commit everything

hive.nix

@@ -6,54 +6,68 @@ let
 
   inherit (defaultNixpkgs) lib;
 
-  revision = node: (builtins.fromJSON (builtins.readFile ./npins/sources.json)).pins.${pkgsVersion node}.revision;
+  revision =
+    node:
+    (builtins.fromJSON (builtins.readFile ./npins/sources.json)).pins.${pkgsVersion node}.revision;
 
   mkNode = node: {
-    ${node} = {
-      name,
-      nodes,
-      ...
-    }: {
-      imports = [./machines/${node}/_configuration.nix] ++ lib.attrByPath [ "imports" ] [] metadata.nodes.${node};
-      inherit (metadata.nodes.${node}) deployment;
-      nix.nixPath =
-        builtins.map (n: "${n}=${sources.${n}}") (builtins.attrNames sources)
-        ++ ["nixpkgs=${mkNixpkgsPath name}"];
-      system.nixos.tags = [
-        (revision node)
-      ];
-    };
+    ${node} =
+      {
+        name,
+        nodes,
+        ...
+      }:
+      {
+        imports = [
+          ./machines/${node}/_configuration.nix
+        ] ++ lib.attrByPath [ "imports" ] [ ] metadata.nodes.${node};
+        inherit (metadata.nodes.${node}) deployment;
+        nix.nixPath = builtins.map (n: "${n}=${sources.${n}}") (builtins.attrNames sources) ++ [
+          "nixpkgs=${mkNixpkgsPath name}"
+        ];
+        system.nixos.tags = [
+          (revision node)
+        ];
+      };
   };
 
-  pkgsVersion = node: lib.attrByPath [ node "nixpkgs" ] "nixos-unstable" metadata.nodes;
+  pkgsVersion =
+    node:
+    lib.attrByPath [
+      node
+      "nixpkgs"
+    ] "nixos-unstable" metadata.nodes;
 
   mkNixpkgsPath = node: sources.${pkgsVersion node};
 
   mkNixpkgs = node: {
-    ${node} =
-      importNixpkgsPath
-      (lib.attrByPath [ "arch" ] "x86_64-linux" metadata.nodes.${node})
-      (mkNixpkgsPath node);
+    ${node} = importNixpkgsPath (lib.attrByPath [ "arch" ] "x86_64-linux" metadata.nodes.${node}) (
+      mkNixpkgsPath node
+    );
   };
 
-  importNixpkgsPath = arch: p: import p {
-    config.allowUnfree = true;
-    overlays = import ./pkgs/overlays.nix;
-    system = arch;
-  };
+  importNixpkgsPath =
+    arch: p:
+    import p {
+      config.allowUnfree = true;
+      overlays = import ./pkgs/overlays.nix;
+      system = arch;
+    };
 
   nodes = builtins.attrNames metadata.nodes;
 
-  concatAttrs = builtins.foldl' (x: y: x // y) {};
+  concatAttrs = builtins.foldl' (x: y: x // y) { };
 in
-  {
-    meta = {
-      specialArgs = {inherit metadata;};
-      nixpkgs = defaultNixpkgs;
-      nodeNixpkgs = concatAttrs (builtins.map mkNixpkgs nodes);
-      specialArgs = {
-        lib = lib;
-      };
+{
+  meta = {
+    specialArgs = {
+      inherit metadata;
     };
-  }
-  // (concatAttrs (builtins.map mkNode nodes))
+    nixpkgs = defaultNixpkgs;
+    nodeNixpkgs = concatAttrs (builtins.map mkNixpkgs nodes);
+    specialArgs = {
+      lib = lib;
+    };
+  };
+}
+// (concatAttrs (builtins.map mkNode nodes))

machines/hackens-milieu/_configuration.nix

@@ -5,21 +5,20 @@
 { config, pkgs, ... }:
 
 {
-  imports =
-    [
-      # Include the results of the hardware scan.
-      ./hardware-configuration.nix
-      ./aarch64.nix
-      ./audio.nix
-      ./dns
-      ./gnome.nix
-      ./i18n.nix
-      ./no-sleep.nix
-      ./programs.nix
-      ./system.nix
-      ./users.nix
-      ./vim.nix
-    ];
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    ./aarch64.nix
+    ./audio.nix
+    ./dns
+    ./gnome.nix
+    ./i18n.nix
+    ./no-sleep.nix
+    ./programs.nix
+    ./system.nix
+    ./users.nix
+    ./vim.nix
+  ];
 
   boot.loader.efi.canTouchEfiVariables = true;
   boot.loader.systemd-boot = {
@@ -43,4 +42,3 @@
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
   system.stateVersion = "20.09"; # Did you read the comment?
 }
-

machines/hackens-milieu/audio.nix

@@ -1,6 +1,5 @@
 { pkgs, ... }:
 {
   # Enable sound.
-  sound.enable = true;
   hardware.pulseaudio.enable = true;
 }

machines/hackens-milieu/default.nix

@@ -1,4 +1,6 @@
-{ pkgs, ... }: {
-  imports = [
-  ];
+{ pkgs, ... }:
+{
+  imports =
+    [
+    ];
 }

machines/hackens-milieu/dns/default.nix

@@ -6,7 +6,10 @@ let
 in
 {
   networking = {
-    nameservers = [ "127.0.0.1" "::1" ];
+    nameservers = [
+      "127.0.0.1"
+      "::1"
+    ];
   };
 
   services.dnscrypt-proxy2 = {
@@ -17,9 +20,13 @@ in
 
       forwarding_rules = ./forwarding.txt;
 
