Merge remote-tracking branch 'cd/master'
This commit is contained in:
lassulus
commit
0b0b0d65ee
28
Makefile
28
Makefile
|
|
@ -4,14 +4,16 @@ endif
|
|||
|
||||
export target_host ?= $(system)
|
||||
export target_user ?= root
|
||||
export target_port ?= 22
|
||||
export target_path ?= /var/src
|
||||
|
||||
evaluate = \
|
||||
nix-instantiate \
|
||||
--arg configuration "./$$LOGNAME/1systems/$$system.nix" \
|
||||
--eval \
|
||||
--readonly-mode \
|
||||
--show-trace \
|
||||
-I nixos-config=./$(LOGNAME)/1systems/$(system).nix \
|
||||
-I stockholm=. \
|
||||
$(1)
|
||||
|
||||
execute = \
|
||||
|
|
@ -22,20 +24,20 @@ execute = \
|
|||
# usage: make deploy system=foo [target_host=bar]
|
||||
deploy:
|
||||
$(call execute,populate)
|
||||
@set -x; ssh "$$target_user@$$target_host" nixos-rebuild switch -I "$$target_path"
|
||||
ssh $(target_user)@$(target_host) -p $(target_port) \
|
||||
nixos-rebuild switch --show-trace -I $(target_path)
|
||||
|
||||
# usage: make LOGNAME=shared system=wolf eval.config.krebs.build.host.name
|
||||
eval eval.:;@$(call evaluate)
|
||||
eval.%:;@$(call evaluate,-A $*)
|
||||
|
||||
## usage: make install system=foo target=
|
||||
#.PHONY: install
|
||||
#install: ssh = ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
|
||||
#install:;@set -x
|
||||
# $(ssh) "$$target_user@$$target_host" \
|
||||
# env target_path="$target_path" \
|
||||
# sh -s prepare < krebs/4lib/infest/prepare.sh
|
||||
# make -s populate target_path=/mnt"$$target_path"
|
||||
# $(ssh) "$$target_user@$$target_host" \
|
||||
# env NIXOS_CONFIG=/var/src/nixos-config \
|
||||
# nixos-install
|
||||
# usage: make install system=foo [target_host=bar]
|
||||
install: ssh ?= ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
|
||||
install:
|
||||
$(ssh) $(target_user)@$(target_host) -p $(target_port) \
|
||||
env target_path=$(target_path) \
|
||||
sh -s prepare < krebs/4lib/infest/prepare.sh
|
||||
target_path=/mnt$(target_path) $(call execute,populate)
|
||||
$(ssh) $(target_user)@$(target_host) -p $(target_port) \
|
||||
env NIXOS_CONFIG=$(target_path)/nixos-config \
|
||||
nixos-install
|
||||
|
|
|
|||
93
default.nix
93
default.nix
|
|
@ -1,88 +1,5 @@
|
|||
{ configuration ? import (nixpkgs-path + "/nixos/lib/from-env.nix") "NIXOS_CONFIG" <nixos-config>
|
||||
, system ? builtins.currentSystem
|
||||
, current-host-name ?
|
||||
let v = builtins.getEnv "HOSTNAME"; in
|
||||
if v != "" then v else builtins.readFile /proc/sys/kernel/hostname
|
||||
, current-user-name ?
|
||||
let v = builtins.getEnv "LOGNAME"; in
|
||||
if v != "" then v else abort "undefined variable: LOGNAME"
|
||||
, nixpkgs-path ?
|
||||
if (builtins.tryEval <nixpkgs/krebs>).success
|
||||
then <upstream-nixpkgs>
|
||||
else <nixpkgs>
|
||||
, StrictHostKeyChecking ? "yes"
|
||||
}@args:
|
||||
|
||||
let stockholm = {
|
||||
inherit krebs;
|
||||
inherit users;
|
||||
inherit lib;
|
||||
inherit config options pkgs;
|
||||
system = config.system.build.toplevel;
|
||||
};
|
||||
|
||||
krebs = import ./krebs (args // { inherit lib stockholm; });
|
||||
|
||||
lib = let
|
||||
nlib = import (slib.npath "lib");
|
||||
klib = import (slib.kpath "4lib") { lib = nlib; };
|
||||
slib = rec {
|
||||
nspath = ns: p: ./. + "/${ns}/${p}";
|
||||
npath = p: nixpkgs-path + "/${p}";
|
||||
kpath = nspath "krebs";
|
||||
upath = nspath current-user-name;
|
||||
};
|
||||
ulib = let p = slib.upath "4lib"; in
|
||||
nlib.optionalAttrs (klib.dir.has-default-nix p)
|
||||
(import p { lib = nlib // klib; });
|
||||
in nlib // klib // slib // ulib // builtins;
|
||||
|
||||
inherit (eval configuration) config options pkgs;
|
||||
|
||||
base-module = { config, ... }: {
|
||||
imports = builtins.filter lib.dir.has-default-nix (lib.concatLists [
|
||||
(map (f: f "2configs") [ lib.upath ])
|
||||
(map (f: f "3modules") [ lib.kpath lib.upath ])
|
||||
]);
|
||||
|
||||
krebs.current.enable = true;
|
||||
krebs.current.host = config.krebs.hosts.${current-host-name};
|
||||
krebs.current.user = config.krebs.users.${current-user-name};
|
||||
|
||||
nixpkgs.config.packageOverrides = pkgs: let
|
||||
kpkgs = import (lib.kpath "5pkgs") { inherit lib pkgs; };
|
||||
upkgs = import (lib.upath "5pkgs") { inherit lib; pkgs = pkgs // kpkgs; };
|
||||
in kpkgs // upkgs;
|
||||
};
|
||||
|
||||
eval = config: import (lib.npath "nixos/lib/eval-config.nix") {
|
||||
inherit system;
|
||||
specialArgs = {
|
||||
inherit lib;
|
||||
};
|
||||
modules = [
|
||||
base-module
|
||||
config
|
||||
];
|
||||
};
|
||||
|
||||
# TODO move user namespaces' to users/, so no exception for krebs/ is needed
|
||||
users =
|
||||
lib.mapAttrs
|
||||
(name: _: eval-all-systems (lib.nspath name "1systems"))
|
||||
(lib.filterAttrs
|
||||
(n: t: !lib.hasPrefix "." n && t == "directory" && n != "krebs")
|
||||
(builtins.readDir ./.));
|
||||
|
||||
eval-all-systems = path:
|
||||
lib.mapAttrs'
|
||||
(n: _: (lib.nameValuePair (lib.removeSuffix ".nix" n)
|
||||
(eval-system (path + "/${n}"))))
|
||||
(builtins.readDir path);
|
||||
|
||||
eval-system = path: rec {
|
||||
inherit (eval path) config options;
|
||||
system = config.system.build.toplevel;
|
||||
};
|
||||
|
||||
in stockholm
|
||||
import <nixpkgs/nixos/lib/eval-config.nix> {
|
||||
modules = [
|
||||
(import <nixpkgs/nixos/lib/from-env.nix> "NIXOS_CONFIG" <nixos-config>)
|
||||
];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
|
||||
ReaktorConfig = pkgs.writeText "config.py" ''
|
||||
|
|
@ -16,7 +16,7 @@ let
|
|||
|
||||
out = {
|
||||
options.krebs.Reaktor = api;
|
||||
config = mkIf cfg.enable imp;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
};
|
||||
|
||||
api = {
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
acng-config = pkgs.writeTextFile {
|
||||
name = "acng-configuration";
|
||||
|
|
@ -151,5 +151,5 @@ let
|
|||
in
|
||||
{
|
||||
options.krebs.apt-cacher-ng = api;
|
||||
config = mkIf cfg.enable imp;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,9 +1,9 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
out = {
|
||||
options.krebs.backup = api;
|
||||
config = mkIf cfg.enable imp;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
};
|
||||
|
||||
cfg = config.krebs.backup;
|
||||
|
|
@ -12,14 +12,17 @@ let
|
|||
enable = mkEnableOption "krebs.backup" // { default = true; };
|
||||
plans = mkOption {
|
||||
default = {};
|
||||
type = types.attrsOf (types.submodule ({
|
||||
# TODO enable = mkEnableOption "TODO" // { default = true; };
|
||||
type = types.attrsOf (types.submodule ({ config, ... }: {
|
||||
options = {
|
||||
enable = mkEnableOption "krebs.backup.${config.name}" // {
|
||||
default = true;
|
||||
};
|
||||
method = mkOption {
|
||||
type = types.enum ["pull" "push"];
|
||||
};
|
||||
name = mkOption {
|
||||
type = types.str;
|
||||
default = config._module.args.name;
|
||||
};
|
||||
src = mkOption {
|
||||
type = types.krebs.file-location;
|
||||
|
|
@ -29,7 +32,7 @@ let
|
|||
};
|
||||
startAt = mkOption {
|
||||
default = "hourly";
|
||||
type = types.str; # TODO systemd.time(7)'s calendar event
|
||||
type = with types; nullOr str; # TODO systemd.time(7)'s calendar event
|
||||
};
|
||||
snapshots = mkOption {
|
||||
default = {
|
||||
|
|
@ -57,239 +60,165 @@ let
|
|||
};
|
||||
|
||||
imp = {
|
||||
users.groups.backup.gid = genid "backup";
|
||||
users.users = {}
|
||||
// {
|
||||
root.openssh.authorizedKeys.keys =
|
||||
map (plan: plan.dst.host.ssh.pubkey)
|
||||
(filter isPullSrc (attrValues cfg.plans))
|
||||
++
|
||||
map (plan: plan.src.host.ssh.pubkey)
|
||||
(filter isPushDst (attrValues cfg.plans))
|
||||
;
|
||||
}
|
||||
;
|
||||
systemd.services =
|
||||
flip mapAttrs' (filterAttrs (_:isPullDst) cfg.plans) (name: plan: {
|
||||
name = "backup.${name}.pull";
|
||||
value = makePullService plan;
|
||||
})
|
||||
//
|
||||
flip mapAttrs' (filterAttrs (_:isPushSrc) cfg.plans) (name: plan: {
|
||||
name = "backup.${name}.push";
|
||||
value = makePushService plan;
|
||||
})
|
||||
;
|
||||
listToAttrs (map (plan: nameValuePair "backup.${plan.name}" {
|
||||
# TODO if there is plan.user, then use its privkey
|
||||
# TODO push destination users need a similar path
|
||||
path = with pkgs; [
|
||||
coreutils
|
||||
gnused
|
||||
openssh
|
||||
rsync
|
||||
utillinux
|
||||
];
|
||||
serviceConfig = rec {
|
||||
ExecStart = start plan;
|
||||
SyslogIdentifier = ExecStart.name;
|
||||
Type = "oneshot";
|
||||
};
|
||||
startAt = mkIf (plan.startAt != null) plan.startAt;
|
||||
}) (filter (plan: build-host-is "pull" "dst" plan ||
|
||||
build-host-is "push" "src" plan)
|
||||
enabled-plans));
|
||||
|
||||
users.groups.backup.gid = genid "backup";
|
||||
users.users.root.openssh.authorizedKeys.keys =
|
||||
map (plan: getAttr plan.method {
|
||||
push = plan.src.host.ssh.pubkey;
|
||||
pull = plan.dst.host.ssh.pubkey;
|
||||
}) (filter (plan: build-host-is "pull" "src" plan ||
|
||||
build-host-is "push" "dst" plan)
|
||||
enabled-plans);
|
||||
};
|
||||
|
||||
isPushSrc = plan:
|
||||
plan.method == "push" &&
|
||||
plan.src.host.name == config.krebs.build.host.name;
|
||||
enabled-plans = filter (getAttr "enable") (attrValues cfg.plans);
|
||||
|
||||
isPullSrc = plan:
|
||||
plan.method == "pull" &&
|
||||
plan.src.host.name == config.krebs.build.host.name;
|
||||
build-host-is = method: side: plan:
|
||||
plan.method == method &&
|
||||
config.krebs.build.host.name == plan.${side}.host.name;
|
||||
|
||||
isPushDst = plan:
|
||||
plan.method == "push" &&
|
||||
plan.dst.host.name == config.krebs.build.host.name;
|
||||
|
||||
isPullDst = plan:
|
||||
plan.method == "pull" &&
|
||||
plan.dst.host.name == config.krebs.build.host.name;
|
||||
|
||||
# TODO push destination needs this in the dst.user's PATH
|
||||
service-path = [
|
||||
pkgs.coreutils
|
||||
pkgs.gnused
|
||||
pkgs.openssh
|
||||
pkgs.rsync
|
||||
pkgs.utillinux
|
||||
];
|
||||
|
||||
# TODO if there is plan.user, then use its privkey
|
||||
makePushService = plan: assert isPushSrc plan; {
|
||||
path = service-path;
|
||||
serviceConfig = {
|
||||
ExecStart = push plan;
|
||||
Type = "oneshot";
|
||||
};
|
||||
startAt = plan.startAt;
|
||||
};
|
||||
|
||||
makePullService = plan: assert isPullDst plan; {
|
||||
path = service-path;
|
||||
serviceConfig = {
|
||||
ExecStart = pull plan;
|
||||
Type = "oneshot";
|
||||
};
|
||||
startAt = plan.startAt;
|
||||
};
|
||||
|
||||
push = plan: let
|
||||
# We use writeDashBin and return the absolute path so systemd will produce
|
||||
# nice names in the log, i.e. without the Nix store hash.
|
||||
out = "${main}/bin/${main.name}";
|
||||
|
||||
main = writeDashBin "backup.${plan.name}.push" ''
|
||||
start = plan: pkgs.writeDash "backup.${plan.name}" ''
|
||||
set -efu
|
||||
${getAttr plan.method {
|
||||
push = ''
|
||||
identity=${shell.escape plan.src.host.ssh.privkey.path}
|
||||
src_path=${shell.escape plan.src.path}
|
||||
src=$src_path
|
||||
dst_user=root
|
||||
dst_host=$(${fastest-address plan.dst.host})
|
||||
dst_port=$(${network-ssh-port plan.dst.host "$dst_host"})
|
||||
dst_path=${shell.escape plan.dst.path}
|
||||
dst=$dst_user@$dst_host:$dst_path
|
||||
echo "update snapshot: current; $src -> $dst" >&2
|
||||
dst_shell() {
|
||||
exec ssh -F /dev/null \
|
||||
-i "$identity" \
|
||||
''${dst_port:+-p $dst_port} \
|
||||
"$dst_user@$dst_host" \
|
||||
-T "$with_dst_path_lock_script"
|
||||
}
|
||||
'';
|
||||
pull = ''
|
||||
identity=${shell.escape plan.dst.host.ssh.privkey.path}
|
||||
src_user=root
|
||||
src_host=$(${fastest-address plan.src.host})
|
||||
src_port=$(${network-ssh-port plan.src.host "$src_host"})
|
||||
src_path=${shell.escape plan.src.path}
|
||||
src=$src_user@$src_host:$src_path
|
||||
dst_path=${shell.escape plan.dst.path}
|
||||
dst=$dst_path
|
||||
echo "update snapshot: current; $dst <- $src" >&2
|
||||
dst_shell() {
|
||||
eval "$with_dst_path_lock_script"
|
||||
}
|
||||
'';
|
||||
}}
|
||||
# Note that this only works because we trust date +%s to produce output
|
||||
# that doesn't need quoting when used to generate a command string.
|
||||
# TODO relax this requirement by selectively allowing to inject variables
|
||||
# e.g.: ''${shell.quote "exec env NOW=''${shell.unquote "$NOW"} ..."}
|
||||
with_dst_path_lock_script="exec env start_date=$(date +%s) "${shell.escape
|
||||
"flock -n ${shell.escape plan.dst.path} /bin/sh"
|
||||
}
|
||||
rsync >&2 \
|
||||
-aAXF --delete \
|
||||
-e "ssh -F /dev/null -i $identity ''${dst_port:+-p $dst_port}" \
|
||||
--rsync-path ${shell.escape (concatStringsSep " && " [
|
||||
"mkdir -m 0700 -p ${shell.escape plan.dst.path}/current"
|
||||
"exec flock -n ${shell.escape plan.dst.path} rsync"
|
||||
])} \
|
||||
--link-dest="$dst_path/current" \
|
||||
"$src/" \
|
||||
"$dst/.partial"
|
||||
dst_shell < ${toFile "backup.${plan.name}.take-snapshots" ''
|
||||
set -efu
|
||||
: $start_date
|
||||
|
||||
dst=${shell.escape plan.dst.path}
|
||||
|
||||
mkdir -m 0700 -p "$dst"
|
||||
exec flock -n "$dst" ${critical-section}
|
||||
'';
|
||||
|
||||
critical-section = writeDash "backup.${plan.name}.push.critical-section" ''
