diff options
Diffstat (limited to 'modules/by-name')
26 files changed, 0 insertions, 1760 deletions
diff --git a/modules/by-name/ba/back/module.nix b/modules/by-name/ba/back/module.nix deleted file mode 100644 index 520acdb..0000000 --- a/modules/by-name/ba/back/module.nix +++ /dev/null @@ -1,121 +0,0 @@ -{ - config, - lib, - vhackPackages, - pkgs, - ... -}: let - cfg = config.vhack.back; - - mkConfigFile = repoPath: domain: - (pkgs.formats.json {}).generate "config.json" - { - inherit (cfg) source_code_repository_url; - repository_path = repoPath; - root_url = "https://${domain}"; - }; - - mkUnit = repoPath: port: domain: { - description = "Back service for ${repoPath}"; - wants = ["network-online.target"]; - after = ["network-online.target"]; - wantedBy = ["default.target"]; - - environment = { - ROCKET_PORT = builtins.toString port; - }; - - serviceConfig = { - ExecStart = "${lib.getExe vhackPackages.back} ${mkConfigFile repoPath domain}"; - - # Ensure that the service can read the repository - # FIXME(@bpeetz): This has the implied assumption, that all the exposed git - # repositories are readable for the git group. This should not be necessary. <2024-12-23> - User = "git"; - Group = "git"; - - DynamicUser = true; - Restart = "always"; - - # Sandboxing - ProtectSystem = "strict"; - ProtectHome = true; - PrivateTmp = true; - PrivateDevices = true; - ProtectHostname = true; - ProtectClock = true; - ProtectKernelTunables = true; - ProtectKernelModules = true; - ProtectKernelLogs = true; - ProtectControlGroups = true; - RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"]; - RestrictNamespaces = true; - LockPersonality = true; - MemoryDenyWriteExecute = true; - RestrictRealtime = true; - RestrictSUIDSGID = true; - RemoveIPC = true; - PrivateMounts = true; - # System Call Filtering - SystemCallArchitectures = "native"; - SystemCallFilter = ["~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid"]; - }; - }; - - mkVirtalHost = port: { - locations."/".proxyPass = "http://127.0.0.1:${builtins.toString port}"; - - enableACME = true; - forceSSL = true; - }; - - services = - lib.mapAttrs' (gitPath: config: { - name = builtins.replaceStrings ["/"] ["_"] "back-${config.domain}"; - value = mkUnit gitPath config.port config.domain; - }) - cfg.repositories; - - virtualHosts = - lib.mapAttrs' (gitPath: config: { - name = config.domain; - value = mkVirtalHost config.port; - }) - cfg.repositories; -in { - options.vhack.back = { - enable = lib.mkEnableOption "Back issue tracker (inspired by tvix's panettone)"; - - source_code_repository_url = lib.mkOption { - description = "The url to the source code of this instance of back"; - default = "https://git.foss-syndicate.org/vhack.eu/nixos-server/tree/pkgs/by-name/ba/back"; - type = lib.types.str; - }; - - repositories = lib.mkOption { - description = "An attibute set of repos to launch `back` services for."; - type = lib.types.attrsOf (lib.types.submodule { - options = { - enable = (lib.mkEnableOption "`back` for this repository.") // {default = true;}; - domain = lib.mkOption { - type = lib.types.str; - description = "The domain to host this `back` instance on."; - }; - port = lib.mkOption { - type = lib.types.port; - - # TODO: This _should_ be an implementation detail, but I've no real approach to - # automatically generate them without encountering weird bugs. <2024-12-23> - description = "The port to use for this back instance. This must be unique."; - }; - }; - }); - default = {}; - }; - }; - - config = lib.mkIf cfg.enable { - systemd = {inherit services;}; - services.nginx = {inherit virtualHosts;}; - }; -} diff --git a/modules/by-name/co/constants/module.nix b/modules/by-name/co/constants/module.nix deleted file mode 100644 index a28ea0c..0000000 --- a/modules/by-name/co/constants/module.nix +++ /dev/null @@ -1,43 +0,0 @@ -# This file is inspired by the `nixos/modules/misc/ids.nix` -# file in nixpkgs. -{lib, ...}: { - options.vhack.constants = { - ids.uids = lib.mkOption { - internal = true; - description = '' - The user IDs used in the vhack.eu nixos config. - ''; - type = lib.types.attrsOf lib.types.int; - }; - ids.gids = lib.mkOption { - internal = true; - description = '' - The group IDs used in the vhack.eu nixos config. - ''; - type = lib.types.attrsOf lib.types.int; - }; - }; - - config.vhack.constants = { - ids.uids = { - acme = 328; - dhcpcd = 329; - nscd = 330; - sshd = 331; - systemd-oom = 332; - - # As per the NixOS file, the uids should not be greater or equal to 400; - }; - ids.gids = { - acme = 328; - dhcpcd = 329; - nscd = 330; - sshd = 331; - systemd-oom = 332; - resolvconf = 333; # This group is not matched to an user? - systemd-coredump = 151; # matches systemd-coredump user - - # The gid should match the uid. Thus should not be >= 400; - }; - }; -} diff --git a/modules/by-name/co/coredump/module.nix b/modules/by-name/co/coredump/module.nix deleted file mode 100644 index ce28ed9..0000000 --- a/modules/by-name/co/coredump/module.nix +++ /dev/null @@ -1,18 +0,0 @@ -{ - config, - lib, - ... -}: let - cfg = config.vhack.systemd.coredump; -in { - options.vhack.systemd.coredump = { - # NOTE(@bpeetz): Enabled by default, because that is what NixOS also does. <2024-12-25> - enable = (lib.mkEnableOption "oomd") // {default = true;}; - }; - - config = lib.mkIf cfg.enable { - users = { - groups.systemd-coredump.gid = config.vhack.constants.ids.gids.systemd-coredump; - }; - }; -} diff --git a/modules/by-name/dh/dhcpcd/module.nix b/modules/by-name/dh/dhcpcd/module.nix deleted file mode 100644 index 0e35af3..0000000 --- a/modules/by-name/dh/dhcpcd/module.nix +++ /dev/null @@ -1,18 +0,0 @@ -{ - config, - lib, - ... -}: let - cfg = config.vhack.dhcpcd; -in { - options.vhack.dhcpcd = { - enable = (lib.mkEnableOption "dhcpcd") // {default = config.networking.dhcpcd.enable;}; - }; - - config = lib.mkIf cfg.enable { - users = { - users.dhcpcd.uid = config.vhack.constants.ids.uids.dhcpcd; - groups.dhcpcd.gid = config.vhack.constants.ids.gids.dhcpcd; - }; - }; -} diff --git a/modules/by-name/di/disko/module.nix b/modules/by-name/di/disko/module.nix deleted file mode 100644 index b4fc3c8..0000000 --- a/modules/by-name/di/disko/module.nix +++ /dev/null @@ -1,78 +0,0 @@ -{ - config, - lib, - ... -}: let - cfg = config.vhack.disko; - - defaultMountOptions = ["compress-force=zstd:15" "noatime"]; -in { - options.vhack.disko = { - enable = lib.mkEnableOption "disk configuration via disko"; - - disk = lib.mkOption { - type = lib.types.path; - example = "/dev/disk/by-id/ata-WDC_WD10SDRW-11A0XS0_WD-WXP2A901KJN5"; - description = "Path to the main disk"; - }; - }; - - config = lib.mkIf cfg.enable { - disko.devices = { - disk.main = { - type = "disk"; - device = cfg.disk; - - content = { - type = "gpt"; - partitions = { - boot = { - size = "1M"; - type = "EF02"; # for grub MBR - }; - root = { - size = "100%"; - content = { - type = "btrfs"; - extraArgs = ["-f" "--label nixos"]; # f: Override existing partitions - - subvolumes = { - "/nix" = { - mountpoint = "/nix"; - mountOptions = defaultMountOptions; - }; - "/srv" = { - mountpoint = "/srv"; - mountOptions = defaultMountOptions; - }; - "/srv/.snapshots" = { - mountpoint = "/srv/.snapshots"; - mountOptions = defaultMountOptions; - }; - "/boot" = { - mountpoint = "/boot"; - mountOptions = defaultMountOptions; - }; - }; - }; - }; - }; - }; - }; - - nodev."/" = { - fsType = "tmpfs"; - mountOptions = ["defaults" "size=6G" "mode=755"]; - }; - }; - - fileSystems = { - "/srv" = { - neededForBoot = true; - }; - "/boot" = { - neededForBoot = true; - }; - }; - }; -} diff --git a/modules/by-name/et/etesync/module.nix b/modules/by-name/et/etesync/module.nix deleted file mode 100644 index 0f6c565..0000000 --- a/modules/by-name/et/etesync/module.nix +++ /dev/null @@ -1,72 +0,0 @@ -{ - config, - lib, - ... -}: let - cfg = config.vhack.etesync; -in { - options.vhack.etesync = { - enable = lib.mkEnableOption '' - a secure, end-to-end encrypted, and privacy respecting sync for your contacts, calendars, tasks and notes. - ''; - }; - - config = lib.mkIf cfg.enable { - services.etebase-server = { - enable = true; - port = 8001; - settings = { - global.secret_file = "${config.age.secrets.etebase-server.path}"; - allowed_hosts = { - allowed_host1 = "etebase.vhack.eu"; - allowed_host2 = "dav.vhack.eu"; - }; - }; - }; - - age.secrets.etebase-server = { - file = ./secret_file.age; - mode = "700"; - owner = "etebase-server"; - group = "etebase-server"; - }; - - environment.persistence."/srv".directories = [ - { - directory = "/var/lib/etebase-server"; - user = "etebase-server"; - group = "etebase-server"; - mode = "0700"; - } - ]; - - services.nginx = { - enable = true; - recommendedTlsSettings = true; - recommendedOptimisation = true; - recommendedGzipSettings = true; - recommendedProxySettings = true; - - virtualHosts = { - "etebase.vhack.eu" = { - enableACME = true; - forceSSL = true; - - locations = { - # TODO: Maybe fix permissions to use pregenerated static files which would - # improve performance. - #"/static" = { - # root = config.services.etebase-server.settings.global.static_root; - #}; - "/" = { - proxyPass = "http://127.0.0.1:${builtins.toString config.services.etebase-server.port}"; - }; - }; - serverAliases = [ - "dav.vhack.eu" - ]; - }; - }; - }; - }; -} diff --git a/modules/by-name/et/etesync/secret_file.age b/modules/by-name/et/etesync/secret_file.age deleted file mode 100644 index 8d8e3c2..0000000 --- a/modules/by-name/et/etesync/secret_file.age +++ /dev/null @@ -1,17 +0,0 @@ ------BEGIN AGE ENCRYPTED FILE----- -YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0UiswNDhQNWpsaFZUQTdY -U3F2TFlrSzhMbmRBWEIyTGQ2VGVramdPTDI4CjRGSnlqUm5rWWJ2Vk5neE56azdt -WitpbXlPWngxSGtEalBKWkRZdHF5QjQKLT4gWDI1NTE5IDRSSW1jcHhocjBIM0tM -ZjRxNUhZWkhkd1c5aVlucTMxTTVhSHRIMHMyU0EKbWlQZ0xKRXUvOWluSkZQRWdp -UjNMQWR3MHNwbUVYbm4vSGJQOGtrb2ZxVQotPiBzc2gtZWQyNTUxOSBPRDhUNGcg -SEpCY1JWZm5yMG1lL3QwUERPVUFqRWo5ZVJEb1JqNGVLS3pXVkhaYk1SYwpjb3dW -UWcrMkdmYTlvckFOYmsvcGwvY1dvc1oxY1FaY2p4eURCK3BIR044Ci0+ICgreWhl -KG9RLWdyZWFzZSAobEpLXVEgNVA3IGQKekx5YVFkeFRBUlJiUis2cFVyWlBPNncK -LS0tIFJxa0hDZUIyYm5uYlhiZjRnNHRLNTRrRW01d1hCL2dCZnByL1M2SkFyQXMK -gsR7erKGQrBhXlcnR73PbnC+PzOQlsBOg6a6DosGyixbnEgZ4DfyeK5Ep1oPB81Q -zcS9AV7h+8NlpmVM4G+0JCIC8I3TTCEQyOPwiu+GVXr4GYy/3stg+pK1htkt2V2M -WraPl//K3kvFln1KRt5lbsVXLX8SYZS4UJDzK25oJElwdNuqXHqwMkTmXjEgnbvS -pjgaNak5ooxHiZfCtzismLx5iL+P/+oohegUPvW16fQTq/eKp3mIjeBZmrWNnTuL -/xlhk0vp0+jS3+TqgGWSwAAqoCp/+TewUZ9f+GhU0/pkU3HP4+tx35rKN2wxerQj -nMbQ8SphigUeMpc501oDRw6X5ZAasoww ------END AGE ENCRYPTED FILE----- diff --git a/modules/by-name/fa/fail2ban/module.nix b/modules/by-name/fa/fail2ban/module.nix deleted file mode 100644 index c619ef9..0000000 --- a/modules/by-name/fa/fail2ban/module.nix +++ /dev/null @@ -1,58 +0,0 @@ -{ - config, - lib, - ... -}: let - cfg = config.vhack.fail2ban; -in { - options.vhack.fail2ban = { - enable = lib.mkEnableOption "fail2ban"; - }; - - config = lib.mkIf cfg.enable { - vhack.persist.directories = [ - { - directory = "/var/lib/fail2ban"; - # TODO: Fail2ban should probably run under a dedicated `fail2ban` user. <2024-12-25> - user = "root"; - group = "root"; - mode = "0700"; - } - ]; - - services.fail2ban = { - enable = true; - maxretry = 7; # ban after 7 failures - daemonSettings = { - Definition = { - logtarget = "SYSLOG"; - socket = "/run/fail2ban/fail2ban.sock"; - pidfile = "/run/fail2ban/fail2ban.pid"; - dbfile = "/var/lib/fail2ban/db.sqlite3"; - }; - }; - bantime-increment = { - enable = true; - rndtime = "8m"; - overalljails = true; - multipliers = "2 4 16 128 256"; - maxtime = "72h"; - }; - jails = { - dovecot = '' - # block IPs which failed to log-in - # aggressive mode add blocking for aborted connections - enabled = true - filter = dovecot[mode=aggressive] - maxretry = 2 - ''; - postfix = '' - enabled = true - filter = postfix[mode=aggressive] - findtime = 600 - maxretry = 3 - ''; - }; - }; - }; -} diff --git a/modules/by-name/gi/git-server/css.nix b/modules/by-name/gi/git-server/css.nix deleted file mode 100644 index 