Merge branch 'tv' into newmaster

21 files changed, 609 insertions, 68 deletions

diff --git a/Makefile b/Makefile
index ca828fd2b..54656e9e1 100644
--- a/Makefile
+++ b/Makefile
@@ -25,7 +25,7 @@ deploy:;@
 eval:
 	@
 ifeq ($(filter),json)
-	extraArgs=--json
+	extraArgs='--json --strict'
 	filter() { jq -r .; }
 else
 	filter() { cat; }
@@ -33,8 +33,6 @@ endif
 	NIX_PATH=stockholm=$$PWD:$$NIX_PATH \
 	nix-instantiate \
 		$${extraArgs-} \
-		$${json+--json} \
-		$${json+--strict} \
 		--eval \
 		-A "$$get" \
 		'<stockholm>' \
diff --git a/Zpubkeys/makefu_tsp.ssh.pub b/Zpubkeys/makefu_tsp.ssh.pub
new file mode 100644
index 000000000..9a9c9b6f8
--- /dev/null
+++ b/Zpubkeys/makefu_tsp.ssh.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1srWa67fcsw3r64eqgIuHbMbrj6Ywd9AwzCM+2dfXqYQZblchzH4Q4oydjdFOnV9LaA1LfNcWEjV/gVQKA2/xLSyXSDwzTxQDyOAZaqseKVg1F0a7wAF20+LiegQj6KXE29wcTW1RjcPncmagTBv5/vYbo1eDLKZjwGpEnG0+s+TRftrAhrgtbsuwR1GWWYACxk1CbxbcV+nIZ1RF9E1Fngbl4C4WjXDvsASi8s24utCd/XxgKwKcSFv7EWNfXlNzlETdTqyNVdhA7anc3N7d/TGrQuzCdtrvBFq4WbD3IRhSk79PXaB3L6xJ7LS8DyOSzfPyiJPK65Zw5s4BC07Z makefu@tsp
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 668d66ccf..9ad9c9f91 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -6,6 +6,7 @@ let
 
   out = {
     imports = [
+      ./exim-retiolum.nix
       ./github-hosts-sync.nix
       ./git.nix
       ./nginx.nix
@@ -55,7 +56,7 @@ let
                   --exclude .git \
                   --exclude .graveyard \
                   --exclude old \
-                  --rsync-path="mkdir -p \"$dst\" && rsync" \
+                  --rsync-path="mkdir -p \"$2\" && rsync" \
                   --usermap=\*:0 \
                   --groupmap=\*:0 \
                   --delete-excluded \
@@ -164,7 +165,7 @@ let
     { krebs = tv-imp; }
     {
       krebs.dns.providers = {
-        de.krebsco = "ovh";
+        de.krebsco = "zones";
         internet = "hosts";
         retiolum = "hosts";
       };
@@ -183,7 +184,42 @@ let
           ) host.nets
         ) cfg.hosts
       ));
-    }
+
+      # krebs.hosts.bob = rec {
+      #   addrs4 = "10.0.0.1";
+      #   extraZones = {
+      #     # extraZones
+      #     "krebsco.de" = ''
+      #     krebsco.de.       IN MX 10 mx1
+      #     mx1               IN A     ${addrs4}
+      #     '';
+      #     "dickbutt.de" = ''
+      #     dickbutt.de.       IN NS    ns
+      #     ns                IN A     ${addrs4}
+      #     ''
+      #   }
+      # }
+      # krebs.hosts.khan = rec {
+      #   addrs4 = "10.0.0.2";
+      #   extraZones = {
+      #      "krebsco.de" = ''
+      #      khan.krebsco.de     IN A   ${addrs4}
+      #   };
+      # }
+      #
+      #  =>
+      #  "zone/krebsco.de".text = ''
+      #    krebsco.de.         IN MX 10 mx1
+      #    mx1                 IN A     10.0.0.1
+      #    khan.krebsco.de     IN A     10.0.0.2
+      #  '';
+
+
+      environment.etc = mapAttrs'
+                        (name: value:
+                          nameValuePair (("zones/" + name)) ({ text=value;}))
+                        cfg.hosts.pigstarter.extraZones;
+      }
   ];
 
