WIP: temmie/userweb: fcgiwrap

base/default.nix

@@ -101,8 +101,6 @@
 
   # users.mutableUsers = lib.mkDefault false;
 
-  users.users.root.initialHashedPassword = "$y$j9T$ahP6GAdttD17OMBo7Yqeh.$Ad7qBcFvTL7HrJ9uTtrQzksN3220Nj9t/CrP6DwgK34"; # generated using mkpasswd, see huttiheita root on vaultwarden
-
   users.groups."drift".name = "drift";
 
   # Trusted users on the nix builder machines

base/services/acme.nix

@@ -8,5 +8,6 @@
   # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
   virtualisation.vmVariant = {
     security.acme.defaults.server = "https://127.0.0.1";
+    users.users.root.initialPassword = "root";
   };
 }

base/services/fluentbit.nix

@@ -62,10 +62,8 @@ in
           name = "loki";
           match = "*";
 
-          host = "loki.pvv.ntnu.no";
+          host = "ildkule.pvv.ntnu.no";
-          port = 443;
+          port = 3100;
-          tls = "on";
-          "tls.verify" = "on";
           uri = "/loki/api/v1/push";
           compress = "gzip";
 

flake.lock

@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780236125,
+        "lastModified": 1771267058,
-        "narHash": "sha256-LFFdHbXFthgU81S6P+p9FFKs/Wx868d4CtsFvbgvQqo=",
+        "narHash": "sha256-EEL4SmD1b3BPJPsSJJ4wDTXWMumJqbR+BLzhJJG0skE=",
         "ref": "main",
-        "rev": "267af00ebd8693632fa0f80300e49203cfcebbd4",
+        "rev": "e3962d02c78b9c7b4d18148d931a9a4bf22e7902",
-        "revCount": 258,
+        "revCount": 254,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
       },
@@ -126,10 +126,10 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1779345549,
+        "lastModified": 1777019032,
-        "narHash": "sha256-naEMpFsQrco5eDtYmcTG6cpbPG+kqElOyS7fTb/jw9s=",
+        "narHash": "sha256-29lw7THThWb5DW01rVRj1b816Apwz/P4m2wVWaSIadU=",
         "ref": "main",
-        "rev": "5631e1124508fdef0604b08bfcf6343d967a21b3",
+        "rev": "55262afca46c96f75a834d4e00e30d5fb20affb6",
         "revCount": 61,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
@@ -169,11 +169,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780178524,
+        "lastModified": 1769338528,
-        "narHash": "sha256-2PcNyNqbGCWBpAMdCU1HxSQmhQiG6evdjxVnPA7w5bQ=",
+        "narHash": "sha256-t18ZoSt9kaI1yde26ok5s7aFLkap1Q9+/2icVh2zuaE=",
         "ref": "refs/heads/main",
-        "rev": "2406de41ce9d0a1404cbf4e55537e3f720f37f23",
+        "rev": "7218348163fd8d84df4a6f682c634793e67a3fed",
-        "revCount": 15,
+        "revCount": 13,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/libdib.git"
       },
@@ -189,16 +189,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1782122067,
+        "lastModified": 1764844095,
-        "narHash": "sha256-95q3DiYOTHjQGbqR0I1w4ETrH+smtddqW0bBxaB/Egg=",
+        "narHash": "sha256-Drf1orxsmFDzO+UbPo85gHjXW7QzAM+6oTPvI7vOSik=",
         "owner": "dali99",
         "repo": "nixos-matrix-modules",
-        "rev": "0e0fd9f6a407b08dd5e180a2ff6c3808461e2c47",
+        "rev": "25b9f31ef1dbc3987b4c716de716239f2b283701",
         "type": "github"
       },
       "original": {
         "owner": "dali99",
-        "ref": "master",
+        "ref": "v0.8.0",
         "repo": "nixos-matrix-modules",
         "type": "github"
       }
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1782708249,
+        "lastModified": 1779622335,
-        "narHash": "sha256-ASIzbiHLqFDHfomCJVMDaW1rsD9IJQ/m997Tw8569tM=",
+        "narHash": "sha256-06G98ieM6l+OI7EMhlvchgDBDn+DvIWCNj40LDhKpmc=",
-        "rev": "68d68014342a18d2514d6e6f1185cfc24d02fc00",
+        "rev": "705e9929918b43bd7b715dc0a878ac870449bb03",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.3713.68d68014342a/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05beta1.705e9929918b/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -319,11 +319,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1782731455,
+        "lastModified": 1778586796,
-        "narHash": "sha256-vFMOLxoARiCUBQOysAAJ0VmPzilmHUqk3EZfSRweKN8=",
+        "narHash": "sha256-XmDljcG4x8slQDlsWOc77pCA1YVuYn8JGumkYlhfTxI=",
-        "rev": "9c4c05a947a91dc14625265fab505fb695e93218",
+        "rev": "b25e938b89759b5f9466fc53c4a970244f84dc39",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.11pre1024311.9c4c05a947a9/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre996582.b25e938b8975/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -379,11 +379,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782759909,
+        "lastModified": 1781362709,
-        "narHash": "sha256-gktjBeZyoRvVBkm2cO1tD99fdQ34iUDyB6iecRdorm4=",
+        "narHash": "sha256-zTzLvvtRdOKKcQMWydoZuduj9fwwkYRfB1RBzKegwHM=",
         "ref": "main",
-        "rev": "ad6c79fb713884a4a2df8aab30914cd0c1c2e6cb",
+        "rev": "5fb08a462263e5a8d742ecd93e559e534d5c3af2",
-        "revCount": 587,
+        "revCount": 586,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       },
@@ -447,17 +447,17 @@
         "rust-overlay": "rust-overlay_4"
       },
       "locked": {
-        "lastModified": 1782275838,
+        "lastModified": 1778600367,
-        "narHash": "sha256-CW84hEFcypvEegQp+4zZZ4lCnPT7Qn27OpKiQBxiWS8=",
+        "narHash": "sha256-YB0b2xUf4D8792D5Ay//7C3AjHyv+9yoy8K1mTe+wvE=",
         "ref": "main",
-        "rev": "71d2b72c34352a79dbee8ebf23ce64f39aead692",
+        "rev": "8e5f2849ff7c9616100fe928261512a7ad647939",
-        "revCount": 102,
+        "revCount": 91,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
       },
       "original": {
         "ref": "main",
-        "rev": "71d2b72c34352a79dbee8ebf23ce64f39aead692",
+        "rev": "8e5f2849ff7c9616100fe928261512a7ad647939",
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
       }
@@ -491,11 +491,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779333539,
+        "lastModified": 1777000482,
-        "narHash": "sha256-lpmN2lrBDZDPjov2cbD3bOOJsI0fkKolKXasYPCqSys=",
+        "narHash": "sha256-CZ5FKUSA8FCJf0h9GWdPJXoVVDL9H5yC74GkVc5ubIM=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "672fa5fc5608d5cd82286a6f69aaf84a40b4fe41",
+        "rev": "403c09094a877e6c4816462d00b1a56ff8198e06",
         "type": "github"
       },
       "original": {
@@ -553,11 +553,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782165805,
+        "lastModified": 1777944972,
-        "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=",
+        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24",
+        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
         "type": "github"
       },
       "original": {
@@ -575,11 +575,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780762731,
+        "lastModified": 1773932847,
-        "narHash": "sha256-EuDaLnasWN0mpi995n+fAQQfPGBhqNW4fNjlQRpHt58=",
+        "narHash": "sha256-IklIAdlonrmO8/lkDxNIVz9+ORL4pcVotMTxeyvxzoc=",
         "ref": "main",
-        "rev": "931bd2d63e285e767c8c81c103dda3c0a63f2965",
+        "rev": "0871a319f51d3cb0d1abb5b11edb768b39906d3f",
-        "revCount": 108,
+        "revCount": 104,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
       },

