makefu/stockholm
1
0
Fork 0
Code Issues Pull requests Actions 1 Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'prism/master'

Browse source
This commit is contained in:
makefu 2016-08-21 12:12:13 +02:00
parent 54ccd36717 1d9f7b4f2d
commit 054475b623
No known key found for this signature in database
GPG key ID: 36F7711F3FC0F225
26 changed files with 223 additions and 89 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
krebs/3modules/buildbot/master.nix
View file

@ -3,15 +3,8 @@
with config.krebs.lib;
let
# https://github.com/NixOS/nixpkgs/issues/14026
nixpkgs-fix = import (pkgs.fetchgit {
url = https://github.com/nixos/nixpkgs;
rev = "e026b5c243ea39810826e68362718f5d703fb5d0";
sha256 = "87e0724910a6df0371f883f99a8cf42e366fb4119f676f6f74ffb404beca2632";
}) {};
buildbot = nixpkgs-fix.buildbot;
buildbot-master-config = pkgs.writeText "buildbot-master.cfg" ''
buildbot = pkgs.buildbot;
buildbot-master-config = pkgs.writePython2 "buildbot-master.cfg" ''
# -*- python -*-
from buildbot.plugins import *
import re

7
krebs/3modules/default.nix
View file

@ -153,6 +153,7 @@ let
to = concatMapStringsSep "," (getAttr "mail") (toList to);
};
in mapAttrsToList format (with config.krebs.users; let
eloop-ml = spam-ml ++ [ ciko Mic92 ];
spam-ml = [
lass
makefu
@ -161,8 +162,10 @@ let
ciko.mail = "wieczorek.stefan@gmail.com";
Mic92.mail = "joerg@higgsboson.tk";
in {
"*@eloop.org" = [{ mail = "eloop2016@krebsco.de"; }];
"eloop2016@krebsco.de" = spam-ml ++ [ ciko Mic92 ];
"cfp@eloop.org" = eloop-ml;
"kontakt@eloop.org" = eloop-ml;
"root@eloop.org" = eloop-ml;
"eloop2016@krebsco.de" = eloop-ml;
"postmaster@krebsco.de" = spam-ml; # RFC 822
"lass@krebsco.de" = lass;
"makefu@krebsco.de" = makefu;

4
krebs/5pkgs/apt-cacher-ng/default.nix
View file

@ -2,11 +2,11 @@
stdenv.mkDerivation rec {
name = "apt-cacher-ng-${version}";
version = "0.9.3";
version = "0.9.3.2";
src = fetchurl {
url = "http://ftp.debian.org/debian/pool/main/a/apt-cacher-ng/apt-cacher-ng_${version}.orig.tar.xz";
sha256 = "1bd7l1wg0q1p9pg0v6lqflf2znydx8mrh2jxbvv6xsrp1473nfwg";
sha256 = "1bvng9mwrggvc93q2alj0x72i56wifnjs2dsycr17mapsv0f2gnc";
};
NIX_LDFLAGS = "-lpthread";

22
krebs/5pkgs/builders.nix
View file

@ -253,5 +253,27 @@ rec {
${pkgs.cabal2nix}/bin/cabal2nix ${path} > $out
'');
writePython2 = name: src: pkgs.runCommand name {} /* sh */ ''
name=${assert types.filename.check name; name}
src=${shell.escape src}
# syntax check
printf '%s' "$src" > src.py
${pkgs.python2}/bin/python -m py_compile src.py
cp src.py "$out"
'';
writePython3 = name: src: pkgs.runCommand name {} /* sh */ ''
name=${assert types.filename.check name; name}
src=${shell.escape src}
# syntax check
printf '%s' "$src" > src.py
${pkgs.python3}/bin/python -m py_compile src.py
cp src.py "$out"
'';
writeSed = makeScriptWriter "${pkgs.gnused}/bin/sed -f";
}

