summaryrefslogtreecommitdiffstats
path: root/3modules
diff options
context:
space:
mode:
Diffstat (limited to '3modules')
-rw-r--r--3modules/krebs/default.nix309
-rw-r--r--3modules/krebs/git.nix490
-rw-r--r--3modules/krebs/github-hosts-sync.nix83
-rw-r--r--3modules/krebs/nginx.nix72
-rw-r--r--3modules/krebs/retiolum.nix226
-rw-r--r--3modules/krebs/urlwatch.nix136
-rw-r--r--3modules/lass/iptables.nix187
-rw-r--r--3modules/lass/sshkeys.nix26
-rw-r--r--3modules/lass/urxvtd.nix55
-rw-r--r--3modules/lass/xresources.nix57
-rw-r--r--3modules/tv/consul.nix118
-rw-r--r--3modules/tv/default.nix9
-rw-r--r--3modules/tv/ejabberd.nix166
-rw-r--r--3modules/tv/iptables.nix126
14 files changed, 0 insertions, 2060 deletions
diff --git a/3modules/krebs/default.nix b/3modules/krebs/default.nix
deleted file mode 100644
index 3c2f7c9..0000000
--- a/3modules/krebs/default.nix
+++ /dev/null
@@ -1,309 +0,0 @@
-{ config, lib, ... }:
-
-with import ../../4lib/krebs { inherit lib; };
-let
- cfg = config.krebs;
-
- out = {
- imports = [
- ./github-hosts-sync.nix
- ./git.nix
- ./nginx.nix
- ./retiolum.nix
- ./urlwatch.nix
- ];
- options.krebs = api;
- config = mkIf cfg.enable imp;
- };
-
- api = {
- enable = mkEnableOption "krebs";
-
- build = mkOption {
- type = types.submodule {
- options = {
- host = mkOption {
- type = types.host;
- };
- user = mkOption {
- type = types.user;
- };
- };
- };
- # Define defaul value, so unset values of the submodule get reported.
- default = {};
- };
-
- hosts = mkOption {
- type = with types; attrsOf host;
- };
-
- users = mkOption {
- type = with types; attrsOf user;
- };
-
- # XXX is there a better place to define search-domain?
- # TODO search-domains :: listOf hostname
- search-domain = mkOption {
- type = types.hostname;
- default = "";
- example = "retiolum";
- };
- };
-
- imp = mkMerge [
- { krebs = lass-imp; }
- { krebs = makefu-imp; }
- { krebs = tv-imp; }
- {
- # XXX This overlaps with krebs.retiolum
- networking.extraHosts =
- let
- # TODO move domain name providers to a dedicated module
- # providers : tree label providername
- providers = {
- internet = "hosts";
- retiolum = "hosts";
- de.viljetic = "regfish";
- de.krebsco = "ovh";
- };
-
- # splitByProvider : [alias] -> listset providername alias
- splitByProvider = foldl (acc: alias: listset-insert (providerOf alias) alias acc) {};
-
- # providerOf : alias -> providername
- providerOf = alias:
- tree-get (splitString "." alias) providers;
- in
- concatStringsSep "\n" (flatten (
- # TODO deepMap ["hosts" "nets"] (hostname: host: netname: net:
- mapAttrsToList (hostname: host:
- mapAttrsToList (netname: net:
- let
- aliases = toString (unique (longs ++ shorts));
- longs = (splitByProvider net.aliases).hosts;
- shorts = map (removeSuffix ".${cfg.search-domain}") longs;
- in
- map (addr: "${addr} ${aliases}") net.addrs
- ) host.nets
- ) config.krebs.hosts
- ));
- }
- ];
-
- lass-imp = {
- hosts = addNames {
- };
- users = addNames {
- lass = {
- pubkey = readFile ../../Zpubkeys/lass.ssh.pub;
- };
- uriel = {
- pubkey = readFile ../../Zpubkeys/uriel.ssh.pub;
- };
- };
- };
-
- makefu-imp = {
- hosts = addNames {
- pnp = {
- cores = 1;
- dc = "makefu"; #vm on 'omo'
- nets = {
- retiolum = {
- addrs4 = ["10.243.0.210"];
- addrs6 = ["42:f9f1:0000:0000:0000:0000:0000:0001"];
- aliases = [
- "pnp.retiolum"
- "cgit.pnp.retiolum"
- ];
- tinc.pubkey = ''
- -----BEGIN RSA PUBLIC KEY-----
- MIIBCgKCAQEAugkgEK4iy2C5+VZHwhjj/q3IOhhazE3TYHuipz37KxHWX8ZbjH+g
- Ewtm79dVysujAOX8ZqV8nD8JgDAvkIZDp8FCIK0/rgckhpTsy1HVlHxa7ECrOS8V
- pGz4xOxgcPFRbv5H2coHtbnfQc4GdA5fcNedQ3BP3T2Tn7n/dbbVs30bOP5V0EMR
- SqZwNmtqaDQxOvjpPg9EoHvAYTevrpbbIst9UzCyvmNli9R+SsiDrzEPgB7zOc4T
- TG12MT+XQr6JUu4jPpzdhb6H/36V6ADCIkBjzWh0iSfWGiFDQFinD+YSWbA1NOTr
- Qtd1I3Ov+He7uc2Z719mb0Og2kCGnCnPIwIDAQAB
- -----END RSA PUBLIC KEY-----
- '';
- };
- };
- };
- };
- users = addNames {
- makefu = {
- mail = "root@euer.krebsco.de";
- pubkey = readFile ../../Zpubkeys/makefu_arch.ssh.pub;
- };
- };
- };
-
- tv-imp = {
- hosts = addNames {
- cd = {
- cores = 2;
- dc = "tv"; #dc = "cac";
- nets = rec {
- internet = {
- addrs4 = ["162.219.7.216"];
- aliases = [
- "cd.internet"
- "cd.viljetic.de"
- "cgit.cd.viljetic.de"
- "cd.krebsco.de"
- ];
- };
- retiolum = {
- via = internet;
- addrs4 = ["10.243.113.222"];
- addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af3"];
- aliases = [
- "cd.retiolum"
- "cgit.cd.retiolum"
- ];
- tinc.pubkey = ''
- -----BEGIN RSA PUBLIC KEY-----
- MIICCgKCAgEAvmCBVNKT/Su4v9nl/Nm3STPo5QxWPg7xEkzIs3Oh39BS8+r6/7UQ
- rebib7mczb+ebZd+Rg2yFoGrWO8cmM0VcLy5bYRMK7in8XroLEjWecNNM4TRfNR4
- e53+LhcPdkxo0A3/D+yiut+A2Mkqe+4VXDm/JhAiAYkZTn7jUtj00Atrc7CWW1gN
- sP3jIgv4+CGftdSYOB4dm699B7OD9XDLci2kOaFqFl4cjDYUok03G0AduUlRx10v
- CKbKOTIdm8C36A902/3ms+Hyzkruu+VagGIZuPSwqXHJPCu7Ju+jarKQstMmpQi0
- PubweWDL0o/Dfz2qT3DuL4xDecIvGE6kv3m41hHJYiK+2/azTSehyPFbsVbL7w0V
- LgKN3usnZNcpTsBWxRGT7nMFSnX2FLDu7d9OfCuaXYxHVFLZaNrpccOq8NF/7Hbk
- DDW81W7CvLyJDlp0WLnAawSOGTUTPoYv/2wAapJ89i8QGCueGvEc6o2EcnBVMFEW
- ejWTQzyD816f4RsplnrRqLVlIMbr9Q/n5TvlgjjhX7IMEfMy4+7qLGRQkNbFzgwK
- jxNG2fFSCjOEQitm0gAtx7QRIyvYr6c7/xiHz4AwxYzBmvQsL/OK57NO4+Krwgj5
- Vk8TQ2jGO7J4bB38zaxK+Lrtfl8i1AK1171JqFMhOc34JSJ7T4LWDMECAwEAAQ==
- -----END RSA PUBLIC KEY-----
- '';
- };
- };
- };
- mkdir = {
- cores = 1;
- dc = "tv"; #dc = "cac";
- nets = rec {
- internet = {
- addrs4 = ["162.248.167.241"];
- aliases = [
