From 1d64dfbaa0da531753ea92d704bb5f824af3db7a Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Thu, 26 Mar 2026 10:01:46 +0100 Subject: [PATCH 1/6] checkout flake lock before update --- flake.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/flake.nix b/flake.nix index e0f51cd..1a38a1f 100644 --- a/flake.nix +++ b/flake.nix @@ -26,6 +26,7 @@ apps.nixos-diff = { type = "app"; program = "${pkgs.writeShellScript "nixos-diff.sh" '' + ${pkgs.git}/bin/git checkout flake.lock ${pkgs.git}/bin/git pull --ff-only ${pkgs.nix}/bin/nix flake update ${pkgs.nixos-rebuild}/bin/nixos-rebuild build --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json From 049fcb73c9d283391b28a2dfe7a4f3e17e274d13 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Sun, 12 Apr 2026 19:58:17 +0200 Subject: [PATCH 2/6] update token --- secrets/draupnir_access_token.age | Bin 911 -> 911 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/secrets/draupnir_access_token.age b/secrets/draupnir_access_token.age index 946dbbfe8a9189800b813b29521586a2e96120d3..5cefd51c7b4b00e7273acf19dfbe6564376f0ebf 100644 GIT binary patch delta 823 zcmeBY?`NN&Q*YrL8X94cU6k+Q?Vp~P6yf5Ym1g3V?wXz#rtg*$80no?l~I(Rof;gL z%oV2XQ{wCq;2LUd(iSy_}Gm6%zYQQ@2wl2?#gRFUtIAL3o)9aNDW$)#(jP+Xj$ zo0?)|YHDby;9BOB6ke|2?o#1W>5~&xSmfyE=p5{kXnsH3HOPI+-&pkGQsQdxnag^P=Gj%B)wyJ1ptMt)U!M55>9ct-K?sLY~(q)Jbt z{IneR0Mn4Lpu!yeprqu$$|RSNyg=ie#ME+EXQ!eJ^Pplb!;%VfLoL$gcV zjdFq#-9w9#1F{N>LrMbCW5CV5z|=5ZAuK@O-P@?7)VV4=qoBmEu(ZC!I4H%hz&|%N zwanW&%D5oNq};@{#4yCklglJCBhSe@sxY(MJS(HjsUSDhtT?R9z#=a-(6ubz)F`st zA|N>+#oH^R7~Q(ceCOOmM}^9Czw&%TZL@Uu9QU%qvfxrL|0rLNlzhX~pbWF{G*?s4 zdM8KU0*iwDJWsClGDjDm0@FbEB+KlKVl(GFeWUUSQ~h-RM6+a5kCe=eB7=}nN6X>@ z%XBVXU0nsANXO88<4UvQDDRALV;}Eiufm`#KO^5#r=Wl&uL>u(;S)n0(!@1s^wi}&KFfJ+{_}9zHH@^vfj(zgp!wi bnaFmro6VDPah2#h8$E_)<}Vo%827y8P delta 823 zcmeBY?`NN&Q|}TKo*bB4x8|+w=mr|H%ZeZx^5$tLdVd7lrUli$Un&Vv= z$yHR9oRn4KoL}l*?w(fW=;oSI7!pw&UgQ(tmlR%}&82InP+Xj$ zo0?)|YHDby;9BOB6ke`SQDSbAlWXZ*YLuL5?j4qz?v|4pnChGo7VJ@wZJKOg8WH5} zS?-^hV_=-mm6Vj@k!6x)Z02L)Q5q0c=IRk@TvlZ0Y8j+&;AG-tke8mDY2jOJ9-84h z@uPTnX>hhtUSy`bQMP4jgIUcR|Sex6TNiD71hi+({!YE?d0o`s&8XBoxob8-R-lAJAEjmzEK-4k82{Y~=H z+*9*BoXmX-OtO;A!YTtTQ;RYjGhIEo3bp za>~m?5`!~>9lerVOmdUaW5CV5z|=5Z!PBkK*wVAaz&z2=Il{v)Ah@6q8h=yoe~zaBnl;FmtmcGeh5uq{5)gpcKpUvU^a)vgj$T^E$At{oCBv!F8VN+&<-M6|1HFKhAKI bXWK)yY1UH(wtR|{3sN|CoAH5b<=-6uMPnFC From 9a1eed241f1464e978df744cad471a28c4a04f67 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Thu, 7 May 2026 13:29:33 +0200 Subject: [PATCH 3/6] add mta-sts --- hosts/www/nginx.nix | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/hosts/www/nginx.nix b/hosts/www/nginx.nix index cca313e..851da80 100644 --- a/hosts/www/nginx.nix +++ b/hosts/www/nginx.nix @@ -10,6 +10,21 @@ in ]; services.nginx.virtualHosts = { + "mta-sts.