From 20ed2b65d438b22e6d3bf241f3ef7f672776ac15 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 12 Feb 2016 23:20:50 +0100
Subject: make install: make ssh configurable

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index f39ed0c..a25b907 100644
--- a/Makefile
+++ b/Makefile
@@ -29,7 +29,7 @@ eval eval.:;@$(call evaluate)
 eval.%:;@$(call evaluate,-A $*)
 
 # usage: make install system=foo [target_host=bar]
-install: ssh = ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
+install: ssh ?= ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
 install:
 	$(ssh) $(target_user)@$(target_host) \
 		env target_path=$(target_path) \
-- 
cgit v1.2.3


From 92efbd1aea33eef222249d61e0863521ef1de953 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 16:03:40 +0100
Subject: deploy,install,populate: admit target SSH port

---
 Makefile | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/Makefile b/Makefile
index a25b907..c7dee13 100644
--- a/Makefile
+++ b/Makefile
@@ -4,6 +4,7 @@ endif
 
 export target_host ?= $(system)
 export target_user ?= root
+export target_port ?= 22
 export target_path ?= /var/src
 
 evaluate = \
@@ -22,7 +23,8 @@ execute = \
 # usage: make deploy system=foo [target_host=bar]
 deploy:
 	$(call execute,populate)
-	ssh $(target_user)@$(target_host) nixos-rebuild switch -I $(target_path)
+	ssh $(target_user)@$(target_host) -p $(target_port) \
+		nixos-rebuild switch -I $(target_path)
 
 # usage: make LOGNAME=shared system=wolf eval.config.krebs.build.host.name
 eval eval.:;@$(call evaluate)
@@ -31,10 +33,10 @@ eval.%:;@$(call evaluate,-A $*)
 # usage: make install system=foo [target_host=bar]
 install: ssh ?= ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
 install:
-	$(ssh) $(target_user)@$(target_host) \
+	$(ssh) $(target_user)@$(target_host) -p $(target_port) \
 		env target_path=$(target_path) \
 			sh -s prepare < krebs/4lib/infest/prepare.sh
 	target_path=/mnt$(target_path) $(call execute,populate)
-	$(ssh) $(target_user)@$(target_host) \
+	$(ssh) $(target_user)@$(target_host) -p $(target_port) \
 		env NIXOS_CONFIG=$(target_path)/nixos-config \
 			nixos-install
-- 
cgit v1.2.3


From 0a6a96d8cb5bce4236416c374cd4b49372308d43 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 17:56:06 +0100
Subject: tv urlwatch: add vncdotool and noVNC

---
 tv/2configs/urlwatch.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tv/2configs/urlwatch.nix b/tv/2configs/urlwatch.nix
index 8189f63..0106cdd 100644
--- a/tv/2configs/urlwatch.nix
+++ b/tv/2configs/urlwatch.nix
@@ -51,6 +51,9 @@
       # <stockholm/tv/2configs/xserver/xserver.conf.nix>
       # is derived from `configFile` in:
       https://raw.githubusercontent.com/NixOS/nixpkgs/master/nixos/modules/services/x11/xserver.nix
+
+      https://pypi.python.org/pypi/vncdotool
+      https://api.github.com/repos/kanaka/noVNC/tags
     ];
   };
 }
-- 
cgit v1.2.3


From 93b855971767db02e3be4584b24186510a78a214 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 17:56:59 +0100
Subject: tv backup: add xu-test-*

---
 tv/2configs/backup.nix | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix
index 6c90709..57f299e 100644
--- a/tv/2configs/backup.nix
+++ b/tv/2configs/backup.nix
@@ -26,5 +26,28 @@ with lib;
         yearly   = { format = "%Y";                       };
       };
     };
+  } // mapAttrs (_: recursiveUpdate {
+    snapshots = {
+      minutely = { format = "%Y-%m-%dT%H:%M"; retain = 3; };
+      hourly   = { format = "%Y-%m-%dT%H";    retain = 3; };
+      daily    = { format = "%Y-%m-%d";       retain = 3; };
+    };
+    startAt = null;
+  }) {
+    xu-test-push-xu = {
+      method = "push";
+      src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; };
+      dst = { host = config.krebs.hosts.xu; path = "/bku/xu-test-push"; };
+    };
+    xu-test-pull-xu = {
+      method = "pull";
+      src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; };
+      dst = { host = config.krebs.hosts.xu; path = "/bku/xu-test-pull"; };
+    };
+    xu-test-push-wu = {
+      method = "push";
+      src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; };
+      dst = { host = config.krebs.hosts.wu; path = "/bku/xu-test-push"; };
+    };
   };
 }
-- 
cgit v1.2.3


From b87dcc5be3dc876f34129be3f3c71095779a5954 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 17:58:02 +0100
Subject: tv systemPackages: add get, krebszones, nix-prefetch-scripts, and
 push

---
 tv/2configs/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index b5639af..dee0b15 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -183,6 +183,15 @@ with lib;
         "sendmail"  # for sudo
       ];
     }
+    {
+      environment.systemPackages = [
+        pkgs.get
+        pkgs.krebszones
+        pkgs.nix-prefetch-scripts
+        pkgs.push
+      ];
+    }
+
     {
       systemd.tmpfiles.rules = let
         forUsers = flip map users;
-- 
cgit v1.2.3


From 204536bfd8ec61f8902dba4f47cb646d8701c8de Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 17:58:40 +0100
Subject: xu systemPackages: s/#cac/cac-api/

---
 tv/1systems/xu.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 8c4af2b..6f882cd 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -43,7 +43,7 @@ with lib;
         # tv
         bc
         bind # dig
-        #cac
+        cac-api
         dic
         file
         gnupg21
-- 
cgit v1.2.3


From 4550604ec74b536338c5befef894a557ca43d6f9 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 18:15:59 +0100
Subject: tv: lol libvirt

---
 tv/1systems/wu.nix | 3 ---
 tv/1systems/xu.nix | 2 --
 2 files changed, 5 deletions(-)

diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 4ed13a0..0184ed9 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -191,8 +191,6 @@ with lib;
     "d /tmp 1777 root root - -" # does this work with mounted /tmp?
   ];
 
-  virtualisation.libvirtd.enable = true;
-
   services.udev.extraRules = ''
     SUBSYSTEM=="net", ATTR{address}=="00:90:f5:da:aa:c3", NAME="en0"
     SUBSYSTEM=="net", ATTR{address}=="a0:88:b4:1b:ae:6c", NAME="wl0"
@@ -211,5 +209,4 @@ with lib;
   services.tor.client.enable = true;
   services.tor.enable = true;
   services.virtualboxHost.enable = true;
-
 }
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 6f882cd..098d5ff 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -189,8 +189,6 @@ with lib;
     "d /tmp 1777 root root - -" # does this work with mounted /tmp?
   ];
 
-  #virtualisation.libvirtd.enable = true;
-
   #services.bitlbee.enable = true;
   #services.tor.client.enable = true;
   #services.tor.enable = true;
-- 
cgit v1.2.3


From 908e2bbf610f05290e4736b7140f9bf3d51198ab Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 18:17:55 +0100
Subject: nixpkgs: enable nix-* autocall

---
 nixpkgs/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nixpkgs/default.nix b/nixpkgs/default.nix
index 1fe99b0..8514fa4 100644
--- a/nixpkgs/default.nix
+++ b/nixpkgs/default.nix
@@ -1,5 +1,6 @@
-_:
+{ system ? builtins.currentSystem }:
 
 (import <stockholm> {
+  inherit system;
   configuration = {};
 }).pkgs
-- 
cgit v1.2.3


