mirror of
https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git
synced 2026-07-06 02:31:48 +02:00
Compare commits
21 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 h7x4
|
830e0a842a | ||
|
h7x4
|
819497b485 | ||
|
h7x4
|
decd8b04c1 | ||
|
h7x4
|
4b8be337e0 | ||
|
h7x4
|
fcfcb07e59 | ||
|
h7x4
|
1e66049c79 | ||
|
h7x4
|
928ddde344 | ||
|
h7x4
|
3aa8d0b418 | ||
|
h7x4
|
293f28abb1 | ||
|
h7x4
|
f4b1f090e4 | ||
|
h7x4
|
7c684e42f0 | ||
|
h7x4
|
90bfda9066 | ||
|
h7x4
|
522d8f18cb | ||
|
h7x4
|
5e613a03fc | ||
|
h7x4
|
170fb2a980 | ||
|
h7x4
|
3e627472e9 | ||
|
Adrian G L
|
e05c4ed8ca | ||
|
h7x4
|
3fee83ec05 | ||
|
h7x4
|
a1f02fc39d | ||
|
Adrian G L
|
6e37635aac | ||
|
h7x4
|
cdc3ad488b |
@@ -101,6 +101,8 @@
|
||||
|
||||
# users.mutableUsers = lib.mkDefault false;
|
||||
|
||||
users.users.root.initialHashedPassword = "$y$j9T$ahP6GAdttD17OMBo7Yqeh.$Ad7qBcFvTL7HrJ9uTtrQzksN3220Nj9t/CrP6DwgK34"; # generated using mkpasswd, see huttiheita root on vaultwarden
|
||||
|
||||
users.groups."drift".name = "drift";
|
||||
|
||||
# Trusted users on the nix builder machines
|
||||
|
||||
@@ -8,6 +8,5 @@
|
||||
# Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
|
||||
virtualisation.vmVariant = {
|
||||
security.acme.defaults.server = "https://127.0.0.1";
|
||||
users.users.root.initialPassword = "root";
|
||||
};
|
||||
}
|
||||
|
||||
@@ -62,8 +62,10 @@ in
|
||||
name = "loki";
|
||||
match = "*";
|
||||
|
||||
host = "ildkule.pvv.ntnu.no";
|
||||
port = 3100;
|
||||
host = "loki.pvv.ntnu.no";
|
||||
port = 443;
|
||||
tls = "on";
|
||||
"tls.verify" = "on";
|
||||
uri = "/loki/api/v1/push";
|
||||
compress = "gzip";
|
||||
|
||||
|
||||
Generated
+42
-42
@@ -44,11 +44,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1771267058,
|
||||
"narHash": "sha256-EEL4SmD1b3BPJPsSJJ4wDTXWMumJqbR+BLzhJJG0skE=",
|
||||
"lastModified": 1780236125,
|
||||
"narHash": "sha256-LFFdHbXFthgU81S6P+p9FFKs/Wx868d4CtsFvbgvQqo=",
|
||||
"ref": "main",
|
||||
"rev": "e3962d02c78b9c7b4d18148d931a9a4bf22e7902",
|
||||
"revCount": 254,
|
||||
"rev": "267af00ebd8693632fa0f80300e49203cfcebbd4",
|
||||
"revCount": 258,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
|
||||
},
|
||||
@@ -126,10 +126,10 @@
|
||||
"rust-overlay": "rust-overlay_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1777019032,
|
||||
"narHash": "sha256-29lw7THThWb5DW01rVRj1b816Apwz/P4m2wVWaSIadU=",
|
||||
"lastModified": 1779345549,
|
||||
"narHash": "sha256-naEMpFsQrco5eDtYmcTG6cpbPG+kqElOyS7fTb/jw9s=",
|
||||
"ref": "main",
|
||||
"rev": "55262afca46c96f75a834d4e00e30d5fb20affb6",
|
||||
"rev": "5631e1124508fdef0604b08bfcf6343d967a21b3",
|
||||
"revCount": 61,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
|
||||
@@ -169,11 +169,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1769338528,
|
||||
"narHash": "sha256-t18ZoSt9kaI1yde26ok5s7aFLkap1Q9+/2icVh2zuaE=",
|
||||
"lastModified": 1780178524,
|
||||
"narHash": "sha256-2PcNyNqbGCWBpAMdCU1HxSQmhQiG6evdjxVnPA7w5bQ=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "7218348163fd8d84df4a6f682c634793e67a3fed",
|
||||
"revCount": 13,
|
||||
"rev": "2406de41ce9d0a1404cbf4e55537e3f720f37f23",
|
||||
"revCount": 15,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/libdib.git"
|
||||
},
|
||||
@@ -189,16 +189,16 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1764844095,
|
||||
"narHash": "sha256-Drf1orxsmFDzO+UbPo85gHjXW7QzAM+6oTPvI7vOSik=",
|