|
||||
# TODO check if there is a previous
|
||||
set -efu
|
||||
identity=${shell.escape plan.src.host.ssh.privkey.path}
|
||||
src=${shell.escape plan.src.path}
|
||||
dst_target=${shell.escape "root@${getFQDN plan.dst.host}"}
|
||||
dst_path=${shell.escape plan.dst.path}
|
||||
dst=$dst_target:$dst_path
|
||||
|
||||
# Export NOW so runtime of rsync doesn't influence snapshot naming.
|
||||
export NOW
|
||||
NOW=$(date +%s)
|
||||
|
||||
echo >&2 "update snapshot: current; $src -> $dst"
|
||||
rsync >&2 \
|
||||
-aAXF --delete \
|
||||
-e "ssh -F /dev/null -i $identity" \
|
||||
--rsync-path ${shell.escape
|
||||
"mkdir -m 0700 -p ${shell.escape plan.dst.path} && rsync"} \
|
||||
--link-dest="$dst_path/current" \
|
||||
"$src/" \
|
||||
"$dst/.partial"
|
||||
|
||||
exec ssh -F /dev/null \
|
||||
-i "$identity" \
|
||||
"$dst_target" \
|
||||
-T \
|
||||
env NOW="$NOW" /bin/sh < ${remote-snapshot}
|
||||
EOF
|
||||
'';
|
||||
|
||||
remote-snapshot = writeDash "backup.${plan.name}.push.remote-snapshot" ''
|
||||
set -efu
|
||||
dst=${shell.escape plan.dst.path}
|
||||
|
||||
if test -e "$dst/current"; then
|
||||
mv "$dst/current" "$dst/.previous"
|
||||
fi
|
||||
mv "$dst/.partial" "$dst/current"
|
||||
rm -fR "$dst/.previous"
|
||||
echo >&2
|
||||
|
||||
(${(take-snapshots plan).text})
|
||||
'';
|
||||
|
||||
in out;
|
||||
|
||||
# TODO admit plan.dst.user and its ssh identity
|
||||
pull = plan: let
|
||||
# We use writeDashBin and return the absolute path so systemd will produce
|
||||
# nice names in the log, i.e. without the Nix store hash.
|
||||
out = "${main}/bin/${main.name}";
|
||||
|
||||
main = writeDashBin "backup.${plan.name}.pull" ''
|
||||
set -efu
|
||||
dst=${shell.escape plan.dst.path}
|
||||
|
||||
mkdir -m 0700 -p "$dst"
|
||||
exec flock -n "$dst" ${critical-section}
|
||||
'';
|
||||
|
||||
critical-section = writeDash "backup.${plan.name}.pull.critical-section" ''
|
||||
# TODO check if there is a previous
|
||||
set -efu
|
||||
identity=${shell.escape plan.dst.host.ssh.privkey.path}
|
||||
src=${shell.escape "root@${getFQDN plan.src.host}:${plan.src.path}"}
|
||||
dst=${shell.escape plan.dst.path}
|
||||
|
||||
# Export NOW so runtime of rsync doesn't influence snapshot naming.
|
||||
export NOW
|
||||
NOW=$(date +%s)
|
||||
|
||||
echo >&2 "update snapshot: current; $dst <- $src"
|
||||
mkdir -m 0700 -p ${shell.escape plan.dst.path}
|
||||
rsync >&2 \
|
||||
-aAXF --delete \
|
||||
-e "ssh -F /dev/null -i $identity" \
|
||||
--link-dest="$dst/current" \
|
||||
"$src/" \
|
||||
"$dst/.partial"
|
||||
mv "$dst/current" "$dst/.previous"
|
||||
mv "$dst/.partial" "$dst/current"
|
||||
rm -fR "$dst/.previous"
|
||||
echo >&2
|
||||
|
||||
exec ${take-snapshots plan}
|
||||
'';
|
||||
in out;
|
||||
snapshot() {(
|
||||
: $ns $format $retain
|
||||
name=$(date --date="@$start_date" +"$format")
|
||||
if ! test -e "$dst/$ns/$name"; then
|
||||
echo >&2 "create snapshot: $ns/$name"
|
||||
mkdir -m 0700 -p "$dst/$ns"
|
||||
rsync >&2 \
|
||||
-aAXF --delete \
|
||||
--link-dest="$dst/current" \
|
||||
"$dst/current/" \
|
||||
"$dst/$ns/.partial.$name"
|
||||
mv "$dst/$ns/.partial.$name" "$dst/$ns/$name"
|
||||
echo >&2
|
||||
fi
|
||||
case $retain in
|
||||
([0-9]*)
|
||||
delete_from=$(($retain + 1))
|
||||
ls -r "$dst/$ns" \
|
||||
| sed -n "$delete_from,\$p" \
|
||||
| while read old_name; do
|
||||
echo >&2 "delete snapshot: $ns/$old_name"
|
||||
rm -fR "$dst/$ns/$old_name"
|
||||
done
|
||||
;;
|
||||
(ALL)
|
||||
:
|
||||
;;
|
||||
esac
|
||||
)}
|
||||
|
||||
take-snapshots = plan: writeDash "backup.${plan.name}.take-snapshots" ''
|
||||
set -efu
|
||||
NOW=''${NOW-$(date +%s)}
|
||||
dst=${shell.escape plan.dst.path}
|
||||
|
||||
snapshot() {(
|
||||
: $ns $format $retain
|
||||
name=$(date --date="@$NOW" +"$format")
|
||||
if ! test -e "$dst/$ns/$name"; then
|
||||
echo >&2 "create snapshot: $ns/$name"
|
||||
mkdir -m 0700 -p "$dst/$ns"
|
||||
rsync >&2 \
|
||||
-aAXF --delete \
|
||||
--link-dest="$dst/current" \
|
||||
"$dst/current/" \
|
||||
"$dst/$ns/.partial.$name"
|
||||
mv "$dst/$ns/.partial.$name" "$dst/$ns/$name"
|
||||
echo >&2
|
||||
fi
|
||||
case $retain in
|
||||
([0-9]*)
|
||||
delete_from=$(($retain + 1))
|
||||
ls -r "$dst/$ns" \
|
||||
| sed -n "$delete_from,\$p" \
|
||||
| while read old_name; do
|
||||
echo >&2 "delete snapshot: $ns/$old_name"
|
||||
rm -fR "$dst/$ns/$old_name"
|
||||
done
|
||||
;;
|
||||
(ALL)
|
||||
:
|
||||
;;
|
||||
esac
|
||||
)}
|
||||
|
||||
${concatStringsSep "\n" (mapAttrsToList (ns: { format, retain ? null, ... }:
|
||||
toString (map shell.escape [
|
||||
"ns=${ns}"
|
||||
"format=${format}"
|
||||
"retain=${if retain == null then "ALL" else toString retain}"
|
||||
"snapshot"
|
||||
]))
|
||||
plan.snapshots)}
|
||||
${concatStringsSep "\n" (mapAttrsToList (ns: { format, retain, ... }:
|
||||
toString (map shell.escape [
|
||||
"ns=${ns}"
|
||||
"format=${format}"
|
||||
"retain=${if retain == null then "ALL" else toString retain}"
|
||||
"snapshot"
|
||||
]))
|
||||
plan.snapshots)}
|
||||
''}
|
||||
'';
|
||||
|
||||
# TODO getFQDN: admit hosts in other domains
|
||||
getFQDN = host: "${host.name}.${config.krebs.search-domain}";
|
||||
|
||||
writeDash = name: text: pkgs.writeScript name ''
|
||||
#! ${pkgs.dash}/bin/dash
|
||||
${text}
|
||||
# XXX Is one ping enough to determine fastest address?
|
||||
fastest-address = host: ''
|
||||
{ ${pkgs.fping}/bin/fping </dev/null -a \
|
||||
${concatMapStringsSep " " shell.escape
|
||||
(mapAttrsToList (_: net: head net.aliases) host.nets)} \
|
||||
| ${pkgs.coreutils}/bin/head -1; }
|
||||
'';
|
||||
|
||||
writeDashBin = name: text: pkgs.writeTextFile {
|
||||
executable = true;
|
||||
destination = "/bin/${name}";
|
||||
name = name;
|
||||
text = ''
|
||||
#! ${pkgs.dash}/bin/dash
|
||||
${text}
|
||||
'';
|
||||
};
|
||||
# Note that we don't escape word on purpose, so we can deref shell vars.
|
||||
# TODO type word
|
||||
network-ssh-port = host: word: ''
|
||||
case ${word} in
|
||||
${concatStringsSep ";;\n" (mapAttrsToList
|
||||
(_: net: "(${head net.aliases}) echo ${toString net.ssh.port}")
|
||||
host.nets)};;
|
||||
esac
|
||||
'';
|
||||
|
||||
in out
|
||||
# TODO ionice
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
gunicorn = pkgs.pythonPackages.gunicorn;
|
||||
bepasty = pkgs.pythonPackages.bepasty-server;
|
||||
|
|
@ -10,8 +10,8 @@ let
|
|||
|
||||
out = {
|
||||
options.krebs.bepasty = api;
|
||||
config = mkIf cfg.enable (mkMerge [
|
||||
(mkIf cfg.serveNginx nginx-imp)
|
||||
config = lib.mkIf cfg.enable (lib.mkMerge [
|
||||
(lib.mkIf cfg.serveNginx nginx-imp)
|
||||
imp
|
||||
]);
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,10 +1,8 @@
|
|||
{ config, lib, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
let
|
||||
target = config.krebs.build // { user.name = "root"; };
|
||||
|
||||
out = {
|
||||
# TODO deprecate krebs.build.host
|
||||
options.krebs.build.host = mkOption {
|
||||
|
|
@ -17,12 +15,6 @@ let
|
|||
default = "/nix/var/nix/profiles/system";
|
||||
};
|
||||
|
||||
# TODO make krebs.build.target.host :: host
|
||||
options.krebs.build.target = mkOption {
|
||||
type = with types; nullOr str;
|
||||
default = null;
|
||||
};
|
||||
|
||||
# TODO deprecate krebs.build.user
|
||||
options.krebs.build.user = mkOption {
|
||||
type = types.user;
|
||||
|
|
@ -59,6 +51,7 @@ let
|
|||
source = config.krebs.build.source;
|
||||
target-user = maybeEnv "target_user" "root";
|
||||
target-host = maybeEnv "target_host" config.krebs.build.host.name;
|
||||
target-port = maybeEnv "target_port" "22";
|
||||
target-path = maybeEnv "target_path" "/var/src";
|
||||
out = ''
|
||||
#! /bin/sh
|
||||
|
|
@ -70,7 +63,8 @@ let
|
|||
}
|
||||
|
||||
echo ${shell.escape git-script} \
|
||||
| ssh ${shell.escape "${target-user}@${target-host}"} -T
|
||||
| ssh -p ${shell.escape target-port} \
|
||||
${shell.escape "${target-user}@${target-host}"} -T
|
||||
|
||||
unset tmpdir
|
||||
trap '
|
||||
|
|
@ -101,6 +95,7 @@ let
|
|||
(attrNames file-specs)} \
|
||||
--delete \
|
||||
-vFrlptD \
|
||||
-e ${shell.escape "ssh -p ${target-port}"} \
|
||||
${shell.escape target-path}/ \
|
||||
${shell.escape "${target-user}@${target-host}:${target-path}"}
|
||||
'';
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
buildbot = pkgs.buildbot;
|
||||
buildbot-master-config = pkgs.writeText "buildbot-master.cfg" ''
|
||||
|
|
@ -381,5 +381,5 @@ let
|
|||
in
|
||||
{
|
||||
options.krebs.buildbot.master = api;
|
||||
config = mkIf cfg.enable imp;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
buildbot-slave-init = pkgs.writeText "buildbot-slave.tac" ''
|
||||
import os
|
||||
|
|
@ -182,5 +182,5 @@ let
|
|||
in
|
||||
{
|
||||
options.krebs.buildbot.slave = api;
|
||||
config = mkIf cfg.enable imp;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,13 +1,13 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
let
|
||||
cfg = config.krebs.current;
|
||||
|
||||
out = {
|
||||
options.krebs.current = api;
|
||||
config = mkIf cfg.enable imp;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
};
|
||||
|
||||
api = {
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
cfg = config.krebs;
|
||||
|
||||
|
|
@ -9,9 +9,9 @@ let
|
|||
./apt-cacher-ng.nix
|
||||
./backup.nix
|
||||
./bepasty-server.nix
|
||||
./build.nix
|
||||
./buildbot/master.nix
|
||||
./buildbot/slave.nix
|
||||
./build.nix
|
||||
./current.nix
|
||||
./exim-retiolum.nix
|
||||
./exim-smarthost.nix
|
||||
|
|
@ -20,17 +20,20 @@ let
|
|||
./git.nix
|
||||
./go.nix
|
||||
./iptables.nix
|
||||
./lib.nix
|
||||
./nginx.nix
|
||||
./nixpkgs.nix
|
||||
./per-user.nix
|
||||
./Reaktor.nix
|
||||
./retiolum-bootstrap.nix
|
||||
./realwallpaper.nix
|
||||
./retiolum-bootstrap.nix
|
||||
./retiolum.nix
|
||||
./setuid.nix
|
||||
./tinc_graphs.nix
|
||||
./urlwatch.nix
|
||||
];
|
||||
options.krebs = api;
|
||||
config = mkIf cfg.enable imp;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
};
|
||||
|
||||
api = {
|
||||
|
|
@ -81,13 +84,13 @@ let
|
|||
};
|
||||
};
|
||||
|
||||
imp = mkMerge [
|
||||
{ krebs = import ./lass { inherit lib; }; }
|
||||
{ krebs = import ./makefu { inherit lib; }; }
|
||||
{ krebs = import ./miefda { inherit lib; }; }
|
||||
{ krebs = import ./mv { inherit lib; }; }
|
||||
{ krebs = import ./shared { inherit lib; }; }
|
||||
{ krebs = import ./tv { inherit lib; }; }
|
||||
imp = lib.mkMerge [
|
||||
{ krebs = import ./lass { inherit config lib; }; }
|
||||
{ krebs = import ./makefu { inherit config lib; }; }
|
||||
{ krebs = import ./miefda { inherit config lib; }; }
|
||||
{ krebs = import ./mv { inherit config lib; }; }
|
||||
{ krebs = import ./shared { inherit config lib; }; }
|
||||
{ krebs = import ./tv { inherit config lib; }; }
|
||||
{
|
||||
krebs.dns.providers = {
|
||||
de.krebsco = "zones";
|
||||
|
|
@ -156,7 +159,16 @@ let
|
|||
let inherit (config.krebs.build.host.ssh) privkey; in
|
||||
mkIf (privkey != null) (mkForce [privkey]);
|
||||
|
||||
# TODO use imports for merging
|
||||
services.openssh.knownHosts =
|
||||
(let inherit (config.krebs.build.host.ssh) pubkey; in
|
||||
optionalAttrs (pubkey != null) {
|
||||
localhost = {
|
||||
hostNames = ["localhost" "127.0.0.1" "::1"];
|
||||
publicKey = pubkey;
|
||||
};
|
||||
})
|
||||
//
|
||||
# GitHub's IPv4 address range is 192.30.252.0/22
|
||||
# Refs https://help.github.com/articles/what-ip-addresses-does-github-use-that-i-should-whitelist/
|
||||