-      query_log = if debugDNS then {
-        file = "/dev/stdout";
-      } else {};
+      query_log =
+        if debugDNS then
+          {
+            file = "/dev/stdout";
+          }
+        else
+          { };
 
       sources.public-resolvers = {
         urls = [

machines/hackens-milieu/hardware-configuration.nix

@@ -1,36 +1,49 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
-  imports =
-    [
-      <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
-    ];
+  imports = [
+    <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
+  ];
 
-  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [
+    "ehci_pci"
+    "ahci"
+    "usbhid"
+    "sd_mod"
+    "sr_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
   # boot.kernelParams = [ "nomodeset" ];
 
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-label/nixos-root";
-      fsType = "btrfs";
-      options = [ "ssd" "noatime" "ssd_spread" "discard" "space_cache" ];
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos-root";
+    fsType = "btrfs";
+    options = [
+      "ssd"
+      "noatime"
+      "ssd_spread"
+      "discard"
+      "space_cache"
+    ];
+  };
 
-  fileSystems."/boot" =
-    {
-      device = "/dev/disk/by-label/BOOT";
-      fsType = "vfat";
-    };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/BOOT";
+    fsType = "vfat";
+  };
 
-  swapDevices =
-    [{ device = "/dev/disk/by-label/SWAP"; }];
+  swapDevices = [ { device = "/dev/disk/by-label/SWAP"; } ];
 
   nix.maxJobs = lib.mkDefault 4;
   powerManagement.cpuFreqGovernor = lib.mkDefault "performance";

machines/hackens-milieu/i18n.nix

@@ -1,4 +1,5 @@
-{ pkgs, ... }: {
+{ pkgs, ... }:
+{
   i18n.defaultLocale = "en_US.UTF-8";
   console = {
     font = "Lat2-Terminus16";

machines/hackens-milieu/no-sleep.nix

@@ -1,4 +1,5 @@
-{ ... }: {
+{ ... }:
+{
   systemd.targets = {
     sleep.enable = false;
     suspend.enable = false;

machines/hackens-milieu/system.nix

@@ -1,4 +1,5 @@
-{ pkgs, ... }: {
+{ pkgs, ... }:
+{
   # Upgrades
   system.autoUpgrade = {
     enable = true;
@@ -12,8 +13,10 @@
 
   # Auto-GC and store optimizations
   nix = {
-    trustedUsers = [ "root" "hackens" ];
-    package = pkgs.nixUnstable;
+    trustedUsers = [
+      "root"
+      "hackens"
+    ];
     gc = {
       automatic = true;
       dates = "weekly";

machines/hackens-milieu/users.nix

@@ -11,7 +11,12 @@ in
 {
   users.users.hackens = {
     isNormalUser = true;
-    extraGroups = [ "wheel" "dialout" "audio" "video" ];
+    extraGroups = [
+      "wheel"
+      "dialout"
+      "audio"
+      "video"
+    ];
 
     openssh.authorizedKeys.keys = [
       "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDcKULx/AgnqBsgwRX2BfV8waq6JXIkvZHhu9Y8paofM8awq6Om56BZoA7AV45YOcJxO/eFDOxSegXXmt22s4WjIf8I049aMdsW54BNpFpC/h18cMzm5ylKVGHl1ier/WXxpBsA8YU++YdRlGHPpKnhCtYLnBzD4Q5h+05GMIHismNZP1aGpE9s01FuP8eaDDkZUba7oSpn03AA77DBw4/2ZreSbqo96Z6WwiG09KeZvxFtEIk98EQtmiExB2fwsK3/JIxIBCoZHh4SzERcslxxGgzdppd6NhhSh7g523zhiihLaTAPNXBovGm5wcKOU9uWe+pUWEbwV04E+809aVbkJOdYBCtIf8M91meqpupA8jK38uquePHEFvpNr5UmY0qUlJCoqTvoqg9XgrfJVjlPEmYknj/QjQzkA4k19y8njsyEjnYOBL6tsztg6Igl+NZXjBAPuAzxCsfHOtWw1WM5gANwqOL0V9f7+14yST3HwweqjHRj4xky6ritxK+ujfc= hackens@hackens-desktop"

machines/hackens-milieu/vim.nix

@@ -1,6 +1,7 @@
-{ pkgs, ... }: {
+{ pkgs, ... }:
+{
   environment.systemPackages = with pkgs; [
-    nixfmt
+    nixfmt-rfc-style
     git
     (neovim.override {
       vimAlias = true;

machines/hackens-org/_configuration.nix

@@ -5,25 +5,25 @@
 { config, pkgs, ... }:
 
