WIP: feat: Add minecraft server

.git-blame-ignore-revs

@@ -9,6 +9,3 @@ fd138d45e6a2cad89fead6e9f246ba282070d6b7
 
 # Switch to alejandra formatting
 046a88905ddfa7f9edc3291c310dbb985dee34f9
-
-# Apply wide linting
-63b3cbe00be80ccb4b221aad64eb657ae5c96d70

checks/default.nix

@@ -1,61 +0,0 @@
-{
-  self,
-  nixpkgs,
-  deploy-rs,
-  system,
-  ...
-}:
-let
-  pkgs = nixpkgs.legacyPackages.${system};
-
-  statix' = pkgs.statix.overrideAttrs (old: {
-    patches = old.patches ++ [
-      (pkgs.fetchpatch {
-        url = "https://github.com/oppiliappan/statix/commit/925dec39bb705acbbe77178b4d658fe1b752abbb.patch";
-        hash = "sha256-0wacO6wuYJ4ufN9PGucRVJucFdFFNF+NoHYIrLXsCWs=";
-      })
-    ];
-  });
-
-  runNuCheck =
-    {
-      name,
-      packages,
-      check,
-    }:
-    pkgs.stdenvNoCC.mkDerivation {
-      inherit name;
-
-      src = nixpkgs.lib.cleanSourceWith {
-        src = self;
-        filter = nixpkgs.lib.cleanSourceFilter;
-      };
-
-      dontPatch = true;
-      dontConfigure = true;
-      dontBuild = true;
-      dontInstall = true;
-      dontFixup = true;
-      doCheck = true;
-
-      checkInputs = nixpkgs.lib.singleton pkgs.nushell ++ packages;
-
-      checkPhase = ''
-        nu ${check}
-      '';
-    };
-in
-nixpkgs.lib.recursiveUpdate {
-  lints = runNuCheck {
-    name = "lints";
-
-    packages = [
-      pkgs.deadnix
-      pkgs.nixfmt-rfc-style
-      pkgs.shellcheck
-      statix'
-    ];
-
-    check = ./lints.nu;
-  };
-} (deploy-rs.lib.${system}.deployChecks self.deploy)

checks/lints.nu

@@ -1,39 +0,0 @@
-#!/usr/bin/env nu
-
-let shell_files = ls **/*.sh | get name
-let nix_files = ls **/*.nix | where name !~ "hardware-configuration.nix|_sources" | get name
-
-let linters = [
-  ([shellcheck] ++ $shell_files)
-  ([nixfmt --check --strict] ++ $nix_files)
-  ([deadnix --fail] ++ $nix_files)
-  ([statix check] ++ $nix_files)
-]
-
-mkdir $env.out
-
-def run-linter [linterArgs: list<string>] {
-  print $'Running ($linterArgs.0)...'
-
-  let exit_code = try {
-    ^$linterArgs.0 ...($linterArgs | skip 1)
-    $env.LAST_EXIT_CODE
-  } catch {|e| $e.exit_code}
-
-  [$linterArgs.0, $exit_code]
-}
-
-let results = $linters | each {|linter| run-linter $linter}
-
-print 'Linter results:'
-
-let success = $results | each {|result|
-  match $result.1 {
-    0 => {print $'(ansi green)($result.0)(ansi reset)'}
-    _ => {print $'(ansi red)($result.0)(ansi reset)'}
-  }
-
-  $result.1
-} | math sum
-
-exit $success

configuration/default.nix

@@ -1,5 +1,7 @@
 {
   config,
+  pkgs,
+  lib,
   modulesPath,
   flake-inputs,
   ...
@@ -30,7 +32,13 @@
     ./sops.nix
   ];
 
