Compare commits

..

7 commits

24 changed files with 87 additions and 29 deletions

View file

@ -3,6 +3,7 @@
, buildNpmPackage , buildNpmPackage
, fetchFromGitHub , fetchFromGitHub
, fetchzip
, nodejs , nodejs
@ -40,6 +41,14 @@
pname = "${pname}-onlyoffice"; pname = "${pname}-onlyoffice";
inherit version; inherit version;
x2t = let
version = "v7.3+1";
in fetchzip {
url = "https://github.com/cryptpad/onlyoffice-x2t-wasm/releases/download/${version}/x2t.zip";
hash = "sha256-d5raecsTOflo0UpjSEZW5lker4+wdkTb6IyHNq5iBg8=";
stripRoot = false;
};
srcs = lib.mapAttrsToList (version: { rev, hash ? lib.fakeHash }: fetchFromGitHub { srcs = lib.mapAttrsToList (version: { rev, hash ? lib.fakeHash }: fetchFromGitHub {
name = "${final.pname}-${version}-source"; name = "${final.pname}-${version}-source";
owner = "cryptpad"; owner = "cryptpad";
@ -57,20 +66,21 @@
(version: "cp -Tr ${final.pname}-${version}-source $out/${version}") (version: "cp -Tr ${final.pname}-${version}-source $out/${version}")
(builtins.attrNames onlyOfficeVersions) (builtins.attrNames onlyOfficeVersions)
)} )}
cp -Tr $x2t $out/x2t
''; '';
}); });
in buildNpmPackage rec { in buildNpmPackage rec {
pname = "cryptpad"; pname = "cryptpad";
version = "2024.3.1"; version = "2024.6.0";
src = fetchFromGitHub { src = fetchFromGitHub {
owner = "cryptpad"; owner = "cryptpad";
repo = "cryptpad"; repo = "cryptpad";
rev = version; rev = version;
hash = "sha256-kXghuktaKicFOz98Siy/OjJ9rlgy6C2BTKkD2OFLE+k="; hash = "sha256-huIhhnjatkaVfm1zDeqi88EX/nAUBQ0onPNOwn7hrX4=";
}; };
npmDepsHash = "sha256-fjImdtv0bwgdDvl/BXV0DesreOAW2u8HsNqJ13hrJMw="; npmDepsHash = "sha256-Oh1fBvP7OXC+VDiH3D+prHmi8pRrxld06n30sqw5apY=";
inherit nodejs; inherit nodejs;
@ -107,6 +117,10 @@ in buildNpmPackage rec {
runHook postInstall runHook postInstall
''; '';
passthru = {
inherit onlyOffice;
};
meta = { meta = {
description = "Collaborative office suite, end-to-end encrypted and open-source."; description = "Collaborative office suite, end-to-end encrypted and open-source.";
homepage = "https://cryptpad.org"; homepage = "https://cryptpad.org";

View file

@ -5,8 +5,10 @@
pkgs = import sources.nixpkgs {}; pkgs = import sources.nixpkgs {};
in rec { in rec {
cryptpad = pkgs.callPackage ./default.nix {}; cryptpad = pkgs.callPackage ./default.nix {};
docker = pkgs.callPackage ./docker.nix { docker = import ./docker.nix {
inherit pkgs;
inherit name tag; inherit name tag;
inherit cryptpad; inherit cryptpad;
withOnlyOffice = true;
}; };
} }

View file

@ -2,9 +2,9 @@
"pins": { "pins": {
"nixpkgs": { "nixpkgs": {
"type": "Channel", "type": "Channel",
"name": "nixos-23.11", "name": "nixos-24.05",
"url": "https://releases.nixos.org/nixos/23.11/nixos-23.11.7237.46397778ef1f/nixexprs.tar.xz", "url": "https://releases.nixos.org/nixos/24.05/nixos-24.05.2355.d032c1a6dfad/nixexprs.tar.xz",
"hash": "00cy8q07diavxb91g7pxl0gqc68s3hzimsggjc9rqyf99h1q9d3r" "hash": "1fynyfjsmrxs383mygzlbkb3yhzmlnnpf8x84mikaiqc3ngszsv8"
} }
}, },
"version": 3 "version": 3

View file

@ -188,6 +188,12 @@ module.exports = {
* DATABASE VOLUMES * DATABASE VOLUMES
* ===================== */ * ===================== */
/*
* We need this config entry, else CryptPad will try to mkdir
* some stuff into Nix store apparently...
*/
base: '/mnt/data',
/* /*
* CryptPad stores each document in an individual file on your hard drive. * CryptPad stores each document in an individual file on your hard drive.
* Specify a directory where files should be stored. * Specify a directory where files should be stored.

