This repository has no description
remove dead ubik infrastructure and clean up domsen
- Remove ubik machine (DNS no longer points to us)
- Remove ubik-host.nix container config
- Remove sqlBackup.nix and mysql-backup module (no databases left)
- Remove usershadow module (was only used by removed exim auth)
- Clean up domsen.nix: remove dead domains, mail, users, backups
- Clean up util.nix: remove unused serveWordpress/serveOwncloud
- Clean up internet-gateway.nix: remove ubik domain routing
- Clean up exim-smarthost.nix: remove dead wordpress alias
- Clean up prism: remove mail.ubikmedia.eu proxy, usershadow
Domains removed (DNS pointed elsewhere):
- ubikmedia.de/eu, apanowicz.de, beesmooth.ch, jarugadesign.de
- jla-trading.com, alewis.de, freemonkey.art, aldonasiech.com
- karlaskop.de, youthtube.xyz, joemisch.com, weirdwednesday.de
Only illustra.de remains active on prism.
author
lassulus
date
(Jan 17, 2026, 6:40 PM CET)
commit
dea750b6
dea750b6957314f1099acf26fd05588650379769
parent
717fa8b6
717fa8b6e3e4feb1bb5ec392b9d31d900475298d
+2
-1372
-1
2configs/exim-smarthost.nix
-1
2configs/exim-smarthost.nix
-65
2configs/ubik-host.nix
-65
2configs/ubik-host.nix
···
1
-
{ config, pkgs, ... }:
2
-
{
3
-
krebs.sync-containers3.containers.ubik = {
4
-
sshKey = config.clan.core.vars.generators.ubik-container.files."ubik.sync.key".path;
5
-
startCommand = ''
6
-
export PATH=$PATH:${pkgs.git}/bin
7
-
until ${pkgs.dig.host}/bin/host github.com; do sleep 1; done
8
-
${pkgs.nixos-rebuild}/bin/nixos-rebuild --refresh --flake github:lassulus/superconfig#ubik switch --no-write-lock-file
9
-
'';
10
-
};
11
-
clan.core.vars.generators.ubik-container = {
12
-
files."ubik.sync.key" = { };
13
-
migrateFact = "ubik-container";
14
-
prompts.warn = {
15
-
description = "copy or reference the secret key from the container into here, so we can actually start/sync the container";
16
-
type = "hidden";
17
-
};
18
-
};
19
-
containers.ubik.bindMounts."/var/lib" = {
20
-
hostPath = "/var/lib/sync-containers3/ubik/state";
21
-
isReadOnly = false;
22
-
};
23
-
containers.ubik.bindMounts."/var/lib/nextcloud/data" = {
24
-
hostPath = "/var/ubik";
25
-
isReadOnly = false;
26
-
};
27
-
# services.nginx.virtualHosts."c.apanowicz.de" = {
28
-
# enableACME = true;
29
-
# acmeFallbackHost = "ubik.r";
30
-
# forceSSL = true;
31
-
# locations."/" = {
32
-
# recommendedProxySettings = true;
33
-
# proxyWebsockets = true;
34
-
# proxyPass = "https://ubik.r";
35
-
# extraConfig = ''
36
-
# client_max_body_size 9001M;
37
-
# # fix abort after 1GB download
38
-
# # https://trac.nginx.org/nginx/ticket/1472
39
-
# proxy_max_temp_file_size 0;
40
-
# '';
41
-
# };
42
-
# };
43
-
# services.nginx.virtualHosts."mail.ubikmedia.eu" = {
44
-
# enableACME = true;
45
-
# forceSSL = true;
46
-
# acmeFallbackHost = "ubik.r";
47
-
# locations."/" = {
48
-
# recommendedProxySettings = true;
49
-
# proxyWebsockets = true;
50
-
# proxyPass = "https://ubik.r";
51
-
# };
52
-
# };
53
-
54
-
services.nginx.virtualHosts."karlaskop.de" = {
55
-
serverAliases = [ "www.karlaskop.de" ];
56
-
enableACME = true;
57
-
forceSSL = true;
58
-
acmeFallbackHost = "prism.r";
59
-
locations."/" = {
60
-
recommendedProxySettings = true;
61
-
proxyWebsockets = true;
62
-
proxyPass = "https://prism.r";
63
-
};
64
-
};
65
-
}
-2
3modules/default.nix
-2
3modules/default.nix
-109
3modules/mysql-backup.nix
-109
3modules/mysql-backup.nix
···
1
-
{
2
-
config,
3
-
lib,
4
-
pkgs,
5
-
...
6
-
}:
7
-
8
-
with lib;
9
-
10
-
let
11
-
12
-
cfg = config.lass.mysqlBackup;
13
-
14
-
out = {
15
-
options.lass.mysqlBackup = api;
16
-
config = mkIf cfg.enable imp;
17
-
};
18
-
19
-
api = {
20
-
enable = mkEnableOption "mysqlBackup";
21
-
config = mkOption {
22
-
type =
23
-
with types;
24
-
attrsOf (
25
-
submodule (
26
-
{ config, ... }:
27
-
{
28
-
options = {
29
-
name = mkOption {
30
-
type = types.str;
31
-
default = config._module.args.name;
32
-
};
33
-
startAt = mkOption {
34
-
type = with types; nullOr str; # TODO systemd.time(7)'s calendar event
35
-
default = "*-*-* 01:15:00";
36
-
};
37
-
user = mkOption {
38
-
type = str;
39
-
default = "root";
40
-
};
41
-
password = mkOption {
42
-
type = nullOr str;
43
-
default = null;
44
-
description = ''
45
-
path to a file containing the mysqlPassword for the specified user.
46
-
'';
47
-
};
48
-
databases = mkOption {
49
-
type = listOf str;
50
-
default = [ ];
51
-
};
52
-
location = mkOption {
53
-
type = str;
54
-
default = "/backups/sql_dumps";
55
-
};
56
-
};
57
-
}
58
-
)
59
-
);
60
-
description = "configuration for mysqlBackup";
61
-
};
62
-
};
63
-
64
-
imp = {
65
-
66
-
services.mysql.ensureUsers = [
67
-
{
68
-
ensurePermissions = {
69
-
"*.*" = "ALL";
70
-
};
71
-
name = "root";
72
-
}
73
-
];
74
-
75
-
systemd.services = mapAttrs' (
76
-
_: plan:
77
-
nameValuePair "mysqlBackup-${plan.name}" {
78
-
path = with pkgs; [
79
-
mariadb
80
-
gzip
81
-
];
82
-
serviceConfig = rec {
83
-
ExecStart = start plan;
84
-
SyslogIdentifier = ExecStart.name;
85
-
Type = "oneshot";
86
-
User = plan.user;
87
-
};
88
-
startAt = plan.startAt;
89
-
}
90
-
) cfg.config;
91
-
};
92
-
93
-
start =
94
-
plan:
95
-
let
96
-
backupScript = plan: db: ''
97
-
mkdir -p ${plan.location}
98
-
mysqldump -u ${plan.user} ${
99
-
optionalString (plan.password != null) "-p$(cat ${plan.password})"
100
-
} ${db} | gzip -c > ${plan.location}/${db}.gz
101
-
'';
102
-
103
-
in
104
-
pkgs.pkgs.writeDash "mysqlBackup.${plan.name}" ''
105
-
${concatMapStringsSep "\n" (backupScript plan) plan.databases}
106
-
'';
107
-
108
-
in
109
-
out
-148
3modules/usershadow.nix
-148
3modules/usershadow.nix
···
1
-
{
2
-
config,
3
-
lib,
4
-
pkgs,
5
-
...
