diff options
63 files changed, 2536 insertions, 391 deletions
diff --git a/krebs/3modules/Reaktor.nix b/krebs/3modules/Reaktor.nix index d87003ac2..a70f1ef5d 100644 --- a/krebs/3modules/Reaktor.nix +++ b/krebs/3modules/Reaktor.nix @@ -3,99 +3,88 @@ with import <stockholm/lib>; let - ReaktorConfig = pkgs.writeText "config.py" '' - ${if (isString cfg.overrideConfig ) then '' - # Overriden Config - ${cfg.overrideConfig} - '' else ""} - ## Extra Config - ${concatStringsSep "\n" (map (plug: plug.config) cfg.plugins)} - ${cfg.extraConfig} - ''; cfg = config.krebs.Reaktor; + workdir = "/var/lib/Reaktor"; + out = { options.krebs.Reaktor = api; - config = lib.mkIf cfg.enable imp; + config = imp; }; - api = { - enable = mkOption { - default = false; - description = '' - Start Reaktor at system boot - ''; - }; + api = mkOption { + default = {}; + type = with types; attrsOf (submodule ({ options = { - nickname = mkOption { - default = config.krebs.build.host.name + "|r"; - type = types.string; - description = '' - The nick name of the irc bot. - Defaults to {hostname}|r - ''; - }; + nickname = mkOption { + default = config.krebs.build.host.name + "|r"; + type = types.string; + description = '' + The nick name of the irc bot. + Defaults to {hostname}|r + ''; + }; - overrideConfig = mkOption { - default = null; - type = types.nullOr types.str; - description = '' - configuration to be used instead of default ones. - Reaktor default cfg can be retrieved via `reaktor get-config` - ''; - }; - plugins = mkOption { - default = [pkgs.ReaktorPlugins.nixos-version]; - }; - extraConfig = mkOption { - default = ""; - type = types.string; - description = '' - configuration appended to the default or overridden configuration - ''; - }; + overrideConfig = mkOption { + default = null; + type = types.nullOr types.str; + description = '' + configuration to be used instead of default ones. + Reaktor default cfg can be retrieved via `reaktor get-config` + ''; + }; - workdir = mkOption { - default = "/var/lib/Reaktor"; - type = types.str; - description = '' - Reaktor working directory - ''; - }; - extraEnviron = mkOption { - default = {}; - type = types.attrsOf types.str; - description = '' - Environment to be provided to the service, can be: - REAKTOR_HOST - REAKTOR_PORT - REAKTOR_STATEDIR - - debug and nickname can be set separately via the Reaktor api - ''; - }; - channels = mkOption { - default = [ "#krebs" ]; - type = types.listOf types.str; - description = '' - Channels the Reaktor should connect to at startup. - ''; - }; - debug = mkOption { - default = false; - description = '' - Reaktor debug output - ''; - }; + plugins = mkOption { + default = [pkgs.ReaktorPlugins.nixos-version]; + }; + + extraConfig = mkOption { + default = ""; + type = types.string; + description = '' + configuration appended to the default or overridden configuration + ''; + }; + + extraEnviron = mkOption { + default = {}; + type = types.attrsOf types.str; + description = '' + Environment to be provided to the service, can be: + REAKTOR_HOST + REAKTOR_PORT + REAKTOR_STATEDIR + + debug and nickname can be set separately via the Reaktor api + ''; + }; + + channels = mkOption { + default = [ "#krebs" ]; + type = types.listOf types.str; + description = '' + Channels the Reaktor should connect to at startup. + ''; + }; + + debug = mkOption { + default = false; + description = '' + Reaktor debug output + ''; + }; + };})); }; imp = { + # TODO get user per configured bot + # TODO get home from api # for reaktor get-config users.extraUsers = singleton rec { name = "Reaktor"; uid = genid name; description = "Reaktor user"; - home = cfg.workdir; + home = workdir; createHome = true; }; @@ -104,39 +93,52 @@ let # gid = config.ids.gids.Reaktor; #}; - systemd.services.Reaktor = { - path = with pkgs; [ - utillinux #flock for tell_on-join - git # for nag - python # for caps - ]; - description = "Reaktor IRC Bot"; - after = [ "network.target" ]; - wantedBy = [ "multi-user.target" ]; - environment = { - GIT_SSL_CAINFO = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; - REAKTOR_NICKNAME = cfg.nickname; - REAKTOR_DEBUG = (if cfg.debug then "True" else "False"); - REAKTOR_CHANNELS = lib.concatStringsSep "," cfg.channels; - state_dir = cfg.workdir; - - } // cfg.extraEnviron; - serviceConfig= { - ExecStartPre = pkgs.writeScript "Reaktor-init" '' - #! /bin/sh - ${if (isString cfg.overrideConfig) then - ''cp ${ReaktorConfig} /tmp/config.py'' - else - ''(${pkgs.Reaktor}/bin/reaktor get-config;cat "${ReaktorConfig}" ) > /tmp/config.py'' - } + systemd.services = mapAttrs' (name: botcfg: + let + ReaktorConfig = pkgs.writeText "config.py" '' + ${if (isString botcfg.overrideConfig ) then '' + # Overriden Config + ${botcfg.overrideConfig} + '' else ""} + ## Extra Config + ${concatStringsSep "\n" (map (plug: plug.config) botcfg.plugins)} + ${botcfg.extraConfig} ''; - ExecStart = "${pkgs.Reaktor}/bin/reaktor run /tmp/config.py"; - PrivateTmp = "true"; - User = "Reaktor"; - Restart = "always"; - RestartSec= "30" ; + in nameValuePair "Reaktor-${name}" { + path = with pkgs; [ + utillinux #flock for tell_on-join + git # for nag + python # for caps + ]; + description = "Reaktor IRC Bot"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + environment = { + GIT_SSL_CAINFO = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; + REAKTOR_NICKNAME = botcfg.nickname; + REAKTOR_DEBUG = (if botcfg.debug then "True" else "False"); + REAKTOR_CHANNELS = lib.concatStringsSep "," botcfg.channels; + state_dir = workdir; + + } // botcfg.extraEnviron; + serviceConfig= { + ExecStartPre = pkgs.writeScript "Reaktor-init" '' + #! /bin/sh + ${if (isString botcfg.overrideConfig) then + ''cp ${ReaktorConfig} /tmp/reaktor-${name}-config.py'' + else + ''(${pkgs.Reaktor}/bin/reaktor get-config;cat "${ReaktorConfig}" ) > /tmp/reaktor-${name}-config.py'' + } + ''; + ExecStart = "${pkgs.Reaktor}/bin/reaktor run /tmp/reaktor-${name}-config.py"; + PrivateTmp = "true"; + User = "Reaktor"; + Restart = "always"; + RestartSec= "30" ; }; - }; + } + ) cfg; + }; in diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index bf09b7424..4b17c4abd 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -93,6 +93,7 @@ let { krebs = import ./lass { inherit config; }; } { krebs = import ./makefu { inherit config; }; } { krebs = import ./mv { inherit config; }; } + { krebs = import ./nin { inherit config; }; } { krebs = import ./shared { inherit config; }; } { krebs = import ./tv { inherit config; }; } { @@ -200,7 +201,7 @@ let }) // # GitHub's IPv4 address range is 192.30.252.0/22 - # Refs https://help.github.com/articles/what-ip-addresses-does-github-use-that-i-should-whitelist/ + # Refs https://help.github.com/articles/github-s-ip-addresses/ # 192.30.252.0/22 = 192.30.252.0-192.30.255.255 (1024 addresses) # Because line length is limited by OPENSSH_LINE_MAX (= 