summaryrefslogtreecommitdiffstats
path: root/tv/3modules
diff options
context:
space:
mode:
Diffstat (limited to 'tv/3modules')
-rw-r--r--tv/3modules/Xresources.nix38
-rw-r--r--tv/3modules/charybdis/config.nix519
-rw-r--r--tv/3modules/charybdis/default.nix81
l---------tv/3modules/charybdis/lib1
-rw-r--r--tv/3modules/default.nix8
-rw-r--r--tv/3modules/dnsmasq.nix58
-rw-r--r--tv/3modules/ejabberd/default.nix275
l---------tv/3modules/ejabberd/lib1
-rw-r--r--tv/3modules/focus.nix4
-rw-r--r--tv/3modules/hosts.nix9
-rw-r--r--tv/3modules/hw.nix16
-rw-r--r--tv/3modules/im.nix110
-rw-r--r--tv/3modules/iptables.nix208
l---------tv/3modules/lib1
-rw-r--r--tv/3modules/lidControl.nix45
-rw-r--r--tv/3modules/org.freedesktop.machine1.host-shell.nix29
-rw-r--r--tv/3modules/slock.nix78
-rw-r--r--tv/3modules/systemd.nix47
-rw-r--r--tv/3modules/unbound.nix84
-rw-r--r--tv/3modules/wwan.nix182
-rw-r--r--tv/3modules/x0vncserver.nix45
21 files changed, 0 insertions, 1839 deletions
diff --git a/tv/3modules/Xresources.nix b/tv/3modules/Xresources.nix
deleted file mode 100644
index 266531de9..000000000
--- a/tv/3modules/Xresources.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-with import ./lib;
-{ config, pkgs, ... }: let
- cfg = {
- enable = config.services.xserver.enable && config.tv.Xresources != {};
- user = config.krebs.build.user;
- };
-in {
- options.tv.Xresources = mkOption {
- default = {};
- type = types.attrsOf types.str;
- };
- config = {
- nixpkgs.overlays = singleton (self: super: {
- tv = super.tv or {} // {
- Xresources =
- self.writeText "Xresources"
- (concatStrings (mapAttrsToList (name: value: /* xdefaults */ ''
- ${name}: ${value}
- '') config.tv.Xresources));
- };
- });
- systemd.services.${if cfg.enable then "Xresources" else null} = {
- wantedBy = [ "graphical.target" ];
- after = [ "xmonad.service" ];
- environment = {
- DISPLAY = ":${toString config.services.xserver.display}";
- };
- serviceConfig = {
- ExecStart = "${pkgs.xorg.xrdb}/bin/xrdb ${pkgs.tv.Xresources}";
- RemainAfterExit = true;
- SyslogIdentifier = "Xresources";
- Type = "oneshot";
- User = cfg.user.name;
- WorkingDirectory = cfg.user.home;
- };
- };
- };
-}
diff --git a/tv/3modules/charybdis/config.nix b/tv/3modules/charybdis/config.nix
deleted file mode 100644
index 4669345eb..000000000
--- a/tv/3modules/charybdis/config.nix
+++ /dev/null
@@ -1,519 +0,0 @@
-{ config, ... }: with import ./lib; let
- cfg = config.tv.charybdis;
-in toFile "charybdis.conf" ''
- /* doc/example.conf - brief example configuration file
- *
- * Copyright (C) 2000-2002 Hybrid Development Team
- * Copyright (C) 2002-2005 ircd-ratbox development team
- * Copyright (C) 2005-2006 charybdis development team
- *
- * $Id: example.conf 3582 2007-11-17 21:55:48Z jilles $
- *
- * See reference.conf for more information.
