WIP: base/nginx: host well-known content on multiple subdomains

Co-authored-by: Øystein Kristoffer Tveit <oysteikt@pvv.ntnu.no>

base/default.nix

@@ -101,6 +101,8 @@
 
   # users.mutableUsers = lib.mkDefault false;
 
+  users.users.root.initialHashedPassword = "$y$j9T$ahP6GAdttD17OMBo7Yqeh.$Ad7qBcFvTL7HrJ9uTtrQzksN3220Nj9t/CrP6DwgK34"; # generated using mkpasswd, see huttiheita root on vaultwarden
+
   users.groups."drift".name = "drift";
 
   # Trusted users on the nix builder machines

base/services/acme.nix

@@ -8,6 +8,5 @@
   # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
   virtualisation.vmVariant = {
     security.acme.defaults.server = "https://127.0.0.1";
-    users.users.root.initialPassword = "root";
   };
 }

base/services/fluentbit.nix

@@ -62,8 +62,10 @@ in
           name = "loki";
           match = "*";
 
-          host = "ildkule.pvv.ntnu.no";
+          host = "loki.pvv.ntnu.no";
-          port = 3100;
+          port = 443;
+          tls = "on";
+          "tls.verify" = "on";
           uri = "/loki/api/v1/push";
           compress = "gzip";
 

base/services/irqbalance.nix

@@ -1,4 +1,22 @@
-{ ... }:
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.irqbalance;
+in
 {
   services.irqbalance.enable = true;
-}
+
+  # irqbalance only has meaningful work to do on multi-socket machines, so
+  # skip starting it pointlessly everywhere else.
+  systemd.services.irqbalance.serviceConfig.ExecCondition = let
+    isMultiSocket = pkgs.writeShellApplication {
+      name = "irqbalance-is-multi-socket";
+      runtimeInputs = [ pkgs.coreutils ];
+      text = ''
+        sockets=$(cat /sys/devices/system/cpu/cpu*/topology/physical_package_id | sort -u | wc -l)
+        [ "$sockets" -gt 1 ]
+      '';
+    };
+  in lib.mkIf cfg.enable [
+    (lib.getExe isMultiSocket)
+  ];
+}

