Compare commits
2 commits
ec01fe5eea
...
952d6dfc06
| Author | SHA1 | Date | |
|---|---|---|---|
 Benjamin Yule Bädorf
|
952d6dfc06
|
||
|
Benjamin Yule Bädorf
|
087ff3810b
|
14
docs/automated-account-deletion.md
Normal file
14
docs/automated-account-deletion.md
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
# Automated account deletion
|
||||
|
||||
Per GDPR legislation, accounts should be automatically deleted after a period of inactivity. We discern between two different types of accounts:
|
||||
|
||||
1. Without verified email: should be deleted after 30 days without being activated
|
||||
2. With verified email: should be deleted after 2 years of inactivity
|
||||
|
||||
Some services hold on to a session for a very long time. We'll have to query their APIs to see if the account is still in use:
|
||||
|
||||
* Matrix via the admin api: https://matrix-org.github.io/synapse/v1.48/admin_api/user_admin_api.html#query-current-sessions-for-a-user
|
||||
* Mastodon via the admin api: https://docs.joinmastodon.org/methods/admin/accounts/#200-ok
|
||||
* Nextcloud only gives the last login, not the last active time like a sync via `nextcloud-occ user:lastseen`
|
||||
* Keycloak
|
||||
* We can ignore Forgejo, since the sessions there are valid for a maximum of one year, regardless of how they got created
|
||||
150
flake.lock
150
flake.lock
|
|
@ -52,6 +52,25 @@
|
|||
"devshell": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils",
|
||||
"nixpkgs": "nixpkgs"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1713532798,
|
||||
"narHash": "sha256-wtBhsdMJA3Wa32Wtm1eeo84GejtI43pMrFrmwLXrsEc=",
|
||||
"owner": "numtide",
|
||||
"repo": "devshell",
|
||||
"rev": "12e914740a25ea1891ec619bb53cf5e6ca922e40",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "devshell",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"devshell_2": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils_2",
|
||||
"nixpkgs": [
|
||||
"keycloak-theme-pub-solar",
|
||||
"nixpkgs"
|
||||
|
|
@ -122,6 +141,24 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-parts_2": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": "nixpkgs-lib_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1712014858,
|
||||
"narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "9126214d0a59633752a136528f5f3b9aa8565b7d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"inputs": {
|
||||
"systems": "systems_3"
|
||||
|
|
@ -144,6 +181,24 @@
|
|||
"inputs": {
|
||||
"systems": "systems_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1701680307,
|
||||
"narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_3": {
|
||||
"inputs": {
|
||||
"systems": "systems_5"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1705309234,
|
||||
"narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
|
||||
|
|
@ -158,7 +213,7 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_3": {
|
||||
"flake-utils_4": {
|
||||
"locked": {
|
||||
"lastModified": 1653893745,
|
||||
"narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
|
||||
|
|
@ -194,10 +249,33 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"keycloak-theme-pub-solar": {
|
||||
"keycloak-event-listener": {
|
||||
"inputs": {
|
||||
"devshell": "devshell",
|
||||
"flake-utils": "flake-utils_2",
|
||||
"flake-parts": "flake-parts_2",
|
||||
"nixpkgs": [
|
||||
"unstable"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1714263025,
|
||||
"narHash": "sha256-Uesrz49RwbG7sHgiHkkb5o364BN9WbuwroWxVXdcfvo=",
|
||||
"ref": "main",
|
||||
"rev": "fb569f474698b5711c208fd5b4b5880d64863587",
|
||||
"revCount": 2,
|
||||
"type": "git",
|
||||
"url": "https://git.pub.solar/pub-solar/keycloak-event-listener"
|
||||
},
|
||||
"original": {
|
||||
"ref": "main",
|
||||
"type": "git",
|
||||
"url": "https://git.pub.solar/pub-solar/keycloak-event-listener"
|
||||
}
|
||||
},
|
||||
"keycloak-theme-pub-solar": {
|
||||
"inputs": {
|
||||
"devshell": "devshell_2",
|
||||
"flake-utils": "flake-utils_3",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
