mirror of
https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git
synced 2026-07-04 09:51:47 +02:00
Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 h7x4
|
14623252a1 | ||
|
h7x4
|
ffb2d261ae |
-14
@@ -20,7 +20,6 @@ keys:
|
||||
- &host_lupine-4 age1ml48zztcmnrdrhrdsjrlyxf09jtmjgz46u8td4zm59wn3fm4g57qs4wg0l
|
||||
- &host_lupine-5 age12gws5nws69vxryd3kt7q0ayngch90efmhqcrfhnnsmj00lkgxd4qsdkvqn
|
||||
- &host_skrot age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr
|
||||
- &host_temmie age10avsdvqger25z0lyzlq8v7xfzcmypkmjsswswaxwqnpnl6x9wcjq0uv2n7
|
||||
- &host_gluttony age12czfkvuw9pjk5qny5c6m2hjhd634cj9r4dsa3ss5zkux5h4vvc7s7k4urq
|
||||
|
||||
creation_rules:
|
||||
@@ -122,19 +121,6 @@ creation_rules:
|
||||
pgp:
|
||||
- *user_oysteikt
|
||||
|
||||
- path_regex: secrets/temmie/[^/]+\.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
- *host_temmie
|
||||
- *user_danio
|
||||
- *user_felixalb
|
||||
- *user_pederbs_sopp
|
||||
- *user_pederbs_nord
|
||||
- *user_pederbs_bjarte
|
||||
- *user_vegardbm
|
||||
pgp:
|
||||
- *user_oysteikt
|
||||
|
||||
- path_regex: secrets/gluttony/[^/]+\.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
|
||||
@@ -1,5 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
inputs,
|
||||
@@ -47,18 +46,12 @@
|
||||
|
||||
system.nixos.tags = lib.optionals (inputs.self.sourceInfo ? dirtyRev) [ "dirty" ];
|
||||
|
||||
specialisation."auto-upgrade".configuration = {
|
||||
system.nixos.tags = [ "auto" ];
|
||||
};
|
||||
|
||||
boot.tmp.cleanOnBoot = lib.mkDefault true;
|
||||
boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
|
||||
|
||||
boot.loader.systemd-boot.enable = lib.mkDefault true;
|
||||
boot.loader.efi.canTouchEfiVariables = lib.mkDefault true;
|
||||
|
||||
services.btrfs.autoScrub.enable = lib.mkDefault (lib.any ({ fsType, ... }: fsType == "btrfs") (lib.attrValues config.fileSystems));
|
||||
|
||||
time.timeZone = "Europe/Oslo";
|
||||
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
@@ -13,7 +13,6 @@ in
|
||||
|
||||
"--refresh"
|
||||
"--no-write-lock-file"
|
||||
"--specialisation auto-upgrade"
|
||||
# --update-input is deprecated since nix 2.22, and removed in lix 2.90
|
||||
# as such we instead use --override-input combined with --refresh
|
||||
# https://git.lix.systems/lix-project/lix/issues/400
|
||||
|
||||
Generated
+1
-67
@@ -161,27 +161,6 @@
|
||||
"url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
|
||||
}
|
||||
},
|
||||
"libdib": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"worblehat",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1769338528,
|
||||
"narHash": "sha256-t18ZoSt9kaI1yde26ok5s7aFLkap1Q9+/2icVh2zuaE=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "7218348163fd8d84df4a6f682c634793e67a3fed",
|
||||
"revCount": 13,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/libdib.git"
|
||||
},
|
||||
"original": {
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/libdib.git"
|
||||
}
|
||||
},
|
||||
"matrix-next": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -330,27 +309,6 @@
|
||||
"url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
|
||||
}
|
||||
},
|
||||
"passwd2systemd-users": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1780764154,
|
||||
"narHash": "sha256-Xvf9aBNLYDnbDKdtFjp5GEA/rZwVczHZWbJ0hac8Vv4=",
|
||||
"ref": "main",
|
||||
"rev": "8b4541be73ee3bd6c60525b2f42605efe89398c9",
|
||||
"revCount": 14,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git"
|
||||
}
|
||||
},
|
||||
"pvv-calendar-bot": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -429,13 +387,11 @@
|
||||
"nix-topology": "nix-topology",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||
"passwd2systemd-users": "passwd2systemd-users",
|
||||
"pvv-calendar-bot": "pvv-calendar-bot",
|
||||
"pvv-nettsiden": "pvv-nettsiden",
|
||||
"qotd": "qotd",
|
||||
"roowho2": "roowho2",
|
||||
"sops-nix": "sops-nix",
|
||||
"worblehat": "worblehat"
|
||||
"sops-nix": "sops-nix"
|
||||
}
|
||||
},
|
||||
"roowho2": {
|
||||
@@ -566,28 +522,6 @@
|
||||
"repo": "sops-nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"worblehat": {
|
||||
"inputs": {
|
||||
"libdib": "libdib",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1773932847,
|
||||
"narHash": "sha256-IklIAdlonrmO8/lkDxNIVz9+ORL4pcVotMTxeyvxzoc=",
|
||||
"ref": "main",
|
||||
"rev": "0871a319f51d3cb0d1abb5b11edb768b39906d3f",
|
||||
"revCount": 104,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
|
||||
@@ -23,9 +23,6 @@
|
||||
dibbler.url = "git+https://git.pvv.ntnu.no/Projects/dibbler.git?ref=main";
|
||||
dibbler.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
worblehat.url = "git+https://git.pvv.ntnu.no/Projects/worblehat.git?ref=main";
|
||||
worblehat.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
matrix-next.url = "github:dali99/nixos-matrix-modules/v0.8.0";
|
||||
matrix-next.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
@@ -53,8 +50,6 @@
|
||||
|
||||
bro.url = "git+https://git.pvv.ntnu.no/Projects/bro.git?ref=main";
|
||||
bro.inputs.nixpkgs.follows = "nixpkgs";
|
||||
passwd2systemd-users.url = "git+https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git?ref=main";
|
||||
passwd2systemd-users.inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
outputs = {
|
||||
@@ -97,18 +92,6 @@
|
||||
];
|
||||
});
|
||||
|
||||
apps = forAllSystems (system: let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
in {
|
||||
gitea-workflows = {
|
||||
type = "app";
|
||||
meta.description = "Run all gitea workflows locally";
|
||||
program = toString (pkgs.writeShellScript "pvv-nixos-config-run-gitea-worflows" ''
|
||||
${lib.getExe pkgs.gitea-actions-runner} exec -i node:current-trixie
|
||||
'');
|
||||
};
|
||||
});
|
||||
|
||||
nixosConfigurations = let
|
||||
nixosConfig = nixpkgs: name: configurationPath: extraArgs @ {
|
||||
localSystem ? "x86_64-linux", # buildPlatform
|
||||
@@ -204,12 +187,6 @@
|
||||
(final: prev: {
|
||||
inherit (self.packages.${prev.stdenv.hostPlatform.system}) out-of-your-element;
|
||||
})
|
||||
(final: prev: {
|
||||
# See https://git.pvv.ntnu.no/Drift/issues/issues/369
|
||||
mjolnir = prev.mjolnir.override {
|
||||
nodejs = prev.nodejs_22;
|
||||
};
|
||||
})
|
||||
];
|
||||
};
|
||||
bekkalokk = stableNixosConfig "bekkalokk" {
|
||||
@@ -233,21 +210,16 @@
|
||||
};
|
||||
skrot = stableNixosConfig "skrot" {
|
||||
modules = [
|
||||
self.nixosModules.drumknotty
|
||||
inputs.disko.nixosModules.disko
|
||||
inputs.dibbler.nixosModules.default
|
||||
];
|
||||
overlays =
|
||||
[
|
||||
inputs.dibbler.overlays.default
|
||||
inputs.worblehat.overlays.default
|
||||
];
|
||||
overlays = [inputs.dibbler.overlays.default];
|
||||
};
|
||||
shark = stableNixosConfig "shark" {};
|
||||
wenche = stableNixosConfig "wenche" {};
|
||||
temmie = stableNixosConfig "temmie" {
|
||||
overlays = [
|
||||
inputs.bro.overlays.default
|
||||
inputs.passwd2systemd-users.overlays.default
|
||||
];
|
||||
modules = [
|
||||
inputs.bro.nixosModules.default
|
||||
@@ -312,7 +284,6 @@
|
||||
rsync-pull-targets = ./modules/rsync-pull-targets.nix;
|
||||
snakeoil-certs = ./modules/snakeoil-certs.nix;
|
||||
snappymail = ./modules/snappymail.nix;
|
||||
drumknotty = ./modules/drumknotty;
|
||||
};
|
||||
|
||||
devShells = forAllSystems (system: {
|
||||
|
||||
@@ -7,7 +7,6 @@
|
||||
|
||||
./services/alps.nix
|
||||
./services/bluemap.nix
|
||||
./services/radicale.nix
|
||||
./services/idp-simplesamlphp
|
||||
./services/kerberos.nix
|
||||
./services/mediawiki
|
||||
@@ -25,6 +24,8 @@
|
||||
address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||
};
|
||||
|
||||
services.btrfs.autoScrub.enable = true;
