chore(ops/modules): Cleanup leftovers from TVL
Change-Id: I979cb18f3b8d461d21424e8dae6b0b2d7407809d Reviewed-on: https://cl.snix.dev/c/snix/+/30106 Tested-by: besadii Reviewed-by: Ryan Lahfa <masterancpp@gmail.com> Autosubmit: Ilan Joselevich <personal@ilanjoselevich.com>
This commit is contained in:
Ilan Joselevich
clbot
parent
f8bdafd3f2
commit
580f03f6fd
21 changed files with 0 additions and 1113 deletions
|
|
@ -1,38 +0,0 @@
|
|||
{ depot, config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.depot.atward;
|
||||
description = "atward - (attempt to) cleverly route queries";
|
||||
in
|
||||
{
|
||||
options.services.depot.atward = {
|
||||
enable = lib.mkEnableOption description;
|
||||
|
||||
host = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "[::1]";
|
||||
description = "Host on which atward should listen";
|
||||
};
|
||||
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 28973;
|
||||
description = "Port on which atward should listen";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services.atward = {
|
||||
inherit description;
|
||||
script = "${depot.web.atward}/bin/atward";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
Restart = "always";
|
||||
};
|
||||
|
||||
environment.ATWARD_LISTEN_ADDRESS = "${cfg.host}:${toString cfg.port}";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
# Automatically performs a scrub on all btrfs filesystems configured in
|
||||
# `config.fileSystems` on a daily schedule (by default). Activated by importing.
|
||||
{ config, lib, ... }:
|
||||
|
||||
{
|
||||
config = {
|
||||
services = {
|
||||
btrfs.autoScrub = {
|
||||
enable = true;
|
||||
interval = lib.mkDefault "*-*-* 03:30:00";
|
||||
# gather all btrfs fileSystems, extra ones can be added via the NixOS
|
||||
# module merging mechanism, of course.
|
||||
fileSystems = lib.concatLists (
|
||||
lib.mapAttrsToList
|
||||
(
|
||||
_:
|
||||
{ fsType, mountPoint, ... }:
|
||||
if fsType == "btrfs" then [ mountPoint ] else [ ]
|
||||
)
|
||||
config.fileSystems
|
||||
);
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,110 +0,0 @@
|
|||
# This is a fork of the nixpkgs module for Harmonia, which adds compatibility
|
||||
# with Nix 2.3.
|
||||
#
|
||||
# We will upstream this eventually.
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.services.depot.harmonia;
|
||||
format = pkgs.formats.toml { };
|
||||
|
||||
credentials = lib.imap0
|
||||
(i: signKeyPath: {
|
||||
id = "sign-key-${builtins.toString i}";
|
||||
path = signKeyPath;
|
||||
})
|
||||
cfg.signKeyPaths;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
services.depot.harmonia = {
|
||||
enable = lib.mkEnableOption "Harmonia: Nix binary cache written in Rust";
|
||||
|
||||
signKeyPaths = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.path;
|
||||
default = [ ];
|
||||
description = "Paths to the signing keys to use for signing the cache";
|
||||
};
|
||||
|
||||
package = lib.mkPackageOption pkgs "harmonia" { };
|
||||
|
||||
settings = lib.mkOption {
|
||||
inherit (format) type;
|
||||
default = { };
|
||||
description = ''
|
||||
Settings to merge with the default configuration.
|
||||
For the list of the default configuration, see <https://github.com/nix-community/harmonia/tree/master#configuration>.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
users.users.harmonia = {
|
||||
isSystemUser = true;
|
||||
group = "harmonia";
|
||||
};
|
||||
users.groups.harmonia = { };
|
||||
|
||||
systemd.services.harmonia = {
|
||||
description = "harmonia binary cache service";
|
||||
|
||||
requires = [ "nix-daemon.socket" ];
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
environment = {
|
||||
CONFIG_FILE = format.generate "harmonia.toml" cfg.settings;
|
||||
SIGN_KEY_PATHS = lib.strings.concatMapStringsSep " "
|
||||
(
|
||||
credential: "%d/${credential.id}"
|
||||
)
|
||||
credentials;
|
||||
# Note: it's important to set this for nix-store, because it wants to use
|
||||
# $HOME in order to use a temporary cache dir. bizarre failures will occur
|
||||
# otherwise
|
||||
HOME = "/run/harmonia";
|
||||
};
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = lib.getExe cfg.package;
|
||||
User = "harmonia";
|
||||
Group = "harmonia";
|
||||
Restart = "on-failure";
|
||||
PrivateUsers = true;
|
||||
DeviceAllow = [ "" ];
|
||||
UMask = "0066";
|
||||
RuntimeDirectory = "harmonia";
|
||||
LoadCredential = builtins.map (credential: "${credential.id}:${credential.path}") credentials;
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@privileged"
|
||||
"~@resources"
|
||||
];
|
||||
CapabilityBoundingSet = "";
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectHostname = true;
|
||||
ProtectClock = true;
|
||||
RestrictRealtime = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
ProcSubset = "pid";
|
||||
ProtectProc = "invisible";
|
||||
RestrictNamespaces = true;
|
||||
SystemCallArchitectures = "native";
|
||||
PrivateNetwork = false;
|
||||
PrivateTmp = true;
|
||||
PrivateDevices = true;
|
||||
PrivateMounts = true;
|
||||
NoNewPrivileges = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
LockPersonality = true;
|
||||
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
|
||||
LimitNOFILE = 65536;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
|
@ -1,64 +0,0 @@
|
|||
{ depot, config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.depot.irccat;
|
||||
description = "irccat - forward messages to IRC";
