Merge remote-tracking branch 'gum/master'

This commit is contained in:
lassulus 2017-12-09 15:25:12 +01:00
commit f5e123992e
26 changed files with 407 additions and 106 deletions
krebs/3modules/makefu
makefu

View file

@ -107,7 +107,7 @@ with import <stockholm/lib>;
ci = true;
cores = 1;
ssh.privkey.path = <secrets/ssh_host_ed25519_key>;
ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIrkK1mWfPvfZ9ALC1irGLuzOtMefaGAmGY1VD4dj7K1 latte";
# ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIrkK1mWfPvfZ9ALC1irGLuzOtMefaGAmGY1VD4dj7K1 latte";
nets = {
internet = {
ip4.addr = "185.215.224.160";
@ -500,7 +500,7 @@ with import <stockholm/lib>;
};
retiolum = {
ip4.addr = "10.243.214.15";
ip6.addr = "42:5a02:2c30:c1b1:3f2e:7c19:2496:a732";
# ip6.addr = "42:5a02:2c30:c1b1:3f2e:7c19:2496:a732";
aliases = [
"wbob.r"
];

View file

@ -46,7 +46,7 @@ in {
# services
<stockholm/makefu/2configs/share/gum.nix>
<stockholm/makefu/2configs/sabnzbd.nix>
# <stockholm/makefu/2configs/sabnzbd.nix>
<stockholm/makefu/2configs/torrent.nix>
<stockholm/makefu/2configs/iodined.nix>
<stockholm/makefu/2configs/vpn/openvpn-server.nix>
@ -65,6 +65,8 @@ in {
<stockholm/makefu/2configs/deployment/graphs.nix>
<stockholm/makefu/2configs/deployment/owncloud.nix>
<stockholm/makefu/2configs/deployment/boot-euer.nix>
<stockholm/makefu/2configs/deployment/bgt/hidden_service.nix>
{
services.taskserver.enable = true;
services.taskserver.fqdn = config.krebs.build.host.name;
@ -84,13 +86,40 @@ in {
# Temporary:
# <stockholm/makefu/2configs/temp/rst-issue.nix>
<stockholm/makefu/2configs/virtualisation/docker.nix>
#{
# services.dockerRegistry.enable = true;
# networking.firewall.allowedTCPPorts = [ 8443 ];
# services.nginx.virtualHosts."euer.krebsco.de" = {
# forceSSL = true;
# enableACME = true;
# extraConfig = ''
# client_max_body_size 1000M;
# '';
# locations."/".proxyPass = "http://localhost:5000";
# };
#}
{ # wireguard server
networking.firewall.allowedUDPPorts = [ 51820 ];
#networking.wireguard.interfaces.wg0 = {
# ips = [ "10.244.0.1/24" ];
# privateKeyFile = (toString <secrets>) + "/wireguard.key";
# allowedIPsAsRoutes = true;
# peers = [{
# allowedIPs = [ "0.0.0.0/0" "::/0" ];
# publicKey = "fe5smvKVy5GAn7EV4w4tav6mqIAKhGWQotm7dRuRt1g=";
# }];
#};
}
];
makefu.dl-dir = "/var/download";
services.openssh.hostKeys = [
{ bits = 4096; path = <secrets/ssh_host_rsa_key>; type = "rsa"; }
{ path = <secrets/ssh_host_ed25519_key>; type = "ed25519"; } ];
{ bits = 4096; path = (toString <secrets/ssh_host_rsa_key>); type = "rsa"; }
{ path = (toString <secrets/ssh_host_ed25519_key>); type = "ed25519"; } ];
###### stable
services.nginx.virtualHosts.cgit.serverAliases = [ "cgit.euer.krebsco.de" ];
krebs.build.host = config.krebs.hosts.gum;

View file

@ -61,6 +61,7 @@ in {
# logs to influx
<stockholm/makefu/2configs/stats/external/aralast.nix>
<stockholm/makefu/2configs/stats/telegraf>
<stockholm/makefu/2configs/stats/telegraf/europastats.nix>
# services
<stockholm/makefu/2configs/syncthing.nix>

