diff options
Diffstat (limited to 'tv')
| -rw-r--r-- | tv/1systems/cd.nix | 1 | ||||
| -rw-r--r-- | tv/1systems/mkdir.nix | 1 | ||||
| -rw-r--r-- | tv/1systems/rmdir.nix | 2 | ||||
| -rw-r--r-- | tv/2configs/backup.nix | 14 | ||||
| -rw-r--r-- | tv/2configs/default.nix | 2 | ||||
| -rw-r--r-- | tv/2configs/git.nix | 4 | ||||
| -rw-r--r-- | tv/2configs/vim.nix | 27 | ||||
| -rw-r--r-- | tv/3modules/iptables.nix | 40 |
8 files changed, 56 insertions, 35 deletions
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix index 8297a56df..b96548d61 100644 --- a/tv/1systems/cd.nix +++ b/tv/1systems/cd.nix @@ -4,7 +4,6 @@ with lib; { krebs.build.host = config.krebs.hosts.cd; - krebs.build.target = "root@cd.internet"; imports = [ ../2configs/hw/CAC-Developer-2.nix diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix index 79e5f73b9..2010dcd57 100644 --- a/tv/1systems/mkdir.nix +++ b/tv/1systems/mkdir.nix @@ -17,7 +17,6 @@ in { krebs.build.host = config.krebs.hosts.mkdir; - krebs.build.target = "root@${primary-addr4}"; imports = [ ../2configs/hw/CAC-Developer-1.nix diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix index 6fd79c596..4005b5e6f 100644 --- a/tv/1systems/rmdir.nix +++ b/tv/1systems/rmdir.nix @@ -18,8 +18,6 @@ in { krebs.build.host = config.krebs.hosts.rmdir; - krebs.build.target = "root@rmdir.internet"; - imports = [ ../2configs/hw/CAC-Developer-1.nix ../2configs/fs/CAC-CentOS-7-64bit.nix diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix index ce937a744..6c90709a8 100644 --- a/tv/2configs/backup.nix +++ b/tv/2configs/backup.nix @@ -1,7 +1,7 @@ { config, lib, ... }: with lib; { - krebs.backup.plans = addNames { + krebs.backup.plans = { wu-home-xu = { method = "push"; src = { host = config.krebs.hosts.wu; path = "/home"; }; @@ -14,5 +14,17 @@ with lib; yearly = { format = "%Y"; }; }; }; + xu-home-wu = { + method = "push"; + src = { host = config.krebs.hosts.xu; path = "/home"; }; + dst = { host = config.krebs.hosts.wu; path = "/bku/xu-home"; }; + startAt = "06:00"; + snapshots = { + daily = { format = "%Y-%m-%d"; retain = 7; }; + weekly = { format = "%YW%W"; retain = 4; }; + monthly = { format = "%Y-%m"; retain = 12; }; + yearly = { format = "%Y"; }; + }; + }; }; } diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index 57c4620c4..b5639af51 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -7,7 +7,6 @@ with lib; krebs.build = { user = config.krebs.users.tv; - target = mkDefault "root@${config.krebs.build.host.name}"; source = mapAttrs (_: mkDefault) ({ nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix"; nixpkgs = symlink:stockholm/nixpkgs; @@ -165,6 +164,7 @@ with lib; { tv.iptables.enable = true; + tv.iptables.accept-echo-request = "internet"; } { diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix index b8180085f..3ee708e03 100644 --- a/tv/2configs/git.nix +++ b/tv/2configs/git.nix @@ -90,12 +90,12 @@ let with git // config.krebs.users; repo: singleton { - user = [ tv tv_xu ]; + user = [ tv tv-xu ]; repo = [ repo ]; perm = push "refs/*" [ non-fast-forward create delete merge ]; } ++ optional repo.public { - user = [ lass makefu uriel ]; + user = [ lass makefu ]; repo = [ repo ]; perm = fetch; } ++ diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix index 23f90af05..69a880dab 100644 --- a/tv/2configs/vim.nix +++ b/tv/2configs/vim.nix @@ -13,9 +13,21 @@ let environment.variables.VIMINIT = ":so /etc/vimrc"; }; - extra-runtimepath = concatStringsSep "," [ - "${pkgs.vimPlugins.undotree}/share/vim-plugins/undotree" - ]; + extra-runtimepath = let + inherit (pkgs.vimUtils) buildVimPlugin rtpPath; + fromVimPlugins = pkgs: concatStringsSep "," + (mapAttrsToList (name: pkg: "${pkg}/${rtpPath}/${name}") pkgs); + in fromVimPlugins { + inherit (pkgs.vimPlugins) undotree; + file-line = buildVimPlugin { + name = "file-line-1.0"; + src = pkgs.fetchgit { + url = git://github.com/bogado/file-line; + rev = "refs/tags/1.0"; + sha256 = "0z47zq9rqh06ny0q8lpcdsraf3lyzn9xvb59nywnarf3nxrk6hx0"; + }; + }; + }; dirs = { backupdir = "$HOME/.cache/vim/backup"; @@ -32,12 +44,9 @@ let alldirs = attrValues dirs ++ map dirOf (attrValues files); in unique (sort lessThan alldirs); - vim = pkgs.writeScriptBin "vim" '' - #! ${pkgs.dash}/bin/dash - set -f - umask 0077 - ${concatStringsSep "\n" (map (x: "mkdir -p ${x}") mkdirs)} - umask 0022 + vim = pkgs.writeDashBin "vim" '' + set -efu + (umask 0077; exec ${pkgs.coreutils}/bin/mkdir -p ${toString mkdirs}) exec ${pkgs.vim}/bin/vim "$@" ''; diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix index cbf49f577..a4ebef44f 100644 --- a/tv/3modules/iptables.nix +++ b/tv/3modules/iptables.nix @@ -13,6 +13,11 @@ let api = { enable = mkEnableOption "tv.iptables"; + accept-echo-request = mkOption { + type = with types; nullOr (enum ["internet" "retiolum"]); + default = "retiolum"; + }; + input-internet-accept-new-tcp = mkOption { type = with types; listOf (either int str); default = []; @@ -49,22 +54,27 @@ let }; - accept-new-tcp = port: - "-p tcp -m tcp --dport ${port} -m conntrack --ctstate NEW -j ACCEPT"; - - rules = iptables-version: + rules = iptables-version: let + accept-echo-request = { + ip4tables = "-p icmp -m icmp --icmp-type echo-request -j ACCEPT"; + ip6tables = "-p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT"; + }."ip${toString iptables-version}tables"; + accept-new-tcp = port: + "-p tcp -m tcp --dport ${port} -m conntrack --ctstate NEW -j ACCEPT"; + in pkgs.writeText "tv-iptables-rules${toString iptables-version}" '' *nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] - ${concatMapStringsSep "\n" (rule: "-A PREROUTING ${rule}") ([] - ++ [ - "! -i retiolum -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 0" - "-p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22" - ] - )} + ${concatMapStringsSep "\n" (rule: "-A PREROUTING ${rule}") [ + "! -i retiolum -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 0" + "-p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22" + ]} + ${concatMapStringsSep "\n" (rule: "-A OUTPUT ${rule}") [ + "-o lo -p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22" + ]} COMMIT *filter :INPUT DROP [0:0] @@ -76,18 +86,12 @@ let "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT" "-i lo -j ACCEPT" ] + ++ optional (cfg.accept-echo-request == "internet") accept-echo-request ++ map accept-new-tcp (unique (map toString cfg.input-internet-accept-new-tcp)) ++ ["-i retiolum -j Retiolum"] )} ${concatMapStringsSep "\n" (rule: "-A Retiolum ${rule}") ([] - ++ { - ip4tables = [ - "-p icmp -m icmp --icmp-type echo-request -j ACCEPT" - ]; - ip6tables = [ - "-p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT" - ]; - }."ip${toString iptables-version}tables" + ++ optional (cfg.accept-echo-request == "retiolum") accept-echo-request ++ map accept-new-tcp (unique (map toString cfg.input-retiolum-accept-new-tcp)) ++ { ip4tables = [ |