fix: had forgotten someone

Reviewed-on: #143

applications/email.nix

@@ -470,7 +470,7 @@ in {
 
     mailserver = {
       enable = true;
-      stateVersion = 1;
+      stateVersion = 3;
 
       fqdn = "${cfg.sub}.${cfg.domain}";
       domains = [

applications/itd/splunk/module.nix

@@ -1,189 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-with lib; let
-  name = "splunk";
-  cfg = config.services.itd."${name}";
-
-  package = pkgs.callPackage ./package.nix {};
-in {
-  imports = [];
-
-  options.services.itd."${name}" = {
-    enable = mkEnableOption "ITD Splunk";
-
-    user = {
-      user = mkOption {
-        type = types.str;
-        default = "splunk";
-      };
-      group = mkOption {
-        type = types.str;
-        default = "splunk";
-      };
-
-      home = mkOption {
-        type = types.str;
-        default = "/etc/itd/splunk";
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    # create user and group for the program
-    users.groups."${cfg.user.group}" = {};
-    users.users."${cfg.user.user}" = {
-      createHome = true;
-      isNormalUser = true;
-      home = cfg.user.home;
-      group = cfg.user.group;
-      # X11 is to ensure the directory can be traversed
-      homeMode = "711";
-    };
-
-    # might not be required
-    networking.firewall.allowedTCPPorts = [8089];
-
-    # need to set access controls
-    systemd.tmpfiles.rules = [
-      "a /var/log                 - - - - u:splunk:rx"
-      "a /var/log/auth.log        - - - - u:splunk:r "
-      "a /var/log/messages        - - - - u:splunk:r "
-      "a /var/log/secure          - - - - u:splunk:r "
-      "a /var/log/audit           - - - - u:splunk:rx"
-      "a /var/log/audit.log       - - - - u:splunk:r "
-      "a /var/log/audit/audit.log - - - - u:splunk:r "
-      "a /root                    - - - - u:splunk:rx"
-      "a /root/.bash_history      - - - - u:splunk:r "
-      "a /home/*                  - - - - u:splunk:rx"
-      "a /home/*/.bash_history    - - - - u:splunk:r "
-    ];
-
-    security.auditd = {
-      enable = true;
-      settings = {
-        log_group = cfg.user.group;
-      };
-    };
-
-    # set up the core files
-    systemd.services."${name}_prestart" = {
-      wantedBy = [
-        #      "gitlab.target"
-      ];
-      partOf = [
-        #      "gitlab.target"
-      ];
-      path = with pkgs; [util-linux];
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-        #        User = cfg.user.user;
-        #        Group = cfg.user.group;
-        #        TimeoutSec = "infinity";
-        #        Restart = "on-failure";
-        #        WorkingDirectory = "${cfg.package}/share/gitlab";
-        #        Slice = "system-gitlab.slice";
-        RemainAfterExit = true;
-        ExecStart = let
-          # from $SPLUNK_HOME/etc/splunk-launch.conf.default
-          splunk_launch = pkgs.writeText "splunk-launch" ''
-            SPLUNK_HOME=${cfg.user.home}
-            SPLUNK_SERVER_NAME=SplunkForwarder
-            PYTHONHTTPSVERIFY=0
-            PYTHONUTF8=1
-          '';
-
-          etc_passwd = pkgs.writeText "passwd" ''
-            :admin:$6$XOFhpq0Y1Ul1pejO$DUkXU6xSAKYrl3nLTPFS7LJqlnWC4r97SSikjCzv7XNEG6lgP32TZHyLDY/aJs8ZYyblZ5spfmnlMvh8Lxndi/::Administrator:admin:changeme@example.com:::20329
-          '';
-
-          deployment_client = pkgs.writeText "deploymentclient" ''
-            [deployment-client]
-            clientName = UL_client
-            [target-broker:deploymentServer]
-            targetUri = soc-deployment.heanet.ie:8089
-          '';
-        in
-          pkgs.writeShellScript "splunk-config" ''
-            set -o errexit -o pipefail -o nounset
-            shopt -s inherit_errexit
-
-            umask u=rwx,g=rx,o=
-
-            # start with a clean slate, it yells at ye if ye try to boot it up without doing this
-            rm -rf ${cfg.user.home}/*
-
-            chmod 771 -R ${cfg.user.home}
-
-            # pull in all relevent files
-            cp -f -R ${package}/* ${cfg.user.home}
-
-            chmod 771 -R ${cfg.user.home}
-            chown ${cfg.user.user}:${cfg.user.group} -R ${cfg.user.home}
-
-            # if [ ! -f ${cfg.user.home}/etc/splunk-launch.conf ]; then
-              export SPLUNK_HOME=${cfg.user.home}
-
-              cp ${splunk_launch} $SPLUNK_HOME/etc/splunk-launch.conf
-
-              cp ${etc_passwd} $SPLUNK_HOME/etc/passwd
-
-              # ensure the dir exists
-              mkdir -p $SPLUNK_HOME/etc/apps/000_ul_umbrio_essentials/local/
-              cp ${deployment_client} $SPLUNK_HOME/etc/apps/000_ul_umbrio_essentials/local/deploymentclient.conf
-
-              # make sure user permissions are correct
-              chmod 771 -R ${cfg.user.home}
-              chown ${cfg.user.user}:${cfg.user.group} -R ${cfg.user.home}
-
-              # run it to see if that works
-              runuser -u ${cfg.user.user} -- $SPLUNK_HOME/bin/splunk start --accept-license
-
-              # $SPLUNK_HOME/bin/splunk enable boot-start
-              # /etc/systemd/system/multi-user.target.wants/SplunkForwarder.service
-            # fi
-          '';
-      };
-    };
-
-    systemd.services."${name}" = {
-      wantedBy = [
-      ];
-      requires = [
-        "${name}_prestart.service"
-      ];
-      path = with pkgs; [util-linux toybox];
-      serviceConfig = {
-        Type = "simple";
-        Restart = "always";
-        Environment = "SPLUNK_HOME=${cfg.user.home}";
-        ExecStart = "${package}/bin/splunk  _internal_launch_under_systemd";
-        KillMode = "mixed";
-        KillSignal = "SIGINT";
-        TimeoutStopSec = 360;
-        LimitNOFILE = 65536;
-        LimitRTPRIO = 99;
-        SuccessExitStatus = "51 52";
-        RestartPreventExitStatus = 51;
-        RestartForceExitStatus = 52;
-        User = cfg.user.user;
-        Group = cfg.user.group;
-        NoNewPrivileges = "yes";
-        AmbientCapabilities = "CAP_DAC_READ_SEARCH";
-
-        # ExecStartPre=-/bin/bash -c "chown -R splunk:splunk /opt/splunkforwarder"
-        Delegate = "true";
-        #         CPUShares=1024;
-        #         MemoryLimit=3973632000;
-        PermissionsStartOnly = "true";
-        # ExecStartPost=-/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/cpu/system.slice/%n"
-        # ExecStartPost=-/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/memory/system.slice/%n"
-      };
-    };
-  };
-}

