feat: add initialdeploy hashed password to root

Co-authored-by: Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>

base/default.nix

@@ -101,6 +101,8 @@
 
   # users.mutableUsers = lib.mkDefault false;
 
+  users.users.root.initialHashedPassword = "$y$j9T$ahP6GAdttD17OMBo7Yqeh.$Ad7qBcFvTL7HrJ9uTtrQzksN3220Nj9t/CrP6DwgK34"; # generated using mkpasswd, see huttiheita root on vaultwarden
+
   users.groups."drift".name = "drift";
 
   # Trusted users on the nix builder machines

base/services/acme.nix

@@ -8,6 +8,5 @@
   # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
   virtualisation.vmVariant = {
     security.acme.defaults.server = "https://127.0.0.1";
-    users.users.root.initialPassword = "root";
   };
 }

base/services/fluentbit.nix

@@ -62,8 +62,10 @@ in
           name = "loki";
           match = "*";
 
-          host = "ildkule.pvv.ntnu.no";
+          host = "loki.pvv.ntnu.no";
-          port = 3100;
+          port = 443;
+          tls = "on";
+          "tls.verify" = "on";
           uri = "/loki/api/v1/push";
           compress = "gzip";
 

hosts/bicep/services/postgresql/default.nix

@@ -127,4 +127,27 @@ in
 
   networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
   networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
+
+  environment.systemPackages = [
+    (pkgs.writeShellApplication {
+      name = "postgres-update-collations.sh";
+      runtimeInputs = [
+        config.systemd.package
+        cfg.package
+      ];
+      text = ''
+        run0 --user=postgres psql <${pkgs.writeText "postgres-update-collations.sql" ''
+          CREATE FUNCTION exec(text) returns text language plpgsql volatile
+            AS $f$
+              BEGIN
+                EXECUTE $1;
+                RETURN $1;
+              END;
+          $f$;
+
+          SELECT exec('ALTER DATABASE "' || datname || '" REFRESH COLLATION VERSION') FROM pg_database WHERE datistemplate = false;
+        ''}
+      '';
+    })
+  ];
 }

hosts/ildkule/services/monitoring/loki.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, values, ... }:
 
 let
   cfg = config.services.loki;
@@ -9,8 +9,8 @@ in {
     configuration = {
       auth_enabled = false;
       server = {
-        http_listen_port = 3100;
+        http_listen_port = 31832;
-        http_listen_address = "0.0.0.0";
+        http_listen_address = "127.0.0.1";
         grpc_listen_port = 9096;
       };
 
@@ -81,5 +81,25 @@ in {
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ cfg.configuration.server.http_listen_port ];
+  services.nginx.virtualHosts."loki.pvv.ntnu.no" = {
+    forceSSL = true;
+    enableACME = true;
+    kTLS = true;
+
+    locations = {
+      "/".return = "403";
+      "/loki/api/v1/push" = {
+        proxyPass = "http://${cfg.configuration.server.http_listen_address}:${toString cfg.configuration.server.http_listen_port}/loki/api/v1/push";
+        extraConfig = ''
+          allow 127.0.0.1;
+          allow ::1;
+          allow ${values.ipv4-space};
+          allow ${values.ipv6-space};
+          allow ${values.ntnu.ipv4-space};
+          allow ${values.ntnu.ipv6-space};
+          deny all;
+        '';
+      };
+    };
+  };
 }

hosts/temmie/services/nfs-mounts.nix

@@ -88,9 +88,8 @@ in
           [[ -d "$dir" ]] || continue
 
           uid="$(stat -c '%u' "$dir")"
-          username="$(basename "$dir")"
 
-          mountpoint="/run/pvvhome/by-uid/$uid/$1/$username"
+          mountpoint="/run/pvvhome/by-uid/$uid"
           mkdir -p "$mountpoint"
 
           unit_name=$(systemd-escape --path --suffix=mount "$mountpoint")

hosts/temmie/services/userweb/default.nix

@@ -1,6 +1,5 @@
 {
   imports = [
-    ./fcgiwrap.nix
     ./httpd.nix
     ./log-processor.nix
     ./mail.nix

