only cross compile when necessary

Co-authored-by: System administrator <root@skrot.pvv.ntnu.no>
Reviewed-on: https://git.pvv.ntnu.no/Drift/pvv-nixos-config/pulls/124
Co-authored-by: Vegard Bieker Matthey <VegardMatthey@protonmail.com>
Co-committed-by: Vegard Bieker Matthey <VegardMatthey@protonmail.com>

.mailmap

@@ -23,3 +23,9 @@ Adrian Gunnar Lauterer <adriangl@pvv.ntnu.no> Adrian Gunnar Lauterer <adrian@lau
 
 Fredrik Robertsen <frero@pvv.ntnu.no> frero <frero@pvv.ntnu.no>
 Fredrik Robertsen <frero@pvv.ntnu.no> fredrikr79 <fredrikrobertsen7@gmail.com>
+Fredrik Robertsen <frero@pvv.ntnu.no> fredrik <fredrikr79@pm.me>
+
+Vegard Bieker Matthey <vegardbm@pvv.ntnu.no> Vegard Matthey <VegardMatthey@protonmail.com>
+Vegard Bieker Matthey <vegardbm@pvv.ntnu.no> Vegard Bieker Matthey <VegardMatthey@protonmail.com>
+
+Albert Bayazidi <albertba@pvv.ntnu.no> Albert <albert.bayazidi@gmail.com>

.sops.yaml

@@ -20,7 +20,9 @@ keys:
   - &host_lupine-3 age1j2u876z8hu87q5npfxzzpfgllyw8ypj66d7cgelmzmnrf3xud34qzkntp9
   - &host_lupine-4 age1t8zlawqkmhye737pn8yx0z3p9cl947d9ktv2cajdc6hnvn52d3fsc59s2k
   - &host_lupine-5 age199zkqq4jp4yc3d0hx2q0ksxdtp42xhmjsqwyngh8tswuck34ke3smrfyqu
+  - &host_skrott age1lpkju2e053aaddpgsr4ef83epclf4c9tp4m98d35ft2fswr8p4tq2ua0mf
   - &host_ustetind age1hffjafs4slznksefmtqrlj7rdaqgzqncn4un938rhr053237ry8s3rs0v8
+  - &host_skrot age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr
 
 creation_rules:
   # Global secrets
@@ -137,10 +139,24 @@ creation_rules:
   - path_regex: secrets/skrott/[^/]+\.yaml$
     key_groups:
     - age:
+      - *host_skrott
       - *user_danio
       - *user_felixalb
       - *user_pederbs_sopp
       - *user_pederbs_nord
       - *user_pederbs_bjarte
+      - *user_vegardbm
+      pgp:
+      - *user_oysteikt
+  - path_regex: secrets/skrot/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_skrot
+      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      - *user_vegardbm
       pgp:
       - *user_oysteikt

README.md

@@ -43,6 +43,7 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
 | [kommode][kom]             | Virtual  | Gitea + Gitea pages                                       |
 | [lupine][lup]              | Physical | Gitea CI/CD runners                                       |
 |  shark                     | Virtual  | Test host for authentication, absolutely horrendous       |
+| [skrot/skrott][skr]        | Physical | Kiosk, snacks and soda                                    |
 | [wenche][wen]              | Virtual  | Nix-builders, general purpose compute                     |
 
 ## Documentation
@@ -59,4 +60,5 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
 [ild]: https://wiki.pvv.ntnu.no/wiki/Maskiner/ildkule
 [kom]: https://wiki.pvv.ntnu.no/wiki/Maskiner/kommode
 [lup]: https://wiki.pvv.ntnu.no/wiki/Maskiner/lupine
+[skr]: https://wiki.pvv.ntnu.no/wiki/Maskiner/Skrott
 [wen]: https://wiki.pvv.ntnu.no/wiki/Maskiner/wenche

base/default.nix

@@ -81,7 +81,7 @@
     AllowHibernation=no
   '';
 
-  users.mutableUsers = lib.mkDefault false;
+  # users.mutableUsers = lib.mkDefault false;
 
   users.groups."drift".name = "drift";
 

base/nix.nix

@@ -1,4 +1,9 @@
-{ lib, config, inputs, ... }:
+{
+  lib,
+  config,
+  inputs,
+  ...
+}:
 {
   nix = {
     gc = {
@@ -11,16 +16,21 @@
       allow-dirty = true;
       auto-allocate-uids = true;
       builders-use-substitutes = true;
-      experimental-features = [ "nix-command" "flakes" "auto-allocate-uids" ];
+      experimental-features = [
+        "nix-command"
+        "flakes"
+        "auto-allocate-uids"
+      ];
       log-lines = 50;
       use-xdg-base-directories = true;
     };
 
-    /* This makes commandline tools like
+    /*
-    ** nix run nixpkgs#hello
+      This makes commandline tools like
-    ** and nix-shell -p hello
+      ** nix run nixpkgs#hello
-    ** use the same channel the system
+      ** and nix-shell -p hello
-    ** was built with
+      ** use the same channel the system
+      ** was built with
     */
     registry = lib.mkMerge [
       {

base/programs.nix

@@ -13,9 +13,15 @@
     # Debug and find files
     file
 
+    # Process json data
+    jq
+
     # Check computer specs
     lshw
 
+    # Check who is keeping open files
+    lsof
+
     # Scan for open ports with netstat
     net-tools
 
@@ -54,6 +60,8 @@
   programs.nano.enable = true;
   # Same reasoning as nano
   programs.vim.enable = true;
+  # Same reasoning as vim
+  programs.neovim.enable = true;
 
   # Some people like this shell for some reason
   programs.zsh.enable = true;

base/services/acme.nix

@@ -2,14 +2,12 @@
 {
   security.acme = {
     acceptTerms = true;
-    defaults.email = "drift@pvv.ntnu.no";
+    defaults.email = "acme-drift@pvv.ntnu.no";
   };
 
   # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
   virtualisation.vmVariant = {
     security.acme.defaults.server = "https://127.0.0.1";
-    security.acme.preliminarySelfsigned = true;
-
     users.users.root.initialPassword = "root";
   };
-}
+}

base/services/auto-upgrade.nix

@@ -1,4 +1,10 @@
-{ config, inputs, pkgs, lib, ... }:
+{
+  config,
+  inputs,
+  pkgs,
+  lib,
+  ...
+}:
 
 let
   inputUrls = lib.mapAttrs (input: value: value.url) (import "${inputs.self}/flake.nix").inputs;
@@ -16,26 +22,34 @@ in
       # --update-input is deprecated since nix 2.22, and removed in lix 2.90
       # as such we instead use --override-input combined with --refresh
       # https://git.lix.systems/lix-project/lix/issues/400
-    ] ++ (lib.pipe inputUrls [
+    ]
+    ++ (lib.pipe inputUrls [
       (lib.intersectAttrs {
         nixpkgs = { };
         nixpkgs-unstable = { };
       })
-      (lib.mapAttrsToList (input: url: ["--override-input" input url]))
+      (lib.mapAttrsToList (
+        input: url: [
+          "--override-input"
+          input
+          url
+        ]
+      ))
       lib.concatLists
     ]);
   };
 
   # workaround for https://github.com/NixOS/nix/issues/6895
   # via https://git.lix.systems/lix-project/lix/issues/400
-  environment.etc = lib.mkIf (!config.virtualisation.isVmVariant) {
+  environment.etc =
-    "current-system-flake-inputs.json".source
+    lib.mkIf (!config.virtualisation.isVmVariant && config.system.autoUpgrade.enable)
-      = pkgs.writers.writeJSON "flake-inputs.json" (
+      {
-        lib.flip lib.mapAttrs inputs (name: input:
+        "current-system-flake-inputs.json".source = pkgs.writers.writeJSON "flake-inputs.json" (
-          # inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
+          lib.flip lib.mapAttrs inputs (
-          lib.removeAttrs (input.sourceInfo or {}) [ "outPath" ]
+            name: input:
-            // { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
+            # inputs.*.sourceInfo sans outPath, since writeJSON will otherwise serialize sourceInfo like a derivation
-        )
+            lib.removeAttrs (input.sourceInfo or { }) [ "outPath" ] // { store-path = input.outPath; } # comment this line if you don't want to retain a store reference to the flake inputs
-      );
+          )
-  };
+        );
+      };
 }

base/services/irqbalance.nix

@@ -1,4 +1,4 @@
 { ... }:
 {
   services.irqbalance.enable = true;
-}
+}

base/services/journald-upload.nix

@@ -1,4 +1,9 @@
-{ config, lib, values, ... }:
+{
+  config,
+  lib,
+  values,
+  ...
+}:
 let
   cfg = config.services.journald.upload;
 in

base/services/logrotate.nix

@@ -1,7 +1,10 @@
 { ... }:
 {
   systemd.services.logrotate = {
-    documentation = [ "man:logrotate(8)" "man:logrotate.conf(5)" ];
+    documentation = [
+      "man:logrotate(8)"
+      "man:logrotate.conf(5)"
+    ];
     unitConfig.RequiresMountsFor = "/var/log";
     serviceConfig.ReadWritePaths = [ "/var/log" ];
   };

base/services/nginx.nix

@@ -11,7 +11,10 @@
     };
   };
 
-  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
+  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [
+    80
+    443
+  ];
 
   services.nginx = {
     recommendedTlsSettings = true;

base/services/openssh.nix

@@ -12,10 +12,9 @@
     settings.PermitRootLogin = "yes";
 
   };
-    users.users."root".openssh.authorizedKeys.keys = [
+  users.users."root".openssh.authorizedKeys.keys = [
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqVt4LCe0YIttr9swFxjkjn37ZDY9JxwVC+2gvfSINDJorOCtqPjDOTD2fTS1Gz08QCwpnLWq2kyvRchu6WgriAbSACpbZZBgxRaF/FVh3oiMVFGnNKGnv6/fdo/vZtu8mUVuqtmTrgLYpZdbR4oD3XiBlDKs7Cv5hPqt95lnP6MNFvE8mICCfd1PwhsABd2IQ5laz3u77/RXhNFJL0Kf2/+6gk9awcLuwHrPdvq7c3BxRHbc9UMRQENyjyQPa7aLe+uJBFLKP51I8VBuDpDacuibQx7nMt6N2UJ2KWI0JxRMHuJNq4S5jidR82aOw9gzGbTv30SKNLMqsZ0xj4LtdqCXDiZF6Lr09PsJYsvnBUFWa14HGcThKDtgwQwBryNViYmfv//0h9+RLZiU0ab+NEwSs7Zh5iAD+vhx64QqNX3tR7Le4SWXh8W0eShU9N78qYdSkiC3Ui7htxeqOocXM/P4AwbnHsLELIvkHdvgchCPvl8ygZa4WJTEWv16+ICskJcAKWGuqjvXAFuwjJJmPp9xLW9O0DFfQhMELiGamQR9wK07yYQVr34iah6qZO7cwhSKyEPFrVPIaNtfDhsjED639F7vmktf26SWNJHWfW0wOHILjI6TgqUvy0JDd8W8w0CHlAfz6Fs2l99NNgNF8dB3vBASbxS0hu/y0PVu/xQ== openstack-sleipner"
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqVt4LCe0YIttr9swFxjkjn37ZDY9JxwVC+2gvfSINDJorOCtqPjDOTD2fTS1Gz08QCwpnLWq2kyvRchu6WgriAbSACpbZZBgxRaF/FVh3oiMVFGnNKGnv6/fdo/vZtu8mUVuqtmTrgLYpZdbR4oD3XiBlDKs7Cv5hPqt95lnP6MNFvE8mICCfd1PwhsABd2IQ5laz3u77/RXhNFJL0Kf2/+6gk9awcLuwHrPdvq7c3BxRHbc9UMRQENyjyQPa7aLe+uJBFLKP51I8VBuDpDacuibQx7nMt6N2UJ2KWI0JxRMHuJNq4S5jidR82aOw9gzGbTv30SKNLMqsZ0xj4LtdqCXDiZF6Lr09PsJYsvnBUFWa14HGcThKDtgwQwBryNViYmfv//0h9+RLZiU0ab+NEwSs7Zh5iAD+vhx64QqNX3tR7Le4SWXh8W0eShU9N78qYdSkiC3Ui7htxeqOocXM/P4AwbnHsLELIvkHdvgchCPvl8ygZa4WJTEWv16+ICskJcAKWGuqjvXAFuwjJJmPp9xLW9O0DFfQhMELiGamQR9wK07yYQVr34iah6qZO7cwhSKyEPFrVPIaNtfDhsjED639F7vmktf26SWNJHWfW0wOHILjI6TgqUvy0JDd8W8w0CHlAfz6Fs2l99NNgNF8dB3vBASbxS0hu/y0PVu/xQ== openstack-sleipner"
 
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCbgJ0Uwh9VSVhfId7l9i5/jk4CvAK5rbkiab8R+moF root@sleipner"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCbgJ0Uwh9VSVhfId7l9i5/jk4CvAK5rbkiab8R+moF root@sleipner"
-    ];
+  ];
 }
-

base/services/postfix.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   cfg = config.services.postfix;
 in

base/services/prometheus-node-exporter.nix

@@ -1,4 +1,9 @@
-{ config, lib, values, ... }:
+{
+  config,
+  lib,
+  values,
+  ...
+}:
 let
   cfg = config.services.prometheus.exporters.node;
 in

base/services/prometheus-systemd-exporter.nix

@@ -1,4 +1,9 @@
-{ config, lib, values, ... }:
+{
+  config,
+  lib,
+  values,
+  ...
+}:
 let
   cfg = config.services.prometheus.exporters.systemd;
 in

base/services/promtail.nix

@@ -1,4 +1,9 @@
-{ config, lib, values, ... }:
+{
+  config,
+  lib,
+  values,
+  ...
+}:
 let
   cfg = config.services.prometheus.exporters.node;
 in
@@ -10,29 +15,33 @@ in
         http_listen_port = 28183;
         grpc_listen_port = 0;
       };
-      clients = [{
+      clients = [
-        url = "http://ildkule.pvv.ntnu.no:3100/loki/api/v1/push";
+        {
-      }];
+          url = "http://ildkule.pvv.ntnu.no:3100/loki/api/v1/push";
-      scrape_configs = [{
+        }
-        job_name = "systemd-journal";
+      ];
-        journal = {
+      scrape_configs = [
-          max_age = "12h";
+        {
-          labels = {
+          job_name = "systemd-journal";
-            job = "systemd-journal";
+          journal = {
-            host = config.networking.hostName;
+            max_age = "12h";
+            labels = {
+              job = "systemd-journal";
+              host = config.networking.hostName;
+            };
           };
-        };
+          relabel_configs = [
-        relabel_configs = [
+            {
-          {
+              source_labels = [ "__journal__systemd_unit" ];
-            source_labels = [ "__journal__systemd_unit" ];
+              target_label = "unit";
-            target_label = "unit";
+            }
-          }
+            {
-          {
+              source_labels = [ "__journal_priority_keyword" ];
-            source_labels = [ "__journal_priority_keyword" ];
+              target_label = "level";
-            target_label = "level";
+            }
-          }
+          ];
-        ];
+        }
-      }];
+      ];
     };
   };
 }

base/services/smartd.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 {
   services.smartd = {
     # NOTE: qemu guests tend not to have SMART-reporting disks. Please override for the
@@ -14,9 +19,12 @@
     };
   };
 
-  environment.systemPackages = lib.optionals config.services.smartd.enable (with pkgs; [
+  environment.systemPackages = lib.optionals config.services.smartd.enable (
-    smartmontools
+    with pkgs;
-  ]);
+    [
+      smartmontools
+    ]
+  );
 
   systemd.services.smartd.unitConfig.ConditionVirtualization = "no";
 }

base/services/thermald.nix

@@ -2,7 +2,7 @@
 {
   # Let's not thermal throttle
   services.thermald.enable = lib.mkIf (lib.all (x: x) [
-      (config.nixpkgs.system == "x86_64-linux")
+    (config.nixpkgs.system == "x86_64-linux")
-      (!config.boot.isContainer or false)
+    (!config.boot.isContainer or false)
-    ]) true;
+  ]) true;
-}
+}

base/services/uptimed.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   cfg = config.services.uptimed;
 in
@@ -15,45 +20,48 @@ in
     services.uptimed = {
       enable = true;
 
-      settings = let
+      settings =
-        stateDir = "/var/lib/uptimed";
+        let
-      in {
+          stateDir = "/var/lib/uptimed";
-        PIDFILE = "${stateDir}/pid";
+        in
-        SENDMAIL = lib.mkDefault "${pkgs.system-sendmail}/bin/sendmail -t";
+        {
-      };
+          PIDFILE = "${stateDir}/pid";
+          SENDMAIL = lib.mkDefault "${pkgs.system-sendmail}/bin/sendmail -t";
+        };
     };
 
     systemd.services.uptimed = lib.mkIf (cfg.enable) {
-      serviceConfig = let
+      serviceConfig =
-        uptimed = pkgs.uptimed.overrideAttrs (prev: {
+        let
-          postPatch = ''
+          uptimed = pkgs.uptimed.overrideAttrs (prev: {
-             substituteInPlace Makefile.am \
+            postPatch = ''
-               --replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
+              substituteInPlace Makefile.am \
-             substituteInPlace src/Makefile.am \
+                --replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
-               --replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
+              substituteInPlace src/Makefile.am \
-          '';
+                --replace-fail '$(sysconfdir)/uptimed.conf' '/var/lib/uptimed/uptimed.conf'
-        });
+            '';
+          });
 
-      in {
+        in
-        Type = "notify";
+        {
+          Type = "notify";
 
-        ExecStart = lib.mkForce "${uptimed}/sbin/uptimed -f";
+          ExecStart = lib.mkForce "${uptimed}/sbin/uptimed -f";
 
-        BindReadOnlyPaths = let
+          BindReadOnlyPaths =
-          configFile = lib.pipe cfg.settings [
+            let
-            (lib.mapAttrsToList
+              configFile = lib.pipe cfg.settings [
-              (k: v:
+                (lib.mapAttrsToList (
-                if builtins.isList v
+                  k: v: if builtins.isList v then lib.mapConcatStringsSep "\n" (v': "${k}=${v'}") v else "${k}=${v}"
-                  then lib.mapConcatStringsSep "\n" (v': "${k}=${v'}") v
+                ))
-                  else "${k}=${v}")
+                (lib.concatStringsSep "\n")
-            )
+                (pkgs.writeText "uptimed.conf")
-            (lib.concatStringsSep "\n")
+              ];
-            (pkgs.writeText "uptimed.conf")
+            in
-          ];
+            [
-        in [
+              "${configFile}:/var/lib/uptimed/uptimed.conf"
-          "${configFile}:/var/lib/uptimed/uptimed.conf"
+            ];
-        ];
+        };
-      };
     };
   };
 }

base/sops.nix

@@ -1,8 +1,15 @@
-{ config, fp, lib, ... }:
 {
-  sops.defaultSopsFile = let
+  config,
-    secretsFilePath = fp /secrets/${config.networking.hostName}/${config.networking.hostName}.yaml;
+  fp,
-  in lib.mkIf (builtins.pathExists secretsFilePath) secretsFilePath;
+  lib,
+  ...
+}:
+{
+  sops.defaultSopsFile =
+    let
+      secretsFilePath = fp /secrets/${config.networking.hostName}/${config.networking.hostName}.yaml;
+    in
+    lib.mkIf (builtins.pathExists secretsFilePath) secretsFilePath;
 
   sops.age = lib.mkIf (config.sops.defaultSopsFile != null) {
     sshKeyPaths = lib.mkDefault [ "/etc/ssh/ssh_host_ed25519_key" ];

base/vm.nix

@@ -11,5 +11,6 @@
   };
   config.virtualisation.vmVariant = {
     virtualisation.isVmVariant = true;
+    virtualisation.graphics = false;
   };
 }

