about summary refs log tree commit diff
path: root/ops/modules
AgeCommit message (Collapse)AuthorFilesLines
2024-03-31 r/7835 feat(automatic-gc): robust way to disable automatic-gcVincent Ambo1-0/+5
We just had a minor incident where apparently our build cache for the critical security fix was deleted by automatic-gc (which I had stopped manually) being reenabled by an unrelated whitby deploy. This adds a new mechanism where by touching a file called `/run/stop-automatic-gc` the GC can be prevented from running. We might want to configure an occasional alert or something if this file exists, so we don't forget about it when we are using it. Change-Id: I041e57e24b2b684696164a2d516581d7f5696ef0 Reviewed-on: https://cl.tvl.fyi/c/depot/+/11326 Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: flokli <flokli@flokli.de>
2024-03-18 r/7734 chore(3p/sources): bump channels & overlays (2024-03-17)Vincent Ambo1-12/+0
In hope that iwlwifi works again on this commit, and I don't actually have to debug it. Includes following changes: * users/aspen: home-manager is shuffling around pinentry options again * users/flokli: rebase ipu6-softisp patches to Linux 6.8 make cl/11097 a separate patch * ops/modules: remove unused (and now broken) v4l2loopback module Co-Authored-By: Florian Klink <flokli@flokli.de> Change-Id: I763f1f075778f2ed8db7803f87248c9dabde4213 Reviewed-on: https://cl.tvl.fyi/c/depot/+/11174 Reviewed-by: tazjin <tazjin@tvl.su> Reviewed-by: aspen <root@gws.fyi> Reviewed-by: flokli <flokli@flokli.de> Autosubmit: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI
2024-03-13 r/7688 chore(ops/modules/open_eid): use nativeMessagingHosts.packagesFlorian Klink1-1/+1
trace: warning: The `programs.firefox.nativeMessagingHosts.euwebid` option is deprecated, please add `web-eid-app` to `programs.firefox.nativeMessagingHosts.packages` instead. Change-Id: Ic2518957eb8e9151f2fdb13a5f25dfbc12c577a2 Reviewed-on: https://cl.tvl.fyi/c/depot/+/11138 Autosubmit: flokli <flokli@flokli.de> Tested-by: BuildkiteCI Reviewed-by: tazjin <tazjin@tvl.su>
2024-03-03 r/7645 feat(tvix/docs): switch to mdbookFlorian Klink1-7/+0
Some of the docs are still outdated (like architecture and drv path inconsistencies). Change-Id: I7a6afceb008ef4cd19a764dd6c637b39fa842a2e Reviewed-on: https://cl.tvl.fyi/c/depot/+/11072 Autosubmit: flokli <flokli@flokli.de> Tested-by: BuildkiteCI Reviewed-by: edef <edef@edef.eu>
2024-02-28 r/7622 feat(ops/sanduny): deploy volgasprint.orgVincent Ambo1-0/+15
Change-Id: I5058e78ee3d7c26f2abafedeb5c0fb9d55a4da6a Reviewed-on: https://cl.tvl.fyi/c/depot/+/11066 Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: Mark Shevchenko <markshevchenko@gmail.com>
2024-02-26 r/7607 fix: explicit dependencies on network-online.targetVincent Ambo1-0/+1
A recent change in nixpkgs introduced evaluation warnings if a systemd service is configured to start after network-online.target, but does not directly depend on it. This is done because the existing dependency from multi-user.target to network-online.target is being removed, leaving these services without an actual dependency on the service. This affected autosubmit (I added a weak dependency here, for now the service is actually on the same host as Gerrit), and sterni's mirror setup (I added a strong dependency here). Change-Id: I88a4aa69f6788c489f59533d34be3c9cea681326 Reviewed-on: https://cl.tvl.fyi/c/depot/+/11026 Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: sterni <sternenseemann@systemli.org> Tested-by: BuildkiteCI
