mirror of
https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git
synced 2026-01-12 10:28:25 +01:00
Compare commits
10 Commits
dagali-hei
...
30e594f93c
| Author | SHA1 | Date | |
|---|---|---|---|
|
30e594f93c | ||
|
|
3c068bd63b | ||
|
|
fb2899bf37 | ||
|
|
27ab2c09ab | ||
|
|
6c22db75b9 | ||
|
|
718b32be31 | ||
|
|
7514ada131 | ||
|
|
7e22154b9b | ||
|
|
86c1c77947 | ||
|
|
068e4591a7 |
@@ -14,6 +14,7 @@ keys:
|
||||
- &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
|
||||
- &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
|
||||
- &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
|
||||
- &host_kvernberg age19rlntxt0m27waa0n288g9wgpksa6ndlzz8eneeqya7w3zd7may0sqzhcvz
|
||||
|
||||
creation_rules:
|
||||
# Global secrets
|
||||
@@ -91,3 +92,9 @@ creation_rules:
|
||||
- *user_pederbs_bjarte
|
||||
pgp:
|
||||
- *user_oysteikt
|
||||
|
||||
- path_regex: secrets/kvernberg/[^/]+$
|
||||
key_groups:
|
||||
- age:
|
||||
- *host_kvernberg
|
||||
- *user_danio
|
||||
|
||||
@@ -3,10 +3,6 @@
|
||||
systemd.network.enable = true;
|
||||
networking.domain = "pvv.ntnu.no";
|
||||
networking.useDHCP = false;
|
||||
# networking.search = [ "pvv.ntnu.no" "pvv.org" ];
|
||||
# networking.nameservers = lib.mkDefault [ "129.241.0.200" "129.241.0.201" ];
|
||||
# networking.tempAddresses = lib.mkDefault "disabled";
|
||||
# networking.defaultGateway = values.hosts.gateway;
|
||||
|
||||
# The rest of the networking configuration is usually sourced from /values.nix
|
||||
|
||||
|
||||
@@ -2,12 +2,12 @@
|
||||
{
|
||||
system.autoUpgrade = {
|
||||
enable = true;
|
||||
flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
|
||||
flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git?ref=pvvvvv";
|
||||
flags = [
|
||||
# --update-input is deprecated since nix 2.22, and removed in lix 2.90
|
||||
# https://git.lix.systems/lix-project/lix/issues/400
|
||||
"--refresh"
|
||||
"--override-input" "nixpkgs" "github:nixos/nixpkgs/nixos-24.11-small"
|
||||
"--override-input" "nixpkgs" "github:nixos/nixpkgs/nixos-unstable-small"
|
||||
"--override-input" "nixpkgs-unstable" "github:nixos/nixpkgs/nixos-unstable-small"
|
||||
"--no-write-lock-file"
|
||||
];
|
||||
|
||||
20
flake.lock
generated
20
flake.lock
generated
@@ -7,11 +7,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1740485968,
|
||||
"narHash": "sha256-WK+PZHbfDjLyveXAxpnrfagiFgZWaTJglewBWniTn2Y=",
|
||||
"lastModified": 1739634831,
|
||||
"narHash": "sha256-xFnU+uUl48Icas2wPQ+ZzlL2O3n8f6J2LrzNK9f2nng=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "19c1140419c4f1cdf88ad4c1cfb6605597628940",
|
||||
"rev": "fa5746ecea1772cf59b3f34c5816ab3531478142",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -139,27 +139,27 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1740782485,
|
||||
"narHash": "sha256-GkDJDqHYlPKZFdyxzZHtljxNRsosKB1GCrblqlvLFgo=",
|
||||
"lastModified": 1739611738,
|
||||
"narHash": "sha256-3bnOIZz8KXtzcaXGuH9Eriv0HiQyr1EIfcye+VHLQZE=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "dd5c2540983641bbaabdfc665931592d4c9989e8",
|
||||
"rev": "31ff66eb77d02e9ac34b7256a02edb1c43fb9998",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-24.11-small",
|
||||
"ref": "nixos-unstable-small",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1740848276,
|
||||
"narHash": "sha256-bYeI3FEs824X+MJYksKboNlmglehzplqzn+XvcojWMc=",
|
||||
"lastModified": 1739611738,
|
||||
"narHash": "sha256-3bnOIZz8KXtzcaXGuH9Eriv0HiQyr1EIfcye+VHLQZE=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "e9b0ff70ddc61c42548501b0fafb86bb49cca858",
|
||||
"rev": "31ff66eb77d02e9ac34b7256a02edb1c43fb9998",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
10
flake.nix
10
flake.nix
@@ -2,7 +2,7 @@
|
||||
description = "PVV System flake";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11-small"; # remember to also update the url in base/services/auto-upgrade.nix
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable-small"; # remember to also update the url in base/services/auto-upgrade.nix
|
||||
nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
|
||||
|
||||
sops-nix.url = "github:Mic92/sops-nix";
|
||||
@@ -145,8 +145,12 @@
|
||||
inputs.gergle.overlays.default
|
||||
];
|
||||
};
|
||||
|
||||
dagali = unstableNixosConfig "dagali" { };
|
||||
kvernberg = stableNixosConfig "kvernberg" {
|
||||
modules = [
|
||||
disko.nixosModules.disko
|
||||
{ disko.devices.disk.disk1.device = "/dev/sda"; }
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
nixosModules = {
|
||||
|
||||
@@ -13,8 +13,6 @@ in {
|
||||
|
||||
services.bluemap = {
|
||||
enable = true;
|
||||
package = pkgs.callPackage ./package.nix { };
|
||||
|
||||
eula = true;
|
||||
onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
|
||||
|
||||
|
||||
@@ -26,6 +26,7 @@ let
|
||||
"webapp.conf" = webappConfig;
|
||||
"webserver.conf" = webserverConfig;
|
||||
"packs" = cfg.resourcepacks;
|
||||
"addons" = cfg.resourcepacks; # TODO
|
||||
};
|
||||
|
||||
renderConfigFolder = name: value: pkgs.linkFarm "bluemap-${name}-config" {
|
||||
@@ -37,13 +38,13 @@ let
|
||||
"webapp.conf" = format.generate "webapp.conf" (cfg.webappSettings // { "update-settings-file" = false; });
|
||||
"webserver.conf" = webserverConfig;
|
||||
"packs" = value.resourcepacks;
|
||||
"addons" = cfg.resourcepacks; # TODO
|
||||
};
|
||||
|
||||
inherit (lib) mkOption;
|
||||
in {
|
||||
options.services.bluemap = {
|
||||
enable = lib.mkEnableOption "bluemap";
|
||||
package = lib.mkPackageOption pkgs "bluemap" { };
|
||||
|
||||
eula = mkOption {
|
||||
type = lib.types.bool;
|
||||
@@ -158,7 +159,7 @@ in {
|
||||
type = lib.types.path;
|
||||
default = cfg.resourcepacks;
|
||||
defaultText = lib.literalExpression "config.services.bluemap.resourcepacks";
|
||||
description = "A set of resourcepacks/mods/bluemap-addons to extract models from loaded in alphabetical order";
|
||||
description = "A set of resourcepacks/mods to extract models from loaded in alphabetical order";
|
||||
};
|
||||
settings = mkOption {
|
||||
type = (lib.types.submodule {
|
||||
@@ -309,18 +310,9 @@ in {
|
||||
Group = "nginx";
|
||||
UMask = "026";
|
||||
