mirror of
https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git
synced 2026-08-11 05:42:33 +02:00
Compare commits
1
Commits
main
..
base-auditd
| Author | SHA1 | Date | |
|---|---|---|---|
 h7x4
|
af69c27fe2 |
@@ -34,12 +34,12 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
|
||||
|
||||
| Name | Type | Description |
|
||||
|----------------------------|----------|-----------------------------------------------------------|
|
||||
| [bekkalokk][bek] | Physical | Our main web host, webmail, wiki, idp, ... |
|
||||
| [bekkalokk][bek] | Physical | Our main web host, webmail, wiki, idp, minecraft map, ... |
|
||||
| [bicep][bic] | Virtual | Database host, matrix, git mirrors, ... |
|
||||
| bikkje | Virtual | Experimental login box |
|
||||
| [brzeczyszczykiewicz][brz] | Physical | Shared music player |
|
||||
| [georg][geo] | Physical | Shared music player |
|
||||
| [gluttony][glu] | Virtual | General purpose compute, minecraft map |
|
||||
| [gluttony][glu] | Virtual | General purpose compute |
|
||||
| [ildkule][ild] | Virtual | Logging and monitoring host, prometheus, grafana, ... |
|
||||
| [kommode][kom] | Virtual | Gitea + Gitea pages |
|
||||
| [lupine][lup] | Physical | Gitea CI/CD runners |
|
||||
|
||||
@@ -22,6 +22,7 @@
|
||||
./vm.nix
|
||||
|
||||
./services/acme.nix
|
||||
./services/auditd.nix
|
||||
./services/auto-upgrade.nix
|
||||
./services/dbus.nix
|
||||
./services/fluentbit.nix
|
||||
|
||||
@@ -21,18 +21,4 @@ in
|
||||
boot.blacklistedKernelModules = modulesToBan;
|
||||
|
||||
boot.extraModprobeConfig = lib.concatMapStringsSep "\n" (mod: "install ${mod} ${lib.getExe' pkgs.coreutils "false"}") modulesToBan;
|
||||
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
matrix-synapse-unwrapped = prev.matrix-synapse-unwrapped.overrideAttrs (old: rec {
|
||||
version = "1.157.2";
|
||||
src = final.fetchFromGitHub {
|
||||
owner = "element-hq";
|
||||
repo = "synapse";
|
||||
rev = "v${version}";
|
||||
hash = "sha256-TUHcNAXrV43+J7jqfstlYdrZrwL5kDCh03yxO+vL/gw=";
|
||||
};
|
||||
});
|
||||
})
|
||||
];
|
||||
}
|
||||
|
||||
@@ -0,0 +1,56 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
security.audit = {
|
||||
enable = lib.mkDefault true;
|
||||
|
||||
# NOTE: see auditctl(8) for the meaning of the different rule flags.
|
||||
rules = [
|
||||
# Kernel module loading/unloading
|
||||
"-a always,exit -F arch=b64 -S init_module,finit_module,delete_module -k kernel-modules"
|
||||
|
||||
# Mount/unmount by real (non-service) users
|
||||
"-a always,exit -F arch=b64 -S mount,umount2 -F auid>=1000 -F auid!=-1 -k mounts"
|
||||
|
||||
# DAC permission/ownership changes by real users
|
||||
"-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=-1 -k perm-mod"
|
||||
"-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=-1 -k perm-mod"
|
||||
"-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=-1 -k perm-mod"
|
||||
|
||||
# Failed access attempts (permission denied) by real users
|
||||
"-a always,exit -F arch=b64 -S open,openat,creat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k access"
|
||||
"-a always,exit -F arch=b64 -S open,openat,creat,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k access"
|
||||
|
||||
# File deletion/rename by real users
|
||||
"-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=-1 -k delete"
|
||||
|
||||
# Execution of privileged commands
|
||||
"-w ${config.security.wrapperDir}/sudo -p x -k privileged-sudo"
|
||||
"-w ${config.security.wrapperDir}/su -p x -k privileged-su"