|
||||
|
||||
# Don't change (even during upgrades) unless you know what you are doing.
|
||||
# See https://search.nixos.org/options?show=system.stateVersion
|
||||
system.stateVersion = "25.11";
|
||||
|
||||
@@ -107,6 +107,7 @@ in {
|
||||
CodeEditor
|
||||
CodeMirror
|
||||
DeleteBatch
|
||||
MediawikiMatrixNotifs
|
||||
PdfHandler
|
||||
PluggableAuth
|
||||
Popups
|
||||
|
||||
@@ -1,40 +0,0 @@
|
||||
{ config, lib, ... }:
|
||||
let
|
||||
domain = "dav.pvv.ntnu.no";
|
||||
radicalePort = 5232;
|
||||
in {
|
||||
services.radicale = {
|
||||
enable = true;
|
||||
|
||||
settings = {
|
||||
server = {
|
||||
hosts = [ "127.0.0.1:${toString radicalePort}" ];
|
||||
};
|
||||
|
||||
auth = {
|
||||
type = "imap";
|
||||
imap_host = "imap.pvv.ntnu.no";
|
||||
imap_security = "tls";
|
||||
};
|
||||
|
||||
storage = {
|
||||
filesystem_folder = "/var/lib/radicale/collections";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."${domain}" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
kTLS = true;
|
||||
|
||||
extraConfig = ''
|
||||
client_max_body_size 128M;
|
||||
'';
|
||||
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:${toString radicalePort}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -10,9 +10,8 @@
|
||||
enableACME = true;
|
||||
kTLS = true;
|
||||
locations = {
|
||||
# "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
|
||||
"= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
|
||||
|
||||
"/roundcube".return = "302 https://webmail.pvv.ntnu.no/";
|
||||
"/afterlogic_lite".return = "302 https://webmail.pvv.ntnu.no/roundcube";
|
||||
"/squirrelmail".return = "302 https://webmail.pvv.ntnu.no/roundcube";
|
||||
"/rainloop".return = "302 https://snappymail.pvv.ntnu.no/";
|
||||
|
||||
@@ -29,7 +29,7 @@ in
|
||||
|
||||
dicts = with pkgs.aspellDicts; [ en en-computers nb nn fr de it ];
|
||||
maxAttachmentSize = 20;
|
||||
hostName = domain;
|
||||
hostName = "roundcubeplaceholder.example.com";
|
||||
|
||||
database = {
|
||||
host = "postgres.pvv.ntnu.no";
|
||||
@@ -49,9 +49,44 @@ in
|
||||
'';
|
||||
};
|
||||
|
||||
# TODO: move this back to `webmail.pvv.ntnu.no/roundcube` subpath
|
||||
services.nginx.virtualHosts."roundcubeplaceholder.example.com" = lib.mkForce { };
|
||||
|
||||
services.nginx.virtualHosts.${domain} = {
|
||||
kTLS = true;
|
||||
locations."/roundcube" = {
|
||||
tryFiles = "$uri $uri/ =404";
|
||||
index = "index.php";
|
||||
root = pkgs.linkFarm "roundcube-dir" {
|
||||
roundcube = "${cfg.package}";
|
||||
};
|
||||
|
||||
extraConfig = ''
|
||||
location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
|
||||
# https://wiki.archlinux.org/title/Roundcube
|
||||
"README"
|
||||
"INSTALL"
|
||||
"LICENSE"
|
||||
"CHANGELOG"
|
||||
"UPGRADING"
|
||||
"bin"
|
||||
"SQL"
|
||||
".+\\.md"
|
||||
"\\."
|
||||
"config"
|
||||
"temp"
|
||||
"logs"
|
||||
]})/? {
|
||||
deny all;
|
||||
}
|
||||
|
||||
location ~ ^/roundcube/(.+\.php)(/?.*)$ {
|
||||
fastcgi_split_path_info ^/roundcube(/.+\.php)(/.+)$;
|
||||
include ${config.services.nginx.package}/conf/fastcgi_params;
|
||||
include ${config.services.nginx.package}/conf/fastcgi.conf;
|
||||
fastcgi_index index.php;
|
||||
fastcgi_pass unix:${config.services.phpfpm.pools.roundcube.socket};
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -23,9 +23,6 @@ in
|
||||
bind-address = values.services.mysql.ipv4;
|
||||
skip-networking = 0;
|
||||
|
||||
# Useful for the mysqld prometheus exporter
|
||||
userstat = 1;
|
||||
|
||||
# This was needed in order to be able to use all of the old users
|
||||
# during migration from knakelibrak to bicep in Sep. 2023
|
||||
secure_auth = 0;
|
||||
@@ -74,16 +71,4 @@ in
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services.logrotate = lib.mkIf (cfg.settings.mysqld.slow-query-log == 1) {
|
||||
enable = true;
|
||||
settings.mysql-slowlog = {
|
||||
files = [ cfg.settings.mysqld.slow-query-log-file ];
|
||||
frequency = "weekly";
|
||||
rotate = 12;
|
||||
create = "0660 mysql mysql";
|
||||
minsize = "1M";
|
||||
compress = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -29,29 +29,7 @@
|
||||
firewall = {
|
||||
enable = true;
|
||||
# Allow SSH and HTTP and ports for email and irc
|
||||
allowedTCPPorts = [
|
||||
22 # SSH
|
||||
80 # HTTP
|
||||
|
||||
# IRC
|
||||
194 # IRC
|
||||
994 # IRC (TLS)
|
||||
6697 # IRC (SSL)
|
||||
6665
|
||||
6666
|
||||
6667
|
||||
6668
|
||||
6669
|
||||
|
||||
# EMAIL
|
||||
25 # STMP
|
||||
465 # STMP (SSL)
|
||||
587 # STMP (TLS/STARTTLS)
|
||||
110 # POP3
|
||||
995 # POP3 (SSL/TLS)
|
||||
143 # IMAP
|
||||
993 # IMAP (SSL/TLS)
|
||||
];
|
||||
allowedTCPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
|
||||
allowedUDPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
|
||||
};
|
||||
# Use systemd-resolved inside the container
|
||||
|
||||
@@ -1,12 +1,14 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.prometheus.scrapeConfigs = [{
|
||||
services.prometheus = {
|
||||
scrapeConfigs = [
|
||||
{
|
||||
job_name = "exim";
|
||||
scrape_interval = "15s";
|
||||
scheme = "http";
|
||||
|
||||
static_configs = [{
|
||||
targets = [ "microbel.pvv.ntnu.no:9636" ];
|
||||
}];
|
||||
}];
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -15,6 +15,8 @@
|
||||
address = with values.hosts.kommode; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||
};
|
||||
|
||||
services.btrfs.autoScrub.enable = true;
|
||||
|
||||
services.qemuGuest.enable = true;
