Merge branch 'main' of ssh://git.berlin.ccc.de/xengi/infra

flake.nix

@@ -192,11 +192,37 @@
                 group = "postgres";
                 mode = "0400";
               };
+              postgres-baikal = {
+                file = ./secrets/postgres-baikal.age;
+                owner = "postgres";
+                group = "postgres";
+                mode = "0400";
+              };
             };
           }
           ./hosts/sql
         ];
       };
+      nixosConfigurations."dav" = nixpkgs.lib.nixosSystem {
+        #system = "x86_64-linux";
+        #pkgs = import nixpkgs { inherit system; };
+        inherit system;
+        modules = [
+          agenix.nixosModules.default
+          { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
+          {
+            age.secrets = {
+              radicale-htpasswd = {
+                file = ./secrets/radicale_htpasswd.age;
+                owner = "radicale";
+                group = "radicale";
+                mode = "0400";
+              };
+            };
+          }
+          ./hosts/dav
+        ];
+      };
     };
   #);
 }

hosts/dav/baikal.nix

@@ -0,0 +1,24 @@
+{ config, ... }:
+
+{
+  imports = [
+    ../../services/nginx.nix
+  ];
+
+  services = {
+    baikal = {
+      enable = true;
+      virtualHost = "dav.${config.networking.domain}";
+    };
+
+    nginx.virtualHosts."dav.${config.networking.domain}" = {
+      default = true;
+      quic = true;
+      kTLS = true;
+      forceSSL = true;
+      enableACME = true;
+      locations."/all.ics".root = "/srv/www/calendar";
+    };
+  };
+}
+

hosts/dav/default.nix

@@ -0,0 +1,37 @@
+{ ... }:
+
+{
+  imports = [
+    ../common.nix
+    ../../services/openssh.nix
+    ../../services/prometheus-node.nix
+    #./radicale.nix
+    ./baikal.nix
+  ];
+
+  networking = {
+    hostName = "dav";
+    firewall = {
+      allowedTCPPorts = [
+        80 # HTTP/1
+        443 # HTTP/2
+      ];
+      allowedUDPPorts = [
+        443 # HTTP/3
+      ];
+    };
+  };
+
+  environment.etc."ssh/banner".text = ''
+      __
+     /\ \
+     \_\ \     __     __  __
+     /'_` \  /'__`\  /\ \/\ \
+    /\ \L\ \/\ \L\.\_\ \ \_/ |
+    \ \___,_\ \__/.\_\\ \___/
+     \/__,_ /\/__/\/_/ \/__/
+  '';
+  services.openssh.settings.Banner = "/etc/ssh/banner";
+
+  system.stateVersion = "26.05";
+}

hosts/dav/radicale.nix

@@ -0,0 +1,96 @@
+{ config, pkgs, ... }:
+
+let
+  calendarAggregate = pkgs.writers.writePython3 "calendar-aggregate.py" { libraries = [ pkgs.python3Packages.icalendar ]; } ''
+    from pathlib import Path
+    from icalendar import Calendar
+
+    combined = Calendar()
+
+    for path in Path("/var/lib/radicale/collections").rglob("*.ics"):
+        with open(path, "rb") as f:
+            cal = Calendar.from_ical(f.read())
+
+        for component in cal.walk("VEVENT"):
+            combined.add_component(component)
+
+    with open("/srv/www/calendar/all.ics", "wb") as f:
+        f.write(combined.to_ical())
+  '';
+in
+{
+  imports = [
+    ../../services/nginx.nix
+    ../../services/prometheus-nginx.nix
+  ];
+
+  systemd = {
+    services.calendar-aggregate = {
+      script = "${calendarAggregate}";
+      serviceConfig.Type = "oneshot";
+    };
+    timers.calendar-aggregate = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnBootSec = "5m";
+        OnUnitActiveSec = "5m";
+      };
+    };
+  };
+
+  services = {
+    radicale = {
+      enable = true;
+      rights = {
+        readonly = {
+          user = "";
+          collection = ".*";
+          permissions = "r";
+        };
+        principal = {
+          user = ".*";
+          collection = "{user}";
+          permissions = "rw";
+        };
+        collections = {
+          user = ".*";
+          collection = "{user}/.*";
+          permissions = "rw";
+        };
+      };
+      settings = {
+        server = {
+          hosts = [ "[::1]:5232" ];
+          validate_user_value = "strict";
+          validate_path_value = "strict";
+        };
+        auth = {
+          type = "htpasswd";
+          htpasswd_filename = config.age.secrets.radicale-htpasswd.path;
+          htpasswd_encryption = "bcrypt";
+        };
+        storage.filesystem_folder = "/var/lib/radicale/collections";
+        headers."Access-Control-Allow-Origin" = "*";
+      };
+    };
+
+    nginx.virtualHosts."dav.${config.networking.domain}" = {
+      default = true;
+      quic = true;
+      kTLS = true;
+      forceSSL = true;
+      enableACME = true;
+      locations = {
+        "/" = {
+          proxyPass = "http://[::1]:5232";
+          recommendedProxySettings = true;
+          extraConfig = ''
+            proxy_pass_header Authorization;
+          '';
+        };
+        "/all.ics".root = "/srv/www/calendar";
+      };
+    };
+  };
+}
+

hosts/sql/postgres.nix

@@ -14,6 +14,7 @@ let
     (mkEntry "hedgedoc" 26) # md.berlin.ccc.de
     (mkEntry "grafana" 14) # monitoring.berlin.ccc.de
     (mkEntry "forgejo" 16) # git.berlin.ccc.de
+    (mkEntry "baikal" 24) # dav.berlin.ccc.de
   ];
   mkEntry = name: octet: {
     user = {

secrets/secrets.nix

@@ -22,6 +22,7 @@ let
   _sql = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPcSXjDSyVVVdJbpheOhT0fIuOGFk+jsHhjrAVnBNLQV root@sql";
   _www = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID4TJCMuJZn03soKuxxv6ywFKiXfhLf9Ab03fbMqNaBJ root@www";
   _monitoring = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINmRWdAUur0lb08NiB6ZWLrGmCeELRV30ElxRLfVJGPB root@monitoring";
+  _dav = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICArHbX8OlNOv8HCWyyFvyi60d6MRFYe+apK0iGJ7yIM root@dav";
 in
 {
   "matrix_admin_password.age".publicKeys = xengi;
@@ -58,5 +59,10 @@ in
     ++ shokinn
     ++ [ _sql ];
   "postgres-extkuma.age".publicKeys = xengi ++ [ _sql ];
+  "postgres-baikal.age".publicKeys = xengi ++ [
+    _sql
+    _dav
+  ];
   "www-staging-htpasswd.age".publicKeys = xengi ++ [ _www ];
+  "radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ];
 }