nixbld-etc-nixos/configuration.nix

@@ -20,8 +20,8 @@ in
       ./afws-module.nix
       ./rt.nix
       (builtins.fetchTarball {
-        url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/af7d3bf5daeba3fc28089b015c0dd43f06b176f2/nixos-mailserver-nixos.tar.gz";
+        url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/29916981e7b3b5782dc5085ad18490113f8ff63b/nixos-mailserver-nixos.tar.gz";
-        sha256 = "sha256:1j0r52ij5pw8b8wc5xz1bmm5idwkmsnwpla6smz8gypcjls860ma";
+        sha256 = "sha256:0clvw4622mqzk1aqw1qn6shl9pai097q62mq1ibzscnjayhp278b";
       })
     ];
 
@@ -358,15 +358,6 @@ in
     };
   };
 
-  systemd.services."network-addresses-${netifUSA}" = {
-    after = pkgs.lib.mkOverride 1 [ "network-pre.target" "${netifUSA}-netdev.service" "systemd-udevd.service" ];
-    requires = [ "systemd-udevd.service" ];
-  };
-  systemd.services."network-addresses-${netifAlt}" = {
-    after = pkgs.lib.mkOverride 1 [ "network-pre.target" "${netifAlt}-netdev.service" "systemd-udevd.service" ];
-    requires = [ "systemd-udevd.service" ];
-  };
-
   # https://kb.isc.org/docs/dnssec-key-and-signing-policy
   # chown named.named /etc/nixos/named
   services.bind = {
@@ -500,7 +491,6 @@ in
     enable = true;
     radios.${netifWifi} = {
       band = "2g";
-      channel = 7;
       countryCode = "HK";
       networks.${netifWifi} = {
         ssid = "M-Labs";
@@ -648,6 +638,7 @@ in
     SUBSYSTEM=="usb", ATTRS{idVendor}=="07cf", ATTRS{idProduct}=="4204", MODE="0660", GROUP="lp"
     '';
 
+  sound.enable = true;
   services.mpd.enable = true;
   services.mpd.musicDirectory = "/tank/sb-public/FLAC";
   services.mpd.network.listenAddress = "192.168.1.1";
@@ -741,6 +732,7 @@ in
   users.extraUsers.nix = {
     isNormalUser = true;
   };
+  boot.kernel.sysctl."kernel.dmesg_restrict" = true;
   services.udev.packages = [ pkgs.sane-backends ];
 
   nix.settings.max-jobs = 10;
@@ -761,10 +753,6 @@ in
         job = web:web:web
         command = [ $(jq '.buildStatus' < $HYDRA_JSON) = 0 ] && ln -sfn $(jq -r '.outputs[0].path' < $HYDRA_JSON) ${hydraWwwOutputs}/web
       </runcommand>
-      <runcommand>
-        job = web:web:web-ph
-        command = [ $(jq '.buildStatus' < $HYDRA_JSON) = 0 ] && ln -sfn $(jq -r '.outputs[0].path' < $HYDRA_JSON) ${hydraWwwOutputs}/web-ph
-      </runcommand>
       <runcommand>
         job = web:web:web-intl
         command = [ $(jq '.buildStatus' < $HYDRA_JSON) = 0 ] && ${pkgs.rsync}/bin/rsync -r -c $(jq -r '.outputs[0].path' < $HYDRA_JSON)/ zolaupd@10.47.3.0:/var/www/m-labs-intl.com/html/
@@ -949,26 +937,22 @@ in
     nix = super.nix.overrideAttrs(oa: {
       patches = oa.patches or [] ++ [ ./nix-networked-derivations.patch ];
     });
-    hydra = super.hydra.overrideAttrs(oa: {
+    hydra_unstable = super.hydra_unstable.overrideAttrs(oa: {
       patches = oa.patches or [] ++ [
         ./hydra-conda.patch
         ./hydra-msys2.patch
+        ./hydra-restrictdist.patch
       ];
       hydraPath = oa.hydraPath + ":" + super.lib.makeBinPath [ super.jq ];
       doCheck = false;  # FIXME: ldap tests fail on hydra rebuild, seems unrelated to patches above.
     });
-    mattermost = super.mattermost.overrideAttrs(oldAttrs: {
-      webapp = oldAttrs.webapp.overrideAttrs (webappAttrs: {
-        patches = webappAttrs.patches or [ ] ++ [ ./mattermost-remove-free-banner.patch ];
-      });
-    });
     matterbridge = super.matterbridge.overrideAttrs(oa: {
       patches = oa.patches or [] ++ [ ./matterbridge-disable-github.patch ];
     });
   };
 
   security.acme.acceptTerms = true;
-  security.acme.defaults.email = "sb@m-labs.hk";
+  security.acme.defaults.email = "sb" + "@m-labs.hk";
 
