WIP: Move krb5 realm to pvv.local, make sane ldap structure

WIP: set up heimdal-openldap-sasl stack
hosts/dagali: init
2026-01-12 18:38:23 +01:00 · 2025-03-11 14:14:07 +01:00 · 2025-03-11 14:14:07 +01:00 · 2025-03-11 14:14:02 +01:00 · 2025-03-10 20:06:29 +01:00 · 2025-03-10 19:59:16 +01:00
45 changed files with 1044 additions and 865 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -13,7 +13,7 @@ keys:
  - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
  - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
  - &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
-  - &host_kvernberg age19rlntxt0m27waa0n288g9wgpksa6ndlzz8eneeqya7w3zd7may0sqzhcvz
+  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8

 creation_rules:
  # Global secrets
@@ -80,8 +80,14 @@ creation_rules:
      pgp:
      - *user_oysteikt

-  - path_regex: secrets/kvernberg/[^/]+$
+  - path_regex: secrets/ustetind/[^/]+\.yaml$
    key_groups:
    - age:
-          - *host_kvernberg
+      - *host_ustetind
      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      pgp:
+      - *user_oysteikt
--- a/base/networking.nix
+++ b/base/networking.nix
@@ -3,6 +3,10 @@
  systemd.network.enable = true;
  networking.domain = "pvv.ntnu.no";
  networking.useDHCP = false;
+  # networking.search = [ "pvv.ntnu.no" "pvv.org" ];
+  # networking.nameservers = lib.mkDefault [ "129.241.0.200" "129.241.0.201" ];
+  # networking.tempAddresses = lib.mkDefault "disabled";
+  # networking.defaultGateway = values.hosts.gateway;

  # The rest of the networking configuration is usually sourced from /values.nix

--- a/base/services/auto-upgrade.nix
+++ b/base/services/auto-upgrade.nix
@@ -2,12 +2,12 @@
 {
  system.autoUpgrade = {
    enable = true;
-    flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git?ref=pvvvvv";
+    flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
    flags = [
      # --update-input is deprecated since nix 2.22, and removed in lix 2.90
      # https://git.lix.systems/lix-project/lix/issues/400
      "--refresh"
-      "--override-input" "nixpkgs" "github:NixOS/nixpkgs/refs/pull/332699/merge"
+      "--override-input" "nixpkgs" "github:nixos/nixpkgs/nixos-24.11-small"
      "--override-input" "nixpkgs-unstable" "github:nixos/nixpkgs/nixos-unstable-small"
      "--no-write-lock-file"
    ];
--- a/base/services/logrotate.nix
+++ b/base/services/logrotate.nix
@@ -1,41 +1,8 @@
 { ... }:
 {
-  # source: https://github.com/logrotate/logrotate/blob/main/examples/logrotate.service
  systemd.services.logrotate = {
    documentation = [ "man:logrotate(8)" "man:logrotate.conf(5)" ];
    unitConfig.RequiresMountsFor = "/var/log";
-    serviceConfig = {
-      Nice = 19;
-      IOSchedulingClass = "best-effort";
-      IOSchedulingPriority = 7;
-
-      ReadWritePaths = [ "/var/log" ];
-
-      AmbientCapabilities = [ "" ];
-      CapabilityBoundingSet = [ "" ];
-      DeviceAllow = [ "" ];
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      NoNewPrivileges = true; # disable for third party rotate scripts
-      PrivateDevices = true;
-      PrivateNetwork = true; # disable for mail delivery
-      PrivateTmp = true;
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true; # disable for userdir logs
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "full";
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      SocketBindDeny = [ "any" ];
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-      ];
-    };
+    serviceConfig.ReadWritePaths = [ "/var/log" ];
  };
 }
--- a/base/services/nginx.nix
+++ b/base/services/nginx.nix
@@ -33,6 +33,10 @@

  systemd.services.nginx.serviceConfig = lib.mkIf config.services.nginx.enable {
    LimitNOFILE = 65536;
+    # We use jit my dudes
+    MemoryDenyWriteExecute = lib.mkForce false;
+    # What the fuck do we use that where the defaults are not enough???
+    SystemCallFilter = lib.mkForce null;
  };

  services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
--- a/base/services/smartd.nix
+++ b/base/services/smartd.nix
@@ -1,8 +1,20 @@
 { config, pkgs, lib, ... }:
 {
-  services.smartd.enable = lib.mkDefault true;
+  services.smartd = {
+    enable = lib.mkDefault true;
+    notifications = {
+      mail = {
+        enable = true;
+        sender = "root@pvv.ntnu.no";
+        recipient = "root@pvv.ntnu.no";
+      };
+      wall.enable = false;
+    };
+  };

  environment.systemPackages = lib.optionals config.services.smartd.enable (with pkgs; [
    smartmontools
  ]);
+
+  systemd.services.smartd.unitConfig.ConditionVirtualization = "no";
 }
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1731746438,
-        "narHash": "sha256-f3SSp1axoOk0NAI7oFdRzbxG2XPBSIXC+/DaAXnvS1A=",
+        "lastModified": 1740485968,
+        "narHash": "sha256-WK+PZHbfDjLyveXAxpnrfagiFgZWaTJglewBWniTn2Y=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "cb64993826fa7a477490be6ccb38ba1fa1e18fa8",
+        "rev": "19c1140419c4f1cdf88ad4c1cfb6605597628940",
        "type": "github"
      },
      "original": {
@@ -20,6 +20,26 @@
        "type": "github"
      }
    },
+    "gergle": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1736621371,
+        "narHash": "sha256-45UIQSQA7R5iU4YWvilo7mQbhY1Liql9bHBvYa3qRI0=",
+        "ref": "refs/heads/main",
+        "rev": "3729796c1213fe76e568ac28f1df8de4e596950b",
+        "revCount": 20,
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
+      }
+    },
    "greg-ng": {
      "inputs": {
        "nixpkgs": [
@@ -28,17 +48,17 @@
        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1730249639,
-        "narHash": "sha256-G3URSlqCcb+GIvGyki+HHrDM5ZanX/dP9BtppD/SdfI=",
+        "lastModified": 1736545379,
+        "narHash": "sha256-PeTTmGumdOX3rd6OKI7QMCrZovCDkrckZbcHr+znxWA=",
        "ref": "refs/heads/main",
-        "rev": "80e0447bcb79adad4f459ada5610f3eae987b4e3",
-        "revCount": 34,
+        "rev": "74f5316121776db2769385927ec0d0c2cc2b23e4",
+        "revCount": 42,
        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/greg-ng.git"
+        "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
      },
      "original": {
        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/greg-ng.git"
+        "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
      }
    },
    "grzegorz-clients": {
@@ -48,17 +68,17 @@
        ]
      },
      "locked": {
-        "lastModified": 1726861934,
-        "narHash": "sha256-lOzPDwktd+pwszUTbpUdQg6iCzInS11fHLfkjmnvJrM=",
+        "lastModified": 1736178795,
+        "narHash": "sha256-mPdi8cgvIDYcgG3FRG7A4BOIMu2Jef96TPMnV00uXlM=",
        "ref": "refs/heads/master",
-        "rev": "546d921ec46735dbf876e36f4af8df1064d09432",
-        "revCount": 78,
+        "rev": "fde738910de1fd8293535a6382c2f0c2749dd7c1",
+        "revCount": 79,
        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/grzegorz-clients.git"
+        "url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
      },
      "original": {
        "type": "git",
-        "url": "https://git.pvv.ntnu.no/Projects/grzegorz-clients.git"
+        "url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
      }
    },
    "matrix-next": {
@@ -104,11 +124,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1714416973,
-        "narHash": "sha256-aZUcvXjdETUC6wVQpWDVjLUzwpDAEca8yR0ITDeK39o=",
+        "lastModified": 1736531400,
+        "narHash": "sha256-+X/HVI1AwoPcud28wI35XRrc1kDgkYdDUGABJBAkxDI=",
        "ref": "refs/heads/main",
-        "rev": "2b23c0ba8aae68d3cb6789f0f6e4891cef26cc6d",
-        "revCount": 6,
+        "rev": "e4dafd06b3d7e9e6e07617766e9c3743134571b7",
+        "revCount": 7,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
      },
@@ -119,43 +139,27 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1731779898,
-        "narHash": "sha256-oxxCrYZM0WNRoaokDyVXcPIlTc8Z2yX4QjKbgXGI3IM=",
+        "lastModified": 1740782485,
+        "narHash": "sha256-GkDJDqHYlPKZFdyxzZHtljxNRsosKB1GCrblqlvLFgo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9972661139e27eed0237df4dde34839e09028cd5",
+        "rev": "dd5c2540983641bbaabdfc665931592d4c9989e8",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "refs/pull/332699/merge",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-stable": {
-      "locked": {
-        "lastModified": 1730602179,
-        "narHash": "sha256-efgLzQAWSzJuCLiCaQUCDu4NudNlHdg2NzGLX5GYaEY=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "3c2f1c4ca372622cb2f9de8016c9a0b1cbd0f37c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "release-24.05",
+        "ref": "nixos-24.11-small",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1731745710,
-        "narHash": "sha256-SVeiClbgqL071JpAspOu0gCkPSAL51kSIRwo4C/pghA=",
+        "lastModified": 1740848276,
+        "narHash": "sha256-bYeI3FEs824X+MJYksKboNlmglehzplqzn+XvcojWMc=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "dfaa4cb76c2d450d8f396bb6b9f43cede3ade129",
+        "rev": "e9b0ff70ddc61c42548501b0fafb86bb49cca858",
        "type": "github"
      },
      "original": {
@@ -192,11 +196,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1725212759,
+        "lastModified": 1737151758,
        "narHash": "sha256-yZBsefIarFUEhFRj+rCGMp9Zvag3MCafqV/JfGVRVwc=",
        "ref": "refs/heads/master",
-        "rev": "e7b66b4bc6a89bab74bac45b87e9434f5165355f",
-        "revCount": 473,
+        "rev": "a4ebe6ded0c8c124561a41cb329ff30891914b5e",
+        "revCount": 475,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
      },
@@ -208,6 +212,7 @@
    "root": {
      "inputs": {
        "disko": "disko",
+        "gergle": "gergle",
        "greg-ng": "greg-ng",
        "grzegorz-clients": "grzegorz-clients",
        "matrix-next": "matrix-next",
@@ -245,15 +250,14 @@
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
-        ],
-        "nixpkgs-stable": "nixpkgs-stable"
+        ]
      },
      "locked": {
-        "lastModified": 1731748189,
-        "narHash": "sha256-Zd/Uukvpcu26M6YGhpbsgqm6LUSLz+Q8mDZ5LOEGdiE=",
+        "lastModified": 1739262228,
+        "narHash": "sha256-7JAGezJ0Dn5qIyA2+T4Dt/xQgAbhCglh6lzCekTVMeU=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "d2bd7f433b28db6bc7ae03d5eca43564da0af054",
+        "rev": "07af005bb7d60c7f118d9d9f5530485da5d1e975",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,7 @@
  description = "PVV System flake";

  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/refs/pull/332699/merge"; # remember to also update the url in base/services/auto-upgrade.nix
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11-small"; # remember to also update the url in base/services/auto-upgrade.nix
    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";

    sops-nix.url = "github:Mic92/sops-nix";
@@ -23,9 +23,11 @@
    nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git";
    nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";

-    greg-ng.url = "git+https://git.pvv.ntnu.no/Projects/greg-ng.git";
+    greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git";
    greg-ng.inputs.nixpkgs.follows = "nixpkgs";
-    grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Projects/grzegorz-clients.git";
+    gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git";
+    gergle.inputs.nixpkgs.follows = "nixpkgs";
+    grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git";
    grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";

    minecraft-data.url = "git+https://git.pvv.ntnu.no/Drift/minecraft-data.git";
@@ -33,13 +35,13 @@

  outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
  let
-    nixlib = nixpkgs.lib;
+    inherit (nixpkgs) lib;
    systems = [
      "x86_64-linux"
      "aarch64-linux"
      "aarch64-darwin"
    ];
-    forAllSystems = f: nixlib.genAttrs systems f;
+    forAllSystems = f: lib.genAttrs systems f;
    allMachines = builtins.attrNames self.nixosConfigurations;
    importantMachines = [
      "bekkalokk"
@@ -49,11 +51,11 @@
      "ildkule"
    ];
  in {
-    inherit inputs;
+    inputs = lib.mapAttrs (_: src: src.outPath) inputs;

    nixosConfigurations = let
      unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
-      nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
+      nixosConfig = nixpkgs: name: config: lib.nixosSystem (lib.recursiveUpdate
        rec {
          system = "x86_64-linux";
          specialArgs = {
@@ -115,30 +117,36 @@
      #ildkule-unstable = unstableNixosConfig "ildkule" { };
      shark = stableNixosConfig "shark" { };