7d0ad06..0000000 --- a/modules/by-name/gi/git-server/css.nix +++ /dev/null @@ -1,119 +0,0 @@ -{ - cgitPkg, - pkgs, -}: let - /* - Adapted from `https://git.qyliss.net/nixlib/sys/atuin.nix`, originally distributed under - the MIT license. - */ - cgitCss = - pkgs.runCommand "cgit-extra.css" { - licenseHeader = '' - /* - * This program is free software: you can redistribute it and/or modify - * it under the terms of the GNU General Public License v2 as published - * by the Free Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * See <https://www.gnu.org/licenses/>. - */ - - ''; - - # Adapted from - # <https://git.causal.agency/src/plain/www/git.causal.agency/custom.css>, - # distributed as a Larger Work under a Secondary License, - # as permitted by the terms of the - # Mozilla Public License Version 2.0. - extraCss = '' - * { line-height: 1.25em; } - - article { - font-family: sans-serif; - max-width: 70ch; - margin-left: auto; - margin-right: auto; - } - - div#cgit { - margin: auto; - font-family: monospace; - -moz-tab-size: 4; - tab-size: 4; - display: table; - } - - div#cgit table#header { - margin-left: auto; - margin-right: auto; - } - div#cgit table#header td.logo { - display: none; - } - div#cgit table#header td.main { - font-size: 1em; - font-weight: bold; - } - div#cgit table#header td.sub { - border-top: none; - } - div#cgit table.tabs { - margin-left: auto; - margin-right: auto; - border-bottom: none; - } - div#cgit div.content { - border-bottom: none; - min-width: 108ch; - } - div#cgit div.content div#summary { - display: table; - margin-left: auto; - margin-right: auto; - } - div#cgit div.notes { - border: none; - background: transparent; - padding: 0; - } - div#cgit table.list { - margin-left: auto; - margin-right: auto; - } - div#cgit table.list th a { - color: inherit; - } - div#cgit table.list tr:nth-child(even) { - background: inherit; - } - div#cgit table.list tr:hover { - background: inherit; - } - div#cgit table.list tr.nohover-highlight:hover:nth-child(even) { - background: inherit; - } - div#cgit div.footer { - font-size: 1em; - margin-top: 0; - } - - div#cgit table.blob td.linenumbers:nth-last-child(3) { - display: none; - } - - div#cgit table.blob td.linenumbers a:target { - color: goldenrod; - text-decoration: underline; - outline: none; - } - ''; - passAsFile = ["licenseHeader" "extraCss"]; - } '' - cat $licenseHeaderPath ${cgitPkg}/cgit/cgit.css $extraCssPath > $out - ''; -in - cgitCss diff --git a/modules/by-name/gi/git-server/module.nix b/modules/by-name/gi/git-server/module.nix deleted file mode 100644 index db35897..0000000 --- a/modules/by-name/gi/git-server/module.nix +++ /dev/null @@ -1,188 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: let - cfg = config.vhack.git-server; - - cgitCss = import ./css.nix { - inherit pkgs; - cgitPkg = - config.services.cgit."${cfg.domain}".package; - }; -in { - options.vhack.git-server = { - enable = lib.mkEnableOption '' - a lightweight git-server, realised with cgit and gitolite. - ''; - - domain = lib.mkOption { - type = lib.types.str; - default = "git.vhack.eu"; - description = '' - The domain this git instance will run under. - ''; - }; - - gitolite = { - adminPubkey = lib.mkOption { - description = '' - The initial key to use for gitolite. This will only be used for the initial - clone of the `gitolite-admin` repository. - ''; - type = lib.types.str; - default = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAe4o1PM6VasT3KZNl5NYvgkkBrPOg36dqsywd10FztS openpgp:0x21D20D6A"; - }; - }; - }; - - config = lib.mkIf cfg.enable { - programs.git = { - enable = true; - config = { - init = { - defaultBranch = "main"; - }; - }; - }; - - # Needed for the nginx proxy and the virtual host - vhack = { - nginx.enable = true; - persist.directories = [ - { - directory = "/var/lib/gitolite"; - user = "git"; - group = "git"; - mode = "0755"; - } - ]; - }; - - services = { - gitolite = { - inherit (cfg.gitolite) adminPubkey; - enable = true; - dataDir = "/var/lib/gitolite"; - user = "git"; - group = "git"; - extraGitoliteRc = '' - $RC{UMASK} = 0027; # Enable group access, important for cgit. - - # Enable modifing git variables (for cgit.owner and such things) - # These must be enable in the gitolite-admin repo (option user-configs = ...) - push( @{$RC{ENABLE}}, 'config' ); - push( @{$RC{ENABLE}}, 'git-config' ); - - push( @{$RC{ENABLE}}, 'expand-deny-messages' ); - push( @{$RC{ENABLE}}, 'Motd' ); - - push( @{$RC{ENABLE}}, 'cgit' ); - ''; - }; - - cgit."${cfg.domain}" = { - enable = true; - package = pkgs.cgit-pink; - scanPath = "${config.services.gitolite.dataDir}/repositories"; - user = "git"; - group = "git"; - settings = { - branch-sort = "age"; - - # Allow users to download a repo checkout with these compression formats - snapshots = ["tar.gz" "zip"]; - # The template used to generate the clone url for https clone. - clone-url = [ - "https://${cfg.domain}/$CGIT_REPO_URL" - "ssh://git@${cfg.domain}/$CGIT_REPO_URL" - ]; - enable-http-clone = true; - - # TODO: We might want to add an logo and readme here <2024-07-31> - # logo = "<url>"; - # root-readme = "/some/readme/file" - root-desc = "The cgit instance of ${cfg.domain}!"; - root-title = "${ - lib.strings.toUpper (builtins.substring 0 1 cfg.domain) + builtins.substring 1 (builtins.stringLength cfg.domain) cfg.domain - } cgit instace"; - - # Set the default maximum statistics period. Valid values are "week", - # "month", "quarter" and "year". - max-stats = "week"; - - readme = [ - ":README.md" - ":readme.md" - ":README.mkd" - ":readme.mkd" - ":README.rst" - ":readme.rst" - ":README.html" - ":readme.html" - ":README.htm" - ":readme.htm" - ":README.txt" - ":readme.txt" - ":README" - ":readme" - ":INSTALL.md" - ":install.md" - ":INSTALL.mkd" - ":install.mkd" - ":INSTALL.rst" - ":install.rst" - ":INSTALL.html" - ":install.html" - ":INSTALL.htm" - ":install.htm" - ":INSTALL.txt" - ":install.txt" - ":INSTALL" - ":install" - ]; - - enable-blame = true; - enable-commit-graph = true; - enable-subject-links = true; - enable-follow-links = true; - enable-index-links = true; - enable-index-owner = true; - - # NOTE: This allows cgit to take configuration from the bare git repositories: - # All `repo.