mirror of
https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git
synced 2026-08-11 05:42:33 +02:00
Compare commits
3
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 h7x4
|
b350554bf3 | ||
|
h7x4
|
f41e6c0a74 | ||
|
h7x4
|
8bb86ef634 |
@@ -34,12 +34,12 @@ revert the changes on the next nightly rebuild (tends to happen when everybody i
|
||||
|
||||
| Name | Type | Description |
|
||||
|----------------------------|----------|-----------------------------------------------------------|
|
||||
| [bekkalokk][bek] | Physical | Our main web host, webmail, wiki, idp, ... |
|
||||
| [bekkalokk][bek] | Physical | Our main web host, webmail, wiki, idp, minecraft map, ... |
|
||||
| [bicep][bic] | Virtual | Database host, matrix, git mirrors, ... |
|
||||
| bikkje | Virtual | Experimental login box |
|
||||
| [brzeczyszczykiewicz][brz] | Physical | Shared music player |
|
||||
| [georg][geo] | Physical | Shared music player |
|
||||
| [gluttony][glu] | Virtual | General purpose compute, minecraft map |
|
||||
| [gluttony][glu] | Virtual | General purpose compute |
|
||||
| [ildkule][ild] | Virtual | Logging and monitoring host, prometheus, grafana, ... |
|
||||
| [kommode][kom] | Virtual | Gitea + Gitea pages |
|
||||
| [lupine][lup] | Physical | Gitea CI/CD runners |
|
||||
|
||||
+1
-1
@@ -30,9 +30,9 @@
|
||||
./services/journald-upload.nix
|
||||
./services/logrotate.nix
|
||||
./services/nginx.nix
|
||||
./services/nullmailer.nix
|
||||
./services/openssh.nix
|
||||
./services/polkit.nix
|
||||
./services/postfix.nix
|
||||
./services/prometheus-flake-input-exporter.nix
|
||||
./services/prometheus-node-exporter.nix
|
||||
./services/prometheus-systemd-exporter.nix
|
||||
|
||||
@@ -21,18 +21,4 @@ in
|
||||
boot.blacklistedKernelModules = modulesToBan;
|
||||
|
||||
boot.extraModprobeConfig = lib.concatMapStringsSep "\n" (mod: "install ${mod} ${lib.getExe' pkgs.coreutils "false"}") modulesToBan;
|
||||
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
matrix-synapse-unwrapped = prev.matrix-synapse-unwrapped.overrideAttrs (old: rec {
|
||||
version = "1.157.2";
|
||||
src = final.fetchFromGitHub {
|
||||
owner = "element-hq";
|
||||
repo = "synapse";
|
||||
rev = "v${version}";
|
||||
hash = "sha256-TUHcNAXrV43+J7jqfstlYdrZrwL5kDCh03yxO+vL/gw=";
|
||||
};
|
||||
});
|
||||
})
|
||||
];
|
||||
}
|
||||
|
||||
@@ -9,7 +9,7 @@ in
|
||||
URL = "https://journald.pvv.ntnu.no:${toString config.services.journald.remote.port}";
|
||||
ServerKeyFile = "-";
|
||||
ServerCertificateFile = "-";
|
||||
TrustedCertificateFile = config.security.pki.caBundle;
|
||||
TrustedCertificateFile = "-";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
{ config, lib, ... }:
|
||||
{
|
||||
services.nullmailer = {
|
||||
enable = true;
|
||||
|
||||
config = {
|
||||
adminaddr = "root@pvv.ntnu.no";
|
||||
defaultdomain = "pvv.ntnu.no";
|
||||
defaulthost = "pvv.ntnu.no";
|
||||
|
||||
me = lib.mkDefault config.networking.fqdn;
|
||||
remotes = lib.mkDefault "smtp.pvv.ntnu.no smtp port=465 tls";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -10,18 +10,12 @@
|
||||
Match All
|
||||
'';
|
||||
settings.PermitRootLogin = "yes";
|
||||
settings.AcceptEnv = [
|
||||
"LANG"
|
||||
"LC_*"
|
||||
"COLORTERM"
|
||||
"GIT_PROTOCOL"
|
||||
];
|
||||
|
||||
};
|
||||
users.users."root".openssh.authorizedKeys.keys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqVt4LCe0YIttr9swFxjkjn37ZDY9JxwVC+2gvfSINDJorOCtqPjDOTD2fTS1Gz08QCwpnLWq2kyvRchu6WgriAbSACpbZZBgxRaF/FVh3oiMVFGnNKGnv6/fdo/vZtu8mUVuqtmTrgLYpZdbR4oD3XiBlDKs7Cv5hPqt95lnP6MNFvE8mICCfd1PwhsABd2IQ5laz3u77/RXhNFJL0Kf2/+6gk9awcLuwHrPdvq7c3BxRHbc9UMRQENyjyQPa7aLe+uJBFLKP51I8VBuDpDacuibQx7nMt6N2UJ2KWI0JxRMHuJNq4S5jidR82aOw9gzGbTv30SKNLMqsZ0xj4LtdqCXDiZF6Lr09PsJYsvnBUFWa14HGcThKDtgwQwBryNViYmfv//0h9+RLZiU0ab+NEwSs7Zh5iAD+vhx64QqNX3tR7Le4SWXh8W0eShU9N78qYdSkiC3Ui7htxeqOocXM/P4AwbnHsLELIvkHdvgchCPvl8ygZa4WJTEWv16+ICskJcAKWGuqjvXAFuwjJJmPp9xLW9O0DFfQhMELiGamQR9wK07yYQVr34iah6qZO7cwhSKyEPFrVPIaNtfDhsjED639F7vmktf26SWNJHWfW0wOHILjI6TgqUvy0JDd8W8w0CHlAfz6Fs2l99NNgNF8dB3vBASbxS0hu/y0PVu/xQ== openstack-sleipner"
|
||||
|
||||
users.users."root".openssh.authorizedKeys.keys = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqVt4LCe0YIttr9swFxjkjn37ZDY9JxwVC+2gvfSINDJorOCtqPjDOTD2fTS1Gz08QCwpnLWq2kyvRchu6WgriAbSACpbZZBgxRaF/FVh3oiMVFGnNKGnv6/fdo/vZtu8mUVuqtmTrgLYpZdbR4oD3XiBlDKs7Cv5hPqt95lnP6MNFvE8mICCfd1PwhsABd2IQ5laz3u77/RXhNFJL0Kf2/+6gk9awcLuwHrPdvq7c3BxRHbc9UMRQENyjyQPa7aLe+uJBFLKP51I8VBuDpDacuibQx7nMt6N2UJ2KWI0JxRMHuJNq4S5jidR82aOw9gzGbTv30SKNLMqsZ0xj4LtdqCXDiZF6Lr09PsJYsvnBUFWa14HGcThKDtgwQwBryNViYmfv//0h9+RLZiU0ab+NEwSs7Zh5iAD+vhx64QqNX3tR7Le4SWXh8W0eShU9N78qYdSkiC3Ui7htxeqOocXM/P4AwbnHsLELIvkHdvgchCPvl8ygZa4WJTEWv16+ICskJcAKWGuqjvXAFuwjJJmPp9xLW9O0DFfQhMELiGamQR9wK07yYQVr34iah6qZO7cwhSKyEPFrVPIaNtfDhsjED639F7vmktf26SWNJHWfW0wOHILjI6TgqUvy0JDd8W8w0CHlAfz6Fs2l99NNgNF8dB3vBASbxS0hu/y0PVu/xQ== openstack-sleipner"
|
||||
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCbgJ0Uwh9VSVhfId7l9i5/jk4CvAK5rbkiab8R+moF root@sleipner"
|
||||
];
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCbgJ0Uwh9VSVhfId7l9i5/jk4CvAK5rbkiab8R+moF root@sleipner"
|
||||
];
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,22 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.services.postfix;
|
||||
in
|
||||
{
|
||||
services.postfix = {
|
||||
enable = true;
|
||||
|
||||
settings.main = {
|
||||
myhostname = "${config.networking.hostName}.pvv.ntnu.no";
|
||||
