mirror of
https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git
synced 2026-07-04 09:51:47 +02:00
Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 h7x4
|
b848e0f1cc | ||
|
h7x4
|
c671329b93 |
+14
@@ -20,6 +20,7 @@ keys:
|
|||||||
- &host_lupine-4 age1ml48zztcmnrdrhrdsjrlyxf09jtmjgz46u8td4zm59wn3fm4g57qs4wg0l
|
- &host_lupine-4 age1ml48zztcmnrdrhrdsjrlyxf09jtmjgz46u8td4zm59wn3fm4g57qs4wg0l
|
||||||
- &host_lupine-5 age12gws5nws69vxryd3kt7q0ayngch90efmhqcrfhnnsmj00lkgxd4qsdkvqn
|
- &host_lupine-5 age12gws5nws69vxryd3kt7q0ayngch90efmhqcrfhnnsmj00lkgxd4qsdkvqn
|
||||||
- &host_skrot age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr
|
- &host_skrot age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr
|
||||||
|
- &host_temmie age10avsdvqger25z0lyzlq8v7xfzcmypkmjsswswaxwqnpnl6x9wcjq0uv2n7
|
||||||
- &host_gluttony age12czfkvuw9pjk5qny5c6m2hjhd634cj9r4dsa3ss5zkux5h4vvc7s7k4urq
|
- &host_gluttony age12czfkvuw9pjk5qny5c6m2hjhd634cj9r4dsa3ss5zkux5h4vvc7s7k4urq
|
||||||
|
|
||||||
creation_rules:
|
creation_rules:
|
||||||
@@ -121,6 +122,19 @@ creation_rules:
|
|||||||
pgp:
|
pgp:
|
||||||
- *user_oysteikt
|
- *user_oysteikt
|
||||||
|
|
||||||
|
- path_regex: secrets/temmie/[^/]+\.yaml$
|
||||||
|
key_groups:
|
||||||
|
- age:
|
||||||
|
- *host_temmie
|
||||||
|
- *user_danio
|
||||||
|
- *user_felixalb
|
||||||
|
- *user_pederbs_sopp
|
||||||
|
- *user_pederbs_nord
|
||||||
|
- *user_pederbs_bjarte
|
||||||
|
- *user_vegardbm
|
||||||
|
pgp:
|
||||||
|
- *user_oysteikt
|
||||||
|
|
||||||
- path_regex: secrets/gluttony/[^/]+\.yaml$
|
- path_regex: secrets/gluttony/[^/]+\.yaml$
|
||||||
key_groups:
|
key_groups:
|
||||||
- age:
|
- age:
|
||||||
|
|||||||
Generated
+22
@@ -330,6 +330,27 @@
|
|||||||
"url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
|
"url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"passwd2systemd-users": {
|
||||||
|
"inputs": {
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1780764154,
|
||||||
|
"narHash": "sha256-Xvf9aBNLYDnbDKdtFjp5GEA/rZwVczHZWbJ0hac8Vv4=",
|
||||||
|
"ref": "main",
|
||||||
|
"rev": "8b4541be73ee3bd6c60525b2f42605efe89398c9",
|
||||||
|
"revCount": 14,
|
||||||
|
"type": "git",
|
||||||
|
"url": "https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"ref": "main",
|
||||||
|
"type": "git",
|
||||||
|
"url": "https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git"
|
||||||
|
}
|
||||||
|
},
|
||||||
"pvv-calendar-bot": {
|
"pvv-calendar-bot": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
@@ -408,6 +429,7 @@
|
|||||||
"nix-topology": "nix-topology",
|
"nix-topology": "nix-topology",
|
||||||
"nixpkgs": "nixpkgs",
|
"nixpkgs": "nixpkgs",
|
||||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||||
|
"passwd2systemd-users": "passwd2systemd-users",
|
||||||
"pvv-calendar-bot": "pvv-calendar-bot",
|
"pvv-calendar-bot": "pvv-calendar-bot",
|
||||||
"pvv-nettsiden": "pvv-nettsiden",
|
"pvv-nettsiden": "pvv-nettsiden",
|
||||||
"qotd": "qotd",
|
"qotd": "qotd",
|
||||||
|
|||||||
@@ -53,6 +53,8 @@
|
|||||||
|
|
||||||
bro.url = "git+https://git.pvv.ntnu.no/Projects/bro.git?ref=main";
|
bro.url = "git+https://git.pvv.ntnu.no/Projects/bro.git?ref=main";
|
||||||
bro.inputs.nixpkgs.follows = "nixpkgs";
|
bro.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
passwd2systemd-users.url = "git+https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git?ref=main";
|
||||||
|
passwd2systemd-users.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = {
|
outputs = {
|
||||||
@@ -245,6 +247,7 @@
|
|||||||
temmie = stableNixosConfig "temmie" {
|
temmie = stableNixosConfig "temmie" {
|
||||||
overlays = [
|
overlays = [
|
||||||
inputs.bro.overlays.default
|
inputs.bro.overlays.default
|
||||||
|
inputs.passwd2systemd-users.overlays.default
|
||||||
];
|
];