   lass-imp = {
@@ -306,10 +342,106 @@ let
           };
         };
       };
+      tsp = {
+        cores = 2;
+        dc = "makefu"; #x200
+        nets = {
+          retiolum = {
+            addrs4 = ["10.243.0.212"];
+            addrs6 = ["42:f9f1:0000:0000:0000:0000:0000:0002"];
+            aliases = [
+              "tsp.retiolum"
+            ];
+            tinc.pubkey = ''
+              -----BEGIN RSA PUBLIC KEY-----
+              MIICCgKCAgEAwW+RjRcp3uarkfXZ+FcCYY2GFcfI595GDpLRuiS/YQAB3JZEirHi
+              HFhDJN80fZ9qHqtq9Af462xSx+cIb282TxAqCM1Z9buipOcYTYo0m8xIqkT10dB3
+              mR87B+Ed1H6G3J6isdwEb9ZMegyGIIeyR53FJQYMZXjxdJbAmGMDKqjZSk1D5mo+
+              n5Vx3lGzTuDy84VyphfO2ypG48RHCxHUAx4Yt3o84LKoiy/y5E66jaowCOjZ6SqG
+              R0cymuhoBhMIk2xAXk0Qn7MZ1AOm9N7Wru7FXyoLc7B3+Gb0/8jXOJciysTG7+Gr
+              Txza6fJvq2FaH8iBnfezSELmicIYhc8Ynlq4xElcHhQEmRTQavVe/LDhJ0i6xJSi
+              aOu0njnK+9xK+MyDkB7n8dO1Iwnn7aG4n3CjVBB4BDO08lrovD3zdpDX0xhWgPRo
+              ReOJ3heRO/HsVpzxKlqraKWoHuOXXcREfU9cj3F6CRd0ECOhqtFMEr6TnuSc8GaE
+              KCKxY1oN45NbEFOCv2XKd2wEZFH37LFO6xxzSRr1DbVuKRYIPjtOiFKpwN1TIT8v
+              XGzTT4TJpBGnq0jfhFwhVjfCjLuGj29MCkvg0nqObQ07qYrjdQI4W1GnGOuyXkvQ
+              teyxjUXYbp0doTGxKvQaTWp+JapeEaJPN2MDOhrRFjPrzgo3aW9+97UCAwEAAQ==
+              -----END RSA PUBLIC KEY-----
+              '';
+          };
+        };
+      };
+      pornocauster = {
+        cores = 2;
+        dc = "makefu"; #x220
+        nets = {
+          retiolum = {
+            addrs4 = ["10.243.0.91"];
+            addrs6 = ["42:0b2c:d90e:e717:03dc:9ac1:7c30:a4db"];
+            aliases = [
+              "pornocauster.retiolum"
+            ];
+            tinc.pubkey = ''
+              -----BEGIN RSA PUBLIC KEY-----
+              MIICCgKCAgEAwW+RjRcp3uarkfXZ+FcCYY2GFcfI595GDpLRuiS/YQAB3JZEirHi
+              HFhDJN80fZ9qHqtq9Af462xSx+cIb282TxAqCM1Z9buipOcYTYo0m8xIqkT10dB3
+              mR87B+Ed1H6G3J6isdwEb9ZMegyGIIeyR53FJQYMZXjxdJbAmGMDKqjZSk1D5mo+
+              n5Vx3lGzTuDy84VyphfO2ypG48RHCxHUAx4Yt3o84LKoiy/y5E66jaowCOjZ6SqG
+              R0cymuhoBhMIk2xAXk0Qn7MZ1AOm9N7Wru7FXyoLc7B3+Gb0/8jXOJciysTG7+Gr
+              Txza6fJvq2FaH8iBnfezSELmicIYhc8Ynlq4xElcHhQEmRTQavVe/LDhJ0i6xJSi
+              aOu0njnK+9xK+MyDkB7n8dO1Iwnn7aG4n3CjVBB4BDO08lrovD3zdpDX0xhWgPRo
+              ReOJ3heRO/HsVpzxKlqraKWoHuOXXcREfU9cj3F6CRd0ECOhqtFMEr6TnuSc8GaE
+              KCKxY1oN45NbEFOCv2XKd2wEZFH37LFO6xxzSRr1DbVuKRYIPjtOiFKpwN1TIT8v
+              XGzTT4TJpBGnq0jfhFwhVjfCjLuGj29MCkvg0nqObQ07qYrjdQI4W1GnGOuyXkvQ
+              teyxjUXYbp0doTGxKvQaTWp+JapeEaJPN2MDOhrRFjPrzgo3aW9+97UCAwEAAQ==
+              -----END RSA PUBLIC KEY-----
+              '';
+          };
+        };
+      };
+      pigstarter = rec {
+        cores = 1;
+        dc = "frontrange"; #vps
+
+        extraZones = {
+          "de.krebsco" = ''
+            pigstarter.krebsco.de       IN A ${elemAt nets.internet.addrs4 0}
+            krebsco.de.                 IN NS io
+            io                          IN A ${elemAt nets.internet.addrs4 0}
+            krebsco.de.                 IN MX 10 mx42
+            mx42                        IN A ${elemAt nets.internet.addrs4 0}
+            '';
+        };
+        nets = {
+          internet = {
+            addrs4 = ["192.40.56.122"];
+            addrs6 = ["2604:2880::841f:72c"];
+            aliases = [
+              "pigstarter.internet"
+            ];
+          };
+          retiolum = {
+            addrs4 = ["10.243.0.153"];
+            addrs6 = ["42:9143:b4c0:f981:6030:7aa2:8bc5:4110"];
+            aliases = [
+              "pigstarter.retiolum"
+            ];
+            tinc.pubkey = ''
+              -----BEGIN RSA PUBLIC KEY-----
+              MIIBCgKCAQEA/efJuJRLUIZROe3QE8WYTD/zyNGRh9I2/yw+5It9HSNVDMIOV1FZ
+              9PaspsC+YQSBUQRN8SJ95G4RM6TIn/+ei7LiUYsf1Ik+uEOpP5EPthXqvdJEeswv
+              3QFwbpBeOMNdvmGvQLeR1uJKVyf39iep1wWGOSO1sLtUA+skUuN38QKc1BPASzFG