|
||||
|
||||
# Don't change (even during upgrades) unless you know what you are doing.
|
||||
|
||||
@@ -9,12 +9,6 @@
|
||||
|
||||
sops.defaultSopsFile = fp /secrets/lupine/lupine.yaml;
|
||||
|
||||
boot.binfmt.emulatedSystems = [
|
||||
"aarch64-linux"
|
||||
"armv7l-linux"
|
||||
"i686-linux"
|
||||
];
|
||||
|
||||
systemd.network.networks."30-enp0s31f6" = values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "enp0s31f6";
|
||||
address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||
|
||||
@@ -28,26 +28,17 @@
|
||||
|
||||
sops.secrets = {
|
||||
"dibbler/postgresql/password" = {
|
||||
owner = "drumknotty";
|
||||
group = "drumknotty";
|
||||
};
|
||||
"worblehat/postgresql/password" = {
|
||||
owner = "drumknotty";
|
||||
group = "drumknotty";
|
||||
owner = "dibbler";
|
||||
group = "dibbler";
|
||||
};
|
||||
};
|
||||
|
||||
services.drumknotty = {
|
||||
services.dibbler = {
|
||||
enable = true;
|
||||
kioskMode = true;
|
||||
limitScreenWidth = 80;
|
||||
limitScreenHeight = 42;
|
||||
|
||||
screen = {
|
||||
limitWidth = 80;
|
||||
limitHeight = 42;
|
||||
};
|
||||
|
||||
dibbler = {
|
||||
enable = true;
|
||||
settings = {
|
||||
general.quit_allowed = false;
|
||||
database = {
|
||||
@@ -62,23 +53,6 @@
|
||||
};
|
||||
};
|
||||
|
||||
worblehat = {
|
||||
enable = true;
|
||||
settings = {
|
||||
general.quit_allowed = false;
|
||||
database = {
|
||||
type = "postgresql";
|
||||
postgresql = {
|
||||
username = "worblehat";
|
||||
dbname = "worblehat";
|
||||
host = "postgres.pvv.ntnu.no";
|
||||
password = config.sops.secrets."worblehat/postgresql/password".path;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."serial-getty@ttyUSB0" = lib.mkIf (!config.virtualisation.isVmVariant) {
|
||||
enable = true;
|
||||
wantedBy = [ "getty.target" ]; # to start at boot
|
||||
|
||||
@@ -130,9 +130,6 @@ let
|
||||
file
|
||||
findutils
|
||||
gawk
|
||||
glibc.getent
|
||||
strace
|
||||
systemd
|
||||
gnugrep
|
||||
gnumake
|
||||
gnupg
|
||||
@@ -157,11 +154,6 @@ in
|
||||
./mail.nix
|
||||
];
|
||||
|
||||
sops.secrets = {
|
||||
"httpd/passwd-ssh-key" = { };
|
||||
"httpd/ssh-known-hosts" = { };
|
||||
};
|
||||
|
||||
services.httpd = {
|
||||
enable = true;
|
||||
adminAddr = "drift@pvv.ntnu.no";
|
||||
@@ -284,60 +276,17 @@ in
|
||||
serviceConfig = {
|
||||
Type = lib.mkForce "notify";
|
||||
|
||||
ExecStartPre = let
|
||||
rsyncCommand = ''${lib.getExe pkgs.rsync} -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey" -avz'';
|
||||
in lib.mkForce [
|
||||
"${lib.getExe (pkgs.writeShellApplication {
|
||||
name = "http-exec-start-pre-remove-old-semaphores";
|
||||
text = ''
|
||||
# Get rid of old semaphores. These tend to accumulate across
|
||||
# server restarts, eventually preventing it from restarting
|
||||
# successfully.
|
||||
for i in $(${pkgs.util-linux}/bin/ipcs -s | grep ' ${cfg.user} ' | cut -f2 -d ' '); do
|
||||
${pkgs.util-linux}/bin/ipcrm -s "$i"
|
||||
done
|
||||
'';
|
||||
})}"
|
||||
# "${pkgs.systemd}/bin/resolvectl query smtp.pvv.ntnu.no"
|
||||
"${pkgs.strace}/bin/strace ${pkgs.glibc.getent}/bin/getent ahosts smtp.pvv.ntnu.no"
|
||||
"${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/passwd /run/httpd/pamunix-sync/"
|
||||
"${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/group /run/httpd/pamunix-sync/"
|
||||
# "+|echo 'wwwrun:x:54:54:Apache httpd user:/var/empty:/run/current-system/sw/bin/nologin' >> /run/httpd/pamunix-sync/passwd"
|
||||
# "+|echo 'root:x:0:0:System administrator:/root:/run/current-system/sw/bin/bash' >> /run/httpd/pamunix-sync/passwd"
|
||||
# "+|echo 'wwwrun:x:54:' >> /run/httpd/pamunix-sync/group"
|
||||
# "${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/shadow /run/httpd/pamunix-sync/"
|
||||
(let
|
||||
args = lib.cli.toCommandLineShellGNU { } {
|
||||
passwd-file = "/run/httpd/pamunix-sync/passwd";
|
||||
group-file = "/run/httpd/pamunix-sync/group";
|
||||
output-dir = "/run/httpd/systemd-userdb";
|
||||
shadow-file = pkgs.emptyFile;
|
||||
|
||||
output-passwd = true;
|
||||
|
||||
ignore-user-file = toString ./ignore_user_file.txt;
|
||||
ignore-group-file = toString ./ignore_group_file.txt;
|
||||
};
|
||||
in ''${lib.getExe pkgs.passwd2systemd-users} ${args}'')
|
||||
"${lib.getExe' pkgs.coreutils "shred"} -u /run/httpd/pamunix-sync/passwd /run/httpd/pamunix-sync/group"
|
||||
];
|
||||
ExecStart = lib.mkForce "${cfg.package}/bin/httpd -D FOREGROUND -f /etc/httpd/httpd.conf -k start";
|
||||
ExecReload = lib.mkForce "${cfg.package}/bin/httpd -f /etc/httpd/httpd.conf -k graceful";
|
||||
ExecStop = lib.mkForce "";
|
||||
KillMode = "mixed";
|
||||
|
||||
LoadCredential=[
|
||||
"sshkey:${config.sops.secrets."httpd/passwd-ssh-key".path}"
|
||||
"ssh-known-hosts:${config.sops.secrets."httpd/ssh-known-hosts".path}"
|
||||
];
|
||||
|
||||
ConfigurationDirectory = [ "httpd" ];
|
||||
LogsDirectory = [ "httpd" ];
|
||||
LogsDirectoryMode = "0700";
|
||||
|
||||
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_PTRACE" ];
|
||||
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_PTRACE" ];
|
||||
# LockPersonality = true;
|
||||
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
|
||||
LockPersonality = true;
|
||||
PrivateDevices = true;
|
||||
PrivateTmp = true;
