diff options
Diffstat (limited to 'lass')
31 files changed, 698 insertions, 402 deletions
diff --git a/lass/1systems/aergia/config.nix b/lass/1systems/aergia/config.nix new file mode 100644 index 000000000..ed5bbcf12 --- /dev/null +++ b/lass/1systems/aergia/config.nix @@ -0,0 +1,76 @@ +{ config, lib, pkgs, ... }: + +{ + imports = [ + <stockholm/lass> + + <stockholm/lass/2configs/retiolum.nix> + <stockholm/lass/2configs/exim-retiolum.nix> + <stockholm/lass/2configs/baseX.nix> + <stockholm/lass/2configs/pipewire.nix> + <stockholm/lass/2configs/browsers.nix> + <stockholm/lass/2configs/programs.nix> + <stockholm/lass/2configs/network-manager.nix> + <stockholm/lass/2configs/syncthing.nix> + <stockholm/lass/2configs/sync/sync.nix> + <stockholm/lass/2configs/games.nix> + <stockholm/lass/2configs/steam.nix> + <stockholm/lass/2configs/wine.nix> + <stockholm/lass/2configs/fetchWallpaper.nix> + <stockholm/lass/2configs/yellow-mounts/samba.nix> + <stockholm/lass/2configs/pass.nix> + <stockholm/lass/2configs/mail.nix> + <stockholm/lass/2configs/bitcoin.nix> + # <stockholm/lass/2configs/xonsh.nix> + <stockholm/lass/2configs/review.nix> + <stockholm/lass/2configs/dunst.nix> + <stockholm/lass/2configs/print.nix> + <stockholm/lass/2configs/br.nix> + ]; + + system.stateVersion = "22.11"; + + krebs.build.host = config.krebs.hosts.aergia; + + environment.systemPackages = with pkgs; [ + brain + bank + l-gen-secrets + generate-secrets + ]; + + programs.adb.enable = true; + + hardware.bluetooth = { + enable = true; + powerOnBoot = true; + }; + hardware.pulseaudio.package = pkgs.pulseaudioFull; + + lass.browser.config = { + fy = { browser = "chromium"; groups = [ "audio" "video" ]; hidden = true; }; + qt = { browser = "qutebrowser"; groups = [ "audio" "video" ]; hidden = true; }; + }; + + nix.trustedUsers = [ "root" "lass" ]; + + # nix.extraOptions = '' + # extra-experimental-features = nix-command flakes + # ''; + + services.tor = { + enable = true; + client.enable = true; + }; + + documentation.nixos.enable = true; + boot.binfmt.emulatedSystems = [ + "aarch64-linux" + ]; + + boot.cleanTmpDir = true; + + # vbox + virtualisation.virtualbox.host.enable = true; + users.users.mainUser.extraGroups = [ "vboxusers" ]; +} diff --git a/lass/1systems/aergia/disk.nix b/lass/1systems/aergia/disk.nix new file mode 100644 index 000000000..0ae0892ee --- /dev/null +++ b/lass/1systems/aergia/disk.nix @@ -0,0 +1,64 @@ +{ lib, ... }: +{ + disk = { + main = { + type = "disk"; + device = "/dev/nvme0n1"; + content = { + type = "table"; + format = "gpt"; + partitions = [ + { + name = "boot"; + type = "partition"; + start = "0"; + end = "1M"; + part-type = "primary"; + flags = ["bios_grub"]; + } + { + type = "partition"; + name = "ESP"; + start = "1MiB"; + end = "1GiB"; + fs-type = "fat32"; + bootable = true; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + }; + } + { + name = "root"; + type = "partition"; + start = "1GiB"; + end = "100%"; + content = { + type = "luks"; + name = "aergia1"; + content = { + type = "btrfs"; + extraArgs = "-f"; # Override existing partition + subvolumes = { + # Subvolume name is different from mountpoint + "/rootfs" = { + mountpoint = "/"; + }; + # Mountpoints inferred from subvolume name + "/home" = { + mountOptions = []; + }; + "/nix" = { + mountOptions = []; + }; + }; + }; + }; + } + ]; + }; + }; + }; +} + diff --git a/lass/1systems/aergia/install.sh b/lass/1systems/aergia/install.sh new file mode 100644 index 000000000..0e4f0ab4c --- /dev/null +++ b/lass/1systems/aergia/install.sh @@ -0,0 +1,3 @@ +#!/bin/sh + +target=$1 diff --git a/lass/1systems/aergia/physical.nix b/lass/1systems/aergia/physical.nix new file mode 100644 index 000000000..de5f7540e --- /dev/null +++ b/lass/1systems/aergia/physical.nix @@ -0,0 +1,86 @@ +{ config, lib, pkgs, modulesPath, ... }: +{ + imports = [ + ./config.nix + (modulesPath + "/installer/scan/not-detected.nix") + ]; + disko.devices = import ./disk.nix; + + networking.hostId = "deadbeef"; + # boot.loader.efi.canTouchEfiVariables = true; + boot.loader.grub = { + enable = true; + device = "/dev/nvme0n1"; + efiSupport = true; + efiInstallAsRemovable = true; + }; + + boot.kernelPackages = pkgs.linuxPackages_latest; + + boot.kernelParams = [ + # Enable energy savings during sleep + "mem_sleep_default=deep" + "initcall_blacklist=acpi_cpufreq_init" + + # for ryzenadj -i + "iomem=relaxed" + ]; + + # Enables the amd cpu scaling https://www.kernel.org/doc/html/latest/admin-guide/pm/amd-pstate.html + # On recent AMD CPUs this can be more energy efficient. + boot.kernelModules = [ "amd-pstate" "kvm-amd" ]; + + # hardware.cpu.amd.updateMicrocode = true; + + services.xserver.videoDrivers = [ + "amdgpu" + ]; + + boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "usbhid" "usb_storage" "sd_mod" ]; + + environment.systemPackages = [ + pkgs.vulkan-tools + pkgs.ryzenadj + (pkgs.writers.writeDashBin "set_tdp" '' + set -efux + watt=$1 + value=$(( $watt * 1000 )) + ${pkgs.ryzenadj}/bin/ryzenadj --stapm-limit="$value" --fast-limit="$value" --slow-limit="$value" + '') + ]; + + # textsize + services.xserver.dpi = 200; + hardware.video.hidpi.enable = lib.mkDefault true; + + # corectrl + programs.corectrl.enable = true; + users.users.mainUser.extraGroups = [ "corectrl" ]; + + # use newer ryzenadj + nixpkgs.config.packageOverrides = super: { + ryzenadj = super.ryzenadj.overrideAttrs (old: { + version = "unstable-2023-01-15"; + src = pkgs.fetchFromGitHub { + owner = "FlyGoat"; + repo = "RyzenAdj"; + rev = "1052fb52b2c0e23ac4cd868c4e74d4a9510be57c"; # unstable on 2023-01-15 + sha256 = "sha256-/IxkbQ1XrBrBVrsR4EdV6cbrFr1m+lGwz+rYBqxYG1k="; + }; + }); + }; + + # keyboard