flake.nix

@@ -26,7 +26,7 @@
     worblehat.url = "git+https://git.pvv.ntnu.no/Projects/worblehat.git?ref=main";
     worblehat.inputs.nixpkgs.follows = "nixpkgs";
 
-    matrix-next.url = "github:dali99/nixos-matrix-modules/master";
+    matrix-next.url = "github:dali99/nixos-matrix-modules/v0.8.0";
     matrix-next.inputs.nixpkgs.follows = "nixpkgs";
 
     nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git?ref=main";
@@ -35,7 +35,7 @@
     minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
     minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";
 
-    roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=71d2b72c34352a79dbee8ebf23ce64f39aead692";
+    roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=8e5f2849ff7c9616100fe928261512a7ad647939";
     roowho2.inputs.nixpkgs.follows = "nixpkgs";
 
     greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";

hosts/bekkalokk/hardware-configuration.nix

@@ -16,7 +16,6 @@
   fileSystems."/" =
     { device = "/dev/sda1";
       fsType = "btrfs";
-      options = [ "relatime" ];
     };
 
   fileSystems."/boot" =

hosts/bicep/services/matrix/synapse.nix

@@ -74,7 +74,7 @@ in {
         name = "psycopg2";
         args = {
           host = "/var/run/postgresql";
-          database = "synapse";
+          dbname = "synapse";
           user = "matrix-synapse";
           cp_min = 1;
           cp_max = 5;

