11 files changed, 145 insertions, 10 deletions

diff --git a/flakes/private/chatons/flake.lock b/flakes/private/chatons/flake.lock
index 5e84cc2..1e163a2 100644
--- a/flakes/private/chatons/flake.lock
+++ b/flakes/private/chatons/flake.lock
@@ -3,7 +3,7 @@
     "environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-VO82m/95IcX3xxJ63wcLh3hXzXDRFKUohYil/18pBSY=",
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
         "path": "../environment",
         "type": "path"
       },
diff --git a/flakes/private/environment/flake.nix b/flakes/private/environment/flake.nix
index 24cbb7a..389a601 100644
--- a/flakes/private/environment/flake.nix
+++ b/flakes/private/environment/flake.nix
@@ -369,6 +369,36 @@
               };
             };
           };
+          borg_backup = mkOption {
+            description = ''
+              Remote backup with borg/borgmatic
+            '';
+            type = submodule {
+              options = {
+                password = mkOption { type = str; description = "Password for encrypting files"; };
+                remotes = mkOption {
+                  type = attrsOf (submodule {
+                    options = {
+                      remote = mkOption {
+                        type = functionTo (functionTo str);
+                        example = literalExample ''
+                          bucket: "ssh://some_host/${bucket}";
+                          '';
+                        description = ''
+                          Function.
+                          Takes a bucket name as argument and returns a url
+                          '';
+                      };
+                      sshRsyncPort = mkOption { type = str; default = "22"; description = "SSH port"; };
+                      sshRsyncHost = mkOption { type = nullOr str; default = null; description = "SSH host"; };
+
+                      sshKnownHosts = mkOption { type = nullOr str; default = null; description = "Ssh known hosts"; };
+                    };
+                  });
+                };
+              };
+            };
+          };
           backup = mkOption {
             description = ''
               Remote backup with duplicity
@@ -379,6 +409,9 @@
                 remotes = mkOption {
                   type = attrsOf (submodule {
                     options = {
+                      remote_type = mkOption {
+                        type = enum [ "s3" "rsync" ];
+                      };
                       remote = mkOption {
                         type = functionTo str;
                         example = literalExample ''
@@ -389,8 +422,12 @@
                           Takes a bucket name as argument and returns a url
                           '';
                       };
-                      accessKeyId = mkOption { type = str; description = "Remote access-key"; };
-                      secretAccessKey = mkOption { type = str; description = "Remote access secret"; };
+                      sshRsyncPort = mkOption { type = str; default = "22"; description = "SSH port for rsync"; };
+                      sshRsyncHost = mkOption { type = nullOr str; default = null; description = "SSH host for rsync"; };
+
+                      sshKnownHosts = mkOption { type = nullOr str; default = null; description = "Ssh known hosts"; };
+                      s3AccessKeyId = mkOption { type = nullOr str; default = null; description = "Remote access-key"; };
+                      s3SecretAccessKey = mkOption { type = nullOr str; default = null; description = "Remote access secret"; };
                     };
                   });
                 };
@@ -905,6 +942,14 @@
                     };
                   };
                 };
+                matrix = mkOption {
+                  description = "Matrix configuration";
+                  type = submodule {
+                    options = {
+                      ldap = mkLdapOptions "Mediagoblin" {};
+                    };
+                  };
+                };
                 mediagoblin = mkOption {
                   description = "Mediagoblin configuration";
                   type = submodule {
diff --git a/flakes/private/mail-relay/flake.lock b/flakes/private/mail-relay/flake.lock
index d1447b7..4d620ad 100644
--- a/flakes/private/mail-relay/flake.lock
+++ b/flakes/private/mail-relay/flake.lock
@@ -3,7 +3,7 @@
     "environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-VO82m/95IcX3xxJ63wcLh3hXzXDRFKUohYil/18pBSY=",
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
         "path": "../environment",
         "type": "path"
       },
diff --git a/flakes/private/milters/flake.lock b/flakes/private/milters/flake.lock
index e2366fa..6891e49 100644
--- a/flakes/private/milters/flake.lock
+++ b/flakes/private/milters/flake.lock
@@ -3,7 +3,7 @@
     "environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-VO82m/95IcX3xxJ63wcLh3hXzXDRFKUohYil/18pBSY=",
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
         "path": "../environment",
         "type": "path"
       },
diff --git a/flakes/private/monitoring/flake.lock b/flakes/private/monitoring/flake.lock
index e76ca08..cdba7c2 100644
--- a/flakes/private/monitoring/flake.lock
+++ b/flakes/private/monitoring/flake.lock
@@ -3,7 +3,7 @@
     "environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-VO82m/95IcX3xxJ63wcLh3hXzXDRFKUohYil/18pBSY=",
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
         "path": "../environment",
         "type": "path"
       },
diff --git a/flakes/private/monitoring/flake.nix b/flakes/private/monitoring/flake.nix
index b7c3997..5610d67 100644
--- a/flakes/private/monitoring/flake.nix
+++ b/flakes/private/monitoring/flake.nix
@@ -164,6 +164,13 @@
                 Whether to enable monitoring.