2024-02-23 r/7599 feat(ops/modules/www): drop hsts for .devFlorian Klink1-10/+0
The .dev TLS is on the HSTS preload list, so there's no need to set this header here at all. Change-Id: I253fa2427e75bd0808945cd5d53159cac74e7f8b Reviewed-on: https://cl.tvl.fyi/c/depot/+/11018 Autosubmit: flokli <flokli@flokli.de> Reviewed-by: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI
2024-02-23 r/7598 feat(ops/glesys): add bolt.tvix.devFlorian Klink2-19/+17
Make tvixbolt.tvl.su just serve a redirect to the new domain, and fold everything into the tvix.dev.nix module. Change-Id: I3a9ccf37d2ceee8886208d6f662e7598ce395b1a Reviewed-on: https://cl.tvl.fyi/c/depot/+/11015 Reviewed-by: lukegb <lukegb@tvl.fyi> Reviewed-by: tazjin <tazjin@tvl.su> Autosubmit: flokli <flokli@flokli.de> Tested-by: BuildkiteCI
2024-02-23 r/7595 chore(tvixbolt): move from //corp to //webVincent Ambo1-1/+1
Assigning copyright to the TVL community (whatever that is), and adding AGPL-3.0-or-later license. I also cleaned up some of the stuff on the landing page. Change-Id: I4dbca19406e00e5105fed50e8fb64e0fcca23e3a Reviewed-on: https://cl.tvl.fyi/c/depot/+/11013 Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: flokli <flokli@flokli.de> Tested-by: BuildkiteCI
2024-02-18 r/7549 feat(ops/modules): reindex livegrap when depot refs changeVincent Ambo1-0/+17
Change-Id: I917e628428171fa30a89e061cd9bf07e5a759081 Reviewed-on: https://cl.tvl.fyi/c/depot/+/10950 Tested-by: BuildkiteCI Reviewed-by: flokli <flokli@flokli.de> Autosubmit: tazjin <tazjin@tvl.su>
2024-02-17 r/7537 feat(ops/modules): initialise module for running livegrepVincent Ambo2-4/+90
Change-Id: Ic22118def24089cda25ccc74c9da670d41c6b323 Reviewed-on: https://cl.tvl.fyi/c/depot/+/10936 Tested-by: BuildkiteCI Reviewed-by: flokli <flokli@flokli.de>
2024-02-15 r/7525 fix(ops/gerrit): mitigate Quarkus temporarilyVincent Ambo1-1/+1
Keycloak has a new thing going on: Wildfly (whatever that is) is out, and Quarkus (whatever that is) is in. https://www.keycloak.org/migration/migrating-to-quarkus This breaks our stuff, however, so we're using the Gerrit OAuth plugins recommendations for how to work around that: https://gerrit.googlesource.com/plugins/oauth/+/8d467e99457466c71eb0ca9e661dd433f03a0123%5E%21/#F1 Change-Id: I2391a89c6791015e66c5e480b905b6ee56663020 Reviewed-on: https://cl.tvl.fyi/c/depot/+/10905 Tested-by: BuildkiteCI Reviewed-by: flokli <flokli@flokli.de>
2024-02-15 r/7520 chore(ops/modules/btrfs-auto-scrub): schedule later by defaultsterni1-1/+1
Midnight is kind of when you're still up and may want read performance that is not affected by a btrfs scrub. Change-Id: I0609269d3ee9853f7c7fe08cae18efe1d9259e7e Reviewed-on: https://cl.tvl.fyi/c/depot/+/10864 Reviewed-by: sterni <sternenseemann@systemli.org> Autosubmit: sterni <sternenseemann@systemli.org> Tested-by: BuildkiteCI
2024-02-14 r/7511 chore(users): grfn -> aspenAspen Smith2-5/+3
Change-Id: I6c6847fac56f0a9a1a2209792e00a3aec5e672b9 Reviewed-on: https://cl.tvl.fyi/c/depot/+/10809 Autosubmit: aspen <root@gws.fyi> Reviewed-by: sterni <sternenseemann@systemli.org> Tested-by: BuildkiteCI Reviewed-by: lukegb <lukegb@tvl.fyi>