hosts/bicep/services/minecraft-heatmap.nix

@@ -43,7 +43,7 @@ in
         sshCommand = ''${pkgs.openssh}/bin/ssh -o UserKnownHostsFile='${knownHostsFile}' -i \"$CREDENTIALS_DIRECTORY\"/sshkey'';
       in [
         "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.minecraftLogsDir}'"
-        "${lib.getExe pkgs.rsync} ${rsyncArgs} --rsh=\"${sshCommand}\" root@innovation.pvv.ntnu.no:. '${cfg.minecraftLogsDir}'/"
+        "${lib.getExe pkgs.rsync} ${rsyncArgs} --rsh=\"${sshCommand}\" root@innovation.pvv.ntnu.no:/ '${cfg.minecraftLogsDir}'/"
       ];
     };
   };

hosts/bicep/services/postgresql/default.nix

@@ -127,27 +127,4 @@ in
 
   networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
   networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
-
-  environment.systemPackages = [
-    (pkgs.writeShellApplication {
-      name = "postgres-update-collations.sh";
-      runtimeInputs = [
-        config.systemd.package
-        cfg.package
-      ];
-      text = ''
-        run0 --user=postgres psql <${pkgs.writeText "postgres-update-collations.sql" ''
-          CREATE FUNCTION exec(text) returns text language plpgsql volatile
-            AS $f$
-              BEGIN
-                EXECUTE $1;
-                RETURN $1;
-              END;
-          $f$;
-
-          SELECT exec('ALTER DATABASE "' || datname || '" REFRESH COLLATION VERSION') FROM pg_database WHERE datistemplate = false;
-        ''}
-      '';
-    })
-  ];
 }

hosts/brzeczyszczykiewicz/hardware-configuration.nix

@@ -16,7 +16,6 @@
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
       fsType = "ext4";
-      options = [ "relatime" ];
     };
 
   fileSystems."/boot" =

hosts/georg/hardware-configuration.nix

@@ -16,7 +16,6 @@
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
       fsType = "ext4";
-      options = [ "relatime" ];
     };
 
   fileSystems."/boot" =

hosts/gluttony/hardware-configuration.nix

@@ -28,7 +28,6 @@
   fileSystems."/" = {
     device = "/dev/mapper/pool-root";
     fsType = "ext4";
-    options = [ "relatime" ];
   };
 
   fileSystems."/boot" = {

hosts/gluttony/services/bluemap.nix

@@ -93,7 +93,7 @@ in {
           no-group = true;
           rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
         };
-      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:. ${vanillaSurvival}";
+      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
       ExecStartPost = let
         rsyncArgs = lib.cli.toCommandLineShellGNU { } {
           archive = true;
@@ -103,7 +103,7 @@ in {
           no-group = true;
           rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
         };
-      in "${lib.getExe pkgs.rsync} ${rsyncArgs} --groupmap=root:nginx ${config.services.bluemap.webRoot}/ root@bekkalokk.pvv.ntnu.no:.";
+      in "${lib.getExe pkgs.rsync} ${rsyncArgs} --groupmap=root:nginx ${config.services.bluemap.webRoot}/ root@bekkalokk.pvv.ntnu.no:/";
       LoadCredential = [
         "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
         "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"

hosts/ildkule/services/monitoring/default.nix

@@ -2,10 +2,10 @@
 
 {
   imports = [
-    ./gatus
     ./grafana.nix
     ./loki.nix
     ./prometheus
     ./scrutiny.nix
+    ./uptime-kuma.nix
   ];
 }

