aboutsummaryrefslogtreecommitdiffstats
path: root/modules/by-name
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--hosts/by-name/server3/secrets/matrix/passwd.age (renamed from modules/by-name/ma/matrix/passwd.age)0
-rw-r--r--modules/by-name/ba/back/module.nix121
-rw-r--r--modules/by-name/co/constants/module.nix66
-rw-r--r--modules/by-name/ni/nix-sync/hosts.nix48
-rw-r--r--modules/by-name/ni/nix-sync/module.nix70
-rw-r--r--modules/by-name/re/redlib/module.nix44
-rw-r--r--modules/vhack/ba/backup/module.nix (renamed from modules/by-name/ba/backup/module.nix)0
-rw-r--r--modules/vhack/co/coredump/module.nix (renamed from modules/by-name/co/coredump/module.nix)0
-rw-r--r--modules/vhack/dh/dhcpcd/module.nix (renamed from modules/by-name/dh/dhcpcd/module.nix)0
-rw-r--r--modules/vhack/di/disko/module.nix (renamed from modules/by-name/di/disko/module.nix)0
-rw-r--r--modules/vhack/et/etesync/module.nix (renamed from modules/by-name/et/etesync/module.nix)14
-rw-r--r--modules/vhack/fa/fail2ban/module.nix (renamed from modules/by-name/fa/fail2ban/module.nix)0
-rw-r--r--modules/vhack/ga/gallery/module.nix (renamed from modules/by-name/ga/gallery/module.nix)0
-rw-r--r--modules/vhack/gi/git-server/css.nix (renamed from modules/by-name/gi/git-server/css.nix)0
-rw-r--r--modules/vhack/gi/git-server/module.nix (renamed from modules/by-name/gi/git-server/module.nix)11
-rw-r--r--modules/vhack/im/impermanence/module.nix (renamed from modules/by-name/im/impermanence/module.nix)0
-rw-r--r--modules/vhack/in/invidious-router/module.nix (renamed from modules/by-name/in/invidious-router/module.nix)4
-rw-r--r--modules/vhack/ma/mail/module.nix (renamed from modules/by-name/ma/mail/module.nix)40
-rw-r--r--modules/vhack/ma/mastodon/module.nix (renamed from modules/by-name/ma/mastodon/module.nix)27
-rw-r--r--modules/vhack/ma/mastodon/patches/0001-feat-treewide-Increase-character-limit-to-5000-in-me.patch (renamed from modules/by-name/ma/mastodon/patches/0001-feat-treewide-Increase-character-limit-to-5000-in-me.patch)28
-rw-r--r--modules/vhack/ma/matrix/module.nix (renamed from modules/by-name/ma/matrix/module.nix)86
-rw-r--r--modules/vhack/mi/miniflux/module.nix (renamed from modules/by-name/mi/miniflux/module.nix)0
-rw-r--r--modules/vhack/mu/murmur/module.nix (renamed from modules/by-name/mu/murmur/module.nix)7
-rw-r--r--modules/vhack/ng/nginx/module.nix (renamed from modules/by-name/ng/nginx/module.nix)48
-rw-r--r--modules/vhack/ni/nix-sync/internal_module.nix (renamed from modules/by-name/ni/nix-sync/internal_module.nix)0
-rw-r--r--modules/vhack/ni/nixconfig/module.nix (renamed from modules/by-name/ni/nixconfig/module.nix)0
-rw-r--r--modules/vhack/ns/nscd/module.nix (renamed from modules/by-name/ns/nscd/module.nix)0
-rw-r--r--modules/vhack/oo/oomd/module.nix (renamed from modules/by-name/oo/oomd/module.nix)0
-rw-r--r--modules/vhack/op/openssh/module.nix (renamed from modules/by-name/op/openssh/module.nix)0
-rw-r--r--modules/vhack/pe/peertube/module.nix (renamed from modules/by-name/pe/peertube/module.nix)0
-rw-r--r--modules/vhack/po/postgresql/module.nix (renamed from modules/by-name/po/postgresql/module.nix)0
-rw-r--r--modules/vhack/re/resolvconf/module.nix (renamed from modules/by-name/re/resolvconf/module.nix)0
-rw-r--r--modules/vhack/ru/rust-motd/module.nix (renamed from modules/by-name/ru/rust-motd/module.nix)32
-rw-r--r--modules/vhack/us/users/module.nix (renamed from modules/by-name/us/users/module.nix)30
34 files changed, 186 insertions, 490 deletions
diff --git a/modules/by-name/ma/matrix/passwd.age b/hosts/by-name/server3/secrets/matrix/passwd.age
index 6386ed6..6386ed6 100644
--- a/modules/by-name/ma/matrix/passwd.age
+++ b/hosts/by-name/server3/secrets/matrix/passwd.age
diff --git a/modules/by-name/ba/back/module.nix b/modules/by-name/ba/back/module.nix
deleted file mode 100644
index 520acdb..0000000
--- a/modules/by-name/ba/back/module.nix
+++ /dev/null
@@ -1,121 +0,0 @@
-{
- config,
- lib,
- vhackPackages,
- pkgs,
- ...