flake.lock

@@ -24,11 +24,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1776635034,
+        "lastModified": 1784407669,
-        "narHash": "sha256-OEOJrT3ZfwbChzODfIH4GzlNTtOFuZFWPtW7jIeR8xU=",
+        "narHash": "sha256-gcFMcRjw0ZSn380Rx2QLlU1goUQeSrKX/DF12omI6+o=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "dc7496d8ea6e526b1254b55d09b966e94673750f",
+        "rev": "1316b7d278ad77a16aec024b71d971366e123bec",
         "type": "github"
       },
       "original": {
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771267058,
+        "lastModified": 1784367836,
-        "narHash": "sha256-EEL4SmD1b3BPJPsSJJ4wDTXWMumJqbR+BLzhJJG0skE=",
+        "narHash": "sha256-yeWTb3KNvHY/InqbVmIjQRH5BI4d2HFbQqWi2eRKiv0=",
         "ref": "main",
-        "rev": "e3962d02c78b9c7b4d18148d931a9a4bf22e7902",
+        "rev": "422f383fd8736d60cd2fe818168b93d07f013865",
-        "revCount": 254,
+        "revCount": 259,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/dibbler.git"
       },
@@ -104,11 +104,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777067150,
+        "lastModified": 1784553797,
-        "narHash": "sha256-vqPz8jCS1zTQlvmgctUFpvnr6f9ISR5h7CPG/HgQvf0=",
+        "narHash": "sha256-buGdmnsKNRDUNsb+aXGeUc/UjGGsMbH1KWy3xnheInA=",
         "ref": "main",
-        "rev": "b452a854fb78d6df9fe062b45e23a968657d115d",
+        "rev": "c3101eb7424d4b15665bd00624220ec411187797",
-        "revCount": 35,
+        "revCount": 36,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Grzegorz/gergle.git"
       },
@@ -126,11 +126,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1777019032,
+        "lastModified": 1784553736,
-        "narHash": "sha256-29lw7THThWb5DW01rVRj1b816Apwz/P4m2wVWaSIadU=",
+        "narHash": "sha256-W1pPlTHmp+EvONwf8Qa5NvCiuyV4LC/yNDdc27RSpuA=",
         "ref": "main",
-        "rev": "55262afca46c96f75a834d4e00e30d5fb20affb6",
+        "rev": "e06daaef1f48160254c202c59b060ac6f1da9f38",
-        "revCount": 61,
+        "revCount": 62,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
       },
@@ -169,11 +169,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769338528,
+        "lastModified": 1780178524,
-        "narHash": "sha256-t18ZoSt9kaI1yde26ok5s7aFLkap1Q9+/2icVh2zuaE=",
+        "narHash": "sha256-2PcNyNqbGCWBpAMdCU1HxSQmhQiG6evdjxVnPA7w5bQ=",
         "ref": "refs/heads/main",
-        "rev": "7218348163fd8d84df4a6f682c634793e67a3fed",
+        "rev": "2406de41ce9d0a1404cbf4e55537e3f720f37f23",
-        "revCount": 13,
+        "revCount": 15,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/libdib.git"
       },
@@ -189,16 +189,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1764844095,
+        "lastModified": 1782122067,
-        "narHash": "sha256-Drf1orxsmFDzO+UbPo85gHjXW7QzAM+6oTPvI7vOSik=",
+        "narHash": "sha256-95q3DiYOTHjQGbqR0I1w4ETrH+smtddqW0bBxaB/Egg=",
         "owner": "dali99",
         "repo": "nixos-matrix-modules",
-        "rev": "25b9f31ef1dbc3987b4c716de716239f2b283701",
+        "rev": "0e0fd9f6a407b08dd5e180a2ff6c3808461e2c47",
         "type": "github"
       },
       "original": {
         "owner": "dali99",
-        "ref": "v0.8.0",
+        "ref": "master",
         "repo": "nixos-matrix-modules",
         "type": "github"
       }
@@ -211,11 +211,11 @@
         "rust-overlay": "rust-overlay_3"
       },
       "locked": {
-        "lastModified": 1767906976,
+        "lastModified": 1784554105,
-        "narHash": "sha256-igCg8I83eO+noF00raXVJqDxzLS2SrZN8fK5bnvO+xI=",
+        "narHash": "sha256-lgtCXgYCf0ljf14H7K7ngxnUc30FwcHMJlDZx+7Nt8s=",
         "ref": "main",
-        "rev": "626bc9b6bae6a997b347cdbe84080240884f2955",
+        "rev": "cbd5b7318239303e19e8a7a407699ed85cc25d94",
-        "revCount": 17,
+        "revCount": 18,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git"
       },
@@ -232,11 +232,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769500363,
+        "lastModified": 1784554069,
-        "narHash": "sha256-vFxmdsLBPdTy5j2bf54gbTQi1XnWbZDmeR/BBh8MFrw=",
+        "narHash": "sha256-5UNUBVAAMEvLanAyOgm6yGZgKJoTAZ2gXavKbMH+6OA=",
         "ref": "main",
-        "rev": "2618e434e40e109eaab6a0693313c7e0de7324a3",
+        "rev": "62ffa4f7de826ced2c2a8ad787695118589450bb",
-        "revCount": 47,
+        "revCount": 48,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/minecraft-kartverket.git"
       },
@@ -275,11 +275,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778407980,
+        "lastModified": 1782153600,
-        "narHash": "sha256-r980BhsReZQe6FkmyNZkwCZpvzARo5jZgTl8HxjAssY=",
+        "narHash": "sha256-Vbkgl7/x8+Gg0gMe94EStfIfNC4bHQIbaZrIAxpuQ/w=",
         "owner": "oddlama",
         "repo": "nix-topology",
-        "rev": "ca0a602f650306d00d6f3e3c76d0f4c48a5c5adc",
+        "rev": "e61876f548e4f301d63640d30ecc1305c05c3986",
         "type": "github"
       },
       "original": {
@@ -291,11 +291,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1779622335,
+        "lastModified": 1784526640,
-        "narHash": "sha256-06G98ieM6l+OI7EMhlvchgDBDn+DvIWCNj40LDhKpmc=",
+        "narHash": "sha256-UDnuu3uM64qjfVvsGSislJgP1j15FiFiDiKOjbGTv9Q=",
-        "rev": "705e9929918b43bd7b715dc0a878ac870449bb03",
+        "rev": "036c2421db75172aeef4bb83921988891d4773c9",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05beta1.705e9929918b/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05-small/nixos-26.05.5692.036c2421db75/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -319,11 +319,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1778586796,
+        "lastModified": 1784536202,
-        "narHash": "sha256-XmDljcG4x8slQDlsWOc77pCA1YVuYn8JGumkYlhfTxI=",
+        "narHash": "sha256-7CmHmK10lEXBgymS0DeYj4/4STLpzRWCc/5BfoIxHQo=",
-        "rev": "b25e938b89759b5f9466fc53c4a970244f84dc39",
+        "rev": "94f12be79cb7f961726a0157b4168bc722befeac",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.05pre996582.b25e938b8975/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.11pre1037880.94f12be79cb7/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -358,11 +358,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779774845,
+        "lastModified": 1784554034,
-        "narHash": "sha256-QJU1J4eupwjRrtvWGzRut0GY3woql92RS9O/acWkJkk=",
+        "narHash": "sha256-NbL+1ju1j53MqsjUCAFWgpVp3IXo2lLET1OoDdxc18Q=",
         "ref": "main",
-        "rev": "13667cd216db260ab549e6f1b6281aa230d2f9e0",
+        "rev": "a7cbd30941ee0430f6a626e7dc38b5358dcc8a2a",
-        "revCount": 29,
+        "revCount": 30,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
       },
@@ -379,11 +379,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781362709,
+        "lastModified": 1782759909,
-        "narHash": "sha256-zTzLvvtRdOKKcQMWydoZuduj9fwwkYRfB1RBzKegwHM=",
+        "narHash": "sha256-gktjBeZyoRvVBkm2cO1tD99fdQ34iUDyB6iecRdorm4=",
         "ref": "main",
-        "rev": "5fb08a462263e5a8d742ecd93e559e534d5c3af2",
+        "rev": "ad6c79fb713884a4a2df8aab30914cd0c1c2e6cb",
-        "revCount": 586,
+        "revCount": 587,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       },
@@ -447,17 +447,17 @@
         "rust-overlay": "rust-overlay_4"
       },
       "locked": {
-        "lastModified": 1778600367,
+        "lastModified": 1784550731,
-        "narHash": "sha256-YB0b2xUf4D8792D5Ay//7C3AjHyv+9yoy8K1mTe+wvE=",
+        "narHash": "sha256-KDrBGT98fQWlnEBmTvIijPq4n4sVLcETBu8EuL486SM=",
         "ref": "main",
-        "rev": "8e5f2849ff7c9616100fe928261512a7ad647939",
+        "rev": "c0c0e47c8a45673c62462cadf38a489b72fd39ec",
-        "revCount": 91,
+        "revCount": 112,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
       },
       "original": {
         "ref": "main",
-        "rev": "8e5f2849ff7c9616100fe928261512a7ad647939",
+        "rev": "c0c0e47c8a45673c62462cadf38a489b72fd39ec",
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
       }
@@ -491,11 +491,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777000482,
+        "lastModified": 1784526465,
-        "narHash": "sha256-CZ5FKUSA8FCJf0h9GWdPJXoVVDL9H5yC74GkVc5ubIM=",
+        "narHash": "sha256-L37teKC6oINWG4PGZLIqbphMWvSQ0PEz+aWxAk+rIDw=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "403c09094a877e6c4816462d00b1a56ff8198e06",
+        "rev": "58c6334db52d51fc5dd8877c90b01f00cf8a696b",
         "type": "github"
       },
       "original": {
@@ -512,11 +512,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766371695,
+        "lastModified": 1784526465,
-        "narHash": "sha256-W7CX9vy7H2Jj3E8NI4djHyF8iHSxKpb2c/7uNQ/vGFU=",
+        "narHash": "sha256-L37teKC6oINWG4PGZLIqbphMWvSQ0PEz+aWxAk+rIDw=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "d81285ba8199b00dc31847258cae3c655b605e8c",
+        "rev": "58c6334db52d51fc5dd8877c90b01f00cf8a696b",
         "type": "github"
       },
       "original": {
@@ -533,11 +533,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776914043,
+        "lastModified": 1784438913,
-        "narHash": "sha256-qug5r56yW1qOsjSI99l3Jm15JNT9CvS2otkXNRNtrPI=",
+        "narHash": "sha256-NYF7ZM5ip0u+w1pBFDpIGEbrbgN/wpnLFAmBkWkYMXw=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "2d35c4358d7de3a0e606a6e8b27925d981c01cc3",
+        "rev": "afacd6819d3765a05814ee8e3de74c77d42ac799",
         "type": "github"
       },
       "original": {
@@ -553,11 +553,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777944972,
+        "lastModified": 1783174389,
-        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
+        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
+        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
         "type": "github"
       },
       "original": {
@@ -575,11 +575,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1773932847,
+        "lastModified": 1780762731,
-        "narHash": "sha256-IklIAdlonrmO8/lkDxNIVz9+ORL4pcVotMTxeyvxzoc=",
+        "narHash": "sha256-EuDaLnasWN0mpi995n+fAQQfPGBhqNW4fNjlQRpHt58=",
         "ref": "main",
-        "rev": "0871a319f51d3cb0d1abb5b11edb768b39906d3f",
+        "rev": "931bd2d63e285e767c8c81c103dda3c0a63f2965",
-        "revCount": 104,
+        "revCount": 108,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
       },

flake.nix

@@ -26,7 +26,7 @@
     worblehat.url = "git+https://git.pvv.ntnu.no/Projects/worblehat.git?ref=main";
     worblehat.inputs.nixpkgs.follows = "nixpkgs";
 
-    matrix-next.url = "github:dali99/nixos-matrix-modules/v0.8.0";
+    matrix-next.url = "github:dali99/nixos-matrix-modules/master";
     matrix-next.inputs.nixpkgs.follows = "nixpkgs";
 
     nix-gitea-themes.url = "git+https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git?ref=main";
@@ -35,7 +35,7 @@
     minecraft-heatmap.url = "git+https://git.pvv.ntnu.no/Projects/minecraft-heatmap.git?ref=main";
     minecraft-heatmap.inputs.nixpkgs.follows = "nixpkgs";
 
-    roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=8e5f2849ff7c9616100fe928261512a7ad647939";
+    roowho2.url = "git+https://git.pvv.ntnu.no/Projects/roowho2.git?ref=main&rev=c0c0e47c8a45673c62462cadf38a489b72fd39ec";
     roowho2.inputs.nixpkgs.follows = "nixpkgs";
 
     greg-ng.url = "git+https://git.pvv.ntnu.no/Grzegorz/greg-ng.git?ref=main";
@@ -173,6 +173,7 @@
                 sops-nix.nixosModules.sops
                 inputs.roowho2.nixosModules.default
                 self.nixosModules.rsync-pull-targets
+                self.nixosModules.python-http-handlers
               ])
               ++ modules;
           }
@@ -306,13 +307,14 @@
 
     nixosModules = {
       bluemap = ./modules/bluemap.nix;
+      drumknotty = ./modules/drumknotty;
       gickup = ./modules/gickup;
       matrix-ooye = ./modules/matrix-ooye.nix;
+      python-http-handlers = ./modules/python-http-handlers.nix;
       robots-txt = ./modules/robots-txt.nix;
       rsync-pull-targets = ./modules/rsync-pull-targets.nix;
       snakeoil-certs = ./modules/snakeoil-certs.nix;
       snappymail = ./modules/snappymail.nix;
-      drumknotty = ./modules/drumknotty;
     };
 
     devShells = forAllSystems (system: {
@@ -402,7 +404,6 @@
                       inputs.nix-topology.nixosModules.default
                       ./topology/service-extractors/greg-ng.nix
                       ./topology/service-extractors/postgresql.nix
-                      ./topology/service-extractors/mysql.nix
                       ./topology/service-extractors/gitea-runners.nix
                     ];
                   })

hosts/bekkalokk/hardware-configuration.nix

@@ -16,6 +16,7 @@
   fileSystems."/" =
     { device = "/dev/sda1";
       fsType = "btrfs";
+      options = [ "relatime" ];
     };
 
   fileSystems."/boot" =

hosts/bekkalokk/services/well-known/default.nix

@@ -1,25 +1,70 @@
 { lib, ... }:
 {
-  services.nginx.virtualHosts = lib.genAttrs [
+  # TODO: move this to base so that all virtualHosts take effect on their respecitve hosts
-    "pvv.ntnu.no"
-    "www.pvv.ntnu.no"
-    "pvv.org"
-    "www.pvv.org"
-  ] (_: {
-    locations = {
-      "^~ /.well-known/" = {
-        alias = (toString ./root) + "/";
-      };
 
-      # Proxy the matrix well-known files
+  # NOTE: automatically hosting well-known files by looping over all existing `virtualHosts`
-      # Host has be set before proxy_pass
+  #       unfortunately causes infinite recursuion due to submodule usage within the nginx
-      # The header must be set so nginx on the other side routes it to the right place
+  #       module. For now, the easiest solution was to manually specify a list of virtualHosts
-      "^~ /.well-known/matrix/" = {
+  #       here, but it would be nice to find a better solution in the future.
+  services.nginx.virtualHosts = lib.mkMerge [
+    (lib.genAttrs [
+      "pvv.ntnu.no"
+      "pvv.org"
+
+      "www.pvv.ntnu.no"
+      "www.pvv.org"
+      "www2.pvv.ntnu.no"
+      "www2.pvv.org"
+
+      # NOTE: this list is probably not complete
+      "alps.pvv.ntnu.no"
+      "chat.pvv.ntnu.no"
+      "grafana.pvv.ntnu.no"
+      "status.pvv.ntnu.no"
+      "matrix.pvv.ntnu.no"
+      "mirrors.pvv.ntnu.no"
+      "pages.pvv.ntnu.no"
+      "ooye.pvv.ntnu.no"
+      "ooye.pvv.ntnu.no"
+      "dav.pvv.ntnu.no"
+      "git.pvv.ntnu.no"
+      "idp.pvv.ntnu.no"
+      "minecraft.pvv.ntnu.no"
+      "pw.pvv.ntnu.no"
+      "snappymail.pvv.ntnu.no"
+      "webmail.pvv.ntnu.no"
+      "wiki.pvv.ntnu.no"
+    ] (_: {
+      locations."^~ /.well-known/security.txt" = {
+        alias = toString ./root/security.txt;
+      };
+    }))
+
+    (lib.genAttrs [
+      "pvv.ntnu.no"
+      "pvv.org"
+      "mail.pvv.ntnu.no"
+      "mail.pvv.org"
+      "smtp.pvv.ntnu.no"
+      "smtp.pvv.org"
+    ] (_: {
+      locations."^~ /.well-known/autoconfig/mail/" = {
+        root = toString ./root/autoconfig/mail;
+      };
+    }))
+
+    (lib.genAttrs [
+      "pvv.ntnu.no"
+      "pvv.org"
+      "www.pvv.ntnu.no"
+      "www.pvv.org"
+    ] (_: {
+      locations."^~ /.well-known/matrix/" = {
         extraConfig = ''
           proxy_set_header Host matrix.pvv.ntnu.no;
           proxy_pass https://matrix.pvv.ntnu.no/.well-known/matrix/;
         '';
       };
-    };
+    }))
-  });
+  ];
 }

hosts/bicep/services/matrix/synapse.nix

@@ -74,7 +74,7 @@ in {
         name = "psycopg2";
         args = {
           host = "/var/run/postgresql";
-          dbname = "synapse";
+          database = "synapse";
           user = "matrix-synapse";
           cp_min = 1;
           cp_max = 5;

hosts/bicep/services/minecraft-heatmap.nix

@@ -43,7 +43,7 @@ in
         sshCommand = ''${pkgs.openssh}/bin/ssh -o UserKnownHostsFile='${knownHostsFile}' -i \"$CREDENTIALS_DIRECTORY\"/sshkey'';
       in [
         "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.minecraftLogsDir}'"
-        "${lib.getExe pkgs.rsync} ${rsyncArgs} --rsh=\"${sshCommand}\" root@innovation.pvv.ntnu.no:/ '${cfg.minecraftLogsDir}'/"
+        "${lib.getExe pkgs.rsync} ${rsyncArgs} --rsh=\"${sshCommand}\" root@innovation.pvv.ntnu.no:. '${cfg.minecraftLogsDir}'/"
       ];
     };
   };

hosts/bicep/services/postgresql/default.nix

@@ -14,6 +14,7 @@ in
     extensions = ps: with ps; [ pg_repack ];
     enableTCPIP = true;
 
+    # NOTE: md5 accepts both md5 and scram-sha-256
     authentication = ''
       host all all ${values.ipv4-space} md5
       host all all ${values.ipv6-space} md5
@@ -76,6 +77,15 @@ in
       maintenance_io_concurrency = 100;
       wal_recycle = true;
 
+      # -------------------------------- #
+
+      # Authentication
+      password_encryption = "scram-sha-256";
+
+      # Logging
+      log_connections = "authorization";
+      log_disconnections = true;
+
       # SSL
       ssl = true;
       ssl_cert_file = "/run/credentials/postgresql.service/cert";
@@ -127,4 +137,27 @@ in
 
   networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
   networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
+
+  environment.systemPackages = [
+    (pkgs.writeShellApplication {
+      name = "postgres-update-collations.sh";
+      runtimeInputs = [
+        config.systemd.package
+        cfg.package
+      ];
+      text = ''
+        run0 --user=postgres psql <${pkgs.writeText "postgres-update-collations.sql" ''
+          CREATE FUNCTION exec(text) returns text language plpgsql volatile
+            AS $f$
+              BEGIN
+                EXECUTE $1;
+                RETURN $1;
+              END;
+          $f$;
+
+          SELECT exec('ALTER DATABASE "' || datname || '" REFRESH COLLATION VERSION') FROM pg_database WHERE datistemplate = false;
+        ''}
+      '';
+    })
+  ];
 }

hosts/brzeczyszczykiewicz/hardware-configuration.nix

@@ -16,6 +16,7 @@
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/4e8667f8-55de-4103-8369-b94665f42204";
       fsType = "ext4";
+      options = [ "relatime" ];
     };
 
   fileSystems."/boot" =

hosts/georg/hardware-configuration.nix

@@ -16,6 +16,7 @@
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/33825f0d-5a63-40fc-83db-bfa1ebb72ba0";
       fsType = "ext4";
+      options = [ "relatime" ];
     };
 
   fileSystems."/boot" =

hosts/gluttony/hardware-configuration.nix

@@ -28,6 +28,7 @@
   fileSystems."/" = {
     device = "/dev/mapper/pool-root";
     fsType = "ext4";
+    options = [ "relatime" ];
   };
 
   fileSystems."/boot" = {

hosts/gluttony/services/bluemap.nix

@@ -93,7 +93,7 @@ in {
           no-group = true;
           rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
         };
-      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:/ ${vanillaSurvival}";
+      in "${lib.getExe pkgs.rsync} ${rsyncArgs} root@innovation.pvv.ntnu.no:. ${vanillaSurvival}";
       ExecStartPost = let
         rsyncArgs = lib.cli.toCommandLineShellGNU { } {
           archive = true;
@@ -103,7 +103,7 @@ in {
           no-group = true;
           rsh = "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey";
         };
-      in "${lib.getExe pkgs.rsync} ${rsyncArgs} --groupmap=root:nginx ${config.services.bluemap.webRoot}/ root@bekkalokk.pvv.ntnu.no:/";
+      in "${lib.getExe pkgs.rsync} ${rsyncArgs} --groupmap=root:nginx ${config.services.bluemap.webRoot}/ root@bekkalokk.pvv.ntnu.no:.";
       LoadCredential = [
         "sshkey:${config.sops.secrets."bluemap/ssh-key".path}"
         "ssh-known-hosts:${config.sops.secrets."bluemap/ssh-known-hosts".path}"

hosts/ildkule/services/monitoring/default.nix

@@ -2,10 +2,10 @@
 
 {
   imports = [
+    ./gatus
     ./grafana.nix
     ./loki.nix
     ./prometheus
     ./scrutiny.nix
-    ./uptime-kuma.nix
   ];
 }

hosts/ildkule/services/monitoring/gatus/default.nix

@@ -0,0 +1,155 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.gatus;
+in
+{
+  imports = [
+    ./minecraft-checker.nix
+  ];
+
+  services.gatus = {
+    enable = true;
+
+    settings = {
+      web = {
+        address = "127.0.0.1";
+        port = 19283;
+      };
+
+      storage = {
+        type = "sqlite";
+        path = "/var/lib/gatus/data.db";
+      };
+
+      ui = {
+        title = "PVV Nede!?";
+        header = "😭😭😭";
+        dashboard-heading = "PVV Nede!?";
+        dashboard-subheading = "Kan noen ringe drift?";
+      };
+
+      endpoints = let
+        mkMachine = name: {
+          inherit name;
+          group = "Machines";
+          url = "icmp://${name}.pvv.ntnu.no";
+          conditions = [
+            "[CONNECTED] == true"
+          ];
+        };
+
+        mkWebsite = name: url: {
+          inherit name url;
+          group = "Websites";
+          method = "GET";
+          conditions = [
+            "[STATUS] == 200"
+          ];
+        };
+
+        mkService = name: url: {
+          inherit name url;
+          group = "Services";
+          conditions = [
+            "[CONNECTED] == true"
+          ];
+        };
+      in (lib.sortOn (m: m.name) [
+        (mkMachine "ambidextrous")
+        (mkMachine "bekkalokk")
+        (mkMachine "bicep")
+        (mkMachine "bikkje")
+        (mkMachine "brzeczyszczykiewicz")
+        (mkMachine "georg")
+        (mkMachine "gluttony")
+        (mkMachine "ildkule")
+        (mkMachine "kana")
+        (mkMachine "kommode")
+        (mkMachine "lupine-1")
+        (mkMachine "lupine-2")
+        (mkMachine "lupine-3")
+        (mkMachine "lupine-4")
+        (mkMachine "lupine-5")
+        (mkMachine "skrot")
+        (mkMachine "temmie")
+        (mkMachine "wenche")
+
+        (mkMachine "balduzius")
+        (mkMachine "blossom")
+        (mkMachine "bubbles")
+        (mkMachine "buskerud")
+        (mkMachine "buttercup")
+        (mkMachine "demiurgen")
+        (mkMachine "drolsum")
+        (mkMachine "hildring")
+        (mkMachine "innovation")
+        (mkMachine "isvegg")
+        (mkMachine "knutsen")
+        (mkMachine "ludvigsen" // {
+          url = "icmp://ludvigsen-tap.pvv.ntnu.no";
+        })
+        (mkMachine "microbel")
+        (mkMachine "mirage")
+        (mkMachine "orchid")
+        (mkMachine "principal")
+        (mkMachine "sleipner")
+        (mkMachine "smask")
+        (mkMachine "tom")
+        (mkMachine "wegonke")
+      ]) ++ [
+        (mkWebsite "Bluemap" "https://minecraft.pvv.ntnu.no")
+        (mkWebsite "Element Web" "https://chat.pvv.ntnu.no")
+        (mkWebsite "Gitea" "https://git.pvv.ntnu.no/api/healthz" // {
+          conditions = [
+            "[STATUS] == 200"
+            "[BODY].status == pass"
+          ];
+        })
+        (mkWebsite "Grafana" "https://grafana.pvv.ntnu.no/api/health" // {
+          conditions = [
+            "[STATUS] == 200"
+            "[BODY].database == ok"
+          ];
+        })
+        (mkWebsite "Grzegorz - Brzeczyszczykiewicz" "https://brzeczyszczykiewicz.pvv.ntnu.no")
+        (mkWebsite "Grzegorz - Georg" "https://georg.pvv.ntnu.no")
+        (mkWebsite "IDP" "https://idp.pvv.ntnu.no")
+        (mkWebsite "Mailing Lists" "http://list.pvv.ntnu.no")
+        (mkWebsite "Mapcrafter" "http://isvegg.pvv.ntnu.no/kart")
+        (mkWebsite "PVV-Nettsiden" "https://www.pvv.ntnu.no")
+        (mkWebsite "Roundcube" "https://webmail.pvv.ntnu.no/roundcube")
+        (mkWebsite "Scrutiny" "https://scrutiny.pvv.ntnu.no")
+        (mkWebsite "Snappymail" "http://snappymail.pvv.ntnu.no")
+        (mkWebsite "Userweb - Temmie" "https://temmie.pvv.ntnu.no/~oysteikt")
+        (mkWebsite "Userweb - Tom" "https://www.pvv.ntnu.no/~oysteikt")
+        (mkWebsite "Vaultwarden" "https://pw.pvv.ntnu.no/alive")
+        (mkWebsite "Wiki" "https://wiki.pvv.ntnu.no/w/api.php?action=query&format=json")
+
+        (mkService "Gitea SSH" "ssh://git.pvv.ntnu.no:2222")
+        (mkService "QoTD" "tcp://bekkalokk.pvv.ntnu.no:17")
+        (mkService "Minecraft" "http://localhost:1337" // {
+          conditions = [
+            "[STATUS] == 200"
+            "[BODY].ok == true"
+          ];
+        })
+        (mkService "Email (SMTP)" "starttls://mail.pvv.ntnu.no:587")
+        (mkService "Email (POP3)" "tls://mail.pvv.ntnu.no:995")
+        (mkService "Email (IMAP)" "tls://mail.pvv.ntnu.no:993")
+        (mkService "Matrix Synapse" "https://matrix.pvv.ntnu.no/_matrix/client/versions" // {
+          method = "GET";
+          conditions = [
+            "[STATUS] == 200"
+          ];
+        })
+      ];
+    };
+  };
+
+  services.nginx.virtualHosts."status.pvv.ntnu.no" = lib.mkIf cfg.enable {
+    enableACME = true;
+    forceSSL = true;
+    kTLS = true;
+    locations."/".proxyPass = "http://localhost:${toString cfg.settings.web.port}";
+  };
+}

hosts/ildkule/services/monitoring/gatus/minecraft-checker.nix

@@ -0,0 +1,40 @@
+{ lib, pkgs, ... }:
+{
+  services.python-http-handlers."gatus-minecraft-checker" = {
+    listenStreams = [ "127.0.0.1:1337" ];
+    libraries = with pkgs.python3Packages; [
+      mcstatus
+    ];
+    handler = ''
+      import json
+      from mcstatus import JavaServer
+
+      class Handler(BaseHTTPRequestHandler):
+          def do_GET(self):
+              try:
+                  mcserver = JavaServer.lookup("minecraft.pvv.ntnu.no")
+                  status = mcserver.status()
+
+                  body = {
+                      "ok": True,
+                      "players": status.players.online,
+                      "version": status.version.name,
+                      "latency": status.latency,
+                  }
+
+                  data = json.dumps(body).encode()
+
+                  self.send_response(200)
+                  self.send_header("Content-Type", "application/json")
+                  self.send_header("Content-Length", str(len(data)))
+                  self.end_headers()
+                  self.wfile.write(data)
+
+              except Exception as e:
+                  data = json.dumps({"ok": False, "error": str(e)}).encode()
+                  self.send_response(500)
+                  self.end_headers()
+                  self.wfile.write(data)
+    '';
+  };
+}

hosts/ildkule/services/monitoring/loki.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, values, ... }:
 
 let
   cfg = config.services.loki;
@@ -9,8 +9,8 @@ in {
     configuration = {
       auth_enabled = false;
       server = {
-        http_listen_port = 3100;
+        http_listen_port = 31832;
-        http_listen_address = "0.0.0.0";
+        http_listen_address = "127.0.0.1";
         grpc_listen_port = 9096;
       };
 
@@ -81,5 +81,25 @@ in {
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ cfg.configuration.server.http_listen_port ];
+  services.nginx.virtualHosts."loki.pvv.ntnu.no" = {
+    forceSSL = true;
+    enableACME = true;
+    kTLS = true;
+
+    locations = {
+      "/".return = "403";
+      "/loki/api/v1/push" = {
+        proxyPass = "http://${cfg.configuration.server.http_listen_address}:${toString cfg.configuration.server.http_listen_port}/loki/api/v1/push";
+        extraConfig = ''
+          allow 127.0.0.1;
+          allow ::1;
+          allow ${values.ipv4-space};
+          allow ${values.ipv6-space};
+          allow ${values.ntnu.ipv4-space};
+          allow ${values.ntnu.ipv6-space};
+          deny all;
+        '';
+      };
+    };
+  };
 }

hosts/ildkule/services/monitoring/uptime-kuma.nix

@@ -1,44 +0,0 @@
-{ config, pkgs, lib, values, ... }:
-let
-  cfg = config.services.uptime-kuma;
-  domain = "status.pvv.ntnu.no";
-  stateDir = "/data/monitoring/uptime-kuma";
-in {
-  services.uptime-kuma = {
-    enable = true;
-    settings = {
-      PORT = "5059";
-      HOST = "127.0.1.2";
-    };
-  };
-
-  services.nginx.virtualHosts.${domain} = {
-    enableACME = true;
-    forceSSL = true;
-    kTLS = true;
-    locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
-  };
-
-  fileSystems."/var/lib/private/uptime-kuma" = {
-    device = stateDir;
-    fsType = "bind";
-    options = [ "bind" ];
-  };
-
-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${stateDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXzcDm6cVr4NmWzUSroy33FlielKqaG83wY0RCMC0p/ uptime_kuma rsync backup";
-    };
-  };
-}

hosts/kommode/disks.nix

@@ -48,6 +48,7 @@
 
                 # swap.swapfile.size = "4G";
                 mountpoint = "/";
+                mountOptions = [ "relatime" ];
               };
             };
 

hosts/kommode/services/gitea/default.nix

@@ -136,7 +136,7 @@ in {
       picture = {
         AVATAR_MAX_FILE_SIZE = 1024 * 1024 * 5;
         # NOTE: go any bigger than this, and gitea will freeze your gif >:(
-        AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 2;
+        AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 4;
       };
       actions.ENABLED = true;
       webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," [

hosts/lupine/configuration.nix

@@ -5,6 +5,8 @@
 
     (fp /base)
     ./services/gitea-runner.nix
+  ] ++ lib.optionals (lupineName == "lupine-5") [
+    ./services/openvpn.nix
   ];
 
   sops.defaultSopsFile = fp /secrets/lupine/lupine.yaml;
@@ -15,14 +17,61 @@
     "i686-linux"
   ];
 
-  systemd.network.networks."30-enp0s31f6" = values.defaultNetworkConfig // {
+  systemd.network = if (lupineName != "lupine-5")
-    matchConfig.Name = "enp0s31f6";
+    then {
-    address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
+      networks."30-enp0s31f6" =  (values.defaultNetworkConfig // {
-    networkConfig.LLDP = false;
+        matchConfig.Name = "enp0s31f6";
-  };
+        address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
-  systemd.network.wait-online = {
+        networkConfig.LLDP = false;
-    anyInterface = true;
+      });
-  };
+
+      wait-online = {
+        anyInterface = true;
+      };
+    }
+    else {
+      netdevs."10-br0".netdevConfig = {
+        Name = "br0";
+        Kind = "bridge";
+      };
+
+      netdevs."20-tap0".netdevConfig = {
+        Name = "tap0";
+        Kind = "tap";
+      };
+
+      networks."10-enp0s31f6" = {
+        matchConfig.Name = "enp0s31f6";
+        bridge = [ "br0" ];
+      };
+
+      networks."20-br0" = {
+        matchConfig.Name = "br0";
+
+        address = with values.hosts.${lupineName}; [
+          (ipv4 + "/25")
+          (ipv6 + "/64")
+          values.services.knutsen-vpn
+        ];
+        networkConfig.LLDP = false;
+
+        dns = ["129.241.0.200" "129.241.0.201" "2001:700:300:1900::200" "2001:700:300:1900::201"];
+        domains = ["pvv.ntnu.no" "pvv.org"];
+        gateway = [values.hosts.gateway values.hosts.gateway6];
+
+        networkConfig.IPv6AcceptRA = "no";
+        DHCP = "no";
+      };
+
+      networks."30-tap0" = {
+        matchConfig.Name = "tap0";
+        bridge = [ "br0" ];
+      };
+
+      wait-online = {
+        anyInterface = true;
+      };
+    };
 
   # Don't change (even during upgrades) unless you know what you are doing.
   # See https://search.nixos.org/options?show=system.stateVersion

hosts/lupine/services/openvpn.nix

@@ -0,0 +1,101 @@
+{ config, pkgs, lib, values, ... }:
+let
+  renderConfig = attrs: lib.pipe attrs [
+    (lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
+    (builtins.mapAttrs (_: value:
+      if builtins.isList value then builtins.concatStringsSep " " (map toString value)
+      else if value == true then value
+      else if builtins.any (f: f value) [
+        builtins.isString
+        builtins.isInt
+        builtins.isFloat
+        lib.isPath
+        lib.isDerivation
+      ] then toString value
+      else throw "Unknown value in lupine openvpn config:\n${value}"
+    ))
+    (lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
+    (builtins.concatStringsSep "\n")
+    (x: x + "\n\n")
+  ];
+in
+{
+  sops.secrets = {
+    "openvpn/ca/crt" = { };
+    "openvpn/server/crt" = { };
+    "openvpn/server/key" = { };
+  };
+
+  services.openvpn.servers."ov-tunnel" = {
+    config = renderConfig {
+      mode = "server";
+
+      # TODO: use aliases
+      local = "0.0.0.0";
+      port = 1194;
+      proto = "udp";
+
+      dev = "tap0";
+      dev-type = "tap";
+
+      script-security = 0;
+
+      ca = config.sops.secrets."openvpn/ca/crt".path;
+      cert = config.sops.secrets."openvpn/server/crt".path;
+      key = config.sops.secrets."openvpn/server/key".path;
+      dh = "none";
+
+      # Maintain a record of client <-> virtual IP address
+      # associations in this file.  If OpenVPN goes down or
+      # is restarted, reconnecting clients can be assigned
+      # the same virtual IP address from the pool that was
+      # previously assigned.
+
+      # ifconfig-pool-persist = ./ipp.txt;
+
+      server-bridge = builtins.concatStringsSep " " [
+        # Gateway
+        "129.241.210.129"
+        # Netmask
+        "255.255.255.128"
+        # Pool start
+        values.services.knutsen-tap
+        # Pool end
+        values.services.ludvigsen-tap
+      ];
+
+      keepalive = "10 120";
+
+      user = "nobody";
+      group = "nobody";
+
+      status = "/var/log/openvpn-status.log";
+
+      client-config-dir = pkgs.writeTextDir "ludvigsen" ''
+        # Sett IP-adr. for tap0 til ludvigsens PVV-addresse.
+        ifconfig-push ${values.services.ludvigsen-tap} 255.255.255.128
+
+        # Hvordan skal man faa dette til aa funke, tro?
+        # ifconfig-ipv6-push 2001:700:300:1900::xxx/64
+
+        # La ludvigsen bruke std. PVV-gateway til all trafikk (unntatt VPN-tunnellen).
+        push "redirect-gateway"
+      '';
+
+      persist-key = true;
+      persist-tun = true;
+
+      tls-version-min = "1.2";
+      tls-version-max = "1.2";
+
+      verb = 5;
+
+      explicit-exit-notify = 1;
+    };
+  };
+
+  networking.firewall = {
+    allowedTCPPorts = [ 1194 ];
+    allowedUDPPorts = [ 1194 ];
+  };
+}

hosts/shark/hardware-configuration.nix

@@ -16,6 +16,7 @@
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/224c45db-9fdc-45d4-b3ad-aaf20b3efa8a";
       fsType = "ext4";
+      options = [ "relatime" ];
     };
 
   fileSystems."/boot" =

hosts/skrot/configuration.nix

@@ -12,6 +12,8 @@
     ./hardware-configuration.nix
     ./disk-config.nix
     (fp /base)
+
+    ./services/drumknotty.nix
   ];
 
   boot.consoleLogLevel = 0;
@@ -26,59 +28,6 @@
     ];
   };
 
-  sops.secrets = {
-    "dibbler/postgresql/password" = {
-      owner = "drumknotty";
-      group = "drumknotty";
-    };
-    "worblehat/postgresql/password" = {
-      owner = "drumknotty";
-      group = "drumknotty";
-    };
-  };
-
-  services.drumknotty = {
-    enable = true;
-    kioskMode = true;
-
-    screen = {
-      limitWidth = 80;
-      limitHeight = 42;
-    };
-
-    dibbler = {
-      enable = true;
-      settings = {
-        general.quit_allowed = false;
-        database = {
-          type = "postgresql";
-          postgresql = {
-            username = "pvv_vv";
-            dbname = "pvv_vv";
-            host = "postgres.pvv.ntnu.no";
-            password_file = config.sops.secrets."dibbler/postgresql/password".path;
-          };
-        };
-      };
-    };
-
-    worblehat = {
-      enable = true;
-      settings = {
-        general.quit_allowed = false;
-        database = {
-          type = "postgresql";
-          postgresql = {
-            username = "worblehat";
-            dbname = "worblehat";
-            host = "postgres.pvv.ntnu.no";
-            password = config.sops.secrets."worblehat/postgresql/password".path;
-          };
-        };
-      };
-    };
-  };
-
   systemd.services."serial-getty@ttyUSB0" = lib.mkIf (!config.virtualisation.isVmVariant) {
     enable = true;
     wantedBy = [ "getty.target" ]; # to start at boot

hosts/skrot/disk-config.nix

@@ -31,6 +31,7 @@
                 type = "filesystem";
                 format = "ext4";
                 mountpoint = "/";
+                mountOptions = [ "relatime" ];
               };
             };
           };

hosts/skrot/services/drumknotty.nix

@@ -0,0 +1,57 @@
+{ config, ... }:
+{
+  sops.secrets = {
+    "dibbler/postgresql/password" = {
+      owner = "drumknotty";
+      group = "drumknotty";
+    };
+    "worblehat/postgresql/password" = {
+      owner = "drumknotty";
+      group = "drumknotty";
+    };
+  };
+
+  services.drumknotty = {
+    enable = true;
+    kioskMode = true;
+
+    screen = {
+      limitWidth = 80;
+      limitHeight = 42;
+    };
+
+    dibbler = {
+      enable = true;
+      settings = {
+        general.quit_allowed = false;
+        database = {
+          type = "postgresql";
+          postgresql = {
+            username = "pvv_vv";
+            dbname = "pvv_vv";
+            host = "postgres.pvv.ntnu.no";
+            password_file = config.sops.secrets."dibbler/postgresql/password".path;
+          };
+        };
+      };
+    };
+
+    worblehat = {
+      enable = true;
+      settings = {
+        general.quit_allowed = false;
+        database = {
+          type = "postgresql";
+          postgresql = {
+            username = "worblehat";
+            dbname = "worblehat";
+            host = "postgres.pvv.ntnu.no";
+            password = config.sops.secrets."worblehat/postgresql/password".path;
+          };
+        };
+      };
+    };
+  };
+
+  services.roowho2.settings.rwhod.ignoreUsers = [ "drumknotty" ];
+}

hosts/temmie/hardware-configuration.nix

@@ -16,6 +16,7 @@
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/c3aed415-0054-4ac5-8d29-75a99cc26451";
       fsType = "btrfs";
+      options = [ "relatime" ];
     };
 
   fileSystems."/boot" =

hosts/temmie/services/nfs-mounts.nix

@@ -88,9 +88,8 @@ in
           [[ -d "$dir" ]] || continue
 
           uid="$(stat -c '%u' "$dir")"
-          username="$(basename "$dir")"
 
-          mountpoint="/run/pvvhome/by-uid/$uid/$1/$username"
+          mountpoint="/run/pvvhome/by-uid/$uid"
           mkdir -p "$mountpoint"
 
           unit_name=$(systemd-escape --path --suffix=mount "$mountpoint")

hosts/temmie/services/userweb/default.nix

@@ -1,6 +1,5 @@
 {
   imports = [
-    ./fcgiwrap.nix
     ./httpd.nix
     ./log-processor.nix
     ./mail.nix

hosts/temmie/services/userweb/fcgiwrap.nix

@@ -1,85 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  mcfg = config.services.pvv-userweb;
-in
-{
-  config = lib.mkIf mcfg.enable {
-    systemd.slices.system-userweb-fcgiwrap = { };
-
-    # NOTE: expected %i here is the UID of the user
-    systemd.sockets."userweb-fcgiwrap@" = {
-      description = "UserWeb fcgiwrap server for user %i";
-      socketConfig = {
-        ListenStream = "/run/userweb-fcgiwrap/%i.sock";
-        RemoveOnStop = true;
-
-        SocketUser = "wwwrun";
-        SocketGroup = "wwwrun";
-        SocketMode = "0660";
-      };
-    };
-
-    systemd.services."userweb-fcgiwrap@" = {
-      after = [
-        "httpd-passwd-sync.service"
-      ];
-      requires = [
-        "httpd-passwd-sync.service"
-      ];
-      documentation = [ "man:fcgiwrap(8)" ];
-
-      unitConfig = {
-        AssertPathExists = "/run/pvvhome/by-uid/%i";
-      };
-
-      serviceConfig = {
-
-        Slice = "system-userweb-fcgiwrap.slice";
-        Type = "simple";
-        User = "%i";
-
-        ExecStart = "${lib.getExe pkgs.fcgiwrap}";
-
-        RuntimeDirectoryMode = "0750";
-        RuntimeDirectory = [
-          "fcgiwrap/%i/root-mnt"
-        ];
-        RootDirectory = "/run/fcgiwrap/%i/root-mnt";
-        MountAPIVFS = true;
-        BindReadOnlyPaths = [
-          builtins.storeDir
-          "/etc"
-
-          # TODO: set up minimal fake passwd + group in `ExecStartPre` instead
-          "/var/lib/httpd-passwd-sync/passwd:/etc/passwd"
-          "/var/lib/httpd-passwd-sync/group:/etc/group"
-
-          "${pkgs.writeText "userweb-fake-nsswitch.conf" ''
-            passwd:    files
-            group:     files
-            shadow:    files
-            sudoers:   files
-
-            hosts:     mymachines resolve [!UNAVAIL=return] files myhostname dns
-            networks:  files
-
-            ethers:    files
-            services:  files
-            protocols: files
-            rpc:       files
-
-            subuid:    files
-            subgid:    files
-          ''}:/etc/nsswitch.conf"
-        ] ++ lib.optionals mcfg.debugMode [
-          "/bin"
-        ] ++ mcfg.fhsBindPaths;
-
-        # TODO: handle /amd/homepvv${l}
-        BindPaths = [
-          "/run/pvvhome/by-uid/%i:/home/pvv"
-        ];
-      };
-    };
-  };
-}

hosts/temmie/services/userweb/httpd.nix

@@ -277,7 +277,30 @@ in
         "/dev/null"
         "/var/lib/acme"
         "/var/run/nscd"
-      ] ++ mcfg.fhsBindPaths;
+        "${mcfg.fhsEnv}/bin:/bin"
+        "${mcfg.fhsEnv}/sbin:/sbin"
+        "${mcfg.fhsEnv}/lib:/lib"
+        "${mcfg.fhsEnv}/share:/share"
+      ] ++ (lib.mapCartesianProduct ({ parent, child }: "${mcfg.fhsEnv}${child}:${parent}${child}") {
+        parent = [
+          "/local"
+          "/opt"
+          "/opt/local"
+          "/store"
+          "/store/gnu"
+          "/usr"
+          "/usr/local"
+          "/run/current-system/sw"
+        ];
+        child = [
+          "/bin"
+          "/sbin"
+          "/lib"
+          "/libexec"
+          "/include"
+          "/share"
+        ];
+      });
       BindPaths = (lib.mapCartesianProduct ({ directoryFn, letter }: "/run/pvvhome/${letter}:${directoryFn letter}${letter}") {
         directoryFn = [
           (_: "/home/pvv/")

hosts/temmie/services/userweb/module.nix

@@ -106,36 +106,6 @@ in
         ];
       };
     };
-
-    fhsBindPaths = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      readOnly = true;
-      default = [
-        "${cfg.fhsEnv}/bin:/bin"
-        "${cfg.fhsEnv}/sbin:/sbin"
-        "${cfg.fhsEnv}/lib:/lib"
-        "${cfg.fhsEnv}/share:/share"
-      ] ++ (lib.mapCartesianProduct ({ parent, child }: "${cfg.fhsEnv}${child}:${parent}${child}") {
-        parent = [
-          "/local"
-          "/opt"
-          "/opt/local"
-          "/store"
-          "/store/gnu"
-          "/usr"
-          "/usr/local"
-          "/run/current-system/sw"
-        ];
-        child = [
-          "/bin"
-          "/sbin"
-          "/lib"
-          "/libexec"
-          "/include"
-          "/share"
-        ];
-      });
-    };
   };
 
   config = lib.mkIf cfg.enable {

hosts/wenche/hardware-configuration.nix

@@ -13,6 +13,7 @@
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/4e8ecdd2-d453-4fff-b952-f06da00f3b85";
       fsType = "ext4";
+      options = [ "relatime" ];
     };
 
   swapDevices = [ {

modules/drumknotty/dibbler.nix

@@ -109,5 +109,10 @@ in
         Group = "drumknotty";
       };
     };
+
+    systemd.services."drumknotty-screen-session".serviceConfig.StateDirectory = [
+      "dibbler"
+      "dibbler/crashdumps"
+    ];
   };
 }

modules/drumknotty/worblehat.nix

@@ -117,6 +117,10 @@ in
           ];
         };
       };
+
+      systemd.services."drumknotty-screen-session".serviceConfig.StateDirectory = [
+        "worblehat"
+      ];
     }
 
     (lib.mkIf ((mainCfg.enable && cfg.enable) || cfg.deadline-daemon.enable) {

modules/grzegorz.nix

@@ -123,5 +123,7 @@ in {
       };
     };
   };
+
+  services.roowho2.settings.rwhod.ignoreUsers = [ "greg" ];
 }
 

modules/python-http-handlers.nix

@@ -0,0 +1,224 @@
+{ config, options, lib, pkgs, utils, ... }:
+let
+  cfg = config.services.python-http-handlers;
+in
+{
+  options.services.python-http-handlers = lib.mkOption {
+    default = { };
+    type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
+      options = {
+        enable = lib.mkEnableOption "" // {
+          default = true;
+          description = "Whether to enable this python HTTP handler.";
+        };
+
+        name = lib.mkOption {
+          type = lib.types.str;
+          default = "phh-${name}";
+          defaultText = "phh-<name>";
+          description = ''
+            The name of this HTTP handler.
+
+            This will be used for the systemd service among other things.
+          '';
+        };
+
+        listenStreams = lib.mkOption {
+          type = with lib.types; listOf str;
+          default = [
+            "/run/phh-${name}.socket"
+          ];
+          defaultText = lib.literalExpression ''
+            [
+              "/run/phh-<name>.socket"
+            ]
+          '';
+          description = ''
+            For each item in this list, a `ListenStream`
+            option in the `[Socket]` section will be created.
+          '';
+        };
+
+        socketConfig = lib.mkOption {
+          type = utils.systemdUtils.unitOptions.unitOption;
+          default = { };
+          description = ''
+            Config for the systemd socket's `[Socket]` section.
+
+            See {manpage}`systemd.socket(5)` for details.
+          '';
+        };
+
+        serviceConfig = lib.mkOption {
+          type = utils.systemdUtils.unitOptions.unitOption;
+          default = { };
+          description = ''
+            Config for the systemd service's `[Service]` section.
+
+            See {manpage}`systemd.exec(5)` and {manpage}`systemd.service(5)` for details.
+          '';
+        };
+
+        enableDefaultHardening = lib.mkEnableOption "" // {
+          default = true;
+          description = ''
+            Whether to enable a set of recommended systemd hardening directives.
+
+            If this breaks the service, you can either override the offending directives
+            through {option}`serviceConfig`, or disable this option altogether.
+          '';
+        };
+
+        libraries = lib.mkOption {
+          type = with lib.types; listOf package;
+          default = [ ];
+          example = lib.literalExpression ''
+            with pkgs.python3Packages; [
+              matplotlib
+              numpy
+              pillow
+            ]
+          '';
+          description = ''
+            Extra python libraries to make available to the service.
+          '';
+        };
+
+        flakeIgnore = lib.mkOption {
+          type = with lib.types; listOf str;
+          default = [
+            "E111" # indentation is not a multiple of four
+            "E201" # whitespace after (
+            "E202" # whitespace after )
+            "E203" # whitespace before :
+            "E211" # whitespace before (
+            "E251" # unexpected spaces around keyword / parameter equals
+            "E301" # expected 1 blank line, found 0
+            "E302" # expected 2 blank lines, found 0
+            "E303" # too many blank lines
+            "E305" # expected 2 blank lines after end of function or class
+            "E306" # expected 1 blank line before a nested definition
+            "E501" # max line length
+            "E704" # multiple statements on one line (def)
+          ];
+          description = ''
+            A list of flake8 rules to ignore while linting the python code.
+
+            An opinionated list of bogus rules (according to module author) is provided as default.
+          '';
+        };
+
+        handler = lib.mkOption {
+          type = lib.types.lines;
+          default = ''
+            import json
+
+            class Handler(BaseHTTPRequestHandler):
+                def do_GET(self):
+                    body = {"ok": True}
+                    data = json.dumps(body).encode()
+                    self.send_response(200)
+                    self.send_header("Content-Type", "application/json")
+                    self.send_header("Content-Length", str(len(data)))
+                    self.end_headers()
+                    self.wfile.write(data)
+          '';
+          description = ''
+            Python code including the HTTP handler for the server.
+
+            You can include as many imports and functions as you'd like here, but you will need
+            to at least provide a `class Handler(BaseHTTPRequestHandler)` to handle incoming HTTP requests.
+          '';
+        };
+      };
+    }));
+  };
+
+  config = {
+    systemd.sockets = lib.pipe cfg [
+      lib.attrValues
+      (lib.filter (v: v.enable))
+      (vs: lib.genAttrs' vs (v: {
+        inherit (v) name;
+        value = {
+          wantedBy = [ "sockets.target" ];
+          inherit (v) listenStreams;
+          socketConfig = {
+            Accept = false;
+          } // v.socketConfig;
+        };
+      }))
+    ];
+
+    systemd.services = lib.pipe cfg [
+      lib.attrValues
+      (lib.filter (v: v.enable))
+      (vs: lib.genAttrs' vs (v: {
+        inherit (v) name;
+        value = {
+          serviceConfig = {
+            Type = "simple";
+            DynamicUser = true;
+
+            ExecStart = let
+              package = pkgs.writers.writePython3Bin "${v.name}-bin" {
+                inherit (v) libraries flakeIgnore;
+              } ''
+                import socket
+                from http.server import HTTPServer, BaseHTTPRequestHandler
+
+                ${v.handler}
+
+                class NoBindHTTPServer(HTTPServer):
+                    def server_bind(): pass
+                    def server_activate(): pass
+
+                def main():
+                    httpd = NoBindHTTPServer(
+                        ("", 0),
+                        Handler,
+                        bind_and_activate=False,
+                    )
+                    httpd.socket = socket.fromfd(3, socket.AF_INET, socket.SOCK_STREAM)
+                    httpd.serve_forever()
+
+                if __name__ == '__main__':
+                    main()
+              '';
+            in lib.getExe package;
+          } // (lib.optionalAttrs v.enableDefaultHardening {
+            AmbientCapabilities = [ "" ];
+            CapabilityBoundingSet = [ "" ];
+            DeviceAllow = [ "" ];
+            LockPersonality = true;
+            NoNewPrivileges = true;
+            PrivateDevices = true;
+            PrivateTmp = true;
+            ProcSubset = "pid";
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectHome = true;
+            ProtectHostname = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectProc = "invisible";
+            ProtectSystem = "strict";
+            RemoveIPC = true;
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            SocketBindDeny = "any";
+            SystemCallArchitectures = "native";
+            SystemCallFilter = [
+               "@system-service"
+               "~@privileged"
+               "~@resources"
+            ];
+            UMask = "0077";
+          }) // v.serviceConfig;
+        };
+      }))
+    ];
+  };
+}

topology/service-extractors/mysql.nix

@@ -1,19 +0,0 @@
-{ config, unstablePkgs, lib, ... }:
-let
-  cfg = config.services.mysql;
-  cfgBak = config.services.mysqlBackup;
-in
-{
-  config.topology.self.services.mysql = lib.mkIf cfg.enable {
-    name = "MySQL";
-    icon = "${unstablePkgs.super-tiny-icons}/share/icons/SuperTinyIcons/svg/mysql.svg";
-
-    details.listen.text = "${cfg.settings.mysqld.bind-address or "127.0.0.1"}:${toString (cfg.settings.mysqld.port or 3306)}";
-    details.socket.text = cfg.settings.mysqld.socket or "/run/mysqld/mysqld.sock";
-    details.type.text = cfg.package.pname;
-    details.dataDir.text = cfg.dataDir;
-
-    # details.backup-time = lib.mkIf cfgBak.enable cfgBak.calendar;
-    # details.backup-location = lib.mkIf cfgBak.enable cfgBak.location;
-  };
-}

values.nix

@@ -26,6 +26,10 @@ in rec {
       ipv4 = pvv-ipv4 213;
       ipv6 = pvv-ipv6 213;
     };
+
+    knutsen-vpn = pvv-ipv4 191;
+    knutsen-tap = pvv-ipv4 253;
+    ludvigsen-tap = pvv-ipv4 254;
   };
 
   hosts = {