-  nixpkgs.overlays = [ (_: prev: { local = import ../pkgs { pkgs = prev; }; }) ];
+  nixpkgs.overlays = [
+    (final: prev: {
+      local = import ../pkgs {
+        pkgs = prev;
+      };
+    })
+  ];
 
   nix = {
     extraOptions = ''

configuration/hardware-specific/vm.nix

@@ -6,35 +6,26 @@
   boot.kernelParams = [ "nomodeset" ];
 
   networking.hostName = "testvm";
-
-  services = {
   # Sets the base domain for nginx to a local domain so that we can
   # easily test locally with the VM.
-    nginx.domain = "dev.local";
+  services.nginx.domain = "dev.local";
-
-    # Don't run this
-    batteryManager.enable = lib.mkForce false;
-
-    openssh.hostKeys = lib.mkForce [
-      {
-        type = "rsa";
-        bits = 4096;
-        path = "/etc/staging.key";
-      }
-    ];
-  };
 
   # Use the staging secrets
   sops.defaultSopsFile = lib.mkOverride 99 ../../keys/staging.yaml;
 
   systemd.network.networks."10-eth0" = {
     matchConfig.Name = "eth0";
-    gateway = [ "192.168.9.1" ];
+    gateway = [
+      "192.168.9.1"
+    ];
     networkConfig = {
       Address = "192.168.9.2/24";
     };
   };
 
+  # Don't run this
+  services.batteryManager.enable = lib.mkForce false;
+
   # Both so we have a predictable key for the staging env, as well as
   # to have a static key for decrypting the sops secrets for the
   # staging env.
@@ -43,6 +34,14 @@
     source = ../../keys/hosts/staging.key;
   };
 
+  services.openssh.hostKeys = lib.mkForce [
+    {
+      type = "rsa";
+      bits = 4096;
+      path = "/etc/staging.key";
+    }
+  ];
+
   virtualisation.vmVariant = {
     virtualisation = {
       memorySize = 3941;

configuration/nginx.nix

@@ -1,7 +1,6 @@
 { config, lib, ... }:
 {
-  services = {
+  services.nginx = {
-    nginx = {
     enable = true;
     recommendedTlsSettings = true;
     recommendedOptimisation = true;
@@ -20,7 +19,7 @@
     '';
   };
 
-    logrotate.settings =
+  services.logrotate.settings =
     {
       # Override the default, just keep fewer logs
       nginx.rotate = 6;
@@ -37,14 +36,6 @@
       }
     ) config.services.nginx.virtualHosts;
 
-    backups.acme = {
-      user = "acme";
-      paths = lib.mapAttrsToList (
-        virtualHost: _: "/var/lib/acme/${virtualHost}"
-      ) config.services.nginx.virtualHosts;
-    };
-  };
-
   systemd.tmpfiles.rules = lib.mapAttrsToList (
     virtualHost: _:
     #
@@ -75,4 +66,11 @@
   systemd.services.nginx.serviceConfig.SupplementaryGroups = [
     config.security.acme.certs."tlater.net".group
   ];
+
+  services.backups.acme = {
+    user = "acme";
+    paths = lib.mapAttrsToList (
+      virtualHost: _: "/var/lib/acme/${virtualHost}"
+    ) config.services.nginx.virtualHosts;
+  };
 }

configuration/services/backups.nix

@@ -57,7 +57,7 @@ in
       '';
       type = types.attrsOf (
         types.submodule (
-          { name, ... }:
+          { config, name, ... }:
           {
             options = {
               user = lib.mkOption {
@@ -246,7 +246,7 @@ in
         };
       }
       // lib.mapAttrs' (
-        name: _:
+        name: backup:
         lib.nameValuePair "backup-${name}" {
           wantedBy = [ "timers.target" ];
           timerConfig = {

configuration/services/conduit/default.nix

@@ -18,8 +18,7 @@ in
     ./matrix-hookshot.nix
   ];
 
-  services = {
+  services.matrix-conduit = {
-    matrix-conduit = {
     enable = true;
     package = flake-inputs.continuwuity.packages.${pkgs.system}.default;
     settings.global = {
@@ -49,7 +48,20 @@ in
     };
   };
 