34
krebs/5pkgs/games-user-env/default.nix Normal file
View file

@ -0,0 +1,34 @@
{ lib, pkgs, ... }: let
#TODO: make sure env exists prior to running
env_nix = pkgs.writeText "env.nix" ''
{ pkgs ? import <nixpkgs> {} }:
(pkgs.buildFHSUserEnv {
name = "simple-x11-env";
targetPkgs = pkgs: with pkgs; [
coreutils
];
multiPkgs = pkgs: with pkgs; [
alsaLib
zlib
xorg.libXxf86vm
curl
openal
openssl_1_0_2
xorg.libXext
xorg.libX11
xorg.libXrandr
xorg.libXcursor
xorg.libXinerama
xorg.libXi
mesa_glu
];
runScript = "bash";
}).env
'';
in pkgs.writeDashBin "games-user-env" ''
nix-shell ${env_nix}
''

21
krebs/5pkgs/tarantool/default.nix Normal file
View file

@ -0,0 +1,21 @@
{ stdenv, fetchgit, cmake, ncurses, openssl, readline, ... }:
stdenv.mkDerivation rec {
name = "tarantool-1.7.1-164-g0fd0239";
src = fetchgit {
url = https://github.com/tarantool/tarantool;
rev = builtins.elemAt (builtins.match ".*-g([0-9a-f]+)" name) 0;
sha256 = "1jnaiizbl9j4a8vsihqx75iqa9bkh1kpwsyrgmim8ikiyzfw54dz";
fetchSubmodules = true;
};
buildInputs = [
cmake
ncurses
openssl
readline
];
preConfigure = ''
echo ${(builtins.parseDrvName name).version} > VERSION
sed -i 's/NAMES termcap/NAMES ncurses/' cmake/FindTermcap.cmake
'';
}

1
lass/1systems/mors.nix
View file

@ -17,7 +17,6 @@
../2configs/wine.nix
../2configs/chromium-patched.nix
../2configs/git.nix
../2configs/bitlbee.nix
../2configs/skype.nix
../2configs/teamviewer.nix
../2configs/libvirt.nix

9
lass/1systems/prism.nix
View file

@ -188,9 +188,16 @@ in {
"fullchain.pem"
"full.pem"
];
user = "ejabberd";
allowKeysForGroup = true;
group = "lasscert";
};
};
users.groups.lasscert.members = [
"dovecot2"
"ejabberd"
"exim"
"nginx"
];
krebs.nginx.servers."lassul.us" = {
server-names = [ "lassul.us" ];
locations = [

2
lass/2configs/baseX.nix
View file

@ -16,7 +16,7 @@ in {
systemWide = true;
};
users.extraUsers.mainUser.extraGroups = [ "audio" ];
users.extraUsers.mainUser.extraGroups = [ "audio" "video" ];
time.timeZone = "Europe/Berlin";