   # https://github.com/NixOS/nixpkgs/issues/106862
   systemd.services."acme-fixperms".wants = [ "bind.service" "dnsmasq.service" ];
@@ -1056,24 +1040,9 @@ in
       };
     in {
       "m-labs.hk" = mainWebsite;
-      "www.m-labs.hk" = {
+      "www.m-labs.hk" = mainWebsite;
-        addSSL = true;
+      "m-labs.ph" = mainWebsite;
-        enableACME = true;
+      "www.m-labs.ph" = mainWebsite;
-        globalRedirect = "m-labs.hk";
-      };
-      "m-labs.ph" = {
-        root = "${hydraWwwOutputs}/web-ph";
-        forceSSL = true;
-        enableACME = true;
-        extraConfig = ''
-          error_page 404 /404.html;
-        '';
-      };
-      "www.m-labs.ph" = {
-        addSSL = true;
-        enableACME = true;
-        globalRedirect = "m-labs.ph";
-      };
       "nixbld.m-labs.hk" = {
         forceSSL = true;
         enableACME = true;
@@ -1220,7 +1189,7 @@ in
       "www.193thz.com" = {
         addSSL = true;
         enableACME = true;
-        globalRedirect = "193thz.com";
+        root = "/var/www/193thz";
       };
       "nmigen.net" = {
         addSSL = true;
@@ -1230,7 +1199,7 @@ in
       "www.nmigen.net" = {
         addSSL = true;
         enableACME = true;
-        globalRedirect = "nmigen.net";
+        root = "${hydraWwwOutputs}/nmigen-docs";
       };
     };
   };
@@ -1324,12 +1293,10 @@ in
   services.roundcube = {
     enable = true;
     hostName = "mail.m-labs.hk";
-    # https://github.com/roundcube/roundcubemail/issues/5869
     extraConfig = ''
       $config['smtp_server'] = "tls://${config.mailserver.fqdn}";
       $config['smtp_user'] = "%u";
       $config['smtp_pass'] = "%p";
-      $config['session_storage'] = "php";
     '';
   };
 

