mirror of
https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git
synced 2026-05-26 00:01:12 +02:00
Compare commits
1 Commits
temmie-use
...
setup-open
| Author | SHA1 | Date | |
|---|---|---|---|
|
7eb6351471 |
54
flake.lock
generated
54
flake.lock
generated
@@ -1,27 +1,5 @@
|
|||||||
{
|
{
|
||||||
"nodes": {
|
"nodes": {
|
||||||
"bro": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs"
|
|
||||||
],
|
|
||||||
"rust-overlay": "rust-overlay"
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1779629827,
|
|
||||||
"narHash": "sha256-nrlB50/oelB8oFx9DhOoXI5z0VoTZGEA6XxYvkvpqDA=",
|
|
||||||
"ref": "main",
|
|
||||||
"rev": "7d0f35e12e4dec39f981c08fc33515589f41f4a5",
|
|
||||||
"revCount": 3,
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/bro.git"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"ref": "main",
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://git.pvv.ntnu.no/Projects/bro.git"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"crane": {
|
"crane": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1776635034,
|
"lastModified": 1776635034,
|
||||||
@@ -123,7 +101,7 @@
|
|||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"nixpkgs-unstable"
|
"nixpkgs-unstable"
|
||||||
],
|
],
|
||||||
"rust-overlay": "rust-overlay_2"
|
"rust-overlay": "rust-overlay"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1777019032,
|
"lastModified": 1777019032,
|
||||||
@@ -187,7 +165,7 @@
|
|||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"nixpkgs"
|
"nixpkgs"
|
||||||
],
|
],
|
||||||
"rust-overlay": "rust-overlay_3"
|
"rust-overlay": "rust-overlay_2"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1767906976,
|
"lastModified": 1767906976,
|
||||||
@@ -374,7 +352,6 @@
|
|||||||
},
|
},
|
||||||
"root": {
|
"root": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"bro": "bro",
|
|
||||||
"dibbler": "dibbler",
|
"dibbler": "dibbler",
|
||||||
"disko": "disko",
|
"disko": "disko",
|
||||||
"gergle": "gergle",
|
"gergle": "gergle",
|
||||||
@@ -400,7 +377,7 @@
|
|||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"nixpkgs"
|
"nixpkgs"
|
||||||
],
|
],
|
||||||
"rust-overlay": "rust-overlay_4"
|
"rust-overlay": "rust-overlay_3"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1778600367,
|
"lastModified": 1778600367,
|
||||||
@@ -419,27 +396,6 @@
|
|||||||
}
|
}
|
||||||
},
|
},
|
||||||
"rust-overlay": {
|
"rust-overlay": {
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"bro",
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1779419951,
|
|
||||||
"narHash": "sha256-dMX0PUslUHPajP6o8FEoRdFv9afq/dec4POR0vVfjK4=",
|
|
||||||
"owner": "oxalica",
|
|
||||||
"repo": "rust-overlay",
|
|
||||||
"rev": "5b5c521d6cae9ef4aa32f888eb2c0ce595c9be52",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "oxalica",
|
|
||||||
"repo": "rust-overlay",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"rust-overlay_2": {
|
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"greg-ng",
|
"greg-ng",
|
||||||
@@ -460,7 +416,7 @@
|
|||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"rust-overlay_3": {
|
"rust-overlay_2": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"minecraft-heatmap",
|
"minecraft-heatmap",
|
||||||
@@ -481,7 +437,7 @@
|
|||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"rust-overlay_4": {
|
"rust-overlay_3": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"roowho2",
|
"roowho2",
|
||||||
|
|||||||
26
flake.nix
26
flake.nix
@@ -47,9 +47,6 @@
|
|||||||
|
|
||||||
qotd.url = "git+https://git.pvv.ntnu.no/Projects/qotd.git?ref=main";
|
qotd.url = "git+https://git.pvv.ntnu.no/Projects/qotd.git?ref=main";
|
||||||
qotd.inputs.nixpkgs.follows = "nixpkgs";
|
qotd.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
bro.url = "git+https://git.pvv.ntnu.no/Projects/bro.git?ref=main";
|
|
||||||
bro.inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = {
|
outputs = {
|
||||||
@@ -217,14 +214,7 @@
|
|||||||
};
|
};
|
||||||
shark = stableNixosConfig "shark" {};
|
shark = stableNixosConfig "shark" {};
|
||||||
wenche = stableNixosConfig "wenche" {};
|
wenche = stableNixosConfig "wenche" {};
|
||||||
temmie = stableNixosConfig "temmie" {
|
temmie = stableNixosConfig "temmie" {};
|
||||||
overlays = [
|
|
||||||
inputs.bro.overlays.default
|
|
||||||
];
|
|
||||||
modules = [
|
|
||||||
inputs.bro.nixosModules.default
|
|
||||||
];
|
|
||||||
};
|
|
||||||
gluttony = stableNixosConfig "gluttony" {
|
gluttony = stableNixosConfig "gluttony" {
|
||||||
overlays = [
|
overlays = [
|
||||||
(final: prev: { bluemap = final.callPackage ./packages/bluemap.nix {}; })
|
(final: prev: { bluemap = final.callPackage ./packages/bluemap.nix {}; })
|
||||||
@@ -242,6 +232,20 @@
|
|||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
|
grevling = stableNixosConfig "grevling" {
|
||||||
|
modules = [
|
||||||
|
./hosts/grevling/configuration.nix
|
||||||
|
sops-nix.nixosModules.sops
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
tuba = stableNixosConfig "grevling" {
|
||||||
|
modules = [
|
||||||
|
./hosts/tuba/configuration.nix
|
||||||
|
sops-nix.nixosModules.sops
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
|
brzeczyszczykiewicz = stableNixosConfig "brzeczyszczykiewicz" {
|
||||||
modules = [
|
modules = [
|
||||||
inputs.grzegorz-clients.nixosModules.grzegorz-webui
|
inputs.grzegorz-clients.nixosModules.grzegorz-webui
|
||||||
|
|||||||
36
hosts/grevling/configuration.nix
Normal file
36
hosts/grevling/configuration.nix
Normal file
@@ -0,0 +1,36 @@
|
|||||||
|
{ config, pkgs, values, ... }:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
# Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
../../base.nix
|
||||||
|
../../misc/metrics-exporters.nix
|
||||||
|
|
||||||
|
./services/openvpn
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.loader.systemd-boot.enable = true;
|
||||||
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
|
||||||
|
networking.hostName = "grevling";
|
||||||
|
|
||||||
|
# systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
|
||||||
|
# matchConfig.Name = "eno1";
|
||||||
|
# address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||||
|
# };
|
||||||
|
|
||||||
|
# List packages installed in system profile
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
];
|
||||||
|
|
||||||
|
# List services that you want to enable:
|
||||||
|
|
||||||
|
# This value determines the NixOS release from which the default
|
||||||
|
# settings for stateful data, like file locations and database versions
|
||||||
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
# this value at the release version of the first install of this system.
|
||||||
|
# Before changing this value read the documentation for this option
|
||||||
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
|
system.stateVersion = "23.05"; # Did you read the comment?
