||||
|
kms: []
|
||||||
|
gcp_kms: []
|
||||||
|
azure_kv: []
|
||||||
|
hc_vault: []
|
||||||
age:
|
age:
|
||||||
- recipient: age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
|
- recipient: age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzMVM0T0Y4Wjg1OGNsR0Iv
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNbjFxWk5lY0kxaStxcnVh
|
||||||
VmxoNmRMcjlWRHFhc3l2Sy9aZnF4b0ZsTnhnCkd6UnEvWi9kRU9qSmVLZkdiWGJh
|
SnlYamw5WXBRTkU0ZGFEWnZvME1nZk94TlIwCmlhVGFtckJpN1RZdXRBYkxDbnVS
|
||||||
SW1SS3FDWnZTZnBhTmFvTW5FMCtUK0UKLS0tIFJDdHFoT3pPaEJLZmR3R2Jsd2pt
|
UmZtWENzZWNYRmptY2kwem42ek1LbXcKLS0tIElsRXBmNHNmdjdqTmFLL2ltMnFC
|
||||||
R0RmcXJwRlkvSVhRbGwxZytLNmlqeFkKw/0nGPzgzH39udFyJVkjNTMTmffiQh6/
|
VG11M3ZpeUJPUGlEQmExOEdSZFJERE0KSIo1pzx8AcoJWEzNzEDoV3eM7194IHxL
|
||||||
HT1O7imvPymx5kXrnfciAP9bnCV4o/HiVkuDxBP7gG5nBUgY6PIC7Q==
|
4pCSSztKDCF+XdJZLh5sgudaYLJGtX5n7q1hbuL0wOmotM9bN2YLog==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
|
- recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCV2ptWkhqNjcrM0hXOWEv
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBybXRjNEM3ZDYwa21LdWpE
|
||||||
Y21GNkVJUXY3dHV1OUdUdlJZNHhka3g3QVdNCk9vak0wSDBhS3pZSWk2anVsMnVY
|
dDg1MUxaeHlJSHRhWk40TndYbHZLWHVsVWk4CkxkRVJ4c1lhaXZodGxhNGhkUy9q
|
||||||
UmVuamF3ZGw1MGZ5M3ppSThWK3FPR2sKLS0tIDlQRENlQjh6THZRZlpEWnE0djNo
|
M0I1SHdjeXVXL1E4OXgxS2x0cU9ESFkKLS0tIFpNMjNKLzNDWWtvTkhHRDFSTklH
|
||||||
cXl3S2tRdExvSjRNUHpwbFNzVXdQVmcK65zb8MPh67TyHkjLA2vLgv2eOQOSUDih
|
T1k1cXp4NXVvVGdkYXp0VVNJejVJRkkK6K31gqRRvo0mbJy6aCTKotVmrfqZoARG
|
||||||
JeHkryWGQXzlYL5tZZ24ae1mqYiYQ6DsbWXopA0q0OmndYByXct6FA==
|
w6wKe1TJLWJv8RAD3GQrub9MJwQhUG38Jtj1WrXgNMlF24zFPlZDEQ==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCSnU5dml1bjY5ejZHUGRQ
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2azhwMEJRZ3JQRnhDNlFR
|
||||||
V1pNQnBXWUx0c1R5WkY5d3NFOFlKTkFrMUN3CkNqMjc5NDRMb05tSW9wV3lkUUVU
|
a283MitGTTdaMTZURmFYam85TU43RkdXYTI0CnQxWnRUZ2F6MHd1TWlHMDZ4b1p0
|
||||||
Mml0VWc5N2NBZDQzVXMrWGpqVzY4NUEKLS0tIHBoNTZlOVBMdFJXOC9QRjJ4bHh2
|
WStOVndGTUpmdncvd1k0WlV3c0xKYmMKLS0tIFpSb1hKbHJyM1dCOVBMa1Jabndp
|
||||||
SzM4Rml4dFNjMWxxYXlVdTdxTTB1ZzQKvoBpb4PPNM5yl85wTcTTqZmkXmwZGyvS
|
NWlGSFhQUngvWG5BQ1lyOFAxanlGdlEKt09a9bMErR3wqbutxhDRfSWp40mmfShJ
|
||||||
PMPFNqEkzcZFtC1BfYGIlKAuisGhQ6rFAkyTZXTLP0HjPEcH00+WMw==
|
KAAO2TEMKkEGFvaxYu+G9rbR37h/ZttikJMvIVlfRzmVADlFwO7eHw==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
- recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDbGdTVUU3UVUwZytQancy
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtYVJLMTZma08xZVo3cEZs
|
||||||
ZXY1Ullmck9qZ0dsSmZqUHF0NGpSZlJWRjBJCndmbGh6Y3lUWmdEWUdHNkZwd0dM
|
Ym1FTU9ZdmxlcUxselltWDRwdUhUdU1udnpjCmh4TlJEK09UdlNFLzN0YnN3WGtt
|
||||||
OWpaTk4xdzlLak1iMFhhU3BnT1NYTE0KLS0tIElxOFVmUnVDUXhUeVBEVjJhR0Rv
|
aGpzd25Vckc1TmVCamQ0ekk2QWpraUEKLS0tIG9CNzBOM1g2aTRlQmt3WWVrTlNB
|
||||||
NmloODFNNXU1TG9FeWxKYTBGOG5qR1kKXGAQyRVO6Sh0LNlFD5nx0F3m2KYP8hYl
|
ZWsrZy9HSWt4OUdMb3ZZQmNjNGZNZjQKMhvkRnis8P2iV3hoigiN2IXeIFvFuYRK
|
||||||
/g3mwi4NI4UIR2dYXsgNJuF7axxP1IbaZ/j2NLNYbVe2+iZvscvBTw==
|
FeMG/cNOtAUsOgHMs4xDPqpLrhpay7IEvwQukBxscd/88I8/ZdGeHQ==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
- recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtWkVyLzJWM01ybHB3cmpq
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtazZ2RUo3ZjdKeStLWW0r
|
||||||
cTJTM3VWaEk3djcxb0RnbVZXUGRyMWQxcWlFCmhQUmtGZm0wczdsLzZUNHFqRnZW
|
bm1NVWJRbjZpZTVRcEFWTnJwYkp2YUN3OTM4CnhRa2RpOS83MW9zaWlUV1M4b21t
|
||||||
R0JaUDhmUXB6OTBwNEFja2xhbm1JNXMKLS0tIHNVUFltMjZjalJya2x2UzVHcUoy
|
OG5Ub3VkK1dSMkVzN2VtT0JrWkFSTkEKLS0tIGMvOFU2U243RnpUTThRRWthaHpZ
|
||||||
RGs3aStCRUJmMG9JRFZyRFJWeTZKWGsK8oTccCGCXPsQEGnn57ml5IwYCHgYoBpC
|
SjBhZjJpNGlUclF3bXRKOXk0KzlHdzQKp/asp39bRfNXyetc3ySVpnzfO6it9D/e
|
||||||
2U7uT/Z10crtrqgPGi3/jYr5IEacLBvbuGLBwSlCo7NGz/6XnVIyaQ==
|
XWyhq0yKRFAC8yMYeAuA4kIcNM4DGRc0PnwA/ce3IgHsV1ZNdvdWfg==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
- recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSTlJPQk9DTFNKMjA2bTRj
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnT3lTUEFaN3pOMGhsQ1Ra
|
||||||
OE5uaWxEQkhUdmRvT2h4TDJvREo4TlQ4MFZrCjNjd2ErOXcxQkJrNzlOdGNFSDNW
|
SVZ6cE90a1BteXgzaldsN3ZTSGZpZXlyWHdvClhJM2ZDRHR0VzVSQXd0b1drK3hG
|
||||||
S1gyaG1SSGpyNmtXZXpqZzVnN3o2MkUKLS0tIGdkbEROYUNjNk54RmFuR2VkK0Zq
|
aW8zUWlHcVFkTFpJYXpxWlAwVHV0ckUKLS0tIGVmR0g2Vk56dlZCU01Dd3NzUFZU
|
||||||
RlRMc0R3dDllUGRHcmNDTDBSS09mUUUKhdxXMEuwLviNY134uA4SELXiHo4rCC9h
|
UHpLRkdQTnhkeGlWVG9VS1hkWktyckEKAdwnA9URLYZ50lMtXrU9Q09d0L3Zfsyr
|
||||||
pT2iqOV+VDquwE99h9OIo2Kfmblzje/TGpok1i4cxytg8fly3LZD+Q==
|
4UsvjjdnFtsXwEZ9ZzOQrpiN0Oz24s3csw5KckDni6kslaloJZsLGg==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQcHVjN3MvVUEwazNraXFQ
|
|
||||||
anVTbU1EY1JUQ0FyeSt3bWJ6TVcwY1UwZ1cwClRtOTE1QWNXaUdzejh5a3BUdTFv
