Update from updated-inputs-2024-11-22-02-03

Advertise current prefixes more often than claimed addresses expire.
Also increased lifetimes for claimed addresses.

configuration/common/nix.nix

@@ -26,7 +26,6 @@
     experimental-features = [
       "flakes"
       "nix-command"
-      "repl-flake"
     ];
     substituters = [
       "https://nix-cache.clerie.de"
@@ -63,6 +62,8 @@
     };
   };
 
+  nix.package = lib.mkDefault pkgs.nixVersions.nix_2_18;
+
   documentation.doc.enable = false;
 
   environment.systemPackages = with pkgs; [

configuration/desktop/fonts.nix

@@ -7,8 +7,7 @@
     roboto
     roboto-mono
     noto-fonts
-    noto-fonts-cjk
     noto-fonts-emoji
     comfortaa
-  ];
+  ] ++ (if pkgs ? "noto-fonts-cjk-sans" then [ pkgs.noto-fonts-cjk-sans ] else [ pkgs.noto-fonts-cjk ]);
 }

configuration/gpg-ssh/default.nix

@@ -1,7 +1,17 @@
 { pkgs, lib, ... }:
 
-{
+let
 
+  custom_gnupg = pkgs.gnupg.overrideAttrs (final: prev: {
+    configureFlags = prev.configureFlags ++ [
+      # Make sure scdaemon never ever again tries to use its own ccid driver
+      "--disable-ccid-driver"
+    ];
+  });
+
+in {
+
+  programs.gnupg.package = custom_gnupg;
   programs.gnupg.agent = {
     enable = true;
     enableSSHSupport = true;
@@ -9,7 +19,7 @@
   };
 
   environment.systemPackages = with pkgs; [
-    gnupg
+    custom_gnupg
     yubikey-personalization
     openpgp-card-tools
 

flake.lock

@@ -167,16 +167,16 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1716301230,
-        "narHash": "sha256-olEXRstmP0lf0H11ht6j3co7mNwcDEXTm+eGfwdEJzM=",
-        "owner": "clerie",
+        "lastModified": 1727121740,
+        "narHash": "sha256-72nDVSvUfZsLa2HbyricOpA0Eb8gxs/VST25b6DNBpM=",
+        "owner": "nix-community",
         "repo": "harmonia",
-        "rev": "e99509779ce6d6ed46062ac556b71f6ca1eb59ad",
+        "rev": "ff44006a30f93ac40d76c786e15149d901946c2b",
         "type": "github"
       },
       "original": {
-        "owner": "clerie",
-        "ref": "clerie/multiple-signing-keys",
+        "owner": "nix-community",
+        "ref": "harmonia-v1.0.2",
         "repo": "harmonia",
         "type": "github"
       }
@@ -288,11 +288,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1725983898,
-        "narHash": "sha256-4b3A9zPpxAxLnkF9MawJNHDtOOl6ruL0r6Og1TEDGCE=",
+        "lastModified": 1732014248,
+        "narHash": "sha256-y/MEyuJ5oBWrWAic/14LaIr/u5E0wRVzyYsouYY3W6w=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1355a0cbfeac61d785b7183c0caaec1f97361b43",
+        "rev": "23e89b7da85c3640bbc2173fe04f4bd114342367",
         "type": "github"
       },
       "original": {

flake.nix

@@ -19,7 +19,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     harmonia = {
-      url = "github:clerie/harmonia/clerie/multiple-signing-keys";
+      url = "github:nix-community/harmonia/harmonia-v1.0.2";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     fieldpoc.url = "git+https://git.clerie.de/clerie/fieldpoc.git";
@@ -124,6 +124,8 @@
         chromium-incognito
         git-checkout-github-pr
         git-diff-word
+        git-pp
+        harmonia
         iot-data
         nix-remove-result-links
         nixfiles-auto-install

flake/overlay.nix

@@ -15,7 +15,7 @@ final: prev: {
   inherit (chaosevents.packages.${final.system})
     chaosevents;
   harmonia = harmonia.packages.${final.system}.harmonia.override {
-    nixForHarmonia = final.nixVersions.nix_2_21;
+    nixForHarmonia = final.nixVersions.nix_2_23;
   };
   inherit (nurausstieg.packages.${final.system})
     nurausstieg;

hosts/carbon/configuration.nix

@@ -7,6 +7,7 @@
       ../../configuration/router
 
       ./dns.nix
+      ./mdns.nix
       ./net-dsl.nix
       ./net-gastnetz.nix
       ./net-heimnetz.nix
@@ -65,13 +66,6 @@
     ];
   };
 
