summaryrefslogtreecommitdiffstats
path: root/makefu
diff options
context:
space:
mode:
Diffstat (limited to 'makefu')
-rw-r--r--makefu/1systems/darth.nix24
-rw-r--r--makefu/1systems/omo.nix47
-rw-r--r--makefu/1systems/pornocauster.nix12
-rw-r--r--makefu/1systems/shoney.nix54
-rw-r--r--makefu/1systems/wry.nix13
-rw-r--r--makefu/2configs/default.nix15
-rw-r--r--makefu/2configs/fs/CAC-CentOS-7-64bit.nix20
-rw-r--r--makefu/2configs/fs/sda-crypto-root.nix6
-rw-r--r--makefu/2configs/hw/CAC.nix13
-rw-r--r--makefu/2configs/hw/fingerprint-reader.nix6
-rw-r--r--makefu/2configs/hw/tp-x220.nix4
-rw-r--r--makefu/2configs/hw/tp-x2x0.nix3
-rw-r--r--makefu/2configs/save-diskspace.nix9
-rw-r--r--makefu/3modules/umts.nix10
-rw-r--r--makefu/5pkgs/bintray-upload/default.nix19
-rw-r--r--makefu/5pkgs/default.nix3
-rw-r--r--makefu/6tests/data/secrets/bepasty-secret.nix1
-rw-r--r--makefu/6tests/data/secrets/hashedPasswords.nix1
-rw-r--r--makefu/6tests/data/secrets/iodinepw.nix1
-rw-r--r--makefu/6tests/data/secrets/retiolum-ci.rsa_key.priv0
-rw-r--r--makefu/6tests/data/secrets/retiolum.rsa_key.priv0
-rw-r--r--makefu/6tests/data/secrets/retiolum.rsa_key.pub0
-rw-r--r--makefu/6tests/data/secrets/sambacred0
-rw-r--r--makefu/6tests/data/secrets/ssh.makefu.id_rsa0
-rw-r--r--makefu/6tests/data/secrets/ssh.makefu.id_rsa.pub0
-rw-r--r--makefu/6tests/data/secrets/ssh_host_ed25519_key0
-rw-r--r--makefu/6tests/data/secrets/tinc.krebsco.de.crt0
-rw-r--r--makefu/6tests/data/secrets/tinc.krebsco.de.key0
-rw-r--r--makefu/6tests/data/secrets/tw-pass.ini0
-rw-r--r--makefu/6tests/data/secrets/wildcard.krebsco.de.crt0
-rw-r--r--makefu/6tests/data/secrets/wildcard.krebsco.de.key0
31 files changed, 215 insertions, 46 deletions
diff --git a/makefu/1systems/darth.nix b/makefu/1systems/darth.nix
index 2f2358ddc..5f1d6e121 100644
--- a/makefu/1systems/darth.nix
+++ b/makefu/1systems/darth.nix
@@ -17,19 +17,31 @@ in {
../2configs/exim-retiolum.nix
../2configs/virtualization.nix
];
-
- networking.firewall.allowedUDPPorts = [ 80 655 67 ];
- networking.firewall.allowedTCPPorts = [ 80 655 ];
- networking.firewall.checkReversePath = false;
+ services.tinc.networks.siem = {
+ name = "sdarth";
+ extraConfig = "ConnectTo = sjump";
+ };
#networking.firewall.enable = false;
- # virtualisation.nova.enableSingleNode = true;
krebs.retiolum.enable = true;
boot.kernelModules = [ "coretemp" "f71882fg" ];
hardware.enableAllFirmware = true;
nixpkgs.config.allowUnfree = true;
- networking.wireless.enable = true;
+ networking = {
+ wireless.enable = true;
+ firewall = {
+ allowPing = true;
+ logRefusedConnections = false;
+ allowedUDPPorts = [ 80 655 1655 67 ];
+ allowedTCPPorts = [ 80 655 1655 ];
+ };
+ # fallback connection to the internal virtual network
