mirror of
https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git
synced 2025-12-31 12:48:23 +01:00
Compare commits
3 Commits
fix-bluema
...
dagali-hei
| Author | SHA1 | Date | |
|---|---|---|---|
|
051dd82f57 | ||
|
|
735d590f85 | ||
|
|
57a2bf8bf1 |
@@ -1,32 +0,0 @@
|
||||
name: "Build topology graph"
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
jobs:
|
||||
evals:
|
||||
runs-on: debian-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
|
||||
- name: Install sudo
|
||||
run: apt-get update && apt-get -y install sudo
|
||||
|
||||
- uses: https://github.com/cachix/install-nix-action@v31
|
||||
|
||||
- name: Configure Nix
|
||||
run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
|
||||
|
||||
- name: Build topology graph
|
||||
run: nix build .#topology -L
|
||||
|
||||
- name: Upload topology graph
|
||||
uses: https://git.pvv.ntnu.no/Projects/rsync-action@v2
|
||||
with:
|
||||
source: result/*.svg
|
||||
quote-source: false
|
||||
target: ${{ gitea.ref_name }}/topology_graph/
|
||||
username: gitea-web
|
||||
ssh-key: ${{ secrets.WEB_SYNC_SSH_KEY }}
|
||||
host: pages.pvv.ntnu.no
|
||||
known-hosts: "pages.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2QjfFB+city1SYqltkVqWACfo1j37k+oQQfj13mtgg"
|
||||
@@ -4,10 +4,10 @@ on:
|
||||
push:
|
||||
jobs:
|
||||
evals:
|
||||
runs-on: debian-latest
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/checkout@v3
|
||||
- run: apt-get update && apt-get -y install sudo
|
||||
- uses: https://github.com/cachix/install-nix-action@v31
|
||||
- uses: https://github.com/cachix/install-nix-action@v23
|
||||
- run: echo -e "show-trace = true\nmax-jobs = auto\ntrusted-users = root\nexperimental-features = nix-command flakes\nbuild-users-group =" > /etc/nix/nix.conf
|
||||
- run: nix flake check
|
||||
|
||||
25
.mailmap
25
.mailmap
@@ -1,25 +0,0 @@
|
||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> <daniel.olsen99@gmail.com>
|
||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel <danio@pvv.ntnu.no>
|
||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Lovbrotte Olsen <danio@pvv.ntnu.no>
|
||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Olsen <danio@pvv.ntnu.no>
|
||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> danio <danio@pvv.ntnu.no>
|
||||
Daniel Løvbrøtte Olsen <danio@pvv.ntnu.no> Daniel Olsen <danio@bicep.pvv.ntnu.no>
|
||||
|
||||
|
||||
Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> h7x4 <h7x4@nani.wtf>
|
||||
Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Øystein Tveit <oysteikt@pvv.ntnu.no>
|
||||
Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> oysteikt <oysteikt@pvv.ntnu.no>
|
||||
Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Øystein <oysteikt@pvv.org>
|
||||
Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no> Oystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>
|
||||
|
||||
Felix Albrigtsen <felixalb@pvv.ntnu.no> <felix@albrigtsen.it>
|
||||
Felix Albrigtsen <felixalb@pvv.ntnu.no> <felixalbrigtsen@gmail.com>
|
||||
Felix Albrigtsen <felixalb@pvv.ntnu.no> felixalb <felixalb@pvv.ntnu.no>
|
||||
|
||||
Peder Bergebakken Sundt <pederbs@pvv.ntnu.no> <pbsds@hotmail.com>
|
||||
|
||||
Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian G L <adrian@lauterer.it>
|
||||
Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian Gunnar Lauterer <adrian@lauterer.it>
|
||||
|
||||
Fredrik Robertsen <frero@pvv.ntnu.no> frero <frero@pvv.ntnu.no>
|
||||
Fredrik Robertsen <frero@pvv.ntnu.no> fredrikr79 <fredrikrobertsen7@gmail.com>
|
||||
53
.sops.yaml
53
.sops.yaml
@@ -1,24 +1,18 @@
|
||||
keys:
|
||||
# Users
|
||||
- &user_danio age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
|
||||
- &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
|
||||
- &user_danio age17tagmpwqjk3mdy45rfesrfey6h863x8wfq38wh33tkrlrywxducs0k6tpq
|
||||
- &user_felixalb age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
||||
- &user_oysteikt F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||
- &user_pederbs_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
||||
- &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
||||
- &user_eirikwit age1ju7rd26llahz3g8tz7cy5ld52swj8gsmg0flrmrxngc0nj0avq3ssh0sn5
|
||||
- &user_pederbs_sopp age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
||||
- &user_pederbs_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
||||
- &user_pederbs_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
||||
|
||||
# Hosts
|
||||
- &host_bakke age1syted6kt48sumjjucggh6r3uca4x2ppp4mfungf3lamkt2le05csc99633
|
||||
- &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
|
||||
- &host_bicep age19nk55kcs7s0358jpkn75xnr57dfq6fq3p43nartvsprx0su22v7qcgcjdx
|
||||
- &host_jokum age1gp8ye4g2mmw3may5xg0zsy7mm04glfz3788mmdx9cvcsdxs9hg0s0cc9kt
|
||||
- &host_ildkule age1x28hmzvuv6f2n66c0jtqcca3h9rput8d7j5uek6jcpx8n9egd52sqpejq0
|
||||
- &host_kommode age1mt4d0hg5g76qp7j0884llemy0k2ymr5up8vfudz6vzvsflk5nptqqd32ly
|
||||
- &host_lupine-1 age1fkrypl6fu4ldsa7te4g3v4qsegnk7sd6qhkquuwzh04vguy96qus08902e
|
||||
- &host_lupine-2 age1mu0ej57n4s30ghealhyju3enls83qyjua69986la35t2yh0q2s0seruz5n
|
||||
- &host_lupine-3 age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
|
||||
- &host_lupine-4 age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
|
||||
- &host_lupine-5 age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
|
||||
- &host_bekkalokk age12nj59tguy9wg882updc2vjdusx5srnxmjyfaqve4zx6jnnsaw3qsyjq6zd
|
||||
- &host_bicep age1sl43gc9cw939z5tgha2lpwf0xxxgcnlw7w4xem4sqgmt2pt264vq0dmwx2
|
||||
- &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
|
||||
|
||||
creation_rules:
|
||||
@@ -26,6 +20,7 @@ creation_rules:
|
||||
- path_regex: secrets/[^/]+\.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
- *host_jokum
|
||||
- *user_danio
|
||||
- *user_felixalb
|
||||
- *user_eirikwit
|
||||
@@ -49,10 +44,10 @@ creation_rules:
|
||||
pgp:
|
||||
- *user_oysteikt
|
||||
|
||||
- path_regex: secrets/kommode/[^/]+\.yaml$
|
||||
- path_regex: secrets/jokum/[^/]+\.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
- *host_kommode
|
||||
- *host_jokum
|
||||
- *user_danio
|
||||
- *user_felixalb
|
||||
- *user_pederbs_sopp
|
||||
@@ -96,31 +91,3 @@ creation_rules:
|
||||
- *user_pederbs_bjarte
|
||||
pgp:
|
||||
- *user_oysteikt
|
||||
|
||||
- path_regex: secrets/lupine/[^/]+\.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
- *host_lupine-1
|
||||
- *host_lupine-2
|
||||
- *host_lupine-3
|
||||
- *host_lupine-4
|
||||
- *host_lupine-5
|
||||
- *user_danio
|
||||
- *user_felixalb
|
||||
- *user_pederbs_sopp
|
||||
- *user_pederbs_nord
|
||||
- *user_pederbs_bjarte
|
||||
pgp:
|
||||
- *user_oysteikt
|
||||
|
||||
- path_regex: secrets/bakke/[^/]+\.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
- *host_bakke
|
||||
- *user_danio
|
||||
- *user_felixalb
|
||||
- *user_pederbs_sopp
|
||||
- *user_pederbs_nord
|
||||
- *user_pederbs_bjarte
|
||||
pgp:
|
||||
- *user_oysteikt
|
||||
|
||||
61
README.MD
Normal file
61
README.MD
Normal file
@@ -0,0 +1,61 @@
|
||||
# PVV NixOS configs
|
||||
|
||||
## Hvordan endre på ting
|
||||
|
||||
Før du endrer på ting husk å ikke putte ting som skal være hemmelig uten å først lese seksjonen for hemmeligheter!
|
||||
|
||||
Etter å ha klonet prosjektet ned og gjort endringer kan du evaluere configene med:
|
||||
|
||||
`nix flake check --keep-going`
|
||||
|
||||
før du bygger en maskin med:
|
||||
|
||||
`nix build .#<maskinnavn>`
|
||||
|
||||
hvis du vil være ekstra sikker på at alt bygger så kan du kjøre:
|
||||
|
||||
`nix build .` for å bygge alle de viktige maskinene.
|
||||
|
||||
NB: Dette kan ta opp til 30 minutter avhengig av hva som ligger i caches
|
||||
|
||||
Husk å hvertfall stage nye filer om du har laget dem!
|
||||
|
||||
Om alt bygger fint commit det og push til git repoet.
|
||||
Det er sikkert lurt å lage en PR først om du ikke er vandt til nix enda.
|
||||
|
||||
Innen 24h skal alle systemene hente ned den nye konfigurasjonen og deploye den.
|
||||
|
||||
Du kan tvinge en maskin til å oppdatere seg før dette ved å kjøre:
|
||||
`nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --upgrade --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git`
|
||||
|
||||
som root på maskinen.
|
||||
|
||||
Hvis du ikke har lyst til å oppdatere alle pakkene (og kanskje måtte vente en stund!) kan du kjøre
|
||||
|
||||
`nixos-rebuild switch --override-input nixpkgs nixpkgs --override-input nixpkgs-unstable nixpkgs-unstable --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git`
|
||||
|
||||
## Seksjonen for hemmeligheter
|
||||
|
||||
For at hemmeligheter ikke skal deles med hele verden i git - eller å være world
|
||||
readable i nix-storen, bruker vi [sops-nix](https://github.com/Mic92/sops-nix)
|
||||
|
||||
For å legge til secrets kan du kjøre f.eks. `sops secrets/jokum/jokum.yaml`
|
||||
Dette vil dekryptere filen og gi deg en text-editor du kan bruke for endre hemmelighetene.
|
||||
|
||||
Et nix shell med dette verktøyet inkludert ligger i flaket og shell.nix og kan aktiveres med:
|
||||
|
||||
`nix-shell` eller `nix develop`. Vi anbefaler det siste.
|
||||
I tilegg kan du sette opp [direnv](https://direnv.net/) slik at dette skjer automatisk
|
||||
|
||||
for å få tilgang til å lese/skrive hemmeligheter må du spørre noen/noe som har tilgang til hemmelighetene
|
||||
om å legge til age eller pgp nøkkelen din i [`.sops.yaml`](https://git.pvv.ntnu.no/Drift/pvv-nixos-config/src/main/.sops.yaml)
|
||||
|
||||
Denne kan du generere fra ssh-nøkkelene dine eller lage en egen nøkkel.
|
||||
|
||||
### Legge til flere keys
|
||||
|
||||
Gjør det som gir mening i .sops.yml
|
||||
|
||||
Etter det kjør `sops updatekeys secrets/host/file.yml`
|
||||
|
||||
MERK at det ikke er `sops -r` som BARE roterer nøkklene for de som allerede er i secretfila
|
||||
36
README.md
36
README.md
@@ -1,36 +0,0 @@
|
||||
# PVV NixOS config
|
||||
|
||||
This repository contains the NixOS configurations for Programvareverkstedet's server closet.
|
||||
In addition to machine configurations, it also contains a bunch of shared modules, packages, and
|
||||
more.
|
||||
|
||||
## Machines
|
||||
|
||||
| Name | Type | Description |
|
||||
|----------------------------|----------|-----------------------------------------------------------|
|
||||
| [bekkalokk][bek] | Physical | Our main web host, webmail, wiki, idp, minecraft map, ... |
|
||||
| [bicep][bic] | Virtual | Database host, matrix, git mirrors, ... |
|
||||
| bikkje | Virtual | Experimental login box |
|
||||
| [brzeczyszczykiewicz][brz] | Physical | Shared music player |
|
||||
| [georg][geo] | Physical | Shared music player |
|
||||
| [ildkule][ild] | Virtual | Logging and monitoring host, prometheus, grafana, ... |
|
||||
| [kommode][kom] | Virtual | Gitea + Gitea pages |
|
||||
| [lupine][lup] | Physical | Gitea CI/CD runners |
|
||||
| shark | Virtual | Test host for authentication, absolutely horrendous |
|
||||
| [wenche][wen] | Virtual | Nix-builders, general purpose compute |
|
||||
|
||||
## Documentation
|
||||
|
||||
- [Development - working on the PVV machines](./docs/development.md)
|
||||
- [Miscellaneous development notes](./docs/development-misc.md)
|
||||
- [User management](./docs/users.md)
|
||||
- [Secret management and `sops-nix`](./docs/secret-management.md)
|
||||
|
||||
[bek]: https://wiki.pvv.ntnu.no/wiki/Maskiner/bekkalokk
|
||||
[bic]: https://wiki.pvv.ntnu.no/wiki/Maskiner/bicep
|
||||
[brz]: https://wiki.pvv.ntnu.no/wiki/Maskiner/brzęczyszczykiewicz
|
||||
[geo]: https://wiki.pvv.ntnu.no/wiki/Maskiner/georg
|
||||
[ild]: https://wiki.pvv.ntnu.no/wiki/Maskiner/ildkule
|
||||
[kom]: https://wiki.pvv.ntnu.no/wiki/Maskiner/kommode
|
||||
[lup]: https://wiki.pvv.ntnu.no/wiki/Maskiner/lupine
|
||||
[wen]: https://wiki.pvv.ntnu.no/wiki/Maskiner/wenche
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
fp,
|
||||
...
|
||||
}:
|
||||
{ pkgs, lib, fp, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
@@ -12,30 +7,19 @@
|
||||
|
||||
./networking.nix
|
||||
./nix.nix
|
||||
./vm.nix
|
||||
./flake-input-exporter.nix
|
||||
|
||||
./services/acme.nix
|
||||
./services/uptimed.nix
|
||||
./services/auto-upgrade.nix
|
||||
./services/dbus.nix
|
||||
./services/fwupd.nix
|
||||
./services/irqbalance.nix
|
||||
./services/logrotate.nix
|
||||
./services/nginx.nix
|
||||
./services/openssh.nix
|
||||
./services/postfix.nix
|
||||
./services/prometheus-node-exporter.nix
|
||||
./services/prometheus-systemd-exporter.nix
|
||||
./services/promtail.nix
|
||||
./services/smartd.nix
|
||||
./services/thermald.nix
|
||||
./services/userborn.nix
|
||||
./services/userdbd.nix
|
||||
];
|
||||
|
||||
boot.tmp.cleanOnBoot = lib.mkDefault true;
|
||||
boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
|
||||
|
||||
time.timeZone = "Europe/Oslo";
|
||||
|
||||
@@ -61,22 +45,8 @@
|
||||
kitty.terminfo
|
||||
];
|
||||
|
||||
# .bash_profile already works, but lets also use .bashrc like literally every other distro
|
||||
# https://man.archlinux.org/man/core/bash/bash.1.en#INVOCATION
|
||||
# home-manager usually handles this for you: https://github.com/nix-community/home-manager/blob/22a36aa709de7dd42b562a433b9cefecf104a6ee/modules/programs/bash.nix#L203-L209
|
||||
# btw, programs.bash.shellInit just goes into environment.shellInit which in turn goes into /etc/profile, spooky shit
|
||||
programs.bash.shellInit = ''
|
||||
if [ -n "''${BASH_VERSION:-}" ]; then
|
||||
if [[ ! -f ~/.bash_profile && ! -f ~/.bash_login ]]; then
|
||||
[[ -f ~/.bashrc ]] && . ~/.bashrc
|
||||
fi
|
||||
fi
|
||||
'';
|
||||
|
||||
programs.zsh.enable = true;
|
||||
|
||||
# security.lockKernelModules = true;
|
||||
security.protectKernelImage = true;
|
||||
security.sudo.execWheelOnly = true;
|
||||
security.sudo.extraConfig = ''
|
||||
Defaults lecture = never
|
||||
@@ -87,3 +57,4 @@
|
||||
# Trusted users on the nix builder machines
|
||||
users.groups."nix-builder-users".name = "nix-builder-users";
|
||||
}
|
||||
|
||||
|
||||
@@ -1,55 +0,0 @@
|
||||
{
|
||||
config,
|
||||
inputs,
|
||||
lib,
|
||||
pkgs,
|
||||
values,
|
||||
...
|
||||
}:
|
||||
let
|
||||
data = lib.flip lib.mapAttrs inputs (
|
||||
name: input: {
|
||||
inherit (input)
|
||||
lastModified
|
||||
;
|
||||
}
|
||||
);
|
||||
folder = pkgs.writeTextDir "share/flake-inputs" (
|
||||
lib.concatMapStringsSep "\n" (
|
||||
{ name, value }: ''nixos_last_modified_input{flake="${name}"} ${toString value.lastModified}''
|
||||
) (lib.attrsToList data)
|
||||
);
|
||||
port = 9102;
|
||||
in
|
||||
{
|
||||
services.nginx.virtualHosts."${config.networking.fqdn}-nixos-metrics" = {
|
||||
serverName = config.networking.fqdn;
|
||||
serverAliases = [
|
||||
"${config.networking.hostName}.pvv.org"
|
||||
];
|
||||
locations."/metrics" = {
|
||||
root = "${folder}/share";
|
||||
tryFiles = "/flake-inputs =404";
|
||||
extraConfig = ''
|
||||
default_type text/plain;
|
||||
'';
|
||||
};
|
||||
listen = [
|
||||
{
|
||||
inherit port;
|
||||
addr = "0.0.0.0";
|
||||
}
|
||||
];
|
||||
extraConfig = ''
|
||||
allow ${values.hosts.ildkule.ipv4}/32;
|
||||
allow ${values.hosts.ildkule.ipv6}/128;
|
||||
allow 127.0.0.1/32;
|
||||
allow ::1/128;
|
||||
allow ${values.ipv4-space};
|
||||
allow ${values.ipv6-space};
|
||||
deny all;
|
||||
'';
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ port ];
|
||||
}
|
||||
@@ -3,6 +3,10 @@
|
||||
systemd.network.enable = true;
|
||||
networking.domain = "pvv.ntnu.no";
|
||||
networking.useDHCP = false;
|
||||
# networking.search = [ "pvv.ntnu.no" "pvv.org" ];
|
||||
# networking.nameservers = lib.mkDefault [ "129.241.0.200" "129.241.0.201" ];
|
||||
# networking.tempAddresses = lib.mkDefault "disabled";
|
||||
# networking.defaultGateway = values.hosts.gateway;
|
||||
|
||||
# The rest of the networking configuration is usually sourced from /values.nix
|
||||
|
||||
|
||||
22
base/nix.nix
22
base/nix.nix
@@ -1,17 +1,16 @@
|
||||
{ lib, config, inputs, ... }:
|
||||
{ inputs, ... }:
|
||||
{
|
||||
nix = {
|
||||
gc = {
|
||||
automatic = true;
|
||||
options = "--delete-older-than 2d";
|
||||
};
|
||||
optimise.automatic = true;
|
||||
|
||||
settings = {
|
||||
allow-dirty = true;
|
||||
auto-allocate-uids = true;
|
||||
auto-optimise-store = true;
|
||||
builders-use-substitutes = true;
|
||||
experimental-features = [ "nix-command" "flakes" "auto-allocate-uids" ];
|
||||
experimental-features = [ "nix-command" "flakes" ];
|
||||
log-lines = 50;
|
||||
use-xdg-base-directories = true;
|
||||
};
|
||||
@@ -22,16 +21,11 @@
|
||||
** use the same channel the system
|
||||
** was built with
|
||||
*/
|
||||
registry = lib.mkMerge [
|
||||
{
|
||||
"nixpkgs".flake = inputs.nixpkgs;
|
||||
"nixpkgs-unstable".flake = inputs.nixpkgs-unstable;
|
||||
}
|
||||
# We avoid the reference to self in vmVariant to get a stable system .outPath for equivalence testing
|
||||
(lib.mkIf (!config.virtualisation.isVmVariant) {
|
||||
"pvv-nix".flake = inputs.self;
|
||||
})
|
||||
];
|
||||
registry = {
|
||||
"nixpkgs".flake = inputs.nixpkgs;
|
||||
"nixpkgs-unstable".flake = inputs.nixpkgs-unstable;
|
||||
"pvv-nix".flake = inputs.self;
|
||||
};
|
||||
nixPath = [
|
||||
"nixpkgs=${inputs.nixpkgs}"
|
||||
"unstable=${inputs.nixpkgs-unstable}"
|
||||
|
||||
@@ -1,39 +1,26 @@
|
||||
{ config, inputs, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
inputUrls = lib.mapAttrs (input: value: value.url) (import "${inputs.self}/flake.nix").inputs;
|
||||
in
|
||||
|
||||
{ inputs, pkgs, lib, ... }:
|
||||
{
|
||||
system.autoUpgrade = {
|
||||
enable = true;
|
||||
flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
|
||||
flags = [
|
||||
"--refresh"
|
||||
"--no-write-lock-file"
|
||||
# --update-input is deprecated since nix 2.22, and removed in lix 2.90
|
||||
# as such we instead use --override-input combined with --refresh
|
||||
# https://git.lix.systems/lix-project/lix/issues/400
|
||||
] ++ (lib.pipe inputUrls [
|
||||
(lib.intersectAttrs {
|
||||
nixpkgs = { };
|
||||
nixpkgs-unstable = { };
|
||||
})
|
||||
(lib.mapAttrsToList (input: url: ["--override-input" input url]))
|
||||
lib.concatLists
|
||||
]);
|
||||
"--refresh"
|
||||
"--override-input" "nixpkgs" "github:nixos/nixpkgs/nixos-24.11-small"
|
||||
"--override-input" "nixpkgs-unstable" "github:nixos/nixpkgs/nixos-unstable-small"
|
||||
"--no-write-lock-file"
|
||||
];
|
||||
};
|
||||
|
||||
# workaround for https://github.com/NixOS/nix/issues/6895
|
||||
# via https://git.lix.systems/lix-project/lix/issues/400
|
||||
environment.etc = lib.mkIf (!config.virtualisation.isVmVariant) {
|
||||
"current-system-flake-inputs.json".source
|
||||
= pkgs.writers.writeJSON "flake-inputs.json" (
|
||||
lib.flip lib.mapAttrs inputs (name: input:
|
||||
# inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
|
||||
lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
|
||||
// { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
|
||||
)
|
||||
);
|
||||
};
|
||||
environment.etc."current-system-flake-inputs.json".source
|
||||
= pkgs.writers.writeJSON "flake-inputs.json" (
|
||||
lib.flip lib.mapAttrs inputs (name: input:
|
||||
# inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
|
||||
lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
|
||||
// { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.dbus = {
|
||||
enable = true;
|
||||
implementation = "broker";
|
||||
};
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.fwupd.enable = true;
|
||||
}
|
||||
@@ -20,14 +20,14 @@
|
||||
recommendedGzipSettings = true;
|
||||
|
||||
appendConfig = ''
|
||||
# pcre_jit on;
|
||||
pcre_jit on;
|
||||
worker_processes auto;
|
||||
worker_rlimit_nofile 100000;
|
||||
'';
|
||||
eventsConfig = ''
|
||||
worker_connections 2048;
|
||||
use epoll;
|
||||
# multi_accept on;
|
||||
multi_accept on;
|
||||
'';
|
||||
};
|
||||
|
||||
@@ -40,25 +40,6 @@
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."_" = lib.mkIf config.services.nginx.enable {
|
||||
listen = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
extraParameters = [
|
||||
"default_server"
|
||||
# Seemingly the default value of net.core.somaxconn
|
||||
"backlog=4096"
|
||||
"deferred"
|
||||
];
|
||||
}
|
||||
{
|
||||
addr = "[::0]";
|
||||
extraParameters = [
|
||||
"default_server"
|
||||
"backlog=4096"
|
||||
"deferred"
|
||||
];
|
||||
}
|
||||
];
|
||||
sslCertificate = "/etc/certs/nginx.crt";
|
||||
sslCertificateKey = "/etc/certs/nginx.key";
|
||||
addSSL = true;
|
||||
|
||||
@@ -6,17 +6,18 @@ in
|
||||
services.postfix = {
|
||||
enable = true;
|
||||
|
||||
settings.main = {
|
||||
myhostname = "${config.networking.hostName}.pvv.ntnu.no";
|
||||
mydomain = "pvv.ntnu.no";
|
||||
hostname = "${config.networking.hostName}.pvv.ntnu.no";
|
||||
domain = "pvv.ntnu.no";
|
||||
|
||||
# Nothing should be delivered to this machine
|
||||
mydestination = [ ];
|
||||
|
||||
relayhost = [ "smtp.pvv.ntnu.no:465" ];
|
||||
relayHost = "smtp.pvv.ntnu.no";
|
||||
relayPort = 465;
|
||||
|
||||
config = {
|
||||
smtp_tls_wrappermode = "yes";
|
||||
smtp_tls_security_level = "encrypt";
|
||||
};
|
||||
|
||||
# Nothing should be delivered to this machine
|
||||
destination = [ ];
|
||||
};
|
||||
}
|
||||
@@ -1,23 +0,0 @@
|
||||
{ config, lib, values, ... }:
|
||||
let
|
||||
cfg = config.services.prometheus.exporters.node;
|
||||
in
|
||||
{
|
||||
services.prometheus.exporters.node = {
|
||||
enable = lib.mkDefault true;
|
||||
port = 9100;
|
||||
enabledCollectors = [ "systemd" ];
|
||||
};
|
||||
|
||||
systemd.services.prometheus-node-exporter.serviceConfig = lib.mkIf cfg.enable {
|
||||
IPAddressDeny = "any";
|
||||
IPAddressAllow = [
|
||||
"127.0.0.1"
|
||||
"::1"
|
||||
values.hosts.ildkule.ipv4
|
||||
values.hosts.ildkule.ipv6
|
||||
];
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
|
||||
}
|
||||
@@ -1,26 +0,0 @@
|
||||
{ config, lib, values, ... }:
|
||||
let
|
||||
cfg = config.services.prometheus.exporters.systemd;
|
||||
in
|
||||
{
|
||||
services.prometheus.exporters.systemd = {
|
||||
enable = lib.mkDefault true;
|
||||
port = 9101;
|
||||
extraFlags = [
|
||||
"--systemd.collector.enable-restart-count"
|
||||
"--systemd.collector.enable-ip-accounting"
|
||||
];
|
||||
};
|
||||
|
||||
systemd.services.prometheus-systemd-exporter.serviceConfig = {
|
||||
IPAddressDeny = "any";
|
||||
IPAddressAllow = [
|
||||
"127.0.0.1"
|
||||
"::1"
|
||||
values.hosts.ildkule.ipv4
|
||||
values.hosts.ildkule.ipv6
|
||||
];
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
|
||||
}
|
||||
@@ -1,38 +0,0 @@
|
||||
{ config, lib, values, ... }:
|
||||
let
|
||||
cfg = config.services.prometheus.exporters.node;
|
||||
in
|
||||
{
|
||||
services.promtail = {
|
||||
enable = lib.mkDefault true;
|
||||
configuration = {
|
||||
server = {
|
||||
http_listen_port = 28183;
|
||||
grpc_listen_port = 0;
|
||||
};
|
||||
clients = [{
|
||||
url = "http://ildkule.pvv.ntnu.no:3100/loki/api/v1/push";
|
||||
}];
|
||||
scrape_configs = [{
|
||||
job_name = "systemd-journal";
|
||||
journal = {
|
||||
max_age = "12h";
|
||||
labels = {
|
||||
job = "systemd-journal";
|
||||
host = config.networking.hostName;
|
||||
};
|
||||
};
|
||||
relabel_configs = [
|
||||
{
|
||||
source_labels = [ "__journal__systemd_unit" ];
|
||||
target_label = "unit";
|
||||
}
|
||||
{
|
||||
source_labels = [ "__journal_priority_keyword" ];
|
||||
target_label = "level";
|
||||
}
|
||||
];
|
||||
}];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,59 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.services.uptimed;
|
||||
in
|
||||
{
|
||||
options.services.uptimed.settings = lib.mkOption {
|
||||
description = "";
|
||||
default = { };
|
||||
type = lib.types.submodule {
|
||||
freeformType = with lib.types; attrsOf (either str (listOf str));
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
services.uptimed = {
|
||||
enable = true;
|
||||
|
||||
settings = let
|
||||
stateDir = "/var/lib/uptimed";
|
||||
in {
|
||||
PIDFILE = "${stateDir}/pid";
|
||||
SENDMAIL = lib.mkDefault "${pkgs.system-sendmail}/bin/sendmail -t";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.uptimed = lib.mkIf (cfg.enable) {
|
||||
serviceConfig = let
|
||||
uptimed = pkgs.uptimed.overrideAttrs (prev: {
|
||||
postPatch = ''
|
||||
substituteInPlace Makefile.am \
|
||||
--replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
|
||||
substituteInPlace src/Makefile.am \
|
||||
--replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
|
||||
'';
|
||||
});
|
||||
|
||||
in {
|
||||
Type = "notify";
|
||||
|
||||
ExecStart = lib.mkForce "${uptimed}/sbin/uptimed -f";
|
||||
|
||||
BindReadOnlyPaths = let
|
||||
configFile = lib.pipe cfg.settings [
|
||||
(lib.mapAttrsToList
|
||||
(k: v:
|
||||
if builtins.isList v
|
||||
then lib.mapConcatStringsSep "\n" (v': "${k}=${v'}") v
|
||||
else "${k}=${v}")
|
||||
)
|
||||
(lib.concatStringsSep "\n")
|
||||
(pkgs.writeText "uptimed.conf")
|
||||
];
|
||||
in [
|
||||
"${configFile}:/var/lib/uptimed/uptimed.conf"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.userborn.enable = true;
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.userdbd.enable = true;
|
||||
}
|
||||
15
base/vm.nix
15
base/vm.nix
@@ -1,15 +0,0 @@
|
||||
{ lib, ... }:
|
||||
|
||||
# This enables
|
||||
# lib.mkIf (!config.virtualisation.isVmVariant) { ... }
|
||||
|
||||
{
|
||||
options.virtualisation.isVmVariant = lib.mkOption {
|
||||
description = "`true` if system is build with 'nixos-rebuild build-vm'";
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
};
|
||||
config.virtualisation.vmVariant = {
|
||||
virtualisation.isVmVariant = true;
|
||||
};
|
||||
}
|
||||
@@ -1,103 +0,0 @@
|
||||
# Miscellaneous development notes
|
||||
|
||||
This document contains a bunch of information that is not particularly specific to the pvv nixos config,
|
||||
but concerns technologies we use often or gotchas to be aware of when working with NixOS. A lot of the information
|
||||
here is already public information spread around the internet, but we've collected some of the items we use often
|
||||
here.
