ildkule/loki: restrict incoming connections to pvv + ntnu

{ildkule/loki,base/fluentbit}: send data over https
ildkule/loki: firewall all endpoints except push API
2026-06-16 09:39:14 +02:00 · 2026-06-13 03:23:12 +09:00 · 2026-06-13 03:22:18 +09:00 · 2026-06-13 03:11:13 +09:00 · 2026-06-13 02:54:28 +09:00 · 2026-06-13 01:41:05 +09:00
116 changed files with 4188 additions and 4456 deletions
@@ -7,16 +7,13 @@ jobs:
  evals:
    runs-on: debian-latest
    steps:
+    - name: Install sudo
+      run: apt-get install --update --assume-yes sudo
+
    - uses: actions/checkout@v6

-    - name: Install sudo
-      run: apt-get update && apt-get -y install sudo
-
    - uses: https://github.com/cachix/install-nix-action@v31

-    - name: Configure Nix
-      run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
-
    - name: Build topology graph
      run: nix build .#topology -L

@@ -6,8 +6,11 @@ jobs:
  evals:
    runs-on: debian-latest
    steps:
+    - name: Install sudo
+      run: apt-get install --update --assume-yes sudo
+
    - uses: actions/checkout@v6
-    - run: apt-get update && apt-get -y install sudo
+
    - uses: https://github.com/cachix/install-nix-action@v31
-    - run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
+
    - run: nix flake check
@@ -10,19 +10,18 @@ keys:
  - &user_vegardbm age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune

  # Hosts
-  - &host_bakke age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
  - &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
  - &host_bicep age19nk55kcs7s0358jpkn75xnr57dfq6fq3p43nartvsprx0su22v7qcgcjdx
-  - &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
+  - &host_ildkule age102e6y8gah0ntr6fxqnkpepc8ar29p6ls7ks9ka7v8w87q8scm9yqmc2u8d
  - &host_kommode age1mt4d0hg5g76qp7j0884llemy0k2ymr5up8vfudz6vzvsflk5nptqqd32ly
-  - &host_lupine-1 age1fkrypl6fu4ldsa7te4g3v4qsegnk7sd6qhkquuwzh04vguy96qus08902e
-  - &host_lupine-2 age1mu0ej57n4s30ghealhyju3enls83qyjua69986la35t2yh0q2s0seruz5n
-  - &host_lupine-3 age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
-  - &host_lupine-4 age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
-  - &host_lupine-5 age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
-  - &host_skrott age1lpkju2e053aaddpgsr4ef83epclf4c9tp4m98d35ft2fswr8p4tq2ua0mf
-  - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
+  - &host_lupine-1 age18lta9d683yekz487xwtd99da236d8mgk4ftlmv2jffx858p9qf2s9j868l
+  - &host_lupine-2 age1e0a4ru707v637wzmuxqv0xywmlkhunzgyfy4mrkjc7a23qq8msgq7nqtvt
+  - &host_lupine-3 age1wmrrhd5deatmgflkas636u3rzuk46u9knl02v4t39ncs37xqquhq9vwzye
+  - &host_lupine-4 age1ml48zztcmnrdrhrdsjrlyxf09jtmjgz46u8td4zm59wn3fm4g57qs4wg0l
+  - &host_lupine-5 age12gws5nws69vxryd3kt7q0ayngch90efmhqcrfhnnsmj00lkgxd4qsdkvqn
  - &host_skrot age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr
+  - &host_temmie age10avsdvqger25z0lyzlq8v7xfzcmypkmjsswswaxwqnpnl6x9wcjq0uv2n7
+  - &host_gluttony age12czfkvuw9pjk5qny5c6m2hjhd634cj9r4dsa3ss5zkux5h4vvc7s7k4urq

 creation_rules:
  # Global secrets
@@ -93,19 +92,6 @@ creation_rules:
      pgp:
      - *user_oysteikt

-  - path_regex: secrets/ustetind/[^/]+\.yaml$
-    key_groups:
-    - age:
-      - *host_ustetind
-      - *user_danio
-      - *user_felixalb
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
-      - *user_vegardbm
-      pgp:
-      - *user_oysteikt
-
  - path_regex: secrets/lupine/[^/]+\.yaml$
    key_groups:
    - age:
@@ -123,31 +109,6 @@ creation_rules:
      pgp:
      - *user_oysteikt

-  - path_regex: secrets/bakke/[^/]+\.yaml$
-    key_groups:
-    - age:
-      - *host_bakke
-      - *user_danio
-      - *user_felixalb
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
-      - *user_vegardbm
-      pgp:
-      - *user_oysteikt
-
-  - path_regex: secrets/skrott/[^/]+\.yaml$
-    key_groups:
-    - age:
-      - *host_skrott
-      - *user_danio
-      - *user_felixalb
-      - *user_pederbs_sopp
-      - *user_pederbs_nord
-      - *user_pederbs_bjarte
-      - *user_vegardbm
-      pgp:
-      - *user_oysteikt
  - path_regex: secrets/skrot/[^/]+\.yaml$
    key_groups:
    - age:
@@ -160,3 +121,29 @@ creation_rules:
      - *user_vegardbm
      pgp:
      - *user_oysteikt
+
+  - path_regex: secrets/temmie/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_temmie
+      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      - *user_vegardbm
+      pgp:
+      - *user_oysteikt
+
+  - path_regex: secrets/gluttony/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_gluttony
+      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      - *user_vegardbm
+      pgp:
+      - *user_oysteikt
@@ -39,11 +39,13 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
 |  bikkje                    | Virtual  | Experimental login box                                    |
 | [brzeczyszczykiewicz][brz] | Physical | Shared music player                                       |
 | [georg][geo]               | Physical | Shared music player                                       |
+| [gluttony][glu]            | Virtual  | General purpose compute                                   |
 | [ildkule][ild]             | Virtual  | Logging and monitoring host, prometheus, grafana, ...     |
 | [kommode][kom]             | Virtual  | Gitea + Gitea pages                                       |
 | [lupine][lup]              | Physical | Gitea CI/CD runners                                       |
 |  shark                     | Virtual  | Test host for authentication, absolutely horrendous       |
-| [skrot/skrott][skr]        | Physical | Kiosk, snacks and soda                                    |
+| [skrot][skr]               | Physical | Kiosk, snacks and soda                                    |
+| [temmie][tem]              | Virtual  | User websites                                             |
 | [wenche][wen]              | Virtual  | Nix-builders, general purpose compute                     |

 ## Documentation
@@ -57,8 +59,10 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
 [bic]: https://wiki.pvv.ntnu.no/wiki/Maskiner/bicep
 [brz]: https://wiki.pvv.ntnu.no/wiki/Maskiner/brzęczyszczykiewicz
 [geo]: https://wiki.pvv.ntnu.no/wiki/Maskiner/georg
+[glu]: https://wiki.pvv.ntnu.no/wiki/Maskiner/gluttony
 [ild]: https://wiki.pvv.ntnu.no/wiki/Maskiner/ildkule
 [kom]: https://wiki.pvv.ntnu.no/wiki/Maskiner/kommode
 [lup]: https://wiki.pvv.ntnu.no/wiki/Maskiner/lupine
-[skr]: https://wiki.pvv.ntnu.no/wiki/Maskiner/Skrott
+[skr]: https://wiki.pvv.ntnu.no/wiki/Maskiner/Skrot
+[tem]: https://wiki.pvv.ntnu.no/wiki/Maskiner/temmie
 [wen]: https://wiki.pvv.ntnu.no/wiki/Maskiner/wenche
@@ -1,6 +1,8 @@
 {
+  config,
  pkgs,
  lib,
+  inputs,
  fp,
  ...
 }:
@@ -10,7 +12,9 @@
    (fp /users)
    (fp /modules/snakeoil-certs.nix)

-    ./flake-input-exporter.nix
+    ./mitigations.nix
+
+    ./hardening.nix
    ./networking.nix
    ./nix.nix
    ./programs.nix
@@ -20,6 +24,7 @@
    ./services/acme.nix
    ./services/auto-upgrade.nix
    ./services/dbus.nix
+    ./services/fluentbit.nix
    ./services/fwupd.nix
    ./services/irqbalance.nix
    ./services/journald-upload.nix
@@ -28,23 +33,34 @@
    ./services/openssh.nix
    ./services/polkit.nix
    ./services/postfix.nix
+    ./services/prometheus-flake-input-exporter.nix
    ./services/prometheus-node-exporter.nix
    ./services/prometheus-systemd-exporter.nix
-    ./services/promtail.nix
    ./services/roowho2.nix
+    ./services/rsyslogd.nix
+    ./services/scrutiny-collector.nix
    ./services/smartd.nix
    ./services/thermald.nix
+    ./services/timesyncd.nix
    ./services/uptimed.nix
    ./services/userborn.nix
    ./services/userdbd.nix
  ];

+  system.nixos.tags = lib.optionals (inputs.self.sourceInfo ? dirtyRev) [ "dirty" ];
+
+  specialisation."auto-upgrade".configuration = {
+    system.nixos.tags = [ "auto" ];
+  };
+
  boot.tmp.cleanOnBoot = lib.mkDefault true;
  boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;

  boot.loader.systemd-boot.enable = lib.mkDefault true;
  boot.loader.efi.canTouchEfiVariables = lib.mkDefault true;

+  services.btrfs.autoScrub.enable = lib.mkDefault (lib.any ({ fsType, ... }: fsType == "btrfs") (lib.attrValues config.fileSystems));
+
  time.timeZone = "Europe/Oslo";

  i18n.defaultLocale = "en_US.UTF-8";
@@ -68,18 +84,16 @@
    fi
  '';

-  # security.lockKernelModules = true;
-  security.protectKernelImage = true;
  security.sudo.execWheelOnly = true;
  security.sudo.extraConfig = ''
    Defaults lecture = never
  '';

  # These are servers, sleep is for the weak
-  systemd.sleep.extraConfig = lib.mkDefault ''
-    AllowSuspend=no
-    AllowHibernation=no
-  '';
+  systemd.sleep.settings.Sleep = {
+    AllowSuspend = lib.mkDefault false;
+    AllowHibernation = lib.mkDefault false;
+  };

  # users.mutableUsers = lib.mkDefault false;

@@ -1,55 +0,0 @@
-{
-  config,
-  inputs,
-  lib,
-  pkgs,
-  values,
-  ...
-}:
-let
-  data = lib.flip lib.mapAttrs inputs (
-    name: input: {
-      inherit (input)
-        lastModified
-        ;
-    }
-  );
-  folder = pkgs.writeTextDir "share/flake-inputs" (
-    lib.concatMapStringsSep "\n" (
-      { name, value }: ''nixos_last_modified_input{flake="${name}"} ${toString value.lastModified}''
-    ) (lib.attrsToList data)
-  );
-  port = 9102;
-in
-{
-  services.nginx.virtualHosts."${config.networking.fqdn}-nixos-metrics" = {
-    serverName = config.networking.fqdn;
-    serverAliases = [
-      "${config.networking.hostName}.pvv.org"
-    ];
-    locations."/metrics" = {
-      root = "${folder}/share";
-      tryFiles = "/flake-inputs =404";
-      extraConfig = ''
-        default_type text/plain;
-      '';
-    };
-    listen = [
-      {
-        inherit port;
-        addr = "0.0.0.0";
-      }
-    ];
-    extraConfig = ''
-      allow ${values.hosts.ildkule.ipv4}/32;
-      allow ${values.hosts.ildkule.ipv6}/128;
-      allow 127.0.0.1/32;
-      allow ::1/128;
-      allow ${values.ipv4-space};
-      allow ${values.ipv6-space};
-      deny all;
-    '';
-  };
-
-  networking.firewall.allowedTCPPorts = [ port ];
-}
@@ -0,0 +1,71 @@
+{ ... }:
+{
+  boot.blacklistedKernelModules = [
+    # Obscure network protocols
+    "appletalk"
+    "atm"
+    "ax25"
+    "batman-adv"
+    "can"
+    "dccp"
+    "ipx"
+    "llc"
+    "n-hdlc"
+    "netrom"
+    "p8022"
+    "p8023"
+    "psnap"
+    "rds"
+    "rose"
+    "sctp"
+    "tipc"
+
+    # Filesystems we don't use
+    "adfs"
+    "affs"
+    "befs"
+    "bfs"
+    "cifs"
+    "cramfs"
+    "efs"
+    "exofs"
+    "freevxfs"
+    "gfs2"
+    "hfs"
+    "hfsplus"
+    "hpfs"
+    "jffs2"
+    "jfs"
+    "minix"
+    "nilfs2"
+    "ntfs"
+    "omfs"
+    "orangefs"
+    "qnx4"
+    "qnx6"
+    "sysv"
+    "ubifs"
+    "udf"
+    "ufs"
+
+    # Legacy hardware
+    "pcspkr"
+    "floppy"
+    "parport"
+    "ppdev"
+
+    # Other stuff we don't use
+    "firewire-core"
+    "firewire-ohci"
+    "ksmbd"
+    "ib_core"
+    "l2tp_eth"
+    "l2tp_netlink"
+    "l2tp_ppp"
+    "nfc"
+    "soundwire"
+  ];
+
+  # security.lockKernelModules = true;
+  security.protectKernelImage = true;
+}
@@ -0,0 +1,24 @@
+{ pkgs, lib, ... }:
+let
+  modulesToBan = [
+    # copy.fail
+    "af_alg"
+    "algif_aead"
+    "algif_hash"
+    "algif_rng"
+    "algif_skcipher"
+
+    # dirtyfrag / Fragnesia
+    "esp4"
+    "esp6"
+    "rxrpc"
+
+    # PinTheft
+    "rds"
+  ];
+in
+{
+  boot.blacklistedKernelModules = modulesToBan;
+
+  boot.extraModprobeConfig = lib.concatMapStringsSep "\n" (mod: "install ${mod} ${lib.getExe' pkgs.coreutils "false"}") modulesToBan;
+}
@@ -8,6 +8,6 @@

  services.resolved = {
    enable = lib.mkDefault true;
-    dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
+    settings.Resolve.DNSSEC = false; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
  };
 }
@@ -2,7 +2,7 @@
 {
  security.acme = {
    acceptTerms = true;
-    defaults.email = "acme-drift@pvv.ntnu.no";
+    defaults.email = "drift@pvv.ntnu.no";
  };

  # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
@@ -13,6 +13,7 @@ in

      "--refresh"
      "--no-write-lock-file"
+      "--specialisation auto-upgrade"
      # --update-input is deprecated since nix 2.22, and removed in lix 2.90
      # as such we instead use --override-input combined with --refresh
      # https://git.lix.systems/lix-project/lix/issues/400
@@ -0,0 +1,137 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.fluent-bit;
+in
+{
+  services.fluent-bit = {
+    enable = lib.mkDefault true;
+    settings = {
+      service = {
+        flush = 1;
+        log_level = "warn";
+
+        http_server = "on";
+        http_listen = "127.0.0.1";
+        http_port = 28183;
+
+        # filesystem-backed buffering so logs survives potential outages.
+        "storage.path" = "/var/lib/fluent-bit/storage";
+        "storage.sync" = "normal";
+        "storage.max_chunks_up" = 64;
+        "storage.backlog.mem_limit" = "16M";
+      };
+
+      pipeline = {
+        inputs = [{
+          name = "systemd";
+          tag = "journal.*";
+
+          db = "/var/lib/fluent-bit/journal.db";
+          read_from_tail = true;
+          strip_underscores = true;
+          lowercase = true;
+          max_entries = 1000;
+          "storage.type" = "filesystem";
+        }];
+
+        filters = [{
+          name = "modify";
+          match = "journal.*";
+          rename = [
+            "hostname host"
+            "priority level"
+            "systemd_unit unit"
+          ];
+        }] ++ (lib.mapAttrsToList (k: v: {
+          name = "modify";
+          match = "journal.*";
+          condition = "Key_value_equals level ${k}";
+          set = "level ${v}";
+        }) {
+          "7" = "debug";
+          "6" = "info";
+          "5" = "notice";
+          "4" = "warning";
+          "3" = "error";
+          "2" = "crit";
+          "1" = "alert";
+          "0" = "emergency";
+        });
+
+        outputs = [{
+          name = "loki";
+          match = "*";
+
+          host = "loki.pvv.ntnu.no";
+          port = 443;
+          tls = "on";
+          "tls.verify" = "on";
+          uri = "/loki/api/v1/push";
+          compress = "gzip";
+
+          labels = lib.concatStringsSep ", " [
+            "job=systemd-journal"
+          ];
+          label_keys = lib.concatMapStringsSep "," (k: "$" + k) [
+            "host"
+            "unit"
+            "level"
+          ];
+
+          # JSON is probably fine for now, then we just extract the keys we want with the grafana web ui
+          # line_format = "key_value";
+          # drop_single_key = true;
+
+          "storage.total_limit_size" = "256M";
+        }];
+      };
+    };
+  };
+
+  systemd.services.fluent-bit = lib.mkIf cfg.enable {
+    serviceConfig = {
+      StateDirectory = "fluent-bit";
+
+      # NOTE: This hardening might be way too strong for general purpose use, don't upstream this.
+      AmbientCapabilities = [ "" ];
+      CapabilityBoundingSet = [ "" ];
+      DeviceAllow = [ "" ];
+      LockPersonality = true;
+      # Lua JIT, maybe other things
+      MemoryDenyWriteExecute = false;
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateMounts = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+        "~@resources"
+      ];
+      UMask = "0077";
+
+      BindReadOnlyPaths = [
+        "/run/systemd/journal"
+      ];
+    };
+  };
+}
@@ -6,8 +6,7 @@ in
  services.journald.upload = {
    enable = lib.mkDefault true;
    settings.Upload = {
-      # URL = "https://journald.pvv.ntnu.no:${toString config.services.journald.remote.port}";
-      URL = "https://${values.hosts.ildkule.ipv4}:${toString config.services.journald.remote.port}";
+      URL = "https://journald.pvv.ntnu.no:${toString config.services.journald.remote.port}";
      ServerKeyFile = "-";
      ServerCertificateFile = "-";
      TrustedCertificateFile = "-";
@@ -1,18 +1,5 @@
 { config, lib, ... }:
 {
-  # nginx return 444 for all nonexistent virtualhosts
-
-  systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
-
-  environment.snakeoil-certs = lib.mkIf config.services.nginx.enable {
-    "/etc/certs/nginx" = {
-      owner = "nginx";
-      group = "nginx";
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
-
  services.nginx = {
    recommendedTlsSettings = true;
    recommendedProxySettings = true;
@@ -60,17 +47,8 @@
          ];
        }
      ];
-      sslCertificate = "/etc/certs/nginx.crt";
-      sslCertificateKey = "/etc/certs/nginx.key";
-      addSSL = true;
-      extraConfig = "return 444;";
+    };
  };

-    ${config.networking.fqdn} = {
-      sslCertificate = lib.mkDefault "/etc/certs/nginx.crt";
-      sslCertificateKey = lib.mkDefault "/etc/certs/nginx.key";
-      addSSL = lib.mkDefault true;
-      extraConfig = lib.mkDefault "return 444;";
-    };
-  };
+  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
 }
@@ -6,9 +6,12 @@ in
  security.polkit.enable = true;

  environment.etc."polkit-1/rules.d/9-nixos-overrides.rules".text = lib.mkIf cfg.enable ''
-    polkit.addAdminRule(function(action, subject) {
-        if(subject.isInGroup("wheel")) {
-            return ["unix-user:"+subject.user];
+    polkit.addRule(function(action, subject) {
+       if (
+           action.id.startsWith("org.freedesktop.systemd1.") &&
+           subject.isInGroup("wheel")
+       ) {
+           return polkit.Result.AUTH_SELF_KEEP;
         }
     });
  '';
@@ -0,0 +1,47 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  values,
+  ...
+}:
+let
+  data = lib.flip lib.mapAttrs inputs (
+    name: input: {
+      inherit (input)
+        lastModified
+        ;
+    }
+  );
+  folder = pkgs.writeTextDir "share/flake-inputs" (
+    lib.concatMapStringsSep "\n" (
+      { name, value }: ''nixos_last_modified_input{flake="${name}"} ${toString value.lastModified}''
+    ) (lib.attrsToList data)
+  );
+in
+{
+  services.nginx = {
+    enable = lib.mkDefault true;
+
+    virtualHosts.${config.networking.fqdn} = lib.mkIf config.services.nginx.enable {
+      forceSSL = true;
+      enableACME = true;
+      kTLS = true;
+
+      locations."/prometheus-nixos-flake-input-exporter/metrics" = {
+        root = "${folder}/share";
+        tryFiles = "/flake-inputs =404";
+        extraConfig = ''
+          default_type text/plain;
+
+          allow 127.0.0.1;
+          allow ::1;
+          allow ${values.hosts.ildkule.ipv4};
+          allow ${values.hosts.ildkule.ipv6};
+          deny all;
+        '';
+      };
+    };
+  };
+}
@@ -5,19 +5,30 @@ in
 {
  services.prometheus.exporters.node = {
    enable = lib.mkDefault true;
+    listenAddress = "127.0.0.1";
    port = 9100;
    enabledCollectors = [ "systemd" ];
  };

-  systemd.services.prometheus-node-exporter.serviceConfig = lib.mkIf cfg.enable {
-    IPAddressDeny = "any";
-    IPAddressAllow = [
-      "127.0.0.1"
-      "::1"
-      values.hosts.ildkule.ipv4
-      values.hosts.ildkule.ipv6
-    ];
-  };
+  services.nginx = {
+    enable = lib.mkDefault true;

-  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
+    virtualHosts.${config.networking.fqdn} = lib.mkIf config.services.nginx.enable {
+      forceSSL = true;
+      enableACME = true;
+      kTLS = true;
+
+      locations."/prometheus-node-exporter/metrics" = {
+        proxyPass = "http://localhost:${toString cfg.port}/metrics";
+
+        extraConfig = ''
+          allow 127.0.0.1;
+          allow ::1;
+          allow ${values.hosts.ildkule.ipv4};
+          allow ${values.hosts.ildkule.ipv6};
+          deny all;
+        '';
+      };
+    };
+  };
 }
@@ -5,6 +5,7 @@ in
 {
  services.prometheus.exporters.systemd = {
    enable = lib.mkDefault true;
+    listenAddress = "127.0.0.1";
    port = 9101;
    extraFlags = [
      "--systemd.collector.enable-restart-count"
@@ -12,15 +13,25 @@ in
    ];
  };

-  systemd.services.prometheus-systemd-exporter.serviceConfig = {
-    IPAddressDeny = "any";
-    IPAddressAllow = [
-      "127.0.0.1"
-      "::1"
-      values.hosts.ildkule.ipv4
-      values.hosts.ildkule.ipv6
-    ];
-  };
+  services.nginx = {
+    enable = lib.mkDefault true;

