hainich/sympa: added type to mta.type

.gitignore

@@ -2,4 +2,3 @@ result
 ecdsa_host
 secrets/
 .*.swp
-.deploy-gc/*

.gitlab-ci.yml

@@ -0,0 +1,17 @@
+stages:
+  - instantiate
+  - build
+
+instantiate:
+  tags:
+    - nix
+  stage: instantiate
+  script:
+    - nix-instantiate -A deploy.all
+
+build:
+  tags:
+    - nix
+  stage: build
+  script:
+    - nix-build -A deploy.all

.rgignore

@@ -1 +0,0 @@
-websites/*

.sops.yaml

@@ -1,23 +0,0 @@
-keys:
-  - &parsons age1yql8qaf7upraqy4cq397tt4vgs046hq0v59qymla8t3x0ujqvu4sesgsvw
-  - &hexchen-backup age1zgdegurzlr8cw9948wgf4q5qh3efltwhhzus5tt6az5xvvsux9us2v4tyd
-  - &stuebinm-ilex age18wkr3kjalalzrq9l05q32gnlaqr7t6rqqzde307m83rs9fp4xcfsdtj9gt
-  - &stuebinm-surltesh-echer age1q88az2y5hnx8naqsvrurllqj6y5gtehrpa9emmrxy5ghwsr7pvnqf7tfpx
-  - &stuebinm-abbenay age18nkru4pwvvapdw76nauv2xdtlj8cvyv3ugahe9kcxtvtsptx2eyqw7p0m6
-  - &octycs-m age1fm3e99tdyrsvztdchxxllt9nat35xzvd68d09y8scu9jfc7kvvuquhr49c
-  - &zauberberg-conway age16fk0m26n0fr2vmuxm2mjsmrawclde2mlyj6wg3ee9jvzmu5ru3ustgs5jq
-  - &moira-2022-06 age1l694a4xht7r0eza9r2vjncupmp6cxyk3k9x2ljwynnur4m2lc5jqmy3jut
-  - &moira-openpgp age1m374x78q9eykua32ldrqxh8rh36kz6jyre69a263krf28hcycsqsrmshl0
-creation_rules:
-  - path_regex: secrets.yaml
-    key_groups:
-    - age:
-      - *parsons
-      - *hexchen-backup
-      - *stuebinm-ilex
-      - *stuebinm-surltesh-echer
-      - *stuebinm-abbenay
-      - *octycs-m
-      - *zauberberg-conway
-      - *moira-2022-06
-      - *moira-openpgp

LICENSE

@@ -1,24 +0,0 @@
-This is free and unencumbered software released into the public domain.
-
-Anyone is free to copy, modify, publish, use, compile, sell, or
-distribute this software, either in source code form or as a compiled
-binary, for any purpose, commercial or non-commercial, and by any
-means.
-
-In jurisdictions that recognize copyright laws, the author or authors
-of this software dedicate any and all copyright interest in the
-software to the public domain. We make this dedication for the benefit
-of the public at large and to the detriment of our heirs and
-successors. We intend this dedication to be an overt act of
-relinquishment in perpetuity of all present and future rights to this
-software under copyright law.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
-OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
-ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
-OTHER DEALINGS IN THE SOFTWARE.
-
-For more information, please refer to <http://unlicense.org/>

README.md

@@ -1,81 +1,32 @@
 # hacc nixfiles
 
-Welcome to the hacc nixfiles (haccfiles). This is how we configure (most of)
-our infrastructure.
+welcome to hacc nixfiles (haccfiles). this is the code describing our nix-based infrastructure.
 
-## General layout
+## structure
 
-- `flake.nix`: Entrypoint & dependencies
+- `default.nix`: Entrypoint to the config
+- `common/`: configuration common to all hosts
+- `desktop/`: desktop-relevant communication
 - `modules/`: home-grown modules for hacc-specific services
-- `pkgs/`: packages we need which aren't in nixpkgs
-- `websites/`: static websites hosted by us
-- `common/`: meta-level config, reusable across machines
-- `parsons/`: our sole server, its config & the services it runs
+- `nix/`: sources files, managed with niv
+- `pkgs/`: packages we built and don't want to upstream
 
-Right now, we only have a single host. We might add more again in the future.
+## working with the haccfiles
 
-## Working with this repo
-
-You will need a flake-enabled nix installation, and have your ssh config set up
-so that `ssh parsons` will connect to `parsons.hacc.space`.
-
-### Deploying remotely
-
-It's recommended to use [deploy_rs](https://github.com/serokell/deploy-rs):
-~~~shell
-deploy .#parsons -k [--dry-activate]
-~~~
-
-Alternatively, using just `nixos-rebuild`:
-~~~shell
-nixos-rebuild --flake .#parsons --target-host parsons \
-  --use-remote-sudo --use-substitutes [test|switch|dry-activate]
-~~~
-
-### Re-deploying on parsons itself
-
-Simply do:
-~~~shell
-nixos-rebuild --flake .#parsons [test|switch|dry-activate]
-~~~
-
-## Working on websites
-
-Websites are exposed as flake outputs: if you're working on a website & want to
-check it in a browser, do e.g.
-
-~~~shell
-nix run .#\"muc.hacc.earth\"
-~~~
-
-to start a local http server (note that some of our websites need a directory
-to be built in; these use `/tmp/hacc-website`).
-
-To add a new website, add a new subdirectory to `websites`; nix will generate a
-vhost config based on that directory's name. Add a `default.nix` in your directory
-describing how to build the website, and give its derivation a `watch` attribute
-to make the `nix run` setup work.
-
-## I don't want to build this long dependency / want a cached version!
-
-If it's still available on parsons from a previous deploy, do:
+deploy:
 ``` shell
-nix copy --from ssh://parsons /nix/store/...
+nix build -f . deploy.$hostname && ./result switch
 ```
 
-Note: don't just copy the .drv file (which Nix complains about if it can't
-build something), that's just the description of how to build it! If you
-don't know the actual outpath, look in the .drv file (should start with
-`Derive([("out","[the path you want]"...`)
+`$hostname` can be replaced with any hostname or group
 
 ## committing to haccfiles
-- Things on `main` should always reflect the config that's actually deployed on
-  parsons, except during testing / debugging sessions
+- Golden Rule: DO NOT COMMIT TO MAIN
+  - exceptions apply, if you are not sure where to commit, don't commit to main
 - split up commits, every commit is one atomic change
-- follow the commit format: "place: $change"
-  - place: e.g. `modules/$module`, `services/$service` ...
-  - change: describe your change. Please wrap your lines sensibly (or configure
-    your editor to do this for you)
+  - e.g. no big "did some changes" but instead "updated service x", "updated service y", "update service z"
+- follow the commit format: "$prefix$place: $change"
+  - prefix: one of fixup, nothing
+  - place: one of "modules/$module", "$hostname/service", "common/($place)", "pkgs/$pkgs" or "sources"
+  - change: describe your change, don't go over the character limit where git starts hiding/wrapping
 - Exception: autogenerated messages (merge commits, reverts, etc)
-- don't overuse merge commits, try to rebase things if possible with reasonable
-  effort

common/default.nix

@@ -1,12 +1,16 @@
-{ config, lib, pkgs, modules, sources, ... }:
+{ config, lib, pkgs, ... }:
 
-{
+let
+  sources = import ../nix/sources.nix;
+in {
   imports = [
     ../modules
     ./users.nix
+    (sources.home-manager + "/nixos")
+    (sources.pbb-nixfiles + "/modules/nftables")
   ];
 
-  boot.kernelPackages = lib.mkDefault pkgs.linuxPackages;
+  boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
   boot.kernelParams = [ "quiet" ];
 
   networking.domain = lib.mkDefault "hacc.space";
@@ -15,31 +19,24 @@
     SystemMaxUse=512M
     MaxRetentionSec=48h
   '';
-  nix.package = pkgs.lix;
   nix.gc.automatic = lib.mkDefault true;
-  nix.gc.options = lib.mkDefault "--delete-older-than 7d";
-  nix.settings.trusted-users = [ "root" "@wheel" ];
-  nix.extraOptions = ''
-    experimental-features = nix-command flakes
-  '';
+  nix.gc.options = lib.mkDefault "--delete-older-than 1w";
+  nix.trustedUsers = [ "root" "@wheel" ];
   environment.variables.EDITOR = "vim";
 
   services.openssh = {
     enable = true;
     ports = lib.mkDefault [ 62954 ];
-    settings = {
-      X11Forwarding = true;
-      PermitRootLogin = "prohibit-password";
-      PasswordAuthentication = false;
-      KbdInteractiveAuthentication = false;
-      StreamLocalBindUnlink = true;
+    passwordAuthentication = false;
+    challengeResponseAuthentication = false;
+    permitRootLogin = lib.mkDefault "prohibit-password";
+    extraConfig = "StreamLocalBindUnlink yes";
+    forwardX11 = true;
   };
-  };
-  programs.mosh.enable = true;
-  programs.fish.enable = true;
   security.sudo.wheelNeedsPassword = lib.mkDefault false;
 
   i18n.defaultLocale = "en_IE.UTF-8";
+  time.timeZone = "UTC";
   console = {
     font = "Lat2-Terminus16";
     keyMap = "de";
@@ -48,8 +45,8 @@
 
   environment.systemPackages = with pkgs; [
     smartmontools lm_sensors htop tcpdump nload iftop
-    bottom 
-    ripgrep vgrep
+#   bottom 
+    ripgrep
     git wget
     kitty.terminfo
     rsync pv progress
@@ -61,11 +58,11 @@
     whois
     iperf
     fd
-    eza
+    exa
     socat
     tmux
     gnupg
-    vim neovim
+    vim
     patchelf
     binutils
     dnsutils
@@ -73,19 +70,14 @@
     nmap
     s-tui stress
     ffmpeg-full
-    bat 
-    niv
-    sqlite-interactive
-    hacc-scripts
   ];
 
-  security.acme.defaults.email = "info+acme@hacc.space";
+  security.acme.email = "info+acme@hacc.space";
   security.acme.acceptTerms = true;
 
   services.nginx.appendHttpConfig = ''
     access_log off;
-    add_header Permissions-Policy "interest-cohort=()";
   '';
 
-  networking.nftables.enable = true;
+  petabyte.nftables.enable = true;
 }

common/users.nix

@@ -1,21 +1,19 @@
 { config, pkgs, lib, ... }:
 
 {
+  home-manager.useGlobalPkgs = true;
 
   users.users = {
     root = {
       openssh.authorizedKeys.keys = with pkgs.lib; concatLists (mapAttrsToList (name: user: if elem "wheel" user.extraGroups then user.openssh.authorizedKeys.keys else []) config.users.users);
     };
 
-    # all the actual config is imported from hexchen's nixfiles
-    hexchen = {
-      uid = lib.mkForce 1000;
+    stuebinm = {
+      uid = 1005;
       isNormalUser = true;
       extraGroups = [ "wheel" ];
       openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINJ0tCxsEilAzV6LaNpUpcjzyEn4ptw8kFz3R+Z3YjEF hexchen@backup"
-        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDI3T1eFS77URHZ/HVWkMOqx7W1U54zJtn9C7QWsHOtyH72i/4EVj8SxYqLllElh1kuKUXSUipPeEzVsipFVvfH0wEuTDgFffiSQ3a8lfUgdEBuoySwceEoPgc5deapkOmiDIDeeWlrRe3nqspLRrSWU1DirMxoFPbwqJXRvpl6qJPxRg+2IolDcXlZ6yxB4Vv48vzRfVzZNUz7Pjmy2ebU8PbDoFWL/S3m7yOzQpv3L7KYBz7+rkjuF3AU2vy6CAfIySkVpspZZLtkTGCIJF228ev0e8NvhuN6ZnjzXxVTQOy32HCdPdbBbicu0uHfZ5O7JX9DjGd8kk1r2dnZwwy/ hexchen@yubi5"
-        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4CLJ+mFfq5XiBXROKewmN9WYmj+79bj/AoaR6Iud2pirulot3tkrrLe2cMjiNWFX8CGVqrsAELKUA8EyUTJfStlcTE0/QNESTRmdDaC+lZL41pWUO9KOiD6/0axAhHXrSJ0ScvbqtD0CtpnCKKxtuOflVPoUGZsH9cLKJNRKfEka0H0GgeKb5Tp618R/WNAQOwaCcXzg/nG4Bgv3gJW4Nm9IKy/MwRZqtILi8Mtd+2diTqpMwyNRmbenmRHCQ1vRw46joYkledVqrmSlfSMFgIHI1zRSBXb/JkG2IvIyB5TGbTkC4N2fqJNpH8wnCKuOvs46xmgdiRA26P48C2em3 hexchen@yubi5c"
+        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDQtJQ8fUfwsC9Q39sNpZ41RRbW91QXDLKltsYK+TLidQ5IJj2KsG/lkd433Tod6PzSvB2PcfIfnvUz7GQuS1UwXHMdLEy0/kqeYrSi6QlAxFyFBSTsUZ4d+HHwBBoXhu1Iaoch/FJNI0FhfBciIii05UyYuPj5zGgvWhnfD53Ll8HA6XVXhSK09+9GRGq57Mix5N9AkzfEF83aRUF9Qfl7Jl16rOjIgtS8hbL0kXIKUeCxZA2xi/lNHEQRriCiriPmPGOhiPcNXzbekw7IbFfE3If1CHnj7KA4KnafHAd+uHvQAce5Y4v2vMOPfGVh1cm84VTzdSPEW5V1hFjOlSnnuCQtAzkQLv8zed2NLj73GgFlcUrYKERcH84wydD0gEednNKsW8T2NzgO2eNCBf0LrcFp17qmWLv51A3jofEX5tQ3PZ7zbtR4DMUmrizrsBWDYiHJOMVeMs/9TnmIc3PL17qvVvFI7OcYxl+SPPpPtaBzxXZAMIvGFppzYxRylBcBhNvE+bXXgLFXh5cbUcwgXjvrX0y8Gv/5S4E55+i2rQMqC55+O48snoSeNlQDZV+B9setXoC93K9fBurmCX8ObnNRvvghcwUl9OBSW5K9TBdl6FF3+Z3gOCIxOMGQQKJUS5/g/eLFJ+13Y5qAPS49XJzaBiTmDrRi8x22p7sU1Q== stuebinm@in.tum.de"
       ];
     };
 
@@ -24,7 +22,7 @@
       isNormalUser = true;
       extraGroups = [ "wheel" ];
       openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQqFXSlqW+D4ZtVdCiN9IT461iwyqy2taBRD3qkvXqn m@octycs.eu"
+        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDobGLrA6YQAKdJkZMpAsqjlk744G/pCJEvAUNJDuT1Sr59BFKDchPT03exb0o39mjH4iqvw4JDI10RfylKbR1736Ji2yRLlbCzUdgv2CfZc28TAO0rscyT49RHJmzEEE5QD4Ge7MgvFBEmZKXAxntA8M8EbxxEVfzhWp3751BYkzrCbJiHMXcTb+BG9P6rmrraINmgUJxywym5PsMYt2sfHlVus3hSpWnCR/cu0nxmW9E6Tm6CzSkWOXOTdjVuc0Kgh5GXaKDROzJ9K7cJAhd5t8Yzqtpm2xfSU5FVVUH9i7PbXOo8FL82Xi6kWMgdFNLvKimxGqW+bCv3ROlyKWF4I+HQdfdL181KaOQ40jAvjmldrB/ZiEbuWYSBZ/XhxFkKrtBYPDFHq/a5lnH3OvcDm7+/LhwIKUnyZyQ2dXOLOTOEDsO/69xwNveCB8of9o/erDbOeb+d44cXUFpPMUTz4bHXEP6y+zz8TB8/aleGbLQCPUzRZfvazN95jGUDqkumi9B3Lf+W/KpjVUgu3NQsUuJn6khMYW9VefnJvHwzbWpqIzbzNePL4iZFECv4NHPQHO/katajnMbkCie9rfnLk1EjJnrSnZUInEygkW/7Eu4EQM2h7lU4HYfwP1c4ubCFdES0ELGqSuJRwd/ORDbgxbuKOQ7gZ3/lgHdr9KGqJQ== markus.amaseder@amaseder.de"
       ];
       hashedPassword = "$6$qQEbD8Ejx/y$6/nkX8CmFBtAlUP/UbFKVMVlA.ZvVbjQZRABqXQjU11tKpY25ww.MCGGMEKFv.7I/UH/126/q0S3ROTqePUEc.";
     };
@@ -34,53 +32,19 @@
       isNormalUser = true;
       extraGroups = [ "wheel" "cdrom" ];
       openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfxXSy22k2EZwz1EtvIMwQKGWsswEBeLn5ClhuiI4Ma lukas@Conway.lan"
+        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCt34ou3NYWoUayWrJa5ISzihAAhFiwolJPmm2fF9llPUUA8DP3BQRiKeqDlkDzhWLwztb+dNIUuregiFJdRN5Q2JZBKlM7Gqb1QtPhtK+xe2pyZPX2SWKIsKA6j3VAThhXsQdj3slXu3dG8FF7j+IFg/eTgpeQIFQQkMIc204ha8OP2ASYAJqgJVbXq8Xh3KkAc1HSrjYJLntryvK10wyU8p3ug370dMu3vRUn44FEyDzXFM9rfsgysQTzVgp+sXdRfMLeyvf+SUrE8hiPjzevF2nsUP0Xf/rIaK5VayChPLXJkulognINzvuVWAdwNPDLpgGwkjglF2681Ag88bLX allesmoeglicheundvielmehr@hotmail.de"
       ];
       packages = with pkgs; [ ffmpeg ];
     };
 
-    moira = {
+    schweby = {
       uid = 1004;
-      shell = pkgs.fish;
       isNormalUser = true;
       extraGroups = [ "wheel" "cdrom" ];
       openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJrcJRF71+XM5YZj+SaSiGcdVZ0IDxGBXIWssDtHiTtr moira_2022_06"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINUa7NLrRqQ3j4KSGIw0vSvLMTO0gSZeCypQnJ/Viqm8 openpgp:0xBE0BE8A3"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL6JWi0MBDz0Zy4zjauQv28xYmHyapb8D4zeesq91LLE schweby@txsbcct"
       ];
       hashedPassword = "$6$zkAsaVdmIduqZxez$GY9aBlYeP41F0it/VbbZzLLLRQhHAbDdFsa3e/1GS9McTuSimMHODg6HqNVEH1zSqD3afhK/0UHfqbtF5qpi90";
     };
-
-    stuebinm = {
-      uid = 1005;
-      isNormalUser = true;
-      extraGroups = [ "wheel" ];
-      shell = pkgs.fish;
-      openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG7J3peZGB4XGJKI1dV5PdpQS+TzmoJ7qL//ipCG7G5K stuebinm@surltesh-echer"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKPB74xA2GBXnDwPEEaxWLONdQyBwjDoJHYagKRQXwO2 stuebinm@abbenay"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH8e9WrHsknoFwBm/YaigOSz9VI8dXRRR5G9BX4kKt9/ stuebinm@ilex"
-      ];
-    };
-
-    leah2 = {
-      uid = 1006;
-      shell = pkgs.fish;
-      isNormalUser = true;
-      extraGroups = [ "wheel" "cdrom" ];
-      openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK4o/ncaQUorp/BeZesPnVhzvfoqLJW3WZHtz+CWQvFU"
-      ];
-    };
-
-    floppy = {
-      uid = 1007;
-      shell = pkgs.fish;
-      isNormalUser = true;
-      extraGroups = [ "wheel" "cdrom" ];
-      openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDyVQhFDcoMnoYivQu1h8NCTWa+2WriZ1m5BilkuUk4u"
-      ];
-    };
   };
 }

default.nix

@@ -0,0 +1,7 @@
+rec {
+  sources = import ./nix/sources.nix;
+  pkgs = import ./pkgs {};
+  inherit (pkgs) lib;
+  inherit (import (sources.nix-hexchen + "/lib/hosts.nix") { inherit pkgs; hostsDir = ./hosts; commonImports = [./common]; pkgsPath = ./pkgs; }) hosts groups;
+  deploy = import (sources.nix-hexchen + "/lib/deploy.nix") { inherit pkgs hosts groups; };
+}

desktop/default.nix

@@ -0,0 +1,33 @@
+{ config, lib, pkgs, ... }:
+
+{
+  boot.plymouth.enable = true;
+  nixpkgs.config = {
+    mumble.speechdSupport = true;
+    allowUnfree = true;
+  };
+# boot.plymouth.splashBeforeUnlock = true;
+  users.users.schweby.packages = with pkgs; [
+    pulsemixer pavucontrol
+    firefox git kitty j4-dmenu-desktop bemenu
+    breeze-qt5 mako
+    mpv youtube-dl
+    wl-clipboard mumble
+    xdg_utils
+    slurp grim libnotify
+    _1password-gui
+    # gnome3.nautilus
+  ] ++ (with pkgs; [ alacritty picom feh copyq polybar cinnamon.nemo rofi arandr notepadqq nomacs bat ]);
+
+  sound.enable = true;
+  hardware.pulseaudio = {
+    enable = true;
+    package = pkgs.pulseaudioFull;
+  };
+  networking.useDHCP = lib.mkDefault true;
+  hardware.opengl.enable = true;
+  services.xserver = {
+    windowManager.bspwm.enable = true;
+    layout = "de";
+  };
+}

desktop/gnome.nix

@@ -0,0 +1,14 @@
+{config, lib, pkgs, ...}:
+
+{
+  services.xserver.displayManager.lightdm = {
+    enable = true;
+  };
+  services.xserver = {
+    enable = true;
+#   videoDrivers = [ "nvidia" ];
+  };
+# hardware.nvidia.modesetting.enable = true;
+
+  services.xserver.desktopManager.plasma5.enable = true;
+}

desktop/streaming.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, ...}:
+
+{
+  boot = {
+    extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ];
+    kernelModules = [ "v4l2loopback" ];
+  };
+
+  environment.systemPackages = with pkgs; [ obs-studio ];
+}

docs/_index.md

@@ -1,7 +0,0 @@
-+++
-title = "hacc infra documentation"
-page_template = "doc-page.html"
-sort_by="title"
-+++
-
-

docs/auth.md

@@ -1,10 +0,0 @@
-+++
-title = "Authentication"
-categories = [ "services", "uffd" ]
-+++
-
-We use [uffd](https://git.cccv.de/uffd/uffd) for our SSO, for better or worse.
-Mostly for worse.
-
-
-

docs/domains.md

@@ -1,20 +0,0 @@
-+++
-title = "Domains"
-categories = [ "domains", "meta" ]
-+++
-
-Perhaps too many of them.
-
-## Domains
-
-| domain               | mc  | status  | date     | reseller    | owner      | custody   |
-| :------------------- | :-: | :-----: | :------: | :---------- | :--------- | :-----:   |
-| 4future.dev          | yes |         |          |             |            | hacc e.V. |
-| infra4future.de      | yes |         |          |             |            | hacc e.V. |
-| hacc.space           | yes |         |          |             |            | hacc e.V. |
-| hacc.earth           | yes |         |          |             |            | hacc e.V. |
-| hacc.media           | yes |         |          |             |            | hacc e.V. |
-| hacc.wiki            | no  |         |          |             |            |           |
-
-mc = managed by cloudflare  
-status = (renewl | autorenewl | expires)

docs/hostnames.md

@@ -1,16 +0,0 @@
-+++
-title = "Hostname schema"
-+++
-
-[Badass Anarchist Women](https://listverse.com/2018/09/27/10-absolutely-badass-anarchist-women-who-challenged-the-system/)
-- keller
-- deCleyre
-- davidNeel
-- leGuin
-- [parsons](../parsons)
-- ohair
-- berneri
-- michel
-- sanger
-- goldman
-

docs/lxc.md

@@ -1,17 +0,0 @@
-+++
-title = "LXC"
-categories = [ "lxc" ]
-+++
-
-Some things don't easily run on NixOS. For these we have LXC containers running
-debian.
-
-Right now, only onlyoffice is left.
-
-## Useful commands
- - login to a container as root with a usable shell
-   `lxc-attach -n <name> -- /usr/bin/sudo -i`
- - restarting the keycloak and ldap containers
-   `lxc-stop -n <name> && lxc-start -n <name>`
- - restarting their network bridge:
-   `systemctl restart lxcbr0-netdev.services`

docs/rebooting.md

@@ -1,18 +0,0 @@
-+++
-title = "Rebooting Parsons"
-categories = [ "nix" ]
-+++
-
-## Check integrity after unexpected shutdown
-These steps are only required if the server shut down unexpectedly or you suspect tampering.
-
-TODO
-
-## Unlock full disk encryption
-Connection to the server via the command listed in the shared password manager.
-Only the Vorstand has access to it!
-
-Enter the passwords for dpool and zroot.
-
-If both are correct, you will be disconnected and the server continues the boot sequence.
-The server should be up after about minute. Please check all services for availability.

docs/secrets.md

@@ -1,21 +0,0 @@
-+++
-title = "Secrets"
-categories = [ "services", "sops" ]
-+++
-
-## Secret management
-
-We use [sops-nix](https://github.com/Mic92/sops-nix) to manage secrets which we'd
-like to have in Git but don't want to be public. Entries in `secrets.yaml` are
-encrypted for each of the age keys listed in `.sops.yaml`, which are themselves
-derived from ssh keys.
-
-For the initial set up, please take a look at the sops-nix Readme file.
-
-To edit the secrets file, run `sops secrets.yaml`, which will decrypt the
-file & open it in your $EDITOR, then re-encrypt it when you're done.
-
-To add a new key, use `ssh-to-age` to convert your ssh key to age, and add it to
-`sops.yaml`. Then do `sops updatekeys secrets.yaml` to re-encrypt the file for
-the new set of keys.
-

docs/services/_index.md

@@ -1,5 +0,0 @@
-+++
-title = "Services"
-sort_by = "title"
-page_template = "doc-page.html"
-+++

docs/services/acme.md

@@ -1,19 +0,0 @@
-+++
-title = "ACME / letsencrypt"
-categories = [ "domain", "https", "ssl", "tls", "Certificates" ]
-+++
-
-
-# Usage
-
-We use the ACME module's nginx integration for basically everything. Beware of
-rate limits when redeploying lots of things at once! Let's Encrypt is a little
-picky about those.
-
-
-## Workarounds & peculiar configuration choices
-
-Certs live under `/var/lib/acme/`
-
-If you need to remove a cert for whatever reason, be aware that there is a
-hidden `.lego` folder, that contains state as well

docs/services/hedgedoc.md

@@ -1,68 +0,0 @@
-+++
-title = "hedgedoc"
-taxonomies.categories = [ "services" ]
-+++
-
-
-hegedoc was once called codiMD, so container, config and users are still called codimd.
-
-**Do NOT change this** unless you're sure what you're doing.
-
-We have two instances:
- - `pad-hacc`/pad.hacc.space is connected to our SSO/uffd
- - `pad-i4f`/pad.infra4future.de is not connected to our SSO and meant to be more public
-
-## Basic Troubleshooting
-
-Usually if hedgedoc dies, it's because postgresql wasn't there yet. Just restart
-hedgedoc.
-
-## More Troubles
-log into the container and take a look at the logs
-
-~~~shell
-sudo nixos-container root-login codimd
-journalctl -e
-~~~
-
-### fixing failed database upgrades
-
-see https://docs.hedgedoc.org/guides/migration-troubleshooting/ (copied below
-for convenience?):
-
-In some cases, HedgeDoc might apply migrations without correctly saving the
-progress. It will then refuse to start with "already exists"-errors like
-ERROR: type "enum_Notes_permission" already exists.
-
-Get the name of the failing migration and append .js to it. For example, if
-you encounter this error:
-
-~~~
-== 20180306150303-fix-enum: migrating =======
-
-ERROR: type "enum_Notes_permission" already exists
-~~~
-
-the name of the failed migration would be 20180306150303-fix-enum.js.
-
-The SQL-statement may look like this:
-
-~~~
-INSERT INTO "SequelizeMeta" (name) VALUES ('20180306150303-fix-enum.js');
-~~~
-
-Make sure HedgeDoc does not run and insert the name into the SequelizeMeta table.
-Enter the container switch to the postgres user, open psql and commect to the
-codimd database:
-
-~~~shell
-su postgres
-psql
-\l
-\c codimd
-UN adjusted SQL STAMEMENT from above ]
-\q
-~~~
-
-Start HedgeDoc again and observe if it starts correctly. It may be necessary to
-repeat this process and insert multiple migrations into the SequelizeMeta table.

