fixup! WIP: temmie/userweb: inject users from passwd into httpd sandbox

This also fixes a few issues, such as enabling `createLocalDatabase` for
multiple programs, and wraps all the screen logic within a screenrc
file. Some assertions were also added to avoid some easy-to-make
mistakes.

.sops.yaml

@@ -20,6 +20,7 @@ keys:
   - &host_lupine-4 age1ml48zztcmnrdrhrdsjrlyxf09jtmjgz46u8td4zm59wn3fm4g57qs4wg0l
   - &host_lupine-5 age12gws5nws69vxryd3kt7q0ayngch90efmhqcrfhnnsmj00lkgxd4qsdkvqn
   - &host_skrot age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr
+  - &host_temmie age10avsdvqger25z0lyzlq8v7xfzcmypkmjsswswaxwqnpnl6x9wcjq0uv2n7
   - &host_gluttony age12czfkvuw9pjk5qny5c6m2hjhd634cj9r4dsa3ss5zkux5h4vvc7s7k4urq
 
 creation_rules:
@@ -121,6 +122,19 @@ creation_rules:
       pgp:
       - *user_oysteikt
 
+  - path_regex: secrets/temmie/[^/]+\.yaml$
+    key_groups:
+    - age:
+      - *host_temmie
+      - *user_danio
+      - *user_felixalb
+      - *user_pederbs_sopp
+      - *user_pederbs_nord
+      - *user_pederbs_bjarte
+      - *user_vegardbm
+      pgp:
+      - *user_oysteikt
+
   - path_regex: secrets/gluttony/[^/]+\.yaml$
     key_groups:
     - age:

base/default.nix

@@ -1,6 +1,8 @@
 {
+  config,
   pkgs,
   lib,
+  inputs,
   fp,
   ...
 }:
@@ -35,6 +37,7 @@
     ./services/prometheus-node-exporter.nix
     ./services/prometheus-systemd-exporter.nix
     ./services/roowho2.nix
+    ./services/scrutiny-collector.nix
     ./services/smartd.nix
     ./services/thermald.nix
     ./services/uptimed.nix
@@ -42,12 +45,20 @@
     ./services/userdbd.nix
   ];
 
+  system.nixos.tags = lib.optionals (inputs.self.sourceInfo ? dirtyRev) [ "dirty" ];
+
+  specialisation."auto-upgrade".configuration = {
+    system.nixos.tags = [ "auto" ];
+  };
+
   boot.tmp.cleanOnBoot = lib.mkDefault true;
   boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
 
   boot.loader.systemd-boot.enable = lib.mkDefault true;
   boot.loader.efi.canTouchEfiVariables = lib.mkDefault true;
 
+  services.btrfs.autoScrub.enable = lib.mkDefault (lib.any ({ fsType, ... }: fsType == "btrfs") (lib.attrValues config.fileSystems));
+
   time.timeZone = "Europe/Oslo";
 
   i18n.defaultLocale = "en_US.UTF-8";

base/services/auto-upgrade.nix

@@ -13,6 +13,7 @@ in
 
       "--refresh"
       "--no-write-lock-file"
+      "--specialisation auto-upgrade"
       # --update-input is deprecated since nix 2.22, and removed in lix 2.90
       # as such we instead use --override-input combined with --refresh
       # https://git.lix.systems/lix-project/lix/issues/400

base/services/polkit.nix

@@ -6,10 +6,13 @@ in
   security.polkit.enable = true;
 
   environment.etc."polkit-1/rules.d/9-nixos-overrides.rules".text = lib.mkIf cfg.enable ''
-    polkit.addAdminRule(function(action, subject) {
+    polkit.addRule(function(action, subject) {
-        if(subject.isInGroup("wheel")) {
+       if (
-            return ["unix-user:"+subject.user];
+           action.id.startsWith("org.freedesktop.systemd1.") &&
-        }
+           subject.isInGroup("wheel")
-    });
+       ) {
+           return polkit.Result.AUTH_SELF_KEEP;
+         }
+     });
   '';
 }

base/services/scrutiny-collector.nix

@@ -0,0 +1,11 @@
+{ config, ... }:
+{
+  services.scrutiny.collector = {
+    enable = !config.services.qemuGuest.enable;
+    settings = {
+      version = 1;
+      host.id = config.networking.hostName;
+      api.endpoint = "https://scrutiny.pvv.ntnu.no/";
+    };
+  };
+}

flake.lock

@@ -161,6 +161,27 @@
         "url": "https://git.pvv.ntnu.no/Grzegorz/grzegorz-clients.git"
       }
     },
+    "libdib": {
+      "inputs": {
+        "nixpkgs": [
+          "worblehat",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769338528,
+        "narHash": "sha256-t18ZoSt9kaI1yde26ok5s7aFLkap1Q9+/2icVh2zuaE=",
+        "ref": "refs/heads/main",
+        "rev": "7218348163fd8d84df4a6f682c634793e67a3fed",
+        "revCount": 13,
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/libdib.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/libdib.git"
+      }
+    },
     "matrix-next": {
       "inputs": {
         "nixpkgs": [
@@ -309,6 +330,27 @@
         "url": "https://nixos.org/channels/nixos-unstable-small/nixexprs.tar.xz"
       }
     },
+    "passwd2systemd-users": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1780764154,
+        "narHash": "sha256-Xvf9aBNLYDnbDKdtFjp5GEA/rZwVczHZWbJ0hac8Vv4=",
+        "ref": "main",
+        "rev": "8b4541be73ee3bd6c60525b2f42605efe89398c9",
+        "revCount": 14,
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git"
+      }
+    },
     "pvv-calendar-bot": {
       "inputs": {
         "nixpkgs": [
@@ -337,11 +379,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778960428,
+        "lastModified": 1779903528,
-        "narHash": "sha256-YAs3LbFGlBLJW3xHeoQfTq2GBBXTvuSKl2WXDtloczU=",
+        "narHash": "sha256-4rajaHeBeQ4PjbNSpslE9G3A5mZM1J/64ls+VoufWZo=",
         "ref": "main",
-        "rev": "927748790b1f7159adfe32a3ad9ec01d22e9c5a2",
+        "rev": "bba7413a1c611d4918fbef4d3aa55e465ca3f3fb",
-        "revCount": 583,
+        "revCount": 585,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       },
@@ -387,11 +429,13 @@
         "nix-topology": "nix-topology",
         "nixpkgs": "nixpkgs",
         "nixpkgs-unstable": "nixpkgs-unstable",
+        "passwd2systemd-users": "passwd2systemd-users",
         "pvv-calendar-bot": "pvv-calendar-bot",
         "pvv-nettsiden": "pvv-nettsiden",
         "qotd": "qotd",
         "roowho2": "roowho2",
-        "sops-nix": "sops-nix"
+        "sops-nix": "sops-nix",
+        "worblehat": "worblehat"
       }
     },
     "roowho2": {
@@ -522,6 +566,28 @@
         "repo": "sops-nix",
         "type": "github"
       }
+    },
+    "worblehat": {
+      "inputs": {
+        "libdib": "libdib",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1773932847,
+        "narHash": "sha256-IklIAdlonrmO8/lkDxNIVz9+ORL4pcVotMTxeyvxzoc=",
+        "ref": "main",
+        "rev": "0871a319f51d3cb0d1abb5b11edb768b39906d3f",
+        "revCount": 104,
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/worblehat.git"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -23,6 +23,9 @@
     dibbler.url = "git+https://git.pvv.ntnu.no/Projects/dibbler.git?ref=main";
     dibbler.inputs.nixpkgs.follows = "nixpkgs";
 
+    worblehat.url = "git+https://git.pvv.ntnu.no/Projects/worblehat.git?ref=main";
+    worblehat.inputs.nixpkgs.follows = "nixpkgs";
+
     matrix-next.url = "github:dali99/nixos-matrix-modules/v0.8.0";
     matrix-next.inputs.nixpkgs.follows = "nixpkgs";
 
@@ -50,6 +53,8 @@
 
     bro.url = "git+https://git.pvv.ntnu.no/Projects/bro.git?ref=main";
     bro.inputs.nixpkgs.follows = "nixpkgs";
+    passwd2systemd-users.url = "git+https://git.pvv.ntnu.no/Projects/passwd2systemd-users.git?ref=main";
+    passwd2systemd-users.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs = {
@@ -92,6 +97,18 @@
           ];
       });
 
+    apps = forAllSystems (system: let
+      pkgs = nixpkgs.legacyPackages.${system};
+    in {
+      gitea-workflows = {
+        type = "app";
+        meta.description = "Run all gitea workflows locally";
+        program = toString (pkgs.writeShellScript "pvv-nixos-config-run-gitea-worflows" ''
+          ${lib.getExe pkgs.gitea-actions-runner} exec -i node:current-trixie
+        '');
+      };
+    });
+
     nixosConfigurations = let
       nixosConfig = nixpkgs: name: configurationPath: extraArgs @ {
         localSystem ? "x86_64-linux", # buildPlatform
@@ -187,6 +204,12 @@
             (final: prev: {
               inherit (self.packages.${prev.stdenv.hostPlatform.system}) out-of-your-element;
             })
+            (final: prev: {
+              # See https://git.pvv.ntnu.no/Drift/issues/issues/369
+              mjolnir = prev.mjolnir.override {
+                nodejs = prev.nodejs_22;
+              };
+            })
           ];
         };
         bekkalokk = stableNixosConfig "bekkalokk" {
@@ -210,16 +233,21 @@
         };
         skrot = stableNixosConfig "skrot" {
           modules = [
+            self.nixosModules.drumknotty
             inputs.disko.nixosModules.disko
-            inputs.dibbler.nixosModules.default
           ];
-          overlays = [inputs.dibbler.overlays.default];
+          overlays =
+          [
+            inputs.dibbler.overlays.default
+            inputs.worblehat.overlays.default
+          ];
         };
         shark = stableNixosConfig "shark" {};
         wenche = stableNixosConfig "wenche" {};
         temmie = stableNixosConfig "temmie" {
           overlays = [
             inputs.bro.overlays.default
+            inputs.passwd2systemd-users.overlays.default
           ];
           modules = [
             inputs.bro.nixosModules.default
@@ -284,6 +312,7 @@
       rsync-pull-targets = ./modules/rsync-pull-targets.nix;
       snakeoil-certs = ./modules/snakeoil-certs.nix;
       snappymail = ./modules/snappymail.nix;
+      drumknotty = ./modules/drumknotty;
     };
 
     devShells = forAllSystems (system: {

hosts/bekkalokk/configuration.nix

@@ -7,6 +7,7 @@
 
     ./services/alps.nix
     ./services/bluemap.nix
+    ./services/radicale.nix
     ./services/idp-simplesamlphp
     ./services/kerberos.nix
     ./services/mediawiki
@@ -24,8 +25,6 @@
     address = with values.hosts.bekkalokk; [ (ipv4 + "/25") (ipv6 + "/64") ];
   };
 