|
||||||
|
|
||||||
|
}
|
||||||
40
hosts/grevling/hardware-configuration.nix
Normal file
40
hosts/grevling/hardware-configuration.nix
Normal file
@@ -0,0 +1,40 @@
|
|||||||
|
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||||
|
# and may be overwritten by future invocations. Please make changes
|
||||||
|
# to /etc/nixos/configuration.nix instead.
|
||||||
|
{ config, lib, pkgs, modulesPath, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
|
||||||
|
boot.initrd.kernelModules = [ ];
|
||||||
|
boot.kernelModules = [ "kvm-intel" ];
|
||||||
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
|
fileSystems."/" =
|
||||||
|
{ device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
|
||||||
|
fsType = "ext4";
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems."/boot" =
|
||||||
|
{ device = "/dev/disk/by-uuid/145E-7362";
|
||||||
|
fsType = "vfat";
|
||||||
|
};
|
||||||
|
|
||||||
|
swapDevices =
|
||||||
|
[ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
|
||||||
|
];
|
||||||
|
|
||||||
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
|
networking.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp2s2.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
|
}
|
||||||
77
hosts/grevling/services/openvpn/default.nix
Normal file
77
hosts/grevling/services/openvpn/default.nix
Normal file
@@ -0,0 +1,77 @@
|
|||||||
|
{ pkgs, lib, values, ... }:
|
||||||
|
{
|
||||||
|
services.openvpn.servers."ov-tunnel" = {
|
||||||
|
config = let
|
||||||
|
conf = {
|
||||||
|
# TODO: use aliases
|
||||||
|
local = "129.241.210.191";
|
||||||
|
port = 1194;
|
||||||
|
proto = "udp";
|
||||||
|
dev = "tap";
|
||||||
|
|
||||||
|
# TODO: set up
|
||||||
|
ca = "";
|
||||||
|
cert = "";
|
||||||
|
key = "";
|
||||||
|
dh = "";
|
||||||
|
|
||||||
|
# Maintain a record of client <-> virtual IP address
|
||||||
|
# associations in this file. If OpenVPN goes down or
|
||||||
|
# is restarted, reconnecting clients can be assigned
|
||||||
|
# the same virtual IP address from the pool that was
|
||||||
|
# previously assigned.
|
||||||
|
ifconfig-pool-persist = ./ipp.txt;
|
||||||
|
|
||||||
|
server-bridge = builtins.concatStringsSep " " [
|
||||||
|
"129.241.210.129"
|
||||||
|
"255.255.255.128"
|
||||||
|
"129.241.210.253"
|
||||||
|
"129.241.210.254"
|
||||||
|
];
|
||||||
|
|
||||||
|
keepalive = "10 120";
|
||||||
|
cipher = "none";
|
||||||
|
|
||||||
|
user = "nobody";
|
||||||
|
group = "nobody";
|
||||||
|
|
||||||
|
status = "/var/log/openvpn-status.log";
|
||||||
|
|
||||||
|
client-config-dir = pkgs.writeTextDir "tuba" ''
|
||||||
|
# Sett IP-adr. for tap0 til tubas PVV-adr.
|
||||||
|
ifconfig-push ${values.services.tuba-tap} 255.255.255.128
|
||||||
|
# Hvordan skal man faa dette til aa funke, tro?
|
||||||
|
#ifconfig-ipv6-push 2001:700:300:1900::xxx/64
|
||||||
|
|
||||||
|
# La tuba bruke std. PVV-gateway til all trafikk (unntatt
|
||||||
|
# VPN-tunnellen).
|
||||||
|
push "redirect-gateway"
|
||||||
|
'';
|
||||||
|
|
||||||
|
persist-key = true;
|
||||||
|
persist-tun = true;
|
||||||
|
|
||||||
|
verb = 5;
|
||||||
|
|
||||||
|
explicit-exit-notify = 1;
|
||||||
|
};
|
||||||
|
in lib.pipe conf [
|
||||||
|
(lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
|
||||||
|
(builtins.mapAttrs (_: value:
|
||||||
|
if builtins.isList value then builtins.concatStringsSep " " (map toString value)
|
||||||
|
else if value == true then value
|
||||||
|
else if builtins.any (f: f value) [
|
||||||
|
builtins.isString
|
||||||
|
builtins.isInt
|
||||||
|
builtins.isFloat
|
||||||
|
lib.isPath
|
||||||
|
lib.isDerivation
|
||||||
|
] then toString value
|
||||||
|
else throw "Unknown value in grevling openvpn config, deading now\n${value}"
|
||||||
|
))
|
||||||
|
(lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
|
||||||
|
(builtins.concatStringsSep "\n")
|
||||||
|
(x: x + "\n\n")