|
||||
|
||||
# Read of files containing secrets.
|
||||
"-w /var/lib/sops-nix/key.txt -p r -k secrets"
|
||||
"-w /run/secrets -p r -k secrets"
|
||||
"-w /etc/ssh/ssh_host_ed25519_key -p r -k secrets"
|
||||
"-w /etc/ssh/ssh_host_rsa_key -p r -k secrets"
|
||||
|
||||
# NixOS generation switching
|
||||
"-w /nix/var/nix/profiles -p wa -k nixos-generation-switch"
|
||||
|
||||
# Switching bootloader content
|
||||
"-w /boot -p wa -k boot-tampering"
|
||||
|
||||
# Login records
|
||||
"-w /var/lib/lastlog2 -p wa -k logins"
|
||||
|
||||
# Write or append to the audit trail
|
||||
"-w /var/log/audit -p wa -k audit-log-tampering"
|
||||
"-w ${lib.getExe' pkgs.audit "auditctl"} -p x -k audit-tools"
|
||||
];
|
||||
};
|
||||
|
||||
security.auditd = {
|
||||
enable = lib.mkDefault true;
|
||||
plugins.syslog.active = true;
|
||||
plugins.af_unix.active = true;
|
||||
};
|
||||
}
|
||||
@@ -9,7 +9,7 @@ in
|
||||
URL = "https://journald.pvv.ntnu.no:${toString config.services.journald.remote.port}";
|
||||
ServerKeyFile = "-";
|
||||
ServerCertificateFile = "-";
|
||||
TrustedCertificateFile = config.security.pki.caBundle;
|
||||
TrustedCertificateFile = "-";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
Generated
+29
-29
@@ -126,11 +126,11 @@
|
||||
"rust-overlay": "rust-overlay_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1784709844,
|
||||
"narHash": "sha256-5PW5+UEFFjsru5FiDg9ZRUjQyo7AVyc+nesQlBSqM6c=",
|
||||
"lastModified": 1784553736,
|
||||
"narHash": "sha256-W1pPlTHmp+EvONwf8Qa5NvCiuyV4LC/yNDdc27RSpuA=",
|
||||
"ref": "main",
|
||||
"rev": "a8fb5df19d1cdcc3ac29cdb8ad192c1d578761f0",
|
||||
"revCount": 63,
|
||||
"rev": "e06daaef1f48160254c202c59b060ac6f1da9f38",
|
||||
"revCount": 62,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
|
||||
},
|
||||
@@ -253,11 +253,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1786305372,
|
||||
"narHash": "sha256-ZKTGJzXQMeskdivpyXmfyonEjR25b42N9tWwx+nvKMM=",
|
||||
"lastModified": 1770960722,
|
||||
"narHash": "sha256-IdhPsWFZUKSJh/nLjGLJvGM5d5Uta+k1FlVYPxTZi0E=",
|
||||
"ref": "main",
|
||||
"rev": "723a3d8d117bbfa07bda86427afaef1b1b6b7ff5",
|
||||
"revCount": 19,
|
||||
"rev": "c2e4aca7e1ba27cd09eeaeab47010d32a11841b2",
|
||||
"revCount": 15,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
|
||||
},
|
||||
@@ -291,11 +291,11 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1786245335,
|
||||
"narHash": "sha256-cAR1Po8rYta0tqfjdotDXYVaPC3oJ1/th2cLcQNQSco=",
|
||||
"rev": "33ddeb9e7c03403e17814e8aac1f7affe6d70b21",
|
||||
"lastModified": 1784526640,
|
||||
"narHash": "sha256-UDnuu3uM64qjfVvsGSislJgP1j15FiFiDiKOjbGTv9Q=",
|
||||
"rev": "036c2421db75172aeef4bb83921988891d4773c9",
|
||||
"type": "tarball",
|
||||
"url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.7300.33ddeb9e7c03/nixexprs.tar.xz"
|
||||
"url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.5692.036c2421db75/nixexprs.tar.xz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
@@ -319,11 +319,11 @@
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1786237299,
|
||||
"narHash": "sha256-ZNjdCWSLUF0mrPSKXijAm606sfbI6889LCg6doYG3B8=",
|
||||
"rev": "60c768b1d7043edb84f25e2880ab2bd8327f6cfa",
|
||||
"lastModified": 1784536202,
|
||||
"narHash": "sha256-7CmHmK10lEXBgymS0DeYj4/4STLpzRWCc/5BfoIxHQo=",