-  services.btrfs.autoScrub.enable = true;
-
   # Don't change (even during upgrades) unless you know what you are doing.
   # See https://search.nixos.org/options?show=system.stateVersion
   system.stateVersion = "25.11";

hosts/bekkalokk/services/mediawiki/default.nix

@@ -107,6 +107,7 @@ in {
         CodeEditor
         CodeMirror
         DeleteBatch
+        PdfHandler
         PluggableAuth
         Popups
         Scribunto
@@ -181,12 +182,17 @@ in {
       ];
 
       # Misc program paths
-      $wgFFmpegLocation = '${pkgs.ffmpeg}/bin/ffmpeg';
+      $wgFFmpegLocation = '${lib.getExe pkgs.ffmpeg}';
-      $wgExiftool = '${pkgs.exiftool}/bin/exiftool';
+      $wgExiftool = '${lib.getExe pkgs.exiftool}';
-      $wgExiv2Command = '${pkgs.exiv2}/bin/exiv2';
+      $wgExiv2Command = '${lib.getExe pkgs.exiv2}';
       # See https://gist.github.com/sergejmueller/088dce028b6dd120a16e
-      $wgJpegTran = '${pkgs.mozjpeg}/bin/jpegtran';
+      $wgJpegTran = '${lib.getExe' pkgs.mozjpeg "jpegtran"}';
-      $wgGitBin = '${pkgs.git}/bin/git';
+      $wgGitBin = '${lib.getExe pkgs.git}';
+      $wgDiff3 = '${lib.getExe' pkgs.diffutils "diff3"}';
+      $wgDiff = '${lib.getExe' pkgs.diffutils "diff"}';
+
+      $wgUseImageMagick = true;
+      $wgImageMagickConvertCommand = '${lib.getExe pkgs.imagemagick}';
 
       # Debugging
       $wgShowExceptionDetails = false;
@@ -211,6 +217,13 @@ in {
       # EXT:WikiEditor
       $wgWikiEditorRealtimePreview = true;
 
+      # EXT:PdfHandler
+      $wgPdfProcessor = '${lib.getExe pkgs.ghostscript_headless}';
+      $wgPdfPostProcessor = $wgImageMagickConvertCommand;
+      $wgPdfInfo = '${lib.getExe' pkgs.poppler-utils "pdfinfo"}';
+      $wgPdftoText = '${lib.getExe' pkgs.poppler-utils "pdftotext"}';
+
+      # Override key from hardcoded config in nixpkgs
       $wgSecretKey = file_get_contents("${config.sops.secrets."mediawiki/secret-key".path}");
     '';
   };

hosts/bekkalokk/services/radicale.nix

@@ -0,0 +1,40 @@
+{ config, lib, ... }:
+let
+  domain = "dav.pvv.ntnu.no";
+  radicalePort = 5232;
+in {
+  services.radicale = {
+    enable = true;
+
+    settings = {
+      server = {
+        hosts = [ "127.0.0.1:${toString radicalePort}" ];
+      };
+
+      auth = {
+        type = "imap";
+        imap_host = "imap.pvv.ntnu.no";
+        imap_security = "tls";
+      };
+
+      storage = {
+        filesystem_folder = "/var/lib/radicale/collections";
+      };
+    };
+  };
+
+  services.nginx.virtualHosts."${domain}" = {
+    forceSSL = true;
+    enableACME = true;
+    kTLS = true;
+
+    extraConfig = ''
+      client_max_body_size 128M;
+    '';
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString radicalePort}";
+      proxyWebsockets = true;
+    };
+  };
+}

hosts/bekkalokk/services/webmail/default.nix

@@ -10,8 +10,9 @@
     enableACME = true;
     kTLS = true;
     locations = {
-      "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
+      # "= /".return = "302 https://webmail.pvv.ntnu.no/roundcube";
 
+      "/roundcube".return = "302 https://webmail.pvv.ntnu.no/";
       "/afterlogic_lite".return = "302 https://webmail.pvv.ntnu.no/roundcube";
       "/squirrelmail".return = "302 https://webmail.pvv.ntnu.no/roundcube";
       "/rainloop".return = "302 https://snappymail.pvv.ntnu.no/";

hosts/bekkalokk/services/webmail/roundcube.nix

@@ -29,7 +29,7 @@ in
 
     dicts = with pkgs.aspellDicts; [ en en-computers nb nn fr de it ];
     maxAttachmentSize = 20;
-    hostName = "roundcubeplaceholder.example.com";
+    hostName = domain;
 
     database = {
       host = "postgres.pvv.ntnu.no";
@@ -49,44 +49,9 @@ in
     '';
   };
 
-  services.nginx.virtualHosts."roundcubeplaceholder.example.com" = lib.mkForce { };
+  # TODO: move this back to `webmail.pvv.ntnu.no/roundcube` subpath
 
   services.nginx.virtualHosts.${domain} = {
     kTLS = true;
-    locations."/roundcube" = {
-      tryFiles = "$uri $uri/ =404";
-      index = "index.php";
-      root = pkgs.runCommandLocal "roundcube-dir" { } ''
-        mkdir -p $out
-        ln -s ${cfg.package} $out/roundcube
-      '';
-      extraConfig = ''
-        location ~ ^/roundcube/(${builtins.concatStringsSep "|" [
-        # https://wiki.archlinux.org/title/Roundcube
-        "README"
-        "INSTALL"
-        "LICENSE"
-        "CHANGELOG"
-        "UPGRADING"
-        "bin"
-        "SQL"
-        ".+\\.md"
-        "\\."
-        "config"
-        "temp"
-        "logs"
-        ]})/? {
-          deny all;
-        }
-
-        location ~ ^/roundcube/(.+\.php)(/?.*)$ {
-          fastcgi_split_path_info ^/roundcube(/.+\.php)(/.+)$;
-          include ${config.services.nginx.package}/conf/fastcgi_params;
-          include ${config.services.nginx.package}/conf/fastcgi.conf;
-          fastcgi_index index.php;
-          fastcgi_pass unix:${config.services.phpfpm.pools.roundcube.socket};
-        }
-      '';
-    };
   };
 }

hosts/bekkalokk/services/website/default.nix

@@ -119,6 +119,7 @@ in {
   services.nginx.virtualHosts."pvv.ntnu.no" = {
     globalRedirect = cfg.domainName;
     redirectCode = 307;
+    kTLS = true;
     forceSSL = true;
     useACMEHost = "www.pvv.ntnu.no";
   };
@@ -126,6 +127,7 @@ in {
   services.nginx.virtualHosts."www.pvv.org" = {
     globalRedirect = cfg.domainName;
     redirectCode = 307;
+    kTLS = true;
     forceSSL = true;
     useACMEHost = "www.pvv.ntnu.no";
   };
@@ -133,11 +135,13 @@ in {
   services.nginx.virtualHosts."pvv.org" = {
     globalRedirect = cfg.domainName;
     redirectCode = 307;
+    kTLS = true;
     forceSSL = true;
     useACMEHost = "www.pvv.ntnu.no";
   };
 
   services.nginx.virtualHosts.${cfg.domainName} = {
+    kTLS = true;
     locations = {
       # Proxy home directories
       "^~ /~" = {

hosts/bekkalokk/services/website/fetch-gallery.nix

@@ -37,47 +37,56 @@ in {
   };
 
   systemd.services.pvv-nettsiden-gallery-update = {
-    path = with pkgs; [ imagemagick gnutar gzip ];
-
-    script = ''
-      tar ${lib.cli.toCommandLineShellGNU { } {
-        extract = true;
-        file = "${transferDir}/gallery.tar.gz";
-        directory = ".";
-      }}
-
-      # Delete files and directories that exists in the gallery that don't exist in the tarball
-      filesToRemove=$(uniq -u <(sort <(find . -not -path './.thumbnails*') <(tar -tf '${transferDir}/gallery.tar.gz' | sed 's|/$||')))
-      while IFS= read -r fname; do
-        rm -f "$fname" ||:
-        rm -f ".thumbnails/$fname.png" ||:
-      done <<< "$filesToRemove"
-
-      find . -type d -empty -delete
-
-      mkdir -p .thumbnails
-      images=$(find . -type f -not -path './.thumbnails*')
-
-      while IFS= read -r fname; do
-        # Skip this file if an up-to-date thumbnail already exists
-        if [ -f ".thumbnails/$fname.png" ] && \
-          [ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
-        then
-          continue
-        fi
-
-        echo "Creating thumbnail for $fname"
-        mkdir -p "$(dirname ".thumbnails/$fname")"
-        magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
-        touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
-      done <<< "$images"
-    '';
-
     serviceConfig = {
       WorkingDirectory = galleryDir;
       User = config.services.pvv-nettsiden.user;
       Group = config.services.pvv-nettsiden.group;
 
+      ExecStart = lib.getExe (pkgs.writeShellApplication {
+        name = "pvv-nettsiden-gallery-update-exec-start.sh";
+        runtimeInputs = with pkgs; [
+          coreutils
+          findutils
+          gnused
+          gnutar
+          gzip
+          imagemagick
+        ];
+        text = ''
+          tar ${lib.cli.toCommandLineShellGNU { } {
+            extract = true;
+            file = "${transferDir}/gallery.tar.gz";
+            directory = ".";
+          }}
+
+          # Delete files and directories that exists in the gallery that don't exist in the tarball
+          filesToRemove="$(uniq -u <(sort <(find . -not -path './.thumbnails*') <(tar -tf '${transferDir}/gallery.tar.gz' | sed 's|/$||')))"
+          while IFS= read -r fname; do
+            rm -f "$fname" ||:
+            rm -f ".thumbnails/$fname.png" ||:
+          done <<< "$filesToRemove"
+
+          find . -type d -empty -delete
+
+          mkdir -p .thumbnails
+          images="$(find . -type f -not -path './.thumbnails*')"
+
+          while IFS= read -r fname; do
+            # Skip this file if an up-to-date thumbnail already exists
+            if [ -f ".thumbnails/$fname.png" ] && \
+              [ "$(date -R -r "$fname")" == "$(date -R -r ".thumbnails/$fname.png")" ]
+            then
+              continue
+            fi
+
+            echo "Creating thumbnail for $fname"
+            mkdir -p "$(dirname ".thumbnails/$fname")"
+            magick -define jpeg:size=200x200 "$fname" -thumbnail 300 -auto-orient ".thumbnails/$fname.png" ||:
+            touch -m -d "$(date -R -r "$fname")" ".thumbnails/$fname.png"
+          done <<< "$images"
+        '';
+      });
+
       AmbientCapabilities = [ "" ];
       CapabilityBoundingSet = [ "" ];
       DeviceAllow = [ "" ];

hosts/bicep/services/git-mirrors/default.nix

@@ -83,6 +83,7 @@ in
   };
 
   services.nginx.virtualHosts."mirrors.pvv.ntnu.no" = {
+    kTLS = true;
     forceSSL = true;
     enableACME = true;
 

hosts/bicep/services/matrix/hookshot/default.nix

@@ -22,6 +22,7 @@ in
   sops.templates."hookshot-registration.yaml" = {
     owner = config.users.users.matrix-synapse.name;
     group = config.users.groups.keys-matrix-registrations.name;
+    mode = "0440";
     restartUnits = [ "matrix-hookshot.service" ];
     content = ''
       id: matrix-hookshot
@@ -49,12 +50,59 @@ in
 
   systemd.services.matrix-hookshot = {
     serviceConfig = {
+      DynamicUser = true;
       SupplementaryGroups = [
         config.users.groups.keys-matrix-registrations.name
       ];
       LoadCredential = [
         "passkey.pem:${config.sops.secrets."matrix/hookshot/passkey".path}"
       ];
+
+      RuntimeDirectory = [ "matrix-hookshot/root-mnt" ];
+      RootDirectory = "/run/matrix-hookshot/root-mnt";
+      BindReadOnlyPaths = [
+        config.sops.templates."hookshot-registration.yaml".path
+        builtins.storeDir
+        "/etc"
+        "/run/nscd"
+        "/var/run/nscd"
+      ];
+
+      AmbientCapabilities = "";
+      CapabilityBoundingSet = "";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = false; # node needs this
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateMounts = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      RemoveIPC = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+        "~@resources"
+      ];
+      UMask = "0077";
     };
   };
 
