Compare commits

..

2 Commits

Author SHA1 Message Date
h7x4
94841751e1 temmie/userweb: get first iteration working 2026-01-31 18:40:20 +09:00
h7x4
0131e5af6d temmie: combine homedirs in overlayfs 2026-01-30 04:00:17 +09:00
16 changed files with 22969 additions and 8914 deletions

24
flake.lock generated
View File

@@ -233,11 +233,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1769724120,
"narHash": "sha256-oQBM04hQk1kotfv4qmIG1tHmuwODd1+hqRJE5TELeCE=",
"rev": "8ec59ed5093c2a742d7744e9ecf58f358aa4a87d",
"lastModified": 1769484787,
"narHash": "sha256-ufhG9uSA8cCEk/97D/7xQEKcO/ftr4IPRH+HQFaKNdE=",
"rev": "999ca0e5484922624254294ea1adc2b90081579e",
"type": "tarball",
"url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.4961.8ec59ed5093c/nixexprs.tar.xz"
"url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.4804.999ca0e54849/nixexprs.tar.xz"
},
"original": {
"type": "tarball",
@@ -261,11 +261,11 @@
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1769813739,
"narHash": "sha256-RmNWW1DQczvDwBHu11P0hGwJZxbngdoymVu7qkwq/2M=",
"rev": "16a3cae5c2487b1afa240e5f2c1811f172419558",
"lastModified": 1769434638,
"narHash": "sha256-u19M4QdjvjEySkGhP4fUNyY6rqAbPCdQf/AFw04CkQU=",
"rev": "9c2822d7024c032e66000a8b8a47e91b4e63ffc8",
"type": "tarball",
"url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre937548.16a3cae5c248/nixexprs.tar.xz"
"url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre935000.9c2822d7024c/nixexprs.tar.xz"
},
"original": {
"type": "tarball",
@@ -364,11 +364,11 @@
"rust-overlay": "rust-overlay_3"
},
"locked": {
"lastModified": 1769834595,
"narHash": "sha256-P1jrO7BxHyIKDuOXHuUb7bi4H2TuYnACW5eqf1gG47g=",
"lastModified": 1769325266,
"narHash": "sha256-q2G2NG7I1tvfFK4GDnn3vt1CCg0GN4ncdo0NSY+Q2Nc=",
"ref": "main",
"rev": "def4eec2d59a69b4638b3f25d6d713b703b2fa56",
"revCount": 49,
"rev": "23b163e828901cb981eec6f3262e922f437f850b",
"revCount": 45,
"type": "git",
"url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
},

View File

@@ -56,7 +56,6 @@ in {
rrsyncArgs.ro = true;
authorizedKeysAttrs = [
"restrict"
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
"no-agent-forwarding"
"no-port-forwarding"
"no-pty"

View File

@@ -1,4 +1,4 @@
{ config, pkgs, lib, values, ... }:
{ config, pkgs, lib, ... }:
let
cfg = config.services.vaultwarden;
domain = "pw.pvv.ntnu.no";
@@ -99,21 +99,4 @@ in {
];
};
};
services.rsync-pull-targets = {
enable = true;
locations."/var/lib/vaultwarden" = {
user = "root";
rrsyncArgs.ro = true;
authorizedKeysAttrs = [
"restrict"
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
"no-agent-forwarding"
"no-port-forwarding"
"no-pty"
"no-X11-forwarding"
];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB2cDaW52gBtLVaNqoGijvN2ZAVkAWlII5AXUzT3Dswj vaultwarden rsync backup";
};
};
}

View File

@@ -1,4 +1,4 @@
{ config, lib, fp, pkgs, values, ... }:
{ config, lib, fp, pkgs, ... }:
let
cfg = config.services.snappymail;
in {
@@ -14,21 +14,5 @@ in {
enableACME = true;
kTLS = true;
};
services.rsync-pull-targets = {
enable = true;
locations.${cfg.dataDir} = {
user = "root";
rrsyncArgs.ro = true;
authorizedKeysAttrs = [
"restrict"
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
"no-agent-forwarding"
"no-port-forwarding"
"no-pty"
"no-X11-forwarding"
];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJENMnuNsHEeA91oX+cj7Qpex2defSXP/lxznxCAqV03 snappymail rsync backup";
};
};
}