+      ustetind = stableNixosConfig "ustetind" {
+        modules = [
+         "${nixpkgs}/nixos/modules/virtualisation/lxc-container.nix"
+        ];
+      };
+
      brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
        modules = [
          inputs.grzegorz-clients.nixosModules.grzegorz-webui
+          inputs.gergle.nixosModules.default
          inputs.greg-ng.nixosModules.default
        ];
        overlays = [
          inputs.greg-ng.overlays.default
+          inputs.gergle.overlays.default
        ];
      };
      georg = stableNixosConfig "georg" {
        modules = [
          inputs.grzegorz-clients.nixosModules.grzegorz-webui
+          inputs.gergle.nixosModules.default
          inputs.greg-ng.nixosModules.default
        ];
        overlays = [
          inputs.greg-ng.overlays.default
+          inputs.gergle.overlays.default
        ];
      };
-      kvernberg = stableNixosConfig "kvernberg" {
-        modules = [
-          disko.nixosModules.disko
-          { disko.devices.disk.disk1.device = "/dev/sda"; }
-        ];
-      };
+
+      dagali = unstableNixosConfig "dagali" { };
    };

    nixosModules = {
@@ -156,19 +164,19 @@
      in rec {
        default = important-machines;
        important-machines = pkgs.linkFarm "important-machines"
-          (nixlib.getAttrs importantMachines self.packages.x86_64-linux);
+          (lib.getAttrs importantMachines self.packages.x86_64-linux);
        all-machines = pkgs.linkFarm "all-machines"
-          (nixlib.getAttrs allMachines self.packages.x86_64-linux);
+          (lib.getAttrs allMachines self.packages.x86_64-linux);

        simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };

      } //
-      (nixlib.pipe null [
+      (lib.pipe null [
        (_: pkgs.callPackage ./packages/mediawiki-extensions { })
-        (nixlib.flip builtins.removeAttrs ["override" "overrideDerivation"])
-        (nixlib.mapAttrs' (name: nixlib.nameValuePair "mediawiki-${name}"))
+        (lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
+        (lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
      ])
-      // nixlib.genAttrs allMachines
+      // lib.genAttrs allMachines
        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
    };
  };
--- a/hosts/bekkalokk/services/bluemap/default.nix
+++ b/hosts/bekkalokk/services/bluemap/default.nix
@@ -6,13 +6,15 @@ in {
    ./module.nix # From danio, pending upstreaming
  ];

-  disabledModules = [ "services/web-servers/bluemap.nix" ];
+  disabledModules = [ "services/web-apps/bluemap.nix" ];

  sops.secrets."bluemap/ssh-key" = { };
  sops.secrets."bluemap/ssh-known-hosts" = { };

  services.bluemap = {
    enable = true;
+    package = pkgs.callPackage ./package.nix { };
+    
    eula = true;
    onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade

--- a/hosts/bekkalokk/services/bluemap/module.nix
+++ b/hosts/bekkalokk/services/bluemap/module.nix
@@ -26,7 +26,6 @@ let
    "webapp.conf" = webappConfig;
    "webserver.conf" = webserverConfig;
    "packs" = cfg.resourcepacks;
-    "addons" = cfg.resourcepacks; # TODO
  };

  renderConfigFolder = name: value: pkgs.linkFarm "bluemap-${name}-config" {
@@ -38,13 +37,13 @@ let
    "webapp.conf" = format.generate "webapp.conf" (cfg.webappSettings // { "update-settings-file" = false; });
    "webserver.conf" = webserverConfig;
    "packs" = value.resourcepacks;
-    "addons" = cfg.resourcepacks; # TODO
  };

  inherit (lib) mkOption;
 in {
  options.services.bluemap = {
    enable = lib.mkEnableOption "bluemap";
+    package = lib.mkPackageOption pkgs "bluemap" { };

    eula = mkOption {
      type = lib.types.bool;
@@ -159,7 +158,7 @@ in {
            type = lib.types.path;
            default = cfg.resourcepacks;
            defaultText = lib.literalExpression "config.services.bluemap.resourcepacks";
-            description = "A set of resourcepacks/mods to extract models from loaded in alphabetical order";
+            description = "A set of resourcepacks/mods/bluemap-addons to extract models from loaded in alphabetical order";
          };
          settings = mkOption {
            type = (lib.types.submodule {
@@ -310,9 +309,18 @@ in {
        Group = "nginx";
        UMask = "026";
      };
-      script = lib.strings.concatStringsSep "\n" ((lib.attrsets.mapAttrsToList
-        (name: value: "${lib.getExe pkgs.bluemap} -c ${renderConfigFolder name value} -r")
-        cfg.maps) ++ [ "${lib.getExe pkgs.bluemap} -c ${webappConfigFolder} -gs" ]);
+      script = ''
+        # If web folder doesnt exist generate it
+        test -f "${cfg.webRoot}" || ${lib.getExe cfg.package} -c ${webappConfigFolder} -gs
+
+        # Render each minecraft map
+        ${lib.strings.concatStringsSep "\n" (lib.attrsets.mapAttrsToList
+          (name: value: "${lib.getExe cfg.package} -c ${renderConfigFolder name value} -r")
+          cfg.maps)}
+
+        # Generate updated webapp
+        ${lib.getExe cfg.package} -c ${webappConfigFolder} -gs
+      '';
    };

    systemd.timers."render-bluemap-maps" = lib.mkIf cfg.enableRender {
--- a/hosts/bekkalokk/services/bluemap/package.nix
+++ b/hosts/bekkalokk/services/bluemap/package.nix
@@ -0,0 +1,30 @@
+{ lib, stdenvNoCC, fetchurl, makeWrapper, jre }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "bluemap";
+  version = "5.7";
+
+  src = fetchurl {
+    url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
+    hash = "sha256-8udZYJgrr4bi2mjRYrASd8JwUoUVZW1tZpOLRgafAIw=";
+  };
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+    makeWrapper ${jre}/bin/java $out/bin/bluemap --add-flags "-jar $src"
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "3D minecraft map renderer";
+    homepage = "https://bluemap.bluecolored.de/";
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dandellion h7x4 ];
+    mainProgram = "bluemap";
+  };
+}
--- a/hosts/bekkalokk/services/gitea/customization.nix
+++ b/hosts/bekkalokk/services/gitea/customization.nix
@@ -0,0 +1,52 @@
+{ config, pkgs, lib, fp, ... }:
+let
+  cfg = config.services.gitea;
+in
+{
+  services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
+
+  systemd.services.gitea-customization = lib.mkIf cfg.enable {
+    description = "Install extra customization in gitea's CUSTOM_DIR";
+    wantedBy = [ "gitea.service" ];
+    requiredBy = [ "gitea.service" ];
+
+    serviceConfig =  {
+      Type = "oneshot";
+      User = cfg.user;
+      Group = cfg.group;
+    };
+
+    script = let
+      logo-svg = fp /assets/logo_blue_regular.svg;
+      logo-png = fp /assets/logo_blue_regular.png;
+      extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
+        <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
+        <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
+        <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
+      '';
+
+      project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
+        labels = lib.importJSON ./labels/projects.json;
+      };
+
+      customTemplates = pkgs.runCommandLocal "gitea-templates" {
+        nativeBuildInputs = with pkgs; [
+          coreutils
+          gnused
+        ];
+      } ''
+        # Bigger icons
+        install -Dm444 "${cfg.package.src}/templates/repo/icon.tmpl" "$out/repo/icon.tmpl"
+        sed -i -e 's/24/48/g' "$out/repo/icon.tmpl"
+      '';
+    in ''
+      install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
+      install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
+      install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
+      install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
+      install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml
+
+      "${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
+    '';
+  };
+}
--- a/hosts/bekkalokk/services/gitea/default.nix
+++ b/hosts/bekkalokk/services/gitea/default.nix
@@ -1,11 +1,12 @@
-{ config, values, fp, pkgs, lib, ... }:
+{ config, values, lib, ... }:
 let
  cfg = config.services.gitea;
  domain = "git.pvv.ntnu.no";
  sshPort  = 2222;
 in {
  imports = [
-    ./ci.nix
+    ./customization.nix
+    ./gpg.nix
    ./import-users
    ./web-secret-provider
  ];
@@ -130,6 +131,11 @@ in {
      };
      "ui.meta".DESCRIPTION = "Bokstavelig talt programvareverkstedet";
    };
+
+    dump = {
+      enable = true;
+      type = "tar.gz";
+    };
  };

  environment.systemPackages = [ cfg.package ];
@@ -156,35 +162,4 @@ in {
  };

  networking.firewall.allowedTCPPorts = [ sshPort ];
-
-  # Extra customization
-
-  services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
-
-  systemd.services.install-gitea-customization = {
-    description = "Install extra customization in gitea's CUSTOM_DIR";
-    wantedBy = [ "gitea.service" ];
-    requiredBy = [ "gitea.service" ];
-
-    serviceConfig =  {
-      Type = "oneshot";
-      User = cfg.user;
-      Group = cfg.group;
-    };
-
-    script = let
-      logo-svg = fp /assets/logo_blue_regular.svg;
-      logo-png = fp /assets/logo_blue_regular.png;
-      extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
-        <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
-        <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
-        <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
-      '';
-    in ''
-      install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
-      install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
-      install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
-      install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
-    '';
-  };
 }
--- a/hosts/bekkalokk/services/gitea/gpg.nix
+++ b/hosts/bekkalokk/services/gitea/gpg.nix
@@ -0,0 +1,38 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.gitea;
+  GNUPGHOME = "${config.users.users.gitea.home}/gnupg";
+in
+{
+  sops.secrets."gitea/gpg-signing-key" = {
+    owner = cfg.user;
+    inherit (cfg) group;
+  };
+
+  systemd.services.gitea.environment = { inherit GNUPGHOME; };
+
+  systemd.tmpfiles.settings."20-gitea-gnugpg".${GNUPGHOME}.d = {
+    inherit (cfg) user group;
+    mode = "700";
+  };
+
+  systemd.services.gitea-ensure-gnupg-homedir = {
+    description = "Import gpg key for gitea";
+    environment = { inherit GNUPGHOME; };
+    serviceConfig = {
+      Type = "oneshot";
+      User = cfg.user;
+      PrivateNetwork = true;
+    };
+    script = ''
+      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key".path}
+    '';
+  };
+
+  services.gitea.settings."repository.signing" = {
+    SIGNING_KEY = "0549C43374D2253C";
+    SIGNING_NAME = "PVV Git";
+    SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
+    INITIAL_COMMIT = "always";
+  };
+}
--- a/hosts/bekkalokk/services/gitea/import-users/gitea-import-users.py
+++ b/hosts/bekkalokk/services/gitea/import-users/gitea-import-users.py
@@ -177,6 +177,7 @@ def ensure_gitea_user_is_part_of_team(
 # List of teams that all users should be part of by default
 COMMON_USER_TEAMS = [
    ("Projects", "Members"),
+    ("Grzegorz", "Members"),
    ("Kurs", "Members"),
 ]

--- a/hosts/bekkalokk/services/gitea/labels/projects.json
+++ b/hosts/bekkalokk/services/gitea/labels/projects.json
@@ -0,0 +1,116 @@
+[
+  {
+    "name": "art",
+    "exclusive": false,
+    "color": "#006b75",
+    "description": "Requires some creativity"
+  },
+  {
+    "name": "big",
+    "exclusive": false,
+    "color": "#754bc4",
+    "description": "This is gonna take a while"
+  },
+  {
+    "name": "blocked",
+    "exclusive": false,
+    "color": "#850021",
+    "description": "This issue/PR depends on one or more other issues/PRs"
+  },
+  {
+    "name": "bug",
+    "exclusive": false,
+    "color": "#f05048",
+    "description": "Something brokey"
+  },
+  {
+    "name": "ci-cd",
+    "exclusive": false,
+    "color": "#d1ff78",
+    "description": "Continuous integrals and continuous derivation"
+  },
+  {
+    "name": "crash report",
+    "exclusive": false,
+    "color": "#ed1111",
+    "description": "Report an oopsie"
+  },
+  {
+    "name": "disputed",
+    "exclusive": false,
+    "color": "#5319e7",
+    "description": "Kranglefanter"
+  },
+  {
+    "name": "documentation",
+    "exclusive": false,
+    "color": "#fbca04",
+    "description": "Documentation changes required"
+  },
+  {
+    "name": "duplicate",
+    "exclusive": false,
+    "color": "#cccccc",
+    "description": "This issue or pull request already exists"
+  },
+  {
+    "name": "feature request",
+    "exclusive": false,
+    "color": "#0052cc",
+    "description": ""
+  },
+  {
+    "name": "good first issue",
+    "exclusive": false,
+    "color": "#009800",
+    "description": "Get your hands dirty with a new project here"
+  },
+  {
+    "name": "me gusta",
+    "exclusive": false,
+    "color": "#30ff36",
+    "description": "( ͡° ͜ʖ ͡°)"
+  },
+  {
+    "name": "packaging",
+    "exclusive": false,
+    "color": "#bf642b",
+    "description": ""
+  },
+  {
+    "name": "question",
+    "exclusive": false,
+    "color": "#cc317c",
+    "description": ""
+  },
+  {
+    "name": "security",
+    "exclusive": false,
+    "color": "#ed1111",
+    "description": "Skommel"
+  },
+  {
+    "name": "techdebt spring cleaning",
+    "exclusive": false,
+    "color": "#8c6217",
+    "description": "The code is smelly 👃"
+  },
+  {
+    "name": "testing",
+    "exclusive": false,
+    "color": "#52b373",
+    "description": "Poke it and see if it explodes"
+  },
+  {
+    "name": "ui/ux",
+    "exclusive": false,
+    "color": "#f28852",
+    "description": "User complaints about ergonomics and economics and whatever"
+  },
+  {
+    "name": "wontfix",
+    "exclusive": false,
+    "color": "#ffffff",
+    "description": "Nei, vil ikke"
+  }
+]
--- a/hosts/bekkalokk/services/gitea/web-secret-provider/default.nix
+++ b/hosts/bekkalokk/services/gitea/web-secret-provider/default.nix
@@ -3,6 +3,7 @@ let
  organizations = [
    "Drift"
    "Projects"
+    "Grzegorz"
    "Kurs"
  ];