View file

@ -32,6 +32,8 @@
# acer aspire
networking.wireless.enable = lib.mkDefault true;
services.xserver.synaptics.enable = true;
hardware.enableAllFirmware = true;
nixpkgs.config.allowUnfree = true;

View file

@ -3,6 +3,7 @@ let
rootdisk = "/dev/disk/by-id/ata-TS256GMTS800_C613840115";
datadisk = "/dev/disk/by-id/ata-HGST_HTS721010A9E630_JR10006PH3A02F";
user = config.makefu.gui.user;
primaryIP = "192.168.8.11";
in {
imports =
@ -10,16 +11,18 @@ in {
<stockholm/makefu>
<stockholm/makefu/2configs/zsh-user.nix>
<stockholm/makefu/2configs/tools/core.nix>
<stockholm/makefu/2configs/tools/core-gui.nix>
<stockholm/makefu/2configs/tools/extra-gui.nix>
<stockholm/makefu/2configs/tools/media.nix>
<stockholm/makefu/2configs/disable_v6.nix>
# <stockholm/makefu/2configs/tools/core-gui.nix>
# <stockholm/makefu/2configs/tools/extra-gui.nix>
# <stockholm/makefu/2configs/tools/media.nix>
<stockholm/makefu/2configs/virtualisation/libvirt.nix>
<stockholm/makefu/2configs/tinc/retiolum.nix>
<stockholm/makefu/2configs/mqtt.nix>
<stockholm/makefu/2configs/deployment/led-fader.nix>
# <stockholm/makefu/2configs/gui/wbob-kiosk.nix>
<stockholm/makefu/2configs/stats/client.nix>
# <stockholm/makefu/2configs/gui/studio-virtual.nix>
# <stockholm/makefu/2configs/audio/jack-on-pulse.nix>
# <stockholm/makefu/2configs/audio/realtime-audio.nix>
@ -27,6 +30,41 @@ in {
# Services
<stockholm/makefu/2configs/remote-build/slave.nix>
<stockholm/makefu/2configs/share/wbob.nix>
<stockholm/makefu/2configs/stats/telegraf>
<stockholm/makefu/2configs/deployment/led-fader.nix>
<stockholm/makefu/2configs/stats/external/aralast.nix>
<stockholm/makefu/2configs/stats/telegraf/airsensor.nix>
<stockholm/makefu/2configs/deployment/bureautomation>
(let
collectd-port = 25826;
influx-port = 8086;
grafana-port = 3000; # TODO nginx forward
db = "collectd_db";
logging-interface = "enp0s25";
in {
services.grafana.enable = true;
services.grafana.addr = "0.0.0.0";
services.influxdb.enable = true;
services.influxdb.extraConfig = {
meta.hostname = config.krebs.build.host.name;
# meta.logging-enabled = true;
http.bind-address = ":${toString influx-port}";
admin.bind-address = ":8083";
collectd = [{
enabled = true;
typesdb = "${pkgs.collectd}/share/collectd/types.db";
database = db;
bind-address = ":${toString collectd-port}";
}];
};
networking.firewall.extraCommands = ''
iptables -A INPUT -i ${logging-interface} -p tcp --dport ${toString grafana-port} -j ACCEPT
'';
})
# temporary
# <stockholm/makefu/2configs/temp/rst-issue.nix>

View file

@ -1,4 +1,4 @@
import <stockholm/makefu/source.nix> {
name="wbob";
musnix = true;
# musnix = true;
}

