diff --git a/SwarselSystems.org b/SwarselSystems.org index 7fb7b3b..3d13955 100644 --- a/SwarselSystems.org +++ b/SwarselSystems.org @@ -6612,14 +6612,14 @@ Here I am forcing =startWhenNeeded= to false so that the value will not be set t extraGroups = [ "video" "render" "users" ]; }; nixpkgs.config.packageOverrides = pkgs: { - vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; }; + intel-vaapi-driver = pkgs.intel-vaapi-driver.override { enableHybridCodec = true; }; }; hardware.graphics = { enable = true; extraPackages = with pkgs; [ intel-media-driver # LIBVA_DRIVER_NAME=iHD - vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium) - vaapiVdpau + intel-vaapi-driver # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium) + libva-vdpau-driver libvdpau-va-gl ]; }; @@ -7460,7 +7460,7 @@ Here I am forcing =startWhenNeeded= to false so that the value will not be set t services.${serviceName} = { enable = true; - package = pkgs.stable.immich; + package = pkgs.immich; host = "0.0.0.0"; port = servicePort; openFirewall = true; @@ -8788,230 +8788,278 @@ A stupid (but simple) way to get the =originUrl= is to simply set any URL there To get other URLs (token, etc.), use https:///oauth2/openid//.well-known/oauth-authorization-server, e.g. https:///oauth2/openid/nextcloud/.well-known/oauth-authorization-server, with clienID being the client name as specified in kanidm. #+begin_src nix-ts :tangle modules/nixos/server/kanidm.nix - { self, lib, pkgs, config, globals, ... }: - let - certsSopsFile = self + /secrets/certs/secrets.yaml; - inherit (config.swarselsystems) sopsFile; +{ self, lib, pkgs, config, globals, ... }: +let + certsSopsFile = self + /secrets/certs/secrets.yaml; + inherit (config.swarselsystems) sopsFile; - servicePort = 8300; - serviceUser = "kanidm"; - serviceGroup = serviceUser; - serviceName = "kanidm"; - serviceDomain = config.repo.secrets.common.services.domains.${serviceName}; - serviceAddress = globals.hosts.winters.ipv4; + servicePort = 8300; + serviceUser = "kanidm"; + serviceGroup = serviceUser; + serviceName = "kanidm"; + serviceDomain = config.repo.secrets.common.services.domains.${serviceName}; + serviceAddress = globals.hosts.winters.ipv4; - oauth2ProxyDomain = globals.services.oauth2Proxy.domain; - immichDomain = globals.services.immich.domain; - paperlessDomain = globals.services.paperless.domain; - forgejoDomain = globals.services.forgejo.domain; - grafanaDomain = globals.services.grafana.domain; - nextcloudDomain = globals.services.nextcloud.domain; - in - { - options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server"; - config = lib.mkIf config.swarselmodules.server.${serviceName} { + oauth2ProxyDomain = globals.services.oauth2Proxy.domain; + immichDomain = globals.services.immich.domain; + paperlessDomain = globals.services.paperless.domain; + forgejoDomain = globals.services.forgejo.domain; + grafanaDomain = globals.services.grafana.domain; + nextcloudDomain = globals.services.nextcloud.domain; - users.users.${serviceUser} = { - group = serviceGroup; - isSystemUser = true; + certBase = "/etc/ssl"; + certsDir = "${certBase}/certs"; + privateDir = "${certBase}/private"; + certPath = "${certsDir}/${serviceName}.crt"; + keyPath = "${privateDir}/${serviceName}.key"; +in +{ + options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server"; + config = lib.mkIf config.swarselmodules.server.${serviceName} { + + users.users.${serviceUser} = { + group = serviceGroup; + isSystemUser = true; + }; + + users.groups.${serviceGroup} = { }; + + sops = { + secrets = { + "kanidm-self-signed-crt" = { sopsFile = certsSopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; + "kanidm-self-signed-key" = { sopsFile = certsSopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; + "kanidm-admin-pw" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; + "kanidm-idm-admin-pw" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; + "kanidm-immich" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; + "kanidm-paperless" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; + "kanidm-forgejo" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; + "kanidm-grafana" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; + "kanidm-nextcloud" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; + "kanidm-freshrss" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; + "kanidm-oauth2-proxy" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; + }; + }; + + networking.firewall.allowedTCPPorts = [ servicePort ]; + + globals.services.${serviceName}.domain = serviceDomain; + + system.activationScripts."generateSSLCert-${serviceName}" = + let + daysValid = 3650; + renewBeforeDays = 365; + in + { + text = '' + set -eu + + ${pkgs.coreutils}/bin/install -d -m 0755 ${certsDir} + ${pkgs.coreutils}/bin/install -d -m 0750 ${privateDir} + + need_gen=0 + if [ ! -f "${certPath}" ] || [ ! -f "${keyPath}" ]; then + need_gen=1 + else + enddate="$(${pkgs.openssl}/bin/openssl x509 -noout -enddate -in "${certPath}" | cut -d= -f2)" + end_epoch="$(${pkgs.coreutils}/bin/date -d "$enddate" +%s)" + now_epoch="$(${pkgs.coreutils}/bin/date +%s)" + seconds_left=$(( end_epoch - now_epoch )) + days_left=$(( seconds_left / 86400 )) + if [ "$days_left" -lt ${toString renewBeforeDays} ]; then + need_gen=1 + fi + fi + + if [ "$need_gen" -eq 1 ]; then + ${pkgs.openssl}/bin/openssl req -x509 -nodes -days ${toString daysValid} -newkey rsa:4096 -sha256 \ + -keyout "${keyPath}" \ + -out "${certPath}" \ + -subj "/CN=${serviceDomain}" \ + -addext "subjectAltName=DNS:${serviceDomain}" + + chmod 0644 "${certPath}" + chmod 0600 "${keyPath}" + chown ${serviceUser}:${serviceGroup} "${certPath}" "${keyPath}" + fi + ''; + deps = [ "etc" ]; }; - users.groups.