|
|
||||||
M25HcGZBY1IrVkdXV21vWnVMTHY2VXcKLS0tIGVKMFFCRjhJaGJPWjhlNEFna1hB
|
|
||||||
SU5zanlva1p2QjVndVJwUnlkdkFuTDAKbQRrSfG9MGsGvF2ywoGhDSuriDsbQ+k2
|
|
||||||
29mxere0efSSGGq8y9YrPC8UX5hZRfqg/dfbL+PFc4NHfbxB/oSzQw==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
lastmodified: "2024-12-09T21:18:23Z"
|
lastmodified: "2024-12-09T21:18:23Z"
|
||||||
mac: ENC[AES256_GCM,data:scdduZPcJZgeT9LarRgxVr/obYsGrJAbMoLGJPPPp19qxOJMTdvYfMz8bxPjCikB4MacEgVZmcnKIn5aCzHJAnCI/7F2wm1DDtW9ZI5qbhDJKSSld+m2leOSPfR8VY/0qj6UNgGnwkwx7dfcAlv8cP2Sp3o1M2oyQxeXPr5FWEg=,iv:JEAwkCewMp0ERmYU62kZkbl7+FET1ZeRr6xeEwt6ioM=,tag:jxvli935X3JyZYe7fFbnLg==,type:str]
|
mac: ENC[AES256_GCM,data:scdduZPcJZgeT9LarRgxVr/obYsGrJAbMoLGJPPPp19qxOJMTdvYfMz8bxPjCikB4MacEgVZmcnKIn5aCzHJAnCI/7F2wm1DDtW9ZI5qbhDJKSSld+m2leOSPfR8VY/0qj6UNgGnwkwx7dfcAlv8cP2Sp3o1M2oyQxeXPr5FWEg=,iv:JEAwkCewMp0ERmYU62kZkbl7+FET1ZeRr6xeEwt6ioM=,tag:jxvli935X3JyZYe7fFbnLg==,type:str]
|
||||||
pgp:
|
pgp:
|
||||||
- created_at: "2026-01-16T06:34:44Z"
|
- created_at: "2024-08-04T00:03:28Z"
|
||||||
enc: |-
|
enc: |-
|
||||||
-----BEGIN PGP MESSAGE-----
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
hQIMA0av/duuklWYAQ/7BX4o2qvoL2bJN4zkyjqUBgFi0rS3UXsP2D81nxDmlEYP
|
hQIMA0av/duuklWYAQ/7BlyYej03uyhLheXS406h3Ew7v7D+rHHvHjiw3FCJxHoC
|
||||||
iAm7uQ56/QLbxQ4nW+aBy+ijy4+a9w6yOEfy4DBwXQLebWJUFn2BJ88+6rOlAz51
|
1revUrMa/M6iTNQteaBvBcYVR4+SpUpRyN/6BSzEQBrNhUBR+70VWL2yzeeb6Bw7
|
||||||
hxHlAOAkN7aFm5a2Y8SQVGnsM/HFx3xJJU5seD5QhJgoPcaDlD/f3zrmmKzvgwX9
|
GBtuyS7O3DEd0froE3aFETR0NfQ1FfcndOBd3SDKOsCgL5nfJSyOPQtr1OMLKzoW
|
||||||
CHPI4lmQjzwjyG8BJRDlCdXtjXqYT2prs0raLUESwt9p3Hu+zZ5DZfZcnx0s5F2y
|
+CARt457xEx0KY7IIpN6e57IT7bVjJx5UuDcN0ZncUyuGUAKHdn0nAHzWqiSZV9w
|
||||||
nj7cFncmFci204EUzCoYrJNkjYKZSDhlNGyzZzF+7ve6LYW2snet86gDFWNsJqfj
|
bIftLJ936zvBOhhl3DkzvALnI9+//KPSMM3o/1ti07FoAx8cK2w83VA5Ia9qeNkB
|
||||||
/1Xp+pDSZVFs3Sp2iSTKqG0wQaRgmyP/r9IagNwTJxjgCjJall2qmdrj4xi4EJef
|
wfVuE6f5a2KP/KrfnVCfvweMh/MIEUGb14XEaniyYwvlW5vwF9YgPH6HGc0c+lH6
|
||||||
40ZGn9BGmk5EBAVhErqwFwZTlEDuGRWSzStRMpyi8YMA8DMd/mNxdXetrg7zw+ro
|
UWy8+Iw7kXkUEJuhtNWyBPJeVKheSBieoWUBZZAK4uWUpChJxfc5M3+P3mgzTIP+
|
||||||
iaj+izF+FDjPAm2dCaO9r1zZiFKZk84Q2tYNVAs+2t3a/GJYGAs0qzqWcyJzYk8q
|
7P04xdtS0GwrNwMBiQFqc56hoYDAwMYbn9lFzM3LLq+h8Ztg2G4X9LXjD956TP5C
|
||||||
CHpXUDHVGFXFjgm067nowjtETLyBtegM1bIfoFJEqJUgWT+NU9kON638Dp0HuV/X
|
bPV7BFcjTSaAt1TDJcDJRxfrtx6Mo/DLknpGTMRM0UfQ/22uMz2GAH38L0C7lD9B
|
||||||
DkBbwYCRCRSnumslEHlUxw/I1pZijCiJf6m0hbjWEKxUM8N0fKLLxdoYLSY36/8L
|
RrKlpDuMKzj/LUihO33Ry9J0IpZ3XF6oaSl/+P+uO9QYNxA/zkuxuSWfqoysldyN
|
||||||
kyA9T59+qwNIfpKmpF9jvyIX7/Chers8ebgwwpJrP1UwueKQoxhO2mL99by9+P3S
|
bSo1dHGapY/+PVMjM0E/2Dkk9T2IbQUlkVxPrlvuUd3YfrJ7bCva2GDjLvXSp7LS
|
||||||
XgE5D3lqS+OQqJfRd5VMjy6Skq5N1kRhtP+dujwBnX/MxClrh1HbgVaNKqwiBKBj
|
XgGgLgrj54YoOn4uUFsxzDIS7yVps3fCkByVtc1Lc3C8uPPF1B+jOX7O87kZOHag
|
||||||
CV9oTxtI8LDC06KOws841HmUuGe9/4H0MNu/dz+VMh62RD0MVher7JYs5fuFHVo=
|
XvT2ze2ITfdxPzoyZO1nWVIGO8rAtQ/vK/Iv2/hHtc4gfzL+gy7GeUWGHkvZ1Kk=
|
||||||
=7yLr
|
=wDmH
|
||||||
-----END PGP MESSAGE-----
|
-----END PGP MESSAGE-----
|
||||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||||
unencrypted_suffix: _unencrypted
|
unencrypted_suffix: _unencrypted
|
||||||
|
|||||||
@@ -5,98 +5,88 @@ mysql:
|
|||||||
password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
|
password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
|
||||||
gickup:
|
gickup:
|
||||||
github-token: ENC[AES256_GCM,data:H/yBDLIvEXunmaUha3c2vUWKLRIbl9QrC0t13AQDRCTnrvhabeiUFLNxZ/F+4B6sZ2aPSgZoB69WwnHvh1wLdiFp1qLWKW/jQPvzZOxE4n+jXrnSOutUWktbPzVj,iv:KFW4jRru93JIl9doVFtcNkJDWp89NlzWjPDflHxcL/U=,tag:YtgyRxkoZO9MkuP3DJh7zA==,type:str]
|
github-token: ENC[AES256_GCM,data:H/yBDLIvEXunmaUha3c2vUWKLRIbl9QrC0t13AQDRCTnrvhabeiUFLNxZ/F+4B6sZ2aPSgZoB69WwnHvh1wLdiFp1qLWKW/jQPvzZOxE4n+jXrnSOutUWktbPzVj,iv:KFW4jRru93JIl9doVFtcNkJDWp89NlzWjPDflHxcL/U=,tag:YtgyRxkoZO9MkuP3DJh7zA==,type:str]
|
||||||
minecraft-heatmap:
|
|
||||||
postgres-passwd: ENC[AES256_GCM,data:T8s9xct07AJ4/Z6MQjNrqZQq7FerHz8Op+ea8zO2MDLPWWgU7/hBfrr+T4sc1TgT3e5vtE0dVcqCSbZCZj+6zQ==,iv:prx6d8c92OvbL8IjBLAvi1Vqk69D6ZIkAp7E8CSljok=,tag:UA5YS4YwViYZJ2PWzIIM3g==,type:str]
|
|
||||||
ssh-key:
|
|
||||||
private: ENC[AES256_GCM,data:h9OtD6hxrxyokFDe9bveAkMICrs3YrsAEqg0RVHV+xCkgkNAdoh85wb1QI8FJ0tga4Bfq8ZxZTdMnexQvbYWL8m/N/P6gWoPPJd7dwGuxaUZu5lqngVuHIhH0yWFWtPXjQ0Zyl5Q1aBKyjzJMvJc/H2iprgVH4YFs/fWf/KDEp17Plvvz0AoPGPrOZErDmne4MtLbW3pUm1r5ACo/41OyXYwjHk1Ywgsoz1CMxe/DrmkADnf7jSDWL6Q0mz8hIIYi8GbToJS4BIJ2plttraxV9sqpIPzS/1jMERNchItlkCppSYIy/eohVmskP8dAySm5Z7HNGGtzWSSGLxq15xKc7OVFYPMI+B35nPnp1LVOUWqBHAqVo7dwxc3VXOlVat7AMknUZnr67d4TIIl5BOdy/rvAxzXS/fDV0zntIs5o3phKStVvq07eZFaOVva45B7Pyyn0PdBhHBt2JcBtm+Xtg9i3xvZdwQgbeeJRhnYgDqK6BVhmtTuirwp1GOyslqaFCjg0MJj+W+d8R9gbbfyFR6YrZQAkcd/o/yZGg86z7Phe18=,iv:nt/+qPBwPZKQt43VJ9FbKjLYioFwCxD7VK9WNCJCmpQ=,tag:MuDfnTiro3VVJq9x5rkEQg==,type:str]