|
||||
# NOTE: this removes CAP_NET_BIND_SERVICE...
|
||||
@@ -364,45 +313,20 @@ in
|
||||
"tcp:443"
|
||||
];
|
||||
SystemCallArchitectures = "native";
|
||||
# SystemCallFilter = [
|
||||
# "@system-service"
|
||||
# ];
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
];
|
||||
UMask = "0077";
|
||||
|
||||
RuntimeDirectory = [
|
||||
"httpd/root-mnt"
|
||||
"httpd/pamunix-sync"
|
||||
"httpd/systemd-userdb"
|
||||
];
|
||||
RuntimeDirectory = [ "httpd/root-mnt" ];
|
||||
RootDirectory = "/run/httpd/root-mnt";
|
||||
MountAPIVFS = true;
|
||||
BindReadOnlyPaths = [
|
||||
builtins.storeDir
|
||||
"/etc"
|
||||
"/dev/null"
|
||||
# NCSD socket
|
||||
# "/var/run"
|
||||
# "/var/run/systemd/resolve"
|
||||
"/etc/resolv.conf"
|
||||
"/var/run"
|
||||
"/var/lib/acme"
|
||||
"/run/httpd/systemd-userdb:/etc/userdb"
|
||||
"${pkgs.writeText "userweb-fake-nsswitch.conf" ''
|
||||
passwd: systemd files
|
||||
group: systemd files
|
||||
shadow: systemd files
|
||||
sudoers: files
|
||||
|
||||
hosts: mymachines resolve [!UNAVAIL=return] files myhostname dns
|
||||
networks: files
|
||||
|
||||
ethers: files
|
||||
services: files
|
||||
protocols: files
|
||||
rpc: files
|
||||
|
||||
subuid: files
|
||||
subgid: files
|
||||
''}:/etc/nsswitch.conf"
|
||||
|
||||
"${fhsEnv}/bin:/bin"
|
||||
"${fhsEnv}/sbin:/sbin"
|
||||
|
||||
@@ -1,91 +0,0 @@
|
||||
Debian-exim
|
||||
_cvsadmin
|
||||
_ssh
|
||||
adm
|
||||
audio
|
||||
avahi
|
||||
backup
|
||||
bin
|
||||
cdrom
|
||||
cl-builder
|
||||
clamav
|
||||
clock
|
||||
colord
|
||||
courier
|
||||
crontab
|
||||
daemon
|
||||
debian-spamd
|
||||
dialout
|
||||
dip
|
||||
dirmngr
|
||||
disk
|
||||
dovecot
|
||||
fax
|
||||
floppy
|
||||
fuse
|
||||
games
|
||||
geoclue
|
||||
gnats
|
||||
input
|
||||
irc
|
||||
kmem
|
||||
kvm
|
||||
list
|
||||
lock
|
||||
lp
|
||||
lpadmin
|
||||
mail
|
||||
man
|
||||
messagebus
|
||||
mlocate
|
||||
munin
|
||||
netdev
|
||||
news
|
||||
nogroup
|
||||
ntp
|
||||
ntpsec
|
||||
oident
|
||||
opendkim
|
||||
operator
|
||||
plocate
|
||||
plugdev
|
||||
polkitd
|
||||
postdrop
|
||||
postfix
|
||||
postgres
|
||||
prometheus
|
||||
prometheus-exporter
|
||||
proxy
|
||||
rdma
|
||||
root
|
||||
# runit
|
||||
salt
|
||||
sambashare
|
||||
saned
|
||||
sasl
|
||||
scanner
|
||||
sgx
|
||||
shadow
|
||||
src
|
||||
ssl-cert
|
||||
staff
|
||||
stunnel4
|
||||
sudo
|
||||
sys
|
||||
systemd-coredump
|
||||
systemd-journal
|
||||
systemd-network
|
||||
systemd-resolve
|
||||
systemd-timesync
|
||||
tape
|
||||
tcpdump
|
||||
tty
|
||||
users
|
||||
utempter
|
||||
utmp
|
||||
uucp
|
||||
uuidd
|
||||
video
|
||||
voice
|
||||
winbindd_priv
|
||||
www-data
|
||||
@@ -1,74 +0,0 @@
|
||||
# System Users
|
||||
Debian-exim
|
||||
_apt
|
||||
_rpc
|
||||
avahi
|
||||
backup
|
||||
bin
|
||||
cl-builder
|
||||
clamav
|
||||
colord
|
||||
courier
|
||||
daemon
|
||||
debian-spamd
|
||||
debian-spamd
|
||||
dirmngr
|
||||
distccd
|
||||
dovecot
|
||||
dovenull
|
||||
driftsupport
|
||||
fetchmail
|
||||
games
|
||||
geoclue
|
||||
gitea
|
||||
gnats
|
||||
hplip
|
||||
irc
|
||||
list
|
||||
lp
|
||||
mail
|
||||
mail2news
|
||||
mailnews
|
||||
man
|
||||
messagebus
|
||||
munin
|
||||
news
|
||||
nobody
|
||||
noone
|
||||
ntp
|
||||
ntpsec
|
||||
oident
|
||||
opendkim
|
||||
polkitd
|
||||
postfix
|
||||
postgres
|
||||
prometheus
|
||||
prometheus-exporter
|
||||
proxy
|
||||
root
|
||||
rwhod
|
||||
salt
|
||||
saned
|
||||
spamd
|
||||
sshd
|
||||
statd
|
||||
stunnel4
|
||||
sync
|
||||
sys
|
||||
systemd-coredump
|
||||
systemd-network
|
||||
systemd-resolve
|
||||
systemd-timesync
|
||||
tcpdump
|
||||
uucp
|
||||
uuidd
|
||||
vaultwarden
|
||||
www-data
|
||||
|
||||
# Misc
|
||||
nuccc04
|
||||
nuccc
|
||||
kybkokos
|
||||
kybkokos2
|
||||
testbruker2309
|
||||
testbruker2404
|
||||
@@ -1,198 +0,0 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.services.drumknotty;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./dibbler.nix
|
||||
./worblehat.nix
|
||||
];
|
||||
|
||||
options.services.drumknotty = {
|
||||
enable = lib.mkEnableOption "DrumknoTTY";
|
||||
|
||||
kioskMode = lib.mkEnableOption "" // {
|
||||
description = ''
|
||||
Whether to let dibbler take over the entire machine.
|
||||
|
||||
This will restrict the machine to a single TTY and make the program unquittable.
|
||||
You can still get access to PTYs via SSH and similar, if enabled.
|
||||
'';
|
||||
};
|
||||
|
||||
screen = {
|
||||
package = lib.mkPackageOption pkgs "screen" { };
|
||||
|
||||
sessionName = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "drumknotty";
|
||||
example = "myscreensessionname";
|
||||
description = ''
|
||||
Sets the screen session name.
|
||||
'';
|
||||
};
|
||||
|
||||
limitHeight = lib.mkOption {
|
||||
type = with lib.types; nullOr ints.unsigned;
|
||||
default = null;
|
||||
example = 42;
|
||||
description = ''
|
||||
If set, limits the height of the screen dibbler uses to the given number of lines.
|
||||
'';
|
||||
};
|
||||
|
||||
limitWidth = lib.mkOption {
|
||||
type = with lib.types; nullOr ints.unsigned;
|
||||
default = null;
|
||||
example = 80;
|
||||
description = ''
|
||||
If set, limits the width of the screen dibbler uses to the given number of columns.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
assertions = [
|
||||
{
|
||||
assertion = cfg.enable -> lib.any (b: b) [
|
||||
cfg.dibbler.enable
|
||||
cfg.worblehat.enable
|
||||
];
|
||||
message = "DrumknoTTY must have at least one service enabled";
|
||||
}
|
||||
];
|
||||
|
||||
users = {
|
||||
users.drumknotty = {
|
||||
group = "drumknotty";
|
||||
extraGroups = [ "lp" ];
|
||||
isNormalUser = true;