View file

@ -0,0 +1,48 @@
{ pkgs, lib, ... }:
with lib;
let
name = "bgt_cyberwar_hidden_service";
sec = (toString <secrets>) + "/";
secdir = sec + name;
srvdir = "/var/lib/tor/onion/";
basedir = srvdir + name;
hn = builtins.readFile (secdir + "/hostname");
in
{
systemd.services.prepare-hidden-service = {
wantedBy = [ "local-fs.target" ];
before = [ "tor.service" ];
serviceConfig = {
ExecStart = pkgs.writeScript "prepare-euer-blog-service" ''
#!/bin/sh
set -euf
if ! test -d "${basedir}" ;then
mkdir -p "${srvdir}"
cp -r "${secdir}" "${srvdir}"
chown -R tor:tor "${srvdir}"
chmod -R 700 "${basedir}"
else
echo "not overwriting ${basedir}"
fi
'';
Type = "oneshot";
RemainAfterExit = "yes";
TimeoutSec = "0";
};
};
services.nginx.virtualHosts."${hn}".locations."/" = {
proxyPass = "https://blog.binaergewitter.de";
extraConfig = ''
proxy_set_header Host blog.binaergewitter.de;
proxy_ssl_server_name on;
'';
};
services.tor = {
enable = true;
hiddenServices."${name}".map = [
{ port = "80"; }
# { port = "443"; toHost = "blog.binaergewitter.de"; }
];
};
}

View file

@ -0,0 +1,41 @@
{ pkgs, lib, ... }:
with lib;
let
port = 3001;
runit = pkgs.writeDash "runit" ''
set -xeuf
PATH=${pkgs.curl}/bin:${pkgs.coreutils}/bin
name=''${1?must provide name as first arg}
state=''${2?must provide state as second arg}
# val=''${3?must provide val as third arg}
# we ignore non-alerting events
test $state = alerting || exit 0
echo $name - $state
curl 'http://bauarbeiterlampe/ay?o=1'
sleep 5
curl 'http://bauarbeiterlampe/ay?o=1'
'';
in {
services.logstash = {
package = pkgs.logstash5;
enable = true;
inputConfig = ''
http {
port => ${toString port}
host => "127.0.0.1"
}
'';
filterConfig = ''
'';
outputConfig = ''
stdout { codec => json }
exec { command => "${runit} '%{ruleName}' '%{state}'" }
'';
extraSettings = ''
path.plugins: [ "${pkgs.logstash-output-exec}" ]
'';
};
}

View file

@ -1,27 +1,25 @@
{ config, lib, pkgs, ... }:
{ config, lib, pkgs, buildPythonPackage, ... }:
with import <stockholm/lib>;
let
mq = "192.168.8.11";
pkg = pkgs.stdenv.mkDerivation {
pkg = pkgs.python3Packages.buildPythonPackage {
name = "ampel-master";
src = pkgs.fetchgit {
url = "http://cgit.euer.krebsco.de/ampel";
rev = "07a6791de368e16cc0864d2676fd255eba522cee";
sha256 = "1jxjapvkfglvgapy7gjbr1nra3ay418nvz70bvypcmv7wc8d4h8q";
rev = "531741b";
sha256 = "110yij53jz074zbswylbzcd8jy7z49r9fg6i3j1gk2y3vl91g81c";
};
buildInputs = [
(pkgs.python35.withPackages (pythonPackages: with pythonPackages; [
propagatedBuildInputs = with pkgs.python3Packages; [
docopt
paho-mqtt
]))
requests
pytz
influxdb
httplib2
google_api_python_client
];
installPhase = ''
install -m755 -D fade.py $out/bin/fade.py
install -m755 -D ampel.py $out/bin/ampel
install -m755 -D times.json $out/share/times.json
'';
};
in {
systemd.services.led-fader = {
@ -34,7 +32,9 @@ in {
serviceConfig = {
# User = "nobody"; # need a user with permissions to run nix-shell
ExecStartPre = pkgs.writeDash "sleep.sh" "sleep 2";
ExecStart = "${pkg}/bin/ampel 4 ${pkg}/share/times.json";
ExecStart = "${pkg}/bin/ampel 4";
Restart = "always";
RestartSec = 10;
PrivateTmp = true;
};
};