nixbld-etc-nixos/flarum/composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "4cdb60c860f81068e57be8adcf5d68e6",
+    "content-hash": "4fabd8ac0c664ee2d779f1dec28ef2b3",
     "packages": [
         {
             "name": "axy/backtrace",
@@ -1007,22 +1007,22 @@
         },
         {
             "name": "enshrined/svg-sanitize",
-            "version": "0.21.0",
+            "version": "0.15.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/darylldoyle/svg-sanitizer.git",
-                "reference": "5e477468fac5c5ce933dce53af3e8e4e58dcccc9"
+                "reference": "e50b83a2f1f296ca61394fe88fbfe3e896a84cf4"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/darylldoyle/svg-sanitizer/zipball/5e477468fac5c5ce933dce53af3e8e4e58dcccc9",
+                "url": "https://api.github.com/repos/darylldoyle/svg-sanitizer/zipball/e50b83a2f1f296ca61394fe88fbfe3e896a84cf4",
-                "reference": "5e477468fac5c5ce933dce53af3e8e4e58dcccc9",
+                "reference": "e50b83a2f1f296ca61394fe88fbfe3e896a84cf4",
                 "shasum": ""
             },
             "require": {
                 "ext-dom": "*",
                 "ext-libxml": "*",
-                "php": "^7.1 || ^8.0"
+                "php": "^7.0 || ^8.0"
             },
             "require-dev": {
                 "phpunit/phpunit": "^6.5 || ^8.5"
@@ -1046,9 +1046,9 @@
             "description": "An SVG sanitizer for PHP",
             "support": {
                 "issues": "https://github.com/darylldoyle/svg-sanitizer/issues",
-                "source": "https://github.com/darylldoyle/svg-sanitizer/tree/0.21.0"
+                "source": "https://github.com/darylldoyle/svg-sanitizer/tree/0.15.4"
             },
-            "time": "2025-01-13T09:32:25+00:00"
+            "time": "2022-02-21T09:13:59+00:00"
         },
         {
             "name": "fig/http-message-util",
@@ -2592,120 +2592,18 @@
             ],
             "time": "2024-11-20T08:51:17+00:00"
         },
-        {
-            "name": "fof/components",
-            "version": "1.0.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/FriendsOfFlarum/components.git",
-                "reference": "1e60224260b5a284a385968c6fa99ecd4a89c026"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/FriendsOfFlarum/components/zipball/1e60224260b5a284a385968c6fa99ecd4a89c026",
-                "reference": "1e60224260b5a284a385968c6fa99ecd4a89c026",
-                "shasum": ""
-            },
-            "require": {
-                "flarum/core": "^1.0.0"
-            },
-            "type": "library",
-            "autoload": {
-                "psr-4": {
-                    "FoF\\Components\\": "src/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "David Sevilla Martín",
-                    "email": "me+fof@datitisev.me",
-                    "role": "Developer"
-                }
-            ],
-            "description": "[NOT EXT] Reusable JavaScript components for your Flarum extension",
-            "keywords": [
-                "flarum",
-                "friendsofflarum"
-            ],
-            "support": {
-                "issues": "https://github.com/FriendsOfFlarum/components/issues",
-                "source": "https://github.com/FriendsOfFlarum/components/tree/1.0.0"
-            },
-            "funding": [
-                {
-                    "url": "https://opencollective.com/fof",
-                    "type": "open_collective"
-                }
-            ],
-            "time": "2021-05-17T13:47:34+00:00"
-        },
-        {
-            "name": "fof/extend",
-            "version": "1.3.3",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/FriendsOfFlarum/extend.git",
-                "reference": "ba55c9b765911cb689592d0de787e3351625e3f0"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/FriendsOfFlarum/extend/zipball/ba55c9b765911cb689592d0de787e3351625e3f0",
-                "reference": "ba55c9b765911cb689592d0de787e3351625e3f0",
-                "shasum": ""
-            },
-            "require": {
-                "flarum/core": "^1.0.0"
-            },
-            "require-dev": {
-                "flarum/phpstan": "*",
-                "league/oauth2-client": "^2.7"
-            },
-            "type": "library",
-            "autoload": {
-                "psr-4": {
-                    "FoF\\Extend\\": "src/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "David Sevilla Martin",
-                    "email": "me+fof@datitisev.me",
-                    "role": "Developer"
-                }
-            ],
-            "description": "Configurable PHP components for your Flarum extension",
-            "support": {
-                "issues": "https://github.com/FriendsOfFlarum/extend/issues",
-                "source": "https://github.com/FriendsOfFlarum/extend/tree/1.3.3"
-            },
-            "funding": [
-                {
-                    "url": "https://opencollective.com/fof",
-                    "type": "open_collective"
-                }
-            ],
-            "time": "2023-11-30T08:13:16+00:00"
-        },
         {
             "name": "fof/polls",
-            "version": "2.2.11",
+            "version": "2.2.9",
             "source": {
                 "type": "git",
                 "url": "https://github.com/FriendsOfFlarum/polls.git",
-                "reference": "a788a5e8ed15ca297bdf2b8f7e168ac6773352c9"
+                "reference": "9d30e39a01bd420e3a37985849699f2c010e3611"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/FriendsOfFlarum/polls/zipball/a788a5e8ed15ca297bdf2b8f7e168ac6773352c9",
+                "url": "https://api.github.com/repos/FriendsOfFlarum/polls/zipball/9d30e39a01bd420e3a37985849699f2c010e3611",
-                "reference": "a788a5e8ed15ca297bdf2b8f7e168ac6773352c9",
+                "reference": "9d30e39a01bd420e3a37985849699f2c010e3611",
                 "shasum": ""
             },
             "require": {
@@ -2720,6 +2618,15 @@
             },
             "type": "flarum-extension",
             "extra": {
+                "flarum-extension": {
+                    "title": "FoF Polls",
+                    "category": "discussion",
+                    "icon": {
+                        "name": "fas fa-poll",
+                        "backgroundColor": "#e74c3c",
+                        "color": "#fff"
+                    }
+                },
                 "flagrow": {
                     "discuss": "https://discuss.flarum.org/d/20586"
                 },
@@ -2728,15 +2635,6 @@
                         "githubActions": true,
                         "backendTesting": true
                     }
-                },
-                "flarum-extension": {
-                    "icon": {
-                        "name": "fas fa-poll",
-                        "color": "#fff",
-                        "backgroundColor": "#e74c3c"
-                    },
-                    "title": "FoF Polls",
-                    "category": "discussion"
                 }
             },
             "autoload": {
@@ -2772,7 +2670,7 @@
                     "type": "website"
                 }
             ],
-            "time": "2024-12-09T10:44:10+00:00"
+            "time": "2024-10-28T22:02:59+00:00"
         },
         {
             "name": "fof/subscribed",
@@ -2801,6 +2699,19 @@
             },
             "type": "flarum-extension",
             "extra": {
+                "flarum-extension": {
+                    "title": "FoF Subscribed",
+                    "category": "feature",