|
||||
"rev": "94f12be79cb7f961726a0157b4168bc722befeac",
|
||||
"type": "tarball",
|
||||
"url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.11pre1050368.60c768b1d704/nixexprs.tar.xz"
|
||||
"url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.11pre1037880.94f12be79cb7/nixexprs.tar.xz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
@@ -379,11 +379,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1784979981,
|
||||
"narHash": "sha256-OnvjEXYU/InjJYH2+iIrvHWIjHnc5J9f84qWhrgAWlY=",
|
||||
"lastModified": 1782759909,
|
||||
"narHash": "sha256-gktjBeZyoRvVBkm2cO1tD99fdQ34iUDyB6iecRdorm4=",
|
||||
"ref": "main",
|
||||
"rev": "ffb8ed0c9df2444727e49f16f7e43ea70184dc4b",
|
||||
"revCount": 590,
|
||||
"rev": "ad6c79fb713884a4a2df8aab30914cd0c1c2e6cb",
|
||||
"revCount": 587,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
||||
},
|
||||
@@ -447,17 +447,17 @@
|
||||
"rust-overlay": "rust-overlay_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1785060737,
|
||||
"narHash": "sha256-tlOCUK+X1Um1y/pP/vToGrygn1wmrtUDKrvQquPLVfA=",
|
||||
"lastModified": 1784550731,
|
||||
"narHash": "sha256-KDrBGT98fQWlnEBmTvIijPq4n4sVLcETBu8EuL486SM=",
|
||||
"ref": "main",
|
||||
"rev": "35fe97baa795d1564c79b013d8a36ee01698f47b",
|
||||
"revCount": 126,
|
||||
"rev": "c0c0e47c8a45673c62462cadf38a489b72fd39ec",
|
||||
"revCount": 112,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"rev": "35fe97baa795d1564c79b013d8a36ee01698f47b",
|
||||
"rev": "c0c0e47c8a45673c62462cadf38a489b72fd39ec",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
|
||||
}
|
||||
@@ -575,11 +575,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1785100355,
|
||||
"narHash": "sha256-wBGnYrF7Kfs4vk3djspT3RdQqsYiqm60fKn7/J3vH4I=",
|
||||
"lastModified": 1780762731,
|
||||
"narHash": "sha256-EuDaLnasWN0mpi995n+fAQQfPGBhqNW4fNjlQRpHt58=",
|
||||
"ref": "main",
|
||||
"rev": "611f6ac1a304cc319fc85876d3f0301f49ce458e",
|
||||
"revCount": 120,
|
||||
"rev": "931bd2d63e285e767c8c81c103dda3c0a63f2965",
|
||||
"revCount": 108,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
|
||||
},
|
||||
|
||||
@@ -35,7 +35,7 @@
|
||||
minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
|
||||
minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=35fe97baa795d1564c79b013d8a36ee01698f47b";
|
||||
roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=c0c0e47c8a45673c62462cadf38a489b72fd39ec";
|
||||
roowho2.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";
|
||||
|
||||
@@ -13,7 +13,6 @@
|
||||
./services/mediawiki
|
||||
./services/nginx.nix
|
||||
./services/phpfpm.nix
|
||||
./services/prometheus-phpfpm-exporter.nix
|
||||
./services/vaultwarden.nix
|
||||
./services/webmail
|
||||
./services/website
|
||||
|
||||
@@ -1,54 +0,0 @@
|
||||
{ config, lib, values, ... }:
|
||||
let
|
||||
cfg = config.services.prometheus.exporters.php-fpm;
|
||||
pools = [
|
||||
"idp"
|
||||
"mediawiki"
|
||||
"pvv-nettsiden"
|
||||
"roundcube"
|
||||
"snappymail"
|
||||
];
|
||||
in
|
||||
{
|
||||
services.phpfpm.pools = lib.genAttrs pools (_: {
|
||||
settings."pm.status_path" = "/status";
|
||||
});
|
||||
|
||||
services.prometheus.exporters.php-fpm = {
|
||||
enable = true;
|
||||
listenAddress = "127.0.0.1";
|
||||
extraFlags = [
|
||||