-  systemd.services."system-reboot" = {
-    script = ''
-      ${pkgs.systemd}/bin/reboot
-    '';
-    startAt = "*-*-* 1/3:13:14";
-  };
-
   clerie.firewall.enable = true;
 
   clerie.monitoring = {

hosts/carbon/mdns.nix

@@ -0,0 +1,17 @@
+{ pkgs, ... }:
+
+{
+
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+
+    allowInterfaces = [
+      "net-heimnetz"
+      "net-iot"
+    ];
+
+    reflector = true;
+  };
+
+}

hosts/carbon/net-gastnetz.nix

@@ -20,9 +20,10 @@
   services.radvd.config = ''
     interface net-gastnetz {
       AdvSendAdvert on;
+      MaxRtrAdvInterval 30;
       prefix ::/64 {
-        AdvValidLifetime 60;
-        AdvPreferredLifetime 30;
+        AdvValidLifetime 300;
+        AdvPreferredLifetime 120;
       };
       RDNSS 2620:fe::fe 2620:fe::9 {}; # Quad 9
     };

hosts/carbon/net-heimnetz.nix

@@ -22,9 +22,10 @@
   services.radvd.config = ''
     interface net-heimnetz {
       AdvSendAdvert on;
+      MaxRtrAdvInterval 30;
       prefix ::/64 {
-        AdvValidLifetime 60;
-        AdvPreferredLifetime 30;
+        AdvValidLifetime 300;
+        AdvPreferredLifetime 120;
       };
       RDNSS fd00:152:152::1 {};
       DNSSL net.clerie.de {};

hosts/carbon/net-iot.nix

@@ -23,9 +23,10 @@
   services.radvd.config = ''
     interface net-iot {
       AdvSendAdvert on;
+      MaxRtrAdvInterval 30;
       prefix ::/64 {
-        AdvValidLifetime 60;
-        AdvPreferredLifetime 30;
+        AdvValidLifetime 300;
+        AdvPreferredLifetime 120;
       };
       RDNSS fd00:152:152::1 {};
       DNSSL iot.clerie.de {};

hosts/carbon/net-mgmt.nix

@@ -20,9 +20,10 @@
   services.radvd.config = ''
     interface net-mgmt {
       AdvSendAdvert on;
+      MaxRtrAdvInterval 30;
       prefix ::/64 {
-        AdvValidLifetime 60;
-        AdvPreferredLifetime 30;
+        AdvValidLifetime 300;
+        AdvPreferredLifetime 120;
       };
     };
   '';

hosts/carbon/ppp.nix

@@ -54,31 +54,7 @@
   };
 
   clerie.firewall.extraForwardMangleCommands = ''
-    ip46tables -t mangle -A forward-mangle -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1416
+    ip46tables -t mangle -A forward-mangle -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
   '';
 
-  networking.dhcpcd-prefixdelegation = {
-    enable = true;
-    interfaces = {
-      "ppp-dtagdsl" = {
-        iaid = 1;
-        interfaces = {
-          "net-heimnetz" = {
-            sla_id = 201;
-            prefix_len = 64;
-          };
-        };
-      };
-    };
-  };
-
-  environment.etc."ppp/ipv6-up" = {
-    text = ''
-      #!${pkgs.runtimeShell}
-
-      set -euo pipefail
-
-      ${pkgs.dhcpcd}/bin/dhcpcd --renew $1
-    '';
-  };
 }

hosts/carbon/wg-clerie.nix

@@ -5,5 +5,6 @@
     enable = true;
     ipv6s = [ "2a01:4f8:c0c:15f1::8111/128" ];
     ipv4s = [ "10.20.30.111/32" ];
+    defaultViaVPN = false;
   };
 }

hosts/hydra-1/nix-cache.nix

@@ -5,18 +5,10 @@
   services.harmonia = {
     enable = true;
     settings.bind = "[::1]:5005";
-  };
-
-  systemd.services.harmonia = {
-    environment = {
-      SIGN_KEY_PATHS = "%d/key1 %d/key2";
-    };
-    serviceConfig = {
-      LoadCredential = [
-        "key1:${config.sops.secrets."sign-key-nix-cache.clerie.de".path}"
-        "key2:${config.sops.secrets."sign-key-cache.nix.clerie.de".path}"
-      ];
-    };
+    signKeyPaths = [
+      config.sops.secrets."sign-key-nix-cache.clerie.de".path
+      config.sops.secrets."sign-key-cache.nix.clerie.de".path
+    ];
   };
 