mydomain = "pvv.ntnu.no";
|
||||
|
||||
# Nothing should be delivered to this machine
|
||||
mydestination = [ ];
|
||||
|
||||
relayhost = [ "smtp.pvv.ntnu.no:465" ];
|
||||
|
||||
smtp_tls_wrappermode = "yes";
|
||||
smtp_tls_security_level = "encrypt";
|
||||
};
|
||||
};
|
||||
}
|
||||
Generated
+29
-29
@@ -126,11 +126,11 @@
|
||||
"rust-overlay": "rust-overlay_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1784709844,
|
||||
"narHash": "sha256-5PW5+UEFFjsru5FiDg9ZRUjQyo7AVyc+nesQlBSqM6c=",
|
||||
"lastModified": 1784553736,
|
||||
"narHash": "sha256-W1pPlTHmp+EvONwf8Qa5NvCiuyV4LC/yNDdc27RSpuA=",
|
||||
"ref": "main",
|
||||
"rev": "a8fb5df19d1cdcc3ac29cdb8ad192c1d578761f0",
|
||||
"revCount": 63,
|
||||
"rev": "e06daaef1f48160254c202c59b060ac6f1da9f38",
|
||||
"revCount": 62,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
|
||||
},
|
||||
@@ -253,11 +253,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1786305372,
|
||||
"narHash": "sha256-ZKTGJzXQMeskdivpyXmfyonEjR25b42N9tWwx+nvKMM=",
|
||||
"lastModified": 1770960722,
|
||||
"narHash": "sha256-IdhPsWFZUKSJh/nLjGLJvGM5d5Uta+k1FlVYPxTZi0E=",
|
||||
"ref": "main",
|
||||
"rev": "723a3d8d117bbfa07bda86427afaef1b1b6b7ff5",
|
||||
"revCount": 19,
|
||||
"rev": "c2e4aca7e1ba27cd09eeaeab47010d32a11841b2",
|
||||
"revCount": 15,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
|
||||
},
|
||||
@@ -291,11 +291,11 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1786245335,
|
||||
"narHash": "sha256-cAR1Po8rYta0tqfjdotDXYVaPC3oJ1/th2cLcQNQSco=",
|
||||
"rev": "33ddeb9e7c03403e17814e8aac1f7affe6d70b21",
|
||||
"lastModified": 1784526640,
|
||||
"narHash": "sha256-UDnuu3uM64qjfVvsGSislJgP1j15FiFiDiKOjbGTv9Q=",
|
||||
"rev": "036c2421db75172aeef4bb83921988891d4773c9",
|
||||
"type": "tarball",
|
||||
"url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.7300.33ddeb9e7c03/nixexprs.tar.xz"
|
||||
"url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.5692.036c2421db75/nixexprs.tar.xz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
@@ -319,11 +319,11 @@
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1786237299,
|
||||
"narHash": "sha256-ZNjdCWSLUF0mrPSKXijAm606sfbI6889LCg6doYG3B8=",
|
||||
"rev": "60c768b1d7043edb84f25e2880ab2bd8327f6cfa",
|
||||
"lastModified": 1784536202,
|
||||
"narHash": "sha256-7CmHmK10lEXBgymS0DeYj4/4STLpzRWCc/5BfoIxHQo=",
|
||||
"rev": "94f12be79cb7f961726a0157b4168bc722befeac",
|
||||
"type": "tarball",
|
||||
"url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.11pre1050368.60c768b1d704/nixexprs.tar.xz"
|
||||
"url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.11pre1037880.94f12be79cb7/nixexprs.tar.xz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
@@ -379,11 +379,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1784979981,
|
||||
"narHash": "sha256-OnvjEXYU/InjJYH2+iIrvHWIjHnc5J9f84qWhrgAWlY=",
|
||||
"lastModified": 1782759909,
|
||||
"narHash": "sha256-gktjBeZyoRvVBkm2cO1tD99fdQ34iUDyB6iecRdorm4=",
|
||||
"ref": "main",
|
||||
"rev": "ffb8ed0c9df2444727e49f16f7e43ea70184dc4b",
|
||||
"revCount": 590,
|
||||
"rev": "ad6c79fb713884a4a2df8aab30914cd0c1c2e6cb",
|
||||
"revCount": 587,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
||||
},
|
||||
@@ -447,17 +447,17 @@
|
||||
"rust-overlay": "rust-overlay_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1785060737,
|
||||
"narHash": "sha256-tlOCUK+X1Um1y/pP/vToGrygn1wmrtUDKrvQquPLVfA=",
|
||||
"lastModified": 1784550731,
|
||||
"narHash": "sha256-KDrBGT98fQWlnEBmTvIijPq4n4sVLcETBu8EuL486SM=",
|
||||
"ref": "main",
|
||||
"rev": "35fe97baa795d1564c79b013d8a36ee01698f47b",
|
||||
"revCount": 126,
|
||||
"rev": "c0c0e47c8a45673c62462cadf38a489b72fd39ec",
|
||||
"revCount": 112,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"rev": "35fe97baa795d1564c79b013d8a36ee01698f47b",
|
||||
"rev": "c0c0e47c8a45673c62462cadf38a489b72fd39ec",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
|
||||
}
|
||||
@@ -575,11 +575,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1785100355,
|
||||
"narHash": "sha256-wBGnYrF7Kfs4vk3djspT3RdQqsYiqm60fKn7/J3vH4I=",
|
||||
"lastModified": 1780762731,
|
||||
"narHash": "sha256-EuDaLnasWN0mpi995n+fAQQfPGBhqNW4fNjlQRpHt58=",
|
||||
"ref": "main",
|
||||
"rev": "611f6ac1a304cc319fc85876d3f0301f49ce458e",
|
||||
"revCount": 120,
|
||||
"rev": "931bd2d63e285e767c8c81c103dda3c0a63f2965",
|
||||
"revCount": 108,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
|
||||
},
|
||||
|
||||
@@ -35,7 +35,7 @@
|
||||
minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
|
||||
minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=35fe97baa795d1564c79b013d8a36ee01698f47b";
|
||||
roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=c0c0e47c8a45673c62462cadf38a489b72fd39ec";
|
||||
roowho2.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";
|
||||
@@ -197,6 +197,7 @@
|
||||
inputs.pvv-calendar-bot.nixosModules.default
|
||||
inputs.minecraft-heatmap.nixosModules.default
|
||||
self.nixosModules.gickup
|
||||
self.nixosModules.hugepages
|
||||
self.nixosModules.matrix-ooye
|
||||
];
|
||||
overlays = [
|
||||
@@ -268,7 +269,6 @@
|
||||
modules = [
|
||||
inputs.nix-gitea-themes.nixosModules.default
|
||||
inputs.disko.nixosModules.disko
|
||||
self.nixosModules.robots-txt
|
||||
];
|
||||
};
|
||||
|
||||
@@ -310,6 +310,7 @@
|
||||
bluemap = ./modules/bluemap.nix;
|
||||
drumknotty = ./modules/drumknotty;
|
||||
gickup = ./modules/gickup;
|
||||
hugepages = ./modules/hugepages.nix;
