From 87fa7792e3f2debeb221073b393a7909a75a9176 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Fri, 9 Oct 2015 13:34:25 +0200
Subject: disband github-known_hosts harder

---
 krebs/3modules/github-hosts-sync.nix | 2 --
 1 file changed, 2 deletions(-)

(limited to 'krebs')

diff --git a/krebs/3modules/github-hosts-sync.nix b/krebs/3modules/github-hosts-sync.nix
index f44fe3ad8..eaec0333a 100644
--- a/krebs/3modules/github-hosts-sync.nix
+++ b/krebs/3modules/github-hosts-sync.nix
@@ -60,8 +60,6 @@ let
             -m 0400 \
             ${cfg.ssh-identity-file} \
             "$ssh_identity_file_target"
-
-          ln -snf ${pkgs.github-known_hosts} ${cfg.dataDir}/.ssh/known_hosts
         '';
         ExecStart = "${pkgs.github-hosts-sync}/bin/github-hosts-sync";
       };
-- 
cgit v1.2.3


From f15864623a579f4af1c1b0cae14b5977283d52bd Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Fri, 9 Oct 2015 14:07:29 +0200
Subject: krebs lib.types += suffixed-str

---
 krebs/4lib/types.nix | 7 +++++++
 1 file changed, 7 insertions(+)

(limited to 'krebs')

diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index 039f803ef..b3d2c8b70 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -147,6 +147,13 @@ types // rec {
     merge = mergeOneOption;
   };
 
+  suffixed-str = suffs:
+    mkOptionType {
+      name = "string suffixed by ${concatStringsSep ", " suffs}";
+      check = x: isString x && any (flip hasSuffix x) suffs;
+      merge = mergeOneOption;
+    };
+
   user = submodule {
     options = {
       mail = mkOption {
-- 
cgit v1.2.3


From 51e4b62de206cbf692e5f247d595c904c768e202 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Fri, 9 Oct 2015 14:08:06 +0200
Subject: krebs.github-host-sync.ssh-identity-file: fix type

---
 krebs/3modules/github-hosts-sync.nix | 23 ++++++++---------------
 1 file changed, 8 insertions(+), 15 deletions(-)

(limited to 'krebs')

diff --git a/krebs/3modules/github-hosts-sync.nix b/krebs/3modules/github-hosts-sync.nix
index eaec0333a..4d4e21252 100644
--- a/krebs/3modules/github-hosts-sync.nix
+++ b/krebs/3modules/github-hosts-sync.nix
@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 with builtins;
-with lib;
+with import ../4lib { inherit lib; };
 let
   cfg = config.krebs.github-hosts-sync;
 
@@ -21,7 +21,7 @@ let
       default = "/var/lib/github-hosts-sync";
     };
     ssh-identity-file = mkOption {
-      type = types.str; # TODO must be named *.ssh.{id_rsa,id_ed25519}
+      type = types.suffixed-str [".ssh.id_ed25519" ".ssh.id_rsa"];
       default = toString <secrets/github-hosts-sync.ssh.id_rsa>;
     };
   };
@@ -42,16 +42,6 @@ let
           #! /bin/sh
           set -euf
 
-          ssh_identity_file_target=$(
-            case ${cfg.ssh-identity-file} in
-              *.ssh.id_rsa|*.ssh.id_ed25519) echo ${cfg.dataDir}/.ssh/id_rsa;;
-              *.ssh.id_ed25519) echo ${cfg.dataDir}/.ssh/id_ed25519;;
-              *)
-                echo "bad identity file name: ${cfg.ssh-identity-file}" >&2
-                exit 1
-            esac
-          )
-
           mkdir -p ${cfg.dataDir}
           chown ${user.name}: ${cfg.dataDir}
 
@@ -59,7 +49,7 @@ let
             -o ${user.name} \
             -m 0400 \
             ${cfg.ssh-identity-file} \
-            "$ssh_identity_file_target"
+            ${cfg.dataDir}/.ssh/${fileExtension cfg.ssh-identity-file}
         '';
         ExecStart = "${pkgs.github-hosts-sync}/bin/github-hosts-sync";
       };
@@ -75,5 +65,8 @@ let
     name = "github-hosts-sync";
     uid = 3220554646; # genid github-hosts-sync
   };
-in
-out
+
+  # TODO move to lib?
+  fileExtension = s: last (splitString "." s);
+
+in out
-- 
cgit v1.2.3


From 509423f1f19ade5586f66c5691b27694ecb68b01 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Fri, 9 Oct 2015 14:31:25 +0200
Subject: github-hosts-sync: fix ca-bundle path

---
 krebs/5pkgs/github-hosts-sync/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'krebs')

diff --git a/krebs/5pkgs/github-hosts-sync/default.nix b/krebs/5pkgs/github-hosts-sync/default.nix
index d69b2b12b..b9dcfa9b8 100644
--- a/krebs/5pkgs/github-hosts-sync/default.nix
+++ b/krebs/5pkgs/github-hosts-sync/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
 
   installPhase =
     let
-      ca-bundle = "${pkgs.cacert}/etc/ca-bundle.crt";
+      ca-bundle = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
       path = stdenv.lib.makeSearchPath "bin" (with pkgs; [
         coreutils
         findutils
-- 
cgit v1.2.3


From 694c79a5bc05014604fa2467f965b370102ff78f Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Fri, 9 Oct 2015 14:32:45 +0200
Subject: github-hosts-sync service: fix directory creation

---
 krebs/3modules/github-hosts-sync.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

(limited to 'krebs')

diff --git a/krebs/3modules/github-hosts-sync.nix b/krebs/3modules/github-hosts-sync.nix
index 4d4e21252..2a1df9e03 100644
--- a/krebs/3modules/github-hosts-sync.nix
+++ b/krebs/3modules/github-hosts-sync.nix
@@ -41,13 +41,9 @@ let
         ExecStartPre = pkgs.writeScript "github-hosts-sync-init" ''
           #! /bin/sh
           set -euf
-
-          mkdir -p ${cfg.dataDir}
-          chown ${user.name}: ${cfg.dataDir}
-
-          install \
-            -o ${user.name} \
-            -m 0400 \
+          install -m 0711 -o ${user.name} -d ${cfg.dataDir}
+          install -m 0700 -o ${user.name} -d ${cfg.dataDir}/.ssh
+          install -m 0400 -o ${user.name} \
             ${cfg.ssh-identity-file} \
             ${cfg.dataDir}/.ssh/${fileExtension cfg.ssh-identity-file}
         '';
-- 
cgit v1.2.3

[cgit] Unable to lock slot /tmp/cgit/f9000000.lock: No such file or directory (2)