|
||||||
modules = [
|
modules = [
|
||||||
inputs.bro.nixosModules.default
|
inputs.bro.nixosModules.default
|
||||||
|
|||||||
@@ -0,0 +1 @@
|
|||||||
|
target
|
||||||
@@ -0,0 +1,171 @@
|
|||||||
|
# This file is automatically @generated by Cargo.
|
||||||
|
# It is not intended for manual editing.
|
||||||
|
version = 4
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "apache-log-processor"
|
||||||
|
version = "0.1.0"
|
||||||
|
dependencies = [
|
||||||
|
"nix",
|
||||||
|
"time",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "bitflags"
|
||||||
|
version = "2.11.1"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "cfg-if"
|
||||||
|
version = "1.0.4"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "cfg_aliases"
|
||||||
|
version = "0.2.1"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "deranged"
|
||||||
|
version = "0.5.8"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
|
||||||
|
dependencies = [
|
||||||
|
"powerfmt",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "itoa"
|
||||||
|
version = "1.0.18"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "libc"
|
||||||
|
version = "0.2.186"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "nix"
|
||||||
|
version = "0.31.3"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
|
||||||
|
dependencies = [
|
||||||
|
"bitflags",
|
||||||
|
"cfg-if",
|
||||||
|
"cfg_aliases",
|
||||||
|
"libc",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "num-conv"
|
||||||
|
version = "0.2.2"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "num_threads"
|
||||||
|
version = "0.1.7"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9"
|
||||||
|
dependencies = [
|
||||||
|
"libc",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "powerfmt"
|
||||||
|
version = "0.2.0"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "proc-macro2"
|
||||||
|
version = "1.0.106"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
|
||||||
|
dependencies = [
|
||||||
|
"unicode-ident",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "quote"
|
||||||
|
version = "1.0.45"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
|
||||||
|
dependencies = [
|
||||||
|
"proc-macro2",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "serde_core"
|
||||||
|
version = "1.0.228"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
|
||||||
|
dependencies = [
|
||||||
|
"serde_derive",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "serde_derive"
|
||||||
|
version = "1.0.228"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
|
||||||
|
dependencies = [
|
||||||
|
"proc-macro2",
|
||||||
|
"quote",
|
||||||
|
"syn",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "syn"
|
||||||
|
version = "2.0.117"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
|
||||||
|
dependencies = [
|
||||||
|
"proc-macro2",
|
||||||
|
"quote",
|
||||||
|
"unicode-ident",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "time"
|
||||||
|
version = "0.3.47"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
|
||||||
|
dependencies = [
|
||||||
|
"deranged",
|
||||||
|
"itoa",
|
||||||
|
"libc",
|
||||||
|
"num-conv",
|
||||||
|
"num_threads",
|
||||||
|
"powerfmt",
|
||||||
|
"serde_core",
|
||||||
|
"time-core",
|
||||||
|
"time-macros",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "time-core"
|
||||||
|
version = "0.1.8"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "time-macros"
|
||||||
|
version = "0.2.27"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
|
||||||
|
dependencies = [
|
||||||
|
"num-conv",
|
||||||
|
"time-core",
|
||||||
|
]
|
||||||
|
|
||||||
|
[[package]]
|
||||||
|
name = "unicode-ident"
|
||||||
|
version = "1.0.24"
|
||||||
|
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||||
|
checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
[package]
|
||||||
|
name = "apache-log-processor"
|
||||||
|
version = "0.1.0"
|
||||||
|
edition = "2024"
|
||||||
|
autobins = false
|
||||||
|
license = "MIT"
|
||||||
|
authors = [
|
||||||
|
"projects@pvv.ntnu.no",
|
||||||
|
]
|
||||||
|
|
||||||
|
[dependencies]
|
||||||
|
nix = { version = "0.31.3", features = ["event", "fs", "user"] }
|
||||||
|
time = { version = "0.3.47", features = ["formatting", "local-offset"] }
|
||||||
|
|
||||||
|
|
||||||
|
[[bin]]
|
||||||
|
name = "apache-log-processor"
|
||||||
|
bench = false
|
||||||
|
path = "src/main.rs"
|
||||||
@@ -0,0 +1,33 @@
|
|||||||
|
{
|
||||||
|
lib
|
||||||
|
, rustPlatform
|
||||||
|
, stdenv
|
||||||
|
}:
|
||||||
|
let
|
||||||
|
cargoToml = fromTOML (builtins.readFile ./Cargo.toml);
|
||||||
|
cargoLock = ./Cargo.lock;
|
||||||
|
mainProgram = (lib.head cargoToml.bin).name;
|
||||||
|
pname = cargoToml.package.name;
|
||||||
|
in
|
||||||
|
rustPlatform.buildRustPackage {
|
||||||
|
inherit pname;
|
||||||
|
inherit (cargoToml.package) version;
|
||||||
|
src = lib.fileset.toSource {
|
||||||
|
root = ./.;
|
||||||
|
fileset = lib.fileset.unions [
|
||||||
|
./Cargo.toml
|
||||||
|
./Cargo.lock
|
||||||
|
./src
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
cargoLock.lockFile = cargoLock;
|
||||||
|
|
||||||
|
doCheck = true;
|
||||||
|
|
||||||
|
meta = with lib; {
|
||||||
|
license = licenses.mit;
|
||||||
|
platforms = platforms.linux;
|
||||||
|
inherit mainProgram;
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,321 @@
|
|||||||
|
use nix::{
|
||||||
|
errno::Errno,
|
||||||
|
fcntl::{FcntlArg, OFlag, fcntl, open},
|
||||||
|
sys::{
|
||||||
|
epoll::{Epoll, EpollCreateFlags, EpollEvent, EpollFlags, EpollTimeout},
|
||||||
|
stat::Mode,
|
||||||
|
},
|
||||||
|
unistd::{User, getegid, geteuid, read, setegid, seteuid, write},
|
||||||
|
};
|
||||||
|
use std::{
|
||||||
|
collections::VecDeque,
|
||||||
|
os::fd::{AsFd, BorrowedFd, OwnedFd},
|
||||||
|
path::PathBuf,
|
||||||
|
process::exit,
|
||||||
|
};
|
||||||
|
use time::{OffsetDateTime, format_description};
|
||||||
|
|
||||||
|
const READ_BUFFER_SIZE: usize = 8 * 1024;
|
||||||
|
|
||||||
|
#[derive(Debug, Clone, Copy)]
|
||||||
|
enum LogMode {
|
||||||
|
Access,
|
||||||
|
Error,
|
||||||
|
}
|
||||||
|
|
||||||
|
fn main() -> Result<(), String> {
|
||||||
|
let log_mode = match std::env::args().nth(1).as_deref() {
|
||||||
|
Some("access") => LogMode::Access,
|
||||||
|
Some("error") => LogMode::Error,
|
||||||
|
Some(other) => {
|
||||||
|
return Err(format!(
|
||||||
|
"invalid log mode `{other}`; expected `access` or `error`"
|
||||||
|
));
|
||||||
|
}
|
||||||
|
