diff options
| author | makefu <github@syntax-fehler.de> | 2016-02-15 17:07:48 +0100 |
|---|---|---|
| committer | makefu <github@syntax-fehler.de> | 2016-02-15 17:07:48 +0100 |
| commit | 3ceff0ec29a36119ea83f02c8943752d91b250e9 (patch) | |
| tree | 7b179bc972ea01c9305ea64697e14237346885d8 | |
| parent | 9a4071b66ff45e99a30e9a314eb43c6efc7e921f (diff) | |
| parent | 372f2d77f301719e396a6f943657325e2f8b2cf4 (diff) | |
Merge remote-tracking branch 'cd/master'
163 files changed, 829 insertions, 564 deletions
@@ -4,14 +4,16 @@ endif export target_host ?= $(system) export target_user ?= root +export target_port ?= 22 export target_path ?= /var/src evaluate = \ nix-instantiate \ - --arg configuration ./$(LOGNAME)/1systems/$(system).nix \ --eval \ --readonly-mode \ --show-trace \ + -I nixos-config=./$(LOGNAME)/1systems/$(system).nix \ + -I stockholm=. \ $(1) execute = \ @@ -22,19 +24,20 @@ execute = \ # usage: make deploy system=foo [target_host=bar] deploy: $(call execute,populate) - ssh $(target_user)@$(target_host) nixos-rebuild switch -I $(target_path) + ssh $(target_user)@$(target_host) -p $(target_port) \ + nixos-rebuild switch --show-trace -I $(target_path) # usage: make LOGNAME=shared system=wolf eval.config.krebs.build.host.name eval eval.:;@$(call evaluate) eval.%:;@$(call evaluate,-A $*) # usage: make install system=foo [target_host=bar] -install: ssh = ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null +install: ssh ?= ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null install: - $(ssh) $(target_user)@$(target_host) \ + $(ssh) $(target_user)@$(target_host) -p $(target_port) \ env target_path=$(target_path) \ sh -s prepare < krebs/4lib/infest/prepare.sh target_path=/mnt$(target_path) $(call execute,populate) - $(ssh) $(target_user)@$(target_host) \ + $(ssh) $(target_user)@$(target_host) -p $(target_port) \ env NIXOS_CONFIG=$(target_path)/nixos-config \ nixos-install diff --git a/default.nix b/default.nix index 2aa0a8e14..52e8924cd 100644 --- a/default.nix +++ b/default.nix @@ -1,84 +1,5 @@ -{ configuration ? import (nixpkgs-path + "/nixos/lib/from-env.nix") "NIXOS_CONFIG" <nixos-config> -, system ? builtins.currentSystem -, current-host-name ? - let v = builtins.getEnv "HOSTNAME"; in - if v != "" then v else builtins.readFile /proc/sys/kernel/hostname -, current-user-name ? - let v = builtins.getEnv "LOGNAME"; in - if v != "" then v else abort "undefined variable: LOGNAME" -, nixpkgs-path ? - if (builtins.tryEval <nixpkgs/krebs>).success - then <upstream-nixpkgs> - else <nixpkgs> -, StrictHostKeyChecking ? "yes" -}@args: - -let stockholm = { - inherit krebs; - inherit users; - inherit lib; - inherit config options pkgs; - system = config.system.build.toplevel; - }; - - krebs = import ./krebs (args // { inherit lib stockholm; }); - - lib = let - nlib = import (slib.npath "lib"); - klib = import (slib.kpath "4lib") { lib = nlib; }; - slib = rec { - nspath = ns: p: ./. + "/${ns}/${p}"; - npath = p: nixpkgs-path + "/${p}"; - kpath = nspath "krebs"; - upath = nspath current-user-name; - }; - ulib = let p = slib.upath "4lib"; in - nlib.optionalAttrs (klib.dir.has-default-nix p) - (import p { lib = nlib // klib; }); - in nlib // klib // slib // ulib // builtins; - - inherit (eval configuration) config options pkgs; - - base-module = { config, ... }: { - imports = builtins.filter lib.dir.has-default-nix (lib.concatLists [ - (map (f: f "2configs") [ lib.upath ]) - (map (f: f "3modules") [ lib.kpath lib.upath ]) - (map (f: f "5pkgs") [ lib.kpath lib.upath ]) - ]); - - krebs.current.enable = true; - krebs.current.host = config.krebs.hosts.${current-host-name}; - krebs.current.user = config.krebs.users.${current-user-name}; - }; - - eval = config: import (lib.npath "nixos/lib/eval-config.nix") { - inherit system; - specialArgs = { - inherit lib; - }; - modules = [ - base-module - config - ]; - }; - - # TODO move user namespaces' to users/, so no exception for krebs/ is needed - users = - lib.mapAttrs - (name: _: eval-all-systems (lib.nspath name "1systems")) - (lib.filterAttrs - (n: t: !lib.hasPrefix "." n && t == "directory" && n != "krebs") - (builtins.readDir ./.)); - - eval-all-systems = path: - lib.mapAttrs' - (n: _: (lib.nameValuePair (lib.removeSuffix ".nix" n) - (eval-system (path + "/${n}")))) - (builtins.readDir path); - - eval-system = path: rec { - inherit (eval path) config options; - system = config.system.build.toplevel; - }; - -in stockholm +import <nixpkgs/nixos/lib/eval-config.nix> { + modules = [ + (import <nixpkgs/nixos/lib/from-env.nix> "NIXOS_CONFIG" <nixos-config>) + ]; +} diff --git a/krebs/3modules/Reaktor.nix b/krebs/3modules/Reaktor.nix index 92400139c..d58661a28 100644 --- a/krebs/3modules/Reaktor.nix +++ b/krebs/3modules/Reaktor.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let ReaktorConfig = pkgs.writeText "config.py" '' @@ -16,7 +16,7 @@ let out = { options.krebs.Reaktor = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/apt-cacher-ng.nix b/krebs/3modules/apt-cacher-ng.nix index 371d39b6f..46b405842 100644 --- a/krebs/3modules/apt-cacher-ng.nix +++ b/krebs/3modules/apt-cacher-ng.nix @@ -1,6 +1,6 @@ { config, pkgs, lib, ... }: -with lib; +with config.krebs.lib; let acng-config = pkgs.writeTextFile { name = "acng-configuration"; @@ -151,5 +151,5 @@ let in { options.krebs.apt-cacher-ng = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; } diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix index 66a325ed9..0aa86dec9 100644 --- a/krebs/3modules/backup.nix +++ b/krebs/3modules/backup.nix @@ -1,9 +1,9 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let out = { options.krebs.backup = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; cfg = config.krebs.backup; @@ -210,7 +210,7 @@ let | ${pkgs.coreutils}/bin/head -1; } ''; - # Note that we don't escape word on purpose, so we deref shell vars. + # Note that we don't escape word on purpose, so we can deref shell vars. # TODO type word network-ssh-port = host: word: '' case ${word} in diff --git a/krebs/3modules/bepasty-server.nix b/krebs/3modules/bepasty-server.nix index e74841205..9e777a5ef 100644 --- a/krebs/3modules/bepasty-server.nix +++ b/krebs/3modules/bepasty-server.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let gunicorn = pkgs.pythonPackages.gunicorn; bepasty = pkgs.pythonPackages.bepasty-server; @@ -10,8 +10,8 @@ let out = { options.krebs.bepasty = api; - config = mkIf cfg.enable (mkMerge [ - (mkIf cfg.serveNginx nginx-imp) + config = lib.mkIf cfg.enable (lib.mkMerge [ + (lib.mkIf cfg.serveNginx nginx-imp) imp ]); }; diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix index 3530fd595..a1f446188 100644 --- a/krebs/3modules/build.nix +++ b/krebs/3modules/build.nix @@ -1,6 +1,6 @@ { config, lib, ... }: -with lib; +with config.krebs.lib; let out = { @@ -51,6 +51,7 @@ let source = config.krebs.build.source; target-user = maybeEnv "target_user" "root"; target-host = maybeEnv "target_host" config.krebs.build.host.name; + target-port = maybeEnv "target_port" "22"; target-path = maybeEnv "target_path" "/var/src"; out = '' #! /bin/sh @@ -62,7 +63,8 @@ let } echo ${shell.escape git-script} \ - | ssh ${shell.escape "${target-user}@${target-host}"} -T + | ssh -p ${shell.escape target-port} \ + ${shell.escape "${target-user}@${target-host}"} -T unset tmpdir trap ' @@ -93,6 +95,7 @@ let (attrNames file-specs)} \ --delete \ -vFrlptD \ + -e ${shell.escape "ssh -p ${target-port}"} \ ${shell.escape target-path}/ \ ${shell.escape "${target-user}@${target-host}:${target-path}"} ''; diff --git a/krebs/3modules/buildbot/master.nix b/krebs/3modules/buildbot/master.nix index 74385a433..825cb3413 100644 --- a/krebs/3modules/buildbot/master.nix +++ b/krebs/3modules/buildbot/master.nix @@ -1,6 +1,6 @@ { config, pkgs, lib, ... }: -with lib; +with config.krebs.lib; let buildbot = pkgs.buildbot; buildbot-master-config = pkgs.writeText "buildbot-master.cfg" '' @@ -381,5 +381,5 @@ let in { options.krebs.buildbot.master = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; } diff --git a/krebs/3modules/buildbot/slave.nix b/krebs/3modules/buildbot/slave.nix index 0e7796d8a..7705ac31c 100644 --- a/krebs/3modules/buildbot/slave.nix +++ b/krebs/3modules/buildbot/slave.nix @@ -1,6 +1,6 @@ { config, pkgs, lib, ... }: -with lib; +with config.krebs.lib; let buildbot-slave-init = pkgs.writeText "buildbot-slave.tac" '' import os @@ -182,5 +182,5 @@ let in { options.krebs.buildbot.slave = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; } diff --git a/krebs/3modules/current.nix b/krebs/3modules/current.nix index 41941e289..9f63e33ac 100644 --- a/krebs/3modules/current.nix +++ b/krebs/3modules/current.nix @@ -1,13 +1,13 @@ { config, pkgs, lib, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.current; out = { options.krebs.current = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 060b4445d..c06f3754e 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -1,6 +1,6 @@ { config, lib, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs; @@ -9,9 +9,9 @@ let ./apt-cacher-ng.nix ./backup.nix ./bepasty-server.nix - ./build.nix ./buildbot/master.nix ./buildbot/slave.nix + ./build.nix ./current.nix ./exim-retiolum.nix ./exim-smarthost.nix @@ -20,19 +20,21 @@ let ./git.nix ./go.nix ./iptables.nix + ./lib.nix ./nginx.nix ./nixpkgs.nix ./per-user.nix ./Reaktor.nix - ./retiolum-bootstrap.nix ./realwallpaper.nix + ./retiolum-bootstrap.nix ./retiolum.nix + ./setuid.nix ./tinc_graphs.nix ./urlwatch.nix ./repo-sync.nix ]; options.krebs = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { @@ -83,13 +85,13 @@ let }; }; - imp = mkMerge [ - { krebs = import ./lass { inherit lib; }; } - { krebs = import ./makefu { inherit lib; }; } - { krebs = import ./miefda { inherit lib; }; } - { krebs = import ./mv { inherit lib; }; } - { krebs = import ./shared { inherit lib; }; } - { krebs = import ./tv { inherit lib; }; } + imp = lib.mkMerge [ + { krebs = import ./lass { inherit config lib; }; } + { krebs = import ./makefu { inherit config lib; }; } + { krebs = import ./miefda { inherit config lib; }; } + { krebs = import ./mv { inherit config lib; }; } + { krebs = import ./shared { inherit config lib; }; } + { krebs = import ./tv { inherit config lib; }; } { krebs.dns.providers = { de.krebsco = "zones"; diff --git a/krebs/3modules/exim-retiolum.nix b/krebs/3modules/exim-retiolum.nix index ea012c38c..1722eef1f 100644 --- a/krebs/3modules/exim-retiolum.nix +++ b/krebs/3modules/exim-retiolum.nix @@ -1,12 +1,12 @@ { config, pkgs, lib, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.exim-retiolum; out = { options.krebs.exim-retiolum = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix index a564430ea..267ee2900 100644 --- a/krebs/3modules/exim-smarthost.nix +++ b/krebs/3modules/exim-smarthost.nix @@ -1,13 +1,12 @@ { config, pkgs, lib, ... }: -with builtins; -with lib; +with config.krebs.lib; let cfg = config.krebs.exim-smarthost; out = { options.krebs.exim-smarthost = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/fetchWallpaper.nix b/krebs/3modules/fetchWallpaper.nix index 225f00803..53fe0839d 100644 --- a/krebs/3modules/fetchWallpaper.nix +++ b/krebs/3modules/fetchWallpaper.nix @@ -1,13 +1,13 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.fetchWallpaper; out = { options.krebs.fetchWallpaper = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix index 11cf21b5f..a9542718d 100644 --- a/krebs/3modules/git.nix +++ b/krebs/3modules/git.nix @@ -1,4 +1,4 @@ -{ config, pkgs, lib, ... }: +{ config, lib, pkgs, ... }: # TODO unify logging of shell scripts to user and journal # TODO move all scripts to ${etcDir}, so ControlMaster connections @@ -6,13 +6,13 @@ # TODO when authorized_keys changes, then restart ssh # (or kill already connected users somehow) -with lib; +with config.krebs.lib; let cfg = config.krebs.git; out = { options.krebs.git = api; - config = mkIf cfg.enable (mkMerge [ + config = with lib; mkIf cfg.enable (mkMerge [ (mkIf cfg.cgit cgit-imp) git-imp ]); @@ -86,7 +86,7 @@ let singleton { user = [ config.krebs.users.tv ]; repo = [ testing ]; # see literal example of repos - perm = push "refs/*" (with lib.git; [ + perm = push "refs/*" (with config.krebs.lib.git; [ non-fast-forward create delete merge ]); } diff --git a/krebs/3modules/github-hosts-sync.nix b/krebs/3modules/github-hosts-sync.nix index 2aa18d53a..1d3873232 100644 --- a/krebs/3modules/github-hosts-sync.nix +++ b/krebs/3modules/github-hosts-sync.nix @@ -1,12 +1,12 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.github-hosts-sync; out = { options.krebs.github-hosts-sync = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/go.nix b/krebs/3modules/go.nix index 08a93dab7..52a104bb9 100644 --- a/krebs/3modules/go.nix +++ b/krebs/3modules/go.nix @@ -1,13 +1,13 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.go; out = { options.krebs.go = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index 749d3ff49..41a609105 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -1,6 +1,6 @@ -{ lib, ... }: +{ config, lib, ... }: -with lib; +with config.krebs.lib; { hosts = { diff --git a/krebs/3modules/lib.nix b/krebs/3modules/lib.nix new file mode 100644 index 000000000..b19f275b5 --- /dev/null +++ b/krebs/3modules/lib.nix @@ -0,0 +1,15 @@ +{ config, pkgs, lib, ... }: +with lib; +let + out = { + options.krebs.lib = api; + config = imp; + }; + api = mkOption { + default = {}; + type = types.attrs; + }; + imp = { + krebs.lib = lib // import ../4lib { inherit lib; } // builtins; + }; +in out diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix index 2811c0c52..ca83d6906 100644 --- a/krebs/3modules/makefu/default.nix +++ b/krebs/3modules/makefu/default.nix @@ -1,6 +1,6 @@ -{ lib, ... }: +{ config, lib, ... }: -with lib; +with config.krebs.lib; { hosts = { @@ -292,8 +292,8 @@ with lib; cores = 1; nets = { retiolm = { - addrs4 = ["10.243.214.15/32"]; - addrs6 = ["42:5a02:2c30:c1b1:3f2e:7c19:2496:a732/128"]; + addrs4 = ["10.243.214.15"]; + addrs6 = ["42:5a02:2c30:c1b1:3f2e:7c19:2496:a732"]; aliases = [ "wbob.retiolum" ]; diff --git a/krebs/3modules/miefda/default.nix b/krebs/3modules/miefda/default.nix index 0cfa8bd27..6587ad92d 100644 --- a/krebs/3modules/miefda/default.nix +++ b/krebs/3modules/miefda/default.nix @@ -1,6 +1,6 @@ -{ lib, ... }: +{ config, lib, ... }: -with lib; +with config.krebs.lib; { hosts = { diff --git a/krebs/3modules/mv/default.nix b/krebs/3modules/mv/default.nix index 8803cb249..33f941aae 100644 --- a/krebs/3modules/mv/default.nix +++ b/krebs/3modules/mv/default.nix @@ -1,6 +1,6 @@ -{ lib, ... }: +{ config, ... }: -with lib; +with config.krebs.lib; { hosts = { diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix index 921771033..7b7163071 100644 --- a/krebs/3modules/nginx.nix +++ b/krebs/3modules/nginx.nix @@ -1,13 +1,12 @@ -{ config, pkgs, lib, ... }: +{ config, lib, pkgs, ... }: -with builtins; -with lib; +with config.krebs.lib; let cfg = config.krebs.nginx; out = { options.krebs.nginx = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { @@ -34,6 +33,7 @@ let }; locations = mkOption { type = with types; listOf (attrsOf str); + default = []; }; extraConfig = mkOption { type = with types; string; @@ -76,8 +76,8 @@ let server { ${concatMapStringsSep "\n" (x: "listen ${x};") listen} server_name ${toString server-names}; - ${extraConfig} - ${indent (concatStrings (map to-location locations))} + ${indent extraConfig} + ${indent (concatMapStrings to-location locations)} } ''; diff --git a/krebs/3modules/nixpkgs.nix b/krebs/3modules/nixpkgs.nix index 4129f9483..5816b8a30 100644 --- a/krebs/3modules/nixpkgs.nix +++ b/krebs/3modules/nixpkgs.nix @@ -1,11 +1,11 @@ -{ config, pkgs, lib, ... }: -with lib; +{ config, lib, pkgs, ... }: +with config.krebs.lib; let cfg = config.krebs.nixpkgs; out = { options.krebs.nixpkgs = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { @@ -37,7 +37,7 @@ let }; }; - imp = mkIf (cfg.allowUnfreePredicate != null) { + imp = lib.mkIf (cfg.allowUnfreePredicate != null) { nixpkgs.config.allowUnfreePredicate = cfg.allowUnfreePredicate; }; in out diff --git a/krebs/3modules/per-user.nix b/krebs/3modules/per-user.nix index ee213deda..13da5c4c3 100644 --- a/krebs/3modules/per-user.nix +++ b/krebs/3modules/per-user.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.per-user; diff --git a/krebs/3modules/realwallpaper.nix b/krebs/3modules/realwallpaper.nix index b377368f7..df374e184 100644 --- a/krebs/3modules/realwallpaper.nix +++ b/krebs/3modules/realwallpaper.nix @@ -1,12 +1,12 @@ -arg@{ config, lib, pkgs, ... }: +{ config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.realwallpaper; out = { options.krebs.realwallpaper = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix index 65bb51193..40382d098 100644 --- a/krebs/3modules/retiolum-bootstrap.nix +++ b/krebs/3modules/retiolum-bootstrap.nix @@ -1,12 +1,12 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.retiolum-bootstrap; out = { options.krebs.retiolum-bootstrap = api; - config = mkIf cfg.enable imp ; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/retiolum.nix b/krebs/3modules/retiolum.nix index 407695273..d0162eae9 100644 --- a/krebs/3modules/retiolum.nix +++ b/krebs/3modules/retiolum.nix @@ -1,11 +1,11 @@ { config, pkgs, lib, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.retiolum; out = { options.krebs.retiolum = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/setuid.nix b/krebs/3modules/setuid.nix new file mode 100644 index 000000000..1137788d8 --- /dev/null +++ b/krebs/3modules/setuid.nix @@ -0,0 +1,75 @@ +{ config, pkgs, lib, ... }: +with config.krebs.lib; +let + cfg = config.krebs.setuid; + + out = { + options.krebs.setuid = api; + config = imp; + }; + + api = mkOption { + default = {}; + type = let + # TODO make wrapperDir configurable + inherit (config.security) wrapperDir; + inherit (config.users) groups users; + in types.attrsOf (types.submodule ({ config, ... }: { + options = { + name = mkOption { + type = types.filename; + default = config._module.args.name; + }; + filename = mkOption { + type = mkOptionType { + # TODO unyuck string and merge with toC + name = "derivation or string"; + check = x: + isDerivation x || + isString x; + }; + apply = toString; + }; + owner = mkOption { + default = "root"; + type = types.enum (attrNames users); + }; + group = mkOption { + default = "root"; + type = types.enum (attrNames groups); + }; + mode = mkOption { + default = "4710"; + type = mkOptionType { + # TODO admit symbolic mode + name = "octal mode"; + check = x: + isString x && + match "[0-7][0-7][0-7][0-7]" x != null; + }; + }; + activate = mkOption { + type = types.str; + visible = false; + readOnly = true; + }; + }; + config.activate = let + src = pkgs.execve config.name { + inherit (config) filename; + }; + dst = "${wrapperDir}/${config.name}"; + in '' + cp ${src} ${dst} + chown ${config.owner}.${config.group} ${dst} + chmod ${config.mode} ${dst} + ''; + })); + }; + + imp = { + system.activationScripts."krebs.setuid" = stringAfter [ "setuid" ] + (concatMapStringsSep "\n" (getAttr "activate") (attrValues cfg)); + }; + +in out diff --git a/krebs/3modules/shared/default.nix b/krebs/3modules/shared/default.nix index df4c529bf..208b596f8 100644 --- a/krebs/3modules/shared/default.nix +++ b/krebs/3modules/shared/default.nix @@ -1,9 +1,8 @@ -{ lib, ... }: - -with lib; +{ config, ... }: +with config.krebs.lib; let - testHosts = lib.genAttrs [ + testHosts = genAttrs [ "test-arch" "test-centos6" "test-centos7" diff --git a/krebs/3modules/tinc_graphs.nix b/krebs/3modules/tinc_graphs.nix index dc0484a8b..2692de982 100644 --- a/krebs/3modules/tinc_graphs.nix +++ b/krebs/3modules/tinc_graphs.