   services.nginx.virtualHosts = {

hosts/monitoring-3/prometheus.nix

@@ -190,6 +190,7 @@ in {
               "www.fem.tu-ilmenau.de"
               "www.heise.de"
               "dyon.net.entr0py.de"
+              "matrix.fachschaften.org"
             ];
           }
         ];
@@ -229,18 +230,10 @@ in {
               "achtbaan.nikhef.nl"
               "www.fem.tu-ilmenau.de"
               "www.heise.de"
-              "pe10-fd2.nodes.nethinks.com"
-              "pe20-fd2.nodes.nethinks.com"
-              "pe10-pet1.nodes.nethinks.com"
-              "pe20-pet1.nodes.nethinks.com"
-              "pe10-ffm1.nodes.nethinks.com"
-              "ie10-ffm2.nodes.nethinks.com"
-              "pe10-ffm2.nodes.nethinks.com"
-              "ie10-due1.nodes.nethinks.com"
-              "pe10-due1.nodes.nethinks.com"
               "matrix.bau-ha.us"
               "dyon.net.entr0py.de"
               "matrix.entr0py.de"
+              "matrix.fachschaften.org"
             ];
           }
         ];
@@ -275,6 +268,7 @@ in {
           {
             targets = [
               "matrix.entr0py.de"
+              "matrix.fachschaften.org"
             ];
           }
         ];
@@ -355,46 +349,6 @@ in {
           relabelAddressToInstance
         ];
       }
-      {
-        job_name = "zimmer-temp";
-        scrape_interval = "20s";
-        scheme = "https";
-        metrics_path = "/data/zimmer-temp/";
-        static_configs = [
-          {
-            targets = [
-              "iot-data.clerie.de"
-            ];
-          }
-        ];
-      }
-      {
-        job_name = "outdoor-temp";
-        scrape_interval = "20s";
-        scheme = "https";
-        metrics_path = "/data/outdoor-temp/";
-        static_configs = [
-          {
-            targets = [
-              "iot-data.clerie.de"
-            ];
-          }
-        ];
-      }
-      {
-        job_name = "xmpp-alerts";
-        scrape_interval = "20s";
-        static_configs = [
-          {
-            targets = [
-              "monitoring-3.mon.clerie.de:9199"
-            ];
-          }
-        ];
-        relabel_configs = [
-          relabelAddressToInstance
-        ];
-      }
       {
         job_name = "hydra";
         scrape_interval = "20s";

hosts/web-2/bubblesort.nix

@@ -1,14 +0,0 @@
-{ pkgs, ... }:
-{
-  services.nginx.virtualHosts = {
-    "bubblesort.clerie.de" = {
-      enableACME = true;
-      forceSSL = true;
-      root = pkgs.fetchgit {
-        url = "https://git.clerie.de/clerie/bubblesort_js.git";
-        rev = "39d54701a11f4fb48d7e023e384a848e6bde5640";
-        sha256 = "sha256-au/sbTVLDER0BbXD6cKJIpq0GcS/saiRQw46mZQWsO0=";
-      };
-    };
-  };
-}

hosts/web-2/clerie.nix

@@ -15,8 +15,8 @@
       forceSSL = true;
       root = pkgs.fetchgit {
         url = "https://git.clerie.de/clerie/clerie.de.git";
-        rev = "785693e6826c6377c3f3200274c281d2ef3317b3";
-        hash = "sha256-cyTHOOm7hpPUD8paKB7Wci3RYAo6Jr/MI/Xqx4iwXwY=";
+        rev = "ec744cbeaf99ae4fd4832d7e594bc72bfabc8706";
+        hash = "sha256-EG8UO/9ycyWjtqLUX7ydctLdIbq/j8zylEK7YYvEwmI=";
       };
       locations."/ssh" = {
         extraConfig = ''

hosts/web-2/configuration.nix

@@ -5,27 +5,23 @@
     [
       ./hardware-configuration.nix
       ./blog.nix
-      ./bubblesort.nix
       ./bula22.nix
       ./chaosevents.nix
       ./clerie.nix
       ./drop.nix
       ./fieldpoc.nix
       ./gitea.nix
-      ./iot-data.nix
       ./ip.nix
       ./legal.nix
       ./meow.nix
       ./milchinsel.nix
       ./mitel-ommclient2.nix
       ./nix-install.nix
-      ./nogo2024.nix
       ./nurausstieg.nix
       ./ping.nix
       ./public.nix
       ./radicale.nix
       ./reichartstrasse.nix
-      ./tap.nix
       ./uptimestatus.nix
       ./wetter.nix
     ];