|
||||
|
||||
# TODO: make this display the error log or error message in case that
|
||||
# the screen session service is bootlooping or otherwise off.
|
||||
shell =
|
||||
lib.mkIf cfg.kioskMode
|
||||
(pkgs.writeShellScriptBin "login-shell"
|
||||
"${lib.getExe' cfg.screen.package "screen"} -x ${cfg.screen.sessionName} -p dibbler"
|
||||
// {
|
||||
shellPath = "/bin/login-shell";
|
||||
});
|
||||
};
|
||||
groups.drumknotty = { };
|
||||
};
|
||||
|
||||
boot.kernelParams = lib.mkIf cfg.kioskMode [
|
||||
"console=tty1"
|
||||
];
|
||||
|
||||
services.getty.autologinUser = lib.mkIf cfg.kioskMode "drumknotty";
|
||||
|
||||
systemd.services.drumknotty-screen-session = lib.mkIf cfg.kioskMode {
|
||||
description = "Drumknotty Screen Session";
|
||||
wantedBy = [
|
||||
"default.target"
|
||||
];
|
||||
after =
|
||||
# TODO: this could be refined
|
||||
if (cfg.dibbler.createLocalDatabase || cfg.worblehat.createLocalDatabase) then
|
||||
[
|
||||
"postgresql.service"
|
||||
"dibbler-setup-database.service"
|
||||
"worblehat-setup-database.service"
|
||||
]
|
||||
else
|
||||
[
|
||||
"network.target"
|
||||
];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "forking";
|
||||
RemainAfterExit = false;
|
||||
Restart = "always";
|
||||
RestartSec = "5s";
|
||||
SuccessExitStatus = 1;
|
||||
|
||||
User = "drumknotty";
|
||||
Group = "drumknotty";
|
||||
|
||||
ExecStartPre =
|
||||
let
|
||||
screenArgs = lib.escapeShellArgs [
|
||||
# Send the specified command to a running screen session
|
||||
"-X"
|
||||
|
||||
# Session name
|
||||
"-S"
|
||||
"${cfg.screen.sessionName}"
|
||||
|
||||
"kill"
|
||||
];
|
||||
in
|
||||
"-${lib.getExe' cfg.screen.package "screen"} ${screenArgs}";
|
||||
|
||||
ExecStart =
|
||||
let
|
||||
screenrc = let
|
||||
convertToFile = lines: lib.pipe lines [
|
||||
lib.concatLists
|
||||
(lib.concatStringsSep "\n")
|
||||
(pkgs.writeText "drumknotty-screenrc")
|
||||
];
|
||||
in convertToFile [
|
||||
(lib.optionals (cfg.screen.limitWidth != null) [
|
||||
"screen width ${toString cfg.screen.limitWidth}"
|
||||
])
|
||||
(lib.optionals (cfg.screen.limitHeight != null) [
|
||||
"screen height ${toString cfg.screen.limitHeight}"
|
||||
])
|
||||
|
||||
(let
|
||||
dibblerArgs = lib.cli.toCommandLineShellGNU { } {
|
||||
config = "/etc/dibbler/dibbler.toml";
|
||||
};
|
||||
in lib.optionals cfg.dibbler.enable [
|
||||
"screen -t dibbler ${lib.getExe cfg.dibbler.package} ${dibblerArgs} loop"
|
||||
|
||||
])
|
||||
|
||||
(let
|
||||
worblehatArgs = lib.cli.toCommandLineShellGNU { } {
|
||||
config = "/etc/worblehat/config.toml";
|
||||
};
|
||||
in lib.optionals cfg.worblehat.enable [
|
||||
"screen -t worblehat ${lib.getExe cfg.worblehat.package} ${worblehatArgs} cli"
|
||||
])
|
||||
|
||||
[ "select 0" ]
|
||||
];
|
||||
|
||||
screenArgs = lib.escapeShellArgs [
|
||||
# -dm creates the screen in detached mode without accessing it
|
||||
"-dm"
|
||||
|
||||
# Session name
|
||||
"-S"
|
||||
"${cfg.screen.sessionName}"
|
||||
|
||||
# Set optimal output mode instead of VT100 emulation
|
||||
"-O"
|
||||
|
||||
# Enable login mode, updates utmp entries
|
||||
"-l"
|
||||
|
||||
# Config file path
|
||||
"-c"
|
||||
"${screenrc}"
|
||||
];
|
||||
in
|
||||
"${lib.getExe' cfg.screen.package "screen"} ${screenArgs}";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,113 +0,0 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
mainCfg = config.services.drumknotty;
|
||||
cfg = config.services.drumknotty.dibbler;
|
||||
|
||||
format = pkgs.formats.toml { };
|
||||
in
|
||||
{
|
||||
options.services.drumknotty.dibbler = {
|
||||
enable = lib.mkEnableOption "";
|
||||
|
||||
package = lib.mkPackageOption pkgs "dibbler" { };
|
||||
|
||||
settings = lib.mkOption {
|
||||
description = "Configuration for dibbler";
|
||||
default = { };
|
||||
type = lib.types.submodule {
|
||||
freeformType = format.type;
|
||||
};
|
||||
};
|
||||
|
||||
createLocalDatabase = lib.mkEnableOption "" // {
|
||||
description = ''
|
||||
Whether to set up a local postgres database automatically.
|
||||
|
||||
::: {.note}
|
||||
You must set up postgres manually before enabling this option.
|
||||
:::
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf (mainCfg.enable && cfg.enable) {
|
||||
assertions = [
|
||||
{
|
||||
assertion = cfg.createLocalDatabase -> config.services.postgresql.enable;
|
||||
message = "PostgreSQL must be enabled for dibbler to create a local database";
|
||||
}
|
||||
];
|
||||
|
||||
environment.systemPackages = [ cfg.package ];
|
||||
environment.etc."dibbler/dibbler.toml".source = format.generate "dibbler.toml" cfg.settings;
|
||||
|
||||
services.drumknotty.dibbler.settings = {
|
||||
limits = {
|
||||
low_credit_warning_limit = lib.mkDefault (-100);
|
||||
user_recent_transaction_limit = lib.mkDefault 100;
|
||||
};
|
||||
|
||||
printer = {
|
||||
label_type = lib.mkDefault "62";
|
||||
label_rotate = lib.mkDefault false;
|
||||
};
|
||||
|
||||
database = {
|
||||
type = lib.mkIf cfg.createLocalDatabase "postgresql";
|
||||
postgresql = {
|
||||
username = lib.mkDefault "dibbler";
|
||||
dbname = lib.mkDefault "dibbler";
|
||||
|
||||
host = lib.mkIf cfg.createLocalDatabase "/run/postgresql";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.drumknotty.dibbler.settings.general = lib.mkIf mainCfg.kioskMode {
|
||||
quit_allowed = false;
|
||||
stop_allowed = false;
|
||||
};
|
||||
|
||||
services.postgresql = lib.mkIf cfg.createLocalDatabase {
|
||||
authentication = ''
|
||||
local ${cfg.settings.database.postgresql.dbname} ${cfg.settings.database.postgresql.username} peer map=${cfg.settings.database.postgresql.username}
|
||||
'';
|
||||
identMap = ''
|
||||
${cfg.settings.database.postgresql.username} drumknotty ${cfg.settings.database.postgresql.username}
|
||||
'';
|
||||
ensureDatabases = [ cfg.settings.database.postgresql.dbname ];
|
||||
ensureUsers = [{
|
||||
name = cfg.settings.database.postgresql.username;
|
||||
ensureDBOwnership = true;
|
||||
ensureClauses.login = true;
|
||||
}];
|
||||
};
|
||||
|
||||
systemd.services.dibbler-setup-database = lib.mkIf cfg.createLocalDatabase {
|
||||
description = "Dibbler database setup";
|
||||
|
||||
wantedBy = [ "default.target" ];
|
||||
requiredBy = [ "drumknotty-screen-session.service" ];
|
||||
before = [ "drumknotty-screen-session.service" ];
|
||||
after = [ "postgresql.service" ];
|
||||
|
||||
unitConfig = {
|
||||
ConditionPathExists = "!/var/lib/dibbler/.db-setup-done";
|
||||
};
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = "${lib.getExe cfg.package} --config /etc/dibbler/dibbler.toml create-db";
|
||||
ExecStartPost = "${lib.getExe' pkgs.coreutils "touch"} /var/lib/dibbler/.db-setup-done";
|
||||
StateDirectory = "dibbler";
|
||||
|
||||
User = "drumknotty";
|
||||
Group = "drumknotty";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,209 +0,0 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
mainCfg = config.services.drumknotty;
|
||||
cfg = config.services.drumknotty.worblehat;
|
||||
|
||||
format = pkgs.formats.toml { };
|
||||
in
|
||||
{
|
||||
options.services.drumknotty.worblehat = {
|
||||
enable = lib.mkEnableOption "";
|
||||
|
||||
package = lib.mkPackageOption pkgs "worblehat" { };
|
||||
|
||||
settings = lib.mkOption {
|
||||
description = "Configuration for worblehat";
|
||||
default = { };
|
||||
type = lib.types.submodule {
|
||||
freeformType = format.type;
|
||||
};
|
||||
};
|
||||
|
||||
createLocalDatabase = lib.mkEnableOption "" // {
|
||||
description = ''
|
||||
Whether to set up a local postgres database automatically.