quirks + services.xserver.displayManager.sessionCommands = '' + xmodmap -e 'keycode 96 = F12 Insert F12 F12' # rebind shift + F12 to shift + insert + ''; + services.udev.extraHwdb = /* sh */ '' + # disable back buttons + evdev:input:b0003v2F24p0135* # /dev/input/event2 + KEYBOARD_KEY_70026=reserved + KEYBOARD_KEY_70027=reserved + ''; + + # ignore power key + services.logind.extraConfig = "HandlePowerKey=ignore"; +} diff --git a/lass/1systems/aergia/source.nix b/lass/1systems/aergia/source.nix new file mode 100644 index 000000000..abbf26c75 --- /dev/null +++ b/lass/1systems/aergia/source.nix @@ -0,0 +1,21 @@ +{ lib, pkgs, test, ... }: let + npkgs = lib.importJSON ../../../krebs/nixpkgs-unstable.json; +in { + nixpkgs = (if test then lib.mkForce ({ derivation = let + rev = npkgs.rev; + sha256 = npkgs.sha256; + in '' + with import (builtins.fetchTarball { + url = "https://github.com/nixos/nixpkgs/archive/${rev}.tar.gz"; + sha256 = "${sha256}"; + }) {}; + pkgs.fetchFromGitHub { + owner = "nixos"; + repo = "nixpkgs"; + rev = "${rev}"; + sha256 = "${sha256}"; + } + ''; }) else { + git.ref = lib.mkForce npkgs.rev; + }); +} diff --git a/lass/1systems/green/config.nix b/lass/1systems/green/config.nix index cd38c3585..077f7b3fa 100644 --- a/lass/1systems/green/config.nix +++ b/lass/1systems/green/config.nix @@ -27,7 +27,7 @@ with import <stockholm/lib>; krebs.build.host = config.krebs.hosts.green; - lass.sync-containers3.inContainer = { + krebs.sync-containers3.inContainer = { enable = true; pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFlUMf943qEQG64ob81p6dgoHq4jUjq7tSvmSdEOEU2y"; }; diff --git a/lass/1systems/hilum/disk.nix b/lass/1systems/hilum/disk.nix new file mode 100644 index 000000000..926401648 --- /dev/null +++ b/lass/1systems/hilum/disk.nix @@ -0,0 +1,53 @@ +{ lib, disk, keyFile, ... }: +{ + disk = { + main = { + type = "disk"; + device = disk; + content = { + type = "table"; + format = "gpt"; + partitions = [ + { + name = "boot"; + type = "partition"; + start = "0"; + end = "1M"; + part-type = "primary"; + flags = ["bios_grub"]; + } + { + type = "partition"; + name = "ESP"; + start = "1MiB"; + end = "50%"; + fs-type = "fat32"; + bootable = true; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + }; + } + { + name = "root"; + type = "partition"; + start = "50%"; + end = "100%"; + content = { + type = "luks"; + name = "hilum_luks"; + keyFile = keyFile; + content = { + type = "filesystem"; + format = "xfs"; + mountpoint = "/"; + }; + }; + } + ]; + }; + }; + }; +} + diff --git a/lass/1systems/hilum/flash-stick.sh b/lass/1systems/hilum/flash-stick.sh new file mode 100755 index 000000000..17a5fc580 --- /dev/null +++ b/lass/1systems/hilum/flash-stick.sh @@ -0,0 +1,37 @@ +#!/bin/sh +set -efux + +disk=$1 + +export NIXPKGS_ALLOW_UNFREE=1 +(umask 077; pass show admin/hilum/luks > /tmp/hilum.luks) +trap 'rm -f /tmp/hilum.luks' EXIT +stockholm_root=$(git rev-parse --show-toplevel) +ssh root@localhost -t -- $(nix-build \ + --no-out-link \ + -I nixpkgs=/var/src/nixpkgs \ + -I stockholm="$stockholm_root" \ + -I secrets="$stockholm_root"/lass/2configs/tests/dummy-secrets \ + -E "with import <nixpkgs> {}; (pkgs.nixos [ + { + luksPassFile = \"/tmp/hilum.luks\"; + mainDisk = \"$disk\"; + disko.rootMountPoint = \"/mnt/hilum\"; + } + ./physical.nix + ]).disko" +) +rm -f /tmp/hilum.luks +$(nix-build \ + --no-out-link \ + -I nixpkgs=/var/src/nixpkgs \ + "$stockholm_root"/lass/krops.nix -A populate \ + --argstr name hilum \ + --argstr target "root@localhost/mnt/hilum/var/src" \ + --arg force true +) +ssh root@localhost << SSH +NIXOS_CONFIG=/mnt/hilum/var/src/nixos-config nixos-install --no-root-password --root /mnt/hilum -I /var/src +nixos-enter --root /mnt/hilum -- nixos-rebuild -I /var/src switch --install-bootloader +umount -Rv /mnt/hilum +SSH diff --git a/lass/1systems/hilum/physical.nix b/lass/1systems/hilum/physical.nix index f8bab57d6..6f160062d 100644 --- a/lass/1systems/hilum/physical.nix +++ b/lass/1systems/hilum/physical.nix @@ -1,11 +1,38 @@ -{ lib, pkgs, ... }: +{ config, lib, pkgs, ... }: { imports = [ ./config.nix <nixpkgs/nixos/modules/installer/scan/not-detected.nix> + { + # nice hack to carry around state passed impurely at the beginning + options.mainDisk = let + tryFile = path: default: + if lib.elem (builtins.baseNameOf path) (lib.attrNames (builtins.readDir (builtins.dirOf path))) then + builtins.readFile path + else + default + ; + in lib.mkOption { + type = lib.types.str; + default = tryFile "/etc/hilum-disk" "/dev/sdz"; + }; + config.environment.etc.hilum-disk.text = config.mainDisk; + } + { + options.luksPassFile = lib.mkOption { + type = lib.types.nullOr lib.types.str; + default = null; + }; + } ]; + disko.devices = import ./disk.nix { + inherit lib; + disk = config.mainDisk; + keyFile = config.luksPassFile; + }; + boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "xhci_pci" "usb_storage" "sd_mod" "sdhci_pci" ]; boot.initrd.kernelModules = [ "dm-snapshot" ]; boot.kernelModules = [ "kvm-intel" ]; @@ -13,21 +40,9 @@ boot.loader.grub.enable = true; boot.loader.grub.efiSupport = true; - boot.loader.grub.device = "/dev/disk/by-id/usb-General_USB_Flash_Disk_0374116060006128-0:0"; + boot.loader.grub.device = config.mainDisk; boot.loader.grub.efiInstallAsRemovable = true; - fileSystems."