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.tinc_graphs; internal_dir = "${cfg.workingDir}/internal"; @@ -8,7 +8,7 @@ let out = { options.krebs.tinc_graphs = api; - config = mkIf cfg.enable imp ; + config = lib.mkIf cfg.enable imp ; }; api = { diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index 9a0b99396..f8d3d8671 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -1,6 +1,6 @@ -{ lib, ... }: +{ config, ... }: -with lib; +with config.krebs.lib; { dns.providers = { diff --git a/krebs/3modules/urlwatch.nix b/krebs/3modules/urlwatch.nix index 7a9fb55fd..cd4976a21 100644 --- a/krebs/3modules/urlwatch.nix +++ b/krebs/3modules/urlwatch.nix @@ -5,14 +5,14 @@ # cache = url: "${cfg.dataDir}/.urlwatch/cache/${hashString "sha1" url}" # TODO hooks.py -with lib; +with config.krebs.lib; let cfg = config.krebs.urlwatch; # TODO assert sendmail's existence out = { options.krebs.urlwatch = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/4lib/default.nix b/krebs/4lib/default.nix index 4d7e0b549..d5b6d03ac 100644 --- a/krebs/4lib/default.nix +++ b/krebs/4lib/default.nix @@ -26,11 +26,15 @@ let out = rec { shell = import ./shell.nix { inherit lib; }; tree = import ./tree.nix { inherit lib; }; - toC = x: { + toC = x: let + type = typeOf x; + reject = throw "cannot convert ${type}"; + in { list = "{ ${concatStringsSep ", " (map toC x)} }"; null = "NULL"; + set = if isDerivation x then toJSON x else reject; string = toJSON x; # close enough - }.${typeOf x}; + }.${type} or reject; subdirsOf = path: mapAttrs (name: _: path + "/${name}") diff --git a/krebs/4lib/infest/install-nix.sh b/krebs/4lib/infest/install-nix.sh deleted file mode 100644 index af1a8bd16..000000000 --- a/krebs/4lib/infest/install-nix.sh +++ /dev/null @@ -1,50 +0,0 @@ -#! /bin/sh -set -efu - -nix_url=https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-linux.tar.bz2 -nix_sha256=504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4 - -install_nix() {( - - # install nix on host (cf. https://nixos.org/nix/install) - if ! test -e /root/.nix-profile/etc/profile.d/nix.sh; then - ( - verify() { - printf '%s %s\n' $nix_sha256 $(basename $nix_url) | sha256sum -c - } - if ! verify; then - curl -C - -O "$nix_url" - verify - fi - ) - nix_src_dir=$(basename $nix_url .tar.bz2) - tar jxf $nix_src_dir.tar.bz2 - $nix_src_dir/install - fi - - . /root/.nix-profile/etc/profile.d/nix.sh - - for i in \ - bash \ - coreutils \ - # This line intentionally left blank. - do - if ! nix-env -q $i | grep -q .; then - nix-env -iA nixpkgs.pkgs.$i - fi - done - - # install nixos-install - if ! type nixos-install 2>/dev/null; then - nixpkgs_expr='import <nixpkgs> { system = builtins.currentSystem; }' - nixpkgs_path=$(find /nix/store -mindepth 1 -maxdepth 1 -name *-nixpkgs-* -type d) - nix-env \ - --arg config "{ nix.package = ($nixpkgs_expr).nix; }" \ - --arg pkgs "$nixpkgs_expr" \ - --arg modulesPath 'throw "no modulesPath"' \ - -f $nixpkgs_path/nixpkgs/nixos/modules/installer/tools/tools.nix \ - -iA config.system.build.nixos-install - fi -)} - -install_nix "$@" diff --git a/krebs/4lib/infest/prepare.sh b/krebs/4lib/infest/prepare.sh index 0bfc49380..b3824c7d4 100644 --- a/krebs/4lib/infest/prepare.sh +++ b/krebs/4lib/infest/prepare.sh @@ -1,6 +1,9 @@ #! /bin/sh set -efu +nix_url=https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-linux.tar.bz2 +nix_sha256=504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4 + prepare() {( if test -e /etc/os-release; then . /etc/os-release @@ -33,6 +36,13 @@ prepare() {( ;; esac ;; + nixos) + case $(cat /proc/cmdline) in + *' root=LABEL=NIXOS_ISO '*) + prepare_nixos_iso "$@" + exit + esac + ;; esac elif test -e /etc/centos-release; then case $(cat /etc/centos-release) in @@ -70,7 +80,25 @@ prepare_debian() { prepare_common } -prepare_common() { +prepare_nixos_iso() { + mountpoint /mnt + + type git 2>/dev/null || nix-env -iA nixos.git + + mkdir -p /mnt/"$target_path" + mkdir -p "$target_path" + + if ! mountpoint "$target_path"; then + mount --rbind /mnt/"$target_path" "$target_path" + fi + + mkdir -p bin + rm -f bin/nixos-install + cp "$(type -p nixos-install)" bin/nixos-install + sed -i "s@^NIX_PATH=\"[^\"]*\"@NIX_PATH=$target_path@" bin/nixos-install +} + +prepare_common() {( if ! getent group nixbld >/dev/null; then groupadd -g 30000 -r nixbld @@ -133,6 +161,50 @@ prepare_common() { mkdir -p /mnt/nix mount --bind /nix /mnt/nix fi -} + + # + # install nix + # + + # install nix on host (cf. https://nixos.org/nix/install) + if ! test -e /root/.nix-profile/etc/profile.d/nix.sh; then + ( + verify() { + printf '%s %s\n' $nix_sha256 $(basename $nix_url) | sha256sum -c + } + if ! verify; then + curl -C - -O "$nix_url" + verify + fi + ) + nix_src_dir=$(basename $nix_url .tar.bz2) + tar jxf $nix_src_dir.tar.bz2 + $nix_src_dir/install + fi + + . /root/.nix-profile/etc/profile.d/nix.sh + + for i in \ + bash \ + coreutils \ + # This line intentionally left blank. + do + if ! nix-env -q $i | grep -q .; then + nix-env -iA nixpkgs.pkgs.$i + fi + done + + # install nixos-install + if ! type nixos-install 2>/dev/null; then + nixpkgs_expr='import <nixpkgs> { system = builtins.currentSystem; }' + nixpkgs_path=$(find /nix/store -mindepth 1 -maxdepth 1 -name *-nixpkgs-* -type d) + nix-env \ + --arg config "{ nix.package = ($nixpkgs_expr).nix; }" \ + --arg pkgs "$nixpkgs_expr" \ + --arg modulesPath 'throw "no modulesPath"' \ + -f $nixpkgs_path/nixpkgs/nixos/modules/installer/tools/tools.nix \ + -iA config.system.build.nixos-install + fi +)} prepare "$@" diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix index 873f3ddfb..d0a537467 100644 --- a/krebs/4lib/types.nix +++ b/krebs/4lib/types.nix @@ -17,6 +17,7 @@ types // rec { }; nets = mkOption { type = attrsOf net; + default = {}; }; extraZones = mkOption { diff --git a/krebs/5pkgs/builders.nix b/krebs/5pkgs/builders.nix index b3cb1c943..fa51857ba 100644 --- a/krebs/5pkgs/builders.nix +++ b/krebs/5pkgs/builders.nix @@ -1,19 +1,30 @@ -{ lib, pkgs, ... }: -with lib; -{ - execve = name: { filename, argv, envp ? {}, destination ? "" }: - writeC name { inherit destination; } '' - #include <unistd.h> - int main () { - const char *filename = ${toC filename}; - char *const argv[] = ${toC (argv ++ [null])}; - char *const envp[] = ${toC ( - mapAttrsToList (k: v: "${k}=${v}") envp ++ [null] - )}; - execve(filename, argv, envp); - return -1; - } - ''; +{ config, lib, pkgs, ... }: +with config.krebs.lib; +rec { + execve = name: { filename, argv ? null, envp ? {}, destination ? "" }: let + in writeC name { inherit destination; } '' + #include <unistd.h> + + static char *const filename = ${toC filename}; + + ${if argv == null + then /* Propagate arguments */ '' + #define MAIN_ARGS int argc, char **argv + '' + else /* Provide fixed arguments */ '' + #define MAIN_ARGS void + static char *const argv[] = ${toC (argv ++ [null])}; + ''} + + static char *const envp[] = ${toC ( + mapAttrsToList (k: v: "${k}=${v}") envp ++ [null] + )}; + + int main (MAIN_ARGS) { + execve(filename, argv, envp); + return -1; + } + ''; execveBin = name: cfg: execve name (cfg // { destination = "/bin/${name}"; }); diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix index 1cf3de56e..d395fe00a 100644 --- a/krebs/5pkgs/default.nix +++ b/krebs/5pkgs/default.nix @@ -1,5 +1,5 @@ -{ lib, pkgs, ... }@args: -with lib; +{ config, lib, pkgs, ... }@args: +with config.krebs.lib; { nixpkgs.config.packageOverrides = pkgs: { haskellPackages = pkgs.haskellPackages.override { diff --git a/krebs/5pkgs/noVNC/default.nix b/krebs/5pkgs/noVNC/default.nix new file mode 100644 index 000000000..629d288ae --- /dev/null +++ b/krebs/5pkgs/noVNC/default.nix @@ -0,0 +1,21 @@ +{ fetchgit, lib, stdenv, ... }: +with builtins; +with lib; +stdenv.mkDerivation rec { + name = "${baseNameOf src.name}-${removePrefix "refs/tags/v" src.rev}"; + + src = fetchgit { + url = https://github.com/kanaka/noVNC; + rev = "refs/tags/v0.5.1"; + sha256 = "1azsnppwnrsv3axj0r5bw8lfarkibgz5vhgcyj8dzn4afn98f55w"; + }; + + phases = [ + "unpackPhase" + "installPhase" + ]; + + installPhase = '' + cp -R . $out + ''; +} diff --git a/krebs/5pkgs/vncdotool/default.nix b/krebs/5pkgs/vncdotool/default.nix new file mode 100644 index 000000000..95e2ca706 --- /dev/null +++ b/krebs/5pkgs/vncdotool/default.nix @@ -0,0 +1,20 @@ +{ lib, pythonPackages, fetchurl, ... }: +with pythonPackages; buildPythonPackage rec { + name = lib.removeSuffix ".tar.gz" (builtins.baseNameOf src.name); + + src = fetchurl { + url = https://pypi.python.org/packages/source/v/vncdotool/vncdotool-0.9.0.tar.gz; + sha256 = "1hl44w4x9c8air0g6kp9h1af2vj4lmc50vnsxmca9g080740iyvi"; + }; + + propagatedBuildInputs = [ + twisted + pillow + ]; + + meta = { + homepage = https://github.com/sibson/vncdotool; + description = "A command line VNC client and python library"; + license = lib.licenses.mit; + }; +} diff --git a/krebs/default.nix b/krebs/default.nix index 17c035896..93e006f3d 100644 --- a/krebs/default.nix +++ b/krebs/default.nix @@ -1,193 +1,8 @@ -assert false; - -{ current-host-name -, current-user-name -, lib -, stockholm -, StrictHostKeyChecking ? "yes" -}: - -let out = { - inherit infest; - inherit init; - inherit nixos-install; - }; - - infest = - { system ? current-host-name - , target ? system - }@args: let - config = get-config system; - in '' - #! /bin/sh - # krebs.infest - set -efu - - ${rootssh target '' - ${builtins.readFile ./4lib/infest/prepare.sh} - ${builtins.readFile ./4lib/infest/install-nix.sh} - ''} - - (${nixos-install args}) - - ${rootssh target '' - ${builtins.readFile ./4lib/infest/finalize.sh} - ''} - ''; - - init = - { system ? current-host-name - }@args: let - config = get-config system; - in '' - #! /bin/sh - # krebs.init - set -efu - - system=${lib.shell.escape system} - secrets_dir=${config.krebs.build.source.dir.secrets.path} - key_type=ed25519 - key_file=$secrets_dir/ssh.id_$key_type - key_comment=$system - - if test -e "$key_file"; then - echo "Warning: privkey already exists: $key_file" >&2 - else - ssh-keygen \ - -C "$key_comment" \ - -t "$key_type" \ - -f "$key_file" \ - -N "" - rm "$key_file.pub" - fi - - pubkey=$(ssh-keygen -y -f "$key_file") - - cat<<EOF - # put following into config.krebs.hosts.$system: - ssh.privkey.path = <secrets/ssh.$key_type>; - ssh.pubkey = $(echo $pubkey | jq -R .); - EOF - ''; - - nixos-install = - { system ? current-host-name - , target ? system - }@args: let - in '' - #! /bin/sh - # krebs.nixos-install - (${populate (args // { root = "/mnt"; })}) - - ${rootssh target '' - export PATH; PATH=/root/.nix-profile/bin:$PATH - - src=$(type -p nixos-install) - cat_src() { - sed < "$src" "$( - { sed < "$src" -n ' - /^if ! test -e "\$mountPoint\/\$NIXOS_CONFIG/,/^fi$/= - /^nixpkgs=/= - /^NIX_PATH=/,/^$/{/./=} - - # Disable: Copy the NixOS/Nixpkgs sources to the target as - # the initial contents of the NixOS channel. - /^srcs=/,/^ln -sfn /= - ' - } | sed 's:$:s/^/#krebs#/:' - )" - } - - # Location to insert `nix-install` - i=$(sed -n '/^echo "building the system configuration/=' "$src") - - { - cat_src | sed -n "1,$i{p}" - cat ${doc (nix-install args)} - cat_src | sed -n "$i,\''${$i!p}" - } > nixos-install - chmod +x nixos-install - - # Wrap inserted nix-install into chroot. - nix_env=$(cat_src | sed -n ' - s:.