Merge branch 'staging/jeschli' of prism.r:stockholm into staging/jeschli

19 files changed, 347 insertions, 110 deletions

diff --git a/.gitignore b/.gitignore
index e1c6ef9..d17552e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 /.graveyard
 /TODO
+result
diff --git a/jeschli/1systems/bln/config.nix b/jeschli/1systems/bln/config.nix
index 885307b..6142933 100644
--- a/jeschli/1systems/bln/config.nix
+++ b/jeschli/1systems/bln/config.nix
@@ -3,12 +3,13 @@
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
 { config, lib, pkgs, ... }:
-
+# bln config file
 {
   imports =
     [ # Include the results of the hardware scan.
       <stockholm/jeschli>
       <stockholm/jeschli/2configs/virtualbox.nix>
+      <stockholm/jeschli/2configs/urxvt.nix>
       ./hardware-configuration.nix
       # ./dcso-vpn.nix
     ];
@@ -16,10 +17,18 @@
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
+  jeschliFontSize = 20;
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
+  # boot.loader.grub.efiSupport = true;
+  # boot.loader.grub.efiInstallAsRemovable = true;
+  # boot.loader.efi.efiSysMountPoint = "/boot/efi";
+  # Define on which hard drive you want to install Grub.
   environment.shellAliases = {
     n = "nix-shell";
-    gd = "cd /home/jeschli/go/src/gitlab.dcso.lolcat";
-    gh = "cd /home/jeschli/go/src/github.com";
+    gd = "cd /home/markus/go/src/gitlab.dcso.lolcat";
+    gh = "cd /home/markus/go/src/github.com";
     stocki = pkgs.writeDash "deploy" ''
       cd ~/stockholm
       LOGNAME=jeschli exec nix-shell -I stockholm="$PWD" --run 'deploy  --system="bln"'
@@ -33,6 +42,7 @@
   nixpkgs.config.allowUnfree = true;
   environment.variables = { GOROOT= [ "${pkgs.go.out}/share/go" ]; };
   environment.systemPackages = with pkgs; [
+    termite
   # system helper
     ag
     copyq
@@ -57,6 +67,7 @@
     chromium
     google-chrome
   # programming languages
+    elmPackages.elm
     go
     gcc
     ghc
diff --git a/jeschli/1systems/brauerei/config.nix b/jeschli/1systems/brauerei/config.nix
index e4109c6..eb2bb11 100644
--- a/jeschli/1systems/brauerei/config.nix
+++ b/jeschli/1systems/brauerei/config.nix
@@ -79,6 +79,8 @@
     jetbrains.goland
   # document viewer
     zathura
+  # xorg
+    xorg.xbacklight
   ];
 
   # Some programs need SUID wrappers, can be configured further or are
diff --git a/jeschli/1systems/enklave/config.nix b/jeschli/1systems/enklave/config.nix
index 76e7186..470566a 100644
--- a/jeschli/1systems/enklave/config.nix
+++ b/jeschli/1systems/enklave/config.nix
@@ -40,6 +40,16 @@
         };
       };
     }
+    {
+      services.taskserver = {
+        enable = true;
+        fqdn = "enklave.r";
+        listenHost = "::";
+        listenPort = 53589;
+        organisations.lass.users = [ "jeschli" ];
+      };
+      networking.firewall.allowedTCPPorts = [ 53589 ];
+    }
   ];
 
