mirror of
https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git
synced 2025-12-31 12:48:23 +01:00
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
c7cc9ab029 |
@@ -1,10 +0,0 @@
|
|||||||
root = true
|
|
||||||
|
|
||||||
[*]
|
|
||||||
end_of_line = lf
|
|
||||||
insert_final_newline = true
|
|
||||||
trim_trailing_whitespace = true
|
|
||||||
|
|
||||||
[*.nix]
|
|
||||||
indent_style = space
|
|
||||||
indent_size = 2
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
e00008da1afe0d760badd34bbeddff36bb08c475
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
name: "Build topology graph"
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
branches:
|
|
||||||
- main
|
|
||||||
jobs:
|
|
||||||
evals:
|
|
||||||
runs-on: debian-latest
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v6
|
|
||||||
|
|
||||||
- name: Install sudo
|
|
||||||
run: apt-get update && apt-get -y install sudo
|
|
||||||
|
|
||||||
- uses: https://github.com/cachix/install-nix-action@v31
|
|
||||||
|
|
||||||
- name: Configure Nix
|
|
||||||
run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
|
|
||||||
|
|
||||||
- name: Build topology graph
|
|
||||||
run: nix build .#topology -L
|
|
||||||
|
|
||||||
- name: Upload topology graph
|
|
||||||
uses: https://git.pvv.ntnu.no/Projects/rsync-action@v2
|
|
||||||
with:
|
|
||||||
source: result/*.svg
|
|
||||||
quote-source: false
|
|
||||||
target: ${{ gitea.ref_name }}/topology_graph/
|
|
||||||
username: gitea-web
|
|
||||||
ssh-key: ${{ secrets.WEB_SYNC_SSH_KEY }}
|
|
||||||
host: pages.pvv.ntnu.no
|
|
||||||
known-hosts: "pages.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2QjfFB+city1SYqltkVqWACfo1j37k+oQQfj13mtgg"
|
|
||||||
@@ -4,10 +4,10 @@ on:
|
|||||||
push:
|
push:
|
||||||
jobs:
|
jobs:
|
||||||
evals:
|
evals:
|
||||||
runs-on: debian-latest
|
runs-on: ubuntu-latest
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v6
|
- uses: actions/checkout@v3
|
||||||
- run: apt-get update && apt-get -y install sudo
|
- run: apt-get update && apt-get -y install sudo
|
||||||
- uses: https://github.com/cachix/install-nix-action@v31
|
- uses: https://github.com/cachix/install-nix-action@v23
|
||||||
- run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
|
- run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
|
||||||
- run: nix flake check
|
- run: nix flake check
|
||||||
|
|||||||
1
.gitignore
vendored
1
.gitignore
vendored
@@ -1,4 +1,3 @@
|
|||||||
result*
|
result*
|
||||||
/configuration.nix
|
/configuration.nix
|
||||||
/.direnv/
|
/.direnv/
|
||||||
*.qcow2
|
|
||||||
|
|||||||
25
.mailmap
25
.mailmap
@@ -1,25 +0,0 @@
|
|||||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> <daniel.olsen99@gmail.com>
|
|
||||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel <danio@pvv.ntnu.no>
|
|
||||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Lovbrotte Olsen <danio@pvv.ntnu.no>
|
|
||||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Olsen <danio@pvv.ntnu.no>
|
|
||||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> danio <danio@pvv.ntnu.no>
|
|
||||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Olsen <danio@bicep.pvv.ntnu.no>
|
|
||||||
|
|
||||||
|
|
||||||
Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> h7x4 <h7x4@nani.wtf>
|
|
||||||
Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Øystein Tveit <oysteikt@pvv.ntnu.no>
|
|
||||||
Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> oysteikt <oysteikt@pvv.ntnu.no>
|
|
||||||
Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Øystein <oysteikt@pvv.org>
|
|
||||||
Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
|
|
||||||
|
|
||||||
Felix Albrigtsen <felixalb@pvv.ntnu.no> <felix@albrigtsen.it>
|
|
||||||
Felix Albrigtsen <felixalb@pvv.ntnu.no> <felixalbrigtsen@gmail.com>
|
|
||||||
Felix Albrigtsen <felixalb@pvv.ntnu.no> felixalb <felixalb@pvv.ntnu.no>
|
|
||||||
|
|
||||||
Peder Bergebakken Sundt <pederbs@pvv.ntnu.no> <pbsds@hotmail.com>
|
|
||||||
|
|
||||||
Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian G L <adrian@lauterer.it>
|
|
||||||
Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian Gunnar Lauterer <adrian@lauterer.it>
|
|
||||||
|
|
||||||
Fredrik Robertsen <frero@pvv.ntnu.no> frero <frero@pvv.ntnu.no>
|
|
||||||
Fredrik Robertsen <frero@pvv.ntnu.no> fredrikr79 <fredrikrobertsen7@gmail.com>
|
|
||||||
70
.sops.yaml
70
.sops.yaml
@@ -1,31 +1,25 @@
|
|||||||
keys:
|
keys:
|
||||||
# Users
|
# Users
|
||||||
- &user_danio age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
|
- &user_danio age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
|
||||||
- &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
|
|
||||||
- &user_felixalb age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
- &user_felixalb age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
||||||
- &user_oysteikt F7D37890228A907440E1FD4846B9228E814A2AAC
|
- &user_oysteikt F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||||
- &user_pederbs_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
- &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
|
||||||
- &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
|
||||||
- &user_pederbs_sopp age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
- &user_pederbs_sopp age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
||||||
|
- &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
||||||
|
- &user_pederbs_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
||||||
|
|
||||||
# Hosts
|
# Hosts
|
||||||
- &host_bakke age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
|
- &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
|
||||||
- &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
|
|
||||||
- &host_bicep age19nk55kcs7s0358jpkn75xnr57dfq6fq3p43nartvsprx0su22v7qcgcjdx
|
|
||||||
- &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
|
- &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
|
||||||
- &host_kommode age1mt4d0hg5g76qp7j0884llemy0k2ymr5up8vfudz6vzvsflk5nptqqd32ly
|
- &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
|
||||||
- &host_lupine-1 age1fkrypl6fu4ldsa7te4g3v4qsegnk7sd6qhkquuwzh04vguy96qus08902e
|
- &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
|
||||||
- &host_lupine-2 age1mu0ej57n4s30ghealhyju3enls83qyjua69986la35t2yh0q2s0seruz5n
|
|
||||||
- &host_lupine-3 age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
|
|
||||||
- &host_lupine-4 age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
|
|
||||||
- &host_lupine-5 age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
|
|
||||||
- &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
|
|
||||||
|
|
||||||
creation_rules:
|
creation_rules:
|
||||||
# Global secrets
|
# Global secrets
|
||||||
- path_regex: secrets/[^/]+\.yaml$
|
- path_regex: secrets/[^/]+\.yaml$
|
||||||
key_groups:
|
key_groups:
|
||||||
- age:
|
- age:
|
||||||
|
- *host_jokum
|
||||||
- *user_danio
|
- *user_danio
|
||||||
- *user_felixalb
|
- *user_felixalb
|
||||||
- *user_eirikwit
|
- *user_eirikwit
|
||||||
@@ -36,7 +30,7 @@ creation_rules:
|
|||||||
- *user_oysteikt
|
- *user_oysteikt
|
||||||
|
|
||||||
# Host specific secrets
|
# Host specific secrets
|
||||||
|
|
||||||
- path_regex: secrets/bekkalokk/[^/]+\.yaml$
|
- path_regex: secrets/bekkalokk/[^/]+\.yaml$
|
||||||
key_groups:
|
key_groups:
|
||||||
- age:
|
- age:
|
||||||
@@ -49,10 +43,10 @@ creation_rules:
|
|||||||
pgp:
|
pgp:
|
||||||
- *user_oysteikt
|
- *user_oysteikt
|
||||||
|
|
||||||
- path_regex: secrets/kommode/[^/]+\.yaml$
|
- path_regex: secrets/jokum/[^/]+\.yaml$
|
||||||
key_groups:
|
key_groups:
|
||||||
- age:
|
- age:
|
||||||
- *host_kommode
|
- *host_jokum
|
||||||
- *user_danio
|
- *user_danio
|
||||||
- *user_felixalb
|
- *user_felixalb
|
||||||
- *user_pederbs_sopp
|
- *user_pederbs_sopp
|
||||||
@@ -72,7 +66,7 @@ creation_rules:
|
|||||||
- *user_pederbs_bjarte
|
- *user_pederbs_bjarte
|
||||||
pgp:
|
pgp:
|
||||||
- *user_oysteikt
|
- *user_oysteikt
|
||||||
|
|
||||||
- path_regex: secrets/bicep/[^/]+\.yaml$
|
- path_regex: secrets/bicep/[^/]+\.yaml$
|
||||||
key_groups:
|
key_groups:
|
||||||
- age:
|
- age:
|
||||||
@@ -84,43 +78,3 @@ creation_rules:
|
|||||||
- *user_pederbs_bjarte
|
- *user_pederbs_bjarte
|
||||||
pgp:
|
pgp:
|
||||||
- *user_oysteikt
|
- *user_oysteikt
|
||||||
|
|
||||||
- path_regex: secrets/ustetind/[^/]+\.yaml$
|
|
||||||
key_groups:
|
|
||||||
- age:
|
|
||||||
- *host_ustetind
|
|
||||||
- *user_danio
|
|
||||||
- *user_felixalb
|
|
||||||
- *user_pederbs_sopp
|
|
||||||
- *user_pederbs_nord
|
|
||||||
- *user_pederbs_bjarte
|
|
||||||
pgp:
|
|
||||||
- *user_oysteikt
|
|
||||||
|
|
||||||
- path_regex: secrets/lupine/[^/]+\.yaml$
|
|
||||||
key_groups:
|
|
||||||
- age:
|
|
||||||
- *host_lupine-1
|
|
||||||
- *host_lupine-2
|
|
||||||
- *host_lupine-3
|
|
||||||
- *host_lupine-4
|
|
||||||
- *host_lupine-5
|
|
||||||
- *user_danio
|
|
||||||
- *user_felixalb
|
|
||||||
- *user_pederbs_sopp
|
|
||||||
- *user_pederbs_nord
|
|
||||||
- *user_pederbs_bjarte
|
|
||||||
pgp:
|
|
||||||
- *user_oysteikt
|
|
||||||
|
|
||||||
- path_regex: secrets/bakke/[^/]+\.yaml$
|
|
||||||
key_groups:
|
|
||||||
- age:
|
|
||||||
- *host_bakke
|
|
||||||
- *user_danio
|
|
||||||
- *user_felixalb
|
|
||||||
- *user_pederbs_sopp
|
|
||||||
- *user_pederbs_nord
|
|
||||||
- *user_pederbs_bjarte
|
|
||||||
pgp:
|
|
||||||
- *user_oysteikt
|
|
||||||
|
|||||||
57
README.MD
Normal file
57
README.MD
Normal file
@@ -0,0 +1,57 @@
|
|||||||
|
# PVV NixOS configs
|
||||||
|
|
||||||
|
## Hvordan endre på ting
|
||||||
|
|
||||||
|
Før du endrer på ting husk å ikke putte ting som skal være hemmelig uten å først lese seksjonen for hemmeligheter!
|
||||||
|
|
||||||
|
Etter å ha klonet prosjektet ned og gjort endringer kan du evaluere configene med:
|
||||||
|
|
||||||
|
`nix flake check --keep-going`
|
||||||
|
|
||||||
|
før du bygger en maskin med:
|
||||||
|
|
||||||
|
`nix build .#<maskinnavn>`
|
||||||
|
|
||||||
|
hvis du vil være ekstra sikker på at alt bygger så kan du kjøre:
|
||||||
|
|
||||||
|
`nix build .` for å bygge alle de viktige maskinene.
|
||||||
|
|
||||||
|
NB: Dette kan ta opp til 30 minutter avhengig av hva som ligger i caches
|
||||||
|
|
||||||
|
Husk å hvertfall stage nye filer om du har laget dem!
|
||||||
|
|
||||||
|
Om alt bygger fint commit det og push til git repoet.
|
||||||
|
Det er sikkert lurt å lage en PR først om du ikke er vandt til nix enda.
|
||||||
|
|
||||||
|
Innen 24h skal alle systemene hente ned den nye konfigurasjonen og deploye den.
|
||||||
|
|
||||||
|
Du kan tvinge en maskin til å oppdatere seg før dette ved å kjøre:
|
||||||
|
`nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git --upgrade`
|
||||||
|
|
||||||
|
som root på maskinen.
|
||||||
|
|
||||||
|
## Seksjonen for hemmeligheter
|
||||||
|
|
||||||
|
For at hemmeligheter ikke skal deles med hele verden i git - eller å være world
|
||||||
|
readable i nix-storen, bruker vi [sops-nix](https://github.com/Mic92/sops-nix)
|
||||||
|
|
||||||
|
For å legge til secrets kan du kjøre f.eks. `sops secrets/jokum/jokum.yaml`
|
||||||
|
Dette vil dekryptere filen og gi deg en text-editor du kan bruke for endre hemmelighetene.
|
||||||
|
|
||||||
|
Et nix shell med dette verktøyet inkludert ligger i flaket og shell.nix og kan aktiveres med:
|
||||||
|
|
||||||
|
`nix-shell` eller `nix develop`. Vi anbefaler det siste.
|
||||||
|
I tilegg kan du sette opp [direnv](https://direnv.net/) slik at dette skjer automatisk
|
||||||
|
|
||||||
|
for å få tilgang til å lese/skrive hemmeligheter må du spørre noen/noe som har tilgang til hemmelighetene
|
||||||
|
om å legge til age eller pgp nøkkelen din i [`.sops.yaml`](https://git.pvv.ntnu.no/Drift/pvv-nixos-config/src/main/.sops.yaml)
|
||||||
|
|
||||||
|
Denne kan du generere fra ssh-nøkkelene dine eller lage en egen nøkkel.
|
||||||
|
|
||||||
|
### Legge til flere keys
|
||||||
|
|
||||||
|
Gjør det som gir mening i .sops.yml
|
||||||
|
|
||||||
|
Etter det kjør `sops updatekeys secrets/host/file.yml`
|
||||||
|
|
||||||
|
MERK at det ikke er `sops -r` som BARE roterer nøkklene for de som allerede er i secretfila
|
||||||
36
README.md
36
README.md
@@ -1,36 +0,0 @@
|
|||||||
# PVV NixOS config
|
|
||||||
|
|
||||||
This repository contains the NixOS configurations for Programvareverkstedet's server closet.
|
|
||||||
In addition to machine configurations, it also contains a bunch of shared modules, packages, and
|
|
||||||
more.
|
|
||||||
|
|
||||||
## Machines
|
|
||||||
|
|
||||||
| Name | Type | Description |
|
|
||||||
|----------------------------|----------|-----------------------------------------------------------|
|
|
||||||
| [bekkalokk][bek] | Physical | Our main web host, webmail, wiki, idp, minecraft map, ... |
|
|
||||||
| [bicep][bic] | Virtual | Database host, matrix, git mirrors, ... |
|
|
||||||
| bikkje | Virtual | Experimental login box |
|
|
||||||
| [brzeczyszczykiewicz][brz] | Physical | Shared music player |
|
|
||||||
| [georg][geo] | Physical | Shared music player |
|
|
||||||
| [ildkule][ild] | Virtual | Logging and monitoring host, prometheus, grafana, ... |
|
|
||||||
| [kommode][kom] | Virtual | Gitea + Gitea pages |
|
|
||||||
| [lupine][lup] | Physical | Gitea CI/CD runners |
|
|
||||||
| shark | Virtual | Test host for authentication, absolutely horrendous |
|
|
||||||
| [wenche][wen] | Virtual | Nix-builders, general purpose compute |
|
|
||||||
|
|
||||||
## Documentation
|
|
||||||
|
|
||||||
- [Development - working on the PVV machines](./docs/development.md)
|
|
||||||
- [Miscellaneous development notes](./docs/development-misc.md)
|
|
||||||
- [User management](./docs/users.md)
|
|
||||||
- [Secret management and `sops-nix`](./docs/secret-management.md)
|
|
||||||
|
|
||||||
[bek]: https://wiki.pvv.ntnu.no/wiki/Maskiner/bekkalokk
|
|
||||||
[bic]: https://wiki.pvv.ntnu.no/wiki/Maskiner/bicep
|
|
||||||
[brz]: https://wiki.pvv.ntnu.no/wiki/Maskiner/brzęczyszczykiewicz
|
|
||||||
[geo]: https://wiki.pvv.ntnu.no/wiki/Maskiner/georg
|
|
||||||
[ild]: https://wiki.pvv.ntnu.no/wiki/Maskiner/ildkule
|
|
||||||
[kom]: https://wiki.pvv.ntnu.no/wiki/Maskiner/kommode
|
|
||||||
[lup]: https://wiki.pvv.ntnu.no/wiki/Maskiner/lupine
|
|
||||||
[wen]: https://wiki.pvv.ntnu.no/wiki/Maskiner/wenche
|
|
||||||
133
base.nix
Normal file
133
base.nix
Normal file
@@ -0,0 +1,133 @@
|
|||||||
|
{ config, lib, pkgs, inputs, values, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./users
|
||||||
|
./modules/snakeoil-certs.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
networking.domain = "pvv.ntnu.no";
|
||||||
|
networking.useDHCP = false;
|
||||||
|
# networking.search = [ "pvv.ntnu.no" "pvv.org" ];
|
||||||
|
# networking.nameservers = lib.mkDefault [ "129.241.0.200" "129.241.0.201" ];
|
||||||
|
# networking.tempAddresses = lib.mkDefault "disabled";
|
||||||
|
# networking.defaultGateway = values.hosts.gateway;
|
||||||
|
|
||||||
|
systemd.network.enable = true;
|
||||||
|
|
||||||
|
services.resolved = {
|
||||||
|
enable = lib.mkDefault true;
|
||||||
|
dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
|
||||||
|
};
|
||||||
|
|
||||||
|
time.timeZone = "Europe/Oslo";
|
||||||
|
|
||||||
|
i18n.defaultLocale = "en_US.UTF-8";
|
||||||
|
console = {
|
||||||
|
font = "Lat2-Terminus16";
|
||||||
|
keyMap = "no";
|
||||||
|
};
|
||||||
|
|
||||||
|
system.autoUpgrade = {
|
||||||
|
enable = true;
|
||||||
|
flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
|
||||||
|
flags = [
|
||||||
|
"--update-input" "nixpkgs"
|
||||||
|
"--update-input" "nixpkgs-unstable"
|
||||||
|
"--no-write-lock-file"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
nix.gc.automatic = true;
|
||||||
|
nix.gc.options = "--delete-older-than 2d";
|
||||||
|
|
||||||
|
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||||
|
|
||||||
|
/* This makes commandline tools like
|
||||||
|
** nix run nixpkgs#hello
|
||||||
|
** and nix-shell -p hello
|
||||||
|
** use the same channel the system
|
||||||
|
** was built with
|
||||||
|
*/
|
||||||
|
nix.registry = {
|
||||||
|
nixpkgs.flake = inputs.nixpkgs;
|
||||||
|
};
|
||||||
|
nix.nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
|
||||||
|
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
file
|
||||||
|
git
|
||||||
|
gnupg
|
||||||
|
htop
|
||||||
|
nano
|
||||||
|
ripgrep
|
||||||
|
rsync
|
||||||
|
screen
|
||||||
|
tmux
|
||||||
|
vim
|
||||||
|
wget
|
||||||
|
|
||||||
|
kitty.terminfo
|
||||||
|
];
|
||||||
|
|
||||||
|
programs.zsh.enable = true;
|
||||||
|
|
||||||
|
users.groups."drift".name = "drift";
|
||||||
|
|
||||||
|
# Trusted users on the nix builder machines
|
||||||
|
users.groups."nix-builder-users".name = "nix-builder-users";
|
||||||
|
|
||||||
|
services.openssh = {
|
||||||
|
enable = true;
|
||||||
|
extraConfig = ''
|
||||||
|
PubkeyAcceptedAlgorithms=+ssh-rsa
|
||||||
|
'';
|
||||||
|
settings.PermitRootLogin = "yes";
|
||||||
|
};
|
||||||
|
|
||||||
|
# nginx return 444 for all nonexistent virtualhosts
|
||||||
|
|
||||||
|
systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
|
||||||
|
|
||||||
|
environment.snakeoil-certs = lib.mkIf config.services.nginx.enable {
|
||||||
|
"/etc/certs/nginx" = {
|
||||||
|
owner = "nginx";
|
||||||
|
group = "nginx";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx = {
|
||||||
|
recommendedTlsSettings = true;
|
||||||
|
recommendedProxySettings = true;
|
||||||
|
recommendedOptimisation = true;
|
||||||
|
recommendedGzipSettings = true;
|
||||||
|
|
||||||
|
appendConfig = ''
|
||||||
|
pcre_jit on;
|
||||||
|
worker_processes auto;
|
||||||
|
worker_rlimit_nofile 100000;
|
||||||
|
'';
|
||||||
|
eventsConfig = ''
|
||||||
|
worker_connections 2048;
|
||||||
|
use epoll;
|
||||||
|
multi_accept on;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.nginx.serviceConfig = lib.mkIf config.services.nginx.enable {
|
||||||
|
LimitNOFILE = 65536;
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
|
||||||
|
sslCertificate = "/etc/certs/nginx.crt";
|
||||||
|
sslCertificateKey = "/etc/certs/nginx.key";
|
||||||
|
addSSL = true;
|
||||||
|
extraConfig = "return 444;";
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
|
||||||
|
|
||||||
|
security.acme = {
|
||||||
|
acceptTerms = true;
|
||||||
|
defaults.email = "drift@pvv.ntnu.no";
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -1,89 +0,0 @@
|
|||||||
{
|
|
||||||
pkgs,
|
|
||||||
lib,
|
|
||||||
fp,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
(fp /users)
|
|
||||||
(fp /modules/snakeoil-certs.nix)
|
|
||||||
|
|
||||||
./networking.nix
|
|
||||||
./nix.nix
|
|
||||||
./vm.nix
|
|
||||||
./flake-input-exporter.nix
|
|
||||||
|
|
||||||
./services/acme.nix
|
|
||||||
./services/uptimed.nix
|
|
||||||
./services/auto-upgrade.nix
|
|
||||||
./services/dbus.nix
|
|
||||||
./services/fwupd.nix
|
|
||||||
./services/irqbalance.nix
|
|
||||||
./services/logrotate.nix
|
|
||||||
./services/nginx.nix
|
|
||||||
./services/openssh.nix
|
|
||||||
./services/postfix.nix
|
|
||||||
./services/prometheus-node-exporter.nix
|
|
||||||
./services/prometheus-systemd-exporter.nix
|
|
||||||
./services/promtail.nix
|
|
||||||
./services/smartd.nix
|
|
||||||
./services/thermald.nix
|
|
||||||
./services/userborn.nix
|
|
||||||
./services/userdbd.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.tmp.cleanOnBoot = lib.mkDefault true;
|
|
||||||
boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
|
|
||||||
|
|
||||||
time.timeZone = "Europe/Oslo";
|
|
||||||
|
|
||||||
i18n.defaultLocale = "en_US.UTF-8";
|
|
||||||
console = {
|
|
||||||
font = "Lat2-Terminus16";
|
|
||||||
keyMap = "no";
|
|
||||||
};
|
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [
|
|
||||||
file
|
|
||||||
git
|
|
||||||
gnupg
|
|
||||||
htop
|
|
||||||
nano
|
|
||||||
ripgrep
|
|
||||||
rsync
|
|
||||||
screen
|
|
||||||
tmux
|
|
||||||
vim
|
|
||||||
wget
|
|
||||||
|
|
||||||
kitty.terminfo
|
|
||||||
];
|
|
||||||
|
|
||||||
# .bash_profile already works, but lets also use .bashrc like literally every other distro
|
|
||||||
# https://man.archlinux.org/man/core/bash/bash.1.en#INVOCATION
|
|
||||||
# home-manager usually handles this for you: https://github.com/nix-community/home-manager/blob/22a36aa709de7dd42b562a433b9cefecf104a6ee/modules/programs/bash.nix#L203-L209
|
|
||||||
# btw, programs.bash.shellInit just goes into environment.shellInit which in turn goes into /etc/profile, spooky shit
|
|
||||||
programs.bash.shellInit = ''
|
|
||||||
if [ -n "''${BASH_VERSION:-}" ]; then
|
|
||||||
if [[ ! -f ~/.bash_profile && ! -f ~/.bash_login ]]; then
|
|
||||||
[[ -f ~/.bashrc ]] && . ~/.bashrc
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
'';
|
|
||||||
|
|
||||||
programs.zsh.enable = true;
|
|
||||||
|
|
||||||
# security.lockKernelModules = true;
|
|
||||||
security.protectKernelImage = true;
|
|
||||||
security.sudo.execWheelOnly = true;
|
|
||||||
security.sudo.extraConfig = ''
|
|
||||||
Defaults lecture = never
|
|
||||||
'';
|
|
||||||
|
|
||||||
users.groups."drift".name = "drift";
|
|
||||||
|
|
||||||
# Trusted users on the nix builder machines
|
|
||||||
users.groups."nix-builder-users".name = "nix-builder-users";
|
|
||||||
}
|
|
||||||
@@ -1,55 +0,0 @@
|
|||||||
{
|
|
||||||
config,
|
|
||||||
inputs,
|
|
||||||
lib,
|
|
||||||
pkgs,
|
|
||||||
values,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
let
|
|
||||||
data = lib.flip lib.mapAttrs inputs (
|
|
||||||
name: input: {
|
|
||||||
inherit (input)
|
|
||||||
lastModified
|
|
||||||
;
|
|
||||||
}
|
|
||||||
);
|
|
||||||
folder = pkgs.writeTextDir "share/flake-inputs" (
|
|
||||||
lib.concatMapStringsSep "\n" (
|
|
||||||
{ name, value }: ''nixos_last_modified_input{flake="${name}"} ${toString value.lastModified}''
|
|
||||||
) (lib.attrsToList data)
|
|
||||||
);
|
|
||||||
port = 9102;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
services.nginx.virtualHosts."${config.networking.fqdn}-nixos-metrics" = {
|
|
||||||
serverName = config.networking.fqdn;
|
|
||||||
serverAliases = [
|
|
||||||
"${config.networking.hostName}.pvv.org"
|
|
||||||
];
|
|
||||||
locations."/metrics" = {
|
|
||||||
root = "${folder}/share";
|
|
||||||
tryFiles = "/flake-inputs =404";
|
|
||||||
extraConfig = ''
|
|
||||||
default_type text/plain;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
listen = [
|
|
||||||
{
|
|
||||||
inherit port;
|
|
||||||
addr = "0.0.0.0";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
extraConfig = ''
|
|
||||||
allow ${values.hosts.ildkule.ipv4}/32;
|
|
||||||
allow ${values.hosts.ildkule.ipv6}/128;
|
|
||||||
allow 127.0.0.1/32;
|
|
||||||
allow ::1/128;
|
|
||||||
allow ${values.ipv4-space};
|
|
||||||
allow ${values.ipv6-space};
|
|
||||||
deny all;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ port ];
|
|
||||||
}
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
{ lib, values, ... }:
|
|
||||||
{
|
|
||||||
systemd.network.enable = true;
|
|
||||||
networking.domain = "pvv.ntnu.no";
|
|
||||||
networking.useDHCP = false;
|
|
||||||
|
|
||||||
# The rest of the networking configuration is usually sourced from /values.nix
|
|
||||||
|
|
||||||
services.resolved = {
|
|
||||||
enable = lib.mkDefault true;
|
|
||||||
dnssec = "false"; # Supposdly this keeps breaking and the default is to allow downgrades anyways...