2024-02-12 r/7503 chore(3p/gerrit): 3.8.2 -> 3.9.1Luke Granger-Brown1-1/+1
Change-Id: I8fa10b52c44bd3d5efb0fff740ad6d5da6e96831 Reviewed-on: https://cl.tvl.fyi/c/depot/+/10802 Tested-by: BuildkiteCI Reviewed-by: tazjin <tazjin@tvl.su>
2023-12-11 r/7152 feat(tvix/build-go): initFlorian Klink1-2/+12
This adds the generated golang bindings for tvix-build. Change-Id: I2eb0d1cc38bc2fa34afd7c904eea05c5ee192cce Reviewed-on: https://cl.tvl.fyi/c/depot/+/10242 Tested-by: BuildkiteCI Autosubmit: flokli <flokli@flokli.de> Reviewed-by: raitobezarius <tvl@lahfa.xyz>
2023-11-27 r/7078 chore(ops): move from gerrit-queue to gerrit-autosubmitVincent Ambo2-52/+42
Enables the new autosubmit bot, albeit without rebase functionality (this will be a separate change). Change-Id: Ia42a4f08c0edca5e6cc8bf4770ec24dbf16a5db7 Reviewed-on: https://cl.tvl.fyi/c/depot/+/10132 Reviewed-by: sterni <sternenseemann@systemli.org> Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su>
2023-11-26 r/7071 fix(ops/modules/irccat): recursively merge config attribute setsterni1-1/+1
`lib.types.attrs` is deprecated in favor of `lib.types.attrsOf lib.types.anything` because it doesn't merge attribute sets /recursively/. `attrsOf` and `anything` do, the former is used to ensure that the top value is an attribute set as expected by irccat. Change-Id: I2a9d943a06c8f99f7d6d20c9944288e854924bff Reviewed-on: https://cl.tvl.fyi/c/depot/+/10129 Reviewed-by: tazjin <tazjin@tvl.su> Autosubmit: sterni <sternenseemann@systemli.org> Tested-by: BuildkiteCI
2023-11-26 r/7070 feat(sterni/ingeborg): enable btrfs auto scrubsterni1-0/+25
While we are at it, rename disk-checkup.nix to btrfs-auto-scrub.nix and move it into //ops/modules. I originally wanted to have additionally disk health related services in that module, but the btrfs scrub functionality is nicely self-contained and reusable, so I think it makes sense to have this in a more central location. Change-Id: Iabdd62838eef009540ca71abafd921afda2a9b47 Reviewed-on: https://cl.tvl.fyi/c/depot/+/10128 Reviewed-by: sterni <sternenseemann@systemli.org> Autosubmit: sterni <sternenseemann@systemli.org> Tested-by: BuildkiteCI
2023-11-05 r/6945 fix(monorepo-gerrit): fix linking to bugs & CLs in commitsVincent Ambo1-4/+4
In some Gerrit version upgrade the syntax of this config element seems to have changed. There's now one less level of escaping, and it no longer produces raw HTML but rather a link. Fixes b/319. Change-Id: I8d86d23e91cb003e950d9a6723bb0a5ee5d80bb0 Reviewed-on: https://cl.tvl.fyi/c/depot/+/9952 Reviewed-by: flokli <flokli@flokli.de> Tested-by: BuildkiteCI
2023-10-30 r/6906 chore(third_party/gerrit-queue): move to tvl overlayFlorian Klink1-1/+1
Bump to a version including https://github.com/flokli/gerrit-queue/pull/15 Change-Id: Ie316498ca2c608e5489901c5705ce5f2dc047f29 Reviewed-on: https://cl.tvl.fyi/c/depot/+/9808 Reviewed-by: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI
2023-10-17 r/6848 chore(tvix/store-go): rename go moduleFlorian Klink1-4/+4