docs/secret-management.md

@@ -151,7 +151,7 @@ is up to date, you can do the following:
 
 ```console
 # Fetch gpg (unless you have it already)
-nix-shell -p gpg
+nix shell nixpkgs#gnupg
 
 # Import oysteikts key to the gpg keychain
 gpg --import ./keys/oysteikt.pub

flake.lock

@@ -2,17 +2,16 @@
   "nodes": {
     "dibbler": {
       "inputs": {
-        "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1768138611,
+        "lastModified": 1770133120,
-        "narHash": "sha256-KfZX6wpuwE2IRKLjh0DrEviE4f6kqLJWwKIE5QJSqa4=",
+        "narHash": "sha256-RuAWONXb+U3omSsuIPCrPcgj0XYqv+2djG0cnPGEyKg=",
         "ref": "main",
-        "rev": "cb385097dcda5fb9772f903688d078b30a66ccd4",
+        "rev": "3123b8b474319bc75ee780e0357dcdea69dc85e6",
-        "revCount": 221,
+        "revCount": 244,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
       },
@@ -61,23 +60,6 @@
         "type": "github"
       }
     },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "id": "flake-utils",
-        "type": "indirect"
-      }
-    },
     "gergle": {
       "inputs": {
         "nixpkgs": [
@@ -192,11 +174,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768749374,
+        "lastModified": 1769500363,
-        "narHash": "sha256-dhXYLc64d7TKCnRPW4TlHGl6nLRNdabJB2DpJ8ffUw0=",
+        "narHash": "sha256-vFxmdsLBPdTy5j2bf54gbTQi1XnWbZDmeR/BBh8MFrw=",
         "ref": "main",
-        "rev": "040294f2e1df46e33d995add6944b25859654097",
+        "rev": "2618e434e40e109eaab6a0693313c7e0de7324a3",
-        "revCount": 37,
+        "revCount": 47,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
       },
@@ -213,11 +195,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767906352,
+        "lastModified": 1770960722,
-        "narHash": "sha256-wYsH9MMAPFG3XTL+3DwI39XMG0F2fTmn/5lt265a3Es=",
+        "narHash": "sha256-IdhPsWFZUKSJh/nLjGLJvGM5d5Uta+k1FlVYPxTZi0E=",
         "ref": "main",
-        "rev": "d054c5d064b8ed6d53a0adb0cf6c0a72febe212e",
+        "rev": "c2e4aca7e1ba27cd09eeaeab47010d32a11841b2",
-        "revCount": 13,
+        "revCount": 15,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
       },
@@ -235,11 +217,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768955766,
+        "lastModified": 1769018862,
-        "narHash": "sha256-V9ns1OII7sWSbIDwPkiqmJ3Xu/bHgQzj+asgH9cTpOo=",
+        "narHash": "sha256-x3eMpPQhZwEDunyaUos084Hx41XwYTi2uHY4Yc4YNlk=",
         "owner": "oddlama",
         "repo": "nix-topology",
-        "rev": "71f27de56a03f6d8a1a72cf4d0dfd780bcc075bc",
+        "rev": "a15cac71d3399a4c2d1a3482ae62040a3a0aa07f",
         "type": "github"
       },
       "original": {
@@ -251,11 +233,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1768877948,
+        "lastModified": 1769724120,
-        "narHash": "sha256-Bq9Hd6DWCBaZ2GkwvJCWGnpGOchaD6RWPSCFxmSmupw=",
+        "narHash": "sha256-oQBM04hQk1kotfv4qmIG1tHmuwODd1+hqRJE5TELeCE=",
-        "rev": "43b2e61c9d09cf6c1c9c192fe6da08accc9bfb1d",
+        "rev": "8ec59ed5093c2a742d7744e9ecf58f358aa4a87d",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.4368.43b2e61c9d09/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/25.11-small/nixos-25.11.4961.8ec59ed5093c/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -279,11 +261,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1768886240,
+        "lastModified": 1769813739,
-        "narHash": "sha256-HUAAI7AF+/Ov1u3Vvjs4DL91zTxMkWLC4xJgQ9QxOUQ=",
+        "narHash": "sha256-RmNWW1DQczvDwBHu11P0hGwJZxbngdoymVu7qkwq/2M=",
-        "rev": "80e4adbcf8992d3fd27ad4964fbb84907f9478b0",
+        "rev": "16a3cae5c2487b1afa240e5f2c1811f172419558",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre930839.80e4adbcf899/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre937548.16a3cae5c248/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -318,11 +300,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768636400,
+        "lastModified": 1769009806,
-        "narHash": "sha256-AiSKT4/25LS1rUlPduBMogf4EbdMQYDY1rS7AvHFcxk=",
+        "narHash": "sha256-52xTtAOc9B+MBRMRZ8HI6ybNsRLMlHHLh+qwAbaJjRY=",
         "ref": "main",
-        "rev": "3a8f82b12a44e6c4ceacd6955a290a52d1ee2856",
+        "rev": "aa8adfc6a4d5b6222752e2d15d4a6d3b3b85252e",
-        "revCount": 573,
+        "revCount": 575,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       },
@@ -382,11 +364,11 @@
         "rust-overlay": "rust-overlay_3"
       },
       "locked": {
-        "lastModified": 1768140181,
+        "lastModified": 1769834595,
-        "narHash": "sha256-HfZzup5/jlu8X5vMUglTovVTSwhHGHwwV1YOFIL/ksA=",
+        "narHash": "sha256-P1jrO7BxHyIKDuOXHuUb7bi4H2TuYnACW5eqf1gG47g=",
         "ref": "main",
-        "rev": "834463ed64773939798589ee6fd4adfe3a97dddd",
+        "rev": "def4eec2d59a69b4638b3f25d6d713b703b2fa56",
-        "revCount": 43,
+        "revCount": 49,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
       },
@@ -446,11 +428,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767322002,
+        "lastModified": 1769309768,
-        "narHash": "sha256-yHKXXw2OWfIFsyTjduB4EyFwR0SYYF0hK8xI9z4NIn0=",
+        "narHash": "sha256-AbOIlNO+JoqRJkK1VrnDXhxuX6CrdtIu2hSuy4pxi3g=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "03c6e38661c02a27ca006a284813afdc461e9f7e",
+        "rev": "140c9dc582cb73ada2d63a2180524fcaa744fad5",
         "type": "github"
       },
       "original": {
@@ -466,11 +448,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768863606,
+        "lastModified": 1769469829,
-        "narHash": "sha256-1IHAeS8WtBiEo5XiyJBHOXMzECD6aaIOJmpQKzRRl64=",
+        "narHash": "sha256-wFcr32ZqspCxk4+FvIxIL0AZktRs6DuF8oOsLt59YBU=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c7067be8db2c09ab1884de67ef6c4f693973f4a2",
+        "rev": "c5eebd4eb2e3372fe12a8d70a248a6ee9dd02eff",
         "type": "github"
       },
       "original": {
@@ -479,21 +461,6 @@
         "repo": "sops-nix",
         "type": "github"
       }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -49,297 +49,403 @@
     qotd.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = { self, nixpkgs, nixpkgs-unstable, sops-nix, disko, ... }@inputs:
+  outputs =
-  let
+    {
-    inherit (nixpkgs) lib;
+      self,
-    systems = [
+      nixpkgs,
-      "x86_64-linux"
+      nixpkgs-unstable,
-      "aarch64-linux"
+      sops-nix,
-      "aarch64-darwin"
+      disko,
-    ];
+      ...
-    forAllSystems = f: lib.genAttrs systems f;
+    }@inputs:
-    allMachines = builtins.attrNames self.nixosConfigurations;
+    let
-    importantMachines = [
+      inherit (nixpkgs) lib;
-      "bekkalokk"
+      systems = [
-      "bicep"
+        "x86_64-linux"
-      "brzeczyszczykiewicz"
+        "aarch64-linux"
-      "georg"
+        "aarch64-darwin"
-      "ildkule"
+      ];
-    ];
+      forAllSystems = f: lib.genAttrs systems f;
-  in {
+      allMachines = builtins.attrNames self.nixosConfigurations;
-    inputs = lib.mapAttrs (_: src: src.outPath) inputs;
+      importantMachines = [
+        "bekkalokk"
+        "bicep"
+        "brzeczyszczykiewicz"
+        "georg"
+        "ildkule"
+      ];
+    in
+    {
+      inputs = lib.mapAttrs (_: src: src.outPath) inputs;
 
-    pkgs = forAllSystems (system:
+      pkgs = forAllSystems (
-      import nixpkgs {
+        system:
-        inherit system;
+        import nixpkgs {
-        config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
-          [
-            "nvidia-x11"
-            "nvidia-settings"
-          ];
-      });
-
-    nixosConfigurations = let
-      unstablePkgs = nixpkgs-unstable.legacyPackages.x86_64-linux;
-
-      nixosConfig =
-        nixpkgs:
-        name:
-        configurationPath:
-        extraArgs@{
-          system ? "x86_64-linux",
-          specialArgs ? { },
-          modules ? [ ],
-          overlays ? [ ],
-          enableDefaults ? true,
-          ...
-        }:
-        lib.nixosSystem (lib.recursiveUpdate
-        {
           inherit system;
-
+          config.allowUnfreePredicate =
-          specialArgs = {
+            pkg:
-            inherit unstablePkgs inputs;
+            builtins.elem (lib.getName pkg) [
-            values = import ./values.nix;
+              "nvidia-x11"
-            fp = path: ./${path};
+              "nvidia-settings"
-          } // specialArgs;
+            ];
-
-          modules = [
-            {
-              networking.hostName = lib.mkDefault name;
-            }
-            configurationPath
-          ] ++ (lib.optionals enableDefaults [
-            sops-nix.nixosModules.sops
-            inputs.roowho2.nixosModules.default
-          ]) ++ modules;
-
-          pkgs = import nixpkgs {
-            inherit system;
-            config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
-              [
-                "nvidia-x11"
-                "nvidia-settings"
-              ];
-            overlays = (lib.optionals enableDefaults [
-              # Global overlays go here
-              inputs.roowho2.overlays.default
-            ]) ++ overlays;
-          };
         }
-        (builtins.removeAttrs extraArgs [
-          "system"
-          "modules"
-          "overlays"
-          "specialArgs"
-          "enableDefaults"
-        ])
       );
 
-      stableNixosConfig = name: extraArgs:
+      nixosConfigurations =
-          nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
+        let
-    in {
+          nixosConfig =
-      bakke = stableNixosConfig "bakke" {
+            nixpkgs: name: configurationPath:
-        modules = [
+            extraArgs@{
-          disko.nixosModules.disko
+              localSystem ? "x86_64-linux", # buildPlatform
-        ];
+              crossSystem ? "x86_64-linux", # hostPlatform
-      };
+              specialArgs ? { },
-      bicep = stableNixosConfig "bicep" {
+              modules ? [ ],
-        modules = [
+              overlays ? [ ],
-          inputs.matrix-next.nixosModules.default
+              enableDefaults ? true,
-          inputs.pvv-calendar-bot.nixosModules.default
+              ...
-          inputs.minecraft-heatmap.nixosModules.default
+            }:
-          self.nixosModules.gickup
+            let
-          self.nixosModules.matrix-ooye
+              commonPkgsConfig = {
-        ];
+                config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg)
-        overlays = [
+                  [
-          inputs.pvv-calendar-bot.overlays.default
+                    "nvidia-x11"
-          inputs.minecraft-heatmap.overlays.default
+                    "nvidia-settings"
-          (final: prev: {
+                  ];
-            inherit (self.packages.${prev.stdenv.hostPlatform.system}) out-of-your-element;
+                overlays = (lib.optionals enableDefaults [
-          })
+                  # Global overlays go here
-        ];
+                  inputs.roowho2.overlays.default
-      };
+                ]) ++ overlays;
-      bekkalokk = stableNixosConfig "bekkalokk" {
+              } // (if localSystem != crossSystem then {
-        overlays = [
+                inherit localSystem crossSystem;
-          (final: prev: {
+              } else {
-            heimdal = unstablePkgs.heimdal;
+                system = crossSystem;
-            mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions { };
+              });
-            simplesamlphp = final.callPackage ./packages/simplesamlphp { };
-            bluemap = final.callPackage ./packages/bluemap.nix { };
-          })
-          inputs.pvv-nettsiden.overlays.default
-          inputs.qotd.overlays.default
-        ];
-        modules = [
-          inputs.pvv-nettsiden.nixosModules.default
-          self.nixosModules.bluemap
-          inputs.qotd.nixosModules.default
-        ];
-      };
-      ildkule = stableNixosConfig "ildkule" { };
-      #ildkule-unstable = unstableNixosConfig "ildkule" { };
-      shark = stableNixosConfig "shark" { };
-      wenche = stableNixosConfig "wenche" { };
-      temmie = stableNixosConfig "temmie" { };
-      gluttony = stableNixosConfig "gluttony" { };
 
-      kommode = stableNixosConfig "kommode" {
+              pkgs = import nixpkgs commonPkgsConfig;
-        overlays = [
+              unstablePkgs = import nixpkgs-unstable commonPkgsConfig;
-          inputs.nix-gitea-themes.overlays.default
+            in
-        ];
+            lib.nixosSystem (
-        modules = [
+              lib.recursiveUpdate
-          inputs.nix-gitea-themes.nixosModules.default
+                {
-        ];
+                  system = crossSystem;
-      };
 
-      ustetind = stableNixosConfig "ustetind" {
+                  inherit pkgs;
-        modules = [
-         "${nixpkgs}/nixos/modules/virtualisation/lxc-container.nix"
-        ];
-      };
 
-      brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
+                  specialArgs = {
-        modules = [
+                    inherit inputs unstablePkgs;
-          inputs.grzegorz-clients.nixosModules.grzegorz-webui
+                    values = import ./values.nix;
-          inputs.gergle.nixosModules.default
+                    fp = path: ./${path};
-          inputs.greg-ng.nixosModules.default
+                  }
-        ];
+                  // specialArgs;
-        overlays = [
-          inputs.greg-ng.overlays.default
-          inputs.gergle.overlays.default
-        ];
-      };
-      georg = stableNixosConfig "georg" {
-        modules = [
-          inputs.grzegorz-clients.nixosModules.grzegorz-webui
-          inputs.gergle.nixosModules.default
-          inputs.greg-ng.nixosModules.default
-        ];
-        overlays = [
-          inputs.greg-ng.overlays.default
-          inputs.gergle.overlays.default
-        ];
-      };
-      skrott = stableNixosConfig "skrott" {
-        system = "aarch64-linux";
-        modules = [
-          (nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
-          inputs.dibbler.nixosModules.default
-        ];
-        overlays = [
-          inputs.dibbler.overlays.default
-        ];
-      };
-    }
-    //
-    (let
-      machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
-      stableLupineNixosConfig = name: extraArgs:
-          nixosConfig nixpkgs name ./hosts/lupine/configuration.nix extraArgs;
-    in lib.genAttrs machineNames (name: stableLupineNixosConfig name {
-      modules = [{ networking.hostName = name; }];
-      specialArgs.lupineName = name;
-    }));
 
-    nixosModules = {
+                  modules = [
-      bluemap = ./modules/bluemap.nix;
+                    {
-      snakeoil-certs = ./modules/snakeoil-certs.nix;
+                      networking.hostName = lib.mkDefault name;
-      snappymail = ./modules/snappymail.nix;
+                    }
-      robots-txt = ./modules/robots-txt.nix;
+                    configurationPath
-      gickup = ./modules/gickup;
+                  ]
-      matrix-ooye = ./modules/matrix-ooye.nix;
+                  ++ (lib.optionals enableDefaults [
-    };
+                    sops-nix.nixosModules.sops
+                    inputs.roowho2.nixosModules.default
+                    self.nixosModules.rsync-pull-targets
+                  ])
+                  ++ modules;
+                }
+                (
+                  builtins.removeAttrs extraArgs [
+                    "localSystem"
+                    "crossSystem"
+                    "modules"
+                    "overlays"
+                    "specialArgs"
+                    "enableDefaults"
+                  ]
+                )
+            );
 
-    devShells = forAllSystems (system: {
+          stableNixosConfig =
-      default = nixpkgs-unstable.legacyPackages.${system}.callPackage ./shell.nix { };
+            name: extraArgs: nixosConfig nixpkgs name ./hosts/${name}/configuration.nix extraArgs;
-      cuda = let
+        in
-        cuda-pkgs = import nixpkgs-unstable {
+        {
-          inherit system;
+          bakke = stableNixosConfig "bakke" {
-          config = {
+            modules = [
-            allowUnfree = true;
+              inputs.disko.nixosModules.disko
-            cudaSupport = true;
+            ];
           };
-        };
+          bicep = stableNixosConfig "bicep" {
-      in cuda-pkgs.callPackage ./shells/cuda.nix { };
+            modules = [
-    });
+              inputs.matrix-next.nixosModules.default
-
+              inputs.pvv-calendar-bot.nixosModules.default
-    packages = {
+              inputs.minecraft-heatmap.nixosModules.default
-      "x86_64-linux" = let
+              self.nixosModules.gickup
-        pkgs = nixpkgs.legacyPackages."x86_64-linux";
+              self.nixosModules.matrix-ooye
-      in rec {
+            ];
-        default = important-machines;
-        important-machines = pkgs.linkFarm "important-machines"
-          (lib.getAttrs importantMachines self.packages.x86_64-linux);
-        all-machines = pkgs.linkFarm "all-machines"
-          (lib.getAttrs allMachines self.packages.x86_64-linux);
-
-        simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
-
-        bluemap = pkgs.callPackage ./packages/bluemap.nix { };
-
-        out-of-your-element = pkgs.callPackage ./packages/ooye/package.nix { };
-      }
-      //
-      # Mediawiki extensions
-      (lib.pipe null [
-        (_: pkgs.callPackage ./packages/mediawiki-extensions { })
-        (lib.flip builtins.removeAttrs ["override" "overrideDerivation"])
-        (lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
-      ])
-      //
-      # Machines
-      lib.genAttrs allMachines
-        (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
-      //
-      # Skrott is exception
-      {
-        skrott = self.nixosConfigurations.skrott.config.system.build.sdImage;
-      }
-      //
-      # Nix-topology
-      (let
-        topology' = import inputs.nix-topology {
-          pkgs = import nixpkgs {
-            system = "x86_64-linux";
             overlays = [
-              inputs.nix-topology.overlays.default
+              inputs.pvv-calendar-bot.overlays.default
+              inputs.minecraft-heatmap.overlays.default
               (final: prev: {
-                inherit (nixpkgs-unstable.legacyPackages.x86_64-linux) super-tiny-icons;
+                inherit (self.packages.${prev.stdenv.hostPlatform.system}) out-of-your-element;
               })
             ];
           };
+          bekkalokk = stableNixosConfig "bekkalokk" {
+            overlays = [
+              (final: prev: {
+                mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions { };
+                simplesamlphp = final.callPackage ./packages/simplesamlphp { };
+                bluemap = final.callPackage ./packages/bluemap.nix { };
+              })
+              inputs.pvv-nettsiden.overlays.default
+              inputs.qotd.overlays.default
+            ];
+            modules = [
+              inputs.pvv-nettsiden.nixosModules.default
+              self.nixosModules.bluemap
+              inputs.qotd.nixosModules.default
+            ];
+          };
+          ildkule = stableNixosConfig "ildkule" { };
+          #ildkule-unstable = unstableNixosConfig "ildkule" { };
+          skrot = stableNixosConfig "skrot" {
+            modules = [
+              inputs.disko.nixosModules.disko
+              inputs.dibbler.nixosModules.default
+            ];
+            overlays = [ inputs.dibbler.overlays.default ];
+          };
+          shark = stableNixosConfig "shark" { };
+          wenche = stableNixosConfig "wenche" { };
+          temmie = stableNixosConfig "temmie" { };
+          gluttony = stableNixosConfig "gluttony" { };
 
-          specialArgs = {
+          kommode = stableNixosConfig "kommode" {
-            values = import ./values.nix;
+            overlays = [
+              inputs.nix-gitea-themes.overlays.default
+            ];
+            modules = [
+              inputs.nix-gitea-themes.nixosModules.default
+              inputs.disko.nixosModules.disko
+            ];
           };
 
-          modules = [
+          ustetind = stableNixosConfig "ustetind" {
-            ./topology
+            modules = [
-            {
+              "${nixpkgs}/nixos/modules/virtualisation/lxc-container.nix"
-              nixosConfigurations = lib.mapAttrs (_name: nixosCfg: nixosCfg.extendModules {
+            ];
-                modules = [
+          };
-                  inputs.nix-topology.nixosModules.default
+
-                  ./topology/service-extractors/greg-ng.nix
+          brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