|
|
||||||
};
|
|
||||||
}
|
|
||||||
40
base/nix.nix
40
base/nix.nix
@@ -1,40 +0,0 @@
|
|||||||
{ lib, config, inputs, ... }:
|
|
||||||
{
|
|
||||||
nix = {
|
|
||||||
gc = {
|
|
||||||
automatic = true;
|
|
||||||
options = "--delete-older-than 2d";
|
|
||||||
};
|
|
||||||
optimise.automatic = true;
|
|
||||||
|
|
||||||
settings = {
|
|
||||||
allow-dirty = true;
|
|
||||||
auto-allocate-uids = true;
|
|
||||||
builders-use-substitutes = true;
|
|
||||||
experimental-features = [ "nix-command" "flakes" "auto-allocate-uids" ];
|
|
||||||
log-lines = 50;
|
|
||||||
use-xdg-base-directories = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
/* This makes commandline tools like
|
|
||||||
** nix run nixpkgs#hello
|
|
||||||
** and nix-shell -p hello
|
|
||||||
** use the same channel the system
|
|
||||||
** was built with
|
|
||||||
*/
|
|
||||||
registry = lib.mkMerge [
|
|
||||||
{
|
|
||||||
"nixpkgs".flake = inputs.nixpkgs;
|
|
||||||
"nixpkgs-unstable".flake = inputs.nixpkgs-unstable;
|
|
||||||
}
|
|
||||||
# We avoid the reference to self in vmVariant to get a stable system .outPath for equivalence testing
|
|
||||||
(lib.mkIf (!config.virtualisation.isVmVariant) {
|
|
||||||
"pvv-nix".flake = inputs.self;
|
|
||||||
})
|
|
||||||
];
|
|
||||||
nixPath = [
|
|
||||||
"nixpkgs=${inputs.nixpkgs}"
|
|
||||||
"unstable=${inputs.nixpkgs-unstable}"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
{ ... }:
|
|
||||||
{
|
|
||||||
security.acme = {
|
|
||||||
acceptTerms = true;
|
|
||||||
defaults.email = "drift@pvv.ntnu.no";
|
|
||||||
};
|
|
||||||
|
|
||||||
# Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
|
|
||||||
virtualisation.vmVariant = {
|
|
||||||
security.acme.defaults.server = "https://127.0.0.1";
|
|
||||||
security.acme.preliminarySelfsigned = true;
|
|
||||||
|
|
||||||
users.users.root.initialPassword = "root";
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,39 +0,0 @@
|
|||||||
{ config, inputs, pkgs, lib, ... }:
|
|
||||||
|
|
||||||
let
|
|
||||||
inputUrls = lib.mapAttrs (input: value: value.url) (import "${inputs.self}/flake.nix").inputs;
|
|
||||||
in
|
|
||||||
|
|
||||||
{
|
|
||||||
system.autoUpgrade = {
|
|
||||||
enable = true;
|
|
||||||
flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
|
|
||||||
flags = [
|
|
||||||
"--refresh"
|
|
||||||
"--no-write-lock-file"
|
|
||||||
# --update-input is deprecated since nix 2.22, and removed in lix 2.90
|
|
||||||
# as such we instead use --override-input combined with --refresh
|
|
||||||
# https://git.lix.systems/lix-project/lix/issues/400
|
|
||||||
] ++ (lib.pipe inputUrls [
|
|
||||||
(lib.intersectAttrs {
|
|
||||||
nixpkgs = { };
|
|
||||||
nixpkgs-unstable = { };
|
|
||||||
})
|
|
||||||
(lib.mapAttrsToList (input: url: ["--override-input" input url]))
|
|
||||||
lib.concatLists
|
|
||||||
]);
|
|
||||||
};
|
|
||||||
|
|
||||||
# workaround for https://github.com/NixOS/nix/issues/6895
|
|
||||||
# via https://git.lix.systems/lix-project/lix/issues/400
|
|
||||||
environment.etc = lib.mkIf (!config.virtualisation.isVmVariant) {
|
|
||||||
"current-system-flake-inputs.json".source
|
|
||||||
= pkgs.writers.writeJSON "flake-inputs.json" (
|
|
||||||
lib.flip lib.mapAttrs inputs (name: input:
|
|
||||||
# inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
|
|
||||||
lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
|
|
||||||
// { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
|
|
||||||
)
|
|
||||||
);
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
{ ... }:
|
|
||||||
{
|
|
||||||
services.dbus = {
|
|
||||||
enable = true;
|
|
||||||
implementation = "broker";
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
{ ... }:
|
|
||||||
{
|
|
||||||
services.fwupd.enable = true;
|
|
||||||
}
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
{ ... }:
|
|
||||||
{
|
|
||||||
services.irqbalance.enable = true;
|
|
||||||
}
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
{ ... }:
|
|
||||||
{
|
|
||||||
systemd.services.logrotate = {
|
|
||||||
documentation = [ "man:logrotate(8)" "man:logrotate.conf(5)" ];
|
|
||||||
unitConfig.RequiresMountsFor = "/var/log";
|
|
||||||
serviceConfig.ReadWritePaths = [ "/var/log" ];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,67 +0,0 @@
|
|||||||
{ config, lib, ... }:
|
|
||||||
{
|
|
||||||
# nginx return 444 for all nonexistent virtualhosts
|
|
||||||
|
|
||||||
systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
|
|
||||||
|
|
||||||
environment.snakeoil-certs = lib.mkIf config.services.nginx.enable {
|
|
||||||
"/etc/certs/nginx" = {
|
|
||||||
owner = "nginx";
|
|
||||||
group = "nginx";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
|
|
||||||
|
|
||||||
services.nginx = {
|
|
||||||
recommendedTlsSettings = true;
|
|
||||||
recommendedProxySettings = true;
|
|
||||||
recommendedOptimisation = true;
|
|
||||||
recommendedGzipSettings = true;
|
|
||||||
|
|
||||||
appendConfig = ''
|
|
||||||
# pcre_jit on;
|
|
||||||
worker_processes auto;
|
|
||||||
worker_rlimit_nofile 100000;
|
|
||||||
'';
|
|
||||||
eventsConfig = ''
|
|
||||||
worker_connections 2048;
|
|
||||||
use epoll;
|
|
||||||
# multi_accept on;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.nginx.serviceConfig = lib.mkIf config.services.nginx.enable {
|
|
||||||
LimitNOFILE = 65536;
|
|
||||||
# We use jit my dudes
|
|
||||||
MemoryDenyWriteExecute = lib.mkForce false;
|
|
||||||
# What the fuck do we use that where the defaults are not enough???
|
|
||||||
SystemCallFilter = lib.mkForce null;
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
|
|
||||||
listen = [
|
|
||||||
{
|
|
||||||
addr = "0.0.0.0";
|
|
||||||
extraParameters = [
|
|
||||||
"default_server"
|
|
||||||
# Seemingly the default value of net.core.somaxconn
|
|
||||||
"backlog=4096"
|
|
||||||
"deferred"
|
|
||||||
];
|
|
||||||
}
|
|
||||||
{
|
|
||||||
addr = "[::0]";
|
|
||||||
extraParameters = [
|
|
||||||
"default_server"
|
|
||||||
"backlog=4096"
|
|
||||||
"deferred"
|
|
||||||
];
|
|
||||||
}
|
|
||||||
];
|
|
||||||
sslCertificate = "/etc/certs/nginx.crt";
|
|
||||||
sslCertificateKey = "/etc/certs/nginx.key";
|
|
||||||
addSSL = true;
|
|
||||||
extraConfig = "return 444;";
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
{ ... }:
|
|
||||||
{
|
|
||||||
services.openssh = {
|
|
||||||
enable = true;
|
|
||||||
startWhenNeeded = true;
|
|
||||||
extraConfig = ''
|
|
||||||
PubkeyAcceptedAlgorithms=+ssh-rsa
|
|
||||||
Match Group wheel
|
|
||||||
PasswordAuthentication no
|
|
||||||
Match All
|
|
||||||
'';
|
|
||||||
settings.PermitRootLogin = "yes";
|
|
||||||
|
|
||||||
};
|
|
||||||
users.users."root".openssh.authorizedKeys.keys = [
|
|
||||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqVt4LCe0YIttr9swFxjkjn37ZDY9JxwVC+2gvfSINDJorOCtqPjDOTD2fTS1Gz08QCwpnLWq2kyvRchu6WgriAbSACpbZZBgxRaF/FVh3oiMVFGnNKGnv6/fdo/vZtu8mUVuqtmTrgLYpZdbR4oD3XiBlDKs7Cv5hPqt95lnP6MNFvE8mICCfd1PwhsABd2IQ5laz3u77/RXhNFJL0Kf2/+6gk9awcLuwHrPdvq7c3BxRHbc9UMRQENyjyQPa7aLe+uJBFLKP51I8VBuDpDacuibQx7nMt6N2UJ2KWI0JxRMHuJNq4S5jidR82aOw9gzGbTv30SKNLMqsZ0xj4LtdqCXDiZF6Lr09PsJYsvnBUFWa14HGcThKDtgwQwBryNViYmfv//0h9+RLZiU0ab+NEwSs7Zh5iAD+vhx64QqNX3tR7Le4SWXh8W0eShU9N78qYdSkiC3Ui7htxeqOocXM/P4AwbnHsLELIvkHdvgchCPvl8ygZa4WJTEWv16+ICskJcAKWGuqjvXAFuwjJJmPp9xLW9O0DFfQhMELiGamQR9wK07yYQVr34iah6qZO7cwhSKyEPFrVPIaNtfDhsjED639F7vmktf26SWNJHWfW0wOHILjI6TgqUvy0JDd8W8w0CHlAfz6Fs2l99NNgNF8dB3vBASbxS0hu/y0PVu/xQ== openstack-sleipner"
|
|
||||||
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCbgJ0Uwh9VSVhfId7l9i5/jk4CvAK5rbkiab8R+moF root@sleipner"
|
|
||||||
];
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
{ config, pkgs, lib, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.postfix;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
services.postfix = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
settings.main = {
|
|
||||||
myhostname = "${config.networking.hostName}.pvv.ntnu.no";
|
|
||||||
mydomain = "pvv.ntnu.no";
|
|
||||||
|
|
||||||
# Nothing should be delivered to this machine
|
|
||||||
mydestination = [ ];
|
|
||||||
|
|
||||||
relayhost = [ "smtp.pvv.ntnu.no:465" ];
|
|
||||||
|
|
||||||
smtp_tls_wrappermode = "yes";
|
|
||||||
smtp_tls_security_level = "encrypt";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
{ config, lib, values, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.prometheus.exporters.node;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
services.prometheus.exporters.node = {
|
|
||||||
enable = lib.mkDefault true;
|
|
||||||
port = 9100;
|
|
||||||
enabledCollectors = [ "systemd" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.prometheus-node-exporter.serviceConfig = lib.mkIf cfg.enable {
|
|
||||||
IPAddressDeny = "any";
|
|
||||||
IPAddressAllow = [
|
|
||||||
"127.0.0.1"
|
|
||||||
"::1"
|
|
||||||
values.hosts.ildkule.ipv4
|
|
||||||
values.hosts.ildkule.ipv6
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
|
|
||||||
}
|
|
||||||
@@ -1,26 +0,0 @@
|
|||||||
{ config, lib, values, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.prometheus.exporters.systemd;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
services.prometheus.exporters.systemd = {
|
|
||||||
enable = lib.mkDefault true;
|
|
||||||
port = 9101;
|
|
||||||
extraFlags = [
|
|
||||||
"--systemd.collector.enable-restart-count"
|
|
||||||
"--systemd.collector.enable-ip-accounting"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.prometheus-systemd-exporter.serviceConfig = {
|
|
||||||
IPAddressDeny = "any";
|
|
||||||
IPAddressAllow = [
|
|
||||||
"127.0.0.1"
|
|
||||||
"::1"
|
|
||||||
values.hosts.ildkule.ipv4
|
|
||||||
values.hosts.ildkule.ipv6
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
|
|
||||||
}
|
|
||||||
@@ -1,38 +0,0 @@
|
|||||||
{ config, lib, values, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.prometheus.exporters.node;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
services.promtail = {
|
|
||||||
enable = lib.mkDefault true;
|
|
||||||
configuration = {
|
|
||||||
server = {
|
|
||||||
http_listen_port = 28183;
|
|
||||||
grpc_listen_port = 0;
|
|
||||||
};
|
|
||||||
clients = [{
|
|
||||||
url = "http://ildkule.pvv.ntnu.no:3100/loki/api/v1/push";
|
|
||||||
}];
|
|
||||||
scrape_configs = [{
|
|
||||||
job_name = "systemd-journal";
|
|
||||||
journal = {
|
|
||||||
max_age = "12h";
|
|
||||||
labels = {
|
|
||||||
job = "systemd-journal";
|
|
||||||
host = config.networking.hostName;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
relabel_configs = [
|
|
||||||
{
|
|
||||||
source_labels = [ "__journal__systemd_unit" ];
|
|
||||||
target_label = "unit";
|
|
||||||
}
|
|
||||||
{
|
|
||||||
source_labels = [ "__journal_priority_keyword" ];
|
|
||||||
target_label = "level";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
}];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,20 +0,0 @@
|
|||||||
{ config, pkgs, lib, ... }:
|
|
||||||
{
|
|
||||||
services.smartd = {
|
|
||||||
enable = lib.mkDefault true;
|
|
||||||
notifications = {
|
|
||||||
mail = {
|
|
||||||
enable = true;
|
|
||||||
sender = "root@pvv.ntnu.no";
|
|
||||||
recipient = "root@pvv.ntnu.no";
|
|
||||||
};
|
|
||||||
wall.enable = false;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
environment.systemPackages = lib.optionals config.services.smartd.enable (with pkgs; [
|
|
||||||
smartmontools
|
|
||||||
]);
|
|
||||||
|
|
||||||
systemd.services.smartd.unitConfig.ConditionVirtualization = "no";
|
|
||||||
}
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
{ config, lib, ... }:
|
|
||||||
{
|
|
||||||
# Let's not thermal throttle
|
|
||||||
services.thermald.enable = lib.mkIf (lib.all (x: x) [
|
|
||||||
(config.nixpkgs.system == "x86_64-linux")
|
|
||||||
(!config.boot.isContainer or false)
|
|
||||||
]) true;
|
|
||||||
}
|
|
||||||
@@ -1,59 +0,0 @@
|
|||||||
{ config, pkgs, lib, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.uptimed;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
options.services.uptimed.settings = lib.mkOption {
|
|
||||||
description = "";
|
|
||||||
default = { };
|
|
||||||
type = lib.types.submodule {
|
|
||||||
freeformType = with lib.types; attrsOf (either str (listOf str));
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
config = {
|
|
||||||
services.uptimed = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
settings = let
|
|
||||||
stateDir = "/var/lib/uptimed";
|
|
||||||
in {
|
|
||||||
PIDFILE = "${stateDir}/pid";
|
|
||||||
SENDMAIL = lib.mkDefault "${pkgs.system-sendmail}/bin/sendmail -t";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.uptimed = lib.mkIf (cfg.enable) {
|
|
||||||
serviceConfig = let
|
|
||||||
uptimed = pkgs.uptimed.overrideAttrs (prev: {
|
|
||||||
postPatch = ''
|
|
||||||
substituteInPlace Makefile.am \
|
|
||||||
--replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
|
|
||||||
substituteInPlace src/Makefile.am \
|
|
||||||
--replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
|
|
||||||
'';
|
|
||||||
});
|
|
||||||
|
|
||||||
in {
|
|
||||||
Type = "notify";
|
|
||||||
|
|
||||||
ExecStart = lib.mkForce "${uptimed}/sbin/uptimed -f";
|
|
||||||
|
|
||||||
BindReadOnlyPaths = let
|
|
||||||
configFile = lib.pipe cfg.settings [
|
|
||||||
(lib.mapAttrsToList
|
|
||||||
(k: v:
|
|
||||||
if builtins.isList v
|
|
||||||
then lib.mapConcatStringsSep "\n" (v': "${k}=${v'}") v
|
|
||||||
else "${k}=${v}")
|
|
||||||
)
|
|
||||||
(lib.concatStringsSep "\n")
|
|
||||||
(pkgs.writeText "uptimed.conf")
|
|
||||||
];
|
|
||||||
in [
|
|
||||||
"${configFile}:/var/lib/uptimed/uptimed.conf"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
{ ... }:
|
|
||||||
{
|
|
||||||
services.userborn.enable = true;
|
|
||||||
}
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
{ ... }:
|
|
||||||
{
|
|
||||||
services.userdbd.enable = true;
|
|
||||||
}
|
|
||||||
15
base/vm.nix
15
base/vm.nix
@@ -1,15 +0,0 @@
|
|||||||
{ lib, ... }:
|
|
||||||
|
|
||||||
# This enables
|
|
||||||
# lib.mkIf (!config.virtualisation.isVmVariant) { ... }
|
|
||||||
|
|
||||||
{
|
|
||||||
options.virtualisation.isVmVariant = lib.mkOption {
|
|
||||||
description = "`true` if system is build with 'nixos-rebuild build-vm'";
|
|
||||||
type = lib.types.bool;
|
|
||||||
default = false;
|
|
||||||
};
|
|
||||||
config.virtualisation.vmVariant = {
|
|
||||||
virtualisation.isVmVariant = true;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,103 +0,0 @@
|
|||||||
# Miscellaneous development notes
|
|
||||||
|
|
||||||
This document contains a bunch of information that is not particularly specific to the pvv nixos config,
|
|
||||||
but concerns technologies we use often or gotchas to be aware of when working with NixOS. A lot of the information
|
|
||||||
here is already public information spread around the internet, but we've collected some of the items we use often
|
|
||||||
here.
|
|
||||||
|
|
||||||
## The firewall
|
|
||||||
|
|
||||||
`networking.firewall` is a NixOS module that configures `iptables` rules on the machine. It is enabled by default on
|
|
||||||
all of our machines, and it can be easy to forget about it when setting up new services, especially when we are the
|
|
||||||
ones creating the NixOS module.
|
|
||||||
|
|
||||||
When setting up a new service that listens on a TCP or UDP port, make sure to add the appropriate ports to either
|
|
||||||
`networking.firewall.allowedTCPPorts` or `networking.firewall.allowedUDPPorts`.
|
|
||||||
|
|
||||||
You can list out the current firewall rules by running `sudo iptables -L -n -v` on the machine.
|
|
||||||
|
|
||||||
## Finding stuff
|
|
||||||
|
|
||||||
Finding stuff, both underlying implementation and usage is absolutely crucial when working on nix.
|
|
||||||
Oftentimes, the documentation will be outdated, lacking or just plain out wrong. These are some of
|
|
||||||
the techniques we have found to be quite good when working with nix.
|
|
||||||
|
|
||||||
### [ripgrep](https://github.com/BurntSushi/ripgrep)
|
|
||||||
|
|
||||||
ripgrep (or `rg` for short) is a tool that lets you recursively grep for regex patters in a directory.
|
|
||||||
|
|
||||||
It is great for finding references to configuration, and where and how certain things are used. It is
|
|
||||||
especially great when working with [nixpkgs](https://github.com/NixOS/nixpkgs), which is quite large.
|
|
||||||
|
|
||||||
### GitHub Search
|
|
||||||
|
|
||||||
When trying to set up a new service or reconfigure something, it is very common that someone has done it
|
|
||||||
before you, but it has never been documented anywhere. A lot of Nix code exists on GitHub, and you can
|
|
||||||
easily query it by using the `lang:nix` filter in the search bar.
|
|
||||||
|
|
||||||
For example: https://github.com/search?q=lang%3Anix+dibbler&type=code
|
|
||||||
|
|
||||||
## rsync
|
|
||||||
|
|
||||||
`rsync` is a tool for synchronizing files between machines. It is very useful when transferring large
|
|
||||||
amounts of data from a to b. We use it for multiple things, often when data is produced or stored on
|
|
||||||
one machine, and we want to process or convert it on another. For example, we use it to transfer gitea
|
|
||||||
artifacts, to transfer gallery pictures, to transfer minecraft world data for map rendering, and more.
|
|
||||||
|
|
||||||
Along with `rsync`, we often use a lesser known tool called `rrsync`, which you can use inside an ssh
|
|
||||||
configuration (`authorized_keys` file) to restrict what paths a user can access when connecting over ssh.
|
|
||||||
This is useful both as a security measure, but also to avoid accidental overwrites of files outside the intended
|
|
||||||
path. `rrsync` will use chroot to restrict what paths the user can access, as well as refuse to run arbitrary commands.
|
|
||||||
|
|
||||||
## `nix repl`
|
|
||||||
|
|
||||||
`nix repl` is an interactive REPL for the Nix language. It is very useful for experimenting with Nix code,
|
|
||||||
and testing out small snippets of code to make sure it behaves as expected. You can also use it to explore
|
|
||||||
NixOS machine configurations, to interactively see that the configuration evaluates to what you expect.
|
|
||||||
|
|
||||||
```
|
|
||||||
# While in the pvv-nixos-config directory
|
|
||||||
nix repl .
|
|
||||||
|
|
||||||
# Upon writing out the config path and clickin [Tab], you will get autocompletion suggestions:
|
|
||||||
nix-repl> nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts._
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.bekkalokk.pvv.ntnu.no-nixos-metrics
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.idp.pvv.ntnu.no
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.minecraft.pvv.ntnu.no
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.pvv.ntnu.no
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.pvv.org
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.pw.pvv.ntnu.no
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.roundcubeplaceholder.example.com
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.snappymail.pvv.ntnu.no
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.webmail.pvv.ntnu.no
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.wiki.pvv.ntnu.no
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.www.pvv.ntnu.no
|
|
||||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.www.pvv.org
|
|
||||||
```
|
|
||||||
|
|
||||||
## `nix why-depends`
|
|
||||||
|
|
||||||
If you ever wonder why a certain package is being used as a dependency of another package,
|
|
||||||
or another machine, you can use `nix why-depends` to find the dependency path from one package to another.
|
|
||||||
This is often useful after updating nixpkgs and finding an error saying that a certain package is insecure,
|
|
||||||
broken or whatnot. You can do something like the following
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Why does bekkalokk depend on openssl?
|
|
||||||
nix why-depends .#nixosConfigurations.bekkalokk.config.system.build.toplevel .#nixosConfigurations.bekkalokk.pkgs.openssl
|
|
||||||
|
|
||||||
# Why does bekkalokk's minecraft-server depend on zlib? (this is not real)
|
|
||||||
nix why-depends .#nixosConfigurations.bekkalokk.pkgs.minecraft-server .#nixosConfigurations.bekkalokk.pkgs.zlib
|
|
||||||
```
|
|
||||||
|
|
||||||
## php-fpm
|
|
||||||
|
|
||||||
php-fpm (FastCGI Process Manager) is a PHP implementation that is designed for speed and production use. We host a bunch
|
|
||||||
of different PHP applications (including our own website), and so we use php-fpm quite a bit. php-fpm typically exposes a
|
|
||||||
unix socket that nginx will connect to, and php-fpm will then render php upon web requests forwarded from nginx and return
|
|
||||||
it.
|
|
||||||
|
|
||||||
php-fpm has a tendency to be a bit hard to debug. It is not always very willing to spit out error messages and logs, and so
|
|
||||||
it can be a bit hard to figure out what's up when something goes wrong. You should see some of the commented stuff laying around
|
|
||||||
in the website code on bekkalokk for examples of how to configure php-fpm for better logging and error reporting.
|
|
||||||
@@ -1,190 +0,0 @@
|
|||||||
# Development - working on the PVV machines
|
|
||||||
|
|
||||||
This document outlines the process of editing our NixOS configurations, and testing and deploying said changes
|
|
||||||
to the machines. Most of the information written here is specific to the PVV NixOS configuration, and the topics
|
|
||||||
will not really cover the nix code itself in detail. You can find some more resources for that by either following
|
|
||||||
the links from the *Upstream documentation* section below, or in [Miscellaneous development notes](./development-misc.md).
|
|
||||||
|
|
||||||
## Editing nix files
|
|
||||||
|
|
||||||
> [!WARN]
|
|
||||||
> Before editing any nix files, make sure to read [Secret management and `sops-nix`](./secret-management.md)!
|
|
||||||
> We do not want to add any secrets in plaintext to the nix files, and certainly not commit and publish
|
|
||||||
> them into the common public.
|
|
||||||
|
|
||||||
The files are plaintext code, written in the [`Nix` language](https://nix.dev/manual/nix/stable/language/).
|
|
||||||
|
|
||||||
Below is a list of important files and directories, and a description of what they contain.
|
|
||||||
|
|
||||||
### `flake.nix`
|
|
||||||
|
|
||||||
The `flake.nix` file is a [nix flake](https://wiki.nixos.org/wiki/Flakes) and makes up the entrypoint of the
|
|
||||||
entire configuration. It declares what inputs are used (similar to dependencies), as well as what outputs the
|
|
||||||
flake exposes. In our case, the most important outputs are the `nixosConfigurations` (our machine configs), but
|
|
||||||
we also expose custom modules, packages, devshells, and more. You can run `nix flake show` to get an overview of
|
|
||||||
the outputs (however you will need to [enable the `nix-flakes` experimental option](https://wiki.nixos.org/wiki/Flakes#Setup)).
|
|
||||||
|
|
||||||
You will find that a lot of the flake inputs are the different PVV projects that we develop, imported to be hosted
|
|
||||||
on the NixOS machines. This makes it easy to deploy changes to these projects, as we can just update the flake input
|
|
||||||
to point to a new commit or version, and then rebuild the machines.
|
|
||||||
|
|
||||||
A NixOS configuration is usually made with the `nixpkgs.lib.nixosSystem` function, however we have a few custom wrapper
|
|
||||||
functions named `nixosConfig` and `stableNixosConfig` that abstracts away some common configuration we want on all our machines.
|
|
||||||
|
|
||||||
### `values.nix`
|
|
||||||
|
|
||||||
`values.nix` is a somewhat rare pattern in NixOS configurations around the internet. It contains a bunch of constant values
|
|
||||||
that we use throughout the configuration, such as IP addresses, DNS names, paths and more. This not only makes it easier to
|
|
||||||
change the values should we need to, but it also makes the configuration more readable. Instead of caring what exact IP any
|
|
||||||
machine has, you can write `values.machines.name.ipv4` and abstract the details away.
|
|
||||||
|
|
||||||
### `base`
|
|
||||||
|
|
||||||
The `base` directory contains a bunch of NixOS configuration that is common for all or most machines. Some of the config
|
|
||||||
you will find here sets defaults for certain services without enabling them, so that when they are enabled in a machine config,
|
|
||||||
we don't need to repeat the same defaults over again. Other parts actually enable certain services that we want on all machines,
|
|
||||||
such as `openssh` or the auto upgrade timer.
|
|
||||||
|
|
||||||
### Vendoring `modules` and `packages`
|
|
||||||
|
|
||||||
Sometimes, we either find that the packages or modules provided by `nixpkgs` is not sufficient for us,
|
|
||||||
or that they are bugged in some way that can not be easily overrided. There are also cases where the
|
|
||||||
modules or packages does not exist. In these cases, we tend to either copy and modify the modules and
|
|
||||||
packages from nixpkgs, or create our own. These modules and packages end up in the top-level `modules`
|
|
||||||
and `packages` directories. They are usually exposed in `flake.nix` as flake outputs `nixosModules.<name>`
|
|
||||||
and `packages.<platform>.<name>`, and they are usually also added to the machines that need them in the flake.
|
|
||||||
|
|
||||||
In order to override or add an extra package, the easiest way is to use an [`overlay`](https://wiki.nixos.org/wiki/Overlays).
|
|
||||||
This makes it so that the package from `pkgs.<name>` now refers to the modified variant of the package.
|
|
||||||
|
|
||||||
In order to add a module, you can just register it in the modules of the nixos machine.
|
|
||||||
In order to override a module, you also have to use `disabledModules = [ "<path-relative-to-nixpkgs/modules>" ];`.
|
|
||||||
Use `rg` to find examples of the latter.
|
|
||||||
|
|
||||||
Do note that if you believe a new module to be of high enough quality, or the change you are making to be
|
|
||||||
relevant for every nix user, you should strongly consider also creating a PR towards nixpkgs. However,
|
|
||||||
getting changes made there has a bit higher threshold and takes more time than making changes in the PVV config,
|
|
||||||
so feel free to make the changes here first. We can always remove the changes again once the upstreaming is finished.
|
|
||||||
|
|
||||||
### `users`, `secrets` and `keys`
|
|
||||||
|
|
||||||
For `users`, see [User management](./users.md)
|
|
||||||
|
|
||||||
For `secrets` and `keys`, see [Secret management and `sops-nix`](./secret-management.md)
|
|
||||||
|
|
||||||
### Collaboration
|
|
||||||
|
|
||||||
We use our gitea to collaborate on changes to the nix configuration. Every PVV maintenance member should have
|
|
||||||
access to the repository. The usual workflow is that we create a branch for the change we want to make, do a bunch
|
|
||||||
of commits and changes, and then open a merge request for review (or just rebase on master if you know what you are doing).
|
|
||||||
|
|
||||||
### Upstream documentation
|
|
||||||
|
|
||||||
Here are different sources of documentation and stuff that you might find useful while
|
|
||||||
writing, editing and debugging nix code.