8192), # we split each /24 into its own entry. diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix index c96b14723..bda563f8d 100644 --- a/krebs/3modules/exim-smarthost.nix +++ b/krebs/3modules/exim-smarthost.nix @@ -2,7 +2,6 @@ with import <stockholm/lib>; let - indent = replaceChars ["\n"] ["\n "]; cfg = config.krebs.exim-smarthost; out = { diff --git a/krebs/3modules/fetchWallpaper.nix b/krebs/3modules/fetchWallpaper.nix index 94bcbed9d..aed5f595c 100644 --- a/krebs/3modules/fetchWallpaper.nix +++ b/krebs/3modules/fetchWallpaper.nix @@ -45,7 +45,7 @@ let mkdir -p ${shell.escape cfg.stateDir} cd ${shell.escape cfg.stateDir} - curl -s -o wallpaper.tmp -z wallpaper ${shell.escape cfg.url} && mv wallpaper.tmp wallpaper + (curl -s -o wallpaper.tmp -z wallpaper ${shell.escape cfg.url} && mv wallpaper.tmp wallpaper) || : feh --no-fehbg --bg-scale ${shell.escape cfg.stateDir}/wallpaper ''; diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix index 164831846..a08dbb32c 100644 --- a/krebs/3modules/git.nix +++ b/krebs/3modules/git.nix @@ -339,9 +339,11 @@ let description = "Git repository hosting user"; shell = "/bin/sh"; openssh.authorizedKeys.keys = - mapAttrsToList (_: makeAuthorizedKey git-ssh-command) - (filterAttrs (_: user: isString user.pubkey) - config.krebs.users); + unique + (sort lessThan + (map (makeAuthorizedKey git-ssh-command) + (filter (user: isString user.pubkey) + (concatMap (getAttr "user") cfg.rules)))); }; }; diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix index 933c2e513..b28e97e37 100644 --- a/krebs/3modules/nginx.nix +++ b/krebs/3modules/nginx.nix @@ -129,8 +129,6 @@ let }; }; - indent = replaceChars ["\n"] ["\n "]; - to-acme = { server-names, ssl, ... }: optionalAttrs ssl.acmeEnable { email = "lassulus@gmail.com"; diff --git a/krebs/3modules/nin/default.nix b/krebs/3modules/nin/default.nix new file mode 100644 index 000000000..3231c0e23 --- /dev/null +++ b/krebs/3modules/nin/default.nix @@ -0,0 +1,65 @@ +{ config, ... }: + +with import <stockholm/lib>; + +{ + hosts = mapAttrs (_: setAttr "owner" config.krebs.users.nin) { + hiawatha = { + cores = 2; + nets = { + retiolum = { + ip4.addr = "10.243.132.96"; + ip6.addr = "42:0000:0000:0000:0000:0000:0000:2342"; + aliases = [ + "hiawatha.retiolum" + "hiawatha.r" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEAucIe5yLzKJ8F982XRpZT6CvyXuPrtnNTmw/E/T6Oyq88m/OVHh6o + Viho1XAlJZZwqNniItD0AQB98uFB3+3yA7FepnwwC+PEceIfBG4bTDNyYD3ZCsAB + iWpmRar9SQ7LFnoZ6X2lYaJkUD9afmvXqJJLR5MClnRQo5OSqXaFdp7ryWinHP7E + UkPSNByu4LbQ9CnBEW8mmCVZSBLb8ezxg3HpJSigmUcJgiDBJ6aj22BsZ5L+j1Sr + lvUuaCr8WOS41AYsD5dbTYk7EG42tU5utrOS6z5yHmhbA5r8Ro2OFi/R3Td68BIJ + yw/m8sfItBCvjJSMEpKHEDfGMBCfQKltCwIDAQAB + -----END RSA PUBLIC KEY----- + ''; + }; + }; + ssh.privkey.path = <secrets/ssh.id_ed25519>; + ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFizK5kauDlnjm/IzyzLi+W4hLKqjSWMkfuxzLwg6egx"; + }; + onondaga = { + cores = 1; + nets = { + retiolum = { + ip4.addr = "10.243.132.55"; + ip6.addr = "42:0000:0000:0000:0000:0000:0000:1357"; + aliases = [ + "onondaga.retiolum" + "onondaga.r" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEAqj6NPhRVsr8abz9FFx9+ld3amfxN7SRNccbksUOqkufGS0vaupFR + OWsgj4Qmt3lQ82YVt5yjx0FZHkAsenCEKM3kYoIb4nipT0e1MWkQ7plVveMfGkiu + htaJ1aCbI2Adxfmk4YbyAr8k3G+Zl9t7gTikBRh7cf5PMiu2JhGUZHzx9urR0ieH + xyashZFjl4TtIy4q6QTiyST9kfzteh8k7CJ72zfYkdHl9dPlr5Nk22zH9xPkyzmO + kCNeknuDqKeTT9erNtRLk6pjEcyutt0y2/Uq6iZ38z5qq9k4JzcMuQ3YPpNy8bxn + hVuk2qBu6kBTUW3iLchoh0d4cfFLWLx1SQIDAQAB + -----END RSA PUBLIC KEY----- + ''; + }; + }; + ssh.privkey.path = <secrets/ssh.id_ed25519>; + ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGmQk7AXsYLzjUrOjsuhZ3+gT7FjhPtjwxv5XnuU8GJO"; + }; + + }; + users = { + nin = { + mail = "nin@hiawatha.retiolum"; + pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDicZLUPEVNX7SgqYWcjPo0UESRizEfIvVVbiwa1aApA8x25u/5R3sevcgbIpLHYKDMl5tebny9inr6G2zqB6oq/pocQjHxrPnuLzqjvqeSpbjQjlNWJ9GaHT5koTXZHdkEXGL0vfv1SRDNWUiK0rNymr3GXab4DyrnRnuNl/G1UtLf4Zka94YUD0SSPdS9y6knnRrUWKjGMFBZEbNSgHqMGATPQP9VDwKHIO2OWGfiBAJ4nj/MWj+BxHDleCMY9zbym8yY7p/0PLaUe9eIyLC8MftJ5suuMmASlj+UGWgnqUxWxsMHax9y7CTAc23r1NNCXN5LC6/facGt0rEQrdrTizBgOA1FSHAPCl5f0DBEgWBrRuygEcAueuGWvI8/uvtvQQZLhosDbXEfs/3vm2xoYBe7wH4NZHm+d2LqgIcPXehH9hVQsl6pczngTCJt0Q/6tIMffjhDHeYf6xbe/n3AqFT0PylUSvOw/H5iHws3R6rxtgnOio7yTJ4sq0NMzXCtBY6LYPGnkwf0oKsgB8KavZVnxzF8B1TD4nNi0a7ma7bd1LMzI/oGE6i8kDMROgisIECOcoe8YYJZXIne/wimhhRKZAsd+VrKUo4SzNIavCruCodGAVh2vfrqRJD+HD/aWH7Vr1fCEexquaxeKpRtKGIPW9LRCcEsTilqpZdAiw== nin@hiawatha"; + }; + }; +} diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index d44c322aa..1220143a7 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -85,7 +85,7 @@ with import <stockholm/lib>; }; nets = { internet = { - ip4.addr = "45.62.237.203"; + ip4.addr = "64.137.177.226"; aliases = [ "cd.i" "cd.krebsco.de" diff --git a/krebs/4lib/infest/prepare.sh b/krebs/4lib/infest/prepare.sh index e265b0e67..3f5d66431 100644 --- a/krebs/4lib/infest/prepare.sh +++ b/krebs/4lib/infest/prepare.sh @@ -143,10 +143,10 @@ prepare_common() {( mkdir -p /mnt/boot if mount | grep -Fq ' on /boot type '; then - bootdev=$(mount | grep " on /boot type " | sed 's/ .*//') - mount $bootdev /mnt/boot + bootpart=$(mount | grep ' on /boot type ' | sed 's/ .*//') + mount $bootpart /mnt/boot else - mount --bind /boot/ /mnt/boot + mount --bind /boot /mnt/boot fi fi @@ -155,10 +155,12 @@ prepare_common() {( # prepare install directory # - rootpart=$(mount | grep " on / type" | sed 's/ .*//') + rootpart=$(mount | grep ' on / type ' | sed 's/ .*//') mkdir -p /mnt/etc/nixos mkdir -m 0555 -p /mnt/var/empty + mkdir -p /mnt/var/src + touch /mnt/var/src/.populate if ! mount | grep -Fq "$rootpart on /mnt/root type "; then mkdir -p /mnt/root diff --git a/krebs/5pkgs/Reaktor/plugins.nix b/krebs/5pkgs/Reaktor/plugins.nix index a483db32c..d4774dd69 100644 --- a/krebs/5pkgs/Reaktor/plugins.nix +++ b/krebs/5pkgs/Reaktor/plugins.nix @@ -116,4 +116,16 @@ rec { commands.insert(0,titlebot_cmd('clear')) ''; }; + + url-title = (buildSimpleReaktorPlugin "url-title" { + pattern = "^.*(?P<args>http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+)$$"; + path = with pkgs; [ curl perl ]; + script = pkgs.writeDash "lambda-pl" '' + if [ "$#" -gt 0 ]; then + curl -SsL --max-time 5 "$1" | + perl -l -0777 -ne 'print $1 if /<title.*?>\s*(.*?)(?: - youtube)?