lighttpd: Allow defaultPort being null.

Lighttpd doesn't allow to unset server.port, but we just set a dummy
Unix socket path instead if defaultPort == null. That way, it won't
listen on any ethernet interfaces at all by default.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
machines/ultron: Selectively generate vhosts.

We want to generate vhosts _only_ for the IP addresses which we actually
use. The rest should be unbound, so we use defaultPort = null.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Add unzervalt as a new container host.

I need to host a few private projects, which I'm going to make available
in a secret repository, so this puts everything regarding it into a
container and basically HTTP-proxies the container from outside.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
pkgs: Add Haxe version 3.1.3.

It's only in nixpkgs unstoble right now and we need it for the
headcounter site, so let's place a copy of thu whelu file in here, which
we're going to remove/revert once NixOS 14.10 becomes stable.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
modules: Add a new webspace service module.

Provides a simple way to map virtual hosts to user accounts and provide
a SFTP service for uploading content. The latter is using a seccomp BPF
sandboxed OpenSSH with a small patch which enables us to prefix user
names with "webspace_" and the client just uses the unprefixed version.

The webspace SFTP service will run on port 2222 by default, because it
is completely separate from the main SSHd. Essentially, this means that
we have to proxy the connection from the host system.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
ultron: Provide a SFTP proxy to unzervalt.

We now include unzervalt, despite of /private being available, because
essentially the private repository just lists the webspace accounts and
nothing fancy.

The proxy connects the misc domain from port 22 to unzervalt:2222, so
the SFTP service is reachable by the IPs in the misc vhost.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
common: Enable OpenNTPd by default.

Unfortunately, this isn't in <nixpkgs> release-14.04 (yet), but
hopefully will be very soon.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
lighttpd: Provide a type for virtualHosts.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
ultron: Don't listen for SSH on all interfaces.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Add submodule for /private tree.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Update hydra submodule to latest master version.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>