about summary refs log tree commit diff stats
path: root/modules/by-name
diff options
context:
space:
mode:
Diffstat (limited to 'modules/by-name')
-rw-r--r--modules/by-name/at/atuin-sync/module.nix45
-rw-r--r--modules/by-name/ba/back/module.nix92
-rw-r--r--modules/by-name/gi/git-back/module.nix41
-rw-r--r--modules/by-name/ma/matrix/module.nix4
-rw-r--r--modules/by-name/ne/nextcloud/module.nix4
-rw-r--r--modules/by-name/re/redlib/module.nix5
-rw-r--r--modules/by-name/ru/rust-motd/module.nix32
-rw-r--r--modules/by-name/st/stalwart-mail/module.nix2
-rw-r--r--modules/by-name/ta/taskchampion-sync/module.nix43
-rw-r--r--modules/by-name/us/users/module.nix90
10 files changed, 189 insertions, 169 deletions
diff --git a/modules/by-name/at/atuin-sync/module.nix b/modules/by-name/at/atuin-sync/module.nix
new file mode 100644
index 0000000..0db2e29
--- /dev/null
+++ b/modules/by-name/at/atuin-sync/module.nix
@@ -0,0 +1,45 @@
+{
+  config,
+  lib,
+  vhackPackages,
+  ...
+}: let
+  cfg = config.vhack.atuin-sync;
+in {
+  options.vhack.atuin-sync = {
+    enable = lib.mkEnableOption "atuin sync server";
+
+    fqdn = lib.mkOption {
+      description = "The fully qualified domain name of this instance.";
+      type = lib.types.str;
+      example = "atuin-sync.atuin.sh";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    vhack.nginx.enable = true;
+
+    services = {
+      nginx.virtualHosts."${cfg.fqdn}" = {
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:${toString config.services.atuin.port}";
+          recommendedProxySettings = true;
+        };
+
+        enableACME = true;
+        forceSSL = true;
+      };
+
+      atuin = {
+        enable = true;
+        package = vhackPackages.atuin-server-only;
+        host = "127.0.0.1";
+
+        # Nobody knows about the fqdn and even if, they can only upload encrypted blobs.
+        openRegistration = true;
+
+        database.createLocally = true;
+      };
+    };
+  };
+}
diff --git a/modules/by-name/ba/back/module.nix b/modules/by-name/ba/back/module.nix
deleted file mode 100644
index d47ffce..0000000
--- a/modules/by-name/ba/back/module.nix
+++ /dev/null
@@ -1,92 +0,0 @@
-{
-  config,
-  lib,
-  vhackPackages,
-  pkgs,
-  ...
-}: let
-  cfg = config.vhack.back;
-in {
-  options.vhack.back = {
-    enable = lib.mkEnableOption "Back issue tracker (inspired by tvix's panettone)";
-
-    domain = lib.mkOption {
-      type = lib.types.str;
-      description = "The domain to host this `back` instance on.";
-    };
-
-    settings = {
-      scan_path = lib.mkOption {
-        type = lib.types.path;
-        description = "The path to the directory under which all the repositories reside";
-      };
-      project_list = lib.mkOption {
-        type = lib.types.path;
-        description = "The path to the `projects.list` file.";
-      };
-
-      source_code_repository_url = lib.mkOption {
-        description = "The url to the source code of this instance of back";
-        default = "https://git.foss-syndicate.org/vhack.eu/nixos-server/tree/pkgs/by-name/ba/back";
-        type = lib.types.str;
-      };
-
-      root_url = lib.mkOption {
-        type = lib.types.str;
-        description = "The url to this instance of back.";
-        default = "https://${cfg.domain}";
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.services."back" = {
-      description = "Back issue tracking system.";
-      requires = ["network-online.target"];
-      after = ["network-online.target"];
-      wantedBy = ["default.target"];
-
-      serviceConfig = {
-        ExecStart = "${lib.getExe vhackPackages.back} ${(pkgs.formats.json {}).generate "config.json" cfg.settings}";
-
-        # Ensure that the service can read the repository
-        # FIXME(@bpeetz): This has the implied assumption, that all the exposed git
-        # repositories are readable for the git group. This should not be necessary. <2024-12-23>
-        User = "git";
-        Group = "git";
-
-        DynamicUser = true;
-        Restart = "always";
-
-        # Sandboxing
-        ProtectSystem = "strict";
-        ProtectHome = true;
-        PrivateTmp = true;
-        PrivateDevices = true;
-        ProtectHostname = true;
-        ProtectClock = true;
-        ProtectKernelTunables = true;
-        ProtectKernelModules = true;
-        ProtectKernelLogs = true;
-        ProtectControlGroups = true;
-        RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"];
-        RestrictNamespaces = true;
-        LockPersonality = true;
-        MemoryDenyWriteExecute = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        RemoveIPC = true;
-        PrivateMounts = true;
-        # System Call Filtering
-        SystemCallArchitectures = "native";
-        SystemCallFilter = ["~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid"];
-      };
-    };
-    services.nginx.virtualHosts."${cfg.domain}" = {
-      locations."/".proxyPass = "http://127.0.0.1:8000";
-
-      enableACME = true;
-      forceSSL = true;
-    };
-  };
-}
diff --git a/modules/by-name/gi/git-back/module.nix b/modules/by-name/gi/git-back/module.nix
new file mode 100644
index 0000000..96f4913
--- /dev/null
+++ b/modules/by-name/gi/git-back/module.nix
@@ -0,0 +1,41 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.vhack.git-back;
+in {
+  options.vhack.git-back = {
+    enable = lib.mkEnableOption "Back integration into git-server";
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      description = "The domain where to deploy back";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    vhack.back = {
+      enable = true;
+
+      user = "git";
+      group = "git";
+
+      settings = {
+        scan_path = "${config.services.gitolite.dataDir}/repositories";
+        project_list = "${config.services.gitolite.dataDir}/projects.list";
+        root_url = "https://${cfg.domain}";
+      };
+    };
+
+    services.nginx = {
+      enable = true;
+      virtualHosts."${cfg.domain}" = {
+        locations."/".proxyPass = "http://127.0.0.1:8000";
+
+        enableACME = true;
+        forceSSL = true;
+      };
+    };
+  };
+}
diff --git a/modules/by-name/ma/matrix/module.nix b/modules/by-name/ma/matrix/module.nix
index f34ecf4..ae3f04e 100644
--- a/modules/by-name/ma/matrix/module.nix
+++ b/modules/by-name/ma/matrix/module.nix
@@ -63,8 +63,8 @@ in {
         "d /etc/matrix 0755 matrix-synapse matrix-synapse"
       ];
       services.postgresql.postStart = ''
-        $PSQL -tAc "ALTER ROLE matrix-synapse WITH ENCRYPTED PASSWORD 'synapse';"
-        $PSQL -tAc "ALTER ROLE mautrix-whatsapp WITH ENCRYPTED PASSWORD 'whatsapp';"
+        $PSQL -tAc "ALTER ROLE \"matrix-synapse\" WITH PASSWORD 'synapse';"
+        $PSQL -tAc "ALTER ROLE \"mautrix-whatsapp\" WITH PASSWORD 'whatsapp';"
       '';
     };
 