};
|
||||
script = ''
|
||||
# If web folder doesnt exist generate it
|
||||
test -f "${cfg.webRoot}" || ${lib.getExe cfg.package} -c ${webappConfigFolder} -gs
|
||||
|
||||
# Render each minecraft map
|
||||
${lib.strings.concatStringsSep "\n" (lib.attrsets.mapAttrsToList
|
||||
(name: value: "${lib.getExe cfg.package} -c ${renderConfigFolder name value} -r")
|
||||
cfg.maps)}
|
||||
|
||||
# Generate updated webapp
|
||||
${lib.getExe cfg.package} -c ${webappConfigFolder} -gs
|
||||
'';
|
||||
script = lib.strings.concatStringsSep "\n" ((lib.attrsets.mapAttrsToList
|
||||
(name: value: "${lib.getExe pkgs.bluemap} -c ${renderConfigFolder name value} -r")
|
||||
cfg.maps) ++ [ "${lib.getExe pkgs.bluemap} -c ${webappConfigFolder} -gs" ]);
|
||||
};
|
||||
|
||||
systemd.timers."render-bluemap-maps" = lib.mkIf cfg.enableRender {
|
||||
|
||||
@@ -1,30 +0,0 @@
|
||||
{ lib, stdenvNoCC, fetchurl, makeWrapper, jre }:
|
||||
|
||||
stdenvNoCC.mkDerivation rec {
|
||||
pname = "bluemap";
|
||||
version = "5.7";
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
|
||||
hash = "sha256-8udZYJgrr4bi2mjRYrASd8JwUoUVZW1tZpOLRgafAIw=";
|
||||
};
|
||||
|
||||
dontUnpack = true;
|
||||
|
||||
nativeBuildInputs = [ makeWrapper ];
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
makeWrapper ${jre}/bin/java $out/bin/bluemap --add-flags "-jar $src"
|
||||
runHook postInstall
|
||||
'';
|
||||
|
||||
meta = {
|
||||
description = "3D minecraft map renderer";
|
||||
homepage = "https://bluemap.bluecolored.de/";
|
||||
sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
|
||||
license = lib.licenses.mit;
|
||||
maintainers = with lib.maintainers; [ dandellion h7x4 ];
|
||||
mainProgram = "bluemap";
|
||||
};
|
||||
}
|
||||
@@ -1,52 +0,0 @@
|
||||
{ config, pkgs, lib, fp, ... }:
|
||||
let
|
||||
cfg = config.services.gitea;
|
||||
in
|
||||
{
|
||||
services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
|
||||
|
||||
systemd.services.gitea-customization = lib.mkIf cfg.enable {
|
||||
description = "Install extra customization in gitea's CUSTOM_DIR";
|
||||
wantedBy = [ "gitea.service" ];
|
||||
requiredBy = [ "gitea.service" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
};
|
||||
|
||||
script = let
|
||||
logo-svg = fp /assets/logo_blue_regular.svg;
|
||||
logo-png = fp /assets/logo_blue_regular.png;
|
||||
extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
|
||||
<a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
|
||||
<a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
|
||||
<a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
|
||||
'';
|
||||
|
||||
project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
|
||||
labels = lib.importJSON ./labels/projects.json;
|
||||
};
|
||||
|
||||
customTemplates = pkgs.runCommandLocal "gitea-templates" {
|
||||
nativeBuildInputs = with pkgs; [
|
||||
coreutils
|
||||
gnused
|
||||
];
|
||||
} ''
|
||||
# Bigger icons
|
||||
install -Dm444 "${cfg.package.src}/templates/repo/icon.tmpl" "$out/repo/icon.tmpl"
|
||||
sed -i -e 's/24/48/g' "$out/repo/icon.tmpl"
|
||||
'';
|
||||
in ''
|
||||
install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
|
||||
install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
|
||||
install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
|
||||
install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
|
||||
install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml
|
||||
|
||||
"${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
|
||||
'';
|
||||
};
|
||||
}
|
||||
@@ -1,11 +1,10 @@
|
||||
{ config, values, lib, ... }:
|
||||
{ config, values, fp, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.services.gitea;
|
||||
domain = "git.pvv.ntnu.no";
|
||||
sshPort = 2222;
|
||||
in {
|
||||
imports = [
|
||||
./customization.nix
|
||||
./gpg.nix
|
||||
./import-users
|
||||
./web-secret-provider
|
||||
@@ -131,11 +130,6 @@ in {
|
||||
};
|
||||
"ui.meta".DESCRIPTION = "Bokstavelig talt programvareverkstedet";
|
||||
};
|
||||
|
||||
dump = {
|
||||
enable = true;
|
||||
type = "tar.gz";
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = [ cfg.package ];
|
||||
@@ -162,4 +156,40 @@ in {
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ sshPort ];
|
||||
|
||||
# Extra customization
|
||||
|
||||
services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
|
||||
|
||||
systemd.services.install-gitea-customization = {
|
||||
description = "Install extra customization in gitea's CUSTOM_DIR";
|
||||
wantedBy = [ "gitea.service" ];
|
||||
requiredBy = [ "gitea.service" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
};
|
||||
|
||||
script = let
|
||||
logo-svg = fp /assets/logo_blue_regular.svg;
|
||||
logo-png = fp /assets/logo_blue_regular.png;
|
||||
extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
|
||||
<a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
|
||||
<a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
|
||||
<a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
|
||||
'';
|
||||
|
||||
project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
|
||||
labels = lib.importJSON ./labels/projects.json;
|
||||
};
|
||||
in ''
|
||||
install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
|
||||
install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
|
||||
install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
|
||||
install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
|
||||
install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,78 +0,0 @@
|
||||
# Tracking document for new PVV kerberos auth stack
|
||||
|
||||
|
||||
|
||||
<div align="center">
|
||||
Bensinstasjon på heimdal
|
||||
</div>
|
||||
|
||||
### TODO:
|
||||
|
||||
- [ ] setup heimdal
|
||||
- [x] ensure running with systemd
|
||||
- [x] compile smbk5pwd (part of openldap)
|
||||
- [ ] set `modify -a -disallow-all-tix,requires-pre-auth default` declaratively
|
||||
- [ ] fully initialize PVV.NTNU.NO
|
||||
- [x] `kadmin -l init PVV.NTNU.NO`
|
||||
- [x] add oysteikt/admin@PVV.NTNU.NO principal
|
||||
- [x] add oysteikt@PVV.NTNU.NO principal
|
||||
- [x] add krbtgt/PVV.NTNU.NO@PVV.NTNU.NO principal?
