diff --git a/.sops.yaml b/.sops.yaml index bc5cfc6..6f01614 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -4,7 +4,6 @@ keys: - &nyarlathotep age1s99d0vlj5qlm287n98jratql5fypvjrxxal0k5jl2aw9dcc8kyvqw5yyt4 - &bragi age1lqvgpmlemyg9095ujck64u59ma29656zs7a4yxgz4s6u5cld2ccss69jwe - - &lobon age12nz7dtc0m5wasxm4r9crtkgwnzvauyfp0xh0n8z8jld0arn9ea9qe0agvn creation_rules: - path_regex: nixos/machines/nyarlathotep/.* @@ -19,12 +18,6 @@ creation_rules: - *nerf - *gonne - *bragi - - path_regex: nixos/machines/lobon/.* - key_groups: - - age: - - *nerf - - *gonne - - *lobon # this is the catchall clause if nothing above machtes. Encrypt to users but not # to machines - key_groups: diff --git a/flake-module.nix b/flake-module.nix index c30fff4..82bf10f 100644 --- a/flake-module.nix +++ b/flake-module.nix @@ -15,7 +15,6 @@ perSystem = { config, pkgs, - system, ... }: { devShells.default = config.pre-commit.devShell; @@ -27,15 +26,14 @@ in { check.enable = true; settings = { + # for some reason statix takes it config differently than all the other hooks. + settings.statix = { + format = "stderr"; + ignore = generatedFiles; + }; hooks = { nil.enable = true; - statix = { - enable = true; - settings = { - format = "stderr"; - ignore = generatedFiles; - }; - }; + statix.enable = true; deadnix = { enable = true; excludes = generatedFiles; @@ -50,10 +48,6 @@ # Per-system attributes can be defined here. The self' and inputs' # module parameters provide easy access to attributes of the same # system. - _module.args.pkgs = import inputs.nixpkgs { - inherit system; - config.permittedInsecurePackages = ["jitsi-meet-1.0.8043"]; - }; }; # Equivalent to inputs'.nixpkgs.legacyPackages.hello; diff --git a/flake.lock b/flake.lock index dc1839f..4c3308e 100644 --- a/flake.lock +++ b/flake.lock @@ -21,11 +21,11 @@ "nixpkgs-lib": "nixpkgs-lib" }, "locked": { - "lastModified": 1727826117, - "narHash": "sha256-K5ZLCyfO/Zj9mPFldf3iwS6oZStJcU4tSpiXTMYaaL0=", + "lastModified": 1709336216, + "narHash": "sha256-Dt/wOWeW6Sqm11Yh+2+t0dfEWxoMxGBvv3JpIocFl9E=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "3d04084d54bedc3d6b8b736c70ef449225c361b1", + "rev": "f7b3c975cf067e56e7cda6cb098ebe3fb4d74ca2", "type": "github" }, "original": { @@ -33,13 +33,31 @@ "type": "indirect" } }, + "flake-utils": { + "inputs": { + "systems": "systems_2" + }, + "locked": { + "lastModified": 1710146030, + "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, "impermanence": { "locked": { - "lastModified": 1727649413, - "narHash": "sha256-FA53of86DjFdeQzRDVtvgWF9o52rWK70VHGx0Y8fElQ=", + "lastModified": 1708968331, + "narHash": "sha256-VUXLaPusCBvwM3zhGbRIJVeYluh2uWuqtj4WirQ1L9Y=", "owner": "nix-community", "repo": "impermanence", - "rev": "d0b38e550039a72aff896ee65b0918e975e6d48e", + "rev": "a33ef102a02ce77d3e39c25197664b7a636f9c30", "type": "github" }, "original": { @@ -53,14 +71,14 @@ "blobs": "blobs", "flake-compat": [], "nixpkgs": [], - "nixpkgs-24_05": "nixpkgs-24_05" + "utils": "utils" }, "locked": { - "lastModified": 1722877200, - "narHash": "sha256-qgKDNJXs+od+1UbRy62uk7dYal3h98I4WojfIqMoGcg=", + "lastModified": 1710449465, + "narHash": "sha256-2orO8nfplp6uQJBFqKkj1iyNMC6TysmwbWwbb4osTag=", "ref": "refs/heads/master", - "rev": "af7d3bf5daeba3fc28089b015c0dd43f06b176f2", - "revCount": 