hosts/temmie/services/userweb/fcgiwrap.nix

@@ -1,85 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  mcfg = config.services.pvv-userweb;
-in
-{
-  config = lib.mkIf mcfg.enable {
-    systemd.slices.system-userweb-fcgiwrap = { };
-
-    # NOTE: expected %i here is the UID of the user
-    systemd.sockets."userweb-fcgiwrap@" = {
-      description = "UserWeb fcgiwrap server for user %i";
-      socketConfig = {
-        ListenStream = "/run/userweb-fcgiwrap/%i.sock";
-        RemoveOnStop = true;
-
-        SocketUser = "wwwrun";
-        SocketGroup = "wwwrun";
-        SocketMode = "0660";
-      };
-    };
-
-    systemd.services."userweb-fcgiwrap@" = {
-      after = [
-        "httpd-passwd-sync.service"
-      ];
-      requires = [
-        "httpd-passwd-sync.service"
-      ];
-      documentation = [ "man:fcgiwrap(8)" ];
-
-      unitConfig = {
-        AssertPathExists = "/run/pvvhome/by-uid/%i";
-      };
-
-      serviceConfig = {
-
-        Slice = "system-userweb-fcgiwrap.slice";
-        Type = "simple";
-        User = "%i";
-
-        ExecStart = "${lib.getExe pkgs.fcgiwrap}";
-
-        RuntimeDirectoryMode = "0750";
-        RuntimeDirectory = [
-          "fcgiwrap/%i/root-mnt"
-        ];
-        RootDirectory = "/run/fcgiwrap/%i/root-mnt";
-        MountAPIVFS = true;
-        BindReadOnlyPaths = [
-          builtins.storeDir
-          "/etc"
-
-          # TODO: set up minimal fake passwd + group in `ExecStartPre` instead
-          "/var/lib/httpd-passwd-sync/passwd:/etc/passwd"
-          "/var/lib/httpd-passwd-sync/group:/etc/group"
-
-          "${pkgs.writeText "userweb-fake-nsswitch.conf" ''
-            passwd:    files
-            group:     files
-            shadow:    files
-            sudoers:   files
-
-            hosts:     mymachines resolve [!UNAVAIL=return] files myhostname dns
-            networks:  files
-
-            ethers:    files
-            services:  files
-            protocols: files
-            rpc:       files
-
-            subuid:    files
-            subgid:    files
-          ''}:/etc/nsswitch.conf"
-        ] ++ lib.optionals mcfg.debugMode [
-          "/bin"
-        ] ++ mcfg.fhsBindPaths;
-
-        # TODO: handle /amd/homepvv${l}
-        BindPaths = [
-          "/run/pvvhome/by-uid/%i:/home/pvv"
-        ];
-      };
-    };
-  };
-}

hosts/temmie/services/userweb/httpd.nix

@@ -277,7 +277,30 @@ in
         "/dev/null"
         "/var/lib/acme"
         "/var/run/nscd"
-      ] ++ mcfg.fhsBindPaths;
+        "${mcfg.fhsEnv}/bin:/bin"
+        "${mcfg.fhsEnv}/sbin:/sbin"
+        "${mcfg.fhsEnv}/lib:/lib"
+        "${mcfg.fhsEnv}/share:/share"
+      ] ++ (lib.mapCartesianProduct ({ parent, child }: "${mcfg.fhsEnv}${child}:${parent}${child}") {
+        parent = [
+          "/local"
+          "/opt"
+          "/opt/local"
+          "/store"
+          "/store/gnu"
+          "/usr"
+          "/usr/local"
+          "/run/current-system/sw"
+        ];
+        child = [
+          "/bin"
+          "/sbin"
+          "/lib"
+          "/libexec"
+          "/include"
+          "/share"
+        ];
+      });
       BindPaths = (lib.mapCartesianProduct ({ directoryFn, letter }: "/run/pvvhome/${letter}:${directoryFn letter}${letter}") {
         directoryFn = [
           (_: "/home/pvv/")

hosts/temmie/services/userweb/module.nix

@@ -106,36 +106,6 @@ in
         ];
       };
     };
-
-    fhsBindPaths = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      readOnly = true;
-      default = [
-        "${cfg.fhsEnv}/bin:/bin"
-        "${cfg.fhsEnv}/sbin:/sbin"
-        "${cfg.fhsEnv}/lib:/lib"
-        "${cfg.fhsEnv}/share:/share"
-      ] ++ (lib.mapCartesianProduct ({ parent, child }: "${cfg.fhsEnv}${child}:${parent}${child}") {
-        parent = [
-          "/local"
-          "/opt"
-          "/opt/local"
-          "/store"
-          "/store/gnu"
-          "/usr"
-          "/usr/local"
-          "/run/current-system/sw"
-        ];
-        child = [
-          "/bin"
-          "/sbin"
-          "/lib"
-          "/libexec"
-          "/include"
-          "/share"
-        ];
-      });
-    };
   };
 
   config = lib.mkIf cfg.enable {