-}: let
- cfg = config.vhack.back;
-
- mkConfigFile = repoPath: domain:
- (pkgs.formats.json {}).generate "config.json"
- {
- inherit (cfg) source_code_repository_url;
- repository_path = repoPath;
- root_url = "https://${domain}";
- };
-
- mkUnit = repoPath: port: domain: {
- description = "Back service for ${repoPath}";
- wants = ["network-online.target"];
- after = ["network-online.target"];
- wantedBy = ["default.target"];
-
- environment = {
- ROCKET_PORT = builtins.toString port;
- };
-
- serviceConfig = {
- ExecStart = "${lib.getExe vhackPackages.back} ${mkConfigFile repoPath domain}";
-
- # Ensure that the service can read the repository
- # FIXME(@bpeetz): This has the implied assumption, that all the exposed git
- # repositories are readable for the git group. This should not be necessary. <2024-12-23>
- User = "git";
- Group = "git";
-
- DynamicUser = true;
- Restart = "always";
-
- # Sandboxing
- ProtectSystem = "strict";
- ProtectHome = true;
- PrivateTmp = true;
- PrivateDevices = true;
- ProtectHostname = true;
- ProtectClock = true;
- ProtectKernelTunables = true;
- ProtectKernelModules = true;
- ProtectKernelLogs = true;
- ProtectControlGroups = true;
- RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"];
- RestrictNamespaces = true;
- LockPersonality = true;
- MemoryDenyWriteExecute = true;
- RestrictRealtime = true;
- RestrictSUIDSGID = true;
- RemoveIPC = true;
- PrivateMounts = true;
- # System Call Filtering
- SystemCallArchitectures = "native";
- SystemCallFilter = ["~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid"];
- };
- };
-
- mkVirtalHost = port: {
- locations."/".proxyPass = "http://127.0.0.1:${builtins.toString port}";
-
- enableACME = true;
- forceSSL = true;
- };
-
- services =
- lib.mapAttrs' (gitPath: config: {
- name = builtins.replaceStrings ["/"] ["_"] "back-${config.domain}";
- value = mkUnit gitPath config.port config.domain;
- })
- cfg.repositories;
-
- virtualHosts =
- lib.mapAttrs' (gitPath: config: {
- name = config.domain;
- value = mkVirtalHost config.port;
- })
- cfg.repositories;
-in {
- options.vhack.back = {
- enable = lib.mkEnableOption "Back issue tracker (inspired by tvix's panettone)";
-
- source_code_repository_url = lib.mkOption {
- description = "The url to the source code of this instance of back";
- default = "https://git.foss-syndicate.org/vhack.eu/nixos-server/tree/pkgs/by-name/ba/back";
- type = lib.types.str;
- };
-
- repositories = lib.mkOption {
- description = "An attibute set of repos to launch `back` services for.";
- type = lib.types.attrsOf (lib.types.submodule {
- options = {
- enable = (lib.mkEnableOption "`back` for this repository.") // {default = true;};
- domain = lib.mkOption {
- type = lib.types.str;
- description = "The domain to host this `back` instance on.";
- };
- port = lib.mkOption {
- type = lib.types.port;
-
- # TODO: This _should_ be an implementation detail, but I've no real approach to
- # automatically generate them without encountering weird bugs. <2024-12-23>
- description = "The port to use for this back instance. This must be unique.";
- };
- };
- });
- default = {};
- };
- };
-
- config = lib.mkIf cfg.enable {
- systemd = {inherit services;};
- services.nginx = {inherit virtualHosts;};
- };
-}
diff --git a/modules/by-name/co/constants/module.nix b/modules/by-name/co/constants/module.nix
deleted file mode 100644
index b344fcd..0000000
--- a/modules/by-name/co/constants/module.nix
+++ /dev/null
@@ -1,66 +0,0 @@
-# This file is inspired by the `nixos/modules/misc/ids.nix`
-# file in nixpkgs.
-{lib, ...}: {
- options.vhack.constants = {
- ids.uids = lib.mkOption {
- internal = true;
- description = ''
- The user IDs used in the vhack.eu nixos config.
- '';
- type = lib.types.attrsOf lib.types.int;
- };
- ids.gids = lib.mkOption {
- internal = true;
- description = ''
- The group IDs used in the vhack.eu nixos config.
- '';
- type = lib.types.attrsOf lib.types.int;
- };
- };
-
- config.vhack.constants = {
- ids.uids = {
- acme = 328;
- dhcpcd = 329;
- nscd = 330;
- sshd = 331;
- systemd-oom = 332;
- redis-peertube = 990;
- peertube = 992; # TODO Sort correctly
- mastodon = 996;
- redis-mastodon = 991;
- matrix-synapse = 224;
- mautrix-whatsapp = 225;
- knot-resolver = 997;
- redis-rspamd = 989;
- rspamd = 225;
- opendkim = 221;
- virtualMail = 5000;
- etebase-server = 998;
-
- # As per the NixOS file, the uids should not be greater or equal to 400;
- };
- ids.gids = {
- acme = 328;
- dhcpcd = 329;
- nscd = 330;
- sshd = 331;
- systemd-oom = 332;
- resolvconf = 333; # This group is not matched to an user?
