From f6a4131daecd6e5c1a0727adbcac43ba8530ec13 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 1 Feb 2016 17:13:46 +0100 Subject: tv exim-retiolum: init --- tv/1systems/nomic.nix | 7 +------ tv/1systems/wu.nix | 5 +---- tv/1systems/xu.nix | 8 +------- tv/2configs/exim-retiolum.nix | 5 +++++ 4 files changed, 8 insertions(+), 17 deletions(-) create mode 100644 tv/2configs/exim-retiolum.nix diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix index 7bc7b70d2..145e9b236 100644 --- a/tv/1systems/nomic.nix +++ b/tv/1systems/nomic.nix @@ -5,11 +5,9 @@ with lib; { krebs.build.host = config.krebs.hosts.nomic; - krebs.build.target = "root@nomic.gg23"; - imports = [ ../2configs/hw/AO753.nix - #../2configs/consul-server.nix + ../2configs/exim-retiolum.nix ../2configs/git.nix ../2configs/pulse.nix ../2configs/xserver @@ -24,9 +22,6 @@ with lib; ]; }; } - { - krebs.exim-retiolum.enable = true; - } { krebs.nginx = { enable = true; diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index 3bdf8d37a..47fdb2092 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -7,7 +7,7 @@ with lib; imports = [ ../2configs/hw/w110er.nix - #../2configs/consul-client.nix + ../2configs/exim-retiolum.nix ../2configs/git.nix ../2configs/mail-client.nix ../2configs/pulse.nix @@ -134,9 +134,6 @@ with lib; ]; }; } - { - krebs.exim-retiolum.enable = true; - } { krebs.nginx = { enable = true; diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index e6894b55e..12c115eb8 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -5,12 +5,9 @@ with lib; { krebs.build.host = config.krebs.hosts.xu; - krebs.build.source.git.nixpkgs.rev = - "7ae05edcdd14f6ace83ead9bf0d114e97c89a83a"; - imports = [ ../2configs/hw/x220.nix - #../2configs/consul-client.nix + ../2configs/exim-retiolum.nix ../2configs/git.nix ../2configs/mail-client.nix ../2configs/pulse.nix @@ -135,9 +132,6 @@ with lib; ]; }; } - { - krebs.exim-retiolum.enable = true; - } { krebs.nginx = { enable = true; diff --git a/tv/2configs/exim-retiolum.nix b/tv/2configs/exim-retiolum.nix new file mode 100644 index 000000000..1af72c28f --- /dev/null +++ b/tv/2configs/exim-retiolum.nix @@ -0,0 +1,5 @@ +{ ... }: + +{ + krebs.exim-retiolum.enable = true; +} -- cgit v1.2.3 From a7e1709a466cee24783e20b6219ef5112b00e8c9 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 1 Feb 2016 17:18:07 +0100 Subject: tv nginx-public_html: init --- tv/1systems/nomic.nix | 11 +---------- tv/1systems/wu.nix | 11 +---------- tv/1systems/xu.nix | 11 +---------- tv/2configs/nginx-public_html.nix | 14 ++++++++++++++ 4 files changed, 17 insertions(+), 30 deletions(-) create mode 100644 tv/2configs/nginx-public_html.nix diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix index 145e9b236..64fe5a635 100644 --- a/tv/1systems/nomic.nix +++ b/tv/1systems/nomic.nix @@ -9,6 +9,7 @@ with lib; ../2configs/hw/AO753.nix ../2configs/exim-retiolum.nix ../2configs/git.nix + ../2configs/nginx-public_html.nix ../2configs/pulse.nix ../2configs/xserver { @@ -22,16 +23,6 @@ with lib; ]; }; } - { - krebs.nginx = { - enable = true; - servers.default.locations = [ - (nameValuePair "~ ^/~(.+?)(/.*)?\$" '' - alias /home/$1/public_html$2; - '') - ]; - }; - } { krebs.retiolum = { enable = true; diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index 47fdb2092..6dd051210 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -10,6 +10,7 @@ with lib; ../2configs/exim-retiolum.nix ../2configs/git.nix ../2configs/mail-client.nix + ../2configs/nginx-public_html.nix ../2configs/pulse.nix ../2configs/xserver { @@ -134,16 +135,6 @@ with lib; ]; }; } - { - krebs.nginx = { - enable = true; - servers.default.locations = [ - (nameValuePair "~ ^/~(.+?)(/.*)?\$" '' - alias /home/$1/public_html$2; - '') - ]; - }; - } { krebs.retiolum = { enable = true; diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index 12c115eb8..409129581 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -10,6 +10,7 @@ with lib; ../2configs/exim-retiolum.nix ../2configs/git.nix ../2configs/mail-client.nix + ../2configs/nginx-public_html.nix ../2configs/pulse.nix ../2configs/xserver { @@ -132,16 +133,6 @@ with lib; ]; }; } - { - krebs.nginx = { - enable = true; - servers.default.locations = [ - (nameValuePair "~ ^/~(.+?)(/.*)?\$" '' - alias /home/$1/public_html$2; - '') - ]; - }; - } { krebs.retiolum = { enable = true; diff --git a/tv/2configs/nginx-public_html.nix b/tv/2configs/nginx-public_html.nix new file mode 100644 index 000000000..50c623915 --- /dev/null +++ b/tv/2configs/nginx-public_html.nix @@ -0,0 +1,14 @@ +{ lib, ... }: + +with lib; + +{ + krebs.nginx = { + enable = true; + servers.default.locations = [ + (nameValuePair "~ ^/~(.+?)(/.*)?\$" '' + alias /home/$1/public_html$2; + '') + ]; + }; +} -- cgit v1.2.3 From b3a481e0b9462bdb4ed92bfc27b2cbf723a8ec30 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 1 Feb 2016 17:30:38 +0100 Subject: krebs lib.ne: init --- krebs/4lib/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/krebs/4lib/default.nix b/krebs/4lib/default.nix index dfc51bbe4..4d7e0b549 100644 --- a/krebs/4lib/default.nix +++ b/krebs/4lib/default.nix @@ -6,6 +6,7 @@ with lib; let out = rec { eq = x: y: x == y; + ne = x: y: x != y; mod = x: y: x - y * (x / y); -- cgit v1.2.3 From d6ded00d012d4fb2a2a0a824604b25dac35ee349 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 1 Feb 2016 17:32:04 +0100 Subject: tv retiolum: init --- tv/1systems/cd.nix | 11 +---------- tv/1systems/nomic.nix | 10 +--------- tv/1systems/wu.nix | 10 +--------- tv/1systems/xu.nix | 11 +---------- tv/2configs/retiolum.nix | 16 ++++++++++++++++ 5 files changed, 20 insertions(+), 38 deletions(-) create mode 100644 tv/2configs/retiolum.nix diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix index b69d7655a..da44f5077 100644 --- a/tv/1systems/cd.nix +++ b/tv/1systems/cd.nix @@ -17,6 +17,7 @@ with lib; #../2configs/consul-server.nix ../2configs/exim-smarthost.nix ../2configs/git.nix + ../2configs/retiolum.nix ../2configs/urlwatch.nix { imports = [ ../2configs/charybdis.nix ]; @@ -77,16 +78,6 @@ with lib; ''); }; } - { - krebs.retiolum = { - enable = true; - connectTo = [ - "fastpoke" - "pigstarter" - "ire" - ]; - }; - } ]; networking.interfaces.enp2s1.ip4 = [ diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix index 64fe5a635..b7e77e973 100644 --- a/tv/1systems/nomic.nix +++ b/tv/1systems/nomic.nix @@ -11,6 +11,7 @@ with lib; ../2configs/git.nix ../2configs/nginx-public_html.nix ../2configs/pulse.nix + ../2configs/retiolum.nix ../2configs/xserver { tv.iptables = { @@ -23,15 +24,6 @@ with lib; ]; }; } - { - krebs.retiolum = { - enable = true; - connectTo = [ - "gum" - "pigstarter" - ]; - }; - } ]; boot.initrd.luks = { diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index 6dd051210..f52bbc091 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -12,6 +12,7 @@ with lib; ../2configs/mail-client.nix ../2configs/nginx-public_html.nix ../2configs/pulse.nix + ../2configs/retiolum.nix ../2configs/xserver { environment.systemPackages = with pkgs; [ @@ -135,15 +136,6 @@ with lib; ]; }; } - { - krebs.retiolum = { - enable = true; - connectTo = [ - "gum" - "pigstarter" - ]; - }; - } ]; boot.initrd.luks = { diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index 409129581..54e16868f 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -12,6 +12,7 @@ with lib; ../2configs/mail-client.nix ../2configs/nginx-public_html.nix ../2configs/pulse.nix + ../2configs/retiolum.nix ../2configs/xserver { environment.systemPackages = with pkgs; [ @@ -133,16 +134,6 @@ with lib; ]; }; } - { - krebs.retiolum = { - enable = true; - connectTo = [ - "cd" - "gum" - "pigstarter" - ]; - }; - } ]; boot.initrd.luks = { diff --git a/tv/2configs/retiolum.nix b/tv/2configs/retiolum.nix new file mode 100644 index 000000000..91fe81d69 --- /dev/null +++ b/tv/2configs/retiolum.nix @@ -0,0 +1,16 @@ +{ config, lib, ... }: + +with lib; + +{ + krebs.retiolum = { + enable = true; + connectTo = filter (ne config.krebs.build.host.name) [ + "gum" + "prism" + "echelon" + "cd" + "ire" + ]; + }; +} -- cgit v1.2.3 From bb1dbae8187601cea2ddfbdcdc9baa456bc5b4ab Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 1 Feb 2016 17:40:25 +0100 Subject: tv: open ssh port by default --- tv/1systems/cd.nix | 4 ---- tv/1systems/nomic.nix | 1 - tv/1systems/wu.nix | 1 - tv/1systems/xu.nix | 1 - tv/2configs/default.nix | 5 +++++ 5 files changed, 5 insertions(+), 7 deletions(-) diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix index da44f5077..6db78ca89 100644 --- a/tv/1systems/cd.nix +++ b/tv/1systems/cd.nix @@ -41,7 +41,6 @@ with lib; tv.iptables = { enable = true; input-internet-accept-new-tcp = [ - "ssh" "tinc" "smtp" "xmpp-client" @@ -58,10 +57,7 @@ with lib; "cgit.cd.krebsco.de" "cgit.cd.viljetic.de" ]; - } - { # TODO make public_html also available to cd, cd.retiolum (AKA default) - tv.iptables.input-internet-accept-new-tcp = singleton "http"; krebs.nginx.servers.public_html = { server-names = singleton "cd.viljetic.de"; locations = singleton (nameValuePair "~ ^/~(.+?)(/.*)?\$" '' diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix index b7e77e973..f176a5f23 100644 --- a/tv/1systems/nomic.nix +++ b/tv/1systems/nomic.nix @@ -17,7 +17,6 @@ with lib; tv.iptables = { enable = true; input-internet-accept-new-tcp = [ - "ssh" "http" "tinc" "smtp" diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index f52bbc091..16709052b 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -129,7 +129,6 @@ with lib; tv.iptables = { enable = true; input-internet-accept-new-tcp = [ - "ssh" "http" "tinc" "smtp" diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index 54e16868f..c6f1a393e 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -127,7 +127,6 @@ with lib; tv.iptables = { enable = true; input-internet-accept-new-tcp = [ - "ssh" "http" "tinc" "smtp" diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index 310077021..abe9d3de8 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -162,6 +162,10 @@ with lib; }; } + { + tv.iptables.enable = true; + } + { services.openssh = { enable = true; @@ -169,6 +173,7 @@ with lib; { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; } ]; }; + tv.iptables.input-internet-accept-new-tcp = singleton "ssh"; } { -- cgit v1.2.3 From b172630f894362dc32cb6af7d5c9d44902ec5752 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 1 Feb 2016 17:44:19 +0100 Subject: tv retiolum: open tinc port --- tv/1systems/cd.nix | 1 - tv/1systems/nomic.nix | 1 - tv/1systems/wu.nix | 1 - tv/1systems/xu.nix | 1 - tv/2configs/retiolum.nix | 1 + 5 files changed, 1 insertion(+), 4 deletions(-) diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix index 6db78ca89..783d23ca9 100644 --- a/tv/1systems/cd.nix +++ b/tv/1systems/cd.nix @@ -41,7 +41,6 @@ with lib; tv.iptables = { enable = true; input-internet-accept-new-tcp = [ - "tinc" "smtp" "xmpp-client" "xmpp-server" diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix index f176a5f23..6f2c41823 100644 --- a/tv/1systems/nomic.nix +++ b/tv/1systems/nomic.nix @@ -18,7 +18,6 @@ with lib; enable = true; input-internet-accept-new-tcp = [ "http" - "tinc" "smtp" ]; }; diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index 16709052b..7635f6162 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -130,7 +130,6 @@ with lib; enable = true; input-internet-accept-new-tcp = [ "http" - "tinc" "smtp" ]; }; diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index c6f1a393e..91b761d24 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -128,7 +128,6 @@ with lib; enable = true; input-internet-accept-new-tcp = [ "http" - "tinc" "smtp" ]; }; diff --git a/tv/2configs/retiolum.nix b/tv/2configs/retiolum.nix index 91fe81d69..d2bb9e6cf 100644 --- a/tv/2configs/retiolum.nix +++ b/tv/2configs/retiolum.nix @@ -13,4 +13,5 @@ with lib; "ire" ]; }; + tv.iptables.input-internet-accept-new-tcp = singleton "tinc"; } -- cgit v1.2.3 From d85c70d1d669636fe2fcbb1179dca2c4aecb0802 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 1 Feb 2016 17:46:33 +0100 Subject: tv nginx-public_html: open http port --- tv/1systems/nomic.nix | 1 - tv/1systems/wu.nix | 1 - tv/1systems/xu.nix | 1 - tv/2configs/nginx-public_html.nix | 1 + 4 files changed, 1 insertion(+), 3 deletions(-) diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix index 6f2c41823..2b71a974e 100644 --- a/tv/1systems/nomic.nix +++ b/tv/1systems/nomic.nix @@ -17,7 +17,6 @@ with lib; tv.iptables = { enable = true; input-internet-accept-new-tcp = [ - "http" "smtp" ]; }; diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index 7635f6162..a51e0e678 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -129,7 +129,6 @@ with lib; tv.iptables = { enable = true; input-internet-accept-new-tcp = [ - "http" "smtp" ]; }; diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index 91b761d24..847b57249 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -127,7 +127,6 @@ with lib; tv.iptables = { enable = true; input-internet-accept-new-tcp = [ - "http" "smtp" ]; }; diff --git a/tv/2configs/nginx-public_html.nix b/tv/2configs/nginx-public_html.nix index 50c623915..dc74f7f8d 100644 --- a/tv/2configs/nginx-public_html.nix +++ b/tv/2configs/nginx-public_html.nix @@ -11,4 +11,5 @@ with lib; '') ]; }; + tv.iptables.input-internet-accept-new-tcp = singleton "http"; } -- cgit v1.2.3 From fe025213ea5c15012fd83f1064269a315a2d576a Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 1 Feb 2016 17:50:00 +0100 Subject: tv exim-retiolum: open smtp port to retiolum --- tv/1systems/nomic.nix | 8 -------- tv/1systems/wu.nix | 8 -------- tv/1systems/xu.nix | 8 -------- tv/2configs/exim-retiolum.nix | 5 ++++- 4 files changed, 4 insertions(+), 25 deletions(-) diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix index 2b71a974e..37ef204c7 100644 --- a/tv/1systems/nomic.nix +++ b/tv/1systems/nomic.nix @@ -13,14 +13,6 @@ with lib; ../2configs/pulse.nix ../2configs/retiolum.nix ../2configs/xserver - { - tv.iptables = { - enable = true; - input-internet-accept-new-tcp = [ - "smtp" - ]; - }; - } ]; boot.initrd.luks = { diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index a51e0e678..aef8ca761 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -125,14 +125,6 @@ with lib; unison ]; } - { - tv.iptables = { - enable = true; - input-internet-accept-new-tcp = [ - "smtp" - ]; - }; - } ]; boot.initrd.luks = { diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index 847b57249..31a8a3e99 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -123,14 +123,6 @@ with lib; unison ]; } - { - tv.iptables = { - enable = true; - input-internet-accept-new-tcp = [ - "smtp" - ]; - }; - } ]; boot.initrd.luks = { diff --git a/tv/2configs/exim-retiolum.nix b/tv/2configs/exim-retiolum.nix index 1af72c28f..aedf25823 100644 --- a/tv/2configs/exim-retiolum.nix +++ b/tv/2configs/exim-retiolum.nix @@ -1,5 +1,8 @@ -{ ... }: +{ lib, ... }: + +with lib; { krebs.exim-retiolum.enable = true; + tv.iptables.input-retiolum-accept-new-tcp = singleton "smtp"; } -- cgit v1.2.3 From b58f37ce3833b7800c0a9ec83367dc888ea571b3 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 1 Feb 2016 17:53:16 +0100 Subject: tv exim-smarthost: open smtp port --- tv/1systems/cd.nix | 1 - tv/2configs/exim-smarthost.nix | 5 ++++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix index 783d23ca9..1d9457600 100644 --- a/tv/1systems/cd.nix +++ b/tv/1systems/cd.nix @@ -41,7 +41,6 @@ with lib; tv.iptables = { enable = true; input-internet-accept-new-tcp = [ - "smtp" "xmpp-client" "xmpp-server" ]; diff --git a/tv/2configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix index f5f63d284..bcfea7821 100644 --- a/tv/2configs/exim-smarthost.nix +++ b/tv/2configs/exim-smarthost.nix @@ -1,4 +1,6 @@ -{ config, pkgs, ... }: +{ config, lib, pkgs, ... }: + +with lib; { krebs.exim-smarthost = { @@ -34,4 +36,5 @@ { from = "mirko"; to = "mv"; } ]; }; + tv.iptables.input-internet-accept-new-tcp = singleton "smtp"; } -- cgit v1.2.3 From 0c1a2d11b18c73ddc7fdb429e0d09dcffa3906f8 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 1 Feb 2016 17:56:10 +0100 Subject: cd: redistribute iptable rules --- tv/1systems/cd.nix | 20 +++++--------------- 1 file changed, 5 insertions(+), 15 deletions(-) diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix index 1d9457600..27e94aef0 100644 --- a/tv/1systems/cd.nix +++ b/tv/1systems/cd.nix @@ -31,6 +31,10 @@ with lib; enable = true; hosts = [ "jabber.viljetic.de" ]; }; + tv.iptables.input-internet-accept-new-tcp = [ + "xmpp-client" + "xmpp-server" + ]; } { krebs.github-hosts-sync.enable = true; @@ -38,19 +42,6 @@ with lib; singleton config.krebs.github-hosts-sync.port; } { - tv.iptables = { - enable = true; - input-internet-accept-new-tcp = [ - "xmpp-client" - "xmpp-server" - ]; - input-retiolum-accept-new-tcp = [ - "http" - ]; - }; - } - { - tv.iptables.input-internet-accept-new-tcp = singleton "http"; krebs.nginx.servers.cgit.server-names = [ "cgit.cd.krebsco.de" "cgit.cd.viljetic.de" @@ -62,8 +53,6 @@ with lib; alias /home/$1/public_html$2; ''); }; - } - { krebs.nginx.servers.viljetic = { server-names = singleton "viljetic.de"; # TODO directly set root (instead via location) @@ -71,6 +60,7 @@ with lib; root ${pkgs.viljetic-pages}; ''); }; + tv.iptables.input-internet-accept-new-tcp = singleton "http"; } ]; -- cgit v1.2.3 From 461fe008e72995a42e8546d5dcc46382ca820000 Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 1 Feb 2016 21:58:19 +0100 Subject: ma 1 filepimp: use by-id fs path, snapraid --- makefu/1systems/filepimp.nix | 51 +++++++++++++++++++++++++++++++------------- 1 file changed, 36 insertions(+), 15 deletions(-) diff --git a/makefu/1systems/filepimp.nix b/makefu/1systems/filepimp.nix index 2d008cee6..fb9324ee9 100644 --- a/makefu/1systems/filepimp.nix +++ b/makefu/1systems/filepimp.nix @@ -1,10 +1,14 @@ -# Edit this configuration file to define what should be installed on -# your system. Help is available in the configuration.nix(5) man page -# and in the NixOS manual (accessible by running ‘nixos-help’). - -{ config, pkgs, ... }: - -{ +{ config, pkgs, lib, ... }: +let + byid = dev: "/dev/disk/by-id/" + dev; + part1 = disk: disk + "-part1"; + rootDisk = byid "ata-SanDisk_SDSSDP064G_140237402890"; + jDisk0 = byid "ata-ST4000DM000-1F2168_Z303HVSG"; + jDisk1 = byid "ata-ST4000DM000-1F2168_Z3040NEA"; + jDisk2 = byid "ata-WDC_WD40EFRX-68WT0N0_WD-WCC4E0621363"; + jDisk3 = byid "ata-TOSHIBA_MD04ACA400_156GK89OFSBA"; + allDisks = [ rootDisk jDisk0 jDisk1 jDisk2 jDisk3 ]; +in { imports = [ # Include the results of the hardware scan. ../2configs/fs/single-partition-ext4.nix @@ -12,16 +16,9 @@ ../2configs/smart-monitor.nix ]; krebs.build.host = config.krebs.hosts.filepimp; - services.smartd.devices = [ - { device = "/dev/sda"; } - { device = "/dev/sdb"; } - { device = "/dev/sdc"; } - { device = "/dev/sdd"; } - { device = "/dev/sde"; } - ]; # AMD N54L boot = { - loader.grub.device = "/dev/sde"; + loader.grub.device = rootDisk; initrd.availableKernelModules = [ "ahci" @@ -40,4 +37,28 @@ zramSwap.enable = true; zramSwap.numDevices = 2; + + makefu.snapraid = let + toMedia = name: "/media/" + name; + in { + enable = true; + # todo combine creation when enabling the mount point + disks = map toMedia [ "j0" "j1" "j2" ]; + parity = toMedia "par0"; + }; + # TODO: refactor, copy-paste from omo + services.smartd.devices = builtins.map (x: { device = x; }) allDisks; + powerManagement.powerUpCommands = lib.concatStrings (map (disk: '' + ${pkgs.hdparm}/sbin/hdparm -S 100 ${disk} + ${pkgs.hdparm}/sbin/hdparm -B 127 ${disk} + ${pkgs.hdparm}/sbin/hdparm -y ${disk} + '') allDisks); + fileSystems = let + xfsmount = name: dev: + { "/media/${name}" = { device = dev; fsType = "xfs"; }; }; + in + (xfsmount "j0" (part1 jDisk0)) + // (xfsmount "j1" (part1 jDisk1)) + // (xfsmount "j2" (part1 jDisk2)) + // (xfsmount "par0" (part1 jDisk3)); } -- cgit v1.2.3 From 40b13f240888be643e19939ceef79483aeb07ca5 Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 1 Feb 2016 21:58:54 +0100 Subject: ma 1 gum: host update.connector.one --- makefu/1systems/gum.nix | 1 + makefu/2configs/nginx/update.connector.one.nix | 26 ++++++++++++++++++++++++++ 2 files changed, 27 insertions(+) create mode 100644 makefu/2configs/nginx/update.connector.one.nix diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix index ac7524506..c4dfbf4b7 100644 --- a/makefu/1systems/gum.nix +++ b/makefu/1systems/gum.nix @@ -15,6 +15,7 @@ in { ../2configs/git/cgit-retiolum.nix ../2configs/mattermost-docker.nix ../2configs/nginx/euer.test.nix + ../2configs/nginx/update.connector.one.nix ../2configs/exim-retiolum.nix ../2configs/urlwatch.nix diff --git a/makefu/2configs/nginx/update.connector.one.nix b/makefu/2configs/nginx/update.connector.one.nix new file mode 100644 index 000000000..eb39a1668 --- /dev/null +++ b/makefu/2configs/nginx/update.connector.one.nix @@ -0,0 +1,26 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + hostname = config.krebs.build.host.name; + external-ip = head config.krebs.build.host.nets.internet.addrs4; +in { + krebs.nginx = { + enable = mkDefault true; + servers = { + omo-share = { + listen = [ "${external-ip}:80" ]; + server-names = [ + "update.connector.one" + "firmware.connector.one" + ]; + locations = singleton (nameValuePair "/" '' + autoindex on; + root /var/www/update.connector.one; + sendfile on; + gzip on; + ''); + }; + }; + }; +} -- cgit v1.2.3 From 44e0c5153ca6a65ee130f30ea8466906deedcada Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 1 Feb 2016 22:01:41 +0100 Subject: ma 1 omo: add shares --- makefu/1systems/omo.nix | 30 +--------------- makefu/2configs/nginx/omo-share.nix | 34 ------------------- makefu/2configs/omo-share.nix | 68 +++++++++++++++++++++++++++++++++++++ 3 files changed, 69 insertions(+), 63 deletions(-) delete mode 100644 makefu/2configs/nginx/omo-share.nix create mode 100644 makefu/2configs/omo-share.nix diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix index 19183fea8..e9c51f485 100644 --- a/makefu/1systems/omo.nix +++ b/makefu/1systems/omo.nix @@ -28,7 +28,7 @@ in { ../2configs/smart-monitor.nix ../2configs/mail-client.nix ../2configs/share-user-sftp.nix - ../2configs/nginx/omo-share.nix + ../2configs/omo-share.nix ../3modules ]; networking.firewall.trustedInterfaces = [ "enp3s0" ]; @@ -42,34 +42,6 @@ in { # services.openssh.allowSFTP = false; krebs.build.source.git.nixpkgs.rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce"; - # samba share /media/crypt1/share - users.users.smbguest = { - name = "smbguest"; - uid = config.ids.uids.smbguest; - description = "smb guest user"; - home = "/var/empty"; - }; - services.samba = { - enable = true; - shares = { - winshare = { - path = "/media/crypt1/share"; - "read only" = "no"; - browseable = "yes"; - "guest ok" = "yes"; - }; - }; - extraConfig = '' - guest