From 0798ee7bfb748e877e89c452e8fa4fa74b159eb7 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 18:21:17 +0100
Subject: xu-qemu0: init

---
 tv/1systems/xu-qemu0.nix |  27 ++++++
 tv/1systems/xu.nix       |   1 +
 tv/2configs/xu-qemu0.nix | 226 +++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 254 insertions(+)
 create mode 100644 tv/1systems/xu-qemu0.nix
 create mode 100644 tv/2configs/xu-qemu0.nix

diff --git a/tv/1systems/xu-qemu0.nix b/tv/1systems/xu-qemu0.nix
new file mode 100644
index 0000000..03ac19c
--- /dev/null
+++ b/tv/1systems/xu-qemu0.nix
@@ -0,0 +1,27 @@
+{ config, lib, pkgs, ... }:
+
+{
+  krebs.hosts.xu-qemu0 = {
+    cores = 1;
+    ssh.privkey.path = <secrets/ssh.id_ed25519>;
+    # cannot define ssh.pubkey without at least one addr or alias
+    #ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFe51rD0ZqlMXNi/YpapnRzvdzCjI0icmxfCyBLSKG04";
+  };
+  krebs.build.host = config.krebs.hosts.xu-qemu0;
+
+  imports = [
+    <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
+  ];
+
+  boot.loader.grub.device = "/dev/sda";
+
+  fileSystems = {
+    "/boot" = {
+      device = "/dev/sda1";
+    };
+    "/" = {
+      device = "/dev/sda2";
+      fsType = "btrfs";
+    };
+  };
+}
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 098d5ff..2719d56 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -14,6 +14,7 @@ with lib;
     ../2configs/pulse.nix
     ../2configs/retiolum.nix
     ../2configs/xserver
+    ../2configs/xu-qemu0.nix
     {
       environment.systemPackages = with pkgs; [
 
diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
new file mode 100644
index 0000000..8366036
--- /dev/null
+++ b/tv/2configs/xu-qemu0.nix
@@ -0,0 +1,226 @@
+{ config, lib, pkgs, ... }:
+
+let
+  # XXX cannot use config.build.host.name here because infinite recursion when
+  # defining  krebs.hosts.${host-name}.nets.retiolum.aliases  below.
+  host-name = "xu";
+in
+
+# usage:
+#   sudo -iu df xu-qemu0
+#   set_password vnc correcthorze
+#
+#   vncdo -s xu:1 type 'curl init.xu.r' key shift-\\ type sh key return
+#
+#   http://vnc.xu/vnc_auto.html?port=5701&host=xu&password=correcthorze
+#
+#   make [install] system=xu-qemu0 target_host=10.56.0.101
+
+
+with lib;
+
+{
+  #networking.wireless.interfaces = [ "wlp3s0" ];
+
+  #networking.useNetworkd = true;
+
+  #networking.dhcpcd.allowInterfaces = [
+  #  "qemubr0"
+  #];
+
+  #systemd.network.networks.wlp3s0 = {
+  #  matchConfig.name = "wlp3s0";
+  #  networkConfig.Bridge = "qemubr0";
+  #};
+
+  systemd.network.enable = true;
+
+  systemd.network.netdevs.qemubr0 = {
+    netdevConfig = {
+      Name = "qemubr0";
+      Kind = "bridge";
+    };
+  };
+
+  users.groups.qemu-users.gid = genid "qemu-users";
+  users.users.df.extraGroups = [ "qemu-users" ];
+
+  environment.etc."qemu/bridge.conf".text = ''
+    allow qemubr0
+  '';
+
+  krebs.per-user.tv.packages = [
+    pkgs.vncdotool
+  ];
+
+  krebs.per-user.df.packages = [
+    (pkgs.writeDashBin "xu-qemu0" ''
+      set -efux
+      img=$HOME/tmp/xu-qemu0.raw
+      if ! test -e "$img"; then
+        ${pkgs.coreutils}/bin/mkdir -p "$(${pkgs.coreutils}/bin/dirname "$img")"
+        ${pkgs.kvm}/bin/qemu-img create "$img" 10G
+      fi
+      exec ${pkgs.kvm}/bin/qemu-kvm \
+          -monitor stdio \
+          -boot order=cd \
+          -cdrom ${pkgs.fetchurl {
+            url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso;
+            sha256 = "18bc9wrsrjnhj9rya75xliqkl99gxbsk4dmwqivhvwfzb5qb5yp9";
+          }} \
+          -m 1024 \
+          -netdev bridge,br=qemubr0,id=hn0,helper=/var/setuid-wrappers/qemu-bridge-helper \
+          -net nic,netdev=hn0,id=nic1,macaddr=52:54:00:12:34:56 \
+          -drive file="$img",format=raw \
+          -display vnc=:1,websocket=5701,password,lossy \
+          -name xu-qemu0 \
+    '')
+  ];
+
+  #TODO krebs.setuid.qemu-bridge-helper = {
+  #  filename = "${pkgs.qemu}/libexec/qemu-bridge-helper";
+  #  owner = "root";
+  #  group = "qemu-users";
+  #  mode = "4710";
+  #};
+  system.activationScripts."krebs.setuid" = stringAfter [ "setuid" ] ''
+    src=${pkgs.execve "qemu-bridge-helper" {
+      filename = "${pkgs.qemu}/libexec/qemu-bridge-helper";
+    }}
+    dst=${config.security.wrapperDir}/qemu-bridge-helper
+    cp "$src" "$dst"
+    chown root.qemu-users "$dst"
+    chmod 4710 "$dst"
+  '';
+
+  users.users.qemu-dnsmasq.uid = genid "qemu-dnsmasq";
+
+  # TODO need custom etc/dbus-1/system.d/dnsmasq.conf for different BusName
+  services.dbus.packages = [ pkgs.dnsmasq ];
+
+  systemd.services.qemu-dnsmasq = let
+    # bind-interfaces
+    conf = pkgs.writeText "qemu-dnsmasq.conf" ''
+      listen-address=10.56.0.1
+      interface=qemubr0
+      dhcp-range=10.56.0.200,10.56.0.250
+      dhcp-no-override
+      dhcp-leasefile=/tmp/qemu-dnsmasq.leases
+      domain=${host-name}.local
+      dhcp-host=52:54:00:12:34:56,xu-qemu0,10.56.0.101,1440m
+    '';
+  in {
+    after = [ "network.target" "systemd-resolved.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "dbus";
+      BusName = "uk.org.thekelleys.dnsmasq";
+      # -1 --enable-dbus[=uk.org.thekelleys.dnsmasq]
+      SyslogIdentifier = "qemu-dnsmasq";
+      ExecStart = "${pkgs.dnsmasq}/bin/dnsmasq -1k -u qemu-dnsmasq -C ${conf}";
+      ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+      PrivateTmp = "true";
+    };
+    restartTriggers = [ config.environment.etc.hosts.source ];
+  };
+
+
+  krebs.nginx.servers.init = {
+    server-names = [
+      "init.${host-name}"
+      "init.${host-name}.r"
+      "init.${host-name}.retiolum"
+    ];
+    extraConfig = ''
+      index init.txt;
+      root ${pkgs.writeTextFile {
+        name = "init-pages";
+        text = ''
+          #! /bin/sh
+          set -efu
+
+          dev=/dev/sda
+          pttype=dos # gpt
+
+          case $pttype in
+            dos)
+              if ! test "$(blkid -o value -s PTTYPE "$dev")" = dos; then
+                parted -s "$dev" mklabel msdos
+              fi
+              if ! test "$(blkid -o value -s PARTLABEL "$dev"1)" = primary; then
+                parted -s "$dev" mkpart primary ext4 1MiB 513MiB
+                parted -s "$dev" set 1 boot on
+              fi
+              ;;
+            gpt)
+              if ! test "$(blkid -o value -s PTTYPE "$dev")" = gpt; then
+                parted -s "$dev" mklabel gpt
+              fi
+              if ! test "$(blkid -o value -s PARTLABEL "$dev"1)" = ESP; then
+                parted -s "$dev" mkpart ESP fat32 1MiB 513MiB
+                parted -s "$dev" set 1 boot on
+              fi
+              ;;
+            *)
+              echo "Error: bad pttype: $pttype" >&2
+              exit -1
+          esac
+
+          if ! test "$(blkid -o value -s PARTLABEL "$dev"2)" = primary; then
+            parted -s "$dev" mkpart primary btrfs 513MiB 100%
+          fi
+          if ! test "$(blkid -o value -s TYPE "$dev"1)" = vfat; then
+            mkfs.vfat "$dev"1
+          fi
+          if ! test "$(blkid -o value -s TYPE "$dev"2)" = btrfs; then
+            mkfs.btrfs "$dev"2
+          fi
+
+          parted "$dev" print
+
+          if ! test "$(lsblk -n -o MOUNTPOINT "$dev"2)" = /mnt; then
+            mount "$dev"2 /mnt
+          fi
+          if ! test "$(lsblk -n -o MOUNTPOINT "$dev"1)" = /mnt/boot; then
+            mkdir -m 0000 -p /mnt/boot
+            mount "$dev"1 /mnt/boot
+          fi
+
+          lsblk "$dev"
+
+          key=${shell.escape config.krebs.users.tv-xu.pubkey}
+
+          if [ "$(cat /root/.ssh/authorized_keys 2>/dev/null)" != "$key" ]; then
+            mkdir -p /root/.ssh
+            echo "$key" > /root/.ssh/authorized_keys
+          fi
+          systemctl start sshd
+          ip route
+          echo READY.
+        '';
+        destination = "/init.txt";
+      }};
+    '';
+  };
+
+
+  krebs.hosts.${host-name}.nets.retiolum.aliases = [
+    "init.${host-name}.r"
+    "init.${host-name}.retiolum"
+    "vnc.${host-name}.r"
+    "vnc.${host-name}.retiolum"
+  ];
+
+  krebs.nginx.servers.noVNC = {
+    server-names = [
+      "vnc.${host-name}"
+      "vnc.${host-name}.r"
+      "vnc.${host-name}.retiolum"
+    ];
+    #rewrite ^([^.]*)$ /vnc_auto.html?host=localhost&port=5701;
+    locations = singleton (nameValuePair "/" ''
+      index vnc.html;
+      root ${pkgs.noVNC};
+    '');
+  };
+}
-- 
cgit v1.2.3


