Commit graph

627 commits

Author SHA1 Message Date
281745d7a6 simplify nat on parsons 2024-04-07 16:25:08 +02:00
1ad0a7751c use networking.firewall instead of nftables.ruleset 2024-04-07 15:57:51 +02:00
5e51d5f252 docs: do not rebuild on each change
this does slight tweaking of paths to make the docs.hacc.space
derivation no longer depend on our entire flake, so we won't have to
rebuild it as often.
2024-04-06 23:16:43 +02:00
069236027c meta: add build info to motd / system label, remove /etc/haccfiles 2024-04-06 23:15:37 +02:00
283aba0c2c update inputs 2024-03-31 00:20:51 +01:00
faa83b6007 mattermost 9.5.2 → 9.5.3 2024-03-30 23:38:41 +01:00
e81472cb87 monit: restart onlyoffice if failed
this should hopefully help with our consistent onlyoffice-does-not-work-but-no-one-noticed
problems (yes, monit runs as root and can do that).

"then restart" will still send an alert if it restarted the unit (see monit's man page)
2024-03-26 17:06:36 +01:00
1cee814e04 update inputs 2024-03-23 22:42:41 +01:00
8da02ed645 update inputs
later than usual this week
2024-03-15 16:00:58 +01:00
8283162109 mattermost: remove flake inputs, copy nixpkgs package
this copies the current mattermost package definition from upstream
nixpkgs into our repo as-is (that definition itself being a modified
version of our definition that I upstreamed recently).

Since apparently no one else is maintaining the nixpkgs package and I am
apparently maintaining a mattermost package mostly on my own anyways,
this should make upstreaming future changes easier.
2024-03-11 00:13:18 +01:00
8f7f5448a3 mattermost: 9.5.1 → 9.5.2 2024-03-08 18:14:37 +01:00
319e5894e0 alps: hopefully fix the startup issue
alps frequently fails to start (e.g. during a system activation script)
since either its configured imap or smtp servers are not reachable
yet (i.e. their process has not yet opened the corresponding port).

This should hopefully fix that behaviour:
 - also set BindsTo, telling systemd to only start alps once the
   required units have entered "active" state (not just after it has
   started them)
 - also require postfix to be present, since that provides smtp
2024-03-05 17:03:09 +01:00
55b0b3558d update inputs 2024-03-05 16:45:24 +01:00
3fb25aa016 update inputs 2024-03-05 16:45:08 +01:00
7b9e423999 forgejo: final name changes gitea → forgejo
mostly just replacing strings to avoid confusion later on. Since our
containers are now ephemeral, renaming them is basically a non-issue
(though the files under /persist/containers & the uffd client name had
to be changed manually)
2024-02-25 23:24:07 +01:00
f29830ec93 format nftables.nix 2024-02-25 17:53:54 +01:00
e12cc7dbf5 mattermost: 8.1.10 → 9.5.1
This jumps Mattermost ESR Versions (see [1] for their release cycle). The
new version makes use of Go's workspace feature, which unfortunately the
buildGoModule function does not (yet?) support [2], and unfortunately this
breaks the previous build process for mattermost.

Further, the new release also makes use of private modules only included
in the (non-free) enterprise version of mattermost which makes it impossible
to build in the usual way even outside of nixpkgs's build abstractions [3].

Both issues can be solved by using Go 1.22, which has added support for
vendoring when using workspaces, and instructing it to ignore errors with
the -e flag. This requires overriding the go-modules derivation's buildPhase.

Finally, this now also build the commands/mmctl subpackage, which contains
a cli utility to administrate mattermost. This currently has its own nixpkgs
package for no reason i can see at all (it also has a version mismatch
between nixpkgs's mattermost and nixpkgs's mmctl).

[1] https://docs.mattermost.com/upgrade/extended-support-release.html
[2] https://github.com/NixOS/nixpkgs/issues/203039
[3] https://github.com/mattermost/mattermost/issues/26221
2024-02-25 17:22:39 +01:00
cbc7827cb9 make all nixos containers ephemeral 2024-02-22 21:15:41 +01:00
1042c90d8a update inputs 2024-02-20 16:33:43 +01:00
ea230c34b0 remove nix-hexchen from flake inputs
fun fact: this commit delets more lines (in flake.lock) than were
removed during the previous commits (to vendor nix-hexchen's modules
into our repo)
2024-02-18 13:47:54 +01:00
62917423e3 render nftables's ruleset
This does the same as the last commit did for the nftnat module, but for
the more general nftables module. Note the weird whatspace again.
2024-02-18 13:39:54 +01:00
0f678c5e80 render nftnat's extraConfig
this removes usage of the nftnat module by rendering it into a static
nftables config. It's a no-op (modulo /etc/haccfiles) as far as nix is
concerned, hence the slightly off-putting whitespace of the multi-line
string.

This seems to me to be a better approach than just bundling the module,
since we only use it for two things (giving the containers network
access & forwarding port 22 to forgejo), which to me doesn't press for
using a custom module we can't really maintain on our own.
2024-02-17 00:04:51 +00:00
0140b7a9fb bundle encboot
this does nothing but move the module & rename the hexchen.* options to hacc.*
2024-02-17 00:04:51 +00:00
39531f1c48 bundle hexchen's nopersist & bindmount moduls
the bind mount module has been tweaked in a couple ways:
 - rename hexchen.* to hacc.*
 - rename bindmount to bindMount to make it consistent with usage in
   the nixpkgs container module
 - add a hacc.bindToPersist option as shorthand for prepending /perist
   to a path via bind mount

the nopersist module has been shortened a little by moving
service-specific things which are used once out into the individual
service files, and removing those which we don't need at all (this also
means we get to loose a mkForce or two in case of mismatches between
hexchen's and our current config).
2024-02-17 00:04:51 +00:00
461cb01126 uncurse mattermost
thanks to emily for the secret nixpkgs knowledge!
2024-02-16 23:19:56 +01:00
2988939be0 mattermost 8.1.9 → 8.1.10 (cursed)
see the comment in pkgs/mattermost.nix
2024-02-16 19:44:22 +01:00
7427df5167 mattermost: firewall.allowedTCPPorts redundant
our containers profile already sets networking.firewall = false, so this
does exactly nothing except cause confusion.
2024-02-12 21:07:53 +01:00
1ccc0ccbca update inputs, mattermost 8.1.8 → 8.1.9 2024-02-07 22:53:34 +01:00
5dd817796f parsons/gitea.nix → parsons/forgejo.nix
forgot this last time ...
2024-02-01 00:10:00 +01:00
a36d2a7617 update inputs 2024-01-30 14:46:02 +01:00
c28a1f6e2e monit: check for onlyoffice status 2024-01-28 22:56:33 +01:00
c681bb413c gitea → forgejo 2024-01-28 16:07:18 +01:00
062e123046 common/users: add floppy & leah2 2024-01-28 15:57:07 +01:00
93cc8b8172 backups: psql dumps for mattermost & nextcloud 2024-01-28 15:48:13 +01:00
816e175b33 restic: move secrets into sops 2024-01-28 15:32:18 +01:00
a3c6479dbe update inputs 2024-01-23 20:05:36 +01:00
abfc5618e9 mattermost 8.1.7 → 8.1.8 2024-01-19 00:58:12 +01:00
c0f37da12f update inputs 2024-01-16 02:38:20 +01:00
12e4cba3e6 websites: better watch scripts
nix run .#\"<domain>\" will now actually listen for changes in the
source repository, and not first copy the entire thing into the nix
store.
2024-01-12 00:41:15 +01:00
68dc640257 fix docs.hacc.space
this is a slightly cursed work around; see the comment.

Alternatively, we could pass in the $src attribute of that derivation
via callPackage (passing it through all the way from flake.nix), but tbh
that sounds like too much effort rn.

Have fun with confusingly long paths in the nix store 🙃
2024-01-12 00:31:32 +01:00
41d82ae436 meta: new structure
we decided to:
 - get rid of unused packages
 - simpify the directory layout since we only have one host anyways
 - move our docs (such as they are) in-tree
2024-01-11 23:49:26 +01:00
c2022d9c60 add a .rgignore
to make Moira less annoyed when using ripgrep
2024-01-11 21:30:22 +01:00
990d48a1c7 update inputs; simple-nixos-mailserver now has a 23.11 branch 2024-01-08 22:25:55 +01:00
d011fcb56d update inputs
back to normal weekly updates now
2024-01-02 17:21:44 +01:00
b38e6a0ebc move the auamost.fish script into haccfiles
This is our script to synchronise groups between uffd and mattermost,
since there seems to be no better way to do that. It has long lived
under /persist/magic/auamost since it contained sensitive data (both
which groups are on our platform & access tokens to both uffd's and
mattermost's API with admin-level permissions).

This splits the script up into a non-sensitive part which lives in Nix,
and a small snippet that just sets all the sensitive stuff into env vars
in sops, so we can manage the entire thing with our usual setup.
2023-12-30 19:03:25 +01:00
a72f35de35 update inputs (smtp smuggling)
also hexchen's nixfiles now set the mysql data dir, so we now have
one more mkForce.
2023-12-27 16:56:52 +01:00
4e17d6034c update inputs 2023-12-23 03:56:55 +01:00
2008876dc6 !fixup: add a " also whitespace 2023-12-16 20:41:26 +01:00
910caf3485 servies/murmur: update some text 2023-12-16 18:49:29 +01:00
226508d4b0 tracktrain: use psql15 2023-12-12 00:10:35 +01:00