-  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
+    virtualHosts.${config.networking.fqdn} = lib.mkIf config.services.nginx.enable {
+      forceSSL = true;
+      enableACME = true;
+      kTLS = true;
+
+      locations."/prometheus-systemd-exporter/metrics" = {
+        proxyPass = "http://localhost:${toString cfg.port}/metrics";
+
+        extraConfig = ''
+          allow 127.0.0.1;
+          allow ::1;
+          allow ${values.hosts.ildkule.ipv4};
+          allow ${values.hosts.ildkule.ipv6};
+          deny all;
+        '';
+      };
+    };
+  };
 }
@@ -1,38 +0,0 @@
-{ config, lib, values, ... }:
-let
-  cfg = config.services.prometheus.exporters.node;
-in
-{
-  services.promtail = {
-    enable = lib.mkDefault true;
-    configuration = {
-      server = {
-        http_listen_port = 28183;
-        grpc_listen_port = 0;
-      };
-      clients = [{
-        url = "http://ildkule.pvv.ntnu.no:3100/loki/api/v1/push";
-      }];
-      scrape_configs = [{
-        job_name = "systemd-journal";
-        journal = {
-          max_age = "12h";
-          labels = {
-            job = "systemd-journal";
-            host = config.networking.hostName;
-          };
-        };
-        relabel_configs = [
-          {
-            source_labels = [ "__journal__systemd_unit" ];
-            target_label = "unit";
-          }
-          {
-            source_labels = [ "__journal_priority_keyword" ];
-            target_label = "level";
-          }
-        ];
-      }];
-    };
-  };
-}
@@ -0,0 +1,13 @@
+{ ... }:
+{
+  services.rsyslogd = {
+    enable = true;
+    defaultConfig = ''
+      *.* @loghost.pvv.ntnu.no
+    '';
+  };
+
+  services.journald.extraConfig = ''
+    ForwardToSyslog=yes
+  '';
+}
@@ -0,0 +1,11 @@
+{ config, ... }:
+{
+  services.scrutiny.collector = {
+    enable = !config.services.qemuGuest.enable;
+    settings = {
+      version = 1;
+      host.id = config.networking.hostName;
+      api.endpoint = "https://scrutiny.pvv.ntnu.no/";
+    };
+  };
+}
@@ -0,0 +1,12 @@
+{ ... }:
+{
+  services.timesyncd = {
+    servers = [ "ntp.ntnu.no" ];
+    fallbackServers = [
+      "0.pool.ntp.org"
+      "1.pool.ntp.org"
+      "0.no.pool.ntp.org"
+    ];
+  };
+}
+
@@ -1,5 +1,42 @@
 {
  "nodes": {
+    "bro": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1779629827,
+        "narHash": "sha256-nrlB50/oelB8oFx9DhOoXI5z0VoTZGEA6XxYvkvpqDA=",
+        "ref": "main",
+        "rev": "7d0f35e12e4dec39f981c08fc33515589f41f4a5",
+        "revCount": 3,
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/bro.git"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/bro.git"
+      }
+    },
+    "crane": {
+      "locked": {
+        "lastModified": 1776635034,
+        "narHash": "sha256-OEOJrT3ZfwbChzODfIH4GzlNTtOFuZFWPtW7jIeR8xU=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "dc7496d8ea6e526b1254b55d09b966e94673750f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
    "dibbler": {
      "inputs": {
        "nixpkgs": [
@@ -7,11 +44,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770133120,
-        "narHash": "sha256-RuAWONXb+U3omSsuIPCrPcgj0XYqv+2djG0cnPGEyKg=",
+        "lastModified": 1771267058,
+        "narHash": "sha256-EEL4SmD1b3BPJPsSJJ4wDTXWMumJqbR+BLzhJJG0skE=",
        "ref": "main",
-        "rev": "3123b8b474319bc75ee780e0357dcdea69dc85e6",
-        "revCount": 244,
+        "rev": "e3962d02c78b9c7b4d18148d931a9a4bf22e7902",
+        "revCount": 254,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
      },
@@ -28,16 +65,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1736864502,
-        "narHash": "sha256-ItkIZyebGvNH2dK9jVGzJHGPtb6BSWLN8Gmef16NeY0=",
+        "lastModified": 1768920986,
+        "narHash": "sha256-CNzzBsRhq7gg4BMBuTDObiWDH/rFYHEuDRVOwCcwXw4=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "0141aabed359f063de7413f80d906e1d98c0c123",
+        "rev": "de5708739256238fb912c62f03988815db89ec9a",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "v1.11.0",
+        "ref": "v1.13.0",
        "repo": "disko",
        "type": "github"
      }
@@ -47,11 +84,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1765835352,
-        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
+        "lastModified": 1772408722,
+        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
+        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
        "type": "github"
      },
      "original": {
@@ -63,15 +100,15 @@
    "gergle": {
      "inputs": {
        "nixpkgs": [
-          "nixpkgs"
+          "nixpkgs-unstable"
        ]
      },
      "locked": {
-        "lastModified": 1767906545,
-        "narHash": "sha256-LOf08pcjEQFLs3dLPuep5d1bAXWOFcdfxuk3YMb5KWw=",
+        "lastModified": 1777067150,
+        "narHash": "sha256-vqPz8jCS1zTQlvmgctUFpvnr6f9ISR5h7CPG/HgQvf0=",
        "ref": "main",
-        "rev": "e55cbe0ce0b20fc5952ed491fa8a553c8afb1bdd",
-        "revCount": 23,
+        "rev": "b452a854fb78d6df9fe062b45e23a968657d115d",
+        "revCount": 35,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
      },
@@ -84,15 +121,15 @@
    "greg-ng": {
      "inputs": {
        "nixpkgs": [
-          "nixpkgs"
+          "nixpkgs-unstable"
        ],
-        "rust-overlay": "rust-overlay"
+        "rust-overlay": "rust-overlay_2"
      },
      "locked": {
-        "lastModified": 1767906494,
-        "narHash": "sha256-Dd6gtdZfRMAD6JhdX0GdJwIHVaBikePSpQXhIdwLlWI=",
+        "lastModified": 1777019032,
+        "narHash": "sha256-29lw7THThWb5DW01rVRj1b816Apwz/P4m2wVWaSIadU=",
        "ref": "main",
-        "rev": "7258822e2e90fea2ea00b13b5542f63699e33a9e",
+        "rev": "55262afca46c96f75a834d4e00e30d5fb20affb6",
        "revCount": 61,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
@@ -124,6 +161,27 @@
        "url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
      }
    },
+    "libdib": {
+      "inputs": {
+        "nixpkgs": [
+          "worblehat",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769338528,
+        "narHash": "sha256-t18ZoSt9kaI1yde26ok5s7aFLkap1Q9+/2icVh2zuaE=",
+        "ref": "refs/heads/main",
+        "rev": "7218348163fd8d84df4a6f682c634793e67a3fed",
+        "revCount": 13,
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/libdib.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/libdib.git"
+      }
+    },
    "matrix-next": {
      "inputs": {
        "nixpkgs": [
@@ -150,7 +208,7 @@
        "nixpkgs": [
          "nixpkgs"
        ],
-        "rust-overlay": "rust-overlay_2"
+        "rust-overlay": "rust-overlay_3"
      },
      "locked": {
        "lastModified": 1767906976,
@@ -217,11 +275,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769018862,
-        "narHash": "sha256-x3eMpPQhZwEDunyaUos084Hx41XwYTi2uHY4Yc4YNlk=",
+        "lastModified": 1778407980,
+        "narHash": "sha256-r980BhsReZQe6FkmyNZkwCZpvzARo5jZgTl8HxjAssY=",
        "owner": "oddlama",
        "repo": "nix-topology",
-        "rev": "a15cac71d3399a4c2d1a3482ae62040a3a0aa07f",
+        "rev": "ca0a602f650306d00d6f3e3c76d0f4c48a5c5adc",
        "type": "github"
      },
      "original": {
@@ -233,24 +291,24 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1769724120,
-        "narHash": "sha256-oQBM04hQk1kotfv4qmIG1tHmuwODd1+hqRJE5TELeCE=",
-        "rev": "8ec59ed5093c2a742d7744e9ecf58f358aa4a87d",
+        "lastModified": 1779622335,
+        "narHash": "sha256-06G98ieM6l+OI7EMhlvchgDBDn+DvIWCNj40LDhKpmc=",
+        "rev": "705e9929918b43bd7b715dc0a878ac870449bb03",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.4961.8ec59ed5093c/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05beta1.705e9929918b/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
-        "url": "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz"
+        "url": "https://nixos.org/channels/nixos-26.05-small/nixexprs.tar.xz"
      }
    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1765674936,
-        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
+        "lastModified": 1772328832,
+        "narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
+        "rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742",
        "type": "github"
      },
      "original": {
@@ -261,17 +319,38 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1769813739,
-        "narHash": "sha256-RmNWW1DQczvDwBHu11P0hGwJZxbngdoymVu7qkwq/2M=",
-        "rev": "16a3cae5c2487b1afa240e5f2c1811f172419558",
+        "lastModified": 1778586796,
+        "narHash": "sha256-XmDljcG4x8slQDlsWOc77pCA1YVuYn8JGumkYlhfTxI=",
+        "rev": "b25e938b89759b5f9466fc53c4a970244f84dc39",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre937548.16a3cae5c248/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre996582.b25e938b8975/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
        "url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
      }
    },
+    "passwd2systemd-users": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1780764154,
+        "narHash": "sha256-Xvf9aBNLYDnbDKdtFjp5GEA/rZwVczHZWbJ0hac8Vv4=",
+        "ref": "main",
+        "rev": "8b4541be73ee3bd6c60525b2f42605efe89398c9",
+        "revCount": 14,
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git"
+      }
+    },
    "pvv-calendar-bot": {
      "inputs": {
        "nixpkgs": [
@@ -279,11 +358,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1764869785,
-        "narHash": "sha256-FGTIpC7gB4lbeL0bfYzn1Ge0PaCpd7VqWBLhJBx0i4A=",
+        "lastModified": 1779774845,
+        "narHash": "sha256-QJU1J4eupwjRrtvWGzRut0GY3woql92RS9O/acWkJkk=",
        "ref": "main",
-        "rev": "8ce7fb0b1918bdb3d1489a40d73895693955e8b2",
-        "revCount": 23,
+        "rev": "13667cd216db260ab549e6f1b6281aa230d2f9e0",
+        "revCount": 29,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
      },
@@ -300,11 +379,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769009806,
-        "narHash": "sha256-52xTtAOc9B+MBRMRZ8HI6ybNsRLMlHHLh+qwAbaJjRY=",
+        "lastModified": 1779903528,
+        "narHash": "sha256-4rajaHeBeQ4PjbNSpslE9G3A5mZM1J/64ls+VoufWZo=",
        "ref": "main",
-        "rev": "aa8adfc6a4d5b6222752e2d15d4a6d3b3b85252e",
-        "revCount": 575,
+        "rev": "bba7413a1c611d4918fbef4d3aa55e465ca3f3fb",
+        "revCount": 585,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
      },
@@ -337,6 +416,7 @@
    },
    "root": {
      "inputs": {
+        "bro": "bro",
        "dibbler": "dibbler",
        "disko": "disko",
        "gergle": "gergle",
@@ -349,31 +429,35 @@
        "nix-topology": "nix-topology",
        "nixpkgs": "nixpkgs",
        "nixpkgs-unstable": "nixpkgs-unstable",
+        "passwd2systemd-users": "passwd2systemd-users",
        "pvv-calendar-bot": "pvv-calendar-bot",
        "pvv-nettsiden": "pvv-nettsiden",
        "qotd": "qotd",
        "roowho2": "roowho2",
-        "sops-nix": "sops-nix"
+        "sops-nix": "sops-nix",
+        "worblehat": "worblehat"
      }
    },
    "roowho2": {
      "inputs": {
+        "crane": "crane",
        "nixpkgs": [
          "nixpkgs"
        ],
-        "rust-overlay": "rust-overlay_3"
+        "rust-overlay": "rust-overlay_4"
      },
      "locked": {
-        "lastModified": 1769834595,
-        "narHash": "sha256-P1jrO7BxHyIKDuOXHuUb7bi4H2TuYnACW5eqf1gG47g=",
+        "lastModified": 1778600367,
+        "narHash": "sha256-YB0b2xUf4D8792D5Ay//7C3AjHyv+9yoy8K1mTe+wvE=",
        "ref": "main",
-        "rev": "def4eec2d59a69b4638b3f25d6d713b703b2fa56",
-        "revCount": 49,
+        "rev": "8e5f2849ff7c9616100fe928261512a7ad647939",
+        "revCount": 91,
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
      },
      "original": {
        "ref": "main",
+        "rev": "8e5f2849ff7c9616100fe928261512a7ad647939",
        "type": "git",
        "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
      }
@@ -381,16 +465,16 @@
    "rust-overlay": {
      "inputs": {
        "nixpkgs": [
-          "greg-ng",
+          "bro",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1767840362,
-        "narHash": "sha256-ZtsFqUhilubohNZ1TgpQIFsi4biZTwRH9rjZsDRDik8=",
+        "lastModified": 1779419951,
+        "narHash": "sha256-dMX0PUslUHPajP6o8FEoRdFv9afq/dec4POR0vVfjK4=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "d159ea1fc321c60f88a616ac28bab660092a227d",
+        "rev": "5b5c521d6cae9ef4aa32f888eb2c0ce595c9be52",
        "type": "github"
      },
      "original": {
@@ -400,6 +484,27 @@
      }
    },
    "rust-overlay_2": {
+      "inputs": {
+        "nixpkgs": [
+          "greg-ng",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1777000482,
+        "narHash": "sha256-CZ5FKUSA8FCJf0h9GWdPJXoVVDL9H5yC74GkVc5ubIM=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "403c09094a877e6c4816462d00b1a56ff8198e06",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_3": {
      "inputs": {
        "nixpkgs": [
          "minecraft-heatmap",
@@ -420,7 +525,7 @@
        "type": "github"
      }
    },
-    "rust-overlay_3": {
+    "rust-overlay_4": {
      "inputs": {
        "nixpkgs": [
          "roowho2",
@@ -428,11 +533,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769309768,
-        "narHash": "sha256-AbOIlNO+JoqRJkK1VrnDXhxuX6CrdtIu2hSuy4pxi3g=",
+        "lastModified": 1776914043,
+        "narHash": "sha256-qug5r56yW1qOsjSI99l3Jm15JNT9CvS2otkXNRNtrPI=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "140c9dc582cb73ada2d63a2180524fcaa744fad5",
+        "rev": "2d35c4358d7de3a0e606a6e8b27925d981c01cc3",
        "type": "github"
      },
      "original": {
@@ -448,11 +553,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769469829,
-        "narHash": "sha256-wFcr32ZqspCxk4+FvIxIL0AZktRs6DuF8oOsLt59YBU=",
+        "lastModified": 1777944972,
+        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "c5eebd4eb2e3372fe12a8d70a248a6ee9dd02eff",
+        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
        "type": "github"
      },
      "original": {
@@ -461,6 +566,28 @@
        "repo": "sops-nix",
        "type": "github"
      }
+    },
+    "worblehat": {
+      "inputs": {
+        "libdib": "libdib",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1773932847,
+        "narHash": "sha256-IklIAdlonrmO8/lkDxNIVz9+ORL4pcVotMTxeyvxzoc=",
+        "ref": "main",
+        "rev": "0871a319f51d3cb0d1abb5b11edb768b39906d3f",
+        "revCount": 104,
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
+      }
    }
  },
  "root": "root",
@@ -2,13 +2,13 @@
  description = "PVV System flake";

  inputs = {
-    nixpkgs.url = "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz";
+    nixpkgs.url = "https://nixos.org/channels/nixos-26.05-small/nixexprs.tar.xz";
    nixpkgs-unstable.url = "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz";

    sops-nix.url = "github:Mic92/sops-nix/master";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";

-    disko.url = "github:nix-community/disko/v1.11.0";
+    disko.url = "github:nix-community/disko/v1.13.0";
    disko.inputs.nixpkgs.follows = "nixpkgs";

    nix-topology.url = "github:oddlama/nix-topology/main";
@@ -23,6 +23,9 @@
    dibbler.url = "git+https://git.pvv.ntnu.no/Projects/dibbler.git?ref=main";
    dibbler.inputs.nixpkgs.follows = "nixpkgs";

+    worblehat.url = "git+https://git.pvv.ntnu.no/Projects/worblehat.git?ref=main";
+    worblehat.inputs.nixpkgs.follows = "nixpkgs";
+
    matrix-next.url = "github:dali99/nixos-matrix-modules/v0.8.0";
    matrix-next.inputs.nixpkgs.follows = "nixpkgs";

@@ -32,13 +35,13 @@
    minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
    minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";

-    roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main";
+    roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=8e5f2849ff7c9616100fe928261512a7ad647939";
    roowho2.inputs.nixpkgs.follows = "nixpkgs";

    greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";
-    greg-ng.inputs.nixpkgs.follows = "nixpkgs";
+    greg-ng.inputs.nixpkgs.follows = "nixpkgs-unstable";
    gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git?ref=main";
-    gergle.inputs.nixpkgs.follows = "nixpkgs";
+    gergle.inputs.nixpkgs.follows = "nixpkgs-unstable";
    grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git?ref=master";
    grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";

@@ -47,10 +50,21 @@

    qotd.url = "git+https://git.pvv.ntnu.no/Projects/qotd.git?ref=main";
    qotd.inputs.nixpkgs.follows = "nixpkgs";
+
+    bro.url = "git+https://git.pvv.ntnu.no/Projects/bro.git?ref=main";
+    bro.inputs.nixpkgs.follows = "nixpkgs";
+    passwd2systemd-users.url = "git+https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git?ref=main";
+    passwd2systemd-users.inputs.nixpkgs.follows = "nixpkgs";
  };

-  outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
-  let
+  outputs = {
+    self,
+    nixpkgs,
+    nixpkgs-unstable,
+    sops-nix,
+    disko,
+    ...
+  } @ inputs: let
    inherit (nixpkgs) lib;
    systems = [
      "x86_64-linux"
@@ -62,75 +76,105 @@
    importantMachines = [
      "bekkalokk"
      "bicep"
-      "brzeczyszczykiewicz"
      "georg"
      "ildkule"
+      "kommode"
+      "lupine-1"
+      "skrot"
    ];
  in {
    inputs = lib.mapAttrs (_: src: src.outPath) inputs;

-    pkgs = forAllSystems (system: import nixpkgs {
+    pkgs = forAllSystems (system:
+      import nixpkgs {
        inherit system;
-      config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
+        config.allowUnfreePredicate = pkg:
+          builtins.elem (lib.getName pkg)
          [
            "nvidia-x11"
            "nvidia-settings"
+            "nvidia-kernel-modules"
          ];
      });

+    apps = forAllSystems (system: let
+      pkgs = nixpkgs.legacyPackages.${system};
+    in {
+      gitea-workflows = {
+        type = "app";
+        meta.description = "Run all gitea workflows locally";
+        program = toString (pkgs.writeShellScript "pvv-nixos-config-run-gitea-worflows" ''
+          ${lib.getExe pkgs.gitea-actions-runner} exec -i node:current-trixie
+        '');
+      };
+    });
+
    nixosConfigurations = let
-      nixosConfig =
-        nixpkgs:
-        name:
-        configurationPath:
-        extraArgs@{
+      nixosConfig = nixpkgs: name: configurationPath: extraArgs @ {
        localSystem ? "x86_64-linux", # buildPlatform
        crossSystem ? "x86_64-linux", # hostPlatform
-          specialArgs ? { },
-          modules ? [ ],
-          overlays ? [ ],
+        specialArgs ? {},
+        modules ? [],
+        overlays ? [],
        enableDefaults ? true,
        ...
-        }:
-        let
-          commonPkgsConfig = {
-            inherit localSystem crossSystem;
-            config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
+      }: let
+        commonPkgsConfig =
+          {
+            config.allowUnfreePredicate = pkg:
+              builtins.elem (lib.getName pkg)
              [
                "nvidia-x11"
                "nvidia-settings"
+                "nvidia-kernel-modules"
              ];
-            overlays = (lib.optionals enableDefaults [
+            overlays =
+              (lib.optionals enableDefaults [
                # Global overlays go here
                inputs.roowho2.overlays.default
-            ]) ++ overlays;
-          };
-
+              ])
+              ++ overlays;
+          }
+          // (
+            if localSystem != crossSystem
+            then {
+              inherit localSystem crossSystem;
+            }
+            else {
+              system = crossSystem;
+            }
+          );
        pkgs = import nixpkgs commonPkgsConfig;
        unstablePkgs = import nixpkgs-unstable commonPkgsConfig;
      in
-        lib.nixosSystem (lib.recursiveUpdate
+        lib.nixosSystem (
+          lib.recursiveUpdate
          {
            system = crossSystem;

            inherit pkgs;

-          specialArgs = {
+            specialArgs =
+              {
                inherit inputs unstablePkgs;
                values = import ./values.nix;
                fp = path: ./${path};
-          } // specialArgs;
+              }
+              // specialArgs;

-          modules = [
+            modules =
+              [
                {
                  networking.hostName = lib.mkDefault name;
                }
                configurationPath
-          ] ++ (lib.optionals enableDefaults [
+              ]
+              ++ (lib.optionals enableDefaults [
                sops-nix.nixosModules.sops
                inputs.roowho2.nixosModules.default
                self.nixosModules.rsync-pull-targets
-          ]) ++ modules;
+              ])
+              ++ modules;
          }
          (builtins.removeAttrs extraArgs [
            "localSystem"
@@ -144,12 +188,8 @@

      stableNixosConfig = name: extraArgs:
        nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
-    in {
-      bakke = stableNixosConfig "bakke" {
-        modules = [
-          inputs.disko.nixosModules.disko
-        ];
-      };
+    in
+      {
        bicep = stableNixosConfig "bicep" {
          modules = [
            inputs.matrix-next.nixosModules.default
@@ -164,37 +204,61 @@
            (final: prev: {
              inherit (self.packages.${prev.stdenv.hostPlatform.system}) out-of-your-element;
            })
+            (final: prev: {
+              # See https://git.pvv.ntnu.no/Drift/issues/issues/369
+              mjolnir = prev.mjolnir.override {
+                nodejs = prev.nodejs_22;
+              };
+            })
          ];
        };
        bekkalokk = stableNixosConfig "bekkalokk" {
          overlays = [
            (final: prev: {
-            mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions { };
-            simplesamlphp = final.callPackage ./packages/simplesamlphp { };
-            bluemap = final.callPackage ./packages/bluemap.nix { };
+              mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions {};
+              simplesamlphp = final.callPackage ./packages/simplesamlphp {};
            })
            inputs.pvv-nettsiden.overlays.default
            inputs.qotd.overlays.default
          ];
          modules = [
            inputs.pvv-nettsiden.nixosModules.default
-          self.nixosModules.bluemap
            inputs.qotd.nixosModules.default
          ];
        };
-      ildkule = stableNixosConfig "ildkule" { };
-      #ildkule-unstable = unstableNixosConfig "ildkule" { };
-      skrot = stableNixosConfig "skrot" {
+        ildkule = stableNixosConfig "ildkule" {
          modules = [
            inputs.disko.nixosModules.disko
-          inputs.dibbler.nixosModules.default
          ];
-        overlays = [inputs.dibbler.overlays.default];
        };
-      shark = stableNixosConfig "shark" { };
-      wenche = stableNixosConfig "wenche" { };
-      temmie = stableNixosConfig "temmie" { };
-      gluttony = stableNixosConfig "gluttony" { };
+        skrot = stableNixosConfig "skrot" {
+          modules = [
+            self.nixosModules.drumknotty
+            inputs.disko.nixosModules.disko
+          ];
+          overlays =
+          [
+            inputs.dibbler.overlays.default
+            inputs.worblehat.overlays.default
+          ];
+        };
+        shark = stableNixosConfig "shark" {};
+        wenche = stableNixosConfig "wenche" {};
+        temmie = stableNixosConfig "temmie" {
+          overlays = [
+            inputs.bro.overlays.default
+            inputs.passwd2systemd-users.overlays.default
+          ];
+          modules = [
+            inputs.bro.nixosModules.default
+          ];
+        };
+        gluttony = stableNixosConfig "gluttony" {
+          overlays = [
+            (final: prev: { bluemap = final.callPackage ./packages/bluemap.nix {}; })
+          ];
+          modules = [ self.nixosModules.bluemap ];
+        };

        kommode = stableNixosConfig "kommode" {
          overlays = [
@@ -206,12 +270,6 @@
          ];
        };

-      ustetind = stableNixosConfig "ustetind" {
-        modules = [
-         "${nixpkgs}/nixos/modules/virtualisation/lxc-container.nix"
-        ];
-      };
-
        brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
          modules = [
            inputs.grzegorz-clients.nixosModules.grzegorz-webui
@@ -235,45 +293,14 @@
          ];
        };
      }
-    //
-    (let
-      skrottConfig = {
-        modules = [
-          (nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
-          inputs.dibbler.nixosModules.default
-        ];
-        overlays = [
-          inputs.dibbler.overlays.default
-          (final: prev: {
-            # NOTE: Yeetus (these break crosscompile ¯\_(ツ)_/¯)
-            atool = prev.emptyDirectory;
-            micro = prev.emptyDirectory;
-            ncdu = prev.emptyDirectory;
-          })
-        ];
-      };
-    in {
-      skrott = self.nixosConfigurations.skrott-native;
-      skrott-native = stableNixosConfig "skrott" (skrottConfig // {
-        localSystem = "aarch64-linux";
-        crossSystem = "aarch64-linux";
-      });
-      skrott-cross = stableNixosConfig "skrott" (skrottConfig // {
-        localSystem = "x86_64-linux";
-        crossSystem = "aarch64-linux";
-      });
-      skrott-x86_64 = stableNixosConfig "skrott" (skrottConfig // {
-        localSystem = "x86_64-linux";
-        crossSystem = "x86_64-linux";
-      });
-    })
-    //
-    (let
+      // (let
        machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
        stableLupineNixosConfig = name: extraArgs:
          nixosConfig nixpkgs name ./hosts/lupine/configuration.nix extraArgs;
-    in lib.genAttrs machineNames (name: stableLupineNixosConfig name {
-      modules = [{ networking.hostName = name; }];
+      in
+        lib.genAttrs machineNames (name:
+          stableLupineNixosConfig name {
+            modules = [{networking.hostName = name;}];
            specialArgs.lupineName = name;
          }));

@@ -285,6 +312,7 @@
      rsync-pull-targets = ./modules/rsync-pull-targets.nix;
      snakeoil-certs = ./modules/snakeoil-certs.nix;
      snappymail = ./modules/snappymail.nix;
+      drumknotty = ./modules/drumknotty;
    };

    devShells = forAllSystems (system: {
@@ -297,7 +325,8 @@
            })
          ];
        };
-      in pkgs.callPackage ./shell.nix { };
+      in
+        pkgs.callPackage ./shell.nix {};
      cuda = let
        cuda-pkgs = import nixpkgs-unstable {
          inherit system;
@@ -306,30 +335,34 @@
            cudaSupport = true;
          };
        };
-      in cuda-pkgs.callPackage ./shells/cuda.nix { };
+      in
+        cuda-pkgs.callPackage ./shells/cuda.nix {};
    });

    packages = {
      "x86_64-linux" = let
        system = "x86_64-linux";
        pkgs = nixpkgs.legacyPackages.${system};
-      in rec {
+      in
+        rec {
          default = important-machines;
-        important-machines = pkgs.linkFarm "important-machines"
+          important-machines =
+            pkgs.linkFarm "important-machines"
            (lib.getAttrs importantMachines self.packages.${system});
-        all-machines = pkgs.linkFarm "all-machines"
+          all-machines =
+            pkgs.linkFarm "all-machines"
            (lib.getAttrs allMachines self.packages.${system});

-        simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
+          simplesamlphp = pkgs.callPackage ./packages/simplesamlphp {};

-        bluemap = pkgs.callPackage ./packages/bluemap.nix { };
+          bluemap = pkgs.callPackage ./packages/bluemap.nix {};