+              4ATM6rd2Tkt8+9hCeoePJdLr3pXat9BBuQIxImgx7m5EP02SH1ndb2wttQeAi9cE
+              DdJadpzOcEgFatzXP3SoKVV9loRHz5HhV4WtAqBIkDvgjj2j+NnXolAUY25Ix+kv
+              sfqfIw5aNLoIX4kDhuDEVBIyoc7/ofSbkQIDAQAB
+              -----END RSA PUBLIC KEY-----
+              '';
+          };
+        };
+      };
     };
     users = addNames {
       makefu = {
-        mail = "root@euer.krebsco.de";
+        mail = "root@tsp.retiolum";
         pubkey = readFile ../../Zpubkeys/makefu_arch.ssh.pub;
       };
     };
@@ -323,6 +455,13 @@ let
       cd = {
         cores = 2;
         dc = "tv"; #dc = "cac";
+        extraZones = {
+          "de.krebsco" = ''
+            mx23          IN A ${elemAt nets.internet.addrs4 0}
+            cd            IN A ${elemAt nets.internet.addrs4 0}
+            krebsco.de.   IN MX 5 mx23
+          '';
+        };
         nets = rec {
           internet = {
             addrs4 = ["162.219.7.216"];
diff --git a/tv/2configs/exim-retiolum.nix b/krebs/3modules/exim-retiolum.nix
index 851a0c625..e1315d8c8 100644
--- a/tv/2configs/exim-retiolum.nix
+++ b/krebs/3modules/exim-retiolum.nix
@@ -1,15 +1,27 @@
-{ config, pkgs, ... }:
-
-{
-  services.exim =
-    # This configuration makes only sense for retiolum-enabled hosts.
-    # TODO modular configuration
-    assert config.krebs.retiolum.enable;
-    let
-      # TODO get the hostname from config.krebs.retiolum.
-      retiolumHostname = "${config.networking.hostName}.retiolum";
-    in
-      { enable = true;
+{ config, pkgs, lib, ... }:
+
+with builtins;
+with lib;
+let
+  cfg = config.krebs.exim-retiolum;
+
+  out = {
+    options.krebs.exim-retiolum = api;
+    config =
+      mkIf cfg.enable imp;
+  };
+
+  api = {
+    enable = mkEnableOption "krebs.exim-retiolum";
+  };
+
+  imp = {
+    services.exim =
+      # This configuration makes only sense for retiolum-enabled hosts.
+      # TODO modular configuration
+      assert config.krebs.retiolum.enable;
+      {
+        enable = true;
         config = ''
           primary_hostname = ${retiolumHostname}
           domainlist local_domains    = @ : localhost
@@ -123,4 +135,9 @@
           begin authenticators
         '';
       };
-}
+  };
+
+  # TODO get the hostname from somewhere else.
+  retiolumHostname = "${config.networking.hostName}.retiolum";
+in
+out
diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index 92410dd58..f767d20fe 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -20,6 +20,13 @@ types // rec {
         type = attrsOf net;
         apply = x: assert hasAttr "retiolum" x; x;
       };
+
+      extraZones = mkOption {
+        default = {};
+        # TODO: string is either MX, NS, A or AAAA
+        type = with types; attrsOf string;
+      };
+
       secure = mkOption {
         type = bool;
         default = false;
diff --git a/krebs/5pkgs/cac.nix b/krebs/5pkgs/cac.nix
new file mode 100644
index 000000000..eff523048
--- /dev/null
+++ b/krebs/5pkgs/cac.nix
@@ -0,0 +1,38 @@
+{ stdenv, fetchgit, coreutils, curl, gnused, jq, ncurses, sshpass, ... }:
+
+stdenv.mkDerivation {
+  name = "cac";
+
+  src = fetchgit {
+    url = http://cgit.cd.retiolum/cac;
+    rev = "f4589158572ab35969b9bccf801ea07e115705e1";
+    sha256 = "9d761cd1d7ff68507392cbfd6c3f6000ddff9cc540293da2b3c4ee902321fb27";
+  };
+
+  phases = [
+    "unpackPhase"
+    "installPhase"
+  ];
+
+  installPhase =
+    let
+      path = stdenv.lib.makeSearchPath "bin" [
+        coreutils
+        curl
+        gnused
+        jq
+        ncurses
+        sshpass
+      ];
+    in
+    ''
+      mkdir -p $out/bin
+
+      sed \
+        's,^\(  true) \)\(cac "$@";;\)$,\1 PATH=${path}${PATH+:$PATH} \2,' \
+        < ./cac \
+        > $out/bin/cac
+
+      chmod +x $out/bin/cac
+    '';
+}
diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix
index 231fda797..5de84f66c 100644
--- a/krebs/5pkgs/default.nix
+++ b/krebs/5pkgs/default.nix
@@ -6,6 +6,7 @@ in
 