# 192.30.252.0/22 = 192.30.252.0-192.30.255.255 (1024 addresses)
|
||||
|
|
@ -180,7 +192,6 @@ let
|
|||
(mapAttrsToList
|
||||
(net-name: net:
|
||||
let
|
||||
aliases = shorts ++ longs;
|
||||
longs = net.aliases;
|
||||
shorts =
|
||||
map (removeSuffix ".${cfg.search-domain}")
|
||||
|
|
@ -191,7 +202,7 @@ let
|
|||
then "[${a}]:${toString net.ssh.port}"
|
||||
else a;
|
||||
in
|
||||
aliases ++ map add-port net.addrs)
|
||||
map add-port (shorts ++ longs ++ net.addrs))
|
||||
host.nets);
|
||||
|
||||
publicKey = host.ssh.pubkey;
|
||||
|
|
|
|||
|
|
@ -1,12 +1,12 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
cfg = config.krebs.exim-retiolum;
|
||||
|
||||
out = {
|
||||
options.krebs.exim-retiolum = api;
|
||||
config = mkIf cfg.enable imp;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
};
|
||||
|
||||
api = {
|
||||
|
|
|
|||
|
|
@ -1,13 +1,12 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
|
||||
with builtins;
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
cfg = config.krebs.exim-smarthost;
|
||||
|
||||
out = {
|
||||
options.krebs.exim-smarthost = api;
|
||||
config = mkIf cfg.enable imp;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
};
|
||||
|
||||
api = {
|
||||
|
|
|
|||
|
|
@ -1,21 +1,17 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
let
|
||||
cfg = config.krebs.fetchWallpaper;
|
||||
|
||||
out = {
|
||||
options.krebs.fetchWallpaper = api;
|
||||
config = mkIf cfg.enable imp;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
};
|
||||
|
||||
api = {
|
||||
enable = mkEnableOption "fetch wallpaper";
|
||||
predicate = mkOption {
|
||||
type = with types; nullOr path;
|
||||
default = null;
|
||||
};
|
||||
url = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
|
|
@ -33,16 +29,20 @@ let
|
|||
type = types.str;
|
||||
default = ":11";
|
||||
};
|
||||
unitConfig = mkOption {
|
||||
type = types.attrsOf types.str;
|
||||
description = "Extra unit configuration for fetchWallpaper to define conditions and assertions for the unit";
|
||||
example = literalExample ''
|
||||
# do not start when running on umts
|
||||
{ ConditionPathExists = "!/var/run/ppp0.pid"; }
|
||||
'';
|
||||
default = {};
|
||||
};
|
||||
};
|
||||
|
||||
fetchWallpaperScript = pkgs.writeScript "fetchWallpaper" ''
|
||||
#! ${pkgs.bash}/bin/bash
|
||||
${optionalString (cfg.predicate != null) ''
|
||||
if ! ${cfg.predicate}; then
|
||||
echo "predicate failed - will not fetch from remote"
|
||||
exit 0
|
||||
fi
|
||||
''}
|
||||
|
||||
mkdir -p ${shell.escape cfg.stateDir}
|
||||
curl -s -o ${shell.escape cfg.stateDir}/wallpaper -z ${shell.escape cfg.stateDir}/wallpaper ${shell.escape cfg.url}
|
||||
feh --no-fehbg --bg-scale ${shell.escape cfg.stateDir}/wallpaper
|
||||
|
|
@ -76,7 +76,6 @@ let
|
|||
URL = cfg.url;
|
||||
DISPLAY = cfg.display;
|
||||
};
|
||||
|
||||
restartIfChanged = true;
|
||||
|
||||
serviceConfig = {
|
||||
|
|
@ -84,6 +83,8 @@ let
|
|||
ExecStart = fetchWallpaperScript;
|
||||
User = "fetchWallpaper";
|
||||
};
|
||||
|
||||
unitConfig = cfg.unitConfig;
|
||||
};
|
||||
};
|
||||
in out
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
# TODO unify logging of shell scripts to user and journal
|
||||
# TODO move all scripts to ${etcDir}, so ControlMaster connections
|
||||
|
|
@ -6,13 +6,13 @@
|
|||
# TODO when authorized_keys changes, then restart ssh
|
||||
# (or kill already connected users somehow)
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
cfg = config.krebs.git;
|
||||
|
||||
out = {
|
||||
options.krebs.git = api;
|
||||
config = mkIf cfg.enable (mkMerge [
|
||||
config = with lib; mkIf cfg.enable (mkMerge [
|
||||
(mkIf cfg.cgit cgit-imp)
|
||||
git-imp
|
||||
]);
|
||||
|
|
@ -86,7 +86,7 @@ let
|
|||
singleton {
|
||||
user = [ config.krebs.users.tv ];
|
||||
repo = [ testing ]; # see literal example of repos
|
||||
perm = push "refs/*" (with lib.git; [
|
||||
perm = push "refs/*" (with config.krebs.lib.git; [
|
||||
non-fast-forward create delete merge
|
||||
]);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,12 +1,12 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
cfg = config.krebs.github-hosts-sync;
|
||||
|
||||
out = {
|
||||
options.krebs.github-hosts-sync = api;
|
||||
config = mkIf cfg.enable imp;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
};
|
||||
|
||||
api = {
|
||||
|
|
|
|||
|
|
@ -1,13 +1,13 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
let
|
||||
cfg = config.krebs.go;
|
||||
|
||||
out = {
|
||||
options.krebs.go = api;
|
||||
config = mkIf cfg.enable imp;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
};
|
||||
|
||||
api = {
|
||||
|
|
|
|||
|
|
@ -1,12 +1,11 @@
|
|||
{ lib, ... }:
|
||||
{ config, lib, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
{
|
||||
hosts = addNames {
|
||||
hosts = {
|
||||
dishfire = {
|
||||
cores = 4;
|
||||
dc = "lass"; #dc = "cac";
|
||||
nets = rec {
|
||||
internet = {
|
||||
addrs4 = ["144.76.172.188"];
|
||||
|
|
@ -38,7 +37,6 @@ with lib;
|
|||
};
|
||||
echelon = {
|
||||
cores = 2;
|
||||
dc = "lass"; #dc = "cac";
|
||||
nets = rec {
|
||||
internet = {
|
||||
addrs4 = ["162.252.241.33"];
|
||||
|
|
@ -72,7 +70,6 @@ with lib;
|
|||
};
|
||||
prism = {
|
||||
cores = 4;
|
||||
dc = "lass"; #dc = "cac";
|
||||
nets = rec {
|
||||
internet = {
|
||||
addrs4 = ["213.239.205.240"];
|
||||
|
|
@ -104,7 +101,6 @@ with lib;
|
|||
ssh.pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQChm4sqQ2bUZj+2YnTf6G5HHRTpSe1jTUhJRnwcYPYZKF+CBqBncipRpuGlGXEsptNa+7ZMcQC0ySsz5SUOMt3Ih+NehVe/qt3VtRz0l0MgOWmH2qBwKK9Y4IuxrJQzUmP4UGlOGlFj9DORssSMOyFIG4eZ9k2qMn3xal0NVRfGTShKlouWsiUILZ8I+sDNE00z8DAYesgc1yazvRnjzvLkRxdNdpYiAFBbmXMpPKK95McRJaWsuNSeal9kd5p5PagWcgN4DZ6+ebzz3NKnmzk4j+vuHX0U9lTXBqKMlzzmM2YNLRtDPfrtJNyHqLpZUpFhJKqZCD+4/0zdrzRfC7Th+5czzUCSvHiKPVsqw5eOdiQX6EyzNAF5zpkpRp//QdUNNXC5/Ku6GKCO491+TuA8VCha0fOwBONccTLUI/hGNmCh88mLbukVoeGJrbYNCOA/6kEz7ZLEveU4i+TT7okhDElMsNk+AWCZ8/NdJQNX3/K6+JJ9qAn+/yC8LdjgYYJ2oU/aw5/HyOgiQ0z4n9UfQ7j+nHysY9CQb1b3guX7yjJoc3KpNXCXEztuIRHjFD1EP8NRTSmGjsa/VjLmTLSsqjD+7IE5mT0tO5RJvmagDgdJSr/iR5D9zjW7hx7ttvektrlp9g0v3CiCFVaW4l95hGYT0HaNBLJ5R0YHm0lD+Q==";
|
||||
};
|
||||
fastpoke = {
|
||||
dc = "lass";
|
||||
nets = rec {
|
||||
internet = {
|
||||
addrs4 = ["193.22.164.36"];
|
||||
|
|
@ -135,7 +131,6 @@ with lib;
|
|||
};
|
||||
cloudkrebs = {
|
||||
cores = 1;
|
||||
dc = "lass"; #dc = "cac";
|
||||
nets = rec {
|
||||
internet = {
|
||||
addrs4 = ["104.167.113.104"];
|
||||
|
|
@ -168,7 +163,6 @@ with lib;
|
|||
};
|
||||
uriel = {
|
||||
cores = 1;
|
||||
dc = "lass";
|
||||
nets = {
|
||||
gg23 = {
|
||||
addrs4 = ["10.23.1.12"];
|
||||
|
|
@ -199,7 +193,6 @@ with lib;
|
|||
};
|
||||
mors = {
|
||||
cores = 2;
|
||||
dc = "lass";
|
||||
nets = {
|
||||
gg23 = {
|
||||
addrs4 = ["10.23.1.11"];
|
||||
|
|
@ -230,7 +223,6 @@ with lib;
|
|||
};
|
||||
helios = {
|
||||
cores = 2;
|
||||
dc = "lass";
|
||||
nets = {
|
||||
retiolum = {
|
||||
addrs4 = ["10.243.0.3"];
|
||||
|
|
@ -257,16 +249,16 @@ with lib;
|
|||
};
|
||||
|
||||
};
|
||||
users = addNames {
|
||||
users = {
|
||||
lass = {
|
||||
pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAp83zynhIueJJsWlSEykVSBrrgBFKq38+vT8bRfa+csqyjZBl2SQFuCPo+Qbh49mwchpZRshBa9jQEIGqmXxv/PYdfBFQuOFgyUq9ZcTZUXqeynicg/SyOYFW86iiqYralIAkuGPfQ4howLPVyjTZtWeEeeEttom6p6LMY5Aumjz2em0FG0n9rRFY2fBzrdYAgk9C0N6ojCs/Gzknk9SGntA96MDqHJ1HXWFMfmwOLCnxtE5TY30MqSmkrJb7Fsejwjoqoe9Y/mCaR0LpG2cStC1+37GbHJNH0caCMaQCX8qdfgMVbWTVeFWtV6aWOaRgwLrPDYn4cHWQJqTfhtPrNQ== lass@mors";
|
||||
mail = "lass@mors.retiolum";
|
||||
};
|
||||
lass_uriel = {
|
||||
lass-uriel = {
|
||||
pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDExWuRcltGM2FqXO695nm6/QY3wU3r1bDTyCpMrLfUSym7TxcXDSmZSWcueexPXV6GENuUfjJPZswOdWqIo5u2AXw9t0aGvwEDmI6uJ7K5nzQOsXIneGMdYuoOaAzWI8pxZ4N+lIP1HsOYttIPDp8RwU6kyG+Ud8mnVHWSTO13C7xC9vePnDP6b+44nHS691Zj3X/Cq35Ls0ISC3EM17jreucdP62L3TKk2R4NCm3Sjqj+OYEv0LAqIpgqSw5FypTYQgNByxRcIcNDlri63Q1yVftUP1338UiUfxtraUu6cqa2CdsHQmtX5mTNWEluVWO3uUKTz9zla3rShC+d3qvr lass@uriel";
|
||||
mail = "lass@uriel.retiolum";
|
||||
};
|
||||
lass_helios = {
|
||||
lass-helios = {
|
||||
pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDBOnMtgy5GH6R6tHp2ugy5QTe3gAGxh2CKsstSNSNAJwvWGiaWJkbNmgM8KlCWeq1GJBGa95kU4I2BDO5fJd7J9vqyrTGF1+sx0Nwj/ELKSNVxDoKVYiU09pTqSB3pi46i+E8N49y4/8aRhu4/7O2dSTH7OS3YoZpt2Soas+cYJYhQdZtYQAgPX5LOkTfQvPhGR8AzrrTvOUrHyTWaSBEELVZ088LrFT6ibXHcPhwXX7A5+YMS8LLr3KRstySWzJEmfVOJxuMhQJSH1Xiq4bLilVn9V4AK5pCOnlALSYf48SexsCqzBUKgISuncurIBbXtW9EkNTMX3jSKlSQ7WniGRlmzrBAJCh4VXJUZgXDf8hAaPckIRbLosbTnEAauWcfnIXLfvI+bYkURhfYKsWelM+MS6ihk+P2yr8rNT9w5iUVJGVypOXUp45PrFuPn6ayCpNRJzqPwCCPE7fFagzLs7wibIXlrhCnRALT5HHyExFFcQoGvIq/8o+Oia8mrTimb55IDLwkiYrG6I5DPXFPKsTC0hium9T3I8dC+M7n9GbwnLTUK2kWnoklD3HTab21xJTtbF98nQ94df7doqPFxL/jongeZCGMB+PJ+BdQTtHr7tCY0kN2GXpoHxz/2w8YEWTKHhWIUsD+Utf8pDkKQfCqlm7iR7byxL51gHL9Z3Q== lass@helios";
|
||||
mail = "lass@helios.retiolum";
|
||||
};
|
||||
|
|
|
|||
15
krebs/3modules/lib.nix
Normal file
15
krebs/3modules/lib.nix
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
with lib;
|
||||
let
|
||||
out = {
|
||||
options.krebs.lib = api;
|
||||
config = imp;
|
||||
};
|
||||
api = mkOption {
|
||||
default = {};
|
||||
type = types.attrs;
|
||||
};
|
||||
imp = {
|
||||
krebs.lib = lib // import ../4lib { inherit lib; } // builtins;
|
||||
};
|
||||
in out
|
||||
|
|
@ -1,12 +1,11 @@
|
|||
{ lib, ... }:
|
||||
{ config, lib, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
{
|
||||
hosts = addNames {
|
||||
hosts = {
|
||||
pnp = {
|
||||
cores = 1;
|
||||
dc = "makefu"; #vm on 'omo'
|
||||
nets = {
|
||||
retiolum = {
|
||||
addrs4 = ["10.243.0.210"];
|
||||
|
|
@ -30,7 +29,6 @@ with lib;
|
|||
};
|
||||
tsp = {
|
||||
cores = 1;
|
||||
dc = "makefu"; #x200
|
||||
nets = {
|
||||
retiolum = {
|
||||
addrs4 = ["10.243.0.212"];
|
||||
|
|
@ -58,7 +56,6 @@ with lib;
|
|||
};
|
||||
pornocauster = {
|
||||
cores = 2;
|
||||
dc = "makefu"; #x220
|
||||
nets = {
|
||||
retiolum = {
|
||||
addrs4 = ["10.243.0.91"];
|
||||
|
|
@ -90,7 +87,6 @@ with lib;
|
|||
|
||||
vbob = {
|
||||
cores = 2;
|
||||
dc = "makefu"; #vm local
|
||||
nets = {
|
||||
retiolum = {
|
||||
addrs4 = ["10.243.1.91"];
|
||||
|
|
@ -116,7 +112,6 @@ with lib;
|
|||
};
|
||||
flap = rec {
|
||||
cores = 1;
|
||||
dc = "cac"; #vps
|
||||
|
||||
extraZones = {
|
||||
"krebsco.de" = ''
|
||||
|
|
@ -152,7 +147,6 @@ with lib;
|
|||
};
|
||||
pigstarter = rec {
|
||||
cores = 1;
|
||||
dc = "frontrange"; #vps
|
||||
|
||||
extraZones = {
|
||||
"krebsco.de" = ''
|
||||
|
|
@ -191,7 +185,6 @@ with lib;
|
|||
};
|
||||
wry = rec {
|
||||
cores = 1;
|
||||
dc = "makefu"; #dc = "cac";
|
||||
extraZones = {
|
||||
"krebsco.de" = ''
|
||||
euer IN A ${head nets.internet.addrs4}
|
||||
|
|
@ -248,7 +241,6 @@ with lib;
|
|||
};
|
||||
filepimp = rec {
|
||||
cores = 1;
|
||||
dc = "makefu"; #nas
|
||||
|
||||
nets = {
|
||||
retiolum = {
|
||||
|
|
@ -273,7 +265,6 @@ with lib;
|
|||
|
||||
omo = rec {
|
||||
cores = 2;
|
||||
dc = "makefu"; #AMD E350
|
||||
|
||||
nets = {
|
||||
retiolum = {
|
||||
|
|
@ -299,11 +290,10 @@ with lib;
|
|||
};
|
||||
wbob = rec {
|
||||
cores = 1;
|
||||
dc = "none";
|
||||
nets = {
|
||||
retiolm = {
|
||||
addrs4 = ["10.243.214.15/32"];
|
||||
addrs6 = ["42:5a02:2c30:c1b1:3f2e:7c19:2496:a732/128"];
|
||||
addrs4 = ["10.243.214.15"];
|
||||
addrs6 = ["42:5a02:2c30:c1b1:3f2e:7c19:2496:a732"];
|
||||
aliases = [
|
||||
"wbob.retiolum"
|
||||
];
|
||||
|
|
@ -323,7 +313,6 @@ TNs2RYfwDy/r6H/hDeB/BSngPouedEVcPwIDAQAB