`code.tvl.fyi/tvix/store/protos` now points to a directory that only contains the `.proto` files, while all golang tooling and .pb.go files live in tvix/store-go. As discussed in https://cl.tvl.fyi/c/depot/+/9787/comment/fc5d155c_1bd38e3a/, the amount of people currently using this is still small, so rename the go.mod now, while it doesn't yet hurt. Also, use code.tvl.fyi/tvix/castore-go instead of code.tvl.fyi/tvix/ castore/protos, to make use of cl/9791. Change-Id: I9ea89957d7c29dfae4c893b9aae8ac8a0bad2d8e Reviewed-on: https://cl.tvl.fyi/c/depot/+/9792 Autosubmit: flokli <flokli@flokli.de> Tested-by: BuildkiteCI Reviewed-by: Connor Brewster <cbrewster@hey.com>
2023-10-17 r/6847 chore(tvix/castore-go): rename go moduleFlorian Klink1-4/+4
`code.tvl.fyi/tvix/castore/protos` now points to a directory that only contains the `.proto` files, while all golang tooling and .pb.go files live in tvix/castore-go. As discussed in https://cl.tvl.fyi/c/depot/+/9787/comment/fc5d155c_1bd38e3a/, the amount of people currently using this is still small, so rename the go.mod now, while it doesn't yet hurt. Change-Id: Ib3c6a2dac2923b3806ebb05be00af66d0da9f698 Reviewed-on: https://cl.tvl.fyi/c/depot/+/9791 Reviewed-by: Connor Brewster <cbrewster@hey.com> Tested-by: BuildkiteCI Autosubmit: flokli <flokli@flokli.de>
2023-10-17 r/6844 chore(tvix): move store golang bindings to tvix/store-goFlorian Klink1-1/+1
Similar to the castore-go CL before, this also updates the store-go bindings to the new layout. Change-Id: Id73d7ad43f7d70171ab021728e303300c5db71f0 Reviewed-on: https://cl.tvl.fyi/c/depot/+/9788 Tested-by: BuildkiteCI Reviewed-by: Connor Brewster <cbrewster@hey.com>
2023-10-17 r/6843 chore(tvix): move castore golang bindings to tvix/castore-goFlorian Klink1-1/+1
Have `tvix/castore/protos` only contain the protos, no go noise. Make the `.pb.go` file generation a pure Nix build at `//tvix/castore/protos:go-bindings`, and have a script at `//tvix:castore-go-generate` (TBD) that copies the results to `tvix/castore-go`. `//tvix:castore-go`, with sources in `tvix/castore-go` now contains the tooling around the generated bindings, and the generated bindings themselves (So go mod replace workflows still work). An additional CI step is added from there to ensure idempotenty of the .pb.go files. The code.tvl.fyi webserver config is updated to the new source code path. I'm still unsure if we want to also update the go.mod name. While being a backwards-incompatible change, it'll probbaly make it easier where to find these files, and the amount of external consumers is still low enough. Part of b/323. Change-Id: I2edadd118c22ec08e57c693f6cc2ef3261c62489 Reviewed-on: https://cl.tvl.fyi/c/depot/+/9787 Reviewed-by: Connor Brewster <cbrewster@hey.com> Tested-by: BuildkiteCI
2023-10-10 r/6762 revert(ops/code.tvl.fyi): fix josh-proxy cmdline argstazjin1-1/+1
This partially reverts commit eb167c71a779b978a1fd4d6cd29fdf47268c578d. Reason for revert: Broke anonymous cloning. Change-Id: I10d148f8deed5d9a200d1e731fe341b9ee0782c3 Reviewed-on: https://cl.tvl.fyi/c/depot/+/9625 Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: tazjin <tazjin@tvl.su>
2023-10-09 r/6751 fix(ops/code.tvl.fyi): fix josh-proxy cmdline argsFlorian Klink2-2/+2
It looks like josh is only listening on v4 currently: https://github.com/josh-project/josh/blob/1586eab06284ce668779c87f00a1fb5fa9763be0/josh-proxy/src/bin/josh-proxy.rs#L1429 Also, the remote URL to push to is (or became) https://cl.tvl.fyi/a, not just https://cl.tvl.fyi/, update it Change-Id: Ic59bc51c28be913d833186c715e9a9eb960bbd6e Reviewed-on: https://cl.tvl.fyi/c/depot/+/9591 Reviewed-by: tazjin <tazjin@tvl.su> Autosubmit: flokli <flokli@flokli.de> Tested-by: BuildkiteCI