-        out-of-your-element = pkgs.callPackage ./packages/ooye/package.nix { };
+          out-of-your-element = pkgs.callPackage ./packages/ooye/package.nix {};
        }
        //
        # Mediawiki extensions
        (lib.pipe null [
-        (_: pkgs.callPackage ./packages/mediawiki-extensions { })
+          (_: pkgs.callPackage ./packages/mediawiki-extensions {})
          (lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
          (lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
        ])
@@ -338,16 +371,6 @@
        lib.genAttrs allMachines
        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
        //
-      # Skrott is exception
-      {
-        skrott = self.packages.${system}.skrott-native-sd;
-        skrott-native = self.nixosConfigurations.skrott-native.config.system.build.toplevel;
-        skrott-native-sd = self.nixosConfigurations.skrott-native.config.system.build.sdImage;
-        skrott-cross = self.nixosConfigurations.skrott-cross.config.system.build.toplevel;
-        skrott-cross-sd = self.nixosConfigurations.skrott-cross.config.system.build.sdImage;
-        skrott-x86_64 = self.nixosConfigurations.skrott-x86_64.config.system.build.toplevel;
-      }
-      //
        # Nix-topology
        (let
          topology' = import inputs.nix-topology {
@@ -368,7 +391,8 @@
            modules = [
              ./topology
              {
-              nixosConfigurations = lib.mapAttrs (_name: nixosCfg: nixosCfg.extendModules {
+                nixosConfigurations = lib.mapAttrs (_name: nixosCfg:
+                  nixosCfg.extendModules {
                    modules = [
                      inputs.nix-topology.nixosModules.default
                      ./topology/service-extractors/greg-ng.nix
@@ -376,14 +400,16 @@
                      ./topology/service-extractors/mysql.nix
                      ./topology/service-extractors/gitea-runners.nix
                    ];
-              }) self.nixosConfigurations;
+                  })
+                self.nixosConfigurations;
              }
            ];
          };
        in {
          topology = topology'.config.output;
-        topology-png = pkgs.runCommand "pvv-config-topology-png" {
-          nativeBuildInputs = [ pkgs.writableTmpDirAsHomeHook ];
+          topology-png =
+            pkgs.runCommand "pvv-config-topology-png" {
+              nativeBuildInputs = [pkgs.writableTmpDirAsHomeHook];
            } ''
              mkdir -p "$out"
              for file in '${topology'.config.output}'/*.svg; do
@@ -1,18 +0,0 @@
-{ config, pkgs, values, ... }:
-{
-  imports = [
-      ./hardware-configuration.nix
-      ../../base
-      ./filesystems.nix
-    ];
-
-  networking.hostId = "99609ffc";
-  systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
-    matchConfig.Name = "enp2s0";
-    address = with values.hosts.bakke; [ (ipv4 + "/25") (ipv6 + "/64") ];
-  };
-
-  # Don't change (even during upgrades) unless you know what you are doing.
-  # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "24.05";
-}
@@ -1,83 +0,0 @@
-{
-  # https://github.com/nix-community/disko/blob/master/example/boot-raid1.nix
-  # Note: Disko was used to create the initial md raid, but is no longer in active use on this host.
-  disko.devices = {
-    disk = {
-      one = {
-        type = "disk";
-        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E2EER6N6";
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "500M";
-              type = "EF00";
-              content = {
-                type = "mdraid";
-                name = "boot";
-              };
-            };
-            mdadm = {
-              size = "100%";
-              content = {
-                type = "mdraid";
-                name = "raid1";
-              };
-            };
-          };
-        };
-      };
-      two = {
-        type = "disk";
-        device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E7LPLU71";
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "500M";
-              type = "EF00";
-              content = {
-                type = "mdraid";
-                name = "boot";
-              };
-            };
-            mdadm = {
-              size = "100%";
-              content = {
-                type = "mdraid";
-                name = "raid1";
-              };
-            };
-          };
-        };
-      };
-    };
-    mdadm = {
-      boot = {
-        type = "mdadm";
-        level = 1;
-        metadata = "1.0";
-        content = {
-          type = "filesystem";
-          format = "vfat";
-          mountpoint = "/boot";
-        };
-      };
-      raid1 = {
-        type = "mdadm";
-        level = 1;
-        content = {
-          type = "gpt";
-          partitions.primary = {
-            size = "100%";
-            content = {
-              type = "filesystem";
-              format = "ext4";
-              mountpoint = "/";
-            };
-          };
-        };
-      };
-    };
-  };
-}
@@ -1,26 +0,0 @@
-{ pkgs,... }:
-{
-  # Boot drives:
-  boot.swraid.enable = true;
-
-  # ZFS Data pool:
-  boot = {
-    zfs = {
-      extraPools = [ "tank" ];
-      requestEncryptionCredentials = false;
-    };
-    supportedFilesystems.zfs = true;
-    # Use stable linux packages, these work with zfs
-    kernelPackages = pkgs.linuxPackages;
-  };
-  services.zfs.autoScrub = {
-    enable = true;
-    interval = "Wed *-*-8..14 00:00:00";
-  };
-
-  # NFS Exports:
-  #TODO
-
-  # NFS Import mounts:
-  #TODO
-}
@@ -1,52 +0,0 @@
-# Do not modify this file!  It was generated by 'nixos-generate-config'
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
-      fsType = "btrfs";
-      options = [ "subvol=root" ];
-    };
-
-  fileSystems."/home" =
-    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
-      fsType = "btrfs";
-      options = [ "subvol=home" ];
-    };
-
-  fileSystems."/nix" =
-    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
-      fsType = "btrfs";
-      options = [ "subvol=nix" "noatime" ];
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/sdc2";
-      fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
-    };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault false;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}
@@ -7,6 +7,7 @@

    ./services/alps.nix
    ./services/bluemap.nix
+    ./services/radicale.nix
    ./services/idp-simplesamlphp
    ./services/kerberos.nix
    ./services/mediawiki
@@ -24,8 +25,6 @@
    address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };

-  services.btrfs.autoScrub.enable = true;
-
  # Don't change (even during upgrades) unless you know what you are doing.
  # See https://search.nixos.org/options?show=system.stateVersion
  system.stateVersion = "25.11";
@@ -1,105 +1,10 @@
-{ config, lib, pkgs, inputs, ... }:
+{ values, ... }:
 let
-  vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
-  format = pkgs.formats.hocon { };
+  webExport = "/var/lib/bluemap/web";
 in {
-  # NOTE: our versino of the module gets added in flake.nix
+  # NOTE: our version of the module gets added in flake.nix
  disabledModules = [ "services/web-apps/bluemap.nix" ];

-  sops.secrets."bluemap/ssh-key" = { };
-  sops.secrets."bluemap/ssh-known-hosts" = { };
-
-  services.bluemap = {
-    enable = true;
-
-    eula = true;
-    onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
-
-    host = "minecraft.pvv.ntnu.no";
-
-    maps = let
-      inherit (inputs.minecraft-kartverket.packages.${pkgs.stdenv.hostPlatform.system}) bluemap-export;
-    in {
-      "verden" = {
-        extraHoconMarkersFile = "${bluemap-export}/overworld.hocon";
-        settings = {
-          world = vanillaSurvival;
-          dimension = "minecraft:overworld";
-          name = "Verden";
-          sorting = 0;
-          start-pos = {
-            x = 0;
-            z = 0;
-          };
-          ambient-light = 0.1;
-          cave-detection-ocean-floor = -5;
-        };
-      };
-      "underverden" = {
-        extraHoconMarkersFile = "${bluemap-export}/nether.hocon";
-        settings = {
-          world = vanillaSurvival;
-          dimension = "minecraft:the_nether";
-          name = "Underverden";
-          sorting = 100;
-          start-pos = {
-            x = 0;
-            z = 0;
-          };
-          sky-color = "#290000";
-          void-color = "#150000";
-          sky-light = 1;
-          ambient-light = 0.6;
-          remove-caves-below-y = -10000;
-          cave-detection-ocean-floor = -5;
-          cave-detection-uses-block-light = true;
-          render-mask = [{
-            max-y = 90;
-          }];
-        };
-      };
-      "enden" = {
-        extraHoconMarkersFile = "${bluemap-export}/the-end.hocon";
-        settings = {
-          world = vanillaSurvival;
-          dimension = "minecraft:the_end";
-          name = "Enden";
-          sorting = 200;
-          start-pos = {
-            x = 0;
-            z = 0;
-          };
-          sky-color = "#080010";
-          void-color = "#080010";
-          sky-light = 1;
-          ambient-light = 0.6;
-          remove-caves-below-y = -10000;
-          cave-detection-ocean-floor = -5;
-        };
-      };
-    };
-  };
-
-  systemd.services."render-bluemap-maps" = {
-    serviceConfig = {
-      StateDirectory = [ "bluemap/world" ];
-      ExecStartPre = let
-        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
-          archive = true;
-          compress = true;
-          verbose = true;
-          no-owner = true;
-          no-group = true;
-          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
-        };
-      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
-      LoadCredential = [
-        "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
-        "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
-      ];
-    };
-  };
-
  services.nginx.virtualHosts."minecraft.pvv.ntnu.no" = {
    enableACME = true;
    forceSSL = true;
@@ -115,6 +20,30 @@ in {
      quic_retry on;
      add_header Alt-Svc 'h3=":$server_port"; ma=86400';
    '';
+    root = webExport;
+    locations = {
+      "~* ^/maps/[^/]*/tiles/".extraConfig = ''
+        error_page 404 = @empty;
+      '';
+      "@empty".return = "204";
+    };
+  };
+
+  services.rsync-pull-targets = {
+    enable = true;
+    locations.${webExport} = {
+      user = "root";
+      rrsyncArgs.wo = true;
+      authorizedKeysAttrs = [
+        "restrict"
+        "from=\"gluttony.pvv.ntnu.no,${values.hosts.gluttony.ipv6},${values.hosts.gluttony.ipv4}\""
+        "no-agent-forwarding"
+        "no-port-forwarding"
+        "no-pty"
+        "no-X11-forwarding"
+      ];
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH5jrqMovXlWaFWZAV/aKyQReHvUQp5kb+7Ja4gnevSr root@gluttony bluemap";
+    };
  };

  networking.firewall.allowedUDPPorts = [ 443 ];
@@ -107,6 +107,7 @@ in {
        CodeEditor
        CodeMirror
        DeleteBatch
+        PdfHandler
        PluggableAuth
        Popups
        Scribunto
@@ -181,12 +182,17 @@ in {
      ];

      # Misc program paths
-      $wgFFmpegLocation = '${pkgs.ffmpeg}/bin/ffmpeg';
-      $wgExiftool = '${pkgs.exiftool}/bin/exiftool';
-      $wgExiv2Command = '${pkgs.exiv2}/bin/exiv2';
+      $wgFFmpegLocation = '${lib.getExe pkgs.ffmpeg}';
+      $wgExiftool = '${lib.getExe pkgs.exiftool}';
+      $wgExiv2Command = '${lib.getExe pkgs.exiv2}';
      # See https://gist.github.com/sergejmueller/088dce028b6dd120a16e
-      $wgJpegTran = '${pkgs.mozjpeg}/bin/jpegtran';
-      $wgGitBin = '${pkgs.git}/bin/git';
+      $wgJpegTran = '${lib.getExe' pkgs.mozjpeg "jpegtran"}';
+      $wgGitBin = '${lib.getExe pkgs.git}';
+      $wgDiff3 = '${lib.getExe' pkgs.diffutils "diff3"}';
+      $wgDiff = '${lib.getExe' pkgs.diffutils "diff"}';
+
+      $wgUseImageMagick = true;
+      $wgImageMagickConvertCommand = '${lib.getExe pkgs.imagemagick}';

      # Debugging
      $wgShowExceptionDetails = false;
@@ -210,6 +216,15 @@ in {

      # EXT:WikiEditor
      $wgWikiEditorRealtimePreview = true;
+
+      # EXT:PdfHandler
+      $wgPdfProcessor = '${lib.getExe pkgs.ghostscript_headless}';
+      $wgPdfPostProcessor = $wgImageMagickConvertCommand;
+      $wgPdfInfo = '${lib.getExe' pkgs.poppler-utils "pdfinfo"}';
+      $wgPdftoText = '${lib.getExe' pkgs.poppler-utils "pdftotext"}';
+
+      # Override key from hardcoded config in nixpkgs
+      $wgSecretKey = file_get_contents("${config.sops.secrets."mediawiki/secret-key".path}");
    '';
  };

@@ -273,8 +288,6 @@ in {
  systemd.services.mediawiki-init = lib.mkIf cfg.enable {
    after = [ "sops-install-secrets.service" ];
    serviceConfig = {
-      BindReadOnlyPaths = [ "/run/credentials/mediawiki-init.service/secret-key:/var/lib/mediawiki/secret.key" ];
-      LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
      UMask = lib.mkForce "0007";
    };
  };
@@ -282,8 +295,6 @@ in {
  systemd.services.phpfpm-mediawiki = lib.mkIf cfg.enable {
    after = [ "sops-install-secrets.service" ];
    serviceConfig = {
-      BindReadOnlyPaths = [ "/run/credentials/phpfpm-mediawiki.service/secret-key:/var/lib/mediawiki/secret.key" ];
-      LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
      UMask = lib.mkForce "0007";
    };
  };
@@ -0,0 +1,40 @@
+{ config, lib, ... }:
+let
+  domain = "dav.pvv.ntnu.no";
+  radicalePort = 5232;
+in {
+  services.radicale = {
+    enable = true;
+
+    settings = {
+      server = {
+        hosts = [ "127.0.0.1:${toString radicalePort}" ];
+      };
+
+      auth = {
+        type = "imap";
+        imap_host = "imap.pvv.ntnu.no";
+        imap_security = "tls";
+      };
+
+      storage = {
+        filesystem_folder = "/var/lib/radicale/collections";
+      };
+    };
+  };
+
+  services.nginx.virtualHosts."${domain}" = {
+    forceSSL = true;
+    enableACME = true;
+    kTLS = true;
+
+    extraConfig = ''
+      client_max_body_size 128M;
+    '';
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString radicalePort}";
+      proxyWebsockets = true;
+    };
+  };
+}
@@ -6,40 +6,58 @@ let
  port = 3011;
  wsPort = 3012;
 in {
-  sops.secrets."vaultwarden/environ" = {
+  sops.secrets."vaultwarden/rsa_key.pem" = {
    owner = "vaultwarden";
    group = "vaultwarden";
+    mode = "440";
+    restartUnits = [ "vaultwarden.service" ];
+  };
+  sops.secrets."vaultwarden/rsa_key.pub.pem" = {
+    owner = "vaultwarden";
+    group = "vaultwarden";
+    mode = "440";
+    restartUnits = [ "vaultwarden.service" ];
+  };
+  sops.secrets."vaultwarden/env/DATABASE_PASSWORD" = { };
+  sops.secrets."vaultwarden/env/SMTP_PASSWORD" = { };
+  sops.templates."vaultwarden/environment_file" = {
+    owner = "vaultwarden";
+    group = "vaultwarden";
+    mode = "440";
+    restartUnits = [ "vaultwarden.service" ];
+    content = ''
+        DATABASE_URL=postgresql://vaultwarden:${config.sops.placeholder."vaultwarden/env/DATABASE_PASSWORD"}@postgres.pvv.ntnu.no/vaultwarden
+        SMTP_PASSWORD=${config.sops.placeholder."vaultwarden/env/SMTP_PASSWORD"}
+    '';
  };

  services.vaultwarden = {
    enable = true;
    dbBackend = "postgresql";
-    environmentFile = config.sops.secrets."vaultwarden/environ".path;
+    environmentFile = config.sops.templates."vaultwarden/environment_file".path;
    config = {
-      domain = "https://${domain}";
+      DOMAIN = "https://${domain}";

-      rocketAddress = address;
-      rocketPort = port;
+      ROCKET_ADDRESS = address;
+      ROCKET_PORT = port;

-      websocketEnabled = true;
-      websocketAddress = address;
-      websocketPort = wsPort;
+      WEBSOCKET_ENABLED = true;
+      WEBSOCKET_ADDRESS = address;
+      WEBSOCKET_PORT = wsPort;

-      signupsAllowed = true;
-      signupsVerify = true;
-      signupsDomainsWhitelist = "pvv.ntnu.no";
+      SIGNUPS_ALLOWED = true;
+      SIGNUPS_VERIFY = true;
+      SIGNUPS_DOMAINS_WHITELIST = "pvv.ntnu.no";

-      smtpFrom = "vaultwarden@pvv.ntnu.no";
-      smtpFromName = "VaultWarden PVV";
+      SMTP_FROM = "vaultwarden@pvv.ntnu.no";
+      SMTP_FROM_NAME = "VaultWarden PVV";

-      smtpHost = "smtp.pvv.ntnu.no";
-      smtpUsername = "vaultwarden";
-      smtpSecurity = "force_tls";
-      smtpAuthMechanism = "Login";
+      SMTP_HOST = "smtp.pvv.ntnu.no";
+      SMTP_USERNAME = "vaultwarden";
+      SMTP_SECURITY = "force_tls";
+      SMTP_AUTH_MECHANISM = "Login";

-      # Configured in environ:
-      # databaseUrl = "postgresql://vaultwarden@/vaultwarden";
-      # smtpPassword = hemli
+      RSA_KEY_FILENAME = lib.removeSuffix ".pem" config.sops.secrets."vaultwarden/rsa_key.pem".path;
    };
  };

@@ -66,40 +84,6 @@ in {
    };
  };

-  systemd.services.vaultwarden = lib.mkIf cfg.enable {
-    serviceConfig = {
-      AmbientCapabilities = [ "" ];
-      CapabilityBoundingSet = [ "" ];
-      DeviceAllow = [ "" ];
-      LockPersonality = true;
-      NoNewPrivileges = true;
-      # MemoryDenyWriteExecute = true;
-      PrivateMounts = true;
-      PrivateUsers = true;
-      ProcSubset = "pid";
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-      ];
-      RemoveIPC = true;
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-      ];
-    };
-  };
-
  services.rsync-pull-targets = {
    enable = true;
    locations."/var/lib/vaultwarden" = {
@@ -10,8 +10,9 @@
    enableACME = true;
    kTLS = true;
    locations = {
-      "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
+      # "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";

+      "/roundcube".return = "302 https://webmail.pvv.ntnu.no/";
      "/afterlogic_lite".return = "302 https://webmail.pvv.ntnu.no/roundcube";
      "/squirrelmail".return = "302 https://webmail.pvv.ntnu.no/roundcube";
      "/rainloop".return = "302 https://snappymail.pvv.ntnu.no/";
@@ -9,6 +9,12 @@ in
  sops.secrets."roundcube/postgres_password" = {
    owner = "nginx";
    group = "nginx";
+    restartUnits = [ "phpfpm-roundcube.service" ];
+  };
+  sops.secrets."roundcube/des_key" = {
+    owner = "nginx";
+    group = "nginx";
+    restartUnits = [ "phpfpm-roundcube.service" ];
  };

  services.roundcube = {
@@ -23,7 +29,7 @@ in

    dicts = with pkgs.aspellDicts; [ en en-computers nb nn fr de it ];
    maxAttachmentSize = 20;
-    hostName = "roundcubeplaceholder.example.com";
+    hostName = domain;

    database = {
      host = "postgres.pvv.ntnu.no";
@@ -39,47 +45,13 @@ in
      $config['mail_domain'] = "pvv.ntnu.no";
      $config['smtp_user'] = "%u";
      $config['support_url'] = "";
+      $config['des_key'] = "${config.sops.secrets."roundcube/des_key".path}";
    '';
  };

-  services.nginx.virtualHosts."roundcubeplaceholder.example.com" = lib.mkForce { };
+  # TODO: move this back to `webmail.pvv.ntnu.no/roundcube` subpath

  services.nginx.virtualHosts.${domain} = {
    kTLS = true;
-    locations."/roundcube" = {
-      tryFiles = "$uri $uri/ =404";
-      index = "index.php";
-      root = pkgs.runCommandLocal "roundcube-dir" { } ''
-        mkdir -p $out
-        ln -s ${cfg.package} $out/roundcube
-      '';
-      extraConfig = ''
-        location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
-        # https://wiki.archlinux.org/title/Roundcube
-        "README"
-        "INSTALL"
-        "LICENSE"
-        "CHANGELOG"
-        "UPGRADING"
-        "bin"
-        "SQL"
-        ".+\\.md"
-        "\\."
-        "config"
-        "temp"
-        "logs"
-        ]})/? {
-          deny all;
-        }
-
-        location ~ ^/roundcube/(.+\.php)(/?.*)$ {
-          fastcgi_split_path_info ^/roundcube(/.+\.php)(/.+)$;
-          include ${config.services.nginx.package}/conf/fastcgi_params;
-          include ${config.services.nginx.package}/conf/fastcgi.conf;
-          fastcgi_index index.php;
-          fastcgi_pass unix:${config.services.phpfpm.pools.roundcube.socket};
-        }
-      '';
-    };
  };
 }
@@ -80,14 +80,46 @@ in {
  };

  services.phpfpm.pools."pvv-nettsiden".settings = {
-    # "php_admin_value[error_log]" = "stderr";
+    "php_admin_value[error_log]" = "syslog";
    "php_admin_flag[log_errors]" = true;
    "catch_workers_output" = true;
+
+    "php_admin_value[max_execution_time]" = "30";
+    "request_terminate_timeout" = "60s";
+
+    "php_admin_value[sendmail_path]" = let
+      fakeSendmail = pkgs.writeShellApplication {
+        name = "fake-sendmail";
+        text = ''
+          TIMESTAMP="$(date +%Y-%m-%d-%H-%M-%S-%N)"
+          (
+            echo "SENDMAIL ARGS:"
+            echo "$@"
+            echo "SENDMAIL STDIN:"
+            cat -
+          ) > "/var/lib/pvv-nettsiden/emails/$TIMESTAMP.mail"
+        '';
+      };
+    in lib.getExe fakeSendmail;
+
+    "php_admin_value[disable_functions]" = lib.concatStringsSep "," [
+      "curl_exec"
+      "curl_multi_exec"
+      "exec"
+      "parse_ini_file"
+      "passthru"
+      "popen"
+      "proc_open"
+      "shell_exec"
+      "show_source"
+      "system"
+    ];
  };

  services.nginx.virtualHosts."pvv.ntnu.no" = {
    globalRedirect = cfg.domainName;
    redirectCode = 307;
+    kTLS = true;
    forceSSL = true;
    useACMEHost = "www.pvv.ntnu.no";
  };
@@ -95,6 +127,7 @@ in {
  services.nginx.virtualHosts."www.pvv.org" = {
    globalRedirect = cfg.domainName;
    redirectCode = 307;
+    kTLS = true;
    forceSSL = true;
    useACMEHost = "www.pvv.ntnu.no";
  };
@@ -102,11 +135,13 @@ in {
  services.nginx.virtualHosts."pvv.org" = {
    globalRedirect = cfg.domainName;
    redirectCode = 307;
+    kTLS = true;
    forceSSL = true;
    useACMEHost = "www.pvv.ntnu.no";
  };

  services.nginx.virtualHosts.${cfg.domainName} = {
+    kTLS = true;
    locations = {
      # Proxy home directories
      "^~ /~" = {
@@ -37,18 +37,31 @@ in {
  };

  systemd.services.pvv-nettsiden-gallery-update = {
-    path = with pkgs; [ imagemagick gnutar gzip ];
+    serviceConfig = {
+      WorkingDirectory = galleryDir;
+      User = config.services.pvv-nettsiden.user;
+      Group = config.services.pvv-nettsiden.group;

-    script = ''
-      tar ${lib.cli.toGNUCommandLineShell {} {
+      ExecStart = lib.getExe (pkgs.writeShellApplication {
+        name = "pvv-nettsiden-gallery-update-exec-start.sh";
+        runtimeInputs = with pkgs; [
+          coreutils
+          findutils
+          gnused
+          gnutar
+          gzip
+          imagemagick
+        ];
+        text = ''
+          tar ${lib.cli.toCommandLineShellGNU { } {
            extract = true;
            file = "${transferDir}/gallery.tar.gz";
            directory = ".";
          }}

          # Delete files and directories that exists in the gallery that don't exist in the tarball
-      filesToRemove=$(uniq -u <(sort <(find . -not -path "./.thumbnails*") <(tar -tf ${transferDir}/gallery.tar.gz | sed 's|/$||')))
-      while IFS= read fname; do
+          filesToRemove="$(uniq -u <(sort <(find . -not -path './.thumbnails*') <(tar -tf '${transferDir}/gallery.tar.gz' | sed 's|/$||')))"
+          while IFS= read -r fname; do
            rm -f "$fname" ||:
            rm -f ".thumbnails/$fname.png" ||:
          done <<< "$filesToRemove"
@@ -56,9 +69,9 @@ in {
          find . -type d -empty -delete

          mkdir -p .thumbnails
-      images=$(find . -type f -not -path "./.thumbnails*")
+          images="$(find . -type f -not -path './.thumbnails*')"

-      while IFS= read fname; do
+          while IFS= read -r fname; do
            # Skip this file if an up-to-date thumbnail already exists
            if [ -f ".thumbnails/$fname.png" ] && \
              [ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
@@ -67,16 +80,12 @@ in {
            fi

            echo "Creating thumbnail for $fname"
-        mkdir -p $(dirname ".thumbnails/$fname")
+            mkdir -p "$(dirname ".thumbnails/$fname")"
            magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
            touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
          done <<< "$images"
        '';
-
-    serviceConfig = {
-      WorkingDirectory = galleryDir;
-      User = config.services.pvv-nettsiden.user;
-      Group = config.services.pvv-nettsiden.group;
+      });

      AmbientCapabilities = [ "" ];
      CapabilityBoundingSet = [ "" ];
@@ -83,6 +83,7 @@ in
  };

  services.nginx.virtualHosts."mirrors.pvv.ntnu.no" = {
+    kTLS = true;
    forceSSL = true;
    enableACME = true;

@@ -22,6 +22,7 @@ in
  sops.templates."hookshot-registration.yaml" = {
    owner = config.users.users.matrix-synapse.name;
    group = config.users.groups.keys-matrix-registrations.name;
+    mode = "0440";
    restartUnits = [ "matrix-hookshot.service" ];
    content = ''
      id: matrix-hookshot
@@ -49,12 +50,59 @@ in

  systemd.services.matrix-hookshot = {
    serviceConfig = {
+      DynamicUser = true;
      SupplementaryGroups = [
        config.users.groups.keys-matrix-registrations.name
      ];
      LoadCredential = [
        "passkey.pem:${config.sops.secrets."matrix/hookshot/passkey".path}"
      ];
+
+      RuntimeDirectory = [ "matrix-hookshot/root-mnt" ];
+      RootDirectory = "/run/matrix-hookshot/root-mnt";
+      BindReadOnlyPaths = [
+        config.sops.templates."hookshot-registration.yaml".path
+        builtins.storeDir
+        "/etc"
+        "/run/nscd"
+        "/var/run/nscd"
+      ];
+
+      AmbientCapabilities = "";
+      CapabilityBoundingSet = "";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = false; # node needs this
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateMounts = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      RemoveIPC = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+        "~@resources"
+      ];
+      UMask = "0077";
    };
  };

@@ -146,6 +194,7 @@ in
  };

  services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
+    kTLS = true;
    enableACME = true;
    addSSL = true;
    locations."/" = {
@@ -54,4 +54,53 @@
    # TODO: Fix upstream module in nixpkgs
    pantalaimon.username = "bot_admin";
  };
+
+  systemd.services.mjolnir.serviceConfig = {
+    DynamicUser = true;
+    RuntimeDirectory = [ "mjolnir/root-mnt" ];
+    RootDirectory = "/run/mjolnir/root-mnt";
+    BindReadOnlyPaths = [
+      config.sops.secrets."matrix/mjolnir/access_token".path
+      builtins.storeDir
+      "/etc"
+      "/run/nscd"
+      "/var/run/nscd"
+    ];
+
+    AmbientCapabilities = "";
+    CapabilityBoundingSet = "";
+    LockPersonality = true;
+    MemoryDenyWriteExecute = false; # node needs this
+    NoNewPrivileges = true;
+    PrivateDevices = true;
+    PrivateMounts = true;
+    PrivateTmp = true;
+    PrivateUsers = true;
+    ProcSubset = "pid";
+    ProtectClock = true;
+    ProtectControlGroups = true;
+    ProtectHome = true;
+    ProtectHostname = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    ProtectSystem = "strict";
+    RemoveIPC = true;
+    RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+      "AF_UNIX"
+    ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    SystemCallFilter = [
+      "@system-service"
+      "~@privileged"
+      "~@resources"
+    ];
+    UMask = "0077";
+  };
 }
@@ -56,6 +56,55 @@ in
    enableSynapseIntegration = false;
  };