\s*<\/title/si' + fi + ''; + }); + } diff --git a/krebs/5pkgs/bepasty-client-cli/default.nix b/krebs/5pkgs/bepasty-client-cli/default.nix index 990f99af6..c58e637b3 100644 --- a/krebs/5pkgs/bepasty-client-cli/default.nix +++ b/krebs/5pkgs/bepasty-client-cli/default.nix @@ -1,17 +1,18 @@ -{ lib, pkgs, pythonPackages, fetchurl, ... }: +{ lib, pkgs, pythonPackages, fetchFromGitHub, ... }: with pythonPackages; buildPythonPackage rec { - name = "bepasty-client-cli-${version}"; - version = "0.3.0"; + name = "bepasty-client-cli"; propagatedBuildInputs = [ python_magic click requests2 ]; - src = fetchurl { - url = "https://pypi.python.org/packages/source/b/bepasty-client-cli/bepasty-client-cli-${version}.tar.gz"; - sha256 = "002kcplyfnmr5pn2ywdfilss0rmbm8wcdzz8hzp03ksy2zr4sdbw"; + src = fetchFromGitHub { + owner = "bepasty"; + repo = "bepasty-client-cli"; + rev = "4b7135ba8ba1e17501de08ad7b6aca73c0d949d2"; + sha256 = "1svchyk9zai1vip9ppm12jm7wfjbdr9ijhgcd2n10xh73jrn9cnc"; }; meta = { diff --git a/krebs/5pkgs/kapacitor/default.nix b/krebs/5pkgs/kapacitor/default.nix new file mode 100644 index 000000000..804826941 --- /dev/null +++ b/krebs/5pkgs/kapacitor/default.nix @@ -0,0 +1,23 @@ +{ stdenv, lib, fetchFromGitHub, buildGoPackage }: + +buildGoPackage rec { + name = "kapacitor-${version}"; + version = "1.0.0"; + + goPackagePath = "github.com/influxdata/kapacitor"; + + src = fetchFromGitHub { + owner = "influxdata"; + repo = "kapacitor"; + rev = "v${version}"; + sha256 = "14l9bhj6qdif79s4dyqqbnjgj3m4iarvw0ckld1wdhpdgvl8w9qh"; + }; + + meta = with lib; { + description = "Open source framework for processing, monitoring, and alerting on time series data"; + license = licenses.mit; + homepage = https://influxdata.com/time-series-platform/kapacitor/; + maintainers = with maintainers; [offline]; + platforms = with platforms; linux; + }; +} diff --git a/krebs/5pkgs/telegraf/default.nix b/krebs/5pkgs/telegraf/default.nix new file mode 100644 index 000000000..996c839ac --- /dev/null +++ b/krebs/5pkgs/telegraf/default.nix @@ -0,0 +1,27 @@ +{ lib, buildGoPackage, fetchFromGitHub }: + +buildGoPackage rec { + name = "telegraf-${version}"; + version = "1.1.2"; + + goPackagePath = "github.com/influxdata/telegraf"; + + excludedPackages = "test"; + + src = fetchFromGitHub { + owner = "influxdata"; + repo = "telegraf"; + rev = "${version}"; + sha256 = "0dgrbdyz261j28wcq636125ha4xmfgh4y9shlg8m1y6jqdqd2zf2"; + }; + + goDeps = ./. + builtins.toPath "/deps-${version}.nix"; + + meta = with lib; { + description = "The plugin-driven server agent for collecting & reporting metrics."; + license = licenses.mit; + homepage = https://www.influxdata.com/time-series-platform/telegraf/; + maintainers = with maintainers; [ mic92 roblabla ]; + platforms = platforms.linux; + }; +} diff --git a/krebs/5pkgs/telegraf/deps-1.1.2.nix b/krebs/5pkgs/telegraf/deps-1.1.2.nix new file mode 100644 index 000000000..b62ae44db --- /dev/null +++ b/krebs/5pkgs/telegraf/deps-1.1.2.nix @@ -0,0 +1,588 @@ +# This file was generated by go2nix. +[ + { + goPackagePath = "github.com/Shopify/sarama"; + fetch = { + type = "git"; + url = "https://github.com/Shopify/sarama"; + rev = "8aadb476e66ca998f2f6bb3c993e9a2daa3666b9"; + sha256 = "1ndaddqcll9r22jg9x36acanxv5ds3xwahrm4b6nmmg06670gksv"; + }; + } + { + goPackagePath = "github.com/Sirupsen/logrus"; + fetch = { + type = "git"; + url = "https://github.com/Sirupsen/logrus"; + rev = "219c8cb75c258c552e999735be6df753ffc7afdc"; + sha256 = "04v55846v1535dplldyjhr0yqxl6n1mr4kiy2vz3ragv92xpshr6"; + }; + } + { + goPackagePath = "github.com/aerospike/aerospike-client-go"; + fetch = { + type = "git"; + url = "https://github.com/aerospike/aerospike-client-go"; + rev = "7f3a312c3b2a60ac083ec6da296091c52c795c63"; + sha256 = "05ancqplckvni9xp6xd4bv2pgkfa4v23svfcg27m8xinzi4ry219"; + }; + } + { + goPackagePath = "github.com/amir/raidman"; + fetch = { + type = "git"; + url = "https://github.com/amir/raidman" |