docs/services/mail.md

@@ -1,65 +0,0 @@
-+++
-title = "mail"
-taxonomies.categories = [ "services" ]
-+++
-
-Mail is not connected to our SSO!
-
-## adding a mail account
-- We use `@hacc.space` for our mails
-- `@infra4future.de` is reserved for services, old user accounts will be
-  forwarded & logins disabled
-- choose a name (no aliases or other names can be the same)
-- generate a sha-512 password hash ```mkpasswd -m sha-512``` - **never add an 
-  unhashed password!**
-- add your account to `loginAccounts =` in `//parsons/mail.nix`
-- build and redeploy parsons
-
-**example:**
-```
-zwoelfontheshelf@hacc.space" = {
-	hashedPassword = "$6$ISAaU8X6D$oGKe9WXDWrRpGzHUEdxrxdtgvzuGOkBMuDc82IZhegpsv1bqd550FhZZrI40IjZTA5Hy2MZ8j/0efpnQ4fOQH0";
-};
-```
-
-## adding to a forward address
-- add the mail address to the corresponding `extraVirtualAliases =`
-- build and redeploy parsons
-
-## adding a forward address
-- add the address to `extraVirtualAliases =`
-- add the addresses it should forward to
-- build and redeploy parsons
-
-**example:**
-```
-"himmel@hacc.space" = [
-	"hexchen@hacc.space"
-	"zauberberg@hacc.space"
-];
-```
-
-## sending & receiving mail
-
-### as a user
-- Your mail client should auto configure correctly
-
-~~~
-mailserver: mail.hacc.space (everywhere)
-username: $your_mail_address
-sending via smtp: port 587 or 465
-recieving
-	imap: port 993
-TLS and STARTTLS are supported
-~~~
-
-- You can send mail as you and any alias you receive mail from. Set a second Identity in your e-mail client
-
-### as an application
-- mailserver: `mail.hacc.space`
-- Do **not** use port 25. It's for server to server communication only.
-- Use smtp ports `587` or `465`
-- enable TLS if possible
-- only send mail from `noreply@infra4future.de`
-- Password is somewhere (TODO!)
-

docs/services/mumble.md

@@ -1,40 +0,0 @@
-+++
-title = "mumble"
-taxonomies.categories = [ "mumble" ]
-+++
-
-
-[offical Docmuentation](https://wiki.mumble.info/wiki/Main_Page)
-
-Mumble's server is called murmur, but the naming is inconsistent. Sometimes
-it's also just called mumble server.
-
-# Usage
-
-## registration
-Users need to be registered to join any other channel than public.
-An already registered user has to register them with the server.
-1. right click on the username
-2. choose register in the menu. Done.
-
-## restricted channels
-Every channel in the hacc category except for plenum can only be accessed by
-members of the hacc group.
-
-## adding users to a group
-Only admins can edit groups, and only registered users can be added to groups.
-1. right click on the Root channel
-2. select Edit...
-2. In Groups select $groupname
-3. make the change you want to make
-4. click "OK"
-
-# Config details
-- the server is not registered with mumble & not on the public server list 
-- the bitrate is set to 128kb/s; otherwise the client would complain that the
-  server bitrate is less then the configured (default) in its local settings
-
-# Hacks
-- murmur needs a TLS cert, which we get via the ACME module
-- there's a funny group setup so that hopefully murmurd can read the cert
-- this seems to work fine now, but was some source of trouble in the past

docs/services/service.template.md

@@ -1,18 +0,0 @@
-+++
-title = "$Service Name"
-draft = true ## Remove this line to make file appear on website
-+++
-
-<general information & pointers to official documentation>
-
-# Usage
-<usage from an admin's perspective>
-
-# Config Notes
-<what should one keep in mind when reading the nix file?>
-
-## Updating
-<anything to keep in mind?>
-
-# Hacks
-<ugly things which might break or cause general ???? states>

docs/snapshots.md

@@ -1,24 +0,0 @@
-+++
-title = "Use ZFS snapshot"
-taxonomies.categories = [ "zfs", "snapshot", "filesystem", "backup", "update", "upgrade" ]
-+++
-
-## Make a ZFS snapshot
-~~~shell
-sudo zfs snapshot zroot/safe/persist@<name>
-~~~
-
-## Rollback
-
-### single files
-The snapshots can be accessed under `<mountpoint>/.zfs/snapshot/...`
-
-### fully
-~~~shell
-sudo zfs rollback zroot/safe/persist@<name>
-~~~
-
-## Delete a ZFS snapshot
-~~~shell
-sudo zfs destroy zroot/safe/persist@<name>
-~~~

flake.lock

@@ -1,229 +0,0 @@
-{
-  "nodes": {
-    "blobs": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1604995301,
-        "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=",
-        "owner": "simple-nixos-mailserver",
-        "repo": "blobs",
-        "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265",
-        "type": "gitlab"
-      },
-      "original": {
-        "owner": "simple-nixos-mailserver",
-        "repo": "blobs",
-        "type": "gitlab"
-      }
-    },
-    "deploy-rs": {
-      "inputs": {
-        "flake-compat": "flake-compat",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "utils": "utils"
-      },
-      "locked": {
-        "lastModified": 1727447169,
-        "narHash": "sha256-3KyjMPUKHkiWhwR91J1YchF6zb6gvckCAY1jOE+ne0U=",
-        "owner": "serokell",
-        "repo": "deploy-rs",
-        "rev": "aa07eb05537d4cd025e2310397a6adcedfe72c76",
-        "type": "github"
-      },
-      "original": {
-        "owner": "serokell",
-        "repo": "deploy-rs",
-        "type": "github"
-      }
-    },
-    "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "nixos-mailserver": {
-      "inputs": {
-        "blobs": "blobs",
-        "flake-compat": [
-          "deploy-rs",
-          "flake-compat"
-        ],
-        "nixpkgs": [
-          "nixpkgs-unstable"
-        ],
-        "nixpkgs-24_05": "nixpkgs-24_05"
-      },
-      "locked": {
-        "lastModified": 1734370678,
-        "narHash": "sha256-a8zkti1QM5Oxkdfnzr/NjrFlyqI36/kYV/X8G1jOmB4=",
-        "owner": "simple-nixos-mailserver",
-        "repo": "nixos-mailserver",
-        "rev": "c43d8c4a3ce84a7bebd110b06e69365484db6208",
-        "type": "gitlab"
-      },
-      "original": {
-        "owner": "simple-nixos-mailserver",
-        "ref": "master",
-        "repo": "nixos-mailserver",
-        "type": "gitlab"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1734298236,
-        "narHash": "sha256-aWhhqY44xBjMoO9r5fyPp5u8tqUNWRZ/m/P+abMSs5c=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "eb919d9300b6a18f8583f58aef16db458fbd7bec",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-24.11-small",
-        "type": "indirect"
-      }
-    },
-    "nixpkgs-24_05": {
-      "locked": {
-        "lastModified": 1731797254,
-        "narHash": "sha256-df3dJApLPhd11AlueuoN0Q4fHo/hagP75LlM5K1sz9g=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "e8c38b73aeb218e27163376a2d617e61a2ad9b59",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-24.05",
-        "type": "indirect"
-      }
-    },
-    "nixpkgs-oldstable": {
-      "locked": {
-        "lastModified": 1678761643,
-        "narHash": "sha256-tapXZvg6Kg5Fm7Fm6i+7cRC5Exp2lX7cgMrqsfrGhuc=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "c4aec3c021620d98861639946123214207e98344",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "c4aec3c021620d98861639946123214207e98344",
-        "type": "github"
-      }
-    },
-    "nixpkgs-unstable": {
-      "locked": {
-        "lastModified": 1734318609,
-        "narHash": "sha256-VPbVfHSvFs58T+kbseS7wa9WP6p2z7RJmjTnV4pAPQ0=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "66cdf593c0041cf1efc9b2889d80c9a5c497b284",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-unstable-small",
-        "type": "indirect"
-      }
-    },
-    "root": {
-      "inputs": {
-        "deploy-rs": "deploy-rs",
-        "nixos-mailserver": "nixos-mailserver",
-        "nixpkgs": "nixpkgs",
-        "nixpkgs-oldstable": "nixpkgs-oldstable",
-        "nixpkgs-unstable": "nixpkgs-unstable",
-        "sops-nix": "sops-nix",
-        "tracktrain": "tracktrain"
-      }
-    },
-    "sops-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs-unstable"
-        ]
-      },
-      "locked": {
-        "lastModified": 1733965552,
-        "narHash": "sha256-GZ4YtqkfyTjJFVCub5yAFWsHknG1nS/zfk7MuHht4Fs=",
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "rev": "2d73fc6ac4eba4b9a83d3cb8275096fbb7ab4004",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "type": "github"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "tracktrain": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1720213096,
-        "narHash": "sha256-GrSXD6WvyiXcHx1s+48PEZVn/MTtBJAXpgds+NdEL2g=",
-        "ref": "main",
-        "rev": "2943327863bfe5c6e793e5c40e473a2755d45642",
-        "revCount": 126,
-        "type": "git",
-        "url": "https://stuebinm.eu/git/tracktrain"
-      },
-      "original": {
-        "ref": "main",
-        "type": "git",
-        "url": "https://stuebinm.eu/git/tracktrain"
-      }
-    },
-    "utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1701680307,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

flake.nix

@@ -1,88 +0,0 @@
-{
-  description = "hacc infra stuff";
-
-  inputs = {
-    nixpkgs.url = "nixpkgs/nixos-24.11-small";
-    nixpkgs-unstable.url = "nixpkgs/nixos-unstable-small";
-    nixpkgs-oldstable.url = "github:/NixOS/nixpkgs?rev=c4aec3c021620d98861639946123214207e98344";
-
-    nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/master";
-    tracktrain.url = "git+https://stuebinm.eu/git/tracktrain?ref=main";
-    tracktrain.flake = false;
-
-    deploy-rs.url = "github:serokell/deploy-rs";
-    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
-    sops-nix.url = "github:Mic92/sops-nix";
-    sops-nix.inputs.nixpkgs.follows = "nixpkgs-unstable";
-    
-    # these exist mostly to make the flake.lock somewhat more human-friendly
-    # note that in theory doing this might break things, but it seems fairly unlikely
-    nixos-mailserver.inputs = {
-      nixpkgs.follows = "nixpkgs-unstable";
-      flake-compat.follows = "/deploy-rs/flake-compat";
-    };
-  };
-
-  outputs = { self, nixpkgs, deploy-rs, sops-nix, ... }@inputs:
-    let modules = {
-          bindMounts = import ./modules/bindmounts.nix;
-          nopersist = import ./modules/nopersist.nix;
-          encboot = import ./modules/encboot.nix;
-        };
-        profiles = {
-          container = import ./modules/container-profile.nix;
-        };
-        pkgs = import ./pkgs {
-          sources = inputs;
-          system = "x86_64-linux";
-          config.allowUnfree = true;
-        };
-    in {
-      nixosConfigurations.parsons = nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules = [
-          ./parsons/configuration.nix
-          ./modules/buildinfo.nix
-          ./modules/containers.nix
-          sops-nix.nixosModules.sops
-          { nixpkgs.pkgs = pkgs; }
-        ];
-        specialArgs = {
-          sources = inputs;
-          inherit modules profiles;
-          inherit (nixpkgs.lib) nixosSystem;
-        };
-      };
-
-      deploy.nodes.parsons = {
-        hostname = "parsons";
-        profiles.system = {
-          user = "root";
-          autoRollback = false;
-          path = deploy-rs.lib.x86_64-linux.activate.nixos
-            self.nixosConfigurations.parsons;
-        };
-      };
-
-      # This is highly advised, and will prevent many possible mistakes
-      checks = builtins.mapAttrs
-        (system: deployLib: deployLib.deployChecks self.deploy)
-        deploy-rs.lib;
-
-      apps.x86_64-linux =
-        let
-	  mkApp = pkg: {
-	    type = "app";
-	    program = pkgs.lib.getExe pkg;
-	  };
-          websites = pkgs.lib.mapAttrs (name: mkApp) 
-	    self.nixosConfigurations.parsons.config.hacc.websites.builders;
-        in
-          { docs = websites."docs.hacc.space"; } // websites;
-
-      packages.x86_64-linux = {
-        inherit (pkgs) mattermost hacc-scripts;
-      };
-    };
-
-}

hosts/hainich/configuration.nix

@@ -0,0 +1,103 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    ../../common
+    ./encboot.nix
+    ./hardware.nix
+    ./services/murmur.nix
+    ./services/mail.nix
+    ./services/sympa.nix
+#   ./services/engelsystem.nix
+    ./services/codimd.nix
+    ../../common
+#   ./wireguard.nix
+    ./services/nginx.nix
+#   ./k8s.nix
+    ./services/docker.nix
+    ./services/gitlab-runner.nix
+    ./services/lantifa.nix
+  ];
+  boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
+  boot.loader.grub.device = "/dev/sda";
+  boot.supportedFilesystems = [ "zfs" ];
+
+  # networking
+  networking.hostName = "hainich";
+  networking.hostId = "8a58cb2f";
+  networking.useDHCP = true;
+  networking.interfaces.enp6s0.ipv4.addresses = [
+    {
+      address = "46.4.63.148";
+      prefixLength = 27;
+    }
+
+    {
+      address = "46.4.63.158";
+      prefixLength = 27;
+    }
+  ];
+  networking.interfaces.enp6s0.ipv6.addresses = [ {
+    address = "2a01:4f8:140:84c9::1";
+    prefixLength = 64;
+  } ];
+  networking.defaultGateway = "46.4.63.129";
+  networking.nameservers = [
+    "1.1.1.1" "1.0.0.1"
+    "2606:4700:4700::1111" "2606:4700:4700::1001"
+  ];
+  networking.defaultGateway6 = {
+    address = "fe80::1";
+    interface = "enp6s0";
+  };
+
+  hacc.nftables.nat.enable = true;
+  networking.nat.internalInterfaces = ["ve-+"];
+  networking.nat.internalIPs = [ "192.168.100.0/24" "172.17.0.0/16" ];
+  networking.nat.externalInterface = "enp6s0";
+
+
+  networking.firewall.allowedTCPPorts = [ 22 80 443 ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # networking.firewall.enable = false;
+
+  # misc
+  time.timeZone = "UTC";
+
+  environment.systemPackages = with pkgs; [
+    wget vim git
+  ];
+
+  services.openssh.enable = true;
+  services.openssh.ports = [ 22 62954 ];
+
+  users.users.root = {
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL6JWi0MBDz0Zy4zjauQv28xYmHyapb8D4zeesq91LLE schweby@txsbcct"
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCvmrk3i04tXfrSlZtHFbG3o6lQgh3ODMWmGDING4TJ4ctidexmMNY15IjVjzXZgQSET1uKLDLITiaPsii8vaWERZfjm3jjub845mpKkKv48nYdM0eCbv7n604CA3lwoB5ebRgULg4oGTi60rQ4trFf3iTkJfmiLsieFBZz7l+DfgeDEjDNSJcrkOggGBrjE5vBXoDimdkNh8kBNwgMDj1kPR/FHDqybSd5hohCJ5FzQg9vzl/x/H1rzJJKYPO4svSgHkYNkeoL84IZNeHom+UEHX0rw2qAIEN6AiHvNUJR38relvQYxbVdDSlaGN3g26H2ehsmolf+U0uQlRAXTHo0NbXNVYOfijFKL/jWxNfH0aRycf09Lu60oY54gkqS/J0GoQe/OGNq1Zy72DI+zAwEzyCGfSDbAgVF7Y3mU2HqcqGqNzu7Ade5oCbLmkT7yzDM3x6IsmT1tO8dYiT8Qv+zFAECkRpw3yDkJkPOxNKg10oM318whMTtM3yqntE90hk= schweby@taxusbaccata"
+    ];
+    initialHashedPassword = "$6$F316njEF2$GMF4OmPSF6QgZ3P/DblQ/UFMgoo98bztbdw7X0ygvBGC1UMMIc13Vtxjd/ZGRYW/pEHACZZ7sbRZ48t6xhvO7/";
+#   shell = pkgs.fish;
+  };
+
+  # storage stuffs!
+  services.zfs = {
+    autoSnapshot = {
+      enable = true;
+    };
+    autoScrub = {
+      enable = true;
+    };
+  };
+
+  boot.kernelPackages = pkgs.linuxPackages;
+ 
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "20.03"; # Did you read the comment?
+}

hosts/hainich/encboot.nix

@@ -0,0 +1,28 @@
+{ config, lib, pkgs, ... }:
+
+{
+  boot.initrd.kernelModules = [ "r8169" ]; # add network card driver
+  boot.kernelParams = ["ip=:::::enp6s0:dhcp"]; # enable dhcp on primary network interface
+  boot.initrd.network = {
+    enable = true;
+    ssh = {
+      enable = true;
+      port = 2222;
+      # TODO: Modify system config so that this works
+#     authorizedKeys = with lib; concatLists (mapAttrsToList (name: user: if elem "wheel" user.extraGroups then user.openssh.authorizedKeys.keys else []) config.users.users);
+      authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys;
+      hostKeys = [ /run/keys/ecdsa_host ];
+    };
+    # TODO: curl some webhook here to alert?
+    #       possibly quite hard to do, we only have limited wget or netcat available
+    # how this all works:
+    #       when someone logs in via ssh, they are prompted to unlock the zfs volume
+    #       afterwards zfs is killed in order for the boot to progress
+    #       timeout of 120s still applies afaik
+    postCommands = ''
+      zpool import zroot
+      zpool import dpool
+      echo "zfs load-key -a; killall zfs && exit" >> /root/.profile
+    '';
+  };
+}

hosts/hainich/hardware.nix

@@ -0,0 +1,52 @@
+{ config, lib, pkgs, ... }:
+
+{
+  boot.initrd.availableKernelModules = [ "uhci_hcd" "ahci" "sd_mod" ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "zroot/root/nixos";
+      fsType = "zfs";
+    };
+
+  fileSystems."/nix" =
+    { device = "zroot/root/nixos/nix";
+      fsType = "zfs";
+    };
+
+  fileSystems."/home" =
+    { device = "dpool/home";
+      fsType = "zfs";
+    };
+
+  fileSystems."/var/lib/containers" =
+    { device = "dpool/containers";
+      fsType = "zfs";
+    };
+
+  fileSystems."/var/lib/docker" =
+    { device = "dpool/docker";
+      fsType = "zfs";
+    };
+
+  fileSystems."/var/lib/gitlab-runner" =
+    { device = "dpool/gitlab-runner";
+      fsType = "zfs";
+    };
+
+  fileSystems."/data" =
+    { device = "dpool/data";
+      fsType = "zfs";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/40125f55-7fe8-4850-902e-b4d6e22f0335";
+      fsType = "ext2";
+    };
+
+  swapDevices = [ ];
+
+  nix.maxJobs = lib.mkDefault 12;
+  powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
+}

hosts/hainich/k8s.nix

@@ -0,0 +1,125 @@
+{ config, pkgs, ... }:
+{
+  services.etcd = {
+    advertiseClientUrls = [
+      "https://[2a0d:eb04:8:10::1]:2379"
+    ];
+    listenClientUrls = [
+      "https://[2a0d:eb04:8:10::1]:2379"
+    ];
+    listenPeerUrls = [
+      "https://[::1]:2380"
+    ];
+  };
+  services.kubernetes = {
+    roles = [ "master" "node" ];
+    flannel.enable = false;
+    addons.dns = {
+      enable = true;
+      clusterIp = "2a0d:eb04:8:11::53";
+      reconcileMode = "EnsureExists";
+    };
+    pki.cfsslAPIExtraSANs = [ "hainich.hacc.space" ];
+    apiserver = {
+      advertiseAddress = "2a0d:eb04:8:10::1";
+      extraSANs = [
+        "2a0d:eb04:8:10::1" "2a0d:eb04:8:11::1" "hainich.hacc.space"
+      ];
+      bindAddress = "::";
+      insecureBindAddress = "::1";
+      etcd = {
+        servers = [ "https://[2a0d:eb04:8:10::1]:2379" ];
+      };
+      serviceClusterIpRange = "2a0d:eb04:8:11::/120";
+      extraOpts = "--allow-privileged=true";
+    };
+    controllerManager = {
+      bindAddress = "::";
+      clusterCidr = "2a0d:eb04:8:12::/64";
+    };
+    kubelet = {
+      address = "::";
+      clusterDns = "2a0d:eb04:8:11::53";
+    };
+    proxy = {
+      bindAddress = "::";
+    };
+    scheduler = {
+      address = "::1" ;
+    };
+    apiserverAddress = "https://[2a0d:eb04:8:10::1]:6443";
+    clusterCidr = "2a0d:eb04:8:12::/64";
+    easyCerts = true;
+    masterAddress = "hainich.hacc.space";
+  };
+
+  networking.firewall = {
+    allowedTCPPorts = [ 80 443 6443 ];
+    trustedInterfaces = [
+      "cbr0" "tunnat64"
+    ];
+    extraCommands = ''
+      iptables -t nat -A POSTROUTING -o enp6s0 -j SNAT --to 46.4.63.158
+      iptables -A FORWARD -i tunnat64 -j ACCEPT
+
+      iptables -t nat -A PREROUTING -p tcp -d 46.4.63.158 --dport 80 -j DNAT --to-destination 10.255.255.2:80
+      iptables -t nat -A PREROUTING -p tcp -d 46.4.63.158 --dport 443 -j DNAT --to-destination 10.255.255.2:443
+      iptables -t nat -A PREROUTING -p tcp -d 46.4.63.158 --dport 6443 -j DNAT --to-destination 10.255.255.1:443
+
+      ip6tables -A FORWARD -i tunnat64 -j ACCEPT
+      ip6tables -A INPUT -i tunnat64 -j ACCEPT
+    '';
+    extraStopCommands = ''
+      iptables -t nat -D POSTROUTING -o enp6s0 -j SNAT --to 46.4.63.158
+      iptables -D FORWARD -i tunnat64 -j ACCEPT
+
+      iptables -t nat -D PREROUTING -p tcp -d 46.4.63.158 --dport 80 -j DNAT --to-destination 10.255.255.2:80
+      iptables -t nat -D PREROUTING -p tcp -d 46.4.63.158 --dport 443 -j DNAT --to-destination 10.255.255.2:443
+      iptables -t nat -D PREROUTING -p tcp -d 46.4.63.158 --dport 6443 -j DNAT --to-destination 10.255.255.1:443
+
+      ip6tables -A FORWARD -i tunnat64 -j ACCEPT
+      ip6tables -A INPUT -i tunnat64 -j ACCEPT
+    '';
+  };
+
+  systemd.services.tayga = (let
+    config = pkgs.writeText "tayga.conf" ''
+        tun-device tunnat64
+        ipv4-addr 10.255.255.254
+        prefix 2a0d:eb04:8:10:64::/96
+        dynamic-pool 10.255.255.0/24
+        map 10.255.255.1 2a0d:eb04:8:10::1
+        map 10.255.255.2 2a0d:eb04:8:11::2
+        strict-frag-hdr 1
+      '';
+    startScript = pkgs.writeScriptBin "tayga-start" ''
+        #! ${pkgs.runtimeShell} -e
+        ${pkgs.iproute}/bin/ip link set up tunnat64 || true
+        ${pkgs.iproute}/bin/ip route add 10.255.255.0/24 dev tunnat64 || true
+        ${pkgs.iproute}/bin/ip -6 route add 2a0d:eb04:8:10:64::/96 dev tunnat64 || true
+        ${pkgs.tayga}/bin/tayga -d --config ${config}
+      '';
+  in {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+    serviceConfig = {
+      ExecStart = ''${startScript}/bin/tayga-start'';
+    };
+  });
+
+  networking.interfaces.cbr0.ipv6.routes = [{
+    address = "2a0d:eb04:8:10::";
+    prefixLength = 60;
+  }];
+
+  networking.interfaces.tunnat64 = {
+    virtual = true;
+  };
+
+  # openebs expects some stuff to be there.
+  system.activationScripts.openebs = ''
+    mkdir -p /usr/lib /usr/sbin
+    ln -sf ${pkgs.zfs.lib}/lib/* /usr/lib/
+    ln -sf ${pkgs.zfs}/bin/zfs /usr/sbin/
+  '';
+}

hosts/hainich/services/codimd.nix

@@ -0,0 +1,80 @@
+{ config, lib, pkgs, ... }:
+
+{
+  containers.codimd = {
+    privateNetwork = true;
+    hostAddress = "192.168.100.1";
+    localAddress = "192.168.100.3";
+    autoStart = true;
+    config = { config, lib, pkgs, ... }: {
+      networking.firewall.enable = false;
+      services.coredns = {
+        enable = true;
+        config = ''
+        .:53 {
+          forward . 1.1.1.1
+        }
+        '';
+      };
+      services.hedgedoc = {
+        enable = true;
+        configuration = {
+          allowAnonymous = true;
+          allowFreeURL = true;
+          allowGravatar = false;
+          allowOrigin = [ "localhost" "pad.hacc.space" "fff-muc.de" ];
+          dbURL = "postgres://codimd:codimd@localhost:5432/codimd";
+          defaultPermission = "limited";
+          domain  = "pad.hacc.space";
+          host = "0.0.0.0";
+          protocolUseSSL = true;
+          hsts.preload = false;
+          email = false;
+          oauth2 = {
+            authorizationURL = "https://auth.infra4future.de/auth/realms/forfuture/protocol/openid-connect/auth";
+            tokenURL = "https://auth.infra4future.de/auth/realms/forfuture/protocol/openid-connect/token";
+            clientID = "codimd";
+            clientSecret = "1a730af1-4d6e-4c1d-8f7e-72375c9b8d62";
+          };
+        };
+      };
+      systemd.services.hedgedoc.environment = {
+        "CMD_OAUTH2_USER_PROFILE_URL" = "https://auth.infra4future.de/auth/realms/forfuture/protocol/openid-connect/userinfo";
+        "CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR" = "name";
+        "CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR" = "display-name";
+        "CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR" = "email";
+        "CMD_OAUTH2_PROVIDERNAME" = "Infra4Future";
+      };
+      services.postgresql = {
+        enable = true;
+        ensureDatabases = [ "codimd" ];
+        ensureUsers = [{
+          name = "codimd";
+          ensurePermissions = {
+            "DATABASE codimd" = "ALL PRIVILEGES";
+          };
+        }];
+      };
+    };
+  };
+
+  services.nginx.virtualHosts."pad.hacc.space" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://192.168.100.3:3000";
+      extraConfig = ''
+        proxy_pass_request_headers on;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $http_connection;
+        add_header Access-Control-Allow-Origin "*";
+        proxy_buffering off;
+      '';
+    };
+  };
+}

hosts/hainich/services/docker.nix

@@ -0,0 +1,32 @@
+{ config, lib, pkgs, ... }:
+
+{
+  virtualisation.oci-containers.containers."ghost-waszumfff" = {
+    autoStart = true;
+    environment = {
+      url = "https://waszumfff.4future.dev";
+    };
+    image = "ghost:alpine";
+    ports = [ "127.0.0.1:2368:2368" ];
+    volumes = [ "/run/florinori:/var/lib/ghost/content" ];
+  };
+
+  fileSystems."/run/florinori" =
+    { device = "dpool/k8s/florinori";
+      fsType = "zfs";
+    };
+
+  services.nginx.virtualHosts."waszumfff.4future.dev" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:2368";
+      extraConfig = "
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+      ";
+    };
+  };
+}

hosts/hainich/services/engelsystem.nix

@@ -0,0 +1,93 @@
+{ config, lib, pkgs, ... }:
+
+# TODO: Make this confix nix-y, so it doesn't require a metric shitton of
+# manual intervention to install
+{
+  containers.engelsystem = {
+    config = { pkgs, lib, config, ... }:
+      let
+        app = "engelsystem";
+        domain = "himmel.hacc.earth";
+        dataDir = "/srv/http/${domain}/public";
+        engelport-py-pack = python-packages: with pkgs.python38Packages; [
+          mysqlclient
+        ];
+        engelport-py = pkgs.python38.withPackages engelport-py-pack;
+      in {
+        networking.firewall.enable = false;
+        networking.nameservers = ["1.1.1.1" "1.0.0.1"];
+        networking.hosts."192.168.100.1" = [ "mail.hacc.space" ];
+        services.phpfpm.pools.${app} = {
+          user = app;
+          settings = {
+            "listen.owner" = config.services.nginx.user;
+            "pm" = "dynamic";
+            "pm.max_children" = 32;
+            "pm.max_requests" = 500;
+            "pm.start_servers" = 2;
+            "pm.min_spare_servers" = 2;
+            "pm.max_spare_servers" = 5;
+            "php_admin_value[error_log]" = "stderr";
+            "php_admin_flag[log_errors]" = true;
+            "catch_workers_output" = true;
+          };
+          phpEnv."PATH" = lib.makeBinPath [ pkgs.php ];
+        };
+        services.nginx = {
+          enable = true;
+          virtualHosts.${domain}.locations = {
+            "/" = {
+              extraConfig = "rewrite ^ /index.php;";
+            };
+            "/assets" = {
+              root = dataDir;
+            };
+            "/index.php" = {
+              root = dataDir;
+              extraConfig = ''
+                include ${pkgs.nginx}/conf/fastcgi.conf;
+                fastcgi_split_path_info ^(.+\.php)(\\/.*)$;
+                try_files $fastcgi_script_name =404;
+                fastcgi_param PATH_INFO $fastcgi_path_info;
+                fastcgi_pass unix:${config.services.phpfpm.pools.${app}.socket};
+                fastcgi_intercept_errors on;
+              '';
+            };
+          };
+        };
+        users.users.${app} = {
+          isSystemUser = true;
+          createHome = true;
+          home = dataDir;
+          group  = app;
+        };
+        users.groups.${app} = {};
+
+        services.mysql = {
+          enable = true;
+          ensureDatabases = [ "engelsystem" ];
+          ensureUsers = [{
+            name = "engelsystem";
+            ensurePermissions."engelsystem.*" = "ALL PRIVILEGES";
+          }];
+          package = pkgs.mariadb;
+        };
+
+        environment.systemPackages = [
+          pkgs.php pkgs.php74Packages.composer pkgs.yarn engelport-py
+        ];
+      };
+    privateNetwork = true;
+    hostAddress = "192.168.100.1";
+    localAddress = "192.168.100.2";
+    autoStart = true;
+  };
+  services.nginx.virtualHosts."himmel.hacc.earth" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://192.168.100.2";
+      extraConfig = "add_header Host himmel.hacc.earth;";
+    };
+  };
+}

hosts/hainich/services/gitlab-runner.nix

@@ -0,0 +1,62 @@
+{config, pkgs, lib, ...}:
+
+{
+  services.gitlab-runner = {
+    enable = true;
+    concurrent = 4;
+    services = {
+      infra4future = {
+        buildsDir = "/var/lib/gitlab-runner/builds";
+        dockerImage = "nixos/nix";
+        executor = "docker";
+        registrationConfigFile = "/run/gitlab-runner.env";
+      };
+      nix = {
+        registrationConfigFile = "/run/gitlab-runner.env";
+        dockerImage = "alpine";
+        dockerVolumes = [
+          "/nix/store:/nix/store:ro"
+          "/nix/var/nix/db:/nix/var/nix/db:ro"
+          "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
+        ];
+        dockerDisableCache = true;
+        preBuildScript = pkgs.writeScript "setup-container" ''
+          mkdir -p -m 0755 /nix/var/log/nix/drvs
+          mkdir -p -m 0755 /nix/var/nix/gcroots
+          mkdir -p -m 0755 /nix/var/nix/profiles
+          mkdir -p -m 0755 /nix/var/nix/temproots
+          mkdir -p -m 0755 /nix/var/nix/userpool
+          mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
+          mkdir -p -m 1777 /nix/var/nix/profiles/per-user
+          mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
+          mkdir -p -m 0700 "$HOME/.nix-defexpr"
+          . ${pkgs.nix}/etc/profile.d/nix.sh
+          ${pkgs.nix}/bin/nix-env -i ${lib.concatStringsSep " " (with pkgs; [ nix cacert git openssh ])}
+          ${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable
+          ${pkgs.nix}/bin/nix-channel --update nixpkgs
+        '';
+        environmentVariables = {
+          ENV = "/etc/profile";
+          USER = "root";
+          NIX_REMOTE = "daemon";
+          PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
+          NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
+        };
+        tagList = [ "nix" ];
+      };
+    };
+  };
+
+  systemd.services.gitlab-runner.serviceConfig = {
+    DynamicUser = lib.mkForce false;
+    User = "gitlab-runner";
+  };
+
+  users.users.gitlab-runner = {
+    home = "/var/lib/gitlab-runner";
+    extraGroups = [ "docker" ];
+    isSystemUser = true;
+  };
+
+  virtualisation.docker.storageDriver = "zfs";
+}