|
|||
|
||||
gum = rec {
|
||||
cores = 1;
|
||||
dc = "online.net"; #root-server
|
||||
|
||||
extraZones = {
|
||||
"krebsco.de" = ''
|
||||
|
|
@ -364,7 +353,7 @@ TNs2RYfwDy/r6H/hDeB/BSngPouedEVcPwIDAQAB
|
|||
ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcxWFEPzke/Sdd9qNX6rSJgXal8NmINYajpFCxXfYdj root@gum";
|
||||
};
|
||||
};
|
||||
users = addNames rec {
|
||||
users = rec {
|
||||
makefu = {
|
||||
mail = "makefu@pornocauster.retiolum";
|
||||
pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCl3RTOHd5DLiVeUbUr/GSiKoRWknXQnbkIf+uNiFO+XxiqZVojPlumQUVhasY8UzDzj9tSDruUKXpjut50FhIO5UFAgsBeMJyoZbgY/+R+QKU00Q19+IiUtxeFol/9dCO+F4o937MC0OpAC10LbOXN/9SYIXueYk3pJxIycXwUqhYmyEqtDdVh9Rx32LBVqlBoXRHpNGPLiswV2qNe0b5p919IGcslzf1XoUzfE3a3yjk/XbWh/59xnl4V7Oe7+iQheFxOT6rFA30WYwEygs5As//ZYtxvnn0gA02gOnXJsNjOW9irlxOUeP7IOU6Ye3WRKFRR0+7PS+w8IJLag2xb makefu@pornocauster";
|
||||
|
|
|
|||
|
|
@ -1,12 +1,11 @@
|
|||
{ lib, ... }:
|
||||
{ config, lib, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
{
|
||||
hosts = addNames {
|
||||
hosts = {
|
||||
bobby = {
|
||||
cores = 4;
|
||||
dc = "miefda";
|
||||
nets = {
|
||||
retiolum = {
|
||||
addrs4 = ["10.243.111.112"];
|
||||
|
|
@ -31,7 +30,7 @@ with lib;
|
|||
#ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+7Qa51l0NSkBiaK2s8vQEoeObV3UPZyEzMxfUK/ZAO root@stro";
|
||||
};
|
||||
};
|
||||
users = addNames {
|
||||
users = {
|
||||
miefda = {
|
||||
mail = "miefda@miefda.de";
|
||||
pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCVdNCks6mrItKHYIwgW3s+NINFhHqZtLPj3l6TJUWd93ZSuuI6P+Z/0m0G9Z4tWWaXWsOCnzMA2WOKcitBbLcaQxVypJfvmfoA5CVlh4/nf8NfvbMFkVIYPehxR7YoejfKOxPOCNC3248RiD8kqa4/5IF8qdqE+mRQUIZJXvN0jZZ+rGnYo5Z544O9JqsV+VjjOgK0Fchpxf/lC8dnBucIce7gUwi5npwsGQZgSDmRobBRFVDZag1abLFNZN2faI8uqzSlU6KRRapYV266Of7j3kmDokMan4szjP1EexmTWm+arwRiz9p0M5oKs6zofez0mOyF5ux02NB3XIhbJc8CfMjeA7PmSg4ZhghjlSjIOR+1mMIDiDVi6PNLw5atzvpyfYtpf5sWpdIpXCS0lyzIgasqW4gbAiWoFPv5A0mw0QI6UqlxQ8Pdm6R7P6yQxyknrxnvFGMQPiqgl21ssSNA9A+YRd4j0nATntzOeD1bxTZkyU4FtW++0hg3Ph6HiHLfPd9w70wPr7b0RITVnBcN2ZqIO+5NIqQYU801FCNXsTuBh0ueTsVTGJYySUGkmkHyH5spLYdr1Z5w+4W+HgbxPk40pyZJ18S0umL49igxR9NsniucFy1/jqqi0TiDIsHx6vsawFT1F2rq9ZtGaRcJL6Yfz0p+uZC5rc/nI+mMlQ== miefda@nixos";
|
||||
|
|
|
|||
|
|
@ -1,12 +1,11 @@
|
|||
{ lib, ... }:
|
||||
{ config, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
{
|
||||
hosts = addNames {
|
||||
hosts = {
|
||||
stro = {
|
||||
cores = 4;
|
||||
dc = "mv";
|
||||
nets = {
|
||||
retiolum = {
|
||||
addrs4 = ["10.243.111.111"];
|
||||
|
|
@ -31,8 +30,8 @@ with lib;
|
|||
ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+7Qa51l0NSkBiaK2s8vQEoeObV3UPZyEzMxfUK/ZAO root@stro";
|
||||
};
|
||||
};
|
||||
users = addNames {
|
||||
mv_stro = {
|
||||
users = {
|
||||
mv-stro = {
|
||||
mail = "mv@stro.retiolum";
|
||||
pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCxM34g1GUm5EtU00DAOlGSx8MsCWunhGTrozurj460QT7EdUbZvj0AcrQC0lP9kaZyhX+KueTjmLC+ICsnlHYeg4zoSEnSAUkccuyZxfgynVc4wrpfNAc1nHjDhDb/ulnC+8wNxvxUpI0XlBgu/Y7AbbChZj3ofv6uGGHJKfG3uSyCkt9VTCi1KwydHpe9P252N8NbopnbnkT0EMkRHruh7ICEKr4/ivmUL/IUrbFicEeCy4SeRAl8+00x4WqqvbBPzgdXn0AIjKLvus3dBoQubJNpUoXnyXJbElnit5a7QcgZJNLMbV0kf9zzCGduxkADzHkAFB9D4PuSMYt62iy12QlGbm80A9ncuwaSyJf7hPTvNbU8VyCblyfRz/SCaudUrfk5Xbxxu26FHi4hZqr3IUQt4T8pD8JWYGl4n2ZKnD8hHz/jrmNBK8h9d+VFafU9t1hRxlFsW1AhMEM+kfWClyhfTcKBKbml2a657lgUEVmlZt+18kwwsivM1QhHNTgxn5urRXRkh1VQ40UQroVuV1OUmvAngyAthF441VPGc5z7kEI+D4qjmUjSy6k4dvEy/RGfsAgJCf63zilRuUbL68f2OpxE8aeZZUXPvgdLml284pry7+C5sjlnCDoJfCj/yhdVx6mU9pWUd/Q97CLQewbsYhMzsqlBlIkXuipkDQ== mv@stro";
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,13 +1,12 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with builtins;
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
cfg = config.krebs.nginx;
|
||||
|
||||
out = {
|
||||
options.krebs.nginx = api;
|
||||
config = mkIf cfg.enable imp;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
};
|
||||
|
||||
api = {
|
||||
|
|
@ -34,6 +33,7 @@ let
|
|||
};
|
||||
locations = mkOption {
|
||||
type = with types; listOf (attrsOf str);
|
||||
default = [];
|
||||
};
|
||||
extraConfig = mkOption {
|
||||
type = with types; string;
|
||||
|
|
@ -76,8 +76,8 @@ let
|
|||
server {
|
||||
${concatMapStringsSep "\n" (x: "listen ${x};") listen}
|
||||
server_name ${toString server-names};
|
||||
${extraConfig}
|
||||
${indent (concatStrings (map to-location locations))}
|
||||
${indent extraConfig}
|
||||
${indent (concatMapStrings to-location locations)}
|
||||
}
|
||||
'';
|
||||
|
||||
|
|
|
|||
43
krebs/3modules/nixpkgs.nix
Normal file
43
krebs/3modules/nixpkgs.nix
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
with config.krebs.lib;
|
||||
let
|
||||
cfg = config.krebs.nixpkgs;
|
||||
|
||||
out = {
|
||||
options.krebs.nixpkgs = api;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
};
|
||||
|
||||
api = {
|
||||
enable = mkEnableOption "krebs.nixpkgs" // { default = true; };
|
||||
|
||||
allowUnfreePredicate = mkOption {
|
||||
description = ''
|
||||
This option is similar to `nixpkgs.config.allowUnfreePredicate'
|
||||
but can be defined in several modules. An unfree package will be
|
||||
allowed if any of the defined predicates returns true.
|
||||
'';
|
||||
type = types.nullOr (mkOptionType {
|
||||
name = "Predicate";
|
||||
check = isFunction;
|
||||
merge = _locs: defs: pkg: let
|
||||
evalPredicateDef = def: let
|
||||
allow = def.value pkg;
|
||||
in if cfg.verbose && allow
|
||||
then trace "unfree ‘${pkg.name}’ allowed in ${def.file}" allow
|
||||
else allow;
|
||||
in any evalPredicateDef defs;
|
||||
});
|
||||
default = null;
|
||||
};
|
||||
|
||||
verbose = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
};
|
||||
};
|
||||
|
||||
imp = lib.mkIf (cfg.allowUnfreePredicate != null) {
|
||||
nixpkgs.config.allowUnfreePredicate = cfg.allowUnfreePredicate;
|
||||
};
|
||||
in out
|
||||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
let
|
||||
cfg = config.krebs.per-user;
|
||||
|
|
|
|||
|
|
@ -1,12 +1,12 @@
|
|||
arg@{ config, lib, pkgs, ... }:
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
cfg = config.krebs.realwallpaper;
|
||||
|
||||
out = {
|
||||
options.krebs.realwallpaper = api;
|
||||
config = mkIf cfg.enable imp;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
};
|
||||
|
||||
api = {
|
||||
|
|
|
|||
|
|
@ -1,12 +1,12 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
cfg = config.krebs.retiolum-bootstrap;
|
||||
|
||||
out = {
|
||||
options.krebs.retiolum-bootstrap = api;
|
||||
config = mkIf cfg.enable imp ;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
};
|
||||
|
||||
api = {
|
||||
|
|
|
|||
|
|
@ -1,11 +1,11 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
cfg = config.krebs.retiolum;
|
||||
|
||||
out = {
|
||||
options.krebs.retiolum = api;
|
||||
config = mkIf cfg.enable imp;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
};
|
||||
|
||||
api = {
|
||||
|
|
@ -58,9 +58,38 @@ let
|
|||
default =
|
||||
filterAttrs (_: h: hasAttr cfg.netname h.nets) config.krebs.hosts;
|
||||
description = ''
|
||||
Hosts which should be part of the tinc configuration.
|
||||
Note that these hosts must have a correspondingly named network
|
||||
configured, see <literal>config.krebs.retiolum.netname</literal>.
|
||||
Hosts to generate <literal>config.krebs.retiolum.hostsPackage</literal>.
|
||||
Note that these hosts must have a network named
|
||||
<literal>config.krebs.retiolum.netname</literal>.
|
||||
'';
|
||||
};
|
||||
|
||||
hostsPackage = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.stdenv.mkDerivation {
|
||||
name = "${cfg.netname}-tinc-hosts";
|
||||
phases = [ "installPhase" ];
|
||||
installPhase = ''
|
||||
mkdir $out
|
||||
${concatStrings (mapAttrsToList (_: host: ''
|
||||
echo ${shell.escape host.nets.${cfg.netname}.tinc.config} \
|
||||
> $out/${shell.escape host.name}
|
||||
'') cfg.hosts)}
|
||||
'';
|
||||
};
|
||||
description = ''
|
||||
Package of tinc host configuration files. By default, a package will
|
||||
be generated from <literal>config.krebs.retiolum.hosts</literal>. This
|
||||
option's main purpose is to expose the generated hosts package to other
|
||||
modules, like <literal>config.krebs.tinc_graphs</literal>. But it can
|
||||
also be used to provide a custom hosts directory.
|
||||
'';
|
||||
example = literalExample ''
|
||||
(pkgs.stdenv.mkDerivation {
|
||||
name = "my-tinc-hosts";
|
||||
src = /home/tv/my-tinc-hosts;
|
||||
installPhase = "cp -R . $out";
|
||||
})
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
@ -130,18 +159,6 @@ let
|
|||
|
||||
tinc = cfg.tincPackage;
|
||||
|
||||
tinc-hosts = pkgs.stdenv.mkDerivation {
|
||||
name = "${cfg.netname}-tinc-hosts";
|
||||
phases = [ "installPhase" ];
|
||||
installPhase = ''
|
||||
mkdir $out
|
||||
${concatStrings (mapAttrsToList (_: host: ''
|
||||
echo ${shell.escape host.nets.${cfg.netname}.tinc.config} \
|
||||
> $out/${shell.escape host.name}
|
||||
'') cfg.hosts)}
|
||||
'';
|
||||
};
|
||||
|
||||
iproute = cfg.iproutePackage;
|
||||
|
||||
confDir = pkgs.runCommand "retiolum" {
|
||||
|
|
@ -153,7 +170,7 @@ let
|
|||
|
||||
mkdir -p $out
|
||||
|
||||
ln -s ${tinc-hosts} $out/hosts
|
||||
ln -s ${cfg.hostsPackage} $out/hosts
|
||||
|
||||
cat > $out/tinc.conf <<EOF
|
||||
Name = ${cfg.name}
|
||||
|
|
|
|||
75
krebs/3modules/setuid.nix
Normal file
75
krebs/3modules/setuid.nix
Normal file
|
|
@ -0,0 +1,75 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
with config.krebs.lib;
|
||||
let
|
||||
cfg = config.krebs.setuid;
|
||||
|
||||
out = {
|
||||
options.krebs.setuid = api;
|
||||
config = imp;
|
||||
};
|
||||
|
||||
api = mkOption {
|
||||
default = {};
|
||||
type = let
|
||||
# TODO make wrapperDir configurable
|
||||
inherit (config.security) wrapperDir;
|
||||
inherit (config.users) groups users;
|
||||
in types.attrsOf (types.submodule ({ config, ... }: {
|
||||
options = {
|
||||
name = mkOption {
|
||||
type = types.filename;
|
||||
default = config._module.args.name;
|
||||
};
|
||||
filename = mkOption {
|
||||
type = mkOptionType {
|
||||
# TODO unyuck string and merge with toC
|
||||
name = "derivation or string";
|
||||
check = x:
|
||||
isDerivation x ||
|
||||
isString x;
|
||||
};
|
||||
apply = toString;
|
||||
};
|
||||
owner = mkOption {
|
||||
default = "root";
|
||||
type = types.enum (attrNames users);
|
||||
};
|
||||
group = mkOption {
|
||||
default = "root";
|
||||
type = types.enum (attrNames groups);
|
||||
};
|
||||
mode = mkOption {
|
||||
default = "4710";
|
||||
type = mkOptionType {
|
||||
# TODO admit symbolic mode
|
||||
name = "octal mode";
|
||||
check = x:
|
||||
isString x &&
|
||||
match "[0-7][0-7][0-7][0-7]" x != null;
|
||||
};
|
||||
};
|
||||
activate = mkOption {
|
||||
type = types.str;
|
||||
visible = false;
|
||||
readOnly = true;
|
||||
};
|
||||
};
|
||||
config.activate = let
|
||||
src = pkgs.execve config.name {
|
||||
inherit (config) filename;
|
||||
};
|
||||
dst = "${wrapperDir}/${config.name}";
|
||||
in ''
|
||||
cp ${src} ${dst}
|
||||
chown ${config.owner}.${config.group} ${dst}
|
||||
chmod ${config.mode} ${dst}
|
||||
'';
|
||||
}));
|
||||
};
|
||||
|
||||
imp = {
|
||||
system.activationScripts."krebs.setuid" = stringAfter [ "setuid" ]
|
||||
(concatMapStringsSep "\n" (getAttr "activate") (attrValues cfg));
|
||||
};
|
||||
|
||||
in out
|
||||
|
|
@ -1,9 +1,8 @@
|
|||
{ lib, ... }:
|
||||
|
||||
with lib;
|
||||
{ config, ... }:
|
||||
|
||||
with config.krebs.lib;
|
||||
let
|
