Commit graph

124 commits

Author SHA1 Message Date
eae84263f5 less verbose container definitions
move some options (the nopersist & container profiles + allowUnfree
packages) into the evalConfig used for containers, so we don't have to
repeat ourselves as much.

also removed some no-longer-needed specialArgs.

also made thelounge work with nopersist, which for some reason it didn't
use before.
2023-09-28 01:11:02 +02:00
f9d7496af7 various absurd fixes 2023-09-28 01:11:02 +02:00
6529cb79a0 update inputs 2023-09-28 01:11:02 +02:00
72ca5b2888 initial work for 23.05
in theory this might be ready to deploy. Potential hazards & things to
know when actually doing so:

 1. the mysql version used by mattermost was updated (the old uses an
    openssl which is marked insecure). Might have to migrate a database
 2. lots of settings now use RFC 42-style settings, which might contain
    new typos
 3. this updates uffd (& changes the patches we apply). Since version
    dependencies of uffd are basically "whatever debian has" we have
    never bothered to match them, but afaik have also never updated uffd
    since the initial deploy some years ago. No guarantee it still
    works.
 4. tracktrain depends on haskellPackages.conferer-warp, which is
    currently marked broken. There is no reason for this (it builds
    fine). Until fixed upstream, build with NIXPKGS_ALLOW_BROKEN=1.
    cf. https://github.com/NixOS/nixpkgs/pull/234784; waiting for a
    merge of haskell-updates into 23.05
2023-09-28 01:11:02 +02:00
d8e937a91d mattermost: 7.1.8 → 7.8.5 2023-05-19 23:06:15 +02:00
57b6eac7c2 tracktrain: upstream is slow in updating gtfs, use our own
note: I am author of both the file now under /persist/containers/tracktrain
& the upstream one at ilztalbahn.eu, but don't have direct access to the
wordpress instance running there, and no one who does has yet uploaded
the new file.
2023-05-17 17:49:56 +02:00
e5d57ebec9 sops/tracktrain: fix a missed non-declarative secret 2023-05-17 17:49:28 +02:00
6a51e74c73 enable receiving mail on mattermost@
otherwise we apparently cause feedback loops? pfft.
2023-05-05 16:28:37 +02:00
5bd2c5ab4c remove apparently unnecessary nextcloud config 2023-05-04 00:46:48 +02:00
3099798468 remove apparently unnessary mattermost lib.mkForce 2023-05-04 00:40:59 +02:00
003f2f7e44 move all on-disk secrets into sops
this only concerns secrets which are in a raw file. Some of our
services (e.g. nextclouds) keeps secrets in its database; these remain
untouched.

Not yet deployed because of shitty train internet.
2023-05-03 23:04:13 +02:00
49fa2325f3 sops-nix proof of concept
this is currently deployed and appears to be working. please everyone
have a look at it & then decide if we want to use this for the other
secrets as well.
2023-04-19 20:08:45 +02:00
b30df7ea6d unbreak tracktrain css 2023-03-16 15:03:13 +01:00
f91ea850bc
mail: reenable recieving mail on noreply@
because mail providers are sending out abuse mails for fbls they're
causing *shrung*
2023-03-15 19:06:36 +01:00
72c16d9e1c nicer container configs
today i woke up to the realisation that there's an extremely obvious way
to make these nicer, & then i did exactly that. For some reason I did
not think of this when originally removing the dependency to nix-hexchen's
evalConfig.