100
lass/2configs/buildbot-standalone.nix
View file

@ -8,9 +8,6 @@ let
ControlPath /tmp/%u_sshmux_%r@%h:%p
ControlPersist 4h
'';
sshWrapper = pkgs.writeDash "ssh-wrapper" ''
${pkgs.openssh}/bin/ssh -F ${sshHostConfig} -i ${shell.escape config.lass.build-ssh-privkey.path} "$@"
'';
in {
config.krebs.buildbot.master = let
@ -47,8 +44,8 @@ in {
sched.append(schedulers.SingleBranchScheduler(
change_filter=util.ChangeFilter(branch_re=".*"),
treeStableTimer=10,
name="prism-all-branches",
builderNames=["build-all"]))
name="build-all-branches",
builderNames=["build-all", "build-pkgs"]))
'';
};
builder_pre = ''
@ -74,7 +71,7 @@ in {
# prepare nix-shell
# the dependencies which are used by the test script
deps = [ "gnumake", "jq", "nix", "(import <stockholm>).pkgs.populate" ]
deps = [ "gnumake", "jq", "nix", "(import <stockholm>).pkgs.populate", "openssh" ]
# TODO: --pure , prepare ENV in nix-shell command:
# SSL_CERT_FILE,LOGNAME,NIX_REMOTE
nixshell = ["nix-shell",
@ -93,20 +90,20 @@ in {
for i in [ "mors", "uriel", "shodan", "helios", "cloudkrebs", "echelon", "dishfire", "prism" ]:
addShell(f,name="build-{}".format(i),env=env_lass,
command=nixshell + \
["make \
["mkdir -p /tmp/testbuild/$LOGNAME && touch /tmp/testbuild/$LOGNAME/.populate; \
make \
test \
ssh=${sshWrapper} \
target=build@localhost${config.users.users.build.home}/testbuild \
target=$LOGNAME@${config.krebs.build.host.name}/tmp/testbuild/$LOGNAME \
method=build \
system={}".format(i)])
for i in [ "x", "wry", "vbob", "wbob", "shoney" ]:
addShell(f,name="build-{}".format(i),env=env_makefu,
command=nixshell + \
["make \
["mkdir -p /tmp/testbuild/$LOGNAME && touch /tmp/testbuild/$LOGNAME/.populate; \
make \
test \
ssh=${sshWrapper} \
target=build@localhost${config.users.users.build.home}/testbuild \
target=$LOGNAME@${config.krebs.build.host.name}/tmp/testbuild/$LOGNAME \
method=build \
system={}".format(i)])
@ -114,7 +111,7 @@ in {
slavenames=slavenames,
factory=f))
'';
'';
fast-tests = ''
f = util.BuildFactory()
@ -122,37 +119,94 @@ in {
for i in [ "mors", "uriel", "shodan", "helios", "cloudkrebs", "echelon", "dishfire", "prism" ]:
addShell(f,name="build-{}".format(i),env=env_lass,
command=nixshell + \
["make \
["mkdir -p /tmp/testbuild/$LOGNAME && touch /tmp/testbuild/$LOGNAME/.populate; \
make \
test \
ssh=${sshWrapper} \
target=build@localhost${config.users.users.build.home}/testbuild \
target=$LOGNAME@${config.krebs.build.host.name}/tmp/testbuild/$LOGNAME \
method=eval \
system={}".format(i)])
for i in [ "x", "wry", "vbob", "wbob", "shoney" ]:
addShell(f,name="build-{}".format(i),env=env_makefu,
command=nixshell + \
["make \
["mkdir -p /tmp/testbuild/$LOGNAME && touch /tmp/testbuild/$LOGNAME/.populate; \
make \
test \
ssh=${sshWrapper} \
target=build@localhost${config.users.users.build.home}/testbuild \
target=$LOGNAME@${config.krebs.build.host.name}/tmp/testbuild/$LOGNAME \
method=eval \
system={}".format(i)])
for i in [ "test-minimal-deploy" ]:
for i in [ "test-minimal-deploy", "test-all-krebs-modules", "wolf" ]:
addShell(f,name="build-{}".format(i),env=env_shared,
command=nixshell + \
["make \
["mkdir -p /tmp/testbuild/$LOGNAME && touch /tmp/testbuild/$LOGNAME/.populate; \
make \
test \
ssh=${sshWrapper} \
target=build@localhost${config.users.users.build.home}/testbuild \
target=$LOGNAME@${config.krebs.build.host.name}/tmp/testbuild/$LOGNAME \
method=eval \
system={}".format(i)])
bu.append(util.BuilderConfig(name="fast-tests",
slavenames=slavenames,
factory=f))
'';
build-pkgs = ''
f = util.BuildFactory()
f.addStep(grab_repo)
for i in [
"apt-cacher-ng",
"bepasty-client-cli",
"cac-api",
"cac-cert",
"cac-panel",
"charybdis",
"collectd-connect-time",
"dic",
"drivedroid-gen-repo",
"exim",
"fortclientsslvpn",
"get",
"git-hooks",
"github-hosts-sync",
"go",
"hashPassword",
"haskellPackages.blessings",
"haskellPackages.email-header",
"haskellPackages.megaparsec",
"haskellPackages.scanner",
"haskellPackages.xmonad-stockholm",
"krebspaste",
"krebszones",
"logf",
"much",
"newsbot-js",
"noVNC",
"passwdqc-utils",
"populate",
"posix-array",
"pssh",
"push",
"Reaktor",
"realwallpaper",
"repo-sync",
"retiolum-bootstrap",
"tarantool",
"test",
"tinc_graphs",
"translate-shell",
"urlwatch",
"vncdotool",
"with-tmpdir",
"youtube-tools",
]:
addShell(f,name="build-{}".format(i),env=env_lass,
command=nixshell + \
["mkdir -p /tmp/testbuild/$LOGNAME && touch /tmp/testbuild/$LOGNAME/.populate; \
make system=prism pkgs.{}".format(i)])
bu.append(util.BuilderConfig(name="build-pkgs",
slavenames=slavenames,
factory=f))
'';
};
enable = true;