+                    "icon": {
+                        "name": "fas fa-reply-all",
+                        "backgroundColor": "#e74c3c",
+                        "color": "#fff"
+                    },
+                    "optional-dependencies": [
+                        "flarum/approval",
+                        "flarum/flags"
+                    ]
+                },
                 "flagrow": {
                     "discuss": "https://discuss.flarum.org/d/20917"
                 },
@@ -2808,19 +2719,6 @@
                     "modules": {
                         "githubActions": true
                     }
-                },
-                "flarum-extension": {
-                    "icon": {
-                        "name": "fas fa-reply-all",
-                        "color": "#fff",
-                        "backgroundColor": "#e74c3c"
-                    },
-                    "title": "FoF Subscribed",
-                    "category": "feature",
-                    "optional-dependencies": [
-                        "flarum/approval",
-                        "flarum/flags"
-                    ]
                 }
             },
             "autoload": {
@@ -2863,26 +2761,26 @@
         },
         {
             "name": "fof/upload",
-            "version": "1.7.0",
+            "version": "1.6.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/FriendsOfFlarum/upload.git",
-                "reference": "bc66315ea428438a180efbf8a80f9db44454a4ac"
+                "reference": "039544d9a4751cebcf44d2eb079583a6d4dac274"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/FriendsOfFlarum/upload/zipball/bc66315ea428438a180efbf8a80f9db44454a4ac",
+                "url": "https://api.github.com/repos/FriendsOfFlarum/upload/zipball/039544d9a4751cebcf44d2eb079583a6d4dac274",
-                "reference": "bc66315ea428438a180efbf8a80f9db44454a4ac",
+                "reference": "039544d9a4751cebcf44d2eb079583a6d4dac274",
                 "shasum": ""
             },
             "require": {
-                "enshrined/svg-sanitize": "^0",
+                "enshrined/svg-sanitize": "^0.15.4",
                 "ext-json": "*",
                 "flarum/core": "^1.8.3",
                 "guzzlehttp/guzzle": "^6.0 || ^7.0",
-                "php": "^8.1",
+                "php": "^8.0",
                 "ramsey/uuid": "^3.5.2 || ^4",
-                "softcreatr/php-mime-detector": "^4.0"
+                "softcreatr/php-mime-detector": "^3.0"
             },
             "replace": {
                 "flagrow/upload": "*"
@@ -2900,24 +2798,24 @@
             },
             "type": "flarum-extension",
             "extra": {
+                "flarum-extension": {
+                    "title": "FoF Upload",
+                    "category": "feature",
+                    "icon": {
+                        "name": "fas fa-file-upload",
+                        "backgroundColor": "#e74c3c",
+                        "color": "#fff"
+                    }
+                },
                 "flagrow": {
                     "discuss": "https://discuss.flarum.org/d/4154"
                 },
                 "flarum-cli": {
                     "modules": {
-                        "typescript": true,
                         "githubActions": true,
+                        "typescript": true,
                         "backendTesting": true
                     }
-                },
-                "flarum-extension": {
-                    "icon": {
-                        "name": "fas fa-file-upload",
-                        "color": "#fff",
-                        "backgroundColor": "#e74c3c"
-                    },
-                    "title": "FoF Upload",
-                    "category": "feature"
                 }
             },
             "autoload": {
@@ -2958,7 +2856,7 @@
                     "type": "website"
                 }
             ],
-            "time": "2024-11-30T14:03:04+00:00"
+            "time": "2024-11-23T18:33:38+00:00"
         },
         {
             "name": "franzl/whoops-middleware",
@@ -6158,58 +6056,6 @@
             },
             "time": "2015-06-18T19:15:47+00:00"
         },
-        {
-            "name": "nyu8/flarum-email-filter",
-            "version": "1.0.7",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/nyu8/flarum-email-filter.git",
-                "reference": "a8e09c0d42366fe30f7c203037c8dfa0858f49cb"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/nyu8/flarum-email-filter/zipball/a8e09c0d42366fe30f7c203037c8dfa0858f49cb",
-                "reference": "a8e09c0d42366fe30f7c203037c8dfa0858f49cb",
-                "shasum": ""
-            },
-            "require": {
-                "flarum/core": "^1.0",
-                "fof/components": "^1.0",
-                "fof/extend": "^1.0"
-            },
-            "type": "flarum-extension",
-            "extra": {
-                "flarum-extension": {
-                    "icon": {
-                        "name": "fas fa-envelope",
-                        "color": "#ffffff",
-                        "backgroundColor": "#eb5424"
-                    },
-                    "title": "Email Filter"
-                }
-            },
-            "autoload": {
-                "psr-4": {
-                    "NYU8\\FlarumEmailFilter\\": "src/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "NYU8",
-                    "email": "dev@nyu8.com"
-                }
-            ],
-            "description": "Filter emails registering your Flarum site with whitelist, blacklist and even regular expressions.",
-            "support": {
-                "issues": "https://github.com/nyu8/flarum-email-filter/issues",
-                "source": "https://github.com/nyu8/flarum-email-filter"
-            },
-            "time": "2022-04-26T05:45:27+00:00"
-        },
         {
             "name": "opis/closure",
             "version": "3.6.3",
@@ -7230,25 +7076,25 @@
         },
         {
             "name": "softcreatr/php-mime-detector",
-            "version": "4.0.0",
+            "version": "3.2.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/SoftCreatR/php-mime-detector.git",
-                "reference": "ae204590de58cc4655c8fbf9a2dfbcbb21dae4fe"
+                "reference": "bd26abae1659901617ed51150063c310e089eef9"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/SoftCreatR/php-mime-detector/zipball/ae204590de58cc4655c8fbf9a2dfbcbb21dae4fe",
+                "url": "https://api.github.com/repos/SoftCreatR/php-mime-detector/zipball/bd26abae1659901617ed51150063c310e089eef9",
-                "reference": "ae204590de58cc4655c8fbf9a2dfbcbb21dae4fe",
+                "reference": "bd26abae1659901617ed51150063c310e089eef9",
                 "shasum": ""
             },
             "require": {
-                "php": ">=8.1.0"
+                "php": ">=7.1.0"
             },
             "require-dev": {
-                "phpunit/phpunit": ">=10.0",
+                "phpunit/phpunit": ">=7.0",
-                "roave/security-advisories": "dev-latest",
+                "roave/security-advisories": "dev-master",
-                "squizlabs/php_codesniffer": "^3.7"
+                "squizlabs/php_codesniffer": "^3.5"
             },
             "type": "library",
             "autoload": {
@@ -7289,7 +7135,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2024-09-01T17:19:47+00:00"
+            "time": "2021-05-30T10:34:43+00:00"
         },
         {
             "name": "staudenmeir/eloquent-eager-limit",

nixbld-etc-nixos/flarum/default.nix

@@ -17,13 +17,14 @@ php.buildComposerProject (finalAttrs: {
   };
 
   patches = [
-    # Add useful flarum extensions (polls, subscribed, upload, email-filter)
+    # Add useful extensions from https://github.com/FriendsOfFlarum
-    ./flarum-extensions.patch
+    # Extensions included: fof/upload, fof/polls, fof/subscribed
+    ./fof-extensions.patch
   ];
 
   composerLock = ./composer.lock;
   composerStrictValidation = false;
-  vendorHash = "sha256-rWvIKiQVyfvUprYfm/+Jdq+DO5qymyWp+Xh0c0nY2Cw=";
+  vendorHash = "sha256-GLE5ZtzZmQ8YbitV6LG744QHoGxlj5TfC5wP2a3eFpU=";
 
   meta = with lib; {
     changelog = "https://github.com/flarum/framework/blob/main/CHANGELOG.md";

nixbld-etc-nixos/flarum/fof-extensions.patch

@@ -1,8 +1,8 @@
 diff --git a/composer.json b/composer.json
-index c63b5f8..4bc00c1 100644
+index c63b5f8..5ad1186 100644
 --- a/composer.json
 +++ b/composer.json
-@@ -37,7 +37,11 @@
+@@ -37,7 +37,10 @@
          "flarum/sticky": "*",
          "flarum/subscriptions": "*",
          "flarum/suspend": "*",
@@ -10,8 +10,7 @@ index c63b5f8..4bc00c1 100644
 +        "flarum/tags": "*",
 +        "fof/polls": "*",
 +        "fof/subscribed": "*",
-+        "fof/upload": "*",
++        "fof/upload": "*"
-+        "nyu8/flarum-email-filter": "^1.0"
      },
      "config": {
          "preferred-install": "dist",

nixbld-etc-nixos/gitea-home.tmpl

@@ -15,7 +15,7 @@
 	<div class="ui stackable middle very relaxed page grid">
 		<div class="sixteen wide center column">
 			<p class="large">
-				Welcome! This Gitea instance is here to support projects related to <a href="https://m-labs.hk">M-Labs</a>. You may want to browse the <a href="https://git.m-labs.hk/M-Labs/">M-Labs organization</a> where many projects are located. If you would like an account (we give them to anyone who wants to contribute on projects related to Sinara, ARTIQ, nMigen, etc.), simply write a short email to sb@m-labs.hk stating the username you would like to have.
+				Welcome! This Gitea instance is here to support projects related to <a href="https://m-labs.hk">M-Labs</a>. You may want to browse the <a href="https://git.m-labs.hk/M-Labs/">M-Labs organization</a> where many projects are located. If you would like an account (we give them to anyone who wants to contribute on projects related to Sinara, ARTIQ, nMigen, etc.), simply write a short email to sb@m-***.hk stating the username you would like to have.
 			</p>
 		</div>
 	</div>

nixbld-etc-nixos/gitea-signin.tmpl

@@ -4,7 +4,7 @@
 	<div class="ui middle very relaxed page grid">
 		<div class="ui container column fluid">
 			{{template "user/auth/signin_inner" .}}
-			To get an account (also available to external contributors), simply write to sb@m-labs.hk.
+			To get an account (also available to external contributors), simply write to sb@m-***s.hk.
 		</div>
 	</div>
 </div>

nixbld-etc-nixos/hydra-restrictdist.patch

@@ -0,0 +1,32 @@
+diff --git src/lib/Hydra/Controller/Root.pm src/lib/Hydra/Controller/Root.pm
+index a9b0d558..71869ba0 100644
+--- a/src/lib/Hydra/Controller/Root.pm
++++ b/src/lib/Hydra/Controller/Root.pm
+@@ -19,6 +19,11 @@ use Net::Prometheus;
+ # Put this controller at top-level.
+ __PACKAGE__->config->{namespace} = '';
+ 
++sub isRedistRestricted {
++  my ($path) = @_;
++
++  return index($path, "-RESTRICTDIST-") >= 0;
++}
+ 
+ sub noLoginNeeded {
+   my ($c) = @_;
+@@ -319,6 +324,7 @@ sub nar :Local :Args(1) {
+         $path = $Nix::Config::storeDir . "/$path";
+ 
+         gone($c, "Path " . $path . " is no longer available.") unless isValidPath($path);
++        notFound($c, "Redistribution restricted") if isRedistRestricted($path);
+ 
+         $c->stash->{current_view} = 'NixNAR';
+         $c->stash->{storePath} = $path;
+@@ -368,6 +374,7 @@ sub narinfo :LocalRegex('^([a-z0-9]+).narinfo$') :Args(0) {
+             setCacheHeaders($c, 60 * 60);
+             return;
+         }
++        notFound($c, "Redistribution restricted") if isRedistRestricted($path);
+ 
+         $c->stash->{storePath} = $path;
+         $c->forward('Hydra::View::NARInfo');