- systemd-coredump = 151; # matches systemd-coredump user
- redis-peertube = 990;
- peertube = 992;
- mastodon = 996;
- redis-mastodon = 991;
- matrix-synapse = 224;
- knot-resolver = 997;
- redis-rspamd = 989;
- rspamd = 225;
- opendkim = 221;
- virtualMail = 5000;
- etebase-server = 998;
-
- # The gid should match the uid. Thus should not be >= 400;
- };
- };
-}
diff --git a/modules/by-name/ni/nix-sync/hosts.nix b/modules/by-name/ni/nix-sync/hosts.nix
deleted file mode 100644
index 98dbbf1..0000000
--- a/modules/by-name/ni/nix-sync/hosts.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{...}: let
- extraWkdSettings = {
- locations."/.well-known/openpgpkey/hu/".extraConfig = ''
- default_type application/octet-stream;
-
- # Came from: https://www.uriports.com/blog/setting-up-openpgp-web-key-directory/
- # No idea if it is actually necessary
- # add_header Access-Control-Allow-Origin * always;
- '';
- };
-in [
- {
- domain = "vhack.eu";
- url = "https://codeberg.org/vhack.eu/website.git";
- }
- {
- domain = "b-peetz.de";
- url = "https://codeberg.org/bpeetz/b-peetz.de.git";
- }
-
- # Trinitrix
- {
- domain = "trinitrix.vhack.eu";
- url = "https://codeberg.org/trinitrix/website.git";
- }
-
- # WKD
- {
- domain = "openpgpkey.b-peetz.de";
- url = "https://codeberg.org/vhack.eu/gpg_wkd.git";
- extraSettings = extraWkdSettings;
- }
- {
- domain = "openpgpkey.s-schoeffel.de";
- url = "https://codeberg.org/vhack.eu/gpg_wkd.git";
- extraSettings = extraWkdSettings;
- }
- {
- domain = "openpgpkey.sils.li";
- url = "https://codeberg.org/vhack.eu/gpg_wkd.git";
- extraSettings = extraWkdSettings;
- }
- {
- domain = "openpgpkey.vhack.eu";
- url = "https://codeberg.org/vhack.eu/gpg_wkd.git";
- extraSettings = extraWkdSettings;
- }
-]
diff --git a/modules/by-name/ni/nix-sync/module.nix b/modules/by-name/ni/nix-sync/module.nix
deleted file mode 100644
index de096b9..0000000
--- a/modules/by-name/ni/nix-sync/module.nix
+++ /dev/null
@@ -1,70 +0,0 @@
-{
- config,
- lib,
- ...
-}: let
- cfg = config.vhack.nix-sync;
-
- mkNixSyncRepository = {
- domain,
- root ? "",
- url,
- extraSettings ? {},
- }: {
- name = "${domain}";
- value = {
- path = "/etc/nginx/websites/${domain}/${root}";
- uri = "${url}";
- inherit extraSettings;
- };
- };
- nixSyncRepositories = builtins.listToAttrs (builtins.map mkNixSyncRepository domains);
-
- mkVirtHost = {
- domain,
- root ? "",
- url,
- extraSettings ? {},
- }: {
- name = "${domain}";
- value =
- lib.recursiveUpdate {
- forceSSL = true;
- enableACME = true;
- root = "/etc/nginx/websites/${domain}/${root}";
- }
- extraSettings;
- };
- virtHosts = builtins.listToAttrs (builtins.map mkVirtHost domains);
-
- domains = import ./hosts.nix {};
-in {
- imports = [
- ./internal_module.nix
- ];
-
- options.vhack.nix-sync = {
- enable = lib.mkEnableOption ''
- a website git ops solution.
- '';
- };
-
- config = lib.mkIf cfg.enable {
- vhack.persist.directories = [
- {
- directory = "/var/lib/nix-sync";
- user = "nix-sync";
- group = "nix-sync";
- mode = "0700";
- }
- ];
-
- services.nix-sync = {
- enable = true;
- repositories = nixSyncRepositories;
- };
-
- vhack.nginx.enable = true;
- services.nginx.virtualHosts = virtHosts;
- };
-}
diff --git a/modules/by-name/re/redlib/module.nix b/modules/by-name/re/redlib/module.nix
deleted file mode 100644
index 2b20c66..0000000
--- a/modules/by-name/re/redlib/module.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{
- config,
- pkgsUnstable,
- lib,
- ...
-}: let
- domain = "redlib.vhack.eu";
-
- cfg = config.vhack.redlib;
-in {
- options.vhack.redlib = {
- enable = lib.mkEnableOption ''
- the redlib reddit frontend
- '';
- };
-
- config = lib.mkIf cfg.enable {
- services.redlib = {
- enable = true;
- package = pkgsUnstable.redlib;
- port = 8080;
- address = "127.0.0.1";
- openFirewall = false;
- };
-
- services.nginx = {
- enable = true;
- virtualHosts.${domain} = {
- locations."/".proxyPass = "http://127.0.0.1:${toString config.services.redlib.port}";
-
- enableACME = true;
- forceSSL = true;
- };
-
- # TODO: Remove this at a certain point. <2024-12-19>
- virtualHosts."libreddit.vhack.eu" = {
- locations."/".return = "301 https://${domain}";
-
- forceSSL = true;
- enableACME = true;
- };
- };
- };
-}
diff --git a/modules/by-name/ba/backup/module.nix b/modules/vhack/ba/backup/module.nix
index 856a1c3..856a1c3 100644
--- a/modules/by-name/ba/backup/module.nix
+++ b/modules/vhack/ba/backup/module.nix
diff --git a/modules/by-name/co/coredump/module.nix b/modules/vhack/co/coredump/module.nix
index ce28ed9..ce28ed9 100644
--- a/modules/by-name/co/coredump/module.nix
+++ b/modules/vhack/co/coredump/module.nix
diff --git a/modules/by-name/dh/dhcpcd/module.nix b/modules/vhack/dh/dhcpcd/module.nix
index 0e35af3..0e35af3 100644
--- a/modules/by-name/dh/dhcpcd/module.nix
+++ b/modules/vhack/dh/dhcpcd/module.nix
diff --git a/modules/by-name/di/disko/module.nix b/modules/vhack/di/disko/module.nix
index b4fc3c8..b4fc3c8 100644
--- a/modules/by-name/di/disko/module.nix
+++ b/modules/vhack/di/disko/module.nix
diff --git a/modules/by-name/et/etesync/module.nix b/modules/vhack/et/etesync/module.nix
index bcabc8a..4dc8575 100644
--- a/modules/by-name/et/etesync/module.nix
+++ b/modules/vhack/et/etesync/module.nix
@@ -45,26 +45,14 @@ in {
];
services.nginx = {
- enable = true;
- recommendedTlsSettings = true;
- recommendedOptimisation = true;
- recommendedGzipSettings = true;
- recommendedProxySettings = true;
-
virtualHosts = {
"etebase.vhack.eu" = {
- enableACME = true;
- forceSSL = true;