View File

@@ -34,7 +34,6 @@ in {
rrsyncArgs.ro = true;
authorizedKeysAttrs = [
"restrict"
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
"no-agent-forwarding"
"no-port-forwarding"
"no-pty"

View File

@@ -1,4 +1,4 @@
{ config, lib, pkgs, values, ... }:
{ config, lib, pkgs, ... }:
let
cfg = config.services.mysql;
backupDir = "/data/mysql-backups";
@@ -22,7 +22,6 @@ in
rrsyncArgs.ro = true;
authorizedKeysAttrs = [
"restrict"
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
"no-agent-forwarding"
"no-port-forwarding"
"no-pty"
@@ -57,8 +56,8 @@ in
rm "$STATE_DIRECTORY/mysql-dump-latest.sql.zst" ||:
ln -T "$OUT_FILE" "$STATE_DIRECTORY/mysql-dump-latest.sql.zst"
while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt ${toString (rotations + 1)} ]; do
rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
while [ $(find -type f -printf '.' "$STATE_DIRECTORY" | wc -c) -gt ${toString (rotations + 1)} ]; do
rm $(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)
done
'';

View File

@@ -1,4 +1,4 @@
{ config, lib, pkgs, values, ... }:
{ config, lib, pkgs, ... }:
let
cfg = config.services.postgresql;
backupDir = "/data/postgresql-backups";
@@ -23,7 +23,6 @@ in
rrsyncArgs.ro = true;
authorizedKeysAttrs = [
"restrict"
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
"no-agent-forwarding"
"no-port-forwarding"
"no-pty"
@@ -58,8 +57,8 @@ in
rm "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst" ||:
ln -T "$OUT_FILE" "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst"
while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt ${toString (rotations + 1)} ]; do
rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
while [ $(find -type f -printf '.' "$STATE_DIRECTORY" | wc -c) -gt ${toString (rotations + 1)} ]; do
rm $(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)
done
'';