account = smbguest - map to guest = bad user - # disable printing - load printers = no - printing = bsd - printcap name = /dev/null - disable spoolss = yes - ''; - }; - # copy config from to /var/lib/sabnzbd/ services.sabnzbd.enable = true; systemd.services.sabnzbd.environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; diff --git a/makefu/2configs/nginx/omo-share.nix b/makefu/2configs/nginx/omo-share.nix deleted file mode 100644 index ce85e0442..000000000 --- a/makefu/2configs/nginx/omo-share.nix +++ /dev/null @@ -1,34 +0,0 @@ -{ config, lib, pkgs, ... }: - -with lib; -let - hostname = config.krebs.build.host.name; - # TODO local-ip from the nets config - local-ip = "192.168.1.11"; - # local-ip = head config.krebs.build.host.nets.retiolum.addrs4; -in { - krebs.nginx = { - enable = mkDefault true; - servers = { - omo-share = { - listen = [ "${local-ip}:80" ]; - locations = singleton (nameValuePair "/" '' - autoindex on; - root /media; - limit_rate_after 100m; - limit_rate 5m; - mp4_buffer_size 4M; - mp4_max_buffer_size 10M; - allow all; - access_log off; - keepalive_timeout 65; - keepalive_requests 200; - reset_timedout_connection on; - sendfile on; - tcp_nopush on; - gzip off; - ''); - }; - }; - }; -} diff --git a/makefu/2configs/omo-share.nix b/makefu/2configs/omo-share.nix new file mode 100644 index 000000000..1e0975e1d --- /dev/null +++ b/makefu/2configs/omo-share.nix @@ -0,0 +1,68 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + hostname = config.krebs.build.host.name; + # TODO local-ip from the nets config + local-ip = "192.168.1.11"; + # local-ip = head config.krebs.build.host.nets.retiolum.addrs4; +in { + krebs.nginx = { + enable = mkDefault true; + servers = { + omo-share = { + listen = [ "${local-ip}:80" ]; + locations = singleton (nameValuePair "/" '' + autoindex on; + root /media; + limit_rate_after 100m; + limit_rate 5m; + mp4_buffer_size 4M; + mp4_max_buffer_size 10M; + allow all; + access_log off; + keepalive_timeout 65; + keepalive_requests 200; + reset_timedout_connection on; + sendfile on; + tcp_nopush on; + gzip off; + ''); + }; + }; + }; + + # samba share /media/crypt1/share + users.users.smbguest = { + name = "smbguest"; + uid = config.ids.uids.smbguest; + description = "smb guest user"; + home = "/var/empty"; + }; + services.samba = { + enable = true; + shares = { + winshare = { + path = "/media/crypt1/share"; + "read only" = "no"; + browseable = "yes"; + "guest ok" = "yes"; + }; + usenet = { + path = "/media/crypt0/usenet/dst"; + "read only" = "yes"; + browseable = "yes"; + "guest ok" = "yes"; + }; + }; + extraConfig = '' + guest account = smbguest + map to guest = bad user + # disable printing + load printers = no + printing = bsd + printcap name = /dev/null + disable spoolss = yes + ''; + }; +} -- cgit v1.2.3 From 07fa0d989609faca2e9f9847165db61428206ef7 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 01:35:19 +0100 Subject: nixpkgs: symlink upstream-nixpkgs/{default.nix,lib} --- nixpkgs/default.nix | 2 +- nixpkgs/lib | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) mode change 100644 => 120000 nixpkgs/default.nix create mode 120000 nixpkgs/lib diff --git a/nixpkgs/default.nix b/nixpkgs/default.nix deleted file mode 100644 index 92da82c35..000000000 --- a/nixpkgs/default.nix +++ /dev/null @@ -1 +0,0 @@ -import diff --git a/nixpkgs/default.nix b/nixpkgs/default.nix new file mode 120000 index 000000000..74e9d7633 --- /dev/null +++ b/nixpkgs/default.nix @@ -0,0 +1 @@ +../upstream-nixpkgs/default.nix \ No newline at end of file diff --git a/nixpkgs/lib b/nixpkgs/lib new file mode 120000 index 000000000..2284ef489 --- /dev/null +++ b/nixpkgs/lib @@ -0,0 +1 @@ +../upstream-nixpkgs/lib \ No newline at end of file -- cgit v1.2.3 From 2497533b90ce901a39d6642923738b2a337ad9aa Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 01:53:38 +0100 Subject: krebs/populate.nix -> krebs/v2 populate --- Makefile | 13 ++++-- krebs/populate.nix | 116 ------------------------------------------------- krebs/v2/default.nix | 120 +++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 129 insertions(+), 120 deletions(-) delete mode 100644 krebs/populate.nix create mode 100644 krebs/v2/default.nix diff --git a/Makefile b/Makefile index a35d6d128..d7534e1f3 100644 --- a/Makefile +++ b/Makefile @@ -33,15 +33,20 @@ deploy2: export target-host = $(target) else deploy2: export target-host = $(system) endif +deploy2: export source = \ + with (import ~/stockholm {}).users.$(LOGNAME).$(system).config.krebs.build; \ + assert source-version == 2; \ + source deploy2:;@ target=$${target-$$system} result=$$(nix-instantiate \ - --json \ --eval \ - krebs/populate.nix \ - --arg source 'with (import ~/stockholm {}).users.$(LOGNAME).$(system).config.krebs.build; assert source-version == 2; source' \ + --json \ + --arg source "$$source" \ --argstr target-host "$$target" \ - --argstr target-path /var/src) + --argstr target-path /var/src \ + -A populate \ + krebs/v2) script=$$(echo "$$result" | jq -r .) echo "$$script" | sh ssh root@$$target nixos-rebuild switch -I /var/src diff --git a/krebs/populate.nix b/krebs/populate.nix deleted file mode 100644 index 13270c8a7..000000000 --- a/krebs/populate.nix +++ /dev/null @@ -1,116 +0,0 @@ -{ source -, target-user ? "root" -, target-host -, target-path ? "/var/src" -}: -with import ; -with import ~/stockholm/krebs/4lib { - lib = import ; -}; -with builtins; -let - out = '' - #! /bin/sh - set -efu - - echo ${shell.escape git-script} \ - | ssh ${shell.escape "${target-user}@${target-host}"} -T - - tmpdir=$(mktemp -dt stockholm.XXXXXXXX) - trap ' - set +f - rm "$tmpdir"/* - rmdir "$tmpdir" - trap - EXIT INT QUIT - ' EXIT INT QUIT - chmod 0755 "$tmpdir" - ${concatStringsSep "\n" - (mapAttrsToList - (name: spec: let dst = removePrefix "symlink:" (get-url spec); in - "ln -s ${shell.escape dst} $tmpdir/${shell.escape name}") - symlink-specs)} - - proot \ - -b $tmpdir:${shell.escape target-path} \ - ${concatStringsSep " \\\n " - (mapAttrsToList - (name: spec: - "-b ${shell.escape "${get-url spec}:${target-path}/${name}"}") - file-specs)} \ - rsync \ - -f ${shell.escape "P /*"} \ - ${concatMapStringsSep " \\\n " - (name: "-f ${shell.escape "R /${name}"}") - (attrNames file-specs)} \ - --delete \ - -vFrlptD \ - ${shell.escape target-path}/ \ - ${shell.escape "${target-user}@${target-host}:${target-path}"} - ''; - - get-schema = uri: - if substring 0 1 uri == "/" - then "file" - else head (splitString ":" uri); - - has-schema = schema: uri: get-schema uri == schema; - - get-url = spec: { - string = spec; - path = toString spec; - set = get-url spec.url; - }.${typeOf spec}; - - git-specs = - filterAttrs (_: spec: has-schema "https" (get-url spec)) source // - filterAttrs (_: spec: has-schema "http" (get-url spec)) source // - filterAttrs (_: spec: has-schema "git" (get-url spec)) source; - - file-specs = - filterAttrs (_: spec: has-schema "file" (get-url spec)) source; - - symlink-specs = - filterAttrs (_: spec: has-schema "symlink" (get-url spec)) source; - - git-script = '' - fetch_git() {( - dst_dir=$1 - src_url=$2 - src_ref=$3 - - if ! test -e "$dst_dir"; then - git clone "$src_url" "$dst_dir" - fi - - cd "$dst_dir" - - if ! url=$(git config remote.origin.url); then - git remote add origin "$src_url" - elif test "$url" != "$src_url"; then - git remote set-url origin "$src_url" - fi - - # TODO resolve src_ref to commit hash - hash=$src_ref - - if ! test "$(git log --format=%H -1)" = "$hash"; then - git fetch origin - git checkout "$hash" -- "$dst_dir" - git checkout "$hash" - fi - - git clean -dxf - )} - - ${concatStringsSep "\n" - (mapAttrsToList - (name: spec: toString (map shell.escape [ - "fetch_git" - "${target-path}/${name}" - spec.url - spec.rev - ])) - git-specs)} - ''; - -in out diff --git a/krebs/v2/default.nix b/krebs/v2/default.nix new file mode 100644 index 000000000..7eb60103f --- /dev/null +++ b/krebs/v2/default.nix @@ -0,0 +1,120 @@ +{ source +, target-user ? "root" +, target-host +, target-path ? "/var/src" +}: +with import ; +with import ~/stockholm/krebs/4lib { + lib = import ; +}; +with builtins; +let + out = { + inherit populate; + }; + + populate = '' + #! /bin/sh + set -efu + + echo ${shell.escape git-script} \ + | ssh ${shell.escape "${target-user}@${target-host}"} -T + + tmpdir=$(mktemp -dt stockholm.XXXXXXXX) + trap ' + set +f + rm "$tmpdir"/* + rmdir "$tmpdir" + trap - EXIT INT QUIT + ' EXIT INT QUIT + chmod 0755 "$tmpdir" + ${concatStringsSep "\n" + (mapAttrsToList + (name: spec: let dst = removePrefix "symlink:" (get-url spec); in + "ln -s ${shell.escape dst} $tmpdir/${shell.escape name}") + symlink-specs)} + + proot \ + -b $tmpdir:${shell.escape target-path} \ + ${concatStringsSep " \\\n " + (mapAttrsToList + (name: spec: + "-b ${shell.escape "${get-url spec}:${target-path}/${name}"}") + file-specs)} \ + rsync \ + -f ${shell.escape "P /*"} \ + ${concatMapStringsSep " \\\n " + (name: "-f ${shell.escape "R /${name}"}") + (attrNames file-specs)} \ + --delete \ + -vFrlptD \ + ${shell.escape target-path}/ \ + ${shell.escape "${target-user}@${target-host}:${target-path}"} + ''; + + get-schema = uri: + if substring 0 1 uri == "/" + then "file" + else head (splitString ":" uri); + + has-schema = schema: uri: get-schema uri == schema; + + get-url = spec: { + string = spec; + path = toString spec; + set = get-url spec.url; + }.${typeOf spec}; + + git-specs = + filterAttrs (_: spec: has-schema "https" (get-url spec)) source // + filterAttrs (_: spec: has-schema "http" (get-url spec)) source // + filterAttrs (_: spec: has-schema "git" (get-url spec)) source; + + file-specs = + filterAttrs (_: spec: has-schema "file" (get-url spec)) source; + + symlink-specs = + filterAttrs (_: spec: has-schema "symlink" (get-url spec)) source; + + git-script = '' + fetch_git() {( + dst_dir=$1 + src_url=$2 + src_ref=$3 + + if ! test -e "$dst_dir"; then + git clone "$src_url" "$dst_dir" + fi + + cd "$dst_dir" + + if ! url=$(git config remote.origin.url); then + git remote add origin "$src_url" + elif test "$url" != "$src_url"; then + git remote set-url origin "$src_url" + fi + + # TODO resolve src_ref to commit hash + hash=$src_ref + + if ! test "$(git log --format=%H -1)" = "$hash"; then + git fetch origin + git checkout "$hash" -- "$dst_dir" + git checkout "$hash" + fi + + git clean -dxf + )} + + ${concatStringsSep "\n" + (mapAttrsToList + (name: spec: toString (map shell.escape [ + "fetch_git" + "${target-path}/${name}" + spec.url + spec.rev + ])) + git-specs)} + ''; + +in out -- cgit v1.2.3 From b849e3525edfe884a2e004e6497aad9995c093bd Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 03:19:20 +0100 Subject: make {deploy2 -> populate, rebuild} --- Makefile | 51 +++++++++++++++++++++++++++------------------------ 1 file changed, 27 insertions(+), 24 deletions(-) diff --git a/Makefile b/Makefile index d7534e1f3..ecfc7e50d 100644 --- a/Makefile +++ b/Makefile @@ -27,30 +27,6 @@ deploy infest:;@ script=$$(make -s eval) echo "$$script" | sh -.PHONY: deploy2 -ifdef target -deploy2: export target-host = $(target) -else -deploy2: export target-host = $(system) -endif -deploy2: export source = \ - with (import ~/stockholm {}).users.$(LOGNAME).$(system).config.krebs.build; \ - assert source-version == 2; \ - source -deploy2:;@ - target=$${target-$$system} - result=$$(nix-instantiate \ - --eval \ - --json \ - --arg source "$$source" \ - --argstr target-host "$$target" \ - --argstr target-path /var/src \ - -A populate \ - krebs/v2) - script=$$(echo "$$result" | jq -r .) - echo "$$script" | sh - ssh root@$$target nixos-rebuild switch -I /var/src - .PHONY: eval eval: @ @@ -73,6 +49,33 @@ endif $${target+--argstr target "$$target"}) echo "$$result" | filter +ifndef target +export target = $(system) +endif + +# usage: make populate system=foo [target=bar] +.PHONY: populate +populate: export source = \ + with (import ~/stockholm {}).users.$(LOGNAME).$(system).config.krebs.build; \ + assert source-version == 2; \ + source +populate:;@ + result=$$(nix-instantiate \ + --eval \ + --json \ + --arg source "$$source" \ + --argstr target-host "$$target" \ + --argstr target-path /var/src \ + -A populate \ + krebs/v2) + script=$$(echo "$$result" | jq -r .) + echo "$$script" | sh + +# usage: make rebuild system=foo [target=bar] [operation=switch] +.PHONY: rebuild +rebuild: populate ;@ + ssh root@"$$target" nixos-rebuild "$${operation-switch}" -I /var/src + else $(error unbound variable: system[s]) endif -- cgit v1.2.3 From 8e219cd0a2446e8f141e0f2403413a9bd3f0b061 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 03:20:29 +0100 Subject: Makefile,krebs/v2: verbosity++ --- Makefile | 2 +- krebs/v2/default.nix | 28 +++++++++++++++++++++++----- 2 files changed, 24 insertions(+), 6 deletions(-) diff --git a/Makefile b/Makefile index ecfc7e50d..f81666ae3 100644 --- a/Makefile +++ b/Makefile @@ -73,7 +73,7 @@ populate:;@ # usage: make rebuild system=foo [target=bar] [operation=switch] .PHONY: rebuild -rebuild: populate ;@ +rebuild: populate ;@set -x ssh root@"$$target" nixos-rebuild "$${operation-switch}" -I /var/src else diff --git a/krebs/v2/default.nix b/krebs/v2/default.nix index 7eb60103f..78e990d1c 100644 --- a/krebs/v2/default.nix +++ b/krebs/v2/default.nix @@ -15,26 +15,34 @@ let populate = '' #! /bin/sh - set -efu + set -eu + + verbose() { + printf '+' >&2 + printf ' %q' "$@" >&2 + printf '\n' + "$@" + } echo ${shell.escape git-script} \ | ssh ${shell.escape "${target-user}@${target-host}"} -T - tmpdir=$(mktemp -dt stockholm.XXXXXXXX) + unset tmpdir trap ' - set +f rm "$tmpdir"/* rmdir "$tmpdir" trap - EXIT INT QUIT ' EXIT INT QUIT + tmpdir=$(mktemp -dt stockholm.XXXXXXXX) chmod 0755 "$tmpdir" + ${concatStringsSep "\n" (mapAttrsToList (name: spec: let dst = removePrefix "symlink:" (get-url spec); in - "ln -s ${shell.escape dst} $tmpdir/${shell.escape name}") + "verbose ln -s ${shell.escape dst} $tmpdir/${shell.escape name}") symlink-specs)} - proot \ + verbose proot \ -b $tmpdir:${shell.escape target-path} \ ${concatStringsSep " \\\n " (mapAttrsToList @@ -77,6 +85,15 @@ let filterAttrs (_: spec: has-schema "symlink" (get-url spec)) source; git-script = '' + #! /bin/sh + set -efu + + verbose() { + printf '+' >&2 + printf ' %q' "$@" >&2 + printf '\n' + } + fetch_git() {( dst_dir=$1 src_url=$2 @@ -109,6 +126,7 @@ let ${concatStringsSep "\n" (mapAttrsToList (name: spec: toString (map shell.escape [ + "verbose" "fetch_git" "${target-path}/${name}" spec.url -- cgit v1.2.3 From 1b67c62f15e1c92aa1ccdf392fcdfe85488e3f48 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 03:29:42 +0100 Subject: make populate: define and pass lib to krebs/v2 --- Makefile | 6 +++++- krebs/v2/default.nix | 9 +++------ 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/Makefile b/Makefile index f81666ae3..c4f5cd398 100644 --- a/Makefile +++ b/Makefile @@ -55,14 +55,18 @@ endif # usage: make populate system=foo [target=bar] .PHONY: populate +populate: export lib = \ + let nlib = import ; in \ + nlib // import krebs/4lib { lib = nlib; } // builtins populate: export source = \ - with (import ~/stockholm {}).users.$(LOGNAME).$(system).config.krebs.build; \ + with (import ./. {}).users.$(LOGNAME).$(system).config.krebs.build; \ assert source-version == 2; \ source populate:;@ result=$$(nix-instantiate \ --eval \ --json \ + --arg lib "$$lib" \ --arg source "$$source" \ --argstr target-host "$$target" \ --argstr target-path /var/src \ diff --git a/krebs/v2/default.nix b/krebs/v2/default.nix index 78e990d1c..ac1c13e72 100644 --- a/krebs/v2/default.nix +++ b/krebs/v2/default.nix @@ -1,13 +1,10 @@ -{ source +{ lib +, source , target-user ? "root" , target-host , target-path ? "/var/src" }: -with import ; -with import ~/stockholm/krebs/4lib { - lib = import ; -}; -with builtins; +with lib; let out = { inherit populate; -- cgit v1.2.3 From 942511acb1ca0d3c6ef1e59694e888c7d4665aee Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 03:51:22 +0100 Subject: make {populate,rebuild}: use $target_{host,user,path} --- Makefile | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/Makefile b/Makefile index c4f5cd398..501dfbe83 100644 --- a/Makefile +++ b/Makefile @@ -49,36 +49,39 @@ endif $${target+--argstr target "$$target"}) echo "$$result" | filter -ifndef target -export target = $(system) -endif +export target_host ?= $(system) +export target_user ?= root +export target_path ?= /var/src -# usage: make populate system=foo [target=bar] +# usage: make populate system=foo [target_host=bar] .PHONY: populate populate: export lib = \ let nlib = import ; in \ nlib // import krebs/4lib { lib = nlib; } // builtins populate: export source = \ - with (import ./. {}).users.$(LOGNAME).$(system).config.krebs.build; \ - assert source-version == 2; \ - source + with builtins; \ + with (import ./. {}).users.$${getEnv "LOGNAME"}.$${getEnv "system"}; \ + assert config.krebs.build.source-version == 2; \ + config.krebs.build.source populate:;@ result=$$(nix-instantiate \ --eval \ --json \ --arg lib "$$lib" \ --arg source "$$source" \ - --argstr target-host "$$target" \ - --argstr target-path /var/src \ + --argstr target-user "$$target_user" \ + --argstr target-host "$$target_host" \ + --argstr target-path "$$target_path" \ -A populate \ krebs/v2) script=$$(echo "$$result" | jq -r .) echo "$$script" | sh -# usage: make rebuild system=foo [target=bar] [operation=switch] +# usage: make rebuild system=foo [target_host=bar] [operation=switch] .PHONY: rebuild rebuild: populate ;@set -x - ssh root@"$$target" nixos-rebuild "$${operation-switch}" -I /var/src + ssh "$$target_user@$$target_host" \ + nixos-rebuild "$${operation-switch}" -I "$$target_path" else $(error unbound variable: system[s]) -- cgit v1.2.3 From 74120066f0387339bc4b3c02b30ed303a90de5da Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 03:57:32 +0100 Subject: krebs/v2: simplify verbose --- krebs/v2/default.nix | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/krebs/v2/default.nix b/krebs/v2/default.nix index ac1c13e72..cba7a75ff 100644 --- a/krebs/v2/default.nix +++ b/krebs/v2/default.nix @@ -15,9 +15,7 @@ let set -eu verbose() { - printf '+' >&2 - printf ' %q' "$@" >&2 - printf '\n' + printf '+%s\n' "$(printf ' %q' "$@")" >&2 "$@" } @@ -86,9 +84,8 @@ let set -efu verbose() { - printf '+' >&2 - printf ' %q' "$@" >&2 - printf '\n' + printf '+%s\n' "$(printf ' %q' "$@")" >&2 + "$@" } fetch_git() {( -- cgit v1.2.3 From 0414f344d9abec821883dcdc77acc6b1d7b8f0ae Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 04:01:55 +0100 Subject: nixpkgs/nixos/lib -> upstream-nixpkgs/nixos/lib --- nixpkgs/nixos/lib | 1 + 1 file changed, 1 insertion(+) create mode 120000 nixpkgs/nixos/lib diff --git a/nixpkgs/nixos/lib b/nixpkgs/nixos/lib new file mode 120000 index 000000000..eb942f88b --- /dev/null +++ b/nixpkgs/nixos/lib @@ -0,0 +1 @@ +../../upstream-nixpkgs/nixos/lib \ No newline at end of file -- cgit v1.2.3 From 5ce588fb8172ba4d91cfa31c9e043fa1799be9ae Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 13:21:59 +0100 Subject: nixpkgs/pkgs -> upstream-nixpkgs/pkgs --- nixpkgs/pkgs | 1 + 1 file changed, 1 insertion(+) create mode 120000 nixpkgs/pkgs diff --git a/nixpkgs/pkgs b/nixpkgs/pkgs new file mode 120000 index 000000000..ce5f5448b --- /dev/null +++ b/nixpkgs/pkgs @@ -0,0 +1 @@ +../upstream-nixpkgs/pkgs \ No newline at end of file -- cgit v1.2.3 From 11371608c1c6b5fc661d1c0a1f825226dfd9f599 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 15:29:40 +0100 Subject: with-tmpdir: init at 1 --- krebs/5pkgs/with-tmpdir/default.nix | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 krebs/5pkgs/with-tmpdir/default.nix diff --git a/krebs/5pkgs/with-tmpdir/default.nix b/krebs/5pkgs/with-tmpdir/default.nix new file mode 100644 index 000000000..517e46310 --- /dev/null +++ b/krebs/5pkgs/with-tmpdir/default.nix @@ -0,0 +1,29 @@ +{ stdenv, fetchgit, coreutils, dash, ... }: + +stdenv.mkDerivation { + name = "with-tmpdir-1"; + + src = fetchgit { + url = http://cgit.cd.krebsco.de/with-tmpdir; + rev = "3243c02ed8cd27a04c080bd39560204980f6c16a"; + sha256 = "80ee6cafb2c337999ddcd1e41747d6256b7cfcea605358c2046eb7e3729555c6"; + }; + + phases = [ + "unpackPhase" + "installPhase" + ]; + + installPhase = '' + mkdir -p $out/bin + + { echo '#! ${dash}/bin/dash' + echo 'OLDPATH=$PATH' + echo 'PATH=${coreutils}/bin' + sed '$s/^/#/' ./with-tmpdir + echo '(PATH=$OLDPATH; exec "$@")' + } > $out/bin/with-tmpdir + + chmod +x $out/bin/with-tmpdir + ''; +} -- cgit v1.2.3 From 7dbfc126fb329a67d68b32803e866ba9f0e7b2f0 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 15:34:22 +0100 Subject: tv git public-repos += with-tmpdir --- tv/2configs/git.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix index 800deff1b..5e0f95c15 100644 --- a/tv/2configs/git.nix +++ b/tv/2configs/git.nix @@ -39,6 +39,7 @@ let stockholm = { desc = "take all the computers hostage, they'll love you!"; }; + with-tmpdir = {}; } // mapAttrValues (setAttr "section" "2. Haskell libraries") { blessings = {}; mime = {}; -- cgit v1.2.3 From 03e5d03c129190451e1431fac6aae70f745812f9 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 19:17:19 +0100 Subject: tv config: use null for dummy secrets --- tv/2configs/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index abe9d3de8..777cd4ea3 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -12,6 +12,7 @@ with lib; source = mapAttrs (_: mkDefault) ({ nixos-config = "symlink:stockholm-private/1systems/${config.krebs.build.host.name}.nix"; nixpkgs = symlink:stockholm-nixpkgs; + null = "/home/tv/stockholm/null"; secrets = "/home/tv/secrets/${config.krebs.build.host.name}"; secrets-common = "/home/tv/secrets/common"; stockholm-krebs = "/home/tv/stockholm/krebs"; @@ -101,7 +102,7 @@ with lib; }; environment.variables = { - NIX_PATH = mkForce "/var/src"; + NIX_PATH = mkForce "secrets=/var/src/null:/var/src"; }; programs.bash = { -- cgit v1.2.3 From 28382e43e0df74a6b10bfcf23465d8415fa86460 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 19:51:01 +0100 Subject: tv: RIP consul --- tv/1systems/cd.nix | 1 - tv/1systems/mkdir.nix | 1 - tv/1systems/rmdir.nix | 1 - tv/2configs/consul-client.nix | 9 ---- tv/2configs/consul-server.nix | 21 -------- tv/3modules/consul.nix | 118 ------------------------------------------ tv/3modules/default.nix | 1 - 7 files changed, 152 deletions(-) delete mode 100644 tv/2configs/consul-client.nix delete mode 100644 tv/2configs/consul-server.nix delete mode 100644 tv/3modules/consul.nix diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix index 27e94aef0..e42d5750a 100644 --- a/tv/1systems/cd.nix +++ b/tv/1systems/cd.nix @@ -14,7 +14,6 @@ with lib; imports = [ ../2configs/hw/CAC-Developer-2.nix ../2configs/fs/CAC-CentOS-7-64bit.nix - #../2configs/consul-server.nix ../2configs/exim-smarthost.nix ../2configs/git.nix ../2configs/retiolum.nix diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix index 9d8a0bcfa..79e5f73b9 100644 --- a/tv/1systems/mkdir.nix +++ b/tv/1systems/mkdir.nix @@ -22,7 +22,6 @@ in imports = [ ../2configs/hw/CAC-Developer-1.nix ../2configs/fs/CAC-CentOS-7-64bit.nix - ../2configs/consul-server.nix ../2configs/exim-smarthost.nix ../2configs/git.nix { diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix index 1f1d975c9..6fd79c596 100644 --- a/tv/1systems/rmdir.nix +++ b/tv/1systems/rmdir.nix @@ -23,7 +23,6 @@ in imports = [ ../2configs/hw/CAC-Developer-1.nix ../2configs/fs/CAC-CentOS-7-64bit.nix - ../2configs/consul-server.nix ../2configs/exim-smarthost.nix ../2configs/git.nix { diff --git a/tv/2configs/consul-client.nix b/tv/2configs/consul-client.nix deleted file mode 100644 index 0a8bf4d75..000000000 --- a/tv/2configs/consul-client.