+  systemd.services."matrix-ooye" = {
+    serviceConfig = {
+      RuntimeDirectory = [ "matrix-ooye/root-mnt" ];
+      RootDirectory = "/run/matrix-ooye/root-mnt";
+      BindReadOnlyPaths = [
+        builtins.storeDir
+        "/etc"
+        "/run/nscd"
+        "/var/run/nscd"
+      ];
+
+      AmbientCapabilities = "";
+      CapabilityBoundingSet = "";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = false; # node needs this
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateMounts = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      RemoveIPC = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+        "~@resources"
+      ];
+      UMask = "0077";
+    };
+  };
+
  systemd.services."matrix-synapse" = {
    after = [
      "matrix-ooye-pre-start.service"
@@ -80,6 +129,7 @@ in
  };

  services.nginx.virtualHosts."ooye.pvv.ntnu.no" = {
+    kTLS = true;
    forceSSL = true;
    enableACME = true;
    locations."/".proxyPass = "http://localhost:${cfg.socket}";
@@ -23,27 +23,28 @@ in
  };

  systemd.services.minecraft-heatmap-ingest-logs = lib.mkIf cfg.enable {
-    serviceConfig.LoadCredential = [
+    serviceConfig = {
+      LoadCredential = [
        "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
      ];
-
-    preStart = let
+      ExecStartPre = let
        knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
          innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
          innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
          innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
        '';
-    in ''
-      mkdir -p '${cfg.minecraftLogsDir}'
-      "${lib.getExe pkgs.rsync}" \
-      --archive \
-      --verbose \
-      --progress \
-      --no-owner \
-      --no-group \
-      --rsh="${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=\"${knownHostsFile}\" -i \"$CREDENTIALS_DIRECTORY\"/sshkey" \
-      root@innovation.pvv.ntnu.no:/ \
-      '${cfg.minecraftLogsDir}'/
-    '';
+        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
+          archive = true;
+          verbose = true;
+          progress = true;
+          no-owner = true;
+          no-group = true;
+        };
+        sshCommand = ''${pkgs.openssh}/bin/ssh -o UserKnownHostsFile='${knownHostsFile}' -i \"$CREDENTIALS_DIRECTORY\"/sshkey'';
+      in [
+        "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.minecraftLogsDir}'"
+        "${lib.getExe pkgs.rsync} ${rsyncArgs} --rsh=\"${sshCommand}\" root@innovation.pvv.ntnu.no:/ '${cfg.minecraftLogsDir}'/"
+      ];
+    };
  };
 }
@@ -57,7 +57,7 @@ in
      rm "$STATE_DIRECTORY/mysql-dump-latest.sql.zst" ||:
      ln -T "$OUT_FILE" "$STATE_DIRECTORY/mysql-dump-latest.sql.zst"

-      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt ${toString (rotations + 1)} ]; do
+      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt '${toString (rotations + 1)}' ]; do
        rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
      done
    '';
@@ -23,6 +23,9 @@ in
        bind-address = values.services.mysql.ipv4;
        skip-networking = 0;

+        # Useful for the mysqld prometheus exporter
+        userstat = 1;
+
        # This was needed in order to be able to use all of the old users
        # during migration from knakelibrak to bicep in Sep. 2023
        secure_auth = 0;
@@ -71,4 +74,16 @@ in
      ];
    };
  };
+
+  services.logrotate = lib.mkIf (cfg.settings.mysqld.slow-query-log == 1) {
+    enable = true;
+    settings.mysql-slowlog = {
+      files = [ cfg.settings.mysqld.slow-query-log-file ];
+      frequency = "weekly";
+      rotate = 12;
+      create = "0660 mysql mysql";
+      minsize = "1M";
+      compress = true;
+    };
+  };
 }
@@ -58,7 +58,7 @@ in
      rm "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst" ||:
      ln -T "$OUT_FILE" "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst"

-      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt ${toString (rotations + 1)} ]; do
+      while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt '${toString (rotations + 1)}' ]; do
        rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
      done
    '';
@@ -0,0 +1,37 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.postgresql;
+in
+{
+  config = lib.mkIf cfg.enable {
+    systemd.services = {
+      postgresql-repack = {
+        requires = [ "postgresql.service" ];
+        after = [ "postgresql.target" ];
+        description = "Repack all PostgreSQL databases";
+        startAt = "Mon 06:00:00";
+        serviceConfig = {
+          Type = "oneshot";
+          User = "postgres";
+          Group = "postgres";
+
+          ExecStart = "${lib.getExe cfg.package.pkgs.pg_repack} --host=/run/postgresql --no-kill-backend --wait-timeout=30 --all";
+        };
+      };
+
+      postgresql-vacuum-analyze = {
+        requires = [ "postgresql.service" ];
+        after = [ "postgresql.target" ];
+        description = "Vacuum and analyze all PostgreSQL databases";
+        startAt = "Tue 06:00:00";
+        serviceConfig = {
+          Type = "oneshot";
+          User = "postgres";
+          Group = "postgres";
+
+          ExecStart = "${lib.getExe' cfg.package "psql"} --port=${builtins.toString cfg.settings.port} -tAc 'VACUUM ANALYZE'";
+        };
+      };
+    };
+  };
+}
@@ -3,11 +3,15 @@ let
  cfg = config.services.postgresql;
 in
 {
-  imports = [ ./backup.nix ];
+  imports = [
+    ./backup.nix
+    ./cleanup-timers.nix
+  ];

  services.postgresql = {
    enable = true;
    package = pkgs.postgresql_18;
+    extensions = ps: with ps; [ pg_repack ];
    enableTCPIP = true;

    authentication = ''
@@ -29,7 +29,29 @@
        firewall = {
          enable = true;
          # Allow SSH and HTTP and ports for email and irc
-          allowedTCPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
+          allowedTCPPorts = [
+            22 # SSH
+            80 # HTTP
+
+            # IRC
+            194 # IRC
+            994 # IRC (TLS)
+            6697 # IRC (SSL)
+            6665
+            6666
+            6667
+            6668
+            6669
+
+            # EMAIL
+            25  # STMP
+            465 # STMP (SSL)
+            587 # STMP (TLS/STARTTLS)
+            110 # POP3
+            995 # POP3 (SSL/TLS)
+            143 # IMAP
+            993 # IMAP (SSL/TLS)
+          ];
          allowedUDPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
        };
        # Use systemd-resolved inside the container
@@ -7,6 +7,7 @@
 {
  imports = [
    ./hardware-configuration.nix
+    ./services/bluemap.nix
    (fp /base)
  ];

@@ -22,7 +22,7 @@
    "sd_mod"
  ];
  boot.initrd.kernelModules = [ "dm-snapshot" ];
-  boot.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];

  fileSystems."/" = {
@@ -31,7 +31,7 @@
  };

  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/933A-3005";
+    device = "/dev/disk/by-uuid/BD97-FCA0";
    fsType = "vfat";
    options = [
      "fmask=0077"
@@ -0,0 +1,113 @@
+{ config, lib, pkgs, inputs, ... }:
+let
+  vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
+in {
+  # NOTE: our version of the module gets added in flake.nix
+  disabledModules = [ "services/web-apps/bluemap.nix" ];
+
+  sops.secrets."bluemap/ssh-key" = { };
+  sops.secrets."bluemap/ssh-known-hosts" = { };
+
+  services.bluemap = {
+    enable = true;
+
+    eula = true;
+    onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
+
+    enableNginx = false;
+
+    host = "minecraft.pvv.ntnu.no";
+
+    maps = let
+      inherit (inputs.minecraft-kartverket.packages.${pkgs.stdenv.hostPlatform.system}) bluemap-export;
+    in {
+      "verden" = {
+        extraHoconMarkersFile = "${bluemap-export}/overworld.hocon";
+        settings = {
+          world = vanillaSurvival;
+          dimension = "minecraft:overworld";
+          name = "Verden";
+          sorting = 0;
+          start-pos = {
+            x = 0;
+            z = 0;
+          };
+          ambient-light = 0.1;
+          cave-detection-ocean-floor = -5;
+        };
+      };
+      "underverden" = {
+        extraHoconMarkersFile = "${bluemap-export}/nether.hocon";
+        settings = {
+          world = vanillaSurvival;
+          dimension = "minecraft:the_nether";
+          name = "Underverden";
+          sorting = 100;
+          start-pos = {
+            x = 0;
+            z = 0;
+          };
+          sky-color = "#290000";
+          void-color = "#150000";
+          sky-light = 1;
+          ambient-light = 0.6;
+          remove-caves-below-y = -10000;
+          cave-detection-ocean-floor = -5;
+          cave-detection-uses-block-light = true;
+          render-mask = [{
+            max-y = 90;
+          }];
+        };
+      };
+      "enden" = {
+        extraHoconMarkersFile = "${bluemap-export}/the-end.hocon";
+        settings = {
+          world = vanillaSurvival;
+          dimension = "minecraft:the_end";
+          name = "Enden";
+          sorting = 200;
+          start-pos = {
+            x = 0;
+            z = 0;
+          };
+          sky-color = "#080010";
+          void-color = "#080010";
+          sky-light = 1;
+          ambient-light = 0.6;
+          remove-caves-below-y = -10000;
+          cave-detection-ocean-floor = -5;
+        };
+      };
+    };
+  };
+
+  systemd.services."render-bluemap-maps" = {
+    serviceConfig = {
+      StateDirectory = [ "bluemap/world" ];
+      ExecStartPre = let
+        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
+          archive = true;
+          compress = true;
+          verbose = true;
+          no-owner = true;
+          no-group = true;
+          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
+        };
+      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
+      ExecStartPost = let
+        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
+          archive = true;
+          compress = true;
+          verbose = true;
+          no-owner = true;
+          no-group = true;
+          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
+        };
+      in "${lib.getExe pkgs.rsync} ${rsyncArgs} --groupmap=root:nginx ${config.services.bluemap.webRoot}/ root@bekkalokk.pvv.ntnu.no:/";
+      LoadCredential = [
+        "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
+        "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
+      ];
+    };
+  };
+}
@@ -1,8 +1,14 @@
-{ config, fp, pkgs, lib, values, ... }:
 {
+  config,
+  fp,
+  pkgs,
+  lib,
+  values,
+  ...
+}: {
  imports = [
-      # Include the results of the hardware scan.
    ./hardware-configuration.nix
+    ./disks.nix
    (fp /base)

    ./services/monitoring
@@ -10,8 +16,8 @@
    ./services/journald-remote.nix
  ];

-  boot.loader.systemd-boot.enable = false;
-  boot.loader.grub.device = "/dev/vda";
+  boot.loader.grub.enable = true;
+  boot.loader.systemd-boot.enable = lib.mkForce false;
  boot.tmp.cleanOnBoot = true;
  zramSwap.enable = true;

@@ -27,13 +33,22 @@
    nameservers = values.defaultNetworkConfig.dns;
    defaultGateway.address = hostConf.ipv4_internal_gw;

-    interfaces."ens4" = {
+    interfaces."ens3" = {
      ipv4.addresses = [
-        { address = hostConf.ipv4;          prefixLength = 32; }
-        { address = hostConf.ipv4_internal; prefixLength = 24; }
+        {
+          address = hostConf.ipv4;
+          prefixLength = 32;
+        }
+        {
+          address = hostConf.ipv4_internal;
+          prefixLength = 24;
+        }
      ];
      ipv6.addresses = [
-        { address = hostConf.ipv6;          prefixLength = 64; }
+        {
+          address = hostConf.ipv6;
+          prefixLength = 64;
+        }
      ];
    };
  };
@@ -0,0 +1,27 @@
+{
+  disko.devices = {
+    disk = {
+      sda = {
+        device = "/dev/sda";
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            bios = {
+              size = "1M";
+              type = "EF02";
+            };
+            root = {
+              size = "100%";
+              content = {
+                type = "filesystem";
+                format = "ext4";
+                mountpoint = "/";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
@@ -1,16 +1,24 @@
-{ modulesPath, lib, ... }:
-{
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
-  boot.initrd.kernelModules = [ "nvme" ];
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/e35eb4ce-aac3-4f91-8383-6e7cd8bbf942";
-    fsType = "ext4";
-  };
-  fileSystems."/data" = {
-    device = "/dev/disk/by-uuid/0a4c1234-02d3-4b53-aeca-d95c4c8d534b";
-    fsType = "ext4";
-  };
+# Do not modify this file!  It was generated by 'nixos-generate-config'
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:

+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens3.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }
@@ -5,6 +5,7 @@
    ./grafana.nix
    ./loki.nix
    ./prometheus
+    ./scrutiny.nix
    ./uptime-kuma.nix
  ];
 }
@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, values, ... }:

 let
  cfg = config.services.loki;
@@ -9,8 +9,8 @@ in {
    configuration = {
      auth_enabled = false;
      server = {
-        http_listen_port = 3100;
-        http_listen_address = "0.0.0.0";
+        http_listen_port = 31832;
+        http_listen_address = "127.0.0.1";
        grpc_listen_port = 9096;
      };

@@ -81,5 +81,25 @@ in {
    };
  };

-  networking.firewall.allowedTCPPorts = [ cfg.configuration.server.http_listen_port ];
+  services.nginx.virtualHosts."loki.pvv.ntnu.no" = {
+    forceSSL = true;
+    enableACME = true;
+    kTLS = true;
+
+    locations = {
+      "/".return = "403";
+      "/loki/api/v1/push" = {
+        proxyPass = "http://${cfg.configuration.server.http_listen_address}:${toString cfg.configuration.server.http_listen_port}/loki/api/v1/push";
+        extraConfig = ''
+          allow 127.0.0.1;
+          allow ::1;
+          allow ${values.ipv4-space};
+          allow ${values.ipv6-space};
+          allow ${values.ntnu.ipv4-space};
+          allow ${values.ntnu.ipv6-space};
+          deny all;
+        '';
+      };
+    };
+  };
 }
@@ -21,6 +21,7 @@ in {

  fileSystems."/var/lib/prometheus2" = {
    device = stateDir;
+    fsType = "bind";
    options = [ "bind" ];
  };
 }
@@ -1,14 +1,12 @@
 { ... }:
 {
-  services.prometheus = {
-    scrapeConfigs = [
-      {
+  services.prometheus.scrapeConfigs = [{
    job_name = "exim";
    scrape_interval = "15s";
+    scheme = "http";
+
    static_configs = [{
      targets = [ "microbel.pvv.ntnu.no:9636" ];
    }];
-      }
-    ];
-  };
+  }];
 }
@@ -6,35 +6,63 @@
    targets = map (port: "${name}.pvv.ntnu.no:${toString port}") ports;
  };

+  nixosMachines = [
+    "ildkule"
+    "bekkalokk"
+    "bicep"
+    "brzeczyszczykiewicz"
+    "georg"
+    "gluttony"
+    "kommode"
+    "lupine-1"
+    "lupine-2"
+    "lupine-3"
+    "lupine-4"
+    "lupine-5"
+    # TODO: export prometheus stats via apache on temmie
+    # "temmie"
+    "wenche"
+  ];
+
  defaultNodeExporterPort = 9100;
-  defaultSystemdExporterPort = 9101;
-  defaultNixosExporterPort = 9102;
 in {
-  services.prometheus.scrapeConfigs = [{
-    job_name = "base_info";
+  services.prometheus.scrapeConfigs = [
+    {
+      job_name = "nixos-node";
+      scheme = "https";
+      metrics_path = "/prometheus-node-exporter/metrics";
+      static_configs = map (name: {
+        labels.hostname = name;
+        targets = [ "${name}.pvv.ntnu.no:443" ];
+      }) nixosMachines;
+    }
+    {
+      job_name = "nixos-systemd";
+      scheme = "https";
+      metrics_path = "/prometheus-systemd-exporter/metrics";
+      static_configs = map (name: {
+        labels.hostname = name;
+        targets = [ "${name}.pvv.ntnu.no:443" ];
+      }) nixosMachines;
+    }
+    {
+      job_name = "nixos-flake-input";
+      scheme = "https";
+      metrics_path = "/prometheus-nixos-flake-input-exporter/metrics";
+      static_configs = map (name: {
+        labels.hostname = name;
+        targets = [ "${name}.pvv.ntnu.no:443" ];
+      }) nixosMachines;
+    }
+    {
+      job_name = "non-nixos-node";
+      scheme = "http";
+      metrics_path = "/metrics";
      static_configs = [
-      (mkHostScrapeConfig "ildkule" [ cfg.exporters.node.port cfg.exporters.systemd.port defaultNixosExporterPort ])
-
-      (mkHostScrapeConfig "bekkalokk" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      (mkHostScrapeConfig "bicep" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      (mkHostScrapeConfig "brzeczyszczykiewicz" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      (mkHostScrapeConfig "georg" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      (mkHostScrapeConfig "gluttony" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      (mkHostScrapeConfig "kommode" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      (mkHostScrapeConfig "lupine-1" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      (mkHostScrapeConfig "lupine-2" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      (mkHostScrapeConfig "lupine-3" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      (mkHostScrapeConfig "lupine-4" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      (mkHostScrapeConfig "lupine-5" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      (mkHostScrapeConfig "temmie" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      (mkHostScrapeConfig "ustetind" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      (mkHostScrapeConfig "wenche" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-
-      (mkHostScrapeConfig "skrott" [ defaultNodeExporterPort defaultSystemdExporterPort ])
-
        (mkHostScrapeConfig "hildring" [ defaultNodeExporterPort ])
        (mkHostScrapeConfig "isvegg" [ defaultNodeExporterPort ])
        (mkHostScrapeConfig "microbel" [ defaultNodeExporterPort ])
      ];
-  }];
+    }
+  ];
 }
@@ -0,0 +1,40 @@
+{ config, values, ... }:
+let
+  cfg = config.services.scrutiny;
+in
+{
+  services.scrutiny = {
+    enable = true;
+    settings = {
+      web.listen = {
+        host = "127.0.0.1";
+        port = 18293;
+        basepath = "";
+      };
+
+      # notify.urls = [
+      #   "matrix://username:password@host:port/[?rooms=!roomID1[,roomAlias2]]"
+      # ];
+    };
+  };
+
+  services.nginx.virtualHosts."scrutiny.pvv.ntnu.no" = {
+    kTLS = true;
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://${cfg.settings.web.listen.host}:${toString cfg.settings.web.listen.port}";
+    };
+
+    # TODO: allow website access to the outside world, but restrict input api
+    extraConfig = ''
+      allow ${values.hosts.ildkule.ipv4}/32;
+      allow ${values.hosts.ildkule.ipv6}/128;
+      allow 127.0.0.1/32;
+      allow ::1/128;
+      allow ${values.ipv4-space};
+      allow ${values.ipv6-space};
+      deny all;
+    '';
+  };
+}
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, values, ... }:
 let
  cfg = config.services.uptime-kuma;
  domain = "status.pvv.ntnu.no";
@@ -19,8 +19,26 @@ in {
    locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
  };

-  fileSystems."/var/lib/uptime-kuma" = {
+  fileSystems."/var/lib/private/uptime-kuma" = {
    device = stateDir;
+    fsType = "bind";
    options = [ "bind" ];
  };
+
+  services.rsync-pull-targets = {
+    enable = true;
+    locations.${stateDir} = {
+      user = "root";
+      rrsyncArgs.ro = true;
+      authorizedKeysAttrs = [
+        "restrict"
+        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
+        "no-agent-forwarding"
+        "no-port-forwarding"
+        "no-pty"
+        "no-X11-forwarding"
+      ];
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXzcDm6cVr4NmWzUSroy33FlielKqaG83wY0RCMC0p/ uptime_kuma rsync backup";
+    };
+  };
 }
@@ -15,8 +15,6 @@
    address = with values.hosts.kommode; [ (ipv4 + "/25") (ipv6 + "/64") ];
  };

-  services.btrfs.autoScrub.enable = true;
-
  services.qemuGuest.enable = true;

  # Don't change (even during upgrades) unless you know what you are doing.
@@ -72,9 +72,9 @@ in
      Type = "oneshot";
      User = cfg.user;
      Group = cfg.group;
-    };
+      PrivateNetwork = true;

-    script = let
+      ExecStart = let
        logo-svg = fp /assets/logo_blue_regular.svg;
        logo-png = fp /assets/logo_blue_regular.png;

@@ -99,23 +99,25 @@ in
          ];
        } ''
          # Bigger icons
-        install -Dm444 "${cfg.package.src}/templates/repo/icon.tmpl" "$out/repo/icon.tmpl"
+          install -Dm444 '${cfg.package.src}/templates/repo/icon.tmpl' "$out/repo/icon.tmpl"
          sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
        '';
-    in ''
-      install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
-      install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
-      install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
-      install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
-      install -Dm444 ${extraLinksFooter} ${cfg.customDir}/templates/custom/extra_links_footer.tmpl
-      install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml
+        install = lib.getExe' pkgs.coreutils "install";
+      in [
+        "${install} -Dm444 '${logo-svg}' '${cfg.customDir}/public/assets/img/logo.svg'"
+        "${install} -Dm444 '${logo-png}' '${cfg.customDir}/public/assets/img/logo.png'"
+        "${install} -Dm444 '${./loading.apng}' '${cfg.customDir}/public/assets/img/loading.png'"
+        "${install} -Dm444 '${extraLinks}' '${cfg.customDir}/templates/custom/extra_links.tmpl'"
+        "${install} -Dm444 '${extraLinksFooter}' '${cfg.customDir}/templates/custom/extra_links_footer.tmpl'"
+        "${install} -Dm444 '${project-labels}' '${cfg.customDir}/options/label/project-labels.yaml'"

-      install -Dm644 ${./emotes/bruh.png} ${cfg.customDir}/public/assets/img/emoji/bruh.png
-      install -Dm644 ${./emotes/huh.gif} ${cfg.customDir}/public/assets/img/emoji/huh.png
-      install -Dm644 ${./emotes/grr.png} ${cfg.customDir}/public/assets/img/emoji/grr.png
-      install -Dm644 ${./emotes/okiedokie.jpg} ${cfg.customDir}/public/assets/img/emoji/okiedokie.png
+        "${install} -Dm644 '${./emotes/bruh.png}' '${cfg.customDir}/public/assets/img/emoji/bruh.png'"
+        "${install} -Dm644 '${./emotes/huh.gif}' '${cfg.customDir}/public/assets/img/emoji/huh.png'"
+        "${install} -Dm644 '${./emotes/grr.png}' '${cfg.customDir}/public/assets/img/emoji/grr.png'"
+        "${install} -Dm644 '${./emotes/okiedokie.jpg}' '${cfg.customDir}/public/assets/img/emoji/okiedokie.png'"

-      "${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
-    '';
+        "${lib.getExe pkgs.rsync} -a '${customTemplates}/' '${cfg.customDir}/templates/'"
+      ];
+    };
  };
 }
@@ -131,16 +131,17 @@ in {
          "repo.pulls"
          "repo.releases"
        ];
+        ALLOW_FORK_INTO_SAME_OWNER = true;
      };
      picture = {
-        DISABLE_GRAVATAR = true;
-        ENABLE_FEDERATED_AVATAR = false;
-
        AVATAR_MAX_FILE_SIZE = 1024 * 1024 * 5;
        # NOTE: go any bigger than this, and gitea will freeze your gif >:(
        AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 2;
      };
      actions.ENABLED = true;
+      webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," [
+        "external"
+      ];
    };

    dump = {
@@ -216,7 +217,7 @@ in {

  systemd.services.gitea-dump = {
    serviceConfig.ExecStart = let
-      args = lib.cli.toGNUCommandLineShell { } {
+      args = lib.cli.toCommandLineShellGNU { } {
        type = cfg.dump.type;

        # This should be declarative on nixos, no need to backup.
@@ -228,16 +229,11 @@ in {
        # Logs are stored in the systemd journal
        skip-log = true;
      };
-    in lib.mkForce "${lib.getExe cfg.package} ${args}";
+    in lib.mkForce "${lib.getExe cfg.package} dump ${args}";

-    # Only keep n backup files at a time
-    postStop = let
-      cu = prog: "'${lib.getExe' pkgs.coreutils prog}'";
-      backupCount = 3;
-    in ''
-      for file in $(${cu "ls"} -t1 '${cfg.dump.backupDir}' | ${cu "sort"} --reverse | ${cu "tail"} -n+${toString (backupCount + 1)}); do
-        ${cu "rm"} "$file"
-      done
+    # Only keep a single backup file at a time.
+    postStop = ''
+      ${lib.getExe' pkgs.coreutils "mv"} '${cfg.dump.backupDir}'/gitea-dump-*.tar.gz gitea-dump.tar.gz
    '';
  };
 }
@@ -38,11 +38,11 @@ in
      Type = "oneshot";
      User = cfg.user;
      PrivateNetwork = true;
+      ExecStart = [
+        "${lib.getExe pkgs.gnupg} --import '${config.sops.secrets."gitea/gpg-signing-key-public".path}'"
+        "${lib.getExe pkgs.gnupg} --import '${config.sops.secrets."gitea/gpg-signing-key-private".path}'"
+      ];
    };
-    script = ''
-      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-public".path}
-      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-private".path}
-    '';
  };

  services.gitea.settings."repository.signing" = {
@@ -50,6 +50,8 @@ in
    SIGNING_NAME = "PVV Git";
    SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
    INITIAL_COMMIT = "always";
+    MERGES = lib.concatStringsSep "," [ "always" ];
+    CRUD_ACTIONS = lib.concatStringsSep "," [ "always" ];
    WIKI = "always";
  };
 }
@@ -11,9 +11,9 @@ in

  systemd.services.gitea-import-users = lib.mkIf cfg.enable {
    enable = true;
-    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
    environment.PASSWD_FILE_PATH = "/run/gitea-import-users/passwd";
    serviceConfig = {
+      ExecStartPre = ''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
      ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
        flakeIgnore = [
          "E501" # Line over 80 chars lol
@@ -53,7 +53,7 @@ in
      Slice = "system-giteaweb.slice";
      Type = "oneshot";
      ExecStart = let
-        args = lib.cli.toGNUCommandLineShell { } {
+        args = lib.cli.toCommandLineShellGNU { } {
          org = "%i";
          token-path = "%d/token";
          api-url = "${giteaCfg.settings.server.ROOT_URL}api/v1";
@@ -1,15 +1,20 @@
-{ fp, values, lupineName, ... }:
+{ fp, values, lib, lupineName, ... }:
 {
  imports = [
    ./hardware-configuration/${lupineName}.nix

    (fp /base)
-
    ./services/gitea-runner.nix
  ];

  sops.defaultSopsFile = fp /secrets/lupine/lupine.yaml;

+  boot.binfmt.emulatedSystems = [
+    "aarch64-linux"
+    "armv7l-linux"
+    "i686-linux"
+  ];
+
  systemd.network.networks."30-enp0s31f6" = values.defaultNetworkConfig // {
    matchConfig.Name = "enp0s31f6";
    address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
@@ -19,9 +24,6 @@
    anyInterface = true;
  };

-  # There are no smart devices
-  services.smartd.enable = false;
-
  # Don't change (even during upgrades) unless you know what you are doing.
  # See https://search.nixos.org/options?show=system.stateVersion
  system.stateVersion = "25.05";
@@ -14,27 +14,28 @@
  boot.extraModulePackages = [ ];