applications/itd/splunk/package.nix

@@ -1,48 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchurl,
-  gnused,
-  openssl,
-  zlib,
-  autoPatchelfHook,
-}:
-stdenv.mkDerivation rec {
-  pname = "splunk-forwarder";
-  version = "9.1.7";
-  version_long = "${version}-e17104057ef0";
-
-  src = fetchurl {
-    url = "https://download.splunk.com/products/universalforwarder/releases/${version}/linux/splunkforwarder-${version_long}-Linux-x86_64.tgz";
-    hash = "sha256-EWpfenEhExe5qDscqb7ZQUwahYgAgPQ+APLlweRQAoc=";
-  };
-
-  nativeBuildInputs = [autoPatchelfHook];
-
-  buildInputs = [
-    #    alsaLib
-    openssl
-    zlib
-    gnused
-  ];
-
-  sourceRoot = ".";
-
-  installPhase = ''
-    runHook preInstall
-    # gets unzipped and we just pop it all into teh output
-    cp -R ./splunkforwarder $out
-
-    # Splunk is doing a crime by deciding what teh path is, need to comment out this line in /bin/pid_check.sh
-    # PATH=/usr/xpg4/bin:/usr/bin:/bin
-    find $out -type f -name "*.sh" -print0 | xargs -0 sed -i -e 's/PATH=/#PATH=/g'
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    homepage = "https://splunk.com";
-    description = "Logging Service";
-    platforms = platforms.linux;
-  };
-}

applications/skynet.ie/skynet.ie.nix

@@ -48,6 +48,11 @@ in {
         r_type = "CNAME";
         value = config.services.skynet.host.name;
       }
+      {
+        record = "wolves";
+        r_type = "CNAME";
+        value = config.services.skynet.host.name;
+      }
       {
         record = "public";
         r_type = "CNAME";
@@ -80,6 +85,12 @@ in {
         "www.skynet.ie" = main_site;
         "skynet.ie" = main_site;
 