${config.networking.domain}" = { + quic = true; + kTLS = true; + forceSSL = true; + enableACME = true; + extraConfig = '' + add_header Strict-Transport-Security max-age=15768000; + ''; + locations."= /.well-known/mta-sts.txt" = { + alias = "/srv/http/mta-sts.txt"; + extraConfig = '' + default_type text/plain; + ''; + }; + }; "www.${config.networking.domain}" = { default = true; serverAliases = [ config.networking.domain ]; From cfb533aebcf5b7cb29615d0a491d5dedadedb8d6 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Mon, 18 May 2026 16:11:45 +0200 Subject: [PATCH 4/6] change mod room --- hosts/matrix/draupnir.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hosts/matrix/draupnir.nix b/hosts/matrix/draupnir.nix index e0c70d8..84cae04 100644 --- a/hosts/matrix/draupnir.nix +++ b/hosts/matrix/draupnir.nix @@ -5,7 +5,8 @@ enable = true; settings = { homeserverUrl = "https://matrix.${config.networking.domain}"; - managementRoom = "!ZYWNuaQBkkenNklCSm:matrix.org"; # #cccb-moderators:berlin.ccc.de + #managementRoom = "!ZYWNuaQBkkenNklCSm:matrix.org"; # #cccb-moderators:berlin.ccc.de + managementRoom = "#cccb-moderators:berlin.ccc.de"; #"!ZYWNuaQBkkenNklCSm:matrix.org"; autojoinOnlyIfManager = true; recordIgnoredInvites = true; roomStateBackingStore.enabled = true; From ef3045a739f96568695d79341bcb18db8f2c937d Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Mon, 1 Jun 2026 15:25:01 +0200 Subject: [PATCH 5/6] update to nixos 26.05 --- flake.lock | 8 ++++---- flake.nix | 4 ++-- hosts/common.nix | 12 ++++++------ hosts/matrix/default.nix | 21 ++++++++++----------- hosts/md/default.nix | 21 ++++++++++----------- hosts/monitoring/default.nix | 25 ++++++++++++------------- hosts/sql/default.nix | 25 ++++++++++++------------- hosts/www/default.nix | 17 ++++++++--------- 8 files changed, 64 insertions(+), 69 deletions(-) diff --git a/flake.lock b/flake.lock index 88c8b0f..f0bd2b3 100644 --- a/flake.lock +++ b/flake.lock @@ -68,16 +68,16 @@ }, "nixpkgs": { "locked": { - "lastModified": 1772598333, - "narHash": "sha256-YaHht/C35INEX3DeJQNWjNaTcPjYmBwwjFJ2jdtr+5U=", + "lastModified": 1780203844, + "narHash": "sha256-K5sT4jTpGs15ADhviMKNBH38REpPf5Q6mM1+N6cArVE=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "fabb8c9deee281e50b1065002c9828f2cf7b2239", + "rev": "b51242d7d43689db2f3be91bd05d5b24fbb469c4", "type": "github" }, "original": { "owner": "NixOS", - "ref": "nixos-25.11", + "ref": "nixos-26.05", "repo": "nixpkgs", "type": "github" } diff --git a/flake.nix b/flake.nix index 1a38a1f..f805528 100644 --- a/flake.nix +++ b/flake.nix @@ -1,7 +1,7 @@ { description = "CCCB services"; inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11"; + nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05"; #flake-utils.url = "github:numtide/flake-utils"; agenix = { url = "github:ryantm/agenix"; @@ -40,7 +40,7 @@ ]; }; nixosConfigurations."matrix" = nixpkgs.lib.nixosSystem { - #system = "x86_64-linux"; + #system = "x86_64-linux";d #pkgs = import nixpkgs { inherit system; }; inherit system; modules = [ diff --git a/hosts/common.nix b/hosts/common.nix index 53d1e86..248fccb 100644 --- a/hosts/common.nix +++ b/hosts/common.nix @@ -88,12 +88,12 @@ # Cache DNS lookups to improve performance resolved = { enable = true; - dnssec = "allow-downgrade"; - dnsovertls = "true"; - extraConfig = '' - Cache=true - CacheFromLocalhost=true - ''; + settings.Resolve = { + DNSSEC = "allow-downgrade"; + DNSOverTLS = true; + Cache = true; + CacheFromLocalhost = true; + }; }; }; diff --git a/hosts/matrix/default.nix b/hosts/matrix/default.nix index 7fc2fac..e4de744 100644 --- a/hosts/matrix/default.nix +++ b/hosts/matrix/default.nix @@ -23,17 +23,16 @@ }; }; - services = { - openssh.banner = '' - __ __ - /\ \__ __ /\ \ - ___ ___ __ \ \ ,_\ _ __ /\_\ __ _ ___ ___ ___\ \ \____ - /' __` __`\ /'__`\ \ \ \/ /\`'__\/\ \ /\ \/'\ /'___\ /'___\ /'___\ \ '__`\ - /\ \/\ \/\ \/\ \L\.\_\ \ \_\ \ \/ \ \ \\/> Date: Mon, 1 Jun 2026 15:27:31 +0200 Subject: [PATCH 6/6] fix ssh banner --- hosts/matrix/default.nix | 2 +- hosts/md/default.nix | 2 +- hosts/monitoring/default.nix | 2 +- hosts/sql/default.nix | 2 +- hosts/www/default.nix | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/hosts/matrix/default.nix b/hosts/matrix/default.nix index e4de744..a44a30d 100644 --- a/hosts/matrix/default.nix +++ b/hosts/matrix/default.nix @@ -23,7 +23,7 @@ }; }; - environment.etc."ssh/banner" = '' + environment.etc."ssh/banner".text = '' __ __ /\ \__ __ /\ \ ___ ___ __ \ \ ,_\ _ __ /\_\ __ _ ___ ___ ___\ \ \____ diff --git a/hosts/md/default.nix b/hosts/md/default.nix index 0d659cb..3519921 100644 --- a/hosts/md/default.nix +++ b/hosts/md/default.nix @@ -21,7 +21,7 @@ }; }; - environment.etc."ssh/banner" = '' + environment.etc."ssh/banner".text = '' __ /\ \ ___ ___ \_\ \ diff --git a/hosts/monitoring/default.nix b/hosts/monitoring/default.nix index 161b122..d98b765 100644 --- a/hosts/monitoring/default.nix +++ b/hosts/monitoring/default.nix @@ -22,7 +22,7 @@ }; }; - environment.etc."ssh/banner" = '' + environment.etc."ssh/banner".text = '' __ __/\ \__ __ ___ ___ ___ ___ /\_\ \ ,_\ ___ _ __ /\_\ ___ __ diff --git a/hosts/sql/default.nix b/hosts/sql/default.nix index 623b418..93e3af2 100644 --- a/hosts/sql/default.nix +++ b/hosts/sql/default.nix @@ -17,7 +17,7 @@ ''; }; - environment.etc."ssh/banner" = '' + environment.etc."ssh/banner".text = '' ___ /\_ \ ____ __ \//\ \ diff --git a/hosts/www/default.nix b/hosts/www/default.nix index 47326ec..2b89987 100644 --- a/hosts/www/default.nix +++ b/hosts/www/default.nix @@ -22,7 +22,7 @@ }; }; - environment.etc."ssh/banner" = '' + environment.etc."ssh/banner".text = '' __ __ __ __ __ __ __ __ __ /\ \/\ \/\ \/\ \/\ \/\ \/\ \/\ \/\ \ \ \ \_/ \_/ \ \ \_/ \_/ \ \ \_/ \_/ \