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ pkgs, ... }: - -{ - imports = [ ./consul-server.nix ]; - - tv.consul = { - server = pkgs.lib.mkForce false; - }; -} diff --git a/tv/2configs/consul-server.nix b/tv/2configs/consul-server.nix deleted file mode 100644 index d10f9ea75..000000000 --- a/tv/2configs/consul-server.nix +++ /dev/null @@ -1,21 +0,0 @@ -{ config, ... }: - -{ - tv.consul = rec { - enable = true; - - self = config.krebs.build.host; - inherit (self) dc; - - server = true; - - hosts = with config.krebs.hosts; [ - # TODO get this list automatically from each host where tv.consul.enable is true - cd - mkdir - nomic - rmdir - #wu - ]; - }; -} diff --git a/tv/3modules/consul.nix b/tv/3modules/consul.nix deleted file mode 100644 index 5c955fdb5..000000000 --- a/tv/3modules/consul.nix +++ /dev/null @@ -1,118 +0,0 @@ -{ config, lib, pkgs, ... }: - -# if quorum gets lost, then start any node with a config that doesn't contain bootstrap_expect -# but -bootstrap -# TODO consul-bootstrap HOST that actually does is -# TODO tools to inspect state of a cluster in outage state - -with lib; -let - cfg = config.tv.consul; - - out = { - options.tv.consul = api; - config = mkIf cfg.enable (mkMerge [ - imp - { tv.iptables.input-retiolum-accept-new-tcp = [ "8300" "8301" ]; } - # TODO udp for 8301 - ]); - }; - - api = { - enable = mkEnableOption "tv.consul"; - - dc = mkOption { - type = types.label; - }; - hosts = mkOption { - type = with types; listOf host; - }; - encrypt-file = mkOption { - type = types.str; # TODO path (but not just into store) - default = toString ; - }; - data-dir = mkOption { - type = types.str; # TODO path (but not just into store) - default = "/var/lib/consul"; - }; - self = mkOption { - type = types.host; - }; - server = mkOption { - type = types.bool; - default = false; - }; - GOMAXPROCS = mkOption { - type = types.int; - default = cfg.self.cores; - }; - }; - - consul-config = { - datacenter = cfg.dc; - data_dir = cfg.data-dir; - log_level = "INFO"; - #node_name = - server = cfg.server; - enable_syslog = true; - retry_join = - # TODO allow consul in other nets than retiolum [maybe] - concatMap (host: host.nets.retiolum.addrs) - (filter (host: host.name != cfg.self.name) cfg.hosts); - leave_on_terminate = true; - } // optionalAttrs cfg.server { - bootstrap_expect = length cfg.hosts; - leave_on_terminate = false; - }; - - imp = { - environment.systemPackages = with pkgs; [ - consul - ]; - - systemd.services.consul = { - after = [ "network.target" ]; - wantedBy = [ "multi-user.target" ]; - path = with pkgs; [ - consul - ]; - environment = { - GOMAXPROCS = toString cfg.GOMAXPROCS; - }; - serviceConfig = { - PermissionsStartOnly = "true"; - SyslogIdentifier = "consul"; - User = user.name; - PrivateTmp = "true"; - Restart = "always"; - ExecStartPre = pkgs.writeScript "consul-init" '' - #! /bin/sh - mkdir -p ${cfg.data-dir} - chown ${user.name}: ${cfg.data-dir} - install -o ${user.name} -m 0400 ${cfg.encrypt-file} /tmp/encrypt.json - ''; - ExecStart = pkgs.writeScript "consul-service" '' - #! /bin/sh - set -euf - exec >/dev/null - exec consul agent \ - -config-file=${toFile "consul.json" (toJSON consul-config)} \ - -config-file=/tmp/encrypt.json - ''; - #-node=${cfg.self.fqdn} \ - #ExecStart = "${tinc}/sbin/tincd -c ${confDir} -d 0 -U ${user} -D"; - }; - }; - - users.extraUsers = singleton { - inherit (user) name uid; - }; - }; - - user = rec { - name = "consul"; - uid = genid name; - }; - -in -out diff --git a/tv/3modules/default.nix b/tv/3modules/default.nix index bb10d8261..f7889b245 100644 --- a/tv/3modules/default.nix +++ b/tv/3modules/default.nix @@ -2,7 +2,6 @@ _: { imports = [ - ./consul.nix ./ejabberd.nix ./iptables.nix ]; -- cgit v1.2.3 From d341d1ad1006d49299007c2210dfd8f9903ae21a Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 20:01:28 +0100 Subject: tv vim: drop noise --- tv/2configs/vim.nix | 5 ----- 1 file changed, 5 deletions(-) diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix index bab949270..83cc6e117 100644 --- a/tv/2configs/vim.nix +++ b/tv/2configs/vim.nix @@ -7,11 +7,6 @@ let vim ]; - # Nano really is just a stupid name for Vim. - nixpkgs.config.packageOverrides = pkgs: { - nano = pkgs.vim; - }; - environment.etc.vimrc.source = vimrc; environment.variables.EDITOR = mkForce "vim"; -- cgit v1.2.3 From ef0ce9065f312140cbcb51fc5102c4c5d4e80568 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 20:02:01 +0100 Subject: tv nix.vim: let b:current_syntax --- tv/2configs/vim.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix index 83cc6e117..23f90af05 100644 --- a/tv/2configs/vim.nix +++ b/tv/2configs/vim.nix @@ -105,6 +105,8 @@ let syn match String /"\([^\\"]\|\\.\)*"/ syn match Comment /\(^\|\s\)#.*/ + + let b:current_syntax = "nix" ''} au BufRead,BufNewFile /dev/shm/* set nobackup nowritebackup noswapfile -- cgit v1.2.3 From ba4bfed2715cb3973f9dbaa6f0a6010c59121a54 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 20:05:12 +0100 Subject: wu: selectively allowUnfree nvidia-x11 --- tv/1systems/wu.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index aef8ca761..2fa0e8ab7 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -157,7 +157,7 @@ with lib; nixpkgs.config.chromium.enablePepperFlash = true; - nixpkgs.config.allowUnfree = true; + nixpkgs.config.allowUnfreePredicate = pkg: hasPrefix "nvidia-x11-" pkg.name; hardware.bumblebee.enable = true; hardware.bumblebee.group = "video"; hardware.enableAllFirmware = true; -- cgit v1.2.3 From 34dcaa692382072889e7e796461933ff129d5a13 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 20:06:15 +0100 Subject: xu: don't unconditionally allowUnfree --- tv/1systems/xu.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index 31a8a3e99..8c4af2bd3 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -155,7 +155,6 @@ with lib; nixpkgs.config.chromium.enablePepperFlash = true; - nixpkgs.config.allowUnfree = true; #hardware.bumblebee.enable = true; #hardware.bumblebee.group = "video"; hardware.enableAllFirmware = true; -- cgit v1.2.3 From 44b9f90b2c70c997399afcc550dac2fff155af6b Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 20:12:06 +0100 Subject: tv config: allowUnfree = false --- tv/2configs/default.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index 777cd4ea3..ee1d9521d 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -70,6 +70,9 @@ with lib; nix.useChroot = true; } + { + nixpkgs.config.allowUnfree = false; + } { environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ]; -- cgit v1.2.3 From afd09edbd3ec1739fb95eaab664a2400386ce7a0 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 2 Feb 2016 20:17:10 +0100 Subject: tv: cleanup allowUnfree --- tv/2configs/hw/AO753.nix | 9 ++++----- tv/2configs/hw/x220.nix | 1 - 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/tv/2configs/hw/AO753.nix b/tv/2configs/hw/AO753.nix index acd9ee32b..72a40819f 100644 --- a/tv/2configs/hw/AO753.nix +++ b/tv/2configs/hw/AO753.nix @@ -1,4 +1,6 @@ -{ config, pkgs, ... }: +{ config, lib, pkgs, ... }: + +with lib; { imports = [ @@ -39,8 +41,5 @@ HandleSuspendKey=ignore ''; - nixpkgs.config = { - allowUnfree = false; - allowUnfreePredicate = (x: pkgs.lib.hasPrefix "broadcom-sta-" x.name); - }; + nixpkgs.config.allowUnfreePredicate = pkg: hasPrefix "broadcom-sta-" pkg.name; } diff --git a/tv/2configs/hw/x220.nix b/tv/2configs/hw/x220.nix index 8549311e7..7cec670fa 100644 --- a/tv/2configs/hw/x220.nix +++ b/tv/2configs/hw/x220.nix @@ -14,7 +14,6 @@ networking.wireless.enable = true; #hardware.enableAllFirmware = true; - #nixpkgs.config.allowUnfree = true; #zramSwap.enable = true; #zramSwap.numDevices = 2; -- cgit v1.2.3 From 68655d1ddf078eb1bb3a48ba7e6e9376d913985e Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 3 Feb 2016 11:32:58 +0100 Subject: krebs.git: remove trailing spaces --- krebs/3modules/git.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix index e6267d7e6..0fa6b240b 100644 --- a/krebs/3modules/git.nix +++ b/krebs/3modules/git.nix @@ -27,7 +27,7 @@ let description = '' Enable cgit. Cgit is an attempt to create a fast web interface for the git version - control system, using a built in cache to decrease pressure on the + control system, using a built in cache to decrease pressure on the git server. cgit in this module is being served via fastcgi nginx.This module deploys a http://cgit. nginx configuration and enables nginx @@ -127,7 +127,7 @@ let git-imp = { system.activationScripts.git-init = "${init-script}"; - + # TODO maybe put all scripts here and then use PATH? environment.etc."${etc-base}".source = scriptFarm "git-ssh-authorizers" { @@ -136,7 +136,7 @@ let (map getName (ensureList repo)) (map getName perm.allow-commands) ]) cfg.rules); - + authorize-push = makeAuthorizeScript (map ({ repo, user, perm }: [ (map getName (ensureList user)) (map getName (ensureList repo)) @@ -144,7 +144,7 @@ let (map getName perm.allow-receive-modes) ]) (filter (x: hasAttr "allow-receive-ref" x.perm) cfg.rules)); }; - + users.extraUsers = singleton rec { description = "Git repository hosting user"; name = "git"; -- cgit v1.2.3 From cdb590be5072712c9552a98f8979aa94288dcbc8 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 3 Feb 2016 13:36:54 +0100 Subject: krebs.git.rules: specify type --- krebs/3modules/git.nix | 193 +++++++++++++++++++++++++++++++++++-------------- tv/2configs/git.nix | 4 +- 2 files changed, 142 insertions(+), 55 deletions(-) diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix index 0fa6b240b..7b28ffca8 100644 --- a/krebs/3modules/git.nix +++ b/krebs/3modules/git.nix @@ -44,48 +44,8 @@ let default = "/etc/git"; }; repos = mkOption { - type = types.attrsOf (types.submodule ({ - options = { - desc = mkOption { - type = types.nullOr types.str; - default = null; - description = '' - Repository description. - ''; - }; - section = mkOption { - type = types.nullOr types.str; - default = null; - description = '' - Repository section. - ''; - }; - name = mkOption { - type = types.str; - description = '' - Repository name. - ''; - }; - hooks = mkOption { - type = types.attrsOf types.str; - default = {}; - description = '' - Repository-specific hooks. - ''; - }; - public = mkOption { - type = types.bool; - default = false; - description = '' - Allow everybody to read the repository via HTTP if cgit enabled. - ''; - # TODO allow every configured user to fetch the repository via SSH. - }; - }; - })); - + type = types.attrsOf subtypes.repo; default = {}; - example = literalExample '' { testing = { @@ -99,7 +59,6 @@ let testing2 = { name = "testing2"; }; } ''; - description = '' Repositories. ''; @@ -121,28 +80,156 @@ let ''; }; rules = mkOption { - type = types.unspecified; + type = types.listOf subtypes.rule; + default = []; + example = literalExample '' + singleton { + user = [ config.krebs.users.tv ]; + repo = [ testing ]; # see literal example of repos + perm = push "refs/*" (with lib.git; [ + non-fast-forward create delete merge + ]); + } + ''; + description = '' + Rules. + ''; }; }; + # TODO put into krebs/4lib/types.nix? + subtypes = { + repo = types.submodule ({ + options = { + collaborators = mkOption { + type = types.listOf types.user; + default = []; + description = '' + List of users that should be able to fetch from this repo. + + This option is currently not used by krebs.git but instead can be + used to create rules. See e.g. for + an example. + ''; + }; + desc = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + Repository description. + ''; + }; + section = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + Repository section. + ''; + }; + name = mkOption { + type = types.str; + description = '' + Repository name. + ''; + }; + hooks = mkOption { + type = types.attrsOf types.str; + default = {}; + description = '' + Repository-specific hooks. + ''; + }; + public = mkOption { + type = types.bool; + default = false; + description = '' + Allow everybody to read the repository via HTTP if cgit enabled. + ''; + # TODO allow every configured user to fetch the repository via SSH. + }; + }; + }); + rule = types.submodule ({ config, ... }: { + options = { + user = mkOption { + type = types.listOf types.user; + description = '' + List of users this rule should apply to. + Checked by authorize-command. + ''; + }; + repo = mkOption { + type = types.listOf subtypes.repo; + description = '' + List of repos this rule should apply to. + Checked by authorize-command. + ''; + }; + perm = mkOption { + type = types.submodule { + # TODO generate enum argument from krebs/4lib/git.nix + options = { + allow-commands = mkOption { + type = types.listOf (types.enum (with git; [ + git-receive-pack + git-upload-pack + ])); + default = []; + description = '' + List of commands the rule's users are allowed to execute. + Checked by authorize-command. + ''; + }; + allow-receive-ref = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + Ref that can receive objects. + Checked by authorize-push. + ''; + }; + allow-receive-modes = mkOption { + type = types.listOf (types.enum (with git; [ + fast-forward + non-fast-forward + create + delete + merge + ])); + default = []; + description = '' + List of allowed receive modes. + Checked by pre-receive hook. + ''; + }; + }; + }; + description = '' + Permissions granted. + ''; + }; + }; + }); + }; + git-imp = { system.activationScripts.git-init = "${init-script}"; # TODO maybe put all scripts here and then use PATH? environment.etc."${etc-base}".source = scriptFarm "git-ssh-authorizers" { - authorize-command = makeAuthorizeScript (map ({ repo, user, perm }: [ - (map getName (ensureList user)) - (map getName (ensureList repo)) - (map getName perm.allow-commands) + authorize-command = makeAuthorizeScript (map (rule: [ + (map getName (ensureList rule.user)) + (map getName (ensureList rule.repo)) + (map getName rule.perm.allow-commands) ]) cfg.rules); - authorize-push = makeAuthorizeScript (map ({ repo, user, perm }: [ - (map getName (ensureList user)) - (map getName (ensureList repo)) - (ensureList perm.allow-receive-ref) - (map getName perm.allow-receive-modes) - ]) (filter (x: hasAttr "allow-receive-ref" x.perm) cfg.rules)); + authorize-push = makeAuthorizeScript (map (rule: [ + (map getName (ensureList rule.user)) + (map getName (ensureList rule.repo)) + (ensureList rule.perm.allow-receive-ref) + (map getName rule.perm.allow-receive-modes) + ]) (filter (rule: rule.perm.allow-receive-ref != null) cfg.rules)); }; users.extraUsers = singleton rec { diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix index 5e0f95c15..01dc7de9b 100644 --- a/tv/2configs/git.nix +++ b/tv/2configs/git.nix @@ -9,7 +9,7 @@ let enable = true; root-title = "public repositories at ${config.krebs.build.host.name}"; root-desc = "keep calm and engage"; - repos = mapAttrs (_: s: removeAttrs s ["collaborators"]) repos; + repos = repos; rules = rules; }; }; @@ -99,7 +99,7 @@ let repo = [ repo ]; perm = fetch; } ++ - optional (length (repo.collaborators or []) > 0) { + optional (repo.collaborators or [] != []) { user = repo.collaborators; repo = [ repo ]; perm = fetch; -- cgit v1.2.3 From 5bc7523bb54e960f5ac00492b16519b1bce21007 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 3 Feb 2016 19:39:00 +0100 Subject: cac-1.0.3 -> cac-api-1.1.0 --- krebs/5pkgs/cac-api/default.nix | 37 +++++++++++++++++++++++ krebs/5pkgs/cac/default.nix | 39 ------------------------- krebs/5pkgs/test/infest-cac-centos7/default.nix | 4 +-- krebs/5pkgs/test/infest-cac-centos7/notes | 32 ++++++++++---------- tv/1systems/wu.nix | 2 +- tv/2configs/git.nix | 4 +-- 6 files changed, 58 insertions(+), 60 deletions(-) create mode 100644 krebs/5pkgs/cac-api/default.nix delete mode 100644 krebs/5pkgs/cac/default.nix diff --git a/krebs/5pkgs/cac-api/default.nix b/krebs/5pkgs/cac-api/default.nix new file mode 100644 index 000000000..2a32bb096 --- /dev/null +++ b/krebs/5pkgs/cac-api/default.nix @@ -0,0 +1,37 @@ +{ stdenv, fetchgit, bc, coreutils, curl, gnused, inotifyTools, jq, ncurses, sshpass, ... }: + +stdenv.mkDerivation { + name = "cac-api-1.1.0"; + + src = fetchgit { + url = http://cgit.cd.krebsco.de/cac-api; + rev = "0809fae379239687ed1170e04311dc2880ef0aba"; + sha256 = "357ced27c9ed88028967c934178a1d230bf38617a7494cd4632fabdd2a04fcdd"; + }; + + phases = [ + "unpackPhase" + "installPhase" + ]; + + installPhase = + let + path = stdenv.lib.makeSearchPath "bin" [ + bc + coreutils + curl + gnused + inotifyTools + jq + ncurses + sshpass + ]; + in + '' + mkdir -p $out/bin + cp cac-api $out/bin/cac-api + sed -i ' + s;^_cac_cli_main .*;PATH=${path}''${PATH+:$PATH} &; + ' $out/bin/cac-api + ''; +} diff --git a/krebs/5pkgs/cac/default.nix b/krebs/5pkgs/cac/default.nix deleted file mode 100644 index 4d39ce2fb..000000000 --- a/krebs/5pkgs/cac/default.nix +++ /dev/null @@ -1,39 +0,0 @@ -{ stdenv, fetchgit, bc, coreutils, curl, gnused, inotifyTools, jq, ncurses, sshpass, ... }: - -stdenv.mkDerivation { - name = "cac-1.0.3"; - - src = fetchgit { - url = http://cgit.cd.retiolum/cac; - rev = "22acc1b990ac7d97c16344fbcbc2621e24cdf915"; - sha256 = "135b740617c983b3f46a1983d4744be17340d5146a0a0de0dff4bb7a53688f2f"; - }; - - phases = [ - "unpackPhase" - "installPhase" - ]; - - installPhase = - let - path = stdenv.lib.makeSearchPath "bin" [ - bc - coreutils - curl - gnused - inotifyTools - jq - ncurses - sshpass - ]; - in - '' - mkdir -p $out/bin - - sed < ./cac > $out/bin/cac ' - s;^_cac_main .*;PATH=${path}''${PATH+:$PATH} &; - ' - - chmod +x $out/bin/cac - ''; -} diff --git a/krebs/5pkgs/test/infest-cac-centos7/default.nix b/krebs/5pkgs/test/infest-cac-centos7/default.nix index 7f2e3f231..ebea5ae1c 100644 --- a/krebs/5pkgs/test/infest-cac-centos7/default.nix +++ b/krebs/5pkgs/test/infest-cac-centos7/default.nix @@ -1,4 +1,4 @@ -{ stdenv, coreutils,makeWrapper, cac, cacpanel, gnumake, gnused, jq, openssh, ... }: +{ stdenv, coreutils,makeWrapper, cac-api, cacpanel, gnumake, gnused, jq, openssh, ... }: stdenv.mkDerivation rec { name = "${shortname}-${version}"; @@ -14,7 +14,7 @@ stdenv.mkDerivation rec { path = stdenv.lib.makeSearchPath "bin" [ coreutils - cac + cac-api cacpanel gnumake gnused diff --git a/krebs/5pkgs/test/infest-cac-centos7/notes b/krebs/5pkgs/test/infest-cac-centos7/notes index 6bfb6906e..7b9cbb46f 100755 --- a/krebs/5pkgs/test/infest-cac-centos7/notes +++ b/krebs/5pkgs/test/infest-cac-centos7/notes @@ -1,6 +1,6 @@ #! /bin/sh -# nix-shell -p gnumake jq openssh cac cacpanel +# nix-shell -p gnumake jq openssh cac-api cacpanel set -eufx # 2 secrets are required: @@ -47,15 +47,15 @@ export cac_secrets=$sec_file cac-cli --config $krebs_cred panel add-api-ip # test login: -cac update -cac servers +cac-api update +cac-api servers # preserve old trap old_trapstr=$(clear_defer) while true;do # Template 26: CentOS7 - # TODO: use cac templates to determine the real Centos7 template in case it changes - out=$(cac build cpu=1 ram=512 storage=10 os=26 2>&1) + # TODO: use cac-api templates to determine the real Centos7 template in case it changes + out=$(cac-api build cpu=1 ram=512 storage=10 os=26 2>&1) if name=$(echo "$out" | jq -r .servername);then id=servername:$name echo "got a working machine, id=$id" @@ -67,15 +67,15 @@ while true;do fi clear_defer >/dev/null - defer "cac delete $id" + defer "cac-api delete $id" # TODO: timeout? wait_login_cac(){ # we wait for 30 minutes for t in `seq 180`;do - # now we have a working cac server - if cac ssh $1 -o ConnectTimeout=10 \ + # now we have a working cac-api server + if cac-api ssh $1 -o ConnectTimeout=10 \ cat /etc/redhat-release | \ grep CentOS ;then return 0 @@ -87,7 +87,7 @@ while true;do # die on timeout if ! wait_login_cac $id;then echo "unable to boot a working system within time frame, retrying..." >&2 - echo "Cleaning up old image,last status: $(cac update;cac getserver $id | jq -r .status)" + echo "Cleaning up old image,last status: $(cac-api update;cac-api getserver $id | jq -r .status)" eval "$(clear_defer | sed 's/;exit//')" sleep 15 else @@ -96,17 +96,17 @@ while true;do fi done clear_defer >/dev/null -defer "cac delete $id;$old_trapstr" +defer "cac-api delete $id;$old_trapstr" mkdir -p shared/2configs/temp -cac generatenetworking $id > \ +cac-api generatenetworking $id > \ shared/2configs/temp/networking.nix # new temporary ssh key we will use to log in after infest ssh-keygen -f $krebs_ssh -N "" cp $retiolum_key $krebs_secrets/retiolum.rsa_key.priv # we override the directories for secrets and stockholm # additionally we set the ssh key we generated -ip=$(cac getserver $id | jq -r .ip) +ip=$(cac-api getserver $id | jq -r .ip) cat > shared/2configs/temp/dirs.nix < $krebs_secrets/infest sh -x $krebs_secrets/infest # TODO: generate secrets directory $krebs_secrets for nix import -cac powerop $id reset +cac-api powerop $id reset wait_login(){ # timeout for t in `seq 90`;do - # now we have a working cac server + # now we have a working cac-api server if ssh -o StrictHostKeyChecking=no \ -o UserKnownHostsFile=/dev/null \ -i $krebs_ssh \ diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index 2fa0e8ab7..29e6de08b 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -43,7 +43,7 @@ with lib; # tv bc bind # dig - cac + cac-api dic file get diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix index 01dc7de9b..b8180085f 100644 --- a/tv/2configs/git.nix +++ b/tv/2configs/git.nix @@ -22,8 +22,8 @@ let public-repos = mapAttrs make-public-repo ({ } // mapAttrValues (setAttr "section" "1. Miscellaneous") { - cac = { - desc = "CloudAtCost command line interface"; + cac-api = { + desc = "CloudAtCost API command line interface"; }; get = {}; hack = {}; -- cgit v1.2.3 From a350db5ce9e3fcf27678a2b9bb6685358b63742a Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 3 Feb 2016 21:17:46 +0100 Subject: cacpanel 0.2.3 -> cac-panel 0.4.4 --- krebs/5pkgs/cac-panel/default.nix | 18 ++++++++++++++++++ krebs/5pkgs/cacpanel/default.nix | 18 ------------------ 2 files changed, 18 insertions(+), 18 deletions(-) create mode 100644 krebs/5pkgs/cac-panel/default.nix delete mode 100644 krebs/5pkgs/cacpanel/default.nix diff --git a/krebs/5pkgs/cac-panel/default.nix b/krebs/5pkgs/cac-panel/default.nix new file mode 100644 index 000000000..fd4799535 --- /dev/null +++ b/krebs/5pkgs/cac-panel/default.nix @@ -0,0 +1,18 @@ +{pkgs, python3Packages, ...