||||
"lastModified": 1782122067,
|
||||
"narHash": "sha256-95q3DiYOTHjQGbqR0I1w4ETrH+smtddqW0bBxaB/Egg=",
|
||||
"owner": "dali99",
|
||||
"repo": "nixos-matrix-modules",
|
||||
"rev": "25b9f31ef1dbc3987b4c716de716239f2b283701",
|
||||
"rev": "0e0fd9f6a407b08dd5e180a2ff6c3808461e2c47",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "dali99",
|
||||
"ref": "v0.8.0",
|
||||
"ref": "master",
|
||||
"repo": "nixos-matrix-modules",
|
||||
"type": "github"
|
||||
}
|
||||
@@ -291,11 +291,11 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1779622335,
|
||||
"narHash": "sha256-06G98ieM6l+OI7EMhlvchgDBDn+DvIWCNj40LDhKpmc=",
|
||||
"rev": "705e9929918b43bd7b715dc0a878ac870449bb03",
|
||||
"lastModified": 1782708249,
|
||||
"narHash": "sha256-ASIzbiHLqFDHfomCJVMDaW1rsD9IJQ/m997Tw8569tM=",
|
||||
"rev": "68d68014342a18d2514d6e6f1185cfc24d02fc00",
|
||||
"type": "tarball",
|
||||
"url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05beta1.705e9929918b/nixexprs.tar.xz"
|
||||
"url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.3713.68d68014342a/nixexprs.tar.xz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
@@ -319,11 +319,11 @@
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1778586796,
|
||||
"narHash": "sha256-XmDljcG4x8slQDlsWOc77pCA1YVuYn8JGumkYlhfTxI=",
|
||||
"rev": "b25e938b89759b5f9466fc53c4a970244f84dc39",
|
||||
"lastModified": 1782731455,
|
||||
"narHash": "sha256-vFMOLxoARiCUBQOysAAJ0VmPzilmHUqk3EZfSRweKN8=",
|
||||
"rev": "9c4c05a947a91dc14625265fab505fb695e93218",
|
||||
"type": "tarball",
|
||||
"url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre996582.b25e938b8975/nixexprs.tar.xz"
|
||||
"url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.11pre1024311.9c4c05a947a9/nixexprs.tar.xz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
@@ -379,11 +379,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1781362709,
|
||||
"narHash": "sha256-zTzLvvtRdOKKcQMWydoZuduj9fwwkYRfB1RBzKegwHM=",
|
||||
"lastModified": 1782759909,
|
||||
"narHash": "sha256-gktjBeZyoRvVBkm2cO1tD99fdQ34iUDyB6iecRdorm4=",
|
||||
"ref": "main",
|
||||
"rev": "5fb08a462263e5a8d742ecd93e559e534d5c3af2",
|
||||
"revCount": 586,
|
||||
"rev": "ad6c79fb713884a4a2df8aab30914cd0c1c2e6cb",
|
||||
"revCount": 587,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
|
||||
},
|
||||
@@ -447,17 +447,17 @@
|
||||
"rust-overlay": "rust-overlay_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1778600367,
|
||||
"narHash": "sha256-YB0b2xUf4D8792D5Ay//7C3AjHyv+9yoy8K1mTe+wvE=",
|
||||
"lastModified": 1782275838,
|
||||
"narHash": "sha256-CW84hEFcypvEegQp+4zZZ4lCnPT7Qn27OpKiQBxiWS8=",
|
||||
"ref": "main",
|
||||
"rev": "8e5f2849ff7c9616100fe928261512a7ad647939",
|
||||
"revCount": 91,
|
||||
"rev": "71d2b72c34352a79dbee8ebf23ce64f39aead692",
|
||||
"revCount": 102,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"rev": "8e5f2849ff7c9616100fe928261512a7ad647939",
|
||||
"rev": "71d2b72c34352a79dbee8ebf23ce64f39aead692",
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
|
||||
}
|
||||
@@ -491,11 +491,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1777000482,
|
||||
"narHash": "sha256-CZ5FKUSA8FCJf0h9GWdPJXoVVDL9H5yC74GkVc5ubIM=",
|
||||
"lastModified": 1779333539,
|
||||
"narHash": "sha256-lpmN2lrBDZDPjov2cbD3bOOJsI0fkKolKXasYPCqSys=",
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"rev": "403c09094a877e6c4816462d00b1a56ff8198e06",
|
||||