|
||||
|
||||
## The firewall
|
||||
|
||||
`networking.firewall` is a NixOS module that configures `iptables` rules on the machine. It is enabled by default on
|
||||
all of our machines, and it can be easy to forget about it when setting up new services, especially when we are the
|
||||
ones creating the NixOS module.
|
||||
|
||||
When setting up a new service that listens on a TCP or UDP port, make sure to add the appropriate ports to either
|
||||
`networking.firewall.allowedTCPPorts` or `networking.firewall.allowedUDPPorts`.
|
||||
|
||||
You can list out the current firewall rules by running `sudo iptables -L -n -v` on the machine.
|
||||
|
||||
## Finding stuff
|
||||
|
||||
Finding stuff, both underlying implementation and usage is absolutely crucial when working on nix.
|
||||
Oftentimes, the documentation will be outdated, lacking or just plain out wrong. These are some of
|
||||
the techniques we have found to be quite good when working with nix.
|
||||
|
||||
### [ripgrep](https://github.com/BurntSushi/ripgrep)
|
||||
|
||||
ripgrep (or `rg` for short) is a tool that lets you recursively grep for regex patters in a directory.
|
||||
|
||||
It is great for finding references to configuration, and where and how certain things are used. It is
|
||||
especially great when working with [nixpkgs](https://github.com/NixOS/nixpkgs), which is quite large.
|
||||
|
||||
### GitHub Search
|
||||
|
||||
When trying to set up a new service or reconfigure something, it is very common that someone has done it
|
||||
before you, but it has never been documented anywhere. A lot of Nix code exists on GitHub, and you can
|
||||
easily query it by using the `lang:nix` filter in the search bar.
|
||||
|
||||
For example: https://github.com/search?q=lang%3Anix+dibbler&type=code
|
||||
|
||||
## rsync
|
||||
|
||||
`rsync` is a tool for synchronizing files between machines. It is very useful when transferring large
|
||||
amounts of data from a to b. We use it for multiple things, often when data is produced or stored on
|
||||
one machine, and we want to process or convert it on another. For example, we use it to transfer gitea
|
||||
artifacts, to transfer gallery pictures, to transfer minecraft world data for map rendering, and more.
|
||||
|
||||
Along with `rsync`, we often use a lesser known tool called `rrsync`, which you can use inside an ssh
|
||||
configuration (`authorized_keys` file) to restrict what paths a user can access when connecting over ssh.
|
||||
This is useful both as a security measure, but also to avoid accidental overwrites of files outside the intended
|
||||
path. `rrsync` will use chroot to restrict what paths the user can access, as well as refuse to run arbitrary commands.
|
||||
|
||||
## `nix repl`
|
||||
|
||||
`nix repl` is an interactive REPL for the Nix language. It is very useful for experimenting with Nix code,
|
||||
and testing out small snippets of code to make sure it behaves as expected. You can also use it to explore
|
||||
NixOS machine configurations, to interactively see that the configuration evaluates to what you expect.
|
||||
|
||||
```
|
||||
# While in the pvv-nixos-config directory
|
||||
nix repl .
|
||||
|
||||
# Upon writing out the config path and clickin [Tab], you will get autocompletion suggestions:
|
||||
nix-repl> nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.
|
||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts._
|
||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.bekkalokk.pvv.ntnu.no-nixos-metrics
|
||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.idp.pvv.ntnu.no
|
||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.minecraft.pvv.ntnu.no
|
||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.pvv.ntnu.no
|
||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.pvv.org
|
||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.pw.pvv.ntnu.no
|
||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.roundcubeplaceholder.example.com
|
||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.snappymail.pvv.ntnu.no
|
||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.webmail.pvv.ntnu.no
|
||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.wiki.pvv.ntnu.no
|
||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.www.pvv.ntnu.no
|
||||
nixosConfigurations.bekkalokk.config.services.nginx.virtualHosts.www.pvv.org
|
||||
```
|
||||
|
||||
## `nix why-depends`
|
||||
|
||||
If you ever wonder why a certain package is being used as a dependency of another package,
|
||||
or another machine, you can use `nix why-depends` to find the dependency path from one package to another.
|
||||
This is often useful after updating nixpkgs and finding an error saying that a certain package is insecure,
|
||||
broken or whatnot. You can do something like the following
|
||||
|
||||
```bash
|
||||
# Why does bekkalokk depend on openssl?
|
||||
nix why-depends .#nixosConfigurations.bekkalokk.config.system.build.toplevel .#nixosConfigurations.bekkalokk.pkgs.openssl
|
||||
|
||||
# Why does bekkalokk's minecraft-server depend on zlib? (this is not real)
|
||||
nix why-depends .#nixosConfigurations.bekkalokk.pkgs.minecraft-server .#nixosConfigurations.bekkalokk.pkgs.zlib
|
||||
```
|
||||
|
||||
## php-fpm
|
||||
|
||||
php-fpm (FastCGI Process Manager) is a PHP implementation that is designed for speed and production use. We host a bunch
|
||||
of different PHP applications (including our own website), and so we use php-fpm quite a bit. php-fpm typically exposes a
|
||||
unix socket that nginx will connect to, and php-fpm will then render php upon web requests forwarded from nginx and return
|
||||
it.
|
||||
|
||||
php-fpm has a tendency to be a bit hard to debug. It is not always very willing to spit out error messages and logs, and so
|
||||
it can be a bit hard to figure out what's up when something goes wrong. You should see some of the commented stuff laying around
|
||||
in the website code on bekkalokk for examples of how to configure php-fpm for better logging and error reporting.
|
||||
@@ -1,190 +0,0 @@
|
||||
# Development - working on the PVV machines
|
||||
|
||||
This document outlines the process of editing our NixOS configurations, and testing and deploying said changes
|
||||
to the machines. Most of the information written here is specific to the PVV NixOS configuration, and the topics
|
||||
will not really cover the nix code itself in detail. You can find some more resources for that by either following
|
||||
the links from the *Upstream documentation* section below, or in [Miscellaneous development notes](./development-misc.md).
|
||||
|
||||
## Editing nix files
|
||||
|
||||
> [!WARN]
|
||||
> Before editing any nix files, make sure to read [Secret management and `sops-nix`](./secret-management.md)!
|
||||
> We do not want to add any secrets in plaintext to the nix files, and certainly not commit and publish
|
||||
> them into the common public.
|
||||
|
||||
The files are plaintext code, written in the [`Nix` language](https://nix.dev/manual/nix/stable/language/).
|
||||
|
||||
Below is a list of important files and directories, and a description of what they contain.
|
||||
|
||||
### `flake.nix`
|
||||
|
||||
The `flake.nix` file is a [nix flake](https://wiki.nixos.org/wiki/Flakes) and makes up the entrypoint of the
|
||||
entire configuration. It declares what inputs are used (similar to dependencies), as well as what outputs the
|
||||
flake exposes. In our case, the most important outputs are the `nixosConfigurations` (our machine configs), but
|
||||
we also expose custom modules, packages, devshells, and more. You can run `nix flake show` to get an overview of
|
||||
the outputs (however you will need to [enable the `nix-flakes` experimental option](https://wiki.nixos.org/wiki/Flakes#Setup)).
|
||||
|
||||
You will find that a lot of the flake inputs are the different PVV projects that we develop, imported to be hosted
|
||||
on the NixOS machines. This makes it easy to deploy changes to these projects, as we can just update the flake input
|
||||
to point to a new commit or version, and then rebuild the machines.
|
||||
|
||||
A NixOS configuration is usually made with the `nixpkgs.lib.nixosSystem` function, however we have a few custom wrapper
|
||||
functions named `nixosConfig` and `stableNixosConfig` that abstracts away some common configuration we want on all our machines.
|
||||
|
||||
### `values.nix`
|
||||
|
||||
`values.nix` is a somewhat rare pattern in NixOS configurations around the internet. It contains a bunch of constant values
|
||||
that we use throughout the configuration, such as IP addresses, DNS names, paths and more. This not only makes it easier to
|
||||
change the values should we need to, but it also makes the configuration more readable. Instead of caring what exact IP any
|
||||
machine has, you can write `values.machines.name.ipv4` and abstract the details away.
|
||||
|
||||
### `base`
|
||||
|
||||
The `base` directory contains a bunch of NixOS configuration that is common for all or most machines. Some of the config
|
||||
you will find here sets defaults for certain services without enabling them, so that when they are enabled in a machine config,
|
||||
we don't need to repeat the same defaults over again. Other parts actually enable certain services that we want on all machines,
|
||||
such as `openssh` or the auto upgrade timer.
|
||||
|
||||
### Vendoring `modules` and `packages`
|
||||
|
||||
Sometimes, we either find that the packages or modules provided by `nixpkgs` is not sufficient for us,
|
||||
or that they are bugged in some way that can not be easily overrided. There are also cases where the
|
||||
modules or packages does not exist. In these cases, we tend to either copy and modify the modules and
|
||||
packages from nixpkgs, or create our own. These modules and packages end up in the top-level `modules`
|
||||
and `packages` directories. They are usually exposed in `flake.nix` as flake outputs `nixosModules.<name>`
|
||||
and `packages.<platform>.<name>`, and they are usually also added to the machines that need them in the flake.
|
||||
|
||||
In order to override or add an extra package, the easiest way is to use an [`overlay`](https://wiki.nixos.org/wiki/Overlays).
|
||||
This makes it so that the package from `pkgs.<name>` now refers to the modified variant of the package.
|
||||
|
||||
In order to add a module, you can just register it in the modules of the nixos machine.
|
||||
In order to override a module, you also have to use `disabledModules = [ "<path-relative-to-nixpkgs/modules>" ];`.
|
||||
Use `rg` to find examples of the latter.
|
||||
|
||||
Do note that if you believe a new module to be of high enough quality, or the change you are making to be
|
||||
relevant for every nix user, you should strongly consider also creating a PR towards nixpkgs. However,
|
||||
getting changes made there has a bit higher threshold and takes more time than making changes in the PVV config,
|
||||
so feel free to make the changes here first. We can always remove the changes again once the upstreaming is finished.
|
||||
|
||||
### `users`, `secrets` and `keys`
|
||||
|
||||
For `users`, see [User management](./users.md)
|
||||
|
||||
For `secrets` and `keys`, see [Secret management and `sops-nix`](./secret-management.md)
|
||||
|
||||
### Collaboration
|
||||
|
||||
We use our gitea to collaborate on changes to the nix configuration. Every PVV maintenance member should have
|
||||
access to the repository. The usual workflow is that we create a branch for the change we want to make, do a bunch
|
||||
of commits and changes, and then open a merge request for review (or just rebase on master if you know what you are doing).
|
||||
|
||||
### Upstream documentation
|
||||
|
||||
Here are different sources of documentation and stuff that you might find useful while
|
||||
writing, editing and debugging nix code.
|
||||
|
||||
- [nixpkgs repository](https://github.com/NixOS/nixpkgs)
|
||||
|
||||
This is particularly useful to read the source code, as well as upstreaming pieces of code that we think
|
||||
everyone would want
|
||||
|
||||
- [NixOS search](https://search.nixos.org/)
|
||||
|
||||
This is useful for searching for both packages and NixOS options.
|
||||
|
||||
- [nixpkgs documentation](https://nixos.org/manual/nixpkgs/stable/)
|
||||
- [NixOS documentation](https://nixos.org/manual/nixos/stable/)
|
||||
- [nix (the tool) documentation](https://nix.dev/manual/nix/stable/)
|
||||
|
||||
All of the three above make up the official documentation with all technical
|
||||
details about the different pieces that makes up NixOS.
|
||||
|
||||
- [The official NixOS wiki](https://wiki.nixos.org)
|
||||
|
||||
User-contributed guides, tips and tricks, and whatever else.
|
||||
|
||||
- [nix.dev](https://nix.dev)
|
||||
|
||||
Additional stuff
|
||||
|
||||
- [Noogle](https://noogle.dev)
|
||||
|
||||
This is useful when looking for nix functions and packaging helpers.
|
||||
|
||||
## Testing and deploying changes
|
||||
|
||||
After editing the nix files on a certain branch, you will want to test and deploy the changes to the machines.
|
||||
Unfortunately, we don't really have a good setup for testing for runtime correctness locally, but we can at least
|
||||
make sure that the code evaluates and builds correctly before deploying.
|
||||
|
||||
To just check that the code evaluates without errors, you can run:
|
||||
|
||||
```bash
|
||||
nix flake check
|
||||
# Or if you want to keep getting all errors before it quits:
|
||||
nix flake check --keep-going
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> If you are making changes that involves creating new nix files, remember to `git add` those files before running
|
||||
> any nix commands. Nix refuses to acknowledge files that are not either commited or at least staged. It will spit
|
||||
> out an error message about not finding the file in question.
|
||||
|
||||
### Building machine configurations
|
||||
|
||||
To build any specific machine configuration and look at the output, you can run:
|
||||
|
||||
```bash
|
||||
nix build .#nixosConfigurations.<machine-name>.config.system.build.toplevel
|
||||
# or just
|
||||
nix build .#<machine-name>
|
||||
```
|
||||
|
||||
This will create a symlink name `./result` to a directory containing the built NixOS system. It is oftentimes
|
||||
the case that config files for certain services only end up in the nix store without being put into `/etc`. If you wish
|
||||
to read those files, you can often find them by looking at the systemd unit files in `./result/etc/systemd/system/`.
|
||||
(if you are using vim, `gf` or go-to-file while the cursor is over a file path is a useful trick while doing this).
|
||||
|
||||
If you have edited something that affects multiple machines, you can also build all important machines at once by running:
|
||||
|
||||
```bash
|
||||
nix build .#
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> Building all machines at once can take a long time, depending on what has changed and whether you have already
|
||||
> built some of the machines recently. Be prepared to wait for up to an hour to build all machines from scratch
|
||||
> if this is the first time.
|
||||
|
||||
### Deploying to machines
|
||||
|
||||
> [!WARN]
|
||||
> Be careful to think about state when testing changes against the machines. Sometimes, a certain change
|
||||
> can lead to irreversible changes to the data stored on the machine. An example would be a set of database
|
||||
> migrations applied when testing a newer version of a service. Unless that service also comes with downwards
|
||||
> migrations, you can not go back to the previous version without losing data.
|
||||
|
||||
To deploy the changes to a machine, you should first SSH into the machine, and clone the pvv-nixos-config
|
||||
repository unless you have already done so. After that, checkout the branch you want to deploy from, and rebuild:
|
||||
|
||||
```bash
|
||||
# Run this while in the pvv-nixos-config directory
|
||||
sudo nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --flake .# --upgrade
|
||||
```
|
||||
|
||||
This will rebuild the NixOS system on the current branch and switch the system configuration to reflect the new changes.
|
||||
|
||||
Note that unless you eventually merge the current changes into `main`, the machine will rebuild itself automatically and
|
||||
revert the changes on the next nightly rebuild (tends to happen when everybody is asleep).
|
||||
|
||||
### Forcefully reset to `main`
|
||||
|
||||
If you ever want to reset a machine to the `main` branch, you can do so by running:
|
||||
|
||||
```bash
|
||||
nixos-rebuild switch --update-input nixpkgs --update-input nixpkgs-unstable --no-write-lock-file --refresh --upgrade --flake git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git
|
||||
```
|
||||
|
||||
This will ignore the current branch and just pull the latest `main` from the git repository directly from gitea.
|
||||
You can also use this command if there are updates on the `main` branch that you want to deploy to the machine without
|
||||
waiting for the nightly rebuild.
|
||||
@@ -1,160 +0,0 @@
|
||||
# Secret management and `sops-nix`
|
||||
|
||||
Nix config is love, nix config is life, and publishing said config to the
|
||||
internet is not only a good deed and kinda cool, but also encourages properly
|
||||
secured configuration as opposed to [security through obscurity](https://en.wikipedia.org/wiki/Security_through_obscurity).
|
||||
That being said, there are some details of the config that we really shouldn't
|
||||
share with the general public. In particular, there are so-called *secrets*, that is
|
||||
API keys, passwords, tokens, cookie secrets, salts, peppers and jalapenos that we'd
|
||||
rather keep to ourselves. However, it is not entirely trivial to do so in the NixOS config.
|
||||
For one, we'd have to keep these secrets out of the public git repo somehow, and secondly
|
||||
everything that is configured via nix ends up as world readable files (i.e. any user on the
|
||||
system can read the file) in `/nix/store`.
|
||||
|
||||
In order to solve this, we use a NixOS module called [`sops-nix`](https://github.com/Mic92/sops-nix)
|
||||
which uses a technology called [`sops`](https://github.com/getsops/sops) behind the scenes.
|
||||
The idea is simple: we encrypt these secrets with a bunch of different keys and store the
|
||||
encrypted files in the git repo. First of all, we encrypt the secrets a bunch of time with
|
||||
PVV maintenance member's keys, so that we can decrypt and edit the contents. Secondly, we
|
||||
encrypt the secrets with the [host keys]() of the NixOS machines, so that they can decrypt
|
||||
the secrets. The secrets will be decrypted and stored in a well-known location (usually `/run/secrets`)
|
||||
so that they do not end up in the nix store, and are not world readable.
|
||||
|
||||
This way, we can both keep the secrets in the git repository and let multiple people edit them,
|
||||
but also ensure that they don't end up in the wrong hands.
|
||||
|
||||
## Adding a new machine
|
||||
|
||||
In order to add a new machine to the nix-sops setup, you should do the following:
|
||||
|
||||
```console
|
||||
# Create host keys (if they don't already exist)
|
||||
ssh-keygen -A -b 4096
|
||||
|
||||
# Derive an age-key from the public host key
|
||||
nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
|
||||
|
||||
# Register the age key in .sops.yaml
|
||||
vim .sops.yaml
|
||||
```
|
||||
|
||||
The contents of `.sops.yaml` should look like this:
|
||||
|
||||
```yaml
|
||||
keys:
|
||||
# Users
|
||||
...
