diff options
Diffstat (limited to '3modules')
-rw-r--r-- | 3modules/tv/consul.nix | 19 | ||||
-rw-r--r-- | 3modules/tv/ejabberd.nix | 3 | ||||
-rw-r--r-- | 3modules/tv/git.nix | 8 | ||||
-rw-r--r-- | 3modules/tv/github-hosts-sync.nix | 2 | ||||
-rw-r--r-- | 3modules/tv/identity.nix | 123 | ||||
-rw-r--r-- | 3modules/tv/retiolum.nix | 29 | ||||
-rw-r--r-- | 3modules/tv/urlwatch.nix | 24 |
7 files changed, 91 insertions, 117 deletions
diff --git a/3modules/tv/consul.nix b/3modules/tv/consul.nix index 4801984..312faa0 100644 --- a/3modules/tv/consul.nix +++ b/3modules/tv/consul.nix @@ -5,8 +5,7 @@ # TODO consul-bootstrap HOST that actually does is # TODO tools to inspect state of a cluster in outage state -with builtins; -with lib; +with import ../../4lib/tv { inherit lib pkgs; }; let cfg = config.tv.consul; @@ -24,10 +23,10 @@ let enable = mkEnableOption "tv.consul"; dc = mkOption { - type = types.unspecified; + type = types.label; }; hosts = mkOption { - type = with types; listOf unspecified; + type = with types; listOf host; }; encrypt-file = mkOption { type = types.str; # TODO path (but not just into store) @@ -38,7 +37,7 @@ let default = "/var/lib/consul"; }; self = mkOption { - type = types.unspecified; + type = types.host; }; server = mkOption { type = types.bool; @@ -56,9 +55,11 @@ let log_level = "INFO"; #node_name = server = cfg.server; - bind_addr = cfg.self.addr; # TODO cfg.addr enable_syslog = true; - retry_join = map (getAttr "addr") (filter (host: host.fqdn != cfg.self.fqdn) cfg.hosts); + retry_join = + # TODO allow consul in other nets than retiolum [maybe] + concatMap (host: host.nets.retiolum.addrs) + (filter (host: host.name != cfg.self.name) cfg.hosts); leave_on_terminate = true; } // optionalAttrs cfg.server { bootstrap_expect = length cfg.hosts; @@ -88,7 +89,7 @@ let ExecStartPre = pkgs.writeScript "consul-init" '' #! /bin/sh mkdir -p ${cfg.data-dir} - chown consul: ${cfg.data-dir} + chown ${user.name}: ${cfg.data-dir} install -o ${user.name} -m 0400 ${cfg.encrypt-file} /tmp/encrypt.json ''; ExecStart = pkgs.writeScript "consul-service" '' @@ -111,7 +112,7 @@ let user = { name = "consul"; - uid = 2983239726; # genid consul + uid = 2999951406; # genid consul }; in diff --git a/3modules/tv/ejabberd.nix b/3modules/tv/ejabberd.nix index b694d05..2910a9a 100644 --- a/3modules/tv/ejabberd.nix +++ b/3modules/tv/ejabberd.nix @@ -55,8 +55,7 @@ let user = { name = "ejabberd"; - uid = 405222; - # TODO uid = 3483034447; # genid ejabberd + uid = 3499746127; # genid ejabberd }; my-ejabberdctl = pkgs.writeScriptBin "ejabberdctl" '' diff --git a/3modules/tv/git.nix b/3modules/tv/git.nix index 8d2ab48..8c73d03 100644 --- a/3modules/tv/git.nix +++ b/3modules/tv/git.nix @@ -149,7 +149,7 @@ let shell = "/bin/sh"; openssh.authorizedKeys.keys = mapAttrsToList (_: makeAuthorizedKey git-ssh-command) cfg.users; - uid = 112606723; # genid git + uid = 129318403; # genid git }; }; @@ -237,13 +237,13 @@ let fcgitwrap-user = { name = "fcgiwrap"; - uid = 2851179180; # genid fcgiwrap + uid = 2867890860; # genid fcgiwrap group = "fcgiwrap"; }; fcgitwrap-group = { - name = "fcgiwrap"; - gid = 2851179180; # genid fcgiwrap + name = fcgitwrap-user.name; + gid = fcgitwrap-user.uid; }; diff --git