  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/a949e2e8-d973-4925-83e4-bcd815e65af7";
-      fsType = "ext4";
+    { device = "/dev/disk/by-uuid/e88adbb7-de01-4f9b-b338-fffed743c259";
+      fsType = "btrfs";
+      options = [ "subvol=@root" "compress=zstd" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/e88adbb7-de01-4f9b-b338-fffed743c259";
+      fsType = "btrfs";
+      options = [ "subvol=@nix" "compress=zstd" "noatime" ];
    };

  fileSystems."/boot" =
    { device = "/dev/disk/by-uuid/81D6-38D3";
      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
+      options = [ "fmask=0022" "dmask=0022" ];
    };

  swapDevices =
    [ { device = "/dev/disk/by-uuid/82c2d7fa-7cd0-4398-8cf6-c892bc56264b"; }
    ];

-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
-
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
+
@@ -14,27 +14,27 @@
  boot.extraModulePackages = [ ];

  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/aa81d439-800b-403d-ac10-9d2aac3619d0";
-      fsType = "ext4";
+    { device = "/dev/disk/by-uuid/ab2e1a13-8e95-48d8-970c-64fa2fab52d0";
+      fsType = "btrfs";
+      options = [ "subvol=@root" "compress=zstd" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/ab2e1a13-8e95-48d8-970c-64fa2fab52d0";
+      fsType = "btrfs";
+      options = [ "subvol=@nix" "noatime" "compress=zstd" ];
    };

  fileSystems."/boot" =
    { device = "/dev/disk/by-uuid/4A34-6AE5";
      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
+      options = [ "fmask=0022" "dmask=0022" ];
    };

  swapDevices =
    [ { device = "/dev/disk/by-uuid/efb7cd0c-c1ae-4a86-8bc2-8e7fd0066650"; }
    ];

-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
-
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
@@ -14,27 +14,28 @@
  boot.extraModulePackages = [ ];

  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/39ba059b-3205-4701-a832-e72c0122cb88";
-      fsType = "ext4";
+    { device = "/dev/disk/by-uuid/0a5bda7c-af55-4d3d-9135-7f7cbb78004d";
+      fsType = "btrfs";
+      options = [ "subvol=@root" "compress=zstd" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/0a5bda7c-af55-4d3d-9135-7f7cbb78004d";
+      fsType = "btrfs";
+      options = [ "subvol=@nix" "noatime" "compress=zstd" ];
    };

  fileSystems."/boot" =
    { device = "/dev/disk/by-uuid/63FA-297B";
      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
+      options = [ "fmask=0022" "dmask=0022" ];
    };

  swapDevices =
    [ { device = "/dev/disk/by-uuid/9c72eb54-ea8c-4b09-808a-8be9b9a33869"; }
    ];

-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
-
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
+
@@ -14,21 +14,27 @@
  boot.extraModulePackages = [ ];

  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/c7bbb293-a0a3-4995-8892-0ec63e8c67dd";
-      fsType = "ext4";
+    { device = "/dev/disk/by-uuid/fcd51970-f040-4c45-94cf-2b372d4599a2";
+      fsType = "btrfs";
+      options = [ "subvol=@root" "compress=zstd" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/fcd51970-f040-4c45-94cf-2b372d4599a2";
+      fsType = "btrfs";
+      options = [ "subvol=@nix" "noatime" "compress=zstd" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/A22E-E41A";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
    };

  swapDevices =
    [ { device = "/dev/disk/by-uuid/a86ffda8-8ecb-42a1-bf9f-926072e90ca5"; }
    ];

-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
-
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
@@ -14,27 +14,27 @@
  boot.extraModulePackages = [ ];

  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/5f8418ad-8ec1-4f9e-939e-f3a4c36ef343";
-      fsType = "ext4";
+    { device = "/dev/disk/by-uuid/85830e14-e2c8-4f04-95fa-d6ab22840bc7";
+      fsType = "btrfs";
+      options = [ "subvol=@root" "compress=zstd" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/85830e14-e2c8-4f04-95fa-d6ab22840bc7";
+      fsType = "btrfs";
+      options = [ "subvol=@nix" "noatime" "compress=zstd" ];
    };

  fileSystems."/boot" =
    { device = "/dev/disk/by-uuid/F372-37DF";
      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
+      options = [ "fmask=0022" "dmask=0022" ];
    };

  swapDevices =
    [ { device = "/dev/disk/by-uuid/27bf292d-bbb3-48c4-a86e-456e0f1f648f"; }
    ];

-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
-
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
@@ -39,17 +39,22 @@
        "debian-bullseye-slim:docker://node:current-bullseye-slim"

        "alpine-latest:docker://node:current-alpine"
+        "alpine-3.23:docker://node:current-alpine3.23"
        "alpine-3.22:docker://node:current-alpine3.22"
        "alpine-3.21:docker://node:current-alpine3.21"

        # See https://gitea.com/gitea/runner-images
        "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+        "ubuntu-26.04:docker://docker.gitea.com/runner-images:ubuntu-26.04"
+        "ubuntu-resolute:docker://docker.gitea.com/runner-images:ubuntu-26.04"
        "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
        "ubuntu-noble:docker://docker.gitea.com/runner-images:ubuntu-24.04"
        "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
        "ubuntu-jammy:docker://docker.gitea.com/runner-images:ubuntu-22.04"

        "ubuntu-latest-slim:docker://docker.gitea.com/runner-images:ubuntu-latest-slim"
+        "ubuntu-26.04-slim:docker://docker.gitea.com/runner-images:ubuntu-26.04-slim"
+        "ubuntu-resolute-slim:docker://docker.gitea.com/runner-images:ubuntu-26.04-slim"
        "ubuntu-24.04-slim:docker://docker.gitea.com/runner-images:ubuntu-24.04-slim"
        "ubuntu-noble-slim:docker://docker.gitea.com/runner-images:ubuntu-24.04-slim"
        "ubuntu-22.04-slim:docker://docker.gitea.com/runner-images:ubuntu-22.04-slim"
@@ -28,17 +28,26 @@

  sops.secrets = {
    "dibbler/postgresql/password" = {
-      owner = "dibbler";
-      group = "dibbler";
+      owner = "drumknotty";
+      group = "drumknotty";
+    };
+    "worblehat/postgresql/password" = {
+      owner = "drumknotty";
+      group = "drumknotty";
    };
  };

-  services.dibbler = {
+  services.drumknotty = {
    enable = true;
    kioskMode = true;
-    limitScreenWidth = 80;
-    limitScreenHeight = 42;

+    screen = {
+      limitWidth = 80;
+      limitHeight = 42;
+    };
+
+    dibbler = {
+      enable = true;
      settings = {
        general.quit_allowed = false;
        database = {
@@ -53,6 +62,23 @@
      };
    };

+    worblehat = {
+      enable = true;
+      settings = {
+        general.quit_allowed = false;
+        database = {
+          type = "postgresql";
+          postgresql = {
+            username = "worblehat";
+            dbname = "worblehat";
+            host = "postgres.pvv.ntnu.no";
+            password = config.sops.secrets."worblehat/postgresql/password".path;
+          };
+        };
+      };
+    };
+  };
+
  systemd.services."serial-getty@ttyUSB0" = lib.mkIf (!config.virtualisation.isVmVariant) {
    enable = true;
    wantedBy = [ "getty.target" ]; # to start at boot
@@ -1,112 +0,0 @@
-{ config, pkgs, lib, modulesPath, fp, values, ... }: {
-  imports = [
-    (modulesPath + "/profiles/perlless.nix")
-
-    (fp /base)
-  ];
-
-  # Disable import of a bunch of tools we don't need from nixpkgs.
-  disabledModules = [ "profiles/base.nix" ];
-
-  sops.defaultSopsFile = fp /secrets/skrott/skrott.yaml;
-
-  boot = {
-    consoleLogLevel = 0;
-    enableContainers = false;
-    loader.grub.enable = false;
-    loader.systemd-boot.enable = false;
-    kernelPackages = pkgs.linuxPackages;
-  };
-
-  hardware = {
-    enableAllHardware = lib.mkForce false;
-    firmware = [ pkgs.raspberrypiWirelessFirmware ];
-  };
-
-  # Now turn off a bunch of stuff lol
-  # TODO: can we reduce further?
-  # See also https://nixcademy.com/posts/minimizing-nixos-images/
-  system.autoUpgrade.enable = lib.mkForce false;
-  services.irqbalance.enable = lib.mkForce false;
-  services.logrotate.enable = lib.mkForce false;
-  services.nginx.enable = lib.mkForce false;
-  services.postfix.enable = lib.mkForce false;
-  services.smartd.enable = lib.mkForce false;
-  services.udisks2.enable = lib.mkForce false;
-  services.thermald.enable = lib.mkForce false;
-  services.promtail.enable = lib.mkForce false;
-  # There aren't really that many firmware updates for rbpi3 anyway
-  services.fwupd.enable = lib.mkForce false;
-
-  documentation.enable = lib.mkForce false;
-
-  environment.enableAllTerminfo = lib.mkForce false;
-
-  programs.neovim.enable = lib.mkForce false;
-  programs.zsh.enable = lib.mkForce false;
-  programs.git.package = pkgs.gitMinimal;
-
-  nix.registry = lib.mkForce { };
-  nix.nixPath = lib.mkForce [ ];
-
-  sops.secrets = {
-    "dibbler/postgresql/password" = {
-      owner = "dibbler";
-      group = "dibbler";
-    };
-  };
-
-  # zramSwap.enable = true;
-
-  networking = {
-    hostName = "skrott";
-    defaultGateway = values.hosts.gateway;
-    defaultGateway6 = values.hosts.gateway6;
-    interfaces.eth0 = {
-      useDHCP = false;
-      ipv4.addresses = [{
-        address = values.hosts.skrott.ipv4;
-        prefixLength = 25;
-      }];
-      ipv6.addresses = [{
-        address = values.hosts.skrott.ipv6;
-        prefixLength = 25;
-      }];
-    };
-  };
-
-  services.dibbler = {
-    enable = true;
-    kioskMode = true;
-    limitScreenWidth = 80;
-    limitScreenHeight = 42;
-
-    settings = {
-      general.quit_allowed = false;
-      database = {
-        type = "postgresql";
-        postgresql = {
-          username = "pvv_vv";
-          dbname = "pvv_vv";
-          host = "postgres.pvv.ntnu.no";
-          password_file = config.sops.secrets."dibbler/postgresql/password".path;
-        };
-      };
-    };
-  };
-
-  # https://github.com/NixOS/nixpkgs/issues/84105
-  boot.kernelParams = lib.mkIf (!config.virtualisation.isVmVariant) [
-    "console=ttyUSB0,9600"
-    # "console=tty1" # Already part of the module
-  ];
-  systemd.services."serial-getty@ttyUSB0" = lib.mkIf (!config.virtualisation.isVmVariant) {
-    enable = true;
-    wantedBy = [ "getty.target" ]; # to start at boot
-    serviceConfig.Restart = "always"; # restart when session is closed
-  };
-
-  # Don't change (even during upgrades) unless you know what you are doing.
-  # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "25.11";
-}
@@ -6,7 +6,7 @@
    (fp /base)

    ./services/nfs-mounts.nix
-    ./services/userweb.nix
+    ./services/userweb
  ];

  systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
@@ -1,344 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.httpd;
-
-  homeLetters = [ "a" "b" "c" "d" "h" "i" "j" "k" "l" "m" "z" ];
-
-  # https://nixos.org/manual/nixpkgs/stable/#ssec-php-user-guide-installing-with-extensions
-  phpEnv = pkgs.php.buildEnv {
-    extensions = { all, ... }: with all; [
-      imagick
-      opcache
-      protobuf
-    ];
-
-    extraConfig = ''
-      display_errors=0
-      post_max_size = 40M
-      upload_max_filesize = 40M
-    '';
-  };
-
-  perlEnv = pkgs.perl.withPackages (ps: with ps; [
-    pkgs.exiftool
-    pkgs.ikiwiki
-    pkgs.irssi
-    pkgs.nix.libs.nix-perl-bindings
-
-    AlgorithmDiff
-    AnyEvent
-    AnyEventI3
-    ArchiveZip
-    CGI
-    CPAN
-    CPANPLUS
-    DBDPg
-    DBDSQLite
-    DBI
-    EmailAddress
-    EmailSimple
-    Env
-    Git
-    HTMLMason
-    HTMLParser
-    HTMLTagset
-    HTTPDAV
-    HTTPDaemon
-    ImageMagick
-    JSON
-    LWP
-    MozillaCA
-    PathTiny
-    Switch
-    SysSyslog
-    TestPostgreSQL
-    TextPDF
-    TieFile
-    Tk
-    URI
-    XMLLibXML
-  ]);
-
-  # https://nixos.org/manual/nixpkgs/stable/#python.buildenv-function
-  pythonEnv = pkgs.python3.buildEnv.override {
-    extraLibs = with pkgs.python3Packages; [
-      legacy-cgi
-
-      matplotlib
-      requests
-    ];
-    ignoreCollisions = true;
-  };
-
-  # https://nixos.org/manual/nixpkgs/stable/#sec-building-environment
-  fhsEnv = pkgs.buildEnv {
-    name = "userweb-env";
-    paths = with pkgs; [
-      bash
-
-      perlEnv
-      pythonEnv
-
-      phpEnv
-    ]
-    ++ (with phpEnv.packages; [
-      # composer
-    ])
-    ++ [
-      acl
-      aspell
-      autoconf
-      autotrash
-      bazel
-      bintools
-      bison
-      bsd-finger
-      catdoc
-      ccache
-      clang
-      cmake
-      coreutils-full
-      curl
-      devcontainer
-      diffutils
-      emacs
-      # exiftags
-      exiftool
-      ffmpeg
-      file
-      findutils
-      gawk
-      gcc
-      glibc
-      gnugrep
-      gnumake
-      gnupg
-      gnuplot
-      gnused
-      gnutar
-      gzip
-      html-tidy
-      imagemagick
-      inetutils
-      iproute2
-      jhead
-      less
-      libgcc
-      lndir
-      mailutils
-      man # TODO: does this one want a mandb instance?
-      meson
-      more
-      mpc
-      mpi
-      mplayer
-      ninja
-      nix
-      openssh
-      openssl
-      patchelf
-      pkg-config
-      ppp
-      procmail
-      procps
-      qemu
-      rc
-      rhash
-      rsync
-      ruby # TODO: does this one want systemwide packages?
-      salt
-      sccache
-      sourceHighlight
-      spamassassin
-      strace
-      subversion
-      system-sendmail
-      systemdMinimal
-      texliveMedium
-      tmux
-      unzip
-      util-linux
-      valgrind
-      vim
-      wget
-      which
-      wine
-      xdg-utils
-      zip
-      zstd
-    ];
-
-    extraOutputsToInstall = [
-      "man"
-      "doc"
-    ];
-  };
-in
-{
-  services.httpd = {
-    enable = true;
-    adminAddr = "drift@pvv.ntnu.no";
-
-    # TODO: consider upstreaming systemd support
-    # TODO: mod_log_journald in v2.5
-    package = pkgs.apacheHttpd.overrideAttrs (prev: {
-      nativeBuildInputs = prev.nativeBuildInputs ++ [ pkgs.pkg-config ];
-      buildInputs = prev.buildInputs ++ [ pkgs.systemdLibs ];
-      configureFlags = prev.configureFlags ++ [ "--enable-systemd" ];
-    });
-
-    enablePHP = true;
-    phpPackage = phpEnv;
-
-    enablePerl = true;
-
-    # TODO: mod_log_journald in v2.5
-    extraModules = [
-      "systemd"
-      "userdir"
-      # TODO: I think the compilation steps of pkgs.apacheHttpdPackages.mod_perl might have some
-      #       incorrect or restrictive assumptions upstream, either nixpkgs or source
-      # {
-      #   name = "perl";
-      #   path = let
-      #     mod_perl = pkgs.apacheHttpdPackages.mod_perl.override {
-      #       apacheHttpd = cfg.package.out;
-      #       perl = perlEnv;
-      #     };
-      #   in "${mod_perl}/modules/mod_perl.so";
-      # }
-    ];
-
-    extraConfig = ''
-      TraceEnable on
-      LogLevel warn rewrite:trace3
-      ScriptLog ${cfg.logDir}/cgi.log
-    '';
-
-    # virtualHosts."userweb.pvv.ntnu.no" = {
-    virtualHosts."temmie.pvv.ntnu.no" = {
-      forceSSL = true;
-      enableACME = true;
-
-      extraConfig = ''
-        UserDir ${lib.concatMapStringsSep " " (l: "/home/pvv/${l}/*/web-docs") homeLetters}
-        UserDir disabled root
-        AddHandler cgi-script .cgi
-        DirectoryIndex index.html index.html.var index.php index.php3 index.cgi index.phtml index.shtml meg.html
-
-        <Directory "/home/pvv/?/*/web-docs">
-          Options MultiViews Indexes SymLinksIfOwnerMatch ExecCGI IncludesNoExec
-          AllowOverride All
-          Require all granted
-        </Directory>
-      '';
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
-
-  # socket activation comes in v2.5
-  # systemd.sockets.httpd = {
-  #   wantedBy = [ "sockets.target" ];
-  #   description = "HTTPD socket";
-  #   listenStreams = [
-  #     "0.0.0.0:80"
-  #     "0.0.0.0:443"
-  #   ];
-  # };
-
-  systemd.services.httpd = {
-    after = [ "pvv-homedirs.target" ];
-    requires = [ "pvv-homedirs.target" ];
-
-    environment = {
-      PATH = lib.mkForce "/usr/bin";
-    };
-
-    serviceConfig = {
-      Type = lib.mkForce "notify";
-
-      ExecStart = lib.mkForce "${cfg.package}/bin/httpd -D FOREGROUND -f /etc/httpd/httpd.conf -k start";
-      ExecReload = lib.mkForce "${cfg.package}/bin/httpd -f /etc/httpd/httpd.conf -k graceful";
-      ExecStop = lib.mkForce "";
-      KillMode = "mixed";
-
-      ConfigurationDirectory = [ "httpd" ];
-      LogsDirectory = [ "httpd" ];
-      LogsDirectoryMode = "0700";
-
-      CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
-      LockPersonality = true;
-      PrivateDevices = true;
-      PrivateTmp = true;
-      # NOTE: this removes CAP_NET_BIND_SERVICE...
-      # PrivateUsers = true;
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = "tmpfs";
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectSystem = true;
-      RemoveIPC = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-        "AF_NETLINK"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SocketBindDeny = "any";
-      SocketBindAllow = [
-        "tcp:80"
-        "tcp:443"
-      ];
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-         "@system-service"
-      ];
-      UMask = "0077";
-
-      RuntimeDirectory = [ "httpd/root-mnt" ];
-      RootDirectory = "/run/httpd/root-mnt";
-      MountAPIVFS = true;
-      BindReadOnlyPaths = [
-        builtins.storeDir
-        "/etc"
-        # NCSD socket
-        "/var/run"
-        "/var/lib/acme"
-
-        "${fhsEnv}/bin:/bin"
-        "${fhsEnv}/sbin:/sbin"
-        "${fhsEnv}/lib:/lib"
-        "${fhsEnv}/share:/share"
-      ] ++ (lib.mapCartesianProduct ({ parent, child }: "${fhsEnv}${child}:${parent}${child}") {
-        parent = [
-          "/local"
-          "/opt"
-          "/opt/local"
-          "/store"
-          "/store/gnu"
-          "/usr"
-          "/usr/local"
-        ];
-        child = [
-          "/bin"
-          "/sbin"
-          "/lib"
-          "/libexec"
-          "/include"
-          "/share"
-        ];
-      });
-      BindPaths = map (l: "/run/pvv-home-mounts/${l}:/home/pvv/${l}") homeLetters;
-    };
-  };
-
-  # TODO: create phpfpm pools with php environments that contain packages similar to those present on tom
-}
@@ -0,0 +1 @@
+target
@@ -0,0 +1,171 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "apache-log-processor"
+version = "0.1.0"
+dependencies = [
+ "nix",
+ "time",
+]
+
+[[package]]
+name = "bitflags"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "powerfmt",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
+[[package]]
+name = "num_threads"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "time"
+version = "0.3.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+dependencies = [
+ "deranged",
+ "itoa",
+ "libc",
+ "num-conv",
+ "num_threads",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+
+[[package]]
+name = "time-macros"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
@@ -0,0 +1,19 @@
+[package]
+name = "apache-log-processor"
+version = "0.1.0"
+edition = "2024"
+autobins = false
+license = "MIT"
+authors = [
+  "projects@pvv.ntnu.no",
+]
+
+[dependencies]
+nix = { version = "0.31.3", features = ["event", "fs", "user"] }
+time = { version = "0.3.47", features = ["formatting", "local-offset"] }
+
+
+[[bin]]
+name = "apache-log-processor"
+bench = false
+path = "src/main.rs"
@@ -0,0 +1,33 @@
+{
+  lib
+, rustPlatform
+, stdenv
+}:
+let
+  cargoToml = fromTOML (builtins.readFile ./Cargo.toml);
+  cargoLock = ./Cargo.lock;
+  mainProgram = (lib.head cargoToml.bin).name;
+  pname = cargoToml.package.name;
+in
+rustPlatform.buildRustPackage {
+  inherit pname;
+  inherit (cargoToml.package) version;
+  src = lib.fileset.toSource {
+    root = ./.;
+    fileset = lib.fileset.unions [
+      ./Cargo.toml
+      ./Cargo.lock
+      ./src
+    ];
+  };
+
+  cargoLock.lockFile = cargoLock;
+
+  doCheck = true;
+
+  meta = with lib; {
+    license = licenses.mit;
+    platforms = platforms.linux;
+    inherit mainProgram;
+  };
+}
@@ -0,0 +1,321 @@
+use nix::{
+    errno::Errno,
+    fcntl::{FcntlArg, OFlag, fcntl, open},
+    sys::{
+        epoll::{Epoll, EpollCreateFlags, EpollEvent, EpollFlags, EpollTimeout},
+        stat::Mode,
+    },
+    unistd::{User, getegid, geteuid, read, setegid, seteuid, write},
+};
+use std::{
+    collections::VecDeque,
+    os::fd::{AsFd, BorrowedFd, OwnedFd},
+    path::PathBuf,
+    process::exit,
+};
+use time::{OffsetDateTime, format_description};
+
+const READ_BUFFER_SIZE: usize = 8 * 1024;
+
+#[derive(Debug, Clone, Copy)]
+enum LogMode {
+    Access,
+    Error,
+}
+
+fn main() -> Result<(), String> {
+    let log_mode = match std::env::args().nth(1).as_deref() {
+        Some("access") => LogMode::Access,
+        Some("error") => LogMode::Error,
+        Some(other) => {
+            return Err(format!(
+                "invalid log mode `{other}`; expected `access` or `error`"
+            ));
+        }
+        None => return Err("missing log mode argument; expected `access` or `error`".to_string()),
+    };
+
+    let tee_file = match log_mode {
+        LogMode::Access => None,
+        LogMode::Error => Some(
+            open(
+                &PathBuf::from("/var/log/httpd/error.log"),
+                OFlag::O_WRONLY | OFlag::O_APPEND | OFlag::O_CREAT | OFlag::O_CLOEXEC,
+                Mode::S_IRUSR | Mode::S_IWUSR,
+            )
+            .map_err(|error| format!("failed to open error log for teeing: {error}"))?,
+        ),
+    };
+
+    let stdin = std::io::stdin();
+
+    fcntl(stdin.as_fd(), FcntlArg::F_GETFL)
+        .map(OFlag::from_bits_retain)
+        .map(|flags| FcntlArg::F_SETFL(flags | OFlag::O_NONBLOCK))
+        .and_then(|flags| fcntl(stdin.as_fd(), flags))
+        .map_err(|error| format!("failed to make stdin nonblocking: {error}"))?;
+
+    let epoll = Epoll::new(EpollCreateFlags::EPOLL_CLOEXEC)
+        .map_err(|error| format!("failed to create epoll instance: {error}"))?;
+
+    epoll
+        .add(
+            stdin.as_fd(),
+            EpollEvent::new(
+                EpollFlags::EPOLLIN | EpollFlags::EPOLLERR | EpollFlags::EPOLLHUP,
+                0,
+            ),
+        )
+        .map_err(|error| format!("failed to register stdin with epoll: {error}"))?;
+
+    if let Err(error) = event_loop(log_mode, epoll, stdin.as_fd(), tee_file) {
+        eprintln!("Error: {error}");
+        exit(1);
+    }
+
+    Ok(())
+}
+
+fn event_loop(
+    log_mode: LogMode,
+    epoll: Epoll,
+    stdin_fd: BorrowedFd<'_>,
+    mut tee_file: Option<OwnedFd>,
+) -> Result<(), String> {
+    let mut events = [EpollEvent::empty(); 1];
+    let mut pending = VecDeque::new();
+
+    loop {
+        let ready = loop {
+            match epoll.wait(&mut events, EpollTimeout::NONE) {
+                Ok(ready) => break ready,
+                Err(Errno::EINTR) => continue,
+                Err(error) => {
+                    return Err(format!("epoll wait failed: {error}"));
+                }
+            }
+        };
+
+        if ready == 0 {
+            continue;
+        }
+
+        let mut scratch = [0u8; READ_BUFFER_SIZE];
+
+        let eof = loop {
+            match read(stdin_fd, &mut scratch) {
+                Ok(0) => break true,
+                Ok(read_bytes) => pending.extend(scratch[..read_bytes].iter().copied()),
+                Err(Errno::EINTR) => continue,
+                Err(Errno::EAGAIN) => break false,
+                Err(error) => {
+                    return Err(format!("failed to read from stdin: {error}"));
+                }
+            }
+        };
+
+        while let Some(newline_index) = pending.iter().position(|byte| *byte == b'\n') {
+            let line = pending.make_contiguous();
+            process_line(log_mode, &line[..=newline_index], &mut tee_file)?;
+            pending.drain(..=newline_index);
+        }
+
+        if eof {
+            if !pending.is_empty() {
+                process_line(log_mode, pending.make_contiguous(), &mut tee_file)?;
+                pending.clear();
+            }
+            return Ok(());
+        }
+    }
+}
+
+fn process_line(
+    log_mode: LogMode,
+    line: &[u8],
+    tee_file: &mut Option<OwnedFd>,
+) -> Result<(), String> {
+    if let Some(tee_file) = tee_file.as_ref() {
+        write_all_fd(tee_file, line).map_err(|error| {
+            format!("failed to append to APACHE_LOG_PROCESSOR_TEE_FILE: {error}")
+        })?;
+    }
+
+    if let Some(user) =
+        parse_username_from_line(line).and_then(|name| User::from_name(name).ok().flatten())
+    {
+        let identity = EffectiveIdentity::switch_to(&user).map_err(|error| {
+            format!(
+                "failed to switch effective identity to {} (uid {}, gid {}): {error}",
+                user.name, user.uid, user.gid
+            )
+        })?;
+
+        let result: Result<(), String> = (|| {
+            let dir = user.dir.join("nobackup/weblogs");
+
+            if !dir.is_dir() {
+                return Err(format!(
+                    "logs directory {} does not exist for user {}",
+                    dir.display(),
+                    user.name
+                ));
+            }
+
+            let now = OffsetDateTime::now_local()
+                .unwrap_or_else(|_| OffsetDateTime::now_utc())
+                .format(&format_description::parse("[year]-[month]-[day]").unwrap())
+                .map_err(|error| {
+                    format!("failed to format current date for log file name: {error}")
+                })?;
+
+            let logfile = dir.join(match log_mode {
+                LogMode::Access => format!("access-{now}.log"),
+                LogMode::Error => format!("error-{now}.log"),
+            });
+
+            let fd = open(
+                &logfile,
+                OFlag::O_WRONLY | OFlag::O_APPEND | OFlag::O_CREAT | OFlag::O_CLOEXEC,
+                Mode::S_IRUSR
+                    | Mode::S_IWUSR
+                    | Mode::S_IRGRP
+                    | Mode::S_IROTH
+                    | Mode::S_IWGRP
+                    | Mode::S_IWOTH,
+            )
+            .map_err(|error| format!("failed to open log file for user {}: {error}", user.name))?;
+
+            write_all_fd(fd.as_fd(), line).map_err(|error| {
+                format!(
+                    "failed to append to log file for user {}: {error}",
+                    user.name
+                )
+            })?;
+
+            Ok(())
+        })();
+
+        if let Err(error) = result {
+            eprintln!("Error processing log line for user {}: {error}", user.name);
+        }
+
+        identity.restore().map_err(|error| {
+            format!(
+                "failed to restore original effective identity after handling {}: {error}",
+                user.name
+            )
+        })?;
+    }
+
+    Ok(())
+}
+
+fn parse_username_from_line(line: &[u8]) -> Option<&str> {
+    line.splitn(8, |&b| b == b' ')
+        .nth(6)
+        .and_then(|path| {
+            path.strip_prefix(b"/~")
+                .and_then(|rest| rest.split(|&b| b == b'/').next())
+        })
+        .or_else(|| {
+            line.windows(b"/home/pvv/".len())
+                .enumerate()
+                .find_map(|(start, window)| {
+                    (window == b"/home/pvv/")
+                        .then_some(start + b"/home/pvv/".len())
+                        .and_then(|start| line.get(start..))
+                        .filter(|rest| rest.get(1) == Some(&b'/'))
+                        .and_then(|rest| rest.get(2..))
+                        .and_then(|rest| rest.split(|&b| b == b'/').next())
+                })
+        })
+        .filter(|segment| !segment.is_empty())
+        .and_then(|segment| std::str::from_utf8(segment).ok())
+}
+
+fn write_all_fd<Fd: AsFd>(fd: Fd, mut buffer: &[u8]) -> nix::Result<()> {
+    while !buffer.is_empty() {
+        match write(fd.as_fd(), buffer) {
+            Ok(0) => return Err(Errno::EIO),
+            Ok(written) => buffer = &buffer[written..],
+            Err(Errno::EINTR) => continue,
+            Err(error) => return Err(error),
+        }
+    }
+
+    Ok(())
+}
+
+struct EffectiveIdentity {
+    saved_euid: nix::unistd::Uid,
+    saved_egid: nix::unistd::Gid,
+    restored: bool,
+}
+
+impl EffectiveIdentity {
+    fn switch_to(user: &User) -> nix::Result<Self> {
+        let guard = Self {
+            saved_euid: geteuid(),
+            saved_egid: getegid(),
+            restored: false,
+        };
+
+        setegid(user.gid)?;
+        if let Err(error) = seteuid(user.uid) {
+            let _ = setegid(guard.saved_egid);
+            return Err(error);
+        }
+
+        Ok(guard)
+    }
+
+    fn restore(mut self) -> nix::Result<()> {
+        let restore_uid = seteuid(self.saved_euid);
+        let restore_gid = setegid(self.saved_egid);
+        self.restored = true;
+
+        restore_uid?;
+        restore_gid?;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_parse_user_from_access_log() {
+        let inputs = [(
+            "1.2.3.4 - - [25/May/2026:10:07:24 +0200] \"GET /~oysteikt/ HTTP/2.0\" 200 3708",
+            "oysteikt",
+        )];
+
+        for (line, expected_user) in inputs {
+            let parsed_user = parse_username_from_line(line.as_bytes());
+            assert_eq!(
+                parsed_user,
+                Some(expected_user),
+                "Failed to parse user from line: {line}"
+            );
+        }
+    }
+
+    #[test]
+    fn test_parse_user_from_error_log() {
+        let inputs = [(
+            "[Sat May 09 20:45:21.480016 2026] [authz_core:error] [pid 3555:tid 3617] [remote 1::2:42000] AH01630: client denied by server configuration: /home/pvv/d/oysteikt/web-docs/.git",
+            "oysteikt",
+        )];
+
+        for (line, expected_user) in inputs {
+            let parsed_user = parse_username_from_line(line.as_bytes());
+            assert_eq!(
+                parsed_user,
+                Some(expected_user),
+                "Failed to parse user from line: {line}"
+            );
+        }
+    }
+}
@@ -0,0 +1,473 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.httpd;
+
+  # NOTE Enable this if you want to strace stuff in the sandbox...
+  debug = false;
+
+  homeLetters = [ "a" "b" "c" "d" "h" "i" "j" "k" "l" "m" "z" ];
+
+  phpOptions = lib.concatStringsSep "\n" (lib.mapAttrsToList (k: v: "${k} = ${v}"){
+    display_errors = "Off";
+    display_startup_errors = "Off";
+    post_max_size = "40M";
+    upload_max_filesize = "40M";
+  });
+
+  apache-log-processor = pkgs.callPackage ./apache-log-processor { };
+
+  # https://nixos.org/manual/nixpkgs/stable/#ssec-php-user-guide-installing-with-extensions
+  phpEnv = pkgs.php.buildEnv {
+    extensions = { all, ... }: with all; [
+      bz2
+      curl
+      decimal
+      gd
+      imagick
+      mysqli
+      mysqlnd
+      pgsql
+      posix
+      protobuf sqlite3
+      uuid
+      xml
+      xsl
+      zlib
+      zstd
+
+      pdo
+      pdo_mysql
+      pdo_pgsql
+      pdo_sqlite
+    ];
+
+    extraConfig = phpOptions;
+  };
+
+  perlEnv = (pkgs.perl.withPackages (ps: with ps; [
+    pkgs.exiftool
+    pkgs.ikiwiki
+    pkgs.irssi
+    pkgs.nix.libs.nix-perl-bindings
+
+    CGI
+    DBDPg
+    DBDSQLite
+    DBDmysql
+    DBI
+    Git
+    ImageMagick
+    JSON
+    TemplateToolkit
+  ])).overrideAttrs (prev: {
+    # NOTE: `pkgs.perl.propagatedBuildInputs` don't actually propagate through the
+    #       wrapper derivation created by `withPackages`. This should compensate
+    #       for that.
+    postBuild = prev.postBuild + ''
+      cp -r '${pkgs.perl}/nix-support' "$out"/nix-support
+    '';
+  });
+
+  # https://nixos.org/manual/nixpkgs/stable/#python.buildenv-function
+  pythonEnv = pkgs.python3.buildEnv.override {
+    extraLibs = with pkgs.python3Packages; [
+      legacy-cgi
+
+      matplotlib
+      requests
+    ];
+    ignoreCollisions = true;
+  };
+
+  # https://nixos.org/manual/nixpkgs/stable/#sec-building-environment
+  fhsEnv = pkgs.buildEnv {
+    name = "userweb-env";
+    ignoreCollisions = true;
+    paths = with pkgs; [
+      bash
+
+      config.services.bro.instances.userweb-sendmail.client.package
+
+      perlEnv
+      pythonEnv
+      phpEnv
+    ]
+    ++ (with phpEnv.packages; [
+      # composer
+    ])
+    ++ [
+      # Useful packages for homepages
+      exiftool
+      gnuplot
+      ikiwiki-full
+      imagemagick
+      jhead
+      ruby
+      sbcl
+      sourceHighlight
+
+      # Missing packages from tom
+      # blosxom
+      # pyblosxom
+      # mediawiki (TODO: do people host their own mediawikis in userweb?)
+      # nanoblogger
+
+      # Version control
+      cvs
+      rcs
+      git
+
+      # Compression/Archival
+      bzip2
+      gnutar
+      gzip
+      lz4
+      unzip
+      xz
+      zip
+      zstd
+
+      # Other tools you might expect to find on a normal system
+      acl
+      coreutils-full
+      curl
+      diffutils
+      file
+      findutils
+      gawk
+      gnugrep
+      gnumake
+      gnupg
+      gnused
+      less
+      man
+      util-linux
+      vim
+      wget
+      which
+      xdg-utils
+    ] ++ lib.optionals debug [
+      glibc.getent
+      strace
+      systemd
+    ];
+
+    extraOutputsToInstall = [
+      "man"
+      "doc"
+    ];
+  };
+in
+{
+  imports = [
+    ./mail.nix
+  ];
+
+  sops.secrets = {
+    "httpd/passwd-ssh-key" = { };
+    "httpd/ssh-known-hosts" = { };
+  };
+
+  services.httpd = {
+    enable = true;
+    adminAddr = "drift@pvv.ntnu.no";
+
+    # TODO: consider upstreaming systemd support
+    # TODO: mod_log_journald in v2.5
+    package = pkgs.apacheHttpd.overrideAttrs (prev: {
+      nativeBuildInputs = prev.nativeBuildInputs ++ [ pkgs.pkg-config ];
+      buildInputs = prev.buildInputs ++ [ pkgs.systemdLibs ];
+      configureFlags = prev.configureFlags ++ [ "--enable-systemd" ];
+    });
+
+    enablePHP = true;
+    phpPackage = phpEnv;
+    inherit phpOptions;
+
+    enablePerl = true;
+
+    # TODO: mod_log_journald in v2.5
+    extraModules = [
+      "systemd"
+      "userdir"
+      {
+        name = "perl";
+        path = let
+          mod_perl = pkgs.symlinkJoin {
+            name = "userweb_modperl_with_custom_perl_env";
+            ignoreCollisions = true;
+            paths = [
+              (pkgs.apacheHttpdPackages.mod_perl.override {
+                apacheHttpd = cfg.package.out;
+              })
+              perlEnv
+            ];
+          };
+        in "${mod_perl}/modules/mod_perl.so";
+      }
+    ];
+
+    logPerVirtualHost = false;
+
+    extraConfig = ''
+      TraceEnable on
+      LogLevel warn rewrite:trace3
+
+      <FilesMatch ".+\.ph(p[3457]?|t|tml)$">
+          SetHandler application/x-httpd-php
+      </FilesMatch>
+      <FilesMatch ".+\.phps$">
+          SetHandler application/x-httpd-php-source
+          Require all denied
+      </FilesMatch>
+      <FilesMatch "\.pl$">
+          SetHandler modperl
+          PerlResponseHandler ModPerl::Registry
+          Options +ExecCGI
+      </FilesMatch>
+    '';
+
+    virtualHosts."temmie.pvv.ntnu.no" = {
+      forceSSL = true;
+      enableACME = true;
+
+      serverAliases = [
+        "www2.pvv.ntnu.no"
+      ];
+
+      extraConfig = ''
+        CustomLog "${cfg.logDir}/access.log" combined
+        CustomLog "|${lib.getExe apache-log-processor} access" combined
+        ErrorLog "|${lib.getExe apache-log-processor} error"
+        ScriptLog "${cfg.logDir}/cgi.log"
+
+        UserDir ${lib.concatMapStringsSep " " (l: "/home/pvv/${l}/*/web-docs") homeLetters}
+        UserDir disabled root
+        AddHandler cgi-script .cgi
+        DirectoryIndex index.html index.html.var index.php index.php3 index.cgi index.phtml index.shtml meg.html
+        SetEnvIf Request_URI "^/~([^/]+)" USERDIR_USER=$1
+
+        <Directory "/home/pvv/?/*/web-docs">
+          Options MultiViews Indexes SymLinksIfOwnerMatch ExecCGI IncludesNoExec
+          AllowOverride All
+          Require all granted
+        </Directory>
+
+        <DirectoryMatch "^/home/pvv/.*/web-docs/(${lib.concatStringsSep "|" [
+          "\\.git"
+          "\\.hg"
+          "\\.svn"
+          "\\.ssh"
+          "\\.env"
+          "\\.envrc"
+          "\\.bzr"
+          "\\.venv"
+          "CVS"
+          "RCS"
+          ".*\\.swp"
+          ".*\\.bak"
+          ".*~"
+        ]})(/|$)">
+            AllowOverride All
+            Require all denied
+        </DirectoryMatch>
+      '';
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+
+  # socket activation comes in v2.5
+  # systemd.sockets.httpd = {
+  #   wantedBy = [ "sockets.target" ];
+  #   description = "HTTPD socket";
+  #   listenStreams = [
+  #     "0.0.0.0:80"
+  #     "0.0.0.0:443"
+  #   ];
+  # };
+
+  # NOTE: 54 -> 33, this is the UID/GID we used for www-data on tom in the past.
+  #       Any files accessed by or created by httpd will do so over NFS with this
+  #       UID/GID pair as its credentials.
+  #       This overlaps with the hardcoded `disnix` uid in nixpkgs, but we *probably*
+  #       won't be using that for the foreseeable future.
+  users.users."wwwrun".uid = lib.mkForce 33;
+  users.groups."wwwrun".gid = lib.mkForce 33;
+
+  systemd.services.httpd = {
+    after = [ "pvv-homedirs.target" ];
+    requires = [ "pvv-homedirs.target" ];
+
+    environment = {
+      PATH = lib.mkForce "/usr/bin";
+    };
+
+    serviceConfig = {
+      Type = lib.mkForce "notify";
+
+      ExecStartPre = let
+        rsyncCommand = ''${lib.getExe pkgs.rsync} -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey" -avz'';
+      in lib.mkForce [
+        "${lib.getExe (pkgs.writeShellApplication {
+          name = "http-exec-start-pre-remove-old-semaphores";
+          text = ''
+            # Get rid of old semaphores.  These tend to accumulate across
+            # server restarts, eventually preventing it from restarting
+            # successfully.
+            for i in $(${pkgs.util-linux}/bin/ipcs -s | grep ' ${cfg.user} ' | cut -f2 -d ' '); do
+                ${pkgs.util-linux}/bin/ipcrm -s "$i"
+            done
+          '';
+        })}"
+
+        "${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/passwd /run/httpd/pamunix-in/"
+        "${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/group /run/httpd/pamunix-in/"
+
+        (let
+          args = lib.cli.toCommandLineShellGNU { } {
+            passwd-file = "/run/httpd/pamunix-in/passwd";
+            group-file = "/run/httpd/pamunix-in/group";
+            output-dir = "/run/httpd/pamunix-out";
+            shadow-file = pkgs.emptyFile;
+
+            output-passwd = true;
+
+            ignore-user-file = toString ./ignore_user_file.txt;
+            ignore-group-file = toString ./ignore_group_file.txt;
+          };
+        in ''${lib.getExe pkgs.passwd2systemd-users} ${args}'')
+        "${lib.getExe' pkgs.coreutils "shred"} -u /run/httpd/pamunix-in/passwd /run/httpd/pamunix-in/group"
+        ":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:0:System administrator:/root:/run/current-system/sw/bin/bash' /run/httpd/pamunix-out/passwd"
+        ":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:54:Apache httpd user:/var/empty:/run/current-system/sw/bin/bash' /run/httpd/pamunix-out/passwd"
+        ":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:' /run/httpd/pamunix-out/group"
+        ":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:' /run/httpd/pamunix-out/group"
+        "+${lib.getExe' pkgs.coreutils "chown"} root:root /run/httpd/pamunix-out/passwd /run/httpd/pamunix-out/group"
+        "+${lib.getExe' pkgs.coreutils "chmod"} 0644 /run/httpd/pamunix-out/passwd /run/httpd/pamunix-out/group"
+        "+${lib.getExe pkgs.mount} --bind /run/httpd/pamunix-out/passwd /etc/passwd"
+        "+${lib.getExe pkgs.mount} --bind /run/httpd/pamunix-out/group  /etc/group"
+      ];
+      ExecStart = lib.mkForce "${cfg.package}/bin/httpd -D FOREGROUND -f /etc/httpd/httpd.conf -k start";
+      ExecReload = lib.mkForce "${cfg.package}/bin/httpd -f /etc/httpd/httpd.conf -k graceful";
+      ExecStop = lib.mkForce "";
+      KillMode = "mixed";
+
+      LoadCredential=[
+        "sshkey:${config.sops.secrets."httpd/passwd-ssh-key".path}"
+        "ssh-known-hosts:${config.sops.secrets."httpd/ssh-known-hosts".path}"
+      ];
+
+      ConfigurationDirectory = [ "httpd" ];
+      LogsDirectory = [ "httpd" ];
+      LogsDirectoryMode = "0700";
+
+      AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_SETUID" "CAP_SETGID" ] ++ lib.optionals debug [ "CAP_SYS_PTRACE" ];
+      CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SETUID" "CAP_SETGID" ] ++ lib.optionals debug [ "CAP_SYS_PTRACE" ];
+      LockPersonality = !debug;
+      PrivateDevices = true;
+      PrivateTmp = true;
+      # NOTE: this removes CAP_NET_BIND_SERVICE...
+      # PrivateUsers = true;
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = "tmpfs";
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectSystem = true;
+      RemoveIPC = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+        "AF_NETLINK"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SocketBindDeny = "any";
+      SocketBindAllow = [
+        "tcp:80"
+        "tcp:443"
+      ];
+      SystemCallArchitectures = "native";
+      SystemCallFilter = lib.mkIf (!debug) [
+         "@system-service"
+         "@setuid"
+      ];
+      UMask = "0077";
+
+      RuntimeDirectoryMode = "0750";
+      RuntimeDirectory = [
+        "httpd/root-mnt"
+        "httpd/pamunix-in"
+        "httpd/pamunix-out"
+      ];
+      RootDirectory = "/run/httpd/root-mnt";
+      MountAPIVFS = true;
+      BindReadOnlyPaths = [
+        builtins.storeDir
+        "/etc"
+        "/dev/null"
+        "/etc/resolv.conf"
+        "/var/lib/acme"
+
+        "-/run/httpd/pamunix-out/passwd:/etc/passwd"
+        "-/run/httpd/pamunix-out/group:/etc/group"
+
+        "${pkgs.writeText "userweb-fake-nsswitch.conf" ''
+          passwd:    files
+          group:     files
+          shadow:    files
+          sudoers:   files
+
+          hosts:     mymachines resolve [!UNAVAIL=return] files myhostname dns
+          networks:  files
+
+          ethers:    files
+          services:  files
+          protocols: files
+          rpc:       files
+
+          subuid:    files
+          subgid:    files
+        ''}:/etc/nsswitch.conf"
+
+        "${fhsEnv}/bin:/bin"
+        "${fhsEnv}/sbin:/sbin"
+        "${fhsEnv}/lib:/lib"
+        "${fhsEnv}/share:/share"
+      ] ++ (lib.mapCartesianProduct ({ parent, child }: "${fhsEnv}${child}:${parent}${child}") {
+        parent = [
+          "/local"
+          "/opt"
+          "/opt/local"
+          "/store"
+          "/store/gnu"
+          "/usr"
+          "/usr/local"
+          "/run/current-system/sw"
+        ];
+        child = [
+          "/bin"
+          "/sbin"
+          "/lib"
+          "/libexec"
+          "/include"
+          "/share"
+        ];
+      });
+      BindPaths = lib.mapCartesianProduct ({ directoryFn, letter }: "/run/pvv-home-mounts/${letter}:${directoryFn letter}${letter}") {
+        directoryFn = [
+          (_: "/home/pvv/")
+          (l: "/amd/homepvv${l}/")
+        ];
+        letter = homeLetters;
+      };
+    };
+  };
+
+  # TODO: create phpfpm pools with php environments that contain packages similar to those present on tom
+}
@@ -0,0 +1,91 @@
+Debian-exim
+_cvsadmin
+_ssh
+adm
+audio
+avahi
+backup
+bin
+cdrom
+cl-builder
+clamav
+clock
+colord
+courier
+crontab
+daemon
+debian-spamd
+dialout
+dip
+dirmngr
+disk
+dovecot
+fax
+floppy
+fuse
+games
+geoclue
+gnats
+input
+irc
+kmem
+kvm
+list
+lock
+lp
+lpadmin
+mail
+man
+messagebus
+mlocate
+munin
+netdev
+news
+nogroup
+ntp
+ntpsec
+oident
+opendkim
+operator
+plocate
+plugdev
+polkitd
+postdrop
+postfix
+postgres
+prometheus
+prometheus-exporter
+proxy
+rdma
+root
+# runit
+salt
+sambashare
+saned
+sasl
+scanner
+sgx
+shadow
+src
+ssl-cert
+staff
+stunnel4
+sudo
+sys
+systemd-coredump
+systemd-journal
+systemd-network
+systemd-resolve
+systemd-timesync
+tape
+tcpdump
+tty
+users
+utempter
+utmp
+uucp
+uuidd
+video
+voice
+winbindd_priv
+www-data
@@ -0,0 +1,74 @@
+# System Users
+Debian-exim
+_apt
+_rpc
+avahi
+backup
+bin
+cl-builder
+clamav
+colord
+courier
+daemon
+debian-spamd
+debian-spamd
+dirmngr
+distccd
+dovecot
+dovenull
+driftsupport
+fetchmail
+games
+geoclue
+gitea
+gnats
+hplip
+irc
+list
+lp
+mail
+mail2news
+mailnews
+man
+messagebus
+munin
+news
+nobody
+noone
+ntp
+ntpsec
+oident
+opendkim
+polkitd
+postfix
+postgres
+prometheus
+prometheus-exporter
+proxy
+root
+rwhod
+salt
+saned
+spamd
+sshd
+statd
+stunnel4
+sync
+sys
+systemd-coredump
+systemd-network
+systemd-resolve
+systemd-timesync
+tcpdump
+uucp
+uuidd
+vaultwarden
+www-data
+
+# Misc
+nuccc04
+nuccc
+kybkokos
+kybkokos2
+testbruker2309
+testbruker2404
@@ -0,0 +1,119 @@
+{ config, lib, pkgs, ... }:
+{
+  services.postfix.enable = lib.mkForce false;
+
+  services.nullmailer = {
+    enable = true;
+    config = {
+      me = config.networking.fqdn;
+      remotes = "mail.pvv.ntnu.no smtp --port=25";
+    };
+  };
+
+  services.bro = {
+    enable = true;
+
+    instances.userweb-sendmail = {
+      enable = true;
+
+      client = {
+        settings.BRO_FILE_FLAGS = [
+          "-C"
+        ];
+      };
+
+      server = {
+        settings = {
+          executable = let
+            sendmailWrapper = pkgs.writeShellApplication {
+              name = "sendmail";
+              runtimeInputs = [ ];
+              bashOptions = [
+                "errexit"
+                "pipefail"
+              ];
+              text = ''
+                args=("$@")
+
+                if [[ -z "$USERDIR_USER" ]] && [[ "$USERDIR_USER" != "pvv" ]]; then
+                    # Prepend -fusername to the argument list, so bounces go to the user
+                    args=("-f$USERDIR_USER" "''${args[@]}")
+                fi
+
+                exec '${lib.getExe pkgs.system-sendmail}' -t -i "''${args[@]}"
+              '';
+            };
+          in lib.getExe sendmailWrapper;
+          allowed-env = [ "USERDIR_USER" ];
+        };
+      };
+    };
+  };
+
+  environment.systemPackages = [
+    (config.services.bro.instances.userweb-sendmail.client.package.overrideAttrs (prev: {
+      buildCommand = prev.buildCommand + ''
+        mv "$out/bin/sendmail" "$out/bin/bro-sendmail"
+      '';
+    }))
+  ];
+
+  users.users.nullmailer-user = {
+    enable = true;
+    isSystemUser = true;
+    group = "nullmailer-user";
+  };
+
+  users.groups.nullmailer-user = { };
+
+  systemd.services.bro-userweb-sendmail = {
+    serviceConfig = {
+      User = "nullmailer-user";
+      Group = "nullmailer-user";
+
+      ReadWritePaths = [
+        "/var/spool/nullmailer"
+      ];
+
+      AmbientCapabilities = "";
+      CapabilityBoundingSet = "";
+      NoNewPrivileges = false;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      PrivateTmp = true;
+      PrivateDevices = true;
+      PrivateUsers = false;
+      ProtectHostname = true;
+      ProtectClock = true;
+      ProtectKernelTunables = true;
+      ProtectKernelModules = true;
+      ProtectKernelLogs = true;
+      ProtectControlGroups = true;
+      RestrictAddressFamilies = [
+        "AF_UNIX"
+        "AF_INET"
+        "AF_INET6"
+        "AF_NETLINK"
+      ];
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      PrivateMounts = true;
+      ProcSubset = "pid";
+      ProtectProc = "invisible";
+      RemoveIPC = true;
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@resources"
+      ];
+      UMask = "0077";
+    };
+  };
+
+  systemd.services.httpd.serviceConfig = {
+    BindPaths = [ (lib.head config.systemd.sockets.bro-userweb-sendmail.listenStreams) ];
+  };
+}
@@ -1,40 +0,0 @@
-{ config, fp, pkgs, lib, values, ... }:
-
-{
-  imports = [
-    (fp /base)
-
-    ./services/gitea-runners.nix
-  ];
-
-  boot.loader.systemd-boot.enable = false;
-
-  networking.useHostResolvConf = lib.mkForce false;
-
-  systemd.network.networks = {
-    "30-lxc-eth" = values.defaultNetworkConfig // {
-      matchConfig = {
-        Type = "ether";
-        Kind = "veth";
-        Name = [
-          "eth*"
-        ];
-      };
-      address = with values.hosts.ustetind; [ (ipv4 + "/25") (ipv6 + "/64") ];
-    };
-    "40-podman-veth" = values.defaultNetworkConfig // {
-      matchConfig = {
-        Type = "ether";
-        Kind = "veth";
-        Name = [
-          "veth*"
-        ];
-      };
-      DHCP = "yes";
-    };
-  };
-
-  # Don't change (even during upgrades) unless you know what you are doing.
-  # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "24.11";
-}
@@ -1,41 +0,0 @@
-{ config, lib, values, ... }:
-let
-  mkRunner = name: {
-    # This is unfortunately state, and has to be generated one at a time :(
-    # To do that, comment out all except one of the runners, fill in its token
-    # inside the sops file, rebuild the system, and only after this runner has
-    # successfully registered will gitea give you the next token.
-    # - oysteikt Sep 2023
-    sops.secrets."gitea/runners/${name}".restartUnits = [
-      "gitea-runner-${name}.service"
-    ];
-
-    services.gitea-actions-runner.instances = {
-      ${name} = {
-        enable = true;
-        name = "git-runner-${name}"; url = "https://git.pvv.ntnu.no";
-        labels = [
-          "debian-latest:docker://node:current-bookworm"
-          "ubuntu-latest:docker://node:current-bookworm"
-        ];
-        tokenFile = config.sops.secrets."gitea/runners/${name}".path;
-      };
-    };
-  };
-in
-lib.mkMerge [
-  (mkRunner "alpha")
-  (mkRunner "beta")
-  (mkRunner "epsilon")
-  {
-    virtualisation.podman = {
-      enable = true;
-      defaultNetwork.settings.dns_enabled = true;
-      autoPrune.enable = true;
-    };
-
-    networking.dhcpcd.IPv6rs = false;
-
-    networking.firewall.interfaces."podman+".allowedUDPPorts = [53 5353];
-  }
-]
@@ -376,7 +376,7 @@ in {
      serviceConfig = {
        Type = "oneshot";
        CPUSchedulingPolicy = "batch";
-        Group = "nginx";
+        Group = lib.mkIf cfg.enableNginx "nginx";
        UMask = "026";
        ExecStart = [
          # If web folder doesnt exist generate it
@@ -0,0 +1,198 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.drumknotty;
+in
+{
+  imports = [
+    ./dibbler.nix
+    ./worblehat.nix
+  ];
+
+  options.services.drumknotty = {
+    enable = lib.mkEnableOption "DrumknoTTY";
+
+    kioskMode = lib.mkEnableOption "" // {
+      description = ''
+        Whether to let dibbler take over the entire machine.
+
+        This will restrict the machine to a single TTY and make the program unquittable.
+        You can still get access to PTYs via SSH and similar, if enabled.
+      '';
+    };
+
+    screen = {
+      package = lib.mkPackageOption pkgs "screen" { };
+
+      sessionName = lib.mkOption {
+        type = lib.types.str;
+        default = "drumknotty";
+        example = "myscreensessionname";
+        description = ''
+          Sets the screen session name.
+        '';
+      };
+
+      limitHeight = lib.mkOption {
+        type = with lib.types; nullOr ints.unsigned;
+        default = null;
+        example = 42;
+        description = ''
+          If set, limits the height of the screen dibbler uses to the given number of lines.
+        '';
+      };
+
+      limitWidth = lib.mkOption {
+        type = with lib.types; nullOr ints.unsigned;
+        default = null;
+        example = 80;
+        description = ''
+          If set, limits the width of the screen dibbler uses to the given number of columns.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.enable -> lib.any (b: b) [
+          cfg.dibbler.enable
+          cfg.worblehat.enable
+        ];
+        message = "DrumknoTTY must have at least one service enabled";
+      }
+    ];
+
+    users = {
+      users.drumknotty = {
+        group = "drumknotty";
+        extraGroups = [ "lp" ];
+        isNormalUser = true;
+
+        # TODO: make this display the error log or error message in case that
+        #       the screen session service is bootlooping or otherwise off.
+        shell =
+          lib.mkIf cfg.kioskMode
+          (pkgs.writeShellScriptBin "login-shell"
+            "${lib.getExe' cfg.screen.package "screen"} -x ${cfg.screen.sessionName} -p dibbler"
+          // {
+            shellPath = "/bin/login-shell";
+          });
+      };
+      groups.drumknotty = { };
+    };
+
+    boot.kernelParams = lib.mkIf cfg.kioskMode [
+      "console=tty1"
+    ];
+
+    services.getty.autologinUser = lib.mkIf cfg.kioskMode "drumknotty";
+
+    systemd.services.drumknotty-screen-session = lib.mkIf cfg.kioskMode {
+      description = "Drumknotty Screen Session";
+      wantedBy = [
+        "default.target"
+      ];
+      after =
+        # TODO: this could be refined
+        if (cfg.dibbler.createLocalDatabase || cfg.worblehat.createLocalDatabase) then
+          [
+            "postgresql.service"
+            "dibbler-setup-database.service"
+            "worblehat-setup-database.service"
+          ]
+        else
+          [
+            "network.target"
+          ];
+
+      serviceConfig = {
+        Type = "forking";
+        RemainAfterExit = false;
+        Restart = "always";
+        RestartSec = "5s";
+        SuccessExitStatus = 1;
+
+        User = "drumknotty";
+        Group = "drumknotty";
+
+        ExecStartPre =
+          let
+            screenArgs = lib.escapeShellArgs [
+              # Send the specified command to a running screen session
+              "-X"
+
+              # Session name
+              "-S"
+              "${cfg.screen.sessionName}"
+
+              "kill"
+            ];
+          in
+          "-${lib.getExe' cfg.screen.package "screen"} ${screenArgs}";
+
+        ExecStart =
+          let
+            screenrc = let
+              convertToFile = lines: lib.pipe lines [
+                lib.concatLists
+                (lib.concatStringsSep "\n")
+                (pkgs.writeText "drumknotty-screenrc")
+              ];
+            in convertToFile [
+              (lib.optionals (cfg.screen.limitWidth != null) [
+                "screen width ${toString cfg.screen.limitWidth}"
+              ])
+              (lib.optionals (cfg.screen.limitHeight != null) [
+                "screen height ${toString cfg.screen.limitHeight}"
+              ])
+
+              (let
+                dibblerArgs = lib.cli.toCommandLineShellGNU { } {
+                  config = "/etc/dibbler/dibbler.toml";
+                };
+              in lib.optionals cfg.dibbler.enable [
+                "screen -t dibbler ${lib.getExe cfg.dibbler.package} ${dibblerArgs} loop"
+
+              ])
+
+              (let
+                worblehatArgs = lib.cli.toCommandLineShellGNU { } {
+                  config = "/etc/worblehat/config.toml";
+                };
+              in lib.optionals cfg.worblehat.enable [
+                "screen -t worblehat ${lib.getExe cfg.worblehat.package} ${worblehatArgs} cli"
+              ])
+
+              [ "select 0" ]
+            ];
+
+            screenArgs = lib.escapeShellArgs [
+              # -dm creates the screen in detached mode without accessing it
+              "-dm"
+
+              # Session name
+              "-S"
+              "${cfg.screen.sessionName}"
+
+              # Set optimal output mode instead of VT100 emulation
+              "-O"
+
+              # Enable login mode, updates utmp entries
+              "-l"
+
+              # Config file path
+              "-c"
+              "${screenrc}"
+            ];
+          in
+            "${lib.getExe' cfg.screen.package "screen"} ${screenArgs}";
+      };
+    };
+  };
+}
@@ -0,0 +1,113 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  mainCfg = config.services.drumknotty;
+  cfg = config.services.drumknotty.dibbler;
+
+  format = pkgs.formats.toml { };
+in
+{
+  options.services.drumknotty.dibbler = {
+    enable = lib.mkEnableOption "";
+
+    package = lib.mkPackageOption pkgs "dibbler" { };
+
+    settings = lib.mkOption {
+      description = "Configuration for dibbler";
+      default = { };
+      type = lib.types.submodule {
+        freeformType = format.type;
+      };
+    };
+
+    createLocalDatabase = lib.mkEnableOption "" // {
+      description = ''
+        Whether to set up a local postgres database automatically.
+
+        ::: {.note}
+        You must set up postgres manually before enabling this option.
+        :::
+      '';
+    };
+  };
+
+  config = lib.mkIf (mainCfg.enable && cfg.enable) {
+    assertions = [
+      {
+        assertion = cfg.createLocalDatabase -> config.services.postgresql.enable;
+        message = "PostgreSQL must be enabled for dibbler to create a local database";
+      }
+    ];
+
+    environment.systemPackages = [ cfg.package ];
+    environment.etc."dibbler/dibbler.toml".source = format.generate "dibbler.toml" cfg.settings;
+
+    services.drumknotty.dibbler.settings = {
+      limits = {
+        low_credit_warning_limit = lib.mkDefault (-100);
+        user_recent_transaction_limit = lib.mkDefault 100;
+      };
+
+      printer = {
+        label_type = lib.mkDefault "62";
+        label_rotate = lib.mkDefault false;
+      };
+
+      database = {
+        type = lib.mkIf cfg.createLocalDatabase "postgresql";
+        postgresql = {
+          username = lib.mkDefault "dibbler";
+          dbname = lib.mkDefault "dibbler";
+
+          host = lib.mkIf cfg.createLocalDatabase "/run/postgresql";
+        };
+      };
+    };
+
+    services.drumknotty.dibbler.settings.general = lib.mkIf mainCfg.kioskMode {
+      quit_allowed = false;
+      stop_allowed = false;
+    };
+
+    services.postgresql = lib.mkIf cfg.createLocalDatabase {
+      authentication = ''
+        local ${cfg.settings.database.postgresql.dbname} ${cfg.settings.database.postgresql.username} peer map=${cfg.settings.database.postgresql.username}
+      '';
+      identMap = ''
+        ${cfg.settings.database.postgresql.username} drumknotty ${cfg.settings.database.postgresql.username}
+      '';
+      ensureDatabases = [ cfg.settings.database.postgresql.dbname ];
+      ensureUsers = [{
+        name = cfg.settings.database.postgresql.username;
+        ensureDBOwnership = true;
+        ensureClauses.login = true;
+      }];
+    };
+
+    systemd.services.dibbler-setup-database = lib.mkIf cfg.createLocalDatabase {
+      description = "Dibbler database setup";
+
+      wantedBy = [ "default.target" ];
+      requiredBy = [ "drumknotty-screen-session.service" ];
+      before = [ "drumknotty-screen-session.service" ];
+      after = [ "postgresql.service" ];
+
+      unitConfig = {
+        ConditionPathExists = "!/var/lib/dibbler/.db-setup-done";
+      };
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${lib.getExe cfg.package} --config /etc/dibbler/dibbler.toml create-db";
+        ExecStartPost = "${lib.getExe' pkgs.coreutils "touch"} /var/lib/dibbler/.db-setup-done";
+        StateDirectory = "dibbler";
+
+        User = "drumknotty";
+        Group = "drumknotty";
+      };
+    };
+  };
+}
@@ -0,0 +1,209 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  mainCfg = config.services.drumknotty;
+  cfg = config.services.drumknotty.worblehat;
+
+  format = pkgs.formats.toml { };
+in
+{
+  options.services.drumknotty.worblehat = {
+    enable = lib.mkEnableOption "";
+
+    package = lib.mkPackageOption pkgs "worblehat" { };
+
+    settings = lib.mkOption {
+      description = "Configuration for worblehat";
+      default = { };
+      type = lib.types.submodule {
+        freeformType = format.type;
+      };
+    };
+
+    createLocalDatabase = lib.mkEnableOption "" // {
+      description = ''
+        Whether to set up a local postgres database automatically.
+
+        ::: {.note}
+        You must set up postgres manually before enabling this option.
+        :::
+      '';
+    };
+
+    deadline-daemon = {
+      enable = lib.mkEnableOption "" // {
+        description = ''
+          Whether to enable the worblehat deadline-daemon service,
+          which periodically checks for upcoming deadlines and notifies users.
+
+          Note that this service is independent of the main worblehat service,
+          and must be enabled separately.
+        '';
+      };
+
+      onCalendar = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          How often to trigger rendering the map,
+          in the format of a systemd timer onCalendar configuration.
+
+          See {manpage}`systemd.timer(5)`.
+        '';
+        default = "*-*-* 10:15:00";
+      };
+    };
+  };
+
+  config = lib.mkMerge [
+    {
+      assertions = [
+        {
+          assertion = cfg.createLocalDatabase -> config.services.postgresql.enable;
+          message = "PostgreSQL must be enabled for worblehat to create a local database";
+        }
+      ];
+
+      # TODO: Retrieve defaults from the example config file in the project code.
+      services.drumknotty.worblehat.settings = {
+        logging = {
+          debug = lib.mkDefault true;
+          debug_sql = lib.mkDefault false;
+        };
+
+        database = {
+          type = lib.mkDefault "sqlite";
+          sqlite.path = lib.mkDefault "./worblehat.sqlite";
+          postgresql = {
+            host = lib.mkDefault "localhost";
+            port = lib.mkDefault 5432;
+            username = lib.mkDefault "worblehat";
+            password = lib.mkDefault "/var/lib/worblehat/db-password";
+            database = lib.mkDefault "worblehat";
+          };
+        };
+
+        flask = {
+          TESTING = lib.mkDefault true;
+          DEBUG = lib.mkDefault true;
+          FLASK_ENV = lib.mkDefault "development";
+          SECRET_KEY = lib.mkDefault "change-me";
+        };
+
+        smtp = {
+          enabled = lib.mkDefault false;
+          host = lib.mkDefault "smtp.pvv.ntnu.no";
+          port = lib.mkDefault 587;
+          username = lib.mkDefault "worblehat";
+          password = lib.mkDefault "/var/lib/worblehat/smtp-password";
+          from = lib.mkDefault "worblehat@pvv.ntnu.no";
+          subject_prefix = lib.mkDefault "[Worblehat]";
+        };
+
+        deadline_daemon = {
+          enabled = lib.mkDefault true;
+          dryrun = lib.mkDefault false;
+          warn_days_before_borrowing_deadline = lib.mkDefault [
+            5
+            1
+          ];
+          days_before_queue_position_expires = lib.mkDefault 14;
+          warn_days_before_expiring_queue_position_deadline = lib.mkDefault [
+            3
+            1
+          ];
+        };
+      };
+    }
+
+    (lib.mkIf ((mainCfg.enable && cfg.enable) || cfg.deadline-daemon.enable) {
+      environment.systemPackages = [ cfg.package ];
+      environment.etc."worblehat/config.toml".source = format.generate "worblehat-config.toml" cfg.settings;
+    })
+
+    (lib.mkIf (mainCfg.enable && cfg.enable) {
+      services.drumknotty.worblehat.settings.general = lib.mkIf mainCfg.kioskMode {
+        quit_allowed = false;
+        stop_allowed = false;
+      };
+
+      services.drumknotty.worblehat.settings.database = lib.mkIf cfg.createLocalDatabase {
+        type = "postgresql";
+        postgresql.host = "/run/postgresql";
+      };
+
+      services.postgresql = lib.mkIf cfg.createLocalDatabase {
+        authentication = ''
+          local ${cfg.settings.database.postgresql.database} ${cfg.settings.database.postgresql.username} peer map=${cfg.settings.database.postgresql.username}
+        '';
+        identMap = ''
+          ${cfg.settings.database.postgresql.username} drumknotty ${cfg.settings.database.postgresql.username}
+        '';
+        ensureDatabases = [ cfg.settings.database.postgresql.database ];
+        ensureUsers = [{
+          name = cfg.settings.database.postgresql.username;
+          ensureDBOwnership = true;
+          ensureClauses.login = true;
+        }];
+      };
+
+      systemd.services.worblehat-setup-database = lib.mkIf cfg.createLocalDatabase {
+        description = "Worblehat database setup";
+
+        wantedBy = [ "default.target" ];
+        requiredBy = [ "drumknotty-screen-session.service" ];
+        before = [ "drumknotty-screen-session.service" ];
+        after = [ "postgresql.service" ];
+
+        unitConfig = {
+          ConditionPathExists = "!/var/lib/worblehat/.db-setup-done";
+        };
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${lib.getExe cfg.package} --config /etc/worblehat/config.toml create-db";
+          ExecStartPost = "${lib.getExe' pkgs.coreutils "touch"} /var/lib/worblehat/.db-setup-done";
+          StateDirectory = "worblehat";
+
+          User = "drumknotty";
+          Group = "drumknotty";
+        };
+      };
+    })
+
+    (lib.mkIf cfg.deadline-daemon.enable {
+      systemd.timers.worblehat-deadline-daemon = lib.mkIf cfg.deadline-daemon.enable {
+        description = "Worblehat Deadline Daemon";
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = cfg.deadline-daemon.onCalendar;
+          Persistent = true;
+        };
+      };
+
+      systemd.services.worblehat-deadline-daemon = lib.mkIf cfg.deadline-daemon.enable {
+        description = "Worblehat Deadline Daemon";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig = {
+          Type = "oneshot";
+          CPUSchedulingPolicy = "idle";
+          IOSchedulingClass = "idle";
+
+          ExecStart =
+            let
+              worblehatArgs = lib.cli.toCommandLineShellGNU { } {
+                config = "/etc/worblehat/config.toml";
+              };
+            in
+            "${lib.getExe cfg.package} ${worblehatArgs} deadline-daemon";
+
+          User = "drumknotty";
+          Group = "drumknotty";
+        };
+      };
+    })
+  ];
+}
@@ -16,7 +16,7 @@ in {
  };