6
-
}:
7
-
with lib;
8
-
let
9
-
10
-
cfg = config.lass.usershadow;
11
-
12
-
out = {
13
-
options.lass.usershadow = api;
14
-
config = lib.mkIf cfg.enable imp;
15
-
};
16
-
17
-
api = {
18
-
enable = mkEnableOption "usershadow";
19
-
pattern = mkOption {
20
-
type = types.str;
21
-
default = "/home/%/.shadow";
22
-
};
23
-
path = mkOption {
24
-
type = types.str;
25
-
};
26
-
};
27
-
28
-
imp = {
29
-
environment.systemPackages = [ usershadow ];
30
-
lass.usershadow.path = "${usershadow}";
31
-
security.pam.services.sshd.text = ''
32
-
auth required pam_exec.so expose_authtok /run/wrappers/bin/shadow_verify_pam ${cfg.pattern}
33
-
auth required pam_permit.so
34
-
account required pam_permit.so
35
-
session required pam_permit.so
36
-
'';
37
-
38
-
security.pam.services.dovecot2.text = ''
39
-
auth required pam_exec.so expose_authtok /run/wrappers/bin/shadow_verify_pam ${cfg.pattern}
40
-
auth required pam_permit.so
41
-
account required pam_permit.so
42
-
session required pam_permit.so
43
-
'';
44
-
45
-
security.wrappers.shadow_verify_pam = {
46
-
setuid = true;
47
-
source = "${usershadow}/bin/verify_pam";
48
-
owner = "root";
49
-
group = "root";
50
-
};
51
-
security.wrappers.shadow_verify_arg = {
52
-
setuid = true;
53
-
source = "${usershadow}/bin/verify_arg";
54
-
owner = "root";
55
-
group = "root";
56
-
};
57
-
};
58
-
59
-
usershadow =
60
-
let
61
-
deps = [
62
-
"pwstore-fast"
63
-
"bytestring"
64
-
];
65
-
in
66
-
pkgs.writeHaskellPackage "passwords" {
67
-
ghc-options = [
68
-
"-rtsopts"
69
-
"-Wall"
70
-
];
71
-
executables.verify_pam = {
72
-
extra-depends = deps;
73
-
text = ''
74
-
import System.IO
75
-
import Data.Char (chr)
76
-
import System.Environment (getEnv, getArgs)
77
-
import Crypto.PasswordStore (verifyPasswordWith, pbkdf2)
78
-
import qualified Data.ByteString.Char8 as BS8
79
-
import System.Exit (exitFailure, exitSuccess)
80
-
81
-
main :: IO ()
82
-
main = do
83
-
user <- getEnv "PAM_USER"
84
-
shadowFilePattern <- head <$> getArgs
85
-
let shadowFile = lhs <> user <> tail rhs
86
-
(lhs, rhs) = span (/= '%') shadowFilePattern
87
-
hash <- readFile shadowFile
88
-
password <- takeWhile (/= (chr 0)) <$> hGetLine stdin
89
-
let res = verifyPasswordWith pbkdf2 (2^) (BS8.pack password) (BS8.pack hash)
90
-
if res then exitSuccess else exitFailure
91
-
'';
92
-
};
93
-
executables.verify_arg = {
94
-
extra-depends = deps;
95
-
text = ''
96
-
import System.Environment (getArgs)
97
-
import Crypto.PasswordStore (verifyPasswordWith, pbkdf2)
98
-
import qualified Data.ByteString.Char8 as BS8
99
-
import System.Exit (exitFailure, exitSuccess)
100
-
101
-
main :: IO ()
102
-
main = do
103
-
argsList <- getArgs
104
-
let shadowFilePattern = argsList !! 0
105
-
let user = argsList !! 1
106
-
let password = argsList !! 2
107
-
let shadowFile = lhs <> user <> tail rhs
108
-
(lhs, rhs) = span (/= '%') shadowFilePattern
109
-
hash <- readFile shadowFile
110
-
let res = verifyPasswordWith pbkdf2 (2^) (BS8.pack password) (BS8.pack hash)
111
-
if res then do (putStr "yes") else exitFailure
112
-
'';
113
-
};
114
-
executables.passwd = {
115
-
extra-depends = deps;
116
-
text = ''
117
-
import System.Environment (getEnv)
118
-
import Crypto.PasswordStore (makePasswordWith, pbkdf2)
119
-
import qualified Data.ByteString.Char8 as BS8
120
-
import System.IO (stdin, stdout, hSetEcho, hFlush, putStr, putStrLn)
121
-
import Control.Exception (bracket_)
122
-
123
-
main :: IO ()
124
-
main = do
125
-
home <- getEnv "HOME"
126
-
mb_password <- bracket_ (hSetEcho stdin False) (hSetEcho stdin True) $ do
127
-
putStr "Enter new UNIX password: "
128
-
hFlush stdout
129
-
password <- BS8.hGetLine stdin
130
-
putStrLn ""
131
-
putStr "Retype new UNIX password: "
132
-
hFlush stdout
133
-
password2 <- BS8.hGetLine stdin
134
-
return $ if password == password2
135
-
then Just password
136
-
else Nothing
137
-
case mb_password of
138
-
Just password -> do
139
-
hash <- makePasswordWith pbkdf2 password 10
140
-
BS8.writeFile (home ++ "/.shadow") hash
141
-
putStrLn "passwd: all authentication tokens updated successfully."
142
-
Nothing -> putStrLn "Sorry, passwords do not match"
143
-
'';
144
-
};
145
-
};
146
-
147
-
in
148
-
out
-14
2configs/mail/internet-gateway.nix
-14
2configs/mail/internet-gateway.nix
···
37
37
local_domains = [
38
38
"localhost"
39
39
"lassul.us"
40
-
"ubikmedia.eu"
41
-
"ubikmedia.de"
42
-
"apanowicz.de"
43
-
"alewis.de"
44
-
"jarugadesign.de"
45
-
"beesmooth.ch"
46
-
"jla-trading.com"
47
40
];
48
41
extraRouters = ''
49
42
forward_lassul_us:
···
51
44
domains = lassul.us
52
45
transport = remote_smtp
53
46
route_list = * orange.r
54
-
no_more
55
-
56
-
forward_ubik:
57
-
driver = manualroute
58
-
domains = ubikmedia.eu:ubikmedia.de:apanowicz.de:alewis.de:jarugadesign.de:beesmooth.ch:jla-trading.com
59
-
transport = remote_smtp
60
-
route_list = * ubik.r
61
47
no_more
62
48
'';
63
49
};
+1
-467
2configs/websites/domsen.nix
+1
-467
2configs/websites/domsen.nix
···
1
1
{
2
-
self,
3
-
config,
4
-
pkgs,
5
2
lib,
3
+
pkgs,
6
4
...