|
|
||||||
public: ENC[AES256_GCM,data:+fiCO8VRSmV7tmyweYSpZJMOuMORLHkWetYbr20aTQ1vRYr927nYGes4E464t+Dv9OyJPCLmHBdgt7UvxJWuC3pZE8iStnBYnej3D4ebMzi2SMfOkJjGuQSplXtl8QeAYe1YvROmtQ==,iv:thgGQUyWdXfwUt1E/vudoNjl8JjnksFd1rb/asTry+g=,tag:t1iQPocvfI+JafuJycaLuw==,type:str]
|
|
||||||
sops:
|
sops:
|
||||||
|
kms: []
|
||||||
|
gcp_kms: []
|
||||||
|
azure_kv: []
|
||||||
|
hc_vault: []
|
||||||
age:
|
age:
|
||||||
- recipient: age19nk55kcs7s0358jpkn75xnr57dfq6fq3p43nartvsprx0su22v7qcgcjdx
|
- recipient: age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoeFE5T1FHeVczVU1aVmhC
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiOVc1eXg1bU9BZmc0cXhM
|
||||||
UE9aKzRHVWdDOG4xMXBtV1Y5dW5sVmZzcWtVCjd1ck1CRmZxZHduZmMzRnRodi9n
|
L0dpbVBvQTNzcnFWcktSaW5rQXhnZks4dlhRCmVla3kzWDlJN2V0dDFYWkxJUUVo
|
||||||
ZVRNckIyQzErVmJUaDdDb1A1bkRUNkEKLS0tIEJWL3EzTkFYQ2tNRnliRWJISHVr
|
RTlqNWM4c0lmbkc3cUM0dTgyWGpSNWcKLS0tIEx4SkxDdTFGUi9OQ0NRVGxXeSs4
|
||||||
aCtGUFhRYkdPdG1uTVdGN3lITzJJc2MKt9TDBg1CV3a6FhlROVZ3ruKVdehQcuSN
|
b3Zaa3p1MnU1UTk1T3hmejVkM2RDLzAKmk63I60GEenLt0l4FHmz9mBAumw105Qs
|
||||||
hv0vUdbR1uOX89+P1oqNMRMQJI0V4oWi138m+uqA+jozvz+Vn5z/3w==
|
mDbQBfAj1m1FTE6tl38J8wVyFI8LT550bqYdymvnT2mnEIAIP/04ag==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
|
- recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDYUNsemZ4TDR3S3EzcnNI
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5dmJpdUxVcllPYXpxRlN6
|
||||||
eTduanpyc09XYnBSTk04dEZSME8rYjdvalZFCnd5dDluWStCR0lvRFlkYnpKUVlz
|
ZnYyc25sbjdWNUNEQnE3UU5Ea0JPK3o0Ukc0CnFIOU0rOU5lV0tGb2NuNnQzejhw
|
||||||
dzR6cHU4T01TUGdFamRqZlBGb2NBYUEKLS0tIGRCTTdjVnU4ZjY1czZjZnhJdzdw
|
cTBkOFJHTXJIMFhzZ0tpODJ6N1pJRTgKLS0tIEhPVlBMcjdHNVRKWDhkTXFTOFFu
|
||||||
M0swSS9wQVpIQ29XeGRJelk3aHVNcTQKv2Nuia6fkUIu+P2RcP/iHonc6B3y5GJL
|
NUREdmFNR2NkY0Uzcm9tbmhteHFtSTgKSUTGoNb2/0rljN7oojVk1fMAulK669ud
|
||||||
eiGHywJ5QnQAVOkaNiMZSNfo6OWL/49GnULWJwvbaS/Hong/ax9GBQ==
|
fpacGQFBJzJOusx29YC01W6mn8TW8Cdw6mKmS3QEsYYx7S4HpX0v1g==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlOHJGNWN4ajA0Q2xrWHlX
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRUmNyQWU2Ym5NMjJnUUpu
|
||||||
UkZYVGRtcXkrTkl0YWRVd2JOa3o3b215cWlBCkRjWlJCWXlmWTdia1pUOTIvdlNI
|
Vi9yeWhFM0NDTGZtRThXQWMxYVI2aEUrNUVvCklxTldQRnp4dTVXMjRXWU5DNWhz
|
||||||
aHowK29KT3d3a2xuTWlwd01JK3VPZ0kKLS0tIGkxUElSUVVXODZtZHFuTGpqZTd1
|
dzllOXp1RVRaMDFNWExuK01maFk0blEKLS0tIC9hUENybThmWlBab3IwSTQxSHBj
|
||||||
TzIwUHBIRG0vSHRpM05vQUJYQ01HYVEKFrDzolWZAsiOLhls4hdIkjRXAsYYVq9k
|
Q0IyL20vdlRBNWZyNXc3MGVtcUNza1UKLDq74TMy5hXhimnDA06/Ku5RJQcDvkjn
|
||||||
aKbS+DAKVP6AnhMC+Xz8zp7N1bvcXI6tKTmrlg+mo7bsc+vOl12AGg==
|
QKSGCxZ6FJ/io22qNiw0vDRzTfW1Dz+9/Yog3Pi870IcAljkdmoxEA==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
- recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBZmg1a3d0ZU9idCtMelYw
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOTUpYam1KQ2laek42V1NE
|
||||||
YnZlaFZSc0pCWG4yYVMrZXNkN3RVOXhJTFFVClBXa0NqZjB6TDFCWGRRaG9JWHZx
|
eUY2TlY2Q0JNTHR6QUEvZEhhem5ZKzhPQ0JFClZldDE3dDVIeTQrOVpJNGI5dDlR
|
||||||
SVZ0SXExU3hBb08xNVQvU3FRRkRXSFkKLS0tIFlmUXJSc25jZVVhaFFNejY5d1Ux
|
YStuTlRDcXdiWE9LdThaUERnbEpkU28KLS0tIDNidFQ3ZTdINXpTZGljZmh3Q1ky
|
||||||
TWVyQVRjWFBpOGc2Z0xCRlBBclVmQlEKwdADPZ/JtBznYW5ngAehdFD7dJKjy826
|
Ynk3aUtFOFdGV1NHb2d4YXJXb0xNYU0K07jwIfF+US++qz9rKn0TgR/vZam12vvr
|
||||||
G9JaApg1xGj3OQzB88rlyQwE+WSV9yCdJ1BzIK8HVSaBOsitRoJDKQ==
|
lq5s694hHkSRmAP5uJ4lNQKUkacH9qlBXB+aU+D98vKRDGYIkKhlQg==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
- recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFZ05hM2N0QUNHWmpHMHdq
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjaURPbENOQ2l2N2lsd2l4
|
||||||
cHJLTWdaMkIxSlRsZ205VjJYU0IwNmtEb0h3CmhBN3hmQ0pscFVQMmNwemY2UnhT
|
aUdQNlUyWjNFM2JhcXF1Z1NJZ0lzZWFjYmhNCnF0VmZzd0hJSjJvekpzN3hoYnlq
|
||||||
OFlRL1VPa01NaDh4Q2xxdUYzU1E1QzgKLS0tIDB4ZjEwRmtSb1hXWFpSdHA1ZzZL
|
UDg0VHVlMUFTc2xNdGtLb2VXVzBySHMKLS0tIHdVWjlnTmdxSGpMR09zOFpVYmZF
|
||||||
YStGSVJYUGE2cDhiYkJhY3dMQ1F0dEEKLexDk8xrQ/7SGGUjGIjt+PiL98LeIm6z
|
M3ljcDgyUHB3Zm00bUxWeHRvK3o1bE0KGWWaSuPmvzA4PqBg3y+XOpnVCkv34eV3
|
||||||
Bs+2xr/egd8X8ISwPTjgTutDqTM4Oc6HaDJ/mG8H3ewic4ey7TmuPQ==
|
ZEnPJood5bkBlVqfiBbwJaF98rCH1f5WI6S0NA/5ol5kckDpfwpePg==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
- recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmNkxBQjBDSEt2MllQbzJL
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMczFnbUlONTI0M083bzNB
|
||||||
VzJrUFhHRzduTDZLUGlTZlBFVUozc1VlY1g4CjM5VzIrbTdZMlJzcTh3MWlGNWNK
|
RVdYQ3ZIT2dwbVJVS3pjZjc4d1htMVQxZGtZCjlPejdVNFVrV0t2MjJ5NEZuYklt
|
||||||
amVnbnJwbzFxalNSYUJQRjZ0dFllL28KLS0tIFV2SmV3TkNxSEhDTTAweStMUVIy
|
