bicep/mysql: enable userstat

base/default.nix

@@ -46,6 +46,10 @@
 
   system.nixos.tags = lib.optionals (inputs.self.sourceInfo ? dirtyRev) [ "dirty" ];
 
+  specialisation."auto-upgrade".configuration = {
+    system.nixos.tags = [ "auto" ];
+  };
+
   boot.tmp.cleanOnBoot = lib.mkDefault true;
   boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
 

base/services/auto-upgrade.nix

@@ -13,6 +13,7 @@ in
 
       "--refresh"
       "--no-write-lock-file"
+      "--specialisation auto-upgrade"
       # --update-input is deprecated since nix 2.22, and removed in lix 2.90
       # as such we instead use --override-input combined with --refresh
       # https://git.lix.systems/lix-project/lix/issues/400

hosts/bekkalokk/configuration.nix

@@ -7,6 +7,7 @@
 
     ./services/alps.nix
     ./services/bluemap.nix
+    ./services/radicale.nix
     ./services/idp-simplesamlphp
     ./services/kerberos.nix
     ./services/mediawiki

hosts/bekkalokk/services/radicale.nix

@@ -0,0 +1,40 @@
+{ config, lib, ... }:
+let
+  domain = "dav.pvv.ntnu.no";
+  radicalePort = 5232;
+in {
+  services.radicale = {
+    enable = true;
+
+    settings = {
+      server = {
+        hosts = [ "127.0.0.1:${toString radicalePort}" ];
+      };
+
+      auth = {
+        type = "imap";
+        imap_host = "imap.pvv.ntnu.no";
+        imap_security = "tls";
+      };
+
+      storage = {
+        filesystem_folder = "/var/lib/radicale/collections";
+      };
+    };
+  };
+
+  services.nginx.virtualHosts."${domain}" = {
+    forceSSL = true;
+    enableACME = true;
+    kTLS = true;
+
+    extraConfig = ''
+      client_max_body_size 128M;
+    '';
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString radicalePort}";
+      proxyWebsockets = true;
+    };
+  };
+}

hosts/bekkalokk/services/webmail/default.nix

@@ -10,8 +10,9 @@
     enableACME = true;
     kTLS = true;
     locations = {
-      "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
+      # "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
 
+      "/roundcube".return = "302 https://webmail.pvv.ntnu.no/";
       "/afterlogic_lite".return = "302 https://webmail.pvv.ntnu.no/roundcube";
       "/squirrelmail".return = "302 https://webmail.pvv.ntnu.no/roundcube";
       "/rainloop".return = "302 https://snappymail.pvv.ntnu.no/";

hosts/bekkalokk/services/webmail/roundcube.nix

@@ -29,7 +29,7 @@ in
 
     dicts = with pkgs.aspellDicts; [ en en-computers nb nn fr de it ];
     maxAttachmentSize = 20;
-    hostName = "roundcubeplaceholder.example.com";
+    hostName = domain;
 
     database = {
       host = "postgres.pvv.ntnu.no";
@@ -49,44 +49,9 @@ in
     '';
   };
 
-  services.nginx.virtualHosts."roundcubeplaceholder.example.com" = lib.mkForce { };
+  # TODO: move this back to `webmail.pvv.ntnu.no/roundcube` subpath
 
   services.nginx.virtualHosts.${domain} = {
     kTLS = true;
-    locations."/roundcube" = {
-      tryFiles = "$uri $uri/ =404";
-      index = "index.php";
-      root = pkgs.linkFarm "roundcube-dir" {
-        roundcube = "${cfg.package}";
-      };
-
-      extraConfig = ''
-        location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
-        # https://wiki.archlinux.org/title/Roundcube
-        "README"
-        "INSTALL"
-        "LICENSE"
-        "CHANGELOG"
-        "UPGRADING"
-        "bin"
-        "SQL"
-        ".+\\.md"
-        "\\."
-        "config"
-        "temp"
-        "logs"
-        ]})/? {
-          deny all;
-        }
-
-        location ~ ^/roundcube/(.+\.php)(/?.*)$ {
-          fastcgi_split_path_info ^/roundcube(/.+\.php)(/.+)$;
-          include ${config.services.nginx.package}/conf/fastcgi_params;
-          include ${config.services.nginx.package}/conf/fastcgi.conf;
-          fastcgi_index index.php;
-          fastcgi_pass unix:${config.services.phpfpm.pools.roundcube.socket};
-        }
-      '';
-    };
   };
 }

hosts/bicep/services/mysql/default.nix

@@ -23,6 +23,9 @@ in
         bind-address = values.services.mysql.ipv4;
         skip-networking = 0;
 
+        # Useful for the mysqld prometheus exporter
+        userstat = 1;
+
         # This was needed in order to be able to use all of the old users
         # during migration from knakelibrak to bicep in Sep. 2023
         secure_auth = 0;
@@ -71,4 +74,16 @@ in
       ];
     };
   };
+
+  services.logrotate = lib.mkIf (cfg.settings.mysqld.slow-query-log == 1) {
+    enable = true;
+    settings.mysql-slowlog = {
+      files = [ cfg.settings.mysqld.slow-query-log-file ];
+      frequency = "weekly";
+      rotate = 12;
+      create = "0660 mysql mysql";
+      minsize = "1M";
+      compress = true;
+    };
+  };
 }

hosts/ildkule/services/monitoring/prometheus/exim.nix

@@ -1,14 +1,12 @@
 { ... }:
 {
-  services.prometheus = {
+  services.prometheus.scrapeConfigs = [{
-    scrapeConfigs = [
-      {
     job_name = "exim";
     scrape_interval = "15s";
+    scheme = "http";
+
     static_configs = [{
       targets = [ "microbel.pvv.ntnu.no:9636" ];
     }];
-      }
+  }];
-    ];
-  };
 }

hosts/lupine/configuration.nix

@@ -9,6 +9,12 @@
 
   sops.defaultSopsFile = fp /secrets/lupine/lupine.yaml;
 
+  boot.binfmt.emulatedSystems = [
+    "aarch64-linux"
+    "armv7l-linux"
+    "i686-linux"
+  ];
+
   systemd.network.networks."30-enp0s31f6" = values.defaultNetworkConfig // {
     matchConfig.Name = "enp0s31f6";
     address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];