593, + "rev": "79c8cfcd5873a85559da6201b116fb38b490d030", + "revCount": 582, "type": "git", "url": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git" }, @@ -71,11 +89,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1728492678, - "narHash": "sha256-9UTxR8eukdg+XZeHgxW5hQA9fIKHsKCdOIUycTryeVw=", + "lastModified": 1711703276, + "narHash": "sha256-iMUFArF0WCatKK6RzfUJknjem0H9m4KgorO/p3Dopkk=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "5633bcff0c6162b9e4b5f1264264611e950c8ec7", + "rev": "d8fe5e6c92d0d190646fb9f1056741a229980089", "type": "github" }, "original": { @@ -85,45 +103,36 @@ "type": "github" } }, - "nixpkgs-24_05": { + "nixpkgs-lib": { "locked": { - "lastModified": 1717144377, - "narHash": "sha256-F/TKWETwB5RaR8owkPPi+SPJh83AQsm6KrQAlJ8v/uA=", + "dir": "lib", + "lastModified": 1709237383, + "narHash": "sha256-cy6ArO4k5qTx+l5o+0mL9f5fa86tYUX3ozE1S+Txlds=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "805a384895c696f802a9bf5bf4720f37385df547", + "rev": "1536926ef5621b09bba54035ae2bb6d806d72ac8", "type": "github" }, "original": { - "id": "nixpkgs", - "ref": "nixos-24.05", - "type": "indirect" - } - }, - "nixpkgs-lib": { - "locked": { - "lastModified": 1727825735, - "narHash": "sha256-0xHYkMkeLVQAMa7gvkddbPqpxph+hDzdu1XdGPJR+Os=", - "type": "tarball", - "url": "https://github.com/NixOS/nixpkgs/archive/fb192fec7cc7a4c26d51779e9bab07ce6fa5597a.tar.gz" - }, - "original": { - "type": "tarball", - "url": "https://github.com/NixOS/nixpkgs/archive/fb192fec7cc7a4c26d51779e9bab07ce6fa5597a.tar.gz" + "dir": "lib", + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" } }, "nixpkgs-stable": { "locked": { - "lastModified": 1728156290, - "narHash": "sha256-uogSvuAp+1BYtdu6UWuObjHqSbBohpyARXDWqgI12Ss=", + "lastModified": 1711233294, + "narHash": "sha256-eEu5y4J145BYDw9o/YEmeJyqh8blgnZwuz9k234zuWc=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "17ae88b569bb15590549ff478bab6494dde4a907", + "rev": "ac6bdf6181666ebb4f90dd20f31e2fa66ede6b68", "type": "github" }, "original": { "owner": "NixOS", - "ref": "release-24.05", + "ref": "release-23.11", "repo": "nixpkgs", "type": "github" } @@ -131,16 +140,17 @@ "pre-commit-hooks": { "inputs": { "flake-compat": [], + "flake-utils": "flake-utils", "gitignore": [], "nixpkgs": [], "nixpkgs-stable": [] }, "locked": { - "lastModified": 1728727368, - "narHash": "sha256-7FMyNISP7K6XDSIt1NJxkXZnEdV3HZUXvFoBaJ/qdOg=", + "lastModified": 1711760932, + "narHash": "sha256-DqUTQ2iAAqSDwMhKBqvi24v0Oc7pD3LCK/0FCG//TdA=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "eb74e0be24a11a1531b5b8659535580554d30b28", + "rev": "c11e43aed6f17336c25cd120eac886b96c455731", "type": "github" }, "original": { @@ -167,11 +177,11 @@ "nixpkgs-stable": "nixpkgs-stable" }, "locked": { - "lastModified": 1728345710, - "narHash": "sha256-lpunY1+bf90ts+sA2/FgxVNIegPDKCpEoWwOPu4ITTQ=", + "lastModified": 1711249319, + "narHash": "sha256-N+Pp3/8H+rd7cO71VNV/ovV/Kwt+XNeUHNhsmyTabdM=", "owner": "Mic92", "repo": "sops-nix", - "rev": "06535d0e3d0201e6a8080dd32dbfde339b94f01b", + "rev": "405987a66cce9a4a82f321f11b205982a7127c88", "type": "github" }, "original": { @@ -179,6 +189,54 @@ "repo": "sops-nix", "type": "github" } + }, + "systems": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, + "systems_2": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, + "utils": { + "inputs": { + "systems": "systems" + }, + "locked": { + "lastModified": 1709126324, + "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "d465f4819400de7c8d874d50b982301f28a84605", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } } }, "root": "root", diff --git a/nixos/machines/bragi/configuration.nix b/nixos/machines/bragi/configuration.nix index dd2ecdc..f74fbb9 100644 --- a/nixos/machines/bragi/configuration.nix +++ b/nixos/machines/bragi/configuration.nix @@ -1,4 +1,4 @@ -{config, ...}: { +{ imports = [ ./hardware-configuration.nix ../../roles @@ -12,11 +12,4 @@ # System configuration here networking.hostName = "bragi"; system.stateVersion = "23.11"; - - sops.secrets.backupKey = { - sopsFile = ./backupKey.yaml; - owner = config.users.users.fsaccount.name; - inherit (config.users.users.fsaccount) group; - mode = "0400"; - }; } diff --git a/nixos/machines/bragi/network.nix b/nixos/machines/bragi/network.nix index af70cb7..b113b50 100644 --- a/nixos/machines/bragi/network.nix +++ b/nixos/machines/bragi/network.nix @@ -10,7 +10,6 @@ } ]; defaultGateway = "192.168.1.137"; - # https://www.hrz.tu-darmstadt.de/services/it_services/nameserver_dns/index.de.jsp - nameservers = ["130.83.22.63" "130.83.22.60" "130.83.56.60"]; + nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"]; }; } diff --git a/nixos/machines/ghatanothoa/configuration.nix b/nixos/machines/ghatanothoa/configuration.nix index 8364bea..207e37f 100644 --- a/nixos/machines/ghatanothoa/configuration.nix +++ b/nixos/machines/ghatanothoa/configuration.nix @@ -4,7 +4,7 @@ ../../modules/jitsi.nix ../../roles ../../roles/vm.nix - ../../modules/vmNetwork.nix + ./network.nix ]; services.mathebau-jitsi = { @@ -14,6 +14,5 @@ # System configuration here networking.hostName = "ghatanothoa"; - vmNetwork.ipv4 = "192.168.0.25"; system.stateVersion = "23.11"; } diff --git a/nixos/machines/ghatanothoa/network.nix b/nixos/machines/ghatanothoa/network.nix new file mode 100644 index 0000000..2a1f4ae --- /dev/null +++ b/nixos/machines/ghatanothoa/network.nix @@ -0,0 +1,16 @@ +# We sohuld put that config somewhere in roles and give it a parameter or something, +# everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways +# depend on the same thing +{ + imports = []; + networking = { + interfaces.enX0.ipv4.addresses = [ + { + address = "192.168.0.25"; + prefixLength = 16; + } + ]; + defaultGateway = "192.168.0.152"; + nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"]; + }; +} diff --git a/nixos/machines/lobon/allowlistPass.yaml b/nixos/machines/lobon/allowlistPass.yaml deleted file mode 100644 index c8d4d98..0000000 --- a/nixos/machines/lobon/allowlistPass.yaml +++ /dev/null @@ -1,39 +0,0 @@ -allowlistPass: ENC[AES256_GCM,data:bb9jXSvWeDnZqqiY/IarwA==,iv:qeFAYvXYdh2uEleg8kpCd77u4PTbwM8ydEkbMhyPz1I=,tag:1/eysyZb2mJ0mYHXIrpihw==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1rasjnr2tlv9y70sj0z0hwpgpxdc974wzg5umtx2pnc6z0p05u3js6r8sln - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAySVhjV0xXdGE2am85RVJh - NXJLRy92blkzeENuWHh3QSsxNHBXcUpibGxnCnVHUEVoYVgxbk5WSmxQRXNzMC9i - Y1g4MUFrNEVjVjJWM0xhU0JzTzNZTk0KLS0tIFIrdmhrbXFHb2VaQ1p2dDJMMmlR - Um5CcGlZanBBRzJKOVNZeWVPTmsrcVUK905uViHD7uZMVQHPfFraIHXYTHaT+ERl - ZvyRDdjjRCyxu0qcIpYVpPAmfGCo0++bXSRUX8rCp48YN20MbPNjgA== - -----END AGE ENCRYPTED FILE----- - - recipient: age1xv5rfxkxg9jyqx5jg2j82cxv7w7ep4a3795p4yl5fuqf38f3m3eqfnefju - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLNkNpN2RlcHBuOUxoYmkx - QzdOM1E0cFBSc1I0NzVRbmhiUXhjM3dQOWhnCmlOQzJ3b2Q5NFJkb2haMDNGSFBv - SkdySWtRUzhic1FNeXhiUFBPRVNoWmcKLS0tIGNaVW5xUmxWOEtXVkRqVEJJSEVv - NFBWREFQbnFXclhiNW51M0ZsOEMxdnMKdOPVRbD42q7MRw1CX1M30Xdil7VFLDVD - G8j4sjxlDkcwQK/3WjZdBLXAzJcrvAp0okGzw8lymC812CXTSEfmxw== - -----END AGE ENCRYPTED FILE----- - - recipient: age12nz7dtc0m5wasxm4r9crtkgwnzvauyfp0xh0n8z8jld0arn9ea9qe0agvn - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKVVN2THloaU1pVnhtWDhm - TWpPaHNLSXlud0RLU3ovS0s4REtUTzQwMHhZClF5OFZQVHB2VG9BeThSYzVSMUFJ - VDNkT0Y1Y3RUemkwSmxlM0drUlNDR1UKLS0tIDYrcVhXMWJxR2dhcXhjdTQ3MjV1 - Y3lWbHdLOGRGamhRY0xoRnVJczc2aFUKWWAflRwoszNw5bEDTSaVI65FtQve/HrC - uY1JvYwXLq4m4hu76dyrplDpzb8ant/YAUXpG6F4U7nn9GiLBaoyUQ== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-03-31T14:34:54Z" - mac: ENC[AES256_GCM,data:sjWiO96NcFUT4L9mdBuQwt6Zl5cS16o73zes30SYJxzM1R3ZBIg9oOmhXxY9BC3yKjEb6bVuemj/bnnopSR/m3RPH7xfaYCBfz97Zgc4SGtoqLIra5OUCRpWnKSsD6Nf09Qss5Pbla9EIrI0kQt7fpf4iKLF7VJwrQryslnvfcM=,iv:ilnbLK6sttweEyqszVHxVnjbTq8jF5ZTO24OEIPMprE=,tag:3XgAlXMl/RIaUfkVwHJeBQ==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.8.1 diff --git a/nixos/machines/lobon/backupKey.yaml b/nixos/machines/lobon/backupKey.yaml deleted file mode 100644 index 3095894..0000000 --- a/nixos/machines/lobon/backupKey.yaml +++ /dev/null @@ -1,39 +0,0 @@ -backupKey: ENC[AES256_GCM,data:/PErHUVZDTyqK+GKI2inDoEBQpSmezeBTgXWnrthc8IPtUFn4Ur2CkDo+MqfiAlSn9vT2ksHmyS5qmoGANG01e1Cm50qpt/BdoC2hh15jOVuc0uUBNOq7f5YBVeYtbemwjPcmbF7dgUeRlEAvxhqtX3/ntzxSB1inew/SsEgPrU4Yl0FF+CHhqgbeB/NJOhQY29/3hBGwMksfTUDymUmX6pUgIN1M26crIKFCn5IyqAXl10F+zL4PThZPnhmks7Y8BsGUbKkiE6ghdaUjEjBjGOGgbaGAjolG+nJ17xyM1Pc2speT4E/3VgAC34dpaByveGcf2SfsXir0KavcI86mUkjzaNF9u7GjGO0Szn742/aqbdUoOkJl41unb0Enf2/D4Up3fy6LrUqVqrHIM4Dea9WLQd0poD0FWSN12IKh+ylkouMkmhwLXUXFzIHOePS92/MsPM+9fLhH4cU64qxr9UzmfYRnNBpAHrjlxdkK9WZ1Oj4mdtu6R20vYkYcMIQgU38FvSN6uWGvPxJj+Ij,iv:ghvgkC6qFO/0tvsc7igCoZy7am8eNsd21WYCSAKiZDs=,tag:MFnk/Nnw+cloN+x7sd4LLg==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1rasjnr2tlv9y70sj0z0hwpgpxdc974wzg5umtx2pnc6z0p05u3js6r8sln - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaNVExTHQrY2h1M3RZOEdU - Wm5kdDBHZ1NmZGpQU0VOYWtjOTdBVURQZkJnCmZzWTEvSWxvMFk4NlFOVnBDbm9q - Tncva0VyMGVDL29ZZ0YxeGE3RFBUS3cKLS0tIDluK05NMUNNM3pEUmlCNE9BV3lT - L0dPYTBwbjJzUmJnYktiM2JBME5LM3cKvPwth4DxQgFYhvr9vJLfeaiNc+UfAo4c - RdXPLkwtq3vksrU1IR54tHcUJ0yZiZ1HxxGp3PCPaXXJiUykllnJPw== - -----END AGE ENCRYPTED FILE----- - - recipient: age1epz92k2rkp43hkrg3u0jgkzhnkwx8y43kag7rvfzwl9wcddelvusyetxl7 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRdFV0OVA5VTBuOVhsL3lp - MFpDN2RHVDExck5vcWpDNDNPM2k3S1FqQUFFCjNreXdSbDFXOHJ4b21mNGlZb0xQ - YUh0WVNGN2o1aFVaaGpxbmk4aUQ4ZTAKLS0tIHhtci84Zk1zZlBOOHk4a3VKUlM1 - MXNZbWdpVEJiTTlIRERLYzBlNWxBMlUK4Z8JLlN5FOegfdg5njhHjbCwAm/f+kJS - buOHGWzWirW0ZibOP+fikzJwdIzIsX8v8tGaV89nQwf0hrxK0748Hg== - -----END AGE ENCRYPTED FILE----- - - recipient: age12nz7dtc0m5wasxm4r9crtkgwnzvauyfp0xh0n8z8jld0arn9ea9qe0agvn - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZa2pUZlZsVmhPU242d0Nj - bi9BSlJBU1Q1cFU4ZjA4NnlJNmdwaVFBc2xNCjJlSG5UaDFnSzFHZ01RVVNjOHY5 - L1JVUit6SThvbGRIU0loNmtZanllNXcKLS0tIFhMR1pxRmlGQWFEQURiRFJoMWJZ - dlExV2xTVWR6bWI3VCtSdU81SmtqYncKLFQczlIj89vzlfgE33w6ktotYFdxaWr9 - YyewbY8qZmOUGQ4xKlZmhojeMh/FEH8dGNEf1AxnKbuQdnW6lqGR/w== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-03-31T16:01:00Z" - mac: ENC[AES256_GCM,data:AawTzIXyX+3FyFpw8pXFeVJJtXN7ZpTFnUqhedC2vcbbNUzMMt1X0SaxtNNJ5chZI/tYHn59FT6zznl1eO4Xn29Zc2Up4dkT1BE4yqkEG0hiCFXrXMz/PaHfROzBhIWCVyF4fYj6MZKg1iBBxhWRqhJlQ1q4UVkoaITRUKpFJgs=,iv:3lTPOQ8VjmP3WNGbFK2yLU4Ks1KviNS/l7TH4SnvSUs=,tag:KUbAU6+76/Uxj2Wn9EnqnA==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.8.1 diff --git a/nixos/machines/lobon/configuration.nix b/nixos/machines/lobon/configuration.nix deleted file mode 100644 index 506d637..0000000 --- a/nixos/machines/lobon/configuration.nix +++ /dev/null @@ -1,36 +0,0 @@ -{ - imports = [ - ./hardware-configuration.nix - ../../modules/mailman.nix - ../../roles - ../../roles/vm.nix - ../../modules/vmNetwork.nix - ]; - - # System configuration here - - services.mathebau-mailman = { - enable = true; - hostName = "lists.mathebau.de"; - siteOwner = "root@mathebau.de"; - }; - - networking.hostName = "lobon"; - vmNetwork.ipv4 = "192.168.0.22"; - system.stateVersion = "23.11"; - - sops.secrets = { - allowlistPass = { - sopsFile = ./allowlistPass.yaml; - owner = "mailman"; - group = "mailman"; - mode = "0400"; - }; - backupKey = { - sopsFile = ./backupKey.yaml; - owner = "root"; - group = "root"; - mode = "0400"; - }; - }; -} diff --git a/nixos/machines/lobon/hardware-configuration.nix b/nixos/machines/lobon/hardware-configuration.nix deleted file mode 100644 index ce7112d..0000000 --- a/nixos/machines/lobon/hardware-configuration.nix +++ /dev/null @@ -1,30 +0,0 @@ -{ - lib, - pkgs, - ... -}: { - imports = []; - - fileSystems."/" = { - device = "root"; - fsType = "tmpfs"; - options = ["size=1G" "mode=755"]; - }; - fileSystems."/persist" = { - device = "/dev/disk/by-label/nixos"; - fsType = "btrfs"; - options = ["subvol=persist"]; - neededForBoot = true; - }; - fileSystems."/boot" = { - device = "/dev/disk/by-label/boot"; - fsType = "ext4"; - }; - fileSystems."/nix" = { - device = "/dev/disk/by-label/nixos"; - fsType = "btrfs"; - options = ["subvol=nix"]; - }; - - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; -} diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix index 08724cc..b5cbe40 100644 --- a/nixos/modules/borgbackup.nix +++ b/nixos/modules/borgbackup.nix @@ -83,13 +83,6 @@ in { path = "/var/lib/backups/ithaqua"; allowSubRepos = true; }; - lobon = { - authorizedKeysAppendOnly = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICEptjf1UWRlo6DG9alAIRwkSDUAVHwDKkHC6/DeYKzi Lobon Backup" - ]; - path = "/var/lib/backups/lobon"; - allowSubRepos = true; - }; sanctamariamaterdei = { authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH9Le5OI4ympQ0mQKYHmxgxGF598rzpD5VVpWK1mGfd8 Sanctamariamaterdei Backupsystem" @@ -128,7 +121,7 @@ in { jobs.fsaccount = { preHook = '' mkdir -p /home/fsaccount/sicherung # Create if it does not exist - ${pkgs.rsync}/bin/rsync --rsh='ssh -i /run/secrets/backupKey' --recursive --delete fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* /home/fsaccount/sicherung + ${pkgs.rsync}/bin/rsync -e 'ssh -i /run/secrets/backupKey' -r fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* /home/fsaccount/sicherung ''; paths = "/home/fsaccount/sicherung"; encryption.mode = "none"; # Otherwise the key is next to the backup or we have human interaction. @@ -168,5 +161,11 @@ in { } ]; }; + sops.secrets.backupKey = { + sopsFile = ../machines/bragi/backupKey.yaml; + owner = config.users.users.fsaccount.name; + inherit (config.users.users.fsaccount) group; + mode = "0400"; + }; }; } diff --git a/nixos/modules/mailman.nix b/nixos/modules/mailman.nix deleted file mode 100644 index 5cfa63d..0000000 --- a/nixos/modules/mailman.nix +++ /dev/null @@ -1,128 +0,0 @@ -# Adapted and simplified from https://nixos.wiki/wiki/Mailman -{ - config, - lib, - pkgs, - ... -}: let - inherit - (lib) - mkIf - mkEnableOption - mkOption - ; - inherit (lib.types) nonEmptyStr; - cfg = config.services.mathebau-mailman; -in { - options.services.mathebau-mailman = { - enable = mkEnableOption "mathebau mailman service"; - hostName = mkOption { - type = nonEmptyStr; - }; - siteOwner = mkOption { - type = nonEmptyStr; - }; - }; - - config = mkIf cfg.enable { - services = { - postfix = { - enable = true; - relayDomains = ["hash:/var/lib/mailman/data/postfix_domains"]; - config = { - transport_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"]; - local_recipient_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"]; - proxy_interfaces = "130.83.2.184"; - smtputf8_enable = "no"; # HRZ does not know SMTPUTF8 - }; - relayHost = "192.168.0.24"; # Relay to eihort which relays to HRZ (see https://www.hrz.tu-darmstadt.de/services/it_services/email_infrastruktur/index.de.jsp) - }; - mailman = { - enable = true; - inherit (cfg) siteOwner; - hyperkitty.enable = true; - webHosts = [cfg.hostName]; - serve.enable = true; # - # Don't include confirmation tokens in reply addresses, because we would need to send them to HRZ otherwise. - settings.mta.verp_confirmations = "no"; - }; - }; - - environment.persistence.${config.impermanence.name} = { - directories = [ - "/var/lib/mailman" - "/var/lib/mailman-web" - ]; - files = ["/root/.ssh/known_hosts"]; # for the backup server bragi - }; - - networking.firewall.allowedTCPPorts = [25 80]; - - # Update HRZ allowlist - # For account details see https://www-cgi.hrz.tu-darmstadt.de/mail/ - # will stop working if no valid TUIDs are associated to our domain. - systemd.timers."mailAllowlist" = { - wantedBy = ["timers.target"]; - timerConfig = { - OnBootSec = "5m"; # Run every 5 minutes - OnUnitActiveSec = "5m"; - RandomizedDelaySec = "2m"; # prevent overload on regular intervals - Unit = "mailAllowlist.service"; - }; - }; - systemd.services."mailAllowlist" = { - description = "Allowlist update: Post the mail addresses used by mailman to the HRZ allowllist"; - script = '' - # Get the mail addresses' local-part - cut -d '@' -f 1 /var/lib/mailman/data/postfix_lmtp | grep -v '#' | grep "\S" > /tmp/addresses - # Post local-parts