From 271c7843120dc079c6507fc2d7d08fff9105e3a5 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Thu, 25 Feb 2016 13:45:23 +0100
Subject: [PATCH 01/12] tv: sudoers env_keep += SSH_CLIENT
---
tv/2configs/default.nix | 1 +
1 file changed, 1 insertion(+)
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 5a1e90bc4..9b83997bb 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -49,6 +49,7 @@ with config.krebs.lib;
}
{
security.sudo.extraConfig = ''
+ Defaults env_keep+="SSH_CLIENT"
Defaults mailto="${config.krebs.users.tv.mail}"
Defaults !lecture
'';
From 186708147fd96d87134e4b0ab1f8c0577eab7376 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 27 Feb 2016 12:10:57 +0100
Subject: [PATCH 02/12] tv vim: simplify extra-runtimepath generation
---
tv/2configs/vim.nix | 14 +++++---------
1 file changed, 5 insertions(+), 9 deletions(-)
diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index b0c26e50e..6e2059484 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -13,21 +13,17 @@ let
environment.variables.VIMINIT = ":so /etc/vimrc";
};
- extra-runtimepath = let
- inherit (pkgs.vimUtils) buildVimPlugin rtpPath;
- fromVimPlugins = pkgs: concatStringsSep ","
- (mapAttrsToList (name: pkg: "${pkg}/${rtpPath}/${name}") pkgs);
- in fromVimPlugins {
- inherit (pkgs.vimPlugins) undotree;
- file-line = buildVimPlugin {
+ extra-runtimepath = concatMapStringsSep "," (pkg: "${pkg.rtp}") [
+ pkgs.vimPlugins.undotree
+ (pkgs.vimUtils.buildVimPlugin {
name = "file-line-1.0";
src = pkgs.fetchgit {
url = git://github.com/bogado/file-line;
rev = "refs/tags/1.0";
sha256 = "0z47zq9rqh06ny0q8lpcdsraf3lyzn9xvb59nywnarf3nxrk6hx0";
};
- };
- };
+ })
+ ];
dirs = {
backupdir = "$HOME/.cache/vim/backup";
From cc395214f58e4ac1d95e9855d4cf4784fa75d17e Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 27 Feb 2016 12:39:29 +0100
Subject: [PATCH 03/12] tv nixpkgs: 77f8f35 -> 40c586b
---
tv/2configs/default.nix | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 9b83997bb..02b3b61cf 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -14,8 +14,7 @@ with config.krebs.lib;
stockholm = "/home/tv/stockholm";
nixpkgs = {
url = https://github.com/NixOS/nixpkgs;
- rev = "77f8f35d57618c1ba456d968524f2fb2c3448295";
- dev = "/home/tv/nixpkgs";
+ rev = "40c586b7ce2c559374df435f46d673baf711c543";
};
} // optionalAttrs config.krebs.build.host.secure {
secrets-master = "/home/tv/secrets/master";
From 7cff3c0650acc6c1c07d578faa9bb35ff61266bc Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 27 Feb 2016 13:10:21 +0100
Subject: [PATCH 04/12] tv sendmail: setuid in exim-*
---
tv/2configs/default.nix | 6 ------
tv/2configs/exim-retiolum.nix | 4 ++++
tv/2configs/exim-smarthost.nix | 4 ++++
3 files changed, 8 insertions(+), 6 deletions(-)
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 02b3b61cf..1e0da8da4 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -177,12 +177,6 @@ with config.krebs.lib;
tv.iptables.input-internet-accept-new-tcp = singleton "ssh";
}
- {
- # TODO: exim
- security.setuidPrograms = [
- "sendmail" # for sudo
- ];
- }
{
environment.systemPackages = [
pkgs.get
diff --git a/tv/2configs/exim-retiolum.nix b/tv/2configs/exim-retiolum.nix
index 9197a3c30..dbe83dcf1 100644
--- a/tv/2configs/exim-retiolum.nix
+++ b/tv/2configs/exim-retiolum.nix
@@ -4,5 +4,9 @@ with config.krebs.lib;
{
krebs.exim-retiolum.enable = true;
+ krebs.setuid.sendmail = {
+ filename = "${pkgs.exim}/bin/exim";
+ mode = "4111";
+ };
tv.iptables.input-retiolum-accept-new-tcp = singleton "smtp";
}
diff --git a/tv/2configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix
index 75dd9b42f..3ea010524 100644
--- a/tv/2configs/exim-smarthost.nix
+++ b/tv/2configs/exim-smarthost.nix
@@ -40,5 +40,9 @@ with config.krebs.lib;
{ from = "mirko"; to = "mv"; }
];
};
+ krebs.setuid.sendmail = {
+ filename = "${pkgs.exim}/bin/exim";
+ mode = "4111";
+ };
tv.iptables.input-internet-accept-new-tcp = singleton "smtp";
}
From 2ea539c80f48060aeb86b3522fde73c832b793cd Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 27 Feb 2016 13:10:59 +0100
Subject: [PATCH 05/12] krebs.setuid.*.mode: use mergeOneOption
---
krebs/3modules/setuid.nix | 1 +
1 file changed, 1 insertion(+)
diff --git a/krebs/3modules/setuid.nix b/krebs/3modules/setuid.nix
index 1137788d8..cfb8382e8 100644
--- a/krebs/3modules/setuid.nix
+++ b/krebs/3modules/setuid.nix
@@ -46,6 +46,7 @@ let
check = x:
isString x &&
match "[0-7][0-7][0-7][0-7]" x != null;
+ merge = mergeOneOption;
};
};
activate = mkOption {
From f7165409a511582507f465162609676c7b6ef0df Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 27 Feb 2016 13:16:24 +0100
Subject: [PATCH 06/12] jq: rip
---
krebs/5pkgs/default.nix | 2 +-
krebs/5pkgs/jq/default.nix | 33 ---------------------------------
2 files changed, 1 insertion(+), 34 deletions(-)
delete mode 100644 krebs/5pkgs/jq/default.nix
diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix
index d395fe00a..f7997dd63 100644
--- a/krebs/5pkgs/default.nix
+++ b/krebs/5pkgs/default.nix
@@ -17,7 +17,7 @@ with config.krebs.lib;
};
push = pkgs.callPackage ./push {
- inherit (subdirs) get jq;
+ inherit (subdirs) get;
};
ReaktorPlugins = pkgs.callPackage ./Reaktor/plugins.nix {};
diff --git a/krebs/5pkgs/jq/default.nix b/krebs/5pkgs/jq/default.nix
deleted file mode 100644
index 41db0f284..000000000
--- a/krebs/5pkgs/jq/default.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{stdenv, fetchurl}:
-let
- s = # Generated upstream information
- rec {
- baseName="jq";
- version="1.5";
- name="${baseName}-${version}";
- url=https://github.com/stedolan/jq/releases/download/jq-1.5/jq-1.5.tar.gz;
- sha256="0g29kyz4ykasdcrb0zmbrp2jqs9kv1wz9swx849i2d1ncknbzln4";
- };
- buildInputs = [
- ];
-in
-stdenv.mkDerivation {
- inherit (s) name version;
- inherit buildInputs;
- src = fetchurl {
- inherit (s) url sha256;
- };
-
- # jq is linked to libjq:
- configureFlags = [
- "LDFLAGS=-Wl,-rpath,\\\${libdir}"
- ];
- meta = {
- inherit (s) version;
- description = ''A lightweight and flexible command-line JSON processor'';
- license = stdenv.lib.licenses.mit ;
- maintainers = [stdenv.lib.maintainers.raskin];
- platforms = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
- };
-}
-
From 94154606cb011a53bfd81b52dbc60cbdf416371e Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 27 Feb 2016 15:13:10 +0100
Subject: [PATCH 07/12] tv wu-binary-cache: init
---
krebs/3modules/tv/default.nix | 5 ++++-
tv/1systems/wu.nix | 1 +
tv/2configs/wu-binary-cache/client.nix | 7 +++++++
tv/2configs/wu-binary-cache/default.nix | 25 +++++++++++++++++++++++++
4 files changed, 37 insertions(+), 1 deletion(-)
create mode 100644 tv/2configs/wu-binary-cache/client.nix
create mode 100644 tv/2configs/wu-binary-cache/default.nix
diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index 533502914..d8b5da007 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -286,7 +286,10 @@ with config.krebs.lib;
nets = {
gg23 = {
addrs4 = ["10.23.1.37"];
- aliases = ["wu.gg23"];
+ aliases = [
+ "wu.gg23"
+ "cache.wu.gg23"
+ ];
ssh.port = 11423;
};
retiolum = {
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 8c363d9fc..d64deaf95 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -16,6 +16,7 @@ with config.krebs.lib;
../2configs/nginx-public_html.nix
../2configs/pulse.nix
../2configs/retiolum.nix
+ ../2configs/wu-binary-cache
../2configs/xserver
{
environment.systemPackages = with pkgs; [
diff --git a/tv/2configs/wu-binary-cache/client.nix b/tv/2configs/wu-binary-cache/client.nix
new file mode 100644
index 000000000..9634c21d4