From c276992906cf189c018bd7eac537b9d6cb69723d Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 19:57:45 +0100
Subject: tv: add systemd.services.xu-qemu0 + xu-qemu0-monitor

---
 tv/2configs/default.nix  |  1 +
 tv/2configs/xu-qemu0.nix | 86 +++++++++++++++++++++++++++++++++---------------
 2 files changed, 61 insertions(+), 26 deletions(-)

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index dee0b15..2edaed7 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -44,6 +44,7 @@ with lib;
           tv = {
             isNormalUser = true;
             uid = 1337;
+            extraGroups = [ "tv" ];
           };
         };
       };
diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
index 8366036..4584dcd 100644
--- a/tv/2configs/xu-qemu0.nix
+++ b/tv/2configs/xu-qemu0.nix
@@ -7,8 +7,7 @@ let
 in
 
 # usage:
-#   sudo -iu df xu-qemu0
-#   set_password vnc correcthorze
+#   echo set_password vnc correcthorze | xu-qemu0-monitor
 #
 #   vncdo -s xu:1 type 'curl init.xu.r' key shift-\\ type sh key return
 #
@@ -16,6 +15,13 @@ in
 #
 #   make [install] system=xu-qemu0 target_host=10.56.0.101
 
+# TODO iptables -A INPUT -p udp -m udp --dport bootps -j ACCEPT
+# TODO iptables -A FORWARD -i qemubr0 -s 10.56.0.1/24 -m conntrack --ctstate NEW -j ACCEPT
+# TODO iptables -A POSTROUTING -t nat -j MASQUERADE
+# TODO iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+# TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT
+# TODO echo 1 > /proc/sys/net/ipv4/ip_forward
+# TODO ifconfig qemubr0 10.56.0.1/24 up
 
 with lib;
 
@@ -43,7 +49,6 @@ with lib;
   };
 
   users.groups.qemu-users.gid = genid "qemu-users";
-  users.users.df.extraGroups = [ "qemu-users" ];
 
   environment.etc."qemu/bridge.conf".text = ''
     allow qemubr0
@@ -53,29 +58,58 @@ with lib;
     pkgs.vncdotool
   ];
 
-  krebs.per-user.df.packages = [
-    (pkgs.writeDashBin "xu-qemu0" ''
-      set -efux
-      img=$HOME/tmp/xu-qemu0.raw
-      if ! test -e "$img"; then
-        ${pkgs.coreutils}/bin/mkdir -p "$(${pkgs.coreutils}/bin/dirname "$img")"
-        ${pkgs.kvm}/bin/qemu-img create "$img" 10G
-      fi
-      exec ${pkgs.kvm}/bin/qemu-kvm \
-          -monitor stdio \
-          -boot order=cd \
-          -cdrom ${pkgs.fetchurl {
-            url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso;
-            sha256 = "18bc9wrsrjnhj9rya75xliqkl99gxbsk4dmwqivhvwfzb5qb5yp9";
-          }} \
-          -m 1024 \
-          -netdev bridge,br=qemubr0,id=hn0,helper=/var/setuid-wrappers/qemu-bridge-helper \
-          -net nic,netdev=hn0,id=nic1,macaddr=52:54:00:12:34:56 \
-          -drive file="$img",format=raw \
-          -display vnc=:1,websocket=5701,password,lossy \
-          -name xu-qemu0 \
-    '')
-  ];
+  users.users.xu-qemu0 = {
+    createHome = true;
+    group = "qemu-users";
+    home = "/home/xu-qemu0";
+    uid = genid "xu-qemu0";
+  };
+
+  systemd.services.xu-qemu0 = let
+  in {
+    after = [ "network.target" "systemd-resolved.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      User = "xu-qemu0";
+      SyslogIdentifier = "xu-qemu0";
+      ExecStart = pkgs.writeDash "xu-qemu0" ''
+        set -efu
+        img=$HOME/tmp/xu-qemu0.raw
+        if ! test -e "$img"; then
+          ${pkgs.coreutils}/bin/mkdir -p "$(${pkgs.coreutils}/bin/dirname "$img")"
+          ${pkgs.kvm}/bin/qemu-img create "$img" 10G
+        fi
+        exec ${pkgs.kvm}/bin/qemu-kvm \
+            -monitor unix:$HOME/xu-qemu0.sock,server,nowait \
+            -boot order=cd \
+            -cdrom ${pkgs.fetchurl {
+              url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso;
+              sha256 = "18bc9wrsrjnhj9rya75xliqkl99gxbsk4dmwqivhvwfzb5qb5yp9";
+            }} \
+            -m 1024 \
+            -netdev bridge,br=qemubr0,id=hn0,helper=/var/setuid-wrappers/qemu-bridge-helper \
+            -net nic,netdev=hn0,id=nic1,macaddr=52:54:00:12:34:56 \
+            -drive file="$img",format=raw \
+            -display vnc=:1,websocket=5701,password,lossy \
+            -name xu-qemu0 \
+      '';
+    };
+  };
+
+  system.activationScripts."krebs.setuid.xu-qemu0-monitor" = stringAfter [ "setuid" ] ''
+    src=${pkgs.execve "xu-qemu0-monitor" {
+      # TODO toC should handle derivation, then we don't have to "${...}" here
+      filename = "${pkgs.writeDash "xu-qemu0-monitor" ''
+        exec ${pkgs.socat}/bin/socat \
+            stdio \
+            UNIX-CONNECT:${config.users.users.xu-qemu0.home}/xu-qemu0.sock \
+      ''}";
+    }}
+    dst=${config.security.wrapperDir}/xu-qemu0-monitor
+    cp "$src" "$dst"
+    chown xu-qemu0.tv "$dst"
+    chmod 4710 "$dst"
+  '';
 