|
||||
|
||||
::: {.note}
|
||||
You must set up postgres manually before enabling this option.
|
||||
:::
|
||||
'';
|
||||
};
|
||||
|
||||
deadline-daemon = {
|
||||
enable = lib.mkEnableOption "" // {
|
||||
description = ''
|
||||
Whether to enable the worblehat deadline-daemon service,
|
||||
which periodically checks for upcoming deadlines and notifies users.
|
||||
|
||||
Note that this service is independent of the main worblehat service,
|
||||
and must be enabled separately.
|
||||
'';
|
||||
};
|
||||
|
||||
onCalendar = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
How often to trigger rendering the map,
|
||||
in the format of a systemd timer onCalendar configuration.
|
||||
|
||||
See {manpage}`systemd.timer(5)`.
|
||||
'';
|
||||
default = "*-*-* 10:15:00";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkMerge [
|
||||
{
|
||||
assertions = [
|
||||
{
|
||||
assertion = cfg.createLocalDatabase -> config.services.postgresql.enable;
|
||||
message = "PostgreSQL must be enabled for worblehat to create a local database";
|
||||
}
|
||||
];
|
||||
|
||||
# TODO: Retrieve defaults from the example config file in the project code.
|
||||
services.drumknotty.worblehat.settings = {
|
||||
logging = {
|
||||
debug = lib.mkDefault true;
|
||||
debug_sql = lib.mkDefault false;
|
||||
};
|
||||
|
||||
database = {
|
||||
type = lib.mkDefault "sqlite";
|
||||
sqlite.path = lib.mkDefault "./worblehat.sqlite";
|
||||
postgresql = {
|
||||
host = lib.mkDefault "localhost";
|
||||
port = lib.mkDefault 5432;
|
||||
username = lib.mkDefault "worblehat";
|
||||
password = lib.mkDefault "/var/lib/worblehat/db-password";
|
||||
database = lib.mkDefault "worblehat";
|
||||
};
|
||||
};
|
||||
|
||||
flask = {
|
||||
TESTING = lib.mkDefault true;
|
||||
DEBUG = lib.mkDefault true;
|
||||
FLASK_ENV = lib.mkDefault "development";
|
||||
SECRET_KEY = lib.mkDefault "change-me";
|
||||
};
|
||||
|
||||
smtp = {
|
||||
enabled = lib.mkDefault false;
|
||||
host = lib.mkDefault "smtp.pvv.ntnu.no";
|
||||
port = lib.mkDefault 587;
|
||||
username = lib.mkDefault "worblehat";
|
||||
password = lib.mkDefault "/var/lib/worblehat/smtp-password";
|
||||
from = lib.mkDefault "worblehat@pvv.ntnu.no";
|
||||
subject_prefix = lib.mkDefault "[Worblehat]";
|
||||
};
|
||||
|
||||
deadline_daemon = {
|
||||
enabled = lib.mkDefault true;
|
||||
dryrun = lib.mkDefault false;
|
||||
warn_days_before_borrowing_deadline = lib.mkDefault [
|
||||
5
|
||||
1
|
||||
];
|
||||
days_before_queue_position_expires = lib.mkDefault 14;
|
||||
warn_days_before_expiring_queue_position_deadline = lib.mkDefault [
|
||||
3
|
||||
1
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
(lib.mkIf ((mainCfg.enable && cfg.enable) || cfg.deadline-daemon.enable) {
|
||||
environment.systemPackages = [ cfg.package ];
|
||||
environment.etc."worblehat/config.toml".source = format.generate "worblehat-config.toml" cfg.settings;
|
||||
})
|
||||
|
||||
(lib.mkIf (mainCfg.enable && cfg.enable) {
|
||||
services.drumknotty.worblehat.settings.general = lib.mkIf mainCfg.kioskMode {
|
||||
quit_allowed = false;
|
||||
stop_allowed = false;
|
||||
};
|
||||
|
||||
services.drumknotty.worblehat.settings.database = lib.mkIf cfg.createLocalDatabase {
|
||||
type = "postgresql";
|
||||
postgresql.host = "/run/postgresql";
|
||||
};
|
||||
|
||||
services.postgresql = lib.mkIf cfg.createLocalDatabase {
|
||||
authentication = ''
|
||||
local ${cfg.settings.database.postgresql.database} ${cfg.settings.database.postgresql.username} peer map=${cfg.settings.database.postgresql.username}
|
||||
'';
|
||||
identMap = ''
|
||||
${cfg.settings.database.postgresql.username} drumknotty ${cfg.settings.database.postgresql.username}
|
||||
'';
|
||||
ensureDatabases = [ cfg.settings.database.postgresql.database ];
|
||||
ensureUsers = [{
|
||||
name = cfg.settings.database.postgresql.username;
|
||||
ensureDBOwnership = true;
|
||||
ensureClauses.login = true;
|
||||
}];
|
||||
};
|
||||
|
||||
systemd.services.worblehat-setup-database = lib.mkIf cfg.createLocalDatabase {
|
||||
description = "Worblehat database setup";
|
||||
|
||||
wantedBy = [ "default.target" ];
|
||||
requiredBy = [ "drumknotty-screen-session.service" ];
|
||||
before = [ "drumknotty-screen-session.service" ];
|
||||
after = [ "postgresql.service" ];
|
||||
|
||||
unitConfig = {
|
||||
ConditionPathExists = "!/var/lib/worblehat/.db-setup-done";
|
||||
};
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = "${lib.getExe cfg.package} --config /etc/worblehat/config.toml create-db";
|
||||
ExecStartPost = "${lib.getExe' pkgs.coreutils "touch"} /var/lib/worblehat/.db-setup-done";
|
||||
StateDirectory = "worblehat";
|
||||
|
||||
User = "drumknotty";
|
||||
Group = "drumknotty";
|
||||
};
|
||||
};
|
||||
})
|
||||
|
||||
(lib.mkIf cfg.deadline-daemon.enable {