<key>` can be set by setting `cgit.<key>` in the git config. E.g.: - # setting the owner (i.e. `repo.owner`) would be done by setting the - # `cgit.owner` config. All repo options are outline in the cgitrc (5) man page. - enable-git-config = true; - - # Remove the `.git` suffix from scanned repositories (this must be set _before_ `scan-path`) - remove-suffix = true; - - css = "/custom_cgit.css"; - - # This is a number of path elements to treat as section. - # `-1` means that we treat the last element as name, all others as sections - section-from-path = -1; - - project-list = "${config.services.gitolite.dataDir}/projects.list"; - - # TODO: We might want to use the kernel.org `libravatar.lua` email-filter <2024-07-31> - source-filter = "${config.services.cgit."${cfg.domain}".package}/lib/cgit/filters/syntax-highlighting.py"; - about-filter = "${config.services.cgit."${cfg.domain}".package}/lib/cgit/filters/about-formatting.sh"; - }; - }; - - nginx.virtualHosts."${cfg.domain}" = { - enableACME = true; - forceSSL = true; - - locations = { - "= /custom_cgit.css" = { - alias = cgitCss.outPath; - }; - }; - }; - }; - }; -} diff --git a/modules/by-name/im/impermanence/module.nix b/modules/by-name/im/impermanence/module.nix deleted file mode 100644 index 1c916e2..0000000 --- a/modules/by-name/im/impermanence/module.nix +++ /dev/null @@ -1,30 +0,0 @@ -{ - config, - lib, - ... -}: let - cfg = config.vhack.persist; -in { - options.vhack.persist = { - enable = lib.mkEnableOption "impermanence"; - - directories = lib.mkOption { - description = "The list of directories to persist"; - type = lib.types.listOf (lib.types.coercedTo lib.types.str (d: {directory = d;}) (lib.types.attrsOf lib.types.anything)); - }; - }; - - config = lib.mkIf cfg.enable { - environment.persistence."/srv" = { - hideMounts = true; - directories = - [ - "/etc/nixos" - ] - ++ cfg.directories; - files = [ - "/etc/machine-id" - ]; - }; - }; -} diff --git a/modules/by-name/ng/nginx/module.nix b/modules/by-name/ng/nginx/module.nix deleted file mode 100644 index 39919c9..0000000 --- a/modules/by-name/ng/nginx/module.nix +++ /dev/null @@ -1,80 +0,0 @@ -{ - lib, - config, - ... -}: let - mkRedirect = _: value: { - forceSSL = true; - enableACME = true; - locations."/".return = "301 ${value}"; - }; - - redirects = builtins.mapAttrs mkRedirect cfg.redirects; - - cfg = config.vhack.nginx; -in { - options.vhack.nginx = { - enable = lib.mkEnableOption '' - a default nginx config. - ''; - - selfsign = lib.mkOption { - type = lib.types.bool; - default = false; - description = '' - Whether to selfsign the acme certificates. This should only - really be useful for tests. - ''; - }; - - redirects = lib.mkOption { - type = lib.types.attrsOf lib.types.str; - default = {}; - description = '' - An attrset of redirects to add. - The keys are the domain that should than be redirected to the url specified as - value. - ''; - }; - }; - - config = lib.mkIf cfg.enable { - vhack.persist.directories = [ - "/var/lib/acme" - ]; - - users = { - users.acme.uid = config.vhack.constants.ids.uids.acme; - groups.acme.gid = config.vhack.constants.ids.gids.acme; - }; - - security.acme = { - acceptTerms = true; - defaults = { - email = "admin@vhack.eu"; - webroot = "/var/lib/acme/acme-challenge"; - - # Avoid spamming the acme server, if we run in a test, and only really want self-signed - # certificates - server = lib.mkIf cfg.selfsign "https://127.0.0.1"; - }; - }; - - networking.firewall = { - allowedTCPPorts = [80 443]; - }; - services.nginx = { - enable = true; - virtualHosts = redirects; - - # FIXME(@bpeetz): Migrate to a host. <2024-12-25> - # { - # "gallery.s-schoeffel.de" = { - # forceSSL = true; - # enableACME = true; - # root = "/srv/gallery.s-schoeffel.de"; - # }; - # } - }; - }; -} diff --git a/modules/by-name/ni/nix-sync/hosts.nix b/modules/by-name/ni/nix-sync/hosts.nix deleted file mode 100644 index 98dbbf1..0000000 --- a/modules/by-name/ni/nix-sync/hosts.nix +++ /dev/null @@ -1,48 +0,0 @@ -{...}: let - extraWkdSettings = { - locations."/.well-known/openpgpkey/hu/".extraConfig = '' - default_type application/octet-stream; - - # Came from: https://www.uriports.com/blog/setting-up-openpgp-web-key-directory/ - # No idea if it is actually necessary - # add_header Access-Control-Allow-Origin * always; - ''; - }; -in [ - { - domain = "vhack.eu"; - url = "https://codeberg.org/vhack.eu/website.git"; - } - { - domain = "b-peetz.de"; - url = "https://codeberg.org/bpeetz/b-peetz.de.git"; - } - - # Trinitrix - { - domain = "trinitrix.vhack.eu"; - url = "https://codeberg.org/trinitrix/website.git"; - } - - # WKD - { - domain = "openpgpkey.b-peetz.de"; - url = "https://codeberg.org/vhack.eu/gpg_wkd.git"; - extraSettings = extraWkdSettings; - } - { - domain = "openpgpkey.s-schoeffel.de"; - url = "https://codeberg.org/vhack.eu/gpg_wkd.git"; - extraSettings = extraWkdSettings; - } - { - domain = "openpgpkey.sils.li"; - url = "https://codeberg.org/vhack.eu/gpg_wkd.git"; - extraSettings = extraWkdSettings; - } - { - domain = "openpgpkey.vhack.eu"; - url = "https://codeberg.org/vhack.eu/gpg_wkd.git"; - extraSettings = extraWkdSettings; - } -] diff --git a/modules/by-name/ni/nix-sync/internal_module.nix b/modules/by-name/ni/nix-sync/internal_module.nix deleted file mode 100644 index 4e28586..0000000 --- a/modules/by-name/ni/nix-sync/internal_module.nix +++ /dev/null @@ -1,299 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: let - cfg = config.services.nix-sync; - esa = lib.strings.escapeShellArg; - - mkTimer = name: repo: { - description = "Nix sync ${name} timer"; - wantedBy = ["timers.target"]; - timerConfig = { - OnUnitActiveSec = repo.interval; - }; - wants = ["network-online.target"]; - after = ["network-online.target"]; - }; - - parents = path: let - split_path = builtins.split "/" path; - filename = builtins.elemAt split_path (builtins.length split_path - 1); - path_build = - lib.strings.removeSuffix "/" (builtins.replaceStrings [filename] [""] path); - final_path = - if filename == "" - then parents path_build - else path_build; - in - final_path; - - mkUnit = name: repo: let - optionalPathSeparator = - if lib.strings.hasPrefix "/" repo.path - then "" - else "/"; - /* - * `ln` tries to create a symlink in the directory, if the target ends with a '/', - * thus remove it. - */ - repoPath = lib.strings.removeSuffix "/" repo.path; - - repoCachePath = cfg.cachePath + optionalPathSeparator + repo.path; - execStartScript = pkgs.writeScript "nix-sync-exec" '' - #! /usr/bin/env dash - export XDG_CACHE_HOME="$CACHE_DIRECTORY"; - cd ${esa repoCachePath}; - - git fetch - origin="$(git rev-parse @{u})"; - branch="$(git rev-parse @)"; - - if ! [ "$origin" = "$branch" ]; then - git pull --rebase; - - out_paths=$(mktemp); - nix build . --print-out-paths --experimental-features 'nix-command flakes' > "$out_paths"; - [ "$(wc -l < "$out_paths")" -gt 1 ] && { echo "To many out-paths"; exit 1; } - out_path="$(cat "$out_paths")"; - rm ${esa repoPath}; - ln -s "$out_path" ${esa repoPath}; - rm "$out_paths"; - fi - ''; - execStartPreScript = '' - export XDG_CACHE_HOME="$CACHE_DIRECTORY"; - - if ! [ -d ${esa repoCachePath}/.git ]; then - mkdir --parents ${esa repoCachePath}; - git clone ${esa repo.uri} ${esa repoCachePath}; - - out_paths=$(mktemp); - nix build ${esa repoCachePath} --print-out-paths --experimental-features 'nix-command flakes' > "$out_paths"; - [ "$(wc -l < "$out_paths")" -gt 1 ] && { echo "To many out-paths"; exit 1; } - out_path="$(cat "$out_paths")"; - ln -s "$out_path" ${esa repoPath}; - rm "$out_paths"; - fi - - if ! [ -L ${esa repoPath} ]; then - cd ${esa repoCachePath}; - - git pull --rebase; - - out_paths=$(mktemp); - nix build . --print-out-paths --experimental-features 'nix-command flakes' > "$out_paths"; - [ "$(wc -l < "$out_paths")" -gt 1 ] && { echo "To many out-paths"; exit 1; } - out_path="$(cat "$out_paths")"; - - if [ -d ${esa repoPath} ]; then - rm -d ${esa repoPath}; - else - mkdir --parents "$(dirname ${esa repoPath})"; - fi - [ -e ${esa repoPath} ] && rm ${esa repoPath}; - - ln -s "$out_path" ${esa repoPath}; - rm "$out_paths"; - fi - ''; - in { - description = "Nix Sync ${name}"; - wantedBy = ["default.target"]; - after = ["network.target"]; - path = with pkgs; [openssh git nix mktemp coreutils dash]; - preStart = execStartPreScript; - - serviceConfig = { - TimeoutSec = 0; - ExecStart = execStartScript; - Restart = "on-abort"; - # User and group - User = cfg.user; - Group = cfg.group; - # Runtime directory and mode - RuntimeDirectory = "nix-sync"; - RuntimeDirectoryMode = "0750"; - # Cache directory and mode - CacheDirectory = "nix-sync"; - CacheDirectoryMode = "0750"; - # Logs directory and mode - LogsDirectory = "nix-sync"; - LogsDirectoryMode = "0750"; - # Proc filesystem - ProcSubset = "all"; - ProtectProc = "invisible"; - # New file permissions - UMask = "0027"; # 0640 / 0750 - # Capabilities - AmbientCapabilities = ["CAP_CHOWN"]; - CapabilityBoundingSet = ["CAP_CHOWN"]; - # Security - NoNewPrivileges = true; - # Sandboxing (sorted by occurrence in https://www.freedesktop.org/software/systemd/man/systemd.exec.html) - ReadWritePaths = ["${esa (parents repo.path)}" "-${esa (parents repoCachePath)}" "-${esa cfg.cachePath}"]; - ReadOnlyPaths = ["/nix"]; # TODO: Should be irrelevant, as we have ProtectSystem=Strict <2024-06-01> - ProtectSystem = "strict"; - ProtectHome = true; - PrivateTmp = true; - PrivateDevices = true; - ProtectHostname = true; - ProtectClock = true; - ProtectKernelTunables = true; - ProtectKernelModules = true; - ProtectKernelLogs = true; - ProtectControlGroups = true; - RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"]; - RestrictNamespaces = true; - LockPersonality = true; - MemoryDenyWriteExecute = true; - RestrictRealtime = true; - RestrictSUIDSGID = true; - RemoveIPC = true; - PrivateMounts = true; - # System Call Filtering - SystemCallArchitectures = "native"; - SystemCallFilter = ["~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid"]; - }; - }; - - services = - lib.mapAttrs' (name: repo: { - name = "nix-sync-${name}"; - value = mkUnit name repo; - }) - cfg.repositories; - timers = - lib.mapAttrs' (name: repo: { - name = "nix-sync-${name}"; - value = mkTimer name repo; - }) - cfg.repositories; - - # generate the websites directory, so systemd can mount it read write - generatedDirectories = - lib.mapAttrsToList ( - _: repo: "d ${esa (parents repo.path)} 0755 ${cfg.user} ${cfg.group}" - ) - cfg.repositories; - - repositoryType = lib.types.submodule ({name, ...}: { - options = { - name = lib.mkOption { - internal = true; - default = name; - type = lib.types.str; - description = "The name that should be given to this unit."; - }; - - path = lib.mkOption { - type = lib.types.str; - description = "The path at which to sync the repository"; - }; - - uri = lib.mkOption { - type = lib.types.str; - example = "ssh://user@example.com:/~[user]/path/to/repo.git"; - description = '' - The URI of the remote to be synchronized. This is only used in the - event that the directory does not already exist. See - <link xlink:href="https://git-scm.com/docs/git-clone#_git_urls"/> - for the supported URIs. - ''; - }; - - extraSettings = lib.mkOption { - type = lib.types.attrsOf lib.types.anything; - example = lib.literalExpression '' - { - locations."