${serviceGroup} = { }; - - sops = { - secrets = { - "kanidm-self-signed-crt" = { sopsFile = certsSopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; - "kanidm-self-signed-key" = { sopsFile = certsSopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; - "kanidm-admin-pw" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; - "kanidm-idm-admin-pw" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; - "kanidm-immich" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; - "kanidm-paperless" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; - "kanidm-forgejo" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; - "kanidm-grafana" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; - "kanidm-nextcloud" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; - "kanidm-freshrss" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; - "kanidm-oauth2-proxy" = { inherit sopsFile; owner = serviceUser; group = serviceGroup; mode = "0440"; }; + services = { + ${serviceName} = { + package = pkgs.kanidmWithSecretProvisioning_1_7; + enableServer = true; + serverSettings = { + domain = serviceDomain; + origin = "https://${serviceDomain}"; + # tls_chain = config.sops.secrets.kanidm-self-signed-crt.path; + tls_chain = certPath; + # tls_key = config.sops.secrets.kanidm-self-signed-key.path; + tls_key = keyPath; + bindaddress = "0.0.0.0:${toString servicePort}"; + trust_x_forward_for = true; }; - }; - - networking.firewall.allowedTCPPorts = [ servicePort ]; - - globals.services.${serviceName}.domain = serviceDomain; - - services = { - ${serviceName} = { - package = pkgs.kanidmWithSecretProvisioning_1_7; - enableServer = true; - serverSettings = { - domain = serviceDomain; - origin = "https://${serviceDomain}"; - tls_chain = config.sops.secrets.kanidm-self-signed-crt.path; - tls_key = config.sops.secrets.kanidm-self-signed-key.path; - bindaddress = "0.0.0.0:${toString servicePort}"; - trust_x_forward_for = true; + enableClient = true; + clientSettings = { + uri = config.services.kanidm.serverSettings.origin; + verify_ca = true; + verify_hostnames = true; + }; + provision = { + enable = true; + adminPasswordFile = config.sops.secrets.kanidm-admin-pw.path; + idmAdminPasswordFile = config.sops.secrets.kanidm-idm-admin-pw.path; + groups = { + "immich.access" = { }; + "paperless.access" = { }; + "forgejo.access" = { }; + "forgejo.admins" = { }; + "grafana.access" = { }; + "grafana.editors" = { }; + "grafana.admins" = { }; + "grafana.server-admins" = { }; + "nextcloud.access" = { }; + "nextcloud.admins" = { }; + "navidrome.access" = { }; + "freshrss.access" = { }; + "firefly.access" = { }; + "radicale.access" = { }; + "slink.access" = { }; }; - enableClient = true; - clientSettings = { - uri = config.services.kanidm.serverSettings.origin; - verify_ca = true; - verify_hostnames = true; - }; - provision = { - enable = true; - adminPasswordFile = config.sops.secrets.kanidm-admin-pw.path; - idmAdminPasswordFile = config.sops.secrets.kanidm-idm-admin-pw.path; - groups = { - "immich.access" = { }; - "paperless.access" = { }; - "forgejo.access" = { }; - "forgejo.admins" = { }; - "grafana.access" = { }; - "grafana.editors" = { }; - "grafana.admins" = { }; - "grafana.server-admins" = { }; - "nextcloud.access" = { }; - "nextcloud.admins" = { }; - "navidrome.access" = { }; - "freshrss.access" = { }; - "firefly.access" = { }; - "radicale.access" = { }; - "slink.access" = { }; - }; - inherit (config.repo.secrets.local) persons; + inherit (config.repo.secrets.local) persons; - systems = { - oauth2 = { - immich = { - displayName = "Immich"; - originUrl = [ - "https://${immichDomain}/auth/login" - "https://${immichDomain}/user-settings" - "app.immich:///oauth-callback" - "https://${immichDomain}/api/oauth/mobile-redirect" - ]; - originLanding = "https://${immichDomain}/"; - basicSecretFile = config.sops.secrets.kanidm-immich.path; - preferShortUsername = true; - enableLegacyCrypto = true; # can use RS256 / HS256, not ES256 - scopeMaps."immich.access" = [ - "openid" - "email" - "profile" - ]; + systems = { + oauth2 = { + immich = { + displayName = "Immich"; + originUrl = [ + "https://${immichDomain}/auth/login" + "https://${immichDomain}/user-settings" + "app.immich:///oauth-callback" + "https://${immichDomain}/api/oauth/mobile-redirect" + ]; + originLanding = "https://${immichDomain}/"; + basicSecretFile = config.sops.secrets.kanidm-immich.path; + preferShortUsername = true; + enableLegacyCrypto = true; # can use RS256 / HS256, not ES256 + scopeMaps."immich.access" = [ + "openid" + "email" + "profile" + ]; + }; + paperless = { + displayName = "Paperless"; + originUrl = "https://${paperlessDomain}/accounts/oidc/kanidm/login/callback/"; + originLanding = "https://${paperlessDomain}/"; + basicSecretFile = config.sops.secrets.kanidm-paperless.path; + preferShortUsername = true; + scopeMaps."paperless.access" = [ + "openid" + "email" + "profile" + ]; + }; + forgejo = { + displayName = "Forgejo"; + originUrl = "https://${forgejoDomain}/user/oauth2/kanidm/callback"; + originLanding = "https://${forgejoDomain}/"; + basicSecretFile = config.sops.secrets.kanidm-forgejo.path; + scopeMaps."forgejo.access" = [ + "openid" + "email" + "profile" + ]; + # XXX: PKCE is currently not supported by gitea/forgejo, + # see https://github.com/go-gitea/gitea/issues/21376. + allowInsecureClientDisablePkce = true; + preferShortUsername = true; + claimMaps.groups = { + joinType = "array"; + valuesByGroup."forgejo.admins" = [ "admin" ]; }; - paperless = { - displayName = "Paperless"; - originUrl = "https://${paperlessDomain}/accounts/oidc/kanidm/login/callback/"; - originLanding = "https://${paperlessDomain}/"; - basicSecretFile = config.sops.secrets.kanidm-paperless.path; - preferShortUsername = true; - scopeMaps."paperless.access" = [ - "openid" - "email" - "profile" - ]; - }; - forgejo = { - displayName = "Forgejo"; - originUrl = "https://${forgejoDomain}/user/oauth2/kanidm/callback"; - originLanding = "https://${forgejoDomain}/"; - basicSecretFile = config.sops.secrets.kanidm-forgejo.path; - scopeMaps."forgejo.access" = [ - "openid" - "email" - "profile" - ]; - # XXX: PKCE is currently not supported by gitea/forgejo, - # see https://github.com/go-gitea/gitea/issues/21376. - allowInsecureClientDisablePkce = true; - preferShortUsername = true; - claimMaps.groups = { - joinType = "array"; - valuesByGroup."forgejo.admins" = [ "admin" ]; + }; + grafana = { + displayName = "Grafana"; + originUrl = "https://${grafanaDomain}/login/generic_oauth"; + originLanding = "https://${grafanaDomain}/"; + basicSecretFile = config.sops.secrets.kanidm-grafana.path; + preferShortUsername = true; + scopeMaps."grafana.access" = [ + "openid" + "email" + "profile" + ]; + claimMaps.groups = { + joinType = "array"; + valuesByGroup = { + "grafana.editors" = [ "editor" ]; + "grafana.admins" = [ "admin" ]; + "grafana.server-admins" = [ "server_admin" ]; }; }; - grafana = { - displayName = "Grafana"; - originUrl = "https://${grafanaDomain}/login/generic_oauth"; - originLanding = "https://${grafanaDomain}/"; - basicSecretFile = config.sops.secrets.kanidm-grafana.path; - preferShortUsername = true; - scopeMaps."grafana.access" = [ + }; + nextcloud = { + displayName = "Nextcloud"; + originUrl = " https://${nextcloudDomain}/apps/sociallogin/custom_oidc/kanidm"; + originLanding = "https://${nextcloudDomain}/"; + basicSecretFile = config.sops.secrets.kanidm-nextcloud.path; + allowInsecureClientDisablePkce = true; + scopeMaps."nextcloud.access" = [ + "openid" + "email" + "profile" + ]; + preferShortUsername = true; + claimMaps.groups = { + joinType = "array"; + valuesByGroup = { + "nextcloud.admins" = [ "admin" ]; + }; + }; + }; + oauth2-proxy = { + displayName = "Oauth2-Proxy"; + originUrl = "https://${oauth2ProxyDomain}/oauth2/callback"; + originLanding = "https://${oauth2ProxyDomain}/"; + basicSecretFile = config.sops.secrets.kanidm-oauth2-proxy.path; + scopeMaps = { + "freshrss.access" = [ "openid" "email" "profile" ]; - claimMaps.groups = { - joinType = "array"; - valuesByGroup = { - "grafana.editors" = [ "editor" ]; - "grafana.admins" = [ "admin" ]; - "grafana.server-admins" = [ "server_admin" ]; - }; - }; - }; - nextcloud = { - displayName = "Nextcloud"; - originUrl = " https://${nextcloudDomain}/apps/sociallogin/custom_oidc/kanidm"; - originLanding = "https://${nextcloudDomain}/"; - basicSecretFile = config.sops.secrets.kanidm-nextcloud.path; - allowInsecureClientDisablePkce = true; - scopeMaps."nextcloud.access" = [ + "navidrome.access" = [ + "openid" + "email" + "profile" + ]; + "firefly.access" = [ + "openid" + "email" + "profile" + ]; + "radicale.access" = [ + "openid" + "email" + "profile" + ]; + "slink.access" = [ "openid" "email" "profile" ]; - preferShortUsername = true; - claimMaps.groups = { - joinType = "array"; - valuesByGroup = { - "nextcloud.admins" = [ "admin" ]; - }; - }; }; - oauth2-proxy = { - displayName = "Oauth2-Proxy"; - originUrl = "https://${oauth2ProxyDomain}/oauth2/callback"; - originLanding = "https://${oauth2ProxyDomain}/"; - basicSecretFile = config.sops.secrets.kanidm-oauth2-proxy.path; - scopeMaps = { - "freshrss.access" = [ - "openid" - "email" - "profile" - ]; - "navidrome.access" = [ - "openid" - "email" - "profile" - ]; - "firefly.access" = [ - "openid" - "email" - "profile" - ]; - "radicale.access" = [ - "openid" - "email" - "profile" - ]; - "slink.access" = [ - "openid" - "email" - "profile" - ]; - }; - preferShortUsername = true; - claimMaps.groups = { - joinType = "array"; - valuesByGroup = { - "freshrss.access" = [ "ttrss_access" ]; - "navidrome.access" = [ "navidrome_access" ]; - "firefly.access" = [ "firefly_access" ]; - "radicale.access" = [ "radicale_access" ]; - "slink.access" = [ "slink_access" ]; - }; + preferShortUsername = true; + claimMaps.groups = { + joinType = "array"; + valuesByGroup = { + "freshrss.access" = [ "ttrss_access" ]; + "navidrome.access" = [ "navidrome_access" ]; + "firefly.access" = [ "firefly_access" ]; + "radicale.access" = [ "radicale_access" ]; + "slink.access" = [ "slink_access" ]; }; }; }; @@ -9019,37 +9067,38 @@ To get other URLs (token, etc.), use https:///oauth2/openid/ - + SwarselSystems: NixOS + Emacs Configurationo @@ -209,8 +209,8 @@
  • 1.4. Hosts
  • 1.5. Programs
  • 1.6. Services
    • -
  • 1.7. Manual steps when setting up a new machine
    • -
  • 1.8. Current issues
    • +
  • 1.7. Manual steps when setting up a new machine
    • +
  • 1.8. Current issues
  • 2. flake.nix @@ -271,7 +271,7 @@
  • 3.1.2.4. machpizza (MacBook Pro)
  • 3.1.2.5. Magicant (Phone)
    • -
  • 3.1.2.6. Treehouse (DGX Spark)
    • +
  • 3.1.2.6. Treehouse (DGX Spark)
  • 3.1.3. Virtual hosts @@ -445,15 +445,15 @@
  • 3.2.5.8. Hibernation
  • 3.2.5.9. BTRFS
  • 3.2.5.10. work
    • -
  • 3.2.5.11. microvm-host
    • -
  • 3.2.5.12. microvm-guest
    • +
  • 3.2.5.11. microvm-host
    • +
  • 3.2.5.12. microvm-guest
  • 3.3. Home-manager
  • 3.3.3. Server @@ -587,8 +587,8 @@
  • 3.5.31. swarsel-build
  • 3.5.32. swarsel-instantiate
  • 3.5.33. sshrm
    • -
  • 3.5.34. endme
    • -
  • 3.5.35. git-replace
    • +
  • 3.5.34. endme
    • +
  • 3.5.35. git-replace
  • 3.6. Profiles @@ -597,7 +597,7 @@
    • 3.6.1.1. Personal
    • 3.6.1.2. Minimal
      • -
    • 3.6.1.3. Optionals
      • +
    • 3.6.1.3. Optionals
    • 3.6.1.4. Chaostheatre
    • 3.6.1.5. Work
    • 3.6.1.6. Uni
      • @@ -608,7 +608,7 @@
    • 3.6.2. home-manager @@ -1219,8 +1219,8 @@ Here I give a brief overview over the hostmachines that I am using. This is held -
      -