5
lass/2configs/default.nix
View file

@ -44,6 +44,11 @@ with config.krebs.lib;
};
};
}
{
environment.variables = {
NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src";
};
}
];
networking.hostName = config.krebs.build.host.name;

9
lass/2configs/downloading.nix
View file

@ -15,10 +15,11 @@ in {
extraGroups = [
"download"
];
openssh.authorizedKeys.keys = [
config.krebs.users.lass.pubkey
config.krebs.users.lass-uriel.pubkey
config.krebs.users.lass-shodan.pubkey
openssh.authorizedKeys.keys = with config.krebs.users; [
lass.pubkey
lass-uriel.pubkey
lass-shodan.pubkey
makefu.pubkey
];
};

3
lass/2configs/mpv.nix
View file

@ -28,6 +28,9 @@ let
good = moveToDir "G" "./.good";
delete = moveToDir "D" "./.graveyard";
up = moveToDir "U" "./up";
down = moveToDir "Y" "./down";
deleteCurrentTrack = pkgs.writeText "delete.lua" ''
deleted_tmp = "./.graveyard"

1
lass/2configs/newsbot-js.nix
View file

@ -159,7 +159,6 @@ let
torrentfreak|http://feeds.feedburner.com/Torrentfreak|#news
torr_news|http://feed.torrentfreak.com/Torrentfreak/|#news
travel_warnings|http://feeds.travel.state.gov/ca/travelwarnings-alerts|#news
#truther|http://truthernews.wordpress.com/feed/|#news
un_afr|http://www.un.org/apps/news/rss/rss_africa.asp|#news
un_am|http://www.un.org/apps/news/rss/rss_americas.asp|#news
un_eu|http://www.un.org/apps/news/rss/rss_europe.asp|#news

2
lass/2configs/nixpkgs.nix
View file

@ -3,6 +3,6 @@
{
krebs.build.source.nixpkgs.git = {
url = https://github.com/lassulus/nixpkgs;
ref = "c6ca9c8c8b7eb8f8e68868e36fb90e162adf080f";
ref = "a75c0d9342ecb86dedd11f61a4e6f59ecc42d151";
};
}

1
shared/1systems/test-arch.nix
View file

@ -3,7 +3,6 @@
{
imports = [
../.
../2configs/base.nix
{
boot.loader.grub = {
device = "/dev/sda";

1
shared/1systems/test-centos6.nix
View file

@ -8,7 +8,6 @@ let
in {
imports = [
../.
../2configs/base.nix
../2configs/os-templates/CAC-CentOS-6.5-64bit.nix
{
networking.interfaces.enp11s0.ip4 = [

1
shared/1systems/test-centos7.nix
View file

@ -6,7 +6,6 @@ let
in {
imports = [
../.
../2configs/base.nix
../2configs/os-templates/CAC-CentOS-7-64bit.nix
../2configs/temp/networking.nix
../2configs/temp/dirs.nix

1
shared/1systems/wolf.nix
View file

@ -7,7 +7,6 @@ in
{
imports = [
../.
../2configs/base.nix
<nixpkgs/nixos/modules/profiles/qemu-guest.nix>
../2configs/collectd-base.nix
../2configs/shack-nix-cacher.nix

9
shared/2configs/base.nix → shared/2configs/default.nix
View file

@ -11,10 +11,13 @@ with config.krebs.lib;
nixos-config.symlink = "stockholm/${user.name}/1systems/${host.name}.nix";
nixpkgs.git = {
url = https://github.com/NixOS/nixpkgs;
ref = "63b9785"; # stable @ 2016-06-01
ref = "9cb194cfa449c43f63185a25c8d10307aea3b358"; # nixos-16.03 @ 2016-08-05
};
secrets.file = "${getEnv "HOME"}/secrets/krebs/${host.name}";
stockholm.file = "${getEnv "HOME"}/stockholm";
secrets.file =
if getEnv "dummy_secrets" == "true"
then toString <stockholm/shared/6tests/data/secrets>
else "${getEnv "HOME"}/secrets/krebs/${host.name}";
stockholm.file = getEnv "PWD";
};
networking.hostName = config.krebs.build.host.name;