 {
-  imports =
-    [
-      ./_bootloader.nix
-      ./_networking.nix
-      ./_ssh.nix
-      ./_users.nix
-      ./dokuwiki.nix
-      ./hardware-configuration.nix
-      ./matterbridge.nix
-      ./nginx.nix
-      ./orga
-      ./secrets
-      ./static-sites.nix
-      ./legacy-redir.nix
-      ./webpass.nix
-      ./prometheus.nix
-      ./grafana.nix
-      ./kfet-monitor
-    ];
+  imports = [
+    ./_bootloader.nix
+    ./_networking.nix
+    ./_ssh.nix
+    ./_users.nix
+    ./dokuwiki.nix
+    ./hardware-configuration.nix
+    ./matterbridge.nix
+    ./nginx.nix
+    ./orga
+    ./snipe-it.nix
+    ./secrets
+    ./static-sites.nix
+    ./legacy-redir.nix
+    ./webpass.nix
+    ./prometheus.nix
+    ./grafana.nix
+    ./kfet-monitor
+  ];
 
   time.timeZone = "Europe/Paris";
 
@@ -38,4 +38,3 @@
   system.stateVersion = "22.11"; # Did you read the comment?
 
 }
-

machines/hackens-org/_networking.nix

@@ -29,14 +29,17 @@
         };
       };
       "10-tun-he" = {
-         matchConfig.Name = "sit-he";
-         networkConfig = {
-           Gateway = [ "2001:470:1f12:d21::1" ];
-           Description = "HE.NET IPv6 Tunnel (owned by maurice)";
-           Address = [ "2001:470:1f12:d21::2/64" ];
-         };
-       };
+        matchConfig.Name = "sit-he";
+        networkConfig = {
+          Gateway = [ "2001:470:1f12:d21::1" ];
+          Description = "HE.NET IPv6 Tunnel (owned by maurice)";
+          Address = [ "2001:470:1f12:d21::2/64" ];
+        };
+      };
     };
   };
-  networking.nameservers = [ "1.1.1.1" "8.8.8.8" ];
+  networking.nameservers = [
+    "1.1.1.1"
+    "8.8.8.8"
+  ];
 }

machines/hackens-org/_ssh.nix

@@ -1,11 +1,18 @@
-{ ... }: {
+{ ... }:
+{
   # Enable the OpenSSH daemon.
   services.openssh.enable = true;
   services.openssh.settings.PasswordAuthentication = false;
-  services.openssh.ports = [ 22 2222 ];
+  services.openssh.ports = [
+    22
+    2222
+  ];
 
   # Open ports in the firewall. (In fact not needed)
-  networking.firewall.allowedTCPPorts = [ 22 2222 ];
+  networking.firewall.allowedTCPPorts = [
+    22
+    2222
+  ];
 
   # Mosh <3
   programs.mosh.enable = true;

machines/hackens-org/_users.nix

@@ -1,12 +1,12 @@
-{ ... }: {
+{ ... }:
+{
   users = {
     mutableUsers = false;
     users = {
       rlahfa = {
         isNormalUser = true;
         extraGroups = [ "wheel" ];
-        hashedPassword =
-          "$6$y/I6nKCMYUku7$91vTR5kYz4nHyhbuA/j6kPsD8Vfo/Rg7ri6Ympftra9V6emOt/mPg0AScECtYjSIxretvfQ3sPUF1Ho0IWx381";
+        hashedPassword = "$6$y/I6nKCMYUku7$91vTR5kYz4nHyhbuA/j6kPsD8Vfo/Rg7ri6Ympftra9V6emOt/mPg0AScECtYjSIxretvfQ3sPUF1Ho0IWx381";
         openssh.authorizedKeys.keyFiles = [ ../../pubkeys/raito.keys ];
       };
       gdoriathdohler = {
@@ -17,8 +17,7 @@
       mdebray = {
         isNormalUser = true;
         extraGroups = [ "wheel" ];
-        hashedPassword =
-          "$6$ujz06kXa4TgvPAbF$NaXkDuOUpf3.fBRh7JuygtS0V2U/Bz4N3DpbOznO.md44xEdlKwPH/pSbL9CQJBhI5kodaKZeSaoCyhzybBPA/";
+        hashedPassword = "$6$ujz06kXa4TgvPAbF$NaXkDuOUpf3.fBRh7JuygtS0V2U/Bz4N3DpbOznO.md44xEdlKwPH/pSbL9CQJBhI5kodaKZeSaoCyhzybBPA/";
         openssh.authorizedKeys.keyFiles = [ ../../pubkeys/sinavir.keys ];
       };
       ecoppens = {

machines/hackens-org/dokuwiki.nix

@@ -1,4 +1,10 @@
-{ config, pkgs, lib, ... }: {
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
 
   services.nginx.virtualHosts."hackens.org" = {
     enableACME = true;
@@ -31,7 +37,7 @@
         showAddNewPage = "logged";
         fluidContainer = 0;
       };
-      plugin.htmlok.htmlok=1;
+      plugin.htmlok.htmlok = 1;
     };
     pluginsConfig = {
 