U0ZiUWgzdytMSHd1N3FPdmNmb3B3UkEKLS0tIGtPdmhpT0NQSGpPWWVublF6dVZt
|
||||||
UHVhenNpRGxweWpIQXl6N1B2NEtuYXcKgE62N2ThlFFp+b0T2Rix+H+rmBwrfQDx
|
cTh5bnJ3WW90aXRCSUp6NHFYeU1tZ0kK4afdtJwGNu6wLRI0fuu+mBVeqVeB0rgX
|
||||||
5jXxPFWOdeEowXMM6kUi4xzeUH7/CGXlg+5uNF9jWMpJ09eAKPoO/g==
|
0q5hwyzjiRnHnyjF38CmcGgydSfDRmF6P+WIMbCwXC6LwfRhAmBGPg==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
|
lastmodified: "2025-05-07T21:34:48Z"
|
||||||
enc: |
|
mac: ENC[AES256_GCM,data:n6GHD+nQmZL17WvUZiMCBLRHbtpoKU6U8o/Oraj0VSRi/pQ74QWGVEcIX87kFjBvR2C+UPd3KwXzjQHhjUfHpz9EjIGi6tXLTTo8K3ptd2wCL8MW418TVO4KV+BFmHGT4kwlbdoqaJ2SA7HcfXNaC68e/2CTXhtkLpIwGXtYWJA=,iv:iC5QX/JMwno4mBljPdorNmcQSD2wy/wOYvGrUoC2yzg=,tag:GuFNQ6+d6o9DYC6Do/IEqQ==,type:str]
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIa3dxbkQwWktRcFI2ZW80
|
|
||||||
S0N5MXZWaWxBTmkwV1o2bzVvZlQ2MldiY0d3CmFyRWk1clJCeEptNkcwVkdwUURR
|
|
||||||
MGVzcldGbUpxWDN6K2RGT3ErajBZRU0KLS0tIFZadXVXbDNsT2Q5eGtJaEtOaTlX
|
|
||||||
U3IrZTB3YUJiREZDQkgzUFMvb3VxU1kKJhYYVcCT8hNJkEK1nD3GBekVGDOI3Nin
|
|
||||||
iBat3LwB4Ijzx1jA+jKJ1Ilf4MgdoL2ox6l/uWft27vvsRaQ501VvA==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
lastmodified: "2025-08-25T12:27:53Z"
|
|
||||||
mac: ENC[AES256_GCM,data:GoJ2en7e+D4wjyPJqq7i1s8JPdgFO3wcxrtXOgSKTxi6HTibuIcP4KQcKrCMRAZmXOEL1vpnWFA2uk7S00Av7/QOnzP0Zrk3aPBM6lbB+p9XSabN0sOe1UpZDtAM3bzvS9JZzyztT5nHKvO/eV2rP71y/tYbsT6yvj7Y9zxpvKg=,iv:tQiCr7zpo7g5jZpt2VD9jtFKo32XUWs94Jay+T4XWys=,tag:npBqmlbUUfN+ztttajva3w==,type:str]
|
|
||||||
pgp:
|
pgp:
|
||||||
- created_at: "2026-01-16T06:34:45Z"
|
- created_at: "2024-08-04T00:03:40Z"
|
||||||
enc: |-
|
enc: |-
|
||||||
-----BEGIN PGP MESSAGE-----
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
hQIMA0av/duuklWYAQ//Wr/FkredBdFTg1pft56pSfVNVScGeETZXT/EVr0esNb1
|
hQIMA0av/duuklWYAQ//XP1HnmkjG/wdSC2lQm2XJkB5hMU+eJxglsPVaQpqTODr
|
||||||
8bO2SUxWSSKAFaHy5YJ/C7B9Ok267dmecvDiCpBN/UwAVKnbXIwMwQVEpdwFI7Zp
|
dtVslBr/4nvCLypWhwYCG4jSz9YHU1sI9kDOsuo7PtwCrhfefeOL6CO+O40ECFMR
|
||||||
g41BaxZ87ogphyXmmPmTtekbV6hJZE1FJ2D1rDlEuIHECGhn+lViuF2T+WmCE5iN
|
CEMmPLrTXg3LV3TzulchXY6x72LRzJ/aJ1Ra/6sGmffL7JHJ7vHz+U63oXyYivdX
|
||||||
UvcU194RjL5cWy4Rgap7bo9UaowDXRHYTuvc0lEBkoCaNbb252KhC+C/4OXIjV3z
|
9zsxP+iGRpQBK6wcA+Wg30rFV1ENE77H5Wh3PGRRXBSVE1fF6I3USgOxlQvGGnK8
|
||||||
BoOxF3jF7xLgeK/7swMfwVpQjwD/aM1IKkCLFdf7GbUfUjdKdEiPCpRCMSmSUtXk
|
cobLecH6V2TwSAptVcGk1gEmn6RUZdxATBnt0vE/Wr/zxZLuoRJgxmiwXuL5+kYW
|
||||||
JDAJz7lzej6r/fCHSsmntSf2RoaHDk3kKMNSvqR9UkCiF/LHBhIeDz2rJiOx+suR
|
QjCvCgAAEyFJtDRycwPPpDtTCBECPV97Ryev0Z8PdrYHfjNcgNVgDwNH9L3TuIEY
|
||||||
gPQLehedeF66+A6m7WwQarklPqMhPRw/IiVxXgsDR8Ws7Dr5wPmNkuQ+LvO4rPEG
|
QL/f/+9PgNuUjf/7nktn1c5eAvmMyKJCiy9yKYZ1H9ynwN5Bxf+KJflVtTWbdJJo
|
||||||
iC8pOTs2+Eb0ulxtjY9o3DNkCbXGzorSLZ6MBkhQhNUmCuubVQ0gpw6RR7uflgGL
|
ITXP2RyU2ttM2WjAM87E0HJD3XZ9x9I8Se/f5eQbg2Om7E2HXYr/v2uWf2ByRn5y
|
||||||
AYvv8GYpoY+uWWAbsnVdeK8XuGccjP5toK25PiOKzIdRXczngGMLdhNpQmS2cfh/
|
PV232/rR/whf/vpiwChDsBT97ZfZJibU8Xot7WMkQhgjCJaYH0wzYcrnvg3EIAo6
|
||||||
A69QRFprjTt1/sAqzbe9V68PZ1Opa3EH/fvWgXbUTJbxhAMJoZy03KGnQC8kNw0O
|
MBN1ufKNAp8BoXrM2P4yu+UOjrN8O+54Sxg7CSwg/a/ldDdjUnsGfbf3vzY1EJcY
|
||||||
RFMSmX2fnK4ppmahnO5rn+5InF1TGSd34O9yPacSB9glb3hvClmNOsC9b/Ow/FnS
|
2lhLZ8sOQyl+Ppe095pcTLvcYp2FOihf6d3i7GGG6Q9Uh2Ljs7EB02GDKP1XozjS
|
||||||
XgGY8d7IGU6zlCwJyIEKsekexJ+UiooT1AoyORHvzHw1J9jlrybSZTK+IzSGlpzf
|
XgEsx/GScE/PE15VKlOHhrrF7OJj8P+uvlriVqk/MSWUVO2+X1yS09gXFtazLZBo
|
||||||
bfiUk6yOyYNU82LhJBc+gdl6QVeO7VoQrN8iJq752A9yrk5eZsBWOeZybezJQos=
|
yqK2yWAOsjFnrMv4A8YHM7COkKvJ9BGdefsoGQu1O838/T7R9+e1OK9iDhfbcMM=
|
||||||
=WTmp
|
=vMG8
|
||||||
-----END PGP MESSAGE-----
|
-----END PGP MESSAGE-----
|
||||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||||
unencrypted_suffix: _unencrypted
|
unencrypted_suffix: _unencrypted
|
||||||
version: 3.10.2
|
version: 3.9.4
|
||||||
|
|||||||
@@ -9,101 +9,91 @@ mjolnir:
|
|||||||
discord:
|
discord:
|
||||||
as_token: ENC[AES256_GCM,data:cnPZjBbODZUA1p0kLNeWpKh1oGkDPxDw/g7163XnoRCIgpqk,iv:Uu4L36uDPMBgzdXE2Lt9U0qrBSl3Xuufh1313BD8B/U=,tag:nTm6s7IGd4vNzZ95mfxDpA==,type:str]
|
as_token: ENC[AES256_GCM,data:cnPZjBbODZUA1p0kLNeWpKh1oGkDPxDw/g7163XnoRCIgpqk,iv:Uu4L36uDPMBgzdXE2Lt9U0qrBSl3Xuufh1313BD8B/U=,tag:nTm6s7IGd4vNzZ95mfxDpA==,type:str]
|
||||||
hs_token: ENC[AES256_GCM,data:UzcaNsJtJPKvFT4gQDNfat0nmyJzmQ6OcSI73pANibzOVrWl,iv:ujgRM2jb1rbeloPB4UPLBEvQ7uue4a+bHiqsZAHIqtk=,tag:uIfuaTWSTeVvpQx5o28HPA==,type:str]
|
hs_token: ENC[AES256_GCM,data:UzcaNsJtJPKvFT4gQDNfat0nmyJzmQ6OcSI73pANibzOVrWl,iv:ujgRM2jb1rbeloPB4UPLBEvQ7uue4a+bHiqsZAHIqtk=,tag:uIfuaTWSTeVvpQx5o28HPA==,type:str]
|
||||||
ooye:
|
|
||||||
hs_token: ENC[AES256_GCM,data:QBrdRt4ozAh2XYJtssm82uHlk9aGO1Nr0fEZetmWfLvmw52FZEq8ijyKOgwS6uTcndMi4gGKkq9r4eapLwcMdQ==,iv:VHOAqxR1WGzZ9dmNx+FmjGAKRpUFjWOwyOVmgDswpE0=,tag:k5it/yx7pOfGbJXZUlV69Q==,type:str]