+        "wolves.skynet.ie" = {
+          forceSSL = true;
+          useACMEHost = "skynet";
+          locations."/".return = "307 https://ulwolves.ie/society/computer";
+        };
+
         # a custom discord url, because we are too cheap otehrwise
         "discord.skynet.ie" = {
           forceSSL = true;

config/users.nix

@@ -52,24 +52,36 @@ in {
       committee = lib.lists.unique (
         # Committee - Core
         [
+          # President
           "silver"
-          "eoghanconlon73"
+          # Secretary
-          "nanda"
+          "kaiden"
+          # Treasurer
+          "peace"
+          # PRO
+          "amymucko"
+          # HSO
           "skyapples"
-          "generically"
         ]
         # Committee - OCM
         ++ [
+          "connormc"
+          "cordlesscoder"
+          "dca_"
           "eliza"
-          "amymucko"
+          "emilyrutai"
-          "archiedms"
+          "generically"
-          "kaiden"
+          "mysticwolf"
+          "nanda"
+          "rituk_0817"
+          "sania_m"
+          "shourjyo24_"
+          "sunny"
+          "tatabbyi"
+          "wormyworm5"
         ]
         # Committee - SISTEM
-        ++ [
+        ++ []
-          "peace"
-          "milan"
-        ]
         # Admins are part of Committee as well
         ++ cfg.admin
       );
@@ -78,8 +90,6 @@ in {
         "evanc"
         "eliza"
         "esy"
-        # for temp reasons
-        "peace"
       ];
       trainee = [];
       lifetime = [];