@@ -146,6 +194,7 @@ in
   };
 
   services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
+    kTLS = true;
     enableACME = true;
     addSSL = true;
     locations."/" = {

hosts/bicep/services/matrix/mjolnir.nix

@@ -54,4 +54,53 @@
     # TODO: Fix upstream module in nixpkgs
     pantalaimon.username = "bot_admin";
   };
+
+  systemd.services.mjolnir.serviceConfig = {
+    DynamicUser = true;
+    RuntimeDirectory = [ "mjolnir/root-mnt" ];
+    RootDirectory = "/run/mjolnir/root-mnt";
+    BindReadOnlyPaths = [
+      config.sops.secrets."matrix/mjolnir/access_token".path
+      builtins.storeDir
+      "/etc"
+      "/run/nscd"
+      "/var/run/nscd"
+    ];
+
+    AmbientCapabilities = "";
+    CapabilityBoundingSet = "";
+    LockPersonality = true;
+    MemoryDenyWriteExecute = false; # node needs this
+    NoNewPrivileges = true;
+    PrivateDevices = true;
+    PrivateMounts = true;
+    PrivateTmp = true;
+    PrivateUsers = true;
+    ProcSubset = "pid";
+    ProtectClock = true;
+    ProtectControlGroups = true;
+    ProtectHome = true;
+    ProtectHostname = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    ProtectSystem = "strict";
+    RemoveIPC = true;
+    RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+      "AF_UNIX"
+    ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    SystemCallFilter = [
+      "@system-service"
+      "~@privileged"
+      "~@resources"
+    ];
+    UMask = "0077";
+  };
 }

hosts/bicep/services/matrix/out-of-your-element.nix

@@ -56,6 +56,55 @@ in
     enableSynapseIntegration = false;
   };
 
+  systemd.services."matrix-ooye" = {
+    serviceConfig = {
+      RuntimeDirectory = [ "matrix-ooye/root-mnt" ];
+      RootDirectory = "/run/matrix-ooye/root-mnt";
+      BindReadOnlyPaths = [
+        builtins.storeDir
+        "/etc"
+        "/run/nscd"
+        "/var/run/nscd"
+      ];
+
+      AmbientCapabilities = "";
+      CapabilityBoundingSet = "";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = false; # node needs this
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateMounts = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      RemoveIPC = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+        "~@resources"
+      ];
+      UMask = "0077";
+    };
+  };
+
   systemd.services."matrix-synapse" = {
     after = [
       "matrix-ooye-pre-start.service"
@@ -80,6 +129,7 @@ in
   };
 
   services.nginx.virtualHosts."ooye.pvv.ntnu.no" = {
+    kTLS = true;
     forceSSL = true;
     enableACME = true;
     locations."/".proxyPass = "http://localhost:${cfg.socket}";

hosts/bicep/services/minecraft-heatmap.nix

@@ -23,27 +23,28 @@ in
   };
 
   systemd.services.minecraft-heatmap-ingest-logs = lib.mkIf cfg.enable {
-    serviceConfig.LoadCredential = [
+    serviceConfig = {
-      "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
+      LoadCredential = [
-    ];
+        "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}"
-
+      ];
-    preStart = let
+      ExecStartPre = let
-      knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
+        knownHostsFile = pkgs.writeText "minecraft-heatmap-known-hosts" ''
-        innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
+          innovation.pvv.ntnu.no ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE9O/y5uqcLKCodg2Q+XfZPH/AoUIyBlDhigImU+4+Kn
-        innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
+          innovation.pvv.ntnu.no ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClR9GvWeVPZHudlnFXhGHUX5sGX9nscsOsotnlQ4uVuGsgvRifsVsuDULlAFXwoV1tYp4vnyXlsVtMddpLI5ANOIDcZ4fgDxpfSQmtHKssNpDcfMhFJbfRVyacipjA4osxTxvLox/yjtVt+URjTHUA1MWzEwc26KfiOvWO5tCBTan7doN/4KOyT05GwBxwzUAwUmoGTacIITck2Y9qp4+xFYqehbXqPdBb15hFyd38OCQhtU1hWV2Yi18+hJ4nyjc/g5pr6mW09ULlFghe/BaTUXrTisYC6bMcJZsTDwsvld9581KPvoNZOTQhZPTEQCZZ1h54fe0ZHuveVB3TIHovZyjoUuaf4uiFOjJVaKRB+Ig+Il6r7tMUn9CyHtus/Nd86E0TFBzoKxM0OFu88oaUlDtZVrUJL5En1lGoimajebb1JPxllFN5hqIT+gVyMY6nRzkcfS7ieny/U4rzXY2rfz98selftgh3LsBywwADv65i+mPw1A/1QdND1R6fV4U=
-        innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
+          innovation.pvv.ntnu.no ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNjl3HfsDqmALWCL9uhz9k93RAD2565ndBqUh4N/rvI7MCwEJ6iRCdDev0YzB1Fpg24oriyYoxZRP24ifC2sQf8=
-      '';
+        '';
-    in ''
+        rsyncArgs = lib.cli.toCommandLineShellGNU { } {
-      mkdir -p '${cfg.minecraftLogsDir}'
+          archive = true;
-      "${lib.getExe pkgs.rsync}" \
+          verbose = true;
-      --archive \
+          progress = true;
-      --verbose \
+          no-owner = true;
-      --progress \
+          no-group = true;
-      --no-owner \
+        };
-      --no-group \
+        sshCommand = ''${pkgs.openssh}/bin/ssh -o UserKnownHostsFile='${knownHostsFile}' -i \"$CREDENTIALS_DIRECTORY\"/sshkey'';
-      --rsh="${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=\"${knownHostsFile}\" -i \"$CREDENTIALS_DIRECTORY\"/sshkey" \
+      in [
-      root@innovation.pvv.ntnu.no:/ \
+        "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.minecraftLogsDir}'"
-      '${cfg.minecraftLogsDir}'/
+        "${lib.getExe pkgs.rsync} ${rsyncArgs} --rsh=\"${sshCommand}\" root@innovation.pvv.ntnu.no:/ '${cfg.minecraftLogsDir}'/"
-    '';
+      ];
+    };
   };
 }

hosts/bicep/services/mysql/default.nix

@@ -23,6 +23,9 @@ in
         bind-address = values.services.mysql.ipv4;
         skip-networking = 0;
 
+        # Useful for the mysqld prometheus exporter
+        userstat = 1;
+
         # This was needed in order to be able to use all of the old users
         # during migration from knakelibrak to bicep in Sep. 2023
         secure_auth = 0;
@@ -71,4 +74,16 @@ in
       ];
     };
   };
+
+  services.logrotate = lib.mkIf (cfg.settings.mysqld.slow-query-log == 1) {
+    enable = true;
+    settings.mysql-slowlog = {
+      files = [ cfg.settings.mysqld.slow-query-log-file ];
+      frequency = "weekly";
+      rotate = 12;
+      create = "0660 mysql mysql";
+      minsize = "1M";
+      compress = true;
+    };
+  };
 }

hosts/bikkje/configuration.nix

@@ -29,7 +29,29 @@
         firewall = {
           enable = true;
           # Allow SSH and HTTP and ports for email and irc
-          allowedTCPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
+          allowedTCPPorts = [
+            22 # SSH
+            80 # HTTP
+
+            # IRC
+            194 # IRC
+            994 # IRC (TLS)
+            6697 # IRC (SSL)
+            6665
+            6666
+            6667
+            6668
+            6669
+
+            # EMAIL
+            25  # STMP
+            465 # STMP (SSL)
+            587 # STMP (TLS/STARTTLS)
+            110 # POP3
+            995 # POP3 (SSL/TLS)
+            143 # IMAP
+            993 # IMAP (SSL/TLS)
+          ];
           allowedUDPPorts = [ 80 22 194 994 6665 6666 6667 6668 6669 6697 995 993 25 465 587 110 143 993 995 ];
         };
         # Use systemd-resolved inside the container

hosts/ildkule/services/monitoring/default.nix

@@ -5,6 +5,7 @@
     ./grafana.nix
     ./loki.nix
     ./prometheus
+    ./scrutiny.nix
     ./uptime-kuma.nix
   ];
 }

hosts/ildkule/services/monitoring/prometheus/exim.nix

@@ -1,14 +1,12 @@
 { ... }:
 {
-  services.prometheus = {
+  services.prometheus.scrapeConfigs = [{
-    scrapeConfigs = [
+    job_name = "exim";
-      {
+    scrape_interval = "15s";
-        job_name = "exim";
+    scheme = "http";
-        scrape_interval = "15s";
+
-        static_configs = [{
+    static_configs = [{
-          targets = [ "microbel.pvv.ntnu.no:9636" ];
+      targets = [ "microbel.pvv.ntnu.no:9636" ];
-        }];
+    }];
-      }
+  }];
-    ];
-  };
 }

hosts/ildkule/services/monitoring/scrutiny.nix

@@ -0,0 +1,40 @@
+{ config, values, ... }:
+let
+  cfg = config.services.scrutiny;
+in
+{
+  services.scrutiny = {
+    enable = true;
+    settings = {
+      web.listen = {
+        host = "127.0.0.1";
+        port = 18293;
+        basepath = "";
+      };
+
+      # notify.urls = [
+      #   "matrix://username:password@host:port/[?rooms=!roomID1[,roomAlias2]]"
+      # ];
+    };
+  };
+
+  services.nginx.virtualHosts."scrutiny.pvv.ntnu.no" = {
+    kTLS = true;
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://${cfg.settings.web.listen.host}:${toString cfg.settings.web.listen.port}";
+    };
+
+    # TODO: allow website access to the outside world, but restrict input api
+    extraConfig = ''
+      allow ${values.hosts.ildkule.ipv4}/32;
+      allow ${values.hosts.ildkule.ipv6}/128;
+      allow 127.0.0.1/32;
+      allow ::1/128;
+      allow ${values.ipv4-space};
+      allow ${values.ipv6-space};
+      deny all;
+    '';
+  };
+}

hosts/kommode/configuration.nix

@@ -15,8 +15,6 @@
     address = with values.hosts.kommode; [ (ipv4 + "/25") (ipv6 + "/64") ];
   };
 
