fixup! sops/lupine: add CA + 2 keypairs for OpenVPN

hosts/ildkule/services/monitoring/default.nix

@@ -2,10 +2,10 @@
 
 {
   imports = [
-    ./gatus
     ./grafana.nix
     ./loki.nix
     ./prometheus
     ./scrutiny.nix
+    ./uptime-kuma.nix
   ];
 }

hosts/ildkule/services/monitoring/gatus/default.nix

@@ -1,153 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.services.gatus;
-in
-{
-  imports = [
-    ./minecraft-checker.nix
-  ];
-
-  services.gatus = {
-    enable = true;
-
-    settings = {
-      web = {
-        address = "127.0.0.1";
-        port = 19283;
-      };
-
-      storage = {
-        type = "sqlite";
-        path = "/var/lib/gatus/data.db";
-      };
-
-      ui = {
-        title = "PVV Nede!?";
-        header = "😭😭😭";
-        dashboard-heading = "PVV Nede!?";
-        dashboard-subheading = "Kan noen ringe drift?";
-      };
-
-      endpoints = let
-        mkMachine = name: {
-          inherit name;
-          group = "Machines";
-          url = "icmp://${name}.pvv.ntnu.no";
-          conditions = [
-            "[CONNECTED] == true"
-          ];
-        };
-
-        mkWebsite = name: url: {
-          inherit name url;
-          group = "Websites";
-          method = "GET";
-          conditions = [
-            "[STATUS] == 200"
-          ];
-        };
-
-        mkService = name: url: {
-          inherit name url;
-          group = "Services";
-          conditions = [
-            "[CONNECTED] == true"
-          ];
-        };
-      in (lib.sortOn (m: m.name) [
-        (mkMachine "bekkalokk")
-        (mkMachine "bicep")
-        (mkMachine "bikkje")
-        (mkMachine "brzeczyszczykiewicz")
-        (mkMachine "georg")
-        (mkMachine "gluttony")
-        (mkMachine "ildkule")
-        (mkMachine "kommode")
-        (mkMachine "lupine-1")
-        (mkMachine "lupine-2")
-        (mkMachine "lupine-3")
-        (mkMachine "lupine-4")
-        (mkMachine "lupine-5")
-        (mkMachine "skrot")
-        (mkMachine "temmie")
-        (mkMachine "wenche")
-
-        (mkMachine "balduzius")
-        (mkMachine "blossom")
-        (mkMachine "bubbles")
-        (mkMachine "buskerud")
-        (mkMachine "buttercup")
-        (mkMachine "demiurgen")
-        (mkMachine "drolsum")
-        (mkMachine "hildring")
-        (mkMachine "innovation")
-        (mkMachine "isvegg")
-        (mkMachine "knutsen")
-        (mkMachine "ludvigsen" // {
-          url = "icmp://ludvigsen-tap.pvv.ntnu.no";
-        })
-        (mkMachine "microbel")
-        (mkMachine "mirage")
-        (mkMachine "orchid")
-        (mkMachine "principal")
-        (mkMachine "sleipner")
-        (mkMachine "smask")
-        (mkMachine "tom")
-        (mkMachine "wegonke")
-      ]) ++ [
-        (mkWebsite "Bluemap" "https://minecraft.pvv.ntnu.no")
-        (mkWebsite "Element Web" "https://chat.pvv.ntnu.no")
-        (mkWebsite "Gitea" "https://git.pvv.ntnu.no/api/healthz" // {
-          conditions = [
-            "[STATUS] == 200"
-            "[BODY].status == pass"
-          ];
-        })
-        (mkWebsite "Grafana" "https://grafana.pvv.ntnu.no/api/health" // {
-          conditions = [
-            "[STATUS] == 200"
-            "[BODY].database == ok"
-          ];
-        })
-        (mkWebsite "Grzegorz - Brzeczyszczykiewicz" "https://brzeczyszczykiewicz.pvv.ntnu.no")
-        (mkWebsite "Grzegorz - Georg" "https://georg.pvv.ntnu.no")
-        (mkWebsite "IDP" "https://idp.pvv.ntnu.no")
-        (mkWebsite "Mailing Lists" "http://list.pvv.ntnu.no")
-        (mkWebsite "Mapcrafter" "http://isvegg.pvv.ntnu.no/kart")
-        (mkWebsite "PVV-Nettsiden" "https://www.pvv.ntnu.no")
-        (mkWebsite "Roundcube" "https://webmail.pvv.ntnu.no/roundcube")
-        (mkWebsite "Scrutiny" "https://scrutiny.pvv.ntnu.no")
-        (mkWebsite "Snappymail" "http://snappymail.pvv.ntnu.no")
-        (mkWebsite "Userweb - Temmie" "https://temmie.pvv.ntnu.no/~oysteikt")
-        (mkWebsite "Userweb - Tom" "https://www.pvv.ntnu.no/~oysteikt")
-        (mkWebsite "Vaultwarden" "https://pw.pvv.ntnu.no/alive")
-        (mkWebsite "Wiki" "https://wiki.pvv.ntnu.no/w/api.php?action=query&format=json")
-
-        (mkService "Gitea SSH" "ssh://git.pvv.ntnu.no:2222")
-        (mkService "QoTD" "tcp://bekkalokk.pvv.ntnu.no:17")
-        (mkService "Minecraft" "http://localhost:25565" // {
-          conditions = [
-            "[STATUS] == 200"
-            "[BODY].ok == true"
-          ];
-        })
-        (mkService "Email (SMTP)" "tcp://mail.pvv.ntnu.no:587")
-        (mkService "Email (POP3)" "tcp://mail.pvv.ntnu.no:995")
-        (mkService "Email (IMAP)" "tcp://mail.pvv.ntnu.no:993")
-        (mkService "Matrix Synapse" "https://matrix.pvv.ntnu.no/_matrix/client/versions" // {
-          method = "GET";
-          conditions = [
-            "[STATUS] == 200"
-          ];
-        })
-      ];
-    };
-  };
-
-  services.nginx.virtualHosts."status.pvv.ntnu.no" = lib.mkIf cfg.enable {
-    enableACME = true;
-    forceSSL = true;
-    kTLS = true;
-    locations."/".proxyPass = "http://localhost:${toString cfg.settings.web.port}";
-  };
-}