      1.7. Manual steps when setting up a new machine

      +
      +

      1.7. Manual steps when setting up a new machine

      These steps are required when setting up a normal NixOS host:
@@ -1263,8 +1263,8 @@ If the new machine is home-manager only, perform these steps:
      -
      -

      1.8. Current issues

      +
      +

      1.8. Current issues

      Currently, these adaptions are made to the configuration to account for bugs in upstream repos:
@@ -3779,8 +3779,8 @@ My phone. I use only a minimal config for remote debugging here.
      -
      -
      3.1.2.6. Treehouse (DGX Spark)
      +
      +
      3.1.2.6. Treehouse (DGX Spark)
      { self, outputs, ... }:
@@ -7937,14 +7937,14 @@ in
       extraGroups = [ "video" "render" "users" ];
     };
     nixpkgs.config.packageOverrides = pkgs: {
-      vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
+      intel-vaapi-driver = pkgs.intel-vaapi-driver.override { enableHybridCodec = true; };
     };
     hardware.graphics = {
       enable = true;
       extraPackages = with pkgs; [
         intel-media-driver # LIBVA_DRIVER_NAME=iHD
-        vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
-        vaapiVdpau
+        intel-vaapi-driver # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
+        libva-vdpau-driver
         libvdpau-va-gl
       ];
     };
@@ -8785,7 +8785,7 @@ in
 