@@ -67,7 +73,7 @@
         postInstall = ''
           rm -r $out/share
           cp -r . $out
-          '';
+        '';
       }))
       (pkgs.fetchFromGitHub {
         name = "htmlok";

machines/hackens-org/gestiohackens/default.nix

@@ -0,0 +1,91 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  src = pkgs.fetchgit {
+    url = "https://git.rz.ens.wtf/HackENS/gestiojeux.git";
+    rev = "HEAD";
+    hash = "sha256-ly786xct9U4hdsHr7NLl23smnOfE891au9/GXqxpFb4=";
+  };
+in
+{
+  imports =
+    [
+    ];
+  systemd.services.django-gestiohackens.serviceConfig = {
+    DynamicUser = lib.mkForce false;
+    User = "django-gestiohackens";
+    SupplementaryGroups = [ "nginx" ];
+  };
+  users.users.django-gestiohackens = {
+    group = "django-gestiohackens";
+    isSystemUser = true;
+  };
+  users.groups.django-gestiohackens = { };
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    virtualHosts."inventaire.hackens.org" = {
+      enableACME = true;
+      forceSSL = true;
+      locations = {
+        "/" = {
+          proxyPass = "http://localhost:51667";
+        };
+        "/media/".alias = "/var/lib/django-gestiohackens/media/";
+        "/static".root = config.services.django.gestiohackens.staticAssets;
+      };
+    };
+  };
+  services.django.gestiohackens = {
+    inherit src;
+    enable = true;
+    mainModule = "gestiojeux";
+    port = 51667;
+    settings = {
+      DEBUG = false;
+      CSRF_COOKIE_SECURE = true;
+      AUTHENS_ALLOW_STAFF = true;
+      SESSION_COOKIE_SECURE = true;
+      MEDIA_URL = "media/";
+      ALLOWED_HOSTS = [ "inventaire.hackens.org" ];
+      DATABASES = {
+        "default" = {
+          "ENGINE" = "django.db.backends.sqlite3";
+          "NAME" = "/var/lib/django-gestiohackens/db.sqlite3";
+        };
+      };
+      HAYSTACK_CONNECTIONS = {
+        "default" = {
+          "ENGINE" = "haystack.backends.whoosh_backend.WhooshEngine";
+          "PATH" = "/var/lib/django-gestiohackens/whoosh_index";
+        };
+      };
+      MEDIA_ROOT = "/var/lib/django-gestiohackens/media";
+    };
+    extraPackages = ps: [
+      ps.django-autoslug
+      ps.loadcredential
+      ps.django-cleanup
+      ps.django-haystack
+      ps.django-markdownx
+      ps.django-tables2
+      ps.pillow
+      ps.whoosh
+      ps.markdown-icons
+      ps.authens
+
+      ps.qrcode
+      ps.pillow
+
+      # Django haystack is drunk
+      ps.setuptools
+    ];
+    secrets = {
+      SECRET_KEY = config.age.secrets.django-gestiohackens.path;
+    };
+  };
+}

machines/hackens-org/hardware-configuration.nix

@@ -1,32 +1,39 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [
-      (modulesPath + "/profiles/qemu-guest.nix")
-    ];
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
 
-  boot.initrd.availableKernelModules = [ "uhci_hcd" "ahci" "virtio_pci" "virtio_blk" ];
+  boot.initrd.availableKernelModules = [
+    "uhci_hcd"
+    "ahci"
+    "virtio_pci"
+    "virtio_blk"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/8deb32c9-ee6a-4de8-94da-239c8ec509a2";
-      fsType = "btrfs";
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/8deb32c9-ee6a-4de8-94da-239c8ec509a2";
+    fsType = "btrfs";
+  };
 
-  fileSystems."/boot" =
-    {
-      device = "/dev/disk/by-uuid/0795-75ED";
-      fsType = "vfat";
-    };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/0795-75ED";
+    fsType = "vfat";
+  };
 
-  swapDevices =
-    [{ device = "/dev/disk/by-uuid/bd7c1c01-ce31-4db3-9c06-70716020e24a"; }];
+  swapDevices = [ { device = "/dev/disk/by-uuid/bd7c1c01-ce31-4db3-9c06-70716020e24a"; } ];
 
 }

machines/hackens-org/kfet-monitor/default.nix

@@ -1,6 +1,6 @@
-{ lib, pkgs, ...}:
+{ lib, pkgs, ... }:
 let
-  wsScraper = pkgs.callPackage ./websocket-exporter.nix {};
+  wsScraper = pkgs.callPackage ./websocket-exporter.nix { };
 in
 {
   systemd.services.kfet-open-recorder = {

machines/hackens-org/kfet-monitor/websocket-exporter.nix

@@ -1,6 +1,7 @@
-{ lib
-, python3
-, fetchFromGitHub
+{
+  lib,
+  python3,
+  fetchFromGitHub,
 }:
 
 python3.pkgs.buildPythonApplication rec {

machines/hackens-org/legacy-redir.nix

@@ -28,28 +28,28 @@
       enableACME = true;
       extraConfig = ''
         return 301 $scheme://hackens.org/known$request_uri;
-        '';
+      '';
     };
     "prez.hackens.org" = {
       forceSSL = true;
       enableACME = true;
       extraConfig = ''
         return 301 $scheme://hackens.org/prez$request_uri;
-        '';
+      '';
     };
     "pub.hackens.org" = {
       forceSSL = true;
       enableACME = true;
       extraConfig = ''
         return 301 $scheme://hackens.org/pub$request_uri;
-        '';
+      '';
     };
     "2048.hackens.org" = {
       forceSSL = true;
       enableACME = true;
       extraConfig = ''
         return 301 $scheme://hackens.org/2048$request_uri;
-        '';
+      '';
     };
   };
 }

machines/hackens-org/matterbridge.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 let
   port = 52187;
   configFile = pkgs.writeText "metterbridge.toml" ''
@@ -37,7 +42,6 @@ in
       ${pkgs.matterbridge}/bin/matterbridge -conf ${configFile}
     '';
 
