diff --git a/applications/email.nix b/applications/email.nix index d7a6381..97b2362 100644 --- a/applications/email.nix +++ b/applications/email.nix @@ -470,7 +470,7 @@ in { mailserver = { enable = true; - stateVersion = 1; + stateVersion = 3; fqdn = "${cfg.sub}.${cfg.domain}"; domains = [ diff --git a/applications/itd/splunk/module.nix b/applications/itd/splunk/module.nix deleted file mode 100644 index 304d29e..0000000 --- a/applications/itd/splunk/module.nix +++ /dev/null @@ -1,189 +0,0 @@ -{ - config, - pkgs, - lib, - ... -}: -with lib; let - name = "splunk"; - cfg = config.services.itd."${name}"; - - package = pkgs.callPackage ./package.nix {}; -in { - imports = []; - - options.services.itd."${name}" = { - enable = mkEnableOption "ITD Splunk"; - - user = { - user = mkOption { - type = types.str; - default = "splunk"; - }; - group = mkOption { - type = types.str; - default = "splunk"; - }; - - home = mkOption { - type = types.str; - default = "/etc/itd/splunk"; - }; - }; - }; - - config = mkIf cfg.enable { - # create user and group for the program - users.groups."${cfg.user.group}" = {}; - users.users."${cfg.user.user}" = { - createHome = true; - isNormalUser = true; - home = cfg.user.home; - group = cfg.user.group; - # X11 is to ensure the directory can be traversed - homeMode = "711"; - }; - - # might not be required - networking.firewall.allowedTCPPorts = [8089]; - - # need to set access controls - systemd.tmpfiles.rules = [ - "a /var/log - - - - u:splunk:rx" - "a /var/log/auth.log - - - - u:splunk:r " - "a /var/log/messages - - - - u:splunk:r " - "a /var/log/secure - - - - u:splunk:r " - "a /var/log/audit - - - - u:splunk:rx" - "a /var/log/audit.log - - - - u:splunk:r " - "a /var/log/audit/audit.log - - - - u:splunk:r " - "a /root - - - - u:splunk:rx" - "a /root/.bash_history - - - - u:splunk:r " - "a /home/* - - - - u:splunk:rx" - "a /home/*/.bash_history - - - - u:splunk:r " - ]; - - security.auditd = { - enable = true; - settings = { - log_group = cfg.user.group; - }; - }; - - # set up the core files - systemd.services."${name}_prestart" = { - wantedBy = [ - # "gitlab.target" - ]; - partOf = [ - # "gitlab.target" - ]; - path = with pkgs; [util-linux]; - serviceConfig = { - Type = "oneshot"; - User = "root"; - Group = "root"; - # User = cfg.user.user; - # Group = cfg.user.group; - # TimeoutSec = "infinity"; - # Restart = "on-failure"; - # WorkingDirectory = "${cfg.package}/share/gitlab"; - # Slice = "system-gitlab.slice"; - RemainAfterExit = true; - ExecStart = let - # from $SPLUNK_HOME/etc/splunk-launch.conf.default - splunk_launch = pkgs.writeText "splunk-launch" '' - SPLUNK_HOME=${cfg.user.home} - SPLUNK_SERVER_NAME=SplunkForwarder - PYTHONHTTPSVERIFY=0 - PYTHONUTF8=1 - ''; - - etc_passwd = pkgs.writeText "passwd" '' - :admin:$6$XOFhpq0Y1Ul1pejO$DUkXU6xSAKYrl3nLTPFS7LJqlnWC4r97SSikjCzv7XNEG6lgP32TZHyLDY/aJs8ZYyblZ5spfmnlMvh8Lxndi/::Administrator:admin:changeme@example.com:::20329 - ''; - - deployment_client = pkgs.writeText "deploymentclient" '' - [deployment-client] - clientName = UL_client - [target-broker:deploymentServer] - targetUri = soc-deployment.heanet.ie:8089 - ''; - in - pkgs.writeShellScript "splunk-config" '' - set -o errexit -o pipefail -o nounset - shopt -s inherit_errexit - - umask u=rwx,g=rx,o= - - # start with a clean slate, it yells at ye if ye try to boot it up without doing this - rm -rf ${cfg.user.home}/* - - chmod 771 -R ${cfg.user.home} - - # pull in all relevent files - cp -f -R ${package}/* ${cfg.user.home} - - chmod 771 -R ${cfg.user.home} - chown ${cfg.user.user}:${cfg.user.group} -R ${cfg.user.home} - - # if [ ! -f ${cfg.user.home}/etc/splunk-launch.conf ]; then - export SPLUNK_HOME=${cfg.user.home} - - cp ${splunk_launch} $SPLUNK_HOME/etc/splunk-launch.conf - - cp ${etc_passwd} $SPLUNK_HOME/etc/passwd - - # ensure the dir exists - mkdir -p $SPLUNK_HOME/etc/apps/000_ul_umbrio_essentials/local/ - cp ${deployment_client} $SPLUNK_HOME/etc/apps/000_ul_umbrio_essentials/local/deploymentclient.conf - - # make sure user permissions are correct - chmod 771 -R ${cfg.user.home} - chown ${cfg.user.user}:${cfg.user.group} -R ${cfg.user.home} - - # run it to see if that works - runuser -u ${cfg.user.user} -- $SPLUNK_HOME/bin/splunk start --accept-license - - # $SPLUNK_HOME/bin/splunk enable boot-start - # /etc/systemd/system/multi-user.target.wants/SplunkForwarder.service - # fi - ''; - }; - }; - - systemd.services."${name}" = { - wantedBy = [ - ]; - requires = [ - "${name}_prestart.service" - ]; - path = with pkgs; [util-linux toybox]; - serviceConfig = { - Type = "simple"; - Restart = "always"; - Environment = "SPLUNK_HOME=${cfg.user.home}"; - ExecStart = "${package}/bin/splunk _internal_launch_under_systemd"; - KillMode = "mixed"; - KillSignal = "SIGINT"; - TimeoutStopSec = 360; - LimitNOFILE = 65536; - LimitRTPRIO = 99; - SuccessExitStatus = "51 52"; - RestartPreventExitStatus = 51; - RestartForceExitStatus = 52; - User = cfg.user.user; - Group = cfg.user.group; - NoNewPrivileges = "yes"; - AmbientCapabilities = "CAP_DAC_READ_SEARCH"; - - # ExecStartPre=-/bin/bash -c "chown -R splunk:splunk /opt/splunkforwarder" - Delegate = "true"; - # CPUShares=1024; - # MemoryLimit=3973632000; - PermissionsStartOnly = "true"; - # ExecStartPost=-/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/cpu/system.slice/%n" - # ExecStartPost=-/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/memory/system.slice/%n" - }; - }; - }; -} diff --git a/applications/itd/splunk/package.nix b/applications/itd/splunk/package.nix deleted file mode 100644 index c5a21ef..0000000 --- a/applications/itd/splunk/package.nix +++ /dev/null @@ -1,48 +0,0 @@ -{ - stdenv, - lib, - fetchurl, - gnused, - openssl, - zlib, - autoPatchelfHook, -}: -stdenv.mkDerivation rec { - pname = "splunk-forwarder"; - version = "9.1.7"; - version_long = "${version}-e17104057ef0"; - - src = fetchurl { - url = "https://download.splunk.com/products/universalforwarder/releases/${version}/linux/splunkforwarder-${version_long}-Linux-x86_64.tgz"; - hash = "sha256-EWpfenEhExe5qDscqb7ZQUwahYgAgPQ+APLlweRQAoc="; - }; - - nativeBuildInputs = [autoPatchelfHook]; - - buildInputs = [ - # alsaLib - openssl - zlib - gnused - ]; - - sourceRoot = "."; - - installPhase = '' - runHook preInstall - # gets unzipped and we just pop it all into teh output - cp -R ./splunkforwarder $out - - # Splunk is doing a crime by deciding what teh path is, need to comment out this line in /bin/pid_check.sh - # PATH=/usr/xpg4/bin:/usr/bin:/bin - find $out -type f -name "*.sh" -print0 | xargs -0 sed -i -e 's/PATH=/#PATH=/g' - - runHook postInstall - ''; - - meta = with lib; { - homepage = "https://splunk.com"; - description = "Logging Service"; - platforms = platforms.linux; - }; -} diff --git a/applications/skynet.ie/skynet.ie.nix b/applications/skynet.ie/skynet.ie.nix index fb1bf69..99cc46d 100644 --- a/applications/skynet.ie/skynet.ie.nix +++ b/applications/skynet.ie/skynet.ie.nix @@ -48,6 +48,11 @@ in { r_type = "CNAME"; value = config.services.skynet.host.name; } + { + record = "wolves"; + r_type = "CNAME"; + value = config.services.skynet.host.name; + } { record = "public"; r_type = "CNAME"; @@ -80,6 +85,12 @@ in { "www.skynet.ie" = main_site; "skynet.ie" = main_site; + "wolves.skynet.ie" = { + forceSSL = true; + useACMEHost = "skynet"; + locations."