|
|
||||||
|
|
||||||
- [nixpkgs repository](https://github.com/NixOS/nixpkgs)
|
|
||||||
|
|
||||||
This is particularly useful to read the source code, as well as upstreaming pieces of code that we think
|
|
||||||
everyone would want
|
|
||||||
|
|
||||||
- [NixOS search](https://search.nixos.org/)
|
|
||||||
|
|
||||||
This is useful for searching for both packages and NixOS options.
|
|
||||||
|
|
||||||
- [nixpkgs documentation](https://nixos.org/manual/nixpkgs/stable/)
|
|
||||||
- [NixOS documentation](https://nixos.org/manual/nixos/stable/)
|
|
||||||
- [nix (the tool) documentation](https://nix.dev/manual/nix/stable/)
|
|
||||||
|
|
||||||
All of the three above make up the official documentation with all technical
|
|
||||||
details about the different pieces that makes up NixOS.
|
|
||||||
|
|
||||||
- [The official NixOS wiki](https://wiki.nixos.org)
|
|
||||||
|
|
||||||
User-contributed guides, tips and tricks, and whatever else.
|
|
||||||
|
|
||||||
- [nix.dev](https://nix.dev)
|
|
||||||
|
|
||||||
Additional stuff
|
|
||||||
|
|
||||||
- [Noogle](https://noogle.dev)
|
|
||||||
|
|
||||||
This is useful when looking for nix functions and packaging helpers.
|
|
||||||
|
|
||||||
## Testing and deploying changes
|
|
||||||
|
|
||||||
After editing the nix files on a certain branch, you will want to test and deploy the changes to the machines.
|
|
||||||
Unfortunately, we don't really have a good setup for testing for runtime correctness locally, but we can at least
|
|
||||||
make sure that the code evaluates and builds correctly before deploying.
|
|
||||||
|
|
||||||
To just check that the code evaluates without errors, you can run:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
nix flake check
|
|
||||||
# Or if you want to keep getting all errors before it quits:
|
|
||||||
nix flake check --keep-going
|
|
||||||
```
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> If you are making changes that involves creating new nix files, remember to `git add` those files before running
|
|
||||||
> any nix commands. Nix refuses to acknowledge files that are not either commited or at least staged. It will spit
|
|
||||||
> out an error message about not finding the file in question.
|
|
||||||
|
|
||||||
### Building machine configurations
|
|
||||||
|
|
||||||
To build any specific machine configuration and look at the output, you can run:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
nix build .#nixosConfigurations.<machine-name>.config.system.build.toplevel
|
|
||||||
# or just
|
|
||||||
nix build .#<machine-name>
|
|
||||||
```
|
|
||||||
|
|
||||||
This will create a symlink name `./result` to a directory containing the built NixOS system. It is oftentimes
|
|
||||||
the case that config files for certain services only end up in the nix store without being put into `/etc`. If you wish
|
|
||||||
to read those files, you can often find them by looking at the systemd unit files in `./result/etc/systemd/system/`.
|
|
||||||
(if you are using vim, `gf` or go-to-file while the cursor is over a file path is a useful trick while doing this).
|
|
||||||
|
|
||||||
If you have edited something that affects multiple machines, you can also build all important machines at once by running:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
nix build .#
|
|
||||||
```
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> Building all machines at once can take a long time, depending on what has changed and whether you have already
|
|
||||||
> built some of the machines recently. Be prepared to wait for up to an hour to build all machines from scratch
|
|
||||||
> if this is the first time.
|
|
||||||
|
|
||||||
### Deploying to machines
|
|
||||||
|
|
||||||
> [!WARN]
|
|
||||||
> Be careful to think about state when testing changes against the machines. Sometimes, a certain change
|
|
||||||
> can lead to irreversible changes to the data stored on the machine. An example would be a set of database
|
|
||||||
> migrations applied when testing a newer version of a service. Unless that service also comes with downwards
|
|
||||||
> migrations, you can not go back to the previous version without losing data.
|
|
||||||
|
|
||||||
To deploy the changes to a machine, you should first SSH into the machine, and clone the pvv-nixos-config
|
|
||||||
repository unless you have already done so. After that, checkout the branch you want to deploy from, and rebuild:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Run this while in the pvv-nixos-config directory
|
|
||||||
sudo nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --flake .# --upgrade
|
|
||||||
```
|
|
||||||
|
|
||||||
This will rebuild the NixOS system on the current branch and switch the system configuration to reflect the new changes.
|
|
||||||
|
|
||||||
Note that unless you eventually merge the current changes into `main`, the machine will rebuild itself automatically and
|
|
||||||
revert the changes on the next nightly rebuild (tends to happen when everybody is asleep).
|
|
||||||
|
|
||||||
### Forcefully reset to `main`
|
|
||||||
|
|
||||||
If you ever want to reset a machine to the `main` branch, you can do so by running:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --upgrade --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git
|
|
||||||
```
|
|
||||||
|
|
||||||
This will ignore the current branch and just pull the latest `main` from the git repository directly from gitea.
|
|
||||||
You can also use this command if there are updates on the `main` branch that you want to deploy to the machine without
|
|
||||||
waiting for the nightly rebuild.
|
|
||||||
@@ -1,160 +0,0 @@
|
|||||||
# Secret management and `sops-nix`
|
|
||||||
|
|
||||||
Nix config is love, nix config is life, and publishing said config to the
|
|
||||||
internet is not only a good deed and kinda cool, but also encourages properly
|
|
||||||
secured configuration as opposed to [security through obscurity](https://en.wikipedia.org/wiki/Security_through_obscurity).
|
|
||||||
That being said, there are some details of the config that we really shouldn't
|
|
||||||
share with the general public. In particular, there are so-called *secrets*, that is
|
|
||||||
API keys, passwords, tokens, cookie secrets, salts, peppers and jalapenos that we'd
|
|
||||||
rather keep to ourselves. However, it is not entirely trivial to do so in the NixOS config.
|
|
||||||
For one, we'd have to keep these secrets out of the public git repo somehow, and secondly
|
|
||||||
everything that is configured via nix ends up as world readable files (i.e. any user on the
|
|
||||||
system can read the file) in `/nix/store`.
|
|
||||||
|
|
||||||
In order to solve this, we use a NixOS module called [`sops-nix`](https://github.com/Mic92/sops-nix)
|
|
||||||
which uses a technology called [`sops`](https://github.com/getsops/sops) behind the scenes.
|
|
||||||
The idea is simple: we encrypt these secrets with a bunch of different keys and store the
|
|
||||||
encrypted files in the git repo. First of all, we encrypt the secrets a bunch of time with
|
|
||||||
PVV maintenance member's keys, so that we can decrypt and edit the contents. Secondly, we
|
|
||||||
encrypt the secrets with the [host keys]() of the NixOS machines, so that they can decrypt
|
|
||||||
the secrets. The secrets will be decrypted and stored in a well-known location (usually `/run/secrets`)
|
|
||||||
so that they do not end up in the nix store, and are not world readable.
|
|
||||||
|
|
||||||
This way, we can both keep the secrets in the git repository and let multiple people edit them,
|
|
||||||
but also ensure that they don't end up in the wrong hands.
|
|
||||||
|
|
||||||
## Adding a new machine
|
|
||||||
|
|
||||||
In order to add a new machine to the nix-sops setup, you should do the following:
|
|
||||||
|
|
||||||
```console
|
|
||||||
# Create host keys (if they don't already exist)
|
|
||||||
ssh-keygen -A -b 4096
|
|
||||||
|
|
||||||
# Derive an age-key from the public host key
|
|
||||||
nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
|
|
||||||
|
|
||||||
# Register the age key in .sops.yaml
|
|
||||||
vim .sops.yaml
|
|
||||||
```
|
|
||||||
|
|
||||||
The contents of `.sops.yaml` should look like this:
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
keys:
|
|
||||||
# Users
|
|
||||||
...
|
|
||||||
|
|
||||||
# Hosts
|
|
||||||
...
|
|
||||||
- &host_<machine_name> <public_age_key>
|
|
||||||
|
|
||||||
creation_rules:
|
|
||||||
...
|
|
||||||
|
|
||||||
- path_regex: secrets/<machine_name>/[^/]+\.yaml$
|
|
||||||
key_groups:
|
|
||||||
- age:
|
|
||||||
- *host_<machine_name>
|
|
||||||
- ... user keys
|
|
||||||
- pgp:
|
|
||||||
- ... user keys
|
|
||||||
```
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> Take care that all the keys in the `age` and `pgp` sections are prefixed
|
|
||||||
> with a `-`, or else sops might try to encrypt the secrets in a way where
|
|
||||||
> you need both keys present to decrypt the content. Also, it tends to throw
|
|
||||||
> interesting errors when it fails to do so.
|
|
||||||
|
|
||||||
```console
|
|
||||||
# While cd-ed into the repository, run this to get a shell with the `sops` tool present
|
|
||||||
nix-shell
|
|
||||||
```
|
|
||||||
|
|
||||||
Now you should also be able to edit secrets for this machine by running:
|
|
||||||
|
|
||||||
```
|
|
||||||
sops secrets/<machine_name>/<machine_name>.yaml
|
|
||||||
```
|
|
||||||
|
|
||||||
## Adding a user
|
|
||||||
|
|
||||||
Adding a user is quite similar to adding a new machine.
|
|
||||||
This guide assumes you have already set up SSH keys.
|
|
||||||
|
|
||||||
```
|
|
||||||
# Derive an age-key from your key
|
|
||||||
# (edit the path to the key if it is named something else)
|
|
||||||
nix-shell -p ssh-to-age --run 'cat ~/.ssh/id_ed25519.pub | ssh-to-age'
|
|
||||||
|
|
||||||
# Register the age key in .sops.yaml
|
|
||||||
vim .sops.yaml
|
|
||||||
```
|
|
||||||
|
|
||||||
The contents of `.sops.yaml` should look like this:
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
keys:
|
|
||||||
# Users
|
|
||||||
...
|
|
||||||
- &user_<user_name> <public_age_key>
|
|
||||||
|
|
||||||
# Hosts
|
|
||||||
...
|
|
||||||
|
|
||||||
creation_rules:
|
|
||||||
...
|
|
||||||
|
|
||||||
# Do this for all the machines you are planning to edit
|
|
||||||
# (or just do it for all machines)
|
|
||||||
- path_regex: secrets/<machine_name>/[^/]+\.yaml$
|
|
||||||
key_groups:
|
|
||||||
- age:
|
|
||||||
- *host_<machine_name>
|
|
||||||
- ... user keys
|
|
||||||
- *host_<user_name>
|
|
||||||
- pgp:
|
|
||||||
- ... user keys
|
|
||||||
```
|
|
||||||
|
|
||||||
Now that sops is properly configured to recognize the key, you need someone
|
|
||||||
who already has access to decrypt all the secrets and re-encrypt them with your
|
|
||||||
key. At this point, you should probably [open a PR](https://docs.gitea.com/usage/issues-prs/pull-request)
|
|
||||||
and ask someone in PVV maintenance if they can checkout the PR branch, run the following
|
|
||||||
command and push the diff back into the PR (and maybe even ask them to merge if you're feeling
|
|
||||||
particularly needy).
|
|
||||||
|
|
||||||
```console
|
|
||||||
sops updatekeys secrets/*/*.yaml
|
|
||||||
```
|
|
||||||
|
|
||||||
## Updating keys
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> At some point, we found this flag called `sops -r` that seemed to be described to do what
|
|
||||||
> `sops updatekeys` does, do not be fooled. This only rotates the "inner key" for those who
|
|
||||||
> already have the secrets encrypted with their key.
|
|
||||||
|
|
||||||
Updating keys is done with this command:
|
|
||||||
|
|
||||||
```console
|
|
||||||
sops updatekeys secrets/*/*.yaml
|
|
||||||
```
|
|
||||||
|
|
||||||
However, there is a small catch. [oysteikt](https://git.pvv.ntnu.no/oysteikt) has kinda been
|
|
||||||
getting gray hairs lately, and refuses to use modern technology - he is still stuck using GPG.
|
|
||||||
This means that to be able to re-encrypt the sops secrets, you will need to have a gpg keychain
|
|
||||||
with his latest public key available. The key has an expiry date, so if he forgets to update it,
|
|
||||||
you should send him and angry email and tag him a bunch of times in a gitea issue. If the key
|
|
||||||
is up to date, you can do the following:
|
|
||||||
|
|
||||||
```console
|
|
||||||
# Fetch gpg (unless you have it already)
|
|
||||||
nix-shell -p gpg
|
|
||||||
|
|
||||||
# Import oysteikts key to the gpg keychain
|
|
||||||
gpg --import ./keys/oysteikt.pub
|
|
||||||
```
|
|
||||||
|
|
||||||
Now you should be able to run the `sops updatekeys` command again.
|
|
||||||
@@ -1,50 +0,0 @@
|
|||||||
# User management
|
|
||||||
|
|
||||||
Due to some complications with how NixOS creates users compared to how we used to
|
|
||||||
create users with the salt-based setup, the NixOS machine users are created and
|
|
||||||
managed separately. We tend to create users on-demand, whenever someone in PVV
|
|
||||||
maintenance want to work on the NixOS machines.
|
|
||||||
|
|
||||||
## Setting up a new user
|
|
||||||
|
|
||||||
You can find the files for the existing users, and thereby examples of user files
|
|
||||||
in the [`users`](../users) directory. When creating a new file here, you should name it
|
|
||||||
`your-username.nix`, and add *at least* the following contents:
|
|
||||||
|
|
||||||
```nix
|
|
||||||
{ pkgs, ... }:
|
|
||||||
{
|
|
||||||
users.users."<username>" = {
|
|
||||||
isNormalUser = true;
|
|
||||||
extraGroups = [
|
|
||||||
"wheel" # In case you wanna use sudo (you probably do)
|
|
||||||
"nix-builder-users" # Arbitrary access to write to the nix store
|
|
||||||
];
|
|
||||||
|
|
||||||
# Any packages you frequently use to manage servers go here.
|
|
||||||
# Please don't pull gigantonormous packages here unless you
|
|
||||||
# absolutely need them, and remember that any package can be
|
|
||||||
# pulled via nix-shell if you only use it once in a blue moon.
|
|
||||||
packages = with pkgs; [
|
|
||||||
bottom
|
|
||||||
eza
|
|
||||||
];
|
|
||||||
|
|
||||||
# Not strictly needed, but we recommend adding your public SSH
|
|
||||||
# key here. If it is not present, you will have to log into the
|
|
||||||
# machine as 'root' before setting your password for every NixOS
|
|
||||||
# machine you have not logged into yet.
|
|
||||||
openssh.authorizedKeys.keys = [
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjiQ0wg4lpC7YBMAAHoGmgwqHOBi+EUz5mmCymGlIyT my-key"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
The file will be picked up automatically, so creating the file and adding the
|
|
||||||
contents should be enough to get you registered. You should
|
|
||||||
[open a PR](https://docs.gitea.com/usage/issues-prs/pull-request) with the new
|
|
||||||
code so the machines will be rebuilt with your user present.
|
|
||||||
|
|
||||||
See also [Secret Management](./secret-management.md) for how to add your keys to the
|
|
||||||
system that lets us add secrets (API keys, password, etc.) to the NixOS config.
|
|
||||||
389
flake.lock
generated
389
flake.lock
generated
@@ -1,26 +1,5 @@
|
|||||||
{
|
{
|
||||||
"nodes": {
|
"nodes": {
|
||||||
"devshell": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"nix-topology",
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1728330715,
|
|
||||||
"narHash": "sha256-xRJ2nPOXb//u1jaBnDP56M7v5ldavjbtR6lfGqSvcKg=",
|
|
||||||
"owner": "numtide",
|
|
||||||
"repo": "devshell",
|
|
||||||
"rev": "dd6b80932022cea34a019e2bb32f6fa9e494dfef",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "numtide",
|
|
||||||
"repo": "devshell",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"disko": {
|
"disko": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
@@ -28,33 +7,38 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1736864502,
|
"lastModified": 1715445235,
|
||||||
"narHash": "sha256-ItkIZyebGvNH2dK9jVGzJHGPtb6BSWLN8Gmef16NeY0=",
|
"narHash": "sha256-SUu+oIWn+xqQIOlwfwNfS9Sek4i1HKsrLJchsDReXwA=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "disko",
|
"repo": "disko",
|
||||||
"rev": "0141aabed359f063de7413f80d906e1d98c0c123",
|
"rev": "159d87ea5b95bbdea46f0288a33c5e1570272725",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"ref": "v1.11.0",
|
|
||||||
"repo": "disko",
|
"repo": "disko",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"flake-compat": {
|
"fix-python": {
|
||||||
"flake": false,
|
"inputs": {
|
||||||
|
"flake-utils": "flake-utils",
|
||||||
|
"nixpkgs": [
|
||||||
|
"grzegorz",
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1696426674,
|
"lastModified": 1713887124,
|
||||||
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
|
"narHash": "sha256-hGTSm0p9xXUYDgsAAr/ORZICo6T6u33vLfX3tILikaQ=",
|
||||||
"owner": "edolstra",
|
"owner": "GuillaumeDesforges",
|
||||||
"repo": "flake-compat",
|
"repo": "fix-python",
|
||||||
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
|
"rev": "f7f4b33e22414071fc1f9cbf68072c413c3a7fdf",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "edolstra",
|
"owner": "GuillaumeDesforges",
|
||||||
"repo": "flake-compat",
|
"repo": "fix-python",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
@@ -63,84 +47,39 @@
|
|||||||
"systems": "systems"
|
"systems": "systems"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1726560853,
|
"lastModified": 1689068808,
|
||||||
"narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
|
"narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
|
||||||
"owner": "numtide",
|
"owner": "numtide",
|
||||||
"repo": "flake-utils",
|
"repo": "flake-utils",
|
||||||
"rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
|
"rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "numtide",
|
"id": "flake-utils",
|
||||||
"repo": "flake-utils",
|
"type": "indirect"
|
||||||
"type": "github"
|
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"gergle": {
|
"grzegorz": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
|
"fix-python": "fix-python",
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"nixpkgs"
|
"nixpkgs-unstable"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1764868579,
|
"lastModified": 1715364232,
|
||||||
"narHash": "sha256-rfTUOIc0wnC4+19gLVfPbHfXx/ilfuUix6bWY+yaM2U=",
|
"narHash": "sha256-ZJC3SkanEgbV7p+LFhP+85CviRWOXJNHzZwR/Stb7hE=",
|
||||||
"ref": "main",
|
"owner": "Programvareverkstedet",
|
||||||
"rev": "9c923d1d50daa6a3b28c3214ad2300bfaf6c8fcd",
|
"repo": "grzegorz",
|
||||||
"revCount": 22,
|
"rev": "3841cda1cdcac470440b06838d56a2eb2256378c",
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"ref": "main",
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"gitignore": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"nix-topology",
|
|
||||||
"pre-commit-hooks",
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1709087332,
|
|
||||||
"narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
|
|
||||||
"owner": "hercules-ci",
|
|
||||||
"repo": "gitignore.nix",
|
|
||||||
"rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
|
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "hercules-ci",
|
"owner": "Programvareverkstedet",
|
||||||
"repo": "gitignore.nix",
|
"repo": "grzegorz",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"greg-ng": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs"
|
|
||||||
],
|
|
||||||
"rust-overlay": "rust-overlay"
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1765760377,
|
|
||||||
"narHash": "sha256-2+lgzUjVas9hPSeWn52MwuX+iidMN4RkzkHo4vrGmR8=",
|
|
||||||
"ref": "main",
|
|
||||||
"rev": "f340dc5b9c9f3b75b7aca41f56f8869b9e28cf8c",
|
|
||||||
"revCount": 58,
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"ref": "main",
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"grzegorz-clients": {
|
"grzegorz-clients": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
@@ -148,18 +87,17 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1764867811,
|
"lastModified": 1715384651,
|
||||||
"narHash": "sha256-UWHiwr8tIcGcVxMLvAdNxDbQ8QuHf3REHboyxvFkYEI=",
|
"narHash": "sha256-7RhckgUTjqeCjWkhiCc1iB+5CBx9fl80d/3O4Jh+5kM=",
|
||||||
"ref": "master",
|
"owner": "Programvareverkstedet",
|
||||||
"rev": "c9983e947efe047ea9d6f97157a1f90e49d0eab3",
|
"repo": "grzegorz-clients",
|
||||||
"revCount": 81,
|
"rev": "738a4f3dd887f7c3612e4e772b83cbfa3cde5693",
|
||||||
"type": "git",
|
"type": "github"
|
||||||
"url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
|
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"ref": "master",
|
"owner": "Programvareverkstedet",
|
||||||
"type": "git",
|
"repo": "grzegorz-clients",
|
||||||
"url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"matrix-next": {
|
"matrix-next": {
|
||||||
@@ -169,63 +107,20 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1764844095,
|
"lastModified": 1717234745,
|
||||||
"narHash": "sha256-Drf1orxsmFDzO+UbPo85gHjXW7QzAM+6oTPvI7vOSik=",
|
"narHash": "sha256-MFyKRdw4WQD6V3vRGbP6MYbtJhZp712zwzjW6YiOBYM=",
|
||||||
"owner": "dali99",
|
"owner": "dali99",
|
||||||
"repo": "nixos-matrix-modules",
|
"repo": "nixos-matrix-modules",
|
||||||
"rev": "25b9f31ef1dbc3987b4c716de716239f2b283701",
|
"rev": "d7dc42c9bbb155c5e4aa2f0985d0df75ce978456",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "dali99",
|
"owner": "dali99",
|
||||||
"ref": "v0.8.0",
|
"ref": "v0.6.0",
|
||||||
"repo": "nixos-matrix-modules",
|
"repo": "nixos-matrix-modules",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"minecraft-heatmap": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs"
|
|
||||||
],
|
|
||||||
"rust-overlay": "rust-overlay_2"
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1766407405,
|
|
||||||
"narHash": "sha256-UEJ8F8/oG70biWRrGbL5/aB7OXzzvnYs+jxkR07UHvA=",
|
|
||||||
"ref": "main",
|
|
||||||
"rev": "e719840f72ca1b0cd169562a3a0de69899821de0",
|
|
||||||
"revCount": 16,
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"ref": "main",
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"minecraft-kartverket": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1765904683,
|
|
||||||
"narHash": "sha256-uXM56y5n5GWpCiCNdKlTcCAy2IntgDB21c4gBDU30io=",
|
|
||||||
"ref": "main",
|
|
||||||
"rev": "6fae27b1659efb6774cf08a4e36ed29ab0e24105",
|
|
||||||
"revCount": 26,
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"ref": "main",
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"nix-gitea-themes": {
|
"nix-gitea-themes": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
@@ -233,95 +128,63 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1743881366,
|
"lastModified": 1714416973,
|
||||||
"narHash": "sha256-ScGA2IHPk9ugf9bqEZnp+YB/OJgrkZblnG/XLEKvJAo=",
|
"narHash": "sha256-aZUcvXjdETUC6wVQpWDVjLUzwpDAEca8yR0ITDeK39o=",
|
||||||
"ref": "main",
|
"ref": "refs/heads/main",
|
||||||
"rev": "db2e4becf1b11e5dfd33de12a90a7d089fcf68ec",
|
"rev": "2b23c0ba8aae68d3cb6789f0f6e4891cef26cc6d",
|
||||||
"revCount": 11,
|
"revCount": 6,
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
|
"url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"ref": "main",
|
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
|
"url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
|
||||||
}
|
|
||||||
},
|
|
||||||
"nix-topology": {
|
|
||||||
"inputs": {
|
|
||||||
"devshell": "devshell",
|
|
||||||
"flake-utils": "flake-utils",
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs"
|
|
||||||
],
|
|
||||||
"pre-commit-hooks": "pre-commit-hooks"
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1765969653,
|
|
||||||
"narHash": "sha256-qVpQxyvdByeDfb+d+jhbyNna2Ie+w85iHpt4Qu0rv/E=",
|
|
||||||
"owner": "oddlama",
|
|
||||||
"repo": "nix-topology",
|
|
||||||
"rev": "0ed73e5a1b65eb8ed388d070ebe8dedb9182f466",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "oddlama",
|
|
||||||
"ref": "main",
|
|
||||||
"repo": "nix-topology",
|
|
||||||
"type": "github"
|
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs": {
|
"nixpkgs": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1767043167,
|
"lastModified": 1719520878,
|
||||||
"narHash": "sha256-wN04/SL+8tV0D2HBIgt9dpX/03U18xoJ+8PT+dcn30E=",
|
"narHash": "sha256-5BXzNOl2RVHcfS/oxaZDKOi7gVuTyWPibQG0DHd5sSc=",
|
||||||
"rev": "0b43a6ee07997a6e319e92dcbf276c2736506944",
|
"owner": "NixOS",
|
||||||
"type": "tarball",
|
"repo": "nixpkgs",
|
||||||
"url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.2789.0b43a6ee0799/nixexprs.tar.xz"
|
"rev": "a44bedbb48c367f0476e6a3a27bf28f6330faf23",
|
||||||
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"type": "tarball",
|
"id": "nixpkgs",
|
||||||
"url": "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz"
|
"ref": "nixos-24.05-small",
|
||||||
|
"type": "indirect"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"nixpkgs-stable": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1714858427,
|
||||||
|
"narHash": "sha256-tCxeDP4C1pWe2rYY3IIhdA40Ujz32Ufd4tcrHPSKx2M=",
|
||||||
|
"owner": "NixOS",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"rev": "b980b91038fc4b09067ef97bbe5ad07eecca1e76",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "NixOS",
|
||||||
|
"ref": "release-23.11",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs-unstable": {
|
"nixpkgs-unstable": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1767031366,
|
"lastModified": 1715435713,
|
||||||
"narHash": "sha256-SJz8tVEnXusU8OzN5ixAXQgzXv8fNIzp9ztzUyobh4s=",
|
"narHash": "sha256-lb2HqDQGfTdnCCpc1pgF6fkdgIOuBQ0nP8jjVSfLFqg=",
|
||||||
"rev": "d23fedd87fcd067b1d160323fae0d0e4f995527d",
|