hosts/web-2/iot-data.nix

@@ -1,40 +0,0 @@
-{pkgs, ...}:
-
-{
-  users.users.iot-data = {
-    description = "IOT Data Service";
-    group = "iot-data";
-    home = "/var/lib/iot-data/";
-    useDefaultShell = true;
-    isSystemUser = true;
-  };
-  users.groups.iot-data = {};
-
-  systemd.services.iot-data = {
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      RuntimeDirectory = "iot-data";
-      StateDirectory = "iot-data";
-      User = "iot-data";
-      Group = "iot-data";
-    };
-    environment = {
-      IOT_DATA_CONFIG = "/var/src/iot-data-config.json";
-    };
-    script = "gunicorn -w 1 -b [::1]:8235 iot_data:app";
-    path = with pkgs; [ (python3.withPackages (ps: [ ps.gunicorn iot-data ])) ];
-  };
-
-  services.nginx.virtualHosts = {
-    "iot-data.clerie.de" = {
-      enableACME = true;
-      addSSL = true;
-      locations."/" = {
-        proxyPass = "http://[::1]:8235";
-      };
-      extraConfig = ''
-        access_log off;
-      '';
-    };
-  };
-}

hosts/web-2/nogo2024.nix

@@ -1,20 +0,0 @@
-{ pkgs, ... }:
-
-{
-  services.nginx.virtualHosts = {
-    "nogo2024.clerie.de" = {
-      enableACME = true;
-      forceSSL = true;
-      locations."/" = {
-        return = "404";
-      };
-      locations."= /nogo2024.ics" = {
-        root = pkgs.fetchgit {
-          url = "https://git.clerie.de/clerie/nogo2024.git";
-          rev = "fdc07667e6cfa09e91eaaee488528fb842a6115d";
-          sha256 = "sha256-qRviw0sQnMmrkwBO0+AWnmeqZK8wXeFxZJgmLMUtzn4=";
-        };
-      };
-    };
-  };
-}

hosts/web-2/tap.nix

@@ -1,15 +0,0 @@
-{ pkgs, ... }:
-
-{
-  services.nginx.virtualHosts = {
-    "tap.clerie.de" = {
-      enableACME = true;
-      forceSSL = true;
-      root = pkgs.fetchgit {
-        url = "https://git.clerie.de/clerie/tap.clerie.de.git";
-        rev = "a90df6f6cb6dc58ab807b230527aae76c48cdcc8";
-        sha256 = "sha256-GTUy98NHXvR7pG8lUWZm6wa0XjULnDTSu17C/DQuXBI=";
-      };
-    };
-  };
-}

hosts/zinc/programs.nix

@@ -6,7 +6,9 @@
     firefox
 
     blender
-    cura
+    #cura # libarcus library is currently broken, required for curaengine
+
+    mumble
   ];
 
 }

modules/wg-clerie/default.nix

@@ -25,6 +25,11 @@ in
         default = [];
         description = "IPv4 interface addresses";
       };
+      defaultViaVPN = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Use VPN default route for a protocol, if that protocol is unavailable in the underlay";
+      };
     };
   };
 
@@ -45,7 +50,9 @@ in
         { rule = "to 2a01:4f8:c0c:15f1::1/128 ipproto udp dport 51820 unreachable"; prio = 20001; }
         # Try direct routing first, fallback to VPN
         { rule = "lookup main"; prio = 21000; }
+      ] ++ (if cfg.defaultViaVPN then [
         { rule = "lookup wg-clerie"; prio = 21001; }
+      ] else []) ++ [
         { rule = "unreachable"; prio = 22000; }
       ];
       rules4 = (concatMap (ip: [
@@ -57,7 +64,9 @@ in
         { rule = "to 78.47.183.82/32 ipproto udp dport 51820 unreachable"; prio = 20001; }
         # Try direct routing first, fallback to VPN
         { rule = "lookup main"; prio = 21000; }
+      ] ++ (if cfg.defaultViaVPN then [
         { rule = "lookup wg-clerie"; prio = 21001; }
+      ] else []) ++ [
         { rule = "unreachable"; prio = 22000; }
       ];
     };

pkgs/clerie-sops/clerie-sops-config.nix

@@ -1,37 +1,19 @@
 { pkgs, lib, ... }:
 
-with lib;
+pkgs.python313Packages.buildPythonPackage rec {
+  pname = "clerie-sops-config";
+  version = "0.0.1";
 
-let
-  hosts = builtins.attrNames (builtins.readDir ../../hosts);
+  src = ./.;
 
-  mkAgeKey = hostname: ssh_pub_file:
-    pkgs.runCommand "${hostname}.age" {
-      buildInputs = [ pkgs.ssh-to-age ];
-    } ''
-      ssh-to-age -i ${ssh_pub_file} -o $out
-    '';
+  format = "other";
 