*\(/nix/store/[a-z0-9]*-nix-[0-9.]\+/bin/nix-env\).*:\1:p;T;q - ') - echo "nix-env is $nix_env" >&2 - findpkg() {( - name=$1 - path=$(find /nix/store \ - -mindepth 1 -maxdepth 1 -type d -name '*-'"$name"'-*' \ - | head -n 1 | sed s:^/mnt::) - if echo "$path" | grep .; then - echo "$name is $path" >&2 - else - echo "Error: package not found: $name" >&2 - exit 1 - fi - )} - cacert=$(findpkg cacert) - coreutils=$(findpkg coreutils) - cp "$cacert"/etc/ssl/certs/ca-bundle.crt /mnt/root/SSL_CERT_FILE - env="$coreutils/bin/env SSL_CERT_FILE=/root/SSL_CERT_FILE" - sed -i ' - s:^NIX_PATH=:chroot $mountPoint '"$env"' &: - s:^nix-env:'"$nix_env"': - ' nixos-install - - ./nixos-install - ''} - ''; - - doc = s: - let b = "EOF${builtins.hashString "sha256" s}"; in - '' - <<\${b} - ${s} - ${b} - ''; - - get-config = system: let - config = stockholm.users.${current-user-name}.${system}.config - or (abort "unknown system: ${system}, user: ${current-user-name}"); - in config; - - nix-install = - { system ? current-host-name - , target ? system - }: - let - config = get-config system; - - nix-path = - lib.concatStringsSep ":" - (lib.mapAttrsToList (name: src: "${name}=${src.target-path}") - (config.krebs.build.source.dir // - config.krebs.build.source.git)); - in '' - set -efu - NIX_PATH=${lib.shell.escape nix-path} \ - nix-env \ - --show-trace \ - -f '<stockholm>' \ - --argstr current-host-name ${lib.shell.escape current-host-name} \ - --argstr current-user-name ${lib.shell.escape current-user-name} \ - --profile ${lib.shell.escape config.krebs.build.profile} \ - --set \ - -A ${lib.escapeShellArg (lib.concatStringsSep "." [ - "users" - config.krebs.build.user.name - config.krebs.build.host.name - "system" - ])} - ''; - - rootssh = target: script: - let - flags = "-o StrictHostKeyChecking=${StrictHostKeyChecking}"; - in - "ssh ${flags} root@${target} -T ${doc '' - set -efu - ${script} - ''}"; - -in out +{ config, lib, pkgs, ... }: +with config.krebs.lib; +{ + imports = [ + ./3modules + ./5pkgs + ]; +} diff --git a/lass/1systems/cloudkrebs.nix b/lass/1systems/cloudkrebs.nix index ab24b584b..98f509050 100644 --- a/lass/1systems/cloudkrebs.nix +++ b/lass/1systems/cloudkrebs.nix @@ -7,6 +7,7 @@ let ip = (head config.krebs.build.host.nets.internet.addrs4); in { imports = [ + ../. ../2configs/os-templates/CAC-CentOS-7-64bit.nix ../2configs/base.nix ../2configs/retiolum.nix diff --git a/lass/1systems/dishfire.nix b/lass/1systems/dishfire.nix index cc9836dff..c7d016cd3 100644 --- a/lass/1systems/dishfire.nix +++ b/lass/1systems/dishfire.nix @@ -2,6 +2,7 @@ { imports = [ + ../. <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ../2configs/base.nix ../2configs/git.nix diff --git a/lass/1systems/echelon.nix b/lass/1systems/echelon.nix index 39af4a96f..2ff6dba70 100644 --- a/lass/1systems/echelon.nix +++ b/lass/1systems/echelon.nix @@ -7,6 +7,7 @@ let ip = (head config.krebs.build.host.nets.internet.addrs4); in { imports = [ + ../. ../2configs/os-templates/CAC-CentOS-7-64bit.nix ../2configs/base.nix ../2configs/retiolum.nix diff --git a/lass/1systems/helios.nix b/lass/1systems/helios.nix index 67e3738ea..88fb6aac7 100644 --- a/lass/1systems/helios.nix +++ b/lass/1systems/helios.nix @@ -3,6 +3,7 @@ with builtins; { imports = [ + ../. ../2configs/baseX.nix ../2configs/browsers.nix ../2configs/programs.nix diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix index ebce93957..f6ac1b4e6 100644 --- a/lass/1systems/mors.nix +++ b/lass/1systems/mors.nix @@ -2,6 +2,7 @@ { imports = [ + ../. ../2configs/baseX.nix ../2configs/programs.nix ../2configs/bitcoin.nix diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix index 95c55533c..05b3470e5 100644 --- a/lass/1systems/prism.nix +++ b/lass/1systems/prism.nix @@ -6,6 +6,7 @@ let ip = (head config.krebs.build.host.nets.internet.addrs4); in { imports = [ + ../. ../2configs/base.nix ../2configs/downloading.nix ../2configs/git.nix diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix index d53e783d0..0758164f0 100644 --- a/lass/1systems/uriel.nix +++ b/lass/1systems/uriel.nix @@ -3,6 +3,7 @@ with builtins; { imports = [ + ../. ../2configs/baseX.nix ../2configs/browsers.nix ../2configs/games.nix diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix index 4c73fc0ce..d2c96fdaa 100644 --- a/lass/2configs/base.nix +++ b/lass/2configs/base.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { imports = [ ../2configs/vim.nix @@ -50,12 +50,10 @@ with lib; user = config.krebs.users.lass; source = mapAttrs (_: mkDefault) ({ nixos-config = "symlink:stockholm/lass/1systems/${config.krebs.build.host.name}.nix"; - nixpkgs = symlink:stockholm/nixpkgs; secrets = "/home/lass/secrets/${config.krebs.build.host.name}"; #secrets-common = "/home/lass/secrets/common"; stockholm = "/home/lass/stockholm"; - stockholm-user = "symlink:stockholm/lass"; - upstream-nixpkgs = { + nixpkgs = { url = https://github.com/Lassulus/nixpkgs; rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce"; dev = "/home/lass/src/nixpkgs"; diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix index e80b74007..115cb8b61 100644 --- a/lass/2configs/downloading.nix +++ b/lass/2configs/downloading.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let rpc-password = import <secrets/transmission-pw.nix>; diff --git a/lass/2configs/fastpoke-pages.nix b/lass/2configs/fastpoke-pages.nix index 0470865b6..bf6ea8952 100644 --- a/lass/2configs/fastpoke-pages.nix +++ b/lass/2configs/fastpoke-pages.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let createStaticPage = domain: diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix index ac6aae44f..76b897d1f 100644 --- a/lass/2configs/git.nix +++ b/lass/2configs/git.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let diff --git a/lass/2configs/go.nix b/lass/2configs/go.nix index f4c2ac289..795ad7a26 100644 --- a/lass/2configs/go.nix +++ b/lass/2configs/go.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { environment.systemPackages = [ pkgs.go diff --git a/lass/2configs/teamviewer.nix b/lass/2configs/teamviewer.nix index 48053d7db..22bfb18d8 100644 --- a/lass/2configs/teamviewer.nix +++ b/lass/2configs/teamviewer.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { services.teamviewer.enable = true; } diff --git a/lass/2configs/xserver/Xresources.nix b/lass/2configs/xserver/Xresources.nix index d52418897..e3b0f45dc 100644 --- a/lass/2configs/xserver/Xresources.nix +++ b/lass/2configs/xserver/Xresources.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; pkgs.writeText "Xresources" '' URxvt*scrollBar: false diff --git a/lass/2configs/xserver/default.nix b/lass/2configs/xserver/default.nix index c407bb59e..82cfd57bb 100644 --- a/lass/2configs/xserver/default.nix +++ b/lass/2configs/xserver/default.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }@args: -with lib; +with config.krebs.lib; let # TODO krebs.build.user diff --git a/lass/2configs/xserver/xserver.conf.nix b/lass/2configs/xserver/xserver.conf.nix index e8a997a99..c452b4226 100644 --- a/lass/2configs/xserver/xserver.conf.nix +++ b/lass/2configs/xserver/xserver.conf.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.services.xserver; diff --git a/lass/3modules/owncloud_nginx.nix b/lass/3modules/owncloud_nginx.nix index 79c9de1d4..a10df779e 100644 --- a/lass/3modules/owncloud_nginx.nix +++ b/lass/3modules/owncloud_nginx.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.lass.owncloud; diff --git a/lass/3modules/per-user.nix b/lass/3modules/per-user.nix index 98d6339db..f8d357ce2 100644 --- a/lass/3modules/per-user.nix +++ b/lass/3modules/per-user.nix @@ -1,7 +1,6 @@ { config, lib, pkgs, ... }: -with builtins; -with lib; +with config.krebs.lib; let cfg = config.lass.per-user; diff --git a/lass/3modules/static_nginx.nix b/lass/3modules/static_nginx.nix index fd5cfdfd7..93441cf0d 100644 --- a/lass/3modules/static_nginx.nix +++ b/lass/3modules/static_nginx.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.lass.staticPage; diff --git a/lass/3modules/wordpress_nginx.nix b/lass/3modules/wordpress_nginx.nix index bfed9e7c6..108054cb6 100644 --- a/lass/3modules/wordpress_nginx.nix +++ b/lass/3modules/wordpress_nginx.