"rev": "672fa5fc5608d5cd82286a6f69aaf84a40b4fe41",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -553,11 +553,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1777944972,
|
||||
"narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
|
||||
"lastModified": 1782165805,
|
||||
"narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
|
||||
"rev": "56b24064fdcaedca53553b1a6d607fd23b613a24",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -575,11 +575,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1773932847,
|
||||
"narHash": "sha256-IklIAdlonrmO8/lkDxNIVz9+ORL4pcVotMTxeyvxzoc=",
|
||||
"lastModified": 1780762731,
|
||||
"narHash": "sha256-EuDaLnasWN0mpi995n+fAQQfPGBhqNW4fNjlQRpHt58=",
|
||||
"ref": "main",
|
||||
"rev": "0871a319f51d3cb0d1abb5b11edb768b39906d3f",
|
||||
"revCount": 104,
|
||||
"rev": "931bd2d63e285e767c8c81c103dda3c0a63f2965",
|
||||
"revCount": 108,
|
||||
"type": "git",
|
||||
"url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
|
||||
},
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
worblehat.url = "git+https://git.pvv.ntnu.no/Projects/worblehat.git?ref=main";
|
||||
worblehat.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
matrix-next.url = "github:dali99/nixos-matrix-modules/v0.8.0";
|
||||
matrix-next.url = "github:dali99/nixos-matrix-modules/master";
|
||||
matrix-next.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git?ref=main";
|
||||
@@ -35,7 +35,7 @@
|
||||
minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
|
||||
minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=8e5f2849ff7c9616100fe928261512a7ad647939";
|
||||
roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=71d2b72c34352a79dbee8ebf23ce64f39aead692";
|
||||
roowho2.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";
|
||||
|
||||
@@ -16,6 +16,7 @@
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/sda1";
|
||||
fsType = "btrfs";
|
||||
options = [ "relatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
|
||||
@@ -74,7 +74,7 @@ in {
|
||||
name = "psycopg2";
|
||||
args = {
|
||||
host = "/var/run/postgresql";
|
||||
dbname = "synapse";
|
||||
database = "synapse";
|
||||
user = "matrix-synapse";
|
||||
cp_min = 1;
|
||||
cp_max = 5;
|
||||
|
||||
@@ -43,7 +43,7 @@ in
|
||||
sshCommand = ''${pkgs.openssh}/bin/ssh -o UserKnownHostsFile='${knownHostsFile}' -i \"$CREDENTIALS_DIRECTORY\"/sshkey'';
|
||||
in [
|
||||
"${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.minecraftLogsDir}'"
|
||||
"${lib.getExe pkgs.rsync} ${rsyncArgs} --rsh=\"${sshCommand}\" root@innovation.pvv.ntnu.no:/ '${cfg.minecraftLogsDir}'/"
|
||||
"${lib.getExe pkgs.rsync} ${rsyncArgs} --rsh=\"${sshCommand}\" root@innovation.pvv.ntnu.no:. '${cfg.minecraftLogsDir}'/"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
@@ -127,4 +127,27 @@ in
|
||||
|
||||
networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
|
||||
networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
|
||||
|
||||
environment.systemPackages = [
|
||||
(pkgs.writeShellApplication {
|
||||
name = "postgres-update-collations.sh";
|
||||
runtimeInputs = [
|
||||
config.systemd.package
|
||||
cfg.package
|
||||
];
|
||||
text = ''
|
||||
run0 --user=postgres psql <${pkgs.writeText "postgres-update-collations.sql" ''
|
||||
CREATE FUNCTION exec(text) returns text language plpgsql volatile
|
||||
AS $f$
|
||||
BEGIN
|
||||
EXECUTE $1;
|
||||
RETURN $1;
|
||||
END;
|
||||
$f$;
|
||||
|