   krebs.build.host = config.krebs.hosts.enklave;
diff --git a/jeschli/1systems/enklave/taskserver.nix b/jeschli/1systems/enklave/taskserver.nix
new file mode 100644
index 0000000..23b235d
--- /dev/null
+++ b/jeschli/1systems/enklave/taskserver.nix
@@ -0,0 +1,10 @@
+    {
+      services.taskserver = {
+        enable = true;
+        fqdn = "enklave.r";
+        listenHost = "::";
+        listenPort = 53589;
+        organisations.lass.users = [ "jeschli" ];
+      };
+      networking.firewall.allowedTCPPorts = [ 53589 ];
+    }
diff --git a/jeschli/2configs/default.nix b/jeschli/2configs/default.nix
index 0ac3708..5aaabe2 100644
--- a/jeschli/2configs/default.nix
+++ b/jeschli/2configs/default.nix
@@ -4,6 +4,7 @@ with import <stockholm/lib>;
   imports = [
     ./vim.nix
     ./retiolum.nix
+    ./zsh.nix
     <stockholm/lass/2configs/security-workarounds.nix>
     {
       environment.variables = {
diff --git a/jeschli/2configs/urxvt.nix b/jeschli/2configs/urxvt.nix
index 69811eb..0149187 100644
--- a/jeschli/2configs/urxvt.nix
+++ b/jeschli/2configs/urxvt.nix
@@ -1,34 +1,39 @@
 { config, pkgs, ... }:
 with import <stockholm/lib>;
-
 {
-  services.urxvtd.enable = true;
-  krebs.xresources.enable = true;
-  krebs.xresources.resources.urxvt = ''
-  *foreground: rgb:a8/a8/a8
-  *background: rgb:00/00/00
-  *faceName: DejaVu Sans Mono
-  *faceSize: 12
-  *color0: rgb:00/00/00
-  *color1: rgb:a8/00/00
-  *color2: rgb:00/a8/00
-  *color3: rgb:a8/54/00
-  *color4: rgb:00/00/a8
-  *color5: rgb:a8/00/a8
-  *color6: rgb:00/a8/a8
-  *color7: rgb:a8/a8/a8
-  *color8: rgb:54/54/54
-  *color9: rgb:fc/54/54
-  *color10: rgb:54/fc/54
-  *color11: rgb:fc/fc/54
-  *color12: rgb:54/54/fc
-  *color13: rgb:fc/54/fc
-  *color14: rgb:54/fc/fc
-  *color15: rgb:fc/fc/fc
-  
-  URxvt*scrollBar:                      false
-  URxvt*urgentOnBell:                   true
-  URxvt*font: xft:DejaVu Sans Mono:pixelsize=12
-  URXvt*faceSize: 12
-  '';
+  options.jeschliFontSize = mkOption {
+    type = types.int;
+    default = 12;
+  };
+  config = {
+    services.urxvtd.enable = true;
+    krebs.xresources.enable = true;
+    krebs.xresources.resources.urxvt = ''
+    *foreground: rgb:a8/a8/a8
+    *background: rgb:00/00/00
+    *faceName: DejaVu Sans Mono
+    *faceSize: ${toString config.jeschliFontSize}
+    *color0: rgb:00/00/00
+    *color1: rgb:a8/00/00
+    *color2: rgb:00/a8/00
+    *color3: rgb:a8/54/00
+    *color4: rgb:26/8b/d2
+    *color5: rgb:a8/00/a8
+    *color6: rgb:00/a8/a8
+    *color7: rgb:a8/a8/a8
+    *color8: rgb:54/54/54
+    *color9: rgb:fc/54/54
+    *color10: rgb:54/fc/54
+    *color11: rgb:fc/fc/54
+    *color12: rgb:54/54/fc
+    *color13: rgb:fc/54/fc
+    *color14: rgb:54/fc/fc
+    *color15: rgb:fc/fc/fc
+    
+    URxvt*scrollBar:                      false
+    URxvt*urgentOnBell:                   true
+    URxvt*font: xft:DejaVu Sans Mono:pixelsize=${toString config.jeschliFontSize}
+    URXvt*faceSize: ${toString config.jeschliFontSize}
+    '';
+  }; 
 }
diff --git a/jeschli/2configs/vim.nix b/jeschli/2configs/vim.nix
index 7721b1d..c13113f 100644
--- a/jeschli/2configs/vim.nix
+++ b/jeschli/2configs/vim.nix
@@ -27,6 +27,9 @@ in {
       name = "vim";
       vimrcConfig.customRC = let
         colorscheme = ''colorscheme molokai'';
+        highlightTrailingWhiteSpaces = ''
+          au Syntax * syn match Garbage containedin=ALL /\s\+$/
+        '';
         setStatements = ''
           set autowrite
           set clipboard=unnamedplus
@@ -42,6 +45,7 @@ in {
         remapStatements = ''
           imap jk <Esc>
           map gr :GoRun<Enter>         " Map gr to execute go run
+          map tt :GoTest<Enter>        " Map tt to execute go test
           map nf :NERDTreeToggle<CR>
           nnoremap <C-TAB> <c-w><c-w>
           nnoremap <S-TAB> :bnext<CR>
@@ -74,11 +78,12 @@ in {
         '';
       in ''
         ${colorscheme}
+        ${highlightTrailingWhiteSpaces}
         ${remapStatements}
         ${setStatements}
         ${settingsForElm}
         ${settingsForGo}
-        " I dont know what this line is about
+        " dont expand tabs in go files and show it with four whitespaces.
         autocmd BufNewFile,BufRead *.go setlocal noexpandtab tabstop=4 shiftwidth=4
       '';
        vimrcConfig.vam.knownPlugins = pkgs.vimPlugins // customPlugins;
diff --git a/jeschli/2configs/zsh.nix b/jeschli/2configs/zsh.nix
new file mode 100644
index 0000000..be5b661
--- /dev/null
+++ b/jeschli/2configs/zsh.nix
@@ -0,0 +1,138 @@
+{ config, lib, pkgs, ... }:
+{
+  environment.systemPackages = [ pkgs.fzf ];
+  programs.zsh = {
+    enable = true;
+    shellInit = ''
+      #disable config wizard
+      zsh-newuser-install() { :; }
+    '';
+    interactiveShellInit = ''
+      setopt autocd extendedglob
+      bindkey -e
+
+      #history magic
+      bindkey "" up-line-or-local-history
+      bindkey "" down-line-or-local-history
+
+      up-line-or-local-history() {
+          zle set-local-history 1
+          zle up-line-or-history
+          zle set-local-history 0
+      }
+      zle -N up-line-or-local-history
+      down-line-or-local-history() {
+          zle set-local-history 1
+          zle down-line-or-history
+          zle set-local-history 0
+      }
+      zle -N down-line-or-local-history
+
+      setopt share_history
+      setopt hist_ignore_dups
+      # setopt inc_append_history
+      bindkey '^R' history-incremental-search-backward
+
+      #C-x C-e open line in editor
+      autoload -z edit-command-line
+      zle -N edit-command-line
+      bindkey "^X^E" edit-command-line
+
+      #fzf inclusion
+      source ${pkgs.fzf}/share/fzf/completion.zsh
+      source ${pkgs.fzf}/share/fzf/key-bindings.zsh
+
+      #completion magic
+      autoload -Uz compinit
+      compinit
+      zstyle ':completion:*' menu select
+
+      #enable automatic rehashing of $PATH
+      zstyle ':completion:*' rehash true
+
+      eval $(dircolors -b ${pkgs.fetchFromGitHub {
+        owner = "trapd00r";
+        repo = "LS_COLORS";
+        rev = "master";
+        sha256="05lh5w3bgj9h8d8lrbbwbzw8788709cnzzkl8yh7m1dawkpf6nlp";
+      }}/LS_COLORS)
+
+      #beautiful colors
+      alias ls='ls --color'
+      # zstyle ':completion:*:default' list-colors ''${(s.:.)LS_COLORS}
+
+      #emacs bindings
+      bindkey "[7~" beginning-of-line
+      bindkey "[8~" end-of-line
+      bindkey "Oc" emacs-forward-word
+      bindkey "Od" emacs-backward-word
+
+      #aliases
+      alias ll='ls -l'
+      alias la='ls -la'
+
+      #fancy window title magic
+    '';
+    promptInit = ''
+      # TODO: figure out why we need to set this here
+      HISTSIZE=900001
+      HISTFILESIZE=$HISTSIZE
+      SAVEHIST=$HISTSIZE
+
+      autoload -U promptinit
+      promptinit
+
+      p_error='%(?..%F{red}%?%f )'
+      t_error='%(?..%? )'
+
+      case $UID in
+        0)
+          p_username='%F{red}root%f'
+          t_username='root'
+          ;;
+        1337)
+          p_username=""
+          t_username=""
+          ;;
+        *)
+          p_username='%F{blue}%n%f'
+          t_username='%n'
+          ;;
+      esac
+
+      if test -n "$SSH_CLIENT"; then
+        p_hostname='@%F{magenta}%M%f '
+        t_hostname='@%M '
+      else
+        p_hostname=""
+        t_hostname=""
+      fi
+
+      #check if in nix shell
+      if test -n "$buildInputs"; then
+        p_nixshell='%F{green}[s]%f '
+        t_nixshell='[s] '
+      else
+        p_nixshell=""
+        t_nixshell=""
+      fi
+
+      PROMPT="$p_error$p_username$p_hostname$p_nixshell%~ "
+      TITLE="$t_error$t_username$t_hostname$t_nixshell%~"
+      case $TERM in
+        (*xterm* | *rxvt*)
+          function precmd {
+            PROMPT_EVALED="$(print -P $TITLE)"
+            echo -ne "\033]0;$$ $PROMPT_EVALED\007"
+          }
+          # This is seen while the shell waits for a command to complete.
+          function preexec {
+            PROMPT_EVALED="$(print -P $TITLE)"
+            echo -ne "\033]0;$$ $PROMPT_EVALED $1\007"
+          }
+        ;;
+      esac
+    '';
+  };
+  users.defaultUserShell = "/run/current-system/sw/bin/zsh";
+}
diff --git a/jeschli/source.nix b/jeschli/source.nix
index d5cc32a..91ff551 100644
--- a/jeschli/source.nix
+++ b/jeschli/source.nix
@@ -4,6 +4,11 @@ host@{ name, secure ? false, override ? {} }: let
               then "buildbot"
               else "jeschli";
   _file = <stockholm> + "/jeschli/1systems/${name}/source.nix";
+  pkgs = import <nixpkgs> {
+    overlays = map import [
+      <stockholm/krebs/5pkgs>
+    ];
+  };
 in
   evalSource (toString _file) [
     {
@@ -17,6 +22,7 @@ in
         jeschli = "${getEnv "HOME"}/secrets/${name}";
       };
       stockholm.file = toString <stockholm>;
+      stockholm-version.pipe = "${pkgs.stockholm}/bin/get-version";
     }
     override
   ]
diff --git a/lib/types.nix b/lib/types.nix
index b857949..1cf2d96 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -2,7 +2,7 @@
 
