From 95f7e039ac314506e152c69cdf70a5a73aab3a79 Mon Sep 17 00:00:00 2001 From: kalipso Date: Mon, 2 Nov 2026 20:27:59 +0100 Subject: [PATCH 01/12] [portal] init --- flake.nix | 5 ++++ machines/fanny/configuration.nix | 17 +++++++++++ machines/hosts.nix | 9 ++++-- machines/overwatch/configuration.nix | 6 ++++ machines/portal/configuration.nix | 43 ++++++++++++++++++++++++++++ 5 files changed, 78 insertions(+), 2 deletions(-) create mode 100644 machines/portal/configuration.nix diff --git a/flake.nix b/flake.nix index e46e9c1..7e2223f 100644 --- a/flake.nix +++ b/flake.nix @@ -32,6 +32,11 @@ inputs.nixpkgs.follows = "nixpkgs"; }; + portal = { + url = "git+https://git.dynamicdiscord.de/malobeo/portal"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + ep3-bs = { url = "git+https://git.dynamicdiscord.de/kalipso/ep3-bs.nix"; inputs.nixpkgs.follows = "nixpkgs"; diff --git a/machines/fanny/configuration.nix b/machines/fanny/configuration.nix index 317da99..2522887 100644 --- a/machines/fanny/configuration.nix +++ b/machines/fanny/configuration.nix @@ -149,6 +149,7 @@ in "antamap" "ns1" "wordpress" + "portal" ]; networking = { @@ -184,6 +185,22 @@ in }; }; + virtualHosts."portal.hq.malobeo.org" = { + forceSSL = true; + enableACME = true; + acmeRoot = null; + locations."/" = { + proxyPass = "http://${hosts.malobeo.hosts.portal.network.address}:8080"; + extraConfig = '' + proxy_set_header Host $host; + client_max_body_size ${inputs.self.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize}; + client_body_timeout 3600s; + send_timeout 3600s; + fastcgi_buffers 64 4K; + ''; + }; + }; + virtualHosts."cloud.hq.malobeo.org" = { forceSSL = true; enableACME = true; diff --git a/machines/hosts.nix b/machines/hosts.nix index 4d35b6c..adc3cad 100644 --- a/machines/hosts.nix +++ b/machines/hosts.nix @@ -146,10 +146,15 @@ in wordpress = { type = "microvm"; - network = createMaloNet "21" "52:DA:0D:F9:EF:F6"; + network = createMaloNet "21" "52:DA:0D:F9:EF:F7"; }; - # last host id: 21 + portal = { + type = "microvm"; + network = createMaloNet "22" "52:DA:0D:F9:EF:F8"; + }; + + # last host id: 22 }; }; } diff --git a/machines/overwatch/configuration.nix b/machines/overwatch/configuration.nix index 28befbd..a0050a5 100644 --- a/machines/overwatch/configuration.nix +++ b/machines/overwatch/configuration.nix @@ -270,6 +270,12 @@ in targets = [ "${hosts.malobeo.hosts.wordpress.network.address}:9002" ]; }]; } + { + job_name = "portal"; + static_configs = [{ + targets = [ "${hosts.malobeo.hosts.zineshop.network.address}:9002" ]; + }]; + } # add vpn - check how to reach it first. most probably 10.100.0.1 ]; }; diff --git a/machines/portal/configuration.nix b/machines/portal/configuration.nix new file mode 100644 index 0000000..304010d --- /dev/null +++ b/machines/portal/configuration.nix @@ -0,0 +1,43 @@ +{ self, config, lib, pkgs, inputs, ... }: + +with lib; + +{ + networking = { + hostName = mkDefault "portal"; + useDHCP = false; + }; + + imports = [ + inputs.malobeo.nixosModules.malobeo.metrics + inputs.malobeo.nixosModules.malobeo.printing + inputs.portal.nixosModules.portal + inputs.self.nixosModules.malobeo.users + ../modules/sshd.nix + ]; + + malobeo.metrics = { + enable = true; + enablePromtail = true; + logNginx = true; + }; + + malobeo.users = { + admin = true; + backup = true; + }; + + services.printing.enable = true; + services.malobeo.printing.enable = true; + + services.portal = { + enable = true; + #TODO: we should use FQDN like gatekeeper.hq.malobeo.org + gatekeeperHost = "${hosts.malobeo.hosts.goldman.network.address}"; + gatekeeperScheme = "http"; + }; + networking.firewall.allowedTCPPorts = [ 8080 ]; + + system.stateVersion = "22.11"; # Did you read the comment? +} + From 586dbc711a62dd8315d2cf8e436e8cc9da67e252 Mon Sep 17 00:00:00 2001 From: kalipso Date: Mon, 2 Nov 2026 20:36:46 +0100 Subject: [PATCH 02/12] [portal] update lock --- flake.lock | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 59 insertions(+), 4 deletions(-) diff --git a/flake.lock b/flake.lock index 2bf3b0e..67351b0 100644 --- a/flake.lock +++ b/flake.lock @@ -278,6 +278,27 @@ "type": "github" } }, + "portal": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ], + "utils": "utils_3" + }, + "locked": { + "lastModified": 1793647408, + "narHash": "sha256-ZalqgFM/8QAa9oNh1lPgYU5AEwJBoyu1NsFMsD+1GYo=", + "ref": "refs/heads/master", + "rev": "c7d697186796fcca2af5cd08b2d4714e1a9ddb3e", + "revCount": 14, + "type": "git", + "url": "https://git.dynamicdiscord.de/malobeo/portal" + }, + "original": { + "type": "git", + "url": "https://git.dynamicdiscord.de/malobeo/portal" + } + }, "pyproject-build-systems": { "inputs": { "nixpkgs": [ @@ -341,9 +362,10 @@ "nixos-hardware": "nixos-hardware", "nixpkgs": "nixpkgs_3", "nixpkgs-unstable": "nixpkgs-unstable", + "portal": "portal", "sops-nix": "sops-nix", "tasklist": "tasklist", - "utils": "utils_3", + "utils": "utils_4", "zineshop": "zineshop" } }, @@ -443,6 +465,21 @@ "type": "github" } }, + "systems_5": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, "tasklist": { "inputs": { "nixpkgs": [ @@ -503,6 +540,24 @@ "inputs": { "systems": "systems_3" }, + "locked": { + "lastModified": 1791914995, + "narHash": "sha256-Zf/xfQEAasnwnmEfHqW/4hjDE/s44yn2hD4RuVIZRjA=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "b7a79d3fea1e214f6d668d521cecec0c01e26544", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "utils_4": { + "inputs": { + "systems": "systems_4" + }, "locked": { "lastModified": 1731533236, "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", @@ -517,9 +572,9 @@ "type": "github" } }, - "utils_4": { + "utils_5": { "inputs": { - "systems": "systems_4" + "systems": "systems_5" }, "locked": { "lastModified": 1731533236, @@ -565,7 +620,7 @@ "nixpkgs": [ "nixpkgs" ], - "utils": "utils_4" + "utils": "utils_5" }, "locked": { "lastModified": 1792488750, From dd776cfede2541c6dfc059ab927e004386d11dd2 Mon Sep 17 00:00:00 2001 From: kalipso Date: Tue, 3 Nov 2026 12:51:54 +0100 Subject: [PATCH 03/12] [portal] update --- flake.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/flake.lock b/flake.lock index 67351b0..98f238a 100644 --- a/flake.lock +++ b/flake.lock @@ -286,11 +286,11 @@ "utils": "utils_3" }, "locked": { - "lastModified": 1793647408, - "narHash": "sha256-ZalqgFM/8QAa9oNh1lPgYU5AEwJBoyu1NsFMsD+1GYo=", + "lastModified": 1793706628, + "narHash": "sha256-wQowUhshtUjCSaA298Ul9WIZlwNfVuhSfNt1++qakNo=", "ref": "refs/heads/master", - "rev": "c7d697186796fcca2af5cd08b2d4714e1a9ddb3e", - "revCount": 14, + "rev": "bfe091000eec1cad3a024f0f53fce5003ef37df5", + "revCount": 15, "type": "git", "url": "https://git.dynamicdiscord.de/malobeo/portal" }, From d273204b7dd05e17ddb0db5c76378ca15ab61d90 Mon Sep 17 00:00:00 2001 From: kalipso Date: Tue, 3 Nov 2026 12:55:19 +0100 Subject: [PATCH 04/12] [portal] import missing hosts --- machines/portal/configuration.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/machines/portal/configuration.nix b/machines/portal/configuration.nix index 304010d..3e57480 100644 --- a/machines/portal/configuration.nix +++ b/machines/portal/configuration.nix @@ -2,6 +2,9 @@ with lib; +let + hosts = import ../hosts.nix {}; +in { networking = { hostName = mkDefault "portal"; From c4b38ecc7a0a41bf6dd59baa49ee5c7aef11e793 Mon Sep 17 00:00:00 2001 From: kalipso Date: Tue, 3 Nov 2026 17:53:14 +0100 Subject: [PATCH 05/12] [portal] update --- flake.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/flake.lock b/flake.lock index 98f238a..fdbd820 100644 --- a/flake.lock +++ b/flake.lock @@ -286,11 +286,11 @@ "utils": "utils_3" }, "locked": { - "lastModified": 1793706628, - "narHash": "sha256-wQowUhshtUjCSaA298Ul9WIZlwNfVuhSfNt1++qakNo=", + "lastModified": 1793724757, + "narHash": "sha256-5Ew5wM4swz3WUOa7bp7Y+OBlxhRrcd6PiTZx0nJfbNE=", "ref": "refs/heads/master", - "rev": "bfe091000eec1cad3a024f0f53fce5003ef37df5", - "revCount": 15, + "rev": "9f59e9d3f791b5b45bc3cd42d70b0e81b0bad105", + "revCount": 17, "type": "git", "url": "https://git.dynamicdiscord.de/malobeo/portal" }, From 5be3d3ba62347166292aa09b69bcf6dc15f21637 Mon Sep 17 00:00:00 2001 From: kalipso Date: Tue, 3 Nov 2026 17:53:22 +0100 Subject: [PATCH 06/12] [goldman] open port 8000 --- machines/goldman/configuration.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/machines/goldman/configuration.nix b/machines/goldman/configuration.nix index 3074159..139bd98 100644 --- a/machines/goldman/configuration.nix +++ b/machines/goldman/configuration.nix @@ -95,7 +95,7 @@ in }; }; - networking.firewall.allowedTCPPorts = [ 80 443 1883]; + networking.firewall.allowedTCPPorts = [ 80 443 1883 8000 ]; system.stateVersion = "23.05"; } From 7c395a72e0056219a4c58a3bc16e1ebf148e3544 Mon Sep 17 00:00:00 2001 From: kalipso Date: Tue, 3 Nov 2026 17:53:31 +0100 Subject: [PATCH 07/12] [portal] use gatekeeper api port 8000 --- machines/portal/configuration.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/machines/portal/configuration.nix b/machines/portal/configuration.nix index 3e57480..c5bdee9 100644 --- a/machines/portal/configuration.nix +++ b/machines/portal/configuration.nix @@ -36,7 +36,7 @@ in services.portal = { enable = true; #TODO: we should use FQDN like gatekeeper.hq.malobeo.org - gatekeeperHost = "${hosts.malobeo.hosts.goldman.network.address}"; + gatekeeperHost = "${hosts.malobeo.hosts.goldman.network.address}:8000"; gatekeeperScheme = "http"; }; networking.firewall.allowedTCPPorts = [ 8080 ]; From b5d0ef7099ef052c09c6438a8237686d5fd44bd7 Mon Sep 17 00:00:00 2001 From: kalipso Date: Tue, 3 Nov 2026 18:27:12 +0100 Subject: [PATCH 08/12] [portal] update --- flake.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/flake.lock b/flake.lock index fdbd820..c5999a0 100644 --- a/flake.lock +++ b/flake.lock @@ -286,11 +286,11 @@ "utils": "utils_3" }, "locked": { - "lastModified": 1793724757, - "narHash": "sha256-5Ew5wM4swz3WUOa7bp7Y+OBlxhRrcd6PiTZx0nJfbNE=", + "lastModified": 1793726785, + "narHash": "sha256-WYPbkqvsmVc7T8CorqV7eeylCTJqDXSDiIiT7n8oE4c=", "ref": "refs/heads/master", - "rev": "9f59e9d3f791b5b45bc3cd42d70b0e81b0bad105", - "revCount": 17, + "rev": "21a11c2f859632038d8cae8e9f7878c3a424f5ba", + "revCount": 19, "type": "git", "url": "https://git.dynamicdiscord.de/malobeo/portal" }, From 6917bc359bceef45194712018061fa17fd04f29b Mon Sep 17 00:00:00 2001 From: kalipso Date: Tue, 3 Nov 2026 18:38:59 +0100 Subject: [PATCH 09/12] [portal] update --- flake.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/flake.lock b/flake.lock index c5999a0..b3c73e6 100644 --- a/flake.lock +++ b/flake.lock @@ -286,11 +286,11 @@ "utils": "utils_3" }, "locked": { - "lastModified": 1793726785, - "narHash": "sha256-WYPbkqvsmVc7T8CorqV7eeylCTJqDXSDiIiT7n8oE4c=", + "lastModified": 1793727485, + "narHash": "sha256-zpTS/6sgapW7cZqPNqQ4wMHoxXsKZZPby+RpPxZVxAo=", "ref": "refs/heads/master", - "rev": "21a11c2f859632038d8cae8e9f7878c3a424f5ba", - "revCount": 19, + "rev": "3cc90f3a470e95e3c79edaa1539173ae6d76874c", + "revCount": 20, "type": "git", "url": "https://git.dynamicdiscord.de/malobeo/portal" }, From 3e6c40f0dc8431a8030d40b9bdf4873f1d45170c Mon Sep 17 00:00:00 2001 From: kalipso Date: Fri, 6 Nov 2026 11:53:40 +0100 Subject: [PATCH 10/12] [portal] update --- flake.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/flake.lock b/flake.lock index b3c73e6..1de6743 100644 --- a/flake.lock +++ b/flake.lock @@ -286,11 +286,11 @@ "utils": "utils_3" }, "locked": { - "lastModified": 1793727485, - "narHash": "sha256-zpTS/6sgapW7cZqPNqQ4wMHoxXsKZZPby+RpPxZVxAo=", + "lastModified": 1793962157, + "narHash": "sha256-syLIoDUWY5g2ubyNZNqgR+R6R5wLgSD8/XWnIazjhYc=", "ref": "refs/heads/master", - "rev": "3cc90f3a470e95e3c79edaa1539173ae6d76874c", - "revCount": 20, + "rev": "5a5b043354b88f024b53fce39b60a563fd895063", + "revCount": 33, "type": "git", "url": "https://git.dynamicdiscord.de/malobeo/portal" }, From 2f964aeeae28d37727a62b1eb5c91eb807046361 Mon Sep 17 00:00:00 2001 From: kalipso Date: Fri, 6 Nov 2026 12:07:56 +0100 Subject: [PATCH 11/12] [portal] disable backup user --- machines/portal/configuration.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/machines/portal/configuration.nix b/machines/portal/configuration.nix index c5bdee9..8a9a5ab 100644 --- a/machines/portal/configuration.nix +++ b/machines/portal/configuration.nix @@ -27,7 +27,6 @@ in malobeo.users = { admin = true; - backup = true; }; services.printing.enable = true; From 66328a5fbf3f302f9fd62e034d4d798b77735159 Mon Sep 17 00:00:00 2001 From: kalipso Date: Fri, 6 Nov 2026 12:08:09 +0100 Subject: [PATCH 12/12] [portal] disable printing --- machines/portal/configuration.nix | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/machines/portal/configuration.nix b/machines/portal/configuration.nix index 8a9a5ab..93c0710 100644 --- a/machines/portal/configuration.nix +++ b/machines/portal/configuration.nix @@ -13,7 +13,6 @@ in imports = [ inputs.malobeo.nixosModules.malobeo.metrics - inputs.malobeo.nixosModules.malobeo.printing inputs.portal.nixosModules.portal inputs.self.nixosModules.malobeo.users ../modules/sshd.nix @@ -29,15 +28,13 @@ in admin = true; }; - services.printing.enable = true; - services.malobeo.printing.enable = true; - services.portal = { enable = true; #TODO: we should use FQDN like gatekeeper.hq.malobeo.org gatekeeperHost = "${hosts.malobeo.hosts.goldman.network.address}:8000"; gatekeeperScheme = "http"; }; + networking.firewall.allowedTCPPorts = [ 8080 ]; system.stateVersion = "22.11"; # Did you read the comment?