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.lass.wordpress; diff --git a/lass/default.nix b/lass/default.nix new file mode 100644 index 000000000..69b4abaac --- /dev/null +++ b/lass/default.nix @@ -0,0 +1,7 @@ +_: +{ + imports = [ + ../krebs + ./3modules + ]; +} diff --git a/makefu/1systems/filepimp.nix b/makefu/1systems/filepimp.nix index fb9324ee9..f2c592ea9 100644 --- a/makefu/1systems/filepimp.nix +++ b/makefu/1systems/filepimp.nix @@ -11,6 +11,7 @@ let in { imports = [ # Include the results of the hardware scan. + ../. ../2configs/fs/single-partition-ext4.nix ../2configs/tinc-basic-retiolum.nix ../2configs/smart-monitor.nix diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix index fe800f251..04adc4941 100644 --- a/makefu/1systems/gum.nix +++ b/makefu/1systems/gum.nix @@ -1,11 +1,12 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let external-ip = head config.krebs.build.host.nets.internet.addrs4; internal-ip = head config.krebs.build.host.nets.retiolum.addrs4; in { imports = [ + ../. ../2configs/tinc-basic-retiolum.nix ../2configs/headless.nix ../2configs/fs/simple-swap.nix diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix index 34d5a394d..6cff35e9d 100644 --- a/makefu/1systems/omo.nix +++ b/makefu/1systems/omo.nix @@ -20,6 +20,7 @@ let in { imports = [ + ../. # TODO: unlock home partition via ssh ../2configs/fs/single-partition-ext4.nix ../2configs/tinc-basic-retiolum.nix diff --git a/makefu/1systems/pnp.nix b/makefu/1systems/pnp.nix index 51c124bbe..8791ad1d7 100644 --- a/makefu/1systems/pnp.nix +++ b/makefu/1systems/pnp.nix @@ -6,6 +6,7 @@ { imports = [ + ../. ../2configs/tinc-basic-retiolum.nix ../2configs/headless.nix ../../krebs/3modules/Reaktor.nix diff --git a/makefu/1systems/pornocauster.nix b/makefu/1systems/pornocauster.nix index d8ccc5846..b2cf0be79 100644 --- a/makefu/1systems/pornocauster.nix +++ b/makefu/1systems/pornocauster.nix @@ -6,6 +6,7 @@ { imports = [ # Include the results of the hardware scan. + ../. ../2configs/main-laptop.nix #< base-gui + zsh # Krebs diff --git a/makefu/1systems/repunit.nix b/makefu/1systems/repunit.nix index 0c6ba09fb..f9421cfa2 100644 --- a/makefu/1systems/repunit.nix +++ b/makefu/1systems/repunit.nix @@ -7,8 +7,9 @@ { imports = [ # Include the results of the hardware scan. + ../. <nixpkgs/nixos/modules/profiles/qemu-guest.nix> - ../2configs/cgit-retiolum.nix + ../2configs/git/cgit-retiolum.nix ]; krebs.build.host = config.krebs.hosts.repunit; diff --git a/makefu/1systems/tsp.nix b/makefu/1systems/tsp.nix index 990db65d2..d5d44cce0 100644 --- a/makefu/1systems/tsp.nix +++ b/makefu/1systems/tsp.nix @@ -6,6 +6,7 @@ { imports = [ # Include the results of the hardware scan. + ../. ../2configs/base-gui.nix ../2configs/tinc-basic-retiolum.nix ../2configs/fs/sda-crypto-root.nix diff --git a/makefu/1systems/vbob.nix b/makefu/1systems/vbob.nix index 2dee83728..e07525d0d 100644 --- a/makefu/1systems/vbob.nix +++ b/makefu/1systems/vbob.nix @@ -6,6 +6,7 @@ krebs.build.host = config.krebs.hosts.vbob; imports = [ # Include the results of the hardware scan. + ../. <nixpkgs/nixos/modules/virtualisation/virtualbox-image.nix> ../2configs/main-laptop.nix #< base-gui diff --git a/makefu/1systems/wbob.nix b/makefu/1systems/wbob.nix index 8917e4339..b4f7c9058 100644 --- a/makefu/1systems/wbob.nix +++ b/makefu/1systems/wbob.nix @@ -2,6 +2,7 @@ { imports = [ # Include the results of the hardware scan. + ../. ../2configs/main-laptop.nix ]; krebs = { diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix index f022311c9..747321968 100644 --- a/makefu/1systems/wry.nix +++ b/makefu/1systems/wry.nix @@ -1,12 +1,13 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let external-ip = head config.krebs.build.host.nets.internet.addrs4; internal-ip = head config.krebs.build.host.nets.retiolum.addrs4; in { imports = [ + ../. # TODO: copy this config or move to krebs ../../tv/2configs/hw/CAC.nix ../../tv/2configs/fs/CAC-CentOS-7-64bit.nix diff --git a/makefu/2configs/backup.nix b/makefu/2configs/backup.nix index 936f31c1c..6f79ed4f4 100644 --- a/makefu/2configs/backup.nix +++ b/makefu/2configs/backup.nix @@ -1,5 +1,5 @@ { config, lib, ... }: -with lib; +with config.krebs.lib; let startAt = "0,6,12,18:00"; defaultBackupServer = config.krebs.hosts.omo; diff --git a/makefu/2configs/base-gui.nix b/makefu/2configs/base-gui.nix index da3ad4afe..341a2ab20 100644 --- a/makefu/2configs/base-gui.nix +++ b/makefu/2configs/base-gui.nix @@ -21,7 +21,7 @@ # URxvt.visualBell: false # URxvt.font : xft:Terminus -with lib; +with config.krebs.lib; let mainUser = config.krebs.build.user.name; awesomecfg = pkgs.awesomecfg.full; diff --git a/makefu/2configs/bepasty-dual.nix b/makefu/2configs/bepasty-dual.nix index 123ae3cf9..5682f5eb6 100644 --- a/makefu/2configs/bepasty-dual.nix +++ b/makefu/2configs/bepasty-dual.nix @@ -10,7 +10,7 @@ # wildcard.krebsco.de.key # bepasty-secret.nix <- contains single string -with lib; +with config.krebs.lib; let sec = toString <secrets>; # secKey is nothing worth protecting on a local machine diff --git a/makefu/2configs/collectd/collectd-base.nix b/makefu/2configs/collectd/collectd-base.nix index 7909c1be5..c739368ca 100644 --- a/makefu/2configs/collectd/collectd-base.nix +++ b/makefu/2configs/collectd/collectd-base.nix @@ -2,7 +2,7 @@ # graphite-web on port 8080 # carbon cache on port 2003 (tcp/udp) -with lib; +with config.krebs.lib; let connect-time-cfg = with pkgs; writeText "collectd-connect-time.cfg" '' LoadPlugin python diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix index f7f70de3b..83018e9f8 100644 --- a/makefu/2configs/default.nix +++ b/makefu/2configs/default.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { system.stateVersion = "15.09"; @@ -20,7 +20,7 @@ with lib; build = { user = config.krebs.users.makefu; source = mapAttrs (_: mkDefault) { - upstream-nixpkgs = { + nixpkgs = { url = https://github.com/nixos/nixpkgs; rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; # unstable @ 2015-01-27, tested on wry }; @@ -29,8 +29,6 @@ with lib; # Defaults for all stockholm users? nixos-config = "symlink:stockholm/${config.krebs.build.user.name}/1systems/${config.krebs.build.host.name}.nix"; - nixpkgs = symlink:stockholm/nixpkgs; - stockholm-user = "symlink:stockholm/${config.krebs.build.user.name}"; }; }; }; diff --git a/makefu/2configs/exim-retiolum.nix b/makefu/2configs/exim-retiolum.nix index b8c5c5236..34943f593 100644 --- a/makefu/2configs/exim-retiolum.nix +++ b/makefu/2configs/exim-retiolum.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.exim-retiolum.enable = true; environment.systemPackages = with pkgs; [ diff --git a/makefu/2configs/fs/cac-boot-partition.nix b/makefu/2configs/fs/cac-boot-partition.nix index cec004582..bf08504d5 100644 --- a/makefu/2configs/fs/cac-boot-partition.nix +++ b/makefu/2configs/fs/cac-boot-partition.nix @@ -1,7 +1,7 @@ { config, lib, pkgs, ... }: # vda1 ext4 (label nixos) -> only root partition -with lib; +with config.krebs.lib; { boot.loader.grub.enable = true; boot.loader.grub.version = 2; diff --git a/makefu/2configs/fs/sda-crypto-root-home.nix b/makefu/2configs/fs/sda-crypto-root-home.nix index cc2133a49..5214cf872 100644 --- a/makefu/2configs/fs/sda-crypto-root-home.nix +++ b/makefu/2configs/fs/sda-crypto-root-home.nix @@ -8,7 +8,7 @@ # / (main-root) # /home (main-home) -with lib; +with config.krebs.lib; { imports = [ diff --git a/makefu/2configs/fs/sda-crypto-root.nix b/makefu/2configs/fs/sda-crypto-root.nix index 2bfe26960..e9d7b755a 100644 --- a/makefu/2configs/fs/sda-crypto-root.nix +++ b/makefu/2configs/fs/sda-crypto-root.nix @@ -3,7 +3,7 @@ # sda: bootloader grub2 # sda1: boot ext4 (label nixboot) # sda2: cryptoluks -> ext4 -with lib; +with config.krebs.lib; { boot = { loader.grub.enable = true; diff --git a/makefu/2configs/fs/vm-single-partition.nix b/makefu/2configs/fs/vm-single-partition.nix index 27e28cb68..88f209597 100644 --- a/makefu/2configs/fs/vm-single-partition.nix +++ b/makefu/2configs/fs/vm-single-partition.nix @@ -1,7 +1,7 @@ { config, lib, pkgs, ... }: # vda1 ext4 (label nixos) -> only root partition -with lib; +with config.krebs.lib; { imports = [ ./single-partition-ext4.nix diff --git a/makefu/2configs/git/brain-retiolum.nix b/makefu/2configs/git/brain-retiolum.nix index 25ef584bf..58fd250e5 100644 --- a/makefu/2configs/git/brain-retiolum.nix +++ b/makefu/2configs/git/brain-retiolum.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: # TODO: remove tv lib :) -with lib; +with config.krebs.lib; let repos = priv-repos // krebs-repos ; diff --git a/makefu/2configs/git/cgit-retiolum.nix b/makefu/2configs/git/cgit-retiolum.nix index 7d85eb8d1..a488d98f2 100644 --- a/makefu/2configs/git/cgit-retiolum.nix +++ b/makefu/2configs/git/cgit-retiolum.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: # TODO: remove tv lib :) -with lib; +with config.krebs.lib; let repos = priv-repos // krebs-repos // connector-repos ; diff --git a/makefu/2configs/graphite-standalone.nix b/makefu/2configs/graphite-standalone.nix index 8b70c11c8..dd5438e8d 100644 --- a/makefu/2configs/graphite-standalone.nix +++ b/makefu/2configs/graphite-standalone.nix @@ -2,7 +2,7 @@ # graphite-web on port 8080 # carbon cache on port 2003 (tcp/udp) -with lib; +with config.krebs.lib; { imports = [ ]; diff --git a/makefu/2configs/hw/tp-x200.nix b/makefu/2configs/hw/tp-x200.nix index ed46875d8..f17ac74a6 100644 --- a/makefu/2configs/hw/tp-x200.nix +++ b/makefu/2configs/hw/tp-x200.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { imports = [ ./tp-x2x0.nix ]; diff --git a/makefu/2configs/hw/tp-x220.nix b/makefu/2configs/hw/tp-x220.nix index 0c90e6fde..0a471bde0 100644 --- a/makefu/2configs/hw/tp-x220.nix +++ b/makefu/2configs/hw/tp-x220.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { imports = [ ./tp-x2x0.nix ]; diff --git a/makefu/2configs/hw/tp-x2x0.nix b/makefu/2configs/hw/tp-x2x0.nix index 1033f69c0..892be07b8 100644 --- a/makefu/2configs/hw/tp-x2x0.nix +++ b/makefu/2configs/hw/tp-x2x0.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { # TODO: put this somewhere else networking.wireless.enable = true; diff --git a/makefu/2configs/mail-client.nix b/makefu/2configs/mail-client.nix index bda21e9d0..913cbf25b 100644 --- a/makefu/2configs/mail-client.nix +++ b/makefu/2configs/mail-client.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { environment.systemPackages = with pkgs; [ msmtp diff --git a/makefu/2configs/main-laptop.nix b/makefu/2configs/main-laptop.nix index 32f194e6b..c3e43723c 100644 --- a/makefu/2configs/main-laptop.nix +++ b/makefu/2configs/main-laptop.nix @@ -5,7 +5,7 @@ # not fit into base-gui # TODO split generic desktop stuff and laptop-specifics like lidswitching -with lib; +with config.krebs.lib; { imports = [ ./base-gui.nix diff --git a/makefu/2configs/mattermost-docker.nix b/makefu/2configs/mattermost-docker.nix index 20a93dff1..e679a3d91 100644 --- a/makefu/2configs/mattermost-docker.nix +++ b/makefu/2configs/mattermost-docker.nix @@ -1,6 +1,6 @@ {config, lib, ...}: -with lib; +with config.krebs.lib; let sec = toString <secrets>; ssl_cert = "${sec}/wildcard.krebsco.de.crt"; diff --git a/makefu/2configs/nginx/euer.blog.nix b/makefu/2configs/nginx/euer.blog.nix index c6724c617..9d08f4b9a 100644 --- a/makefu/2configs/nginx/euer.blog.nix +++ b/makefu/2configs/nginx/euer.blog.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let sec = toString <secrets>; ssl_cert = "${sec}/wildcard.krebsco.de.crt"; diff --git a/makefu/2configs/nginx/euer.test.nix b/makefu/2configs/nginx/euer.test.nix index ffdc0bc60..f7214e613 100644 --- a/makefu/2configs/nginx/euer.test.nix +++ b/makefu/2configs/nginx/euer.test.