summaryrefslogtreecommitdiffstats
path: root/tv
diff options
context:
space:
mode:
Diffstat (limited to 'tv')
-rw-r--r--tv/1systems/cd.nix6
-rw-r--r--tv/1systems/mkdir.nix1
-rw-r--r--tv/1systems/rmdir.nix2
-rw-r--r--tv/1systems/wu.nix2
-rw-r--r--tv/2configs/backup.nix14
-rw-r--r--tv/2configs/default.nix2
-rw-r--r--tv/2configs/git.nix14
-rw-r--r--tv/2configs/hw/AO753.nix2
-rw-r--r--tv/2configs/hw/x220.nix16
-rw-r--r--tv/2configs/vim.nix27
-rw-r--r--tv/3modules/iptables.nix58
-rw-r--r--tv/5pkgs/default.nix37
12 files changed, 90 insertions, 91 deletions
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index e42d5750a..b96548d61 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -4,12 +4,6 @@ with lib;
{
krebs.build.host = config.krebs.hosts.cd;
- krebs.build.target = "root@cd.internet";
-
- krebs.build.source.upstream-nixpkgs = {
- url = https://github.com/NixOS/nixpkgs;
- rev = "b7ff030";
- };
imports = [
../2configs/hw/CAC-Developer-2.nix
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index 79e5f73b9..2010dcd57 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -17,7 +17,6 @@ in
{
krebs.build.host = config.krebs.hosts.mkdir;
- krebs.build.target = "root@${primary-addr4}";
imports = [
../2configs/hw/CAC-Developer-1.nix
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index 6fd79c596..4005b5e6f 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -18,8 +18,6 @@ in
{
krebs.build.host = config.krebs.hosts.rmdir;
- krebs.build.target = "root@rmdir.internet";
-
imports = [
../2configs/hw/CAC-Developer-1.nix
../2configs/fs/CAC-CentOS-7-64bit.nix
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 29e6de08b..4ed13a0ea 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -157,7 +157,7 @@ with lib;
nixpkgs.config.chromium.enablePepperFlash = true;
- nixpkgs.config.allowUnfreePredicate = pkg: hasPrefix "nvidia-x11-" pkg.name;
+ krebs.nixpkgs.allowUnfreePredicate = pkg: hasPrefix "nvidia-x11-" pkg.name;
hardware.bumblebee.enable = true;
hardware.bumblebee.group = "video";
hardware.enableAllFirmware = true;
diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix
index ce937a744..6c90709a8 100644
--- a/tv/2configs/backup.nix
+++ b/tv/2configs/backup.nix
@@ -1,7 +1,7 @@
{ config, lib, ... }:
with lib;
{
- krebs.backup.plans = addNames {
+ krebs.backup.plans = {
wu-home-xu = {
method = "push";
src = { host = config.krebs.hosts.wu; path = "/home"; };
@@ -14,5 +14,17 @@ with lib;
yearly = { format = "%Y"; };
};
};
+ xu-home-wu = {
+ method = "push";
+ src = { host = config.krebs.hosts.xu; path = "/home"; };
+ dst = { host = config.krebs.hosts.wu; path = "/bku/xu-home"; };
+ startAt = "06:00";
+ snapshots = {
+ daily = { format = "%Y-%m-%d"; retain = 7; };
+ weekly = { format = "%YW%W"; retain = 4; };
+ monthly = { format = "%Y-%m"; retain = 12; };
+ yearly = { format = "%Y"; };
+ };
+ };
};
}
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 57c4620c4..b5639af51 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -7,7 +7,6 @@ with lib;
krebs.build = {
user = config.krebs.users.tv;
- target = mkDefault "root@${config.krebs.build.host.name}";
source = mapAttrs (_: mkDefault) ({
nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix";
nixpkgs = symlink:stockholm/nixpkgs;
@@ -165,6 +164,7 @@ with lib;
{
tv.iptables.enable = true;
+ tv.iptables.accept-echo-request = "internet";
}
{
diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix
index b8180085f..f248a8cb5 100644
--- a/tv/2configs/git.nix
+++ b/tv/2configs/git.nix
@@ -7,8 +7,8 @@ let
out = {
krebs.git = {
enable = true;
- root-title = "public repositories at ${config.krebs.build.host.name}";
- root-desc = "keep calm and engage";
+ root-title = "repositories at ${config.krebs.build.host.name}";
+ root-desc = "mostly krebs";
repos = repos;
rules = rules;
};
@@ -21,7 +21,7 @@ let
rules = concatMap make-rules (attrValues repos);
public-repos = mapAttrs make-public-repo ({
- } // mapAttrValues (setAttr "section" "1. Miscellaneous") {