   #TODO krebs.setuid.qemu-bridge-helper = {
   #  filename = "${pkgs.qemu}/libexec/qemu-bridge-helper";
-- 
cgit v1.2.3


From 4713de3573f34a0a2bec043fe17d98758636711a Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 20:09:23 +0100
Subject: xu-qemu0: create socket in ~/tmp

---
 tv/2configs/xu-qemu0.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
index 4584dcd..470b16e 100644
--- a/tv/2configs/xu-qemu0.nix
+++ b/tv/2configs/xu-qemu0.nix
@@ -74,13 +74,13 @@ with lib;
       SyslogIdentifier = "xu-qemu0";
       ExecStart = pkgs.writeDash "xu-qemu0" ''
         set -efu
+        ${pkgs.coreutils}/bin/mkdir -p "$HOME/tmp"
         img=$HOME/tmp/xu-qemu0.raw
         if ! test -e "$img"; then
-          ${pkgs.coreutils}/bin/mkdir -p "$(${pkgs.coreutils}/bin/dirname "$img")"
           ${pkgs.kvm}/bin/qemu-img create "$img" 10G
         fi
         exec ${pkgs.kvm}/bin/qemu-kvm \
-            -monitor unix:$HOME/xu-qemu0.sock,server,nowait \
+            -monitor unix:$HOME/tmp/xu-qemu0.sock,server,nowait \
             -boot order=cd \
             -cdrom ${pkgs.fetchurl {
               url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso;
@@ -102,7 +102,7 @@ with lib;
       filename = "${pkgs.writeDash "xu-qemu0-monitor" ''
         exec ${pkgs.socat}/bin/socat \
             stdio \
-            UNIX-CONNECT:${config.users.users.xu-qemu0.home}/xu-qemu0.sock \
+            UNIX-CONNECT:${config.users.users.xu-qemu0.home}/tmp/xu-qemu0.sock \
       ''}";
     }}
     dst=${config.security.wrapperDir}/xu-qemu0-monitor
-- 
cgit v1.2.3


From 026d8cb2eb6e7479a75eb3bf170c67a103d0197a Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 20:11:26 +0100
Subject: xu-qemu0: not wanted by multi-user.target

---
 tv/2configs/xu-qemu0.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
index 470b16e..bc108b4 100644
--- a/tv/2configs/xu-qemu0.nix
+++ b/tv/2configs/xu-qemu0.nix
@@ -68,7 +68,6 @@ with lib;
   systemd.services.xu-qemu0 = let
   in {
     after = [ "network.target" "systemd-resolved.service" ];
-    wantedBy = [ "multi-user.target" ];
     serviceConfig = {
       User = "xu-qemu0";
       SyslogIdentifier = "xu-qemu0";
-- 
cgit v1.2.3


From 0bb63de57d48bb79518815a0ee1c5c4eea0f342c Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 20:16:50 +0100
Subject: xu-qemu0: disable services.resolved

---
 tv/2configs/xu-qemu0.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
index bc108b4..205b1c0 100644
--- a/tv/2configs/xu-qemu0.nix
+++ b/tv/2configs/xu-qemu0.nix
@@ -40,6 +40,7 @@ with lib;
   #};
 
   systemd.network.enable = true;
+  services.resolved.enable = mkForce false;
 
   systemd.network.netdevs.qemubr0 = {
     netdevConfig = {
-- 
cgit v1.2.3


From d08dab713bdd5bb61e47ed5a53c4ef530e704599 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 20:55:38 +0100
Subject: xu-qemu0: setup qemubr0 address and route

---
 tv/2configs/xu-qemu0.nix | 28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
index 205b1c0..4d39031 100644
--- a/tv/2configs/xu-qemu0.nix
+++ b/tv/2configs/xu-qemu0.nix
@@ -15,33 +15,31 @@ in
 #
 #   make [install] system=xu-qemu0 target_host=10.56.0.101
 
-# TODO iptables -A INPUT -p udp -m udp --dport bootps -j ACCEPT
+# TODO iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 # TODO iptables -A FORWARD -i qemubr0 -s 10.56.0.1/24 -m conntrack --ctstate NEW -j ACCEPT
 # TODO iptables -A POSTROUTING -t nat -j MASQUERADE
-# TODO iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+# TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport bootps -j ACCEPT
 # TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT
 # TODO echo 1 > /proc/sys/net/ipv4/ip_forward
-# TODO ifconfig qemubr0 10.56.0.1/24 up
 
 with lib;
 
 {
-  #networking.wireless.interfaces = [ "wlp3s0" ];
-
-  #networking.useNetworkd = true;
-
-  #networking.dhcpcd.allowInterfaces = [
-  #  "qemubr0"
-  #];
-
-  #systemd.network.networks.wlp3s0 = {
-  #  matchConfig.name = "wlp3s0";
-  #  networkConfig.Bridge = "qemubr0";
-  #};
+  networking.dhcpcd.denyInterfaces = [ "qemubr0" ];
 
   systemd.network.enable = true;
   services.resolved.enable = mkForce false;
 
+  systemd.network.networks.qemubr0 = {
+    matchConfig.Name = "qemubr0";
+    address = ["10.56.0.1/24"];
+    routes = [{
+      routeConfig = {
+        Gateway = "*";
+        Destination = "10.56.0.0";
+      };
+    }];
+  };
   systemd.network.netdevs.qemubr0 = {
     netdevConfig = {
       Name = "qemubr0";
-- 
cgit v1.2.3


From 1c5c7af4b04fc967b664b2102cfc03336f7a501c Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 20:58:27 +0100
Subject: xu-qemu0: net.ipv4.ip_forward = 1

---
 tv/2configs/xu-qemu0.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
index 4d39031..9962ca5 100644
--- a/tv/2configs/xu-qemu0.nix
+++ b/tv/2configs/xu-qemu0.nix
@@ -20,7 +20,6 @@ in
 # TODO iptables -A POSTROUTING -t nat -j MASQUERADE
 # TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport bootps -j ACCEPT
 # TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT
-# TODO echo 1 > /proc/sys/net/ipv4/ip_forward
 
 with lib;
 
@@ -30,6 +29,8 @@ with lib;
   systemd.network.enable = true;
   services.resolved.enable = mkForce false;
 
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+
   systemd.network.networks.qemubr0 = {
     matchConfig.Name = "qemubr0";
     address = ["10.56.0.1/24"];
-- 
cgit v1.2.3


From 1e69dbac0c978aef960228144db635a34e2b4d37 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 14 Feb 2016 13:26:37 +0100
Subject: krebs.setuid: init