- "mkdir.internet"
- ];
- };
- retiolum = {
- via = internet;
- addrs4 = ["10.243.113.223"];
- addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af4"];
- aliases = [
- "mkdir.retiolum"
- "cgit.mkdir.retiolum"
- ];
- tinc.pubkey = ''
- -----BEGIN RSA PUBLIC KEY-----
- MIIBCgKCAQEAuyfM+3od75zOYXqnqRMAt+yp/4z/vC3vSWdjUvEmCuM23c5BOBw+
- dKqbWoSPTzOuaQ0szdL7a6YxT+poSUXd/i3pPz59KgCl192rd1pZoJKgvoluITev
- voYSP9rFQOUrustfDb9qKW/ZY95cwdCvypo7Vf4ghxwDCnlmyCGz7qXTJMLydNKF
- 2PH9KiY4suv15sCg/zisu+q0ZYQXUc1TcgpoIYBOftDunOJoNdbti+XjwWdjGmJZ
- Bn4GelsrrpwJFvfDmouHUe8GsD7nTgbZFtiJbKfCEiK16N0Q0d0ZFHhAV2nPjsk2
- 3JhG4n9vxATBkO82f7RLrcrhkx9cbLfN3wIDAQAB
- -----END RSA PUBLIC KEY-----
- '';
- };
- };
- };
- nomic = {
- cores = 2;
- dc = "tv"; #dc = "gg23";
- nets = rec {
- retiolum = {
- addrs4 = ["10.243.0.110"];
- addrs6 = ["42:02d5:733f:d6da:c0f5:2bb7:2b18:09ec"];
- aliases = [
- "nomic.retiolum"
- "cgit.nomic.retiolum"
- ];
- tinc.pubkey = ''
- -----BEGIN RSA PUBLIC KEY-----
- MIIBCgKCAQEAwb8Yk/YRc17g2J9n960p6j4W/l559OPyuMPdGJ4DmCm3WNQtxoa+
- qTFUiDiI85BcmfqnSeddLG8zTC2XnSlIvCRMJ9oKzppFM4PX4OTAaJZVE5WyCQhw
- Kd4tHVdoQgJW5yFepmT9IUmHqkxXJ0R2W93l2eSZNOcnFvFn0ooiAlRi4zAiHClu
- 5Mz80Sc2rvez+n9wtC2D06aYjP23pHYld2xighHR9SUqX1dFzgSXNSoWWCcgNp2a
- OKcM8LzxLV7MTMZFOJCJndZ77e4LsUvxhQFP6nyKZWg30PC0zufZsuN5o2xsWSlA
- Wi9sMB1AUR6mZrxgcgTFpUjbjbLQf+36CwIDAQAB
- -----END RSA PUBLIC KEY-----
- '';
- };
- };
- secure = true;
- };
- rmdir = {
- cores = 1;
- dc = "tv"; #dc = "cac";
- nets = rec {
- internet = {
- addrs4 = ["167.88.44.94"];
- aliases = [
- "rmdir.internet"
- ];
- };
- retiolum = {
- via = internet;
- addrs4 = ["10.243.113.224"];
- addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af5"];
- aliases = [
- "rmdir.retiolum"
- "cgit.rmdir.retiolum"
- ];
- tinc.pubkey = ''
- -----BEGIN RSA PUBLIC KEY-----
- MIIBCgKCAQEA+twy4obSbJdmZLfBoe9YYeyoDnXkO/WPa2D6Eh6jXrWk5fbhBjRf
- i3EAQfLiXXFJX3E8V8YvJyazXklI19jJtCLDiu/F5kgJJfyAkWHH+a/hcg7qllDM
- Xx2CvS/nCbs+p48/VLO6zLC7b1oHu3K/ob5M5bwPK6j9NEDIL5qYiM5PQzV6zryz
- hS9E/+l8Z+UUpYcfS3bRovXJAerB4txc/gD3Xmptq1zk53yn1kJFYfVlwyyz+NEF
- 59JZj2PDrvWoG0kx/QjiNurs6XfdnyHe/gP3rmSTrihKFVuA3cZM62sDR4FcaeWH
- SnKSp02pqjBOjC/dOK97nXpKLJgNH046owIDAQAB
- -----END RSA PUBLIC KEY-----
- '';
- };
- };
- };
- wu = {
- cores = 4;
- # TODO wu is mobile, so dc means "home data center"
- dc = "tv"; #dc = "gg23";
- nets = {
- retiolum = {
- addrs4 = ["10.243.13.37"];
- addrs6 = ["42:0:0:0:0:0:0:1337"];
- aliases = [
- "wu.retiolum"
- ];
- tinc.pubkey = ''
- -----BEGIN RSA PUBLIC KEY-----
- MIIBCgKCAQEArDvU0cuBsVqTjCX2TlWL4XHSy4qSjUhjrDvUPZSKTVN7x6OENCUn
- M27g9H7j4/Jw/8IHoJLiKnXHavOoc9UJM+P9Fla/4TTVADr69UDSnLgH+wGiHcEg
- GxPkb2jt0Z8zcpD6Fusj1ATs3sssaLHTHvg1D0LylEWA3cI4WPP13v23PkyUENQT
- KpSWfR+obqDl38Q7LuFi6dH9ruyvqK+4syddrBwjPXrcNxcGL9QbDn7+foRNiWw4
- 4CE5z25oGG2iWMShI7fe3ji/fMUAl7DSOOrHVVG9eMtpzy+uI8veOHrdTax4oKik
- AFGCrMIov3F0GIeu3nDlrTIZPZDTodbFKQIDAQAB
- -----END RSA PUBLIC KEY-----
- '';
- };
- };
- secure = true;
- };
- };
- users = addNames {
- mv = {
- mail = "mv@cd.retiolum";
- pubkey = readFile ../../Zpubkeys/mv_vod.ssh.pub;
- };
- tv = {
- mail = "tv@wu.retiolum";
- pubkey = readFile ../../Zpubkeys/tv_wu.ssh.pub;
- };
- };
- };
-
-in
-out
diff --git a/3modules/krebs/git.nix b/3modules/krebs/git.nix
deleted file mode 100644
index 6046451..0000000
--- a/3modules/krebs/git.nix
+++ /dev/null
@@ -1,490 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-# TODO unify logging of shell scripts to user and journal
-# TODO move all scripts to ${etcDir}, so ControlMaster connections
-# immediately pick up new authenticators
-# TODO when authorized_keys changes, then restart ssh
-# (or kill already connected users somehow)
-
-with import ../../4lib/krebs { inherit lib; };
-let
- cfg = config.krebs.git;
-
- out = {
- # TODO don't import krebs.nginx here
- imports = [
- ../../3modules/krebs/nginx.nix
- ];
- options.krebs.git = api;
- config = mkIf cfg.enable (mkMerge [
- (mkIf cfg.cgit cgit-imp)
- git-imp
- ]);
- };
-
- api = {
- enable = mkEnableOption "krebs.git";
-
- cgit = mkOption {
- type = types.bool;
- default = true;
- description = ''
- Enable cgit.
- Cgit is an attempt to create a fast web interface for the git version
- control system, using a built in cache to decrease pressure on the
- git server.
- cgit in this module is being served via fastcgi nginx.This module
- deploys a http://cgit.<hostname> nginx configuration and enables nginx
- if not yet enabled.
- '';
- };
- dataDir = mkOption {
- type = types.str;
- default = "/var/lib/git";
- description = "Directory used to store repositories.";
- };
- etcDir = mkOption {
- type = types.str;
- default = "/etc/git";
- };
- repos = mkOption {
- type = types.attrsOf (types.submodule ({
- options = {
- desc = mkOption {
- type = types.nullOr types.str;
- default = null;
- description = ''
- Repository description.
- '';
- };
- section = mkOption {
- type = types.nullOr types.str;
- default = null;
- description = ''
- Repository section.
- '';
- };
- name = mkOption {
- type = types.str;
- description = ''
- Repository name.
- '';
- };
- hooks = mkOption {
- type = types.attrsOf types.str;
- default = {};
- description = ''
- Repository-specific hooks.
- '';
- };
- public = mkOption {
- type = types.bool;
- default = false;
- description = ''
- Allow everybody to read the repository via HTTP if cgit enabled.