|
|
@ -255,16 +333,16 @@
|
|||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1713995372,
|
||||
"narHash": "sha256-fFE3M0vCoiSwCX02z8VF58jXFRj9enYUSTqjyHAjrds=",
|
||||
"owner": "nixos",
|
||||
"lastModified": 1704161960,
|
||||
"narHash": "sha256-QGua89Pmq+FBAro8NriTuoO/wNaUtugt29/qqA8zeeM=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "dd37924974b9202f8226ed5d74a252a9785aedf8",
|
||||
"rev": "63143ac2c9186be6d9da6035fa22620018c85932",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-23.11",
|
||||
"owner": "NixOS",
|
||||
"ref": "nixpkgs-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
|
|
@ -303,6 +381,40 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-lib_2": {
|
||||
"locked": {
|
||||
"dir": "lib",
|
||||
"lastModified": 1711703276,
|
||||
"narHash": "sha256-iMUFArF0WCatKK6RzfUJknjem0H9m4KgorO/p3Dopkk=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "d8fe5e6c92d0d190646fb9f1056741a229980089",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"dir": "lib",
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1713995372,
|
||||
"narHash": "sha256-fFE3M0vCoiSwCX02z8VF58jXFRj9enYUSTqjyHAjrds=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "dd37924974b9202f8226ed5d74a252a9785aedf8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-23.11",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"agenix": "agenix",
|
||||
|
|
@ -310,10 +422,11 @@
|
|||
"element-themes": "element-themes",
|
||||
"flake-parts": "flake-parts",
|
||||
"home-manager": "home-manager",
|
||||
"keycloak-event-listener": "keycloak-event-listener",
|
||||
"keycloak-theme-pub-solar": "keycloak-theme-pub-solar",
|
||||
"nix-darwin": "nix-darwin",
|
||||
"nixos-flake": "nixos-flake",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"nixpkgs-2205": "nixpkgs-2205",
|
||||
"triton-vmtools": "triton-vmtools",
|
||||
"unstable": "unstable"
|
||||
|
|
@ -379,9 +492,24 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_5": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"triton-vmtools": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils_3",
|
||||
"flake-utils": "flake-utils_4",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
|
|
|
|||
11
flake.nix
11
flake.nix
|
|
@ -26,6 +26,9 @@
|
|||
keycloak-theme-pub-solar.url = "git+https://git.pub.solar/pub-solar/keycloak-theme?ref=main";
|
||||
keycloak-theme-pub-solar.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
keycloak-event-listener.url = "git+https://git.pub.solar/pub-solar/keycloak-event-listener?ref=main";
|
||||
keycloak-event-listener.inputs.nixpkgs.follows = "unstable";
|
||||
|
||||
triton-vmtools.url = "git+https://git.pub.solar/pub-solar/infra-vintage?ref=main&dir=vmtools";
|
||||
triton-vmtools.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
|
|
@ -46,7 +49,7 @@
|
|||
./hosts
|
||||
];
|
||||
|
||||
perSystem = { system, pkgs, config, ... }: {
|
||||
perSystem = args@{ system, pkgs, config, lib, ... }: {
|
||||
_module.args = {
|
||||
inherit inputs;
|
||||
pkgs = import inputs.nixpkgs {
|
||||
|
|
@ -58,6 +61,9 @@
|
|||
unstable = import inputs.unstable { inherit system; };
|
||||
master = import inputs.master { inherit system; };
|
||||
};
|
||||
|
||||
packages = import ./tests ({ inherit inputs self; } // args);
|
||||
|
||||
devShells.default = pkgs.mkShell {
|
||||
buildInputs = with pkgs; [
|
||||
deploy-rs
|
||||
|
|
@ -78,8 +84,7 @@
|
|||
};
|
||||
};
|
||||
|
||||
flake =
|
||||
let
|
||||
flake = let
|
||||
username = "barkeeper";
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -14,6 +14,17 @@
|
|||
];
|
||||
};
|
||||
|
||||
nachtigall-test = {
|
||||
imports = [
|
||||
self.inputs.agenix.nixosModules.default
|
||||
self.nixosModules.home-manager
|
||||
./nachtigall/test-vm.nix
|
||||
self.nixosModules.overlays
|
||||
self.nixosModules.core
|
||||
self.nixosModules.docker
|
||||
];
|
||||
};
|
||||
|
||||
flora-6 = self.nixos-flake.lib.mkLinuxSystem {
|
||||
imports = [
|
||||
self.inputs.agenix.nixosModules.default
|
||||