 let
   inherit (lib)
-    all any concatMapStringsSep concatStringsSep const filter flip
+    all any attrNames concatMapStringsSep concatStringsSep const filter flip
     genid hasSuffix head isInt isString length mergeOneOption mkOption
     mkOptionType optional optionalAttrs optionals range splitString
     stringLength substring test testString typeOf;
@@ -231,90 +231,93 @@ rec {
   source = submodule ({ config, ... }: {
     options = {
       type = let
-        types = [
-          "file"
-          "git"
-          "pass"
-          "symlink"
-        ];
+        known-types = attrNames source-types;
+        type-candidates = filter (k: config.${k} != null) known-types;
       in mkOption {
-        type = enum types;
-        default = let
-          cands = filter (k: config.${k} != null) types;
-        in
-          if length cands == 1
-            then head cands
-            else throw "cannot determine type";
-      };
-      file = let
-        file-path = (file-source.getSubOptions "FIXME").path.type;
-      in mkOption {
-        type = nullOr (either file-source file-path);
-        default = null;
+        default = if length type-candidates == 1
+                    then head type-candidates
+                    else throw "cannot determine type";
+        type = enum known-types;
+      };
+      file = mkOption {
         apply = x:
-          if file-path.check x
+          if absolute-pathname.check x
             then { path = x; }
             else x;
+        default = null;
+        type = nullOr (either absolute-pathname source-types.file);
       };
       git = mkOption {
-        type = nullOr git-source;
         default = null;
+        type = nullOr source-types.git;
       };
       pass = mkOption {
-        type = nullOr pass-source;
         default = null;
+        type = nullOr source-types.pass;
       };
-      symlink = let
-        symlink-target = (symlink-source.getSubOptions "FIXME").target.type;
-      in mkOption {
-        type = nullOr (either symlink-source symlink-target);
+      pipe = mkOption {
+        apply = x:
+          if absolute-pathname.check x
+            then { command = x; }
+            else x;
+        default = null;
+        type = nullOr (either absolute-pathname source-types.pipe);
+      };
+      symlink = mkOption {
+        type = nullOr (either pathname source-types.symlink);
         default = null;
         apply = x:
-          if symlink-target.check x
+          if pathname.check x
             then { target = x; }
             else x;
       };
     };
   });
 