"owner": "NixOS",
|
||||||
"type": "tarball",
|
"repo": "nixpkgs",
|
||||||
"url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre918279.d23fedd87fcd/nixexprs.tar.xz"
|
"rev": "52b40f6c4be12742b1504ca2eb4527e597bf2526",
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"type": "tarball",
|
|
||||||
"url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"pre-commit-hooks": {
|
|
||||||
"inputs": {
|
|
||||||
"flake-compat": "flake-compat",
|
|
||||||
"gitignore": "gitignore",
|
|
||||||
"nixpkgs": [
|
|
||||||
"nix-topology",
|
|
||||||
"nixpkgs"
|
|
||||||
],
|
|
||||||
"nixpkgs-stable": [
|
|
||||||
"nix-topology",
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1730797577,
|
|
||||||
"narHash": "sha256-SrID5yVpyUfknUTGWgYkTyvdr9J1LxUym4om3SVGPkg=",
|
|
||||||
"owner": "cachix",
|
|
||||||
"repo": "pre-commit-hooks.nix",
|
|
||||||
"rev": "1864030ed24a2b8b4e4d386a5eeaf0c5369e50a9",
|
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "cachix",
|
"id": "nixpkgs",
|
||||||
"repo": "pre-commit-hooks.nix",
|
"ref": "nixos-unstable-small",
|
||||||
"type": "github"
|
"type": "indirect"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"pvv-calendar-bot": {
|
"pvv-calendar-bot": {
|
||||||
@@ -331,16 +194,15 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1764869785,
|
"lastModified": 1693136143,
|
||||||
"narHash": "sha256-FGTIpC7gB4lbeL0bfYzn1Ge0PaCpd7VqWBLhJBx0i4A=",
|
"narHash": "sha256-amHprjftc3y/bg8yf4hITCLa+ez5HIi0yGfR7TU6UIc=",
|
||||||
"ref": "main",
|
"ref": "refs/heads/main",
|
||||||
"rev": "8ce7fb0b1918bdb3d1489a40d73895693955e8b2",
|
"rev": "a32894b305f042d561500f5799226afd1faf5abb",
|
||||||
"revCount": 23,
|
"revCount": 9,
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
|
"url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"ref": "main",
|
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
|
"url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
|
||||||
}
|
}
|
||||||
@@ -352,16 +214,15 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1767080188,
|
"lastModified": 1722722932,
|
||||||
"narHash": "sha256-BmyPuWeSQ9XREyi0KSerWRfJndmyzHNJLysBJld/KwA=",
|
"narHash": "sha256-K81a2GQpY2kRX+C9ek9r91THlZB674CqRTSMMb5IO7E=",
|
||||||
"ref": "main",
|
"ref": "refs/heads/master",
|
||||||
"rev": "08a216f4473e26aa2a5349e72633c0ab24e8ffbd",
|
"rev": "6580cfe546c902cdf11e17b0b8aa30b3c412bb34",
|
||||||
"revCount": 534,
|
"revCount": 465,
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"ref": "main",
|
|
||||||
"type": "git",
|
"type": "git",
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
||||||
}
|
}
|
||||||
@@ -369,14 +230,10 @@
|
|||||||
"root": {
|
"root": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"disko": "disko",
|
"disko": "disko",
|
||||||
"gergle": "gergle",
|
"grzegorz": "grzegorz",
|
||||||
"greg-ng": "greg-ng",
|
|
||||||
"grzegorz-clients": "grzegorz-clients",
|
"grzegorz-clients": "grzegorz-clients",
|
||||||
"matrix-next": "matrix-next",
|
"matrix-next": "matrix-next",
|
||||||
"minecraft-heatmap": "minecraft-heatmap",
|
|
||||||
"minecraft-kartverket": "minecraft-kartverket",
|
|
||||||
"nix-gitea-themes": "nix-gitea-themes",
|
"nix-gitea-themes": "nix-gitea-themes",
|
||||||
"nix-topology": "nix-topology",
|
|
||||||
"nixpkgs": "nixpkgs",
|
"nixpkgs": "nixpkgs",
|
||||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||||
"pvv-calendar-bot": "pvv-calendar-bot",
|
"pvv-calendar-bot": "pvv-calendar-bot",
|
||||||
@@ -384,65 +241,23 @@
|
|||||||
"sops-nix": "sops-nix"
|
"sops-nix": "sops-nix"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"rust-overlay": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"greg-ng",
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1765680428,
|
|
||||||
"narHash": "sha256-fyPmRof9SZeI14ChPk5rVPOm7ISiiGkwGCunkhM+eUg=",
|
|
||||||
"owner": "oxalica",
|
|
||||||
"repo": "rust-overlay",
|
|
||||||
"rev": "eb3898d8ef143d4bf0f7f2229105fc51c7731b2f",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "oxalica",
|
|
||||||
"repo": "rust-overlay",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"rust-overlay_2": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"minecraft-heatmap",
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1766371695,
|
|
||||||
"narHash": "sha256-W7CX9vy7H2Jj3E8NI4djHyF8iHSxKpb2c/7uNQ/vGFU=",
|
|
||||||
"owner": "oxalica",
|
|
||||||
"repo": "rust-overlay",
|
|
||||||
"rev": "d81285ba8199b00dc31847258cae3c655b605e8c",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "oxalica",
|
|
||||||
"repo": "rust-overlay",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"sops-nix": {
|
"sops-nix": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"nixpkgs"
|
"nixpkgs"
|
||||||
]
|
],
|
||||||
|
"nixpkgs-stable": "nixpkgs-stable"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1766894905,
|
"lastModified": 1715244550,
|
||||||
"narHash": "sha256-pn8AxxfajqyR/Dmr1wnZYdUXHgM3u6z9x0Z1Ijmz2UQ=",
|
"narHash": "sha256-ffOZL3eaZz5Y1nQ9muC36wBCWwS1hSRLhUzlA9hV2oI=",
|
||||||
"owner": "Mic92",
|
"owner": "Mic92",
|
||||||
"repo": "sops-nix",
|
"repo": "sops-nix",
|
||||||
"rev": "61b39c7b657081c2adc91b75dd3ad8a91d6f07a7",
|
"rev": "0dc50257c00ee3c65fef3a255f6564cfbfe6eb7f",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "Mic92",
|
"owner": "Mic92",
|
||||||
"ref": "master",
|
|
||||||
"repo": "sops-nix",
|
"repo": "sops-nix",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
|
|||||||
235
flake.nix
235
flake.nix
@@ -2,54 +2,43 @@
|
|||||||
description = "PVV System flake";
|
description = "PVV System flake";
|
||||||
|
|
||||||
inputs = {
|
inputs = {
|
||||||
nixpkgs.url = "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz";
|
nixpkgs.url = "nixpkgs/nixos-24.05-small";
|
||||||
nixpkgs-unstable.url = "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz";
|
nixpkgs-unstable.url = "nixpkgs/nixos-unstable-small";
|
||||||
|
|
||||||
sops-nix.url = "github:Mic92/sops-nix/master";
|
sops-nix.url = "github:Mic92/sops-nix";
|
||||||
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
disko.url = "github:nix-community/disko/v1.11.0";
|
disko.url = "github:nix-community/disko";
|
||||||
disko.inputs.nixpkgs.follows = "nixpkgs";
|
disko.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
nix-topology.url = "github:oddlama/nix-topology/main";
|
pvv-nettsiden.url = "git+https://git.pvv.ntnu.no/Projects/nettsiden.git";
|
||||||
nix-topology.inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
|
|
||||||
pvv-nettsiden.url = "git+https://git.pvv.ntnu.no/Projects/nettsiden.git?ref=main";
|
|
||||||
pvv-nettsiden.inputs.nixpkgs.follows = "nixpkgs";
|
pvv-nettsiden.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git?ref=main";
|
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
|
||||||
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
matrix-next.url = "github:dali99/nixos-matrix-modules/v0.8.0";
|
matrix-next.url = "github:dali99/nixos-matrix-modules/v0.6.0";
|
||||||
matrix-next.inputs.nixpkgs.follows = "nixpkgs";
|
matrix-next.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git?ref=main";
|
nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git";
|
||||||
nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";
|
nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
|
grzegorz.url = "github:Programvareverkstedet/grzegorz";
|
||||||
minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";
|
grzegorz.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||||
|
grzegorz-clients.url = "github:Programvareverkstedet/grzegorz-clients";
|
||||||
greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";
|
|
||||||
greg-ng.inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git?ref=main";
|
|
||||||
gergle.inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git?ref=master";
|
|
||||||
grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
|
grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
minecraft-kartverket.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git?ref=main";
|
|
||||||
minecraft-kartverket.inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
|
outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
|
||||||
let
|
let
|
||||||
inherit (nixpkgs) lib;
|
nixlib = nixpkgs.lib;
|
||||||
systems = [
|
systems = [
|
||||||
"x86_64-linux"
|
"x86_64-linux"
|
||||||
"aarch64-linux"
|
"aarch64-linux"
|
||||||
"aarch64-darwin"
|
"aarch64-darwin"
|
||||||
];
|
];
|
||||||
forAllSystems = f: lib.genAttrs systems f;
|
forAllSystems = f: nixlib.genAttrs systems (system: f system);
|
||||||
allMachines = builtins.attrNames self.nixosConfigurations;
|
allMachines = nixlib.mapAttrsToList (name: _: name) self.nixosConfigurations;
|
||||||
importantMachines = [
|
importantMachines = [
|
||||||
"bekkalokk"
|
"bekkalokk"
|
||||||
"bicep"
|
"bicep"
|
||||||
@@ -58,84 +47,41 @@
|
|||||||
"ildkule"
|
"ildkule"
|
||||||
];
|
];
|
||||||
in {
|
in {
|
||||||
inputs = lib.mapAttrs (_: src: src.outPath) inputs;
|
|
||||||
|
|
||||||
pkgs = forAllSystems (system:
|
|
||||||
import nixpkgs {
|
|
||||||
inherit system;
|
|
||||||
config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
|
|
||||||
[
|
|
||||||
"nvidia-x11"
|
|
||||||
"nvidia-settings"
|
|
||||||
];
|
|
||||||
});
|
|
||||||
|
|
||||||
nixosConfigurations = let
|
nixosConfigurations = let
|
||||||
unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
|
unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
|
||||||
|
nixosConfig = nixpkgs: name: config: nixpkgs.lib.nixosSystem (nixpkgs.lib.recursiveUpdate
|
||||||
nixosConfig =
|
rec {
|
||||||
nixpkgs:
|
|
||||||
name:
|
|
||||||
configurationPath:
|
|
||||||
extraArgs:
|
|
||||||
lib.nixosSystem (lib.recursiveUpdate
|
|
||||||
(let
|
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
in {
|
|
||||||
inherit system;
|
|
||||||
|
|
||||||
specialArgs = {
|
specialArgs = {
|
||||||
inherit unstablePkgs inputs;
|
inherit nixpkgs-unstable inputs;
|
||||||
values = import ./values.nix;
|
values = import ./values.nix;
|
||||||
fp = path: ./${path};
|
};
|
||||||
} // extraArgs.specialArgs or { };
|
|
||||||
|
|
||||||
modules = [
|
modules = [
|
||||||
configurationPath
|
./hosts/${name}/configuration.nix
|
||||||
sops-nix.nixosModules.sops
|
sops-nix.nixosModules.sops
|
||||||
] ++ extraArgs.modules or [];
|
] ++ config.modules or [];
|
||||||
|
|
||||||
pkgs = import nixpkgs {
|
pkgs = import nixpkgs {
|
||||||
inherit system;
|
inherit system;
|
||||||
config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
|
|
||||||
[
|
|
||||||
"nvidia-x11"
|
|
||||||
"nvidia-settings"
|
|
||||||
];
|
|
||||||
overlays = [
|
overlays = [
|
||||||
# Global overlays go here
|
# Global overlays go here
|
||||||
] ++ extraArgs.overlays or [ ];
|
] ++ config.overlays or [ ];
|
||||||
};
|
};
|
||||||
})
|
}
|
||||||
(builtins.removeAttrs extraArgs [
|
(removeAttrs config [ "modules" "overlays" ])
|
||||||
"modules"
|
|
||||||
"overlays"
|
|
||||||
"specialArgs"
|
|
||||||
])
|
|
||||||
);
|
);
|
||||||
|
|
||||||
stableNixosConfig = name: extraArgs:
|
stableNixosConfig = nixosConfig nixpkgs;
|
||||||
nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
|
unstableNixosConfig = nixosConfig nixpkgs-unstable;
|
||||||
in {
|
in {
|
||||||
bakke = stableNixosConfig "bakke" {
|
|
||||||
modules = [
|
|
||||||
disko.nixosModules.disko
|
|
||||||
];
|
|
||||||
};
|
|
||||||
bicep = stableNixosConfig "bicep" {
|
bicep = stableNixosConfig "bicep" {
|
||||||
modules = [
|
modules = [
|
||||||
inputs.matrix-next.nixosModules.default
|
inputs.matrix-next.nixosModules.default
|
||||||
inputs.pvv-calendar-bot.nixosModules.default
|
inputs.pvv-calendar-bot.nixosModules.default
|
||||||
inputs.minecraft-heatmap.nixosModules.default
|
|
||||||
self.nixosModules.gickup
|
|
||||||
self.nixosModules.matrix-ooye
|
|
||||||
];
|
];
|
||||||
overlays = [
|
overlays = [
|
||||||
inputs.pvv-calendar-bot.overlays.default
|
inputs.pvv-calendar-bot.overlays.x86_64-linux.default
|
||||||
inputs.minecraft-heatmap.overlays.default
|
|
||||||
(final: prev: {
|
|
||||||
inherit (self.packages.${prev.system}) out-of-your-element;
|
|
||||||
})
|
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
bekkalokk = stableNixosConfig "bekkalokk" {
|
bekkalokk = stableNixosConfig "bekkalokk" {
|
||||||
@@ -144,88 +90,42 @@
|
|||||||
heimdal = unstablePkgs.heimdal;
|
heimdal = unstablePkgs.heimdal;
|
||||||
mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions { };
|
mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions { };
|
||||||
simplesamlphp = final.callPackage ./packages/simplesamlphp { };
|
simplesamlphp = final.callPackage ./packages/simplesamlphp { };
|
||||||
bluemap = final.callPackage ./packages/bluemap.nix { };
|
|
||||||
})
|
})
|
||||||
|
inputs.nix-gitea-themes.overlays.default
|
||||||
inputs.pvv-nettsiden.overlays.default
|
inputs.pvv-nettsiden.overlays.default
|
||||||
];
|
];
|
||||||
modules = [
|
modules = [
|
||||||
|
inputs.nix-gitea-themes.nixosModules.default
|
||||||
inputs.pvv-nettsiden.nixosModules.default
|
inputs.pvv-nettsiden.nixosModules.default
|
||||||
self.nixosModules.bluemap
|
];
|
||||||
|
};
|
||||||
|
bob = stableNixosConfig "bob" {
|
||||||
|
modules = [
|
||||||
|
disko.nixosModules.disko
|
||||||
|
{ disko.devices.disk.disk1.device = "/dev/vda"; }
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
ildkule = stableNixosConfig "ildkule" { };
|
ildkule = stableNixosConfig "ildkule" { };
|
||||||
#ildkule-unstable = unstableNixosConfig "ildkule" { };
|
#ildkule-unstable = unstableNixosConfig "ildkule" { };
|
||||||
shark = stableNixosConfig "shark" { };
|
shark = stableNixosConfig "shark" { };
|
||||||
wenche = stableNixosConfig "wenche" { };
|
|
||||||
|
|
||||||
kommode = stableNixosConfig "kommode" {
|
|
||||||
overlays = [
|
|
||||||
inputs.nix-gitea-themes.overlays.default
|
|
||||||
];
|
|
||||||
modules = [
|
|
||||||
inputs.nix-gitea-themes.nixosModules.default
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
ustetind = stableNixosConfig "ustetind" {
|
|
||||||
modules = [
|
|
||||||
"${nixpkgs}/nixos/modules/virtualisation/lxc-container.nix"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
|
brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
|
||||||
modules = [
|
modules = [
|
||||||
|
inputs.grzegorz.nixosModules.grzegorz-kiosk
|
||||||
inputs.grzegorz-clients.nixosModules.grzegorz-webui
|
inputs.grzegorz-clients.nixosModules.grzegorz-webui
|
||||||
inputs.gergle.nixosModules.default
|
|
||||||
inputs.greg-ng.nixosModules.default
|
|
||||||
];
|
|
||||||
overlays = [
|
|
||||||
inputs.greg-ng.overlays.default
|
|
||||||
inputs.gergle.overlays.default
|
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
georg = stableNixosConfig "georg" {
|
georg = stableNixosConfig "georg" {
|
||||||
modules = [
|
modules = [
|
||||||
|
inputs.grzegorz.nixosModules.grzegorz-kiosk
|
||||||
inputs.grzegorz-clients.nixosModules.grzegorz-webui
|
inputs.grzegorz-clients.nixosModules.grzegorz-webui
|
||||||
inputs.gergle.nixosModules.default
|
|
||||||
inputs.greg-ng.nixosModules.default
|
|
||||||
];
|
|
||||||
overlays = [
|
|
||||||
inputs.greg-ng.overlays.default
|
|
||||||
inputs.gergle.overlays.default
|
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
}
|
buskerud = stableNixosConfig "buskerud" { };
|
||||||
//
|
|
||||||
(let
|
|
||||||
machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
|
|
||||||
stableLupineNixosConfig = name: extraArgs:
|
|
||||||
nixosConfig nixpkgs name ./hosts/lupine/configuration.nix extraArgs;
|
|
||||||
in lib.genAttrs machineNames (name: stableLupineNixosConfig name {
|
|
||||||
modules = [{ networking.hostName = name; }];
|
|
||||||
specialArgs.lupineName = name;
|
|
||||||
}));
|
|
||||||
|
|
||||||
nixosModules = {
|
|
||||||
bluemap = ./modules/bluemap.nix;
|
|
||||||
snakeoil-certs = ./modules/snakeoil-certs.nix;
|
|
||||||
snappymail = ./modules/snappymail.nix;
|
|
||||||
robots-txt = ./modules/robots-txt.nix;
|
|
||||||
gickup = ./modules/gickup;
|
|
||||||
matrix-ooye = ./modules/matrix-ooye.nix;
|
|
||||||
};
|
};
|
||||||
|
|
||||||
devShells = forAllSystems (system: {
|
devShells = forAllSystems (system: {
|
||||||
default = nixpkgs-unstable.legacyPackages.${system}.callPackage ./shell.nix { };
|
default = nixpkgs.legacyPackages.${system}.callPackage ./shell.nix { };
|
||||||
cuda = let
|
|
||||||
cuda-pkgs = import nixpkgs-unstable {
|
|
||||||
inherit system;
|
|
||||||
config = {
|
|
||||||
allowUnfree = true;
|
|
||||||
cudaSupport = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
in cuda-pkgs.callPackage ./shells/cuda.nix { };
|
|
||||||
});
|
});
|
||||||
|
|
||||||
packages = {
|
packages = {
|
||||||
@@ -234,63 +134,20 @@
|
|||||||
in rec {
|
in rec {
|
||||||
default = important-machines;
|
default = important-machines;
|
||||||
important-machines = pkgs.linkFarm "important-machines"
|
important-machines = pkgs.linkFarm "important-machines"
|
||||||
(lib.getAttrs importantMachines self.packages.x86_64-linux);
|
(nixlib.getAttrs importantMachines self.packages.x86_64-linux);
|
||||||
all-machines = pkgs.linkFarm "all-machines"
|
all-machines = pkgs.linkFarm "all-machines"
|
||||||
(lib.getAttrs allMachines self.packages.x86_64-linux);
|
(nixlib.getAttrs allMachines self.packages.x86_64-linux);
|
||||||
|
|
||||||
simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
|
simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
|
||||||
|
|
||||||
bluemap = pkgs.callPackage ./packages/bluemap.nix { };
|
} //
|
||||||
|
(nixlib.pipe null [
|
||||||
out-of-your-element = pkgs.callPackage ./packages/out-of-your-element.nix { };
|
|
||||||
}
|
|
||||||
//
|
|
||||||
# Mediawiki extensions
|
|
||||||
(lib.pipe null [
|
|
||||||
(_: pkgs.callPackage ./packages/mediawiki-extensions { })
|
(_: pkgs.callPackage ./packages/mediawiki-extensions { })
|
||||||
(lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
|
(nixlib.flip builtins.removeAttrs ["override" "overrideDerivation"])
|
||||||
(lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
|
(nixlib.mapAttrs' (name: nixlib.nameValuePair "mediawiki-${name}"))
|
||||||
])
|
])
|
||||||
//
|
// nixlib.genAttrs allMachines
|
||||||
# Machines
|
(machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
|
||||||
lib.genAttrs allMachines
|
|
||||||
(machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
|
|
||||||
//
|
|
||||||
# Nix-topology
|
|
||||||
(let
|
|
||||||
topology' = import inputs.nix-topology {
|
|
||||||
pkgs = import nixpkgs {
|
|
||||||
system = "x86_64-linux";
|
|
||||||
overlays = [ inputs.nix-topology.overlays.default ];
|
|
||||||
};
|
|
||||||
|
|
||||||
specialArgs = {
|
|
||||||
values = import ./values.nix;
|
|
||||||
};
|
|
||||||
|
|
||||||
modules = [
|
|
||||||
./topology
|
|
||||||
{
|
|
||||||
nixosConfigurations = lib.mapAttrs (_name: nixosCfg: nixosCfg.extendModules {
|
|
||||||
modules = [
|
|
||||||
inputs.nix-topology.nixosModules.default
|
|
||||||
./topology/service-extractors/greg-ng.nix
|
|
||||||
];
|
|
||||||
}) self.nixosConfigurations;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
in {
|
|
||||||
topology = topology'.config.output;
|
|
||||||
topology-png = pkgs.runCommand "pvv-config-topology-png" {
|
|
||||||
nativeBuildInputs = [ pkgs.writableTmpDirAsHomeHook ];
|
|
||||||
} ''
|
|
||||||
mkdir -p "$out"
|
|
||||||
for file in '${topology'.config.output}'/*.svg; do
|
|
||||||
${lib.getExe pkgs.imagemagick} -density 300 -background none "$file" "$out"/"$(basename "''${file%.svg}.png")"
|
|
||||||
done
|
|
||||||
'';
|
|
||||||
});
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,25 +0,0 @@
|
|||||||
{ config, pkgs, values, ... }:
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
./hardware-configuration.nix
|
|
||||||
../../base
|
|
||||||
./filesystems.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
sops.defaultSopsFile = ../../secrets/bakke/bakke.yaml;
|
|
||||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
||||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
|
||||||
sops.age.generateKey = true;
|
|
||||||
|
|
||||||
boot.loader.systemd-boot.enable = true;
|
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
|
||||||
|
|
||||||
networking.hostName = "bakke";
|
|
||||||
networking.hostId = "99609ffc";
|
|
||||||
systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
|
|
||||||
matchConfig.Name = "enp2s0";
|
|
||||||
address = with values.hosts.bakke; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
|
||||||
};
|
|
||||||
|
|
||||||
system.stateVersion = "24.05";
|
|
||||||
}
|
|
||||||
@@ -1,83 +0,0 @@
|
|||||||
{
|
|
||||||
# https://github.com/nix-community/disko/blob/master/example/boot-raid1.nix
|
|
||||||
# Note: Disko was used to create the initial md raid, but is no longer in active use on this host.
|
|
||||||
disko.devices = {
|
|
||||||
disk = {
|
|
||||||
one = {
|
|
||||||
type = "disk";
|
|
||||||
device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E2EER6N6";
|
|
||||||
content = {
|
|
||||||
type = "gpt";
|
|
||||||
partitions = {
|
|
||||||
ESP = {
|
|
||||||
size = "500M";
|
|
||||||
type = "EF00";
|
|
||||||
content = {
|
|
||||||
type = "mdraid";
|
|
||||||
name = "boot";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
mdadm = {
|
|
||||||
size = "100%";
|
|
||||||
content = {
|
|
||||||
type = "mdraid";
|
|
||||||
name = "raid1";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
two = {
|
|
||||||
type = "disk";
|
|
||||||
device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E7LPLU71";
|
|
||||||
content = {
|
|
||||||
type = "gpt";
|
|
||||||
partitions = {
|
|
||||||
ESP = {
|
|
||||||
size = "500M";
|
|
||||||
type = "EF00";
|
|
||||||
content = {
|
|
||||||
type = "mdraid";
|
|
||||||
name = "boot";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
mdadm = {
|
|
||||||
size = "100%";
|
|
||||||
content = {
|
|
||||||
type = "mdraid";
|
|
||||||
name = "raid1";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
mdadm = {
|
|
||||||
boot = {
|
|
||||||
type = "mdadm";
|
|
||||||
level = 1;
|
|
||||||
metadata = "1.0";
|
|
||||||
content = {
|
|
||||||
type = "filesystem";
|
|
||||||
format = "vfat";
|
|
||||||
mountpoint = "/boot";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
raid1 = {
|
|
||||||
type = "mdadm";
|
|
||||||
level = 1;
|
|
||||||
content = {
|
|
||||||
type = "gpt";
|
|
||||||
partitions.primary = {
|
|
||||||
size = "100%";
|
|
||||||
content = {
|
|
||||||
type = "filesystem";
|
|
||||||
format = "ext4";
|
|
||||||
mountpoint = "/";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,26 +0,0 @@
|
|||||||
{ config, pkgs, lib, ... }:
|
|
||||||
{
|
|
||||||
# Boot drives:
|
|
||||||
boot.swraid.enable = true;
|
|
||||||
|
|
||||||
# ZFS Data pool:
|
|
||||||
environment.systemPackages = with pkgs; [ zfs ];
|
|
||||||
boot = {
|
|
||||||
zfs = {
|
|
||||||
extraPools = [ "tank" ];
|
|
||||||
requestEncryptionCredentials = false;
|
|
||||||
};
|
|
||||||
supportedFilesystems = [ "zfs" ];
|
|
||||||
kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
|
|
||||||
};
|
|
||||||
services.zfs.autoScrub = {
|
|
||||||
enable = true;
|
|
||||||
interval = "Wed *-*-8..14 00:00:00";
|
|
||||||
};
|
|
||||||
|
|
||||||
# NFS Exports:
|
|
||||||
#TODO
|
|
||||||
|
|
||||||
# NFS Import mounts:
|
|
||||||
#TODO
|
|
||||||
}
|
|
||||||
@@ -1,52 +0,0 @@
|
|||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ "kvm-intel" ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
|
|
||||||
fsType = "btrfs";
|
|
||||||
options = [ "subvol=root" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/home" =
|
|
||||||
{ device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
|
|
||||||
fsType = "btrfs";
|
|
||||||
options = [ "subvol=home" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/nix" =
|
|
||||||
{ device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
|
|
||||||
fsType = "btrfs";
|
|
||||||
options = [ "subvol=nix" "noatime" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" =
|
|
||||||
{ device = "/dev/sdc2";
|
|
||||||
fsType = "vfat";
|
|
||||||
options = [ "fmask=0022" "dmask=0022" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices = [ ];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
|
||||||
networking.useDHCP = lib.mkDefault false;
|
|
||||||
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
|
||||||
# networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
|
||||||
}
|
|
||||||
@@ -1,24 +1,22 @@
|
|||||||
{ fp, pkgs, values, ... }:
|
{ pkgs, values, ... }:
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
|
|
||||||
(fp /base)
|
../../base.nix
|
||||||
|
../../misc/metrics-exporters.nix
|
||||||
|
|
||||||
./services/alps.nix
|
./services/gitea/default.nix
|
||||||
./services/bluemap.nix
|
|
||||||
./services/idp-simplesamlphp
|
./services/idp-simplesamlphp
|
||||||
./services/kerberos.nix
|
./services/kerberos
|
||||||
./services/mediawiki
|
./services/mediawiki
|
||||||
./services/nginx.nix
|
./services/nginx.nix
|
||||||
./services/phpfpm.nix
|
|
||||||
./services/vaultwarden.nix
|
./services/vaultwarden.nix
|
||||||
./services/webmail
|
./services/webmail
|
||||||
./services/website
|
./services/website
|
||||||
./services/well-known
|
|
||||||
];
|
];
|
||||||
|
|
||||||
sops.defaultSopsFile = fp /secrets/bekkalokk/bekkalokk.yaml;
|
sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
|
||||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||||
sops.age.generateKey = true;
|
sops.age.generateKey = true;
|
||||||
@@ -33,8 +31,6 @@
|
|||||||
address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||||
};
|
};
|
||||||
|
|
||||||
services.btrfs.autoScrub.enable = true;
