Merge remote-tracking branch 'gum/master'

krebs/3modules/makefu/default.nix

@@ -232,15 +232,16 @@ with config.krebs.lib;
           ip6.addr = "42:4b0b:d990:55ba:8da8:630f:dc0e:aae0";
           aliases = [
             "filepimp.retiolum"
+            "filepimp.r"
           ];
           tinc.pubkey = ''
             -----BEGIN RSA PUBLIC KEY-----
-            MIIBCgKCAQEAvgvzx3rT/3zLuCkzXk1ZkYBkG4lltxrLOLNivohw2XAzrYDIw/ZY
+            MIIBCgKCAQEA43w+A1TMOfugZ/CVwilJn4c36wWSjihaeVe7suZD0DSscKBcbkGg
-            BTDDcD424EkNOF6g/3tIRWqvVGZ1u12WQ9A/R+2F7i1SsaE4nTxdNlQ5rjy80gO3
+            3dTCSTnu6Qb9sYd2mKebKXLreO6nhEEoFGsRU0yw/1h8gl7mWYEdTifPfvM5EWwS
-            i1ZubMkTGwd1OYjJytYdcMTwM9V9/8QYFiiWqh77Xxu/FhY6PcQqwHxM7SMyZCJ7
+            wkN9dJ5njwIUSRyWH7QTsLkiRJVFN2UxEwrhAbo1FJ7yuhRgAKqKJSN4yPVViZwR
-            09gtZuR16ngKnKfo2tw6C3hHQtWCfORVbWQq5cmGzCb4sdIKow5BxUC855MulNsS
+            oHyyobvm/i2J+XSiDI9MRo74vNjnDLvO7R6ErIrhOPP1bD9fx3u+UYUfgS0iCO3X
-            u5l+G8wX+UbDI85VSDAtOP4QaSFzLL+U0aaDAmq0NO1QiODJoCo0iPhULZQTFZUa
+            UN0duBz/faRcl6IRytZOuHaIp30eJ4850ZK8RPz/Dqqj+USMFq60i0oMsuAi/ljB
-            OMDYHHfqzluEI7n8ENI4WwchDXH+MstsgwIDAQAB
+            8b+eQBt6OXu4MSntxoR8Ja7ht+EOTDnBOwIDAQAB
             -----END RSA PUBLIC KEY-----
             '';
         };
@@ -339,6 +340,35 @@ TNs2RYfwDy/r6H/hDeB/BSngPouedEVcPwIDAQAB
       ssh.privkey.path = <secrets/ssh_host_ed25519_key>;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcxWFEPzke/Sdd9qNX6rSJgXal8NmINYajpFCxXfYdj root@gum";
     };
+    shoney = rec {
+      cores = 1;
+      nets = {
+        internet = {
+          ip4.addr = "64.137.235.70";
+          aliases = [
+            "shoney.i"
+          ];
+        };
+        retiolum = {
+          ip4.addr = "10.243.205.131";
+          ip6.addr = "42:490d:cd82:d2bb:56d5:abd1:b88b:e8b4";
+          aliases = [
+            "shoney.retiolum"
+            "shoney.r"
+          ];
+          tinc.pubkey = ''
+            -----BEGIN RSA PUBLIC KEY-----
+            MIIBCgKCAQEAsYXzbotmODJqos+Ilve8WyO2qBti6eMDSOP59Aqb18h8A5b4tCTL
+            ygDo2xLLzRaINQAxfdaKcdMOWSEkiy1j/pBYs1tfqv4mT6BO+1t8LXz82D+YcT+4
+            okGXklZ/H5L+T9cynbpKIwzTrw0DuOUhzs/WRFJU60B4cJ0Tl3IQs5ePX1SevVht
+            M5n1ob47SCHxEuC+ZLNdLc6KRumcp3Ozk6Yxj3lZ0tqyngxY1C+1kTJwRyw9A7vO
+            +DAH8t1YusYi7ICHcYt5J1p0ZGizcs8oEnZLBy4D+bJX86g7zbix1lZ37LxDCpQ5
+            uCoAYFes7QqLVDYhucZ5ElRWdATM2mBtZwIDAQAB
+            -----END RSA PUBLIC KEY-----
+            '';
+        };
+      };
+    };
 