-
locations = {
# TODO: Maybe fix permissions to use pregenerated static files which would
# improve performance.
#"/static" = {
# root = config.services.etebase-server.settings.global.static_root;
#};
- "/" = {
- proxyPass = "http://127.0.0.1:${builtins.toString config.services.etebase-server.port}";
- };
};
serverAliases = [
"dav.vhack.eu"
@@ -72,6 +60,8 @@ in {
};
};
};
+ vhack.anubis.instances."etebase.vhack.eu".target = "http://127.0.0.1:${builtins.toString config.services.etebase-server.port}";
+
users = {
users.etebase-server.uid = config.vhack.constants.ids.uids.etebase-server;
groups.etebase-server.gid = config.vhack.constants.ids.gids.etebase-server;
diff --git a/modules/by-name/fa/fail2ban/module.nix b/modules/vhack/fa/fail2ban/module.nix
index c619ef9..c619ef9 100644
--- a/modules/by-name/fa/fail2ban/module.nix
+++ b/modules/vhack/fa/fail2ban/module.nix
diff --git a/modules/by-name/ga/gallery/module.nix b/modules/vhack/ga/gallery/module.nix
index a5237e6..a5237e6 100644
--- a/modules/by-name/ga/gallery/module.nix
+++ b/modules/vhack/ga/gallery/module.nix
diff --git a/modules/by-name/gi/git-server/css.nix b/modules/vhack/gi/git-server/css.nix
index 7d0ad06..7d0ad06 100644
--- a/modules/by-name/gi/git-server/css.nix
+++ b/modules/vhack/gi/git-server/css.nix
diff --git a/modules/by-name/gi/git-server/module.nix b/modules/vhack/gi/git-server/module.nix
index db35897..3e2c848 100644
--- a/modules/by-name/gi/git-server/module.nix
+++ b/modules/vhack/gi/git-server/module.nix
@@ -8,8 +8,7 @@
cgitCss = import ./css.nix {
inherit pkgs;
- cgitPkg =
- config.services.cgit."${cfg.domain}".package;
+ cgitPkg = config.services.cgit."${cfg.domain}".package;
};
in {
options.vhack.git-server = {
@@ -84,10 +83,16 @@ in {
cgit."${cfg.domain}" = {
enable = true;
- package = pkgs.cgit-pink;
+ package = pkgs.cgit;
scanPath = "${config.services.gitolite.dataDir}/repositories";
user = "git";
group = "git";
+
+ # Don't bypass `cgit` when performing a http only clone.
+ # This is slightly slower, but we don't need to worry about the access
+ # restrictions also being by-passed.
+ gitHttpBackend.enable = false;
+
settings = {
branch-sort = "age";
diff --git a/modules/by-name/im/impermanence/module.nix b/modules/vhack/im/impermanence/module.nix
index 1c916e2..1c916e2 100644
--- a/modules/by-name/im/impermanence/module.nix
+++ b/modules/vhack/im/impermanence/module.nix
diff --git a/modules/by-name/in/invidious-router/module.nix b/modules/vhack/in/invidious-router/module.nix
index f85a06c..750f852 100644
--- a/modules/by-name/in/invidious-router/module.nix
+++ b/modules/vhack/in/invidious-router/module.nix
@@ -1,7 +1,7 @@
{
config,
lib,
- pkgsUnstable,
+ pkgs,
...