||||
testHosts = lib.genAttrs [
|
||||
testHosts = genAttrs [
|
||||
"test-arch"
|
||||
"test-centos6"
|
||||
"test-centos7"
|
||||
|
|
@ -32,9 +31,8 @@ let
|
|||
};
|
||||
});
|
||||
in {
|
||||
hosts = addNames {
|
||||
hosts = {
|
||||
wolf = {
|
||||
dc = "shack";
|
||||
nets = {
|
||||
shack = {
|
||||
addrs4 = [ "10.42.2.150" ];
|
||||
|
|
@ -68,7 +66,7 @@ in {
|
|||
ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKYMXMWZIK0jjnZDM9INiYAKcwjXs2241vew54K8veCR";
|
||||
};
|
||||
} // testHosts;
|
||||
users = addNames {
|
||||
users = {
|
||||
shared = {
|
||||
mail = "spam@krebsco.de";
|
||||
pubkey = "lol"; # TODO krebs.users.shared.pubkey should be unnecessary
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
cfg = config.krebs.tinc_graphs;
|
||||
internal_dir = "${cfg.workingDir}/internal";
|
||||
|
|
@ -8,7 +8,7 @@ let
|
|||
|
||||
out = {
|
||||
options.krebs.tinc_graphs = api;
|
||||
config = mkIf cfg.enable imp ;
|
||||
config = lib.mkIf cfg.enable imp ;
|
||||
};
|
||||
|
||||
api = {
|
||||
|
|
@ -85,7 +85,7 @@ let
|
|||
EXTERNAL_FOLDER = external_dir;
|
||||
INTERNAL_FOLDER = internal_dir;
|
||||
GEODB = cfg.geodbPath;
|
||||
TINC_HOSTPATH=config.krebs.retiolum.hosts;
|
||||
TINC_HOSTPATH = config.krebs.retiolum.hostsPackage;
|
||||
};
|
||||
|
||||
restartIfChanged = true;
|
||||
|
|
|
|||
|
|
@ -1,15 +1,14 @@
|
|||
{ lib, ... }:
|
||||
{ config, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
{
|
||||
dns.providers = {
|
||||
de.viljetic = "regfish";
|
||||
};
|
||||
hosts = addNames {
|
||||
hosts = {
|
||||
cd = rec {
|
||||
cores = 2;
|
||||
dc = "tv"; #dc = "cac";
|
||||
extraZones = {
|
||||
# TODO generate krebsco.de zone from nets and don't use extraZones at all
|
||||
"krebsco.de" = ''
|
||||
|
|
@ -65,7 +64,6 @@ with lib;
|
|||
};
|
||||
mkdir = rec {
|
||||
cores = 1;
|
||||
dc = "tv"; #dc = "cac";
|
||||
nets = rec {
|
||||
internet = {
|
||||
addrs4 = ["104.167.114.142"];
|
||||
|
|
@ -172,7 +170,7 @@ with lib;
|
|||
mu = {
|
||||
nets = {
|
||||
retiolum = {
|
||||
addrs4 = ["10.243.20.01"];
|
||||
addrs4 = ["10.243.20.1"];
|
||||
addrs6 = ["42:0:0:0:0:0:0:2001"];
|
||||
aliases = [
|
||||
"mu.r"
|
||||
|
|
@ -193,11 +191,11 @@ with lib;
|
|||
};
|
||||
nomic = {
|
||||
cores = 2;
|
||||
dc = "tv"; #dc = "gg23";
|
||||
nets = rec {
|
||||
gg23 = {
|
||||
addrs4 = ["10.23.1.110"];
|
||||
aliases = ["nomic.gg23"];
|
||||
ssh.port = 11423;
|
||||
};
|
||||
retiolum = {
|
||||
addrs4 = ["10.243.0.110"];
|
||||
|
|
@ -234,7 +232,6 @@ with lib;
|
|||
};
|
||||
rmdir = rec {
|
||||
cores = 1;
|
||||
dc = "tv"; #dc = "cac";
|
||||
nets = rec {
|
||||
internet = {
|
||||
addrs4 = ["167.88.34.182"];
|
||||
|
|
@ -286,12 +283,11 @@ with lib;
|
|||
};
|
||||
wu = {
|
||||
cores = 4;
|
||||
# TODO wu is mobile, so dc means "home data center"
|
||||
dc = "tv"; #dc = "gg23";
|
||||
nets = {
|
||||
gg23 = {
|
||||
addrs4 = ["10.23.1.37"];
|
||||
aliases = ["wu.gg23"];
|
||||
ssh.port = 11423;
|
||||
};
|
||||
retiolum = {
|
||||
addrs4 = ["10.243.13.37"];
|
||||
|
|
@ -320,12 +316,11 @@ with lib;
|
|||
};
|
||||
xu = {
|
||||
cores = 4;
|
||||
# TODO xu is mobile, so dc means "home data center"
|
||||
dc = "tv"; #dc = "gg23";
|
||||
nets = {
|
||||
gg23 = {
|
||||
addrs4 = ["10.23.1.38"];
|
||||
aliases = ["xu.gg23"];
|
||||
ssh.port = 11423;
|
||||
};
|
||||
retiolum = {
|
||||
addrs4 = ["10.243.13.38"];
|
||||
|
|
@ -351,7 +346,7 @@ with lib;
|
|||
ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnjfceKuHNQu7S4eYFN1FqgzMqiL7haNZMh2ZLhvuhK root@xu";
|
||||
};
|
||||
};
|
||||
users = addNames rec {
|
||||
users = rec {
|
||||
mv = {
|
||||
mail = "mv@cd.retiolum";
|
||||
pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGer9e2+Lew7vnisgBbsFNECEIkpNJgEaqQqgb9inWkQ mv@vod";
|
||||
|
|
@ -360,11 +355,11 @@ with lib;
|
|||
mail = "tv@wu.retiolum";
|
||||
pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDFR//RnCvEZAt0F6ExDsatKZ/DDdifanuSL360mqOhaFieKI34RoOwfQT9T+Ga52Vh5V2La6esvlph686EdgzeKLvDoxEwFM9ZYFBcMrNzu4bMTlgE7YUYw5JiORyXNfznBGnme6qpuvx9ibYhUyiZo99kM8ys5YrUHrP2JXQJMezDFZHxT4GFMOuSdh/1daGoKKD6hYL/jEHX8CI4E3BSmKK6ygYr1fVX0K0Tv77lIi5mLXucjR7CytWYWYnhM6DC3Hxpv2zRkPgf3k0x/Y1hrw3V/r0Me5h90pd2C8pFaWA2ZoUT/fmyVqvx1tZPYToU/O2dMItY0zgx2kR0yD+6g7Aahz3R+KlXkV8k5c8bbTbfGnZWDR1ZlbLRM9Yt5vosfwapUD90MmVkpmR3wUkO2sUKi80QfC7b4KvSDXQ+MImbGxMaU5Bnsq1PqLN95q+uat3nlAVBAELkcx51FlE9CaIS65y4J7FEDg8BE5JeuCNshh62VSYRXVSFt8bk3f/TFGgzC8OIo14BhVmiRQQ503Z1sROyf5xLX2a/EJavMm1i2Bs2TH6ROKY9z5Pz8hT5US0r381V8oG7TZyLF9HTtoy3wCYsgWA5EmLanjAsVU2YEeAA0rxzdtYP8Y2okFiJ6u+M4HQZ3Wg3peSodyp3vxdYce2vk4EKeqEFuuS82850DYb7Et7fmp+wQQUT8Q/bMO0DreWjHoMM5lE4LJ4ME6AxksmMiFtfo/4Fe2q9D+LAqZ+ANOcv9M+8Rn6ngiYmuRNd0l/a02q1PEvO6vTfXgcl4f7Z1IULHPEaDNZHCJS1K5RXYFqYQ6OHsTmOm7hnwaRAS97+VFMo1i5uvTx9nYaAcY7yzq3Ckfb67dMBKApGOpJpkvPgfrP7bgBO5rOZXM1opXqVPb09nljAhhAhyCTh1e/8+mJrBo0cLQ/LupQzVxGDgm3awSMPxsZAN45PSWz76zzxdDa1MMo51do+VJHfs7Wl0NcXAQrniOBYL9Wqt0qNkn1gY5smkkISGeQ/vxNap4MmzeZE7b5fpOy+2fpcRVQLpc4nooQzJvSVTFz+25lgZ6iHf45K87gQFMIAri1Pf/EDDpL87az+bRWvWi+BA2kMe1kf+Ay1LyMz8r+g51H0ma0bNFh6+fbWMfUiD9JCepIObclnUJ4NlWfcgHxTf17d/4tl6z4DTcLpCCk8Da77JouSHgvtcRbRlFV1OfhWZLXUsrlfpaQTiItv6TGIr3k7+7b66o3Qw/GQVs5GmYifaIZIz8n8my4XjkaMBd0SZfBzzvFjHMq6YUP9+SbjvReqofuoO+5tW1wTYZXitFFBfwuHlXm6w77K5QDBW6olT7pat41/F5eGxLcz tv@wu";
|
||||
};
|
||||
tv_nomic = {
|
||||
tv-nomic = {
|
||||
inherit (tv) mail;
|
||||
pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3dYR/n4Yw8OsYmfR2rSUG7o10G6AqOlSJHuHSEmANbMkqjiWl1TnpORtt5bAktyAGI4vWf9vhNEnxuIqGXWSV+3yCd7yfBHR1m0Y9QSw6blQ0xc1venl3JU0kpEyJfUn8a9cdXlnRiS0MP1gcsN7Zk8cqBELJYJajkSEnsT4eVaU5/wdnyzUO1fk8D8tFBJbF/tsWDLJPu4P18rpxq4wZgA2qmyHoVDEVlrz2OYcziXT6gpG0JGnToteaNg9ok5QavEYFpp8P+k1AacrBjc1PAb4MaMX1nfkSyaZwSqLdH35XkNRgPhVVmqZ5PlG3VeNpPSwpdcKi8P3zH1xG9g6Usx1SAyvcoAyGHdOwmFuA2tc1HgYEiQ+OsPrHZHujBOOZsKTN9+IZHScCAe+UmUcK413WEZKPs8PeFjf1gQAoDXb55JpksxLAnC/SQOl4FhkctIAXxr12ALlyt9UFPzIoj/Nj2MpFzGSlf653fTFmnMbQ8+GICc4TUpqx5GELZhfQuprBTv/55a9zKvM4B8XT3Bn9olQzMQIXEjXb3WUVFDDNWeNydToorYn1wG3ZWQ+3f0IlqRicWO7Q9BRj1Lp5rcUCb+naJ48tGY6HFUZ1Kz/0x458GDFvUd8mCJjqqmeSkUEeZd0xet5tVFg/bYoSslEqPF6pz7V3ruJMSdYxnQ== tv@nomic #2";
|
||||
};
|
||||
tv_xu = {
|
||||
tv-xu = {
|
||||
inherit (tv) mail;
|
||||
pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/3nkqxe8YrDVt615n96A7iC3vvwsiqgpsBYC/bhwfBHu1bAtBmTWVqSKDIdwg7p8TQpIKtAgZ3IJT3BlrnVTeR4RIviLjHjYWW1NBhm+nXi+heThgi5fLciE3lVLVsy5X9Kc1ZPLgLa1In0REOanwbueOD0ESN1yKIDwUUdczw/o3dLDMzanqFHKuSSN4o9Ex2x+MRj9eLsb706s4VSYMo3lirRCJeAOGv1C7Xg1cuepdhIeJsq9aF7vSy15c0nCkWwr8zdY7pbMPYCe5zvIEymZ0UowZ5HQ3NmIZnYDxa4E1PFjDczHdQbVmmGMI80grNwMsHzQ6bynHSPXDoLf4WodXlhS0+9Ju5QavDT6uqZ9uhDBuWC8QNgWUMIJnEaTBFyA0OI1akl8Q2RLC+qnNf5IwItSq+GDwEsB2ZJNW3kOk1kNiCUrBafRYpPaFeP97wzzP4uYlBKAr2SOLrrkf7NFEdw2ihxhDMNnps/ErRJ8U0zdpmalw8mItGyqRULpHjk/wN00rYOdBIhW3G3QJuVgtGnWtGCBG5x70EfMiSEXPD3YSsVVsgKD+v8qr+YiilRRD+N3gaHhiOWA6HgxRNul/P4llk0ktTpb9LoHk2+oooTH5ZuuT/8yF8J4stZt7EIOH+mSOAXG1z0BwnEkQu7pVKwu/oOZpGJTvBrGwww== tv@xu";
|
||||
};
|
||||
|
|
|
|||
|
|
@ -5,14 +5,14 @@
|
|||
# cache = url: "${cfg.dataDir}/.urlwatch/cache/${hashString "sha1" url}"
|
||||
# TODO hooks.py
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
cfg = config.krebs.urlwatch;
|
||||
|
||||
# TODO assert sendmail's existence
|
||||
out = {
|
||||
options.krebs.urlwatch = api;
|
||||
config = mkIf cfg.enable imp;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
};
|
||||
|
||||
api = {
|
||||
|
|
|
|||
|
|
@ -26,11 +26,15 @@ let out = rec {
|
|||
shell = import ./shell.nix { inherit lib; };
|
||||
tree = import ./tree.nix { inherit lib; };
|
||||
|
||||
toC = x: {
|
||||
toC = x: let
|
||||
type = typeOf x;
|
||||
reject = throw "cannot convert ${type}";
|
||||
in {
|
||||
list = "{ ${concatStringsSep ", " (map toC x)} }";
|
||||
null = "NULL";
|
||||
set = if isDerivation x then toJSON x else reject;
|
||||
string = toJSON x; # close enough
|
||||
}.${typeOf x};
|
||||
}.${type} or reject;
|
||||
|
||||
subdirsOf = path:
|
||||
mapAttrs (name: _: path + "/${name}")
|
||||
|
|
|
|||
|
|
@ -1,50 +0,0 @@
|
|||
#! /bin/sh
|
||||
set -efu
|
||||
|
||||
nix_url=https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-linux.tar.bz2
|
||||
nix_sha256=504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4
|
||||
|
||||
install_nix() {(
|
||||
|
||||
# install nix on host (cf. https://nixos.org/nix/install)
|
||||
if ! test -e /root/.nix-profile/etc/profile.d/nix.sh; then
|
||||
(
|
||||
verify() {
|
||||
printf '%s %s\n' $nix_sha256 $(basename $nix_url) | sha256sum -c
|
||||
}
|
||||
if ! verify; then
|
||||
curl -C - -O "$nix_url"
|
||||
verify
|
||||
fi
|
||||
)
|
||||
nix_src_dir=$(basename $nix_url .tar.bz2)
|
||||
tar jxf $nix_src_dir.tar.bz2
|
||||
$nix_src_dir/install
|
||||
fi
|
||||
|
||||
. /root/.nix-profile/etc/profile.d/nix.sh
|
||||
|
||||
for i in \
|
||||
bash \
|
||||
coreutils \
|
||||
# This line intentionally left blank.
|
||||
do
|
||||
if ! nix-env -q $i | grep -q .; then
|
||||
nix-env -iA nixpkgs.pkgs.$i
|
||||
fi
|
||||
done
|
||||
|
||||
# install nixos-install
|
||||
if ! type nixos-install 2>/dev/null; then
|
||||
nixpkgs_expr='import <nixpkgs> { system = builtins.currentSystem; }'
|
||||
nixpkgs_path=$(find /nix/store -mindepth 1 -maxdepth 1 -name *-nixpkgs-* -type d)
|
||||
nix-env \
|
||||
--arg config "{ nix.package = ($nixpkgs_expr).nix; }" \
|
||||
--arg pkgs "$nixpkgs_expr" \
|
||||
--arg modulesPath 'throw "no modulesPath"' \
|
||||
-f $nixpkgs_path/nixpkgs/nixos/modules/installer/tools/tools.nix \
|
||||
-iA config.system.build.nixos-install
|
||||
fi
|
||||
)}
|
||||
|
||||
install_nix "$@"
|
||||
|
|
@ -1,6 +1,9 @@
|
|||
#! /bin/sh
|
||||
set -efu
|
||||
|
||||
nix_url=https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-linux.tar.bz2
|
||||
nix_sha256=504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4
|
||||
|
||||
prepare() {(
|
||||
if test -e /etc/os-release; then
|
||||
. /etc/os-release
|
||||
|
|
@ -33,6 +36,13 @@ prepare() {(
|
|||
;;
|
||||
esac
|
||||
;;
|
||||
nixos)
|
||||
case $(cat /proc/cmdline) in
|
||||
*' root=LABEL=NIXOS_ISO '*)
|
||||
prepare_nixos_iso "$@"
|
||||
exit
|
||||
esac
|
||||
;;
|
||||
esac
|
||||
elif test -e /etc/centos-release; then
|
||||
case $(cat /etc/centos-release) in
|
||||
|
|
@ -70,7 +80,25 @@ prepare_debian() {
|
|||
prepare_common
|
||||
}
|
||||
|
||||
prepare_common() {
|
||||
prepare_nixos_iso() {
|
||||
mountpoint /mnt
|
||||
|
||||
type git 2>/dev/null || nix-env -iA nixos.git
|
||||
|
||||
mkdir -p /mnt/"$target_path"
|
||||
mkdir -p "$target_path"
|
||||
|
||||
if ! mountpoint "$target_path"; then
|
||||
mount --rbind /mnt/"$target_path" "$target_path"
|
||||
fi
|
||||
|
||||
mkdir -p bin
|
||||
rm -f bin/nixos-install
|
||||
cp "$(type -p nixos-install)" bin/nixos-install
|
||||
sed -i "s@^NIX_PATH=\"[^\"]*\"@NIX_PATH=$target_path@" bin/nixos-install
|
||||
}
|
||||
|
||||
prepare_common() {(
|
||||
|
||||
if ! getent group nixbld >/dev/null; then
|
||||
groupadd -g 30000 -r nixbld
|
||||
|
|
@ -133,6 +161,50 @@ prepare_common() {
|
|||
mkdir -p /mnt/nix
|
||||
mount --bind /nix /mnt/nix
|
||||
fi
|
||||
}
|
||||
|
||||
#
|
||||
# install nix
|
||||
#
|
||||
|
||||
# install nix on host (cf. https://nixos.org/nix/install)
|
||||
if ! test -e /root/.nix-profile/etc/profile.d/nix.sh; then
|
||||
(
|
||||
verify() {
|
||||
printf '%s %s\n' $nix_sha256 $(basename $nix_url) | sha256sum -c
|
||||
}
|
||||
if ! verify; then
|
||||
curl -C - -O "$nix_url"
|
||||
verify
|
||||
fi
|
||||
)
|
||||
nix_src_dir=$(basename $nix_url .tar.bz2)