|
|
||||||
|
|
||||||
# Do not change, even during upgrades.
|
# Do not change, even during upgrades.
|
||||||
# See https://search.nixos.org/options?show=system.stateVersion
|
# See https://search.nixos.org/options?show=system.stateVersion
|
||||||
system.stateVersion = "22.11";
|
system.stateVersion = "22.11";
|
||||||
|
|||||||
@@ -1,22 +0,0 @@
|
|||||||
{ config, lib, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.alps;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
services.alps = {
|
|
||||||
enable = true;
|
|
||||||
theme = "sourcehut";
|
|
||||||
smtps.host = "smtp.pvv.ntnu.no";
|
|
||||||
imaps.host = "imap.pvv.ntnu.no";
|
|
||||||
bindIP = "127.0.0.1";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."alps.pvv.ntnu.no" = lib.mkIf cfg.enable {
|
|
||||||
enableACME = true;
|
|
||||||
forceSSL = true;
|
|
||||||
kTLS = true;
|
|
||||||
locations."/" = {
|
|
||||||
proxyPass = "http://${cfg.bindIP}:${toString cfg.port}";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,127 +0,0 @@
|
|||||||
{ config, lib, pkgs, inputs, ... }:
|
|
||||||
let
|
|
||||||
vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
|
|
||||||
format = pkgs.formats.hocon { };
|
|
||||||
in {
|
|
||||||
# NOTE: our versino of the module gets added in flake.nix
|
|
||||||
disabledModules = [ "services/web-apps/bluemap.nix" ];
|
|
||||||
|
|
||||||
sops.secrets."bluemap/ssh-key" = { };
|
|
||||||
sops.secrets."bluemap/ssh-known-hosts" = { };
|
|
||||||
|
|
||||||
services.bluemap = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
eula = true;
|
|
||||||
onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
|
|
||||||
|
|
||||||
host = "minecraft.pvv.ntnu.no";
|
|
||||||
|
|
||||||
maps = let
|
|
||||||
inherit (inputs.minecraft-kartverket.packages.${pkgs.stdenv.hostPlatform.system}) bluemap-export;
|
|
||||||
in {
|
|
||||||
"verden" = {
|
|
||||||
settings = {
|
|
||||||
world = vanillaSurvival;
|
|
||||||
dimension = "minecraft:overworld";
|
|
||||||
name = "Verden";
|
|
||||||
sorting = 0;
|
|
||||||
start-pos = {
|
|
||||||
x = 0;
|
|
||||||
z = 0;
|
|
||||||
};
|
|
||||||
ambient-light = 0.1;
|
|
||||||
cave-detection-ocean-floor = -5;
|
|
||||||
marker-sets = {
|
|
||||||
_includes = [ (format.lib.mkInclude "${bluemap-export}/overworld.hocon") ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
"underverden" = {
|
|
||||||
settings = {
|
|
||||||
world = vanillaSurvival;
|
|
||||||
dimension = "minecraft:the_nether";
|
|
||||||
name = "Underverden";
|
|
||||||
sorting = 100;
|
|
||||||
start-pos = {
|
|
||||||
x = 0;
|
|
||||||
z = 0;
|
|
||||||
};
|
|
||||||
sky-color = "#290000";
|
|
||||||
void-color = "#150000";
|
|
||||||
sky-light = 1;
|
|
||||||
ambient-light = 0.6;
|
|
||||||
remove-caves-below-y = -10000;
|
|
||||||
cave-detection-ocean-floor = -5;
|
|
||||||
cave-detection-uses-block-light = true;
|
|
||||||
render-mask = [{
|
|
||||||
max-y = 90;
|
|
||||||
}];
|
|
||||||
marker-sets = {
|
|
||||||
_includes = [ (format.lib.mkInclude "${bluemap-export}/nether.hocon") ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
"enden" = {
|
|
||||||
settings = {
|
|
||||||
world = vanillaSurvival;
|
|
||||||
dimension = "minecraft:the_end";
|
|
||||||
name = "Enden";
|
|
||||||
sorting = 200;
|
|
||||||
start-pos = {
|
|
||||||
x = 0;
|
|
||||||
z = 0;
|
|
||||||
};
|
|
||||||
sky-color = "#080010";
|
|
||||||
void-color = "#080010";
|
|
||||||
sky-light = 1;
|
|
||||||
ambient-light = 0.6;
|
|
||||||
remove-caves-below-y = -10000;
|
|
||||||
cave-detection-ocean-floor = -5;
|
|
||||||
marker-sets = {
|
|
||||||
_includes = [ (format.lib.mkInclude "${bluemap-export}/the-end.hocon") ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services."render-bluemap-maps" = {
|
|
||||||
serviceConfig = {
|
|
||||||
StateDirectory = [ "bluemap/world" ];
|
|
||||||
ExecStartPre = let
|
|
||||||
rsyncArgs = lib.cli.toCommandLineShellGNU { } {
|
|
||||||
archive = true;
|
|
||||||
compress = true;
|
|
||||||
verbose = true;
|
|
||||||
no-owner = true;
|
|
||||||
no-group = true;
|
|
||||||
rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
|
|
||||||
};
|
|
||||||
in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
|
|
||||||
LoadCredential = [
|
|
||||||
"sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
|
|
||||||
"ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."minecraft.pvv.ntnu.no" = {
|
|
||||||
enableACME = true;
|
|
||||||
forceSSL = true;
|
|
||||||
kTLS = true;
|
|
||||||
http3 = true;
|
|
||||||
quic = true;
|
|
||||||
http3_hq = true;
|
|
||||||
extraConfig = ''
|
|
||||||
# Enabling QUIC 0-RTT
|
|
||||||
ssl_early_data on;
|
|
||||||
|
|
||||||
quic_gso on;
|
|
||||||
quic_retry on;
|
|
||||||
add_header Alt-Svc 'h3=":$server_port"; ma=86400';
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedUDPPorts = [ 443 ];
|
|
||||||
}
|
|
||||||
@@ -15,9 +15,9 @@ let
|
|||||||
enable = true;
|
enable = true;
|
||||||
name = "git-runner-${name}"; url = "https://git.pvv.ntnu.no";
|
name = "git-runner-${name}"; url = "https://git.pvv.ntnu.no";
|
||||||
labels = [
|
labels = [
|
||||||
"debian-latest:docker://node:current-bookworm"
|
"debian-latest:docker://node:18-bullseye"
|
||||||
"ubuntu-latest:docker://node:current-bookworm"
|
"ubuntu-latest:docker://node:18-bullseye"
|
||||||
];
|
];
|
||||||
tokenFile = config.sops.secrets."gitea/runners/${name}".path;
|
tokenFile = config.sops.secrets."gitea/runners/${name}".path;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
@@ -27,15 +27,5 @@ lib.mkMerge [
|
|||||||
(mkRunner "alpha")
|
(mkRunner "alpha")
|
||||||
(mkRunner "beta")
|
(mkRunner "beta")
|
||||||
(mkRunner "epsilon")
|
(mkRunner "epsilon")
|
||||||
{
|
{ virtualisation.podman.enable = true; }
|
||||||
virtualisation.podman = {
|
|
||||||
enable = true;
|
|
||||||
defaultNetwork.settings.dns_enabled = true;
|
|
||||||
autoPrune.enable = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.dhcpcd.IPv6rs = false;
|
|
||||||
|
|
||||||
networking.firewall.interfaces."podman+".allowedUDPPorts = [53 5353];
|
|
||||||
}
|
|
||||||
]
|
]
|
||||||
144
hosts/bekkalokk/services/gitea/default.nix
Normal file
144
hosts/bekkalokk/services/gitea/default.nix
Normal file
@@ -0,0 +1,144 @@
|
|||||||
|
{ config, values, pkgs, lib, ... }:
|
||||||
|
let
|
||||||
|
cfg = config.services.gitea;
|
||||||
|
domain = "git.pvv.ntnu.no";
|
||||||
|
sshPort = 2222;
|
||||||
|
in {
|
||||||
|
imports = [
|
||||||
|
./ci.nix
|
||||||
|
./import-users.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
sops.secrets = {
|
||||||
|
"gitea/database" = {
|
||||||
|
owner = "gitea";
|
||||||
|
group = "gitea";
|
||||||
|
};
|
||||||
|
"gitea/email-password" = {
|
||||||
|
owner = "gitea";
|
||||||
|
group = "gitea";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.gitea = {
|
||||||
|
enable = true;
|
||||||
|
appName = "PVV Git";
|
||||||
|
|
||||||
|
database = {
|
||||||
|
type = "postgres";
|
||||||
|
host = "postgres.pvv.ntnu.no";
|
||||||
|
port = config.services.postgresql.settings.port;
|
||||||
|
passwordFile = config.sops.secrets."gitea/database".path;
|
||||||
|
createDatabase = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
mailerPasswordFile = config.sops.secrets."gitea/email-password".path;
|
||||||
|
|
||||||
|
# https://docs.gitea.com/administration/config-cheat-sheet
|
||||||
|
settings = {
|
||||||
|
server = {
|
||||||
|
DOMAIN = domain;
|
||||||
|
ROOT_URL = "https://${domain}/";
|
||||||
|
PROTOCOL = "http+unix";
|
||||||
|
SSH_PORT = sshPort;
|
||||||
|
START_SSH_SERVER = true;
|
||||||
|
START_LFS_SERVER = true;
|
||||||
|
LANDING_PAGE = "explore";
|
||||||
|
};
|
||||||
|
mailer = {
|
||||||
|
ENABLED = true;
|
||||||
|
FROM = "gitea@pvv.ntnu.no";
|
||||||
|
PROTOCOL = "smtp";
|
||||||
|
SMTP_ADDR = "smtp.pvv.ntnu.no";
|
||||||
|
SMTP_PORT = 587;
|
||||||
|
USER = "gitea@pvv.ntnu.no";
|
||||||
|
SUBJECT_PREFIX = "[pvv-git]";
|
||||||
|
};
|
||||||
|
indexer.REPO_INDEXER_ENABLED = true;
|
||||||
|
service = {
|
||||||
|
DISABLE_REGISTRATION = true;
|
||||||
|
ENABLE_NOTIFY_MAIL = true;
|
||||||
|
};
|
||||||
|
admin.DEFAULT_EMAIL_NOTIFICATIONS = "onmention";
|
||||||
|
session.COOKIE_SECURE = true;
|
||||||
|
database.LOG_SQL = false;
|
||||||
|
repository = {
|
||||||
|
PREFERRED_LICENSES = lib.concatStringsSep "," [
|
||||||
|
"AGPL-3.0-only"
|
||||||
|
"AGPL-3.0-or-later"
|
||||||
|
"Apache-2.0"
|
||||||
|
"BSD-3-Clause"
|
||||||
|
"CC-BY-4.0"
|
||||||
|
"CC-BY-NC-4.0"
|
||||||
|
"CC-BY-NC-ND-4.0"
|
||||||
|
"CC-BY-NC-SA-4.0"
|
||||||
|
"CC-BY-ND-4.0"
|
||||||
|
"CC-BY-SA-4.0"
|
||||||
|
"CC0-1.0"
|
||||||
|
"GPL-2.0-only"
|
||||||
|
"GPL-3.0-only"
|
||||||
|
"GPL-3.0-or-later"
|
||||||
|
"LGPL-3.0-linking-exception"
|
||||||
|
"LGPL-3.0-only"
|
||||||
|
"LGPL-3.0-or-later"
|
||||||
|
"MIT"
|
||||||
|
"MPL-2.0"
|
||||||
|
"Unlicense"
|
||||||
|
];
|
||||||
|
DEFAULT_REPO_UNITS = lib.concatStringsSep "," [
|
||||||
|
"repo.code"
|
||||||
|
"repo.issues"
|
||||||
|
"repo.pulls"
|
||||||
|
"repo.releases"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
picture = {
|
||||||
|
DISABLE_GRAVATAR = true;
|
||||||
|
ENABLE_FEDERATED_AVATAR = false;
|
||||||
|
};
|
||||||
|
actions.ENABLED = true;
|
||||||
|
"ui.meta".DESCRIPTION = "Bokstavelig talt programvareverkstedet";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
environment.systemPackages = [ cfg.package ];
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."${domain}" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
kTLS = true;
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://unix:${cfg.settings.server.HTTP_ADDR}";
|
||||||
|
extraConfig = ''
|
||||||
|
client_max_body_size 512M;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = [ sshPort ];
|
||||||
|
|
||||||
|
# Extra customization
|
||||||
|
|
||||||
|
services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
|
||||||
|
|
||||||
|
systemd.services.install-gitea-customization = {
|
||||||
|
description = "Install extra customization in gitea's CUSTOM_DIR";
|
||||||
|
wantedBy = [ "gitea.service" ];
|
||||||
|
requiredBy = [ "gitea.service" ];
|
||||||
|
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
User = cfg.user;
|
||||||
|
Group = cfg.group;
|
||||||
|
};
|
||||||
|
|
||||||
|
script = let
|
||||||
|
logo-svg = ../../../../assets/logo_blue_regular.svg;
|
||||||
|
logo-png = ../../../../assets/logo_blue_regular.png;
|
||||||
|
in ''
|
||||||
|
install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
|
||||||
|
install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
|
||||||
|
install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
}
|
||||||
94
hosts/bekkalokk/services/gitea/gitea-import-users.py
Normal file
94
hosts/bekkalokk/services/gitea/gitea-import-users.py
Normal file
@@ -0,0 +1,94 @@
|
|||||||
|
import requests
|
||||||
|
import secrets
|
||||||
|
import os
|
||||||
|
|
||||||
|
EMAIL_DOMAIN = os.getenv('EMAIL_DOMAIN')
|
||||||
|
if EMAIL_DOMAIN is None:
|
||||||
|
EMAIL_DOMAIN = 'pvv.ntnu.no'
|
||||||
|
|
||||||
|
API_TOKEN = os.getenv('API_TOKEN')
|
||||||
|
if API_TOKEN is None:
|
||||||
|
raise Exception('API_TOKEN not set')
|
||||||
|
|
||||||
|
GITEA_API_URL = os.getenv('GITEA_API_URL')
|
||||||
|
if GITEA_API_URL is None:
|
||||||
|
GITEA_API_URL = 'https://git.pvv.ntnu.no/api/v1'
|
||||||
|
|
||||||
|
BANNED_SHELLS = [
|
||||||
|
"/usr/bin/nologin",
|
||||||
|
"/usr/sbin/nologin",
|
||||||
|
"/sbin/nologin",
|
||||||
|
"/bin/false",
|
||||||
|
"/bin/msgsh",
|
||||||
|
]
|
||||||
|
|
||||||
|
existing_users = {}
|
||||||
|
|
||||||
|
|
||||||
|
# This function should only ever be called when adding users
|
||||||
|
# from the passwd file
|
||||||
|
def add_user(username, name):
|
||||||
|
user = {
|
||||||
|
"full_name": name,
|
||||||
|
"username": username,
|
||||||
|
"login_name": username,
|
||||||
|
"source_id": 1, # 1 = SMTP
|
||||||
|
}
|
||||||
|
|
||||||
|
if username not in existing_users:
|
||||||
|
user["password"] = secrets.token_urlsafe(32)
|
||||||
|
user["must_change_password"] = False
|
||||||
|
user["visibility"] = "private"
|
||||||
|
user["email"] = username + '@' + EMAIL_DOMAIN
|
||||||
|
|
||||||
|
r = requests.post(GITEA_API_URL + '/admin/users', json=user,
|
||||||
|
headers={'Authorization': 'token ' + API_TOKEN})
|
||||||
|
if r.status_code != 201:
|
||||||
|
print('ERR: Failed to create user ' + username + ': ' + r.text)
|
||||||
|
return
|
||||||
|
|
||||||
|
print('Created user ' + username)
|
||||||
|
existing_users[username] = user
|
||||||
|
|
||||||
|
else:
|
||||||
|
user["visibility"] = existing_users[username]["visibility"]
|
||||||
|
r = requests.patch(GITEA_API_URL + f'/admin/users/{username}',
|
||||||
|
json=user,
|
||||||
|
headers={'Authorization': 'token ' + API_TOKEN})
|
||||||
|
if r.status_code != 200:
|
||||||
|
print('ERR: Failed to update user ' + username + ': ' + r.text)
|
||||||
|
return
|
||||||
|
|
||||||
|
print('Updated user ' + username)
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
# Fetch existing users
|
||||||
|
r = requests.get(GITEA_API_URL + '/admin/users',
|
||||||
|
headers={'Authorization': 'token ' + API_TOKEN})
|
||||||
|
|
||||||
|
if r.status_code != 200:
|
||||||
|
raise Exception('Failed to get users: ' + r.text)
|
||||||
|
|
||||||
|
for user in r.json():
|
||||||
|
existing_users[user['login']] = user
|
||||||
|
|
||||||
|
# Read the file, add each user
|
||||||
|
with open("/tmp/passwd-import", 'r') as f:
|
||||||
|
for line in f.readlines():
|
||||||
|
uid = int(line.split(':')[2])
|
||||||
|
if uid < 1000:
|
||||||
|
continue
|
||||||
|
|
||||||
|
shell = line.split(':')[-1]
|
||||||
|
if shell in BANNED_SHELLS:
|
||||||
|
continue
|
||||||
|
|
||||||
|
username = line.split(':')[0]
|
||||||
|
name = line.split(':')[4].split(',')[0]
|
||||||
|
|
||||||
|
add_user(username, name)
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
main()
|
||||||
@@ -11,13 +11,9 @@ in
|
|||||||
|
|
||||||
systemd.services.gitea-import-users = lib.mkIf cfg.enable {
|
systemd.services.gitea-import-users = lib.mkIf cfg.enable {
|
||||||
enable = true;
|
enable = true;
|
||||||
preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
|
preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /tmp/passwd-import'';
|
||||||
environment.PASSWD_FILE_PATH = "/run/gitea-import-users/passwd";
|
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
|
ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
|
||||||
flakeIgnore = [
|
|
||||||
"E501" # Line over 80 chars lol
|
|
||||||
];
|
|
||||||
libraries = with pkgs.python3Packages; [ requests ];
|
libraries = with pkgs.python3Packages; [ requests ];
|
||||||
} (builtins.readFile ./gitea-import-users.py);
|
} (builtins.readFile ./gitea-import-users.py);
|
||||||
LoadCredential=[
|
LoadCredential=[
|
||||||
@@ -26,7 +22,6 @@ in
|
|||||||
];
|
];
|
||||||
DynamicUser="yes";
|
DynamicUser="yes";
|
||||||
EnvironmentFile=config.sops.secrets."gitea/import-user-env".path;
|
EnvironmentFile=config.sops.secrets."gitea/import-user-env".path;
|
||||||
RuntimeDirectory = "gitea-import-users";
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
Before Width: | Height: | Size: 1.1 MiB After Width: | Height: | Size: 1.1 MiB |
@@ -112,7 +112,7 @@ class PwAuth extends \SimpleSAML\Module\core\Auth\UserPassBase
|
|||||||
array_shift($groups);
|
array_shift($groups);
|
||||||
array_shift($groups);
|
array_shift($groups);
|
||||||
array_pop($groups);
|
array_pop($groups);
|
||||||
|
|
||||||
$info = posix_getpwnam($uid);
|
$info = posix_getpwnam($uid);
|
||||||
$group = $info['gid'];
|
$group = $info['gid'];
|
||||||
if (!in_array($group, $groups)) {
|
if (!in_array($group, $groups)) {
|
||||||
|
|||||||
@@ -58,7 +58,7 @@ $config = [
|
|||||||
/*
|
/*
|
||||||
* The following settings are *filesystem paths* which define where
|
* The following settings are *filesystem paths* which define where
|
||||||
* SimpleSAMLphp can find or write the following things:
|
* SimpleSAMLphp can find or write the following things:
|
||||||
* - 'cachedir': Where SimpleSAMLphp can write its cache.
|
* - 'cachedir': Where SimpleSAMLphp can write its cache.
|
||||||
* - 'loggingdir': Where to write logs. MUST be set to NULL when using a logging
|
* - 'loggingdir': Where to write logs. MUST be set to NULL when using a logging
|
||||||
* handler other than `file`.
|
* handler other than `file`.
|
||||||
* - 'datadir': Storage of general data.
|
* - 'datadir': Storage of general data.
|
||||||
|
|||||||
@@ -22,62 +22,62 @@ let
|
|||||||
# openssl req -newkey rsa:4096 -new -x509 -days 365 -nodes -out idp.crt -keyout idp.pem
|
# openssl req -newkey rsa:4096 -new -x509 -days 365 -nodes -out idp.crt -keyout idp.pem
|
||||||
"metadata/saml20-idp-hosted.php" = pkgs.writeText "saml20-idp-remote.php" ''
|
"metadata/saml20-idp-hosted.php" = pkgs.writeText "saml20-idp-remote.php" ''
|
||||||
<?php
|
<?php
|
||||||
$metadata['https://idp.pvv.ntnu.no/'] = array(
|
$metadata['https://idp.pvv.ntnu.no/'] = array(
|
||||||
'host' => '__DEFAULT__',
|
'host' => '__DEFAULT__',
|
||||||
'privatekey' => '${config.sops.secrets."idp/privatekey".path}',
|
'privatekey' => '${config.sops.secrets."idp/privatekey".path}',
|
||||||
'certificate' => '${./idp.crt}',
|
'certificate' => '${./idp.crt}',
|
||||||
'auth' => 'pwauth',
|
'auth' => 'pwauth',
|
||||||
);
|
);
|
||||||
?>
|
?>
|
||||||
'';
|
'';
|
||||||
|
|
||||||
"metadata/saml20-sp-remote.php" = pkgs.writeText "saml20-sp-remote.php" ''
|
"metadata/saml20-sp-remote.php" = pkgs.writeText "saml20-sp-remote.php" ''
|
||||||
<?php
|
<?php
|
||||||
${ lib.pipe config.services.idp.sp-remote-metadata [
|
${ lib.pipe config.services.idp.sp-remote-metadata [
|
||||||
(map (url: ''
|
(map (url: ''
|
||||||
$metadata['${url}'] = [
|
$metadata['${url}'] = [
|
||||||
'SingleLogoutService' => [
|
'SingleLogoutService' => [
|
||||||
[
|
[
|
||||||
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
|
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
|
||||||
'Location' => '${url}module.php/saml/sp/saml2-logout.php/default-sp',
|
'Location' => '${url}module.php/saml/sp/saml2-logout.php/default-sp',
|
||||||
],
|
],
|
||||||
[
|
[
|
||||||
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP',
|
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP',
|
||||||
'Location' => '${url}module.php/saml/sp/saml2-logout.php/default-sp',
|
'Location' => '${url}module.php/saml/sp/saml2-logout.php/default-sp',
|
||||||
],
|
],
|
||||||
],
|
],
|
||||||
'AssertionConsumerService' => [
|
'AssertionConsumerService' => [
|
||||||
[
|
[
|
||||||
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
|
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
|
||||||
'Location' => '${url}module.php/saml/sp/saml2-acs.php/default-sp',
|
'Location' => '${url}module.php/saml/sp/saml2-acs.php/default-sp',
|
||||||
'index' => 0,
|
'index' => 0,
|
||||||
],
|
],
|
||||||
[
|
[
|
||||||
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact',
|
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact',
|
||||||
'Location' => '${url}module.php/saml/sp/saml2-acs.php/default-sp',
|
'Location' => '${url}module.php/saml/sp/saml2-acs.php/default-sp',
|
||||||
'index' => 1,
|
'index' => 1,
|
||||||
],
|
],
|
||||||
],
|
],
|
||||||
];
|
];
|
||||||
''))
|
''))
|
||||||
(lib.concatStringsSep "\n")
|
(lib.concatStringsSep "\n")
|
||||||
]}
|
]}
|
||||||
?>
|
?>
|
||||||
'';
|
'';
|
||||||
|
|
||||||
"config/authsources.php" = pkgs.writeText "idp-authsources.php" ''
|
"config/authsources.php" = pkgs.writeText "idp-authsources.php" ''
|
||||||
<?php
|
<?php
|
||||||
$config = array(
|
$config = array(
|
||||||
'admin' => array(
|
'admin' => array(
|
||||||
'core:AdminPassword'
|
'core:AdminPassword'
|
||||||
),
|
),
|
||||||
'pwauth' => array(
|
'pwauth' => array(
|
||||||
'authpwauth:PwAuth',
|
'authpwauth:PwAuth',
|
||||||
'pwauth_bin_path' => '${lib.getExe pwAuthScript}',
|
'pwauth_bin_path' => '${lib.getExe pwAuthScript}',
|
||||||
'mail_domain' => '@pvv.ntnu.no',
|
'mail_domain' => '@pvv.ntnu.no',
|
||||||
),
|
),
|
||||||
);
|
);
|
||||||
?>
|
?>
|
||||||
'';
|
'';
|
||||||
|
|
||||||
"config/config.php" = pkgs.runCommandLocal "simplesamlphp-config.php" { } ''
|
"config/config.php" = pkgs.runCommandLocal "simplesamlphp-config.php" { } ''
|
||||||
@@ -108,7 +108,7 @@ in
|
|||||||
List of urls point to (simplesamlphp) service profiders, which the idp should trust.
|
List of urls point to (simplesamlphp) service profiders, which the idp should trust.
|
||||||
|
|
||||||
:::{.note}
|
:::{.note}
|
||||||
Make sure the url ends with a `/`
|
Make sure the url ends with a `/`
|
||||||
:::
|
:::
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
@@ -132,7 +132,7 @@ in
|
|||||||
owner = "idp";
|
owner = "idp";
|
||||||
group = "idp";
|
group = "idp";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
users.groups."idp" = { };
|
users.groups."idp" = { };
|
||||||
users.users."idp" = {
|
users.users."idp" = {
|
||||||
@@ -199,15 +199,9 @@ in
|
|||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
"^~ /simplesaml/".extraConfig = ''
|
"^~ /simplesaml/".extraConfig = ''
|
||||||
rewrite ^/simplesaml/(.*)$ /$1 redirect;
|
rewrite ^/simplesaml/(.*)$ /$1 redirect;
|
||||||
return 404;
|
return 404;
|
||||||
'';
|
'';
|
||||||
"/robots.txt" = {
|
|
||||||
root = pkgs.writeTextDir "robots.txt" ''
|
|
||||||
User-agent: *
|
|
||||||
Disallow: /
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|||||||
88
hosts/bekkalokk/services/kerberos/krb5-conf-format.nix
Normal file
88
hosts/bekkalokk/services/kerberos/krb5-conf-format.nix
Normal file
@@ -0,0 +1,88 @@
|
|||||||
|
{ pkgs, lib, ... }:
|
||||||
|
|
||||||
|
# Based on
|
||||||
|
# - https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html
|
||||||
|
# - https://manpages.debian.org/unstable/heimdal-docs/krb5.conf.5heimdal.en.html
|
||||||
|
|
||||||
|
let
|
||||||
|
inherit (lib) boolToString concatMapStringsSep concatStringsSep filter
|
||||||
|
isAttrs isBool isList mapAttrsToList mdDoc mkOption singleton splitString;
|
||||||
|
inherit (lib.types) attrsOf bool coercedTo either int listOf oneOf path
|
||||||
|
str submodule;
|
||||||
|
in
|
||||||
|
{ }: {
|
||||||
|
type = let
|
||||||
|
section = attrsOf relation;
|
||||||
|
relation = either (attrsOf value) value;
|
||||||
|
value = either (listOf atom) atom;
|
||||||
|
atom = oneOf [int str bool];
|
||||||
|
in submodule {
|
||||||
|
freeformType = attrsOf section;
|
||||||
|
options = {
|
||||||
|
include = mkOption {
|
||||||
|
default = [ ];
|
||||||
|
description = mdDoc ''
|
||||||
|
Files to include in the Kerberos configuration.
|
||||||
|
'';
|
||||||
|
type = coercedTo path singleton (listOf path);
|
||||||
|
};
|
||||||
|
includedir = mkOption {
|
||||||
|
default = [ ];
|
||||||
|
description = mdDoc ''
|
||||||
|
Directories containing files to include in the Kerberos configuration.
|
||||||
|
'';
|
||||||
|
type = coercedTo path singleton (listOf path);
|
||||||
|
};
|
||||||
|
module = mkOption {
|
||||||
|
default = [ ];
|
||||||
|
description = mdDoc ''
|
||||||
|
Modules to obtain Kerberos configuration from.
|
||||||
|
'';
|
||||||
|
type = coercedTo path singleton (listOf path);
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
generate = let
|
||||||
|
indent = str: concatMapStringsSep "\n" (line: " " + line) (splitString "\n" str);
|
||||||
|
|
||||||
|
formatToplevel = args @ {
|
||||||
|
include ? [ ],
|
||||||
|
includedir ? [ ],
|
||||||
|
module ? [ ],
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
sections = removeAttrs args [ "include" "includedir" "module" ];
|
||||||
|
in concatStringsSep "\n" (filter (x: x != "") [
|
||||||
|
(concatStringsSep "\n" (mapAttrsToList formatSection sections))
|
||||||
|
(concatMapStringsSep "\n" (m: "module ${m}") module)
|
||||||
|
(concatMapStringsSep "\n" (i: "include ${i}") include)
|
||||||
|
(concatMapStringsSep "\n" (i: "includedir ${i}") includedir)
|
||||||
|
]);
|
||||||
|
|
||||||
|
formatSection = name: section: ''
|
||||||
|
[${name}]
|
||||||
|
${indent (concatStringsSep "\n" (mapAttrsToList formatRelation section))}
|
||||||
|
'';
|
||||||
|
|
||||||
|
formatRelation = name: relation:
|
||||||
|
if isAttrs relation
|
||||||
|
then ''
|
||||||
|
${name} = {
|
||||||
|
${indent (concatStringsSep "\n" (mapAttrsToList formatValue relation))}
|
||||||
|
}''
|
||||||
|
else formatValue name relation;
|
||||||
|
|
||||||
|
formatValue = name: value:
|
||||||
|
if isList value
|
||||||
|
then concatMapStringsSep "\n" (formatAtom name) value
|
||||||
|
else formatAtom name value;
|
||||||
|
|
||||||
|
formatAtom = name: atom: let
|
||||||
|
v = if isBool atom then boolToString atom else toString atom;
|
||||||
|
in "${name} = ${v}";
|
||||||
|
in
|
||||||
|
name: value: pkgs.writeText name ''
|
||||||
|
${formatToplevel value}
|
||||||
|
'';
|
||||||
|
}
|
||||||
90
hosts/bekkalokk/services/kerberos/krb5.nix
Normal file
90
hosts/bekkalokk/services/kerberos/krb5.nix
Normal file
@@ -0,0 +1,90 @@
|
|||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
let
|
||||||
|
inherit (lib) mdDoc mkIf mkOption mkPackageOption mkRemovedOptionModule;
|
||||||
|
inherit (lib.types) bool;
|
||||||
|
|
||||||
|
mkRemovedOptionModule' = name: reason: mkRemovedOptionModule ["krb5" name] reason;
|
||||||
|
mkRemovedOptionModuleCfg = name: mkRemovedOptionModule' name ''
|
||||||
|
The option `krb5.${name}' has been removed. Use
|
||||||
|
`security.krb5.settings.${name}' for structured configuration.