hosts/hainich/services/lantifa.nix

@@ -0,0 +1,91 @@
+{ config, lib, pkgs, ... }:
+
+let
+  unstable = import (import ../../../nix/sources.nix).nixpkgs-unstable {};
+in {
+  containers.lantifa = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress6 = "fd00::42:14";
+    localAddress6 = "fd00::42:15";
+
+    config = {config, pkgs, ... }: {
+      networking.hosts."::1" = [ "wiki.lantifa.org" ];
+      networking.firewall.enable = false;
+      users.users.mediawiki.extraGroups = [ "keys" ];
+
+      services.mediawiki = {
+        enable = true;
+        name = "LANtifa";
+        package = unstable.mediawiki;
+        database.createLocally = true;
+        passwordFile = "/var/lib/mediawiki/mediawiki-password";
+        extraConfig = let
+          wikidb = pkgs.fetchzip {
+            url = "http://www.kennel17.co.uk/uploads/testwiki/e/e9/WikiDB.zip";
+            sha256 = "0d4f2ygglz4w515a7lgw59500q3xmr92xxhsmh8p204yaa769x8v";
+          };
+        in ''
+          // Configure short URLs
+          $wgScriptPath  = "";
+          $wgArticlePath = "/wiki/$1";
+          $wgUsePathInfo = true;
+
+          require_once('${wikidb}/WikiDB.php');
+          $wgExtraNamespaces = array( 100 => "Table", 101 => "Table_Talk",);
+          $wgWikiDBNamespaces = 100;
+          $wgGroupPermissions['user']['writeapi'] = true;
+          $wgDefaultUserOptions['visualeditor-enable'] = 1;
+          $wgLogo = "images/c/c5/LantifaLogoFem0.3.png";
+
+          // PageForms config
+          $wgGroupPermissions['*']['viewedittab'] = false;
+          $wgGroupPermissions['user']['viewedittab'] = true;
+
+          // Moderation setting
+          $wgModerationNotificationEnable = true;
+          $wgModerationEmail = "wiki_mod@lantifa.org";
+          $wgLogRestrictions["newusers"] = 'moderation';
+
+          // intersection / DynamicPageList config
+          $wgDLPMaxCacheTime = 5 * 60;
+        '';
+
+        extensions = {
+          TemplateData = null;
+          VisualEditor = null;
+          InputBox = null;
+          Moderation = pkgs.fetchzip {
+            url = "https://github.com/edwardspec/mediawiki-moderation/archive/v1.4.20.tar.gz";
+            sha256 = "1k0z44jfqsxzwy6jjz3yfibiq8wi845d5iwwh8j3yijn2854fj0i";
+          };
+          intersection = pkgs.fetchzip {  # This is the DynamicPageList extension
+            url = "https://extdist.wmflabs.org/dist/extensions/intersection-REL1_35-f657385.tar.gz";
+            sha256 = "0f4bpxdfj5k4ll56s3i6cpgcpfalsff307shdhqhrbl0n3kbr3q0";
+          };
+          PageForms = pkgs.fetchzip {
+            url = "https://github.com/wikimedia/mediawiki-extensions-PageForms/archive/5.0.1.zip";
+            sha256 = "172m7p941fbkl29h5bhanx3dn42jfmzgyvgmgm2lgdbmkawwly96";
+          };
+        };
+
+        virtualHost =  {
+          hostName = "wiki.lantifa.org";
+          listen = [ { port = 80; } ];
+          adminAddr = "admin@hacc.space";
+          extraConfig = ''
+            RewriteEngine On
+            RewriteRule ^/?wiki(/.*)?$ %{DOCUMENT_ROOT}/index.php [L]
+            RewriteRule ^/*$ %{DOCUMENT_ROOT}/index.php [L]
+          '';
+        };
+      };
+    };
+  };
+
+  services.nginx.virtualHosts."wiki.lantifa.org" = {
+    locations."/".proxyPass = "http://[" + config.containers.lantifa.localAddress6 + "]";
+    forceSSL = true;
+    enableACME = true;
+  };
+}

hosts/hainich/services/mail.nix

@@ -0,0 +1,167 @@
+{ config, pkgs, lib, ... }:
+
+let
+    sources = import ../../../nix/sources.nix;
+in {
+  imports = [
+      sources.nixos-mailserver.outPath
+  ];
+
+  mailserver = {
+    mailDirectory = "/data/mail";
+    enable = true;
+    fqdn = "mail.hacc.space";
+    domains = [ "hacc.space" "hacc.earth" "4future.dev" "4futu.re" "infra4future.de" "discuss.infra4future.de" "lists.hacc.space" "lists.infra4future.de" ];
+
+    loginAccounts = {
+        "hexchen@hacc.space" = {
+            hashedPassword = "$6$x9skYtRp4dgxC$1y8gPC2BuVqG3kJVSMGgzZv0Bg1T9qxcnBWLIDbANy1d//SQ23Y7s3IMYcEPd1/l/MYWD9Y/Qse6HbT5w5Xwq/";
+
+            aliases = [
+                "postmaster@hacc.space"
+                "abuse@hacc.space"
+            ];
+        };
+
+        "octycs@hacc.space" = {
+            hashedPassword = "$6$KceTivtJ$58jxhYF6ULfivNsb3Z0J7PnGea0Hs2wTWh3c9FrKRIAmuOD96u2IDgZRCn6P5NrXA0BL.n6HC2RS3r.4JnOmg.";
+
+            aliases = [
+                "markus@hacc.space"
+            ];
+        };
+
+        "raphael@hacc.space" = {
+            hashedPassword = "$6$QveHpwMcp9mkFVAU$EFuahOrJIxPg.c.WGFHtrP3.onwJYwvP7fiBHHGb9jhosewZ2tEUP.2D3uyDLhd9Cfny6Yp4jDk/Hkjk7/ME1/";
+        };
+
+        "engelsystem@hacc.space" = {
+            hashedPassword = "$6$5cIAEhJ7af7M$eJBPQc3ONd.N3HKPFpxfG7liZbUXPvWuSpWVgeG7rmsG7f7.Zdxtodvt5VaXoA3AEiv3GqcY.gKHISK/Gg0ib/";
+        };
+
+        "schweby@hacc.space" = {
+            hashedPassword = "$6$BpYhwcZNrkLhVqK$6FMqA/vUkdV4GBlHLSqS5DRCb/CaLDNeIsBcZ8G30heytS/tJj2Ag7b1ovSltTA4PUfhee3pJrz1BkwkA93vN1";
+        };
+
+        "zauberberg@hacc.space" = {
+            hashedPassword = "$6$ISAaU8X6D$oGKe9WXDWrRpGzHUTdxrxdtg9zuGOlBMuDc82IZhegpsv1bqd550FhZZrI40IjZTA5Hy2MZ8j/0efpnQ4fOQH0";
+            aliases = [
+                "lukas@hacc.space"
+            ];
+        };
+
+        "talx@hacc.space" = {
+            hashedPassword = "$6$0hIKRoMJS./JSE$tXizRgphhNM3ZYx216VdRv1OiyZoYXsjGqSudTDu8vB8eZb03Axi31VKV87RXiEGGixdvTsHEKpx032aOzzt31";
+        };
+
+        "unms@hacc.space" = {
+            hashedPassword = "$6$pYlNP37913$sGE3L722ceP.1Qm5lsffYUN919hPP1xRTrzco3ic3Op21iiknBkOY04eY2l3Um/Bpk/yV89aJD0eaB/5RCbWR1";
+        };
+
+        "noreply@hacc.space" = {
+            hashedPassword = "$6$YsqMoItITZUzI5wo$5Lejf8XBHRx4LW4VuZ9wJCiBbT4kOV/EZaCdWQ07eVIrkRTZwXWZ5zfsh.olXEFwvpNWN.DBnU.dQc.cC0/ra/";
+        };
+        "stuebinm@hacc.space" = {
+            hashedPassword = "$6$mjrMQG5smqLRlm$WzmbiZnGlEXGT7hj/n2qz0nvVzGyZfMToCyLRi0wErfVEHI7y7jtWoHqIWnpcHAM29UocsIFFsUCb3XqQCwwB.";
+        };
+        "newsletter@hacc.space" = {
+            hashedPassword = "$6$f0xKnQxBInd$zbVIi1lTKWauqW.c8sMNLHNwzn81oQrVOiIfJwPa98n9xWz/NkjuWLYuFpK.MSZwNwP7Yv/a/qaOb9v8qv/.N1";
+        };
+        "lenny@hacc.space" = {
+            hashedPassword = "$6$dR.lhYiJDpsR4.dw$n7bCbyTm97v/O8Ue44n58YwOmmct..Gt5TeAmen8C5FWyPTwTh65XCjwc27gNFVGnZLwsRJwMJ.E9D0oJEzUh0";
+        };
+
+        # service accounts
+        "gitlab@infra4future.de".hashedPassword = "$6$8vvkYuxv$9xV5WktsqfgM3cWSxonjtaohm7oqvDC5qsgJCJBATwesjTRxd/QTLa7t7teK8Nzyl.Py26xz.NvYowCZQ4aBE1";
+        "noreply@infra4future.de".hashedPassword = "$6$uaD8bRcT1$gFqhFyu5RUsyUUOG5b.kN.JAJ1rVHvaYhpeRHoMvrERAMgBu1FHu2oDnjTsy.5NKoLc5xpI5uv4Gpy4YbmDmV.";
+        "discuss@infra4future.de".hashedPassword = "$6$8x8/OlMFjq1$S54jdBh7WjrdC6UtbYAHHzMJak7Ai/CjwmWBBbqh7yRHuZt.mfZrsfBNiL3JKBHE7seQ7JYRU99lJKCU6Aujg/";
+    };
+
+    extraVirtualAliases = {
+        # address = forward address;
+        "info@hacc.space" = [
+            "hexchen@hacc.space"
+            "octycs@hacc.space"
+            "raphael@hacc.space"
+            "schweby@hacc.space"
+            "zauberberg@hacc.space"
+            "stuebinm@hacc.space"
+            "lenny@hacc.space"
+        ];
+        "himmel@hacc.space" = [
+            "hexchen@hacc.space"
+            "schweby@hacc.space"
+            "zauberberg@hacc.space"
+        ];
+        "admin@hacc.space" = [
+            "schweby@hacc.space"
+            "zauberberg@hacc.space"
+        ];
+        "voc@hacc.space" = [
+            "hexchen@hacc.space"
+            "schweby@hacc.space"
+            "octycs@hacc.space"
+            "stuebinm@hacc.space"
+            "zauberberg@hacc.space"
+            "lenny@hacc.space"
+        ];
+        "vorstand@hacc.space" = [
+            "raphael@hacc.space"
+            "schweby@hacc.space"
+            "zauberberg@hacc.space"
+        ];
+        "mitglieder@hacc.space" = [
+            "raphael@hacc.space"
+            "schweby@hacc.space"
+            "zauberberg@hacc.space"
+            "lenny@hacc.space"
+            "octycs@hacc.space"
+        ];
+    };
+
+    # Use Let's Encrypt certificates. Note that this needs to set up a stripped
+    # down nginx and opens port 80.
+    certificateScheme = 3;
+
+    # Enable IMAP and POP3
+    enableImap = true;
+    enablePop3 = true;
+    enableImapSsl = true;
+    enablePop3Ssl = true;
+
+    # Enable the ManageSieve protocol
+    enableManageSieve = true;
+
+    # whether to scan inbound emails for viruses (note that this requires at least
+    # 1 Gb RAM for the server. Without virus scanning 256 MB RAM should be plenty)
+    virusScanning = false;
+  };
+  services.postfix.submissionOptions.smtpd_sender_restrictions = "reject_non_fqdn_sender,reject_unknown_sender_domain,permit";
+  services.postfix.submissionsOptions.smtpd_sender_restrictions = "reject_non_fqdn_sender,reject_unknown_sender_domain,permit";
+  services.postfix.virtual = ''
+    @4future.dev @hacc.space
+    @4futu.re @hacc.space
+    @hacc.earth @hacc.space
+    @discuss.infra4future.de discuss@infra4future.de
+    admin@infra4future.de admin@hacc.space
+    noreply@infra4future.de admin@hacc.space
+    lukas@infra4future.de zauberberg@hacc.space
+    info@infra4future.de admin@hacc.space
+    postmaster@infra4future.de admin@hacc.space
+    voc@infra4future.de admin@hacc.space
+    haccvoc@infra4future.de admin@hacc.space
+    contact@hacc.space info@hacc.space
+  '';
+
+  systemd.services.alps = {
+    enable = true;
+    script = "${pkgs.alps}/bin/alps -theme alps imaps://mail.hacc.space:993 smtps://mail.hacc.space:465";
+    serviceConfig.WorkingDirectory = "${pkgs.alps}/share/alps";
+  };
+
+  services.nginx.virtualHosts."mail.hacc.space" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/".proxyPass = "http://[::1]:1323";
+  };
+}

hosts/hainich/services/murmur.nix

@@ -0,0 +1,32 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.murmur = {
+    enable = true;
+    logDays = -1;
+    welcometext = "Welcome to mumble4future! Brought to you by infra4future. The server is now reachable under mumble.hacc.space, please update your bookmarks.";
+    sslKey = "/var/lib/acme/mumble.hacc.space/key.pem";
+    sslCert = "/var/lib/acme/mumble.hacc.space/fullchain.pem";
+    bandwidth = 128000;
+
+  };
+
+  networking.firewall.allowedTCPPorts = [ config.services.murmur.port ];
+  networking.firewall.allowedUDPPorts = [ config.services.murmur.port ];
+
+  services.nginx.virtualHosts =
+    let vhost = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "https://infra4future.4future.dev/mumble.infra4future.de/";
+          };
+        };
+    in {
+      "mumble.infra4future.de" = vhost;
+      "mumble.hacc.space" = vhost;
+    };
+
+  # set ACLs so that the murmur user can read the certificates
+  security.acme.certs."mumble.hacc.space".postRun = "setfacl -Rm u:murmur:rX /var/lib/acme/mumble.hacc.space";
+}

hosts/hainich/services/nginx.nix

@@ -0,0 +1,61 @@
+{ config, lib, pkgs, ... }:
+
+{
+  security.acme.acceptTerms = true;
+  security.acme.email = "info+acme@hacc.space";
+  services.nginx.enable = true;
+  services.nginx.package = pkgs.nginx.override {
+    modules = [ pkgs.nginxModules.rtmp ];
+  };
+
+# services.nginx.recommendedProxySettings = true;
+
+  services.nginx.virtualHosts = let
+    rc3clustersite = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/".proxyPass = "https://stuebinm.4future.dev/about-future-website/";
+    };
+  in {
+    "hainich.chaoswit.ch" = {
+      enableACME = true;
+      forceSSL = true;
+    };
+    "hainich.hacc.space" = {
+      enableACME = true;
+      forceSSL = true;
+      locations = {
+        "/" = {
+          return = "404";
+        };
+      };
+    };
+    "freedom.rc3.io" = rc3clustersite;
+    "future.rc3.io" = rc3clustersite;
+  };
+
+  networking.firewall.allowedTCPPorts = [ 1935 ];
+  services.nginx.appendConfig = ''
+  rtmp {
+    server {
+      listen 1935;
+      application cutiestream {
+        live on;
+        allow publish all;
+        allow play all;
+      }
+      application ingest {
+        live on;
+
+        record all;
+        record_path /data/ingest;
+        record_unique on;
+
+        include /var/secrets/ingest.conf;
+      }
+    }
+  }
+  '';
+
+  systemd.services.nginx.serviceConfig.ReadWriteDirectories = "/data/ingest /var/secrets";
+}

hosts/hainich/services/sympa.nix

@@ -0,0 +1,14 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.sympa = {
+	  enable = true;
+    mta.type = "none";
+	  lang = "de";
+	  domains."lists.infra4future.de".webHost = "lists.infra4future.de";
+	  domains."lists.hacc.space".webHost = "lists.hacc.space";
+	  listMasters = [ "postmaster@hacc.space" ];
+	  mainDomain = "lists.infra4future.de";
+  };
+
+}

hosts/hainich/services/syncthing.nix

@@ -0,0 +1,30 @@
+{ config, lib, pkgs, ... }:
+{
+  services.syncthing = {
+    enable = true;
+    relay.enable = false;
+    openDefaultPorts = true;
+    declarative = {
+      devices = {
+        txsbcct = {
+          addresses = []; # empty = dynamic
+          id = "A6SRBZL-CP627PX-4QA55B7-QKJXOMO-UJDXQIV-77OK57V-RXO3CUQ-JIHX7AC";
+        };
+       };
+
+      folders = {
+        "/var/lib/syncthing/hacc" = {
+          id = "qt2ly-xvvvs";
+          devices = [ "txsbcct" ];
+          type = "receiveonly";
+          versioning = {
+            type = "simple";
+            params.keep = "10";
+          };
+        };
+      };
+
+    };
+
+  };
+}

hosts/hainich/wireguard.nix

@@ -0,0 +1,34 @@
+{ config, lib, pkgs, ... }:
+{
+  systemd.services.wireguard-upstream = {
+    wants = [ "wg-upstream-key.service" ];
+    after = [ "wg-upstream-key.service" ];
+  };
+  networking.wireguard.interfaces.upstream = {
+    ips = [ "2a0d:eb04:8:ffff:2::2/128" ];
+    generatePrivateKeyFile = true;
+    privateKeyFile = "/etc/wireguard/upstream.key";
+    listenPort = 51820;
+    peers = [
+      {
+        allowedIPs = [ "::/0" ];
+        endpoint = "103.105.50.220:51823";
+        publicKey = "qL5xKnQ7xLbtTvu0VmLBwHExteJBhmCe5S/0ZoXBeXY=";
+      }
+    ];
+    postSetup = ''
+    ${pkgs.iproute}/bin/ip addr del dev upstream 2a0d:eb04:8:ffff:2::2/128
+    ${pkgs.iproute}/bin/ip addr add dev upstream 2a0d:eb04:8:ffff:2::2/128 peer 2a0d:eb04:8:ffff:2::1/128
+    '';
+  };
+  networking.interfaces.lo.ipv6 = {
+    addresses = [{
+      address = "2a0d:eb04:8:10::1";
+      prefixLength = 128;
+    }];
+  };
+  networking.defaultGateway6 = {
+    address = "2a0d:eb04:8:ffff:2::1";
+    interface = "upstream";
+  };
+}

hosts/nixda/configuration.nix

@@ -0,0 +1,51 @@
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-config.nix
+      ../../common
+      ../../desktop
+      ../../desktop/streaming.nix
+      ../../desktop/gnome.nix
+    ];
+
+  boot.loader.grub ={
+    enable = true;
+    version = 2;
+    efiSupport = true;
+    device = "nodev";
+  };
+  boot.loader.efi = {
+    canTouchEfiVariables = true;
+    efiSysMountPoint = "/boot";
+  };
+
+  hardware.decklink.enable = true;
+
+  networking.hostName = "nixda"; # Define your hostname.
+
+  environment.systemPackages = with pkgs; [ blackmagicDesktopVideo blender ];
+
+  networking.wg-quick.interfaces.cornbox = {
+    privateKeyFile = "/etc/wireguard/cornbox.key";
+    address = [ "195.39.247.67/28" "2a0f:4ac0:1337::12/64" ];
+    postUp = "ip link set dev cornbox mtu 1400";
+    peers = [
+      {
+        allowedIPs = [ "2a0f:4ac0:1337::/48" "195.39.247.64/27" ];
+        publicKey = "8IWyiQL3wKP9CD/4UdS9b8mcbL67mkUyeSPORgEPvV0=";
+        endpoint = "cornbox.hetzner.chaoswit.ch:51821";
+      }
+    ];
+  };
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "20.09"; # Did you read the comment?
+
+}

hosts/nixda/hardware-config.nix

@@ -0,0 +1,31 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "nvme" "ehci_pci" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/dfbfee26-c2c0-4c0c-b145-6362c7650ac9";
+      fsType = "btrfs";
+      options = [ "subvol=@nix" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-uuid/dfbfee26-c2c0-4c0c-b145-6362c7650ac9";
+      fsType = "btrfs";
+      options = [ "subvol=@home" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/A358-97BC";
+      fsType = "vfat";
+    };
+
+  swapDevices = [ ];
+}

modules/bindmounts.nix

@@ -1,28 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let cfg = config.hacc;
-
-in {
-
-  options.hacc.bindMounts = mkOption {
-    type = types.attrsOf types.str;
-    default = { };
-    example = { "/etc/asdf" = "/persist/asdf"; };
-  };
-  options.hacc.bindToPersist = mkOption {
-    type = types.listOf types.str;
-    default = [];
-    example = [ "postgres" ];
-  };
-
-  config.fileSystems = mapAttrs (_: device: {
-    inherit device;
-    options = [ "bind" ];
-  }) cfg.bindMounts;
-
-  config.hacc.bindMounts = listToAttrs
-    (map (name: { inherit name; value = "/persist${name}"; })
-      cfg.bindToPersist);
-}

modules/buildinfo.nix

@@ -1,29 +0,0 @@
-{ config, lib, pkgs, sources, ... }:
-
-let
-  self = sources.self;
-
-  formatDate = date: with lib.strings;
-    let
-      year = substring 0 4 date;
-      month = substring 4 2 date;
-      day = substring 6 2 date;
-      hour = substring 8 2 date;
-      minute = substring 10 2 date;
-      second = substring 12 2 date;
-    in
-      "${year}-${month}-${day} ${hour}:${minute}:${second} UTC";
-in
-{
-  system.nixos.label = "${config.system.nixos.release}-haccfiles-${self.shortRev or self.dirtyShortRev}";
-  users.motd = ''
-    Welcome to ${config.networking.hostName}, running NixOS ${config.system.nixos.release}!
-    Built from haccfiles ${self.rev or self.dirtyRev}.
-    Last commit was at ${formatDate self.lastModifiedDate}.
-    ${if self ? dirtyRev then "\nPlease remember to commit your changes.\n" else ""}
-  '';
-
-  # used by monit
-  environment.etc."haccfiles-commit".text = self.rev or self.dirtyRev;
-  environment.etc."haccfiles-timestamp".text = builtins.toString self.lastModified;
-}

modules/container-profile.nix

@@ -1,18 +0,0 @@
-{ lib, ...}:
-
-{
-  boot.isContainer = true;
-  networking.useDHCP = false;
-  users.users.root.hashedPassword = "";
-  networking.firewall.enable = false;
-  services.coredns = {
-    enable = true;
-    config = ''
-    .:53 {
-      forward . 1.1.1.1
-    }
-    '';
-  };
-
-  system.stateVersion = lib.mkDefault "21.05";
-}

modules/containers.nix

@@ -1,95 +0,0 @@
-{ config, lib, pkgs, modules, profiles, sources, nixosSystem, ... }:
-
-let
-  mkIPv4 = index: local:
-    "192.168.${if local then "100" else "101"}.${toString index}";
-  mkIPv6 = index: local:
-    "fd00::${if local then "100" else "101"}:${toString index}";
-
-  evalConfig = nixosConfig: (nixosSystem {
-    inherit (config.nixpkgs) system;
-    modules = [
-      nixosConfig
-      modules.nopersist
-      profiles.container
-      { nixpkgs.pkgs = lib.mkForce pkgs; }
-    ];
-    specialArgs = {
-      inherit modules sources;
-    };
-  }).config.system.build.toplevel;
-
-in {
-  options.hacc.containers = with lib.options;
-    mkOption {
-      description = ''
-        hacc-specific containers. These are a thin wrapper around "normal" nixos containers:
-          - they automatically get an IPv4/IPv6 address assigned
-            (note that these are not guaranteed to be stable across config changes,
-            so please use {option}`containers.<name>.hostAddress` & friends to
-            reference them elsewhere)
-          - they set a couple default options (e.g. ephemeral, autoStart, privateNetwork)
-          - they are evaluated with our own version of {nix}`evalConfig`, which includes a
-            couple more modules by default, use our version of `nixpkgs`, and includes the
-            {nix}`profiles.containers` profile setting sane defaults for containers.
-      '';
-      default = { };
-      type = with lib.types;
-        types.attrsOf (types.submodule {
-          options = {
-            bindToPersist = mkOption {
-              default = true;
-              type = types.bool;
-              description =
-                "Wether to mount /persist/containers/<name> at /persist into this container.";
-            };
-
-            bindSecrets = mkOption {
-              default = false;
-              type = types.bool;
-              description =
-                "Whether to mount /run/secrets/<name> at /secrets into this container.";
-            };
-
-            config = mkOption {
-              type = types.unspecified;
-              description =
-                "The container's config, to be evaluated with our own {nix}`evalConfig`.";
-            };
-          };
-        });
-    };
-
-  # wrapped into imap1, which enumerates the containers; IP addresses are then
-  # simply assigned based on the order the containers are in the list.
-  config.containers = lib.mkMerge (lib.imap1
-    (index: { name, value }: let container = value; in {
-      ${name} = {
-        hostAddress = mkIPv4 index false;
-        localAddress = mkIPv4 index true;
-        hostAddress6 = mkIPv6 index false;
-        localAddress6 = mkIPv6 index true;
-
-        privateNetwork = true;
-        autoStart = true;
-        ephemeral = true;
-
-        bindMounts = lib.mkMerge [
-          (lib.mkIf container.bindToPersist {
-            "/persist" = {
-              hostPath = "/persist/containers/${name}";
-              isReadOnly = false;
-            };
-          })
-          (lib.mkIf container.bindSecrets {
-            "/secrets" = {
-              hostPath = "/run/secrets/${name}";
-              isReadOnly = true;
-            };
-          })
-        ];
-
-        path = evalConfig container.config;
-      };
-    }) (lib.attrsToList config.hacc.containers));
-}

modules/default.nix

@@ -1,7 +1,9 @@
 { ... }:
-
-{
+let
+  sources = import ../nix/sources.nix;
+in {
   imports = [
-    ./websites.nix
+    "${sources.immae-nix}/modules/webapps/peertube.nix"
+    ./nftnat
   ];
 }

modules/encboot.nix

@@ -1,45 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-with lib;
-
-let cfg = config.hacc.encboot;
-
-in {
-  options = {
-    hacc.encboot = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-      };
-      networkDrivers = mkOption { type = with types; listOf str; };
-      dataset = mkOption {
-        type = types.str;
-        default = "zroot";
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    boot.initrd.kernelModules = cfg.networkDrivers;
-
-    boot.initrd.network = {
-      enable = true;
-      ssh = {
-        enable = true;
-        port = 2222;
-        authorizedKeys = with lib;
-          concatLists (mapAttrsToList (name: user:
-            if elem "wheel" user.extraGroups then
-              user.openssh.authorizedKeys.keys
-            else
-              [ ]) config.users.users);
-        hostKeys = [ /etc/ssh/encboot_host ];
-      };
-
-      postCommands = ''
-        zpool import ${cfg.dataset}
-        echo "zfs load-key -a; killall zfs && exit" >> /root/.profile
-      '';
-    };
-  };
-}

modules/nftnat/default.nix

@@ -0,0 +1,62 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.hacc.nftables.nat;
+  nats = config.networking.nat;
+in {
+  options.hacc.nftables.nat = {
+    enable = mkEnableOption "Wrap NAT into nftables.";
+    forwardPorts = mkOption {
+      type = with types; listOf (submodule {
+        options = {
+          ports = mkOption {
+            type = types.listOf (types.either types.int (types.strMatching "[[:digit:]]+-[[:digit:]]+"));
+          };
+          destination = mkOption {
+            type = types.str;
+            example = "10.0.0.1";
+          };
+          proto = mkOption {
+            type = types.str;
+            default = "tcp";
+            example = "udp";
+          };
+        };
+      });
+      default = [];
+      example = [{ ports = [ 8080 "9100-9200" ]; destination = "192.168.100.2"; proto = "udp"; }];
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.nat.enable = mkOverride 99 false;
+
+    boot = {
+      kernelModules = [ "nf_nat_ftp" ];
+      kernel.sysctl = {
+        "net.ipv4.conf.all.forwarding" = mkOverride 98 true;
+        "net.ipv4.conf.default.forwarding" = mkOverride 98 true;
+      };
+    };
+
+    petabyte.nftables = {
+      enable = true;
+
+      extraConfig = ''
+        table ip nat {
+          chain prerouting {
+            type nat hook prerouting priority -100
+            ${concatMapStringsSep "\n" (rule: "iif ${nats.externalInterface} ${rule.proto} dport { ${concatStringsSep ", " (map (x: toString x) rule.ports)} } dnat ${rule.destination}") cfg.forwardPorts}
+          }
+          chain postrouting {
+            type nat hook postrouting priority 100
+            ${concatMapStringsSep "\n" (iface: "iifname ${replaceStrings ["+"] ["*"] iface} oifname ${nats.externalInterface} masquerade") nats.internalInterfaces}
+            ${concatMapStringsSep "\n" (addr: "ip saddr ${addr} oifname ${nats.externalInterface} masquerade") nats.internalIPs}
+          }
+        }
+      '';
+    };
+  };
+}

modules/nopersist.nix

@@ -1,52 +0,0 @@
-{ config, lib, pkgs, modules, ... }:
-
-with lib;
-
-{
-  imports = [ modules.bindMounts ];
-
-  users.mutableUsers = false;
-
-  boot.initrd = mkIf (config.fileSystems."/".fsType or "notzfs" == "zfs") {
-    network.ssh.hostKeys = mkIf config.hacc.encboot.enable
-      (mkForce [ /persist/ssh/encboot_host ]);
-
-    postDeviceCommands = mkIf (!config.boot.initrd.systemd.enable)
-      (mkAfter ''
-        zfs rollback -r ${config.fileSystems."/".device}@blank
-      '');
-
-    systemd = mkIf config.boot.initrd.systemd.enable {
-      storePaths = [ pkgs.zfs ];
-      services.rollback = {
-        description = "Rollback ZFS datasets to a pristine state";
-        wantedBy = [ "initrd.target" ];
-        after = [ "zfs-import-${head (splitString "/" config.fileSystems."/".device)}.service" ];
-        before = [ "sysroot.mount" ];
-        path = [ pkgs.zfs ];
-        unitConfig.DefaultDependencies = "no";
-        serviceConfig.Type = "oneshot";
-        script = ''
-          zfs rollback -r ${config.fileSystems."/".device}@blank && echo "rollback complete"
-        '';
-      };
-    };
-  };
-
-  services.openssh = {
-    hostKeys = [
-      {
-        path = "/persist/ssh/ssh_host_ed25519_key";
-        type = "ed25519";
-      }
-      {
-        path = "/persist/ssh/ssh_host_rsa_key";
-        type = "rsa";
-        bits = 4096;
-      }
-    ];
-  };
-
-  services.postgresql.dataDir =
-    "/persist/postgresql/${config.services.postgresql.package.psqlSchema}";
-}