|
||||
tar jxf $nix_src_dir.tar.bz2
|
||||
$nix_src_dir/install
|
||||
fi
|
||||
|
||||
. /root/.nix-profile/etc/profile.d/nix.sh
|
||||
|
||||
for i in \
|
||||
bash \
|
||||
coreutils \
|
||||
# This line intentionally left blank.
|
||||
do
|
||||
if ! nix-env -q $i | grep -q .; then
|
||||
nix-env -iA nixpkgs.pkgs.$i
|
||||
fi
|
||||
done
|
||||
|
||||
# install nixos-install
|
||||
if ! type nixos-install 2>/dev/null; then
|
||||
nixpkgs_expr='import <nixpkgs> { system = builtins.currentSystem; }'
|
||||
nixpkgs_path=$(find /nix/store -mindepth 1 -maxdepth 1 -name *-nixpkgs-* -type d)
|
||||
nix-env \
|
||||
--arg config "{ nix.package = ($nixpkgs_expr).nix; }" \
|
||||
--arg pkgs "$nixpkgs_expr" \
|
||||
--arg modulesPath 'throw "no modulesPath"' \
|
||||
-f $nixpkgs_path/nixpkgs/nixos/modules/installer/tools/tools.nix \
|
||||
-iA config.system.build.nixos-install
|
||||
fi
|
||||
)}
|
||||
|
||||
prepare "$@"
|
||||
|
|
|
|||
|
|
@ -10,15 +10,14 @@ types // rec {
|
|||
options = {
|
||||
name = mkOption {
|
||||
type = label;
|
||||
};
|
||||
dc = mkOption {
|
||||
type = label;
|
||||
default = config._module.args.name;
|
||||
};
|
||||
cores = mkOption {
|
||||
type = positive;
|
||||
};
|
||||
nets = mkOption {
|
||||
type = attrsOf net;
|
||||
default = {};
|
||||
};
|
||||
|
||||
extraZones = mkOption {
|
||||
|
|
@ -155,26 +154,25 @@ types // rec {
|
|||
merge = mergeOneOption;
|
||||
};
|
||||
|
||||
user = submodule {
|
||||
user = submodule ({ config, ... }: {
|
||||
options = {
|
||||
mail = mkOption {
|
||||
type = str; # TODO retiolum mail address
|
||||
};
|
||||
name = mkOption {
|
||||
type = str; # TODO
|
||||
type = username;
|
||||
default = config._module.args.name;
|
||||
};
|
||||
pubkey = mkOption {
|
||||
type = str;
|
||||
};
|
||||
};
|
||||
};
|
||||
});
|
||||
|
||||
# TODO
|
||||
addr = str;
|
||||
addr4 = str;
|
||||
addr6 = str;
|
||||
hostname = str;
|
||||
label = str;
|
||||
|
||||
krebs.file-location = types.submodule {
|
||||
options = {
|
||||
|
|
@ -192,4 +190,36 @@ types // rec {
|
|||
};
|
||||
};
|
||||
};
|
||||
|
||||
# RFC952, B. Lexical grammar, <hname>
|
||||
hostname = mkOptionType {
|
||||
name = "hostname";
|
||||
check = x: all label.check (splitString "." x);
|
||||
merge = mergeOneOption;
|
||||
};
|
||||
|
||||
# RFC952, B. Lexical grammar, <name>
|
||||
# RFC1123, 2.1 Host Names and Numbers
|
||||
label = mkOptionType {
|
||||
name = "label";
|
||||
# TODO case-insensitive labels
|
||||
check = x: match "[0-9A-Za-z]([0-9A-Za-z-]*[0-9A-Za-z])?" x != null;
|
||||
merge = mergeOneOption;
|
||||
};
|
||||
|
||||
# POSIX.1‐2013, 3.278 Portable Filename Character Set
|
||||
filename = mkOptionType {
|
||||
name = "POSIX filename";
|
||||
check = let
|
||||
filename-chars = stringToCharacters
|
||||
"-.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
|
||||
in s: all (flip elem filename-chars) (stringToCharacters s);
|
||||
merge = mergeOneOption;
|
||||
};
|
||||
|
||||
# POSIX.1-2013, 3.431 User Name
|
||||
username = mkOptionType {
|
||||
name = "POSIX username";
|
||||
check = s: filename.check s && substring 0 1 s != "-";
|
||||
};
|
||||
}
|
||||
|
|
|
|||
62
krebs/5pkgs/builders.nix
Normal file
62
krebs/5pkgs/builders.nix
Normal file
|
|
@ -0,0 +1,62 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
with config.krebs.lib;
|
||||
rec {
|
||||
execve = name: { filename, argv ? null, envp ? {}, destination ? "" }: let
|
||||
in writeC name { inherit destination; } ''
|
||||
#include <unistd.h>
|
||||
|
||||
static char *const filename = ${toC filename};
|
||||
|
||||
${if argv == null
|
||||
then /* Propagate arguments */ ''
|
||||
#define MAIN_ARGS int argc, char **argv
|
||||
''
|
||||
else /* Provide fixed arguments */ ''
|
||||
#define MAIN_ARGS void
|
||||
static char *const argv[] = ${toC (argv ++ [null])};
|
||||
''}
|
||||
|
||||
static char *const envp[] = ${toC (
|
||||
mapAttrsToList (k: v: "${k}=${v}") envp ++ [null]
|
||||
)};
|
||||
|
||||
int main (MAIN_ARGS) {
|
||||
execve(filename, argv, envp);
|
||||
return -1;
|
||||
}
|
||||
'';
|
||||
|
||||
execveBin = name: cfg: execve name (cfg // { destination = "/bin/${name}"; });
|
||||
|
||||
writeC = name: { destination ? "" }: src: pkgs.runCommand name {} ''
|
||||
PATH=${makeSearchPath "bin" (with pkgs; [
|
||||
binutils
|
||||
coreutils
|
||||
gcc
|
||||
])}
|
||||
src=${pkgs.writeText "${name}.c" src}
|
||||
exe=$out${destination}
|
||||
mkdir -p "$(dirname "$exe")"
|
||||
gcc -O -Wall -o "$exe" $src
|
||||
strip --strip-unneeded "$exe"
|
||||
'';
|
||||
|
||||
writeDash = name: text: pkgs.writeScript name ''
|
||||
#! ${pkgs.dash}/bin/dash
|
||||
${text}
|
||||
'';
|
||||
|
||||
writeDashBin = name: text: pkgs.writeTextFile {
|
||||
executable = true;
|
||||
destination = "/bin/${name}";
|
||||
name = name;
|
||||
text = ''
|
||||
#! ${pkgs.dash}/bin/dash
|
||||
${text}
|
||||
'';
|
||||
};
|
||||
|
||||
writeNixFromCabal = name: path: pkgs.runCommand name {} ''
|
||||
${pkgs.cabal2nix}/bin/cabal2nix ${path} > $out
|
||||
'';
|
||||
}
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
{ stdenv, fetchgit, bc, cac-cert, coreutils, curl, dash, gnused, inotifyTools, jq, ncurses, openssh, sshpass, ... }:
|
||||
{ stdenv, fetchgit, bc, cac-cert, coreutils, curl, dash, gnugrep, gnused, inotifyTools, jq, ncurses, openssh, sshpass, ... }:
|
||||
|
||||
stdenv.mkDerivation {
|
||||
name = "cac-api-1.1.0";
|
||||
|
|
@ -22,6 +22,7 @@ stdenv.mkDerivation {
|
|||
bc
|
||||
coreutils
|
||||
curl
|
||||
gnugrep
|
||||
gnused
|
||||
inotifyTools
|
||||
jq
|
||||
|
|
|
|||
|
|
@ -1,67 +1,33 @@
|
|||
{ lib, pkgs, ... }:
|
||||
{ config, lib, pkgs, ... }@args:
|
||||
with config.krebs.lib;
|
||||
{
|
||||
nixpkgs.config.packageOverrides = pkgs: {
|
||||
haskellPackages = pkgs.haskellPackages.override {
|
||||
overrides = self: super:
|
||||
mapAttrs (name: path: self.callPackage path {})
|
||||
(mapAttrs'
|
||||
(name: type:
|
||||
if hasSuffix ".nix" name
|
||||
then {
|
||||
name = removeSuffix ".nix" name;
|
||||
value = ./haskell-overrides + "/${name}";
|
||||
}
|
||||
else null)
|
||||
(builtins.readDir ./haskell-overrides));
|
||||
};
|
||||
|
||||
with lib;
|
||||
let
|
||||
subdirs = mapAttrs (_: flip pkgs.callPackage {}) (subdirsOf ./.);
|
||||
pkgs' = pkgs // subdirs;
|
||||
in
|
||||
push = pkgs.callPackage ./push {
|
||||
inherit (subdirs) get jq;
|
||||
};
|
||||
|
||||
subdirs // rec {
|
||||
ReaktorPlugins = pkgs.callPackage ./Reaktor/plugins.nix {};
|
||||
|
||||
haskellPackages = pkgs.haskellPackages.override {
|
||||
overrides = self: super:
|
||||
mapAttrs (name: path: self.callPackage path {})
|
||||
(mapAttrs'
|
||||
(name: type:
|
||||
if hasSuffix ".nix" name
|
||||
then {
|
||||
name = removeSuffix ".nix" name;
|
||||
value = ./haskell-overrides + "/${name}";
|
||||
}
|
||||
else null)
|
||||
(builtins.readDir ./haskell-overrides));
|
||||
};
|
||||
|
||||
push = pkgs'.callPackage ./push {
|
||||
inherit (subdirs) get jq;
|
||||
};
|
||||
|
||||
ReaktorPlugins = pkgs.callPackage ./Reaktor/plugins.nix {};
|
||||
|
||||
execve = name: { filename, argv, envp ? {}, destination ? "" }:
|
||||
writeC name { inherit destination; } ''
|
||||
#include <unistd.h>
|
||||
int main () {
|
||||
const char *filename = ${toC filename};
|
||||
char *const argv[] = ${toC (argv ++ [null])};
|
||||
char *const envp[] = ${toC (
|
||||
mapAttrsToList (k: v: "${k}=${v}") envp ++ [null]
|
||||
)};
|
||||
execve(filename, argv, envp);
|
||||
return -1;
|
||||
}
|
||||
'';
|
||||
|
||||
test = {
|
||||
infest-cac-centos7 = pkgs.callPackage ./test/infest-cac-centos7 {};
|
||||
};
|
||||
|
||||
execveBin = name: cfg: execve name (cfg // { destination = "/bin/${name}"; });
|
||||
|
||||
writeC = name: { destination ? "" }: src: pkgs.runCommand name {} ''
|
||||
PATH=${makeSearchPath "bin" (with pkgs; [
|
||||
binutils
|
||||
coreutils
|
||||
gcc
|
||||
])}
|
||||
src=${pkgs.writeText "${name}.c" src}
|
||||
exe=$out${destination}
|
||||
mkdir -p "$(dirname "$exe")"
|
||||
gcc -O -Wall -o "$exe" $src
|
||||
strip --strip-unneeded "$exe"
|
||||
'';
|
||||
|
||||
writeNixFromCabal = name: path: pkgs.runCommand name {} ''
|
||||
${pkgs.cabal2nix}/bin/cabal2nix ${path} > $out
|
||||
'';
|
||||
test = {
|
||||
infest-cac-centos7 = pkgs.callPackage ./test/infest-cac-centos7 {};
|
||||
};
|
||||
}
|
||||
// import ./builders.nix args
|
||||
// mapAttrs (_: flip pkgs.callPackage {})
|
||||
(filterAttrs (_: dir.has-default-nix)
|
||||
(subdirsOf ./.));
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,11 +3,11 @@
|
|||
}:
|
||||
mkDerivation {
|
||||
pname = "xmonad-stockholm";
|
||||
version = "1.0.0";
|
||||
version = "1.1.0";
|
||||
src = fetchgit {
|
||||
url = "http://cgit.cd.krebsco.de/xmonad-stockholm";
|
||||
sha256 = "35dda5d16acc90af94ae2fae10ab5cc2d5b450c3f1ff2e7f515ac53877269abf";
|
||||
rev = "2dbefe42fc5cfe9093465bf3e22ba8f82feeef6e";
|
||||
url = http://cgit.cd.krebsco.de/xmonad-stockholm;
|
||||
rev = "179d29fd4c765dee698058ef63295331ac603639";
|
||||
sha256 = "0c6mj68xsxxr4j8adkzhjszi7bg6cpisrsmqn587a16sblpbrnkj";
|
||||
};
|
||||
libraryHaskellDepends = [
|
||||
base containers X11 X11-xshape xmonad xmonad-contrib
|
||||
|
|
|
|||
21
krebs/5pkgs/noVNC/default.nix
Normal file
21
krebs/5pkgs/noVNC/default.nix
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
{ fetchgit, lib, stdenv, ... }:
|
||||
with builtins;
|
||||
with lib;
|
||||
stdenv.mkDerivation rec {
|
||||
name = "${baseNameOf src.name}-${removePrefix "refs/tags/v" src.rev}";
|
||||
|
||||
src = fetchgit {
|
||||
url = https://github.com/kanaka/noVNC;
|
||||
rev = "refs/tags/v0.5.1";
|
||||
sha256 = "1azsnppwnrsv3axj0r5bw8lfarkibgz5vhgcyj8dzn4afn98f55w";
|
||||
};
|
||||
|
||||
phases = [
|
||||
"unpackPhase"
|
||||
"installPhase"
|
||||
];
|
||||
|
||||
installPhase = ''
|
||||
cp -R . $out
|
||||
'';
|
||||
}
|
||||
|
|
@ -1,7 +1,7 @@
|
|||
{ stdenv, fetchgit, ... }:
|
||||
{ fetchgit, lib, stdenv, ... }:
|
||||
|
||||
with stdenv; stdenv.mkDerivation rec {
|
||||
name = "posix-array";
|
||||
stdenv.mkDerivation rec {
|
||||
name = "posix-array-${version}";
|
||||
version = "1.0.0";
|
||||
|
||||
src = fetchgit {
|
||||
|
|
@ -16,16 +16,15 @@ with stdenv; stdenv.mkDerivation rec {
|
|||
];
|
||||
|
||||
installPhase = ''
|
||||
mkdir -p "$out/bin"
|
||||
mkdir -p $out/bin
|
||||
cp -a ./array $out/bin
|
||||
rm *
|
||||
'';
|
||||
|
||||
meta = {
|
||||
description = "Posix-compliant array implementation";
|
||||
description = "POSIX-compliant array implementation";
|
||||
url = https://github.com/makefu/array;
|
||||
license = licenses.wtfpl;
|
||||
platforms = platforms.unix;
|
||||
maintainers = with maintainers; [ makefu ];
|
||||
license = lib.licenses.wtfpl;
|
||||
platforms = lib.platforms.unix;
|
||||
maintainers = with lib.maintainers; [ makefu ];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
19
krebs/5pkgs/repo-sync/default.nix
Normal file
19
krebs/5pkgs/repo-sync/default.nix
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
{ lib, pkgs, python3Packages, fetchurl, ... }:
|
||||
with python3Packages; buildPythonPackage rec {
|
||||
name = "repo-sync-${version}";
|
||||
version = "0.1.1";
|
||||
disabled = isPy26 || isPy27;
|
||||
propagatedBuildInputs = [
|
||||
docopt
|
||||
GitPython
|
||||
];
|
||||
src = fetchurl {
|
||||
url = "https://pypi.python.org/packages/source/r/repo-sync/repo-sync-${version}.tar.gz";
|
||||
sha256 = "01r30l2bbsld90ps13ip0zi2a41b53dv4q6fxrzvkfrprr64c0vv";
|
||||
};
|
||||
meta = {
|
||||
homepage = http://github.com/makefu/repo-sync;
|
||||
description = "Sync remotes to other remotes.";
|
||||
license = lib.licenses.mit;
|
||||
};
|
||||
}
|
||||
|
|
@ -115,7 +115,6 @@ _: {
|
|||
users.extraUsers.root.openssh.authorizedKeys.keys = [
|
||||
"$(cat ${krebs_ssh}.pub)"
|
||||
];
|
||||
krebs.build.target = "$ip";
|
||||
}
|
||||
EOF
|
||||
|
||||
|
|
|
|||
20
krebs/5pkgs/vncdotool/default.nix
Normal file
20
krebs/5pkgs/vncdotool/default.nix
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
{ lib, pythonPackages, fetchurl, ... }:
|
||||
with pythonPackages; buildPythonPackage rec {
|
||||
name = lib.removeSuffix ".tar.gz" (builtins.baseNameOf src.name);
|
||||
|
||||
src = fetchurl {
|
||||
url = https://pypi.python.org/packages/source/v/vncdotool/vncdotool-0.9.0.tar.gz;
|
||||
sha256 = "1hl44w4x9c8air0g6kp9h1af2vj4lmc50vnsxmca9g080740iyvi";
|
||||
};
|
||||
|
||||
propagatedBuildInputs = [
|
||||
twisted
|
||||
pillow
|
||||
];
|
||||
|
||||
meta = {
|
||||
homepage = https://github.com/sibson/vncdotool;