     services.${serviceName} = {
       enable = true;
-      package = pkgs.stable.immich;
+      package = pkgs.immich;
       host = "0.0.0.0";
       port = servicePort;
       openFirewall = true;
@@ -10157,6 +10157,12 @@ let
   forgejoDomain = globals.services.forgejo.domain;
   grafanaDomain = globals.services.grafana.domain;
   nextcloudDomain = globals.services.nextcloud.domain;
+
+  certBase = "/etc/ssl";
+  certsDir = "${certBase}/certs";
+  privateDir = "${certBase}/private";
+  certPath = "${certsDir}/${serviceName}.crt";
+  keyPath = "${privateDir}/${serviceName}.key";
 in
 {
   options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
@@ -10189,6 +10195,47 @@ in
 
     globals.services.${serviceName}.domain = serviceDomain;
 
+    system.activationScripts."generateSSLCert-${serviceName}" =
+      let
+        daysValid = 3650;
+        renewBeforeDays = 365;
+      in
+      {
+        text = ''
+          set -eu
+
+          ${pkgs.coreutils}/bin/install -d -m 0755 ${certsDir}
+          ${pkgs.coreutils}/bin/install -d -m 0750 ${privateDir}
+
+          need_gen=0
+          if [ ! -f "${certPath}" ] || [ ! -f "${keyPath}" ]; then
+            need_gen=1
+          else
+            enddate="$(${pkgs.openssl}/bin/openssl x509 -noout -enddate -in "${certPath}" | cut -d= -f2)"
+            end_epoch="$(${pkgs.coreutils}/bin/date -d "$enddate" +%s)"
+            now_epoch="$(${pkgs.coreutils}/bin/date +%s)"
+            seconds_left=$(( end_epoch - now_epoch ))
+            days_left=$(( seconds_left / 86400 ))
+            if [ "$days_left" -lt ${toString renewBeforeDays} ]; then
+              need_gen=1
+            fi
+          fi
+
+          if [ "$need_gen" -eq 1 ]; then
+            ${pkgs.openssl}/bin/openssl req -x509 -nodes -days ${toString daysValid} -newkey rsa:4096 -sha256 \
+              -keyout "${keyPath}" \
+              -out "${certPath}" \
+              -subj "/CN=${serviceDomain}" \
+              -addext "subjectAltName=DNS:${serviceDomain}"
+
+            chmod 0644 "${certPath}"
+            chmod 0600 "${keyPath}"
+            chown ${serviceUser}:${serviceGroup} "${certPath}" "${keyPath}"
+          fi
+        '';
+        deps = [ "etc" ];
+      };
+
     services = {
       ${serviceName} = {
         package = pkgs.kanidmWithSecretProvisioning_1_7;
@@ -10196,8 +10243,10 @@ in
         serverSettings = {
           domain = serviceDomain;
           origin = "https://${serviceDomain}";
-          tls_chain = config.sops.secrets.kanidm-self-signed-crt.path;
-          tls_key = config.sops.secrets.kanidm-self-signed-key.path;
+          # tls_chain = config.sops.secrets.kanidm-self-signed-crt.path;
+          tls_chain = certPath;
+          # tls_key = config.sops.secrets.kanidm-self-signed-key.path;
+          tls_key = keyPath;
           bindaddress = "0.0.0.0:${toString servicePort}";
           trust_x_forward_for = true;
         };
@@ -12251,8 +12300,8 @@ in
      -
      -
      3.2.5.11. microvm-host
      +
      +
      3.2.5.11. microvm-host

      Some standard options that should be set for every microvm host. @@ -12278,8 +12327,8 @@ Some standard options that should be set for every microvm host.

      -
      -
      3.2.5.12. microvm-guest
      +
      +
      3.2.5.12. microvm-guest

      Some standard options that should be set vor every microvm guest. We set the default @@ -12376,8 +12425,8 @@ in

      -
      -

      3.3.1. Steps to setup/upgrade home-manager only

      +
      +

      3.3.1. Steps to setup/upgrade home-manager only

      Steps to get a home-manager only setup up and running: @@ -13405,8 +13454,8 @@ nix-index provides a way to find out which packages are provided by which deriva

      -
      -
      3.3.2.15. nix-your-shell
      +
      +
      3.3.2.15. nix-your-shell
      { lib, config, ... }:
@@ -15131,8 +15180,8 @@ The `extraConfig` section here CANNOT be reindented. This has something to do wi
      -
      -
      3.3.2.31.6. blueman-applet
      +
      +
      3.3.2.31.6. blueman-applet
      { lib, config, ... }:
@@ -15146,8 +15195,8 @@ The `extraConfig` section here CANNOT be reindented. This has something to do wi
      -
      -
      3.3.2.31.7. network-manager-applet
      +
      +
      3.3.2.31.7. network-manager-applet
      { lib, config, ... }:
@@ -15162,8 +15211,8 @@ The `extraConfig` section here CANNOT be reindented. This has something to do wi
      -
      -
      3.3.2.31.8. obsidian service for tray
      +
      +
      3.3.2.31.8. obsidian service for tray
      { lib, config, ... }:
@@ -15197,8 +15246,8 @@ The `extraConfig` section here CANNOT be reindented. This has something to do wi
      -
      -
      3.3.2.31.9. anki service for tray
      +
      +
      3.3.2.31.9. anki service for tray

