From bad79f7f1270c01343b3c308f5a2cf390dac014c Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 6 Nov 2015 21:53:21 +0100 Subject: tv: init user z --- tv/2configs/base.nix | 3 +++ tv/2configs/xserver/default.nix | 8 -------- tv/2configs/z.nix | 40 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 43 insertions(+), 8 deletions(-) create mode 100644 tv/2configs/z.nix (limited to 'tv/2configs') diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix index a74ce3297..4beece5ef 100644 --- a/tv/2configs/base.nix +++ b/tv/2configs/base.nix @@ -22,6 +22,9 @@ with lib; mapAttrs (_: h: { hashedPassword = h; }) (import ); } + { + users.groups.subusers.gid = 1093178926; # genid subusers + } { users.defaultUserShell = "/run/current-system/sw/bin/bash"; users.mutableUsers = false; diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix index 4d2fe9e45..df00203be 100644 --- a/tv/2configs/xserver/default.nix +++ b/tv/2configs/xserver/default.nix @@ -70,14 +70,6 @@ let ExecStart = "${xserver}/bin/xserver"; }; }; - - programs.bash.interactiveShellInit = '' - case ''${XMONAD_SPAWN_WORKSPACE-} in - za|zh|zj|zs) - exec sudo -u zalora -i - ;; - esac - ''; }; xmonad-environment = { diff --git a/tv/2configs/z.nix b/tv/2configs/z.nix new file mode 100644 index 000000000..e5494ecc9 --- /dev/null +++ b/tv/2configs/z.nix @@ -0,0 +1,40 @@ +{ config, lib, pkgs, ... }: + +with lib; + +{ + krebs.per-user.z.packages = [ + (pkgs.writeScriptBin "cr" '' + #! /bin/sh + set -efu + export LC_TIME=de_DE.utf8 + exec ${pkgs.chromium}/bin/chromium \ + --ssl-version-min=tls1 \ + --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \ + --disk-cache-size=50000000 \ + "%@" + '') + ]; + + programs.bash.interactiveShellInit = '' + case ''${XMONAD_SPAWN_WORKSPACE-} in + za|zh|zj|zs) + exec sudo -u z -i + ;; + esac + ''; + + security.sudo.extraConfig = "tv ALL=(z) NOPASSWD: ALL"; + + users.users.z = { + extraGroups = [ + "audio" + "vboxusers" + "video" + ]; + group = "subusers"; + home = "/home/z"; + uid = 3043726074; # genid z + useDefaultShell = true; + }; +} -- cgit v1.2.3 From 3c75c59794d6b67c34d9a8857ca3fb64c649507c Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 6 Nov 2015 21:54:53 +0100 Subject: tv: set environment.profileRelativeEnvVars.PATH --- tv/2configs/base.nix | 2 ++ 1 file changed, 2 insertions(+) (limited to 'tv/2configs') diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix index 4beece5ef..38cc1eefe 100644 --- a/tv/2configs/base.nix +++ b/tv/2configs/base.nix @@ -72,6 +72,8 @@ with lib; nix.useChroot = true; } { + environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ]; + environment.systemPackages = with pkgs; [ rxvt_unicode.terminfo ]; -- cgit v1.2.3 From 28fad6e2fc3aa45a9d1b5fad8810bbc7c78a5dc6 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 6 Nov 2015 21:55:08 +0100 Subject: tv base: drop redundant with builtins --- tv/2configs/base.nix | 1 - 1 file changed, 1 deletion(-) (limited to 'tv/2configs') diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix index 38cc1eefe..b74b721cb 100644 --- a/tv/2configs/base.nix +++ b/tv/2configs/base.nix @@ -1,6 +1,5 @@ { config, lib, pkgs, ... }: -with builtins; with lib; { -- cgit v1.2.3 From 0bf6e55f77cffb4ca65c6926eea7bc77140574a5 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 6 Nov 2015 21:55:38 +0100 Subject: tv base: tv@xu can root --- tv/2configs/base.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'tv/2configs') diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix index b74b721cb..d3f4eed0d 100644 --- a/tv/2configs/base.nix +++ b/tv/2configs/base.nix @@ -33,6 +33,7 @@ with lib; root = { openssh.authorizedKeys.keys = [ config.krebs.users.tv.pubkey + config.krebs.users.tv_xu.pubkey ]; }; tv = { -- cgit v1.2.3 From f559b19bec61730c537cdd76233304e66c3f497a Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 6 Nov 2015 22:05:36 +0100 Subject: stockholm: import default user config --- tv/2configs/base.nix | 168 ------------------------------------------------ tv/2configs/default.nix | 168 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 168 insertions(+), 168 deletions(-) delete mode 100644 tv/2configs/base.nix create mode 100644 tv/2configs/default.nix (limited to 'tv/2configs') diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix deleted file mode 100644 index d3f4eed0d..000000000 --- a/tv/2configs/base.nix +++ /dev/null @@ -1,168 +0,0 @@ -{ config, lib, pkgs, ... }: - -with lib; - -{ - krebs.enable = true; - - networking.hostName = config.krebs.build.host.name; - - imports = [ - ./vim.nix - { - # stockholm dependencies - environment.systemPackages = with pkgs; [ - git - ]; - } - { - # TODO never put hashedPassword into the store - users.extraUsers = - mapAttrs (_: h: { hashedPassword = h; }) - (import ); - } - { - users.groups.subusers.gid = 1093178926; # genid subusers - } - { - users.defaultUserShell = "/run/current-system/sw/bin/bash"; - users.mutableUsers = false; - } - { - users.extraUsers = { - root = { - openssh.authorizedKeys.keys = [ - config.krebs.users.tv.pubkey - config.krebs.users.tv_xu.pubkey - ]; - }; - tv = { - uid = 1337; - group = "users"; - home = "/home/tv"; - createHome = true; - useDefaultShell = true; - extraGroups = [ - "audio" - "video" - "wheel" - ]; - openssh.authorizedKeys.keys = [ - config.krebs.users.tv.pubkey - ]; - }; - }; - } - { - security.sudo.extraConfig = '' - Defaults mailto="${config.krebs.users.tv.mail}" - ''; - time.timeZone = "Europe/Berlin"; - } - { - # TODO check if both are required: - nix.chrootDirs = [ "/etc/protocols" pkgs.iana_etc.outPath ]; - - nix.trustedBinaryCaches = [ - "https://cache.nixos.org" - "http://cache.nixos.org" - "http://hydra.nixos.org" - ]; - - nix.useChroot = true; - } - { - environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ]; - - environment.systemPackages = with pkgs; [ - rxvt_unicode.terminfo - ]; - - environment.shellAliases = mkForce { - # alias cal='cal -m3' - gp = "${pkgs.pari}/bin/gp -q"; - df = "df -h"; - du = "du -h"; - # alias grep='grep --color=auto' - - # TODO alias cannot contain #\' - # "ps?" = "ps ax | head -n 1;ps ax | fgrep -v ' grep --color=auto ' | grep"; - - # alias la='ls -lA' - lAtr = "ls -lAtr"; - # alias ll='ls -l' - ls = "ls -h --color=auto --group-directories-first"; - dmesg = "dmesg -L --reltime"; - view = "vim -R"; - }; - - programs.bash = { - interactiveShellInit = '' - HISTCONTROL='erasedups:ignorespace' - HISTSIZE=65536 - HISTFILESIZE=$HISTSIZE - - shopt -s checkhash - shopt -s histappend histreedit histverify - shopt -s no_empty_cmd_completion - complete -d cd - - ${readFile ./bash_completion.sh} - - # TODO source bridge - ''; - promptInit = '' - case $UID in - 0) - PS1='\[\e[1;31m\]\w\[\e[0m\] ' - ;; - 1337) - PS1='\[\e[1;32m\]\w\[\e[0m\] ' - ;; - *) - PS1='\[\e[1;35m\]\u \[\e[1;32m\]\w\[\e[0m\] ' - ;; - esac - if test -n "$SSH_CLIENT"; then - PS1='\[\e[35m\]\h'" $PS1" - fi - if test -n "$SSH_AGENT_PID"; then - PS1="ssh-agent[$SSH_AGENT_PID] $PS1" - fi - ''; - }; - - programs.ssh.startAgent = false; - } - - { - services.cron.enable = false; - services.nscd.enable = false; - services.ntp.enable = false; - } - - { - boot.kernel.sysctl = { - # Enable IPv6 Privacy Extensions - "net.ipv6.conf.all.use_tempaddr" = 2; - "net.ipv6.conf.default.use_tempaddr" = 2; - }; - } - - { - services.openssh = { - enable = true; - hostKeys = [ - { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; } - ]; - }; - } - - { - # TODO: exim - security.setuidPrograms = [ - "sendmail" # for sudo - ]; - } - ]; -} diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix new file mode 100644 index 000000000..d3f4eed0d --- /dev/null +++ b/tv/2configs/default.nix @@ -0,0 +1,168 @@ +{ config, lib, pkgs, ... }: + +with lib; + +{ + krebs.enable = true; + + networking.hostName = config.krebs.build.host.name; + + imports = [ + ./vim.nix + { + # stockholm dependencies + environment.systemPackages = with pkgs; [ + git + ]; + } + { + # TODO never put hashedPassword