}: let
cfg = config.vhack.invidious-router;
@@ -21,7 +21,7 @@ in {
config = lib.mkIf cfg.enable {
services.invidious-router = {
enable = true;
- package = pkgsUnstable.invidious-router;
+ package = pkgs.invidious-router;
settings = {
app = {
listen = "127.0.0.1:8050";
diff --git a/modules/by-name/ma/mail/module.nix b/modules/vhack/ma/mail/module.nix
index 55f2fb8..62ff684 100644
--- a/modules/by-name/ma/mail/module.nix
+++ b/modules/vhack/ma/mail/module.nix
@@ -27,12 +27,6 @@ in {
mode = "0700";
}
{
- directory = "/var/lib/mail/sieve";
- user = "virtualMail";
- group = "virtualMail";
- mode = "0700";
- }
- {
directory = "/var/lib/mail/vmail";
user = "virtualMail";
group = "virtualMail";
@@ -63,27 +57,32 @@ in {
mode = "0700";
}
];
+
vhack.nginx.enable = true;
security.acme.certs = {
"${cfg.fqdn}" = {
domain = cfg.fqdn;
};
};
+
mailserver = {
enable = true;
inherit (cfg) fqdn;
- useFsLayout = true;
+ stateVersion = 5;
- extraVirtualAliases = {
+ aliases = {
"abuse@vhack.eu" = all_admins;
"postmaster@vhack.eu" = all_admins;
"admin@vhack.eu" = all_admins;
};
- mailDirectory = "/var/lib/mail/vmail";
- dkimKeyDirectory = "/var/lib/mail/dkim";
- sieveDirectory = "/var/lib/mail/sieve";
+ storage = {
+ directoryLayout = "fs";
+ path = "/var/lib/mail/vmail";
+ };
+
+ dkim.keyDirectory = "/var/lib/mail/dkim";
backup.snapshotRoot = "/var/lib/mail/backup";
enableImap = false;
@@ -95,9 +94,8 @@ in {
enableSubmissionSsl = true;
openFirewall = true;
- keyFile = "/var/lib/acme/${cfg.fqdn}/key.pem";
- certificateScheme = "acme";
- certificateFile = "/var/lib/acme/${cfg.fqdn}/fullchain.pem";
+ # Reference the existing ACME configuration created by nginx
+ x509.useACMEHost = cfg.fqdn;
domains = [
"vhack.eu"
@@ -108,9 +106,11 @@ in {
"sils.li"
"nightingale.sils.li"
"sils.sils.li"
+
+ "jaki.li"
];
- loginAccounts = {
+ accounts = {
"sils@vhack.eu" = {
hashedPassword = "$2b$05$RW/Svgk7iGxvP5W7ZwUZ1e.a3fj4fteevb2MtfFYYD0d1DQ17y9Fm";
};
@@ -140,6 +140,14 @@ in {
"@sils.li"
];
};
+ "mail@jaki.li" = {
+ hashedPassword = "$y$j9T$jaG/lkAOfYXUNiJt11DoE.$ZKTeev6b5TCBEXZzNLH12hOmy5mL.Fitp0V6saWXR73";
+ aliases = [
+ "postmaster@jaki.li"
+ "abuse@jaki.li"
+ "admin@jaki.li"
+ ];
+ };
# Mail-Account used by hosted software
"mastodon@vhack.eu" = {
@@ -156,11 +164,13 @@ in {
knot-resolver.uid = config.vhack.constants.ids.uids.knot-resolver;
redis-rspamd.uid = config.vhack.constants.ids.uids.redis-rspamd;
rspamd.uid = config.vhack.constants.ids.uids.rspamd;
+ postfix-tlspol.uid = config.vhack.constants.ids.uids.postfix-tlspol;
};
groups = {
knot-resolver.gid = lib.mkForce config.vhack.constants.ids.gids.knot-resolver;
redis-rspamd.gid = config.vhack.constants.ids.gids.redis-rspamd;
rspamd.gid = config.vhack.constants.ids.gids.rspamd;
+ postfix-tlspol.gid = config.vhack.constants.ids.gids.postfix-tlspol;
};
};
};
diff --git a/modules/by-name/ma/mastodon/module.nix b/modules/vhack/ma/mastodon/module.nix
index 895428d..84f3ec8 100644
--- a/modules/by-name/ma/mastodon/module.nix
+++ b/modules/vhack/ma/mastodon/module.nix
@@ -37,16 +37,22 @@ in {
owner = "mastodon";
group = "mastodon";
};
- vhack.persist.directories = [
- {
- directory = "/var/lib/mastodon";
- user = "mastodon";
- group = "mastodon";
- mode = "0700";
- }
- ];
- vhack.postgresql.enable = true;
+ vhack = {
+ persist.directories = [
+ {
+ directory = "/var/lib/mastodon";
+ user = "mastodon";
+ group = "mastodon";
+ mode = "0700";
+ }
+ ];
+
+ postgresql.enable = true;
+
+ nginx.enable = true;
+ };
+
services.mastodon = {
enable = true;
@@ -54,7 +60,7 @@ in {
# Unstable Mastodon package, used if
# security updates aren't backported.
- #package = applyPatches pkgs-unstable.mastodon;
+ #package = applyPatches pkgsUnstable.mastodon;
localDomain =
if cfg.enableTLD
@@ -75,7 +81,6 @@ in {
};
};
- vhack.nginx.enable = true;
services.nginx = {
enable = true;
recommendedProxySettings = true; # required for redirections to work
diff --git a/modules/by-name/ma/mastodon/patches/0001-feat-treewide-Increase-character-limit-to-5000-in-me.patch b/modules/vhack/ma/mastodon/patches/0001-feat-treewide-Increase-character-limit-to-5000-in-me.patch
index 35dc809..870492a 100644
--- a/modules/by-name/ma/mastodon/patches/0001-feat-treewide-Increase-character-limit-to-5000-in-me.patch
+++ b/modules/vhack/ma/mastodon/patches/0001-feat-treewide-Increase-character-limit-to-5000-in-me.patch
@@ -1,6 +1,6 @@
-From ab67426c53d343eee349de501767ecbbf5d211ad Mon Sep 17 00:00:00 2001
+From 265bc7b12ab8229225b13565a361051b9e120792 Mon Sep 17 00:00:00 2001
From: Benedikt Peetz <benedikt.peetz@b-peetz.de>
-Date: Sat, 21 Dec 2024 20:07:11 +0100
+Date: Tue, 7 Jul 2026 11:34:50 +0200
Subject: [PATCH] feat(treewide): Increase character limit to 5000 in messages
The default of 500 was just not enough.