a/3modules/tv/github-hosts-sync.nix b/3modules/tv/github-hosts-sync.nix index 3da1064..f50bf2b 100644 --- a/3modules/tv/github-hosts-sync.nix +++ b/3modules/tv/github-hosts-sync.nix @@ -75,7 +75,7 @@ let user = { name = "github-hosts-sync"; - uid = 3203842966; # genid github-hosts-sync + uid = 3220554646; # genid github-hosts-sync }; Zpkgs = import ../../Zpkgs/tv { inherit pkgs; }; diff --git a/3modules/tv/identity.nix b/3modules/tv/identity.nix index d3ac913..584b271 100644 --- a/3modules/tv/identity.nix +++ b/3modules/tv/identity.nix @@ -1,6 +1,6 @@ -{ config, lib, ... }: +{ config, lib, pkgs, ... }: -with lib; +with import ../../4lib/tv { inherit lib pkgs; }; let cfg = config.tv.identity; @@ -13,77 +13,70 @@ let enable = mkEnableOption "tv.identity"; self = mkOption { - type = types.unspecified; + type = types.host; }; + + #others = mkOption { + # type = types.host; + # default = filterAttrs (name: _host: name != cfg.self.name) cfg.hosts; + #}; + hosts = mkOption { - type = with types; attrsOf unspecified; - default = { - cd = { - #dc = "cac"; - dc = "tv"; - fqdn = "cd.retiolum"; - subdomains = [ - "cgit" - ]; - addr = "10.243.113.222"; - addr6 = "42:4522:25f8:36bb:8ccb:0150:231a:2af3"; - #internet-addr = "162.219.5.183"; - cores = 2; - }; - mkdir = { - #dc = "cac"; - dc = "tv"; - fqdn = "mkdir.retiolum"; - subdomains = [ - "cgit" - ]; - addr = "10.243.113.223"; - cores = 1; - }; - nomic = { - #dc = "gg"; - dc = "tv"; - fqdn = "nomic.retiolum"; - subdomains = [ - "cgit" - ]; - addr = "10.243.0.110"; - cores = 2; - }; - rmdir = { - #dc = "cac"; - dc = "tv"; - fqdn = "rmdir.retiolum"; - subdomains = [ - "cgit" - ]; - addr = "10.243.113.224"; - #addr = "42:4522:25f8:36bb:8ccb:0150:231a:2af5"; - cores = 1; - }; - wu = { - #dc = "gg"; - dc = "tv"; - fqdn = "wu.retiolum"; - subdomains = [ - "cgit" - ]; - addr = "10.243.13.37"; - cores = 8; - }; - }; + type = with types; attrsOf host; + apply = mapAttrs (name: value: value // { inherit name; }); + }; + + search = mkOption { + type = types.hostname; }; }; imp = { networking.extraHosts = - let - f = name: { addr, fqdn, subdomains, ... }: '' - ${addr} ${toString (map (s: "${s}.${name} ${s}.${fqdn}") subdomains)} - ''; - in - concatStringsSep "\n" (mapAttrsToList f cfg.hosts); + concatStringsSep "\n" (flatten ( + # TODO deepMap ["hosts" "nets"] (hostname: host: netname: net: + mapAttrsToList (hostname: host: + mapAttrsToList (netname: net: + let + aliases = toString (unique (longs ++ shorts)); + longs = (splitByProvider net.aliases).hosts; + shorts = map (removeSuffix ".${cfg.search}") longs; + in + map (addr: "${addr} ${aliases}") net.addrs + ) host.nets + ) cfg.hosts + )); + }; + + # TODO move domain name providers to a dedicated module + # providers : tree label providername + providers = { + internet = "hosts"; + retiolum = "hosts"; + de.viljetic = "regfish"; + de.krebsco = "ovh"; }; + # splitByProvider : [alias] -> set providername [alias] + splitByProvider = foldl (acc: alias: insert (providerOf alias) alias acc) {}; + + # providerOf : alias -> providername + providerOf = alias: + tree-get (splitString "." alias) providers; + + # insert : k -> v -> set k [v] -> set k [v] + insert = name: value: set: + set // { ${name} = set.