-  services.btrfs.autoScrub.enable = true;
-
   services.qemuGuest.enable = true;
 
   # Don't change (even during upgrades) unless you know what you are doing.

hosts/kommode/services/gitea/customization/default.nix

@@ -72,50 +72,52 @@ in
       Type = "oneshot";
       User = cfg.user;
       Group = cfg.group;
+      PrivateNetwork = true;
+
+      ExecStart = let
+        logo-svg = fp /assets/logo_blue_regular.svg;
+        logo-png = fp /assets/logo_blue_regular.png;
+
+        extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
+          <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
+        '';
+
+        extraLinksFooter = pkgs.writeText "gitea-extra-links-footer.tmpl" ''
+          <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
+          <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
+          <a class="item" href="https://wiki.pvv.ntnu.no/wiki/Tjenester/Kodelager">PVV Gitea Howto</a>
+        '';
+
+        project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
+          labels = lib.importJSON ./labels/projects.json;
+        };
+
+        customTemplates = pkgs.runCommandLocal "gitea-templates" {
+          nativeBuildInputs = with pkgs; [
+            coreutils
+            gnused
+          ];
+        } ''
+          # Bigger icons
+          install -Dm444 '${cfg.package.src}/templates/repo/icon.tmpl' "$out/repo/icon.tmpl"
+          sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
+        '';
+        install = lib.getExe' pkgs.coreutils "install";
+      in [
+        "${install} -Dm444 '${logo-svg}' '${cfg.customDir}/public/assets/img/logo.svg'"
+        "${install} -Dm444 '${logo-png}' '${cfg.customDir}/public/assets/img/logo.png'"
+        "${install} -Dm444 '${./loading.apng}' '${cfg.customDir}/public/assets/img/loading.png'"
+        "${install} -Dm444 '${extraLinks}' '${cfg.customDir}/templates/custom/extra_links.tmpl'"
+        "${install} -Dm444 '${extraLinksFooter}' '${cfg.customDir}/templates/custom/extra_links_footer.tmpl'"
+        "${install} -Dm444 '${project-labels}' '${cfg.customDir}/options/label/project-labels.yaml'"
+
+        "${install} -Dm644 '${./emotes/bruh.png}' '${cfg.customDir}/public/assets/img/emoji/bruh.png'"
+        "${install} -Dm644 '${./emotes/huh.gif}' '${cfg.customDir}/public/assets/img/emoji/huh.png'"
+        "${install} -Dm644 '${./emotes/grr.png}' '${cfg.customDir}/public/assets/img/emoji/grr.png'"
+        "${install} -Dm644 '${./emotes/okiedokie.jpg}' '${cfg.customDir}/public/assets/img/emoji/okiedokie.png'"
+
+        "${lib.getExe pkgs.rsync} -a '${customTemplates}/' '${cfg.customDir}/templates/'"
+      ];
     };
-
-    script = let
-      logo-svg = fp /assets/logo_blue_regular.svg;
-      logo-png = fp /assets/logo_blue_regular.png;
-
-      extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
-        <a class="item" href="https://git.pvv.ntnu.no/Drift/-/projects/4">Tokyo Drift Issues</a>
-      '';
-
-      extraLinksFooter = pkgs.writeText "gitea-extra-links-footer.tmpl" ''
-        <a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
-        <a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
-        <a class="item" href="https://wiki.pvv.ntnu.no/wiki/Tjenester/Kodelager">PVV Gitea Howto</a>
-      '';
-
-      project-labels = (pkgs.formats.yaml { }).generate "gitea-project-labels.yaml" {
-        labels = lib.importJSON ./labels/projects.json;
-      };
-
-      customTemplates = pkgs.runCommandLocal "gitea-templates" {
-        nativeBuildInputs = with pkgs; [
-          coreutils
-          gnused
-        ];
-      } ''
-        # Bigger icons
-        install -Dm444 '${cfg.package.src}/templates/repo/icon.tmpl' "$out/repo/icon.tmpl"
-        sed -i -e 's/24/60/g' "$out/repo/icon.tmpl"
-      '';
-    in ''
-      install -Dm444 '${logo-svg}' '${cfg.customDir}/public/assets/img/logo.svg'
-      install -Dm444 '${logo-png}' '${cfg.customDir}/public/assets/img/logo.png'
-      install -Dm444 '${./loading.apng}' '${cfg.customDir}/public/assets/img/loading.png'
-      install -Dm444 '${extraLinks}' '${cfg.customDir}/templates/custom/extra_links.tmpl'
-      install -Dm444 '${extraLinksFooter}' '${cfg.customDir}/templates/custom/extra_links_footer.tmpl'
-      install -Dm444 '${project-labels}' '${cfg.customDir}/options/label/project-labels.yaml'
-
-      install -Dm644 '${./emotes/bruh.png}' '${cfg.customDir}/public/assets/img/emoji/bruh.png'
-      install -Dm644 '${./emotes/huh.gif}' '${cfg.customDir}/public/assets/img/emoji/huh.png'
-      install -Dm644 '${./emotes/grr.png}' '${cfg.customDir}/public/assets/img/emoji/grr.png'
-      install -Dm644 '${./emotes/okiedokie.jpg}' '${cfg.customDir}/public/assets/img/emoji/okiedokie.png'
-
-      '${lib.getExe pkgs.rsync}' -a '${customTemplates}/' '${cfg.customDir}/templates/'
-    '';
   };
 }

hosts/kommode/services/gitea/default.nix

@@ -139,6 +139,9 @@ in {
         AVATAR_MAX_ORIGIN_SIZE = 1024 * 1024 * 2;
       };
       actions.ENABLED = true;
+      webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," [
+        "external"
+      ];
     };
 
     dump = {

hosts/kommode/services/gitea/gpg.nix

@@ -38,11 +38,11 @@ in
       Type = "oneshot";
       User = cfg.user;
       PrivateNetwork = true;
+      ExecStart = [
+        "${lib.getExe pkgs.gnupg} --import '${config.sops.secrets."gitea/gpg-signing-key-public".path}'"
+        "${lib.getExe pkgs.gnupg} --import '${config.sops.secrets."gitea/gpg-signing-key-private".path}'"
+      ];
     };
-    script = ''
-      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-public".path}
-      ${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key-private".path}
-    '';
   };
 
   services.gitea.settings."repository.signing" = {

hosts/kommode/services/gitea/import-users/default.nix

@@ -11,9 +11,9 @@ in
 
   systemd.services.gitea-import-users = lib.mkIf cfg.enable {
     enable = true;
-    preStart=''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
     environment.PASSWD_FILE_PATH = "/run/gitea-import-users/passwd";
     serviceConfig = {
+      ExecStartPre = ''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd'';
       ExecStart = pkgs.writers.writePython3 "gitea-import-users" {
         flakeIgnore = [
           "E501" # Line over 80 chars lol

hosts/lupine/configuration.nix

@@ -9,6 +9,12 @@
 
   sops.defaultSopsFile = fp /secrets/lupine/lupine.yaml;
 
+  boot.binfmt.emulatedSystems = [
+    "aarch64-linux"
+    "armv7l-linux"
+    "i686-linux"
+  ];
+
   systemd.network.networks."30-enp0s31f6" = values.defaultNetworkConfig // {
     matchConfig.Name = "enp0s31f6";
     address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
@@ -18,9 +24,6 @@
     anyInterface = true;
   };
 
-  # There are no smart devices
-  services.smartd.enable = false;
-
   # Don't change (even during upgrades) unless you know what you are doing.
   # See https://search.nixos.org/options?show=system.stateVersion
   system.stateVersion = "25.05";

hosts/skrot/configuration.nix

@@ -28,26 +28,52 @@
 
   sops.secrets = {
     "dibbler/postgresql/password" = {
-      owner = "dibbler";
+      owner = "drumknotty";
-      group = "dibbler";
+      group = "drumknotty";
+    };
+    "worblehat/postgresql/password" = {
+      owner = "drumknotty";
+      group = "drumknotty";
     };
   };
 
-  services.dibbler = {
+  services.drumknotty = {
     enable = true;
     kioskMode = true;
-    limitScreenWidth = 80;
-    limitScreenHeight = 42;
 
-    settings = {
+    screen = {
-      general.quit_allowed = false;
+      limitWidth = 80;
-      database = {
+      limitHeight = 42;
-        type = "postgresql";
+    };
-        postgresql = {
+
-          username = "pvv_vv";
+    dibbler = {
-          dbname = "pvv_vv";
+      enable = true;
-          host = "postgres.pvv.ntnu.no";
+      settings = {
-          password_file = config.sops.secrets."dibbler/postgresql/password".path;
+        general.quit_allowed = false;
+        database = {
+          type = "postgresql";
+          postgresql = {
+            username = "pvv_vv";
+            dbname = "pvv_vv";
+            host = "postgres.pvv.ntnu.no";
+            password_file = config.sops.secrets."dibbler/postgresql/password".path;
+          };
+        };
+      };
+    };
+
+    worblehat = {
+      enable = true;
+      settings = {
+        general.quit_allowed = false;
+        database = {
+          type = "postgresql";
+          postgresql = {
+            username = "worblehat";
+            dbname = "worblehat";
+            host = "postgres.pvv.ntnu.no";
+            password = config.sops.secrets."worblehat/postgresql/password".path;
+          };
         };
       };
     };

hosts/temmie/services/userweb/default.nix

@@ -130,6 +130,9 @@ let
       file
       findutils
       gawk
+      glibc.getent
+      strace
+      systemd
       gnugrep
       gnumake
       gnupg
@@ -154,6 +157,11 @@ in
     ./mail.nix
   ];
 
+  sops.secrets = {
+    "httpd/passwd-ssh-key" = { };
+    "httpd/ssh-known-hosts" = { };
+  };
+
   services.httpd = {
     enable = true;
     adminAddr = "drift@pvv.ntnu.no";
@@ -276,17 +284,60 @@ in
     serviceConfig = {
       Type = lib.mkForce "notify";
 