2023-10-09 r/6748 chore(ops): expose nar-bridge for go getBrian McGee1-0/+10
Change-Id: I9d8f444ed625502cfaeea83e0b330f52dac24118 Reviewed-on: https://cl.tvl.fyi/c/depot/+/9589 Reviewed-by: flokli <flokli@flokli.de> Tested-by: BuildkiteCI
2023-10-09 r/6745 feat(ops/www): add experimental grep.tvl.fyi setupVincent Ambo1-0/+22
This points a reverse proxy at a manually run, highly experimental container. The actual setup is not yet nixified. Change-Id: I8e1d5ec94a3f1e9b4b0bfc7ffd2a9badf4e79291 Reviewed-on: https://cl.tvl.fyi/c/depot/+/9577 Reviewed-by: flokli <flokli@flokli.de> Reviewed-by: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su>
2023-10-08 r/6733 chore(ops/modules): enable passwordless sudo in users moduleVincent Ambo1-0/+5
Change-Id: I8522a106bbadacf1b5720b4cd1102052aa360ff0 Reviewed-on: https://cl.tvl.fyi/c/depot/+/9575 Tested-by: BuildkiteCI Reviewed-by: flokli <flokli@flokli.de>
2023-10-08 r/6732 chore(users): remove inactive usersVincent Ambo1-15/+0
Change-Id: I3cfb425e4dac0a467e3917df996e9800a3ebe875 Reviewed-on: https://cl.tvl.fyi/c/depot/+/9576 Reviewed-by: isomer <isomer@tvl.fyi> Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su>
2023-10-08 r/6730 fix(ops/modules): remove cloud-init from yandex-cloud moduleVincent Ambo1-1/+0
cloud-init stopped working for unknown reasons, enabling it will break DHCP and SSH, and make the image inaccessible. This means that access needs to be provided by baking keys into the image instead. Change-Id: Ib8d32a02d0a8ea61d75921f147349d73a27ef751 Reviewed-on: https://cl.tvl.fyi/c/depot/+/9572 Reviewed-by: flokli <flokli@flokli.de> Tested-by: BuildkiteCI
2023-10-06 r/6717 chore(ops): remove images.tvl.fyiVincent Ambo1-22/+0
I don't even know what this is/was. Change-Id: I743efa88258bbc13b7a3d4b8de8df222325b00ed Reviewed-on: https://cl.tvl.fyi/c/depot/+/9553 Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: flokli <flokli@flokli.de> Reviewed-by: tazjin <tazjin@tvl.su>
2023-09-24 r/6647 fix(ops/modules/tvl-buildkite): add /run/wrappers/bin to $PATHFlorian Klink1-0/+3
It looks like since cl/9341, the tvix buildkite pipeline fails. We're not yet sure what's causing it, it might be the lack of the `fusermount` binary in $PATH. Change-Id: Ie95678fbd07201e96ca3d43b53827781b49f1f46 Reviewed-on: https://cl.tvl.fyi/c/depot/+/9386 Autosubmit: flokli <flokli@flokli.de> Tested-by: BuildkiteCI Reviewed-by: tazjin <tazjin@tvl.su> Reviewed-by: Connor Brewster <cbrewster@hey.com>
2023-09-22 r/6634 chore(ops): move yandex-cloud image module out of corpVincent Ambo1-0/+79
Change-Id: Idc8cc3a640fc895cd3882e93a193212adb743abb Reviewed-on: https://cl.tvl.fyi/c/depot/+/9425 Tested-by: BuildkiteCI Reviewed-by: flokli <flokli@flokli.de>
2023-09-22 r/6631 chore(ops/modules/www/code.tvl.fyi): add missing go get redirectFlorian Klink1-0/+6
This was missing in cl/9370. Change-Id: I02048b0e65d1192e9e300160bb8f78fe30a70da1 Reviewed-on: https://cl.tvl.fyi/c/depot/+/9405 Autosubmit: flokli <flokli@flokli.de> Reviewed-by: Connor Brewster <cbrewster@hey.com> Reviewed-by: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI
2023-09-22 r/6629 refactor(tvix): move castore into tvix-castore crateFlorian Klink1-0/+4