               '';
             };
+            smartdDisks = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [];
+              description = ''
+                List of smartd disks ids (symlinks in /dev/disk/by-id/) to monitor
+              '';
+            };
             master = lib.mkOption {
               type = lib.types.bool;
               default = false;
@@ -261,6 +268,54 @@
             objectDefs =
               self.lib.toObjects cfg.objects;
           };
+
+          myServices.monitoring.objects.service = builtins.map (d: {
+            service_description = "Disk /dev/disk/by-id/${d} is sane";
+            use = "local-service";
+            check_command = [ "check_smartctl" "/dev/disk/by-id/${d}" ];
+            __passive_servicegroups = "webstatus-resources";
+
+            check_interval = 60;
+          }) cfg.smartdDisks;
+
+          systemd = let
+            checkShortTimer = {
+              timerConfig = {
+                OnCalendar = "monthly";
+                RandomizedDelaySec = "3 weeks";
+                FixedRandomDelay = true;
+              };
+              wantedBy = [ "timers.target" ];
+            };
+            checkLongTimer = {
+              timerConfig = {
+                OnCalendar = "monthly";
+                RandomizedDelaySec = "3 weeks";
+                FixedRandomDelay = true;
+              };
+              wantedBy = [ "timers.target" ];
+            };
+            toSDTimers = id: {
+              "check-smartd-long-${id}" = checkLongTimer;
+              "check-smartd-short-${id}" = checkShortTimer;
+            };
+            toCheckService = id: type: {
+              description = "Run ${type} smartctl test for /dev/disk/by-id/${id}";
+              after = [ "multi-user.target" ];
+              serviceConfig = {
+                Type = "oneshot";
+                ExecStart = "${pkgs.smartmontools}/bin/smartctl -t ${type} /dev/disk/by-id/${id}";
+              };
+            };
+            toSDServices = id: {
+              "check-smartd-long-${id}" = toCheckService id "long";
+              "check-smartd-short-${id}" = toCheckService id "short";
+            };
+
+          in {
+            services = lib.attrsets.mergeAttrsList (builtins.map toSDServices cfg.smartdDisks);
+            timers = lib.attrsets.mergeAttrsList (builtins.map toSDTimers cfg.smartdDisks);
+          };
         };
       };
   };
diff --git a/flakes/private/monitoring/myplugins.nix b/flakes/private/monitoring/myplugins.nix
index f76f2c1..bb3a383 100644
--- a/flakes/private/monitoring/myplugins.nix
+++ b/flakes/private/monitoring/myplugins.nix
@@ -284,6 +284,30 @@ in
       ]}
     '';
   };
+  smartctl = {
+    commands = {
+      check_smartctl = "$USER2$/check_smartctl -i auto -d $ARG1$";
+    };
+    chunk = let
+      smartPlugin = pkgs.fetchurl {
+        url = "https://www.claudiokuenzler.com/monitoring-plugins/check_smart.pl";
+        sha256 = "sha256-gxGkzyycUl+I3WziKhOnZSoQjpqbPqjbunfUQxmeb7w=";
+      };
+    in ''
+      cp ${smartPlugin} $out/check_smartctl
+      chmod +x $out/check_smartctl