- '';
- # TODO allow every configured user to fetch the repository via SSH.
- };
- };
- }));
-
- default = {};
-
- example = literalExample ''
- {
- testing = {
- name = "testing";
- hooks.post-update = '''
- #! /bin/sh
- set -euf
- echo post-update hook: $* >&2
- ''';
- };
- testing2 = { name = "testing2"; };
- }
- '';
-
- description = ''
- Repositories.
- '';
- };
- root-desc = mkOption {
- type = types.nullOr types.str;
- default = null;
- description = ''
- Text printed below the heading on the repository index page.
- Default value: "a fast webinterface for the git dscm".
- '';
- };
- root-title = mkOption {
- type = types.nullOr types.str;
- default = null;
- description = ''
- Text printed as heading on the repository index page.
- Default value: "Git Repository Browser".
- '';
- };
- rules = mkOption {
- type = types.unspecified;
- };
- };
-
- git-imp = {
- system.activationScripts.git-init = "${init-script}";
-
- # TODO maybe put all scripts here and then use PATH?
- environment.etc."${etc-base}".source =
- scriptFarm "git-ssh-authorizers" {
- authorize-command = makeAuthorizeScript (map ({ repo, user, perm }: [
- (map getName (ensureList user))
- (map getName (ensureList repo))
- (map getName perm.allow-commands)
- ]) cfg.rules);
-
- authorize-push = makeAuthorizeScript (map ({ repo, user, perm }: [
- (map getName (ensureList user))
- (map getName (ensureList repo))
- (ensureList perm.allow-receive-ref)
- (map getName perm.allow-receive-modes)
- ]) (filter (x: hasAttr "allow-receive-ref" x.perm) cfg.rules));
- };
-
- users.extraUsers = singleton {
- description = "Git repository hosting user";
- name = "git";
- shell = "/bin/sh";
- openssh.authorizedKeys.keys =
- mapAttrsToList (_: makeAuthorizedKey git-ssh-command)
- config.krebs.users;
- uid = 129318403; # genid git
- };
- };
-
- cgit-imp = {
- users.extraUsers = lib.singleton {
- inherit (fcgitwrap-user) group name uid;
- home = toString (pkgs.runCommand "empty" {} "mkdir -p $out");
- };
-
- users.extraGroups = lib.singleton {
- inherit (fcgitwrap-group) gid name;
- };
-
- services.fcgiwrap = {
- enable = true;
- user = fcgitwrap-user.name;
- group = fcgitwrap-user.group;
- # socketAddress = "/run/fcgiwrap.sock" (default)
- # socketType = "unix" (default)
- };
-
- environment.etc."cgitrc".text = ''
- css=/static/cgit.css
- logo=/static/cgit.png
-
- # if you do not want that webcrawler (like google) index your site
- robots=noindex, nofollow
-
- virtual-root=/
-
- # TODO make this nicer (and/or somewhere else)
- cache-root=/tmp/cgit
-
- cache-size=1000
- enable-commit-graph=1
- enable-index-links=1
- enable-index-owner=0
- enable-log-filecount=1
- enable-log-linecount=1
- enable-remote-branches=1
-
- ${optionalString (cfg.root-title != null) "root-title=${cfg.root-title}"}
- ${optionalString (cfg.root-desc != null) "root-desc=${cfg.root-desc}"}
-
- snapshots=0
- max-stats=year
-
- ${concatMapStringsSep "\n" (repo: ''
- repo.url=${repo.name}
- repo.path=${cfg.dataDir}/${repo.name}
- ${optionalString (repo.section != null) "repo.section=${repo.section}"}
- ${optionalString (repo.desc != null) "repo.desc=${repo.desc}"}
- '') (filter isPublicRepo (attrValues cfg.repos))}
- '';
-
- system.activationScripts.cgit = ''
- mkdir -m 0700 -p /tmp/cgit
- chown ${toString fcgitwrap-user.uid}:${toString fcgitwrap-group.gid} /tmp/cgit
- '';
-
- krebs.nginx = {
- enable = true;
- servers.cgit = {
- server-names = [
- "cgit.${config.networking.hostName}"
- "cgit.${config.networking.hostName}.retiolum"
- ];
- locations = [
- (nameValuePair "/" ''
- include ${pkgs.nginx}/conf/fastcgi_params;
- fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi;
- fastcgi_param PATH_INFO $uri;
- fastcgi_param QUERY_STRING $args;
- fastcgi_param HTTP_HOST $server_name;
- fastcgi_pass unix:${config.services.fcgiwrap.socketAddress};
- '')
- (nameValuePair "/static/" ''
- root ${pkgs.cgit}/cgit;
- rewrite ^/static(/.*)$ $1 break;
- '')
- ];
- };
- };
- };
-
- fcgitwrap-user = {
- name = "fcgiwrap";
- uid = 2867890860; # genid fcgiwrap
- group = "fcgiwrap";
- };
-
- fcgitwrap-group = {
- name = fcgitwrap-user.name;
- gid = fcgitwrap-user.uid;
- };
-
-
- ensureList = x:
- if typeOf x == "list" then x else [x];
-
- getName = x: x.name;
-
- isPublicRepo = getAttr "public"; # TODO this is also in ./cgit.nix
-
- makeAuthorizedKey = git-ssh-command: user@{ name, pubkey, ... }:
- # TODO assert name
- # TODO assert pubkey
- let
- options = concatStringsSep "," [
- ''command="exec ${git-ssh-command} ${name}"''
- "no-agent-forwarding"
- "no-port-forwarding"
- "no-pty"
- "no-X11-forwarding"
- ];
- in
- "${options} ${pubkey}";
-
- # [case-pattern] -> shell-script
- # Create a shell script that succeeds (exit 0) when all its arguments
- # match the case patterns (in the given order).
- makeAuthorizeScript =
- let
- # TODO escape
- to-pattern = x: concatStringsSep "|" (ensureList x);
- go = i: ps:
- if ps == []
- then "exit 0"
- else ''
- case ''$${toString i} in ${to-pattern (head ps)})
- ${go (i + 1) (tail ps)}
- esac'';
- in
- patterns: ''
- #! /bin/sh
- set -euf
- ${concatStringsSep "\n" (map (go 1) patterns)}
- exit -1
- '';
-
- reponames = rules: sort lessThan (unique (map (x: x.repo.name) rules));
-
- # TODO makeGitHooks that uses runCommand instead of scriptFarm?
- scriptFarm =
- farm-name: scripts:
- let
- makeScript = script-name: script-string: {
- name = script-name;
- path = pkgs.writeScript "${farm-name}_${script-name}" script-string;
- };
- in
- pkgs.linkFarm farm-name (mapAttrsToList makeScript scripts);
-
-
- git-ssh-command = pkgs.writeScript "git-ssh-command" ''
- #! /bin/sh
- set -euf
-
- PATH=${makeSearchPath "bin" (with pkgs; [
- coreutils
- git
- gnugrep
- gnused
- systemd
- ])}
-
- abort() {
- echo "error: $1" >&2
- systemd-cat -p err -t git echo "error: $1"
- exit -1
- }
-
- GIT_SSH_USER=$1
-
- systemd-cat -p info -t git echo \
- "authorizing $GIT_SSH_USER $SSH_CONNECTION $SSH_ORIGINAL_COMMAND"
-
- # References: The Base Definitions volume of
- # POSIX.1‐2013, Section 3.278, Portable Filename Character Set
- portable_filename_bre="^[A-Za-z0-9._-]\\+$"
-
- command=$(echo "$SSH_ORIGINAL_COMMAND" \
- | sed -n 's/^\([^ ]*\) '"'"'\(.*\)'"'"'/\1/p' \
- | grep "$portable_filename_bre" \
- || abort 'cannot read command')
-
- GIT_SSH_REPO=$(echo "$SSH_ORIGINAL_COMMAND" \
- | sed -n 's/^\([^ ]*\) '"'"'\(.*\)'"'"'/\2/p' \
- | grep "$portable_filename_bre" \
- || abort 'cannot read reponame')
-
- ${cfg.etcDir}/authorize-command \
- "$GIT_SSH_USER" "$GIT_SSH_REPO" "$command" \
- || abort 'access denied'
-
- repodir=${escapeShellArg cfg.dataDir}/$GIT_SSH_REPO
-
- systemd-cat -p info -t git \
- echo "authorized exec $command $repodir"
-
- export GIT_SSH_USER
- export GIT_SSH_REPO
- exec "$command" "$repodir"
- '';
-
- init-script = pkgs.writeScript "git-init" ''
- #! /bin/sh
- set -euf
-
- PATH=${makeSearchPath "bin" (with pkgs; [
- coreutils
- findutils
- gawk
- git
- gnugrep
- gnused
- ])}
-
- dataDir=${escapeShellArg cfg.dataDir}
- mkdir -p "$dataDir"
-
- # Notice how the presence of hooks symlinks determine whether
- # we manage a repositry or not.