 pkgs //
 {
+  cac = callPackage ./cac.nix {};
   dic = callPackage ./dic.nix {};
   genid = callPackage ./genid.nix {};
   github-hosts-sync = callPackage ./github-hosts-sync.nix {};
diff --git a/makefu/1systems/pnp.nix b/makefu/1systems/pnp.nix
index 549658983..6693dc066 100644
--- a/makefu/1systems/pnp.nix
+++ b/makefu/1systems/pnp.nix
@@ -10,6 +10,9 @@
       <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
       ../2configs/base.nix
       ../2configs/cgit-retiolum.nix
+      ../2configs/graphite-standalone.nix
+      ../2configs/vm-single-partition.nix
+      ../2configs/tinc-basic-retiolum.nix
     ];
   krebs.build.host = config.krebs.hosts.pnp;
   krebs.build.user = config.krebs.users.makefu;
@@ -20,45 +23,14 @@
       url = https://github.com/NixOS/nixpkgs;
       rev = "4c01e6d91993b6de128795f4fbdd25f6227fb870";
     };
-    secrets = {
-      url = "/home/makefu/secrets/${config.krebs.build.host.name}";
-    };
-    stockholm = {
-      url = toString ../..;
-    };
   };
 
-  boot.loader.grub.enable = true;
-  boot.loader.grub.version = 2;
-  boot.loader.grub.device = "/dev/vda";
-
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ehci_pci" "virtio_pci" "virtio_blk" ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-  hardware.enableAllFirmware = true;
-  hardware.cpu.amd.updateMicrocode = true;
+  networking.firewall.allowedTCPPorts = [
+  # nginx runs on 80
+  # graphite-web runs on 8080, carbon cache runs on 2003 tcp and udp
+    80
+    8080 2003
+  ];
+  networking.firewall.allowedUDPPorts = [ 2003 ];
 