View file

@ -0,0 +1,6 @@
{
imports = [
./elkstack.nix
./selenium.nix
];
}

View file

@ -0,0 +1,65 @@
{config, pkgs, lib, ...}:
with <stockholm/lib>;
let
selenium-pw = <secrets/selenium-vncpasswd>;
in {
services.jenkinsSlave.enable = true;
users.users.selenium = {
uid = genid "selenium";
extraGroups = [ "plugdev" ];
};
fonts.enableFontDir = true;
# networking.firewall.allowedTCPPorts = [ 5910 ];
systemd.services.selenium-X11 =
{
description = "X11 vnc for selenium";
wantedBy = [ "multi-user.target" ];
path = [ pkgs.xorg.xorgserver pkgs.tightvnc pkgs.dwm ];
environment =
{
DISPLAY = ":10";
};
script = ''
set -ex
[ -e /tmp/.X10-lock ] && ( set +e ; chmod u+w /tmp/.X10-lock ; rm /tmp/.X10-lock )
[ -e /tmp/.X11-unix/X10 ] && ( set +e ; chmod u+w /tmp/.X11-unix/X10 ; rm /tmp/.X11-unix/X10 )
mkdir -p ~/.vnc
cp -f ${selenium-pw} ~/.vnc/passwd
chmod go-rwx ~/.vnc/passwd
echo > ~/.vnc/xstartup
chmod u+x ~/.vnc/xstartup
vncserver $DISPLAY -geometry 1280x1024 -depth 24 -name jenkins -ac
dwm
'';
preStop = ''
vncserver -kill $DISPLAY
'';
serviceConfig = {
User = "selenium";
};
};
systemd.services.selenium-server =
{
description = "selenium-server";
wantedBy = [ "multi-user.target" ];
requires = [ "selenium-X11.service" ];
path = [ pkgs.chromium
pkgs.firefoxWrapper ];
environment =
{
DISPLAY = ":10";
};
script = ''
${pkgs.selenium-server-standalone}/bin/selenium-server -Dwebdriver.enable.native.events=1
'';
serviceConfig = {
User = "selenium";
};
};
}

View file

@ -30,24 +30,18 @@ in {
browseable = "yes";
"guest ok" = "yes";
};
usenet = {
path = "/media/crypt0/usenet/dst";
"read only" = "yes";
browseable = "yes";
"guest ok" = "yes";
};
pyload = {
path = "/media/crypt0/pyload";
"read only" = "yes";
browseable = "yes";
"guest ok" = "yes";
};
crypt0 = {
path = "/media/crypt0";
"read only" = "yes";
browseable = "yes";
"guest ok" = "yes";
};
crypX-games = {
path = "/media/cryptX/games";
"read only" = "yes";
browseable = "yes";
"guest ok" = "yes";
};
media-rw = {
path = "/media/";
"read only" = "no";

View file

@ -0,0 +1,38 @@
{config, ... }:{
networking.firewall.allowedUDPPorts = [ 137 138 ];
networking.firewall.allowedTCPPorts = [ 139 445 ];
users.users.smbguest = {
name = "smbguest";
uid = config.ids.uids.smbguest;
description = "smb guest user";
home = "/home/share";
createHome = true;
};
services.samba = {
enable = true;
enableNmbd = true;
shares = {
incoming = {
path = "/data/incoming";
"read only" = "no";
browseable = "yes";
"guest ok" = "yes";
};
data = {
path = "/data/";
"read only" = "yes";
browseable = "yes";
"guest ok" = "yes";
};
};
extraConfig = ''
guest account = smbguest
map to guest = bad user
# disable printing
load printers = no
printing = bsd
printcap name = /dev/null
disable spoolss = yes
'';
};
}

View file

@ -0,0 +1,19 @@
{ pkgs, ...}:
{
services.udev.extraRules = ''
SUBSYSTEMS=="usb", ATTRS{product}=="iAQ Stick", GROUP="input"
'';
users.users.telegraf.extraGroups = [ "input" ];
services.telegraf.extraConfig.inputs.exec = [
{
commands = [ "${pkgs.airsensor-py}/bin/airsensor-py"];
timeout = "10s";
data_format = "value";
data_type = "integer";
name_override = "airquality";
interval = "10s";
tags.unit="VOC";
}
];
}

View file

@ -2,9 +2,6 @@
let
url = "http://localhost:8086";
in {
imports = [
./europastats.nix
];
services.telegraf = {
enable = true;
extraConfig = {

View file

@ -13,10 +13,12 @@
esptool
cac-api
cac-panel
krebszones
ovh-zone
whatsupnix
brain
gen-oath-safe
cdrtools
stockholm
];
}