-    coturn = {
+  systemd.services.conduit.serviceConfig = {
+    ExecStart = lib.mkForce "${config.services.matrix-conduit.package}/bin/conduwuit";
+    # Pass in the TURN secret via EnvironmentFile, not supported by
+    # upstream module currently.
+    #
+    # See also https://gitlab.com/famedly/conduit/-/issues/314
+    EnvironmentFile = config.sops.secrets."turn/env".path;
+  };
+
+  systemd.services.coturn.serviceConfig.SupplementaryGroups = [
+    config.security.acme.certs."tlater.net".group
+  ];
+
+  services.coturn = {
     enable = true;
     no-cli = true;
     use-auth-secret = true;
@@ -105,7 +117,7 @@ in
     '';
   };
 
-    nginx.virtualHosts."${domain}" = {
+  services.nginx.virtualHosts."${domain}" = {
     useACMEHost = "tlater.net";
 
     listen = [
@@ -159,25 +171,11 @@ in
     };
   };
 
-    backups.conduit = {
+  services.backups.conduit = {
     user = "root";
     paths = [ "/var/lib/private/matrix-conduit/" ];
     # Other services store their data in conduit, so no other services
     # need to be shut down currently.
     pauseServices = [ "conduit.service" ];
   };
-  };
-
-  systemd.services.conduit.serviceConfig = {
-    ExecStart = lib.mkForce "${config.services.matrix-conduit.package}/bin/conduwuit";
-    # Pass in the TURN secret via EnvironmentFile, not supported by
-    # upstream module currently.
-    #
-    # See also https://gitlab.com/famedly/conduit/-/issues/314
-    EnvironmentFile = config.sops.secrets."turn/env".path;
-  };
-
-  systemd.services.coturn.serviceConfig.SupplementaryGroups = [
-    config.security.acme.certs."tlater.net".group
-  ];
 }

configuration/services/conduit/matrix-hookshot.nix

@@ -74,7 +74,9 @@ in
   services.matrix-hookshot = {
     enable = true;
 
-    serviceDependencies = [ "conduit.service" ];
+    serviceDependencies = [
+      "conduit.service"
+    ];
 
     registrationFile = "/run/matrix-hookshot/registration.yaml";
 
@@ -124,11 +126,15 @@ in
       listeners = [
         {
           port = 9000;
-          resources = [ "webhooks" ];
+          resources = [
+            "webhooks"
+          ];
         }
         {
           port = 9001;
-          resources = [ "metrics" ];
+          resources = [
+            "metrics"
+          ];
         }
       ];
 

configuration/services/crowdsec.nix

@@ -8,7 +8,9 @@
   security.crowdsec = {
     enable = true;
 
-    parserWhitelist = [ "10.45.249.2" ];
+    parserWhitelist = [
+      "10.45.249.2"
+    ];
 
     extraGroups = [
       "systemd-journal"
@@ -19,19 +21,25 @@
       {
         source = "journalctl";
         labels.type = "syslog";
-        journalctl_filter = [ "SYSLOG_IDENTIFIER=Nextcloud" ];
+        journalctl_filter = [
+          "SYSLOG_IDENTIFIER=Nextcloud"
+        ];
       }
 
       {
         source = "journalctl";
         labels.type = "syslog";
-        journalctl_filter = [ "SYSLOG_IDENTIFIER=sshd-session" ];
+        journalctl_filter = [
+          "SYSLOG_IDENTIFIER=sshd-session"
+        ];
       }
 
       {
         labels.type = "nginx";
         filenames =
-          [ "/var/log/nginx/*.log" ]
+          [
+            "/var/log/nginx/*.log"
+          ]
           ++ lib.mapAttrsToList (
             vHost: _: "/var/log/nginx/${vHost}/access.log"
           ) config.services.nginx.virtualHosts;

configuration/services/foundryvtt.nix

@@ -11,8 +11,7 @@ in
 {
   imports = [ flake-inputs.foundryvtt.nixosModules.foundryvtt ];
 
-  services = {
+  services.foundryvtt = {
-    foundryvtt = {
     enable = true;
     hostName = domain;
     minifyStaticFiles = true;
@@ -21,7 +20,11 @@ in
     package = flake-inputs.foundryvtt.packages.${pkgs.system}.foundryvtt_11;
   };
 