|
||||
description = "A command line VNC client and python library";
|
||||
license = lib.licenses.mit;
|
||||
};
|
||||
}
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
Address = 144.76.172.188
|
||||
Subnet = 10.243.133.99
|
||||
Subnet = 42:0000:0000:0000:0000:0000:d15f:1233
|
||||
|
||||
-----BEGIN RSA PUBLIC KEY-----
|
||||
MIIBCgKCAQEAwKi49fN+0s5Cze6JThM7f7lj4da27PSJ/3w3tDFPvtQco11ksNLs
|
||||
Xd3qPaQIgmcNVCR06aexae3bBeTx9y3qHvKqZVE1nCtRlRyqy1LVKSj15J1D7yz7
|
||||
uS6u/BSZiCzmdZwu3Fq5qqoK0nfzWe/NKEDWNa5l4Mz/BZQyI/hbOpn6UfFD0LpK
|
||||
R4jzc9Dbk/IFNAvwb5yrgEYtwBzlXzeDvHW2JcPq3qQjK2byQYNiIyV3g0GHppEd
|
||||
vDbIPDFhTn3Hv5zz/lX+/We8izzRge7MEd+Vn9Jwb5NAzwDsOHl6ExpqASv9H49U
|
||||
HwgPw5pstabyrsDWXybSYUb+8LcZf+unGwIDAQAB
|
||||
-----END RSA PUBLIC KEY-----
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
Subnet = 42:0:0:0:0:0:0:7105/128
|
||||
Subnet = 10.243.0.3/32
|
||||
-----BEGIN RSA PUBLIC KEY-----
|
||||
MIIBCgKCAQEA9SItL2mhQpTl95gjSWRstrDajUnI5YbrVCuaDKfw9gRwMyPNiO/y
|
||||
Xwv/w4Ri8NCJZLZGkj2vG3X0EfJFBEPTJPTCbF9fP7PqqVs38BD41txLp+NrFxEq
|
||||
5fmFk65/eg8ujrNQoOSUGmky/BKqQhWjvxdAWuwjN933wJCcNCxyaUwljHLYEK/I
|
||||
oIJX+spnFmPwmhW9hsOj8K06eHixT13+0W48GG/ZNcV3x5vWxcKUvZ4Qtzz2iMNB
|
||||
hud5kae7xMUfFAzCeKF/zsjuyt2d/xQg1WgR8MXGNgYhNJFSXz94r/bivNO6H4vP
|
||||
Pfjndnh8cD46ADo8woS1nQ19WId+sMbipwIDAQAB
|
||||
-----END RSA PUBLIC KEY-----
|
||||
|
|
@ -1,193 +1,8 @@
|
|||
assert false;
|
||||
|
||||
{ current-host-name
|
||||
, current-user-name
|
||||
, lib
|
||||
, stockholm
|
||||
, StrictHostKeyChecking ? "yes"
|
||||
}:
|
||||
|
||||
let out = {
|
||||
inherit infest;
|
||||
inherit init;
|
||||
inherit nixos-install;
|
||||
};
|
||||
|
||||
infest =
|
||||
{ system ? current-host-name
|
||||
, target ? system
|
||||
}@args: let
|
||||
config = get-config system;
|
||||
in ''
|
||||
#! /bin/sh
|
||||
# krebs.infest
|
||||
set -efu
|
||||
|
||||
${rootssh target ''
|
||||
${builtins.readFile ./4lib/infest/prepare.sh}
|
||||
${builtins.readFile ./4lib/infest/install-nix.sh}
|
||||
''}
|
||||
|
||||
(${nixos-install args})
|
||||
|
||||
${rootssh target ''
|
||||
${builtins.readFile ./4lib/infest/finalize.sh}
|
||||
''}
|
||||
'';
|
||||
|
||||
init =
|
||||
{ system ? current-host-name
|
||||
}@args: let
|
||||
config = get-config system;
|
||||
in ''
|
||||
#! /bin/sh
|
||||
# krebs.init
|
||||
set -efu
|
||||
|
||||
system=${lib.shell.escape system}
|
||||
secrets_dir=${config.krebs.build.source.dir.secrets.path}
|
||||
key_type=ed25519
|
||||
key_file=$secrets_dir/ssh.id_$key_type
|
||||
key_comment=$system
|
||||
|
||||
if test -e "$key_file"; then
|
||||
echo "Warning: privkey already exists: $key_file" >&2
|
||||
else
|
||||
ssh-keygen \
|
||||
-C "$key_comment" \
|
||||
-t "$key_type" \
|
||||
-f "$key_file" \
|
||||
-N ""
|
||||
rm "$key_file.pub"
|
||||
fi
|
||||
|
||||
pubkey=$(ssh-keygen -y -f "$key_file")
|
||||
|
||||
cat<<EOF
|
||||
# put following into config.krebs.hosts.$system:
|
||||
ssh.privkey.path = <secrets/ssh.$key_type>;
|
||||
ssh.pubkey = $(echo $pubkey | jq -R .);
|
||||
EOF
|
||||
'';
|
||||
|
||||
nixos-install =
|
||||
{ system ? current-host-name
|
||||
, target ? system
|
||||
}@args: let
|
||||
in ''
|
||||
#! /bin/sh
|
||||
# krebs.nixos-install
|
||||
(${populate (args // { root = "/mnt"; })})
|
||||
|
||||
${rootssh target ''
|
||||
export PATH; PATH=/root/.nix-profile/bin:$PATH
|
||||
|
||||
src=$(type -p nixos-install)
|
||||
cat_src() {
|
||||
sed < "$src" "$(
|
||||
{ sed < "$src" -n '
|
||||
/^if ! test -e "\$mountPoint\/\$NIXOS_CONFIG/,/^fi$/=
|
||||
/^nixpkgs=/=
|
||||
/^NIX_PATH=/,/^$/{/./=}
|
||||
|
||||
# Disable: Copy the NixOS/Nixpkgs sources to the target as
|
||||
# the initial contents of the NixOS channel.
|
||||
/^srcs=/,/^ln -sfn /=
|
||||
'
|
||||
} | sed 's:$:s/^/#krebs#/:'
|
||||
)"
|
||||
}
|
||||
|
||||
# Location to insert `nix-install`
|
||||
i=$(sed -n '/^echo "building the system configuration/=' "$src")
|
||||
|
||||
{
|
||||
cat_src | sed -n "1,$i{p}"
|
||||
cat ${doc (nix-install args)}
|
||||
cat_src | sed -n "$i,\''${$i!p}"
|
||||
} > nixos-install
|
||||
chmod +x nixos-install
|
||||
|
||||
# Wrap inserted nix-install into chroot.
|
||||
nix_env=$(cat_src | sed -n '
|
||||
s:.*\(/nix/store/[a-z0-9]*-nix-[0-9.]\+/bin/nix-env\).*:\1:p;T;q
|
||||
')
|
||||
echo "nix-env is $nix_env" >&2
|
||||
findpkg() {(
|
||||
name=$1
|
||||
path=$(find /nix/store \
|
||||
-mindepth 1 -maxdepth 1 -type d -name '*-'"$name"'-*' \
|
||||
| head -n 1 | sed s:^/mnt::)
|
||||
if echo "$path" | grep .; then
|
||||
echo "$name is $path" >&2
|
||||
else
|
||||
echo "Error: package not found: $name" >&2
|
||||
exit 1
|
||||
fi
|
||||
)}
|
||||
cacert=$(findpkg cacert)
|
||||
coreutils=$(findpkg coreutils)
|
||||
cp "$cacert"/etc/ssl/certs/ca-bundle.crt /mnt/root/SSL_CERT_FILE
|
||||
env="$coreutils/bin/env SSL_CERT_FILE=/root/SSL_CERT_FILE"
|
||||
sed -i '
|
||||
s:^NIX_PATH=:chroot $mountPoint '"$env"' &:
|
||||
s:^nix-env:'"$nix_env"':
|
||||
' nixos-install
|
||||
|
||||
./nixos-install
|
||||
''}
|
||||
'';
|
||||
|
||||
doc = s:
|
||||
let b = "EOF${builtins.hashString "sha256" s}"; in
|
||||
''
|
||||
<<\${b}
|
||||
${s}
|
||||
${b}
|
||||
'';
|
||||
|
||||
get-config = system: let
|
||||
config = stockholm.users.${current-user-name}.${system}.config
|
||||
or (abort "unknown system: ${system}, user: ${current-user-name}");
|
||||
in config;
|
||||
|
||||
nix-install =
|
||||
{ system ? current-host-name
|
||||
, target ? system
|
||||
}:
|
||||
let
|
||||
config = get-config system;
|
||||
|
||||
nix-path =
|
||||
lib.concatStringsSep ":"
|
||||
(lib.mapAttrsToList (name: src: "${name}=${src.target-path}")
|
||||
(config.krebs.build.source.dir //
|
||||
config.krebs.build.source.git));
|
||||
in ''
|
||||
set -efu
|
||||
NIX_PATH=${lib.shell.escape nix-path} \
|
||||
nix-env \
|
||||
--show-trace \
|
||||
-f '<stockholm>' \
|
||||
--argstr current-host-name ${lib.shell.escape current-host-name} \
|
||||
--argstr current-user-name ${lib.shell.escape current-user-name} \
|
||||
--profile ${lib.shell.escape config.krebs.build.profile} \
|
||||
--set \
|
||||
-A ${lib.escapeShellArg (lib.concatStringsSep "." [
|
||||
"users"
|
||||
config.krebs.build.user.name
|
||||
config.krebs.build.host.name
|
||||
"system"
|
||||
])}
|
||||
'';
|
||||
|
||||
rootssh = target: script:
|
||||
let
|
||||
flags = "-o StrictHostKeyChecking=${StrictHostKeyChecking}";
|
||||
in
|
||||
"ssh ${flags} root@${target} -T ${doc ''
|
||||
set -efu
|
||||
${script}
|
||||
''}";
|
||||
|
||||
in out
|
||||
{ config, lib, pkgs, ... }:
|
||||
with config.krebs.lib;
|
||||
{
|
||||
imports = [
|
||||
./3modules
|
||||
./5pkgs
|
||||
];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,6 +7,7 @@ let
|
|||
ip = (head config.krebs.build.host.nets.internet.addrs4);
|
||||
in {
|
||||
imports = [
|
||||
../.
|
||||
../2configs/os-templates/CAC-CentOS-7-64bit.nix
|
||||
../2configs/base.nix
|
||||
../2configs/retiolum.nix
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@
|
|||
|
||||
{
|
||||
imports = [
|
||||
../.
|
||||
<nixpkgs/nixos/modules/profiles/qemu-guest.nix>
|
||||
../2configs/base.nix
|
||||
../2configs/git.nix
|
||||
|
|
|
|||
|
|
@ -7,6 +7,7 @@ let
|
|||
ip = (head config.krebs.build.host.nets.internet.addrs4);
|
||||
in {
|
||||
imports = [
|
||||
../.
|
||||
../2configs/os-templates/CAC-CentOS-7-64bit.nix
|
||||
../2configs/base.nix
|
||||
../2configs/retiolum.nix
|
||||
|
|
|
|||
|
|
@ -3,6 +3,7 @@
|
|||
with builtins;
|
||||
{
|
||||
imports = [
|
||||
../.
|
||||
../2configs/baseX.nix
|
||||
../2configs/browsers.nix
|
||||
../2configs/programs.nix
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@
|
|||
|
||||
{
|
||||
imports = [
|
||||
../.
|
||||
../2configs/baseX.nix
|
||||
../2configs/programs.nix
|
||||
../2configs/bitcoin.nix
|
||||
|
|
|
|||
|
|
@ -6,6 +6,7 @@ let
|
|||
ip = (head config.krebs.build.host.nets.internet.addrs4);
|
||||
in {
|
||||
imports = [
|
||||
../.
|
||||
../2configs/base.nix
|
||||
../2configs/downloading.nix
|
||||
../2configs/git.nix
|
||||
|
|
|
|||
|
|
@ -3,6 +3,7 @@
|
|||
with builtins;
|
||||
{
|
||||
imports = [
|
||||
../.
|
||||
../2configs/baseX.nix
|
||||
../2configs/browsers.nix
|
||||
../2configs/games.nix
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
{
|
||||
imports = [
|
||||
../2configs/vim.nix
|
||||
|
|
@ -17,8 +17,8 @@ with lib;
|
|||
root = {
|
||||
openssh.authorizedKeys.keys = [
|
||||
config.krebs.users.lass.pubkey
|
||||
config.krebs.users.lass_uriel.pubkey
|
||||
config.krebs.users.lass_helios.pubkey
|
||||
config.krebs.users.lass-uriel.pubkey
|
||||
config.krebs.users.lass-helios.pubkey
|
||||
];
|
||||
};
|
||||
mainUser = {
|
||||
|
|
@ -32,7 +32,7 @@ with lib;
|
|||
];
|
||||
openssh.authorizedKeys.keys = [
|
||||
config.krebs.users.lass.pubkey
|
||||
config.krebs.users.lass_uriel.pubkey
|
||||
config.krebs.users.lass-uriel.pubkey
|
||||
];
|
||||
};
|
||||
};
|
||||
|
|
@ -50,12 +50,10 @@ with lib;
|
|||
user = config.krebs.users.lass;
|
||||
source = mapAttrs (_: mkDefault) ({
|
||||
nixos-config = "symlink:stockholm/lass/1systems/${config.krebs.build.host.name}.nix";
|
||||
nixpkgs = symlink:stockholm/nixpkgs;
|
||||
secrets = "/home/lass/secrets/${config.krebs.build.host.name}";
|
||||
#secrets-common = "/home/lass/secrets/common";
|
||||
stockholm = "/home/lass/stockholm";
|
||||
stockholm-user = "symlink:stockholm/lass";
|
||||
upstream-nixpkgs = {
|
||||
nixpkgs = {
|
||||
url = https://github.com/Lassulus/nixpkgs;
|
||||
rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce";
|
||||
dev = "/home/lass/src/nixpkgs";
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
let
|
||||
rpc-password = import <secrets/transmission-pw.nix>;
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
let
|
||||
createStaticPage = domain:
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
let
|
||||
|
||||
|
|
@ -71,7 +71,7 @@ let
|
|||
with git // config.krebs.users;
|
||||
repo:
|
||||
singleton {
|
||||
user = [ lass lass_helios lass_uriel ];
|
||||
user = [ lass lass-helios lass-uriel ];
|
||||
repo = [ repo ];
|
||||
perm = push "refs/*" [ non-fast-forward create delete merge ];
|
||||
} ++
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
{
|
||||
environment.systemPackages = [
|
||||
pkgs.go
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
{
|
||||
services.teamviewer.enable = true;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
pkgs.writeText "Xresources" ''
|
||||
URxvt*scrollBar: false
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }@args:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
let
|
||||
# TODO krebs.build.user
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
let
|
||||
cfg = config.services.xserver;
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
let
|
||||
cfg = config.lass.owncloud;
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with builtins;
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
cfg = config.lass.per-user;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
let
|
||||
cfg = config.lass.staticPage;
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
|
||||
let
|
||||
cfg = config.lass.wordpress;
|
||||
|
|
|
|||
|
|
@ -3,15 +3,16 @@
|
|||
let
|
||||
inherit (pkgs) callPackage;
|
||||
in
|
||||
|
||||
rec {
|
||||
firefoxPlugins = {
|
||||
noscript = callPackage ./firefoxPlugins/noscript.nix {};
|
||||
ublock = callPackage ./firefoxPlugins/ublock.nix {};
|
||||
vimperator = callPackage ./firefoxPlugins/vimperator.nix {};
|
||||
{
|
||||
nixpkgs.config.packageOverrides = rec {
|
||||
firefoxPlugins = {
|
||||
noscript = callPackage ./firefoxPlugins/noscript.nix {};
|
||||
ublock = callPackage ./firefoxPlugins/ublock.nix {};
|
||||
vimperator = callPackage ./firefoxPlugins/vimperator.nix {};
|
||||
};
|
||||
newsbot-js = callPackage ./newsbot-js/default.nix {};
|
||||
xmonad-lass =
|
||||
let src = pkgs.writeNixFromCabal "xmonad-lass.nix" ./xmonad-lass; in
|
||||
pkgs.haskellPackages.callPackage src {};
|
||||
};
|
||||
newsbot-js = callPackage ./newsbot-js/default.nix {};
|
||||
xmonad-lass =
|
||||
let src = pkgs.writeNixFromCabal "xmonad-lass.nix" ./xmonad-lass; in
|
||||
pkgs.haskellPackages.callPackage src {};
|
||||
}
|
||||
|
|
|
|||
7
lass/default.nix
Normal file
7
lass/default.nix
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
_:
|
||||
{
|
||||
imports = [
|
||||
../krebs
|
||||
./3modules
|
||||
];
|
||||
}
|
||||
|
|
@ -11,6 +11,7 @@ let
|
|||
in {
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
../.