hosts/ildkule/services/monitoring/gatus/default.nix

@@ -1,153 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.services.gatus;
-in
-{
-  imports = [
-    ./minecraft-checker.nix
-  ];
-
-  services.gatus = {
-    enable = true;
-
-    settings = {
-      web = {
-        address = "127.0.0.1";
-        port = 19283;
-      };
-
-      storage = {
-        type = "sqlite";
-        path = "/var/lib/gatus/data.db";
-      };
-
-      ui = {
-        title = "PVV Nede!?";
-        header = "😭😭😭";
-        dashboard-heading = "PVV Nede!?";
-        dashboard-subheading = "Kan noen ringe drift?";
-      };
-
-      endpoints = let
-        mkMachine = name: {
-          inherit name;
-          group = "Machines";
-          url = "icmp://${name}.pvv.ntnu.no";
-          conditions = [
-            "[CONNECTED] == true"
-          ];
-        };
-
-        mkWebsite = name: url: {
-          inherit name url;
-          group = "Websites";
-          method = "GET";
-          conditions = [
-            "[STATUS] == 200"
-          ];
-        };
-
-        mkService = name: url: {
-          inherit name url;
-          group = "Services";
-          conditions = [
-            "[CONNECTED] == true"
-          ];
-        };
-      in (lib.sortOn (m: m.name) [
-        (mkMachine "bekkalokk")
-        (mkMachine "bicep")
-        (mkMachine "bikkje")
-        (mkMachine "brzeczyszczykiewicz")
-        (mkMachine "georg")
-        (mkMachine "gluttony")
-        (mkMachine "ildkule")
-        (mkMachine "kommode")
-        (mkMachine "lupine-1")
-        (mkMachine "lupine-2")
-        (mkMachine "lupine-3")
-        (mkMachine "lupine-4")
-        (mkMachine "lupine-5")
-        (mkMachine "skrot")
-        (mkMachine "temmie")
-        (mkMachine "wenche")
-
-        (mkMachine "balduzius")
-        (mkMachine "blossom")
-        (mkMachine "bubbles")
-        (mkMachine "buskerud")
-        (mkMachine "buttercup")
-        (mkMachine "demiurgen")
-        (mkMachine "drolsum")
-        (mkMachine "hildring")
-        (mkMachine "innovation")
-        (mkMachine "isvegg")
-        (mkMachine "knutsen")
-        (mkMachine "ludvigsen" // {
-          url = "icmp://ludvigsen-tap.pvv.ntnu.no";
-        })
-        (mkMachine "microbel")
-        (mkMachine "mirage")
-        (mkMachine "orchid")
-        (mkMachine "principal")
-        (mkMachine "sleipner")
-        (mkMachine "smask")
-        (mkMachine "tom")
-        (mkMachine "wegonke")
-      ]) ++ [
-        (mkWebsite "Bluemap" "https://minecraft.pvv.ntnu.no")
-        (mkWebsite "Element Web" "https://chat.pvv.ntnu.no")
-        (mkWebsite "Gitea" "https://git.pvv.ntnu.no/api/healthz" // {
-          conditions = [
-            "[STATUS] == 200"
-            "[BODY].status == pass"
-          ];
-        })
-        (mkWebsite "Grafana" "https://grafana.pvv.ntnu.no/api/health" // {
-          conditions = [
-            "[STATUS] == 200"
-            "[BODY].database == ok"
-          ];
-        })
-        (mkWebsite "Grzegorz - Brzeczyszczykiewicz" "https://brzeczyszczykiewicz.pvv.ntnu.no")
-        (mkWebsite "Grzegorz - Georg" "https://georg.pvv.ntnu.no")
-        (mkWebsite "IDP" "https://idp.pvv.ntnu.no")
-        (mkWebsite "Mailing Lists" "http://list.pvv.ntnu.no")
-        (mkWebsite "Mapcrafter" "http://isvegg.pvv.ntnu.no/kart")
-        (mkWebsite "PVV-Nettsiden" "https://www.pvv.ntnu.no")
-        (mkWebsite "Roundcube" "https://webmail.pvv.ntnu.no/roundcube")
-        (mkWebsite "Scrutiny" "https://scrutiny.pvv.ntnu.no")
-        (mkWebsite "Snappymail" "http://snappymail.pvv.ntnu.no")
-        (mkWebsite "Userweb - Temmie" "https://temmie.pvv.ntnu.no/~oysteikt")
-        (mkWebsite "Userweb - Tom" "https://www.pvv.ntnu.no/~oysteikt")
-        (mkWebsite "Vaultwarden" "https://pw.pvv.ntnu.no/alive")
-        (mkWebsite "Wiki" "https://wiki.pvv.ntnu.no/w/api.php?action=query&format=json")
-
-        (mkService "Gitea SSH" "ssh://git.pvv.ntnu.no:2222")
-        (mkService "QoTD" "tcp://bekkalokk.pvv.ntnu.no:17")
-        (mkService "Minecraft" "http://localhost:25565" // {
-          conditions = [
-            "[STATUS] == 200"
-            "[BODY].ok == true"
-          ];
-        })
-        (mkService "Email (SMTP)" "tcp://mail.pvv.ntnu.no:587")
-        (mkService "Email (POP3)" "tcp://mail.pvv.ntnu.no:995")
-        (mkService "Email (IMAP)" "tcp://mail.pvv.ntnu.no:993")
-        (mkService "Matrix Synapse" "https://matrix.pvv.ntnu.no/_matrix/client/versions" // {
-          method = "GET";
-          conditions = [
-            "[STATUS] == 200"
-          ];
-        })
-      ];
-    };
-  };
-
-  services.nginx.virtualHosts."status.pvv.ntnu.no" = lib.mkIf cfg.enable {
-    enableACME = true;
-    forceSSL = true;
-    kTLS = true;
-    locations."/".proxyPass = "http://localhost:${toString cfg.settings.web.port}";
-  };
-}