|
||||
- why is this needed, and where is it documented?
|
||||
- `kadmin check` seems to work under sudo?
|
||||
- (it is included by default, just included as error message
|
||||
in a weird state)
|
||||
|
||||
- [x] Ensure client is working correctly
|
||||
- [x] Ensure kinit works on darbu
|
||||
- [x] Ensure kpasswd works on darbu
|
||||
- [x] Ensure kadmin get <user> (and other restricted commands) works on darbu
|
||||
|
||||
- [ ] Ensure kdc is working correctly
|
||||
- [x] Ensure kinit works on dagali
|
||||
- [x] Ensure kpasswd works on dagali
|
||||
- [ ] Ensure kadmin get <user> (and other restricte commands) works on dagali
|
||||
|
||||
- [x] Fix FQDN
|
||||
- https://github.com/NixOS/nixpkgs/issues/94011
|
||||
- https://github.com/NixOS/nixpkgs/issues/261269
|
||||
- Possibly fixed by disabling systemd-resolved
|
||||
|
||||
- [ ] setup cyrus sasl
|
||||
- [x] ensure running with systemd
|
||||
- [x] verify GSSAPI support plugin is installed
|
||||
- `nix-shell -p cyrus_sasl --command pluginviewer`
|
||||
- [x] create "host/localhost@PVV.NTNU.NO" and export to keytab
|
||||
- [x] verify cyrus sasl is able to talk to heimdal
|
||||
- `sudo testsaslauthd -u oysteikt -p <password>`
|
||||
- [ ] provide ldap principal to cyrus sasl through keytab
|
||||
|
||||
- [ ] setup openldap
|
||||
- [x] ensure running with systemd
|
||||
- [ ] verify openldap is able to talk to cyrus sasl
|
||||
- [ ] create user for oysteikt in openldap
|
||||
- [ ] authenticate openldap login through sasl
|
||||
- does this require creating an ldap user?
|
||||
|
||||
- [ ] fix smbk5pwd integration
|
||||
- [x] add smbk5pwd schemas to openldap
|
||||
- [x] create openldap db for smbk5pwd with overlays
|
||||
- [ ] test to ensure that user sync is working
|
||||
- [ ] test as user source (replace passwd)
|
||||
- [ ] test as PAM auth source
|
||||
- [ ] test as auth source for 3rd party appliation
|
||||
|
||||
- [ ] Set up ldap administration panel
|
||||
- Doesn't seem like there are many good ones out there. Maybe phpLDAPAdmin?
|
||||
|
||||
- [ ] Set up kerberos SRV DNS entry
|
||||
|
||||
### Information and URLS
|
||||
|
||||
- OpenLDAP SASL: https://www.openldap.org/doc/admin24/sasl.html
|
||||
- Use a keytab: https://kb.iu.edu/d/aumh
|
||||
- 2 ways for openldap to auth: https://security.stackexchange.com/questions/65093/how-to-test-ldap-that-authenticates-with-kerberos
|
||||
- Cyrus guide OpenLDAP + SASL + GSSAPI: https://www.cyrusimap.org/sasl/sasl/faqs/openldap-sasl-gssapi.html
|
||||
- Configuring GSSAPI and Cyrus SASL: https://web.mit.edu/darwin/src/modules/passwordserver_sasl/cyrus_sasl/doc/gssapi.html
|
||||
- PVV Kerberos docs: https://wiki.pvv.ntnu.no/wiki/Drift/Kerberos
|
||||
- OpenLDAP smbk5pwd source: https://git.openldap.org/nivanova/openldap/-/tree/master/contrib/slapd-modules/smbk5pwd
|
||||
- saslauthd(8): https://linux.die.net/man/8/saslauthd
|
||||
@@ -1,51 +0,0 @@
|
||||
|
||||
{ config, pkgs, values, lib, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
../../base.nix
|
||||
../../misc/metrics-exporters.nix
|
||||
|
||||
./services/heimdal.nix
|
||||
#./services/openldap.nix
|
||||
./services/cyrus-sasl.nix
|
||||
];
|
||||
|
||||
# buskerud does not support efi?
|
||||
# boot.loader.systemd-boot.enable = true;
|
||||
# boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
|
||||
# resolved messes up FQDN coming from nscd
|
||||
services.resolved.enable = false;
|
||||
|
||||
networking.hostName = "dagali";
|
||||
networking.domain = lib.mkForce "pvv.local";
|
||||
networking.hosts = {
|
||||
"129.241.210.185" = [ "dagali.pvv.local" ];
|
||||
};
|
||||
#networking.search = [ "pvv.ntnu.no" "pvv.org" ];
|
||||
networking.nameservers = [ "129.241.0.200" "129.241.0.201" ];
|
||||
networking.tempAddresses = "disabled";
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
systemd.network.networks."ens18" = values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "ens18";
|
||||
address = with values.hosts.dagali; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||
};
|
||||
|
||||
# List packages installed in system profile
|
||||
environment.systemPackages = with pkgs; [
|
||||
# TODO: consider adding to base.nix
|
||||
nix-output-monitor
|
||||
];
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "24.05"; # Did you read the comment?
|
||||
}
|
||||
@@ -1,21 +0,0 @@
|
||||
{ config, ... }:
|
||||
let
|
||||
cfg = config.services.saslauthd;
|
||||
in
|
||||
{
|
||||
# TODO: This is seemingly required for openldap to authenticate
|
||||
# against kerberos, but I have no idea how to configure it as
|
||||
# such. Does it need a keytab? There's a binary "testsaslauthd"
|
||||
# that follows with `pkgs.cyrus_sasl` that might be useful.
|
||||
services.saslauthd = {
|
||||
enable = true;
|
||||
mechanism = "kerberos5";
|
||||
config = ''
|
||||
mech_list: gs2-krb5 gssapi
|
||||
keytab: /etc/krb5.keytab
|
||||
'';
|
||||
};
|
||||
|
||||
# TODO: maybe the upstream module should consider doing this?
|
||||
environment.systemPackages = [ cfg.package ];
|
||||
}
|
||||
@@ -1,100 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
realm = "PVV.LOCAL";
|
||||
cfg = config.security.krb5;
|
||||
in
|
||||
{
|
||||
security.krb5 = {
|
||||
enable = true;