None => return Err("missing log mode argument; expected `access` or `error`".to_string()),
|
||||||
|
};
|
||||||
|
|
||||||
|
let tee_file = match log_mode {
|
||||||
|
LogMode::Access => None,
|
||||||
|
LogMode::Error => Some(
|
||||||
|
open(
|
||||||
|
&PathBuf::from("/var/log/httpd/error.log"),
|
||||||
|
OFlag::O_WRONLY | OFlag::O_APPEND | OFlag::O_CREAT | OFlag::O_CLOEXEC,
|
||||||
|
Mode::S_IRUSR | Mode::S_IWUSR,
|
||||||
|
)
|
||||||
|
.map_err(|error| format!("failed to open error log for teeing: {error}"))?,
|
||||||
|
),
|
||||||
|
};
|
||||||
|
|
||||||
|
let stdin = std::io::stdin();
|
||||||
|
|
||||||
|
fcntl(stdin.as_fd(), FcntlArg::F_GETFL)
|
||||||
|
.map(OFlag::from_bits_retain)
|
||||||
|
.map(|flags| FcntlArg::F_SETFL(flags | OFlag::O_NONBLOCK))
|
||||||
|
.and_then(|flags| fcntl(stdin.as_fd(), flags))
|
||||||
|
.map_err(|error| format!("failed to make stdin nonblocking: {error}"))?;
|
||||||
|
|
||||||
|
let epoll = Epoll::new(EpollCreateFlags::EPOLL_CLOEXEC)
|
||||||
|
.map_err(|error| format!("failed to create epoll instance: {error}"))?;
|
||||||
|
|
||||||
|
epoll
|
||||||
|
.add(
|
||||||
|
stdin.as_fd(),
|
||||||
|
EpollEvent::new(
|
||||||
|
EpollFlags::EPOLLIN | EpollFlags::EPOLLERR | EpollFlags::EPOLLHUP,
|
||||||
|
0,
|
||||||
|
),
|
||||||
|
)
|
||||||
|
.map_err(|error| format!("failed to register stdin with epoll: {error}"))?;
|
||||||
|
|
||||||
|
if let Err(error) = event_loop(log_mode, epoll, stdin.as_fd(), tee_file) {
|
||||||
|
eprintln!("Error: {error}");
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
fn event_loop(
|
||||||
|
log_mode: LogMode,
|
||||||
|
epoll: Epoll,
|
||||||
|
stdin_fd: BorrowedFd<'_>,
|
||||||
|
mut tee_file: Option<OwnedFd>,
|
||||||
|
) -> Result<(), String> {
|
||||||
|
let mut events = [EpollEvent::empty(); 1];
|
||||||
|
let mut pending = VecDeque::new();
|
||||||
|
|
||||||
|
loop {
|
||||||
|
let ready = loop {
|
||||||
|
match epoll.wait(&mut events, EpollTimeout::NONE) {
|
||||||
|
Ok(ready) => break ready,
|
||||||
|
Err(Errno::EINTR) => continue,
|
||||||
|
Err(error) => {
|
||||||
|
return Err(format!("epoll wait failed: {error}"));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
|
if ready == 0 {
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
|
||||||
|
let mut scratch = [0u8; READ_BUFFER_SIZE];
|
||||||
|
|
||||||
|
let eof = loop {
|
||||||
|
match read(stdin_fd, &mut scratch) {
|
||||||
|
Ok(0) => break true,
|
||||||
|
Ok(read_bytes) => pending.extend(scratch[..read_bytes].iter().copied()),
|
||||||
|
Err(Errno::EINTR) => continue,
|
||||||
|
Err(Errno::EAGAIN) => break false,
|
||||||
|
Err(error) => {
|
||||||
|
return Err(format!("failed to read from stdin: {error}"));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
|
while let Some(newline_index) = pending.iter().position(|byte| *byte == b'\n') {
|
||||||
|
let line = pending.make_contiguous();
|
||||||
|
process_line(log_mode, &line[..=newline_index], &mut tee_file)?;
|
||||||
|
pending.drain(..=newline_index);
|
||||||
|
}
|
||||||
|
|
||||||
|
if eof {
|
||||||
|
if !pending.is_empty() {
|
||||||
|
process_line(log_mode, pending.make_contiguous(), &mut tee_file)?;
|
||||||
|
pending.clear();
|
||||||
|
}
|
||||||
|
return Ok(());
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn process_line(
|
||||||
|
log_mode: LogMode,
|
||||||
|
line: &[u8],
|
||||||
|
tee_file: &mut Option<OwnedFd>,
|
||||||
|
) -> Result<(), String> {
|
||||||
|
if let Some(tee_file) = tee_file.as_ref() {
|
||||||
|
write_all_fd(tee_file, line).map_err(|error| {
|
||||||
|
format!("failed to append to APACHE_LOG_PROCESSOR_TEE_FILE: {error}")
|
||||||
|
})?;
|
||||||
|
}
|
||||||
|
|
||||||
|
if let Some(user) =
|
||||||
|
parse_username_from_line(line).and_then(|name| User::from_name(name).ok().flatten())
|
||||||
|
{
|
||||||
|
let identity = EffectiveIdentity::switch_to(&user).map_err(|error| {
|
||||||
|
format!(
|
||||||
|
"failed to switch effective identity to {} (uid {}, gid {}): {error}",
|
||||||
|
user.name, user.uid, user.gid
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
|
||||||
|
let result: Result<(), String> = (|| {
|
||||||
|
let dir = user.dir.join("nobackup/weblogs");
|
||||||
|
|
||||||
|
if !dir.is_dir() {
|
||||||
|
return Err(format!(
|
||||||
|
"logs directory {} does not exist for user {}",
|
||||||
|
dir.display(),
|
||||||
|
user.name
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
|
let now = OffsetDateTime::now_local()
|
||||||
|
.unwrap_or_else(|_| OffsetDateTime::now_utc())
|
||||||
|
.format(&format_description::parse("[year]-[month]-[day]").unwrap())
|
||||||
|
.map_err(|error| {
|
||||||
|
format!("failed to format current date for log file name: {error}")
|
||||||
|
})?;
|
||||||
|
|
||||||
|
let logfile = dir.join(match log_mode {
|
||||||
|
LogMode::Access => format!("access-{now}.log"),
|
||||||
|
LogMode::Error => format!("error-{now}.log"),
|
||||||
|
});
|
||||||
|
|
||||||
|
let fd = open(
|
||||||
|
&logfile,
|
||||||
|
OFlag::O_WRONLY | OFlag::O_APPEND | OFlag::O_CREAT | OFlag::O_CLOEXEC,
|
||||||
|
Mode::S_IRUSR
|
||||||
|
| Mode::S_IWUSR
|
||||||
|
| Mode::S_IRGRP
|
||||||
|
| Mode::S_IROTH
|
||||||
|
| Mode::S_IWGRP
|
||||||
|
| Mode::S_IWOTH,
|
||||||
|
)
|
||||||
|
.map_err(|error| format!("failed to open log file for user {}: {error}", user.name))?;
|
||||||
|
|
||||||
|
write_all_fd(fd.as_fd(), line).map_err(|error| {
|
||||||
|
format!(
|
||||||
|
"failed to append to log file for user {}: {error}",
|
||||||
|
user.name
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
|
||||||
|
Ok(())
|
||||||
|
})();
|
||||||
|
|
||||||
|
if let Err(error) = result {
|
||||||
|
eprintln!("Error processing log line for user {}: {error}", user.name);
|
||||||
|
}
|
||||||
|
|
||||||
|
identity.restore().map_err(|error| {
|
||||||
|
format!(
|
||||||
|
"failed to restore original effective identity after handling {}: {error}",
|
||||||
|
user.name
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
fn parse_username_from_line(line: &[u8]) -> Option<&str> {
|
||||||
|
line.splitn(8, |&b| b == b' ')
|
||||||
|
.nth(6)
|
||||||
|
.and_then(|path| {
|
||||||
|
path.strip_prefix(b"/~")
|
||||||
|
.and_then(|rest| rest.split(|&b| b == b'/').next())
|
||||||
|
})
|
||||||
|
.or_else(|| {
|
||||||
|
line.windows(b"/home/pvv/".len())
|
||||||
|
.enumerate()
|
||||||
|
.find_map(|(start, window)| {
|
||||||
|
(window == b"/home/pvv/")
|
||||||
|
.then_some(start + b"/home/pvv/".len())
|
||||||
|
.and_then(|start| line.get(start..))