     # non-stockholm
 

makefu/1systems/omo.nix

@@ -5,9 +5,10 @@
 { config, pkgs, lib, ... }:
 let
   byid = dev: "/dev/disk/by-id/" + dev;
-  keyFile = "/dev/disk/by-id/usb-Verbatim_STORE_N_GO_070B3CEE0B223954-0:0";
+  keyFile = byid "usb-Verbatim_STORE_N_GO_070B3CEE0B223954-0:0";
-  rootDisk = byid "ata-INTEL_SSDSA2M080G2GC_CVPO003402PB080BGN";
+  rootDisk = byid "ata-SanDisk_SD8SNAT128G1122_162099420904";
-  homePartition = byid "ata-INTEL_SSDSA2M080G2GC_CVPO003402PB080BGN-part3";
+  rootPartition = byid "ata-SanDisk_SD8SNAT128G1122_162099420904-part2";
+  primaryInterface = "enp1s0";
   # cryptsetup luksFormat $dev --cipher aes-xts-plain64 -s 512 -h sha512
   # cryptsetup luksAddKey $dev tmpkey
   # cryptsetup luksOpen $dev crypt0 --key-file tmpkey --keyfile-size=4096
@@ -15,14 +16,14 @@ let
 
   # omo Chassis:
   # __FRONT_
-  # |* d2   |
+  # |* d0   |
   # |       |
   # |* d3   |
   # |       |
-  # |* d0   |
+  # |* d3   |
   # |       |
-  # |* d1   |
   # |*      |
+  # |* d2   |
   # |  * r0 |
   # |_______|
   cryptDisk0 = byid "ata-ST2000DM001-1CH164_Z240XTT6";
@@ -38,27 +39,31 @@ in {
     [
       ../.
       # TODO: unlock home partition via ssh
-      ../2configs/fs/single-partition-ext4.nix
+      ../2configs/fs/sda-crypto-root.nix
       ../2configs/zsh-user.nix
       ../2configs/exim-retiolum.nix
       ../2configs/smart-monitor.nix
       ../2configs/mail-client.nix
-      ../2configs/share-user-sftp.nix
+      #../2configs/graphite-standalone.nix
-      ../2configs/graphite-standalone.nix
+      #../2configs/share-user-sftp.nix
       ../2configs/omo-share.nix
+
+      ## as long as pyload is not in nixpkgs:
+      # docker run -d -v /var/lib/pyload:/opt/pyload/pyload-config -v /media/crypt0/pyload:/opt/pyload/Downloads --name pyload --restart=always -p 8112:8000 -P writl/pyload
     ];
 
   krebs.retiolum.enable = true;
-  networking.firewall.trustedInterfaces = [ "enp3s0" ];
+  networking.firewall.trustedInterfaces = [ primaryInterface ];
   # udp:137 udp:138 tcp:445 tcp:139 - samba, allowed in local net
   # tcp:80          - nginx for sharing files
   # tcp:655 udp:655 - tinc
   # tcp:8111        - graphite
+  # tcp:8112        - pyload
   # tcp:9090        - sabnzbd
   # tcp:9200        - elasticsearch
   # tcp:5601        - kibana
   networking.firewall.allowedUDPPorts = [ 655 ];
-  networking.firewall.allowedTCPPorts = [ 80 655 5601 8111 9200 9090 ];
+  networking.firewall.allowedTCPPorts = [ 80 655 5601 8111 8112 9200 9090 ];
 
   # services.openssh.allowSFTP = false;
 
@@ -66,6 +71,9 @@ in {
   services.sabnzbd.enable = true;
   systemd.services.sabnzbd.environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
 
+  virtualisation.docker.enable = true;
+
+
   # HDD Array stuff
   services.smartd.devices = builtins.map (x: { device = x; }) allDisks;
 
@@ -76,15 +84,11 @@ in {
     disks = map toMapper [ 0 1 ];
     parity = toMapper 2;
   };
+
   fileSystems = let
     cryptMount = name:
       { "/media/${name}" = { device = "/dev/mapper/${name}"; fsType = "xfs"; };};
-  in {
+  in   cryptMount "crypt0"
-    "/home" = {
-      device = "/dev/mapper/home";
-      fsType = "ext4";
-    };
-  } // cryptMount "crypt0"
     // cryptMount "crypt1"
     // cryptMount "crypt2";
 
@@ -101,15 +105,16 @@ in {
         usbkey = name: device: {
           inherit name device keyFile;
           keyFileSize = 4096;
+          allowDiscards = true;
         };
       in [
-        (usbkey "home" homePartition)
+        (usbkey "luksroot" rootPartition)
         (usbkey "crypt0" cryptDisk0)
         (usbkey "crypt1" cryptDisk1)
         (usbkey "crypt2" cryptDisk2)
       ];
     };
-    loader.grub.device = rootDisk;
+    loader.grub.device = lib.mkForce rootDisk;
 
     initrd.availableKernelModules = [
       "ahci"
@@ -121,12 +126,12 @@ in {
       "usbhid"
     ];
 
-    kernelModules = [ "kvm-amd" ];
+    kernelModules = [ "kvm-intel" ];
     extraModulePackages = [ ];
   };
 
   hardware.enableAllFirmware = true;
-  hardware.cpu.amd.updateMicrocode = true;
+  hardware.cpu.intel.updateMicrocode = true;
 
   zramSwap.enable = true;
 

makefu/1systems/pornocauster.nix

@@ -31,6 +31,7 @@
 
       # hardware specifics are in here
       ../2configs/hw/tp-x220.nix
+      ../2configs/hw/rtl8812au.nix
       # mount points
       ../2configs/fs/sda-crypto-root-home.nix
       # ../2configs/mediawiki.nix
@@ -59,7 +60,6 @@
   networking.firewall.allowedUDPPorts = [ 665 ];
 
   krebs.build.host = config.krebs.hosts.pornocauster;
-
   krebs.hosts.omo.nets.retiolum.via.ip4.addr = "192.168.1.11";
   krebs.retiolum = {
     enable = true;
@@ -68,4 +68,6 @@
   networking.extraHosts = ''
     192.168.1.11 omo.local
   '';
+  # hard dependency because otherwise the device will not be unlocked
+  boot.initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; allowDiscards=true; }];
 }

makefu/1systems/shoney.nix

@@ -0,0 +1,30 @@
+{ config, pkgs, ... }:
+let
+  ip = "64.137.235.70";
+  gw = "64.137.235.1";
+in {
+  imports = [
+    ../.
+    ../../tv/2configs/hw/CAC.nix
+    ../../tv/2configs/fs/CAC-CentOS-7-64bit.nix
+
+  ];
+
+  # minimal resources
+  services.nixosManual.enable = false;
+  programs.man.enable = false;
+  nix.gc.automatic = true;
+  nix.gc.dates = "03:10";
+
+  krebs = {
+    enable = true;
+    retiolum.enable = true;
+    build.host = config.krebs.hosts.shoney;
+  };
+  networking.interfaces.enp2s1.ip4 = [ {
+    address = ip;
+    prefixLength = 24;
+  } ];
+  networking.defaultGateway = gw;
+  networking.nameservers = [ "8.8.8.8" ];
+}

makefu/2configs/default.nix

@@ -154,6 +154,15 @@ with config.krebs.lib;
     "net.ipv6.conf.default.use_tempaddr" = 2;
   };
 
+  system.activationScripts.nix-defexpr = ''
+    (set -euf
+     for i in /home/makefu /root/;do
+       f="$i/.nix-defexpr"
+       rm -fr "$f"
+       ln -s /var/src/nixpkgs "$f"
+     done)
+  '';
+
   i18n = {
     consoleKeyMap = "us";
     defaultLocale = "en_US.UTF-8";

makefu/2configs/fs/sda-crypto-root.nix

@@ -1,16 +1,16 @@
 { config, lib, pkgs, ... }:
 
 # sda:  bootloader grub2
-# sda1: boot ext4 (label nixboot)
+# sda1: boot ext4 (label nixboot) - must be unlocked on boot if required:
+  # boot.initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; allowDiscards=true; }];
 # sda2: cryptoluks -> ext4
 with config.krebs.lib;
 {
   boot = {
     loader.grub.enable = true;
     loader.grub.version = 2;
-    loader.grub.device = "/dev/sda";
+    loader.grub.device = lib.mkDefault "/dev/sda";
 
-    initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; allowDiscards=true; }];
     initrd.luks.cryptoModules = ["aes" "sha512" "sha1" "xts" ];
     initrd.availableKernelModules = ["xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
   };

makefu/2configs/hw/fingerprint-reader.nix

@@ -0,0 +1,6 @@
+_: {
+  # add fingerprint with fprintd-enroll
+  services.fprintd.enable = true;
+  security.pam.services.login.fprintAuth = true;
+  security.pam.services.xscreensaver.fprintAuth = true;
+}

makefu/2configs/hw/tp-x220.nix

@@ -5,7 +5,7 @@ with config.krebs.lib;
 
   imports = [ ./tp-x2x0.nix ];
   boot = {
-    kernelModules = [ "kvm-intel" "acpi_call" ];
+    kernelModules = [ "kvm-intel" "acpi_call" "tpm-rng" ];
     extraModulePackages = [ config.boot.kernelPackages.tp_smapi ];
   };
 
@@ -28,7 +28,7 @@ with config.krebs.lib;
 
   # enable HDMI output switching with pulseaudio
   hardware.pulseaudio.configFile = pkgs.writeText "pulse-default-pa" ''
-    ${builtins.readFile "${config.hardware.pulseaudio.package}/etc/pulse/default.pa"}
+    ${builtins.readFile "${config.hardware.pulseaudio.package.out}/etc/pulse/default.pa"}
     load-module module-alsa-sink device=hw:0,3 sink_properties=device.description="HDMIOutput" sink_name="HDMI"
   '';
 

makefu/2configs/hw/tp-x2x0.nix

@@ -22,7 +22,8 @@ with config.krebs.lib;
 
   services.tlp.enable = true;
   services.tlp.extraConfig = ''
-    START_CHARGE_THRESH_BAT0=80
+    # BUG: http://linrunner.de/en/tlp/docs/tlp-faq.html#erratic-battery
+    #START_CHARGE_THRESH_BAT0=80
     STOP_CHARGE_THRESH_BAT0=95
 
     CPU_SCALING_GOVERNOR_ON_AC=performance

makefu/3modules/umts.nix

@@ -3,6 +3,14 @@
 with config.krebs.lib;
 
 let
+  nixpkgs-1509 = import (pkgs.fetchFromGitHub {
+    owner = "NixOS"; repo = "nixpkgs-channels";
+    rev = "91371c2bb6e20fc0df7a812332d99c38b21a2bda";
+    sha256 = "1as1i0j9d2n3iap9b471y4x01561r2s3vmjc5281qinirlr4al73";
+  }) {};
+
+  wvdial = nixpkgs-1509.wvdial; # https://github.com/NixOS/nixpkgs/issues/16113
+
   # TODO: currently it is only netzclub
   umts-bin = pkgs.writeScriptBin "umts" ''
     #!/bin/sh
@@ -62,7 +70,7 @@ let
         Type = "simple";
         Restart = "always";
         RestartSec = "10s";
-        ExecStart = "${pkgs.wvdial}/bin/wvdial -n";
+        ExecStart = "${wvdial}/bin/wvdial -n";
       };
     };
   };