|
||||
|
||||
# Hosts
|
||||
...
|
||||
- &host_<machine_name> <public_age_key>
|
||||
|
||||
creation_rules:
|
||||
...
|
||||
|
||||
- path_regex: secrets/<machine_name>/[^/]+\.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
- *host_<machine_name>
|
||||
- ... user keys
|
||||
- pgp:
|
||||
- ... user keys
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> Take care that all the keys in the `age` and `pgp` sections are prefixed
|
||||
> with a `-`, or else sops might try to encrypt the secrets in a way where
|
||||
> you need both keys present to decrypt the content. Also, it tends to throw
|
||||
> interesting errors when it fails to do so.
|
||||
|
||||
```console
|
||||
# While cd-ed into the repository, run this to get a shell with the `sops` tool present
|
||||
nix-shell
|
||||
```
|
||||
|
||||
Now you should also be able to edit secrets for this machine by running:
|
||||
|
||||
```
|
||||
sops secrets/<machine_name>/<machine_name>.yaml
|
||||
```
|
||||
|
||||
## Adding a user
|
||||
|
||||
Adding a user is quite similar to adding a new machine.
|
||||
This guide assumes you have already set up SSH keys.
|
||||
|
||||
```
|
||||
# Derive an age-key from your key
|
||||
# (edit the path to the key if it is named something else)
|
||||
nix-shell -p ssh-to-age --run 'cat ~/.ssh/id_ed25519.pub | ssh-to-age'
|
||||
|
||||
# Register the age key in .sops.yaml
|
||||
vim .sops.yaml
|
||||
```
|
||||
|
||||
The contents of `.sops.yaml` should look like this:
|
||||
|
||||
```yaml
|
||||
keys:
|
||||
# Users
|
||||
...
|
||||
- &user_<user_name> <public_age_key>
|
||||
|
||||
# Hosts
|
||||
...
|
||||
|
||||
creation_rules:
|
||||
...
|
||||
|
||||
# Do this for all the machines you are planning to edit
|
||||
# (or just do it for all machines)
|
||||
- path_regex: secrets/<machine_name>/[^/]+\.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
- *host_<machine_name>
|
||||
- ... user keys
|
||||
- *host_<user_name>
|
||||
- pgp:
|
||||
- ... user keys
|
||||
```
|
||||
|
||||
Now that sops is properly configured to recognize the key, you need someone
|
||||
who already has access to decrypt all the secrets and re-encrypt them with your
|
||||
key. At this point, you should probably [open a PR](https://docs.gitea.com/usage/issues-prs/pull-request)
|
||||
and ask someone in PVV maintenance if they can checkout the PR branch, run the following
|
||||
command and push the diff back into the PR (and maybe even ask them to merge if you're feeling
|
||||
particularly needy).
|
||||
|
||||
```console
|
||||
sops updatekeys secrets/*/*.yaml
|
||||
```
|
||||
|
||||
## Updating keys
|
||||
|
||||
> [!NOTE]
|
||||
> At some point, we found this flag called `sops -r` that seemed to be described to do what
|
||||
> `sops updatekeys` does, do not be fooled. This only rotates the "inner key" for those who
|
||||
> already have the secrets encrypted with their key.
|
||||
|
||||
Updating keys is done with this command:
|
||||
|
||||
```console
|
||||
sops updatekeys secrets/*/*.yaml
|
||||
```
|
||||
|
||||
However, there is a small catch. [oysteikt](https://git.pvv.ntnu.no/oysteikt) has kinda been
|
||||
getting gray hairs lately, and refuses to use modern technology - he is still stuck using GPG.
|
||||
This means that to be able to re-encrypt the sops secrets, you will need to have a gpg keychain
|
||||
with his latest public key available. The key has an expiry date, so if he forgets to update it,
|
||||
you should send him and angry email and tag him a bunch of times in a gitea issue. If the key
|
||||
is up to date, you can do the following:
|
||||
|
||||
```console
|
||||
# Fetch gpg (unless you have it already)
|
||||
nix-shell -p gpg
|
||||
|
||||
# Import oysteikts key to the gpg keychain
|
||||
gpg --import ./keys/oysteikt.pub
|
||||
```
|
||||
|
||||
Now you should be able to run the `sops updatekeys` command again.
|
||||
@@ -1,50 +0,0 @@
|
||||
# User management
|
||||
|
||||
Due to some complications with how NixOS creates users compared to how we used to
|
||||
create users with the salt-based setup, the NixOS machine users are created and
|
||||
managed separately. We tend to create users on-demand, whenever someone in PVV
|
||||
maintenance want to work on the NixOS machines.
|
||||
|
||||
## Setting up a new user
|
||||
|
||||
You can find the files for the existing users, and thereby examples of user files
|
||||
in the [`users`](../users) directory. When creating a new file here, you should name it
|
||||
`your-username.nix`, and add *at least* the following contents:
|
||||
|
||||
```nix
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
users.users."<username>" = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [
|
||||
"wheel" # In case you wanna use sudo (you probably do)
|
||||
"nix-builder-users" # Arbitrary access to write to the nix store
|
||||
];
|
||||
|
||||
# Any packages you frequently use to manage servers go here.
|
||||
# Please don't pull gigantonormous packages here unless you
|
||||
# absolutely need them, and remember that any package can be
|
||||
# pulled via nix-shell if you only use it once in a blue moon.
|
||||
packages = with pkgs; [
|
||||
bottom
|
||||
eza
|
||||
];
|
||||
|
||||
# Not strictly needed, but we recommend adding your public SSH
|
||||
# key here. If it is not present, you will have to log into the
|
||||
# machine as 'root' before setting your password for every NixOS
|
||||
# machine you have not logged into yet.
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjiQ0wg4lpC7YBMAAHoGmgwqHOBi+EUz5mmCymGlIyT my-key"
|
||||
];
|
||||
};
|
||||
}
|
||||
```
|
||||
|
||||
The file will be picked up automatically, so creating the file and adding the
|
||||
contents should be enough to get you registered. You should
|
||||
[open a PR](https://docs.gitea.com/usage/issues-prs/pull-request) with the new
|
||||
code so the machines will be rebuilt with your user present.
|
||||
|
||||
See also [Secret Management](./secret-management.md) for how to add your keys to the
|
||||
system that lets us add secrets (API keys, password, etc.) to the NixOS config.
|
||||
340
flake.lock
generated
340
flake.lock
generated
@@ -1,26 +1,5 @@
|
||||
{
|
||||
"nodes": {
|
||||
"devshell": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nix-topology",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1728330715,
|
||||
"narHash": "sha256-xRJ2nPOXb//u1jaBnDP56M7v5ldavjbtR6lfGqSvcKg=",
|
||||
"owner": "numtide",
|
||||
"repo": "devshell",
|
||||
"rev": "dd6b80932022cea34a019e2bb32f6fa9e494dfef",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "devshell",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"disko": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -28,54 +7,19 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1736864502,
|
||||
"narHash": "sha256-ItkIZyebGvNH2dK9jVGzJHGPtb6BSWLN8Gmef16NeY0=",
|
||||
"lastModified": 1740485968,
|
||||
"narHash": "sha256-WK+PZHbfDjLyveXAxpnrfagiFgZWaTJglewBWniTn2Y=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "0141aabed359f063de7413f80d906e1d98c0c123",
|
||||
"rev": "19c1140419c4f1cdf88ad4c1cfb6605597628940",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"ref": "v1.11.0",
|
||||
"repo": "disko",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1696426674,
|
||||
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"inputs": {
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1726560853,
|
||||
"narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"gergle": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -83,42 +27,19 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1764868579,
|
||||
"narHash": "sha256-rfTUOIc0wnC4+19gLVfPbHfXx/ilfuUix6bWY+yaM2U=",
|
||||
"ref": "main",
|
||||
"rev": "9c923d1d50daa6a3b28c3214ad2300bfaf6c8fcd",
|
||||
"revCount": 22,
|
||||
"lastModified": 1736621371,
|
||||
"narHash": "sha256-45UIQSQA7R5iU4YWvilo7mQbhY1Liql9bHBvYa3qRI0=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "3729796c1213fe76e568ac28f1df8de4e596950b",
|
||||
"revCount": 20,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
|
||||
}
|
||||
},
|
||||
"gitignore": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nix-topology",
|
||||
"pre-commit-hooks",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1709087332,
|
||||
"narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "gitignore.nix",
|
||||
"rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "hercules-ci",
|
||||
"repo": "gitignore.nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"greg-ng": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -127,16 +48,15 @@
|
||||
"rust-overlay": "rust-overlay"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1765760377,
|
||||
"narHash": "sha256-2+lgzUjVas9hPSeWn52MwuX+iidMN4RkzkHo4vrGmR8=",
|
||||
"ref": "main",
|
||||
"rev": "f340dc5b9c9f3b75b7aca41f56f8869b9e28cf8c",
|
||||
"revCount": 58,
|
||||
"lastModified": 1736545379,
|
||||
"narHash": "sha256-PeTTmGumdOX3rd6OKI7QMCrZovCDkrckZbcHr+znxWA=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "74f5316121776db2769385927ec0d0c2cc2b23e4",
|
||||
"revCount": 42,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
|
||||
}
|
||||
@@ -148,16 +68,15 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1764867811,
|
||||
"narHash": "sha256-UWHiwr8tIcGcVxMLvAdNxDbQ8QuHf3REHboyxvFkYEI=",
|
||||
"ref": "master",
|
||||
"rev": "c9983e947efe047ea9d6f97157a1f90e49d0eab3",
|
||||
"revCount": 81,
|
||||
"lastModified": 1736178795,
|
||||
"narHash": "sha256-mPdi8cgvIDYcgG3FRG7A4BOIMu2Jef96TPMnV00uXlM=",
|
||||
"ref": "refs/heads/master",
|
||||
"rev": "fde738910de1fd8293535a6382c2f0c2749dd7c1",
|
||||
"revCount": 79,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "master",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
|
||||
}
|
||||
@@ -169,61 +88,33 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1764844095,
|
||||
"narHash": "sha256-Drf1orxsmFDzO+UbPo85gHjXW7QzAM+6oTPvI7vOSik=",
|
||||
"lastModified": 1727410897,
|
||||
"narHash": "sha256-tWsyxvf421ieWUJYgjV7m1eTdr2ZkO3vId7vmtvfFpQ=",
|
||||
"owner": "dali99",
|
||||
"repo": "nixos-matrix-modules",
|
||||
"rev": "25b9f31ef1dbc3987b4c716de716239f2b283701",
|
||||
"rev": "ff787d410cba17882cd7b6e2e22cc88d4064193c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "dali99",
|
||||
"ref": "v0.8.0",
|
||||
"ref": "v0.6.1",
|
||||
"repo": "nixos-matrix-modules",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"minecraft-heatmap": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"rust-overlay": "rust-overlay_2"
|
||||
},
|
||||
"minecraft-data": {
|
||||
"locked": {
|
||||
"lastModified": 1766407405,
|
||||
"narHash": "sha256-UEJ8F8/oG70biWRrGbL5/aB7OXzzvnYs+jxkR07UHvA=",
|
||||
"ref": "main",
|
||||
"rev": "e719840f72ca1b0cd169562a3a0de69899821de0",
|
||||
"revCount": 16,
|
||||
"lastModified": 1725277886,
|
||||
"narHash": "sha256-Fw4VbbE3EfypQWSgPDFfvVH47BHeg3ptsO715NlUM8Q=",
|
||||
"ref": "refs/heads/master",
|
||||
"rev": "1b4087bd3322a2e2ba84271c8fcc013e6b641a58",
|
||||
"revCount": 2,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git"
|
||||
"url": "https://git.pvv.ntnu.no/Drift/minecraft-data.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git"
|
||||
}
|
||||
},
|
||||
"minecraft-kartverket": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1765904683,
|
||||
"narHash": "sha256-uXM56y5n5GWpCiCNdKlTcCAy2IntgDB21c4gBDU30io=",
|
||||
"ref": "main",
|
||||
"rev": "6fae27b1659efb6774cf08a4e36ed29ab0e24105",
|
||||
"revCount": 26,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
|
||||
"url": "https://git.pvv.ntnu.no/Drift/minecraft-data.git"
|
||||
}
|
||||
},
|
||||
"nix-gitea-themes": {
|
||||
@@ -233,94 +124,48 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1743881366,
|
||||
"narHash": "sha256-ScGA2IHPk9ugf9bqEZnp+YB/OJgrkZblnG/XLEKvJAo=",
|
||||
"ref": "main",
|
||||
"rev": "db2e4becf1b11e5dfd33de12a90a7d089fcf68ec",
|
||||
"revCount": 11,
|
||||
"lastModified": 1736531400,
|
||||
"narHash": "sha256-+X/HVI1AwoPcud28wI35XRrc1kDgkYdDUGABJBAkxDI=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "e4dafd06b3d7e9e6e07617766e9c3743134571b7",
|
||||
"revCount": 7,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
|
||||
"url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
|
||||
}
|
||||
},
|
||||
"nix-topology": {
|
||||
"inputs": {
|
||||
"devshell": "devshell",
|
||||
"flake-utils": "flake-utils",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"pre-commit-hooks": "pre-commit-hooks"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1765969653,
|
||||
"narHash": "sha256-qVpQxyvdByeDfb+d+jhbyNna2Ie+w85iHpt4Qu0rv/E=",
|
||||
"owner": "oddlama",
|
||||
"repo": "nix-topology",
|
||||
"rev": "0ed73e5a1b65eb8ed388d070ebe8dedb9182f466",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "oddlama",
|
||||
"ref": "main",
|
||||
"repo": "nix-topology",
|
||||
"type": "github"
|
||||
"url": "https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1767043167,
|
||||
"narHash": "sha256-wN04/SL+8tV0D2HBIgt9dpX/03U18xoJ+8PT+dcn30E=",
|
||||
"rev": "0b43a6ee07997a6e319e92dcbf276c2736506944",
|
||||
"type": "tarball",
|
||||
"url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.2789.0b43a6ee0799/nixexprs.tar.xz"
|
||||
"lastModified": 1740782485,
|
||||
"narHash": "sha256-GkDJDqHYlPKZFdyxzZHtljxNRsosKB1GCrblqlvLFgo=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "dd5c2540983641bbaabdfc665931592d4c9989e8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
"url": "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz"
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-24.11-small",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1767031366,
|
||||
"narHash": "sha256-SJz8tVEnXusU8OzN5ixAXQgzXv8fNIzp9ztzUyobh4s=",
|
||||
"rev": "d23fedd87fcd067b1d160323fae0d0e4f995527d",
|
||||
"type": "tarball",
|
||||
"url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre918279.d23fedd87fcd/nixexprs.tar.xz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
"url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
|
||||
}
|
||||
},
|
||||
"pre-commit-hooks": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
"gitignore": "gitignore",
|
||||
"nixpkgs": [
|
||||
"nix-topology",
|
||||
"nixpkgs"
|
||||
],
|
||||
"nixpkgs-stable": [
|
||||
"nix-topology",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1730797577,
|
||||
"narHash": "sha256-SrID5yVpyUfknUTGWgYkTyvdr9J1LxUym4om3SVGPkg=",
|
||||
"owner": "cachix",
|
||||
"repo": "pre-commit-hooks.nix",
|
||||
"rev": "1864030ed24a2b8b4e4d386a5eeaf0c5369e50a9",
|
||||
"lastModified": 1740848276,
|
||||
"narHash": "sha256-bYeI3FEs824X+MJYksKboNlmglehzplqzn+XvcojWMc=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "e9b0ff70ddc61c42548501b0fafb86bb49cca858",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "cachix",
|
||||
"repo": "pre-commit-hooks.nix",
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-unstable-small",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
@@ -331,16 +176,15 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1764869785,
|
||||
"narHash": "sha256-FGTIpC7gB4lbeL0bfYzn1Ge0PaCpd7VqWBLhJBx0i4A=",
|
||||
"ref": "main",
|
||||
"rev": "8ce7fb0b1918bdb3d1489a40d73895693955e8b2",
|
||||
"revCount": 23,
|
||||
"lastModified": 1723850344,
|
||||
"narHash": "sha256-aT37O9l9eclWEnqxASVNBL1dKwDHZUOqdbA4VO9DJvw=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "38b66677ab8c01aee10cd59e745af9ce3ea88092",
|
||||
"revCount": 19,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
|
||||
}
|
||||
@@ -352,16 +196,15 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1767080188,
|
||||
"narHash": "sha256-BmyPuWeSQ9XREyi0KSerWRfJndmyzHNJLysBJld/KwA=",
|
||||
"ref": "main",
|
||||
"rev": "08a216f4473e26aa2a5349e72633c0ab24e8ffbd",
|
||||
"revCount": 534,
|
||||
"lastModified": 1737151758,
|
||||
"narHash": "sha256-yZBsefIarFUEhFRj+rCGMp9Zvag3MCafqV/JfGVRVwc=",
|
||||
"ref": "refs/heads/master",
|
||||
"rev": "a4ebe6ded0c8c124561a41cb329ff30891914b5e",
|
||||
"revCount": 475,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
||||
}
|
||||
@@ -373,10 +216,8 @@
|
||||
"greg-ng": "greg-ng",
|
||||
"grzegorz-clients": "grzegorz-clients",
|
||||
"matrix-next": "matrix-next",
|
||||
"minecraft-heatmap": "minecraft-heatmap",
|
||||
"minecraft-kartverket": "minecraft-kartverket",
|
||||
"minecraft-data": "minecraft-data",
|
||||
"nix-gitea-themes": "nix-gitea-themes",
|
||||
"nix-topology": "nix-topology",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||
"pvv-calendar-bot": "pvv-calendar-bot",
|
||||
@@ -392,32 +233,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1765680428,
|
||||
"narHash": "sha256-fyPmRof9SZeI14ChPk5rVPOm7ISiiGkwGCunkhM+eUg=",
|
||||
"lastModified": 1729391507,
|
||||
"narHash": "sha256-as0I9xieJUHf7kiK2a9znDsVZQTFWhM1pLivII43Gi0=",
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"rev": "eb3898d8ef143d4bf0f7f2229105fc51c7731b2f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"rust-overlay_2": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"minecraft-heatmap",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1766371695,
|
||||
"narHash": "sha256-W7CX9vy7H2Jj3E8NI4djHyF8iHSxKpb2c/7uNQ/vGFU=",
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"rev": "d81285ba8199b00dc31847258cae3c655b605e8c",
|
||||
"rev": "784981a9feeba406de38c1c9a3decf966d853cca",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -433,34 +253,18 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1766894905,
|
||||
"narHash": "sha256-pn8AxxfajqyR/Dmr1wnZYdUXHgM3u6z9x0Z1Ijmz2UQ=",
|
||||
"lastModified": 1739262228,
|
||||
"narHash": "sha256-7JAGezJ0Dn5qIyA2+T4Dt/xQgAbhCglh6lzCekTVMeU=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "61b39c7b657081c2adc91b75dd3ad8a91d6f07a7",
|
||||
"rev": "07af005bb7d60c7f118d9d9f5530485da5d1e975",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "Mic92",
|
||||
"ref": "master",
|
||||
"repo": "sops-nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
|
||||
189
flake.nix
189
flake.nix
@@ -2,42 +2,35 @@
|
||||
description = "PVV System flake";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "https://nixos.org/channels/nixos-25.11-small/nixexprs.tar.xz";
|
||||
nixpkgs-unstable.url = "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz";
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11-small"; # remember to also update the url in base/services/auto-upgrade.nix
|
||||
nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
|
||||
|
||||
sops-nix.url = "github:Mic92/sops-nix/master";
|
||||
sops-nix.url = "github:Mic92/sops-nix";
|
||||
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
disko.url = "github:nix-community/disko/v1.11.0";
|
||||
disko.url = "github:nix-community/disko";
|
||||
disko.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
nix-topology.url = "github:oddlama/nix-topology/main";
|
||||
nix-topology.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
pvv-nettsiden.url = "git+https://git.pvv.ntnu.no/Projects/nettsiden.git?ref=main";
|
||||
pvv-nettsiden.url = "git+https://git.pvv.ntnu.no/Projects/nettsiden.git";
|
||||
pvv-nettsiden.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git?ref=main";
|
||||
pvv-calendar-bot.url = "git+https://git.pvv.ntnu.no/Projects/calendar-bot.git";
|
||||
pvv-calendar-bot.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
matrix-next.url = "github:dali99/nixos-matrix-modules/v0.8.0";
|
||||
matrix-next.url = "github:dali99/nixos-matrix-modules/v0.6.1";
|
||||
matrix-next.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git?ref=main";
|
||||
nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/oysteikt/nix-gitea-themes.git";
|
||||
nix-gitea-themes.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
|
||||
minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";
|
||||
greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git";
|
||||
greg-ng.inputs.nixpkgs.follows = "nixpkgs";
|
||||
gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git?ref=main";
|
||||
gergle.url = "git+https://git.pvv.ntnu.no/Grzegorz/gergle.git";
|
||||
gergle.inputs.nixpkgs.follows = "nixpkgs";
|
||||
grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git?ref=master";
|
||||
grzegorz-clients.url = "git+https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git";
|
||||
grzegorz-clients.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
minecraft-kartverket.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git?ref=main";
|
||||
minecraft-kartverket.inputs.nixpkgs.follows = "nixpkgs";
|
||||
minecraft-data.url = "git+https://git.pvv.ntnu.no/Drift/minecraft-data.git";
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
|
||||
@@ -60,82 +53,42 @@
|
||||
in {
|
||||
inputs = lib.mapAttrs (_: src: src.outPath) inputs;
|
||||
|
||||
pkgs = forAllSystems (system:
|
||||
import nixpkgs {
|
||||
inherit system;
|
||||
config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
|
||||
[
|
||||
"nvidia-x11"
|
||||
"nvidia-settings"
|
||||
];
|
||||
});
|
||||
|
||||
nixosConfigurations = let
|
||||
unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
|
||||
|
||||
nixosConfig =
|
||||
nixpkgs:
|
||||
name:
|
||||
configurationPath:
|
||||
extraArgs:
|
||||
lib.nixosSystem (lib.recursiveUpdate
|
||||
(let
|
||||
nixosConfig = nixpkgs: name: config: lib.nixosSystem (lib.recursiveUpdate
|
||||
rec {
|
||||
system = "x86_64-linux";
|
||||
in {
|
||||
inherit system;
|
||||
|
||||
specialArgs = {
|
||||
inherit unstablePkgs inputs;
|
||||
values = import ./values.nix;
|
||||
fp = path: ./${path};
|
||||
} // extraArgs.specialArgs or { };
|
||||
};
|
||||
|
||||
modules = [
|
||||
configurationPath
|
||||
./hosts/${name}/configuration.nix
|
||||
sops-nix.nixosModules.sops
|
||||
] ++ extraArgs.modules or [];
|
||||
] ++ config.modules or [];
|
||||
|
||||
pkgs = import nixpkgs {
|
||||
inherit system;
|
||||
config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
|
||||
[
|
||||
"nvidia-x11"
|
||||
"nvidia-settings"
|
||||
];
|
||||
overlays = [
|
||||
# Global overlays go here
|
||||
] ++ extraArgs.overlays or [ ];
|
||||
] ++ config.overlays or [ ];
|
||||
};
|
||||
})
|
||||
(builtins.removeAttrs extraArgs [
|
||||
"modules"
|
||||
"overlays"
|
||||
"specialArgs"
|
||||
])
|
||||
}
|
||||
(removeAttrs config [ "modules" "overlays" ])
|
||||
);
|
||||
|
||||
stableNixosConfig = name: extraArgs:
|
||||
nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
|
||||
stableNixosConfig = nixosConfig nixpkgs;
|
||||
unstableNixosConfig = nixosConfig nixpkgs-unstable;
|
||||
in {
|
||||
bakke = stableNixosConfig "bakke" {
|
||||
modules = [
|
||||
disko.nixosModules.disko
|
||||
];
|
||||
};
|
||||
bicep = stableNixosConfig "bicep" {
|
||||
modules = [
|
||||
inputs.matrix-next.nixosModules.default
|
||||
inputs.pvv-calendar-bot.nixosModules.default
|
||||
inputs.minecraft-heatmap.nixosModules.default
|
||||
self.nixosModules.gickup
|
||||
self.nixosModules.matrix-ooye
|
||||
];
|
||||
overlays = [
|
||||
inputs.pvv-calendar-bot.overlays.default
|
||||
inputs.minecraft-heatmap.overlays.default
|
||||
(final: prev: {
|
||||
inherit (self.packages.${prev.system}) out-of-your-element;
|
||||
})
|
||||
inputs.pvv-calendar-bot.overlays.x86_64-linux.default
|
||||
];
|
||||
};
|
||||
bekkalokk = stableNixosConfig "bekkalokk" {
|
||||
@@ -146,26 +99,23 @@
|
||||
simplesamlphp = final.callPackage ./packages/simplesamlphp { };
|
||||
bluemap = final.callPackage ./packages/bluemap.nix { };
|
||||
})
|
||||
inputs.nix-gitea-themes.overlays.default
|
||||
inputs.pvv-nettsiden.overlays.default
|
||||
];
|
||||
modules = [
|
||||
inputs.nix-gitea-themes.nixosModules.default
|
||||
inputs.pvv-nettsiden.nixosModules.default
|
||||
self.nixosModules.bluemap
|
||||
];
|
||||
};
|
||||
bob = stableNixosConfig "bob" {
|
||||
modules = [
|
||||
disko.nixosModules.disko
|
||||
{ disko.devices.disk.disk1.device = "/dev/vda"; }
|
||||
];
|
||||
};
|
||||
ildkule = stableNixosConfig "ildkule" { };
|
||||
#ildkule-unstable = unstableNixosConfig "ildkule" { };
|
||||
shark = stableNixosConfig "shark" { };
|
||||
wenche = stableNixosConfig "wenche" { };
|
||||
|
||||
kommode = stableNixosConfig "kommode" {
|
||||
overlays = [
|
||||
inputs.nix-gitea-themes.overlays.default
|
||||
];
|
||||
modules = [
|
||||
inputs.nix-gitea-themes.nixosModules.default
|
||||
];
|
||||
};
|
||||
|
||||
ustetind = stableNixosConfig "ustetind" {
|
||||
modules = [
|
||||
@@ -195,37 +145,17 @@
|
||||
inputs.gergle.overlays.default
|
||||
];
|
||||
};
|
||||
}
|
||||
//
|
||||
(let
|
||||
machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
|
||||
stableLupineNixosConfig = name: extraArgs:
|
||||
nixosConfig nixpkgs name ./hosts/lupine/configuration.nix extraArgs;
|
||||
in lib.genAttrs machineNames (name: stableLupineNixosConfig name {
|
||||
modules = [{ networking.hostName = name; }];
|
||||
specialArgs.lupineName = name;
|
||||
}));
|
||||
|
||||
dagali = unstableNixosConfig "dagali" { };
|
||||
};
|
||||
|
||||
nixosModules = {
|
||||
bluemap = ./modules/bluemap.nix;
|
||||
snakeoil-certs = ./modules/snakeoil-certs.nix;
|
||||
snappymail = ./modules/snappymail.nix;
|
||||
robots-txt = ./modules/robots-txt.nix;
|
||||
gickup = ./modules/gickup;
|
||||
matrix-ooye = ./modules/matrix-ooye.nix;
|
||||
};
|
||||
|
||||
devShells = forAllSystems (system: {
|
||||
default = nixpkgs-unstable.legacyPackages.${system}.callPackage ./shell.nix { };
|
||||
cuda = let
|
||||
cuda-pkgs = import nixpkgs-unstable {
|
||||
inherit system;
|
||||
config = {
|
||||
allowUnfree = true;
|
||||
cudaSupport = true;
|
||||
};
|
||||
};
|
||||
in cuda-pkgs.callPackage ./shells/cuda.nix { };
|
||||
default = nixpkgs.legacyPackages.${system}.callPackage ./shell.nix { };
|
||||
});
|
||||
|
||||
packages = {
|
||||
@@ -240,57 +170,14 @@
|
||||
|
||||
simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
|
||||
|
||||
bluemap = pkgs.callPackage ./packages/bluemap.nix { };
|
||||
|
||||
out-of-your-element = pkgs.callPackage ./packages/out-of-your-element.nix { };
|
||||
}
|
||||
//
|
||||
# Mediawiki extensions
|
||||
} //
|
||||
(lib.pipe null [
|
||||
(_: pkgs.callPackage ./packages/mediawiki-extensions { })
|
||||
(lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
|
||||
(lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
|
||||
])
|
||||
//
|
||||
# Machines
|
||||
lib.genAttrs allMachines
|
||||
(machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
|
||||
//
|
||||
# Nix-topology
|
||||
(let
|
||||
topology' = import inputs.nix-topology {
|
||||
pkgs = import nixpkgs {
|
||||
system = "x86_64-linux";
|
||||
overlays = [ inputs.nix-topology.overlays.default ];
|
||||
};
|
||||
|
||||
specialArgs = {
|
||||
values = import ./values.nix;
|
||||
};
|
||||
|
||||
modules = [
|
||||
./topology
|
||||
{
|
||||
nixosConfigurations = lib.mapAttrs (_name: nixosCfg: nixosCfg.extendModules {
|
||||
modules = [
|
||||
inputs.nix-topology.nixosModules.default
|
||||
./topology/service-extractors/greg-ng.nix
|
||||
];
|
||||
}) self.nixosConfigurations;
|
||||
}
|
||||
];
|
||||
};
|
||||
in {
|
||||
topology = topology'.config.output;
|
||||
topology-png = pkgs.runCommand "pvv-config-topology-png" {
|
||||
nativeBuildInputs = [ pkgs.writableTmpDirAsHomeHook ];
|
||||
} ''
|
||||
mkdir -p "$out"
|
||||
for file in '${topology'.config.output}'/*.svg; do
|
||||
${lib.getExe pkgs.imagemagick} -density 300 -background none "$file" "$out"/"$(basename "''${file%.svg}.png")"
|
||||
done
|
||||
'';
|
||||
});
|
||||
// lib.genAttrs allMachines
|
||||
(machine: self.nixosConfigurations.${machine}.config.system.build.toplevel);
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,25 +0,0 @@
|
||||
{ config, pkgs, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
../../base
|
||||
./filesystems.nix
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = ../../secrets/bakke/bakke.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
networking.hostName = "bakke";
|
||||
networking.hostId = "99609ffc";
|
||||
systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "enp2s0";
|
||||
address = with values.hosts.bakke; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||
};