|
||||||
|
'';
|
||||||
|
|
||||||
|
cfg = config.security.krb5;
|
||||||
|
format = import ./krb5-conf-format.nix { inherit pkgs lib; } { };
|
||||||
|
in {
|
||||||
|
imports = [
|
||||||
|
(mkRemovedOptionModuleCfg "libdefaults")
|
||||||
|
(mkRemovedOptionModuleCfg "realms")
|
||||||
|
(mkRemovedOptionModuleCfg "domain_realm")
|
||||||
|
(mkRemovedOptionModuleCfg "capaths")
|
||||||
|
(mkRemovedOptionModuleCfg "appdefaults")
|
||||||
|
(mkRemovedOptionModuleCfg "plugins")
|
||||||
|
(mkRemovedOptionModuleCfg "config")
|
||||||
|
(mkRemovedOptionModuleCfg "extraConfig")
|
||||||
|
(mkRemovedOptionModule' "kerberos" ''
|
||||||
|
The option `krb5.kerberos' has been moved to `security.krb5.package'.
|
||||||
|
'')
|
||||||
|
];
|
||||||
|
|
||||||
|
options = {
|
||||||
|
security.krb5 = {
|
||||||
|
enable = mkOption {
|
||||||
|
default = false;
|
||||||
|
description = mdDoc "Enable and configure Kerberos utilities";
|
||||||
|
type = bool;
|
||||||
|
};
|
||||||
|
|
||||||
|
package = mkPackageOption pkgs "krb5" {
|
||||||
|
example = "heimdal";
|
||||||
|
};
|
||||||
|
|
||||||
|
settings = mkOption {
|
||||||
|
default = { };
|
||||||
|
type = format.type;
|
||||||
|
description = mdDoc ''
|
||||||
|
Structured contents of the {file}`krb5.conf` file. See
|
||||||
|
{manpage}`krb5.conf(5)` for details about configuration.
|
||||||
|
'';
|
||||||
|
example = {
|
||||||
|
include = [ "/run/secrets/secret-krb5.conf" ];
|
||||||
|
includedir = [ "/run/secrets/secret-krb5.conf.d" ];
|
||||||
|
|
||||||
|
libdefaults = {
|
||||||
|
default_realm = "ATHENA.MIT.EDU";
|
||||||
|
};
|
||||||
|
|
||||||
|
realms = {
|
||||||
|
"ATHENA.MIT.EDU" = {
|
||||||
|
admin_server = "athena.mit.edu";
|
||||||
|
kdc = [
|
||||||
|
"athena01.mit.edu"
|
||||||
|
"athena02.mit.edu"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
domain_realm = {
|
||||||
|
"mit.edu" = "ATHENA.MIT.EDU";
|
||||||
|
};
|
||||||
|
|
||||||
|
logging = {
|
||||||
|
kdc = "SYSLOG:NOTICE";
|
||||||
|
admin_server = "SYSLOG:NOTICE";
|
||||||
|
default = "SYSLOG:NOTICE";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
environment = {
|
||||||
|
systemPackages = [ cfg.package ];
|
||||||
|
etc."krb5.conf".source = format.generate "krb5.conf" cfg.settings;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
meta.maintainers = builtins.attrValues {
|
||||||
|
inherit (lib.maintainers) dblsaiko h7x4;
|
||||||
|
};
|
||||||
|
}
|
||||||
1543
hosts/bekkalokk/services/kerberos/pam.nix
Normal file
1543
hosts/bekkalokk/services/kerberos/pam.nix
Normal file
File diff suppressed because it is too large
Load Diff
@@ -1,4 +1,4 @@
|
|||||||
{ pkgs, lib, fp, config, values, pkgs-unstable, ... }: let
|
{ pkgs, lib, config, values, pkgs-unstable, ... }: let
|
||||||
cfg = config.services.mediawiki;
|
cfg = config.services.mediawiki;
|
||||||
|
|
||||||
# "mediawiki"
|
# "mediawiki"
|
||||||
@@ -61,6 +61,7 @@ in {
|
|||||||
user = "mediawiki";
|
user = "mediawiki";
|
||||||
passwordFile = config.sops.secrets."mediawiki/postgres_password".path;
|
passwordFile = config.sops.secrets."mediawiki/postgres_password".path;
|
||||||
createLocally = false;
|
createLocally = false;
|
||||||
|
# TODO: create a normal database and copy over old data when the service is production ready
|
||||||
name = "mediawiki";
|
name = "mediawiki";
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -130,12 +131,6 @@ in {
|
|||||||
$wgVectorDefaultSidebarVisibleForAnonymousUser = true;
|
$wgVectorDefaultSidebarVisibleForAnonymousUser = true;
|
||||||
$wgVectorResponsive = true;
|
$wgVectorResponsive = true;
|
||||||
|
|
||||||
# Experimental dark mode support for Vector 2022
|
|
||||||
$wgVectorNightMode['beta'] = true;
|
|
||||||
$wgVectorNightMode['logged_out'] = true;
|
|
||||||
$wgVectorNightMode['logged_in'] = true;
|
|
||||||
$wgDefaultUserOptions['vector-theme'] = 'os';
|
|
||||||
|
|
||||||
# Misc
|
# Misc
|
||||||
$wgEmergencyContact = "${cfg.passwordSender}";
|
$wgEmergencyContact = "${cfg.passwordSender}";
|
||||||
$wgUseTeX = false;
|
$wgUseTeX = false;
|
||||||
@@ -204,7 +199,7 @@ in {
|
|||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
location ~ ^/simplesaml/(?<phpfile>.+?\.php)(?<pathinfo>/.*)?$ {
|
location ~ ^/simplesaml/(?<phpfile>.+?\.php)(?<pathinfo>/.*)?$ {
|
||||||
include ${pkgs.nginx}/conf/fastcgi_params;
|
include ${pkgs.nginx}/conf/fastcgi_params;
|
||||||
fastcgi_pass unix:${config.services.phpfpm.pools.mediawiki.socket};
|
fastcgi_pass unix:${config.services.phpfpm.pools.mediawiki.socket};
|
||||||
fastcgi_param SCRIPT_FILENAME ${simplesamlphp}/share/php/simplesamlphp/public/$phpfile;
|
fastcgi_param SCRIPT_FILENAME ${simplesamlphp}/share/php/simplesamlphp/public/$phpfile;
|
||||||
|
|
||||||
# Must be prepended with the baseurlpath
|
# Must be prepended with the baseurlpath
|
||||||
@@ -215,16 +210,16 @@ in {
|
|||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
"= /PNG/PVV-logo.svg".alias = fp /assets/logo_blue_regular.svg;
|
"= /PNG/PVV-logo.svg".alias = ../../../../assets/logo_blue_regular.svg;
|
||||||
"= /PNG/PVV-logo.png".alias = fp /assets/logo_blue_regular.png;
|
"= /PNG/PVV-logo.png".alias = ../../../../assets/logo_blue_regular.png;
|
||||||
"= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
|
"= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
|
||||||
buildInputs = with pkgs; [ imagemagick ];
|
buildInputs = with pkgs; [ imagemagick ];
|
||||||
} ''
|
} ''
|
||||||
magick \
|
convert \
|
||||||
${fp /assets/logo_blue_regular.png} \
|
|
||||||
-resize x64 \
|
-resize x64 \
|
||||||
-gravity center \
|
-gravity center \
|
||||||
-crop 64x64+0+0 \
|
-crop 64x64+0+0 \
|
||||||
|
${../../../../assets/logo_blue_regular.png} \
|
||||||
-flatten \
|
-flatten \
|
||||||
-colors 256 \
|
-colors 256 \
|
||||||
-background transparent \
|
-background transparent \
|
||||||
|
|||||||
@@ -58,7 +58,7 @@ $config = [
|
|||||||
/*
|
/*
|
||||||
* The following settings are *filesystem paths* which define where
|
* The following settings are *filesystem paths* which define where
|
||||||
* SimpleSAMLphp can find or write the following things:
|
* SimpleSAMLphp can find or write the following things:
|
||||||
* - 'cachedir': Where SimpleSAMLphp can write its cache.
|
* - 'cachedir': Where SimpleSAMLphp can write its cache.
|
||||||
* - 'loggingdir': Where to write logs. MUST be set to NULL when using a logging
|
* - 'loggingdir': Where to write logs. MUST be set to NULL when using a logging
|
||||||
* handler other than `file`.
|
* handler other than `file`.
|
||||||
* - 'datadir': Storage of general data.
|
* - 'datadir': Storage of general data.
|
||||||
|
|||||||
@@ -1,51 +0,0 @@
|
|||||||
{ lib, ... }:
|
|
||||||
let
|
|
||||||
pools = map (pool: "phpfpm-${pool}") [
|
|
||||||
"idp"
|
|
||||||
"mediawiki"
|
|
||||||
"pvv-nettsiden"
|
|
||||||
"roundcube"
|
|
||||||
"snappymail"
|
|
||||||
];
|
|
||||||
in
|
|
||||||
{
|
|
||||||
# Source: https://www.pierreblazquez.com/2023/06/17/how-to-harden-apache-php-fpm-daemons-using-systemd/
|
|
||||||
systemd.services = lib.genAttrs pools (_: {
|
|
||||||
serviceConfig = let
|
|
||||||
caps = [
|
|
||||||
"CAP_NET_BIND_SERVICE"
|
|
||||||
"CAP_SETGID"
|
|
||||||
"CAP_SETUID"
|
|
||||||
"CAP_CHOWN"
|
|
||||||
"CAP_KILL"
|
|
||||||
"CAP_IPC_LOCK"
|
|
||||||
"CAP_DAC_OVERRIDE"
|
|
||||||
];
|
|
||||||
in {
|
|
||||||
AmbientCapabilities = caps;
|
|
||||||
CapabilityBoundingSet = caps;
|
|
||||||
DeviceAllow = [ "" ];
|
|
||||||
LockPersonality = true;
|
|
||||||
MemoryDenyWriteExecute = false;
|
|
||||||
NoNewPrivileges = true;
|
|
||||||
PrivateMounts = true;
|
|
||||||
ProtectClock = true;
|
|
||||||
ProtectControlGroups = true;
|
|
||||||
ProtectHome = true;
|
|
||||||
ProtectHostname = true;
|
|
||||||
ProtectKernelLogs = true;
|
|
||||||
ProtectKernelModules = true;
|
|
||||||
ProtectKernelTunables = true;
|
|
||||||
RemoveIPC = true;
|
|
||||||
UMask = "0077";
|
|
||||||
RestrictNamespaces = "~mnt";
|
|
||||||
RestrictRealtime = true;
|
|
||||||
RestrictSUIDSGID = true;
|
|
||||||
SystemCallArchitectures = "native";
|
|
||||||
KeyringMode = "private";
|
|
||||||
SystemCallFilter = [
|
|
||||||
"@system-service"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
});
|
|
||||||
}
|
|
||||||
@@ -65,38 +65,4 @@ in {
|
|||||||
proxyWebsockets = true;
|
proxyWebsockets = true;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.vaultwarden = lib.mkIf cfg.enable {
|
|
||||||
serviceConfig = {
|
|
||||||
AmbientCapabilities = [ "" ];
|
|
||||||
CapabilityBoundingSet = [ "" ];
|
|
||||||
DeviceAllow = [ "" ];
|
|
||||||
LockPersonality = true;
|
|
||||||
NoNewPrivileges = true;
|
|
||||||
# MemoryDenyWriteExecute = true;
|
|
||||||
PrivateMounts = true;
|
|
||||||
PrivateUsers = true;
|
|
||||||
ProcSubset = "pid";
|
|
||||||
ProtectClock = true;
|
|
||||||
ProtectControlGroups = true;
|
|
||||||
ProtectHostname = true;
|
|
||||||
ProtectKernelLogs = true;
|
|
||||||
ProtectKernelModules = true;
|
|
||||||
ProtectKernelTunables = true;
|
|
||||||
RestrictAddressFamilies = [
|
|
||||||
"AF_INET"
|
|
||||||
"AF_INET6"
|
|
||||||
"AF_UNIX"
|
|
||||||
];
|
|
||||||
RemoveIPC = true;
|
|
||||||
RestrictNamespaces = true;
|
|
||||||
RestrictRealtime = true;
|
|
||||||
RestrictSUIDSGID = true;
|
|
||||||
SystemCallArchitectures = "native";
|
|
||||||
SystemCallFilter = [
|
|
||||||
"@system-service"
|
|
||||||
"~@privileged"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -4,13 +4,8 @@ with lib;
|
|||||||
let
|
let
|
||||||
cfg = config.services.roundcube;
|
cfg = config.services.roundcube;
|
||||||
domain = "webmail.pvv.ntnu.no";
|
domain = "webmail.pvv.ntnu.no";
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
sops.secrets."roundcube/postgres_password" = {
|
|
||||||
owner = "nginx";
|
|
||||||
group = "nginx";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.roundcube = {
|
services.roundcube = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
@@ -21,15 +16,10 @@ in
|
|||||||
custom_from
|
custom_from
|
||||||
]);
|
]);
|
||||||
|
|
||||||
dicts = with pkgs.aspellDicts; [ en en-computers nb nn fr de it ];
|
dicts = with pkgs.aspellDicts; [ en en-science en-computers nb nn fr de it ];
|
||||||
maxAttachmentSize = 20;
|
maxAttachmentSize = 20;
|
||||||
hostName = "roundcubeplaceholder.example.com";
|
hostName = "roundcubeplaceholder.example.com";
|
||||||
|
|
||||||
database = {
|
|
||||||
host = "postgres.pvv.ntnu.no";
|
|
||||||
passwordFile = config.sops.secrets."roundcube/postgres_password".path;
|
|
||||||
};
|
|
||||||
|
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
$config['enable_installer'] = false;
|
$config['enable_installer'] = false;
|
||||||
$config['default_host'] = "ssl://imap.pvv.ntnu.no";
|
$config['default_host'] = "ssl://imap.pvv.ntnu.no";
|
||||||
|
|||||||
@@ -1,8 +1,8 @@
|
|||||||
{ config, lib, fp, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
let
|
let
|
||||||
cfg = config.services.snappymail;
|
cfg = config.services.snappymail;
|
||||||
in {
|
in {
|
||||||
imports = [ (fp /modules/snappymail.nix) ];
|
imports = [ ../../../../modules/snappymail.nix ];
|
||||||
|
|
||||||
services.snappymail = {
|
services.snappymail = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|||||||
@@ -18,16 +18,11 @@ in {
|
|||||||
restartUnits = [ "phpfpm-pvv-nettsiden.service" ];
|
restartUnits = [ "phpfpm-pvv-nettsiden.service" ];
|
||||||
});
|
});
|
||||||
|
|
||||||
security.acme.certs."www.pvv.ntnu.no" = {
|
|
||||||
extraDomainNames = [
|
|
||||||
"pvv.ntnu.no"
|
|
||||||
"www.pvv.org"
|
|
||||||
"pvv.org"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
services.idp.sp-remote-metadata = [
|
services.idp.sp-remote-metadata = [
|
||||||
"https://www.pvv.ntnu.no/simplesaml/"
|
"https://www.pvv.ntnu.no/simplesaml/"
|
||||||
|
"https://pvv.ntnu.no/simplesaml/"
|
||||||
|
"https://www.pvv.org/simplesaml/"
|
||||||
|
"https://pvv.org/simplesaml/"
|
||||||
];
|
];
|
||||||
|
|
||||||
services.pvv-nettsiden = {
|
services.pvv-nettsiden = {
|
||||||
@@ -48,7 +43,7 @@ in {
|
|||||||
'idp' => 'https://idp.pvv.ntnu.no/',
|
'idp' => 'https://idp.pvv.ntnu.no/',
|
||||||
),
|
),
|
||||||
);
|
);
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -72,9 +67,7 @@ in {
|
|||||||
ADMIN_NAME = "PVV Drift";
|
ADMIN_NAME = "PVV Drift";
|
||||||
ADMIN_EMAIL = "drift@pvv.ntnu.no";
|
ADMIN_EMAIL = "drift@pvv.ntnu.no";
|
||||||
ADMIN_PASSWORD = includeFromSops "simplesamlphp/admin_password";
|
ADMIN_PASSWORD = includeFromSops "simplesamlphp/admin_password";
|
||||||
TRUSTED_DOMAINS = [
|
TRUSTED_DOMAINS = [ cfg.domainName ];
|
||||||
"www.pvv.ntnu.no"
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
@@ -85,28 +78,13 @@ in {
|
|||||||
"catch_workers_output" = true;
|
"catch_workers_output" = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
services.nginx.virtualHosts."pvv.ntnu.no" = {
|
|
||||||
globalRedirect = cfg.domainName;
|
|
||||||
redirectCode = 307;
|
|
||||||
forceSSL = true;
|
|
||||||
useACMEHost = "www.pvv.ntnu.no";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."www.pvv.org" = {
|
|
||||||
globalRedirect = cfg.domainName;
|
|
||||||
redirectCode = 307;
|
|
||||||
forceSSL = true;
|
|
||||||
useACMEHost = "www.pvv.ntnu.no";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."pvv.org" = {
|
|
||||||
globalRedirect = cfg.domainName;
|
|
||||||
redirectCode = 307;
|
|
||||||
forceSSL = true;
|
|
||||||
useACMEHost = "www.pvv.ntnu.no";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts.${cfg.domainName} = {
|
services.nginx.virtualHosts.${cfg.domainName} = {
|
||||||
|
serverAliases = [
|
||||||
|
"pvv.ntnu.no"
|
||||||
|
"www.pvv.org"
|
||||||
|
"pvv.org"
|
||||||
|
];
|
||||||
|
|
||||||
locations = {
|
locations = {
|
||||||
# Proxy home directories
|
# Proxy home directories
|
||||||
"^~ /~" = {
|
"^~ /~" = {
|
||||||
@@ -138,6 +116,16 @@ in {
|
|||||||
"/drift".return = "301 https://wiki.pvv.ntnu.no/wiki/Drift";
|
"/drift".return = "301 https://wiki.pvv.ntnu.no/wiki/Drift";
|
||||||
"/diverse/abuse.php".return = "301 https://wiki.pvv.ntnu.no/wiki/CERT/Abuse";
|
"/diverse/abuse.php".return = "301 https://wiki.pvv.ntnu.no/wiki/CERT/Abuse";
|
||||||
"/nerds/".return = "301 https://wiki.pvv.ntnu.no/wiki/Nerdepizza";
|
"/nerds/".return = "301 https://wiki.pvv.ntnu.no/wiki/Nerdepizza";
|
||||||
|
|
||||||
|
# Proxy the matrix well-known files
|
||||||
|
# Host has be set before proxy_pass
|
||||||
|
# The header must be set so nginx on the other side routes it to the right place
|
||||||
|
"^~ /.well-known/matrix/" = {
|
||||||
|
extraConfig = ''
|
||||||
|
proxy_set_header Host matrix.pvv.ntnu.no;
|
||||||
|
proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
|
||||||
|
'';
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -46,15 +46,15 @@ in {
|
|||||||
while IFS= read fname; do
|
while IFS= read fname; do
|
||||||
# Skip this file if an up-to-date thumbnail already exists
|
# Skip this file if an up-to-date thumbnail already exists
|
||||||
if [ -f ".thumbnails/$fname.png" ] && \
|
if [ -f ".thumbnails/$fname.png" ] && \
|
||||||
[ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
|
[ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
|
||||||
then
|
then
|
||||||
continue
|
continue
|
||||||
fi
|
fi
|
||||||
|
|
||||||
echo "Creating thumbnail for $fname"
|
echo "Creating thumbnail for $fname"
|
||||||
mkdir -p $(dirname ".thumbnails/$fname")
|
mkdir -p $(dirname ".thumbnails/$fname")
|
||||||
magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
|
convert -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
|
||||||
touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
|
touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
|
||||||
done <<< "$images"
|
done <<< "$images"
|
||||||
'';
|
'';
|
||||||
|
|
||||||
@@ -62,33 +62,6 @@ in {
|
|||||||
WorkingDirectory = galleryDir;
|
WorkingDirectory = galleryDir;
|
||||||
User = config.services.pvv-nettsiden.user;
|
User = config.services.pvv-nettsiden.user;
|
||||||
Group = config.services.pvv-nettsiden.group;
|
Group = config.services.pvv-nettsiden.group;
|
||||||
|
|
||||||
AmbientCapabilities = [ "" ];
|
|
||||||
CapabilityBoundingSet = [ "" ];
|
|
||||||
DeviceAllow = [ "" ];
|
|
||||||
LockPersonality = true;
|
|
||||||
MemoryDenyWriteExecute = true;
|
|
||||||
NoNewPrivileges = true; # disable for third party rotate scripts
|
|
||||||
PrivateDevices = true;
|
|
||||||
PrivateNetwork = true; # disable for mail delivery
|
|
||||||
PrivateTmp = true;
|
|
||||||
ProtectClock = true;
|
|
||||||
ProtectControlGroups = true;
|
|
||||||
ProtectHome = true; # disable for userdir logs
|
|
||||||
ProtectHostname = true;
|
|
||||||
ProtectKernelLogs = true;
|
|
||||||
ProtectKernelModules = true;
|
|
||||||
ProtectKernelTunables = true;
|
|
||||||
ProtectProc = "invisible";
|
|
||||||
ProtectSystem = "full";
|
|
||||||
RestrictNamespaces = true;
|
|
||||||
RestrictRealtime = true;
|
|
||||||
RestrictSUIDSGID = true; # disable for creating setgid directories
|
|
||||||
SocketBindDeny = [ "any" ];
|
|
||||||
SystemCallArchitectures = "native";
|
|
||||||
SystemCallFilter = [
|
|
||||||
"@system-service"
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,18 +0,0 @@
|
|||||||
{ ... }:
|
|
||||||
{
|
|
||||||
services.nginx.virtualHosts."www.pvv.ntnu.no".locations = {
|
|
||||||
"^~ /.well-known/" = {
|
|
||||||
alias = (toString ./root) + "/";
|
|
||||||
};
|
|
||||||
|
|
||||||
# Proxy the matrix well-known files
|
|
||||||
# Host has be set before proxy_pass
|
|
||||||
# The header must be set so nginx on the other side routes it to the right place
|
|
||||||
"^~ /.well-known/matrix/" = {
|
|
||||||
extraConfig = ''
|
|
||||||
proxy_set_header Host matrix.pvv.ntnu.no;
|
|
||||||
proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,31 +0,0 @@
|
|||||||
<?xml version="1.0"?>
|
|
||||||
<clientConfig version="1.1">
|
|
||||||
<emailProvider id="pvv.ntnu.no">
|
|
||||||
<domain>pvv.ntnu.no</domain>
|
|
||||||
<domain>pvv.org</domain>
|
|
||||||
|
|
||||||
<displayName>Programvareverkstedet</displayName>
|
|
||||||
|
|
||||||
<incomingServer type="imap">
|
|
||||||
<hostname>imap.pvv.ntnu.no</hostname>
|
|
||||||
<port>993</port>
|
|
||||||
<socketType>SSL</socketType>
|
|
||||||
<username>%EMAILLOCALPART%</username>
|
|
||||||
<authentication>password-cleartext</authentication>
|
|
||||||
</incomingServer>
|
|
||||||
|
|
||||||
<outgoingServer type="smtp">
|
|
||||||
<hostname>smtp.pvv.ntnu.no</hostname>
|
|
||||||
<port>587</port>
|
|
||||||
<socketType>STARTTLS</socketType>
|
|
||||||
<username>%EMAILLOCALPART%</username>
|
|
||||||
<authentication>password-cleartext</authentication>
|
|
||||||
<useGlobalPreferredServer>true</useGlobalPreferredServer>
|
|
||||||
</outgoingServer>
|
|
||||||
|
|
||||||
<documentation url="https://www.pvv.ntnu.no/pvv/Drift/Mail/IMAP_POP3">
|
|
||||||
<descr lang="en">Setup programvareverkstedet email user with IMAP or POP3</descr>
|
|
||||||
<descr lang="nb">Sett opp programvareverkstedet email bruker med IMAP eller POP3</descr>
|
|
||||||
</documentation>
|
|
||||||
</emailProvider>
|
|
||||||
</clientConfig>
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
Contact: mailto:drift@pvv.ntnu.no
|
|
||||||
Contact: mailto:cert@pvv.ntnu.no
|
|
||||||
# drift@pvv.ntnu.no is read by more people and have a quicker reaction time,
|
|
||||||
# but cert@pvv.ntnu.no can be used for more severe issues.
|
|
||||||
|
|
||||||
Preferred-Languages: no, en
|
|
||||||
|
|
||||||
Expires: 2032-12-31T23:59:59.000Z
|
|
||||||
# This file was last updated 2024-09-14.
|
|
||||||
|
|
||||||
# You can find a wikipage for our security policies at:
|
|
||||||
# https://wiki.pvv.ntnu.no/wiki/CERT
|
|
||||||
24
hosts/bicep/acmeCert.nix
Normal file
24
hosts/bicep/acmeCert.nix
Normal file
@@ -0,0 +1,24 @@
|
|||||||
|
{ values, ... }:
|
||||||
|
{
|
||||||
|
users.groups.acme.members = [ "nginx" ];
|
||||||
|
|
||||||
|
security.acme.certs."postgres.pvv.ntnu.no" = {
|
||||||
|
group = "acme";
|
||||||
|
extraDomainNames = [
|
||||||
|
# "postgres.pvv.org"
|
||||||
|
"bicep.pvv.ntnu.no"
|
||||||
|
# "bicep.pvv.org"
|
||||||
|
# values.hosts.bicep.ipv4
|
||||||
|
# values.hosts.bicep.ipv6
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
virtualHosts."postgres.pvv.ntnu.no" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
# useACMEHost = "postgres.pvv.ntnu.no";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -1,34 +1,35 @@
|
|||||||
{ fp, pkgs, values, ... }:
|
{ pkgs, values, ... }:
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
|
|
||||||
(fp /base)
|
../../base.nix
|
||||||
|
../../misc/metrics-exporters.nix
|
||||||
./services/nginx
|
./services/nginx
|
||||||
|
|
||||||
./services/calendar-bot.nix
|
./acmeCert.nix
|
||||||
#./services/git-mirrors
|
|
||||||
./services/minecraft-heatmap.nix
|
|
||||||
./services/mysql.nix
|
./services/mysql.nix
|
||||||
./services/postgres.nix
|
./services/postgres.nix
|
||||||
|
./services/mysql.nix
|
||||||
|
# TODO: fix the calendar bot
|
||||||
|
# ./services/calendar-bot.nix
|
||||||
|
|
||||||
./services/matrix
|
./services/matrix
|
||||||
];
|
];
|
||||||
|
|
||||||
sops.defaultSopsFile = fp /secrets/bicep/bicep.yaml;
|
sops.defaultSopsFile = ../../secrets/bicep/bicep.yaml;
|
||||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||||
sops.age.generateKey = true;
|
sops.age.generateKey = true;
|
||||||
|
|
||||||
boot.loader.systemd-boot.enable = true;
|
boot.loader.grub.enable = true;
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
boot.loader.grub.device = "/dev/disk/by-id/scsi-3600508b1001cb1a8751c137b30610682";
|
||||||
|
|
||||||
networking.hostName = "bicep";
|
networking.hostName = "bicep";
|
||||||
|
|
||||||
#systemd.network.networks."30-enp6s0f0" = values.defaultNetworkConfig // {
|
systemd.network.networks."30-enp6s0f0" = values.defaultNetworkConfig // {
|
||||||
systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
|
matchConfig.Name = "enp6s0f0";
|
||||||
#matchConfig.Name = "enp6s0f0";
|
|
||||||
matchConfig.Name = "ens18";
|
|
||||||
address = with values.hosts.bicep; [ (ipv4 + "/25") (ipv6 + "/64") ]
|
address = with values.hosts.bicep; [ (ipv4 + "/25") (ipv6 + "/64") ]
|
||||||
++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
|
++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
|
||||||
};
|
};
|
||||||
@@ -36,16 +37,6 @@
|
|||||||
anyInterface = true;
|
anyInterface = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
# There are no smart devices
|
|
||||||
services.smartd.enable = false;
|
|
||||||
|
|
||||||
# we are a vm now
|
|
||||||
services.qemuGuest.enable = true;
|
|
||||||
|
|
||||||
# Enable the OpenSSH daemon.
|
|
||||||
services.openssh.enable = true;
|
|
||||||
services.sshguard.enable = true;
