From ef365a763e5ff4fab039443b7756f27da701b81e Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sun, 19 Jul 2015 22:51:39 +0200
Subject: 2 lass.desktop-base: remove german keyboard layout

---
 2configs/lass/desktop-base.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/2configs/lass/desktop-base.nix b/2configs/lass/desktop-base.nix
index ee7a94b..9b98e4a 100644
--- a/2configs/lass/desktop-base.nix
+++ b/2configs/lass/desktop-base.nix
@@ -55,11 +55,9 @@ in {
     displayManager.auto.enable = true;
     displayManager.auto.user = mainUser.name;
 
-    layout = "us,de";
+    layout = "us";
     xkbModel = "evdev";
-    xkbVariant = "altgr-intl,nodeadkeys";
-    xkbOptions = "grp:caps_toggle";
-
+    xkbVariant = "altgr-intl";
   };
 
 }
-- 
cgit v1.2.3


From 5b5e76e21099213758a6b3872b24015f8e33d409 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Tue, 21 Jul 2015 18:57:58 +0200
Subject: 1&2 lass: move userconfig to base.nix

---
 1systems/lass/mors.nix  | 15 ---------------
 1systems/lass/uriel.nix | 33 ++++++++++-----------------------
 2configs/lass/base.nix  | 26 ++++++++++++++++++++++++--
 3 files changed, 34 insertions(+), 40 deletions(-)

diff --git a/1systems/lass/mors.nix b/1systems/lass/mors.nix
index 940dc4f..7e70be8 100644
--- a/1systems/lass/mors.nix
+++ b/1systems/lass/mors.nix
@@ -168,21 +168,6 @@
     '';
   };
 
-  users.extraUsers = {
-    #main user
-    mainUser = {
-      uid = 1337;
-      name = "lass";
-      #isNormalUser = true;
-      group = "users";
-      createHome = true;
-      home = "/home/lass";
-      useDefaultShell = true;
-      isSystemUser = false;
-      extraGroups = [ "wheel" "audio" ];
-    };
-  };
-
   environment.systemPackages = with pkgs; [
   ];
 
diff --git a/1systems/lass/uriel.nix b/1systems/lass/uriel.nix
index 25745d0..a5a0833 100644
--- a/1systems/lass/uriel.nix
+++ b/1systems/lass/uriel.nix
@@ -1,5 +1,6 @@
 { config, pkgs, ... }:
 
+with builtins;
 {
   imports = [
     ../../2configs/lass/desktop-base.nix
@@ -30,6 +31,15 @@
         enable = true;
       };
     }
+    {
+      users.extraUsers = {
+        root = {
+          openssh.authorizedKeys.keys = map readFile [
+            ../../Zpubkeys/uriel.ssh.pub
+          ];
+        };
+      };
+    }
   ];
 
   networking.hostName = "uriel";
@@ -87,29 +97,6 @@
     '';
   };
 
-  users.extraUsers = {
-    root = {
-      openssh.authorizedKeys.keys = [
-        config.sshKeys.lass.pub
-      ];
-    };
-    mainUser = {
-      uid = 1337;
-      name = "lass";
-      #isNormalUser = true;
-      group = "users";
-      createHome = true;
-      home = "/home/lass";
-      useDefaultShell = true;
-      isSystemUser = false;
-      description = "lassulus";
-      extraGroups = [ "wheel" "audio" ];
-      openssh.authorizedKeys.keys = [
-        config.sshKeys.lass.pub
-      ];
-    };
-  };
-
   environment.systemPackages = with pkgs; [
   ];
 
diff --git a/2configs/lass/base.nix b/2configs/lass/base.nix
index 5e5b8a7..26e6cae 100644
--- a/2configs/lass/base.nix
+++ b/2configs/lass/base.nix
@@ -3,14 +3,36 @@
 with lib;
 {
   imports = [
-    ./sshkeys.nix
     ../../3modules/lass/iptables.nix
     {
       users.extraUsers =
         mapAttrs (_: h: { hashedPassword = h; })
                  (import /root/src/secrets/hashedPasswords.nix);
     }
-
+    {
+      users.extraUsers = {
+        root = {
+          openssh.authorizedKeys.keys = map readFile [
+            ../../Zpubkeys/lass.ssh.pub
+          ];
+        };
+        mainUser = {
+          name = "lass";
+          uid = 1337;
+          home = "/home/lass";
+          group = "users";
+          createHome = true;
+          useDefaultShell = true;
+          extraGroups = [
+            "audio"
+            "wheel"
+          ];
+          openssh.authorizedKeys.keys = map readFile [
+            ../../Zpubkeys/lass.ssh.pub
+          ];
+        };
+      };
+    }
   ];
 
   nix.useChroot = true;
-- 
cgit v1.2.3


From 188b97682a03e1c786b3404b0c5009e20294f22b Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Tue, 21 Jul 2015 19:02:31 +0200
Subject: 2 lass: remove gitolite from base.nix

---
 2configs/lass/base.nix | 33 +++++----------------------------
 1 file changed, 5 insertions(+), 28 deletions(-)

diff --git a/2configs/lass/base.nix b/2configs/lass/base.nix
index 26e6cae..a0d3c3a 100644
--- a/2configs/lass/base.nix
+++ b/2configs/lass/base.nix
@@ -99,11 +99,11 @@ with lib;
     "sendmail"
   ];
 
-  services.gitolite = {
-    enable = true;
-    dataDir = "/home/gitolite";
-    adminPubkey = config.sshKeys.lass.pub;
-  };
+  #services.gitolite = {
+  #  enable = true;
+  #  dataDir = "/home/gitolite";
+  #  adminPubkey = config.sshKeys.lass.pub;
+  #};
 
   services.openssh = {
     enable = true;
@@ -132,27 +132,4 @@ with lib;
     };
   };
 
-  #Networking.firewall = {
-  #  enable = true;
-
-  #  allowedTCPPorts = [
-  #    22
-  #  ];
-
-  #  extraCommands = ''
-  #    iptables -A INPUT -j ACCEPT -m conntrack --ctstate RELATED,ESTABLISHED
-  #    iptables -A INPUT -j ACCEPT -i lo
-  #    #http://serverfault.com/questions/84963/why-not-block-icmp
-  #    iptables -A INPUT -j ACCEPT -p icmp
-
-  #    #TODO: fix Retiolum firewall
-  #    #iptables -N RETIOLUM
-  #    #iptables -A INPUT -j RETIOLUM -i retiolum
-  #    #iptables -A RETIOLUM -j ACCEPT -m conntrack --ctstate RELATED,ESTABLISHED
-  #    #iptables -A RETIOLUM -j REJECT -p tcp --reject-with tcp-reset
-  #    #iptables -A RETIOLUM -j REJECT -p udp --reject-with icmp-port-unreachable
-  #    #iptables -A RETIOLUM -j REJECT        --reject-with icmp-proto-unreachable
-  #    #iptables -A RETIOLUM -j REJECT
-  #  '';
-  #};
 }
-- 
cgit v1.2.3


From b0db57b8da61b86a4e1cc2cec56053790f26aec1 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Tue, 21 Jul 2015 19:04:40 +0200
Subject: lass: add cloudkrebs system

---
 0make/lass/cloudkrebs.makefile |  4 ++++
 1systems/lass/cloudkrebs.nix   | 43 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 0make/lass/cloudkrebs.makefile
 create mode 100644 1systems/lass/cloudkrebs.nix

diff --git a/0make/lass/cloudkrebs.makefile b/0make/lass/cloudkrebs.makefile
new file mode 100644
index 0000000..baf7660
--- /dev/null
+++ b/0make/lass/cloudkrebs.makefile
@@ -0,0 +1,4 @@
+deploy_host := root@cloudkrebs
+nixpkgs_url := https://github.com/Lassulus/nixpkgs
+nixpkgs_rev := 1879a011925c561f0a7fd4043da0768bbff41d0b
+secrets_dir := /home/lass/secrets/cloudkrebs
diff --git a/1systems/lass/cloudkrebs.nix b/1systems/lass/cloudkrebs.nix
new file mode 100644
index 0000000..dc27aff
--- /dev/null
+++ b/1systems/lass/cloudkrebs.nix
@@ -0,0 +1,43 @@
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ../../2configs/tv/CAC-Developer-2.nix
+    ../../2configs/tv/CAC-CentOS-7-64bit.nix
+    ../../2configs/lass/base.nix
+    {
+      networking.interfaces.enp2s1.ip4 = [
+        {
+          address = "104.167.113.104";
+          prefixLength = 24;
+        }
+      ];
+      networking.defaultGateway = "104.167.113.1";
+      networking.nameservers = [
+        "8.8.8.8"
+      ];
+
+    }
+    {
+      imports = [ ../../3modules/tv/retiolum.nix ];
+      tv.retiolum = {
+        enable = true;
+        hosts = ../../Zhosts;
+        connectTo = [
+          "fastpoke"
+          "gum"
+          "pigstarter"
+        ];
+      };
+    }
+    {
+      imports = [ ../../3modules/tv/identity.nix ];
+      tv.identity = {
+        enable = true;
+      };
+    }
+  ];
+
+  networking.hostName = "cloudkrebs";
+
+}
-- 
cgit v1.2.3


From 9a81802d3427d767c81ba62368da3ad22e0da75c Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Tue, 21 Jul 2015 19:14:15 +0200
Subject: 2 lass.git-repos: change irc-server to cd