@@ -10,31 +10,31 @@ The default of 500 was just not enough.
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/app/javascript/mastodon/features/compose/containers/compose_form_container.js b/app/javascript/mastodon/features/compose/containers/compose_form_container.js
-index bda2edba6..76ac65bf3 100644
+index c5cffff10d..2172a0ad8f 100644
--- a/app/javascript/mastodon/features/compose/containers/compose_form_container.js
+++ b/app/javascript/mastodon/features/compose/containers/compose_form_container.js
-@@ -28,7 +28,7 @@ const mapStateToProps = state => ({
- anyMedia: state.getIn(['compose', 'media_attachments']).size > 0,
+@@ -58,7 +58,7 @@ const mapStateToProps = state => ({
+ && !state.getIn(['settings', 'dismissed_banners', PRIVATE_QUOTE_MODAL_ID]),
isInReply: state.getIn(['compose', 'in_reply_to']) !== null,
lang: state.getIn(['compose', 'language']),
-- maxChars: state.getIn(['server', 'server', 'configuration', 'statuses', 'max_characters'], 500),
-+ maxChars: state.getIn(['server', 'server', 'configuration', 'statuses', 'max_characters'], 5000),
+- maxChars: state.getIn(['server', 'server', 'item', 'configuration', 'statuses', 'max_characters'], 500),
++ maxChars: state.getIn(['server', 'server', 'item', 'configuration', 'statuses', 'max_characters'], 5000),
});
-
- const mapDispatchToProps = (dispatch) => ({
+
+ const mapDispatchToProps = (dispatch, props) => ({
diff --git a/app/validators/status_length_validator.rb b/app/validators/status_length_validator.rb
-index dc841ded3..9cb1ec94b 100644
+index 575aaf1869..ecefca6fe9 100644
--- a/app/validators/status_length_validator.rb
+++ b/app/validators/status_length_validator.rb
@@ -1,7 +1,7 @@
# frozen_string_literal: true
-
+
class StatusLengthValidator < ActiveModel::Validator
- MAX_CHARS = 500
+ MAX_CHARS = 5000
URL_PLACEHOLDER_CHARS = 23
URL_PLACEHOLDER = 'x' * 23
-
---
-2.47.0
+
+--
+2.54.0
diff --git a/modules/by-name/ma/matrix/module.nix b/modules/vhack/ma/matrix/module.nix
index a73fd13..39631ef 100644
--- a/modules/by-name/ma/matrix/module.nix
+++ b/modules/vhack/ma/matrix/module.nix
@@ -1,6 +1,5 @@
{
config,
- pkgs,
lib,
...
}: let
@@ -24,55 +23,70 @@ in {
type = lib.types.str;
description = "The url the matrix-server should be known under.";
};
+ sharedSecretFile = lib.mkOption {
+ type = lib.types.path;
+ description = "The age encrypted shared secret file for synapse, passed to agenix";
+ };
};
+
config = lib.mkIf cfg.enable {
age.secrets.matrix-synapse_registration_shared_secret = {
- file = ./passwd.age;
+ file = cfg.sharedSecretFile;
mode = "700";
owner = "matrix-synapse";
group = "matrix-synapse";
};
networking.firewall.allowedTCPPorts = [80 443];
- vhack.persist.directories = [
- {
- directory = "/var/lib/matrix";
- user = "matrix-synapse";
- group = "matrix-synapse";
- mode = "0700";
- }
- {
- directory = "/var/lib/mautrix-whatsapp";
- user = "mautrix-whatsapp";
- group = "matrix-synapse";
- mode = "0750";
- }
- ];
- systemd.tmpfiles.rules = [
- "d /etc/matrix 0755 matrix-synapse matrix-synapse"
- ];
+ vhack = {
+ persist.directories = [
+ {
+ directory = "/var/lib/matrix";
+ user = "matrix-synapse";
+ group = "matrix-synapse";
+ mode = "0700";
+ }
+ {
+ directory = "/var/lib/mautrix-whatsapp";
+ user = "mautrix-whatsapp";
+ group = "matrix-synapse";
+ mode = "0750";
+ }
+ ];
+
+ postgresql.enable = true;
+ nginx.enable = true;
+ };
- vhack.postgresql.enable = true;
- vhack.nginx.enable = true;
+ systemd = {
+ tmpfiles.rules = [
+ "d /etc/matrix 0755 matrix-synapse matrix-synapse"
+ ];
+ # TODO: Do we still need this? <2025-12-18>
+ # The `$PSQL` env var seemed to go away between the 25.05 -> 25.11 update
+ # services.postgresql.postStart = ''
+ # $PSQL -tAc "ALTER ROLE \"matrix-synapse\" WITH PASSWORD 'synapse';"
+ # $PSQL -tAc "ALTER ROLE \"mautrix-whatsapp\" WITH PASSWORD 'whatsapp';"
+ # '';
+ };
services = {
postgresql = {
enable = true;
- initialScript = pkgs.writeText "synapse-init.sql" ''
- --Matrix:
- CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
- CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
- TEMPLATE template0
- LC_COLLATE = "C"
- LC_CTYPE = "C";
-
- --Whatsapp-bridge:
- CREATE ROLE "mautrix-whatsapp" WITH LOGIN PASSWORD 'whatsapp';
- CREATE DATABASE "mautrix-whatsapp" WITH OWNER "mautrix-whatsapp"
- TEMPLATE template0
- LC_COLLATE = "C"
- LC_CTYPE = "C";
- '';
+ ensureUsers = [
+ {
+ name = "matrix-synapse";
+ ensureDBOwnership = true;
+ }
+ {
+ name = "mautrix-whatsapp";
+ ensureDBOwnership = true;
+ }
+ ];
+ ensureDatabases = [
+ "matrix-synapse"
+ "mautrix-whatsapp"
+ ];
};
nginx = {
diff --git a/modules/by-name/mi/miniflux/module.nix b/modules/vhack/mi/miniflux/module.nix
index 0075bca..0075bca 100644
--- a/modules/by-name/mi/miniflux/module.nix
+++ b/modules/vhack/mi/miniflux/module.nix
diff --git a/modules/by-name/mu/murmur/module.nix b/modules/vhack/mu/murmur/module.nix
index 5cc6f7d..061e236 100644
--- a/modules/by-name/mu/murmur/module.nix
+++ b/modules/vhack/mu/murmur/module.nix
@@ -47,8 +47,11 @@ in {
The entire team of [name of the company] is thrilled to welcome you on board. We hope you’ll do some amazing work here!