@@ -27,6 +28,7 @@ in
  users.users."gitea-web" = {
    group = "gitea-web";
    isSystemUser = true;
+    shell = pkgs.bash;
  };

  sops.secrets."gitea/web-secret-provider/token" = {
@@ -58,6 +60,7 @@ in
          key-dir = "/var/lib/gitea-web/keys/%i";
          authorized-keys-path = "/var/lib/gitea-web/authorized_keys.d/%i";
          rrsync-script = pkgs.writeShellScript "rrsync-chown" ''
+            mkdir -p "$1"
            ${lib.getExe pkgs.rrsync} -wo "$1"
            ${pkgs.coreutils}/bin/chown -R gitea-web:gitea-web "$1"
          '';
--- a/hosts/bekkalokk/services/gitea/web-secret-provider/gitea-web-secret-provider.py
+++ b/hosts/bekkalokk/services/gitea/web-secret-provider/gitea-web-secret-provider.py
@@ -34,7 +34,21 @@ def get_org_repo_list(args: argparse.Namespace, token: str):
        f"{args.api_url}/orgs/{args.org}/repos",
        headers = { 'Authorization': 'token ' + token },
    )
-    return [repo["name"] for repo in result.json()]
+
+    results = [repo["name"] for repo in result.json()]
+    target = int(result.headers['X-Total-Count'])
+
+    i = 2
+    while len(results) < target:
+        result = requests.get(
+            f"{args.api_url}/orgs/{args.org}/repos",
+            params = { 'page': i },
+            headers = { 'Authorization': 'token ' + token },
+        )
+        results += [repo["name"] for repo in result.json()]
+        i += 1
+
+    return results


 def generate_ssh_key(args: argparse.Namespace, repository: str):
--- a/hosts/bekkalokk/services/vaultwarden.nix
+++ b/hosts/bekkalokk/services/vaultwarden.nix
@@ -83,7 +83,6 @@ in {
      ProtectKernelLogs = true;
      ProtectKernelModules = true;
      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
      RestrictAddressFamilies = [
        "AF_INET"
        "AF_INET6"
@@ -98,7 +97,6 @@ in {
        "@system-service"
        "~@privileged"
      ];
-      UMask = "0007";
    };
  };
 }
--- a/hosts/bekkalokk/services/webmail/roundcube.nix
+++ b/hosts/bekkalokk/services/webmail/roundcube.nix
@@ -21,7 +21,7 @@ in
      custom_from
    ]);

-    dicts = with pkgs.aspellDicts; [ en en-science en-computers nb nn fr de it ];
+    dicts = with pkgs.aspellDicts; [ en en-computers nb nn fr de it ];
    maxAttachmentSize = 20;
    hostName = "roundcubeplaceholder.example.com";

--- a/hosts/bicep/services/matrix/coturn.nix
+++ b/hosts/bicep/services/matrix/coturn.nix
@@ -48,6 +48,9 @@

  users.users.turnserver.extraGroups = [ "acme" ];

+  # It needs this to be allowed to access the files with the acme group
+  systemd.services.coturn.serviceConfig.PrivateUsers = lib.mkForce false;
+
  systemd.services."acme-${config.services.coturn.realm}".serviceConfig = {
    AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
  };
@@ -66,7 +69,7 @@

    listening-ips = [
      values.services.turn.ipv4
-      # values.services.turn.ipv6
+      values.services.turn.ipv6
    ];

    tls-listening-port = 443;
--- a/hosts/bicep/services/matrix/hookshot/default.nix
+++ b/hosts/bicep/services/matrix/hookshot/default.nix
@@ -6,10 +6,6 @@ let
  webhookListenPort = 8435;
 in
 {
-  imports = [
-    ./module.nix
-  ];
-
  sops.secrets."matrix/hookshot/as_token" = {
    sopsFile = fp /secrets/bicep/matrix.yaml;
    key = "hookshot/as_token";
--- a/hosts/bicep/services/matrix/hookshot/module.nix
+++ b/hosts/bicep/services/matrix/hookshot/module.nix
@@ -1,127 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  cfg = config.services.matrix-hookshot;
-  settingsFormat = pkgs.formats.yaml { };
-  configFile = settingsFormat.generate "matrix-hookshot-config.yml" cfg.settings;
-in
-{
-  options = {
-    services.matrix-hookshot = {
-      enable = lib.mkEnableOption "matrix-hookshot, a bridge between Matrix and project management services";
-
-      package = lib.mkPackageOption pkgs "matrix-hookshot" { };
-
-      registrationFile = lib.mkOption {
-        type = lib.types.path;
-        description = ''
-          Appservice registration file.
-          As it contains secret tokens, you may not want to add this to the publicly readable Nix store.
-        '';
-        example = lib.literalExpression ''
-          pkgs.writeText "matrix-hookshot-registration" \'\'
-            id: matrix-hookshot
-            as_token: aaaaaaaaaa
-            hs_token: aaaaaaaaaa
-            namespaces:
-              rooms: []
-              users:
-                - regex: "@_webhooks_.*:foobar"
-                  exclusive: true
-
-            sender_localpart: hookshot
-            url: "http://localhost:9993"
-            rate_limited: false
-            \'\'
-        '';
-      };
-
-      settings = lib.mkOption {
-        description = ''
-          {file}`config.yml` configuration as a Nix attribute set.
-
-          For details please see the [documentation](https://matrix-org.github.io/matrix-hookshot/latest/setup/sample-configuration.html).
-        '';
-        example = {
-          bridge = {
-            domain = "example.com";
-            url = "http://localhost:8008";
-            mediaUrl = "https://example.com";
-            port = 9993;
-            bindAddress = "127.0.0.1";
-          };
-          listeners = [
-            {
-              port = 9000;
-              bindAddress = "0.0.0.0";
-              resources = [ "webhooks" ];
-            }
-            {
-              port = 9001;
-              bindAddress = "localhost";
-              resources = [
-                "metrics"
-                "provisioning"
-              ];
-            }
-          ];
-        };
-        default = { };
-        type = lib.types.submodule {
-          freeformType = settingsFormat.type;
-          options = {
-            passFile = lib.mkOption {
-              type = lib.types.path;
-              default = "/var/lib/matrix-hookshot/passkey.pem";
-              description = ''
-                A passkey used to encrypt tokens stored inside the bridge.
-                File will be generated if not found.
-              '';
-            };
-          };
-        };
-      };
-
-      serviceDependencies = lib.mkOption {
-        type = with lib.types; listOf str;
-        default = lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
-        defaultText = lib.literalExpression ''
-          lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
-        '';
-        description = ''
-          List of Systemd services to require and wait for when starting the application service,
-          such as the Matrix homeserver if it's running on the same host.
-        '';
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.services.matrix-hookshot = {
-      description = "a bridge between Matrix and multiple project management services";
-
-      wantedBy = [ "multi-user.target" ];
-      wants = [ "network-online.target" ] ++ cfg.serviceDependencies;
-      after = [ "network-online.target" ] ++ cfg.serviceDependencies;
-
-      preStart = ''
-        if [ ! -f '${cfg.settings.passFile}' ]; then
-          mkdir -p $(dirname '${cfg.settings.passFile}')
-          ${pkgs.openssl}/bin/openssl genpkey -out '${cfg.settings.passFile}' -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:4096
-        fi
-      '';
-
-      serviceConfig = {
-        Type = "simple";
-        Restart = "always";
-        ExecStart = "${cfg.package}/bin/matrix-hookshot ${configFile} ${cfg.registrationFile}";
-      };
-    };
-  };
-
-  meta.maintainers = with lib.maintainers; [ flandweber ];
-}
--- a/hosts/dagali/TODO.md
+++ b/hosts/dagali/TODO.md
@@ -0,0 +1,78 @@
+# Tracking document for new PVV kerberos auth stack
+
+![Bensinstasjon på heimdal](https://bydelsnytt.no/wp-content/uploads/2022/08/esso_heimdal003.jpg)
+
+<div align="center">
+  Bensinstasjon på heimdal
+</div>
+
+### TODO:
+
+- [ ] setup heimdal
+  - [x] ensure running with systemd
+  - [x] compile smbk5pwd (part of openldap)
+  - [ ] set `modify -a -disallow-all-tix,requires-pre-auth default` declaratively
+  - [ ] fully initialize PVV.NTNU.NO
+    - [x] `kadmin -l init PVV.NTNU.NO`
+    - [x] add oysteikt/admin@PVV.NTNU.NO principal
+    - [x] add oysteikt@PVV.NTNU.NO principal
+    - [x] add krbtgt/PVV.NTNU.NO@PVV.NTNU.NO principal?
+      - why is this needed, and where is it documented?
+      - `kadmin check` seems to work under sudo?
+      - (it is included by default, just included as error message
+         in a weird state)
+
+    - [x] Ensure client is working correctly
+      - [x] Ensure kinit works on darbu
+      - [x] Ensure kpasswd works on darbu
+      - [x] Ensure kadmin get <user> (and other restricted commands) works on darbu
+
+    - [ ] Ensure kdc is working correctly
+      - [x] Ensure kinit works on dagali
+      - [x] Ensure kpasswd works on dagali
+      - [ ] Ensure kadmin get <user> (and other restricte commands) works on dagali
+
+    - [x] Fix FQDN
+      - https://github.com/NixOS/nixpkgs/issues/94011
+      - https://github.com/NixOS/nixpkgs/issues/261269
+      - Possibly fixed by disabling systemd-resolved
+
+- [ ] setup cyrus sasl
+  - [x] ensure running with systemd 
+  - [x] verify GSSAPI support plugin is installed
+    - `nix-shell -p cyrus_sasl --command pluginviewer`
+  - [x] create "host/localhost@PVV.NTNU.NO" and export to keytab
+  - [x] verify cyrus sasl is able to talk to heimdal
+    - `sudo testsaslauthd -u oysteikt -p <password>`
+  - [ ] provide ldap principal to cyrus sasl through keytab
+
+- [ ] setup openldap
+  - [x] ensure running with systemd
+  - [ ] verify openldap is able to talk to cyrus sasl
+  - [ ] create user for oysteikt in openldap
+  - [ ] authenticate openldap login through sasl
+    - does this require creating an ldap user?
+
+- [ ] fix smbk5pwd integration
+  - [x] add smbk5pwd schemas to openldap
+  - [x] create openldap db for smbk5pwd with overlays
+  - [ ] test to ensure that user sync is working
+  - [ ] test as user source (replace passwd)
+  - [ ] test as PAM auth source
+  - [ ] test as auth source for 3rd party appliation
+
+- [ ] Set up ldap administration panel
+  - Doesn't seem like there are many good ones out there. Maybe phpLDAPAdmin?
+
+- [ ] Set up kerberos SRV DNS entry
+
+### Information and URLS
+
+- OpenLDAP SASL: https://www.openldap.org/doc/admin24/sasl.html
+- Use a keytab: https://kb.iu.edu/d/aumh
+- 2 ways for openldap to auth: https://security.stackexchange.com/questions/65093/how-to-test-ldap-that-authenticates-with-kerberos
+- Cyrus guide OpenLDAP + SASL + GSSAPI: https://www.cyrusimap.org/sasl/sasl/faqs/openldap-sasl-gssapi.html
+- Configuring GSSAPI and Cyrus SASL: https://web.mit.edu/darwin/src/modules/passwordserver_sasl/cyrus_sasl/doc/gssapi.html
+- PVV Kerberos docs: https://wiki.pvv.ntnu.no/wiki/Drift/Kerberos
+- OpenLDAP smbk5pwd source: https://git.openldap.org/nivanova/openldap/-/tree/master/contrib/slapd-modules/smbk5pwd
+- saslauthd(8): https://linux.die.net/man/8/saslauthd
--- a/hosts/dagali/configuration.nix
+++ b/hosts/dagali/configuration.nix
@@ -0,0 +1,51 @@
+
+{ config, pkgs, values, lib, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../base.nix
+    ../../misc/metrics-exporters.nix
+
+    ./services/heimdal.nix
+    #./services/openldap.nix
+    ./services/cyrus-sasl.nix
+  ];
+
+  # buskerud does not support efi?
+  # boot.loader.systemd-boot.enable = true;
+  # boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/sda";
+
+  # resolved messes up FQDN coming from nscd
+  services.resolved.enable = false;
+
+  networking.hostName = "dagali";
+  networking.domain = lib.mkForce "pvv.local";
+  networking.hosts = {
+    "129.241.210.185" = [ "dagali.pvv.local" ];
+  };
+  #networking.search = [ "pvv.ntnu.no" "pvv.org" ];
+  networking.nameservers = [ "129.241.0.200" "129.241.0.201" ];
+  networking.tempAddresses = "disabled";
+  networking.networkmanager.enable = true;
+
+  systemd.network.networks."ens18" = values.defaultNetworkConfig // {
+    matchConfig.Name = "ens18";
+    address = with values.hosts.dagali; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  };
+
+  # List packages installed in system profile
+  environment.systemPackages = with pkgs; [
+    # TODO: consider adding to base.nix
+    nix-output-monitor
+  ];
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "24.05"; # Did you read the comment?
+}
--- a/hosts/kvernberg/hardware-configuration.nix
+++ b/hosts/kvernberg/hardware-configuration.nix
@@ -13,7 +13,14 @@
  boot.kernelModules = [ ];
  boot.extraModulePackages = [ ];

