From 3175318eb0542d0751491b7f9e881d50f8ba6741 Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 19 Oct 2015 19:46:26 +0200 Subject: m 2 cgit: add tinc_graphs repo --- makefu/2configs/git/cgit-retiolum.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/makefu/2configs/git/cgit-retiolum.nix b/makefu/2configs/git/cgit-retiolum.nix index 1277a014e..189dd66c8 100644 --- a/makefu/2configs/git/cgit-retiolum.nix +++ b/makefu/2configs/git/cgit-retiolum.nix @@ -10,6 +10,9 @@ let stockholm = { desc = "Make all the systems into 1systems!"; }; + tinc_graphs = { + desc = "Tinc Advanced Graph Generation"; + }; }; priv-repos = mapAttrs make-priv-repo { -- cgit v1.2.3 From 7656868d1b3232d5a17ed422c25c38e37c81e588 Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 19 Oct 2015 19:48:56 +0200 Subject: m 1 wry: start Reaktor --- makefu/1systems/wry.nix | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-) diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix index 819a208ac..d8c8d6fa1 100644 --- a/makefu/1systems/wry.nix +++ b/makefu/1systems/wry.nix @@ -5,23 +5,29 @@ let ip = (lib.head config.krebs.build.host.nets.internet.addrs4); in { imports = [ - ../../tv/2configs/CAC-CentOS-7-64bit.nix - ../2configs/base.nix - ../2configs/base-sources.nix - ../2configs/tinc-basic-retiolum.nix + # TODO: copy this config or move to krebs + ../../tv/2configs/CAC-CentOS-7-64bit.nix + ../2configs/base.nix + ../2configs/base-sources.nix + ../2configs/tinc-basic-retiolum.nix + + # Reaktor + ../2configs/Reaktor/simpleExtend.nix ]; + krebs.Reaktor.enable = true; + networking.firewall.allowPing = true; networking.interfaces.enp2s1.ip4 = [ - { - address = ip; - prefixLength = 24; - } - ]; - networking.defaultGateway = "104.233.87.1"; - networking.nameservers = [ - "8.8.8.8" - ]; + { + address = ip; + prefixLength = 24; + } + ]; + networking.defaultGateway = "104.233.87.1"; + networking.nameservers = [ + "8.8.8.8" + ]; # based on ../../tv/2configs/CAC-Developer-2.nix sound.enable = false; -- cgit v1.2.3 From 952c03b3742cc1a979e4a1c148d083f1334cfe65 Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 19 Oct 2015 20:02:29 +0200 Subject: krebs 5 retiolum-bootstrap: init new_install.sh package --- krebs/5pkgs/retiolum-bootstrap/default.nix | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 krebs/5pkgs/retiolum-bootstrap/default.nix diff --git a/krebs/5pkgs/retiolum-bootstrap/default.nix b/krebs/5pkgs/retiolum-bootstrap/default.nix new file mode 100644 index 000000000..d3bcc05db --- /dev/null +++ b/krebs/5pkgs/retiolum-bootstrap/default.nix @@ -0,0 +1,6 @@ +{ fetchurl }: + +fetchurl { + url = https://raw.githubusercontent.com/krebscode/painload/master/retiolum/scripts/tinc_setup/new_install.sh; + sha256 = "03kmil8q2xm3rdm2jxyah7vww84pw6w01d0c3siid9zpn2j7la9s"; +} -- cgit v1.2.3 From 5a1808617aa121b8fc66389d8e92e387bb25a64c Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 19 Oct 2015 21:49:08 +0200 Subject: krebs 5 retiolum-bootstrap: packing to be used by nginx --- krebs/5pkgs/retiolum-bootstrap/default.nix | 31 ++++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-) diff --git a/krebs/5pkgs/retiolum-bootstrap/default.nix b/krebs/5pkgs/retiolum-bootstrap/default.nix index d3bcc05db..331b1cb7f 100644 --- a/krebs/5pkgs/retiolum-bootstrap/default.nix +++ b/krebs/5pkgs/retiolum-bootstrap/default.nix @@ -1,6 +1,29 @@ -{ fetchurl }: +{ stdenv,lib,fetchurl, ... }: +with lib; +stdenv.mkDerivation rec { + name = "retiolum-bootstrap"; + version = "4.2.3"; -fetchurl { - url = https://raw.githubusercontent.com/krebscode/painload/master/retiolum/scripts/tinc_setup/new_install.sh; - sha256 = "03kmil8q2xm3rdm2jxyah7vww84pw6w01d0c3siid9zpn2j7la9s"; + + src = fetchurl { + url = https://raw.githubusercontent.com/krebscode/painload/master/retiolum/scripts/tinc_setup/new_install.sh; + sha256 = "03kmil8q2xm3rdm2jxyah7vww84pw6w01d0c3siid9zpn2j7la9s"; + }; + + phases = [ + "installPhase" + ]; + + installPhase = '' + mkdir -p "$out" + cp -a ${src} $out/retiolum.sh + ''; + + meta = { + description = "Retiolum boostrap scripts"; + url = https://github.com/krebscode/painload; + license = licenses.wtfpl; + platforms = platforms.unix; + maintainers = with maintainers; [ makefu ]; + }; } -- cgit v1.2.3 From 754ea55ab89cdeffaac7b4b66ca792558fed9237 Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 19 Oct 2015 21:50:08 +0200 Subject: krebs 3 retiolum-bootstrap: init module --- krebs/3modules/default.nix | 1 + krebs/3modules/retiolum-bootstrap.nix | 60 +++++++++++++++++++++++++++++++++++ 2 files changed, 61 insertions(+) create mode 100644 krebs/3modules/retiolum-bootstrap.nix diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index ff0cc8346..756245c0b 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -14,6 +14,7 @@ let ./iptables.nix ./nginx.nix ./Reaktor.nix + ./retiolum-bootstrap.nix ./realwallpaper.nix ./retiolum.nix ./urlwatch.nix diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix new file mode 100644 index 000000000..5cce4c2af --- /dev/null +++ b/krebs/3modules/retiolum-bootstrap.nix @@ -0,0 +1,60 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + cfg = config.krebs.retiolum-bootstrap; + + out = { + options.krebs.retiolum-bootstrap = api; + config = mkIf cfg.enable imp ; + }; + + api = { + enable = mkEnableOption "retiolum boot strap for tinc.krebsco.de"; + hostname = mkOption { + type = types.str; + description = "hostname which serves tinc boot"; + default = "tinc.krebsco.de" ; + }; + ssl_certificate_key = mkOption { + type = types.str; + description = "Certificate key to use for ssl"; + default = "/root/secrets/tinc.krebsco.de.key"; + }; + ssl_certificate = mkOption { + type = types.str; + description = "Certificate file to use for ssl"; + default = "/root/secrets/tinc.krebsco.de.crt" ; + }; + # in use: + # + # + }; + + imp = { + # TODO: assert krebs nginx + + krebs.nginx.servers = { + retiolum-boot-redir = { + server-names = singleton cfg.hostname; + extraConfig = '' + return 301 https://$server_name$request_uri; + ''; + locations = []; + }; + retiolum-boot-ssl = { + server-names = singleton cfg.hostname; + listen = "443 ssl"; + extraConfig = '' + ssl_certificate ${cfg.ssl_certificate}; + ssl_certificate_key ${cfg.ssl_certificate_key}; + root ${pkgs.retiolum-bootstrap}; + try_files $uri $uri/retiolum.sh; + ''; + locations = []; + }; + }; + }; + +in +out -- cgit v1.2.3 From 858034cc615469c6e4b7e48711f6fb026f16ffb4 Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 19 Oct 2015 21:51:20 +0200 Subject: m 1 wry: host is the new provider for tinc.krebsco.de --- krebs/3modules/makefu/default.nix | 2 +- makefu/1systems/wry.nix | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix index 4628b2acc..659e71458 100644 --- a/krebs/3modules/makefu/default.nix +++ b/krebs/3modules/makefu/default.nix @@ -130,7 +130,6 @@ with import ../../4lib { inherit lib; }; io IN NS pigstarter.krebsco.de. pigstarter IN A ${head nets.internet.addrs4} gold IN A ${head nets.internet.addrs4} - tinc IN A ${head nets.internet.addrs4} boot IN A ${head nets.internet.addrs4}''; }; nets = { @@ -167,6 +166,7 @@ with import ../../4lib { inherit lib; }; "krebsco.de" = '' wry IN A ${head nets.internet.addrs4} graphs IN A ${head nets.internet.addrs4} + tinc IN A ${head nets.internet.addrs4} ''; }; nets = rec { diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix index d8c8d6fa1..03b19d1c7 100644 --- a/makefu/1systems/wry.nix +++ b/makefu/1systems/wry.nix @@ -34,15 +34,19 @@ in { # prepare graphs nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; }; + krebs.nginx.enable = true; + krebs.retiolum-bootstrap.enable = true; makefu.tinc_graphs.enable = true; + makefu.tinc_graphs.krebsNginx = { enable = true; # TODO: remove hard-coded hostname hostnames_complete = [ "graphs.wry" ]; hostnames_anonymous = [ "graphs.krebsco.de" ]; }; - networking.firewall.allowedTCPPorts = [80]; + + networking.firewall.allowedTCPPorts = [ 80 443 ]; krebs.build = { user = config.krebs.users.makefu; -- cgit v1.2.3 From 8d3ebfc096c10e9d498ca0bed934ad9e35e6c022 Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 19 Oct 2015 21:57:05 +0200 Subject: krebs 3 retiolum-bootstrap: fix assert todo --- krebs/3modules/retiolum-bootstrap.nix | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix index 5cce4c2af..eed11642f 100644 --- a/krebs/3modules/retiolum-bootstrap.nix +++ b/krebs/3modules/retiolum-bootstrap.nix @@ -32,9 +32,7 @@ let }; imp = { - # TODO: assert krebs nginx - - krebs.nginx.servers = { + krebs.nginx.servers = assert config.krebs.nginx.enable; { retiolum-boot-redir = { server-names = singleton cfg.hostname; extraConfig = '' -- cgit v1.2.3 From ded0821d9bf7c85e2197cb7811d5f95987ded02e Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 19 Oct 2015 23:46:10 +0200 Subject: m 1,2 : wry serves as iodine entry point --- krebs/3modules/makefu/default.nix | 2 +- makefu/1systems/wry.nix | 4 +++- makefu/2configs/base-sources.nix | 6 +++--- makefu/2configs/iodined.nix | 16 ++++++++++++++++ 4 files changed, 23 insertions(+), 5 deletions(-) create mode 100644 makefu/2configs/iodined.nix diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix index 659e71458..acc5d7dd2 100644 --- a/krebs/3modules/makefu/default.nix +++ b/krebs/3modules/makefu/default.nix @@ -127,7 +127,6 @@ with import ../../4lib { inherit lib; }; "krebsco.de" = '' IN MX 10 mx42 euer IN MX 1 aspmx.l.google.com. - io IN NS pigstarter.krebsco.de. pigstarter IN A ${head nets.internet.addrs4} gold IN A ${head nets.internet.addrs4} boot IN A ${head nets.internet.addrs4}''; @@ -165,6 +164,7 @@ with import ../../4lib { inherit lib; }; extraZones = { "krebsco.de" = '' wry IN A ${head nets.internet.addrs4} + io IN NS wry.krebsco.de. graphs IN A ${head nets.internet.addrs4} tinc IN A ${head nets.internet.addrs4} ''; diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix index 03b19d1c7..a7ed93c43 100644 --- a/makefu/1systems/wry.nix +++ b/makefu/1systems/wry.nix @@ -11,6 +11,8 @@ in { ../2configs/base-sources.nix ../2configs/tinc-basic-retiolum.nix + ../2configs/iodined.nix + # Reaktor ../2configs/Reaktor/simpleExtend.nix ]; @@ -46,7 +48,7 @@ in { hostnames_anonymous = [ "graphs.krebsco.de" ]; }; - networking.firewall.allowedTCPPorts = [ 80 443 ]; + networking.firewall.allowedTCPPorts = [ 53 80 443 ]; krebs.build = { user = config.krebs.users.makefu; diff --git a/makefu/2configs/base-sources.nix b/makefu/2configs/base-sources.nix index 826cd6fef..7e6bebec3 100644 --- a/makefu/2configs/base-sources.nix +++ b/makefu/2configs/base-sources.nix @@ -3,9 +3,9 @@ { krebs.build.source = { git.nixpkgs = { - url = https://github.com/NixOS/nixpkgs; - #url = https://github.com/makefu/nixpkgs; - rev = "dc18f39bfb2f9d1ba62c7e8ad98544bb15cb26b2"; # nixos-15.09 + #url = https://github.com/NixOS/nixpkgs; + url = https://github.com/makefu/nixpkgs; + rev = "78340b042463fd35caa587b0db2e400e5666dbe1"; # nixos-15.09 + cherry-picked iodine }; dir.secrets = { diff --git a/makefu/2configs/iodined.nix b/makefu/2configs/iodined.nix new file mode 100644 index 000000000..db8a1bfed --- /dev/null +++ b/makefu/2configs/iodined.nix @@ -0,0 +1,16 @@ +{ services,builtins,environment,pkgs, ... }: + +let + # TODO: make this a parameter + domain = "io.krebsco.de"; + pw = import ; +in { + + services.iodined = { + enable = true; + domain = domain; + ip = "172.16.10.1/24"; + extraConfig = "-P ${pw}"; + }; + +} -- cgit v1.2.3 From be44341c6ba0d8fe66220f4fe6493a88fdce849b Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 20 Oct 2015 14:25:49 +0200 Subject: m 2 mail: split exim-retiolum --- makefu/1systems/pornocauster.nix | 1 + makefu/2configs/mail-client.nix | 12 ++++++++++++ 2 files changed, 13 insertions(+) create mode 100644 makefu/2configs/mail-client.nix diff --git a/makefu/1systems/pornocauster.nix b/makefu/1systems/pornocauster.nix index 8f7f5ea7c..97cf86a4e 100644 --- a/makefu/1systems/pornocauster.nix +++ b/makefu/1systems/pornocauster.nix @@ -21,6 +21,7 @@ # applications ../2configs/exim-retiolum.nix + ../2configs/mail-client.nix #../2configs/virtualization.nix ../2configs/virtualization-virtualbox.nix ../2configs/wwan.nix diff --git a/makefu/2configs/mail-client.nix b/makefu/2configs/mail-client.nix new file mode 100644 index 000000000..a6ae33d2f --- /dev/null +++ b/makefu/2configs/mail-client.nix @@ -0,0 +1,12 @@ +{ config, lib, pkgs, ... }: + +with lib; +{ + environment.systemPackages = with pkgs; [ + msmtp + mutt-kz + notmuch + offlineimap + ]; + +} -- cgit v1.2.3 From 24271c6f6b4e730eccb238c28ca4b04eb70ede92 Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 20 Oct 2015 18:11:30 +0200 Subject: m 3 bepasty-server.nix: init --- makefu/3modules/bepasty-server.nix | 160 +++++++++++++++++++++++++++++++++++++ 1 file changed, 160 insertions(+) create mode 100644 makefu/3modules/bepasty-server.nix diff --git a/makefu/3modules/bepasty-server.nix b/makefu/3modules/bepasty-server.nix new file mode 100644 index 000000000..d970652a4 --- /dev/null +++ b/makefu/3modules/bepasty-server.nix @@ -0,0 +1,160 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + gunicorn = pkgs.pythonPackages.gunicorn; + bepasty = pkgs.pythonPackages.bepasty-server; + gevent = pkgs.pythonPackages.gevent; + python = pkgs.pythonPackages.python; + cfg = config.makefu.bepasty-server; + + out = { + options.makefu.bepasty-server = api; + config = mkIf cfg.enable (mkMerge [(mkIf cfg.serveNginx nginx-imp) imp ]) ; + }; + + api = { + enable = mkEnableOption "Bepasty Servers"; + serveNginx = mkEnableOption "Serve Bepasty Servers with Nginx"; + + servers = mkOption { + type = with types; attrsOf optionSet; + options = singleton { + nginxCfg = mkOption { + # TODO use the correct type + type = with types; attrsOf unspecified; + description = '' + additional nginx configuration. see krebs.nginx for all options + '' ; + }; + debug = mkOption { + type = types.bool; + description = '' + run server in debug mode + ''; + default = false; + }; + + # TODO: assert secretKey + secretKey = mkOption { + type = types.str; + description = '' + server secret for safe session cookies, must be set. + ''; + }; + + # we create a wsgi socket in $workDir/gunicorn-${name}.wsgi + workDir = mkOption { + type = types.str; + description = '' + Path to the working directory (used for sockets and pidfile). + Defaults to the users home directory. Must be accessible to nginx, + permissions will be set to 755 + ''; + default = config.users.extraUsers.bepasty.home; + }; + + dataDir = mkOption { + type = types.str; + description = '' + Defaults to the new users home dir which defaults to + /var/lib/bepasty-server/data + ''; + default = "${config.users.extraUsers.bepasty.home}/data"; + }; + + extraConfig = mkOption { + type = types.str; + default = ""; + example = '' + PERMISSIONS = { + 'myadminsecret': 'admin,list,create,read,delete', + } + MAX_ALLOWED_FILE_SIZE = 5 * 1000 * 1000 + ''; + }; + + defaultPermissions = mkOption { + type = types.str; + default = "list"; + }; + + }; + default = {}; + }; + + }; + + imp = { + # Configures systemd services for each configured server + # environment.systemPackages = [ bepasty gunicorn gevent ]; + systemd.services = mapAttrs' (name: server: + nameValuePair ("bepasty-server-${name}") + ({ + description = "Bepasty Server ${name}"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + restartIfChanged = true; + environment = { + BEPASTY_CONFIG = "${server.workDir}/bepasty-${name}.conf"; + PYTHONPATH= "${bepasty}/lib/${python.libPrefix}/site-packages:${gevent}/lib/${python.libPrefix}/site-packages"; + }; + serviceConfig = { + Type = "simple"; + PrivateTmp = true; + ExecStartPre = pkgs.writeScript "bepasty-server.${name}-init" '' + #!/bin/sh + chmod 755 ${server.workDir} + mkdir -p ${server.dataDir} + cat > ${server.workDir}/bepasty-${name}.conf <