7
5
}:
8
6
9
7
let
10
-
11
-
inherit (self.inputs.stockholm.lib)
12
-
genid_uint31
13
-
;
14
8
inherit (import ./util.nix { inherit lib pkgs; })
15
9
servePage
16
-
serveWordpress
17
10
;
18
-
19
-
msmtprc = pkgs.writeText "msmtprc" ''
20
-
account localhost
21
-
host localhost
22
-
account default: localhost
23
-
'';
24
-
25
-
sendmail = pkgs.writeDash "msmtp" ''
26
-
exec ${pkgs.msmtp}/bin/msmtp --read-envelope-from -C ${msmtprc} "$@"
27
-
'';
28
-
29
11
in
30
12
{
31
13
imports = [
32
-
self.inputs.stockholm.nixosModules.acl
33
-
self.inputs.stockholm.nixosModules.on-failure
34
14
./default.nix
35
-
./sqlBackup.nix
36
-
(servePage [
37
-
"aldonasiech.com"
38
-
"www.aldonasiech.com"
39
-
])
40
15
(servePage [
41
16
"illustra.de"
42
17
"www.illustra.de"
43
18
])
44
-
# (servePage [ "nirwanabluete.de" "www.nirwanabluete.de" ])
45
-
(servePage [ "karlaskop.de" ])
46
-
(servePage [
47
-
"freemonkey.art"
48
-
"www.freemonkey.art"
49
-
])
50
-
(serveWordpress [
51
-
"ubikmedia.de"
52
-
"ubikmedia.eu"
53
-
"youthtube.xyz"
54
-
"joemisch.com"
55
-
"weirdwednesday.de"
56
-
"jarugadesign.de"
57
-
"beesmooth.ch"
58
-
59
-
"www.ubikmedia.eu"
60
-
"www.youthtube.xyz"
61
-
"www.ubikmedia.de"
62
-
"www.joemisch.com"
63
-
"www.weirdwednesday.de"
64
-
"www.jarugadesign.de"
65
-
"www.beesmooth.ch"
66
-
67
-
"aldona2.ubikmedia.de"
68
-
"cinevita.ubikmedia.de"
69
-
"factscloud.ubikmedia.de"
70
-
"illucloud.ubikmedia.de"
71
-
"joemisch.ubikmedia.de"
72
-
"nb.ubikmedia.de"
73
-
"youthtube.ubikmedia.de"
74
-
"weirdwednesday.ubikmedia.de"
75
-
"freemonkey.ubikmedia.de"
76
-
"jarugadesign.ubikmedia.de"
77
-
"crypto4art.ubikmedia.de"
78
-
"jarugadesign.ubikmedia.de"
79
-
"beesmooth.ubikmedia.de"
80
-
])
81
19
];
82
-
83
-
# https://github.com/nextcloud/server/issues/25436
84
-
services.mysql.settings.mysqld.innodb_read_only_compressed = 0;
85
-
86
-
services.mysql.ensureDatabases = [
87
-
"ubikmedia_de"
88
-
"o_ubikmedia_de"
89
-
];
90
-
services.mysql.ensureUsers = [
91
-
{
92
-
ensurePermissions = {
93
-
"ubikmedia_de.*" = "ALL";
94
-
};
95
-
name = "nginx";
96
-
}
97
-
{
98
-
ensurePermissions = {
99
-
"o_ubikmedia_de.*" = "ALL";
100
-
};
101
-
name = "nginx";
102
-
}
103
-
];
104
-
105
-
services.nginx.virtualHosts."ubikmedia.de".locations."/piwika".extraConfig = ''
106
-
try_files $uri $uri/ /index.php?$args;
107
-
'';
108
-
109
-
lass.mysqlBackup.config.all.databases = [
110
-
"ubikmedia_de"
111
-
"o_ubikmedia_de"
112
-
];
113
-
114
-
services.phpfpm.phpOptions = ''
115
-
sendmail_path = ${sendmail} -t
116
-
upload_max_filesize = 100M
117
-
post_max_size = 100M
118
-
file_uploads = on
119
-
'';
120
-
121
-
clan.core.vars.generators.nextcloud = {
122
-
files."nextcloud_pw" = { };
123
-
prompts.password.description = "enter initial admin password for nextcloud";
124
-
script = ''
125
-
cat "$prompts"/password > "$out"/nextcloud_pw
126
-
'';
127
-
};
128
-
# systemd.services.nextcloud-setup.after = [ "secret-nextcloud_pw.service" ];
129
-
# krebs.secret.files.nextcloud_pw = {
130
-
# path = "/run/nextcloud.pw";
131
-
# owner.name = "nextcloud";
132
-
# group-name = "nextcloud";
133
-
# source-path = "${config.krebs.secret.directory}/nextcloud_pw";
134
-
# };
135
-
services.nextcloud = {
136
-
enable = true;
137
-
hostName = "o.xanf.org";
138
-
package = pkgs.nextcloud31;
139
-
settings.overwriteProtocol = "https";
140
-
config.dbtype = "sqlite";
141
-
config.adminpassFile = "/run/nextcloud.pw";
142
-
https = true;
143
-
};
144
-
services.nginx.virtualHosts."o.xanf.org" = {
145
-
enableACME = true;
146
-
forceSSL = true;
147
-
};
148
-
services.nginx.virtualHosts."weirdweekender.de" = {
149
-
serverAliases = [ "www.weirdweekender.de" ];
150
-
enableACME = true;
151
-
forceSSL = true;
152
-
locations."/".extraConfig = ''
153
-
return 301 https://wonderl.ink/@weird0711;
154
-
'';
155
-
};
156
-
services.nginx.virtualHosts."shop.weirdwednesday.de" = {
157
-
enableACME = true;
158
-
addSSL = true;
159
-
locations."/".extraConfig = ''
160
-
return 301 https://weirdwednesday0711.etsy.com;
161
-
'';
162
-
};
163
-
164
-
# MAIL STUFF
165
-
# TODO: make into its own module
166
-
167
-
services.roundcube = {
168
-
enable = true;
169
-
hostName = "mail.lassul.us";
170
-
extraConfig = ''
171
-
$config['smtp_debug'] = true;
172
-
$config['smtp_host'] = "localhost:25";
173
-
'';
174
-
};
175
-
services.dovecot2 = {
176
-
enable = true;
177
-
showPAMFailure = true;
178
-
mailLocation = "maildir:~/Mail";
179
-
sslServerCert = "/var/lib/acme/lassul.us/fullchain.pem";
180
-
sslServerKey = "/var/lib/acme/lassul.us/key.pem";
181
-
};
182
-
183
-
environment.systemPackages = [
184
-
(pkgs.writers.writeDashBin "debug_exim" ''
185
-
set -ef
186
-
export PATH="${lib.makeBinPath [ pkgs.coreutils ]}"
187
-
echo "$@" >> /tmp/xxx
188
-
/run/wrappers/bin/shadow_verify_arg "${config.lass.usershadow.pattern}" "$2" "$3" 2>>/tmp/xxx1
189
-
echo "ok" >> /tmp/yyy
190
-
exit 23
191
-
'')
192
-
];
193
-
194
-