--- /dev/null
+++ b/tv/2configs/wu-binary-cache/client.nix
@@ -0,0 +1,7 @@
+_:
+{
+ nix = {
+ binaryCaches = ["http://cache.wu.gg23"];
+ binaryCachePublicKeys = ["cache.wu-1:cdhA201O2R2Ect463vhJFmhpMaNyT/tOvzYvtceT9q8="];
+ };
+}
diff --git a/tv/2configs/wu-binary-cache/default.nix b/tv/2configs/wu-binary-cache/default.nix
new file mode 100644
index 000000000..6fcac21af
--- /dev/null
+++ b/tv/2configs/wu-binary-cache/default.nix
@@ -0,0 +1,25 @@
+{ config, lib, pkgs, ... }: with config.krebs.lib;
+{
+ services.nix-serve = assert config.krebs.build.host.name == "wu"; {
+ enable = true;
+ secretKeyFile = config.krebs.secret.files.nix-serve-key.path;
+ };
+ systemd.services.nix-serve = {
+ requires = ["secret.service"];
+ after = ["secret.service"];
+ };
+ krebs.secret.files.nix-serve-key = {
+ path = "/run/secret/nix-serve.key";
+ owner.name = "nix-serve";
+ source-path = toString <secrets> + "/nix-serve.key";
+ };
+ krebs.nginx = {
+ enable = true;
+ servers.nix-serve = {
+ server-names = [ "cache.wu.gg23" ];
+ locations = singleton (nameValuePair "/" ''
+ proxy_pass http://localhost:${toString config.services.nix-serve.port};
+ '');
+ };
+ };
+}
From 35d7bc99463590c54e55b39e2bca5cb9083e9e76 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 27 Feb 2016 15:13:44 +0100
Subject: [PATCH 08/12] tv: nix.requireSignedBinaryCaches = true
---
tv/2configs/default.nix | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 1e0da8da4..0a3e40a5c 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -54,15 +54,14 @@ with config.krebs.lib;
'';
time.timeZone = "Europe/Berlin";
}
+
{
# TODO check if both are required:
nix.chrootDirs = [ "/etc/protocols" pkgs.iana_etc.outPath ];
- nix.trustedBinaryCaches = [
- "https://cache.nixos.org"
- "http://cache.nixos.org"
- "http://hydra.nixos.org"
- ];
+ nix.requireSignedBinaryCaches = true;
+
+ nix.binaryCaches = ["https://cache.nixos.org"];
nix.useChroot = true;
}
From 766cd8cbf0945653381546fd6834d3df82e15bdf Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 27 Feb 2016 15:24:06 +0100
Subject: [PATCH 09/12] nomic,xu: use wu-binary-cache
---
tv/1systems/nomic.nix | 1 +
tv/1systems/xu.nix | 1 +
2 files changed, 2 insertions(+)
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 45320690b..fa9c90816 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -15,6 +15,7 @@ with config.krebs.lib;
../2configs/nginx-public_html.nix
../2configs/pulse.nix
../2configs/retiolum.nix
+ ../2configs/wu-binary-cache/client.nix
../2configs/xserver
];
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index c6a69a85a..155310602 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -15,6 +15,7 @@ with config.krebs.lib;
../2configs/nginx-public_html.nix
../2configs/pulse.nix
../2configs/retiolum.nix
+ ../2configs/wu-binary-cache/client.nix
../2configs/xserver
../2configs/xu-qemu0.nix
{
From ad9d704ac32c30a90dda792b9ce983cd2166bcc1 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 27 Feb 2016 15:39:53 +0100
Subject: [PATCH 10/12] tv: mute random new filesystem option deprecation
warning
---
tv/1systems/wu.nix | 6 +++---
tv/1systems/xu.nix | 6 +++---
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index d64deaf95..0bf242109 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -127,12 +127,12 @@ with config.krebs.lib;
"/" = {
device = "/dev/mapper/vg840-wuroot";
fsType = "btrfs";
- options = "defaults,noatime,ssd,compress=lzo";
+ options = ["defaults" "noatime" "ssd" "compress=lzo"];
};
"/home" = {
device = "/dev/mapper/home";
fsType = "btrfs";
- options = "defaults,noatime,ssd,compress=lzo";
+ options = ["defaults" "noatime" "ssd" "compress=lzo"];
};
"/boot" = {
device = "/dev/sda1";
@@ -140,7 +140,7 @@ with config.krebs.lib;
"/tmp" = {
device = "tmpfs";
fsType = "tmpfs";