/" = - { device = "/dev/disk/by-uuid/6db29cdd-ff64-496d-b541-5f1616665dc2"; - fsType = "ext4"; - }; - - boot.initrd.luks.devices."usb_nix".device = "/dev/disk/by-uuid/3c8ab3af-57fb-4564-9e27-b2766404f5d4"; - - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/2B9E-5131"; - fsType = "vfat"; - }; - swapDevices = [ ]; nix.maxJobs = lib.mkDefault 4; diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix index 8e5a60c36..7f6be782e 100644 --- a/lass/1systems/neoprism/config.nix +++ b/lass/1systems/neoprism/config.nix @@ -9,10 +9,16 @@ <stockholm/lass/2configs/consul.nix> <stockholm/lass/2configs/yellow-host.nix> <stockholm/lass/2configs/radio/container-host.nix> + <stockholm/lass/2configs/ubik-host.nix> # other containers <stockholm/lass/2configs/riot.nix> ]; krebs.build.host = config.krebs.hosts.neoprism; + + networking.firewall.allowedTCPPorts = [ 80 443 ]; + services.nginx.enable = true; + security.acme.acceptTerms = true; + security.acme.defaults.email = "acme@lassul.us"; } diff --git a/lass/1systems/orange/config.nix b/lass/1systems/orange/config.nix new file mode 100644 index 000000000..3bc20878e --- /dev/null +++ b/lass/1systems/orange/config.nix @@ -0,0 +1,21 @@ +with import <stockholm/lib>; +{ config, lib, pkgs, ... }: +{ + imports = [ + <stockholm/lass> + <stockholm/lass/2configs> + <stockholm/lass/2configs/retiolum.nix> + ]; + + krebs.build.host = config.krebs.hosts.orange; + + security.acme = { + acceptTerms = true; + defaults.email = "acme@lassul.us"; + }; + + krebs.sync-containers3.inContainer = { + enable = true; + pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFQWzKuXrwQopBc1mzb2VpljmwAs7Y8bRl9a8hBXLC+l"; + }; +} diff --git a/lass/1systems/orange/physical.nix b/lass/1systems/orange/physical.nix new file mode 100644 index 000000000..8577daf34 --- /dev/null +++ b/lass/1systems/orange/physical.nix @@ -0,0 +1,7 @@ +{ + imports = [ + ./config.nix + ]; + boot.isContainer = true; + networking.useDHCP = true; +} diff --git a/lass/1systems/radio/config.nix b/lass/1systems/radio/config.nix index 2fd23a448..5e34335d3 100644 --- a/lass/1systems/radio/config.nix +++ b/lass/1systems/radio/config.nix @@ -17,7 +17,7 @@ with import <stockholm/lib>; defaults.email = "acme@lassul.us"; }; - lass.sync-containers3.inContainer = { + krebs.sync-containers3.inContainer = { enable = true; pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvPKdbVwMEFCDMyNAzR8NdVjTbQL2G+03Xomxn6KKFt"; }; diff --git a/lass/1systems/ubik/config.nix b/lass/1systems/ubik/config.nix new file mode 100644 index 000000000..1d836d4ec --- /dev/null +++ b/lass/1systems/ubik/config.nix @@ -0,0 +1,33 @@ +with import <stockholm/lib>; +{ config, lib, pkgs, ... }: +{ + imports = [ + <stockholm/lass> + <stockholm/lass/2configs> + <stockholm/lass/2configs/retiolum.nix> + ]; + + krebs.build.host = config.krebs.hosts.ubik; + + krebs.sync-containers3.inContainer = { + enable = true; + pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPBFGMjH0+Dco6DVFZbByENMci8CFTLXCL7j53yctPnM"; + }; + + networking.firewall.allowedTCPPorts = [ 80 ]; + services.nextcloud = { + enable = true; + hostName = "c.apanowicz.de"; + package = pkgs.nextcloud25; + config.adminpassFile = "/run/nextcloud.pw"; + https = true; + }; + systemd.services.nextcloud-setup.serviceConfig.ExecStartPre = [ + "+${pkgs.writeDash "copy-pw" '' + ${pkgs.rsync}/bin/rsync \ + --chown nextcloud:nextcloud \ + --chmod 0700 \ + /var/src/secrets/nextcloud.pw /run/nextcloud.pw + ''}" + ]; +} diff --git a/lass/1systems/ubik/physical.nix b/lass/1systems/ubik/physical.nix new file mode 100644 index 000000000..8577daf34 --- /dev/null +++ b/lass/1systems/ubik/physical.nix @@ -0,0 +1,7 @@ +{ + imports = [ + ./config.nix + ]; + boot.isContainer = true; + networking.useDHCP = true; +} diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix index 06561e9cf..ff8189e24 100644 --- a/lass/1systems/yellow/config.nix +++ b/lass/1systems/yellow/config.nix @@ -9,7 +9,7 @@ in { krebs.build.host = config.krebs.hosts.yellow; - lass.sync-containers3.inContainer = { + krebs.sync-containers3.inContainer = { enable = true; pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN737BAP36KiZO97mPKTIUGJUcr97ps8zjfFag6cUiYL"; }; @@ -40,6 +40,7 @@ in { security.acme.certs."jelly.r".server = config.krebs.ssl.acmeURL; security.acme.certs."radar.r".server = config.krebs.ssl.acmeURL; security.acme.certs."sonar.r".server = config.krebs.ssl.acmeURL; + security.acme.certs."transmission.r".server = config.krebs.ssl.acmeURL; services.nginx = { enable = true; package = pkgs.nginx.override { @@ -152,6 +153,14 @@ in { proxy_set_header Accept-Encoding ""; ''; }; + virtualHosts."transmission.r" = { + enableACME = true; + addSSL = true; + locations."/".extraConfig = '' + proxy_pass http://localhost:9091/; + proxy_set_header Accept-Encoding ""; + ''; + }; virtualHosts."radar.r" = { enableACME = true; addSSL = true; diff --git a/lass/2configs/gg23.nix b/lass/2configs/gg23.nix index 51db9a40a..b35b0cb85 100644 --- a/lass/2configs/gg23.nix +++ b/lass/2configs/gg23.nix @@ -2,17 +2,19 @@ with import <stockholm/lib>; { + # ipv6 from vodafone is really really flaky + boot.kernel.sysctl."net.ipv6.conf.et0.disable_ipv6" = 1; systemd.network.networks."50-et0" = { matchConfig.Name = "et0"; - DHCP = "yes"; + DHCP = "ipv4"; # dhcpV4Config.UseDNS = false; # dhcpV6Config.UseDNS = false; linkConfig = { RequiredForOnline = "routable"; }; - # networkConfig = { - # LinkLocalAddressing = "no"; - # }; + networkConfig = { + LinkLocalAddressing = "no"; + }; # dhcpV6Config = { # PrefixDelegationHint = "::/60"; # }; @@ -23,14 +25,15 @@ with import <stockholm/lib>; # Managed = true; # }; }; + boot.kernel.sysctl."net.ipv4.ip_forward" = 1; systemd.network.networks."50-int0" = { name = "int0"; address = [ "10.42.0.1/24" ]; networkConfig = { - IPForward = "yes"; - IPMasquerade = "both"; + # IPForward = "yes"; + # IPMasquerade = "both"; ConfigureWithoutCarrier = true; DHCPServer = "yes"; # IPv6SendRA = "yes"; @@ -49,9 +52,16 @@ with import <stockholm/lib>; krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [ { v6 = false; predicate = "-s 10.42.0.0/24"; target = "ACCEPT"; } ]; + krebs.iptables.tables.nat.POSTROUTING.rules = [ + { v6 = false; predicate = "-s 10.42.0.0/24"; target = "MASQUERADE"; } + ]; networking.domain = "gg23"; + networking.useHostResolvConf = false; + services.resolved.extraConfig = '' + DNSStubListener=no + ''; services.dnsmasq = { enable = true; resolveLocalQueries = false; @@ -64,4 +74,12 @@ with import <stockholm/lib>; interface=int0 ''; }; + + environment.systemPackages = [ + (pkgs.writers.writeDashBin "restart_router" '' + ${pkgs.mosquitto}/bin/mosquitto_pub -h localhost -t 'cmnd/router/POWER' -u gg23 -P gg23-mqtt -m OFF + sleep 2 + ${pkgs.mosquitto}/bin/mosquitto_pub -h localhost -t 'cmnd/router/POWER' -u gg23 -P gg23-mqtt -m ON + '') + ]; } diff --git a/lass/2configs/green-host.nix b/lass/2configs/green-host.nix index 1e41e8e02..66088a562 100644 --- a/lass/2configs/green-host.nix +++ b/lass/2configs/green-host.nix @@ -1,10 +1,6 @@ { config, pkgs, ... }: { - imports = [ - <stockholm/lass/2configs/container-networking.nix> - ]; - - lass.sync-containers3.containers.green = { + krebs.sync-containers3.containers.green = { sshKey = "${toString <secrets>}/green.sync.key"; }; } diff --git a/lass/2configs/mail.nix b/lass/2configs/mail.nix index b874695a8..f5b2e22b7 100644 --- a/lass/2configs/mail.nix +++ b/lass/2configs/mail.nix @@ -1,5 +1,4 @@ -with import <stockholm/lib>; -{ pkgs, ... }: +{ config, lib, pkgs, ... }: let @@ -14,7 +13,6 @@ let port 465 tls on tls_starttls off - tls_fingerprint 9C:82:3B:0F:31:CE:1B:8E:96:00:CC:C9:FF:E7:BE:66:95:92:4F:22:DD:D6:2E:0E:1D:90:76:BE:8E:9E:8E:16 auth on user lassulus passwordeval pass show c-base/pass @@ -24,11 +22,12 @@ let notmuch-config = pkgs.writeText "notmuch-config" '' [database] path=/home/lass/Maildir + mail_root=/home/lass/Maildir [user] name=lassulus primary_email=lassulus@lassul.us - other_email=lass@mors.r;${concatStringsSep ";" (flatten (attrValues mailboxes))} + other_email=lass@mors.r;${lib.concatStringsSep ";" (lib.flatten (lib.attrValues mailboxes))} [new] tags=unread;inbox; @@ -93,11 +92,37 @@ let tag-new-mails = pkgs.writeDashBin "nm-tag-init" '' ${pkgs.notmuch}/bin/notmuch new - ${concatMapStringsSep "\n" (i: ''${pkgs.notmuch}/bin/notmuch tag -inbox +${i.name} -- tag:inbox ${concatMapStringsSep " or " (f: "${f}") i.value}'') (mapAttrsToList nameValuePair mailboxes)} + ${lib.concatMapStringsSep "\n" (i: '' + '') (lib.mapAttrsToList lib.nameValuePair mailboxes)} + ${lib.concatMapStringsSep "\n" (i: '' + mkdir -p "$HOME/Maildir/.${i.name}/cur" + for mail in $(${pkgs.notmuch}/bin/notmuch search --output=files 'tag:inbox and (${lib.concatMapStringsSep " or " (f: "${f}") i.value})'); do + if test -e "$mail"; then + mv "$mail" "$HOME/Maildir/.${i.name}/cur/" + else + echo "$mail does not exist" + fi + done + ${pkgs.notmuch}/bin/notmuch tag -inbox +${i.name} -- tag:inbox ${lib.concatMapStringsSep " or " (f: "${f}") i.value} + '') (lib.mapAttrsToList lib.nameValuePair mailboxes)} + ${pkgs.notmuch}/bin/notmuch new + ${pkgs.notmuch}/bin/notmuch dump > "$HOME/Maildir/notmuch.backup" ''; tag-old-mails = pkgs.writeDashBin "nm-tag-old" '' - ${concatMapStringsSep "\n" (i: ''${pkgs.notmuch}/bin/notmuch tag -inbox -archive +${i.name} -- ${concatMapStringsSep " or " (f: "${f}") i.value}'') (mapAttrsToList nameValuePair mailboxes)} + set -efux + ${lib.concatMapStringsSep "\n" (i: '' + ${pkgs.notmuch}/bin/notmuch tag -inbox -archive +${i.name} -- ${lib.concatMapStringsSep " or " (f: "${f}") i.value} + mkdir -p "$HOME/Maildir/.${i.name}/cur" + for mail in $(${pkgs.notmuch}/bin/notmuch search --output=files ${lib.concatMapStringsSep " or " (f: "${f}") i.value}); do + if test -e "$mail"; then + mv "$mail" "$HOME/Maildir/.${i.name}/cur/" + else + echo "$mail does not exist" + fi + done + '') (lib.mapAttrsToList lib.nameValuePair mailboxes)} + ${pkgs.notmuch}/bin/notmuch new --no-hooks ''; muttrc = pkgs.writeText "muttrc" '' @@ -110,17 +135,6 @@ let set crypt_verify_sig = yes set pgp_verify_command = "gpg --no-verbose --batch --output - --verify %s %f" - macro index \Cv \ - "<enter-command> set my_crypt_verify_sig=\$crypt_verify_sig<enter> \ - <enter-command> set crypt_verify_sig=yes<enter> \ - <display-message><enter-command> set crypt_verify_sig=\$my_crypt_verify_sig<enter>" \ - 'Verify PGP signature and open the message' - - macro pager \Cv \ - "<exit><enter-command> set my_crypt_verify_sig=\$crypt_verify_sig<enter> \ - <enter-command> set crypt_verify_sig=yes<enter> \ - <display-message><enter-command> set crypt_verify_sig=\$my_crypt_verify_sig<enter>" \ - 'Verify PGP signature' # read html mails auto_view text/html @@ -138,8 +152,8 @@ let set sendmail="${msmtp}/bin/msmtp" # enables parsing of outgoing mail set from="lassulus@lassul.us" alternates ^.*@lassul\.us$ ^.*@.