|
||||||
|
.filter(|rest| rest.get(1) == Some(&b'/'))
|
||||||
|
.and_then(|rest| rest.get(2..))
|
||||||
|
.and_then(|rest| rest.split(|&b| b == b'/').next())
|
||||||
|
})
|
||||||
|
})
|
||||||
|
.filter(|segment| !segment.is_empty())
|
||||||
|
.and_then(|segment| std::str::from_utf8(segment).ok())
|
||||||
|
}
|
||||||
|
|
||||||
|
fn write_all_fd<Fd: AsFd>(fd: Fd, mut buffer: &[u8]) -> nix::Result<()> {
|
||||||
|
while !buffer.is_empty() {
|
||||||
|
match write(fd.as_fd(), buffer) {
|
||||||
|
Ok(0) => return Err(Errno::EIO),
|
||||||
|
Ok(written) => buffer = &buffer[written..],
|
||||||
|
Err(Errno::EINTR) => continue,
|
||||||
|
Err(error) => return Err(error),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
struct EffectiveIdentity {
|
||||||
|
saved_euid: nix::unistd::Uid,
|
||||||
|
saved_egid: nix::unistd::Gid,
|
||||||
|
restored: bool,
|
||||||
|
}
|
||||||
|
|
||||||
|
impl EffectiveIdentity {
|
||||||
|
fn switch_to(user: &User) -> nix::Result<Self> {
|
||||||
|
let guard = Self {
|
||||||
|
saved_euid: geteuid(),
|
||||||
|
saved_egid: getegid(),
|
||||||
|
restored: false,
|
||||||
|
};
|
||||||
|
|
||||||
|
setegid(user.gid)?;
|
||||||
|
if let Err(error) = seteuid(user.uid) {
|
||||||
|
let _ = setegid(guard.saved_egid);
|
||||||
|
return Err(error);
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(guard)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn restore(mut self) -> nix::Result<()> {
|
||||||
|
let restore_uid = seteuid(self.saved_euid);
|
||||||
|
let restore_gid = setegid(self.saved_egid);
|
||||||
|
self.restored = true;
|
||||||
|
|
||||||
|
restore_uid?;
|
||||||
|
restore_gid?;
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[cfg(test)]
|
||||||
|
mod tests {
|
||||||
|
use super::*;
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_parse_user_from_access_log() {
|
||||||
|
let inputs = [(
|
||||||
|
"1.2.3.4 - - [25/May/2026:10:07:24 +0200] \"GET /~oysteikt/ HTTP/2.0\" 200 3708",
|
||||||
|
"oysteikt",
|
||||||
|
)];
|
||||||
|
|
||||||
|
for (line, expected_user) in inputs {
|
||||||
|
let parsed_user = parse_username_from_line(line.as_bytes());
|
||||||
|
assert_eq!(
|
||||||
|
parsed_user,
|
||||||
|
Some(expected_user),
|
||||||
|
"Failed to parse user from line: {line}"
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn test_parse_user_from_error_log() {
|
||||||
|
let inputs = [(
|
||||||
|
"[Sat May 09 20:45:21.480016 2026] [authz_core:error] [pid 3555:tid 3617] [remote 1::2:42000] AH01630: client denied by server configuration: /home/pvv/d/oysteikt/web-docs/.git",
|
||||||
|
"oysteikt",
|
||||||
|
)];
|
||||||
|
|
||||||
|
for (line, expected_user) in inputs {
|
||||||
|
let parsed_user = parse_username_from_line(line.as_bytes());
|
||||||
|
assert_eq!(
|
||||||
|
parsed_user,
|
||||||
|
Some(expected_user),
|
||||||
|
"Failed to parse user from line: {line}"
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -2,6 +2,9 @@
|
|||||||
let
|
let
|
||||||
cfg = config.services.httpd;
|
cfg = config.services.httpd;
|
||||||
|
|
||||||
|
# NOTE Enable this if you want to strace stuff in the sandbox...
|
||||||
|
debug = false;
|
||||||
|
|
||||||
homeLetters = [ "a" "b" "c" "d" "h" "i" "j" "k" "l" "m" "z" ];
|
homeLetters = [ "a" "b" "c" "d" "h" "i" "j" "k" "l" "m" "z" ];
|
||||||
|
|
||||||
phpOptions = lib.concatStringsSep "\n" (lib.mapAttrsToList (k: v: "${k} = ${v}"){
|
phpOptions = lib.concatStringsSep "\n" (lib.mapAttrsToList (k: v: "${k} = ${v}"){
|
||||||
@@ -11,6 +14,8 @@ let
|
|||||||
upload_max_filesize = "40M";
|
upload_max_filesize = "40M";
|
||||||
});
|
});
|
||||||
|
|
||||||
|
apache-log-processor = pkgs.callPackage ./apache-log-processor { };
|
||||||
|
|
||||||
# https://nixos.org/manual/nixpkgs/stable/#ssec-php-user-guide-installing-with-extensions
|
# https://nixos.org/manual/nixpkgs/stable/#ssec-php-user-guide-installing-with-extensions
|
||||||
phpEnv = pkgs.php.buildEnv {
|
phpEnv = pkgs.php.buildEnv {
|
||||||
extensions = { all, ... }: with all; [
|
extensions = { all, ... }: with all; [
|
||||||
@@ -141,6 +146,10 @@ let
|
|||||||
wget
|
wget
|
||||||
which
|
which
|
||||||
xdg-utils
|
xdg-utils
|
||||||
|
] ++ lib.optionals debug [
|
||||||
|
glibc.getent
|
||||||
|
strace
|
||||||
|
systemd
|
||||||
];
|
];
|
||||||
|
|
||||||
extraOutputsToInstall = [
|
extraOutputsToInstall = [
|
||||||
@@ -154,6 +163,11 @@ in
|
|||||||
./mail.nix
|
./mail.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
|
sops.secrets = {
|
||||||
|
"httpd/passwd-ssh-key" = { };
|
||||||
|
"httpd/ssh-known-hosts" = { };
|
||||||
|
};
|
||||||
|
|
||||||
services.httpd = {
|
services.httpd = {
|
||||||
enable = true;
|
enable = true;
|
||||||
adminAddr = "drift@pvv.ntnu.no";
|
adminAddr = "drift@pvv.ntnu.no";
|
||||||
@@ -193,10 +207,11 @@ in
|
|||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
|
logPerVirtualHost = false;
|
||||||
|
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
TraceEnable on
|
TraceEnable on
|
||||||
LogLevel warn rewrite:trace3
|