View file

@ -26,7 +26,7 @@ job "cryptpad" {
} }
config { config {
image = "kokakiwi/cryptpad:2024.3.1" image = "kokakiwi/cryptpad:2024.6.0"
ports = [ "http" ] ports = [ "http" ]
volumes = [ volumes = [

View file

@ -93,6 +93,12 @@
address = "10.83.5.3"; address = "10.83.5.3";
endpoint = "82.64.238.84:33742"; endpoint = "82.64.238.84:33742";
}; };
"ortie" = {
siteName = "dathomir";
publicKey = "tbx2mvt3TN3Xd+ermwwZ6it80VWT5949cKH9BRFgvzE=";
address = "10.83.5.4";
endpoint = "82.64.238.84:33743";
};
}; };
# Pin Nomad version # Pin Nomad version

View file

@ -12,3 +12,4 @@ ananas.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHs0zAyBy70oyV5
onion.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINjBQ67fxwuDDzRPveTko/Sgf0cev3tIvlr3CfAmhF0C onion.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINjBQ67fxwuDDzRPveTko/Sgf0cev3tIvlr3CfAmhF0C
oseille.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAgQdQ5UVFFn+DXN90ut9+V7NtEopQJnES3r8soKTZW4 oseille.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAgQdQ5UVFFn+DXN90ut9+V7NtEopQJnES3r8soKTZW4
io.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIvgCJ7Jew7ou1RZuaT41Sd+ucZAgxUwtdieqNqoC3+T io.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIvgCJ7Jew7ou1RZuaT41Sd+ucZAgxUwtdieqNqoC3+T
ortie.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMqtfIPLk8a5tM6Upj7GQwlIS16nBPrZYVXE2FVlO2Yn

View file

@ -0,0 +1,12 @@
{ ... }:
{
boot.loader.systemd-boot.enable = true;
boot.loader.timeout = 20;
boot.loader.efi.canTouchEfiVariables = true;
services.openssh.ports = [ 22 33604 ];
deuxfleurs.hostName = "ortie";
deuxfleurs.staticIPv4.address = "192.168.1.37";
deuxfleurs.staticIPv6.address = "2a01:e0a:5e4:1d0:223:24ff:feb0:1b9";
}

View file

@ -0,0 +1 @@
../site/dathomir.nix

View file

@ -41,3 +41,6 @@ Host oseille
Host io Host io
HostName io.machine.deuxfleurs.fr HostName io.machine.deuxfleurs.fr
Host ortie
HostName ortie.machine.deuxfleurs.fr

View file

@ -1,5 +1,5 @@
job "albatros" { job "albatros" {
datacenters = ["neptune", "jupiter", "corrin", "bespin"] datacenters = ["neptune", "dathomir", "corrin", "bespin"]
type = "service" type = "service"
priority = 90 priority = 90

View file

@ -2,7 +2,7 @@ job "builder" {
namespace = "ci" namespace = "ci"
type = "batch" type = "batch"
datacenters = ["neptune", "jupiter", "corrin", "bespin"] datacenters = ["neptune", "dathomir", "corrin", "bespin"]
priority = 100 priority = 100
parameterized { parameterized {

View file

@ -1,5 +1,5 @@
job "core-d53" { job "core-d53" {
datacenters = ["neptune", "jupiter", "corrin", "bespin"] datacenters = ["neptune", "dathomir", "corrin", "bespin"]
type = "service" type = "service"
priority = 90 priority = 90

View file

@ -1,5 +1,5 @@
job "core-diplonat" { job "core-diplonat" {
datacenters = ["neptune", "jupiter", "corrin", "bespin"] datacenters = ["neptune", "dathomir", "corrin", "bespin"]
type = "system" type = "system"
priority = 90 priority = 90