---
 2configs/lass/git-repos.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/2configs/lass/git-repos.nix b/2configs/lass/git-repos.nix
index c0c305b..b4f446a 100644
--- a/2configs/lass/git-repos.nix
+++ b/2configs/lass/git-repos.nix
@@ -39,7 +39,7 @@ let
           post-receive = git.irc-announce {
             nick = config.networking.hostName; # TODO make this the default
             channel = "#retiolum";
-            server = "ire.retiolum";
+            server = "cd.retiolum";
           };
         };
       };
@@ -63,7 +63,7 @@ let
           post-receive = git.irc-announce {
             nick = config.networking.hostName; # TODO make this the default
             channel = "#retiolum";
-            server = "ire.retiolum";
+            server = "cd.retiolum";
           };
         };
         public = true;
-- 
cgit v1.2.3


From 83de7be89610ef2c408bc00b178b60a57e36e163 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Thu, 23 Jul 2015 02:11:56 +0200
Subject: 1&2 lass: move exim/retiolum to retiolum.nix

---
 1systems/lass/cloudkrebs.nix | 13 +------------
 1systems/lass/mors.nix       | 14 +-------------
 1systems/lass/uriel.nix      | 14 +-------------
 2configs/lass/retiolum.nix   | 29 +++++++++++++++++++++++++++++
 4 files changed, 32 insertions(+), 38 deletions(-)
 create mode 100644 2configs/lass/retiolum.nix

diff --git a/1systems/lass/cloudkrebs.nix b/1systems/lass/cloudkrebs.nix
index dc27aff..53e23db 100644
--- a/1systems/lass/cloudkrebs.nix
+++ b/1systems/lass/cloudkrebs.nix
@@ -5,6 +5,7 @@
     ../../2configs/tv/CAC-Developer-2.nix
     ../../2configs/tv/CAC-CentOS-7-64bit.nix
     ../../2configs/lass/base.nix
+    ../../2configs/lass/retiolum.nix
     {
       networking.interfaces.enp2s1.ip4 = [
         {
@@ -18,18 +19,6 @@
       ];
 
     }
-    {
-      imports = [ ../../3modules/tv/retiolum.nix ];
-      tv.retiolum = {
-        enable = true;
-        hosts = ../../Zhosts;
-        connectTo = [
-          "fastpoke"
-          "gum"
-          "pigstarter"
-        ];
-      };
-    }
     {
       imports = [ ../../3modules/tv/identity.nix ];
       tv.identity = {
diff --git a/1systems/lass/mors.nix b/1systems/lass/mors.nix
index 7e70be8..dacf766 100644
--- a/1systems/lass/mors.nix
+++ b/1systems/lass/mors.nix
@@ -20,19 +20,7 @@
     ../../2configs/lass/chromium-patched.nix
     ../../2configs/lass/git-repos.nix
     ../../2configs/tv/synaptics.nix
-    ../../2configs/tv/exim-retiolum.nix
-    {
-      imports = [ ../../3modules/tv/retiolum.nix ];
-      tv.retiolum = {
-        enable = true;
-        hosts = ../../Zhosts;
-        connectTo = [
-          "fastpoke"
-          "gum"
-          "pigstarter"
-        ];
-      };
-    }
+    ../../2configs/lass/retiolum.nix
     {
       imports = [ ../../3modules/tv/identity.nix ];
       tv.identity = {
diff --git a/1systems/lass/uriel.nix b/1systems/lass/uriel.nix
index a5a0833..7a5da23 100644
--- a/1systems/lass/uriel.nix
+++ b/1systems/lass/uriel.nix
@@ -12,19 +12,7 @@ with builtins;
     ../../2configs/lass/bird.nix
     ../../2configs/lass/git-repos.nix
     ../../2configs/lass/chromium-patched.nix
-    ../../2configs/tv/exim-retiolum.nix
-    {
-      imports = [ ../../3modules/tv/retiolum.nix ];
-      tv.retiolum = {
-        enable = true;
-        hosts = ../../Zhosts;
-        connectTo = [
-          "fastpoke"
-          "gum"
-          "pigstarter"
-        ];
-      };
-    }
+    ../../2configs/lass/retiolum.nix
     {
       imports = [ ../../3modules/tv/identity.nix ];
       tv.identity = {
diff --git a/2configs/lass/retiolum.nix b/2configs/lass/retiolum.nix
new file mode 100644
index 0000000..d1389ad
--- /dev/null
+++ b/2configs/lass/retiolum.nix
@@ -0,0 +1,29 @@
+{ ... }:
+
+{
+  imports = [
+    ../../3modules/lass/iptables.nix
+    ../../3modules/tv/retiolum.nix
+    ../../2configs/tv/exim-retiolum.nix
+  ];
+
+  lass.iptables = {
+    tables = {
+      filter.INPUT.rules = [
+        { predicate = "-p tcp --dport smtp"; target = "ACCEPT"; }
+        { predicate = "-p tcp --dport tinc"; target = "ACCEPT"; }
+        { predicate = "-p udp --dport tinc"; target = "ACCEPT"; }
+      ];
+    };
+  };
+
+  tv.retiolum = {
+    enable = true;
+    hosts = ../../Zhosts;
+    connectTo = [
+      "fastpoke"
+      "cloudkrebs"
+      "pigstarter"
+    ];
+  };
+}
-- 
cgit v1.2.3


From fbea2ae05c574cd11f1aebaeb40cca8d4b536908 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Thu, 23 Jul 2015 02:17:40 +0200
Subject: 1&2 lass: move vim.nix import to base.nix

---
 1systems/lass/mors.nix  | 1 -
 1systems/lass/uriel.nix | 1 -
 2configs/lass/base.nix  | 1 +
 3 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/1systems/lass/mors.nix b/1systems/lass/mors.nix
index dacf766..3007380 100644
--- a/1systems/lass/mors.nix
+++ b/1systems/lass/mors.nix
@@ -8,7 +8,6 @@
     ../../2configs/lass/browsers.nix
     ../../2configs/lass/games.nix
     ../../2configs/lass/pass.nix
-    ../../2configs/lass/vim.nix
     ../../2configs/lass/virtualbox.nix
     ../../2configs/lass/elster.nix
     ../../2configs/lass/urxvt.nix
diff --git a/1systems/lass/uriel.nix b/1systems/lass/uriel.nix
index 7a5da23..a6f5a82 100644
--- a/1systems/lass/uriel.nix
+++ b/1systems/lass/uriel.nix
@@ -7,7 +7,6 @@ with builtins;
     ../../2configs/lass/browsers.nix
     ../../2configs/lass/games.nix
     ../../2configs/lass/pass.nix
-    ../../2configs/lass/vim.nix
     ../../2configs/lass/urxvt.nix
     ../../2configs/lass/bird.nix
     ../../2configs/lass/git-repos.nix
diff --git a/2configs/lass/base.nix b/2configs/lass/base.nix
index a0d3c3a..35631ff 100644
--- a/2configs/lass/base.nix
+++ b/2configs/lass/base.nix
@@ -4,6 +4,7 @@ with lib;
 {
   imports = [
     ../../3modules/lass/iptables.nix
+    ../../2configs/lass/vim.nix
     {
       users.extraUsers =
         mapAttrs (_: h: { hashedPassword = h; })
-- 
cgit v1.2.3


From cbd8d5e8db94c41b8fca33d23419c88ad109a551 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Thu, 23 Jul 2015 02:18:45 +0200
Subject: 3 lass.iptables: fix precedence sort order

---
 3modules/lass/iptables.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/3modules/lass/iptables.nix b/3modules/lass/iptables.nix
index c97b9f7..8c6ad3f 100644
--- a/3modules/lass/iptables.nix
+++ b/3modules/lass/iptables.nix
@@ -106,7 +106,7 @@ let
 
       buildChain = tn: cn:
         let
-          sortedRules = sort (a: b: a.precedence < b.precedence) ts."${tn}"."${cn}".rules;
+          sortedRules = sort (a: b: a.precedence > b.precedence) ts."${tn}"."${cn}".rules;
 
         in
           #TODO: double check should be unneccessary, refactor!
-- 
cgit v1.2.3


From 493184a2f4b7d0f0cf407731e11e6cb9565f5aa8 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Thu, 23 Jul 2015 02:19:24 +0200
Subject: 2 lass.base: use precedence in iptables config

---
 2configs/lass/base.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/2configs/lass/base.nix b/2configs/lass/base.nix
index 35631ff..b24e6a9 100644
--- a/2configs/lass/base.nix
+++ b/2configs/lass/base.nix
@@ -125,10 +125,10 @@ with lib;
       filter.INPUT.policy = "DROP";
       filter.FORWARD.policy = "DROP";
       filter.INPUT.rules = [
-        { predicate = "-i lo"; target = "ACCEPT"; }
-        { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
-        { predicate = "-p icmp"; target = "ACCEPT"; }
-        { predicate = "-p tcp --dport 22"; target = "ACCEPT"; }
+        { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; precedence = 10001; }
+        { predicate = "-p icmp"; target = "ACCEPT"; precedence = 10000; }
+        { predicate = "-i lo"; target = "ACCEPT"; precedence = 9999; }
+        { predicate = "-p tcp --dport 22"; target = "ACCEPT"; precedence = 9998; }
       ];
     };
   };
-- 
cgit v1.2.3


From 88d8137c63c0742028145b1fe39728a55879ed96 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Thu, 23 Jul 2015 02:19:46 +0200
Subject: 2 lass.base: add nmap to defaultPackages