+ interfaces.virbr3.ip4 = [{
+ address = "10.8.8.2";
+ prefixLength = 24;
+ }];
+ };
# TODO smartd omo darth gum all-in-one
services.smartd.devices = builtins.map (x: { device = x; }) allDisks;
diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix
index fbd06a9c7..e71055f54 100644
--- a/makefu/1systems/omo.nix
+++ b/makefu/1systems/omo.nix
@@ -5,9 +5,10 @@
{ config, pkgs, lib, ... }:
let
byid = dev: "/dev/disk/by-id/" + dev;
- keyFile = "/dev/disk/by-id/usb-Verbatim_STORE_N_GO_070B3CEE0B223954-0:0";
- rootDisk = byid "ata-INTEL_SSDSA2M080G2GC_CVPO003402PB080BGN";
- homePartition = byid "ata-INTEL_SSDSA2M080G2GC_CVPO003402PB080BGN-part3";
+ keyFile = byid "usb-Verbatim_STORE_N_GO_070B3CEE0B223954-0:0";
+ rootDisk = byid "ata-SanDisk_SD8SNAT128G1122_162099420904";
+ rootPartition = byid "ata-SanDisk_SD8SNAT128G1122_162099420904-part2";
+ primaryInterface = "enp1s0";
# cryptsetup luksFormat $dev --cipher aes-xts-plain64 -s 512 -h sha512
# cryptsetup luksAddKey $dev tmpkey
# cryptsetup luksOpen $dev crypt0 --key-file tmpkey --keyfile-size=4096
@@ -15,14 +16,14 @@ let
# omo Chassis:
# __FRONT_
- # |* d2 |
+ # |* d0 |
# | |
# |* d3 |
# | |
- # |* d0 |
+ # |* d3 |
# | |
- # |* d1 |
# |* |
+ # |* d2 |
# | * r0 |
# |_______|
cryptDisk0 = byid "ata-ST2000DM001-1CH164_Z240XTT6";
@@ -38,27 +39,31 @@ in {
[
../.
# TODO: unlock home partition via ssh
- ../2configs/fs/single-partition-ext4.nix
+ ../2configs/fs/sda-crypto-root.nix
../2configs/zsh-user.nix
../2configs/exim-retiolum.nix
../2configs/smart-monitor.nix
../2configs/mail-client.nix
- ../2configs/share-user-sftp.nix
- ../2configs/graphite-standalone.nix
+ #../2configs/graphite-standalone.nix
+ #../2configs/share-user-sftp.nix
../2configs/omo-share.nix
+
+ ## as long as pyload is not in nixpkgs:
+ # docker run -d -v /var/lib/pyload:/opt/pyload/pyload-config -v /media/crypt0/pyload:/opt/pyload/Downloads --name pyload --restart=always -p 8112:8000 -P writl/pyload
];
krebs.retiolum.enable = true;
- networking.firewall.trustedInterfaces = [ "enp3s0" ];
+ networking.firewall.trustedInterfaces = [ primaryInterface ];
# udp:137 udp:138 tcp:445 tcp:139 - samba, allowed in local net
# tcp:80 - nginx for sharing files
# tcp:655 udp:655 - tinc
# tcp:8111 - graphite
+ # tcp:8112 - pyload
# tcp:9090 - sabnzbd
# tcp:9200 - elasticsearch
# tcp:5601 - kibana
networking.firewall.allowedUDPPorts = [ 655 ];
- networking.firewall.allowedTCPPorts = [ 80 655 5601 8111 9200 9090 ];
+ networking.firewall.allowedTCPPorts = [ 80 655 5601 8111 8112 9200 9090 ];
# services.openssh.allowSFTP = false;
@@ -66,6 +71,9 @@ in {
services.sabnzbd.enable = true;
systemd.services.sabnzbd.environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+ virtualisation.docker.enable = true;