+      ExecStartPre = let
+        rsyncCommand = ''${lib.getExe pkgs.rsync} -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=%d/ssh-known-hosts -i %d/sshkey" -avz'';
+      in lib.mkForce [
+        "${lib.getExe (pkgs.writeShellApplication {
+          name = "http-exec-start-pre-remove-old-semaphores";
+          text = ''
+            # Get rid of old semaphores.  These tend to accumulate across
+            # server restarts, eventually preventing it from restarting
+            # successfully.
+            for i in $(${pkgs.util-linux}/bin/ipcs -s | grep ' ${cfg.user} ' | cut -f2 -d ' '); do
+                ${pkgs.util-linux}/bin/ipcrm -s "$i"
+            done
+          '';
+        })}"
+        # "${pkgs.systemd}/bin/resolvectl query smtp.pvv.ntnu.no"
+        "${pkgs.strace}/bin/strace ${pkgs.glibc.getent}/bin/getent ahosts smtp.pvv.ntnu.no"
+        "${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/passwd /run/httpd/pamunix-sync/"
+        "${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/group /run/httpd/pamunix-sync/"
+        # "+|echo 'wwwrun:x:54:54:Apache httpd user:/var/empty:/run/current-system/sw/bin/nologin' >> /run/httpd/pamunix-sync/passwd"
+        # "+|echo 'root:x:0:0:System administrator:/root:/run/current-system/sw/bin/bash' >> /run/httpd/pamunix-sync/passwd"
+        # "+|echo 'wwwrun:x:54:' >> /run/httpd/pamunix-sync/group"
+        # "${rsyncCommand} pvv@smtp.pvv.ntnu.no:/etc/shadow /run/httpd/pamunix-sync/"
+        (let
+          args = lib.cli.toCommandLineShellGNU { } {
+            passwd-file = "/run/httpd/pamunix-sync/passwd";
+            group-file = "/run/httpd/pamunix-sync/group";
+            output-dir = "/run/httpd/systemd-userdb";
+            shadow-file = pkgs.emptyFile;
+
+            output-passwd = true;
+
+            ignore-user-file = toString ./ignore_user_file.txt;
+            ignore-group-file = toString ./ignore_group_file.txt;
+          };
+        in ''${lib.getExe pkgs.passwd2systemd-users} ${args}'')
+        "${lib.getExe' pkgs.coreutils "shred"} -u /run/httpd/pamunix-sync/passwd /run/httpd/pamunix-sync/group"
+      ];
       ExecStart = lib.mkForce "${cfg.package}/bin/httpd -D FOREGROUND -f /etc/httpd/httpd.conf -k start";
       ExecReload = lib.mkForce "${cfg.package}/bin/httpd -f /etc/httpd/httpd.conf -k graceful";
       ExecStop = lib.mkForce "";
       KillMode = "mixed";
 
+      LoadCredential=[
+        "sshkey:${config.sops.secrets."httpd/passwd-ssh-key".path}"
+        "ssh-known-hosts:${config.sops.secrets."httpd/ssh-known-hosts".path}"
+      ];
+
       ConfigurationDirectory = [ "httpd" ];
       LogsDirectory = [ "httpd" ];
       LogsDirectoryMode = "0700";
 
-      CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+      AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_PTRACE" ];
-      LockPersonality = true;
+      CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_PTRACE" ];
+      # LockPersonality = true;
       PrivateDevices = true;
       PrivateTmp = true;
       # NOTE: this removes CAP_NET_BIND_SERVICE...
@@ -313,20 +364,45 @@ in
         "tcp:443"
       ];
       SystemCallArchitectures = "native";
-      SystemCallFilter = [
+      # SystemCallFilter = [
-         "@system-service"
+      #    "@system-service"
-      ];
+      # ];
       UMask = "0077";
 
-      RuntimeDirectory = [ "httpd/root-mnt" ];
+      RuntimeDirectory = [
+        "httpd/root-mnt"
+        "httpd/pamunix-sync"
+        "httpd/systemd-userdb"
+      ];
       RootDirectory = "/run/httpd/root-mnt";
       MountAPIVFS = true;
       BindReadOnlyPaths = [
         builtins.storeDir
         "/etc"
+        "/dev/null"
         # NCSD socket
-        "/var/run"
+        # "/var/run"
+        # "/var/run/systemd/resolve"
+        "/etc/resolv.conf"
         "/var/lib/acme"
+        "/run/httpd/systemd-userdb:/etc/userdb"
+        "${pkgs.writeText "userweb-fake-nsswitch.conf" ''
+          passwd:    systemd files
+          group:     systemd files
+          shadow:    systemd files
+          sudoers:   files
+
+          hosts:     mymachines resolve [!UNAVAIL=return] files myhostname dns
+          networks:  files
+
+          ethers:    files
+          services:  files
+          protocols: files
+          rpc:       files
+
+          subuid:    files
+          subgid:    files
+        ''}:/etc/nsswitch.conf"
 
         "${fhsEnv}/bin:/bin"
         "${fhsEnv}/sbin:/sbin"

hosts/temmie/services/userweb/ignore_group_file.txt

@@ -0,0 +1,91 @@
+Debian-exim
+_cvsadmin
+_ssh
+adm
+audio
+avahi
+backup
+bin
+cdrom
+cl-builder
+clamav
+clock
+colord
+courier
+crontab
+daemon
+debian-spamd
+dialout
+dip
+dirmngr
+disk
+dovecot
+fax
+floppy
+fuse
+games
+geoclue
+gnats
+input
+irc
+kmem
+kvm
+list
+lock
+lp
+lpadmin
+mail
+man
+messagebus
+mlocate
+munin
+netdev
+news
+nogroup
+ntp
+ntpsec
+oident
+opendkim
+operator
+plocate
+plugdev
+polkitd
+postdrop
+postfix
+postgres
+prometheus
+prometheus-exporter
+proxy
+rdma
+root
+# runit
+salt
+sambashare
+saned
+sasl
+scanner
+sgx
+shadow
+src
+ssl-cert
+staff
+stunnel4
+sudo
+sys
+systemd-coredump
+systemd-journal
+systemd-network
+systemd-resolve
+systemd-timesync
+tape
+tcpdump
+tty
+users
+utempter
+utmp
+uucp
+uuidd
+video
+voice
+winbindd_priv
+www-data

hosts/temmie/services/userweb/ignore_user_file.txt

@@ -0,0 +1,74 @@
+# System Users
+Debian-exim
+_apt
+_rpc
+avahi
+backup
+bin
+cl-builder
+clamav
+colord
+courier
+daemon
+debian-spamd
+debian-spamd
+dirmngr
+distccd
+dovecot
+dovenull
+driftsupport
+fetchmail
+games
+geoclue
+gitea
+gnats
+hplip
+irc
+list
+lp
+mail
+mail2news
+mailnews
+man
+messagebus
+munin
+news
+nobody
+noone
+ntp
+ntpsec
+oident
+opendkim
+polkitd
+postfix
+postgres
+prometheus
+prometheus-exporter
+proxy
+root
+rwhod
+salt
+saned
+spamd
+sshd
+statd
+stunnel4
+sync
+sys
+systemd-coredump
+systemd-network
+systemd-resolve
+systemd-timesync
+tcpdump
+uucp
+uuidd
+vaultwarden
+www-data
+
+# Misc
+nuccc04
+nuccc
+kybkokos
+kybkokos2
+testbruker2309
+testbruker2404

modules/drumknotty/default.nix

@@ -0,0 +1,198 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.drumknotty;
+in
+{
+  imports = [
+    ./dibbler.nix
+    ./worblehat.nix
+  ];
+
+  options.services.drumknotty = {
+    enable = lib.mkEnableOption "DrumknoTTY";
+
+    kioskMode = lib.mkEnableOption "" // {
+      description = ''
+        Whether to let dibbler take over the entire machine.
+
+        This will restrict the machine to a single TTY and make the program unquittable.
+        You can still get access to PTYs via SSH and similar, if enabled.
+      '';
+    };
+
+    screen = {
+      package = lib.mkPackageOption pkgs "screen" { };
+
+      sessionName = lib.mkOption {
+        type = lib.types.str;
+        default = "drumknotty";
+        example = "myscreensessionname";
+        description = ''
+          Sets the screen session name.
+        '';
+      };
+
+      limitHeight = lib.mkOption {
+        type = with lib.types; nullOr ints.unsigned;
+        default = null;
+        example = 42;
+        description = ''
+          If set, limits the height of the screen dibbler uses to the given number of lines.
+        '';
+      };
+
+      limitWidth = lib.mkOption {
+        type = with lib.types; nullOr ints.unsigned;
+        default = null;
+        example = 80;
+        description = ''
+          If set, limits the width of the screen dibbler uses to the given number of columns.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.enable -> lib.any (b: b) [
+          cfg.dibbler.enable
+          cfg.worblehat.enable
+        ];
+        message = "DrumknoTTY must have at least one service enabled";
+      }
+    ];
+
+    users = {
+      users.drumknotty = {
+        group = "drumknotty";
+        extraGroups = [ "lp" ];
+        isNormalUser = true;
+
+        # TODO: make this display the error log or error message in case that
+        #       the screen session service is bootlooping or otherwise off.
+        shell =
+          lib.mkIf cfg.kioskMode
+          (pkgs.writeShellScriptBin "login-shell"
+            "${lib.getExe' cfg.screen.package "screen"} -x ${cfg.screen.sessionName} -p dibbler"
+          // {
+            shellPath = "/bin/login-shell";
+          });
+      };
+      groups.drumknotty = { };
+    };
+
+    boot.kernelParams = lib.mkIf cfg.kioskMode [
+      "console=tty1"
+    ];
+
+    services.getty.autologinUser = lib.mkIf cfg.kioskMode "drumknotty";
+
+    systemd.services.drumknotty-screen-session = lib.mkIf cfg.kioskMode {
+      description = "Drumknotty Screen Session";
+      wantedBy = [
+        "default.target"
+      ];
+      after =
+        # TODO: this could be refined
+        if (cfg.dibbler.createLocalDatabase || cfg.worblehat.createLocalDatabase) then
+          [
+            "postgresql.service"
+            "dibbler-setup-database.service"
+            "worblehat-setup-database.service"
+          ]
+        else
+          [
+            "network.target"
+          ];
+
+      serviceConfig = {
+        Type = "forking";
+        RemainAfterExit = false;
+        Restart = "always";
+        RestartSec = "5s";
+        SuccessExitStatus = 1;
+
+        User = "drumknotty";
+        Group = "drumknotty";
+
+        ExecStartPre =
+          let
+            screenArgs = lib.escapeShellArgs [
+              # Send the specified command to a running screen session
+              "-X"
+
+              # Session name
+              "-S"
+              "${cfg.screen.sessionName}"
+
+              "kill"
+            ];
+          in
+          "-${lib.getExe' cfg.screen.package "screen"} ${screenArgs}";
+
+        ExecStart =
+          let
+            screenrc = let
+              convertToFile = lines: lib.pipe lines [
+                lib.concatLists
+                (lib.concatStringsSep "\n")
+                (pkgs.writeText "drumknotty-screenrc")
+              ];
+            in convertToFile [
+              (lib.optionals (cfg.screen.limitWidth != null) [
+                "screen width ${toString cfg.screen.limitWidth}"
+              ])
+              (lib.optionals (cfg.screen.limitHeight != null) [
+                "screen height ${toString cfg.screen.limitHeight}"
+              ])
+
+              (let
+                dibblerArgs = lib.cli.toCommandLineShellGNU { } {
+                  config = "/etc/dibbler/dibbler.toml";
+                };
+              in lib.optionals cfg.dibbler.enable [
+                "screen -t dibbler ${lib.getExe cfg.dibbler.package} ${dibblerArgs} loop"
+
+              ])
+
+              (let
+                worblehatArgs = lib.cli.toCommandLineShellGNU { } {
+                  config = "/etc/worblehat/config.toml";
+                };
+              in lib.optionals cfg.worblehat.enable [
+                "screen -t worblehat ${lib.getExe cfg.worblehat.package} ${worblehatArgs} cli"
+              ])
+
+              [ "select 0" ]
+            ];
+
+            screenArgs = lib.escapeShellArgs [
+              # -dm creates the screen in detached mode without accessing it
+              "-dm"
+
+              # Session name
+              "-S"
+              "${cfg.screen.sessionName}"
+
+              # Set optimal output mode instead of VT100 emulation
+              "-O"
+
+              # Enable login mode, updates utmp entries
+              "-l"
+
+              # Config file path
+              "-c"
+              "${screenrc}"
+            ];
+          in
+            "${lib.getExe' cfg.screen.package "screen"} ${screenArgs}";
+      };
+    };
+  };
+}