-                  ./topology/service-extractors/postgresql.nix
+            modules = [
-                  ./topology/service-extractors/mysql.nix
+              inputs.grzegorz-clients.nixosModules.grzegorz-webui
-                  ./topology/service-extractors/gitea-runners.nix
+              inputs.gergle.nixosModules.default
-                ];
+              inputs.greg-ng.nixosModules.default
-              }) self.nixosConfigurations;
+            ];
+            overlays = [
+              inputs.greg-ng.overlays.default
+              inputs.gergle.overlays.default
+            ];
+          };
+          georg = stableNixosConfig "georg" {
+            modules = [
+              inputs.grzegorz-clients.nixosModules.grzegorz-webui
+              inputs.gergle.nixosModules.default
+              inputs.greg-ng.nixosModules.default
+            ];
+            overlays = [
+              inputs.greg-ng.overlays.default
+              inputs.gergle.overlays.default
+            ];
+          };
+        }
+        // (
+          let
+            skrottConfig = {
+              modules = [
+                (nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
+                inputs.dibbler.nixosModules.default
+              ];
+              overlays = [
+                inputs.dibbler.overlays.default
+                (final: prev: {
+                  # NOTE: Yeetus (these break crosscompile ¯\_(ツ)_/¯)
+                  atool = prev.emptyDirectory;
+                  micro = prev.emptyDirectory;
+                  ncdu = prev.emptyDirectory;
+                })
+              ];
+            };
+          in
+          {
+            skrott = self.nixosConfigurations.skrott-native;
+            skrott-native = stableNixosConfig "skrott" (
+              skrottConfig
+              // {
+                localSystem = "aarch64-linux";
+                crossSystem = "aarch64-linux";
+              }
+            );
+            skrott-cross = stableNixosConfig "skrott" (
+              skrottConfig
+              // {
+                localSystem = "x86_64-linux";
+                crossSystem = "aarch64-linux";
+              }
+            );
+            skrott-x86_64 = stableNixosConfig "skrott" (
+              skrottConfig
+              // {
+                localSystem = "x86_64-linux";
+                crossSystem = "x86_64-linux";
+              }
+            );
+          }
+        )
+        // (
+          let
+            machineNames = map (i: "lupine-${toString i}") (lib.range 1 5);
+            stableLupineNixosConfig =
+              name: extraArgs: nixosConfig nixpkgs name ./hosts/lupine/configuration.nix extraArgs;
+          in
+          lib.genAttrs machineNames (
+            name:
+            stableLupineNixosConfig name {
+              modules = [ { networking.hostName = name; } ];
+              specialArgs.lupineName = name;
             }
-          ];
+          )
-        };
+        );
-      in {
+
-        topology = topology'.config.output;
+      nixosModules = {
-        topology-png = pkgs.runCommand "pvv-config-topology-png" {
+        bluemap = ./modules/bluemap.nix;
-          nativeBuildInputs = [ pkgs.writableTmpDirAsHomeHook ];
+        gickup = ./modules/gickup;
-        } ''
+        matrix-ooye = ./modules/matrix-ooye.nix;
-          mkdir -p "$out"
+        robots-txt = ./modules/robots-txt.nix;
-          for file in '${topology'.config.output}'/*.svg; do
+        rsync-pull-targets = ./modules/rsync-pull-targets.nix;
-            ${lib.getExe pkgs.imagemagick} -density 300 -background none "$file" "$out"/"$(basename "''${file%.svg}.png")"
+        snakeoil-certs = ./modules/snakeoil-certs.nix;
-          done
+        snappymail = ./modules/snappymail.nix;
-        '';
+      };
+
+      devShells = forAllSystems (system: {
+        default =
+          let
+            pkgs = import nixpkgs-unstable {
+              inherit system;
+              overlays = [
+                (final: prev: {
+                  inherit (inputs.disko.packages.${system}) disko;
+                })
+              ];
+            };
+          in
+          pkgs.callPackage ./shell.nix { };
+        cuda =
+          let
+            cuda-pkgs = import nixpkgs-unstable {
+              inherit system;
+              config = {
+                allowUnfree = true;
+                cudaSupport = true;
+              };
+            };
+          in
+          cuda-pkgs.callPackage ./shells/cuda.nix { };
       });
+
+      packages = {
+        "x86_64-linux" =
+          let
+            system = "x86_64-linux";
+            pkgs = nixpkgs.legacyPackages.${system};
+          in
+          rec {
+            default = important-machines;
+            important-machines = pkgs.linkFarm "important-machines" (
+              lib.getAttrs importantMachines self.packages.${system}
+            );
+            all-machines = pkgs.linkFarm "all-machines" (lib.getAttrs allMachines self.packages.${system});
+
+            simplesamlphp = pkgs.callPackage ./packages/simplesamlphp { };
+
+            bluemap = pkgs.callPackage ./packages/bluemap.nix { };
+
+            out-of-your-element = pkgs.callPackage ./packages/ooye/package.nix { };
+          }
+          //
+            # Mediawiki extensions
+            (lib.pipe null [
+              (_: pkgs.callPackage ./packages/mediawiki-extensions { })
+              (lib.flip builtins.removeAttrs [
+                "override"
+                "overrideDerivation"
+              ])
+              (lib.mapAttrs' (name: lib.nameValuePair "mediawiki-${name}"))
+            ])
+          //
+            # Machines
+            lib.genAttrs allMachines (machine: self.nixosConfigurations.${machine}.config.system.build.toplevel)
+          //
+            # Skrott is exception
+            {
+              skrott = self.packages.${system}.skrott-native-sd;
+              skrott-native = self.nixosConfigurations.skrott-native.config.system.build.toplevel;
+              skrott-native-sd = self.nixosConfigurations.skrott-native.config.system.build.sdImage;
+              skrott-cross = self.nixosConfigurations.skrott-cross.config.system.build.toplevel;
+              skrott-cross-sd = self.nixosConfigurations.skrott-cross.config.system.build.sdImage;
+              skrott-x86_64 = self.nixosConfigurations.skrott-x86_64.config.system.build.toplevel;
+            }
+          //
+            # Nix-topology
+            (
+              let
+                topology' = import inputs.nix-topology {
+                  pkgs = import nixpkgs {
+                    inherit system;
+                    overlays = [
+                      inputs.nix-topology.overlays.default
+                      (final: prev: {
+                        inherit (nixpkgs-unstable.legacyPackages.${system}) super-tiny-icons;
+                      })
+                    ];
+                  };
+
+                  specialArgs = {
+                    values = import ./values.nix;
+                  };
+
+                  modules = [
+                    ./topology
+                    {
+                      nixosConfigurations = lib.mapAttrs (
+                        _name: nixosCfg:
+                        nixosCfg.extendModules {
+                          modules = [
+                            inputs.nix-topology.nixosModules.default
+                            ./topology/service-extractors/greg-ng.nix
+                            ./topology/service-extractors/postgresql.nix
+                            ./topology/service-extractors/mysql.nix
+                            ./topology/service-extractors/gitea-runners.nix
+                          ];
+                        }
+                      ) self.nixosConfigurations;
+                    }
+                  ];
+                };
+              in
+              {
+                topology = topology'.config.output;
+                topology-png =
+                  pkgs.runCommand "pvv-config-topology-png"
+                    {
+                      nativeBuildInputs = [ pkgs.writableTmpDirAsHomeHook ];
+                    }
+                    ''
+                      mkdir -p "$out"
+                      for file in '${topology'.config.output}'/*.svg; do
+                        ${lib.getExe pkgs.imagemagick} -density 300 -background none "$file" "$out"/"$(basename "''${file%.svg}.png")"
+                      done
+                    '';
+              }
+            );
+      };
     };
-  };
 }

hosts/bakke/configuration.nix

@@ -1,15 +1,23 @@
-{ config, pkgs, values, ... }:
+{
+  config,
+  pkgs,
+  values,
+  ...
+}:
 {
   imports = [
-      ./hardware-configuration.nix
+    ./hardware-configuration.nix
-      ../../base
+    ../../base
-      ./filesystems.nix
+    ./filesystems.nix
-    ];
+  ];
 
   networking.hostId = "99609ffc";
   systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
     matchConfig.Name = "enp2s0";
-    address = with values.hosts.bakke; [ (ipv4 + "/25") (ipv6 + "/64") ];
+    address = with values.hosts.bakke; [
+      (ipv4 + "/25")
+      (ipv6 + "/64")
+    ];
   };
 
   # Don't change (even during upgrades) unless you know what you are doing.

hosts/bakke/filesystems.nix

@@ -1,17 +1,17 @@
-{ config, pkgs, lib, ... }:
+{ pkgs, ... }:
 {
   # Boot drives:
   boot.swraid.enable = true;
 
   # ZFS Data pool:
-  environment.systemPackages = with pkgs; [ zfs ];
   boot = {
     zfs = {
       extraPools = [ "tank" ];
       requestEncryptionCredentials = false;
     };
-    supportedFilesystems = [ "zfs" ];
+    supportedFilesystems.zfs = true;
-    kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
+    # Use stable linux packages, these work with zfs
+    kernelPackages = pkgs.linuxPackages;
   };
   services.zfs.autoScrub = {
     enable = true;

hosts/bakke/hardware-configuration.nix

@@ -1,41 +1,59 @@
 # Do not modify this file!  It was generated by 'nixos-generate-config'
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  ];
 
-  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "ehci_pci"
+    "ahci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+    device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
-      fsType = "btrfs";
+    fsType = "btrfs";
-      options = [ "subvol=root" ];
+    options = [ "subvol=root" ];
-    };
+  };
 
-  fileSystems."/home" =
+  fileSystems."/home" = {
-    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+    device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
-      fsType = "btrfs";
+    fsType = "btrfs";
-      options = [ "subvol=home" ];
+    options = [ "subvol=home" ];
-    };
+  };
 
-  fileSystems."/nix" =
+  fileSystems."/nix" = {
-    { device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
+    device = "/dev/disk/by-uuid/0f63c3d2-fc12-4ed5-a5a5-141bfd67a571";
-      fsType = "btrfs";
+    fsType = "btrfs";
-      options = [ "subvol=nix" "noatime" ];
+    options = [
-    };
+      "subvol=nix"
+      "noatime"
+    ];
+  };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/sdc2";
+    device = "/dev/sdc2";
-      fsType = "vfat";
+    fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
+    options = [
-    };
+      "fmask=0022"
+      "dmask=0022"
+    ];
+  };
 
   swapDevices = [ ];
 

hosts/bekkalokk/configuration.nix

@@ -1,4 +1,9 @@
-{ fp, pkgs, values, ... }:
+{
+  fp,
+  pkgs,
+  values,
+  ...
+}:
 {
   imports = [
     ./hardware-configuration.nix
@@ -21,12 +26,15 @@
 
   systemd.network.networks."30-enp2s0" = values.defaultNetworkConfig // {
     matchConfig.Name = "enp2s0";
-    address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
+    address = with values.hosts.bekkalokk; [
+      (ipv4 + "/25")
+      (ipv6 + "/64")
+    ];
   };
 
   services.btrfs.autoScrub.enable = true;
 
   # Don't change (even during upgrades) unless you know what you are doing.
   # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "22.11";
+  system.stateVersion = "25.11";
 }

hosts/bekkalokk/hardware-configuration.nix

@@ -1,31 +1,43 @@
 # Do not modify this file!  It was generated by 'nixos-generate-config'
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  ];
 
-  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "ehci_pci"
+    "ahci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/sda1";
+    device = "/dev/sda1";
-      fsType = "btrfs";
+    fsType = "btrfs";
-    };
+  };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/CE63-3B9B";
+    device = "/dev/disk/by-uuid/CE63-3B9B";
-      fsType = "vfat";
+    fsType = "vfat";
-    };
+  };
 
-  swapDevices =
+  swapDevices = [
-    [ { device = "/dev/disk/by-uuid/2df10c7b-0dec-45c6-a728-533f7da7f4b9"; }
+    { device = "/dev/disk/by-uuid/2df10c7b-0dec-45c6-a728-533f7da7f4b9"; }
-    ];
+  ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

hosts/bekkalokk/services/bluemap.nix

@@ -1,8 +1,15 @@
-{ config, lib, pkgs, inputs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
 let
   vanillaSurvival = "/var/lib/bluemap/vanilla_survival_world";
   format = pkgs.formats.hocon { };
-in {
+in
+{
   # NOTE: our versino of the module gets added in flake.nix
   disabledModules = [ "services/web-apps/bluemap.nix" ];
 
@@ -17,82 +24,88 @@ in {
 
     host = "minecraft.pvv.ntnu.no";
 
-    maps = let
+    maps =
-      inherit (inputs.minecraft-kartverket.packages.${pkgs.stdenv.hostPlatform.system}) bluemap-export;
+      let
-    in {
+        inherit (inputs.minecraft-kartverket.packages.${pkgs.stdenv.hostPlatform.system}) bluemap-export;
-      "verden" = {
+      in
-        extraHoconMarkersFile = "${bluemap-export}/overworld.hocon";
+      {
-        settings = {
+        "verden" = {
-          world = vanillaSurvival;
+          extraHoconMarkersFile = "${bluemap-export}/overworld.hocon";
-          dimension = "minecraft:overworld";
+          settings = {
-          name = "Verden";
+            world = vanillaSurvival;
-          sorting = 0;
+            dimension = "minecraft:overworld";
-          start-pos = {
+            name = "Verden";
-            x = 0;
+            sorting = 0;
-            z = 0;
+            start-pos = {
+              x = 0;
+              z = 0;
+            };
+            ambient-light = 0.1;
+            cave-detection-ocean-floor = -5;
+          };
+        };
+        "underverden" = {
+          extraHoconMarkersFile = "${bluemap-export}/nether.hocon";
+          settings = {
+            world = vanillaSurvival;
+            dimension = "minecraft:the_nether";
+            name = "Underverden";
+            sorting = 100;
+            start-pos = {
+              x = 0;
+              z = 0;
+            };
+            sky-color = "#290000";
+            void-color = "#150000";
+            sky-light = 1;
+            ambient-light = 0.6;
+            remove-caves-below-y = -10000;
+            cave-detection-ocean-floor = -5;
+            cave-detection-uses-block-light = true;
+            render-mask = [
+              {
+                max-y = 90;
+              }
+            ];
+          };
+        };
+        "enden" = {
+          extraHoconMarkersFile = "${bluemap-export}/the-end.hocon";
+          settings = {
+            world = vanillaSurvival;
+            dimension = "minecraft:the_end";
+            name = "Enden";
+            sorting = 200;
+            start-pos = {
+              x = 0;
+              z = 0;
+            };
+            sky-color = "#080010";
+            void-color = "#080010";
+            sky-light = 1;
+            ambient-light = 0.6;
+            remove-caves-below-y = -10000;
+            cave-detection-ocean-floor = -5;
           };
-          ambient-light = 0.1;
-          cave-detection-ocean-floor = -5;
         };
       };
-      "underverden" = {
-        extraHoconMarkersFile = "${bluemap-export}/nether.hocon";
-        settings = {
-          world = vanillaSurvival;
-          dimension = "minecraft:the_nether";
-          name = "Underverden";
-          sorting = 100;
-          start-pos = {
-            x = 0;
-            z = 0;
-          };
-          sky-color = "#290000";
-          void-color = "#150000";
-          sky-light = 1;
-          ambient-light = 0.6;
-          remove-caves-below-y = -10000;
-          cave-detection-ocean-floor = -5;
-          cave-detection-uses-block-light = true;
-          render-mask = [{
-            max-y = 90;
-          }];
-        };
-      };
-      "enden" = {
-        extraHoconMarkersFile = "${bluemap-export}/the-end.hocon";
-        settings = {
-          world = vanillaSurvival;
-          dimension = "minecraft:the_end";
-          name = "Enden";
-          sorting = 200;
-          start-pos = {
-            x = 0;
-            z = 0;
-          };
-          sky-color = "#080010";
-          void-color = "#080010";
-          sky-light = 1;
-          ambient-light = 0.6;
-          remove-caves-below-y = -10000;
-          cave-detection-ocean-floor = -5;
-        };
-      };
-    };
   };
 
   systemd.services."render-bluemap-maps" = {
     serviceConfig = {
       StateDirectory = [ "bluemap/world" ];
-      ExecStartPre = let
+      ExecStartPre =
-        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
+        let
-          archive = true;
+          rsyncArgs = lib.cli.toCommandLineShellGNU { } {
-          compress = true;
+            archive = true;
-          verbose = true;
+            compress = true;
-          no-owner = true;
+            verbose = true;
-          no-group = true;
+            no-owner = true;
-          rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
+            no-group = true;
-        };
+            rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
-      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
+          };
+        in
+        "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
       LoadCredential = [
         "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
         "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"

hosts/bekkalokk/services/idp-simplesamlphp/config.php

@@ -556,7 +556,6 @@ $config = [
     'module.enable' => [
         'admin' => true,
 	'authpwauth' => true,
-	'themepvv' => true,
     ],
 
 
@@ -859,7 +858,7 @@ $config = [
     /*
      * Which theme directory should be used?
      */
-    'theme.use' => 'themepvv:pvv',
+    'theme.use' => 'default',
 
     /*
      * Set this option to the text you would like to appear at the header of each page. Set to false if you don't want

hosts/bekkalokk/services/idp-simplesamlphp/default.nix

@@ -5,14 +5,6 @@
   ...
 }:
 let
-  themePvv = pkgs.fetchFromGitea {
-    domain = "git.pvv.ntnu.no";
-    owner = "Drift";
-    repo = "ssp-theme";
-    rev = "bda4314030be5f81aeaf2fb1927aee582f1194d9";
-    hash = "sha256-naNRyPL6PAsZKW2w1Vt9wrHT9inCL/yAFnvpy4glv+c=";
-  };
-
   pwAuthScript = pkgs.writeShellApplication {
     name = "pwauth";
     runtimeInputs = with pkgs; [
@@ -119,9 +111,6 @@ let
       '';
 
       "modules/authpwauth/src/Auth/Source/PwAuth.php" = ./authpwauth.php;
-
-      # PVV theme module (themepvv).
-      "modules/themepvv" = themePvv;
     };
   };
 in

hosts/bekkalokk/services/kerberos.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 {
   security.krb5 = {
     enable = true;

hosts/bekkalokk/services/mediawiki/default.nix

@@ -1,4 +1,12 @@
-{ pkgs, lib, fp, config, values, pkgs-unstable, ... }: let
+{
+  pkgs,
+  lib,
+  fp,
+  config,
+  values,
+  ...
+}:
+let
   cfg = config.services.mediawiki;
 
   # "mediawiki"
@@ -9,7 +17,9 @@
 
   simplesamlphp = pkgs.simplesamlphp.override {
     extra_files = {
-      "metadata/saml20-idp-remote.php" = pkgs.writeText "mediawiki-saml20-idp-remote.php" (import ../idp-simplesamlphp/metadata.php.nix);
+      "metadata/saml20-idp-remote.php" = pkgs.writeText "mediawiki-saml20-idp-remote.php" (
+        import ../idp-simplesamlphp/metadata.php.nix
+      );
 
       "config/authsources.php" = ./simplesaml-authsources.php;
 
@@ -18,35 +28,66 @@
 
         substituteInPlace "$out" \
           --replace-warn '$SAML_COOKIE_SECURE' 'true' \
-          --replace-warn '$SAML_COOKIE_SALT' 'file_get_contents("${config.sops.secrets."mediawiki/simplesamlphp/cookie_salt".path}")' \
+          --replace-warn '$SAML_COOKIE_SALT' 'file_get_contents("${
+            config.sops.secrets."mediawiki/simplesamlphp/cookie_salt".path
+          }")' \
           --replace-warn '$SAML_ADMIN_NAME' '"Drift"' \
           --replace-warn '$SAML_ADMIN_EMAIL' '"drift@pvv.ntnu.no"' \
-          --replace-warn '$SAML_ADMIN_PASSWORD' 'file_get_contents("${config.sops.secrets."mediawiki/simplesamlphp/admin_password".path}")' \