---
 2configs/lass/base.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/2configs/lass/base.nix b/2configs/lass/base.nix
index b24e6a9..494cafa 100644
--- a/2configs/lass/base.nix
+++ b/2configs/lass/base.nix
@@ -53,6 +53,8 @@ with lib;
   '';
 
   environment.systemPackages = with pkgs; [
+    nmap
+
     git
     most
     rxvt_unicode.terminfo
-- 
cgit v1.2.3


From 264a24c5346b926366b5e5716c26af64de398572 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Thu, 23 Jul 2015 02:20:44 +0200
Subject: 1 lass.cloudkrebs: move config to fastpoke-pages

---
 1systems/lass/cloudkrebs.nix     |   1 +
 2configs/lass/fastpoke-pages.nix | 103 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 104 insertions(+)
 create mode 100644 2configs/lass/fastpoke-pages.nix

diff --git a/1systems/lass/cloudkrebs.nix b/1systems/lass/cloudkrebs.nix
index 53e23db..8b3e415 100644
--- a/1systems/lass/cloudkrebs.nix
+++ b/1systems/lass/cloudkrebs.nix
@@ -6,6 +6,7 @@
     ../../2configs/tv/CAC-CentOS-7-64bit.nix
     ../../2configs/lass/base.nix
     ../../2configs/lass/retiolum.nix
+    ../../2configs/lass/fastpoke-pages.nix
     {
       networking.interfaces.enp2s1.ip4 = [
         {
diff --git a/2configs/lass/fastpoke-pages.nix b/2configs/lass/fastpoke-pages.nix
new file mode 100644
index 0000000..2fd9a86
--- /dev/null
+++ b/2configs/lass/fastpoke-pages.nix
@@ -0,0 +1,103 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+{
+  imports = [
+    ../../3modules/tv/nginx.nix
+    ../../3modules/lass/iptables.nix
+  ];
+
+  lass.iptables = {
+    tables = {
+      filter.INPUT.rules = [
+        { predicate = "-p tcp --dport http"; target = "ACCEPT"; }
+      ];
+    };
+  };
+
+  #createStaticPage = domain:
+  #  {
+  #    irc.nginx.servers."${domain}" = {
+  #      server-names = [
+  #        "${domain}"
+  #        "www.${domain}"
+  #      ];
+  #      locations = [
+  #        (nameValuePair "/" ''
+  #          root /var/lib/http/${domain};
+  #        '')
+  #      ];
+  #    };
+  #    networking.extraHosts = ''
+  #      10.243.206.102 ${domain}
+  #    '';
+  #  };
+
+  #map createStaticPage [
+  #  "habsys.de"
+  #  "pixelpocket.de"
+  #  "karlaskop.de"
+  #  "ubikmedia.de"
+  #  "apanowicz.de"
+  #  "aidsballs.de"
+  #];
+
+  tv.nginx = {
+    enable = true;
+    servers = {
+
+      "habsys.de" = {
+        server-names = [
+          "habsys.de"
+          "www.habsys.de"
+        ];
+        locations = [
+          (nameValuePair "/" ''
+            root /var/lib/http/habsys.de;
+          '')
+        ];
+      };
+
+      "karlaskop.de" = {
+        server-names = [
+          "karlaskop.de"
+          "www.karlaskop.de"
+        ];
+        locations = [
+          (nameValuePair "/" ''
+            root /var/lib/http/karlaskop.de;
+          '')
+        ];
+      };
+
+      "pixelpocket.de" = {
+        server-names = [
+          "pixelpocket.de"
+          "www.karlaskop.de"
+        ];
+        locations = [
+          (nameValuePair "/" ''
+            root /var/lib/http/karlaskop.de;
+          '')
+        ];
+      };
+
+    };
+  };
+
+  networking.extraHosts = ''
+    10.243.206.102 habsys.de karlaskop.de pixelpocket.de ubikmedia.de apanowicz.de
+    10.243.206.102 aidsballs.de
+  '';
+
+  #services.postgresql = {
+  #  enable = true;
+  #};
+
+  #config.services.vsftpd = {
+  #  enable = true;
+  #  userlistEnable = true;
+  #  userlistFile = pkgs.writeFile "vsftpd-userlist" ''
+  #  '';
+  #};
+}
-- 
cgit v1.2.3


From 4864ecc2aa04d4a200ff65dd7c775fb4fb4582af Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Thu, 23 Jul 2015 13:14:32 +0200
Subject: 1 lass.cloudkrebs: add identity

---
 1systems/lass/cloudkrebs.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/1systems/lass/cloudkrebs.nix b/1systems/lass/cloudkrebs.nix
index 8b3e415..57b1910 100644
--- a/1systems/lass/cloudkrebs.nix
+++ b/1systems/lass/cloudkrebs.nix
@@ -7,6 +7,10 @@
     ../../2configs/lass/base.nix
     ../../2configs/lass/retiolum.nix
     ../../2configs/lass/fastpoke-pages.nix
+    ../../2configs/lass/identity.nix
+    {
+      tv.identity.self = config.tv.identity.hosts.cloudkrebs;
+    }
     {
       networking.interfaces.enp2s1.ip4 = [
         {
-- 
cgit v1.2.3


From 42deb3899c73a09c7b8ba1cc589e95d4fa60c73e Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Thu, 23 Jul 2015 13:15:38 +0200
Subject: 3 tv.identity: add cloudkrebs domains

---
 3modules/tv/identity.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/3modules/tv/identity.nix b/3modules/tv/identity.nix
index 584b271..9a83908 100644
--- a/3modules/tv/identity.nix
+++ b/3modules/tv/identity.nix
@@ -55,6 +55,12 @@ let
     retiolum = "hosts";
     de.viljetic = "regfish";
     de.krebsco = "ovh";
+    de.habsys = "hosts";
+    de.pixelpocket = "hosts";
+    de.karlaskop = "hosts";
+    de.ubikmedia = "hosts";
+    de.apanowicz = "hosts";
+    de.aidsballs = "hosts";
   };
 
   # splitByProvider : [alias] -> set providername [alias]
-- 
cgit v1.2.3


From 977b84a5cfd26248d6fa6cba255c94053347668c Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Thu, 23 Jul 2015 13:16:30 +0200
Subject: 2 lass.identity: add with cloudkrebs

---
 2configs/lass/identity.nix | 48 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 2configs/lass/identity.nix

diff --git a/2configs/lass/identity.nix b/2configs/lass/identity.nix
new file mode 100644
index 0000000..bfaad14
--- /dev/null
+++ b/2configs/lass/identity.nix
@@ -0,0 +1,48 @@
+{ config, ... }:
+
+{
+  imports = [ ../../3modules/tv/identity.nix ];
+  tv.identity = {
+    enable = true;
+    search = "retiolum";
+    hosts = {
+      cloudkrebs = {
+        cores = 1;
+        dc = "lass"; #dc = "cac";
+        nets = rec {
+          internet = {
+            addrs4 = ["104.167.113.104"];
+            aliases = [
+              "cloudkrebs.internet"
+            ];
+          };
+          retiolum = {
+            via = internet;
+            addrs4 = ["10.243.206.102"];
+            addrs6 = ["42:941e:2816:35f4:5c5e:206b:3f0b:f762"];
+            aliases = [
+              "cloudkrebs.retiolum"
+              "cgit.cloudkrebs.retiolum"
+              "habsys.de"
+              "pixelpocket.de"
+              "karlaskop.de"
+              "ubikmedia.de"
+              "apanowicz.de"
+              "aidsballs.de"
+            ];
+            tinc.pubkey = ''
+              -----BEGIN RSA PUBLIC KEY-----
+              MIIBCgKCAQEAttUygCu7G6lIA9y+9rfTpLKIy2UgNDglUVoKZYLs8JPjtAtQVbtA
+              OcWwwPc8ijLQvwJWa8e/shqSzSIrtOe+HJbRGdXLdBLtOuLKpz+ZFHcS+95RS5aF
+              QTehg+QY7pvhbrrwKX936tkMR568suTQG6C8qNC/5jWYO/wIxFMhnQ2iRRKQOq1v
+              3aGGPC16KeXKVioY9KoV98S3n1rZW1JK07CIsZU4qb5txtLlW6FplJ7UmhVku1WC
+              sgOOj9yi6Zk1t8R2Pwv9gxa3Hc270voj5U+I2hgLV/LjheE8yhQgYHEA4vXerPdO
+              TGSATlSmMtE2NYGrKsLM7pKn286aSpXinwIDAQAB
+              -----END RSA PUBLIC KEY-----
+            '';
+          };
+        };
+      };
+    };
+  };
+}
-- 
cgit v1.2.3


From 09031485dcea56d5207f7c668c5cec6830a588d5 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Fri, 24 Jul 2015 14:00:28 +0200
Subject: 2 lass.fastpoke-pages: use functions for static