krebs.exim-smarthost = {
195
-
authenticators.PLAIN = ''
196
-
driver = plaintext
197
-
public_name = PLAIN
198
-
server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
199
-
'';
200
-
authenticators.LOGIN = ''
201
-
driver = plaintext
202
-
public_name = LOGIN
203
-
server_prompts = "Username:: : Password::"
204
-
server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
205
-
# server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
206
-
'';
207
-
internet-aliases = [
208
-
{
209
-
from = "dma@ubikmedia.de";
210
-
to = "domsen";
211
-
}
212
-
{
213
-
from = "dma@ubikmedia.eu";
214
-
to = "domsen";
215
-
}
216
-
{
217
-
from = "mail@habsys.de";
218
-
to = "domsen";
219
-
}
220
-
{
221
-
from = "mail@habsys.eu";
222
-
to = "domsen";
223
-
}
224
-
{
225
-
from = "hallo@apanowicz.de";
226
-
to = "domsen";
227
-
}
228
-
{
229
-
from = "bruno@apanowicz.de";
230
-
to = "bruno";
231
-
}
232
-
{
233
-
from = "mail@jla-trading.com";
234
-
to = "jla-trading";
235
-
}
236
-
{
237
-
from = "jms@ubikmedia.eu";
238
-
to = "jms";
239
-
}
240
-
{
241
-
from = "ms@ubikmedia.eu";
242
-
to = "ms";
243
-
}
244
-
{
245
-
from = "ubik@ubikmedia.eu";
246
-
to = "domsen, jms, ms";
247
-
}
248
-
{
249
-
from = "kontakt@alewis.de";
250
-
to = "klabusterbeere";
251
-
}
252
-
{
253
-
from = "hallo@jarugadesign.de";
254
-
to = "kasia";
255
-
}
256
-
{
257
-
from = "noreply@beeshmooth.ch";
258
-
to = "besmooth@gmx.ch";
259
-
}
260
-
261
-
{
262
-
from = "testuser@lassul.us";
263
-
to = "testuser";
264
-
}
265
-
{
266
-
from = "testuser@ubikmedia.eu";
267
-
to = "testuser";
268
-
}
269
-
];
270
-
sender_domains = [
271
-
"jla-trading.com"
272
-
"ubikmedia.eu"
273
-
"ubikmedia.de"
274
-
"apanowicz.de"
275
-
"alewis.de"
276
-
"jarugadesign.de"
277
-
"beesmooth.ch"
278
-
"event-extra.de"
279
-
];
280
-
dkim = [
281
-
{ domain = "ubikmedia.eu"; }
282
-
{ domain = "apanowicz.de"; }
283
-
{ domain = "beesmooth.ch"; }
284
-
];
285
-
};
286
-
clan.core.vars.generators."ubikmedia.eu-dkim" = {
287
-
files."ubikmedia.eu.dkim.priv" = { };
288
-
files."ubikmedia.eu.dkim.pub".secret = false;
289
-
runtimeInputs = with pkgs; [
290
-
coreutils
291
-
openssl
292
-
];
293
-
script = ''
294
-
exit 1 # Manual migration required from facts to vars
295
-
openssl genrsa -out "$out"/ubikmedia.eu.dkim.priv 1024
296
-
openssl rsa -in "$out"/ubikmedia.eu.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/ubikmedia.eu.dkim.pub
297
-
'';
298
-
};
299
-
clan.core.vars.generators."apanowicz.de-dkim" = {
300
-
files."apanowicz.de.dkim.priv" = { };
301
-
files."apanowicz.de.dkim.pub".secret = false;
302
-
runtimeInputs = with pkgs; [
303
-
coreutils
304
-
openssl
305
-
];
306
-
script = ''
307
-
exit 1 # Manual migration required from facts to vars
308
-
openssl genrsa -out "$out"/apanowicz.de.dkim.priv 1024
309
-
openssl rsa -in "$out"/apanowicz.de.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/apanowicz.de.dkim.pub
310
-
'';
311
-
};
312
-
clan.core.vars.generators."beesmooth.ch-dkim" = {
313
-
files."beesmooth.ch.dkim.priv" = { };
314
-
files."beesmooth.ch.dkim.pub".secret = false;
315
-
runtimeInputs = with pkgs; [
316
-
coreutils
317
-
openssl
318
-
];
319
-
script = ''
320
-
exit 1 # Manual migration required from facts to vars
321
-
openssl genrsa -out "$out"/beesmooth.ch.dkim.priv 1024
322
-
openssl rsa -in "$out"/beesmooth.ch.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/beesmooth.ch.dkim.pub
323
-
'';
324
-
};
325
-
clan.core.vars.generators."freemonkey.art" = {
326
-
files."freemonkey.art.dkim.priv" = { };
327
-
files."freemonkey.art.dkim.pub".secret = false;
328
-
runtimeInputs = with pkgs; [
329
-
coreutils
330
-
openssl
331
-
];
332
-
script = ''
333
-
exit 1 # Manual migration required from facts to vars
334
-
openssl genrsa -out "$out"/freemonkey.art.dkim.priv 1024
335
-
openssl rsa -in "$out"/freemonkey.art.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/freemonkey.art.dkim.pub
336
-
'';
337
-
};
338
-
services.borgbackup.jobs.hetzner.paths = [
339
-
"/home/xanf"
340
-
"/home/domsen"
341
-
"/home/bruno"
342
-
"/home/jla-trading"
343
-
"/home/jms"
344
-
"/home/ms"
345
-
"/home/bui"
346
-
"/home/klabusterbeere"
347
-
"/home/akayguen"
348
-
"/home/kasia"
349
-
"/home/dif"
350
-
"/home/lavafilms"
351
-
"/home/movematchers"
352
-
"/home/blackphoton"
353
-
"/home/avada"
354
-
"/home/sts"
355
-
"/home/familienrat"
356
-
];
357
-
users.users.domsen = {
358
-
uid = genid_uint31 "domsen";
359
-
description = "maintenance acc for domsen";
360
-
home = "/home/domsen";
361
-
useDefaultShell = true;
362
-
extraGroups = [
363
-
"syncthing"
364
-
"download"
365
-
"xanf"
366
-
];
367
-
createHome = true;
368
-
isNormalUser = true;
369
-
};
370
-
371
-
users.users.bruno = {
372
-
uid = genid_uint31 "bruno";
373
-
home = "/home/bruno";
374
-
useDefaultShell = true;
375
-
createHome = true;
376
-
isNormalUser = true;
377
-
};
378
-
379
-
users.users.jms = {
380
-
uid = genid_uint31 "jms";