+          --replace-warn '$SAML_ADMIN_PASSWORD' 'file_get_contents("${
+            config.sops.secrets."mediawiki/simplesamlphp/admin_password".path
+          }")' \
           --replace-warn '$SAML_TRUSTED_DOMAINS' 'array( "wiki.pvv.ntnu.no" )' \
           --replace-warn '$SAML_DATABASE_DSN' '"pgsql:host=postgres.pvv.ntnu.no;port=5432;dbname=mediawiki_simplesamlphp"' \
           --replace-warn '$SAML_DATABASE_USERNAME' '"mediawiki_simplesamlphp"' \
-          --replace-warn '$SAML_DATABASE_PASSWORD' 'file_get_contents("${config.sops.secrets."mediawiki/simplesamlphp/postgres_password".path}")' \
+          --replace-warn '$SAML_DATABASE_PASSWORD' 'file_get_contents("${
+            config.sops.secrets."mediawiki/simplesamlphp/postgres_password".path
+          }")' \
           --replace-warn '$CACHE_DIRECTORY' '/var/cache/mediawiki/idp'
       '';
     };
   };
-in {
+in
+{
   services.idp.sp-remote-metadata = [ "https://wiki.pvv.ntnu.no/simplesaml/" ];
 
-  sops.secrets = lib.pipe [
+  sops.secrets =
-    "mediawiki/password"
+    lib.pipe
-    "mediawiki/postgres_password"
+      [
-    "mediawiki/simplesamlphp/postgres_password"
+        "mediawiki/secret-key"
-    "mediawiki/simplesamlphp/cookie_salt"
+        "mediawiki/password"
-    "mediawiki/simplesamlphp/admin_password"
+        "mediawiki/postgres_password"
-  ] [
+        "mediawiki/simplesamlphp/postgres_password"
-    (map (key: lib.nameValuePair key {
+        "mediawiki/simplesamlphp/cookie_salt"
-      owner = user;
+        "mediawiki/simplesamlphp/admin_password"
-      group = group;
+      ]
-      restartUnits = [ "phpfpm-mediawiki.service" ];
+      [
-    }))
+        (map (
-    lib.listToAttrs
+          key:
-  ];
+          lib.nameValuePair key {
+            owner = user;
+            group = group;
+            restartUnits = [ "phpfpm-mediawiki.service" ];
+          }
+        ))
+        lib.listToAttrs
+      ];
+
+  services.rsync-pull-targets = {
+    enable = true;
+    locations.${cfg.uploadsDir} = {
+      user = "root";
+      rrsyncArgs.ro = true;
+      authorizedKeysAttrs = [
+        "restrict"
+        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
+        "no-agent-forwarding"
+        "no-port-forwarding"
+        "no-pty"
+        "no-X11-forwarding"
+      ];
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICHFHa3Iq1oKPhbKCAIHgOoWOTkLmIc7yqxeTbut7ig/ mediawiki rsync backup";
+    };
+  };
 
   services.mediawiki = {
     enable = true;
@@ -144,6 +185,24 @@ in {
       $wgDBserver = "${toString cfg.database.host}";
       $wgAllowCopyUploads = true;
 
+      # Files
+      $wgFileExtensions = [
+        'bmp',
+        'gif',
+        'jpeg',
+        'jpg',
+        'mp3',
+        'odg',
+        'odp',
+        'ods',
+        'odt',
+        'pdf',
+        'png',
+        'tiff',
+        'webm',
+        'webp',
+      ];
+
       # Misc program paths
       $wgFFmpegLocation = '${pkgs.ffmpeg}/bin/ffmpeg';
       $wgExiftool = '${pkgs.exiftool}/bin/exiftool';
@@ -179,19 +238,21 @@ in {
 
   # Cache directory for simplesamlphp
   # systemd.services.phpfpm-mediawiki.serviceConfig.CacheDirectory = "mediawiki/simplesamlphp";
-  systemd.tmpfiles.settings."10-mediawiki"."/var/cache/mediawiki/simplesamlphp".d = {
+  systemd.tmpfiles.settings."10-mediawiki"."/var/cache/mediawiki/simplesamlphp".d =
-    user = "mediawiki";
+    lib.mkIf cfg.enable
-    group = "mediawiki";
+      {
-    mode = "0770";
+        user = "mediawiki";
-  };
+        group = "mediawiki";
+        mode = "0770";
+      };
 
-  users.groups.mediawiki.members = [ "nginx" ];
+  users.groups.mediawiki.members = lib.mkIf cfg.enable [ "nginx" ];
 
-  services.nginx.virtualHosts."wiki.pvv.ntnu.no" = {
+  services.nginx.virtualHosts."wiki.pvv.ntnu.no" = lib.mkIf cfg.enable {
     kTLS = true;
     forceSSL = true;
     enableACME = true;
-    locations =  {
+    locations = {
       "= /wiki/Main_Page" = lib.mkForce {
         return = "301 /wiki/Programvareverkstedet";
       };
@@ -217,20 +278,45 @@ in {
 
       "= /PNG/PVV-logo.svg".alias = fp /assets/logo_blue_regular.svg;
       "= /PNG/PVV-logo.png".alias = fp /assets/logo_blue_regular.png;
-      "= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
+      "= /favicon.ico".alias =
-        buildInputs = with pkgs; [ imagemagick ];
+        pkgs.runCommandLocal "mediawiki-favicon.ico"
-      } ''
+          {
-        magick \
+            buildInputs = with pkgs; [ imagemagick ];
-          ${fp /assets/logo_blue_regular.png} \
+          }
-          -resize x64 \
+          ''
-          -gravity center \
+            magick \
-          -crop 64x64+0+0 \
+              ${fp /assets/logo_blue_regular.png} \
-          -flatten \
+              -resize x64 \
-          -colors 256 \
+              -gravity center \
-          -background transparent \
+              -crop 64x64+0+0 \
-          $out
+              -flatten \
-      '';
+              -colors 256 \
+              -background transparent \
+              $out
+          '';
     };
 
   };
+
+  systemd.services.mediawiki-init = lib.mkIf cfg.enable {
+    after = [ "sops-install-secrets.service" ];
+    serviceConfig = {
+      BindReadOnlyPaths = [
+        "/run/credentials/mediawiki-init.service/secret-key:/var/lib/mediawiki/secret.key"
+      ];
+      LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
+      UMask = lib.mkForce "0007";
+    };
+  };
+
+  systemd.services.phpfpm-mediawiki = lib.mkIf cfg.enable {
+    after = [ "sops-install-secrets.service" ];
+    serviceConfig = {
+      BindReadOnlyPaths = [
+        "/run/credentials/phpfpm-mediawiki.service/secret-key:/var/lib/mediawiki/secret.key"
+      ];
+      LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
+      UMask = lib.mkForce "0007";
+    };
+  };
 }

hosts/bekkalokk/services/phpfpm.nix

@@ -11,41 +11,43 @@ in
 {
   # Source: https://www.pierreblazquez.com/2023/06/17/how-to-harden-apache-php-fpm-daemons-using-systemd/
   systemd.services = lib.genAttrs pools (_: {
-    serviceConfig = let
+    serviceConfig =
-      caps = [
+      let
-        "CAP_NET_BIND_SERVICE"
+        caps = [
-        "CAP_SETGID"
+          "CAP_NET_BIND_SERVICE"
-        "CAP_SETUID"
+          "CAP_SETGID"
-        "CAP_CHOWN"
+          "CAP_SETUID"
-        "CAP_KILL"
+          "CAP_CHOWN"
-        "CAP_IPC_LOCK"
+          "CAP_KILL"
-        "CAP_DAC_OVERRIDE"
+          "CAP_IPC_LOCK"
-      ];
+          "CAP_DAC_OVERRIDE"
-    in {
+        ];
-      AmbientCapabilities = caps;
+      in
-      CapabilityBoundingSet = caps;
+      {
-      DeviceAllow = [ "" ];
+        AmbientCapabilities = caps;
-      LockPersonality = true;
+        CapabilityBoundingSet = caps;
-      MemoryDenyWriteExecute = false;
+        DeviceAllow = [ "" ];
-      NoNewPrivileges = true;
+        LockPersonality = true;
-      PrivateMounts = true;
+        MemoryDenyWriteExecute = false;
-      ProtectClock = true;
+        NoNewPrivileges = true;
-      ProtectControlGroups = true;
+        PrivateMounts = true;
-      ProtectHome = true;
+        ProtectClock = true;
-      ProtectHostname = true;
+        ProtectControlGroups = true;
-      ProtectKernelLogs = true;
+        ProtectHome = true;
-      ProtectKernelModules = true;
+        ProtectHostname = true;
-      ProtectKernelTunables = true;
+        ProtectKernelLogs = true;
-      RemoveIPC = true;
+        ProtectKernelModules = true;
-      UMask = "0077";
+        ProtectKernelTunables = true;
-      RestrictNamespaces = "~mnt";
+        RemoveIPC = true;
-      RestrictRealtime = true;
+        UMask = "0077";
-      RestrictSUIDSGID = true;
+        RestrictNamespaces = "~mnt";
-      SystemCallArchitectures = "native";
+        RestrictRealtime = true;
-      KeyringMode = "private";
+        RestrictSUIDSGID = true;
-      SystemCallFilter = [
+        SystemCallArchitectures = "native";
-        "@system-service"
+        KeyringMode = "private";
-      ];
+        SystemCallFilter = [
-    };
+          "@system-service"
+        ];
+      };
   });
 }

hosts/bekkalokk/services/vaultwarden.nix

@@ -1,11 +1,18 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  values,
+  ...
+}:
 let
   cfg = config.services.vaultwarden;
   domain = "pw.pvv.ntnu.no";
   address = "127.0.1.2";
   port = 3011;
   wsPort = 3012;
-in {
+in
+{
   sops.secrets."vaultwarden/environ" = {
     owner = "vaultwarden";
     group = "vaultwarden";
@@ -99,4 +106,21 @@ in {
       ];
     };
   };
+
+  services.rsync-pull-targets = {
+    enable = true;
+    locations."/var/lib/vaultwarden" = {
+      user = "root";
+      rrsyncArgs.ro = true;
+      authorizedKeysAttrs = [
+        "restrict"
+        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
+        "no-agent-forwarding"
+        "no-port-forwarding"
+        "no-pty"
+        "no-X11-forwarding"
+      ];
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB2cDaW52gBtLVaNqoGijvN2ZAVkAWlII5AXUzT3Dswj vaultwarden rsync backup";
+    };
+  };
 }

hosts/bekkalokk/services/webmail/default.nix

@@ -1,4 +1,10 @@
-{ config, values, pkgs, lib, ... }:
+{
+  config,
+  values,
+  pkgs,
+  lib,
+  ...
+}:
 {
   imports = [
     ./roundcube.nix

hosts/bekkalokk/services/webmail/roundcube.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 with lib;
 let
@@ -14,14 +19,24 @@ in
   services.roundcube = {
     enable = true;
 
-    package = pkgs.roundcube.withPlugins (plugins: with plugins; [
+    package = pkgs.roundcube.withPlugins (
-      persistent_login
+      plugins: with plugins; [
-      thunderbird_labels
+        persistent_login
-      contextmenu
+        thunderbird_labels
-      custom_from
+        contextmenu
-    ]);
+        custom_from
+      ]
+    );
 
-    dicts = with pkgs.aspellDicts; [ en en-computers nb nn fr de it ];
+    dicts = with pkgs.aspellDicts; [
+      en
+      en-computers
+      nb
+      nn
+      fr
+      de
+      it
+    ];
     maxAttachmentSize = 20;
     hostName = "roundcubeplaceholder.example.com";
 
@@ -54,21 +69,23 @@ in
         ln -s ${cfg.package} $out/roundcube
       '';
       extraConfig = ''
-        location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
+        location ~ ^/roundcube/(${
-        # https://wiki.archlinux.org/title/Roundcube
+          builtins.concatStringsSep "|" [
-        "README"
+            # https://wiki.archlinux.org/title/Roundcube
-        "INSTALL"
+            "README"
-        "LICENSE"
+            "INSTALL"
-        "CHANGELOG"
+            "LICENSE"
-        "UPGRADING"
+            "CHANGELOG"
-        "bin"
+            "UPGRADING"
-        "SQL"
+            "bin"
-        ".+\\.md"
+            "SQL"
-        "\\."
+            ".+\\.md"
-        "config"
+            "\\."
-        "temp"
+            "config"
-        "logs"
+            "temp"
-        ]})/? {
+            "logs"
+          ]
+        })/? {
           deny all;
         }
 

hosts/bekkalokk/services/webmail/snappymail.nix

@@ -1,7 +1,15 @@
-{ config, lib, fp, pkgs, ... }:
+{
+  config,
+  lib,
+  fp,
+  pkgs,
+  values,
+  ...
+}:
 let
   cfg = config.services.snappymail;
-in {
+in
+{
   imports = [ (fp /modules/snappymail.nix) ];
 
   services.snappymail = {
@@ -14,5 +22,21 @@ in {
     enableACME = true;
     kTLS = true;
   };
-}
 
+  services.rsync-pull-targets = {
+    enable = true;
+    locations.${cfg.dataDir} = {
+      user = "root";
+      rrsyncArgs.ro = true;
+      authorizedKeysAttrs = [
+        "restrict"
+        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
+        "no-agent-forwarding"
+        "no-port-forwarding"
+        "no-pty"
+        "no-X11-forwarding"
+      ];
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJENMnuNsHEeA91oX+cj7Qpex2defSXP/lxznxCAqV03 snappymail rsync backup";
+    };
+  };
+}

hosts/bekkalokk/services/website/default.nix

@@ -1,22 +1,31 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 let
   format = pkgs.formats.php { };
   cfg = config.services.pvv-nettsiden;
-in {
+in
+{
   imports = [
     ./fetch-gallery.nix
   ];
 
-  sops.secrets = lib.genAttrs [
+  sops.secrets =
-    "nettsiden/door_secret"
+    lib.genAttrs
-    "nettsiden/mysql_password"
+      [
-    "nettsiden/simplesamlphp/admin_password"
+        "nettsiden/door_secret"
-    "nettsiden/simplesamlphp/cookie_salt"
+        "nettsiden/mysql_password"
-  ] (_: {
+        "nettsiden/simplesamlphp/admin_password"
-    owner = config.services.phpfpm.pools.pvv-nettsiden.user;
+        "nettsiden/simplesamlphp/cookie_salt"
-    group = config.services.phpfpm.pools.pvv-nettsiden.group;
+      ]
-    restartUnits = [ "phpfpm-pvv-nettsiden.service" ];
+      (_: {
-  });
+        owner = config.services.phpfpm.pools.pvv-nettsiden.user;
+        group = config.services.phpfpm.pools.pvv-nettsiden.group;
+        restartUnits = [ "phpfpm-pvv-nettsiden.service" ];
+      });
 
   security.acme.certs."www.pvv.ntnu.no" = {
     extraDomainNames = [
@@ -35,48 +44,53 @@ in {
 
     package = pkgs.pvv-nettsiden.override {
       extra_files = {
-        "${pkgs.pvv-nettsiden.passthru.simplesamlphpPath}/metadata/saml20-idp-remote.php" = pkgs.writeText "pvv-nettsiden-saml20-idp-remote.php" (import ../idp-simplesamlphp/metadata.php.nix);
+        "${pkgs.pvv-nettsiden.passthru.simplesamlphpPath}/metadata/saml20-idp-remote.php" =
-        "${pkgs.pvv-nettsiden.passthru.simplesamlphpPath}/config/authsources.php" = pkgs.writeText "pvv-nettsiden-authsources.php" ''
+          pkgs.writeText "pvv-nettsiden-saml20-idp-remote.php" (import ../idp-simplesamlphp/metadata.php.nix);
-          <?php
+        "${pkgs.pvv-nettsiden.passthru.simplesamlphpPath}/config/authsources.php" =
-          $config = array(
+          pkgs.writeText "pvv-nettsiden-authsources.php" ''
-              'admin' => array(
+            <?php
-                'core:AdminPassword'
+            $config = array(
-              ),
+                'admin' => array(
-              'default-sp' => array(
+                  'core:AdminPassword'
-                  'saml:SP',
+                ),
-                  'entityID' => 'https://${cfg.domainName}/simplesaml/',
+                'default-sp' => array(
-                  'idp' => 'https://idp.pvv.ntnu.no/',
+                    'saml:SP',
-              ),
+                    'entityID' => 'https://${cfg.domainName}/simplesaml/',
-          );
+                    'idp' => 'https://idp.pvv.ntnu.no/',
-        '';
+                ),
+            );
+          '';
       };
     };
 
     domainName = "www.pvv.ntnu.no";
 
-    settings = let
+    settings =
-      includeFromSops = path: format.lib.mkRaw "file_get_contents('${config.sops.secrets."nettsiden/${path}".path}')";
+      let
-    in {
+        includeFromSops =
-      DOOR_SECRET = includeFromSops "door_secret";
+          path: format.lib.mkRaw "file_get_contents('${config.sops.secrets."nettsiden/${path}".path}')";
+      in
+      {
+        DOOR_SECRET = includeFromSops "door_secret";
 
-      DB = {
+        DB = {
-        DSN = "mysql:dbname=www-data_nettside;host=mysql.pvv.ntnu.no";
+          DSN = "mysql:dbname=www-data_nettside;host=mysql.pvv.ntnu.no";
-        USER = "www-data_nettsi";
+          USER = "www-data_nettsi";
-        PASS = includeFromSops "mysql_password";
+          PASS = includeFromSops "mysql_password";
-      };
+        };
 
-      # TODO: set up postgres session for simplesamlphp
+        # TODO: set up postgres session for simplesamlphp
-      SAML = {
+        SAML = {
-        COOKIE_SALT = includeFromSops "simplesamlphp/cookie_salt";
+          COOKIE_SALT = includeFromSops "simplesamlphp/cookie_salt";
-        COOKIE_SECURE = true;
+          COOKIE_SECURE = true;
-        ADMIN_NAME = "PVV Drift";
+          ADMIN_NAME = "PVV Drift";
-        ADMIN_EMAIL = "drift@pvv.ntnu.no";
+          ADMIN_EMAIL = "drift@pvv.ntnu.no";
-        ADMIN_PASSWORD = includeFromSops "simplesamlphp/admin_password";
+          ADMIN_PASSWORD = includeFromSops "simplesamlphp/admin_password";
-        TRUSTED_DOMAINS = [
+          TRUSTED_DOMAINS = [
-          "www.pvv.ntnu.no"
+            "www.pvv.ntnu.no"
-        ];
+          ];
+        };
       };
-    };
   };
 
   services.phpfpm.pools."pvv-nettsiden".settings = {

hosts/bekkalokk/services/website/fetch-gallery.nix

@@ -1,15 +1,37 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  values,
+  ...
+}:
 let
   galleryDir = config.services.pvv-nettsiden.settings.GALLERY.DIR;
   transferDir = "${config.services.pvv-nettsiden.settings.GALLERY.DIR}-transfer";
-in {
+in
+{
   users.users.${config.services.pvv-nettsiden.user} = {
+    # NOTE: the user unfortunately needs a registered shell for rrsync to function...
+    #       is there anything we can do to remove this?
     useDefaultShell = true;
+  };
 
-    # This is pushed from microbel:/var/www/www-gallery/build-gallery.sh
+  # This is pushed from microbel:/var/www/www-gallery/build-gallery.sh
-    openssh.authorizedKeys.keys = [
+  services.rsync-pull-targets = {
-    ''command="${pkgs.rrsync}/bin/rrsync -wo ${transferDir}",restrict,no-agent-forwarding,no-port-forwarding,no-pty,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjHhC2dikhWs/gG+m7qP1eSohWzTehn4ToNzDSOImyR gallery-publish''
+    enable = true;
-    ];
+    locations.${transferDir} = {
+      user = config.services.pvv-nettsiden.user;
+      rrsyncArgs.wo = true;
+      authorizedKeysAttrs = [
+        "restrict"
+        "from=\"microbel.pvv.ntnu.no,${values.hosts.microbel.ipv6},${values.hosts.microbel.ipv4}\""
+        "no-agent-forwarding"
+        "no-port-forwarding"
+        "no-pty"
+        "no-X11-forwarding"
+      ];
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjHhC2dikhWs/gG+m7qP1eSohWzTehn4ToNzDSOImyR gallery-publish";
+    };
   };
 
   systemd.paths.pvv-nettsiden-gallery-update = {
@@ -22,14 +44,20 @@ in {
   };
 
   systemd.services.pvv-nettsiden-gallery-update = {
-    path = with pkgs; [ imagemagick gnutar gzip ];
+    path = with pkgs; [
+      imagemagick
+      gnutar
+      gzip
+    ];
 
     script = ''
-      tar ${lib.cli.toGNUCommandLineShell {} {
+      tar ${
-        extract = true;
+        lib.cli.toGNUCommandLineShell { } {
-        file = "${transferDir}/gallery.tar.gz";
+          extract = true;
-        directory = ".";
+          file = "${transferDir}/gallery.tar.gz";
-      }}
+          directory = ".";
+        }
+      }
 
       # Delete files and directories that exists in the gallery that don't exist in the tarball
       filesToRemove=$(uniq -u <(sort <(find . -not -path "./.thumbnails*") <(tar -tf ${transferDir}/gallery.tar.gz | sed 's|/$||')))

hosts/bekkalokk/services/well-known/default.nix

@@ -1,25 +1,28 @@
 { lib, ... }:
 {
-  services.nginx.virtualHosts = lib.genAttrs [
+  services.nginx.virtualHosts =
-    "pvv.ntnu.no"
+    lib.genAttrs
-    "www.pvv.ntnu.no"
+      [
-    "pvv.org"
+        "pvv.ntnu.no"
-    "www.pvv.org"
+        "www.pvv.ntnu.no"
-  ] (_: {
+        "pvv.org"
-    locations = {
+        "www.pvv.org"
-      "^~ /.well-known/" = {
+      ]
-        alias = (toString ./root) + "/";
+      (_: {
-      };
+        locations = {
+          "^~ /.well-known/" = {
+            alias = (toString ./root) + "/";
+          };
 
-      # Proxy the matrix well-known files
+          # Proxy the matrix well-known files
-      # Host has be set before proxy_pass
+          # Host has be set before proxy_pass
-      # The header must be set so nginx on the other side routes it to the right place
+          # The header must be set so nginx on the other side routes it to the right place
-      "^~ /.well-known/matrix/" = {
+          "^~ /.well-known/matrix/" = {
-        extraConfig = ''
+            extraConfig = ''
-          proxy_set_header Host matrix.pvv.ntnu.no;
+              proxy_set_header Host matrix.pvv.ntnu.no;
-          proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
+              proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
-        '';
+            '';
-      };
+          };
-    };
+        };
-  });
+      });
 }

hosts/bekkalokk/services/well-known/root/security.txt

@@ -6,7 +6,11 @@ Contact: mailto:cert@pvv.ntnu.no
 Preferred-Languages: no, en
 
 Expires: 2032-12-31T23:59:59.000Z
-# This file was last updated 2024-09-14.
+# This file was last updated 2026-02-27.
 
 # You can find a wikipage for our security policies at:
 # https://wiki.pvv.ntnu.no/wiki/CERT
+
+# Please note that we are a student organization, and unfortunately we do not
+# have a bug bounty program or offer monetary compensation for disclosure of
+# security vulnerabilities.

hosts/bicep/configuration.nix

@@ -1,4 +1,9 @@
-{ fp, pkgs, values, ... }:
+{
+  fp,
+  pkgs,
+  values,
+  ...
+}:
 {
   imports = [
     ./hardware-configuration.nix
@@ -9,8 +14,8 @@
     ./services/calendar-bot.nix
     #./services/git-mirrors
     ./services/minecraft-heatmap.nix
-    ./services/mysql.nix
+    ./services/mysql
-    ./services/postgres.nix
+    ./services/postgresql
 
     ./services/matrix
   ];
@@ -19,8 +24,16 @@
   systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
     #matchConfig.Name = "enp6s0f0";
     matchConfig.Name = "ens18";
-    address = with values.hosts.bicep; [ (ipv4 + "/25") (ipv6 + "/64") ]
+    address =
-      ++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]);
+      with values.hosts.bicep;
+      [
+        (ipv4 + "/25")
+        (ipv6 + "/64")
+      ]
+      ++ (with values.services.turn; [
+        (ipv4 + "/25")
+        (ipv6 + "/64")
+      ]);
   };
   systemd.network.wait-online = {
     anyInterface = true;
@@ -30,5 +43,5 @@
 
   # Don't change (even during upgrades) unless you know what you are doing.
   # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "22.11";
+  system.stateVersion = "25.11";
 }

hosts/bicep/hardware-configuration.nix

@@ -1,34 +1,49 @@
 # Do not modify this file!  It was generated by 'nixos-generate-config'
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
-    ];
+  ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ahci" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "ahci"
+    "sd_mod"
+    "sr_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/20e06202-7a09-47cc-8ef6-5e7afe19453a";
+    device = "/dev/disk/by-uuid/20e06202-7a09-47cc-8ef6-5e7afe19453a";
-      fsType = "ext4";
+    fsType = "ext4";
-    };
+  };
 
   # temp data disk, only 128gb not enough until we can add another disk to the system.
-  fileSystems."/data" =
+  fileSystems."/data" = {
-    { device = "/dev/disk/by-uuid/c81af266-0781-4084-b8eb-c2587cbcf1ba";
+    device = "/dev/disk/by-uuid/c81af266-0781-4084-b8eb-c2587cbcf1ba";
-      fsType = "ext4";
+    fsType = "ext4";
-    };
+  };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/198B-E363";
+    device = "/dev/disk/by-uuid/198B-E363";
-      fsType = "vfat";
+    fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
+    options = [
-    };
+      "fmask=0022"
+      "dmask=0022"
+    ];
+  };
 
   swapDevices = [ ];
 

hosts/bicep/services/calendar-bot.nix

@@ -1,7 +1,14 @@
-{ config, fp, lib, pkgs, ... }:
+{
+  config,
+  fp,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.services.pvv-calendar-bot;
-in {
+in
+{
   sops.secrets = {
     "calendar-bot/matrix_token" = {
       sopsFile = fp /secrets/bicep/bicep.yaml;

hosts/bicep/services/git-mirrors/default.nix

@@ -1,4 +1,10 @@
-{ config, pkgs, lib, fp, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  fp,
+  ...
+}:
 let
   cfg = config.services.gickup;
 in
@@ -20,79 +26,88 @@ in
       lfs = false;
     };
 
-    instances = let
+    instances =
-      defaultGithubConfig = {
+      let
-        settings.token_file = config.sops.secrets."gickup/github-token".path;
+        defaultGithubConfig = {
-      };
+          settings.token_file = config.sops.secrets."gickup/github-token".path;
-      defaultGitlabConfig = {
+        };
-        # settings.token_file = ...
+        defaultGitlabConfig = {
-      };
+          # settings.token_file = ...
-    in {
+        };
-      "github:Git-Mediawiki/Git-Mediawiki" = defaultGithubConfig;
+      in
-      "github:NixOS/nixpkgs" = defaultGithubConfig;
+      {
-      "github:go-gitea/gitea" = defaultGithubConfig;
+        "github:Git-Mediawiki/Git-Mediawiki" = defaultGithubConfig;
-      "github:heimdal/heimdal" = defaultGithubConfig;
+        "github:NixOS/nixpkgs" = defaultGithubConfig;
-      "github:saltstack/salt" = defaultGithubConfig;
+        "github:go-gitea/gitea" = defaultGithubConfig;
-      "github:typst/typst" = defaultGithubConfig;
+        "github:heimdal/heimdal" = defaultGithubConfig;
-      "github:unmojang/FjordLauncher" = defaultGithubConfig;
+        "github:saltstack/salt" = defaultGithubConfig;
-      "github:unmojang/drasl" = defaultGithubConfig;
+        "github:typst/typst" = defaultGithubConfig;
-      "github:yushijinhun/authlib-injector" = defaultGithubConfig;
+        "github:unmojang/FjordLauncher" = defaultGithubConfig;
+        "github:unmojang/drasl" = defaultGithubConfig;
+        "github:yushijinhun/authlib-injector" = defaultGithubConfig;
 
-      "gitlab:mx-puppet/discord/better-discord.js" = defaultGitlabConfig;
+        "gitlab:mx-puppet/discord/better-discord.js" = defaultGitlabConfig;
-      "gitlab:mx-puppet/discord/discord-markdown" = defaultGitlabConfig;
+        "gitlab:mx-puppet/discord/discord-markdown" = defaultGitlabConfig;
-      "gitlab:mx-puppet/discord/matrix-discord-parser" = defaultGitlabConfig;
+        "gitlab:mx-puppet/discord/matrix-discord-parser" = defaultGitlabConfig;
-      "gitlab:mx-puppet/discord/mx-puppet-discord" = defaultGitlabConfig;
+        "gitlab:mx-puppet/discord/mx-puppet-discord" = defaultGitlabConfig;
-      "gitlab:mx-puppet/mx-puppet-bridge" = defaultGitlabConfig;
+        "gitlab:mx-puppet/mx-puppet-bridge" = defaultGitlabConfig;
 
-      "any:glibc" = {
+        "any:glibc" = {
-        settings.url = "https://sourceware.org/git/glibc.git";
+          settings.url = "https://sourceware.org/git/glibc.git";
-      };
+        };
 
-      "any:out-of-your-element" = {
+        "any:out-of-your-element" = {
-        settings.url = "https://gitdab.com/cadence/out-of-your-element.git";
+          settings.url = "https://gitdab.com/cadence/out-of-your-element.git";
-      };
+        };
 
-      "any:out-of-your-element-module" = {
+        "any:out-of-your-element-module" = {
-        settings.url = "https://cgit.rory.gay/nix/OOYE-module.git";
+          settings.url = "https://cgit.rory.gay/nix/OOYE-module.git";
+        };
       };
-    };
   };
 
-  services.cgit = let
+  services.cgit =
-    domain = "mirrors.pvv.ntnu.no";
+    let
-  in {
+      domain = "mirrors.pvv.ntnu.no";
-    ${domain} = {
+    in
-      enable = true;
+    {
-      package = pkgs.callPackage (fp /packages/cgit.nix) { };
+      ${domain} = {
-      group = "gickup";
+        enable = true;
-      scanPath = "${cfg.dataDir}/linktree";
+        package = pkgs.callPackage (fp /packages/cgit.nix) { };
-      gitHttpBackend.checkExportOkFiles = false;
+        group = "gickup";
-      settings = {
+        scanPath = "${cfg.dataDir}/linktree";
-        enable-commit-graph = true;
+        gitHttpBackend.checkExportOkFiles = false;
-        enable-follow-links = true;
+        settings = {
-        enable-http-clone = true;
+          enable-commit-graph = true;
-        enable-remote-branches = true;
+          enable-follow-links = true;
-        clone-url = "https://${domain}/$CGIT_REPO_URL";
+          enable-http-clone = true;
-        remove-suffix = true;
+          enable-remote-branches = true;
-        root-title = "PVVSPPP";
+          clone-url = "https://${domain}/$CGIT_REPO_URL";
-        root-desc = "PVV Speiler Praktisk og Prominent Programvare";
+          remove-suffix = true;
-        snapshots = "all";
+          root-title = "PVVSPPP";
-        logo = "/PVV-logo.png";
+          root-desc = "PVV Speiler Praktisk og Prominent Programvare";
+          snapshots = "all";
+          logo = "/PVV-logo.png";
+        };
       };
     };
-  };
 
   services.nginx.virtualHosts."mirrors.pvv.ntnu.no" = {
     forceSSL = true;
     enableACME = true;
 
-    locations."= /PVV-logo.png".alias = let
+    locations."= /PVV-logo.png".alias =
-      small-pvv-logo = pkgs.runCommandLocal "pvv-logo-96x96" {
+      let
-        nativeBuildInputs = [ pkgs.imagemagick ];
+        small-pvv-logo =
-      } ''
+          pkgs.runCommandLocal "pvv-logo-96x96"
-        magick '${fp /assets/logo_blue_regular.svg}' -resize 96x96 PNG:"$out"
+            {
-      '';
+              nativeBuildInputs = [ pkgs.imagemagick ];
-    in toString small-pvv-logo;
+            }
+            ''
+              magick '${fp /assets/logo_blue_regular.svg}' -resize 96x96 PNG:"$out"
+            '';
+      in
+      toString small-pvv-logo;
   };
 
   systemd.services."fcgiwrap-cgit-mirrors.pvv.ntnu.no" = {

hosts/bicep/services/matrix/coturn.nix

@@ -1,4 +1,12 @@
-{ config, lib, fp, pkgs, secrets, values, ... }:
+{
+  config,
+  lib,
+  fp,
+  pkgs,
+  secrets,
+  values,
+  ...
+}:
 
 {
   sops.secrets."matrix/coturn/static-auth-secret" = {
@@ -127,18 +135,31 @@
   };
 
   networking.firewall = {
-    interfaces.enp6s0f0 = let
+    interfaces.enp6s0f0 =
-      range = with config.services.coturn; [ {
+      let
-      from = min-port;
+        range = with config.services.coturn; [
-      to = max-port;
+          {
-    } ];
+            from = min-port;
-    in
+            to = max-port;
-    {
+          }
-      allowedUDPPortRanges = range;
+        ];
-      allowedUDPPorts = [ 443 3478 3479 5349 ];
+      in
-      allowedTCPPortRanges = range;
+      {
-      allowedTCPPorts = [ 443 3478 3479 5349 ];
+        allowedUDPPortRanges = range;
-    };
+        allowedUDPPorts = [
+          443
+          3478
+          3479
+          5349
+        ];
+        allowedTCPPortRanges = range;
+        allowedTCPPorts = [
+          443
+          3478
+          3479
+          5349
+        ];
+      };
   };
 
 }

hosts/bicep/services/matrix/default.nix

@@ -1,8 +1,9 @@
 { config, ... }:
 {
   imports = [
-    ./synapse.nix
     ./synapse-admin.nix
+    ./synapse-auto-compressor.nix
+    ./synapse.nix
     ./element.nix
     ./coturn.nix
     ./livekit.nix

hosts/bicep/services/matrix/discord.nix

@@ -1,4 +1,9 @@
-{ config, lib, fp, ... }:
+{
+  config,
+  lib,
+  fp,
+  ...
+}:
 
 let
   cfg = config.services.mx-puppet-discord;
@@ -44,7 +49,6 @@ in
     ];
   };
 
-
   services.mx-puppet-discord.enable = false;
   services.mx-puppet-discord.settings = {
     bridge = {
@@ -52,16 +56,21 @@ in
       domain = "pvv.ntnu.no";
       homeserverUrl = "https://matrix.pvv.ntnu.no";
     };
-    provisioning.whitelist = [ "@dandellion:dodsorf\\.as" "@danio:pvv\\.ntnu\\.no"];
+    provisioning.whitelist = [
+      "@dandellion:dodsorf\\.as"
+      "@danio:pvv\\.ntnu\\.no"
+    ];
     relay.whitelist = [ ".*" ];
-    selfService.whitelist = [ "@danio:pvv\\.ntnu\\.no" "@dandellion:dodsorf\\.as" ];
+    selfService.whitelist = [
+      "@danio:pvv\\.ntnu\\.no"
+      "@dandellion:dodsorf\\.as"
+    ];
   };
   services.mx-puppet-discord.serviceDependencies = [
     "matrix-synapse.target"
     "nginx.service"
   ];
 
-
   services.matrix-synapse-next.settings = {
     app_service_config_files = [
       config.sops.templates."discord-registration.yaml".path

hosts/bicep/services/matrix/element.nix

@@ -1,7 +1,13 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   synapse-cfg = config.services.matrix-synapse-next;
-in {
+in
+{
   services.pvv-matrix-well-known.client = {
     "m.homeserver" = {
       base_url = "https://matrix.pvv.ntnu.no";
@@ -21,12 +27,12 @@ in {
         default_server_config = config.services.pvv-matrix-well-known.client;
 
         disable_3pid_login = true;
-#        integrations_ui_url = "https://dimension.dodsorf.as/riot";
+        #        integrations_ui_url = "https://dimension.dodsorf.as/riot";
-#        integrations_rest_url = "https://dimension.dodsorf.as/api/v1/scalar";
+        #        integrations_rest_url = "https://dimension.dodsorf.as/api/v1/scalar";
-#        integrations_widgets_urls = [
+        #        integrations_widgets_urls = [
-#          "https://dimension.dodsorf.as/widgets"
+        #          "https://dimension.dodsorf.as/widgets"
-#        ];
+        #        ];
-#        integration_jitsi_widget_url = "https://dimension.dodsorf.as/widgets/jitsi";
+        #        integration_jitsi_widget_url = "https://dimension.dodsorf.as/widgets/jitsi";
         defaultCountryCode = "NO";
         showLabsSettings = true;
         features = {
@@ -37,6 +43,7 @@ in {
           # element call group calls
           feature_group_calls = true;
         };
+        default_country_code = "NO";
         default_theme = "dark";
         # Servers in this list should provide some sort of valuable scoping
         # matrix.org is not useful compared to matrixrooms.info,

hosts/bicep/services/matrix/hookshot/default.nix

@@ -1,4 +1,11 @@
-{ config, lib, fp, unstablePkgs, inputs, ... }:
+{
+  config,
+  lib,
+  fp,
+  unstablePkgs,
+  inputs,
+  ...
+}:
 
 let
   cfg = config.services.matrix-hookshot;
@@ -14,6 +21,10 @@ in
     sopsFile = fp /secrets/bicep/matrix.yaml;
     key = "hookshot/hs_token";
   };
+  sops.secrets."matrix/hookshot/passkey" = {
+    sopsFile = fp /secrets/bicep/matrix.yaml;
+    key = "hookshot/passkey";
+  };
 
   sops.templates."hookshot-registration.yaml" = {
     owner = config.users.users.matrix-synapse.name;
@@ -44,9 +55,14 @@ in
   };
 
   systemd.services.matrix-hookshot = {
-    serviceConfig.SupplementaryGroups = [
+    serviceConfig = {
-      config.users.groups.keys-matrix-registrations.name
+      SupplementaryGroups = [
-    ];
+        config.users.groups.keys-matrix-registrations.name
+      ];
+      LoadCredential = [
+        "passkey.pem:${config.sops.secrets."matrix/hookshot/passkey".path}"
+      ];
+    };
   };
 
   services.matrix-hookshot = {
@@ -54,6 +70,8 @@ in
     package = unstablePkgs.matrix-hookshot;
     registrationFile = config.sops.templates."hookshot-registration.yaml".path;
     settings = {
+      passFile = "/run/credentials/matrix-hookshot.service/passkey.pem";
+
       bridge = {
         bindAddress = "127.0.0.1";
         domain = "pvv.ntnu.no";
@@ -61,6 +79,7 @@ in
         mediaUrl = "https://matrix.pvv.ntnu.no";
         port = 9993;
       };
+
       listeners = [
         {
           bindAddress = webhookListenAddress;
@@ -73,6 +92,7 @@ in
           ];
         }
       ];
+
       generic = {
         enabled = true;
         outbound = true;
@@ -87,7 +107,8 @@ in
       };
 
       serviceBots = [
-        { localpart = "bot_feeds";
+        {
+          localpart = "bot_feeds";
           displayname = "Aya";
           avatar = ./feeds.png;
           prefix = "!aya";
@@ -102,20 +123,44 @@ in
 
       permissions = [
         # Users of the PVV Server
-        { actor = "pvv.ntnu.no";
+        {
-          services = [ { service = "*"; level = "commands"; } ];
+          actor = "pvv.ntnu.no";
+          services = [
+            {
+              service = "*";
+              level = "commands";
+            }
+          ];
         }
         # Members of Medlem space (for people with their own hs)
-        { actor = "!pZOTJQinWyyTWaeOgK:pvv.ntnu.no";
+        {
-          services = [ { service = "*"; level = "commands"; } ];
+          actor = "!pZOTJQinWyyTWaeOgK:pvv.ntnu.no";
+          services = [
+            {
+              service = "*";
+              level = "commands";
+            }
+          ];
         }
         # Members of Drift
-        { actor = "!eYgeufLrninXxQpYml:pvv.ntnu.no";
+        {
-          services = [ { service = "*"; level = "admin"; } ];
+          actor = "!eYgeufLrninXxQpYml:pvv.ntnu.no";
+          services = [
+            {
+              service = "*";
+              level = "admin";
+            }
+          ];
         }
         # Dan bootstrap
-        { actor = "@dandellion:dodsorf.as";
+        {
-          services = [ { service = "*"; level = "admin"; } ];
+          actor = "@dandellion:dodsorf.as";
+          services = [
+            {
+              service = "*";
+              level = "admin";
+            }
+          ];
         }
       ];
     };

hosts/bicep/services/matrix/livekit.nix

@@ -1,4 +1,9 @@
-{ config, lib, fp, ... }:
+{
+  config,
+  lib,
+  fp,
+  ...
+}:
 let
   synapseConfig = config.services.matrix-synapse-next;
   matrixDomain = "matrix.pvv.ntnu.no";
@@ -20,10 +25,12 @@ in
   };
 
   services.pvv-matrix-well-known.client = lib.mkIf cfg.enable {
-    "org.matrix.msc4143.rtc_foci" = [{
+    "org.matrix.msc4143.rtc_foci" = [
-      type = "livekit";
+      {
-      livekit_service_url = "https://${matrixDomain}/livekit/jwt";
+        type = "livekit";
-    }];
+        livekit_service_url = "https://${matrixDomain}/livekit/jwt";
+      }
+    ];
   };
 
   services.livekit = {
@@ -43,7 +50,12 @@ in
     keyFile = config.sops.templates."matrix-livekit-keyfile".path;
   };
 
-  systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = lib.mkIf cfg.enable matrixDomain;
+  systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = lib.mkIf cfg.enable (
+    builtins.concatStringsSep "," [
+      "pvv.ntnu.no"
+      "dodsorf.as"
+    ]
+  );
 
   services.nginx.virtualHosts.${matrixDomain} = lib.mkIf cfg.enable {
     locations."^~ /livekit/jwt/" = {

hosts/bicep/services/matrix/mjolnir.nix

@@ -1,4 +1,9 @@
-{ config, lib, fp, ... }:
+{
+  config,
+  lib,
+  fp,
+  ...
+}:
 
 {
   sops.secrets."matrix/mjolnir/access_token" = {

hosts/bicep/services/matrix/out-of-your-element.nix

@@ -1,4 +1,11 @@
-{ config, pkgs, fp, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  values,
+  fp,
+  ...
+}:
 let
   cfg = config.services.matrix-ooye;
 in
@@ -28,6 +35,23 @@ in
     };
   };
 
+  services.rsync-pull-targets = lib.mkIf cfg.enable {
+    enable = true;
+    locations."/var/lib/private/matrix-ooye" = {
+      user = "root";
+      rrsyncArgs.ro = true;
+      authorizedKeysAttrs = [
+        "restrict"
+        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
+        "no-agent-forwarding"
+        "no-port-forwarding"
+        "no-pty"
+        "no-X11-forwarding"
+      ];
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE5koYfor5+kKB30Dugj3dAWvmj8h/akQQ2XYDvLobFL matrix_ooye rsync backup";
+    };
+  };
+
   services.matrix-ooye = {
     enable = true;
     homeserver = "https://matrix.pvv.ntnu.no";

hosts/bicep/services/matrix/smtp-authenticator/default.nix

@@ -1,4 +1,9 @@
-{ lib, buildPythonPackage, fetchFromGitHub, setuptools }:
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+}:
 
 buildPythonPackage rec {
   pname = "matrix-synapse-smtp-auth";

hosts/bicep/services/matrix/synapse-admin.nix

@@ -1,5 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
-
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 # This service requires you to have access to endpoints not available over the internet
 # Use an ssh proxy or similar to access this dashboard.

hosts/bicep/services/matrix/synapse-auto-compressor.nix

@@ -0,0 +1,61 @@
+{
+  config,
+  lib,
+  utils,
+  ...
+}:
+let
+  cfg = config.services.synapse-auto-compressor;
+in
+{
+  services.synapse-auto-compressor = {
+    # enable = true;
+    postgresUrl = "postgresql://matrix-synapse@/synapse?host=/run/postgresql";
+  };
+
+  # NOTE: nixpkgs has some broken asserts, vendored the entire unit
+  systemd.services.synapse-auto-compressor = {
+    description = "synapse-auto-compressor";
+    requires = [
+      "postgresql.target"
+    ];
+    inherit (cfg) startAt;
+    serviceConfig = {
+      Type = "oneshot";
+      DynamicUser = true;
+      User = "matrix-synapse";
+      PrivateTmp = true;
+      ExecStart = utils.escapeSystemdExecArgs [
+        "${cfg.package}/bin/synapse_auto_compressor"
+        "-p"
+        cfg.postgresUrl
+        "-c"
+        cfg.settings.chunk_size
+        "-n"
+        cfg.settings.chunks_to_compress
+        "-l"
+        (lib.concatStringsSep "," (map toString cfg.settings.levels))
+      ];
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateMounts = true;
+      PrivateUsers = true;
+      RemoveIPC = true;
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      ProcSubset = "pid";
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectClock = true;
+      ProtectKernelTunables = true;
+      ProtectKernelModules = true;
+      ProtectKernelLogs = true;
+      ProtectControlGroups = true;
+    };
+  };
+}

hosts/bicep/services/matrix/synapse.nix

@@ -1,13 +1,23 @@
-{ config, lib, fp, pkgs, values, inputs, ... }:
+{
+  config,
+  lib,
+  fp,
+  pkgs,
+  values,
+  inputs,
+  ...
+}:
 
 let
   cfg = config.services.matrix-synapse-next;
 
   matrix-lib = inputs.matrix-next.lib;
 
-  imap0Attrs = with lib; f: set:
+  imap0Attrs =
-    listToAttrs (imap0 (i: attr: nameValuePair attr (f i attr set.${attr})) (attrNames set));
+    with lib;
-in {
+    f: set: listToAttrs (imap0 (i: attr: nameValuePair attr (f i attr set.${attr})) (attrNames set));
+in
+{
   sops.secrets."matrix/synapse/signing_key" = {
     key = "synapse/signing_key";
     sopsFile = fp /secrets/bicep/matrix.yaml;
@@ -23,10 +33,29 @@ in {
     owner = config.users.users.matrix-synapse.name;
     group = config.users.users.matrix-synapse.group;
     content = ''
-      registration_shared_secret: ${config.sops.placeholder."matrix/synapse/user_registration/registration_shared_secret"}
+      registration_shared_secret: ${
+        config.sops.placeholder."matrix/synapse/user_registration/registration_shared_secret"
+      }
     '';
   };
 
+  services.rsync-pull-targets = {
+    enable = true;
+    locations.${cfg.settings.media_store_path} = {
+      user = "root";
+      rrsyncArgs.ro = true;
+      authorizedKeysAttrs = [
+        "restrict"
+        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
+        "no-agent-forwarding"
+        "no-port-forwarding"
+        "no-pty"
+        "no-X11-forwarding"
+      ];
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIASnjI9b3j4ZS3BL/D1ggHfws1BkE8iS0v0cGpEmbG+k matrix_media_store rsync backup";
+    };
+  };
+
   services.matrix-synapse-next = {
     enable = true;
 
@@ -51,7 +80,7 @@ in {
 
       signing_key_path = config.sops.secrets."matrix/synapse/signing_key".path;
 
-      media_store_path =  "${cfg.dataDir}/media";
+      media_store_path = "${cfg.dataDir}/media";
 
       database = {
         name = "psycopg2";
@@ -93,7 +122,8 @@ in {
       password_config.enabled = true;
 
       modules = [
-        { module = "smtp_auth_provider.SMTPAuthProvider";
+        {
+          module = "smtp_auth_provider.SMTPAuthProvider";
           config = {
             smtp_host = "smtp.pvv.ntnu.no";
           };
@@ -166,61 +196,79 @@ in {
   services.pvv-matrix-well-known.server."m.server" = "matrix.pvv.ntnu.no:443";
 
   services.nginx.virtualHosts."matrix.pvv.ntnu.no" = lib.mkMerge [
-  {
+    {
-    kTLS = true;
+      kTLS = true;
-  }
+    }
-  {
+    {
-    locations."/_synapse/admin" = {
+      locations."/_synapse/admin" = {
-      proxyPass = "http://$synapse_backend";
+        proxyPass = "http://$synapse_backend";
-      extraConfig = ''
+        extraConfig = ''
-        allow 127.0.0.1;
+          allow 127.0.0.1;
-        allow ::1;
+          allow ::1;
-        allow ${values.hosts.bicep.ipv4};
+          allow ${values.hosts.bicep.ipv4};
-        allow ${values.hosts.bicep.ipv6};
+          allow ${values.hosts.bicep.ipv6};
-        deny all;
+          deny all;
-      '';
+        '';
-    };
+      };
-  }
+    }
-  {
+    {
-    locations = let
+      locations =
-      connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
+        let
-      socketAddress = w: let c = connectionInfo w; in "${c.host}:${toString c.port}";
+          connectionInfo = w: matrix-lib.workerConnectionResource "metrics" w;
+          socketAddress =
+            w:
+            let
+              c = connectionInfo w;
+            in
+            "${c.host}:${toString c.port}";
 
-      metricsPath = w: "/metrics/${w.type}/${toString w.index}";
+          metricsPath = w: "/metrics/${w.type}/${toString w.index}";
-      proxyPath = w: "http://${socketAddress w}/_synapse/metrics";
+          proxyPath = w: "http://${socketAddress w}/_synapse/metrics";
-    in lib.mapAttrs' (n: v: lib.nameValuePair
+        in
-      (metricsPath v) {
+        lib.mapAttrs' (
-        proxyPass = proxyPath v;
+          n: v:
+          lib.nameValuePair (metricsPath v) {
+            proxyPass = proxyPath v;
+            extraConfig = ''
+              allow ${values.hosts.ildkule.ipv4};
+              allow ${values.hosts.ildkule.ipv6};
+              deny all;
+            '';
+          }
+        ) cfg.workers.instances;
+    }
+    {
+      locations."/metrics/master/1" = {
+        proxyPass = "http://127.0.0.1:9000/_synapse/metrics";
         extraConfig = ''
           allow ${values.hosts.ildkule.ipv4};
           allow ${values.hosts.ildkule.ipv6};
           deny all;
         '';
-      })
+      };
-      cfg.workers.instances;
-  }
-  {
-    locations."/metrics/master/1" = {
-      proxyPass = "http://127.0.0.1:9000/_synapse/metrics";
-      extraConfig = ''
-        allow ${values.hosts.ildkule.ipv4};
-        allow ${values.hosts.ildkule.ipv6};
-        deny all;
-      '';
-    };
 
-    locations."/metrics/" = let
+      locations."/metrics/" =
-      endpoints = lib.pipe cfg.workers.instances [
+        let
-        (lib.mapAttrsToList (_: v: v))
+          endpoints =
-        (map (w: "${w.type}/${toString w.index}"))
+            lib.pipe cfg.workers.instances [
-        (map (w: "matrix.pvv.ntnu.no/metrics/${w}"))
+              (lib.mapAttrsToList (_: v: v))
-      ] ++ [ "matrix.pvv.ntnu.no/metrics/master/1" ];
+              (map (w: "${w.type}/${toString w.index}"))
-    in {
+              (map (w: "matrix.pvv.ntnu.no/metrics/${w}"))
-      alias = pkgs.writeTextDir "/config.json"
+            ]
-        (builtins.toJSON [
+            ++ [ "matrix.pvv.ntnu.no/metrics/master/1" ];
-          { targets = endpoints;
+        in
-            labels = { };
+        {
-          }]) + "/";
+          alias =
-    };
+            pkgs.writeTextDir "/config.json" (
-  }];
+              builtins.toJSON [
+                {
+                  targets = endpoints;
+                  labels = { };
+                }
+              ]
+            )
+            + "/";
+        };
+    }
+  ];
 }

hosts/bicep/services/matrix/well-known.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   cfg = config.services.pvv-matrix-well-known;
   format = pkgs.formats.json { };

hosts/bicep/services/minecraft-heatmap.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.services.minecraft-heatmap;
 in
@@ -22,28 +27,30 @@ in
     };
   };
 
-  systemd.services.minecraft-heatmap-ingest-logs = {
+  systemd.services.minecraft-heatmap-ingest-logs = lib.mkIf cfg.enable {
     serviceConfig.LoadCredential = [
       "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
     ];
 
-    preStart = let
+    preStart =
-      knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
+      let
-        innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
+        knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
-        innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
+          innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
-        innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
+          innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
+          innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
+        '';
+      in
+      ''
+        mkdir -p '${cfg.minecraftLogsDir}'
+        "${lib.getExe pkgs.rsync}" \
+        --archive \
+        --verbose \
+        --progress \
+        --no-owner \
+        --no-group \
+        --rsh="${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=\"${knownHostsFile}\" -i \"$CREDENTIALS_DIRECTORY\"/sshkey" \
+        root@innovation.pvv.ntnu.no:/ \
+        '${cfg.minecraftLogsDir}'/
       '';
-    in ''
-      mkdir -p '${cfg.minecraftLogsDir}'
-      "${lib.getExe pkgs.rsync}" \
-      --archive \
-      --verbose \
-      --progress \
-      --no-owner \
-      --no-group \
-      --rsh="${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=\"${knownHostsFile}\" -i \"$CREDENTIALS_DIRECTORY\"/sshkey" \
-      root@innovation.pvv.ntnu.no:/ \
-      '${cfg.minecraftLogsDir}'/
-    '';
   };
 }

hosts/bicep/services/mysql.nix

@@ -1,55 +0,0 @@
-{ pkgs, lib, config, values, ... }:
-{
-  sops.secrets."mysql/password" = {
-    owner = "mysql";
-    group = "mysql";
-  };
-
-  users.mysql.passwordFile = config.sops.secrets."mysql/password".path;
-
-  services.mysql = {
-    enable = true;
-    dataDir = "/data/mysql";
-    package = pkgs.mariadb;
-    settings = {
-      mysqld = {
-        # PVV allows a lot of connections at the same time
-        max_connect_errors = 10000;
-        bind-address = values.services.mysql.ipv4;
-        skip-networking = 0;
-
-        # This was needed in order to be able to use all of the old users
-        # during migration from knakelibrak to bicep in Sep. 2023
-        secure_auth = 0;
-      };
-    };
-
-    # Note: This user also has MAX_USER_CONNECTIONS set to 3, and
-    #       a password which can be found in /secrets/ildkule/ildkule.yaml
-    #       We have also changed both the host and auth plugin of this user
-    #       to be 'ildkule.pvv.ntnu.no' and 'mysql_native_password' respectively.
-    ensureUsers = [{
-      name = "prometheus_mysqld_exporter";
-      ensurePermissions = {
-        "*.*" = "PROCESS, REPLICATION CLIENT, SELECT, SLAVE MONITOR";
-      };
-    }];
-  };
-
-  services.mysqlBackup = {
-    enable = true;
-    location = "/var/lib/mysql/backups";
-  };
-
-  networking.firewall.allowedTCPPorts = [ 3306 ];
-
-  systemd.services.mysql.serviceConfig = {
-    IPAddressDeny = "any";
-    IPAddressAllow = [
-      values.ipv4-space
-      values.ipv6-space
-      values.hosts.ildkule.ipv4
-      values.hosts.ildkule.ipv6
-    ];
-  };
-}

hosts/bicep/services/mysql/backup.nix

@@ -0,0 +1,91 @@
+{
+  config,
+  lib,
+  pkgs,
+  values,
+  ...
+}:
+let
+  cfg = config.services.mysql;
+  backupDir = "/data/mysql-backups";
+in
+{
+  # services.mysqlBackup = lib.mkIf cfg.enable {
+  #   enable = true;
+  #   location = "/var/lib/mysql-backups";
+  # };
+
+  systemd.tmpfiles.settings."10-mysql-backups".${backupDir}.d = {
+    user = "mysql";
+    group = "mysql";
+    mode = "700";
+  };
+
+  services.rsync-pull-targets = lib.mkIf cfg.enable {
+    enable = true;
+    locations.${backupDir} = {
+      user = "root";
+      rrsyncArgs.ro = true;
+      authorizedKeysAttrs = [
+        "restrict"
+        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
+        "no-agent-forwarding"
+        "no-port-forwarding"
+        "no-pty"
+        "no-X11-forwarding"
+      ];
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJgj55/7Cnj4cYMJ5sIkl+OwcGeBe039kXJTOf2wvo9j mysql rsync backup";
+    };
+  };
+
+  # NOTE: instead of having the upstream nixpkgs postgres backup unit trigger
+  #       another unit, it was easier to just make one ourselves.
+  systemd.services."backup-mysql" = lib.mkIf cfg.enable {
+    description = "Backup MySQL data";
+    requires = [ "mysql.service" ];
+
+    path = with pkgs; [
+      cfg.package
+      coreutils
+      zstd
+    ];
+
+    script =
+      let
+        rotations = 2;
+      in
+      ''
+        set -euo pipefail
+
+        OUT_FILE="$STATE_DIRECTORY/mysql-dump-$(date --iso-8601).sql.zst"
+
+        mysqldump --all-databases | zstd --compress -9 --rsyncable -o "$OUT_FILE"
+
+        # NOTE: this needs to be a hardlink for rrsync to allow sending it
+        rm "$STATE_DIRECTORY/mysql-dump-latest.sql.zst" ||:
+        ln -T "$OUT_FILE" "$STATE_DIRECTORY/mysql-dump-latest.sql.zst"
+
+        while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt ${toString (rotations + 1)} ]; do
+          rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
+        done
+      '';
+
+    serviceConfig = {
+      Type = "oneshot";
+      User = "mysql";
+      Group = "mysql";
+      UMask = "0077";
+
+      Nice = 19;
+      IOSchedulingClass = "best-effort";
+      IOSchedulingPriority = 7;
+
+      StateDirectory = [ "mysql-backups" ];
+      BindPaths = [ "${backupDir}:/var/lib/mysql-backups" ];
+
+      # TODO: hardening
+    };
+
+    startAt = "*-*-* 02:15:00";
+  };
+}

hosts/bicep/services/mysql/default.nix

@@ -0,0 +1,82 @@
+{
+  config,
+  pkgs,
+  lib,
+  values,
+  ...
+}:
+let
+  cfg = config.services.mysql;
+  dataDir = "/data/mysql";
+in
+{
+  imports = [ ./backup.nix ];
+
+  sops.secrets."mysql/password" = {
+    owner = "mysql";
+    group = "mysql";
+  };
+
+  users.mysql.passwordFile = config.sops.secrets."mysql/password".path;
+
+  services.mysql = {
+    enable = true;
+    package = pkgs.mariadb_118;
+    settings = {
+      mysqld = {
+        # PVV allows a lot of connections at the same time
+        max_connect_errors = 10000;
+        bind-address = values.services.mysql.ipv4;
+        skip-networking = 0;
+
+        # This was needed in order to be able to use all of the old users
+        # during migration from knakelibrak to bicep in Sep. 2023
+        secure_auth = 0;
+
+        slow-query-log = 1;
+        slow-query-log-file = "/var/log/mysql/mysql-slow.log";
+      };
+    };
+
+    # Note: This user also has MAX_USER_CONNECTIONS set to 3, and
+    #       a password which can be found in /secrets/ildkule/ildkule.yaml
+    #       We have also changed both the host and auth plugin of this user
+    #       to be 'ildkule.pvv.ntnu.no' and 'mysql_native_password' respectively.
+    ensureUsers = [
+      {
+        name = "prometheus_mysqld_exporter";
+        ensurePermissions = {
+          "*.*" = "PROCESS, REPLICATION CLIENT, SELECT, SLAVE MONITOR";
+        };
+      }
+    ];
+  };
+
+  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 3306 ];
+
+  systemd.tmpfiles.settings."10-mysql".${dataDir}.d = lib.mkIf cfg.enable {
+    inherit (cfg) user group;
+    mode = "0700";
+  };
+
+  systemd.services.mysql = lib.mkIf cfg.enable {
+    after = [
+      "systemd-tmpfiles-setup.service"
+      "systemd-tmpfiles-resetup.service"
+    ];
+
+    serviceConfig = {
+      BindPaths = [ "${dataDir}:${cfg.dataDir}" ];
+
+      LogsDirectory = "mysql";
+
+      IPAddressDeny = "any";
+      IPAddressAllow = [
+        values.ipv4-space
+        values.ipv6-space
+        values.hosts.ildkule.ipv4
+        values.hosts.ildkule.ipv6
+      ];
+    };
+  };
+}

hosts/bicep/services/postgresql/backup.nix

@@ -0,0 +1,92 @@
+{
+  config,
+  lib,
+  pkgs,
+  values,
+  ...
+}:
+let
+  cfg = config.services.postgresql;
+  backupDir = "/data/postgresql-backups";
+in
+{
+  # services.postgresqlBackup = lib.mkIf cfg.enable {
+  #   enable = true;
+  #   location = "/var/lib/postgresql-backups";
+  #   backupAll = true;
+  # };
+
+  systemd.tmpfiles.settings."10-postgresql-backups".${backupDir}.d = {
+    user = "postgres";
+    group = "postgres";
+    mode = "700";
+  };
+
+  services.rsync-pull-targets = lib.mkIf cfg.enable {
+    enable = true;
+    locations.${backupDir} = {
+      user = "root";
+      rrsyncArgs.ro = true;
+      authorizedKeysAttrs = [
+        "restrict"
+        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
+        "no-agent-forwarding"
+        "no-port-forwarding"
+        "no-pty"
+        "no-X11-forwarding"
+      ];
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGvO7QX7QmwSiGLXEsaxPIOpAqnJP3M+qqQRe5dzf8gJ postgresql rsync backup";
+    };
+  };
+
+  # NOTE: instead of having the upstream nixpkgs postgres backup unit trigger
+  #       another unit, it was easier to just make one ourselves
+  systemd.services."backup-postgresql" = {
+    description = "Backup PostgreSQL data";
+    requires = [ "postgresql.service" ];
+
+    path = with pkgs; [
+      coreutils
+      zstd
+      cfg.package
+    ];
+
+    script =
+      let
+        rotations = 2;
+      in
+      ''
+        set -euo pipefail
+
+        OUT_FILE="$STATE_DIRECTORY/postgresql-dump-$(date --iso-8601).sql.zst"
+
+        pg_dumpall -U postgres | zstd --compress -9 --rsyncable -o "$OUT_FILE"
+
+        # NOTE: this needs to be a hardlink for rrsync to allow sending it
+        rm "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst" ||:
+        ln -T "$OUT_FILE" "$STATE_DIRECTORY/postgresql-dump-latest.sql.zst"
+
+        while [ "$(find "$STATE_DIRECTORY" -type f -printf '.' | wc -c)" -gt ${toString (rotations + 1)} ]; do
+          rm "$(find "$STATE_DIRECTORY" -type f -printf '%T+ %p\n' | sort | head -n 1 | cut -d' ' -f2)"
+        done
+      '';
+
+    serviceConfig = {
+      Type = "oneshot";
+      User = "postgres";
+      Group = "postgres";
+      UMask = "0077";
+
+      Nice = 19;
+      IOSchedulingClass = "best-effort";
+      IOSchedulingPriority = 7;
+
+      StateDirectory = [ "postgresql-backups" ];
+      BindPaths = [ "${backupDir}:/var/lib/postgresql-backups" ];
+
+      # TODO: hardening
+    };
+
+    startAt = "*-*-* 01:15:00";
+  };
+}

hosts/bicep/services/postgresql/default.nix

@@ -1,8 +1,19 @@
-{ config, pkgs, values, ... }:
 {
+  config,
+  lib,
+  pkgs,
+  values,
+  ...
+}:
+let
+  cfg = config.services.postgresql;
+in
+{
+  imports = [ ./backup.nix ];
+
   services.postgresql = {
     enable = true;
-    package = pkgs.postgresql_15;
+    package = pkgs.postgresql_18;
     enableTCPIP = true;
 
     authentication = ''
@@ -74,13 +85,13 @@
     };
   };
 
-  systemd.tmpfiles.settings."10-postgresql"."/data/postgresql".d = {
+  systemd.tmpfiles.settings."10-postgresql"."/data/postgresql".d = lib.mkIf cfg.enable {
     user = config.systemd.services.postgresql.serviceConfig.User;
     group = config.systemd.services.postgresql.serviceConfig.Group;
     mode = "0700";
   };
 
-  systemd.services.postgresql-setup = {
+  systemd.services.postgresql-setup = lib.mkIf cfg.enable {
     after = [
       "systemd-tmpfiles-setup.service"
       "systemd-tmpfiles-resetup.service"
@@ -95,7 +106,7 @@
     };
   };
 
-  systemd.services.postgresql = {
+  systemd.services.postgresql = lib.mkIf cfg.enable {
     after = [
       "systemd-tmpfiles-setup.service"
       "systemd-tmpfiles-resetup.service"
@@ -110,18 +121,12 @@
     };
   };
 
-  environment.snakeoil-certs."/etc/certs/postgres" = {
+  environment.snakeoil-certs."/etc/certs/postgres" = lib.mkIf cfg.enable {
     owner = "postgres";
     group = "postgres";
     subject = "/C=NO/O=Programvareverkstedet/CN=postgres.pvv.ntnu.no/emailAddress=drift@pvv.ntnu.no";
   };
 
-  networking.firewall.allowedTCPPorts = [ 5432 ];
+  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
-  networking.firewall.allowedUDPPorts = [ 5432 ];
+  networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
-
-  services.postgresqlBackup = {
-    enable = true;
-    location = "/var/lib/postgres/backups";
-    backupAll = true;
-  };
 }

hosts/bikkje/configuration.nix

@@ -1,8 +1,14 @@
-{ config, pkgs, values, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  values,
+  ...
+}:
 {
   networking.nat = {
     enable = true;
-    internalInterfaces = ["ve-+"];
+    internalInterfaces = [ "ve-+" ];
     externalInterface = "ens3";
     # Lazy IPv6 connectivity for the container
     enableIPv6 = true;
@@ -10,9 +16,11 @@
 
   containers.bikkje = {
     autoStart = true;
-    config = { config, pkgs, ... }: {
+    config =
-      #import packages
+      { config, pkgs, ... }:
-      packages = with pkgs; [
+      {
+        #import packages
+        packages = with pkgs; [
           alpine
           mutt
           mutt-ics
@@ -22,26 +30,66 @@
           hexchat
           irssi
           pidgin
-      ];
+        ];
 
-      networking = {
+        networking = {
-        hostName = "bikkje";
+          hostName = "bikkje";
-        firewall = {
+          firewall = {
-          enable = true;
+            enable = true;
-          # Allow SSH and HTTP and ports for email and irc
+            # Allow SSH and HTTP and ports for email and irc
-          allowedTCPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
+            allowedTCPPorts = [
-          allowedUDPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
+              80
+              22
+              194
+              994
+              6665
+              6666
+              6667
+              6668
+              6669
+              6697
+              995
+              993
+              25
+              465
+              587
+              110
+              143
+              993
+              995
+            ];
+            allowedUDPPorts = [
+              80
+              22
+              194
+              994
+              6665
+              6666
+              6667
+              6668
+              6669
+              6697
+              995
+              993
+              25
+              465
+              587
+              110
+              143
+              993
+              995
+            ];
+          };
+          # Use systemd-resolved inside the container
+          # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
+          useHostResolvConf = lib.mkForce false;
         };
-        # Use systemd-resolved inside the container
+
-        # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
+        services.resolved.enable = true;
-        useHostResolvConf = mkForce false;
+
+        # Don't change (even during upgrades) unless you know what you are doing.
+        # See https://search.nixos.org/options?show=system.stateVersion
+        system.stateVersion = "23.11";
       };
-
-      services.resolved.enable = true;
-
-      # Don't change (even during upgrades) unless you know what you are doing.
-      # See https://search.nixos.org/options?show=system.stateVersion
-      system.stateVersion = "23.11";
-    };
   };
-};
+}

hosts/brzeczyszczykiewicz/configuration.nix

@@ -1,21 +1,30 @@
-{ config, fp, pkgs, values, ... }:
+{
+  config,
+  fp,
+  pkgs,
+  values,
+  ...
+}:
 {
   imports = [
-      # Include the results of the hardware scan.
+    # Include the results of the hardware scan.
-      ./hardware-configuration.nix
+    ./hardware-configuration.nix
-      (fp /base)
+    (fp /base)
 
-      ./services/grzegorz.nix
+    ./services/grzegorz.nix
-    ];
+  ];
 
   systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
     matchConfig.Name = "eno1";
-    address = with values.hosts.brzeczyszczykiewicz; [ (ipv4 + "/25") (ipv6 + "/64") ];
+    address = with values.hosts.brzeczyszczykiewicz; [
+      (ipv4 + "/25")
+      (ipv6 + "/64")
+    ];
   };
 
   fonts.fontconfig.enable = true;
 
   # Don't change (even during upgrades) unless you know what you are doing.
   # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "23.05";
+  system.stateVersion = "25.11";
 }

hosts/brzeczyszczykiewicz/hardware-configuration.nix

@@ -1,31 +1,45 @@
 # Do not modify this file!  It was generated by 'nixos-generate-config'
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ehci_pci"
+    "ahci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+    "sr_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
+    device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
-      fsType = "ext4";
+    fsType = "ext4";
-    };
+  };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/82E3-3D03";
+    device = "/dev/disk/by-uuid/82E3-3D03";
-      fsType = "vfat";
+    fsType = "vfat";
-    };
+  };
 
-  swapDevices =
+  swapDevices = [
-    [ { device = "/dev/disk/by-uuid/d0bf9a21-44bc-44a3-ae55-8f0971875883"; }
+    { device = "/dev/disk/by-uuid/d0bf9a21-44bc-44a3-ae55-8f0971875883"; }
-    ];
+  ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

hosts/georg/configuration.nix

@@ -1,16 +1,25 @@
-{ config, fp, pkgs, values, ... }:
+{
+  config,
+  fp,
+  pkgs,
+  values,
+  ...
+}:
 {
   imports = [
-      # Include the results of the hardware scan.
+    # Include the results of the hardware scan.
-      ./hardware-configuration.nix
+    ./hardware-configuration.nix
-      (fp /base)
+    (fp /base)
 
-      (fp /modules/grzegorz.nix)
+    (fp /modules/grzegorz.nix)
-    ];
+  ];
 
   systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
     matchConfig.Name = "eno1";
-    address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
+    address = with values.hosts.georg; [
+      (ipv4 + "/25")
+      (ipv6 + "/64")
+    ];
   };
 
   services.spotifyd = {
@@ -32,5 +41,5 @@
 
   # Don't change (even during upgrades) unless you know what you are doing.
   # See https://search.nixos.org/options?show=system.stateVersion
-  system.stateVersion = "23.05";
+  system.stateVersion = "25.11";
 }

hosts/georg/hardware-configuration.nix

@@ -1,31 +1,44 @@
 # Do not modify this file!  It was generated by 'nixos-generate-config'
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ehci_pci"
+    "ahci"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
+    device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
-      fsType = "ext4";
+    fsType = "ext4";
-    };
+  };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/145E-7362";
+    device = "/dev/disk/by-uuid/145E-7362";
-      fsType = "vfat";
+    fsType = "vfat";
-    };
+  };
 
-  swapDevices =
+  swapDevices = [
-    [ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
+    { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
-    ];
+  ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

hosts/gluttony/configuration.nix

@@ -11,6 +11,15 @@
   ];
 
   systemd.network.enable = lib.mkForce false;
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+
+  boot.loader = {
+    systemd-boot.enable = false; # no uefi support on this device
+    grub.device = "/dev/sda";
+    grub.enable = true;
+  };
+  boot.tmp.cleanOnBoot = true;
+
   networking =
     let
       hostConf = values.hosts.gluttony;

hosts/gluttony/hardware-configuration.nix

@@ -31,7 +31,7 @@
   };
 
   fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/D00A-B488";
+    device = "/dev/disk/by-uuid/933A-3005";
     fsType = "vfat";
     options = [
       "fmask=0077"

hosts/ildkule/configuration.nix

@@ -1,14 +1,21 @@
-{ config, fp, pkgs, lib, values, ... }:
+{
+  config,
+  fp,
+  pkgs,
+  lib,
+  values,
+  ...
+}:
 {
   imports = [
-      # Include the results of the hardware scan.
+    # Include the results of the hardware scan.
-      ./hardware-configuration.nix
+    ./hardware-configuration.nix
-      (fp /base)
+    (fp /base)
 
-      ./services/monitoring
+    ./services/monitoring
-      ./services/nginx
+    ./services/nginx
-      ./services/journald-remote.nix
+    ./services/journald-remote.nix
-    ];
+  ];
 
   boot.loader.systemd-boot.enable = false;
   boot.loader.grub.device = "/dev/vda";
@@ -17,26 +24,37 @@
 
   # Openstack Neutron and systemd-networkd are not best friends, use something else:
   systemd.network.enable = lib.mkForce false;
-  networking = let
+  networking =
-    hostConf = values.hosts.ildkule;
+    let
-  in {
+      hostConf = values.hosts.ildkule;
-    tempAddresses = "disabled";
+    in
-    useDHCP = lib.mkForce true;
+    {
+      tempAddresses = "disabled";
+      useDHCP = lib.mkForce true;
 
-    search = values.defaultNetworkConfig.domains;
+      search = values.defaultNetworkConfig.domains;
-    nameservers = values.defaultNetworkConfig.dns;
+      nameservers = values.defaultNetworkConfig.dns;
-    defaultGateway.address = hostConf.ipv4_internal_gw;
+      defaultGateway.address = hostConf.ipv4_internal_gw;
 
-    interfaces."ens4" = {
+      interfaces."ens4" = {
-      ipv4.addresses = [
+        ipv4.addresses = [
-        { address = hostConf.ipv4;          prefixLength = 32; }
+          {
-        { address = hostConf.ipv4_internal; prefixLength = 24; }
+            address = hostConf.ipv4;
-      ];
+            prefixLength = 32;
-      ipv6.addresses = [
+          }
-        { address = hostConf.ipv6;          prefixLength = 64; }
+          {
-      ];
+            address = hostConf.ipv4_internal;
+            prefixLength = 24;
+          }
+        ];
+        ipv6.addresses = [
+          {
+            address = hostConf.ipv6;
+            prefixLength = 64;
+          }
+        ];
+      };
     };
-  };
 
   services.qemuGuest.enable = true;
 

hosts/ildkule/hardware-configuration.nix

@@ -1,7 +1,12 @@
 { modulesPath, lib, ... }:
 {
   imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "xen_blkfront"
+    "vmw_pvscsi"
+  ];
   boot.initrd.kernelModules = [ "nvme" ];
   fileSystems."/" = {
     device = "/dev/disk/by-uuid/e35eb4ce-aac3-4f91-8383-6e7cd8bbf942";

hosts/ildkule/services/journald-remote.nix

@@ -1,4 +1,9 @@
-{ config, lib, values, ... }:
+{
+  config,
+  lib,
+  values,
+  ...
+}:
 let
   cfg = config.services.journald.remote;
   domainName = "journald.pvv.ntnu.no";
@@ -22,13 +27,15 @@ in
 
   services.journald.remote = {
     enable = true;
-    settings.Remote = let
+    settings.Remote =
-      inherit (config.security.acme.certs.${domainName}) directory;
+      let
-    in {
+        inherit (config.security.acme.certs.${domainName}) directory;
-      ServerKeyFile = "/run/credentials/systemd-journal-remote.service/key.pem";
+      in
-      ServerCertificateFile = "/run/credentials/systemd-journal-remote.service/cert.pem";
+      {
-      TrustedCertificateFile = "-";
+        ServerKeyFile = "/run/credentials/systemd-journal-remote.service/key.pem";
-    };
+        ServerCertificateFile = "/run/credentials/systemd-journal-remote.service/cert.pem";
+        TrustedCertificateFile = "-";
+      };
   };
 
   systemd.sockets."systemd-journal-remote" = {
@@ -47,12 +54,14 @@ in
 
   systemd.services."systemd-journal-remote" = {
     serviceConfig = {
-      LoadCredential = let
+      LoadCredential =
-        inherit (config.security.acme.certs.${domainName}) directory;
+        let
-      in [
+          inherit (config.security.acme.certs.${domainName}) directory;
-        "key.pem:${directory}/key.pem"
+        in
-        "cert.pem:${directory}/cert.pem"
+        [
-      ];
+          "key.pem:${directory}/key.pem"
+          "cert.pem:${directory}/cert.pem"
+        ];
     };
   };
 }

hosts/ildkule/services/monitoring/dashboards/mysql.json

@@ -13,7 +13,7 @@
     ]
   },
   "description": "",
-  "editable": true,
+  "editable": false,
   "gnetId": 11323,
   "graphTooltip": 1,
   "id": 31,
@@ -1899,7 +1899,7 @@
       "dashes": false,
       "datasource": "$datasource",
       "decimals": 0,
-      "description": "***System Memory***: Total Memory for the system.\\\n***InnoDB Buffer Pool Data***: InnoDB maintains a storage area called the buffer pool for caching data and indexes in memory.\\\n***TokuDB Cache Size***: Similar in function to the InnoDB Buffer Pool,  TokuDB will allocate 50% of the installed RAM for its own cache.\\\n***Key Buffer Size***: Index blocks for MYISAM tables are buffered and are shared by all threads. key_buffer_size is the size of the buffer used for index blocks.\\\n***Adaptive Hash Index Size***: When InnoDB notices that some index values are being accessed very frequently, it builds a hash index for them in memory on top of B-Tree indexes.\\\n ***Query Cache Size***: The query cache stores the text of a SELECT statement together with the corresponding result that was sent to the client. The query cache has huge scalability problems in that only one thread can do an operation in the query cache at the same time.\\\n***InnoDB Dictionary Size***: The data dictionary is InnoDB 's internal catalog of tables. InnoDB stores the data dictionary on disk, and loads entries into memory while the server is running.\\\n***InnoDB Log Buffer Size***: The MySQL InnoDB log buffer allows transactions to run without having to write the log to disk before the transactions commit.",
+      "description": "***System Memory***: Total Memory for the system.\\\n***InnoDB Buffer Pool Data***: InnoDB maintains a storage area called the buffer pool for caching data and indexes in memory.\\\n***TokuDB Cache Size***: Similar in function to the InnoDB Buffer Pool,  TokuDB will allocate 50% of the installed RAM for its own cache.\\\n***Key Buffer Size***: Index blocks for MYISAM tables are buffered and are shared by all threads. key_buffer_size is the size of the buffer used for index blocks.\\\n***Adaptive Hash Index Size***: When InnoDB notices that some index values are being accessed very frequently, it builds a hash index for them in memory on top of B-Tree indexes.\\\n ***Query Cache Size***: The query cache stores the text of a SELECT statement together with the corresponding result that was sent to the client. The query cache has huge scalability problems in that only one thread can do an operation in the query cache at the same time.\\\n***InnoDB Dictionary Size***: The data dictionary is InnoDB ‘s internal catalog of tables. InnoDB stores the data dictionary on disk, and loads entries into memory while the server is running.\\\n***InnoDB Log Buffer Size***: The MySQL InnoDB log buffer allows transactions to run without having to write the log to disk before the transactions commit.",
       "editable": true,
       "error": false,
       "fieldConfig": {
@@ -3690,7 +3690,7 @@
         },
         "hide": 0,
         "includeAll": false,
-        "label": "Data Source",
+        "label": "Data source",
         "multi": false,
         "name": "datasource",
         "options": [],
@@ -3713,12 +3713,12 @@
         "definition": "label_values(mysql_up, job)",
         "hide": 0,
         "includeAll": true,
-        "label": "job",
+        "label": "Job",
         "multi": true,
         "name": "job",
         "options": [],
         "query": "label_values(mysql_up, job)",
-        "refresh": 1,
+        "refresh": 2,
         "regex": "",
         "skipUrlSync": false,
         "sort": 0,
@@ -3742,12 +3742,12 @@
         "definition": "label_values(mysql_up, instance)",
         "hide": 0,
         "includeAll": true,
-        "label": "instance",
+        "label": "Instance",
         "multi": true,
         "name": "instance",
         "options": [],
         "query": "label_values(mysql_up, instance)",
-        "refresh": 1,
+        "refresh": 2,
         "regex": "",
         "skipUrlSync": false,
         "sort": 0,

hosts/ildkule/services/monitoring/dashboards/postgres.json

@@ -328,7 +328,7 @@
         "rgba(50, 172, 45, 0.97)"
       ],
       "datasource": "${DS_PROMETHEUS}",
-      "format": "decbytes",
+      "format": "short",
       "gauge": {
         "maxValue": 100,
         "minValue": 0,
@@ -411,7 +411,7 @@
         "rgba(50, 172, 45, 0.97)"
       ],
       "datasource": "${DS_PROMETHEUS}",
-      "format": "decbytes",
+      "format": "short",
       "gauge": {
         "maxValue": 100,
         "minValue": 0,
@@ -1410,7 +1410,7 @@
       "tableColumn": "",
       "targets": [
         {
-          "expr": "pg_settings_seq_page_cost",
+          "expr": "pg_settings_seq_page_cost{instance=\"$instance\"}",
           "format": "time_series",
           "intervalFactor": 1,
           "refId": "A"
@@ -1872,7 +1872,7 @@
       },
       "yaxes": [
         {
-          "format": "bytes",
+          "format": "short",
           "label": null,
           "logBase": 1,
           "max": null,
@@ -1966,7 +1966,7 @@
       },
       "yaxes": [
         {
-          "format": "bytes",
+          "format": "short",
           "label": null,
           "logBase": 1,
           "max": null,
@@ -2060,7 +2060,7 @@
       },
       "yaxes": [
         {
-          "format": "bytes",
+          "format": "short",
           "label": null,
           "logBase": 1,
           "max": null,
@@ -2251,7 +2251,7 @@
       },
       "yaxes": [
         {
-          "format": "bytes",
+          "format": "short",
           "label": null,
           "logBase": 1,
           "max": null,
@@ -2439,7 +2439,7 @@
       },
       "yaxes": [
         {
-          "format": "bytes",
+          "format": "short",
           "label": null,
           "logBase": 1,
           "max": null,
@@ -2589,35 +2589,35 @@
       "steppedLine": false,
       "targets": [
         {
-          "expr": "irate(pg_stat_bgwriter_buffers_backend{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_backend_total{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "buffers_backend",
           "refId": "A"
         },
         {
-          "expr": "irate(pg_stat_bgwriter_buffers_alloc{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_alloc_total{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "buffers_alloc",
           "refId": "B"
         },
         {
-          "expr": "irate(pg_stat_bgwriter_buffers_backend_fsync{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_backend_fsync_total{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "backend_fsync",
           "refId": "C"
         },
         {
-          "expr": "irate(pg_stat_bgwriter_buffers_checkpoint{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_checkpoint_total{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "buffers_checkpoint",
           "refId": "D"
         },
         {
-          "expr": "irate(pg_stat_bgwriter_buffers_clean{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_buffers_clean_total{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "buffers_clean",
@@ -2886,14 +2886,14 @@
       "steppedLine": false,
       "targets": [
         {
-          "expr": "irate(pg_stat_bgwriter_checkpoint_write_time{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_checkpoint_write_time_total{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "write_time - Total amount of time that has been spent in the portion of checkpoint processing where files are written to disk.",
           "refId": "B"
         },
         {
-          "expr": "irate(pg_stat_bgwriter_checkpoint_sync_time{instance=\"$instance\"}[5m])",
+          "expr": "irate(pg_stat_bgwriter_checkpoint_sync_time_total{instance=\"$instance\"}[5m])",
           "format": "time_series",
           "intervalFactor": 1,
           "legendFormat": "sync_time - Total amount of time that has been spent in the portion of checkpoint processing where files are synchronized to disk.",
@@ -3164,4 +3164,4 @@
   "title": "PostgreSQL Database",
   "uid": "000000039",
   "version": 1
-}
+}

hosts/ildkule/services/monitoring/grafana.nix

@@ -1,32 +1,43 @@
-{ config, pkgs, values, ... }: let
+{
+  config,
+  pkgs,
+  values,
+  ...
+}:
+let
   cfg = config.services.grafana;
-in {
+in
-  sops.secrets = let
+{
-    owner = "grafana";
+  sops.secrets =
-    group = "grafana";
+    let
-  in {
+      owner = "grafana";
-    "keys/grafana/secret_key" = { inherit owner group; };
+      group = "grafana";
-    "keys/grafana/admin_password" = { inherit owner group; };
+    in
-  };
+    {
+      "keys/grafana/secret_key" = { inherit owner group; };
+      "keys/grafana/admin_password" = { inherit owner group; };
+    };
 
   services.grafana = {
     enable = true;
 
-    settings = let
+    settings =
-      # See https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider
+      let
-      secretFile = path: "$__file{${path}}";
+        # See https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider
-    in {
+        secretFile = path: "$__file{${path}}";
-      server = {
+      in
-        domain = "grafana.pvv.ntnu.no";
+      {
-        http_port = 2342;
+        server = {
-        http_addr = "127.0.0.1";
+          domain = "grafana.pvv.ntnu.no";
-      };
+          http_port = 2342;
+          http_addr = "127.0.0.1";
+        };
 
-      security = {
+        security = {
-        secret_key = secretFile config.sops.secrets."keys/grafana/secret_key".path;
+          secret_key = secretFile config.sops.secrets."keys/grafana/secret_key".path;
-        admin_password = secretFile config.sops.secrets."keys/grafana/admin_password".path;
+          admin_password = secretFile config.sops.secrets."keys/grafana/admin_password".path;
+        };
       };
-    };
 
     provision = {
       enable = true;
@@ -47,13 +58,13 @@ in {
         {
           name = "Node Exporter Full";
           type = "file";
-          url = "https://grafana.com/api/dashboards/1860/revisions/29/download";
+          url = "https://grafana.com/api/dashboards/1860/revisions/42/download";
           options.path = dashboards/node-exporter-full.json;
         }
         {
           name = "Matrix Synapse";
           type = "file";
-          url = "https://raw.githubusercontent.com/matrix-org/synapse/develop/contrib/grafana/synapse.json";
+          url = "https://github.com/element-hq/synapse/raw/refs/heads/develop/contrib/grafana/synapse.json";
           options.path = dashboards/synapse.json;
         }
         {
@@ -65,15 +76,9 @@ in {
         {
           name = "Postgresql";
           type = "file";
-          url = "https://grafana.com/api/dashboards/9628/revisions/7/download";
+          url = "https://grafana.com/api/dashboards/9628/revisions/8/download";
           options.path = dashboards/postgres.json;
         }
-        {
-          name = "Go Processes (gogs)";
-          type = "file";
-          url = "https://grafana.com/api/dashboards/240/revisions/3/download";
-          options.path = dashboards/go-processes.json;
-        }
         {
           name = "Gitea Dashboard";
           type = "file";

hosts/ildkule/services/monitoring/loki.nix

@@ -3,7 +3,8 @@
 let
   cfg = config.services.loki;
   stateDir = "/data/monitoring/loki";
-in {
+in
+{
   services.loki = {
     enable = true;
     configuration = {

hosts/ildkule/services/monitoring/prometheus/default.nix

@@ -1,6 +1,8 @@
-{ config, ... }: let
+{ config, ... }:
+let
   stateDir = "/data/monitoring/prometheus";
-in {
+in
+{
   imports = [
     ./exim.nix
     ./gitea.nix

hosts/ildkule/services/monitoring/prometheus/exim.nix

@@ -5,9 +5,11 @@
       {
         job_name = "exim";
         scrape_interval = "15s";
-        static_configs = [{
+        static_configs = [
-          targets = [ "microbel.pvv.ntnu.no:9636" ];
+          {
-        }];
+            targets = [ "microbel.pvv.ntnu.no:9636" ];
+          }
+        ];
       }
     ];
   };

hosts/ildkule/services/monitoring/prometheus/gitea.nix

@@ -1,16 +1,18 @@