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
0
hosts/grevling/services/openvpn/ipp.txt
Normal file
0
hosts/grevling/services/openvpn/ipp.txt
Normal file
@@ -1 +0,0 @@
|
|||||||
target
|
|
||||||
@@ -1,171 +0,0 @@
|
|||||||
# This file is automatically @generated by Cargo.
|
|
||||||
# It is not intended for manual editing.
|
|
||||||
version = 4
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "apache-log-processor"
|
|
||||||
version = "0.1.0"
|
|
||||||
dependencies = [
|
|
||||||
"nix",
|
|
||||||
"time",
|
|
||||||
]
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "bitflags"
|
|
||||||
version = "2.11.1"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "cfg-if"
|
|
||||||
version = "1.0.4"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "cfg_aliases"
|
|
||||||
version = "0.2.1"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "deranged"
|
|
||||||
version = "0.5.8"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
|
|
||||||
dependencies = [
|
|
||||||
"powerfmt",
|
|
||||||
]
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "itoa"
|
|
||||||
version = "1.0.18"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "libc"
|
|
||||||
version = "0.2.186"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "nix"
|
|
||||||
version = "0.31.3"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
|
|
||||||
dependencies = [
|
|
||||||
"bitflags",
|
|
||||||
"cfg-if",
|
|
||||||
"cfg_aliases",
|
|
||||||
"libc",
|
|
||||||
]
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "num-conv"
|
|
||||||
version = "0.2.2"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "num_threads"
|
|
||||||
version = "0.1.7"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9"
|
|
||||||
dependencies = [
|
|
||||||
"libc",
|
|
||||||
]
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "powerfmt"
|
|
||||||
version = "0.2.0"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "proc-macro2"
|
|
||||||
version = "1.0.106"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
|
|
||||||
dependencies = [
|
|
||||||
"unicode-ident",
|
|
||||||
]
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "quote"
|
|
||||||
version = "1.0.45"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
|
|
||||||
dependencies = [
|
|
||||||
"proc-macro2",
|
|
||||||
]
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "serde_core"
|
|
||||||
version = "1.0.228"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
|
|
||||||
dependencies = [
|
|
||||||
"serde_derive",
|
|
||||||
]
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "serde_derive"
|
|
||||||
version = "1.0.228"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
|
|
||||||
dependencies = [
|
|
||||||
"proc-macro2",
|
|
||||||
"quote",
|
|
||||||
"syn",
|
|
||||||
]
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "syn"
|
|
||||||
version = "2.0.117"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
|
|
||||||
dependencies = [
|
|
||||||
"proc-macro2",
|
|
||||||
"quote",
|
|
||||||
"unicode-ident",
|
|
||||||
]
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "time"
|
|
||||||
version = "0.3.47"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
|
|
||||||
dependencies = [
|
|
||||||
"deranged",
|
|
||||||
"itoa",
|
|
||||||
"libc",
|
|
||||||
"num-conv",
|
|
||||||
"num_threads",
|
|
||||||
"powerfmt",
|
|
||||||
"serde_core",
|
|
||||||
"time-core",
|
|
||||||
"time-macros",
|
|
||||||
]
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "time-core"
|
|
||||||
version = "0.1.8"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "time-macros"
|
|
||||||
version = "0.2.27"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
|
|
||||||
dependencies = [
|
|
||||||
"num-conv",
|
|
||||||
"time-core",
|
|
||||||
]
|
|
||||||
|
|
||||||
[[package]]
|
|
||||||
name = "unicode-ident"
|
|
||||||
version = "1.0.24"
|
|
||||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
|
||||||
checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
|
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
[package]
|
|
||||||
name = "apache-log-processor"
|
|
||||||
version = "0.1.0"
|
|
||||||
edition = "2024"
|
|
||||||
autobins = false
|
|
||||||
license = "MIT"
|
|
||||||
authors = [
|
|
||||||
"projects@pvv.ntnu.no",
|
|
||||||
]
|
|
||||||
|
|
||||||
[dependencies]
|
|
||||||
nix = { version = "0.31.3", features = ["event", "fs", "user"] }
|
|
||||||
time = { version = "0.3.47", features = ["formatting", "local-offset"] }
|
|
||||||
|
|
||||||
|
|
||||||
[[bin]]
|
|
||||||
name = "apache-log-processor"
|
|
||||||
bench = false
|
|
||||||
path = "src/main.rs"
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
{
|
|
||||||
lib
|
|
||||||
, rustPlatform
|
|
||||||
, stdenv
|
|
||||||
}:
|
|
||||||
let
|
|
||||||
cargoToml = fromTOML (builtins.readFile ./Cargo.toml);
|
|
||||||
cargoLock = ./Cargo.lock;
|
|
||||||
mainProgram = (lib.head cargoToml.bin).name;
|
|
||||||
pname = cargoToml.package.name;
|
|
||||||
in
|
|
||||||
rustPlatform.buildRustPackage {
|
|
||||||
inherit pname;
|
|
||||||
inherit (cargoToml.package) version;
|
|
||||||
src = lib.fileset.toSource {
|
|
||||||
root = ./.;
|
|
||||||
fileset = lib.fileset.unions [
|
|
||||||
./Cargo.toml
|
|
||||||
./Cargo.lock
|
|
||||||
./src
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