modules/websites.nix

@@ -1,62 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.hacc.websites;
-in
-
-{
-  options.hacc.websites = {
-    enable = mkOption {
-      type = types.bool;
-      default = false;
-    };
-    directory = mkOption {
-      type = types.path;
-      description = "all subdirectories of the given path are expected to contain a (static) website";
-    };
-    ignore = mkOption {
-      type = types.listOf types.str;
-      default = [];
-      description = "subdirectories that shouldn't be published";
-    };
-    builders = mkOption {
-      type = types.lazyAttrsOf types.package;
-      default = {};
-      description = "exposes website builders, for use with nix run";
-    };
-  };
-
-  config = let
-    subdirs =
-      let dirAttrs = filterAttrs
-        (n: v: v == "directory" || lists.elem n cfg.ignore)
-        (builtins.readDir cfg.directory);
-      in mapAttrsToList (n: v: n) dirAttrs;
-    mkWebsiteDrv = subdir:
-      pkgs.callPackage "${cfg.directory}/${subdir}" {};
-    mkWebsiteVHost = subdir: {
-      name = subdir;
-      # the nginx virtualhost config (for all sites) goes in here
-      value = {
-        enableACME = true;
-        forceSSL = true;
-
-        locations."/".root =
-          (mkWebsiteDrv subdir).outPath;
-      };
-    };
-  in mkIf cfg.enable {
-    services.nginx = {
-      enable = true;
-      virtualHosts =
-        listToAttrs (map mkWebsiteVHost subdirs);
-    };
-    hacc.websites.builders =
-      listToAttrs (map (subdir: {
-        name = subdir;
-        value = if (mkWebsiteDrv subdir) ? watch then (mkWebsiteDrv subdir).watch else null;
-      }) subdirs);
-  };
-}

nix/sources.json

@@ -0,0 +1,77 @@
+{
+    "home-manager": {
+        "branch": "release-20.09",
+        "description": "Manage a user environment using Nix  [maintainer=@rycee] ",
+        "homepage": "https://nix-community.github.io/home-manager/",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "22f6736e628958f05222ddaadd7df7818fe8f59d",
+        "sha256": "1j4hyjd3kgvwym5jjazzyn554ngrm05ca9wl1a7z1bid22asr99p",
+        "type": "tarball",
+        "url": "https://github.com/nix-community/home-manager/archive/22f6736e628958f05222ddaadd7df7818fe8f59d.tar.gz",
+        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
+    },
+    "immae-nix": {
+        "ref": "master",
+        "repo": "https://git.immae.eu/perso/Immae/Config/Nix.git",
+        "rev": "238587099b92027ad780053f0f6217ad88b61ad2",
+        "type": "git"
+    },
+    "niv": {
+        "branch": "master",
+        "description": "Easy dependency management for Nix projects",
+        "homepage": "https://github.com/nmattia/niv",
+        "owner": "nmattia",
+        "repo": "niv",
+        "rev": "94dadba1a3a6a2f0b8ca2963e49daeec5d4e3098",
+        "sha256": "1y2h9wl7w60maa2m4xw9231xdr325xynzpph8xr4j5vsznygv986",
+        "type": "tarball",
+        "url": "https://github.com/nmattia/niv/archive/94dadba1a3a6a2f0b8ca2963e49daeec5d4e3098.tar.gz",
+        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
+    },
+    "nix-hexchen": {
+        "ref": "main",
+        "repo": "https://gitlab.com/hexchen/nixfiles.git",
+        "rev": "412491716b9a64dd4f436d9949cb7c26b669519c",
+        "type": "git"
+    },
+    "nixos-mailserver": {
+        "ref": "nixos-20.09",
+        "repo": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver",
+        "rev": "fb1cc04c0a517d4200237b02c3472bcaf9104afb",
+        "sha256": "0vsvgxxg5cgmzwj98171j7h5l028f1yq784alb3lxgbk8znfk51y",
+        "type": "tarball",
+        "url": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/fb1cc04c0a517d4200237b02c3472bcaf9104afb/nixos-mailserver-fb1cc04c0a517d4200237b02c3472bcaf9104afb.tar.gz",
+        "url_template": "<repo>/-/archive/<rev>.tar.gz"
+    },
+    "nixpkgs": {
+        "branch": "hexchen-20.09",
+        "description": "Nix Packages collection",
+        "homepage": "",
+        "owner": "hexchen",
+        "repo": "nixpkgs",
+        "rev": "4b1f1b356d874eae749f7e0d2d9ce9afbe977a88",
+        "sha256": "0dbhzb1kccsp6qwds93d7kchypj0b0spzkf8jah1lg4vjvxxi2v8",
+        "type": "tarball",
+        "url": "https://github.com/hexchen/nixpkgs/archive/4b1f1b356d874eae749f7e0d2d9ce9afbe977a88.tar.gz",
+        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
+    },
+    "nixpkgs-unstable": {
+        "branch": "hexchen-main",
+        "description": "Nix Packages collection",
+        "homepage": "",
+        "owner": "hexchen",
+        "repo": "nixpkgs",
+        "rev": "9091f350c69d744aad6d9ab5994446bec9a51567",
+        "sha256": "1s8cw7wvnl0liv5rcs882h74lmqh72f01yrdg1h6kg51iwl7swws",
+        "type": "tarball",
+        "url": "https://github.com/hexchen/nixpkgs/archive/9091f350c69d744aad6d9ab5994446bec9a51567.tar.gz",
+        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
+    },
+    "pbb-nixfiles": {
+        "ref": "main",
+        "repo": "https://git.petabyte.dev/petabyteboy/nixfiles.git",
+        "rev": "0720c5dba283d782f2f887bf97aad339137d95dc",
+        "type": "git"
+    }
+}

nix/sources.nix

@@ -0,0 +1,148 @@
+# This file has been generated by Niv.
+
+let
+
+  #
+  # The fetchers. fetch_<type> fetches specs of type <type>.
+  #
+
+  fetch_file = pkgs: spec:
+    if spec.builtin or true then
+      builtins_fetchurl { inherit (spec) url sha256; }
+    else
+      pkgs.fetchurl { inherit (spec) url sha256; };
+
+  fetch_tarball = pkgs: name: spec:
+    let
+      ok = str: ! builtins.isNull (builtins.match "[a-zA-Z0-9+-._?=]" str);
+      # sanitize the name, though nix will still fail if name starts with period
+      name' = stringAsChars (x: if ! ok x then "-" else x) "${name}-src";
+    in
+      if spec.builtin or true then
+        builtins_fetchTarball { name = name'; inherit (spec) url sha256; }
+      else
+        pkgs.fetchzip { name = name'; inherit (spec) url sha256; };
+
+  fetch_git = spec:
+    builtins.fetchGit { url = spec.repo; inherit (spec) rev ref; };
+
+  fetch_local = spec: spec.path;
+
+  fetch_builtin-tarball = name: throw
+    ''[${name}] The niv type "builtin-tarball" is deprecated. You should instead use `builtin = true`.
+        $ niv modify ${name} -a type=tarball -a builtin=true'';
+
+  fetch_builtin-url = name: throw
+    ''[${name}] The niv type "builtin-url" will soon be deprecated. You should instead use `builtin = true`.
+        $ niv modify ${name} -a type=file -a builtin=true'';
+
+  #
+  # Various helpers
+  #
+
+  # The set of packages used when specs are fetched using non-builtins.
+  mkPkgs = sources:
+    let
+      sourcesNixpkgs =
+        import (builtins_fetchTarball { inherit (sources.nixpkgs) url sha256; }) {};
+      hasNixpkgsPath = builtins.any (x: x.prefix == "nixpkgs") builtins.nixPath;
+      hasThisAsNixpkgsPath = <nixpkgs> == ./.;
+    in
+      if builtins.hasAttr "nixpkgs" sources
+      then sourcesNixpkgs
+      else if hasNixpkgsPath && ! hasThisAsNixpkgsPath then
+        import <nixpkgs> {}
+      else
+        abort
+          ''
+            Please specify either <nixpkgs> (through -I or NIX_PATH=nixpkgs=...) or
+            add a package called "nixpkgs" to your sources.json.
+          '';
+
+  # The actual fetching function.
+  fetch = pkgs: name: spec:
+
+    if ! builtins.hasAttr "type" spec then
+      abort "ERROR: niv spec ${name} does not have a 'type' attribute"
+    else if spec.type == "file" then fetch_file pkgs spec
+    else if spec.type == "tarball" then fetch_tarball pkgs name spec
+    else if spec.type == "git" then fetch_git spec
+    else if spec.type == "local" then fetch_local spec
+    else if spec.type == "builtin-tarball" then fetch_builtin-tarball name
+    else if spec.type == "builtin-url" then fetch_builtin-url name
+    else
+      abort "ERROR: niv spec ${name} has unknown type ${builtins.toJSON spec.type}";
+
+  # If the environment variable NIV_OVERRIDE_${name} is set, then use
+  # the path directly as opposed to the fetched source.
+  replace = name: drv:
+    let
+      saneName = stringAsChars (c: if isNull (builtins.match "[a-zA-Z0-9]" c) then "_" else c) name;
+      ersatz = builtins.getEnv "NIV_OVERRIDE_${saneName}";
+    in
+      if ersatz == "" then drv else ersatz;
+
+  # Ports of functions for older nix versions
+
+  # a Nix version of mapAttrs if the built-in doesn't exist
+  mapAttrs = builtins.mapAttrs or (
+    f: set: with builtins;
+    listToAttrs (map (attr: { name = attr; value = f attr set.${attr}; }) (attrNames set))
+  );
+
+  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295
+  range = first: last: if first > last then [] else builtins.genList (n: first + n) (last - first + 1);
+
+  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L257
+  stringToCharacters = s: map (p: builtins.substring p 1 s) (range 0 (builtins.stringLength s - 1));
+
+  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L269
+  stringAsChars = f: s: concatStrings (map f (stringToCharacters s));
+  concatStrings = builtins.concatStringsSep "";
+
+  # fetchTarball version that is compatible between all the versions of Nix
+  builtins_fetchTarball = { url, name, sha256 }@attrs:
+    let
+      inherit (builtins) lessThan nixVersion fetchTarball;
+    in
+      if lessThan nixVersion "1.12" then
+        fetchTarball { inherit name url; }
+      else
+        fetchTarball attrs;
+
+  # fetchurl version that is compatible between all the versions of Nix
+  builtins_fetchurl = { url, sha256 }@attrs:
+    let
+      inherit (builtins) lessThan nixVersion fetchurl;
+    in
+      if lessThan nixVersion "1.12" then
+        fetchurl { inherit url; }
+      else
+        fetchurl attrs;
+
+  # Create the final "sources" from the config
+  mkSources = config:
+    mapAttrs (
+      name: spec:
+        if builtins.hasAttr "outPath" spec
+        then abort
+          "The values in sources.json should not have an 'outPath' attribute"
+        else
+          spec // { outPath = replace name (fetch config.pkgs name spec); }
+    ) config.sources;
+
+  # The "config" used by the fetchers
+  mkConfig =
+    { sourcesFile ? if builtins.pathExists ./sources.json then ./sources.json else null
+    , sources ? if isNull sourcesFile then {} else builtins.fromJSON (builtins.readFile sourcesFile)
+    , pkgs ? mkPkgs sources
+    }: rec {
+      # The sources, i.e. the attribute set of spec name to spec
+      inherit sources;
+
+      # The "pkgs" (evaluated nixpkgs) to use for e.g. non-builtin fetchers
+      inherit pkgs;
+    };
+
+in
+mkSources (mkConfig {}) // { __functor = _: settings: mkSources (mkConfig settings); }

parsons/configuration.nix

@@ -1,93 +0,0 @@
-{ config, lib, pkgs, sources, modules, ... }:
-
-{
-  imports = [
-    ../common
-    ./hardware.nix
-    modules.encboot
-    modules.nopersist
-    ./nftables.nix
-    ./nextcloud.nix
-    ./mattermost.nix
-    ./murmur.nix
-    ./hedgedoc-hacc.nix
-    ./hedgedoc-i4f.nix
-    ./mail.nix
-    ./forgejo.nix
-    ./nginx-pages.nix
-    ./vaultwarden.nix
-    ./tracktrain.nix
-    ./uffd.nix
-    ./lxc.nix
-    ./monit.nix
-  ];
-
-  hacc.bindToPersist = [ "/var/lib/acme" ];
-
-  hacc.encboot = {
-    enable = true;
-    dataset = "-a";
-    networkDrivers = [ "igb" ];
-  };
-
-  sops.defaultSopsFile = ../secrets.yaml;
-  sops.age.sshKeyPaths = [ "/persist/ssh/ssh_host_ed25519_key" ];
-
-  boot.loader.grub.enable = true;
-  boot.loader.grub.devices = [ "/dev/nvme0n1" "/dev/nvme1n1" ];
-  boot.supportedFilesystems = [ "zfs" ];
-
-  networking.hostId = "b2867696";
-  networking.useDHCP = true;
-  networking.nftables.enable = true;
-
-  networking.hostName = "parsons";
-
-  networking.interfaces.enp35s0.ipv6.addresses = [{
-    address = "2a01:4f9:3a:2ddb::1";
-    prefixLength = 64;
-  }];
-  networking.defaultGateway6 = {
-    address = "fe80::1";
-    interface = "enp35s0";
-  };
-
-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    virtualHosts = {
-      "parsons.hacc.space" = {
-        default = true;
-        locations."/".return = "404";
-      };
-      "hacc.space" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/".return = "302 https://hacc.earth";
-      };
-    };
-  };
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
-  services.restic.backups.tardis = {
-    passwordFile = "/run/secrets/restic/system";
-    environmentFile = "/run/secrets/restic/s3creds.env";
-    paths = [
-      "/home"
-      "/persist"
-    ];
-    pruneOpts = [
-      "--keep-daily 7"
-      "--keep-weekly 5"
-      "--keep-monthly 3"
-    ];
-    repository = "b2:tardis-parsons:system";
-  };
-
-  sops.secrets = {
-    "restic/system" = {};
-    "restic/s3creds.env" = {};
-  };
-
-  system.stateVersion = "21.05";
-}

parsons/forgejo.nix

@@ -1,86 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  hacc.containers.forgejo = {
-    config = { lib, pkgs, ... }: {
-      system.stateVersion = "21.11";
-
-      environment.systemPackages = [ pkgs.forgejo ];
-
-      hacc.bindMounts."/var/lib/forgejo" = "/persist/forgejo";
-
-      services.forgejo = {
-        enable = true;
-        package = pkgs.forgejo;
-        lfs.enable = true;
-        database.type = "postgres";
-        settings = {
-          repository = {
-            DEFAULT_PRIVATE = "public";
-            PREFERRED_LICENSES = "Unlicense";
-            DEFAULT_BRANCH = "main";
-          };
-          oauth2_client = {
-            ACCOUNT_LINKING = "auto";
-            ENABLE_AUTO_REGISTRATION = true;
-          };
-          "repository.pull-requests" = {
-            DEFAULT_MERGE_STYLE = "merge";
-            DEFAULT_MERGE_MESSAGE_ALL_AUTHORS = true;
-          };
-          "repository.upload".FILE_MAX_SIZE = 1024;
-          server = {
-            LANDING_PAGE = "explore";
-            OFFLINE_MODE = true;
-            ROOT_URL = "https://git.infra4future.de";
-            HTTP_PORT = 3000;
-            HTTP_ADDR = "0.0.0.0";
-          };
-          security = { INSTALL_LOCK = true; };
-          other = {
-            SHOW_FOOTER_VERSION = false;
-            SHOW_FOOTER_TEMPLATE_LOAD_TIME = false;
-          };
-          cron = {
-            ENABLED = true;
-            NOTICE_ON_SUCCESS = true;
-          };
-          "cron.update_mirrors" = {
-            SCHEDULE = "@every 12h";
-            PULL_LIMIT = "-1";
-            PUSH_LIMIT = "-1";
-          };
-          "cron.git_gc_repos".ENABLED = true;
-          "cron.delete_old_actions".ENABLED = true;
-          log.LEVEL = "Info";
-          service.DISABLE_REGISTRATION = true;
-          session.COOKIE_SECURE = true;
-          default.APP_NAME = "0x0: git for all creatures";
-        };
-      };
-      services.postgresql.package = pkgs.postgresql_15;
-
-      services.postgresqlBackup = {
-        enable = true;
-        databases = [ "forgejo" ];
-        startAt = "*-*-* 23:45:00";
-        location = "/persist/backups/postgres";
-      };
-      services.openssh = {
-        enable = true;
-        settings = {
-          PasswordAuthentication = false;
-          AcceptEnv = "GIT_PROTOCOL";
-        };
-      };
-    };
-  };
-
-  services.nginx.virtualHosts."git.infra4future.de" = {
-    forceSSL = true;
-    enableACME = true;
-    locations."/" = {
-      proxyPass = "http://${config.containers.forgejo.localAddress}:3000";
-    };
-  };
-}

parsons/hardware.nix

@@ -1,61 +0,0 @@
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "zroot/local/root";
-      fsType = "zfs";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/daf2a731-952f-45c7-9c25-49e1a2f56062";
-      fsType = "ext4";
-    };
-
-  fileSystems."/nix" =
-    { device = "zroot/local/nix";
-      fsType = "zfs";
-    };
-
-  fileSystems."/persist" =
-    { device = "zroot/safe/persist";
-      fsType = "zfs";
-      neededForBoot = true;
-    };
-
-  fileSystems."/home" =
-    { device = "zroot/safe/home";
-      fsType = "zfs";
-    };
-
-  fileSystems."/root" =
-    { device = "zroot/safe/root";
-      fsType = "zfs";
-    };
-
-  fileSystems."/var/cache/restic-backups-tardis" =
-    { device = "zroot/safe/restic-cache";
-      fsType = "zfs";
-    };
-
-  fileSystems."/tmp" =
-    { device = "zroot/local/tmp";
-      fsType = "zfs";
-    };
-
-  fileSystems."/persist/data" =
-    { device = "dpool/safe/data";
-      fsType = "zfs";
-    };
-
-  swapDevices = [ ];
-
-}

parsons/hedgedoc-hacc.nix

@@ -1,91 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-
-  sops.secrets = {
-    "hedgedoc-hacc/env" = {};
-  };
-
-  containers.pad-hacc.bindMounts = {
-    "/secrets".hostPath = "/run/secrets/hedgedoc-hacc";
-  };
-  hacc.containers.pad-hacc = {
-    config = { config, lib, ... }: {
-      services.hedgedoc = {
-        enable = true;
-        settings = {
-          allowAnonymous = true;
-          allowFreeURL = true;
-          allowGravatar = false;
-          allowOrigin = [ "localhost" "pad.hacc.space" "fff-muc.de" ];
-          db = {
-            host = "/run/postgresql";
-            username = "codimd";
-            dialect = "postgres";
-            database = "codimd";
-          };
-          defaultPermission = "limited";
-          domain  = "pad.hacc.space";
-          host = "0.0.0.0";
-          protocolUseSSL = true;
-          hsts.preload = false;
-          email = false;
-          oauth2 = {
-            authorizationURL = "https://login.infra4future.de/oauth2/authorize";
-            tokenURL = "https://login.infra4future.de/oauth2/token";
-            clientID = "hedgedoc";
-            # must be set to make the NixOS module happy, but env var takes precedence
-            clientSecret = "lol nope";
-          };
-        };
-        environmentFile = "/secrets/env";
-      };
-      systemd.services.hedgedoc.environment = {
-        "CMD_LOGLEVEL" = "warn";
-        "CMD_OAUTH2_USER_PROFILE_URL" = "https://login.infra4future.de/oauth2/userinfo";
-        "CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR" = "nickname";
-        "CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR" = "name";
-        "CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR" = "email";
-        "CMD_OAUTH2_PROVIDERNAME" = "Infra4Future";
-      };
-
-      services.postgresql = {
-        enable = true;
-        ensureDatabases = [ "codimd" ];
-        ensureUsers = [{
-          name = "codimd";
-          ensureDBOwnership = true;
-        }];
-        authentication = ''
-          local all all trust
-          host  codimd  codimd  127.0.0.1/32  trust
-        '';
-        package = pkgs.postgresql_15;
-      };
-      services.postgresqlBackup = {
-        enable = true;
-        databases = [ "codimd" ];
-        startAt = "*-*-* 23:45:00";
-        location = "/persist/backups/postgres";
-      };
-      hacc.bindToPersist = [ "/var/lib/hedgedoc" ];
-    };
-  };
-  services.nginx.virtualHosts."pad.hacc.earth" = {
-    enableACME = true;
-    forceSSL = true;
-    globalRedirect = "pad.hacc.space";
-  };
-
-  services.nginx.virtualHosts."pad.hacc.space" = {
-    forceSSL = true;
-    enableACME = true;
-    locations."/" = {
-      proxyPass = "http://${config.containers.pad-hacc.localAddress}:3000";
-      extraConfig = ''
-        add_header Access-Control-Allow-Origin "*";
-        proxy_buffering off;
-      '';
-    };
-  };
-}

parsons/hedgedoc-i4f.nix

@@ -1,63 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  hacc.containers.pad-i4f = {
-    config = { config, lib, ... }: {
-      services.hedgedoc = {
-        enable = true;
-        settings = {
-          allowAnonymous = true;
-          allowFreeURL = true;
-          allowGravatar = false;
-          allowOrigin = [ "localhost" "pad.infra4future.de" "fff-muc.de" ];
-          db = {
-            host = "/run/postgresql";
-            dialect = "postgres";
-            database = "hedgedoc";
-          };
-          defaultPermission = "freely";
-          domain  = "pad.infra4future.de";
-          host = "0.0.0.0";
-          protocolUseSSL = true;
-          hsts.preload = false;
-          email = false;
-          };
-        };
-      systemd.services.hedgedoc.environment = {
-        "CMD_LOGLEVEL" = "warn";
-      };
-      services.postgresql = {
-        enable = true;
-        package = pkgs.postgresql_15;
-        authentication = ''
-          local all       all                     trust
-          host  hedgedoc  hedgedoc  127.0.0.1/32  trust
-          '';
-        ensureDatabases = [ "hedgedoc" ];
-        ensureUsers = [{
-          name = "hedgedoc";
-          ensureDBOwnership = true;
-        }];
-      };
-      services.postgresqlBackup = {
-        enable = true;
-        databases = [ "hedgedoc" ];
-        startAt = "*-*-* 23:45:00";
-        location = "/persist/backups/postgres";
-      };
-      hacc.bindToPersist = [ "/var/lib/hedgedoc" ];
-    };
-  };
-
-  services.nginx.virtualHosts."pad.infra4future.de" = {
-    forceSSL = true;
-    enableACME = true;
-    locations."/" = {
-      proxyPass = "http://${config.containers.pad-i4f.localAddress}:3000";
-      extraConfig = ''
-        add_header Access-Control-Allow-Origin "*";
-        proxy_buffering off;
-      '';
-    };
-  };
-}

parsons/lxc.nix

@@ -1,29 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  networking.bridges.lxcbr0.interfaces = [];
-  networking.interfaces.lxcbr0.ipv4.addresses = [
-    {
-      address = "10.1.2.1";
-      prefixLength = 24;
-    }
-  ];
-
-  virtualisation.lxc.enable = true;
-  virtualisation.lxc.systemConfig = ''
-    lxc.bdev.zfs.root = zroot/safe/containers/lxc
-    lxc.lxcpath = /persist/lxc
-  '';
-
-  users.users.root.subUidRanges = [{ count = 65536; startUid = 100000; }];
-  users.users.root.subGidRanges = [{ count = 65536; startGid = 100000; }];
-
-  environment.etc."lxc/share".source = "${pkgs.lxc}/share/lxc";
-
-
-  services.nginx.virtualHosts."onlyoffice.infra4future.de" = {
-    locations."/".proxyPass = "http://10.1.2.233:80";
-    enableACME = true;
-    forceSSL = true;
-  };
-}

parsons/mail.nix

@@ -1,208 +0,0 @@
-{ config, options, pkgs, lib, sources, ... }:
-
-{
-  imports = [ sources.nixos-mailserver.outPath ];
-
-  # reduce log spam
-  systemd.services.rspamd.serviceConfig.LogLevelMax =
-    3; # this is set to error because rspamd regularly complains about not enough learns
-  systemd.services.dovecot2.serviceConfig.LogLevelMax = 5; # = notice
-
-  # stop postfix from dying if rspamd hiccups
-  systemd.services.postfix.unitConfig = {
-    Requires = lib.mkForce "dovecot2.service opendkim.service";
-  };
-
-  mailserver = {
-    mailDirectory = "/persist/mail";
-    enable = true;
-    fqdn = "mail.hacc.space";
-    monitoring = {
-      enable = true;
-      alertAddress = "admin@hacc.space";
-    };
-    domains = [
-      "hacc.space"
-      "muc.hacc.space"
-      "hacc.earth"
-      "4future.dev"
-      "4futu.re"
-      "infra4future.de"
-    ];
-
-    loginAccounts = {
-      "hexchen@hacc.space".hashedPassword =
-        "$6$x9skYtRp4dgxC$1y8gPC2BuVqG3kJVSMGgzZv0Bg1T9qxcnBWLIDbANy1d//SQ23Y7s3IMYcEPd1/l/MYWD9Y/Qse6HbT5w5Xwq/";
-
-      "octycs@hacc.space".hashedPassword =
-        "$6$KceTivtJ$58jxhYF6ULfivNsb3Z0J7PnGea0Hs2wTWh3c9FrKRIAmuOD96u2IDgZRCn6P5NrXA0BL.n6HC2RS3r.4JnOmg.";
-      "octycs@hacc.space".aliases = [ "markus@hacc.space" ];
-
-      "raphael@hacc.space".hashedPassword =
-        "$6$QveHpwMcp9mkFVAU$EFuahOrJIxPg.c.WGFHtrP3.onwJYwvP7fiBHHGb9jhosewZ2tEUP.2D3uyDLhd9Cfny6Yp4jDk/Hkjk7/ME1/";
-
-      "moira@hacc.space".hashedPassword =
-        "$6$BpYhwcZNrkLhVqK$6FMqA/vUkdV4GBlHLSqS5DRCb/CaLDNeIsBcZ8G30heytS/tJj2Ag7b1ovSltTA4PUfhee3pJrz1BkwkA93vN1";
-
-      "zauberberg@hacc.space".hashedPassword =
-        "$6$ISAaU8X6D$oGKe9WXDWrRpGzHUTdxrxdtg9zuGOlBMuDc82IZhegpsv1bqd550FhZZrI40IjZTA5Hy2MZ8j/0efpnQ4fOQH0";
-      "zauberberg@hacc.space".aliases = [ "lukas@hacc.space" ];
-
-      "stuebinm@hacc.space".hashedPassword =
-        "$6$mjrMQG5smqLRlm$WzmbiZnGlEXGT7hj/n2qz0nvVzGyZfMToCyLRi0wErfVEHI7y7jtWoHqIWnpcHAM29UocsIFFsUCb3XqQCwwB.";
-
-      "lenny@hacc.space".hashedPassword =
-        "$6$EZpv9XImv5F3$p2NSoo5gLxh6NnB3/C6wF8knRTuMHqDXYF3BEscaQuk7qok2Z13xKT/6mFvvSKKBnFCuYptgnfGswmoqIzm/1/";
-      "lenny@hacc.space".aliases = [ "rinderhacc@hacc.space" ];
-
-      "peter@hacc.space".hashedPassword =
-        "$6$yvpfTC.7DDpqpsYy$7TrfmLvz/fRl.k5mSHhI67CNquJa3yEFbLuTJvpyJ8Dj7SaD2eoOHWqef.CNo.T08kYzaqMcM73whAxjXVEmc.";
-      "peter@hacc.space".aliases = [ "linmob@hacc.space" ];
-
-      "finance@muc.hacc.space".hashedPassword =
-        "$6$R3GRmvXwqnMM6q.R$Y9mrUAmMnCScsM6pKjxo2a2XPM7lHrV8FIgK0PzhYvZbxWczo7.O4dk1onYeV1mRx/nXZfkZNjqNCruCn0S2m.";
-
-      "noreply@hacc.space" = {
-        hashedPassword =
-          "$6$YsqMoItITZUzI5wo$5Lejf8XBHRx4LW4VuZ9wJCiBbT4kOV/EZaCdWQ07eVIrkRTZwXWZ5zfsh.olXEFwvpNWN.DBnU.dQc.cC0/ra/";
-      };
-
-      "noreply@infra4future.de" = {
-        hashedPassword =
-          "$6$uaD8bRcT1$gFqhFyu5RUsyUUOG5b.kN.JAJ1rVHvaYhpeRHoMvrERAMgBu1FHu2oDnjTsy.5NKoLc5xpI5uv4Gpy4YbmDmV.";
-      };
-
-      "mattermost@hacc.space" = {
-        hashedPassword =
-          "$6$uaD8bRcT1$gFqhFyu5RUsyUUOG5b.kN.JAJ1rVHvaYhpeRHoMvrERAMgBu1FHu2oDnjTsy.5NKoLc5xpI5uv4Gpy4YbmDmV.";
-      };
-    };
-
-    extraVirtualAliases = {
-      # address = forward address;
-
-      # -- International --
-      # info/contact: main entrypoint, anyone can read or reply to this.
-      "info@hacc.space" = [
-        "hexchen@hacc.space"
-        "octycs@hacc.space"
-        "raphael@hacc.space"
-        "moira@hacc.space"
-        "zauberberg@hacc.space"
-        "stuebinm@hacc.space"
-        "lenny@hacc.space"
-        "peter@hacc.space"
-      ];
-
-      # admin: current people with access to the mail server and knowledge on how to use it™
-      "admin@hacc.space" = [
-        "hexchen@hacc.space"
-        "moira@hacc.space"
-        "zauberberg@hacc.space"
-        "stuebinm@hacc.space"
-      ];
-
-      # voc: hacc video operation center, various streaming-related things
-      "voc@hacc.space" = [
-        "hexchen@hacc.space"
-        "moira@hacc.space"
-        "octycs@hacc.space"
-        "stuebinm@hacc.space"
-        "zauberberg@hacc.space"
-        "lenny@hacc.space"
-        "raphael@hacc.space"
-      ];
-
-      # -- Regional: Germany --
-      # board of hacc e.V.
-      "vorstand@hacc.space" =
-        [ "raphael@hacc.space" "moira@hacc.space" "peter@hacc.space" ];
-
-      # members of hacc e.V.
-      "mitglieder@hacc.space" = [
-        "hexchen@hacc.space"
-        "raphael@hacc.space"
-        "moira@hacc.space"
-        "zauberberg@hacc.space"
-        "lenny@hacc.space"
-        "octycs@hacc.space"
-        "stuebinm@hacc.space"
-        "peter@hacc.space"
-      ];
-
-      # -- Regional: Munich --
-      "muc@hacc.space" = [
-        "hexchen@hacc.space"
-        "octycs@hacc.space"
-        "raphael@hacc.space"
-        "moira@hacc.space"
-        "zauberberg@hacc.space"
-        "stuebinm@hacc.space"
-        "lenny@hacc.space"
-        "peter@hacc.space"
-      ];
-    };
-
-    # Use Let's Encrypt certificates. Note that this needs to set up a stripped
-    # down nginx and opens port 80.
-    certificateScheme = "acme-nginx";
-
-    # Only allow implict TLS
-    enableImap = false;
-    enablePop3 = false;
-
-    # Enable the ManageSieve protocol
-    enableManageSieve = true;
-
-  };
-
-  services.postfix.submissionOptions.smtpd_sender_restrictions =
-    lib.mkForce "reject_non_fqdn_sender,reject_unknown_sender_domain,permit";
-  services.postfix.submissionsOptions.smtpd_sender_restrictions =
-    lib.mkForce "reject_non_fqdn_sender,reject_unknown_sender_domain,permit";
-
-  services.postfix.virtual = ''
-    postmaster@hacc.space admin@hacc.space
-    abuse@hacc.space admin@hacc.space
-    contact@hacc.space info@hacc.space
-    hello@hacc.space info@hacc.space
-    haccvoc@hacc.space voc@hacc.space
-    @4future.dev @hacc.space
-    @4futu.re @hacc.space
-    @hacc.earth @hacc.space
-    @infra4future.de @hacc.space
-  '';
-
-  services.alps = {
-    enable = true;
-    theme = "alps";
-    smtps = {
-      port = 465;
-      host = "mail.hacc.space";
-    };
-    imaps = {
-      port = 993;
-      host = "mail.hacc.space";
-    };
-    bindIP = "[::1]";
-  };
-
-  systemd.services.alps.after = [ "dovecot2.service" "postfix.service" ];
-  systemd.services.alps.bindsTo = [ "dovecot2.service" "postfix.service" ];
-
-  services.nginx.virtualHosts."mail.hacc.space" = {
-    enableACME = true;
-    forceSSL = true;
-    locations."/".proxyPass = "http://[::1]:1323";
-  };
-
-  hacc.bindToPersist = [
-    "/var/lib/rspamd"
-    "/var/lib/opendkim"
-    "/var/lib/postfix"
-    "/var/lib/dovecot"
-    "/var/sieve"
-    "/var/lib/redis-rspamd"
-    "/var/dkim"
-  ];
-}

parsons/mattermost.nix

@@ -1,211 +0,0 @@
-{ config, pkgs, lib, ...}:
-
-{
-  sops.secrets = {
-    "mattermost/env" = {};
-  };
-
-  hacc.containers.mattermost = {
-    bindSecrets = true;
-
-    config = { config, lib, pkgs, ... }: {
-      environment.systemPackages = [ pkgs.morph pkgs.pgloader ];
-
-      systemd.services.mattermost.serviceConfig.EnvironmentFile =
-        lib.mkForce "/secrets/env";
-
-      services.mattermost = {
-        enable = true;
-        siteUrl = "https://mattermost.infra4future.de";
-        siteName = "Mattermost for Future";
-        listenAddress = "0.0.0.0:3000";
-        mutableConfig = false;
-
-        statePath = "/persist/mattermost";
-
-        extraConfig = {
-          ServiceSettings = {
-            TrustedProxyIPHeader = [ "X-Forwarded-For" "X-Real-Ip" ];
-            ReadTimeout = 300;
-            WriteTimeout = 600;
-            IdleTimeout = 60;
-            MaximumLoginAttempts = 10;
-            AllowCorsFrom = "*.infra4future.de/*";
-            WebserverMode = "gzip";
-            EnableCustomEmoji = true;
-            EnableEmojiPicker = true;
-            EnableGifPicker = false;
-            RestrictCustomEmojiCreation = "all";
-            RestrictPostDelete = "all";
-            AllowEditPost = "always";
-            PostEditTimeout = -1;
-            EnableTutorial = false;
-            ExperimentalChannelSidebarOrganization = "default_on";
-            ExperimentalChannelOrganization = true;
-            ExperimentalDataPrefetch = true;
-            EnableEmailInvitations = true;
-            DisableLegacyMFA = true;
-            EnableSVGs = true;
-            EnableLaTeX = true;
-            ThreadAutoFollow = true;
-            EnableSecurityFixAlert = false;
-            CollapsedThreads = "default_on";
-          };
-          TeamSettings = {
-            EnableTeamCreation = true;
-            EnableUserCreation = true;
-            MaxUsersPerTeam = 250;
-            EnableOpenServer = false;
-            EnableUserDeactivation = true;
-            ExperimentalViewArchivedChannels = true;
-            ExperimentalEnableAutomaticReplies = true;
-          };
-          LogSettings = {
-            EnableConsole = true;
-            ConsoleLevel = "ERROR";
-            EnableDiagnostics = false;
-            EnableWebhookDebugging = false;
-          };
-          NotificationLogSettings = {
-            EnableConsole = true;
-            ConsoleLevel = "INFO";
-          };
-          PasswordSettings = {
-            MinimumLength = 10;
-            # turn of all the bullshit requirements
-            Lowercase = false;
-            Number = false;
-            Uppercase = false;
-            Symbol = false;
-          };
-          FileSettings = {
-            EnableFileAttachments = true;
-            MaxFileSize = 52428800;
-            DriverName = "local";
-            Directory = "/persist/mattermost/upload-storage";
-            EnablePublicLink = true;
-            PublicLinkSalt = "3k7p3yxdhz6798b3b9openfr9rn3ymwu";
-          };
-          EmailSettings = {
-            EnableSignUpWithEmail = false;
-            EnableSignInWithEmail = false;
-            EnableSignInWithUsername = false;
-            SendEmailNotifications = true;
-            FeedbackName = "mattermost";
-            FeedbackEmail = "mattermost@infra4future.de";
-            ReplyToAddress = "mattermost@infra4future.de";
-            FeedbackOrganization = "∆infra4future.de";
-            EnableSMTPAuth = true;
-            SMTPUsername = "noreply@infra4future.de";
-            SMTPServer = "mail.hacc.space";
-            SMTPPort = "465";
-            SMTPServerTimeout = 10;
-            ConnectionSecurity = "TLS";
-          };
-          RateLimitSettings.Enable = false;
-          PrivacySettings = {
-            ShowEmailAddress = false;
-            ShowFullName = true;
-          };
-          # to disable the extra landing page advertising the app
-          NativeAppSettings = {
-            AppDownloadLink = "";
-            AndroidAppDownloadLink = "";
-            IosAppDownloadLink = "";
-          };
-          SupportSettings = {
-            TermsOfServiceLink = "https://infra4future.de/nutzungsbedingungen.html";
-            PrivacyPolicyLink = "https://infra4future.de/nutzungsbedingungen.html";
-            AboutLink = "https://infra4future.de";
-            SupportEmail = "info@infra4future.de";
-            CustomTermsOfServiceEnabled = false;
-            EnableAskCommunityLink = true;
-          };
-          AnnouncementSettings.EnableBanner = false;
-          GitLabSettings = {
-            Enable = true;
-            Id = "mattermost";
-            Scope = "";
-            AuthEndpoint = "https://login.infra4future.de/oauth2/authorize";
-            TokenEndpoint = "https://login.infra4future.de/oauth2/token";
-            UserApiEndpoint = "https://login.infra4future.de/oauth2/userinfo";
-          };
-          # for some reason, these don't appear to be working; the startup
-          # process complaines and sets these back to en
-          LocalizationSettings = {
-            DefaultServerLocale = "de";
-            DefaultClientLocale = "de";
-            AvailableLocales = "de,en";
-          };
-          MessageExportSettings.EnableExport = false;
-          # plugins appear to have trouble with the read-only filesystem; it may
-          # be necessary to manually change their paths etc.
-          PluginSettings = {
-            Enable = true;
-            EnableUploads = true;
-            Plugins = {
-              "com.github.matterpoll.matterpoll" = {
-                experimentalui = true;
-                trigger = "poll";
-              };
-            };
-            PluginStates = {
-              "com.github.matterpoll.matterpoll".Enable = true;
-            };
-          };
-          ComplianceSettings.Enable = false;
-          ClusterSettings.Enable = false;
-          MetricsSettings.Enable = false;
-          GuestAccountsSettings.Enable = false;
-          FeatureFlags.CollapsedThreads = true;
-          SqlSettings.DriverName = "postgres";
-          SqlSettings.DataSource = "postgres:///mattermost?host=/run/postgresql";
-        };
-
-        # turn of the weirder parts of this module (which insist on passwords
-        # in nix files, instead of just using socket-based authentication)
-        #
-        # It will still attempt to use its default password, but postgres will
-        # just let it in regardless of that.
-        localDatabaseCreate = false;
-      };
-
-      services.postgresql = {
-        enable = lib.mkForce true; # mattermost sets this to false. wtf.
-        package = pkgs.postgresql_15;
-        ensureDatabases = [ "mattermost" ];
-        ensureUsers = [ {
-          name = "mattermost";
-          ensureDBOwnership = true;
-        } ];
-
-        authentication = lib.mkForce ''
-          # Generated file; do not edit!
-          local all all trust
-        '';
-      };
-
-      services.postgresqlBackup = {
-        enable = true;
-        databases = [ "mattermost" ];
-        startAt = "*-*-* 23:45:00";
-        location = "/persist/backups/postgres";
-      };
-    };
-  };
-
-  services.nginx.virtualHosts."mattermost.infra4future.de" = {
-    locations."/" = {
-      proxyPass = "http://${config.containers.mattermost.localAddress}:3000";
-      proxyWebsockets = true;
-      extraConfig = ''
-        # Mattermost CSR Patch
-        proxy_hide_header Content-Security-Policy;
-        proxy_hide_header X-Frame-Options;
-        proxy_redirect off;
-      '';
-    };
-    forceSSL = true;
-    enableACME = true;
-  };
-}

parsons/monit.nix

@@ -1,64 +0,0 @@
-{ config, options, lib, pkgs, ... }:
-
-let
-  checkHash = pkgs.writeScriptBin "check-commit-hash" ''
-    #!${lib.getExe pkgs.fish}
-    set wanted (${lib.getExe pkgs.curl} -s https://git.infra4future.de/api/v1/repos/hacc/haccfiles/branches/main \
-                -H 'accept: application/json' | jq -r .commit.id)
-
-    if test $status != 0
-      echo "could not reach git.infra4future.de"
-      exit 2
-    end
-
-    set actual (cat /etc/haccfiles-commit)
-    if test $status != 0
-      echo "/etc/haccfiles-commit does not exist??"
-      exit 2
-    end
-
-    if test $actual != $wanted
-      echo "parsons was built on $actual, but commit on main is $wanted"
-      exit 1
-    end
-  '';
-
-  checkDeployAge = pkgs.writeScriptBin "check-deploy-age" ''
-    #!${lib.getExe pkgs.fish}
-
-    set date (date +%s)
-    # we do this indirection here so monit's config won't change on each deploy
-    set deploytimestamp (cat /etc/haccfiles-timestamp)
-    set age (expr $date - $deploytimestamp)
-
-    if test $age -ge (expr 3600 \* 24 \* 10)
-      echo "${config.networking.hostName} has not been deployed since 10 days, perhaps someone should do updates?"
-      exit 1
-    end
-  '';
-in
-{
-  mailserver.monitoring = {
-    enable = true;
-    alertAddress = "admin@hacc.space";
-    config = (lib.replaceStrings ["port 22"] ["port ${toString (lib.head config.services.openssh.ports)}"] options.mailserver.monitoring.config.default);
-  };
-
-  services.monit.config = ''
-      check host onlyoffice with address onlyoffice.infra4future.de
-            start program "/run/current-system/sw/bin/lxc-start -n onlyoffice -f /persist/lxc/onlyoffice/config"
-            stop program "/run/current-system/sw/bin/lxc-stop -n onlyoffice"
-            if failed port 443 protocol https status = 302
-            then restart
-
-      check program deployed-commit-on-main path ${lib.getExe checkHash}
-            if status == 1 for 64 cycles then alert
-            if status == 2 for 3 cycles then alert
-
-      check program is-system-running path ${pkgs.systemd}/bin/systemctl is-system-running
-            if status != 0 then alert
-
-      check program check-deploy-age path ${lib.getExe checkDeployAge}
-            if status == 1 then alert
-  '';
-}

parsons/murmur.nix

@@ -1,30 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  services.murmur = {
-    enable = true;
-    logDays = -1;
-    registerName = "hackers against climate change";
-    welcometext = ''
-      <br>Welcome to <b>mumble4future</b>!<br>Brought to you by <b style="color:red">infra4future</b>.<br>On <a href=https://mumble.hacc.space>mumble.hacc.space</a><br>Not confusing at all!
-    '';
-    sslKey = "/var/lib/acme/mumble.hacc.space/key.pem";
-    sslCert = "/var/lib/acme/mumble.hacc.space/fullchain.pem";
-    bandwidth = 128000;
-  };
-
-  networking.firewall.allowedTCPPorts = [ config.services.murmur.port ];
-  networking.firewall.allowedUDPPorts = [ config.services.murmur.port ];
-
-  # the mumble cert has its own group so that both nginx and murmur can read it
-  users.groups.mumblecert = { };
-  security.acme.certs."mumble.hacc.space" = {
-    group = "mumblecert";
-    extraDomainNames = [ "mumble.infra4future.de" ];
-    reloadServices = [ "murmur" ];
-  };
-  users.users.nginx.extraGroups = [ "mumblecert" ];
-  users.users.murmur.extraGroups = [ "mumblecert" ];
-
-  hacc.bindToPersist = [ "/var/lib/murmur" ];
-}

parsons/nextcloud.nix

@@ -1,89 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  containers.nextcloud.timeoutStartSec = "10 min";
-  hacc.containers.nextcloud = {
-    config = { config, lib, pkgs, ... }: {
-      environment.systemPackages = [ pkgs.htop ];
-
-      services.nextcloud = {
-        enable = true;
-
-        # must be set manually; may not be incremented by more than one at
-        # a time, otherwise nextcloud WILL break
-        package = pkgs.nextcloud30;
-
-        home = "/persist/nextcloud";
-        https = true;
-
-        hostName = "cloud.infra4future.de";
-        config = {
-          dbtype = "pgsql";
-          dbuser = "nextcloud";
-          dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself
-          dbname = "nextcloud";
-          # socket auth does not needs this, but the module insists it does
-          adminpassFile = "/persist/adminpassfile";
-          adminuser = "root";
-        };
-
-        # multiple pools may be doable using services.phpfpm.pools,
-        # but i have not tried this yet. The nextcloud module defines a
-        # pool "nextcloud"
-        poolSettings = {
-          pm = "dynamic";
-          "pm.max_children" = "32";
-          "pm.max_requests" = "500";
-          "pm.max_spare_servers" = "4";
-          "pm.min_spare_servers" = "2";
-          "pm.start_servers" = "2";
-        };
-
-        settings = {
-          instanceid = "ocxlphb7fbju";
-          datadirectory = "/persist/nextcloud/data";
-          loglevel = 0;
-          "overwrite.cli.url" = "https://cloud.infra4future.de";
-        };
-      };
-
-      services.postgresql = {
-        enable = true;
-        package = pkgs.postgresql_15;
-        ensureDatabases = [ "nextcloud" ];
-        ensureUsers = [
-          { # by default, postgres has unix sockets enabled, and allows a
-            # system user `nextcloud` to log in without other authentication
-            name = "nextcloud";
-            ensureDBOwnership = true;
-          }
-        ];
-      };
-
-      services.postgresqlBackup = {
-        enable = true;
-        databases = [ "nextcloud" ];
-        startAt = "*-*-* 23:45:00";
-        location = "/persist/backups/postgres";
-      };
-
-      # ensure that postgres is running *before* running the setup
-      systemd.services."nextcloud-setup" = {
-        requires = ["postgresql.service"];
-        after = ["postgresql.service"];
-      };
-    };
-  };
-
-  services.nginx.virtualHosts."cloud.infra4future.de" = {
-    locations."/".proxyPass = "http://${config.containers.nextcloud.localAddress}:80";
-    enableACME = true;
-    forceSSL = true;
-    extraConfig = ''
-      proxy_buffering off;
-      client_max_body_size 0;
-      add_header Cache-Control "no-store, no-cache, must-revalidate";
-    '';
-  };
-
-}

parsons/nftables.nix

@@ -1,23 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  networking.firewall.enable = true;
-  networking.firewall.logRefusedConnections = false;
-  networking.nat.enable = true;
-
-  networking.nftables.enable = true;
-  networking.nftables.tables.nat = {
-    family = "ip";
-    content = ''
-      chain prerouting {
-        type nat hook prerouting priority -100
-        iifname enp35s0 tcp dport { 22 } dnat ${config.containers.forgejo.localAddress}:22
-      }
-      chain postrouting {
-        type nat hook postrouting priority 100
-        iifname lxcbr0 oifname enp35s0 masquerade
-        iifname ve-* oifname enp35s0 masquerade
-      }
-    '';
-  };
-}

parsons/nginx-pages.nix

@@ -1,16 +0,0 @@
-{ config, pkgs, ... }:
-
-
-{
-  hacc.websites = {
-    enable = true;
-    directory = "${../.}/websites";
-  };
-
-
-  services.nginx.virtualHosts."parsons.hacc.space" = {
-    enableACME = true;
-    forceSSL = true;
-    locations."/~stuebinm/".root = "/persist/www/";
-  };
-}

parsons/s4f-conference.nix

@@ -1,137 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  sops.secrets = {
-    "s4f-conference/env" = {};
-  };
-
-  hacc.containers.s4f-conference = {
-    bindSecrets = true;
-
-    config = { config, lib, pkgs, ... }: {
-      systemd.services.mattermost.serviceConfig.EnvironmentFile =
-        lib.mkForce "/secrets/env";
-
-      services.mattermost = {
-        enable = true;
-        siteUrl = "https://s4f-conference.infra4future.de";
-        siteName = "Scientists for Future Chat";
-        listenAddress = "0.0.0.0:3000";
-        mutableConfig = false;
-
-        statePath = "/persist/mattermost";
-
-        extraConfig = {
-          ServiceSettings = {
-            TrustedProxyIPHeader = [ "X-Forwarded-For" "X-Real-Ip" ];
-            EnableEmailInvitations = true;
-          };
-          TeamSettings = {
-            EnableUserCreation = true;
-            MaxUsersPerTeam = 2500;
-            EnableUserDeactivation = true;
-            EnableOpenServer = false;
-          };
-          PasswordSettings = {
-            MinimumLength = 10;
-          };
-          FileSettings = {
-            EnableFileAttachments = true;
-            MaxFileSize = 52428800;
-            DriverName = "local";
-            Directory = "/persist/upload-storage";
-            EnablePublicLink = true;
-            PublicLinkSalt = "3k7p3yxdhz6798b3b9openfr9rn3ymwu";
-          };
-          EmailSettings = {
-            EnableSignUpWithEmail = true;
-            EnableSignInWithEmail = true;
-            EnableSignInWithUsername = true;
-            SendEmailNotifications = true;
-            FeedbackName = "mattermost";
-            FeedbackEmail = "mattermost@infra4future.de";
-            ReplyToAddress = "mattermost@infra4future.de";
-            FeedbackOrganization = "∆infra4future.de";
-            EnableSMTPAuth = true;
-            SMTPUsername = "noreply@infra4future.de";
-            SMTPServer = "mail.hacc.space";
-            SMTPPort = "465";
-            SMTPServerTimeout = 10;
-            ConnectionSecurity = "TLS";
-          };
-          RateLimitSettings.Enable = false;
-          PrivacySettings = {
-            ShowEmailAddress = false;
-            ShowFullName = true;
-          };
-          # to disable the extra landing page advertising the app
-          NativeAppSettings = {
-            AppDownloadLink = "";
-            AndroidAppDownloadLink = "";
-            IosAppDownloadLink = "";
-          };
-          LogSettings = {
-            EnableConsole = true;
-            ConsoleLevel = "ERROR";
-            EnableDiagnostics = false;
-            EnableWebhookDebugging = false;
-          };
-          SupportSettings = {
-            TermsOfServiceLink = "https://infra4future.de/nutzungsbedingungen.html";
-            PrivacyPolicyLink = "https://infra4future.de/nutzungsbedingungen.html";
-            AboutLink = "https://infra4future.de";
-            SupportEmail = "info@infra4future.de";
-            CustomTermsOfServiceEnabled = false;
-            EnableAskCommunityLink = true;
-          };
-          AnnouncementSettings.EnableBanner = false;
-          ComplianceSettings.Enable = false;
-          ClusterSettings.Enable = false;
-          MetricsSettings.Enable = false;
-          GuestAccountsSettings.Enable = true;
-        };
-
-        localDatabaseCreate = false;
-      };
-
-      services.postgresql = {
-        enable = lib.mkForce true; # mattermost sets this to false. wtf.
-        package = pkgs.postgresql_15;
-        ensureDatabases = [ "mattermost" ];
-        ensureUsers = [ {
-          name = "mattermost";
-          ensureDBOwnership = true;
-        } ];
-
-        authentication = lib.mkForce ''
-          # Generated file; do not edit!
-          local all all              trust
-          host  mattermost mattermost ::1/128      trust
-        '';
-      };
-      services.postgresqlBackup = {
-        enable = true;
-        databases = [ "mattermost" ];
-        startAt = "*-*-* 23:45:00";
-        location = "/persist/backups/postgres";
-      };
-    };
-  };
-
-  services.nginx.virtualHosts."s4f-conference.infra4future.de" = {
-    locations."/" = {
-      proxyPass = "http://${config.containers.s4f-conference.localAddress}:3000";
-      proxyWebsockets = true;
-      extraConfig = ''
-        # Mattermost CSR Patch
-        proxy_hide_header Content-Security-Policy;
-        proxy_hide_header X-Frame-Options;
-        proxy_redirect off;
-
-        client_max_body_size 100M;
-      '';
-    };
-    forceSSL = true;
-    enableACME = true;
-  };
-}

parsons/tracktrain.nix

@@ -1,105 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  tracktrain-config = ''
-    dbstring: "dbname=tracktrain"
-    gtfs: /persist/gtfs.zip
-    assets: ${pkgs.tracktrain}/assets
-
-    warp:
-      port: 4000
-
-    login:
-      enable: true
-      url: https://login.infra4future.de
-      clientName: tracktrain
-      # clientSecret defined in env file
-
-    logging:
-      ntfyTopic: ping.stuebinm.eu/monit
-      name: ilztalbahn
-  '';
-in
-{
-  sops.secrets = {
-    "tracktrain/env" = {};
-  };
-
-  services.nginx.virtualHosts."tracktrain.ilztalbahn.eu" = {
-    enableACME = true;
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://${config.containers.tracktrain.localAddress}:4000";
-      proxyWebsockets = true;
-    };
-    # note: this shadows the /metrics endpoint of tracktrain
-    # in case you remove this, please consider putting something
-    # else here to keep it from being publicly scrapable
-    locations."/metrics/" = {
-      proxyPass = "http://${config.containers.tracktrain.localAddress}:2342";
-      proxyWebsockets = true;
-      extraConfig = ''
-        rewrite  ^/metrics/(.*)  /$1 break;
-      '';
-    };
-  };
-
-  hacc.containers.tracktrain = {
-    bindSecrets = true;
-
-    config = { config, lib, pkgs, ... }: {
-
-      systemd.services.tracktrain = {
-        enable = true;
-
-        description = "tracks trains, hopefully";
-        wantedBy = [ "multi-user.target" ];
-        requires = [ "network.target" ];
-        after = [ "network.target" ];
-        serviceConfig = {
-          Type = "simple";
-          EnvironmentFile = "/secrets/env";
-          DynamicUser = true;
-        };
-        path = [ pkgs.wget pkgs.ntfy-sh ];
-        script = ''
-          cd /tmp
-          ln -sf ${pkgs.writeText "tracktrain-config.yaml" tracktrain-config} config.yaml
-          sleep 3
-          ${pkgs.tracktrain}/bin/tracktrain +RTS -T
-        '';
-      };
-
-      systemd.services.postgresql.wantedBy = [ "tracktrain.service" ];
-
-      services.postgresql = {
-        enable = true;
-        package = pkgs.postgresql_15;
-        ensureDatabases = [ "tracktrain" ];
-        ensureUsers = [ {
-          name = "tracktrain";
-          ensureDBOwnership = true;
-        } ];
-        authentication = ''
-          local all all trust
-        '';
-      };
-
-      services.prometheus = {
-        enable = true;
-        port = 9001;
-        scrapeConfigs = [ {
-          job_name = "tracktrain";
-          static_configs = [{
-            targets = [  "0.0.0.0:4000" ];
-          }];
-        } ];
-      };
-
-      systemd.services.grafana.serviceConfig.EnvironmentFile =
-        "/secrets/env";
-      hacc.bindToPersist = [ "/var/lib/grafana" ];
-    };
-  };
-
-}

parsons/uffd.nix

@@ -1,66 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  hacc.containers.uffd = {
-    config = { config, lib, pkgs, ... }: {
-      services.uwsgi = {
-        enable = true;
-        plugins = [ "python3" ];
-        instance = {
-          type = "normal";
-          pythonPackages = _: [ pkgs.uffd ];
-          module = "uffd:create_app()";
-          # socket = "${config.services.uwsgi.runDir}/uwsgi.sock";
-          http = ":8080";
-          env = [
-            "CONFIG_PATH=/persist/uffd/uffd.conf"
-          ];
-          hook-pre-app = "exec:FLASK_APP=${pkgs.uffd}/lib/python3.10/site-packages/uffd flask db upgrade";
-        };
-      };
-    };
-  };
-  services.nginx.virtualHosts."login.infra4future.de" = {
-    enableACME = true;
-    forceSSL = true;
-    locations = {
-      "/".proxyPass = "http://${config.containers.uffd.localAddress}:8080";
-      "/static".root = "${pkgs.uffd}/lib/python3.10/site-packages/uffd";
-      "/static/hacc.png".return = "302 https://infra4future.de/assets/img/logo_vernetzung.png";
-      "/static/infra4future.svg".return = "302 https://infra4future.de/assets/img/infra4future.svg";
-      "/static/hedgedoc.svg".return = "302 https://infra4future.de/assets/img/icons/hedgedoc.svg";
-      "/static/mattermost.svg".return = "302 https://infra4future.de/assets/img/icons/mattermost.svg";
-      "/static/nextcloud.svg".return = "302 https://infra4future.de/assets/img/icons/nextcloud.svg";
-      "/static/hot_shit.svg".return = "302 https://infra4future.de/assets/img/icons/hot_shit.svg";
-    };
-  };
-
-  systemd.services.auamost = {
-    enable = true;
-
-    description = "mattermost aua gruppensync";
-    wantedBy = [ "multi-user.target" ];
-    after = [ "network.target" ];
-    serviceConfig.Type = "simple";
-    path = [ pkgs.fish pkgs.curl pkgs.jq ];
-    script = "${pkgs.hacc-scripts}/bin/uffd-sync-mattermost-groups.fish";
-    startAt = "*:0/15";
-  };
-
-  systemd.services.uffd-account-expiry-notification = {
-    enable = true;
-    wantedBy = [ "multi-user.target" ];
-    after = [ "network.target" ];
-    serviceConfig.Type = "simple";
-    path = [ pkgs.hacc-scripts pkgs.sqlite-interactive pkgs.postfix ];
-    script = ''
-      uffd-unused-accounts-notification.scm -v admin
-    '';
-    startAt = "weekly";
-    restartIfChanged = false;
-  };
-
-  sops.secrets."auamost/secrets.fish" = { };
-
-  environment.systemPackages = with pkgs; [ curl jq ];
-}

parsons/vaultwarden.nix

@@ -1,55 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  sops.secrets = {
-    "vaultwarden/env" = {};
-  };
-
-  services.vaultwarden = {
-    enable = true;
-    config = {
-      DATA_FOLDER="/persist/var/lib/vaultwarden/data";
-      LOG_LEVEL="error";
-      SIGNUPS_ALLOWED=false;
-      SIGNUPS_VERIFY=true;
-      SIGNUPS_DOMAINS_WHITELIST="hacc.space";
-      ORG_CREATION_USERS="admin@hacc.space";
-      INVITATIONS_ALLOWED=true;
-      INVITATION_ORG_NAME="haccwarden";
-
-      TRASH_AUTO_DELETE_DAYS=90;
-      
-      DOMAIN="https://pw.hacc.space";
-      ROCKET_ADDRESS="127.0.0.1";
-      ROCKET_PORT=5354;
-      ROCKET_WORKERS=2;
-      
-      SMTP_HOST="mail.hacc.space";
-      SMTP_FROM="vaultwarden@hacc.space";
-      SMTP_FROM_NAME="haccwarden";
-      SMTP_PORT=587;
-      SMTP_USERNAME="noreply@infra4future.de";
-
-    };
-    environmentFile = "/run/secrets/vaultwarden/env";
-    dbBackend = "sqlite";
-    backupDir = "/persist/data/vaultwarden_backups/";
-  };
-
-  #work around ProtectSystem=strict, cleanup
-  systemd.services.vaultwarden.serviceConfig = {
-    ReadWritePaths = [ "/persist/var/lib/vaultwarden" ];
-    StateDirectory = lib.mkForce "";
-  };
-  systemd.services.backup-vaultwarden.environment.DATA_FOLDER =
-    lib.mkForce "/persist/var/lib/vaultwarden/data";
-
-  services.nginx.virtualHosts."pw.hacc.space" = {
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:5354";
-      proxyWebsockets = true;
-    };
-    forceSSL = true;
-    enableACME = true;
-  };
-}

pkgs/alps/default.nix

@@ -0,0 +1,25 @@
+{ lib, buildGoModule }:
+
+buildGoModule rec {
+  pname = "alps";
+  version = "0.0.1";
+
+  src = fetchGit {
+    url = "https://git.sr.ht/~migadu/alps";
+    rev = "51498a2dc37987f55b022efb961b68a282be17ed";
+  };
+
+  vendorSha256 = "0wc8fb03zlc1gl4nxlsh149gvpvrs3lc0smzrnam9smigg9gw4in";
+
+  subPackages = [ "cmd/alps" ];
+
+  postInstall = ''
+    mkdir -p $out/share/alps
+    cp -r $src/themes $out/share/alps/
+  '';
+
+  meta = with lib; {
+    description = "A simple and extensible webmail.";
+    homepage = "https://git.sr.ht/~migadu/alps";
+  };
+}

pkgs/default.nix

@@ -1,32 +1,17 @@
-{ sources, ... }@args:
+{ config ? {}, system ? builtins.currentSystem, ... }@args:
 
 let
+  sources = import ../nix/sources.nix;
   pkgs = import sources.nixpkgs args;
-  oldstable = import sources.nixpkgs-oldstable args;
-  unstable = import sources.nixpkgs-unstable args;
 
   callPackage = pkgs.lib.callPackageWith (pkgs // newpkgs);
 
   newpkgs = {
+    peertube = callPackage ./peertube { mylibs = import "${sources.immae-nix}/lib" { inherit pkgs; }; };
+    alps = callPackage ./alps {};
 
-    mattermost = callPackage ./mattermost.nix {
-      buildGoModule = unstable.buildGo122Module;
+    inherit callPackage;
+    appendOverlays = overlays: (pkgs.appendOverlays overlays) // newpkgs;
   };
 
-    morph = callPackage ./morph.nix {
-      buildGoModule = unstable.buildGo122Module;
-    };
-
-    tracktrain = import sources.tracktrain {
-      nixpkgs = unstable;
-      compiler = "default";
-    };
-
-    uffd = oldstable.callPackage ./uffd { };
-
-    hacc-scripts = callPackage ./scripts {};
-
-    inherit (oldstable) uwsgi flask;
-  };
-
-in pkgs.extend(_: _: newpkgs)
+in pkgs // newpkgs

pkgs/mattermost.nix

@@ -1,85 +0,0 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, nix-update-script
-, fetchurl
-, nixosTests
-}:
-
-buildGoModule rec {
-  pname = "mattermost";
-  # ESR releases only.
-  # See https://docs.mattermost.com/upgrade/extended-support-release.html
-  # When a new ESR version is available (e.g. 8.1.x -> 9.5.x), update
-  # the version regex in passthru.updateScript as well.
-  version = "9.11.5";
-
-  src = fetchFromGitHub {
-    owner = "mattermost";
-    repo = "mattermost";
-    rev = "v${version}";
-    hash = "sha256-bLZFeG6kBVP0ws50wtBam/bO206sQnz6va8PATAoRAQ=";
-  };
-
-  # Needed because buildGoModule does not support go workspaces yet.
-  # We use go 1.22's workspace vendor command, which is not yet available
-  # in the default version of go used in nixpkgs, nor is it used by upstream:
-  # https://github.com/mattermost/mattermost/issues/26221#issuecomment-1945351597
-  overrideModAttrs = (_: {
-    buildPhase = ''
-      make setup-go-work
-      go work vendor -e
-    '';
-  });
-
-  webapp = fetchurl {
-    url = "https://releases.mattermost.com/${version}/mattermost-${version}-linux-amd64.tar.gz";
-    hash = "sha256-jyaJUN8wpuBivKNdm7f1mYwygO8xC+Zxy0SdkDovdsA=";
-  };
-
-  vendorHash = "sha256-Gwv6clnq7ihoFC8ox8iEM5xp/us9jWUrcmqA9/XbxBE=";
-
-  modRoot = "./server";
-  preBuild = ''
-    make setup-go-work
-  '';
-
-  subPackages = [ "cmd/mattermost" ];
-  offlineCache = webapp;
-
-  tags = [ "production" ];
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X github.com/mattermost/mattermost/server/public/model.Version=${version}"
-    "-X github.com/mattermost/mattermost/server/public/model.BuildNumber=${version}-nixpkgs"
-    "-X github.com/mattermost/mattermost/server/public/model.BuildDate=1970-01-01"
-    "-X github.com/mattermost/mattermost/server/public/model.BuildHash=v${version}"
-    "-X github.com/mattermost/mattermost/server/public/model.BuildHashEnterprise=none"
-    "-X github.com/mattermost/mattermost/server/public/model.BuildEnterpriseReady=false"
-  ];
-
-  postInstall = ''
-    tar --strip 1 --directory $out -xf $webapp \
-      mattermost/{client,i18n,fonts,templates,config}
-
-    # For some reason a bunch of these files are executable
-    find $out/{client,i18n,fonts,templates,config} -type f -exec chmod -x {} \;
-  '';
-
-  passthru = {
-    updateScript = nix-update-script {
-      extraArgs = [ "--version-regex" "^v(9\.11\.([0-9.]+))" ];
-    };
-    tests.mattermost = nixosTests.mattermost;
-  };
-
-  meta = with lib; {
-    description = "Mattermost is an open source platform for secure collaboration across the entire software development lifecycle";
-    homepage = "https://www.mattermost.org";
-    license = with licenses; [ agpl3Only asl20 ];
-    maintainers = with maintainers; [ ryantm numinit kranzes mgdelacroix ];
-    mainProgram = "mattermost";
-  };
-}

pkgs/morph.nix

@@ -1,33 +0,0 @@
-{ buildGoModule
-, fetchFromGitHub
-}:
-
-buildGoModule rec {
-  pname = "mattermost-morph";
-  version = "1.1.0";
-
-  src = fetchFromGitHub {
-    owner = "mattermost";
-    repo = "morph";
-    rev = "v${version}";
-    hash = "sha256-Orh/a9OlUVIlDdLXRpDAnHUmWRiM1N2oO+dijbuJzx8=";
-  };
-
-  vendorHash = null;
-
-  subPackages = [ "cmd/morph" ];
-
-  tags = [ "production" ];
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X github.com/mattermost/mattermost/server/public/model.Version=${version}"
-    "-X github.com/mattermost/mattermost/server/public/model.BuildNumber=${version}-nixpkgs"
-    "-X github.com/mattermost/mattermost/server/public/model.BuildDate=1970-01-01"
-    "-X github.com/mattermost/mattermost/server/public/model.BuildHash=v${version}"
-    "-X github.com/mattermost/mattermost/server/public/model.BuildHashEnterprise=none"
-    "-X github.com/mattermost/mattermost/server/public/model.BuildEnterpriseReady=false"
-  ];
-
-}

pkgs/peertube/default.nix

@@ -0,0 +1,207 @@
+{ ldap ? false, sendmail ? false, light ? null, syden ? false, runCommand, libsass
+, lib, stdenv, rsync, fetchzip, youtube-dl, fetchurl, mylibs, python, nodejs, nodePackages, yarn2nix-moretea }:
+let
+  nodeHeaders = fetchurl {
+    url = "https://nodejs.org/download/release/v${nodejs.version}/node-v${nodejs.version}-headers.tar.gz";
+    sha256 = "17kf05a92r4y4n1lj78265wr6zhkpzbr1k8nbwrl8sq71npd6n5j";
+  };
+  source = mylibs.fetchedGithub ./peertube.json;
+  patchedSource = stdenv.mkDerivation (source // rec {
+    phases = [ "unpackPhase" "patchPhase" "installPhase" ];
+    patches = [ ./yarn_fix_http_node.patch ]
+      ++ lib.optionals ldap [ ./ldap.patch ]
+      ++ lib.optionals sendmail [ ./sendmail.patch ]
+      ++ lib.optionals syden [ ./syden.patch ];
+    installPhase = ''
+      mkdir $out
+      cp -a . $out/
+      '';
+  });
+  serverPatchedPackage = runCommand "server-package" {} ''
+    mkdir -p $out
+    cp ${patchedSource}/package.json $out/
+    cp ${patchedSource}/yarn.lock $out/
+  '';
+  clientPatchedPackage = runCommand "client-package" {} ''
+    mkdir -p $out
+    cp ${patchedSource}/client/package.json $out/
+    cp ${patchedSource}/client/yarn.lock $out/
+  '';
+
+  yarnModulesConfig = {
+    bcrypt = {
+      buildInputs = [ nodePackages.node-pre-gyp ];
+      postInstall = let
+        node_module_version = "72";
+        bcrypt_lib = fetchurl {
+          url = "https://github.com/kelektiv/node.bcrypt.js/releases/download/v3.0.7/bcrypt_lib-v3.0.7-node-v${node_module_version}-linux-x64-glibc.tar.gz";
+          sha256 = "0kpm9j0yc4lqsafldfsql3m72rr1fapljlb6ddxvy3zi13rb7ppx";
+        };
+      in
+        ''
+          if [ "$(node -e "console.log(process.versions.modules)")" != "${node_module_version}" ]; then
+            echo "mismatching version with nodejs please update bcrypt derivation"
+            false
+          fi
+          mkdir lib && tar -C lib -xf ${bcrypt_lib}
+          patchShebangs ../node-pre-gyp
+          npm run install
+        '';
+    };
+    dtrace-provider = {
+      buildInputs = [ python nodePackages.node-gyp ];
+      postInstall = ''
+        npx node-gyp rebuild --tarball=${nodeHeaders}
+        '';
+    };
+    node-sass = {
+      buildInputs = [ libsass python ];
+      postInstall =
+        ''
+          node scripts/build.js --tarball=${nodeHeaders}
+        '';
+    };
+
+    sharp = {
+      buildInputs = [ python nodePackages.node-gyp ];
+      postInstall =
+        let
+          tarball = fetchurl {
+            url = "https://github.com/lovell/sharp-libvips/releases/download/v8.8.1/libvips-8.8.1-linux-x64.tar.gz";
+            sha256 = "0xqv61g6s6rkvc31zq9a3bf8rp56ijnpw0xhr91hc88asqprd5yh";
+          };
+        in
+        ''
+          mkdir vendor
+          tar -C vendor -xf ${tarball}
+          patchShebangs ../prebuild-install
+          npx node install/libvips
+          npx node install/dll-copy
+          npx prebuild-install || npx node-gyp rebuild --tarball=${nodeHeaders}
+        '';
+    };
+    utf-8-validate = {
+      buildInputs = [ nodePackages.node-gyp-build ];
+    };
+    youtube-dl = {
+      postInstall = ''
+        mkdir bin
+        ln -s ${youtube-dl}/bin/youtube-dl bin/youtube-dl
+        cat > bin/details <<EOF
+        {"version":"${youtube-dl.version}","path":null,"exec":"youtube-dl"}
+        EOF
+        '';
+    };
+  };
+  serverYarnModulesArg = rec {
+    pname = "peertube-server-yarn-modules";
+    version = source.version;
+    name = "${pname}-${version}";
+    packageJSON = "${serverPatchedPackage}/package.json";
+    yarnLock = "${serverPatchedPackage}/yarn.lock";
+    yarnNix = ./server-yarn-packages.nix;
+    pkgConfig = yarnModulesConfig;
+  };
+  clientYarnModulesArg = rec {
+    pname = "peertube-client-yarn-modules";
+    version = source.version;
+    name = "${pname}-${version}";
+    packageJSON = "${clientPatchedPackage}/package.json";
+    yarnLock = "${clientPatchedPackage}/yarn.lock";
+    yarnNix = ./client-yarn-packages.nix;
+    pkgConfig = yarnModulesConfig;
+  };
+  yarnModulesNoWorkspace = args: (yarn2nix-moretea.mkYarnModules args).overrideAttrs(old: {
+    buildPhase = builtins.replaceStrings [" ./package.json"] [" /dev/null; cp deps/*/package.json ."] old.buildPhase;
+  });
+
+  patchedPackages = stdenv.mkDerivation (source // rec {
+    patches = if ldap then [ ./ldap.patch ] else [ ./yarn_fix_http_node.patch ];
+    installPhase = ''
+      mkdir $out
+      cp package.json yarn.lock $out/
+      '';
+  });
+  serverYarnModules = yarnModulesNoWorkspace serverYarnModulesArg;
+  serverYarnModulesProd = yarnModulesNoWorkspace (serverYarnModulesArg // { yarnFlags = yarn2nix-moretea.defaultYarnFlags ++ [ "--production" ]; });
+  clientYarnModules = yarnModulesNoWorkspace clientYarnModulesArg;
+
+  server = stdenv.mkDerivation ({
+    pname = "peertube-server";
+    version = source.version;
+    src = patchedSource;
+    buildPhase = ''
+      ln -s ${serverYarnModules}/node_modules .
+      npm run build:server
+      '';
+    installPhase = ''
+      mkdir $out
+      cp -a dist $out
+      '';
+    buildInputs = [ nodejs serverYarnModules ];
+  });
+
+  client = stdenv.mkDerivation ({
+    pname = "peertube-client";
+    version = source.version;
+    src = patchedSource;
+    buildPhase = let
+      lightArg = if light == null then "" else if light == true then "--light" else "--light-language";
+    in ''
+      ln -s ${serverYarnModules}/node_modules .
+      cp -a ${clientYarnModules}/node_modules client/
+      chmod +w client/node_modules
+      patchShebangs .
+      npm run build:client -- ${lightArg}
+      '';
+    installPhase = ''
+      mkdir $out
+      cp -a client/dist $out
+      '';
+    buildInputs = [ nodejs clientYarnModules ];
+  });
+
+  package = stdenv.mkDerivation rec {
+    version = source.version;
+    pname = "peertube";
+    src = patchedSource;
+    buildPhase = ''
+      ln -s ${serverYarnModulesProd}/node_modules .
+      ln -s ${clientYarnModules}/node_modules client/
+      rm -rf dist && cp -a ${server}/dist dist
+      rm -rf client/dist && cp -a ${client}/dist client/
+      '';
+    installPhase = ''
+      mkdir $out
+      cp -a * $out
+      ln -s /tmp $out/.cache
+      '';
+
+    meta = {
+      description = "A free software to take back control of your videos";
+
+      longDescription = ''
+        PeerTube aspires to be a decentralized and free/libre alternative to video
+        broadcasting services.
+        PeerTube is not meant to become a huge platform that would centralize
+        videos from all around the world. Rather, it is a network of
+        inter-connected small videos hosters.
+        Anyone with a modicum of technical skills can host a PeerTube server, aka
+        an instance. Each instance hosts its users and their videos. In this way,
+        every instance is created, moderated and maintained independently by
+        various administrators.
+        You can still watch from your account videos hosted by other instances
+        though if the administrator of your instance had previously connected it
+        with other instances.
+      '';
+
+      license = stdenv.lib.licenses.agpl3Plus;
+
+      homepage = "https://joinpeertube.org/";
+
+      platforms = stdenv.lib.platforms.linux; # not sure here
+      maintainers = with stdenv.lib.maintainers; [ matthiasbeyer immae ];
+    };
+  };
+in
+  package

pkgs/peertube/ldap.patch

@@ -0,0 +1,597 @@
+commit ffb4a59047a014d6bb050b67a2fc7bc116be4682
+Author: Ismaël Bouya <ismael.bouya@normalesup.org>
+Date:   Tue Feb 12 18:47:53 2019 +0100
+
+    Add LDAP authentication
+
+diff --git a/config/default.yaml b/config/default.yaml
+index 3260c62fc..dcce721b9 100644
+--- a/config/default.yaml
++++ b/config/default.yaml
+@@ -51,6 +51,19 @@ redis:
+   auth: null
+   db: 0
+ 
++auth:
++  local:
++    enabled: true
++  ldap:
++    enabled: true
++    url: ldap://localhost:389/dc=example,dc=com
++    insecure_tls: false
++    bind_dn: cn=admin,dc=example,dc=com
++    bind_password: adminPass
++    base: dc=example,dc=com
++    mail_entry: "mail"
++    user_filter: "(|(email=%username%)(uid=%username%))"
++
+ smtp:
+   hostname: null
+   port: 465
+diff --git a/config/production.yaml.example b/config/production.yaml.example
+index 30cd2ffe0..c56691bf4 100644
+--- a/config/production.yaml.example
++++ b/config/production.yaml.example
+@@ -51,6 +51,19 @@ redis:
+   auth: null
+   db: 0
+ 
++auth:
++  local:
++    enabled: true
++  ldap:
++    enabled: true
++    url: ldap://localhost:389/dc=example,dc=com
++    insecure_tls: false
++    bind_dn: cn=admin,dc=example,dc=com
++    bind_password: adminPass
++    base: dc=example,dc=com
++    mail_entry: "mail"
++    user_filter: "(|(email=%username%)(uid=%username%))"
++
+ # SMTP server to send emails
+ smtp:
+   hostname: null
+diff --git a/package.json b/package.json
+index 49d9faf97..31eccf797 100644
+--- a/package.json
++++ b/package.json
+@@ -112,6 +112,7 @@
+     "iso-639-3": "^1.0.1",
+     "js-yaml": "^3.5.4",
+     "jsonld": "~2.0.1",
++    "ldapjs": "^1.0.2",
+     "lodash": "^4.17.10",
+     "lru-cache": "^5.1.1",
+     "magnet-uri": "^5.1.4",
+diff --git a/server/initializers/config.ts b/server/initializers/config.ts
+index 7fd77f3e8..45a667826 100644
+--- a/server/initializers/config.ts
++++ b/server/initializers/config.ts
+@@ -34,6 +34,21 @@ const CONFIG = {
+     AUTH: config.has('redis.auth') ? config.get<string>('redis.auth') : null,
+     DB: config.has('redis.db') ? config.get<number>('redis.db') : null
+   },
++  AUTH: {
++    LOCAL: {
++      ENABLED: config.has('auth.local.enabled') ? config.get<boolean>('auth.local.enabled') : true,
++    },
++    LDAP: {
++      ENABLED: config.has('auth.ldap.enabled') ? config.get<boolean>('auth.ldap.enabled') : false,
++      URL: config.has('auth.ldap.url') ? config.get<string>('auth.ldap.url') : null,
++      INSECURE_TLS: config.has('auth.ldap.insecure_tls') ? config.get<boolean>('auth.ldap.insecure_tls') : false,
++      BIND_DN: config.has('auth.ldap.bind_dn') ? config.get<string>('auth.ldap.bind_dn') : null,
++      BIND_PASSWORD: config.has('auth.ldap.bind_password') ? config.get<string>('auth.ldap.bind_password') : null,
++      BASE: config.has('auth.ldap.base') ? config.get<string>('auth.ldap.base') : null,
++      MAIL_ENTRY: config.has('auth.ldap.mail_entry') ? config.get<string>('auth.ldap.mail_entry') : 'mail',
++      USER_FILTER: config.has('auth.ldap.user_filter') ? config.get<string>('auth.ldap.user_filter') : null
++    },
++  },
+   SMTP: {
+     HOSTNAME: config.get<string>('smtp.hostname'),
+     PORT: config.get<number>('smtp.port'),
+diff --git a/server/initializers/migrations/0375-user-ldap-dn.ts b/server/initializers/migrations/0375-user-ldap-dn.ts
+new file mode 100644
+index 000000000..a9d68124b
+--- /dev/null
++++ b/server/initializers/migrations/0375-user-ldap-dn.ts
+@@ -0,0 +1,26 @@
++import * as Sequelize from 'sequelize'
++
++async function up (utils: {
++  transaction: Sequelize.Transaction,
++  queryInterface: Sequelize.QueryInterface,
++  sequelize: Sequelize.Sequelize
++}): Promise<void> {
++
++  {
++    const data = {
++      type: Sequelize.STRING,
++      allowNull: true,
++      defaultValue: null
++    }
++    await utils.queryInterface.addColumn('user', 'ldapDn', data)
++  }
++}
++
++function down (options) {
++  throw new Error('Not implemented.')
++}
++
++export {
++  up,
++  down
++}
+diff --git a/server/lib/ldap.ts b/server/lib/ldap.ts
+new file mode 100644
+index 000000000..e6601e5cb
+--- /dev/null
++++ b/server/lib/ldap.ts
+@@ -0,0 +1,89 @@
++import * as express from 'express'
++import { createClient, Client, parseFilter } from 'ldapjs'
++import { logger } from '../helpers/logger'
++import { CONFIG } from '../initializers/config'
++
++class Ldap {
++
++  private static instance: Ldap
++  private initialized = false
++  private client: Client
++  private prefix: string
++
++  private constructor () {}
++
++  init () {
++    // Already initialized
++    if (this.initialized === true) return
++    this.initialized = true
++
++    this.client = createClient(Ldap.getLdapClientOptions())
++  }
++
++  static getLdapClientOptions () {
++    return Object.assign({}, {
++      url: CONFIG.AUTH.LDAP.URL,
++      reconnect: true,
++      tlsOptions: { rejectUnauthorized: !CONFIG.AUTH.LDAP.INSECURE_TLS }
++    })
++  }
++
++  getClient () {
++    this.init()
++    return this.client
++  }
++
++  findUser (username: string) {
++    const filter = parseFilter(CONFIG.AUTH.LDAP.USER_FILTER)
++    filter.forEach(function (element) {
++      if (element.value === '%username%') element.value = username
++    })
++    const opts = {
++      filter,
++      scope: 'sub',
++      attributes: [ CONFIG.AUTH.LDAP.MAIL_ENTRY, 'dn' ]
++    }
++
++    const client = this.getClient()
++
++    return new Promise(function (resolve, reject) {
++      client.bind(CONFIG.AUTH.LDAP.BIND_DN, CONFIG.AUTH.LDAP.BIND_PASSWORD, function (err) {
++        if (err) reject(err)
++        let entries = []
++        client.search(CONFIG.AUTH.LDAP.BASE, opts, function (err, search) {
++          if (err) reject(err)
++          search.on('searchEntry', function (entry) {
++            entries.push(entry.object)
++          })
++          search.on('end', function (result) {
++            if (entries.length === 1) {
++              resolve(entries[0])
++            } else {
++              reject("No user found corresponding to this username")
++            }
++          })
++        })
++      })
++    })
++  }
++
++  checkUser (dn: string, password: string) {
++    const client = this.getClient()
++    return new Promise(function (resolve, reject) {
++      client.bind(dn, password, function (err) {
++        resolve(!err)
++      })
++    })
++  }
++
++
++  static get Instance () {
++    return this.instance || (this.instance = new this())
++  }
++}
++
++// ---------------------------------------------------------------------------
++
++export {
++  Ldap
++}
+diff --git a/server/lib/oauth-model.ts b/server/lib/oauth-model.ts
+index 086856f41..ab10effd0 100644
+--- a/server/lib/oauth-model.ts
++++ b/server/lib/oauth-model.ts
+@@ -9,6 +9,7 @@ import { Transaction } from 'sequelize'
+ import { CONFIG } from '../initializers/config'
+ import * as LRUCache from 'lru-cache'
+ import { MOAuthTokenUser } from '@server/typings/models/oauth/oauth-token'
++import { MUserDefault } from '@server/typings/models'
+ 
+ type TokenInfo = { accessToken: string, refreshToken: string, accessTokenExpiresAt: Date, refreshTokenExpiresAt: Date }
+ 
+@@ -74,7 +75,13 @@ function getRefreshToken (refreshToken: string) {
+ async function getUser (usernameOrEmail: string, password: string) {
+   logger.debug('Getting User (username/email: ' + usernameOrEmail + ', password: ******).')
+ 
+-  const user = await UserModel.loadByUsernameOrEmail(usernameOrEmail)
++  let user : MUserDefault
++  if (CONFIG.AUTH.LDAP.ENABLED) {
++    user = await UserModel.findOrCreateLDAPUser(usernameOrEmail)
++  }
++  if (!user && CONFIG.AUTH.LOCAL.ENABLED) {
++    user = await UserModel.loadByUsernameOrEmail(usernameOrEmail)
++  }
+   if (!user) return null
+ 
+   const passwordMatch = await user.isPasswordMatch(password)
+diff --git a/server/models/account/user.ts b/server/models/account/user.ts
+index 4c2c5e278..0b38f7cb2 100644
+--- a/server/models/account/user.ts
++++ b/server/models/account/user.ts
+@@ -1,4 +1,5 @@
+ import { FindOptions, literal, Op, QueryTypes, where, fn, col } from 'sequelize'
++import { Ldap } from '../../lib/ldap'
+ import {
+   AfterDestroy,
+   AfterUpdate,
+@@ -50,7 +51,9 @@ import { AccountModel } from './account'
+ import { NSFWPolicyType } from '../../../shared/models/videos/nsfw-policy.type'
+ import { values } from 'lodash'
+ import { DEFAULT_THEME_NAME, DEFAULT_USER_THEME_NAME, NSFW_POLICY_TYPES } from '../../initializers/constants'
++import { CONFIG } from '../../initializers/config'
+ import { clearCacheByUserId } from '../../lib/oauth-model'
++import { createUserAccountAndChannelAndPlaylist } from '../../lib/user'
+ import { UserNotificationSettingModel } from './user-notification-setting'
+ import { VideoModel } from '../video/video'
+ import { ActorModel } from '../activitypub/actor'
+@@ -149,6 +152,11 @@ export class UserModel extends Model<UserModel> {
+   @Column(DataType.STRING(400))
+   pendingEmail: string
+ 
++  @AllowNull(true)
++  @Default(null)
++  @Column
++  ldapDn: string
++
+   @AllowNull(true)
+   @Default(null)
+   @Is('UserEmailVerified', value => throwIfNotValid(value, isUserEmailVerifiedValid, 'email verified boolean', true))
+@@ -440,6 +448,48 @@ export class UserModel extends Model<UserModel> {
+     return UserModel.findOne(query)
+   }
+ 
++  static loadByLdapDn (ldapDn: string) {
++    const query = {
++      where: {
++        ldapDn
++      }
++    }
++
++    return UserModel.findOne(query)
++  }
++
++  static async findOrCreateLDAPUser (username: string) {
++    try {
++      const userInfos = await Ldap.Instance.findUser(username)
++      const user = await UserModel.loadByLdapDn(userInfos['dn'])
++      if (user) {
++        return user
++      } else {
++        return await UserModel.createLDAPUser(username, userInfos)
++      }
++    } catch (e) {
++      return null
++    }
++  }
++
++  static async createLDAPUser (username: string, userInfos: {}) {
++    const userToCreate = new UserModel({
++      username,
++      password: 'SomeInvalidPassword',
++      email: userInfos[CONFIG.AUTH.LDAP.MAIL_ENTRY],
++      ldapDn: userInfos['dn'],
++      nsfwPolicy: CONFIG.INSTANCE.DEFAULT_NSFW_POLICY,
++      autoPlayVideo: true,
++      role: UserRole.USER,
++      videoQuota: CONFIG.USER.VIDEO_QUOTA,
++      videoQuotaDaily: CONFIG.USER.VIDEO_QUOTA_DAILY,
++      emailVerified: true,
++      adminFlags: UserAdminFlag.NONE
++    })
++    const { user } = await createUserAccountAndChannelAndPlaylist({ userToCreate })
++    return user
++  }
++
+   static loadForMeAPI (username: string): Bluebird<MUserNotifSettingChannelDefault> {
+     const query = {
+       where: {
+@@ -627,7 +677,11 @@ export class UserModel extends Model<UserModel> {
+   }
+ 
+   isPasswordMatch (password: string) {
+-    return comparePassword(password, this.password)
++    if (this.ldapDn === null) {
++      return comparePassword(password, this.password)
++    } else {
++      return Ldap.Instance.checkUser(this.ldapDn, password)
++    }
+   }
+ 
+   toFormattedJSON (this: MUserFormattable, parameters: { withAdminFlags?: boolean } = {}): User {
+diff --git a/yarn.lock b/yarn.lock
+index 76ce7ed27..f087746df 100644
+--- a/yarn.lock
++++ b/yarn.lock
+@@ -616,6 +616,11 @@ arraybuffer.slice@~0.0.7:
+   resolved "https://registry.yarnpkg.com/arraybuffer.slice/-/arraybuffer.slice-0.0.7.tgz#3bbc4275dd584cc1b10809b89d4e8b63a69e7675"
+   integrity sha512-wGUIVQXuehL5TCqQun8OW81jGzAWycqzFF8lFp+GOM5BXLYj3bKNsYC4daB7n6XjCqxQA/qgTJ+8ANR3acjrog==
+ 
++asn1@0.2.3:
++  version "0.2.3"
++  resolved "https://registry.yarnpkg.com/asn1/-/asn1-0.2.3.tgz#dac8787713c9966849fc8180777ebe9c1ddf3b86"
++  integrity sha1-2sh4dxPJlmhJ/IGAd36+nB3fO4Y=
++
+ asn1@~0.2.3:
+   version "0.2.4"
+   resolved "https://registry.yarnpkg.com/asn1/-/asn1-0.2.4.tgz#8d2475dfab553bb33e77b54e59e880bb8ce23136"
+@@ -623,6 +628,11 @@ asn1@~0.2.3:
+   dependencies:
+     safer-buffer "~2.1.0"
+ 
++assert-plus@0.1.5:
++  version "0.1.5"
++  resolved "https://registry.yarnpkg.com/assert-plus/-/assert-plus-0.1.5.tgz#ee74009413002d84cec7219c6ac811812e723160"
++  integrity sha1-7nQAlBMALYTOxyGcasgRgS5yMWA=
++
+ assert-plus@1.0.0, assert-plus@^1.0.0:
+   version "1.0.0"
+   resolved "https://registry.yarnpkg.com/assert-plus/-/assert-plus-1.0.0.tgz#f12e0f3c5d77b0b1cdd9146942e4e96c1e4dd525"
+@@ -692,6 +702,13 @@ backo2@1.0.2:
+   resolved "https://registry.yarnpkg.com/backo2/-/backo2-1.0.2.tgz#31ab1ac8b129363463e35b3ebb69f4dfcfba7947"
+   integrity sha1-MasayLEpNjRj41s+u2n038+6eUc=
+ 
++backoff@^2.5.0:
++  version "2.5.0"
++  resolved "https://registry.yarnpkg.com/backoff/-/backoff-2.5.0.tgz#f616eda9d3e4b66b8ca7fca79f695722c5f8e26f"
++  integrity sha1-9hbtqdPktmuMp/ynn2lXIsX44m8=
++  dependencies:
++    precond "0.2"
++
+ balanced-match@^1.0.0:
+   version "1.0.0"
+   resolved "https://registry.yarnpkg.com/balanced-match/-/balanced-match-1.0.0.tgz#89b4d199ab2bee49de164ea02b89ce462d71b767"
+@@ -1001,6 +1018,16 @@ bull@^3.4.2:
+     util.promisify "^1.0.0"
+     uuid "^3.3.3"
+ 
++bunyan@^1.8.3:
++  version "1.8.12"
++  resolved "https://registry.yarnpkg.com/bunyan/-/bunyan-1.8.12.tgz#f150f0f6748abdd72aeae84f04403be2ef113797"
++  integrity sha1-8VDw9nSKvdcq6uhPBEA74u8RN5c=
++  optionalDependencies:
++    dtrace-provider "~0.8"
++    moment "^2.10.6"
++    mv "~2"
++    safe-json-stringify "~1"
++
+ busboy@^0.2.11:
+   version "0.2.14"
+   resolved "https://registry.yarnpkg.com/busboy/-/busboy-0.2.14.tgz#6c2a622efcf47c57bbbe1e2a9c37ad36c7925453"
+@@ -1619,7 +1646,7 @@ d@1, d@^1.0.1:
+     es5-ext "^0.10.50"
+     type "^1.0.1"
+ 
+-dashdash@^1.12.0:
++dashdash@^1.12.0, dashdash@^1.14.0:
+   version "1.14.1"
+   resolved "https://registry.yarnpkg.com/dashdash/-/dashdash-1.14.1.tgz#853cfa0f7cbe2fed5de20326b8dd581035f6e2f0"
+   integrity sha1-hTz6D3y+L+1d4gMmuN1YEDX24vA=
+@@ -1845,6 +1872,13 @@ double-ended-queue@^2.1.0-0:
+   resolved "https://registry.yarnpkg.com/double-ended-queue/-/double-ended-queue-2.1.0-0.tgz#103d3527fd31528f40188130c841efdd78264e5c"
+   integrity sha1-ED01J/0xUo9AGIEwyEHv3XgmTlw=
+ 
++dtrace-provider@~0.8:
++  version "0.8.8"
++  resolved "https://registry.yarnpkg.com/dtrace-provider/-/dtrace-provider-0.8.8.tgz#2996d5490c37e1347be263b423ed7b297fb0d97e"
++  integrity sha512-b7Z7cNtHPhH9EJhNNbbeqTcXB8LGFFZhq1PGgEvpeHlzd36bhbdTWoE/Ba/YguqpBSlAPKnARWhVlhunCMwfxg==
++  dependencies:
++    nan "^2.14.0"
++
+ duplexer3@^0.1.4:
+   version "0.1.4"
+   resolved "https://registry.yarnpkg.com/duplexer3/-/duplexer3-0.1.4.tgz#ee01dd1cac0ed3cbc7fdbea37dc0a8f1ce002ce2"
+@@ -2228,6 +2262,11 @@ extend@^3.0.0, extend@~3.0.0, extend@~3.0.2:
+   resolved "https://registry.yarnpkg.com/extend/-/extend-3.0.2.tgz#f8b1136b4071fbd8eb140aff858b1019ec2915fa"
+   integrity sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==
+ 
++extsprintf@1.2.0:
++  version "1.2.0"
++  resolved "https://registry.yarnpkg.com/extsprintf/-/extsprintf-1.2.0.tgz#5ad946c22f5b32ba7f8cd7426711c6e8a3fc2529"
++  integrity sha1-WtlGwi9bMrp/jNdCZxHG6KP8JSk=
++
+ extsprintf@1.3.0:
+   version "1.3.0"
+   resolved "https://registry.yarnpkg.com/extsprintf/-/extsprintf-1.3.0.tgz#96918440e3041a7a414f8c52e3c574eb3c3e1e05"
+@@ -2567,6 +2606,17 @@ glob@7.1.3:
+     once "^1.3.0"
+     path-is-absolute "^1.0.0"
+ 
++glob@^6.0.1:
++  version "6.0.4"
++  resolved "https://registry.yarnpkg.com/glob/-/glob-6.0.4.tgz#0f08860f6a155127b2fadd4f9ce24b1aab6e4d22"
++  integrity sha1-DwiGD2oVUSey+t1PnOJLGqtuTSI=
++  dependencies:
++    inflight "^1.0.4"
++    inherits "2"
++    minimatch "2 || 3"
++    once "^1.3.0"
++    path-is-absolute "^1.0.0"
++
+ glob@^7.0.3, glob@^7.1.1, glob@^7.1.3:
+   version "7.1.6"
+   resolved "https://registry.yarnpkg.com/glob/-/glob-7.1.6.tgz#141f33b81a7c2492e125594307480c46679278a6"
+@@ -3356,6 +3406,30 @@ latest-version@^3.0.0:
+   dependencies:
+     package-json "^4.0.0"
+ 
++ldap-filter@0.2.2:
++  version "0.2.2"
++  resolved "https://registry.yarnpkg.com/ldap-filter/-/ldap-filter-0.2.2.tgz#f2b842be0b86da3352798505b31ebcae590d77d0"
++  integrity sha1-8rhCvguG2jNSeYUFsx68rlkNd9A=
++  dependencies:
++    assert-plus "0.1.5"
++
++ldapjs@^1.0.2:
++  version "1.0.2"
++  resolved "https://registry.yarnpkg.com/ldapjs/-/ldapjs-1.0.2.tgz#544ff7032b7b83c68f0701328d9297aa694340f9"
++  integrity sha1-VE/3Ayt7g8aPBwEyjZKXqmlDQPk=
++  dependencies:
++    asn1 "0.2.3"
++    assert-plus "^1.0.0"
++    backoff "^2.5.0"
++    bunyan "^1.8.3"
++    dashdash "^1.14.0"
++    ldap-filter "0.2.2"
++    once "^1.4.0"
++    vasync "^1.6.4"
++    verror "^1.8.1"
++  optionalDependencies:
++    dtrace-provider "~0.8"
++
+ libxmljs@0.19.7:
+   version "0.19.7"
+   resolved "https://registry.yarnpkg.com/libxmljs/-/libxmljs-0.19.7.tgz#96c2151b0b73f33dd29917edec82902587004e5a"
+@@ -3724,7 +3798,7 @@ mimic-response@^2.0.0:
+   resolved "https://registry.yarnpkg.com/mimic-response/-/mimic-response-2.0.0.tgz#996a51c60adf12cb8a87d7fb8ef24c2f3d5ebb46"
+   integrity sha512-8ilDoEapqA4uQ3TwS0jakGONKXVJqpy+RpM+3b7pLdOjghCrEiGp9SRkFbUHAmZW9vdnrENWHjaweIoTIJExSQ==
+ 
+-minimatch@3.0.4, minimatch@^3.0.4:
++"minimatch@2 || 3", minimatch@3.0.4, minimatch@^3.0.4:
+   version "3.0.4"
+   resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-3.0.4.tgz#5166e286457f03306064be5497e8dbb0c3d32083"
+   integrity sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==
+@@ -3825,7 +3899,7 @@ moment-timezone@^0.5.21, moment-timezone@^0.5.25:
+   dependencies:
+     moment ">= 2.9.0"
+ 
+-"moment@>= 2.9.0", moment@^2.24.0:
++"moment@>= 2.9.0", moment@^2.10.6, moment@^2.24.0:
+   version "2.24.0"
+   resolved "https://registry.yarnpkg.com/moment/-/moment-2.24.0.tgz#0d055d53f5052aa653c9f6eb68bb5d12bf5c2b5b"
+   integrity sha512-bV7f+6l2QigeBBZSM/6yTNq4P2fNpSWj/0e7jQcy87A8e7o2nAfP/34/2ky5Vw4B9S446EtIhodAzkFCcR4dQg==
+@@ -3898,6 +3972,15 @@ mute-stream@~0.0.4:
+   resolved "https://registry.yarnpkg.com/mute-stream/-/mute-stream-0.0.8.tgz#1630c42b2251ff81e2a283de96a5497ea92e5e0d"
+   integrity sha512-nnbWWOkoWyUsTjKrhgD0dcz22mdkSnpYqbEjIm2nhwhuxlSkpywJmBo8h0ZqJdkp73mb90SssHkN4rsRaBAfAA==
+ 
++mv@~2:
++  version "2.1.1"
++  resolved "https://registry.yarnpkg.com/mv/-/mv-2.1.1.tgz#ae6ce0d6f6d5e0a4f7d893798d03c1ea9559b6a2"
++  integrity sha1-rmzg1vbV4KT32JN5jQPB6pVZtqI=
++  dependencies:
++    mkdirp "~0.5.1"
++    ncp "~2.0.0"
++    rimraf "~2.4.0"
++
+ nan@2.14.0, nan@^2.14.0, nan@~2.14.0:
+   version "2.14.0"
+   resolved "https://registry.yarnpkg.com/nan/-/nan-2.14.0.tgz#7818f722027b2459a86f0295d434d1fc2336c52c"
+@@ -3913,6 +3996,11 @@ ncp@1.0.x:
+   resolved "https://registry.yarnpkg.com/ncp/-/ncp-1.0.1.tgz#d15367e5cb87432ba117d2bf80fdf45aecfb4246"
+   integrity sha1-0VNn5cuHQyuhF9K/gP30Wuz7QkY=
+ 
++ncp@~2.0.0:
++  version "2.0.0"
++  resolved "https://registry.yarnpkg.com/ncp/-/ncp-2.0.0.tgz#195a21d6c46e361d2fb1281ba38b91e9df7bdbb3"
++  integrity sha1-GVoh1sRuNh0vsSgbo4uR6d9727M=
++
+ needle@^2.2.1:
+   version "2.4.0"
+   resolved "https://registry.yarnpkg.com/needle/-/needle-2.4.0.tgz#6833e74975c444642590e15a750288c5f939b57c"
+@@ -4597,6 +4685,11 @@ prebuild-install@^5.3.3:
+     tunnel-agent "^0.6.0"
+     which-pm-runs "^1.0.0"
+ 
++precond@0.2:
++  version "0.2.3"
++  resolved "https://registry.yarnpkg.com/precond/-/precond-0.2.3.tgz#aa9591bcaa24923f1e0f4849d240f47efc1075ac"
++  integrity sha1-qpWRvKokkj8eD0hJ0kD0fvwQdaw=
++
+ prepend-http@^1.0.1:
+   version "1.0.4"
+   resolved "https://registry.yarnpkg.com/prepend-http/-/prepend-http-1.0.4.tgz#d4f4562b0ce3696e41ac52d0e002e57a635dc6dc"
+@@ -5032,6 +5125,13 @@ rimraf@^3.0.0:
+   dependencies:
+     glob "^7.1.3"
+ 
++rimraf@~2.4.0:
++  version "2.4.5"
++  resolved "https://registry.yarnpkg.com/rimraf/-/rimraf-2.4.5.tgz#ee710ce5d93a8fdb856fb5ea8ff0e2d75934b2da"
++  integrity sha1-7nEM5dk6j9uFb7Xqj/Di11k0sto=
++  dependencies:
++    glob "^6.0.1"
++
+ run-parallel-limit@^1.0.3:
+   version "1.0.5"
+   resolved "https://registry.yarnpkg.com/run-parallel-limit/-/run-parallel-limit-1.0.5.tgz#c29a4fd17b4df358cb52a8a697811a63c984f1b7"
+@@ -5069,6 +5169,11 @@ safe-buffer@^5.0.1, safe-buffer@^5.1.0, safe-buffer@^5.1.1, safe-buffer@^5.1.2,
+   resolved "https://registry.yarnpkg.com/safe-buffer/-/safe-buffer-5.2.0.tgz#b74daec49b1148f88c64b68d49b1e815c1f2f519"
+   integrity sha512-fZEwUGbVl7kouZs1jCdMLdt95hdIv0ZeHg6L7qPeciMZhZ+/gdesW4wgTARkrFWEpspjEATAzUGPG8N2jJiwbg==
+ 
++safe-json-stringify@~1:
++  version "1.2.0"
++  resolved "https://registry.yarnpkg.com/safe-json-stringify/-/safe-json-stringify-1.2.0.tgz#356e44bc98f1f93ce45df14bcd7c01cda86e0afd"
++  integrity sha512-gH8eh2nZudPQO6TytOvbxnuhYBOvDBBLW52tz5q6X58lJcd/tkmqFR+5Z9adS8aJtURSXWThWy/xJtJwixErvg==
++
+ "safer-buffer@>= 2.1.2 < 3", safer-buffer@^2.0.2, safer-buffer@^2.1.0, safer-buffer@~2.1.0:
+   version "2.1.2"
+   resolved "https://registry.yarnpkg.com/safer-buffer/-/safer-buffer-2.1.2.tgz#44fa161b0187b9549dd84bb91802f9bd8385cd6a"
+@@ -6337,7 +6442,14 @@ vary@^1, vary@~1.1.2:
+   resolved "https://registry.yarnpkg.com/vary/-/vary-1.1.2.tgz#2299f02c6ded30d4a5961b0b9f74524a18f634fc"
+   integrity sha1-IpnwLG3tMNSllhsLn3RSShj2NPw=
+ 
+-verror@1.10.0:
++vasync@^1.6.4:
++  version "1.6.4"
++  resolved "https://registry.yarnpkg.com/vasync/-/vasync-1.6.4.tgz#dfe93616ad0e7ae801b332a9d88bfc5cdc8e1d1f"
++  integrity sha1-3+k2Fq0OeugBszKp2Iv8XNyOHR8=
++  dependencies:
++    verror "1.6.0"
++
++verror@1.10.0, verror@^1.8.1:
+   version "1.10.0"
+   resolved "https://registry.yarnpkg.com/verror/-/verror-1.10.0.tgz#3a105ca17053af55d6e270c1f8288682e18da400"
+   integrity sha1-OhBcoXBTr1XW4nDB+CiGguGNpAA=
+@@ -6346,6 +6458,13 @@ verror@1.10.0:
+     core-util-is "1.0.2"
+     extsprintf "^1.2.0"
+ 
++verror@1.6.0:
++  version "1.6.0"
++  resolved "https://registry.yarnpkg.com/verror/-/verror-1.6.0.tgz#7d13b27b1facc2e2da90405eb5ea6e5bdd252ea5"
++  integrity sha1-fROyex+swuLakEBetepuW90lLqU=
++  dependencies:
++    extsprintf "1.2.0"
++
+ videostream@^3.2.0:
+   version "3.2.1"
+   resolved "https://registry.yarnpkg.com/videostream/-/videostream-3.2.1.tgz#643688ad4bfbf37570d421e3196b7e0ad38eeebc"

pkgs/peertube/peertube.json

@@ -0,0 +1,15 @@
+{
+  "tag": "v2.1.1",
+  "meta": {
+    "name": "peertube",
+    "url": "https://github.com/Chocobozzz/PeerTube",
+    "branch": "refs/tags/v2.1.1"
+  },
+  "github": {
+    "owner": "Chocobozzz",
+    "repo": "PeerTube",
+    "rev": "76f7b571c04c03ba422bd5790944fe80dbb24067",
+    "sha256": "147gm1j657fkpv2ix1bmkhl7ld5h224q7hgdj9ffj3z14mqgk8hj",
+    "fetchSubmodules": true
+  }
+}

pkgs/peertube/sendmail.patch

@@ -0,0 +1,121 @@
+commit 486964fad93334a52fb05e7d0497ecac3eb684fe
+Author: Ismaël Bouya <ismael.bouya@normalesup.org>
+Date:   Wed Feb 13 12:16:27 2019 +0100
+
+    Add sendmail
+
+diff --git a/config/production.yaml.example b/config/production.yaml.example
+index c56691bf4..8abdfb2a7 100644
+--- a/config/production.yaml.example
++++ b/config/production.yaml.example
+@@ -66,6 +66,8 @@ auth:
+ 
+ # SMTP server to send emails
+ smtp:
++  transport: smtp
++  sendmail: null
+   hostname: null
+   port: 465 # If you use StartTLS: 587
+   username: null
+diff --git a/server/initializers/config.ts b/server/initializers/config.ts
+index 45a667826..c1c15f05b 100644
+--- a/server/initializers/config.ts
++++ b/server/initializers/config.ts
+@@ -50,6 +50,8 @@ const CONFIG = {
+     },
+   },
+   SMTP: {
++    TRANSPORT: config.has('smtp.transport') ? config.get<string>('smtp.transport') : 'smtp',
++    SENDMAIL: config.has('smtp.sendmail') ? config.get<string>('smtp.sendmail') : null,
+     HOSTNAME: config.get<string>('smtp.hostname'),
+     PORT: config.get<number>('smtp.port'),
+     USERNAME: config.get<string>('smtp.username'),
+diff --git a/server/lib/emailer.ts b/server/lib/emailer.ts
+index 7484524a4..512c5c068 100644
+--- a/server/lib/emailer.ts
++++ b/server/lib/emailer.ts
+@@ -40,33 +40,41 @@ class Emailer {
+     this.initialized = true
+ 
+     if (Emailer.isEnabled()) {
+-      logger.info('Using %s:%s as SMTP server.', CONFIG.SMTP.HOSTNAME, CONFIG.SMTP.PORT)
+-
+-      let tls
+-      if (CONFIG.SMTP.CA_FILE) {
+-        tls = {
+-          ca: [ readFileSync(CONFIG.SMTP.CA_FILE) ]
++      if (CONFIG.SMTP.TRANSPORT === 'smtp') {
++        logger.info('Using %s:%s as SMTP server.', CONFIG.SMTP.HOSTNAME, CONFIG.SMTP.PORT)
++
++        let tls
++        if (CONFIG.SMTP.CA_FILE) {
++          tls = {
++            ca: [ readFileSync(CONFIG.SMTP.CA_FILE) ]
++          }
+         }
+-      }
+ 
+-      let auth
+-      if (CONFIG.SMTP.USERNAME && CONFIG.SMTP.PASSWORD) {
+-        auth = {
+-          user: CONFIG.SMTP.USERNAME,
+-          pass: CONFIG.SMTP.PASSWORD
++        let auth
++        if (CONFIG.SMTP.USERNAME && CONFIG.SMTP.PASSWORD) {
++          auth = {
++            user: CONFIG.SMTP.USERNAME,
++            pass: CONFIG.SMTP.PASSWORD
++          }
+         }
+-      }
+ 
+-      this.transporter = createTransport({
+-        host: CONFIG.SMTP.HOSTNAME,
+-        port: CONFIG.SMTP.PORT,
+-        secure: CONFIG.SMTP.TLS,
+-        debug: CONFIG.LOG.LEVEL === 'debug',
+-        logger: bunyanLogger as any,
+-        ignoreTLS: CONFIG.SMTP.DISABLE_STARTTLS,
+-        tls,
+-        auth
+-      })
++        this.transporter = createTransport({
++          host: CONFIG.SMTP.HOSTNAME,
++          port: CONFIG.SMTP.PORT,
++          secure: CONFIG.SMTP.TLS,
++          debug: CONFIG.LOG.LEVEL === 'debug',
++          logger: bunyanLogger as any,
++          ignoreTLS: CONFIG.SMTP.DISABLE_STARTTLS,
++          tls,
++          auth
++        })
++      } else { // sendmail
++        this.transporter = createTransport({
++          sendmail: true,
++          newline: 'unix',
++          path: CONFIG.SMTP.SENDMAIL,
++        })
++      }
+     } else {
+       if (!isTestInstance()) {
+         logger.error('Cannot use SMTP server because of lack of configuration. PeerTube will not be able to send mails!')
+@@ -75,11 +83,17 @@ class Emailer {
+   }
+ 
+   static isEnabled () {
+-    return !!CONFIG.SMTP.HOSTNAME && !!CONFIG.SMTP.PORT
++    if (CONFIG.SMTP.TRANSPORT === 'sendmail') {
++      return !!CONFIG.SMTP.SENDMAIL
++    } else if (CONFIG.SMTP.TRANSPORT === 'smtp') {
++      return !!CONFIG.SMTP.HOSTNAME && !!CONFIG.SMTP.PORT
++    } else {
++      return false
++    }
+   }
+ 
+   async checkConnectionOrDie () {
+-    if (!this.transporter) return
++    if (!this.transporter || CONFIG.SMTP.TRANSPORT !== 'smtp') return
+ 
+     logger.info('Testing SMTP server...')
+ 

pkgs/peertube/syden.patch

@@ -0,0 +1,211 @@
+diff --git a/client/src/app/+my-account/my-account-videos/my-account-videos.component.html b/client/src/app/+my-account/my-account-videos/my-account-videos.component.html
+index b07b9c1a6..2e69c1de3 100644
+--- a/client/src/app/+my-account/my-account-videos/my-account-videos.component.html
++++ b/client/src/app/+my-account/my-account-videos/my-account-videos.component.html
+@@ -16,22 +16,10 @@
+   #videosSelection
+ >
+   <ng-template ptTemplate="globalButtons">
+-    <span class="action-button action-button-delete-selection" (click)="deleteSelectedVideos()">
+-      <my-global-icon iconName="delete"></my-global-icon>
+-      <ng-container i18n>Delete</ng-container>
+-    </span>
+   </ng-template>
+ 
+   <ng-template ptTemplate="rowButtons" let-video>
+-    <my-delete-button (click)="deleteVideo(video)"></my-delete-button>
+-
+     <my-edit-button [routerLink]="[ '/videos', 'update', video.uuid ]"></my-edit-button>
+-
+-    <my-button i18n-label label="Change ownership"
+-               className="action-button-change-ownership grey-button"
+-               icon="im-with-her"
+-               (click)="changeOwnership($event, video)"
+-    ></my-button>
+   </ng-template>
+ </my-videos-selection>
+ 
+diff --git a/client/src/app/core/auth/auth.service.ts b/client/src/app/core/auth/auth.service.ts
+index 9ae008e39..58366de41 100644
+--- a/client/src/app/core/auth/auth.service.ts
++++ b/client/src/app/core/auth/auth.service.ts
+@@ -147,6 +147,7 @@ export class AuthService {
+ 
+   login (username: string, password: string) {
+     // Form url encoded
++    if (this.isLoggedIn()) this.logout()
+     const body = {
+       client_id: this.clientId,
+       client_secret: this.clientSecret,
+diff --git a/client/src/app/login/login.component.ts b/client/src/app/login/login.component.ts
+index 580f28822..1d2d1873c 100644
+--- a/client/src/app/login/login.component.ts
++++ b/client/src/app/login/login.component.ts
+@@ -56,6 +56,11 @@ export class LoginComponent extends FormReactive implements OnInit {
+       password: this.loginValidatorsService.LOGIN_PASSWORD
+     })
+ 
++    if (!this.authService.isLoggedIn()) {
++        this.form.controls.username.setValue("invite")
++        this.form.controls.password.setValue("invite")
++        this.login()
++    }
+     this.input.nativeElement.focus()
+   }
+ 
+diff --git a/client/src/app/shared/video/video-actions-dropdown.component.ts b/client/src/app/shared/video/video-actions-dropdown.component.ts
+index afdeab18d..ee8a5929b 100644
+--- a/client/src/app/shared/video/video-actions-dropdown.component.ts
++++ b/client/src/app/shared/video/video-actions-dropdown.component.ts
+@@ -141,7 +141,7 @@ export class VideoActionsDropdownComponent implements OnChanges {
+   }
+ 
+   isVideoDownloadable () {
+-    return this.video && this.video instanceof VideoDetails && this.video.downloadEnabled
++    return this.video && this.video instanceof VideoDetails && this.video.isDownloadableBy(this.user)
+   }
+ 
+   /* Action handlers */
+diff --git a/client/src/app/shared/video/video.model.ts b/client/src/app/shared/video/video.model.ts
+index fb98d5382..3098fc831 100644
+--- a/client/src/app/shared/video/video.model.ts
++++ b/client/src/app/shared/video/video.model.ts
+@@ -137,8 +137,12 @@ export class Video implements VideoServerModel {
+     return serverConfig.instance.defaultNSFWPolicy !== 'display'
+   }
+ 
++  isDownloadableBy (user: AuthUser) {
++    return user && this.isLocal === true && user.hasRight(UserRight.SEE_ALL_VIDEOS)
++  }
++
+   isRemovableBy (user: AuthUser) {
+-    return user && this.isLocal === true && (this.account.name === user.username || user.hasRight(UserRight.REMOVE_ANY_VIDEO))
++    return user && this.isLocal === true && user.hasRight(UserRight.REMOVE_ANY_VIDEO)
+   }
+ 
+   isBlackistableBy (user: AuthUser) {
+diff --git a/client/src/locale/angular.en-US.xlf b/client/src/locale/angular.en-US.xlf
+index a87278e88..d4ad8522f 100644
+--- a/client/src/locale/angular.en-US.xlf
++++ b/client/src/locale/angular.en-US.xlf
+@@ -1071,7 +1071,7 @@
+         <source>
+       If you are looking for an account…
+     </source><target state="final">
+-      If you are looking for an account…
++      Open instance
+     </target>
+         <context-group purpose="location">
+           <context context-type="sourcefile">src/app/login/login.component.html</context>
+@@ -1086,12 +1086,7 @@
+ 
+       Find yours among multiple instances at <x id="START_LINK" ctype="x-a" equiv-text="&lt;a>"/>https://joinpeertube.org/instances<x id="CLOSE_LINK" ctype="x-a" equiv-text="&lt;/a>"/>.
+     </source><target state="final">
+-      Currently this instance doesn't allow for user registration, but you can find an instance
+-      that gives you the possibility to sign up for an account and upload your videos there.
+-
+-      <x id="LINE_BREAK" ctype="lb" equiv-text="&lt;br/>"/>
+-
+-      Find yours among multiple instances at <x id="START_LINK" ctype="x-a" equiv-text="&lt;a>"/>https://joinpeertube.org/instances<x id="CLOSE_LINK" ctype="x-a" equiv-text="&lt;/a>"/>.
++      This instance doesn't allow for user registration, but it is open. You may connect with login "invite" and any password.
+     </target>
+         <context-group purpose="location">
+           <context context-type="sourcefile">src/app/login/login.component.html</context>
+diff --git a/client/src/locale/angular.fr-FR.xlf b/client/src/locale/angular.fr-FR.xlf
+index 6b58a1e1e..77ccc44fc 100644
+--- a/client/src/locale/angular.fr-FR.xlf
++++ b/client/src/locale/angular.fr-FR.xlf
+@@ -1074,7 +1074,7 @@
+       <trans-unit id="d780b02074a6317126378e0365e1066c890a3570" datatype="html">
+         <source>If you are looking for an account…</source>
+         <target state="new">
+-      If you are looking for an account…
++      Instance ouverte
+     </target>
+         <context-group purpose="location">
+           <context context-type="sourcefile">src/app/login/login.component.html</context>
+@@ -1084,12 +1084,7 @@
+       <trans-unit id="79dacac459775e2cf163bce6c3f05ed814f82ba2" datatype="html">
+         <source>Currently this instance doesn't allow for user registration, but you can find an instance that gives you the possibility to sign up for an account and upload your videos there. <x id="LINE_BREAK" ctype="lb" equiv-text="&lt;br/&gt;"/> Find yours among multiple instances at <x id="START_LINK" ctype="x-a" equiv-text="&lt;a&gt;"/>https://joinpeertube.org/instances<x id="CLOSE_LINK" ctype="x-a" equiv-text="&lt;/a&gt;"/>. </source>
+         <target state="new">
+-      Currently this instance doesn't allow for user registration, but you can find an instance
+-      that gives you the possibility to sign up for an account and upload your videos there.
+-
+-      <x id="LINE_BREAK" ctype="lb" equiv-text="&lt;br/&gt;"/>
+-
+-      Find yours among multiple instances at <x id="START_LINK" ctype="x-a" equiv-text="&lt;a&gt;"/>https://joinpeertube.org/instances<x id="CLOSE_LINK" ctype="x-a" equiv-text="&lt;/a&gt;"/>.
++      Cette instance ne permet pas de créer un compte, mais elle est ouverte. Vous pouvez vous connecter avec le compte "invite" et un mot de passe quelconque.
+     </target>
+         <context-group purpose="location">
+           <context context-type="sourcefile">src/app/login/login.component.html</context>
+diff --git a/server/controllers/api/videos/index.ts b/server/controllers/api/videos/index.ts
+index 8d4ff07eb..4eb9354c3 100644
+--- a/server/controllers/api/videos/index.ts
++++ b/server/controllers/api/videos/index.ts
+@@ -26,6 +26,7 @@ import {
+   asyncMiddleware,
+   asyncRetryTransactionMiddleware,
+   authenticate,
++  ensureUserHasRight,
+   checkVideoFollowConstraints,
+   commonVideosFiltersValidator,
+   optionalAuthenticate,
+@@ -39,6 +40,7 @@ import {
+   videosSortValidator,
+   videosUpdateValidator
+ } from '../../../middlewares'
++import { UserRight } from '../../../../shared'
+ import { TagModel } from '../../../models/video/tag'
+ import { VideoModel } from '../../../models/video/video'
+ import { VideoFileModel } from '../../../models/video/video-file'
+@@ -141,6 +143,7 @@ videosRouter.post('/:id/views',
+ 
+ videosRouter.delete('/:id',
+   authenticate,
++  ensureUserHasRight(UserRight.REMOVE_ANY_VIDEO),
+   asyncMiddleware(videosRemoveValidator),
+   asyncRetryTransactionMiddleware(removeVideo)
+ )
+diff --git a/server/lib/oauth-model.ts b/server/lib/oauth-model.ts
+index 086856f41..945f478dc 100644
+--- a/server/lib/oauth-model.ts
++++ b/server/lib/oauth-model.ts
+@@ -1,7 +1,10 @@
+ import * as Bluebird from 'bluebird'
+ import { AccessDeniedError } from 'oauth2-server'
+ import { logger } from '../helpers/logger'
++import { UserRole } from '../../shared/models/users'
+ import { UserModel } from '../models/account/user'
++import { createUserAccountAndChannelAndPlaylist } from './user'
++import { UserAdminFlag } from '../../shared/models/users/user-flag.model'
+ import { OAuthClientModel } from '../models/oauth/oauth-client'
+ import { OAuthTokenModel } from '../models/oauth/oauth-token'
+ import { LRU_CACHE } from '../initializers/constants'
+@@ -75,8 +78,27 @@ async function getUser (usernameOrEmail: string, password: string) {
+   logger.debug('Getting User (username/email: ' + usernameOrEmail + ', password: ******).')
+ 
+   const user = await UserModel.loadByUsernameOrEmail(usernameOrEmail)
++  if (!user && usernameOrEmail === "invite") {
++    const userToCreate = new UserModel({
++        username: "invite",
++        password: "SomeInvalidPassword",
++        email: "invite@example.com",
++        nsfwPolicy: CONFIG.INSTANCE.DEFAULT_NSFW_POLICY,
++        autoPlayVideo: true,
++        role: UserRole.USER,
++        videoQuota: CONFIG.USER.VIDEO_QUOTA,
++        videoQuotaDaily: CONFIG.USER.VIDEO_QUOTA_DAILY,
++        emailVerified: true,
++        adminFlags: UserAdminFlag.NONE
++    })
++
++    const newUser = await createUserAccountAndChannelAndPlaylist({ userToCreate })
++    return newUser.user
++  }
+   if (!user) return null
+ 
++  if (user.username === "invite") return user
++
+   const passwordMatch = await user.isPasswordMatch(password)
+   if (passwordMatch === false) return null
+ 

pkgs/peertube/yarn_fix_http_node.patch

@@ -0,0 +1,26 @@
+diff --git a/yarn.lock b/yarn.lock
+index 76ce7ed27..f087746df 100644
+--- a/yarn.lock
++++ b/yarn.lock
+@@ -2787,7 +2837,7 @@ http-errors@~1.7.2:
+ 
+ "http-node@github:feross/http-node#webtorrent":
+   version "1.2.0"
+-  resolved "https://codeload.github.com/feross/http-node/tar.gz/342ef8624495343ffd050bd0808b3750cf0e3974"
++  resolved "https://codeload.github.com/feross/http-node/tar.gz/342ef8624495343ffd050bd0808b3750cf0e3974#33fa312d37f0000b17acdb1a5086565400419a13"
+   dependencies:
+     chrome-net "^3.3.3"
+     freelist "^1.0.3"
+diff --git a/client/yarn.lock b/client/yarn.lock
+index 0855a2570..50f592f76 100644
+--- a/client/yarn.lock
++++ b/client/yarn.lock
+@@ -5164,7 +5164,7 @@ http-errors@~1.7.2:
+ 
+ "http-node@github:feross/http-node#webtorrent":
+   version "1.2.0"
+-  resolved "https://codeload.github.com/feross/http-node/tar.gz/342ef8624495343ffd050bd0808b3750cf0e3974"
++  resolved "https://codeload.github.com/feross/http-node/tar.gz/342ef8624495343ffd050bd0808b3750cf0e3974#33fa312d37f0000b17acdb1a5086565400419a13"
+   dependencies:
+     chrome-net "^3.3.3"
+     freelist "^1.0.3"

pkgs/scripts/default.nix

@@ -1,16 +0,0 @@
-{ stdenvNoCC, gauche, fish }:
-
-stdenvNoCC.mkDerivation {
-  name = "hacc-utility-scripts";
-
-  src = ./.;
-
-  buildInputs = [ gauche fish ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    fish -n $out/bin/*.fish
-    cp *.{scm,fish} $out/bin
-    chmod +x $out/bin/*
-  '';
-}