}: + +python3Packages.buildPythonPackage rec { + name = "cac-panel-${version}"; + version = "0.4.4"; + + src = pkgs.fetchurl { + url = "https://pypi.python.org/packages/source/c/cac-panel/cac-panel-${version}.tar.gz"; + sha256 = "16bx67fsbgwxciik42jhdnfzxx1xp5b0rimzrif3r7h4fawlnld8"; + }; + + propagatedBuildInputs = with python3Packages; [ + docopt + requests2 + beautifulsoup4 + ]; +} + diff --git a/krebs/5pkgs/cacpanel/default.nix b/krebs/5pkgs/cacpanel/default.nix deleted file mode 100644 index 3df4dffed..000000000 --- a/krebs/5pkgs/cacpanel/default.nix +++ /dev/null @@ -1,18 +0,0 @@ -{pkgs, python3Packages, ...}: - -python3Packages.buildPythonPackage rec { - name = "cacpanel-${version}"; - version = "0.2.3"; - - src = pkgs.fetchurl { - url = "https://pypi.python.org/packages/source/c/cacpanel/cacpanel-${version}.tar.gz"; - sha256 = "1fib7416qqv8yzrj75kxra7ccpz9abqh58b6gkaavws2fa6m3mm8"; - }; - - propagatedBuildInputs = with python3Packages; [ - docopt - requests2 - beautifulsoup4 - ]; -} - -- cgit v1.2.3 From fdc4fa5c98aaabfb31be7e7f219ca2b134172cf9 Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 3 Feb 2016 21:17:46 +0100 Subject: cacpanel 0.2.3 -> cac-panel 0.4.4 --- krebs/5pkgs/cac-panel/default.nix | 18 ++++++++++++++++++ krebs/5pkgs/cacpanel/default.nix | 18 ------------------ 2 files changed, 18 insertions(+), 18 deletions(-) create mode 100644 krebs/5pkgs/cac-panel/default.nix delete mode 100644 krebs/5pkgs/cacpanel/default.nix diff --git a/krebs/5pkgs/cac-panel/default.nix b/krebs/5pkgs/cac-panel/default.nix new file mode 100644 index 000000000..fd4799535 --- /dev/null +++ b/krebs/5pkgs/cac-panel/default.nix @@ -0,0 +1,18 @@ +{pkgs, python3Packages, ...}: + +python3Packages.buildPythonPackage rec { + name = "cac-panel-${version}"; + version = "0.4.4"; + + src = pkgs.fetchurl { + url = "https://pypi.python.org/packages/source/c/cac-panel/cac-panel-${version}.tar.gz"; + sha256 = "16bx67fsbgwxciik42jhdnfzxx1xp5b0rimzrif3r7h4fawlnld8"; + }; + + propagatedBuildInputs = with python3Packages; [ + docopt + requests2 + beautifulsoup4 + ]; +} + diff --git a/krebs/5pkgs/cacpanel/default.nix b/krebs/5pkgs/cacpanel/default.nix deleted file mode 100644 index 3df4dffed..000000000 --- a/krebs/5pkgs/cacpanel/default.nix +++ /dev/null @@ -1,18 +0,0 @@ -{pkgs, python3Packages, ...}: - -python3Packages.buildPythonPackage rec { - name = "cacpanel-${version}"; - version = "0.2.3"; - - src = pkgs.fetchurl { - url = "https://pypi.python.org/packages/source/c/cacpanel/cacpanel-${version}.tar.gz"; - sha256 = "1fib7416qqv8yzrj75kxra7ccpz9abqh58b6gkaavws2fa6m3mm8"; - }; - - propagatedBuildInputs = with python3Packages; [ - docopt - requests2 - beautifulsoup4 - ]; -} - -- cgit v1.2.3 From 48381bd8dd9607d54a936c644964ab5bac90e4a9 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 01:20:03 +0100 Subject: cac-api: don't GET broken listtasks + use complete cert --- krebs/5pkgs/cac-api/cac.pem | 88 +++++++++++++++++++++++++++++++++++++++++ krebs/5pkgs/cac-api/default.nix | 47 ++++++++++++---------- 2 files changed, 114 insertions(+), 21 deletions(-) create mode 100644 krebs/5pkgs/cac-api/cac.pem diff --git a/krebs/5pkgs/cac-api/cac.pem b/krebs/5pkgs/cac-api/cac.pem new file mode 100644 index 000000000..9d02b6bcf --- /dev/null +++ b/krebs/5pkgs/cac-api/cac.pem @@ -0,0 +1,88 @@ +-----BEGIN CERTIFICATE----- +MIIFWzCCBEOgAwIBAgIQXWIKGWRZf838+wW1zLdK0DANBgkqhkiG9w0BAQsFADCBkDELMAkGA1UE +BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgG +A1UEChMRQ09NT0RPIENBIExpbWl0ZWQxNjA0BgNVBAMTLUNPTU9ETyBSU0EgRG9tYWluIFZhbGlk +YXRpb24gU2VjdXJlIFNlcnZlciBDQTAeFw0xNTEwMjMwMDAwMDBaFw0xODEwMjIyMzU5NTlaMF8x +ITAfBgNVBAsTGERvbWFpbiBDb250cm9sIFZhbGlkYXRlZDEeMBwGA1UECxMVRXNzZW50aWFsU1NM +IFdpbGRjYXJkMRowGAYDVQQDDBEqLmNsb3VkYXRjb3N0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD +ggEPADCCAQoCggEBAM9CyL8uUPoE3zYbvnwtUW69h0f+rkND1/Jsi15EEBFPQqiYCmPiSaJLn6JB +Hri34t4lArGrPA6K01x18LJqFoYDy5ya37J8Bd4jF3cijWe/IQEWAw0r2ufhd4LTNMvEyJIECida +LMhBxpORRdijmvEXCf9D0OEGBV3qfizcCH7+VPordCY3y9fwgbk0wAB1lAk29aRosK3gZJceu57Q +YkEKjee6pZ473+xpCjaeTBUlPuGA95A2jPf8c+QSPegczOd9Hwo4JqAJSjTzzuHiSbEhd+8JIC/P +6GYVOvwnNqCPuuXsoBy8xBQ8lHuZcWd5sh4MDRvm5YxVFhYN6kOgf1ECAwEAAaOCAd8wggHbMB8G +A1UdIwQYMBaAFJCvajqUWgvYkOoSVnPfQ7Q6KNrnMB0GA1UdDgQWBBSC9dSGoIEPHBTUQJjOxxPg +lhRLPDAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYI +KwYBBQUHAwIwTwYDVR0gBEgwRjA6BgsrBgEEAbIxAQICBzArMCkGCCsGAQUFBwIBFh1odHRwczov +L3NlY3VyZS5jb21vZG8uY29tL0NQUzAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDov +L2NybC5jb21vZG9jYS5jb20vQ09NT0RPUlNBRG9tYWluVmFsaWRhdGlvblNlY3VyZVNlcnZlckNB +LmNybDCBhQYIKwYBBQUHAQEEeTB3ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LmNvbW9kb2NhLmNv +bS9DT01PRE9SU0FEb21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EuY3J0MCQGCCsGAQUFBzAB +hhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wLQYDVR0RBCYwJIIRKi5jbG91ZGF0Y29zdC5jb22C +D2Nsb3VkYXRjb3N0LmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAPfUXBGDYOQnJuykm8I9cB2rBFVvt +HgzKIM+SXRz/jRt4HN/fsQkq2mI8SUPigWbtrtL1yim0hHdTR4m6vn7eHqj8erjjEJy16OfyRwp8 +LfjjHvcPxAxiRcFdv+8Pu/o0umqtxmRn4enyAZWhqAp3TBjkJPkJgh/toJqGpE7dN1Jw1AF75rrA +DXS8J5fcJYZQydJce+kacMHLh4C0Q37NgZKPfM+9jsygqY3Fhqh5GIt/CXNx2vlDPQP87QEtK7y7 +dCGd/MwrdKkUvOpsmqWiO1+02DesZSdIow/YW+8cUhPvYMqpM9zKbqVdRj3FJK56+/xNfNX5tiU1 +1VE7rIcEbw== +-----END CERTIFICATE----- + +-----BEGIN CERTIFICATE----- +MIIGCDCCA/CgAwIBAgIQKy5u6tl1NmwUim7bo3yMBzANBgkqhkiG9w0BAQwFADCBhTELMAkGA1UE +BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgG +A1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlv +biBBdXRob3JpdHkwHhcNMTQwMjEyMDAwMDAwWhcNMjkwMjExMjM1OTU5WjCBkDELMAkGA1UEBhMC +R0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UE +ChMRQ09NT0RPIENBIExpbWl0ZWQxNjA0BgNVBAMTLUNPTU9ETyBSU0EgRG9tYWluIFZhbGlkYXRp +b24gU2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAI7CAhnh +oFmk6zg1jSz9AdDTScBkxwtiBUUWOqigwAwCfx3M28ShbXcDow+G+eMGnD4LgYqbSRutA776S9uM +IO3Vzl5ljj4Nr0zCsLdFXlIvNN5IJGS0Qa4Al/e+Z96e0HqnU4A7fK31llVvl0cKfIWLIpeNs4Tg +llfQcBhglo/uLQeTnaG6ytHNe+nEKpooIZFNb5JPJaXyejXdJtxGpdCsWTWM/06RQ1A/WZMebFEh +7lgUq/51UHg+TLAchhP6a5i84DuUHoVS3AOTJBhuyydRReZw3iVDpA3hSqXttn7IzW3uLh0nc13c +RTCAquOyQQuvvUSH2rnlG51/ruWFgqUCAwEAAaOCAWUwggFhMB8GA1UdIwQYMBaAFLuvfgI9+qbx +PISOre44mOzZMjLUMB0GA1UdDgQWBBSQr2o6lFoL2JDqElZz30O0Oija5zAOBgNVHQ8BAf8EBAMC +AYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwGwYD +VR0gBBQwEjAGBgRVHSAAMAgGBmeBDAECATBMBgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3JsLmNv +bW9kb2NhLmNvbS9DT01PRE9SU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDBxBggrBgEFBQcB +AQRlMGMwOwYIKwYBBQUHMAKGL2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9ET1JTQUFkZFRy +dXN0Q0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wDQYJKoZIhvcN +AQEMBQADggIBAE4rdk+SHGI2ibp3wScF9BzWRJ2pmj6q1WZmAT7qSeaiNbz69t2Vjpk1mA42GHWx +3d1Qcnyu3HeIzg/3kCDKo2cuH1Z/e+FE6kKVxF0NAVBGFfKBiVlsit2M8RKhjTpCipj4SzR7JzsI +tG8kO3KdY3RYPBpsP0/HEZrIqPW1N+8QRcZs2eBelSaz662jue5/DJpmNXMyYE7l3YphLG5SEXdo +ltMYdVEVABt0iN3hxzgEQyjpFv3ZBdRdRydg1vs4O2xyopT4Qhrf7W8GjEXCBgCq5Ojc2bXhc3js +9iPc0d1sjhqPpepUfJa3w/5Vjo1JXvxku88+vZbrac2/4EjxYoIQ5QxGV/Iz2tDIY+3GH5QFlkoa +kdH368+PUq4NCNk+qKBR6cGHdNXJ93SrLlP7u3r7l+L4HyaPs9Kg4DdbKDsx5Q5XLVq4rXmsXiBm +GqW5prU5wfWYQ//u+aen/e7KJD2AFsQXj4rBYKEMrltDR5FL1ZoXX/nUh8HCjLfn4g8wGTeGrODc +QgPmlKidrv0PJFGUzpII0fxQ8ANAe4hZ7Q7drNJ3gjTcBpUC2JD5Leo31Rpg0Gcg19hCC0Wvgmje +3WYkN5AplBlGGSW4gNfL1IYoakRwJiNiqZ+Gb7+6kHDSVneFeO/qJakXzlByjAA6quPbYzSf+AZx +AeKCINT+b72x +-----END CERTIFICATE----- + +-----BEGIN CERTIFICATE----- +MIIF2DCCA8CgAwIBAgIQTKr5yttjb+Af907YWwOGnTANBgkqhkiG9w0BAQwFADCBhTELMAkGA1UE +BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgG +A1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlv +biBBdXRob3JpdHkwHhcNMTAwMTE5MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMC +R0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UE +ChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBB +dXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCR6FSS0gpWsawNJN3Fz0Rn +dJkrN6N9I3AAcbxT38T6KhKPS38QVr2fcHK3YX/JSw8Xpz3jsARh7v8Rl8f0hj4K+j5c+ZPmNHrZ +FGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+ +5eNu/Nio5JIk2kNrYrhV/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pG +x8cgoLEfZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z+pUX +2nwzV0E8jVHtC7ZcryxjGt9XyD+86V3Em69FmeKjWiS0uqlWPc9vqv9JWL7wqP/0uK3pN/u6uPQL +OvnoQ0IeidiEyxPx2bvhiWC4jChWrBQdnArncevPDt09qZahSL0896+1DSJMwBGB7FY79tOi4lu3 +sgQiUpWAk2nojkxl8ZEDLXB0AuqLZxUpaVICu9ffUGpVRr+goyhhf3DQw6KqLCGqR84onAZFdr+C +GCe01a60y1Dma/RMhnEw6abfFobg2P9A3fvQQoh/ozM6LlweQRGBY84YcWsr7KaKtzFcOmpH4MN5 +WdYgGq/yapiqcrxXStJLnbsQ/LBMQeXtHT1eKJ2czL+zUdqnR+WEUwIDAQABo0IwQDAdBgNVHQ4E +FgQUu69+Aj36pvE8hI6t7jiY7NkyMtQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8w +DQYJKoZIhvcNAQEMBQADggIBAArx1UaEt65Ru2yyTUEUAJNMnMvlwFTPoCWOAvn9sKIN9SCYPBMt +rFaisNZ+EZLpLrqeLppysb0ZRGxhNaKatBYSaVqM4dc+pBroLwP0rmEdEBsqpIt6xf4FpuHA1sj+ +nq6PK7o9mfjYcwlYRm6mnPTXJ9OV2jeDchzTc+CiR5kDOF3VSXkAKRzH7JsgHAckaVd4sjn8OoSg +tZx8jb8uk2IntznaFxiuvTwJaP+EmzzV1gsD41eeFPfR60/IvYcjt7ZJQ3mFXLrrkguhxuhoqEwW +sRqZCuhTLJK7oQkYdQxlqHvLI7cawiiFwxv/0Cti76R7CZGYZ4wUAc1oBmpjIXUDgIiKboHGhfKp +pC3n9KUkEEeDys30jXlYsQab5xoq2Z0B15R97QNKyvDb6KkBPvVWmckejkk9u+UJueBPSZI9FoJA +zMxZxuY67RIuaTxslbH9qh17f4a+Hg4yRvv7E491f0yLS0Zj/gA0QHDBw7mh3aZw4gSzQbzpgJHq +ZJx64SIDqZxubw5lT2yHh17zbqD5daWbQOhTsiedSrnAdyGN/4fy3ryM7xfft0kL0fJuMAsaDk52 +7RH89elWsn2/x20Kk4yl0MC2Hb46TpSi125sC8KKfPog88Tk5c0NqMuRkrF8hey1FGlmDoLnzc7I +LaZRfyHBNVOFBkpdn627G190 +-----END CERTIFICATE----- diff --git a/krebs/5pkgs/cac-api/default.nix b/krebs/5pkgs/cac-api/default.nix index 2a32bb096..331b0853f 100644 --- a/krebs/5pkgs/cac-api/default.nix +++ b/krebs/5pkgs/cac-api/default.nix @@ -1,4 +1,4 @@ -{ stdenv, fetchgit, bc, coreutils, curl, gnused, inotifyTools, jq, ncurses, sshpass, ... }: +{ stdenv, fetchgit, bc, coreutils, curl, dash, gnused, inotifyTools, jq, ncurses, openssh, sshpass, ... }: stdenv.mkDerivation { name = "cac-api-1.1.0"; @@ -14,24 +14,29 @@ stdenv.mkDerivation { "installPhase" ]; - installPhase = - let - path = stdenv.lib.makeSearchPath "bin" [ - bc - coreutils - curl - gnused - inotifyTools - jq - ncurses - sshpass - ]; - in - '' - mkdir -p $out/bin - cp cac-api $out/bin/cac-api - sed -i ' - s;^_cac_cli_main .*;PATH=${path}''${PATH+:$PATH} &; - ' $out/bin/cac-api - ''; + installPhase = '' + mkdir -p $out/bin + { cat <<\EOF + #! ${dash}/bin/dash + export PATH=${stdenv.lib.makeSearchPath "bin" [ + bc + coreutils + curl + gnused + inotifyTools + jq + ncurses + openssh + sshpass + ]} + EOF + # [1]: Disable fetching tasks; listtasks is currently broken: + # Unknown column 'iod.apitask.cid' in 'field list' + sed ' + /^\s*tasks \\$/d; # [1] + s|\<_cac_exec curl|<${./cac.pem} & --cacert /dev/stdin| + ' cac-api + } > $out/bin/cac-api + chmod +x $out/bin/cac-api + ''; } -- cgit v1.2.3 From bbfef6bd25b4647d9587f891f9b7cb358fabfc87 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 01:32:38 +0100 Subject: Reaktor: use upstream lentil --- krebs/5pkgs/Reaktor/plugins.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/krebs/5pkgs/Reaktor/plugins.nix b/krebs/5pkgs/Reaktor/plugins.nix index 7490be4ca..0f61688e3 100644 --- a/krebs/5pkgs/Reaktor/plugins.nix +++ b/krebs/5pkgs/Reaktor/plugins.nix @@ -82,7 +82,7 @@ rec { }; stockholm-issue = buildSimpleReaktorPlugin "stockholm-issue" { script = ./scripts/random-issue.sh; - path = with pkgs; [ git gnused lentil ]; + path = with pkgs; [ git gnused haskellPackages.lentil ]; env = { "origin" = "http://cgit.gum/stockholm"; }; }; -- cgit v1.2.3 From f095b0267a94e7b8b5ff9acbf54ce11df4a40d8f Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 01:59:40 +0100 Subject: test: cacpanel -> cac-panel --- krebs/5pkgs/test/infest-cac-centos7/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/krebs/5pkgs/test/infest-cac-centos7/default.nix b/krebs/5pkgs/test/infest-cac-centos7/default.nix index f7b2a5a08..7adb09ca9 100644 --- a/krebs/5pkgs/test/infest-cac-centos7/default.nix +++ b/krebs/5pkgs/test/infest-cac-centos7/default.nix @@ -1,4 +1,4 @@ -{ stdenv, coreutils,makeWrapper, cac-api, cacpanel, gnumake, gnused, jq, openssh, ... }: +{ stdenv, coreutils,makeWrapper, cac-api, cac-panel, gnumake, gnused, jq, openssh, ... }: stdenv.mkDerivation rec { name = "${shortname}-${version}"; @@ -15,7 +15,7 @@ stdenv.mkDerivation rec { path = stdenv.lib.makeSearchPath "bin" [ coreutils cac-api - cacpanel + cac-panel gnumake gnused jq -- cgit v1.2.3 From 1745d3efa0be1687d482077c75942cf9d6a5ecc2 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 01:55:59 +0100 Subject: cac-cert: init --- krebs/5pkgs/cac-api/cac.pem | 88 ---------------------- krebs/5pkgs/cac-api/default.nix | 4 +- krebs/5pkgs/cac-cert/cac.pem | 88 ++++++++++++++++++++++ krebs/5pkgs/test/infest-cac-centos7/default.nix | 22 +++--- .../infest-cac-centos7/panel.cloudatcost.com.crt | 88 ---------------------- 5 files changed, 101 insertions(+), 189 deletions(-) delete mode 100644 krebs/5pkgs/cac-api/cac.pem create mode 100644 krebs/5pkgs/cac-cert/cac.pem delete mode 100644 krebs/5pkgs/test/infest-cac-centos7/panel.cloudatcost.com.crt diff --git a/krebs/5pkgs/cac-api/cac.pem b/krebs/5pkgs/cac-api/cac.pem deleted file mode 100644 index 9d02b6bcf..000000000 --- a/krebs/5pkgs/cac-api/cac.pem +++ /dev/null @@ -1,88 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFWzCCBEOgAwIBAgIQXWIKGWRZf838+wW1zLdK0DANBgkqhkiG9w0BAQsFADCBkDELMAkGA1UE -BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgG -A1UEChMRQ09NT0RPIENBIExpbWl0ZWQxNjA0BgNVBAMTLUNPTU9ETyBSU0EgRG9tYWluIFZhbGlk -YXRpb24gU2VjdXJlIFNlcnZlciBDQTAeFw0xNTEwMjMwMDAwMDBaFw0xODEwMjIyMzU5NTlaMF8x -ITAfBgNVBAsTGERvbWFpbiBDb250cm9sIFZhbGlkYXRlZDEeMBwGA1UECxMVRXNzZW50aWFsU1NM -IFdpbGRjYXJkMRowGAYDVQQDDBEqLmNsb3VkYXRjb3N0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD -ggEPADCCAQoCggEBAM9CyL8uUPoE3zYbvnwtUW69h0f+rkND1/Jsi15EEBFPQqiYCmPiSaJLn6JB -Hri34t4lArGrPA6K01x18LJqFoYDy5ya37J8Bd4jF3cijWe/IQEWAw0r2ufhd4LTNMvEyJIECida -LMhBxpORRdijmvEXCf9D0OEGBV3qfizcCH7+VPordCY3y9fwgbk0wAB1lAk29aRosK3gZJceu57Q -YkEKjee6pZ473+xpCjaeTBUlPuGA95A2jPf8c+QSPegczOd9Hwo4JqAJSjTzzuHiSbEhd+8JIC/P -6GYVOvwnNqCPuuXsoBy8xBQ8lHuZcWd5sh4MDRvm5YxVFhYN6kOgf1ECAwEAAaOCAd8wggHbMB8G -A1UdIwQYMBaAFJCvajqUWgvYkOoSVnPfQ7Q6KNrnMB0GA1UdDgQWBBSC9dSGoIEPHBTUQJjOxxPg -lhRLPDAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYI -KwYBBQUHAwIwTwYDVR0gBEgwRjA6BgsrBgEEAbIxAQICBzArMCkGCCsGAQUFBwIBFh1odHRwczov -L3NlY3VyZS5jb21vZG8uY29tL0NQUzAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDov -L2NybC5jb21vZG9jYS5jb20vQ09NT0RPUlNBRG9tYWluVmFsaWRhdGlvblNlY3VyZVNlcnZlckNB -LmNybDCBhQYIKwYBBQUHAQEEeTB3ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LmNvbW9kb2NhLmNv -bS9DT01PRE9SU0FEb21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EuY3J0MCQGCCsGAQUFBzAB -hhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wLQYDVR0RBCYwJIIRKi5jbG91ZGF0Y29zdC5jb22C -D2Nsb3VkYXRjb3N0LmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAPfUXBGDYOQnJuykm8I9cB2rBFVvt -HgzKIM+SXRz/jRt4HN/fsQkq2mI8SUPigWbtrtL1yim0hHdTR4m6vn7eHqj8erjjEJy16OfyRwp8 -LfjjHvcPxAxiRcFdv+8Pu/o0umqtxmRn4enyAZWhqAp3TBjkJPkJgh/toJqGpE7dN1Jw1AF75rrA -DXS8J5fcJYZQydJce+kacMHLh4C0Q37NgZKPfM+9jsygqY3Fhqh5GIt/CXNx2vlDPQP87QEtK7y7 -dCGd/MwrdKkUvOpsmqWiO1+02DesZSdIow/YW+8cUhPvYMqpM9zKbqVdRj3FJK56+/xNfNX5tiU1 -1VE7rIcEbw== ------END CERTIFICATE----- - ------BEGIN CERTIFICATE----- -MIIGCDCCA/CgAwIBAgIQKy5u6tl1NmwUim7bo3yMBzANBgkqhkiG9w0BAQwFADCBhTELMAkGA1UE -BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgG -A1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlv -biBBdXRob3JpdHkwHhcNMTQwMjEyMDAwMDAwWhcNMjkwMjExMjM1OTU5WjCBkDELMAkGA1UEBhMC -R0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UE -ChMRQ09NT0RPIENBIExpbWl0ZWQxNjA0BgNVBAMTLUNPTU9ETyBSU0EgRG9tYWluIFZhbGlkYXRp -b24gU2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAI7CAhnh -oFmk6zg1jSz9AdDTScBkxwtiBUUWOqigwAwCfx3M28ShbXcDow+G+eMGnD4LgYqbSRutA776S9uM -IO3Vzl5ljj4Nr0zCsLdFXlIvNN5IJGS0Qa4Al/e+Z96e0HqnU4A7fK31llVvl0cKfIWLIpeNs4Tg -llfQcBhglo/uLQeTnaG6ytHNe+nEKpooIZFNb5JPJaXyejXdJtxGpdCsWTWM/06RQ1A/WZMebFEh -7lgUq/51UHg+TLAchhP6a5i84DuUHoVS3AOTJBhuyydRReZw3iVDpA3hSqXttn7IzW3uLh0nc13c -RTCAquOyQQuvvUSH2rnlG51/ruWFgqUCAwEAAaOCAWUwggFhMB8GA1UdIwQYMBaAFLuvfgI9+qbx -PISOre44mOzZMjLUMB0GA1UdDgQWBBSQr2o6lFoL2JDqElZz30O0Oija5zAOBgNVHQ8BAf8EBAMC -AYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwGwYD -VR0gBBQwEjAGBgRVHSAAMAgGBmeBDAECATBMBgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3JsLmNv -bW9kb2NhLmNvbS9DT01PRE9SU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDBxBggrBgEFBQcB -AQRlMGMwOwYIKwYBBQUHMAKGL2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9ET1JTQUFkZFRy -dXN0Q0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wDQYJKoZIhvcN -AQEMBQADggIBAE4rdk+SHGI2ibp3wScF9BzWRJ2pmj6q1WZmAT7qSeaiNbz69t2Vjpk1mA42GHWx -3d1Qcnyu3HeIzg/3kCDKo2cuH1Z/e+FE6kKVxF0NAVBGFfKBiVlsit2M8RKhjTpCipj4SzR7JzsI -tG8kO3KdY3RYPBpsP0/HEZrIqPW1N+8QRcZs2eBelSaz662jue5/DJpmNXMyYE7l3YphLG5SEXdo -ltMYdVEVABt0iN3hxzgEQyjpFv3ZBdRdRydg1vs4O2xyopT4Qhrf7W8GjEXCBgCq5Ojc2bXhc3js -9iPc0d1sjhqPpepUfJa3w/5Vjo1JXvxku88+vZbrac2/4EjxYoIQ5QxGV/Iz2tDIY+3GH5QFlkoa -kdH368+PUq4NCNk+qKBR6cGHdNXJ93SrLlP7u3r7l+L4HyaPs9Kg4DdbKDsx5Q5XLVq4rXmsXiBm -GqW5prU5wfWYQ//u+aen/e7KJD2AFsQXj4rBYKEMrltDR5FL1ZoXX/nUh8HCjLfn4g8wGTeGrODc -QgPmlKidrv0PJFGUzpII0fxQ8ANAe4hZ7Q7drNJ3gjTcBpUC2JD5Leo31Rpg0Gcg19hCC0Wvgmje -3WYkN5AplBlGGSW4gNfL1IYoakRwJiNiqZ+Gb7+6kHDSVneFeO/qJakXzlByjAA6quPbYzSf+AZx -AeKCINT+b72x ------END CERTIFICATE----- - ------BEGIN CERTIFICATE----- -MIIF2DCCA8CgAwIBAgIQTKr5yttjb+Af907YWwOGnTANBgkqhkiG9w0BAQwFADCBhTELMAkGA1UE -BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgG -A1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlv -biBBdXRob3JpdHkwHhcNMTAwMTE5MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMC -R0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UE -ChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBB -dXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCR6FSS0gpWsawNJN3Fz0Rn -dJkrN6N9I3AAcbxT38T6KhKPS38QVr2fcHK3YX/JSw8Xpz3jsARh7v8Rl8f0hj4K+j5c+ZPmNHrZ -FGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+ -5eNu/Nio5JIk2kNrYrhV/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pG -x8cgoLEfZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z+pUX -2nwzV0E8jVHtC7ZcryxjGt9XyD+86V3Em69FmeKjWiS0uqlWPc9vqv9JWL7wqP/0uK3pN/u6uPQL -OvnoQ0IeidiEyxPx2bvhiWC4jChWrBQdnArncevPDt09qZahSL0896+1DSJMwBGB7FY79tOi4lu3 -sgQiUpWAk2nojkxl8ZEDLXB0AuqLZxUpaVICu9ffUGpVRr+goyhhf3DQw6KqLCGqR84onAZFdr+C -GCe01a60y1Dma/RMhnEw6abfFobg2P9A3fvQQoh/ozM6LlweQRGBY84YcWsr7KaKtzFcOmpH4MN5 -WdYgGq/yapiqcrxXStJLnbsQ/LBMQeXtHT1eKJ2czL+zUdqnR+WEUwIDAQABo0IwQDAdBgNVHQ4E -FgQUu69+Aj36pvE8hI6t7jiY7NkyMtQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8w -DQYJKoZIhvcNAQEMBQADggIBAArx1UaEt65Ru2yyTUEUAJNMnMvlwFTPoCWOAvn9sKIN9SCYPBMt -rFaisNZ+EZLpLrqeLppysb0ZRGxhNaKatBYSaVqM4dc+pBroLwP0rmEdEBsqpIt6xf4FpuHA1sj+ -nq6PK7o9mfjYcwlYRm6mnPTXJ9OV2jeDchzTc+CiR5kDOF3VSXkAKRzH7JsgHAckaVd4sjn8OoSg -tZx8jb8uk2IntznaFxiuvTwJaP+EmzzV1gsD41eeFPfR60/IvYcjt7ZJQ3mFXLrrkguhxuhoqEwW -sRqZCuhTLJK7oQkYdQxlqHvLI7cawiiFwxv/0Cti76R7CZGYZ4wUAc1oBmpjIXUDgIiKboHGhfKp -pC3n9KUkEEeDys30jXlYsQab5xoq2Z0B15R97QNKyvDb6KkBPvVWmckejkk9u+UJueBPSZI9FoJA -zMxZxuY67RIuaTxslbH9qh17f4a+Hg4yRvv7E491f0yLS0Zj/gA0QHDBw7mh3aZw4gSzQbzpgJHq -ZJx64SIDqZxubw5lT2yHh17zbqD5daWbQOhTsiedSrnAdyGN/4fy3ryM7xfft0kL0fJuMAsaDk52 -7RH89elWsn2/x20Kk4yl0MC2Hb46TpSi125sC8KKfPog88Tk5c0NqMuRkrF8hey1FGlmDoLnzc7I -LaZRfyHBNVOFBkpdn627G190 ------END CERTIFICATE----- diff --git a/krebs/5pkgs/cac-api/default.nix b/krebs/5pkgs/cac-api/default.nix index 331b0853f..9ab6ac8b2 100644 --- a/krebs/5pkgs/cac-api/default.nix +++ b/krebs/5pkgs/cac-api/default.nix @@ -1,4 +1,4 @@ -{ stdenv, fetchgit, bc, coreutils, curl, dash, gnused, inotifyTools, jq, ncurses, openssh, sshpass, ... }: +{ stdenv, fetchgit, bc, cac-cert, coreutils, curl, dash, gnused, inotifyTools, jq, ncurses, openssh, sshpass, ... }: stdenv.mkDerivation { name = "cac-api-1.1.0"; @@ -34,7 +34,7 @@ stdenv.mkDerivation { # Unknown column 'iod.apitask.cid' in 'field list' sed ' /^\s*tasks \\$/d; # [1] - s|\<_cac_exec curl|<${./cac.pem} & --cacert /dev/stdin| + s|\<_cac_exec curl|<${cac-cert} & --cacert /dev/stdin| ' cac-api } > $out/bin/cac-api chmod +x $out/bin/cac-api diff --git a/krebs/5pkgs/cac-cert/cac.pem b/krebs/5pkgs/cac-cert/cac.pem new file mode 100644 index 000000000..9d02b6bcf --- /dev/null +++ b/krebs/5pkgs/cac-cert/cac.pem @@ -0,0 +1,88 @@ +-----BEGIN CERTIFICATE----- +MIIFWzCCBEOgAwIBAgIQXWIKGWRZf838+wW1zLdK0DANBgkqhkiG9w0BAQsFADCBkDELMAkGA1UE +BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgG +A1UEChMRQ09NT0RPIENBIExpbWl0ZWQxNjA0BgNVBAMTLUNPTU9ETyBSU0EgRG9tYWluIFZhbGlk +YXRpb24gU2VjdXJlIFNlcnZlciBDQTAeFw0xNTEwMjMwMDAwMDBaFw0xODEwMjIyMzU5NTlaMF8x +ITAfBgNVBAsTGERvbWFpbiBDb250cm9sIFZhbGlkYXRlZDEeMBwGA1UECxMVRXNzZW50aWFsU1NM +IFdpbGRjYXJkMRowGAYDVQQDDBEqLmNsb3VkYXRjb3N0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD +ggEPADCCAQoCggEBAM9CyL8uUPoE3zYbvnwtUW69h0f+rkND1/Jsi15EEBFPQqiYCmPiSaJLn6JB +Hri34t4lArGrPA6K01x18LJqFoYDy5ya37J8Bd4jF3cijWe/IQEWAw0r2ufhd4LTNMvEyJIECida +LMhBxpORRdijmvEXCf9D0OEGBV3qfizcCH7+VPordCY3y9fwgbk0wAB1lAk29aRosK3gZJceu57Q +YkEKjee6pZ473+xpCjaeTBUlPuGA95A2jPf8c+QSPegczOd9Hwo4JqAJSjTzzuHiSbEhd+8JIC/P +6GYVOvwnNqCPuuXsoBy8xBQ8lHuZcWd5sh4MDRvm5YxVFhYN6kOgf1ECAwEAAaOCAd8wggHbMB8G +A1UdIwQYMBaAFJCvajqUWgvYkOoSVnPfQ7Q6KNrnMB0GA1UdDgQWBBSC9dSGoIEPHBTUQJjOxxPg +lhRLPDAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYI +KwYBBQUHAwIwTwYDVR0gBEgwRjA6BgsrBgEEAbIxAQICBzArMCkGCCsGAQUFBwIBFh1odHRwczov +L3NlY3VyZS5jb21vZG8uY29tL0NQUzAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDov +L2NybC5jb21vZG9jYS5jb20vQ09NT0RPUlNBRG9tYWluVmFsaWRhdGlvblNlY3VyZVNlcnZlckNB +LmNybDCBhQYIKwYBBQUHAQEEeTB3ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LmNvbW9kb2NhLmNv +bS9DT01PRE9SU0FEb21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EuY3J0MCQGCCsGAQUFBzAB +hhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wLQYDVR0RBCYwJIIRKi5jbG91ZGF0Y29zdC5jb22C +D2Nsb3VkYXRjb3N0LmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAPfUXBGDYOQnJuykm8I9cB2rBFVvt +HgzKIM+SXRz/jRt4HN/fsQkq2mI8SUPigWbtrtL1yim0hHdTR4m6vn7eHqj8erjjEJy16OfyRwp8 +LfjjHvcPxAxiRcFdv+8Pu/o0umqtxmRn4enyAZWhqAp3TBjkJPkJgh/toJqGpE7dN1Jw1AF75rrA +DXS8J5fcJYZQydJce+kacMHLh4C0Q37NgZKPfM+9jsygqY3Fhqh5GIt/CXNx2vlDPQP87QEtK7y7 +dCGd/MwrdKkUvOpsmqWiO1+02DesZSdIow/YW+8cUhPvYMqpM9zKbqVdRj3FJK56+/xNfNX5tiU1 +1VE7rIcEbw== +-----END