"--phpfpm.scrape-uri=${lib.concatMapStringsSep "," (name: "unix://${config.services.phpfpm.pools.${name}.socket};/status") pools}"
|
||||
];
|
||||
};
|
||||
|
||||
systemd.services.prometheus-php-fpm-exporter.serviceConfig = {
|
||||
Slice = "system-monitoring.slice";
|
||||
SupplementaryGroups = [ config.services.nginx.group ];
|
||||
RestrictAddressFamilies = lib.mkForce [
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
"AF_UNIX"
|
||||
];
|
||||
};
|
||||
|
||||
services.nginx = lib.mkIf cfg.enable {
|
||||
virtualHosts."www.pvv.ntnu.no" = lib.mkIf config.services.nginx.enable {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
kTLS = true;
|
||||
|
||||
locations."/prometheus-php-fpm-exporter/metrics" = {
|
||||
proxyPass = "http://localhost:${toString cfg.port}/metrics";
|
||||
|
||||
extraConfig = ''
|
||||
allow 127.0.0.1;
|
||||
allow ::1;
|
||||
allow ${values.hosts.ildkule.ipv4};
|
||||
allow ${values.hosts.ildkule.ipv6};
|
||||
deny all;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -16,8 +16,8 @@
|
||||
|
||||
<outgoingServer type="smtp">
|
||||
<hostname>smtp.pvv.ntnu.no</hostname>
|
||||
<port>465</port>
|
||||
<socketType>SSL</socketType>
|
||||
<port>587</port>
|
||||
<socketType>STARTTLS</socketType>
|
||||
<username>%EMAILLOCALPART%</username>
|
||||
<authentication>password-cleartext</authentication>
|
||||
<useGlobalPreferredServer>true</useGlobalPreferredServer>
|
||||
|
||||
@@ -150,6 +150,7 @@ in
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
|
||||
networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
|
||||
|
||||
environment.systemPackages = [
|
||||
(pkgs.writeShellApplication {
|
||||
|
||||
@@ -82,6 +82,7 @@ in
|
||||
(mkMachine "buskerud")
|
||||
(mkMachine "buttercup")
|
||||
(mkMachine "demiurgen")
|
||||
(mkMachine "drolsum")
|
||||
(mkMachine "hildring")
|
||||
(mkMachine "innovation")
|
||||
(mkMachine "isvegg")
|
||||
|
||||
@@ -7,7 +7,6 @@ in {
|
||||
./machines.nix
|
||||
./matrix-synapse.nix
|
||||
./mysqld.nix
|
||||
./phpfpm.nix
|
||||
./postgres.nix
|
||||
];
|
||||
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.prometheus.scrapeConfigs = [{
|
||||
job_name = "phpfpm";
|
||||
scheme = "https";
|
||||
metrics_path = "/prometheus-php-fpm-exporter/metrics";
|
||||
|
||||
static_configs = [
|
||||
{
|
||||
labels.hostname = "bekkalokk";
|
||||
targets = [ "www.pvv.ntnu.no:443" ];
|
||||
}
|
||||
];
|
||||
}];
|
||||
}
|
||||
@@ -36,9 +36,6 @@ in
|
||||
description = ''
|
||||
For each item in this list, a `ListenStream`
|
||||
option in the `[Socket]` section will be created.
|
||||
|
||||
Only a single `ListenStream` is currently supported by the handler script; if
|
||||
you need more than one, you'll have to adjust {option}`handler` accordingly.
|
||||
'';
|
||||
};
|
||||
|
||||
@@ -101,10 +98,8 @@ in
|
||||
"E303" # too many blank lines
|
||||
"E305" # expected 2 blank lines after end of function or class
|
||||
"E306" # expected 1 blank line before a nested definition
|
||||
"E402" # module level import not at top of file
|
||||
"E501" # max line length
|
||||
"E704" # multiple statements on one line (def)
|
||||
"F811" # redefined while unused
|
||||
];
|
||||
description = ''
|
||||
A list of flake8 rules to ignore while linting the python code.