modules/drumknotty/dibbler.nix

@@ -0,0 +1,113 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  mainCfg = config.services.drumknotty;
+  cfg = config.services.drumknotty.dibbler;
+
+  format = pkgs.formats.toml { };
+in
+{
+  options.services.drumknotty.dibbler = {
+    enable = lib.mkEnableOption "";
+
+    package = lib.mkPackageOption pkgs "dibbler" { };
+
+    settings = lib.mkOption {
+      description = "Configuration for dibbler";
+      default = { };
+      type = lib.types.submodule {
+        freeformType = format.type;
+      };
+    };
+
+    createLocalDatabase = lib.mkEnableOption "" // {
+      description = ''
+        Whether to set up a local postgres database automatically.
+
+        ::: {.note}
+        You must set up postgres manually before enabling this option.
+        :::
+      '';
+    };
+  };
+
+  config = lib.mkIf (mainCfg.enable && cfg.enable) {
+    assertions = [
+      {
+        assertion = cfg.createLocalDatabase -> config.services.postgresql.enable;
+        message = "PostgreSQL must be enabled for dibbler to create a local database";
+      }
+    ];
+
+    environment.systemPackages = [ cfg.package ];
+    environment.etc."dibbler/dibbler.toml".source = format.generate "dibbler.toml" cfg.settings;
+
+    services.drumknotty.dibbler.settings = {
+      limits = {
+        low_credit_warning_limit = lib.mkDefault (-100);
+        user_recent_transaction_limit = lib.mkDefault 100;
+      };
+
+      printer = {
+        label_type = lib.mkDefault "62";
+        label_rotate = lib.mkDefault false;
+      };
+
+      database = {
+        type = lib.mkIf cfg.createLocalDatabase "postgresql";
+        postgresql = {
+          username = lib.mkDefault "dibbler";
+          dbname = lib.mkDefault "dibbler";
+
+          host = lib.mkIf cfg.createLocalDatabase "/run/postgresql";
+        };
+      };
+    };
+
+    services.drumknotty.dibbler.settings.general = lib.mkIf mainCfg.kioskMode {
+      quit_allowed = false;
+      stop_allowed = false;
+    };
+
+    services.postgresql = lib.mkIf cfg.createLocalDatabase {
+      authentication = ''
+        local ${cfg.settings.database.postgresql.dbname} ${cfg.settings.database.postgresql.username} peer map=${cfg.settings.database.postgresql.username}
+      '';
+      identMap = ''
+        ${cfg.settings.database.postgresql.username} drumknotty ${cfg.settings.database.postgresql.username}
+      '';
+      ensureDatabases = [ cfg.settings.database.postgresql.dbname ];
+      ensureUsers = [{
+        name = cfg.settings.database.postgresql.username;
+        ensureDBOwnership = true;
+        ensureClauses.login = true;
+      }];
+    };
+
+    systemd.services.dibbler-setup-database = lib.mkIf cfg.createLocalDatabase {
+      description = "Dibbler database setup";
+
+      wantedBy = [ "default.target" ];
+      requiredBy = [ "drumknotty-screen-session.service" ];
+      before = [ "drumknotty-screen-session.service" ];
+      after = [ "postgresql.service" ];
+
+      unitConfig = {
+        ConditionPathExists = "!/var/lib/dibbler/.db-setup-done";
+      };
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${lib.getExe cfg.package} --config /etc/dibbler/dibbler.toml create-db";
+        ExecStartPost = "${lib.getExe' pkgs.coreutils "touch"} /var/lib/dibbler/.db-setup-done";
+        StateDirectory = "dibbler";
+
+        User = "drumknotty";
+        Group = "drumknotty";
+      };
+    };
+  };
+}

modules/drumknotty/worblehat.nix

@@ -0,0 +1,209 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  mainCfg = config.services.drumknotty;
+  cfg = config.services.drumknotty.worblehat;
+
+  format = pkgs.formats.toml { };
+in
+{
+  options.services.drumknotty.worblehat = {
+    enable = lib.mkEnableOption "";
+
+    package = lib.mkPackageOption pkgs "worblehat" { };
+
+    settings = lib.mkOption {
+      description = "Configuration for worblehat";
+      default = { };
+      type = lib.types.submodule {
+        freeformType = format.type;
+      };
+    };
+
+    createLocalDatabase = lib.mkEnableOption "" // {
+      description = ''
+        Whether to set up a local postgres database automatically.
+
+        ::: {.note}
+        You must set up postgres manually before enabling this option.
+        :::
+      '';
+    };
+
+    deadline-daemon = {
+      enable = lib.mkEnableOption "" // {
+        description = ''
+          Whether to enable the worblehat deadline-daemon service,
+          which periodically checks for upcoming deadlines and notifies users.
+
+          Note that this service is independent of the main worblehat service,
+          and must be enabled separately.
+        '';
+      };
+
+      onCalendar = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          How often to trigger rendering the map,
+          in the format of a systemd timer onCalendar configuration.
+
+          See {manpage}`systemd.timer(5)`.
+        '';
+        default = "*-*-* 10:15:00";
+      };
+    };
+  };
+
+  config = lib.mkMerge [
+    {
+      assertions = [
+        {
+          assertion = cfg.createLocalDatabase -> config.services.postgresql.enable;
+          message = "PostgreSQL must be enabled for worblehat to create a local database";
+        }
+      ];
+
+      # TODO: Retrieve defaults from the example config file in the project code.
+      services.drumknotty.worblehat.settings = {
+        logging = {
+          debug = lib.mkDefault true;
+          debug_sql = lib.mkDefault false;
+        };
+
+        database = {
+          type = lib.mkDefault "sqlite";
+          sqlite.path = lib.mkDefault "./worblehat.sqlite";
+          postgresql = {
+            host = lib.mkDefault "localhost";
+            port = lib.mkDefault 5432;
+            username = lib.mkDefault "worblehat";
+            password = lib.mkDefault "/var/lib/worblehat/db-password";
+            database = lib.mkDefault "worblehat";
+          };
+        };
+
+        flask = {
+          TESTING = lib.mkDefault true;
+          DEBUG = lib.mkDefault true;
+          FLASK_ENV = lib.mkDefault "development";
+          SECRET_KEY = lib.mkDefault "change-me";
+        };
+
+        smtp = {
+          enabled = lib.mkDefault false;
+          host = lib.mkDefault "smtp.pvv.ntnu.no";
+          port = lib.mkDefault 587;
+          username = lib.mkDefault "worblehat";
+          password = lib.mkDefault "/var/lib/worblehat/smtp-password";
+          from = lib.mkDefault "worblehat@pvv.ntnu.no";
+          subject_prefix = lib.mkDefault "[Worblehat]";
+        };
+
+        deadline_daemon = {
+          enabled = lib.mkDefault true;
+          dryrun = lib.mkDefault false;
+          warn_days_before_borrowing_deadline = lib.mkDefault [
+            5
+            1
+          ];
+          days_before_queue_position_expires = lib.mkDefault 14;
+          warn_days_before_expiring_queue_position_deadline = lib.mkDefault [
+            3
+            1
+          ];
+        };
+      };
+    }
+
+    (lib.mkIf ((mainCfg.enable && cfg.enable) || cfg.deadline-daemon.enable) {
+      environment.systemPackages = [ cfg.package ];
+      environment.etc."worblehat/config.toml".source = format.generate "worblehat-config.toml" cfg.settings;
+    })
+
+    (lib.mkIf (mainCfg.enable && cfg.enable) {
+      services.drumknotty.worblehat.settings.general = lib.mkIf mainCfg.kioskMode {
+        quit_allowed = false;
+        stop_allowed = false;
+      };
+
+      services.drumknotty.worblehat.settings.database = lib.mkIf cfg.createLocalDatabase {
+        type = "postgresql";
+        postgresql.host = "/run/postgresql";
+      };
+
+      services.postgresql = lib.mkIf cfg.createLocalDatabase {
+        authentication = ''
+          local ${cfg.settings.database.postgresql.database} ${cfg.settings.database.postgresql.username} peer map=${cfg.settings.database.postgresql.username}
+        '';
+        identMap = ''
+          ${cfg.settings.database.postgresql.username} drumknotty ${cfg.settings.database.postgresql.username}
+        '';
+        ensureDatabases = [ cfg.settings.database.postgresql.database ];
+        ensureUsers = [{
+          name = cfg.settings.database.postgresql.username;
+          ensureDBOwnership = true;
+          ensureClauses.login = true;
+        }];
+      };
+
+      systemd.services.worblehat-setup-database = lib.mkIf cfg.createLocalDatabase {
+        description = "Worblehat database setup";
+
+        wantedBy = [ "default.target" ];
+        requiredBy = [ "drumknotty-screen-session.service" ];
+        before = [ "drumknotty-screen-session.service" ];
+        after = [ "postgresql.service" ];
+
+        unitConfig = {
+          ConditionPathExists = "!/var/lib/worblehat/.db-setup-done";
+        };
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${lib.getExe cfg.package} --config /etc/worblehat/config.toml create-db";
+          ExecStartPost = "${lib.getExe' pkgs.coreutils "touch"} /var/lib/worblehat/.db-setup-done";
+          StateDirectory = "worblehat";
+
+          User = "drumknotty";
+          Group = "drumknotty";
+        };
+      };
+    })
+
+    (lib.mkIf cfg.deadline-daemon.enable {
+      systemd.timers.worblehat-deadline-daemon = lib.mkIf cfg.deadline-daemon.enable {
+        description = "Worblehat Deadline Daemon";
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = cfg.deadline-daemon.onCalendar;
+          Persistent = true;
+        };
+      };
+
+      systemd.services.worblehat-deadline-daemon = lib.mkIf cfg.deadline-daemon.enable {
+        description = "Worblehat Deadline Daemon";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig = {
+          Type = "oneshot";
+          CPUSchedulingPolicy = "idle";
+          IOSchedulingClass = "idle";
+
+          ExecStart =
+            let
+              worblehatArgs = lib.cli.toCommandLineShellGNU { } {
+                config = "/etc/worblehat/config.toml";
+              };
+            in
+            "${lib.getExe cfg.package} ${worblehatArgs} deadline-daemon";
+
+          User = "drumknotty";
+          Group = "drumknotty";
+        };
+      };
+    })
+  ];
+}