-
     serviceConfig = {
       User = "matterbridge";
       Group = "matterbridge";

machines/hackens-org/orga/authens.nix

@@ -1,12 +0,0 @@
-{ lib, fetchgit, pythoncas, django, ldap, buildPythonPackage }:
-buildPythonPackage rec {
-  pname = "authens";
-  version = "v0.1b5";
-  doCheck = false;
-  src = fetchgit {
-    url = "https://git.eleves.ens.fr/klub-dev-ens/authens.git";
-    rev = "58747e57b30b47f36a0ed3e7c80850ed7f1edbf9";
-    hash = "sha256-R0Nw212/BOPHfpspT5wzxtji1vxZ/JOuwr00naklWE8=";
-  };
-  propagatedBuildInputs = [ django ldap pythoncas ];
-}

machines/hackens-org/orga/default.nix

@@ -1,14 +1,20 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 let
- src = pkgs.fetchgit {
-      url = "https://git.rz.ens.wtf/HackENS/hackens-orga.git";
-      rev = "HEAD";
-      hash = "sha256-BiOKGeDPVp7EV/q4S9Zc54jUeBTpfOs5e/MsCPGAk/I=";
-    };
+  src = pkgs.fetchgit {
+    url = "https://git.rz.ens.wtf/HackENS/hackens-orga.git";
+    rev = "HEAD";
+    hash = "sha256-BiOKGeDPVp7EV/q4S9Zc54jUeBTpfOs5e/MsCPGAk/I=";
+  };
 in
 {
-  imports = [
-  ];
+  imports =
+    [
+    ];
   services.nginx = {
     enable = true;
     recommendedProxySettings = true;
@@ -38,8 +44,8 @@ in
         };
       };
     };
-    extraPackages = p: let pythoncas = (p.callPackage ./python-cas.nix { }); in [
-      (p.callPackage ./authens.nix { inherit pythoncas; })
+    extraPackages = p: [
+      p.authens
     ];
     secrets = {
       SECRET_KEY = config.age.secrets.django.path;

machines/hackens-org/programs.nix

@@ -1,4 +1,5 @@
-{ pkgs, ... }: {
+{ pkgs, ... }:
+{
   environment.systemPackages = [
     pkgs.vim
   ];

machines/hackens-org/prometheus.nix

@@ -24,18 +24,20 @@ in
 
     extraFlags = [ "--storage.tsdb.retention.size=2GB" ];
 
-    rules = [ ''
-      groups:
-        - name: Chrony
-          rules:
-            - record: instance:chrony_clock_error_seconds:abs
-              expr: >
-                abs(chrony_tracking_last_offset_seconds)
-                +
-                chrony_tracking_root_dispersion_seconds
-                +
-                (0.5 * chrony_tracking_root_delay_seconds)
-    ''];
+    rules = [
+      ''
+        groups:
+          - name: Chrony
+            rules:
+              - record: instance:chrony_clock_error_seconds:abs
+                expr: >
+                  abs(chrony_tracking_last_offset_seconds)
+                  +
+                  chrony_tracking_root_dispersion_seconds
+                  +
+                  (0.5 * chrony_tracking_root_delay_seconds)
+      ''
+    ];
 
     scrapeConfigs = [
       {

machines/hackens-org/secrets/default.nix

@@ -1,7 +1,15 @@
-{ ... }: {
+{ ... }:
+{
   age.secrets."django" = {
     file = ./django.age;
   };
+  age.secrets."snipeit" = {
+    file = ./snipeit.age;
+    owner = "snipeit";
+  };
+  age.secrets."django-gestiohackens" = {
+    file = ./django-gestiohackens.age;
+  };
   age.secrets."matterbridge-env" = {
     file = ./matterbridge-env.age;
     owner = "matterbridge";