65
shared/2configs/shared-buildbot.nix
View file

@ -71,7 +71,11 @@
# prepare grab_repo step for stockholm
grab_repo = steps.Git(repourl=stockholm_repo, mode='incremental')
env = {"LOGNAME": "shared", "NIX_REMOTE": "daemon"}
env = {
"LOGNAME": "shared",
"NIX_REMOTE": "daemon",
"dummy_secrets": "true",
}
# prepare nix-shell
# the dependencies which are used by the test script
@ -91,52 +95,39 @@
'';
builder = {
fast-tests = ''
f = util.BuildFactory()
f.addStep(grab_repo)
for i in [ "test-centos7", "wolf", "test-failing" ]:
addShell(f,name="populate-{}".format(i),env=env,
command=nixshell + \
["{}(make system={} populate debug=true)".format("!" if "failing" in i else "",i)])
f = util.BuildFactory()
f.addStep(grab_repo)
# XXX we must prepare ./retiolum.rsa_key.priv for secrets to work
addShell(f,name="instantiate-test-all-modules",env=env,
command=nixshell + \
["touch retiolum.rsa_key.priv; \
nix-instantiate \
--show-trace --eval --strict --json \
-I nixos-config=./shared/1systems/test-all-krebs-modules.nix \
-I secrets=. \
-A config.system.build.toplevel"]
)
for i in [ "test-minimal-deploy", "test-all-krebs-modules", "wolf", "test-centos7" ]:
addShell(f,name="build-{}".format(i),env=env,
command=nixshell + \
["mkdir -p /tmp/testbuild/$LOGNAME && touch /tmp/testbuild/$LOGNAME/.populate; \
make \
test \
target=$LOGNAME@${config.krebs.build.host.name}/tmp/testbuild/$LOGNAME \
method=eval \
system={}".format(i)])
addShell(f,name="build-test-minimal",env=env,
command=nixshell + \
["nix-instantiate \
--show-trace --eval --strict --json \
-I nixos-config=./shared/1systems/test-minimal-deploy.nix \
-I secrets=. \
-A config.system.build.toplevel"]
)
bu.append(util.BuilderConfig(name="fast-tests",
slavenames=slavenames,
factory=f))
bu.append(util.BuilderConfig(name="fast-tests",
slavenames=slavenames,
factory=f))
'';
'';
# this build will try to build against local nixpkgs
# TODO change to do a 'local' populate and use the retrieved nixpkgs
build-local = ''
f = util.BuildFactory()
f.addStep(grab_repo)
addShell(f,name="build-test-all-modules",env=env,
for i in [ "test-all-krebs-modules", "wolf" ]:
addShell(f,name="build-{}".format(i),env=env,
command=nixshell + \
["touch retiolum.rsa_key.priv; \
nix-build \
--show-trace --no-out-link \
-I nixos-config=./shared/1systems/test-all-krebs-modules.nix \
-I secrets=. \
-A config.system.build.toplevel"]
)
["mkdir -p /tmp/testbuild/$LOGNAME && touch /tmp/testbuild/$LOGNAME/.populate; \
make \
test \
target=$LOGNAME@${config.krebs.build.host.name}/tmp/testbuild/$LOGNAME \
method=build \
system={}".format(i)])
bu.append(util.BuilderConfig(name="build-local",
slavenames=slavenames,

1
shared/6tests/data/secrets/grafana_security.nix Normal file
View file

@ -0,0 +1 @@
{}

0
shared/6tests/data/secrets/retiolum.rsa_key.priv Normal file
View file

0
shared/6tests/data/secrets/ssh.id_ed25519 Normal file
View file

1
shared/default.nix
View file

@ -2,6 +2,7 @@ _:
{
imports = [
../krebs
./2configs
./3modules
];
}

1
tv/2configs/exim-smarthost.nix
View file

@ -19,6 +19,7 @@ with config.krebs.lib;
config.krebs.hosts.xu
];
internet-aliases = with config.krebs.users; [
{ from = "bku-eppler@viljetic.de"; to = tv.mail; }
{ from = "postmaster@viljetic.de"; to = tv.mail; } # RFC 822
{ from = "mirko@viljetic.de"; to = mv-cd.mail; }
{ from = "tomislav@viljetic.de"; to = tv.mail; }