LogLevel warn rewrite:trace3
|
||||||
ScriptLog ${cfg.logDir}/cgi.log
|
|
||||||
'';
|
'';
|
||||||
|
|
||||||
virtualHosts."temmie.pvv.ntnu.no" = {
|
virtualHosts."temmie.pvv.ntnu.no" = {
|
||||||
@@ -208,6 +223,11 @@ in
|
|||||||
];
|
];
|
||||||
|
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
|
CustomLog "${cfg.logDir}/access.log" combined
|
||||||
|
CustomLog "|${lib.getExe apache-log-processor} access" combined
|
||||||
|
ErrorLog "|${lib.getExe apache-log-processor} error"
|
||||||
|
ScriptLog "${cfg.logDir}/cgi.log"
|
||||||
|
|
||||||
UserDir ${lib.concatMapStringsSep " " (l: "/home/pvv/${l}/*/web-docs") homeLetters}
|
UserDir ${lib.concatMapStringsSep " " (l: "/home/pvv/${l}/*/web-docs") homeLetters}
|
||||||
UserDir disabled root
|
UserDir disabled root
|
||||||
AddHandler cgi-script .cgi
|
AddHandler cgi-script .cgi
|
||||||
@@ -276,17 +296,65 @@ in
|
|||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
Type = lib.mkForce "notify";
|
Type = lib.mkForce "notify";
|
||||||
|
|
||||||
|
ExecStartPre = let
|
||||||
|
rsyncCommand = ''${lib.getExe pkgs.rsync} -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey" -avz'';
|
||||||
|
in lib.mkForce [
|
||||||
|
"${lib.getExe (pkgs.writeShellApplication {
|
||||||
|
name = "http-exec-start-pre-remove-old-semaphores";
|
||||||
|
text = ''
|
||||||
|
# Get rid of old semaphores. These tend to accumulate across
|
||||||
|
# server restarts, eventually preventing it from restarting
|
||||||
|
# successfully.
|
||||||
|
for i in $(${pkgs.util-linux}/bin/ipcs -s | grep ' ${cfg.user} ' | cut -f2 -d ' '); do
|
||||||
|
${pkgs.util-linux}/bin/ipcrm -s "$i"
|
||||||
|
done
|
||||||
|
'';
|
||||||
|
})}"
|
||||||
|
|
||||||
|
"${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/passwd /run/httpd/pamunix-in/"
|
||||||
|
"${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/group /run/httpd/pamunix-in/"
|
||||||
|
|
||||||
|
(let
|
||||||
|
args = lib.cli.toCommandLineShellGNU { } {
|
||||||
|
passwd-file = "/run/httpd/pamunix-in/passwd";
|
||||||
|
group-file = "/run/httpd/pamunix-in/group";
|
||||||
|
output-dir = "/run/httpd/pamunix-out";
|
||||||
|
shadow-file = pkgs.emptyFile;
|
||||||
|
|
||||||
|
output-passwd = true;
|
||||||
|
|
||||||
|
ignore-user-file = toString ./ignore_user_file.txt;
|
||||||
|
ignore-group-file = toString ./ignore_group_file.txt;
|
||||||
|
};
|
||||||
|
in ''${lib.getExe pkgs.passwd2systemd-users} ${args}'')
|
||||||
|
"${lib.getExe' pkgs.coreutils "shred"} -u /run/httpd/pamunix-in/passwd /run/httpd/pamunix-in/group"
|
||||||
|
":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:0:System administrator:/root:/run/current-system/sw/bin/bash' /run/httpd/pamunix-out/passwd"
|
||||||
|
":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:54:Apache httpd user:/var/empty:/run/current-system/sw/bin/bash' /run/httpd/pamunix-out/passwd"
|
||||||
|
":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:' /run/httpd/pamunix-out/group"
|
||||||
|
":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:' /run/httpd/pamunix-out/group"
|
||||||
|
"${lib.getExe' pkgs.coreutils "cat"} /run/httpd/pamunix-out/passwd"
|
||||||
|
"+${lib.getExe' pkgs.coreutils "chown"} root:root /run/httpd/pamunix-out/passwd /run/httpd/pamunix-out/group"
|
||||||
|
"+${lib.getExe' pkgs.coreutils "chmod"} 0644 /run/httpd/pamunix-out/passwd /run/httpd/pamunix-out/group"
|
||||||
|
"+${lib.getExe pkgs.mount} --bind /run/httpd/pamunix-out/passwd /etc/passwd"
|
||||||
|
"+${lib.getExe pkgs.mount} --bind /run/httpd/pamunix-out/group /etc/group"
|
||||||
|
];
|
||||||
ExecStart = lib.mkForce "${cfg.package}/bin/httpd -D FOREGROUND -f /etc/httpd/httpd.conf -k start";
|
ExecStart = lib.mkForce "${cfg.package}/bin/httpd -D FOREGROUND -f /etc/httpd/httpd.conf -k start";
|
||||||
ExecReload = lib.mkForce "${cfg.package}/bin/httpd -f /etc/httpd/httpd.conf -k graceful";
|
ExecReload = lib.mkForce "${cfg.package}/bin/httpd -f /etc/httpd/httpd.conf -k graceful";
|
||||||
ExecStop = lib.mkForce "";
|
ExecStop = lib.mkForce "";
|
||||||
KillMode = "mixed";
|
KillMode = "mixed";
|
||||||
|
|
||||||
|
LoadCredential=[
|
||||||
|
"sshkey:${config.sops.secrets."httpd/passwd-ssh-key".path}"
|
||||||
|
"ssh-known-hosts:${config.sops.secrets."httpd/ssh-known-hosts".path}"
|
||||||
|
];
|
||||||
|
|
||||||
ConfigurationDirectory = [ "httpd" ];
|
ConfigurationDirectory = [ "httpd" ];
|
||||||
LogsDirectory = [ "httpd" ];
|
LogsDirectory = [ "httpd" ];
|
||||||
LogsDirectoryMode = "0700";
|
LogsDirectoryMode = "0700";
|
||||||
|
|
||||||
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
|
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_SETUID" "CAP_SETGID" ] ++ lib.optionals debug [ "CAP_SYS_PTRACE" ];
|
||||||
LockPersonality = true;
|
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SETUID" "CAP_SETGID" ] ++ lib.optionals debug [ "CAP_SYS_PTRACE" ];
|
||||||
|
LockPersonality = !debug;
|
||||||
PrivateDevices = true;
|
PrivateDevices = true;
|
||||||
PrivateTmp = true;
|
PrivateTmp = true;