|
||||
|
||||
# irccat expects to read its configuration from the *current
|
||||
# directory*, and its configuration contains secrets.
|
||||
#
|
||||
# To make this work we construct the JSON configuration file and
|
||||
# then recursively merge it with an on-disk secret using jq on
|
||||
# service launch.
|
||||
configJson = pkgs.writeText "irccat.json" (builtins.toJSON cfg.config);
|
||||
|
||||
# Right now, merging configuration file with secrets and running the main
|
||||
# application needs to happen both in ExecStart=, due to
|
||||
# https://github.com/systemd/systemd/issues/19604#issuecomment-989279884
|
||||
mergeAndLaunch = pkgs.writeShellScript "merge-irccat-config" ''
|
||||
if [ ! -f "$CREDENTIALS_DIRECTORY/secrets" ]; then
|
||||
echo "irccat secrets file is missing"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# jq's * is the recursive merge operator
|
||||
${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${configJson} "$CREDENTIALS_DIRECTORY/secrets" \
|
||||
> /var/lib/irccat/irccat.json
|
||||
|
||||
exec ${depot.third_party.irccat}/bin/irccat
|
||||
'';
|
||||
in
|
||||
{
|
||||
options.services.depot.irccat = {
|
||||
enable = lib.mkEnableOption description;
|
||||
|
||||
config = lib.mkOption {
|
||||
type = lib.types.attrsOf lib.types.anything; # varying value types
|
||||
description = "Configuration structure (unchecked!)";
|
||||
};
|
||||
|
||||
secretsFile = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Path to the secrets file to be merged";
|
||||
default = config.age.secretsDir + "/irccat";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services.irccat = {
|
||||
inherit description;
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = "${mergeAndLaunch}";
|
||||
DynamicUser = true;
|
||||
StateDirectory = "irccat";
|
||||
WorkingDirectory = "/var/lib/irccat";
|
||||
LoadCredential = "secrets:${cfg.secretsFile}";
|
||||
Restart = "always";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,33 +0,0 @@
|
|||
# Configures the public josh instance for serving the depot.
|
||||
{ config, depot, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.depot.josh;
|
||||
in
|
||||
{
|
||||
options.services.depot.josh = with lib; {
|
||||
enable = mkEnableOption "Enable josh for serving the depot";
|
||||
|
||||
port = mkOption {
|
||||
description = "Port on which josh should listen";
|
||||
type = types.int;
|
||||
default = 5674;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# Run josh for the depot.
|
||||
systemd.services.josh = {
|
||||
description = "josh - partial cloning of monorepos";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
path = [ pkgs.git pkgs.bash ];
|
||||
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
StateDirectory = "josh";
|
||||
Restart = "always";
|
||||
ExecStart = "${pkgs.josh}/bin/josh-proxy --no-background --local /var/lib/josh --port ${toString cfg.port} --remote https://cl.tvl.fyi/ --require-auth";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,102 +0,0 @@