machines/hackens-org/secrets/django-gestiohackens.age

@@ -0,0 +1,28 @@
+age-encryption.org/v1
+-> ssh-ed25519 JGx7Ng bMdvEX7j6bw5GNBohOahx43feq2/5/j/sm4+gLBCqls
+SJAb40fN72h2/e6TFxKyF270xGtBq5EICpQB7Oe6KnU
+-> ssh-ed25519 kXobKQ P1Ve/+t8nPrzu0qBL0EVnVH8X8f7/O93pH5ImPGnfVU
+cG2dTLsKuY0mJhApuRw4ShlcpjPHfbobN+wxnpW42qE
+-> ssh-ed25519 7hZk0g 7cPMy1bOSScXdk5xUiBrWM1noZ7QA9td+ffAlJGuKDg
+2GrbxwLERVZgMAsAxhxVkEt2dAwv3lK2tmi+feDi9Bw
+-> ssh-rsa krWCLQ
+raDB1S2KgNXYYjYQoReSNbsMPBt8qUerW2I5Tiewco5Ao/iGuQPfaMxtuHPvk82r
+VIpznCS6ZyEFkyFKCC/rnzgeTmH8LDAuGPSjCFOicq7STjhVqgjdaERkw4s6UxRN
+WTQVhuVpRaN8abdxMknQG+1WpkdmlOQG6n+B7JN/Z5AgM4kE891CH+WJcaPetDwO
+/wC6+Na3EkgJS2XrK++IveWGmRRy+CZdRNe/NzxNCV2wp+w1BJohHttq7gRc2F7z
+58r6GzViXSAZ39QfKMO5e1MrkZHfzshc74jpkMnLWK9QXWsbTbkYJzeYf7wWCm9F
+STRR5xQJIZdOEYKNsIfb6Q
+-> ssh-ed25519 /vwQcQ gYKVPzT6ZXSc9xfuulV/57pIM1NXJ9IlLF/kJMRMWGw
+4FiYaBIoC1hmYayoWUfomIHg2ibtHsBtyYMzMs8OcSA
+-> ssh-ed25519 0R97PA GKMaGC4HmLhIL3pNEqiYqZ8a04CYgKt13IcRsJwQ2l8
+/8ePse2mnztxXGJrDLpr1yUcnyrm9AUQgUWV4fUcmXk
+-> ssh-ed25519 cvTB5g CBw8+xqz9S9S5t7/TY7oz21WdhIqtWNv0WAbU16bayk
+cUmHOQsoyaXkWVwYK9fK+CoAvYtDGcYF+JV3GgxzPYI
+-> ssh-ed25519 Wu8JLQ VRDbadjqSTsmF/gkFe/Fg9OcxOFJDur0NJhexgObJy0
+C1/W8PbucQUpYfVomvK0S/JIrHOcdGfpmru7hbvLdGY
+-> ssh-ed25519 EIt1vA SlgOWnU5N7XUX/tpp2cOH+7d1fl6qjy5R4D8lyTr004
+UBNV6PrfOB1jRV+GATefjpv1KEGyP06cKD741xzS8Gc
+-> ssh-ed25519 X51wxg h1LfGf2RiFSAaUbLjAivqkX/f0rvxAO905NUYCrX7gk
+ppAwL7fboGHlPptL2uQU5nBUI1FXCs6Ds3TMzG8WKxA
+--- XgL6A4y8r8g55SKB86IIv+vb3Yo3ovpH+KQURMAtwg4
+"Ú<> b.äcb¾Er<45>÷¹š·{»¦Öl(Ó§PßÄ2…e#ùòõ”3¾<33>ÏC‡P¹…	|á˜I0ÔÜ¥S@ʪëQ¸ÝYæ'5…<35>µ

machines/hackens-org/secrets/secrets.nix

@@ -1,20 +1,46 @@
 let
   lib = (import <nixpkgs> { }).lib;
-  readpubkeys = user:
-    builtins.filter (k: k != "")
-      (lib.splitString "\n" (builtins.readFile (../../../pubkeys + "/${user}.keys")));
+  readpubkeys =
+    user:
+    builtins.filter (k: k != "") (
+      lib.splitString "\n" (builtins.readFile (../../../pubkeys + "/${user}.keys"))
+    );
 in
 {
-  "matterbridge-env.age".publicKeys = (readpubkeys "sinavir")
-    ++ (readpubkeys "hackens-host") ++ (readpubkeys "raito")
-    ++ (readpubkeys "gdd") ++ (readpubkeys "backslash");
-  "django.age".publicKeys = (readpubkeys "sinavir")
-    ++ (readpubkeys "hackens-host") ++ (readpubkeys "raito")
-    ++ (readpubkeys "gdd") ++ (readpubkeys "backslash");
-  "wg-key.age".publicKeys = (readpubkeys "sinavir")
-    ++ (readpubkeys "hackens-host") ++ (readpubkeys "raito")
-    ++ (readpubkeys "gdd") ++ (readpubkeys "backslash");
-  "prometheus-webconf".publicKeys = (readpubkeys "sinavir")
-    ++ (readpubkeys "hackens-host") ++ (readpubkeys "raito")
-    ++ (readpubkeys "gdd") ++ (readpubkeys "backslash");
+  "matterbridge-env.age".publicKeys =
+    (readpubkeys "sinavir")
+    ++ (readpubkeys "hackens-host")
+    ++ (readpubkeys "raito")
+    ++ (readpubkeys "gdd")
+    ++ (readpubkeys "backslash");
+  "snipeit.age".publicKeys =
+    (readpubkeys "sinavir")
+    ++ (readpubkeys "hackens-host")
+    ++ (readpubkeys "raito")
+    ++ (readpubkeys "gdd")
+    ++ (readpubkeys "backslash");
+  "django.age".publicKeys =
+    (readpubkeys "sinavir")
+    ++ (readpubkeys "hackens-host")
+    ++ (readpubkeys "raito")
+    ++ (readpubkeys "gdd")
+    ++ (readpubkeys "backslash");
+  "django-gestiohackens.age".publicKeys =
+    (readpubkeys "sinavir")
+    ++ (readpubkeys "hackens-host")
+    ++ (readpubkeys "raito")
+    ++ (readpubkeys "gdd")
+    ++ (readpubkeys "backslash");
+  "wg-key.age".publicKeys =
+    (readpubkeys "sinavir")
+    ++ (readpubkeys "hackens-host")
+    ++ (readpubkeys "raito")
+    ++ (readpubkeys "gdd")
+    ++ (readpubkeys "backslash");
+  "prometheus-webconf".publicKeys =
+    (readpubkeys "sinavir")
+    ++ (readpubkeys "hackens-host")
+    ++ (readpubkeys "raito")
+    ++ (readpubkeys "gdd")
+    ++ (readpubkeys "backslash");
 }

machines/hackens-org/secrets/snipeit.age

@@ -0,0 +1,29 @@
+age-encryption.org/v1
+-> ssh-ed25519 JGx7Ng 6OHSOGM9Q4Us9F0dbVCiwWKzse3pRYAgJpAA6IPIdnQ
+HqD9hdgqQqM3ZrivBDdYGHXtWF2XF/twsWw+vgsMvFQ
+-> ssh-ed25519 kXobKQ PPSORbXqcXh4nyJp9zSiZsPj4M43xnYQTQOwStxRh2A
+I3y7+s74YH5clRMT2yqt4EHNF008zVX8qJmymoGZrFM
+-> ssh-ed25519 7hZk0g g6OU5HYXe3oc5gwSpHwChaLFxJ367vqOCGUKUOHvvGE
+r4/WjMwACs6L8XPdun9C2MlOoBh/osc/16z344C8gTU
+-> ssh-rsa krWCLQ
+GBk11DEIlkEuqQ8IYRohr86rOGzr9Wh9SMxc5ukxpj1mLtiJhurGS98kpFO1Ybsa
+6ik+mxl4OmQqKwsJFFqrOeOg2R4ORwoldDPZT0LB/DoQyVS5DzS6JRjxskvrmows
+X7QLfeMZ9HYgpi5wsN++E3a3Kka/ulBAfksw4g+LquZwCP3FBKN/DEwsGCMuWnKW
+SkYIBgiEDWCMB4W7QuafDR4sw19e9V06BTqghpjDaxHpG36srA3sfL3X/i6gjgz8
+nV/Hu19qVCLNf08Z+0T3qF4LWLKCFZkZFizttGao5cb6t4Kw/kiLsudPmvVjne6n
+jVq5JSrZiSNA0SgJ1cK3dg
+-> ssh-ed25519 /vwQcQ 8YA7/bMsUIr5Y/EzZbfeamwmeXD5EwQ6oO7PWiziO3k
+tvGAoGnGPCMPgaZ61dWQ/5I3tiVLYkEJGb4D/OfCzYY
+-> ssh-ed25519 0R97PA we+Q49vxyES8lHcdsJfDs3RsPvZh097G7jGEpHPCLHk
+vlq2ylTC8//Bv4rVaBGesTr7SUd7s7To93FSrz45+4Y
+-> ssh-ed25519 cvTB5g EIqyNfE/A1e4lICBqgwviXlM73GL6YH8ADqfIVCGe0U
+ajHEiVrEAPk0bxNkbXX6FWDXeom8inTUamq/ToI7Kbg
+-> ssh-ed25519 Wu8JLQ +4eSVyk9FMUBjgi65ukfx6MFNr3DomHcONPo71QsrTc
+/4Pr60oSZmSneQcUXffq+wEJCt2zHRC1pkn/l6onwog
+-> ssh-ed25519 EIt1vA 3M3zoHSBceyiQDLRkeGOjRHLkljrc2xRMOlhZy8Gs0g
+C21xBrCwuskiZXSo+Ucl3HDChAO9V2sauGSCdj+2pwI
+-> ssh-ed25519 X51wxg EhYdCmwgYWBHj3QAatGYlcX5qMQJaFlwkzyspQLfiTY
+L0aeN67YVWuY5aSdQLi1qwyJ3TcwSH/Fs+hAFLZL/DE
+--- gUY9ofxPOoMCmNT+HJvc3j83MPBoO1KnxW5UCfsNZ78
+­Š!T°{˜	KWÆ<57>L
+¢Uðƒ(q>.¾+ÏS‘G¤ãð	[¯+j
¿rý}ׄ„<E2809E>¾¥ý.
d¢c…„âZ‘eW¸&
m}t}

machines/hackens-org/snipe-it.nix

@@ -0,0 +1,22 @@
+{ config, ... }:
+{
+  services.snipe-it = {
+    enable = true;
+    appKeyFile = config.age.secrets."snipeit".path;
+    config = {
+      APP_LOCALE = "fr-FR";
+      APP_TIMEZONE = "Europe/Paris";
+    };
+    database = {
+      createLocally = true;
+      user = "snipeit";
+    };
+    user = "snipeit";
+    group = "snipeit";
+    hostName = "inventaire.hackens.org";
+    nginx = {
+      enableACME = true;
+      forceSSL = true;
+    };
+  };
+}

machines/hackens-org/static-sites.nix

@@ -19,10 +19,13 @@ in
         extraConfig = ''
           autoindex on;
           charset utf-8;
-          '';
+        '';
       });
     };
 