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
@@ -1,83 +0,0 @@
|
||||
{
|
||||
# https://github.com/nix-community/disko/blob/master/example/boot-raid1.nix
|
||||
# Note: Disko was used to create the initial md raid, but is no longer in active use on this host.
|
||||
disko.devices = {
|
||||
disk = {
|
||||
one = {
|
||||
type = "disk";
|
||||
device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E2EER6N6";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
size = "500M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "mdraid";
|
||||
name = "boot";
|
||||
};
|
||||
};
|
||||
mdadm = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "mdraid";
|
||||
name = "raid1";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
two = {
|
||||
type = "disk";
|
||||
device = "/dev/disk/by-id/ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E7LPLU71";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
size = "500M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "mdraid";
|
||||
name = "boot";
|
||||
};
|
||||
};
|
||||
mdadm = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "mdraid";
|
||||
name = "raid1";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
mdadm = {
|
||||
boot = {
|
||||
type = "mdadm";
|
||||
level = 1;
|
||||
metadata = "1.0";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
};
|
||||
};
|
||||
raid1 = {
|
||||
type = "mdadm";
|
||||
level = 1;
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions.primary = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,26 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
# Boot drives:
|
||||
boot.swraid.enable = true;
|
||||
|
||||
# ZFS Data pool:
|
||||
environment.systemPackages = with pkgs; [ zfs ];
|
||||
boot = {
|
||||
zfs = {
|
||||
extraPools = [ "tank" ];
|
||||
requestEncryptionCredentials = false;
|
||||
};
|
||||
supportedFilesystems = [ "zfs" ];
|
||||
kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
|
||||
};
|
||||
services.zfs.autoScrub = {
|
||||
enable = true;
|
||||
interval = "Wed *-*-8..14 00:00:00";
|
||||
};
|
||||
|
||||
# NFS Exports:
|
||||
#TODO
|
||||
|
||||
# NFS Import mounts:
|
||||
#TODO
|
||||
}
|
||||
@@ -1,52 +0,0 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=root" ];
|
||||
};
|
||||
|
||||
fileSystems."/home" =
|
||||
{ device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=home" ];
|
||||
};
|
||||
|
||||
fileSystems."/nix" =
|
||||
{ device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=nix" "noatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/sdc2";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault false;
|
||||
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -4,10 +4,12 @@
|
||||
./hardware-configuration.nix
|
||||
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
|
||||
./services/bluemap.nix
|
||||
./services/bluemap/default.nix
|
||||
./services/gitea/default.nix
|
||||
./services/idp-simplesamlphp
|
||||
./services/kerberos.nix
|
||||
./services/kerberos
|
||||
./services/mediawiki
|
||||
./services/nginx.nix
|
||||
./services/phpfpm.nix
|
||||
|
||||
@@ -1,131 +0,0 @@
|
||||
{ config, lib, pkgs, inputs, ... }:
|
||||
let
|
||||
vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
|
||||
format = pkgs.formats.hocon { };
|
||||
in {
|
||||
# NOTE: our versino of the module gets added in flake.nix
|
||||
disabledModules = [ "services/web-apps/bluemap.nix" ];
|
||||
|
||||
sops.secrets."bluemap/ssh-key" = { };
|
||||
sops.secrets."bluemap/ssh-known-hosts" = { };
|
||||
|
||||
services.bluemap = {
|
||||
enable = true;
|
||||
|
||||
eula = true;
|
||||
onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
|
||||
|
||||
host = "minecraft.pvv.ntnu.no";
|
||||
|
||||
maps = let
|
||||
inherit (inputs.minecraft-kartverket.packages.${pkgs.stdenv.hostPlatform.system}) bluemap-export;
|
||||
in {
|
||||
"verden" = {
|
||||
settings = {
|
||||
world = vanillaSurvival;
|
||||
dimension = "minecraft:overworld";
|
||||
name = "Verden";
|
||||
sorting = 0;
|
||||
start-pos = {
|
||||
x = 0;
|
||||
z = 0;
|
||||
};
|
||||
ambient-light = 0.1;
|
||||
cave-detection-ocean-floor = -5;
|
||||
marker-sets = {
|
||||
_includes = [ (format.lib.mkInclude "${bluemap-export}/overworld.hocon") ];
|
||||
};
|
||||
};
|
||||
};
|
||||
"underverden" = {
|
||||
settings = {
|
||||
world = vanillaSurvival;
|
||||
dimension = "minecraft:the_nether";
|
||||
name = "Underverden";
|
||||
sorting = 100;
|
||||
start-pos = {
|
||||
x = 0;
|
||||
z = 0;
|
||||
};
|
||||
sky-color = "#290000";
|
||||
void-color = "#150000";
|
||||
sky-light = 1;
|
||||
ambient-light = 0.6;
|
||||
remove-caves-below-y = -10000;
|
||||
cave-detection-ocean-floor = -5;
|
||||
cave-detection-uses-block-light = true;
|
||||
render-mask = [{
|
||||
max-y = 90;
|
||||
}];
|
||||
marker-sets = {
|
||||
_includes = [ (format.lib.mkInclude {
|
||||
required = true;
|
||||
type = "file";
|
||||
value = "${bluemap-export}/nether.hocon";
|
||||
}) ];
|
||||
};
|
||||
};
|
||||
};
|
||||
"enden" = {
|
||||
settings = {
|
||||
world = vanillaSurvival;
|
||||
dimension = "minecraft:the_end";
|
||||
name = "Enden";
|
||||
sorting = 200;
|
||||
start-pos = {
|
||||
x = 0;
|
||||
z = 0;
|
||||
};
|
||||
sky-color = "#080010";
|
||||
void-color = "#080010";
|
||||
sky-light = 1;
|
||||
ambient-light = 0.6;
|
||||
remove-caves-below-y = -10000;
|
||||
cave-detection-ocean-floor = -5;
|
||||
marker-sets = {
|
||||
_includes = [ (format.lib.mkInclude "${bluemap-export}/the-end.hocon") ];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."render-bluemap-maps" = {
|
||||
serviceConfig = {
|
||||
StateDirectory = [ "bluemap/world" ];
|
||||
ExecStartPre = let
|
||||
rsyncArgs = lib.cli.toCommandLineShellGNU { } {
|
||||
archive = true;
|
||||
compress = true;
|
||||
verbose = true;
|
||||
no-owner = true;
|
||||
no-group = true;
|
||||
rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
|
||||
};
|
||||
in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
|
||||
LoadCredential = [
|
||||
"sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
|
||||
"ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."minecraft.pvv.ntnu.no" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
kTLS = true;
|
||||
http3 = true;
|
||||
quic = true;
|
||||
http3_hq = true;
|
||||
extraConfig = ''
|
||||
# Enabling QUIC 0-RTT
|
||||
ssl_early_data on;
|
||||
|
||||
quic_gso on;
|
||||
quic_retry on;
|
||||
add_header Alt-Svc 'h3=":$server_port"; ma=86400';
|
||||
'';
|
||||
};
|
||||
|
||||
networking.firewall.allowedUDPPorts = [ 443 ];
|
||||
}
|
||||
85
hosts/bekkalokk/services/bluemap/default.nix
Normal file
85
hosts/bekkalokk/services/bluemap/default.nix
Normal file
@@ -0,0 +1,85 @@
|
||||
{ config, lib, pkgs, inputs, ... }:
|
||||
let
|
||||
vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
|
||||
in {
|
||||
imports = [
|
||||
./module.nix # From danio, pending upstreaming
|
||||
];
|
||||
|
||||
disabledModules = [ "services/web-apps/bluemap.nix" ];
|
||||
|
||||
sops.secrets."bluemap/ssh-key" = { };
|
||||
sops.secrets."bluemap/ssh-known-hosts" = { };
|
||||
|
||||
services.bluemap = {
|
||||
enable = true;
|
||||
package = pkgs.callPackage ./package.nix { };
|
||||
|
||||
eula = true;
|
||||
onCalendar = "*-*-* 05:45:00"; # a little over an hour after auto-upgrade
|
||||
|
||||
host = "minecraft.pvv.ntnu.no";
|
||||
|
||||
maps = {
|
||||
"verden" = {
|
||||
settings = {
|
||||
world = vanillaSurvival;
|
||||
sorting = 0;
|
||||
ambient-light = 0.1;
|
||||
cave-detection-ocean-floor = -5;
|
||||
marker-sets = inputs.minecraft-data.map-markers.vanillaSurvival.verden;
|
||||
};
|
||||
};
|
||||
"underverden" = {
|
||||
settings = {
|
||||
world = "${vanillaSurvival}/DIM-1";
|
||||
sorting = 100;
|
||||
sky-color = "#290000";
|
||||
void-color = "#150000";
|
||||
ambient-light = 0.6;
|
||||
world-sky-light = 0;
|
||||
remove-caves-below-y = -10000;
|
||||
cave-detection-ocean-floor = -5;
|
||||
cave-detection-uses-block-light = true;
|
||||
max-y = 90;
|
||||
marker-sets = inputs.minecraft-data.map-markers.vanillaSurvival.underverden;
|
||||
};
|
||||
};
|
||||
"enden" = {
|
||||
settings = {
|
||||
world = "${vanillaSurvival}/DIM1";
|
||||
sorting = 200;
|
||||
sky-color = "#080010";
|
||||
void-color = "#080010";
|
||||
ambient-light = 0.6;
|
||||
world-sky-light = 0;
|
||||
remove-caves-below-y = -10000;
|
||||
cave-detection-ocean-floor = -5;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."minecraft.pvv.ntnu.no" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
};
|
||||
|
||||
# TODO: render somewhere else lmao
|
||||
systemd.services."render-bluemap-maps" = {
|
||||
preStart = ''
|
||||
mkdir -p /var/lib/bluemap/world
|
||||
${pkgs.rsync}/bin/rsync \
|
||||
-e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" \
|
||||
-avz --no-owner --no-group \
|
||||
root@innovation.pvv.ntnu.no:/ \
|
||||
${vanillaSurvival}
|
||||
'';
|
||||
serviceConfig = {
|
||||
LoadCredential = [
|
||||
"sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
|
||||
"ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -25,7 +25,7 @@ let
|
||||
"core.conf" = coreConfig;
|
||||
"webapp.conf" = webappConfig;
|
||||
"webserver.conf" = webserverConfig;
|
||||
"packs" = cfg.packs;
|
||||
"packs" = cfg.resourcepacks;
|
||||
};
|
||||
|
||||
renderConfigFolder = name: value: pkgs.linkFarm "bluemap-${name}-config" {
|
||||
@@ -36,7 +36,7 @@ let
|
||||
"core.conf" = coreConfig;
|
||||
"webapp.conf" = format.generate "webapp.conf" (cfg.webappSettings // { "update-settings-file" = false; });
|
||||
"webserver.conf" = webserverConfig;
|
||||
"packs" = value.packs;
|
||||
"packs" = value.resourcepacks;
|
||||
};
|
||||
|
||||
inherit (lib) mkOption;
|
||||
@@ -110,7 +110,7 @@ in {
|
||||
metrics = lib.mkEnableOption "Sending usage metrics containing the version of bluemap in use";
|
||||
};
|
||||
};
|
||||
description = "Settings for the core.conf file, [see upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/common/src/main/resources/de/bluecolored/bluemap/config/core.conf).";
|
||||
description = "Settings for the core.conf file, [see upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/core.conf).";
|
||||
};
|
||||
|
||||
webappSettings = mkOption {
|
||||
@@ -127,7 +127,7 @@ in {
|
||||
webroot = config.services.bluemap.webRoot;
|
||||
}
|
||||
'';
|
||||
description = "Settings for the webapp.conf file, see [upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/common/src/main/resources/de/bluecolored/bluemap/config/webapp.conf).";
|
||||
description = "Settings for the webapp.conf file, see [upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/webapp.conf).";
|
||||
};
|
||||
|
||||
webserverSettings = mkOption {
|
||||
@@ -147,18 +147,18 @@ in {
|
||||
default = { };
|
||||
description = ''
|
||||
Settings for the webserver.conf file, usually not required.
|
||||
[See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/common/src/main/resources/de/bluecolored/bluemap/config/webserver.conf).
|
||||
[See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/webserver.conf).
|
||||
'';
|
||||
};
|
||||
|
||||
maps = mkOption {
|
||||
type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
|
||||
type = lib.types.attrsOf (lib.types.submodule {
|
||||
options = {
|
||||
packs = mkOption {
|
||||
resourcepacks = mkOption {
|
||||
type = lib.types.path;
|
||||
default = cfg.packs;
|
||||
defaultText = lib.literalExpression "config.services.bluemap.packs";
|
||||
description = "A set of resourcepacks, datapacks, and mods to extract resources from, loaded in alphabetical order.";
|
||||
default = cfg.resourcepacks;
|
||||
defaultText = lib.literalExpression "config.services.bluemap.resourcepacks";
|
||||
description = "A set of resourcepacks/mods/bluemap-addons to extract models from loaded in alphabetical order";
|
||||
};
|
||||
settings = mkOption {
|
||||
type = (lib.types.submodule {
|
||||
@@ -168,74 +168,43 @@ in {
|
||||
type = lib.types.path;
|
||||
description = "Path to world folder containing the dimension to render";
|
||||
};
|
||||
name = mkOption {
|
||||
type = lib.types.str;
|
||||
description = "The display name of this map (how this map will be named on the webapp)";
|
||||
default = name;
|
||||
defaultText = lib.literalExpression "<name>";
|
||||
};
|
||||
render-mask = mkOption {
|
||||
type = with lib.types; listOf (attrsOf format.type);
|
||||
description = "Limits for the map render";
|
||||
default = [ ];
|
||||
example = [
|
||||
{
|
||||
min-x = -4000;
|
||||
max-x = 4000;
|
||||
min-z = -4000;
|
||||
max-z = 4000;
|
||||
min-y = 50;
|
||||
max-y = 100;
|
||||
}
|
||||
{
|
||||
subtract = true;
|
||||
min-y = 90;
|
||||
max-y = 127;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
});
|
||||
description = ''
|
||||
Settings for files in `maps/`.
|
||||
See the default for an example with good options for the different world types.
|
||||
For valid values [consult upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/common/src/main/resources/de/bluecolored/bluemap/config/maps/map.conf).
|
||||
For valid values [consult upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/blob/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/maps/map.conf).
|
||||
'';
|
||||
};
|
||||
};
|
||||
}));
|
||||
});
|
||||
default = {
|
||||
"overworld".settings = {
|
||||
world = cfg.defaultWorld;
|
||||
dimension = "minecraft:overworld";
|
||||
name = "Overworld";
|
||||
world = "${cfg.defaultWorld}";
|
||||
ambient-light = 0.1;
|
||||
cave-detection-ocean-floor = -5;
|
||||
};
|
||||
|
||||
"nether".settings = {
|
||||
world = cfg.defaultWorld;
|
||||
dimension = "minecraft:the_nether";
|
||||
name = "Nether";
|
||||
world = "${cfg.defaultWorld}/DIM-1";
|
||||
sorting = 100;
|
||||
sky-color = "#290000";
|
||||
void-color = "#150000";
|
||||
sky-light = 1;
|
||||
ambient-light = 0.6;
|
||||
world-sky-light = 0;
|
||||
remove-caves-below-y = -10000;
|
||||
cave-detection-ocean-floor = -5;
|
||||
cave-detection-uses-block-light = true;
|
||||
max-y = 90;
|
||||
};
|
||||
|
||||
"end".settings = {
|
||||
world = cfg.defaultWorld;
|
||||
dimension = "minecraft:the_end";
|
||||
name = "The End";
|
||||
world = "${cfg.defaultWorld}/DIM1";
|
||||
sorting = 200;
|
||||
sky-color = "#080010";
|
||||
void-color = "#080010";
|
||||
sky-light = 1;
|
||||
ambient-light = 0.6;
|
||||
world-sky-light = 0;
|
||||
remove-caves-below-y = -10000;
|
||||
cave-detection-ocean-floor = -5;
|
||||
};
|
||||
@@ -243,36 +212,31 @@ in {
|
||||
defaultText = lib.literalExpression ''
|
||||
{
|
||||
"overworld".settings = {
|
||||
world = cfg.defaultWorld;
|
||||
name = "Overworld";
|
||||
dimension = "minecraft:overworld";
|
||||
world = "''${cfg.defaultWorld}";
|
||||
ambient-light = 0.1;
|
||||
cave-detection-ocean-floor = -5;
|
||||
};
|
||||
|
||||
"nether".settings = {
|
||||
world = cfg.defaultWorld;
|
||||
dimension = "minecraft:the_nether";
|
||||
name = "Nether";
|
||||
world = "''${cfg.defaultWorld}/DIM-1";
|
||||
sorting = 100;
|
||||
sky-color = "#290000";
|
||||
void-color = "#150000";
|
||||
sky-light = 1;
|
||||
ambient-light = 0.6;
|
||||
world-sky-light = 0;
|
||||
remove-caves-below-y = -10000;
|
||||
cave-detection-ocean-floor = -5;
|
||||
cave-detection-uses-block-light = true;
|
||||
max-y = 90;
|
||||
};
|
||||
|
||||
"end".settings = {
|
||||
world = cfg.defaultWorld;
|
||||
name = "The End";
|
||||
dimension = "minecraft:the_end";
|
||||
world = "''${cfg.defaultWorld}/DIM1";
|
||||
sorting = 200;
|
||||
sky-color = "#080010";
|
||||
void-color = "#080010";
|
||||
sky-light = 1;
|
||||
ambient-light = 0.6;
|
||||
world-sky-light = 0;
|
||||
remove-caves-below-y = -10000;
|
||||
cave-detection-ocean-floor = -5;
|
||||
};
|
||||
@@ -300,7 +264,7 @@ in {
|
||||
description = ''
|
||||
Where the rendered map will be stored.
|
||||
Unless you are doing something advanced you should probably leave this alone and configure webRoot instead.