|
||||
../2configs/fs/single-partition-ext4.nix
|
||||
../2configs/tinc-basic-retiolum.nix
|
||||
../2configs/smart-monitor.nix
|
||||
|
|
|
|||
|
|
@ -1,11 +1,12 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
external-ip = head config.krebs.build.host.nets.internet.addrs4;
|
||||
internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
|
||||
in {
|
||||
imports = [
|
||||
../.
|
||||
../2configs/tinc-basic-retiolum.nix
|
||||
../2configs/headless.nix
|
||||
../2configs/fs/simple-swap.nix
|
||||
|
|
@ -26,7 +27,6 @@ in {
|
|||
nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
|
||||
|
||||
###### stable
|
||||
krebs.build.target = "root@gum.krebsco.de";
|
||||
krebs.build.host = config.krebs.hosts.gum;
|
||||
krebs.retiolum.extraConfig = ''
|
||||
ListenAddress = ${external-ip} 53
|
||||
|
|
|
|||
|
|
@ -20,6 +20,7 @@ let
|
|||
in {
|
||||
imports =
|
||||
[
|
||||
../.
|
||||
# TODO: unlock home partition via ssh
|
||||
../2configs/fs/single-partition-ext4.nix
|
||||
../2configs/tinc-basic-retiolum.nix
|
||||
|
|
|
|||
|
|
@ -6,6 +6,7 @@
|
|||
{
|
||||
imports =
|
||||
[
|
||||
../.
|
||||
../2configs/tinc-basic-retiolum.nix
|
||||
../2configs/headless.nix
|
||||
../../krebs/3modules/Reaktor.nix
|
||||
|
|
|
|||
|
|
@ -6,6 +6,7 @@
|
|||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
../.
|
||||
../2configs/main-laptop.nix #< base-gui + zsh
|
||||
|
||||
# Krebs
|
||||
|
|
@ -18,7 +19,6 @@
|
|||
../2configs/exim-retiolum.nix
|
||||
../2configs/mail-client.nix
|
||||
../2configs/printer.nix
|
||||
#../2configs/virtualization.nix
|
||||
../2configs/virtualization.nix
|
||||
../2configs/virtualization-virtualbox.nix
|
||||
../2configs/wwan.nix
|
||||
|
|
@ -35,33 +35,13 @@
|
|||
# ../2configs/mediawiki.nix
|
||||
#../2configs/wordpress.nix
|
||||
];
|
||||
hardware.sane.enable = true;
|
||||
hardware.sane.extraBackends = [ pkgs.samsungUnifiedLinuxDriver ];
|
||||
|
||||
nixpkgs.config.packageOverrides = pkgs: {
|
||||
tinc = pkgs.tinc_pre;
|
||||
};
|
||||
|
||||
krebs.Reaktor = {
|
||||
enable = false;
|
||||
nickname = "makefu|r";
|
||||
plugins = with pkgs.ReaktorPlugins; [ nixos-version random-emoji ];
|
||||
};
|
||||
|
||||
# nix.binaryCaches = [ "http://acng.shack/nixos" "https://cache.nixos.org" ];
|
||||
|
||||
environment.systemPackages = with pkgs;[
|
||||
get
|
||||
virtmanager
|
||||
gnome3.dconf
|
||||
krebspaste
|
||||
];
|
||||
|
||||
services.logind.extraConfig = "HandleLidSwitch=ignore";
|
||||
# configure pulseAudio to provide a HDMI sink as well
|
||||
hardware.pulseaudio.configFile = pkgs.writeText "pulse-default-pa" ''
|
||||
${builtins.readFile "${config.hardware.pulseaudio.package}/etc/pulse/default.pa"}
|
||||
load-module module-alsa-sink device=hw:0,3 sink_properties=device.description="HDMIOutput" sink_name="HDMI"'';
|
||||
networking.firewall.enable = false;
|
||||
networking.firewall.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
25
|
||||
];
|
||||
|
|
|
|||
|
|
@ -7,8 +7,9 @@
|
|||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
../.
|
||||
<nixpkgs/nixos/modules/profiles/qemu-guest.nix>
|
||||
../2configs/cgit-retiolum.nix
|
||||
../2configs/git/cgit-retiolum.nix
|
||||
];
|
||||
krebs.build.host = config.krebs.hosts.repunit;
|
||||
|
||||
|
|
|
|||
|
|
@ -6,6 +6,7 @@
|
|||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
../.
|
||||
../2configs/base-gui.nix
|
||||
../2configs/tinc-basic-retiolum.nix
|
||||
../2configs/fs/sda-crypto-root.nix
|
||||
|
|
|
|||
|
|
@ -4,9 +4,9 @@
|
|||
{ lib, config, pkgs, ... }:
|
||||
{
|
||||
krebs.build.host = config.krebs.hosts.vbob;
|
||||
krebs.build.target = "root@10.10.10.220";
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
../.
|
||||
<nixpkgs/nixos/modules/virtualisation/virtualbox-image.nix>
|
||||
../2configs/main-laptop.nix #< base-gui
|
||||
|
||||
|
|
@ -18,8 +18,8 @@
|
|||
tinc = pkgs.tinc_pre;
|
||||
};
|
||||
|
||||
krebs.build.source.nixpkgs = {
|
||||
# url = https://github.com/nixos/nixpkgs;
|
||||
krebs.build.source.upstream-nixpkgs = {
|
||||
url = https://github.com/makefu/nixpkgs;
|
||||
# HTTP Everywhere + libredir
|
||||
rev = "8239ac6";
|
||||
};
|
||||
|
|
@ -39,7 +39,6 @@
|
|||
buildbot
|
||||
buildbot-slave
|
||||
get
|
||||
genid
|
||||
logstash
|
||||
];
|
||||
|
||||
|
|
|
|||
|
|
@ -2,18 +2,60 @@
|
|||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
../.
|
||||
../2configs/main-laptop.nix
|
||||
];
|
||||
krebs = {
|
||||
enable = true;
|
||||
retiolum.enable = true;
|
||||
build.host = config.krebs.hosts.wbob;
|
||||
};
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
fileSystems."/" = {
|
||||
device = "/dev/sda1";
|
||||
fsType = "ext4";
|
||||
};
|
||||
krebs = {
|
||||
enable = true;
|
||||
retiolum.enable = true;
|
||||
build.host = config.krebs.hosts.wbob;
|
||||
};
|
||||
|
||||
# rt2870.bin wifi card, part of linux-unfree
|
||||
hardware.enableAllFirmware = true;
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
networking.wireless.enable = true;
|
||||
# rt2870 with nonfree creates wlp2s0 from wlp0s20u2
|
||||
# not explicitly setting the interface results in wpa_supplicant to crash
|
||||
networking.wireless.interfaces = [ "wlp2s0" ];
|
||||
|
||||
|
||||
# nuc hardware
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
hardware.cpu.intel.updateMicrocode = true;
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
fileSystems."/" = {
|
||||
device = "/dev/sda1";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
# DualHead on NUC
|
||||
services.xserver = {
|
||||
# xrandrHeads = [ "HDMI1" "HDMI2" ];
|
||||
# prevent screen from turning off, disable dpms
|
||||
displayManager.sessionCommands = ''
|
||||
xset s off -dpms
|
||||
xrandr --output HDMI2 --right-of HDMI1
|
||||
'';
|
||||
};
|
||||
## TODO Awesomecfg + autostart chrome
|
||||
#
|
||||
#local current_screen = 1
|
||||
#awful.rules.rules = {
|
||||
# { rule = { class = "chromium-browser" },
|
||||
# callback = function()
|
||||
# awful.client.movetotag(tags[current_screen][1],c)
|
||||
# if (current_screen == 1) then
|
||||
# current_screen = current_screen+1
|
||||
# else
|
||||
# current_screen = current_screen-1
|
||||
# end
|
||||
# end
|
||||
# },
|
||||
#}
|
||||
#awful.util.spawn_with_shell("chromium --new-window --kiosk http://wolf:3000/dashboard/db/soc-critical-values")
|
||||
# prevent Race Condition
|
||||
#awful.util.spawn_with_shell("sleep 0.5;chromium --new-window --kiosk http://wolf:3000/dashboard/db/aralast")
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,12 +1,13 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
|
||||
external-ip = head config.krebs.build.host.nets.internet.addrs4;
|
||||
internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
|
||||
in {
|
||||
imports = [
|
||||
../.
|
||||
# TODO: copy this config or move to krebs
|
||||
../../tv/2configs/hw/CAC.nix
|
||||
../../tv/2configs/fs/CAC-CentOS-7-64bit.nix
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{ config, lib, ... }:
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
startAt = "0,6,12,18:00";
|
||||
defaultBackupServer = config.krebs.hosts.omo;
|
||||
|
|
@ -24,7 +24,7 @@ let
|
|||
};
|
||||
};
|
||||
in {
|
||||
krebs.backup.plans = addNames {
|
||||
krebs.backup.plans = {
|
||||
wry-to-omo_var-www = defaultPull wry "/var/www";
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@
|
|||
# URxvt.visualBell: false
|
||||
# URxvt.font : xft:Terminus
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
mainUser = config.krebs.build.user.name;
|
||||
awesomecfg = pkgs.awesomecfg.full;
|
||||
|
|
@ -44,6 +44,8 @@ in
|
|||
displayManager.auto.user = mainUser;
|
||||
desktopManager.xterm.enable = false;
|
||||
};
|
||||
# lid switch is handled via button presses
|
||||
services.logind.extraConfig = mkDefault "HandleLidSwitch=ignore";
|
||||
nixpkgs.config.packageOverrides = pkgs: rec {
|
||||
awesome = pkgs.stdenv.lib.overrideDerivation pkgs.awesome (oldAttrs : {
|
||||
postFixup = ''
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@
|
|||
# wildcard.krebsco.de.key
|
||||
# bepasty-secret.nix <- contains single string
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
sec = toString <secrets>;
|
||||
# secKey is nothing worth protecting on a local machine
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
# graphite-web on port 8080
|
||||
# carbon cache on port 2003 (tcp/udp)
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
connect-time-cfg = with pkgs; writeText "collectd-connect-time.cfg" ''
|
||||
LoadPlugin python
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
{
|
||||
system.stateVersion = "15.09";
|
||||
|
||||
|
|
@ -18,20 +18,17 @@ with lib;
|
|||
enable = true;
|
||||
search-domain = "retiolum";
|
||||
build = {
|
||||
target = mkDefault "root@${config.krebs.build.host.name}";
|
||||
user = config.krebs.users.makefu;
|
||||
source = mapAttrs (_: mkDefault) {
|
||||
upstream-nixpkgs = {
|
||||
nixpkgs = {
|
||||
url = https://github.com/nixos/nixpkgs;
|
||||
rev = "93d8671e2c6d1d25f126ed30e5e6f16764330119"; # unstable @ 2015-01-03, tested on filepimp
|
||||
rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; # unstable @ 2015-01-27, tested on wry
|
||||
};
|
||||
secrets = "/home/makefu/secrets/${config.krebs.build.host.name}/";
|
||||
stockholm = "/home/makefu/stockholm";
|
||||
|
||||
# Defaults for all stockholm users?
|
||||
nixos-config = "symlink:stockholm/${config.krebs.build.user.name}/1systems/${config.krebs.build.host.name}.nix";
|
||||
nixpkgs = symlink:stockholm/nixpkgs;
|
||||
stockholm-user = "symlink:stockholm/${config.krebs.build.user.name}";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -87,6 +84,7 @@ with lib;
|
|||
environment.systemPackages = with pkgs; [
|
||||
jq
|
||||
git
|
||||
get
|
||||
gnumake
|
||||
rxvt_unicode.terminfo
|
||||
htop
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
{
|
||||
krebs.exim-retiolum.enable = true;
|
||||
environment.systemPackages = with pkgs; [
|
||||
|
|
|
|||
|
|
@ -1,24 +1,15 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
# check if laptop runs on umts
|
||||
weaksauce-internet = with pkgs;writeScript "weaksauce-internet" ''
|
||||
#! /bin/sh
|
||||
if ${iproute}/bin/ip addr show dev ppp0 2>/dev/null \
|
||||
| ${gnugrep}/bin/grep -q inet;then
|
||||
exit 1
|
||||
fi
|
||||
'';
|
||||
|
||||
in {
|
||||
{
|
||||
krebs.fetchWallpaper = {
|
||||
enable = true;
|
||||
display = ":0";
|
||||
predicate = weaksauce-internet;
|
||||
unitConfig.ConditionPathExists = "!/var/run/ppp0.pid";
|
||||
timerConfig = {
|
||||
OnCalendar = "*:0/30";
|
||||
};
|
||||
url = "http://echelon/wallpaper.png";
|
||||
};
|
||||
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
# vda1 ext4 (label nixos) -> only root partition
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
{
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.version = 2;
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@
|
|||
# / (main-root)
|
||||
# /home (main-home)
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
{
|
||||
|
||||
imports = [
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
# sda: bootloader grub2
|
||||
# sda1: boot ext4 (label nixboot)
|
||||
# sda2: cryptoluks -> ext4
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
{
|
||||
boot = {
|
||||
loader.grub.enable = true;
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
# vda1 ext4 (label nixos) -> only root partition
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
{
|
||||
imports = [
|
||||
./single-partition-ext4.nix
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
# TODO: remove tv lib :)
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
|
||||
repos = priv-repos // krebs-repos ;
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
# TODO: remove tv lib :)
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
let
|
||||
|
||||
repos = priv-repos // krebs-repos // connector-repos ;
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
# graphite-web on port 8080
|
||||
# carbon cache on port 2003 (tcp/udp)
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
{
|
||||
imports = [ ];
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
{
|
||||
|
||||
imports = [ ./tp-x2x0.nix ];
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
{
|
||||
|
||||
imports = [ ./tp-x2x0.nix ];
|
||||
|
|
@ -16,10 +16,16 @@ with lib;
|
|||
};
|
||||
|
||||
services.xserver.displayManager.sessionCommands =''
|
||||
xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation" 8 1
|
||||
xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Button" 8 2
|
||||
xinput set-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Axes" 6 7 4 5
|
||||
# xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Timeout" 8 200
|
||||
xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation" 8 1
|
||||
xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Button" 8 2
|
||||
xinput set-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Axes" 6 7 4 5
|
||||
# xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Timeout" 8 200
|
||||
'';
|
||||
|
||||
# enable HDMI output switching with pulseaudio
|
||||
hardware.pulseaudio.configFile = pkgs.writeText "pulse-default-pa" ''
|
||||
${builtins.readFile "${config.hardware.pulseaudio.package}/etc/pulse/default.pa"}
|
||||
load-module module-alsa-sink device=hw:0,3 sink_properties=device.description="HDMIOutput" sink_name="HDMI"
|
||||
'';
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
{
|
||||
# TODO: put this somewhere else
|
||||
networking.wireless.enable = true;
|
||||
|
|
@ -18,18 +18,18 @@ with lib;
|
|||
sensitivity = 220;
|
||||
speed = 220;
|
||||
emulateWheel = true;
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
services.tlp.enable = true;
|
||||
services.tlp.extraConfig = ''
|
||||
START_CHARGE_THRESH_BAT0=80
|
||||
START_CHARGE_THRESH_BAT0=80
|
||||
|
||||
CPU_SCALING_GOVERNOR_ON_AC=performance
|
||||
CPU_SCALING_GOVERNOR_ON_BAT=ondemand
|
||||
CPU_MIN_PERF_ON_AC=0
|
||||
CPU_MAX_PERF_ON_AC=100
|
||||
CPU_MIN_PERF_ON_BAT=0
|
||||
CPU_MAX_PERF_ON_BAT=30
|
||||
CPU_SCALING_GOVERNOR_ON_AC=performance
|
||||
CPU_SCALING_GOVERNOR_ON_BAT=ondemand
|
||||
CPU_MIN_PERF_ON_AC=0
|
||||
CPU_MAX_PERF_ON_AC=100
|
||||
CPU_MIN_PERF_ON_BAT=0
|
||||
CPU_MAX_PERF_ON_BAT=30
|
||||
'';
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
msmtp
|
||||
|
|
|
|||
|
|
@ -3,8 +3,9 @@
|
|||
# stuff for the main laptop
|
||||
# this is pretty much nice-to-have and does
|
||||
# not fit into base-gui
|
||||
# TODO split generic desktop stuff and laptop-specifics like lidswitching
|
||||
|
||||
with lib;
|
||||
with config.krebs.lib;
|
||||
{
|
||||
imports = [
|
||||
./base-gui.nix
|
||||
|
|
@ -17,8 +18,10 @@ with lib;
|
|||
chromium
|
||||
keepassx
|
||||
ntfs3g
|
||||
at_spi2_core
|
||||
gnome3.dconf
|
||||
virtmanager
|
||||
at_spi2_core # dep for virtmanager?
|
||||
krebspaste
|
||||
];
|
||||
|
||||
services.redshift = {
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue