From ccb34ca338bec3219c0d25e1a5518548ce7ec898 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 23 Jul 2016 13:29:39 +0200
Subject: [PATCH] mv: reinit
---
krebs/3modules/default.nix | 1 +
krebs/3modules/mv/default.nix | 41 ++++++++
krebs/3modules/tv/default.nix | 2 +-
mv/1systems/stro.nix | 172 +++++++++++++++++++++++++++++++++
tv/2configs/exim-smarthost.nix | 2 +-
5 files changed, 216 insertions(+), 2 deletions(-)
create mode 100644 krebs/3modules/mv/default.nix
create mode 100644 mv/1systems/stro.nix
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index a38d2b227..d64d8047a 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -91,6 +91,7 @@ let
imp = lib.mkMerge [
{ krebs = import ./lass { inherit config lib; }; }
{ krebs = import ./makefu { inherit config lib; }; }
+ { krebs = import ./mv { inherit config lib; }; }
{ krebs = import ./shared { inherit config lib; }; }
{ krebs = import ./tv { inherit config lib; }; }
{
diff --git a/krebs/3modules/mv/default.nix b/krebs/3modules/mv/default.nix
new file mode 100644
index 000000000..dc47d8983
--- /dev/null
+++ b/krebs/3modules/mv/default.nix
@@ -0,0 +1,41 @@
+{ config, ... }:
+
+with config.krebs.lib;
+
+{
+ hosts = mapAttrs (_: setAttr "owner" config.krebs.users.mv) {
+ stro = {
+ cores = 4;
+ nets = {
+ retiolum = {
+ ip4.addr = "10.243.111.111";
+ ip6.addr = "42:0:0:0:0:0:111:111";
+ aliases = [
+ "stro.r"
+ "cgit.stro.r"
+ "stro.retiolum"
+ "cgit.stro.retiolum"
+ ];
+ tinc.pubkey = ''
+ -----BEGIN RSA PUBLIC KEY-----
+ MIIBCgKCAQEA0vIzLyoetOyi3R7qOh3gjSvUVjPEdqCvd0NEevDCIhhFy0nIbZ/b
+ vnuk3EUeTb6e384J8fKB4agig0JeR3JjtDvtjy5g9Cdy2nrU71w8wqU0etmv2PTb
+ FjbCFfeBXn0N3U7gXwjZGCvjAXa1a4jGb4R2iYBYGG3aY4reCN8B8Ah81h+S0oLg
+ ZJJfaBmWM5vNRFEI5X4CLaVnwtsoZuXIjYStgNn/9Mg/Y6NQS0H0H+HFeyhigAqG
+ oYGqNar/2QqPU176V/FwrD30F3qJV1uyzuPta7hmdfOxqYjZ/jqdPSRYtlunYYcq
+ XbH5oYmzO9NEeVWzjdac/DiV2OP8HufoYwIDAQAB
+ -----END RSA PUBLIC KEY-----
+ '';
+ };
+ };
+ ssh.privkey.path = <secrets/ssh.ed25519>;
+ ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+7Qa51l0NSkBiaK2s8vQEoeObV3UPZyEzMxfUK/ZAO root@stro";
+ };
+ };
+ users = {
+ mv = {
+ mail = "mv@stro.r";
+ pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDfMqkfXsGRaXJ86Pi5svAx4508ij5kc4cMLGwr1CLvFI5G7EHggiHMZYooibmkZimBF1PvLM1lOdoptJ4nSmc3UGuQaeV9BpZ1dNXexc8wOmVPKzAHYZG/2upcV/xVZQ9lk3UOmDym6fDUXThMx4nXdhOjScgWpKp7+0N3JRCf2UHusZjWFGlhE9l4irLFHCwlZeBQ16DNF4fc03vsfZBB1ZrGGZlaVpkcY+FTC3sm8R0iF5QGaq8PgltJoCNnp3L1g3Yn7Elva7kCHjZfJC1pu5icV8vZMNptPn1b10gPsNwb302FCjvZohzRcMo39L2gwdNWQmflYfYk+NPY9EgqkLtSvZJywYu8oTVLeYBAp0ZGzJR4+uIH9at/WQF499HFMxpF4uwYiQweUcPiHrrOqI5zLQoOvqh9Jv0UMsnFynNrszbCTgwzeW8bcvv8ILcjE9of8GXRCrlIMvt7Z9q8xrb5j1RhKscvusyyNOAL+HMZl6jgSxUBDtzRqPZ62QHJsBEBdRXdJRQLGeHNW9kGPrh/tiKGucuT3/HZC+2Rcemxt3RVT60+lHkghrMLi0/VOWBUKL9J94UK5xIE4Gb3RTW9DcNK53U4ql+N4ORSSEuhk3Rqzx3Bzv7AXpLKQCFKdB7tjxzGN7sCQM3PBUUo6Tk0VG2cIKOjzTRnDJlb7Q== mv@stro";
+ };
+ };
+}
diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index d04f1cab2..a933cbddb 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -418,7 +418,7 @@ with config.krebs.lib;
dv = {
mail = "dv@alnus.r";
};
- mv = {
+ mv-cd = {
mail = "mv@cd.r";
pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGer9e2+Lew7vnisgBbsFNECEIkpNJgEaqQqgb9inWkQ mv@vod";
};
diff --git a/mv/1systems/stro.nix b/mv/1systems/stro.nix
new file mode 100644
index 000000000..c948754df
--- /dev/null
+++ b/mv/1systems/stro.nix
@@ -0,0 +1,172 @@
+{ config, lib, pkgs, ... }:
+
+with config.krebs.lib;
+
+{
+ krebs = {
+ enable = true;
+ build = {
+ user = config.krebs.users.mv;
+ host = config.krebs.hosts.stro;
+ source = let
+ HOME = getEnv "HOME";
+ host = config.krebs.build.host;
+ in {
+ nixos-config.symlink = "stockholm/mv/1systems/${host.name}.nix";
+ secrets.file = "${HOME}/secrets/${host.name}";
+ stockholm.file = "${HOME}/stockholm";
+ nixpkgs.git = {
+ url = https://github.com/NixOS/nixpkgs;
+ ref = "8bf31d7d27cae435d7c1e9e0ccb0a320b424066f";
+ };
+ };
+ };
+ };
+
+ imports = [
+ <secrets>
+ <stockholm/krebs>
+ <stockholm/tv/2configs/audit.nix>
+ <stockholm/tv/2configs/bash.nix>
+ <stockholm/tv/2configs/exim-retiolum.nix>
+ <stockholm/tv/2configs/hw/x220.nix>
+ <stockholm/tv/2configs/im.nix>
+ <stockholm/tv/2configs/mail-client.nix>
+ <stockholm/tv/2configs/retiolum.nix>
+ <stockholm/tv/2configs/ssh.nix>
+ <stockholm/tv/2configs/sshd.nix>
+ <stockholm/tv/2configs/vim.nix>
+ <stockholm/tv/2configs/xdg.nix>
+ <stockholm/tv/2configs/xserver>
+ <stockholm/tv/3modules>
+ <stockholm/tv/5pkgs>
+ ];
+
+ boot.kernel.sysctl = {
+ # Enable IPv6 Privacy Extensions
+ "net.ipv6.conf.all.use_tempaddr" = 2;
+ "net.ipv6.conf.default.use_tempaddr" = 2;
+ };
+
+ boot.initrd.luks = {
+ cryptoModules = [ "aes" "sha512" "xts" ];
+ devices = [
+ {
+ name = "luks1";
+ device = "/dev/disk/by-id/ata-TOSHIBA-TR150_467B50JXK8WU-part2";
+ }
+ ];
+ };
+
+ environment = {
+ profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
+ shellAliases = mkForce {
+ gp = "${pkgs.pari}/bin/gp -q";
+ df = "df -h";
+ du = "du -h";
+ ls = "ls -h --color=auto --group-directories-first";
+ dmesg = "dmesg -L --reltime";
+ view = "vim -R";
+
+ reload = "systemctl reload";
+ restart = "systemctl restart";
+ start = "systemctl start";
+ status = "systemctl status";
+ stop = "systemctl stop";
+ };
+ systemPackages = with pkgs; [
+ dic
+ htop
+ p7zip
+ q
+
+ pavucontrol
+ rxvt_unicode.terminfo
+
+ # stockholm
+ git
+ gnumake
+ populate
+ ];
+ variables = {
+ NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src";
+ };
+ };
+
+ fileSystems = {
+ "/boot" = {
+ device = "/dev/disk/by-id/ata-TOSHIBA-TR150_467B50JXK8WU-part1";
+ };
+ "/" = {
+ device = "/dev/mapper/vg1-root";
+ fsType = "btrfs";
+ options = ["defaults" "noatime" "ssd" "compress=lzo"];
+ };
+ "/home" = {
+ device = "/dev/mapper/vg1-home";
+ fsType = "btrfs";
+ options = ["defaults" "noatime" "ssd" "compress=lzo"];
+ };
+ "/tmp" = {
+ device = "tmpfs";
+ fsType = "tmpfs";
+ options = ["nosuid" "nodev" "noatime"];
+ };
+ };
+
+ hardware.pulseaudio = {
+ enable = true;
+ systemWide = true;
+ };
+
+ networking.hostName = config.krebs.build.host.name;
+
+ nix = {
+ binaryCaches = ["https://cache.nixos.org"];
+ # TODO check if both are required:
+ chrootDirs = [ "/etc/protocols" pkgs.iana_etc.outPath ];
+ requireSignedBinaryCaches = true;
+ useChroot = true;
+ };
+
+ nixpkgs.config.allowUnfree = false;
+
+ users = {
+ defaultUserShell = "/run/current-system/sw/bin/bash";
+ mutableUsers = false;
+ users = {
+ mv = {
+ inherit (config.krebs.users.mv) home uid;
+ isNormalUser = true;
+ };
+ };
+ };
+
+ security.setuidPrograms = [
+ "sendmail"
+ ];
+
+ security.sudo.extraConfig = ''
+ Defaults env_keep+="SSH_CLIENT"
+ Defaults mailto="${config.krebs.users.mv.mail}"
+ Defaults !lecture
+ '';
+
+ services.cron.enable = false;
+ services.journald.extraConfig = ''
+ SystemMaxUse=1G
+ RuntimeMaxUse=128M
+ '';
+ services.nscd.enable = false;
+ services.ntp.enable = false;
+ services.timesyncd.enable = true;
+
+ time.timeZone = "Europe/Berlin";
+
+ tv.iptables = {
+ enable = true;
+ accept-echo-request = "internet";
+ };
+
+ system.stateVersion = "16.03";
+}
diff --git a/tv/2configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix
index 351b54da1..cade6fa7b 100644
--- a/tv/2configs/exim-smarthost.nix
+++ b/tv/2configs/exim-smarthost.nix
@@ -20,7 +20,7 @@ with config.krebs.lib;
];
internet-aliases = with config.krebs.users; [
{ from = "postmaster@viljetic.de"; to = tv.mail; } # RFC 822
- { from = "mirko@viljetic.de"; to = mv.mail; }
+ { from = "mirko@viljetic.de"; to = mv-cd.mail; }
{ from = "tomislav@viljetic.de"; to = tv.mail; }
{ from = "tv@destroy.dyn.shackspace.de"; to = tv.mail; }
{ from = "tv@viljetic.de"; to = tv.mail; }