|
|
||||||
as_token: ENC[AES256_GCM,data:RMkY0xVj14FwDbYaAysSmzB0IlJuk0ucicNhhTmVAEgiU05PxWG+qk3/elFcaFwaXRFgQQtVyGFZEcK5gpE9hA==,iv:8JgNrTe7GQqPMdUCxEaxJ9qV7Uec2fkYBmF9LmH4X3o=,tag:tRnFpRAZs9kO3u2SDMwNnA==,type:str]
|
|
||||||
discord_token: ENC[AES256_GCM,data:6rzv3glW03jcYiJ7sAvDcvDmQHs9iVbV11tIFwgD3GuTkVn6mbAoQhjUaz3zpb/OeoGt+j/pCBRlZgk=,iv:JwkqLpeGYhgwLX7SACNh0AUO53XSx9IKgncI0+KkvyU=,tag:30C0X9nVSlEYPITVzuN0qA==,type:str]
|
|
||||||
discord_client_secret: ENC[AES256_GCM,data:wbM7bPZCWa2+UNUqXi27fP0ppdinRkEC4N9KB68TJzg=,iv:Y2j+8oI+kI7DMrBfFU3G5HtFWguNxDpxbNvJkpK5lQs=,tag:GntocbTCybCVqZ2T3lNSIQ==,type:str]
|
|
||||||
hookshot:
|
hookshot:
|
||||||
as_token: ENC[AES256_GCM,data:L4vEw5r4RhcgritOeDTLHN5E/dM=,iv:pC8BLzxf6NaVAGsotoq6chOceBVdMLvrsQn1LGw9H9w=,tag:SI3CDFHAvgQZEvf/oms3EA==,type:str]
|
as_token: ENC[AES256_GCM,data:L4vEw5r4RhcgritOeDTLHN5E/dM=,iv:pC8BLzxf6NaVAGsotoq6chOceBVdMLvrsQn1LGw9H9w=,tag:SI3CDFHAvgQZEvf/oms3EA==,type:str]
|
||||||
hs_token: ENC[AES256_GCM,data:2ufSJfYzzAB5IO+edwKSra5d/+M=,iv:cmTycGzNL+IeRRKZGbkhTtiksYTtbxED0k0B5haFw7k=,tag:FmWe5sGi9rlapUeAE6lKvg==,type:str]
|
hs_token: ENC[AES256_GCM,data:2ufSJfYzzAB5IO+edwKSra5d/+M=,iv:cmTycGzNL+IeRRKZGbkhTtiksYTtbxED0k0B5haFw7k=,tag:FmWe5sGi9rlapUeAE6lKvg==,type:str]
|
||||||
sops:
|
sops:
|
||||||
|
kms: []
|
||||||
|
gcp_kms: []
|
||||||
|
azure_kv: []
|
||||||
|
hc_vault: []
|
||||||
age:
|
age:
|
||||||
- recipient: age19nk55kcs7s0358jpkn75xnr57dfq6fq3p43nartvsprx0su22v7qcgcjdx
|
- recipient: age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlVGNjVTQyWHloRkxWWjJy
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJcndkMFhyZzdCK0JDN2FZ
|
||||||
ODJ1cEg0aCt3YjkwY2pKa2d4a2N1VUwzcXhVCkpKbkFsZ3lNY2tkdXhuRXRLeTdU
|
ME4rTWo5dm9yVGFSQS92M0FpaW5WMGpzRm13CnZ3OEluNWNnMHJWaTBuZXc1dk9X
|
||||||
b3U1OThkT1BubUVnbHBOaDY3ZDB5enMKLS0tIGZYUU9QeHFRT1BwRVpDdDZRUXVn
|
VXRDOHlXUmloYUVYT2pzT2llYU8rK2sKLS0tIENJVUgxUzFxTFg0S1BScm5tNU5x
|
||||||
M2lmWTRiMG5oaUs4NFZCb1NXUVdUZ0kKq28skWDPKQ8U4H+vRu7N3I8vURHj5eMX
|
M09CZ0Y3NTQzUVY2ZXA3cG9pYUx1SG8KkZXHZmB5yBh/zoMBMdMwlHyjIQE31EK7
|
||||||
XKYf6wQ8kyrpT2+nZhWeVP26kpDvHcsMSqQR1ldHOGQAq7fAz8Qwyg==
|
cwAfWYVLjk0CDM1JScTCy7RoQpbqNsMWFyUpu1p+1N0FE8IgefOU6w==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
|
- recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5ZSt0QnRMb0lvYlBYTnVq
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTekd4bHhLeVh3RkNsRjBu
|
||||||
RHNha08xWS9KNURKTTRpQkZUYVJTeXMwc2xNCkplb0JDU2hyakFCN1JjdWd3elZ5
|
V2h0azluRmJzalZGdy9MR2RENkY2WkpyakN3CkdFWHB3cUhQYkZlU2Q3d1ZtcUlr
|
||||||
QUtzSksrVjhZajJ2Rm5HbkF4aGo3TnMKLS0tIFR3ZFpGZVRNY0MxTEIwbm4wL2oy
|
UTBzUU1lVFZZaHUrUENiWlFCYXErT3cKLS0tIEZUcVNRN1QwdnNPYnI0ejRyNDBJ
|
||||||
VFdEczZXV2ZlbElQSjR2MER1YzhMV0EKHT3aX1BnddpVNuzzCKf7f4lqe4hTYPYt
|
QXJzMmFkdDh3SHJCSjlCQmVSKy9McU0Ki8UxAzALy7EPr6Nve8UGLmOCqstCcOfP
|
||||||
+udTQ6pc0XqXEiJmEJN/XrhkS1BOtMBbP4rIse4x663KHREEG1K1OQ==
|
OkTpjXFcTBJ9wMj1ZXCoH3KYqvJSu0gvB97phnkN9X8aXkf2DsOCfQ==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoZEluNjRwRjNHaEZzNHR5
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwT05zbjVqY0NNQ2ozdEhx
|
||||||
ZW5RVll2K0NwUWtOTERwL05HZXJuMUxhUDNZCld6Yjh3Y1N6NHRzSG50Wmh1cUxv
|
MWFlMWpvMUorR2RnY1Nva3h3VHRjZTJiQlFjCjNtUzZxRlRlZkxGNncyQVExSVN4
|
||||||
MW1OWXB6aWR6cHdHUU0rNGZML3pocVkKLS0tIHA5a0JmdFQ3cUdQYXBKTWxpdUty
|
UTJINkxHZU13aXpOdDhRNW56M3RXMUUKLS0tIHBqWHNIZ0dYTWNaclVDVk5sS3I5
|
||||||
dFJhWnBsSzVyVkdMSHhEcWNvUmp1WG8KRB4/5AeDmkJ9I/ZMvqs9Rnrtl0FmOpYP
|
YlFkckxlcjROank3eXdtdWhMY2N2Sm8Khqzk4NUSeaPBYkMbHBhBkagFBQs7Z9MX
|
||||||
hwV87Zznh0jA7vxqB21wH4spqu47VrFo9A7OhTp8e/ogtSJjyJkQHA==
|
HYLiY5pOdCkOteDSOGlqSdiKI7yVNsETjDXeXybLHk/RNaJbhvhqwg==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
- recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBocEU3amQvazVLRjFzOE1X
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQNUU3aE84RnpaR1pET1l1
|
||||||
dHpkQXlIWFptTFNTZmJtak84ODVZZThKSDNzClJrYzBrU01TK3ZNM2prQk5mU01H
|
b2dDYjZmSVd3N05iMTloKzVTc3phOVVGYlRrCkpGMUZhL0Ywd1dEZm5TYStCNjlX
|
||||||
T1Zyd2N3YVcwQkpsMWJIK3hKaUVQWm8KLS0tIFU2QnZVaHRaZjR3RVlveEVmTjdu
|
ZUJnWU8yZ0htbHowMzNBekNRSDBjWVkKLS0tIDlXczh1VDNsdDYzTDMvK1U3TWxQ
|
||||||
SVlaajJ0SThZdUpQUTZBZks4RDcxNnMK33zYR5DuSOe1gJQmaW61Z/CNRvSV5LzC
|
V2tXdk9BUG50c2ZCMVRoY0hxeFlkYkkK+XdRap/LtxzZ3q4ulPRb3LQyeeuO0mu8
|
||||||
+UeqdUsYxOPUzFHRLwUd1YD/uPO+wfQph/WVDh8ELqsG4i0o/l3ycQ==
|
So+7G2acSDhcNqZtW4jsu/NzSNqcv1bwd4XcKe7xqVDVYRpN8LBb2Q==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
- recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArYTRCeXJpVi81WE4xWGli
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhMW8wMi9rdStMSkx5dlpL
|
||||||
TDQ5M0g0MDRYb2ovbzFjbkloeG5LWmdBTUI0CmZSV1FleDhtb3Q3WGhwcEN2OEhN
|
V250UlpET1k0NmZzaFpYRG15OG9NWVBKMGtnClFxeERxc1kvS1QxNTc0WFFQTDU4