  systemd.user.services.restart-greg-ng = {
-    script = "systemctl --user restart greg-ng.service";
+    serviceConfig.ExecStart = "${lib.getExe' pkgs.systemd "systemctl"} --user restart greg-ng.service";
    startAt = "*-*-* 06:30:00";
  };

@@ -77,29 +77,29 @@ in

        id
        echo "Before if statement"
-        stat ''${REGISTRATION_FILE}
+        stat "''${REGISTRATION_FILE}"

-        if [[ ! -f ''${REGISTRATION_FILE} ]]; then
+        if [[ ! -f "''${REGISTRATION_FILE}" ]]; then
          echo "No registration file found at '$REGISTRATION_FILE'"
-          cp --no-preserve=mode,ownership ${baseConfig} ''${REGISTRATION_FILE}
+          cp --no-preserve=mode,ownership "${baseConfig}" "''${REGISTRATION_FILE}"
        fi

        echo "After if statement"
-        stat ''${REGISTRATION_FILE}
+        stat "''${REGISTRATION_FILE}"

-        AS_TOKEN=$(${lib.getExe pkgs.jq} -r .as_token ''${REGISTRATION_FILE})
-        HS_TOKEN=$(${lib.getExe pkgs.jq} -r .hs_token ''${REGISTRATION_FILE})
-        DISCORD_TOKEN=$(cat /run/credentials/matrix-ooye-pre-start.service/discord_token)
-        DISCORD_CLIENT_SECRET=$(cat /run/credentials/matrix-ooye-pre-start.service/discord_client_secret)
+        AS_TOKEN="$('${lib.getExe pkgs.jq}' -r .as_token "''${REGISTRATION_FILE}")"
+        HS_TOKEN="$('${lib.getExe pkgs.jq}' -r .hs_token "''${REGISTRATION_FILE}")"
+        DISCORD_TOKEN="$(cat /run/credentials/matrix-ooye-pre-start.service/discord_token)"
+        DISCORD_CLIENT_SECRET="$(cat /run/credentials/matrix-ooye-pre-start.service/discord_client_secret)"

        # Check if we have all required tokens
        if [[ -z "$AS_TOKEN" || "$AS_TOKEN" == "null" ]]; then
-          AS_TOKEN=$(${lib.getExe pkgs.openssl} rand -hex 64)
+          AS_TOKEN="$('${lib.getExe pkgs.openssl}' rand -hex 64)"
          echo "Generated new AS token: ''${AS_TOKEN}"
        fi

        if [[ -z "$HS_TOKEN" || "$HS_TOKEN" == "null" ]]; then
-          HS_TOKEN=$(${lib.getExe pkgs.openssl} rand -hex 64)
+          HS_TOKEN="$('${lib.getExe pkgs.openssl}' rand -hex 64)"
          echo "Generated new HS token: ''${HS_TOKEN}"
        fi

@@ -115,13 +115,13 @@ in
          exit 1
        fi

-        shred -u ''${REGISTRATION_FILE}
-        cp --no-preserve=mode,ownership ${baseConfig} ''${REGISTRATION_FILE}
+        shred -u "''${REGISTRATION_FILE}"
+        cp --no-preserve=mode,ownership "${baseConfig}" "''${REGISTRATION_FILE}"

-        ${lib.getExe pkgs.jq} '.as_token = "'$AS_TOKEN'" | .hs_token = "'$HS_TOKEN'" | .ooye.discord_token = "'$DISCORD_TOKEN'" | .ooye.discord_client_secret = "'$DISCORD_CLIENT_SECRET'"' ''${REGISTRATION_FILE} > ''${REGISTRATION_FILE}.tmp
+        '${lib.getExe pkgs.jq}' '.as_token = "'$AS_TOKEN'" | .hs_token = "'$HS_TOKEN'" | .ooye.discord_token = "'$DISCORD_TOKEN'" | .ooye.discord_client_secret = "'$DISCORD_CLIENT_SECRET'"' "''${REGISTRATION_FILE}" > "''${REGISTRATION_FILE}.tmp"

-        shred -u ''${REGISTRATION_FILE}
-        mv ''${REGISTRATION_FILE}.tmp ''${REGISTRATION_FILE}
+        shred -u "''${REGISTRATION_FILE}"
+        mv "''${REGISTRATION_FILE}.tmp" "''${REGISTRATION_FILE}"
      '';

    in
@@ -171,6 +171,9 @@ in
        requires = [ "matrix-ooye-pre-start.service" ];
        wantedBy = [ "multi-user.target" ];

+        startLimitIntervalSec = 5;
+        startLimitBurst = 5;
+
        serviceConfig = {
          ExecStart = lib.getExe config.services.matrix-ooye.package;
          WorkingDirectory = "/var/lib/matrix-ooye";
@@ -182,8 +185,6 @@ in
          #PrivateDevices = true;
          Restart = "on-failure";
          RestartSec = "5s";
-          StartLimitIntervalSec = "5s";
-          StartLimitBurst = "5";
          DynamicUser = true;
        };
      };
@@ -51,24 +51,24 @@ in
      script = let
        openssl = lib.getExe pkgs.openssl;
      in lib.concatMapStringsSep "\n" ({ name, value }: ''
-        mkdir -p $(dirname "${value.certificate}") $(dirname "${value.certificateKey}")
-        if ! ${openssl} x509 -checkend 86400 -noout -in ${value.certificate}
+        mkdir -p "$(dirname '${value.certificate}')" "$(dirname '${value.certificateKey}')"
+        if ! ${openssl} x509 -checkend 86400 -noout -in '${value.certificate}'
        then
          echo "Regenerating '${value.certificate}'"
          ${openssl} req \
            -newkey rsa:4096 \
            -new -x509 \
-            -days "${toString value.daysValid}" \
+            -days '${toString value.daysValid}' \
            -nodes \
-            -subj "${value.subject}" \
-            -out "${value.certificate}" \
-            -keyout "${value.certificateKey}" \
+            -subj '${value.subject}' \
+            -out '${value.certificate}' \
+            -keyout '${value.certificateKey}' \
            ${lib.escapeShellArgs value.extraOpenSSLArgs}
        fi
-        chown "${value.owner}:${value.group}" "${value.certificate}"
-        chown "${value.owner}:${value.group}" "${value.certificateKey}"
-        chmod "${value.mode}" "${value.certificate}"
-        chmod "${value.mode}" "${value.certificateKey}"
+        chown '${value.owner}:${value.group}' '${value.certificate}'
+        chown '${value.owner}:${value.group}' '${value.certificateKey}'
+        chmod '${value.mode}' '${value.certificate}'
+        chmod '${value.mode}' '${value.certificateKey}'

        echo "\n-----------------\n"
      '') (lib.attrsToList cfg);
@@ -1,12 +1,14 @@
-{ lib, stdenvNoCC, fetchurl, makeWrapper, jre }:
-
+{ lib, stdenvNoCC, fetchurl, makeWrapper, javaPackages }:
+let
+  jre = javaPackages.compiler.temurin-bin.jre-25;
+in
 stdenvNoCC.mkDerivation rec {
  pname = "bluemap";
-  version = "5.15";
+  version = "5.20";

  src = fetchurl {
    url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
-    hash = "sha256-g50V/4LtHaHNRMTt+PK/ZTf4Tber2D6ZHJvuAXQLaFI=";
+    hash = "sha256-txDN/vG429BHT09TrSB8uQhmB8irrmvvOXX4OX3OSC0=";
  };

  dontUnpack = true;
@@ -15,7 +17,10 @@ stdenvNoCC.mkDerivation rec {

  installPhase = ''
    runHook preInstall
-    makeWrapper ${jre}/bin/java $out/bin/bluemap --add-flags "-jar $src"
+
+    makeWrapper ${jre}/bin/java $out/bin/bluemap \
+      --add-flags "-jar $src"
+
    runHook postInstall
  '';