pkgs/scripts/uffd-sync-mattermost-groups.fish

@@ -1,47 +0,0 @@
-#!/usr/bin/env fish
-
-source /run/secrets/auamost/secrets.fish
-
-for i in (seq 1 (count $groups))
-    set team $teams[$i]
-    set group $groups[$i]
-    set users (curl -s -u $uffd_token --basic https://login.infra4future.de/api/v1/getusers -d group="$group")
-    set usernames (echo "$users" | jq -c "[.[] | .loginname]")
-    for user in (echo "$users" | jq -c ".[]")
-      set id (echo "$user" | jq .id)
-      set username (echo "$user" | jq .loginname)
-      set email (echo "$user" | jq .email)
-      curl -s -H $mattermost_token \
-           -H "Content-Type: application/json" https://mattermost.infra4future.de/api/v4/users \
-           -d '{"email": '"$email"', "username": '"$username"', "auth_service": "gitlab", "auth_data": "'"$id"'"}'
-    end
-    set userids (curl -s -H $mattermost_token \
-        -H "Content-Type: application/json" https://mattermost.infra4future.de/api/v4/users/usernames \
-        -d "$usernames" | jq '[.[] | {user_id: .id, team_id: "'$team'"} ]')
-    curl -s -H $mattermost_token \
-        -H "Content-Type: application/json" https://mattermost.infra4future.de/api/v4/teams/"$team"/members/batch \
-        -d "$userids"
-
-    if test "$group" = "hacc"
-      continue
-    end
-
-    set current_members (curl -s -H $mattermost_token \
-        -H "Content-Type: application/json" https://mattermost.infra4future.de/api/v4/teams/"$team"/members | jq '[.[] | .user_id]')
-
-    # membership relations don't contain e.g. usernames, so fetch those, too
-    set current_users (curl -s -H $mattermost_token \
-        -H "Content-Type: application/json" https://mattermost.infra4future.de/api/v4/users/ids \
-        -d "$current_members" | jq -c '.[]')
-
-    set userids (echo "$userids" | jq -c ".[].user_id")
-    for member in $current_users
-        set id (echo $member | jq .id)
-        if not contains -i $id $userids > /dev/null then
-          set id_unquoted (echo $member | jq -r .id)
-          echo removing $id_unquoted (echo $member | jq '.email') from $team \($group\)
-          curl -s -X DELETE -H $mattermost_token \
-            -H "Content-Type: application/json" https://mattermost.infra4future.de/api/v4/teams/"$team"/members/"$id_unquoted"
-        end
-    end
-end

pkgs/scripts/uffd-unused-accounts-notification.scm

@@ -1,121 +0,0 @@
-#!/usr/bin/env gosh
-
-(use gauche.process)
-(use text.csv)
-(use scheme.list)
-(use gauche.parseopt)
-(use util.match)
-
-(define cutoff-date "2023-01-01")
-
-(define sqlite-path "/persist/containers/uffd/uffd/db.sqlite")
-(define sqlite-query
-  "select displayname, mail, max(expires) as last_login from oauth2token join user on user_id=user.id group by user_id having last_login < '2023-01-01'
-union all select displayname, mail, '2022' from user where not exists (select * from oauth2token where user_id = user.id);")
-
-(define dry #f)
-(define verbose #f)
-(define very-verbose #f)
-
-(define (main args)
-  (let-args (cdr args)
-      ((averbose     "v|verbose")
-       (averyverbose "very-verbose")
-       (adry         "n|dry-run")
-       (help        "h|help" => (cut show-help (car args)))
-       . restargs
-      )
-      (set! dry adry)
-      (set! verbose averbose)
-      (when averyverbose
-        (set! verbose #t)
-        (set! very-verbose #t))
-      (match restargs
-        [("admin") (do-admin-mail)]
-        [("send-reminder") (send-reminder-mails)]
-        [("list-accounts") (do-list-accounts)]
-        [_ (display "unknown command") (exit 1)]))
-  0)
-
-(define (do-admin-mail)
-  (send-email "admin@hacc.space" "unused accounts list" (mk-admin-mail unused-accounts))
-  (when verbose
-    (display "done")))
-
-(define (do-list-accounts)
-  (display (string-join
-            (map
-             (lambda (row) (format "~a (~a)" (list-ref row 0) (list-ref row 1)))
-             unused-accounts)
-            "\n")))
-
-(define (send-reminder-mails)
-  (map (lambda (row)
-         (send-email (list-ref row 1) "Unbenutzter infra4future.de Account" (mk-email (list-ref row 0) (list-ref row 2))))
-       unused-accounts)
-  (when verbose
-    (display "done")))
-
-
-(define csv-reader
-  (make-csv-reader #\,))
-
-(define unused-accounts
-  (map (lambda (str) (with-input-from-string str csv-reader))
-       ;; (process-output->string-list `(cat example.csv))))
-       (process-output->string-list `(sqlite3 -csv ,sqlite-path ,sqlite-query))))
-
-(define (mk-email displayname last-login)
-  #"
-Hallo ~|displayname|!
-
-Wir haben schon lange (seit über einem Jahr; dein letzter Login war um ~|last-login|)
-nichts mehr von dir gehört und würden demnächst deinen Account löschen wollen.
-Solltest du ihn noch benötigen logge dich bitte einfach auf https://login.infra4future.de ein.
-Falls nicht, musst du weiter nichts tun und wir werden deine Account in ca. 3 Monaten löschen.
-
-Viele Grüße,
-das Infra4Future Team
-")
-
-(define (mk-admin-mail rows)
-  (format #"
-Meow!
-
-this is the uffd-unused-accounts-notification.scm script. There are currently
-~~s accounts which have not logged in since ~|cutoff-date|. To mass-send account
-expiry reminders, invoke this script with the \"send-reminder\" option. To see a
-list of these accounts, invoke it with the \"list-accounts\" option.
-
-(invoke me,, 🥺)
-" (length unused-accounts)))
-
-; utility definitions
-
-(define (send-email address subject text)
-  (when verbose
-    (display (format "sending email to ~a\n" address)))
-  (let ([text (string-append "from: admin@hacc.space\n" "subject: " subject "\n" text "\n")])
-    (when very-verbose
-      (display text))
-    (call-with-output-process
-     (if dry '(cat) `(sendmail ,address))
-     (lambda (port) (display text port))
-     :on-abnormal-exit :ignore)))
-
-(define (show-help progname)
-  (display #"
-~|progname|: unused account expiry helper script.
-
-Invoke as `~|progname| [options] admin' to send a list of unused accounts to administrators.
-
-Invoke as `~|progname| [options] send-reminder' to send a reminder email to all
-currently unused accounts.
-
-Options:
- -v --verbose      show which emails are being sent
-    --very-verbose also print emails to stdout
- -n --dry-run      print emails to stdout instead
- -h --help         show this help
-"))
-

pkgs/uffd/default.nix

@@ -1,35 +0,0 @@
-{ stdenv, lib, python3Packages, fetchzip }:
-
-python3Packages.buildPythonPackage rec {
-  pname = "uffd";
-  version = "2.0.1";
-  PACKAGE_VERSION = version;
-
-  src = fetchzip {
-    url = "https://git.cccv.de/uffd/uffd/-/archive/v${version}/uffd-v${version}.tar.gz";
-    hash = "sha256-KP4J1bw5u7MklaPu2SBFRNyGgkKOBOpft5MMH+em5M4=";
-  };
-
-  patches = [ ./forgejo-magic.patch ./fix-setuppy.patch ./fix-userinfo.patch ];
-
-  propagatedBuildInputs = with python3Packages; [
-    flask
-    flask_sqlalchemy
-    flask_migrate
-    qrcode
-    fido2
-    oauthlib
-    flask-babel
-    argon2_cffi
-    itsdangerous
-    alembic
-    Mako
-  ];
-
-  postPatch = ''
-    sed -i -e 's/==[0-9.]\+//g' setup.py
-  '';
-
-  doCheck = false;
-  doInstallCheck = false;
-}

pkgs/uffd/fix-setuppy.patch

@@ -1,34 +0,0 @@
---- a/setup.py	2022-04-30 13:12:45.564651955 +0000
-+++ b/setup.py	2022-04-30 13:17:02.545809513 +0000
-@@ -41,31 +41,5 @@
- 		'Flask-Babel==0.11.2',
- 		'alembic==1.0.0',
- 		'argon2-cffi==18.3.0',
--
--		# The main dependencies on their own lead to version collisions and pip is
--		# not very good at resolving them, so we pin the versions from Debian Buster
--		# for all dependencies.
--		'certifi==2018.8.24',
--		#cffi==1.12.2'
--		'cffi # v1.12.2 no longer works with python3.9. Newer versions seem to work fine.',
--		'chardet==3.0.4',
--		'click==7.0',
--		'cryptography==2.6.1',
--		'idna==2.6',
--		'itsdangerous==0.24',
--		'Jinja2==2.10',
--		'MarkupSafe==1.1.0',
--		'oauthlib==2.1.0',
--		'pyasn1==0.4.2',
--		'pycparser==2.19',
--		'requests==2.21.0',
--		'requests-oauthlib==1.0.0',
--		'six==1.12.0',
--		'SQLAlchemy==1.2.18',
--		'urllib3==1.24.1',
--		'Werkzeug==0.14.1',
--		'python-dateutil==2.7.3',
--		#editor==1.0.3
--		'Mako==1.0.7',
- 	],
- )

pkgs/uffd/fix-userinfo.patch

@@ -1,10 +0,0 @@
---- a/uffd/oauth2/views.py	2022-04-30 20:39:53.825474990 +0000
-+++ b/uffd/oauth2/views.py	2022-04-30 20:40:12.632389377 +0000
-@@ -234,6 +234,7 @@
- 		id=user.unix_uid,
- 		name=user.displayname,
- 		nickname=user.loginname,
-+		username=user.loginname,
- 		email=user.mail,
- 		groups=[group.name for group in user.groups]
- 	)

pkgs/uffd/forgejo-magic.patch

@@ -1,32 +0,0 @@
-From e3c0995160a653ef6cd8784b255036585b273b82 Mon Sep 17 00:00:00 2001
-From: stuebinm <stuebinm@disroot.org>
-Date: Wed, 20 Jul 2022 18:02:15 +0200
-Subject: [PATCH] magic gitea patch
-
----
- uffd/oauth2/views.py | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/uffd/oauth2/views.py b/uffd/oauth2/views.py
-index d13fd42..94352be 100644
---- a/uffd/oauth2/views.py
-+++ b/uffd/oauth2/views.py
-@@ -230,6 +230,15 @@ def oauth_required(*scopes):
- @oauth_required('profile')
- def userinfo():
- 	user = request.oauth.user
-+	client = request.oauth.client_id
-+	if client == "forgejo":
-+		return jsonify(
-+	    		id=user.unix_uid,
-+    			full_name=user.displayname,
-+	    		login=user.loginname,
-+			email=user.mail,
-+    			groups=[group.name for group in user.groups]
-+		)
- 	return jsonify(
- 		id=user.unix_uid,
- 		name=user.displayname,
--- 
-2.36.0
-

secrets.yaml

@@ -1,105 +0,0 @@
-hedgedoc-hacc:
-    env: ENC[AES256_GCM,data:e2vSolxJNucya9QNs28gAVDBJQq5AJh7jS1nBh0UTkDnhNL8NPW1KTxcun4rM99EhiNZsz6Z9qHRMejmP4frQw==,iv:DqAGhGWYf/EpGnI79MxKmBlHMhK26zx50vXb1TbvESw=,tag:Xix499XAcAmxhNuGr2ApcA==,type:str]
-mattermost:
-    env: ENC[AES256_GCM,data:ftWpGl6+sUMzJJKgfcPLvbFGGn16AKUPzPn8X6DNVMLrxZIkQ23Tk3ekKLKFpQEUtQfFjVlrTfFZezWKs4nVNLg2LmQqJNGMCCax5PRwAgoAsJ7pa9ewNmHT+EIXtZEjQgVfN5786Yno5n/6JJ1lz6EiGmdn7/0rF5TLGjzig17azazS1+lkIYY=,iv:SZvGGKpVRI/odHbmgY8M6t6zCk8RgM+7EQEgRiizglA=,tag:cInsVo/QD85m+LxldyRlnA==,type:str]
-tracktrain:
-    env: ENC[AES256_GCM,data:W3+8qWomPgGJt5u50aAm9x/dilMpqKY11I2AdaIBTz5posc25ts0LB5S/Sxe1ROz4itpDK3QvjoFUTRhS39k4dwMr5lqXV8Ln4B+sPpvh7oBM8A5zydP8Jj1J1YqRt8++RTUmb4z41DIwb/yaZKMu6z0guXIu1yuYzcbCuk0xe/iOp6UUpfjOzzWTvxY54zY6kWcjHLiCSwD31Cd+MxMPfbUEkHt+0W+sBmYXGeEFI/6ULSB6FnGjNW6F9g=,iv:3ymah8HG+Yg6VYZZA/MRRjHDYvYJz01ezvhfQiftegg=,tag:trht+PRYfKgWJkg2wRwISQ==,type:str]
-vaultwarden:
-    env: ENC[AES256_GCM,data:hdm91tI8WBd3es+IUbdBO69kh1pNZTNvZNFIdSZO8lm4yYMPE+Jm7EzVqwOaZRbpQaVDBg7uh5P4ODc=,iv:no7U0wQCwZOeL2pwXf2pUIgrEsEOYwqOT04LvpCl614=,tag:AGSu5M7H69x6pDM062bC6g==,type:str]
-auamost:
-    secrets.fish: ENC[AES256_GCM,data:QBteJdVPSWa4cmu1BVWJ3AMWWH4zIv2+G83fK0QsbA/fYoIU5jobCT3USyujNz+jQaAAxA45jmQbCWNAFLl1q8hP4i9EIikVECx0VKVXPXILBND+w7zPSLldAbOugRYt2iAt1dDADZPtulKlkz7usdafbB+2igLXdyFRLfIxDTOrBuqQ+5yeofQe5k0XWRcmQQ/1AV0JrRrmLmr69VKsR932JWD8XxmI/HFyZPzWdExBSOmvnj+m4K+DV4cVmN4t6XOY0dM3gRQ95DglEuGlp/V2o3GqwY0mXCvhM1eh81u8mPALKp6Pv2i2yU35F01Puf5t1FHGDfzp0bW0xuKEywfGjAOifFkSE/3JFir434B6G0DiJNpOIl6QJ6DA8rSKfuPdccm6Or0zX8iJGRHDJmREQ05V9l0jHAAxLNuNdbsxg+8kCWVVnW+d1YDn9KW7LbFlP+sx4Ef5leUYft/lYhF4Z5Xp3arqVrlebWjWIBEuZeJTnkE3y+TdUUCs360zzWHqsipGmo1+/88CEqL52FfUOlJ4VCR45/7nYZ3RaRBWDGFW8RvwmWSFSstEcEXQ01U8lCwyn40+blfltme3KJ1f+pWMrZAKhPlOlMHCYfjd7esWI2sYcQbTZqxH49GnW6dsW/W+eiLs3zlD/Deb2CugHe63zRdlivmVPOz4zD1PXcCVpEZHoTTiJl7Om9K2mPYq9wQN41wsDUrNL9p8m9UlhWKbjBh5UU7p6F6OhF5rKH/Fs8fIaPi6B8uamTvEmiOGTUWl3vmQjBvhM8fJWoIkRB8hgCisr9OZ,iv:8jVAImjeXbXfiLKg9G0PyLMTV8cAyDmukeittqjKFpQ=,tag:fLIcsWKbdFQ/vPCgi/W3Zw==,type:str]
-restic:
-    s3creds.env: ENC[AES256_GCM,data:9WNu5S4KmdMXdshSpawEjIexAKH6vZCPwb9xyq6xmerly1lxSfFZzgg60M0L3L+I4joLTVi23YBB8Eh6Xfx9GgxNww7w7BjMCQs/X16ecDWlb346TKf+,iv:Gu4CbXXJAlQYXRqOjIAUYmn8EU4mrvcOVc2eCh1Ikzs=,tag:1xpVIonHiAGHsXTY9liPQQ==,type:str]
-    system: ENC[AES256_GCM,data:RIgO0QHVjwp2D3LoU62vLzepASdsXxu0DqUTA6Voa3K1d4xFHX2u+UR8AcqR,iv:O0K8i5ivne7WU+ygDEUcrvKW6DIfXjVPY63gpfsxEFE=,tag:n/1atQ5qlyB0SMHrYiTCrA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1yql8qaf7upraqy4cq397tt4vgs046hq0v59qymla8t3x0ujqvu4sesgsvw
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHd0Rrem03aWMwUGgwMlM2
-            dmRJdVYrRVNBTXZrVk5CdEFYcDRyN3VlcUhvCmE5L0lpbzdxanNBWFU1dEprUC9Y
-            eUZqdHVmWks2V1g0SHZRN1BsSU96OU0KLS0tIGl1ZUg2aDNtREZWeUE5UXlPeHNG
-            STcwOFgwK1lpWjdyTkd3c0dBTlAyK28KAKL7rPPH0DNRgL3qqCelAoUPnOy8MydL
-            t2ft9ZmzkoiSdSt0Ad1U5IImQt9ZzhPtYYnYbiEVNcfuFCnGcqdoPw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1zgdegurzlr8cw9948wgf4q5qh3efltwhhzus5tt6az5xvvsux9us2v4tyd
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvT0M2SmdwNmNyWWZ1V2o5
-            OHZ4RDlIbTZONXc5Z0FPMm03V3UzVWhaRnhBCjU5dzZlbkZHRkdacG1nUng4S0p6
-            Q1I5Vjg0Vk5wRzNGZTNONXdCMnpUTEEKLS0tIFo5K0tGdDZpLzNPb0llb0dJdk9u
-            c3p5UVBjZWlNVkxFMlVaQ3VMVFdhZVUKxcIL/JMBEojPRlDLHUIuxKcMPMEEsTkS
-            0zLjYVZL7YDS0dKdaZjaExHKrRzRpsY0qpDBHyhcyzRae1sWA4e5Kw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age18wkr3kjalalzrq9l05q32gnlaqr7t6rqqzde307m83rs9fp4xcfsdtj9gt
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwUmFJc24xV2JGS3dzK25F
-            SVVXTjBaRUxJQ3hXZXlHYTRzaXZVNjVObEFZCmpPQUV1b0lySkUvcURObm1xNSt4
-            WVQrbnlvZkQrbzloQzc4NlJCWnlPeGMKLS0tIDBVa2lpUmcrWURwWW8rc3ZmUUU1
-            U0pGQjJackNhT0d4L2ZIOTdTUjBwcjQKCRWcpevMcv2HsWC4jyc/GzxxjkTEm+UF
-            4QdXjJAHh2QLxV9aXF/k/KogebCFkBTirmyOhRKtBRkt87d1D9FKUA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1q88az2y5hnx8naqsvrurllqj6y5gtehrpa9emmrxy5ghwsr7pvnqf7tfpx
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzWnZFOVFuTnFTMmpVMDFU
-            dkw4UFlUenZzNkRuNy90NWk4aVNEd2J2Ukc0Cm9mM2dpZEJpVVY4TVB0WUxmTjEw
-            VFJ3aHB6ZFh5YWptYTZ5cXVjTUNBVkEKLS0tIEx0dVRPVVVacHFCMDhFNE1NMnZy
-            cUxicklTUGtPeTlnSFV1TUZqR1VmRnMKtJ+Q80SgqW/Jad8aF7pViGANHCsTMNEM
-            7TbhITW+zWIhnviVS0xOqXrvQs4iBbMfiNnQbFS7tEX08AT2oAg6cw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age18nkru4pwvvapdw76nauv2xdtlj8cvyv3ugahe9kcxtvtsptx2eyqw7p0m6
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzT3ZNenJKWTZ3NjdqNWpR
-            Zk9Ya3lsT1Jqd0RIWm8xdm16UjFzcFV1aGlBCkRuMllGSFVIUCs4UEJEQVVGQUxK
-            L1FGNGJwYkFIdU4wOXdFQWt6RSsyR28KLS0tIEgya2xORURncHlvNHJNTnIrb2da
-            emRETSt4WGFYeXR5UmNSajNpUStKUzAKxgDME0M1ewNE/BrL/wFjF4Yj7GupjRPF
-            Fuxae5U3phphzOkflQtreM1ScbUGge8WeiSVWY3Pl1azsYo/yqg8Ew==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1fm3e99tdyrsvztdchxxllt9nat35xzvd68d09y8scu9jfc7kvvuquhr49c
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwVEdpZmdSdnBaYnV2RWhT
-            MmMxQW9PUUJ4enRqNjFIZ25kUEkvdHBpOXdRCmJkSTJyWklhTU5neUlybzR1Nkp6
-            YlVHczNwRzl0d0hGalpvTFdEUlV3UHMKLS0tIGhQZXEvd2F0aTlna0FNL2wyaEdC
-            U1oyWXcza08rTG1DS0dUYkZOVWZ4L1kKgpt6jG0lNBMdk/isa1A/tfKYjprnnIo5
-            pi4t1c7CktFBkhMlOv6VPJCsQlP0YtZUh/uut70Kecv48+YH5gC/8A==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age16fk0m26n0fr2vmuxm2mjsmrawclde2mlyj6wg3ee9jvzmu5ru3ustgs5jq
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHRzc5WHAzcWhGSU1kdE1E
-            Z1B0aFhqYUQzQ2ptK09YMm9odWh3U0w3bmtvCi9IcWFhOFhvYU5ISlVpTURMY2hX
-            RG5mL1gvNkZ1SDdMZTR4QWxtRG1VUlkKLS0tIFl5UUdIR0JOSmF4OWx1OHBuaFJj
-            N0FDY2xYRlpmaTgxWURGZWxWWktPV00KAHNeeqhzql4LInlJoD9u7ptFWZBgktvp
-            tju4cZ/78VgdZIfEfnlzw8lsqpRx1z5Fw8K4CcXRJJLRVfHuj2CHTA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1l694a4xht7r0eza9r2vjncupmp6cxyk3k9x2ljwynnur4m2lc5jqmy3jut
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBscDFuL0ZsdWxoUFJBd2xr
-            ZXh3K0lSUnFmTVFTVHB5bGR2TC9lREdUczJrCnFSaGoyUnJjbXJ5d1lQd0RUcFJt
-            REkvdEY2NzcveHpQRWZ1STBSemx0SkkKLS0tIGtyN0svS3lYcmxUbVJiU1RaK21l
-            Ukh0VkVaeVBoOXQ1cmZ6WHNkYjQvTmsKG4914d+pSt1seoKiejoCvATOTaVFN4ih
-            Y74W+WXyaKoQP3Q9QrbSURpE+ICfblxHmkbsPB/agNzZVWrfyBaX1A==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1m374x78q9eykua32ldrqxh8rh36kz6jyre69a263krf28hcycsqsrmshl0
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqR01XampvRE92VnZ3OTZs
-            YmJYaEN2eVJOVWt1OHE1bTdua1ArSC9oVm1ZClBsVFBSWWtLRUoyNDF0NlUwaUpo
-            b0kyazNwRUFhS0RYd1pGNHNENWxQb28KLS0tIDhzdHhRN1FYczZBMksrM09UWUtJ
-            bndBTXJhQVE2OVlKeGNTbzJlL0duUzAKIWdesesYvBIN/m36fhzxq30+IT8qp/pF
-            S6i7QqZF75y2BpEoupRCqNIAsHrouUE+U9ZQJZO8m9J591mWvbVJIw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-07-26T13:05:44Z"
-    mac: ENC[AES256_GCM,data:9A8nX155dpCC1cvdH1hgeNKh0tt5FMaOKU7vZQ33jfWbiXOsJbp5iHKXxWOexFc70acyhdweoHwq61oJm2mzVufJIPA55ZAUItQcDXJCCeu6KswHug0tQtKHoCRSwdTdMTRNom4XjrpA/j4WWpuhoilyknycXqTpGHHVSdL2lYg=,iv:N0zwzGtGzAxhbmLzslbkXSr/iKmq5FeyT/iWeE4x2hQ=,tag:yIoLXpqlU2SlVRK5+S/qaw==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1

websites/docs.hacc.space/Readme.md

@@ -1,44 +0,0 @@
-# Markdown docs with zola.
-
-[Zola](https://www.getzola.org/) is a static site generated written in Rust
-(which you'll notice since sometimes it panics).
-
-To run the site locally:
-
-```
-zola serve
-```
-
-## Directory Layout
-
-All the important stuff goes into `content`. If you create subdirectories, make
-sure you remembered to also create an `_index.md` file for it (if in doubt, just
-copy the one at `content/_index.md`); otherwise pages in there won't work.
-
-`templates` is *not* for site templates, but specifies how markdown files should
-be turned into html. If an autogenerated link broke, you'll probably have to
-change something in there. `sass` and `static` do exactly what they sound like.
-
-It usually shouldn't be necessary to change `config.toml`, but if it is, [here
-is the list of all available options](https://www.getzola.org/documentation/getting-started/configuration/).
-
-
-## File Layout
-
-Markdown files start with a frontmatter that should look something like so:
-
-```markdown
-+++
-title = "blåhaj"
-taxonomies.categories = [ "flausch" ]
-+++
-
-[actual markdown goes here]
-```
-
-The frontmatter is TOML; the `taxonomies.*` keys are special and can be used to
-aggregate posts if enabled in `config.toml` (currently that's only the case for
-`categories`, though). See also the [list of all available keys](https://www.getzola.org/documentation/content/page/).
-
-Please don't repeat the page's title in markdown, otherwise it'll appear twice
-in the html.

websites/docs.hacc.space/config.toml

@@ -1,35 +0,0 @@
-# Zola's configuration file,
-#
-# see https://www.getzola.org/documentation/getting-started/configuration/
-# for available keys.
-
-# The URL the site will be built for
-base_url = "https://docs.hacc.space"
-
-compile_sass = true
-default_language = "en"
-
-# might be useful — this isn't a blog, obviously, but updates for new entries
-# could still be nice, I guess
-generate_feeds = true
-feed_filenames = [ "atom.xml" ]
-
-build_search_index = true
-
-taxonomies = [
-    { name = "categories", feed = false},
-]
-
-[markdown]
-highlight_code = true
-
-[extra] # user-defined keys
-
-# site title text
-main_title = "haccfiles documentation"
-
-# navbar entries
-main_menu = [
-  {url = "$BASE_URL", name = "Home"},
-  {url = "$BASE_URL/categories", name = "Categories"}
-]

websites/docs.hacc.space/content

@@ -1 +0,0 @@
-../../docs

websites/docs.hacc.space/default.nix

@@ -1,22 +0,0 @@
-{ copyPathToStore, stdenvNoCC, zola, writeShellScriptBin }:
-
-stdenvNoCC.mkDerivation rec {
-  name = "docs.hacc.space-static";
-
-  src = ./.;
-  content = copyPathToStore ../../docs;
-
-  phases = [ "buildPhase" ];
-  buildInputs = [ zola ];
-  buildPhase = ''
-    cp -r $src/* .
-    rm content
-    ln -s $content content
-    zola build --output-dir $out
-  '';
-
-  watch = writeShellScriptBin "watch" ''
-    cd $(git rev-parse --show-toplevel)/websites/docs.hacc.space
-    ${zola}/bin/zola serve --output-dir /tmp/hacc-docs "$@"
-  '';
-}

websites/docs.hacc.space/sass/style.scss

@@ -1,168 +0,0 @@
-
-@font-face {
-  font-family: 'share-tech';
-  src: url('ShareTech-Regular.ttf') format('truetype');
-}
-
-html {
-  overflow: hidden;
-  height: 100%;
-}
-
-body {
-  background-color: #000;
-  color: #fff;
-
-  overflow-y: auto;
-  overflow-x: hidden;
-  height: 100%;
-}
-
-#content {
-  font-family: 'share-tech';
-  margin-left: auto;
-  margin-right: auto;
-  max-width: 60em;
-  font-size: 16pt;
-  position: relative;
-}
-
-p.subtitle {
-  font-size: 14pt;
-  font-style: normal;
-  color: gray;
-}
-
-article {
-  margin-bottom: 4em;
-}
-
-#searchresults {
-  width: 90%;
-  text-align: right;
-  right: 0;
-  position: absolute;
-  background-color: black;
-  top: 5em;
-  color: gray;
-}
-
-#searchresults div {
-  padding: 0.5em;
-  border-top: 1px dashed gray;
-}
-
-#searchresults div:last-child {
-  border-bottom: 1px dashed gray;
-}
-
-.searchresultprevtext {
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  display: inline-block;
-  width: 40em;
-  float: left;
-}
-
-footer.content {
-  top: 50px;
-  color: #cccccc;
-  font-size: 14px;
-  margin-bottom: 4em;
-}
-
-footer a {
-  color: #cccccc;
-}
-
-.logo {
-  position: relative;
-  width: 100%;
-}
-.logo > img {
-  width: 300px;
-  max-width: 100%;
-}
-
-h1 {
-  font-size: 32pt;
-}
-
-#headernav {
-  text-align: right;
-  margin: 1em;
-}
-
-#headernav > a {
-  padding: 0.2em;
-  font-size: 20pt;
-  font-family: share-tech;
-}
-
-h1, h2, h3, h4, h5, h6{
-  font-weight: 600;
-  display: inline;
-  font-family: share-tech;
-  background: rgb(59,115,185);
-  background: linear-gradient(90deg, rgb(59, 115, 185) 0%, rgb(229, 35, 33) 100%);
-  background-clip: border-box;
-  color: transparent;
-  -webkit-background-clip: text;
-  background-clip: text;
-}
-/*
-h4 {
-  //font-weight: 600;
-  //display: inline;
-  font-family: share-tech;
-  //background: rgb(59,115,185);
-  //background: linear-gradient(90deg, rgb(59, 115, 185) 0%, rgb(229, 35, 33) 100%);
-  //background-clip: border-box;
-  color: #fff;
-  //-webkit-background-clip: text;
-  //background-clip: text;
-}
-*/
-a {
-  text-decoration: none;
-  color: #3b73b9;
-  transition: color .1s linear;
-}
-a:hover {
-  /*color: #e52321;*/
-  color: #4e9af9;
-}
-
-ul {
-  margin-top: 0;
-}
-
-
-pre {
-  padding: 1rem;
-  overflow: auto;
-  font-size: 16px;
-}
-// The line numbers already provide some kind of left/right padding
-pre[data-linenos] {
-  padding: 1rem 0;
-}
-pre table td {
-  padding: 0;
-}
-// The line number cells
-pre table td:nth-of-type(1) {
-  text-align: center;
-  user-select: none;
-}
-pre mark {
-  // If you want your highlights to take the full width.
-  display: block;
-  // The default background colour of a mark is bright yellow
-  background-color: rgba(254, 252, 232, 0.9);
-}
-pre table {
-  width: 100%;
-  border-collapse: collapse;
-}