|
||||||
YW1rVEJNVGtWeTNmWnpsQ0J4b1k2b0EKLS0tIHBkVU15a09DdHBQa0x5L3p2THd1
|
UmNGaTluelF4NElXUWhHQ3ZnN2FYa1EKLS0tIEJHT1FZZEFwc3lxYWJFc083ZG92
|
||||||
VFBQUFZXZ1pKVVoycHVuNnVxem9Gd3cKW6ZqzSjbVZDZcv/cWN31AF+5HlyvbThj
|
TllFaWFqOXZhVldlcVJwQ09TSGRFMzQK+smZIE1hYx8urWrAqqAb9zId6ZblQesr
|
||||||
W/qDquapYsf6dybP9F3GJ3pyDdSJbkVvInBL1aZWz/mzvny4SPSJLA==
|
pc7lDe5AAumIh8t8tzFwl72XtSMrStDqaneibbRjr0N39L0xN/nhTw==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
- recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhN2V0ajNZTWhlb2RlTllF
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnZ2gvZXFXNmdod1IxWm1o
|
||||||
KzdCd29lenR3dEJTclhvTnJDTkFNbVA5QUNFCjd3VFFtOUZxeFR2TmNLTGlZQ3k0
|
djN2Sm1iVkpHYTJ4LzdLWVI3dGJIZTdQK0VrCjJqVnA5NFlXVGFFUDhXdE9GZmRJ
|
||||||
SStaKzJHRHdYVEVqTDNnQyttVWFPZm8KLS0tIHNQMHk5QXJQQUZyUmZyUzE1czZk
|
K3ZNTnVDZ2w2NjZEemRNUnVoaXJhN28KLS0tIFVxa0NBNlVVNlBDZ1pxSWRZNFY5
|
||||||
ZmNETDhaT01VL0pQTDhXQnRxUUpWdVUKLxDyNyTKs5hl9CkPGQLOe4JVz1EZN6sR
|
WEh5NFN6SFF1TlltdWFWTGw4MHRHUkUKrKIvC87xjEmwxPQhH8dN+ZuaJTCgPY28
|
||||||
drKTDoEOPdMT+ki0DwfLUcmEOJGg2ZOtmlee6s5jalBIrPZ8MXEndg==
|
pR62KxmoKFICLTHPpYP3euiAx5M9BWvgvCnA/US/5klpk8MtlreNFA==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
|
lastmodified: "2024-10-13T23:30:01Z"
|
||||||
enc: |
|
mac: ENC[AES256_GCM,data:vdsAZmg7gPqzeucBhLhPemtRVkcxRecIdB6PXZ4paU+Uv5UorBKcTZ3jseN2cLi6ot3ycTIm+UI6uhlCy87vAJVynVJhuJS+ICFRS2+DfoVyuttLjZQGC2sr3+dEBHxIH7sZJSo9PIzbIWw3qHrpOPAZj0//1pFyp/k15k3vidM=,iv:jWtV+WAPt08lgdrVvtXOl35rDB4QflkZWuGBW1+ESyw=,tag:YxSHncZZOAW5uDxXtb/krw==,type:str]
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqSUNaM0gzTzJ2d2VQUWd3
|
|
||||||
RlVCdkNUblBKcnV3VEx3dmFXeTI0VEJHMUY4CmpoWHVsdHJzZlJXcjRNWCtVa29E
|
|
||||||
dkNLcnExUUJLQ1NiYWVhSkhMMXFnczAKLS0tIFlhd3c4clBYNDNDKzNuZkhRNmhW
|
|
||||||
Qnh1djQ0ZDFhRmxsU2g0eHJZeFlkcU0Kj5H/dHrOwSgiZIzpv3nOc7AWeNMofJg7
|
|
||||||
OzSVdRry72qPqYU8YLWjAcoP3ddITZnWr53/yYBVmssW/KeyVyPy9A==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
lastmodified: "2025-06-21T21:23:24Z"
|
|
||||||
mac: ENC[AES256_GCM,data:bEJoCzxph/MOnTOJKdrRiQmbVWmAgsKy8vbD5YBeWagWUCJPDAZNDFLzEzmPvt0jDBol04JosrSIKZS1JzJIIm0zRkcOWSqERQCgjgtGdAYmfp0V6ddseDUVfKlZYJDkt6Bdkqg+9LzrP8dDVm2tMDXpo8vzs02o9dTYFm7imVQ=,iv:buP/297JMfvEm9+IdMWRGV7AgZwF0+G6Z2YIeYw/z1o=,tag:+zG612MJA4Ui8CZBgxM+AQ==,type:str]
|
|
||||||
pgp:
|
pgp:
|
||||||
- created_at: "2026-01-16T06:34:46Z"
|
- created_at: "2024-08-04T00:03:46Z"
|
||||||
enc: |-
|
enc: |-
|
||||||
-----BEGIN PGP MESSAGE-----
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
hQIMA0av/duuklWYAQ/+L4rjUWtF3NuYc9UlnyPpwSQvsLbw7gsPuLHYd4cq2VGd
|
hQIMA0av/duuklWYAQ//TtjTsxf5xHnu4g5Y22qvyMud17MN4j4hCoLXjRSbzG8K
|
||||||
p8s0Vreq6smVJlFV64PySIJjFuFhc1IuDDYtgym2Lf4PTOSv3brbO3ypMb+J2yKC
|
/E+0Gs08P3QqV6DddmLvxeAcnLBTAdE4XCMFsRX9eK0BLqPe++yoamOpoPe896zm
|
||||||
pH7xwOQBn+YzKfLu4sX26S2IGSKeytXdHv6hlkt9Ca1i5RKS0ymYfn94vf6e56ZX
|
BW2BXn/oemGdOFVOf43LRuMEYn32pjg4RNzR4bn3om2TY3S0nr7GP5J9B1QrSPfH
|
||||||
SLVjq2GprTTt4oNymxkZ5JvDNXyG8XjW3MjowfQcNHUqAhmYN8ngv7HMdiIb7GGN
|
AFdR78MwX7PrOkkh4jSLPftjAI8jUtvS/TzX8AXnzy1A8xSkWxww00GMvTvSSAwZ
|
||||||
JL9u999H4MCi932Nyc1+/OP4nPdUkiqFxDfo4Zgmj/F+LketzV6QCiV7Es9Vmz1I
|
wxU6fePkLwuxVwZVqI5pdsjAscwy7FE7NWDgE9GMIxxwAJRRwJcsJ+eVM6ykWMyq
|
||||||
OX/NXzYKYnEl2FLvPZLEtge2qTFs6/Ur+VBPz5tOP9J0Xejmz62+HgtwaJI7Q4mP
|
Xqo24kWkAqgs7vbxU55gOqPVHN50M22fQ4+RYaLnLyj6BO+0WegW1OmK88q0flaA
|
||||||
O+5FCOh/Jxf0QWq+OPQf+Rxj/dxuMHUfXF9IELmBwpGDslKcyxTOCR0kw3aZO+1F
|
QADZHLGrsuiVgc4KxHskwQou1RuHZnPUSqn+Nhnsp8rtAfboHS28v7ekRNTmhTWG
|
||||||
Zs3QOoUpz46fTXs94h+7dLoboppug0P4jAwKLbdqmyEDTqiWOfR/ZIbp7RCLFq0F
|
qPVPlOlVnY0AemohDjBnk3o4rCxJhviL9KTjmAtIGTK03Fqzk2v23H3+LRo/rocm
|
||||||
wNPWnB03RTgSKRIXyBhNqP62ZOohHhFSA0oo+IDPzqFWOLTnD8FBJ3SPDFjpHwNJ
|
gQCXzN6Igdwn7n9x8wXmuO6iL9Jftu4MoaQ0W55hZiBfh8pG76TGdNhycZr2T40w
|
||||||
3bjzqZRPU15dk286S3hMkp47H2iIBW3hlhl9g03UTdlt+MRiUHIXyt053TK2cbuo
|
MBnRX3ydwH2T+y2pGM9tJY+nlgGsyTiOw01SN7/mio3YdCSvChXTkV3PaX28u+CJ
|
||||||
Jy7YiQr+dq09NoBBVxEo5hszJ154NNF9JxvN1TNHwouw3DxokQWokRtF4g9MSPbS
|
5TaYLM2IP8W5DJU3r3dV3I3JYED1O5Arq7Xrv5Z4qr8vwamnCN6SZGe2qCqxTOrS
|
||||||
XgFrAw/VlobYHBXNczlKyIaTdHQbosz9EZ7wO8Q1jLlzGF8a2e8F5ca+2I3begns
|
XgEHGwiK1pFQIBxkI0gFmGX0ckd1NYUfsUCyYrFkcAsicWetBhdlgMjLc86bVHwQ
|
||||||
CM4iU9uUpReZC4672sqHX622dZAGf7m0Dt3vVaNjGj90rezeGuajNMnYOEd+PAU=
|
7p4iGLGsr7GZEArBnP0J5Ee+Hr9MCiW/OCLY4M4jlTsyimlsdgDgyr+RqoOnvig=
|
||||||
=Lgup
|
=SRZU
|
||||||
-----END PGP MESSAGE-----
|
-----END PGP MESSAGE-----
|
||||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||||
unencrypted_suffix: _unencrypted
|
unencrypted_suffix: _unencrypted
|
||||||
version: 3.10.2
|
version: 3.8.1
|
||||||
|
|||||||
@@ -8,91 +8,86 @@ keys:
|
|||||||