|
|
|
|||
|
|
@ -30,7 +30,6 @@
|
|||
};
|
||||
};
|
||||
|
||||
# keycloak
|
||||
services.keycloak = {
|
||||
enable = true;
|
||||
database.passwordFile = config.age.secrets.keycloak-database-password.path;
|
||||
|
|
@ -44,6 +43,9 @@
|
|||
themes = {
|
||||
"pub.solar" = flake.inputs.keycloak-theme-pub-solar.legacyPackages.${pkgs.system}.keycloak-theme-pub-solar;
|
||||
};
|
||||
plugins = [
|
||||
flake.inputs.keycloak-event-listener.packages.${pkgs.system}.keycloak-event-listener
|
||||
];
|
||||
};
|
||||
|
||||
services.restic.backups.keycloak-droppie = {
|
||||
|
|
|
|||
54
hosts/nachtigall/test-vm.nix
Normal file
54
hosts/nachtigall/test-vm.nix
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
{ flake, lib, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
./backups.nix
|
||||
./apps/nginx.nix
|
||||
|
||||
./apps/collabora.nix
|
||||
./apps/coturn.nix
|
||||
./apps/forgejo.nix
|
||||
./apps/keycloak.nix
|
||||
./apps/mailman.nix
|
||||
./apps/mastodon.nix
|
||||
./apps/mediawiki.nix
|
||||
./apps/nextcloud.nix
|
||||
./apps/nginx-mastodon.nix
|
||||
./apps/nginx-mastodon-files.nix
|
||||
./apps/nginx-prometheus-exporters.nix
|
||||
./apps/nginx-website.nix
|
||||
./apps/nginx-website-miom.nix
|
||||
./apps/opensearch.nix
|
||||
./apps/owncast.nix
|
||||
./apps/postgresql.nix
|
||||
./apps/prometheus-exporters.nix
|
||||
./apps/promtail.nix
|
||||
./apps/searx.nix
|
||||
./apps/tmate.nix
|
||||
|
||||
./apps/matrix/irc.nix
|
||||
./apps/matrix/mautrix-telegram.nix
|
||||
./apps/matrix/synapse.nix
|
||||
./apps/nginx-matrix.nix
|
||||
];
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
|
||||
security.acme.defaults.server = "https://acme-staging-v02.api.letsencrypt.org/directory";
|
||||
security.acme.preliminarySelfsigned = true;
|
||||
|
||||
networking.useDHCP = true;
|
||||
networking.interfaces."enp35s0".ipv4.addresses = [
|
||||
{
|
||||
address = "10.0.0.1";
|
||||
prefixLength = 26;
|
||||
}
|
||||
];
|
||||
networking.interfaces."enp35s0".ipv6.addresses = [
|
||||
{
|
||||
address = "2a01:4f8:172:1c25::1";
|
||||
prefixLength = 64;
|
||||
}
|
||||
];
|
||||
}
|
||||
|
|
@ -1,8 +1,7 @@
|
|||
{ self, lib, inputs, ... }: {
|
||||
# Configuration common to all Linux systems
|
||||
flake = {
|
||||
lib =
|
||||
let
|
||||
lib = let
|
||||
callLibs = file: import file { inherit lib; };
|
||||
in
|
||||
rec {
|
||||
|
|
|
|||
5
modules/test-vm.nix
Normal file
5
modules/test-vm.nix
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
{ ... }:
|
||||
{
|
||||
security.acme.defaults.server = "https://acme-staging-v02.api.letsencrypt.org/directory";
|
||||
security.acme.preliminarySelfsigned = true;
|
||||
}
|
||||
19
tests/default.nix
Normal file
19
tests/default.nix
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
args@{
|
||||
self,
|
||||
lib,
|
||||
system,
|
||||
pkgs,
|
||||
inputs,
|
||||
...
|
||||
}: let
|
||||
nixos-lib = import (inputs.nixpkgs + "/nixos/lib") { };
|
||||
|
||||
loadTestFiles = with lib; dir: mapAttrs' (name: _: let
|
||||
test = ((import (dir + "/${name}")) args);
|
||||
in {
|
||||
name = "test-" + (lib.strings.removeSuffix ".nix" name);
|
||||
value = nixos-lib.runTest test;
|
||||
})
|
||||
(filterAttrs (name: _: (hasSuffix ".nix" name) && name != "default.nix")
|
||||
(builtins.readDir dir));
|
||||
in loadTestFiles ./.
|
||||
22
tests/website.nix
Normal file
22
tests/website.nix
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
{
|
||||
self,
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: {
|
||||
name = "website";
|
||||
|
||||
nodes.nachtigall-test = self.nixosConfigurations.nachtigall-test;
|
||||
|
||||
node.specialArgs = self.outputs.nixosConfigurations.nachtigall._module.specialArgs;
|
||||
hostPkgs = pkgs;
|
||||
|
||||
enableOCR = true;
|
||||
|
||||
testScript = ''
|
||||
machine.wait_for_unit("system.slice")
|
||||
machine.succeed("ping 127.0.0.1 -c 2")
|
||||
machine.succeed("ping iregendeinscheiss.de -c 2")
|
||||
'';
|
||||
}
|
||||
Loading…
Reference in a new issue