flake.lock

@@ -90,11 +90,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1723391194,
+        "lastModified": 1723500950,
-        "narHash": "sha256-04UThV4LZNRHg/+GbEl7M2ginWbm8FrQ5jBVmYcroNg=",
+        "narHash": "sha256-t1eApFGI+JzLIW2YToLlDV20n+Nevk1q4fZBYU1m93I=",
         "owner": "silver_rust",
         "repo": "bfom",
-        "rev": "fffd69b6433a2d2fd359b92e3816ae9938b3e99c",
+        "rev": "7f339f28442758ecc3f1697e3f70d441973664b9",
         "type": "gitlab"
       },
       "original": {
@@ -148,11 +148,11 @@
         "utils": "utils_2"
       },
       "locked": {
-        "lastModified": 1741131635,
+        "lastModified": 1758582048,
-        "narHash": "sha256-W65UdgryecEzfS6myQ+1Sj5P3yBCJRlGRf+fU78Ei2g=",
+        "narHash": "sha256-SIt6rPXx7O3YMrEw8YrwHNMjOrrJLu/Tf1sMll1Qp9A=",
         "ref": "refs/heads/main",
-        "rev": "b5089910d0d0b303b634c7e125ac0b9ba8728bd9",
+        "rev": "4d825caf25cb966ddb5ce33a0e9b2aa73b0262c6",
-        "revCount": 111,
+        "revCount": 130,
         "type": "git",
         "url": "https://forgejo.skynet.ie/Computer_Society/presentations_compsoc"
       },
@@ -359,11 +359,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749636823,
+        "lastModified": 1750779888,
-        "narHash": "sha256-WUaIlOlPLyPgz9be7fqWJA5iG6rHcGRtLERSCfUDne4=",
+        "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "623c56286de5a3193aa38891a6991b28f9bab056",
+        "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
         "type": "github"
       },
       "original": {
@@ -542,11 +542,11 @@
     },
     "nixpkgs-25_05": {
       "locked": {
-        "lastModified": 1749727998,
+        "lastModified": 1753749649,
-        "narHash": "sha256-mHv/yeUbmL91/TvV95p+mBVahm9mdQMJoqaTVTALaFw=",
+        "narHash": "sha256-+jkEZxs7bfOKfBIk430K+tK9IvXlwzqQQnppC2ZKFj4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fd487183437963a59ba763c0cc4f27e3447dd6dd",
+        "rev": "1f08a4df998e21f4e8be8fb6fbf61d11a1a5076a",
         "type": "github"
       },
       "original": {
@@ -895,20 +895,6 @@
       }
     },
     "nixpkgs_6": {
-      "locked": {
-        "lastModified": 1715413075,
-        "narHash": "sha256-FCi3R1MeS5bVp0M0xTheveP6hhcCYfW/aghSTPebYL4=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "e4e7a43a9db7e22613accfeb1005cca1b2b1ee0d",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "type": "indirect"
-      }
-    },
-    "nixpkgs_7": {
       "locked": {
         "lastModified": 1756787288,
         "narHash": "sha256-rw/PHa1cqiePdBxhF66V7R+WAP8WekQ0mCDG4CFqT8Y=",
@@ -923,6 +909,21 @@
         "type": "indirect"
       }
     },
+    "nixpkgs_7": {
+      "locked": {
+        "lastModified": 1751271578,
+        "narHash": "sha256-P/SQmKDu06x8yv7i0s8bvnnuJYkxVGBWLWHaU+tt4YY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "3016b4b15d13f3089db8a41ef937b13a9e33a8df",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-unstable",
+        "type": "indirect"
+      }
+    },
     "nixpkgs_8": {
       "locked": {
         "lastModified": 1723151389,
@@ -1023,11 +1024,11 @@
         "nixpkgs-25_05": "nixpkgs-25_05"
       },
       "locked": {
-        "lastModified": 1750183846,
+        "lastModified": 1758367587,
-        "narHash": "sha256-owKJ2rsa/0WVZQAprlbqgVAAGlz3MFuvgNea3+ic4fs=",
+        "narHash": "sha256-crj6Ps1BwNbmsk7I7v6K2Dw55vczuQRtTklYiFiQ0Jw=",
         "ref": "refs/heads/master",
-        "rev": "c097bd662c9e1aea8c1fca10d57188e81c5574a0",
+        "rev": "8bca7ebf09d3eb2bfcafe41b9133ee262f09558d",
-        "revCount": 743,
+        "revCount": 794,
         "type": "git",
         "url": "https://forgejo.skynet.ie/Skynet/misc_nixos-mailserver"
       },
@@ -1044,11 +1045,11 @@
         "utils": "utils_3"
       },
       "locked": {
-        "lastModified": 1757023884,
+        "lastModified": 1758295049,
-        "narHash": "sha256-E+lp2PyQo9vakrwAjcB+krIGPi095CaAbZ/49tWvCtw=",
+        "narHash": "sha256-h14Vl/OVguj5jD54xf+3w3DBIloQkoFBH86/xJ35jV8=",
         "ref": "refs/heads/main",
-        "rev": "7526a82bb7c384c16a09992458868b2f669ed279",
+        "rev": "313be247d96131fbea418b826d7b68521c48bd8a",
-        "revCount": 320,
+        "revCount": 326,
         "type": "git",
         "url": "https://forgejo.skynet.ie/Skynet/discord-bot"
       },
@@ -1086,11 +1087,11 @@
         "utils": "utils_5"
       },
       "locked": {
-        "lastModified": 1751234352,
+        "lastModified": 1757267915,
-        "narHash": "sha256-OeNGbd3kn2jjJq9nbNcLq7wquc8leOyWkahuWopKnv4=",
+        "narHash": "sha256-cJA/dTc+VCjODKu5WEycBrEZRxd4STzxhpfUK2kIS4g=",
         "ref": "refs/heads/main",
-        "rev": "1dae2ecb2623d55c88a237d55198efd51e0fd8fe",
+        "rev": "3d882056bc78707ff57321862522ca8d1fc2a3c1",
-        "revCount": 249,
+        "revCount": 252,
         "type": "git",
         "url": "https://forgejo.skynet.ie/Skynet/ldap_backend"
       },
@@ -1124,11 +1125,11 @@
         "utils": "utils_7"
       },
       "locked": {
-        "lastModified": 1732375016,
+        "lastModified": 1758195787,
-        "narHash": "sha256-Y+bJw85TNOp8N369OV0VrDdm3oDy8CXG+GUuG6pZjbo=",
+        "narHash": "sha256-YK5rEiaPqH19PPwMO/smF3SJDdEosGyqUQ8pDEmnfK8=",
         "ref": "refs/heads/main",
-        "rev": "8987e33cb709e7f2c30017e77edf9161b87d9885",
+        "rev": "afd55717913278d4541ae0d21ca915a045423574",
-        "revCount": 29,
+        "revCount": 31,
         "type": "git",
         "url": "https://forgejo.skynet.ie/Skynet/website_2023"
       },
@@ -1302,11 +1303,11 @@
         "utils": "utils_16"
       },
       "locked": {
-        "lastModified": 1752925027,
+        "lastModified": 1758635905,
-        "narHash": "sha256-APuWWdod4L3mgSBXJTukfbB8s37NvzUkju+lELUD7PI=",
+        "narHash": "sha256-PPqhD2RHUOwJrbey72H1wnmdpeELilwKlND4TR5qo2k=",
         "ref": "refs/heads/main",
-        "rev": "917c316e7606995362b436f5c6248f058c762176",
+        "rev": "eb1fc042b5d410b17dd63c492c03be78443ed07f",
-        "revCount": 166,
+        "revCount": 167,
         "type": "git",
         "url": "https://forgejo.skynet.ie/Skynet/wiki"
       },

machines/marvin.nix

@@ -30,7 +30,6 @@ Notes:
   groups_trusted = map (x: "@${x}") groups;
 in {
   imports = [
-    ../applications/itd/splunk/module.nix
   ];
 
   deployment = {
@@ -59,8 +58,4 @@ in {
     host = host;
     backup.enable = true;
   };
-
-  services.itd.splunk = {
-    enable = true;
-  };
 }