|
|||
# Configures a code search instance using Livegrep.
|
||||
#
|
||||
# We do not currently build Livegrep in Nix, because it's a complex,
|
||||
# multi-language Bazel build and doesn't play nicely with Nix.
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.depot.livegrep;
|
||||
|
||||
livegrepConfig = {
|
||||
name = "livegrep";
|
||||
|
||||
fs_paths = [{
|
||||
name = "depot";
|
||||
path = "/depot";
|
||||
metadata.url_pattern = "https://code.tvl.fyi/tree/{path}?id={version}#n{lno}";
|
||||
}];
|
||||
|
||||
repositories = [{
|
||||
name = "depot";
|
||||
path = "/depot";
|
||||
revisions = [ "HEAD" ];
|
||||
|
||||
metadata = {
|
||||
url_pattern = "https://code.tvl.fyi/tree/{path}?id={version}#n{lno}";
|
||||
remote = "https://cl.tvl.fyi/depot.git";
|
||||
};
|
||||
}];
|
||||
};
|
||||
|
||||
configFile = pkgs.writeText "livegrep-config.json" (builtins.toJSON livegrepConfig);
|
||||
|
||||
# latest as of 2024-02-17
|
||||
image = "ghcr.io/livegrep/livegrep/base:033fa0e93c";
|
||||
in
|
||||
{
|
||||
options.services.depot.livegrep = with lib; {
|
||||
enable = mkEnableOption "Run livegrep code search for depot";
|
||||
|
||||
port = mkOption {
|
||||
description = "Port on which livegrep web UI should listen";
|
||||
type = types.int;
|
||||
default = 5477; # lgrp
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
virtualisation.oci-containers.containers.livegrep-codesearch = {
|
||||
inherit image;
|
||||
extraOptions = [ "--net=host" ];
|
||||
|
||||
volumes = [
|
||||
"${configFile}:/etc/livegrep-config.json:ro"
|
||||
"/var/lib/gerrit/git/depot.git:/depot:ro"
|
||||
];
|
||||
|
||||
entrypoint = "/livegrep/bin/codesearch";
|
||||
cmd = [
|
||||
"-grpc"
|
||||
"0.0.0.0:5427" # lgcs
|
||||
"-reload_rpc"
|
||||
"-revparse"
|
||||
"/etc/livegrep-config.json"
|
||||
];
|
||||
};
|
||||
|
||||
virtualisation.oci-containers.containers.livegrep-frontend = {
|
||||
inherit image;
|
||||
dependsOn = [ "livegrep-codesearch" ];
|
||||
extraOptions = [ "--net=host" ];
|
||||
|
||||
entrypoint = "/livegrep/bin/livegrep";
|
||||
cmd = [
|
||||
"-listen"
|
||||
"0.0.0.0:${toString cfg.port}"
|
||||
"-reload"
|
||||
"-connect"
|
||||
"localhost:5427"
|
||||
"-docroot"
|
||||
"/livegrep/web"
|
||||
# TODO(tazjin): docroot with styles etc.
|
||||
];
|
||||
};
|
||||
|
||||
systemd.services.livegrep-reindex = {
|
||||
script = "${pkgs.podman}/bin/podman exec livegrep-codesearch /livegrep/bin/livegrep-reload localhost:5427";
|
||||
serviceConfig.Type = "oneshot";
|
||||
};
|
||||
|
||||
systemd.paths.livegrep-reindex = {
|
||||
description = "Executes a livegrep reindex if depot refs change";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
pathConfig = {
|
||||
PathChanged = [
|
||||
"/var/lib/gerrit/git/depot.git/packed-refs"
|
||||
"/var/lib/gerrit/git/depot.git/refs"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,106 +0,0 @@
|
|||
# Runs the TVL Monitoring setup (currently Grafana + Prometheus).
|
||||
{ depot, pkgs, config, lib, ... }:
|
||||
|
||||
{
|
||||
# Required for prometheus to be able to scrape stats
|
||||
services.nginx.statusPage = true;