-  file-source = submodule {
-    options = {
-      path = mkOption {
-        type = absolute-pathname;
+  source-types = {
+    file = submodule {
+      options = {
+        path = mkOption {
+          type = absolute-pathname;
+        };
       };
     };
-  };
-
-  git-source = submodule {
-    options = {
-      ref = mkOption {
-        type = str; # TODO types.git.ref
-      };
-      url = mkOption {
-        type = str; # TODO types.git.url
+    git = submodule {
+      options = {
+        ref = mkOption {
+          type = str; # TODO types.git.ref
+        };
+        url = mkOption {
+          type = str; # TODO types.git.url
+        };
       };
     };
-  };
-
-  pass-source = submodule {
-    options = {
-      dir = mkOption {
-        type = absolute-pathname;
+    pass = submodule {
+      options = {
+        dir = mkOption {
+          type = absolute-pathname;
+        };
+        name = mkOption {
+          type = pathname; # TODO relative-pathname
+        };
       };
-      name = mkOption {
-        type = pathname; # TODO relative-pathname
+    };
+    pipe = submodule {
+      options = {
+        command = mkOption {
+          type = absolute-pathname;
+        };
       };
     };
-  };
-
-  symlink-source = submodule {
-    options = {
-      target = mkOption {
-        type = pathname; # TODO relative-pathname
+    symlink = submodule {
+      options = {
+        target = mkOption {
+          type = pathname; # TODO relative-pathname
+        };
       };
     };
-  };
 
