hydra-submodule: Update to latest git revision.

This adds a fix for the path of /etc/nix/machines.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
hydra: Add own signing public key.

This temporarily phases out the signing key of the official NixOS Hydra
until we have a solution to accept more than one signing key.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
ssl: Add .gitignore file for the private keys.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
hydra: Force nix.maxJobs to 0.

This is to prevent builds on the Hydra host and only use the build
slaves for doing the grunt work.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
lighttpd: Only set port if defaultPort is set.

This is to listen only on the sockets that are configured via virtual
hosts without having a stray "default port" hanging around that needs to
serve a 404 ;-)

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
lighttpd: Remove server.errorlog directive.

We are logging to the journal, so we don't need this directive anymore.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
lighttpd: Provide type information for options.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
lighttpd: Check config validity prior to startup.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
lighttpd: Use "lighttpd" as process name.

Instead of using the full output path of the derivation.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
lighttpd: Allow virtual host socket configuration.

This is a bit tricky, because the $SERVER["socket"] directive has to be
outside of the actual virtual host configuration, so we need to group
all socket directives together and put all the corresponding virtual
hosts within that directive.

One problem that is left is that when there is no socket attribute
present in the virtual host, the whole virtual host is discarded. For
global configuration we already have an option, but we might either
print an error or merge it with the global config in the future.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
ultron: Finish Hydra webserver configuration.

This also involves a bit of hacky stuff in order to correctly reverse
proxy the Hydra backend. One thing that's problematic is the use-ipv6
directive, because the behaviour will change in a future version.

But for now, this will get us started with a basic Hydra service.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
domains: Fix off-by-one error in IPv4 addresses.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
vhosts: Turn localCommands into a service.

In NixOS/nixpkgs@0e333688 mkOrder got removed and thus mkFooter is gone
as well. While it's not used within nixpkgs/nixos, we tried to correctly
order the localCommands and _append_ our subnets.

This now adds the subnet configuration as a systemd service, which
should not rely anymore on mkOrder and in addition it has the advantage
to be extendible by a stop action that shuts down those addresses
properly.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Revert "Only set port if defaultPort is set".

This reverts commit 1ba8b2db9bc3e1f271881c9a482a32be46df9865 because if
you leave out the server.port command, lighttpd binds to port 80 by
default anyway.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
ultron: Listen on loopback interface for port 80.

This is because by default, lighttpd needs to bind on any port, so we're
going for the loopback interface to avoid having the default virtual
host exposed to the outside world.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
ultron: Provide vhost config for IPv6 as well.

This solves the problem of using use-ipv6, because we now bind to the
respective address directly rather than on all interfaces.

In addition, we now generate SSL vhosts based on the VHost modular
configuration, so we have less duplication over there.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
domains: Fix typo in "no-icq.org".

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
ultron: Redirect main domain to old deployment.

This uses a workaround for the lighttpd else clause, because the
condition isn't optional there.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
lighttpd: Allow empty vhost configuration.

This is to only set socket-specific options and don't match on a
specific host or URL.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
ultron: Redirect port 80 to old deployment.

We not only want to redirect the Hydra URL to the old deployment but
port 80 in general as well. Of course in the long term this will change
back to listening on 127.0.0.1 and only listen to the corresponding IPs
directly, rather than on all interfaces.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>