381
-
home = "/home/jms";
382
-
useDefaultShell = true;
383
-
createHome = true;
384
-
isNormalUser = true;
385
-
};
386
-
387
-
users.users.ms = {
388
-
uid = genid_uint31 "ms";
389
-
home = "/home/ms";
390
-
useDefaultShell = true;
391
-
createHome = true;
392
-
isNormalUser = true;
393
-
};
394
-
395
-
users.users.testuser = {
396
-
uid = genid_uint31 "testuser";
397
-
home = "/home/testuser";
398
-
useDefaultShell = true;
399
-
createHome = true;
400
-
isNormalUser = true;
401
-
};
402
-
403
-
#users.users.akayguen = {
404
-
# uid = genid_uint31 "akayguen";
405
-
# home = "/home/akayguen";
406
-
# useDefaultShell = true;
407
-
# createHome = true;
408
-
# isNormalUser = true;
409
-
#};
410
-
411
-
users.users.klabusterbeere = {
412
-
uid = genid_uint31 "klabusterbeere";
413
-
home = "/home/klabusterbeere";
414
-
useDefaultShell = true;
415
-
createHome = true;
416
-
isNormalUser = true;
417
-
};
418
-
419
-
users.users.familienrat = {
420
-
uid = genid_uint31 "familienrat";
421
-
home = "/home/familienrat";
422
-
useDefaultShell = true;
423
-
createHome = true;
424
-
isNormalUser = true;
425
-
};
426
-
427
-
users.users.pr = {
428
-
uid = genid_uint31 "pr";
429
-
home = "/home/pr";
430
-
useDefaultShell = true;
431
-
createHome = true;
432
-
isNormalUser = true;
433
-
};
434
-
435
-
krebs.acl."/srv/http/familienrat-hamburg.de"."u:familienrat:rwX" = { };
436
-
krebs.acl."/srv/http"."u:familienrat:X" = {
437
-
default = false;
438
-
recursive = false;
439
-
};
440
-
441
-
krebs.on-failure.plans.restic-backups-domsen = {
442
-
journalctl = {
443
-
lines = 1000;
444
-
};
445
-
};
446
-
447
-
# services.restic.backups.domsen = {
448
-
# initialize = true;
449
-
# repository = "/backups/domsen";
450
-
# passwordFile = "${config.krebs.secret.directory}/domsen_backup_pw";
451
-
# timerConfig = {
452
-
# OnCalendar = "00:05";
453
-
# RandomizedDelaySec = "5h";
454
-
# };
455
-
# paths = [
456
-
# "/home/domsen/Mail"
457
-
# "/home/ms/Mail"
458
-
# "/home/klabusterbeere/Mail"
459
-
# "/home/jms/Mail"
460
-
# "/home/kasia/Mail"
461
-
# "/home/bruno/Mail"
462
-
# "/home/akayguen/Mail"
463
-
# "/backups/sql_dumps"
464
-
# ];
465
-
# };
466
-
467
-
# services.syncthing.settings.folders = {
468
-
# domsen-backups = {
469
-
# path = "/backups/domsen";
470
-
# devices = [ "domsen-backup" ];
471
-
# };
472
-
# domsen-backup-srv-http = {
473
-
# path = "/srv/http";
474
-
# devices = [ "domsen-backup" ];
475
-
# };
476
-
# };
477
-
478
-
system.activationScripts.domsen-backups = ''
479
-
${pkgs.coreutils}/bin/chmod 750 /backups
480
-
'';
481
-
482
-
# takes too long!!
483
-
# krebs.acl."/srv/http"."u:syncthing:rwX" = {};
484
-
# krebs.acl."/srv/http"."u:nginx:rwX" = {};
485
-
# krebs.acl."/srv/http/ubikmedia.de"."u:avada:rwX" = {};
486
20
}
-35
2configs/websites/sqlBackup.nix
-35
2configs/websites/sqlBackup.nix
···
1
-
{ config, pkgs, ... }:
2
-
{
3
-
clan.core.vars.generators.mysql = {
4
-
files."mysql_rootPassword" = { };
5
-
prompts.password.description = "enter mysql root password";
6
-
script = ''
7
-
cat "$prompts"/password > "$out"/mysql_rootPassword
8
-
'';
9
-
};
10
-
krebs.secret.files.mysql_rootPassword = {
11
-
path = "${config.services.mysql.dataDir}/mysql_rootPassword";
12
-
owner.name = "mysql";
13
-
source-path = "${config.krebs.secret.directory}/mysql_rootPassword";
14
-
};
15
-
16
-
services.mysql = {
17
-
enable = true;
18
-
dataDir = "/var/mysql";
19
-
package = pkgs.mariadb;
20
-
};
21
-
22
-
systemd.services.mysql = {
23
-
after = [
24
-
config.krebs.secret.files.mysql_rootPassword.service
25
-
];
26
-
partOf = [
27
-
config.krebs.secret.files.mysql_rootPassword.service
28
-
];
29
-
};
30
-
31
-
lass.mysqlBackup = {
32
-
enable = true;
33
-
config.all = { };
34
-
};
35
-
}
+1
-168
2configs/websites/util.nix
+1
-168
2configs/websites/util.nix
···
2
2
3
3
with lib;
4
4
5
-
rec {
6
-
7
-
ssl = _domains: {
8
-
};
9
-
5
+
{
10
6
servePage =
11
7
domains:
12
8
let
···
20
16
locations."/".extraConfig = ''
21
17
root /srv/http/${domain};
22
18
'';
23
-
};
24
-
};
25
-
26
-
serveOwncloud =
27
-
domains:
28
-
let
29
-
domain = head domains;
30
-
in
31
-
{
32
-
services.nginx.virtualHosts."${domain}" = {
33
-
enableACME = true;
34
-
addSSL = true;
35
-
serverAliases = domains;
36
-
extraConfig = ''
37
-
# Add headers to serve security related headers
38
-
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
39
-
add_header X-Content-Type-Options nosniff;
40
-
add_header X-Frame-Options "SAMEORIGIN";
41
-
add_header X-XSS-Protection "1; mode=block";
42
-
add_header X-Robots-Tag none;
43
-
add_header X-Download-Options noopen;
44
-
add_header X-Permitted-Cross-Domain-Policies none;
45
-
46
-
# Path to the root of your installation
47
-
root /srv/http/${domain}/;
48
-
# set max upload size
49
-
client_max_body_size 10G;
50
-
fastcgi_buffers 64 4K;
51
-
fastcgi_read_timeout 120;
52
-
53
-
# Disable gzip to avoid the removal of the ETag header
54
-
gzip off;