View file

@ -1,5 +1,5 @@
job "core-tricot" { job "core-tricot" {
datacenters = ["neptune", "jupiter", "corrin", "bespin"] datacenters = ["neptune", "dathomir", "corrin", "bespin"]
type = "system" type = "system"
priority = 90 priority = 90

View file

@ -1,5 +1,5 @@
job "garage-staging" { job "garage-staging" {
datacenters = [ "neptune", "jupiter", "corrin", "bespin" ] datacenters = [ "neptune", "dathomir", "corrin", "bespin" ]
type = "system" type = "system"
priority = 90 priority = 90

View file

@ -1,5 +1,5 @@
job "telemetry-service" { job "telemetry-service" {
datacenters = ["neptune", "jupiter", "corrin", "bespin"] datacenters = ["neptune", "dathomir", "corrin", "bespin"]
type = "service" type = "service"
group "prometheus" { group "prometheus" {

View file

@ -1,5 +1,5 @@
job "telemetry-system" { job "telemetry-system" {
datacenters = ["neptune", "jupiter", "corrin", "bespin"] datacenters = ["neptune", "dathomir", "corrin", "bespin"]
type = "system" type = "system"
priority = "100" priority = "100"

View file

@ -14,7 +14,7 @@
endpoint = "77.207.15.215:33723"; endpoint = "77.207.15.215:33723";
}; };
"origan" = { "origan" = {
siteName = "jupiter"; siteName = "dathomir";
publicKey = "smBQYUS60JDkNoqkTT7TgbpqFiM43005fcrT6472llI="; publicKey = "smBQYUS60JDkNoqkTT7TgbpqFiM43005fcrT6472llI=";
address = "10.14.2.33"; address = "10.14.2.33";
endpoint = "82.64.238.84:33733"; endpoint = "82.64.238.84:33733";

View file

@ -1,7 +1,4 @@
# Configuration file local to this node { ... }:
{ config, pkgs, ... }:
{ {
# Use the systemd-boot EFI boot loader. # Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true; boot.loader.systemd-boot.enable = true;

View file

@ -1 +1 @@
../site/jupiter.nix ../site/dathomir.nix

View file

@ -0,0 +1,6 @@
{ ... }:
{
deuxfleurs.siteName = "dathomir";
deuxfleurs.staticIPv4.defaultGateway = "192.168.1.1";
deuxfleurs.cnameTarget = "dathomir.site.staging.deuxfleurs.org.";
}

View file

@ -1,7 +0,0 @@
{ config, pkgs, ... }:
{
deuxfleurs.siteName = "jupiter";
deuxfleurs.staticIPv4.defaultGateway = "192.168.1.1";
deuxfleurs.cnameTarget = "jupiter.site.staging.deuxfleurs.org.";
}

View file

@ -78,6 +78,23 @@ SystemMaxUse=1G
services.openssh.enable = true; services.openssh.enable = true;
services.openssh.settings.PasswordAuthentication = false; services.openssh.settings.PasswordAuthentication = false;
# FIXME: Temporary patch for OpenSSH (CVE-2024-6387)
# Patches from backport PR: https://github.com/NixOS/nixpkgs/pull/323765
programs.ssh.package = pkgs.openssh.overrideAttrs(prev: {
patches = prev.patches ++ [
(pkgs.fetchpatch {
url = "https://raw.githubusercontent.com/emilazy/nixpkgs/c21c340818954576c6401ad460a9d42bab030bc4/pkgs/tools/networking/openssh/openssh-9.6_p1-CVE-2024-6387.patch";
hash = "sha256-B3Wz/eWSdOnrOcVzDv+QqzLGdFlb3jivQ8qZMC3d0Qw=";
})
(pkgs.fetchpatch {
url = "https://raw.githubusercontent.com/emilazy/nixpkgs/c21c340818954576c6401ad460a9d42bab030bc4/pkgs/tools/networking/openssh/openssh-9.6_p1-chaff-logic.patch";
hash = "sha256-lepBEFxKTAwg379iCD8KQCZVAzs3qNSSyUTOcartpK4=";
})
];
doCheck = false;
});
virtualisation.docker = { virtualisation.docker = {
enable = true; enable = true;
extraOptions = "--config-file=${pkgs.writeText "daemon.json" (builtins.toJSON { extraOptions = "--config-file=${pkgs.writeText "daemon.json" (builtins.toJSON {