|
||||
systemd.timers.worblehat-deadline-daemon = lib.mkIf cfg.deadline-daemon.enable {
|
||||
description = "Worblehat Deadline Daemon";
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnCalendar = cfg.deadline-daemon.onCalendar;
|
||||
Persistent = true;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.worblehat-deadline-daemon = lib.mkIf cfg.deadline-daemon.enable {
|
||||
description = "Worblehat Deadline Daemon";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
CPUSchedulingPolicy = "idle";
|
||||
IOSchedulingClass = "idle";
|
||||
|
||||
ExecStart =
|
||||
let
|
||||
worblehatArgs = lib.cli.toCommandLineShellGNU { } {
|
||||
config = "/etc/worblehat/config.toml";
|
||||
};
|
||||
in
|
||||
"${lib.getExe cfg.package} ${worblehatArgs} deadline-daemon";
|
||||
|
||||
User = "drumknotty";
|
||||
Group = "drumknotty";
|
||||
};
|
||||
};
|
||||
})
|
||||
];
|
||||
}
|
||||
@@ -15,12 +15,13 @@ let
|
||||
, tracking-branch ? "REL1_45"
|
||||
, kebab-name ? kebab-case-name name
|
||||
, fetchgit ? pkgs.fetchgit
|
||||
, url ? "https://gerrit.wikimedia.org/r/mediawiki/extensions/${name}"
|
||||
}:
|
||||
{
|
||||
${name} = (fetchgit {
|
||||
name = "mediawiki-${kebab-name}-source";
|
||||
url = "https://gerrit.wikimedia.org/r/mediawiki/extensions/${name}";
|
||||
rev = commit;
|
||||
inherit url;
|
||||
inherit hash;
|
||||
}).overrideAttrs (_: {
|
||||
passthru = { inherit name kebab-name tracking-branch; };
|
||||
@@ -97,4 +98,12 @@ lib.mergeAttrsList [
|
||||
commit = "f53000f0499858fe74e4f5008b2f5e467d9d9382";
|
||||
hash = "sha256-+HTXZEVCwMD8z6c1kCZA3k686HzNd30pJljzRvf+gMg=";
|
||||
})
|
||||
|
||||
(mw-ext {
|
||||
name = "MediawikiMatrixNotifs";
|
||||
commit = "52d2a46c03f51af7c16ed4d7b3b07b0cbbffb4df";
|
||||
hash = "sha256-AADWunm2Rn2cfxeu9xyYBw5txnaIbJNdR3jxLqgzAy8=";
|
||||
url = "https://git.pvv.ntnu.no/oysteikt/mediawiki-matrix-notifs.git";
|
||||
tracking-branch = "master";
|
||||
})
|
||||
]
|
||||
|
||||
@@ -10,18 +10,18 @@ let
|
||||
in
|
||||
buildNpmPackage {
|
||||
pname = "delete-your-element";
|
||||
version = "3.6.0";
|
||||
version = "3.5.1";
|
||||
src = fetchFromGitea {
|
||||
domain = "git.pvv.ntnu.no";
|
||||
owner = "Drift";
|
||||
repo = "delete-your-element";
|
||||
rev = "44fb6a02d3139e8ab10e9660ad931e5e70d1205f";
|
||||
hash = "sha256-wDQhPbxwdkAm0kPhaDNjbk8rVFxnGinffVdASdFrYnU=";
|
||||
rev = "80ac1d9d79207b6327975a264fcd9747b99a2a5d";
|
||||
hash = "sha256-fcBpUZ+WEMUXyyo/uaArl4D1NJmK95isWqhFSt6HzUU=";
|
||||
};
|
||||
|
||||
inherit nodejs;
|
||||
|
||||
npmDepsHash = "sha256-h1mmE0/+Y7SBwnI0vaYvV+KqRDJGzwJvDUOkigzHcOY=";
|
||||
npmDepsHash = "sha256-EYxJi6ObJQOLyiJq4C3mV6I62ns9l64ZHcdoQxmN5Ao=";
|
||||
dontNpmBuild = true;
|
||||
|
||||
nativeBuildInputs = [ makeWrapper ];
|
||||
|
||||
@@ -1,9 +1,6 @@
|
||||
dibbler:
|
||||
postgresql:
|
||||
password: ENC[AES256_GCM,data:3X9A3jOpFVRuBg0gRiCEsZVKfLI=,iv:XC7LBNUhALk9IEhItV8fO5p/m7VKL0REBY1W2IZt7G4=,tag:l18R7EhbOlucZHFQiEvpHw==,type:str]
|
||||
worblehat:
|
||||
postgresql:
|
||||
password: ENC[AES256_GCM,data:WpJR6MumY+7WUYdVVgAqv1af+NmqecTMO9aP5lidSpE=,iv:7aoN8mjXckd81LxasMSG3R2vqj0SvzSl7wrEQ1LwToo=,tag:zeeNcEpkYnqyd8be0ZS+kQ==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- recipient: age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr
|
||||
@@ -69,8 +66,8 @@ sops:
|
||||
MmxPMWNPYzJiOFRqY2VYczhvRm5IR3cKpUVV+zsMolsHI2YK9YqC6ecNT6QXv0TV
|
||||
d1SpXRAexZBeWCCHBjSdvQBl8AT4EwrAIP2M2o++6i5DaGoGiEIWZQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2026-03-18T14:56:22Z"
|
||||
mac: ENC[AES256_GCM,data:nBKtFmFKx/Mt9TIFnKuuznsPAXCQpc3+WIspNu5TN9TpIqw75nzYXpxIb2hxRfRu0nbjHXpBy4bkzeMi41BGkvkvV57CZyq11J5i/iIKwuvllaB1IWrdDT2u+6RH3jIspp3KoyxFWdRqcGfNma9dSmtI+1Dd5z7XaxVaoVK2QMI=,iv:6joviyJ2cXmGh/9HH7VEcoK3+4GK5I6i2N/1d65PAN0=,tag:0BFVPWL3BByJH8HbrBTKOw==,type:str]
|
||||
lastmodified: "2026-02-10T20:02:28Z"
|
||||
mac: ENC[AES256_GCM,data:i8CjVxoD7zdkLNJlI9DCo/tDV5DUI7JdpozLtYZzI7Cu51GayaE2Y3Wg4de6P0L7C3FER04WfRe/h+G9PLZICX/CfSipQysyrEq3Pjt9IKsjytDhP9VYJ36QFGF0PuHUQAMSLts/tAoAvLue6MP+V82l5js9ghvyBrzyBGxoyJw=,iv:QFNxvCYxrSkwy7iT+2BEacNPftDXju1cibprVPDjic0=,tag:496E+oCy/VwTylyaWhQD+A==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-02-10T20:01:32Z"
|
||||
enc: |-
|
||||
@@ -93,4 +90,4 @@ sops:
|
||||
-----END PGP MESSAGE-----
|
||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.12.1
|
||||
version: 3.11.0
|
||||
|
||||
@@ -1,93 +0,0 @@
|
||||
httpd:
|
||||
passwd-ssh-key: ENC[AES256_GCM,data:fXfqlhNbAIdacm7s4yirp+XS7gWhsp4jrD5yRzsU8lP+oueqS8cCkQGV4MB83OKa/D3wm1zxvjRsys9uxa+4kKL2/xOetDex5WXH7xAjzMaE0jHRNCjJMYM44L9+n3oc2c6rXz2DZ+4TEdGfJOru3pUIZx2LVYO/NB+FXSW59632PFhkuSypmpeeXRFn13ksd27W5x9fB4lOw9nrdyQkfuqvl0pD9uC6zef/sZ12rfre1JHyhN+jiowzWjJuzA9iiJpjNcek2wTyymVYZNxngfugnCkTKtWcfl+BOTgyhpEtGmL3mLs3n9r6bD725IAuoXUSzBEJqE1dCw93AvlPyrUwOXLM5lOX4h9IYS/0Izfc4w+qC+ID02XU0/cFufT8ODfTK08xF5QAOp5AdLxbcvMq3KadVPesD/5K75mzWtfC+UM4lo8TfphqnEtetL/P0DBXIJIsyY04gyTWsUVCfjcwWcliW6p3pcZZ+rkqObFs9n06uMWQq8qULa85yLq+mMsyPlBW1HE+TIV8jrLtVBqPkfXp85ZtllMOJRpeEOf/l48=,iv:1BE0moa2a4k2yqVBboS/EbNiFGLTu4Df/tnXBassls4=,tag:iPUOAEhqKbF9umsyBLaoJg==,type:str]