 { ... }:
 {
-  services.prometheus.scrapeConfigs = [{
+  services.prometheus.scrapeConfigs = [
-    job_name = "gitea";
+    {
-    scrape_interval = "60s";
+      job_name = "gitea";
-    scheme = "https";
+      scrape_interval = "60s";
+      scheme = "https";
 
-    static_configs = [
+      static_configs = [
-      {
+        {
-        targets = [
+          targets = [
-          "git.pvv.ntnu.no:443"
+            "git.pvv.ntnu.no:443"
-        ];
+          ];
-      }
+        }
-    ];
+      ];
-  }];
+    }
+  ];
 }

hosts/ildkule/services/monitoring/prometheus/machines.nix

@@ -1,4 +1,5 @@
-{ config, ... }: let
+{ config, ... }:
+let
   cfg = config.services.prometheus;
 
   mkHostScrapeConfig = name: ports: {
@@ -9,29 +10,98 @@
   defaultNodeExporterPort = 9100;
   defaultSystemdExporterPort = 9101;
   defaultNixosExporterPort = 9102;
-in {
+in
-  services.prometheus.scrapeConfigs = [{
+{
-    job_name = "base_info";
+  services.prometheus.scrapeConfigs = [
-    static_configs = [
+    {
-      (mkHostScrapeConfig "ildkule" [ cfg.exporters.node.port cfg.exporters.systemd.port defaultNixosExporterPort ])
+      job_name = "base_info";
+      static_configs = [
+        (mkHostScrapeConfig "ildkule" [
+          cfg.exporters.node.port
+          cfg.exporters.systemd.port
+          defaultNixosExporterPort
+        ])
 
-      (mkHostScrapeConfig "bekkalokk" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+        (mkHostScrapeConfig "bekkalokk" [
-      (mkHostScrapeConfig "bicep" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+          defaultNodeExporterPort
-      (mkHostScrapeConfig "brzeczyszczykiewicz" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+          defaultSystemdExporterPort
-      (mkHostScrapeConfig "georg" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+          defaultNixosExporterPort
-      (mkHostScrapeConfig "kommode" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+        ])
-      (mkHostScrapeConfig "ustetind" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+        (mkHostScrapeConfig "bicep" [
-      (mkHostScrapeConfig "wenche" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+          defaultNodeExporterPort
+          defaultSystemdExporterPort
+          defaultNixosExporterPort
+        ])
+        (mkHostScrapeConfig "brzeczyszczykiewicz" [
+          defaultNodeExporterPort
+          defaultSystemdExporterPort
+          defaultNixosExporterPort
+        ])
+        (mkHostScrapeConfig "georg" [
+          defaultNodeExporterPort
+          defaultSystemdExporterPort
+          defaultNixosExporterPort
+        ])
+        (mkHostScrapeConfig "gluttony" [
+          defaultNodeExporterPort
+          defaultSystemdExporterPort
+          defaultNixosExporterPort
+        ])
+        (mkHostScrapeConfig "kommode" [
+          defaultNodeExporterPort
+          defaultSystemdExporterPort
+          defaultNixosExporterPort
+        ])
+        (mkHostScrapeConfig "lupine-1" [
+          defaultNodeExporterPort
+          defaultSystemdExporterPort
+          defaultNixosExporterPort
+        ])
+        (mkHostScrapeConfig "lupine-2" [
+          defaultNodeExporterPort
+          defaultSystemdExporterPort
+          defaultNixosExporterPort
+        ])
+        (mkHostScrapeConfig "lupine-3" [
+          defaultNodeExporterPort
+          defaultSystemdExporterPort
+          defaultNixosExporterPort
+        ])
+        (mkHostScrapeConfig "lupine-4" [
+          defaultNodeExporterPort
+          defaultSystemdExporterPort
+          defaultNixosExporterPort
+        ])
+        (mkHostScrapeConfig "lupine-5" [
+          defaultNodeExporterPort
+          defaultSystemdExporterPort
+          defaultNixosExporterPort
+        ])
+        (mkHostScrapeConfig "temmie" [
+          defaultNodeExporterPort
+          defaultSystemdExporterPort
+          defaultNixosExporterPort
+        ])
+        (mkHostScrapeConfig "ustetind" [
+          defaultNodeExporterPort
+          defaultSystemdExporterPort
+          defaultNixosExporterPort
+        ])
+        (mkHostScrapeConfig "wenche" [
+          defaultNodeExporterPort
+          defaultSystemdExporterPort
+          defaultNixosExporterPort
+        ])
 
-      (mkHostScrapeConfig "lupine-1" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+        (mkHostScrapeConfig "skrott" [
-      # (mkHostScrapeConfig "lupine-2" [ defaultNodeExporterPort defaultSystemdExporterPort ])
+          defaultNodeExporterPort
-      (mkHostScrapeConfig "lupine-3" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+          defaultSystemdExporterPort
-      (mkHostScrapeConfig "lupine-4" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
+        ])
-      (mkHostScrapeConfig "lupine-5" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
 
-      (mkHostScrapeConfig "hildring" [ defaultNodeExporterPort ])
+        (mkHostScrapeConfig "hildring" [ defaultNodeExporterPort ])
-      (mkHostScrapeConfig "isvegg" [ defaultNodeExporterPort ])
+        (mkHostScrapeConfig "isvegg" [ defaultNodeExporterPort ])
-      (mkHostScrapeConfig "microbel" [ defaultNodeExporterPort ])
+        (mkHostScrapeConfig "microbel" [ defaultNodeExporterPort ])
-    ];
+      ];
-  }];
+    }
+  ];
 }

hosts/ildkule/services/monitoring/prometheus/matrix-synapse.nix

@@ -1,40 +1,44 @@
 { ... }:
 {
-  services.prometheus.scrapeConfigs = [{
+  services.prometheus.scrapeConfigs = [
-    job_name = "synapse";
+    {
-    scrape_interval = "15s";
+      job_name = "synapse";
-    scheme = "https";
+      scrape_interval = "15s";
+      scheme = "https";
 
-    http_sd_configs = [{
+      http_sd_configs = [
-      url = "https://matrix.pvv.ntnu.no/metrics/config.json";
+        {
-    }];
+          url = "https://matrix.pvv.ntnu.no/metrics/config.json";
+        }
+      ];
 
-    relabel_configs = [
+      relabel_configs = [
-      {
+        {
-        source_labels = [ "__address__" ];
+          source_labels = [ "__address__" ];
-        regex = "[^/]+(/.*)";
+          regex = "[^/]+(/.*)";
-        target_label = "__metrics_path__";
+          target_label = "__metrics_path__";
-      }
+        }
-      {
+        {
-        source_labels = [ "__address__" ];
+          source_labels = [ "__address__" ];
-        regex = "([^/]+)/.*";
+          regex = "([^/]+)/.*";
-        target_label = "instance";
+          target_label = "instance";
-      }
+        }
-      {
+        {
-        source_labels = [ "__address__" ];
+          source_labels = [ "__address__" ];
-        regex = "[^/]+\\/+[^/]+/(.*)/\\d+$";
+          regex = "[^/]+\\/+[^/]+/(.*)/\\d+$";
-        target_label = "job";
+          target_label = "job";
-      }
+        }
-      {
+        {
-        source_labels = [ "__address__" ];
+          source_labels = [ "__address__" ];
-        regex = "[^/]+\\/+[^/]+/.*/(\\d+)$";
+          regex = "[^/]+\\/+[^/]+/.*/(\\d+)$";
-        target_label = "index";
+          target_label = "index";
-      }
+        }
-      {
+        {
-        source_labels = [ "__address__" ];
+          source_labels = [ "__address__" ];
-        regex = "([^/]+)/.*";
+          regex = "([^/]+)/.*";
-        target_label = "__address__";
+          target_label = "__address__";
-      }
+        }
-    ];
+      ];
-  }];
+    }
+  ];
 }

hosts/ildkule/services/monitoring/prometheus/mysqld.nix

@@ -1,36 +1,42 @@
-{ config, ... }: let
+{ config, ... }:
+let
   cfg = config.services.prometheus;
-in {
+in
+{
   sops = {
     secrets."config/mysqld_exporter_password" = { };
 
     templates."mysqld_exporter.conf" = {
       restartUnits = [ "prometheus-mysqld-exporter.service" ];
-      content = let
+      content =
-        inherit (config.sops) placeholder;
+        let
-      in ''
+          inherit (config.sops) placeholder;
-        [client]
+        in
-        host = mysql.pvv.ntnu.no
+        ''
-        port = 3306
+          [client]
-        user = prometheus_mysqld_exporter
+          host = mysql.pvv.ntnu.no
-        password = ${placeholder."config/mysqld_exporter_password"}
+          port = 3306
-      '';
+          user = prometheus_mysqld_exporter
+          password = ${placeholder."config/mysqld_exporter_password"}
+        '';
     };
   };
 
   services.prometheus = {
-    scrapeConfigs = [{
+    scrapeConfigs = [
-      job_name = "mysql";
+      {
-      scheme = "http";
+        job_name = "mysql";
-      metrics_path = cfg.exporters.mysqld.telemetryPath;
+        scheme = "http";
-      static_configs = [
+        metrics_path = cfg.exporters.mysqld.telemetryPath;
-        {
+        static_configs = [
-          targets = [
+          {
-            "localhost:${toString cfg.exporters.mysqld.port}"
+            targets = [
-          ];
+              "localhost:${toString cfg.exporters.mysqld.port}"
-        }
+            ];
-      ];
+          }
-    }];
+        ];
+      }
+    ];
 
     exporters.mysqld = {
       enable = true;

hosts/ildkule/services/monitoring/prometheus/postgres.nix

@@ -1,9 +1,17 @@
-{ pkgs, lib, config, values, ... }: let
+{
+  pkgs,
+  lib,
+  config,
+  values,
+  ...
+}:
+let
   cfg = config.services.prometheus;
-in {
+in
+{
   sops.secrets = {
-    "keys/postgres/postgres_exporter_env" = {};
+    "keys/postgres/postgres_exporter_env" = { };
-    "keys/postgres/postgres_exporter_knakelibrak_env" = {};
+    "keys/postgres/postgres_exporter_knakelibrak_env" = { };
   };
 
   services.prometheus = {
@@ -11,22 +19,26 @@ in {
       {
         job_name = "postgres";
         scrape_interval = "15s";
-        static_configs = [{
+        static_configs = [
-          targets = [ "localhost:${toString cfg.exporters.postgres.port}" ];
+          {
-          labels = {
+            targets = [ "localhost:${toString cfg.exporters.postgres.port}" ];
-            server = "bicep";
+            labels = {
-          };
+              server = "bicep";
-        }];
+            };
+          }
+        ];
       }
       {
         job_name = "postgres-knakelibrak";
         scrape_interval = "15s";
-        static_configs = [{
+        static_configs = [
-          targets = [ "localhost:${toString (cfg.exporters.postgres.port + 1)}" ];
+          {
-          labels = {
+            targets = [ "localhost:${toString (cfg.exporters.postgres.port + 1)}" ];
-            server = "knakelibrak";
+            labels = {
-          };
+              server = "knakelibrak";
-        }];
+            };
+          }
+        ];
       }
     ];
 
@@ -37,9 +49,11 @@ in {
     };
   };
 
-  systemd.services.prometheus-postgres-exporter-knakelibrak.serviceConfig = let
+  systemd.services.prometheus-postgres-exporter-knakelibrak.serviceConfig =
-    localCfg = config.services.prometheus.exporters.postgres;
+    let
-  in lib.recursiveUpdate config.systemd.services.prometheus-postgres-exporter.serviceConfig {
+      localCfg = config.services.prometheus.exporters.postgres;
+    in
+    lib.recursiveUpdate config.systemd.services.prometheus-postgres-exporter.serviceConfig {
       EnvironmentFile = config.sops.secrets."keys/postgres/postgres_exporter_knakelibrak_env".path;
       ExecStart = ''
         ${pkgs.prometheus-postgres-exporter}/bin/postgres_exporter \

hosts/ildkule/services/monitoring/uptime-kuma.nix

@@ -1,9 +1,15 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   cfg = config.services.uptime-kuma;
   domain = "status.pvv.ntnu.no";
   stateDir = "/data/monitoring/uptime-kuma";
-in {
+in
+{
   services.uptime-kuma = {
     enable = true;
     settings = {

hosts/kommode/configuration.nix

@@ -1,9 +1,15 @@
-{ pkgs, values, fp, ... }:
+{
+  pkgs,
+  values,
+  fp,
+  ...
+}:
 {
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
     (fp /base)
+    ./disks.nix
 
     ./services/gitea
     ./services/nginx.nix
@@ -11,7 +17,10 @@
 
   systemd.network.networks."30-ens18" = values.defaultNetworkConfig // {
     matchConfig.Name = "ens18";
-    address = with values.hosts.kommode; [ (ipv4 + "/25") (ipv6 + "/64") ];
+    address = with values.hosts.kommode; [
+      (ipv4 + "/25")
+      (ipv6 + "/64")
+    ];
   };
 
   services.btrfs.autoScrub.enable = true;

hosts/kommode/disks.nix

@@ -0,0 +1,80 @@
+{ lib, ... }:
+{
+  disko.devices = {
+    disk = {
+      sda = {
+        type = "disk";
+        device = "/dev/sda";
+        content = {
+          type = "gpt";
+          partitions = {
+            root = {
+              name = "root";
+              label = "root";
+              start = "1MiB";
+              end = "-5G";
+              content = {
+                type = "btrfs";
+                extraArgs = [ "-f" ]; # Override existing partition
+                # subvolumes = let
+                #   makeSnapshottable = subvolPath: mountOptions: let
+                #     name = lib.replaceString "/" "-" subvolPath;
+                #   in {
+                #     "@${name}/active" = {
+                #       mountpoint = subvolPath;
+                #       inherit mountOptions;
+                #     };
+                #     "@${name}/snapshots" = {
+                #       mountpoint = "${subvolPath}/.snapshots";
+                #       inherit mountOptions;
+                #     };
+                #   };
+                # in {
+                #   "@" = { };
+                #   "@/swap" = {
+                #     mountpoint = "/.swapvol";
+                #     swap.swapfile.size = "4G";
+                #   };
+                #   "@/root" = {
+                #     mountpoint = "/";
+                #     mountOptions = [ "compress=zstd" "noatime" ];
+                #   };
+                # }
+                # // (makeSnapshottable "/home" [ "compress=zstd" "noatime" ])
+                # // (makeSnapshottable "/nix" [ "compress=zstd" "noatime" ])
+                # // (makeSnapshottable "/var/lib" [ "compress=zstd" "noatime" ])
+                # // (makeSnapshottable "/var/log" [ "compress=zstd" "noatime" ])
+                # // (makeSnapshottable "/var/cache" [ "compress=zstd" "noatime" ]);
+
+                # swap.swapfile.size = "4G";
+                mountpoint = "/";
+              };
+            };
+
+            swap = {
+              name = "swap";
+              label = "swap";
+              start = "-5G";
+              end = "-1G";
+              content.type = "swap";
+            };
+
+            ESP = {
+              name = "ESP";
+              label = "ESP";
+              start = "-1G";
+              end = "100%";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/kommode/hardware-configuration.nix

@@ -1,33 +1,31 @@
 # Do not modify this file!  It was generated by 'nixos-generate-config'
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
-    ];
+  ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/d421538f-a260-44ae-8e03-47cac369dcc1";
-      fsType = "btrfs";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/86CD-4C23";
-      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/4cfbb41e-801f-40dd-8c58-0a0c1a6025f6"; }
-    ];
-
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction

hosts/kommode/services/gitea/customization/default.nix

@@ -1,4 +1,10 @@
-{ config, pkgs, lib, fp, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  fp,
+  ...
+}:
 let
   cfg = config.services.gitea;
 in
@@ -10,54 +16,117 @@ in
     catppuccin = pkgs.gitea-theme-catppuccin;
   };
 
+  services.gitea.settings = {
+    ui = {
+      DEFAULT_THEME = "gitea-auto";
+      REACTIONS = lib.concatStringsSep "," [
+        "+1"
+        "-1"
+        "laugh"
+        "confused"
+        "heart"
+        "hooray"
+        "rocket"
+        "eyes"
+        "100"
+        "anger"
+        "astonished"
+        "no_good"
+        "ok_hand"
+        "pensive"
+        "pizza"
+        "point_up"
+        "sob"
+        "skull"
+        "upside_down_face"
+        "shrug"
+        "huh"
+        "bruh"
+        "okiedokie"
+        "grr"
+      ];
+
+      CUSTOM_EMOJIS = lib.concatStringsSep "," [
+        "bruh"
+        "grr"
+        "huh"
+        "ohyeah"
+      ];
+    };
+    "ui.meta" = {
+      AUTHOR = "Programvareverkstedet";
+      DESCRIPTION = "Bokstavelig talt programvareverkstedet";
+      KEYWORDS = lib.concatStringsSep "," [
+        "git"
+        "hackerspace"
+        "nix"
+        "open source"
+        "foss"
+        "organization"
+        "software"
+        "student"
+      ];
+    };
+  };
+
   systemd.services.gitea-customization = lib.mkIf cfg.enable {
     description = "Install extra customization in gitea's CUSTOM_DIR";
     wantedBy = [ "gitea.service" ];
     requiredBy = [ "gitea.service" ];
 
-    serviceConfig =  {
+    serviceConfig = {
       Type = "oneshot";
       User = cfg.user;
       Group = cfg.group;
     };
 
-    script = let
+    script =
-      logo-svg = fp /assets/logo_blue_regular.svg;
+      let
-      logo-png = fp /assets/logo_blue_regular.png;
+        logo-svg = fp /assets/logo_blue_regular.svg;
+        logo-png = fp /assets/logo_blue_regular.png;
 
-      extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
+        extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
-        <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
+          <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
+        '';
+
+        extraLinksFooter = pkgs.writeText "gitea-extra-links-footer.tmpl" ''
+          <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
+          <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
+          <a class="item" href="https://wiki.pvv.ntnu.no/wiki/Tjenester/Kodelager">PVV Gitea Howto</a>
+        '';
+
+        project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
+          labels = lib.importJSON ./labels/projects.json;
+        };
+
+        customTemplates =
+          pkgs.runCommandLocal "gitea-templates"
+            {
+              nativeBuildInputs = with pkgs; [
+                coreutils
+                gnused
+              ];
+            }
+            ''
+              # Bigger icons
+              install -Dm444 "${cfg.package.src}/templates/repo/icon.tmpl" "$out/repo/icon.tmpl"
+              sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
+            '';
+      in
+      ''
+        install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
+        install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
+        install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
+        install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
+        install -Dm444 ${extraLinksFooter} ${cfg.customDir}/templates/custom/extra_links_footer.tmpl
+        install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml
+
+        install -Dm644 ${./emotes/bruh.png} ${cfg.customDir}/public/assets/img/emoji/bruh.png
+        install -Dm644 ${./emotes/huh.gif} ${cfg.customDir}/public/assets/img/emoji/huh.png
+        install -Dm644 ${./emotes/grr.png} ${cfg.customDir}/public/assets/img/emoji/grr.png
+        install -Dm644 ${./emotes/okiedokie.jpg} ${cfg.customDir}/public/assets/img/emoji/okiedokie.png
+
+        "${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
       '';
-
-      extraLinksFooter = pkgs.writeText "gitea-extra-links-footer.tmpl" ''
-        <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
-        <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
-        <a class="item" href="https://wiki.pvv.ntnu.no/wiki/Tjenester/Kodelager">PVV Gitea Howto</a>
-      '';
-
-      project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
-        labels = lib.importJSON ./labels/projects.json;
-      };
-
-      customTemplates = pkgs.runCommandLocal "gitea-templates" {
-        nativeBuildInputs = with pkgs; [
-          coreutils
-          gnused
-        ];
-      } ''
-        # Bigger icons
-        install -Dm444 "${cfg.package.src}/templates/repo/icon.tmpl" "$out/repo/icon.tmpl"
-        sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
-      '';
-    in ''
-      install -Dm444 ${logo-svg} ${cfg.customDir}/public/assets/img/logo.svg
-      install -Dm444 ${logo-png} ${cfg.customDir}/public/assets/img/logo.png
-      install -Dm444 ${./loading.apng} ${cfg.customDir}/public/assets/img/loading.png
-      install -Dm444 ${extraLinks} ${cfg.customDir}/templates/custom/extra_links.tmpl
-      install -Dm444 ${extraLinksFooter} ${cfg.customDir}/templates/custom/extra_links_footer.tmpl
-      install -Dm444 ${project-labels} ${cfg.customDir}/options/label/project-labels.yaml
-
-      "${lib.getExe pkgs.rsync}" -a "${customTemplates}/" ${cfg.customDir}/templates/
-    '';
   };
 }