-# networking.firewall is enabled by default
-  networking.firewall.allowedTCPPorts = [ 80 ];
-  networking.firewall.rejectPackets = true;
-  networking.firewall.allowPing = true;
-
-  fileSystems."/" =
-  { device = "/dev/disk/by-label/nixos";
-    fsType = "ext4";
-  };
-  krebs.retiolum = {
-    enable = true;
-    hosts = ../../Zhosts;
-    connectTo = [
-      "gum"
-      "pigstarter"
-      "fastpoke"
-    ];
-  };
-
-# $ nix-env -qaP | grep wget
-    environment.systemPackages = with pkgs; [
-      jq
-    ];
 }
diff --git a/makefu/1systems/tsp.nix b/makefu/1systems/tsp.nix
new file mode 100644
index 000000000..6e93df51e
--- /dev/null
+++ b/makefu/1systems/tsp.nix
@@ -0,0 +1,37 @@
+#
+#
+#
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ../2configs/base.nix
+      ../2configs/base-gui.nix
+      ../2configs/tinc-basic-retiolum.nix
+      ../2configs/sda-crypto-root.nix
+      # hardware specifics are in here
+      ../2configs/tp-x200.nix
+    ];
+  # not working in vm
+  krebs.build.host = config.krebs.hosts.tsp;
+  krebs.build.user = config.krebs.users.makefu;
+  krebs.build.target = "root@tsp";
+
+  krebs.exim-retiolum.enable = true;
+  networking.firewall.allowedTCPPorts = [
+  # nginx runs on 80
+  # graphite-web runs on 8080, carbon cache runs on 2003 tcp and udp
+    25
+  ];
+
+  krebs.build.deps = {
+    nixpkgs = {
+      #url = https://github.com/NixOS/nixpkgs;
+      # rev=$(curl https://nixos.org/channels/nixos-unstable/git-revision -L)
+      url = https://github.com/makefu/nixpkgs;
+      rev = "8b8b65da24f13f9317504e8bcba476f9161613fe";
+    };
+  };
+
+}
diff --git a/makefu/2configs/base-gui.nix b/makefu/2configs/base-gui.nix
new file mode 100644
index 000000000..4e5558a1f
--- /dev/null
+++ b/makefu/2configs/base-gui.nix
@@ -0,0 +1,57 @@
+{ config, lib, pkgs, ... }:
+##
+# of course this name is a lie - it prepares a GUI environment close to my
+# current configuration.
+#
+# autologin with mainUser into awesome
+##
+#
+with lib;
+let
+  mainUser = config.krebs.build.user.name;
+in
+{
+  imports = [ ];
+  services.xserver = {
+    enable = true;
+    layout = "us";
+    xkbVariant = "altgr-intl";
+    xkbOptions = "ctrl:nocaps";
+
+    windowManager = {
+      awesome.enable = true;
+      awesome.luaModules = [ pkgs.luaPackages.vicious ];
+      default = "awesome";
+    };
+
+    displayManager.auto.enable = true;
+    displayManager.auto.user = mainUser;
+    desktopManager.xterm.enable = false;
+  };
+
+## FONTS
+# TODO: somewhere else?
+
+  i18n.consoleFont = "Lat2-Terminus16";
+
+  fonts = {
+    enableCoreFonts = true;
+    enableFontDir = true;
+    enableGhostscriptFonts = false;
+    fonts = [ pkgs.terminus_font ];
+  };
+
+  environment.systemPackages = with pkgs;[
+    xlockmore
+    rxvt_unicode-with-plugins
+    vlc
+    firefox
+    chromium
+  ];
+  # TODO: use mainUser
+  users.extraUsers.makefu.extraGroups = [ "audio" ];
+  hardware.pulseaudio = {
+    enable = true;
+  #  systemWide = true;
+  };
+}
diff --git a/makefu/2configs/base.nix b/makefu/2configs/base.nix
index 8dfb2ef27..906c74f7d 100644
--- a/makefu/2configs/base.nix
+++ b/makefu/2configs/base.nix
@@ -2,11 +2,18 @@
 
 with lib;
 {
-  imports = [ ];
+  imports = [
+    {
+      users.extraUsers =
+        mapAttrs (_: h: { hashedPassword = h; })
+                 (import /root/src/secrets/hashedPasswords.nix);
+    }
+    ./vim.nix
+  ];
   krebs.enable = true;
   krebs.search-domain = "retiolum";
 
-  networking.hostName = config.krebs.build.host.name;
+
   users.extraUsers = {
     root = {
         openssh.authorizedKeys.keys = [ config.krebs.users.makefu.pubkey ];
@@ -24,12 +31,29 @@ with lib;
     };
   };
 
+  networking.hostName = config.krebs.build.host.name;
+  nix.maxJobs = config.krebs.build.host.cores + 1;
+  #nix.maxJobs = 1;
+
+  krebs.build.deps = {
+    secrets = {
+      url = "/home/makefu/secrets/${config.krebs.build.host.name}";
+    };
+    stockholm = {
+      url = toString ../..;
+    };
+  };
+
   services.openssh.enable = true;
   nix.useChroot = true;
 
-  users.mutableUsers = true;
+  users.mutableUsers = false;
 
   boot.tmpOnTmpfs = true;
+
+  networking.firewall.rejectPackets = true;
+  networking.firewall.allowPing = true;
+
   systemd.tmpfiles.rules = [
     "d /tmp 1777 root root - -"
   ];
diff --git a/makefu/2configs/cgit-retiolum.nix b/makefu/2configs/cgit-retiolum.nix
index 7dfb181c5..d352f5792 100644
--- a/makefu/2configs/cgit-retiolum.nix
+++ b/makefu/2configs/cgit-retiolum.nix
@@ -52,11 +52,7 @@ let
 
   # TODO: get the list of all krebsministers
   krebsminister = with config.krebs.users; [ lass tv uriel ];
-
-  #all-makefu =  with config.krebs.users; [ makefu ];
-
-
-  all-makefu = with config.krebs.users; [ makefu makefu-omo ];
+  all-makefu = with config.krebs.users; [ makefu makefu-omo makefu-tsp ];
 
   priv-rules = repo: set-owners repo all-makefu;
 