|
||||
ssh-known-hosts: ENC[AES256_GCM,data:E2NiTUQokUDHzkfmTh5eECHZxt8v/Ug63ETA/CcO8358EpPeaFI1tAFt3q0o5rTCAUlB5cJ1ZOxX4mTeIH370wnwFN6emg+iAaK3VM+AL3Tp8Acb5EwErSOTKjAwrS5vwqb3oTYMzj42bKBk0b/qPWspGnoUfDI481+p99PS8eqpNCcGaNEDNk0BPwDvngwuur9o2RTmuWwxZO+s3wqlktQPkCguii8/FD3x3O8eow+v,iv:tJNxoY4UsRrB9k/fX9jLUc4hC3bioekpgKu4aa2o/4Q=,tag:DLj9rqse33D8PDLMxF/heQ==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrMStZRlNCem0zRWgvMytj
|
||||
b2tGR0M4SmF2Z1dYR2RBK1ZTUEx4c3NhMmlnCkVwcStqZ0RPRm1EK01lTWJpUmd2
|
||||
Qis2WlU2ZUpFcUVXZUdVaWVyQno4NFEKLS0tIGJZWmlSdEtaUnd1alZ6NURsSFY3
|
||||
VXJGank2UlBqY0hNZ1QvUGZUdVljaXMK9P4IVuSZ8uhDXDWMOkqABWImL4mu18AU
|
||||
7X+1t3nZVmPze3MOTBRWf483DBAM+69QDlio1uSzZjJQc1X0H6ePKQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age10avsdvqger25z0lyzlq8v7xfzcmypkmjsswswaxwqnpnl6x9wcjq0uv2n7
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJMGdHZ2xvdnVMbFAxYkhF
|
||||
WHRPWjg3OE4vU1RhTWxPc0cxNm1RU1BPem40CnRHc0gyQVNxelBnZERMNlp2YnFk
|
||||
U0xpbHN6RlVHZHdkZktnK0hCMFQ1aGcKLS0tIDVtODVvNzN0NFJ3UGFYdkpLTmZR
|
||||
R0FvdzE5NDhUNFpWZTYreklCMmhCWmcKuD5nNqDSP4SK3E1AsnZtE4jzYgxfgHau
|
||||
nmPKA2dgsPoA2rug/kGB9uXeUUA0oL26FyjlPi6NYDVvN4u1IHgPSw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3SUdGMUgwSEV2SUhkMEJm
|
||||
MWJ5Y1VMdWsyK1NWYmxUK3N1cHoydWp5eUVrCllZK3hKZjNDYzMwQTFENTg2aFFi
|
||||
dXpkWGZkT0hiWGRQdjltNXZ6ZkN2S1EKLS0tIFREeDFVZkZEV0phM3dRYUVRSSsx
|
||||
UVpkZ3hTd0JuWm16WnFFREt4S0hxMjAKbihmtr3/d/BbX21zkZWNarCNa4cYCM9B
|
||||
HGwcEfP4fnevWdM4LbXXBBmfoVUErKjK5tiMwocVZXZrsHBYI4amPA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3d3g2aHUrT0d5Kzl1RmVk
|
||||
MUh4eW8vTS9qbkZ3WHNYMjFHSlZLV2M1aVgwCllWTDFwZDV1QTFkQkVrUnN0bSto
|
||||
aTlvVTVaOWVldDJjSHMyaFhLNXlBcUEKLS0tIHZ6d0ZZWlo5SVJ3a0VNbjRFYnkz
|
||||
dDFFT1JVN2N1cjg2TW5xOUZKZDVzZkUKjtRmm87B4AECzS8mmL6rUyVfNYlsem1w
|
||||
HDFw4p0Nt9JWFFWEWamnTQ+Bq2UPsueBW4Ei/WyDj5d4EyNptoJrDQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2aWs5V0xhTzJlMi9PNks0
|
||||
ZUNiOFB5TDZQUVBnVThRQjdzYTJ0Uml1blJzCjhUdTdpRURsVlIrUkxnUXVhM3Vn
|
||||
cmJSL0x2Y29aMnltcWhiYmhLem1ldGsKLS0tIFpMa1lmZjZPQ0FvSUhTbUhzRlM5
|
||||
bHNqMm1xRGdMd2NOdVo0Y0xFLzJCbGcKnSMBn2kp/RGDr5NL+qMoWqqdCdSu4wFz
|
||||
GjjUS43nW0++TVXusGIj60sDJtK623N4srpubykZtYfEO1c1cAURpg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnU2d6bFRqMk5jZ3lDdzA5
|
||||
WFpsNVdLL2lXRGZ5ZjRIdGs5VjRVZ1JKdDJJCmxQeHZsZk9OQ1g4dG00MVNGeFF2
|
||||
OURQUndCOTM3eUh1SnRaOGFKMi80TjQKLS0tIEE2eE8vK1dnN0dnbGNqaWZqdzJx
|
||||
WGhRM2R0VzV1SlpxeGVWOXNCeWlzcVUK/nD3DWVDjVbWJmP33OC4LSKA3qrjN0hb
|
||||
kZV4U44y+8uLtBVm3WnkZd/cg5wqoD/1agG7aCc9DMmOmxHUfdfrJw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtczYrL3NrM295NEd4N3V0
|
||||
WndPRXltZFhOUU1LdGVNM05LRzV5blhmU1JRClBpU0g2K0FJbFE0RVEyVW1ZRTJU
|
||||
d2ZoeTM0QWx1NE9wSjc3c0tUa3Z3VlkKLS0tIEVrQStXSWRTUkJvK2paTU1EUkcy
|
||||
ZWtMdDRhTWdLZnI2T2ZmS2VXdjFpZVkK1LAo54bl2QIx08rMJ0A8Q5bVXWcaoFPo
|
||||
Y0/PSyL+vMa2Ab6b4vD6GNY5/KAE5XPlvBEKBrIe2oIAMJw38KUq8g==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
|
||||
lastmodified: "2026-05-29T13:54:14Z"
|
||||
mac: ENC[AES256_GCM,data:g1PT225ggTfHuzU9qaNfNrhIVqtTWRCSm7iFDTlCZTDr4PPGbRtUH5fIJSY1F+2mu+H2XRM9ueenhqTyyyDJGsq+Oqp6Ae4E7vp2Uo4qH8O2d/u78EL2zNVestTvCnJGJ5lPWrN2i41pqOWbNx+dXt0O+sdgS890IQkj4i8VrRU=,iv:CjBKRSCMpAT+gWEFjvqb5OBy5u6ZsDelsCg5lGNOsN0=,tag:k1ia0wkw3YQfeFdv0GTX6g==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-05-29T13:54:02Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA0av/duuklWYARAAq4qDoGJmeum8aPwO6TGOO+iIKNE3rqIdCsUsTs+SF3VL
|
||||
ejSW3yB9hw5ptg3CCUH0tZRuZyvQ3fkXFh08hSBfBhICSr9NS2vllXp4ILlhNG0P
|
||||
gEIq67+daK2YyWBcV3Rh8OMz5niGYDKF6WZjzlkFxinUFcqVtQrVKw9pti+Crhs9
|
||||
QgZbTz5+Cph/ACSLufSUV2yyjv+zO+VhyMpHR4x/B/el/T921vAQAdGx9DprC1ed
|
||||
cse2kg9ouhMQI+Aii5oSnDCAuVZGZQN23WXQBQp66l4gFmR3Av85miguEF5Gf8YW
|
||||
44GiixHyul5583NDsMQuoPu1gzE8CqUPMVFVGzp5BsXbb4HzmEslxkpi7obCs7wx
|
||||
fCplc2L+mLa4hTBJXYcCcRbsbopjDnYLNLfl4nvYHW5utimNej4EBdzQQg3DNf8J
|
||||
zdNXlwHXUBgU8ayAyOwThQIP4s+VDSh2ASSWwEmqNMr5nkocIl7UO3J9MzkLNuc1
|
||||
0S4b8rM9om755SlQTeLrOy/4aloZwCMFxQOeIoJ0fxNlgap1BS1FQ68leA+uiCcc
|
||||
vCFVMlYUOwMl2wqkQ84pY3SEL6z96o9wpOyRERk/yfjBWnGjqjANNz4uSXggo4B9
|
||||
LTLIqO+Li26+geyTATIMJU5SeMdP5s+Lvc2qzn0c4qr67hVo9H5Df2qzijsqIqrS
|
||||
XgHQdNafa0JYSH07UKFvfmcDYU/sWRi7QrFD3/zn5HPUN2XNQj4P9OF93NV8tAqK
|
||||
pFqgdJCybDSp4sQujjQOZkJ3tpVnlq/G/QjiAY2TpbYxzPUDWP0Pu0yGxVIrJ5Q=
|
||||
=atHd
|
||||
-----END PGP MESSAGE-----
|
||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.0
|
||||
Reference in New Issue
Block a user