---
 2configs/lass/fastpoke-pages.nix | 121 ++++++++++++++++++++-------------------
 1 file changed, 61 insertions(+), 60 deletions(-)

diff --git a/2configs/lass/fastpoke-pages.nix b/2configs/lass/fastpoke-pages.nix
index 2fd9a86..4db4847 100644
--- a/2configs/lass/fastpoke-pages.nix
+++ b/2configs/lass/fastpoke-pages.nix
@@ -1,10 +1,37 @@
 { config, lib, pkgs, ... }:
 
 with lib;
-{
+
+let
+  createStaticPage = domain:
+    {
+      tv.nginx.servers."${domain}" = {
+        server-names = [
+          "${domain}"
+          "www.${domain}"
+        ];
+        locations = [
+          (nameValuePair "/" ''
+            root /var/lib/http/${domain};
+          '')
+        ];
+      };
+      #networking.extraHosts = ''
+      #  10.243.206.102 ${domain}
+      #'';
+    };
+
+in {
   imports = [
     ../../3modules/tv/nginx.nix
     ../../3modules/lass/iptables.nix
+  ] ++ map createStaticPage [
+    "habsys.de"
+    "pixelpocket.de"
+    "karlaskop.de"
+    "ubikmedia.de"
+    "apanowicz.de"
+    "aidsballs.de"
   ];
 
   lass.iptables = {
@@ -15,72 +42,46 @@ with lib;
     };
   };
 
-  #createStaticPage = domain:
-  #  {
-  #    irc.nginx.servers."${domain}" = {
-  #      server-names = [
-  #        "${domain}"
-  #        "www.${domain}"
-  #      ];
-  #      locations = [
-  #        (nameValuePair "/" ''
-  #          root /var/lib/http/${domain};
-  #        '')
-  #      ];
-  #    };
-  #    networking.extraHosts = ''
-  #      10.243.206.102 ${domain}
-  #    '';
-  #  };
-
-  #map createStaticPage [
-  #  "habsys.de"
-  #  "pixelpocket.de"
-  #  "karlaskop.de"
-  #  "ubikmedia.de"
-  #  "apanowicz.de"
-  #  "aidsballs.de"
-  #];
 
   tv.nginx = {
     enable = true;
     servers = {
 
-      "habsys.de" = {
-        server-names = [
-          "habsys.de"
-          "www.habsys.de"
-        ];
-        locations = [
-          (nameValuePair "/" ''
-            root /var/lib/http/habsys.de;
-          '')
-        ];
-      };
+      #"habsys.de" = {
+      #  server-names = [
+      #    "habsys.de"
+      #    "www.habsys.de"
+      #  ];
+      #  locations = [
+      #    (nameValuePair "/" ''
+      #      root /var/lib/http/habsys.de;
+      #    '')
+      #  ];
+      #};
 
-      "karlaskop.de" = {
-        server-names = [
-          "karlaskop.de"
-          "www.karlaskop.de"
-        ];
-        locations = [
-          (nameValuePair "/" ''
-            root /var/lib/http/karlaskop.de;
-          '')
-        ];
-      };
+      #"karlaskop.de" = {
+      #  server-names = [
+      #    "karlaskop.de"
+      #    "www.karlaskop.de"
+      #  ];
+      #  locations = [
+      #    (nameValuePair "/" ''
+      #      root /var/lib/http/karlaskop.de;
+      #    '')
+      #  ];
+      #};
 
-      "pixelpocket.de" = {
-        server-names = [
-          "pixelpocket.de"
-          "www.karlaskop.de"
-        ];
-        locations = [
-          (nameValuePair "/" ''
-            root /var/lib/http/karlaskop.de;
-          '')
-        ];
-      };
+      #"pixelpocket.de" = {
+      #  server-names = [
+      #    "pixelpocket.de"
+      #    "www.karlaskop.de"
+      #  ];
+      #  locations = [
+      #    (nameValuePair "/" ''
+      #      root /var/lib/http/karlaskop.de;
+      #    '')
+      #  ];
+      #};
 
     };
   };
-- 
cgit v1.2.3


From 834c1b855a6ac002ba495ae638770ec51f870c2b Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 27 Jul 2015 13:54:29 +0200
Subject: 1 lass: get identity from krebs

---
 1systems/lass/cloudkrebs.nix | 12 ++----------
 1systems/lass/mors.nix       |  9 +++------
 1systems/lass/uriel.nix      |  9 +++------
 3 files changed, 8 insertions(+), 22 deletions(-)

diff --git a/1systems/lass/cloudkrebs.nix b/1systems/lass/cloudkrebs.nix
index 57b1910..ba32ae5 100644
--- a/1systems/lass/cloudkrebs.nix
+++ b/1systems/lass/cloudkrebs.nix
@@ -7,10 +7,6 @@
     ../../2configs/lass/base.nix
     ../../2configs/lass/retiolum.nix
     ../../2configs/lass/fastpoke-pages.nix
-    ../../2configs/lass/identity.nix
-    {
-      tv.identity.self = config.tv.identity.hosts.cloudkrebs;
-    }
     {
       networking.interfaces.enp2s1.ip4 = [
         {
@@ -24,14 +20,10 @@
       ];
 
     }
-    {
-      imports = [ ../../3modules/tv/identity.nix ];
-      tv.identity = {
-        enable = true;
-      };
-    }
   ];
 
+  krebs.enable = true;
+  krebs.build.host = config.krebs.hosts.cloudkrebs;
   networking.hostName = "cloudkrebs";
 
 }
diff --git a/1systems/lass/mors.nix b/1systems/lass/mors.nix
index 3007380..882cb9f 100644
--- a/1systems/lass/mors.nix
+++ b/1systems/lass/mors.nix
@@ -20,14 +20,11 @@
     ../../2configs/lass/git-repos.nix
     ../../2configs/tv/synaptics.nix
     ../../2configs/lass/retiolum.nix
-    {
-      imports = [ ../../3modules/tv/identity.nix ];
-      tv.identity = {
-        enable = true;
-      };
-    }
   ];
 
+  krebs.enable = true;
+  krebs.build.host = config.krebs.hosts.mors;
+
   networking.hostName = "mors";
   networking.wireless.enable = true;
 
diff --git a/1systems/lass/uriel.nix b/1systems/lass/uriel.nix
index a6f5a82..d8858b4 100644
--- a/1systems/lass/uriel.nix
+++ b/1systems/lass/uriel.nix
@@ -12,12 +12,6 @@ with builtins;
     ../../2configs/lass/git-repos.nix
     ../../2configs/lass/chromium-patched.nix
     ../../2configs/lass/retiolum.nix
-    {
-      imports = [ ../../3modules/tv/identity.nix ];
-      tv.identity = {
-        enable = true;
-      };
-    }
     {
       users.extraUsers = {
         root = {
@@ -29,7 +23,10 @@ with builtins;
     }
   ];
 
+  krebs.enable = true;
+  krebs.build.host = config.krebs.hosts.uriel;
   networking.hostName = "uriel";
+
   networking.wireless.enable = true;
   nix.maxJobs = 2;
 
-- 
cgit v1.2.3


From 2dab7034acbe74f09ec2df0ceec61255308a7488 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 27 Jul 2015 13:55:16 +0200
Subject: 2 lass.fastpoke-pages: tv.nginx -> krebs.nginx

---
 2configs/lass/fastpoke-pages.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/2configs/lass/fastpoke-pages.nix b/2configs/lass/fastpoke-pages.nix
index 4db4847..3d6fcf2 100644
--- a/2configs/lass/fastpoke-pages.nix
+++ b/2configs/lass/fastpoke-pages.nix
@@ -5,7 +5,7 @@ with lib;
 let
   createStaticPage = domain:
     {
-      tv.nginx.servers."${domain}" = {
+      krebs.nginx.servers."${domain}" = {
         server-names = [
           "${domain}"
           "www.${domain}"
@@ -23,7 +23,6 @@ let
 
 in {
   imports = [
-    ../../3modules/tv/nginx.nix
     ../../3modules/lass/iptables.nix
   ] ++ map createStaticPage [
     "habsys.de"
@@ -43,7 +42,7 @@ in {
   };
 
 
-  tv.nginx = {
+  krebs.nginx = {
     enable = true;
     servers = {
 
-- 
cgit v1.2.3


From 0274aa54df9f38f3f13e311e76c896fd0b16231c Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 27 Jul 2015 13:56:46 +0200
Subject: 2 lass.retiolum: tv.retiolum -> krebs.retiolum

---
 2configs/lass/retiolum.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/2configs/lass/retiolum.nix b/2configs/lass/retiolum.nix
index d1389ad..767a1ce 100644
--- a/2configs/lass/retiolum.nix
+++ b/2configs/lass/retiolum.nix
@@ -3,7 +3,6 @@
 {
   imports = [
     ../../3modules/lass/iptables.nix
-    ../../3modules/tv/retiolum.nix
     ../../2configs/tv/exim-retiolum.nix
   ];
 
@@ -17,7 +16,7 @@
     };
   };
 
-  tv.retiolum = {
+  krebs.retiolum = {
     enable = true;
     hosts = ../../Zhosts;
     connectTo = [
-- 
cgit v1.2.3


From 7748e373162b3b802a56507dd86796e779cc3dd7 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 27 Jul 2015 13:57:46 +0200
Subject: 1 lass: use new-repos.nix