cargoLock.lockFile = cargoLock;
|
|
||||||
|
|
||||||
doCheck = true;
|
|
||||||
|
|
||||||
meta = with lib; {
|
|
||||||
license = licenses.mit;
|
|
||||||
platforms = platforms.linux;
|
|
||||||
inherit mainProgram;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,322 +0,0 @@
|
|||||||
use nix::{
|
|
||||||
errno::Errno,
|
|
||||||
fcntl::{FcntlArg, OFlag, fcntl, open},
|
|
||||||
sys::{
|
|
||||||
epoll::{Epoll, EpollCreateFlags, EpollEvent, EpollFlags, EpollTimeout},
|
|
||||||
stat::Mode,
|
|
||||||
},
|
|
||||||
// unistd::{User, getegid, geteuid, read, setegid, seteuid, write},
|
|
||||||
unistd::{User, read, write},
|
|
||||||
};
|
|
||||||
use std::{
|
|
||||||
collections::VecDeque,
|
|
||||||
os::fd::{AsFd, BorrowedFd, OwnedFd},
|
|
||||||
path::PathBuf,
|
|
||||||
process::exit,
|
|
||||||
};
|
|
||||||
use time::{OffsetDateTime, format_description};
|
|
||||||
|
|
||||||
const READ_BUFFER_SIZE: usize = 8 * 1024;
|
|
||||||
|
|
||||||
#[derive(Debug, Clone, Copy)]
|
|
||||||
enum LogMode {
|
|
||||||
Access,
|
|
||||||
Error,
|
|
||||||
}
|
|
||||||
|
|
||||||
fn main() -> Result<(), String> {
|
|
||||||
let log_mode = match std::env::args().nth(1).as_deref() {
|
|
||||||
Some("access") => LogMode::Access,
|
|
||||||
Some("error") => LogMode::Error,
|
|
||||||
Some(other) => {
|
|
||||||
return Err(format!(
|
|
||||||
"invalid log mode `{other}`; expected `access` or `error`"
|
|
||||||
));
|
|
||||||
}
|
|
||||||
None => return Err("missing log mode argument; expected `access` or `error`".to_string()),
|
|
||||||
};
|
|
||||||
|
|
||||||
let tee_file = match log_mode {
|
|
||||||
LogMode::Access => None,
|
|
||||||
LogMode::Error => Some(
|
|
||||||
open(
|
|
||||||
&PathBuf::from("/var/log/httpd/error.log"),
|
|
||||||
OFlag::O_WRONLY | OFlag::O_APPEND | OFlag::O_CREAT | OFlag::O_CLOEXEC,
|
|
||||||
Mode::S_IRUSR | Mode::S_IWUSR,
|
|
||||||
)
|
|
||||||
.map_err(|error| format!("failed to open error log for teeing: {error}"))?,
|
|
||||||
),
|
|
||||||
};
|
|
||||||
|
|
||||||
let stdin = std::io::stdin();
|
|
||||||
|
|
||||||
fcntl(stdin.as_fd(), FcntlArg::F_GETFL)
|
|
||||||
.map(OFlag::from_bits_retain)
|
|
||||||
.map(|flags| FcntlArg::F_SETFL(flags | OFlag::O_NONBLOCK))
|
|
||||||
.and_then(|flags| fcntl(stdin.as_fd(), flags))
|
|
||||||
.map_err(|error| format!("failed to make stdin nonblocking: {error}"))?;
|
|
||||||
|
|
||||||
let epoll = Epoll::new(EpollCreateFlags::EPOLL_CLOEXEC)
|
|
||||||
.map_err(|error| format!("failed to create epoll instance: {error}"))?;
|
|
||||||
|
|
||||||
epoll
|
|
||||||
.add(
|
|
||||||
stdin.as_fd(),
|
|
||||||
EpollEvent::new(
|
|
||||||
EpollFlags::EPOLLIN | EpollFlags::EPOLLERR | EpollFlags::EPOLLHUP,
|
|
||||||
0,
|
|
||||||
),
|
|
||||||
)
|
|
||||||
.map_err(|error| format!("failed to register stdin with epoll: {error}"))?;
|
|
||||||
|
|
||||||
if let Err(error) = event_loop(log_mode, epoll, stdin.as_fd(), tee_file) {
|
|
||||||
eprintln!("Error: {error}");
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
|
|
||||||
fn event_loop(
|
|
||||||
log_mode: LogMode,
|
|
||||||
epoll: Epoll,
|
|
||||||
stdin_fd: BorrowedFd<'_>,
|
|
||||||
mut tee_file: Option<OwnedFd>,
|
|
||||||
) -> Result<(), String> {
|
|
||||||
let mut events = [EpollEvent::empty(); 1];
|
|
||||||
let mut pending = VecDeque::new();
|
|
||||||
|
|
||||||
loop {
|
|
||||||
let ready = loop {
|
|
||||||
match epoll.wait(&mut events, EpollTimeout::NONE) {
|
|
||||||
Ok(ready) => break ready,
|
|
||||||
Err(Errno::EINTR) => continue,
|
|
||||||
Err(error) => {
|
|
||||||
return Err(format!("epoll wait failed: {error}"));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
if ready == 0 {
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
let mut scratch = [0u8; READ_BUFFER_SIZE];
|
|
||||||
|
|
||||||
let eof = loop {
|
|
||||||
match read(stdin_fd, &mut scratch) {
|
|
||||||
Ok(0) => break true,
|
|
||||||
Ok(read_bytes) => pending.extend(scratch[..read_bytes].iter().copied()),
|
|
||||||
Err(Errno::EINTR) => continue,
|
|
||||||
Err(Errno::EAGAIN) => break false,
|
|
||||||
Err(error) => {
|
|
||||||
return Err(format!("failed to read from stdin: {error}"));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
while let Some(newline_index) = pending.iter().position(|byte| *byte == b'\n') {
|
|
||||||
let line = pending.make_contiguous();
|
|
||||||
process_line(log_mode, &line[..=newline_index], &mut tee_file)?;
|
|
||||||
pending.drain(..=newline_index);
|
|
||||||
}
|
|
||||||
|
|
||||||
if eof {
|
|
||||||
if !pending.is_empty() {
|
|
||||||
process_line(log_mode, pending.make_contiguous(), &mut tee_file)?;
|
|
||||||
pending.clear();
|
|
||||||
}
|
|
||||||
return Ok(());
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
fn process_line(
|
|
||||||
log_mode: LogMode,
|
|
||||||
line: &[u8],
|
|
||||||
tee_file: &mut Option<OwnedFd>,
|
|
||||||
) -> Result<(), String> {
|
|
||||||
if let Some(tee_file) = tee_file.as_ref() {
|
|
||||||
write_all_fd(tee_file, line).map_err(|error| {
|
|
||||||
format!("failed to append to APACHE_LOG_PROCESSOR_TEE_FILE: {error}")
|
|
||||||
})?;
|
|
||||||
}
|
|
||||||
|
|
||||||
if let Some(user) =
|
|
||||||
parse_username_from_line(line).and_then(|name| User::from_name(name).ok().flatten())
|
|
||||||
{
|
|
||||||