|
||||
[See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/tree/master/common/src/main/resources/de/bluecolored/bluemap/config/storages)
|
||||
[See upstream docs](https://github.com/BlueMap-Minecraft/BlueMap/tree/master/BlueMapCommon/src/main/resources/de/bluecolored/bluemap/config/storages)
|
||||
'';
|
||||
default = {
|
||||
"file" = {
|
||||
@@ -316,12 +280,12 @@ in {
|
||||
'';
|
||||
};
|
||||
|
||||
packs = mkOption {
|
||||
resourcepacks = mkOption {
|
||||
type = lib.types.path;
|
||||
default = pkgs.linkFarm "packs" { };
|
||||
default = pkgs.linkFarm "resourcepacks" { };
|
||||
description = ''
|
||||
A set of resourcepacks, datapacks, and mods to extract resources from, loaded in alphabetical order.
|
||||
Can be overriden on a per-map basis with `services.bluemap.maps.<name>.packs`.
|
||||
A set of resourcepacks/mods to extract models from loaded in alphabetical order.
|
||||
Can be overriden on a per-map basis with `services.bluemap.maps.<name>.resourcepacks`.
|
||||
'';
|
||||
};
|
||||
};
|
||||
@@ -342,23 +306,21 @@ in {
|
||||
systemd.services."render-bluemap-maps" = lib.mkIf cfg.enableRender {
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
CPUSchedulingPolicy = "batch";
|
||||
Group = "nginx";
|
||||
UMask = "026";
|
||||
ExecStart = [
|
||||
# If web folder doesnt exist generate it
|
||||
''|test -f "${cfg.webRoot}" || ${lib.getExe cfg.package} -c ${webappConfigFolder} -gs''
|
||||
]
|
||||
++
|
||||
# Render each minecraft map
|
||||
lib.attrsets.mapAttrsToList
|
||||
(name: value: "${lib.getExe cfg.package} -c ${renderConfigFolder name value} -r")
|
||||
cfg.maps
|
||||
++ [
|
||||
# Generate updated webapp
|
||||
"${lib.getExe cfg.package} -c ${webappConfigFolder} -gs"
|
||||
];
|
||||
};
|
||||
script = ''
|
||||
# If web folder doesnt exist generate it
|
||||
test -f "${cfg.webRoot}" || ${lib.getExe cfg.package} -c ${webappConfigFolder} -gs
|
||||
|
||||
# Render each minecraft map
|
||||
${lib.strings.concatStringsSep "\n" (lib.attrsets.mapAttrsToList
|
||||
(name: value: "${lib.getExe cfg.package} -c ${renderConfigFolder name value} -r")
|
||||
cfg.maps)}
|
||||
|
||||
# Generate updated webapp
|
||||
${lib.getExe cfg.package} -c ${webappConfigFolder} -gs
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.timers."render-bluemap-maps" = lib.mkIf cfg.enableRender {
|
||||
30
hosts/bekkalokk/services/bluemap/package.nix
Normal file
30
hosts/bekkalokk/services/bluemap/package.nix
Normal file
@@ -0,0 +1,30 @@
|
||||
{ lib, stdenvNoCC, fetchurl, makeWrapper, jre }:
|
||||
|
||||
stdenvNoCC.mkDerivation rec {
|
||||
pname = "bluemap";
|
||||
version = "5.7";
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
|
||||
hash = "sha256-8udZYJgrr4bi2mjRYrASd8JwUoUVZW1tZpOLRgafAIw=";
|
||||
};
|
||||
|
||||
dontUnpack = true;
|
||||
|
||||
nativeBuildInputs = [ makeWrapper ];
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
makeWrapper ${jre}/bin/java $out/bin/bluemap --add-flags "-jar $src"
|
||||
runHook postInstall
|
||||
'';
|
||||
|
||||
meta = {
|
||||
description = "3D minecraft map renderer";
|
||||
homepage = "https://bluemap.bluecolored.de/";
|
||||
sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
|
||||
license = lib.licenses.mit;
|
||||
maintainers = with lib.maintainers; [ dandellion h7x4 ];
|
||||
mainProgram = "bluemap";
|
||||
};
|
||||
}
|
||||
@@ -3,12 +3,7 @@ let
|
||||
cfg = config.services.gitea;
|
||||
in
|
||||
{
|
||||
services.gitea-themes = {
|
||||
monokai = pkgs.gitea-theme-monokai;
|
||||
earl-grey = pkgs.gitea-theme-earl-grey;
|
||||
pitch-black = pkgs.gitea-theme-pitch-black;
|
||||
catppuccin = pkgs.gitea-theme-catppuccin;
|
||||
};
|
||||
services.gitea-themes.monokai = pkgs.gitea-theme-monokai;
|
||||
|
||||
systemd.services.gitea-customization = lib.mkIf cfg.enable {
|
||||
description = "Install extra customization in gitea's CUSTOM_DIR";
|
||||
@@ -24,15 +19,10 @@ in
|
||||
script = let
|
||||
logo-svg = fp /assets/logo_blue_regular.svg;
|
||||
logo-png = fp /assets/logo_blue_regular.png;
|
||||
|
||||
extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
|
||||
<a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
|
||||
'';
|
||||
|
||||
extraLinksFooter = pkgs.writeText "gitea-extra-links-footer.tmpl" ''
|
||||
<a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
|
||||
<a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
|
||||
<a class="item" href="https://wiki.pvv.ntnu.no/wiki/Tjenester/Kodelager">PVV Gitea Howto</a>
|
||||
<a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
|
||||
'';
|
||||
|
||||
project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
|
||||
@@ -47,14 +37,13 @@ in
|
||||
} ''
|
||||
# Bigger icons
|
||||
install -Dm444 "${cfg.package.src}/templates/repo/icon.tmpl" "$out/repo/icon.tmpl"
|
||||
sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
|
||||
sed -i -e 's/24/48/g' "$out/repo/icon.tmpl"
|
||||
'';
|
||||
in ''
|
||||
install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
|
||||
install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
|
||||
install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
|
||||
install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
|
||||
install -Dm444 ${extraLinksFooter} ${cfg.customDir}/templates/custom/extra_links_footer.tmpl
|
||||
install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml
|
||||
|
||||
"${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
|
||||
@@ -1,36 +1,31 @@
|
||||
{ config, values, lib, pkgs, unstablePkgs, ... }:
|
||||
{ config, values, lib, ... }:
|
||||
let
|
||||
cfg = config.services.gitea;
|
||||
domain = "git.pvv.ntnu.no";
|
||||
sshPort = 2222;
|
||||
in {
|
||||
imports = [
|
||||
./customization
|
||||
./customization.nix
|
||||
./gpg.nix
|
||||
./import-users
|
||||
./web-secret-provider
|
||||
];
|
||||
|
||||
sops.secrets = let
|
||||
defaultConfig = {
|
||||
sops.secrets = {
|
||||
"gitea/database" = {
|
||||
owner = "gitea";
|
||||
group = "gitea";
|
||||
};
|
||||
"gitea/email-password" = {
|
||||
owner = "gitea";
|
||||
group = "gitea";
|
||||
restartUnits = [ "gitea.service" ];
|
||||
};
|
||||
in {
|
||||
"gitea/database" = defaultConfig;
|
||||
"gitea/email-password" = defaultConfig;
|
||||
"gitea/lfs-jwt-secret" = defaultConfig;
|
||||
"gitea/oauth2-jwt-secret" = defaultConfig;
|
||||
"gitea/secret-key" = defaultConfig;
|
||||
};
|
||||
|
||||
services.gitea = {
|
||||
enable = true;
|
||||
appName = "PVV Git";
|
||||
|
||||
package = unstablePkgs.gitea;
|
||||
|
||||
database = {
|
||||
type = "postgres";
|
||||
host = "postgres.pvv.ntnu.no";
|
||||
@@ -48,19 +43,9 @@ in {
|
||||
ROOT_URL = "https://${domain}/";
|
||||
PROTOCOL = "http+unix";
|
||||
SSH_PORT = sshPort;
|
||||
LANDING_PAGE = "explore";
|
||||
START_SSH_SERVER = true;
|
||||
START_LFS_SERVER = true;
|
||||
LFS_JWT_SECRET = lib.mkForce "";
|
||||
LFS_JWT_SECRET_URI = "file:${config.sops.secrets."gitea/lfs-jwt-secret".path}";
|
||||
};
|
||||
oauth2 = {
|
||||
JWT_SECRET = lib.mkForce "";
|
||||
JWT_SECRET_URI = "file:${config.sops.secrets."gitea/oauth2-jwt-secret".path}";
|
||||
};
|
||||
"git.timeout" = {
|
||||
MIGRATE = 3600;
|
||||
MIRROR = 1800;
|
||||
LANDING_PAGE = "explore";
|
||||
};
|
||||
mailer = {
|
||||
ENABLED = true;
|
||||
@@ -84,10 +69,6 @@ in {
|
||||
};
|
||||
admin.DEFAULT_EMAIL_NOTIFICATIONS = "onmention";
|
||||
session.COOKIE_SECURE = true;
|
||||
security = {
|
||||
SECRET_KEY = lib.mkForce "";
|
||||
SECRET_KEY_URI = "file:${config.sops.secrets."gitea/secret-key".path}";
|
||||
};
|
||||
database.LOG_SQL = false;
|
||||
repository = {
|
||||
PREFERRED_LICENSES = lib.concatStringsSep "," [
|
||||
@@ -122,10 +103,6 @@ in {
|
||||
picture = {
|
||||
DISABLE_GRAVATAR = true;
|
||||
ENABLE_FEDERATED_AVATAR = false;
|
||||
|
||||
AVATAR_MAX_FILE_SIZE = 1024 * 1024 * 5;
|
||||
# NOTE: go any bigger than this, and gitea will freeze your gif >:(
|
||||
AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 2;
|
||||
};
|
||||
actions.ENABLED = true;
|
||||
ui = {
|
||||
@@ -157,20 +134,12 @@ in {
|
||||
|
||||
dump = {
|
||||
enable = true;
|
||||
interval = "weekly";
|
||||
type = "tar.gz";
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = [ cfg.package ];
|
||||
|
||||
systemd.services.gitea.serviceConfig.CPUSchedulingPolicy = "batch";
|
||||
|
||||
systemd.services.gitea.serviceConfig.CacheDirectory = "gitea/repo-archive";
|
||||
systemd.services.gitea.serviceConfig.BindPaths = [
|
||||
"%C/gitea/repo-archive:${cfg.stateDir}/data/repo-archive"
|
||||
];
|
||||
|
||||
services.nginx.virtualHosts."${domain}" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
@@ -186,7 +155,6 @@ in {
|
||||
proxyPass = "http://unix:${cfg.settings.server.HTTP_ADDR}";
|
||||
extraConfig = ''
|
||||
allow ${values.hosts.ildkule.ipv4}/32;
|
||||
allow ${values.hosts.ildkule.ipv6}/128;
|
||||
deny all;
|
||||
'';
|
||||
};
|
||||
@@ -194,31 +162,4 @@ in {
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ sshPort ];
|
||||
|
||||
systemd.services.gitea-dump = {
|
||||
serviceConfig.ExecStart = let
|
||||
args = lib.cli.toGNUCommandLineShell { } {
|
||||
type = cfg.dump.type;
|
||||
|
||||
# This should be declarative on nixos, no need to backup.
|
||||
skip-custom-dir = true;
|
||||
|
||||
# This can be regenerated, no need to backup
|
||||
skip-index = true;
|
||||
|
||||
# Logs are stored in the systemd journal
|
||||
skip-log = true;
|
||||
};
|
||||
in lib.mkForce "${lib.getExe cfg.package} ${args}";
|
||||
|
||||
# Only keep n backup files at a time
|
||||
postStop = let
|
||||
cu = prog: "'${lib.getExe' pkgs.coreutils prog}'";
|
||||
backupCount = 3;
|
||||
in ''
|
||||
for file in $(${cu "ls"} -t1 '${cfg.dump.backupDir}' | ${cu "sort"} --reverse | ${cu "tail"} -n+${toString (backupCount + 1)}); do
|
||||
${cu "rm"} "$file"
|
||||
done
|
||||
'';
|
||||
};
|
||||
}
|
||||
@@ -4,23 +4,9 @@ let
|
||||
GNUPGHOME = "${config.users.users.gitea.home}/gnupg";
|
||||
in
|
||||
{
|
||||
sops.secrets = {
|
||||
"gitea/gpg-signing-key-public" = {
|
||||
owner = cfg.user;
|
||||
inherit (cfg) group;
|
||||
restartUnits = [
|
||||
"gitea.service"
|
||||
"gitea-ensure-gnupg-homedir.service"
|
||||
];
|
||||
};
|
||||
"gitea/gpg-signing-key-private" = {
|
||||
owner = cfg.user;
|
||||
inherit (cfg) group;
|
||||
restartUnits = [
|
||||
"gitea.service"
|
||||
"gitea-ensure-gnupg-homedir.service"
|
||||
];
|
||||
};
|
||||
sops.secrets."gitea/gpg-signing-key" = {
|
||||
owner = cfg.user;
|
||||
inherit (cfg) group;
|
||||
};
|
||||
|
||||
systemd.services.gitea.environment = { inherit GNUPGHOME; };
|
||||
@@ -32,7 +18,6 @@ in
|
||||
|
||||
systemd.services.gitea-ensure-gnupg-homedir = {
|
||||
description = "Import gpg key for gitea";
|
||||
before = [ "gitea.service" ];
|
||||
environment = { inherit GNUPGHOME; };
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
@@ -40,8 +25,7 @@ in
|
||||
PrivateNetwork = true;
|
||||
};
|
||||
script = ''
|
||||
${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-public".path}
|
||||
${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-private".path}
|
||||
${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key".path}
|
||||
'';
|
||||
};
|
||||
|
||||
@@ -50,6 +34,5 @@ in
|
||||
SIGNING_NAME = "PVV Git";
|
||||
SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
|
||||
INITIAL_COMMIT = "always";
|
||||
WIKI = "always";
|
||||
};
|
||||
}
|
||||
@@ -11,8 +11,7 @@ in
|
||||
|
||||
systemd.services.gitea-import-users = lib.mkIf cfg.enable {
|
||||
enable = true;
|
||||
preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
|
||||
environment.PASSWD_FILE_PATH = "/run/gitea-import-users/passwd";
|
||||
preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /tmp/passwd-import'';
|
||||
serviceConfig = {
|
||||
ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
|
||||
flakeIgnore = [
|
||||
@@ -26,7 +25,6 @@ in
|
||||
];
|
||||
DynamicUser="yes";
|
||||
EnvironmentFile=config.sops.secrets."gitea/import-user-env".path;
|
||||
RuntimeDirectory = "gitea-import-users";
|
||||
};
|
||||
};
|
||||
|
||||
@@ -17,10 +17,6 @@ GITEA_API_URL = os.getenv('GITEA_API_URL')
|
||||
if GITEA_API_URL is None:
|
||||
GITEA_API_URL = 'https://git.pvv.ntnu.no/api/v1'
|
||||
|
||||
PASSWD_FILE_PATH = os.getenv('PASSWD_FILE_PATH')
|
||||
if PASSWD_FILE_PATH is None:
|
||||
PASSWD_FILE_PATH = '/tmp/passwd-import'
|
||||
|
||||
|
||||
def gitea_list_all_users() -> dict[str, dict[str, any]] | None:
|
||||
r = requests.get(
|
||||
@@ -191,8 +187,7 @@ def main():
|
||||
if existing_users is None:
|
||||
exit(1)
|
||||
|
||||
print(f"Reading passwd entries from {PASSWD_FILE_PATH}")
|
||||
for username, name in passwd_file_parser(PASSWD_FILE_PATH):
|
||||
for username, name in passwd_file_parser("/tmp/passwd-import"):
|
||||
print(f"Processing {username}")
|
||||
add_or_patch_gitea_user(username, name, existing_users)
|
||||
for org, team_name in COMMON_USER_TEAMS:
|
||||
|
Before Width: | Height: | Size: 1.1 MiB After Width: | Height: | Size: 1.1 MiB |
88
hosts/bekkalokk/services/kerberos/krb5-conf-format.nix
Normal file
88
hosts/bekkalokk/services/kerberos/krb5-conf-format.nix
Normal file
@@ -0,0 +1,88 @@
|
||||
{ pkgs, lib, ... }:
|
||||
|
||||
# Based on
|
||||
# - https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html
|
||||
# - https://manpages.debian.org/unstable/heimdal-docs/krb5.conf.5heimdal.en.html
|
||||
|
||||
let
|
||||
inherit (lib) boolToString concatMapStringsSep concatStringsSep filter
|
||||
isAttrs isBool isList mapAttrsToList mdDoc mkOption singleton splitString;
|
||||
inherit (lib.types) attrsOf bool coercedTo either int listOf oneOf path
|
||||
str submodule;
|
||||
in
|
||||
{ }: {
|
||||
type = let
|
||||
section = attrsOf relation;
|
||||
relation = either (attrsOf value) value;
|
||||
value = either (listOf atom) atom;
|
||||
atom = oneOf [int str bool];
|
||||
in submodule {
|
||||
freeformType = attrsOf section;
|
||||
options = {
|
||||
include = mkOption {
|
||||
default = [ ];
|
||||
description = mdDoc ''
|
||||
Files to include in the Kerberos configuration.
|
||||
'';
|
||||
type = coercedTo path singleton (listOf path);
|
||||
};
|
||||
includedir = mkOption {
|
||||
default = [ ];
|
||||
description = mdDoc ''
|
||||
Directories containing files to include in the Kerberos configuration.
|
||||
'';
|
||||
type = coercedTo path singleton (listOf path);
|
||||
};
|
||||
module = mkOption {
|
||||
default = [ ];
|
||||
description = mdDoc ''
|
||||
Modules to obtain Kerberos configuration from.
|
||||
'';
|
||||
type = coercedTo path singleton (listOf path);
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
generate = let
|
||||
indent = str: concatMapStringsSep "\n" (line: " " + line) (splitString "\n" str);
|
||||
|
||||
formatToplevel = args @ {
|
||||
include ? [ ],
|
||||
includedir ? [ ],
|
||||
module ? [ ],
|
||||
...
|
||||
}: let
|
||||
sections = removeAttrs args [ "include" "includedir" "module" ];
|
||||
in concatStringsSep "\n" (filter (x: x != "") [
|
||||
(concatStringsSep "\n" (mapAttrsToList formatSection sections))
|
||||
(concatMapStringsSep "\n" (m: "module ${m}") module)
|
||||
(concatMapStringsSep "\n" (i: "include ${i}") include)
|
||||
(concatMapStringsSep "\n" (i: "includedir ${i}") includedir)
|
||||
]);
|
||||
|
||||
formatSection = name: section: ''
|
||||
[${name}]
|
||||
${indent (concatStringsSep "\n" (mapAttrsToList formatRelation section))}
|
||||
'';
|
||||
|
||||
formatRelation = name: relation:
|
||||
if isAttrs relation
|
||||
then ''
|
||||
${name} = {
|
||||
${indent (concatStringsSep "\n" (mapAttrsToList formatValue relation))}
|
||||
}''
|
||||
else formatValue name relation;
|
||||
|
||||
formatValue = name: value:
|
||||
if isList value
|
||||
then concatMapStringsSep "\n" (formatAtom name) value
|
||||
else formatAtom name value;
|
||||
|
||||
formatAtom = name: atom: let
|
||||
v = if isBool atom then boolToString atom else toString atom;
|
||||
in "${name} = ${v}";
|
||||
in
|
||||
name: value: pkgs.writeText name ''
|
||||
${formatToplevel value}
|
||||
'';
|
||||
}
|
||||
90
hosts/bekkalokk/services/kerberos/krb5.nix
Normal file
90
hosts/bekkalokk/services/kerberos/krb5.nix
Normal file
@@ -0,0 +1,90 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
inherit (lib) mdDoc mkIf mkOption mkPackageOption mkRemovedOptionModule;
|
||||
inherit (lib.types) bool;
|
||||
|
||||
mkRemovedOptionModule' = name: reason: mkRemovedOptionModule ["krb5" name] reason;
|
||||
mkRemovedOptionModuleCfg = name: mkRemovedOptionModule' name ''
|
||||
The option `krb5.${name}' has been removed. Use
|
||||
`security.krb5.settings.${name}' for structured configuration.
|
||||
'';
|
||||
|
||||
cfg = config.security.krb5;
|
||||
format = import ./krb5-conf-format.nix { inherit pkgs lib; } { };
|
||||
in {
|
||||
imports = [
|
||||
(mkRemovedOptionModuleCfg "libdefaults")
|
||||
(mkRemovedOptionModuleCfg "realms")
|
||||
(mkRemovedOptionModuleCfg "domain_realm")
|
||||
(mkRemovedOptionModuleCfg "capaths")
|
||||
(mkRemovedOptionModuleCfg "appdefaults")
|
||||
(mkRemovedOptionModuleCfg "plugins")
|
||||
(mkRemovedOptionModuleCfg "config")
|
||||
(mkRemovedOptionModuleCfg "extraConfig")
|
||||
(mkRemovedOptionModule' "kerberos" ''
|
||||
The option `krb5.kerberos' has been moved to `security.krb5.package'.
|
||||
'')
|
||||
];
|
||||
|
||||
options = {
|
||||
security.krb5 = {
|
||||
enable = mkOption {
|
||||
default = false;
|
||||
description = mdDoc "Enable and configure Kerberos utilities";
|
||||
type = bool;
|
||||
};
|
||||
|
||||
package = mkPackageOption pkgs "krb5" {
|
||||
example = "heimdal";
|
||||
};
|
||||
|
||||
settings = mkOption {
|
||||
default = { };
|
||||
type = format.type;
|
||||
description = mdDoc ''
|
||||
Structured contents of the {file}`krb5.conf` file. See
|
||||
{manpage}`krb5.conf(5)` for details about configuration.