/.well-known/openpgpkey/hu/" = { - extraConfig = \'\' - default_type application/octet-stream; - - add_header Access-Control-Allow-Origin * always; - \'\'; - }; - } - ''; - description = '' - Extra config to add the the nginx virtual host. - ''; - }; - - interval = lib.mkOption { - type = lib.types.int; - default = 500; - description = '' - The interval, specified in seconds, at which the synchronization will - be triggered. - ''; - }; - }; - }); -in { - options = { - services.nix-sync = { - enable = lib.mkEnableOption "nix-sync services"; - - user = lib.mkOption { - type = lib.types.str; - default = "nix-sync"; - description = lib.mdDoc "User account under which nix-sync units runs."; - }; - - group = lib.mkOption { - type = lib.types.str; - default = "nix-sync"; - description = lib.mdDoc "Group account under which nix-sync units runs."; - }; - - cachePath = lib.mkOption { - type = lib.types.str; - default = "/var/lib/nix-sync"; - description = lib.mdDoc '' - Where to cache git directories. Should not end with a slash ("/") - ''; - }; - - repositories = lib.mkOption { - type = with lib.types; attrsOf repositoryType; - description = '' - The repositories that should be synchronized. - ''; - }; - }; - }; - - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = !lib.strings.hasSuffix "/" cfg.cachePath; - message = "Your cachePath ('${cfg.cachePath}') ends with a slash ('/'), please use: '${lib.strings.removeSuffix "/" cfg.cachePath}'."; - } - ]; - systemd = { - tmpfiles.rules = - generatedDirectories; - - inherit services timers; - }; - users.users = - if cfg.user == "nix-sync" - then { - nix-sync = { - group = "${cfg.group}"; - isSystemUser = true; - }; - } - else lib.warnIf (cfg.user != "nix-sync") "The user (${cfg.user}) is not \"nix-sync\", thus you are responible for generating it."; - users.groups = - if cfg.group == "nix-sync" - then { - nix-sync = { - members = ["${cfg.user}"]; - }; - } - else lib.warnIf (cfg.group != "nix-sync") "The group (${cfg.group}) is not \"nix-sync\", thus you are responible for generating it."; - }; -} diff --git a/modules/by-name/ni/nix-sync/module.nix b/modules/by-name/ni/nix-sync/module.nix deleted file mode 100644 index de096b9..0000000 --- a/modules/by-name/ni/nix-sync/module.nix +++ /dev/null @@ -1,70 +0,0 @@ -{ - config, - lib, - ... -}: let - cfg = config.vhack.nix-sync; - - mkNixSyncRepository = { - domain, - root ? "", - url, - extraSettings ? {}, - }: { - name = "${domain}"; - value = { - path = "/etc/nginx/websites/${domain}/${root}"; - uri = "${url}"; - inherit extraSettings; - }; - }; - nixSyncRepositories = builtins.listToAttrs (builtins.map mkNixSyncRepository domains); - - mkVirtHost = { - domain, - root ? "", - url, - extraSettings ? {}, - }: { - name = "${domain}"; - value = - lib.recursiveUpdate { - forceSSL = true; - enableACME = true; - root = "/etc/nginx/websites/${domain}/${root}"; - } - extraSettings; - }; - virtHosts = builtins.listToAttrs (builtins.map mkVirtHost domains); - - domains = import ./hosts.nix {}; -in { - imports = [ - ./internal_module.nix - ]; - - options.vhack.nix-sync = { - enable = lib.mkEnableOption '' - a website git ops solution. - ''; - }; - - config = lib.mkIf cfg.enable { - vhack.persist.directories = [ - { - directory = "/var/lib/nix-sync"; - user = "nix-sync"; - group = "nix-sync"; - mode = "0700"; - } - ]; - - services.nix-sync = { - enable = true; - repositories = nixSyncRepositories; - }; - - vhack.nginx.enable = true; - services.nginx.virtualHosts = virtHosts; - }; -} diff --git a/modules/by-name/ns/nscd/module.nix b/modules/by-name/ns/nscd/module.nix deleted file mode 100644 index 428ae3b..0000000 --- a/modules/by-name/ns/nscd/module.nix +++ /dev/null @@ -1,25 +0,0 @@ -{ - config, - lib, - ... -}: let - cfg = config.vhack.nscd; -in { - options.vhack.nscd = { - # NOTE(@bpeetz): This is enabled by default in NixOS. - # Because of this reason: - # > Whether to enable the Name Service Cache Daemon. Disabling this is - # > strongly discouraged, as this effectively disables NSS Lookups from - # > all non-glibc NSS modules, including the ones provided by systemd. - # - # As such we should also always enable it. <2024-12-25> - enable = (lib.mkEnableOption "nscd") // {default = true;}; - }; - - config = lib.mkIf cfg.enable { - users = { - users.nscd.uid = config.vhack.constants.ids.uids.nscd; - groups.nscd.gid = config.vhack.constants.ids.gids.nscd; - }; - }; -} diff --git a/modules/by-name/oo/oomd/module.nix b/modules/by-name/oo/oomd/module.nix deleted file mode 100644 index 3b39236..0000000 --- a/modules/by-name/oo/oomd/module.nix +++ /dev/null @@ -1,19 +0,0 @@ -{ - config, - lib, - ... -}: let - cfg = config.vhack.systemd.oomd; -in { - options.vhack.systemd.oomd = { - # NOTE(@bpeetz): Enabled by default, because that is what NixOS also does. <2024-12-25> - enable = (lib.mkEnableOption "oomd") // {default = true;}; - }; - - config = lib.mkIf cfg.enable { - users = { - users.systemd-oom.uid = config.vhack.constants.ids.uids.systemd-oom; - groups.systemd-oom.gid = config.vhack.constants.ids.gids.systemd-oom; - }; - }; -} diff --git a/modules/by-name/op/openssh/module.nix b/modules/by-name/op/openssh/module.nix deleted file mode 100644 index 83aeadf..0000000 --- a/modules/by-name/op/openssh/module.nix +++ /dev/null @@ -1,60 +0,0 @@ -{ - config, - lib, - ... -}: let - cfg = config.vhack.openssh; -in { - options.vhack.openssh = { - enable = lib.mkEnableOption '' - a sane openssh implementation. - ''; - }; - - config = lib.mkIf cfg.enable { - /* - FIXME(@bpeetz): - This results in a boot error, as the `/var/lib/sshd` directory - is only mounted _after_ the stage 2 init and with it the system - activation. `agenix` needs the sshd hostkey however to decrypt the - secrets and thus we have to ensure that this directory is mounted - _before_ the system activation. Alas the only way I see to achieve - that is to store the ssh hostkey directly on /srv, which is mounted - before (it's marked as 'neededForBoot' after all). - - It should be possible to achieve this with impermanence however, - as `/var/log` is mounted in the stage 1 init; The problem is that - I have no idea _why_ only this is mounted and nothing else. - - - vhack.persist.directories = [ - { - directory = "/var/lib/sshd"; - user = "root"; - group = "root"; - mode = "0755"; - } - ]; - */ - - users = { - users.sshd.uid = config.vhack.constants.ids.uids.sshd; - groups.sshd.gid = config.vhack.constants.ids.gids.sshd; - }; - - services.openssh = { - enable = true; - settings.PasswordAuthentication = false; - hostKeys = [ - { - # FIXME: Remove the dependency on `/srv` this workaround. - # See the explanation for using `/srv` above. - path = "/srv/var/lib/sshd/ssh_host_ed25519_key"; - - rounds = 1000; - type = "ed25519"; - } - ]; - }; - }; -} diff --git a/modules/by-name/pe/peertube/module.nix b/modules/by-name/pe/peertube/module.nix deleted file mode 100644 index 29d1d07..0000000 --- a/modules/by-name/pe/peertube/module.nix +++ /dev/null @@ -1,113 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: let - cfg = config.vhack.peertube; -in { - options.vhack.peertube = { - enable = lib.mkEnableOption '' - the peertube video platform. - ''; - }; - - config = lib.mkIf cfg.enable { - services.peertube = { - enable = true; - - configureNginx = true; - localDomain = "peertube.vhack.eu"; - enableWebHttps = true; - listenWeb = 443; - - smtp = { - createLocally = true; - passwordFile = "${config.age.secrets.peertubeSmtp.path}"; - }; - database = { - createLocally = true; - }; - redis = { - enableUnixSocket = true; - createLocally = true; - }; - - secrets.secretsFile = "${config.age.secrets.peertubeGeneral.path}"; - - settings = { - signup = { - enabled = true; - - limit = 10; # When the limit is reached, registrations are disabled. -1 == unlimited - - minimum_age = 18; # Used to configure the signup form - - # Users fill a form to register so moderators can accept/reject the registration - requires_approval = true; - requires_email_verification = true; - }; - user = { - video_quota = "10GB"; - video_quota_daily = "2GB"; - }; - auto_blacklist = { - videos = { - of_users = { - enabled = true; - }; - }; - }; - listen.hostname = "127.0.0.1"; - instance.name = "PeerTube at Vhack.eu"; - - admin.email = "admin@vhack.eu"; - - smtp = let - emailAddress = "peertube@vhack.eu"; - in { - sendmail = "${pkgs.postfix}/bin/sendmail"; - - transport = "sendmail"; - hostname = "server1.vhack.eu"; - port = 587; - username = emailAddress; - tls = true; - disable_starttls = true; - from_address = emailAddress; - }; - }; - }; - - # The `configureNginx` option does not do this for some reason - # TODO(@bpeetz): Find out why <2024-06-27> - services.nginx.virtualHosts."${config.services.peertube.localDomain}" = { - enableACME = true; - forceSSL = true; - }; - - age.secrets = { - peertubeGeneral = { - file = ./secrets/general.age; - mode = "700"; - owner = "peertube"; - group = "peertube"; - }; - peertubeSmtp = { - file = ./secrets/smtp.age; - mode = "700"; - owner = "peertube"; - group = "peertube"; - }; - }; - - environment.persistence."/srv".directories = [ - { - directory = "/var/lib/peertube"; - user = "peertube"; - group = "peertube"; - mode = "0700"; - } - ]; - }; -} diff --git a/modules/by-name/pe/peertube/secrets/general.age b/modules/by-name/pe/peertube/secrets/general.age deleted file mode 100644 index 854ab1a..0000000 --- a/modules/by-name/pe/peertube/secrets/general.age +++ /dev/null @@ -1,15 +0,0 @@ ------BEGIN AGE ENCRYPTED FILE----- -YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlNjR4TDVUZmY2Y0hYT2hk -YmtPcFIxSXplNWF4M0V1Kzh2b2VoSTFCK0dzCmpwT2tDa3FpR082V2pyelBoS05o -RmlWRVdNdVhZbkRVUEVnaDlPdlN1bDAKLT4gWDI1NTE5IFlvaTFPc2JHcWczbEJy -eVZDS2NaUzBvbnpadk5ySVFxRTlNVXhrd2N0a3MKanJ0NEZWaTg3dE5Cbm9uNHNS -ZCs2dmU4RkFZOHNyNlJKa0cyd2VqSlFPQQotPiBzc2gtZWQyNTUxOSBPRDhUNGcg -NXhFSHdWUk1sbEUyb3FTdGpIaHlyTUJlMnlzNXBEY2lzTXpuM09WVDBrOApmM05W -d1VBSGlhMmlDYlhZS1hSdlJBUVkrVWs0bTJseS9BUmZGY1l5K0NBCi0+IEQkNi1l -LWdyZWFzZSAhIUlaOnNsZCAsUVRVKiBfRig2KGg+NSA6CmI0Q0N0cmlFbnNGSFZQ -WThEV0RHS0V2NTVaZnIyK2tUQXZTOHdsRkhyRlExdCtOeHRML2hFNDNxd08xQjlG -V3oKMThoQnF4Y3FDU3hMZjhwRUNvVWRRR3I4c1k5QnhJS1dRR2dod0EKLS0tIEZT -dHhnVXdHV3QzYThXWFJQL2szeTZ4SWM4czZYQWxJOFFIVjBZSnJ0K00KH8WdXv68 -rjAqo5RoWu91aVg5Bl2HKuiFbaGcnlkiMPZ9wGfpq4mpCc/yc4NTa6HhkaI5tA61 -PjKurnkiLXywcdyUTPuaykk+wANynLucbwfq/Mv3aLcG01soh+dFNKZV/g== ------END AGE ENCRYPTED FILE----- diff --git a/modules/by-name/pe/peertube/secrets/smtp.age b/modules/by-name/pe/peertube/secrets/smtp.age deleted file mode 100644 index 1979ea7..0000000 --- a/modules/by-name/pe/peertube/secrets/smtp.age +++ /dev/null @@ -1,16 +0,0 @@ ------BEGIN AGE ENCRYPTED FILE----- -YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtU05NMDN0Q2MrVGEraHpH -Tkwyd0NuVEQwcjljd0NUNUpsSER0V0RldWxNCjlnRHZWNmprVDYxQm90Q3pFVHR5 -enJyUTZhSVdUL1I1aC9Ya2NkMElQaFUKLT4gWDI1NTE5IHprWjRDZVlMK3Rmd1A5 -K0pZRVBIYldsOW0wQXp4SmJzM1pXdzAvZVpiWEUKd1cwR2ZNZTh6WXhQNGZBVmdN -VWpxZGxPZXJBT1dqUFd1aU4xaHAxckZLcwotPiBzc2gtZWQyNTUxOSBPRDhUNGcg -akdaS3I3VHplOENIZDg5TSt2SmRCSGpjaUZoUHVYTFJRR2wzc1RHYWNnVQpFN1Ew -MTZDNGNyKzB1aEdTMHpKaWlFLzE0blJpZ3RhOTZReTNucUp6SEdZCi0+IHloQSUq -LWdyZWFzZQo5VitXYjNxck5FbnkwYlBvUyt6R2ROVG9JOWtQNGJma1ZYd29oVlFx -blFzSytWNDA4d3lqWE9JTUVreCs2Wi92ClZCdFgwYmRmc1VsU0NhTVR4b2dtZkpK -ZTU2M24zVjd0UTRrelFXYnFEZwotLS0gT2ZlRGJsZWNPcEwxK2drdDhVSndDV3Fj -SENsN2piWWEzSFI2OW8xbk12cwrFU4dzHxb5M3miGDpWLh3XbwzsrqWlFWLLu0Ht -SDvqJGrwAPsnVn4YLSG42q1BodYfcQVvVwqRCVbkubEUDcecDTdaYDvjaS3tmDZW -u5Nabp1ujYuIewOEZ8w41napS0C553qq0mL5sYZH1C23ViW81va4X1XOJTCnmbz6 -lbh+lK8ZbZz3cer49nR8OHTtpjA9hrf4Pf/W2nMR+0exy4zDYw== ------END AGE ENCRYPTED FILE----- diff --git a/modules/by-name/po/postgresql/module.nix b/modules/by-name/po/postgresql/module.nix deleted file mode 100644 index 319c3ac..0000000 --- a/modules/by-name/po/postgresql/module.nix +++ /dev/null @@ -1,19 +0,0 @@ -{ - config, - lib, - ... -}: let - cfg = config.vhack.postgresql; -in { - options.vhack.postgresql = { - enable = lib.mkEnableOption "postgresql"; - }; - - config = lib.mkIf cfg.enable { - vhack.persist.directories = [ - "/var/lib/postgresql" - ]; - - services.postgresql.enable = true; - }; -} diff --git a/modules/by-name/re/redlib/module.nix b/modules/by-name/re/redlib/module.nix deleted file mode 100644 index 2b20c66..0000000 --- a/modules/by-name/re/redlib/module.nix +++ /dev/null @@ -1,44 +0,0 @@ -{ - config, - pkgsUnstable, - lib, - ... -}: let - domain = "redlib.vhack.eu"; - - cfg = config.vhack.redlib; -in { - options.vhack.redlib = { - enable = lib.mkEnableOption '' - the redlib reddit frontend - ''; - }; - - config = lib.mkIf cfg.enable { - services.redlib = { - enable = true; - package = pkgsUnstable.redlib; - port = 8080; - address = "127.0.0.1"; - openFirewall = false; - }; - - services.nginx = { - enable = true; - virtualHosts.