|
||||
|
||||
# Configure Prometheus & Grafana. Exporter configuration for
|
||||
# Prometheus is inside the respective service modules.
|
||||
services.prometheus = {
|
||||
enable = true;
|
||||
retentionTime = "90d";
|
||||
|
||||
exporters = {
|
||||
node = {
|
||||
enable = true;
|
||||
|
||||
enabledCollectors = [
|
||||
"logind"
|
||||
"processes"
|
||||
"systemd"
|
||||
];
|
||||
};
|
||||
|
||||
nginx = {
|
||||
enable = true;
|
||||
sslVerify = false;
|
||||
constLabels = [ "host=${config.networking.hostName}" ];
|
||||
};
|
||||
};
|
||||
|
||||
scrapeConfigs = [{
|
||||
job_name = "node";
|
||||
scrape_interval = "5s";
|
||||
static_configs = [{
|
||||
targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ];
|
||||
}];
|
||||
}
|
||||
{
|
||||
job_name = "nginx";
|
||||
scrape_interval = "5s";
|
||||
static_configs = [{
|
||||
targets = [ "localhost:${toString config.services.prometheus.exporters.nginx.port}" ];
|
||||
}];
|
||||
}];
|
||||
};
|
||||
|
||||
services.grafana = {
|
||||
enable = true;
|
||||
|
||||
settings = {
|
||||
server = {
|
||||
http_port = 4723; # "graf" on phone keyboard
|
||||
domain = "status.tvl.su";
|
||||
root_url = "https://status.tvl.su";
|
||||
};
|
||||
|
||||
analytics.reporting_enabled = false;
|
||||
|
||||
"auth.generic_oauth" = {
|
||||
enabled = true;
|
||||
client_id = "grafana";
|
||||
scopes = "openid profile email";
|
||||
name = "TVL";
|
||||
email_attribute_path = "mail";
|
||||
login_attribute_path = "sub";
|
||||
name_attribute_path = "displayName";
|
||||
auth_url = "https://auth.tvl.fyi/auth/realms/TVL/protocol/openid-connect/auth";
|
||||
token_url = "https://auth.tvl.fyi/auth/realms/TVL/protocol/openid-connect/token";
|
||||
api_url = "https://auth.tvl.fyi/auth/realms/TVL/protocol/openid-connect/userinfo";
|
||||
|
||||
# Give lukegb, aspen, tazjin "Admin" rights.
|
||||
role_attribute_path = "((sub == 'lukegb' || sub == 'aspen' || sub == 'tazjin') && 'Admin') || 'Editor'";
|
||||
|
||||
# Allow creating new Grafana accounts from OAuth accounts.
|
||||
allow_sign_up = true;
|
||||
};
|
||||
|
||||
"auth.anonymous" = {
|
||||
enabled = true;
|
||||
org_name = "The Virus Lounge";
|
||||
org_role = "Viewer";
|
||||
};
|
||||
|
||||
"auth.basic".enabled = false;
|
||||
|
||||
auth = {
|
||||
oauth_auto_login = true;
|
||||
disable_login_form = true;
|
||||
};
|
||||
};
|
||||
|
||||
provision = {
|
||||
enable = true;
|
||||
datasources.settings.datasources = [{
|
||||
name = "Prometheus";
|
||||
type = "prometheus";
|
||||
url = "http://localhost:9090";
|
||||
}];
|
||||
};
|
||||
};
|
||||
|
||||
# Contains GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET.
|
||||
systemd.services.grafana.serviceConfig.EnvironmentFile = config.age.secretsDir + "/grafana";
|
||||
}
|
||||
|
||||
|
|
@ -1,54 +0,0 @@
|
|||
# NixOS module to configure the Estonian e-ID software.
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
services.pcscd.enable = true;
|
||||
|
||||
# Tell p11-kit to load/proxy opensc-pkcs11.so, providing all available slots
|
||||
# (PIN1 for authentication/decryption, PIN2 for signing).
|
||||
environment.etc."pkcs11/modules/opensc-pkcs11".text = ''
|
||||
module: ${pkgs.opensc}/lib/opensc-pkcs11.so
|
||||
'';
|
||||
|
||||
# Configure Firefox (in case users set `programs.firefox.enable = true;`)
|
||||
programs.firefox = {
|
||||
# Allow a possibly installed "Web eID" extension to do native messaging with
|
||||
# the "web-eid-app" native component.
|
||||
# Users not using `programs.firefox.enable` can override their firefox
|
||||
# derivation, by setting `extraNativeMessagingHosts = [ pkgs.web-eid-app ]`.
|
||||
nativeMessagingHosts.packages = [ pkgs.web-eid-app ];
|
||||
# Configure Firefox to load smartcards via p11kit-proxy.
|
||||
# Users not using `programs.firefox.enable` can override their firefox
|
||||
# derivation, by setting
|
||||
# `extraPolicies.SecurityDevices.p11-kit-proxy "${pkgs.p11-kit}/lib/p11-kit-proxy.so"`.
|
||||
policies.SecurityDevices.p11-kit-proxy = "${pkgs.p11-kit}/lib/p11-kit-proxy.so";
|
||||
};
|
||||
|
||||
# Chromium users need a symlink to their (slightly different) .json file
|
||||
# in the native messaging hosts' manifest file location.
|
||||
environment.etc."chromium/native-messaging-hosts/eu.webeid.json".source = "${pkgs.web-eid-app}/share/web-eid/eu.webeid.json";
|
||||
environment.etc."opt/chrome/native-messaging-hosts/eu.webeid.json".source = "${pkgs.web-eid-app}/share/web-eid/eu.webeid.json";
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
libdigidocpp.bin # provides digidoc-tool(1)