|
||||
'';
|
||||
example = {
|
||||
include = [ "/run/secrets/secret-krb5.conf" ];
|
||||
includedir = [ "/run/secrets/secret-krb5.conf.d" ];
|
||||
|
||||
libdefaults = {
|
||||
default_realm = "ATHENA.MIT.EDU";
|
||||
};
|
||||
|
||||
realms = {
|
||||
"ATHENA.MIT.EDU" = {
|
||||
admin_server = "athena.mit.edu";
|
||||
kdc = [
|
||||
"athena01.mit.edu"
|
||||
"athena02.mit.edu"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
domain_realm = {
|
||||
"mit.edu" = "ATHENA.MIT.EDU";
|
||||
};
|
||||
|
||||
logging = {
|
||||
kdc = "SYSLOG:NOTICE";
|
||||
admin_server = "SYSLOG:NOTICE";
|
||||
default = "SYSLOG:NOTICE";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
environment = {
|
||||
systemPackages = [ cfg.package ];
|
||||
etc."krb5.conf".source = format.generate "krb5.conf" cfg.settings;
|
||||
};
|
||||
};
|
||||
|
||||
meta.maintainers = builtins.attrValues {
|
||||
inherit (lib.maintainers) dblsaiko h7x4;
|
||||
};
|
||||
}
|
||||
1543
hosts/bekkalokk/services/kerberos/pam.nix
Normal file
1543
hosts/bekkalokk/services/kerberos/pam.nix
Normal file
File diff suppressed because it is too large
Load Diff
@@ -61,6 +61,7 @@ in {
|
||||
user = "mediawiki";
|
||||
passwordFile = config.sops.secrets."mediawiki/postgres_password".path;
|
||||
createLocally = false;
|
||||
# TODO: create a normal database and copy over old data when the service is production ready
|
||||
name = "mediawiki";
|
||||
};
|
||||
|
||||
@@ -130,12 +131,6 @@ in {
|
||||
$wgVectorDefaultSidebarVisibleForAnonymousUser = true;
|
||||
$wgVectorResponsive = true;
|
||||
|
||||
# Experimental dark mode support for Vector 2022
|
||||
$wgVectorNightMode['beta'] = true;
|
||||
$wgVectorNightMode['logged_out'] = true;
|
||||
$wgVectorNightMode['logged_in'] = true;
|
||||
$wgDefaultUserOptions['vector-theme'] = 'os';
|
||||
|
||||
# Misc
|
||||
$wgEmergencyContact = "${cfg.passwordSender}";
|
||||
$wgUseTeX = false;
|
||||
@@ -220,11 +215,11 @@ in {
|
||||
"= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
|
||||
buildInputs = with pkgs; [ imagemagick ];
|
||||
} ''
|
||||
magick \
|
||||
${fp /assets/logo_blue_regular.png} \
|
||||
convert \
|
||||
-resize x64 \
|
||||
-gravity center \
|
||||
-crop 64x64+0+0 \
|
||||
${fp /assets/logo_blue_regular.png} \
|
||||
-flatten \
|
||||
-colors 256 \
|
||||
-background transparent \
|
||||
|
||||
@@ -18,16 +18,11 @@ in {
|
||||
restartUnits = [ "phpfpm-pvv-nettsiden.service" ];
|
||||
});
|
||||
|
||||
security.acme.certs."www.pvv.ntnu.no" = {
|
||||
extraDomainNames = [
|
||||
"pvv.ntnu.no"
|
||||
"www.pvv.org"
|
||||
"pvv.org"
|
||||
];
|
||||
};
|
||||
|
||||
services.idp.sp-remote-metadata = [
|
||||
"https://www.pvv.ntnu.no/simplesaml/"
|
||||
"https://pvv.ntnu.no/simplesaml/"
|
||||
"https://www.pvv.org/simplesaml/"
|
||||
"https://pvv.org/simplesaml/"
|
||||
];
|
||||
|
||||
services.pvv-nettsiden = {
|
||||
@@ -72,9 +67,7 @@ in {
|
||||
ADMIN_NAME = "PVV Drift";
|
||||
ADMIN_EMAIL = "drift@pvv.ntnu.no";
|
||||
ADMIN_PASSWORD = includeFromSops "simplesamlphp/admin_password";
|
||||
TRUSTED_DOMAINS = [
|
||||
"www.pvv.ntnu.no"
|
||||
];
|
||||
TRUSTED_DOMAINS = [ cfg.domainName ];
|
||||
};
|
||||
};
|
||||
};
|
||||
@@ -85,28 +78,13 @@ in {
|
||||
"catch_workers_output" = true;
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."pvv.ntnu.no" = {
|
||||
globalRedirect = cfg.domainName;
|
||||
redirectCode = 307;
|
||||
forceSSL = true;
|
||||
useACMEHost = "www.pvv.ntnu.no";
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."www.pvv.org" = {
|
||||
globalRedirect = cfg.domainName;
|
||||
redirectCode = 307;
|
||||
forceSSL = true;
|
||||
useACMEHost = "www.pvv.ntnu.no";
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."pvv.org" = {
|
||||
globalRedirect = cfg.domainName;
|
||||
redirectCode = 307;
|
||||
forceSSL = true;
|
||||
useACMEHost = "www.pvv.ntnu.no";
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts.${cfg.domainName} = {
|
||||
serverAliases = [
|
||||
"pvv.ntnu.no"
|
||||
"www.pvv.org"
|
||||
"pvv.org"
|
||||
];
|
||||
|
||||
locations = {
|
||||
# Proxy home directories
|
||||
"^~ /~" = {
|
||||
|
||||
@@ -53,7 +53,7 @@ in {
|
||||
|
||||
echo "Creating thumbnail for $fname"
|
||||
mkdir -p $(dirname ".thumbnails/$fname")
|
||||
magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
|
||||
convert -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
|
||||
touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
|
||||
done <<< "$images"
|
||||
'';
|
||||
|
||||
@@ -4,13 +4,13 @@
|
||||
./hardware-configuration.nix
|
||||
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
./services/nginx
|
||||
|
||||
./services/calendar-bot.nix
|
||||
#./services/git-mirrors
|
||||
./services/minecraft-heatmap.nix
|
||||
./services/mysql.nix
|
||||
./services/postgres.nix
|
||||
./services/mysql.nix
|
||||
./services/calendar-bot.nix
|
||||
|
||||
./services/matrix
|
||||
];
|
||||
@@ -20,15 +20,13 @@
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.device = "/dev/disk/by-id/scsi-3600508b1001cb1a8751c137b30610682";
|
||||
|
||||
networking.hostName = "bicep";
|
||||
|
||||
#systemd.network.networks."30-enp6s0f0" = values.defaultNetworkConfig // {
|
||||
systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
|
||||
#matchConfig.Name = "enp6s0f0";
|
||||
matchConfig.Name = "ens18";
|
||||
systemd.network.networks."30-enp6s0f0" = values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "enp6s0f0";
|
||||
address = with values.hosts.bicep; [ (ipv4 + "/25") (ipv6 + "/64") ]
|
||||
++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
|
||||
};
|
||||
@@ -39,13 +37,6 @@
|
||||
# There are no smart devices
|
||||
services.smartd.enable = false;
|
||||
|
||||
# we are a vm now
|
||||
services.qemuGuest.enable = true;
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh.enable = true;
|
||||
services.sshguard.enable = true;
|
||||
|
||||
# Do not change, even during upgrades.
|
||||
# See https://search.nixos.org/options?show=system.stateVersion
|
||||
system.stateVersion = "22.11";
|
||||
|
||||
@@ -5,29 +5,22 @@
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ahci" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "hpsa" "ohci_pci" "usbhid" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/20e06202-7a09-47cc-8ef6-5e7afe19453a";
|
||||
{ device = "/dev/disk/by-uuid/31a67903-dc00-448a-a24a-36e820318fe5";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
# temp data disk, only 128gb not enough until we can add another disk to the system.
|
||||
fileSystems."/data" =
|
||||
{ device = "/dev/disk/by-uuid/c81af266-0781-4084-b8eb-c2587cbcf1ba";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/198B-E363";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
{ device = "/dev/disk/by-uuid/79e93eed-ad95-45c9-b115-4ef92afcc8c0";
|
||||
fsType = "f2fs";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
@@ -37,7 +30,11 @@
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp6s0f0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp6s0f1.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp6s0f2.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp6s0f3.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
||||
@@ -1,100 +0,0 @@
|
||||
{ config, pkgs, lib, fp, ... }:
|
||||
let
|
||||
cfg = config.services.gickup;
|
||||
in
|
||||
{
|
||||
sops.secrets."gickup/github-token" = {
|
||||
owner = "gickup";
|
||||
};
|
||||
|
||||
services.gickup = {
|
||||
enable = true;
|
||||
|
||||
dataDir = "/data/gickup";
|
||||
|
||||
destinationSettings = {
|
||||
structured = true;
|
||||
zip = false;
|
||||
keep = 10;
|
||||
bare = true;
|
||||
lfs = false;
|
||||
};
|
||||
|
||||
instances = let
|
||||
defaultGithubConfig = {
|
||||
settings.token_file = config.sops.secrets."gickup/github-token".path;
|
||||
};
|
||||
defaultGitlabConfig = {
|
||||
# settings.token_file = ...
|
||||
};
|
||||
in {
|
||||
"github:Git-Mediawiki/Git-Mediawiki" = defaultGithubConfig;
|
||||
"github:NixOS/nixpkgs" = defaultGithubConfig;
|
||||
"github:go-gitea/gitea" = defaultGithubConfig;
|
||||
"github:heimdal/heimdal" = defaultGithubConfig;
|
||||
"github:saltstack/salt" = defaultGithubConfig;
|
||||
"github:typst/typst" = defaultGithubConfig;
|
||||
"github:unmojang/FjordLauncher" = defaultGithubConfig;
|
||||
"github:unmojang/drasl" = defaultGithubConfig;
|
||||
"github:yushijinhun/authlib-injector" = defaultGithubConfig;
|
||||
|
||||
"gitlab:mx-puppet/discord/better-discord.js" = defaultGitlabConfig;
|
||||
"gitlab:mx-puppet/discord/discord-markdown" = defaultGitlabConfig;
|
||||
"gitlab:mx-puppet/discord/matrix-discord-parser" = defaultGitlabConfig;
|
||||
"gitlab:mx-puppet/discord/mx-puppet-discord" = defaultGitlabConfig;
|
||||
"gitlab:mx-puppet/mx-puppet-bridge" = defaultGitlabConfig;
|
||||
|
||||
"any:glibc" = {
|
||||
settings.url = "https://sourceware.org/git/glibc.git";
|
||||
};
|
||||
|
||||
"any:out-of-your-element" = {
|
||||
settings.url = "https://gitdab.com/cadence/out-of-your-element.git";
|
||||
};
|
||||
|
||||
"any:out-of-your-element-module" = {
|
||||
settings.url = "https://cgit.rory.gay/nix/OOYE-module.git";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.cgit = let
|
||||
domain = "mirrors.pvv.ntnu.no";
|
||||
in {
|
||||
${domain} = {
|
||||
enable = true;
|
||||
package = pkgs.callPackage (fp /packages/cgit.nix) { };
|
||||
group = "gickup";
|
||||
scanPath = "${cfg.dataDir}/linktree";
|
||||
settings = {
|
||||
enable-commit-graph = true;
|
||||
enable-follow-links = true;
|
||||
enable-http-clone = true;
|
||||
enable-remote-branches = true;
|
||||
clone-url = "https://${domain}/$CGIT_REPO_URL";
|
||||
remove-suffix = true;
|
||||
root-title = "PVVSPPP";
|
||||
root-desc = "PVV Speiler Praktisk og Prominent Programvare";
|
||||
snapshots = "all";
|
||||
logo = "/PVV-logo.png";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."mirrors.pvv.ntnu.no" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
|
||||
locations."= /PVV-logo.png".alias = let
|
||||
small-pvv-logo = pkgs.runCommandLocal "pvv-logo-96x96" {
|
||||
nativeBuildInputs = [ pkgs.imagemagick ];
|
||||
} ''
|
||||
magick '${fp /assets/logo_blue_regular.svg}' -resize 96x96 PNG:"$out"
|
||||
'';
|
||||
in toString small-pvv-logo;
|
||||
};
|
||||
|
||||
systemd.services."fcgiwrap-cgit-mirrors.pvv.ntnu.no" = {
|
||||
serviceConfig.BindReadOnlyPaths = [ cfg.dataDir ];
|
||||
};
|
||||
}
|
||||
@@ -6,14 +6,12 @@
|
||||
key = "synapse/turnconfig";
|
||||
owner = config.users.users.matrix-synapse.name;
|
||||
group = config.users.users.matrix-synapse.group;
|
||||
restartUnits = [ "coturn.service" ];
|
||||
};
|
||||
sops.secrets."matrix/coturn/static-auth-secret" = {
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "coturn/static-auth-secret";
|
||||
owner = config.users.users.turnserver.name;
|
||||
group = config.users.users.turnserver.group;
|
||||
restartUnits = [ "coturn.service" ];
|
||||
};
|
||||
|
||||
services.matrix-synapse-next = {
|
||||
@@ -44,7 +42,7 @@
|
||||
|
||||
security.acme.certs.${config.services.coturn.realm} = {
|
||||
email = "drift@pvv.ntnu.no";
|
||||
listenHTTP = "${values.services.turn.ipv4}:80";
|
||||
listenHTTP = "129.241.210.213:80";
|
||||
reloadServices = [ "coturn.service" ];
|
||||
};
|
||||
|
||||
|
||||
@@ -9,8 +9,7 @@
|
||||
./coturn.nix
|
||||
./mjolnir.nix
|
||||
|
||||
# ./discord.nix
|
||||
./out-of-your-element.nix
|
||||
./discord.nix
|
||||
./hookshot
|
||||
];
|
||||
|
||||
|
||||
@@ -45,7 +45,7 @@ in
|
||||
};
|
||||
|
||||
|
||||
services.mx-puppet-discord.enable = false;
|
||||
services.mx-puppet-discord.enable = true;
|
||||
services.mx-puppet-discord.settings = {
|
||||
bridge = {
|
||||
bindAddress = "localhost";
|
||||
|
||||
@@ -18,7 +18,6 @@ in
|
||||
sops.templates."hookshot-registration.yaml" = {
|
||||
owner = config.users.users.matrix-synapse.name;
|
||||
group = config.users.groups.keys-matrix-registrations.name;
|
||||
restartUnits = [ "matrix-hookshot.service" ];
|
||||
content = ''
|
||||
id: matrix-hookshot
|
||||
as_token: "${config.sops.placeholder."matrix/hookshot/as_token"}"
|
||||
@@ -78,7 +77,7 @@ in
|
||||
outbound = true;
|
||||
urlPrefix = "https://hookshot.pvv.ntnu.no/webhook/";
|
||||
userIdPrefix = "_webhooks_";
|
||||
allowJsTransformationFunctions = true;
|
||||
allowJsTransformationFunctions = false;
|
||||
waitForComplete = false;
|
||||
};
|
||||
feeds = {
|
||||
@@ -95,11 +94,6 @@ in
|
||||
}
|
||||
];
|
||||
|
||||
widgets = {
|
||||
roomSetupWidget.addOnInvite = false;
|
||||
publicUrl = "https://hookshot.pvv.ntnu.no/widgetapi/v1/static";
|
||||
};
|
||||
|
||||
permissions = [
|
||||
# Users of the PVV Server
|
||||
{ actor = "pvv.ntnu.no";
|
||||
@@ -134,7 +128,6 @@ in
|
||||
|
||||
services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
|
||||
enableACME = true;
|
||||
addSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://${webhookListenAddress}:${toString webhookListenPort}";
|
||||
};
|
||||
|
||||
@@ -6,7 +6,6 @@
|
||||
key = "mjolnir/access_token";
|
||||
owner = config.users.users.mjolnir.name;
|
||||
group = config.users.users.mjolnir.group;
|
||||
restartUnits = [ "mjolnir.service" ];
|
||||
};
|
||||
|
||||
services.mjolnir = {
|
||||
|
||||
@@ -1,70 +0,0 @@
|
||||
{ config, pkgs, fp, ... }:
|
||||
let
|
||||
cfg = config.services.matrix-ooye;
|
||||
in
|
||||
{
|
||||
users.groups.keys-matrix-registrations = { };
|
||||
|
||||
sops.secrets = {
|
||||
"matrix/ooye/as_token" = {
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "ooye/as_token";
|
||||
restartUnits = [ "matrix-ooye.service" ];
|
||||
};
|
||||
"matrix/ooye/hs_token" = {
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "ooye/hs_token";
|
||||
restartUnits = [ "matrix-ooye.service" ];
|
||||
};
|
||||
"matrix/ooye/discord_token" = {
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "ooye/discord_token";
|
||||
restartUnits = [ "matrix-ooye.service" ];
|
||||
};
|
||||
"matrix/ooye/discord_client_secret" = {
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "ooye/discord_client_secret";
|
||||
restartUnits = [ "matrix-ooye.service" ];
|
||||
};
|
||||
};
|
||||
|
||||
services.matrix-ooye = {
|
||||
enable = true;
|
||||
homeserver = "https://matrix.pvv.ntnu.no";
|
||||
homeserverName = "pvv.ntnu.no";
|
||||
discordTokenPath = config.sops.secrets."matrix/ooye/discord_token".path;
|
||||
discordClientSecretPath = config.sops.secrets."matrix/ooye/discord_client_secret".path;
|
||||
bridgeOrigin = "https://ooye.pvv.ntnu.no";
|
||||
|
||||
enableSynapseIntegration = false;
|
||||
};
|
||||
|
||||
systemd.services."matrix-synapse" = {
|
||||
after = [
|
||||
"matrix-ooye-pre-start.service"
|
||||
"network-online.target"
|
||||
];
|
||||
requires = [ "matrix-ooye-pre-start.service" ];
|
||||
serviceConfig = {
|
||||
LoadCredential = [
|
||||
"matrix-ooye-registration:/var/lib/matrix-ooye/registration.yaml"
|
||||
];
|
||||
ExecStartPre = [
|
||||
"+${pkgs.coreutils}/bin/cp /run/credentials/matrix-synapse.service/matrix-ooye-registration ${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
|
||||
"+${pkgs.coreutils}/bin/chown matrix-synapse:keys-matrix-registrations ${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services.matrix-synapse-next.settings = {
|
||||
app_service_config_files = [
|
||||
"${config.services.matrix-synapse-next.dataDir}/ooye-registration.yaml"
|
||||
];
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."ooye.pvv.ntnu.no" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/".proxyPass = "http://localhost:${cfg.socket}";
|
||||
};
|
||||
}
|
||||
@@ -1,4 +1,4 @@
|
||||
{ lib, buildPythonPackage, fetchFromGitHub, setuptools }:
|
||||
{ lib, buildPythonPackage, fetchFromGitHub }:
|
||||
|
||||
buildPythonPackage rec {
|
||||
pname = "matrix-synapse-smtp-auth";
|
||||
@@ -6,9 +6,6 @@ buildPythonPackage rec {
|
||||
|
||||
src = ./.;
|
||||
|
||||
pyproject = true;
|
||||
build-system = [ setuptools ];
|
||||
|
||||
doCheck = false;
|
||||
|
||||
meta = with lib; {
|
||||
|
||||
@@ -124,8 +124,8 @@ in {
|
||||
"fec0::/10"
|
||||
|
||||
# NTNU
|
||||
values.ntnu.ipv4-space
|
||||
values.ntnu.ipv6-space
|
||||
"129.241.0.0/16"
|
||||
"2001:700:300::/44"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
@@ -1,49 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.minecraft-heatmap;
|
||||
in
|
||||
{
|
||||
sops.secrets."minecraft-heatmap/ssh-key/private" = {
|
||||
mode = "600";
|
||||
};
|
||||
|
||||
sops.secrets."minecraft-heatmap/postgres-passwd" = {
|
||||
mode = "600";
|
||||
};
|
||||
|
||||
services.minecraft-heatmap = {
|
||||
enable = true;
|
||||
database = {
|
||||
host = "postgres.pvv.ntnu.no";
|
||||
port = 5432;
|
||||
name = "minecraft_heatmap";
|
||||
user = "minecraft_heatmap";
|
||||
passwordFile = config.sops.secrets."minecraft-heatmap/postgres-passwd".path;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.minecraft-heatmap-ingest-logs = {
|
||||
serviceConfig.LoadCredential = [
|
||||
"sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
|
||||
];
|
||||
|
||||
preStart = let
|
||||
knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
|
||||
innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
|
||||
innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
|
||||
innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
|
||||
'';
|
||||
in ''
|
||||
mkdir -p '${cfg.minecraftLogsDir}'
|
||||
"${lib.getExe pkgs.rsync}" \
|
||||
--archive \
|
||||
--verbose \
|
||||
--progress \
|
||||
--no-owner \
|
||||
--no-group \
|
||||
--rsh="${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=\"${knownHostsFile}\" -i \"$CREDENTIALS_DIRECTORY\"/sshkey" \
|
||||
root@innovation.pvv.ntnu.no:/ \
|
||||
'${cfg.minecraftLogsDir}'/
|
||||
'';
|
||||
};
|
||||
}
|
||||
@@ -48,8 +48,6 @@
|
||||
IPAddressAllow = [
|
||||
values.ipv4-space
|
||||
values.ipv6-space
|
||||
values.hosts.ildkule.ipv4
|
||||
values.hosts.ildkule.ipv6
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,15 +1,15 @@
|
||||
{ config, pkgs, values, ... }:
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_15;
|
||||
enableTCPIP = true;
|
||||
|
||||
dataDir = "/data/postgresql";
|
||||
|
||||
authentication = ''
|
||||
host all all ${values.ipv4-space} md5
|
||||
host all all ${values.ipv6-space} md5
|
||||
host all all ${values.hosts.ildkule.ipv4}/32 md5
|
||||
host all all ${values.hosts.ildkule.ipv6}/32 md5
|
||||
host all all 129.241.210.128/25 md5
|
||||
host all all 2001:700:300:1900::/64 md5
|
||||
'';
|
||||
|
||||
# Hilsen https://pgconfigurator.cybertec-postgresql.com/
|
||||
@@ -74,40 +74,11 @@
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.settings."10-postgresql"."/data/postgresql".d = {
|
||||
user = config.systemd.services.postgresql.serviceConfig.User;
|
||||
group = config.systemd.services.postgresql.serviceConfig.Group;
|
||||
mode = "0700";
|
||||
};
|
||||
|
||||
systemd.services.postgresql-setup = {
|
||||
after = [
|
||||
"systemd-tmpfiles-setup.service"
|
||||
"systemd-tmpfiles-resetup.service"
|
||||
systemd.services.postgresql.serviceConfig = {
|
||||
LoadCredential = [
|
||||
"cert:/etc/certs/postgres.crt"
|
||||
"key:/etc/certs/postgres.key"
|
||||
];
|
||||
serviceConfig = {
|
||||
LoadCredential = [
|
||||
"cert:/etc/certs/postgres.crt"
|
||||
"key:/etc/certs/postgres.key"
|
||||
];
|
||||
|
||||
BindPaths = [ "/data/postgresql:/var/lib/postgresql" ];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.postgresql = {
|
||||
after = [
|
||||
"systemd-tmpfiles-setup.service"
|
||||
"systemd-tmpfiles-resetup.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
LoadCredential = [
|
||||
"cert:/etc/certs/postgres.crt"
|
||||
"key:/etc/certs/postgres.key"
|
||||
];
|
||||
|
||||
BindPaths = [ "/data/postgresql:/var/lib/postgresql" ];
|
||||
};
|
||||
};
|
||||
|
||||
environment.snakeoil-certs."/etc/certs/postgres" = {
|
||||
|
||||
46
hosts/bob/configuration.nix
Normal file
46
hosts/bob/configuration.nix
Normal file
@@ -0,0 +1,46 @@
|
||||
{ config, fp, pkgs, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
./disks.nix
|
||||
|
||||
(fp /misc/builder.nix)
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = fp /secrets/bob/bob.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
efiSupport = true;
|
||||
efiInstallAsRemovable = true;
|
||||
};
|
||||
|
||||
networking.hostName = "bob"; # Define your hostname.
|
||||
|
||||
systemd.network.networks."30-all" = values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "en*";
|
||||
DHCP = "yes";
|
||||
gateway = [ ];
|
||||
};
|
||||
|
||||
# List packages installed in system profile
|
||||
environment.systemPackages = with pkgs; [
|
||||
];
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "23.05"; # Did you read the comment?
|
||||
|
||||
}
|
||||
39
hosts/bob/disks.nix
Normal file
39
hosts/bob/disks.nix
Normal file
@@ -0,0 +1,39 @@
|
||||
# Example to create a bios compatible gpt partition
|
||||
{ lib, ... }:
|
||||
{
|
||||
disko.devices = {
|
||||
disk.disk1 = {
|
||||
device = lib.mkDefault "/dev/sda";
|
||||
type = "disk";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
boot = {
|
||||
name = "boot";
|
||||
size = "1M";
|
||||
type = "EF02";
|
||||
};
|
||||
esp = {
|
||||
name = "ESP";
|
||||
size = "500M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
};
|
||||
};
|
||||
root = {
|
||||
name = "root";
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -5,30 +5,20 @@
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_blk" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/c7bbb293-a0a3-4995-8892-0ec63e8c67dd";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/a86ffda8-8ecb-42a1-bf9f-926072e90ca5"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.ens3.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -4,6 +4,7 @@
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
|
||||
./services/grzegorz.nix
|
||||
];
|
||||
|
||||
78
hosts/dagali/TODO.md
Normal file
78
hosts/dagali/TODO.md
Normal file
@@ -0,0 +1,78 @@
|
||||
# Tracking document for new PVV kerberos auth stack
|
||||
|
||||
|
||||
|
||||
<div align="center">
|
||||
Bensinstasjon på heimdal
|
||||
</div>
|
||||
|
||||
### TODO:
|
||||
|
||||
- [ ] setup heimdal
|
||||
- [x] ensure running with systemd
|
||||
- [x] compile smbk5pwd (part of openldap)
|
||||
- [ ] set `modify -a -disallow-all-tix,requires-pre-auth default` declaratively
|
||||
- [ ] fully initialize PVV.NTNU.NO
|
||||
- [x] `kadmin -l init PVV.NTNU.NO`
|
||||
- [x] add oysteikt/admin@PVV.NTNU.NO principal
|
||||
- [x] add oysteikt@PVV.NTNU.NO principal
|
||||
- [x] add krbtgt/PVV.NTNU.NO@PVV.NTNU.NO principal?
|
||||
- why is this needed, and where is it documented?
|
||||
- `kadmin check` seems to work under sudo?
|
||||
- (it is included by default, just included as error message
|
||||
in a weird state)
|
||||
|
||||
- [x] Ensure client is working correctly
|
||||
- [x] Ensure kinit works on darbu
|
||||
- [x] Ensure kpasswd works on darbu
|
||||
- [x] Ensure kadmin get <user> (and other restricted commands) works on darbu
|
||||
|
||||
- [ ] Ensure kdc is working correctly
|
||||
- [x] Ensure kinit works on dagali
|
||||
- [x] Ensure kpasswd works on dagali
|
||||
- [ ] Ensure kadmin get <user> (and other restricte commands) works on dagali
|
||||
|
||||
- [x] Fix FQDN
|
||||
- https://github.com/NixOS/nixpkgs/issues/94011
|
||||
- https://github.com/NixOS/nixpkgs/issues/261269
|
||||
- Possibly fixed by disabling systemd-resolved
|
||||
|
||||
- [ ] setup cyrus sasl
|
||||
- [x] ensure running with systemd
|
||||
- [x] verify GSSAPI support plugin is installed
|
||||
- `nix-shell -p cyrus_sasl --command pluginviewer`
|
||||
- [x] create "host/localhost@PVV.NTNU.NO" and export to keytab
|
||||
- [x] verify cyrus sasl is able to talk to heimdal
|
||||
- `sudo testsaslauthd -u oysteikt -p <password>`
|
||||
- [ ] provide ldap principal to cyrus sasl through keytab
|
||||
|
||||
- [ ] setup openldap
|
||||
- [x] ensure running with systemd
|
||||
- [ ] verify openldap is able to talk to cyrus sasl
|
||||
- [ ] create user for oysteikt in openldap
|
||||
- [ ] authenticate openldap login through sasl
|
||||
- does this require creating an ldap user?
|
||||
|
||||
- [ ] fix smbk5pwd integration
|
||||
- [x] add smbk5pwd schemas to openldap
|
||||
- [x] create openldap db for smbk5pwd with overlays
|
||||
- [ ] test to ensure that user sync is working
|
||||
- [ ] test as user source (replace passwd)
|
||||
- [ ] test as PAM auth source
|
||||
- [ ] test as auth source for 3rd party appliation
|
||||
|
||||
- [ ] Set up ldap administration panel
|
||||
- Doesn't seem like there are many good ones out there. Maybe phpLDAPAdmin?
|
||||
|
||||
- [ ] Set up kerberos SRV DNS entry
|
||||
|
||||
### Information and URLS
|
||||
|
||||
- OpenLDAP SASL: https://www.openldap.org/doc/admin24/sasl.html
|
||||
- Use a keytab: https://kb.iu.edu/d/aumh
|
||||
- 2 ways for openldap to auth: https://security.stackexchange.com/questions/65093/how-to-test-ldap-that-authenticates-with-kerberos
|
||||
- Cyrus guide OpenLDAP + SASL + GSSAPI: https://www.cyrusimap.org/sasl/sasl/faqs/openldap-sasl-gssapi.html
|
||||
- Configuring GSSAPI and Cyrus SASL: https://web.mit.edu/darwin/src/modules/passwordserver_sasl/cyrus_sasl/doc/gssapi.html
|
||||
- PVV Kerberos docs: https://wiki.pvv.ntnu.no/wiki/Drift/Kerberos
|
||||
- OpenLDAP smbk5pwd source: https://git.openldap.org/nivanova/openldap/-/tree/master/contrib/slapd-modules/smbk5pwd
|
||||
- saslauthd(8): https://linux.die.net/man/8/saslauthd
|
||||
51
hosts/dagali/configuration.nix
Normal file
51
hosts/dagali/configuration.nix
Normal file
@@ -0,0 +1,51 @@
|
||||
|
||||
{ config, pkgs, values, lib, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
../../base.nix
|
||||
../../misc/metrics-exporters.nix
|
||||
|
||||
./services/heimdal.nix
|
||||
#./services/openldap.nix
|
||||
./services/cyrus-sasl.nix
|
||||
];
|
||||
|
||||
# buskerud does not support efi?
|
||||
# boot.loader.systemd-boot.enable = true;
|
||||
# boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
|
||||
# resolved messes up FQDN coming from nscd
|
||||
services.resolved.enable = false;
|
||||
|
||||
networking.hostName = "dagali";
|
||||
networking.domain = lib.mkForce "pvv.local";
|
||||
networking.hosts = {
|
||||
"129.241.210.185" = [ "dagali.pvv.local" ];
|
||||
};
|
||||
#networking.search = [ "pvv.ntnu.no" "pvv.org" ];
|
||||
networking.nameservers = [ "129.241.0.200" "129.241.0.201" ];
|
||||
networking.tempAddresses = "disabled";
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
systemd.network.networks."ens18" = values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "ens18";
|
||||
address = with values.hosts.dagali; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||
};
|
||||
|
||||
# List packages installed in system profile
|
||||
environment.systemPackages = with pkgs; [
|
||||
# TODO: consider adding to base.nix
|
||||
nix-output-monitor
|
||||
];
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "24.05"; # Did you read the comment?
|
||||
}
|
||||
@@ -14,18 +14,12 @@
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/d421538f-a260-44ae-8e03-47cac369dcc1";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/86CD-4C23";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0077" "dmask=0077" ];
|
||||
{ device = "/dev/disk/by-uuid/4de345e2-be41-4d10-9b90-823b2c77e9b3";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/4cfbb41e-801f-40dd-8c58-0a0c1a6025f6"; }
|
||||
[ { device = "/dev/disk/by-uuid/aa4b9a97-a7d8-4608-9f67-4ad084f1baf7"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
21
hosts/dagali/services/cyrus-sasl.nix
Normal file
21
hosts/dagali/services/cyrus-sasl.nix
Normal file
@@ -0,0 +1,21 @@
|
||||
{ config, ... }:
|
||||
let
|
||||
cfg = config.services.saslauthd;
|
||||
in
|
||||
{
|
||||
# TODO: This is seemingly required for openldap to authenticate
|
||||
# against kerberos, but I have no idea how to configure it as
|
||||
# such. Does it need a keytab? There's a binary "testsaslauthd"
|
||||
# that follows with `pkgs.cyrus_sasl` that might be useful.
|
||||
services.saslauthd = {
|
||||
enable = true;
|
||||
mechanism = "kerberos5";
|
||||
config = ''
|
||||
mech_list: gs2-krb5 gssapi
|
||||
keytab: /etc/krb5.keytab
|
||||
'';
|
||||
};
|
||||
|
||||
# TODO: maybe the upstream module should consider doing this?
|
||||
environment.systemPackages = [ cfg.package ];
|
||||
}
|
||||
100
hosts/dagali/services/heimdal.nix
Normal file
100
hosts/dagali/services/heimdal.nix
Normal file
@@ -0,0 +1,100 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
realm = "PVV.LOCAL";
|
||||
cfg = config.security.krb5;
|
||||
in
|
||||
{
|
||||
security.krb5 = {
|
||||
enable = true;
|
||||
|
||||
# NOTE: This is required in order to build smbk5pwd, because of some nested includes.
|
||||
# We should open an issue upstream (heimdal, not nixpkgs), but this patch
|
||||
# will do for now.
|
||||
package = pkgs.heimdal.overrideAttrs (prev: {
|
||||
postInstall = prev.postInstall + ''
|
||||
cp include/heim_threads.h $dev/include
|
||||
'';
|
||||
});
|
||||
|
||||
settings = {
|
||||
realms.${realm} = {
|
||||
kdc = [ "dagali.${lib.toLower realm}" ];
|
||||
admin_server = "dagali.${lib.toLower realm}";
|
||||
kpasswd_server = "dagali.${lib.toLower realm}";
|
||||
default_domain = lib.toLower realm;
|
||||
primary_kdc = "dagali.${lib.toLower realm}";
|
||||
};
|
||||
|
||||
kadmin.default_keys = lib.concatStringsSep " " [
|
||||
"aes256-cts-hmac-sha1-96:pw-salt"
|
||||
"aes128-cts-hmac-sha1-96:pw-salt"
|
||||
];
|
||||
|
||||
libdefaults.default_etypes = lib.concatStringsSep " " [
|
||||
"aes256-cts-hmac-sha1-96"
|
||||
"aes128-cts-hmac-sha1-96"
|
||||
];
|
||||
|
||||
libdefaults = {
|
||||
default_realm = realm;
|
||||
dns_lookup_kdc = false;
|
||||
dns_lookup_realm = false;
|
||||
};
|
||||
|
||||
domain_realm = {
|
||||
"${lib.toLower realm}" = realm;
|
||||
".${lib.toLower realm}" = realm;
|
||||
};
|
||||
|
||||
logging = {
|
||||
# kdc = "CONSOLE";
|
||||
kdc = "SYSLOG:DEBUG:AUTH";
|
||||
admin_server = "SYSLOG:DEBUG:AUTH";
|
||||
default = "SYSLOG:DEBUG:AUTH";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.kerberos_server = {
|
||||
enable = true;
|
||||
settings = {
|
||||
realms.${realm} = {
|
||||
dbname = "/var/lib/heimdal/heimdal";
|
||||
mkey = "/var/lib/heimdal/m-key";
|
||||
acl = [
|
||||
{
|
||||
principal = "kadmin/admin";
|
||||
access = "all";
|
||||
}
|
||||
{
|
||||
principal = "felixalb/admin";
|
||||
access = "all";
|
||||
}
|
||||
{
|
||||
principal = "oysteikt/admin";
|
||||
access = "all";
|
||||
}
|
||||
];
|
||||
};
|
||||
# kadmin.default_keys = lib.concatStringsSep " " [
|
||||
# "aes256-cts-hmac-sha1-96:pw-salt"
|
||||
# "aes128-cts-hmac-sha1-96:pw-salt"
|
||||
# ];
|
||||
|
||||
# libdefaults.default_etypes = lib.concatStringsSep " " [
|
||||
# "aes256-cts-hmac-sha1-96"
|
||||
# "aes128-cts-hmac-sha1-96"
|
||||
# ];
|
||||
|
||||
# password_quality.min_length = 8;
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 88 464 749 ];
|
||||
networking.firewall.allowedUDPPorts = [ 88 464 749 ];
|
||||
|
||||
networking.hosts = {
|
||||
"127.0.0.2" = lib.mkForce [ ];
|
||||
"::1" = lib.mkForce [ ];
|
||||
};
|
||||
}
|
||||
121
hosts/dagali/services/openldap.nix
Normal file
121
hosts/dagali/services/openldap.nix
Normal file
@@ -0,0 +1,121 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
services.openldap = let
|
||||
dn = "dc=pvv,dc=ntnu,dc=no";
|
||||
cfg = config.services.openldap;
|
||||
|
||||
heimdal = config.security.krb5.package;
|
||||
in {
|
||||
enable = true;
|
||||
|
||||
# NOTE: this is a custom build of openldap with support for
|
||||
# perl and kerberos.
|
||||
package = pkgs.openldap.overrideAttrs (prev: {
|
||||
# https://github.com/openldap/openldap/blob/master/configure
|
||||
configureFlags = prev.configureFlags ++ [
|
||||
# Connect to slapd via UNIX socket
|
||||
"--enable-local"
|
||||
# Cyrus SASL
|
||||
"--enable-spasswd"
|
||||
# Reverse hostname lookups
|
||||
"--enable-rlookups"
|
||||
# perl
|
||||
"--enable-perl"
|
||||
];
|
||||
|
||||
buildInputs = prev.buildInputs ++ [
|
||||
pkgs.perl
|
||||
# NOTE: do not upstream this, it might not work with
|
||||
# MIT in the same way
|
||||
heimdal
|
||||
];
|
||||
|
||||
extraContribModules = prev.extraContribModules ++ [
|
||||
# https://git.openldap.org/openldap/openldap/-/tree/master/contrib/slapd-modules
|
||||
"smbk5pwd"
|
||||
];
|
||||
});
|
||||
|
||||
settings = {
|
||||
attrs = {
|
||||
olcLogLevel = [ "stats" "config" "args" ];
|
||||
|
||||
# olcAuthzRegexp = ''
|
||||
# gidNumber=.*\\\+uidNumber=0,cn=peercred,cn=external,cn=auth
|
||||
# "uid=heimdal,${dn2}"
|
||||
# '';
|
||||
|
||||
# olcSaslSecProps = "minssf=0";
|
||||
};
|
||||
|
||||
children = {
|
||||
"cn=schema".includes = let
|
||||
# NOTE: needed for smbk5pwd.so module
|
||||
schemaToLdif = name: path: pkgs.runCommandNoCC name {
|
||||
buildInputs = with pkgs; [ schema2ldif ];
|
||||
} ''
|
||||
schema2ldif "${path}" > $out
|
||||
'';
|
||||
|
||||
hdb-ldif = schemaToLdif "hdb.ldif" "${heimdal.src}/lib/hdb/hdb.schema";
|
||||
samba-ldif = schemaToLdif "samba.ldif" "${heimdal.src}/tests/ldap/samba.schema";
|
||||
in [
|
||||
"${cfg.package}/etc/schema/core.ldif"
|
||||
"${cfg.package}/etc/schema/cosine.ldif"
|
||||
"${cfg.package}/etc/schema/nis.ldif"
|
||||
"${cfg.package}/etc/schema/inetorgperson.ldif"
|
||||
"${hdb-ldif}"
|
||||
"${samba-ldif}"
|
||||
];
|
||||
|
||||
# NOTE: installation of smbk5pwd.so module
|
||||
# https://git.openldap.org/openldap/openldap/-/tree/master/contrib/slapd-modules/smbk5pwd
|
||||
"cn=module{0}".attrs = {
|
||||
objectClass = [ "olcModuleList" ];
|
||||
olcModuleLoad = [ "${cfg.package}/lib/modules/smbk5pwd.so" ];
|
||||
};
|
||||
|
||||
# NOTE: activation of smbk5pwd.so module for {1}mdb
|
||||
"olcOverlay={0}smbk5pwd,olcDatabase={1}mdb".attrs = {
|
||||
objectClass = [ "olcOverlayConfig" "olcSmbK5PwdConfig" ];
|
||||
olcOverlay = "{0}smbk5pwd";
|
||||
olcSmbK5PwdEnable = [ "krb5" "samba" ];
|
||||
olcSmbK5PwdMustChange = toString (60 * 60 * 24 * 10000);
|
||||
};
|
||||
|
||||
"olcDatabase={1}mdb".attrs = {
|
||||
objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
|
||||
|
||||
olcDatabase = "{1}mdb";
|
||||
|
||||
olcSuffix = dn;
|
||||
|
||||
# TODO: PW is supposed to be a secret, but it's probably fine for testing
|
||||
olcRootDN = "cn=users,${dn}";
|
||||
|
||||
# TODO: replace with proper secret
|
||||
olcRootPW.path = pkgs.writeText "olcRootPW" "pass";
|
||||
|
||||
olcDbDirectory = "/var/lib/openldap/test-smbk5pwd-db";
|
||||
olcDbIndex = "objectClass eq";
|
||||
|
||||
olcAccess = [
|
||||
''{0}to attrs=userPassword,shadowLastChange
|
||||
by dn.exact=cn=users,${dn} write
|
||||
by self write
|
||||
by anonymous auth
|
||||
by * none''
|
||||
|
||||
''{1}to dn.base=""
|
||||
by * read''
|
||||
|
||||
/* allow read on anything else */
|
||||
# ''{2}to *
|
||||
# by cn=users,${dn} write by dn.exact=gidNumber=0+uidNumber=0+cn=peercred,cn=external write
|
||||
# by * read''
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -4,6 +4,7 @@
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
|
||||
(fp /modules/grzegorz.nix)
|
||||
];
|
||||
@@ -24,26 +25,6 @@
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
|
||||
|
||||
services.spotifyd = {
|
||||
enable = true;
|
||||
settings.global = {
|
||||
device_name = "georg";
|
||||
use_mpris = false;
|
||||
#dbus_type = "system";
|
||||
#zeroconf_port = 1234;
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
# config.services.spotifyd.settings.zeroconf_port
|
||||
5353 # spotifyd is its own mDNS service wtf
|
||||
];
|
||||
|
||||
|
||||
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
|
||||
@@ -4,6 +4,7 @@
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
|
||||
./services/monitoring
|
||||
./services/nginx
|
||||
|
||||
@@ -1539,7 +1539,7 @@
|
||||
]
|
||||
},
|
||||
"timezone": "browser",
|
||||
"title": "Gitea Dashboard",
|
||||
"title": "Gitea Dashbaord",
|
||||
"uid": "nNq1Iw5Gz",
|
||||
"version": 29,
|
||||
"weekStart": ""
|
||||
@@ -56,12 +56,13 @@ in {
|
||||
url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
|
||||
options.path = dashboards/synapse.json;
|
||||
}
|
||||
{
|
||||
name = "MySQL";
|
||||
type = "file";
|
||||
url = "https://raw.githubusercontent.com/prometheus/mysqld_exporter/main/mysqld-mixin/dashboards/mysql-overview.json";
|
||||
options.path = dashboards/mysql.json;
|
||||
}
|
||||
# TODO: enable once https://github.com/NixOS/nixpkgs/pull/242365 gets merged
|
||||
# {
|
||||
# name = "MySQL";
|
||||
# type = "file";
|
||||
# url = "https://raw.githubusercontent.com/prometheus/mysqld_exporter/main/mysqld-mixin/dashboards/mysql-overview.json";
|
||||
# options.path = dashboards/mysql.json;
|
||||
# }
|
||||
{
|
||||
name = "Postgresql";
|
||||
type = "file";
|
||||
@@ -75,10 +76,10 @@ in {
|
||||
options.path = dashboards/go-processes.json;
|
||||
}
|
||||
{
|
||||
name = "Gitea Dashboard";
|
||||
name = "Gitea Dashbaord";
|
||||
type = "file";
|
||||
url = "https://grafana.com/api/dashboards/17802/revisions/3/download";
|
||||
options.path = dashboards/gitea-dashboard.json;
|
||||
options.path = dashboards/gitea-dashbaord.json;
|
||||
}
|
||||
];
|
||||
|
||||
|
||||
@@ -2,12 +2,12 @@
|
||||
stateDir = "/data/monitoring/prometheus";
|
||||
in {
|
||||
imports = [
|
||||
./exim.nix
|
||||
./gitea.nix
|
||||
./machines.nix
|
||||
./matrix-synapse.nix
|
||||
./mysqld.nix
|
||||
# TODO: enable once https://github.com/NixOS/nixpkgs/pull/242365 gets merged
|
||||
# ./mysqld.nix
|
||||
./postgres.nix
|
||||
./machines.nix
|
||||
];
|
||||
|
||||
services.prometheus = {
|
||||
|
||||
@@ -1,14 +0,0 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.prometheus = {
|
||||
scrapeConfigs = [
|
||||
{
|
||||
job_name = "exim";
|
||||
scrape_interval = "15s";
|
||||
static_configs = [{
|
||||
targets = [ "microbel.pvv.ntnu.no:9636" ];
|
||||
}];
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -1,37 +1,54 @@
|
||||
{ config, ... }: let
|
||||
cfg = config.services.prometheus;
|
||||
|
||||
mkHostScrapeConfig = name: ports: {
|
||||
labels.hostname = name;
|
||||
targets = map (port: "${name}.pvv.ntnu.no:${toString port}") ports;
|
||||
};
|
||||
|
||||
defaultNodeExporterPort = 9100;
|
||||
defaultSystemdExporterPort = 9101;
|
||||
defaultNixosExporterPort = 9102;
|
||||
in {
|
||||
services.prometheus.scrapeConfigs = [{
|
||||
job_name = "base_info";
|
||||
static_configs = [
|
||||
(mkHostScrapeConfig "ildkule" [ cfg.exporters.node.port cfg.exporters.systemd.port defaultNixosExporterPort ])
|
||||
|
||||
(mkHostScrapeConfig "bekkalokk" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
||||
(mkHostScrapeConfig "bicep" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
||||
(mkHostScrapeConfig "brzeczyszczykiewicz" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
||||
(mkHostScrapeConfig "georg" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
||||
(mkHostScrapeConfig "kommode" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
||||
(mkHostScrapeConfig "ustetind" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
||||
(mkHostScrapeConfig "wenche" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
||||
|
||||
(mkHostScrapeConfig "lupine-1" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
||||
# (mkHostScrapeConfig "lupine-2" [ defaultNodeExporterPort defaultSystemdExporterPort ])
|
||||
(mkHostScrapeConfig "lupine-3" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
||||
(mkHostScrapeConfig "lupine-4" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
||||
(mkHostScrapeConfig "lupine-5" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
|
||||
|
||||
(mkHostScrapeConfig "hildring" [ defaultNodeExporterPort ])
|
||||
(mkHostScrapeConfig "isvegg" [ defaultNodeExporterPort ])
|
||||
(mkHostScrapeConfig "microbel" [ defaultNodeExporterPort ])
|
||||
{ labels.hostname = "ildkule";
|
||||
targets = [
|
||||
"ildkule.pvv.ntnu.no:${toString cfg.exporters.node.port}"
|
||||
"ildkule.pvv.ntnu.no:${toString cfg.exporters.systemd.port}"
|
||||
];
|
||||
}
|
||||
{ labels.hostname = "bekkalokk";
|
||||
targets = [
|
||||
"bekkalokk.pvv.ntnu.no:9100"
|
||||
"bekkalokk.pvv.ntnu.no:9101"
|
||||
];
|
||||
}
|
||||
{ labels.hostname = "bicep";
|
||||
targets = [
|
||||
"bicep.pvv.ntnu.no:9100"
|
||||
"bicep.pvv.ntnu.no:9101"
|
||||
];
|
||||
}
|
||||
{ labels.hostname = "brzeczyszczykiewicz";
|
||||
targets = [
|
||||
"brzeczyszczykiewicz.pvv.ntnu.no:9100"
|
||||
"brzeczyszczykiewicz.pvv.ntnu.no:9101"
|
||||
];
|
||||
}
|
||||
{ labels.hostname = "georg";
|
||||
targets = [
|
||||
"georg.pvv.ntnu.no:9100"
|
||||
"georg.pvv.ntnu.no:9101"
|
||||
];
|
||||
}
|
||||
{ labels.hostname = "hildring";
|
||||
targets = [
|
||||
"hildring.pvv.ntnu.no:9100"
|
||||
];
|
||||
}
|
||||
{ labels.hostname = "isvegg";
|
||||
targets = [
|
||||
"isvegg.pvv.ntnu.no:9100"
|
||||
];
|
||||
}
|
||||
{ labels.hostname = "microbel";
|
||||
targets = [
|
||||
"microbel.pvv.ntnu.no:9100"
|
||||
];
|
||||
}
|
||||
];
|
||||
}];
|
||||
}
|
||||
|
||||
@@ -1,22 +1,7 @@
|
||||
{ config, ... }: let
|
||||
cfg = config.services.prometheus;
|
||||
in {
|
||||
sops = {
|
||||
secrets."config/mysqld_exporter_password" = { };
|
||||
|
||||
templates."mysqld_exporter.conf" = {
|
||||
restartUnits = [ "prometheus-mysqld-exporter.service" ];
|
||||
content = let
|
||||
inherit (config.sops) placeholder;
|
||||
in ''
|
||||
[client]
|
||||
host = mysql.pvv.ntnu.no
|
||||
port = 3306
|
||||
user = prometheus_mysqld_exporter
|
||||
password = ${placeholder."config/mysqld_exporter_password"}
|
||||
'';
|
||||
};
|
||||
};
|
||||
sops.secrets."config/mysqld_exporter" = { };
|
||||
|
||||
services.prometheus = {
|
||||
scrapeConfigs = [{
|
||||
@@ -34,7 +19,7 @@ in {
|
||||
|
||||
exporters.mysqld = {
|
||||
enable = true;
|
||||
configFile = config.sops.templates."mysqld_exporter.conf".path;
|
||||
configFilePath = config.sops.secrets."config/mysqld_exporter".path;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,32 +0,0 @@
|
||||
{ pkgs, values, fp, ... }:
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
(fp /base)
|
||||
|
||||
./services/gitea
|
||||
./services/nginx.nix
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = fp /secrets/kommode/kommode.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
networking.hostName = "kommode"; # Define your hostname.
|
||||
|
||||
systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "ens18";
|
||||
address = with values.hosts.kommode; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||
};
|
||||
|
||||
services.btrfs.autoScrub.enable = true;
|
||||
|
||||
environment.systemPackages = with pkgs; [];
|
||||
|
||||
system.stateVersion = "24.11";
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.nginx.enable = true;
|
||||
}
|
||||
@@ -1,34 +0,0 @@
|
||||
{ fp, values, lupineName, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration/${lupineName}.nix
|
||||
|
||||
(fp /base)
|
||||
|
||||
./services/gitea-runner.nix
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = fp /secrets/lupine/lupine.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
systemd.network.networks."30-enp0s31f6" = values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "enp0s31f6";
|
||||
address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||
networkConfig.LLDP = false;
|
||||
};
|
||||
systemd.network.wait-online = {
|
||||
anyInterface = true;
|
||||
};
|
||||
|
||||
# There are no smart devices
|
||||
services.smartd.enable = false;
|
||||
|
||||
# Do not change, even during upgrades.
|
||||
# See https://search.nixos.org/options?show=system.stateVersion
|
||||
system.stateVersion = "25.05";
|
||||
}
|
||||
@@ -1,40 +0,0 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/a949e2e8-d973-4925-83e4-bcd815e65af7";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/81D6-38D3";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0077" "dmask=0077" ];
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/82c2d7fa-7cd0-4398-8cf6-c892bc56264b"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -1,40 +0,0 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/aa81d439-800b-403d-ac10-9d2aac3619d0";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/4A34-6AE5";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0077" "dmask=0077" ];
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/efb7cd0c-c1ae-4a86-8bc2-8e7fd0066650"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -1,40 +0,0 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/39ba059b-3205-4701-a832-e72c0122cb88";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/63FA-297B";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0077" "dmask=0077" ];
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/9c72eb54-ea8c-4b09-808a-8be9b9a33869"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -1,40 +0,0 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/5f8418ad-8ec1-4f9e-939e-f3a4c36ef343";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/F372-37DF";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0077" "dmask=0077" ];
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/27bf292d-bbb3-48c4-a86e-456e0f1f648f"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@@ -1,71 +0,0 @@
|
||||
{ config, lupineName, ... }:
|
||||
{
|
||||
# This is unfortunately state, and has to be generated one at a time :(
|
||||
# To do that, comment out all except one of the runners, fill in its token
|
||||
# inside the sops file, rebuild the system, and only after this runner has
|
||||
# successfully registered will gitea give you the next token.
|
||||
# - oysteikt Sep 2023
|
||||
sops = {
|
||||
secrets."gitea/runners/token" = {
|
||||
key = "gitea/runners/${lupineName}";
|
||||
};
|
||||
|
||||
templates."gitea-runner-envfile" = {
|
||||
restartUnits = [
|
||||
"gitea-runner-${lupineName}.service"
|
||||
];
|
||||
content = ''
|
||||
TOKEN="${config.sops.placeholder."gitea/runners/token"}"
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
services.gitea-actions-runner.instances = {
|
||||
${lupineName} = {
|
||||
enable = true;
|
||||
name = "git-runner-${lupineName}";
|
||||
url = "https://git.pvv.ntnu.no";
|
||||
# NOTE: gitea actions runners need node inside their docker images,
|
||||
# so we are a bit limited here.
|
||||
labels = [
|
||||
"debian-latest:docker://node:current-trixie"
|
||||
"debian-trixie:docker://node:current-trixie"
|
||||
"debian-bookworm:docker://node:current-bookworm"
|
||||
"debian-bullseye:docker://node:current-bullseye"
|
||||
|
||||
"debian-latest-slim:docker://node:current-trixie-slim"
|
||||
"debian-trixie-slim:docker://node:current-trixie-slim"
|
||||
"debian-bookworm-slim:docker://node:current-bookworm-slim"
|
||||
"debian-bullseye-slim:docker://node:current-bullseye-slim"
|
||||
|
||||
"alpine-latest:docker://node:current-alpine"
|
||||
"alpine-3.22:docker://node:current-alpine3.22"
|
||||
"alpine-3.21:docker://node:current-alpine3.21"
|
||||
|
||||
# See https://gitea.com/gitea/runner-images
|
||||
"ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
|
||||
"ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
|
||||
"ubuntu-noble:docker://docker.gitea.com/runner-images:ubuntu-24.04"
|
||||
"ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
|
||||
"ubuntu-jammy:docker://docker.gitea.com/runner-images:ubuntu-22.04"
|
||||
|
||||
"ubuntu-latest-slim:docker://docker.gitea.com/runner-images:ubuntu-latest-slim"
|
||||
"ubuntu-24.04-slim:docker://docker.gitea.com/runner-images:ubuntu-24.04-slim"
|
||||
"ubuntu-noble-slim:docker://docker.gitea.com/runner-images:ubuntu-24.04-slim"
|
||||
"ubuntu-22.04-slim:docker://docker.gitea.com/runner-images:ubuntu-22.04-slim"
|
||||
"ubuntu-jammy-slim:docker://docker.gitea.com/runner-images:ubuntu-22.04-slim"
|
||||
];
|
||||
tokenFile = config.sops.templates."gitea-runner-envfile".path;
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
defaultNetwork.settings.dns_enabled = true;
|
||||
autoPrune.enable = true;
|
||||
};
|
||||
|
||||
networking.dhcpcd.IPv6rs = false;
|
||||
|
||||
networking.firewall.interfaces."podman+".allowedUDPPorts = [53 5353];
|
||||
}
|
||||
@@ -4,6 +4,7 @@
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = fp /secrets/shark/shark.yaml;
|
||||
|
||||
@@ -3,6 +3,7 @@
|
||||
{
|
||||
imports = [
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
|
||||
./services/gitea-runners.nix
|
||||
];
|
||||
|
||||
@@ -1,44 +0,0 @@
|
||||
{ config, fp, pkgs, values, lib, ... }:
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
(fp /base)
|
||||
];
|
||||
|
||||
nix.settings.trusted-users = [ "@nix-builder-users" ];
|
||||
nix.daemonCPUSchedPolicy = "batch";
|
||||
|
||||
boot.binfmt.emulatedSystems = [
|
||||
"aarch64-linux"
|
||||
"armv7l-linux"
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = fp /secrets/wenche/wenche.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
|
||||
networking.hostName = "wenche"; # Define your hostname.
|
||||
|
||||
systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "ens18";
|
||||
address = with values.hosts.wenche; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||
};
|
||||
|
||||
hardware.graphics.enable = true;
|
||||
services.xserver.videoDrivers = [ "nvidia" ];
|
||||
hardware.nvidia = {
|
||||
modesetting.enable = true;
|
||||
open = false;
|
||||
package = config.boot.kernelPackages.nvidiaPackages.production;
|
||||
};
|
||||
|
||||
# List packages installed in system profile
|
||||
environment.systemPackages = with pkgs; [
|
||||
];
|
||||
|
||||
system.stateVersion = "24.11"; # Did you read the comment?
|
||||
}
|
||||
@@ -1,27 +0,0 @@
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "nvidia" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/4e8ecdd2-d453-4fff-b952-f06da00f3b85";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices = [ {
|
||||
device = "/var/lib/swapfile";
|
||||
size = 16*1024;
|
||||
} ];
|
||||
|
||||
networking.useDHCP = lib.mkDefault false;
|
||||
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
}
|
||||
57
justfile
57
justfile
@@ -1,56 +1,25 @@
|
||||
set positional-arguments # makes variables accesible as $1 $2 $@
|
||||
export GUM_FILTER_HEIGHT := "15"
|
||||
nom := `if [[ -t 1 ]] && command -v nom >/dev/null; then echo nom; else echo nix; fi`
|
||||
nix_eval_opts := "--log-format raw --option warn-dirty false"
|
||||
nom := `if command -v nom >/dev/null; then echo nom; else echo nix; fi`
|
||||
|
||||
@_default:
|
||||
just "$(gum choose --ordered --header "Pick a recipie..." $(just --summary --unsorted))"
|
||||
|
||||
check *_:
|
||||
nix flake check --keep-going "$@"
|
||||
check:
|
||||
nix flake check --keep-going
|
||||
|
||||
build-machine machine=`just _a_machine` *_:
|
||||
{{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel "${@:2}"
|
||||
build-machine machine=`just _a_machine`:
|
||||
{{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel
|
||||
|
||||
run-vm machine=`just _a_machine` *_:
|
||||
nixos-rebuild build-vm --flake .#{{ machine }} "${@:2}"
|
||||
run-vm machine=`just _a_machine`:
|
||||
nixos-rebuild build-vm --flake .#{{ machine }}
|
||||
QEMU_NET_OPTS="hostfwd=tcp::8080-:80,hostfwd=tcp::8081-:443,hostfwd=tcp::2222-:22" ./result/bin/run-*-vm
|
||||
|
||||
@update-inputs *_:
|
||||
@git reset flake.lock
|
||||
@git restore flake.lock
|
||||
nix eval {{nix_eval_opts}} --file flake.nix --apply 'x: builtins.attrNames x.inputs' --json \
|
||||
| { printf "%s\n" --commit-lock-file; jq '.[]' -r | grep -vxF "self" ||:; } \
|
||||
| gum choose --no-limit --header "Choose extra arguments:" \
|
||||
| tee >(xargs -d'\n' echo + nix flake update "$@" >&2) \
|
||||
| xargs -d'\n' nix flake update "$@"
|
||||
|
||||
@repl $machine=`just _a_machine` *_:
|
||||
set -v; nixos-rebuild --flake .#"$machine" repl "${@:2}"
|
||||
|
||||
@eval $machine=`just _a_machine` $attrpath="system.build.toplevel.outPath" *_:
|
||||
set -v; nix eval {{nix_eval_opts}} ".#nixosConfigurations.\"$machine\".config.$attrpath" --show-trace "${@:3}"
|
||||
|
||||
@eval-vm $machine=`just _a_machine` $attrpath="system.build.toplevel.outPath" *_:
|
||||
just eval "$machine" "virtualisation.vmVariant.$attrpath" "${@:3}"
|
||||
@update-inputs:
|
||||
nix eval .#inputs --apply builtins.attrNames --json \
|
||||
| jq '.[]' -r \
|
||||
| gum choose --no-limit --height=15 \
|
||||
| xargs -L 1 nix flake lock --update-input
|
||||
|
||||
|
||||
# helpers
|
||||
|
||||
[no-exit-message]
|
||||
_a_machine:
|
||||
#!/usr/bin/env -S sh -euo pipefail
|
||||
machines="$(
|
||||
nix eval {{nix_eval_opts}} .#nixosConfigurations --apply builtins.attrNames --json | jq .[] -r
|
||||
)"
|
||||
[ -n "$machines" ] || { echo >&2 "ERROR: no machines found"; false; }
|
||||
if [ -s .direnv/vars/last-machine.txt ]; then
|
||||
machines="$(
|
||||
grep <<<"$machines" -xF "$(cat .direnv/vars/last-machine.txt)" ||:
|
||||
grep <<<"$machines" -xFv "$(cat .direnv/vars/last-machine.txt)" ||:
|
||||
)"
|
||||
fi
|
||||
choice="$(gum filter <<<"$machines")"
|
||||
mkdir -p .direnv/vars
|
||||
cat <<<"$choice" >.direnv/vars/last-machine.txt
|
||||
cat <<<"$choice"
|
||||
nix eval .#nixosConfigurations --apply builtins.attrNames --json | jq .[] -r | gum filter
|
||||
|
||||
@@ -8,58 +8,34 @@ FgIDAQACHgECF4AACgkQRrkijoFKKqxIlQD9F0EedrFpHAVuaVas9ZWRZb4xv3zM
|
||||
N3g0IDxoN3g0QG5hbmkud3RmPoiTBBMWCgA7AhsBBQsJCAcDBRUKCQgLBRYCAwEA
|
||||
Ah4BAheAFiEE99N4kCKKkHRA4f1IRrkijoFKKqwFAmL7l8ACGQEACgkQRrkijoFK
|
||||
KqxI4wD9EIGpb3Gt5s5e8waH7XaLSlquOrW1RID3sSuzWI4DvikBAMncfBbtkpzH
|
||||
EYU2Ufm8VxzgJDnyeB+lcdeSJXWaIwYLiJAEExYKADgWIQT303iQIoqQdEDh/UhG
|
||||
uSKOgUoqrAUCYuaF5AIbAQULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRBGuSKO
|
||||
gUoqrKWiAQC1yFpodz5PGsZbFgihEA0UQ5jcoXBojoAlVRgmkwm41gEA782rsvyl
|
||||
87ExoluDD3eV/Z5ILp7Ex6JeaE3JUix8Sgi0Jmg3eDQgKGFsdGVybmF0aXZlKSA8
|
||||
aDd4NC5hbHRAbmFuaS53dGY+iJAEExYKADgWIQT303iQIoqQdEDh/UhGuSKOgUoq
|
||||
rAUCYvuPSgIbAQULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRBGuSKOgUoqrK3L
|
||||
AP4h0cjFuNFwMQlg6oVfWvjCvKZO+ePP+SnTNRKvKbAxSgEA/yG48r9im6M0Xr9z
|
||||
DAHcDlbClaONX4X+6rZ6OoU6hw24MwRi5oZHFgkrBgEEAdpHDwEBB0CyZzQZNAiz
|
||||
OmSMNjCBK3rMjzU/b6T1a8GDogQhKfK5VYj1BBgWCgAmFiEE99N4kCKKkHRA4f1I
|
||||
RrkijoFKKqwFAmLmhkcCGwIFCQPCZwAAgQkQRrkijoFKKqx2IAQZFgoAHRYhBPPN
|
||||
qGzFWp8Q16BpgZ8vfYJQ81FGBQJi5oZHAAoJEJ8vfYJQ81FGFZgBALN+Rh4m323T
|
||||
aM5zdJfCTV7V0aP3J0RdKmtKvz/Y9a7uAP4oP8UlbM9ucyG252gZ8IjM0VprNzP9
|
||||
CpNl4GzpD4CRDu55AP9mpAyRoKt3yjYvTaHz1TpsXHLzqfJO6sYBRXH3YXyNTAEA
|
||||
prtmn/S9HltHijnsLs1PEHmRua14XQBdL1HuzFID8ASI9QQYFgoAJgIbAhYhBPfT
|
||||
eJAiipB0QOH9SEa5Io6BSiqsBQJmqp4CBQkFpUs7AIF2IAQZFgoAHRYhBPPNqGzF
|
||||
Wp8Q16BpgZ8vfYJQ81FGBQJi5oZHAAoJEJ8vfYJQ81FGFZgBALN+Rh4m323TaM5z
|
||||
dJfCTV7V0aP3J0RdKmtKvz/Y9a7uAP4oP8UlbM9ucyG252gZ8IjM0VprNzP9CpNl
|
||||
4GzpD4CRDgkQRrkijoFKKqwYoQEAz0D3G/dD6DBYBf7p6pGYqXd2X0Dv8nmnalol
|
||||
Z6SxfUMA/jT/XjPh7c4Ui8nZO7XDzYWrbV/eZwGMd1zXq2mU42MLiPUEGBYKACYC
|
||||
GwIWIQT303iQIoqQdEDh/UhGuSKOgUoqrAUCaI6lzgUJCWqGhwCBdiAEGRYKAB0W
|
||||
IQTzzahsxVqfENegaYGfL32CUPNRRgUCYuaGRwAKCRCfL32CUPNRRhWYAQCzfkYe
|
||||
Jt9t02jOc3SXwk1e1dGj9ydEXSprSr8/2PWu7gD+KD/FJWzPbnMhtudoGfCIzNFa
|
||||
azcz/QqTZeBs6Q+AkQ4JEEa5Io6BSiqsCG0BALDNFlploZWjQ0Xn3B9fd+1sTUmY
|
||||
+e0s95lEY7XqVkF2AQCkKzMd2mHsymyVtY32bSsZ0iJxHTmxomS0uQ/TGIugB7kC
|
||||
DQRi5oZ6ARAA2tcgStDSsVSLaN4UodtYaKGKVnBF1qjD1xzt+K3AIZLVRTjhyJdm
|
||||
xRknEAGV7YwHKlJjMgvjzLNQ2aKHBZPvTybde4QGv7Ogka8PLyvtX1aoY9Fzi7Xr
|
||||
xlfYguiEb4T8c07DmnjrLIDBiFPMQ5jCk9pxhxjVJKjlxpXetxNzSrCt5Z5fgQna
|
||||
SdH9xhAe2kkPqZOpNbszg11/5oQFCZi9TJFWeoyQN74bK3tCn2vafguZj+ISyeox
|
||||
fqBErwOBwvi7gkhpuuoCAzAt/Y5y6OocGBBI3z1w+wlADeEtniEkhXfmXJTdr2HK
|
||||
ymILAmUtIQRToA4SighwbjMD9dgCDPMvC+uP3jlhaUe7NkrQD442G2XmRAhy1mbd
|
||||
cxlb5Eu16epbAIOv0/BMrChu705dkKvVtAZszYJNjg02ZIb9IKql6aXa/HkYqvod
|
||||
KjHyabRtBsnDr6m/T6BDtnXzQo4yCPFX2khn0hGKPFMLKmE7X4HaDZxQlynda+0J
|
||||
r63WzbBQ0ZpL/sFiaIqcFGlarsm9ijeudo0pacDBAlun0hLE/+Qt5iS4AJoupesq
|
||||
LMOh3SGOo4KQhrcZx1ts0XiEuns2XbcWAQpBByu9MgEsmiB6yyw5J8Pg7ir1wFjg
|
||||
HnKG/BjQRzo12Xty8wbdq1YDgkWvlu5opTYI1ArM/kd6zPF30fsDRBsAEQEAAYh+
|
||||
BBgWCgAmFiEE99N4kCKKkHRA4f1IRrkijoFKKqwFAmLmhnoCGwwFCQPCZwAACgkQ
|
||||
RrkijoFKKqwxNAEAwcUbJlvS+tJsRgqdQqTVgVw9k+g+tOT5TYjQnDPnDgoA/3Nj
|
||||
orUkhudDNGEW8odSz2C+mEHjy9HUJGLI5ul1ZqwCiH4EGBYKACYCGwwWIQT303iQ
|
||||
IoqQdEDh/UhGuSKOgUoqrAUCZqqeBQUJBaVLCAAKCRBGuSKOgUoqrMnbAP4oQbpa
|
||||
Uki4OAfaSbH36qYTIbe8k9w58+e4nsVBII94wQEA3nSPoMKWZTI1eiHR/xKc9uOI
|
||||
/Nk2tOHKpEjs9mOtywaIfgQYFgoAJgIbDBYhBPfTeJAiipB0QOH9SEa5Io6BSiqs
|
||||
BQJojqXOBQkJaoZUAAoJEEa5Io6BSiqsiXkBAJ0JTRmdQQpEK9KSh8V7FEkblIsm
|
||||
Ngko2cs+OhNSUgW9AQD0a7FHM3Dx32a7yD0zE3QwWi5VgeZZVIPyhItrOaANDbgz
|
||||
BGLmhsUWCSsGAQQB2kcPAQEHQFg/avgj0sZbxqL58tZEpcaieeL1OWOoVU3mZX/K
|
||||
7GU+iH4EGBYKACYWIQT303iQIoqQdEDh/UhGuSKOgUoqrAUCYuaGxQIbIAUJA8Jn
|
||||
AAAKCRBGuSKOgUoqrN5jAP96aO0MEPQSIKdLaa9+ilpPp+glJ9duIJ7zdR0U15tO
|
||||
NAEA0WqeRc8Jhv10UjIz/Q3UlcfvKPzVW6yVKo+Lg1FI2QSIfgQYFgoAJgIbIBYh
|
||||
BPfTeJAiipB0QOH9SEa5Io6BSiqsBQJmqp4GBQkFpUq9AAoJEEa5Io6BSiqsjF0B
|
||||
AJn0EBEJfszskYiZzMshFHW5k0QUF+Ak3JNh2UG+M6FJAQCQVY/lDkrvOytuFnKb
|
||||
kDrCaTrtLh/JAmBXpSERIejmD4h+BBgWCgAmAhsgFiEE99N4kCKKkHRA4f1IRrki
|
||||
joFKKqwFAmiOpc4FCQlqhgkACgkQRrkijoFKKqwSMAD/bbO/uwwdFEJVgcNRexZU
|
||||
6aoSxAGI1vjS92hSyfxZ9AABAK8KYO8sBGGCiVu+vWUpoUYmp3lfYTJHtf+36WMc
|
||||
D5MD
|
||||
=Gubf
|
||||
EYU2Ufm8VxzgJDnyeB+lcdeSJXWaIwYLtCZoN3g0IChhbHRlcm5hdGl2ZSkgPGg3
|
||||
eDQuYWx0QG5hbmkud3RmPoiQBBMWCgA4FiEE99N4kCKKkHRA4f1IRrkijoFKKqwF
|
||||
AmL7j0oCGwEFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQRrkijoFKKqytywD+
|
||||
IdHIxbjRcDEJYOqFX1r4wrymTvnjz/kp0zUSrymwMUoBAP8huPK/YpujNF6/cwwB
|
||||
3A5WwpWjjV+F/uq2ejqFOocNuDMEYuaGRxYJKwYBBAHaRw8BAQdAsmc0GTQIszpk
|
||||
jDYwgSt6zI81P2+k9WvBg6IEISnyuVWI9QQYFgoAJhYhBPfTeJAiipB0QOH9SEa5
|
||||
Io6BSiqsBQJi5oZHAhsCBQkDwmcAAIEJEEa5Io6BSiqsdiAEGRYKAB0WIQTzzahs
|
||||
xVqfENegaYGfL32CUPNRRgUCYuaGRwAKCRCfL32CUPNRRhWYAQCzfkYeJt9t02jO
|
||||
c3SXwk1e1dGj9ydEXSprSr8/2PWu7gD+KD/FJWzPbnMhtudoGfCIzNFaazcz/QqT
|
||||
ZeBs6Q+AkQ7ueQD/ZqQMkaCrd8o2L02h89U6bFxy86nyTurGAUVx92F8jUwBAKa7
|
||||
Zp/0vR5bR4o57C7NTxB5kbmteF0AXS9R7sxSA/AEuQINBGLmhnoBEADa1yBK0NKx
|
||||
VIto3hSh21hooYpWcEXWqMPXHO34rcAhktVFOOHIl2bFGScQAZXtjAcqUmMyC+PM
|
||||
s1DZoocFk+9PJt17hAa/s6CRrw8vK+1fVqhj0XOLtevGV9iC6IRvhPxzTsOaeOss
|
||||
gMGIU8xDmMKT2nGHGNUkqOXGld63E3NKsK3lnl+BCdpJ0f3GEB7aSQ+pk6k1uzOD
|
||||
XX/mhAUJmL1MkVZ6jJA3vhsre0Kfa9p+C5mP4hLJ6jF+oESvA4HC+LuCSGm66gID
|
||||
MC39jnLo6hwYEEjfPXD7CUAN4S2eISSFd+ZclN2vYcrKYgsCZS0hBFOgDhKKCHBu
|
||||
MwP12AIM8y8L64/eOWFpR7s2StAPjjYbZeZECHLWZt1zGVvkS7Xp6lsAg6/T8Eys
|
||||
KG7vTl2Qq9W0BmzNgk2ODTZkhv0gqqXppdr8eRiq+h0qMfJptG0GycOvqb9PoEO2
|
||||
dfNCjjII8VfaSGfSEYo8UwsqYTtfgdoNnFCXKd1r7QmvrdbNsFDRmkv+wWJoipwU
|
||||
aVquyb2KN652jSlpwMECW6fSEsT/5C3mJLgAmi6l6yosw6HdIY6jgpCGtxnHW2zR
|
||||
eIS6ezZdtxYBCkEHK70yASyaIHrLLDknw+DuKvXAWOAecob8GNBHOjXZe3LzBt2r
|
||||
VgOCRa+W7milNgjUCsz+R3rM8XfR+wNEGwARAQABiH4EGBYKACYWIQT303iQIoqQ
|
||||
dEDh/UhGuSKOgUoqrAUCYuaGegIbDAUJA8JnAAAKCRBGuSKOgUoqrDE0AQDBxRsm
|
||||
W9L60mxGCp1CpNWBXD2T6D605PlNiNCcM+cOCgD/c2OitSSG50M0YRbyh1LPYL6Y
|
||||
QePL0dQkYsjm6XVmrAK4MwRi5obFFgkrBgEEAdpHDwEBB0BYP2r4I9LGW8ai+fLW
|
||||
RKXGonni9TljqFVN5mV/yuxlPoh+BBgWCgAmFiEE99N4kCKKkHRA4f1IRrkijoFK
|
||||
KqwFAmLmhsUCGyAFCQPCZwAACgkQRrkijoFKKqzeYwD/emjtDBD0EiCnS2mvfopa
|
||||
T6foJSfXbiCe83UdFNebTjQBANFqnkXPCYb9dFIyM/0N1JXH7yj81VuslSqPi4NR
|
||||
SNkE
|
||||
=oTMO
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
5
misc/builder.nix
Normal file
5
misc/builder.nix
Normal file
@@ -0,0 +1,5 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
nix.settings.trusted-users = [ "@nix-builder-users" ];
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user