+ } // mapAttrValues (setAttr "section" "1. miscellaneous") {
cac-api = {
desc = "CloudAtCost API command line interface";
};
@@ -37,7 +37,7 @@ let
desc = "SoundCloud command line interface";
};
stockholm = {
- desc = "take all the computers hostage, they'll love you!";
+ desc = "NixOS configuration";
};
with-tmpdir = {};
} // mapAttrValues (setAttr "section" "2. Haskell libraries") {
@@ -49,7 +49,7 @@ let
web-routes-wai-custom = {};
xintmap = {};
xmonad-stockholm = {};
- } // mapAttrValues (setAttr "section" "3. Museum") {
+ } // mapAttrValues (setAttr "section" "3. museum") {
cgserver = {};
crude-mail-setup = {};
dot-xmonad = {};
@@ -90,12 +90,12 @@ let
with git // config.krebs.users;
repo:
singleton {
- user = [ tv tv_xu ];
+ user = [ tv tv-xu ];
repo = [ repo ];
perm = push "refs/*" [ non-fast-forward create delete merge ];
} ++
optional repo.public {
- user = [ lass makefu uriel ];
+ user = [ lass makefu ];
repo = [ repo ];
perm = fetch;
} ++
diff --git a/tv/2configs/hw/AO753.nix b/tv/2configs/hw/AO753.nix
index 72a40819f..e7a2b9238 100644
--- a/tv/2configs/hw/AO753.nix
+++ b/tv/2configs/hw/AO753.nix
@@ -41,5 +41,5 @@ with lib;
HandleSuspendKey=ignore
'';
- nixpkgs.config.allowUnfreePredicate = pkg: hasPrefix "broadcom-sta-" pkg.name;
+ krebs.nixpkgs.allowUnfreePredicate = pkg: hasPrefix "broadcom-sta-" pkg.name;
}
diff --git a/tv/2configs/hw/x220.nix b/tv/2configs/hw/x220.nix
index 7cec670fa..9b3dd122a 100644
--- a/tv/2configs/hw/x220.nix
+++ b/tv/2configs/hw/x220.nix
@@ -5,18 +5,11 @@
../smartd.nix
];
- boot.initrd.availableKernelModules = [ "ahci" ];
- boot.kernelModules = [ "kvm-intel" ];
-
boot.loader.gummiboot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
networking.wireless.enable = true;
- #hardware.enableAllFirmware = true;
- #zramSwap.enable = true;
- #zramSwap.numDevices = 2;
-
hardware.trackpoint = {
enable = true;
sensitivity = 220;
@@ -46,14 +39,5 @@
services.xserver = {
videoDriver = "intel";
vaapiDrivers = [ pkgs.vaapiIntel pkgs.vaapiVdpau ];
- deviceSection = ''
- Option "AccelMethod" "sna"
- '';
};
-
- #services.xserver.displayManager.sessionCommands =''
- # xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation" 8 1
- # xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Button" 8 2
- # xinput set-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Axes" 6 7 4 5
- #'';
}
diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 23f90af05..69a880dab 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -13,9 +13,21 @@ let
environment.variables.VIMINIT = ":so /etc/vimrc";
};
- extra-runtimepath = concatStringsSep "," [
- "${pkgs.vimPlugins.undotree}/share/vim-plugins/undotree"
- ];
+ extra-runtimepath = let
+ inherit (pkgs.vimUtils) buildVimPlugin rtpPath;
+ fromVimPlugins = pkgs: concatStringsSep ","
+ (mapAttrsToList (name: pkg: "${pkg}/${rtpPath}/${name}") pkgs);
+ in fromVimPlugins {
+ inherit (pkgs.vimPlugins) undotree;
+ file-line = buildVimPlugin {
+ name = "file-line-1.0";
+ src = pkgs.fetchgit {
+ url = git://github.com/bogado/file-line;
+ rev = "refs/tags/1.0";
+ sha256 = "0z47zq9rqh06ny0q8lpcdsraf3lyzn9xvb59nywnarf3nxrk6hx0";
+ };
+ };
+ };
dirs = {
backupdir = "$HOME/.cache/vim/backup";
@@ -32,12 +44,9 @@ let
alldirs = attrValues dirs ++ map dirOf (attrValues files);
in unique (sort lessThan alldirs);
- vim = pkgs.writeScriptBin "vim" ''
- #! ${pkgs.dash}/bin/dash
- set -f
- umask 0077
- ${concatStringsSep "\n" (map (x: "mkdir -p ${x}") mkdirs)}
- umask 0022
+ vim = pkgs.writeDashBin "vim" ''
+ set -efu
+ (umask 0077; exec ${pkgs.coreutils}/bin/mkdir -p ${toString mkdirs})
exec ${pkgs.vim}/bin/vim "$@"
'';
diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix
index cbf49f577..4924db4f3 100644
--- a/tv/3modules/iptables.nix
+++ b/tv/3modules/iptables.nix
@@ -13,6 +13,11 @@ let
api = {
enable = mkEnableOption "tv.iptables";
+ accept-echo-request = mkOption {
+ type = with types; nullOr (enum ["internet" "retiolum"]);
+ default = "retiolum";
+ };
+