|
|
||||||
|
|
||||||
# Do not change, even during upgrades.
|
# Do not change, even during upgrades.
|
||||||
# See https://search.nixos.org/options?show=system.stateVersion
|
# See https://search.nixos.org/options?show=system.stateVersion
|
||||||
system.stateVersion = "22.11";
|
system.stateVersion = "22.11";
|
||||||
|
|||||||
@@ -5,29 +5,22 @@
|
|||||||
|
|
||||||
{
|
{
|
||||||
imports =
|
imports =
|
||||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||||
];
|
];
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ahci" "sd_mod" "sr_mod" ];
|
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "hpsa" "ohci_pci" "usbhid" "sd_mod" ];
|
||||||
boot.initrd.kernelModules = [ ];
|
boot.initrd.kernelModules = [ ];
|
||||||
boot.kernelModules = [ ];
|
boot.kernelModules = [ "kvm-intel" ];
|
||||||
boot.extraModulePackages = [ ];
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
fileSystems."/" =
|
fileSystems."/" =
|
||||||
{ device = "/dev/disk/by-uuid/20e06202-7a09-47cc-8ef6-5e7afe19453a";
|
{ device = "/dev/disk/by-uuid/31a67903-dc00-448a-a24a-36e820318fe5";
|
||||||
fsType = "ext4";
|
fsType = "ext4";
|
||||||
};
|
};
|
||||||
|
|
||||||
# temp data disk, only 128gb not enough until we can add another disk to the system.
|
|
||||||
fileSystems."/data" =
|
fileSystems."/data" =
|
||||||
{ device = "/dev/disk/by-uuid/c81af266-0781-4084-b8eb-c2587cbcf1ba";
|
{ device = "/dev/disk/by-uuid/79e93eed-ad95-45c9-b115-4ef92afcc8c0";
|
||||||
fsType = "ext4";
|
fsType = "f2fs";
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" =
|
|
||||||
{ device = "/dev/disk/by-uuid/198B-E363";
|
|
||||||
fsType = "vfat";
|
|
||||||
options = [ "fmask=0022" "dmask=0022" ];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
swapDevices = [ ];
|
swapDevices = [ ];
|
||||||
@@ -37,7 +30,11 @@
|
|||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
networking.useDHCP = lib.mkDefault true;
|
networking.useDHCP = lib.mkDefault true;
|
||||||
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
|
# networking.interfaces.enp6s0f0.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp6s0f1.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp6s0f2.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp6s0f3.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,20 +1,12 @@
|
|||||||
{ config, fp, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
let
|
let
|
||||||
cfg = config.services.pvv-calendar-bot;
|
cfg = config.services.pvv-calendar-bot;
|
||||||
in {
|
in {
|
||||||
sops.secrets = {
|
sops.secrets."calendar-bot/matrix_token" = {
|
||||||
"calendar-bot/matrix_token" = {
|
sopsFile = ../../../secrets/bicep/bicep.yaml;
|
||||||
sopsFile = fp /secrets/bicep/bicep.yaml;
|
key = "calendar-bot/matrix_token";
|
||||||
key = "calendar-bot/matrix_token";
|
owner = cfg.user;
|
||||||
owner = cfg.user;
|
group = cfg.group;
|
||||||
group = cfg.group;
|
|
||||||
};
|
|
||||||
"calendar-bot/mysql_password" = {
|
|
||||||
sopsFile = fp /secrets/bicep/bicep.yaml;
|
|
||||||
key = "calendar-bot/mysql_password";
|
|
||||||
owner = cfg.user;
|
|
||||||
group = cfg.group;
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
services.pvv-calendar-bot = {
|
services.pvv-calendar-bot = {
|
||||||
@@ -26,11 +18,6 @@ in {
|
|||||||
user = "@bot_calendar:pvv.ntnu.no";
|
user = "@bot_calendar:pvv.ntnu.no";
|
||||||
channel = "!gkNLUIhYVpEyLatcRz:pvv.ntnu.no";
|
channel = "!gkNLUIhYVpEyLatcRz:pvv.ntnu.no";
|
||||||
};
|
};
|
||||||
database = {
|
|
||||||
host = "mysql.pvv.ntnu.no";
|
|
||||||
user = "calendar-bot";
|
|
||||||
passwordFile = config.sops.secrets."calendar-bot/mysql_password".path;
|
|
||||||
};
|
|
||||||
secretsFile = config.sops.secrets."calendar-bot/matrix_token".path;
|
secretsFile = config.sops.secrets."calendar-bot/matrix_token".path;
|
||||||
onCalendar = "*-*-* 09:00:00";
|
onCalendar = "*-*-* 09:00:00";
|
||||||
};
|
};
|
||||||
|
|||||||
@@ -1,100 +0,0 @@
|
|||||||
{ config, pkgs, lib, fp, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.gickup;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
sops.secrets."gickup/github-token" = {
|
|
||||||
owner = "gickup";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.gickup = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
dataDir = "/data/gickup";
|
|
||||||
|
|
||||||
destinationSettings = {
|
|
||||||
structured = true;
|
|
||||||
zip = false;
|
|
||||||
keep = 10;
|
|
||||||
bare = true;
|
|
||||||
lfs = false;
|
|
||||||
};
|
|
||||||
|
|
||||||
instances = let
|
|
||||||
defaultGithubConfig = {
|
|
||||||
settings.token_file = config.sops.secrets."gickup/github-token".path;
|
|
||||||
};
|
|
||||||
defaultGitlabConfig = {
|
|
||||||
# settings.token_file = ...
|
|
||||||
};
|
|
||||||
in {
|
|
||||||
"github:Git-Mediawiki/Git-Mediawiki" = defaultGithubConfig;
|
|
||||||
"github:NixOS/nixpkgs" = defaultGithubConfig;
|
|
||||||
"github:go-gitea/gitea" = defaultGithubConfig;
|
|
||||||
"github:heimdal/heimdal" = defaultGithubConfig;
|
|
||||||
"github:saltstack/salt" = defaultGithubConfig;
|
|
||||||
"github:typst/typst" = defaultGithubConfig;
|
|
||||||
"github:unmojang/FjordLauncher" = defaultGithubConfig;
|
|
||||||
"github:unmojang/drasl" = defaultGithubConfig;
|
|
||||||
"github:yushijinhun/authlib-injector" = defaultGithubConfig;
|
|
||||||
|
|
||||||
"gitlab:mx-puppet/discord/better-discord.js" = defaultGitlabConfig;
|
|
||||||
"gitlab:mx-puppet/discord/discord-markdown" = defaultGitlabConfig;
|
|
||||||
"gitlab:mx-puppet/discord/matrix-discord-parser" = defaultGitlabConfig;
|
|
||||||
"gitlab:mx-puppet/discord/mx-puppet-discord" = defaultGitlabConfig;
|
|
||||||
"gitlab:mx-puppet/mx-puppet-bridge" = defaultGitlabConfig;
|
|
||||||
|
|
||||||
"any:glibc" = {
|
|
||||||
settings.url = "https://sourceware.org/git/glibc.git";
|
|
||||||
};
|
|
||||||
|
|
||||||
"any:out-of-your-element" = {
|
|
||||||
settings.url = "https://gitdab.com/cadence/out-of-your-element.git";
|
|
||||||
};
|
|
||||||
|
|
||||||
"any:out-of-your-element-module" = {
|
|
||||||
settings.url = "https://cgit.rory.gay/nix/OOYE-module.git";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.cgit = let
|
|
||||||
domain = "mirrors.pvv.ntnu.no";
|
|
||||||
in {
|
|
||||||
${domain} = {
|
|
||||||
enable = true;
|
|
||||||
package = pkgs.callPackage (fp /packages/cgit.nix) { };
|
|
||||||
group = "gickup";
|
|
||||||
scanPath = "${cfg.dataDir}/linktree";
|
|
||||||
settings = {
|
|
||||||
enable-commit-graph = true;
|
|
||||||
enable-follow-links = true;
|
|
||||||
enable-http-clone = true;
|
|
||||||
enable-remote-branches = true;
|
|
||||||
clone-url = "https://${domain}/$CGIT_REPO_URL";
|
|
||||||
remove-suffix = true;
|
|
||||||
root-title = "PVVSPPP";
|
|
||||||
root-desc = "PVV Speiler Praktisk og Prominent Programvare";
|
|
||||||
snapshots = "all";
|
|
||||||
logo = "/PVV-logo.png";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."mirrors.pvv.ntnu.no" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
|
|
||||||
locations."= /PVV-logo.png".alias = let
|
|
||||||
small-pvv-logo = pkgs.runCommandLocal "pvv-logo-96x96" {
|
|
||||||
nativeBuildInputs = [ pkgs.imagemagick ];
|
|
||||||
} ''
|
|
||||||
magick '${fp /assets/logo_blue_regular.svg}' -resize 96x96 PNG:"$out"
|
|
||||||
'';
|
|
||||||
in toString small-pvv-logo;
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services."fcgiwrap-cgit-mirrors.pvv.ntnu.no" = {
|
|
||||||
serviceConfig.BindReadOnlyPaths = [ cfg.dataDir ];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,19 +1,17 @@
|
|||||||
{ config, lib, fp, pkgs, secrets, values, ... }:
|
{ config, lib, pkgs, secrets, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
sops.secrets."matrix/synapse/turnconfig" = {
|
sops.secrets."matrix/synapse/turnconfig" = {
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||||
key = "synapse/turnconfig";
|
key = "synapse/turnconfig";
|
||||||
owner = config.users.users.matrix-synapse.name;
|
owner = config.users.users.matrix-synapse.name;
|
||||||
group = config.users.users.matrix-synapse.group;
|
group = config.users.users.matrix-synapse.group;
|
||||||
restartUnits = [ "coturn.service" ];
|
|
||||||
};
|
};
|
||||||
sops.secrets."matrix/coturn/static-auth-secret" = {
|
sops.secrets."matrix/coturn/static-auth-secret" = {
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||||
key = "coturn/static-auth-secret";
|
key = "coturn/static-auth-secret";
|
||||||
owner = config.users.users.turnserver.name;
|
owner = config.users.users.turnserver.name;
|
||||||
group = config.users.users.turnserver.group;
|
group = config.users.users.turnserver.group;
|
||||||
restartUnits = [ "coturn.service" ];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
services.matrix-synapse-next = {
|
services.matrix-synapse-next = {
|
||||||
@@ -28,7 +26,7 @@
|
|||||||
|
|
||||||
"turns:turn.pvv.ntnu.no:5349?transport=tcp"
|
"turns:turn.pvv.ntnu.no:5349?transport=tcp"
|
||||||
"turns:turn.pvv.ntnu.no:5349?transport=udp"
|
"turns:turn.pvv.ntnu.no:5349?transport=udp"
|
||||||
|
|
||||||
"turns:turn.pvv.ntnu.no:3478?transport=udp"
|
"turns:turn.pvv.ntnu.no:3478?transport=udp"
|
||||||
"turns:turn.pvv.ntnu.no:3478?transport=tcp"
|
"turns:turn.pvv.ntnu.no:3478?transport=tcp"
|
||||||
"turn:turn.pvv.ntnu.no:3478?transport=udp"
|
"turn:turn.pvv.ntnu.no:3478?transport=udp"
|
||||||
@@ -44,15 +42,12 @@
|
|||||||
|
|
||||||
security.acme.certs.${config.services.coturn.realm} = {
|
security.acme.certs.${config.services.coturn.realm} = {
|
||||||
email = "drift@pvv.ntnu.no";
|
email = "drift@pvv.ntnu.no";
|
||||||
listenHTTP = "${values.services.turn.ipv4}:80";
|
listenHTTP = "129.241.210.213:80";
|
||||||
reloadServices = [ "coturn.service" ];
|
reloadServices = [ "coturn.service" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
users.users.turnserver.extraGroups = [ "acme" ];
|
users.users.turnserver.extraGroups = [ "acme" ];
|
||||||
|
|
||||||
# It needs this to be allowed to access the files with the acme group
|
|
||||||
systemd.services.coturn.serviceConfig.PrivateUsers = lib.mkForce false;
|
|
||||||
|
|
||||||
systemd.services."acme-${config.services.coturn.realm}".serviceConfig = {
|
systemd.services."acme-${config.services.coturn.realm}".serviceConfig = {
|
||||||
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
|
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
|
||||||
};
|
};
|
||||||
@@ -65,18 +60,16 @@
|
|||||||
pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
|
pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
|
||||||
|
|
||||||
use-auth-secret = true;
|
use-auth-secret = true;
|
||||||
|
# World readable but I dont think it's that bad
|
||||||
static-auth-secret-file = config.sops.secrets."matrix/coturn/static-auth-secret".path;
|
static-auth-secret-file = config.sops.secrets."matrix/coturn/static-auth-secret".path;
|
||||||
|
|
||||||
secure-stun = true;
|
secure-stun = true;
|
||||||
|
|
||||||
listening-ips = [
|
listening-ips = [ "129.241.210.213" "2001:700:300:1900::213" ];
|
||||||
values.services.turn.ipv4
|
|
||||||
values.services.turn.ipv6
|
|
||||||
];
|
|
||||||
|
|
||||||
tls-listening-port = 443;
|
tls-listening-port = 443;
|
||||||
alt-tls-listening-port = 5349;
|
alt-tls-listening-port = 5349;
|
||||||
|
|
||||||
listening-port = 3478;
|
listening-port = 3478;
|
||||||
|
|
||||||
min-port = 49000;
|
min-port = 49000;
|
||||||
@@ -123,7 +116,7 @@
|
|||||||
#total-quota=1200
|
#total-quota=1200
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall = {
|
networking.firewall = {
|
||||||
interfaces.enp6s0f0 = let
|
interfaces.enp6s0f0 = let
|
||||||
range = with config.services.coturn; [ {
|
range = with config.services.coturn; [ {
|
||||||
|
|||||||
@@ -9,11 +9,9 @@
|
|||||||
./coturn.nix
|
./coturn.nix
|
||||||
./mjolnir.nix
|
./mjolnir.nix
|
||||||
|
|
||||||
# ./discord.nix
|
./discord.nix
|
||||||
./out-of-your-element.nix
|
|
||||||
./hookshot
|
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
{ config, lib, fp, ... }:
|
{ config, lib, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
cfg = config.services.mx-puppet-discord;
|
cfg = config.services.mx-puppet-discord;
|
||||||
@@ -6,46 +6,19 @@ in
|
|||||||
{
|
{
|
||||||
users.groups.keys-matrix-registrations = { };
|
users.groups.keys-matrix-registrations = { };
|
||||||
|
|
||||||
sops.secrets."matrix/discord/as_token" = {
|
sops.secrets."matrix/registrations/mx-puppet-discord" = {
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||||
key = "discord/as_token";
|
key = "registrations/mx-puppet-discord";
|
||||||
};
|
|
||||||
sops.secrets."matrix/discord/hs_token" = {
|
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
|
||||||
key = "discord/hs_token";
|
|
||||||
};
|
|
||||||
|
|
||||||
sops.templates."discord-registration.yaml" = {
|
|
||||||
owner = config.users.users.matrix-synapse.name;
|
owner = config.users.users.matrix-synapse.name;
|
||||||
group = config.users.groups.keys-matrix-registrations.name;
|
group = config.users.groups.keys-matrix-registrations.name;
|
||||||
content = ''
|
|
||||||
as_token: "${config.sops.placeholder."matrix/discord/as_token"}"
|
|
||||||
hs_token: "${config.sops.placeholder."matrix/discord/hs_token"}"
|
|
||||||
id: discord-puppet
|
|
||||||
namespaces:
|
|
||||||
users:
|
|
||||||
- exclusive: true
|
|
||||||
regex: '@_discordpuppet_.*'
|
|
||||||
rooms: []
|
|
||||||
aliases:
|
|
||||||
- exclusive: true
|
|
||||||
regex: '#_discordpuppet_.*'
|
|
||||||
protocols: []
|
|
||||||
rate_limited: false
|
|
||||||
sender_localpart: _discordpuppet_bot
|
|
||||||
url: 'http://localhost:8434'
|
|
||||||
de.sorunome.msc2409.push_ephemeral: true
|
|
||||||
'';
|
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.mx-puppet-discord = {
|
systemd.services.mx-puppet-discord = {
|
||||||
serviceConfig.SupplementaryGroups = [
|
serviceConfig.SupplementaryGroups = [ config.users.groups.keys-matrix-registrations.name ];
|
||||||
config.users.groups.keys-matrix-registrations.name
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
||||||
services.mx-puppet-discord.enable = false;
|
services.mx-puppet-discord.enable = true;
|
||||||
services.mx-puppet-discord.settings = {
|
services.mx-puppet-discord.settings = {
|
||||||
bridge = {
|
bridge = {
|
||||||
bindAddress = "localhost";
|
bindAddress = "localhost";
|
||||||
@@ -56,16 +29,11 @@ in
|
|||||||
relay.whitelist = [ ".*" ];
|
relay.whitelist = [ ".*" ];
|
||||||
selfService.whitelist = [ "@danio:pvv\\.ntnu\\.no" "@dandellion:dodsorf\\.as" ];
|
selfService.whitelist = [ "@danio:pvv\\.ntnu\\.no" "@dandellion:dodsorf\\.as" ];
|
||||||
};
|
};
|
||||||
services.mx-puppet-discord.serviceDependencies = [
|
services.mx-puppet-discord.serviceDependencies = [ "matrix-synapse.target" "nginx.service" ];
|
||||||
"matrix-synapse.target"
|
|
||||||
"nginx.service"
|
|
||||||
];
|
|
||||||
|
|
||||||
|
|
||||||
services.matrix-synapse-next.settings = {
|
services.matrix-synapse-next.settings = {
|
||||||
app_service_config_files = [
|
app_service_config_files = [ config.sops.secrets."matrix/registrations/mx-puppet-discord".path ];
|
||||||
config.sops.templates."discord-registration.yaml".path
|
|
||||||
];
|
|
||||||
use_appservice_legacy_authorization = true;
|
use_appservice_legacy_authorization = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|||||||
@@ -1,142 +0,0 @@
|
|||||||
{ config, lib, fp, unstablePkgs, inputs, ... }:
|
|
||||||
|
|
||||||
let
|
|
||||||
cfg = config.services.matrix-hookshot;
|
|
||||||
webhookListenAddress = "127.0.0.1";
|
|
||||||
webhookListenPort = 8435;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
sops.secrets."matrix/hookshot/as_token" = {
|
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
|
||||||
key = "hookshot/as_token";
|
|
||||||
};
|
|
||||||
sops.secrets."matrix/hookshot/hs_token" = {
|
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
|
||||||
key = "hookshot/hs_token";
|
|
||||||
};
|
|
||||||
|
|
||||||
sops.templates."hookshot-registration.yaml" = {
|
|
||||||
owner = config.users.users.matrix-synapse.name;
|
|
||||||
group = config.users.groups.keys-matrix-registrations.name;
|
|
||||||
restartUnits = [ "matrix-hookshot.service" ];
|
|
||||||
content = ''
|
|
||||||
id: matrix-hookshot
|
|
||||||
as_token: "${config.sops.placeholder."matrix/hookshot/as_token"}"
|
|
||||||
hs_token: "${config.sops.placeholder."matrix/hookshot/hs_token"}"
|
|
||||||
namespaces:
|
|
||||||
rooms: []
|
|
||||||
users:
|
|
||||||
- regex: "@_webhooks_.*:pvv.ntnu.no"
|
|
||||||
exclusive: true
|
|
||||||
- regex: "@bot_feeds:pvv.ntnu.no"
|
|
||||||
exclusive: true
|
|
||||||
aliases: []
|
|
||||||
|
|
||||||
sender_localpart: hookshot
|
|
||||||
url: "http://${cfg.settings.bridge.bindAddress}:${toString cfg.settings.bridge.port}"
|
|
||||||
rate_limited: false
|
|
||||||
|
|
||||||
# If enabling encryption
|
|
||||||
de.sorunome.msc2409.push_ephemeral: true
|
|
||||||
push_ephemeral: true
|
|
||||||
org.matrix.msc3202: true
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.matrix-hookshot = {
|
|
||||||
serviceConfig.SupplementaryGroups = [
|
|
||||||
config.users.groups.keys-matrix-registrations.name
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
services.matrix-hookshot = {
|
|
||||||
enable = true;
|
|
||||||
package = unstablePkgs.matrix-hookshot;
|
|
||||||
registrationFile = config.sops.templates."hookshot-registration.yaml".path;
|
|
||||||
settings = {
|
|
||||||
bridge = {
|
|
||||||
bindAddress = "127.0.0.1";
|
|
||||||
domain = "pvv.ntnu.no";
|
|
||||||
url = "https://matrix.pvv.ntnu.no";
|
|
||||||
mediaUrl = "https://matrix.pvv.ntnu.no";
|
|
||||||
port = 9993;
|
|
||||||
};
|
|
||||||
listeners = [
|
|
||||||
{
|
|
||||||
bindAddress = webhookListenAddress;
|
|
||||||
port = webhookListenPort;
|
|
||||||
resources = [
|
|
||||||
"webhooks"
|
|
||||||
# "metrics"
|
|
||||||
# "provisioning"
|
|
||||||
"widgets"
|
|
||||||
];
|
|
||||||
}
|
|
||||||
];
|
|
||||||
generic = {
|
|
||||||
enabled = true;
|
|
||||||
outbound = true;
|
|
||||||
urlPrefix = "https://hookshot.pvv.ntnu.no/webhook/";
|
|
||||||
userIdPrefix = "_webhooks_";
|
|
||||||
allowJsTransformationFunctions = true;
|
|
||||||
waitForComplete = false;
|
|
||||||
};
|
|
||||||
feeds = {
|
|
||||||
enabled = true;
|
|
||||||
pollIntervalSeconds = 600;
|
|
||||||
};
|
|
||||||
|
|
||||||
serviceBots = [
|
|
||||||
{ localpart = "bot_feeds";
|
|
||||||
displayname = "Aya";
|
|
||||||
avatar = ./feeds.png;
|
|
||||||
prefix = "!aya";
|
|
||||||
service = "feeds";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
|
|
||||||
widgets = {
|
|
||||||
roomSetupWidget.addOnInvite = false;
|
|
||||||
publicUrl = "https://hookshot.pvv.ntnu.no/widgetapi/v1/static";
|
|
||||||
};
|
|
||||||
|
|
||||||
permissions = [
|
|
||||||
# Users of the PVV Server
|
|
||||||
{ actor = "pvv.ntnu.no";
|
|
||||||
services = [ { service = "*"; level = "commands"; } ];
|
|
||||||
}
|
|
||||||
# Members of Medlem space (for people with their own hs)
|
|
||||||
{ actor = "!pZOTJQinWyyTWaeOgK:pvv.ntnu.no";
|
|
||||||
services = [ { service = "*"; level = "commands"; } ];
|
|
||||||
}
|
|
||||||
# Members of Drift
|
|
||||||
{ actor = "!eYgeufLrninXxQpYml:pvv.ntnu.no";
|
|
||||||
services = [ { service = "*"; level = "admin"; } ];
|
|
||||||
}
|
|
||||||
# Dan bootstrap
|
|
||||||
{ actor = "@dandellion:dodsorf.as";
|
|
||||||
services = [ { service = "*"; level = "admin"; } ];
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.matrix-hookshot.serviceDependencies = [
|
|
||||||
"matrix-synapse.target"
|
|
||||||
"nginx.service"
|
|
||||||
];
|
|
||||||
|
|
||||||
services.matrix-synapse-next.settings = {
|
|
||||||
app_service_config_files = [
|
|
||||||
config.sops.templates."hookshot-registration.yaml".path
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
|
|
||||||
enableACME = true;
|
|
||||||
addSSL = true;
|
|
||||||
locations."/" = {
|
|
||||||
proxyPass = "http://${webhookListenAddress}:${toString webhookListenPort}";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
Binary file not shown.