postgres_exporter_env: ENC[AES256_GCM,data:8MEoikoA6tFNm9qZbk0DFWANd7nRs5QSqrsGLoLKPIc1xykJaXTlyP5v8ywVGR8j7bfPs4p6QfpUIWK8CCnfQ1QhsFPXUMksl8p+K+xuMakYZr9OoWigGqvOHpFb9blfBN1FBdRrk38REXWAMUn74KSRI9v+0i5lpC4=,iv:anpjWVUadKfSAm9XbkeAKu+jAk+LxcpVYQ+gUe5szYw=,tag:4tzb/8B/e1uVoqTsQGlcKA==,type:str]
|
postgres_exporter_env: ENC[AES256_GCM,data:8MEoikoA6tFNm9qZbk0DFWANd7nRs5QSqrsGLoLKPIc1xykJaXTlyP5v8ywVGR8j7bfPs4p6QfpUIWK8CCnfQ1QhsFPXUMksl8p+K+xuMakYZr9OoWigGqvOHpFb9blfBN1FBdRrk38REXWAMUn74KSRI9v+0i5lpC4=,iv:anpjWVUadKfSAm9XbkeAKu+jAk+LxcpVYQ+gUe5szYw=,tag:4tzb/8B/e1uVoqTsQGlcKA==,type:str]
|
||||||
postgres_exporter_knakelibrak_env: ENC[AES256_GCM,data:xjC7DGXrW2GIJq8XioIZb+jSe/Hzcz0tv9cUHmX/n1nhI+D64lYt+EKnq1+RX/vJzU4sTaKjveKBh88Qqnv6RQm+MZC//dIxcvnnAdl50qnHZyBCaFFEzSNI8I8vGyArMk8Ja72clBq3kMpUz/pLBP0qDrjblKDoWkU=,iv:ZW98hJy8A5t4Oxtu17R3tM7gou183VLbgBsHA8LFuJY=,tag:VMOvQz3X/XDylV1YFg2Jsg==,type:str]
|
postgres_exporter_knakelibrak_env: ENC[AES256_GCM,data:xjC7DGXrW2GIJq8XioIZb+jSe/Hzcz0tv9cUHmX/n1nhI+D64lYt+EKnq1+RX/vJzU4sTaKjveKBh88Qqnv6RQm+MZC//dIxcvnnAdl50qnHZyBCaFFEzSNI8I8vGyArMk8Ja72clBq3kMpUz/pLBP0qDrjblKDoWkU=,iv:ZW98hJy8A5t4Oxtu17R3tM7gou183VLbgBsHA8LFuJY=,tag:VMOvQz3X/XDylV1YFg2Jsg==,type:str]
|
||||||
sops:
|
sops:
|
||||||
|
kms: []
|
||||||
|
gcp_kms: []
|
||||||
|
azure_kv: []
|
||||||
|
hc_vault: []
|
||||||
age:
|
age:
|
||||||
- recipient: age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
|
- recipient: age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIRm5XY3kydDJSRUYrcmRk
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNbW1FZmt2ZDRZcWs4SEkr
|
||||||
K21WUEZSSEpYOHFrVkFyOVJYYnRUSU1aYkV3CkVEUllvUm0wZjlmOFU0VSt3OStL
|
R3ZDaUgyVlVvRHNNRTZCS2pxQThsT0NmYkFJCkk1Y1NpT1RSTFp1MWJ4aVNrelVx
|
||||||
Tmdkc3JHRWplS3lnQWlkT3ROVkxkVUEKLS0tIFRJRkFEeE15Q3A1Z24wQzNlbUx1
|
blYvS0l3ZHczaVcvZDE3U0k4ejVtZmsKLS0tIC84WEE0WERiTCtKNTN0NmZUbDhV
|
||||||
a2tmd21zSWUzbmw5NDdSRUVDcmVwbHcKn+DJ1PnlQApX8fwJoN9DtMqeKzoih6Hr
|
c1QwV1l5b1ZQNitFRnFhQmIzSWNZd2MKokg6XMIFfjxB6sO8EBjBc7E7Ur3zBw1o
|
||||||
sSh2z6rsTj1UmXocbBm1SduattqZFjvO5XGpp25mM9ZBlpcnVjB/hg==
|
akXuA4I1Xw2H1W8B6HkVSDp4BpBEe8xi0z8TUmzkA9/IBoypG5EJKA==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
|
- recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVaEdlWnJCdHVpM0ZHTlJj
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrQzVtTFRFTnNNQTFXL2dF
|
||||||
WmNrQnIxYmxmWlJ4Z29WKytHd1plUURPSDBFCnBHU1MyMS9FNnRCMmJ6Ymd4UWcr
|
UC84d1o5Z0p2by80QW9Sck8zVHJvMjdjd25nCitBRWtzVVdTUU85RzFpN1FmOVQ1
|
||||||
RGV6QmhrbDFObDM1MW1NdTdDU3ZIVU0KLS0tIEtBR01OOVdITExFcUN1dHEyaklD
|
SlNESXBKc1BUdTRaWk5nSENvUXdraWMKLS0tIDlkUFZRVUV2Qi9iSUpFRmN1Tm5S
|
||||||
TVFnZXRva3FUZjcxYlRuQnpFTDhpZzQKxZM0ZB6dVwFr5QkT6YmEA+3RhhsX0pl4
|
dW9lTkxsNXBBN0wwZ0NFbThRdzlvOU0KbLzteBt0VTr825sfKLNs3i3FT0/dgn2z
|
||||||
SolLZXFal1BluDERtZ2Clb5VzrcV3PUfFo8Yx6ncFjcisyFXUHVnYg==
|
kOpJQf7KZKEVBkInUOkPmobtw6oM9vfWha035tTJPYjWy+Lp939tBw==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvYmNZSTBrUzg5d3NPSHhM
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCR25sQzNkMHhETzY5cXRm
|
||||||
Z2s4KzlVZldKVitmL3RFNHFiQnJlcmlCS3k0CkZ4YlBvbW1DTzEzRTZMUVBOWDNT
|
Y3QzYXZOemFTTmN3aTVpODlQclB1Y0JRNlRRCi9wQWVGUVFYd3ppMUVMdUVQNnBC
|
||||||
SHQwcTBQL0NQbXA3WHVZcFhjZW5ZeE0KLS0tIHU2TVErZ0I0dGRuTGIzZkVoeDJC
|
bVVRVHlsTWIzMitqNlQxN2NKcWl3a28KLS0tIEJrNk44TEN0ZzJ5L0JaKzFZaE9M
|
||||||
MHJkcXlGdFN2Y1p4Q08rT0phODlLOVEKhSEO8hUZ0d3SA1tFvXN2HuZR35SRzhUq
|
MmxPN3RUT0hDRW9MSm92LzZJY1lCZlUKM+r/35me5K74KkidKLUTZxqMqR++izHK
|
||||||
+J3eN/qUBu0LcuiBq+qbGYIAHggXy9ZSGCGfrNw35czzGpzfbK/fwQ==
|
69gXZEHY+ZSvJ+9IBzcIxcFdSFyVUAN7wobBWZGDxmGJRClS/8jcHw==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
- recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhdDBxd3J5MWZ0R1IwVWRw
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXbzZHMHVqVkVrTVdiUmli
|
||||||
cklOOENFM2R4Q01JdFd2cDZCQ2pSTGNucmhrClgra0tCSGdqZExLbWNoaDZkSzJD
|
OVhhVTZhbVRVU3VKd1Jxa0Y5dlFReXQ0QmlZCkVtVEhCcVlHamozeDYrQlVvRjlZ
|
||||||
aDc3YXdOZi9jMDdwc1duTWdKbEdUVDgKLS0tIGxKbTYzRnAyRVlwbUxGS3JySFJS
|
YUNXM3FML2ZLOW5PZ0tpZjlPc2lpdlkKLS0tIHVXZHoyRmlscSt2TlpLb2lDd3Bt
|
||||||
VXNrSldhMDV4V2preEJ3ZDk5UlZ1YzgK8K2R4LETFFKpUZVdofJoE6eXw/tlz3+9
|
bmJJS3JPWlVMd0FRaExUZEZMdXk5N0kKY6qYVva2aOkvo1huKH50gkT1iQAUhZCB
|
||||||
k0iXQX6zMj1uSDmenjztU04FIfRxzIur5xifd8hCJnWmxlOCFDqLag==
|
ieUD1aQumHe1OYVeEWJCf2nYgApwq1tPjea5nqc4VzOogTbLVcKMFA==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
- recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPc2dCdGNSeWo4RkovV1Vn
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrNWc0RVNQRzJkRTBKS2xD
|
||||||
ckRYYW1xZldjVDRuSjM4elQyRVFROWduL1QwCmNSVzk3aG90MHNWZWlzVDg5RE55
|
R3ArQ2lkc3F3QXN3bldZbkJMaFhoaDI4Mm1RClhuSmdRbWxlM1lxOURRWWVocC9X
|
||||||
L3JKODZlMDJudTZYNGVNQldaNEhPcjQKLS0tIE41dDYxWE84Wk9XbG9iMUhpMHBu
|
dWFSOG5yN2x3Vm9CZ0pSN1BLTWk1ZmsKLS0tIHRpRmJmL3FmaTFpL0czV0tIOWhX
|
||||||
VlJZM1VMYkRkQXNlSVVoT3RYZXRaRU0KqqIjxe05oO67IUt/LMIYsUAaZw1qQFNv
|
NHZLaEx3dEozc21MR3ROWHRBQzR3T00KQQiQ4SxpyMTDZyGY7TZrdQEioZAB+BQ/
|
||||||
mmVu5GvHdpSrp3PttxlZC7OiP84Jzj7zM/idj0wBIeVCWedWO59aKQ==
|
u24WgbBdSP6VDvqmq2gG8BqZ3Aog2/7SQ0CVzrsimAoXi7YCWCTetA==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
- recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
- recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
||||||
enc: |
|
enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHL3RId3Q4SGJkYjM5STJu
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVcERwTTJmdlgvZjhWeTBP
|
||||||
ZU9BbkgxaXdva3g5ek1hZUF5YWcvZHI5c0VRClhLazhueTRLU2N0T2c2REllT0R1
|
eGJ0aG5RQ0xrRVBSMldEMEFpUHo0TnM1aFNzCkhReEZ2dWVGelNadjdITCthcTZn
|
||||||
LzFrdDdiVVhLQ3BPdkwvVTg1RjdscG8KLS0tIHRYTmg4NFF2c2FpVHphUFdqWmhH
|
RzlQZmh0MzF5RmZGRW5UVXhYL3RHRFkKLS0tIEtrV1ZjQkovZFlmcDM2OUNYaHZx
|
||||||
TFNhSDNUMEo0Z05mbmlwRUs5VHhUWHMKJUCyLDJx2voDttv4UrpFKYyNz+HhtyFj
|
WDRSdDZRa1lIbEVTdDlhU1dwUXUzQTgK5iE4Cf/zjsPYHKcqYA0rFqY0TNcCnzNU
|
||||||
X3OrNbmJQYuNpq4hzQs7jN5UD/4YCtFi9mb5pmFr8MTHLb6UsZN++A==
|
vTM+cEPaA+/FXTwLfPpaiSkg5Fq8k2XdeMQsjQnglTBSWCwAJin27g==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
|
||||||
- recipient: age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
|
|
||||||
enc: |
|
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKNzZ4Y2U2NXpXWHA3Y3Zw
|
|
||||||
S1BKbTNXaGxRaE55QkZNSFV6b3VURFBXWlEwCmpJUjM3VVJRc0dwdjFLOGdQQTlz
|
|
||||||
a0hVUC9tSXNDQ3NyTnlnVlNNalFOZmcKLS0tIFNXYThsRHd2eUQyOGtVT1RLaTdR
|
|
||||||
RmlST2JZS2gwbDBpZ2xMblpWNzB5ZWcKTkKF9aonrBMolxqcj9a5d9JLoCj229KU
|
|
||||||
It2KjhlzBcgcJUIiIPWMoV9VbEpKkTsCLkWxFSLle++ryOUYh3kgaA==
|
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
lastmodified: "2025-03-16T20:08:18Z"
|
lastmodified: "2025-03-16T20:08:18Z"
|
||||||
mac: ENC[AES256_GCM,data:C2tpWppc13jKJq5d4nmAKQOaNWHm27TKwxAxm1fi2lejN1lqUaoz5bHfTBA7MfaWvuP5uZnfbtG32eeu48mnlWpo58XRUFFecAhb9JUpW9s5IR3/nbzLNkGU7H5C0oWPrxI4thd+bAVduIgBjjFyGj1pe6J9db3c0yUWRwNlwGU=,iv:YpoQ4psiFYOWLGipxv1QvRvr034XFsyn2Bhyy39HmOo=,tag:ByiCWygFC/VokVTbdLoLgg==,type:str]
|
mac: ENC[AES256_GCM,data:C2tpWppc13jKJq5d4nmAKQOaNWHm27TKwxAxm1fi2lejN1lqUaoz5bHfTBA7MfaWvuP5uZnfbtG32eeu48mnlWpo58XRUFFecAhb9JUpW9s5IR3/nbzLNkGU7H5C0oWPrxI4thd+bAVduIgBjjFyGj1pe6J9db3c0yUWRwNlwGU=,iv:YpoQ4psiFYOWLGipxv1QvRvr034XFsyn2Bhyy39HmOo=,tag:ByiCWygFC/VokVTbdLoLgg==,type:str]
|
||||||
pgp:
|
pgp:
|
||||||
- created_at: "2026-01-16T06:34:50Z"
|
- created_at: "2024-08-04T00:03:54Z"
|
||||||
enc: |-
|
enc: |-
|
||||||
-----BEGIN PGP MESSAGE-----
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
hQIMA0av/duuklWYARAAgrn0irD12kqDfIEvpLpa0Ys/hMG9GwCMeU186iFfJ193
|
hQIMA0av/duuklWYARAAs0o2EHlphoU4JcO5fhmplhmHQp7GXjaUc5zakGACrl0w
|
||||||
72UVEzx2GwIfSt0qQlpBFZtueL9Bb7ka81IrqhAepq8J5//WxEGvv6H9aIm8V7ov
|
0NVVLXf3hlb3saPgbRkf+ugVXd5dRDYfa3vbIDKpQwHVLSNVrVb7M8eIc0RXM41q
|
||||||
ZkS4eZpFksu0ZRFP5HWQvEQwRKj8WxYQY/TS/5QGNSPeHOZYnpQcBhAVLjn9Uj/O
|
MqpueXLo6YfxbgOvsfNlgCvDFgMoBMVv/rWz0QGTj8VCvD5AkxiLQJxZ8TnlKn0w
|
||||||
6ojnIVoKxDdo235fuDQdiLwCpPXsKi2OQuSFOwq7Acg/fm1pvc76h9dqr5DqrspZ
|
NF6yQ7LCGgKVU8YHpKYjPmmDU/VegRYVe6wz4ackk0MZ5ITSFXF4qOG93Uj2SZfe
|
||||||
c3stdbYwVOedgYjRrdSYpkplGSqNeVtYYJ3apdauMSRNaKmgMwbkxkzXO9YrWASa
|
ocpPYZ9BrOnxzCYd9ZS1yUmMRLRC61l66oG1hGrBTN7fcmHZaycCdcvABWOB/fxJ
|
||||||
beYilvhNgr0rnQB617IhgBZrgik9CvqrqGZqim0fWI+s4bcbgfvK8UORt4+QgJjO
|
940zMb5NYK6whToCWY++m3I6123k+/vLJe+3NoFc/wYdvpnxVqLZqijxYPZZkbRN
|
||||||
FPqAtVE6sNGzElKQ6ZZPWZoXeK7vfIfxwxU+oLcijAnUmLy88zqIUjUZKzmyhDZa
|
gCtRE67AFWny0VQ2k1CGzBGbRAxM2EtIfDlbNgMUNBNuGST4tgxApp5QEa1yecHC
|
||||||
YAAwxBL1nh+UzIbn4GGeVbYHLbKJ6XnznF7zfTWph6GbeFfdWuaSwxmnGjE6n1y2
|
mr3jDhR8UuFdIrq2sTz/uMUptTrsB3oaZmfuZ47pCVHtDNc2ri4U1gsI6oI03utO
|
||||||
ye3GQaW2aeq7RKoqyLJO3oIHyGHZXFe4pB4adz60uKNPJz47/gtA5OofNs0qbxqQ
|
u/q6nMHiJlf8HUwI59GemBaHTiMgzKl0REAoV3SpdfjWSDZiro42au6E20M1dgup
|
||||||
Dp5fmrvZZtDa/TYIV9o1bSp7cYk49TGKHPbX7tLjEIIfRxd4y6rYgwNpPdukjZsk
|
rQG8Gz33QnIHg5ezEHcTSeHk3SgMTbAqQy7/aD3pqI6wEgXqU2neDFZEkNu4FnzD
|
||||||
bbdxypWrJkMx+9xk84DGo3e+RY738JgLjc0ylDO+pIzThUruBOcDjUKeGNmVQYnS
|
ofnm1oAGnbOIH2+SFtd33hDe/2nuFBo3CYEyz/fezhbMwCwoA4Iwd7FBQW4ideXS
|
||||||
XAGofG3JSI97wFdYOB+4yoYPqs5rovgPbkGGuT5SBIxH5zVv3X+SE4wCGu3CLFC4
|
XAGU2gt1hdPfgMQ55GeRI01C2dqiLQOpvTHy2uBl9ekPtSw2Ws27hVhdHvU7B5ZG
|
||||||
A4cdwXmuERPxszVZW+V8CSGq9XnH/OzrpiWVhzqXCRH03F2BmnAx9Fp/zMTH
|
Jr388jC5d5dKGNv1I8nVNlfmPvb4hwGazrHdCYiQdwrpggajFtWD/LIgUcW2
|
||||||
=DooK
|
=aK5J
|
||||||
-----END PGP MESSAGE-----
|
-----END PGP MESSAGE-----
|
||||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||||
unencrypted_suffix: _unencrypted
|
unencrypted_suffix: _unencrypted
|
||||||
|
|||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user