   };
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
 }

machines/hackens-org/webpass.nix

@@ -37,5 +37,8 @@
       proxyWebsockets = true;
     };
   };
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
 }

machines/hackens-org/wireguard.nix

@@ -3,7 +3,8 @@
   lib,
   pkgs,
   ...
-}: {
+}:
+{
   systemd.network = {
     enable = true;
     networks = {
@@ -12,15 +13,12 @@
         address = [
           "10.10.10.1/24"
         ];
-        routes =  [{
-          routeConfig = {
+        routes = [
+          {
             Destination = "10.10.10.0/24";
             Scope = "link";
-          };
-        }];
-        networkConfig = {
-          IPForward = true;
-        };
+          }
+        ];
       };
     };
     netdevs = {
@@ -35,37 +33,33 @@
         };
 
         wireguardPeers = [
-          { #hackens-desktop
-            wireguardPeerConfig = {
-              AllowedIPs = [
-                "10.10.10.3/32"
-              ];
-              PublicKey = "h4Nf+e4JIjqOMuM5JtLN298BF/fym9fWKGtRZmS5MVA=";
-            };
+          {
+            # hackens-desktop
+            AllowedIPs = [
+              "10.10.10.3/32"
+            ];
+            PublicKey = "h4Nf+e4JIjqOMuM5JtLN298BF/fym9fWKGtRZmS5MVA=";
           }
-          { #bakham (AGB)
-            wireguardPeerConfig = {
-              AllowedIPs = [
-                "10.10.10.5/32"
-              ];
-              PublicKey = "JpUHFiavhlQfiHfOdUffQP3HLLeStttheACCaqlXAF8=";
-            };
+          {
+            # bakham (AGB)
+            AllowedIPs = [
+              "10.10.10.5/32"
+            ];
+            PublicKey = "JpUHFiavhlQfiHfOdUffQP3HLLeStttheACCaqlXAF8=";
           }
-          { #soyouzpanda
-            wireguardPeerConfig = {
-              AllowedIPs = [
-                "10.10.10.11/32"
-              ];
-              PublicKey = "/xjWqkiyHY93wqo/Apj5SHP8UaXF4mKQRVwylKC2wy8=";
-            };
+          {
+            # soyouzpanda
+            AllowedIPs = [
+              "10.10.10.11/32"
+            ];
+            PublicKey = "/xjWqkiyHY93wqo/Apj5SHP8UaXF4mKQRVwylKC2wy8=";
           }
-          { #sinavir
-            wireguardPeerConfig = {
-              AllowedIPs = [
-                "10.10.10.12/32"
-              ];
-              PublicKey = "kmc3PexCMKm1Tg8WUDbHaOkcWLl8KUh52CtrDOODf0M=";
-            };
+          {
+            # sinavir
+            AllowedIPs = [
+              "10.10.10.12/32"
+            ];
+            PublicKey = "kmc3PexCMKm1Tg8WUDbHaOkcWLl8KUh52CtrDOODf0M=";
           }
         ];
       };

machines/rigel/_configuration.nix

@@ -4,11 +4,13 @@
   pkgs,
   modulesPath,
   ...
-}: let
-  launchpad =
-    pkgs.python3.withPackages ( ps: [ (ps.callPackage ./launchpad.nix { lpminimk3 = ps.callPackage ./lpminimk3.nix {}; })]);
+}:
+let
+  launchpad = pkgs.python3.withPackages (ps: [
+    (ps.callPackage ./launchpad.nix { lpminimk3 = ps.callPackage ./lpminimk3.nix { }; })
+  ]);
 in
-  {
+{
   imports = [
     (modulesPath + "/installer/sd-card/sd-image-aarch64.nix")
     ./bootloader.nix
@@ -19,8 +21,7 @@ in
     ./users.nix
   ];
 
-  nix.settings.substituters = lib.mkForce [];
-
+  nix.settings.substituters = lib.mkForce [ ];
 
   networking.hostName = "rigel"; # Define your hostname.
 
@@ -34,7 +35,10 @@ in
   systemd.services.launchpad = {
     wantedBy = [ "multi-user.target" ];
     after = [ "network.target" ];
-    path = [ launchpad pkgs.unixtools.ping ];
+    path = [
+      launchpad
+      pkgs.unixtools.ping
+    ];
     script = ''
       while ! ping -n -w 1 -c 1 10.1.1.2 &> /dev/null
       do
@@ -42,7 +46,7 @@ in
       done
       sleep 0.1
       python -m eos_midi 10.1.1.2
-      '';
+    '';
   };
   environment.shellAliases = {
     r = "systemctl restart launchpad.service";

machines/rigel/bootloader.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   boot.loader.grub.enable = false;
   boot.loader.generic-extlinux-compatible.enable = true;
 }

machines/rigel/kfet_lauchpad_controller.nix

@@ -1,9 +1,10 @@
-{ lib
-, buildPythonPackage
-, fetchgit
-, poetry
-, lpminimk3
-, python-osc
+{
+  lib,