-
- # Make sure that no existing repository has hooks. We can delete
- # symlinks because we assume we created them.
- find "$dataDir" -mindepth 2 -maxdepth 2 -name hooks -type l -delete
- bad_hooks=$(find "$dataDir" -mindepth 2 -maxdepth 2 -name hooks)
- if echo "$bad_hooks" | grep -q .; then
- printf 'error: unknown hooks:\n%s\n' \
- "$(echo "$bad_hooks" | sed 's/^/ /')" \
- >&2
- exit -1
- fi
-
- # Initialize repositories.
- ${concatMapStringsSep "\n" (repo:
- let
- hooks = scriptFarm "git-hooks" (makeHooks repo);
- in
- ''
- reponame=${escapeShellArg repo.name}
- repodir=$dataDir/$reponame
- mode=${toString (if isPublicRepo repo then 0711 else 0700)}
- if ! test -d "$repodir"; then
- mkdir -m "$mode" "$repodir"
- git init --bare --template=/var/empty "$repodir"
- chown -R git:nogroup "$repodir"
- fi
- ln -s ${hooks} "$repodir/hooks"
- ''
- ) (attrValues cfg.repos)}
-
- # Warn about repositories that exist but aren't mentioned in the
- # current configuration (and thus didn't receive a hooks symlink).
- unknown_repos=$(find "$dataDir" -mindepth 1 -maxdepth 1 \
- -type d \! -exec test -e '{}/hooks' \; -print)
- if echo "$unknown_repos" | grep -q .; then
- printf 'warning: stale repositories:\n%s\n' \
- "$(echo "$unknown_repos" | sed 's/^/ /')" \
- >&2
- fi
- '';
-
- makeHooks = repo: removeAttrs repo.hooks [ "pre-receive" ] // {
- pre-receive = ''
- #! /bin/sh
- set -euf
-
- PATH=${makeSearchPath "bin" (with pkgs; [
- coreutils # env
- git
- systemd
- ])}
-
- accept() {
- #systemd-cat -p info -t git echo "authorized $1"
- accept_string="''${accept_string+$accept_string
- }authorized $1"
- }
- reject() {
- #systemd-cat -p err -t git echo "denied $1"
- #echo 'access denied' >&2
- #exit_code=-1
- reject_string="''${reject_string+$reject_string
- }access denied: $1"
- }
-
- empty=0000000000000000000000000000000000000000
-
- accept_string=
- reject_string=
- while read oldrev newrev ref; do
-
- if [ $oldrev = $empty ]; then
- receive_mode=create
- elif [ $newrev = $empty ]; then
- receive_mode=delete
- elif [ "$(git merge-base $oldrev $newrev)" = $oldrev ]; then
- receive_mode=fast-forward
- else
- receive_mode=non-fast-forward
- fi
-
- if ${cfg.etcDir}/authorize-push \
- "$GIT_SSH_USER" "$GIT_SSH_REPO" "$ref" "$receive_mode"; then
- accept "$receive_mode $ref"
- else
- reject "$receive_mode $ref"
- fi
- done
-
- if [ -n "$reject_string" ]; then
- systemd-cat -p err -t git echo "$reject_string"
- exit -1
- fi
-
- systemd-cat -p info -t git echo "$accept_string"
-
- ${optionalString (hasAttr "post-receive" repo.hooks) ''
- # custom post-receive hook
- ${repo.hooks.post-receive}''}
- '';
- };
-
- etc-base =
- assert (hasPrefix "/etc/" cfg.etcDir);
- removePrefix "/etc/" cfg.etcDir;
-
-in
-out
diff --git a/3modules/krebs/github-hosts-sync.nix b/3modules/krebs/github-hosts-sync.nix
deleted file mode 100644
index c3b56ef..0000000
--- a/3modules/krebs/github-hosts-sync.nix
+++ /dev/null
@@ -1,83 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with builtins;
-with lib;
-let
- cfg = config.krebs.github-hosts-sync;
-
- out = {
- options.krebs.github-hosts-sync = api;
- config = mkIf cfg.enable imp;
- };
-
- api = {
- enable = mkEnableOption "krebs.github-hosts-sync";
- port = mkOption {
- type = types.int; # TODO port type
- default = 1028;
- };
- dataDir = mkOption {
- type = types.str; # TODO path (but not just into store)
- default = "/var/lib/github-hosts-sync";
- };
- ssh-identity-file = mkOption {
- type = types.str; # TODO must be named *.ssh.{id_rsa,id_ed25519}
- default = "/root/src/secrets/github-hosts-sync.ssh.id_rsa";
- };
- };
-
- imp = {
- systemd.services.github-hosts-sync = {
- after = [ "network.target" ];
- wantedBy = [ "multi-user.target" ];
- environment = {
- port = toString cfg.port;
- };
- serviceConfig = {
- PermissionsStartOnly = "true";
- SyslogIdentifier = "github-hosts-sync";
- User = user.name;
- Restart = "always";
- ExecStartPre = pkgs.writeScript "github-hosts-sync-init" ''
- #! /bin/sh
- set -euf
-
- ssh_identity_file_target=$(
- case ${cfg.ssh-identity-file} in
- *.ssh.id_rsa|*.ssh.id_ed25519) echo ${cfg.dataDir}/.ssh/id_rsa;;
- *.ssh.id_ed25519) echo ${cfg.dataDir}/.ssh/id_ed25519;;
- *)
- echo "bad identity file name: ${cfg.ssh-identity-file}" >&2
- exit 1
- esac
- )
-
- mkdir -p ${cfg.dataDir}
- chown ${user.name}: ${cfg.dataDir}
-
- install \
- -o ${user.name} \
- -m 0400 \
- ${cfg.ssh-identity-file} \
- "$ssh_identity_file_target"
-
- ln -snf ${Zpkgs.github-known_hosts} ${cfg.dataDir}/.ssh/known_hosts
- '';
- ExecStart = "${Zpkgs.github-hosts-sync}/bin/github-hosts-sync";
- };
- };
-
- users.extraUsers = singleton {
- inherit (user) name uid;
- home = cfg.dataDir;
- };
- };
-
- user = {
- name = "github-hosts-sync";
- uid = 3220554646; # genid github-hosts-sync
- };
-
- Zpkgs = import ../../Zpkgs/krebs { inherit pkgs; };
-in
-out
diff --git a/3modules/krebs/nginx.nix b/3modules/krebs/nginx.nix
deleted file mode 100644
index 702e8a7..0000000
--- a/3modules/krebs/nginx.nix
+++ /dev/null
@@ -1,72 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-with builtins;
-with lib;
-let
- cfg = config.krebs.nginx;
-
- out = {
- options.krebs.nginx = api;
- config = mkIf cfg.enable imp;
- };
-
- api = {
- enable = mkEnableOption "krebs.nginx";
-
- servers = mkOption {
- type = with types; attrsOf optionSet;
- options = singleton {
- server-names = mkOption {
- type = with types; listOf str;
- # TODO use identity
- default = [
- "${config.networking.hostName}"
- "${config.networking.hostName}.retiolum"
- ];
- };
- locations = mkOption {
- type = with types; listOf (attrsOf str);
- };
- };
- default = {};
- };
- };
-
- imp = {
- services.nginx = {
- enable = true;
- httpConfig = ''
- include ${pkgs.nginx}/conf/mime.types;
- default_type application/octet-stream;
- sendfile on;
- keepalive_timeout 65;
- gzip on;
- server {
- listen 80 default_server;
- server_name _;
- return 404;
- }
- ${concatStrings (mapAttrsToList (_: to-server) cfg.servers)}
- '';
- };
- };
-
-
- indent = replaceChars ["\n"] ["\n "];
-
- to-location = { name, value }: ''
- location ${name} {
- ${indent value}
- }
- '';
-
- to-server = { server-names, locations, ... }: ''
- server {
- listen 80;
- server_name ${toString server-names};
- ${indent (concatStrings (map to-location locations))}
- }
- '';
-
-in
-out
diff --git a/3modules/krebs/retiolum.nix b/3modules/krebs/retiolum.nix
deleted file mode 100644
index 481d656..0000000
--- a/3modules/krebs/retiolum.nix
+++ /dev/null
@@ -1,226 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-with builtins;
-with lib;
-let
- cfg = config.krebs.retiolum;
-
- out = {
- options.krebs.retiolum = api;
- config = mkIf cfg.enable imp;
- };
-
- api = {
- enable = mkEnableOption "krebs.retiolum";
-
- name = mkOption {
- type = types.str;
- default = config.networking.hostName;
- # Description stolen from tinc.conf(5).