|
Before Width: | Height: | Size: 1.1 MiB |
@@ -1,18 +1,17 @@
|
|||||||
{ config, lib, fp, ... }:
|
{ config, lib, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
sops.secrets."matrix/mjolnir/access_token" = {
|
sops.secrets."matrix/mjolnir/access_token" = {
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||||
key = "mjolnir/access_token";
|
key = "mjolnir/access_token";
|
||||||
owner = config.users.users.mjolnir.name;
|
owner = config.users.users.mjolnir.name;
|
||||||
group = config.users.users.mjolnir.group;
|
group = config.users.users.mjolnir.group;
|
||||||
restartUnits = [ "mjolnir.service" ];
|
|
||||||
};
|
};
|
||||||
|
|
||||||
services.mjolnir = {
|
services.mjolnir = {
|
||||||
enable = true;
|
enable = true;
|
||||||
pantalaimon.enable = false;
|
pantalaimon.enable = false;
|
||||||
homeserverUrl = "https://matrix.pvv.ntnu.no";
|
homeserverUrl = http://127.0.0.1:8008;
|
||||||
accessTokenFile = config.sops.secrets."matrix/mjolnir/access_token".path;
|
accessTokenFile = config.sops.secrets."matrix/mjolnir/access_token".path;
|
||||||
managementRoom = "!gsdeCoWjvYRBrzuiRq:pvv.ntnu.no";
|
managementRoom = "!gsdeCoWjvYRBrzuiRq:pvv.ntnu.no";
|
||||||
protectedRooms = map (a: "https://matrix.to/#/${a}") [
|
protectedRooms = map (a: "https://matrix.to/#/${a}") [
|
||||||
|
|||||||
@@ -1,70 +0,0 @@
|
|||||||
{ config, pkgs, fp, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.matrix-ooye;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
users.groups.keys-matrix-registrations = { };
|
|
||||||
|
|
||||||
sops.secrets = {
|
|
||||||
"matrix/ooye/as_token" = {
|
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
|
||||||
key = "ooye/as_token";
|
|
||||||
restartUnits = [ "matrix-ooye.service" ];
|
|
||||||
};
|
|
||||||
"matrix/ooye/hs_token" = {
|
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
|
||||||
key = "ooye/hs_token";
|
|
||||||
restartUnits = [ "matrix-ooye.service" ];
|
|
||||||
};
|
|
||||||
"matrix/ooye/discord_token" = {
|
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
|
||||||
key = "ooye/discord_token";
|
|
||||||
restartUnits = [ "matrix-ooye.service" ];
|
|
||||||
};
|
|
||||||
"matrix/ooye/discord_client_secret" = {
|
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
|
||||||
key = "ooye/discord_client_secret";
|
|
||||||
restartUnits = [ "matrix-ooye.service" ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.matrix-ooye = {
|
|
||||||
enable = true;
|
|
||||||
homeserver = "https://matrix.pvv.ntnu.no";
|
|
||||||
homeserverName = "pvv.ntnu.no";
|
|
||||||
discordTokenPath = config.sops.secrets."matrix/ooye/discord_token".path;
|
|
||||||
discordClientSecretPath = config.sops.secrets."matrix/ooye/discord_client_secret".path;
|
|
||||||
bridgeOrigin = "https://ooye.pvv.ntnu.no";
|
|
||||||
|
|
||||||
enableSynapseIntegration = false;
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services."matrix-synapse" = {
|
|
||||||
after = [
|
|
||||||
"matrix-ooye-pre-start.service"
|
|
||||||
"network-online.target"
|
|
||||||
];
|
|
||||||
requires = [ "matrix-ooye-pre-start.service" ];
|
|
||||||
serviceConfig = {
|
|
||||||
LoadCredential = [
|
|
||||||
"matrix-ooye-registration:/var/lib/matrix-ooye/registration.yaml"
|
|
||||||
];
|
|
||||||
ExecStartPre = [
|
|
||||||
"+${pkgs.coreutils}/bin/cp /run/credentials/matrix-synapse.service/matrix-ooye-registration ${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
|
|
||||||
"+${pkgs.coreutils}/bin/chown matrix-synapse:keys-matrix-registrations ${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.matrix-synapse-next.settings = {
|
|
||||||
app_service_config_files = [
|
|
||||||
"${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx.virtualHosts."ooye.pvv.ntnu.no" = {
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
locations."/".proxyPass = "http://localhost:${cfg.socket}";
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,4 +1,4 @@
|
|||||||
{ lib, buildPythonPackage, fetchFromGitHub, setuptools }:
|
{ lib, buildPythonPackage, fetchFromGitHub }:
|
||||||
|
|
||||||
buildPythonPackage rec {
|
buildPythonPackage rec {
|
||||||
pname = "matrix-synapse-smtp-auth";
|
pname = "matrix-synapse-smtp-auth";
|
||||||
@@ -6,9 +6,6 @@ buildPythonPackage rec {
|
|||||||
|
|
||||||
src = ./.;
|
src = ./.;
|
||||||
|
|
||||||
pyproject = true;
|
|
||||||
build-system = [ setuptools ];
|
|
||||||
|
|
||||||
doCheck = false;
|
doCheck = false;
|
||||||
|
|
||||||
meta = with lib; {
|
meta = with lib; {
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
{ config, lib, fp, pkgs, values, inputs, ... }:
|
{ config, lib, pkgs, values, inputs, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
cfg = config.services.matrix-synapse-next;
|
cfg = config.services.matrix-synapse-next;
|
||||||
@@ -10,18 +10,23 @@ let
|
|||||||
in {
|
in {
|
||||||
sops.secrets."matrix/synapse/signing_key" = {
|
sops.secrets."matrix/synapse/signing_key" = {
|
||||||
key = "synapse/signing_key";
|
key = "synapse/signing_key";
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||||
owner = config.users.users.matrix-synapse.name;
|
owner = config.users.users.matrix-synapse.name;
|
||||||
group = config.users.users.matrix-synapse.group;
|
group = config.users.users.matrix-synapse.group;
|
||||||
};
|
};
|
||||||
|
|
||||||
sops.secrets."matrix/synapse/user_registration" = {
|
sops.secrets."matrix/synapse/user_registration" = {
|
||||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||||
key = "synapse/signing_key";
|
key = "synapse/signing_key";
|
||||||
owner = config.users.users.matrix-synapse.name;
|
owner = config.users.users.matrix-synapse.name;
|
||||||
group = config.users.users.matrix-synapse.group;
|
group = config.users.users.matrix-synapse.group;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
sops.secrets."matrix/sliding-sync/env" = {
|
||||||
|
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||||
|
key = "sliding-sync/env";
|
||||||
|
};
|
||||||
|
|
||||||
services.matrix-synapse-next = {
|
services.matrix-synapse-next = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
@@ -38,6 +43,8 @@ in {
|
|||||||
workers.eventPersisters = 2;
|
workers.eventPersisters = 2;
|
||||||
workers.useUserDirectoryWorker = true;
|
workers.useUserDirectoryWorker = true;
|
||||||
|
|
||||||
|
enableSlidingSync = true;
|
||||||
|
|
||||||
enableNginx = true;
|
enableNginx = true;
|
||||||
|
|
||||||
settings = {
|
settings = {
|
||||||
@@ -124,19 +131,22 @@ in {
|
|||||||
"fec0::/10"
|
"fec0::/10"
|
||||||
|
|
||||||
# NTNU
|
# NTNU
|
||||||
values.ntnu.ipv4-space
|
"129.241.0.0/16"
|
||||||
values.ntnu.ipv6-space
|
"2001:700:300::/44"
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
services.redis.servers."".enable = true;
|
services.matrix-synapse.sliding-sync.environmentFile = config.sops.secrets."matrix/sliding-sync/env".path;
|
||||||
|
|
||||||
|
|
||||||
|
services.redis.servers."".enable = true;
|
||||||
|
|
||||||
services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
|
services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
|
||||||
{
|
({
|
||||||
kTLS = true;
|
kTLS = true;
|
||||||
}
|
})
|
||||||
{
|
({
|
||||||
locations."/.well-known/matrix/server" = {
|
locations."/.well-known/matrix/server" = {
|
||||||
return = ''
|
return = ''
|
||||||
200 '{"m.server": "matrix.pvv.ntnu.no:443"}'
|
200 '{"m.server": "matrix.pvv.ntnu.no:443"}'
|
||||||
@@ -146,43 +156,35 @@ in {
|
|||||||
add_header Access-Control-Allow-Origin *;
|
add_header Access-Control-Allow-Origin *;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
}
|
})
|
||||||
{
|
({
|
||||||
locations."/_synapse/admin" = {
|
|
||||||
proxyPass = "http://$synapse_backend";
|
|
||||||
extraConfig = ''
|
|
||||||
allow 127.0.0.1;
|
|
||||||
allow ::1;
|
|
||||||
allow ${values.hosts.bicep.ipv4};
|
|
||||||
allow ${values.hosts.bicep.ipv6};
|
|
||||||
deny all;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
}
|
|
||||||
{
|
|
||||||
locations = let
|
locations = let
|
||||||
connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
|
connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
|
||||||
socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString c.port}";
|
socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString (c.port)}";
|
||||||
|
|
||||||
metricsPath = w: "/metrics/${w.type}/${toString w.index}";
|
metricsPath = w: "/metrics/${w.type}/${toString w.index}";
|
||||||
proxyPath = w: "http://${socketAddress w}/_synapse/metrics";
|
proxyPath = w: "http://${socketAddress w}/_synapse/metrics";
|
||||||
in lib.mapAttrs' (n: v: lib.nameValuePair
|
in lib.mapAttrs' (n: v: lib.nameValuePair
|
||||||
(metricsPath v) {
|
(metricsPath v) ({
|
||||||
proxyPass = proxyPath v;
|
proxyPass = proxyPath v;
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
allow ${values.hosts.ildkule.ipv4};
|
allow ${values.hosts.ildkule.ipv4};
|
||||||
allow ${values.hosts.ildkule.ipv6};
|
allow ${values.hosts.ildkule.ipv6};
|
||||||
|
allow ${values.hosts.ildkule.ipv4_global};
|
||||||
|
allow ${values.hosts.ildkule.ipv6_global};
|
||||||
deny all;
|
deny all;
|
||||||
'';
|
'';
|
||||||
})
|
}))
|
||||||
cfg.workers.instances;
|
cfg.workers.instances;
|
||||||
}
|
})
|
||||||
{
|
({
|
||||||
locations."/metrics/master/1" = {
|
locations."/metrics/master/1" = {
|
||||||
proxyPass = "http://127.0.0.1:9000/_synapse/metrics";
|
proxyPass = "http://127.0.0.1:9000/_synapse/metrics";
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
allow ${values.hosts.ildkule.ipv4};
|
allow ${values.hosts.ildkule.ipv4};
|
||||||
allow ${values.hosts.ildkule.ipv6};
|
allow ${values.hosts.ildkule.ipv6};
|
||||||
|
allow ${values.hosts.ildkule.ipv4_global};
|
||||||
|
allow ${values.hosts.ildkule.ipv6_global};
|
||||||
deny all;
|
deny all;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
@@ -200,5 +202,5 @@ in {
|
|||||||
labels = { };
|
labels = { };
|
||||||
}]) + "/";
|
}]) + "/";
|
||||||
};
|
};
|
||||||
}];
|
})];
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,49 +0,0 @@
|
|||||||
{ config, lib, pkgs, ... }:
|
|
||||||
let
|
|
||||||
cfg = config.services.minecraft-heatmap;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
sops.secrets."minecraft-heatmap/ssh-key/private" = {
|
|
||||||
mode = "600";
|
|
||||||
};
|
|
||||||
|
|
||||||
sops.secrets."minecraft-heatmap/postgres-passwd" = {
|
|
||||||
mode = "600";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.minecraft-heatmap = {
|
|
||||||
enable = true;
|
|
||||||
database = {
|
|
||||||
host = "postgres.pvv.ntnu.no";
|
|
||||||
port = 5432;
|
|
||||||
name = "minecraft_heatmap";
|
|
||||||
user = "minecraft_heatmap";
|
|
||||||
passwordFile = config.sops.secrets."minecraft-heatmap/postgres-passwd".path;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.minecraft-heatmap-ingest-logs = {
|
|
||||||
serviceConfig.LoadCredential = [
|
|
||||||
"sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
|
|
||||||
];
|
|
||||||
|
|
||||||
preStart = let
|
|
||||||
knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
|
|
||||||
innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
|
|
||||||
innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
|
|
||||||
innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
|
|
||||||
'';
|
|
||||||
in ''
|
|
||||||
mkdir -p '${cfg.minecraftLogsDir}'
|
|
||||||
"${lib.getExe pkgs.rsync}" \
|
|
||||||
--archive \
|
|
||||||
--verbose \
|
|
||||||
--progress \
|
|
||||||
--no-owner \
|
|
||||||
--no-group \
|
|
||||||
--rsh="${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=\"${knownHostsFile}\" -i \"$CREDENTIALS_DIRECTORY\"/sshkey" \
|
|
||||||
root@innovation.pvv.ntnu.no:/ \
|
|
||||||
'${cfg.minecraftLogsDir}'/
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -15,12 +15,12 @@
|
|||||||
mysqld = {
|
mysqld = {
|
||||||
# PVV allows a lot of connections at the same time
|
# PVV allows a lot of connections at the same time
|
||||||
max_connect_errors = 10000;
|
max_connect_errors = 10000;
|
||||||
bind-address = values.services.mysql.ipv4;
|
bind-address = values.services.mysql.ipv4;
|
||||||
skip-networking = 0;
|
skip-networking = 0;
|
||||||
|
|
||||||
# This was needed in order to be able to use all of the old users
|
# This was needed in order to be able to use all of the old users
|
||||||
# during migration from knakelibrak to bicep in Sep. 2023
|
# during migration from knakelibrak to bicep in Sep. 2023
|
||||||
secure_auth = 0;
|
secure_auth = 0;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -48,8 +48,6 @@
|
|||||||
IPAddressAllow = [
|
IPAddressAllow = [
|
||||||
values.ipv4-space
|
values.ipv4-space
|
||||||
values.ipv6-space
|
values.ipv6-space
|
||||||
values.hosts.ildkule.ipv4
|
|
||||||
values.hosts.ildkule.ipv6
|
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,15 +1,18 @@
|
|||||||
{ config, pkgs, values, ... }:
|
{ config, pkgs, ... }:
|
||||||
|
let
|
||||||
|
sslCert = config.security.acme.certs."postgres.pvv.ntnu.no";
|
||||||
|
in
|
||||||
{
|
{
|
||||||
services.postgresql = {
|
services.postgresql = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = pkgs.postgresql_15;
|
package = pkgs.postgresql_15;
|
||||||
enableTCPIP = true;
|
enableTCPIP = true;
|
||||||
|
|
||||||
|
dataDir = "/data/postgresql";
|
||||||
|
|
||||||
authentication = ''
|
authentication = ''
|
||||||
host all all ${values.ipv4-space} md5
|
host all all 129.241.210.128/25 md5
|
||||||
host all all ${values.ipv6-space} md5
|
host all all 2001:700:300:1900::/64 md5
|
||||||
host all all ${values.hosts.ildkule.ipv4}/32 md5
|
|
||||||
host all all ${values.hosts.ildkule.ipv6}/32 md5
|
|
||||||
'';
|
'';
|
||||||
|
|
||||||
# Hilsen https://pgconfigurator.cybertec-postgresql.com/
|
# Hilsen https://pgconfigurator.cybertec-postgresql.com/
|
||||||
@@ -74,47 +77,14 @@
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.tmpfiles.settings."10-postgresql"."/data/postgresql".d = {
|
systemd.services.postgresql.serviceConfig = {
|
||||||
user = config.systemd.services.postgresql.serviceConfig.User;
|
LoadCredential = [
|
||||||
group = config.systemd.services.postgresql.serviceConfig.Group;
|
"cert:${sslCert.directory}/cert.pem"
|
||||||
mode = "0700";
|
"key:${sslCert.directory}/key.pem"
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.postgresql-setup = {
|
|
||||||
after = [
|
|
||||||
"systemd-tmpfiles-setup.service"
|
|
||||||
"systemd-tmpfiles-resetup.service"
|
|
||||||
];
|
];
|
||||||
serviceConfig = {
|
|
||||||
LoadCredential = [
|
|
||||||
"cert:/etc/certs/postgres.crt"
|
|
||||||
"key:/etc/certs/postgres.key"
|
|
||||||
];
|
|
||||||
|
|
||||||
BindPaths = [ "/data/postgresql:/var/lib/postgresql" ];
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.postgresql = {
|
users.groups.acme.members = [ "postgres" ];
|
||||||
after = [
|
|
||||||
"systemd-tmpfiles-setup.service"
|
|
||||||
"systemd-tmpfiles-resetup.service"
|
|
||||||
];
|
|
||||||
serviceConfig = {
|
|
||||||
LoadCredential = [
|
|
||||||
"cert:/etc/certs/postgres.crt"
|
|
||||||
"key:/etc/certs/postgres.key"
|
|
||||||
];
|
|
||||||
|
|
||||||
BindPaths = [ "/data/postgresql:/var/lib/postgresql" ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
environment.snakeoil-certs."/etc/certs/postgres" = {
|
|
||||||
owner = "postgres";
|
|
||||||
group = "postgres";
|
|
||||||
subject = "/C=NO/O=Programvareverkstedet/CN=postgres.pvv.ntnu.no/emailAddress=drift@pvv.ntnu.no";
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 5432 ];
|
networking.firewall.allowedTCPPorts = [ 5432 ];
|
||||||
networking.firewall.allowedUDPPorts = [ 5432 ];
|
networking.firewall.allowedUDPPorts = [ 5432 ];
|
||||||
|
|||||||
@@ -35,10 +35,10 @@
|
|||||||
# Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
|
# Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
|
||||||
useHostResolvConf = mkForce false;
|
useHostResolvConf = mkForce false;
|
||||||
};
|
};
|
||||||
|
|
||||||
system.stateVersion = "23.11";
|
system.stateVersion = "23.11";
|
||||||
services.resolved.enable = true;
|
services.resolved.enable = true;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
};
|
};
|
||||||
46
hosts/bob/configuration.nix
Normal file
46
hosts/bob/configuration.nix
Normal file
@@ -0,0 +1,46 @@
|
|||||||
|
{ config, pkgs, values, ... }:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
# Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
../../base.nix
|
||||||
|
../../misc/metrics-exporters.nix
|
||||||
|
./disks.nix
|
||||||
|
|
||||||
|
../../misc/builder.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
sops.defaultSopsFile = ../../secrets/bob/bob.yaml;
|
||||||
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||||
|
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||||
|
sops.age.generateKey = true;
|
||||||
|
|
||||||
|
boot.loader.grub = {
|
||||||
|
enable = true;
|
||||||
|
efiSupport = true;
|
||||||
|
efiInstallAsRemovable = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.hostName = "bob"; # Define your hostname.
|
||||||
|
|
||||||
|
systemd.network.networks."30-all" = values.defaultNetworkConfig // {
|
||||||
|
matchConfig.Name = "en*";
|
||||||
|
DHCP = "yes";
|
||||||
|
gateway = [ ];
|
||||||
|
};
|
||||||
|
|
||||||
|
# List packages installed in system profile
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
];
|
||||||
|
|
||||||
|
# List services that you want to enable:
|
||||||
|
|
||||||
|
# This value determines the NixOS release from which the default
|
||||||
|
# settings for stateful data, like file locations and database versions
|
||||||
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
# this value at the release version of the first install of this system.
|
||||||
|
# Before changing this value read the documentation for this option
|
||||||
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
|
system.stateVersion = "23.05"; # Did you read the comment?
|
||||||
|
|
||||||
|
}
|
||||||
39
hosts/bob/disks.nix
Normal file
39
hosts/bob/disks.nix
Normal file
@@ -0,0 +1,39 @@
|
|||||||
|
# Example to create a bios compatible gpt partition
|
||||||
|
{ lib, ... }:
|
||||||
|
{
|
||||||
|
disko.devices = {
|
||||||
|
disk.disk1 = {
|
||||||
|
device = lib.mkDefault "/dev/sda";
|
||||||
|
type = "disk";
|
||||||
|
content = {
|
||||||
|
type = "gpt";
|
||||||
|
partitions = {
|
||||||
|
boot = {
|
||||||
|
name = "boot";
|
||||||
|
size = "1M";
|
||||||
|
type = "EF02";
|
||||||
|
};
|
||||||
|
esp = {
|
||||||
|
name = "ESP";
|
||||||
|
size = "500M";
|
||||||
|
type = "EF00";
|
||||||
|
content = {
|
||||||
|
type = "filesystem";
|
||||||
|
format = "vfat";
|
||||||
|
mountpoint = "/boot";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
root = {
|
||||||
|
name = "root";
|
||||||
|
size = "100%";
|
||||||
|
content = {
|
||||||
|
type = "filesystem";
|
||||||
|
format = "ext4";
|
||||||
|
mountpoint = "/";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -8,32 +8,17 @@
|
|||||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||||
];
|
];
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
|
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_blk" ];
|
||||||
boot.initrd.kernelModules = [ ];
|
boot.initrd.kernelModules = [ ];
|
||||||
boot.kernelModules = [ ];
|
boot.kernelModules = [ ];
|
||||||
boot.extraModulePackages = [ ];
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
fileSystems."/" =
|
|
||||||
{ device = "/dev/disk/by-uuid/d421538f-a260-44ae-8e03-47cac369dcc1";
|
|
||||||
fsType = "btrfs";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" =
|
|
||||||
{ device = "/dev/disk/by-uuid/86CD-4C23";
|
|
||||||
fsType = "vfat";
|
|
||||||
options = [ "fmask=0077" "dmask=0077" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices =
|
|
||||||
[ { device = "/dev/disk/by-uuid/4cfbb41e-801f-40dd-8c58-0a0c1a6025f6"; }
|
|
||||||
];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
networking.useDHCP = lib.mkDefault true;
|
networking.useDHCP = lib.mkDefault true;
|
||||||
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
|
# networking.interfaces.ens3.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
}
|
}
|
||||||
@@ -1,9 +1,10 @@
|
|||||||
{ config, fp, pkgs, values, ... }:
|
{ config, pkgs, values, ... }:
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
# Include the results of the hardware scan.
|
# Include the results of the hardware scan.
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
(fp /base)
|
../../base.nix
|
||||||
|
../../misc/metrics-exporters.nix
|
||||||
|
|
||||||
./services/grzegorz.nix
|
./services/grzegorz.nix
|
||||||
];
|
];
|
||||||
|
|||||||
@@ -1,6 +1,6 @@
|
|||||||
{ config, fp, ... }:
|
{ config, ... }:
|
||||||
{
|
{
|
||||||
imports = [ (fp /modules/grzegorz.nix) ];
|
imports = [ ../../../modules/grzegorz.nix ];
|
||||||
|
|
||||||
services.nginx.virtualHosts."${config.networking.fqdn}" = {
|
services.nginx.virtualHosts."${config.networking.fqdn}" = {
|
||||||
serverAliases = [
|
serverAliases = [
|
||||||
|
|||||||
38
hosts/buskerud/configuration.nix
Normal file
38
hosts/buskerud/configuration.nix
Normal file
@@ -0,0 +1,38 @@
|
|||||||
|
{ config, pkgs, values, ... }:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./hardware-configuration.nix
|
||||||
|
../../base.nix
|
||||||
|
../../misc/metrics-exporters.nix
|
||||||
|
|
||||||
|
./services/libvirt.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
# buskerud does not support efi?
|
||||||
|
# boot.loader.systemd-boot.enable = true;
|
||||||
|
# boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
boot.loader.grub.enable = true;
|
||||||
|
boot.loader.grub.device = "/dev/sdb";
|
||||||
|
|
||||||
|
networking.hostName = "buskerud";
|
||||||
|
networking.search = [ "pvv.ntnu.no" "pvv.org" ];
|
||||||
|
networking.nameservers = [ "129.241.0.200" "129.241.0.201" ];
|
||||||
|
networking.tempAddresses = "disabled";
|
||||||
|
|
||||||
|
systemd.network.networks."enp3s0f0" = values.defaultNetworkConfig // {
|
||||||
|
matchConfig.Name = "enp3s0f0";
|
||||||
|
address = with values.hosts.buskerud; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||||
|
};
|
||||||
|
|
||||||
|
# List packages installed in system profile
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
];
|
||||||
|
|
||||||
|
# This value determines the NixOS release from which the default
|
||||||
|
# settings for stateful data, like file locations and database versions
|
||||||
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
# this value at the release version of the first install of this system.
|
||||||
|
# Before changing this value read the documentation for this option
|
||||||
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
|
system.stateVersion = "23.05"; # Did you read the comment?
|
||||||
|
}
|
||||||
@@ -8,32 +8,29 @@
|
|||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||||
];
|
];
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
|
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ata_piix" "hpsa" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
|
||||||
boot.initrd.kernelModules = [ ];
|
boot.initrd.kernelModules = [ ];
|
||||||
boot.kernelModules = [ "kvm-intel" ];
|
boot.kernelModules = [ "kvm-intel" ];
|
||||||
boot.extraModulePackages = [ ];
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
fileSystems."/" =
|
fileSystems."/" =
|
||||||
{ device = "/dev/disk/by-uuid/39ba059b-3205-4701-a832-e72c0122cb88";
|
{ device = "/dev/disk/by-uuid/ed9654fe-575a-4fb3-b6ff-1b059479acff";
|
||||||
fsType = "ext4";
|
fsType = "ext4";
|
||||||
};
|
};
|
||||||
|
|
||||||
fileSystems."/boot" =
|
swapDevices = [ ];
|
||||||
{ device = "/dev/disk/by-uuid/63FA-297B";
|
|
||||||
fsType = "vfat";
|
|
||||||
options = [ "fmask=0077" "dmask=0077" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices =
|
|
||||||
[ { device = "/dev/disk/by-uuid/9c72eb54-ea8c-4b09-808a-8be9b9a33869"; }
|
|
||||||
];
|
|
||||||
|
|
||||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
# still possible to use this option, but it's recommended to use it in conjunction
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
networking.useDHCP = lib.mkDefault true;
|
networking.useDHCP = lib.mkDefault true;
|
||||||
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
|
# networking.interfaces.enp14s0f0.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp14s0f1.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp3s0f0.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp3s0f1.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp4s0f0.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp4s0f1.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
10
hosts/buskerud/services/libvirt.nix
Normal file
10
hosts/buskerud/services/libvirt.nix
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
{ config, pkgs, lib, ... }:
|
||||||
|
{
|
||||||
|
virtualisation.libvirtd.enable = true;
|
||||||
|
programs.dconf.enable = true;
|
||||||
|
boot.kernelModules = [ "kvm-intel" ];
|
||||||
|
|
||||||
|
# On a gui-enabled machine, connect with:
|
||||||
|
# $ virt-manager --connect "qemu+ssh://buskerud/system?socket=/var/run/libvirt/libvirt-sock"
|
||||||
|
}
|
||||||
|
|
||||||
@@ -1,11 +1,13 @@
|
|||||||
{ config, fp, pkgs, values, ... }:
|
{ config, pkgs, values, ... }:
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
# Include the results of the hardware scan.
|
# Include the results of the hardware scan.
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
(fp /base)
|
../../base.nix
|
||||||
|
../../misc/metrics-exporters.nix
|
||||||
|
|
||||||
(fp /modules/grzegorz.nix)
|
../../modules/grzegorz.nix
|
||||||
|
../../modules/spotifyd.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
boot.loader.systemd-boot.enable = true;
|
boot.loader.systemd-boot.enable = true;
|
||||||
@@ -24,26 +26,6 @@
|
|||||||
|
|
||||||
# List services that you want to enable:
|
# List services that you want to enable:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
services.spotifyd = {
|
|
||||||
enable = true;
|
|
||||||
settings.global = {
|
|
||||||
device_name = "georg";
|
|
||||||
use_mpris = false;
|
|
||||||
#dbus_type = "system";
|
|
||||||
#zeroconf_port = 1234;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [
|
|
||||||
# config.services.spotifyd.settings.zeroconf_port
|
|
||||||
5353 # spotifyd is its own mDNS service wtf
|
|
||||||
];
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# This value determines the NixOS release from which the default
|
# This value determines the NixOS release from which the default
|
||||||
# settings for stateful data, like file locations and database versions
|
# settings for stateful data, like file locations and database versions
|
||||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
|||||||
@@ -1,15 +1,16 @@
|
|||||||
{ config, fp, pkgs, lib, values, ... }:
|
{ config, pkgs, values, ... }:
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
# Include the results of the hardware scan.
|
# Include the results of the hardware scan.
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
(fp /base)
|
../../base.nix
|
||||||
|
../../misc/metrics-exporters.nix
|
||||||
|
|
||||||
./services/monitoring
|
./services/monitoring
|
||||||
./services/nginx
|
./services/nginx
|
||||||
];
|
];
|
||||||
|
|
||||||
sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml;
|
sops.defaultSopsFile = ../../secrets/ildkule/ildkule.yaml;
|
||||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||||
sops.age.generateKey = true;
|
sops.age.generateKey = true;
|
||||||
@@ -18,37 +19,33 @@
|
|||||||
boot.tmp.cleanOnBoot = true;
|
boot.tmp.cleanOnBoot = true;
|
||||||
zramSwap.enable = true;
|
zramSwap.enable = true;
|
||||||
|
|
||||||
# Openstack Neutron and systemd-networkd are not best friends, use something else:
|
networking.hostName = "ildkule"; # Define your hostname.
|
||||||
systemd.network.enable = lib.mkForce false;
|
|
||||||
networking = let
|
|
||||||
hostConf = values.hosts.ildkule;
|
|
||||||
in {
|
|
||||||
hostName = "ildkule";
|
|
||||||
tempAddresses = "disabled";
|
|
||||||
useDHCP = lib.mkForce true;
|
|
||||||
|
|
||||||
search = values.defaultNetworkConfig.domains;
|
# Main connection, using the global/floatig IP, for communications with the world
|
||||||
nameservers = values.defaultNetworkConfig.dns;
|
systemd.network.networks."30-ntnu-global" = values.openstackGlobalNetworkConfig // {
|
||||||
defaultGateway.address = hostConf.ipv4_internal_gw;
|
matchConfig.Name = "ens4";
|
||||||
|
|
||||||
interfaces."ens4" = {
|
# Add the global addresses in addition to the local address learned from DHCP
|
||||||
ipv4.addresses = [
|
addresses = [
|
||||||
{ address = hostConf.ipv4; prefixLength = 32; }
|
{ addressConfig.Address = "${values.hosts.ildkule.ipv4_global}/32"; }
|
||||||
{ address = hostConf.ipv4_internal; prefixLength = 24; }
|
{ addressConfig.Address = "${values.hosts.ildkule.ipv6_global}/128"; }
|
||||||
];
|
];
|
||||||
ipv6.addresses = [
|
};
|
||||||
{ address = hostConf.ipv6; prefixLength = 64; }
|
|
||||||
];
|
# Secondary connection only for use within the university network
|
||||||
};
|
systemd.network.networks."40-ntnu-internal" = values.openstackLocalNetworkConfig // {
|
||||||
|
matchConfig.Name = "ens3";
|
||||||
|
# Add the ntnu-internal addresses in addition to the local address learned from DHCP
|
||||||
|
addresses = [
|
||||||
|
{ addressConfig.Address = "${values.hosts.ildkule.ipv4}/32"; }
|
||||||
|
{ addressConfig.Address = "${values.hosts.ildkule.ipv6}/128"; }
|
||||||
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
# List packages installed in system profile
|
# List packages installed in system profile
|
||||||
environment.systemPackages = with pkgs; [
|
environment.systemPackages = with pkgs; [
|
||||||
];
|
];
|
||||||
|
|
||||||
# No devices with SMART
|
|
||||||
services.smartd.enable = false;
|
|
||||||
|
|
||||||
system.stateVersion = "23.11"; # Did you read the comment?
|
system.stateVersion = "23.11"; # Did you read the comment?
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -3,14 +3,7 @@
|
|||||||
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
||||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
|
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
|
||||||
boot.initrd.kernelModules = [ "nvme" ];
|
boot.initrd.kernelModules = [ "nvme" ];
|
||||||
fileSystems."/" = {
|
fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; };
|
||||||
device = "/dev/disk/by-uuid/e35eb4ce-aac3-4f91-8383-6e7cd8bbf942";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
fileSystems."/data" = {
|
|
||||||
device = "/dev/disk/by-uuid/0a4c1234-02d3-4b53-aeca-d95c4c8d534b";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.useDHCP = lib.mkDefault true;
|
networking.useDHCP = lib.mkDefault true;
|
||||||
}
|
}
|
||||||
|
|||||||
File diff suppressed because it is too large
Load Diff
@@ -23187,4 +23187,4 @@
|
|||||||
"uid": "rYdddlPWk",
|
"uid": "rYdddlPWk",
|
||||||
"version": 9,
|
"version": 9,
|
||||||
"weekStart": ""
|
"weekStart": ""
|
||||||
}
|
}
|
||||||
@@ -3164,4 +3164,4 @@
|
|||||||
"title": "PostgreSQL Database",
|
"title": "PostgreSQL Database",
|
||||||
"uid": "000000039",
|
"uid": "000000039",
|
||||||
"version": 1
|
"version": 1
|
||||||
}
|
}
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user