nixbld-etc-nixos/mattermost-remove-free-banner.patch

@@ -1,210 +0,0 @@
-diff --git webapp/channels/src/components/global_header/left_controls/product_menu/product_branding_team_edition/product_branding_team_edition.tsx webapp/channels/src/components/global_header/left_controls/product_menu/product_branding_team_edition/product_branding_team_edition.tsx
-index 9af4fc7354..60ae3160e8 100644
---- webapp/channels/src/components/global_header/left_controls/product_menu/product_branding_team_edition/product_branding_team_edition.tsx
-+++ webapp/channels/src/components/global_header/left_controls/product_menu/product_branding_team_edition/product_branding_team_edition.tsx
-@@ -9,10 +9,6 @@ import Logo from 'components/common/svg_images_components/logo_dark_blue_svg';
- const ProductBrandingTeamEditionContainer = styled.div`
-     display: flex;
-     align-items: center;
--
--    > * + * {
--        margin-left: 8px;
--    }
- `;
- 
- const StyledLogo = styled(Logo)`
-@@ -21,23 +17,6 @@ const StyledLogo = styled(Logo)`
-     }
- `;
- 
--const Badge = styled.div`
--    display: flex;
--    align-self: center;
--    padding: 2px 6px;
--    position: relative;
--    top: 1px;
--    border-radius: var(--radius-s);
--    margin-left: 12px;
--    background: rgba(var(--sidebar-text-rgb), 0.08);
--    color: rgba(var(--sidebar-text-rgb), 0.75);
--    font-family: 'Open Sans', sans-serif;
--    font-size: 10px;
--    font-weight: 600;
--    letter-spacing: 0.025em;
--    line-height: 16px;
--`;
--
- const ProductBrandingTeamEdition = (): JSX.Element => {
-     return (
-         <ProductBrandingTeamEditionContainer tabIndex={0}>
-@@ -45,7 +24,6 @@ const ProductBrandingTeamEdition = (): JSX.Element => {
-                 width={116}
-                 height={20}
-             />
--            <Badge>{'FREE EDITION'}</Badge>
-         </ProductBrandingTeamEditionContainer>
-     );
- };
-diff --git webapp/channels/src/components/header_footer_route/header.scss webapp/channels/src/components/header_footer_route/header.scss
-index e7c76f9861..2841858f44 100644
---- webapp/channels/src/components/header_footer_route/header.scss
-+++ webapp/channels/src/components/header_footer_route/header.scss
-@@ -39,23 +39,6 @@
-                 width: 170px;
-                 fill: var(--center-channel-color);
-             }
--
--            .freeBadge {
--                position: relative;
--                top: 1px;
--                display: flex;
--                align-self: center;
--                padding: 2px 6px;
--                border-radius: var(--radius-s);
--                margin-left: 12px;
--                background: rgba(var(--center-channel-color-rgb), 0.08);
--                color: rgba(var(--center-channel-color-rgb), 0.75);
--                font-family: 'Open Sans', sans-serif;
--                font-size: 10px;
--                font-weight: 600;
--                letter-spacing: 0.025em;
--                line-height: 16px;
--            }
-         }
-     }
- 
-@@ -77,12 +60,6 @@
-             margin-top: 12px;
-         }
-     }
--
--    &.has-free-banner.has-custom-site-name {
--        .header-back-button {
--            bottom: -20px;
--        }
--    }
- }
- 
- @media screen and (max-width: 699px) {
-diff --git webapp/channels/src/components/header_footer_route/header.tsx webapp/channels/src/components/header_footer_route/header.tsx
-index 8cd1d8a624..55554fb0ad 100644
---- webapp/channels/src/components/header_footer_route/header.tsx
-+++ webapp/channels/src/components/header_footer_route/header.tsx
-@@ -25,33 +25,15 @@ const Header = ({alternateLink, backButtonURL, onBackButtonClick}: HeaderProps)
- 
-     const ariaLabel = SiteName || 'Mattermost';
- 
--    let freeBanner = null;
--    if (license.IsLicensed === 'false') {
--        freeBanner = <><Logo/><span className='freeBadge'>{'FREE EDITION'}</span></>;
--    }
--
-     let title: React.ReactNode = SiteName;
-     if (title === 'Mattermost') {
--        if (freeBanner) {
--            title = '';
--        } else {
--            title = <Logo/>;
--        }
-+        title = <Logo/>;
-     }
- 
-     return (
--        <div className={classNames('hfroute-header', {'has-free-banner': freeBanner, 'has-custom-site-name': title})}>
-+        <div className={classNames('hfroute-header', {'has-custom-site-name': title})}>
-             <div className='header-main'>
-                 <div>
--                    {freeBanner &&
--                        <Link
--                            className='header-logo-link'
--                            to='/'
--                            aria-label={ariaLabel}
--                        >
--                            {freeBanner}
--                        </Link>
--                    }
-                     {title &&
-                         <Link
-                             className='header-logo-link'
-diff --git webapp/channels/src/components/widgets/menu/menu_items/menu_start_trial.tsx webapp/channels/src/components/widgets/menu/menu_items/menu_start_trial.tsx
-index 35646539c4..fbdbb39710 100644
---- webapp/channels/src/components/widgets/menu/menu_items/menu_start_trial.tsx
-+++ webapp/channels/src/components/widgets/menu/menu_items/menu_start_trial.tsx
-@@ -1,42 +1,17 @@
- // Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
- // See LICENSE.txt for license information.
- 
--import React from 'react';
--import {useIntl} from 'react-intl';
- import {useSelector} from 'react-redux';
--import styled from 'styled-components';
- 
- import {getLicense} from 'mattermost-redux/selectors/entities/general';
- 
--import ExternalLink from 'components/external_link';
--
--import {LicenseLinks} from 'utils/constants';
--
- import './menu_item.scss';
- 
--const FreeVersionBadge = styled.div`
--     position: relative;
--     top: 1px;
--     display: flex;
--     padding: 2px 6px;
--     border-radius: var(--radius-s);
--     margin-bottom: 6px;
--     background: rgba(var(--center-channel-color-rgb), 0.08);
--     color: rgba(var(--center-channel-color-rgb), 0.75);
--     font-family: 'Open Sans', sans-serif;
--     font-size: 10px;
--     font-weight: 600;
--     letter-spacing: 0.025em;
--     line-height: 16px;
--`;
--
- type Props = {
-     id: string;
- }
- 
- const MenuStartTrial = (props: Props): JSX.Element | null => {
--    const {formatMessage} = useIntl();
--
-     const license = useSelector(getLicense);
-     const isCurrentLicensed = license?.IsLicensed;
- 
-@@ -44,33 +19,7 @@ const MenuStartTrial = (props: Props): JSX.Element | null => {
-         return null;
-     }
- 
--    return (
--        <li
--            className={'MenuStartTrial'}
--            role='menuitem'
--            id={props.id}
--        >
--            <FreeVersionBadge>{'FREE EDITION'}</FreeVersionBadge>
--            <div className='editionText'>
--                {formatMessage(
--                    {
--                        id: 'navbar_dropdown.versionText',
--                        defaultMessage: 'This is the free <link>unsupported</link> edition of Mattermost.',
--                    },
--                    {
--                        link: (msg: React.ReactNode) => (
--                            <ExternalLink
--                                location='menu_start_trial.unsupported-link'
--                                href={LicenseLinks.UNSUPPORTED}
--                            >
--                                {msg}
--                            </ExternalLink>
--                        ),
--                    },
--                )}
--            </div>
--        </li>
--    );
-+    return null;
- };
- 
- export default MenuStartTrial;

nixbld-etc-nixos/nix-networked-derivations.patch

@@ -1,8 +1,8 @@
-diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
+diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
-index 2a09e3dd4..7dc03855f 100644
+index 763045a80..d7c5cc82e 100644
---- a/src/libstore/unix/build/local-derivation-goal.cc
+--- a/src/libstore/build/local-derivation-goal.cc
-+++ b/src/libstore/unix/build/local-derivation-goal.cc
++++ b/src/libstore/build/local-derivation-goal.cc
-@@ -197,6 +197,8 @@ Goal::Co LocalDerivationGoal::tryLocalBuild()
+@@ -190,6 +190,8 @@ void LocalDerivationGoal::tryLocalBuild()
  
      assert(derivationType);
  
@@ -11,7 +11,7 @@ index 2a09e3dd4..7dc03855f 100644
      /* Are we doing a chroot build? */
      {
          auto noChroot = parsedDrv->getBoolAttr("__noChroot");
-@@ -214,7 +216,7 @@ Goal::Co LocalDerivationGoal::tryLocalBuild()
+@@ -207,7 +209,7 @@ void LocalDerivationGoal::tryLocalBuild()
          else if (settings.sandboxMode == smDisabled)
              useChroot = false;
          else if (settings.sandboxMode == smRelaxed)
@@ -20,7 +20,7 @@ index 2a09e3dd4..7dc03855f 100644
      }
  
      auto & localStore = getLocalStore();
-@@ -737,7 +739,7 @@ void LocalDerivationGoal::startBuilder()
+@@ -717,7 +719,7 @@ void LocalDerivationGoal::startBuilder()
                  "nogroup:x:65534:\n", sandboxGid()));
  