- description = ''
- This is the name which identifies this tinc daemon. It must
- be unique for the virtual private network this daemon will
- connect to. The Name may only consist of alphanumeric and
- underscore characters. If Name starts with a $, then the
- contents of the environment variable that follows will be
- used. In that case, invalid characters will be converted to
- underscores. If Name is $HOST, but no such environment
- variable exist, the hostname will be read using the
- gethostnname() system call This is the name which identifies
- the this tinc daemon.
- '';
- };
-
- generateEtcHosts = mkOption {
- type = types.str;
- default = "both";
- description = ''
- If set to <literal>short</literal>, <literal>long</literal>, or <literal>both</literal>,
- then generate entries in <filename>/etc/hosts</filename> from subnets.
- '';
- };
-
- network = mkOption {
- type = types.str;
- default = "retiolum";
- description = ''
- The tinc network name.
- It is used to generate long host entries,
- and name the TUN device.
- '';
- };
-
- tincPackage = mkOption {
- type = types.package;
- default = pkgs.tinc;
- description = "Tincd package to use.";
- };
-
- hosts = mkOption {
- type = with types; either package path;
- default = ../../Zhosts;
- description = ''
- If a path is given, then it will be used to generate an ad-hoc package.
- '';
- };
-
- iproutePackage = mkOption {
- type = types.package;
- default = pkgs.iproute;
- description = "Iproute2 package to use.";
- };
-
-
- privateKeyFile = mkOption {
- # TODO if it's types.path then it gets copied to /nix/store with
- # bad unsafe permissions...
- type = types.str;
- default = "/root/src/secrets/retiolum.rsa_key.priv";
- description = ''
- Generate file with <literal>tincd -K</literal>.
- This file must exist on the local system. The default points to
- <secrets/retiolum.rsa_key.priv>.
- '';
- };
-
- connectTo = mkOption {
- type = types.listOf types.str;
- default = [ "fastpoke" "pigstarter" "gum" ];
- description = ''
- The list of hosts in the network which the client will try to connect
- to. These hosts should have an 'Address' configured which points to a
- routeable IPv4 or IPv6 address.
- '';
- };
-
- };
-
- imp = {
- environment.systemPackages = [ tinc hosts iproute ];
-
- networking.extraHosts = retiolumExtraHosts;
-
- systemd.services.retiolum = {
- description = "Tinc daemon for Retiolum";
- after = [ "network.target" ];
- wantedBy = [ "multi-user.target" ];
- path = [ tinc iproute ];
- serviceConfig = {
- PermissionsStartOnly = "true";
- PrivateTmp = "true";
- Restart = "always";
- # TODO we cannot chroot (-R) b/c we use symlinks to hosts
- # and the private key.
- ExecStartPre = pkgs.writeScript "retiolum-init" ''
- #! /bin/sh
- install -o ${user.name} -m 0400 ${cfg.privateKeyFile} /tmp/retiolum-rsa_key.priv
- '';
- ExecStart = "${tinc}/sbin/tincd -c ${confDir} -d 0 -U ${user.name} -D";
- SyslogIdentifier = "retiolum";
- };
- };
-
- users.extraUsers = singleton {
- inherit (user) name uid;
- };
- };
-
- user = {
- name = "retiolum";
- uid = 301281149; # genid retiolum
- };
-
- tinc = cfg.tincPackage;
-
- hosts = getAttr (typeOf cfg.hosts) {
- package = cfg.hosts;
- path = pkgs.stdenv.mkDerivation {
- name = "custom-retiolum-hosts";
- src = cfg.hosts;
- installPhase = ''
- mkdir $out
- find . -name .git -prune -o -type f -print0 \
- | xargs -0 cp --target-directory $out
- '';
- };
- };
-
- iproute = cfg.iproutePackage;
-
- retiolumExtraHosts = import (pkgs.runCommand "retiolum-etc-hosts"
- { }
- ''
- generate() {
- (cd ${hosts}
- printf \'\'
- for i in `ls`; do
- names=$(hostnames $i)
- for j in `sed -En 's|^ *Aliases *= *(.+)|\1|p' $i`; do
- names="$names $(hostnames $j)"
- done
- sed -En '
- s|^ *Subnet *= *([^ /]*)(/[0-9]*)? *$|\1 '"$names"'|p
- ' $i
- done | sort
- printf \'\'
- )
- }
-
- case ${cfg.generateEtcHosts} in
- short)
- hostnames() { echo "$1"; }
- generate
- ;;
- long)
- hostnames() { echo "$1.${cfg.network}"; }
- generate
- ;;
- both)
- hostnames() { echo "$1.${cfg.network} $1"; }
- generate
- ;;
- *)
- echo '""'
- ;;
- esac > $out
- '');
-
-
- confDir = pkgs.runCommand "retiolum" {
- # TODO text
- executable = true;
- preferLocalBuild = true;
- } ''
- set -euf
-
- mkdir -p $out
-
- ln -s ${hosts} $out/hosts
-
- cat > $out/tinc.conf <<EOF
- Name = ${cfg.name}
- Device = /dev/net/tun
- Interface = ${cfg.network}
- ${concatStrings (map (c : "ConnectTo = " + c + "\n") cfg.connectTo)}
- PrivateKeyFile = /tmp/retiolum-rsa_key.priv
- EOF
-
- # source: krebscode/painload/retiolum/scripts/tinc_setup/tinc-up
- cat > $out/tinc-up <<EOF
- host=$out/hosts/${cfg.name}
- ${iproute}/sbin/ip link set \$INTERFACE up
-
- addr4=\$(sed -n 's|^ *Subnet *= *\(10[.][^ ]*\) *$|\1|p' \$host)
- if [ -n "\$addr4" ];then
- ${iproute}/sbin/ip -4 addr add \$addr4 dev \$INTERFACE
- ${iproute}/sbin/ip -4 route add 10.243.0.0/16 dev \$INTERFACE
- fi
- addr6=\$(sed -n 's|^ *Subnet *= *\(42[:][^ ]*\) *$|\1|p' \$host)
- ${iproute}/sbin/ip -6 addr add \$addr6 dev \$INTERFACE
- ${iproute}/sbin/ip -6 route add 42::/16 dev \$INTERFACE
- EOF
-
- chmod +x $out/tinc-up
- '';
-
-in out
diff --git a/3modules/krebs/urlwatch.nix b/3modules/krebs/urlwatch.nix
deleted file mode 100644
index 58de72f..0000000
--- a/3modules/krebs/urlwatch.nix
+++ /dev/null
@@ -1,136 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-# TODO multiple users
-# TODO inform about unused caches
-# cache = url: "${cfg.dataDir}/.urlwatch/cache/${hashString "sha1" url}"
-# TODO hooks.py
-
-with builtins;
-with lib;
-let
- cfg = config.krebs.urlwatch;
-
- # TODO assert sendmail's existence
- out = {
- options.krebs.urlwatch = api;
- config = mkIf cfg.enable imp;
- };
-
- api = {
- enable = mkEnableOption "krebs.urlwatch";
-
- dataDir = mkOption {
- type = types.str;
- default = "/var/lib/urlwatch";
- description = ''
- Directory where the urlwatch service should store its state.