View file

@ -14,5 +14,6 @@
saleae-logic
arduino-user-env
gitAndTools.gitFull
signal-desktop
];
}

View file

@ -7,5 +7,6 @@
users.users.makefu.packages = with pkgs; [
games-user-env
wine
pkg2zip
];
}

View file

@ -8,11 +8,12 @@ in
users.extraUsers.${mainUser}.shell = "/run/current-system/sw/bin/zsh";
programs.zsh= {
enable = true;
enableCompletion = false ; #manually at the end
enableCompletion = true ; #manually at the end
interactiveShellInit = ''
HISTSIZE=900001
HISTFILESIZE=$HISTSIZE
SAVEHIST=$HISTSIZE
HISTFILE=$HOME/.zsh_history
setopt HIST_IGNORE_ALL_DUPS
setopt HIST_IGNORE_SPACE
@ -65,13 +66,15 @@ in
zle -N fzf-file-widget
bindkey '^T' fzf-file-widget
# Auto-Completion
for p in ''${(z)NIX_PROFILES}; do
fpath+=($p/share/zsh/site-functions $p/share/zsh/$ZSH_VERSION/functions $p/share/zsh/vendor-completions)
done
autoload -U compinit && compinit
compdef _pass brain
zstyle ':completion::complete:brain::' prefix "$HOME/brain"
# ctrl-x ctrl-e
autoload -U edit-command-line
zle -N edit-command-line
bindkey '^xe' edit-command-line
bindkey '^x^e' edit-command-line
'';
promptInit = ''

View file

@ -0,0 +1,27 @@
{ stdenv, lib, pkgs, fetchFromGitHub, ... }:
stdenv.mkDerivation rec {
name = "PkgDecrypt-2017-12-01";
rev = "e2f9518";
src = fetchFromGitHub {
owner = "St4rk";
repo = "PkgDecrypt";
inherit rev;
sha256 = "0dk13qamxyny0vc990s06vqddxwwc6xmikb1pkc3rnys98yda29p";
};
installPhase = ''
install -m755 -D pkg_dec $out/bin/pkg_dec
install -m755 -D make_key $out/bin/make_key
'';
buildInputs = with pkgs;[
zlib
];
meta = {
homepage = https://github.com/St4rk/PkgDecrypt;
description = "St4rk's Vita pkg decrypter";
license = lib.licenses.gpl2;
};
}

View file

@ -0,0 +1,17 @@
{ pkgs, fetchFromGitHub, ... }:
with pkgs.python3Packages;
buildPythonApplication rec {
name = "airsensor-py-${version}";
version = "2017-12-05";
propagatedBuildInputs = [
pyusb
click
];
src = fetchFromGitHub {
owner = "makefu";
repo = "airsensor-py";
rev = "7ac5f185dc848fca1b556e4c0396dd73f6a93995";
sha256 = "0387b025y8kb0zml7916p70hmzc3y18kqh46b9xv5qayljxymq2w";
};
}

View file

@ -24,7 +24,7 @@ in {
alsa-hdspmixer = callPackage ./custom/alsa-tools { alsaToolTarget="hdspmixer";};
alsa-hdsploader = callPackage ./custom/alsa-tools { alsaToolTarget="hdsploader";};
qcma = super.pkgs.libsForQt5.callPackage ./custom/qcma { };
inherit (callPackage ./devpi {}) devpi-web devpi-server;
inherit (callPackage ./devpi {}) devpi-web ;
nodemcu-uploader = super.pkgs.callPackage ./nodemcu-uploader {};
inkscape = super.pkgs.stdenv.lib.overrideDerivation super.inkscape (old: {
patches = [ ./custom/inkscape/dxf_fix.patch ];