unfortunately, this is not /quite/ a no-op. The only actual change is
different whitespace in some of the semantically-equivalent
coredns-configs that got unified.
2023-02-18 14:45:14 +01:00
30510a3194 tracktrain: don't start before network.target
i hope this is the correct option; the last one apparently wasn't
enough.
2023-02-16 01:38:35 +01:00
2e74ca9b35 tracktrain: remove cors header
this is almost certainly not needed anymore. i think.
2023-01-30 21:00:54 +01:00
4c456eae1c tracktrain: don't open firewall twice
just to cause less confusion down the line
2023-01-30 15:00:13 +01:00
7a3e65a3f5 working tracktrain + monitoring 2023-01-22 20:03:11 +01:00
9af819b4b8 init tracktrain 2023-01-22 02:25:07 +01:00
87fd563ad3 remove netbox 2023-01-06 16:23:05 +01:00
1a54dbd191 alps: please don't start if there's no mailserver yet 2022-12-17 16:37:18 +01:00
015f66d749 netbox: fix uffd secret path
(turns out it's not a good idea to put it into a non-persistant directory)
2022-12-17 16:36:53 +01:00
9363c9e004 services/alps: use the nixos module
(since nixos 22.11 comes with one)
2022-12-17 15:56:06 +01:00
34a147afe6 python 3.9 -> python 3.10
(nixos 22.11 changed the default version, so some of our stuff broke)
2022-12-17 15:54:31 +01:00
bb24ce8b87 nixos-22.11: fix module warnings
(also wow nextcloud encryption is apparently broken. colour me surprised!)
2022-12-16 22:56:28 +01:00
c5a0f13884
remove lantifa: apparently dead 2022-12-13 23:52:48 +01:00
bcc27eba11
netbox: add Media_Root 2022-12-13 23:47:28 +01:00
c28e533257
services/netbox: fix access to static directory 2022-12-10 13:18:02 +01:00
f75429781d netbox uff(d) 2022-12-09 02:53:48 +01:00
5a28a55f01 netbox yolo 2022-12-08 23:30:02 +01:00
3df1ec0436 services/nextcloud: update to 25
(this has already been deployed for over a week, but apparently no one
thought to commit it)
2022-12-06 19:45:47 +01:00
7b145988d2 fix alps mail interface 2022-11-14 18:14:13 +01:00
c09337c973 shoehorn nix-hexchen-style config into flakes
this replaces niv with nix flakes, attempting to preserve the old
structure as much as possible. Notable caveats:
 - I'm not sure if flake inputs expose version information anywhere, so
   the version in pkgs/mattermost/default.nix is now hardcoded.
   Confusingly, this appears to trigger a rebuild. Maybe I've missed something.
 - a lot of the old-style host.nix & deploy.nix machinery in nix-hexchen
   does not work with flakes, and their newer replacements are not exposed
   by upstream; I've put basic imitations of the relevant parts in this repo
 - (in particular, directories in hosts/ won't become deployable configs
   automatically)
 - parts of the code are now probably more complicated than they'd have to be
 - old variables names were preserved; confusingly, this means the flake
   inputs are still called "sources"
2022-11-13 22:45:50 +01:00
d6d45685c7
fix StateVersion for gitea 2022-11-13 20:18:26 +01:00
b1974aa2d0 solve some TODOs
(one of these has even been around for a while!)
2022-11-11 16:30:38 +01:00
f281c90da5 containers: set stateVersion to 21.05
(which is what parsons is on as well)
2022-11-11 16:30:38 +01:00
4bd1430f0a remove services/syncthing.nix
(apparently not used anymore)
2022-11-11 16:30:38 +01:00
63cf62849b add stateVersion to all the containers
(set to 21.11 since that was what we had before)
2022-11-11 16:30:38 +01:00
55f17ad7c3 get rid of the nextcloud module fork 2022-11-11 16:30:38 +01:00
1291d3c9f6 move nextcloud.nix to a sane location 2022-11-11 16:30:38 +01:00
cde949ac5b remove workadventure 2022-11-11 16:30:38 +01:00
052e1ac126 environmentFiles are generally a good and reasonable idea 2022-11-11 16:28:50 +01:00
0686807690 fix the uncommited nextcloud state
(yay i successfully guessed what hexchen did, and turns out it had
nothing to do with the bind mount)
2022-11-10 20:15:00 +01:00
e8d36fc259
services/mumur: add creature comforts
murmur is now reloaded automagically after a cert update
also added mumble.infra4future.de as shared cert
2022-11-03 21:22:31 +01:00
2e92960390
services/mail: update vorstand and admin 2022-11-02 21:21:15 +01:00
0fe3094853
services/mail: renable postfix logs 2022-10-16 14:37:07 +02:00
f64b1f9534
mattermost: don't read config from database
apparently the nixpkgs mattermost module simply ignores its own config
if mutableConfig is false, and reads whatever config is currently in the
database (in our case, old stuff involving auth.infra4future.de).

This overwrites that.
2022-10-16 14:32:04 +02:00
52f9f2d64c
get rid of mattermost-patched module
this does a couple things:
 - redo mattermost's secret config as an env file passed to systemd
 - get rid of modules/mattermost.nix and use upstream module instead
 - move some of the stuff in secret.json which don't need to be there
   into nix (e.g. smtp port)

Also, I set the log level to ERROR in the env file. Mattermost doesn't
seem to respect it otherwise *shrug*
2022-10-15 20:10:29 +02:00
55ffc7282e
services/lantifa: pin WikiDB version
resolves the issue with the nixfiles being unable to be built, because
of a hash mismatch. The previous URL always pointed to the newest
version instead of a static one.
Sadly static links only exist for previous, but not the current version.
2022-10-09 10:06:30 +02:00