WIP

.gitignore

@@ -1,4 +1,3 @@
 result*
 /configuration.nix
 /.direnv/
-*.qcow2

base.nix

@@ -76,19 +76,10 @@
   # Trusted users on the nix builder machines
   users.groups."nix-builder-users".name = "nix-builder-users";
 
-  # Let's not thermal throttle
-  services.thermald.enable = lib.mkIf (lib.all (x: x) [
-      (config.nixpkgs.system == "x86_64-linux")
-      (!config.boot.isContainer or false)
-    ]) true;
-
   services.openssh = {
     enable = true;
     extraConfig = ''
       PubkeyAcceptedAlgorithms=+ssh-rsa
-      Match Group wheel
-        PasswordAuthentication no
-      Match All
     '';
     settings.PermitRootLogin = "yes";
   };
@@ -139,12 +130,4 @@
     acceptTerms = true;
     defaults.email = "drift@pvv.ntnu.no";
   };
-  # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
-  virtualisation.vmVariant = {
-    security.acme.defaults.server = "https://127.0.0.1";
-    security.acme.preliminarySelfsigned = true;
-
-    users.users.root.initialPassword = "root";
-  };
-
 }

flake.lock

@@ -194,11 +194,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723850344,
+        "lastModified": 1693136143,
-        "narHash": "sha256-aT37O9l9eclWEnqxASVNBL1dKwDHZUOqdbA4VO9DJvw=",
+        "narHash": "sha256-amHprjftc3y/bg8yf4hITCLa+ez5HIi0yGfR7TU6UIc=",
         "ref": "refs/heads/main",
-        "rev": "38b66677ab8c01aee10cd59e745af9ce3ea88092",
+        "rev": "a32894b305f042d561500f5799226afd1faf5abb",
-        "revCount": 19,
+        "revCount": 9,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
       },
@@ -207,25 +207,6 @@
         "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
       }
     },
-    "pvv-doorbell-bot": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "dirtyRev": "cec320746bbf5b5bc6618a145c1a997ebd0b5196-dirty",
-        "dirtyShortRev": "cec3207-dirty",
-        "lastModified": 1724515328,
-        "narHash": "sha256-Vj3ZJkCaLq+6d1LJtl7Hg5f7XV4NDPeNC1xEyu9QkOI=",
-        "type": "git",
-        "url": "file:///home/felixalb/doorbell-matrix-bot"
-      },
-      "original": {
-        "type": "git",
-        "url": "file:///home/felixalb/doorbell-matrix-bot"
-      }
-    },
     "pvv-nettsiden": {
       "inputs": {
         "nixpkgs": [
@@ -256,7 +237,6 @@
         "nixpkgs": "nixpkgs",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "pvv-calendar-bot": "pvv-calendar-bot",
-        "pvv-doorbell-bot": "pvv-doorbell-bot",
         "pvv-nettsiden": "pvv-nettsiden",
         "sops-nix": "sops-nix"
       }

flake.nix

@@ -17,10 +17,6 @@
     pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
     pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
 
-    pvv-doorbell-bot.url = "git+https://git.pvv.ntnu.no/Projects/doorbell-matrix-bot.git";
-    #pvv-doorbell-bot.url = "git+file:///home/felixalb/doorbell-matrix-bot";
-    pvv-doorbell-bot.inputs.nixpkgs.follows = "nixpkgs";
-
     matrix-next.url = "github:dali99/nixos-matrix-modules/v0.6.0";
     matrix-next.inputs.nixpkgs.follows = "nixpkgs";
 
@@ -85,11 +81,9 @@
         modules = [
           inputs.matrix-next.nixosModules.default
           inputs.pvv-calendar-bot.nixosModules.default
-          inputs.pvv-doorbell-bot.nixosModules.default
         ];
         overlays = [
           inputs.pvv-calendar-bot.overlays.x86_64-linux.default
-          inputs.pvv-doorbell-bot.overlays.x86_64-linux.default
         ];
       };
       bekkalokk = stableNixosConfig "bekkalokk" {

hosts/bekkalokk/services/gitea/default.nix

@@ -6,7 +6,8 @@ let
 in {
   imports = [
     ./ci.nix
-    ./import-users.nix
+    ./import-users
+    ./web-secret-provider
   ];
 
   sops.secrets = {
@@ -135,16 +136,10 @@ in {
     script = let
       logo-svg = ../../../../assets/logo_blue_regular.svg;
       logo-png = ../../../../assets/logo_blue_regular.png;
-      extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
-        <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
-        <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
-        <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
-      '';
     in ''
       install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
       install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
       install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
-      install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
     '';
   };
 }

hosts/bekkalokk/services/gitea/web-secret-provider/default.nix

@@ -0,0 +1,100 @@
+{ config, pkgs, lib, ... }:
+let
+  sops.secrets = {
+    "gitea/web-secret-provider/Drift" = {
+      owner = "gitea";
+      group = "gitea";
+      restartUnits = [ "gitea-web-secret-provider@Drift" ];
+    };
+    "gitea/web-secret-provider/Projects" = {
+      owner = "gitea";
+      group = "gitea";
+      restartUnits = [ "gitea-web-secret-provider@Projects" ];
+    };
+    "gitea/web-secret-provider/Kurs" = {
+      owner = "gitea";
+      group = "gitea";
+      restartUnits = [ "gitea-web-secret-provider@Kurs" ];
+  };
+
+  cfg = config.services.gitea;
+
+  program = pkgs.writers.writePython3 "gitea-web-secret-provider" {
+    libraries = with pkgs.python3Packages; [ requests ];
+    makeWrapperArgs = [
+      "--prefix PATH : ${(lib.makeBinPath [ pkgs.openssh ])}"
+    ];
+  } (builtins.readFile ./gitea-web-secret-provider.py);
+in
+{
+
+  # https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html#Specifiers
+  # %i - instance name (after the @)
+  # %d - secrets directory
+  # %s - /var/lib
+  systemd.services = {
+    "gitea-web-secret-provider@" = {
+      description = "Gitea web secret provider";
+      wantedBy = [ "multi-user.target" ];
+      requires = [ "gitea.service" "network.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = let
+          args = lib.cli.toGNUCommandLineShell { } {
+            org = "%i";
+            token-path = "%d/token";
+            api-url = "${cfg.settings.server.ROOT_URL}api/v1";
+            key-dir = "%s/%i/keys";
+            authorized-keys-path = "%s/gitea-web/authorized_keys.d/%i";
+            rrsync-path = "${pkgs.rrsync}/bin/rrsync";
+            web-dir = "%s/gitea-web/web";
+          };
+        in "${program} ${args}";
+        User = "gitea";
+        Group = "gitea";
+        Restart = "always";
+
+        StateDir = "%i";
+        WorkingDirectory = "%s/%i";
+
+        # Hardening
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectSystem = true;
+        ProtectHome = true;
+        ProtectControlGroups = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        MemoryDenyWriteExecute = true;
+        LockPersonality = true;
+      };
+    };
+  }
+  //
+  builtins.listToAttrs (map (org: lib.nameValuePair "gitea-web-secret-provider@${org}" {
+      serviceConfig.LoadCredential = [
+        "token:${config.sops.secrets."gitea/web-secret-provider/${org}".path}"
+      ];
+  }));
+
+  systemd.timers = {
+    "gitea-web-secret-provider@" = {
+      description = "Run the Gitea web secret provider";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "daily";
+        RandomizedDelaySec = "1h";
+        Persistent = true;
+        Unit = "gitea-web-secret-provider@%i.service";
+      };
+    };
+  }
+  //
+  builtins.listToAttrs (map (org: lib.nameValuePair "gitea-web-secret-provider@${org}" { }));
+
+  # services.nginx.virtualHosts.
+}

hosts/bekkalokk/services/gitea/web-secret-provider/gitea-web-secret-provider.py

@@ -0,0 +1,105 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python3 -p "python3.withPackages(ps: with ps; [ requests ])" openssh
+
+import argparse
+import hashlib
+import os
+import requests
+import subprocess
+
+
+def parse_args():
+    parser = argparse.ArgumentParser(description="Generate SSH keys for Gitea repositories and add them as secrets")
+    parser.add_argument("--org", required=True, help="The organization to generate keys for")
+    parser.add_argument("--token-path", metavar='PATH', required=True, help="Path to a file containing the Gitea API token")
+    parser.add_argument("--api-url", metavar='URL', help="The URL of the Gitea API", default="https://git.pvv.ntnu.no/api/v1")
+    parser.add_argument("--key-dir", metavar='PATH', help="The directory to store the generated keys in", default="/run/gitea-web-secret-provider")
+    parser.add_argument("--authorized-keys-path", metavar='PATH', help="The path to the resulting authorized_keys file", default="/etc/ssh/authorized_keys.d/gitea-web-secret-provider")
+    parser.add_argument("--rrsync-path", metavar='PATH', help="The path to the rrsync binary", default="/run/current-system/sw/bin/rrsync")
+    parser.add_argument("--web-dir", metavar='PATH', help="The directory to sync the repositories to", default="/var/www")
+    parser.add_argument("--force", action="store_true", help="Overwrite existing keys")
+    return parser.parse_args()
+
+
+def add_secret(args, token, repo, name, secret):
+    result = requests.put(
+        f"{args.api_url}/repos/{args.org}/{repo}/actions/secrets/{name}",
+        json = { 'data': secret },
+        headers = { 'Authorization': 'token ' + token },
+    )
+    if result.status_code not in (201, 204):
+        raise Exception(f"Failed to add secret: {result.json()}")
+
+
+def get_org_repo_list(args, token):
+    result = requests.get(
+        f"{args.api_url}/orgs/{args.org}/repos",
+        headers = { 'Authorization': 'token ' + token },
+    )
+    return [repo["name"] for repo in result.json()]
+
+
+def generate_ssh_key(args, repository: str):
+    keyname = hashlib.sha256(args.org.encode() + repository.encode()).hexdigest()
+
+    if not os.path.exists(os.path.join(args.key_dir, keyname)) or args.force:
+        subprocess.run(
+            [
+                "ssh-keygen",
+                *("-t", "ed25519"),
+                *("-b", "4096"),
+                *("-f", os.path.join(args.key_dir, keyname)),
+                *("-N", ""),
+                *("-C", f"{args.org}/{repository}"),
+            ],
+            check=True,
+            stdin=subprocess.DEVNULL,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL
+        )
+        print(f"Generated SSH key for `{args.org}/{repository}`")
+
+    with open(os.path.join(args.key_dir, keyname), "r") as f:
+        private_key = f.read()
+
+    with open(os.path.join(args.key_dir, keyname + ".pub"), "r") as f:
+        public_key = f.read()
+
+    return private_key, public_key
+
+
+def generate_authorized_keys(args, repo_public_keys: list[tuple[str, str]]):
+    result = ""
+    for repo, public_key in repo_public_keys:
+        result += f"""
+            command="{args.rrsync_path} -wo {args.web_dir}/{args.org}/{repo}",restrict,no-agent-forwarding,no-port-forwarding,no-pty,no-X11-forwarding {public_key}
+        """.strip() + "\n"
+
+    with open(args.authorized_keys_path, "w") as f:
+        f.write(result)
+
+
+def main():
+    args = parse_args()
+
+    with open(args.token_path, "r") as f:
+        token = f.read().strip()
+
+    os.makedirs(args.key_dir, 0o700, exist_ok=True)
+
+    repos = get_org_repo_list(args, token)
+    print(f'Found {len(repos)} repositories in `{args.org}`')
+
+    repo_public_keys = []
+    for repo in repos:
+        print(f"Locating key for `{args.org}/{repo}`")
+        private_key, public_key = generate_ssh_key(args, repo)
+        add_secret(args, token, repo, "WEB_SYNC_SSH_KEY", private_key)
+        repo_public_keys.append((repo, public_key))
+
+    generate_authorized_keys(args, repo_public_keys)
+    print(f"Wrote authorized_keys file to `{args.authorized_keys_path}`")
+
+
+if __name__ == "__main__":
+    main()

hosts/bicep/configuration.nix

@@ -9,11 +9,11 @@
 
     ./acmeCert.nix
 
-    ./services/calendar-bot.nix
-    ./services/doorbell-bot.nix
-    ./services/mysql.nix
     ./services/mysql.nix
     ./services/postgres.nix
+    ./services/mysql.nix
+    # TODO: fix the calendar bot
+    # ./services/calendar-bot.nix
 
     ./services/matrix
   ];

hosts/bicep/services/calendar-bot.nix

@@ -2,19 +2,11 @@
 let
   cfg = config.services.pvv-calendar-bot;
 in {
-  sops.secrets = {
+  sops.secrets."calendar-bot/matrix_token" = {
-    "calendar-bot/matrix_token" = {
+    sopsFile = ../../../secrets/bicep/bicep.yaml;
-      sopsFile = ../../../secrets/bicep/bicep.yaml;
+    key = "calendar-bot/matrix_token";
-      key = "calendar-bot/matrix_token";
+    owner = cfg.user;
-      owner = cfg.user;
+    group = cfg.group;
-      group = cfg.group;
-    };
-    "calendar-bot/mysql_password" = {
-      sopsFile = ../../../secrets/bicep/bicep.yaml;
-      key = "calendar-bot/mysql_password";
-      owner = cfg.user;
-      group = cfg.group;
-    };
   };
 
   services.pvv-calendar-bot = {
@@ -26,11 +18,6 @@ in {
         user = "@bot_calendar:pvv.ntnu.no";
         channel = "!gkNLUIhYVpEyLatcRz:pvv.ntnu.no";
       };
-      database = {
-        host = "mysql.pvv.ntnu.no";
-        user = "calendar-bot";
-        passwordFile = config.sops.secrets."calendar-bot/mysql_password".path;
-      };
       secretsFile = config.sops.secrets."calendar-bot/matrix_token".path;
       onCalendar = "*-*-* 09:00:00";
     };

hosts/bicep/services/doorbell-bot.nix

@@ -1,16 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.pvv-doorbell-bot;
-in {
-  sops.secrets."doorbell-bot/config-json" = {
-    owner = cfg.user;
-    group = cfg.group;
-  };
-
-  services.pvv-doorbell-bot = {
-    enable = true;
-    settings = {
-      configFile = config.sops.secrets."doorbell-bot/config-json".path;
-    };
-  };
-}

justfile

@@ -10,10 +10,6 @@ check:
 build-machine machine=`just _a_machine`:
   {{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel
 
-run-vm machine=`just _a_machine`:
-  nixos-rebuild build-vm --flake .#{{ machine }}
-  QEMU_NET_OPTS="hostfwd=tcp::8080-:80,hostfwd=tcp::8081-:443,hostfwd=tcp::2222-:22" ./result/bin/run-*-vm
-
 @update-inputs:
   nix eval .#inputs --apply builtins.attrNames --json \
     | jq '.[]' -r \

secrets/bicep/bicep.yaml

@@ -1,8 +1,5 @@
 calendar-bot:
     matrix_token: ENC[AES256_GCM,data:zJv9sw6pEzb9hxKT682wsD87HC9iejbps2wl2Z5QW1XZUSBHdcqyg1pxd+jFKTeKGQ==,iv:zDbvF1H98NsECjCtGXS+Y9HIhXowzz9HF9mltqnArog=,tag:/ftcOSQ13ElkVJBxYIMUGQ==,type:str]
-    mysql_password: ENC[AES256_GCM,data:Gqag8yOgPH3ntoT5TmaqJWv1j+si2qIyz5Ryfw5E2A==,iv:kQDcxnPfwJQcFovI4f87UDt18F8ah3z5xeY86KmdCyY=,tag:A1sCSNXJziAmtUWohqwJgg==,type:str]
-doorbell-bot:
-    config-json: ENC[AES256_GCM,data:QNFHiUqaBWfW9ZRAkZo9M18AMbn/oSxvEMq1N1NsDcBjxJMo/OE36fz1Uf4TagGccCDkWy56wSVSFZm8KZnXVaQ/X0EgJkUK1JZyR7i5yiEW8ByLaVzThMWBwxQoj2cz48z53krzfddyl250rLFQRa7Fco74yTFfBWruf/1clN5O/iHFspeW7uJtQh/oyFIVb87YisjKU2+jpU3IeDNsO6VFWOoOJd+ACmfwsAY0wOz5lzBEIrdU2k/PMgSVzECMV4S5ipwIUmVUpGzbvgAWZQGtsUeVevAbvZ1QgyH6bhDIUheeUrOKN0cbgEMc/xIi7yZ+VWHOMBqb8LkyBvunG2TjK31B1HAGL/krBS+gvvQnW0ZN,iv:K0djdxNOGaHBkE4vyh/22fruAHVsZYVT68cdVoMmogw=,tag:3fjjzD3bghvGy3aZ7/Ienw==,type:str]
 mysql:
     password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
 sops:
@@ -65,8 +62,8 @@ sops:
             cTh5bnJ3WW90aXRCSUp6NHFYeU1tZ0kK4afdtJwGNu6wLRI0fuu+mBVeqVeB0rgX
             0q5hwyzjiRnHnyjF38CmcGgydSfDRmF6P+WIMbCwXC6LwfRhAmBGPg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-24T16:49:06Z"
+    lastmodified: "2023-09-05T23:28:56Z"
-    mac: ENC[AES256_GCM,data:A5pYM3yNt5GdlvpdDbRXxQwUccC/dr5JZwPBMjjx4ZRaJMbewpmGL/ySITnsCEuxOG1cagc1S28ti8k3z0bR4rfFlt/fZ93K8uwI9rT6KW5pSEAa1vPEz8Jq+7asfJIBMCpxFxN704JDSeOnBMaSHwQdICdmG4jfN/F+YbXTPIA=,iv:Y6gloFlYtnJZ3kzcUtZZZmJQ8KowQ29pwZaqo/ePrm8=,tag:r8XFLU5PGMr3U3K0N0cmlQ==,type:str]
+    mac: ENC[AES256_GCM,data:pCWTkmCQgBOqhejK2sCLQ3H8bRXmXlToQxYmOG0IWDo2eGiZOLuIkZ1/1grYgfxAGiD4ysJod0nJuvo+eAsMeYAy6QJVtrOqO2d9V2NEdzLckXyYvwyJyZoFbNC5EW9471V0m4jLRSh5821ckNo/wtWFR11wfO15tI3MqtD1rtA=,iv:QDnckPl0LegaH0b7V4WAtmVXaL4LN+k3uKHQI2dkW7E=,tag:mScUQBR0ZHl1pi/YztrvFg==,type:str]
     pgp:
         - created_at: "2024-08-04T00:03:40Z"
           enc: |-
@@ -89,4 +86,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.7.3