CERTIFICATE----- + +-----BEGIN CERTIFICATE----- +MIIGCDCCA/CgAwIBAgIQKy5u6tl1NmwUim7bo3yMBzANBgkqhkiG9w0BAQwFADCBhTELMAkGA1UE +BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgG +A1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlv +biBBdXRob3JpdHkwHhcNMTQwMjEyMDAwMDAwWhcNMjkwMjExMjM1OTU5WjCBkDELMAkGA1UEBhMC +R0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UE +ChMRQ09NT0RPIENBIExpbWl0ZWQxNjA0BgNVBAMTLUNPTU9ETyBSU0EgRG9tYWluIFZhbGlkYXRp +b24gU2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAI7CAhnh +oFmk6zg1jSz9AdDTScBkxwtiBUUWOqigwAwCfx3M28ShbXcDow+G+eMGnD4LgYqbSRutA776S9uM +IO3Vzl5ljj4Nr0zCsLdFXlIvNN5IJGS0Qa4Al/e+Z96e0HqnU4A7fK31llVvl0cKfIWLIpeNs4Tg +llfQcBhglo/uLQeTnaG6ytHNe+nEKpooIZFNb5JPJaXyejXdJtxGpdCsWTWM/06RQ1A/WZMebFEh +7lgUq/51UHg+TLAchhP6a5i84DuUHoVS3AOTJBhuyydRReZw3iVDpA3hSqXttn7IzW3uLh0nc13c +RTCAquOyQQuvvUSH2rnlG51/ruWFgqUCAwEAAaOCAWUwggFhMB8GA1UdIwQYMBaAFLuvfgI9+qbx +PISOre44mOzZMjLUMB0GA1UdDgQWBBSQr2o6lFoL2JDqElZz30O0Oija5zAOBgNVHQ8BAf8EBAMC +AYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwGwYD +VR0gBBQwEjAGBgRVHSAAMAgGBmeBDAECATBMBgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3JsLmNv +bW9kb2NhLmNvbS9DT01PRE9SU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDBxBggrBgEFBQcB +AQRlMGMwOwYIKwYBBQUHMAKGL2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9ET1JTQUFkZFRy +dXN0Q0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wDQYJKoZIhvcN +AQEMBQADggIBAE4rdk+SHGI2ibp3wScF9BzWRJ2pmj6q1WZmAT7qSeaiNbz69t2Vjpk1mA42GHWx +3d1Qcnyu3HeIzg/3kCDKo2cuH1Z/e+FE6kKVxF0NAVBGFfKBiVlsit2M8RKhjTpCipj4SzR7JzsI +tG8kO3KdY3RYPBpsP0/HEZrIqPW1N+8QRcZs2eBelSaz662jue5/DJpmNXMyYE7l3YphLG5SEXdo +ltMYdVEVABt0iN3hxzgEQyjpFv3ZBdRdRydg1vs4O2xyopT4Qhrf7W8GjEXCBgCq5Ojc2bXhc3js +9iPc0d1sjhqPpepUfJa3w/5Vjo1JXvxku88+vZbrac2/4EjxYoIQ5QxGV/Iz2tDIY+3GH5QFlkoa +kdH368+PUq4NCNk+qKBR6cGHdNXJ93SrLlP7u3r7l+L4HyaPs9Kg4DdbKDsx5Q5XLVq4rXmsXiBm +GqW5prU5wfWYQ//u+aen/e7KJD2AFsQXj4rBYKEMrltDR5FL1ZoXX/nUh8HCjLfn4g8wGTeGrODc +QgPmlKidrv0PJFGUzpII0fxQ8ANAe4hZ7Q7drNJ3gjTcBpUC2JD5Leo31Rpg0Gcg19hCC0Wvgmje +3WYkN5AplBlGGSW4gNfL1IYoakRwJiNiqZ+Gb7+6kHDSVneFeO/qJakXzlByjAA6quPbYzSf+AZx +AeKCINT+b72x +-----END CERTIFICATE----- + +-----BEGIN CERTIFICATE----- +MIIF2DCCA8CgAwIBAgIQTKr5yttjb+Af907YWwOGnTANBgkqhkiG9w0BAQwFADCBhTELMAkGA1UE +BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgG +A1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlv +biBBdXRob3JpdHkwHhcNMTAwMTE5MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMC +R0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UE +ChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBB +dXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCR6FSS0gpWsawNJN3Fz0Rn +dJkrN6N9I3AAcbxT38T6KhKPS38QVr2fcHK3YX/JSw8Xpz3jsARh7v8Rl8f0hj4K+j5c+ZPmNHrZ +FGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+ +5eNu/Nio5JIk2kNrYrhV/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pG +x8cgoLEfZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z+pUX +2nwzV0E8jVHtC7ZcryxjGt9XyD+86V3Em69FmeKjWiS0uqlWPc9vqv9JWL7wqP/0uK3pN/u6uPQL +OvnoQ0IeidiEyxPx2bvhiWC4jChWrBQdnArncevPDt09qZahSL0896+1DSJMwBGB7FY79tOi4lu3 +sgQiUpWAk2nojkxl8ZEDLXB0AuqLZxUpaVICu9ffUGpVRr+goyhhf3DQw6KqLCGqR84onAZFdr+C +GCe01a60y1Dma/RMhnEw6abfFobg2P9A3fvQQoh/ozM6LlweQRGBY84YcWsr7KaKtzFcOmpH4MN5 +WdYgGq/yapiqcrxXStJLnbsQ/LBMQeXtHT1eKJ2czL+zUdqnR+WEUwIDAQABo0IwQDAdBgNVHQ4E +FgQUu69+Aj36pvE8hI6t7jiY7NkyMtQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8w +DQYJKoZIhvcNAQEMBQADggIBAArx1UaEt65Ru2yyTUEUAJNMnMvlwFTPoCWOAvn9sKIN9SCYPBMt +rFaisNZ+EZLpLrqeLppysb0ZRGxhNaKatBYSaVqM4dc+pBroLwP0rmEdEBsqpIt6xf4FpuHA1sj+ +nq6PK7o9mfjYcwlYRm6mnPTXJ9OV2jeDchzTc+CiR5kDOF3VSXkAKRzH7JsgHAckaVd4sjn8OoSg +tZx8jb8uk2IntznaFxiuvTwJaP+EmzzV1gsD41eeFPfR60/IvYcjt7ZJQ3mFXLrrkguhxuhoqEwW +sRqZCuhTLJK7oQkYdQxlqHvLI7cawiiFwxv/0Cti76R7CZGYZ4wUAc1oBmpjIXUDgIiKboHGhfKp +pC3n9KUkEEeDys30jXlYsQab5xoq2Z0B15R97QNKyvDb6KkBPvVWmckejkk9u+UJueBPSZI9FoJA +zMxZxuY67RIuaTxslbH9qh17f4a+Hg4yRvv7E491f0yLS0Zj/gA0QHDBw7mh3aZw4gSzQbzpgJHq +ZJx64SIDqZxubw5lT2yHh17zbqD5daWbQOhTsiedSrnAdyGN/4fy3ryM7xfft0kL0fJuMAsaDk52 +7RH89elWsn2/x20Kk4yl0MC2Hb46TpSi125sC8KKfPog88Tk5c0NqMuRkrF8hey1FGlmDoLnzc7I +LaZRfyHBNVOFBkpdn627G190 +-----END CERTIFICATE----- diff --git a/krebs/5pkgs/test/infest-cac-centos7/default.nix b/krebs/5pkgs/test/infest-cac-centos7/default.nix index 7adb09ca9..3be4b1c41 100644 --- a/krebs/5pkgs/test/infest-cac-centos7/default.nix +++ b/krebs/5pkgs/test/infest-cac-centos7/default.nix @@ -1,4 +1,4 @@ -{ stdenv, coreutils,makeWrapper, cac-api, cac-panel, gnumake, gnused, jq, openssh, ... }: +{ stdenv, coreutils,makeWrapper, cac-api, cac-cert, cac-panel, gnumake, gnused, jq, openssh, ... }: stdenv.mkDerivation rec { name = "${shortname}-${version}"; @@ -10,6 +10,7 @@ stdenv.mkDerivation rec { phases = [ "installPhase" ]; + buildInputs = [ makeWrapper ]; path = stdenv.lib.makeSearchPath "bin" [ @@ -22,16 +23,15 @@ stdenv.mkDerivation rec { openssh ]; - installPhase = - '' - mkdir -p $out/bin - cp ${src} $out/bin/${shortname} - chmod +x $out/bin/${shortname} - wrapProgram $out/bin/${shortname} \ - --prefix PATH : ${path} \ - --set SSL_CERT_FILE ${./panel.cloudatcost.com.crt} \ - --set REQUESTS_CA_BUNDLE ${./panel.cloudatcost.com.crt} - ''; + installPhase = '' + mkdir -p $out/bin + cp ${src} $out/bin/${shortname} + chmod +x $out/bin/${shortname} + wrapProgram $out/bin/${shortname} \ + --prefix PATH : ${path} \ + --set REQUESTS_CA_BUNDLE ${cac-cert} \ + --set SSL_CERT_FILE ${cac-cert} + ''; meta = with stdenv.lib; { homepage = http://krebsco.de; description = "Krebs CI Scripts"; diff --git a/krebs/5pkgs/test/infest-cac-centos7/panel.cloudatcost.com.crt b/krebs/5pkgs/test/infest-cac-centos7/panel.cloudatcost.com.crt deleted file mode 100644 index 9d02b6bcf..000000000 --- a/krebs/5pkgs/test/infest-cac-centos7/panel.cloudatcost.com.crt +++ /dev/null @@ -1,88 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFWzCCBEOgAwIBAgIQXWIKGWRZf838+wW1zLdK0DANBgkqhkiG9w0BAQsFADCBkDELMAkGA1UE -BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgG -A1UEChMRQ09NT0RPIENBIExpbWl0ZWQxNjA0BgNVBAMTLUNPTU9ETyBSU0EgRG9tYWluIFZhbGlk -YXRpb24gU2VjdXJlIFNlcnZlciBDQTAeFw0xNTEwMjMwMDAwMDBaFw0xODEwMjIyMzU5NTlaMF8x -ITAfBgNVBAsTGERvbWFpbiBDb250cm9sIFZhbGlkYXRlZDEeMBwGA1UECxMVRXNzZW50aWFsU1NM -IFdpbGRjYXJkMRowGAYDVQQDDBEqLmNsb3VkYXRjb3N0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD -ggEPADCCAQoCggEBAM9CyL8uUPoE3zYbvnwtUW69h0f+rkND1/Jsi15EEBFPQqiYCmPiSaJLn6JB -Hri34t4lArGrPA6K01x18LJqFoYDy5ya37J8Bd4jF3cijWe/IQEWAw0r2ufhd4LTNMvEyJIECida -LMhBxpORRdijmvEXCf9D0OEGBV3qfizcCH7+VPordCY3y9fwgbk0wAB1lAk29aRosK3gZJceu57Q -YkEKjee6pZ473+xpCjaeTBUlPuGA95A2jPf8c+QSPegczOd9Hwo4JqAJSjTzzuHiSbEhd+8JIC/P -6GYVOvwnNqCPuuXsoBy8xBQ8lHuZcWd5sh4MDRvm5YxVFhYN6kOgf1ECAwEAAaOCAd8wggHbMB8G -A1UdIwQYMBaAFJCvajqUWgvYkOoSVnPfQ7Q6KNrnMB0GA1UdDgQWBBSC9dSGoIEPHBTUQJjOxxPg -lhRLPDAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYI -KwYBBQUHAwIwTwYDVR0gBEgwRjA6BgsrBgEEAbIxAQICBzArMCkGCCsGAQUFBwIBFh1odHRwczov -L3NlY3VyZS5jb21vZG8uY29tL0NQUzAIBgZngQwBAgEwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDov -L2NybC5jb21vZG9jYS5jb20vQ09NT0RPUlNBRG9tYWluVmFsaWRhdGlvblNlY3VyZVNlcnZlckNB -LmNybDCBhQYIKwYBBQUHAQEEeTB3ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LmNvbW9kb2NhLmNv -bS9DT01PRE9SU0FEb21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EuY3J0MCQGCCsGAQUFBzAB -hhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wLQYDVR0RBCYwJIIRKi5jbG91ZGF0Y29zdC5jb22C -D2Nsb3VkYXRjb3N0LmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAPfUXBGDYOQnJuykm8I9cB2rBFVvt -HgzKIM+SXRz/jRt4HN/fsQkq2mI8SUPigWbtrtL1yim0hHdTR4m6vn7eHqj8erjjEJy16OfyRwp8 -LfjjHvcPxAxiRcFdv+8Pu/o0umqtxmRn4enyAZWhqAp3TBjkJPkJgh/toJqGpE7dN1Jw1AF75rrA -DXS8J5fcJYZQydJce+kacMHLh4C0Q37NgZKPfM+9jsygqY3Fhqh5GIt/CXNx2vlDPQP87QEtK7y7 -dCGd/MwrdKkUvOpsmqWiO1+02DesZSdIow/YW+8cUhPvYMqpM9zKbqVdRj3FJK56+/xNfNX5tiU1 -1VE7rIcEbw== ------END CERTIFICATE----- - ------BEGIN CERTIFICATE----- -MIIGCDCCA/CgAwIBAgIQKy5u6tl1NmwUim7bo3yMBzANBgkqhkiG9w0BAQwFADCBhTELMAkGA1UE -BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgG -A1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlv -biBBdXRob3JpdHkwHhcNMTQwMjEyMDAwMDAwWhcNMjkwMjExMjM1OTU5WjCBkDELMAkGA1UEBhMC -R0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UE -ChMRQ09NT0RPIENBIExpbWl0ZWQxNjA0BgNVBAMTLUNPTU9ETyBSU0EgRG9tYWluIFZhbGlkYXRp -b24gU2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAI7CAhnh -oFmk6zg1jSz9AdDTScBkxwtiBUUWOqigwAwCfx3M28ShbXcDow+G+eMGnD4LgYqbSRutA776S9uM -IO3Vzl5ljj4Nr0zCsLdFXlIvNN5IJGS0Qa4Al/e+Z96e0HqnU4A7fK31llVvl0cKfIWLIpeNs4Tg -llfQcBhglo/uLQeTnaG6ytHNe+nEKpooIZFNb5JPJaXyejXdJtxGpdCsWTWM/06RQ1A/WZMebFEh -7lgUq/51UHg+TLAchhP6a5i84DuUHoVS3AOTJBhuyydRReZw3iVDpA3hSqXttn7IzW3uLh0nc13c -RTCAquOyQQuvvUSH2rnlG51/ruWFgqUCAwEAAaOCAWUwggFhMB8GA1UdIwQYMBaAFLuvfgI9+qbx -PISOre44mOzZMjLUMB0GA1UdDgQWBBSQr2o6lFoL2JDqElZz30O0Oija5zAOBgNVHQ8BAf8EBAMC -AYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwGwYD -VR0gBBQwEjAGBgRVHSAAMAgGBmeBDAECATBMBgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3JsLmNv -bW9kb2NhLmNvbS9DT01PRE9SU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDBxBggrBgEFBQcB -AQRlMGMwOwYIKwYBBQUHMAKGL2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9ET1JTQUFkZFRy -dXN0Q0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wDQYJKoZIhvcN -AQEMBQADggIBAE4rdk+SHGI2ibp3wScF9BzWRJ2pmj6q1WZmAT7qSeaiNbz69t2Vjpk1mA42GHWx -3d1Qcnyu3HeIzg/3kCDKo2cuH1Z/e+FE6kKVxF0NAVBGFfKBiVlsit2M8RKhjTpCipj4SzR7JzsI -tG8kO3KdY3RYPBpsP0/HEZrIqPW1N+8QRcZs2eBelSaz662jue5/DJpmNXMyYE7l3YphLG5SEXdo -ltMYdVEVABt0iN3hxzgEQyjpFv3ZBdRdRydg1vs4O2xyopT4Qhrf7W8GjEXCBgCq5Ojc2bXhc3js -9iPc0d1sjhqPpepUfJa3w/5Vjo1JXvxku88+vZbrac2/4EjxYoIQ5QxGV/Iz2tDIY+3GH5QFlkoa -kdH368+PUq4NCNk+qKBR6cGHdNXJ93SrLlP7u3r7l+L4HyaPs9Kg4DdbKDsx5Q5XLVq4rXmsXiBm -GqW5prU5wfWYQ//u+aen/e7KJD2AFsQXj4rBYKEMrltDR5FL1ZoXX/nUh8HCjLfn4g8wGTeGrODc -QgPmlKidrv0PJFGUzpII0fxQ8ANAe4hZ7Q7drNJ3gjTcBpUC2JD5Leo31Rpg0Gcg19hCC0Wvgmje -3WYkN5AplBlGGSW4gNfL1IYoakRwJiNiqZ+Gb7+6kHDSVneFeO/qJakXzlByjAA6quPbYzSf+AZx -AeKCINT+b72x ------END CERTIFICATE----- - ------BEGIN CERTIFICATE----- -MIIF2DCCA8CgAwIBAgIQTKr5yttjb+Af907YWwOGnTANBgkqhkiG9w0BAQwFADCBhTELMAkGA1UE -BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgG -A1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlv -biBBdXRob3JpdHkwHhcNMTAwMTE5MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMC -R0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UE -ChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBB -dXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCR6FSS0gpWsawNJN3Fz0Rn -dJkrN6N9I3AAcbxT38T6KhKPS38QVr2fcHK3YX/JSw8Xpz3jsARh7v8Rl8f0hj4K+j5c+ZPmNHrZ -FGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+ -5eNu/Nio5JIk2kNrYrhV/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pG -x8cgoLEfZd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z+pUX -2nwzV0E8jVHtC7ZcryxjGt9XyD+86V3Em69FmeKjWiS0uqlWPc9vqv9JWL7wqP/0uK3pN/u6uPQL -OvnoQ0IeidiEyxPx2bvhiWC4jChWrBQdnArncevPDt09qZahSL0896+1DSJMwBGB7FY79tOi4lu3 -sgQiUpWAk2nojkxl8ZEDLXB0AuqLZxUpaVICu9ffUGpVRr+goyhhf3DQw6KqLCGqR84onAZFdr+C -GCe01a60y1Dma/RMhnEw6abfFobg2P9A3fvQQoh/ozM6LlweQRGBY84YcWsr7KaKtzFcOmpH4MN5 -WdYgGq/yapiqcrxXStJLnbsQ/LBMQeXtHT1eKJ2czL+zUdqnR+WEUwIDAQABo0IwQDAdBgNVHQ4E -FgQUu69+Aj36pvE8hI6t7jiY7NkyMtQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8w -DQYJKoZIhvcNAQEMBQADggIBAArx1UaEt65Ru2yyTUEUAJNMnMvlwFTPoCWOAvn9sKIN9SCYPBMt -rFaisNZ+EZLpLrqeLppysb0ZRGxhNaKatBYSaVqM4dc+pBroLwP0rmEdEBsqpIt6xf4FpuHA1sj+ -nq6PK7o9mfjYcwlYRm6mnPTXJ9OV2jeDchzTc+CiR5kDOF3VSXkAKRzH7JsgHAckaVd4sjn8OoSg -tZx8jb8uk2IntznaFxiuvTwJaP+EmzzV1gsD41eeFPfR60/IvYcjt7ZJQ3mFXLrrkguhxuhoqEwW -sRqZCuhTLJK7oQkYdQxlqHvLI7cawiiFwxv/0Cti76R7CZGYZ4wUAc1oBmpjIXUDgIiKboHGhfKp -pC3n9KUkEEeDys30jXlYsQab5xoq2Z0B15R97QNKyvDb6KkBPvVWmckejkk9u+UJueBPSZI9FoJA -zMxZxuY67RIuaTxslbH9qh17f4a+Hg4yRvv7E491f0yLS0Zj/gA0QHDBw7mh3aZw4gSzQbzpgJHq -ZJx64SIDqZxubw5lT2yHh17zbqD5daWbQOhTsiedSrnAdyGN/4fy3ryM7xfft0kL0fJuMAsaDk52 -7RH89elWsn2/x20Kk4yl0MC2Hb46TpSi125sC8KKfPog88Tk5c0NqMuRkrF8hey1FGlmDoLnzc7I -LaZRfyHBNVOFBkpdn627G190 ------END CERTIFICATE----- -- cgit v1.2.3 From f7d979b21fc0a705105adbbc708645f94af6629c Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 4 Feb 2016 02:48:28 +0100 Subject: s 1 wolf: provide cgit mirror --- krebs/3modules/shared/default.nix | 1 + shared/1systems/wolf.nix | 1 + shared/2configs/cgit-mirror.nix | 41 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 43 insertions(+) create mode 100644 shared/2configs/cgit-mirror.nix diff --git a/krebs/3modules/shared/default.nix b/krebs/3modules/shared/default.nix index 518e46587..91d92857b 100644 --- a/krebs/3modules/shared/default.nix +++ b/krebs/3modules/shared/default.nix @@ -50,6 +50,7 @@ in { addrs6 = ["42:0:0:0:0:0:77:1"]; aliases = [ "wolf.retiolum" + "cgit.wolf.retiolum" ]; tinc.pubkey = '' -----BEGIN RSA PUBLIC KEY----- diff --git a/shared/1systems/wolf.nix b/shared/1systems/wolf.nix index 8cf5be71c..e45195487 100644 --- a/shared/1systems/wolf.nix +++ b/shared/1systems/wolf.nix @@ -12,6 +12,7 @@ in ../2configs/shack-nix-cacher.nix ../2configs/shack-drivedroid.nix ../2configs/buildbot-standalone.nix + ../2configs/cgit-mirror.nix # ../2configs/graphite.nix ]; # use your own binary cache, fallback use cache.nixos.org (which is used by diff --git a/shared/2configs/cgit-mirror.nix b/shared/2configs/cgit-mirror.nix new file mode 100644 index 000000000..5bcfc5818 --- /dev/null +++ b/shared/2configs/cgit-mirror.nix @@ -0,0 +1,41 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + rules = with git;[{ + # user = git-sync; + user = git-sync; + repo = [ stockholm-mirror ]; + perm = push ''refs/*'' [ non-fast-forward create delete merge ]; + }]; + + stockholm-mirror = { + public = true; + name = "stockholm-mirror"; + desc = "mirror for all stockholm branches"; + hooks = { + post-receive = pkgs.git-hooks.irc-announce { + nick = config.networking.hostName; + verbose = false; + channel = "#retiolum"; + server = "cd.retiolum"; + }; + }; + }; + + git-sync = { + name = "git-sync"; + mail = "spam@krebsco.de"; + # TODO put git-sync pubkey somewhere more appropriate + pubkey = ''ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzUuzyoAhMgJmsiaTVWNSXqcrZNTpKpv0nfFBOMcNXUWEbvfAq5eNpg5cX+P8eoYl6UQgfftbYi06flKK3yJdntxoZKLwJGgJt9NZr8yZTsiIfMG8XosvGNQtGPkBtpLusgmPpu7t2RQ9QrqumBvoUDGYEauKTslLwupp1QeyWKUGEhihn4CuqQKiPrz+9vbNd75XOfVZMggk3j4F7HScatmA+p1EQXWyq5Jj78jQN5ZIRnHjMQcIZ4DOz1U96atwSKMviI1xEZIODYfgoGjjiWYeEtKaLVPtSqtLRGI7l+RNouMfwHLdTWOJSlIdFncfPXC6R19hTll3UHeHLtqLP git-sync''; + }; + +in { + krebs.git = { + enable = true; + root-title = "Shared Repos"; + root-desc = "keep on krebsing"; + inherit rules; + repos.stockholm-mirror = stockholm-mirror; + }; +} -- cgit v1.2.3 From cc1a230fd2742b6ccadd0837d9cf569f246375aa Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 4 Feb 2016 02:55:28 +0100 Subject: k 5 test: cac -> cac-api, cacpanel -> cac-panel --- krebs/5pkgs/test/infest-cac-centos7/default.nix | 6 +++--- krebs/5pkgs/test/infest-cac-centos7/notes | 26 ++++++++++++------------- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/krebs/5pkgs/test/infest-cac-centos7/default.nix b/krebs/5pkgs/test/infest-cac-centos7/default.nix index 886e250e2..7adb09ca9 100644 --- a/krebs/5pkgs/test/infest-cac-centos7/default.nix +++ b/krebs/5pkgs/test/infest-cac-centos7/default.nix @@ -1,4 +1,4 @@ -{ stdenv, coreutils,makeWrapper, cac, cacpanel, gnumake, gnused, jq, openssh, ... }: +{ stdenv, coreutils,makeWrapper, cac-api, cac-panel, gnumake, gnused, jq, openssh, ... }: stdenv.mkDerivation rec { name = "${shortname}-${version}"; @@ -14,8 +14,8 @@ stdenv.mkDerivation rec { path = stdenv.lib.makeSearchPath "bin" [ coreutils - cac - cacpanel + cac-api + cac-panel gnumake gnused jq diff --git a/krebs/5pkgs/test/infest-cac-centos7/notes b/krebs/5pkgs/test/infest-cac-centos7/notes index 6bfb6906e..793ef3560 100755 --- a/krebs/5pkgs/test/infest-cac-centos7/notes +++ b/krebs/5pkgs/test/infest-cac-centos7/notes @@ -1,6 +1,6 @@ #! /bin/sh -# nix-shell -p gnumake jq openssh cac cacpanel +# nix-shell -p gnumake jq openssh cac-api cac-panel set -eufx # 2 secrets are required: @@ -40,22 +40,22 @@ defer "rm -r $krebs_secrets" cat > $sec_file <&1) + out=$(cac-api build cpu=1 ram=512 storage=10 os=26 2>&1) if name=$(echo "$out" | jq -r .servername);then id=servername:$name echo "got a working machine, id=$id" @@ -87,7 +87,7 @@ while true;do # die on timeout if ! wait_login_cac $id;then echo "unable to boot a working system within time frame, retrying..." >&2 - echo "Cleaning up old image,last status: $(cac update;cac getserver $id | jq -r .status)" + echo "Cleaning up old image,last status: $(cac-api update;cac-api getserver $id | jq -r .status)" eval "$(clear_defer | sed 's/;exit//')" sleep 15 else @@ -96,17 +96,17 @@ while true;do fi done clear_defer >/dev/null -defer "cac delete $id;$old_trapstr" +defer "cac-api delete $id;$old_trapstr" mkdir -p shared/2configs/temp -cac generatenetworking $id > \ +cac-api generatenetworking $id > \ shared/2configs/temp/networking.nix # new temporary ssh key we will use to log in after infest ssh-keygen -f $krebs_ssh -N "" cp $retiolum_key $krebs_secrets/retiolum.rsa_key.priv # we override the directories for secrets and stockholm # additionally we set the ssh key we generated -ip=$(cac getserver $id | jq -r .ip) +ip=$(cac-api getserver $id | jq -r .ip) cat > shared/2configs/temp/dirs.nix < $krebs_secrets/infest sh -x $krebs_secrets/infest # TODO: generate secrets directory $krebs_secrets for nix import -cac powerop $id reset +cac-api powerop $id reset wait_login(){ # timeout -- cgit v1.2.3 From fb734eded558aad5a728eb1b1b350235a921d541 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 03:07:47 +0100 Subject: stockholm: stockholm-path -> ./. --- default.nix | 3 +-- tv/2configs/default.nix | 11 +++++------ 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/default.nix b/default.nix index 1637aa464..b2b57ea4c 100644 --- a/default.nix +++ b/default.nix @@ -17,8 +17,7 @@ let stockholm = { nlib = import ; klib = import (slib.kpath "4lib") { lib = nlib; }; slib = rec { - stockholm-path = ./.; - nspath = ns: p: stockholm-path + "/${ns}/${p}"; + nspath = ns: p: ./. + "/${ns}/${p}"; kpath = nspath "krebs"; upath = nspath current-user-name; }; diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index ee1d9521d..46320b738 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -10,14 +10,13 @@ with lib; target = mkDefault "root@${config.krebs.build.host.name}"; source-version = 2; source = mapAttrs (_: mkDefault) ({ - nixos-config = "symlink:stockholm-private/1systems/${config.krebs.build.host.name}.nix"; - nixpkgs = symlink:stockholm-nixpkgs; - null = "/home/tv/stockholm/null"; + nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix"; + nixpkgs = symlink:stockholm/nixpkgs; + null = "symlink:stockholm/null"; secrets = "/home/tv/secrets/${config.krebs.build.host.name}"; secrets-common = "/home/tv/secrets/common"; - stockholm-krebs = "/home/tv/stockholm/krebs"; - stockholm-nixpkgs = "/home/tv/stockholm/nixpkgs"; - stockholm-private = "/home/tv/stockholm/tv"; + stockholm = "/home/tv/stockholm"; + stockholm-user = "symlink:stockholm/tv"; upstream-nixpkgs = { url = https://github.com/NixOS/nixpkgs; rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; -- cgit v1.2.3 From db0e7dfe82fbed065afb16f41b46900767d69a96 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 04:23:10 +0100 Subject: cac-cert: add default.nix --- krebs/5pkgs/cac-cert/default.nix | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 krebs/5pkgs/cac-cert/default.nix diff --git a/krebs/5pkgs/cac-cert/default.nix b/krebs/5pkgs/cac-cert/default.nix new file mode 100644 index 000000000..d99019dca --- /dev/null +++ b/krebs/5pkgs/cac-cert/default.nix @@ -0,0 +1,2 @@ +{ writeText, ... }: +writeText "cac.pem" (builtins.readFile ./cac.pem) -- cgit v1.2.3 From 8e3d27a9499bb70d5d033e4fd007aa53dea70b18 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 04:35:39 +0100 Subject: stockholm: add slib.npath --- default.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/default.nix b/default.nix index b2b57ea4c..9dd18a235 100644 --- a/default.nix +++ b/default.nix @@ -14,12 +14,12 @@ let stockholm = { krebs = import ./krebs (args // { inherit lib stockholm; }); lib = let - nlib = import ; + nlib = import (slib.npath "lib"); klib = import (slib.kpath "4lib") { lib = nlib; }; slib = rec { - nspath = ns: p: ./. + "/${ns}/${p}"; - kpath = nspath "krebs"; - upath = nspath current-user-name; + npath = p: + "/${p}"; + kpath = p: ./. + "/krebs/${p}"; + upath = p: ./. + "/${current-user-name}/${p}"; }; ulib = let p = slib.upath "4lib"; in nlib.optionalAttrs (klib.dir.has-default-nix p) @@ -44,7 +44,7 @@ let stockholm = { in kpkgs // upkgs; }; - eval = config: import { + eval = config: import (lib.npath "nixos/lib/eval-config.nix") { specialArgs = { inherit lib; }; -- cgit v1.2.3 From 65977c6108d9517d58a6bd6ce8676c6a7b97615e Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 04:44:26 +0100 Subject: RIP current-date --- Makefile | 1 - default.nix | 3 +-- krebs/default.nix | 9 +-------- shared/2configs/buildbot-standalone.nix | 2 -- 4 files changed, 2 insertions(+), 13 deletions(-) diff --git a/Makefile b/Makefile index 501dfbe83..a1559b48c 100644 --- a/Makefile +++ b/Makefile @@ -42,7 +42,6 @@ endif -A "$$get" \ -I stockholm="$$PWD" \ '' \ - --argstr current-date "$$(date -Is)" \ --argstr current-host-name "$$HOSTNAME" \ --argstr current-user-name "$$LOGNAME" \ $${system+--argstr system "$$system"} \ diff --git a/default.nix b/default.nix index 9dd18a235..4a5e4ea2c 100644 --- a/default.nix +++ b/default.nix @@ -1,5 +1,4 @@ -{ current-date ? abort "current-date not defined" -, current-host-name ? abort "current-host-name not defined" +{ current-host-name ? abort "current-host-name not defined" , current-user-name ? builtins.getEnv "LOGNAME" , StrictHostKeyChecking ? "yes" }@args: diff --git a/krebs/default.nix b/krebs/default.nix index df2d95483..e9ee71b34 100644 --- a/krebs/default.nix +++ b/krebs/default.nix @@ -1,5 +1,4 @@ -{ current-date -, current-host-name +{ current-host-name , current-user-name , lib , stockholm @@ -21,7 +20,6 @@ let out = { config = get-config system; in '' #! /bin/sh - # ${current-date} ${current-user-name}@${current-host-name} # krebs.deploy set -efu (${populate args}) @@ -39,7 +37,6 @@ let out = { config = get-config system; in '' #! /bin/sh - # ${current-date} ${current-user-name}@${current-host-name} # krebs.infest set -efu @@ -64,7 +61,6 @@ let out = { config = get-config system; in '' #! /bin/sh - # ${current-date} ${current-user-name}@${current-host-name} # krebs.init set -efu @@ -100,7 +96,6 @@ let out = { }@args: let in '' #! /bin/sh - # ${current-date} ${current-user-name}@${current-host-name} # krebs.nixos-install (${populate (args // { root = "/mnt"; })}) @@ -196,7 +191,6 @@ let out = { nix-env \ --show-trace \ -f '' \ - --argstr current-date ${lib.shell.escape current-date} \ --argstr current-host-name ${lib.shell.escape current-host-name} \ --argstr current-user-name ${lib.shell.escape current-user-name} \ --profile ${lib.shell.escape config.krebs.build.profile} \ @@ -216,7 +210,6 @@ let out = { }@args: let out = '' #! /bin/sh - # ${current-date} ${current-user-name}@${current-host-name} set -efu ${lib.concatStringsSep "\n" (lib.concatMap diff --git a/shared/2configs/buildbot-standalone.nix b/shared/2configs/buildbot-standalone.nix index c614bd3c1..9982dd915 100644 --- a/shared/2configs/buildbot-standalone.nix +++ b/shared/2configs/buildbot-standalone.nix @@ -86,7 +86,6 @@ -I stockholm=. \ --show-trace \ -I secrets=. '' \ - --argstr current-date lol \ --argstr current-user-name shared \ --argstr current-host-name lol \ --strict --json"]) @@ -98,7 +97,6 @@ -I stockholm=. \ -I secrets=. '' \ --show-trace \ - --argstr current-date lol \ --argstr current-user-name shared \ --argstr current-host-name lol \ --strict --json"]) -- cgit v1.2.3 From 89d6f319d0909b127a603fd825e3a1143b14260b Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 04:47:58 +0100 Subject: stockholm: guess current-{host,user}-name harder --- default.nix | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/default.nix b/default.nix index 4a5e4ea2c..656a7f4b3 100644 --- a/default.nix +++ b/default.nix @@ -1,5 +1,9 @@ -{ current-host-name ? abort "current-host-name not defined" -, current-user-name ? builtins.getEnv "LOGNAME" +{ current-host-name ? + let v = builtins.getEnv "HOSTNAME"; in + if v != "" then v else builtins.readFile /proc/sys/kernel/hostname +, current-user-name ? + let v = builtins.getEnv "LOGNAME"; in + if v != "" then v else abort "undefined variable: LOGNAME" , StrictHostKeyChecking ? "yes" }@args: -- cgit v1.2.3 From b857a48632128be0324c68be95bee16fb0f1b15f Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 05:40:26 +0100 Subject: krebs.build.populate: init and drop support for v1 --- Makefile | 108 ++++++++--------------- default.nix | 16 +++- krebs/3modules/build.nix | 218 +++++++++++++++++++++++++++++++--------------- krebs/default.nix | 95 +------------------- krebs/v2/default.nix | 132 ---------------------------- nixpkgs/krebs | 0 nixpkgs/nixos/default.nix | 66 +------------- nixpkgs/nixos/lib | 2 +- nixpkgs/nixos/modules | 2 +- root | 1 + tv/2configs/default.nix | 4 +- 11 files changed, 203 insertions(+), 441 deletions(-) delete mode 100644 krebs/v2/default.nix create mode 100644 nixpkgs/krebs create mode 120000 root diff --git a/Makefile b/Makefile index a1559b48c..87a636e72 100644 --- a/Makefile +++ b/Makefile @@ -1,87 +1,51 @@ -# -# usage: -# make infest system=foo [target=bar] -# make [deploy] system=foo [target=bar] -# make [deploy] systems='foo bar' -# make eval get=users.tv.wu.config.time.timeZone [filter=json] -# - .ONESHELL: .SHELLFLAGS := -eufc -ifdef systems -$(systems): - @ - unset target - parallel \ - --line-buffer \ - -j0 \ - --no-notice \ - --tagstring {} \ - -q make -s systems= system={} ::: $(systems) -else ifdef system -.PHONY: deploy infest -deploy infest:;@ - export get=krebs.$@ - export filter=json - script=$$(make -s eval) - echo "$$script" | sh - -.PHONY: eval -eval: - @ -ifeq ($(filter),json) - extraArgs='--json --strict' - filter() { jq -r .; } -else - filter() { cat; } +ifndef system +$(error unbound variable: system) endif - result=$$(nix-instantiate \ - $${extraArgs-} \ - --eval \ - -A "$$get" \ - -I stockholm="$$PWD" \ - '' \ - --argstr current-host-name "$$HOSTNAME" \ - --argstr current-user-name "$$LOGNAME" \ - $${system+--argstr system "$$system"} \ - $${target+--argstr target "$$target"}) - echo "$$result" | filter export target_host ?= $(system) export target_user ?= root export target_path ?= /var/src +# usage: make deploy system=foo [target_host=bar] +.PHONY: deploy +deploy: populate ;@set -x + ssh "$$target_user@$$target_host" nixos-rebuild switch -I "$$target_path" + # usage: make populate system=foo [target_host=bar] .PHONY: populate -populate: export lib = \ - let nlib = import ; in \ - nlib // import krebs/4lib { lib = nlib; } // builtins -populate: export source = \ - with builtins; \ - with (import ./. {}).users.$${getEnv "LOGNAME"}.$${getEnv "system"}; \ - assert config.krebs.build.source-version == 2; \ - config.krebs.build.source populate:;@ - result=$$(nix-instantiate \ - --eval \ - --json \ - --arg lib "$$lib" \ - --arg source "$$source" \ - --argstr target-user "$$target_user" \ - --argstr target-host "$$target_host" \ - --argstr target-path "$$target_path" \ - -A populate \ - krebs/v2) - script=$$(echo "$$result" | jq -r .) - echo "$$script" | sh - -# usage: make rebuild system=foo [target_host=bar] [operation=switch] -.PHONY: rebuild -rebuild: populate ;@set -x - ssh "$$target_user@$$target_host" \ - nixos-rebuild "$${operation-switch}" -I "$$target_path" + result=$$(make -s eval get=config.krebs.build.populate filter=json) + echo "$$result" | sh +# usage: make eval system=foo get=config.krebs.build [LOGNAME=tv] [filter=json] +.PHONY: eval +eval:;@ +ifeq ($(filter),json) + extraArgs='--json --strict' + filter() { echo "$$1" | jq -r .; } else -$(error unbound variable: system[s]) + filter() { echo "$$1"; } endif + result=$$(nix-instantiate \ + $${extraArgs-} \ + --show-trace \ + --readonly-mode \ + --eval \ + -A "$$get" \ + --arg configuration "") + filter "$$result" + +## usage: make install system=foo target= +#.PHONY: install +#install: ssh = ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null +#install:;@set -x +# $(ssh) "$$target_user@$$target_host" \ +# env target_path=/var/src \ +# sh -s prepare < krebs/4lib/infest/prepare.sh +# make -s populate target_path=/mnt"$$target_path" +# $(ssh) "$$target_user@$$target_host" \ +# env NIXOS_CONFIG=/var/src/nixos-config \ +# nixos-install diff --git a/default.nix b/default.nix index 656a7f4b3..278f1d14d 100644 --- a/default.nix +++ b/default.nix @@ -1,9 +1,15 @@ -{ current-host-name ? +{ configuration ? import (nixpkgs-path + "/nixos/lib/from-env.nix") "NIXOS_CONFIG" +, system ? builtins.currentSystem +, current-host-name ? let v = builtins.getEnv "HOSTNAME"; in if v != "" then v else builtins.readFile /proc/sys/kernel/hostname , current-user-name ? let v = builtins.getEnv "LOGNAME"; in if v != "" then v else abort "undefined variable: LOGNAME" +, nixpkgs-path ? + if (builtins.tryEval ).success + then + else , StrictHostKeyChecking ? "yes" }@args: @@ -11,7 +17,8 @@ let stockholm = { inherit krebs; inherit users; inherit lib; - inherit pkgs; + inherit config options pkgs; + system = config.system.build.toplevel; }; krebs = import ./krebs (args // { inherit lib stockholm; }); @@ -20,7 +27,7 @@ let stockholm = { nlib = import (slib.npath "lib"); klib = import (slib.kpath "4lib") { lib = nlib; }; slib = rec { - npath = p: + "/${p}"; + npath = p: nixpkgs-path + "/${p}"; kpath = p: ./. + "/krebs/${p}"; upath = p: ./. + "/${current-user-name}/${p}"; }; @@ -29,7 +36,7 @@ let stockholm = { (import p { lib = nlib // klib; }); in nlib // klib // slib // ulib // builtins; - inherit (eval {}) pkgs; + inherit (eval configuration) config options pkgs; base-module = { config, ... }: { imports = builtins.filter lib.dir.has-default-nix (lib.concatLists [ @@ -48,6 +55,7 @@ let stockholm = { }; eval = config: import (lib.npath "nixos/lib/eval-config.nix") { + inherit system; specialArgs = { inherit lib; }; diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix index 0f8aec89d..00142acdd 100644 --- a/krebs/3modules/build.nix +++ b/krebs/3modules/build.nix @@ -28,81 +28,157 @@ let type = types.user; }; - options.krebs.build.source-version = mkOption { - type = types.enum [ 1 2 ]; - default = 1; + options.krebs.build.source = let + raw = types.either types.str types.path; + url = types.submodule { + options = { + url = mkOption { + type = types.str; + }; + rev = mkOption { + type = types.str; + }; + dev = mkOption { + type = types.str; + }; + }; + }; + in mkOption { + type = types.attrsOf (types.either types.str url); + apply = let f = mapAttrs (_: value: { + string = value; + path = toString value; + set = f value; + }.${typeOf value}); in f; + default = {}; }; - options.krebs.build.source = getAttr "v${toString config.krebs.build.source-version}" { - v1 = { - dir = mkOption { - type = let - default-host = config.krebs.current.host; - in types.attrsOf (types.submodule ({ config, ... }: { - options = { - host = mkOption { - type = types.host; - default = default-host; - }; - path = mkOption { - type = types.str; - }; - target-path = mkOption { - type = types.str; - default = "/root/${config._module.args.name}"; - }; - url = mkOption { - type = types.str; - default = "file://${config.host.name}${config.path}"; - }; - }; - })); - default = {}; - }; + options.krebs.build.populate = mkOption { + type = types.str; + default = let + source = config.krebs.build.source; + target-user = maybeEnv "target_user" "root"; + target-host = maybeEnv "target_host" config.krebs.build.host.name; + target-path = maybeEnv "target_path" "/var/src"; + out = '' + #! /bin/sh + set -eu - git = mkOption { - type = with types; attrsOf (submodule ({ config, ... }: { - options = { - url = mkOption { - type = types.str; # TODO must be shell safe - }; - rev = mkOption { - type = types.str; - }; - target-path = mkOption { - type = types.str; - default = "/root/${config._module.args.name}"; - }; - }; - })); - default = {}; - }; - }; + verbose() { + printf '+%s\n' "$(printf ' %q' "$@")" >&2 + "$@" + } - v2 = let - raw = types.either types.str types.path; - url = types.submodule { - options = { - url = mkOption { - type = types.str; - }; - rev = mkOption { - type = types.str; - }; - dev = mkOption { - type = types.str; - }; - }; - }; - in mkOption { - type = types.attrsOf (types.either types.str url); - apply = let f = mapAttrs (_: value: { - string = value; - path = toString value; - set = f value; - }.${typeOf value}); in f; - default = {}; - }; + echo ${shell.escape git-script} \ + | ssh ${shell.escape "${target-user}@${target-host}"} -T + + unset tmpdir + trap ' + rm "$tmpdir"/* + rmdir "$tmpdir" + trap - EXIT INT QUIT + ' EXIT INT QUIT + tmpdir=$(mktemp -dt stockholm.XXXXXXXX) + chmod 0755 "$tmpdir" + + ${concatStringsSep "\n" + (mapAttrsToList + (name: spec: let dst = removePrefix "symlink:" (get-url spec); in + "verbose ln -s ${shell.escape dst} $tmpdir/${shell.escape name}") + symlink-specs)} + + verbose proot \ + -b $tmpdir:${shell.escape target-path} \ + ${concatStringsSep " \\\n " + (mapAttrsToList + (name: spec: + "-b ${shell.escape "${get-url spec}:${target-path}/${name}"}") + file-specs)} \ + rsync \ + -f ${shell.escape "P /*"} \ + ${concatMapStringsSep " \\\n " + (name: "-f ${shell.escape "R /${name}"}") + (attrNames file-specs)} \ + --delete \ + -vFrlptD \ + ${shell.escape target-path}/ \ + ${shell.escape "${target-user}@${target-host}:${target-path}"} + ''; + + get-schema = uri: + if substring 0 1 uri == "/" + then "file" + else head (splitString ":" uri); + + has-schema = schema: uri: get-schema uri == schema; + + get-url = spec: { + string = spec; + path = toString spec; + set = get-url spec.url; + }.${typeOf spec}; + + git-specs = + filterAttrs (_: spec: has-schema "https" (get-url spec)) source // + filterAttrs (_: spec: has-schema "http" (get-url spec)) source // + filterAttrs (_: spec: has-schema "git" (get-url spec)) source; + + file-specs = + filterAttrs (_: spec: has-schema "file" (get-url spec)) source; + + symlink-specs = + filterAttrs (_: spec: has-schema "symlink" (get-url spec)) source; + + git-script = '' + #! /bin/sh + set -efu + + verbose() { + printf '+%s\n' "$(printf ' %q' "$@")" >&2 + "$@" + } + + fetch_git() {( + dst_dir=$1 + src_url=$2 + src_ref=$3 + + if ! test -e "$dst_dir"; then + git clone "$src_url" "$dst_dir" + fi + + cd "$dst_dir" + + if ! url=$(git config remote.origin.url); then + git remote add origin "$src_url" + elif test "$url" != "$src_url"; then + git remote set-url origin "$src_url" + fi + + # TODO resolve src_ref to commit hash + hash=$src_ref + + if ! test "$(git log --format=%H -1)" = "$hash"; then + git fetch origin + git checkout "$hash" -- "$dst_dir" + git checkout "$hash" + fi + + git clean -dxf + )} + + ${concatStringsSep "\n" + (mapAttrsToList + (name: spec: toString (map shell.escape [ + "verbose" + "fetch_git" + "${target-path}/${name}" + spec.url + spec.rev + ])) + git-specs)} + ''; + in out; }; }; diff --git a/krebs/default.nix b/krebs/default.nix index e9ee71b34..17c035896 100644 --- a/krebs/default.nix +++ b/krebs/default.nix @@ -1,3 +1,5 @@ +assert false; + { current-host-name , current-user-name , lib @@ -6,30 +8,11 @@ }: let out = { - inherit deploy; inherit infest; inherit init; inherit nixos-install; - inherit populate; }; - deploy = - { system ? current-host-name - , target ? system - }@args: let - config = get-config system; - in '' - #! /bin/sh - # krebs.deploy - set -efu - (${populate args}) - ${rootssh target '' - ${nix-install args} - ${config.krebs.build.profile}/bin/switch-to-configuration switch - ''} - echo OK - ''; - infest = { system ? current-host-name , target ? system @@ -45,9 +28,6 @@ let out = { ${builtins.readFile ./4lib/infest/install-nix.sh} ''} - # Prepare target source via bind-mounting - - (${nixos-install args}) ${rootssh target '' @@ -169,9 +149,7 @@ let out = { get-config = system: let config = stockholm.users.${current-user-name}.${system}.config or (abort "unknown system: ${system}, user: ${current-user-name}"); - in - assert config.krebs.build.source-version == 1; - config; + in config; nix-install = { system ? current-host-name @@ -203,73 +181,6 @@ let out = { ])} ''; - populate = - { system ? current-host-name - , target ? system - , root ? "" - }@args: - let out = '' - #! /bin/sh - set -efu - ${lib.concatStringsSep "\n" - (lib.concatMap - (type: lib.mapAttrsToList (_: methods.${type}) - config.krebs.build.source.${type}) - ["dir" "git"])} - ''; - - - config = get-config system; - - current-host = config.krebs.hosts.${current-host-name}; - current-user = config.krebs.users.${current-user-name}; - - methods.dir = config: - let - can-push = config.host.name == current-host.name; - target-path = root + config.target-path; - push-method = '' - rsync \ - --exclude .git \ - --exclude .graveyard \ - --exclude old \ - --exclude tmp \ - --rsync-path='mkdir -p ${target-path} && rsync' \ - --delete-excluded \ - -vrlptD \ - ${config.path}/ \ - root@${target}:${target-path} - ''; - in - if can-push then push-method else - let dir = "file://${config.host.name}${config.path}"; in - # /!\ revise this message when using more than just push-method - throw "No way to push ${dir} from ${current-host.name} to ${target}"; - - methods.git = config: - let target-path = root + config.target-path; - in rootssh target '' - mkdir -p ${target-path} - cd ${target-path} - if ! test -e .git; then - git init - fi - if ! cur_url=$(git config remote.origin.url 2>/dev/null); then - git remote add origin ${config.url} - elif test "$cur_url" != ${config.url}; then - git remote set-url origin ${config.url} - fi - if test "$(git rev-parse --verify HEAD 2>/dev/null)" != ${config.rev}; then - git fetch origin - git checkout ${config.rev} -- . - git checkout -q ${config.rev} - git submodule init - git submodule update - fi - git clean -dxf - ''; - in out; - rootssh = target: script: let flags = "-o StrictHostKeyChecking=${StrictHostKeyChecking}"; diff --git a/krebs/v2/default.nix b/krebs/v2/default.nix deleted file mode 100644 index cba7a75ff..000000000 --- a/krebs/v2/default.nix +++ /dev/null @@ -1,132 +0,0 @@ -{ lib -, source -, target-user ? "root" -, target-host -, target-path ? "/var/src" -}: -with lib; -let - out = { - inherit populate; - }; - - populate = '' - #! /bin/sh - set -eu - - verbose() { - printf '+%s\n' "$(printf ' %q' "$@")" >&2 - "$@" - } - - echo ${shell.escape git-script} \ - | ssh ${shell.escape "${target-user}@${target-host}"} -T - - unset tmpdir - trap ' - rm "$tmpdir"/* - rmdir "$tmpdir" - trap - EXIT INT QUIT - ' EXIT INT QUIT - tmpdir=$(mktemp -dt stockholm.XXXXXXXX) - chmod 0755 "$tmpdir" - - ${concatStringsSep "\n" - (mapAttrsToList - (name: spec: let dst = removePrefix "symlink:" (get-url spec); in - "verbose ln -s ${shell.escape dst} $tmpdir/${shell.escape name}") - symlink-specs)} - - verbose proot \ - -b $tmpdir:${shell.escape target-path} \ - ${concatStringsSep " \\\n " - (mapAttrsToList - (name: spec: - "-b ${shell.escape "${get-url spec}:${target-path}/${name}"}") - file-specs)} \ - rsync \ - -f ${shell.escape "P /*"} \ - ${concatMapStringsSep " \\\n " - (name: "-f ${shell.escape "R /${name}"}") - (attrNames file-specs)} \ - --delete \ - -vFrlptD \ - ${shell.escape target-path}/ \ - ${shell.escape "${target-user}@${target-host}:${target-path}"} - ''; - - get-schema = uri: - if substring 0 1 uri == "/" - then "file" - else head (splitString ":" uri); - - has-schema = schema: uri: get-schema uri == schema; - - get-url = spec: { - string = spec; - path = toString spec; - set = get-url spec.url; - }.${typeOf spec}; - - git-specs = - filterAttrs (_: spec: has-schema "https" (get-url spec)) source // - filterAttrs (_: spec: has-schema "http" (get-url spec)) source // - filterAttrs (_: spec: has-schema "git" (get-url spec)) source; - - file-specs = - filterAttrs (_: spec: has-schema "file" (get-url spec)) source; - - symlink-specs = - filterAttrs (_: spec: has-schema "symlink" (get-url spec)) source; - - git-script = '' - #! /bin/sh - set -efu - - verbose() { - printf '+%s\n' "$(printf ' %q' "$@")" >&2 - "$@" - } - - fetch_git() {( - dst_dir=$1 - src_url=$2 - src_ref=$3 - - if ! test -e "$dst_dir"; then - git clone "$src_url" "$dst_dir" - fi - - cd "$dst_dir" - - if ! url=$(git config remote.origin.url); then - git remote add origin "$src_url" - elif test "$url" != "$src_url"; then - git remote set-url origin "$src_url" - fi - - # TODO resolve src_ref to commit hash - hash=$src_ref - - if ! test "$(git log --format=%H -1)" = "$hash"; then - git fetch origin - git checkout "$hash" -- "$dst_dir" - git checkout "$hash" - fi - - git clean -dxf - )} - - ${concatStringsSep "\n" - (mapAttrsToList - (name: spec: toString (map shell.escape [ - "verbose" - "fetch_git" - "${target-path}/${name}" - spec.url - spec.rev - ])) - git-specs)} - ''; - -in out diff --git a/nixpkgs/krebs b/nixpkgs/krebs new file mode 100644 index 000000000..e69de29bb diff --git a/nixpkgs/nixos/default.nix b/nixpkgs/nixos/default.nix index 6c5adf365..4fe08efd2 100644 --- a/nixpkgs/nixos/default.nix +++ b/nixpkgs/nixos/default.nix @@ -1,65 +1 @@ -{ configuration ? import "NIXOS_CONFIG" -, system ? builtins.currentSystem -}: - -let - eval-config = modules: import { - inherit system; - modules = modules ++ [({ config, lib, ... }: with lib; { - imports = filter dir.has-default-nix (concatLists [ - (map (p: p + "/2configs") [ ]) - (map (p: p + "/3modules") [ ]) - ]); - - krebs.current = { - enable = true; - host = config.krebs.hosts.${readFile /proc/sys/kernel/hostname}; - user = config.krebs.users.${getEnv "LOGNAME"}; - }; - - nixpkgs.config.packageOverrides = pkgs: let - kpkgs = import { inherit lib pkgs; }; - upkgs = import { inherit lib; pkgs = pkgs // kpkgs; }; - in kpkgs // upkgs; - })]; - specialArgs = { - lib = let - nlib = import // builtins; - klib = nlib // import { lib = nlib; }; - ulib = klib // (with klib; let p = + "/4lib"; in - optionalAttrs (dir.has-default-nix p) - (import p { lib = klib; })); - in ulib; - }; - }; - - eval = eval-config [ - configuration - ]; - - # This is for `nixos-rebuild build-vm'. - vm = eval-config [ - configuration - - ]; - - # This is for `nixos-rebuild build-vm-with-bootloader'. - vm-with-bootloader = eval-config [ - configuration - - { virtualisation.useBootLoader = true; } - ]; -in - -{ - inherit (eval) config options; - - system = eval.config.system.build.toplevel; - - vm = vm.config.system.build.vm; - - vmWithBootLoader = vm-with-bootloader.config.system.build.vm; - - # The following are used by nixos-rebuild. - nixFallback = eval.pkgs.nixUnstable; -} +import diff --git a/nixpkgs/nixos/lib b/nixpkgs/nixos/lib index eb942f88b..9e69d1a67 120000 --- a/nixpkgs/nixos/lib +++ b/nixpkgs/nixos/lib @@ -1 +1 @@ -../../upstream-nixpkgs/nixos/lib \ No newline at end of file +../../../upstream-nixpkgs/nixos/lib \ No newline at end of file diff --git a/nixpkgs/nixos/modules b/nixpkgs/nixos/modules index 8fbc4373e..8aa24885c 120000 --- a/nixpkgs/nixos/modules +++ b/nixpkgs/nixos/modules @@ -1 +1 @@ -../../upstream-nixpkgs/nixos/modules \ No newline at end of file +../../../upstream-nixpkgs/nixos/modules \ No newline at end of file diff --git a/root b/root new file mode 120000 index 000000000..1cd18253d --- /dev/null +++ b/root @@ -0,0 +1 @@ +../stockholm-user \ No newline at end of file diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index 46320b738..57c4620c4 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -8,11 +8,9 @@ with lib; krebs.build = { user = config.krebs.users.tv; target = mkDefault "root@${config.krebs.build.host.name}"; - source-version = 2; source = mapAttrs (_: mkDefault) ({ nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix"; nixpkgs = symlink:stockholm/nixpkgs; - null = "symlink:stockholm/null"; secrets = "/home/tv/secrets/${config.krebs.build.host.name}"; secrets-common = "/home/tv/secrets/common"; stockholm = "/home/tv/stockholm"; @@ -104,7 +102,7 @@ with lib; }; environment.variables = { - NIX_PATH = mkForce "secrets=/var/src/null:/var/src"; + NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src"; }; programs.bash = { -- cgit v1.2.3 From 307e0afe851654e07e0c3fca25adf60ada3d974d Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 05:52:06 +0100 Subject: make eval: use ./. --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 87a636e72..e82e39c7e 100644 --- a/Makefile +++ b/Makefile @@ -35,7 +35,7 @@ endif --readonly-mode \ --eval \ -A "$$get" \ - --arg configuration "") + --arg configuration "./$$LOGNAME/1systems/$$system.nix") filter "$$result" ## usage: make install system=foo target= -- cgit v1.2.3 From a91803319b3d340ab9a879c11669e3e60d564572 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 07:12:56 +0100 Subject: stockholm: bring back nspath --- default.