- '';
- };
- from = mkOption {
- type = types.str;
- default = "${user.name}@${config.networking.hostName}.retiolum";
- description = ''
- Content of the From: header of the generated mails.
- '';
- };
- mailto = mkOption {
- type = types.str;
- description = ''
- Content of the To: header of the generated mails. [AKA recipient :)]
- '';
- };
- onCalendar = mkOption {
- type = types.str;
- description = ''
- Run urlwatch at this interval.
- The format is described in systemd.time(7), CALENDAR EVENTS.
- '';
- example = "04:23";
- };
- urls = mkOption {
- type = with types; listOf str;
- description = "URL to watch.";
- example = [
- https://nixos.org/channels/nixos-unstable/git-revision
- ];
- };
- };
-
- urlsFile = toFile "urls" (concatStringsSep "\n" cfg.urls);
-
- imp = {
- systemd.timers.urlwatch = {
- wantedBy = [ "timers.target" ];
- timerConfig = {
- OnCalendar = cfg.onCalendar;
- Persistent = "true";
- };
- };
- systemd.services.urlwatch = {
- path = with pkgs; [
- coreutils
- gnused
- urlwatch
- ];
- environment = {
- HOME = cfg.dataDir;
- LC_ALL = "en_US.UTF-8";
- LOCALE_ARCHIVE = "${pkgs.glibcLocales}/lib/locale/locale-archive";
- SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
- };
- serviceConfig = {
- User = user.name;
- PermissionsStartOnly = "true";
- PrivateTmp = "true";
- Type = "oneshot";
- ExecStartPre =
- pkgs.writeScript "urlwatch-prestart" ''
- #! /bin/sh
- set -euf
-
- dataDir=$HOME
-
- if ! test -e "$dataDir"; then
- mkdir -m 0700 -p "$dataDir"
- chown ${user.name}: "$dataDir"
- fi
- '';
- ExecStart = pkgs.writeScript "urlwatch" ''
- #! /bin/sh
- set -euf
-
- from=${escapeShellArg cfg.from}
- mailto=${escapeShellArg cfg.mailto}
- urlsFile=${escapeShellArg urlsFile}
-
- cd /tmp
-
- urlwatch -e --urls="$urlsFile" > changes 2>&1 || :
-
- if test -s changes; then
- date=$(date -R)
- subject=$(sed -n 's/^\(CHANGED\|ERROR\|NEW\): //p' changes \
- | tr \\n \ )
- {
- echo "Date: $date"
- echo "From: $from"
- echo "Subject: $subject"
- echo "To: $mailto"
- echo
- cat changes
- } | /var/setuid-wrappers/sendmail -t
- fi
- '';
- };
- };
- users.extraUsers = singleton {
- inherit (user) name uid;
- };
- };
-
- user = {
- name = "urlwatch";
- uid = 3467631196; # genid urlwatch
- };
-in
-out
diff --git a/3modules/lass/iptables.nix b/3modules/lass/iptables.nix
deleted file mode 100644
index c97b9f7..0000000
--- a/3modules/lass/iptables.nix
+++ /dev/null
@@ -1,187 +0,0 @@
-arg@{ config, lib, pkgs, ... }:
-
-let
- inherit (pkgs) writeScript writeText;
-
- inherit (lib)
- concatMapStringsSep
- concatStringsSep
- attrNames
- unique
- fold
- any
- attrValues
- catAttrs
- filter
- flatten
- length
- hasAttr
- mkEnableOption
- mkOption
- mkIf
- types
- sort;
-
- elemIsIn = a: as:
- any (x: x == a) as;
-
- cfg = config.lass.iptables;
-
- out = {
- options.lass.iptables = api;
- config = mkIf cfg.enable imp;
- };
-
- api = {
- enable = mkEnableOption "iptables";
-
- #tables.filter.INPUT = {
- # policy = "DROP";
- # rules = [
- # { predicate = "-i retiolum"; target = "ACCEPT"; priority = -10; }
- # ];
- #};
- #new api
- tables = mkOption {
- type = with types; attrsOf (attrsOf (submodule ({
- options = {
- policy = mkOption {
- type = str;
- default = "-";
- };
- rules = mkOption {
- type = nullOr (listOf (submodule ({
- options = {
- predicate = mkOption {
- type = str;
- };
- target = mkOption {
- type = str;
- };
- precedence = mkOption {
- type = int;
- default = 0;
- };
- };
- })));
- default = null;
- };
- };
- })));
- };
- };
-
- imp = {
- networking.firewall.enable = false;
-
- systemd.services.lass-iptables = {
- description = "lass-iptables";
- wantedBy = [ "network-pre.target" ];
- before = [ "network-pre.target" ];
- after = [ "systemd-modules-load.service" ];
-
- path = with pkgs; [
- iptables
- ];
-
- restartIfChanged = true;
-
- serviceConfig = {
- Type = "simple";
- RemainAfterExit = true;
- Restart = "always";
- ExecStart = "@${startScript} lass-iptables_start";
- };
- };
- };
-
- #buildTable :: iptablesVersion -> iptablesAttrSet` -> str
- #todo: differentiate by iptables-version
- buildTables = v: ts:
- let
-
- declareChain = t: cn:
- #TODO: find out what to do whit these count numbers
- ":${cn} ${t."${cn}".policy} [0:0]";
-
- buildChain = tn: cn:
- let
- sortedRules = sort (a: b: a.precedence < b.precedence) ts."${tn}"."${cn}".rules;
-
- in
- #TODO: double check should be unneccessary, refactor!
- if (hasAttr "rules" ts."${tn}"."${cn}") then
- if (ts."${tn}"."${cn}".rules == null) then
- ""
- else
- concatMapStringsSep "\n" (rule: "\n-A ${cn} ${rule}") ([]
- ++ map (buildRule tn cn) sortedRules
- )
- else
- ""
- ;
-
-
- buildRule = tn: cn: rule:
- #target validation test:
- assert (elemIsIn rule.target ([ "ACCEPT" "REJECT" "DROP" "QUEUE" "LOG" "RETURN" ] ++ (attrNames ts."${tn}")));
-
- #predicate validation test:
- #maybe use iptables-test
- #TODO: howto exit with evaluation error by shellscript?
- #apperantly not possible from nix because evalatution wouldn't be deterministic.
- "${rule.predicate} -j ${rule.target}";
-
- buildTable = tn:
- "*${tn}\n" +
- concatStringsSep "\n" ([]
- ++ map (declareChain ts."${tn}") (attrNames ts."${tn}")
- ) +
- #this looks dirty, find a better way to do this (maybe optionalString)
- concatStringsSep "" ([]
- ++ map (buildChain tn) (attrNames ts."${tn}")
- ) +
- "\nCOMMIT";
- in
- concatStringsSep "\n" ([]
- ++ map buildTable (attrNames ts)
- );
-
-#=====
-
- rules4 = iptables-version:
- let
- #TODO: find out good defaults.
- tables-defaults = {
- nat.PREROUTING.policy = "ACCEPT";
- nat.INPUT.policy = "ACCEPT";
- nat.OUTPUT.policy = "ACCEPT";
- nat.POSTROUTING.policy = "ACCEPT";
- filter.INPUT.policy = "ACCEPT";
- filter.FORWARD.policy = "ACCEPT";
- filter.OUTPUT.policy = "ACCEPT";
-
- #if someone specifies any other rules on this chain, the default rules get lost.
- #is this wanted beahiviour or a bug?