|
||||
matrix-ooye = ./modules/matrix-ooye.nix;
|
||||
python-http-handlers = ./modules/python-http-handlers.nix;
|
||||
robots-txt = ./modules/robots-txt.nix;
|
||||
|
||||
@@ -13,7 +13,6 @@
|
||||
./services/mediawiki
|
||||
./services/nginx.nix
|
||||
./services/phpfpm.nix
|
||||
./services/prometheus-phpfpm-exporter.nix
|
||||
./services/vaultwarden.nix
|
||||
./services/webmail
|
||||
./services/website
|
||||
|
||||
@@ -1,54 +0,0 @@
|
||||
{ config, lib, values, ... }:
|
||||
let
|
||||
cfg = config.services.prometheus.exporters.php-fpm;
|
||||
pools = [
|
||||
"idp"
|
||||
"mediawiki"
|
||||
"pvv-nettsiden"
|
||||
"roundcube"
|
||||
"snappymail"
|
||||
];
|
||||
in
|
||||
{
|
||||
services.phpfpm.pools = lib.genAttrs pools (_: {
|
||||
settings."pm.status_path" = "/status";
|
||||
});
|
||||
|
||||
services.prometheus.exporters.php-fpm = {
|
||||
enable = true;
|
||||
listenAddress = "127.0.0.1";
|
||||
extraFlags = [
|
||||
"--phpfpm.scrape-uri=${lib.concatMapStringsSep "," (name: "unix://${config.services.phpfpm.pools.${name}.socket};/status") pools}"
|
||||
];
|
||||
};
|
||||
|
||||
systemd.services.prometheus-php-fpm-exporter.serviceConfig = {
|
||||
Slice = "system-monitoring.slice";
|
||||
SupplementaryGroups = [ config.services.nginx.group ];
|
||||
RestrictAddressFamilies = lib.mkForce [
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
"AF_UNIX"
|
||||
];
|
||||
};
|
||||
|
||||
services.nginx = lib.mkIf cfg.enable {
|
||||
virtualHosts."www.pvv.ntnu.no" = lib.mkIf config.services.nginx.enable {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
kTLS = true;
|
||||
|
||||
locations."/prometheus-php-fpm-exporter/metrics" = {
|
||||
proxyPass = "http://localhost:${toString cfg.port}/metrics";
|
||||
|
||||
extraConfig = ''
|
||||
allow 127.0.0.1;
|
||||
allow ::1;
|
||||
allow ${values.hosts.ildkule.ipv4};
|
||||
allow ${values.hosts.ildkule.ipv6};
|
||||
deny all;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -16,8 +16,8 @@
|
||||
|
||||
<outgoingServer type="smtp">
|
||||
<hostname>smtp.pvv.ntnu.no</hostname>
|
||||
<port>465</port>
|
||||
<socketType>SSL</socketType>
|
||||
<port>587</port>
|
||||
<socketType>STARTTLS</socketType>
|
||||
<username>%EMAILLOCALPART%</username>
|
||||
<authentication>password-cleartext</authentication>
|
||||
<useGlobalPreferredServer>true</useGlobalPreferredServer>
|
||||
|
||||
@@ -2,12 +2,11 @@
|
||||
let
|
||||
cfg = config.services.mysql;
|
||||
dataDir = "/data/mysql";
|
||||
|
||||
innodbBufferPoolMB = 128;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./backup.nix
|
||||
./timed-jobs.nix
|
||||
];
|
||||
imports = [ ./backup.nix ];
|
||||
|
||||
sops.secrets."mysql/password" = {
|
||||
owner = "mysql";
|
||||
@@ -29,6 +28,10 @@ in
|
||||
# Useful for the mysqld prometheus exporter
|
||||
userstat = 1;
|
||||
|
||||
# Memory settings
|
||||
innodb_buffer_pool_size = "${toString innodbBufferPoolMB}M";
|
||||
"large-pages" = 1;
|
||||
|
||||
# This was needed in order to be able to use all of the old users
|
||||
# during migration from knakelibrak to bicep in Sep. 2023
|
||||
secure_auth = 0;
|
||||
@@ -50,6 +53,10 @@ in
|
||||
}];
|
||||
};
|
||||
|
||||
boot.kernel.hugepages.reservations.mysql = lib.mkIf cfg.enable (
|
||||
builtins.ceil (innodbBufferPoolMB / config.boot.kernel.hugepages.size)
|
||||
);
|
||||
|
||||
networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 3306 ];
|
||||
|
||||
systemd.tmpfiles.settings."10-mysql".${dataDir}.d = lib.mkIf cfg.enable {
|
||||
@@ -57,18 +64,6 @@ in
|
||||
mode = "0700";
|
||||
};
|
||||
|
||||
fileSystems.${dataDir} = lib.mkIf cfg.enable {
|
||||
device = dataDir;
|
||||
fsType = "none";
|
||||
options = [
|
||||
"bind"
|
||||
"noatime"
|
||||
"noauto"
|
||||
"x-systemd.requires=systemd-tmpfiles-setup.service"
|
||||
"x-systemd.requires=systemd-tmpfiles-resetup.service"
|
||||
];
|
||||
};
|
||||
|
||||
systemd.services.mysql = lib.mkIf cfg.enable {
|
||||
after = [
|
||||
"systemd-tmpfiles-setup.service"
|
||||
@@ -76,7 +71,6 @@ in
|
||||
];
|
||||
|
||||
serviceConfig = {
|
||||
RequiresMountsFor = [ dataDir ];
|
||||
BindPaths = [ "${dataDir}:${cfg.dataDir}" ];
|
||||
|
||||
LogsDirectory = "mysql";
|
||||
|
||||
@@ -1,48 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.mysql;
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services = {
|
||||
mysql-analyze = {
|
||||
requires = [ "mysql.service" ];
|
||||
after = [ "mysql.service" ];
|
||||
description = "Refresh MariaDB optimizer statistics for all databases";
|
||||
startAt = "Mon 05:00:00";
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
|
||||
Nice = 19;
|
||||
IOSchedulingClass = "best-effort";
|
||||
IOSchedulingPriority = 7;
|
||||
|
||||
ExecStart = "${lib.getExe' cfg.package "mariadb-check"} --all-databases --analyze";
|
||||
};
|
||||
};
|
||||
|
||||
mysql-optimize = {
|
||||
requires = [ "mysql.service" ];
|
||||
after = [ "mysql.service" ];
|
||||
description = "Check, repair and optimize all MariaDB databases";
|
||||
startAt = "*-*-01 04:00:00";
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
|
||||
Nice = 19;
|
||||
IOSchedulingClass = "best-effort";
|
||||
IOSchedulingPriority = 7;
|
||||
|
||||
ExecStart = [
|
||||
"${lib.getExe' cfg.package "mariadb-check"} --all-databases --auto-repair"
|
||||
"${lib.getExe' cfg.package "mariadb-check"} --all-databases --optimize"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,6 +1,8 @@
|
||||
{ config, lib, pkgs, values, ... }:
|
||||
let
|
||||
cfg = config.services.postgresql;
|
||||
|
||||
sharedBuffersMB = 8192;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
@@ -29,7 +31,7 @@ in
|
||||
superuser_reserved_connections = 3;
|
||||
|
||||
# Memory Settings
|
||||
shared_buffers = "8192 MB";
|
||||
shared_buffers = "${toString sharedBuffersMB} MB";
|
||||
work_mem = "32 MB";
|
||||
maintenance_work_mem = "420 MB";
|
||||
effective_cache_size = "22 GB";
|
||||
@@ -93,24 +95,16 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
boot.kernel.hugepages.reservations.postgresql = lib.mkIf cfg.enable (
|
||||
builtins.ceil (sharedBuffersMB / config.boot.kernel.hugepages.size)
|
||||
);
|
||||
|
||||
systemd.tmpfiles.settings."10-postgresql"."/data/postgresql".d = lib.mkIf cfg.enable {
|
||||
user = config.systemd.services.postgresql.serviceConfig.User;
|
||||
group = config.systemd.services.postgresql.serviceConfig.Group;
|
||||
mode = "0700";
|
||||
};
|
||||
|
||||
fileSystems."/data/postgresql" = lib.mkIf cfg.enable {
|
||||
device = "/data/postgresql";
|
||||
fsType = "none";
|
||||
options = [
|
||||
"bind"
|
||||
"noatime"
|
||||
"noauto"
|
||||
"x-systemd.requires=systemd-tmpfiles-setup.service"
|
||||
"x-systemd.requires=systemd-tmpfiles-resetup.service"
|
||||
];
|
||||
};
|
||||
|
||||
systemd.services.postgresql-setup = lib.mkIf cfg.enable {
|
||||
after = [
|
||||
"systemd-tmpfiles-setup.service"
|
||||
@@ -122,7 +116,6 @@ in
|
||||
"key:/etc/certs/postgres.key"
|
||||
];
|
||||
|
||||
RequiresMountsFor = [ "/data/postgresql" ];
|
||||
BindPaths = [ "/data/postgresql:/var/lib/postgresql" ];
|
||||
};
|
||||
};
|
||||
@@ -138,7 +131,6 @@ in
|
||||
"key:/etc/certs/postgres.key"
|
||||
];
|
||||
|
||||
RequiresMountsFor = [ "/data/postgresql" ];
|
||||
BindPaths = [ "/data/postgresql:/var/lib/postgresql" ];
|
||||
};
|
||||
};
|
||||
@@ -150,6 +142,7 @@ in
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
|
||||
networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
|
||||
|
||||
environment.systemPackages = [
|
||||
(pkgs.writeShellApplication {
|
||||
|
||||
@@ -5,8 +5,6 @@ in
|
||||
{
|
||||
imports = [
|
||||
./minecraft-checker.nix
|
||||
./postgres-checker.nix
|
||||
./mariadb-checker.nix
|
||||
];
|
||||
|
||||
services.gatus = {
|
||||
@@ -82,6 +80,7 @@ in
|
||||
(mkMachine "buskerud")
|
||||
(mkMachine "buttercup")
|
||||
(mkMachine "demiurgen")
|
||||
(mkMachine "drolsum")
|
||||
(mkMachine "hildring")
|
||||
(mkMachine "innovation")
|
||||
(mkMachine "isvegg")
|
||||
@@ -134,18 +133,6 @@ in
|
||||
"[BODY].ok == true"
|
||||
];
|
||||
})
|
||||
(mkService "PostgreSQL" "http://localhost:1338" // {
|
||||
conditions = [
|
||||
"[STATUS] == 200"
|
||||
"[BODY].ok == true"
|
||||
];
|
||||
})
|
||||
(mkService "MariaDB" "http://localhost:1339" // {
|
||||
conditions = [
|
||||
"[STATUS] == 200"
|
||||
"[BODY].ok == true"
|
||||
];
|
||||
})
|
||||
(mkService "Email (SMTP)" "starttls://mail.pvv.ntnu.no:587")
|
||||
(mkService "Email (POP3)" "tls://mail.pvv.ntnu.no:995")
|
||||
(mkService "Email (IMAP)" "tls://mail.pvv.ntnu.no:993")
|
||||
|
||||
@@ -1,79 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
sops.secrets."keys/gatus/mariadb" = {
|
||||
restartUnits = [ "phh-gatus-mariadb-checker.service" ];
|
||||
};
|
||||
|
||||
sops.templates."gatus-mariadb-checker.env" = {
|
||||
restartUnits = [ "phh-gatus-mariadb-checker.service" ];
|
||||
content = ''
|
||||
MYSQL_HOST=mysql.pvv.ntnu.no
|
||||
MYSQL_PORT=3306
|
||||
MYSQL_DATABASE=mysql
|
||||
MYSQL_USER=gatus_healthcheck
|
||||
MYSQL_PASSWORD=${config.sops.placeholder."keys/gatus/mariadb"}
|
||||
'';
|
||||
};
|
||||
|
||||
services.python-http-handlers."gatus-mariadb-checker" = {
|
||||
listenStreams = [ "127.0.0.1:1339" ];
|
||||
libraries = with pkgs.python3Packages; [
|
||||
pymysql
|
||||
];
|
||||
serviceConfig = {
|
||||
EnvironmentFile = config.sops.templates."gatus-mariadb-checker.env".path;
|
||||
};
|
||||
handler = ''
|
||||
import os
|
||||
import json
|
||||
import pymysql
|
||||
|
||||
class Handler(BaseHTTPRequestHandler):
|
||||
def do_GET(self):
|
||||
try:
|
||||
conn = pymysql.connect(
|
||||
host=os.environ["MYSQL_HOST"],
|
||||
port=int(os.environ.get("MYSQL_PORT", "3306")),
|
||||
user=os.environ["MYSQL_USER"],
|
||||
password=os.environ["MYSQL_PASSWORD"],
|
||||
database=os.environ.get("MYSQL_DATABASE", "mysql"),
|
||||
connect_timeout=5,
|
||||
)
|
||||
|
||||
try:
|
||||
with conn.cursor() as cur:
|
||||
cur.execute("SELECT VERSION();")
|
||||
(version,) = cur.fetchone()
|
||||
|
||||
cur.execute("SHOW STATUS LIKE 'Threads_connected';")
|
||||
(_, connections) = cur.fetchone()
|
||||
|
||||
cur.execute("SHOW DATABASES;")
|
||||
databases = cur.fetchall()
|
||||
finally:
|
||||
conn.close()
|
||||
|
||||
body = {
|
||||
"ok": True,
|
||||
"version": version,
|
||||
"connections": int(connections),
|
||||
"databases": len(databases),
|
||||
}
|
||||
data = json.dumps(body).encode()
|
||||
|
||||
self.send_response(200)
|
||||
self.send_header("Content-Type", "application/json")
|
||||
self.send_header("Content-Length", str(len(data)))
|
||||
self.end_headers()
|
||||
self.wfile.write(data)
|
||||
|
||||
except Exception as e:
|
||||
data = json.dumps({"ok": False, "error": str(e)}).encode()
|
||||
self.send_response(500)
|
||||
self.send_header("Content-Type", "application/json")
|
||||
self.send_header("Content-Length", str(len(data)))
|
||||
self.end_headers()
|
||||
self.wfile.write(data)
|
||||
'';
|
||||
};
|
||||
}
|
||||
@@ -1,79 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
sops.secrets."keys/gatus/postgres" = {
|
||||
restartUnits = [ "phh-gatus-postgres-checker.service" ];
|
||||
};
|
||||
|
||||
sops.templates."gatus-postgres-checker.env" = {
|
||||
restartUnits = [ "phh-gatus-postgres-checker.service" ];
|
||||
content = ''
|
||||
PGHOST=postgres.pvv.ntnu.no
|
||||
PGPORT=5432
|
||||
PGDATABASE=postgres
|
||||
PGUSER=gatus_healthcheck
|
||||
PGPASSWORD=${config.sops.placeholder."keys/gatus/postgres"}
|
||||
'';
|
||||
};
|
||||
|
||||
services.python-http-handlers."gatus-postgres-checker" = {
|
||||
listenStreams = [ "127.0.0.1:1338" ];
|
||||
libraries = with pkgs.python3Packages; [
|
||||
psycopg2
|
||||
];
|
||||
serviceConfig = {
|
||||
EnvironmentFile = config.sops.templates."gatus-postgres-checker.env".path;
|
||||
};
|
||||
handler = ''
|
||||
import os
|
||||
import json
|
||||
import psycopg2
|
||||
|
||||
class Handler(BaseHTTPRequestHandler):
|
||||
def do_GET(self):
|
||||
try:
|
||||
conn = psycopg2.connect(
|
||||
host=os.environ["PGHOST"],
|
||||
port=os.environ.get("PGPORT", "5432"),
|
||||
dbname=os.environ.get("PGDATABASE", "postgres"),
|
||||
user=os.environ["PGUSER"],
|
||||
password=os.environ["PGPASSWORD"],
|
||||
connect_timeout=5,
|
||||
)
|
||||
|
||||
try:
|
||||
with conn.cursor() as cur:
|
||||
cur.execute("SELECT version();")
|
||||
(version,) = cur.fetchone()
|
||||
|
||||
cur.execute("SELECT count(*) FROM pg_stat_activity;")
|
||||
(connections,) = cur.fetchone()
|
||||
|
||||
cur.execute("SELECT count(*) FROM pg_database WHERE NOT datistemplate;")
|
||||
(databases,) = cur.fetchone()
|
||||
finally:
|
||||
conn.close()
|
||||
|
||||
body = {
|
||||
"ok": True,
|
||||
"version": version,
|
||||
"connections": connections,
|
||||
"databases": databases,
|
||||
}
|
||||
data = json.dumps(body).encode()
|
||||
|
||||
self.send_response(200)
|
||||
self.send_header("Content-Type", "application/json")
|
||||
self.send_header("Content-Length", str(len(data)))
|
||||
self.end_headers()
|
||||
self.wfile.write(data)
|
||||
|
||||
except Exception as e:
|
||||
data = json.dumps({"ok": False, "error": str(e)}).encode()
|
||||
self.send_response(500)
|
||||
self.send_header("Content-Type", "application/json")
|
||||
self.send_header("Content-Length", str(len(data)))
|
||||
self.end_headers()
|
||||
self.wfile.write(data)
|
||||
'';
|
||||
};
|
||||
}
|
||||
@@ -7,7 +7,6 @@ in {
|
||||
./machines.nix
|
||||
./matrix-synapse.nix
|
||||
./mysqld.nix
|
||||
./phpfpm.nix
|
||||
./postgres.nix
|
||||
];
|
||||
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.prometheus.scrapeConfigs = [{
|
||||
job_name = "phpfpm";
|
||||
scheme = "https";
|
||||
metrics_path = "/prometheus-php-fpm-exporter/metrics";
|
||||
|
||||
static_configs = [
|
||||
{
|
||||
labels.hostname = "bekkalokk";
|
||||
targets = [ "www.pvv.ntnu.no:443" ];
|
||||
}
|
||||
];
|
||||
}];
|
||||
}
|
||||
@@ -196,108 +196,6 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
environment.robots-txt."gitea" = {
|
||||
virtualHost = domain;
|
||||
rules = [
|
||||
{
|
||||
pre_comment = ''
|
||||
Gitea internals
|
||||
|
||||
See these for more information:
|
||||
- https://gitea.com/robots.txt
|
||||
- https://codeberg.org/robots.txt
|
||||
'';
|
||||
User-agent = "*";
|
||||
Disallow = [
|
||||
"/api/*"
|
||||
"/avatars"
|
||||
"/*/*/src/commit/*"
|
||||
"/*/*/commit/*"
|
||||
"/*/*/*/refs/*"
|
||||
"/*/*/*/star"
|
||||
"/*/*/*/watch"
|
||||
"/*/*/labels"
|
||||
"/*/*/activity/*"
|
||||
"/vendor/*"
|
||||
"/swagger.*.json"
|
||||
"/repo/create"
|
||||
"/repo/migrate"
|
||||
"/org/create"
|
||||
"/*/*/fork"
|
||||
"/*/*/watchers"
|
||||
"/*/*/stargazers"
|
||||
"/*/*/forks"
|
||||
"*/.git/"
|
||||
"/*.git"
|
||||
"/*.atom"
|
||||
"/*.rss"
|
||||
];
|
||||
Crawl-delay = "2";
|
||||
}
|
||||
{
|
||||
pre_comment = "Language Spam";
|
||||
Disallow = "/*?lang=";
|
||||
}
|
||||
{
|
||||
pre_comment = ''
|
||||
AI bots
|
||||
|
||||
Sourced from:
|
||||
- https://www.vg.no/robots.txt
|
||||
- https://codeberg.org/robots.txt
|
||||
'';
|
||||
User-agent = [
|
||||
"AI2Bot"
|
||||
"Ai2Bot-Dolma"
|
||||
"Amazonbot"
|
||||
"Applebot-Extended"
|
||||
"Bytespider"
|
||||
"CCBot"
|
||||
"ChatGPT-User"
|
||||
"Claude-Web"
|
||||
"ClaudeBot"
|
||||
"Crawlspace"
|
||||
"Diffbot"
|
||||
"FacebookBot"
|
||||
"FriendlyCrawler"
|
||||
"GPTBot"
|
||||
"Google-Extended"
|
||||
"ICC-Crawler"
|
||||
"ImagesiftBot"
|
||||
"Kangaroo Bot"
|
||||
"Meta-ExternalAgent"
|
||||
"OAI-SearchBot"
|
||||
"Omgili"
|
||||
"Omgilibot"
|
||||
"PanguBot"
|
||||
"PerplexityBot"
|
||||
"PetalBot"
|
||||
"Scrapy"
|
||||
"SemrushBot-OCOB"
|
||||
"Sidetrade indexer bot"
|
||||
"Timpibot"
|
||||
"VelenPublicWebCrawler"
|
||||
"Webzio-Extended"
|
||||
"YouBot"
|
||||
"anthropic-ai"
|
||||
"cohere-ai"
|
||||
"cohere-training-data-crawler"
|
||||
"facebookexternalhit"
|
||||
"iaskspider/2.0"
|
||||
"img2dataset"
|
||||
"meta-externalagent"
|
||||
"omgili"
|
||||
"omgilibot"
|
||||
];
|
||||
Disallow = "/";
|
||||
Crawl-delay = "2";
|
||||
}
|
||||
{
|
||||
Sitemap = "https://${domain}/sitemap.xml";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ sshPort ];
|
||||
|
||||
services.rsync-pull-targets = {
|
||||
|
||||
@@ -1,13 +1,14 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
assertions = [{
|
||||
assertion = config.services.nullmailer.enable;
|
||||
message = ''
|
||||
Expected nullmailer to be enabled for temmie userweb.
|
||||
services.postfix.enable = lib.mkForce false;
|
||||
|
||||
If you change the default sendmail implementation, please make sure that temmie userweb works correctly!
|
||||
'';
|
||||
}];
|
||||
services.nullmailer = {
|
||||
enable = true;
|
||||
config = {
|
||||
me = config.networking.fqdn;
|
||||
remotes = "mail.pvv.ntnu.no smtp --port=25";
|
||||
};
|
||||
};
|
||||
|
||||
services.bro = {
|
||||
enable = true;
|
||||
|
||||
@@ -0,0 +1,38 @@
|
||||
{ config, lib, ... }:
|
||||
let
|
||||
cfg = config.boot.kernel.hugepages;
|
||||
in
|
||||
{
|
||||
options.boot.kernel.hugepages = {
|
||||
size = lib.mkOption {
|
||||
type = lib.types.enum [ 2 1024 ];
|
||||
default = 2;
|
||||
description = ''
|
||||
Hugepage size in MB.
|
||||
|
||||
You can use this value to calculate the amount of memory you will have available as hugepages.
|
||||
'';
|
||||
};
|
||||
|
||||
reservations = lib.mkOption {
|
||||
type = lib.types.attrsOf lib.types.ints.unsigned;
|
||||
default = { };
|
||||
description = ''
|
||||
Number of hugepages each service wants reserved in vm.nr_hugepages,
|
||||
keyed by service name.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
boot.kernelParams = let
|
||||
num = {
|
||||
"2" = "2M";
|
||||
"1024" = "1G";
|
||||
}.${toString cfg.size};
|
||||
in [ "hugepagesz=${num}" ];
|
||||
|
||||
boot.kernel.sysctl."vm.nr_hugepages" =
|
||||
lib.foldl' (a: b: a + b) 0 (lib.attrValues cfg.reservations);
|
||||
};
|
||||
}
|
||||
@@ -36,9 +36,6 @@ in
|
||||
description = ''
|
||||
For each item in this list, a `ListenStream`
|
||||
option in the `[Socket]` section will be created.
|
||||
|
||||
Only a single `ListenStream` is currently supported by the handler script; if
|
||||
you need more than one, you'll have to adjust {option}`handler` accordingly.
|
||||
'';
|
||||
};
|
||||
|
||||
@@ -101,10 +98,8 @@ in
|
||||
"E303" # too many blank lines
|
||||
"E305" # expected 2 blank lines after end of function or class
|
||||
"E306" # expected 1 blank line before a nested definition
|
||||
"E402" # module level import not at top of file
|
||||
"E501" # max line length
|
||||
"E704" # multiple statements on one line (def)
|
||||
"F811" # redefined while unused
|
||||
];
|
||||
description = ''
|
||||
A list of flake8 rules to ignore while linting the python code.
|
||||
@@ -127,11 +122,6 @@ in
|
||||
self.send_header("Content-Length", str(len(data)))
|
||||
self.end_headers()
|
||||
self.wfile.write(data)
|
||||
|
||||
def on_reload():
|
||||
# This function is called when the service receives SIGHUP (e.g. via `systemctl reload`).
|
||||
# You can use it to clear caches or re-read state. Completely optional
|
||||
pass
|
||||
'';
|
||||
description = ''
|
||||
Python code including the HTTP handler for the server.
|
||||
@@ -155,7 +145,6 @@ in
|
||||
inherit (v) listenStreams;
|
||||
socketConfig = {
|
||||
Accept = false;
|
||||
FileDescriptorName = v.name;
|
||||
} // v.socketConfig;
|
||||
};
|
||||
}))
|
||||
@@ -168,126 +157,30 @@ in
|
||||
inherit (v) name;
|
||||
value = {
|
||||
serviceConfig = {
|
||||
Type = "notify-reload";
|
||||
NotifyAccess = "main";
|
||||
Type = "simple";
|
||||
DynamicUser = true;
|
||||
TimeoutStopSec = "35s";
|
||||
|
||||
ExecStart = let
|
||||
package = pkgs.writers.writePython3Bin "${v.name}-bin" {
|
||||
inherit (v) libraries flakeIgnore;
|
||||
} ''
|
||||
import os
|
||||
import signal
|
||||
import socket
|
||||
import socketserver
|
||||
import threading
|
||||
import time
|
||||
from http.server import HTTPServer, BaseHTTPRequestHandler
|
||||
|
||||
SOCKET_NAME = "${v.name}"
|
||||
SHUTDOWN_TIMEOUT = 30
|
||||
|
||||
def sd_notify(message: str):
|
||||
addr = os.environ.get("NOTIFY_SOCKET")
|
||||
if not addr:
|
||||
return
|
||||
if addr[0] == "@":
|
||||
addr = "\0" + addr[1:]
|
||||
with socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM | socket.SOCK_CLOEXEC) as sock:
|
||||
sock.connect(addr)
|
||||
sock.sendall(message.encode())
|
||||
|
||||
def sd_listen_fd(name: str) -> int:
|
||||
if os.environ.get("LISTEN_PID") != str(os.getpid()):
|
||||
raise RuntimeError("No sockets were passed to this service by systemd")
|
||||
|
||||
try:
|
||||
count = int(os.environ.get("LISTEN_FDS", "0"))
|
||||
except ValueError:
|
||||
count = 0
|
||||
|
||||
raw_names = os.environ.get("LISTEN_FDNAMES")
|
||||
names = raw_names.split(":") if raw_names else []
|
||||
|
||||
for i in range(count):
|
||||
if i < len(names) and names[i] == name:
|
||||
return 3 + i
|
||||
|
||||
raise RuntimeError(
|
||||
"No systemd socket named %r was passed to this service; check the "
|
||||