// let identity = EffectiveIdentity::switch_to(&user).map_err(|error| {
|
|
||||||
// format!(
|
|
||||||
// "failed to switch effective identity to {} (uid {}, gid {}): {error}",
|
|
||||||
// user.name, user.uid, user.gid
|
|
||||||
// )
|
|
||||||
// })?;
|
|
||||||
|
|
||||||
let result: Result<(), String> = (|| {
|
|
||||||
let dir = user.dir.join("nobackup/weblogs");
|
|
||||||
|
|
||||||
if !dir.is_dir() {
|
|
||||||
return Err(format!(
|
|
||||||
"logs directory {} does not exist for user {}",
|
|
||||||
dir.display(),
|
|
||||||
user.name
|
|
||||||
));
|
|
||||||
}
|
|
||||||
|
|
||||||
let now = OffsetDateTime::now_local()
|
|
||||||
.unwrap_or_else(|_| OffsetDateTime::now_utc())
|
|
||||||
.format(&format_description::parse("[year]-[month]-[day]").unwrap())
|
|
||||||
.map_err(|error| {
|
|
||||||
format!("failed to format current date for log file name: {error}")
|
|
||||||
})?;
|
|
||||||
|
|
||||||
let logfile = dir.join(match log_mode {
|
|
||||||
LogMode::Access => format!("access-{now}.log"),
|
|
||||||
LogMode::Error => format!("error-{now}.log"),
|
|
||||||
});
|
|
||||||
|
|
||||||
let fd = open(
|
|
||||||
&logfile,
|
|
||||||
OFlag::O_WRONLY | OFlag::O_APPEND | OFlag::O_CREAT | OFlag::O_CLOEXEC,
|
|
||||||
Mode::S_IRUSR
|
|
||||||
| Mode::S_IWUSR
|
|
||||||
| Mode::S_IRGRP
|
|
||||||
| Mode::S_IROTH
|
|
||||||
| Mode::S_IWGRP
|
|
||||||
| Mode::S_IWOTH,
|
|
||||||
)
|
|
||||||
.map_err(|error| format!("failed to open log file for user {}: {error}", user.name))?;
|
|
||||||
|
|
||||||
write_all_fd(fd.as_fd(), line).map_err(|error| {
|
|
||||||
format!(
|
|
||||||
"failed to append to log file for user {}: {error}",
|
|
||||||
user.name
|
|
||||||
)
|
|
||||||
})?;
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
})();
|
|
||||||
|
|
||||||
if let Err(error) = result {
|
|
||||||
eprintln!("Error processing log line for user {}: {error}", user.name);
|
|
||||||
}
|
|
||||||
|
|
||||||
// identity.restore().map_err(|error| {
|
|
||||||
// format!(
|
|
||||||
// "failed to restore original effective identity after handling {}: {error}",
|
|
||||||
// user.name
|
|
||||||
// )
|
|
||||||
// })?;
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
|
|
||||||
fn parse_username_from_line(line: &[u8]) -> Option<&str> {
|
|
||||||
line.splitn(8, |&b| b == b' ')
|
|
||||||
.nth(6)
|
|
||||||
.and_then(|path| {
|
|
||||||
path.strip_prefix(b"/~")
|
|
||||||
.and_then(|rest| rest.split(|&b| b == b'/').next())
|
|
||||||
})
|
|
||||||
.or_else(|| {
|
|
||||||
line.windows(b"/home/pvv/".len())
|
|
||||||
.enumerate()
|
|
||||||
.find_map(|(start, window)| {
|
|
||||||
(window == b"/home/pvv/")
|
|
||||||
.then_some(start + b"/home/pvv/".len())
|
|
||||||
.and_then(|start| line.get(start..))
|
|
||||||
.filter(|rest| rest.get(1) == Some(&b'/'))
|
|
||||||
.and_then(|rest| rest.get(2..))
|
|
||||||
.and_then(|rest| rest.split(|&b| b == b'/').next())
|
|
||||||
})
|
|
||||||
})
|
|
||||||
.filter(|segment| !segment.is_empty())
|
|
||||||
.and_then(|segment| std::str::from_utf8(segment).ok())
|
|
||||||
}
|
|
||||||
|
|
||||||
fn write_all_fd<Fd: AsFd>(fd: Fd, mut buffer: &[u8]) -> nix::Result<()> {
|
|
||||||
while !buffer.is_empty() {
|
|
||||||
match write(fd.as_fd(), buffer) {
|
|
||||||
Ok(0) => return Err(Errno::EIO),
|
|
||||||
Ok(written) => buffer = &buffer[written..],
|
|
||||||
Err(Errno::EINTR) => continue,
|
|
||||||
Err(error) => return Err(error),
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
|
|
||||||
// struct EffectiveIdentity {
|
|
||||||
// saved_euid: nix::unistd::Uid,
|
|
||||||
// saved_egid: nix::unistd::Gid,
|
|
||||||
// restored: bool,
|
|
||||||
// }
|
|
||||||
|
|
||||||
// impl EffectiveIdentity {
|
|
||||||
// fn switch_to(user: &User) -> nix::Result<Self> {
|
|
||||||
// let guard = Self {
|
|
||||||
// saved_euid: geteuid(),
|
|
||||||
// saved_egid: getegid(),
|
|
||||||
// restored: false,
|
|
||||||
// };
|
|
||||||
|
|
||||||
// setegid(user.gid)?;
|
|
||||||
// if let Err(error) = seteuid(user.uid) {
|
|
||||||
// let _ = setegid(guard.saved_egid);
|
|
||||||
// return Err(error);
|
|
||||||
// }
|
|
||||||
|
|
||||||
// Ok(guard)
|
|
||||||
// }
|
|
||||||
|
|
||||||
// fn restore(mut self) -> nix::Result<()> {
|
|
||||||
// let restore_uid = seteuid(self.saved_euid);
|
|
||||||
// let restore_gid = setegid(self.saved_egid);
|
|
||||||
// self.restored = true;
|
|
||||||
|
|
||||||
// restore_uid?;
|
|
||||||
// restore_gid?;
|
|
||||||
// Ok(())
|
|
||||||
// }
|
|
||||||
// }
|
|
||||||
|
|
||||||
#[cfg(test)]
|
|
||||||
mod tests {
|
|
||||||
use super::*;
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn test_parse_user_from_access_log() {
|
|
||||||
let inputs = [(
|
|
||||||
"1.2.3.4 - - [25/May/2026:10:07:24 +0200] \"GET /~oysteikt/ HTTP/2.0\" 200 3708",
|
|
||||||
"oysteikt",
|
|
||||||
)];
|
|
||||||
|
|
||||||
for (line, expected_user) in inputs {
|
|
||||||
let parsed_user = parse_username_from_line(line.as_bytes());
|
|
||||||
assert_eq!(
|
|
||||||
parsed_user,
|
|
||||||
Some(expected_user),
|
|
||||||
"Failed to parse user from line: {line}"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn test_parse_user_from_error_log() {
|
|
||||||
let inputs = [(
|
|
||||||
"[Sat May 09 20:45:21.480016 2026] [authz_core:error] [pid 3555:tid 3617] [remote 1::2:42000] AH01630: client denied by server configuration: /home/pvv/d/oysteikt/web-docs/.git",
|
|
||||||
"oysteikt",
|
|
||||||
)];
|
|
||||||
|
|
||||||
for (line, expected_user) in inputs {
|
|
||||||
let parsed_user = parse_username_from_line(line.as_bytes());
|
|
||||||
assert_eq!(
|
|
||||||
parsed_user,
|
|
||||||
Some(expected_user),
|
|
||||||
"Failed to parse user from line: {line}"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -11,8 +11,6 @@ let
|
|||||||
upload_max_filesize = "40M";
|
upload_max_filesize = "40M";
|
||||||
});
|
});
|
||||||
|
|
||||||
apache-log-processor = pkgs.callPackage ./apache-log-processor { };
|
|
||||||
|
|
||||||
# https://nixos.org/manual/nixpkgs/stable/#ssec-php-user-guide-installing-with-extensions
|
# https://nixos.org/manual/nixpkgs/stable/#ssec-php-user-guide-installing-with-extensions
|
||||||
phpEnv = pkgs.php.buildEnv {
|
phpEnv = pkgs.php.buildEnv {
|
||||||
extensions = { all, ... }: with all; [
|
extensions = { all, ... }: with all; [
|
||||||
@@ -41,7 +39,7 @@ let
|
|||||||
extraConfig = phpOptions;
|
extraConfig = phpOptions;
|
||||||
};
|
};
|
||||||
|
|
||||||
perlEnv = (pkgs.perl.withPackages (ps: with ps; [
|
perlEnv = pkgs.perl.withPackages (ps: with ps; [
|
||||||
pkgs.exiftool
|
pkgs.exiftool
|
||||||
pkgs.ikiwiki
|
pkgs.ikiwiki
|
||||||
pkgs.irssi
|
pkgs.irssi
|
||||||
@@ -56,14 +54,7 @@ let
|
|||||||
ImageMagick
|
ImageMagick
|
||||||
JSON
|
JSON
|
||||||
TemplateToolkit
|
TemplateToolkit
|
||||||
])).overrideAttrs (prev: {
|
]);
|
||||||
# NOTE: `pkgs.perl.propagatedBuildInputs` don't actually propagate through the
|
|
||||||
# wrapper derivation created by `withPackages`. This should compensate
|
|
||||||
# for that.
|
|
||||||
postBuild = prev.postBuild + ''
|
|
||||||
cp -r '${pkgs.perl}/nix-support' "$out"/nix-support
|
|
||||||
'';
|
|
||||||
});
|
|
||||||
|
|
||||||
# https://nixos.org/manual/nixpkgs/stable/#python.buildenv-function
|
# https://nixos.org/manual/nixpkgs/stable/#python.buildenv-function
|
||||||
pythonEnv = pkgs.python3.buildEnv.override {
|
pythonEnv = pkgs.python3.buildEnv.override {
|
||||||
@@ -76,6 +67,21 @@ let
|
|||||||
ignoreCollisions = true;
|
ignoreCollisions = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
sendmailWrapper = pkgs.writeShellApplication {
|
||||||
|
name = "sendmail";
|
||||||
|
runtimeInputs = [ ];
|
||||||
|
text = ''
|
||||||
|
args=("$@")
|
||||||
|
|
||||||
|
if [[ -z "$USERDIR_USER" ]] && [[ "$USERDIR_USER" != "pvv" ]]; then
|
||||||
|
# Prepend -fusername to the argument list, so bounces go to the user
|
||||||
|
args=("-f$USERDIR_USER" "''${args[@]}")
|
||||||
|
fi
|
||||||
|
|
||||||
|
exec '${lib.getExe pkgs.system-sendmail}' "''${args[@]}"
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
# https://nixos.org/manual/nixpkgs/stable/#sec-building-environment
|
# https://nixos.org/manual/nixpkgs/stable/#sec-building-environment
|
||||||
fhsEnv = pkgs.buildEnv {
|
fhsEnv = pkgs.buildEnv {
|
||||||
name = "userweb-env";
|
name = "userweb-env";
|
||||||
@@ -83,7 +89,7 @@ let
|
|||||||
paths = with pkgs; [
|
paths = with pkgs; [
|
||||||
bash
|
bash
|
||||||
|
|
||||||
config.services.bro.instances.userweb-sendmail.client.package
|
sendmailWrapper
|
||||||
|
|
||||||
perlEnv
|
perlEnv
|
||||||
pythonEnv
|
pythonEnv
|
||||||
@@ -178,44 +184,31 @@ in
|
|||||||
extraModules = [
|
extraModules = [
|
||||||
"systemd"
|
"systemd"
|
||||||
"userdir"
|
"userdir"
|
||||||
{
|
# TODO: I think the compilation steps of pkgs.apacheHttpdPackages.mod_perl might have some
|
||||||
name = "perl";
|
# incorrect or restrictive assumptions upstream, either nixpkgs or source
|
||||||
path = let
|
# {
|
||||||
mod_perl = pkgs.symlinkJoin {
|
# name = "perl";
|
||||||
name = "userweb_modperl_with_custom_perl_env";
|
# path = let
|
||||||
ignoreCollisions = true;
|
# mod_perl = pkgs.apacheHttpdPackages.mod_perl.override {
|
||||||
paths = [
|
# apacheHttpd = cfg.package.out;
|
||||||
(pkgs.apacheHttpdPackages.mod_perl.override {
|
# perl = perlEnv;
|
||||||
apacheHttpd = cfg.package.out;
|
# };
|
||||||
})
|
# in "${mod_perl}/modules/mod_perl.so";
|
||||||
perlEnv
|
# }
|
||||||
];
|
|
||||||
};
|
|
||||||
in "${mod_perl}/modules/mod_perl.so";
|
|
||||||
}
|
|
||||||
];
|
];
|
||||||
|
|
||||||
logPerVirtualHost = false;
|
|
||||||
|
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
TraceEnable on
|
TraceEnable on
|
||||||
LogLevel warn rewrite:trace3
|
LogLevel warn rewrite:trace3
|
||||||
|
ScriptLog ${cfg.logDir}/cgi.log
|
||||||
'';
|
'';
|
||||||
|
|
||||||
|
# virtualHosts."userweb.pvv.ntnu.no" = {
|
||||||
virtualHosts."temmie.pvv.ntnu.no" = {
|
virtualHosts."temmie.pvv.ntnu.no" = {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
|
|
||||||
serverAliases = [
|
|
||||||
"www2.pvv.ntnu.no"
|
|
||||||
];
|
|
||||||
|
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
CustomLog "${cfg.logDir}/access.log" combined
|
|
||||||
CustomLog "|${lib.getExe apache-log-processor} access" combined
|
|
||||||
ErrorLog "|${lib.getExe apache-log-processor} error"
|
|
||||||
ScriptLog "${cfg.logDir}/cgi.log"
|
|
||||||
|
|
||||||
UserDir ${lib.concatMapStringsSep " " (l: "/home/pvv/${l}/*/web-docs") homeLetters}
|
UserDir ${lib.concatMapStringsSep " " (l: "/home/pvv/${l}/*/web-docs") homeLetters}
|
||||||
UserDir disabled root
|
UserDir disabled root
|
||||||
AddHandler cgi-script .cgi
|
AddHandler cgi-script .cgi
|
||||||
@@ -265,14 +258,6 @@ in
|
|||||||
# ];
|
# ];
|
||||||
# };
|
# };
|
||||||
|
|
||||||
# NOTE: 54 -> 33, this is the UID/GID we used for www-data on tom in the past.
|
|
||||||
# Any files accessed by or created by httpd will do so over NFS with this
|
|
||||||
# UID/GID pair as its credentials.
|
|
||||||
# This overlaps with the hardcoded `disnix` uid in nixpkgs, but we *probably*
|
|
||||||
# won't be using that for the foreseeable future.
|
|
||||||
users.users."wwwrun".uid = lib.mkForce 33;
|
|
||||||
users.groups."wwwrun".gid = lib.mkForce 33;
|
|
||||||
|
|
||||||
systemd.services.httpd = {
|
systemd.services.httpd = {
|
||||||
after = [ "pvv-homedirs.target" ];
|
after = [ "pvv-homedirs.target" ];
|
||||||
requires = [ "pvv-homedirs.target" ];
|
requires = [ "pvv-homedirs.target" ];
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, ... }:
|
||||||
{
|
{
|
||||||
services.postfix.enable = lib.mkForce false;
|
services.postfix.enable = lib.mkForce false;
|
||||||
|
|
||||||
@@ -9,111 +9,4 @@
|
|||||||
remotes = "mail.pvv.ntnu.no smtp --port=25";
|
remotes = "mail.pvv.ntnu.no smtp --port=25";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
services.bro = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
instances.userweb-sendmail = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
client = {
|
|
||||||
settings.BRO_FILE_FLAGS = [
|
|
||||||
"-C"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
server = {
|
|
||||||
settings = {
|
|
||||||
executable = let
|
|
||||||
sendmailWrapper = pkgs.writeShellApplication {
|
|
||||||
name = "sendmail";
|
|
||||||
runtimeInputs = [ ];
|
|
||||||
bashOptions = [
|
|
||||||
"errexit"
|
|
||||||
"pipefail"
|
|
||||||
];
|
|
||||||
text = ''
|
|
||||||
args=("$@")
|
|
||||||
|
|
||||||
if [[ -z "$USERDIR_USER" ]] && [[ "$USERDIR_USER" != "pvv" ]]; then
|
|
||||||
# Prepend -fusername to the argument list, so bounces go to the user
|
|
||||||
args=("-f$USERDIR_USER" "''${args[@]}")
|
|
||||||
fi
|
|
||||||
|
|
||||||
exec '${lib.getExe pkgs.system-sendmail}' -t -i "''${args[@]}"
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
in lib.getExe sendmailWrapper;
|
|
||||||
allowed-env = [ "USERDIR_USER" ];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
environment.systemPackages = [
|
|
||||||
(config.services.bro.instances.userweb-sendmail.client.package.overrideAttrs (prev: {
|
|
||||||
buildCommand = prev.buildCommand + ''
|
|
||||||
mv "$out/bin/sendmail" "$out/bin/bro-sendmail"
|
|
||||||
'';
|
|
||||||
}))
|
|
||||||
];
|
|
||||||
|
|
||||||
users.users.nullmailer-user = {
|
|
||||||
enable = true;
|
|
||||||
isSystemUser = true;
|
|
||||||
group = "nullmailer-user";
|
|
||||||
};
|
|
||||||
|
|
||||||
users.groups.nullmailer-user = { };
|
|
||||||
|
|
||||||
systemd.services.bro-userweb-sendmail = {
|
|
||||||
serviceConfig = {
|
|
||||||
User = "nullmailer-user";
|
|
||||||
Group = "nullmailer-user";
|
|
||||||
|
|
||||||
ReadWritePaths = [
|
|
||||||
"/var/spool/nullmailer"
|
|
||||||
];
|
|
||||||
|
|
||||||
AmbientCapabilities = "";
|
|
||||||
CapabilityBoundingSet = "";
|
|
||||||
NoNewPrivileges = false;
|
|
||||||
ProtectSystem = "strict";
|
|
||||||
ProtectHome = true;
|
|
||||||
PrivateTmp = true;
|
|
||||||
PrivateDevices = true;
|
|
||||||
PrivateUsers = false;
|
|
||||||
ProtectHostname = true;
|
|
||||||
ProtectClock = true;
|
|
||||||
ProtectKernelTunables = true;
|
|
||||||
ProtectKernelModules = true;
|
|
||||||
ProtectKernelLogs = true;
|
|
||||||
ProtectControlGroups = true;
|
|
||||||
RestrictAddressFamilies = [
|
|
||||||
"AF_UNIX"
|
|
||||||
"AF_INET"
|
|
||||||
"AF_INET6"
|
|
||||||
"AF_NETLINK"
|
|
||||||
];
|
|
||||||
LockPersonality = true;
|
|
||||||
MemoryDenyWriteExecute = true;
|
|
||||||
PrivateMounts = true;
|
|
||||||
ProcSubset = "pid";
|
|
||||||
ProtectProc = "invisible";
|
|
||||||
RemoveIPC = true;
|
|
||||||
RestrictNamespaces = true;
|
|
||||||
RestrictRealtime = true;
|
|
||||||
RestrictSUIDSGID = true;
|
|
||||||
SystemCallArchitectures = "native";
|
|
||||||
SystemCallFilter = [
|
|
||||||
"@system-service"
|
|
||||||
"~@resources"
|
|
||||||
];
|
|
||||||
UMask = "0077";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.httpd.serviceConfig = {
|
|
||||||
BindPaths = [ (lib.head config.systemd.sockets.bro-userweb-sendmail.listenStreams) ];
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
|||||||
36
hosts/tuba/configuration.nix
Normal file
36
hosts/tuba/configuration.nix
Normal file
@@ -0,0 +1,36 @@
|
|||||||
|
{ config, pkgs, values, ... }:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
# Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
../../base.nix
|
||||||
|
../../misc/metrics-exporters.nix
|
||||||
|
|
||||||
|
./services/openvpn
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.loader.systemd-boot.enable = true;
|
||||||
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
|
||||||
|
networking.hostName = "tuba";
|
||||||
|
|
||||||
|
# systemd.network.networks."30-eno1" = values.defaultNetworkConfig // {
|
||||||
|
# matchConfig.Name = "eno1";
|
||||||
|
# address = with values.hosts.georg; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||||
|
# };
|
||||||
|
|
||||||
|
# List packages installed in system profile
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
];