diff --git a/modules/by-name/ne/nextcloud/module.nix b/modules/by-name/ne/nextcloud/module.nix
index 2e40970..e0d7cb3 100644
--- a/modules/by-name/ne/nextcloud/module.nix
+++ b/modules/by-name/ne/nextcloud/module.nix
@@ -42,6 +42,10 @@ in {
     services = {
       nextcloud = {
         enable = true;
+        extraApps = {
+          inherit (cfg.package.packages.apps) calendar contacts tasks;
+        };
+        extraAppsEnable = true;
         configureRedis = true;
         config = {
           adminuser = "admin";
diff --git a/modules/by-name/re/redlib/module.nix b/modules/by-name/re/redlib/module.nix
index eb5edba..909c9f1 100644
--- a/modules/by-name/re/redlib/module.nix
+++ b/modules/by-name/re/redlib/module.nix
@@ -32,10 +32,5 @@ in {
         forceSSL = true;
       };
     };
-
-    # TODO(@bpeetz): Remove this at some point. <2025-02-04>
-    vhack.nginx.redirects = {
-      "libreddit.vhack.eu" = "${domain}";
-    };
   };
 }
diff --git a/modules/by-name/ru/rust-motd/module.nix b/modules/by-name/ru/rust-motd/module.nix
index a6998f4..8d0939a 100644
--- a/modules/by-name/ru/rust-motd/module.nix
+++ b/modules/by-name/ru/rust-motd/module.nix
@@ -19,6 +19,13 @@
     || v.openssh.authorizedKeys.keyFiles != []
   );
   userList = builtins.mapAttrs (n: v: 2) (lib.filterAttrs pred config.users.users);
+
+  bannerFile =
+    pkgs.runCommandNoCCLocal "banner-file" {
+      nativeBuildInputs = [pkgs.figlet];
+    } ''
+      echo "${config.system.name}" | figlet -f slant > "$out"
+    '';
 in {
   options.vhack.rust-motd = {
     enable = lib.mkEnableOption "rust-motd";
@@ -49,25 +56,22 @@ in {
 