+
+
# HDD Array stuff
services.smartd.devices = builtins.map (x: { device = x; }) allDisks;
@@ -76,15 +84,11 @@ in {
disks = map toMapper [ 0 1 ];
parity = toMapper 2;
};
+
fileSystems = let
cryptMount = name:
{ "/media/${name}" = { device = "/dev/mapper/${name}"; fsType = "xfs"; };};
- in {
- "/home" = {
- device = "/dev/mapper/home";
- fsType = "ext4";
- };
- } // cryptMount "crypt0"
+ in cryptMount "crypt0"
// cryptMount "crypt1"
// cryptMount "crypt2";
@@ -101,15 +105,16 @@ in {
usbkey = name: device: {
inherit name device keyFile;
keyFileSize = 4096;
+ allowDiscards = true;
};
in [
- (usbkey "home" homePartition)
+ (usbkey "luksroot" rootPartition)
(usbkey "crypt0" cryptDisk0)
(usbkey "crypt1" cryptDisk1)
(usbkey "crypt2" cryptDisk2)
];
};
- loader.grub.device = rootDisk;
+ loader.grub.device = lib.mkForce rootDisk;
initrd.availableKernelModules = [
"ahci"
@@ -121,12 +126,12 @@ in {
"usbhid"
];
- kernelModules = [ "kvm-amd" ];
+ kernelModules = [ "kvm-intel" ];
extraModulePackages = [ ];
};
hardware.enableAllFirmware = true;
- hardware.cpu.amd.updateMicrocode = true;
+ hardware.cpu.intel.updateMicrocode = true;
zramSwap.enable = true;
diff --git a/makefu/1systems/pornocauster.nix b/makefu/1systems/pornocauster.nix
index fa39b121c..7b6c18342 100644
--- a/makefu/1systems/pornocauster.nix
+++ b/makefu/1systems/pornocauster.nix
@@ -31,6 +31,7 @@
# hardware specifics are in here
../2configs/hw/tp-x220.nix
+ ../2configs/hw/rtl8812au.nix
# mount points
../2configs/fs/sda-crypto-root-home.nix
# ../2configs/mediawiki.nix
@@ -43,6 +44,14 @@
# ../2configs/temp/sabnzbd.nix
];
+ services.tinc.networks.siem = {
+ name = "makefu";
+ extraConfig = ''
+ ConnectTo = sdarth
+ ConnectTo = sjump
+ '';
+ };
+
krebs.nginx = {
default404 = false;
servers.default.listen = [ "80 default_server" ];
@@ -59,7 +68,6 @@
networking.firewall.allowedUDPPorts = [ 665 ];
krebs.build.host = config.krebs.hosts.pornocauster;
-
krebs.hosts.omo.nets.retiolum.via.ip4.addr = "192.168.1.11";
krebs.retiolum = {
enable = true;
@@ -68,4 +76,6 @@
networking.extraHosts = ''
192.168.1.11 omo.local
'';
+ # hard dependency because otherwise the device will not be unlocked
+ boot.initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; allowDiscards=true; }];
}
diff --git a/makefu/1systems/shoney.nix b/makefu/1systems/shoney.nix
new file mode 100644
index 000000000..1fe8871d2
--- /dev/null
+++ b/makefu/1systems/shoney.nix
@@ -0,0 +1,54 @@
+{ config, pkgs, ... }:
+let
+ tinc-siem-ip = "10.8.10.1";
+
+ ip = "64.137.234.215";
+ alt-ip = "64.137.234.210";
+ extra-ip = "64.137.234.114"; #currently unused
+ gw = "64.137.234.1";
+in {
+ imports = [
+ ../.