This splits the pure content-addressed layers from tvix-store into a `castore` crate, and only leaves PathInfo related things, as well as the CLI entrypoint in the tvix-store crate. Notable changes: - `fixtures` and `utils` had to be moved out of the `test` cfg, so they can be imported from tvix-store. - Some ad-hoc fixtures in the test were moved to proper fixtures in the same step. - The protos are now created by a (more static) recipe in the protos/ directory. The (now two) golang targets are commented out, as it's not possible to update them properly in the same CL. This will be done by a followup CL once this is merged (and whitby deployed) Bug: https://b.tvl.fyi/issues/301 Change-Id: I8d675d4bf1fb697eb7d479747c1b1e3635718107 Reviewed-on: https://cl.tvl.fyi/c/depot/+/9370 Reviewed-by: tazjin <tazjin@tvl.su> Reviewed-by: flokli <flokli@flokli.de> Autosubmit: flokli <flokli@flokli.de> Tested-by: BuildkiteCI Reviewed-by: Connor Brewster <cbrewster@hey.com>
2023-09-10 r/6575 feat(ops/modules/code.tvl.fyi): fix go get for tvix store protosFlorian Klink1-1/+11
There's a go.mod in in tvix/store/protos, which sets the module path to code.tvl.fyi/tvix/store/protos. While this path makes kinda sense, it's currently not possible to `go get` it from that location, as we serve the cgit interface from there. Fortunately, `go get` has a mechanism to determine clone URLs for a given go module path, as documented in https://go.dev/ref/mod#vcs-find. We simply need to serve a small HTML file at that path, describing the proper clone URL. This points the clone URL for code.tvl.fyi/tvix/store/protos to a josh- provided subtree of just :/tvix/store/protos, which will contain the root go.mod file. We need another layer of indirection as nginx can't have an `alias` directive inside a conditional block (but can have a redirect). Contrary to https://b.tvl.fyi/issues/299#comment-464, it seems to work for our usecase. It might become a problem if we actually serve `go.mod` files in a nested fashion at some point, but let's look at that once we get there. Fixes b/299. Change-Id: Idcad795105af5d57e6d06de6e232881dccf9110b Reviewed-on: https://cl.tvl.fyi/c/depot/+/9290 Autosubmit: flokli <flokli@flokli.de> Tested-by: BuildkiteCI Reviewed-by: adisbladis <adisbladis@gmail.com> Reviewed-by: tazjin <tazjin@tvl.su>
2023-09-05 r/6552 feat(ops/modules): deploy //web/pwcrypt to signup.tvl.fyiVincent Ambo1-0/+19
I verified on whitby that the password hashes generated by //web/pwcrypt are compatible with our OpenLDAP, so it's time to make this thing public. Change-Id: Icc2f095ca7ce4acff6de91a1642dea6461177423 Reviewed-on: https://cl.tvl.fyi/c/depot/+/9266 Tested-by: BuildkiteCI Reviewed-by: flokli <flokli@flokli.de> Autosubmit: tazjin <tazjin@tvl.su>
2023-08-22 r/6517 fix(ops/nixery): switch nixery.dev to stable nixpkgs channelVincent Ambo1-2/+3
The current unstable has a bunch of breakage which people have been reporting, lets move the public instance to the stable channel until that is sorted out. Example breakage: https://github.com/tazjin/nixery/issues/159 Change-Id: Id5eb11ebd235928b85c01c178c32da3badea517f Reviewed-on: https://cl.tvl.fyi/c/depot/+/9126 Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: flokli <flokli@flokli.de> Tested-by: BuildkiteCI