|
||||
|
||||
# NOTE: This is required in order to build smbk5pwd, because of some nested includes.
|
||||
# We should open an issue upstream (heimdal, not nixpkgs), but this patch
|
||||
# will do for now.
|
||||
package = pkgs.heimdal.overrideAttrs (prev: {
|
||||
postInstall = prev.postInstall + ''
|
||||
cp include/heim_threads.h $dev/include
|
||||
'';
|
||||
});
|
||||
|
||||
settings = {
|
||||
realms.${realm} = {
|
||||
kdc = [ "dagali.${lib.toLower realm}" ];
|
||||
admin_server = "dagali.${lib.toLower realm}";
|
||||
kpasswd_server = "dagali.${lib.toLower realm}";
|
||||
default_domain = lib.toLower realm;
|
||||
primary_kdc = "dagali.${lib.toLower realm}";
|
||||
};
|
||||
|
||||
kadmin.default_keys = lib.concatStringsSep " " [
|
||||
"aes256-cts-hmac-sha1-96:pw-salt"
|
||||
"aes128-cts-hmac-sha1-96:pw-salt"
|
||||
];
|
||||
|
||||
libdefaults.default_etypes = lib.concatStringsSep " " [
|
||||
"aes256-cts-hmac-sha1-96"
|
||||
"aes128-cts-hmac-sha1-96"
|
||||
];
|
||||
|
||||
libdefaults = {
|
||||
default_realm = realm;
|
||||
dns_lookup_kdc = false;
|
||||
dns_lookup_realm = false;
|
||||
};
|
||||
|
||||
domain_realm = {
|
||||
"${lib.toLower realm}" = realm;
|
||||
".${lib.toLower realm}" = realm;
|
||||
};
|
||||
|
||||
logging = {
|
||||
# kdc = "CONSOLE";
|
||||
kdc = "SYSLOG:DEBUG:AUTH";
|
||||
admin_server = "SYSLOG:DEBUG:AUTH";
|
||||
default = "SYSLOG:DEBUG:AUTH";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.kerberos_server = {
|
||||
enable = true;
|
||||
settings = {
|
||||
realms.${realm} = {
|
||||
dbname = "/var/lib/heimdal/heimdal";
|
||||
mkey = "/var/lib/heimdal/m-key";
|
||||
acl = [
|
||||
{
|
||||
principal = "kadmin/admin";
|
||||
access = "all";
|
||||
}
|
||||
{
|
||||
principal = "felixalb/admin";
|
||||
access = "all";
|
||||
}
|
||||
{
|
||||
principal = "oysteikt/admin";
|
||||
access = "all";
|
||||
}
|
||||
];
|
||||
};
|
||||
# kadmin.default_keys = lib.concatStringsSep " " [
|
||||
# "aes256-cts-hmac-sha1-96:pw-salt"
|
||||
# "aes128-cts-hmac-sha1-96:pw-salt"
|
||||
# ];
|
||||
|
||||
# libdefaults.default_etypes = lib.concatStringsSep " " [
|
||||
# "aes256-cts-hmac-sha1-96"
|
||||
# "aes128-cts-hmac-sha1-96"
|
||||
# ];
|
||||
|
||||
# password_quality.min_length = 8;
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 88 464 749 ];
|
||||
networking.firewall.allowedUDPPorts = [ 88 464 749 ];
|
||||
|
||||
networking.hosts = {
|
||||
"127.0.0.2" = lib.mkForce [ ];
|
||||
"::1" = lib.mkForce [ ];
|
||||
};
|
||||
}
|
||||
@@ -1,121 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
services.openldap = let
|
||||
dn = "dc=pvv,dc=ntnu,dc=no";
|
||||
cfg = config.services.openldap;
|
||||
|
||||
heimdal = config.security.krb5.package;
|
||||
in {
|
||||
enable = true;
|
||||
|
||||
# NOTE: this is a custom build of openldap with support for
|
||||
# perl and kerberos.
|
||||
package = pkgs.openldap.overrideAttrs (prev: {
|
||||
# https://github.com/openldap/openldap/blob/master/configure
|
||||
configureFlags = prev.configureFlags ++ [
|
||||
# Connect to slapd via UNIX socket
|
||||
"--enable-local"
|
||||
# Cyrus SASL
|
||||
"--enable-spasswd"
|
||||
# Reverse hostname lookups
|
||||
"--enable-rlookups"
|
||||
# perl
|
||||
"--enable-perl"
|
||||
];
|
||||
|
||||
buildInputs = prev.buildInputs ++ [
|
||||
pkgs.perl
|
||||
# NOTE: do not upstream this, it might not work with
|
||||
# MIT in the same way
|
||||
heimdal
|
||||
];
|
||||
|
||||
extraContribModules = prev.extraContribModules ++ [
|
||||
# https://git.openldap.org/openldap/openldap/-/tree/master/contrib/slapd-modules
|
||||
"smbk5pwd"
|
||||
];
|
||||
});
|
||||
|
||||
settings = {
|
||||
attrs = {
|
||||
olcLogLevel = [ "stats" "config" "args" ];
|
||||
|
||||
# olcAuthzRegexp = ''
|
||||
# gidNumber=.*\\\+uidNumber=0,cn=peercred,cn=external,cn=auth
|
||||
# "uid=heimdal,${dn2}"
|
||||
# '';
|
||||
|
||||
# olcSaslSecProps = "minssf=0";
|
||||
};
|
||||
|
||||
children = {
|
||||
"cn=schema".includes = let
|
||||
# NOTE: needed for smbk5pwd.so module
|
||||
schemaToLdif = name: path: pkgs.runCommandNoCC name {
|
||||
buildInputs = with pkgs; [ schema2ldif ];
|
||||
} ''
|
||||
schema2ldif "${path}" > $out
|
||||
'';
|
||||
|
||||
hdb-ldif = schemaToLdif "hdb.ldif" "${heimdal.src}/lib/hdb/hdb.schema";
|
||||
samba-ldif = schemaToLdif "samba.ldif" "${heimdal.src}/tests/ldap/samba.schema";
|
||||
in [
|
||||
"${cfg.package}/etc/schema/core.ldif"
|
||||
"${cfg.package}/etc/schema/cosine.ldif"
|
||||
"${cfg.package}/etc/schema/nis.ldif"
|
||||
"${cfg.package}/etc/schema/inetorgperson.ldif"
|
||||
"${hdb-ldif}"
|
||||
"${samba-ldif}"
|
||||
];
|
||||
|
||||
# NOTE: installation of smbk5pwd.so module
|
||||
# https://git.openldap.org/openldap/openldap/-/tree/master/contrib/slapd-modules/smbk5pwd
|
||||
"cn=module{0}".attrs = {
|
||||
objectClass = [ "olcModuleList" ];
|
||||
olcModuleLoad = [ "${cfg.package}/lib/modules/smbk5pwd.so" ];
|
||||
};
|
||||
|
||||
# NOTE: activation of smbk5pwd.so module for {1}mdb
|
||||
"olcOverlay={0}smbk5pwd,olcDatabase={1}mdb".attrs = {
|
||||
objectClass = [ "olcOverlayConfig" "olcSmbK5PwdConfig" ];
|
||||
olcOverlay = "{0}smbk5pwd";
|
||||
olcSmbK5PwdEnable = [ "krb5" "samba" ];
|
||||
olcSmbK5PwdMustChange = toString (60 * 60 * 24 * 10000);
|
||||
};
|
||||
|
||||
"olcDatabase={1}mdb".attrs = {
|
||||
objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
|
||||
|
||||
olcDatabase = "{1}mdb";
|
||||
|
||||
olcSuffix = dn;
|
||||
|
||||
# TODO: PW is supposed to be a secret, but it's probably fine for testing
|
||||
olcRootDN = "cn=users,${dn}";
|
||||
|
||||
# TODO: replace with proper secret
|
||||
olcRootPW.path = pkgs.writeText "olcRootPW" "pass";
|
||||
|
||||
olcDbDirectory = "/var/lib/openldap/test-smbk5pwd-db";
|
||||
olcDbIndex = "objectClass eq";
|
||||
|
||||
olcAccess = [
|
||||
''{0}to attrs=userPassword,shadowLastChange
|
||||
by dn.exact=cn=users,${dn} write
|
||||
by self write
|
||||
by anonymous auth
|
||||
by * none''
|
||||
|
||||
''{1}to dn.base=""
|
||||
by * read''
|
||||
|
||||
/* allow read on anything else */
|
||||
# ''{2}to *
|
||||
# by cn=users,${dn} write by dn.exact=gidNumber=0+uidNumber=0+cn=peercred,cn=external write
|
||||
# by * read''
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
45
hosts/kvernberg/configuration.nix
Normal file
45
hosts/kvernberg/configuration.nix
Normal file
@@ -0,0 +1,45 @@
|
||||
{ config, fp, pkgs, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
./disks.nix
|
||||
|
||||
./services/nginx.nix
|
||||
./services/pvvvvvv
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = fp /secrets/kvernberg/kvernberg.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
networking.hostName = "kvernberg"; # Define your hostname.