-  swapDevices = [ ];
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/4de345e2-be41-4d10-9b90-823b2c77e9b3";
+      fsType = "ext4";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/aa4b9a97-a7d8-4608-9f67-4ad084f1baf7"; }
+    ];

  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
--- a/hosts/dagali/services/cyrus-sasl.nix
+++ b/hosts/dagali/services/cyrus-sasl.nix
@@ -0,0 +1,21 @@
+{ config, ... }:
+let
+  cfg = config.services.saslauthd;
+in
+{
+  # TODO: This is seemingly required for openldap to authenticate
+  #       against kerberos, but I have no idea how to configure it as
+  #       such. Does it need a keytab? There's a binary "testsaslauthd"
+  #       that follows with `pkgs.cyrus_sasl` that might be useful.
+  services.saslauthd = {
+    enable = true;
+    mechanism = "kerberos5";
+    config = ''
+      mech_list: gs2-krb5 gssapi
+      keytab: /etc/krb5.keytab
+    '';
+  };
+
+  # TODO: maybe the upstream module should consider doing this?
+  environment.systemPackages = [ cfg.package ];
+}
--- a/hosts/dagali/services/heimdal.nix
+++ b/hosts/dagali/services/heimdal.nix
@@ -0,0 +1,100 @@
+{ config, pkgs, lib, ... }:
+let
+  realm = "PVV.LOCAL";
+  cfg = config.security.krb5;
+in
+{
+  security.krb5 = {
+    enable = true;
+
+    # NOTE: This is required in order to build smbk5pwd, because of some nested includes.
+    #       We should open an issue upstream (heimdal, not nixpkgs), but this patch
+    #       will do for now.
+    package = pkgs.heimdal.overrideAttrs (prev: {
+      postInstall = prev.postInstall + ''
+        cp include/heim_threads.h $dev/include
+      '';
+    });
+
+    settings = {
+      realms.${realm} = {
+        kdc = [ "dagali.${lib.toLower realm}" ];
+        admin_server = "dagali.${lib.toLower realm}";
+        kpasswd_server = "dagali.${lib.toLower realm}";
+        default_domain = lib.toLower realm;
+        primary_kdc = "dagali.${lib.toLower realm}";
+      };
+
+      kadmin.default_keys = lib.concatStringsSep " " [
+        "aes256-cts-hmac-sha1-96:pw-salt"
+        "aes128-cts-hmac-sha1-96:pw-salt"
+      ];
+
+      libdefaults.default_etypes = lib.concatStringsSep " " [
+        "aes256-cts-hmac-sha1-96"
+        "aes128-cts-hmac-sha1-96"
+      ];
+
+      libdefaults = {
+        default_realm = realm;
+        dns_lookup_kdc = false;
+        dns_lookup_realm = false;
+      };
+
+      domain_realm = {
+        "${lib.toLower realm}" = realm;
+        ".${lib.toLower realm}" = realm;
+      };
+
+      logging = {
+        # kdc = "CONSOLE";
+        kdc = "SYSLOG:DEBUG:AUTH";
+        admin_server = "SYSLOG:DEBUG:AUTH";
+        default = "SYSLOG:DEBUG:AUTH";
+      };
+    };
+  };
+
+  services.kerberos_server = {
+    enable = true;
+    settings = {
+      realms.${realm} = {
+        dbname = "/var/lib/heimdal/heimdal";
+        mkey = "/var/lib/heimdal/m-key";
+        acl = [
+          {
+            principal = "kadmin/admin";
+            access = "all";
+          }
+          {
+            principal = "felixalb/admin";
+            access = "all";
+          }
+          {
+            principal = "oysteikt/admin";
+            access = "all";
+          }
+        ];
+      };
+      # kadmin.default_keys = lib.concatStringsSep " " [
+      #   "aes256-cts-hmac-sha1-96:pw-salt"
+      #   "aes128-cts-hmac-sha1-96:pw-salt"
+      # ];
+
+      # libdefaults.default_etypes = lib.concatStringsSep " " [
+      #   "aes256-cts-hmac-sha1-96"
+      #   "aes128-cts-hmac-sha1-96"
+      # ];
+
+      # password_quality.min_length = 8;
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 88 464 749 ];
+  networking.firewall.allowedUDPPorts = [ 88 464 749 ];
+
+  networking.hosts = {
+    "127.0.0.2" = lib.mkForce [ ];
+    "::1" = lib.mkForce [ ];
+  };
+}
--- a/hosts/dagali/services/openldap.nix
+++ b/hosts/dagali/services/openldap.nix
@@ -0,0 +1,121 @@
+{ config, pkgs, lib, ... }:
+{
+  services.openldap = let
+    dn = "dc=pvv,dc=ntnu,dc=no";
+    cfg = config.services.openldap;
+
+    heimdal = config.security.krb5.package;
+  in {
+    enable = true;
+
+    # NOTE: this is a custom build of openldap with support for
+    #       perl and kerberos.
+    package = pkgs.openldap.overrideAttrs (prev: {
+      # https://github.com/openldap/openldap/blob/master/configure
+      configureFlags = prev.configureFlags ++ [
+        # Connect to slapd via UNIX socket
+        "--enable-local"
+        # Cyrus SASL
+        "--enable-spasswd"
+        # Reverse hostname lookups
+        "--enable-rlookups"
+        # perl
+        "--enable-perl"
+      ];
+
+      buildInputs = prev.buildInputs ++ [
+        pkgs.perl
+	# NOTE: do not upstream this, it might not work with
+	#       MIT in the same way
+        heimdal
+      ];
+
+      extraContribModules = prev.extraContribModules ++ [
+        # https://git.openldap.org/openldap/openldap/-/tree/master/contrib/slapd-modules
+        "smbk5pwd"
+      ];
+    });
+
+    settings = {
+      attrs = {
+        olcLogLevel = [ "stats" "config" "args" ];
+
+        # olcAuthzRegexp = ''
+        #   gidNumber=.*\\\+uidNumber=0,cn=peercred,cn=external,cn=auth
+        #         "uid=heimdal,${dn2}"
+        # '';
+
+        # olcSaslSecProps = "minssf=0";
+      };
+
+      children = {
+        "cn=schema".includes = let
+          # NOTE: needed for smbk5pwd.so module
+          schemaToLdif = name: path: pkgs.runCommandNoCC name {
+            buildInputs = with pkgs; [ schema2ldif ];
+          } ''
+            schema2ldif "${path}" > $out
+          '';
+
+          hdb-ldif = schemaToLdif "hdb.ldif" "${heimdal.src}/lib/hdb/hdb.schema";
+          samba-ldif = schemaToLdif "samba.ldif" "${heimdal.src}/tests/ldap/samba.schema";
+        in [
+           "${cfg.package}/etc/schema/core.ldif"
+           "${cfg.package}/etc/schema/cosine.ldif"
+           "${cfg.package}/etc/schema/nis.ldif"
+           "${cfg.package}/etc/schema/inetorgperson.ldif"
+           "${hdb-ldif}"
+           "${samba-ldif}"
+        ];
+
+        # NOTE: installation of smbk5pwd.so module
+        #       https://git.openldap.org/openldap/openldap/-/tree/master/contrib/slapd-modules/smbk5pwd
+        "cn=module{0}".attrs = {
+          objectClass = [ "olcModuleList" ];
+          olcModuleLoad = [ "${cfg.package}/lib/modules/smbk5pwd.so" ];
+        };
+
+        # NOTE: activation of smbk5pwd.so module for {1}mdb
+        "olcOverlay={0}smbk5pwd,olcDatabase={1}mdb".attrs = {
+          objectClass = [ "olcOverlayConfig" "olcSmbK5PwdConfig" ];
+          olcOverlay = "{0}smbk5pwd";
+          olcSmbK5PwdEnable = [ "krb5" "samba" ];
+          olcSmbK5PwdMustChange = toString (60 * 60 * 24 * 10000);
+        };
+
+        "olcDatabase={1}mdb".attrs = {
+          objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
+
+          olcDatabase = "{1}mdb";
+
+          olcSuffix = dn;
+
+          # TODO: PW is supposed to be a secret, but it's probably fine for testing
+          olcRootDN = "cn=users,${dn}";
+
+          # TODO: replace with proper secret
+          olcRootPW.path = pkgs.writeText "olcRootPW" "pass";
+
+          olcDbDirectory = "/var/lib/openldap/test-smbk5pwd-db";
+          olcDbIndex = "objectClass eq";
+
+          olcAccess = [
+            ''{0}to attrs=userPassword,shadowLastChange
+                by dn.exact=cn=users,${dn} write
+                by self write
+                by anonymous auth
+                by * none''
+
+            ''{1}to dn.base=""
+                by * read''
+
+            /* allow read on anything else */
+            # ''{2}to *
+            #     by cn=users,${dn} write by dn.exact=gidNumber=0+uidNumber=0+cn=peercred,cn=external write
+            #     by * read''
+          ];
+        };
+      };
+    };
+  };
+}
--- a/hosts/kvernberg/configuration.nix
+++ b/hosts/kvernberg/configuration.nix
@@ -1,45 +0,0 @@
-{ config, fp, pkgs, values, ... }:
-{
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-    (fp /base)
-    (fp /misc/metrics-exporters.nix)
-    ./disks.nix
-
-    ./services/nginx.nix
-    ./services/pvvvvvv
-  ];
-
-  sops.defaultSopsFile = fp /secrets/kvernberg/kvernberg.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
-  sops.age.generateKey = true;
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
- 
-  networking.hostName = "kvernberg"; # Define your hostname.
-
-  systemd.network.networks."30-all" = values.defaultNetworkConfig // {
-    matchConfig.Name = "en*";
-    address = with values.hosts.kvernberg; [ (ipv4 + "/25") (ipv6 + "/64") ];
-  };
-
-  # List packages installed in system profile
-  environment.systemPackages = with pkgs; [
-    
-  ];
-
-  # No devices with SMART
-  services.smartd.enable = false;
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "24.05"; # Did you read the comment?
-
-}
--- a/hosts/kvernberg/disks.nix
+++ b/hosts/kvernberg/disks.nix
@@ -1,39 +0,0 @@
-# Example to create a bios compatible gpt partition
-{ lib, ... }:
-{
-  disko.devices = {
-    disk.disk1 = {
-      device = lib.mkDefault "/dev/sda";
-      type = "disk";
-      content = {
-        type = "gpt";
-        partitions = {
-          boot = {
-            name = "boot";
-            size = "1M";
-            type = "EF02";
-          };
-          esp = {
-            name = "ESP";
-            size = "500M";
-            type = "EF00";
-            content = {
-              type = "filesystem";
-              format = "vfat";
-              mountpoint = "/boot";
-            };
-          };
-          root = {
-            name = "root";
-            size = "100%";
-            content = {
-              type = "filesystem";
-              format = "ext4";
-              mountpoint = "/";
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/hosts/kvernberg/services/nginx.nix
+++ b/hosts/kvernberg/services/nginx.nix
@@ -1,5 +0,0 @@
-{ config, lib, ... }:
-
-{
-  services.nginx.enable = true;
-}
--- a/hosts/kvernberg/services/pvvvvvv/bank.nix
+++ b/hosts/kvernberg/services/pvvvvvv/bank.nix
@@ -1,51 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.libeufin.bank;
-  tcfg = config.services.taler;
-  inherit (tcfg.settings.taler) CURRENCY;
-in {
-  services.libeufin.bank = {
-    enable = true;
-    debug = true;
-    createLocalDatabase = true;
-    initialAccounts = [
-      { username = "exchange";
-        password = "exchange";
-        name = "Exchange";
-      }
-    ];
-    settings = {
-      libeufin-bank = {
-        WIRE_TYPE = "x-taler-bank";
-        X_TALER_BANK_PAYTO_HOSTNAME = "bank.kvernberg.pvv.ntnu.no";
-        BASE_URL = "bank.kvernberg.pvv.ntnu.no/";
-
-        ALLOW_REGISTRATION = "yes";
-
-        REGISTRATION_BONUS_ENABLED = "yes";
-        REGISTRATION_BONUS = "${CURRENCY}:500";
-
-        DEFAULT_DEBT_LIMIT = "${CURRENCY}:0";
-
-        ALLOW_CONVERSION = "no";
-        ALLOW_EDIT_CASHOUT_PAYTO_URI = "yes";
-
-        SUGGESTED_WITHDRAWAL_EXCHANGE = "https://exchange.kvernberg.pvv.ntnu.no/";
-
-        inherit CURRENCY;
-      };
-    };
-  };
-
-  services.nginx.virtualHosts."bank.kvernberg.pvv.ntnu.no" = {
-    enableACME = true;
-    forceSSL = true;
-    kTLS = true;
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:8082";
-      extraConfig = ''
-         proxy_read_timeout 300s; 
-      '';
-    };
-  };
-}
--- a/hosts/kvernberg/services/pvvvvvv/default.nix
+++ b/hosts/kvernberg/services/pvvvvvv/default.nix
@@ -1,13 +0,0 @@
-{
-  imports = [
-    ./exchange.nix
-    ./bank.nix
-  ];
-
-  services.taler = {
-    settings = {
-      taler.CURRENCY = "SCHPENN";
-      taler.CURRENCY_ROUND_UNIT = "${cfg.settings.taler.CURRENCY}:1";
-    };
-  };
-}
--- a/hosts/kvernberg/services/pvvvvvv/exchange.nix
+++ b/hosts/kvernberg/services/pvvvvvv/exchange.nix
@@ -1,187 +0,0 @@
-{ config, lib, fp, pkgs, ... }:
-let
-  cfg = config.services.taler;
-  inherit (cfg.settings.taler) CURRENCY;
-in {
-  sops.secrets.exchange-offline-master = {
-    format = "binary";
-    sopsFile = fp /secrets/kvernberg/exhange-offline-master.priv;
-  };
-
-  services.taler.exchange = {
-    enable = true;
-    debug = true;
-    denominationConfig = ''
-      ## Old denomination names cannot be used again
-      # [COIN-${CURRENCY}-k1-1-0]
-
-      ## NOK Denominations
-      [coin-${CURRENCY}-nok-1-0]
-      VALUE = ${CURRENCY}:1
-      DURATION_WITHDRAW = 7 days
-      DURATION_SPEND = 1 years
-      DURATION_LEGAL = 3 years
-      FEE_WITHDRAW = ${CURRENCY}:0
-      FEE_DEPOSIT = ${CURRENCY}:0
-      FEE_REFRESH = ${CURRENCY}:0
-      FEE_REFUND = ${CURRENCY}:0
-      RSA_KEYSIZE = 2048
-      CIPHER = RSA
-      
-      [coin-${CURRENCY}-nok-5-0]
-      VALUE = ${CURRENCY}:5
-      DURATION_WITHDRAW = 7 days
-      DURATION_SPEND = 1 years
-      DURATION_LEGAL = 3 years
-      FEE_WITHDRAW = ${CURRENCY}:0
-      FEE_DEPOSIT = ${CURRENCY}:0
-      FEE_REFRESH = ${CURRENCY}:0
-      FEE_REFUND = ${CURRENCY}:0
-      RSA_KEYSIZE = 2048
-      CIPHER = RSA
-
-      [coin-${CURRENCY}-nok-10-0]
-      VALUE = ${CURRENCY}:10
-      DURATION_WITHDRAW = 7 days
-      DURATION_SPEND = 1 years
-      DURATION_LEGAL = 3 years
-      FEE_WITHDRAW = ${CURRENCY}:0
-      FEE_DEPOSIT = ${CURRENCY}:0
-      FEE_REFRESH = ${CURRENCY}:0
-      FEE_REFUND = ${CURRENCY}:0
-      RSA_KEYSIZE = 2048
-      CIPHER = RSA
-      
-      [coin-${CURRENCY}-nok-20-0]
-      VALUE = ${CURRENCY}:20
-      DURATION_WITHDRAW = 7 days
-      DURATION_SPEND = 1 years
-      DURATION_LEGAL = 3 years
-      FEE_WITHDRAW = ${CURRENCY}:0
-      FEE_DEPOSIT = ${CURRENCY}:0
-      FEE_REFRESH = ${CURRENCY}:0
-      FEE_REFUND = ${CURRENCY}:0
-      RSA_KEYSIZE = 2048
-      CIPHER = RSA
-      
-      [coin-${CURRENCY}-nok-50-0]
-      VALUE = ${CURRENCY}:50
-      DURATION_WITHDRAW = 7 days
-      DURATION_SPEND = 1 years
-      DURATION_LEGAL = 3 years
-      FEE_WITHDRAW = ${CURRENCY}:0
-      FEE_DEPOSIT = ${CURRENCY}:0
-      FEE_REFRESH = ${CURRENCY}:0
-      FEE_REFUND = ${CURRENCY}:0
-      RSA_KEYSIZE = 2048
-      CIPHER = RSA
-      
-      [coin-${CURRENCY}-nok-100-0]
-      VALUE = ${CURRENCY}:100
-      DURATION_WITHDRAW = 7 days
-      DURATION_SPEND = 1 years
-      DURATION_LEGAL = 3 years