modules/grzegorz.nix

@@ -16,7 +16,7 @@ in {
   };
 
   systemd.user.services.restart-greg-ng = {
-    script = "systemctl --user restart greg-ng.service";
+    serviceConfig.ExecStart = "${lib.getExe' pkgs.systemd "systemctl"} --user restart greg-ng.service";
     startAt = "*-*-* 06:30:00";
   };
 

packages/mediawiki-extensions/default.nix

@@ -38,18 +38,23 @@ lib.mergeAttrsList [
   })
   (mw-ext {
     name = "CodeMirror";
-    commit = "f06dfd40a08562a841ddf11b4ae3444ef06c98c7";
+    commit = "7ab826eff8c4097589a3199c40c507717af23234";
-    hash = "sha256-5zXkBjOwFdoQezkPRJ2AcBZLZEEpGG6FawO2K3KzllI=";
+    hash = "sha256-kMIyGW9J4OSGSetByel7hEGgxPRJmQ53it6ndpYA/Hs=";
   })
   (mw-ext {
     name = "DeleteBatch";
-    commit = "9bc75a753efefedfc88c598fb01f18a7e4b61f00";
+    commit = "b5920283cfe78b86a63a1037a81651c58ce764da";
-    hash = "sha256-1xA758fsvoioN9xuq0hRqZKtPXMQViVLtuRINDtowdk=";
+    hash = "sha256-LwuVX2s5Q4uc6o7hlTjFzRTwvSCwTk74gBpX0HoLDMA=";
+  })
+  (mw-ext {
+    name = "PdfHandler";
+    commit = "dc1a3ca04ac6ec7d7de7ce5355803510508a2575";
+    hash = "sha256-ltAQZtfTMMLRPATA7rclSNW8Yz4ctGc30CxlL3SRBWU=";
   })
   (mw-ext {
     name = "PluggableAuth";
-    commit = "64133683b73d8eeea8069fe7ed9cb7237fd5c212";
+    commit = "4b57a23e32d72bd3f74184ff2734aa483a5b0c63";
-    hash = "sha256-wqpfgVLenZp6XC510nrsrbvK1IMEPcWVYq5YuAOt5+c=";
+    hash = "sha256-ZGw0Wgz0Sg04YDcOzkOGywmfQ6s6Ex17QbjmUDO1D8c=";
   })
   (mw-ext {
     name = "Popups";
@@ -58,38 +63,38 @@ lib.mergeAttrsList [
   })
   (mw-ext {
     name = "Scribunto";
-    commit = "cbab0c740e03c8e6184fd647d95e24e0826d20cb";
+    commit = "35c85c96167922adc98e62dd6573789d906dd7d7";
-    hash = "sha256-vXS3+wrUBVtPsETa19pMvud9sALGt4Ao9mM5rQRbBQc=";
+    hash = "sha256-FEWADJW53cDOlLseM62VL66PENv/jNnwuCMo2Pb02ek=";
   })
   (mw-ext {
     name = "SimpleSAMLphp";
     kebab-name = "simple-saml-php";
-    commit = "fc5ad4501434fe85198f0b1f0087d798efa91f9f";
+    commit = "70778bb02f972abbb51e6ba3e0f6545b00dcab00";
-    hash = "sha256-se0krTglo1fShJXj38bPLhw65tZC5P54Ywt7oeZrLes=";
+    hash = "sha256-wfmFJKy+ih84qFM9DVcCQFAZBx45s7Hl0lRnseMPhGY=";
   })
   (mw-ext {
     name = "TemplateData";
-    commit = "d37b02f6ed194138ac7193a0782bbf6efb9164f8";
+    commit = "cca3b3430067f2161bf65de822f70dd38fe07bba";
-    hash = "sha256-NpzVBzX7qfXkIE+jh33ndooS9GE8ZF3/Jynm22in7IQ=";
+    hash = "sha256-OxLwiF8FlWizkpDF9GXYfjehKtrltX8ihiCE+fNJpgw=";
   })
   (mw-ext {
     name = "TemplateStyles";
-    commit = "f85614c26a0057a9f418342f89214a04c9de9988";
+    commit = "101a159dd0190759a16551a86800144c18b6ff5c";
-    hash = "sha256-XZOtM3iadjE5vavsjkx7kfJNhLZlnnFt1CN+mv6XVHQ=";
+    hash = "sha256-IGQQVAx8/76ivHq9b97ec1AlFoqbRl7uhXhwoFimsG4=";
   })
   (mw-ext {
     name = "UserMerge";
-    commit = "2f2432c909a36691ca0002daf6fb304d6c182beb";
+    commit = "6c0d105e07538c34bfde989bd26fa1945f8d1b79";
-    hash = "sha256-ZP8Tp6u+uJxx3I39YGMmkP0sTnjAQUSaxImAJaRv+Ek=";
+    hash = "sha256-w058Ihk0I98hIG1tkVJGy1bzbv7XXyUksGexXgCN540=";
   })
   (mw-ext {
     name = "VisualEditor";
-    commit = "1508d49d0dd71fdc1d18badd23671441b3bc327b";
+    commit = "8d8c6d7f179a5f799e1fa8cba207d81f58f722d2";
-    hash = "sha256-VNiCVNrCAImAr1tS9T28KPPzzNsKPz5ELFRIBtng+So=";
+    hash = "sha256-wbYHXi2vD521EMzUl7ttinG4YdLv/DwYvVUew7dka0g=";
   })
   (mw-ext {
     name = "WikiEditor";
-    commit = "aba5e7c6701877a6b43583709751658fec606d47";
+    commit = "f53000f0499858fe74e4f5008b2f5e467d9d9382";
-    hash = "sha256-XmbQy0NXuY3oVGkkgC233kkzfBfx32HDylloGYXU/Nc=";
+    hash = "sha256-+HTXZEVCwMD8z6c1kCZA3k686HzNd30pJljzRvf+gMg=";
   })
 ]

packages/ooye/package.nix

@@ -10,18 +10,18 @@ let
 in
 buildNpmPackage {
   pname = "delete-your-element";
-  version = "3.5.1";
+  version = "3.6.0";
   src = fetchFromGitea {
     domain = "git.pvv.ntnu.no";
     owner = "Drift";
     repo = "delete-your-element";
-    rev = "80ac1d9d79207b6327975a264fcd9747b99a2a5d";
+    rev = "44fb6a02d3139e8ab10e9660ad931e5e70d1205f";
-    hash = "sha256-fcBpUZ+WEMUXyyo/uaArl4D1NJmK95isWqhFSt6HzUU=";
+    hash = "sha256-wDQhPbxwdkAm0kPhaDNjbk8rVFxnGinffVdASdFrYnU=";
   };
 
   inherit nodejs;
 
-  npmDepsHash = "sha256-EYxJi6ObJQOLyiJq4C3mV6I62ns9l64ZHcdoQxmN5Ao=";
+  npmDepsHash = "sha256-h1mmE0/+Y7SBwnI0vaYvV+KqRDJGzwJvDUOkigzHcOY=";
   dontNpmBuild = true;
 
   nativeBuildInputs = [ makeWrapper ];

secrets/skrot/skrot.yaml

@@ -1,6 +1,9 @@
 dibbler:
     postgresql:
         password: ENC[AES256_GCM,data:3X9A3jOpFVRuBg0gRiCEsZVKfLI=,iv:XC7LBNUhALk9IEhItV8fO5p/m7VKL0REBY1W2IZt7G4=,tag:l18R7EhbOlucZHFQiEvpHw==,type:str]
+worblehat:
+    postgresql:
+        password: ENC[AES256_GCM,data:WpJR6MumY+7WUYdVVgAqv1af+NmqecTMO9aP5lidSpE=,iv:7aoN8mjXckd81LxasMSG3R2vqj0SvzSl7wrEQ1LwToo=,tag:zeeNcEpkYnqyd8be0ZS+kQ==,type:str]
 sops:
     age:
         - recipient: age1hzkvnktkr8t5gvtq0ccw69e44z5z6wf00n3xhk3hj24emf07je5s6q2evr
@@ -66,8 +69,8 @@ sops:
             MmxPMWNPYzJiOFRqY2VYczhvRm5IR3cKpUVV+zsMolsHI2YK9YqC6ecNT6QXv0TV
             d1SpXRAexZBeWCCHBjSdvQBl8AT4EwrAIP2M2o++6i5DaGoGiEIWZQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-10T20:02:28Z"
+    lastmodified: "2026-03-18T14:56:22Z"
-    mac: ENC[AES256_GCM,data:i8CjVxoD7zdkLNJlI9DCo/tDV5DUI7JdpozLtYZzI7Cu51GayaE2Y3Wg4de6P0L7C3FER04WfRe/h+G9PLZICX/CfSipQysyrEq3Pjt9IKsjytDhP9VYJ36QFGF0PuHUQAMSLts/tAoAvLue6MP+V82l5js9ghvyBrzyBGxoyJw=,iv:QFNxvCYxrSkwy7iT+2BEacNPftDXju1cibprVPDjic0=,tag:496E+oCy/VwTylyaWhQD+A==,type:str]
+    mac: ENC[AES256_GCM,data:nBKtFmFKx/Mt9TIFnKuuznsPAXCQpc3+WIspNu5TN9TpIqw75nzYXpxIb2hxRfRu0nbjHXpBy4bkzeMi41BGkvkvV57CZyq11J5i/iIKwuvllaB1IWrdDT2u+6RH3jIspp3KoyxFWdRqcGfNma9dSmtI+1Dd5z7XaxVaoVK2QMI=,iv:6joviyJ2cXmGh/9HH7VEcoK3+4GK5I6i2N/1d65PAN0=,tag:0BFVPWL3BByJH8HbrBTKOw==,type:str]
     pgp:
         - created_at: "2026-02-10T20:01:32Z"
           enc: |-
@@ -90,4 +93,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.12.1