|
||||
qdigidoc
|
||||
|
||||
# Wrapper script to tell to Chrome/Chromium to use p11-kit-proxy to load
|
||||
# security devices, so they can be used for TLS client auth.
|
||||
# Each user needs to run this themselves, it does not work on a system level
|
||||
# due to a bug in Chromium:
|
||||
#
|
||||
# https://bugs.chromium.org/p/chromium/issues/detail?id=16387
|
||||
#
|
||||
# Firefox users can just set
|
||||
# extraPolicies.SecurityDevices.p11-kit-proxy "${pkgs.p11-kit}/lib/p11-kit-proxy.so";
|
||||
# when overriding the firefox derivation.
|
||||
(pkgs.writeShellScriptBin "setup-browser-eid" ''
|
||||
NSSDB="''${HOME}/.pki/nssdb"
|
||||
mkdir -p ''${NSSDB}
|
||||
|
||||
${pkgs.nssTools}/bin/modutil -force -dbdir sql:$NSSDB -add p11-kit-proxy \
|
||||
-libfile ${pkgs.p11-kit}/lib/p11-kit-proxy.so
|
||||
'')
|
||||
];
|
||||
}
|
||||
|
|
@ -1,68 +0,0 @@
|
|||
# Run the owothia IRC bot.
|
||||
{ depot, config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.depot.owothia;
|
||||
description = "owothia - i'm a service owo";
|
||||
in
|
||||
{
|
||||
options.services.depot.owothia = {
|
||||
enable = lib.mkEnableOption description;
|
||||
|
||||
secretsFile = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "File path from which systemd should read secrets";
|
||||
default = config.age.secretsDir + "/owothia";
|
||||
};
|
||||
|
||||
owoChance = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
description = "How likely is owo?";
|
||||
default = 200;
|
||||
};
|
||||
|
||||
ircServer = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "IRC server hostname";
|
||||
};
|
||||
|
||||
ircPort = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
description = "IRC server port";
|
||||
};
|
||||
|
||||
ircIdent = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "IRC username";
|
||||
default = "owothia";
|
||||
};
|
||||
|
||||
ircChannels = lib.mkOption {
|
||||
type = with lib.types; listOf str;
|
||||
description = "IRC channels to join";
|
||||
default = [ "#tvl" ];
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services.owothia = {
|
||||
inherit description;
|
||||
script = "${depot.fun.owothia}/bin/owothia";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
Restart = "always";
|
||||
EnvironmentFile = cfg.secretsFile;
|
||||
};
|
||||
|
||||
environment = {
|
||||
OWO_CHANCE = toString cfg.owoChance;
|
||||
IRC_SERVER = cfg.ircServer;
|
||||
IRC_PORT = toString cfg.ircPort;
|
||||
IRC_IDENT = cfg.ircIdent;
|
||||
IRC_CHANNELS = builtins.toJSON cfg.ircChannels;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,28 +0,0 @@
|
|||
{ depot, config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.depot.paroxysm;
|
||||
description = "TVL's majestic IRC bot";
|
||||
in
|
||||
{
|
||||
options.services.depot.paroxysm.enable = lib.mkEnableOption description;
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services.paroxysm = {
|
||||
inherit description;
|
||||
script = "${depot.fun.paroxysm}/bin/paroxysm";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
environment = {
|
||||
PARX_DATABASE_URL = "postgresql://tvldb:tvldb@localhost/tvldb";
|
||||
PARX_IRC_CONFIG_PATH = "/var/lib/paroxysm/irc.toml";
|
||||
};
|
||||
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
StateDirectory = "paroxysm";
|
||||
Restart = "always";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,52 +0,0 @@
|
|||
{ config, lib, pkgs, depot, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.prometheus-fail2ban-exporter;
|
||||
in
|
||||
|
||||
{
|
||||
options.services.prometheus-fail2ban-exporter = with lib; {
|
||||
enable = mkEnableOption "Prometheus Fail2ban Exporter";
|
||||
|
||||
interval = mkOption {
|
||||
description = "Systemd calendar expression for how often to run the interval";
|
||||
type = types.str;
|
||||
default = "minutely";
|
||||
example = "hourly";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services."prometheus-fail2ban-exporter" = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" "fail2ban.service" ];
|
||||
serviceConfig = {
|
||||
User = "root";
|
||||
Type = "oneshot";
|
||||
ExecStart = pkgs.writeShellScript "prometheus-fail2ban-exporter" ''
|
||||
set -eo pipefail
|
||||
mkdir -p /var/lib/prometheus/node-exporter
|
||||
exec prometheus-fail2ban-exporter
|
||||
'';
|
||||
};
|
||||
|
||||
path = [
|
||||
pkgs.fail2ban
|
||||
depot.third_party.prometheus-fail2ban-exporter
|
||||
];
|
||||
};
|
||||
|
||||
systemd.timers."prometheus-fail2ban-exporter" = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
timerConfig.OnCalendar = cfg.interval;
|
||||
};
|
||||
|
||||
services.prometheus.exporters.node = {
|
||||
enabledCollectors = [ "textfile" ];
|
||||
|
||||
extraFlags = [
|
||||
"--collector.textfile.directory=/var/lib/prometheus/node-exporter"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,83 +0,0 @@
