flake.lock: bump various

treewide: fix rsync <-> rrsync communication
kommode/gitea: bump AVATAR_MAX_ORIGIN_SIZE from 2MB to 4MB
2026-07-04 09:51:47 +02:00 · 2026-06-30 04:15:37 +09:00 · 2026-06-30 02:41:40 +09:00 · 2026-06-24 14:33:20 +09:00 · 2026-06-24 13:38:03 +09:00 · 2026-06-23 01:12:16 +09:00
26 changed files with 432 additions and 153 deletions
@@ -101,6 +101,8 @@

  # users.mutableUsers = lib.mkDefault false;

+  users.users.root.initialHashedPassword = "$y$j9T$ahP6GAdttD17OMBo7Yqeh.$Ad7qBcFvTL7HrJ9uTtrQzksN3220Nj9t/CrP6DwgK34"; # generated using mkpasswd, see huttiheita root on vaultwarden
+
  users.groups."drift".name = "drift";

  # Trusted users on the nix builder machines
@@ -8,6 +8,5 @@
  # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
  virtualisation.vmVariant = {
    security.acme.defaults.server = "https://127.0.0.1";
-    users.users.root.initialPassword = "root";
  };
 }
@@ -62,8 +62,10 @@ in
          name = "loki";
          match = "*";

-          host = "ildkule.pvv.ntnu.no";
-          port = 3100;
+          host = "loki.pvv.ntnu.no";
+          port = 443;
+          tls = "on";
+          "tls.verify" = "on";
          uri = "/loki/api/v1/push";
          compress = "gzip";