'';
- sslKey = "${cfg.murmurStore}/key.pem";
- sslCert = "${cfg.murmurStore}/fullchain.pem";
+
+ tls = {
+ keyPath = "${cfg.murmurStore}/key.pem";
+ certPath = "${cfg.murmurStore}/fullchain.pem";
+ };
registerUrl = cfg.url;
registerName = cfg.name;
diff --git a/modules/by-name/ng/nginx/module.nix b/modules/vhack/ng/nginx/module.nix
index 27b0302..1317d4d 100644
--- a/modules/by-name/ng/nginx/module.nix
+++ b/modules/vhack/ng/nginx/module.nix
@@ -6,7 +6,7 @@
mkRedirect = _: value: {
forceSSL = true;
enableACME = true;
- locations."/".return = "301 ${value}";
+ locations."/".return = "301 ${value}$request_uri";
};
redirects = builtins.mapAttrs mkRedirect cfg.redirects;
@@ -18,15 +18,6 @@ in {
a default nginx config.
'';
- selfsign = lib.mkOption {
- type = lib.types.bool;
- default = false;
- description = ''
- Whether to selfsign the acme certificates. This should only
- really be useful for tests.
- '';
- };
-
redirects = lib.mkOption {
type = lib.types.attrsOf lib.types.str;
default = {};
@@ -39,12 +30,33 @@ in {
};
config = lib.mkIf cfg.enable {
- vhack.persist.directories = [
- "/var/lib/acme"
- ];
+ vhack = {
+ persist.directories = [
+ "/var/lib/acme"
+ ];
+
+ monitoring.prometheus = {
+ sources = [
+ {
+ name = "nginx";
+ target = "127.0.0.1:${toString config.services.prometheus.exporters.nginx.port}";
+ }
+ ];
+ };
+ };
+
+ services.prometheus.exporters.nginx = {
+ enable = true;
+ port = 9111;
+ listenAddress = "127.0.0.1";
+ scrapeUri = "http://localhost:80/nginx_status";
+ };
users = {
- users.acme.uid = config.vhack.constants.ids.uids.acme;
+ users.acme = {
+ uid = config.vhack.constants.ids.uids.acme;
+ group = "acme";
+ };
groups.acme.gid = config.vhack.constants.ids.gids.acme;
};
@@ -53,10 +65,6 @@ in {
defaults = {
email = "admin@vhack.eu";
webroot = "/var/lib/acme/acme-challenge";
-
- # Avoid spamming the acme server, if we run in a test, and only really want self-signed
- # certificates
- server = lib.mkIf cfg.selfsign "https://127.0.0.1";
};
};
@@ -65,6 +73,10 @@ in {
};
services.nginx = {
enable = true;
+
+ # Enable the status page for the prometheus exporter.