File diff suppressed because it is too large Load Diff

View File

@@ -13,7 +13,7 @@
]
},
"description": "",
"editable": false,
"editable": true,
"gnetId": 11323,
"graphTooltip": 1,
"id": 31,
@@ -1899,7 +1899,7 @@
"dashes": false,
"datasource": "$datasource",
"decimals": 0,
"description": "***System Memory***: Total Memory for the system.\\\n***InnoDB Buffer Pool Data***: InnoDB maintains a storage area called the buffer pool for caching data and indexes in memory.\\\n***TokuDB Cache Size***: Similar in function to the InnoDB Buffer Pool, TokuDB will allocate 50% of the installed RAM for its own cache.\\\n***Key Buffer Size***: Index blocks for MYISAM tables are buffered and are shared by all threads. key_buffer_size is the size of the buffer used for index blocks.\\\n***Adaptive Hash Index Size***: When InnoDB notices that some index values are being accessed very frequently, it builds a hash index for them in memory on top of B-Tree indexes.\\\n ***Query Cache Size***: The query cache stores the text of a SELECT statement together with the corresponding result that was sent to the client. The query cache has huge scalability problems in that only one thread can do an operation in the query cache at the same time.\\\n***InnoDB Dictionary Size***: The data dictionary is InnoDB s internal catalog of tables. InnoDB stores the data dictionary on disk, and loads entries into memory while the server is running.\\\n***InnoDB Log Buffer Size***: The MySQL InnoDB log buffer allows transactions to run without having to write the log to disk before the transactions commit.",
"description": "***System Memory***: Total Memory for the system.\\\n***InnoDB Buffer Pool Data***: InnoDB maintains a storage area called the buffer pool for caching data and indexes in memory.\\\n***TokuDB Cache Size***: Similar in function to the InnoDB Buffer Pool, TokuDB will allocate 50% of the installed RAM for its own cache.\\\n***Key Buffer Size***: Index blocks for MYISAM tables are buffered and are shared by all threads. key_buffer_size is the size of the buffer used for index blocks.\\\n***Adaptive Hash Index Size***: When InnoDB notices that some index values are being accessed very frequently, it builds a hash index for them in memory on top of B-Tree indexes.\\\n ***Query Cache Size***: The query cache stores the text of a SELECT statement together with the corresponding result that was sent to the client. The query cache has huge scalability problems in that only one thread can do an operation in the query cache at the same time.\\\n***InnoDB Dictionary Size***: The data dictionary is InnoDB 's internal catalog of tables. InnoDB stores the data dictionary on disk, and loads entries into memory while the server is running.\\\n***InnoDB Log Buffer Size***: The MySQL InnoDB log buffer allows transactions to run without having to write the log to disk before the transactions commit.",
"editable": true,
"error": false,
"fieldConfig": {
@@ -3690,7 +3690,7 @@
},
"hide": 0,
"includeAll": false,
"label": "Data source",
"label": "Data Source",
"multi": false,
"name": "datasource",
"options": [],
@@ -3713,12 +3713,12 @@
"definition": "label_values(mysql_up, job)",
"hide": 0,
"includeAll": true,
"label": "Job",
"label": "job",
"multi": true,
"name": "job",
"options": [],
"query": "label_values(mysql_up, job)",
"refresh": 2,
"refresh": 1,
"regex": "",
"skipUrlSync": false,
"sort": 0,
@@ -3742,12 +3742,12 @@
"definition": "label_values(mysql_up, instance)",
"hide": 0,
"includeAll": true,
"label": "Instance",
"label": "instance",
"multi": true,
"name": "instance",
"options": [],
"query": "label_values(mysql_up, instance)",
"refresh": 2,
"refresh": 1,
"regex": "",
"skipUrlSync": false,
"sort": 0,