+  };
 
   suffixed-str = suffs:
     mkOptionType {
diff --git a/mv/source.nix b/mv/source.nix
index 5f6b2fe..1a7b839 100644
--- a/mv/source.nix
+++ b/mv/source.nix
@@ -4,6 +4,11 @@ host@{ name, override ? {} }: let
               then "buildbot"
               else "mv";
   _file = <stockholm> + "/mv/1systems/${name}/source.nix";
+  pkgs = import <nixpkgs> {
+    overlays = map import [
+      <stockholm/krebs/5pkgs>
+    ];
+  };
 in
   evalSource (toString _file) [
     {
@@ -18,6 +23,7 @@ in
         mv = "/home/mv/secrets/${name}";
       };
       stockholm.file = toString <stockholm>;
+      stockholm-version.pipe = "${pkgs.stockholm}/bin/get-version";
     }
     override
   ]
diff --git a/nin/1systems/axon/config.nix b/nin/1systems/axon/config.nix
index c5f38c1..483a4f8 100644
--- a/nin/1systems/axon/config.nix
+++ b/nin/1systems/axon/config.nix
@@ -11,6 +11,7 @@ with lib;
     <stockholm/nin>
     <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
     #../2configs/copyq.nix
+    <stockholm/nin/2configs/ableton.nix>
     <stockholm/nin/2configs/games.nix>
     <stockholm/nin/2configs/git.nix>
     <stockholm/nin/2configs/retiolum.nix>
@@ -98,6 +99,9 @@ with lib;
     enable = true;
   };
 
+  services.xserver.displayManager.sessionCommands = ''
+    ${pkgs.xorg.xhost}/bin/xhost + local:
+  '';
 
   services.xserver.desktopManager.xfce = let
     xbindConfig = pkgs.writeText "xbindkeysrc" ''
diff --git a/nin/2configs/ableton.nix b/nin/2configs/ableton.nix
new file mode 100644
index 0000000..343a908
--- /dev/null
+++ b/nin/2configs/ableton.nix
@@ -0,0 +1,20 @@
+{ config, pkgs, ... }: let
+  mainUser = config.users.extraUsers.nin;
+in {
+  users.users= {
+    ableton = {
+      isNormalUser = true;
+      extraGroups = [
+        "audio"
+        "video"
+      ];
+      packages = [
+        pkgs.wine
+        pkgs.winetricks
+      ];
+    };
+  };
+  security.sudo.extraConfig = ''
+    ${mainUser.name} ALL=(ableton) NOPASSWD: ALL
+  '';
+}
diff --git a/nin/2configs/git.nix b/nin/2configs/git.nix
index 9ebbaab..aed4a9f 100644
--- a/nin/2configs/git.nix
+++ b/nin/2configs/git.nix
@@ -36,17 +36,6 @@ let
   make-public-repo = name: { cgit ? {}, ... }: {
     inherit cgit name;
     public = true;
-    hooks = {
-      post-receive = pkgs.git-hooks.irc-announce {
-        # TODO make nick = config.krebs.build.host.name the default
-        nick = config.krebs.build.host.name;
-        channel = "#xxx";
-        server = "irc.r";
-        verbose = config.krebs.build.host.name == "onondaga";
-        # TODO define branches in some kind of option per repo
-        branches = [ "master" ];
-      };
-    };
   };
 