---
 tv/2configs/xu-qemu0.nix | 44 ++++++++++++++------------------------------
 1 file changed, 14 insertions(+), 30 deletions(-)

diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
index 9962ca5..df35f5c 100644
--- a/tv/2configs/xu-qemu0.nix
+++ b/tv/2configs/xu-qemu0.nix
@@ -79,7 +79,7 @@ with lib;
           ${pkgs.kvm}/bin/qemu-img create "$img" 10G
         fi
         exec ${pkgs.kvm}/bin/qemu-kvm \
-            -monitor unix:$HOME/tmp/xu-qemu0.sock,server,nowait \
+            -monitor unix:$HOME/tmp/xu-qemu0-monitor.sock,server,nowait \
             -boot order=cd \
             -cdrom ${pkgs.fetchurl {
               url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso;
@@ -95,36 +95,20 @@ with lib;
     };
   };
 
-  system.activationScripts."krebs.setuid.xu-qemu0-monitor" = stringAfter [ "setuid" ] ''
-    src=${pkgs.execve "xu-qemu0-monitor" {
-      # TODO toC should handle derivation, then we don't have to "${...}" here
-      filename = "${pkgs.writeDash "xu-qemu0-monitor" ''
-        exec ${pkgs.socat}/bin/socat \
-            stdio \
-            UNIX-CONNECT:${config.users.users.xu-qemu0.home}/tmp/xu-qemu0.sock \
-      ''}";
-    }}
-    dst=${config.security.wrapperDir}/xu-qemu0-monitor
-    cp "$src" "$dst"
-    chown xu-qemu0.tv "$dst"
-    chmod 4710 "$dst"
-  '';
+  krebs.setuid.xu-qemu0-monitor = {
+    filename = pkgs.writeDash "xu-qemu0-monitor" ''
+      exec ${pkgs.socat}/bin/socat \
+          stdio \
+          UNIX-CONNECT:${config.users.users.xu-qemu0.home}/tmp/xu-qemu0-monitor.sock \
+    '';
+    owner = "xu-qemu0";
+    group = "tv";
+  };
 
-  #TODO krebs.setuid.qemu-bridge-helper = {
-  #  filename = "${pkgs.qemu}/libexec/qemu-bridge-helper";
-  #  owner = "root";
-  #  group = "qemu-users";
-  #  mode = "4710";
-  #};
-  system.activationScripts."krebs.setuid" = stringAfter [ "setuid" ] ''
-    src=${pkgs.execve "qemu-bridge-helper" {
-      filename = "${pkgs.qemu}/libexec/qemu-bridge-helper";
-    }}
-    dst=${config.security.wrapperDir}/qemu-bridge-helper
-    cp "$src" "$dst"
-    chown root.qemu-users "$dst"
-    chmod 4710 "$dst"
-  '';
+  krebs.setuid.qemu-bridge-helper = {
+    filename = "${pkgs.qemu}/libexec/qemu-bridge-helper";
+    group = "qemu-users";
+  };
 
   users.users.qemu-dnsmasq.uid = genid "qemu-dnsmasq";
 
-- 
cgit v1.2.3


From 2339496ff012e511f4d709ed05a7e2fc12b9aef7 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 14 Feb 2016 13:27:42 +0100
Subject: make deploy: --show-trace

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index c7dee13..e5e3b19 100644
--- a/Makefile
+++ b/Makefile
@@ -24,7 +24,7 @@ execute = \
 deploy:
 	$(call execute,populate)
 	ssh $(target_user)@$(target_host) -p $(target_port) \
-		nixos-rebuild switch -I $(target_path)
+		nixos-rebuild switch --show-trace -I $(target_path)
 
 # usage: make LOGNAME=shared system=wolf eval.config.krebs.build.host.name
 eval eval.:;@$(call evaluate)
-- 
cgit v1.2.3


From 5f00b6b93fa081bbd76e5ba67de183e2db83cc15 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 14 Feb 2016 16:43:44 +0100
Subject: RIP specialArgs.lib

---
 miefda/2configs/git.nix                 | 2 +-
 miefda/2configs/miefda.nix              | 2 +-
 miefda/2configs/tinc-basic-retiolum.nix | 2 +-
 miefda/2configs/tlp.nix                 | 2 +-
 miefda/2configs/x220t.nix               | 2 +-
 mv/1systems/stro.nix                    | 2 +-
 mv/2configs/default.nix                 | 2 +-
 mv/2configs/git.nix                     | 2 +-
 mv/2configs/vim.nix                     | 4 ++--
 mv/2configs/xserver/Xresources.nix      | 2 +-
 mv/2configs/xserver/default.nix         | 2 +-
 mv/2configs/xserver/xserver.conf.nix    | 2 +-
 mv/3modules/iptables.nix                | 5 ++---
 shared/2configs/base.nix                | 2 +-
 shared/2configs/cgit-mirror.nix         | 2 +-
 shared/2configs/collectd-base.nix       | 2 +-
 shared/2configs/graphite.nix            | 2 +-
 tv/1systems/cd.nix                      | 2 +-
 tv/1systems/mkdir.nix                   | 2 +-
 tv/1systems/nomic.nix                   | 2 +-
 tv/1systems/rmdir.nix                   | 2 +-
 tv/1systems/wu.nix                      | 2 +-
 tv/1systems/xu.nix                      | 2 +-
 tv/2configs/backup.nix                  | 2 +-
 tv/2configs/charybdis.nix               | 5 ++---
 tv/2configs/default.nix                 | 2 +-
 tv/2configs/exim-retiolum.nix           | 4 ++--
 tv/2configs/exim-smarthost.nix          | 2 +-
 tv/2configs/git.nix                     | 2 +-
 tv/2configs/hw/AO753.nix                | 2 +-
 tv/2configs/nginx-public_html.nix       | 4 ++--
 tv/2configs/pulse.nix                   | 2 +-
 tv/2configs/retiolum.nix                | 2 +-
 tv/2configs/vim.nix                     | 4 ++--
 tv/2configs/xserver/Xresources.nix      | 2 +-
 tv/2configs/xserver/default.nix         | 2 +-
 tv/2configs/xserver/xserver.conf.nix    | 2 +-
 tv/2configs/xu-qemu0.nix                | 2 +-
 tv/3modules/ejabberd.nix                | 5 ++---
 tv/3modules/iptables.nix                | 5 ++---
 40 files changed, 48 insertions(+), 52 deletions(-)

diff --git a/miefda/2configs/git.nix b/miefda/2configs/git.nix
index fec828f..052cc4a 100644
--- a/miefda/2configs/git.nix
+++ b/miefda/2configs/git.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
 
diff --git a/miefda/2configs/miefda.nix b/miefda/2configs/miefda.nix
index 545987a..f17e8aa 100644
--- a/miefda/2configs/miefda.nix
+++ b/miefda/2configs/miefda.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   
   #networking.wicd.enable = true;
diff --git a/miefda/2configs/tinc-basic-retiolum.nix b/miefda/2configs/tinc-basic-retiolum.nix
index b31fe15..f82fd6b 100644
--- a/miefda/2configs/tinc-basic-retiolum.nix
+++ b/miefda/2configs/tinc-basic-retiolum.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   krebs.retiolum = {
     enable = true;
diff --git a/miefda/2configs/tlp.nix b/miefda/2configs/tlp.nix
index 0e1bb0d..32f4f2e 100644
--- a/miefda/2configs/tlp.nix
+++ b/miefda/2configs/tlp.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   hardware.enableAllFirmware = true;
   nixpkgs.config.allowUnfree = true;
diff --git a/miefda/2configs/x220t.nix b/miefda/2configs/x220t.nix
index bea84f7..2d128e5 100644
--- a/miefda/2configs/x220t.nix
+++ b/miefda/2configs/x220t.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
 
   services.xserver = {
diff --git a/mv/1systems/stro.nix b/mv/1systems/stro.nix
index 3915219..b3dfc57 100644
--- a/mv/1systems/stro.nix
+++ b/mv/1systems/stro.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.stro;
diff --git a/mv/2configs/default.nix b/mv/2configs/default.nix
index 9c41209..d93218a 100644
--- a/mv/2configs/default.nix
+++ b/mv/2configs/default.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   HOME = getEnv "HOME";
 in
diff --git a/mv/2configs/git.nix b/mv/2configs/git.nix
index c182d0d..933649f 100644
--- a/mv/2configs/git.nix
+++ b/mv/2configs/git.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
 
diff --git a/mv/2configs/vim.nix b/mv/2configs/vim.nix
index a961b6b..adf1da9 100644
--- a/mv/2configs/vim.nix
+++ b/mv/2configs/vim.nix
@@ -1,6 +1,6 @@
-{ lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   out = {
     environment.systemPackages = [
diff --git a/mv/2configs/xserver/Xresources.nix b/mv/2configs/xserver/Xresources.nix
index f287bf2..9235727 100644
--- a/mv/2configs/xserver/Xresources.nix
+++ b/mv/2configs/xserver/Xresources.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 pkgs.writeText "Xresources" ''
   !URxvt*background:	#050505
diff --git a/mv/2configs/xserver/default.nix b/mv/2configs/xserver/default.nix
index 44539c5..3d4aa88 100644
--- a/mv/2configs/xserver/default.nix
+++ b/mv/2configs/xserver/default.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }@args:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO krebs.build.user
diff --git a/mv/2configs/xserver/xserver.conf.nix b/mv/2configs/xserver/xserver.conf.nix
index e8a997a..c452b42 100644
--- a/mv/2configs/xserver/xserver.conf.nix
+++ b/mv/2configs/xserver/xserver.conf.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.services.xserver;
diff --git a/mv/3modules/iptables.nix b/mv/3modules/iptables.nix
index cbf49f5..b2b41bf 100644
--- a/mv/3modules/iptables.nix
+++ b/mv/3modules/iptables.nix
@@ -1,13 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.tv.iptables;
 
   out = {
     options.tv.iptables = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/shared/2configs/base.nix b/shared/2configs/base.nix
index 715397e..679764b 100644
--- a/shared/2configs/base.nix
+++ b/shared/2configs/base.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   krebs.enable = true;
   krebs.retiolum = {
diff --git a/shared/2configs/cgit-mirror.nix b/shared/2configs/cgit-mirror.nix
index 4ff1902..d30f144 100644
--- a/shared/2configs/cgit-mirror.nix
+++ b/shared/2configs/cgit-mirror.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   rules = with git; singleton {
     user = [ git-sync ];
diff --git a/shared/2configs/collectd-base.nix b/shared/2configs/collectd-base.nix
index 3b792bf..9c63dcd 100644
--- a/shared/2configs/collectd-base.nix
+++ b/shared/2configs/collectd-base.nix
@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 # TODO: krebs.collectd.plugins
-with lib;
+with config.krebs.lib;
 let
   connect-time-cfg = with pkgs; writeText "collectd-connect-time.conf" ''
     LoadPlugin python
diff --git a/shared/2configs/graphite.nix b/shared/2configs/graphite.nix
index 707ec6e..37c6b09 100644
--- a/shared/2configs/graphite.nix
+++ b/shared/2configs/graphite.nix
@@ -5,7 +5,7 @@
 
 # TODO: krebs.graphite.minimal.enable
 # TODO: configure firewall
-with lib;
+with config.krebs.lib;
 {
   imports = [ ];
 
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index b96548d..3f804ba 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.cd;
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index 2010dcd..4b1fcde 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO merge with lass
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 37ef204..610434f 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.nomic;
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index 4005b5e..942e55e 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO merge with lass
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 0184ed9..4b97991 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.wu;
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 2719d56..6d300f1 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.xu;
diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix
index 57f299e..641e2d5 100644
--- a/tv/2configs/backup.nix
+++ b/tv/2configs/backup.nix
@@ -1,5 +1,5 @@
 { config, lib, ... }:
-with lib;
+with config.krebs.lib;
 {
   krebs.backup.plans = {
     wu-home-xu = {
diff --git a/tv/2configs/charybdis.nix b/tv/2configs/charybdis.nix
index f9ab3da..eefb281 100644
--- a/tv/2configs/charybdis.nix
+++ b/tv/2configs/charybdis.nix
@@ -1,13 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.tv.charybdis;
 
   out = {
     options.tv.charybdis = api;
-    config = mkIf cfg.enable (mkMerge [
+    config = lib.mkIf cfg.enable (lib.mkMerge [
       imp
       { tv.iptables.input-retiolum-accept-new-tcp = [ 6667 6697 ]; }
     ]);
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 2edaed7..9694e7b 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.enable = true;
diff --git a/tv/2configs/exim-retiolum.nix b/tv/2configs/exim-retiolum.nix
index aedf258..9197a3c 100644
--- a/tv/2configs/exim-retiolum.nix
+++ b/tv/2configs/exim-retiolum.nix
@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.exim-retiolum.enable = true;
diff --git a/tv/2configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix
index bcfea78..4b49e20 100644
--- a/tv/2configs/exim-smarthost.nix
+++ b/tv/2configs/exim-smarthost.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.exim-smarthost = {
diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix
index f248a8c..7a42ca9 100644
--- a/tv/2configs/git.nix
+++ b/tv/2configs/git.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
 
diff --git a/tv/2configs/hw/AO753.nix b/tv/2configs/hw/AO753.nix
index e7a2b92..b81b773 100644
--- a/tv/2configs/hw/AO753.nix
+++ b/tv/2configs/hw/AO753.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   imports = [
diff --git a/tv/2configs/nginx-public_html.nix b/tv/2configs/nginx-public_html.nix
index dc74f7f..15a3b54 100644
--- a/tv/2configs/nginx-public_html.nix
+++ b/tv/2configs/nginx-public_html.nix
@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.nginx = {
diff --git a/tv/2configs/pulse.nix b/tv/2configs/pulse.nix
index e1894ca..8e611f2 100644
--- a/tv/2configs/pulse.nix
+++ b/tv/2configs/pulse.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   pkg = pkgs.pulseaudioLight;
   runDir = "/run/pulse";
diff --git a/tv/2configs/retiolum.nix b/tv/2configs/retiolum.nix
index d2bb9e6..e1598d7 100644
--- a/tv/2configs/retiolum.nix
+++ b/tv/2configs/retiolum.nix
@@ -1,6 +1,6 @@
 { config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.retiolum = {
diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 69a880d..b0c26e5 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -1,6 +1,6 @@
-{ lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   out = {
     environment.systemPackages = [
diff --git a/tv/2configs/xserver/Xresources.nix b/tv/2configs/xserver/Xresources.nix
index f287bf2..9235727 100644
--- a/tv/2configs/xserver/Xresources.nix
+++ b/tv/2configs/xserver/Xresources.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 pkgs.writeText "Xresources" ''
   !URxvt*background:	#050505
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index 5cd17aa..4b936f4 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }@args:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO krebs.build.user
diff --git a/tv/2configs/xserver/xserver.conf.nix b/tv/2configs/xserver/xserver.conf.nix
index e8a997a..c452b42 100644
--- a/tv/2configs/xserver/xserver.conf.nix
+++ b/tv/2configs/xserver/xserver.conf.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.services.xserver;
diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
index df35f5c..720a8ac 100644
--- a/tv/2configs/xu-qemu0.nix
+++ b/tv/2configs/xu-qemu0.nix
@@ -21,7 +21,7 @@ in
 # TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport bootps -j ACCEPT
 # TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT
 
-with lib;
+with config.krebs.lib;
 
 {
   networking.dhcpcd.denyInterfaces = [ "qemubr0" ];
diff --git a/tv/3modules/ejabberd.nix b/tv/3modules/ejabberd.nix
index 581e100..c9d9b48 100644
--- a/tv/3modules/ejabberd.nix
+++ b/tv/3modules/ejabberd.nix
@@ -1,13 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.tv.ejabberd;
 
   out = {
     options.tv.ejabberd = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix
index 4924db4..c0fd7ec 100644
--- a/tv/3modules/iptables.nix
+++ b/tv/3modules/iptables.nix
@@ -1,13 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.tv.iptables;
 
   out = {
     options.tv.iptables = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
-- 
cgit v1.2.3


From 8fc84193512c2f06c00f0c9b80ec5db53f6a7f3c Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 15 Feb 2016 16:27:11 +0100
Subject: don't try to mimic nixpkgs

---
 Makefile                                   | 3 ++-
 miefda/1systems/bobby.nix                  | 2 +-
 miefda/default.nix                         | 6 ++++++
 mv/1systems/stro.nix                       | 1 +
 nixpkgs/default.nix                        | 6 ------
 nixpkgs/krebs                              | 0
 nixpkgs/lib                                | 1 -
 nixpkgs/nixos/default.nix                  | 1 -
 nixpkgs/nixos/lib                          | 1 -
 nixpkgs/nixos/modules                      | 1 -
 root                                       | 1 -
 shared/1systems/test-all-krebs-modules.nix | 3 +++
 shared/1systems/test-arch.nix              | 1 +
 shared/1systems/test-centos6.nix           | 1 +
 shared/1systems/test-centos7.nix           | 1 +
 shared/1systems/test-failing.nix           | 3 +++
 shared/1systems/test-minimal-deploy.nix    | 3 +++
 shared/1systems/wolf.nix                   | 1 +
 shared/2configs/base.nix                   | 4 +---
 shared/default.nix                         | 7 +++++++
 tv/1systems/cd.nix                         | 1 +
 tv/1systems/mkdir.nix                      | 1 +
 tv/1systems/nomic.nix                      | 1 +
 tv/1systems/rmdir.nix                      | 1 +
 tv/1systems/wu.nix                         | 1 +
 tv/1systems/xu-qemu0.nix                   | 1 +
 tv/1systems/xu.nix                         | 1 +
 tv/2configs/default.nix                    | 4 +---
 tv/default.nix                             | 9 +++++++++
 29 files changed, 48 insertions(+), 19 deletions(-)
 create mode 100644 miefda/default.nix
 delete mode 100644 nixpkgs/default.nix
 delete mode 100644 nixpkgs/krebs
 delete mode 120000 nixpkgs/lib
 delete mode 100644 nixpkgs/nixos/default.nix
 delete mode 120000 nixpkgs/nixos/lib
 delete mode 120000 nixpkgs/nixos/modules
 delete mode 120000 root
 create mode 100644 shared/default.nix
 create mode 100644 tv/default.nix

diff --git a/Makefile b/Makefile
index e5e3b19..384c872 100644
--- a/Makefile
+++ b/Makefile
@@ -9,10 +9,11 @@ export target_path ?= /var/src
 
 evaluate = \
 	nix-instantiate \
-		--arg configuration ./$(LOGNAME)/1systems/$(system).nix \
 		--eval \
 		--readonly-mode \
 		--show-trace \
+		-I nixos-config=./$(LOGNAME)/1systems/$(system).nix \
+		-I stockholm=. \
 		$(1)
 
 execute = \
diff --git a/miefda/1systems/bobby.nix b/miefda/1systems/bobby.nix
index d245952..b85e686 100644
--- a/miefda/1systems/bobby.nix
+++ b/miefda/1systems/bobby.nix
@@ -7,7 +7,7 @@
 {
   imports =
     [ # Include the results of the hardware scan.
-
+      ../.
       ../2configs/miefda.nix
       ../2configs/tlp.nix
       ../2configs/x220t.nix
diff --git a/miefda/default.nix b/miefda/default.nix
new file mode 100644
index 0000000..7f275c2
--- /dev/null
+++ b/miefda/default.nix
@@ -0,0 +1,6 @@
+_:
+{
+  imports = [
+    ../krebs
+  ];
+}
diff --git a/mv/1systems/stro.nix b/mv/1systems/stro.nix
index b3dfc57..f251cb0 100644
--- a/mv/1systems/stro.nix
+++ b/mv/1systems/stro.nix
@@ -9,6 +9,7 @@ with config.krebs.lib;
     "7ae05edcdd14f6ace83ead9bf0d114e97c89a83a";
 
   imports = [
+    ../.
     ../2configs/hw/x220.nix
     ../2configs/git.nix
     ../2configs/mail-client.nix
diff --git a/nixpkgs/default.nix b/nixpkgs/default.nix
deleted file mode 100644
index 8514fa4..0000000
--- a/nixpkgs/default.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ system ? builtins.currentSystem }:
-
-(import <stockholm> {
-  inherit system;
-  configuration = {};
-}).pkgs
diff --git a/nixpkgs/krebs b/nixpkgs/krebs
deleted file mode 100644
index e69de29..0000000
diff --git a/nixpkgs/lib b/nixpkgs/lib
deleted file mode 120000
index 7b13c80..0000000
--- a/nixpkgs/lib
+++ /dev/null
@@ -1 +0,0 @@
-../../upstream-nixpkgs/lib
\ No newline at end of file
diff --git a/nixpkgs/nixos/default.nix b/nixpkgs/nixos/default.nix
deleted file mode 100644
index 4fe08ef..0000000
--- a/nixpkgs/nixos/default.nix
+++ /dev/null
@@ -1 +0,0 @@
-import <stockholm>
diff --git a/nixpkgs/nixos/lib b/nixpkgs/nixos/lib
deleted file mode 120000
index 9e69d1a..0000000
--- a/nixpkgs/nixos/lib
+++ /dev/null
@@ -1 +0,0 @@
-../../../upstream-nixpkgs/nixos/lib
\ No newline at end of file
diff --git a/nixpkgs/nixos/modules b/nixpkgs/nixos/modules
deleted file mode 120000
index 8aa2488..0000000
--- a/nixpkgs/nixos/modules
+++ /dev/null
@@ -1 +0,0 @@
-../../../upstream-nixpkgs/nixos/modules
\ No newline at end of file
diff --git a/root b/root
deleted file mode 120000
index 1cd1825..0000000
--- a/root
+++ /dev/null
@@ -1 +0,0 @@
-../stockholm-user
\ No newline at end of file
diff --git a/shared/1systems/test-all-krebs-modules.nix b/shared/1systems/test-all-krebs-modules.nix
index b98004d..e1021c7 100644
--- a/shared/1systems/test-all-krebs-modules.nix
+++ b/shared/1systems/test-all-krebs-modules.nix
@@ -2,6 +2,9 @@
 let
   en = { enable = true;};
 in {
+  imports = [
+    ../.
+  ];
   krebs = {
     enable = true;
     build.user = config.krebs.users.shared;
diff --git a/shared/1systems/test-arch.nix b/shared/1systems/test-arch.nix
index ece2094..14fc038 100644
--- a/shared/1systems/test-arch.nix
+++ b/shared/1systems/test-arch.nix
@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ../.
     ../2configs/base.nix
     {
       boot.loader.grub = {
diff --git a/shared/1systems/test-centos6.nix b/shared/1systems/test-centos6.nix
index a8b5f9b..8add0b7 100644
--- a/shared/1systems/test-centos6.nix
+++ b/shared/1systems/test-centos6.nix
@@ -7,6 +7,7 @@ let
   gw = "168.235.148.1";
 in {
   imports = [
+    ../.
     ../2configs/base.nix
     ../2configs/os-templates/CAC-CentOS-6.5-64bit.nix
     {
diff --git a/shared/1systems/test-centos7.nix b/shared/1systems/test-centos7.nix
index 48cecc8..65daff5 100644
--- a/shared/1systems/test-centos7.nix
+++ b/shared/1systems/test-centos7.nix
@@ -5,6 +5,7 @@ let
 