secrets/temmie/temmie.yaml

@@ -0,0 +1,93 @@
+httpd:
+    passwd-ssh-key: ENC[AES256_GCM,data:fXfqlhNbAIdacm7s4yirp+XS7gWhsp4jrD5yRzsU8lP+oueqS8cCkQGV4MB83OKa/D3wm1zxvjRsys9uxa+4kKL2/xOetDex5WXH7xAjzMaE0jHRNCjJMYM44L9+n3oc2c6rXz2DZ+4TEdGfJOru3pUIZx2LVYO/NB+FXSW59632PFhkuSypmpeeXRFn13ksd27W5x9fB4lOw9nrdyQkfuqvl0pD9uC6zef/sZ12rfre1JHyhN+jiowzWjJuzA9iiJpjNcek2wTyymVYZNxngfugnCkTKtWcfl+BOTgyhpEtGmL3mLs3n9r6bD725IAuoXUSzBEJqE1dCw93AvlPyrUwOXLM5lOX4h9IYS/0Izfc4w+qC+ID02XU0/cFufT8ODfTK08xF5QAOp5AdLxbcvMq3KadVPesD/5K75mzWtfC+UM4lo8TfphqnEtetL/P0DBXIJIsyY04gyTWsUVCfjcwWcliW6p3pcZZ+rkqObFs9n06uMWQq8qULa85yLq+mMsyPlBW1HE+TIV8jrLtVBqPkfXp85ZtllMOJRpeEOf/l48=,iv:1BE0moa2a4k2yqVBboS/EbNiFGLTu4Df/tnXBassls4=,tag:iPUOAEhqKbF9umsyBLaoJg==,type:str]
+    ssh-known-hosts: ENC[AES256_GCM,data:E2NiTUQokUDHzkfmTh5eECHZxt8v/Ug63ETA/CcO8358EpPeaFI1tAFt3q0o5rTCAUlB5cJ1ZOxX4mTeIH370wnwFN6emg+iAaK3VM+AL3Tp8Acb5EwErSOTKjAwrS5vwqb3oTYMzj42bKBk0b/qPWspGnoUfDI481+p99PS8eqpNCcGaNEDNk0BPwDvngwuur9o2RTmuWwxZO+s3wqlktQPkCguii8/FD3x3O8eow+v,iv:tJNxoY4UsRrB9k/fX9jLUc4hC3bioekpgKu4aa2o/4Q=,tag:DLj9rqse33D8PDLMxF/heQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrMStZRlNCem0zRWgvMytj
+            b2tGR0M4SmF2Z1dYR2RBK1ZTUEx4c3NhMmlnCkVwcStqZ0RPRm1EK01lTWJpUmd2
+            Qis2WlU2ZUpFcUVXZUdVaWVyQno4NFEKLS0tIGJZWmlSdEtaUnd1alZ6NURsSFY3
+            VXJGank2UlBqY0hNZ1QvUGZUdVljaXMK9P4IVuSZ8uhDXDWMOkqABWImL4mu18AU
+            7X+1t3nZVmPze3MOTBRWf483DBAM+69QDlio1uSzZjJQc1X0H6ePKQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age10avsdvqger25z0lyzlq8v7xfzcmypkmjsswswaxwqnpnl6x9wcjq0uv2n7
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJMGdHZ2xvdnVMbFAxYkhF
+            WHRPWjg3OE4vU1RhTWxPc0cxNm1RU1BPem40CnRHc0gyQVNxelBnZERMNlp2YnFk
+            U0xpbHN6RlVHZHdkZktnK0hCMFQ1aGcKLS0tIDVtODVvNzN0NFJ3UGFYdkpLTmZR
+            R0FvdzE5NDhUNFpWZTYreklCMmhCWmcKuD5nNqDSP4SK3E1AsnZtE4jzYgxfgHau
+            nmPKA2dgsPoA2rug/kGB9uXeUUA0oL26FyjlPi6NYDVvN4u1IHgPSw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ug30gg4y7ftuya0wdv7q0vh4egn00wlv2th7mt7cgc2ze46wmvyq9lq6ge
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3SUdGMUgwSEV2SUhkMEJm
+            MWJ5Y1VMdWsyK1NWYmxUK3N1cHoydWp5eUVrCllZK3hKZjNDYzMwQTFENTg2aFFi
+            dXpkWGZkT0hiWGRQdjltNXZ6ZkN2S1EKLS0tIFREeDFVZkZEV0phM3dRYUVRSSsx
+            UVpkZ3hTd0JuWm16WnFFREt4S0hxMjAKbihmtr3/d/BbX21zkZWNarCNa4cYCM9B
+            HGwcEfP4fnevWdM4LbXXBBmfoVUErKjK5tiMwocVZXZrsHBYI4amPA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1mrnldl334l2nszuta6ywvewng0fswv2dz9l5g4qcwe3nj4yxf92qjskdx6
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3d3g2aHUrT0d5Kzl1RmVk
+            MUh4eW8vTS9qbkZ3WHNYMjFHSlZLV2M1aVgwCllWTDFwZDV1QTFkQkVrUnN0bSto
+            aTlvVTVaOWVldDJjSHMyaFhLNXlBcUEKLS0tIHZ6d0ZZWlo5SVJ3a0VNbjRFYnkz
+            dDFFT1JVN2N1cjg2TW5xOUZKZDVzZkUKjtRmm87B4AECzS8mmL6rUyVfNYlsem1w
+            HDFw4p0Nt9JWFFWEWamnTQ+Bq2UPsueBW4Ei/WyDj5d4EyNptoJrDQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2aWs5V0xhTzJlMi9PNks0
+            ZUNiOFB5TDZQUVBnVThRQjdzYTJ0Uml1blJzCjhUdTdpRURsVlIrUkxnUXVhM3Vn
+            cmJSL0x2Y29aMnltcWhiYmhLem1ldGsKLS0tIFpMa1lmZjZPQ0FvSUhTbUhzRlM5
+            bHNqMm1xRGdMd2NOdVo0Y0xFLzJCbGcKnSMBn2kp/RGDr5NL+qMoWqqdCdSu4wFz
+            GjjUS43nW0++TVXusGIj60sDJtK623N4srpubykZtYfEO1c1cAURpg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnU2d6bFRqMk5jZ3lDdzA5
+            WFpsNVdLL2lXRGZ5ZjRIdGs5VjRVZ1JKdDJJCmxQeHZsZk9OQ1g4dG00MVNGeFF2
+            OURQUndCOTM3eUh1SnRaOGFKMi80TjQKLS0tIEE2eE8vK1dnN0dnbGNqaWZqdzJx
+            WGhRM2R0VzV1SlpxeGVWOXNCeWlzcVUK/nD3DWVDjVbWJmP33OC4LSKA3qrjN0hb
+            kZV4U44y+8uLtBVm3WnkZd/cg5wqoD/1agG7aCc9DMmOmxHUfdfrJw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtczYrL3NrM295NEd4N3V0
+            WndPRXltZFhOUU1LdGVNM05LRzV5blhmU1JRClBpU0g2K0FJbFE0RVEyVW1ZRTJU
+            d2ZoeTM0QWx1NE9wSjc3c0tUa3Z3VlkKLS0tIEVrQStXSWRTUkJvK2paTU1EUkcy
+            ZWtMdDRhTWdLZnI2T2ZmS2VXdjFpZVkK1LAo54bl2QIx08rMJ0A8Q5bVXWcaoFPo
+            Y0/PSyL+vMa2Ab6b4vD6GNY5/KAE5XPlvBEKBrIe2oIAMJw38KUq8g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1sqs7urnzsdy64efmd0zukzv3gs5pnjksuxd7nqmdwdy5l0nqnunq6hyune
+    lastmodified: "2026-05-29T13:54:14Z"
+    mac: ENC[AES256_GCM,data:g1PT225ggTfHuzU9qaNfNrhIVqtTWRCSm7iFDTlCZTDr4PPGbRtUH5fIJSY1F+2mu+H2XRM9ueenhqTyyyDJGsq+Oqp6Ae4E7vp2Uo4qH8O2d/u78EL2zNVestTvCnJGJ5lPWrN2i41pqOWbNx+dXt0O+sdgS890IQkj4i8VrRU=,iv:CjBKRSCMpAT+gWEFjvqb5OBy5u6ZsDelsCg5lGNOsN0=,tag:k1ia0wkw3YQfeFdv0GTX6g==,type:str]
+    pgp:
+        - created_at: "2026-05-29T13:54:02Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA0av/duuklWYARAAq4qDoGJmeum8aPwO6TGOO+iIKNE3rqIdCsUsTs+SF3VL
+            ejSW3yB9hw5ptg3CCUH0tZRuZyvQ3fkXFh08hSBfBhICSr9NS2vllXp4ILlhNG0P
+            gEIq67+daK2YyWBcV3Rh8OMz5niGYDKF6WZjzlkFxinUFcqVtQrVKw9pti+Crhs9
+            QgZbTz5+Cph/ACSLufSUV2yyjv+zO+VhyMpHR4x/B/el/T921vAQAdGx9DprC1ed
+            cse2kg9ouhMQI+Aii5oSnDCAuVZGZQN23WXQBQp66l4gFmR3Av85miguEF5Gf8YW
+            44GiixHyul5583NDsMQuoPu1gzE8CqUPMVFVGzp5BsXbb4HzmEslxkpi7obCs7wx
+            fCplc2L+mLa4hTBJXYcCcRbsbopjDnYLNLfl4nvYHW5utimNej4EBdzQQg3DNf8J
+            zdNXlwHXUBgU8ayAyOwThQIP4s+VDSh2ASSWwEmqNMr5nkocIl7UO3J9MzkLNuc1
+            0S4b8rM9om755SlQTeLrOy/4aloZwCMFxQOeIoJ0fxNlgap1BS1FQ68leA+uiCcc
+            vCFVMlYUOwMl2wqkQ84pY3SEL6z96o9wpOyRERk/yfjBWnGjqjANNz4uSXggo4B9
+            LTLIqO+Li26+geyTATIMJU5SeMdP5s+Lvc2qzn0c4qr67hVo9H5Df2qzijsqIqrS
+            XgHQdNafa0JYSH07UKFvfmcDYU/sWRi7QrFD3/zn5HPUN2XNQj4P9OF93NV8tAqK
+            pFqgdJCybDSp4sQujjQOZkJ3tpVnlq/G/QjiAY2TpbYxzPUDWP0Pu0yGxVIrJ5Q=
+            =atHd
+            -----END PGP MESSAGE-----
+          fp: F7D37890228A907440E1FD4846B9228E814A2AAC
+    unencrypted_suffix: _unencrypted
+    version: 3.13.0

values.nix

@@ -55,11 +55,11 @@ in rec {
     };
     brzeczyszczykiewicz = {
       ipv4 = pvv-ipv4 205;
-      ipv6 = pvv-ipv6 "1:50"; # Wtf peder why
+      ipv6 = pvv-ipv6 205;
     };
     georg = {
       ipv4 = pvv-ipv4 204;
-      ipv6 = pvv-ipv6 "1:4f"; # Wtf øystein og daniel why
+      ipv6 = pvv-ipv6 204;
     };
     kommode = {
       ipv4 = pvv-ipv4 223;