55
-
56
-
# Uncomment if your server is build with the ngx_pagespeed module
57
-
# This module is currently not supported.
58
-
#pagespeed off;
59
-
60
-
index index.php;
61
-
error_page 403 /core/templates/403.php;
62
-
error_page 404 /core/templates/404.php;
63
-
64
-
rewrite ^/.well-known/carddav /remote.php/carddav/ permanent;
65
-
rewrite ^/.well-known/caldav /remote.php/caldav/ permanent;
66
-
67
-
# The following 2 rules are only needed for the user_webfinger app.
68
-
# Uncomment it if you're planning to use this app.
69
-
rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
70
-
rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
71
-
'';
72
-
locations."/robots.txt".extraConfig = ''
73
-
allow all;
74
-
log_not_found off;
75
-
access_log off;
76
-
'';
77
-
locations."~ ^/(build|tests|config|lib|3rdparty|templates|data)/".extraConfig = ''
78
-
deny all;
79
-
'';
80
-
81
-
locations."~ ^/(?:autotest|occ|issue|indie|db_|console)".extraConfig = ''
82
-
deny all;
83
-
'';
84
-
85
-
locations."/".extraConfig = ''
86
-
rewrite ^/remote/(.*) /remote.php last;
87
-
rewrite ^(/core/doc/[^\/]+/)$ $1/index.html;
88
-
try_files $uri $uri/ =404;
89
-
'';
90
-
91
-
locations."~ \.php(?:$|/)".extraConfig = ''
92
-
fastcgi_split_path_info ^(.+\.php)(/.+)$;
93
-
include ${pkgs.nginx}/conf/fastcgi_params;
94
-
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
95
-
fastcgi_param PATH_INFO $fastcgi_path_info;
96
-
fastcgi_param HTTPS on;
97
-
fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
98
-
fastcgi_pass unix:/srv/http/${domain}/phpfpm.pool;
99
-
fastcgi_intercept_errors on;
100
-
'';
101
-
102
-
# Adding the cache control header for js and css files
103
-
# Make sure it is BELOW the location ~ \.php(?:$|/) { block
104
-
locations."~* \.(?:css|js)$".extraConfig = ''
105
-
add_header Cache-Control "public, max-age=7200";
106
-
# Add headers to serve security related headers
107
-
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
108
-
add_header X-Content-Type-Options nosniff;
109
-
add_header X-Frame-Options "SAMEORIGIN";
110
-
add_header X-XSS-Protection "1; mode=block";
111
-
add_header X-Robots-Tag none;
112
-
# Optional: Don't log access to assets
113
-
access_log off;
114
-
'';
115
-
# Optional: Don't log access to other assets
116
-
locations."~* \.(?:jpg|jpeg|gif|bmp|ico|png|swf)$".extraConfig = ''
117
-
access_log off;
118
-
'';
119
-
};
120
-
services.phpfpm.pools."${domain}" = {
121
-
user = "nginx";
122
-
group = "nginx";
123
-
settings = {
124
-
listen = "/srv/http/${domain}/phpfpm.pool";
125
-
pm = "dynamic";
126
-
"pm.max_children" = 32;
127
-
"pm.max_requests" = 500;
128
-
"pm.start_servers" = 2;
129
-
"pm.min_spare_servers" = 2;
130
-
"pm.max_spare_servers" = 5;
131
-
};
132
-
};
133
-
};
134
-
135
-
serveWordpress =
136
-
domains:
137
-
let
138
-
domain = head domains;
139
-
140
-
in
141
-
{
142
-
services.nginx.virtualHosts."${domain}" = {
143
-
enableACME = true;
144
-
forceSSL = true;
145
-
serverAliases = domains;
146
-
extraConfig = ''
147
-
root /srv/http/${domain}/;
148
-
index index.php;
149
-
access_log /tmp/nginx_acc.log;
150
-
error_log /tmp/nginx_err.log;
151
-
error_page 404 /404.html;
152
-
error_page 500 502 503 504 /50x.html;
153
-
client_max_body_size 100m;
154
-
'';
155
-
locations."/".extraConfig = ''
156
-
try_files $uri $uri/ /index.php?$args;
157
-
'';
158
-
locations."~ \.php$".extraConfig = ''
159
-
fastcgi_pass unix:/srv/http/${domain}/phpfpm.pool;
160
-
fastcgi_read_timeout 120;
161
-
include ${pkgs.nginx}/conf/fastcgi.conf;
162
-
'';
163
-
#Directives to send expires headers and turn off 404 error logging.
164
-
locations."~* ^.+\.(xml|ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|css|rss|atom|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$".extraConfig =
165
-
''
166
-
access_log off;
167
-
log_not_found off;
168
-
expires max;
169
-
'';
170
-
locations."/nb".extraConfig = ''
171
-
index index.html;
172
-
'';
173
-
};
174
-
services.phpfpm.pools."${domain}" = {
175
-
user = "nginx";
176
-
group = "nginx";
177
-
settings = {
178
-
listen = "/srv/http/${domain}/phpfpm.pool";
179
-
pm = "dynamic";
180
-
"pm.max_children" = 32;
181
-
"pm.max_requests" = 500;
182
-
"pm.start_servers" = 2;
183
-
"pm.min_spare_servers" = 2;
184
-
"pm.max_spare_servers" = 5;
185
-
};
186
19
};
187
20
};
188
21
}
-1
machines/neoprism/config.nix
-1
machines/neoprism/config.nix
-14
machines/prism/config.nix
-14
machines/prism/config.nix
···
35
35
imports = [
36
36
../../2configs/websites/domsen.nix
37
37
];
38
-
# needed by domsen.nix ^^
39
-
lass.usershadow = {
40
-
enable = true;
41
-
};
42
38
43
39
krebs.iptables.tables.filter.INPUT.rules = [
44
40
{
···
227
223
services.nginx.virtualHosts."cgit.lassul.us".acmeFallbackHost = "orange.r";
228
224
services.nginx.virtualHosts."mail.lassul.us".acmeFallbackHost = "neoprism.r";
229
225
services.nginx.virtualHosts."mumble.lassul.us".acmeFallbackHost = "neoprism.r";
230
-
services.nginx.virtualHosts."mail.ubikmedia.eu" = {
231
-
enableACME = true;
232
-
forceSSL = true;
233
-
acmeFallbackHost = "ubik.r";
234
-
locations."/" = {
235
-
recommendedProxySettings = true;
236
-
proxyWebsockets = true;
237
-
proxyPass = "https://ubik.r";
238
-
};
239
-
};
240
226
}
241
227
];
242
228
-321
machines/ubik/config.nix
-321
machines/ubik/config.nix
···
1
-
{
2
-
self,
3
-
config,
4
-
pkgs,
5
-
...