- */
-
- /* Extensions */
- #loadmodule "extensions/chm_operonly_compat.so";
- #loadmodule "extensions/chm_quietunreg_compat.so";
- #loadmodule "extensions/chm_sslonly_compat.so";
- #loadmodule "extensions/createauthonly.so";
- #loadmodule "extensions/extb_account.so";
- #loadmodule "extensions/extb_canjoin.so";
- #loadmodule "extensions/extb_channel.so";
- #loadmodule "extensions/extb_extgecos.so";
- #loadmodule "extensions/extb_oper.so";
- #loadmodule "extensions/extb_realname.so";
- #loadmodule "extensions/extb_server.so";
- #loadmodule "extensions/extb_ssl.so";
- #loadmodule "extensions/hurt.so";
- #loadmodule "extensions/m_findforwards.so";
- #loadmodule "extensions/m_identify.so";
- #loadmodule "extensions/no_oper_invis.so";
- #loadmodule "extensions/sno_farconnect.so";
- #loadmodule "extensions/sno_globalkline.so";
- #loadmodule "extensions/sno_globaloper.so";
- #loadmodule "extensions/sno_whois.so";
- loadmodule "extensions/override.so";
-
- /*
- * IP cloaking extensions: use ip_cloaking_4.0
- * if you're linking 3.2 and later, otherwise use
- * ip_cloaking.so, for compatibility with older 3.x
- * releases.
- */
-
- #loadmodule "extensions/ip_cloaking_4.0.so";
- #loadmodule "extensions/ip_cloaking.so";
-
- serverinfo {
- name = ${toJSON (head config.krebs.build.host.nets.retiolum.aliases)};
- sid = "4z3";
- description = "miep!";
- network_name = "irc.r";
- #network_desc = "Retiolum IRC Network";
- hub = yes;
-
- /* On multi-homed hosts you may need the following. These define
- * the addresses we connect from to other servers. */
- /* for IPv4 */
- vhost = ${toJSON config.krebs.build.host.nets.retiolum.ip4.addr};
- /* for IPv6 */
- vhost6 = ${toJSON config.krebs.build.host.nets.retiolum.ip6.addr};
-
- /* ssl_private_key: our ssl private key */
- ssl_private_key = "/tmp/credentials/ssl_private_key";
-
- /* ssl_cert: certificate for our ssl server */
- ssl_cert = ${toJSON cfg.ssl_cert};
-
- /* ssl_dh_params: DH parameters, generate with openssl dhparam -out dh.pem 1024 */
- ssl_dh_params = "/tmp/credentials/ssl_dh_params";
-
- /* ssld_count: number of ssld processes you want to start, if you
- * have a really busy server, using N-1 where N is the number of
- * cpu/cpu cores you have might be useful. A number greater than one
- * can also be useful in case of bugs in ssld and because ssld needs
- * two file descriptors per SSL connection.
- */
- ssld_count = 1;
-
- /* default max clients: the default maximum number of clients
- * allowed to connect. This can be changed once ircd has started by
- * issuing:
- * /quote set maxclients <limit>
- */
- default_max_clients = 1024;
-
- /* nicklen: enforced nickname length (for this server only; must not
- * be longer than the maximum length set while building).
- */
- nicklen = 30;
- };
-
- admin {
- name = "tv";
- description = "peer";
- };
-
- log {
- fname_userlog = "/dev/stderr";
- fname_fuserlog = "/dev/stderr";
- fname_operlog = "/dev/stderr";
- fname_foperlog = "/dev/stderr";
- fname_serverlog = "/dev/stderr";
- fname_klinelog = "/dev/stderr";
- fname_killlog = "/dev/stderr";
- fname_operspylog = "/dev/stderr";
- fname_ioerrorlog = "/dev/stderr";
- };
-
- /* class {} blocks MUST be specified before anything that uses them. That
- * means they must be defined before auth {} and before connect {}.
- */
-
- class "krebs" {
- ping_time = 2 minutes;
- number_per_ident = 10;
- number_per_ip = 2048;
- number_per_ip_global = 4096;
- cidr_ipv4_bitlen = 24;
- cidr_ipv6_bitlen = 64;
- number_per_cidr = 65536;
- max_number = 3000;
- sendq = 1 megabyte;
- };
-
- class "users" {
- ping_time = 2 minutes;
- number_per_ident = 10;
- number_per_ip = 1024;
- number_per_ip_global = 4096;
- cidr_ipv4_bitlen = 24;
- cidr_ipv6_bitlen = 64;
- number_per_cidr = 65536;
- max_number = 3000;
- sendq = 400 kbytes;
- };
-
- class "opers" {
- ping_time = 5 minutes;
- number_per_ip = 10;
- max_number = 1000;
- sendq = 1 megabyte;
- };
-
- class "server" {
- ping_time = 5 minutes;
- connectfreq = 5 minutes;
- max_number = 1;
- sendq = 4 megabytes;
- };
-
- listen {
- /* defer_accept: wait for clients to send IRC handshake data before
- * accepting them. if you intend to use software which depends on the
- * server replying first, such as BOPM, you should disable this feature.