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/default.nix b/default.nix index 278f1d14d..b0ad60d8a 100644 --- a/default.nix +++ b/default.nix @@ -27,9 +27,10 @@ let stockholm = { nlib = import (slib.npath "lib"); klib = import (slib.kpath "4lib") { lib = nlib; }; slib = rec { + nspath = ns: p: ./. + "/${ns}/${p}"; npath = p: nixpkgs-path + "/${p}"; - kpath = p: ./. + "/krebs/${p}"; - upath = p: ./. + "/${current-user-name}/${p}"; + kpath = nspath "krebs"; + upath = nspath current-user-name; }; ulib = let p = slib.upath "4lib"; in nlib.optionalAttrs (klib.dir.has-default-nix p) -- cgit v1.2.3 From 07a1e29b32f1c507380a252092ff85b1e69dec08 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 11:32:13 +0100 Subject: make eval: add some more awesome --- Makefile | 40 +++++++++++++++------------------------- 1 file changed, 15 insertions(+), 25 deletions(-) diff --git a/Makefile b/Makefile index e82e39c7e..958629055 100644 --- a/Makefile +++ b/Makefile @@ -9,34 +9,24 @@ export target_host ?= $(system) export target_user ?= root export target_path ?= /var/src +evaluate = \ + nix-instantiate \ + --arg configuration "./$$LOGNAME/1systems/$$system.nix" \ + --eval \ + --readonly-mode \ + --show-trace \ + $(1) + +execute = $(call evaluate,-A config.krebs.build.$(1) --json) | jq -r . | sh + # usage: make deploy system=foo [target_host=bar] -.PHONY: deploy -deploy: populate ;@set -x +deploy: + $(call execute,populate) ssh "$$target_user@$$target_host" nixos-rebuild switch -I "$$target_path" -# usage: make populate system=foo [target_host=bar] -.PHONY: populate -populate:;@ - result=$$(make -s eval get=config.krebs.build.populate filter=json) - echo "$$result" | sh - -# usage: make eval system=foo get=config.krebs.build [LOGNAME=tv] [filter=json] -.PHONY: eval -eval:;@ -ifeq ($(filter),json) - extraArgs='--json --strict' - filter() { echo "$$1" | jq -r .; } -else - filter() { echo "$$1"; } -endif - result=$$(nix-instantiate \ - $${extraArgs-} \ - --show-trace \ - --readonly-mode \ - --eval \ - -A "$$get" \ - --arg configuration "./$$LOGNAME/1systems/$$system.nix") - filter "$$result" +# usage: make LOGNAME=shared system=wolf eval.config.krebs.build.host.name +eval eval.:;@$(call evaluate) +eval.%:;@$(call evaluate,-A $*) ## usage: make install system=foo target= #.PHONY: install -- cgit v1.2.3 From 0939b8b37601fbbd509f88f95f7cab30b906a383 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 11:54:00 +0100 Subject: make deploy: properly print ssh target --- Makefile | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/Makefile b/Makefile index 958629055..886a26f89 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,3 @@ -.ONESHELL: -.SHELLFLAGS := -eufc - ifndef system $(error unbound variable: system) endif @@ -22,7 +19,7 @@ execute = $(call evaluate,-A config.krebs.build.$(1) --json) | jq -r . | sh # usage: make deploy system=foo [target_host=bar] deploy: $(call execute,populate) - ssh "$$target_user@$$target_host" nixos-rebuild switch -I "$$target_path" + @set -x; ssh "$$target_user@$$target_host" nixos-rebuild switch -I "$$target_path" # usage: make LOGNAME=shared system=wolf eval.config.krebs.build.host.name eval eval.:;@$(call evaluate) @@ -33,7 +30,7 @@ eval.%:;@$(call evaluate,-A $*) #install: ssh = ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null #install:;@set -x # $(ssh) "$$target_user@$$target_host" \ -# env target_path=/var/src \ +# env target_path="$target_path" \ # sh -s prepare < krebs/4lib/infest/prepare.sh # make -s populate target_path=/mnt"$$target_path" # $(ssh) "$$target_user@$$target_host" \ -- cgit v1.2.3 From 8682f49ed7ba2687f65e8d11f1b943777896a228 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 11:57:47 +0100 Subject: Makefile execute: don't try to run failed evaluations :D --- Makefile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 886a26f89..e61d16b75 100644 --- a/Makefile +++ b/Makefile @@ -14,7 +14,10 @@ evaluate = \ --show-trace \ $(1) -execute = $(call evaluate,-A config.krebs.build.$(1) --json) | jq -r . | sh +execute = \ + result=$$($(call evaluate,-A config.krebs.build.$(1) --json)) && \ + script=$$(echo "$$result" | jq -r .) && \ + echo "$$script" | sh # usage: make deploy system=foo [target_host=bar] deploy: -- cgit v1.2.3 From c9cfaa010dabbd37a329a9690debf7cf7ef5e3ba Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 4 Feb 2016 12:02:11 +0100 Subject: ma: finish merge of new sources v2, nixos compatibility --- makefu/2configs/default.nix | 12 ++++-------- makefu/2configs/wwan.nix | 1 - 2 files changed, 4 insertions(+), 9 deletions(-) diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix index a98393e2b..2b4e31119 100644 --- a/makefu/2configs/default.nix +++ b/makefu/2configs/default.nix @@ -20,10 +20,10 @@ with lib; build = { target = mkDefault "root@${config.krebs.build.host.name}"; user = config.krebs.users.makefu; - source = { + source = mapAttrs (_: mkDefault) { upstream-nixpkgs = { - url = mkDefault https://github.com/nixos/nixpkgs; - rev = mkDefault "93d8671e2c6d1d25f126ed30e5e6f16764330119"; # unstable @ 2015-01-03, tested on filepimp + url = https://github.com/nixos/nixpkgs; + rev = "93d8671e2c6d1d25f126ed30e5e6f16764330119"; # unstable @ 2015-01-03, tested on filepimp }; secrets = "/home/makefu/secrets/${config.krebs.build.host.name}/"; stockholm = "/home/makefu/stockholm"; @@ -80,11 +80,7 @@ with lib; ]; environment.variables = { - NIX_PATH = with config.krebs.build.source; with dir; with git; - mkForce (concatStringsSep ":" [ - "nixpkgs=${nixpkgs.target-path}" - "${nixpkgs.target-path}" - ]); + NIX_PATH = mkForce "/var/src"; EDITOR = mkForce "vim"; }; diff --git a/makefu/2configs/wwan.nix b/makefu/2configs/wwan.nix index 1e76cd28a..0eb0c97d7 100644 --- a/makefu/2configs/wwan.nix +++ b/makefu/2configs/wwan.nix @@ -1,7 +1,6 @@ _: { - imports = [ ../3modules ]; makefu.umts = { enable = true; modem-device = "/dev/serial/by-id/usb-Lenovo_H5321_gw_2D5A51BA0D3C3A90-if01"; -- cgit v1.2.3 From d739448ab940da4ed5bdf9be5398f6b93b854412 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 12:46:09 +0100 Subject: krebs.build.populate: cleanup (less) harder --- krebs/3modules/build.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix index 00142acdd..0da5dd38a 100644 --- a/krebs/3modules/build.nix +++ b/krebs/3modules/build.nix @@ -74,7 +74,7 @@ let unset tmpdir trap ' - rm "$tmpdir"/* + rm -f "$tmpdir"/* rmdir "$tmpdir" trap - EXIT INT QUIT ' EXIT INT QUIT -- cgit v1.2.3 From e402c8ce1d2786abafc1efdc64adca84d174a756 Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 4 Feb 2016 13:07:47 +0100 Subject: k 3 git.nix: flesh out rules description --- krebs/3modules/git.nix | 2 +- makefu/1systems/omo.nix | 1 - makefu/1systems/vbob.nix | 19 ------------------- 3 files changed, 1 insertion(+), 21 deletions(-) diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix index 7b28ffca8..11cf21b5f 100644 --- a/krebs/3modules/git.nix +++ b/krebs/3modules/git.nix @@ -92,7 +92,7 @@ let } ''; description = '' - Rules. + access and permission rules for git repositories. ''; }; }; diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix index d15cc2779..34d5a394d 100644 --- a/makefu/1systems/omo.nix +++ b/makefu/1systems/omo.nix @@ -29,7 +29,6 @@ in { ../2configs/mail-client.nix ../2configs/share-user-sftp.nix ../2configs/omo-share.nix - ../3modules ]; networking.firewall.trustedInterfaces = [ "enp3s0" ]; # udp:137 udp:138 tcp:445 tcp:139 - samba, allowed in local net diff --git a/makefu/1systems/vbob.nix b/makefu/1systems/vbob.nix index 6c8f5ca26..f4a22d720 100644 --- a/makefu/1systems/vbob.nix +++ b/makefu/1systems/vbob.nix @@ -18,25 +18,6 @@ tinc = pkgs.tinc_pre; }; - makefu.buildbot.master = { - enable = false; - irc = { - enable = true; - server = "cd.retiolum"; - channel = "retiolum"; - allowForce = true; - }; - }; - # services.logstash.enable = true; - makefu.buildbot.slave = { - enable = false; - masterhost = "localhost"; - username = "testslave"; - password = "krebspass"; - packages = with pkgs;[ git nix ]; - extraEnviron = { NIX_PATH="nixpkgs=${toString }"; }; - }; - krebs.build.source.nixpkgs = { # url = https://github.com/nixos/nixpkgs; # HTTP Everywhere + libredir -- cgit v1.2.3 From 5be8920fb0262ff703f23ef484c59f4b55a9b015 Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 4 Feb 2016 14:36:48 +0100 Subject: s 2 base: new paths, cosmetics --- shared/2configs/base.nix | 18 +++++++----------- shared/2configs/cgit-mirror.nix | 7 +++---- 2 files changed, 10 insertions(+), 15 deletions(-) diff --git a/shared/2configs/base.nix b/shared/2configs/base.nix index 5e6072661..dd698ba97 100644 --- a/shared/2configs/base.nix +++ b/shared/2configs/base.nix @@ -16,20 +16,16 @@ with lib; # TODO rename shared user to "krebs" krebs.build.user = mkDefault config.krebs.users.shared; krebs.build.source = { - git.nixpkgs = { + upstream-nixpkgs = mkDefault { url = https://github.com/NixOS/nixpkgs; rev = "d0e3cca"; - target-path = "/var/src/nixpkgs"; - }; - dir.secrets = { - host = config.krebs.current.host; - path = mkDefault "${getEnv "HOME"}/secrets/krebs/${config.krebs.build.host.name}"; - }; - dir.stockholm = { - host = config.krebs.current.host; - path = mkDefault "${getEnv "HOME"}/stockholm"; - target-path = "/var/src/stockholm"; }; + secrets = mkDefault "${getEnv "HOME"}/secrets/krebs/${config.krebs.build.host.name}"; + stockholm = mkDefault "${getEnv "HOME"}/stockholm"; + + nixos-config = "symlink:stockholm/${config.krebs.build.user.name}/1systems/${config.krebs.build.host.name}.nix"; + nixpkgs = symlink:stockholm/nixpkgs; + stockholm-user = "symlink:stockholm/${config.krebs.build.user.name}"; }; networking.hostName = config.krebs.build.host.name; diff --git a/shared/2configs/cgit-mirror.nix b/shared/2configs/cgit-mirror.nix index 5bcfc5818..4ff1902f9 100644 --- a/shared/2configs/cgit-mirror.nix +++ b/shared/2configs/cgit-mirror.nix @@ -2,12 +2,11 @@ with lib; let - rules = with git;[{ - # user = git-sync; - user = git-sync; + rules = with git; singleton { + user = [ git-sync ]; repo = [ stockholm-mirror ]; perm = push ''refs/*'' [ non-fast-forward create delete merge ]; - }]; + }; stockholm-mirror = { public = true; -- cgit v1.2.3 From 4c23e33dea4d9901b64bf287983c43862f4990f2 Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 4 Feb 2016 16:38:21 +0100 Subject: ma 1: refactor buildbot config, add documentation --- shared/1systems/wolf.nix | 2 +- shared/2configs/buildbot-standalone.nix | 150 -------------------------------- shared/2configs/shared-buildbot.nix | 148 +++++++++++++++++++++++++++++++ 3 files changed, 149 insertions(+), 151 deletions(-) delete mode 100644 shared/2configs/buildbot-standalone.nix create mode 100644 shared/2configs/shared-buildbot.nix diff --git a/shared/1systems/wolf.nix b/shared/1systems/wolf.nix index e45195487..bcfbd6810 100644 --- a/shared/1systems/wolf.nix +++ b/shared/1systems/wolf.nix @@ -11,7 +11,7 @@ in ../2configs/collectd-base.nix ../2configs/shack-nix-cacher.nix ../2configs/shack-drivedroid.nix - ../2configs/buildbot-standalone.nix + ../2configs/shared-buildbot.nix ../2configs/cgit-mirror.nix # ../2configs/graphite.nix ]; diff --git a/shared/2configs/buildbot-standalone.nix b/shared/2configs/buildbot-standalone.nix deleted file mode 100644 index 9982dd915..000000000 --- a/shared/2configs/buildbot-standalone.nix +++ /dev/null @@ -1,150 +0,0 @@ -{ lib, config, pkgs, ... }: - -{ - networking.firewall.allowedTCPPorts = [ 8010 9989 ]; - krebs.buildbot.master = { - secrets = [ "retiolum-ci.rsa_key.priv" "cac.json" ]; - slaves = { - testslave = "krebspass"; - }; - change_source.stockholm = '' - stockholm_repo = 'http://cgit.gum/stockholm' - cs.append(changes.GitPoller( - stockholm_repo, - workdir='stockholm-poller', branch='master', - project='stockholm', - pollinterval=120)) - ''; - scheduler = { - force-scheduler = '' - sched.append(schedulers.ForceScheduler( - name="force", - builderNames=["full-tests"])) - ''; - fast-tests-scheduler = '' - # test the master real quick - sched.append(schedulers.SingleBranchScheduler( - change_filter=util.ChangeFilter(branch="master"), - treeStableTimer=10, #only test the latest push - name="fast-master-test", - builderNames=["fast-tests"])) - ''; - test-cac-infest-master = '' - # files everyone depends on or are part of the share branch - def shared_files(change): - r =re.compile("^((krebs|shared)/.*|Makefile|default.nix)") - for file in change.files: - if r.match(file): - return True - return False - - sched.append(schedulers.SingleBranchScheduler( - change_filter=util.ChangeFilter(branch="master"), - fileIsImportant=shared_files, - treeStableTimer=60*60, # master was stable for the last hour - name="full-master-test", - builderNames=["full-tests"])) - ''; - }; - builder_pre = '' - # prepare grab_repo step for stockholm - stockholm_repo = "http://cgit.gum.retiolum/stockholm" - grab_repo = steps.Git(repourl=stockholm_repo, mode='incremental') - - env = {"LOGNAME": "shared", "NIX_REMOTE": "daemon"} - - # prepare nix-shell - # the dependencies which are used by the test script - deps = [ "gnumake", "jq","nix","rsync", - "(import {}).pkgs.test.infest-cac-centos7" ] - # TODO: --pure , prepare ENV in nix-shell command: - # SSL_CERT_FILE,LOGNAME,NIX_REMOTE - nixshell = ["nix-shell", "-I", "stockholm=.", "-p" ] + deps + [ "--run" ] - - # prepare addShell function - def addShell(factory,**kwargs): - factory.addStep(steps.ShellCommand(**kwargs)) - ''; - builder = { - fast-tests = '' - f = util.BuildFactory() - f.addStep(grab_repo) - addShell(f,name="deploy-eval-centos7",env=env, - command=nixshell + ["make -s eval get=krebs.deploy filter=json system=test-centos7"]) - - addShell(f,name="deploy-eval-wolf",env=env, - command=nixshell + ["make -s eval get=krebs.deploy filter=json system=wolf"]) - - addShell(f,name="deploy-eval-cross-check",env=env, - command=nixshell + ["! make eval get=krebs.deploy filter=json system=test-failing"]) - - addShell(f,name="instantiate-test-all-modules",env=env, - command=nixshell + \ - ["touch retiolum.rsa_key.priv; \ - nix-instantiate --eval -A \ - users.shared.test-all-krebs-modules.system \ - -I stockholm=. \ - --show-trace \ - -I secrets=. '' \ - --argstr current-user-name shared \ - --argstr current-host-name lol \ - --strict --json"]) - - addShell(f,name="instantiate-test-minimal-deploy",env=env, - command=nixshell + \ - ["nix-instantiate --eval -A \ - users.shared.test-minimal-deploy.system \ - -I stockholm=. \ - -I secrets=. '' \ - --show-trace \ - --argstr current-user-name shared \ - --argstr current-host-name lol \ - --strict --json"]) - - bu.append(util.BuilderConfig(name="fast-tests", - slavenames=slavenames, - factory=f)) - ''; - slow-tests = '' - s = util.BuildFactory() - s.addStep(grab_repo) - - # slave needs 2 files: - # * cac.json - # * retiolum - s.addStep(steps.FileDownload(mastersrc="${config.krebs.buildbot.master.workDir}/cac.json", slavedest="cac.json")) - s.addStep(steps.FileDownload(mastersrc="${config.krebs.buildbot.master.workDir}/retiolum-ci.rsa_key.priv", slavedest="retiolum.rsa_key.priv")) - - addShell(s, name="infest-cac-centos7",env=env, - sigtermTime=60, # SIGTERM 1 minute before SIGKILL - timeout=10800, # 3h - command=nixshell + ["infest-cac-centos7"]) - - bu.append(util.BuilderConfig(name="full-tests", - slavenames=slavenames, - factory=s)) - ''; - }; - enable = true; - web = { - enable = true; - }; - irc = { - enable = true; - nick = "shared-buildbot"; - server = "cd.retiolum"; - channels = [ "retiolum" ]; - allowForce = true; - }; - }; - - krebs.buildbot.slave = { - enable = true; - masterhost = "localhost"; - username = "testslave"; - password = "krebspass"; - packages = with pkgs;[ git nix ]; - # all nix commands will need a working nixpkgs installation - extraEnviron = { NIX_PATH="nixpkgs=${toString }"; }; - }; -} diff --git a/shared/2configs/shared-buildbot.nix b/shared/2configs/shared-buildbot.nix new file mode 100644 index 000000000..50b279036 --- /dev/null +++ b/shared/2configs/shared-buildbot.nix @@ -0,0 +1,148 @@ +{ lib, config, pkgs, ... }: +# The buildbot config is seilf-contained and provides a way to test "shared" +# configuration (infrastructure to be used by every krebsminister). + +# You can add your own test, test steps as required. Deploy the config on a +# shared host like wolf and everything should be fine. +{ + networking.firewall.allowedTCPPorts = [ 8010 9989 ]; + krebs.buildbot.master = { + secrets = [ "retiolum-ci.rsa_key.priv" "cac.json" ]; + slaves = { + testslave = "krebspass"; + }; + change_source.stockholm = '' + stockholm_repo = 'http://cgit.gum/stockholm' + cs.append(changes.GitPoller( + stockholm_repo, + workdir='stockholm-poller', branch='master', + project='stockholm', + pollinterval=120)) + ''; + scheduler = { + force-scheduler = '' + sched.append(schedulers.ForceScheduler( + name="force", + builderNames=["full-tests"])) + ''; + fast-tests-scheduler = '' + # test the master real quick + sched.append(schedulers.SingleBranchScheduler( + change_filter=util.ChangeFilter(branch="master"), + treeStableTimer=10, #only test the latest push + name="fast-master-test", + builderNames=["fast-tests"])) + ''; + test-cac-infest-master = '' + # files everyone depends on or are part of the share branch + def shared_files(change): + r =re.compile("^((krebs|shared)/.*|Makefile|default.nix)") + for file in change.files: + if r.match(file): + return True + return False + + sched.append(schedulers.SingleBranchScheduler( + change_filter=util.ChangeFilter(branch="master"), + fileIsImportant=shared_files, + treeStableTimer=60*60, # master was stable for the last hour + name="full-master-test", + builderNames=["full-tests"])) + ''; + }; + builder_pre = '' + # prepare grab_repo step for stockholm + stockholm_repo = "http://cgit.gum.retiolum/stockholm" + grab_repo = steps.Git(repourl=stockholm_repo, mode='incremental') + + env = {"LOGNAME": "shared", "NIX_REMOTE": "daemon"} + + # prepare nix-shell + # the dependencies which are used by the test script + deps = [ "gnumake", "jq","nix","rsync", + "(import {}).pkgs.test.infest-cac-centos7" ] + # TODO: --pure , prepare ENV in nix-shell command: + # SSL_CERT_FILE,LOGNAME,NIX_REMOTE + nixshell = ["nix-shell", + "-I", "stockholm=.", + "-I", "nixpkgs=/var/src/upstream-nixpkgs", + "-p" ] + deps + [ "--run" ] + + # prepare addShell function + def addShell(factory,**kwargs): + factory.addStep(steps.ShellCommand(**kwargs)) + ''; + builder = { + fast-tests = '' + f = util.BuildFactory() + f.addStep(grab_repo) + for i in [ "test-centos7", "wolf", "test-failing" ]: + addShell(f,name="populate-{}".format(i),env=env, + command=nixshell + ["set -o pipefail;{}( nix-instantiate --arg configuration shared/1systems/{}.nix --eval --readonly-mode --show-trace -A config.krebs.build.populate --strict | jq -r .)".format("!" if "failing" in i else "",i)]) + + addShell(f,name="instantiate-test-all-modules",env=env, + command=nixshell + \ + ["touch retiolum.rsa_key.priv; \ + nix-instantiate --eval -A \ + users.shared.test-all-krebs-modules.system \ + -I stockholm=. \ + --show-trace \ + -I secrets=. '' \ + --strict --json"]) + + addShell(f,name="instantiate-test-minimal-deploy",env=env, + command=nixshell + \ + ["nix-instantiate --eval -A \ + users.shared.test-minimal-deploy.system \ + -I stockholm=. \ + -I secrets=. '' \ + --show-trace \ + --strict --json"]) + + bu.append(util.BuilderConfig(name="fast-tests", + slavenames=slavenames, + factory=f)) + ''; + slow-tests = '' + s = util.BuildFactory() + s.addStep(grab_repo) + + # slave needs 2 files: + # * cac.json + # * retiolum + s.addStep(steps.FileDownload(mastersrc="${config.krebs.buildbot.master.workDir}/cac.json", slavedest="cac.json")) + s.addStep(steps.FileDownload(mastersrc="${config.krebs.buildbot.master.workDir}/retiolum-ci.rsa_key.priv", slavedest="retiolum.rsa_key.priv")) + + addShell(s, name="infest-cac-centos7",env=env, + sigtermTime=60, # SIGTERM 1 minute before SIGKILL + timeout=10800, # 3h + command=nixshell + ["infest-cac-centos7"]) + + bu.append(util.BuilderConfig(name="full-tests", + slavenames=slavenames, + factory=s)) + ''; + }; + enable = true; + web = { + enable = true; + }; + irc = { + enable = true; + nick = "shared-buildbot"; + server = "cd.retiolum"; + channels = [ "retiolum" ]; + allowForce = true; + }; + }; + + krebs.buildbot.slave = { + enable = true; + masterhost = "localhost"; + username = "testslave"; + password = "krebspass"; + packages = with pkgs;[ git nix ]; + # all nix commands will need a working nixpkgs installation + extraEnviron = { NIX_PATH="/var/src"; }; + }; +} -- cgit v1.2.3 From cb264dfb9119de4fb6d081171473e4276cdbb9d5 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 5 Feb 2016 15:11:22 +0100 Subject: urlwatch: 2.0 -> 2.1 --- krebs/5pkgs/urlwatch/default.nix | 23 ++++++----------------- 1 file changed, 6 insertions(+), 17 deletions(-) diff --git a/krebs/5pkgs/urlwatch/default.nix b/krebs/5pkgs/urlwatch/default.nix index d9b595314..780ad24f5 100644 --- a/krebs/5pkgs/urlwatch/default.nix +++ b/krebs/5pkgs/urlwatch/default.nix @@ -1,29 +1,18 @@ { stdenv, fetchurl, python3Packages }: python3Packages.buildPythonPackage rec { - name = "urlwatch-2.0"; + name = "urlwatch-2.1"; src = fetchurl { url = "https://thp.io/2008/urlwatch/${name}.tar.gz"; - sha256 = "0j38qzw4jxw41vnnpi6j851hqpv8d6p1cbni6cv8r2vqf5307s3b"; + sha256 = "0xn435cml9wjwk39117p1diqmvw3jbmv9ccr7230iaf7z59vf9v6"; }; propagatedBuildInputs = with python3Packages; [ - pyyaml keyring - (python3Packages.buildPythonPackage rec { - name = "minidb-2.0.1"; - src = fetchurl { - url = "https://thp.io/2010/minidb/${name}.tar.gz"; - sha256 = "1x958zr9jc26vaqij451qb9m2l7apcpz34ir9fwfjg4fwv24z2dy"; - }; - meta = { - description = "A simple SQLite3-based store for Python objects"; - homepage = https://thp.io/2010/minidb/; - license = stdenv.lib.licenses.isc; - maintainers = [ stdenv.lib.maintainers.tv ]; - }; - }) + minidb + pyyaml + requests2 ]; postFixup = '' @@ -36,4 +25,4 @@ python3Packages.buildPythonPackage rec { license = stdenv.lib.licenses.bsd3; maintainers = [ stdenv.lib.maintainers.tv ]; }; -}# +} -- cgit v1.2.3 From b2303e081fb1ccc9a0b88f538736045fb2fba14f Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 5 Feb 2016 15:18:28 +0100 Subject: cd: use default upstream-nixpkgs --- tv/1systems/cd.nix | 5 ----- 1 file changed, 5 deletions(-) diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix index e42d5750a..8297a56df 100644 --- a/tv/1systems/cd.nix +++ b/tv/1systems/cd.nix @@ -6,11 +6,6 @@ with lib; krebs.build.host = config.krebs.hosts.cd; krebs.build.target = "root@cd.internet"; - krebs.build.source.upstream-nixpkgs = { - url = https://github.com/NixOS/nixpkgs; - rev = "b7ff030"; - }; - imports = [ ../2configs/hw/CAC-Developer-2.nix ../2configs/fs/CAC-CentOS-7-64bit.nix -- cgit v1.2.3 From 23c7c10f5a5ed83dca001d7382e5b89981277f8c Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 15:11:30 +0100 Subject: krebs.retiolum.hosts: change type to attrsOf host --- krebs/3modules/retiolum.nix | 46 +++++++++++++++++----------------- krebs/4lib/types.nix | 16 ++++++------ krebs/Zhosts/Styx | 10 -------- krebs/Zhosts/ThinkArmageddon | 9 ------- krebs/Zhosts/TriBot | 11 -------- krebs/Zhosts/ach | 11 -------- krebs/Zhosts/air | 11 -------- krebs/Zhosts/alarmpi | 11 -------- krebs/Zhosts/albi10 | 11 -------- krebs/Zhosts/albi7 | 10 -------- krebs/Zhosts/almoehi | 11 -------- krebs/Zhosts/alphalabs | 10 -------- krebs/Zhosts/apfull | 11 -------- krebs/Zhosts/bitchctl | 11 -------- krebs/Zhosts/bitchextend | 11 -------- krebs/Zhosts/bitchtop | 11 -------- krebs/Zhosts/bobby | 11 -------- krebs/Zhosts/box | 10 -------- krebs/Zhosts/bridge | 12 --------- krebs/Zhosts/c2ft | 10 -------- krebs/Zhosts/c2fthome | 10 -------- krebs/Zhosts/casino | 11 -------- krebs/Zhosts/cat1 | 11 -------- krebs/Zhosts/cband | 11 -------- krebs/Zhosts/cd | 17 ------------- krebs/Zhosts/cloudkrebs | 12 --------- krebs/Zhosts/darth | 12 --------- krebs/Zhosts/dei | 11 -------- krebs/Zhosts/destroy | 11 -------- krebs/Zhosts/devstar | 11 -------- krebs/Zhosts/echelon | 12 --------- krebs/Zhosts/eigenserv | 11 -------- krebs/Zhosts/elvis | 12 --------- krebs/Zhosts/eulerwalk | 11 -------- krebs/Zhosts/exile | 9 ------- krebs/Zhosts/exitium_mobilis | 10 -------- krebs/Zhosts/falk | 11 -------- krebs/Zhosts/fastpoke | 12 --------- krebs/Zhosts/filebitch | 11 -------- krebs/Zhosts/filepimp | 11 -------- krebs/Zhosts/flap | 12 --------- krebs/Zhosts/foobar | 11 -------- krebs/Zhosts/fuerkrebs | 10 -------- krebs/Zhosts/gum | 15 ----------- krebs/Zhosts/heidi | 11 -------- krebs/Zhosts/horisa | 12 --------- krebs/Zhosts/horreum_magnus | 15 ----------- krebs/Zhosts/incept | 13 ---------- krebs/Zhosts/ire | 12 --------- krebs/Zhosts/ire2 | 9 ------- krebs/Zhosts/irkel | 12 --------- krebs/Zhosts/juhulian | 11 -------- krebs/Zhosts/k2 | 28 --------------------- krebs/Zhosts/kabinett | 11 -------- krebs/Zhosts/kaepsele | 11 -------- krebs/Zhosts/kalle | 11 -------- krebs/Zhosts/karthus | 10 -------- krebs/Zhosts/kebsco | 11 -------- krebs/Zhosts/khackplug | 11 -------- krebs/Zhosts/kheurop | 12 --------- krebs/Zhosts/kiosk | 12 --------- krebs/Zhosts/krebsplug | 10 -------- krebs/Zhosts/kvasir | 11 -------- krebs/Zhosts/laqueus | 11 -------- krebs/Zhosts/linuxatom | 11 -------- krebs/Zhosts/luminos | 11 -------- krebs/Zhosts/machine | 11 -------- krebs/Zhosts/makalu | 11 -------- krebs/Zhosts/mako | 11 -------- krebs/Zhosts/miefda0 | 10 -------- krebs/Zhosts/minikrebs | 10 -------- krebs/Zhosts/mkdir | 11 -------- krebs/Zhosts/monitor | 11 -------- krebs/Zhosts/mors | 10 -------- krebs/Zhosts/motor | 12 --------- krebs/Zhosts/mu | 10 -------- krebs/Zhosts/muhbaasu | 13 ---------- krebs/Zhosts/nomic | 10 -------- krebs/Zhosts/nomic2 | 10 -------- krebs/Zhosts/nukular | 11 -------- krebs/Zhosts/omo | 9 ------- krebs/Zhosts/pic | 11 -------- krebs/Zhosts/pigstarter | 13 ---------- krebs/Zhosts/pike | 11 -------- krebs/Zhosts/pnp | 11 -------- krebs/Zhosts/pornocauster | 10 -------- krebs/Zhosts/prism | 12 --------- krebs/Zhosts/radiotuxmini | 11 -------- krebs/Zhosts/random | 10 -------- krebs/Zhosts/raspafari | 11 -------- krebs/Zhosts/reimae | 12 --------- krebs/Zhosts/rmdir | 11 -------- krebs/Zhosts/robchina | 11 -------- krebs/Zhosts/rockit | 11 -------- krebs/Zhosts/rtjure_debian_oder_so | 11 -------- krebs/Zhosts/rtjure_ras | 11 -------- krebs/Zhosts/rtjure_rdrlab_linkstation | 11 -------- krebs/Zhosts/rubus | 9 ------- krebs/Zhosts/senderechner | 10 -------- krebs/Zhosts/serenity | 11 -------- krebs/Zhosts/seruundroid | 12 --------- krebs/Zhosts/sir_krebs_a_lot | 11 -------- krebs/Zhosts/skirfir | 11 -------- krebs/Zhosts/sleipnir | 12 --------- krebs/Zhosts/smove | 9 ------- krebs/Zhosts/sokrates | 11 -------- krebs/Zhosts/sokrateslaptop | 11 -------- krebs/Zhosts/soundflower | 10 -------- krebs/Zhosts/steve | 10 -------- krebs/Zhosts/stro | 10 -------- krebs/Zhosts/tahoe | 12 --------- krebs/Zhosts/taschenkrebs | 11 -------- krebs/Zhosts/terrapi | 11 -------- krebs/Zhosts/thomasDOTde | 9 ------- krebs/Zhosts/tincdroid | 9 ------- krebs/Zhosts/tmpd | 11 -------- krebs/Zhosts/tpsw | 11 -------- krebs/Zhosts/tsp | 16 ------------ krebs/Zhosts/ufo | 11 -------- krebs/Zhosts/uriel | 11 -------- krebs/Zhosts/vault | 10 -------- krebs/Zhosts/vbob | 9 ------- krebs/Zhosts/voyager | 17 ------------- krebs/Zhosts/wbob | 10 -------- krebs/Zhosts/wolf | 10 -------- krebs/Zhosts/wooktop | 11 -------- krebs/Zhosts/wry | 16 ------------ krebs/Zhosts/wu | 10 -------- krebs/Zhosts/xu | 13 ---------- krebs/Zhosts/ytart | 9 ------- krebs/Zhosts/zombiecancer | 11 -------- lass/2configs/retiolum.nix | 1 - makefu/1systems/repunit.nix | 1 - makefu/1systems/vbob.nix | 1 - 134 files changed, 32 insertions(+), 1479 deletions(-) delete mode 100644 krebs/Zhosts/Styx delete mode 100644 krebs/Zhosts/ThinkArmageddon delete mode 100644 krebs/Zhosts/TriBot delete mode 100644 krebs/Zhosts/ach delete mode 100644 krebs/Zhosts/air delete mode 100644 krebs/Zhosts/alarmpi delete mode 100644 krebs/Zhosts/albi10 delete mode 100644 krebs/Zhosts/albi7 delete mode 100644 krebs/Zhosts/almoehi delete mode 100644 krebs/Zhosts/alphalabs delete mode 100644 krebs/Zhosts/apfull delete mode 100644 krebs/Zhosts/bitchctl delete mode 100644 krebs/Zhosts/bitchextend delete mode 100644 krebs/Zhosts/bitchtop delete mode 100644 krebs/Zhosts/bobby delete mode 100644 krebs/Zhosts/box delete mode 100644 krebs/Zhosts/bridge delete mode 100644 krebs/Zhosts/c2ft delete mode 100644 krebs/Zhosts/c2fthome delete mode 100644 krebs/Zhosts/casino delete mode 100644 krebs/Zhosts/cat1 delete mode 100644 krebs/Zhosts/cband delete mode 100644 krebs/Zhosts/cd delete mode 100644 krebs/Zhosts/cloudkrebs delete mode 100644 krebs/Zhosts/darth delete mode 100644 krebs/Zhosts/dei delete mode 100644 krebs/Zhosts/destroy delete mode 100644 krebs/Zhosts/devstar delete mode 100644 krebs/Zhosts/echelon delete mode 100644 krebs/Zhosts/eigenserv delete mode 100644 krebs/Zhosts/elvis delete mode 100644 krebs/Zhosts/eulerwalk delete mode 100644 krebs/Zhosts/exile delete mode 100644 krebs/Zhosts/exitium_mobilis delete mode 100644 krebs/Zhosts/falk delete mode 100644 krebs/Zhosts/fastpoke delete mode 100644 krebs/Zhosts/filebitch delete mode 100644 krebs/Zhosts/filepimp delete mode 100644 krebs/Zhosts/flap delete mode 100644 krebs/Zhosts/foobar delete mode 100644 krebs/Zhosts/fuerkrebs delete mode 100644 krebs/Zhosts/gum delete mode 100644 krebs/Zhosts/heidi delete mode 100644 krebs/Zhosts/horisa delete mode 100644 krebs/Zhosts/horreum_magnus delete mode 100644 krebs/Zhosts/incept delete mode 100644 krebs/Zhosts/ire delete mode 100644 krebs/Zhosts/ire2 delete mode 100644 krebs/Zhosts/irkel delete mode 100644 krebs/Zhosts/juhulian delete mode 100644 krebs/Zhosts/k2 delete mode 100644 krebs/Zhosts/kabinett delete mode 100644 krebs/Zhosts/kaepsele delete mode 100644 krebs/Zhosts/kalle delete mode 100644 krebs/Zhosts/karthus delete mode 100644 krebs/Zhosts/kebsco delete mode 100644 krebs/Zhosts/khackplug delete mode 100644 krebs/Zhosts/kheurop delete mode 100644 krebs/Zhosts/kiosk delete mode 100644 krebs/Zhosts/krebsplug delete mode 100644 krebs/Zhosts/kvasir delete mode 100644 krebs/Zhosts/laqueus delete mode 100644 krebs/Zhosts/linuxatom delete mode 100644 krebs/Zhosts/luminos delete mode 100644 krebs/Zhosts/machine delete mode 100644 krebs/Zhosts/makalu delete mode 100644 krebs/Zhosts/mako delete mode 100644 krebs/Zhosts/miefda0 delete mode 100644 krebs/Zhosts/minikrebs delete mode 100644 krebs/Zhosts/mkdir delete mode 100644 krebs/Zhosts/monitor delete mode 100644 krebs/Zhosts/mors delete mode 100644 krebs/Zhosts/motor delete mode 100644 krebs/Zhosts/mu delete mode 100644 krebs/Zhosts/muhbaasu delete mode 100644 krebs/Zhosts/nomic delete mode 100644 krebs/Zhosts/nomic2 delete mode 100644 krebs/Zhosts/nukular delete mode 100644 krebs/Zhosts/omo delete mode 100644 krebs/Zhosts/pic delete mode 100644 krebs/Zhosts/pigstarter delete mode 100644 krebs/Zhosts/pike delete mode 100644 krebs/Zhosts/pnp delete mode 100644 krebs/Zhosts/pornocauster delete mode 100644 krebs/Zhosts/prism delete mode 100644 krebs/Zhosts/radiotuxmini delete mode 100644 krebs/Zhosts/random delete mode 100644 krebs/Zhosts/raspafari delete mode 100644 krebs/Zhosts/reimae delete mode 100644 krebs/Zhosts/rmdir delete mode 100644 krebs/Zhosts/robchina delete mode 100644 krebs/Zhosts/rockit delete mode 100644 krebs/Zhosts/rtjure_debian_oder_so delete mode 100644 krebs/Zhosts/rtjure_ras delete mode 100644 krebs/Zhosts/rtjure_rdrlab_linkstation delete mode 100644 krebs/Zhosts/rubus delete mode 100644 krebs/Zhosts/senderechner delete mode 100644 krebs/Zhosts/serenity delete mode 100644 krebs/Zhosts/seruundroid delete mode 100644 krebs/Zhosts/sir_krebs_a_lot delete mode 100644 krebs/Zhosts/skirfir delete mode 100644 krebs/Zhosts/sleipnir delete mode 100644 krebs/Zhosts/smove delete mode 100644 krebs/Zhosts/sokrates delete mode 100644 krebs/Zhosts/sokrateslaptop delete mode 100644 krebs/Zhosts/soundflower delete mode 100644 krebs/Zhosts/steve delete mode 100644 krebs/Zhosts/stro delete mode 100644 krebs/Zhosts/tahoe delete mode 100644 krebs/Zhosts/taschenkrebs delete mode 100644 krebs/Zhosts/terrapi delete mode 100644 krebs/Zhosts/thomasDOTde delete mode 100644 krebs/Zhosts/tincdroid delete mode 100644 krebs/Zhosts/tmpd delete mode 100644 krebs/Zhosts/tpsw delete mode 100644 krebs/Zhosts/tsp delete mode 100644 krebs/Zhosts/ufo delete mode 100644 krebs/Zhosts/uriel delete mode 100644 krebs/Zhosts/vault delete mode 100644 krebs/Zhosts/vbob delete mode 100644 krebs/Zhosts/voyager delete mode 100644 krebs/Zhosts/wbob delete mode 100644 krebs/Zhosts/wolf delete mode 100644 krebs/Zhosts/wooktop delete mode 100644 krebs/Zhosts/wry delete mode 100644 krebs/Zhosts/wu delete mode 100644 krebs/Zhosts/xu delete mode 100644 krebs/Zhosts/ytart delete mode 100644 krebs/Zhosts/zombiecancer diff --git a/krebs/3modules/retiolum.nix b/krebs/3modules/retiolum.nix index e0e2692a8..08ac96461 100644 --- a/krebs/3modules/retiolum.nix +++ b/krebs/3modules/retiolum.nix @@ -1,6 +1,4 @@ { config, pkgs, lib, ... }: - -with builtins; with lib; let cfg = config.krebs.retiolum; @@ -40,7 +38,7 @@ let ''; }; - network = mkOption { + netname = mkOption { type = types.str; default = "retiolum"; description = '' @@ -65,10 +63,13 @@ let }; hosts = mkOption { - type = with types; either package path; - default = ../Zhosts; + type = with types; attrsOf host; + default = + filterAttrs (_: h: hasAttr cfg.netname h.nets) config.krebs.hosts; description = '' - If a path is given, then it will be used to generate an ad-hoc package. + Hosts which should be part of the tinc configuration. + Note that these hosts must have a correspondingly named network + configured, see config.krebs.retiolum.netname. ''; }; @@ -104,7 +105,7 @@ let }; imp = { - environment.systemPackages = [ tinc hosts iproute ]; + environment.systemPackages = [ tinc iproute ]; networking.extraHosts = retiolumExtraHosts; @@ -140,17 +141,16 @@ let tinc = cfg.tincPackage; - hosts = getAttr (typeOf cfg.hosts) { - package = cfg.hosts; - path = pkgs.stdenv.mkDerivation { - name = "custom-retiolum-hosts"; - src = cfg.hosts; - installPhase = '' - mkdir $out - find . -name .git -prune -o -type f -print0 \ - | xargs -0 cp --target-directory $out - ''; - }; + tinc-hosts = pkgs.stdenv.mkDerivation { + name = "${cfg.netname}-tinc-hosts"; + phases = [ "installPhase" ]; + installPhase = '' + mkdir $out + ${concatStrings (mapAttrsToList (_: host: '' + echo ${shell.escape host.nets.${cfg.netname}.tinc.config} \ + > $out/${shell.escape host.name} + '') cfg.hosts)} + ''; }; iproute = cfg.iproutePackage; @@ -159,7 +159,7 @@ let { } '' generate() { - (cd ${hosts} + (cd ${tinc-hosts} printf \'\' for i in `ls`; do names=$(hostnames $i) @@ -180,11 +180,11 @@ let generate ;; long) - hostnames() { echo "$1.${cfg.network}"; } + hostnames() { echo "$1.${cfg.netname}"; } generate ;; both) - hostnames() { echo "$1.${cfg.network} $1"; } + hostnames() { echo "$1.${cfg.netname} $1"; } generate ;; *) @@ -203,12 +203,12 @@ let mkdir -p $out - ln -s ${hosts} $out/hosts + ln -s ${tinc-hosts} $out/hosts cat > $out/tinc.conf < Date: Sat, 6 Feb 2016 15:43:24 +0100 Subject: krebs.retiolum: don't generate extraHosts --- krebs/3modules/default.nix | 1 - krebs/3modules/retiolum.nix | 54 ++------------------------------------------- 2 files changed, 2 insertions(+), 53 deletions(-) diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index ba1f425d9..7418434ea 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -96,7 +96,6 @@ let retiolum = "hosts"; }; - # XXX This overlaps with krebs.retiolum networking.extraHosts = concatStringsSep "\n" (flatten ( mapAttrsToList (hostname: host: mapAttrsToList (netname: net: diff --git a/krebs/3modules/retiolum.nix b/krebs/3modules/retiolum.nix index 08ac96461..2bf8aa5db 100644 --- a/krebs/3modules/retiolum.nix +++ b/krebs/3modules/retiolum.nix @@ -29,22 +29,13 @@ let ''; }; - generateEtcHosts = mkOption { - type = types.str; - default = "both"; - description = '' - If set to short, long, or both, - then generate entries in /etc/hosts from subnets. - ''; - }; - netname = mkOption { type = types.str; default = "retiolum"; description = '' The tinc network name. - It is used to generate long host entries, - and name the TUN device. + It is used to name the TUN device and to generate the default value for + config.krebs.retiolum.hosts. ''; }; @@ -107,8 +98,6 @@ let imp = { environment.systemPackages = [ tinc iproute ]; - networking.extraHosts = retiolumExtraHosts; - systemd.services.retiolum = { description = "Tinc daemon for Retiolum"; after = [ "network.target" ]; @@ -155,45 +144,6 @@ let iproute = cfg.iproutePackage; - retiolumExtraHosts = import (pkgs.runCommand "retiolum-etc-hosts" - { } - '' - generate() { - (cd ${tinc-hosts} - printf \'\' - for i in `ls`; do - names=$(hostnames $i) - for j in `sed -En 's|^ *Aliases *= *(.+)|\1|p' $i`; do - names="$names $(hostnames $j)" - done - sed -En ' - s|^ *Subnet *= *([^ /]*)(/[0-9]*)? *$|\1 '"$names"'|p - ' $i - done | sort - printf \'\' - ) - } - - case ${cfg.generateEtcHosts} in - short) - hostnames() { echo "$1"; } - generate - ;; - long) - hostnames() { echo "$1.${cfg.netname}"; } - generate - ;; - both) - hostnames() { echo "$1.${cfg.netname} $1"; } - generate - ;; - *) - echo '""' - ;; - esac > $out - ''); - - confDir = pkgs.runCommand "retiolum" { # TODO text executable = true; -- cgit v1.2.3 From a1f7f5e510ddc7a35bebe4ec7698e19d83d57c3f Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 15:57:43 +0100 Subject: krebs: DRY up shorts of the networking.extraHosts generator --- krebs/3modules/default.nix | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 7418434ea..20eb944e2 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -103,10 +103,8 @@ let aliases = longs ++ shorts; providers = dns.split-by-provider net.aliases cfg.dns.providers; longs = providers.hosts; - shorts = - map (removeSuffix ".${cfg.search-domain}") - (filter (hasSuffix ".${cfg.search-domain}") - longs); + shorts = let s = ".${cfg.search-domain}"; in + map (removeSuffix s) (filter (hasSuffix s) longs); in map (addr: "${addr} ${toString aliases}") net.addrs ) (filterAttrs (name: host: host.aliases != []) host.nets) -- cgit v1.2.3 From 171df3acbe8ebe97d690bfb386fbf15bc14984cd Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 16:15:25 +0100 Subject: tv: adopt kaepsele --- krebs/3modules/tv/default.nix | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index 31c1a375a..5f70f8489 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -130,6 +130,35 @@ with lib; }; ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBaMjBJ/BfYlHjyn5CO0xzFNaQ0LPvMP3W9UlOs1OxGY"; }; + kaepsele = { + nets = { + internet = { + addrs4 = ["92.222.10.169"]; + aliases = [ + "kaepsele.internet" + # TODO "kaepsele.org" + ]; + }; + retiolum = { + addrs4 = ["10.243.166.2"]; + addrs6 = ["42:0b9d:6660:d07c:2bb7:4e91:1a01:2e7d"]; + aliases = [ + "kaepsele.retiolum" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEAxj7kaye4pGLou7mVRTVgtcWFjuEosJlxVg24gM7nU1EaoRnBD93/ + Y3Je7BSUbz5xMXr5SFTPSkitInL7vU+jDOf2bEpqv+uUJAJIz85494oPS9xocdWo + rQsrQRAtOg4MLD+YIoAxQm2Mc4nt2CSE1+UP4uXGxpuh0c051b+9Kmwv1bTyHB9y + y01VSkDvNyHk5eA+RGDiujBAzhi35hzTlQgCJ3REOBiq4YmE1d3qpk3oNiYUcrcu + yFzQrSRIfhXjuzIR+wxqS95HDUsewSwt9HgkjJzYF5sQZSea0/XsroFqZyTJ8iB5 + FQx2emBqB525cWKOt0f5jgyjklhozhJyiwIDAQAB + -----END RSA PUBLIC KEY----- + ''; + }; + }; + ssh.pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDA9cDUg7qm37uOhQpdKSgpnJPWao9VZR6LFNphVcJQ++gYvVgWu6WMhigiy7DcGQSStUlXkZc4HZBBugwwNWcf7aAF6ijBuG5rVwb9AFQmSexpTOfWap33iA5f+LXYFHe7iv4Pt9TYO1ga1Ryl4EGKb7ol2h5vbKC+JiGaDejB0WqhBAyrTg4tTWO8k2JT11CrlTjNVctqV0IVAMtTc/hcJcNusnoGD4ic0QGSzEMYxcIGRNvIgWmxhI6GHeaHxXWH5fv4b0OpLlDfVUsIvEo9KVozoLGm/wgLBG/tQXKaF9qVMVgOYi9sX/hDLwhRrcD2cyAlq9djo2pMARYiriXF"; + }; nomic = { cores = 2; dc = "tv"; #dc = "gg23"; -- cgit v1.2.3 From c4655c3baad28525550e7c1d0fb9589e06663a2b Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 16:21:30 +0100 Subject: krebs.dns.providers: add i and r --- krebs/3modules/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 20eb944e2..529506905 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -92,7 +92,9 @@ let de.krebsco = "zones"; gg23 = "hosts"; shack = "hosts"; + i = "hosts"; internet = "hosts"; + r = "hosts"; retiolum = "hosts"; }; -- cgit v1.2.3 From b16bfb9c99e6f1f063c5b7358003149db42b70e3 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 16:18:52 +0100 Subject: tv: add .i and .r TLDs --- krebs/3modules/tv/default.nix | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index 5f70f8489..7db5c532e 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -24,6 +24,7 @@ with lib; internet = { addrs4 = ["162.219.7.216"]; aliases = [ + "cd.i" "cd.internet" "cd.krebsco.de" "cgit.cd.krebsco.de" @@ -37,6 +38,7 @@ with lib; addrs4 = ["10.243.113.222"]; addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af3"]; aliases = [ + "cd.r" "cd.retiolum" "cgit.cd.retiolum" ]; @@ -67,6 +69,7 @@ with lib; internet = { addrs4 = ["104.167.114.142"]; aliases = [ + "mkdir.i" "mkdir.internet" ]; }; @@ -75,6 +78,7 @@ with lib; addrs4 = ["10.243.113.223"]; addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af4"]; aliases = [ + "mkdir.r" "mkdir.retiolum" "cgit.mkdir.retiolum" ]; @@ -104,6 +108,7 @@ with lib; internet = { addrs4 = ["198.147.22.115"]; aliases = [ + "ire.i" "ire.internet" "ire.krebsco.de" ]; @@ -113,6 +118,7 @@ with lib; addrs4 = ["10.243.231.66"]; addrs6 = ["42:b912:0f42:a82d:0d27:8610:e89b:490c"]; aliases = [ + "ire.r" "ire.retiolum" ]; tinc.pubkey = '' @@ -135,6 +141,7 @@ with lib; internet = { addrs4 = ["92.222.10.169"]; aliases = [ + "kaepsele.i" "kaepsele.internet" # TODO "kaepsele.org" ]; @@ -143,6 +150,7 @@ with lib; addrs4 = ["10.243.166.2"]; addrs6 = ["42:0b9d:6660:d07c:2bb7:4e91:1a01:2e7d"]; aliases = [ + "kaepsele.r" "kaepsele.retiolum" ]; tinc.pubkey = '' @@ -171,6 +179,7 @@ with lib; addrs4 = ["10.243.0.110"]; addrs6 = ["42:02d5:733f:d6da:c0f5:2bb7:2b18:09ec"]; aliases = [ + "nomic.r" "nomic.retiolum" "cgit.nomic.retiolum" ]; @@ -205,6 +214,7 @@ with lib; internet = { addrs4 = ["167.88.34.182"]; aliases = [ + "rmdir.i" "rmdir.internet" ]; }; @@ -213,6 +223,7 @@ with lib; addrs4 = ["10.243.113.224"]; addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af5"]; aliases = [ + "rmdir.r" "rmdir.retiolum" "cgit.rmdir.retiolum" ]; @@ -260,6 +271,7 @@ with lib; addrs4 = ["10.243.13.37"]; addrs6 = ["42:0:0:0:0:0:0:1337"]; aliases = [ + "wu.r" "wu.retiolum" "cgit.wu.retiolum" ]; @@ -292,6 +304,7 @@ with lib; addrs4 = ["10.243.13.38"]; addrs6 = ["42:0:0:0:0:0:0:1338"]; aliases = [ + "xu.r" "xu.retiolum" ]; tinc.pubkey = '' -- cgit v1.2.3 From 18784b439d6c58eb4102068a5a31e0e46794ee73 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 16:30:56 +0100 Subject: tv: remove stale krebs/Zpubkeys --- krebs/Zpubkeys/deploy_wu.ssh.pub | 1 - krebs/Zpubkeys/mv_vod.ssh.pub | 1 - 2 files changed, 2 deletions(-) delete mode 100644 krebs/Zpubkeys/deploy_wu.ssh.pub delete mode 100644 krebs/Zpubkeys/mv_vod.ssh.pub diff --git a/krebs/Zpubkeys/deploy_wu.ssh.pub b/krebs/Zpubkeys/deploy_wu.ssh.pub deleted file mode 100644 index a54a1ca37..000000000 --- a/krebs/Zpubkeys/deploy_wu.ssh.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEieAihh+o208aeCA14fAtjzyZN/nrpOJt2vZ5VYZp69 deploy@wu diff --git a/krebs/Zpubkeys/mv_vod.ssh.pub b/krebs/Zpubkeys/mv_vod.ssh.pub deleted file mode 100644 index 7b7d2e260..000000000 --- a/krebs/Zpubkeys/mv_vod.ssh.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGer9e2+Lew7vnisgBbsFNECEIkpNJgEaqQqgb9inWkQ mv@vod -- cgit v1.2.3 From 9742953ee932b96cafb390f7b61edd68499cec82 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 16:53:35 +0100 Subject: tv: add cgit.*.r aliases --- krebs/3modules/tv/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index 7db5c532e..b7fd1c54c 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -40,6 +40,7 @@ with lib; aliases = [ "cd.r" "cd.retiolum" + "cgit.cd.r" "cgit.cd.retiolum" ]; tinc.pubkey = '' @@ -80,6 +81,7 @@ with lib; aliases = [ "mkdir.r" "mkdir.retiolum" + "cgit.mkdir.r" "cgit.mkdir.retiolum" ]; tinc.pubkey = '' @@ -181,6 +183,7 @@ with lib; aliases = [ "nomic.r" "nomic.retiolum" + "cgit.nomic.r" "cgit.nomic.retiolum" ]; tinc.pubkey = '' @@ -225,6 +228,7 @@ with lib; aliases = [ "rmdir.r" "rmdir.retiolum" + "cgit.rmdir.r" "cgit.rmdir.retiolum" ]; tinc.pubkey = '' @@ -273,6 +277,7 @@ with lib; aliases = [ "wu.r" "wu.retiolum" + "cgit.wu.r" "cgit.wu.retiolum" ]; tinc.pubkey = '' -- cgit v1.2.3 From c784d271c5dc8783e5e6308baf4f6dd26430bfca Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 18:38:51 +0100 Subject: tv: adopt mu --- krebs/3modules/tv/default.nix | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index b7fd1c54c..9adb0ce11 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -169,6 +169,28 @@ with lib; }; ssh.pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDA9cDUg7qm37uOhQpdKSgpnJPWao9VZR6LFNphVcJQ++gYvVgWu6WMhigiy7DcGQSStUlXkZc4HZBBugwwNWcf7aAF6ijBuG5rVwb9AFQmSexpTOfWap33iA5f+LXYFHe7iv4Pt9TYO1ga1Ryl4EGKb7ol2h5vbKC+JiGaDejB0WqhBAyrTg4tTWO8k2JT11CrlTjNVctqV0IVAMtTc/hcJcNusnoGD4ic0QGSzEMYxcIGRNvIgWmxhI6GHeaHxXWH5fv4b0OpLlDfVUsIvEo9KVozoLGm/wgLBG/tQXKaF9qVMVgOYi9sX/hDLwhRrcD2cyAlq9djo2pMARYiriXF"; }; + mu = { + nets = { + retiolum = { + addrs4 = ["10.243.20.01"]; + addrs6 = ["42:0:0:0:0:0:0:2001"]; + aliases = [ + "mu.r" + "mu.retiolum" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEApXErmPSn2CO4V25lqxanCGCFgxEAjdzFUiTCCu0IvELEuCc3PqVA + g4ecf8gGwPCbzMW/1txjlgbsQcm87U5enaCwzSv/pa7P9/memV74OhqEVOypFlDE + XeZczqQfNbjoLYl4cKZpTsSZmOgASXaMDrH2N37f50q35C0MQw0HRzaQM5VLrzb4 + o87MClS+yPqpvp34QjW+1lqnOKvMkr6mDrmtcAjCOs9Ma16txyfjGVFi8KmYqIs1 + QEJmyC9Uocz5zuoSLUghgVRn9yl4+MEw6++akFDwKt/eMkcSq0GPB+3Rz/WLDiBs + FK6BsssQWdwiEWpv6xIl1Fi+s7F0riq2cwIDAQAB + -----END RSA PUBLIC KEY----- + ''; + }; + }; + }; nomic = { cores = 2; dc = "tv"; #dc = "gg23"; -- cgit v1.2.3 [cgit] Unable to lock slot /tmp/cgit/2b200000.lock: No such file or directory (2)