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let hostname = config.krebs.build.host.name; user = config.services.nginx.user; diff --git a/makefu/2configs/nginx/euer.wiki.nix b/makefu/2configs/nginx/euer.wiki.nix index 2b5fa6ead..a5572a519 100644 --- a/makefu/2configs/nginx/euer.wiki.nix +++ b/makefu/2configs/nginx/euer.wiki.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let sec = toString <secrets>; ssl_cert = "${sec}/wildcard.krebsco.de.crt"; diff --git a/makefu/2configs/nginx/update.connector.one.nix b/makefu/2configs/nginx/update.connector.one.nix index eb39a1668..044a14075 100644 --- a/makefu/2configs/nginx/update.connector.one.nix +++ b/makefu/2configs/nginx/update.connector.one.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let hostname = config.krebs.build.host.name; external-ip = head config.krebs.build.host.nets.internet.addrs4; diff --git a/makefu/2configs/omo-share.nix b/makefu/2configs/omo-share.nix index 1e0975e1d..a9640b38b 100644 --- a/makefu/2configs/omo-share.nix +++ b/makefu/2configs/omo-share.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let hostname = config.krebs.build.host.name; # TODO local-ip from the nets config diff --git a/makefu/2configs/tinc-basic-retiolum.nix b/makefu/2configs/tinc-basic-retiolum.nix index f49c596fc..12d3b8b7c 100644 --- a/makefu/2configs/tinc-basic-retiolum.nix +++ b/makefu/2configs/tinc-basic-retiolum.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.retiolum = { enable = true; diff --git a/makefu/2configs/zsh-user.nix b/makefu/2configs/zsh-user.nix index f79f258f3..9527ead1a 100644 --- a/makefu/2configs/zsh-user.nix +++ b/makefu/2configs/zsh-user.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: ## -with lib; +with config.krebs.lib; let mainUser = config.krebs.build.user.name; in diff --git a/makefu/3modules/snapraid.nix b/makefu/3modules/snapraid.nix index fbdf50219..3d458bbbf 100644 --- a/makefu/3modules/snapraid.nix +++ b/makefu/3modules/snapraid.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let # returns dirname without / , used as disk name @@ -28,7 +28,7 @@ let out = { options.makefu.snapraid = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/makefu/3modules/umts.nix b/makefu/3modules/umts.nix index 1bf3ba0b5..e527a5cb7 100644 --- a/makefu/3modules/umts.nix +++ b/makefu/3modules/umts.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let # TODO: currently it is only netzclub @@ -32,7 +32,7 @@ let out = { options.makefu.umts = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/makefu/default.nix b/makefu/default.nix new file mode 100644 index 000000000..320e1a133 --- /dev/null +++ b/makefu/default.nix @@ -0,0 +1,8 @@ +_: +{ + imports = [ + ../krebs + ./2configs + ./3modules + ]; +} diff --git a/miefda/1systems/bobby.nix b/miefda/1systems/bobby.nix index d24595256..b85e686b5 100644 --- a/miefda/1systems/bobby.nix +++ b/miefda/1systems/bobby.nix @@ -7,7 +7,7 @@ { imports = [ # Include the results of the hardware scan. - + ../. ../2configs/miefda.nix ../2configs/tlp.nix ../2configs/x220t.nix diff --git a/miefda/2configs/git.nix b/miefda/2configs/git.nix index fec828f80..052cc4ab2 100644 --- a/miefda/2configs/git.nix +++ b/miefda/2configs/git.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let diff --git a/miefda/2configs/miefda.nix b/miefda/2configs/miefda.nix index 545987a68..f17e8aa34 100644 --- a/miefda/2configs/miefda.nix +++ b/miefda/2configs/miefda.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { #networking.wicd.enable = true; diff --git a/miefda/2configs/tinc-basic-retiolum.nix b/miefda/2configs/tinc-basic-retiolum.nix index b31fe15af..f82fd6b03 100644 --- a/miefda/2configs/tinc-basic-retiolum.nix +++ b/miefda/2configs/tinc-basic-retiolum.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.retiolum = { enable = true; diff --git a/miefda/2configs/tlp.nix b/miefda/2configs/tlp.nix index 0e1bb0d6b..32f4f2ee7 100644 --- a/miefda/2configs/tlp.nix +++ b/miefda/2configs/tlp.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { hardware.enableAllFirmware = true; nixpkgs.config.allowUnfree = true; diff --git a/miefda/2configs/x220t.nix b/miefda/2configs/x220t.nix index bea84f796..2d128e533 100644 --- a/miefda/2configs/x220t.nix +++ b/miefda/2configs/x220t.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { services.xserver = { diff --git a/miefda/default.nix b/miefda/default.nix new file mode 100644 index 000000000..7f275c2eb --- /dev/null +++ b/miefda/default.nix @@ -0,0 +1,6 @@ +_: +{ + imports = [ + ../krebs + ]; +} diff --git a/mv/1systems/stro.nix b/mv/1systems/stro.nix index 3915219b7..f251cb092 100644 --- a/mv/1systems/stro.nix +++ b/mv/1systems/stro.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.build.host = config.krebs.hosts.stro; @@ -9,6 +9,7 @@ with lib; "7ae05edcdd14f6ace83ead9bf0d114e97c89a83a"; imports = [ + ../. ../2configs/hw/x220.nix ../2configs/git.nix ../2configs/mail-client.nix diff --git a/mv/2configs/default.nix b/mv/2configs/default.nix index 9c412099e..d93218a18 100644 --- a/mv/2configs/default.nix +++ b/mv/2configs/default.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let HOME = getEnv "HOME"; in diff --git a/mv/2configs/git.nix b/mv/2configs/git.nix index c182d0d1e..933649f20 100644 --- a/mv/2configs/git.nix +++ b/mv/2configs/git.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let diff --git a/mv/2configs/vim.nix b/mv/2configs/vim.nix index a961b6b26..adf1da9db 100644 --- a/mv/2configs/vim.nix +++ b/mv/2configs/vim.nix @@ -1,6 +1,6 @@ -{ lib, pkgs, ... }: +{ config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let out = { environment.systemPackages = [ diff --git a/mv/2configs/xserver/Xresources.nix b/mv/2configs/xserver/Xresources.nix index f287bf206..923572721 100644 --- a/mv/2configs/xserver/Xresources.nix +++ b/mv/2configs/xserver/Xresources.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; pkgs.writeText "Xresources" '' !URxvt*background: #050505 diff --git a/mv/2configs/xserver/default.nix b/mv/2configs/xserver/default.nix index 44539c54b..3d4aa8847 100644 --- a/mv/2configs/xserver/default.nix +++ b/mv/2configs/xserver/default.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }@args: -with lib; +with config.krebs.lib; let # TODO krebs.build.user diff --git a/mv/2configs/xserver/xserver.conf.nix b/mv/2configs/xserver/xserver.conf.nix index e8a997a99..c452b4226 100644 --- a/mv/2configs/xserver/xserver.conf.nix +++ b/mv/2configs/xserver/xserver.conf.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.services.xserver; diff --git a/mv/3modules/iptables.nix b/mv/3modules/iptables.nix index cbf49f577..b2b41bf00 100644 --- a/mv/3modules/iptables.nix +++ b/mv/3modules/iptables.nix @@ -1,13 +1,12 @@ { config, lib, pkgs, ... }: -with builtins; -with lib; +with config.krebs.lib; let cfg = config.tv.iptables; out = { options.tv.iptables = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/nixpkgs/default.nix b/nixpkgs/default.nix deleted file mode 100644 index 1fe99b0ab..000000000 --- a/nixpkgs/default.nix +++ /dev/null @@ -1,5 +0,0 @@ -_: - -(import <stockholm> { - configuration = {}; -}).pkgs diff --git a/nixpkgs/krebs b/nixpkgs/krebs deleted file mode 100644 index e69de29bb..000000000 --- a/nixpkgs/krebs +++ /dev/null diff --git a/nixpkgs/lib b/nixpkgs/lib deleted file mode 120000 index 7b13c8069..000000000 --- a/nixpkgs/lib +++ /dev/null @@ -1 +0,0 @@ -../../upstream-nixpkgs/lib
\ No newline at end of file diff --git a/nixpkgs/nixos/default.nix b/nixpkgs/nixos/default.nix deleted file mode 100644 index 4fe08efd2..000000000 --- a/nixpkgs/nixos/default.nix +++ /dev/null @@ -1 +0,0 @@ -import <stockholm> diff --git a/nixpkgs/nixos/lib b/nixpkgs/nixos/lib deleted file mode 120000 index 9e69d1a67..000000000 --- a/nixpkgs/nixos/lib +++ /dev/null @@ -1 +0,0 @@ -../../../upstream-nixpkgs/nixos/lib
\ No newline at end of file diff --git a/nixpkgs/nixos/modules b/nixpkgs/nixos/modules deleted file mode 120000 index 8aa24885c..000000000 --- a/nixpkgs/nixos/modules +++ /dev/null @@ -1 +0,0 @@ -../../../upstream-nixpkgs/nixos/modules
\ No newline at end of file @@ -1 +0,0 @@ -../stockholm-user
\ No newline at end of file diff --git a/shared/1systems/test-all-krebs-modules.nix b/shared/1systems/test-all-krebs-modules.nix index b98004dfe..e1021c7e0 100644 --- a/shared/1systems/test-all-krebs-modules.nix +++ b/shared/1systems/test-all-krebs-modules.nix @@ -2,6 +2,9 @@ let en = { enable = true;}; in { + imports = [ + ../. + ]; krebs = { enable = true; build.user = config.krebs.users.shared; diff --git a/shared/1systems/test-arch.nix b/shared/1systems/test-arch.nix index ece209490..14fc0384b 100644 --- a/shared/1systems/test-arch.nix +++ b/shared/1systems/test-arch.nix @@ -2,6 +2,7 @@ { imports = [ + ../. ../2configs/base.nix { boot.loader.grub = { diff --git a/shared/1systems/test-centos6.nix b/shared/1systems/test-centos6.nix index a8b5f9b9c..8add0b7c1 100644 --- a/shared/1systems/test-centos6.nix +++ b/shared/1systems/test-centos6.nix @@ -7,6 +7,7 @@ let gw = "168.235.148.1"; in { imports = [ + ../. ../2configs/base.nix ../2configs/os-templates/CAC-CentOS-6.5-64bit.nix { diff --git a/shared/1systems/test-centos7.nix b/shared/1systems/test-centos7.nix index 48cecc877..65daff509 100644 --- a/shared/1systems/test-centos7.nix +++ b/shared/1systems/test-centos7.nix @@ -5,6 +5,7 @@ let in { imports = [ + ../. ../2configs/base.nix ../2configs/os-templates/CAC-CentOS-7-64bit.nix ../2configs/temp/networking.nix diff --git a/shared/1systems/test-failing.nix b/shared/1systems/test-failing.nix index 81a9e48d6..fe1c2cb65 100644 --- a/shared/1systems/test-failing.nix +++ b/shared/1systems/test-failing.nix @@ -1,6 +1,9 @@ { config, pkgs, ... }: { + imports = [ + ../. + ]; programs.ssh.startAgent = true; programs.ssh.startAgent = false; } diff --git a/shared/1systems/test-minimal-deploy.nix b/shared/1systems/test-minimal-deploy.nix index 309e28950..bec2b38d5 100644 --- a/shared/1systems/test-minimal-deploy.nix +++ b/shared/1systems/test-minimal-deploy.nix @@ -1,5 +1,8 @@ { config, pkgs, lib, ... }: { + imports = [ + ../. + ]; krebs = { enable = true; build.user = config.krebs.users.shared; diff --git a/shared/1systems/wolf.nix b/shared/1systems/wolf.nix index 588ec1b55..96691aed8 100644 --- a/shared/1systems/wolf.nix +++ b/shared/1systems/wolf.nix @@ -6,6 +6,7 @@ let in { imports = [ + ../. ../2configs/base.nix <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ../2configs/collectd-base.nix diff --git a/shared/2configs/base.nix b/shared/2configs/base.nix index 715397ed5..9f998b554 100644 --- a/shared/2configs/base.nix +++ b/shared/2configs/base.