*\.r$ - set use_from=yes - set envelope_from=yes + unset envelope_from_address + set use_envelope_from set reverse_name set sort=threads @@ -148,7 +162,7 @@ let virtual-mailboxes "Unread" "notmuch://?query=tag:unread" virtual-mailboxes "INBOX" "notmuch://?query=tag:inbox" - ${concatMapStringsSep "\n" (i: ''${" "}virtual-mailboxes "${i.name}" "notmuch://?query=tag:${i.name}"'') (mapAttrsToList nameValuePair mailboxes)} + ${lib.concatMapStringsSep "\n" (i: ''${" "}virtual-mailboxes "${i.name}" "notmuch://?query=tag:${i.name}"'') (lib.mapAttrsToList lib.nameValuePair mailboxes)} virtual-mailboxes "TODO" "notmuch://?query=tag:TODO" virtual-mailboxes "Starred" "notmuch://?query=tag:*" virtual-mailboxes "Archive" "notmuch://?query=tag:archive" @@ -166,6 +180,15 @@ let macro index + "<modify-labels>+*\n<sync-mailbox>" # tag as starred macro index - "<modify-labels>-*\n<sync-mailbox>" # tag as unstarred + # muchsync + bind index \Cr noop + macro index \Cr \ + "<enter-command>unset wait_key<enter> \ + <shell-escape>${pkgs.writeDash "muchsync" '' + set -efu + ${pkgs.muchsync}/bin/muchsync -F lass@green.r + ''}<enter> \ + 'run muchsync to green.r' #killed bind index d noop @@ -213,6 +236,9 @@ let macro pager ,@3 "<enter-command> set pager_index_lines=7; macro pager ] ,@1 'Toggle indexbar<Enter>" macro pager ] ,@1 'Toggle indexbar + # urlview + macro pager \cb <pipe-entry>'${pkgs.urlview}/bin/urlview'<enter> 'Follow links with urlview' + # sidebar set sidebar_divider_char = '│' set sidebar_delim_chars = "/" diff --git a/lass/2configs/orange-host.nix b/lass/2configs/orange-host.nix new file mode 100644 index 000000000..e4bfcff89 --- /dev/null +++ b/lass/2configs/orange-host.nix @@ -0,0 +1,15 @@ +{ config, pkgs, ... }: +{ + krebs.sync-containers3.containers.orange = { + sshKey = "${toString <secrets>}/orange.sync.key"; + }; + services.nginx.virtualHosts."lassul.us" = { + # enableACME = config.security; + # forceSSL = true; + locations."/" = { + recommendedProxySettings = true; + proxyWebsockets = true; + proxyPass = "http://orange.r"; + }; + }; +} diff --git a/lass/2configs/radio/container-host.nix b/lass/2configs/radio/container-host.nix index e32095ffa..de0ea9afe 100644 --- a/lass/2configs/radio/container-host.nix +++ b/lass/2configs/radio/container-host.nix @@ -1,6 +1,6 @@ { config, pkgs, ... }: { - lass.sync-containers3.containers.radio = { + krebs.sync-containers3.containers.radio = { sshKey = "${toString <secrets>}/radio.sync.key"; }; containers.radio = { diff --git a/lass/2configs/red-host.nix b/lass/2configs/red-host.nix index cbd9c097e..171191dac 100644 --- a/lass/2configs/red-host.nix +++ b/lass/2configs/red-host.nix @@ -8,7 +8,7 @@ in ]; - lass.sync-containers3.containers.red = { + krebs.sync-containers3.containers.red = { sshKey = "${toString <secrets>}/containers/red/sync.key"; ephemeral = true; }; diff --git a/lass/2configs/riot.nix b/lass/2configs/riot.nix index 559e7b20d..6aacec5b6 100644 --- a/lass/2configs/riot.nix +++ b/lass/2configs/riot.nix @@ -31,27 +31,31 @@ privateNetwork = true; hostAddress = "10.233.1.1"; localAddress = "10.233.1.2"; - forwardPorts = [ - { hostPort = 45622; containerPort = 22; } - ]; }; systemd.network.networks."50-ve-riot" = { matchConfig.Name = "ve-riot"; networkConfig = { - IPForward = "yes"; # weirdly we have to use POSTROUTING MASQUERADE here + # and set ip_forward manually + # IPForward = "yes"; # IPMasquerade = "both"; LinkLocalAddressing = "no"; KeepConfiguration = "static"; }; }; - # networking.nat can be used instead of this + boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkDefault 1; + krebs.iptables.tables.nat.POSTROUTING.rules = [ { v6 = false; predicate = "-s ${config.containers.riot.localAddress}"; target = "MASQUERADE"; } ]; + + # networking.nat can be used instead of this + krebs.iptables.tables.nat.PREROUTING.rules = [ + { predicate = "-p tcp --dport 45622"; target = "DNAT --to-destination ${config.containers.riot.localAddress}:22"; v6 = false; } + ]; krebs.iptables.tables.filter.FORWARD.rules = [ { predicate = "-i ve-riot"; target = "ACCEPT"; } { predicate = "-o ve-riot"; target = "ACCEPT"; } diff --git a/lass/2configs/ubik-host.nix b/lass/2configs/ubik-host.nix new file mode 100644 index 000000000..a4ad5e55e --- /dev/null +++ b/lass/2configs/ubik-host.nix @@ -0,0 +1,26 @@ +{ config, pkgs, ... }: +{ + krebs.sync-containers3.containers.ubik = { + sshKey = "${toString <secrets>}/ubik.sync.key"; + }; + containers.ubik.bindMounts."/var/lib" = { + hostPath = "/var/lib/sync-containers3/ubik/state"; + isReadOnly = false; + }; + containers.ubik.bindMounts."/var/lib/nextcloud/data" = { + hostPath = "/var/ubik"; + isReadOnly = false; + }; + services.nginx.virtualHosts."c.apanowicz.de" = { + enableACME = true; + forceSSL = true; + locations."/" = { + recommendedProxySettings = true; + proxyWebsockets = true; + proxyPass = "http://ubik.r"; + extraConfig = '' + client_max_body_size 9001M; + ''; + }; + }; +} diff --git a/lass/2configs/xmonad.nix b/lass/2configs/xmonad.nix index 8784da379..b506e026d 100644 --- a/lass/2configs/xmonad.nix +++ b/lass/2configs/xmonad.nix @@ -53,6 +53,7 @@ import XMonad.Util.EZConfig (additionalKeysP) import XMonad.Util.NamedWindows (getName) import XMonad.Util.Run (safeSpawn) import XMonad.Util.Ungrab (unGrab) +import XMonad.Util.Paste (pasteSelection) data LibNotifyUrgencyHook = LibNotifyUrgencyHook deriving (Read, Show) @@ -105,11 +106,9 @@ floatHooks = composeAll myKeyMap :: [([Char], X ())] myKeyMap = - [ ("M4-C-p", forkFile "${pkgs.scrot}/bin/scrot" [ "~/public_html/scrot.png" ] Nothing ) - , ("M4-p", forkFile "${pkgs.pass}/bin/passmenu" [ "--type" ] Nothing) + [ ("M4-p", forkFile "${pkgs.pass}/bin/passmenu" [ "--type" ] Nothing) , ("M4-S-p", forkFile "${pkgs.otpmenu}/bin/otpmenu" [] Nothing) - , ("M4-o", forkFile "${pkgs.brain}/bin/brainmenu --type" [] Nothing) - , ("M4-z", forkFile "${pkgs.emot-menu}/bin/emoticons" [] Nothing) + , ("M4-z", forkFile "${pkgs.unimenu}/bin/unimenu" [] Nothing) , ("M4-S-q", restart "xmonad" True) @@ -177,13 +176,13 @@ myKeyMap = , ("M4-<F10>", spawn "${pkgs.redshift}/bin/redshift -x") , ("M4-<F11>", spawn "${config.lass.screenlock.command}") - , ("M4-<F12>", spawn "${pkgs.systemd}/bin/systemctl suspend -i") , ("M4-u", spawn "${pkgs.xcalib}/bin/xcalib -invert -alter") , ("M4-y", spawn "/run/current-system/sw/bin/switch-theme toggle") - , ("M4-s", spawn "${pkgs.knav}/bin/knav") + ${lib.optionalString (builtins.hasAttr "warpd" pkgs) '', ("M4-s", spawn "${pkgs.warpd}/bin/warpd --hint")''} , ("M4-i", spawn "/run/current-system/sw/bin/screenshot") + , ("S-<F12>", pasteSelection) --, ("M4-w", screenWorkspace 0 >>= (windows . W.greedyView)) --, ("M4-e", screenWorkspace 1 >>= (windows . W.greedyView)) diff --git a/lass/2configs/yellow-host.nix b/lass/2configs/yellow-host.nix index d07c222c6..36027cb5d 100644 --- a/lass/2configs/yellow-host.nix +++ b/lass/2configs/yellow-host.nix @@ -1,6 +1,6 @@ { config, pkgs, ... }: { - lass.sync-containers3.containers.yellow = { + krebs.sync-containers3.containers.yellow = { sshKey = "${toString <secrets>}/yellow.sync.key"; }; containers.yellow.bindMounts."/var/lib" = { diff --git a/lass/2configs/yubikey.nix b/lass/2configs/yubikey.nix index a37752d5e..bf6a587af 100644 --- a/lass/2configs/yubikey.nix +++ b/lass/2configs/yubikey.nix @@ -3,6 +3,7 @@ environment.systemPackages = with pkgs; [ yubikey-personalization yubikey-manager + pinentry-curses pinentry-qt ]; services.udev.packages = with pkgs; [ yubikey-personalization ]; @@ -11,6 +12,7 @@ services.pcscd.enable = true; systemd.user.services.gpg-agent.serviceConfig.ExecStartPre = pkgs.writers.writeDash "init_gpg" '' set -x + mkdir -p $HOME/.gnupg ${pkgs.coreutils}/bin/ln -sf ${pkgs.writeText "scdaemon.conf" '' disable-ccid pcsc-driver ${pkgs.pcsclite.out}/lib/libpcsclite.so.1 @@ -25,6 +27,10 @@ reader-port Yubico YubiKey ''} $HOME/.gnupg/scdaemon.conf ''; + systemd.user.services.gpg-agent.serviceConfig.ExecStartPost = pkgs.writers.writeDash "init_gpg" '' + ${pkgs.gnupg}/bin/gpg --import ${../../kartei/lass/pgp/yubikey.pgp} >/dev/null + echo -e '5\ny\n' | gpg --command-fd 0 --expert --edit-key DBCD757846069B392EA9401D6657BE8A8D1EE807 trust >/dev/null || : + ''; security.polkit.extraConfig = '' polkit.addRule(function(action, subject) { @@ -38,13 +44,14 @@ } }); polkit.addRule(function(action, subject) { - polkit.log("subject: " + subject + " action: " + action); + polkit.log("subject: " + subject + " action: " + action); }); ''; environment.shellInit = '' if [ "$UID" -eq 1337 ] && [ -z "$SSH_CONNECTION" ]; then export GPG_TTY="$(tty)" + mkdir -p $HOME/.gnupg gpg-connect-agent --quiet updatestartuptty /bye > /dev/null export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh" if [ -z "$SSH_AUTH_SOCK" ]; then @@ -61,6 +68,7 @@ ssh.startAgent = false; gnupg.agent = { enable = true; + pinentryFlavor = "qt"; # enableSSHSupport = true; }; }; diff --git a/lass/3modules/default.nix b/lass/3modules/default.nix index 42efa8cd6..3a0b1306c 100644 --- a/lass/3modules/default.nix +++ b/lass/3modules/default.nix @@ -15,6 +15,5 @@ _: ./xjail.nix ./autowifi.nix ./browsers.nix - ./sync-containers3.nix ]; } diff --git a/lass/3modules/sync-containers3.nix b/lass/3modules/sync-containers3.nix deleted file mode 100644 index 86aa40f03..000000000 --- a/lass/3modules/sync-containers3.nix +++ /dev/null @@ -1,333 +0,0 @@ -{ config, lib, pkgs, ... }: let - cfg = config.lass.sync-containers3; - slib = pkgs.stockholm.lib; -in { - options.lass.sync-containers3 = { - inContainer = { - enable = lib.mkEnableOption "container config for syncing"; - pubkey = lib.mkOption { - type = lib.types.str; # TODO ssh key - }; - }; - containers = lib.mkOption { - default = {}; - type = lib.types.attrsOf (lib.types.submodule ({ config, ... }: { - options = { - name = lib.mkOption { - type = lib.types.str; - default = config._module.args.name; - }; - sshKey = lib.mkOption { - type = slib.types.absolute-pathname; - }; - luksKey = lib.mkOption { - type = slib.types.absolute-pathname; - default = config.sshKey; - }; - ephemeral = lib.mkOption { - type = lib.types.bool; - default = false; - }; - runContainer = lib.mkOption { - type = lib.types.bool; - default = true; - }; - }; - })); - }; - }; - config = lib.mkMerge [ - (lib.mkIf (cfg.containers != {}) { - - containers = lib.mapAttrs' (n: ctr: lib.nameValuePair ctr.name { - config = { - environment.systemPackages = [ - pkgs.dhcpcd - pkgs.git - pkgs.jq - ]; - networking.useDHCP = lib.mkForce true; - systemd.services.autoswitch = { - environment = { - NIX_REMOTE = "daemon"; - }; - wantedBy = [ "multi-user.target" ]; - serviceConfig.ExecStart = pkgs.writers.writeDash "autoswitch" '' - set -efu - mkdir -p /var/state/var_src - ln -Tfrs /var/state/var_src /var/src - if test -e /var/src/nixos-config; then - /run/current-system/sw/bin/nixos-rebuild -I /var/src switch || : - fi - ''; - unitConfig.X-StopOnRemoval = false; - }; - }; - autoStart = false; - enableTun = true; - ephemeral = ctr.ephemeral; - privateNetwork = true; - hostBridge = "ctr0"; - bindMounts = { - "/var/lib/self/disk" = { - hostPath = "/var/lib/sync-containers3/${ctr.name}/disk"; - isReadOnly = false; - }; - "/var/state" = { - hostPath = "/var/lib/sync-containers3/${ctr.name}/state"; - isReadOnly = false; - }; - }; - }) (lib.filterAttrs (_: ctr: ctr.runContainer) cfg.containers); - - systemd.services = lib.foldr lib.recursiveUpdate {} (lib.flatten (map (ctr: [ - { "${ctr.name}_syncer" = { - path = with pkgs; [ - coreutils - consul - rsync - openssh - systemd - ]; - startAt = "*:0/1"; - serviceConfig = { - User = "${ctr.name}_container"; - LoadCredential = [ - "ssh_key:${ctr.sshKey}" - ]; - ExecCondition = pkgs.writers.writeDash "${ctr.name}_checker" '' - set -efu - ! systemctl is-active --quiet container@${ctr.name}.service - ''; - ExecStart = pkgs.writers.writeDash "${ctr.name}_syncer" '' - set -efux - consul lock sync_${ctr.name} ${pkgs.writers.writeDash "${ctr.name}-sync" '' - set -efux - if /run/wrappers/bin/ping -c 1 ${ctr.name}.r; then - touch "$HOME"/incomplete - rsync -a -e "ssh -i $CREDENTIALS_DIRECTORY/ssh_key" --timeout=30 --inplace container_sync@${ctr.name}.r:disk "$HOME"/disk - rm "$HOME"/incomplete - fi - ''} - ''; - }; - }; } - { "${ctr.name}_watcher" = lib.mkIf ctr.runContainer { - path = with pkgs; [ - coreutils - consul - cryptsetup - curl - mount - util-linux - jq - retry - ]; - serviceConfig = { - ExecStart = pkgs.writers.writeDash "${ctr.name}_watcher" '' - set -efux - while sleep 5; do - # get the payload - # check if the host reacted recently - case $(curl -s -o /dev/null --retry 10 --retry-delay 10 -w '%{http_code}' http://127.0.0.1:8500/v1/kv/containers/${ctr.name}) in - 404) - echo 'got 404 from kv, should kill the container' - break - ;; - 500) - echo 'got 500 from kv, will kill container' - break - ;; - 200) - # echo 'got 200 from kv, will check payload' - payload=$(consul kv get containers/${ctr.name}) || continue - export payload - if [ "$(jq -rn 'env.payload | fromjson.host')" = '${config.networking.hostName}' ]; then - # echo 'we are the host, trying to reach container' - if $(retry -t 10 -d 10 -- /run/wrappers/bin/ping -q -c 1 ${ctr.name}.r > /dev/null); then - # echo 'container is reachable, continueing' - continue - else - # echo 'container seems dead, killing' - break - fi - else - echo 'we are not host, killing container' - break - fi - ;; - *) - echo 'unknown state, continuing' - continue - ;; - esac - done - /run/current-system/sw/bin/nixos-container stop ${ctr.name} || : - umount /var/lib/sync-containers3/${ctr.name}/state || : - cryptsetup luksClose ${ctr.name} || : - ''; - }; - }; } - { "${ctr.name}_scheduler" = lib.mkIf ctr.runContainer { - wantedBy = [ "multi-user.target" ]; - path = with pkgs; [ - coreutils - consul - cryptsetup - mount - util-linux - curl - systemd - jq - retry - bc - ]; - serviceConfig = { - Restart = "always"; - RestartSec = "30s"; - ExecStart = pkgs.writers.writeDash "${ctr.name}_scheduler" '' - set -efux - # get the payload - # check if the host reacted recently - case $(curl -s -o /dev/null --retry 10 -w '%{http_code}' http://127.0.0.1:8500/v1/kv/containers/${ctr.name}) in - 404) - # echo 'got 404 from kv, will create container' - ;; - 500) - # echo 'got 500 from kv, retrying again' - exit 0 - ;; - 200) - # echo 'got 200 from kv, will check payload' - export payload=$(consul kv get containers/${ctr.name}) - if [ "$(jq -rn 'env.payload | fromjson.host')" = '${config.networking.hostName}' ]; then - echo 'we are the host, starting container' - else - # echo 'we are not host, checking timestamp' - # if [ $(echo "$(date +%s) - $(jq -rn 'env.payload | fromjson.time') > 100" | bc) -eq 1 ]; then - if [ "$(jq -rn 'env.payload | fromjson.time | now - tonumber > 100')" = 'true' ]; then - echo 'last beacon is more than 100s ago, taking over' - else - # echo 'last beacon was recent. trying again' - exit 0 - fi - fi - ;; - *) - echo 'unknown state, bailing out' - exit 0 - ;; - esac - if test -e /var/lib/sync-containers3/${ctr.name}/incomplete; then - echo 'data is inconistent, start aborted' - exit 1 - fi - consul kv put containers/${ctr.name} "$(jq -cn '{host: "${config.networking.hostName}", time: now}')" >/dev/null - consul lock -verbose -monitor-retry=100 -timeout 30s -name container_${ctr.name} container_${ctr.name} ${pkgs.writers.writeBash "${ctr.name}-start" '' - set -efu - cryptsetup luksOpen --key-file ${ctr.luksKey} /var/lib/sync-containers3/${ctr.name}/disk ${ctr.name} || : - mkdir -p /var/lib/sync-containers3/${ctr.name}/state - mountpoint /var/lib/sync-containers3/${ctr.name}/state || mount /dev/mapper/${ctr.name} /var/lib/sync-containers3/${ctr.name}/state - /run/current-system/sw/bin/nixos-container start ${ctr.name} - # wait for system to become reachable for the first time - retry -t 10 -d 10 -- /run/wrappers/bin/ping -q -c 1 ${ctr.name}.r > /dev/null - systemctl start ${ctr.name}_watcher.service - while systemctl is-active container@${ctr.name}.service >/devnull && /run/wrappers/bin/ping -q -c 3 ${ctr.name}.r >/dev/null; do - consul kv put containers/${ctr.name} "$(jq -cn '{host: "${config.networking.hostName}", time: now}')" >/dev/null - sleep 10 - done - ''} - ''; - }; - }; } - ]) (lib.attrValues cfg.containers))); - - systemd.timers = lib.mapAttrs' (n: ctr: lib.nameValuePair "${ctr.name}_syncer" { - timerConfig = { - RandomizedDelaySec = 100; - }; - }) cfg.containers; - - users.groups = lib.mapAttrs' (_: ctr: lib.nameValuePair "${ctr.name}_container" { - }) cfg.containers; - users.users = lib.mapAttrs' (_: ctr: lib.nameValuePair "${ctr.name}_container" ({ - group = "${ctr.name}_container"; - isNormalUser = true; - uid = slib.genid_uint31 "container_${ctr.name}"; - home = "/var/lib/sync-containers3/${ctr.name}"; - createHome = true; - homeMode = "705"; - })) cfg.containers; - - environment.systemPackages = lib.mapAttrsToList (_: ctr: (pkgs.writers.writeDashBin "${ctr.name}_init" '' - set -efux - export PATH=${lib.makeBinPath [ - pkgs.coreutils - pkgs.cryptsetup - pkgs.libxfs.bin - ]}:$PATH - truncate -s 5G /var/lib/sync-containers3/${ctr.name}/disk - cryptsetup luksFormat /var/lib/sync-containers3/${ctr.name}/disk ${ctr.luksKey} - cryptsetup luksOpen --key-file ${ctr.luksKey} /var/lib/sync-containers3/${ctr.name}/disk ${ctr.name} - mkfs.xfs /dev/mapper/${ctr.name} - mkdir -p /var/lib/sync-containers3/${ctr.name}/state - mountpoint /var/lib/sync-containers3/${ctr.name}/state || mount /dev/mapper/${ctr.name} /var/lib/sync-containers3/${ctr.name}/state - /run/current-system/sw/bin/nixos-container start ${ctr.name} - /run/current-system/sw/bin/nixos-container run ${ctr.name} -- ${pkgs.writeDash "init" '' - mkdir -p /var/state - ''} - '')) cfg.containers; - }) - (lib.mkIf (cfg.containers != {}) { - # networking - systemd.network.networks.ctr0 = { - name = "ctr0"; - address = [ - "10.233.0.1/24" - ]; - networkConfig = { - IPForward = "yes"; - IPMasquerade = "both"; - ConfigureWithoutCarrier = true; - DHCPServer = "yes"; - }; - }; - systemd.network.netdevs.ctr0.netdevConfig = { - Kind = "bridge"; - Name = "ctr0"; - }; - networking.networkmanager.unmanaged = [ "ctr0" ]; - krebs.iptables.tables.filter.INPUT.rules = [ - { predicate = "-i ctr0"; target = "ACCEPT"; } - ]; - krebs.iptables.tables.filter.FORWARD.rules = [ - { predicate = "-i ctr0"; target = "ACCEPT"; } - { predicate = "-o ctr0"; target = "ACCEPT"; } - ]; - }) - (lib.mkIf cfg.inContainer.enable { - users.groups.container_sync = {}; - users.users.container_sync = { - group = "container_sync"; - uid = slib.genid_uint31 "container_sync"; - isNormalUser = true; - home = "/var/lib/self"; - createHome = true; - openssh.authorizedKeys.keys = [ - cfg.inContainer.pubkey - ]; - }; - - networking.useHostResolvConf = false; - networking.useNetworkd = true; - systemd.network = { - enable = true; - networks.eth0 = { - matchConfig.Name = "eth0"; - DHCP = "yes"; - dhcpV4Config.UseDNS = true; - }; - }; - }) - ]; -} diff --git a/lass/5pkgs/install-system/default.nix b/lass/5pkgs/install-system/default.nix index 9a392e669..0e13265f6 100644 --- a/lass/5pkgs/install-system/default.nix +++ b/lass/5pkgs/install-system/default.nix @@ -5,13 +5,21 @@ pkgs.writers.writeDashBin "install-system" '' TARGET=$2 # format if ! (sshn "$TARGET" -- mountpoint /mnt); then - nix run github:numtide/nixos-remote -- --stop-after-disko --store-paths "$(nix-build --no-out-link -I stockholm="$HOME"/sync/stockholm -I nixos-config="$HOME"/sync/stockholm/lass/1systems/"$SYSTEM"/physical.nix '<nixpkgs/nixos>' -A config.system.build.diskoNoDeps)" /dev/null "$TARGET" + if ! (sshn "$TARGET" -- type -p nix); then + nix run github:numtide/nixos-remote -- --stop-after-disko --store-paths "$(nix-build --no-out-link -I stockholm="$HOME"/sync/stockholm -I nixos-config="$HOME"/sync/stockholm/lass/1systems/"$SYSTEM"/physical.nix '<nixpkgs/nixos>' -A config.system.build.diskoNoDeps)" /dev/null "$TARGET" + else + disko=$(nix-build -I stockholm=$HOME/sync/stockholm -I secrets=$HOME/sync/stockholm/lass/2configs/tests/dummy-secrets -I nixos-config=$HOME/sync/stockholm/lass/1systems/$SYSTEM/physical.nix '<nixpkgs/nixos>' -A config.system.build.disko) + NIX_SSHOPTS='-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no' nix-copy-closure --to "$TARGET" "$disko" + sshn -t "$TARGET" -- "$disko" + fi fi # install dependencies sshn "$TARGET" << SSH - nix-channel --update - nix-env -iA nixos.git + if ! type -p git; then + nix-channel --update + nix-env -iA nixos.git + fi SSH # populate @@ -19,8 +27,9 @@ pkgs.writers.writeDashBin "install-system" '' # install sshn "$TARGET" << SSH - ln -s /mnt/var/src /var/src - NIXOS_CONFIG=/var/src/nixos-config nixos-install --no-root-password -I /var/src + NIXOS_CONFIG=/var/src/nixos-config nixos-install --no-root-password -I /mnt/var/src + nixos-enter -- nixos-rebuild -I /var/src switch --install-bootloader + umount -R /mnt zpool export -fa SSH '' diff --git a/lass/5pkgs/unimenu/default.nix b/lass/5pkgs/unimenu/default.nix new file mode 100644 index 000000000..d452195fc --- /dev/null +++ b/lass/5pkgs/unimenu/default.nix @@ -0,0 +1,91 @@ +{ + lib, + runCommand, + fetchurl, + writeText, + writers, + coreutils, + dmenu, + gnused, + libnotify, + xclip, + xdotool, + gawk, +}: let + unicode-file = runCommand "unicode.txt" {} '' + ${ + writers.writePython3 "generate.py" {flakeIgnore = ["E501" "E722"];} '' + import csv + + with open("${ + fetchurl { + url = "https://unicode.org/Public/UCD/latest/ucd/UnicodeData.txt"; + sha256 = "sha256-NgGOaGV/3LNIX2NmMP/oyFMuAcl3cD0oA/W4nWxf6vs="; + } + }", "r") as unicode_data: + reader = csv.reader(unicode_data, delimiter=";") + next(reader) # skip first row containing \0 + for row in reader: + codepoint = row[0] + name = row[1] + alternate_name = row[10] + try: + print(chr(int(codepoint, 16)), codepoint, name, alternate_name, sep=" ") + except: + continue + '' + } > $out + ''; + kaomoji-file = writeText "kaomoji.txt" '' + ¯\(°_o)/¯ dunno lol shrug dlol + ¯\_(ツ)_/¯ dunno lol shrug dlol + ( ͡° ͜ʖ ͡°) lenny + ¯\_( ͡° ͜ʖ ͡°)_/¯ lenny shrug dlol + ( ゚д゚) aaah sad noo + ヽ(^o^)丿 hi yay hello + (^o^: ups hehe + (^∇^) yay + ┗(`皿´)┛ angry argh + ヾ(^_^) byebye!! bye + <(^.^<) <(^.^)> (>^.^)> (7^.^)7 (>^.^<) dance + (-.-)Zzz... sleep + (∩╹□╹∩) oh noes woot + (╯°□°)╯ ┻━┻ table flip + (」゜ロ゜)」 why woot + (_゜_゜_) gloom I see you + ༼ ༎ຶ ෴ ༎ຶ༽ sad + (\/) (°,,,,°) (\/) krebs + ┳━┳ ヽ(ಠل͜ಠ)ノ putting table back + ┻━┻︵ \(°□°)/ ︵ ┻━┻ flip all dem tablez + (`・ω・´) bear look + ᕦ(ຈل͜ຈ)ᕤ strong flex muscle bicep + ᕦ(ò_óˇ)ᕤ strong flex muscle bicep + (๑>ᴗ<๑) excite + (∩ ` -´)⊃━━☆゚.*・。゚ wizard spell magic + ◕ ◡ ◕ puss in boots big eye + ≋≋≋≋≋̯̫⌧̯̫(ˆ•̮ ̮•ˆ) nyan cat + ʕ•ᴥ•ʔ bear + (ԾɷԾ) adventure time + (⁀ᗢ⁀) happy yay + (≧◡≦) happy yay + \(º □ º )/ panic + 𓂺 penis + 𓂸 penis + ''; +in + # ref https://github.com/LukeSmithxyz/voidrice/blob/9fe6802122f6e0392c7fe20eefd30437771d7f8e/.local/bin/dmenuunicode + writers.writeDashBin "unimenu" '' + history_file=$HOME/.cache/unimenu + PATH=${lib.makeBinPath [coreutils dmenu gnused libnotify xclip xdotool]} + chosen=$(cat "$history_file" ${kaomoji-file} ${unicode-file} | dmenu -p unicode -i -l 10 | tee --append "$history_file" | sed "s/ .*//") + + [ "$chosen" != "" ] || exit + + echo "$chosen" | tr -d '\n' | xclip -selection clipboard + + if [ -n "$1" ]; then + xdotool key Shift+Insert + else + notify-send --app-name="$(basename "$0")" "'$chosen' copied to clipboard." & + fi + '' |