---
 1systems/lass/cloudkrebs.nix |  1 +
 1systems/lass/mors.nix       |  2 +-
 1systems/lass/uriel.nix      |  2 +-
 2configs/lass/new-repos.nix  | 77 ++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 80 insertions(+), 2 deletions(-)
 create mode 100644 2configs/lass/new-repos.nix

diff --git a/1systems/lass/cloudkrebs.nix b/1systems/lass/cloudkrebs.nix
index ba32ae5..2c755d8 100644
--- a/1systems/lass/cloudkrebs.nix
+++ b/1systems/lass/cloudkrebs.nix
@@ -7,6 +7,7 @@
     ../../2configs/lass/base.nix
     ../../2configs/lass/retiolum.nix
     ../../2configs/lass/fastpoke-pages.nix
+    ../../2configs/lass/new-repos.nix
     {
       networking.interfaces.enp2s1.ip4 = [
         {
diff --git a/1systems/lass/mors.nix b/1systems/lass/mors.nix
index 882cb9f..ee2184a 100644
--- a/1systems/lass/mors.nix
+++ b/1systems/lass/mors.nix
@@ -17,7 +17,7 @@
     ../../2configs/lass/binary-caches.nix
     ../../2configs/lass/ircd.nix
     ../../2configs/lass/chromium-patched.nix
-    ../../2configs/lass/git-repos.nix
+    ../../2configs/lass/new-repos.nix
     ../../2configs/tv/synaptics.nix
     ../../2configs/lass/retiolum.nix
   ];
diff --git a/1systems/lass/uriel.nix b/1systems/lass/uriel.nix
index d8858b4..4fe8cf2 100644
--- a/1systems/lass/uriel.nix
+++ b/1systems/lass/uriel.nix
@@ -9,7 +9,7 @@ with builtins;
     ../../2configs/lass/pass.nix
     ../../2configs/lass/urxvt.nix
     ../../2configs/lass/bird.nix
-    ../../2configs/lass/git-repos.nix
+    ../../2configs/lass/new-repos.nix
     ../../2configs/lass/chromium-patched.nix
     ../../2configs/lass/retiolum.nix
     {
diff --git a/2configs/lass/new-repos.nix b/2configs/lass/new-repos.nix
new file mode 100644
index 0000000..2c73f95
--- /dev/null
+++ b/2configs/lass/new-repos.nix
@@ -0,0 +1,77 @@
+{ config, lib, pkgs, ... }:
+
+with import ../../4lib/tv { inherit lib pkgs; };
+let
+
+  out = {
+    krebs.git = {
+      enable = true;
+      root-title = "public repositories at ${config.krebs.build.host.name}";
+      root-desc = "keep calm and engage";
+      inherit repos rules;
+    };
+  };
+
+  repos = mapAttrs (_: s: removeAttrs s ["collaborators"]) (
+    public-repos //
+    optionalAttrs config.krebs.build.host.secure restricted-repos
+  );
+
+  rules = concatMap make-rules (attrValues repos);
+
+  public-repos = mapAttrs make-public-repo {
+    painload = {};
+    stockholm = {
+      desc = "take all the computers hostage, they'll love you!";
+    };
+    wai-middleware-time = {};
+    web-routes-wai-custom = {};
+  };
+
+  restricted-repos = mapAttrs make-restricted-repo (
+    {
+      brain = {
+        collaborators = with config.krebs.users; [ tv makefu ];
+      };
+    } //
+    import /root/src/secrets/repos.nix { inherit config lib pkgs; }
+  );
+
+  make-public-repo = name: { desc ? null, ... }: {
+    inherit name desc;
+    public = true;
+    hooks = {
+      post-receive = git.irc-announce {
+        # TODO make nick = config.krebs.build.host.name the default
+        nick = config.krebs.build.host.name;
+        channel = "#retiolum";
+        server = "cd.retiolum";
+      };
+    };
+  };
+
+  make-restricted-repo = name: { desc ? null, ... }: {
+    inherit name desc;
+    public = false;
+  };
+
+  make-rules =
+    with git // config.krebs.users;
+    repo:
+      singleton {
+        user = lass;
+        repo = [ repo ];
+        perm = push "refs/*" [ non-fast-forward create delete merge ];
+      } ++
+      optional repo.public {
+        user = [ tv makefu uriel ];
+        repo = [ repo ];
+        perm = fetch;
+      } ++
+      optional (length (repo.collaborators or []) > 0) {
+        user = repo.collaborators;
+        repo = [ repo ];
+        perm = fetch;
+      };
+
+in out
-- 
cgit v1.2.3


From eefd319a49fd03cdd06c32a17f617f26a0ef3a38 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 27 Jul 2015 13:59:00 +0200
Subject: 3 krebs: add lass's hosts domain

---
 3modules/krebs/default.nix | 91 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 91 insertions(+)

diff --git a/3modules/krebs/default.nix b/3modules/krebs/default.nix
index 33c1088..5251f97 100644
--- a/3modules/krebs/default.nix
+++ b/3modules/krebs/default.nix
@@ -66,6 +66,11 @@ let
             retiolum = "hosts";
             de.viljetic = "regfish";
             de.krebsco = "ovh";
+            de.habsys = "hosts";
+            de.pixelpocket = "hosts";
+            de.karlaskop = "hosts";
+            de.ubikmedia = "hosts";
+            de.apanowicz = "hosts";
           };
 
           # splitByProvider : [alias] -> listset providername alias
@@ -93,6 +98,92 @@ let
 
   lass-imp = {
     hosts = addNames {
+      cloudkrebs = {
+        cores = 1;
+        dc = "lass"; #dc = "cac";
+        nets = rec {
+          internet = {
+            addrs4 = ["104.167.113.104"];
+            aliases = [
+              "cloudkrebs.internet"
+            ];
+          };
+          retiolum = {
+            via = internet;
+            addrs4 = ["10.243.206.102"];
+            addrs6 = ["42:941e:2816:35f4:5c5e:206b:3f0b:f762"];
+            aliases = [
+              "cloudkrebs.retiolum"
+              "cgit.cloudkrebs.retiolum"
+              "habsys.de"
+              "pixelpocket.de"
+              "karlaskop.de"
+              "ubikmedia.de"
+              "apanowicz.de"
+            ];
+            tinc.pubkey = ''
+              -----BEGIN RSA PUBLIC KEY-----
+              MIIBCgKCAQEAttUygCu7G6lIA9y+9rfTpLKIy2UgNDglUVoKZYLs8JPjtAtQVbtA
+              OcWwwPc8ijLQvwJWa8e/shqSzSIrtOe+HJbRGdXLdBLtOuLKpz+ZFHcS+95RS5aF
+              QTehg+QY7pvhbrrwKX936tkMR568suTQG6C8qNC/5jWYO/wIxFMhnQ2iRRKQOq1v
+              3aGGPC16KeXKVioY9KoV98S3n1rZW1JK07CIsZU4qb5txtLlW6FplJ7UmhVku1WC
+              sgOOj9yi6Zk1t8R2Pwv9gxa3Hc270voj5U+I2hgLV/LjheE8yhQgYHEA4vXerPdO
+              TGSATlSmMtE2NYGrKsLM7pKn286aSpXinwIDAQAB
+              -----END RSA PUBLIC KEY-----
+            '';
+          };
+        };
+      };
+      uriel = {
+        cores = 1;
+        dc = "lass";
+        nets = rec {
+          retiolum = {
+            addrs4 = ["10.243.81.176"];
+            addrs6 = ["42:dc25:60cf:94ef:759b:d2b6:98a9:2e56"];
+            aliases = [
+              "uriel.retiolum"
+              "cgit.uriel.retiolum"
+            ];
+            tinc.pubkey = ''
+              -----BEGIN RSA PUBLIC KEY-----
+              MIIBCgKCAQEAzw0pvoEmqeqiZrzSOPH0IT99gr1rrvMZbvabXoU4MAiVgGoGrkmR
+              duJkk8Fj12ftMc+Of1gnwDkFhRcfAKOeH1RSc4CTircWVq99WyecTwEZoaR/goQb
+              MND022kIBoG6NQNxv1Y5I1B/h7hfloMFEPym9oFtOAXoGhBY2vVl4g64NNz+RLME
+              m1RipLXKANAh6LRNPGPQCUYX4TVY2ZJVxM3CM1XdomUAdOYXJmWFyUg9NcIKaacx
+              uRrmuy7J9yFBcihZX5Y7NV361kINrpRmZYxJRf9cr0hb5EkJJ7bMIKQMEFQ5RnYo
+              u7MPGKD7aNHa6hLLCeIfJ5u0igVmSLh3pwIDAQAB
+              -----END RSA PUBLIC KEY-----
+            '';
+          };
+        };
+      };
+      mors = {
+        cores = 2;
+        dc = "lass";
+        nets = rec {
+          retiolum = {
+            addrs4 = ["10.243.0.2"];
+            addrs6 = ["42:0:0:0:0:0:0:dea7"];
+            aliases = [
+              "mors.retiolum"
+              "cgit.mors.retiolum"
+            ];
+            tinc.pubkey = ''
+              -----BEGIN RSA PUBLIC KEY-----
+              MIIBCgKCAQEAsj1PCibKOfF68gmFQ+wwyfhUWpqKqpznrJX1dZ+daae7l7nBHvsE
+              H0QwkiMmk3aZy1beq3quM6gX13aT+/wMfWnLyuvT11T5C9JEf/IS91STpM2BRN+R
+              +P/DhbuDcW4UsdEe6uwQDGEJbXRN5ZA7GI0bmcYcwHJ9SQmW5v7P9Z3oZ+09hMD+
+              1cZ3HkPN7weSdMLMPpUpmzCsI92cXGW0xRC4iBEt1ZeBwjkLCRsBFBGcUMuKWwVa
+              9sovca0q3DUar+kikEKVrVy26rZUlGuBLobMetDGioSawWkRSxVlfZvTHjAK5JzU
+              O6y6hj0yQ1sp6W2JjU8ntDHf63aM71dB9QIDAQAB
+              -----END RSA PUBLIC KEY-----
+            '';
+          };
+        };
+        secure = true;
+      };
+
     };
     users = addNames {
       lass = {
-- 
cgit v1.2.3