   make-rules =
diff --git a/nin/2configs/im.nix b/nin/2configs/im.nix
new file mode 100644
index 0000000..b078dbd
--- /dev/null
+++ b/nin/2configs/im.nix
@@ -0,0 +1,19 @@
+{ config, lib, pkgs, ... }:
+with import <stockholm/lib>;
+{
+  environment.systemPackages = with pkgs; [
+    (pkgs.writeDashBin "im" ''
+      export PATH=${makeSearchPath "bin" (with pkgs; [
+        tmux
+        gnugrep
+        weechat
+      ])}
+      ssh chat@onondaga
+      if tmux list-sessions -F\#S | grep -q '^im''$'; then
+        exec tmux attach -t im
+      else
+        exec tmux new -s im weechat
+      fi
+    '')
+  ];
+}
diff --git a/nin/source.nix b/nin/source.nix
index ccf5e6a..9fb2cb3 100644
--- a/nin/source.nix
+++ b/nin/source.nix
@@ -4,6 +4,11 @@ host@{ name, secure ? false }: let
               then "buildbot"
               else "nin";
   _file = <stockholm> + "/nin/1systems/${name}/source.nix";
+  pkgs = import <nixpkgs> {
+    overlays = map import [
+      <stockholm/krebs/5pkgs>
+    ];
+  };
 in
   evalSource (toString _file) {
     nixos-config.symlink = "stockholm/nin/1systems/${name}/config.nix";
@@ -12,8 +17,6 @@ in
       nin = "/home/nin/secrets/${name}";
     };
     stockholm.file = toString <stockholm>;
-    nixpkgs.git = {
-      url = https://github.com/nixos/nixpkgs;
-      ref = "afe9649";
-    };
+    stockholm-version.pipe = "${pkgs.stockholm}/bin/get-version";
+    nixpkgs = (import <stockholm/krebs/source.nix> host).nixpkgs;
   }
diff --git a/tv/2configs/gitrepos.nix b/tv/2configs/gitrepos.nix
index 2c4b486..c3418e7 100644
--- a/tv/2configs/gitrepos.nix
+++ b/tv/2configs/gitrepos.nix
@@ -42,6 +42,9 @@ let {
     kirk = {
       cgit.desc = "IRC tools";
     };
+    kops = {
+      cgit.desc = "deployment tools";
+    };
     load-env = {};
     loldns = {
       cgit.desc = "toy DNS server";
@@ -128,11 +131,6 @@ let {
         repo = [ repo ];
         perm = push "refs/*" [ non-fast-forward create delete merge ];
       } ++
-      optional repo.public {
-        user = attrValues config.krebs.users;
-        repo = [ repo ];
-        perm = fetch;
-      } ++
       optional (repo.collaborators or [] != []) {
         user = repo.collaborators;
         repo = [ repo ];
diff --git a/tv/source.nix b/tv/source.nix
index b5e3f7c..e5e5e04 100644
--- a/tv/source.nix
+++ b/tv/source.nix
@@ -6,6 +6,11 @@ with import <stockholm/lib>;
 }@host: let
   builder = if dummy_secrets then "buildbot" else "tv";
   _file = <stockholm> + "/tv/1systems/${name}/source.nix";
+  pkgs = import <nixpkgs> {
+    overlays = map import [
+      <stockholm/krebs/5pkgs>
+    ];
+  };
 in
   evalSource (toString _file) [
     {
@@ -20,6 +25,7 @@ in
         tv = "/home/tv/secrets/${name}";
       };
       stockholm.file = toString <stockholm>;
+      stockholm-version.pipe = "${pkgs.stockholm}/bin/get-version";
     }
     (mkIf (builder == "tv") {
       secrets-common.file = "/home/tv/secrets/common";