      Sets up a systemd user service for anki that does not stall the shutdown process. Note that the outcommented ExecStart does not work because the home-manager anki package builds a separate anki package that - I think - cannot be referenced as no such expression exists in the module. @@ -15245,8 +15294,8 @@ Sets up a systemd user service for anki that does not stall the shutdown process

      -
      -
      3.3.2.31.10. element service for tray
      +
      +
      3.3.2.31.10. element service for tray
      { lib, config, pkgs, ... }:
@@ -15280,8 +15329,8 @@ Sets up a systemd user service for anki that does not stall the shutdown process
      -
      -
      3.3.2.31.11. vesktop service for tray
      +
      +
      3.3.2.31.11. vesktop service for tray
      { lib, config, pkgs, ... }:
@@ -16212,8 +16261,8 @@ in
      -
      -
      3.3.2.38. Obsidian
      +
      +
      3.3.2.38. Obsidian
      { lib, config, pkgs, nixosConfig ? config, ... }:
@@ -16373,8 +16422,8 @@ in
      -
      -
      3.3.2.39. Anki
      +
      +
      3.3.2.39. Anki
      { lib, config, pkgs, globals, inputs, nixosConfig ? config, ... }:
@@ -16447,8 +16496,8 @@ in
      -
      -
      3.3.2.40. Element-desktop
      +
      +
      3.3.2.40. Element-desktop
      { lib, config, ... }:
@@ -16484,8 +16533,8 @@ in
      -
      -
      3.3.2.41. Hexchat
      +
      +
      3.3.2.41. Hexchat
      { lib, config, nixosConfig ? config, ... }:
@@ -16509,8 +16558,8 @@ in
      -
      -
      3.3.2.42. obs-studio
      +
      +
      3.3.2.42. obs-studio
      { lib, config, ... }:
@@ -16530,8 +16579,8 @@ in
      -
      -
      3.3.2.43. spotify-player
      +
      +
      3.3.2.43. spotify-player
      { lib, config, ... }:
@@ -16551,8 +16600,8 @@ in
      -
      -
      3.3.2.44. vesktop
      +
      +
      3.3.2.44. vesktop
      { lib, pkgs, config, ... }:
@@ -16639,8 +16688,8 @@ in
      -
      -
      3.3.2.45. batsignal
      +
      +
      3.3.2.45. batsignal
      { lib, config, ... }:
@@ -16672,8 +16721,8 @@ in
      -
      -
      3.3.2.46. autotiling
      +
      +
      3.3.2.46. autotiling
      { lib, config, ... }:
@@ -16694,8 +16743,8 @@ in
      -
      -
      3.3.2.47. swayidle
      +
      +
      3.3.2.47. swayidle
      { lib, config, pkgs, ... }:
@@ -16736,8 +16785,8 @@ in
      -
      -
      3.3.2.48. swaylock
      +
      +
      3.3.2.48. swaylock
      { lib, config, pkgs, ... }:
@@ -19959,8 +20008,8 @@ writeShellApplication {
      -
      -

      3.5.34. endme

      +
      +

      3.5.34. endme

      Sometimes my DE crashes after putting it to suspend - to be precise, it happens when I put it into suspend when I have multiple screens plugged in. I have never taken the time to debug the issue, but instead just switch to a different TTY and then use this script to kill the hanging session. @@ -19981,8 +20030,8 @@ writeShellApplication {

      -
      -

      3.5.35. git-replace

      +
      +

      3.5.35. git-replace

      This script allows for quick git replace of a string. @@ -20198,8 +20247,8 @@ in

      -
      -
      3.6.1.3. Optionals
      +
      +
      3.6.1.3. Optionals
      { lib, config, ... }:
@@ -20495,8 +20544,8 @@ in
      -
      -
      3.6.2.2. DGX Spark
      +
      +
      3.6.2.2. DGX Spark
      { lib, config, ... }:
@@ -24206,8 +24255,8 @@ This adds the simple utility of sending desktop notifications whenever a new mai
      -
      -
      4.4.39.3. Work: Signing Mails (S/MIME, smime)
      +
      +
      4.4.39.3. Work: Signing Mails (S/MIME, smime)

      Used to automatically sign messages sent from my work email address using S/MIME certificate. @@ -24491,8 +24540,8 @@ Also see `prot-window-delete-popup-frame'." command) This sections is no longer used really. An introduction can be found in Structure of this file under the historical note. The little noweb-ref blocks that I still use are found in Hosts and Services.

      -
      -

      5.1. General steps when setting up a new machine

      +
      +

      5.1. General steps when setting up a new machine

      These general steps are needed when setting up a new machine and do not fit into another block well: @@ -24505,8 +24554,8 @@ These general steps are needed when setting up a new machine and do not fit into

      -
      -

      5.2. Current patches and fixes

      +
      +

      5.2. Current patches and fixes

      These are current deviations from the standard settings that I take while some things are broken upstream @@ -27466,7 +27515,7 @@ similarly, there exists an version that starts from the right.