From 79d90aa53fe1e360b146748f82e9e092029473af Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 27 Jul 2015 13:59:22 +0200
Subject: 1 lass.mors: open tcp 8000

---
 1systems/lass/mors.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/1systems/lass/mors.nix b/1systems/lass/mors.nix
index ee2184a..e854dd5 100644
--- a/1systems/lass/mors.nix
+++ b/1systems/lass/mors.nix
@@ -186,4 +186,12 @@
   services.mongodb = {
     enable = true;
   };
+
+  lass.iptables = {
+    tables = {
+      filter.INPUT.rules = [
+        { predicate = "-p tcp --dport 8000"; target = "ACCEPT"; precedence = 9001; }
+      ];
+    };
+  };
 }
-- 
cgit v1.2.3


From 30643ec9a11125e65013de8b7da1ad20634e9332 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 27 Jul 2015 13:59:47 +0200
Subject: 2 lass.fastpoke-pages: dont write /etc/hosts

---
 2configs/lass/fastpoke-pages.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/2configs/lass/fastpoke-pages.nix b/2configs/lass/fastpoke-pages.nix
index 3d6fcf2..74e92cc 100644
--- a/2configs/lass/fastpoke-pages.nix
+++ b/2configs/lass/fastpoke-pages.nix
@@ -30,7 +30,6 @@ in {
     "karlaskop.de"
     "ubikmedia.de"
     "apanowicz.de"
-    "aidsballs.de"
   ];
 
   lass.iptables = {
@@ -85,11 +84,6 @@ in {
     };
   };
 
-  networking.extraHosts = ''
-    10.243.206.102 habsys.de karlaskop.de pixelpocket.de ubikmedia.de apanowicz.de
-    10.243.206.102 aidsballs.de
-  '';
-
   #services.postgresql = {
   #  enable = true;
   #};
-- 
cgit v1.2.3


From 87b491245a9b8a2e6091e5bf21a3b51da1e908e1 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 27 Jul 2015 14:00:37 +0200
Subject: 2 lass.git-repos: delete

---
 2configs/lass/git-repos.nix | 140 --------------------------------------------
 1 file changed, 140 deletions(-)
 delete mode 100644 2configs/lass/git-repos.nix

diff --git a/2configs/lass/git-repos.nix b/2configs/lass/git-repos.nix
deleted file mode 100644
index b4f446a..0000000
--- a/2configs/lass/git-repos.nix
+++ /dev/null
@@ -1,140 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  inherit (builtins) map readFile;
-  inherit (lib) concatMap listToAttrs;
-  # TODO lib should already include our stuff
-  inherit (import ../../4lib/tv { inherit lib pkgs; }) addNames git;
-
-  x-repos = [
-    (krebs-private "brain")
-
-    (public "painload")
-    (public "shitment")
-    (public "wai-middleware-time")
-    (public "web-routes-wai-custom")
-
-    (secret "pass")
-
-    (tv-lass "emse-drywall")
-    (tv-lass "emse-hsdb")
-  ];
-
-  users = addNames {
-    tv = { pubkey = readFile ../../Zpubkeys/tv_wu.ssh.pub; };
-    lass = { pubkey = readFile ../../Zpubkeys/lass.ssh.pub; };
-    uriel = { pubkey = readFile ../../Zpubkeys/uriel.ssh.pub; };
-    makefu = { pubkey = readFile ../../Zpubkeys/makefu.ssh.pub; };
-  };
-
-  repos = listToAttrs (map ({ repo, ... }: { name = repo.name; value = repo; }) x-repos);
-
-  rules = concatMap ({ rules, ... }: rules) x-repos;
-
-  krebs-private = repo-name:
-    rec {
-      repo = {
-        name = repo-name;
-        hooks = {
-          post-receive = git.irc-announce {
-            nick = config.networking.hostName; # TODO make this the default
-            channel = "#retiolum";
-            server = "cd.retiolum";
-          };
-        };
-      };
-      rules = with git; with users; [
-        { user = lass;
-          repo = [ repo ];
-          perm = push "refs/*" [ non-fast-forward create delete merge ];
-        }
-        { user = [ tv makefu uriel ];
-          repo = [ repo ];
-          perm = fetch;
-        }
-      ];
-    };
-
-  public = repo-name:
-    rec {
-      repo = {
-        name = repo-name;
-        hooks = {
-          post-receive = git.irc-announce {
-            nick = config.networking.hostName; # TODO make this the default
-            channel = "#retiolum";
-            server = "cd.retiolum";
-          };
-        };
-        public = true;
-      };
-      rules = with git; with users; [
-        { user = lass;
-          repo = [ repo ];
-          perm = push "refs/*" [ non-fast-forward create delete merge ];
-        }
-        { user = [ tv makefu uriel ];
-          repo = [ repo ];
-          perm = fetch;
-        }
-      ];
-    };
-
-  secret = repo-name:
-    rec {
-      repo = {
-        name = repo-name;
-        hooks = {};
-      };
-      rules = with git; with users; [
-        { user = lass;
-          repo = [ repo ];
-          perm = push "refs/*" [ non-fast-forward create delete merge ];
-        }
-        { user = [ uriel ];
-          repo = [ repo ];
-          perm = fetch;
-        }
-      ];
-    };
-
-  tv-lass = repo-name:
-    rec {
-      repo = {
-        name = repo-name;
-        hooks = {};
-      };
-      rules = with git; with users; [
-        { user = lass;
-          repo = [ repo ];
-          perm = push "refs/*" [ non-fast-forward create delete merge ];
-        }
-        { user = [ tv ];
-          repo = [ repo ];
-          perm = fetch;
-        }
-      ];
-    };
-
-in
-
-{
-  imports = [
-    ../../3modules/tv/git.nix
-    ../../3modules/lass/iptables.nix
-  ];
-
-  tv.git = {
-    enable = true;
-    inherit repos rules users;
-  };
-
-  lass.iptables = {
-    tables = {
-      filter.INPUT.rules = [
-        { predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; }
-      ];
-    };
-  };
-
-}
-- 
cgit v1.2.3


From 3f1b07fe4a5fbbe20aaae3d13713889292bdc0ea Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 27 Jul 2015 14:01:00 +0200
Subject: 3 lass: init default.nix

---
 3modules/lass/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 3modules/lass/default.nix

diff --git a/3modules/lass/default.nix b/3modules/lass/default.nix
new file mode 100644
index 0000000..d4e231e
--- /dev/null
+++ b/3modules/lass/default.nix
@@ -0,0 +1,8 @@
+_:
+
+{
+  imports = [
+    ./xresources.nix
+    ./iptables.nix
+  ];
+}
-- 
cgit v1.2.3


From 36566b511d6cca0e17013bcbdfb05885117b375a Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 27 Jul 2015 17:03:20 +0200
Subject: lass: move krebs config to base

---
 1systems/lass/mors.nix | 1 -
 2configs/lass/base.nix | 5 +++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/1systems/lass/mors.nix b/1systems/lass/mors.nix
index e854dd5..8cda1ea 100644
--- a/1systems/lass/mors.nix
+++ b/1systems/lass/mors.nix
@@ -22,7 +22,6 @@
     ../../2configs/lass/retiolum.nix
   ];
 
-  krebs.enable = true;
   krebs.build.host = config.krebs.hosts.mors;
 
   networking.hostName = "mors";
diff --git a/2configs/lass/base.nix b/2configs/lass/base.nix
index 494cafa..8d4a9c8 100644
--- a/2configs/lass/base.nix
+++ b/2configs/lass/base.nix
@@ -36,6 +36,11 @@ with lib;
     }
   ];
 
+  krebs = {
+    enable = true;
+    search-domain = "retiolum";
+  };
+
   nix.useChroot = true;
 
   users.mutableUsers = false;
-- 
cgit v1.2.3


From 7673c84204bd5bae0426b79c62e95dfccf846756 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 27 Jul 2015 16:26:50 +0200
Subject: krebs.build.script: update system profile

---
 3modules/krebs/default.nix | 100 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 100 insertions(+)

diff --git a/3modules/krebs/default.nix b/3modules/krebs/default.nix
index 5251f97..c71b70a 100644
--- a/3modules/krebs/default.nix
+++ b/3modules/krebs/default.nix
@@ -22,6 +22,106 @@ let
     build = mkOption {
       type = types.submodule {
         options = {
+          target = mkOption {
+            type = with types; nullOr str;
+            default = null;
+          };
+          deps = mkOption {
+            type = with types; attrsOf (submodule {
+              options = {
+                url = mkOption {
+                  type = str;
+                };
+                rev = mkOption {
+                  type = nullOr str;
+                  default = null;
+                };
+              };
+            });
+            default = {};
+          };
+          script = mkOption {
+            type = types.str;
+            default = ''
+              #! /bin/sh
+              set -efux
+
+              target=${escapeShellArg cfg.build.target}
+
+              push(){(
+                src=$1/
+                dst=$target:$2
+                rsync \
+                  --exclude .git \
+                  --exclude .graveyard \
+                  --exclude old \
+                  --rsync-path="mkdir -p \"$dst\" && rsync" \
+                  --usermap=\*:0 \
+                  --groupmap=\*:0 \
+                  --delete-excluded \
+                  -vrLptgoD \
+                  "$src" "$dst"
+              )}
+
+              ${concatStrings (mapAttrsToList (name: { url, rev, ... }:
+                optionalString (rev == null) ''
+                  push ${toString (map escapeShellArg [
+                    "${url}"
+                    "/root/src/${name}"
+                  ])}
+                '') config.deps)}
+
+              exec ssh -S none "$target" /bin/sh <<\EOF
+              set -efux
+              fetch(){(
+                url=$1
+                rev=$2
+                dst=$3
+                mkdir -p "$dst"
+                cd "$dst"
+                if ! test -e .git; then
+                  git init
+                fi
+                if ! cur_url=$(git config remote.origin.url 2>/dev/null); then
+                  git remote add origin "$url"
+                elif test "$cur_url" != "$url"; then
+                  git remote set-url origin "$url"
+                fi
+                if test "$(git rev-parse --verify HEAD 2>/dev/null)" != "$rev"; then
+                  git fetch origin
+                  git checkout "$rev" -- .
+                  git checkout -q "$rev"
+                  git submodule init
+                  git submodule update
+                fi
+                git clean -dxf
+              )}
+
+              ${concatStrings (mapAttrsToList (name: { url, rev, ... }:
+                optionalString (rev != null) ''
+                  fetch ${toString (map escapeShellArg [
+                    url
+                    rev
+                    "/root/src/${name}"
+                  ])}
+                '') config.deps)}
+
+              echo build system...
+              profile=/nix/var/nix/profiles/system
+              NIX_PATH=/root/src \
+              nix-env \
+                -Q \
+                -p "$profile" \
+                -f '<stockholm>' \
+                --set \
+                -A system \
+                --argstr user-name ${escapeShellArg cfg.build.user.name} \
+                --argstr system-name ${escapeShellArg cfg.build.host.name}
+
+              exec "$profile"/bin/switch-to-configuration switch
+              EOF
+            '';
+          };
           host = mkOption {
             type = types.host;
           };
-- 
cgit v1.2.3


From aa3a158c25d436643144b24d47a10e2e6d0660eb Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Tue, 28 Jul 2015 20:28:21 +0200
Subject: lass: port everything to stockholm

---
 1systems/lass/cloudkrebs.nix       |  30 ------
 1systems/lass/mors.nix             | 196 -------------------------------------
 1systems/lass/uriel.nix            | 166 -------------------------------
 2configs/lass/base.nix             | 143 ---------------------------
 2configs/lass/binary-caches.nix    |  13 ---
 2configs/lass/bird.nix             |  13 ---
 2configs/lass/bitcoin.nix          |  17 ----
 2configs/lass/browsers.nix         |  67 -------------
 2configs/lass/chromium-patched.nix |  48 ---------
 2configs/lass/desktop-base.nix     |  63 ------------
 2configs/lass/elster.nix           |  20 ----
 2configs/lass/fastpoke-pages.nix   |  97 ------------------
 2configs/lass/games.nix            |  25 -----
 2configs/lass/gitolite-base.nix    | 173 --------------------------------
 2configs/lass/identity.nix         |  48 ---------
 2configs/lass/ircd.nix             |  92 -----------------
 2configs/lass/mors/repos.nix       |  87 ----------------
 2configs/lass/mors/retiolum.nix    |  21 ----
 2configs/lass/new-repos.nix        |  77 ---------------
 2configs/lass/pass.nix             |  10 --
 2configs/lass/programs.nix         |  24 -----
 2configs/lass/retiolum.nix         |  28 ------
 2configs/lass/sshkeys.nix          |  11 ---
 2configs/lass/steam.nix            |  30 ------
 2configs/lass/texlive.nix          |   7 --
 2configs/lass/urxvt.nix            |  40 --------
 2configs/lass/vim.nix              | 118 ----------------------
 2configs/lass/virtualbox.nix       |  22 -----
 2configs/lass/wine.nix             |  23 -----
 3modules/lass/default.nix          |   8 --
 3modules/lass/iptables.nix         | 187 -----------------------------------
 3modules/lass/sshkeys.nix          |  26 -----
 3modules/lass/urxvtd.nix           |  55 -----------
 3modules/lass/xresources.nix       |  57 -----------
 34 files changed, 2042 deletions(-)
 delete mode 100644 1systems/lass/cloudkrebs.nix
 delete mode 100644 1systems/lass/mors.nix
 delete mode 100644 1systems/lass/uriel.nix
 delete mode 100644 2configs/lass/base.nix
 delete mode 100644 2configs/lass/binary-caches.nix
 delete mode 100644 2configs/lass/bird.nix
 delete mode 100644 2configs/lass/bitcoin.nix
 delete mode 100644 2configs/lass/browsers.nix
 delete mode 100644 2configs/lass/chromium-patched.nix
 delete mode 100644 2configs/lass/desktop-base.nix
 delete mode 100644 2configs/lass/elster.nix
 delete mode 100644 2configs/lass/fastpoke-pages.nix
 delete mode 100644 2configs/lass/games.nix
 delete mode 100644 2configs/lass/gitolite-base.nix
 delete mode 100644 2configs/lass/identity.nix
 delete mode 100644 2configs/lass/ircd.nix
 delete mode 100644 2configs/lass/mors/repos.nix
 delete mode 100644 2configs/lass/mors/retiolum.nix
 delete mode 100644 2configs/lass/new-repos.nix
 delete mode 100644 2configs/lass/pass.nix
 delete mode 100644 2configs/lass/programs.nix
 delete mode 100644 2configs/lass/retiolum.nix
 delete mode 100644 2configs/lass/sshkeys.nix
 delete mode 100644 2configs/lass/steam.nix
 delete mode 100644 2configs/lass/texlive.nix
 delete mode 100644 2configs/lass/urxvt.nix
 delete mode 100644 2configs/lass/vim.nix
 delete mode 100644 2configs/lass/virtualbox.nix
 delete mode 100644 2configs/lass/wine.nix
 delete mode 100644 3modules/lass/default.nix
 delete mode 100644 3modules/lass/iptables.nix
 delete mode 100644 3modules/lass/sshkeys.nix
 delete mode 100644 3modules/lass/urxvtd.nix
 delete mode 100644 3modules/lass/xresources.nix

diff --git a/1systems/lass/cloudkrebs.nix b/1systems/lass/cloudkrebs.nix
deleted file mode 100644
index 2c755d8..0000000
--- a/1systems/lass/cloudkrebs.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  imports = [
-    ../../2configs/tv/CAC-Developer-2.nix
-    ../../2configs/tv/CAC-CentOS-7-64bit.nix
-    ../../2configs/lass/base.nix
-    ../../2configs/lass/retiolum.nix
-    ../../2configs/lass/fastpoke-pages.nix
-    ../../2configs/lass/new-repos.nix
-    {
-      networking.interfaces.enp2s1.ip4 = [
-        {
-          address = "104.167.113.104";
-          prefixLength = 24;
-        }
-      ];
-      networking.defaultGateway = "104.167.113.1";
-      networking.nameservers = [
-        "8.8.8.8"
-      ];
-
-    }
-  ];
-
-  krebs.enable = true;
-  krebs.build.host = config.krebs.hosts.cloudkrebs;
-  networking.hostName = "cloudkrebs";
-
-}
diff --git a/1systems/lass/mors.nix b/1systems/lass/mors.nix
deleted file mode 100644
index 8cda1ea..0000000
--- a/1systems/lass/mors.nix
+++ /dev/null
@@ -1,196 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  imports = [
-    ../../2configs/lass/desktop-base.nix
-    ../../2configs/lass/programs.nix
-    ../../2configs/lass/bitcoin.nix
-    ../../2configs/lass/browsers.nix
-    ../../2configs/lass/games.nix
-    ../../2configs/lass/pass.nix
-    ../../2configs/lass/virtualbox.nix
-    ../../2configs/lass/elster.nix
-    ../../2configs/lass/urxvt.nix
-    ../../2configs/lass/steam.nix
-    ../../2configs/lass/wine.nix
-    ../../2configs/lass/texlive.nix
-    ../../2configs/lass/binary-caches.nix
-    ../../2configs/lass/ircd.nix
-    ../../2configs/lass/chromium-patched.nix
-    ../../2configs/lass/new-repos.nix
-    ../../2configs/tv/synaptics.nix
-    ../../2configs/lass/retiolum.nix
-  ];
-
-  krebs.build.host = config.krebs.hosts.mors;
-
-  networking.hostName = "mors";
-  networking.wireless.enable = true;
-
-  networking.extraHosts = ''
-  '';
-
-  nix.maxJobs = 4;
-
-  hardware.enableAllFirmware = true;
-  nixpkgs.config.allowUnfree = true;
-
-  boot = {
-    loader.grub.enable = true;
-    loader.grub.version = 2;
-    loader.grub.device = "/dev/sda";
-
-    initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; } ];
-    initrd.luks.cryptoModules = [ "aes" "sha512" "sha1" "xts" ];
-    initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
-    #kernelModules = [ "kvm-intel" "msr" ];
-    kernelModules = [ "msr" ];
-  };
-  fileSystems = {
-    "/" = {
-      device = "/dev/big/nix";
-      fsType = "ext4";
-    };
-
-    "/boot" = {
-      device = "/dev/sda1";
-    };
-
-    "/mnt/loot" = {
-      device = "/dev/big/loot";
-      fsType = "ext4";
-    };
-
-    "/home" = {
-      device = "/dev/big/home";
-      fsType = "ext4";
-    };
-
-    "/home/lass" = {
-      device = "/dev/big/home-lass";
-      fsType = "ext4";
-    };
-
-    "/mnt/backups" = {
-      device = "/dev/big/backups";
-      fsType = "ext4";
-    };
-
-    "/home/games/.local/share/Steam" = {
-      device = "/dev/big/steam";
-      fsType = "ext4";
-    };
-
-    "/home/virtual/virtual" = {
-      device = "/dev/big/virtual";
-      fsType = "ext4";
-    };
-
-    "/mnt/public" = {
-      device = "/dev/big/public";
-      fsType = "ext4";
-    };
-  };
-
-  services.udev.extraRules = ''
-    SUBSYSTEM=="net", ATTR{address}=="a0:88:b4:29:26:bc", NAME="wl0"
-    SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:0c:a7:63", NAME="et0"
-  '';
-
-  #TODO activationScripts seem broken, fix them!
-  #activationScripts
-  #split up and move into base
-  system.activationScripts.powertopTunables = ''
-    #Enable Audio codec power management
-    echo '1' > '/sys/module/snd_hda_intel/parameters/power_save'
-    #VM writeback timeout
-    echo '1500' > '/proc/sys/vm/dirty_writeback_centisecs'
-    #Autosuspend for USB device Broadcom Bluetooth Device [Broadcom Corp]
-    echo 'auto' > '/sys/bus/usb/devices/1-1.4/power/control'
-    #Autosuspend for USB device Biometric Coprocessor
-    echo 'auto' > '/sys/bus/usb/devices/1-1.3/power/control'
-
-    #Runtime PMs
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:02.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:16.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:00.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:03:00.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1f.3/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1f.2/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1f.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1d.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.3/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:0d:00.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1b.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1a.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:19.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:16.3/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.1/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.4/power/control'
-  '';
-
-  hardware.trackpoint = {
-    enable = true;
-    sensitivity = 220;
-    speed = 0;
-    emulateWheel = true;
-  };
-
-  #system.activationScripts.trackpoint = ''
-  #  echo 0 > '/sys/devices/platform/i8042/serio1/serio2/speed'
-  #  echo 220 > '/sys/devices/platform/i8042/serio1/serio2/sensitivity'
-  #'';
-
-  services.xserver = {
-    videoDriver = "intel";
-    vaapiDrivers = [ pkgs.vaapiIntel ];
-    deviceSection = ''
-      Option "AccelMethod" "sna"
-      BusID "PCI:0:2:0"
-    '';
-  };
-
-  environment.systemPackages = with pkgs; [
-  ];
-
-  #TODO: fix this shit
-  ##fprint stuff
-  ##sudo fprintd-enroll $USER to save fingerprints
-  #services.fprintd.enable = true;
-  #security.pam.services.sudo.fprintAuth = true;
-
-  users.extraGroups = {
-    loot = {
-      members = [
-        config.users.extraUsers.mainUser.name
-        "firefox"
-        "chromium"
-        "google"
-        "virtual"
-      ];
-    };
-  };
-
-  networking.firewall = {
-    allowPing = true;
-    allowedTCPPorts = [
-      8000
-    ];
-    allowedUDPPorts = [
-      67
-    ];
-  };
-
-  services.mongodb = {
-    enable = true;
-  };
-
-  lass.iptables = {
-    tables = {
-      filter.INPUT.rules = [
-        { predicate = "-p tcp --dport 8000"; target = "ACCEPT"; precedence = 9001; }
-      ];
-    };
-  };
-}
diff --git a/1systems/lass/uriel.nix b/1systems/lass/uriel.nix
deleted file mode 100644
index 4fe8cf2..0000000
--- a/1systems/lass/uriel.nix
+++ /dev/null
@@ -1,166 +0,0 @@
-{ config, pkgs, ... }:
-
-with builtins;
-{
-  imports = [
-    ../../2configs/lass/desktop-base.nix
-    ../../2configs/lass/browsers.nix
-    ../../2configs/lass/games.nix
-    ../../2configs/lass/pass.nix
-    ../../2configs/lass/urxvt.nix
-    ../../2configs/lass/bird.nix
-    ../../2configs/lass/new-repos.nix
-    ../../2configs/lass/chromium-patched.nix
-    ../../2configs/lass/retiolum.nix
-    {
-      users.extraUsers = {
-        root = {
-          openssh.authorizedKeys.keys = map readFile [
-            ../../Zpubkeys/uriel.ssh.pub
-          ];
-        };
-      };
-    }
-  ];
-
-  krebs.enable = true;
-  krebs.build.host = config.krebs.hosts.uriel;
-  networking.hostName = "uriel";
-
-  networking.wireless.enable = true;
-  nix.maxJobs = 2;
-
-  hardware.enableAllFirmware = true;
-  nixpkgs.config.allowUnfree = true;
-
-  boot = {
-    #kernelParams = [
-    #  "acpi.brightness_switch_enabled=0"
-    #];
-    #loader.grub.enable = true;
-    #loader.grub.version = 2;
-    #loader.grub.device = "/dev/sda";
-
-    loader.gummiboot.enable = true;
-    loader.gummiboot.timeout = 5;
-
-    initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; } ];
-    initrd.luks.cryptoModules = [ "aes" "sha512" "sha1" "xts" ];
-    initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
-    #kernelModules = [ "kvm-intel" "msr" ];
-    kernelModules = [ "msr" ];
-    extraModprobeConfig = ''
-    '';
-  };
-  fileSystems = {
-    "/" = {
-      device = "/dev/pool/root";
-      fsType = "ext4";
-    };
-
-    "/boot" = {
-      device = "/dev/sda1";
-    };
-  };
-
-  services.udev.extraRules = ''
-    SUBSYSTEM=="net", ATTR{address}=="64:27:37:7d:d8:ae", NAME="wl0"
-    SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:b8:c8:2e", NAME="et0"
-  '';
-
-  #services.xserver = {
-  #};
-
-  services.xserver.synaptics = {
-    enable = true;
-    twoFingerScroll = true;
-    accelFactor = "0.035";
-    additionalOptions = ''
-      Option "FingerHigh" "60"
-      Option "FingerLow"  "60"
-    '';
-  };
-
-  environment.systemPackages = with pkgs; [
-  ];
-
-  #for google hangout
-
-  users.extraUsers.google.extraGroups = [ "audio" "video" ];
-
-
-  #users.extraGroups = {
-  #  loot = {
-  #    members = [
-  #      "lass"
-  #      "firefox"
-  #      "chromium"
-  #      "google"
-  #    ];
-  #  };
-  #};
-  #
-  # iptables
-  #
-  #networking.firewall.enable = false;
-  #system.activationScripts.iptables =
-  #  let
-  #    log = false;
-  #    when = c: f: if c then f else "";
-  #  in
-  #    ''
-  #      ip4tables() { ${pkgs.iptables}/sbin/iptables "$@"; }
-  #      ip6tables() { ${pkgs.iptables}/sbin/ip6tables "$@"; }
-  #      ipXtables() { ip4tables "$@"; ip6tables "$@"; }
-
-  #      #
-  #      # nat
-  #      #
-
-  #      # reset tables
-  #      ipXtables -t nat -F
-  #      ipXtables -t nat -X
-
-  #      #
-  #      #ipXtables -t nat -A PREROUTING -j REDIRECT ! -i retiolum -p tcp --dport ssh --to-ports 0
-  #      ipXtables -t nat -A PREROUTING -j REDIRECT -p tcp --dport 11423 --to-ports ssh
-
-  #      #
-  #      # filter
-  #      #
-
-  #      # reset tables
-  #      ipXtables -P INPUT DROP
-  #      ipXtables -P FORWARD DROP
-  #      ipXtables -F
-  #      ipXtables -X
-
-  #      # create custom chains
-  #      ipXtables -N Retiolum
-
-  #      # INPUT
-  #      ipXtables -A INPUT -j ACCEPT -m conntrack --ctstate RELATED,ESTABLISHED
-  #      ipXtables -A INPUT -j ACCEPT -i lo
-  #      ipXtables -A INPUT -j ACCEPT -p tcp --dport ssh -m conntrack --ctstate NEW
-  #      ipXtables -A INPUT -j ACCEPT -p tcp --dport http -m conntrack --ctstate NEW
-  #      ipXtables -A INPUT -j ACCEPT -p tcp --dport tinc -m conntrack --ctstate NEW
-  #      ipXtables -A INPUT -j Retiolum -i retiolum
-  #      ${when log "ipXtables -A INPUT -j LOG --log-level info --log-prefix 'INPUT DROP '"}
-
-  #      # FORWARD
-  #      ${when log "ipXtables -A FORWARD -j LOG --log-level info --log-prefix 'FORWARD DROP '"}
-
-  #      # Retiolum
-  #      ip4tables -A Retiolum -j ACCEPT -p icmp --icmp-type echo-request
-  #      ip6tables -A Retiolum -j ACCEPT -p ipv6-icmp -m icmp6 --icmpv6-type echo-request
-
-
-  #      ${when log "ipXtables -A Retiolum -j LOG --log-level info --log-prefix 'REJECT '"}
-  #      ipXtables -A Retiolum -j REJECT -p tcp --reject-with tcp-reset
-  #      ip4tables -A Retiolum -j REJECT -p udp --reject-with icmp-port-unreachable
-  #      ip4tables -A Retiolum -j REJECT        --reject-with icmp-proto-unreachable
-  #      ip6tables -A Retiolum -j REJECT -p udp --reject-with icmp6-port-unreachable
-  #      ip6tables -A Retiolum -j REJECT
-
-  #    '';
-}
diff --git a/2conf