2023-08-21 r/6516 feat(tvl-users): grant wheel privileges to flokliVincent Ambo1-1/+1
Flokli needs deploy access to whitby to ~~break auth~~ experiment with Dex. Change-Id: If39763192961e227ee569a312f6a0e3ae2c10786 Reviewed-on: https://cl.tvl.fyi/c/depot/+/9113 Reviewed-by: flokli <flokli@flokli.de> Tested-by: BuildkiteCI
2023-07-01 r/6381 chore(ops/modules): remove oauth2_proxy moduleFlorian Klink1-60/+0
This was dropped from whitby itself in cl/8905, but didn't drop the module because we were worried someone else might still be using it. However, this relies on the "oauth2-proxy" client ID, which only has the following supported redirect uris (as per ops/keycloak/clients.tf): - https://login.tvl.fyi/oauth2/callback - http://localhost:4774/oauth2/callback … which means, noone can really run this properly anyways, so let's drop it. We can always restore it from git. Change-Id: I7d700f59a62cce1254ad4ba0792a7d7b3960b769 Reviewed-on: https://cl.tvl.fyi/c/depot/+/8913 Reviewed-by: sterni <sternenseemann@systemli.org> Tested-by: BuildkiteCI Autosubmit: flokli <flokli@flokli.de>
2023-06-22 r/6343 feat(ops): introduce (head|tail)scale server at net.tvl.fyiVincent Ambo1-0/+62
This runs a headscale server on sanduny which lets users join their machines to the TVL tailscale network. This would theoretically let people communicate with each other on the internal network, but also more notably joined servers can advertise exit node capability so that we can have our own "VPN network", for starters with endpoints in Germany, UK and Russia (whitby, sanduny and koptevo respectively). This setup isn't fully stable yet, notably: * The IP range used by tailscale is just the default one right now, I'm not sure if that should be changed or what. * The system is stateful (on sanduny), but the state is not (yet) backed up anywhere. Use with caution. * Machine joining is a manual process requiring SSH & root access to sanduny. The process is to log in to sanduny, then get a headscale shell with `sudo -u headscale bash`, and to use the `headscale` CLI within there to administrate access. I've opted to create a user account `tvl` for TVL-owned machines, and a personal account for myself and my machines. Change-Id: I4f1be1fe8062a6c2e77203ff72fe8709f4e4dec8 Reviewed-on: https://cl.tvl.fyi/c/depot/+/8837 Reviewed-by: sterni <sternenseemann@systemli.org> Reviewed-by: flokli <flokli@flokli.de> Tested-by: BuildkiteCI
2023-06-15 r/6317 fix(ops/modules/quassel): use systemd LoadCredential to read certsVincent Ambo1-1/+5
This avoids permission issues with nginx vs. quassel Change-Id: I770f8284d8fd8fc6d38add93c1681f9daebe8749 Reviewed-on: https://cl.tvl.fyi/c/depot/+/8786 Reviewed-by: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI
2023-06-15 r/6311 chore(3p/sources): Bump channels & overlayssterni1-1/+1
* //ops/modules/depot-inbox: Adapt to upstream option type declaration. See nixpkgs commit b6ed3b8f402893df91a8e21ce993520301c2f076. * //ops/machines/sanduny, //users/tazjin/polyanka: Remove boot.loader.grub.version options (no longer has any effect). * //users/sterni/emacs: reflect rename emacsPgtk -> emacs-pgtk * //3p/overlays: update tdlib to match emacs-overlay * //3p/overlays: give EXWM from depot a separate name * //users/grfn/system/home: disable Slack support in ntfy Change-Id: I03bde088bc70e05b23925f244899807210cb7b20 Reviewed-on: https://cl.tvl.fyi/c/depot/+/8547 Autosubmit: sterni <sternenseemann@systemli.org> Reviewed-by: sterni <sternenseemann@systemli.org> Reviewed-by: grfn <grfn@gws.fyi> Tested-by: BuildkiteCI Reviewed-by: tazjin <tazjin@tvl.su>