|
|||
# A more modern module for running Quassel.
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.depot.quassel;
|
||||
quasselDaemon = pkgs.quassel.override {
|
||||
monolithic = false;
|
||||
enableDaemon = true;
|
||||
withKDE = false;
|
||||
};
|
||||
in
|
||||
{
|
||||
options.services.depot.quassel = with lib; {
|
||||
enable = mkEnableOption "Quassel IRC daemon";
|
||||
|
||||
acmeHost = mkOption {
|
||||
description = "ACME host to use for the Quassel TLS certificate";
|
||||
type = lib.types.str;
|
||||
};
|
||||
|
||||
bindAddresses = mkOption {
|
||||
description = "Addresses Quassel will bind to/listen on";
|
||||
default = [ "127.0.0.1" ];
|
||||
};
|
||||
|
||||
logLevel = mkOption {
|
||||
description = "Log level for Quassel Core";
|
||||
default = "Info";
|
||||
type = lib.types.enum [
|
||||
"Debug"
|
||||
"Info"
|
||||
"Warning"
|
||||
"Error"
|
||||
];
|
||||
};
|
||||
|
||||
port = mkOption {
|
||||
default = 6698;
|
||||
description = ''
|
||||
The port number the Quassel daemon will be listening to.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = with lib; mkIf cfg.enable {
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
systemd.services.quassel = {
|
||||
description = "Quassel IRC daemon";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
script = concatStringsSep " " [
|
||||
"${quasselDaemon}/bin/quasselcore"
|
||||
"--listen=${concatStringsSep "," cfg.bindAddresses}"
|
||||
"--port=${toString cfg.port}"
|
||||
"--configdir=/var/lib/quassel"
|
||||
"--require-ssl"
|
||||
"--ssl-cert=$CREDENTIALS_DIRECTORY/quassel.pem"
|
||||
"--loglevel=${cfg.logLevel}"
|
||||
];
|
||||
|
||||
serviceConfig = {
|
||||
Restart = "always";
|
||||
User = "quassel";
|
||||
Group = "quassel";
|
||||
StateDirectory = "quassel";
|
||||
|
||||
# Avoid trouble with the ACME file permissions by using the
|
||||
# systemd credentials feature.
|
||||
LoadCredential = "quassel.pem:/var/lib/acme/${cfg.acmeHost}/full.pem";
|
||||
};
|
||||
};
|
||||
|
||||
users = {
|
||||
users.quassel = {
|
||||
isSystemUser = true;
|
||||
group = "quassel";
|
||||
};
|
||||
|
||||
groups.quassel = { };
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,61 +0,0 @@
|
|||
# NixOS module for configuring the simple SMTP relay.
|
||||
{ depot, pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
inherit (builtins) attrValues mapAttrs;
|
||||
inherit (lib)
|
||||
concatStringsSep
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
types
|
||||
;
|
||||
|
||||
cfg = config.services.depot.smtprelay;
|
||||
description = "Simple SMTP relay";
|
||||
|
||||
# Configuration values that are always overridden.
|
||||
#
|
||||
# - logging is pinned to stdout for journald compatibility
|
||||
# - secret config is loaded through systemd's credential loading facility
|
||||
overrideArgs = {
|
||||
logfile = "";
|
||||
config = "$CREDENTIALS_DIRECTORY/secrets";
|
||||
};
|
||||
|
||||
# Creates the command line argument string for the service.
|
||||
prepareArgs = args:
|
||||
concatStringsSep " "
|
||||
(attrValues (mapAttrs (key: value: "-${key} \"${toString value}\"")
|
||||
(args // overrideArgs)));
|
||||
in
|
||||
{
|
||||
options.services.depot.smtprelay = {
|
||||
enable = mkEnableOption description;
|
||||
|
||||
args = mkOption {
|
||||
type = types.attrsOf types.str;
|
||||
description = "Key value pairs for command line arguments";
|
||||
};
|
||||
|
||||
secretsFile = mkOption {
|
||||
type = types.str;
|
||||
default = config.age.secretsDir + "/smtprelay";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
systemd.services.smtprelay = {
|
||||
inherit description;
|
||||
script = "${pkgs.smtprelay}/bin/smtprelay ${prepareArgs cfg.args}";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
Restart = "always";
|
||||
StateDirectory = "smtprelay";
|
||||
DynamicUser = true;
|
||||
LoadCredential = "secrets:${cfg.secretsFile}";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,40 +0,0 @@