to HRZ - ${pkgs.curl}/bin/curl https://www-cgi.hrz.tu-darmstadt.de/mail/whitelist-update.php -F emaildomain=${cfg.hostName} -F password=$(cat /run/secrets/allowlistPass) -F emailliste=@/tmp/addresses -F meldungen=voll - # Cleanup - rm /tmp/addresses - ''; - serviceConfig = { - Type = "oneshot"; - User = "mailman"; - NoNewPrivileges = true; - # See https://www.man7.org/linux/man-pages/man5/systemd.exec.5.html - PrivateTmp = true; - ProtectHome = true; - ReadOnlyPaths = "/"; - ReadWritePaths = "/tmp"; - InaccessiblePaths = "-/lost+found"; - PrivateDevices = true; - PrivateUsers = true; - ProtectHostname = true; - ProtectClock = true; - ProtectKernelTunables = true; - ProtectKernelModules = true; - ProtectKernelLogs = true; - ProtectControlGroups = true; - LockPersonality = true; - MemoryDenyWriteExecute = true; - RestrictRealtime = true; - RestrictSUIDSGID = true; - }; - }; - - # Backups - services.borgbackup.jobs.mailman = { - paths = [ - "/var/lib/mailman/data" - "/var/lib/mailman-web" - ]; - encryption.mode = "none"; # Otherwise the key is next to the backup or we have human interaction. - environment = { - BORG_RSH = "ssh -i /run/secrets/backupKey"; - # “Borg ensures that backups are not created on random drives that ‘just happen’ to contain a Borg repository.” - # https://borgbackup.readthedocs.io/en/stable/deployment/automated-local.html - # We don't want this in order to not need to persist borg cache and simplify new deployments. - BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK = "yes"; - }; - repo = "borg@192.168.1.11:lobon"; # TODO for https://gitea.mathebau.de/Fachschaft/nixConfig/issues/33 - startAt = "daily"; - user = "root"; - group = "root"; - }; - }; -} diff --git a/nixos/modules/vmNetwork.nix b/nixos/modules/vmNetwork.nix deleted file mode 100644 index 133d101..0000000 --- a/nixos/modules/vmNetwork.nix +++ /dev/null @@ -1,48 +0,0 @@ -{ - lib, - config, - ... -}: let - inherit - (lib) - mkOption - types - last - init - ; - inherit - (lib.strings) - splitString - concatStringsSep - toInt - ; - cfg = config.vmNetwork; -in { - imports = []; - - options.vmNetwork = { - ipv4 = mkOption { - type = types.str; - description = "the ipv4 adress of this machine"; - }; - }; - - config = { - networking = { - interfaces.enX0.ipv4.addresses = [ - { - address = cfg.ipv4; - prefixLength = 16; - } - ]; - defaultGateway = let - addr = splitString "." cfg.ipv4; - addrInit = init addr; - addrLastInt = builtins.toString (toInt (last addr) + 127); - in - concatStringsSep "." (addrInit ++ [addrLastInt]); - # https://www.hrz.tu-darmstadt.de/services/it_services/nameserver_dns/index.de.jsp - nameservers = ["130.83.22.63" "130.83.22.60" "130.83.56.60"]; - }; - }; -} diff --git a/nixos/roles/admins.nix b/nixos/roles/admins.nix index 1bc6d4c..3215ccc 100644 --- a/nixos/roles/admins.nix +++ b/nixos/roles/admins.nix @@ -10,7 +10,7 @@ with lib; let gonne = { hashedPassword = "$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/"; keys = [ - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIAhwkSDISCWLN2GhHfxdZsVkK4J7JoEcPwtNbAesb+BZAAAABHNzaDo= Gonne" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFopCUadohY3wg9AoEup9TDRDMyEPSLsQoCnN4lsKCrr gonne@mathebau.de NixOS" ]; }; };