|
||||
@@ -127,11 +122,6 @@ in
|
||||
self.send_header("Content-Length", str(len(data)))
|
||||
self.end_headers()
|
||||
self.wfile.write(data)
|
||||
|
||||
def on_reload():
|
||||
# This function is called when the service receives SIGHUP (e.g. via `systemctl reload`).
|
||||
# You can use it to clear caches or re-read state. Completely optional
|
||||
pass
|
||||
'';
|
||||
description = ''
|
||||
Python code including the HTTP handler for the server.
|
||||
@@ -155,7 +145,6 @@ in
|
||||
inherit (v) listenStreams;
|
||||
socketConfig = {
|
||||
Accept = false;
|
||||
FileDescriptorName = v.name;
|
||||
} // v.socketConfig;
|
||||
};
|
||||
}))
|
||||
@@ -168,126 +157,30 @@ in
|
||||
inherit (v) name;
|
||||
value = {
|
||||
serviceConfig = {
|
||||
Type = "notify-reload";
|
||||
NotifyAccess = "main";
|
||||
Type = "simple";
|
||||
DynamicUser = true;
|
||||
TimeoutStopSec = "35s";
|
||||
|
||||
ExecStart = let
|
||||
package = pkgs.writers.writePython3Bin "${v.name}-bin" {
|
||||
inherit (v) libraries flakeIgnore;
|
||||
} ''
|
||||
import os
|
||||
import signal
|
||||
import socket
|
||||
import socketserver
|
||||
import threading
|
||||
import time
|
||||
from http.server import HTTPServer, BaseHTTPRequestHandler
|
||||
|
||||
SOCKET_NAME = "${v.name}"
|
||||
SHUTDOWN_TIMEOUT = 30
|
||||
|
||||
def sd_notify(message: str):
|
||||
addr = os.environ.get("NOTIFY_SOCKET")
|
||||
if not addr:
|
||||
return
|
||||
if addr[0] == "@":
|
||||
addr = "\0" + addr[1:]
|
||||
with socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM | socket.SOCK_CLOEXEC) as sock:
|
||||
sock.connect(addr)
|
||||
sock.sendall(message.encode())
|
||||
|
||||
def sd_listen_fd(name: str) -> int:
|
||||
if os.environ.get("LISTEN_PID") != str(os.getpid()):
|
||||
raise RuntimeError("No sockets were passed to this service by systemd")
|
||||
|
||||
try:
|
||||
count = int(os.environ.get("LISTEN_FDS", "0"))
|
||||
except ValueError:
|
||||
count = 0
|
||||
|
||||
raw_names = os.environ.get("LISTEN_FDNAMES")
|
||||
names = raw_names.split(":") if raw_names else []
|
||||
|
||||
for i in range(count):
|
||||
if i < len(names) and names[i] == name:
|
||||
return 3 + i
|
||||
|
||||
raise RuntimeError(
|
||||
"No systemd socket named %r was passed to this service; check the "
|
||||
"FileDescriptorName= of the corresponding .socket unit" % name
|
||||
)
|
||||
|
||||
class Server(socketserver.ThreadingMixIn, HTTPServer):
|
||||
daemon_threads = True
|
||||
|
||||
def server_bind(): pass
|
||||
def server_activate(): pass
|
||||
|
||||
def __init__(self, *args, **kwargs):
|
||||
super().__init__(*args, **kwargs)
|
||||
self._request_threads = []
|
||||
self._request_threads_lock = threading.Lock()
|
||||
|
||||
def process_request(self, request, client_address):
|
||||
thread = threading.Thread(
|
||||
target=self.process_request_thread,
|
||||
args=(request, client_address),
|
||||
)
|
||||
thread.daemon = self.daemon_threads
|
||||
with self._request_threads_lock:
|
||||
self._request_threads.append(thread)
|
||||
thread.start()
|
||||
|
||||
def join_request_threads(self, timeout):
|
||||
deadline = time.monotonic() + timeout
|
||||
with self._request_threads_lock:
|
||||
threads = list(self._request_threads)
|
||||
for thread in threads:
|
||||
thread.join(max(deadline - time.monotonic(), 0))
|
||||
|
||||
def handle_reload(signum, frame):
|
||||
monotonic_usec = time.clock_gettime_ns(time.CLOCK_MONOTONIC) // 1000
|
||||
sd_notify("RELOADING=1\nMONOTONIC_USEC=%d" % monotonic_usec)
|
||||
|
||||
on_reload = globals().get("on_reload")
|
||||
if callable(on_reload):
|
||||
on_reload()
|
||||
|
||||
sd_notify("READY=1")
|
||||
|
||||
shutdown_requested = threading.Event()
|
||||
|
||||
def handle_sigterm(signum, frame):
|
||||
sd_notify("STOPPING=1")
|
||||
shutdown_requested.set()
|
||||
|
||||
${v.handler}
|
||||
|
||||
assert "Handler" in globals(), "You must define a class Handler(BaseHTTPRequestHandler) in the handler code"
|
||||
class NoBindHTTPServer(HTTPServer):
|
||||
def server_bind(): pass
|
||||
def server_activate(): pass
|
||||
|
||||
def main():
|
||||
signal.signal(signal.SIGHUP, handle_reload)
|
||||
signal.signal(signal.SIGTERM, handle_sigterm)
|
||||
|
||||
fd = sd_listen_fd(SOCKET_NAME)
|
||||
|
||||
httpd = Server(("", 0), Handler, bind_and_activate=False)
|
||||
httpd.socket = socket.socket(fileno=fd)
|
||||
|
||||
server_thread = threading.Thread(target=httpd.serve_forever, name="http-server", daemon=True)
|
||||
server_thread.start()
|
||||
|
||||
sd_notify("READY=1")
|
||||
shutdown_requested.wait()
|
||||
|
||||
deadline = time.monotonic() + SHUTDOWN_TIMEOUT
|
||||
|
||||
httpd.shutdown()
|
||||
server_thread.join(max(deadline - time.monotonic(), 0))
|
||||
httpd.join_request_threads(max(deadline - time.monotonic(), 0))
|
||||
httpd.server_close()
|
||||
httpd = NoBindHTTPServer(
|
||||
("", 0),
|
||||
Handler,
|
||||
bind_and_activate=False,
|
||||
)
|
||||
httpd.socket = socket.fromfd(3, socket.AF_INET, socket.SOCK_STREAM)
|
||||
httpd.serve_forever()
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
|
||||
@@ -4,11 +4,11 @@ let
|
||||
in
|
||||
stdenvNoCC.mkDerivation rec {
|
||||
pname = "bluemap";
|
||||
version = "5.22";
|
||||
version = "5.20";
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
|
||||
hash = "sha256-oiidZJ9qg+BM8iKrzT1PLfTjLmEUcBX5IcBQZvY+77c=";
|
||||
hash = "sha256-txDN/vG429BHT09TrSB8uQhmB8irrmvvOXX4OX3OSC0=";
|
||||
};
|
||||
|
||||
dontUnpack = true;
|
||||
|
||||
@@ -80,6 +80,29 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
nodes.drolsum = mkDevice "drolsum" {
|
||||
guestType = "proxmox";
|
||||
parent = config.nodes.powerpuff-cluster.id;
|
||||
deviceType = "loginbox";
|
||||
deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/debian.svg";
|
||||
|
||||
# TODO: the interface name is likely wrong
|
||||
interfaceGroups = [ [ "eth0" ] ];
|
||||
interfaces.eth0 = {
|
||||
network = "pvv";
|
||||
# mac = "";
|
||||
addresses = [
|
||||
"129.241.210.217"
|
||||
"2001:700:300:1900::217"
|
||||
"2001:700:300:1900::1:217"
|
||||
];
|
||||
gateways = [
|
||||
values.hosts.gateway
|
||||
values.hosts.gateway6
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
nodes.microbel = mkDevice "microbel" {
|
||||
deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/debian.svg";
|
||||
|
||||
|
||||
Reference in New Issue
Block a user