hosts/ildkule/services/monitoring/gatus/minecraft-checker.nix

@@ -1,79 +0,0 @@
-{ lib, pkgs, ... }:
-{
-  systemd.sockets."gatus-minecraft-checker" = {
-    wantedBy = [ "sockets.target" ];
-    listenStreams = [ "25565" ];
-    socketConfig = {
-      SocketMode = "0666";
-      Accept = false;
-    };
-  };
-
-  systemd.services."gatus-minecraft-checker" = {
-    serviceConfig = {
-      ExecStart = lib.getExe (pkgs.writers.writePython3Bin "gatus-minecraft-checker" {
-        libraries = with pkgs.python3Packages; [
-          # sdnotify
-          mcstatus
-        ];
-        flakeIgnore = [ "E501" "E704" ];
-      } ''
-        import socket
-        import json
-        from http.server import HTTPServer, BaseHTTPRequestHandler
-
-        from mcstatus import JavaServer
-
-
-        class Handler(BaseHTTPRequestHandler):
-            def do_GET(self):
-                try:
-                    mcserver = JavaServer.lookup("minecraft.pvv.ntnu.no")
-                    status = mcserver.status()
-
-                    body = {
-                        "ok": True,
-                        "players": status.players.online,
-                        "version": status.version.name,
-                        "latency": status.latency,
-                    }
-
-                    data = json.dumps(body).encode()
-
-                    self.send_response(200)
-                    self.send_header("Content-Type", "application/json")
-                    self.send_header("Content-Length", str(len(data)))
-                    self.end_headers()
-                    self.wfile.write(data)
-
-                except Exception as e:
-                    data = json.dumps({"ok": False, "error": str(e)}).encode()
-                    self.send_response(500)
-                    self.end_headers()
-                    self.wfile.write(data)
-
-
-        class NoBindHTTPServer(HTTPServer):
-            def server_bind(): pass
-            def server_activate(): pass
-
-
-        def main():
-            httpd = NoBindHTTPServer(
-                ("", 0),
-                Handler,
-                bind_and_activate=False,
-            )
-            httpd.socket = socket.fromfd(3, socket.AF_INET, socket.SOCK_STREAM)
-            httpd.serve_forever()
-
-
-        if __name__ == '__main__':
-            main()
-      '');
-
-      NoNewPrivileges = true;
-      PrivateTmp = true;
-    };
-  };
-}

hosts/ildkule/services/monitoring/loki.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, values, ... }:
+{ config, pkgs, ... }:
 
 let
   cfg = config.services.loki;
@@ -9,8 +9,8 @@ in {
     configuration = {
       auth_enabled = false;
       server = {
-        http_listen_port = 31832;
+        http_listen_port = 3100;
-        http_listen_address = "127.0.0.1";
+        http_listen_address = "0.0.0.0";
         grpc_listen_port = 9096;
       };
 
@@ -81,25 +81,5 @@ in {
     };
   };
 
-  services.nginx.virtualHosts."loki.pvv.ntnu.no" = {
+  networking.firewall.allowedTCPPorts = [ cfg.configuration.server.http_listen_port ];
-    forceSSL = true;
-    enableACME = true;
-    kTLS = true;
-
-    locations = {
-      "/".return = "403";
-      "/loki/api/v1/push" = {
-        proxyPass = "http://${cfg.configuration.server.http_listen_address}:${toString cfg.configuration.server.http_listen_port}/loki/api/v1/push";
-        extraConfig = ''
-          allow 127.0.0.1;
-          allow ::1;
-          allow ${values.ipv4-space};
-          allow ${values.ipv6-space};
-          allow ${values.ntnu.ipv4-space};
-          allow ${values.ntnu.ipv6-space};
-          deny all;
-        '';
-      };
-    };
-  };
 }

hosts/ildkule/services/monitoring/uptime-kuma.nix

@@ -0,0 +1,44 @@
+{ config, pkgs, lib, values, ... }:
+let
+  cfg = config.services.uptime-kuma;
+  domain = "status.pvv.ntnu.no";
+  stateDir = "/data/monitoring/uptime-kuma";
+in {
+  services.uptime-kuma = {
+    enable = true;
+    settings = {
+      PORT = "5059";
+      HOST = "127.0.1.2";
+    };
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    enableACME = true;
+    forceSSL = true;
+    kTLS = true;
+    locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
+  };
+
+  fileSystems."/var/lib/private/uptime-kuma" = {
+    device = stateDir;
+    fsType = "bind";
+    options = [ "bind" ];
+  };
+
+  services.rsync-pull-targets = {
+    enable = true;
+    locations.${stateDir} = {
+      user = "root";
+      rrsyncArgs.ro = true;
+      authorizedKeysAttrs = [
+        "restrict"
+        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
+        "no-agent-forwarding"
+        "no-port-forwarding"
+        "no-pty"
+        "no-X11-forwarding"
+      ];
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXzcDm6cVr4NmWzUSroy33FlielKqaG83wY0RCMC0p/ uptime_kuma rsync backup";
+    };
+  };
+}