input-internet-accept-new-tcp = mkOption {
type = with types; listOf (either int str);
default = [];
@@ -43,28 +48,38 @@ let
Type = "simple";
RemainAfterExit = true;
Restart = "always";
- ExecStart = "@${startScript} tv-iptables_start";
+ SyslogIdentifier = "tv-iptables_start";
+ ExecStart = pkgs.writeDash "tv-iptables_start" ''
+ set -euf
+ iptables-restore < ${rules 4}
+ ip6tables-restore < ${rules 6}
+ '';
};
};
};
- accept-new-tcp = port:
- "-p tcp -m tcp --dport ${port} -m conntrack --ctstate NEW -j ACCEPT";
-
- rules = iptables-version:
+ rules = iptables-version: let
+ accept-echo-request = {
+ ip4tables = "-p icmp -m icmp --icmp-type echo-request -j ACCEPT";
+ ip6tables = "-p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT";
+ }."ip${toString iptables-version}tables";
+ accept-new-tcp = port:
+ "-p tcp -m tcp --dport ${port} -m conntrack --ctstate NEW -j ACCEPT";
+ in
pkgs.writeText "tv-iptables-rules${toString iptables-version}" ''
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
- ${concatMapStringsSep "\n" (rule: "-A PREROUTING ${rule}") ([]
- ++ [
- "! -i retiolum -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 0"
- "-p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22"
- ]
- )}
+ ${concatMapStringsSep "\n" (rule: "-A PREROUTING ${rule}") [
+ "! -i retiolum -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 0"
+ "-p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22"
+ ]}
+ ${concatMapStringsSep "\n" (rule: "-A OUTPUT ${rule}") [
+ "-o lo -p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22"
+ ]}
COMMIT
*filter
:INPUT DROP [0:0]
@@ -76,18 +91,12 @@ let
"-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
"-i lo -j ACCEPT"
]
+ ++ optional (cfg.accept-echo-request == "internet") accept-echo-request
++ map accept-new-tcp (unique (map toString cfg.input-internet-accept-new-tcp))
++ ["-i retiolum -j Retiolum"]
)}
${concatMapStringsSep "\n" (rule: "-A Retiolum ${rule}") ([]
- ++ {
- ip4tables = [
- "-p icmp -m icmp --icmp-type echo-request -j ACCEPT"
- ];
- ip6tables = [
- "-p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT"
- ];
- }."ip${toString iptables-version}tables"
+ ++ optional (cfg.accept-echo-request == "retiolum") accept-echo-request
++ map accept-new-tcp (unique (map toString cfg.input-retiolum-accept-new-tcp))
++ {
ip4tables = [
@@ -104,16 +113,7 @@ let
)}
COMMIT
'';
-
- startScript = pkgs.writeScript "tv-iptables_start" ''
- #! /bin/sh
- set -euf
- iptables-restore < ${rules 4}
- ip6tables-restore < ${rules 6}
- '';
-
-in
-out
+in out
#let
# cfg = config.tv.iptables;
diff --git a/tv/5pkgs/default.nix b/tv/5pkgs/default.nix
index be10e91eb..b520e1a32 100644
--- a/tv/5pkgs/default.nix
+++ b/tv/5pkgs/default.nix
@@ -1,22 +1,25 @@
{ pkgs, ... }:
{
- cr = pkgs.writeScriptBin "cr" ''
- #! /bin/sh
- set -efu
- export LC_TIME=de_DE.utf8
- exec ${pkgs.chromium}/bin/chromium \
- --ssl-version-min=tls1 \
- --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \
- --disk-cache-size=50000000 \
- "%@"
- '';
- ejabberd = pkgs.callPackage ./ejabberd {
- erlang = pkgs.erlangR16;
+ nixpkgs.config.packageOverrides = {
+ # TODO use XDG_RUNTIME_DIR?
+ cr = pkgs.writeScriptBin "cr" ''
+ #! /bin/sh
+ set -efu
+ export LC_TIME=de_DE.utf8
+ exec ${pkgs.chromium}/bin/chromium \
+ --ssl-version-min=tls1 \
+ --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \
+ --disk-cache-size=50000000 \
+ "%@"
+ '';
+ ejabberd = pkgs.callPackage ./ejabberd {
+ erlang = pkgs.erlangR16;
+ };
+ ff = pkgs.callPackage ./ff {};
+ viljetic-pages = pkgs.callPackage ./viljetic-pages {};
+ xmonad-tv =
+ let src = pkgs.writeNixFromCabal "xmonad-tv.nix" ./xmonad-tv; in
+ pkgs.haskellPackages.callPackage src {};
};
- ff = pkgs.callPackage ./ff {};
- viljetic-pages = pkgs.callPackage ./viljetic-pages {};
- xmonad-tv =
- let src = pkgs.writeNixFromCabal "xmonad-tv.nix" ./xmonad-tv; in
- pkgs.haskellPackages.callPackage src {};
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-03 12:11:36 +0000