         banner = {
           color = "red";
-          command = "${pkgs.hostname}/bin/hostname | ${pkgs.figlet}/bin/figlet -f slant";
-          # if you don't want a dependency on figlet, you can generate your
-          # banner however you want, put it in a file, and then use something like:
-          # command = "cat banner.txt"
+          # Avoid some runtime dependencies.
+          command = "cat ${bannerFile}";
+        };
+
+        cg_stats = {
+          state_file = "/var/lib/rust-motd/cg_stats_state";
+          threshold = 0.02; # When to start generating output for a cgroup
+        };
+        load_avg = {
+          format = "Load (1, 5, 15 min.): {one:.02}, {five:.02}, {fifteen:.02}";
         };
 
         uptime = {
           prefix = "Uptime:";
         };
 
-        # ssl_certificates = {
-        #   sort_method = "manual";
-        #
-        #   certs = {
-        #     "server1.vhack.eu" = "/var/lib/acme/server1.vhack.eu/cert.pem";
-        #     "vhack.eu" = "/var/lib/acme/vhack.eu/cert.pem";
-        #   };
-        # };
-
         filesystems = {
           root = "/";
           persistent = "/srv";
@@ -79,7 +83,7 @@ in {
           swap_pos = "beside"; # or "below" or "none"
         };
 
-        fail2_ban = {
+        fail_2_ban = {
           jails = ["sshd"]; #, "anotherjail"]
         };
 
diff --git a/modules/by-name/st/stalwart-mail/module.nix b/modules/by-name/st/stalwart-mail/module.nix
index 7bd985f..4565bf4 100644
--- a/modules/by-name/st/stalwart-mail/module.nix
+++ b/modules/by-name/st/stalwart-mail/module.nix
@@ -18,7 +18,7 @@ in {
   options.vhack.stalwart-mail = {
     enable = lib.mkEnableOption "starwart-mail";
 
-    package = lib.mkPackageOption vhackPackages "stalwart-mail-free" {};
+    package = lib.mkPackageOption vhackPackages "stalwart-mail-patched" {};
 
     admin = lib.mkOption {
       description = ''
diff --git a/modules/by-name/ta/taskchampion-sync/module.nix b/modules/by-name/ta/taskchampion-sync/module.nix
index 1870186..a722883 100644
--- a/modules/by-name/ta/taskchampion-sync/module.nix
+++ b/modules/by-name/ta/taskchampion-sync/module.nix
@@ -8,6 +8,12 @@
 in {
   options.vhack.taskchampion-sync = {
     enable = lib.mkEnableOption "taskchampion-sync";
+
+    fqdn = lib.mkOption {
+      description = "The fully qualified domain name of this instance.";
+      type = lib.types.str;
+      example = "task-sync.tw.online";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -16,19 +22,32 @@ in {
       groups.taskchampion.gid = config.vhack.constants.ids.uids.taskchampion;
     };
 
-    vhack.persist.directories = [
-      {
-        directory = dataDirectory;
-        user = "taskchampion";
-        group = "taskchampion";
-        mode = "0700";
-      }
-    ];
+    vhack = {
+      persist.directories = [
+        {
+          directory = dataDirectory;
+          user = "taskchampion";
+          group = "taskchampion";
+          mode = "0700";
+        }
+      ];
+      nginx.enable = true;
+    };
+
+    services = {
+      taskchampion-sync-server = {
+        enable = true;
+        dataDir = dataDirectory;
+      };
 