hosts/kommode/disks.nix

@@ -48,7 +48,6 @@
 
                 # swap.swapfile.size = "4G";
                 mountpoint = "/";
-                mountOptions = [ "relatime" ];
               };
             };
 

hosts/kommode/services/gitea/default.nix

@@ -136,7 +136,7 @@ in {
       picture = {
         AVATAR_MAX_FILE_SIZE = 1024 * 1024 * 5;
         # NOTE: go any bigger than this, and gitea will freeze your gif >:(
-        AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 4;
+        AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 2;
       };
       actions.ENABLED = true;
       webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," [

hosts/lupine/configuration.nix

@@ -5,8 +5,6 @@
 
     (fp /base)
     ./services/gitea-runner.nix
-  ] ++ lib.optionals (lupineName == "lupine-5") [
-    ./services/openvpn.nix
   ];
 
   sops.defaultSopsFile = fp /secrets/lupine/lupine.yaml;
@@ -17,61 +15,14 @@
     "i686-linux"
   ];
 
-  systemd.network = if (lupineName != "lupine-5")
+  systemd.network.networks."30-enp0s31f6" = values.defaultNetworkConfig // {
-    then {
+    matchConfig.Name = "enp0s31f6";
-      networks."30-enp0s31f6" =  (values.defaultNetworkConfig // {
+    address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
-        matchConfig.Name = "enp0s31f6";
+    networkConfig.LLDP = false;
-        address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
+  };
-        networkConfig.LLDP = false;
+  systemd.network.wait-online = {
-      });
+    anyInterface = true;
-
+  };
-      wait-online = {
-        anyInterface = true;
-      };
-    }
-    else {
-      netdevs."10-br0".netdevConfig = {
-        Name = "br0";
-        Kind = "bridge";
-      };
-
-      netdevs."20-tap0".netdevConfig = {
-        Name = "tap0";
-        Kind = "tap";
-      };
-
-      networks."10-enp0s31f6" = {
-        matchConfig.Name = "enp0s31f6";
-        bridge = [ "br0" ];
-      };
-
-      networks."20-br0" = {
-        matchConfig.Name = "br0";
-
-        address = with values.hosts.${lupineName}; [
-          (ipv4 + "/25")
-          (ipv6 + "/64")
-          values.services.knutsen-vpn
-        ];
-        networkConfig.LLDP = false;
-
-        dns = ["129.241.0.200" "129.241.0.201" "2001:700:300:1900::200" "2001:700:300:1900::201"];
-        domains = ["pvv.ntnu.no" "pvv.org"];
-        gateway = [values.hosts.gateway values.hosts.gateway6];
-
-        networkConfig.IPv6AcceptRA = "no";
-        DHCP = "no";
-      };
-
-      networks."30-tap0" = {
-        matchConfig.Name = "tap0";
-        bridge = [ "br0" ];
-      };
-
-      wait-online = {
-        anyInterface = true;
-      };
-    };
 
   # Don't change (even during upgrades) unless you know what you are doing.
   # See https://search.nixos.org/options?show=system.stateVersion

hosts/lupine/services/openvpn.nix

@@ -1,101 +0,0 @@
-{ config, pkgs, lib, values, ... }:
-let
-  renderConfig = attrs: lib.pipe attrs [
-    (lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
-    (builtins.mapAttrs (_: value:
-      if builtins.isList value then builtins.concatStringsSep " " (map toString value)
-      else if value == true then value
-      else if builtins.any (f: f value) [
-        builtins.isString
-        builtins.isInt
-        builtins.isFloat
-        lib.isPath
-        lib.isDerivation
-      ] then toString value
-      else throw "Unknown value in lupine openvpn config:\n${value}"
-    ))
-    (lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
-    (builtins.concatStringsSep "\n")
-    (x: x + "\n\n")
-  ];
-in
-{
-  sops.secrets = {
-    "openvpn/ca/crt" = { };
-    "openvpn/server/crt" = { };
-    "openvpn/server/key" = { };
-  };
-
-  services.openvpn.servers."ov-tunnel" = {
-    config = renderConfig {
-      mode = "server";
-
-      # TODO: use aliases
-      local = "0.0.0.0";
-      port = 1194;
-      proto = "udp";
-
-      dev = "tap0";
-      dev-type = "tap";
-
-      script-security = 0;
-
-      ca = config.sops.secrets."openvpn/ca/crt".path;
-      cert = config.sops.secrets."openvpn/server/crt".path;
-      key = config.sops.secrets."openvpn/server/key".path;
-      dh = "none";
-
-      # Maintain a record of client <-> virtual IP address
-      # associations in this file.  If OpenVPN goes down or
-      # is restarted, reconnecting clients can be assigned
-      # the same virtual IP address from the pool that was
-      # previously assigned.
-
-      # ifconfig-pool-persist = ./ipp.txt;
-
-      server-bridge = builtins.concatStringsSep " " [
-        # Gateway
-        "129.241.210.129"
-        # Netmask
-        "255.255.255.128"
-        # Pool start
-        values.services.knutsen-tap
-        # Pool end
-        values.services.ludvigsen-tap
-      ];
-
-      keepalive = "10 120";
-
-      user = "nobody";
-      group = "nobody";
-
-      status = "/var/log/openvpn-status.log";
-
-      client-config-dir = pkgs.writeTextDir "ludvigsen" ''
-        # Sett IP-adr. for tap0 til ludvigsens PVV-addresse.
-        ifconfig-push ${values.services.ludvigsen-tap} 255.255.255.128
-
-        # Hvordan skal man faa dette til aa funke, tro?
-        # ifconfig-ipv6-push 2001:700:300:1900::xxx/64
-
-        # La ludvigsen bruke std. PVV-gateway til all trafikk (unntatt VPN-tunnellen).
-        push "redirect-gateway"
-      '';
-
-      persist-key = true;
-      persist-tun = true;
-
-      tls-version-min = "1.2";
-      tls-version-max = "1.2";
-
-      verb = 5;
-
-      explicit-exit-notify = 1;
-    };
-  };
-
-  networking.firewall = {
-    allowedTCPPorts = [ 1194 ];
-    allowedUDPPorts = [ 1194 ];
-  };
-}

hosts/shark/hardware-configuration.nix

@@ -16,7 +16,6 @@
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/224c45db-9fdc-45d4-b3ad-aaf20b3efa8a";
       fsType = "ext4";
-      options = [ "relatime" ];
     };
 
   fileSystems."/boot" =

hosts/skrot/disk-config.nix

@@ -31,7 +31,6 @@
                 type = "filesystem";
                 format = "ext4";
                 mountpoint = "/";
-                mountOptions = [ "relatime" ];
               };
             };
           };

hosts/temmie/hardware-configuration.nix

@@ -16,7 +16,6 @@
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/c3aed415-0054-4ac5-8d29-75a99cc26451";
       fsType = "btrfs";
-      options = [ "relatime" ];
     };
 
   fileSystems."/boot" =

hosts/temmie/services/nfs-mounts.nix

@@ -88,8 +88,9 @@ in
           [[ -d "$dir" ]] || continue
 
           uid="$(stat -c '%u' "$dir")"
+          username="$(basename "$dir")"
 
-          mountpoint="/run/pvvhome/by-uid/$uid"
+          mountpoint="/run/pvvhome/by-uid/$uid/$1/$username"
           mkdir -p "$mountpoint"
 
           unit_name=$(systemd-escape --path --suffix=mount "$mountpoint")

hosts/temmie/services/userweb/default.nix

@@ -1,5 +1,6 @@
 {
   imports = [
+    ./fcgiwrap.nix
     ./httpd.nix
     ./log-processor.nix
     ./mail.nix

hosts/temmie/services/userweb/fcgiwrap.nix

@@ -0,0 +1,85 @@
+{ config, lib, pkgs, ... }:
+let
+  mcfg = config.services.pvv-userweb;
+in
+{
+  config = lib.mkIf mcfg.enable {
+    systemd.slices.system-userweb-fcgiwrap = { };
+
+    # NOTE: expected %i here is the UID of the user
+    systemd.sockets."userweb-fcgiwrap@" = {
+      description = "UserWeb fcgiwrap server for user %i";
+      socketConfig = {
+        ListenStream = "/run/userweb-fcgiwrap/%i.sock";
+        RemoveOnStop = true;
+
+        SocketUser = "wwwrun";
+        SocketGroup = "wwwrun";
+        SocketMode = "0660";
+      };
+    };
+
+    systemd.services."userweb-fcgiwrap@" = {
+      after = [
+        "httpd-passwd-sync.service"
+      ];
+      requires = [
+        "httpd-passwd-sync.service"
+      ];
+      documentation = [ "man:fcgiwrap(8)" ];
+
+      unitConfig = {
+        AssertPathExists = "/run/pvvhome/by-uid/%i";
+      };
+
+      serviceConfig = {
+
+        Slice = "system-userweb-fcgiwrap.slice";
+        Type = "simple";
+        User = "%i";
+
+        ExecStart = "${lib.getExe pkgs.fcgiwrap}";
+
+        RuntimeDirectoryMode = "0750";
+        RuntimeDirectory = [
+          "fcgiwrap/%i/root-mnt"
+        ];
+        RootDirectory = "/run/fcgiwrap/%i/root-mnt";
+        MountAPIVFS = true;
+        BindReadOnlyPaths = [
+          builtins.storeDir
+          "/etc"
+
+          # TODO: set up minimal fake passwd + group in `ExecStartPre` instead
+          "/var/lib/httpd-passwd-sync/passwd:/etc/passwd"
+          "/var/lib/httpd-passwd-sync/group:/etc/group"
+
+          "${pkgs.writeText "userweb-fake-nsswitch.conf" ''
+            passwd:    files
+            group:     files
+            shadow:    files
+            sudoers:   files
+
+            hosts:     mymachines resolve [!UNAVAIL=return] files myhostname dns
+            networks:  files
+
+            ethers:    files
+            services:  files
+            protocols: files
+            rpc:       files
+
+            subuid:    files
+            subgid:    files
+          ''}:/etc/nsswitch.conf"
+        ] ++ lib.optionals mcfg.debugMode [
+          "/bin"
+        ] ++ mcfg.fhsBindPaths;
+
+        # TODO: handle /amd/homepvv${l}
+        BindPaths = [
+          "/run/pvvhome/by-uid/%i:/home/pvv"
+        ];
+      };
+    };
+  };
+}

hosts/temmie/services/userweb/httpd.nix

@@ -277,30 +277,7 @@ in
         "/dev/null"
         "/var/lib/acme"
         "/var/run/nscd"
-        "${mcfg.fhsEnv}/bin:/bin"
+      ] ++ mcfg.fhsBindPaths;
-        "${mcfg.fhsEnv}/sbin:/sbin"
-        "${mcfg.fhsEnv}/lib:/lib"
-        "${mcfg.fhsEnv}/share:/share"
-      ] ++ (lib.mapCartesianProduct ({ parent, child }: "${mcfg.fhsEnv}${child}:${parent}${child}") {
-        parent = [
-          "/local"
-          "/opt"
-          "/opt/local"
-          "/store"
-          "/store/gnu"
-          "/usr"
-          "/usr/local"
-          "/run/current-system/sw"
-        ];
-        child = [
-          "/bin"
-          "/sbin"
-          "/lib"
-          "/libexec"
-          "/include"
-          "/share"
-        ];
-      });
       BindPaths = (lib.mapCartesianProduct ({ directoryFn, letter }: "/run/pvvhome/${letter}:${directoryFn letter}${letter}") {
         directoryFn = [
           (_: "/home/pvv/")

hosts/temmie/services/userweb/module.nix

@@ -106,6 +106,36 @@ in
         ];
       };
     };
+
+    fhsBindPaths = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      readOnly = true;
+      default = [
+        "${cfg.fhsEnv}/bin:/bin"
+        "${cfg.fhsEnv}/sbin:/sbin"
+        "${cfg.fhsEnv}/lib:/lib"
+        "${cfg.fhsEnv}/share:/share"
+      ] ++ (lib.mapCartesianProduct ({ parent, child }: "${cfg.fhsEnv}${child}:${parent}${child}") {
+        parent = [
+          "/local"
+          "/opt"
+          "/opt/local"
+          "/store"
+          "/store/gnu"
+          "/usr"
+          "/usr/local"
+          "/run/current-system/sw"
+        ];
+        child = [
+          "/bin"
+          "/sbin"
+          "/lib"
+          "/libexec"
+          "/include"
+          "/share"
+        ];
+      });
+    };
   };
 
   config = lib.mkIf cfg.enable {

hosts/wenche/hardware-configuration.nix

@@ -13,7 +13,6 @@
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/4e8ecdd2-d453-4fff-b952-f06da00f3b85";
       fsType = "ext4";
-      options = [ "relatime" ];
     };
 
   swapDevices = [ {

values.nix

@@ -26,10 +26,6 @@ in rec {
       ipv4 = pvv-ipv4 213;
       ipv6 = pvv-ipv6 213;
     };
-
-    knutsen-vpn = pvv-ipv4 191;
-    knutsen-tap = pvv-ipv4 253;
-    ludvigsen-tap = pvv-ipv4 254;
   };
 
   hosts = {