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.enable = true; krebs.retiolum = { @@ -16,7 +16,7 @@ with lib; # TODO rename shared user to "krebs" krebs.build.user = mkDefault config.krebs.users.shared; krebs.build.source = { - upstream-nixpkgs = mkDefault { + nixpkgs = mkDefault { url = https://github.com/NixOS/nixpkgs; rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; # for urlwatch-minidb }; @@ -24,8 +24,6 @@ with lib; stockholm = mkDefault "${getEnv "HOME"}/stockholm"; nixos-config = "symlink:stockholm/${config.krebs.build.user.name}/1systems/${config.krebs.build.host.name}.nix"; - nixpkgs = symlink:stockholm/nixpkgs; - stockholm-user = "symlink:stockholm/${config.krebs.build.user.name}"; }; networking.hostName = config.krebs.build.host.name; diff --git a/shared/2configs/cgit-mirror.nix b/shared/2configs/cgit-mirror.nix index 0794ee411..b984535c9 100644 --- a/shared/2configs/cgit-mirror.nix +++ b/shared/2configs/cgit-mirror.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let rules = with git; singleton { user = [ wolf-repo-sync ]; diff --git a/shared/2configs/collectd-base.nix b/shared/2configs/collectd-base.nix index 3b792bf23..9c63dcd20 100644 --- a/shared/2configs/collectd-base.nix +++ b/shared/2configs/collectd-base.nix @@ -1,7 +1,7 @@ { config, lib, pkgs, ... }: # TODO: krebs.collectd.plugins -with lib; +with config.krebs.lib; let connect-time-cfg = with pkgs; writeText "collectd-connect-time.conf" '' LoadPlugin python diff --git a/shared/2configs/graphite.nix b/shared/2configs/graphite.nix index 707ec6e9a..37c6b09fd 100644 --- a/shared/2configs/graphite.nix +++ b/shared/2configs/graphite.nix @@ -5,7 +5,7 @@ # TODO: krebs.graphite.minimal.enable # TODO: configure firewall -with lib; +with config.krebs.lib; { imports = [ ]; diff --git a/shared/2configs/shared-buildbot.nix b/shared/2configs/shared-buildbot.nix index 19724ac01..ebf5f4a1e 100644 --- a/shared/2configs/shared-buildbot.nix +++ b/shared/2configs/shared-buildbot.nix @@ -64,7 +64,7 @@ # prepare nix-shell # the dependencies which are used by the test script deps = [ "gnumake", "jq","nix","rsync", - "(import <stockholm> {}).pkgs.test.infest-cac-centos7" ] + "(import <stockholm>).pkgs.test.infest-cac-centos7" ] # TODO: --pure , prepare ENV in nix-shell command: # SSL_CERT_FILE,LOGNAME,NIX_REMOTE nixshell = ["nix-shell", diff --git a/shared/default.nix b/shared/default.nix new file mode 100644 index 000000000..69b4abaac --- /dev/null +++ b/shared/default.nix @@ -0,0 +1,7 @@ +_: +{ + imports = [ + ../krebs + ./3modules + ]; +} diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix index b96548d61..9b6382607 100644 --- a/tv/1systems/cd.nix +++ b/tv/1systems/cd.nix @@ -1,11 +1,12 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.build.host = config.krebs.hosts.cd; imports = [ + ../. ../2configs/hw/CAC-Developer-2.nix ../2configs/fs/CAC-CentOS-7-64bit.nix ../2configs/exim-smarthost.nix diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix index 2010dcd57..58a8fdcb2 100644 --- a/tv/1systems/mkdir.nix +++ b/tv/1systems/mkdir.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let # TODO merge with lass @@ -19,6 +19,7 @@ in krebs.build.host = config.krebs.hosts.mkdir; imports = [ + ../. ../2configs/hw/CAC-Developer-1.nix ../2configs/fs/CAC-CentOS-7-64bit.nix ../2configs/exim-smarthost.nix diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix index 37ef204c7..2c9775da7 100644 --- a/tv/1systems/nomic.nix +++ b/tv/1systems/nomic.nix @@ -1,11 +1,12 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.build.host = config.krebs.hosts.nomic; imports = [ + ../. ../2configs/hw/AO753.nix ../2configs/exim-retiolum.nix ../2configs/git.nix diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix index 4005b5e6f..c54caa649 100644 --- a/tv/1systems/rmdir.nix +++ b/tv/1systems/rmdir.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let # TODO merge with lass @@ -19,6 +19,7 @@ in krebs.build.host = config.krebs.hosts.rmdir; imports = [ + ../. ../2configs/hw/CAC-Developer-1.nix ../2configs/fs/CAC-CentOS-7-64bit.nix ../2configs/exim-smarthost.nix diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index 4ed13a0ea..6154e4df9 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -1,11 +1,12 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.build.host = config.krebs.hosts.wu; imports = [ + ../. ../2configs/hw/w110er.nix ../2configs/exim-retiolum.nix ../2configs/git.nix @@ -191,8 +192,6 @@ with lib; "d /tmp 1777 root root - -" # does this work with mounted /tmp? ]; - virtualisation.libvirtd.enable = true; - services.udev.extraRules = '' SUBSYSTEM=="net", ATTR{address}=="00:90:f5:da:aa:c3", NAME="en0" SUBSYSTEM=="net", ATTR{address}=="a0:88:b4:1b:ae:6c", NAME="wl0" @@ -211,5 +210,4 @@ with lib; services.tor.client.enable = true; services.tor.enable = true; services.virtualboxHost.enable = true; - } diff --git a/tv/1systems/xu-qemu0.nix b/tv/1systems/xu-qemu0.nix new file mode 100644 index 000000000..8945c1907 --- /dev/null +++ b/tv/1systems/xu-qemu0.nix @@ -0,0 +1,28 @@ +{ config, lib, pkgs, ... }: + +{ + krebs.hosts.xu-qemu0 = { + cores = 1; + ssh.privkey.path = <secrets/ssh.id_ed25519>; + # cannot define ssh.pubkey without at least one addr or alias + #ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFe51rD0ZqlMXNi/YpapnRzvdzCjI0icmxfCyBLSKG04"; + }; + krebs.build.host = config.krebs.hosts.xu-qemu0; + + imports = [ + ../. + <nixpkgs/nixos/modules/profiles/qemu-guest.nix> + ]; + + boot.loader.grub.device = "/dev/sda"; + + fileSystems = { + "/boot" = { + device = "/dev/sda1"; + }; + "/" = { + device = "/dev/sda2"; + fsType = "btrfs"; + }; + }; +} diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index 8c4af2bd3..5ec1fe52b 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -1,11 +1,12 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.build.host = config.krebs.hosts.xu; imports = [ + ../. ../2configs/hw/x220.nix ../2configs/exim-retiolum.nix ../2configs/git.nix @@ -14,6 +15,7 @@ with lib; ../2configs/pulse.nix ../2configs/retiolum.nix ../2configs/xserver + ../2configs/xu-qemu0.nix { environment.systemPackages = with pkgs; [ @@ -43,7 +45,7 @@ with lib; # tv bc bind # dig - #cac + cac-api dic file gnupg21 @@ -189,8 +191,6 @@ with lib; "d /tmp 1777 root root - -" # does this work with mounted /tmp? ]; - #virtualisation.libvirtd.enable = true; - #services.bitlbee.enable = true; #services.tor.client.enable = true; #services.tor.enable = true; diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix index 6c90709a8..641e2d586 100644 --- a/tv/2configs/backup.nix +++ b/tv/2configs/backup.nix @@ -1,5 +1,5 @@ { config, lib, ... }: -with lib; +with config.krebs.lib; { krebs.backup.plans = { wu-home-xu = { @@ -26,5 +26,28 @@ with lib; yearly = { format = "%Y"; }; }; }; + } // mapAttrs (_: recursiveUpdate { + snapshots = { + minutely = { format = "%Y-%m-%dT%H:%M"; retain = 3; }; + hourly = { format = "%Y-%m-%dT%H"; retain = 3; }; + daily = { format = "%Y-%m-%d"; retain = 3; }; + }; + startAt = null; + }) { + xu-test-push-xu = { + method = "push"; + src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; }; + dst = { host = config.krebs.hosts.xu; path = "/bku/xu-test-push"; }; + }; + xu-test-pull-xu = { + method = "pull"; + src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; }; + dst = { host = config.krebs.hosts.xu; path = "/bku/xu-test-pull"; }; + }; + xu-test-push-wu = { + method = "push"; + src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; }; + dst = { host = config.krebs.hosts.wu; path = "/bku/xu-test-push"; }; + }; }; } diff --git a/tv/2configs/charybdis.nix b/tv/2configs/charybdis.nix index f9ab3da68..eefb2810b 100644 --- a/tv/2configs/charybdis.nix +++ b/tv/2configs/charybdis.nix @@ -1,13 +1,12 @@ { config, lib, pkgs, ... }: -with builtins; -with lib; +with config.krebs.lib; let cfg = config.tv.charybdis; out = { options.tv.charybdis = api; - config = mkIf cfg.enable (mkMerge [ + config = lib.mkIf cfg.enable (lib.mkMerge [ imp { tv.iptables.input-retiolum-accept-new-tcp = [ 6667 6697 ]; } ]); diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index b5639af51..c4a2d6baa 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.enable = true; @@ -9,12 +9,10 @@ with lib; user = config.krebs.users.tv; source = mapAttrs (_: mkDefault) ({ nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix"; - nixpkgs = symlink:stockholm/nixpkgs; secrets = "/home/tv/secrets/${config.krebs.build.host.name}"; secrets-common = "/home/tv/secrets/common"; stockholm = "/home/tv/stockholm"; - stockholm-user = "symlink:stockholm/tv"; - upstream-nixpkgs = { + nixpkgs = { url = https://github.com/NixOS/nixpkgs; rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; dev = "/home/tv/nixpkgs"; @@ -44,6 +42,7 @@ with lib; tv = { isNormalUser = true; uid = 1337; + extraGroups = [ "tv" ]; }; }; }; @@ -184,6 +183,15 @@ with lib; ]; } { + environment.systemPackages = [ + pkgs.get + pkgs.krebszones + pkgs.nix-prefetch-scripts + pkgs.push + ]; + } + + { systemd.tmpfiles.rules = let forUsers = flip map users; isUser = { name, group, ... }: diff --git a/tv/2configs/exim-retiolum.nix b/tv/2configs/exim-retiolum.nix index aedf25823..9197a3c30 100644 --- a/tv/2configs/exim-retiolum.nix +++ b/tv/2configs/exim-retiolum.nix @@ -1,6 +1,6 @@ -{ lib, ... }: +{ config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.exim-retiolum.enable = true; diff --git a/tv/2configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix index bcfea7821..4b49e20b1 100644 --- a/tv/2configs/exim-smarthost.nix +++ b/tv/2configs/exim-smarthost.