|
|||
# Run the Telegram<>IRC sync bot for the Volga Sprint channel.
|
||||
#
|
||||
# This module is written in a pretty ad-hoc style, as it is sort of a
|
||||
# throwaway thing (will be removed again after the event).
|
||||
{ depot, config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.depot.teleirc;
|
||||
description = "IRC<>Telegram sync for Volga Sprint channel";
|
||||
configFile = builtins.toFile "teleirc.env" ''
|
||||
# connect through tvlbot's ZNC bouncer
|
||||
IRC_SERVER="localhost"
|
||||
IRC_PORT=2627
|
||||
IRC_USE_SSL=false
|
||||
IRC_CHANNEL="#volgasprint"
|
||||
IRC_BLACKLIST="tvlbot"
|
||||
IRC_BOT_NAME="tvlbot"
|
||||
IRC_BOT_REALNAME="TVL bot for Volga Sprint"
|
||||
IRC_BOT_IDENT="tvlbot"
|
||||
IRC_SEND_STICKER_EMOJI=false # look into this
|
||||
TELEGRAM_CHAT_ID=-1002153072030
|
||||
'';
|
||||
in
|
||||
{
|
||||
options.services.depot.teleirc.enable = lib.mkEnableOption description;
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services.teleirc = {
|
||||
inherit description;
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
Restart = "always";
|
||||
EnvironmentFile = "/run/agenix/teleirc";
|
||||
ExecStart = "${depot.third_party.teleirc}/bin/teleirc -conf ${configFile}";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
options = {
|
||||
tvl.cache.enable = lib.mkEnableOption "the TVL binary cache";
|
||||
tvl.cache.builderball = lib.mkEnableOption "use experimental builderball cache";
|
||||
};
|
||||
|
||||
config = lib.mkIf config.tvl.cache.enable {
|
||||
nix.settings = {
|
||||
trusted-public-keys = [
|
||||
"cache.tvl.su:kjc6KOMupXc1vHVufJUoDUYeLzbwSr9abcAKdn/U1Jk="
|
||||
];
|
||||
|
||||
substituters = [
|
||||
(if config.tvl.cache.builderball
|
||||
then "https://cache.tvl.fyi"
|
||||
else "https://cache.tvl.su")
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,71 +0,0 @@
|
|||
# Configuration for the coordination server for net.tvl.fyi, a
|
||||
# tailscale network run using headscale.
|
||||
#
|
||||
# All TVL members can join this network, which provides several exit
|
||||
# nodes through which traffic can be routed.
|
||||
#
|
||||
# The coordination server is currently run on sanduny.tvl.su. It is
|
||||
# managed manually, ping somebody with access ... for access.
|
||||
#
|
||||
# Servers should join using approximately this command:
|
||||
# tailscale up --login-server https://net.tvl.fyi --accept-dns=false --advertise-exit-node
|
||||
#
|
||||
# Clients should join using approximately this command:
|
||||
# tailscale up --login-server https://net.tvl.fyi --accept-dns=false
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
acl = with builtins; toFile "headscale-acl.json" (toJSON {
|
||||
acls = [{
|
||||
action = "accept";
|
||||
src = [ "*" ];
|
||||
dst = [ "*:*" ];
|
||||
}];
|
||||
|
||||
groups."group:builders" = [ "tvl" "tvl-builders" ];
|
||||
tagOwners."tag:builders" = [ "group:builders" ];
|
||||
});
|
||||
in
|
||||
{
|
||||
# TODO(tazjin): run embedded DERP server
|
||||
services.headscale = {
|
||||
enable = true;
|
||||
port = 4725; # hscl
|
||||
|
||||
settings = {
|
||||
server_url = "https://net.tvl.fyi";
|
||||
dns.magic_dns = false;
|
||||
policy.path = acl;
|
||||
|
||||
# TLS is handled by nginx
|
||||
tls_cert_path = null;
|
||||
tls_key_path = null;
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = [ pkgs.headscale ]; # admin CLI
|
||||
|
||||
services.nginx.virtualHosts."net.tvl.fyi" = {
|
||||
serverName = "net.tvl.fyi";
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
|
||||
# See https://github.com/juanfont/headscale/blob/v0.22.3/docs/reverse-proxy.md#nginx
|
||||
extraConfig = ''
|
||||
location / {
|
||||
proxy_pass http://localhost:${toString config.services.headscale.port};
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
proxy_set_header Host $server_name;
|
||||
proxy_redirect http:// https://;
|
||||
proxy_buffering off;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
|
||||
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
}
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
{ config, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./base.nix
|
||||
];
|
||||
|
||||
config = {
|
||||
services.nginx.virtualHosts."nixery.dev" = {
|
||||
serverName = "nixery.dev";
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
|
||||
extraConfig = ''
|
||||
location / {
|
||||
proxy_pass http://localhost:${toString config.services.depot.nixery.port};