 in {
   imports = [
+    ../.
     ../2configs/base.nix
     ../2configs/os-templates/CAC-CentOS-7-64bit.nix
     ../2configs/temp/networking.nix
diff --git a/shared/1systems/test-failing.nix b/shared/1systems/test-failing.nix
index 81a9e48..fe1c2cb 100644
--- a/shared/1systems/test-failing.nix
+++ b/shared/1systems/test-failing.nix
@@ -1,6 +1,9 @@
 { config, pkgs, ... }:
 
 {
+  imports = [
+    ../.
+  ];
   programs.ssh.startAgent = true;
   programs.ssh.startAgent = false;
 }
diff --git a/shared/1systems/test-minimal-deploy.nix b/shared/1systems/test-minimal-deploy.nix
index 309e289..bec2b38 100644
--- a/shared/1systems/test-minimal-deploy.nix
+++ b/shared/1systems/test-minimal-deploy.nix
@@ -1,5 +1,8 @@
 { config, pkgs, lib, ... }:
 {
+  imports = [
+    ../.
+  ];
   krebs = {
     enable = true;
     build.user = config.krebs.users.shared;
diff --git a/shared/1systems/wolf.nix b/shared/1systems/wolf.nix
index 9a51442..3175914 100644
--- a/shared/1systems/wolf.nix
+++ b/shared/1systems/wolf.nix
@@ -6,6 +6,7 @@ let
 in
 {
   imports = [
+    ../.
     ../2configs/base.nix
     <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
     ../2configs/collectd-base.nix
diff --git a/shared/2configs/base.nix b/shared/2configs/base.nix
index 679764b..9f998b5 100644
--- a/shared/2configs/base.nix
+++ b/shared/2configs/base.nix
@@ -16,7 +16,7 @@ with config.krebs.lib;
   # TODO rename shared user to "krebs"
   krebs.build.user = mkDefault config.krebs.users.shared;
   krebs.build.source = {
-    upstream-nixpkgs = mkDefault {
+    nixpkgs = mkDefault {
       url = https://github.com/NixOS/nixpkgs;
       rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; # for urlwatch-minidb
     };
@@ -24,8 +24,6 @@ with config.krebs.lib;
     stockholm = mkDefault "${getEnv "HOME"}/stockholm";
 
     nixos-config = "symlink:stockholm/${config.krebs.build.user.name}/1systems/${config.krebs.build.host.name}.nix";
-    nixpkgs = symlink:stockholm/nixpkgs;
-    stockholm-user = "symlink:stockholm/${config.krebs.build.user.name}";
   };
 
   networking.hostName = config.krebs.build.host.name;
diff --git a/shared/default.nix b/shared/default.nix
new file mode 100644
index 0000000..69b4aba
--- /dev/null
+++ b/shared/default.nix
@@ -0,0 +1,7 @@
+_:
+{
+  imports = [
+    ../krebs
+    ./3modules
+  ];
+}
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 3f804ba..9b63826 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -6,6 +6,7 @@ with config.krebs.lib;
   krebs.build.host = config.krebs.hosts.cd;
 
   imports = [
+    ../.
     ../2configs/hw/CAC-Developer-2.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
     ../2configs/exim-smarthost.nix
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index 4b1fcde..58a8fdc 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -19,6 +19,7 @@ in
   krebs.build.host = config.krebs.hosts.mkdir;
 
   imports = [
+    ../.
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
     ../2configs/exim-smarthost.nix
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 610434f..2c9775d 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -6,6 +6,7 @@ with config.krebs.lib;
   krebs.build.host = config.krebs.hosts.nomic;
 
   imports = [
+    ../.
     ../2configs/hw/AO753.nix
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index 942e55e..c54caa6 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -19,6 +19,7 @@ in
   krebs.build.host = config.krebs.hosts.rmdir;
 
   imports = [
+    ../.
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
     ../2configs/exim-smarthost.nix
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 4b97991..6154e4d 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -6,6 +6,7 @@ with config.krebs.lib;
   krebs.build.host = config.krebs.hosts.wu;
 
   imports = [
+    ../.
     ../2configs/hw/w110er.nix
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
diff --git a/tv/1systems/xu-qemu0.nix b/tv/1systems/xu-qemu0.nix
index 03ac19c..8945c19 100644
--- a/tv/1systems/xu-qemu0.nix
+++ b/tv/1systems/xu-qemu0.nix
@@ -10,6 +10,7 @@
   krebs.build.host = config.krebs.hosts.xu-qemu0;
 
   imports = [
+    ../.
     <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
   ];
 
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 6d300f1..5ec1fe5 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -6,6 +6,7 @@ with config.krebs.lib;
   krebs.build.host = config.krebs.hosts.xu;
 
   imports = [
+    ../.
     ../2configs/hw/x220.nix
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 9694e7b..c4a2d6b 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -9,12 +9,10 @@ with config.krebs.lib;
     user = config.krebs.users.tv;
     source = mapAttrs (_: mkDefault) ({
       nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix";
-      nixpkgs = symlink:stockholm/nixpkgs;
       secrets = "/home/tv/secrets/${config.krebs.build.host.name}";
       secrets-common = "/home/tv/secrets/common";
       stockholm = "/home/tv/stockholm";
-      stockholm-user = "symlink:stockholm/tv";
-      upstream-nixpkgs = {
+      nixpkgs = {
         url = https://github.com/NixOS/nixpkgs;
         rev = "77f8f35d57618c1ba456d968524f2fb2c3448295";
         dev = "/home/tv/nixpkgs";
diff --git a/tv/default.nix b/tv/default.nix
new file mode 100644
index 0000000..b1c7c1b
--- /dev/null
+++ b/tv/default.nix
@@ -0,0 +1,9 @@
+_:
+{
+  imports = [
+    ../krebs
+    ./2configs
+    ./3modules
+    ./5pkgs
+  ];
+}
-- 
cgit v1.2.3


From 6e6c783a148293acdbfbfeb36c4bd0ef69b9d8ee Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 15 Feb 2016 16:57:15 +0100
Subject: shared-buildbot: <stockholm> isn't a function

---
 shared/2configs/shared-buildbot.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/shared/2configs/shared-buildbot.nix b/shared/2configs/shared-buildbot.nix
index af877f5..f6798bf 100644
--- a/shared/2configs/shared-buildbot.nix
+++ b/shared/2configs/shared-buildbot.nix
@@ -61,7 +61,7 @@
   # prepare nix-shell
   # the dependencies which are used by the test script
   deps = [ "gnumake", "jq","nix","rsync",
-            "(import <stockholm> {}).pkgs.test.infest-cac-centos7" ]
+            "(import <stockholm>).pkgs.test.infest-cac-centos7" ]
   # TODO: --pure , prepare ENV in nix-shell command:
   #                   SSL_CERT_FILE,LOGNAME,NIX_REMOTE
   nixshell = ["nix-shell",
-- 
cgit v1.2.3