|
||||||
# NOTE: this removes CAP_NET_BIND_SERVICE...
|
# NOTE: this removes CAP_NET_BIND_SERVICE...
|
||||||
@@ -313,21 +381,48 @@ in
|
|||||||
"tcp:443"
|
"tcp:443"
|
||||||
];
|
];
|
||||||
SystemCallArchitectures = "native";
|
SystemCallArchitectures = "native";
|
||||||
SystemCallFilter = [
|
SystemCallFilter = lib.mkIf (!debug) [
|
||||||
"@system-service"
|
"@system-service"
|
||||||
|
"@setuid"
|
||||||
];
|
];
|
||||||
UMask = "0077";
|
UMask = "0077";
|
||||||
|
|
||||||
RuntimeDirectory = [ "httpd/root-mnt" ];
|
RuntimeDirectoryMode = "0750";
|
||||||
|
RuntimeDirectory = [
|
||||||
|
"httpd/root-mnt"
|
||||||
|
"httpd/pamunix-in"
|
||||||
|
"httpd/pamunix-out"
|
||||||
|
];
|
||||||
RootDirectory = "/run/httpd/root-mnt";
|
RootDirectory = "/run/httpd/root-mnt";
|
||||||
MountAPIVFS = true;
|
MountAPIVFS = true;
|
||||||
BindReadOnlyPaths = [
|
BindReadOnlyPaths = [
|
||||||
builtins.storeDir
|
builtins.storeDir
|
||||||
"/etc"
|
"/etc"
|
||||||
# NCSD socket
|
"/dev/null"
|
||||||
"/var/run"
|
"/etc/resolv.conf"
|
||||||
"/var/lib/acme"
|
"/var/lib/acme"
|
||||||
|
|
||||||
|
"-/run/httpd/pamunix-out/passwd:/etc/passwd"
|
||||||
|
"-/run/httpd/pamunix-out/group:/etc/group"
|
||||||
|
|
||||||
|
"${pkgs.writeText "userweb-fake-nsswitch.conf" ''
|
||||||
|
passwd: files
|
||||||
|
group: files
|
||||||
|
shadow: files
|
||||||
|
sudoers: files
|
||||||
|
|
||||||
|
hosts: mymachines resolve [!UNAVAIL=return] files myhostname dns
|
||||||
|
networks: files
|
||||||
|
|
||||||
|
ethers: files
|
||||||
|
services: files
|
||||||
|
protocols: files
|
||||||
|
rpc: files
|
||||||
|
|
||||||
|
subuid: files
|
||||||
|
subgid: files
|
||||||
|
''}:/etc/nsswitch.conf"
|
||||||
|
|
||||||
"${fhsEnv}/bin:/bin"
|
"${fhsEnv}/bin:/bin"
|
||||||
"${fhsEnv}/sbin:/sbin"
|
"${fhsEnv}/sbin:/sbin"
|
||||||
"${fhsEnv}/lib:/lib"
|
"${fhsEnv}/lib:/lib"
|
||||||
@@ -341,6 +436,7 @@ in
|
|||||||
"/store/gnu"
|
"/store/gnu"
|
||||||
"/usr"
|
"/usr"
|
||||||
"/usr/local"
|
"/usr/local"
|
||||||
|
"/run/current-system/sw"
|
||||||
];
|
];
|
||||||
child = [
|
child = [
|
||||||
"/bin"
|
"/bin"
|
||||||
|
|||||||
@@ -0,0 +1,91 @@
|
|||||||
|
Debian-exim
|
||||||
|
_cvsadmin
|
||||||
|
_ssh
|
||||||
|
adm
|
||||||
|
audio
|
||||||
|
avahi
|
||||||
|
backup
|
||||||
|
bin
|
||||||
|
cdrom
|
||||||
|
cl-builder
|
||||||
|
clamav
|
||||||
|
clock
|
||||||
|
colord
|
||||||
|
courier
|
||||||
|
crontab
|
||||||
|
daemon
|
||||||
|
debian-spamd
|
||||||
|
dialout
|
||||||
|
dip
|
||||||
|
dirmngr
|
||||||
|
disk
|
||||||
|
dovecot
|
||||||
|
fax
|
||||||
|
floppy
|
||||||
|
fuse
|
||||||
|
games
|
||||||
|
geoclue
|
||||||
|
gnats
|
||||||
|
input
|
||||||
|
irc
|
||||||
|
kmem
|
||||||
|
kvm
|
||||||
|
list
|
||||||
|
lock
|
||||||
|
lp
|
||||||
|
lpadmin
|
||||||
|
mail
|
||||||
|
man
|
||||||
|
messagebus
|
||||||
|
mlocate
|
||||||
|
munin
|
||||||
|
netdev
|
||||||
|
news
|
||||||
|
nogroup
|
||||||
|
ntp
|
||||||
|
ntpsec
|
||||||
|
oident
|
||||||
|
opendkim
|
||||||
|
operator
|
||||||
|
plocate
|
||||||
|
plugdev
|
||||||
|
polkitd
|
||||||
|
postdrop
|
||||||
|
postfix
|
||||||
|
postgres
|
||||||
|
prometheus
|
||||||
|
prometheus-exporter
|
||||||
|
proxy
|
||||||
|
rdma
|
||||||
|
root
|
||||||
|
# runit
|
||||||
|
salt
|
||||||
|
sambashare
|
||||||
|
saned
|
||||||
|
sasl
|
||||||
|
scanner
|
||||||
|
sgx
|
||||||
|
shadow
|
||||||
|
src
|
||||||
|
ssl-cert
|
||||||
|
staff
|
||||||
|
stunnel4
|
||||||
|
sudo
|
||||||
|
sys
|
||||||
|
systemd-coredump
|
||||||
|
systemd-journal
|
||||||
|
systemd-network
|
||||||
|
systemd-resolve
|
||||||
|
systemd-timesync
|
||||||
|
tape
|
||||||
|
tcpdump
|
||||||
|
tty
|
||||||
|
users
|
||||||
|
utempter
|
||||||
|
utmp
|
||||||
|
uucp
|
||||||
|