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
# Redirect the hostname of a machine to its configuration in a web
|
||||
# browser.
|
||||
#
|
||||
# Works by convention, assuming that the machine has its configuration
|
||||
# at //ops/machines/${hostname}.
|
||||
{ config, ... }:
|
||||
|
||||
let
|
||||
host = "${config.networking.hostName}.${config.networking.domain}";
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./base.nix
|
||||
];
|
||||
|
||||
config.services.nginx.virtualHosts."${host}" = {
|
||||
serverName = host;
|
||||
addSSL = true; # SSL is not forced on these redirects
|
||||
enableACME = true;
|
||||
|
||||
extraConfig = ''
|
||||
location = / {
|
||||
return 302 https://at.tvl.fyi/?q=%2F%2Fops%2Fmachines%2F${config.networking.hostName};
|
||||
}
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
{ depot, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./base.nix
|
||||
];
|
||||
|
||||
config = {
|
||||
services.nginx.virtualHosts."volgasprint.org" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
root = "${depot.web.volgasprint}";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
{ depot, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./base.nix
|
||||
];
|
||||
|
||||
config = {
|
||||
services.nginx.virtualHosts."wigglydonke.rs" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
root = "${depot.path + "/users/aspen/wigglydonke.rs"}";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,78 +0,0 @@
|
|||
# Profile for virtual machines on Yandex Cloud, intended for disk
|
||||
# images.
|
||||
#
|
||||
# https://cloud.yandex.com/en/docs/compute/operations/image-create/custom-image
|
||||
#
|
||||
# TODO(tazjin): Upstream to nixpkgs once it works well.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
let
|
||||
cfg = config.virtualisation.yandexCloud;
|
||||
|
||||
# Kernel modules required for interacting with the hypervisor. These
|
||||
# must be available during stage 1 boot and during normal operation,
|
||||
# as disks and network do not work without them.
|
||||
modules = [
|
||||
"virtio-net"
|
||||
"virtio-blk"
|
||||
"virtio-pci"
|
||||
"virtiofs"
|
||||
];
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
"${modulesPath}/profiles/headless.nix"
|
||||
];
|
||||
|
||||
options = {
|
||||
virtualisation.yandexCloud.rootPartitionUuid = with lib; mkOption {
|
||||
type = types.str;
|
||||
default = "C55A5EE2-E5FA-485C-B3AE-CC928429AB6B";
|
||||
|
||||
description = ''
|
||||
UUID to use for the root partition of the disk image. Yandex
|
||||
Cloud requires that root partitions are mounted by UUID.
|
||||
|
||||
Most users do not need to set this to a non-default value.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/${lib.toLower cfg.rootPartitionUuid}";
|
||||
fsType = "ext4";
|
||||
autoResize = true;
|
||||
};
|
||||
|
||||
boot = {
|
||||
loader.grub.device = "/dev/vda";
|
||||
|
||||
initrd.kernelModules = modules;
|
||||
kernelModules = modules;
|
||||
kernelParams = [
|
||||
# Enable support for the serial console
|
||||
"console=ttyS0"
|
||||
];
|
||||
|
||||
growPartition = true;
|
||||
};
|
||||
|
||||
environment.etc.securetty = {
|
||||
text = "ttyS0";
|
||||
mode = "0644";
|
||||
};
|
||||
|
||||
systemd.services."serial-getty@ttyS0".enable = true;
|
||||
|
||||
services.openssh.enable = true;
|
||||
|
||||
system.build.yandexCloudImage = import (pkgs.path + "/nixos/lib/make-disk-image.nix") {
|
||||
inherit lib config pkgs;
|
||||
additionalSpace = "128M";
|
||||
format = "qcow2";
|
||||
partitionTableType = "legacy+gpt";
|
||||
rootGPUID = cfg.rootPartitionUuid;
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue