From 6b0e0cc09996e2ea92446f546dc50938da7aa2dd Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 16 Jul 2017 21:35:04 +0200 Subject: lass downloading: add wine-mors to authorized_keys --- lass/2configs/downloading.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'lass/2configs') diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix index d32262810..9582413ed 100644 --- a/lass/2configs/downloading.nix +++ b/lass/2configs/downloading.nix @@ -17,6 +17,7 @@ with import ; lass-shodan.pubkey lass-icarus.pubkey makefu.pubkey + wine-mors.pubkey ]; }; -- cgit v1.2.3 From 2d6447d9669ba74780a57dd4ddcdb19110bd4928 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 17 Jul 2017 08:01:33 +0200 Subject: l wine: use wineFull --- lass/2configs/wine.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'lass/2configs') diff --git a/lass/2configs/wine.nix b/lass/2configs/wine.nix index d4a91e645..2444d32d3 100644 --- a/lass/2configs/wine.nix +++ b/lass/2configs/wine.nix @@ -5,7 +5,8 @@ let in { krebs.per-user.wine.packages = with pkgs; [ - wineUnstable + wineFull + #(wineFull.override { wineBuild = "wine64"; }) ]; users.users= { wine = { -- cgit v1.2.3 From 53f8fa81e58c426d2a88b1bba4bfc0524dcb9387 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 17 Jul 2017 14:53:14 +0200 Subject: l git: announce brain --- lass/2configs/git.nix | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) (limited to 'lass/2configs') diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix index 4137c482e..a66d08927 100644 --- a/lass/2configs/git.nix +++ b/lass/2configs/git.nix @@ -49,6 +49,7 @@ let { brain = { collaborators = with config.krebs.users; [ tv makefu ]; + announce = true; }; } // import { inherit config lib pkgs; } @@ -75,9 +76,20 @@ let public = true; }; - make-restricted-repo = name: { collaborators ? [], ... }: { + make-restricted-repo = name: { collaborators ? [], announce ? false, ... }: { inherit collaborators name; public = false; + hooks = optionalAttrs announce { + post-receive = pkgs.git-hooks.irc-announce { + # TODO make nick = config.krebs.build.host.name the default + nick = config.krebs.build.host.name; + channel = "#retiolum"; + server = "ni.r"; + verbose = true; + # TODO define branches in some kind of option per repo + branches = [ "master" "staging*" ]; + }; + }; }; make-rules = -- cgit v1.2.3 From 5f743cbd32572a25e0df73b823cd866f1d80f01a Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 17 Jul 2017 15:11:54 +0200 Subject: lass: init otp-ssh --- lass/2configs/otp-ssh.nix | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 lass/2configs/otp-ssh.nix (limited to 'lass/2configs') diff --git a/lass/2configs/otp-ssh.nix b/lass/2configs/otp-ssh.nix new file mode 100644 index 000000000..f9984e245 --- /dev/null +++ b/lass/2configs/otp-ssh.nix @@ -0,0 +1,18 @@ +{ pkgs, ... }: +# Enables second factor for ssh password login + +## Usage: +# gen-oath-safe totp +## scan the qrcode with google authenticator (or FreeOTP) +## copy last line into secrets//users.oath (chmod 700) +{ + security.pam.oath = { + # enabling it will make it a requisite of `all` services + # enable = true; + digits = 6; + # TODO assert existing + usersFile = (toString ) + "/users.oath"; + }; + # I want TFA only active for sshd with password-auth + security.pam.services.sshd.oathAuth = true; +} -- cgit v1.2.3 From 32d09aa9d5b95f91acd14489b7802ad8cb449355 Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 20 Jul 2017 13:40:04 +0200 Subject: l: rip makefu-sip --- lass/2configs/makefu-sip.nix | 21 --------------------- 1 file changed, 21 deletions(-) delete mode 100644 lass/2configs/makefu-sip.nix (limited to 'lass/2configs') diff --git a/lass/2configs/makefu-sip.nix b/lass/2configs/makefu-sip.nix deleted file mode 100644 index 9d2e9b696..000000000 --- a/lass/2configs/makefu-sip.nix +++ /dev/null @@ -1,21 +0,0 @@ -{ config, lib, pkgs, ... }: - -with import ; -{ - users.users.makefu = { - uid = genid "makefu"; - isNormalUser = true; - extraGroups = [ "libvirtd" ]; - openssh.authorizedKeys.keys = [ - config.krebs.users.makefu.pubkey - ]; - }; - - krebs.iptables.tables.nat.PREROUTING.rules = [ - { v6 = false; precedence = 1000; predicate = "-d 213.239.205.246 -p tcp --dport 10022"; target = "DNAT --to-destination 192.168.122.136:22"; } - ]; - - krebs.iptables.tables.filter.FORWARD.rules = [ - { v6 = false; precedence = 1000; predicate = "-d 192.168.122.136 -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; } - ]; -} -- cgit v1.2.3 From 9cb4a46b53a9ca5fe90d3166fa0f42a38a1732d6 Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 20 Jul 2017 14:50:19 +0200 Subject: l websites domsen: serve some www. sites --- lass/2configs/websites/domsen.nix | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'lass/2configs') diff --git a/lass/2configs/websites/domsen.nix b/lass/2configs/websites/domsen.nix index 3bc5570c4..3e1ad6638 100644 --- a/lass/2configs/websites/domsen.nix +++ b/lass/2configs/websites/domsen.nix @@ -25,9 +25,15 @@ in { imports = [ ./sqlBackup.nix (servePage [ "reich-gebaeudereinigung.de" "www.reich-gebaeudereinigung.de" ]) - (servePage [ "karlaskop.de" ]) + (servePage [ + "karlaskop.de" + "www.karlaskop.de" + ]) (servePage [ "makeup.apanowicz.de" ]) - (servePage [ "pixelpocket.de" ]) + (servePage [ + "pixelpocket.de" + "www.pixelpocket.de" + ]) (servePage [ "habsys.de" "habsys.eu" -- cgit v1.2.3