- #TODO: implement abstraction of rules
- filter.INPUT.rules = [
- { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
- ];
- };
- tables = tables-defaults // cfg.tables;
-
- in
- writeText "lass-iptables-rules${toString iptables-version}" ''
- ${buildTables iptables-version tables}
- '';
-
- startScript = writeScript "lass-iptables_start" ''
- #! /bin/sh
- set -euf
- iptables-restore < ${rules4 4}
- ip6tables-restore < ${rules4 6}
- '';
-
-in
-out
-
diff --git a/3modules/lass/sshkeys.nix b/3modules/lass/sshkeys.nix
deleted file mode 100644
index 5f1c606..0000000
--- a/3modules/lass/sshkeys.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib, ... }:
-
-with lib;
-
-{
- options = {
- sshKeys = mkOption {
- type = types.attrsOf (types.submodule (
- { config, ... }:
- {
- options = {
- pub = mkOption {
- type = types.str;
- description = "Public part of the ssh key.";
- };
-
- priv = mkOption {
- type = types.str;
- description = "Private part of the ssh key.";
- };
- };
- }));
- description = "collection of ssh-keys";
- };
- };
-}
diff --git a/3modules/lass/urxvtd.nix b/3modules/lass/urxvtd.nix
deleted file mode 100644
index 469616a..0000000
--- a/3modules/lass/urxvtd.nix
+++ /dev/null
@@ -1,55 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-in
-
-with builtins;
-with lib;
-
-{
- options = {
- services.urxvtd = {
- enable = mkOption {
- type = types.bool;
- default = false;
- description = "Enable urxvtd per user";
- };
- users = mkOption {
- type = types.listOf types.string;
- default = [];
- description = "users to run urxvtd for";
- };
- urxvtPackage = mkOption {
- type = types.package;
- default = pkgs.rxvt_unicode;
- description = "urxvt package to use";
- };
- };
- };
-
- config =
- let
- cfg = config.services.urxvtd;
- users = cfg.users;
- urxvt = cfg.urxvtPackage;
- mkService = user: {
- description = "urxvt terminal daemon";
- wantedBy = [ "multi-user.target" ];
- restartIfChanged = false;
- path = [ pkgs.xlibs.xrdb ];
- environment = {
- DISPLAY = ":0";
- URXVT_PERL_LIB = "${urxvt}/lib/urxvt/perl";
- };
- serviceConfig = {
- Restart = "always";
- User = user;
- ExecStart = "${urxvt}/bin/urxvtd";
- };
- };
- in
- mkIf cfg.enable {
- environment.systemPackages = [ urxvt ];
- systemd.services = listToAttrs (map (u: { name = "${u}-urxvtd"; value = mkService u; }) users);
- };
-}
diff --git a/3modules/lass/xresources.nix b/3modules/lass/xresources.nix
deleted file mode 100644
index 15c5b8b..0000000
--- a/3modules/lass/xresources.nix
+++ /dev/null
@@ -1,57 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-#TODO:
-#prefix with Attribute Name
-#ex: urxvt
-
-#
-#
-with builtins;
-with lib;
-
-
-let
-
- inherit (import ../../4lib/tv { inherit pkgs lib; }) shell-escape;
- inherit (pkgs) writeScript;
-
-in
-
-{
-
- options = {
- services.xresources.enable = mkOption {
- type = types.bool;
- default = false;
- description = ''
- Whether to enable the automatic loading of Xresources definitions at display-manager start;
- '';
- };
-
- services.xresources.resources = mkOption {
- default = {};
- type = types.attrsOf types.str;
- example = {
- urxvt = ''
- URxvt*scrollBar: false
- URxvt*urgentOnBell: true
- '';
- };
- description = ''
- Xresources definitions.
- '';
- };
- };
-
- config =
- let
- cfg = config.services.xresources;
- xres = concatStringsSep "\n" (attrValues cfg.resources);
-
- in mkIf cfg.enable {
- services.xserver.displayManager.sessionCommands = ''
- echo ${shell-escape xres} | xrdb -merge
- '';
- };
-
-}
diff --git a/3modules/tv/consul.nix b/3modules/tv/consul.nix
deleted file mode 100644
index 4e54c2a..0000000
--- a/3modules/tv/consul.nix
+++ /dev/null
@@ -1,118 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-# if quorum gets lost, then start any node with a config that doesn't contain bootstrap_expect
-# but -bootstrap
-# TODO consul-bootstrap HOST that actually does is
-# TODO tools to inspect state of a cluster in outage state
-
-with import ../../4lib/tv { inherit lib pkgs; };
-let
- cfg = config.tv.consul;
-
- out = {
- options.tv.consul = api;
- config = mkIf cfg.enable (mkMerge [
- imp
- { tv.iptables.input-retiolum-accept-new-tcp = [ "8300" "8301" ]; }
- # TODO udp for 8301
- ]);
- };
-
- api = {
- enable = mkEnableOption "tv.consul";
-
- dc = mkOption {
- type = types.label;
- };
- hosts = mkOption {
- type = with types; listOf host;
- };
- encrypt-file = mkOption {
- type = types.str; # TODO path (but not just into store)
- default = "/root/src/secrets/consul-encrypt.json";
- };
- data-dir = mkOption {
- type = types.str; # TODO path (but not just into store)
- default = "/var/lib/consul";
- };
- self = mkOption {
- type = types.host;
- };
- server = mkOption {
- type = types.bool;
- default = false;
- };
- GOMAXPROCS = mkOption {
- type = types.int;
- default = cfg.self.cores;
- };
- };
-
- consul-config = {
- datacenter = cfg.dc;
- data_dir = cfg.data-dir;
- log_level = "INFO";
- #node_name =
- server = cfg.server;
- enable_syslog = true;
- retry_join =
- # TODO allow consul in other nets than retiolum [maybe]
- concatMap (host: host.nets.retiolum.addrs)
- (filter (host: host.name != cfg.self.name) cfg.hosts);
- leave_on_terminate = true;
- } // optionalAttrs cfg.server {
- bootstrap_expect = length cfg.hosts;
- leave_on_terminate = false;
- };
-
- imp = {
- environment.systemPackages = with pkgs; [
- consul
- ];
-
- systemd.services.consul = {
- after = [ "network.target" ];
- wantedBy = [ "multi-user.target" ];
- path = with pkgs; [
- consul
- ];
- environment = {
- GOMAXPROCS = toString cfg.GOMAXPROCS;
- };
- serviceConfig = {
- PermissionsStartOnly = "true";
- SyslogIdentifier = "consul";
- User = user.name;
- PrivateTmp = "true";
- Restart = "always";
- ExecStartPre = pkgs.writeScript "consul-init" ''
- #! /bin/sh
- mkdir -p ${cfg.data-dir}
- chown ${user.name}: ${cfg.data-dir}
- install -o ${user.name} -m 0400 ${cfg.encrypt-file} /tmp/encrypt.json
- '';
- ExecStart = pkgs.writeScript "consul-service" ''
- #! /bin/sh
- set -euf
- exec >/dev/null
- exec consul agent \
- -config-file=${toFile "consul.json" (toJSON consul-config)} \
- -config-file=/tmp/encrypt.json
- '';
- #-node=${cfg.self.fqdn} \
- #ExecStart = "${tinc}/sbin/tincd -c ${confDir} -d 0 -U ${user} -D";
- };
- };
-
- users.extraUsers = singleton {
- inherit (user) name uid;
- };
- };
-
- user = {
- name = "consul";
- uid = 2999951406; # genid consul
- };
-
-in
-out
diff --git a/3modules/tv/default.nix b/3modules/tv/default.nix
deleted file mode 100644
index bb10d82..0000000
--- a/3modules/tv/default.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-_:
-
-{
- imports = [
- ./consul.nix
- ./ejabberd.nix
- ./iptables.nix
- ];
-}
diff --git a/3modules/tv/ejabberd.nix b/3modules/tv/ejabberd.nix
deleted file mode 100644
index 2910a9a..0000000
--- a/3modules/tv/ejabberd.nix
+++ /dev/null
@@ -1,166 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with builtins;
-with lib;
-let
- cfg = config.tv.ejabberd;
-
- out = {
- options.tv.ejabberd = api;
- config = mkIf cfg.enable imp;
- };
-
- api = {
- enable = mkEnableOption "tv.ejabberd";
-
- certFile = mkOption {
- type = types.str;
- default = "/root/src/secrets/ejabberd.pem";
- };
-
- hosts = mkOption {
- type = with types; listOf str;
- };
- };
-
- imp = {
- environment.systemPackages = [ my-ejabberdctl ];
-
- systemd.services.ejabberd = {
- wantedBy = [ "multi-user.target" ];
- after = [ "network.target" ];
- serviceConfig = {
- Type = "oneshot";
- RemainAfterExit = "yes";
- PermissionsStartOnly = "true";
- SyslogIdentifier = "ejabberd";
- User = user.name;
- ExecStartPre = pkgs.writeScript "ejabberd-start" ''
- #! /bin/sh
- install -o ${user.name} -m 0400 ${cfg.certFile} /etc/ejabberd/ejabberd.pem
- '';
- ExecStart = pkgs.writeScript "ejabberd-service" ''
- #! /bin/sh
- ${my-ejabberdctl}/bin/ejabberdctl start
- '';
- };
- };
-
- users.extraUsers = singleton {
- inherit (user) name uid;
- home = "/var/ejabberd";
- createHome = true;
- };
- };
-
- user = {
- name = "ejabberd";
- uid = 3499746127; # genid ejabberd
- };
-
- my-ejabberdctl = pkgs.writeScriptBin "ejabberdctl" ''
- #! /bin/sh
- set -euf
- exec env \
- SPOOLDIR=/var/ejabberd \
- EJABBERD_CONFIG_PATH=${config-file} \
- ${pkgs.ejabberd}/bin/ejabberdctl \
- --logs /var/ejabberd \
- "$@"
- '';
-
- config-file = pkgs.writeText "ejabberd.cfg" ''
- {loglevel, 3}.