- options = "nosuid,nodev,noatime";
+ options = ["nosuid" "nodev" "noatime"];
};
};
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 155310602..46fb59ff3 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -138,12 +138,12 @@ with config.krebs.lib;
"/" = {
device = "/dev/mapper/xuvga-root";
fsType = "btrfs";
- options = "defaults,noatime,ssd,compress=lzo";
+ options = ["defaults" "noatime" "ssd" "compress=lzo"];
};
"/home" = {
device = "/dev/mapper/xuvga-home";
fsType = "btrfs";
- options = "defaults,noatime,ssd,compress=lzo";
+ options = ["defaults" "noatime" "ssd" "compress=lzo"];
};
"/boot" = {
device = "/dev/sda1";
@@ -151,7 +151,7 @@ with config.krebs.lib;
"/tmp" = {
device = "tmpfs";
fsType = "tmpfs";
- options = "nosuid,nodev,noatime";
+ options = ["nosuid" "nodev" "noatime"];
};
};
From 9db6d9db717c6180ca3a0b3bcbf57d48c44ca855 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 27 Feb 2016 15:48:58 +0100
Subject: [PATCH 11/12] krebs.hosts.{gum,ire}.nets.retiolum.via = internet
---
krebs/3modules/makefu/default.nix | 3 ++-
krebs/3modules/tv/default.nix | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index d309c1714..ccf21c868 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -323,7 +323,7 @@ TNs2RYfwDy/r6H/hDeB/BSngPouedEVcPwIDAQAB
cgit.euer IN A ${head nets.internet.addrs4}
'';
};
- nets = {
+ nets = rec {
internet = {
addrs4 = ["195.154.108.70"];
aliases = [
@@ -331,6 +331,7 @@ TNs2RYfwDy/r6H/hDeB/BSngPouedEVcPwIDAQAB
];
};
retiolum = {
+ via = internet;
addrs4 = ["10.243.0.211"];
addrs6 = ["42:f9f0:0000:0000:0000:0000:0000:70d2"];
aliases = [
diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index d8b5da007..a0237d361 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -104,7 +104,7 @@ with config.krebs.lib;
ire 60 IN A ${elemAt nets.internet.addrs4 0}
'';
};
- nets = {
+ nets = rec {
internet = {
addrs4 = ["198.147.22.115"];
aliases = [
@@ -115,6 +115,7 @@ with config.krebs.lib;
ssh.port = 11423;
};
retiolum = {
+ via = internet;
addrs4 = ["10.243.231.66"];
addrs6 = ["42:b912:0f42:a82d:0d27:8610:e89b:490c"];
aliases = [
From 8c859335a879c515a1415bc8b15b5cb7eb519efc Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 27 Feb 2016 17:23:59 +0100
Subject: [PATCH 12/12] krebs.nginx: s/optionSet/submodule/
---
krebs/3modules/nginx.nix | 53 ++++++++++++++++++++--------------------
1 file changed, 27 insertions(+), 26 deletions(-)
diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix
index 7b7163071..ec39715d8 100644
--- a/krebs/3modules/nginx.nix
+++ b/krebs/3modules/nginx.nix
@@ -13,33 +13,34 @@ let
enable = mkEnableOption "krebs.nginx";
servers = mkOption {
- type = with types; attrsOf optionSet;
- options = singleton {
- server-names = mkOption {
- type = with types; listOf str;
- # TODO use identity
- default = [
- "${config.networking.hostName}"
- "${config.networking.hostName}.retiolum"
- ];
+ type = types.attrsOf (types.submodule {
+ options = {
+ server-names = mkOption {
+ type = with types; listOf str;
+ # TODO use identity
+ default = [
+ "${config.networking.hostName}"
+ "${config.networking.hostName}.retiolum"
+ ];
+ };
+ listen = mkOption {
+ type = with types; either str (listOf str);
+ default = "80";
+ apply = x:
+ if typeOf x != "list"
+ then [x]
+ else x;
+ };
+ locations = mkOption {
+ type = with types; listOf (attrsOf str);
+ default = [];
+ };
+ extraConfig = mkOption {
+ type = with types; string;
+ default = "";
+ };
};
- listen = mkOption {
- type = with types; either str (listOf str);
- default = "80";
- apply = x:
- if typeOf x != "list"
- then [x]
- else x;
- };
- locations = mkOption {
- type = with types; listOf (attrsOf str);
- default = [];
- };
- extraConfig = mkOption {
- type = with types; string;
- default = "";
- };
- };
+ });
default = {};
};
};