||||
SELECT exec('ALTER DATABASE "' || datname || '" REFRESH COLLATION VERSION') FROM pg_database WHERE datistemplate = false;
|
||||
''}
|
||||
'';
|
||||
})
|
||||
];
|
||||
}
|
||||
|
||||
@@ -16,6 +16,7 @@
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
|
||||
fsType = "ext4";
|
||||
options = [ "relatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
|
||||
@@ -16,6 +16,7 @@
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
|
||||
fsType = "ext4";
|
||||
options = [ "relatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
|
||||
@@ -28,6 +28,7 @@
|
||||
fileSystems."/" = {
|
||||
device = "/dev/mapper/pool-root";
|
||||
fsType = "ext4";
|
||||
options = [ "relatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
|
||||
@@ -93,7 +93,7 @@ in {
|
||||
no-group = true;
|
||||
rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
|
||||
};
|
||||
in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
|
||||
in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:. ${vanillaSurvival}";
|
||||
ExecStartPost = let
|
||||
rsyncArgs = lib.cli.toCommandLineShellGNU { } {
|
||||
archive = true;
|
||||
@@ -103,7 +103,7 @@ in {
|
||||
no-group = true;
|
||||
rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
|
||||
};
|
||||
in "${lib.getExe pkgs.rsync} ${rsyncArgs} --groupmap=root:nginx ${config.services.bluemap.webRoot}/ root@bekkalokk.pvv.ntnu.no:/";
|
||||
in "${lib.getExe pkgs.rsync} ${rsyncArgs} --groupmap=root:nginx ${config.services.bluemap.webRoot}/ root@bekkalokk.pvv.ntnu.no:.";
|
||||
LoadCredential = [
|
||||
"sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
|
||||
"ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"
|
||||
|
||||
@@ -2,10 +2,10 @@
|
||||
|
||||
{
|
||||
imports = [
|
||||
./gatus
|
||||
./grafana.nix
|
||||
./loki.nix
|
||||
./prometheus
|
||||
./scrutiny.nix
|
||||
./uptime-kuma.nix
|
||||
];
|
||||
}
|
||||
|
||||
@@ -0,0 +1,153 @@
|
||||
{ config, lib, ... }:
|
||||
let
|
||||
cfg = config.services.gatus;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./minecraft-checker.nix
|
||||
];
|
||||
|
||||
services.gatus = {
|
||||
enable = true;
|
||||
|
||||
settings = {
|
||||
web = {
|
||||
address = "127.0.0.1";
|
||||
port = 19283;
|
||||
};
|
||||
|
||||
storage = {
|
||||
type = "sqlite";
|
||||
path = "/var/lib/gatus/data.db";
|
||||
};
|
||||
|
||||
ui = {
|
||||
title = "PVV Nede!?";
|
||||
header = "😭😭😭";
|
||||
dashboard-heading = "PVV Nede!?";
|
||||
dashboard-subheading = "Kan noen ringe drift?";
|
||||
};
|
||||
|
||||
endpoints = let
|
||||
mkMachine = name: {
|
||||
inherit name;
|
||||
group = "Machines";
|
||||
url = "icmp://${name}.pvv.ntnu.no";
|
||||
conditions = [
|
||||
"[CONNECTED] == true"
|
||||
];
|
||||
};
|
||||
|
||||
mkWebsite = name: url: {
|
||||
inherit name url;
|
||||
group = "Websites";
|
||||
method = "GET";
|
||||
conditions = [
|
||||
"[STATUS] == 200"
|
||||
];
|
||||
};
|
||||
|
||||
mkService = name: url: {
|
||||
inherit name url;
|
||||
group = "Services";
|
||||
conditions = [
|
||||
"[CONNECTED] == true"
|
||||
];
|
||||
};
|
||||
in (lib.sortOn (m: m.name) [
|
||||
(mkMachine "bekkalokk")
|
||||
(mkMachine "bicep")
|
||||
(mkMachine "bikkje")
|
||||
(mkMachine "brzeczyszczykiewicz")
|
||||
(mkMachine "georg")
|
||||
(mkMachine "gluttony")
|
||||
(mkMachine "ildkule")
|
||||
(mkMachine "kommode")
|
||||
(mkMachine "lupine-1")
|
||||
(mkMachine "lupine-2")
|
||||
