diff --git a/applications/email.nix b/applications/email.nix index 97b2362..d7a6381 100644 --- a/applications/email.nix +++ b/applications/email.nix @@ -470,7 +470,7 @@ in { mailserver = { enable = true; - stateVersion = 3; + stateVersion = 1; fqdn = "${cfg.sub}.${cfg.domain}"; domains = [ diff --git a/applications/itd/splunk/module.nix b/applications/itd/splunk/module.nix new file mode 100644 index 0000000..304d29e --- /dev/null +++ b/applications/itd/splunk/module.nix @@ -0,0 +1,189 @@ +{ + config, + pkgs, + lib, + ... +}: +with lib; let + name = "splunk"; + cfg = config.services.itd."${name}"; + + package = pkgs.callPackage ./package.nix {}; +in { + imports = []; + + options.services.itd."${name}" = { + enable = mkEnableOption "ITD Splunk"; + + user = { + user = mkOption { + type = types.str; + default = "splunk"; + }; + group = mkOption { + type = types.str; + default = "splunk"; + }; + + home = mkOption { + type = types.str; + default = "/etc/itd/splunk"; + }; + }; + }; + + config = mkIf cfg.enable { + # create user and group for the program + users.groups."${cfg.user.group}" = {}; + users.users."${cfg.user.user}" = { + createHome = true; + isNormalUser = true; + home = cfg.user.home; + group = cfg.user.group; + # X11 is to ensure the directory can be traversed + homeMode = "711"; + }; + + # might not be required + networking.firewall.allowedTCPPorts = [8089]; + + # need to set access controls + systemd.tmpfiles.rules = [ + "a /var/log - - - - u:splunk:rx" + "a /var/log/auth.log - - - - u:splunk:r " + "a /var/log/messages - - - - u:splunk:r " + "a /var/log/secure - - - - u:splunk:r " + "a /var/log/audit - - - - u:splunk:rx" + "a /var/log/audit.log - - - - u:splunk:r " + "a /var/log/audit/audit.log - - - - u:splunk:r " + "a /root - - - - u:splunk:rx" + "a /root/.bash_history - - - - u:splunk:r " + "a /home/* - - - - u:splunk:rx" + "a /home/*/.bash_history - - - - u:splunk:r " + ]; + + security.auditd = { + enable = true; + settings = { + log_group = cfg.user.group; + }; + }; + + # set up the core files + systemd.services."${name}_prestart" = { + wantedBy = [ + # "gitlab.target" + ]; + partOf = [ + # "gitlab.target" + ]; + path = with pkgs; [util-linux]; + serviceConfig = { + Type = "oneshot"; + User = "root"; + Group = "root"; + # User = cfg.user.user; + # Group = cfg.user.group; + # TimeoutSec = "infinity"; + # Restart = "on-failure"; + # WorkingDirectory = "${cfg.package}/share/gitlab"; + # Slice = "system-gitlab.slice"; + RemainAfterExit = true; + ExecStart = let + # from $SPLUNK_HOME/etc/splunk-launch.conf.default + splunk_launch = pkgs.writeText "splunk-launch" '' + SPLUNK_HOME=${cfg.user.home} + SPLUNK_SERVER_NAME=SplunkForwarder + PYTHONHTTPSVERIFY=0 + PYTHONUTF8=1 + ''; + + etc_passwd = pkgs.writeText "passwd" '' + :admin:$6$XOFhpq0Y1Ul1pejO$DUkXU6xSAKYrl3nLTPFS7LJqlnWC4r97SSikjCzv7XNEG6lgP32TZHyLDY/aJs8ZYyblZ5spfmnlMvh8Lxndi/::Administrator:admin:changeme@example.com:::20329 + ''; + + deployment_client = pkgs.writeText "deploymentclient" '' + [deployment-client] + clientName = UL_client + [target-broker:deploymentServer] + targetUri = soc-deployment.heanet.ie:8089 + ''; + in + pkgs.writeShellScript "splunk-config" '' + set -o errexit -o pipefail -o nounset + shopt -s inherit_errexit + + umask u=rwx,g=rx,o= + + # start with a clean slate, it yells at ye if ye try to boot it up without doing this + rm -rf ${cfg.user.home}/* + + chmod 771 -R ${cfg.user.home} + + # pull in all relevent files + cp -f -R ${package}/* ${cfg.user.home} + + chmod 771 -R ${cfg.user.home} + chown ${cfg.user.user}:${cfg.user.group} -R ${cfg.user.home} + + # if [ ! -f ${cfg.user.home}/etc/splunk-launch.conf ]; then + export SPLUNK_HOME=${cfg.user.home} + + cp ${splunk_launch} $SPLUNK_HOME/etc/splunk-launch.conf + + cp ${etc_passwd} $SPLUNK_HOME/etc/passwd + + # ensure the dir exists + mkdir -p $SPLUNK_HOME/etc/apps/000_ul_umbrio_essentials/local/ + cp ${deployment_client} $SPLUNK_HOME/etc/apps/000_ul_umbrio_essentials/local/deploymentclient.conf + + # make sure user permissions are correct + chmod 771 -R ${cfg.user.home} + chown ${cfg.user.user}:${cfg.user.group} -R ${cfg.user.home} + + # run it to see if that works + runuser -u ${cfg.user.user} -- $SPLUNK_HOME/bin/splunk start --accept-license + + # $SPLUNK_HOME/bin/splunk enable boot-start + # /etc/systemd/system/multi-user.target.wants/SplunkForwarder.service + # fi + ''; + }; + }; + + systemd.services."${name}" = { + wantedBy = [ + ]; + requires = [ + "${name}_prestart.service" + ]; + path = with pkgs; [util-linux toybox]; + serviceConfig = { + Type = "simple"; + Restart = "always"; + Environment = "SPLUNK_HOME=${cfg.user.home}"; + ExecStart = "${package}/bin/splunk _internal_launch_under_systemd"; + KillMode = "mixed"; + KillSignal = "SIGINT"; + TimeoutStopSec = 360; + LimitNOFILE = 65536; + LimitRTPRIO = 99; + SuccessExitStatus = "51 52"; + RestartPreventExitStatus = 51; + RestartForceExitStatus = 52; + User = cfg.user.user; + Group = cfg.user.group; + NoNewPrivileges = "yes"; + AmbientCapabilities = "CAP_DAC_READ_SEARCH"; + + # ExecStartPre=-/bin/bash -c "chown -R splunk:splunk /opt/splunkforwarder" + Delegate = "true"; + # CPUShares=1024; + # MemoryLimit=3973632000; + PermissionsStartOnly = "true"; + # ExecStartPost=-/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/cpu/system.slice/%n" + # ExecStartPost=-/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/memory/system.slice/%n" + }; + }; + }; +} diff --git a/applications/itd/splunk/package.nix b/applications/itd/splunk/package.nix new file mode 100644 index 0000000..c5a21ef --- /dev/null +++ b/applications/itd/splunk/package.nix @@ -0,0 +1,48 @@ +{ + stdenv, + lib, + fetchurl, + gnused, + openssl, + zlib, + autoPatchelfHook, +}: +stdenv.mkDerivation rec { + pname = "splunk-forwarder"; + version = "9.1.7"; + version_long = "${version}-e17104057ef0"; + + src = fetchurl { + url = "https://download.splunk.com/products/universalforwarder/releases/${version}/linux/splunkforwarder-${version_long}-Linux-x86_64.tgz"; + hash = "sha256-EWpfenEhExe5qDscqb7ZQUwahYgAgPQ+APLlweRQAoc="; + }; + + nativeBuildInputs = [autoPatchelfHook]; + + buildInputs = [ + # alsaLib + openssl + zlib + gnused + ]; + + sourceRoot = "."; + + installPhase = '' + runHook preInstall + # gets unzipped and we just pop it all into teh output + cp -R ./splunkforwarder $out + + # Splunk is doing a crime by deciding what teh path is, need to comment out this line in /bin/pid_check.sh + # PATH=/usr/xpg4/bin:/usr/bin:/bin + find $out -type f -name "*.sh" -print0 | xargs -0 sed -i -e 's/PATH=/#PATH=/g' + + runHook postInstall + ''; + + meta = with lib; { + homepage = "https://splunk.com"; + description = "Logging Service"; + platforms = platforms.linux; + }; +} diff --git a/applications/skynet.ie/skynet.ie.nix b/applications/skynet.ie/skynet.ie.nix index 99cc46d..fb1bf69 100644 --- a/applications/skynet.ie/skynet.ie.nix +++ b/applications/skynet.ie/skynet.ie.nix @@ -48,11 +48,6 @@ in { r_type = "CNAME"; value = config.services.skynet.host.name; } - { - record = "wolves"; - r_type = "CNAME"; - value = config.services.skynet.host.name; - } { record = "public"; r_type = "CNAME"; @@ -85,12 +80,6 @@ in { "www.skynet.ie" = main_site; "skynet.ie" = main_site; - "wolves.skynet.ie" = { - forceSSL = true; - useACMEHost = "skynet"; - locations."/".return = "307 https://ulwolves.ie/society/computer"; - }; - # a custom discord url, because we are too cheap otehrwise "discord.skynet.ie" = { forceSSL = true; diff --git a/config/users.nix b/config/users.nix index d49d998..f7c3f84 100644 --- a/config/users.nix +++ b/config/users.nix @@ -52,36 +52,24 @@ in { committee = lib.lists.unique ( # Committee - Core [ - # President "silver" - # Secretary - "kaiden" - # Treasurer - "peace" - # PRO - "amymucko" - # HSO + "eoghanconlon73" + "nanda" "skyapples" + "generically" ] # Committee - OCM ++ [ - "connormc" - "cordlesscoder" - "dca_" "eliza" - "emilyrutai" - "generically" - "mysticwolf" - "nanda" - "rituk_0817" - "sania_m" - "shourjyo24_" - "sunny" - "tatabbyi" - "wormyworm5" + "amymucko" + "archiedms" + "kaiden" ] # Committee - SISTEM - ++ [] + ++ [ + "peace" + "milan" + ] # Admins are part of Committee as well ++ cfg.admin ); @@ -90,6 +78,8 @@ in { "evanc" "eliza" "esy" + # for temp reasons + "peace" ]; trainee = []; lifetime = []; diff --git a/flake.lock b/flake.lock index 6f89ba0..285b680 100644 --- a/flake.lock +++ b/flake.lock @@ -90,11 +90,11 @@ "utils": "utils" }, "locked": { - "lastModified": 1723500950, - "narHash": "sha256-t1eApFGI+JzLIW2YToLlDV20n+Nevk1q4fZBYU1m93I=", + "lastModified": 1723391194, + "narHash": "sha256-04UThV4LZNRHg/+GbEl7M2ginWbm8FrQ5jBVmYcroNg=", "owner": "silver_rust", "repo": "bfom", - "rev": "7f339f28442758ecc3f1697e3f70d441973664b9", + "rev": "fffd69b6433a2d2fd359b92e3816ae9938b3e99c", "type": "gitlab" }, "original": { @@ -148,11 +148,11 @@ "utils": "utils_2" }, "locked": { - "lastModified": 1758582048, - "narHash": "sha256-SIt6rPXx7O3YMrEw8YrwHNMjOrrJLu/Tf1sMll1Qp9A=", + "lastModified": 1741131635, + "narHash": "sha256-W65UdgryecEzfS6myQ+1Sj5P3yBCJRlGRf+fU78Ei2g=", "ref": "refs/heads/main", - "rev": "4d825caf25cb966ddb5ce33a0e9b2aa73b0262c6", - "revCount": 130, + "rev": "b5089910d0d0b303b634c7e125ac0b9ba8728bd9", + "revCount": 111, "type": "git", "url": "https://forgejo.skynet.ie/Computer_Society/presentations_compsoc" }, @@ -359,11 +359,11 @@ ] }, "locked": { - "lastModified": 1750779888, - "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=", + "lastModified": 1749636823, + "narHash": "sha256-WUaIlOlPLyPgz9be7fqWJA5iG6rHcGRtLERSCfUDne4=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d", + "rev": "623c56286de5a3193aa38891a6991b28f9bab056", "type": "github" }, "original": { @@ -542,11 +542,11 @@ }, "nixpkgs-25_05": { "locked": { - "lastModified": 1753749649, - "narHash": "sha256-+jkEZxs7bfOKfBIk430K+tK9IvXlwzqQQnppC2ZKFj4=", + "lastModified": 1749727998, + "narHash": "sha256-mHv/yeUbmL91/TvV95p+mBVahm9mdQMJoqaTVTALaFw=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "1f08a4df998e21f4e8be8fb6fbf61d11a1a5076a", + "rev": "fd487183437963a59ba763c0cc4f27e3447dd6dd", "type": "github" }, "original": { @@ -896,26 +896,25 @@ }, "nixpkgs_6": { "locked": { - "lastModified": 1756787288, - "narHash": "sha256-rw/PHa1cqiePdBxhF66V7R+WAP8WekQ0mCDG4CFqT8Y=", + "lastModified": 1715413075, + "narHash": "sha256-FCi3R1MeS5bVp0M0xTheveP6hhcCYfW/aghSTPebYL4=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "d0fc30899600b9b3466ddb260fd83deb486c32f1", + "rev": "e4e7a43a9db7e22613accfeb1005cca1b2b1ee0d", "type": "github" }, "original": { "id": "nixpkgs", - "ref": "nixos-unstable", "type": "indirect" } }, "nixpkgs_7": { "locked": { - "lastModified": 1751271578, - "narHash": "sha256-P/SQmKDu06x8yv7i0s8bvnnuJYkxVGBWLWHaU+tt4YY=", + "lastModified": 1756787288, + "narHash": "sha256-rw/PHa1cqiePdBxhF66V7R+WAP8WekQ0mCDG4CFqT8Y=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "3016b4b15d13f3089db8a41ef937b13a9e33a8df", + "rev": "d0fc30899600b9b3466ddb260fd83deb486c32f1", "type": "github" }, "original": { @@ -1024,11 +1023,11 @@ "nixpkgs-25_05": "nixpkgs-25_05" }, "locked": { - "lastModified": 1758367587, - "narHash": "sha256-crj6Ps1BwNbmsk7I7v6K2Dw55vczuQRtTklYiFiQ0Jw=", + "lastModified": 1750183846, + "narHash": "sha256-owKJ2rsa/0WVZQAprlbqgVAAGlz3MFuvgNea3+ic4fs=", "ref": "refs/heads/master", - "rev": "8bca7ebf09d3eb2bfcafe41b9133ee262f09558d", - "revCount": 794, + "rev": "c097bd662c9e1aea8c1fca10d57188e81c5574a0", + "revCount": 743, "type": "git", "url": "https://forgejo.skynet.ie/Skynet/misc_nixos-mailserver" }, @@ -1045,11 +1044,11 @@ "utils": "utils_3" }, "locked": { - "lastModified": 1758295049, - "narHash": "sha256-h14Vl/OVguj5jD54xf+3w3DBIloQkoFBH86/xJ35jV8=", + "lastModified": 1757023884, + "narHash": "sha256-E+lp2PyQo9vakrwAjcB+krIGPi095CaAbZ/49tWvCtw=", "ref": "refs/heads/main", - "rev": "313be247d96131fbea418b826d7b68521c48bd8a", - "revCount": 326, + "rev": "7526a82bb7c384c16a09992458868b2f669ed279", + "revCount": 320, "type": "git", "url": "https://forgejo.skynet.ie/Skynet/discord-bot" }, @@ -1087,11 +1086,11 @@ "utils": "utils_5" }, "locked": { - "lastModified": 1757267915, - "narHash": "sha256-cJA/dTc+VCjODKu5WEycBrEZRxd4STzxhpfUK2kIS4g=", + "lastModified": 1751234352, + "narHash": "sha256-OeNGbd3kn2jjJq9nbNcLq7wquc8leOyWkahuWopKnv4=", "ref": "refs/heads/main", - "rev": "3d882056bc78707ff57321862522ca8d1fc2a3c1", - "revCount": 252, + "rev": "1dae2ecb2623d55c88a237d55198efd51e0fd8fe", + "revCount": 249, "type": "git", "url": "https://forgejo.skynet.ie/Skynet/ldap_backend" }, @@ -1125,11 +1124,11 @@ "utils": "utils_7" }, "locked": { - "lastModified": 1758195787, - "narHash": "sha256-YK5rEiaPqH19PPwMO/smF3SJDdEosGyqUQ8pDEmnfK8=", + "lastModified": 1732375016, + "narHash": "sha256-Y+bJw85TNOp8N369OV0VrDdm3oDy8CXG+GUuG6pZjbo=", "ref": "refs/heads/main", - "rev": "afd55717913278d4541ae0d21ca915a045423574", - "revCount": 31, + "rev": "8987e33cb709e7f2c30017e77edf9161b87d9885", + "revCount": 29, "type": "git", "url": "https://forgejo.skynet.ie/Skynet/website_2023" }, @@ -1303,11 +1302,11 @@ "utils": "utils_16" }, "locked": { - "lastModified": 1758635905, - "narHash": "sha256-PPqhD2RHUOwJrbey72H1wnmdpeELilwKlND4TR5qo2k=", + "lastModified": 1752925027, + "narHash": "sha256-APuWWdod4L3mgSBXJTukfbB8s37NvzUkju+lELUD7PI=", "ref": "refs/heads/main", - "rev": "eb1fc042b5d410b17dd63c492c03be78443ed07f", - "revCount": 167, + "rev": "917c316e7606995362b436f5c6248f058c762176", + "revCount": 166, "type": "git", "url": "https://forgejo.skynet.ie/Skynet/wiki" }, diff --git a/machines/marvin.nix b/machines/marvin.nix index 175d61d..abb15d1 100644 --- a/machines/marvin.nix +++ b/machines/marvin.nix @@ -30,6 +30,7 @@ Notes: groups_trusted = map (x: "@${x}") groups; in { imports = [ + ../applications/itd/splunk/module.nix ]; deployment = { @@ -58,4 +59,8 @@ in { host = host; backup.enable = true; }; + + services.itd.splunk = { + enable = true; + }; }