+ ../2configs/save-diskspace.nix
+ ../2configs/hw/CAC.nix
+ ../2configs/fs/CAC-CentOS-7-64bit.nix
+ ];
+
+
+
+ services.tinc.networks.siem.name = "sjump";
+
+ krebs = {
+ enable = true;
+ retiolum.enable = true;
+ build.host = config.krebs.hosts.shoney;
+ nginx.enable = true;
+ tinc_graphs = {
+ enable = true;
+ network = "siem";
+ hostsPath = "/etc/tinc/siem/hosts";
+ nginx = {
+ enable = true;
+ # TODO: remove hard-coded hostname
+ complete = {
+ listen = [ "${tinc-siem-ip}:80" ];
+ server-names = [ "graphs.siem" ];
+ };
+ };
+ };
+ };
+ networking = {
+ interfaces.enp2s1.ip4 = [
+ { address = ip; prefixLength = 24; }
+ { address = alt-ip; prefixLength = 24; }
+ ];
+
+ defaultGateway = gw;
+ nameservers = [ "8.8.8.8" ];
+ firewall = {
+ trustedInterfaces = [ "tinc.siem" ];
+ allowedUDPPorts = [ 655 1655 ];
+ allowedTCPPorts = [ 655 1655 ];
+ };
+ };
+}
diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index d9f8ded83..5788cb654 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -9,9 +9,9 @@ in {
imports = [
../.
# TODO: copy this config or move to krebs
- ../../tv/2configs/hw/CAC.nix
- ../../tv/2configs/fs/CAC-CentOS-7-64bit.nix
- ../2configs/headless.nix
+ ../2configs/hw/CAC.nix
+ ../2configs/fs/CAC-CentOS-7-64bit.nix
+ ../2configs/save-diskspace.nix
../2configs/bepasty-dual.nix
@@ -27,8 +27,7 @@ in {
../2configs/collectd/collectd-base.nix
];
krebs.retiolum.enable = true;
- services.nixosManual.enable = false;
- programs.man.enable = false;
+
krebs.build.host = config.krebs.hosts.wry;
krebs.Reaktor = {
@@ -83,9 +82,5 @@ in {
nameservers = [ "8.8.8.8" ];
};
- # small machine - do not forget to gc every day
- nix.gc.automatic = true;
- nix.gc.dates = "03:10";
-
environment.systemPackages = [ ];
}
diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix
index 62daed8be..422927b28 100644
--- a/makefu/2configs/default.nix
+++ b/makefu/2configs/default.nix
@@ -16,6 +16,8 @@ with config.krebs.lib;
nixpkgs.config.allowUnfreePredicate = (pkg: pkgs.lib.hasPrefix "unrar-" pkg.name);
krebs = {
enable = true;
+
+ dns.providers.siem = "hosts";
search-domain = "retiolum";
build = {
user = config.krebs.users.makefu;
@@ -24,7 +26,9 @@ with config.krebs.lib;
url = https://github.com/nixos/nixpkgs;
rev = "63b9785"; # stable @ 2016-06-01
};
- secrets = "/home/makefu/secrets/${config.krebs.build.host.name}/";
+ secrets = if getEnv "dummy_secrets" == "true"
+ then toString <stockholm/makefu/6tests/data/secrets>
+ else "/home/makefu/secrets/${config.krebs.build.host.name}";
stockholm = "/home/makefu/stockholm";
# Defaults for all stockholm users?
@@ -154,6 +158,15 @@ with config.krebs.lib;
"net.ipv6.conf.default.use_tempaddr" = 2;
};
+ system.activationScripts.nix-defexpr = ''
+ (set -euf
+ for i in /home/makefu /root/;do
+ f="$i/.nix-defexpr"
+ rm -fr "$f"
+ ln -s /var/src/nixpkgs "$f"
+ done)
+ '';
+
i18n = {
consoleKeyMap = "us";
defaultLocale = "en_US.UTF-8";
diff --git a/makefu/2configs/fs/CAC-CentOS-7-64bit.nix b/makefu/2configs/fs/CAC-CentOS-7-64bit.nix
new file mode 100644
index 000000000..c9eb97f44
--- /dev/null
+++ b/makefu/2configs/fs/CAC-CentOS-7-64bit.nix
@@ -0,0 +1,20 @@
+_:
+
+{
+ boot.loader.grub = {
+ device = "/dev/sda";
+ };
+ fileSystems = {
+ "/" = {
+ device = "/dev/centos/root";
+ fsType = "xfs";
+ };
+ "/boot" = {
+ device = "/dev/sda1";
+ fsType = "xfs";
+ };
+ };
+ swapDevices = [
+ { device = "/dev/centos/swap"; }
+ ];
+}
diff --git a/makefu/2configs/fs/sda-crypto-root.nix b/makefu/2configs/fs/sda-crypto-root.nix
index b82c0e44e..5c7cdf716 100644
--- a/makefu/2configs/fs/sda-crypto-root.nix
+++ b/makefu/2configs/fs/sda-crypto-root.nix
@@ -1,16 +1,16 @@
{ config, lib, pkgs, ... }:
# sda: bootloader grub2
-# sda1: boot ext4 (label nixboot)
+# sda1: boot ext4 (label nixboot) - must be unlocked on boot if required:
+ # boot.initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; allowDiscards=true; }];
# sda2: cryptoluks -> ext4
with config.krebs.lib;
{
boot = {
loader.grub.enable = true;
loader.grub.version = 2;
- loader.grub.device = "/dev/sda";
+ loader.grub.device = lib.mkDefault "/dev/sda";
- initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; allowDiscards=true; }];
initrd.luks.cryptoModules = ["aes" "sha512" "sha1" "xts" ];
initrd.availableKernelModules = ["xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
};
diff --git a/makefu/2configs/hw/CAC.nix b/makefu/2configs/hw/CAC.nix
new file mode 100644
index 000000000..9ed18344a
--- /dev/null
+++ b/makefu/2configs/hw/CAC.nix
@@ -0,0 +1,13 @@
+_:
+{
+ boot.initrd.availableKernelModules = [
+ "ata_piix"
+ "vmw_pvscsi"
+ ];
+ boot.loader.grub.splashImage = null;
+ nix = {
+ daemonIONiceLevel = 1;
+ daemonNiceLevel = 1;
+ };
+ sound.enable = false;
+}
diff --git a/makefu/2configs/hw/fingerprint-reader.nix b/makefu/2configs/hw/fingerprint-reader.nix
new file mode 100644
index 000000000..1f2f00b03
--- /dev/null
+++ b/makefu/2configs/hw/fingerprint-reader.nix
@@ -0,0 +1,6 @@
+_: {
+ # add fingerprint with fprintd-enroll
+ services.fprintd.enable = true;
+ security.pam.services.login.fprintAuth = true;
+ security.pam.services.xscreensaver.fprintAuth = true;
+}
diff --git a/makefu/2configs/hw/tp-x220.nix b/makefu/2configs/hw/tp-x220.nix
index be3d1eb70..1c9a34965 100644
--- a/makefu/2configs/hw/tp-x220.nix
+++ b/makefu/2configs/hw/tp-x220.nix
@@ -5,7 +5,7 @@ with config.krebs.lib;
imports = [ ./tp-x2x0.nix ];
boot = {
- kernelModules = [ "kvm-intel" "acpi_call" ];
+ kernelModules = [ "kvm-intel" "acpi_call" "tpm-rng" ];
extraModulePackages = [ config.boot.kernelPackages.tp_smapi ];
};
@@ -28,7 +28,7 @@ with config.krebs.lib;
# enable HDMI output switching with pulseaudio
hardware.pulseaudio.configFile = pkgs.writeText "pulse-default-pa" ''
- ${builtins.readFile "${config.hardware.pulseaudio.package}/etc/pulse/default.pa"}
+ ${builtins.readFile "${config.hardware.pulseaudio.package.out}/etc/pulse/default.pa"}
load-module module-alsa-sink device=hw:0,3 sink_properties=device.description="HDMIOutput" sink_name="HDMI"
'';
diff --git a/makefu/2configs/hw/tp-x2x0.nix b/makefu/2configs/hw/tp-x2x0.nix
index 7f9dc67a5..c10ec1314 100644
--- a/makefu/2configs/hw/tp-x2x0.nix
+++ b/makefu/2configs/hw/tp-x2x0.nix
@@ -22,7 +22,8 @@ with config.krebs.lib;
services.tlp.enable = true;
services.tlp.extraConfig = ''
- START_CHARGE_THRESH_BAT0=80
+ # BUG: http://linrunner.de/en/tlp/docs/tlp-faq.html#erratic-battery
+ #START_CHARGE_THRESH_BAT0=80
STOP_CHARGE_THRESH_BAT0=95
CPU_SCALING_GOVERNOR_ON_AC=performance
diff --git a/makefu/2configs/save-diskspace.nix b/makefu/2configs/save-diskspace.nix
new file mode 100644
index 000000000..cc2b29cac
--- /dev/null
+++ b/makefu/2configs/save-diskspace.nix
@@ -0,0 +1,9 @@
+_:
+# TODO: do not check out nixpkgs master but fetch revision from github
+{
+ services.nixosManual.enable = false;
+ programs.man.enable = false;
+ services.journald.extraConfig = "SystemMaxUse=50M";
+ nix.gc.automatic = true;
+ nix.gc.dates = "03:10";
+}
diff --git a/makefu/3modules/umts.nix b/makefu/3modules/umts.nix
index e527a5cb7..300467e1f 100644
--- a/makefu/3modules/umts.nix
+++ b/makefu/3modules/umts.nix
@@ -3,6 +3,14 @@
with config.krebs.lib;
let
+ nixpkgs-1509 = import (pkgs.fetchFromGitHub {
+ owner = "NixOS"; repo = "nixpkgs-channels";
+ rev = "91371c2bb6e20fc0df7a812332d99c38b21a2bda";
+ sha256 = "1as1i0j9d2n3iap9b471y4x01561r2s3vmjc5281qinirlr4al73";
+ }) {};
+
+ wvdial = nixpkgs-1509.wvdial; # https://github.com/NixOS/nixpkgs/issues/16113
+
# TODO: currently it is only netzclub
umts-bin = pkgs.writeScriptBin "umts" ''
#!/bin/sh
@@ -62,7 +70,7 @@ let
Type = "simple";
Restart = "always";
RestartSec = "10s";
- ExecStart = "${pkgs.wvdial}/bin/wvdial -n";
+ ExecStart = "${wvdial}/bin/wvdial -n";
};
};
};
diff --git a/makefu/5pkgs/bintray-upload/default.nix b/makefu/5pkgs/bintray-upload/default.nix
new file mode 100644
index 000000000..1e9582cca
--- /dev/null
+++ b/makefu/5pkgs/bintray-upload/default.nix
@@ -0,0 +1,19 @@
+{ pkgs, ... }:
+
+pkgs.python3Packages.buildPythonPackage rec {
+ name = "bintray-upload-${version}";
+ version = "0.1.2";
+ src = pkgs.fetchFromGitHub {
+ owner = "makefu";
+ repo = "bintray-upload";
+ rev = "4e76724";
+ sha256 = "1401saisk98n5wgw73nwh8hb484vayw5c6dlypxc1fp4ybym4zi9";
+ };
+
+ propagatedBuildInputs = with pkgs.python3Packages; [ requests2 ];
+
+ meta = {
+ description = "Simple BinTray utility for uploading packages";
+ license = pkgs.stdenv.lib.licenses.asl20;
+ };
+}
diff --git a/makefu/5pkgs/default.nix b/makefu/5pkgs/default.nix
index 6d227fa6d..bb6290af2 100644
--- a/makefu/5pkgs/default.nix
+++ b/makefu/5pkgs/default.nix
@@ -13,7 +13,8 @@ in
nodemcu-uploader = callPackage ./nodemcu-uploader {};
tw-upload-plugin = callPackage ./tw-upload-plugin {};
inherit (callPackage ./devpi {}) devpi-web devpi-server;
- skytraq-logger = callPackage ./skytraq-logger/ {};
+ skytraq-logger = callPackage ./skytraq-logger {};
taskserver = callPackage ./taskserver {};
+ bintray-upload = callPackage ./bintray-upload {};
};
}
diff --git a/makefu/6tests/data/secrets/bepasty-secret.nix b/makefu/6tests/data/secrets/bepasty-secret.nix
new file mode 100644
index 000000000..f5e704702
--- /dev/null
+++ b/makefu/6tests/data/secrets/bepasty-secret.nix
@@ -0,0 +1 @@
+"derp"
diff --git a/makefu/6tests/data/secrets/hashedPasswords.nix b/makefu/6tests/data/secrets/hashedPasswords.nix
new file mode 100644
index 000000000..0967ef424
--- /dev/null
+++ b/makefu/6tests/data/secrets/hashedPasswords.nix
@@ -0,0 +1 @@
+{}
diff --git a/makefu/6tests/data/secrets/iodinepw.nix b/makefu/6tests/data/secrets/iodinepw.nix
new file mode 100644
index 000000000..f5e704702
--- /dev/null
+++ b/makefu/6tests/data/secrets/iodinepw.nix
@@ -0,0 +1 @@
+"derp"
diff --git a/makefu/6tests/data/secrets/retiolum-ci.rsa_key.priv b/makefu/6tests/data/secrets/retiolum-ci.rsa_key.priv
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/6tests/data/secrets/retiolum-ci.rsa_key.priv
diff --git a/makefu/6tests/data/secrets/retiolum.rsa_key.priv b/makefu/6tests/data/secrets/retiolum.rsa_key.priv
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/6tests/data/secrets/retiolum.rsa_key.priv
diff --git a/makefu/6tests/data/secrets/retiolum.rsa_key.pub b/makefu/6tests/data/secrets/retiolum.rsa_key.pub
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/6tests/data/secrets/retiolum.rsa_key.pub
diff --git a/makefu/6tests/data/secrets/sambacred b/makefu/6tests/data/secrets/sambacred
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/6tests/data/secrets/sambacred
diff --git a/makefu/6tests/data/secrets/ssh.makefu.id_rsa b/makefu/6tests/data/secrets/ssh.makefu.id_rsa
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/6tests/data/secrets/ssh.makefu.id_rsa
diff --git a/makefu/6tests/data/secrets/ssh.makefu.id_rsa.pub b/makefu/6tests/data/secrets/ssh.makefu.id_rsa.pub
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/6tests/data/secrets/ssh.makefu.id_rsa.pub
diff --git a/makefu/6tests/data/secrets/ssh_host_ed25519_key b/makefu/6tests/data/secrets/ssh_host_ed25519_key
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/6tests/data/secrets/ssh_host_ed25519_key
diff --git a/makefu/6tests/data/secrets/tinc.krebsco.de.crt b/makefu/6tests/data/secrets/tinc.krebsco.de.crt
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/6tests/data/secrets/tinc.krebsco.de.crt
diff --git a/makefu/6tests/data/secrets/tinc.krebsco.de.key b/makefu/6tests/data/secrets/tinc.krebsco.de.key
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/6tests/data/secrets/tinc.krebsco.de.key
diff --git a/makefu/6tests/data/secrets/tw-pass.ini b/makefu/6tests/data/secrets/tw-pass.ini
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/6tests/data/secrets/tw-pass.ini
diff --git a/makefu/6tests/data/secrets/wildcard.krebsco.de.crt b/makefu/6tests/data/secrets/wildcard.krebsco.de.crt
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/6tests/data/secrets/wildcard.krebsco.de.crt
diff --git a/makefu/6tests/data/secrets/wildcard.krebsco.de.key b/makefu/6tests/data/secrets/wildcard.krebsco.de.key
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/6tests/data/secrets/wildcard.krebsco.de.key