(mkMachine "lupine-3")
|
||||
(mkMachine "lupine-4")
|
||||
(mkMachine "lupine-5")
|
||||
(mkMachine "skrot")
|
||||
(mkMachine "temmie")
|
||||
(mkMachine "wenche")
|
||||
|
||||
(mkMachine "balduzius")
|
||||
(mkMachine "blossom")
|
||||
(mkMachine "bubbles")
|
||||
(mkMachine "buskerud")
|
||||
(mkMachine "buttercup")
|
||||
(mkMachine "demiurgen")
|
||||
(mkMachine "drolsum")
|
||||
(mkMachine "hildring")
|
||||
(mkMachine "innovation")
|
||||
(mkMachine "isvegg")
|
||||
(mkMachine "knutsen")
|
||||
(mkMachine "ludvigsen" // {
|
||||
url = "icmp://ludvigsen-tap.pvv.ntnu.no";
|
||||
})
|
||||
(mkMachine "microbel")
|
||||
(mkMachine "mirage")
|
||||
(mkMachine "orchid")
|
||||
(mkMachine "principal")
|
||||
(mkMachine "sleipner")
|
||||
(mkMachine "smask")
|
||||
(mkMachine "tom")
|
||||
(mkMachine "wegonke")
|
||||
]) ++ [
|
||||
(mkWebsite "Bluemap" "https://minecraft.pvv.ntnu.no")
|
||||
(mkWebsite "Element Web" "https://chat.pvv.ntnu.no")
|
||||
(mkWebsite "Gitea" "https://git.pvv.ntnu.no/api/healthz" // {
|
||||
conditions = [
|
||||
"[STATUS] == 200"
|
||||
"[BODY].status == pass"
|
||||
];
|
||||
})
|
||||
(mkWebsite "Grafana" "https://grafana.pvv.ntnu.no/api/health" // {
|
||||
conditions = [
|
||||
"[STATUS] == 200"
|
||||
"[BODY].database == ok"
|
||||
];
|
||||
})
|
||||
(mkWebsite "Grzegorz - Brzeczyszczykiewicz" "https://brzeczyszczykiewicz.pvv.ntnu.no")
|
||||
(mkWebsite "Grzegorz - Georg" "https://georg.pvv.ntnu.no")
|
||||
(mkWebsite "IDP" "https://idp.pvv.ntnu.no")
|
||||
(mkWebsite "Mailing Lists" "http://list.pvv.ntnu.no")
|
||||
(mkWebsite "Mapcrafter" "http://isvegg.pvv.ntnu.no/kart")
|
||||
(mkWebsite "PVV-Nettsiden" "https://www.pvv.ntnu.no")
|
||||
(mkWebsite "Roundcube" "https://webmail.pvv.ntnu.no/roundcube")
|
||||
(mkWebsite "Scrutiny" "https://scrutiny.pvv.ntnu.no")
|
||||
(mkWebsite "Snappymail" "http://snappymail.pvv.ntnu.no")
|
||||
(mkWebsite "Userweb - Temmie" "https://temmie.pvv.ntnu.no/~oysteikt")
|
||||
(mkWebsite "Userweb - Tom" "https://www.pvv.ntnu.no/~oysteikt")
|
||||
(mkWebsite "Vaultwarden" "https://pw.pvv.ntnu.no/alive")
|
||||
(mkWebsite "Wiki" "https://wiki.pvv.ntnu.no/w/api.php?action=query&format=json")
|
||||
|
||||
(mkService "Gitea SSH" "ssh://git.pvv.ntnu.no:2222")
|
||||
(mkService "QoTD" "tcp://bekkalokk.pvv.ntnu.no:17")
|
||||
(mkService "Minecraft" "http://localhost:25565" // {
|
||||
conditions = [
|
||||
"[STATUS] == 200"
|
||||
"[BODY].ok == true"
|
||||
];
|
||||
})
|
||||
(mkService "Email (SMTP)" "tcp://mail.pvv.ntnu.no:587")
|
||||
(mkService "Email (POP3)" "tcp://mail.pvv.ntnu.no:995")
|
||||
(mkService "Email (IMAP)" "tcp://mail.pvv.ntnu.no:993")
|
||||
(mkService "Matrix Synapse" "https://matrix.pvv.ntnu.no/_matrix/client/versions" // {
|
||||
method = "GET";
|
||||
conditions = [
|
||||
"[STATUS] == 200"
|
||||
];
|
||||
})
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."status.pvv.ntnu.no" = lib.mkIf cfg.enable {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
kTLS = true;
|
||||
locations."/".proxyPass = "http://localhost:${toString cfg.settings.web.port}";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,79 @@
|
||||
{ lib, pkgs, ... }:
|
||||
{
|
||||
systemd.sockets."gatus-minecraft-checker" = {
|
||||
wantedBy = [ "sockets.target" ];
|
||||
listenStreams = [ "25565" ];
|
||||
socketConfig = {
|
||||
SocketMode = "0666";
|
||||
Accept = false;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."gatus-minecraft-checker" = {