View File

@@ -328,7 +328,7 @@
"rgba(50, 172, 45, 0.97)"
],
"datasource": "${DS_PROMETHEUS}",
"format": "short",
"format": "decbytes",
"gauge": {
"maxValue": 100,
"minValue": 0,
@@ -411,7 +411,7 @@
"rgba(50, 172, 45, 0.97)"
],
"datasource": "${DS_PROMETHEUS}",
"format": "short",
"format": "decbytes",
"gauge": {
"maxValue": 100,
"minValue": 0,
@@ -1410,7 +1410,7 @@
"tableColumn": "",
"targets": [
{
"expr": "pg_settings_seq_page_cost{instance=\"$instance\"}",
"expr": "pg_settings_seq_page_cost",
"format": "time_series",
"intervalFactor": 1,
"refId": "A"
@@ -1872,7 +1872,7 @@
},
"yaxes": [
{
"format": "short",
"format": "bytes",
"label": null,
"logBase": 1,
"max": null,
@@ -1966,7 +1966,7 @@
},
"yaxes": [
{
"format": "short",
"format": "bytes",
"label": null,
"logBase": 1,
"max": null,
@@ -2060,7 +2060,7 @@
},
"yaxes": [
{
"format": "short",
"format": "bytes",
"label": null,
"logBase": 1,
"max": null,
@@ -2251,7 +2251,7 @@
},
"yaxes": [
{
"format": "short",
"format": "bytes",
"label": null,
"logBase": 1,
"max": null,
@@ -2439,7 +2439,7 @@
},
"yaxes": [
{
"format": "short",
"format": "bytes",
"label": null,
"logBase": 1,
"max": null,
@@ -2589,35 +2589,35 @@
"steppedLine": false,
"targets": [
{
"expr": "irate(pg_stat_bgwriter_buffers_backend_total{instance=\"$instance\"}[5m])",
"expr": "irate(pg_stat_bgwriter_buffers_backend{instance=\"$instance\"}[5m])",
"format": "time_series",
"intervalFactor": 1,
"legendFormat": "buffers_backend",
"refId": "A"
},
{
"expr": "irate(pg_stat_bgwriter_buffers_alloc_total{instance=\"$instance\"}[5m])",
"expr": "irate(pg_stat_bgwriter_buffers_alloc{instance=\"$instance\"}[5m])",
"format": "time_series",
"intervalFactor": 1,
"legendFormat": "buffers_alloc",
"refId": "B"
},
{
"expr": "irate(pg_stat_bgwriter_buffers_backend_fsync_total{instance=\"$instance\"}[5m])",
"expr": "irate(pg_stat_bgwriter_buffers_backend_fsync{instance=\"$instance\"}[5m])",
"format": "time_series",
"intervalFactor": 1,
"legendFormat": "backend_fsync",
"refId": "C"
},
{
"expr": "irate(pg_stat_bgwriter_buffers_checkpoint_total{instance=\"$instance\"}[5m])",
"expr": "irate(pg_stat_bgwriter_buffers_checkpoint{instance=\"$instance\"}[5m])",
"format": "time_series",
"intervalFactor": 1,
"legendFormat": "buffers_checkpoint",
"refId": "D"
},
{
"expr": "irate(pg_stat_bgwriter_buffers_clean_total{instance=\"$instance\"}[5m])",
"expr": "irate(pg_stat_bgwriter_buffers_clean{instance=\"$instance\"}[5m])",
"format": "time_series",
"intervalFactor": 1,
"legendFormat": "buffers_clean",
@@ -2886,14 +2886,14 @@
"steppedLine": false,
"targets": [
{
"expr": "irate(pg_stat_bgwriter_checkpoint_write_time_total{instance=\"$instance\"}[5m])",
"expr": "irate(pg_stat_bgwriter_checkpoint_write_time{instance=\"$instance\"}[5m])",
"format": "time_series",
"intervalFactor": 1,
"legendFormat": "write_time - Total amount of time that has been spent in the portion of checkpoint processing where files are written to disk.",
"refId": "B"
},
{
"expr": "irate(pg_stat_bgwriter_checkpoint_sync_time_total{instance=\"$instance\"}[5m])",
"expr": "irate(pg_stat_bgwriter_checkpoint_sync_time{instance=\"$instance\"}[5m])",
"format": "time_series",
"intervalFactor": 1,
"legendFormat": "sync_time - Total amount of time that has been spent in the portion of checkpoint processing where files are synchronized to disk.",
@@ -3164,4 +3164,4 @@
"title": "PostgreSQL Database",
"uid": "000000039",
"version": 1
}
}

File diff suppressed because it is too large Load Diff

View File

@@ -47,13 +47,13 @@ in {
{
name = "Node Exporter Full";
type = "file";
url = "https://grafana.com/api/dashboards/1860/revisions/42/download";
url = "https://grafana.com/api/dashboards/1860/revisions/29/download";
options.path = dashboards/node-exporter-full.json;
}
{
name = "Matrix Synapse";
type = "file";
url = "https://github.com/element-hq/synapse/raw/refs/heads/develop/contrib/grafana/synapse.json";
url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
options.path = dashboards/synapse.json;
}
{
@@ -65,9 +65,15 @@ in {
{
name = "Postgresql";
type = "file";
url = "https://grafana.com/api/dashboards/9628/revisions/8/download";
url = "https://grafana.com/api/dashboards/9628/revisions/7/download";
options.path = dashboards/postgres.json;
}
{
name = "Go Processes (gogs)";
type = "file";
url = "https://grafana.com/api/dashboards/240/revisions/3/download";
options.path = dashboards/go-processes.json;
}
{
name = "Gitea Dashboard";
type = "file";