6
-
}:
7
-
{
8
-
imports = [
9
-
../../2configs
10
-
../../2configs/retiolum.nix
11
-
../../2configs/autoupdate.nix
12
-
13
-
self.inputs.stockholm.nixosModules.exim-smarthost
14
-
];
15
-
16
-
krebs.build.host = config.krebs.hosts.ubik;
17
-
clan.core.vars.password-store.secretLocation = "/var/state/secret-vars";
18
-
19
-
krebs.sync-containers3.inContainer = {
20
-
enable = true;
21
-
pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPBFGMjH0+Dco6DVFZbByENMci8CFTLXCL7j53yctPnM";
22
-
};
23
-
24
-
security.acme = {
25
-
acceptTerms = true;
26
-
defaults.email = "acme@lassul.us";
27
-
};
28
-
networking.firewall.allowedTCPPorts = [
29
-
80
30
-
443
31
-
];
32
-
33
-
# nextcloud
34
-
services.nginx.virtualHosts."c.apanowicz.de" = {
35
-
enableACME = true;
36
-
forceSSL = true;
37
-
};
38
-
services.nextcloud = {
39
-
enable = true;
40
-
hostName = "c.apanowicz.de";
41
-
package = pkgs.nextcloud31;
42
-
config.dbtype = "sqlite";
43
-
config.adminpassFile = config.clan.core.vars.generators.nextcloud-pw.files.nextcloud-pw.path;
44
-
https = true;
45
-
maxUploadSize = "9001M";
46
-
};
47
-
clan.core.vars.generators.nextcloud-pw = {
48
-
prompts.nextcloud-pw.persist = true;
49
-
};
50
-
51
-
# mail
52
-
lass.usershadow.enable = true;
53
-
services.nginx.virtualHosts."mail.ubikmedia.eu" = {
54
-
enableACME = true;
55
-
forceSSL = true;
56
-
};
57
-
services.roundcube = {
58
-
enable = true;
59
-
hostName = "mail.ubikmedia.eu";
60
-
extraConfig = ''
61
-
$config['smtp_debug'] = true;
62
-
$config['smtp_host'] = "localhost:25";
63
-
'';
64
-
};
65
-
services.dovecot2 = {
66
-
enable = true;
67
-
showPAMFailure = true;
68
-
mailLocation = "maildir:~/Mail";
69
-
sslServerCert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
70
-
sslServerKey = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
71
-
};
72
-
krebs.exim-smarthost = {
73
-
ssl_cert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
74
-
ssl_key = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
75
-
authenticators.PLAIN = ''
76
-
driver = plaintext
77
-
public_name = PLAIN
78
-
server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
79
-
'';
80
-
authenticators.LOGIN = ''
81
-
driver = plaintext
82
-
public_name = LOGIN
83
-
server_prompts = "Username:: : Password::"
84
-
server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
85
-
# server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
86
-
'';
87
-
internet-aliases = [
88
-
{
89
-
from = "dma@ubikmedia.de";
90
-
to = "domsen";
91
-
}
92
-
{
93
-
from = "dma@ubikmedia.eu";
94
-
to = "domsen";
95
-
}
96
-
{
97
-
from = "hallo@apanowicz.de";
98
-
to = "domsen";
99
-
}
100
-
{
101
-
from = "bruno@apanowicz.de";
102
-
to = "bruno";
103
-
}
104
-
{
105
-
from = "mail@jla-trading.com";
106
-
to = "jla-trading";
107
-
}
108
-
{
109
-
from = "jms@ubikmedia.eu";
110
-
to = "jms";
111
-
}
112
-
{
113
-
from = "ms@ubikmedia.eu";
114
-
to = "ms";
115
-
}
116
-
{
117
-
from = "ubik@ubikmedia.eu";
118
-
to = "domsen, jms, ms";
119
-
}
120
-
{
121
-
from = "kontakt@alewis.de";
122
-
to = "klabusterbeere";
123
-
}
124
-
{
125
-
from = "hallo@jarugadesign.de";
126
-
to = "kasia";
127
-
}
128
-
{
129
-
from = "noreply@beeshmooth.ch";
130
-
to = "besmooth@gmx.ch";
131
-
}
132
-
133
-
{
134
-
from = "testuser@ubikmedia.eu";
135
-
to = "testuser";
136
-
}
137
-
];
138
-
sender_domains = [
139
-
"jla-trading.com"
140
-
"ubikmedia.eu"
141
-
"ubikmedia.de"
142
-
"apanowicz.de"
143
-
"alewis.de"
144
-
"jarugadesign.de"
145
-
"beesmooth.ch"
146
-
];
147
-
dkim = [
148
-
{ domain = "ubikmedia.eu"; }
149
-
{ domain = "apanowicz.de"; }
150
-
{ domain = "beesmooth.ch"; }
151
-
];
152
-
};
153
-
154
-
# users
155
-
users.groups.xanf = { };
156
-
users.users.UBIK-SFTP = {
157
-
uid = pkgs.stockholm.lib.genid_uint31 "UBIK-SFTP";
158
-
home = "/home/UBIK-SFTP";
159
-
useDefaultShell = true;
160
-
createHome = true;
161
-
isNormalUser = true;
162
-
};
163
-
164
-
users.users.xanf = {
165
-
uid = pkgs.stockholm.lib.genid_uint31 "xanf";
166
-
group = "xanf";
167
-
home = "/home/xanf";
168
-
useDefaultShell = true;
169
-
createHome = false; # creathome forces permissions
170
-
isNormalUser = true;
171
-
};
172
-
173
-
users.users.domsen = {
174
-
uid = pkgs.stockholm.lib.genid_uint31 "domsen";
175
-
description = "maintenance acc for domsen";
176
-
home = "/home/domsen";
177
-
useDefaultShell = true;
178
-
extraGroups = [
179
-
"syncthing"
180
-
"download"
181
-
"xanf"
182
-
];
183
-
createHome = true;
184
-
isNormalUser = true;
185
-
};
186
-
187
-
users.users.bruno = {
188
-
uid = pkgs.stockholm.lib.genid_uint31 "bruno";
189
-
home = "/home/bruno";
190
-
useDefaultShell = true;
191
-
createHome = true;
192
-
isNormalUser = true;
193
-
};
194
-
195
-
users.users.jla-trading = {
196
-
uid = pkgs.stockholm.lib.genid_uint31 "jla-trading";
197
-
home = "/home/jla-trading";
198
-
useDefaultShell = true;
199
-
createHome = true;
200
-
isNormalUser = true;
201
-
};
202
-
203
-
users.users.jms = {
204
-
uid = pkgs.stockholm.lib.genid_uint31 "jms";