|
||||
serviceConfig = {
|
||||
ExecStart = lib.getExe (pkgs.writers.writePython3Bin "gatus-minecraft-checker" {
|
||||
libraries = with pkgs.python3Packages; [
|
||||
# sdnotify
|
||||
mcstatus
|
||||
];
|
||||
flakeIgnore = [ "E501" "E704" ];
|
||||
} ''
|
||||
import socket
|
||||
import json
|
||||
from http.server import HTTPServer, BaseHTTPRequestHandler
|
||||
|
||||
from mcstatus import JavaServer
|
||||
|
||||
|
||||
class Handler(BaseHTTPRequestHandler):
|
||||
def do_GET(self):
|
||||
try:
|
||||
mcserver = JavaServer.lookup("minecraft.pvv.ntnu.no")
|
||||
status = mcserver.status()
|
||||
|
||||
body = {
|
||||
"ok": True,
|
||||
"players": status.players.online,
|
||||
"version": status.version.name,
|
||||
"latency": status.latency,
|
||||
}
|
||||
|
||||
data = json.dumps(body).encode()
|
||||
|
||||
self.send_response(200)
|
||||
self.send_header("Content-Type", "application/json")
|
||||
self.send_header("Content-Length", str(len(data)))
|
||||
self.end_headers()
|
||||
self.wfile.write(data)
|
||||
|
||||
except Exception as e:
|
||||
data = json.dumps({"ok": False, "error": str(e)}).encode()
|
||||
self.send_response(500)
|
||||
self.end_headers()
|
||||
self.wfile.write(data)
|
||||
|
||||
|
||||
class NoBindHTTPServer(HTTPServer):
|
||||
def server_bind(): pass
|
||||
def server_activate(): pass
|
||||
|
||||
|
||||
def main():
|
||||
httpd = NoBindHTTPServer(
|
||||
("", 0),
|
||||
Handler,
|
||||
bind_and_activate=False,
|
||||
)
|
||||
httpd.socket = socket.fromfd(3, socket.AF_INET, socket.SOCK_STREAM)
|
||||
httpd.serve_forever()
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
'');
|
||||
|
||||
NoNewPrivileges = true;
|
||||
PrivateTmp = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, pkgs, ... }:
|
||||
{ config, pkgs, values, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.loki;
|
||||
@@ -9,8 +9,8 @@ in {
|
||||
configuration = {
|
||||
auth_enabled = false;
|
||||
server = {
|
||||
http_listen_port = 3100;
|
||||
http_listen_address = "0.0.0.0";
|
||||
http_listen_port = 31832;
|
||||
http_listen_address = "127.0.0.1";
|
||||
grpc_listen_port = 9096;
|
||||
};
|
||||
|
||||
@@ -81,5 +81,25 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ cfg.configuration.server.http_listen_port ];
|
||||
services.nginx.virtualHosts."loki.pvv.ntnu.no" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
kTLS = true;
|
||||
|
||||
locations = {
|
||||
"/".return = "403";
|
||||
"/loki/api/v1/push" = {
|
||||
proxyPass = "http://${cfg.configuration.server.http_listen_address}:${toString cfg.configuration.server.http_listen_port}/loki/api/v1/push";
|
||||
extraConfig = ''
|
||||
allow 127.0.0.1;
|
||||
allow ::1;
|
||||
allow ${values.ipv4-space};
|
||||
allow ${values.ipv6-space};
|
||||
allow ${values.ntnu.ipv4-space};
|
||||
allow ${values.ntnu.ipv6-space};
|
||||
deny all;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,44 +0,0 @@
|
||||
{ config, pkgs, lib, values, ... }:
|
||||
let
|
||||
cfg = config.services.uptime-kuma;
|
||||
domain = "status.pvv.ntnu.no";
|
||||
stateDir = "/data/monitoring/uptime-kuma";
|
||||
in {
|
||||
services.uptime-kuma = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PORT = "5059";
|
||||
HOST = "127.0.1.2";
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts.${domain} = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
kTLS = true;
|
||||
locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/private/uptime-kuma" = {
|
||||
device = stateDir;
|
||||
fsType = "bind";
|
||||
options = [ "bind" ];
|
||||
};
|
||||
|
||||
services.rsync-pull-targets = {
|
||||
enable = true;
|
||||
locations.${stateDir} = {
|
||||
user = "root";
|
||||
rrsyncArgs.ro = true;
|
||||
authorizedKeysAttrs = [
|
||||
"restrict"
|
||||
"from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
|
||||
"no-agent-forwarding"
|
||||
"no-port-forwarding"
|
||||
"no-pty"
|
||||
"no-X11-forwarding"
|
||||
];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXzcDm6cVr4NmWzUSroy33FlielKqaG83wY0RCMC0p/ uptime_kuma rsync backup";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -48,6 +48,7 @@
|
||||
|
||||
# swap.swapfile.size = "4G";
|
||||
mountpoint = "/";
|
||||
mountOptions = [ "relatime" ];
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
@@ -136,7 +136,7 @@ in {
|
||||
picture = {
|
||||
AVATAR_MAX_FILE_SIZE = 1024 * 1024 * 5;
|
||||
# NOTE: go any bigger than this, and gitea will freeze your gif >:(
|
||||
AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 2;
|
||||
AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 4;
|
||||
};
|
||||
actions.ENABLED = true;
|
||||
webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," [
|
||||
|
||||
@@ -5,6 +5,8 @@
|
||||
|
||||
(fp /base)
|
||||
./services/gitea-runner.nix
|
||||
] ++ lib.optionals (lupineName == "lupine-5") [
|
||||
./services/openvpn.nix
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = fp /secrets/lupine/lupine.yaml;
|
||||
@@ -15,14 +17,61 @@
|
||||
"i686-linux"
|
||||
];
|
||||
|
||||
systemd.network.networks."30-enp0s31f6" = values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "enp0s31f6";
|
||||
address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||
networkConfig.LLDP = false;
|
||||
};
|
||||
systemd.network.wait-online = {
|
||||
anyInterface = true;
|
||||
};
|
||||
systemd.network = if (lupineName != "lupine-5")
|
||||
then {
|
||||
networks."30-enp0s31f6" = (values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "enp0s31f6";
|
||||
address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||
networkConfig.LLDP = false;
|
||||
});
|
||||
|
||||
wait-online = {
|
||||
anyInterface = true;
|
||||
};
|
||||
}
|
||||
else {
|
||||
netdevs."10-br0".netdevConfig = {
|
||||
Name = "br0";
|
||||
Kind = "bridge";
|
||||
};
|
||||
|
||||
netdevs."20-tap0".netdevConfig = {
|
||||
Name = "tap0";
|
||||
Kind = "tap";
|
||||
};
|
||||
|
||||
networks."10-enp0s31f6" = {
|
||||
matchConfig.Name = "enp0s31f6";
|
||||
bridge = [ "br0" ];
|
||||
};
|
||||
|
||||
networks."20-br0" = {
|
||||
matchConfig.Name = "br0";
|
||||
|
||||
address = with values.hosts.${lupineName}; [
|
||||
(ipv4 + "/25")
|
||||
(ipv6 + "/64")
|
||||
values.services.knutsen-vpn
|
||||
];
|
||||
networkConfig.LLDP = false;
|
||||
|
||||
dns = ["129.241.0.200" "129.241.0.201" "2001:700:300:1900::200" "2001:700:300:1900::201"];
|
||||
domains = ["pvv.ntnu.no" "pvv.org"];
|
||||
gateway = [values.hosts.gateway values.hosts.gateway6];
|
||||
|
||||
networkConfig.IPv6AcceptRA = "no";
|
||||
DHCP = "no";
|
||||
};
|
||||
|
||||
networks."30-tap0" = {
|
||||
matchConfig.Name = "tap0";
|
||||
bridge = [ "br0" ];
|
||||
};
|
||||
|
||||
wait-online = {
|
||||
anyInterface = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Don't change (even during upgrades) unless you know what you are doing.