-    services.taskchampion-sync-server = {
-      enable = true;
-      openFirewall = true;
-      dataDir = dataDirectory;
+      nginx.virtualHosts."${cfg.fqdn}" = {
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:${toString config.services.taskchampion-sync-server.port}";
+          recommendedProxySettings = true;
+        };
+        enableACME = true;
+        forceSSL = true;
+      };
     };
   };
 }
diff --git a/modules/by-name/us/users/module.nix b/modules/by-name/us/users/module.nix
index a197b13..4be3f41 100644
--- a/modules/by-name/us/users/module.nix
+++ b/modules/by-name/us/users/module.nix
@@ -3,45 +3,51 @@
   lib,
   pkgs,
   ...
-}: let
+}:
+let
   cfg = config.vhack.users;
 
-  mkUser = {
-    name,
-    password,
-    uid,
-    sshKey,
-  }: {
-    inherit name;
-    value = {
-      inherit name uid;
-      isNormalUser = true;
-      home = "/home/${name}";
-      hashedPassword = password;
-      extraGroups = [
-        "wheel"
-      ];
-      openssh.authorizedKeys.keys = [
-        sshKey
-      ];
-    };
-  };
-
-  extraUsers = lib.listToAttrs (builtins.map mkUser [
+  mkUser =
     {
-      name = "soispha";
-      password = "$y$jFT$3.8XmUyukZvpExMUxDZkI.$IVrJgm8ysNDF/0vDD2kF6w73ozXgr1LMVRNN4Bq7pv1";
-      sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIME4ZVa+IoZf6T3U08JG93i6QIAJ4amm7mkBzO14JSkz cardno:000F_18F83532";
-      uid = 1000;
-    }
+      name,
+      password,
+      uid,
+      sshKey,
+    }:
     {
-      name = "sils";
-      password = "$y$jFT$KpFnahVCE9JbE.5P3us8o.$ZzSxCusWqe3sL7b6DLgOXNNUf114tiiptM6T8lDxtKC";
-      sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAe4o1PM6VasT3KZNl5NYvgkkBrPOg36dqsywd10FztS openpgp:0x21D20D6A";
-      uid = 1001;
-    }
-  ]);
-in {
+      inherit name;
+      value = {
+        inherit name uid;
+        isNormalUser = true;
+        home = "/home/${name}";
+        hashedPassword = password;
+        extraGroups = [
+          "wheel"
+        ];
+        openssh.authorizedKeys.keys = [
+          sshKey
+        ];
+      };
+    };
+
+  extraUsers = lib.listToAttrs (
+    builtins.map mkUser [
+      {
+        name = "soispha";
+        password = "$y$jFT$3.8XmUyukZvpExMUxDZkI.$IVrJgm8ysNDF/0vDD2kF6w73ozXgr1LMVRNN4Bq7pv1";
+        sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIME4ZVa+IoZf6T3U08JG93i6QIAJ4amm7mkBzO14JSkz cardno:000F_18F83532";
+        uid = 1000;
+      }
+      {
+        name = "sils";
+        password = "$y$jFT$KpFnahVCE9JbE.5P3us8o.$ZzSxCusWqe3sL7b6DLgOXNNUf114tiiptM6T8lDxtKC";
+        sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILn7Oumr5IYtTTIKRFvDnofGXXiDLBQE9jVF+7UE+4G5 vhack.eu";
+        uid = 1001;
+      }
+    ]
+  );
+in
+{
   options.vhack.users = {
     enable = lib.mkEnableOption "user setup";
   };
@@ -51,14 +57,12 @@ in {
       mutableUsers = false;
       defaultUserShell = pkgs.bashInteractive;
 
-      users =
-        {
-          root = {
-            hashedPassword = lib.mkForce null; # to lock root
-            openssh.authorizedKeys.keys = lib.mkForce [];
-          };
-        }
-        // extraUsers;
+      users = {
+        root = {
+          hashedPassword = lib.mkForce null; # to lock root
+          openssh.authorizedKeys.keys = lib.mkForce [ ];
+        };
+      } // extraUsers;
 
       # TODO(@bpeetz): Is this still relevant?
       #                If it is, it should be moved to a separate module. <2024-12-24>
generated by cgit-pink 1.4.1 (git 2.36.1) at 2025-07-07 18:46:44 +0000