2023-04-28 r/6117 feat(ops/modules/open_eid): add support for Web eID extensionFlorian Klink1-20/+37
Most likely due to bad UX in browsers for hardware-backed TLS client cert auth, most websites have switched from client-side TLS to the "Web eID" extension. Once installed, the extension uses [Native Messaging] to talk to a `web-eid-app` application, which handles the communication with the smart card itself. This can be tested on https://web-eid.eu/ . The commit needs nixpkgs to be bumped past https://github.com/NixOS/nixpkgs/pull/227354 . [Native Messaging]: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Native_messaging Change-Id: Iffe6d81ecf7cee25406fa39a983ff52cf669c373 Reviewed-on: https://cl.tvl.fyi/c/depot/+/8490 Reviewed-by: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI
2023-04-19 r/6099 fix(ops/modules/open_eid): use libdigidocpp.binFlorian Klink1-1/+1
nixpkgs commit 134036f642a7f3ba9efeab509727c0989458b02b moved the digidoc-tool binary to the `bin` output, so this wasn't actually providing the digidoc-tool binary anymore. Change-Id: Id5f7cc69d55b7cc058a6361512cc74de0e7bc1b2 Reviewed-on: https://cl.tvl.fyi/c/depot/+/8487 Reviewed-by: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI Autosubmit: flokli <flokli@flokli.de>
2023-04-07 r/6072 chore(3p/sources): Bump channels & overlayssterni1-3/+3
* Satisfy new assert that the corresponding shell needs to be enabled via programs.* if it is as the login shell of at least one user. * //users/tazjin: “Address” removal of hardware.video.hidpi option. * //3p/gerrit: update fetch sha256 Change-Id: Id0988a0ea7f393d6b7848a7104fc3526ee1177f4 Reviewed-on: https://cl.tvl.fyi/c/depot/+/8407 Autosubmit: sterni <sternenseemann@systemli.org> Reviewed-by: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI
2023-03-31 r/6064 fix(views/kit): communicate :unsign in the tvl-kit URL directlyFlorian Klink1-1/+1
Instead of prepending :unsign to all URLs in josh-proxy, and for all calls to filteredGitPush, explicitly use it only in the filter we use for the `export-kit` extraStep. This means, people cloning tvl-kit via > https://code.tvl.fyi/depot.git:workspace=views/kit.git now need to update the URL to point to > https://code.tvl.fyi/depot.git:unsign:workspace=views/kit.git instead. git@github.com:tvlfyi/kit.git will keep the same hashes, as it's updated to export the unsigned workspace view of it. This is less invasive than dooming every josh workspace to have to strip signatures. Change-Id: I6de05182fad4c3695081388c3bbf37306521d255 Reviewed-on: https://cl.tvl.fyi/c/depot/+/8369 Autosubmit: flokli <flokli@flokli.de> Reviewed-by: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI
2023-03-29 r/6054 fix(ops/www): allow all indexing on cl.tvl.fyiVincent Ambo1-0/+4
I *want* search engines to index our CLs, they might be useful! Change-Id: I956d92c80d812e1aefefb6daeba77a1588055b94 Reviewed-on: https://cl.tvl.fyi/c/depot/+/8361 Tested-by: BuildkiteCI Autosubmit: tazjin <tazjin@tvl.su> Reviewed-by: flokli <flokli@flokli.de>
generated by cgit-pink 1.4.1 (git 2.44.2) at 2024-11-05T06·31+0000