|
||||
# See https://search.nixos.org/options?show=system.stateVersion
|
||||
|
||||
@@ -0,0 +1,101 @@
|
||||
{ config, pkgs, lib, values, ... }:
|
||||
let
|
||||
renderConfig = attrs: lib.pipe attrs [
|
||||
(lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
|
||||
(builtins.mapAttrs (_: value:
|
||||
if builtins.isList value then builtins.concatStringsSep " " (map toString value)
|
||||
else if value == true then value
|
||||
else if builtins.any (f: f value) [
|
||||
builtins.isString
|
||||
builtins.isInt
|
||||
builtins.isFloat
|
||||
lib.isPath
|
||||
lib.isDerivation
|
||||
] then toString value
|
||||
else throw "Unknown value in lupine openvpn config:\n${value}"
|
||||
))
|
||||
(lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
|
||||
(builtins.concatStringsSep "\n")
|
||||
(x: x + "\n\n")
|
||||
];
|
||||
in
|
||||
{
|
||||
sops.secrets = {
|
||||
"openvpn/ca/crt" = { };
|
||||
"openvpn/server/crt" = { };
|
||||
"openvpn/server/key" = { };
|
||||
};
|
||||
|
||||
services.openvpn.servers."ov-tunnel" = {
|
||||
config = renderConfig {
|
||||
mode = "server";
|
||||
|
||||
# TODO: use aliases
|
||||
local = "0.0.0.0";
|
||||
port = 1194;
|
||||
proto = "udp";
|
||||
|
||||
dev = "tap0";
|
||||
dev-type = "tap";
|
||||
|
||||
script-security = 0;
|
||||
|
||||
ca = config.sops.secrets."openvpn/ca/crt".path;
|
||||
cert = config.sops.secrets."openvpn/server/crt".path;
|
||||
key = config.sops.secrets."openvpn/server/key".path;
|
||||
dh = "none";
|
||||
|
||||
# Maintain a record of client <-> virtual IP address
|
||||
# associations in this file. If OpenVPN goes down or
|
||||
# is restarted, reconnecting clients can be assigned
|
||||
# the same virtual IP address from the pool that was
|
||||
# previously assigned.
|
||||
|
||||
# ifconfig-pool-persist = ./ipp.txt;
|
||||
|
||||
server-bridge = builtins.concatStringsSep " " [
|
||||
# Gateway
|
||||
"129.241.210.129"
|
||||
# Netmask
|
||||
"255.255.255.128"
|
||||
# Pool start
|
||||
values.services.knutsen-tap
|
||||
# Pool end
|
||||
values.services.ludvigsen-tap
|
||||
];
|
||||
|
||||
keepalive = "10 120";
|
||||
|
||||
user = "nobody";
|
||||
group = "nobody";
|
||||
|
||||
status = "/var/log/openvpn-status.log";
|
||||
|
||||
client-config-dir = pkgs.writeTextDir "ludvigsen" ''
|
||||
# Sett IP-adr. for tap0 til ludvigsens PVV-addresse.
|
||||
ifconfig-push ${values.services.ludvigsen-tap} 255.255.255.128
|
||||
|
||||
# Hvordan skal man faa dette til aa funke, tro?
|
||||
# ifconfig-ipv6-push 2001:700:300:1900::xxx/64
|
||||
|
||||
# La ludvigsen bruke std. PVV-gateway til all trafikk (unntatt VPN-tunnellen).
|
||||
push "redirect-gateway"
|
||||
'';
|
||||
|
||||
persist-key = true;
|
||||
persist-tun = true;
|
||||
|
||||
tls-version-min = "1.2";
|
||||
tls-version-max = "1.2";
|
||||
|
||||
verb = 5;
|
||||
|
||||
explicit-exit-notify = 1;
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
allowedTCPPorts = [ 1194 ];
|
||||
allowedUDPPorts = [ 1194 ];
|
||||
};
|
||||
}
|
||||
@@ -16,6 +16,7 @@
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/224c45db-9fdc-45d4-b3ad-aaf20b3efa8a";
|
||||
fsType = "ext4";
|
||||
options = [ "relatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
|
||||
@@ -31,6 +31,7 @@
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/";
|
||||
mountOptions = [ "relatime" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -16,6 +16,7 @@
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/c3aed415-0054-4ac5-8d29-75a99cc26451";
|
||||
fsType = "btrfs";
|
||||
options = [ "relatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
|
||||
@@ -13,6 +13,7 @@
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/4e8ecdd2-d453-4fff-b952-f06da00f3b85";
|
||||
fsType = "ext4";
|
||||
options = [ "relatime" ];
|
||||
};
|
||||
|
||||
swapDevices = [ {
|
||||
|
||||
+35
-25
File diff suppressed because one or more lines are too long
@@ -26,6 +26,10 @@ in rec {
|
||||
ipv4 = pvv-ipv4 213;
|
||||
ipv6 = pvv-ipv6 213;
|
||||
};
|
||||
|
||||
knutsen-vpn = pvv-ipv4 191;
|
||||
knutsen-tap = pvv-ipv4 253;
|
||||
ludvigsen-tap = pvv-ipv4 254;
|
||||
};
|
||||
|
||||
hosts = {
|
||||
|
||||
Reference in New Issue
Block a user