      Author: Leon Schwarzäugl

      -

      Created: 2025-11-02 So 12:29

      +

      Created: 2025-11-03 Mo 17:12

      Validate

      diff --git a/modules/nixos/server/immich.nix b/modules/nixos/server/immich.nix index 934ad29..e3bc4a0 100644 --- a/modules/nixos/server/immich.nix +++ b/modules/nixos/server/immich.nix @@ -19,7 +19,7 @@ in services.${serviceName} = { enable = true; - package = pkgs.stable.immich; + package = pkgs.immich; host = "0.0.0.0"; port = servicePort; openFirewall = true; diff --git a/modules/nixos/server/jellyfin.nix b/modules/nixos/server/jellyfin.nix index 1b80a0e..420bbb6 100644 --- a/modules/nixos/server/jellyfin.nix +++ b/modules/nixos/server/jellyfin.nix @@ -13,14 +13,14 @@ in extraGroups = [ "video" "render" "users" ]; }; nixpkgs.config.packageOverrides = pkgs: { - vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; }; + intel-vaapi-driver = pkgs.intel-vaapi-driver.override { enableHybridCodec = true; }; }; hardware.graphics = { enable = true; extraPackages = with pkgs; [ intel-media-driver # LIBVA_DRIVER_NAME=iHD - vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium) - vaapiVdpau + intel-vaapi-driver # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium) + libva-vdpau-driver libvdpau-va-gl ]; }; diff --git a/modules/nixos/server/kanidm.nix b/modules/nixos/server/kanidm.nix index 701aa28..61495b6 100644 --- a/modules/nixos/server/kanidm.nix +++ b/modules/nixos/server/kanidm.nix @@ -16,6 +16,12 @@ let forgejoDomain = globals.services.forgejo.domain; grafanaDomain = globals.services.grafana.domain; nextcloudDomain = globals.services.nextcloud.domain; + + certBase = "/etc/ssl"; + certsDir = "${certBase}/certs"; + privateDir = "${certBase}/private"; + certPath = "${certsDir}/${serviceName}.crt"; + keyPath = "${privateDir}/${serviceName}.key"; in { options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server"; @@ -48,6 +54,47 @@ in globals.services.${serviceName}.domain = serviceDomain; + system.activationScripts."generateSSLCert-${serviceName}" = + let + daysValid = 3650; + renewBeforeDays = 365; + in + { + text = '' + set -eu + + ${pkgs.coreutils}/bin/install -d -m 0755 ${certsDir} + ${pkgs.coreutils}/bin/install -d -m 0750 ${privateDir} + + need_gen=0 + if [ ! -f "${certPath}" ] || [ ! -f "${keyPath}" ]; then + need_gen=1 + else + enddate="$(${pkgs.openssl}/bin/openssl x509 -noout -enddate -in "${certPath}" | cut -d= -f2)" + end_epoch="$(${pkgs.coreutils}/bin/date -d "$enddate" +%s)" + now_epoch="$(${pkgs.coreutils}/bin/date +%s)" + seconds_left=$(( end_epoch - now_epoch )) + days_left=$(( seconds_left / 86400 )) + if [ "$days_left" -lt ${toString renewBeforeDays} ]; then + need_gen=1 + fi + fi + + if [ "$need_gen" -eq 1 ]; then + ${pkgs.openssl}/bin/openssl req -x509 -nodes -days ${toString daysValid} -newkey rsa:4096 -sha256 \ + -keyout "${keyPath}" \ + -out "${certPath}" \ + -subj "/CN=${serviceDomain}" \ + -addext "subjectAltName=DNS:${serviceDomain}" + + chmod 0644 "${certPath}" + chmod 0600 "${keyPath}" + chown ${serviceUser}:${serviceGroup} "${certPath}" "${keyPath}" + fi + ''; + deps = [ "etc" ]; + }; + services = { ${serviceName} = { package = pkgs.kanidmWithSecretProvisioning_1_7; @@ -55,8 +102,10 @@ in serverSettings = { domain = serviceDomain; origin = "https://${serviceDomain}"; - tls_chain = config.sops.secrets.kanidm-self-signed-crt.path; - tls_key = config.sops.secrets.kanidm-self-signed-key.path; + # tls_chain = config.sops.secrets.kanidm-self-signed-crt.path; + tls_chain = certPath; + # tls_key = config.sops.secrets.kanidm-self-signed-key.path; + tls_key = keyPath; bindaddress = "0.0.0.0:${toString servicePort}"; trust_x_forward_for = true; }; diff --git a/secrets/general/secrets.yaml b/secrets/general/secrets.yaml index f2d0e18..f11e9d5 100644 --- a/secrets/general/secrets.yaml +++ b/secrets/general/secrets.yaml @@ -20,7 +20,8 @@ u2f-keys: ENC[AES256_GCM,data:4UPXyOYEQR1oybxPLR3JW8ro5gTzq0YQse1lnAP020Nm4JG4El #ENC[AES256_GCM,data:NoqAfw==,iv:myxrEPllN9zwXn5iCxL89qX7wSN8C0foFdxvvitq7b0=,tag:Yud5HDjWvEMrw1lMp21hMg==,type:comment] croc-password: ENC[AES256_GCM,data:uz7vI2rrPi1uTKEks4IPnWOt/R6ydlp/cQ==,iv:ZE01XcS6nF1sqz04rC1o20l+1DpNSRVjhC40ZmTVCww=,tag:REjnDQBcDkUzLg2ZsiDUvA==,type:str] #ENC[AES256_GCM,data:qsBNKxd3Ng==,iv:1fNMDJt7vgKFSdghYBZsuDoZ1sWvzj1Zu8NmkjX6Zh8=,tag:0D7EsgN8B1z7/y4iZS/PtQ==,type:comment] -github-api-token: ENC[AES256_GCM,data:9AhHkmv4JUjmir77INYflGvjNWW/E17FmfoXs5IUnAlL7B/l8s7UlVob0Az4lOUnm3+R0RWJz0HKMvOdZVZjd3RakdoWqvBHFqOVNF1MNthg2izIiaERsnDXcxj54qJfpD505xFSBWmnTKWVwRZlW5WEsFPuvaVy,iv:wzXT+qsn4VG+R8tGU33EWoaMKs4c/BB5W7f2JvuX2eY=,tag:EEhbktsmWHBwh0iBtfaXlA==,type:str] +#ENC[AES256_GCM,data:G6Xk3eWNCSbuxzy91Yx/5ZGR2OgJHhJMnRWXwxJ96DW5K+igQjIimNBW90cXqs5iztjC3q4F/YUK2IStnqCgZQi1Gye2g8uHj+1Xa0bt5LKNdjWwwfcONxcKTq37R55sgMbIwdPqi2CBZAw/fdsXfKeDNz3V+7fKzkzX8EckUGj2v27TJoR0/fHjLA==,iv:la0FjH6m9ersNIEqcXmp2kpioL2kubzU2up9wJujDTQ=,tag:GvFW4wzi4PD9HdryfNQrwQ==,type:comment] +github-api-token: ENC[AES256_GCM,data:jUruDrTBfuqYuNXOxEtFsFkeXW6UqPvFiVNIXHVeTBaDkELSmJnz3u80rdfuVhxmRlFg8/ApiiBCB5X5sd+6Zh0JgH7mbaxVe+lta1m1wiCm1fWRBkDOuEoHt7p4pVbec/LUJOyvhWzcTcWTtW1GT96DFxKHBt8v,iv:WAWIck/gqZD6Oq/2LxS7YCD1F1FfCq+ZK1ls6sPdJQk=,tag:VTfKIICDvAsVN+7Fx4o1XA==,type:str] #ENC[AES256_GCM,data:vQF1i7rtfz/MBElKIN9j8N0=,iv:jf2SZpulx85yx2sHcnA3iwkiXJcHq4x1fdBUcSRuiK0=,tag:WpUNpH6/8jDvQA8zRGrdKg==,type:comment] emacs-radicale-pw: ENC[AES256_GCM,data:BIORG0geX8s1WOA=,iv:SeoVn8xHlqQGxZzHrm5I5LITMoutRnz3OygswDc96ew=,tag:C3S4a8IEvCjHgAyRrCaaRw==,type:str] #ENC[AES256_GCM,data:qsBNKxd3Ng==,iv:1fNMDJt7vgKFSdghYBZsuDoZ1sWvzj1Zu8NmkjX6Zh8=,tag:0D7EsgN8B1z7/y4iZS/PtQ==,type:comment] @@ -93,8 +94,8 @@ sops: SjV6L3crUkdLWTlsNFgyRHBla2FFam8KILYsNbLdCirfoC/Vex8yEYpS2G4O0EQP wa1xzPk3Ue0/g67dv5UZFhUn0ZB2XGFC3kEPWpptTj0VL+9Z/r0zKA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-10-08T23:35:53Z" - mac: ENC[AES256_GCM,data:TxbNh/NiACHx3IwOi2esAfPf/jHV9yO86PRGarL3QQDTVB+nh5in+lx06oFh3bO5aJwpG6MWH9ZpPbX+3buyr2BTNrb6vc2YctSzaQU+ap5rvHf4AoKT3rC9rjHaR0WqJIPGV7HYcnFcoznULMrHqMTKMeEhUMqNl7xxAwxfIyk=,iv:9HAgoJN4xgxevM92K9j/5I2UYyIydOe9O+Cy3oL6/mo=,tag:1sRN7mrsRkAfp0LuZ6knBg==,type:str] + lastmodified: "2025-11-03T15:12:52Z" + mac: ENC[AES256_GCM,data:86AWnB2q5xv/JIyomkJOkZh4r2tj18rmNb02JINokmBv4/eRmej/sQIBeSbCj9cJhtKewECwVk8QKtwTu2sWB/hPjtxb8qnWD7MhNs7qmHOYAeYlAON4w7abcLxt0VFMKa7gd0c28qTHOkaWsLy6gDaIB/5x468FIYqsbfIiL9U=,iv:BDiKNHKTHPazwoM6bVoCf2kb/eNrJS9zy4yj3+PFdlY=,tag:6ZFtZZHvzdWp2EhOV3S7xQ==,type:str] pgp: - created_at: "2025-07-10T23:51:26Z" enc: |-