"FileDescriptorName= of the corresponding .socket unit" % name
|
||||
)
|
||||
|
||||
class Server(socketserver.ThreadingMixIn, HTTPServer):
|
||||
daemon_threads = True
|
||||
|
||||
def server_bind(): pass
|
||||
def server_activate(): pass
|
||||
|
||||
def __init__(self, *args, **kwargs):
|
||||
super().__init__(*args, **kwargs)
|
||||
self._request_threads = []
|
||||
self._request_threads_lock = threading.Lock()
|
||||
|
||||
def process_request(self, request, client_address):
|
||||
thread = threading.Thread(
|
||||
target=self.process_request_thread,
|
||||
args=(request, client_address),
|
||||
)
|
||||
thread.daemon = self.daemon_threads
|
||||
with self._request_threads_lock:
|
||||
self._request_threads.append(thread)
|
||||
thread.start()
|
||||
|
||||
def join_request_threads(self, timeout):
|
||||
deadline = time.monotonic() + timeout
|
||||
with self._request_threads_lock:
|
||||
threads = list(self._request_threads)
|
||||
for thread in threads:
|
||||
thread.join(max(deadline - time.monotonic(), 0))
|
||||
|
||||
def handle_reload(signum, frame):
|
||||
monotonic_usec = time.clock_gettime_ns(time.CLOCK_MONOTONIC) // 1000
|
||||
sd_notify("RELOADING=1\nMONOTONIC_USEC=%d" % monotonic_usec)
|
||||
|
||||
on_reload = globals().get("on_reload")
|
||||
if callable(on_reload):
|
||||
on_reload()
|
||||
|
||||
sd_notify("READY=1")
|
||||
|
||||
shutdown_requested = threading.Event()
|
||||
|
||||
def handle_sigterm(signum, frame):
|
||||
sd_notify("STOPPING=1")
|
||||
shutdown_requested.set()
|
||||
|
||||
${v.handler}
|
||||
|
||||
assert "Handler" in globals(), "You must define a class Handler(BaseHTTPRequestHandler) in the handler code"
|
||||
class NoBindHTTPServer(HTTPServer):
|
||||
def server_bind(): pass
|
||||
def server_activate(): pass
|
||||
|
||||
def main():
|
||||
signal.signal(signal.SIGHUP, handle_reload)
|
||||
signal.signal(signal.SIGTERM, handle_sigterm)
|
||||
|
||||
fd = sd_listen_fd(SOCKET_NAME)
|
||||
|
||||
httpd = Server(("", 0), Handler, bind_and_activate=False)
|
||||
httpd.socket = socket.socket(fileno=fd)
|
||||
|
||||
server_thread = threading.Thread(target=httpd.serve_forever, name="http-server", daemon=True)
|
||||
server_thread.start()
|
||||
|
||||
sd_notify("READY=1")
|
||||
shutdown_requested.wait()
|
||||
|
||||
deadline = time.monotonic() + SHUTDOWN_TIMEOUT
|
||||
|
||||
httpd.shutdown()
|
||||
server_thread.join(max(deadline - time.monotonic(), 0))
|
||||
httpd.join_request_threads(max(deadline - time.monotonic(), 0))
|
||||
httpd.server_close()
|
||||
httpd = NoBindHTTPServer(
|
||||
("", 0),
|
||||
Handler,
|
||||
bind_and_activate=False,
|
||||
)
|
||||
httpd.socket = socket.fromfd(3, socket.AF_INET, socket.SOCK_STREAM)
|
||||
httpd.serve_forever()
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
|
||||
@@ -4,11 +4,11 @@ let
|
||||
in
|
||||
stdenvNoCC.mkDerivation rec {
|
||||
pname = "bluemap";
|
||||
version = "5.22";
|
||||
version = "5.20";
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
|
||||
hash = "sha256-oiidZJ9qg+BM8iKrzT1PLfTjLmEUcBX5IcBQZvY+77c=";
|
||||
hash = "sha256-txDN/vG429BHT09TrSB8uQhmB8irrmvvOXX4OX3OSC0=";
|
||||
};
|
||||
|
||||
dontUnpack = true;
|
||||
|
||||
@@ -1,9 +1,6 @@
|
||||
config:
|
||||
mysqld_exporter_password: ENC[AES256_GCM,data:I9K+QMqaN3FOOVKzeOR9Q6UERStXX0P8WEHyN1jzzbM=,iv:UxvIdlfAyJvNuxPkU4+guKPa0fiD0vVLzHOTYktcmso=,tag:ltnIqEwESYx9HBu8UN0ZLw==,type:str]
|
||||
keys:
|
||||
gatus:
|
||||
mariadb: ENC[AES256_GCM,data:U7CGtjHacJlKcReEw3JO86okCVgLAkP92iX1bHGNw8qeImpvk5mNw77Ox7tbsChvozrJWa/Npu2pTBsNnVYYYA==,iv:hWa+KPiBc3AnH1tHCGJa8LhPXZ1o8sxufpGe7nUjV0E=,tag:mso5HEfmWAOGw350408X7g==,type:str]
|
||||
postgres: ENC[AES256_GCM,data:7fI0JeZDK1MX5poXWaMo67PXbjdjvM+xPKioHSHmGdS8iNDGe5Ym6LlS/hOnPvvDuNFyHjKKizqDst0227U2gg==,iv:D3bz/xyFrnQsUCiMEFq8JOjSudyiw+idEMWQ1e6Uk3k=,tag:8XqadKVHK9NMWehK7V5J0Q==,type:str]
|
||||
grafana:
|
||||
secret_key: ENC[AES256_GCM,data:+WoAJbDBEgKs0RoHT+7oEELAVQ+/2Xt+5RTMSXg23moCqVRx+Gzll9P5Drw=,iv:AkRn/Y20iEe5i1T+84wAgLCTFtAox2G3giyawAkltAw=,tag:BZbt5Wb5lYLIJBm/pfP4GQ==,type:str]
|
||||
admin_password: ENC[AES256_GCM,data:ttKwfC4WuXeL/6x4,iv:x1X+e3z08CR992GzC62YnFIN7SGrE81/nDNrgcgVzx0=,tag:YajUoy61kYbpeGeC7yNrXQ==,type:str]
|
||||
@@ -12,7 +9,8 @@ keys:
|
||||
postgres_exporter_knakelibrak_env: ENC[AES256_GCM,data:xjC7DGXrW2GIJq8XioIZb+jSe/Hzcz0tv9cUHmX/n1nhI+D64lYt+EKnq1+RX/vJzU4sTaKjveKBh88Qqnv6RQm+MZC//dIxcvnnAdl50qnHZyBCaFFEzSNI8I8vGyArMk8Ja72clBq3kMpUz/pLBP0qDrjblKDoWkU=,iv:ZW98hJy8A5t4Oxtu17R3tM7gou183VLbgBsHA8LFuJY=,tag:VMOvQz3X/XDylV1YFg2Jsg==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
- recipient: age102e6y8gah0ntr6fxqnkpepc8ar29p6ls7ks9ka7v8w87q8scm9yqmc2u8d
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyTWRSM3IwMmxtTmZVcCsw
|
||||
OUhlakxHZzgrSEhEdUZFTXE1anNjQ2wvdkZFCnB6S1l3TXQ3ZGFYWmtYM1cwMFZT
|
||||
@@ -20,8 +18,8 @@ sops:
|
||||
YlltQ3FBU3RBYUx4TnNPRk1SUWNqZG8KAJjc09x553ncaWduGLsnIHdroaOmMasP
|
||||
/fq0GzW6UNfmE2rQ6qrQti21B37/sN0WMLCSPLUPG45kBgx20GG4hQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age102e6y8gah0ntr6fxqnkpepc8ar29p6ls7ks9ka7v8w87q8scm9yqmc2u8d
|
||||
- enc: |
|
||||
- recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTOWFvcFFzc1lmNVdmV3lX
|
||||
cVVLNHowcGdENzI5UUJLZTNSMHhjNlI2c0FnCmdwOS9oL1kwTnhwbXRodWxxWVE3
|
||||
@@ -29,8 +27,8 @@ sops:
|
||||
eDVwd2dKMG9FRW1OY1pyUkhLeWw3b0EKtJpsQ/Ss39ZLiRNqUhn8sdB3hpQy7Syv
|
||||
ererqhMkqmDugGEHPk6KpZuj7DVSK1di7JgA2qZOUPzI7UpxjaC0Kg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
|
||||
- enc: |
|
||||
- recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOQU1iVXRkQmo4b3F1Vngz
|
||||
S0pkNkVFR1FUb1djdmI0eHh3V3BBTDJTSTJZClA0S0Z0cTdFRmRaOEZQdHQzdGZ3
|
||||
@@ -38,8 +36,8 @@ sops:
|
||||
REdjRFZyY2pNdEd6cmgvQisyVDhLUEkKRItJ0CGbzlEB5RNAyem4feMVhTfcLef3
|
||||
QIqltZ2l4LLexnkECi3FCJZHxrbUa+/RF6p1DsueUw7LLUnOcphB9A==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
|
||||
- enc: |
|
||||
- recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvZTBpaWM0c1hmODBaK0Iw
|
||||
bmp1NzRacklXMHU0K2J2d0g5ajBiNlRNWGhRCm1DOWI0cm5BdTdlNmFzM2JVekNk
|
||||
@@ -47,8 +45,8 @@ sops:
|
||||
U0ZCT2toZ1ZMZ3E0bXRhSTQvNGFWNVkKhxfQDIDe2LQW7OMBJv0J267AW1wI32df
|
||||
ZQxd657TEqzm7i19azrCS0jyRbfj2MYzEJAtTGiGZaNC9uKDFzBhKw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
||||
- enc: |
|
||||
- recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmRlJROHRKb21YUnlicmc1
|
||||
MlptQllEcXFhajNKS1krMDdUMWk5QWo4eVJBCndGSlhXS1Vaa2RSTllIcmF1ZVpl
|
||||
@@ -56,8 +54,8 @@ sops:
|
||||
TE41aFdjU0h0ekQ2Zjg4Z3VQVjFWcnMK6zjSalqeYjyc4NH6nOeghlhYJydrz4pM
|
||||
N5ZcXjRbrIVFdhbYnvQGKvGKZm0kK6vjzBjdT7BM6ctr8cq/qrz1xQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
||||
- enc: |
|
||||
- recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIRXpBa2tYc2xEeldub0VK
|
||||
bkFwOFdlUGRZM0FVT0tyUW1RWnl0TjRUTUh3CnZlMC92MU1hRW1yZU1NSUdoUEZh
|
||||
@@ -65,8 +63,8 @@ sops:
|
||||
aXFQWlNVQ2laVm1ETStRemNZRXc3TUEKlPYSU3gp67dsPfbEJkru4ieMvspC7+pu
|
||||
rfp315HLyj1FGhrA8f2qOxE/PYI2rn0yKm80KffWBV7ylX/uonm4Fg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
||||
- enc: |
|
||||
- recipient: age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsaTEzOFBEeG9LVThSVmQ5
|
||||
VXBoaFpueFRCbFJ1akE4RWc1aE1HUmVGcXdZCjFnbU0wd2drazNsTmNBMHNuOFhO
|
||||
@@ -74,9 +72,8 @@ sops:
|
||||
dC9meDZlc3d3aUJEVjc4REF0Y1BLcGcK79LbJzc5KVgEgyJR11crGuX8YcVoJBbT
|
||||
Fin7Zoon06L7qx0Zw5u27wV7RKMnYT7hOMiWs6660ZTLcYJ5M1aEZQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
|
||||
lastmodified: "2026-07-21T09:40:54Z"
|
||||
mac: ENC[AES256_GCM,data:FLpmsW9I21qNMFs6Tn/1AzFo+RcmCwtVdAaaGIrGlUi2l3gzb//ZK6ruI/VYx1R5DoX1OhD3EIg6aLMSOT6jiHf+8GwfhdijpayG1nrgeZW3SuFbjVlCYNMPH3DOJJB82U3T+ozSbpnZEtdUwmNWcZJt5F2hOEnoaNa+jLEKDao=,iv:qyQuyWuu+w2ynRvhIx0QVtw+tieO3dbQsUxEB5Brzp0=,tag:qYAj4h6foWm16YqIdZ6xbQ==,type:str]
|
||||
lastmodified: "2025-03-16T20:08:18Z"
|
||||
mac: ENC[AES256_GCM,data:C2tpWppc13jKJq5d4nmAKQOaNWHm27TKwxAxm1fi2lejN1lqUaoz5bHfTBA7MfaWvuP5uZnfbtG32eeu48mnlWpo58XRUFFecAhb9JUpW9s5IR3/nbzLNkGU7H5C0oWPrxI4thd+bAVduIgBjjFyGj1pe6J9db3c0yUWRwNlwGU=,iv:YpoQ4psiFYOWLGipxv1QvRvr034XFsyn2Bhyy39HmOo=,tag:ByiCWygFC/VokVTbdLoLgg==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-05-20T17:35:58Z"
|
||||
enc: |-
|
||||
@@ -99,4 +96,4 @@ sops:
|
||||
-----END PGP MESSAGE-----
|
||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.2
|
||||
version: 3.9.4
|
||||
|
||||
@@ -80,6 +80,29 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
nodes.drolsum = mkDevice "drolsum" {
|
||||
guestType = "proxmox";
|
||||
parent = config.nodes.powerpuff-cluster.id;
|
||||
deviceType = "loginbox";
|
||||
deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/debian.svg";
|
||||
|
||||
# TODO: the interface name is likely wrong
|
||||
interfaceGroups = [ [ "eth0" ] ];
|
||||
interfaces.eth0 = {
|
||||
network = "pvv";
|
||||
# mac = "";
|
||||
addresses = [
|
||||
"129.241.210.217"
|
||||
"2001:700:300:1900::217"
|
||||
"2001:700:300:1900::1:217"
|
||||
];
|
||||
gateways = [
|
||||
values.hosts.gateway
|
||||
values.hosts.gateway6
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
nodes.microbel = mkDevice "microbel" {
|
||||
deviceIcon = "${pkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/debian.svg";
|
||||
|
||||
|
||||
Reference in New Issue
Block a user