|
||||
|
||||
systemd.network.networks."30-all" = values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "en*";
|
||||
address = with values.hosts.kvernberg; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||
};
|
||||
|
||||
# List packages installed in system profile
|
||||
environment.systemPackages = with pkgs; [
|
||||
|
||||
];
|
||||
|
||||
# No devices with SMART
|
||||
services.smartd.enable = false;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "24.05"; # Did you read the comment?
|
||||
|
||||
}
|
||||
39
hosts/kvernberg/disks.nix
Normal file
39
hosts/kvernberg/disks.nix
Normal file
@@ -0,0 +1,39 @@
|
||||
# Example to create a bios compatible gpt partition
|
||||
{ lib, ... }:
|
||||
{
|
||||
disko.devices = {
|
||||
disk.disk1 = {
|
||||
device = lib.mkDefault "/dev/sda";
|
||||
type = "disk";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
boot = {
|
||||
name = "boot";
|
||||
size = "1M";
|
||||
type = "EF02";
|
||||
};
|
||||
esp = {
|
||||
name = "ESP";
|
||||
size = "500M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
};
|
||||
};
|
||||
root = {
|
||||
name = "root";
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -13,14 +13,7 @@
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/4de345e2-be41-4d10-9b90-823b2c77e9b3";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/aa4b9a97-a7d8-4608-9f67-4ad084f1baf7"; }
|
||||
];
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
5
hosts/kvernberg/services/nginx.nix
Normal file
5
hosts/kvernberg/services/nginx.nix
Normal file
@@ -0,0 +1,5 @@
|
||||
{ config, lib, ... }:
|
||||
|
||||
{
|
||||
services.nginx.enable = true;
|
||||
}
|
||||
51
hosts/kvernberg/services/pvvvvvv/bank.nix
Normal file
51
hosts/kvernberg/services/pvvvvvv/bank.nix
Normal file
@@ -0,0 +1,51 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.libeufin.bank;
|
||||
tcfg = config.services.taler;
|
||||
inherit (tcfg.settings.taler) CURRENCY;
|
||||
in {
|
||||
services.libeufin.bank = {
|
||||
enable = true;
|
||||
debug = true;
|
||||
createLocalDatabase = true;
|
||||
initialAccounts = [
|
||||
{ username = "exchange";
|
||||
password = "exchange";
|
||||
name = "Exchange";
|
||||
}
|
||||
];
|
||||
settings = {
|
||||
libeufin-bank = {
|
||||
WIRE_TYPE = "x-taler-bank";
|
||||
X_TALER_BANK_PAYTO_HOSTNAME = "bank.kvernberg.pvv.ntnu.no";
|
||||
BASE_URL = "bank.kvernberg.pvv.ntnu.no/";
|
||||
|
||||
ALLOW_REGISTRATION = "yes";
|
||||
|
||||
REGISTRATION_BONUS_ENABLED = "yes";
|
||||
REGISTRATION_BONUS = "${CURRENCY}:500";
|
||||
|
||||
DEFAULT_DEBT_LIMIT = "${CURRENCY}:0";
|
||||
|
||||
ALLOW_CONVERSION = "no";
|
||||
ALLOW_EDIT_CASHOUT_PAYTO_URI = "yes";
|
||||
|
||||
SUGGESTED_WITHDRAWAL_EXCHANGE = "https://exchange.kvernberg.pvv.ntnu.no/";
|
||||
|
||||
inherit CURRENCY;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."bank.kvernberg.pvv.ntnu.no" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
kTLS = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:8082";
|
||||
extraConfig = ''
|
||||
proxy_read_timeout 300s;
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
17
hosts/kvernberg/services/pvvvvvv/default.nix
Normal file
17
hosts/kvernberg/services/pvvvvvv/default.nix
Normal file
@@ -0,0 +1,17 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.taler;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./exchange.nix
|
||||
./bank.nix
|
||||
];
|
||||
|
||||
services.taler = {
|
||||
settings = {
|
||||
taler.CURRENCY = "SCHPENN";
|
||||
taler.CURRENCY_ROUND_UNIT = "${cfg.settings.taler.CURRENCY}:1";
|
||||
};
|
||||
};
|
||||
}
|
||||
187
hosts/kvernberg/services/pvvvvvv/exchange.nix
Normal file
187
hosts/kvernberg/services/pvvvvvv/exchange.nix
Normal file
@@ -0,0 +1,187 @@
|
||||
{ config, lib, fp, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.taler;
|
||||
inherit (cfg.settings.taler) CURRENCY;
|
||||
in {
|
||||
sops.secrets.exchange-offline-master = {
|
||||
format = "binary";
|
||||
sopsFile = fp /secrets/kvernberg/exhange-offline-master.priv;
|
||||
};
|
||||
|
||||
services.taler.exchange = {
|
||||
enable = true;
|
||||
debug = true;
|
||||
denominationConfig = ''
|
||||
## Old denomination names cannot be used again
|
||||
# [COIN-${CURRENCY}-k1-1-0]
|
||||
|
||||
## NOK Denominations
|
||||
[coin-${CURRENCY}-nok-1-0]
|
||||
VALUE = ${CURRENCY}:1
|
||||
DURATION_WITHDRAW = 7 days
|
||||
DURATION_SPEND = 1 years
|
||||
DURATION_LEGAL = 3 years
|
||||
FEE_WITHDRAW = ${CURRENCY}:0
|
||||
FEE_DEPOSIT = ${CURRENCY}:0
|
||||
FEE_REFRESH = ${CURRENCY}:0
|
||||
FEE_REFUND = ${CURRENCY}:0
|
||||
RSA_KEYSIZE = 2048
|
||||
CIPHER = RSA
|
||||
|
||||
[coin-${CURRENCY}-nok-5-0]
|
||||
VALUE = ${CURRENCY}:5
|
||||
DURATION_WITHDRAW = 7 days
|
||||
DURATION_SPEND = 1 years
|
||||
DURATION_LEGAL = 3 years
|
||||
FEE_WITHDRAW = ${CURRENCY}:0
|
||||
FEE_DEPOSIT = ${CURRENCY}:0
|
||||
FEE_REFRESH = ${CURRENCY}:0
|
||||
FEE_REFUND = ${CURRENCY}:0
|
||||
RSA_KEYSIZE = 2048
|
||||
CIPHER = RSA
|
||||
|
||||
[coin-${CURRENCY}-nok-10-0]
|
||||
VALUE = ${CURRENCY}:10
|
||||
DURATION_WITHDRAW = 7 days
|
||||
DURATION_SPEND = 1 years
|
||||
DURATION_LEGAL = 3 years
|
||||
FEE_WITHDRAW = ${CURRENCY}:0
|
||||
FEE_DEPOSIT = ${CURRENCY}:0
|
||||
FEE_REFRESH = ${CURRENCY}:0
|
||||
FEE_REFUND = ${CURRENCY}:0
|
||||
RSA_KEYSIZE = 2048
|
||||
CIPHER = RSA
|
||||
|
||||
[coin-${CURRENCY}-nok-20-0]
|
||||
VALUE = ${CURRENCY}:20
|
||||
DURATION_WITHDRAW = 7 days
|
||||
DURATION_SPEND = 1 years
|
||||
DURATION_LEGAL = 3 years
|
||||
FEE_WITHDRAW = ${CURRENCY}:0
|
||||
FEE_DEPOSIT = ${CURRENCY}:0
|
||||
FEE_REFRESH = ${CURRENCY}:0
|
||||
FEE_REFUND = ${CURRENCY}:0
|
||||
RSA_KEYSIZE = 2048
|
||||
CIPHER = RSA
|
||||
|
||||
[coin-${CURRENCY}-nok-50-0]
|
||||
VALUE = ${CURRENCY}:50
|
||||
DURATION_WITHDRAW = 7 days
|
||||
DURATION_SPEND = 1 years
|
||||
DURATION_LEGAL = 3 years
|
||||
FEE_WITHDRAW = ${CURRENCY}:0
|
||||
FEE_DEPOSIT = ${CURRENCY}:0
|
||||
FEE_REFRESH = ${CURRENCY}:0
|
||||
FEE_REFUND = ${CURRENCY}:0
|
||||
RSA_KEYSIZE = 2048
|
||||
CIPHER = RSA
|
||||
|
||||
[coin-${CURRENCY}-nok-100-0]
|
||||
VALUE = ${CURRENCY}:100
|
||||
DURATION_WITHDRAW = 7 days
|
||||
DURATION_SPEND = 1 years
|
||||
DURATION_LEGAL = 3 years
|
||||
FEE_WITHDRAW = ${CURRENCY}:0
|
||||
FEE_DEPOSIT = ${CURRENCY}:0
|
||||
FEE_REFRESH = ${CURRENCY}:0
|
||||
FEE_REFUND = ${CURRENCY}:0
|
||||
RSA_KEYSIZE = 2048
|
||||
CIPHER = RSA
|
||||
|
||||
[coin-${CURRENCY}-nok-200-0]
|
||||
VALUE = ${CURRENCY}:200
|
||||
DURATION_WITHDRAW = 7 days
|
||||
DURATION_SPEND = 1 years
|
||||
DURATION_LEGAL = 3 years
|
||||
FEE_WITHDRAW = ${CURRENCY}:0
|
||||
FEE_DEPOSIT = ${CURRENCY}:0
|
||||
FEE_REFRESH = ${CURRENCY}:0
|
||||
FEE_REFUND = ${CURRENCY}:0
|
||||
RSA_KEYSIZE = 2048
|
||||
CIPHER = RSA
|
||||
|
||||
[coin-${CURRENCY}-nok-500-0]
|
||||
VALUE = ${CURRENCY}:500
|
||||
DURATION_WITHDRAW = 7 days
|
||||
DURATION_SPEND = 1 years
|
||||
DURATION_LEGAL = 3 years
|
||||
FEE_WITHDRAW = ${CURRENCY}:0
|
||||
FEE_DEPOSIT = ${CURRENCY}:0
|
||||
FEE_REFRESH = ${CURRENCY}:0
|
||||
FEE_REFUND = ${CURRENCY}:0
|
||||
RSA_KEYSIZE = 2048
|
||||
CIPHER = RSA
|
||||
|
||||
[coin-${CURRENCY}-nok-1000-0]
|
||||
VALUE = ${CURRENCY}:1000
|
||||
DURATION_WITHDRAW = 7 days
|
||||
DURATION_SPEND = 1 years
|
||||
DURATION_LEGAL = 3 years
|
||||
FEE_WITHDRAW = ${CURRENCY}:0
|
||||
FEE_DEPOSIT = ${CURRENCY}:0
|
||||
FEE_REFRESH = ${CURRENCY}:0
|
||||
FEE_REFUND = ${CURRENCY}:0
|
||||
RSA_KEYSIZE = 2048
|
||||
CIPHER = RSA
|
||||
|
||||
## PVV Special Prices
|
||||
# 2024 pizza egenandel
|
||||
[coin-${CURRENCY}-pvv-64-0]
|
||||
VALUE = ${CURRENCY}:64
|
||||
DURATION_WITHDRAW = 7 days
|
||||
DURATION_SPEND = 1 years
|
||||
DURATION_LEGAL = 3 years
|
||||
FEE_WITHDRAW = ${CURRENCY}:0
|
||||
FEE_DEPOSIT = ${CURRENCY}:0
|
||||
FEE_REFRESH = ${CURRENCY}:0
|
||||
FEE_REFUND = ${CURRENCY}:0
|
||||
RSA_KEYSIZE = 2048
|
||||
CIPHER = RSA
|
||||
'';
|
||||
settings = {
|
||||
exchange = {
|
||||
inherit (config.services.taler.settings.taler) CURRENCY CURRENCY_ROUND_UNIT;
|
||||
MASTER_PUBLIC_KEY = "J331T37C8E58P9CVE686P1JFH11DWSRJ3RE4GVDTXKES9M24ERZG";
|
||||
BASE_URL = "https://exchange.kvernberg.pvv.ntnu.no/";
|
||||
TERMS_DIR = "${./terms}";
|
||||
TERMS_ETAG = "0";
|
||||
ENABLE_KYC = "NO";
|
||||
};
|
||||
exchange-offline = {
|
||||
MASTER_PRIV_FILE = config.sops.secrets.exchange-offline-master.path;
|
||||
};
|
||||
exchange-account-test = {
|
||||
PAYTO_URI = "payto://x-taler-bank/bank.kvernberg.pvv.ntnu.no/exchange?receiver-name=Exchange";
|
||||
ENABLE_DEBIT = "YES";
|
||||
ENABLE_CREDIT = "YES";
|
||||
};
|
||||
exchange-accountcredentials-test = {
|
||||
WIRE_GATEWAY_URL = "https://bank.kvernberg.pvv.ntnu.no/accounts/exchange/taler-wire-gateway/";
|
||||
WIRE_GATEWAY_AUTH_METHOD = "BASIC";
|
||||
USERNAME = "exchange";
|
||||
PASSWORD = "exchange";
|
||||
};
|
||||
"currency-${CURRENCY}" = {
|
||||
ENABLED = "YES";
|
||||
CODE = "SCHPENN";
|
||||
NAME = "SCHPENN";
|
||||
FRACTIONAL_NORMAL_DIGITS = 0;
|
||||
FRACTIONAL_INPUT_DIGITS = 0;
|
||||
FRACTIONAL_TRAILING_ZERO_DIGITS = 0;
|
||||
ALT_UNIT_NAMES = "{\"0\": \"S\"}";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."exchange.kvernberg.pvv.ntnu.no" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
kTLS = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:8081";
|
||||
extraConfig = ''
|
||||
proxy_read_timeout 300s;
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
147
hosts/kvernberg/services/pvvvvvv/terms/en/0.txt
Normal file
147
hosts/kvernberg/services/pvvvvvv/terms/en/0.txt
Normal file
@@ -0,0 +1,147 @@
|
||||
Terms of Service
|
||||
================
|
||||
|
||||
Last update: 19.11.2024
|
||||
----------------------
|
||||
|
||||
Welcome! A subset of PVVers who cares about Dibbler (“we,” “our,” or “us”) provides a experimental payment service
|
||||
through our Internet presence (collectively the “Services”). Before using our
|
||||
Services, please read the Terms of Service (the “Terms” or the “Agreement”)
|
||||
carefully.
|
||||
|
||||
Overview
|
||||
--------
|
||||
|
||||
This section provides a brief summary of the highlights of this
|
||||
Agreement. Please note that when you accept this Agreement, you are accepting
|
||||
all of the terms and conditions and not just this section. We and possibly
|
||||
other third parties provide Internet services which interact with the Taler
|
||||
Wallet’s self-hosted personal payment application. When using the Taler Wallet
|
||||
to interact with our Services, you are agreeing to our Terms, so please read
|
||||
carefully.
|
||||
|
||||
Research
|
||||
----------
|
||||
|
||||
This is research, any dibbler credits sent to the dibbler account could be lost at any time.
|
||||
We would make an effort to send the credits back to their canonical owners, but this may be difficult.
|
||||
We make no guarantees on the state of this. The dibbler economy is totally unsecured, and so are these services!
|
||||
Usage is wholly on your own risk.
|
||||
|
||||
Highlights:
|
||||
-----------
|
||||
|
||||
* You are responsible for keeping the data in your Taler Wallet at all times under your control. Any losses arising from you not being in control of your private information are your problem.
|
||||
|
||||
* For our Services, we may charge transaction fees. The specific fee structure is provided based on the Taler protocol and should be shown to you when you withdraw electronic coins using a Taler Wallet. You agree and understand that the Taler protocol allows for the fee structure to change.
|
||||
|
||||
* You agree to not intentionally overwhelm our systems with requests and follow responsible disclosure if you find security issues in our services.
|
||||
|
||||
* We cannot be held accountable for our Services not being available due to circumstances beyond our control. If we modify or terminate our services, we will try to give you the opportunity to recover your funds. However, given the experimental state of the Services today, this may not be possible. You are strongly advised to limit your use of the Service to small-scale experiments expecting total loss of all funds.
|
||||
|
||||
These terms outline approved uses of our Services. The Services and these
|
||||
Terms are still at an experimental stage. If you have any questions or
|
||||
comments related to this Agreement, please send us a message on IRC, or on our Matrix server.
|
||||
If you do not agree to this Agreement, you must not use our Services.
|
||||
|
||||
How you accept this policy
|
||||
--------------------------
|
||||
|
||||
By sending funds to us (to top-up your Taler Wallet), you acknowledge that you
|
||||
have read, understood, and agreed to these Terms. We reserve the right to
|
||||
change these Terms at any time. If you disagree with the change, we may in the
|
||||
future offer you with an easy option to recover your unspent funds. However,
|
||||
in the current experimental period you acknowledge that this feature is not
|
||||
yet available, resulting in your funds being lost unless you accept the new
|
||||
Terms. If you continue to use our Services other than to recover your unspent
|
||||
funds, your continued use of our Services following any such change will
|
||||
signify your acceptance to be bound by the then current Terms. Please check
|
||||
the effective date above to determine if there have been any changes since you
|
||||
have last reviewed these Terms.
|
||||
|
||||
Services
|
||||
--------
|
||||
|
||||
We will try to transfer funds that we hold in escrow for our users to any
|
||||
legal recipient to the best of our ability and within the limitations of the
|
||||
law and our implementation. However, the Services offered today are highly
|
||||
experimental and the set of recipients of funds is severely restricted. The
|
||||
Taler Wallet can be loaded by exchanging ordinary dibbler credit for electronic
|
||||
coins. We are providing this exchange service. Once your Taler Wallet is
|
||||
loaded with electronic coins they can be spent for purchases if the seller is
|
||||
accepting Taler as a means of payment. We are not guaranteeing that any seller
|
||||
is accepting Taler at all or a particular seller. The seller or recipient of
|
||||
deposits of electronic coins must specify the target account, as per the
|
||||
design of the Taler protocol. They are responsible for following the protocol
|
||||
and specifying the correct dibbler account, and are solely liable for any losses
|
||||
that may arise from specifying the wrong account. We will allow the government
|
||||
to link wire transfers to the underlying contract hash. It is the
|
||||
responsibility of recipients to preserve the full contracts and to pay
|
||||
whatever taxes and charges may be applicable. Technical issues may lead to
|
||||
situations where we are unable to make transfers at all or lead to incorrect
|
||||
transfers that cannot be reversed. We will only refuse to execute transfers if
|
||||
the transfers are prohibited by a competent legal authority and we are ordered
|
||||
to do so.
|
||||
|
||||
When using our Services, you agree to not take any action that intentionally
|
||||
imposes an unreasonable load on our infrastructure. If you find security
|
||||
problems in our Services, you agree to first report them to
|
||||
security@taler-systems.com and grant us the right to publish your report. We
|
||||
warrant that we will ourselves publicly disclose any issues reported within 3
|
||||
months, and that we will not prosecute anyone reporting security issues if
|
||||
they did not exploit the issue beyond a proof-of-concept, and followed the
|
||||
above responsible disclosure practice.
|
||||
|
||||
Fees
|
||||
----
|
||||
|
||||
You agree to pay the fees for exchanges and withdrawals completed via the
|
||||
Taler Wallet ("Fees") as defined by us, which we may change from time to
|
||||
time.
|
||||
|
||||
|
||||
Copyrights and trademarks
|
||||
-------------------------
|
||||
|
||||
The Taler Wallet is released under the terms of the GNU General Public License
|
||||
(GNU GPL). You have the right to access, use, and share the Taler Wallet, in
|
||||
modified or unmodified form. However, the GPL is a strong copyleft license,
|
||||
which means that any derivative works must be distributed under the same
|
||||
license terms as the original software. If you have any questions, you should
|
||||
review the GNU GPL’s full terms and conditions on the GNU GPL Licenses page
|
||||
(https://www.gnu.org/licenses/). “Taler” itself is a trademark
|
||||
of Taler Systems SA. You are welcome to use the name in relation to processing
|
||||
payments based on the Taler protocol, assuming your use is compatible with an
|
||||
official release from the GNU Project that is not older than two years.
|
||||
|
||||
|
||||
|
||||
Discontinuance of services and Force majeure
|
||||
--------------------------------------------
|
||||
|
||||
We may, in our sole discretion and without cost to you, with or without prior
|
||||
notice, and at any time, modify or discontinue, temporarily or permanently,
|
||||
any portion of our Services. We will use the Taler protocol’s provisions to
|
||||
notify Wallets if our Services are to be discontinued. It is your
|
||||
responsibility to ensure that the Taler Wallet is online at least once every
|
||||
three months to observe these notifications. We shall not be held responsible
|
||||
or liable for any loss of funds in the event that we discontinue or depreciate
|
||||
the Services and your Taler Wallet fails to transfer out the coins within a
|
||||
three months notification period.
|
||||
|
||||
We shall not be held liable for any delays, failure in performance, or
|
||||
interruptions of service which result directly or indirectly from any cause or
|
||||
condition beyond our reasonable control, including but not limited to: any
|
||||
delay or failure due to any act of God, act of civil or military authorities,
|
||||
act of terrorism, civil disturbance, war, strike or other labor dispute, fire,
|
||||
interruption in telecommunications or Internet services or network provider
|
||||
services, failure of equipment and/or software, other catastrophe, or any
|
||||
other occurrence which is beyond our reasonable control and shall not affect
|
||||
the validity and enforceability of any remaining provisions.
|
||||
|
||||
|
||||
Questions or comments
|
||||
---------------------
|
||||
|
||||
We welcome comments, questions, concerns, or suggestions. Please send us a
|
||||
message via the usual communication channels at PVV
|
||||
24
secrets/kvernberg/exhange-offline-master.priv
Normal file
24
secrets/kvernberg/exhange-offline-master.priv
Normal file
@@ -0,0 +1,24 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:dhVo1B+ZG1B6s0bTLgph4ipPmi0mveaObbJAffDQbpY=,iv:P5plvu4DQYa99cQZQ6B/gEFcSffu3lTY3+Z80Cfoj94=,tag:4xcqCbn6fFSmCbYmmEgQEg==,type:str]",
|
||||
"sops": {
|
||||
"kms": null,
|
||||
"gcp_kms": null,
|
||||
"azure_kv": null,
|
||||
"hc_vault": null,
|
||||
"age": [
|
||||
{
|
||||
"recipient": "age19rlntxt0m27waa0n288g9wgpksa6ndlzz8eneeqya7w3zd7may0sqzhcvz",
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5MzVHSE15Nk9MODQxc2g0\nbHlqNmFKclBYbUNKQTNUOGo0VThiaEZTVzJFCmU2YkYwMXlyeHM3ZzAxOWZpa3k4\nUUJLanVFbkNMa25RcGZmOTBsVmtzazQKLS0tIE1sTTBqT3VJMDFOYXl0T1JvcDRV\nRFpsZGNOZzFzMFc3YzcxeXdIK1d6QUUKzy0n7DJsOmrNvU03Tn6Zcj/l/kAylzzP\nhNnFLXfStdKl3A/qrzBPhTVbYD73yFkZuQ+bDr7/IMsHAmDsztuA9g==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
},
|
||||
{
|
||||
"recipient": "age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq",
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnbEdBWjdEbmtNYWJHQnFj\nSU1yb0NYVG4xVlZkYTdUWUpDcGdmbFF6U1NrCjBlWFZkcC9FMVJLYUtDNlBTUWcw\nNHBwWFNESDBQQmJNb3NDN2tDekM4eUUKLS0tICtMVGc1L2JFQ1BqKzM3eWFPRmRQ\nWXlQUWpvdUdOUlZ1OFhtS0ErL0JKSlUKzxLKbsnXvEqnR2HVsTxNqmM7YPjWfCjG\nZ4Bf046NdseomkNuTvWuPzjzPTe4GvjudMYc4ODchkIMOo6hXyf5kw==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2024-11-17T01:12:23Z",
|
||||
"mac": "ENC[AES256_GCM,data:aXIM/pmgVmfNSa+PwpfK6Efh/kCWXUqZNcKLkyhRwl++vaIBQUIQgQjv09hWHOF77V3ZjRQjh2E1uNe2baBLEmrDT5Au+7VABW+j49KX/vKMd+1l4w47l3DukOVnoo50bsOQFtH+amSl2P2imxpO15sjVDu9/nUeu2qXrtbIUh8=,iv:BQVs3P9p86uzTH2BfuSOxycpE6di4ZIwSz7OTZdcQPg=,tag:mT4Ek8dDbVINGp4Odt62zw==,type:str]",
|
||||
"pgp": null,
|
||||
"unencrypted_suffix": "_unencrypted",
|
||||
"version": "3.9.1"
|
||||
}
|
||||
}
|
||||
@@ -13,7 +13,6 @@
|
||||
bottom
|
||||
eza
|
||||
neovim
|
||||
diskonaut
|
||||
ripgrep
|
||||
tmux
|
||||
];
|
||||
|
||||
@@ -31,10 +31,6 @@ in rec {
|
||||
ipv4 = pvv-ipv4 168;
|
||||
ipv6 = pvv-ipv6 168;
|
||||
};
|
||||
dagali = {
|
||||
ipv4 = pvv-ipv4 185;
|
||||
ipv6 = pvv-ipv6 185;
|
||||
};
|
||||
ildkule = {
|
||||
ipv4 = "129.241.153.213";
|
||||
ipv4_internal = "192.168.12.209";
|
||||
@@ -68,6 +64,10 @@ in rec {
|
||||
ipv4 = pvv-ipv4 234;
|
||||
ipv6 = pvv-ipv6 234;
|
||||
};
|
||||
kvernberg = {
|
||||
ipv4 = pvv-ipv4 206;
|
||||
ipv6 = pvv-ipv6 "1:206";
|
||||
};
|
||||
};
|
||||
|
||||
defaultNetworkConfig = {
|
||||
|
||||
Reference in New Issue
Block a user