-      FEE_WITHDRAW = ${CURRENCY}:0
-      FEE_DEPOSIT = ${CURRENCY}:0
-      FEE_REFRESH = ${CURRENCY}:0
-      FEE_REFUND = ${CURRENCY}:0
-      RSA_KEYSIZE = 2048
-      CIPHER = RSA
-      
-      [coin-${CURRENCY}-nok-200-0]
-      VALUE = ${CURRENCY}:200
-      DURATION_WITHDRAW = 7 days
-      DURATION_SPEND = 1 years
-      DURATION_LEGAL = 3 years
-      FEE_WITHDRAW = ${CURRENCY}:0
-      FEE_DEPOSIT = ${CURRENCY}:0
-      FEE_REFRESH = ${CURRENCY}:0
-      FEE_REFUND = ${CURRENCY}:0
-      RSA_KEYSIZE = 2048
-      CIPHER = RSA
-      
-      [coin-${CURRENCY}-nok-500-0]
-      VALUE = ${CURRENCY}:500
-      DURATION_WITHDRAW = 7 days
-      DURATION_SPEND = 1 years
-      DURATION_LEGAL = 3 years
-      FEE_WITHDRAW = ${CURRENCY}:0
-      FEE_DEPOSIT = ${CURRENCY}:0
-      FEE_REFRESH = ${CURRENCY}:0
-      FEE_REFUND = ${CURRENCY}:0
-      RSA_KEYSIZE = 2048
-      CIPHER = RSA
-      
-      [coin-${CURRENCY}-nok-1000-0]
-      VALUE = ${CURRENCY}:1000
-      DURATION_WITHDRAW = 7 days
-      DURATION_SPEND = 1 years
-      DURATION_LEGAL = 3 years
-      FEE_WITHDRAW = ${CURRENCY}:0
-      FEE_DEPOSIT = ${CURRENCY}:0
-      FEE_REFRESH = ${CURRENCY}:0
-      FEE_REFUND = ${CURRENCY}:0
-      RSA_KEYSIZE = 2048
-      CIPHER = RSA
-
-      ## PVV Special Prices
-      # 2024 pizza egenandel
-      [coin-${CURRENCY}-pvv-64-0]
-      VALUE = ${CURRENCY}:64
-      DURATION_WITHDRAW = 7 days
-      DURATION_SPEND = 1 years
-      DURATION_LEGAL = 3 years
-      FEE_WITHDRAW = ${CURRENCY}:0
-      FEE_DEPOSIT = ${CURRENCY}:0
-      FEE_REFRESH = ${CURRENCY}:0
-      FEE_REFUND = ${CURRENCY}:0
-      RSA_KEYSIZE = 2048
-      CIPHER = RSA
-    '';
-    settings = {
-      exchange = {
-        inherit (config.services.taler.settings.taler) CURRENCY CURRENCY_ROUND_UNIT; 
-        MASTER_PUBLIC_KEY = "J331T37C8E58P9CVE686P1JFH11DWSRJ3RE4GVDTXKES9M24ERZG";
-        BASE_URL = "https://exchange.kvernberg.pvv.ntnu.no/";
-        TERMS_DIR = "${./terms}";
-        TERMS_ETAG = "0";
-        ENABLE_KYC = "NO";
-      };
-      exchange-offline = {
-        MASTER_PRIV_FILE = config.sops.secrets.exchange-offline-master.path;
-      };
-      exchange-account-test = {
-        PAYTO_URI = "payto://x-taler-bank/bank.kvernberg.pvv.ntnu.no/exchange?receiver-name=Exchange";
-        ENABLE_DEBIT = "YES";
-        ENABLE_CREDIT = "YES";
-      };
-      exchange-accountcredentials-test = {
-        WIRE_GATEWAY_URL = "https://bank.kvernberg.pvv.ntnu.no/accounts/exchange/taler-wire-gateway/";
-        WIRE_GATEWAY_AUTH_METHOD = "BASIC";
-        USERNAME = "exchange";
-        PASSWORD = "exchange";
-      };
-      "currency-${CURRENCY}" = {
-        ENABLED = "YES";
-        CODE = "SCHPENN";
-        NAME = "SCHPENN";
-        FRACTIONAL_NORMAL_DIGITS = 0;
-        FRACTIONAL_INPUT_DIGITS = 0;
-        FRACTIONAL_TRAILING_ZERO_DIGITS = 0;
-        ALT_UNIT_NAMES = "{\"0\": \"S\"}";
-      };
-    };
-  };
-
-  services.nginx.virtualHosts."exchange.kvernberg.pvv.ntnu.no" = {
-    enableACME = true;
-    forceSSL = true;
-    kTLS = true;
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:8081";
-      extraConfig = ''
-        proxy_read_timeout 300s;
-      '';
-    };
-  };
-}
--- a/hosts/kvernberg/services/pvvvvvv/terms/en/0.txt
+++ b/hosts/kvernberg/services/pvvvvvv/terms/en/0.txt
@@ -1,147 +0,0 @@
-Terms of Service
-================
-
-Last update: 19.11.2024
----------------------
-
-Welcome! A subset of PVVers who cares about Dibbler (“we,” “our,” or “us”) provides a experimental payment service
-through our Internet presence (collectively the “Services”). Before using our
-Services, please read the Terms of Service (the “Terms” or the “Agreement”)
-carefully.
-
-Overview
--------
-
-This section provides a brief summary of the highlights of this
-Agreement. Please note that when you accept this Agreement, you are accepting
-all of the terms and conditions and not just this section. We and possibly
-other third parties provide Internet services which interact with the Taler
-Wallet’s self-hosted personal payment application. When using the Taler Wallet
-to interact with our Services, you are agreeing to our Terms, so please read
-carefully.
-
-Research
----------
-
-This is research, any dibbler credits sent to the dibbler account could be lost at any time.
-We would make an effort to send the credits back to their canonical owners, but this may be difficult.
-We make no guarantees on the state of this. The dibbler economy is totally unsecured, and so are these services!
-Usage is wholly on your own risk.
-
-Highlights:
-----------
-
-* You are responsible for keeping the data in your Taler Wallet at all times under your control. Any losses arising from you not being in control of your private information are your problem.
-
-* For our Services, we may charge transaction fees. The specific fee structure is provided based on the Taler protocol and should be shown to you when you withdraw electronic coins using a Taler Wallet. You agree and understand that the Taler protocol allows for the fee structure to change.
-
-* You agree to not intentionally overwhelm our systems with requests and follow responsible disclosure if you find security issues in our services.
-
-* We cannot be held accountable for our Services not being available due to circumstances beyond our control. If we modify or terminate our services, we will try to give you the opportunity to recover your funds. However, given the experimental state of the Services today, this may not be possible. You are strongly advised to limit your use of the Service to small-scale experiments expecting total loss of all funds.
-
-These terms outline approved uses of our Services. The Services and these
-Terms are still at an experimental stage. If you have any questions or
-comments related to this Agreement, please send us a message on IRC, or on our Matrix server.
-If you do not agree to this Agreement, you must not use our Services.
-
-How you accept this policy
--------------------------
-
-By sending funds to us (to top-up your Taler Wallet), you acknowledge that you
-have read, understood, and agreed to these Terms. We reserve the right to
-change these Terms at any time. If you disagree with the change, we may in the
-future offer you with an easy option to recover your unspent funds. However,
-in the current experimental period you acknowledge that this feature is not
-yet available, resulting in your funds being lost unless you accept the new
-Terms. If you continue to use our Services other than to recover your unspent
-funds, your continued use of our Services following any such change will
-signify your acceptance to be bound by the then current Terms. Please check
-the effective date above to determine if there have been any changes since you
-have last reviewed these Terms.
-
-Services
--------
-
-We will try to transfer funds that we hold in escrow for our users to any
-legal recipient to the best of our ability and within the limitations of the
-law and our implementation. However, the Services offered today are highly
-experimental and the set of recipients of funds is severely restricted. The
-Taler Wallet can be loaded by exchanging ordinary dibbler credit for electronic
-coins. We are providing this exchange service. Once your Taler Wallet is
-loaded with electronic coins they can be spent for purchases if the seller is
-accepting Taler as a means of payment. We are not guaranteeing that any seller
-is accepting Taler at all or a particular seller. The seller or recipient of
-deposits of electronic coins must specify the target account, as per the
-design of the Taler protocol. They are responsible for following the protocol
-and specifying the correct dibbler account, and are solely liable for any losses
-that may arise from specifying the wrong account. We will allow the government
-to link wire transfers to the underlying contract hash. It is the
-responsibility of recipients to preserve the full contracts and to pay
-whatever taxes and charges may be applicable. Technical issues may lead to
-situations where we are unable to make transfers at all or lead to incorrect
-transfers that cannot be reversed. We will only refuse to execute transfers if
-the transfers are prohibited by a competent legal authority and we are ordered
-to do so.
-
-When using our Services, you agree to not take any action that intentionally
-imposes an unreasonable load on our infrastructure. If you find security
-problems in our Services, you agree to first report them to
-security@taler-systems.com and grant us the right to publish your report. We
-warrant that we will ourselves publicly disclose any issues reported within 3
-months, and that we will not prosecute anyone reporting security issues if
-they did not exploit the issue beyond a proof-of-concept, and followed the
-above responsible disclosure practice.
-
-Fees
----
-
-You agree to pay the fees for exchanges and withdrawals completed via the
-Taler Wallet ("Fees") as defined by us, which we may change from time to
-time.
-
-
-Copyrights and trademarks
-------------------------
-
-The Taler Wallet is released under the terms of the GNU General Public License
-(GNU GPL). You have the right to access, use, and share the Taler Wallet, in
-modified or unmodified form. However, the GPL is a strong copyleft license,
-which means that any derivative works must be distributed under the same
-license terms as the original software. If you have any questions, you should
-review the GNU GPL’s full terms and conditions on the GNU GPL Licenses page 
-(https://www.gnu.org/licenses/). “Taler” itself is a trademark
-of Taler Systems SA. You are welcome to use the name in relation to processing
-payments based on the Taler protocol, assuming your use is compatible with an
-official release from the GNU Project that is not older than two years.
-
-
-
-Discontinuance of services and Force majeure
--------------------------------------------
-
-We may, in our sole discretion and without cost to you, with or without prior
-notice, and at any time, modify or discontinue, temporarily or permanently,
-any portion of our Services. We will use the Taler protocol’s provisions to
-notify Wallets if our Services are to be discontinued. It is your
-responsibility to ensure that the Taler Wallet is online at least once every
-three months to observe these notifications. We shall not be held responsible
-or liable for any loss of funds in the event that we discontinue or depreciate
-the Services and your Taler Wallet fails to transfer out the coins within a
-three months notification period.
-
-We shall not be held liable for any delays, failure in performance, or
-interruptions of service which result directly or indirectly from any cause or
-condition beyond our reasonable control, including but not limited to: any
-delay or failure due to any act of God, act of civil or military authorities,
-act of terrorism, civil disturbance, war, strike or other labor dispute, fire,
-interruption in telecommunications or Internet services or network provider
-services, failure of equipment and/or software, other catastrophe, or any
-other occurrence which is beyond our reasonable control and shall not affect
-the validity and enforceability of any remaining provisions.
-
-
-Questions or comments
---------------------
-
-We welcome comments, questions, concerns, or suggestions. Please send us a
-message via the usual communication channels at PVV
--- a/hosts/ustetind/configuration.nix
+++ b/hosts/ustetind/configuration.nix
@@ -0,0 +1,44 @@
+{ config, fp, pkgs, lib, values, ... }:
+
+{
+  imports = [
+    (fp /base)
+    (fp /misc/metrics-exporters.nix)
+
+    ./services/gitea-runners.nix
+  ];
+
+  sops.defaultSopsFile = fp /secrets/ustetind/ustetind.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  sops.age.generateKey = true;
+
+  networking.hostName = "ustetind";
+
+  networking.useHostResolvConf = lib.mkForce false;
+
+  systemd.network.networks = {
+    "30-lxc-eth" = values.defaultNetworkConfig // {
+      matchConfig = {
+        Type = "ether";
+        Kind = "veth";
+        Name = [
+          "eth*"
+        ];
+      };
+      address = with values.hosts.ustetind; [ (ipv4 + "/25") (ipv6 + "/64") ];
+    };
+    "40-podman-veth" = values.defaultNetworkConfig // {
+      matchConfig = {
+        Type = "ether";
+        Kind = "veth";
+        Name = [
+          "veth*"
+        ];
+      };
+      DHCP = "yes";
+    };
+  };
+
+  system.stateVersion = "24.11";
+}
--- a/hosts/ustetind/services/gitea-runners.nix
+++ b/hosts/ustetind/services/gitea-runners.nix
@@ -15,8 +15,8 @@ let
        enable = true;
        name = "git-runner-${name}"; url = "https://git.pvv.ntnu.no";
        labels = [
-          "debian-latest:docker://node:18-bullseye"
-          "ubuntu-latest:docker://node:18-bullseye"
+          "debian-latest:docker://node:current-bookworm"
+          "ubuntu-latest:docker://node:current-bookworm"
        ];
        tokenFile = config.sops.secrets."gitea/runners/${name}".path;
      };
@@ -27,5 +27,15 @@ lib.mkMerge [
  (mkRunner "alpha")
  (mkRunner "beta")
  (mkRunner "epsilon")
-  { virtualisation.podman.enable = true; }
+  {
+    virtualisation.podman = {
+      enable = true;
+      defaultNetwork.settings.dns_enabled = true;
+      autoPrune.enable = true;
+    };
+
+    networking.dhcpcd.IPv6rs = false;
+
+    networking.firewall.interfaces."podman+".allowedUDPPorts = [53 5353];
+  }
 ]
--- a/modules/grzegorz.nix
+++ b/modules/grzegorz.nix
@@ -2,6 +2,8 @@
 let
  grg = config.services.greg-ng;
  grgw = config.services.grzegorz-webui;
+
+  machine = config.networking.hostName;
 in {
  services.greg-ng = {
    enable = true;
@@ -16,17 +18,56 @@ in {
    listenAddr = "localhost";
    listenPort = 42069;
    listenWebsocketPort = 42042;
-    hostName = "${config.networking.fqdn}";
-    apiBase = "http://${grg.settings.host}:${toString grg.settings.port}/api";
+    hostName = "${machine}-old.pvv.ntnu.no";
+    apiBase = "https://${machine}-backend.pvv.ntnu.no/api";
+  };
+
+  services.gergle = {
+    enable = true;
+    virtualHost = config.networking.fqdn;
  };