${name} or [] ++ [value]; }; + + # tree k v = set k (either v (tree k v)) + + # tree-get : [k] -> tree k v -> v + tree-get = path: x: + let + y = x.${last path}; + in + if typeOf y != "set" + then y + else tree-get (init path) y; in out diff --git a/3modules/tv/retiolum.nix b/3modules/tv/retiolum.nix index 8dc4197..ca1418c 100644 --- a/3modules/tv/retiolum.nix +++ b/3modules/tv/retiolum.nix @@ -46,7 +46,6 @@ let description = '' The tinc network name. It is used to generate long host entries, - derive the name of the user account under which tincd runs, and name the TUN device. ''; }; @@ -106,20 +105,22 @@ let # and the private key. ExecStartPre = pkgs.writeScript "retiolum-init" '' #! /bin/sh - install -o ${user} -m 0400 ${cfg.privateKeyFile} /tmp/retiolum-rsa_key.priv + install -o ${user.name} -m 0400 ${cfg.privateKeyFile} /tmp/retiolum-rsa_key.priv ''; - ExecStart = "${tinc}/sbin/tincd -c ${confDir} -d 0 -U ${user} -D"; + ExecStart = "${tinc}/sbin/tincd -c ${confDir} -d 0 -U ${user.name} -D"; SyslogIdentifier = "retiolum"; }; }; - # TODO user.name = "retiolum" users.extraUsers = singleton { - name = user; - uid = 2961822815; # bin/genid retiolum-tinc + inherit (user) name uid; }; }; + user = { + name = "retiolum"; + uid = 301281149; # genid retiolum + }; tinc = cfg.tincPackage; hostsType = builtins.typeOf cfg.hosts; @@ -217,21 +218,5 @@ let chmod +x $out/tinc-up ''; - - - user = cfg.network + "-tinc"; - in out - - - -#let -# cfg = config.tv.retiolum; -# arg' = arg // { inherit cfg; }; -#in -# -#{ -# options.tv.retiolum = import ./options.nix arg'; -# config = lib.mkIf cfg.enable (import ./config.nix arg'); -#} diff --git a/3modules/tv/urlwatch.nix b/3modules/tv/urlwatch.nix index 05a0b0f..a659fc7 100644 --- a/3modules/tv/urlwatch.nix +++ b/3modules/tv/urlwatch.nix @@ -28,7 +28,7 @@ let }; from = mkOption { type = types.str; - default = "${cfg.user}@${config.networking.hostName}.retiolum"; + default = "${user.name}@${config.networking.hostName}.retiolum"; description = '' Content of the From: header of the generated mails. ''; @@ -54,11 +54,6 @@ let https://nixos.org/channels/nixos-unstable/git-revision ]; }; - user = mkOption { - type = types.str; - default = "urlwatch"; - description = "User under which urlwatch runs."; - }; }; urlsFile = toFile "urls" (concatStringsSep "\n" cfg.urls); @@ -84,7 +79,7 @@ let SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; }; serviceConfig = { - User = cfg.user; + User = user.name; PermissionsStartOnly = "true"; PrivateTmp = "true"; Type = "oneshot"; @@ -94,11 +89,10 @@ let set -euf dataDir=$HOME - user=${escapeShellArg cfg.user} if ! test -e "$dataDir"; then mkdir -m 0700 -p "$dataDir" - chown "$user": "$dataDir" + chown ${user.name}: "$dataDir" fi ''; ExecStart = pkgs.writeScript "urlwatch" '' @@ -108,7 +102,6 @@ let from=${escapeShellArg cfg.from} mailto=${escapeShellArg cfg.mailto} urlsFile=${escapeShellArg urlsFile} - user=${escapeShellArg cfg.user} cd /tmp @@ -130,11 +123,14 @@ let ''; }; }; - users.extraUsers = optionals (cfg.user == "urlwatch") (singleton { - name = "urlwatch"; - uid = 3450919516; # bin/genid urlwatch - }); + users.extraUsers = singleton { + inherit (user) name uid; + }; }; + user = { + name = "urlwatch"; + uid = 3467631196; # genid urlwatch + }; in out |