@@ -12,7 +12,7 @@ let
    name
  , commit
  , hash
-  , tracking-branch ? "REL1_44"
+  , tracking-branch ? "REL1_45"
  , kebab-name ? kebab-case-name name
  , fetchgit ? pkgs.fetchgit
  }:
@@ -33,63 +33,68 @@ in
 lib.mergeAttrsList [
  (mw-ext {
    name = "CodeEditor";
-    commit = "83e1d0c13f34746f0d7049e38b00e9ab0a47c23f";
-    hash = "sha256-qH9fSQZGA+z6tBSh1DaTKLcujqA6K/vQmZML9w5X8mU=";
+    commit = "af7e82f24ba4b68393712fece6f1b5fa4bb049ec";
+    hash = "sha256-XT8E4O6MEZYHSs6Q+A/dfYaUvJ4kY13Kd/cq30dA5NA=";
  })
  (mw-ext {
    name = "CodeMirror";
-    commit = "af2b08b9ad2b89a64b2626cf80b026c5b45e9922";
-    hash = "sha256-CxXPwCKUlF9Tg4JhwLaKQyvt43owq75jCugVtb3VX+I=";
+    commit = "7ab826eff8c4097589a3199c40c507717af23234";
+    hash = "sha256-kMIyGW9J4OSGSetByel7hEGgxPRJmQ53it6ndpYA/Hs=";
  })
  (mw-ext {
    name = "DeleteBatch";
-    commit = "3d6f2fd0e3efdae1087dd0cc8b1f96fe0edf734f";
-    hash = "sha256-iD9EjDIW7AGpZan74SIRcr54dV8W7xMKIDjatjdVkKs=";
+    commit = "b5920283cfe78b86a63a1037a81651c58ce764da";
+    hash = "sha256-LwuVX2s5Q4uc6o7hlTjFzRTwvSCwTk74gBpX0HoLDMA=";
+  })
+  (mw-ext {
+    name = "PdfHandler";
+    commit = "dc1a3ca04ac6ec7d7de7ce5355803510508a2575";
+    hash = "sha256-ltAQZtfTMMLRPATA7rclSNW8Yz4ctGc30CxlL3SRBWU=";
  })
  (mw-ext {
    name = "PluggableAuth";
-    commit = "85e96acd1ac0ebcdaa29c20eae721767a938f426";
-    hash = "sha256-bMVhrg8FsfWhXF605Cj5TgI0A6Jy/MIQ5aaUcLQQ0Ss=";
+    commit = "4b57a23e32d72bd3f74184ff2734aa483a5b0c63";
+    hash = "sha256-ZGw0Wgz0Sg04YDcOzkOGywmfQ6s6Ex17QbjmUDO1D8c=";
  })
  (mw-ext {
    name = "Popups";
-    commit = "410e2343c32a7b18dcdc2bbd995b0bfdf3bf5f37";
-    hash = "sha256-u2AlR75x54rCpiK9Mz00D9odJCn8fmi6DRU4QKmKqSc=";
+    commit = "f74a8639f57232898978d9f3792293eb2d370e40";
+    hash = "sha256-uunUtN3M/ksW/kcbeIzDVTdb1P/PHTeTwaTsvspMLko=";
  })
  (mw-ext {
    name = "Scribunto";
-    commit = "904f323f343dba5ff6a6cdd143c4a8ef5b7d2c55";
-    hash = "sha256-ZOVYhjMMyWbqwZOBb39hMIRmzzCPEnz2y8Q2jgyeERw=";
+    commit = "35c85c96167922adc98e62dd6573789d906dd7d7";
+    hash = "sha256-FEWADJW53cDOlLseM62VL66PENv/jNnwuCMo2Pb02ek=";
  })
  (mw-ext {
    name = "SimpleSAMLphp";
    kebab-name = "simple-saml-php";
-    commit = "a2f77374713473d594e368de24539aebcc1a800a";
-    hash = "sha256-5+t3VQFKcrIffDNPJ4RWBIWS6K1gTOcEleYWmM6xWms=";
+    commit = "70778bb02f972abbb51e6ba3e0f6545b00dcab00";
+    hash = "sha256-wfmFJKy+ih84qFM9DVcCQFAZBx45s7Hl0lRnseMPhGY=";
  })
  (mw-ext {
    name = "TemplateData";
-    commit = "76a6a04bd13a606923847ba68750b5d98372cacd";
-    hash = "sha256-X2+U5PMqzkSljw2ypIvJUSaPDaonTkQx89OgKzf5scw=";
+    commit = "cca3b3430067f2161bf65de822f70dd38fe07bba";
+    hash = "sha256-OxLwiF8FlWizkpDF9GXYfjehKtrltX8ihiCE+fNJpgw=";
  })
  (mw-ext {
    name = "TemplateStyles";
-    commit = "7de60a8da6576d7930f293d19ef83529abf52704";
-    hash = "sha256-iPmFDoO5V4964CVyd1mBSQcNlW34odbvpm2CfDBlPBU=";
+    commit = "101a159dd0190759a16551a86800144c18b6ff5c";
+    hash = "sha256-IGQQVAx8/76ivHq9b97ec1AlFoqbRl7uhXhwoFimsG4=";
  })
  (mw-ext {
    name = "UserMerge";
-    commit = "71eb53ff4289ac4efaa31685ab8b6483c165a584";
-    hash = "sha256-OfKSEPgctfr659oh5jf99T0Rzqn+60JhNaZq+2gfubk=";
+    commit = "6c0d105e07538c34bfde989bd26fa1945f8d1b79";
+    hash = "sha256-w058Ihk0I98hIG1tkVJGy1bzbv7XXyUksGexXgCN540=";
  })
  (mw-ext {
    name = "VisualEditor";
-    commit = "a6a63f53605c4d596c3df1dcc2583ffd3eb8d929";
-    hash = "sha256-4d8picO66uzKoxh1TdyvKLHebc6ZL7N2DdXLV2vgBL4=";
+    commit = "8d8c6d7f179a5f799e1fa8cba207d81f58f722d2";
+    hash = "sha256-wbYHXi2vD521EMzUl7ttinG4YdLv/DwYvVUew7dka0g=";
  })
  (mw-ext {
    name = "WikiEditor";
-    commit = "0a5719bb95326123dd0fee1f88658358321ed7be";
-    hash = "sha256-eQMyjhdm1E6TkktIHad1NMeMo8QNoO8z4A05FYOMCwQ=";
+    commit = "f53000f0499858fe74e4f5008b2f5e467d9d9382";
+    hash = "sha256-+HTXZEVCwMD8z6c1kCZA3k686HzNd30pJljzRvf+gMg=";
  })
 ]
@@ -83,7 +83,7 @@ def get_newest_commit(project_name: str, tracking_branch: str) -> str:
    content = requests.get(f"{BASE_WEB_URL}/{project_name}/+log/refs/heads/{tracking_branch}/").text
    soup = bs4.BeautifulSoup(content, features="html.parser")
    try:
-        a = soup.find('li').findChild('a')
+        a = soup.find('li').find('a')
        commit_sha = a['href'].split('/')[-1]
    except AttributeError:
        print(f"ERROR: Could not parse page for {project_name}:")
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
h7x4	34570c554b	ildkule/loki: restrict incoming connections to pvv + ntnu	2026-06-13 03:23:12 +09:00
h7x4	cd54eabe47	{ildkule/loki,base/fluentbit}: send data over https	2026-06-13 03:22:18 +09:00
Adrian G L	d8d2ed1a8f	ildkule/loki: firewall all endpoints except push API Co-authored-by: Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>	2026-06-13 03:11:13 +09:00
h7x4	526b55c49a	{ildkule/prometheus,base}: send stats over HTTPS through nginx	2026-06-13 02:54:28 +09:00
h7x4	e80189c6eb	temmie/userweb: stop `cat`ing passwd on startup	2026-06-13 01:41:05 +09:00
h7x4	56a51e4c6f	temmie/userweb: mount homedirs under `/amd`	2026-06-13 01:39:20 +09:00
h7x4	f54109f6f3	temmie/userweb: set handlers for php and perl scripts	2026-06-13 01:26:27 +09:00
Vegard Bieker Matthey	5763a76136	user/vegardbm: change shell to zsh and add ssh key	2026-06-08 11:35:44 +02:00
h7x4	b57a935b4c	base/rsyslogd: init	2026-06-08 12:58:37 +09:00
h7x4	b4582a160f	skrot/dibbler: rotate database password	2026-06-07 17:58:33 +09:00
h7x4	ac094d350d	base/timesyncd: specify ntp servers	2026-06-07 17:52:54 +09:00
h7x4	b848e0f1cc	temmie/userweb: add log processor for apache	2026-06-07 06:03:18 +09:00
h7x4	c671329b93	temmie/userweb: inject users from passwd into httpd sandbox	2026-06-07 05:28:24 +09:00
Vegard Bieker Matthey	e6a3d43493	modules/drumknotty: use correct screen window name for dibbler	2026-06-05 22:14:02 +02:00
h7x4	cafc95db8f	bicep/mjolnir: use nodejs v22	2026-06-06 04:43:58 +09:00
h7x4	2d6b09cb32	bikkje: label ports in firewall port list	2026-06-06 04:08:16 +09:00
h7x4	ce0af2f6e4	flake.nix: add app for building gitea workflows locally	2026-06-06 04:05:26 +09:00
h7x4	88892115b5	base: enable autoScrub for all btrfs machine by default	2026-06-06 04:05:26 +09:00
h7x4	8a290d30e7	modules/drumknotty: split into several parts This also fixes a few issues, such as enabling `createLocalDatabase` for multiple programs, and wraps all the screen logic within a screenrc file. Some assertions were also added to avoid some easy-to-make mistakes.	2026-06-05 14:21:35 +02:00
Vegard Bieker Matthey	3197c6a5e3	attach with dibbler window selected	2026-06-05 14:21:35 +02:00
Vegard Bieker Matthey	f8dcaddefb	use main branch for worblehat after merge	2026-06-05 14:21:28 +02:00
Vegard Bieker Matthey	009d89f959	set default settings for worblehat and dibbler	2026-06-05 14:09:06 +02:00
Vegard Bieker Matthey	21bba3ec7e	add worblehat daemons	2026-06-05 14:09:06 +02:00
Vegard Bieker Matthey	9552351776	add database password for worblehat	2026-06-05 14:09:06 +02:00
Vegard Bieker Matthey	7e754ade71	drumknotty: init	2026-06-05 14:08:58 +02:00
h7x4	fcd81aed00	packages/ooye: 3.5.1 -> 3.6.0	2026-06-04 19:17:29 +09:00
h7x4	966081ebfc	bicep/mysql: enable userstat	2026-06-03 15:31:27 +09:00
h7x4	39d313579c	bicep/mysql: rotate slow query logs	2026-06-03 15:21:18 +09:00
h7x4	3386153b8b	ildkule/prometheus/exim: make scheme explicit	2026-06-03 13:35:13 +09:00
h7x4	56906241f6	bekkalokk/roundcube: temporary fix for webmail redirects	2026-06-01 03:52:09 +09:00
h7x4	3fe71d21f6	bekkalokk/roundcube: webdir moved to `public_html` within package	2026-06-01 02:57:43 +09:00
h7x4	074d240595	base: tag generation as `auto` if built by auto upgrade service	2026-06-01 01:00:50 +09:00
h7x4	1ce3372683	lupine/binfmt: enable	2026-06-01 01:00:50 +09:00
Adrian G L	5f14c15679	feat: add radicale to bekkalokk	2026-06-01 00:59:54 +09:00
h7x4	e05eab4ddf	{georg,brzeczyszczykiewicz}: use sane IPv6 addresses	2026-05-29 16:04:52 +09:00
h7x4	64843087be	kommode/gitea: only allow webhooks to external hosts We don't have any servers with intranet IPs, and we want webhooks that hook back to kommode to pass through its firewall.	2026-05-29 12:58:26 +09:00
h7x4	0c45345050	bicep/matrix-ooye harden	2026-05-28 16:07:36 +09:00
h7x4	788f23bf04	bicep/matrix-hookshot: harden	2026-05-28 15:58:04 +09:00
h7x4	8416014aeb	bicep/mjolnir: harden	2026-05-28 15:58:04 +09:00
h7x4	654eeb83d8	base: tag generation as dirty if built from uncommitted source code	2026-05-28 04:39:49 +09:00
h7x4	5bf0de1d0d	bekkalokk/website/fetch-gallery: use proper shellscript builder	2026-05-28 03:58:08 +09:00
h7x4	a550bbf1e0	bekkalokk/roundcube: use specialized builder for nginx root dir	2026-05-28 03:46:59 +09:00
h7x4	6d9bd8256f	kommode/gitea/install-customization: disable networking	2026-05-28 03:15:47 +09:00
h7x4	5c859d9809	kommode/gitea/install-customization: remove `ExecStart` bash wrapper	2026-05-28 03:15:06 +09:00
h7x4	68481b999b	modules/grzegorz: remove `ExecStart` bash wrapper	2026-05-28 03:09:38 +09:00
h7x4	dfbed75cd9	kommode/gitea/gpg: remove `ExecStart` bash wrapper	2026-05-28 03:06:07 +09:00
h7x4	6237a0a0e7	bicep/minecraft-heatmap: remove `ExecStartPre` bash wrapper	2026-05-28 03:03:38 +09:00
h7x4	bd2263a0a9	kommode/gitea/import-users: remove `ExecStartPre` bash wrapper	2026-05-28 03:02:59 +09:00
h7x4	2faff6340c	flake.lock: bump pvv-nettsiden	2026-05-28 02:39:32 +09:00
h7x4	532e8b0eee	bekkalokk/mediawiki: install `PdfHandler` extension	2026-05-28 01:22:13 +09:00
h7x4	eef3f8fe8b	bekkalokk/mediawiki: cleanup executable path config	2026-05-28 01:22:13 +09:00
h7x4	e17025aca6	packages/mediawiki-extensions: add `PdfHandler`, bump all	2026-05-28 00:55:20 +09:00
h7x4	e062a849f3	base/scrutiny-collector: disable if machine is qemu guest	2026-05-27 23:45:30 +09:00
h7x4	b0f81c9379	lupine/smartd: reenable	2026-05-27 23:41:54 +09:00
h7x4	2c819776f8	treewide/nginx: enable kTLS for a bunch more virtualHosts	2026-05-27 23:36:18 +09:00
h7x4	c2d6989350	base/scrutiny-collector: init	2026-05-27 23:35:32 +09:00
h7x4	2b4817b75a	ildkule/scrutiny: init	2026-05-27 23:33:45 +09:00
h7x4	0e2a8ed3ed	base/polkit: let `wheel` users use `AUTH_KEEP_SELF` for systemd actions	2026-05-27 14:13:36 +09:00
h7x4	3372712e26	modules/ooye: move `StartLimit*` options to correct section	2026-05-26 15:03:27 +09:00
h7x4	7e586e082e	flake.lock: bump pvv-calendar-bot	2026-05-26 14:55:58 +09:00
h7x4	47a744f68f	ildkule/uptime-kuma: set up rsync pull target for principal	2026-05-26 13:37:29 +09:00
Vegard Bieker Matthey	da505d4fe2	kommode: sign merge commits and sign crud actions	2026-05-25 20:21:23 +02:00
h7x4	18ab1ef982	temmie/userweb: set `-i` and `-t` in sendmail wrapper	2026-05-25 18:49:57 +09:00
h7x4	5023edeb13	temmie/userweb: install `mod_perl` with custom env	2026-05-25 18:24:23 +09:00
h7x4	0d8c26c548	temmie/userweb: send `propagatedBuildInputs` through perl env wrapper	2026-05-25 17:05:02 +09:00
h7x4	bd244e7797	temmie/userweb: add `www2` server alias	2026-05-25 16:24:35 +09:00
h7x4	e9220bb31e	temmie/userweb: use `www-data`s UID + GID for backwards compat	2026-05-25 15:25:26 +09:00
h7x4	6beb9c62c3	temmie/userweb: use bro to proxy sendmail requests out of sandbox	2026-05-25 15:02:40 +09:00
h7x4	7429b334ca	README: add `temmie` to machine overview	2026-05-25 11:59:17 +09:00
h7x4	1595f67c55	flake.nix: allow `nvidia-kernel-modules` for wenche	2026-05-25 11:35:25 +09:00
h7x4	3f5eadcb87	base/resolved: use RFC42 format	2026-05-25 10:40:04 +09:00
h7x4	70c0ad8724	base: use RFC42 format for `systemd.sleep`	2026-05-25 10:40:04 +09:00
h7x4	61ea0181a1	packages/mediawiki-extensions: REL1_44 -> REL1_45	2026-05-25 10:40:04 +09:00
h7x4	3e22c1a47e	nixpkgs 26.05 🎉	2026-05-25 10:40:02 +09:00
Vegard Bieker Matthey	0319858cad	Merge branch 'gluttony-bluemap'	2026-05-25 03:32:15 +02:00
Vegard Bieker Matthey	efd50868e0	bekkalokk: add back config added through bluemap module	2026-05-25 03:28:49 +02:00
Vegard Bieker Matthey	7a23cf7f25	bekkalokk: remove bluemap	2026-05-25 03:28:30 +02:00
Vegard Bieker Matthey	57963fadd7	gluttony: add private key and set public key for bekkalokk	2026-05-25 03:22:13 +02:00
Vegard Bieker Matthey	792f111a5d	bekkalokk: pull rendered map from gluttony	2026-05-25 03:22:13 +02:00
Vegard Bieker Matthey	b27859c0fa	gluttony: export rendered bluemap to bekkalokk	2026-05-25 03:22:09 +02:00
Vegard Bieker Matthey	eb0eb6d93b	add bekkalokk to known_hosts	2026-05-25 03:20:25 +02:00
Vegard Bieker Matthey	6a943dd7b0	bluemap: set group to nginx only if nginx is enabled	2026-05-25 03:20:25 +02:00
Vegard Bieker Matthey	c59c00f3fc	gluttony: setup bluemap	2026-05-25 03:20:21 +02:00
h7x4	53670b4d05	flake.nix/inputs/disko: v1.11.0 -> v1.13.0	2026-05-24 23:05:48 +09:00
h7x4	d92a5f13ad	base/journald-upload: fix target url	2026-05-24 16:41:54 +09:00
h7x4	16d3251ee2	shells/cuda: fix deprecated package attr warnings	2026-05-24 15:23:33 +09:00
Daniel Olsen	09163b77da	Revert "bicep/matrix/livekit: open the rtc ports" This reverts commit `4a67eddf52`.	2026-05-23 23:23:41 +02:00
Vegard Bieker Matthey	6cca1db3b3	bekkalokk: fix permissions for mediawiki secrets	2026-05-22 20:21:24 +02:00
Vegard Bieker Matthey	bfd83c4c64	uptime-kuma: wants to use /var/lib/private for state	2026-05-22 17:58:00 +02:00
h7x4	9a6fdecb03	kommode/gitea/dump: only keep a single dump at a time	2026-05-22 18:27:57 +09:00
h7x4	82ab97fb45	bekkalokk/roundcube: restart service on changed sops secrets	2026-05-22 18:10:44 +09:00
h7x4	543fd19f8d	bekkalokk/vaultwarden: restart service on changed sops secrets	2026-05-22 18:10:40 +09:00
h7x4	6f99fa575d	bekkalokk/vaultwarden: render environment_file as sops template	2026-05-22 18:02:13 +09:00
h7x4	3141b1f76b	bekkalokk/vaultwarden: remove redundant hardening This has already been upstreamed	2026-05-22 17:51:03 +09:00
h7x4	475f6a8c9b	bekkalokk/vaultwarden: add rsa key to sops	2026-05-22 17:49:31 +09:00
h7x4	9c1687f8f2	bekkalokk/vaultwarden: use envvar keys It seems like the nixpkgs module is compensating for previous config that might've ended up in a file, which are now being turned into screaming snake case environment variables. Let's just name them as they are supposed to be named instead of having the upstream module translate them.	2026-05-22 17:08:31 +09:00
h7x4	0f53bcd731	bekkalokk/roundcube: add des_key to sops	2026-05-22 17:08:31 +09:00
Felix Albrigtsen	f433ae1e15	ustetind: remove from sops rg -. to the rescue	2026-05-22 10:01:15 +02:00
h7x4	5745648f87	bicep/postgres/repack: use local unix socket	2026-05-22 15:59:59 +09:00
h7x4	2c34a93abf	bicep/postgres/repack: don't kill connections on timeout	2026-05-22 15:57:57 +09:00
h7x4	9ebc947eab	ustetind: bai bai 👋	2026-05-22 15:41:28 +09:00
h7x4	6fcc19f0a2	base/fluentbit: init	2026-05-22 15:32:13 +09:00
h7x4	9224f04bd1	base/promtail: remove	2026-05-22 15:32:13 +09:00
Vegard Bieker Matthey	9c93f15569	change agekey for ildkule and update keys update keys	2026-05-21 17:27:11 +02:00
h7x4	5d6c153007	kommode/gitea: fix dump command	2026-05-21 17:54:54 +09:00
h7x4	8b483a92f8	ildkule: set `fsType` for bindmounts	2026-05-21 17:52:47 +09:00
h7x4	0d7f05e56d	bicep/postgres: add cleanup timers	2026-05-21 04:14:34 +09:00
Daniel Olsen	4a67eddf52	bicep/matrix/livekit: open the rtc ports	2026-05-20 20:04:33 +02:00
h7x4	08a23bd380	base/hardening: ban a few more modules	2026-05-20 23:15:25 +09:00
h7x4	28b67c3578	base/mitigations: blacklist modules for copyfail and pintheft	2026-05-20 23:15:25 +09:00
Vegard Bieker Matthey	e5804c043a	README: add gluttony	2026-05-20 06:24:26 +02:00
Vegard Bieker Matthey	9c227f3022	update gluttony IPs and boot device	2026-05-20 06:07:41 +02:00
Felix Albrigtsen	69fdf709d7	grr: fix the heccin quotes	2026-05-19 16:38:34 +02:00
Adrian G L	30ec70fa5f	fix: ildkule grub duplicated devices, format nix files	2026-05-19 16:26:36 +02:00
Adrian G L	1024b428ac	feat: ildkule disco config	2026-05-19 12:16:39 +02:00
Adrian G L	1e6b692fbf	fix: updated ildkule config and ips to match trd1 new setup	2026-05-19 11:37:05 +02:00
Vegard Bieker Matthey	beac6e91dd	flake.lock: bump pvv-nettsiden	2026-05-17 16:58:04 +02:00
h7x4	0fd41c214a	flake.{nix,lock}: bump deps	2026-05-13 01:19:35 +09:00
h7x4	5c1ee958ea	flake.{nix,lock}: bump roowho2	2026-05-12 00:25:55 +09:00
h7x4	d8e97715c9	flake.lock: bump pvv-nettsiden	2026-05-12 00:24:56 +09:00
h7x4	33297b0436	treewide: `lib.cli.toGNUCommandLineShell` -> `lib.cli.toCommandLineShellGNU`	2026-05-11 23:09:50 +09:00
h7x4	be33c95c83	bekkalokk/website: more logging, specify timeouts, ban spooky funcs, fake sendmail	2026-05-11 21:14:08 +09:00
h7x4	2abf36a9af	packages/simplesamlphp: 2.4.3 -> 2.5.0	2026-05-11 16:12:15 +09:00
h7x4	a60be532ce	packages/mediawiki-extensions: bump all	2026-05-11 16:11:10 +09:00
h7x4	9c142fd56f	kommode/gitea: remove deprecated config options	2026-05-11 16:00:51 +09:00
Øystein Tveit	b98e8679e6	temmie/userweb: set same phpOptions for env and apache	2026-05-11 14:54:56 +09:00
h7x4	ea092ec0b3	temmie/userweb: pass userdir user to sendmail through custom envvar	2026-05-11 14:26:47 +09:00
h7x4	5e50b617fb	temmie/userweb: switch from postfix to nullmailer	2026-05-11 13:52:58 +09:00
h7x4	258c5a7b25	temmie/userweb: set up sendmail wrapper	2026-05-11 12:26:39 +09:00
h7x4	b9eda3dc56	temmie/userweb: reduce package list	2026-05-11 10:17:09 +09:00
Vegard Bieker Matthey	2fcaf5893f	fix deprecation warning for mediawiki update script	2026-05-09 20:40:14 +02:00
h7x4	b009da31af	temmie/userweb: deny a bunch of spooky directories by default It should still be possible for the user to re-enable these with `.htaccess`	2026-05-10 03:33:43 +09:00
h7x4	e9a267e2a3	temmie/userweb: ignore collisions in fhs env	2026-05-10 03:02:27 +09:00
h7x4	338c2f2531	temmie/userweb: adjust perl and php env This adds and removes a few packages to make the environments closer to how they are on tom	2026-05-10 03:02:26 +09:00
felixalb	8db3034baf	Run shellcheck	2026-05-08 09:31:35 +02:00
h7x4	f64f9c944e	topology: hook skrot up to the switch at the office	2026-05-08 16:27:01 +09:00
h7x4	baeb1e5e60	base/hardening: move hardening options from base/default	2026-05-08 16:23:17 +09:00
h7x4	86ca8dcdc3	base/hardening: ban a bunch more unimportant kernel modules	2026-05-08 16:23:17 +09:00
Daniel Olsen	11d1f8b442	bakke: the owls sick motorbike	2026-05-08 03:07:09 +02:00
Felix Albrigtsen	d8115c4031	bakke: add shading	2026-05-08 03:06:06 +02:00
Felix Albrigtsen	0d41326d9f	bakke: rest of the owl	2026-05-08 03:06:06 +02:00
felixalb	7baf3ffcb4	bakke: uninit	2026-05-08 03:06:06 +02:00
Daniel Olsen	45f10be9b4	secrets: delete skrott	2026-05-08 03:01:11 +02:00
Daniel Olsen	06cd860d2f	README: change skrot link to point to skrot, not skrott	2026-05-08 02:38:54 +02:00
Daniel Olsen	ebd8b871f4	skrott: yeetus deletus	2026-05-08 01:08:48 +02:00
Daniel Olsen	14994485c5	base: mitigate dirtyfrag	2026-05-08 01:03:45 +02:00
h7x4	f2752ee9a6	.gitea/workflows/*: remove redundant config All of the extra config is now being included by default with the github action	2026-05-06 23:34:22 +09:00
h7x4	bb20f32df8	.gitea/workflows: simplify some steps	2026-04-29 08:34:38 +09:00
h7x4	f83ae6de37	flake.lock: bump roowho2	2026-04-29 08:29:02 +09:00
h7x4	f490e64516	flake.nix: bump greg-ng and gergle Also follow unstable nixpkgs in order to use bleeding edge flutter	2026-04-25 07:09:41 +09:00
Vegard Bieker Matthey	61c6639d3a	remove inactive users	2026-04-23 14:18:52 +02:00
h7x4	eee7e9ad7b	lupine/gitea-runner: register docker images for alpine v3.23 and ubuntu 26.04	2026-04-23 21:05:23 +09:00
h7x4	3160d64167	packages/bluemap: 5.15 -> 5.20	2026-04-19 05:31:15 +09:00
h7x4	23355317d6	lupine-3: update hardware config	2026-04-19 01:26:25 +09:00
h7x4	683e4b2dbc	lupine-3: update sops key	2026-04-19 01:26:12 +09:00
h7x4	f52cf697cc	lupine-5: update hardware config	2026-04-19 00:38:32 +09:00
h7x4	8a9e92c706	lupine-5: update sops key	2026-04-19 00:38:24 +09:00
h7x4	6dce8bac0e	lupine-4: re-enable gitea runner	2026-04-19 00:22:30 +09:00
h7x4	e2abbf224b	lupine-{1,2,4}: update hardware config	2026-04-18 23:58:53 +09:00
h7x4	a399f23785	lupine-{1,2,4}: update sops keys	2026-04-18 23:58:43 +09:00
h7x4	69a22e2ba0	flake.lock: bump	2026-04-02 13:06:30 +09:00
h7x4	6be23feeca	packages/ooye: 3.3-unstable-2026-01-21 -> 3.5.1	2026-04-02 12:44:43 +09:00
Vegard Bieker Matthey	1bfd4fe595	avoid using lupine-4 for gitea actions	2026-03-26 06:05:41 +01:00
felixalb	2efe4a1d1e	Revert "base/acme: use different email alias for account" This reverts commit `0d40c7d7a7`.	2026-03-22 12:52:33 +01:00
h7x4	6ef02bd485	kommode/gitea: allow me to go fork myself	2026-03-10 14:50:56 +09:00
Vegard Bieker Matthey	6b1fb4c065	only cross-compile when necessary This fixes issues with rebuilding georg and brzeczyszczykiewicz. Reviewed-on: https://git.pvv.ntnu.no/Drift/pvv-nixos-config/pulls/128 Reviewed-by: Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Co-authored-by: Vegard Bieker Matthey <VegardMatthey@protonmail.com> Co-committed-by: Vegard Bieker Matthey <VegardMatthey@protonmail.com>	2026-02-21 21:14:04 +01:00