into the store + users.extraUsers = + mapAttrs (_: h: { hashedPassword = h; }) + (import ); + } + { + users.groups.subusers.gid = 1093178926; # genid subusers + } + { + users.defaultUserShell = "/run/current-system/sw/bin/bash"; + users.mutableUsers = false; + } + { + users.extraUsers = { + root = { + openssh.authorizedKeys.keys = [ + config.krebs.users.tv.pubkey + config.krebs.users.tv_xu.pubkey + ]; + }; + tv = { + uid = 1337; + group = "users"; + home = "/home/tv"; + createHome = true; + useDefaultShell = true; + extraGroups = [ + "audio" + "video" + "wheel" + ]; + openssh.authorizedKeys.keys = [ + config.krebs.users.tv.pubkey + ]; + }; + }; + } + { + security.sudo.extraConfig = '' + Defaults mailto="${config.krebs.users.tv.mail}" + ''; + time.timeZone = "Europe/Berlin"; + } + { + # TODO check if both are required: + nix.chrootDirs = [ "/etc/protocols" pkgs.iana_etc.outPath ]; + + nix.trustedBinaryCaches = [ + "https://cache.nixos.org" + "http://cache.nixos.org" + "http://hydra.nixos.org" + ]; + + nix.useChroot = true; + } + { + environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ]; + + environment.systemPackages = with pkgs; [ + rxvt_unicode.terminfo + ]; + + environment.shellAliases = mkForce { + # alias cal='cal -m3' + gp = "${pkgs.pari}/bin/gp -q"; + df = "df -h"; + du = "du -h"; + # alias grep='grep --color=auto' + + # TODO alias cannot contain #\' + # "ps?" = "ps ax | head -n 1;ps ax | fgrep -v ' grep --color=auto ' | grep"; + + # alias la='ls -lA' + lAtr = "ls -lAtr"; + # alias ll='ls -l' + ls = "ls -h --color=auto --group-directories-first"; + dmesg = "dmesg -L --reltime"; + view = "vim -R"; + }; + + programs.bash = { + interactiveShellInit = '' + HISTCONTROL='erasedups:ignorespace' + HISTSIZE=65536 + HISTFILESIZE=$HISTSIZE + + shopt -s checkhash + shopt -s histappend histreedit histverify + shopt -s no_empty_cmd_completion + complete -d cd + + ${readFile ./bash_completion.sh} + + # TODO source bridge + ''; + promptInit = '' + case $UID in + 0) + PS1='\[\e[1;31m\]\w\[\e[0m\] ' + ;; + 1337) + PS1='\[\e[1;32m\]\w\[\e[0m\] ' + ;; + *) + PS1='\[\e[1;35m\]\u \[\e[1;32m\]\w\[\e[0m\] ' + ;; + esac + if test -n "$SSH_CLIENT"; then + PS1='\[\e[35m\]\h'" $PS1" + fi + if test -n "$SSH_AGENT_PID"; then + PS1="ssh-agent[$SSH_AGENT_PID] $PS1" + fi + ''; + }; + + programs.ssh.startAgent = false; + } + + { + services.cron.enable = false; + services.nscd.enable = false; + services.ntp.enable = false; + } + + { + boot.kernel.sysctl = { + # Enable IPv6 Privacy Extensions + "net.ipv6.conf.all.use_tempaddr" = 2; + "net.ipv6.conf.default.use_tempaddr" = 2; + }; + } + + { + services.openssh = { + enable = true; + hostKeys = [ + { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; } + ]; + }; + } + + { + # TODO: exim + security.setuidPrograms = [ + "sendmail" # for sudo + ]; + } + ]; +} -- cgit v1.2.3 From bae469d2a64165a42d93cdb31e231fa75e9813a5 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 6 Nov 2015 22:36:01 +0100 Subject: tv: condense krebs.build --- tv/2configs/default.nix | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'tv/2configs') diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index d3f4eed0d..d31862b60 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -5,6 +5,25 @@ with lib; { krebs.enable = true; + krebs.build = { + user = config.krebs.users.tv; + target = mkDefault "root@${config.krebs.build.host.name}"; + source = { + git.nixpkgs = { + url = mkDefault https://github.com/NixOS/nixpkgs; + rev = mkDefault "c44a593aa43bba6a0708f6f36065a514a5110613"; + target-path = mkDefault "/var/src/nixpkgs"; + }; + dir.secrets = { + path = mkDefault "/home/tv/secrets/${config.krebs.build.host.name}"; + }; + dir.stockholm = { + path = mkDefault "/home/tv/stockholm"; + target-path = mkDefault "/var/src/stockholm"; + }; + }; + }; + networking.hostName = config.krebs.build.host.name; imports = [ -- cgit v1.2.3 [cgit] Unable to lock slot /tmp/cgit/b8100000.lock: No such file or directory (2)