|
||||||
|
|
||||||
|
# List services that you want to enable:
|
||||||
|
|
||||||
|
# This value determines the NixOS release from which the default
|
||||||
|
# settings for stateful data, like file locations and database versions
|
||||||
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
# this value at the release version of the first install of this system.
|
||||||
|
# Before changing this value read the documentation for this option
|
||||||
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
|
system.stateVersion = "23.05"; # Did you read the comment?
|
||||||
|
|
||||||
|
}
|
||||||
40
hosts/tuba/hardware-configuration.nix
Normal file
40
hosts/tuba/hardware-configuration.nix
Normal file
@@ -0,0 +1,40 @@
|
|||||||
|
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||||
|
# and may be overwritten by future invocations. Please make changes
|
||||||
|
# to /etc/nixos/configuration.nix instead.
|
||||||
|
{ config, lib, pkgs, modulesPath, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
|
||||||
|
boot.initrd.kernelModules = [ ];
|
||||||
|
boot.kernelModules = [ "kvm-intel" ];
|
||||||
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
|
fileSystems."/" =
|
||||||
|
{ device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
|
||||||
|
fsType = "ext4";
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems."/boot" =
|
||||||
|
{ device = "/dev/disk/by-uuid/145E-7362";
|
||||||
|
fsType = "vfat";
|
||||||
|
};
|
||||||
|
|
||||||
|
swapDevices =
|
||||||
|
[ { device = "/dev/disk/by-uuid/7ed27e21-3247-44cd-8bcc-5d4a2efebf57"; }
|
||||||
|
];
|
||||||
|
|
||||||
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
|
networking.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp2s2.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
|
}
|
||||||
54
hosts/tuba/services/openvpn/default.nix
Normal file
54
hosts/tuba/services/openvpn/default.nix
Normal file
@@ -0,0 +1,54 @@
|
|||||||
|
{ lib, values, ... }:
|
||||||
|
{
|
||||||
|
services.openvpn.servers."ov-tunnel" = {
|
||||||
|
config = let
|
||||||
|
conf = {
|
||||||
|
# TODO: use aliases
|
||||||
|
client = true;
|
||||||
|
dev = "tap";
|
||||||
|
proto = "udp";
|
||||||
|
remote = "129.241.210.191 1194";
|
||||||
|
|
||||||
|
resolv-retry = "infinite";
|
||||||
|
nobind = true;
|
||||||
|
|
||||||
|
# # TODO: set up
|
||||||
|
ca = "";
|
||||||
|
cert = "";
|
||||||
|
key = "";
|
||||||
|
remote-cert-tls = "server";
|
||||||
|
cipher = "none";
|
||||||
|
|
||||||
|
user = "nobody";
|
||||||
|
group = "nobody";
|
||||||
|
|
||||||
|
status = "/var/log/openvpn-status.log";
|
||||||
|
|
||||||
|
persist-key = true;
|
||||||
|
persist-tun = true;
|
||||||
|
|
||||||
|
verb = 5;
|
||||||
|
|
||||||
|
# script-security = 2;
|
||||||
|
# up = "systemctl restart rwhod";
|
||||||
|
};
|
||||||
|
in lib.pipe conf [
|
||||||
|
(lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
|
||||||
|
(builtins.mapAttrs (_: value:
|
||||||
|
if builtins.isList value then builtins.concatStringsSep " " (map toString value)
|
||||||
|
else if value == true then value
|
||||||
|
else if builtins.any (f: f value) [
|
||||||
|
builtins.isString
|
||||||
|
builtins.isInt
|
||||||
|
builtins.isFloat
|
||||||
|
lib.isPath
|
||||||
|
lib.isDerivation
|
||||||
|
] then toString value
|
||||||
|
else throw "Unknown value in tuba openvpn config, deading now\n${value}"
|
||||||
|
))
|
||||||
|
(lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
|
||||||
|
(builtins.concatStringsSep "\n")
|
||||||
|
(x: x + "\n\n")
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
14
values.nix
14
values.nix
@@ -26,6 +26,12 @@ in rec {
|
|||||||
ipv4 = pvv-ipv4 213;
|
ipv4 = pvv-ipv4 213;
|
||||||
ipv6 = pvv-ipv6 213;
|
ipv6 = pvv-ipv6 213;
|
||||||
};
|
};
|
||||||
|
grevling-tap = {
|
||||||
|
ipv4 = pvv-ipv4 251;
|
||||||
|
};
|
||||||
|
tuba-tap = {
|
||||||
|
ipv4 = pvv-ipv4 252;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
hosts = {
|
hosts = {
|
||||||
@@ -111,6 +117,14 @@ in rec {
|
|||||||
ipv4 = pvv-ipv4 228;
|
ipv4 = pvv-ipv4 228;
|
||||||
ipv6 = pvv-ipv6 228;
|
ipv6 = pvv-ipv6 228;
|
||||||
};
|
};
|
||||||
|
grevling = {
|
||||||
|
ipv4 = pvv-ipv4 198;
|
||||||
|
ipv6 = pvv-ipv6 198;
|
||||||
|
};
|
||||||
|
tuba = {
|
||||||
|
ipv4 = pvv-ipv4 199;
|
||||||
|
ipv6 = pvv-ipv6 199;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
defaultNetworkConfig = {
|
defaultNetworkConfig = {
|
||||||
|
|||||||
Reference in New Issue
Block a user