View file

@ -14,18 +14,6 @@ let
propagatedBuildInputs = with pkgs.python3Packages; [ docutils bleach pygments ];
};
devpi-client = pkgs.python3Packages.buildPythonPackage rec {
name = "devpi-client";
version = "2.7.0";
src = pkgs.fetchurl {
url = "mirror://pypi/d/devpi-client/devpi-client-${version}.tar.gz";
sha256 = "0z7vaf0a66n82mz0vx122pbynjvkhp2mjf9lskgyv09y3bxzzpj3";
};
patches = [ ./py3-fix-encoding.patch ];
buildInputs = with pkgs.python3Packages; [ tox check-manifest pkginfo ];
propagatedBuildInputs = with pkgs.python3Packages; [ devpi-common py ];
};
devpi-web = pkgs.python3Packages.buildPythonPackage rec {
name = "devpi-web";
version = "3.1.1";
@ -37,7 +25,7 @@ let
};
propagatedBuildInputs = with pkgs.python3Packages;
[ devpi-server pyramid_chameleon beautifulsoup4 defusedxml readme-renderer ];
[ pkgs.devpi-server pyramid_chameleon beautifulsoup4 defusedxml readme-renderer ];
meta = {
homepage = https://bitbucket.org/hpk42/devpi;
@ -47,53 +35,7 @@ let
};
};
devpi-common-3 = pkgs.python3Packages.buildPythonPackage rec {
name = "devpi-common";
version = "3.0.1";
src = pkgs.fetchurl {
url = "mirror://pypi/d/devpi-common/devpi-common-${version}.tar.gz";
sha256 = "0l3a7iyk596x6pvzg7604lzzi012qszr804fqn6f517zcy1xz23j";
};
propagatedBuildInputs = with pkgs.python3Packages; [ requests py ];
meta = {
homepage = https://bitbucket.org/hpk42/devpi;
description = "Utilities jointly used by devpi-server and devpi-client";
license = licenses.mit;
maintainers = with maintainers; [ lewo makefu ];
};
};
devpi-server = pkgs.python3Packages.buildPythonPackage rec {
name = "devpi-server";
version = "4.1.1";
# original postFixup adds "import sys; sys.argv[0] = 'devpi-server'" to
# `.devpi-server-wrapped` which
# results in "not existing devpi-server: 'devpi-server'"
postFixup = "";
src = pkgs.fetchurl {
url = "mirror://pypi/d/devpi-server/devpi-server-${version}.tar.gz";
sha256 = "1icbn1nw6w0sc5150fr69rlhs0j5ldnnxfzl2qabq2wi0dbar8hf";
};
propagatedBuildInputs = with pkgs.python3Packages;
[ devpi-common-3 execnet itsdangerous pluggy waitress pyramid ];
buildInputs = with pkgs.python3Packages; [ pytest beautifulsoup4 webtest ];
meta = {
homepage = https://bitbucket.org/hpk42/devpi;
description = "Devpi Server";
license = licenses.mit;
maintainers = with maintainers; [ makefu ];
};
};
in {
inherit devpi-server devpi-client;
devpi-web = pkgs.python3.buildEnv.override {
extraLibs = [ devpi-web devpi-server ];
};

View file

@ -0,0 +1,29 @@
{ stdenv, lib, pkgs, fetchFromGitHub, ... }:
stdenv.mkDerivation rec {
name = "pkg2zip-2017-12-01";
rev = "fccad26";
src = fetchFromGitHub {
owner = "mmozeiko";
repo = "pkg2zip";
inherit rev;
sha256 = "1sq9yx5cbllmc0yyxhvb6c0yq1mkd1mn8njgkkgxz8alw9zwlarp";
};
installPhase = ''
install -m755 -D pkg2zip $out/bin/pkg2zip
install -m755 -D rif2zrif.py $out/bin/rif2zrif
install -m755 -D zrif2rif.py $out/bin/zrif2rif
'';
buildInputs = with pkgs;[
python3
];
meta = {
homepage = https://github.com/St4rk/PkgDecrypt;
description = "St4rk's Vita pkg decrypter";
license = lib.licenses.gpl2;
};
}

View file

@ -0,0 +1 @@
dickbutt2342.onion

View file

@ -11,7 +11,7 @@ let
then "buildbot"
else "makefu";
_file = <stockholm> + "/makefu/1systems/${name}/source.nix";
ref = "6778819"; # unstable @ 2017-11-14
ref = "3874de4"; # unstable @ 2017-12-08
# + do_sqlite3 ruby: 55a952be5b5
in