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.exim-smarthost = { diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix index f248a8cb5..7a42ca9fa 100644 --- a/tv/2configs/git.nix +++ b/tv/2configs/git.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let diff --git a/tv/2configs/hw/AO753.nix b/tv/2configs/hw/AO753.nix index e7a2b9238..b81b773be 100644 --- a/tv/2configs/hw/AO753.nix +++ b/tv/2configs/hw/AO753.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { imports = [ diff --git a/tv/2configs/nginx-public_html.nix b/tv/2configs/nginx-public_html.nix index dc74f7f8d..15a3b5482 100644 --- a/tv/2configs/nginx-public_html.nix +++ b/tv/2configs/nginx-public_html.nix @@ -1,6 +1,6 @@ -{ lib, ... }: +{ config, lib, ... }: -with lib; +with config.krebs.lib; { krebs.nginx = { diff --git a/tv/2configs/pulse.nix b/tv/2configs/pulse.nix index e1894ca64..8e611f21e 100644 --- a/tv/2configs/pulse.nix +++ b/tv/2configs/pulse.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let pkg = pkgs.pulseaudioLight; runDir = "/run/pulse"; diff --git a/tv/2configs/retiolum.nix b/tv/2configs/retiolum.nix index d2bb9e6cf..e1598d792 100644 --- a/tv/2configs/retiolum.nix +++ b/tv/2configs/retiolum.nix @@ -1,6 +1,6 @@ { config, lib, ... }: -with lib; +with config.krebs.lib; { krebs.retiolum = { diff --git a/tv/2configs/urlwatch.nix b/tv/2configs/urlwatch.nix index 8189f6345..0106cddf7 100644 --- a/tv/2configs/urlwatch.nix +++ b/tv/2configs/urlwatch.nix @@ -51,6 +51,9 @@ # <stockholm/tv/2configs/xserver/xserver.conf.nix> # is derived from `configFile` in: https://raw.githubusercontent.com/NixOS/nixpkgs/master/nixos/modules/services/x11/xserver.nix + + https://pypi.python.org/pypi/vncdotool + https://api.github.com/repos/kanaka/noVNC/tags ]; }; } diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix index 69a880dab..b0c26e50e 100644 --- a/tv/2configs/vim.nix +++ b/tv/2configs/vim.nix @@ -1,6 +1,6 @@ -{ lib, pkgs, ... }: +{ config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let out = { environment.systemPackages = [ diff --git a/tv/2configs/xserver/Xresources.nix b/tv/2configs/xserver/Xresources.nix index f287bf206..923572721 100644 --- a/tv/2configs/xserver/Xresources.nix +++ b/tv/2configs/xserver/Xresources.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; pkgs.writeText "Xresources" '' !URxvt*background: #050505 diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix index 5cd17aa1d..4b936f473 100644 --- a/tv/2configs/xserver/default.nix +++ b/tv/2configs/xserver/default.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }@args: -with lib; +with config.krebs.lib; let # TODO krebs.build.user diff --git a/tv/2configs/xserver/xserver.conf.nix b/tv/2configs/xserver/xserver.conf.nix index e8a997a99..c452b4226 100644 --- a/tv/2configs/xserver/xserver.conf.nix +++ b/tv/2configs/xserver/xserver.conf.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.services.xserver; diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix new file mode 100644 index 000000000..720a8acd8 --- /dev/null +++ b/tv/2configs/xu-qemu0.nix @@ -0,0 +1,243 @@ +{ config, lib, pkgs, ... }: + +let + # XXX cannot use config.build.host.name here because infinite recursion when + # defining krebs.hosts.${host-name}.nets.retiolum.aliases below. + host-name = "xu"; +in + +# usage: +# echo set_password vnc correcthorze | xu-qemu0-monitor +# +# vncdo -s xu:1 type 'curl init.xu.r' key shift-\\ type sh key return +# +# http://vnc.xu/vnc_auto.html?port=5701&host=xu&password=correcthorze +# +# make [install] system=xu-qemu0 target_host=10.56.0.101 + +# TODO iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT +# TODO iptables -A FORWARD -i qemubr0 -s 10.56.0.1/24 -m conntrack --ctstate NEW -j ACCEPT +# TODO iptables -A POSTROUTING -t nat -j MASQUERADE +# TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport bootps -j ACCEPT +# TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT + +with config.krebs.lib; + +{ + networking.dhcpcd.denyInterfaces = [ "qemubr0" ]; + + systemd.network.enable = true; + services.resolved.enable = mkForce false; + + boot.kernel.sysctl."net.ipv4.ip_forward" = 1; + + systemd.network.networks.qemubr0 = { + matchConfig.Name = "qemubr0"; + address = ["10.56.0.1/24"]; + routes = [{ + routeConfig = { + Gateway = "*"; + Destination = "10.56.0.0"; + }; + }]; + }; + systemd.network.netdevs.qemubr0 = { + netdevConfig = { + Name = "qemubr0"; + Kind = "bridge"; + }; + }; + + users.groups.qemu-users.gid = genid "qemu-users"; + + environment.etc."qemu/bridge.conf".text = '' + allow qemubr0 + ''; + + krebs.per-user.tv.packages = [ + pkgs.vncdotool + ]; + + users.users.xu-qemu0 = { + createHome = true; + group = "qemu-users"; + home = "/home/xu-qemu0"; + uid = genid "xu-qemu0"; + }; + + systemd.services.xu-qemu0 = let + in { + after = [ "network.target" "systemd-resolved.service" ]; + serviceConfig = { + User = "xu-qemu0"; + SyslogIdentifier = "xu-qemu0"; + ExecStart = pkgs.writeDash "xu-qemu0" '' + set -efu + ${pkgs.coreutils}/bin/mkdir -p "$HOME/tmp" + img=$HOME/tmp/xu-qemu0.raw + if ! test -e "$img"; then + ${pkgs.kvm}/bin/qemu-img create "$img" 10G + fi + exec ${pkgs.kvm}/bin/qemu-kvm \ + -monitor unix:$HOME/tmp/xu-qemu0-monitor.sock,server,nowait \ + -boot order=cd \ + -cdrom ${pkgs.fetchurl { + url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso; + sha256 = "18bc9wrsrjnhj9rya75xliqkl99gxbsk4dmwqivhvwfzb5qb5yp9"; + }} \ + -m 1024 \ + -netdev bridge,br=qemubr0,id=hn0,helper=/var/setuid-wrappers/qemu-bridge-helper \ + -net nic,netdev=hn0,id=nic1,macaddr=52:54:00:12:34:56 \ + -drive file="$img",format=raw \ + -display vnc=:1,websocket=5701,password,lossy \ + -name xu-qemu0 \ + ''; + }; + }; + + krebs.setuid.xu-qemu0-monitor = { + filename = pkgs.writeDash "xu-qemu0-monitor" '' + exec ${pkgs.socat}/bin/socat \ + stdio \ + UNIX-CONNECT:${config.users.users.xu-qemu0.home}/tmp/xu-qemu0-monitor.sock \ + ''; + owner = "xu-qemu0"; + group = "tv"; + }; + + krebs.setuid.qemu-bridge-helper = { + filename = "${pkgs.qemu}/libexec/qemu-bridge-helper"; + group = "qemu-users"; + }; + + users.users.qemu-dnsmasq.uid = genid "qemu-dnsmasq"; + + # TODO need custom etc/dbus-1/system.d/dnsmasq.conf for different BusName + services.dbus.packages = [ pkgs.dnsmasq ]; + + systemd.services.qemu-dnsmasq = let + # bind-interfaces + conf = pkgs.writeText "qemu-dnsmasq.conf" '' + listen-address=10.56.0.1 + interface=qemubr0 + dhcp-range=10.56.0.200,10.56.0.250 + dhcp-no-override + dhcp-leasefile=/tmp/qemu-dnsmasq.leases + domain=${host-name}.local + dhcp-host=52:54:00:12:34:56,xu-qemu0,10.56.0.101,1440m + ''; + in { + after = [ "network.target" "systemd-resolved.service" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + Type = "dbus"; + BusName = "uk.org.thekelleys.dnsmasq"; + # -1 --enable-dbus[=uk.org.thekelleys.dnsmasq] + SyslogIdentifier = "qemu-dnsmasq"; + ExecStart = "${pkgs.dnsmasq}/bin/dnsmasq -1k -u qemu-dnsmasq -C ${conf}"; + ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; + PrivateTmp = "true"; + }; + restartTriggers = [ config.environment.etc.hosts.source ]; + }; + + + krebs.nginx.servers.init = { + server-names = [ + "init.${host-name}" + "init.${host-name}.r" + "init.${host-name}.retiolum" + ]; + extraConfig = '' + index init.txt; + root ${pkgs.writeTextFile { + name = "init-pages"; + text = '' + #! /bin/sh + set -efu + + dev=/dev/sda + pttype=dos # gpt + + case $pttype in + dos) + if ! test "$(blkid -o value -s PTTYPE "$dev")" = dos; then + parted -s "$dev" mklabel msdos + fi + if ! test "$(blkid -o value -s PARTLABEL "$dev"1)" = primary; then + parted -s "$dev" mkpart primary ext4 1MiB 513MiB + parted -s "$dev" set 1 boot on + fi + ;; + gpt) + if ! test "$(blkid -o value -s PTTYPE "$dev")" = gpt; then + parted -s "$dev" mklabel gpt + fi + if ! test "$(blkid -o value -s PARTLABEL "$dev"1)" = ESP; then + parted -s "$dev" mkpart ESP fat32 1MiB 513MiB + parted -s "$dev" set 1 boot on + fi + ;; + *) + echo "Error: bad pttype: $pttype" >&2 + exit -1 + esac + + if ! test "$(blkid -o value -s PARTLABEL "$dev"2)" = primary; then + parted -s "$dev" mkpart primary btrfs 513MiB 100% + fi + if ! test "$(blkid -o value -s TYPE "$dev"1)" = vfat; then + mkfs.vfat "$dev"1 + fi + if ! test "$(blkid -o value -s TYPE "$dev"2)" = btrfs; then + mkfs.btrfs "$dev"2 + fi + + parted "$dev" print + + if ! test "$(lsblk -n -o MOUNTPOINT "$dev"2)" = /mnt; then + mount "$dev"2 /mnt + fi + if ! test "$(lsblk -n -o MOUNTPOINT "$dev"1)" = /mnt/boot; then + mkdir -m 0000 -p /mnt/boot + mount "$dev"1 /mnt/boot + fi + + lsblk "$dev" + + key=${shell.escape config.krebs.users.tv-xu.pubkey} + + if [ "$(cat /root/.ssh/authorized_keys 2>/dev/null)" != "$key" ]; then + mkdir -p /root/.ssh + echo "$key" > /root/.ssh/authorized_keys + fi + systemctl start sshd + ip route + echo READY. + ''; + destination = "/init.txt"; + }}; + ''; + }; + + + krebs.hosts.${host-name}.nets.retiolum.aliases = [ + "init.${host-name}.r" + "init.${host-name}.retiolum" + "vnc.${host-name}.r" + "vnc.${host-name}.retiolum" + ]; + + krebs.nginx.servers.noVNC = { + server-names = [ + "vnc.${host-name}" + "vnc.${host-name}.r" + "vnc.${host-name}.retiolum" + ]; + #rewrite ^([^.]*)$ /vnc_auto.html?host=localhost&port=5701; + locations = singleton (nameValuePair "/" '' + index vnc.html; + root ${pkgs.noVNC}; + ''); + }; +} diff --git a/tv/3modules/ejabberd.nix b/tv/3modules/ejabberd.nix index 581e10074..c9d9b48b1 100644 --- a/tv/3modules/ejabberd.nix +++ b/tv/3modules/ejabberd.nix @@ -1,13 +1,12 @@ { config, lib, pkgs, ... }: -with builtins; -with lib; +with config.krebs.lib; let cfg = config.tv.ejabberd; out = { options.tv.ejabberd = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix index 4924db4f3..c0fd7ec12 100644 --- a/tv/3modules/iptables.nix +++ b/tv/3modules/iptables.nix @@ -1,13 +1,12 @@ { config, lib, pkgs, ... }: -with builtins; -with lib; +with config.krebs.lib; let cfg = config.tv.iptables; out = { options.tv.iptables = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/tv/default.nix b/tv/default.nix new file mode 100644 index 000000000..b1c7c1be8 --- /dev/null +++ b/tv/default.nix @@ -0,0 +1,9 @@ +_: +{ + imports = [ + ../krebs + ./2configs + ./3modules + ./5pkgs + ]; +} |