hosts/ildkule/services/monitoring/gatus/minecraft-checker.nix

@@ -1,79 +0,0 @@
-{ lib, pkgs, ... }:
-{
-  systemd.sockets."gatus-minecraft-checker" = {
-    wantedBy = [ "sockets.target" ];
-    listenStreams = [ "25565" ];
-    socketConfig = {
-      SocketMode = "0666";
-      Accept = false;
-    };
-  };
-
-  systemd.services."gatus-minecraft-checker" = {
-    serviceConfig = {
-      ExecStart = lib.getExe (pkgs.writers.writePython3Bin "gatus-minecraft-checker" {
-        libraries = with pkgs.python3Packages; [
-          # sdnotify
-          mcstatus
-        ];
-        flakeIgnore = [ "E501" "E704" ];
-      } ''
-        import socket
-        import json
-        from http.server import HTTPServer, BaseHTTPRequestHandler
-
-        from mcstatus import JavaServer
-
-
-        class Handler(BaseHTTPRequestHandler):
-            def do_GET(self):
-                try:
-                    mcserver = JavaServer.lookup("minecraft.pvv.ntnu.no")
-                    status = mcserver.status()
-
-                    body = {
-                        "ok": True,
-                        "players": status.players.online,
-                        "version": status.version.name,
-                        "latency": status.latency,
-                    }
-
-                    data = json.dumps(body).encode()
-
-                    self.send_response(200)
-                    self.send_header("Content-Type", "application/json")
-                    self.send_header("Content-Length", str(len(data)))
-                    self.end_headers()
-                    self.wfile.write(data)
-
-                except Exception as e:
-                    data = json.dumps({"ok": False, "error": str(e)}).encode()
-                    self.send_response(500)
-                    self.end_headers()
-                    self.wfile.write(data)
-
-
-        class NoBindHTTPServer(HTTPServer):
-            def server_bind(): pass
-            def server_activate(): pass
-
-
-        def main():
-            httpd = NoBindHTTPServer(
-                ("", 0),
-                Handler,
-                bind_and_activate=False,
-            )
-            httpd.socket = socket.fromfd(3, socket.AF_INET, socket.SOCK_STREAM)
-            httpd.serve_forever()
-
-
-        if __name__ == '__main__':
-            main()
-      '');
-
-      NoNewPrivileges = true;
-      PrivateTmp = true;
-    };
-  };
-}

hosts/ildkule/services/monitoring/uptime-kuma.nix

@@ -0,0 +1,44 @@
+{ config, pkgs, lib, values, ... }:
+let
+  cfg = config.services.uptime-kuma;
+  domain = "status.pvv.ntnu.no";
+  stateDir = "/data/monitoring/uptime-kuma";
+in {
+  services.uptime-kuma = {
+    enable = true;
+    settings = {
+      PORT = "5059";
+      HOST = "127.0.1.2";
+    };
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    enableACME = true;
+    forceSSL = true;
+    kTLS = true;
+    locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
+  };
+
+  fileSystems."/var/lib/private/uptime-kuma" = {
+    device = stateDir;
+    fsType = "bind";
+    options = [ "bind" ];
+  };
+
+  services.rsync-pull-targets = {
+    enable = true;
+    locations.${stateDir} = {
+      user = "root";
+      rrsyncArgs.ro = true;
+      authorizedKeysAttrs = [
+        "restrict"
+        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
+        "no-agent-forwarding"
+        "no-port-forwarding"
+        "no-pty"
+        "no-X11-forwarding"
+      ];
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXzcDm6cVr4NmWzUSroy33FlielKqaG83wY0RCMC0p/ uptime_kuma rsync backup";
+    };
+  };
+}

hosts/lupine/services/openvpn.nix

@@ -28,10 +28,8 @@ in
 
   services.openvpn.servers."ov-tunnel" = {
     config = renderConfig {
-      mode = "server";
-
       # TODO: use aliases
-      local = "0.0.0.0";
+      local = values.services.knutsen-vpn;
       port = 1194;
       proto = "udp";
 
@@ -65,6 +63,7 @@ in
       ];
 
       keepalive = "10 120";
+      data-ciphers = "none";
 
       user = "nobody";
       group = "nobody";
@@ -85,17 +84,9 @@ in
       persist-key = true;
       persist-tun = true;
 
-      tls-version-min = "1.2";
-      tls-version-max = "1.2";
-
       verb = 5;
 
       explicit-exit-notify = 1;
     };
   };
-
-  networking.firewall = {
-    allowedTCPPorts = [ 1194 ];
-    allowedUDPPorts = [ 1194 ];
-  };
 }