- {hosts, ${toErlang cfg.hosts}}.
- {listen,
- [
- {5222, ejabberd_c2s, [
- starttls,
- {certfile, "/etc/ejabberd/ejabberd.pem"},
- {access, c2s},
- {shaper, c2s_shaper},
- {max_stanza_size, 65536}
- ]},
- {5269, ejabberd_s2s_in, [
- {shaper, s2s_shaper},
- {max_stanza_size, 131072}
- ]},
- {5280, ejabberd_http, [
- captcha,
- http_bind,
- http_poll,
- web_admin
- ]}
- ]}.
- {s2s_use_starttls, required}.
- {s2s_certfile, "/etc/ejabberd/ejabberd.pem"}.
- {auth_method, internal}.
- {shaper, normal, {maxrate, 1000}}.
- {shaper, fast, {maxrate, 50000}}.
- {max_fsm_queue, 1000}.
- {acl, local, {user_regexp, ""}}.
- {access, max_user_sessions, [{10, all}]}.
- {access, max_user_offline_messages, [{5000, admin}, {100, all}]}.
- {access, local, [{allow, local}]}.
- {access, c2s, [{deny, blocked},
- {allow, all}]}.
- {access, c2s_shaper, [{none, admin},
- {normal, all}]}.
- {access, s2s_shaper, [{fast, all}]}.
- {access, announce, [{allow, admin}]}.
- {access, configure, [{allow, admin}]}.
- {access, muc_admin, [{allow, admin}]}.
- {access, muc_create, [{allow, local}]}.
- {access, muc, [{allow, all}]}.
- {access, pubsub_createnode, [{allow, local}]}.
- {access, register, [{allow, all}]}.
- {language, "en"}.
- {modules,
- [
- {mod_adhoc, []},
- {mod_announce, [{access, announce}]},
- {mod_blocking,[]},
- {mod_caps, []},
- {mod_configure,[]},
- {mod_disco, []},
- {mod_irc, []},
- {mod_http_bind, []},
- {mod_last, []},
- {mod_muc, [
- {access, muc},
- {access_create, muc_create},
- {access_persistent, muc_create},
- {access_admin, muc_admin}
- ]},
- {mod_offline, [{access_max_user_messages, max_user_offline_messages}]},
- {mod_ping, []},
- {mod_privacy, []},
- {mod_private, []},
- {mod_pubsub, [
- {access_createnode, pubsub_createnode},
- {ignore_pep_from_offline, true},
- {last_item_cache, false},
- {plugins, ["flat", "hometree", "pep"]}
- ]},
- {mod_register, [
- {welcome_message, {"Welcome!",
- "Hi.\nWelcome to this XMPP server."}},
- {ip_access, [{allow, "127.0.0.0/8"},
- {deny, "0.0.0.0/0"}]},
- {access, register}
- ]},
- {mod_roster, []},
- {mod_shared_roster,[]},
- {mod_stats, []},
- {mod_time, []},
- {mod_vcard, []},
- {mod_version, []}
- ]}.
- '';
-
-
- # XXX this is a placeholder that happens to work the default strings.
- toErlang = builtins.toJSON;
-
-in
-out
diff --git a/3modules/tv/iptables.nix b/3modules/tv/iptables.nix
deleted file mode 100644
index 173e582..0000000
--- a/3modules/tv/iptables.nix
+++ /dev/null
@@ -1,126 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with builtins;
-with lib;
-let
- cfg = config.tv.iptables;
-
- out = {
- options.tv.iptables = api;
- config = mkIf cfg.enable imp;
- };
-
- api = {
- enable = mkEnableOption "tv.iptables";
-
- input-internet-accept-new-tcp = mkOption {
- type = with types; listOf (either int str);
- default = [];
- };
-
- input-retiolum-accept-new-tcp = mkOption {
- type = with types; listOf (either int str);
- default = [];
- };
- };
-
- imp = {
- networking.firewall.enable = false;
-
- systemd.services.tv-iptables = {
- description = "tv-iptables";
- wantedBy = [ "network-pre.target" ];
- before = [ "network-pre.target" ];
- after = [ "systemd-modules-load.service" ];
-
- path = with pkgs; [
- iptables
- ];
-
- restartIfChanged = true;
-
- serviceConfig = {
- Type = "simple";
- RemainAfterExit = true;
- Restart = "always";
- ExecStart = "@${startScript} tv-iptables_start";
- };
- };
- };
-
-
- accept-new-tcp = port:
- "-p tcp -m tcp --dport ${port} -m conntrack --ctstate NEW -j ACCEPT";
-
- rules = iptables-version:
- pkgs.writeText "tv-iptables-rules${toString iptables-version}" ''
- *nat
- :PREROUTING ACCEPT [0:0]
- :INPUT ACCEPT [0:0]
- :OUTPUT ACCEPT [0:0]
- :POSTROUTING ACCEPT [0:0]
- ${concatMapStringsSep "\n" (rule: "-A PREROUTING ${rule}") ([]
- ++ [
- "! -i retiolum -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 0"
- "-p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22"
- ]
- )}
- COMMIT
- *filter
- :INPUT DROP [0:0]
- :FORWARD DROP [0:0]
- :OUTPUT ACCEPT [0:0]
- :Retiolum - [0:0]
- ${concatMapStringsSep "\n" (rule: "-A INPUT ${rule}") ([]
- ++ [
- "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
- "-i lo -j ACCEPT"
- ]
- ++ map accept-new-tcp (unique (map toString cfg.input-internet-accept-new-tcp))
- ++ ["-i retiolum -j Retiolum"]
- )}
- ${concatMapStringsSep "\n" (rule: "-A Retiolum ${rule}") ([]
- ++ {
- ip4tables = [
- "-p icmp -m icmp --icmp-type echo-request -j ACCEPT"
- ];
- ip6tables = [
- "-p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT"
- ];
- }."ip${toString iptables-version}tables"
- ++ map accept-new-tcp (unique (map toString cfg.input-retiolum-accept-new-tcp))
- ++ {
- ip4tables = [
- "-p tcp -j REJECT --reject-with tcp-reset"
- "-p udp -j REJECT --reject-with icmp-port-unreachable"
- "-j REJECT --reject-with icmp-proto-unreachable"
- ];
- ip6tables = [
- "-p tcp -j REJECT --reject-with tcp-reset"
- "-p udp -j REJECT --reject-with icmp6-port-unreachable"
- "-j REJECT"
- ];
- }."ip${toString iptables-version}tables"
- )}
- COMMIT
- '';
-
- startScript = pkgs.writeScript "tv-iptables_start" ''
- #! /bin/sh
- set -euf
- iptables-restore < ${rules 4}
- ip6tables-restore < ${rules 6}
- '';
-
-in
-out
-
-#let
-# cfg = config.tv.iptables;
-# arg' = arg // { inherit cfg; };
-#in
-#
-#{
-# options.tv.iptables = import ./options.nix arg';
-# config = lib.mkIf cfg.enable (import ./config.nix arg');
-#}
generated by cgit v1.2.3 (git 2.25.1) at 2025-03-20 10:13:38 +0000
[cgit] Unable to lock slot /tmp/cgit/7b100000.lock: Permission denied (13)