          /* Create /etc/hosts with localhost entry. */
@@ -29,7 +29,7 @@ index 2a09e3dd4..7dc03855f 100644
              writeFile(chrootRootDir + "/etc/hosts", "127.0.0.1 localhost\n::1 localhost\n");
  
          /* Make the closure of the inputs available in the chroot,
-@@ -938,7 +940,7 @@ void LocalDerivationGoal::startBuilder()
+@@ -921,7 +923,7 @@ void LocalDerivationGoal::startBuilder()
             us.
          */
  
@@ -38,16 +38,16 @@ index 2a09e3dd4..7dc03855f 100644
              privateNetwork = true;
  
          userNamespaceSync.create();
-@@ -1177,7 +1179,7 @@ void LocalDerivationGoal::initEnv()
+@@ -1160,7 +1162,7 @@ void LocalDerivationGoal::initEnv()
         to the builder is generally impure, but the output of
         fixed-output derivations is by definition pure (since we
         already know the cryptographic hash of the output). */
 -    if (!derivationType->isSandboxed()) {
 +    if (networked || !derivationType->isSandboxed()) {
-         auto & impureEnv = settings.impureEnv.get();
+         for (auto & i : parsedDrv->getStringsAttr("impureEnvVars").value_or(Strings()))
-         if (!impureEnv.empty())
+             env[i] = getEnv(i).value_or("");
-             experimentalFeatureSettings.require(Xp::ConfigurableImpureEnv);
+     }
-@@ -1851,7 +1853,7 @@ void LocalDerivationGoal::runChild()
+@@ -1829,7 +1831,7 @@ void LocalDerivationGoal::runChild()
              /* Fixed-output derivations typically need to access the
                 network, so give them access to /etc/resolv.conf and so
                 on. */
@@ -56,7 +56,7 @@ index 2a09e3dd4..7dc03855f 100644
                  // Only use nss functions to resolve hosts and
                  // services. Don’t use it for anything else that may
                  // be configured for this system. This limits the
-@@ -2083,7 +2085,7 @@ void LocalDerivationGoal::runChild()
+@@ -2071,7 +2073,7 @@ void LocalDerivationGoal::runChild()
                  #include "sandbox-defaults.sb"
                  ;
  
@@ -65,11 +65,11 @@ index 2a09e3dd4..7dc03855f 100644
                  sandboxProfile +=
                      #include "sandbox-network.sb"
                      ;
-diff --git a/src/libstore/unix/build/local-derivation-goal.hh b/src/libstore/unix/build/local-derivation-goal.hh
+diff --git a/src/libstore/build/local-derivation-goal.hh b/src/libstore/build/local-derivation-goal.hh
-index bf25cf2a6..28f8c1e95 100644
+index 86b86c01e..95b03aae8 100644
---- a/src/libstore/unix/build/local-derivation-goal.hh
+--- a/src/libstore/build/local-derivation-goal.hh
-+++ b/src/libstore/unix/build/local-derivation-goal.hh
++++ b/src/libstore/build/local-derivation-goal.hh
-@@ -83,6 +83,8 @@ struct LocalDerivationGoal : public DerivationGoal
+@@ -82,6 +82,8 @@ struct LocalDerivationGoal : public DerivationGoal
       */
      Path chrootRootDir;
  

nixops/common-users.nix

@@ -111,13 +111,6 @@
       "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBK1tUg7TtceARRnGI80Ai5kNFolFfZ++LH9v1UoRCiJdxeQWPdNYO0Gj7+ejJvgZXwvN4yHGgcZHraEml4Mj/dKrEMFygfuYLDRmXtPFwX6TNMrWlxMhPzuNY+yCaxlqYg=="
     ];
   };
-  abdul = {
-    isNormalUser = true;
-    extraGroups = ["plugdev" "dialout"];
-    openssh.authorizedKeys.keys = [
-      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBONzKWn65erPM2xBCe9Dcw8dHRQCJmvzwhX72iHE1xVlAr7UcB1PMOjEB25MFfV/kCIFS5UB5wuoPvq+/oZ3EXiFjmQtsb669KN6MkZNyDqP5Y2W8gR1wVa/ZLfH4HynHg=="
-    ];
-  };
 
   dpn = {
     isNormalUser = true;

nixops/desktop.nix

@@ -12,7 +12,6 @@ in
 
   boot.loader.systemd-boot.memtest86.enable = true;
   boot.loader.grub.memtest86.enable = true;
-  boot.kernel.sysctl."kernel.dmesg_restrict" = false;
 
   imports =
     [

nixops/rpi.nix

@@ -15,7 +15,6 @@ in
   boot.loader.generic-extlinux-compatible.enable = true;
   boot.kernelParams = if rpi4 then ["cma=64M"] else []; # work around https://github.com/raspberrypi/linux/issues/3208
   boot.initrd.includeDefaultModules = false;
-  boot.kernel.sysctl."kernel.dmesg_restrict" = false;
 
   fileSystems = {
     "/" = {