View File

@@ -202,7 +202,6 @@ in {
rrsyncArgs.ro = true;
authorizedKeysAttrs = [
"restrict"
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
"no-agent-forwarding"
"no-port-forwarding"
"no-pty"

View File

@@ -9,61 +9,26 @@ let
extensions = { all, ... }: with all; [
imagick
opcache
protobuf
];
extraConfig = ''
display_errors=0
post_max_size = 40M
upload_max_filesize = 40M
extension=sysvsem.so
'';
};
perlEnv = pkgs.perl.withPackages (ps: with ps; [
pkgs.exiftool
pkgs.ikiwiki
pkgs.irssi
pkgs.nix.libs.nix-perl-bindings
AlgorithmDiff
AnyEvent
AnyEventI3
ArchiveZip
CGI
CPAN
CPANPLUS
DBDPg
DBDSQLite
DBI
EmailAddress
EmailSimple
Env
Git
HTMLMason
HTMLParser
HTMLTagset
HTTPDAV
HTTPDaemon
ImageMagick
JSON
LWP
MozillaCA
PathTiny
Switch
SysSyslog
TestPostgreSQL
TextPDF
TieFile
Tk
URI
CGI
LWP
XMLLibXML
]);
# https://nixos.org/manual/nixpkgs/stable/#python.buildenv-function
pythonEnv = pkgs.python3.buildEnv.override {
extraLibs = with pkgs.python3Packages; [
legacy-cgi
matplotlib
requests
];
@@ -75,97 +40,24 @@ let
name = "userweb-env";
paths = with pkgs; [
bash
coreutils-full
perlEnv
phpEnv
pythonEnv
phpEnv
]
++ (with phpEnv.packages; [
# composer
])
++ [
acl
aspell
autoconf
autotrash
bazel
bintools
bison
bsd-finger
catdoc
ccache
clang
cmake
coreutils-full
curl
devcontainer
diffutils
emacs
# exiftags
exiftool
ffmpeg
file
findutils
gawk
gcc
glibc
gnugrep
gnumake
gnupg
gnuplot
gnused
gnutar
gzip
html-tidy
imagemagick
inetutils
iproute2
jhead
less
libgcc
lndir
mailutils
man # TODO: does this one want a mandb instance?
meson
more
mpc
mpi
mplayer
ninja
nix
openssh
openssl
patchelf
pkg-config
ppp
procmail
procps
qemu
rc
rhash
rsync
ruby # TODO: does this one want systemwide packages?
salt
sccache
sourceHighlight
spamassassin
strace
subversion
system-sendmail
systemdMinimal
texliveMedium
tmux
unzip
gawk
file
diffutils
gnugrep
util-linux
valgrind
vim
wget
which
wine
xdg-utils
zip
zstd
iproute2
curl
less
gnuplot
system-sendmail
];
extraOutputsToInstall = [
@@ -224,7 +116,6 @@ in
UserDir ${lib.concatMapStringsSep " " (l: "/home/pvv/${l}/*/web-docs") homeLetters}
UserDir disabled root
AddHandler cgi-script .cgi
DirectoryIndex index.html index.html.var index.php index.php3 index.cgi index.phtml index.shtml meg.html
<Directory "/home/pvv/?/*/web-docs">
Options MultiViews Indexes SymLinksIfOwnerMatch ExecCGI IncludesNoExec
@@ -268,7 +159,6 @@ in
ConfigurationDirectory = [ "httpd" ];
LogsDirectory = [ "httpd" ];
LogsDirectoryMode = "0700";
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
LockPersonality = true;

View File

@@ -73,10 +73,6 @@ in rec {
ipv4 = pvv-ipv4 179;
ipv6 = pvv-ipv6 "1:2";
};
principal = {
ipv4 = pvv-ipv4 233;
ipv6 = pvv-ipv6 "4:233";
};
ustetind = {
ipv4 = pvv-ipv4 234;
ipv6 = pvv-ipv6 234;