uuidd
|
||||||
|
video
|
||||||
|
voice
|
||||||
|
winbindd_priv
|
||||||
|
www-data
|
||||||
@@ -0,0 +1,74 @@
|
|||||||
|
# System Users
|
||||||
|
Debian-exim
|
||||||
|
_apt
|
||||||
|
_rpc
|
||||||
|
avahi
|
||||||
|
backup
|
||||||
|
bin
|
||||||
|
cl-builder
|
||||||
|
clamav
|
||||||
|
colord
|
||||||
|
courier
|
||||||
|
daemon
|
||||||
|
debian-spamd
|
||||||
|
debian-spamd
|
||||||
|
dirmngr
|
||||||
|
distccd
|
||||||
|
dovecot
|
||||||
|
dovenull
|
||||||
|
driftsupport
|
||||||
|
fetchmail
|
||||||
|
games
|
||||||
|
geoclue
|
||||||
|
gitea
|
||||||
|
gnats
|
||||||
|
hplip
|
||||||
|
irc
|
||||||
|
list
|
||||||
|
lp
|
||||||
|
mail
|
||||||
|
mail2news
|
||||||
|
mailnews
|
||||||
|
man
|
||||||
|
messagebus
|
||||||
|
munin
|
||||||
|
news
|
||||||
|
nobody
|
||||||
|
noone
|
||||||
|
ntp
|
||||||
|
ntpsec
|
||||||
|
oident
|
||||||
|
opendkim
|
||||||
|
polkitd
|
||||||
|
postfix
|
||||||
|
postgres
|
||||||
|
prometheus
|
||||||
|
prometheus-exporter
|
||||||
|
proxy
|
||||||
|
root
|
||||||
|
rwhod
|
||||||
|
salt
|
||||||
|
saned
|
||||||
|
spamd
|
||||||
|
sshd
|
||||||
|
statd
|
||||||
|
stunnel4
|
||||||
|
sync
|
||||||
|
sys
|
||||||
|
systemd-coredump
|
||||||
|
systemd-network
|
||||||
|
systemd-resolve
|
||||||
|
systemd-timesync
|
||||||
|
tcpdump
|
||||||
|
uucp
|
||||||
|
uuidd
|
||||||
|
vaultwarden
|
||||||
|
www-data
|
||||||
|
|
||||||
|
# Misc
|
||||||
|
nuccc04
|
||||||
|
nuccc
|
||||||
|
kybkokos
|
||||||
|
kybkokos2
|
||||||
|
testbruker2309
|
||||||
|
testbruker2404
|
||||||
@@ -0,0 +1,93 @@
|
|||||||
|
httpd:
|
||||||
|
passwd-ssh-key: ENC[AES256_GCM,data:fXfqlhNbAIdacm7s4yirp+XS7gWhsp4jrD5yRzsU8lP+oueqS8cCkQGV4MB83OKa/D3wm1zxvjRsys9uxa+4kKL2/xOetDex5WXH7xAjzMaE0jHRNCjJMYM44L9+n3oc2c6rXz2DZ+4TEdGfJOru3pUIZx2LVYO/NB+FXSW59632PFhkuSypmpeeXRFn13ksd27W5x9fB4lOw9nrdyQkfuqvl0pD9uC6zef/sZ12rfre1JHyhN+jiowzWjJuzA9iiJpjNcek2wTyymVYZNxngfugnCkTKtWcfl+BOTgyhpEtGmL3mLs3n9r6bD725IAuoXUSzBEJqE1dCw93AvlPyrUwOXLM5lOX4h9IYS/0Izfc4w+qC+ID02XU0/cFufT8ODfTK08xF5QAOp5AdLxbcvMq3KadVPesD/5K75mzWtfC+UM4lo8TfphqnEtetL/P0DBXIJIsyY04gyTWsUVCfjcwWcliW6p3pcZZ+rkqObFs9n06uMWQq8qULa85yLq+mMsyPlBW1HE+TIV8jrLtVBqPkfXp85ZtllMOJRpeEOf/l48=,iv:1BE0moa2a4k2yqVBboS/EbNiFGLTu4Df/tnXBassls4=,tag:iPUOAEhqKbF9umsyBLaoJg==,type:str]
|
||||||
|
ssh-known-hosts: ENC[AES256_GCM,data:E2NiTUQokUDHzkfmTh5eECHZxt8v/Ug63ETA/CcO8358EpPeaFI1tAFt3q0o5rTCAUlB5cJ1ZOxX4mTeIH370wnwFN6emg+iAaK3VM+AL3Tp8Acb5EwErSOTKjAwrS5vwqb3oTYMzj42bKBk0b/qPWspGnoUfDI481+p99PS8eqpNCcGaNEDNk0BPwDvngwuur9o2RTmuWwxZO+s3wqlktQPkCguii8/FD3x3O8eow+v,iv:tJNxoY4UsRrB9k/fX9jLUc4hC3bioekpgKu4aa2o/4Q=,tag:DLj9rqse33D8PDLMxF/heQ==,type:str]
|
||||||
|
sops:
|
||||||
|
age:
|
||||||
|
- enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrMStZRlNCem0zRWgvMytj
|
||||||
|
b2tGR0M4SmF2Z1dYR2RBK1ZTUEx4c3NhMmlnCkVwcStqZ0RPRm1EK01lTWJpUmd2
|
||||||
|
Qis2WlU2ZUpFcUVXZUdVaWVyQno4NFEKLS0tIGJZWmlSdEtaUnd1alZ6NURsSFY3
|
||||||
|
VXJGank2UlBqY0hNZ1QvUGZUdVljaXMK9P4IVuSZ8uhDXDWMOkqABWImL4mu18AU
|
||||||
|
7X+1t3nZVmPze3MOTBRWf483DBAM+69QDlio1uSzZjJQc1X0H6ePKQ==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
recipient: age10avsdvqger25z0lyzlq8v7xfzcmypkmjsswswaxwqnpnl6x9wcjq0uv2n7
|
||||||
|
- enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJMGdHZ2xvdnVMbFAxYkhF
|
||||||
|
WHRPWjg3OE4vU1RhTWxPc0cxNm1RU1BPem40CnRHc0gyQVNxelBnZERMNlp2YnFk
|
||||||
|
U0xpbHN6RlVHZHdkZktnK0hCMFQ1aGcKLS0tIDVtODVvNzN0NFJ3UGFYdkpLTmZR
|
||||||
|
R0FvdzE5NDhUNFpWZTYreklCMmhCWmcKuD5nNqDSP4SK3E1AsnZtE4jzYgxfgHau
|
||||||
|
nmPKA2dgsPoA2rug/kGB9uXeUUA0oL26FyjlPi6NYDVvN4u1IHgPSw==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
|
||||||
|
- enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3SUdGMUgwSEV2SUhkMEJm
|
||||||
|