@@ -44,11 +44,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1771267058,
-        "narHash": "sha256-EEL4SmD1b3BPJPsSJJ4wDTXWMumJqbR+BLzhJJG0skE=",
+        "lastModified": 1780236125,
+        "narHash": "sha256-LFFdHbXFthgU81S6P+p9FFKs/Wx868d4CtsFvbgvQqo=",
        "ref": "main",
-        "rev": "e3962d02c78b9c7b4d18148d931a9a4bf22e7902",
-        "revCount": 254,
+        "rev": "267af00ebd8693632fa0f80300e49203cfcebbd4",
+        "revCount": 258,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
      },
@@ -126,10 +126,10 @@
        "rust-overlay": "rust-overlay_2"
      },
      "locked": {
-        "lastModified": 1777019032,
-        "narHash": "sha256-29lw7THThWb5DW01rVRj1b816Apwz/P4m2wVWaSIadU=",
+        "lastModified": 1779345549,
+        "narHash": "sha256-naEMpFsQrco5eDtYmcTG6cpbPG+kqElOyS7fTb/jw9s=",
        "ref": "main",
-        "rev": "55262afca46c96f75a834d4e00e30d5fb20affb6",
+        "rev": "5631e1124508fdef0604b08bfcf6343d967a21b3",
        "revCount": 61,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
@@ -169,11 +169,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769338528,
-        "narHash": "sha256-t18ZoSt9kaI1yde26ok5s7aFLkap1Q9+/2icVh2zuaE=",
+        "lastModified": 1780178524,
+        "narHash": "sha256-2PcNyNqbGCWBpAMdCU1HxSQmhQiG6evdjxVnPA7w5bQ=",
        "ref": "refs/heads/main",
-        "rev": "7218348163fd8d84df4a6f682c634793e67a3fed",
-        "revCount": 13,
+        "rev": "2406de41ce9d0a1404cbf4e55537e3f720f37f23",
+        "revCount": 15,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/libdib.git"
      },
@@ -189,16 +189,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1764844095,
-        "narHash": "sha256-Drf1orxsmFDzO+UbPo85gHjXW7QzAM+6oTPvI7vOSik=",
+        "lastModified": 1782122067,
+        "narHash": "sha256-95q3DiYOTHjQGbqR0I1w4ETrH+smtddqW0bBxaB/Egg=",
        "owner": "dali99",
        "repo": "nixos-matrix-modules",
-        "rev": "25b9f31ef1dbc3987b4c716de716239f2b283701",
+        "rev": "0e0fd9f6a407b08dd5e180a2ff6c3808461e2c47",
        "type": "github"
      },
      "original": {
        "owner": "dali99",
-        "ref": "v0.8.0",
+        "ref": "master",
        "repo": "nixos-matrix-modules",
        "type": "github"
      }
@@ -291,11 +291,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1779622335,
-        "narHash": "sha256-06G98ieM6l+OI7EMhlvchgDBDn+DvIWCNj40LDhKpmc=",
-        "rev": "705e9929918b43bd7b715dc0a878ac870449bb03",
+        "lastModified": 1782708249,
+        "narHash": "sha256-ASIzbiHLqFDHfomCJVMDaW1rsD9IJQ/m997Tw8569tM=",
+        "rev": "68d68014342a18d2514d6e6f1185cfc24d02fc00",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05beta1.705e9929918b/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.3713.68d68014342a/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
@@ -319,11 +319,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1778586796,
-        "narHash": "sha256-XmDljcG4x8slQDlsWOc77pCA1YVuYn8JGumkYlhfTxI=",
-        "rev": "b25e938b89759b5f9466fc53c4a970244f84dc39",
+        "lastModified": 1782731455,
+        "narHash": "sha256-vFMOLxoARiCUBQOysAAJ0VmPzilmHUqk3EZfSRweKN8=",
+        "rev": "9c4c05a947a91dc14625265fab505fb695e93218",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre996582.b25e938b8975/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.11pre1024311.9c4c05a947a9/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
@@ -379,11 +379,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781362709,
-        "narHash": "sha256-zTzLvvtRdOKKcQMWydoZuduj9fwwkYRfB1RBzKegwHM=",
+        "lastModified": 1782759909,
+        "narHash": "sha256-gktjBeZyoRvVBkm2cO1tD99fdQ34iUDyB6iecRdorm4=",
        "ref": "main",
-        "rev": "5fb08a462263e5a8d742ecd93e559e534d5c3af2",
-        "revCount": 586,
+        "rev": "ad6c79fb713884a4a2df8aab30914cd0c1c2e6cb",
+        "revCount": 587,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
      },
@@ -447,17 +447,17 @@
        "rust-overlay": "rust-overlay_4"
      },
      "locked": {
-        "lastModified": 1778600367,
-        "narHash": "sha256-YB0b2xUf4D8792D5Ay//7C3AjHyv+9yoy8K1mTe+wvE=",
+        "lastModified": 1782275838,
+        "narHash": "sha256-CW84hEFcypvEegQp+4zZZ4lCnPT7Qn27OpKiQBxiWS8=",
        "ref": "main",
-        "rev": "8e5f2849ff7c9616100fe928261512a7ad647939",
-        "revCount": 91,
+        "rev": "71d2b72c34352a79dbee8ebf23ce64f39aead692",
+        "revCount": 102,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
      },
      "original": {
        "ref": "main",
-        "rev": "8e5f2849ff7c9616100fe928261512a7ad647939",
+        "rev": "71d2b72c34352a79dbee8ebf23ce64f39aead692",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
      }
@@ -491,11 +491,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1777000482,
-        "narHash": "sha256-CZ5FKUSA8FCJf0h9GWdPJXoVVDL9H5yC74GkVc5ubIM=",
+        "lastModified": 1779333539,
+        "narHash": "sha256-lpmN2lrBDZDPjov2cbD3bOOJsI0fkKolKXasYPCqSys=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "403c09094a877e6c4816462d00b1a56ff8198e06",
+        "rev": "672fa5fc5608d5cd82286a6f69aaf84a40b4fe41",
        "type": "github"
      },
      "original": {
@@ -553,11 +553,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1777944972,
-        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
+        "lastModified": 1782165805,
+        "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
+        "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24",
        "type": "github"
      },
      "original": {
@@ -575,11 +575,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1773932847,
-        "narHash": "sha256-IklIAdlonrmO8/lkDxNIVz9+ORL4pcVotMTxeyvxzoc=",
+        "lastModified": 1780762731,
+        "narHash": "sha256-EuDaLnasWN0mpi995n+fAQQfPGBhqNW4fNjlQRpHt58=",
        "ref": "main",
-        "rev": "0871a319f51d3cb0d1abb5b11edb768b39906d3f",
-        "revCount": 104,
+        "rev": "931bd2d63e285e767c8c81c103dda3c0a63f2965",
+        "revCount": 108,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
      },
@@ -26,7 +26,7 @@
    worblehat.url = "git+https://git.pvv.ntnu.no/Projects/worblehat.git?ref=main";
    worblehat.inputs.nixpkgs.follows = "nixpkgs";

-    matrix-next.url = "github:dali99/nixos-matrix-modules/v0.8.0";
+    matrix-next.url = "github:dali99/nixos-matrix-modules/master";
    matrix-next.inputs.nixpkgs.follows = "nixpkgs";

    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git?ref=main";
@@ -35,7 +35,7 @@
    minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
    minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";

-    roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=8e5f2849ff7c9616100fe928261512a7ad647939";
+    roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=71d2b72c34352a79dbee8ebf23ce64f39aead692";
    roowho2.inputs.nixpkgs.follows = "nixpkgs";

    greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";
@@ -369,7 +369,12 @@
        //
        # Machines
        lib.genAttrs allMachines
-        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
+        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel.overrideAttrs (prev: {
+          passthru =
+            (prev.passthru or { })
+            // self.nixosConfigurations.${machine}.config.system.build
+            // { inherit (self.nixosConfigurations.${machine}) pkgs config; };
+        }))
        //
        # Nix-topology
        (let
@@ -16,6 +16,7 @@
  fileSystems."/" =
    { device = "/dev/sda1";
      fsType = "btrfs";
+      options = [ "relatime" ];
    };