- * otherwise, you probably want to leave it on.
- */
- defer_accept = yes;
-
- /* If you want to listen on a specific IP only, specify host.
- * host definitions apply only to the following port line.
- */
- #host = ${toJSON config.krebs.build.host.nets.retiolum.ip4.addr};
- port = ${toString cfg.port};
- sslport = ${toString cfg.sslport};
- };
-
- /* auth {}: allow users to connect to the ircd (OLD I:)
- * auth {} blocks MUST be specified in order of precedence. The first one
- * that matches a user will be used. So place spoofs first, then specials,
- * then general access, then restricted.
- */
- auth {
- /* user: the user@host allowed to connect. Multiple IPv4/IPv6 user
- * lines are permitted per auth block. This is matched against the
- * hostname and IP address (using :: shortening for IPv6 and
- * prepending a 0 if it starts with a colon) and can also use CIDR
- * masks.
- */
- user = "*@10.243.0.0/16";
- user = "*@42::/16";
-
- /* password: an optional password that is required to use this block.
- * By default this is not encrypted, specify the flag "encrypted" in
- * flags = ...; below if it is.
- */
- #password = "letmein";
-
- /* spoof: fake the users user@host to be be this. You may either
- * specify a host or a user@host to spoof to. This is free-form,
- * just do everyone a favour and dont abuse it. (OLD I: = flag)
- */
- #spoof = "I.still.hate.packets";
-
- /* Possible flags in auth:
- *
- * encrypted | password is encrypted with mkpasswd
- * spoof_notice | give a notice when spoofing hosts
- * exceed_limit (old > flag) | allow user to exceed class user limits
- * kline_exempt (old ^ flag) | exempt this user from k/g/xlines&dnsbls
- * dnsbl_exempt | exempt this user from dnsbls
- * spambot_exempt | exempt this user from spambot checks
- * shide_exempt | exempt this user from serverhiding
- * jupe_exempt | exempt this user from generating
- * warnings joining juped channels
- * resv_exempt | exempt this user from resvs
- * flood_exempt | exempt this user from flood limits
- * USE WITH CAUTION.
- * no_tilde (old - flag) | don't prefix ~ to username if no ident
- * need_ident (old + flag) | require ident for user in this class
- * need_ssl | require SSL/TLS for user in this class
- * need_sasl | require SASL id for user in this class
- */
- flags = kline_exempt, exceed_limit, flood_exempt;
-
- /* class: the class the user is placed in */
- class = "krebs";
- };
-
- auth {
- user = "*@*";
- class = "users";
- };
-
- /* privset {} blocks MUST be specified before anything that uses them. That
- * means they must be defined before operator {}.
- */
- privset "local_op" {
- privs = oper:local_kill, oper:operwall;
- };
-
- privset "server_bot" {
- extends = "local_op";
- privs = oper:kline, oper:remoteban, snomask:nick_changes;
- };
-
- privset "global_op" {
- extends = "local_op";
- privs = oper:global_kill, oper:routing, oper:kline, oper:unkline, oper:xline,
- oper:resv, oper:mass_notice, oper:remoteban;
- };
-
- privset "admin" {
- extends = "global_op";
- privs = oper:admin, oper:die, oper:rehash, oper:spy, oper:override;
- };
-
- privset "aids" {
- privs = oper:override, oper:rehash;
- };
-
- operator "aids" {
- user = "*@10.243.*";
- privset = "aids";
- flags = ~encrypted;
- password = "balls";
- };
-
- operator "god" {
- /* name: the name of the oper must go above */
-
- /* user: the user@host required for this operator. CIDR *is*
- * supported now. auth{} spoofs work here, other spoofs do not.
- * multiple user="" lines are supported.
- */
- user = "*god@127.0.0.1";
-
- /* password: the password required to oper. Unless ~encrypted is
- * contained in flags = ...; this will need to be encrypted using
- * mkpasswd, MD5 is supported
- */
- password = "5";
-
- /* rsa key: the public key for this oper when using Challenge.
- * A password should not be defined when this is used, see
- * doc/challenge.txt for more information.
- */
- #rsa_public_key_file = "/usr/local/ircd/etc/oper.pub";
-
- /* umodes: the specific umodes this oper gets when they oper.
- * If this is specified an oper will not be given oper_umodes
- * These are described above oper_only_umodes in general {};
- */
- #umodes = locops, servnotice, operwall, wallop;
-
- /* fingerprint: if specified, the oper's client certificate
- * fingerprint will be checked against the specified fingerprint
- * below.
- */
- #fingerprint = "c77106576abf7f9f90cca0f63874a60f2e40a64b";
-
- /* snomask: specific server notice mask on oper up.
- * If this is specified an oper will not be given oper_snomask.
- */
- snomask = "+Zbfkrsuy";
-
- /* flags: misc options for the operator. You may prefix an option
- * with ~ to disable it, e.g. ~encrypted.
- *
- * Default flags are encrypted.
- *
- * Available options:
- *
- * encrypted: the password above is encrypted [DEFAULT]
- * need_ssl: must be using SSL/TLS to oper up
- */
- flags = encrypted;
-
- /* privset: privileges set to grant */
- privset = "admin";
- };
-
- service {
- name = "services.int";
- };
-
- cluster {
- name = "*";
- flags = kline, tkline, unkline, xline, txline, unxline, resv, tresv, unresv;
- };
-
- shared {
- oper = "*@*", "*";
- flags = all, rehash;
- };
-
- /* exempt {}: IPs that are exempt from Dlines and rejectcache. (OLD d:) */
- exempt {
- ip = "127.0.0.1";
- };
-
- channel {
- use_invex = yes;
- use_except = yes;
- use_forward = yes;
- use_knock = yes;
- knock_delay = 5 minutes;
- knock_delay_channel = 1 minute;
- max_chans_per_user = 15;
- max_bans = 100;
- max_bans_large = 500;
- default_split_user_count = 0;
- default_split_server_count = 0;
- no_create_on_split = no;
- no_join_on_split = no;
- burst_topicwho = yes;
- kick_on_split_riding = no;
- only_ascii_channels = no;
- resv_forcepart = yes;
- channel_target_change = yes;
- disable_local_channels = no;
- };
-
- serverhide {
- flatten_links = yes;
- links_delay = 5 minutes;
- hidden = no;
- disable_hidden = no;
- };
-
- /* These are the blacklist settings.
- * You can have multiple combinations of host and rejection reasons.
- * They are used in pairs of one host/rejection reason.
- *
- * These settings should be adequate for most networks, and are (presently)
- * required for use on StaticBox.
- *
- * Word to the wise: Do not use blacklists like SPEWS for blocking IRC
- * connections.
- *
- * As of charybdis 2.2, you can do some keyword substitution on the rejection
- * reason. The available keyword substitutions are:
- *
- * ''${ip} - the user's IP
- * ''${host} - the user's canonical hostname
- * ''${dnsbl-host} - the dnsbl hostname the lookup was done against
- * ''${nick} - the user's nickname
- * ''${network-name} - the name of the network
- *
- * As of charybdis 3.4, a type parameter is supported, which specifies the
- * address families the blacklist supports. IPv4 and IPv6 are supported.
- * IPv4 is currently the default as few blacklists support IPv6 operation
- * as of this writing.
- *
- * Note: AHBL (the providers of the below *.ahbl.org BLs) request that they be
- * contacted, via email, at admins@2mbit.com before using these BLs.
- * See <http://www.ahbl.org/services.php> for more information.
- */
- blacklist {
- host = "rbl.efnetrbl.org";
- type = ipv4;
- reject_reason = "''${nick}, your IP (''${ip}) is listed in EFnet's RBL. For assistance, see http://efnetrbl.org/?i=''${ip}";
-
- # host = "ircbl.ahbl.org";
- # type = ipv4;
- # reject_reason = "''${nick}, your IP (''${ip}) is listed in ''${dnsbl-host} for having an open proxy. In order to protect ''${network-name} from abuse, we are not allowing connections with open proxies to connect.";
- #
- # host = "tor.ahbl.org";
- # type = ipv4;
- # reject_reason = "''${nick}, your IP (''${ip}) is listed as a TOR exit node. In order to protect ''${network-name} from tor-based abuse, we are not allowing TOR exit nodes to connect to our network.";
- #
- /* Example of a blacklist that supports both IPv4 and IPv6 */
- # host = "foobl.blacklist.invalid";
- # type = ipv4, ipv6;
- # reject_reason = "''${nick}, your IP (''${ip}) is listed in ''${dnsbl-host} for some reason. In order to protect ''${network-name} from abuse, we are not allowing connections listed in ''${dnsbl-host} to connect";
- };
-
- alias "NickServ" {
- target = "NickServ";
- };
-
- alias "ChanServ" {
- target = "ChanServ";
- };
-
- alias "OperServ" {
- target = "OperServ";
- };
-
- alias "MemoServ" {
- target = "MemoServ";
- };
-
- alias "NS" {
- target = "NickServ";
- };
-
- alias "CS" {
- target = "ChanServ";
- };
-
- alias "OS" {
- target = "OperServ";
- };
-
- alias "MS" {
- target = "MemoServ";
- };
-
- general {
- hide_error_messages = opers;
- hide_spoof_ips = yes;
-
- /*
- * default_umodes: umodes to enable on connect.
- * If you have enabled the new ip_cloaking_4.0 module, and you want
- * to make use of it, add +x to this option, i.e.:
- * default_umodes = "+ix";
- *
- * If you have enabled the old ip_cloaking module, and you want
- * to make use of it, add +h to this option, i.e.:
- * default_umodes = "+ih";
- */
- default_umodes = "+i";
-
- default_operstring = "is an IRC Operator";
- default_adminstring = "is a Server Administrator";
- servicestring = "is a Network Service";
- disable_fake_channels = no;
- tkline_expire_notices = no;
- default_floodcount = 1000;
- failed_oper_notice = yes;
- dots_in_ident=2;
- min_nonwildcard = 4;
- min_nonwildcard_simple = 3;
- max_accept = 100;
- max_monitor = 100;
- anti_nick_flood = yes;
- max_nick_time = 20 seconds;
- max_nick_changes = 5;
- anti_spam_exit_message_time = 5 minutes;
- ts_warn_delta = 30 seconds;
- ts_max_delta = 5 minutes;
- client_exit = yes;
- collision_fnc = yes;
- resv_fnc = yes;
- global_snotices = yes;
- dline_with_reason = yes;
- kline_delay = 0 seconds;
- kline_with_reason = yes;
- kline_reason = "K-Lined";
- identify_service = "NickServ@services.int";
- identify_command = "IDENTIFY";
- non_redundant_klines = yes;
- warn_no_nline = yes;
- use_propagated_bans = yes;
- stats_e_disabled = no;
- stats_c_oper_only=no;
- stats_h_oper_only=no;
- client_flood_max_lines = 16000;
- client_flood_burst_rate = 32000;
- client_flood_burst_max = 32000;
- client_flood_message_num = 32000;
- client_flood_message_time = 32000;
- use_whois_actually = no;
- oper_only_umodes = operwall, locops, servnotice;
- oper_umodes = locops, servnotice, operwall, wallop;
- oper_snomask = "+s";
- burst_away = yes;
- nick_delay = 0 seconds; # 15 minutes if you want to enable this
- reject_ban_time = 1 minute;
- reject_after_count = 3;
- reject_duration = 5 minutes;
- throttle_duration = 1;
- throttle_count = 1000;
- max_ratelimit_tokens = 30;
- away_interval = 30;
- disable_auth = yes;
- };
-
- modules {
- path = "modules";
- path = "modules/autoload";
- };
-
- exempt {
- ip = "10.243.0.0/16";
- };
-''
diff --git a/tv/3modules/charybdis/default.nix b/tv/3modules/charybdis/default.nix
deleted file mode 100644
index 1fdcea572..000000000
--- a/tv/3modules/charybdis/default.nix
+++ /dev/null
@@ -1,81 +0,0 @@
-with import ./lib;
-{ config, pkgs, ... }@args: let
- cfg = config.tv.charybdis;
-in {
- options.tv.charybdis = {
- enable = mkEnableOption "tv.charybdis";
- motd = mkOption {
- type = types.str;
- default = "/join #retiolum";
- };
- port = mkOption {
- type = types.int;
- default = 6667;
- };
- ssl_cert = mkOption {
- type = types.path;
- };
- ssl_dh_params = mkOption {
- type = types.absolute-pathname;
- default = "${config.krebs.secret.directory}/charybdis.dh.pem";
- };
- ssl_private_key = mkOption {
- type = types.absolute-pathname;
- default = "${config.krebs.secret.directory}/charybdis.key.pem";
- };
- sslport = mkOption {
- type = types.int;
- default = 6697;
- };
- user = mkOption {
- type = types.user;
- default = {
- name = "charybdis";
- home = "/var/lib/charybdis";
- };
- };
- };
- config = lib.mkIf cfg.enable {
-
- environment.etc."charybdis-ircd.motd".text = cfg.motd;
-
- krebs.systemd.services.charybdis = {};
-
- systemd.services.charybdis = {
- wantedBy = [ "multi-user.target" ];
- after = [ "network-online.target" ];
- environment = {
- BANDB_DBPATH = "${cfg.user.home}/ban.db";
- };
- serviceConfig = {
- SyslogIdentifier = "charybdis";
- User = cfg.user.name;
- PrivateTmp = true;
- Restart = "always";
- ExecStartPre = [
- "${pkgs.coreutils}/bin/ln -s /etc/charybdis-ircd.motd /tmp/ircd.motd"
- "${pkgs.coreutils}/bin/ln -s \${CREDENTIALS_DIRECTORY} /tmp/credentials"
- ];
- ExecStart = toString [
- "${pkgs.charybdis}/bin/charybdis"
- "-configfile ${import ./config.nix args}"
- "-foreground"
- "-logfile /dev/stderr"
- ];
- LoadCredential = [
- "ssl_dh_params:${cfg.ssl_dh_params}"
- "ssl_private_key:${cfg.ssl_private_key}"
- ];
- };
- };
-
- users.users.${cfg.user.name} = {
- inherit (cfg.user) home name uid;
- createHome = true;
- group = cfg.user.name;
- isSystemUser = true;
- };
-
- users.groups.${cfg.user.name} = {};
- };
-}
diff --git a/tv/3modules/charybdis/lib b/tv/3modules/charybdis/lib
deleted file mode 120000
index dc598c56d..000000000
--- a/tv/3modules/charybdis/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib \ No newline at end of file
diff --git a/tv/3modules/default.nix b/tv/3modules/default.nix
deleted file mode 100644
index 1a0971ec6..000000000
--- a/tv/3modules/default.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-with import ./lib;
-{
- imports =
- map
- (name: ./. + "/${name}")
- (attrNames
- (filterAttrs isNixDirEntry (readDir ./.)));
-}
diff --git a/tv/3modules/dnsmasq.nix b/tv/3modules/dnsmasq.nix
deleted file mode 100644
index e1dfdea34..000000000
--- a/tv/3modules/dnsmasq.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-with import ./lib;
-{ config, ... }: let
- cfg = config.tv.dnsmasq;
-in {
-
- options.tv.dnsmasq = {
- enable = mkEnableOption "tv.dnsmasq";
- dhcp-range = mkOption {
- type = types.str;
- };
- interface = mkOption {
- type = types.str;
- };
- address = mkOption {
- type = types.str;
- };
- prefixLength = mkOption {
- type = types.addCheck types.int (x: x >= 0 && x <= 32);
- };
- };
-
- config = mkIf cfg.enable (mkMerge [
- {
- networking.dhcpcd.denyInterfaces = [ cfg.interface ];
- services.dnsmasq.resolveLocalQueries = false;
- networking.interfaces.${cfg.interface} = {
- ipv4.addresses = singleton {
- address = cfg.address;
- prefixLength = cfg.prefixLength;
- };
- };
- services.dnsmasq.enable = true;
- services.dnsmasq.extraConfig = ''
- bind-interfaces
- dhcp-range=${cfg.dhcp-range}
- listen-address=${cfg.address}
- '';
- tv.iptables.extra.filter.INPUT = [
- "-i ${cfg.interface} -p tcp -m tcp --dport bootps -j ACCEPT"
- "-i ${cfg.interface} -p udp -m udp --dport bootps -j ACCEPT"
- "-i ${cfg.interface} -p tcp -m tcp --dport domain -j ACCEPT"
- "-i ${cfg.interface} -p udp -m udp --dport domain -j ACCEPT"
- ];
- }
- {
- # enable forwarding
- boot.kernel.sysctl."net.ipv4.ip_forward" = true;
- tv.iptables.extra.filter.FORWARD = [
- "-m state --state RELATED,ESTABLISHED -j ACCEPT"
- "-i ${cfg.interface} -j ACCEPT"
- ];
- tv.iptables.extra.nat.POSTROUTING = [
- "-j MASQUERADE"
- ];
- }
- ]);
-
-}
diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix
deleted file mode 100644
index 61fd8fdf1..000000000
--- a/tv/3modules/ejabberd/default.nix
+++ /dev/null
@@ -1,275 +0,0 @@
-with import ./lib;
-{ config, pkgs, ... }: let
- cfg = config.tv.ejabberd;
-
- gen-dhparam = pkgs.writeDash "gen-dhparam" ''
- set -efu
- path=$1
- bits=2048
- # TODO regenerate dhfile after some time?
- if ! test -e "$path"; then
- ${pkgs.openssl}/bin/openssl dhparam "$bits" > "$path"
- fi
- '';
-
- settingsFormat = pkgs.formats.json {};
-
-in {
- options.tv.ejabberd = {
- enable = mkEnableOption "tv.ejabberd";
- certfiles = mkOption {
- type = types.listOf types.absolute-pathname;
- default = [
- "${config.krebs.secret.directory}/ejabberd.pem"
- ];
- };
- configFile = mkOption {
- type = types.either types.package types.absolute-pathname;
- default = settingsFormat.generate "ejabberd.yaml" cfg.settings;
- };
- ciphers = mkOption {
- type = types.listOf types.str;
- default = [
- "ECDHE-ECDSA-AES256-GCM-SHA384"
- "ECDHE-RSA-AES256-GCM-SHA384"
- "ECDHE-ECDSA-CHACHA20-POLY1305"
- "ECDHE-RSA-CHACHA20-POLY1305"
- "ECDHE-ECDSA-AES128-GCM-SHA256"
- "ECDHE-RSA-AES128-GCM-SHA256"
- "ECDHE-ECDSA-AES256-SHA384"
- "ECDHE-RSA-AES256-SHA384"
- "ECDHE-ECDSA-AES128-SHA256"
- "ECDHE-RSA-AES128-SHA256"
- ];
- };
- credentials.certfiles = mkOption {
- internal = true;
- readOnly = true;
- default =
- imap
- (i: const "/tmp/credentials/certfile${toJSON i}")
- cfg.certfiles;
- };
- hosts = mkOption {
- type = with types; listOf str;
- };
- pkgs.ejabberd = mkOption {
- type = types.package;
- default = pkgs.symlinkJoin {
- name = "ejabberd-wrapper";
- paths = [
- (pkgs.writeDashBin "ejabberdctl" ''
- exec ${pkgs.ejabberd}/bin/ejabberdctl \
- --config /etc/ejabberd/ejabberd.yaml \
- --ctl-config /etc/ejabberd/ejabberdctl.cfg \
- --logs ${cfg.stateDir} \
- --spool ${cfg.stateDir} \
- "$@"
- '')
- pkgs.ejabberd
- ];
- };
- };
- protocol_options = mkOption {
- type = types.listOf types.str;
- default = [
- "no_sslv2"
- "no_sslv3"
- "no_tlsv1"
- "no_tlsv1_10"
- ];
- };
- registration_watchers = mkOption {
- type = types.listOf types.str;
- default = [
- config.krebs.users.tv.mail
- ];
- };
- settings = mkOption {
- type = settingsFormat.type;
- default = {};
- };
- stateDir = mkOption {
- type =
- types.addCheck
- types.absolute-pathname
- (path:
- hasPrefix "/var/lib/" path &&
- types.filename.check (removePrefix "/var/lib/" path)
- );
- default = "/var/lib/ejabberd";
- };
- };
- config = lib.mkIf cfg.enable {
-
- environment.etc."ejabberd/ejabberd.yaml".source = cfg.configFile;
- environment.etc."ejabberd/ejabberdctl.cfg".source =
- builtins.toFile "ejabberdctl.cfg" /* sh */ ''
- ERL_OPTIONS='-setcookie ${cfg.stateDir}/.erlang.cookie'
- '';
-
- environment.systemPackages = [
- (pkgs.symlinkJoin {
- name = "ejabberd-sudo-wrapper";
- paths = [
- (pkgs.writeDashBin "ejabberdctl" ''
- exec ${pkgs.systemd}/bin/systemd-run \
- --unit=ejabberdctl \
- --property=StateDirectory=ejabberd \
- --property=User=ejabberd \
- --collect \
- --pipe \
- --quiet \
- ${cfg.pkgs.ejabberd}/bin/ejabberdctl "$@"
- '')
- cfg.pkgs.ejabberd
- ];
- })
- ];
-
- krebs.systemd.services.ejabberd.restartIfCredentialsChange = true;
-
- systemd.services.ejabberd = {
- wantedBy = [ "multi-user.target" ];
- after = [ "network.target" ];
- reloadTriggers = [
- config.environment.etc."ejabberd/ejabberd.yaml".source
- config.environment.etc."ejabberd/ejabberdctl.cfg".source
- ];
- serviceConfig = {
- ExecStartPre = [
- "${pkgs.coreutils}/bin/ln -s \${CREDENTIALS_DIRECTORY} /tmp/credentials"
- "${gen-dhparam} ${cfg.stateDir}/dhfile"
- ];
- ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground";
- ExecStop = [
- "${cfg.pkgs.ejabberd}/bin/ejabberdctl stop"
- "${cfg.pkgs.ejabberd}/bin/ejabberdctl stopped"
- ];
- ExecReload = "${cfg.pkgs.ejabberd}/bin/ejabberdctl reload_config";
- LoadCredential =
- zipListsWith
- (dst: src: "${baseNameOf dst}:${src}")
- cfg.credentials.certfiles
- cfg.certfiles;
- LimitNOFILE = 65536;
- PrivateDevices = true;
- PrivateTmp = true;
- SyslogIdentifier = "ejabberd";
- StateDirectory = "ejabberd";
- User = "ejabberd";
- DynamicUser = true;
- TimeoutSec = 60;
- RestartSec = 5;
- Restart = "on-failure";
- Type = "notify";
- NotifyAccess = "all";
- WatchdogSec = 30;
- };
- };
-
- # preset config values
- tv.ejabberd.settings = {
- access_rules = {
- announce = mkDefault [{ allow = "admin"; }];
- local = mkDefault [{ allow = "local"; }];
- configure = mkDefault [{ allow = "admin"; }];
- register = mkDefault ["allow"];
- s2s = mkDefault ["allow"];
- trusted_network = mkDefault [{ allow = "loopback"; }];
- };
-
- acl = {
- local.user_regexp = mkDefault "";
- loopback.ip = mkDefault [
- "127.0.0.0/8"
- "::1/128"
- "::FFFF:127.0.0.1/128"
- ];
- };
-
- certfiles = mkDefault cfg.credentials.certfiles;
-
- hosts = mkDefault cfg.hosts;
-
- language = mkDefault "en";
-
- listen = mkDefault [
- {
- port = 5222;
- ip = "::";
- module = "ejabberd_c2s";
- shaper = "c2s_shaper";
- ciphers = concatStringsSep ":" cfg.ciphers;
- protocol_options = cfg.protocol_options;
- starttls = true;
- starttls_required = true;
- tls = false;
- tls_compression = false;
- max_stanza_size = 65536;
- }
- {
- port = 5269;
- ip = "::";
- module = "ejabberd_s2s_in";
- shaper = "s2s_shaper";