-    nginx.virtualHosts."${domain}" =
+  # Want to start it manually when I need it, not have it constantly
+  # running
+  systemd.services.foundryvtt.wantedBy = lib.mkForce [ ];
+
+  services.nginx.virtualHosts."${domain}" =
     let
       inherit (config.services.foundryvtt) port;
     in
@@ -36,14 +39,9 @@ in
       };
     };
 
-    backups.foundryvtt = {
+  services.backups.foundryvtt = {
     user = "foundryvtt";
     paths = [ config.services.foundryvtt.dataDir ];
     pauseServices = [ "foundryvtt.service" ];
   };
-  };
-
-  # Want to start it manually when I need it, not have it constantly
-  # running
-  systemd.services.foundryvtt.wantedBy = lib.mkForce [ ];
 }

configuration/services/gitea.nix

@@ -8,8 +8,7 @@ let
   domain = "gitea.${config.services.nginx.domain}";
 in
 {
-  services = {
+  services.forgejo = {
-    forgejo = {
     enable = true;
     database.type = "postgres";
 
@@ -30,8 +29,16 @@ in
     };
   };
 
+  systemd.services.forgejo.serviceConfig.ExecStartPre =
+    let
+      replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
+      secretPath = config.sops.secrets."forgejo/metrics-token".path;
+      runConfig = "${config.services.forgejo.customDir}/conf/app.ini";
+    in
+    [ "+${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'" ];
+
   # Set up SSL
-    nginx.virtualHosts."${domain}" =
+  services.nginx.virtualHosts."${domain}" =
     let
       httpAddress = config.services.forgejo.settings.server.HTTP_ADDR;
       httpPort = config.services.forgejo.settings.server.HTTP_PORT;
@@ -52,7 +59,7 @@ in
       };
     };
 
-    backups.forgejo = {
+  services.backups.forgejo = {
     user = "forgejo";
     paths = [
       "/var/lib/forgejo/forgejo-db.sql"
@@ -71,13 +78,4 @@ in
     };
     pauseServices = [ "forgejo.service" ];
   };
-  };
-
-  systemd.services.forgejo.serviceConfig.ExecStartPre =
-    let
-      replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
-      secretPath = config.sops.secrets."forgejo/metrics-token".path;
-      runConfig = "${config.services.forgejo.customDir}/conf/app.ini";
-    in
-    [ "+${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'" ];
 }

configuration/services/metrics/exporters.nix

@@ -74,7 +74,7 @@ in
         listenAddress = "127.0.0.1";
         group = "nginx";
 
-        settings.namespaces = lib.mapAttrsToList (name: _: {
+        settings.namespaces = lib.mapAttrsToList (name: virtualHost: {
           inherit name;
           metrics_override.prefix = "nginxlog";
           namespace_label = "vhost";

configuration/services/metrics/options.nix

@@ -38,7 +38,7 @@ in
     services.victoriametrics.scrapeConfigs = mkOption {
       type = types.attrsOf (
         types.submodule (
-          { name, ... }:
+          { name, self, ... }:
           {
             options = {
               job_name = mkOption {
@@ -106,37 +106,35 @@ in
               # module is an intractable mess
               wantedBy = [ "multi-user.target" ];
               after = [ "network.target" ];
-              serviceConfig = {
+              serviceConfig.Restart = mkDefault "always";
-                Restart = mkDefault "always";
+              serviceConfig.PrivateTmp = mkDefault true;
-                PrivateTmp = mkDefault true;
+              serviceConfig.WorkingDirectory = mkDefault /tmp;
-                WorkingDirectory = mkDefault /tmp;
+              serviceConfig.DynamicUser = mkDefault true;
-                DynamicUser = mkDefault true;
               # Hardening
-                CapabilityBoundingSet = mkDefault [ "" ];
+              serviceConfig.CapabilityBoundingSet = mkDefault [ "" ];
-                DeviceAllow = [ "" ];
+              serviceConfig.DeviceAllow = [ "" ];
-                LockPersonality = true;
+              serviceConfig.LockPersonality = true;
-                MemoryDenyWriteExecute = true;
+              serviceConfig.MemoryDenyWriteExecute = true;
-                NoNewPrivileges = true;
+              serviceConfig.NoNewPrivileges = true;
-                PrivateDevices = mkDefault true;
+              serviceConfig.PrivateDevices = mkDefault true;
-                ProtectClock = mkDefault true;
+              serviceConfig.ProtectClock = mkDefault true;
-                ProtectControlGroups = true;
+              serviceConfig.ProtectControlGroups = true;
-                ProtectHome = true;
+              serviceConfig.ProtectHome = true;
-                ProtectHostname = true;
+              serviceConfig.ProtectHostname = true;
-                ProtectKernelLogs = true;
+              serviceConfig.ProtectKernelLogs = true;
-                ProtectKernelModules = true;
+              serviceConfig.ProtectKernelModules = true;
-                ProtectKernelTunables = true;
+              serviceConfig.ProtectKernelTunables = true;
-                ProtectSystem = mkDefault "strict";
+              serviceConfig.ProtectSystem = mkDefault "strict";
-                RemoveIPC = true;
+              serviceConfig.RemoveIPC = true;
-                RestrictAddressFamilies = [
+              serviceConfig.RestrictAddressFamilies = [
                 "AF_INET"
                 "AF_INET6"
               ];
-                RestrictNamespaces = true;
+              serviceConfig.RestrictNamespaces = true;
-                RestrictRealtime = true;
+              serviceConfig.RestrictRealtime = true;
-                RestrictSUIDSGID = true;
+              serviceConfig.RestrictSUIDSGID = true;
-                SystemCallArchitectures = "native";
+              serviceConfig.SystemCallArchitectures = "native";
-                UMask = "0077";
+              serviceConfig.UMask = "0077";
-              };
             }
             exporter.serviceOpts
           ]
@@ -146,7 +144,7 @@ in
       {
         vmagent-scrape-exporters =
           let
-            inherit (config.services.victoriametrics) listenAddress;
+            listenAddress = config.services.victoriametrics.listenAddress;
             vmAddr = (lib.optionalString (lib.hasPrefix ":" listenAddress) "127.0.0.1") + listenAddress;
             promscrape = yaml.generate "prometheus.yml" {
               scrape_configs = lib.mapAttrsToList (
@@ -155,7 +153,7 @@ in
                   inherit (scrape) job_name;
                   static_configs =
                     scrape.static_configs
-                    ++ lib.optional (scrape.targets != [ ]) { inherit (scrape) targets; };
+                    ++ lib.optional (scrape.targets != [ ]) { targets = scrape.targets; };
                 } scrape.extraSettings
               ) config.services.victoriametrics.scrapeConfigs;
             };
@@ -214,7 +212,7 @@ in
 
     services.victoriametrics.scrapeConfigs =
       let
-        allExporters = lib.mapAttrs (_: exporter: { inherit (exporter) listenAddress port; }) (
+        allExporters = lib.mapAttrs (name: exporter: { inherit (exporter) listenAddress port; }) (
           (lib.filterAttrs (
             name: exporter:
             # A bunch of deprecated exporters that need to be ignored

configuration/services/metrics/victorialogs.nix

@@ -1,4 +1,8 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 let
   cfg = config.services.victorialogs;
 in

configuration/services/nextcloud.nix

@@ -9,19 +9,18 @@ let
   hostName = "nextcloud.${config.services.nginx.domain}";
 in
 {
-  services = {
+  services.nextcloud = {
-    nextcloud = {
     inherit hostName;
 
     package = nextcloud;
     phpPackage = lib.mkForce (
       pkgs.php.override {
-          packageOverrides = _: prev: {
+        packageOverrides = final: prev: {
           extensions = prev.extensions // {
-              pgsql = prev.extensions.pgsql.overrideAttrs (_: {
+            pgsql = prev.extensions.pgsql.overrideAttrs (old: {
               configureFlags = [ "--with-pgsql=${lib.getDev config.services.postgresql.package}" ];
             });
-              pdo_pgsql = prev.extensions.pdo_pgsql.overrideAttrs (_: {
+            pdo_pgsql = prev.extensions.pdo_pgsql.overrideAttrs (old: {
               configureFlags = [ "--with-pdo-pgsql=${lib.getDev config.services.postgresql.package}" ];
             });
           };
@@ -61,14 +60,17 @@ in
     };
   };
 
+  # Ensure that this service doesn't start before postgres is ready
+  systemd.services.nextcloud-setup.after = [ "postgresql.service" ];
+
   # Set up SSL
-    nginx.virtualHosts."${hostName}" = {
+  services.nginx.virtualHosts."${hostName}" = {
     forceSSL = true;
     useACMEHost = "tlater.net";
     # The upstream module already adds HSTS
   };
 
-    backups.nextcloud = {
+  services.backups.nextcloud = {
     user = "nextcloud";
     paths = [
       "/var/lib/nextcloud/nextcloud-db.sql"
@@ -96,8 +98,4 @@ in
       '';
     };
   };
-  };
-
-  # Ensure that this service doesn't start before postgres is ready
-  systemd.services.nextcloud-setup.after = [ "postgresql.service" ];
 }

configuration/services/webserver.nix

@@ -1,6 +1,6 @@
 { config, ... }:
 let
-  inherit (config.services.nginx) domain;
+  domain = config.services.nginx.domain;
 in
 {
   services.tlaternet-webserver = {

flake.nix

@@ -96,7 +96,7 @@
       #########
       # Tests #
       #########
-      checks.${system} = import ./checks (inputs // { inherit system; });
+      checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
 
       ###########################
       # Garbage collection root #
@@ -121,6 +121,8 @@
         run-vm = {
           type = "app";
           program =
+            let
+            in
             (pkgs.writeShellScript "" ''
               ${vm.config.system.build.vm.outPath}/bin/run-testvm-vm
             '').outPath;

modules/crowdsec/default.nix

@@ -267,7 +267,9 @@ in
       };
     };
 
-    systemd.packages = [ cfg.package ];
+    systemd.packages = [
+      cfg.package
+    ];
 
     environment = {
       systemPackages = [

modules/crowdsec/remediations/cs-firewall-bouncer.nix

@@ -6,11 +6,10 @@
   ...
 }:
 let
-  inherit (flake-inputs.self.packages.${pkgs.system}) crowdsec-firewall-bouncer;
-
   crowdsecCfg = config.security.crowdsec;
   cfg = crowdsecCfg.remediationComponents.firewallBouncer;
   settingsFormat = pkgs.formats.yaml { };
+  crowdsec-firewall-bouncer = flake-inputs.self.packages.${pkgs.system}.crowdsec-firewall-bouncer;
 in
 {
   options.security.crowdsec.remediationComponents.firewallBouncer = {
@@ -32,7 +31,9 @@ in
     security.crowdsec.remediationComponents.firewallBouncer.settings = {
       mode = lib.mkDefault "${if config.networking.nftables.enable then "nftables" else "iptables"}";
       log_mode = "stdout";
-      iptables_chains = [ "nixos-fw" ];
+      iptables_chains = [
+        "nixos-fw"
+      ];
 
       # Don't let users easily override this; unfortunately we need to
       # set up this key through substitution at runtime.
@@ -77,7 +78,9 @@ in
           requiredBy = [ "crowdsec.service" ];
 
           path =
-            lib.optionals (cfg.settings.mode == "ipset" || cfg.settings.mode == "iptables") [ pkgs.ipset ]
+            lib.optionals (cfg.settings.mode == "ipset" || cfg.settings.mode == "iptables") [
+              pkgs.ipset
+            ]
             ++ lib.optional (cfg.settings.mode == "iptables") pkgs.iptables
             ++ lib.optional (cfg.settings.mode == "nftables") pkgs.nftables;
         };

modules/crowdsec/remediations/default.nix

@@ -1 +1,5 @@
-{ imports = [ ./cs-firewall-bouncer.nix ]; }
+{
+  imports = [
+    ./cs-firewall-bouncer.nix
+  ];
+}

pkgs/crowdsec/hub.nix

@@ -1 +1,4 @@
-{ sources }: sources.crowdsec-hub.src
+{
+  sources,
+}:
+sources.crowdsec-hub.src