+      patchShebangs $out
+      substituteInPlace $out/check_smartctl --replace "/usr/bin /bin /usr/sbin /sbin /usr/local/bin /usr/local/sbin" "${pkgs.smartmontools}/bin"
+      substituteInPlace $out/check_smartctl --replace "sudo" "${sudo}"
+    '';
+
+    sudo = _: {
+      commands = [
+        { command = "${pkgs.smartmontools}/bin/smartctl *"; options = [ "NOPASSWD" ]; }
+      ];
+      runAs = "root";
+    };
+  };
   mysql = {
     commands = {
       check_mysql_replication = "${sudo} -u mysql $USER2$/check_mysql_replication \"$ARG1$\" \"$ARG2$\"";
diff --git a/flakes/private/opendmarc/flake.lock b/flakes/private/opendmarc/flake.lock
index a2eea1a..15fea39 100644
--- a/flakes/private/opendmarc/flake.lock
+++ b/flakes/private/opendmarc/flake.lock
@@ -3,7 +3,7 @@
     "environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-VO82m/95IcX3xxJ63wcLh3hXzXDRFKUohYil/18pBSY=",
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
         "path": "../environment",
         "type": "path"
       },
diff --git a/flakes/private/ssh/flake.lock b/flakes/private/ssh/flake.lock
index d1447b7..4d620ad 100644
--- a/flakes/private/ssh/flake.lock
+++ b/flakes/private/ssh/flake.lock
@@ -3,7 +3,7 @@
     "environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-VO82m/95IcX3xxJ63wcLh3hXzXDRFKUohYil/18pBSY=",
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
         "path": "../environment",
         "type": "path"
       },
diff --git a/flakes/private/system/flake.lock b/flakes/private/system/flake.lock
index 49fb3b5..c6362c5 100644
--- a/flakes/private/system/flake.lock
+++ b/flakes/private/system/flake.lock
@@ -19,7 +19,7 @@
     "environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-VO82m/95IcX3xxJ63wcLh3hXzXDRFKUohYil/18pBSY=",
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
         "path": "../environment",
         "type": "path"
       },
@@ -69,7 +69,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-etK0kcWYmiCmdex+9CjWWqn4q8EonDutUP0yFH+odrE=",
+        "narHash": "sha256-yHJid6Rpxa5pfKI81FfI0VZir9seZMHtLzjdvmt0FVw=",
         "path": "../../mypackages",
         "type": "path"
       },
diff --git a/flakes/private/system/flake.nix b/flakes/private/system/flake.nix
index ad6c58c..6045fd4 100644
--- a/flakes/private/system/flake.nix
+++ b/flakes/private/system/flake.nix
@@ -30,6 +30,17 @@
           secrets.deleteSecretsVars = true;
           secrets.secretsVars = "/run/keys/vars.yml";
 
+          programs.ssh.package = lib.mkDefault (
+            pkgs.openssh.overrideAttrs(old: rec {
+              patches = old.patches ++ [
+                # Mitigation for CVE https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
+                (pkgs.fetchpatch {
+                  url = "https://raw.githubusercontent.com/NixOS/nixpkgs/342bfe5c431fd7828fee8fa7e07a4d8fbfd18618/pkgs/tools/networking/openssh/openssh-9.6_p1-CVE-2024-6387.patch";
+                  sha256 = "sha256-B3Wz/eWSdOnrOcVzDv+QqzLGdFlb3jivQ8qZMC3d0Qw=";
+                })
+              ];
+            })
+          );
           services.openssh.enable = true;
 
           nixpkgs.overlays =