summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authortv <tv@krebsco.de>2016-07-07 22:31:50 +0200
committertv <tv@krebsco.de>2016-07-07 22:31:50 +0200
commit0c72da81cc58dcb68ae079901fae464249e5cec3 (patch)
tree3485e7354b3686a6543f44c4c203b4edcd4e150d
parentfa14575ce2fbcf0fd7f1df4934b54c19d34401b5 (diff)
zu: init
-rw-r--r--krebs/3modules/tv/default.nix31
-rw-r--r--tv/1systems/zu.nix229
2 files changed, 260 insertions, 0 deletions
diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index 2d18a7e8d..075066961 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -358,6 +358,37 @@ with config.krebs.lib;
ssh.privkey.path = <secrets/ssh.id_ed25519>;
ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnjfceKuHNQu7S4eYFN1FqgzMqiL7haNZMh2ZLhvuhK root@xu";
};
+ zu = {
+ cores = 4;
+ nets = {
+ #gg23 = {
+ # ip4.addr = "";
+ # aliases = ["zu.gg23"];
+ # ssh.port = 11423;
+ #};
+ retiolum = {
+ ip4.addr = "10.243.13.40";
+ ip6.addr = "42:0:0:0:0:0:0:1340";
+ aliases = [
+ "zu.r"
+ "zu.retiolum"
+ ];
+ tinc.pubkey = ''
+ -----BEGIN RSA PUBLIC KEY-----
+ MIIBCgKCAQEAti6y+Qkz80oay6H2+ANROWdH4aJS54ST8VhFxRB3WdnlDFG/9t6d
+ idU87uxW5Xmfm6nvpO0OPhG4E3+UI7KtWP71nnducpLV6gfob4f2xNGVG435CJ6u
+ BgorbneUbJEfr4Bb0xd46X2BtLqi5/vUY3M5KMGE2sMdyL2/7oujEI8zQJCse95a
+ OhDZdF2bCDEixCHahNprkQrD8t1lNYoLR2qtDZ5psIh5vgdp0WOOMGvUkCDkNjWj
+ /NKaRXPhUVRDLRFEzMZhtFtSHzaofzrhGFoU1rGZwc/XopqpiFi0D7L++TiNqKAk
+ b9cXwDAI50f8dJagPYtIupjN5bmo+QhXcQIDAQAB
+ -----END RSA PUBLIC KEY-----
+ '';
+ };
+ };
+ secure = true;
+ ssh.privkey.path = <secrets/ssh.id_rsa>;
+ ssh.pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNjHxyUC7afNGSwfwBfQizmDnHTNLWDRHE8SY9W4oiw2lPhCFGTN8Jz84CKtnABbZhbNY1E8T58emF2h45WzDg/OGi8DPAk4VsXSkIhyvAto+nkTy2L4atjqfvXDvqxTDC9sui+t8p5OqOK+sghe4kiy+Vx1jhnjSnkQsx9Kocu24BYTkNqYxG7uwOz6t262XYNwMn13Y2K/yygDR3Uw3wTnEjpaYnObRxxJS3iTECDzgixiQ6ewXwYNggpzO/+EfW1BTz5vmuEVf4GbQ9iEc7IsVXHhR+N0boCscvSgae9KW9MBun0A2veRFXNkkfBEMfzelz+S63oeVfelkBq6N5aLsHYYGC4VQjimScelHYVwxR7O4fV+NttJaFF7H06FJeFzPt3NYZeoPKealD5y2Muh1UnewpmkMgza9hQ9EmI4/G1fMowqeMq0U6Hu0QMDUAagyalizN97AfsllY2cs0qLNg7+zHMPwc5RgLzs73oPUsF3umz0O42I5p5733vveUlWi5IZeI8CA1ZKdpwyMXXNhIOHs8u+yGsOLfSy3RgjVKp2GjN4lfnFd0LI+p7iEsEWDRkIAvGCOFepsebyVpBjGP+Kqs10bPGpk5dMcyn9iBJejoz9ka+H9+JAG04LnXwt6Rf1CRV3VRCRX1ayZEjRv9czV7U9ZpuFQcIlVRJQ== root@zu";
+ };
};
users = {
mv = {
diff --git a/tv/1systems/zu.nix b/tv/1systems/zu.nix
new file mode 100644
index 000000000..bfc018cc3
--- /dev/null
+++ b/tv/1systems/zu.nix
@@ -0,0 +1,229 @@
+{ config, lib, pkgs, ... }:
+
+with config.krebs.lib;
+
+{
+ krebs.build.host = config.krebs.hosts.zu;
+
+ imports = [
+ {
+ options.tv.test.sercret-file = mkOption {
+ type = types.secret-file;
+ default = {};
+ };
+ }
+ ../.
+ ../2configs/hw/x220.nix
+ ../2configs/exim-retiolum.nix
+ ../2configs/git.nix
+ ../2configs/mail-client.nix
+ ../2configs/man.nix
+ ../2configs/nginx/public_html.nix
+ ../2configs/pulse.nix
+ ../2configs/retiolum.nix
+ ../2configs/wu-binary-cache/client.nix
+ ../2configs/xserver
+ {
+ environment.systemPackages = with pkgs; [
+
+ # stockholm
+ gnumake
+ hashPassword
+ haskellPackages.lentil
+ parallel
+ (pkgs.writeBashBin "im" ''
+ export PATH=${makeSearchPath "bin" (with pkgs; [
+ tmux
+ gnugrep
+ weechat
+ ])}
+ if tmux list-sessions -F\#S | grep -q '^im''$'; then
+ exec tmux attach -t im
+ else
+ exec tmux new -s im weechat
+ fi
+ '')
+
+ # root
+ cryptsetup
+
+ # tv
+ bc
+ bind # dig
+ cac-api
+ dic
+ file
+ gnupg1compat
+ haskellPackages.hledger
+ htop
+ jq
+ mkpasswd
+ netcat
+ nix-repl
+ nmap
+ p7zip
+ pass
+ q
+ qrencode
+ # XXX fails at systemd.services.dbus.unitConfig
+ #texlive
+ tmux
+
+ #ack
+ #apache-httpd
+ #ascii
+ #emacs
+ #es
+ #esniper
+ #gcc
+ #gptfdisk
+ #graphviz
+ #haskellPackages.cabal2nix
+ #haskellPackages.ghc
+ #haskellPackages.shake
+ #hdparm
+ #i7z
+ #iftop
+ #imagemagick
+ #inotifyTools
+ #iodine
+ #iotop
+ #lshw
+ #lsof
+ #minicom
+ #mtools
+ #ncmpc
+ #nethogs
+ #nix-prefetch-scripts #cvs bug
+ #openssl
+ #openswan
+ #parted
+ #perl
+ #powertop
+ #ppp
+ #proot
+ #pythonPackages.arandr
+ #pythonPackages.youtube-dl
+ #racket
+ #rxvt_unicode-with-plugins
+ #scrot
+ #sec
+ #silver-searcher
+ #sloccount
+ #smartmontools
+ #socat
+ #sshpass
+ #strongswan
+ #sysdig
+ #sysstat
+ #tcpdump
+ #tlsdate
+ #unetbootin
+ #utillinuxCurses
+ #wvdial
+ #xdotool
+ #xkill
+ #xl2tpd
+ #xsel
+
+ unison
+ ];
+ }
+ ];
+
+ boot.initrd.luks = {
+ cryptoModules = [ "aes" "sha512" "xts" ];
+ devices = [
+ { name = "zuca"; device = "/dev/sda2"; }
+ ];
+ };
+
+ fileSystems = {
+ "/" = {
+ device = "/dev/mapper/zuvga-root";
+ fsType = "btrfs";
+ options = ["defaults" "noatime" "ssd" "compress=lzo"];
+ };
+ "/home" = {
+ device = "/dev/mapper/zuvga-home";
+ fsType = "btrfs";
+ options = ["defaults" "noatime" "ssd" "compress=lzo"];
+ };
+ "/boot" = {
+ device = "/dev/sda1";
+ };
+ "/tmp" = {
+ device = "tmpfs";
+ fsType = "tmpfs";
+ options = ["nosuid" "nodev" "noatime"];
+ };
+ };
+
+ nixpkgs.config.chromium.enablePepperFlash = true;
+
+ #hardware.bumblebee.enable = true;
+ #hardware.bumblebee.group = "video";
+ hardware.enableAllFirmware = true;
+ #hardware.opengl.driSupport32Bit = true;
+
+ environment.systemPackages = with pkgs; [
+ ethtool
+ tinc_pre
+ iptables
+ #jack2
+
+ gptfdisk
+ ];
+
+ security.setuidPrograms = [
+ "sendmail" # for cron
+ ];
+
+ services.printing.enable = true;
+
+ # see tmpfiles.d(5)
+ systemd.tmpfiles.rules = [
+ "d /tmp 1777 root root - -" # does this work with mounted /tmp?
+ ];
+
+ #services.bitlbee.enable = true;
+ #services.tor.client.enable = true;
+ #services.tor.enable = true;
+ #services.virtualboxHost.enable = true;
+
+
+ # The NixOS release to be compatible with for stateful data such as databases.
+ system.stateVersion = "15.09";
+
+#/*
+#{ host api.doraemon.sg.zalora.net | awk '{print$4" api.zalora.sg"}';
+# host bob.live.sg.zalora.net | awk '{print$4" bob.zalora.sg"}';
+# host www.live.sg.zalora.net | awk '{print$4" www.zalora.sg costa.zalora.sg"}'; }
+#*/
+# networking.extraHosts = optionalString (1 == 1) ''
+#54.255.133.72 api.zalora.sg
+#52.77.12.194 bob.zalora.sg
+#52.74.232.49 www.zalora.sg costa.zalora.sg
+# '';
+
+
+ #services.elasticsearch.enable = true;
+ #services.kibana.enable = true;
+ #services.logstash.enable = true;
+
+ environment.etc."ssh/ssh_config".text = mkForce ''
+ AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}
+
+ ${optionalString config.programs.ssh.setXAuthLocation ''
+ XAuthLocation ${pkgs.xorg.xauth}/bin/xauth
+ ''}
+
+ ForwardX11 ${if config.programs.ssh.forwardX11 then "yes" else "no"}
+
+ # Allow DSA keys for now. (These were deprecated in OpenSSH 7.0.)
+ #PubkeyAcceptedKeyTypes +ssh-dss
+
+ ${config.programs.ssh.extraConfig}
+ '';
+
+}