-  ageKeysForHost = hostname: let
-    ssh_pub_file = ../../hosts + "/${hostname}/ssh.pub";
-  in
-    if builtins.pathExists ssh_pub_file then [
-      (fileContents (mkAgeKey hostname ssh_pub_file))
-    ] else [];
+  propagatedBuildInputs = with pkgs; [
+    ssh-to-age
+  ];
 
-  mkCreationRules = hosts:
-    map (hostname: {
-      path_regex = escapeRegex "hosts/${hostname}/secrets.json";
-      key_groups = [{
-        pgp = [
-          (fileContents (pkgs.clerie-keys + "/gpg/clerie@clerie.de.fingerprint.txt"))
-        ];
-        age = ageKeysForHost hostname;
-      }];
-    }) hosts;
-
-  sops_config = {
-    creation_rules = mkCreationRules hosts;
-  };
-in
-  pkgs.writeText "sops.json" (builtins.toJSON sops_config)
+  installPhase = ''
+    mkdir -p $out/bin
+    cp clerie-sops-config.py $out/bin/clerie-sops-config
+  '';
+}

pkgs/clerie-sops/clerie-sops-config.py

@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+
+import sys
+import json
+from pathlib import Path
+import re
+import subprocess
+
+def generate_sops_config(repo_root):
+    admin_keys = []
+
+    # hardcode fingerprints because we can't really generate them automatically currently
+    admin_keys.append("0C982F87B7AFBA0F504F90A2629E741947C87928") # clerie@clerie.de
+
+    list_of_host_directories = sorted(list(filter(lambda path_object: path_object.is_dir(), (repo_root / "hosts").iterdir())))
+
+    creation_rules = []
+
+    for host_directory in list_of_host_directories:
+        host_secrets_file = host_directory / "secrets.json"
+        host_keys = []
+
+        ssh_host_key_file = host_directory / "ssh.pub"
+
+        if ssh_host_key_file.is_file():
+
+            ssh_to_age_command = subprocess.run(["ssh-to-age", "-i", str(ssh_host_key_file)], capture_output=True, text=True)
+            if ssh_to_age_command.returncode == 0:
+                host_keys.append(ssh_to_age_command.stdout.strip())
+
+        creation_rules.append({
+            "key_groups": [{
+                "age": host_keys,
+                "pgp": admin_keys,
+            }],
+            "path_regex": re.escape(str(host_secrets_file)),
+        })
+
+    return {
+        "creation_rules": creation_rules,
+    }
+
+
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 2:
+        print("No repo root specified")
+        exit(1)
+
+    repo_root = Path(sys.argv[1])
+
+    sops_config = generate_sops_config(repo_root)
+
+    print(json.dumps(sops_config))

pkgs/clerie-sops/clerie-sops.nix

@@ -4,8 +4,13 @@ pkgs.writeShellApplication {
   name = "clerie-sops";
   runtimeInputs = with pkgs; [
     sops
+    clerie-sops-config
   ];
   text = ''
-    exec sops --config ${pkgs.clerie-sops-config} "$@"
+    REPO_ROOT="."
+    if GIT_ROOT=$(git rev-parse --show-toplevel); then
+      REPO_ROOT="$GIT_ROOT"
+    fi
+    exec sops --config <(clerie-sops-config "$REPO_ROOT") "$@"
   '';
 }

pkgs/git-pp/default.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+
+pkgs.writeShellApplication {
+  name = "git-pp";
+  text = builtins.readFile ./git-pp.sh;
+  runtimeInputs = with pkgs; [
+    git
+  ];
+}

pkgs/git-pp/git-pp.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+git pull --rebase && git push

pkgs/overlay.nix

@@ -9,6 +9,7 @@ final: prev: {
   chromium-incognito = final.callPackage ./chromium-incognito {};
   git-checkout-github-pr = final.callPackage ./git-checkout-github-pr {};
   git-diff-word = final.callPackage ./git-diff-word {};
+  git-pp = final.callPackage ./git-pp {};
   iot-data = final.python3.pkgs.callPackage ./iot-data {};
   nix-remove-result-links = final.callPackage ./nix-remove-result-links {};
   nixfiles-auto-install = final.callPackage ./nixfiles/nixfiles-auto-install.nix {};

pkgs/run-with-docker-group/run-with-docker-group.sh

@@ -11,4 +11,7 @@ exec systemd-run \
 	"--property=SupplementaryGroups=docker" \
 	"--pty" "--same-dir" "--wait" "--collect" "--service-type=exec" \
 	"--quiet" \
+	"--setenv=PATH" \
+	"--setenv=EDITOR" \
+	"--setenv=PAGER" \
 	"$@"