makefu/stockholm
1
0
Fork 0
Code Issues Pull requests Actions1 Packages Projects Releases Wiki Activity

Merge branch 'master' of prism:stockholm

Browse source
This commit is contained in:
makefu 2019-04-26 20:35:52 +02:00
parent 95f6a06c5a cd825d9934
commit 2685464a60
No known key found for this signature in database
GPG key ID: 36F7711F3FC0F225
13 changed files with 157 additions and 155 deletions

5
krebs/2configs/reaktor2.nix
View file

@ -115,6 +115,11 @@ let
in {
users.users.reaktor2 = {
uid = genid_uint31 "reaktor2";
home = stateDir;
};
krebs.reaktor2 = {
freenode = {
hostname = "irc.freenode.org";

104
krebs/3modules/permown.nix
View file

@ -2,8 +2,8 @@ with import <stockholm/lib>;
{ config, pkgs, ... }: {
options.krebs.permown = mkOption {
default = [];
type = types.listOf (types.submodule {
default = {};
type = types.attrsOf (types.submodule ({ config, ... }: {
options = {
directory-mode = mkOption {
default = "=rwx";
@ -22,6 +22,7 @@ with import <stockholm/lib>;
type = types.username;
};
path = mkOption {
default = config._module.args.name;
type = types.absolute-pathname;
};
umask = mkOption {
@ -29,46 +30,73 @@ with import <stockholm/lib>;
type = types.file-mode;
};
};
});
}));
};
config.systemd.services = genAttrs' config.krebs.permown (plan: {
name = "permown.${replaceStrings ["/"] ["_"] plan.path}";
value = {
environment = {
DIR_MODE = plan.directory-mode;
FILE_MODE = plan.file-mode;
OWNER_GROUP = "${plan.owner}:${plan.group}";
ROOT_PATH = plan.path;
};
path = [
pkgs.coreutils
pkgs.findutils
pkgs.inotifyTools
];
serviceConfig = {
ExecStart = pkgs.writeDash "permown" ''
set -efu
config = let
plans = attrValues config.krebs.permown;
in mkIf (plans != []) {
find "$ROOT_PATH" -exec chown "$OWNER_GROUP" {} +
find "$ROOT_PATH" -type d -exec chmod "$DIR_MODE" {} +
find "$ROOT_PATH" -type f -exec chmod "$FILE_MODE" {} +
system.activationScripts.permown = let
mkdir = plan: /* sh */ ''
${pkgs.coreutils}/bin/mkdir -p ${shell.escape plan.path}
'';
in concatMapStrings mkdir plans;
inotifywait -mrq -e CREATE --format %w%f "$ROOT_PATH" |
while read -r path; do
if test -d "$path"; then
exec "$0" "$@"
fi
chown "$OWNER_GROUP" "$path"
chmod "$FILE_MODE" "$path"
done
'';
Restart = "always";
RestartSec = 10;
UMask = plan.umask;
systemd.services = genAttrs' plans (plan: {
name = "permown.${replaceStrings ["/"] ["_"] plan.path}";
value = {
environment = {
DIR_MODE = plan.directory-mode;
FILE_MODE = plan.file-mode;
OWNER_GROUP = "${plan.owner}:${plan.group}";
ROOT_PATH = plan.path;
};
path = [
pkgs.coreutils
pkgs.findutils
pkgs.inotifyTools
];
serviceConfig = {
ExecStart = pkgs.writeDash "permown" ''
set -efu
find "$ROOT_PATH" -exec chown -h "$OWNER_GROUP" {} +
find "$ROOT_PATH" -type d -exec chmod "$DIR_MODE" {} +
find "$ROOT_PATH" -type f -exec chmod "$FILE_MODE" {} +
paths=/tmp/paths
rm -f "$paths"
mkfifo "$paths"
inotifywait -mrq -e CREATE --format %w%f "$ROOT_PATH" > "$paths" &
inotifywaitpid=$!
trap cleanup EXIT
cleanup() {
kill "$inotifywaitpid"
}
while read -r path; do
if test -d "$path"; then
cleanup
exec "$0" "$@"
fi
chown -h "$OWNER_GROUP" "$path"
if test -f "$path"; then
chmod "$FILE_MODE" "$path"
fi
done < "$paths"
'';
PrivateTemp = true;
Restart = "always";
RestartSec = 10;
UMask = plan.umask;
};
wantedBy = [ "multi-user.target" ];
};
wantedBy = [ "multi-user.target" ];
};
});
});
};
}

9
krebs/3modules/syncthing.nix
View file

@ -10,7 +10,7 @@ let
addresses = peer.addresses;
}) cfg.peers;
folders = map (folder: {
folders = mapAttrsToList ( _: folder: {
inherit (folder) path id type;
devices = map (peer: { deviceId = cfg.peers.${peer}.id; }) folder.peers;
rescanIntervalS = folder.rescanInterval;
@ -81,17 +81,18 @@ in
};
folders = mkOption {
default = [];
type = types.listOf (types.submodule ({ config, ... }: {
default = {};
type = types.attrsOf (types.submodule ({ config, ... }: {
options = {
path = mkOption {
type = types.absolute-pathname;
default = config._module.args.name;
};
id = mkOption {
type = types.str;
default = config.path;
default = config._module.args.name;
};
peers = mkOption {

27
krebs/5pkgs/simple/qrscan.nix Normal file
View file

@ -0,0 +1,27 @@
{ coreutils, gnused, writeDashBin, zbar }:
writeDashBin "qrscan" ''
set -efu
tmpdir=$(${coreutils}/bin/mktemp --tmpdir -d qrscan.XXXXXXXX)
codefile=$tmpdir/code
cleanup() {
${coreutils}/bin/rm "$codefile"
${coreutils}/bin/rmdir "$tmpdir"
}
${coreutils}/bin/mkfifo "$codefile"
${zbar}/bin/zbarcam > "$codefile" &
zbarcampid=$!
exec < "$codefile"
while read -r code; do
code=$(printf %s "$code" | ${gnused}/bin/sed -n 's/^QR-Code://p')
if test -n "$code"; then
${coreutils}/bin/kill "$zbarcampid"
echo "$code"
fi
done
''

6
krebs/nixpkgs.json
View file

@ -1,7 +1,7 @@
{
"url": "https://github.com/NixOS/nixpkgs-channels",
"rev": "5c52b25283a6cccca443ffb7a358de6fe14b4a81",
"date": "2019-04-09T21:48:56+02:00",
"sha256": "0fhbl6bgabhi1sw1lrs64i0hibmmppy1bh256lq8hxy3a2p1haip",
"rev": "8ea36d732567c80b2d11eb029e10400fe85ca786",
"date": "2019-04-18T22:37:03+01:00",
"sha256": "1d59i55qwqd76n2d0hr1si26q333ydizkd91h8lfczb00xnr5pqn",
"fetchSubmodules": false
}

15
lass/1systems/mors/config.nix
View file

@ -49,12 +49,15 @@ with import <stockholm/lib>;
];
}
{
krebs.syncthing.folders = [
{ id = "the_playlist"; path = "/home/lass/tmp/the_playlist"; peers = [ "mors" "phone" "prism" ]; }
];
lass.ensure-permissions = [
{ folder = "/home/lass/tmp/the_playlist"; owner = "lass"; group = "syncthing"; }
];
krebs.syncthing.folders."the_playlist" = {
path = "/home/lass/tmp/the_playlist";
peers = [ "mors" "phone" "prism" ];
};
krebs.permown."/home/lass/tmp/the_playlist" = {
owner = "lass";
group = "syncthing";
umask = "0007";
};
}
{
lass.umts = {

13
lass/2configs/green-host.nix
View file

@ -20,13 +20,12 @@ with import <stockholm/lib>;
}
];
lass.ensure-permissions = [
{ folder = "/var/lib/sync-containers"; owner = "root"; group = "syncthing"; }
];
krebs.syncthing.folders = [
{ path = "/var/lib/sync-containers"; peers = [ "icarus" "skynet" "littleT" "shodan" ]; }
];
krebs.syncthing.folders."/var/lib/sync-containers".peers = [ "icarus" "skynet" "littleT" "shodan" ];
krebs.permown."/var/lib/sync-containers" = {
owner = "root";
group = "syncthing";
umask = "0007";
};
system.activationScripts.containerPermissions = ''
mkdir -p /var/lib/containers

19
lass/2configs/radio.nix
View file

@ -10,7 +10,7 @@ let
source-password = import <secrets/icecast-source-pw>;
add_random = pkgs.writeDashBin "add_random" ''
${pkgs.mpc_cli}/bin/mpc add "$(${pkgs.mpc_cli}/bin/mpc ls | shuf -n1)"
${pkgs.mpc_cli}/bin/mpc add "$(${pkgs.mpc_cli}/bin/mpc ls the_playlist/music | grep '\.ogg$' | shuf -n1)"
'';
skip_track = pkgs.writeDashBin "skip_track" ''
@ -57,7 +57,7 @@ in {
services.mpd = {
enable = true;
group = "radio";
musicDirectory = "/home/radio/the_playlist/music";
musicDirectory = "/home/radio/music";
extraConfig = ''
log_level "default"
auto_update "yes"
@ -248,10 +248,13 @@ in {
alias ${html};
'';
};
krebs.syncthing.folders = [
{ id = "the_playlist"; path = "/home/radio/music/the_playlist"; peers = [ "mors" "phone" "prism" ]; }
];
lass.ensure-permissions = [
{ folder = "/home/radio/music/the_playlist"; owner = "radio"; group = "syncthing"; }
];
krebs.syncthing.folders."the_playlist" = {
path = "/home/radio/music/the_playlist";
peers = [ "mors" "phone" "prism" ];
};
krebs.permown."/home/radio/music/the_playlist" = {
owner = "radio";
group = "syncthing";
umask = "0002";
};
}

15
lass/2configs/sync/decsync.nix
View file

@ -1,8 +1,11 @@
{
krebs.syncthing.folders = [
{ id = "decsync"; path = "/home/lass/decsync"; peers = [ "mors" "blue" "green" "phone" ]; }
];
lass.ensure-permissions = [
{ folder = "/home/lass/decsync"; owner = "lass"; group = "syncthing"; }
];
krebs.syncthing.folders.decsync = {
path = "/home/lass/decsync";
peers = [ "mors" "blue" "green" "phone" ];
};
krebs.permown."/home/lass/decsync" = {
owner = "lass";
group = "syncthing";
umask = "0007";
};
}

12
lass/2configs/sync/weechat.nix
View file

@ -1,8 +1,8 @@
{
krebs.syncthing.folders = [
{ path = "/home/lass/.weechat"; peers = [ "blue" "green" "mors" ]; }
];
lass.ensure-permissions = [
{ folder = "/home/lass/.weechat"; owner = "lass"; group = "syncthing"; }
];
krebs.syncthing.folders."/home/lass/.weechat".peers = [ "blue" "green" "mors" ];
krebs.permown."/home/lass/.weechat" = {
owner = "lass";
group = "syncthing";
umask = "0007";
};
}

20
lass/2configs/syncthing.nix
View file

@ -1,6 +1,6 @@
{ config, pkgs, ... }:
with import <stockholm/lib>;
{
{ config, pkgs, ... }: with import <stockholm/lib>; let
peers = mapAttrs (n: v: { id = v.syncthing.id; }) (filterAttrs (n: v: v.syncthing.id != null) config.krebs.hosts);
in {
services.syncthing = {
enable = true;
group = "syncthing";
@ -14,17 +14,17 @@ with import <stockholm/lib>;
enable = true;
cert = toString <secrets/syncthing.cert>;
key = toString <secrets/syncthing.key>;
peers = mapAttrs (n: v: { id = v.syncthing.id; }) (filterAttrs (n: v: v.syncthing.id != null) config.krebs.hosts);
folders = [
{ path = "/home/lass/sync"; peers = [ "icarus" "mors" "skynet" "blue" "green" "littleT" "prism" "shodan" ]; }
];
peers = peers;
folders."/home/lass/sync".peers = attrNames peers;
};
system.activationScripts.syncthing-home = ''
${pkgs.coreutils}/bin/chmod a+x /home/lass
'';
lass.ensure-permissions = [
{ folder = "/home/lass/sync"; owner = "lass"; group = "syncthing"; }
];
krebs.permown."/home/lass/sync" = {
owner = "lass";
group = "syncthing";
umask = "0007";
};
}

1
lass/3modules/default.nix
View file

@ -3,7 +3,6 @@ _:
imports = [
./dnsmasq.nix
./ejabberd
./ensure-permissions.nix
./folderPerms.nix
./hosts.nix
./mysql-backup.nix

66
lass/3modules/ensure-permissions.nix
View file

@ -1,66 +0,0 @@
{ config, pkgs, ... }: with import <stockholm/lib>;
let
cfg = config.lass.ensure-permissions;
in
{
options.lass.ensure-permissions = mkOption {
default = [];
type = types.listOf (types.submodule ({
options = {
folder = mkOption {
type = types.absolute-pathname;
};
owner = mkOption {
# TODO user type
type = types.str;
default = "root";
};
group = mkOption {
# TODO group type
type = types.str;
default = "root";
};
permission = mkOption {
# TODO permission type
type = types.str;
default = "u+rw,g+rw";
};
};
}));
};
config = mkIf (cfg != []) {
system.activationScripts.ensure-permissions = concatMapStringsSep "\n" (plan: ''
${pkgs.coreutils}/bin/mkdir -p ${plan.folder}
${pkgs.coreutils}/bin/chmod -R ${plan.permission} ${plan.folder}
${pkgs.coreutils}/bin/chown -R ${plan.owner}:${plan.group} ${plan.folder}
'') cfg;
systemd.services =
listToAttrs (map (plan: nameValuePair "ensure-permisson.${replaceStrings ["/"] ["_"] plan.folder}" {
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Restart = "always";
RestartSec = 10;
ExecStart = pkgs.writeDash "ensure-perms" ''
${pkgs.inotifyTools}/bin/inotifywait -mrq -e CREATE --format %w%f ${plan.folder} \
| while IFS= read -r FILE; do
${pkgs.coreutils}/bin/chmod -R ${plan.permission} "$FILE" 2>/dev/null
${pkgs.coreutils}/bin/chown -R ${plan.owner}:${plan.group} "$FILE" 2>/dev/null
done
'';
};
}) cfg)
;
};
}