  fileSystems."/boot" =
@@ -74,7 +74,7 @@ in {
        name = "psycopg2";
        args = {
          host = "/var/run/postgresql";
-          dbname = "synapse";
+          database = "synapse";
          user = "matrix-synapse";
          cp_min = 1;
          cp_max = 5;
@@ -43,7 +43,7 @@ in
        sshCommand = ''${pkgs.openssh}/bin/ssh -o UserKnownHostsFile='${knownHostsFile}' -i \"$CREDENTIALS_DIRECTORY\"/sshkey'';
      in [
        "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.minecraftLogsDir}'"
-        "${lib.getExe pkgs.rsync} ${rsyncArgs} --rsh=\"${sshCommand}\" root@innovation.pvv.ntnu.no:/ '${cfg.minecraftLogsDir}'/"
+        "${lib.getExe pkgs.rsync} ${rsyncArgs} --rsh=\"${sshCommand}\" root@innovation.pvv.ntnu.no:. '${cfg.minecraftLogsDir}'/"
      ];
    };
  };
@@ -127,4 +127,27 @@ in

  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
  networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
+
+  environment.systemPackages = [
+    (pkgs.writeShellApplication {
+      name = "postgres-update-collations.sh";
+      runtimeInputs = [
+        config.systemd.package
+        cfg.package
+      ];
+      text = ''
+        run0 --user=postgres psql <${pkgs.writeText "postgres-update-collations.sql" ''
+          CREATE FUNCTION exec(text) returns text language plpgsql volatile
+            AS $f$
+              BEGIN
+                EXECUTE $1;
+                RETURN $1;
+              END;
+          $f$;
+
+          SELECT exec('ALTER DATABASE "' || datname || '" REFRESH COLLATION VERSION') FROM pg_database WHERE datistemplate = false;
+        ''}
+      '';
+    })
+  ];
 }
@@ -16,6 +16,7 @@
  fileSystems."/" =
    { device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
      fsType = "ext4";
+      options = [ "relatime" ];
    };

  fileSystems."/boot" =
@@ -16,6 +16,7 @@
  fileSystems."/" =
    { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
      fsType = "ext4";
+      options = [ "relatime" ];
    };

  fileSystems."/boot" =
@@ -28,6 +28,7 @@
  fileSystems."/" = {
    device = "/dev/mapper/pool-root";
    fsType = "ext4";
+    options = [ "relatime" ];
  };

  fileSystems."/boot" = {
@@ -93,7 +93,7 @@ in {
          no-group = true;
          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
        };
-      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
+      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:. ${vanillaSurvival}";
      ExecStartPost = let
        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
          archive = true;
@@ -103,7 +103,7 @@ in {
          no-group = true;
          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
        };
-      in "${lib.getExe pkgs.rsync} ${rsyncArgs} --groupmap=root:nginx ${config.services.bluemap.webRoot}/ root@bekkalokk.pvv.ntnu.no:/";
+      in "${lib.getExe pkgs.rsync} ${rsyncArgs} --groupmap=root:nginx ${config.services.bluemap.webRoot}/ root@bekkalokk.pvv.ntnu.no:.";
      LoadCredential = [
        "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
        "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, values, ... }:

 let
  cfg = config.services.loki;
@@ -9,8 +9,8 @@ in {
    configuration = {
      auth_enabled = false;
      server = {
-        http_listen_port = 3100;
-        http_listen_address = "0.0.0.0";
+        http_listen_port = 31832;
+        http_listen_address = "127.0.0.1";
        grpc_listen_port = 9096;
      };

@@ -81,5 +81,25 @@ in {
    };
  };

-  networking.firewall.allowedTCPPorts = [ cfg.configuration.server.http_listen_port ];
+  services.nginx.virtualHosts."loki.pvv.ntnu.no" = {
+    forceSSL = true;
+    enableACME = true;
+    kTLS = true;
+
+    locations = {
+      "/".return = "403";
+      "/loki/api/v1/push" = {
+        proxyPass = "http://${cfg.configuration.server.http_listen_address}:${toString cfg.configuration.server.http_listen_port}/loki/api/v1/push";
+        extraConfig = ''
+          allow 127.0.0.1;
+          allow ::1;
+          allow ${values.ipv4-space};
+          allow ${values.ipv6-space};
+          allow ${values.ntnu.ipv4-space};
+          allow ${values.ntnu.ipv6-space};
+          deny all;
+        '';
+      };
+    };
+  };
 }
@@ -48,6 +48,7 @@

                # swap.swapfile.size = "4G";
                mountpoint = "/";
+                mountOptions = [ "relatime" ];
              };
            };

@@ -136,7 +136,7 @@ in {
      picture = {
        AVATAR_MAX_FILE_SIZE = 1024 * 1024 * 5;
        # NOTE: go any bigger than this, and gitea will freeze your gif >:(
-        AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 2;
+        AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 4;
      };
      actions.ENABLED = true;
      webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," [
@@ -16,6 +16,7 @@
  fileSystems."/" =
    { device = "/dev/disk/by-uuid/224c45db-9fdc-45d4-b3ad-aaf20b3efa8a";
      fsType = "ext4";
+      options = [ "relatime" ];
    };

  fileSystems."/boot" =
@@ -31,6 +31,7 @@
                type = "filesystem";
                format = "ext4";
                mountpoint = "/";
+                mountOptions = [ "relatime" ];
              };
            };
          };
@@ -16,6 +16,7 @@
  fileSystems."/" =
    { device = "/dev/disk/by-uuid/c3aed415-0054-4ac5-8d29-75a99cc26451";
      fsType = "btrfs";
+      options = [ "relatime" ];
    };

  fileSystems."/boot" =
@@ -1,4 +1,4 @@
-{ lib, values, ... }:
+{ lib, pkgs, values, ... }:
 let
  # See microbel:/etc/exports
  letters = [ "a" "b" "c" "d" "h" "i" "j" "k" "l" "m" "z" ];
@@ -6,6 +6,20 @@ in
 {
  systemd.targets."pvv-homedirs" = {
    description = "PVV Homedir Partitions";
+    requires = map (l: "pvv-homedir-create-uidmapped-bindmounts@${l}.service") letters;
+  };
+
+  systemd.tmpfiles.settings."10-pvv-homedirs" = {
+    "/run/pvvhome".d = {
+      user = "root";
+      group = "root";
+      mode = "0755";
+    };
+    "/run/pvvhome/by-uid".d = {
+      user = "root";
+      group = "root";
+      mode = "0755";
+    };
  };

  systemd.mounts = map (l: {
@@ -17,7 +31,7 @@ in

    type = "nfs";
    what = "homepvv${l}.pvv.ntnu.no:/export/home/pvv/${l}";
-    where = "/run/pvv-home-mounts/${l}";
+    where = "/run/pvvhome/${l}";

    options = lib.concatStringsSep "," [
      "nfsvers=3"
@@ -54,4 +68,49 @@ in
      "rw"
    ];
  }) letters;
+
+  systemd.services."pvv-homedir-create-uidmapped-bindmounts@" = {
+    bindsTo = [ "run-pvvhome-%i.mount" ];
+    after = [ "run-pvvhome-%i.mount" ];
+
+    serviceConfig = {
+      Type = "oneshot";
+    };
+
+    path = with pkgs; [
+      coreutils
+      systemdMinimal
+    ];
+
+    scriptArgs = "%i";
+    script = ''
+      for dir in "/run/pvvhome/$1"/*/; do
+          [[ -d "$dir" ]] || continue
+
+          uid="$(stat -c '%u' "$dir")"
+
+          mountpoint="/run/pvvhome/by-uid/$uid"
+          mkdir -p "$mountpoint"
+
+          unit_name=$(systemd-escape --path --suffix=mount "$mountpoint")
+
+          if systemctl --quiet is-active "$unit_name" ||
+             systemctl --quiet is-failed "$unit_name"; then
+              echo "Skipping existing mount unit: $unit_name"
+              continue
+          fi
+
+          systemd-mount \
+              --collect \
+              --fsck=no \
+              --type=none \
+              --options=bind \
+              --property=BindsTo=$(systemd-escape --path --suffix=mount "/run/pvvhome/$1") \
+              --property=After=$(systemd-escape --path --suffix=mount "/run/pvvhome/$1") \
+              "$dir" \
+              "$mountpoint" \
+         || echo "Failed mounting for uid $uid"
+      done
+    '';
+  };
 }
@@ -5,5 +5,6 @@
    ./mail.nix
    ./module.nix
    ./packages.nix
+    ./passwd-sync.nix
  ];
 }
@@ -20,7 +20,11 @@ in
    phpPackage = mcfg.php.env;
    phpOptions = mcfg.php.options;

-    enablePerl = true;
+    # NOTE: we include our own `mod_perl` in `extraModules` instead.
+    enablePerl = false;
+
+    # NOTE: we include `mod_userdir` in `extraModules` and configure this in `extraConfig` ourselves.
+    # enableUserDir = false;

    # TODO: mod_log_journald in v2.5
    extraModules = [
@@ -45,22 +49,9 @@ in

    logPerVirtualHost = false;

-    extraConfig = ''
+    extraConfig = lib.mkIf mcfg.debugMode ''
      TraceEnable on
      LogLevel warn rewrite:trace3
-
-      <FilesMatch ".+\.ph(p[3457]?|t|tml)$">
-          SetHandler application/x-httpd-php
-      </FilesMatch>
-      <FilesMatch ".+\.phps$">
-          SetHandler application/x-httpd-php-source
-          Require all denied
-      </FilesMatch>
-      <FilesMatch "\.pl$">
-          SetHandler modperl
-          PerlResponseHandler ModPerl::Registry
-          Options +ExecCGI
-      </FilesMatch>
    '';

    virtualHosts."temmie.pvv.ntnu.no" = {
@@ -72,15 +63,46 @@ in
      ];

      extraConfig = ''
+        <Directory "${pkgs.emptyDirectory}">
+          Require all denied
+          LogLevel authz_core:crit
+        </Directory>
+
        CustomLog "${cfg.logDir}/access.log" combined
        CustomLog "/run/httpd-log-processor-access.fifo" combined
        ErrorLog "/run/httpd-log-processor-error.fifo"
        ScriptLog "${cfg.logDir}/cgi.log"

        UserDir ${lib.concatMapStringsSep " " (l: "/home/pvv/${l}/*/web-docs") mcfg.homeLetters}
+
        UserDir disabled root
+        UserDir disabled pvv
+
        AddHandler cgi-script .cgi
-        DirectoryIndex index.html index.html.var index.php index.php3 index.cgi index.phtml index.shtml meg.html
+
+        DirectoryIndex ${lib.concatStringsSep " " [
+          "index.htm"
+          "index.html"
+          "index.html.var"
+
+          "index.shtml"
+          "index.xhtml"
+
+          "index.php"
+          "index.php3"
+          "index.php4"
+          "index.php5"
+          "index.php7"
+          "index.php8"
+          "index.pht"
+          "index.phtml"
+
+          "index.cgi"
+          "index.txt"
+
+          "meg.html"
+        ]}
+
        SetEnvIf Request_URI "^/~([^/]+)" USERDIR_USER=$1

        <Directory "/home/pvv/?/*/web-docs">
@@ -89,24 +111,66 @@ in
          Require all granted
        </Directory>

-        <DirectoryMatch "^/home/pvv/.*/web-docs/(${lib.concatStringsSep "|" [
+        ${lib.concatMapStringsSep "\n" (d: ''
+          <DirectoryMatch "/${d}(/|$)">
+            Require all denied
+          </DirectoryMatch>
+        '') [
          "\\.git"
          "\\.hg"
          "\\.svn"
          "\\.ssh"
-          "\\.env"
-          "\\.envrc"
          "\\.bzr"
          "\\.venv"
          "CVS"
          "RCS"
-          ".*\\.swp"
+
          ".*\\.bak"
-          ".*~"
-        ]})(/|$)">
-            AllowOverride All
+          ".*\\.bak.*"
+          ".*\\.bkp"
+          ".*\\.bkp.*"
+          ".*\\.backup"
+          ".*\\.backup.*"
+        ]}
+
+        ${lib.concatMapStringsSep "\n" (d: ''
+          <Files "${d}">
            Require all denied
-        </DirectoryMatch>
+          </Files>
+        '') [
+          ".env"
+          ".env.*"
+          ".envs"
+          ".envs.*"
+          ".envrc"
+
+          "*.swp"
+          "*~"
+
+          "*.bak"
+          "*.bak*"
+          "*.bkp"
+          "*.bkp*"
+          "*.backup"
+          "*.backup*"
+
+          "*.lck"
+          "*.lock"
+          "LCK..*"
+        ]}
+
+        <FilesMatch ".+\.ph(p[34578]?|t|tml)$">
+            SetHandler application/x-httpd-php
+        </FilesMatch>
+        <FilesMatch ".+\.phps$">
+            SetHandler application/x-httpd-php-source
+            Require all denied
+        </FilesMatch>
+        <FilesMatch "\.pl$">
+            SetHandler modperl
+            PerlResponseHandler ModPerl::Registry
+            Options +ExecCGI
+        </FilesMatch>
      '';
    };
  };
@@ -237,7 +301,7 @@ in
          "/share"
        ];
      });
-      BindPaths = (lib.mapCartesianProduct ({ directoryFn, letter }: "/run/pvv-home-mounts/${letter}:${directoryFn letter}${letter}") {
+      BindPaths = (lib.mapCartesianProduct ({ directoryFn, letter }: "/run/pvvhome/${letter}:${directoryFn letter}${letter}") {
        directoryFn = [
          (_: "/home/pvv/")
          (l: "/amd/homepvv${l}/")
@@ -3,11 +3,6 @@ let
  mcfg = config.services.pvv-userweb;
 in
 {
-  sops.secrets = {
-    "httpd/passwd-ssh-key" = { };
-    "httpd/ssh-known-hosts" = { };
-  };
-
  systemd.targets.sockets.wants = [
    "httpd-log-processor@access.socket"
    "httpd-log-processor@error.socket"
@@ -27,6 +22,9 @@ in

  systemd.services."httpd-log-processor@" = lib.mkIf config.services.httpd.enable {
    requiredBy = [ "userweb.target" ];
+    after = [ "httpd-passwd-sync.service" ];
+    requires = [ "httpd-passwd-sync.service" ];
+
    serviceConfig = {
      User = "wwwrun";
      Group = "wwwrun";
@@ -37,58 +35,20 @@ in
      StandardOutput = "journal";
      StandardError = "journal";

-      LoadCredential = [
-        "sshkey:${config.sops.secrets."httpd/passwd-ssh-key".path}"
-        "ssh-known-hosts:${config.sops.secrets."httpd/ssh-known-hosts".path}"
-      ];
-      ExecStartPre = let
-        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
-          archive = true;
-          verbose = true;
-          compress = true;
-          rsh = "${lib.getExe' pkgs.openssh "ssh"} -o BatchMode=yes -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
-        };
-        inputDir = "/run/httpd-log-processor-%i/pamunix-in";
-        outputDir = "/run/httpd-log-processor-%i/pamunix-out";
-      in lib.mkForce [
-        "${lib.getExe pkgs.rsync} ${rsyncArgs} pvv@smtp.pvv.ntnu.no:/etc/passwd ${inputDir}/"
-        "${lib.getExe pkgs.rsync} ${rsyncArgs} pvv@smtp.pvv.ntnu.no:/etc/group ${inputDir}/"
-
-        (let
-          args = lib.cli.toCommandLineShellGNU { } {
-            passwd-file = "${inputDir}/passwd";
-            group-file = "${inputDir}/group";
-            output-dir = outputDir;
-            shadow-file = pkgs.emptyFile;
-
-            output-passwd = true;
-
-            ignore-user-file = toString ./ignore_user_file.txt;
-            ignore-group-file = toString ./ignore_group_file.txt;
-          };
-        in ''${lib.getExe pkgs.passwd2systemd-users} ${args}'')
-        "${lib.getExe' pkgs.coreutils "shred"} -u ${inputDir}/passwd ${inputDir}/group"
-        ":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:0:System administrator:/root:/run/current-system/sw/bin/bash' ${outputDir}/passwd"
-        ":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:54:Apache httpd user:/var/empty:/run/current-system/sw/bin/bash' ${outputDir}/passwd"
-        ":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:' ${outputDir}/group"
-        ":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:' ${outputDir}/group"
-        "+${lib.getExe' pkgs.coreutils "chown"} root:root ${outputDir}/passwd ${outputDir}/group"
-        "+${lib.getExe' pkgs.coreutils "chmod"} 0644 ${outputDir}/passwd ${outputDir}/group"
-        "+${lib.getExe pkgs.mount} --bind ${outputDir}/passwd /etc/passwd"
-        "+${lib.getExe pkgs.mount} --bind ${outputDir}/group  /etc/group"
-      ];
-
      ExecStart = "${lib.getExe mcfg.apacheLogProcessorPackage} %i";

      AmbientCapabilities = [ "CAP_SETUID" "CAP_SETGID" ];
      CapabilityBoundingSet = [ "CAP_SETUID" "CAP_SETGID" ];
      DeviceAllow = [ "" ];
+      IPAddressDeny = "any";
      LockPersonality = true;
      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
      PrivateDevices = true;
      PrivateIPC = true;
+      PrivateNetwork = true;
      PrivateTmp = true;
-      # PrivateUsers = true;
+      PrivateUsers = false;
      ProcSubset = "pid";
      ProtectClock = true;
      ProtectControlGroups = true;
@@ -96,14 +56,11 @@ in
      ProtectHostname = true;
      ProtectKernelLogs = true;
      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
      ProtectProc = "invisible";
      ProtectSystem = "strict";
-      ProtectKernelTunables = true;
      RemoveIPC = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-      ];
+      RestrictAddressFamilies = [ "none" ];
      RestrictNamespaces = true;
      RestrictRealtime = true;
      RestrictSUIDSGID = true;
@@ -112,32 +69,21 @@ in
      SystemCallFilter = [
         "@system-service"
         "@setuid"
+         "~@resources"
      ];
      UMask = "0077";

-      IPAddressAllow = [
-        "127.0.0.53" # systemd-resolved
-        values.hosts.microbel.ipv4
-        values.hosts.microbel.ipv6
-      ];
-      IPAddressDeny = "any";
-
      RootDirectory = "/run/httpd-log-processor-%i/root-mnt";
      MountAPIVFS = true;

      RuntimeDirectoryMode = "0750";
-      RuntimeDirectory = [
-        "httpd-log-processor-%i/root-mnt"
-        "httpd-log-processor-%i/pamunix-in"
-        "httpd-log-processor-%i/pamunix-out"
-      ];
+      RuntimeDirectory = [ "httpd-log-processor-%i/root-mnt" ];
      BindReadOnlyPaths = [
        builtins.storeDir
        "/etc"
-        "/etc/resolv.conf"

-        "-/run/httpd-log-processor-%i/pamunix-out/passwd:/etc/passwd"
-        "-/run/httpd-log-processor-%i/pamunix-out/group:/etc/group"
+        "/var/lib/httpd-passwd-sync/passwd:/etc/passwd"
+        "/var/lib/httpd-passwd-sync/group:/etc/group"

        "${pkgs.writeText "userweb-fake-nsswitch.conf" ''
          passwd:    files
@@ -159,7 +105,7 @@ in
      ] ++ lib.optionals mcfg.debugMode [
        "/bin"
      ];
-      BindPaths = map (l: "/run/pvv-home-mounts/${l}:/home/pvv/${l}") mcfg.homeLetters ++ [
+      BindPaths = map (l: "/run/pvvhome/${l}:/home/pvv/${l}") mcfg.homeLetters ++ [
        "/var/log/httpd"
      ];
    };
@@ -4,7 +4,9 @@ let
 in
 {
  options.services.pvv-userweb = {
-    enable = lib.mkEnableOption "";
+    enable = lib.mkEnableOption "" // {
+      default = true;
+    };

    debugMode = lib.mkEnableOption "";

@@ -0,0 +1,147 @@
+{ config, lib, pkgs, values, ... }:
+let
+  mcfg = config.services.pvv-userweb;
+in
+{
+  config = lib.mkIf mcfg.enable {
+    sops.secrets = {
+      "httpd/passwd-ssh-key" = { };
+      "httpd/ssh-known-hosts" = { };
+    };
+
+    # NOTE: because we are running as `DynamicUser` and we want the result files to be available to
+    #       other services, this directory needs to be created via systemd-tmpfiles
+    systemd.tmpfiles.settings."10-httpd-passwd-sync"."/var/lib/httpd-passwd-sync".d = {
+      user = "root";
+      group = "root";
+      mode = "0700";
+    };
+
+    systemd.timers.httpd-passwd-sync = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "daily";
+        Persistent = true;
+        Unit = "httpd-passwd-sync.service";
+      };
+    };
+
+    systemd.services."httpd-passwd-sync" = {
+      requiredBy = [ "userweb.target" ];
+      after = [
+        "systemd-tmpfiles-setup.service"
+        "systemd-tmpfiles-resetup.service"
+      ];
+      serviceConfig = {
+        Type = "oneshot";
+        Slice = "system-userweb.slice";
+        Restart = "on-failure";
+        RestartSec = "3s";
+
+        DynamicUser = true;
+
+        LoadCredential = [
+          "sshkey:${config.sops.secrets."httpd/passwd-ssh-key".path}"
+          "ssh-known-hosts:${config.sops.secrets."httpd/ssh-known-hosts".path}"
+        ];
+        ExecStart = let
+          rsyncArgs = lib.cli.toCommandLineShellGNU { } {
+            verbose = true;
+            compress = true;
+            rsh = "${lib.getExe' pkgs.openssh "ssh"} -o BatchMode=yes -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
+          };
+          inputDir = "/run/httpd-passwd-sync/in";
+          wipDir = "/run/httpd-passwd-sync/wip";
+          outputDir = "/var/lib/httpd-passwd-sync";
+        in [
+          "${lib.getExe pkgs.rsync} ${rsyncArgs} pvv@smtp.pvv.ntnu.no:/etc/passwd ${inputDir}/"
+          "${lib.getExe pkgs.rsync} ${rsyncArgs} pvv@smtp.pvv.ntnu.no:/etc/group ${inputDir}/"
+
+          (let
+            args = lib.cli.toCommandLineShellGNU { } {
+              passwd-file = "${inputDir}/passwd";
+              group-file = "${inputDir}/group";
+              output-dir = wipDir;
+              shadow-file = pkgs.emptyFile;
+
+              output-passwd = true;
+
+              ignore-user-file = toString ./ignore_user_file.txt;
+              ignore-group-file = toString ./ignore_group_file.txt;
+            };
+          in ''${lib.getExe pkgs.passwd2systemd-users} ${args}'')
+
+          "${lib.getExe' pkgs.coreutils "shred"} -u ${inputDir}/passwd ${inputDir}/group"
+
+          ":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:0:System administrator:/root:/run/current-system/sw/bin/bash' ${wipDir}/passwd"
+          ":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:54:Apache httpd user:/var/empty:/run/current-system/sw/bin/bash' ${wipDir}/passwd"
+          ":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:' ${wipDir}/group"
+          ":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:' ${wipDir}/group"
+
+          "+${lib.getExe' pkgs.coreutils "install"} -m644 -o root -g root -t '${outputDir}' ${wipDir}/passwd ${wipDir}/group"
+          "${lib.getExe' pkgs.coreutils "shred"} -u ${wipDir}/passwd ${wipDir}/group"
+        ];
+
+        AmbientCapabilities = [ "" ];
+        CapabilityBoundingSet = [ "" ];
+        DeviceAllow = [ "" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = "tmpfs";
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ProtectKernelTunables = true;
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SocketBindDeny = "any";
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@resources"
+        ];
+        UMask = "0077";
+
+        IPAddressAllow = [
+          values.hosts.microbel.ipv4
+          values.hosts.microbel.ipv6
+        ];
+        IPAddressDeny = "any";
+
+        RootDirectory = "/run/httpd-passwd-sync/root-mnt";
+        MountAPIVFS = true;
+
+        RuntimeDirectoryMode = "0750";
+        RuntimeDirectory = [
+          "httpd-passwd-sync/root-mnt"
+          "httpd-passwd-sync/in"
+          "httpd-passwd-sync/wip"
+        ];
+
+        BindPaths = [
+          "/var/lib/httpd-passwd-sync"
+        ];
+        BindReadOnlyPaths = [
+          builtins.storeDir
+          "/etc"
+          "/var/run/nscd"
+        ];
+      };
+    };
+  };
+}
@@ -13,6 +13,7 @@
  fileSystems."/" =
    { device = "/dev/disk/by-uuid/4e8ecdd2-d453-4fff-b952-f06da00f3b85";
      fsType = "ext4";
+      options = [ "relatime" ];
    };

  swapDevices = [ {
Author	SHA1	Message	Date
h7x4	f4b1f090e4	flake.lock: bump various	2026-06-30 04:15:37 +09:00
h7x4	7c684e42f0	treewide: fix rsync <-> rrsync communication	2026-06-30 02:41:40 +09:00
h7x4	90bfda9066	kommode/gitea: bump `AVATAR_MAX_ORIGIN_SIZE` from 2MB to 4MB	2026-06-24 14:33:20 +09:00
h7x4	522d8f18cb	flake.{nix,lock}: bump roowho2	2026-06-24 13:38:03 +09:00
h7x4	5e613a03fc	treewide: set `relatime` for most root mounts	2026-06-23 01:12:16 +09:00
h7x4	170fb2a980	bicep/synapse: fix `dbname` option	2026-06-22 18:55:14 +09:00
h7x4	3e627472e9	flake.{nix,lock}: bump matrix-next	2026-06-22 18:55:13 +09:00
Adrian G L	e05c4ed8ca	feat: add initialdeploy hashed password to root	2026-06-21 18:24:01 +02:00
h7x4	3fee83ec05	ildkule/loki: restrict incoming connections to pvv + ntnu	2026-06-22 01:23:16 +09:00
h7x4	a1f02fc39d	{ildkule/loki,base/fluentbit}: send data over https	2026-06-22 01:23:16 +09:00
Adrian G L	6e37635aac	ildkule/loki: firewall all endpoints except push API Co-authored-by: Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>	2026-06-22 01:23:14 +09:00
h7x4	cdc3ad488b	bicep/postgres: add script for updating all collations	2026-06-22 01:12:59 +09:00
h7x4	aa2712005a	temmie/nfs-mounts: create by-uid bindmounts	2026-06-17 13:43:19 +09:00
h7x4	89921b533b	temmie/userweb: further harden log-processor	2026-06-17 12:31:02 +09:00
h7x4	75f87ffab8	temmie/userweb: run passwd sync in different unit	2026-06-17 12:15:23 +09:00
h7x4	b910cf9563	temmie/userweb: suppress erroneous access log for `documentRoot`	2026-06-17 08:57:55 +09:00
h7x4	d23adbd4c2	temmie/userweb: deny access to `documentRoot`	2026-06-17 08:49:44 +09:00
h7x4	48c0a4e504	temmie/userweb: fix directory denylist enforcement	2026-06-17 08:23:08 +09:00
h7x4	374d9b1bc7	flake.nix: passthru machine `config`, `pkgs` and `config.system.build` This shortens down the path needed to build both overlayed packages and all the other machine derivations. Here are some examples: ``` nix build .#machine.etc nix build '.#machine.units."nginx.service".unit' nix build .#machine.pkgs.overlayed-package nix build .#machine.config.services.nginx.package ```	2026-06-17 08:10:17 +09:00
h7x4	d84cc73819	temmie/userweb: handle more `.php\d` suffixes	2026-06-16 19:07:58 +09:00
h7x4	b738f08c09	temmie/userweb: render path denylist into `Directory`/`Files` directives	2026-06-16 19:07:57 +09:00
h7x4	8252bba3ad	temmie/userweb: enable httpd trace on `debugMode`	2026-06-16 19:07:57 +09:00
h7x4	a776a5a5fe	temmie/userweb: explicitly override `mod_perl` and `mod_userdir`	2026-06-16 19:07:57 +09:00
h7x4	ed57744ec3	temmie/userweb: add more patterns to denylist	2026-06-16 16:07:32 +09:00
h7x4	226db1f46e	temmie/userweb: add more `DirectoryIndex` variants	2026-06-16 16:07:32 +09:00
h7x4	51e1656177	temmie/userweb: disable `~pvv`	2026-06-16 15:53:52 +09:00