${domain} = { - locations."/".proxyPass = "http://127.0.0.1:${toString config.services.redlib.port}"; - - enableACME = true; - forceSSL = true; - }; - - # TODO: Remove this at a certain point. <2024-12-19> - virtualHosts."libreddit.vhack.eu" = { - locations."/".return = "301 https://${domain}"; - - forceSSL = true; - enableACME = true; - }; - }; - }; -} diff --git a/modules/by-name/re/resolvconf/module.nix b/modules/by-name/re/resolvconf/module.nix deleted file mode 100644 index ff99696..0000000 --- a/modules/by-name/re/resolvconf/module.nix +++ /dev/null @@ -1,16 +0,0 @@ -{ - config, - lib, - ... -}: let - cfg = config.vhack.resolvconf; -in { - options.vhack.resolvconf = { - # NOTE(@bpeetz): This condition is taken directly from NixOS. <2024-12-25> - enable = lib.mkEnableOption "resolvconf" // {default = !(config.environment.etc ? "resolv.conf");}; - }; - - config = lib.mkIf cfg.enable { - users.groups.resolvconf.gid = config.vhack.constants.ids.gids.resolvconf; - }; -} diff --git a/modules/by-name/ru/rust-motd/module.nix b/modules/by-name/ru/rust-motd/module.nix deleted file mode 100644 index a6998f4..0000000 --- a/modules/by-name/ru/rust-motd/module.nix +++ /dev/null @@ -1,92 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: let - cfg = config.vhack.rust-motd; - - # List all users that can login - pred = n: v: ( - false # <- just here for neat formatting - || v.initialHashedPassword != null - || v.initialPassword != null - || v.hashedPassword != null - || v.hashedPasswordFile != null - || v.password != null - || v.passwordFile != null - || v.openssh.authorizedKeys.keys != [] - || v.openssh.authorizedKeys.keyFiles != [] - ); - userList = builtins.mapAttrs (n: v: 2) (lib.filterAttrs pred config.users.users); -in { - options.vhack.rust-motd = { - enable = lib.mkEnableOption "rust-motd"; - }; - - config = lib.mkIf cfg.enable { - systemd.services.rust-motd = { - path = with pkgs; [ - bash - fail2ban # Needed for rust-motd fail2ban integration - ]; - }; - - programs.rust-motd = { - enable = true; - enableMotdInSSHD = true; - refreshInterval = "*:0/5"; # 0/5 means: hour 0 AND all hour wich match (0 + 5 * x) (is the same as: 0, 5, 10, 15, 20) - - # An example is here: https://raw.githubusercontent.com/rust-motd/rust-motd/refs/heads/main/example_config.toml - settings = { - global = { - progress_full_character = "="; - progress_empty_character = "-"; - progress_prefix = "["; - progress_suffix = "]"; - time_format = "%Y-%m-%d %H:%M:%S"; - }; - - banner = { - color = "red"; - command = "${pkgs.hostname}/bin/hostname | ${pkgs.figlet}/bin/figlet -f slant"; - # if you don't want a dependency on figlet, you can generate your - # banner however you want, put it in a file, and then use something like: - # command = "cat banner.txt" - }; - - uptime = { - prefix = "Uptime:"; - }; - - # ssl_certificates = { - # sort_method = "manual"; - # - # certs = { - # "server1.vhack.eu" = "/var/lib/acme/server1.vhack.eu/cert.pem"; - # "vhack.eu" = "/var/lib/acme/vhack.eu/cert.pem"; - # }; - # }; - - filesystems = { - root = "/"; - persistent = "/srv"; - store = "/nix"; - boot = "/boot"; - }; - - memory = { - swap_pos = "beside"; # or "below" or "none" - }; - - fail2_ban = { - jails = ["sshd"]; #, "anotherjail"] - }; - - last_login = userList; - - last_run = {}; - }; - }; - }; -} diff --git a/modules/by-name/us/users/module.nix b/modules/by-name/us/users/module.nix deleted file mode 100644 index a197b13..0000000 --- a/modules/by-name/us/users/module.nix +++ /dev/null @@ -1,82 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: let - cfg = config.vhack.users; - - mkUser = { - name, - password, - uid, - sshKey, - }: { - inherit name; - value = { - inherit name uid; - isNormalUser = true; - home = "/home/${name}"; - hashedPassword = password; - extraGroups = [ - "wheel" - ]; - openssh.authorizedKeys.keys = [ - sshKey - ]; - }; - }; - - extraUsers = lib.listToAttrs (builtins.map mkUser [ - { - name = "soispha"; - password = "$y$jFT$3.8XmUyukZvpExMUxDZkI.$IVrJgm8ysNDF/0vDD2kF6w73ozXgr1LMVRNN4Bq7pv1"; - sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIME4ZVa+IoZf6T3U08JG93i6QIAJ4amm7mkBzO14JSkz cardno:000F_18F83532"; - uid = 1000; - } - { - name = "sils"; - password = "$y$jFT$KpFnahVCE9JbE.5P3us8o.$ZzSxCusWqe3sL7b6DLgOXNNUf114tiiptM6T8lDxtKC"; - sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAe4o1PM6VasT3KZNl5NYvgkkBrPOg36dqsywd10FztS openpgp:0x21D20D6A"; - uid = 1001; - } - ]); -in { - options.vhack.users = { - enable = lib.mkEnableOption "user setup"; - }; - - config = lib.mkIf cfg.enable { - users = { - mutableUsers = false; - defaultUserShell = pkgs.bashInteractive; - - users = - { - root = { - hashedPassword = lib.mkForce null; # to lock root - openssh.authorizedKeys.keys = lib.mkForce []; - }; - } - // extraUsers; - - # TODO(@bpeetz): Is this still relevant? - # If it is, it should be moved to a separate module. <2024-12-24> - # nixremote = { - # name = "nixremote"; - # isNormalUser = true; - # createHome = true; - # home = "/home/nixremote"; - # uid = 1003; - # group = "nixremote"; - # openssh.authorizedKeys.keys = [ - # "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCbSWqFzb+WTq2JVoRGoTkCkP7AM3bNY91bsUBeoQQc8gKAWuqCrpAOmr2Q2QMaTTGEOM0CsWfWLs3ZYtynHmc7wIFc4T/sUloV+dB9oSCmOk5ePxtj8+gpPK35Ja+ug5zmXsaI4s+n9mEbuuEjn33MxDYCUzAI+aWvWe68u/j+FM3u9c3Ta009rotajjSZ/cmIltgNLsG1rnAZRpwmLVg5UL4cb9um54o/NLYFd2KAekQFVbwUQDzzqriZhWmzkfhnznBMDblf9R1xvZ18Lqv3JF21shdaR43NW1wtuntBvAdsVYK2VUEbj+3MxTkK0aQ/E9SHMtH8MRE4oxU74TeTWfIhuSZk9/wekzSNMkHP3ReFC6B9xCMYa+ZqaTaGSWLQi78AQDeM2F9rAfp3hQzyRa7T7qKlgbae/hEb07xZglqmG7eml9vPSt4AHv5Y176Q95NiiWduGoLQOmjvSBMU9/KEGrGKyLfGH1Wa2EOfPxKKcvcHW0Xi9PlPiuP0nYk= root@thinklappi" - # ]; - # }; - # }; - # groups.nixremote = { - # gid = 1004; - # }; - }; - }; -} |