  services.nginx.enable = true;
-  services.nginx.virtualHosts."${config.networking.fqdn}" = {
+  services.nginx.virtualHosts = {
+    ${config.networking.fqdn} = {
      forceSSL = true;
      enableACME = true;
      kTLS = true;
      serverAliases = [
-      "${config.networking.hostName}.pvv.org"
+        "${machine}.pvv.org"
+      ];
+      extraConfig = ''
+        allow 129.241.210.128/25;
+        allow 2001:700:300:1900::/64;
+        deny all;
+      '';
+    };
+
+    "${machine}-backend.pvv.ntnu.no" = {
+      forceSSL = true;
+      enableACME = true;
+      kTLS = true;
+      serverAliases = [
+        "${machine}-backend.pvv.org"
+      ];
+      extraConfig = ''
+        allow 129.241.210.128/25;
+        allow 2001:700:300:1900::/64;
+        deny all;
+      '';
+
+      locations."/" = {
+        proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
+        proxyWebsockets = true;
+      };
+    };
+
+    "${machine}-old.pvv.ntnu.no" = {
+      forceSSL = true;
+      enableACME = true;
+      kTLS = true;
+      serverAliases = [
+        "${machine}-old.pvv.org"
      ];
      extraConfig = ''
        allow 129.241.210.128/25;
@@ -49,5 +90,6 @@ in {
        proxyPass = "http://${grg.settings.host}:${toString grg.settings.port}";
      };
    };
+  };
 }

--- a/packages/mediawiki-extensions/default.nix
+++ b/packages/mediawiki-extensions/default.nix
@@ -12,7 +12,7 @@ let
    name
  , commit
  , hash
-  , tracking-branch ? "REL1_41"
+  , tracking-branch ? "REL1_42"
  , kebab-name ? kebab-case-name name
  , fetchgit ? pkgs.fetchgit
  }:
@@ -33,63 +33,63 @@ in
 lib.mergeAttrsList [
  (mw-ext {
    name = "CodeEditor";
-    commit = "7d8447035e381d76387e38b92e4d1e2b8d373a01";
-    hash = "sha256-v2AlbP0vZma3qZyEAWGjZ/rLcvOpIMroyc1EixKjlAU=";
+    commit = "9f69f2cf7616342d236726608a702d651b611938";
+    hash = "sha256-sRaYj34+7aghJUw18RoowzEiMx0aOANU1a7YT8jivBw=";
  })
  (mw-ext {
    name = "CodeMirror";
-    commit = "a7b4541089f9b88a0b722d9d790e4cf0f13aa328";
-    hash = "sha256-clyzN3v3+J4GjdyhrCsytBrH7VR1tq5yd0rB+32eWCg=";
+    commit = "1a1048c770795789676adcf8a33c1b69f6f5d3ae";
+    hash = "sha256-Y5ePrtLNiko2uU/sesm8jdYmxZkYzQDHfkIG1Q0v47I=";
  })
  (mw-ext {
    name = "DeleteBatch";
-    commit = "cad869fbd95637902673f744581b29e0f3e3f61a";
-    hash = "sha256-M1ek1WdO1/uTjeYlrk3Tz+nlb/fFZH+O0Ok7b10iKak=";
+    commit = "b76bb482e026453079104d00f9675b4ab851947e";
+    hash = "sha256-GebF9B3RVwpPw8CYKDDT6zHv/MrrzV6h2TEIvNlRmcw=";
  })
  (mw-ext {
    name = "PluggableAuth";
-    commit = "4111a57c34e25bde579cce5d14ea094021e450c8";
-    hash = "sha256-aPtN8A9gDxLlq2+EloRZBO0DfHtE0E5kbV/adk82jvM=";
+    commit = "1da98f447fd8321316d4286d8106953a6665f1cc";
+    hash = "sha256-DKDVcAfWL90FmZbSsdx1J5PkGu47EsDQmjlCpcgLCn4=";
  })
  (mw-ext {
    name = "Popups";
-    commit = "f1bcadbd8b868f32ed189feff232c47966c2c49e";
-    hash = "sha256-PQAjq/X4ZYwnnZ6ADCp3uGWMIucJy0ZXxsTTbAyxlSE=";
+    commit = "9b9e986316b9662b1b45ce307a58dd0320dd33cf";
+    hash = "sha256-rSOZHT3yFIxA3tPhIvztwMSmSef/XHKmNfQl1JtGrUA=";
  })
  (mw-ext {
    name = "Scribunto";
-    commit = "7b99c95f588b06635ee3c487080d6cb04617d4b5";
-    hash = "sha256-pviueRHQAsSlv4AtnUpo2Cjci7CbJ5aM75taEXY+WrI=";
+    commit = "eb6a987e90db47b09b0454fd06cddb69fdde9c40";
+    hash = "sha256-Nr0ZLIrS5jnpiBgGnd90lzi6KshcsxeC+xGmNsB/g88=";
  })
  (mw-ext {
    name = "SimpleSAMLphp";
    kebab-name = "simple-saml-php";
-    commit = "ecb47191fecd1e0dc4c9d8b90a9118e393d82c23";
-    hash = "sha256-gKu+O49XrAVt6hXdt36Ru7snjsKX6g2CYJ0kk/d+CI8=";
+    commit = "fd4d49cf48d16efdb91ae8128cdd507efe84d311";
+    hash = "sha256-Qdtroew2j3AsZYlhAAUKQXXS2kUzUeQFnuR6ZHdFhAQ=";
  })
  (mw-ext {
    name = "TemplateData";
-    commit = "1ec66ce80f8a4322138efa56864502d0ee069bad";
-    hash = "sha256-Lv3Lq9dYAtdgWcwelveTuOhkP38MTu0m5kmW8+ltRis=";
+    commit = "836e3ca277301addd2578b2e746498ff6eb8e574";
+    hash = "sha256-UMcRLYxYn+AormwTYjKjjZZjA806goMY2TRQ4KoS5fY=";
  })
  (mw-ext {
    name = "TemplateStyles";
-    commit = "581180e898d6a942e2a65c8f13435a5d50fffa67";
-    hash = "sha256-zW8O0mzG4jYfQoKi2KzsP+8iwRCLnWgH7qfmDE2R+HU=";
+    commit = "06a2587689eba0a17945fd9bd4bb61674d3a7853";
+    hash = "sha256-C7j0jCkMeVZiLKpk+55X+lLnbG4aeH+hWIm3P5fF4fw=";
  })
  (mw-ext {
    name = "UserMerge";
-    commit = "c17c919bdb9b67bb69f80df43e9ee9d33b1ecf1b";
-    hash = "sha256-+mkzTCo8RVlGoFyfCrSb5YMh4J6Pbi1PZLFu5ps8bWY=";
+    commit = "41759d0c61377074d159f7d84130a095822bc7a3";
+    hash = "sha256-pGjA7r30StRw4ff0QzzZYUhgD3dC3ZuiidoSEz8kA8Q=";
  })
  (mw-ext {
    name = "VisualEditor";
-    commit = "90bb3d455892e25317029ffd4bda93159e8faac8";
-    hash = "sha256-SZAVELQUKZtwSM6NVlxvIHdFPodko8fhZ/uwB0LCFDA=";
+    commit = "a128b11fe109aa882de5a40d2be0cdd0947ab11b";
+    hash = "sha256-bv1TkomouOxe+DKzthyLyppdEUFSXJ9uE0zsteVU+D4=";
  })
  (mw-ext {
    name = "WikiEditor";
-    commit = "8dba5b13246d7ae09193f87e6273432b3264de5f";
-    hash = "sha256-vF9PBuM+VfOIs/a2X1JcPn6WH4GqP/vUJDFkfXzWyFU=";
+    commit = "21383e39a4c9169000acd03edfbbeec4451d7974";
+    hash = "sha256-aPVpE6e4qLLliN9U5TA36e8tFrIt7Fl8RT1cGPUWoNI=";
  })
 ]
--- a/secrets/bekkalokk/bekkalokk.yaml
+++ b/secrets/bekkalokk/bekkalokk.yaml
@@ -5,12 +5,9 @@ gitea:
    database: ENC[AES256_GCM,data:UlS33IdCEyeSvT6ngpmnkBWHuSEqsB//DT+3b7C+UwbD8UXWJlsLf1X8/w==,iv:mPRW5ldyZaHP+y/0vC2JGSLZmlkhgmkvXPk4LazkSDs=,tag:gGk6Z/nbPvzE1zG+tJC8Sw==,type:str]
    email-password: ENC[AES256_GCM,data:KRwC+aL1aPvJuXt91Oq1ttATMnFTnuUy,iv:ats8TygB/2pORkaTZzPOLufZ9UmvVAKoRcWNvYF1z6w=,tag:Do0fA+4cZ3+l7JJyu8hjBg==,type:str]
    passwd-ssh-key: ENC[AES256_GCM,data:L0lF0wvpayss1NU9m3A45cH0bCMQzODTFVrq6EPd1JHx54wIcoaRBYLmxXKXASzBlCg9zlwXMUIk3OQcS3kdzMKL0iqcSL2iicAcKjFIHyrWLqXgwV5pRSP/tRPcVw8KW8gz0bh33EgESs5ReddZ3VZ0Cy1s2YupMRQvBXr89k1+Hv70OWB6P06hvxhv/zKcMGI1N/dWLroMgrQuT9imw4+/Q1RqwzTYeEU+eUn24AM9GjcBg4qf3OI+6g0nXUat/upIYE28iF5J3lbUSmDSmirBLc8xgHLdOyyJPTObWYWYxlSL78T7IqiMm9lI3rtBlpJDDcn/YxZpVqN5bg2154GISNK+uR0TVSLdJ+drdGHIfIX3G78XSxf2L9rbJyRn8MQlgStfdBIQicLavQKVMrmj+XQfvEMez23WbPLjH4oViBQFI+GrOHOGy/f16cz8Sn4n+69OcsOeTxs3tKYdfq6r1XLYSJ/fe/zvxBpaZiyGXljsuyEdIyBL2A8D6uSXe3Nd3/DAdBtceFfIdN1olCdutixzVWgxaJnrel161z5A/4w=,iv:Uy46yY3jFYSvpxrgCHxRMUksnWfhf5DViLMvCXVMMl4=,tag:wFEJ5+icFrOKkc56gY0A5g==,type:str]
+    gpg-signing-key: ENC[AES256_GCM,data:y/g1rpsEgiGEJ9BGii6te166ABpg1jgsyYMT1Ji5njLbT8/juBBMc7BFEM5BcIxKpQGijymsB+Htl8CZAN4Bl3FHSRyrnXGuMCnveJfw1qTVjMa6soriHv7EdTDFPCp3TYMbs1OgY/bhGJIvp8e4hCVd4F3x8eAlFmiwHhkxr62qQNHjH7SRNIyUNibf/TTttOeEcercxOy7FeUE99D+CWG4pnJNEYyRHDdddalgpSJyZIJvPpXoKmeCDk3futnxiZ15Vr7bDS5u4dqnE+no7DKoZ5fvk38f/77JH3w/Qom7NCYSG6L+unJ3r3RKuuGMRDjdz09TPZ4APpmrlyOElfGMmm134g6mdhgXmwNCo65Z7VOd1OKFA/uyZm2b7XsT3tCgRalE8gBa0R3MBMi3JK+5KUdS6ZUvYXDt8D8C68ldM3K9E7lyeeHn775rV6L4JIXcj/NL1O23sXtjeVuUPQmsUesgYlllRaiTSTfY7K+yOIG3wqqCuCDSAeILQICkvod4iw4xdVMQzd8eQtbD6bCjOzHwvBcu+rOSN6ti+xOQ7bJ9+6xhCgJJsiADkp2q09cUu8mDbUh+YJxfu+oZhPomOJVDMSqfS4qNXcVM9mbak/L9KPR4b83GqTpmXHnDMlGe4BHGXrkIUKPsBQ5TmdckXbpRDBQFrnjVvFT+Gfx3xwHxWc9fbxcFID2wp69EzQrGC77bDPCFxBT5vAVwffGYUezPQEo25bKRpCWxTFTpiIQfACrwzZc/O9cmwDgrYN7bTZyrrp8cbyBtllZGYmXxLDkDOzIqzpLG3b0yJC2jSnw0f1DkU6M2mD/j9FRTVW1MVymyLPiZQ7T9QyZ3MekHEEY1QqmyiJMIOekSzC5+3Us6Nl32MeBrIry6NuV8ewIQF5bcZEHtSmZ0k/wBtK0fpFHUuc/vETFuRUiQw/InhN5W8iH78vFvflxBfg61Qp7PzEx0k0axwEc6VAKbEg/uFNL+fhUKKt7sYiEBmwg2Vsj3pyZgdmjPZEsOQ86+psaxv+2feH94wog47jDHFRrc4iRC5w7kZ6UJXHfZt9lkBbwl4qNwiOLlPnUUcR+CpTBpPoKD9ulidQGfcYY49+iE+PM5dAI2CtisKpLQiwmrvjOzB1a/rC9QnH679frgH5Ebb57WRL4uSAVNRdIvIGzAF5MNwQOu+cxKoiW6ZmuNJSb547XUB1UO,iv:aKzrgAV30sLfPEpgdQ26ZzdM3+gYtoSpZ9mNyqCqf/M=,tag:vjywN4qxh2zsCE3RPG6Yrw==,type:str]
    ssh-known-hosts: ENC[AES256_GCM,data:zlRLoelQeumMxGqPmgMTB69X1RVWXIs2jWwc67lk0wrdNOHUs5UzV5TUA1JnQ43RslBU92+js7DkyvE5enGzw7zZE5F1ZYdGv/eCgvkTMC9BoLfzHzP6OzayPLYEt3xJ5PRocN8JUAD55cuu4LgsuebuydHPi2oWOfpbSUBKSeCh6dvk5Pp1XRDprPS5SzGLW8Xjq98QlzmfGv50meI9CDJZVF9Wq/72gkyfgtb3YVdr,iv:AF06TBitHegfWk6w07CdkHklh4ripQCmA45vswDQgss=,tag:zKh7WVXMJN2o9ZIwIkby3Q==,type:str]
    import-user-env: ENC[AES256_GCM,data:wArFwTd0ZoB4VXHPpichfnmykxGxN8y2EQsMgOPHv7zsm6A+m2rG9BWDGskQPr5Ns9o=,iv:gPUzYFSNoALJb1N0dsbNlgHIb7+xG7E9ANpmVNZURQ0=,tag:JghfRy2OcDFWKS9zX1XJ9A==,type:str]
-    runners:
-        alpha: ENC[AES256_GCM,data:gARxCufePz+EMVwEwRsL2iZUfh9HUowWqtb7Juz3fImeeAdbt+k3DvL/Nwgegg==,iv:3fEaWd7v7uLGTy2J7EFQGfN0ztI0uCOJRz5Mw8V5UOU=,tag:Aa6LwWeW2hfDz1SqEhUJpA==,type:str]
-        beta: ENC[AES256_GCM,data:DVjS78IKWiWgf+PuijCZKx4ZaEJGhQr7vl+lc7QOg1JlA4p9Kux/tOD8+f2+jA==,iv:tk3Xk7lKWNdZ035+QVIhxXy2iJbHwunI4jRFM4It46E=,tag:9Mr6o//svYEyYhSvzkOXMg==,type:str]
-        epsilon: ENC[AES256_GCM,data:JMnZVBdiy+5oPyXgDpfYvy7qLzIEfHy09fQSBDpNG4zDXTil2pSKBKxk09h5xg==,iv:/8oXKJW6+sMBjDt51MqVAWjQPM5nk02Lv5QqbZsZ5ms=,tag:+Rx7ursfVWc0EcExCLgLhQ==,type:str]
 mediawiki:
    password: ENC[AES256_GCM,data:HsBuA1E7187roGnKuFPfPDYxA16GFjAUucgUtrdUFmcOzmTNiFH+NWY2ZQ==,iv:vDYUmmZftcrkDtJxNYKAJSx9j+AQcmQarC62QRHR4IM=,tag:3TKjNrGRivFWoK3djC748g==,type:str]
    postgres_password: ENC[AES256_GCM,data:XIOmrOVXWvMMcPJtmovhdyZvLlhmrsrwjuMMkdEY1NIXWjevj5XEkp6Cpw==,iv:KMPTRzu3H/ewfEhc/O0q3o230QNkABfPYF/D1SYL2R8=,tag:sFZiFPHWxwzD9HndPmH3pQ==,type:str]
@@ -97,8 +94,8 @@ sops:
            UHpLRkdQTnhkeGlWVG9VS1hkWktyckEKAdwnA9URLYZ50lMtXrU9Q09d0L3Zfsyr
            4UsvjjdnFtsXwEZ9ZzOQrpiN0Oz24s3csw5KckDni6kslaloJZsLGg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-12T21:56:27Z"
-    mac: ENC[AES256_GCM,data:bZ1BbVC6D+B6SFze2ReeCUcQamK/O14zH3YxCjWBwMC++w3niIiEx4Bq7Ulci5yuMld0luVsfUzHoqFN/+zvZbV2rGVk8lVRiTrpFoSZ78aUUgeHG9ROLXsR7T7rVhLWbl86y1G5LcKws7G55V0wAh6f58WjYYzwR8fnBmfW1Ko=,iv:7xtMdtXQB9uZirE/CkUSmeu0qnG++R7DUR7zn/Bo0lM=,tag:DH/BJPpAp//quDqKNXyHcg==,type:str]
+    lastmodified: "2024-12-09T21:18:23Z"
+    mac: ENC[AES256_GCM,data:scdduZPcJZgeT9LarRgxVr/obYsGrJAbMoLGJPPPp19qxOJMTdvYfMz8bxPjCikB4MacEgVZmcnKIn5aCzHJAnCI/7F2wm1DDtW9ZI5qbhDJKSSld+m2leOSPfR8VY/0qj6UNgGnwkwx7dfcAlv8cP2Sp3o1M2oyQxeXPr5FWEg=,iv:JEAwkCewMp0ERmYU62kZkbl7+FET1ZeRr6xeEwt6ioM=,tag:jxvli935X3JyZYe7fFbnLg==,type:str]
    pgp:
        - created_at: "2024-08-04T00:03:28Z"
          enc: |-
--- a/secrets/kvernberg/exhange-offline-master.priv
+++ b/secrets/kvernberg/exhange-offline-master.priv
@@ -1,24 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:dhVo1B+ZG1B6s0bTLgph4ipPmi0mveaObbJAffDQbpY=,iv:P5plvu4DQYa99cQZQ6B/gEFcSffu3lTY3+Z80Cfoj94=,tag:4xcqCbn6fFSmCbYmmEgQEg==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age19rlntxt0m27waa0n288g9wgpksa6ndlzz8eneeqya7w3zd7may0sqzhcvz",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5MzVHSE15Nk9MODQxc2g0\nbHlqNmFKclBYbUNKQTNUOGo0VThiaEZTVzJFCmU2YkYwMXlyeHM3ZzAxOWZpa3k4\nUUJLanVFbkNMa25RcGZmOTBsVmtzazQKLS0tIE1sTTBqT3VJMDFOYXl0T1JvcDRV\nRFpsZGNOZzFzMFc3YzcxeXdIK1d6QUUKzy0n7DJsOmrNvU03Tn6Zcj/l/kAylzzP\nhNnFLXfStdKl3A/qrzBPhTVbYD73yFkZuQ+bDr7/IMsHAmDsztuA9g==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnbEdBWjdEbmtNYWJHQnFj\nSU1yb0NYVG4xVlZkYTdUWUpDcGdmbFF6U1NrCjBlWFZkcC9FMVJLYUtDNlBTUWcw\nNHBwWFNESDBQQmJNb3NDN2tDekM4eUUKLS0tICtMVGc1L2JFQ1BqKzM3eWFPRmRQ\nWXlQUWpvdUdOUlZ1OFhtS0ErL0JKSlUKzxLKbsnXvEqnR2HVsTxNqmM7YPjWfCjG\nZ4Bf046NdseomkNuTvWuPzjzPTe4GvjudMYc4ODchkIMOo6hXyf5kw==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2024-11-17T01:12:23Z",
-		"mac": "ENC[AES256_GCM,data:aXIM/pmgVmfNSa+PwpfK6Efh/kCWXUqZNcKLkyhRwl++vaIBQUIQgQjv09hWHOF77V3ZjRQjh2E1uNe2baBLEmrDT5Au+7VABW+j49KX/vKMd+1l4w47l3DukOVnoo50bsOQFtH+amSl2P2imxpO15sjVDu9/nUeu2qXrtbIUh8=,iv:BQVs3P9p86uzTH2BfuSOxycpE6di4ZIwSz7OTZdcQPg=,tag:mT4Ek8dDbVINGp4Odt62zw==,type:str]",
-		"pgp": null,
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.9.1"
-	}
-}
--- a/secrets/ustetind/ustetind.yaml
+++ b/secrets/ustetind/ustetind.yaml
@@ -0,0 +1,90 @@
+gitea:
+    runners:
+        alpha: ENC[AES256_GCM,data:Hnq2guka4oERPIFCv1/ggrLjaePA7907VHXMStDQ7ll3hntTioT76qGOUJgfIw==,iv:wDPYuuL6VAWJakrz6asVRrzwRxqw0JDRes13MgJIT6E=,tag:ogFUeUirHVkCLN63nctxOw==,type:str]
+        beta: ENC[AES256_GCM,data:HmdjBvW8eO5MkzXf7KEzSNQAptF/RKN8Bh03Ru7Ru/Ky+eJJtk91aqSSIjFa+Q==,iv:Hz9HE3U6CFfZFcPmYMd6wSzZkSvszt92L2gV+pUlMis=,tag:LG3NfsS7B1EdRFvnP3XESQ==,type:str]
+        epsilon: ENC[AES256_GCM,data:wfGxwWwDzb6AJaFnxe/93WNZGtuTpCkLci/Cc5MTCTKJz6XlNuy3m/1Xsnw0hA==,iv:I6Zl+4BBAUTXym2qUlFfdnoLTHShu+VyxPMjRlFzMis=,tag:jjTyZs1Nzqlhjd8rAldxDw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIYVl6ZnI5TkhxK0JKNnlL
+            WE5YZUZ2T1JEbCtvSVUxemZ1QUs4R2pjMWc0ClJ0cnU0c0d5bU5jWU1aVGd6WE45
+            Wm9OT0xPaTJ3Y2kxMU5RTHdRKy81b2sKLS0tIEx4SkFoV240VUJieWFlc3hRWU1Y
+            SWlwZnNOT3paRHRsTC9CQUp5SlBvTncKdcMI8pWtsfBpgeUagOmZUXIC6svkfmwE
+            QF3GpWZgeVvo8e2oT2kBjerCDlUlzd0jJ8aK+B56xifTm7ii3oCAIA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3QVBaQWlSZk43dEtHVWF1
+            WmFBcmx3eFUvU2lrd0RCUGx3a2hDWHEzTUR3Cm9BclM3OU9SUnpySDZJZHRudmtO
+            Ulp5OEZvZmMyRGJvQXJnUDVLdVRJUVkKLS0tIHE3M3MycE9pU1huYUREN3luWEZV
+            WlNuN3BWeHhqL1dEOUJBSVNTaVJ3eTgKb5MRfeaay22PI9V5hni5mhnb0QF8PG8H
+            bKWbc2SwdMNolrxhUiiIhdppEtXGHqLyBel786tuOdtEwVcy+m/rtA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQaDB6enozMFpqcWxFdU93
+            MEg5RTRzZExzWGppenlBTlZZRlpqWDBPT0UwCnhOaXI5R3Jrd0hWY0xqc1VXaDJZ
+            TUxwSTZDcHd0bnZPR2N2d0JVTUJONnMKLS0tIENzOW9PM0tQSndVNmF1bTZ4anpw
+            b1RzL0NEOWg0dGZUa0Jpd3hiTlRGSm8KleRV5c/Xoe0B1VtnR3y0sgXpmhMS8pKl
+            TWaAQTRlM9X2Pk5M/J/bu369ncmw/kycJKjK6W1yluaGwBNuEP+K4Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0N1JvRVE0Y0xOMERMVXdB
+            enZiNk1DZTJTUnluRVBIWm9WNmFPc21rU0FZCjBIeHErSHgveFFFdk9ybWwrRXZG
+            WGpVcHliUW9Qb3dLb2Q0aWlrZmpiVm8KLS0tIG0wcXJVK2dMeG9NUTFQSzVtY2RG
+            UE1FS3MvSXlxdEtJVWxJVDRFSkRmQkkK/2z7Lu6LVd6RLZAXKs+JsPc+1kcqFAET
+            0zlTTTU0goTBLuXZ7uxFVZtqc1Nmoarf5Ksm/zcZ2B80P5ox9CzcWQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4SFpKcVBTTlp3SXhVaGQy
+            QVVEV3h6dTZVcmx6aFc1eHF4UzJPbXQ2RnhvCkZiOEYydWhCYUtwcUdieGpBeTZh
+            Z3dYVno5bFNkOUszNHBJNTdQWS9jUTQKLS0tIEhPVEdLK0RaclVvdklFNUJCcHNi
+            OXVobVJCTjhQZ2RTQ21xK2dUY0h5RGcKcPBgD5FIWuyQBhmPt5aqrWgEG1tzhtr0
+            gVyLxgtMFGeeShjdpivgcWI/GZZlhWJilJOoZo7f6TknvCIIKsrUSA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYWlhiS1dxekZGZkRCQU9O
+            SktHRHRXL2VhNUJSRVhBeEM5UEZ1R0pFdXdrCnZQOUZaYitpSlJ0aXFpZXFrRFJj
+            MmZiLytvekZtVXYzamJDakc1RjdIREEKLS0tICtiOTZMRGZuWEdHTmZwRjZ2dUNT
+            aU4xWjVYYlNvSmYxajVGdzk5dTQ4WG8Klq12bSegsW29xp4qteuCB5Tzis6EhVCk
+            53jqtYe5UG9MjFVQYiSi2jJz5/dxfqSINMZ/Y/EB5LxbwgbFws8Yuw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-12-12T12:20:19Z"
+    mac: ENC[AES256_GCM,data:D9/NAd/zrF6pHFdZjTUqI+u4WiwJqt0w5Y+SYCS1o/dAXJE/ajHzse/vCSGXZIjP0yqe+S/NyTvhf+stw2B4dk6Njtabjd+PhG0hR4L0X07FtFqzB3u5pLHCb0bH9QLG5zWcyMkwNiNTCvhRUZzbcqLEGqqJ7ZjZAEUfYSR+Jls=,iv:5xPfODPxtQjgbl8delUHsmhD0TI2gHjrxpHV+qiFE00=,tag:HHLo5G8jhy/sKB3R+sKmwQ==,type:str]
+    pgp:
+        - created_at: "2024-12-09T21:17:27Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA0av/duuklWYARAAv2XS2jzoymOzpRHquUbYpUtbIeKXhPS8i9uk2zBvSKnr
+            b/jZCpvtkCcSz1UFm+HzSn/i1eNkj9ghObisifvqY6JbO0DIa1jFlx1TfE9pj8dE
+            rrNTsYfxNwdGOvklPBHm3vKY5qPiGlE71TaKkJcO79vE5jxwhUqzWI9SWAZY3cFw
+            IVJN44DT0I4ctTlwPM9eAYYodL8QP8OMXHJ/mjI4SPODRsvrOyy6rpip40Q+dU/N
+            DwRupzrRlxJ8BDSh/x6J/AryZSwkmChX9cYyGaDknJ3ONQ0XLhVUtLkAvPWtWeow
+            6NVHmUOJ39ockT1clhYy2P5rQTraZESuI7vaSS9zVIuScBnJwbSRZ5xgxSD6Fj+C
+            Y/JyogXa8FtyG6xeMgIwW7t/m/rbXL5OkP4w8D+CJs+4I55WXz054XOZ937EisVH
+            XAlNBIHixjQVckbb+sS7rEmegfoC+rvOXA0irpwXFiapAbMGUePCwQHdSBMP8orC
+            Tb3E8kqHATN40b8CpUBcPw6HCQKmbhe8o+R8NG6TZh6JH7kSztl2+SIIuMzhDflr
+            1AphY047Ku2RANaWfo+xyVZMWgAQcnoaUOeYaHJ9nZ7f2klJ3fnRtdXJn1gcO3i3
+            NZVRjjYHJgzCVCIZJa1b1TMGep84naF7NmRkNlS4wyv6MXGqSpHHZUGUBAQOCMPS
+            XAEqjZt8va0LKtsPsBOTGQDuzTar+2069fu6TjS07mJM2sTp/G8bGBnvjc0TIplZ
+            M5FOiCilI9yX7vQ0O3LUKJW5zELWnW2d+3okpGjgkr0BFERtM7BMCp6nxR6+
+            =rEY5
+            -----END PGP MESSAGE-----
+          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
+    unencrypted_suffix: _unencrypted
+    version: 3.9.2
--- a/users/frero.nix
+++ b/users/frero.nix
@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+{
+  users.users.frero = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" "drift" "nix-builder-users" ];
+    shell = pkgs.zsh;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII09JbtSUMurvmHpJ7TmUQctXpNVhjFYhoJ3+1ZITmMx"
+    ];
+  };
+}
--- a/values.nix
+++ b/values.nix
@@ -31,6 +31,10 @@ in rec {
      ipv4 = pvv-ipv4 168;
      ipv6 = pvv-ipv6 168;
    };
+    dagali = {
+      ipv4 = pvv-ipv4 185;
+      ipv6 = pvv-ipv6 185;
+    };
    ildkule = {
      ipv4 = "129.241.153.213";
      ipv4_internal = "192.168.12.209";
@@ -60,9 +64,9 @@ in rec {
      ipv4 = pvv-ipv4 204;
      ipv6 = pvv-ipv6 "1:4f"; # Wtf øystein og daniel why
    };
-    kvernberg = {
-      ipv4 = pvv-ipv4 206;
-      ipv6 = pvv-ipv6 "1:206";
+    ustetind = {
+      ipv4 = pvv-ipv4 234;
+      ipv6 = pvv-ipv6 234;
    };
  };
Author	SHA1	Message	Date
Felix Albrigtsen	051dd82f57	WIP: Move krb5 realm to pvv.local, make sane ldap structure	2025-03-11 14:14:07 +01:00
Øystein Tveit	735d590f85	WIP: set up heimdal-openldap-sasl stack	2025-03-11 14:14:07 +01:00
Øystein Tveit	57a2bf8bf1	hosts/dagali: init	2025-03-11 14:14:02 +01:00
h7x4	a3c88b7869	bekkalokk/gitea: take a dump	2025-03-10 20:06:29 +01:00
h7x4	4aa994e7a3	bekkalokk/gitea: rename gitea customization service to have gitea prefix	2025-03-10 19:59:16 +01:00
h7x4	fc64139739	bekkalokk/gitea: bigger icons	2025-03-10 19:58:53 +01:00
h7x4	75b0c00212	bekkalokk/gitea: move customization to different file	2025-03-10 18:01:31 +01:00
Daniel Olsen	94d73b34ad	bluemap: generate web folder if it doesnt exist before rendering	2025-03-02 02:32:32 +01:00
Daniel Olsen	bf50d6478b	bluemap: 5.4 -> 5.7	2025-03-02 01:27:09 +01:00
h7x4	e9dc0d85a0	flake.lock: bump	2025-03-01 21:31:56 +01:00
Daniel Olsen	a009b05977	bicep/matrix/coturn: coturn is actually fixed	2025-02-16 02:01:29 +01:00
Øystein Tveit	8a8f5659fb	gergle: big if true	2025-01-25 19:59:43 +01:00
Felix Albrigtsen	13c921c47b	bekkalokk: Update nettsiden (re-enable events)	2025-01-17 23:11:19 +01:00
h7x4	819fcef4c2	flake.lock: bump greg-ng	2025-01-11 15:02:00 +01:00
h7x4	102a6f9011	flake.lock: bump nix-gitea-themes	2025-01-10 18:51:41 +01:00
h7x4	86e68f496e	bekkalokk/gitea: add declarative label set 'projects'	2025-01-10 18:51:40 +01:00
h7x4	394ff94033	flake.nix: move grz projects from `Projects` to `Grzegorz`	2025-01-06 16:34:22 +01:00
h7x4	6cb7f576a5	bekkalokk/gitea-scripts: add `Grzegorz` organization	2025-01-06 16:34:22 +01:00
Øystein Tveit	edb448f7a0	ustetind/gitea-runners: update docker image, update registration keys	2024-12-22 23:17:41 +01:00
h7x4	4507ffe2ab	base/auto-upgrade: switch ref back to main	2024-12-22 23:04:08 +01:00
Felix Albrigtsen	882a8f2e88	bekkalokk: Update nettsiden	2024-12-21 23:50:53 +01:00
Øystein Tveit	65da25da7e	packages/mediawiki-extensions: update all	2024-12-10 21:05:21 +01:00
h7x4	fd81d61a56	common/logrotate: remove custom hardening now that nixpkgs provides it	2024-12-10 21:05:21 +01:00
Daniel Olsen	2776273a27	flake update	2024-12-10 21:05:20 +01:00
Daniel Olsen	ebc5b269ef	24.11	2024-12-10 21:05:20 +01:00
h7x4	850d0b0ec5	bekkalokk/gitea-web: fix SSH access	2024-12-10 21:05:06 +01:00
h7x4	02792fc20e	bekkalokk/gitea: fix api pagination for web secret provider	2024-12-10 19:35:10 +01:00
Øystein Tveit	40dd069a52	ustetind/gitea-runners: fix podman dns	2024-12-09 23:25:54 +01:00
h7x4	04a838fc62	flake.nix: nixlib -> lib	2024-12-09 22:33:39 +01:00
Øystein Tveit	1f85208587	hosts/ustetind: set up gitea-runners	2024-12-09 22:24:54 +01:00
Øystein Tveit	c10c6d5a09	hosts/ustetind: init	2024-12-09 21:31:30 +01:00
h7x4	6301688c95	common/smartd: only run on non-virtualized hardware It's still part of the simulation tho	2024-12-09 21:03:50 +01:00
h7x4	0ed0a3a504	flake.nix: make `outputs.inputs` buildable	2024-12-08 00:29:59 +01:00
h7x4	5242d99260	bekkalokk/gitea: add gpg signing key	2024-11-24 03:23:54 +01:00
Fredrik Robertsen	c60597dc5a	Merge pull request 'Let smartd send mail notification' (!92 ) from add-mail-to-smartd into main Reviewed-on: https://git.pvv.ntnu.no/Drift/pvv-nixos-config/pulls/92 Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Closes #92	2024-11-24 01:09:58 +01:00
frero	69462bf486	let smartd send mail notification	2024-11-24 01:01:55 +01:00
Oystein Kristoffer Tveit	7d4ccf1972	Merge pull request 'Add user frero' (!91 ) from add-user-frero into main Reviewed-on: https://git.pvv.ntnu.no/Drift/pvv-nixos-config/pulls/91	2024-11-23 22:40:43 +01:00
frero	c87a81eeee	users: add `frero`	2024-11-23 22:39:53 +01:00