205
-
home = "/home/jms";
206
-
useDefaultShell = true;
207
-
createHome = true;
208
-
isNormalUser = true;
209
-
};
210
-
211
-
users.users.ms = {
212
-
uid = pkgs.stockholm.lib.genid_uint31 "ms";
213
-
home = "/home/ms";
214
-
useDefaultShell = true;
215
-
createHome = true;
216
-
isNormalUser = true;
217
-
};
218
-
219
-
users.users.testuser = {
220
-
uid = pkgs.stockholm.lib.genid_uint31 "testuser";
221
-
home = "/home/testuser";
222
-
useDefaultShell = true;
223
-
createHome = true;
224
-
isNormalUser = true;
225
-
};
226
-
227
-
users.users.bui = {
228
-
uid = pkgs.stockholm.lib.genid_uint31 "bui";
229
-
home = "/home/bui";
230
-
useDefaultShell = true;
231
-
createHome = true;
232
-
isNormalUser = true;
233
-
};
234
-
235
-
users.users.klabusterbeere = {
236
-
uid = pkgs.stockholm.lib.genid_uint31 "klabusterbeere";
237
-
home = "/home/klabusterbeere";
238
-
useDefaultShell = true;
239
-
createHome = true;
240
-
isNormalUser = true;
241
-
};
242
-
243
-
users.users.kasia = {
244
-
uid = pkgs.stockholm.lib.genid_uint31 "kasia";
245
-
home = "/home/kasia";
246
-
useDefaultShell = true;
247
-
createHome = true;
248
-
isNormalUser = true;
249
-
};
250
-
251
-
users.users.XANF_TEAM = {
252
-
uid = pkgs.stockholm.lib.genid_uint31 "XANF_TEAM";
253
-
group = "xanf";
254
-
home = "/home/XANF_TEAM";
255
-
useDefaultShell = true;
256
-
createHome = true;
257
-
isNormalUser = true;
258
-
};
259
-
260
-
users.users.dif = {
261
-
uid = pkgs.stockholm.lib.genid_uint31 "dif";
262
-
home = "/home/dif";
263
-
useDefaultShell = true;
264
-
extraGroups = [ "xanf" ];
265
-
createHome = true;
266
-
isNormalUser = true;
267
-
};
268
-
269
-
users.users.lavafilms = {
270
-
uid = pkgs.stockholm.lib.genid_uint31 "lavafilms";
271
-
home = "/home/lavafilms";
272
-
useDefaultShell = true;
273
-
extraGroups = [ "xanf" ];
274
-
createHome = true;
275
-
isNormalUser = true;
276
-
};
277
-
278
-
users.users.movematchers = {
279
-
uid = pkgs.stockholm.lib.genid_uint31 "movematchers";
280
-
home = "/home/movematchers";
281
-
useDefaultShell = true;
282
-
extraGroups = [ "xanf" ];
283
-
createHome = true;
284
-
isNormalUser = true;
285
-
};
286
-
287
-
users.users.blackphoton = {
288
-
uid = pkgs.stockholm.lib.genid_uint31 "blackphoton";
289
-
home = "/home/blackphoton";
290
-
useDefaultShell = true;
291
-
extraGroups = [ "xanf" ];
292
-
createHome = true;
293
-
isNormalUser = true;
294
-
};
295
-
296
-
users.users.line = {
297
-
uid = pkgs.stockholm.lib.genid_uint31 "line";
298
-
home = "/home/line";
299
-
useDefaultShell = true;
300
-
# extraGroups = [ "xanf" ];
301
-
createHome = true;
302
-
isNormalUser = true;
303
-
};
304
-
305
-
users.users.avada = {
306
-
uid = pkgs.stockholm.lib.genid_uint31 "avada";
307
-
home = "/home/avada";
308
-
useDefaultShell = true;
309
-
createHome = true;
310
-
isNormalUser = true;
311
-
};
312
-
313
-
users.users.familienrat = {
314
-
uid = pkgs.stockholm.lib.genid_uint31 "familienrat";
315
-
home = "/home/familienrat";
316
-
useDefaultShell = true;
317
-
createHome = true;
318
-
isNormalUser = true;
319
-
};
320
-
321
-
}
-1
machines/ubik/facter.json
-1
machines/ubik/facter.json
···
1
-
{"system":"x86_64-linux"}
-7
machines/ubik/physical.nix
-7
machines/ubik/physical.nix
-1
machines/ubik/facts/mycelium_ip
-1
machines/ubik/facts/mycelium_ip
···
1
-
481:f89e:4a34:7766:1c5b:af7c:a1c1:7c8b
-1
machines/ubik/facts/mycelium_pubkey
-1
machines/ubik/facts/mycelium_pubkey
···
1
-
6b24af557eb8b9f4876f195345a56f8bd4b630a9ea5d70d69d44a0e7f1859d79
-1
machines/ubik/facts/retiolum.ed25519_key.pub
-1
machines/ubik/facts/retiolum.ed25519_key.pub
···
1
-
BcbZOID7dipWNH0/uowqCF7Ivqm4QktMoz11Yv249tG
-13
machines/ubik/facts/retiolum.rsa_key.pub
-13
machines/ubik/facts/retiolum.rsa_key.pub
···
1
-
-----BEGIN RSA PUBLIC KEY-----
2
-
MIICCgKCAgEAnWJKDrDmmGZbwVeaBhvOdTR4nsumo1yzOR2Iu+SMTOH6fbgJM5cW
3
-
WtlgPhrdOMrBYR956SBiBNkvsdczRrOF7F6hvXyDwwoGdWGsZXzaTMJlNAYjP5Y4
4
-
fbJlDq8/QV/SvVFGeu4XP3g2yuU/aNu/4FkU4jlysX+8wo9qGpIFPLpLvqfuU247
5
-
jHCatNzHfLK60fx7yt57iDhuX2plyFfQVX7xPTxudfGZKD7rEDEnKX4Ghd5dUkOA
6
-
z0lr0B1AOrkZgrnajU0ZmkjnNy8lrylCWDOnEPhJdao53gL4XFmUcZaR4uFsWuS7
7
-
V1VM+VivuMTAXRUnJScyLap2mo6dcr9h11kas70c/R7tI2pGmxlNk9t2uYy/jQnC
8
-
WmyzNCcqpPSfKikx5sRVAVIuv2wtAKYDuZg+1D4YEfeklA0+ZZlHO43NnRnIoKeO
9
-
Za0SNUE6vtd/EPoiifMkOWtHaO0LppgOxMTk8OgUxR6dcTmbuL0Roz3aY0rSW3EG
10
-
+li3yjS3YAtMtvhQwuqooVrkBFrcGQLjTnAfCeUHbCjZidGAHnqhESA+Aj+LKx32
11
-
0ALQY439xAs6Vf3rICs93cO4Yxa8W1F5sHE6ANOGU+jCmSkCWI2hdHGbckD3L0AQ
12
-
NBJ+jyXm0kFfVgqRS2i17JPz2ZZxhAHw3KH13Ef1KI4tMdzCvFSayW0CAwEAAQ==
13
-
-----END RSA PUBLIC KEY-----
-1
machines/ubik/facts/ssh.id_ed25519.pub
-1
machines/ubik/facts/ssh.id_ed25519.pub
···
1
-
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHlqW8zqJpjbva0NTty9Ex7R/Jk2emDxHJNpaM3WPt5L
-1
machines/ubik/facts/wiregrill.pub
-1
machines/ubik/facts/wiregrill.pub
···
1
-
JakWwg7Rq76jjzLFWPBQJPpzRHbIEbb46VLsSUOKI2I=
-1
machines/ubik/facts/zerotier-ip
-1
machines/ubik/facts/zerotier-ip
···
1
-
fdcc:c5da:5295:c853:d499:93d1:8943:612b