+ statusPage = lib.mkIf config.services.prometheus.enable true;
+
virtualHosts = redirects;
};
};
diff --git a/modules/by-name/ni/nix-sync/internal_module.nix b/modules/vhack/ni/nix-sync/internal_module.nix
index 4e28586..4e28586 100644
--- a/modules/by-name/ni/nix-sync/internal_module.nix
+++ b/modules/vhack/ni/nix-sync/internal_module.nix
diff --git a/modules/by-name/ni/nixconfig/module.nix b/modules/vhack/ni/nixconfig/module.nix
index a5bf950..a5bf950 100644
--- a/modules/by-name/ni/nixconfig/module.nix
+++ b/modules/vhack/ni/nixconfig/module.nix
diff --git a/modules/by-name/ns/nscd/module.nix b/modules/vhack/ns/nscd/module.nix
index 428ae3b..428ae3b 100644
--- a/modules/by-name/ns/nscd/module.nix
+++ b/modules/vhack/ns/nscd/module.nix
diff --git a/modules/by-name/oo/oomd/module.nix b/modules/vhack/oo/oomd/module.nix
index 3b39236..3b39236 100644
--- a/modules/by-name/oo/oomd/module.nix
+++ b/modules/vhack/oo/oomd/module.nix
diff --git a/modules/by-name/op/openssh/module.nix b/modules/vhack/op/openssh/module.nix
index 83aeadf..83aeadf 100644
--- a/modules/by-name/op/openssh/module.nix
+++ b/modules/vhack/op/openssh/module.nix
diff --git a/modules/by-name/pe/peertube/module.nix b/modules/vhack/pe/peertube/module.nix
index e65e0b5..e65e0b5 100644
--- a/modules/by-name/pe/peertube/module.nix
+++ b/modules/vhack/pe/peertube/module.nix
diff --git a/modules/by-name/po/postgresql/module.nix b/modules/vhack/po/postgresql/module.nix
index 319c3ac..319c3ac 100644
--- a/modules/by-name/po/postgresql/module.nix
+++ b/modules/vhack/po/postgresql/module.nix
diff --git a/modules/by-name/re/resolvconf/module.nix b/modules/vhack/re/resolvconf/module.nix
index ff99696..ff99696 100644
--- a/modules/by-name/re/resolvconf/module.nix
+++ b/modules/vhack/re/resolvconf/module.nix
diff --git a/modules/by-name/ru/rust-motd/module.nix b/modules/vhack/ru/rust-motd/module.nix
index a6998f4..bf23843 100644
--- a/modules/by-name/ru/rust-motd/module.nix
+++ b/modules/vhack/ru/rust-motd/module.nix
@@ -19,6 +19,13 @@
|| v.openssh.authorizedKeys.keyFiles != []
);
userList = builtins.mapAttrs (n: v: 2) (lib.filterAttrs pred config.users.users);
+
+ bannerFile =
+ pkgs.runCommandLocal "banner-file" {
+ nativeBuildInputs = [pkgs.figlet];
+ } ''
+ echo "${config.system.name}" | figlet -f slant > "$out"
+ '';
in {
options.vhack.rust-motd = {
enable = lib.mkEnableOption "rust-motd";
@@ -49,25 +56,22 @@ in {
banner = {
color = "red";
- command = "${pkgs.hostname}/bin/hostname | ${pkgs.figlet}/bin/figlet -f slant";
- # if you don't want a dependency on figlet, you can generate your
- # banner however you want, put it in a file, and then use something like:
- # command = "cat banner.txt"
+ # Avoid some runtime dependencies.
+ command = "cat ${bannerFile}";
+ };
+
+ cg_stats = {
+ state_file = "/var/lib/rust-motd/cg_stats_state";
+ threshold = 0.02; # When to start generating output for a cgroup
+ };
+ load_avg = {
+ format = "Load (1, 5, 15 min.): {one:.02}, {five:.02}, {fifteen:.02}";
};
uptime = {
prefix = "Uptime:";
};
- # ssl_certificates = {
- # sort_method = "manual";
- #
- # certs = {
- # "server1.vhack.eu" = "/var/lib/acme/server1.vhack.eu/cert.pem";
- # "vhack.eu" = "/var/lib/acme/vhack.eu/cert.pem";
- # };
- # };
-
filesystems = {
root = "/";
persistent = "/srv";
@@ -79,7 +83,7 @@ in {
swap_pos = "beside"; # or "below" or "none"
};
- fail2_ban = {
+ fail_2_ban = {
jails = ["sshd"]; #, "anotherjail"]
};
diff --git a/modules/by-name/us/users/module.nix b/modules/vhack/us/users/module.nix
index a197b13..e029130 100644
--- a/modules/by-name/us/users/module.nix
+++ b/modules/vhack/us/users/module.nix
@@ -27,20 +27,22 @@
};
};
- extraUsers = lib.listToAttrs (builtins.map mkUser [
- {
- name = "soispha";
- password = "$y$jFT$3.8XmUyukZvpExMUxDZkI.$IVrJgm8ysNDF/0vDD2kF6w73ozXgr1LMVRNN4Bq7pv1";
- sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIME4ZVa+IoZf6T3U08JG93i6QIAJ4amm7mkBzO14JSkz cardno:000F_18F83532";
- uid = 1000;
- }
- {
- name = "sils";
- password = "$y$jFT$KpFnahVCE9JbE.5P3us8o.$ZzSxCusWqe3sL7b6DLgOXNNUf114tiiptM6T8lDxtKC";
- sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAe4o1PM6VasT3KZNl5NYvgkkBrPOg36dqsywd10FztS openpgp:0x21D20D6A";
- uid = 1001;
- }
- ]);
+ extraUsers = lib.listToAttrs (
+ builtins.map mkUser [
+ {
+ name = "soispha";
+ password = "$y$jFT$3.8XmUyukZvpExMUxDZkI.$IVrJgm8ysNDF/0vDD2kF6w73ozXgr1LMVRNN4Bq7pv1";
+ sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIME4ZVa+IoZf6T3U08JG93i6QIAJ4amm7mkBzO14JSkz cardno:000F_18F83532";
+ uid = 1000;
+ }
+ {
+ name = "jaki";
+ password = "$y$jFT$KpFnahVCE9JbE.5P3us8o.$ZzSxCusWqe3sL7b6DLgOXNNUf114tiiptM6T8lDxtKC";
+ sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILn7Oumr5IYtTTIKRFvDnofGXXiDLBQE9jVF+7UE+4G5 vhack.eu";
+ uid = 1001;
+ }
+ ]
+ );
in {
options.vhack.users = {
enable = lib.mkEnableOption "user setup";
generated by cgit v1.3.1 (git 2.54.0) at 2026-09-20 05:06:41 +0000