/".return = "307 https://ulwolves.ie/society/computer"; + }; + # a custom discord url, because we are too cheap otehrwise "discord.skynet.ie" = { forceSSL = true; diff --git a/config/users.nix b/config/users.nix index f7c3f84..d49d998 100644 --- a/config/users.nix +++ b/config/users.nix @@ -52,24 +52,36 @@ in { committee = lib.lists.unique ( # Committee - Core [ + # President "silver" - "eoghanconlon73" - "nanda" + # Secretary + "kaiden" + # Treasurer + "peace" + # PRO + "amymucko" + # HSO "skyapples" - "generically" ] # Committee - OCM ++ [ + "connormc" + "cordlesscoder" + "dca_" "eliza" - "amymucko" - "archiedms" - "kaiden" + "emilyrutai" + "generically" + "mysticwolf" + "nanda" + "rituk_0817" + "sania_m" + "shourjyo24_" + "sunny" + "tatabbyi" + "wormyworm5" ] # Committee - SISTEM - ++ [ - "peace" - "milan" - ] + ++ [] # Admins are part of Committee as well ++ cfg.admin ); @@ -78,8 +90,6 @@ in { "evanc" "eliza" "esy" - # for temp reasons - "peace" ]; trainee = []; lifetime = []; diff --git a/flake.lock b/flake.lock index 285b680..6f89ba0 100644 --- a/flake.lock +++ b/flake.lock @@ -90,11 +90,11 @@ "utils": "utils" }, "locked": { - "lastModified": 1723391194, - "narHash": "sha256-04UThV4LZNRHg/+GbEl7M2ginWbm8FrQ5jBVmYcroNg=", + "lastModified": 1723500950, + "narHash": "sha256-t1eApFGI+JzLIW2YToLlDV20n+Nevk1q4fZBYU1m93I=", "owner": "silver_rust", "repo": "bfom", - "rev": "fffd69b6433a2d2fd359b92e3816ae9938b3e99c", + "rev": "7f339f28442758ecc3f1697e3f70d441973664b9", "type": "gitlab" }, "original": { @@ -148,11 +148,11 @@ "utils": "utils_2" }, "locked": { - "lastModified": 1741131635, - "narHash": "sha256-W65UdgryecEzfS6myQ+1Sj5P3yBCJRlGRf+fU78Ei2g=", + "lastModified": 1758582048, + "narHash": "sha256-SIt6rPXx7O3YMrEw8YrwHNMjOrrJLu/Tf1sMll1Qp9A=", "ref": "refs/heads/main", - "rev": "b5089910d0d0b303b634c7e125ac0b9ba8728bd9", - "revCount": 111, + "rev": "4d825caf25cb966ddb5ce33a0e9b2aa73b0262c6", + "revCount": 130, "type": "git", "url": "https://forgejo.skynet.ie/Computer_Society/presentations_compsoc" }, @@ -359,11 +359,11 @@ ] }, "locked": { - "lastModified": 1749636823, - "narHash": "sha256-WUaIlOlPLyPgz9be7fqWJA5iG6rHcGRtLERSCfUDne4=", + "lastModified": 1750779888, + "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "623c56286de5a3193aa38891a6991b28f9bab056", + "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d", "type": "github" }, "original": { @@ -542,11 +542,11 @@ }, "nixpkgs-25_05": { "locked": { - "lastModified": 1749727998, - "narHash": "sha256-mHv/yeUbmL91/TvV95p+mBVahm9mdQMJoqaTVTALaFw=", + "lastModified": 1753749649, + "narHash": "sha256-+jkEZxs7bfOKfBIk430K+tK9IvXlwzqQQnppC2ZKFj4=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "fd487183437963a59ba763c0cc4f27e3447dd6dd", + "rev": "1f08a4df998e21f4e8be8fb6fbf61d11a1a5076a", "type": "github" }, "original": { @@ -895,20 +895,6 @@ } }, "nixpkgs_6": { - "locked": { - "lastModified": 1715413075, - "narHash": "sha256-FCi3R1MeS5bVp0M0xTheveP6hhcCYfW/aghSTPebYL4=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "e4e7a43a9db7e22613accfeb1005cca1b2b1ee0d", - "type": "github" - }, - "original": { - "id": "nixpkgs", - "type": "indirect" - } - }, - "nixpkgs_7": { "locked": { "lastModified": 1756787288, "narHash": "sha256-rw/PHa1cqiePdBxhF66V7R+WAP8WekQ0mCDG4CFqT8Y=", @@ -923,6 +909,21 @@ "type": "indirect" } }, + "nixpkgs_7": { + "locked": { + "lastModified": 1751271578, + "narHash": "sha256-P/SQmKDu06x8yv7i0s8bvnnuJYkxVGBWLWHaU+tt4YY=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "3016b4b15d13f3089db8a41ef937b13a9e33a8df", + "type": "github" + }, + "original": { + "id": "nixpkgs", + "ref": "nixos-unstable", + "type": "indirect" + } + }, "nixpkgs_8": { "locked": { "lastModified": 1723151389, @@ -1023,11 +1024,11 @@ "nixpkgs-25_05": "nixpkgs-25_05" }, "locked": { - "lastModified": 1750183846, - "narHash": "sha256-owKJ2rsa/0WVZQAprlbqgVAAGlz3MFuvgNea3+ic4fs=", + "lastModified": 1758367587, + "narHash": "sha256-crj6Ps1BwNbmsk7I7v6K2Dw55vczuQRtTklYiFiQ0Jw=", "ref": "refs/heads/master", - "rev": "c097bd662c9e1aea8c1fca10d57188e81c5574a0", - "revCount": 743, + "rev": "8bca7ebf09d3eb2bfcafe41b9133ee262f09558d", + "revCount": 794, "type": "git", "url": "https://forgejo.skynet.ie/Skynet/misc_nixos-mailserver" }, @@ -1044,11 +1045,11 @@ "utils": "utils_3" }, "locked": { - "lastModified": 1757023884, - "narHash": "sha256-E+lp2PyQo9vakrwAjcB+krIGPi095CaAbZ/49tWvCtw=", + "lastModified": 1758295049, + "narHash": "sha256-h14Vl/OVguj5jD54xf+3w3DBIloQkoFBH86/xJ35jV8=", "ref": "refs/heads/main", - "rev": "7526a82bb7c384c16a09992458868b2f669ed279", - "revCount": 320, + "rev": "313be247d96131fbea418b826d7b68521c48bd8a", + "revCount": 326, "type": "git", "url": "https://forgejo.skynet.ie/Skynet/discord-bot" }, @@ -1086,11 +1087,11 @@ "utils": "utils_5" }, "locked": { - "lastModified": 1751234352, - "narHash": "sha256-OeNGbd3kn2jjJq9nbNcLq7wquc8leOyWkahuWopKnv4=", + "lastModified": 1757267915, + "narHash": "sha256-cJA/dTc+VCjODKu5WEycBrEZRxd4STzxhpfUK2kIS4g=", "ref": "refs/heads/main", - "rev": "1dae2ecb2623d55c88a237d55198efd51e0fd8fe", - "revCount": 249, + "rev": "3d882056bc78707ff57321862522ca8d1fc2a3c1", + "revCount": 252, "type": "git", "url": "https://forgejo.skynet.ie/Skynet/ldap_backend" }, @@ -1124,11 +1125,11 @@ "utils": "utils_7" }, "locked": { - "lastModified": 1732375016, - "narHash": "sha256-Y+bJw85TNOp8N369OV0VrDdm3oDy8CXG+GUuG6pZjbo=", + "lastModified": 1758195787, + "narHash": "sha256-YK5rEiaPqH19PPwMO/smF3SJDdEosGyqUQ8pDEmnfK8=", "ref": "refs/heads/main", - "rev": "8987e33cb709e7f2c30017e77edf9161b87d9885", - "revCount": 29, + "rev": "afd55717913278d4541ae0d21ca915a045423574", + "revCount": 31, "type": "git", "url": "https://forgejo.skynet.ie/Skynet/website_2023" }, @@ -1302,11 +1303,11 @@ "utils": "utils_16" }, "locked": { - "lastModified": 1752925027, - "narHash": "sha256-APuWWdod4L3mgSBXJTukfbB8s37NvzUkju+lELUD7PI=", + "lastModified": 1758635905, + "narHash": "sha256-PPqhD2RHUOwJrbey72H1wnmdpeELilwKlND4TR5qo2k=", "ref": "refs/heads/main", - "rev": "917c316e7606995362b436f5c6248f058c762176", - "revCount": 166, + "rev": "eb1fc042b5d410b17dd63c492c03be78443ed07f", + "revCount": 167, "type": "git", "url": "https://forgejo.skynet.ie/Skynet/wiki" }, diff --git a/machines/marvin.nix b/machines/marvin.nix index abb15d1..175d61d 100644 --- a/machines/marvin.nix +++ b/machines/marvin.nix @@ -30,7 +30,6 @@ Notes: groups_trusted = map (x: "@${x}") groups; in { imports = [ - ../applications/itd/splunk/module.nix ]; deployment = { @@ -59,8 +58,4 @@ in { host = host; backup.enable = true; }; - - services.itd.splunk = { - enable = true; - }; }