MWJ5Y1VMdWsyK1NWYmxUK3N1cHoydWp5eUVrCllZK3hKZjNDYzMwQTFENTg2aFFi
|
||||||
|
dXpkWGZkT0hiWGRQdjltNXZ6ZkN2S1EKLS0tIFREeDFVZkZEV0phM3dRYUVRSSsx
|
||||||
|
UVpkZ3hTd0JuWm16WnFFREt4S0hxMjAKbihmtr3/d/BbX21zkZWNarCNa4cYCM9B
|
||||||
|
HGwcEfP4fnevWdM4LbXXBBmfoVUErKjK5tiMwocVZXZrsHBYI4amPA==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
||||||
|
- enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3d3g2aHUrT0d5Kzl1RmVk
|
||||||
|
MUh4eW8vTS9qbkZ3WHNYMjFHSlZLV2M1aVgwCllWTDFwZDV1QTFkQkVrUnN0bSto
|
||||||
|
aTlvVTVaOWVldDJjSHMyaFhLNXlBcUEKLS0tIHZ6d0ZZWlo5SVJ3a0VNbjRFYnkz
|
||||||
|
dDFFT1JVN2N1cjg2TW5xOUZKZDVzZkUKjtRmm87B4AECzS8mmL6rUyVfNYlsem1w
|
||||||
|
HDFw4p0Nt9JWFFWEWamnTQ+Bq2UPsueBW4Ei/WyDj5d4EyNptoJrDQ==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
||||||
|
- enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2aWs5V0xhTzJlMi9PNks0
|
||||||
|
ZUNiOFB5TDZQUVBnVThRQjdzYTJ0Uml1blJzCjhUdTdpRURsVlIrUkxnUXVhM3Vn
|
||||||
|
cmJSL0x2Y29aMnltcWhiYmhLem1ldGsKLS0tIFpMa1lmZjZPQ0FvSUhTbUhzRlM5
|
||||||
|
bHNqMm1xRGdMd2NOdVo0Y0xFLzJCbGcKnSMBn2kp/RGDr5NL+qMoWqqdCdSu4wFz
|
||||||
|
GjjUS43nW0++TVXusGIj60sDJtK623N4srpubykZtYfEO1c1cAURpg==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
||||||
|
- enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnU2d6bFRqMk5jZ3lDdzA5
|
||||||
|
WFpsNVdLL2lXRGZ5ZjRIdGs5VjRVZ1JKdDJJCmxQeHZsZk9OQ1g4dG00MVNGeFF2
|
||||||
|
OURQUndCOTM3eUh1SnRaOGFKMi80TjQKLS0tIEE2eE8vK1dnN0dnbGNqaWZqdzJx
|
||||||
|
WGhRM2R0VzV1SlpxeGVWOXNCeWlzcVUK/nD3DWVDjVbWJmP33OC4LSKA3qrjN0hb
|
||||||
|
kZV4U44y+8uLtBVm3WnkZd/cg5wqoD/1agG7aCc9DMmOmxHUfdfrJw==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
||||||
|
- enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtczYrL3NrM295NEd4N3V0
|
||||||
|
WndPRXltZFhOUU1LdGVNM05LRzV5blhmU1JRClBpU0g2K0FJbFE0RVEyVW1ZRTJU
|
||||||
|
d2ZoeTM0QWx1NE9wSjc3c0tUa3Z3VlkKLS0tIEVrQStXSWRTUkJvK2paTU1EUkcy
|
||||||
|
ZWtMdDRhTWdLZnI2T2ZmS2VXdjFpZVkK1LAo54bl2QIx08rMJ0A8Q5bVXWcaoFPo
|
||||||
|
Y0/PSyL+vMa2Ab6b4vD6GNY5/KAE5XPlvBEKBrIe2oIAMJw38KUq8g==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
recipient: age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
|
||||||
|
lastmodified: "2026-05-29T13:54:14Z"
|
||||||
|
mac: ENC[AES256_GCM,data:g1PT225ggTfHuzU9qaNfNrhIVqtTWRCSm7iFDTlCZTDr4PPGbRtUH5fIJSY1F+2mu+H2XRM9ueenhqTyyyDJGsq+Oqp6Ae4E7vp2Uo4qH8O2d/u78EL2zNVestTvCnJGJ5lPWrN2i41pqOWbNx+dXt0O+sdgS890IQkj4i8VrRU=,iv:CjBKRSCMpAT+gWEFjvqb5OBy5u6ZsDelsCg5lGNOsN0=,tag:k1ia0wkw3YQfeFdv0GTX6g==,type:str]
|
||||||
|
pgp:
|
||||||
|
- created_at: "2026-05-29T13:54:02Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMA0av/duuklWYARAAq4qDoGJmeum8aPwO6TGOO+iIKNE3rqIdCsUsTs+SF3VL
|
||||||
|
ejSW3yB9hw5ptg3CCUH0tZRuZyvQ3fkXFh08hSBfBhICSr9NS2vllXp4ILlhNG0P
|
||||||
|
gEIq67+daK2YyWBcV3Rh8OMz5niGYDKF6WZjzlkFxinUFcqVtQrVKw9pti+Crhs9
|
||||||
|
QgZbTz5+Cph/ACSLufSUV2yyjv+zO+VhyMpHR4x/B/el/T921vAQAdGx9DprC1ed
|
||||||
|
cse2kg9ouhMQI+Aii5oSnDCAuVZGZQN23WXQBQp66l4gFmR3Av85miguEF5Gf8YW
|
||||||
|
44GiixHyul5583NDsMQuoPu1gzE8CqUPMVFVGzp5BsXbb4HzmEslxkpi7obCs7wx
|
||||||
|
fCplc2L+mLa4hTBJXYcCcRbsbopjDnYLNLfl4nvYHW5utimNej4EBdzQQg3DNf8J
|
||||||
|
zdNXlwHXUBgU8ayAyOwThQIP4s+VDSh2ASSWwEmqNMr5nkocIl7UO3J9MzkLNuc1
|
||||||
|
0S4b8rM9om755SlQTeLrOy/4aloZwCMFxQOeIoJ0fxNlgap1BS1FQ68leA+uiCcc
|
||||||
|
vCFVMlYUOwMl2wqkQ84pY3SEL6z96o9wpOyRERk/yfjBWnGjqjANNz4uSXggo4B9
|
||||||
|
LTLIqO+Li26+geyTATIMJU5SeMdP5s+Lvc2qzn0c4qr67hVo9H5Df2qzijsqIqrS
|
||||||
|
XgHQdNafa0JYSH07UKFvfmcDYU/sWRi7QrFD3/zn5HPUN2XNQj4P9OF93NV8tAqK
|
||||||
|
pFqgdJCybDSp4sQujjQOZkJ3tpVnlq/G/QjiAY2TpbYxzPUDWP0Pu0yGxVIrJ5Q=
|
||||||
|
=atHd
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||||
|
unencrypted_suffix: _unencrypted
|
||||||
|
version: 3.13.0
|
||||||
Reference in New Issue
Block a user