@@ -69,6 +65,10 @@ in {
         name = "makefu-omo" ;
         pubkey= with builtins; readFile ../../Zpubkeys/makefu_omo.ssh.pub;
     };
+    krebs.users.makefu-tsp = {
+        name = "makefu-tsp" ;
+        pubkey= with builtins; readFile ../../Zpubkeys/makefu_tsp.ssh.pub;
+    };
   }];
   krebs.git = {
     enable = true;
diff --git a/makefu/2configs/graphite-standalone.nix b/makefu/2configs/graphite-standalone.nix
new file mode 100644
index 000000000..8b70c11c8
--- /dev/null
+++ b/makefu/2configs/graphite-standalone.nix
@@ -0,0 +1,34 @@
+{ config, lib, pkgs, ... }:
+
+# graphite-web on port 8080
+# carbon cache on port 2003 (tcp/udp)
+with lib;
+{
+  imports = [ ];
+
+  services.graphite = {
+    web = {
+      enable = true;
+      host = "0.0.0.0";
+    };
+    carbon = {
+      enableCache = true;
+      # save disk usage by restricting to 1 bulk update per second
+      config = ''
+        [cache]
+        MAX_CACHE_SIZE = inf
+        MAX_UPDATES_PER_SECOND = 1
+        MAX_CREATES_PER_MINUTE = 50
+        '';
+      storageSchemas = ''
+        [carbon]
+        pattern = ^carbon\.
+        retentions = 60:90d
+
+        [default]
+        pattern = .*
+        retentions = 60s:30d,300s:1y
+        '';
+    };
+  };
+}
diff --git a/makefu/2configs/sda-crypto-root.nix b/makefu/2configs/sda-crypto-root.nix
new file mode 100644
index 000000000..0d979a0b8
--- /dev/null
+++ b/makefu/2configs/sda-crypto-root.nix
@@ -0,0 +1,27 @@
+{ config, lib, pkgs, ... }:
+
+# sda:  bootloader grub2
+# sda1: boot ext4 (label nixboot)
+# sda2: cryptoluks -> ext4
+with lib;
+{
+  boot = {
+    loader.grub.enable =true;
+    loader.grub.version =2;
+    loader.grub.device = "/dev/sda";
+
+    initrd.luks.devices = [ { name = "luksroot"; device= "/dev/sda2";}];
+    initrd.luks.cryptoModules = ["aes" "sha512" "sha1" "xts" ];
+    initrd.availableKernelModules = ["xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
+  };
+  fileSystems = {
+    "/" = {
+      device = "/dev/mapper/luksroot";
+      fsType = "ext4";
+    };
+    "/boot" = {
+      device = "/dev/disk/by-label/nixboot";
+      fsType = "ext4";
+    };
+  };
+}
diff --git a/makefu/2configs/tinc-basic-retiolum.nix b/makefu/2configs/tinc-basic-retiolum.nix
new file mode 100644
index 000000000..cb1991bd6
--- /dev/null
+++ b/makefu/2configs/tinc-basic-retiolum.nix
@@ -0,0 +1,14 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+{
+  krebs.retiolum = {
+    enable = true;
+    hosts = ../../Zhosts;
+    connectTo = [
+      "gum"
+      "pigstarter"
+      "fastpoke"
+    ];
+  };
+}
diff --git a/makefu/2configs/tp-x200.nix b/makefu/2configs/tp-x200.nix
new file mode 100644
index 000000000..25a2537e8
--- /dev/null
+++ b/makefu/2configs/tp-x200.nix
@@ -0,0 +1,28 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+{
+  #services.xserver = {
+  #  videoDriver = "intel";
+  #};
+
+  boot = {
+    kernelModules = [ "tp_smapi" "msr" ];
+    extraModulePackages = [ config.boot.kernelPackages.tp_smapi ];
+
+  };
+
+  networking.wireless.enable = true;
+
+  hardware.enableAllFirmware = true;
+  nixpkgs.config.allowUnfree = true;
+
+  hardware.trackpoint.enable = true;
+  hardware.trackpoint.sensitivity = 255;
+  hardware.trackpoint.speed = 255;
+  services.xserver.displayManager.sessionCommands = ''
+    xinput set-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation" 1
+    xinput set-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Button" 2
+    xinput set-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Timeout" 200
+  '';
+}
diff --git a/makefu/2configs/vim.nix b/makefu/2configs/vim.nix
new file mode 100644
index 000000000..b71d95148
--- /dev/null
+++ b/makefu/2configs/vim.nix
@@ -0,0 +1,119 @@
+{ config, pkgs, ... }:
+
+let
+  customPlugins.vim-better-whitespace = pkgs.vimUtils.buildVimPlugin {
+    name = "vim-better-whitespace";
+    src = pkgs.fetchFromGitHub {
+      owner = "ntpeters";
+      repo = "vim-better-whitespace";
+      rev = "984c8da518799a6bfb8214e1acdcfd10f5f1eed7";
+      sha256 = "10l01a8xaivz6n01x6hzfx7gd0igd0wcf9ril0sllqzbq7yx2bbk";
+    };
+  };
+
+in {
+
+  environment.systemPackages = [
+    pkgs.python27Full # required for youcompleteme
+    (pkgs.vim_configurable.customize {
+      name = "vim";
+
+    vimrcConfig.customRC = ''
+      set nocompatible
+      syntax on
+
+      filetype off
+      filetype plugin indent on
+
+      colorscheme darkblue
+      set background=dark
+
+      set number
+      set relativenumber
+      set mouse=a
+      set ignorecase
+      set incsearch
+      set wildignore=*.o,*.obj,*.bak,*.exe,*.os
+      set textwidth=79
+      set shiftwidth=2
+      set expandtab
+      set softtabstop=2
+      set shiftround
+      set smarttab
+      set tabstop=2
+      set et
+      set autoindent
+      set backspace=indent,eol,start
+
+
+      inoremap <F1> <ESC>
+      nnoremap <F1> <ESC>
+      vnoremap <F1> <ESC>
+
+      nnoremap <F5> :UndotreeToggle<CR>
+      set undodir  =~/.vim/undo
+      set undofile
+      "maximum number of changes that can be undone
+      set undolevels=1000000
+      "maximum number lines to save for undo on a buffer reload
+      set undoreload=10000000
+
+      nnoremap <F2> :set invpaste paste?<CR>
+      set pastetoggle=<F2>
+      set showmode
+
+      set showmatch
+      set matchtime=3
+      set hlsearch
+
+      autocmd ColorScheme * highlight ExtraWhitespace ctermbg=red guibg=red
+
+
+      " save on focus lost
+      au FocusLost * :wa
+
+      autocmd BufRead *.json set filetype=json
+      au  BufNewFile,BufRead *.mustache set syntax=mustache
+
+      cnoremap SudoWrite w !sudo tee > /dev/null %
+
+      " create Backup/tmp/undo dirs
+      set backupdir=~/.vim/backup
+      set directory=~/.vim/tmp
+
+      function! InitBackupDir()
+        let l:parent = $HOME    . '/.vim/'
+        let l:backup = l:parent . 'backup/'
+        let l:tmpdir = l:parent . 'tmp/'
+        let l:undodir= l:parent . 'undo/'
+
+
+        if !isdirectory(l:parent)
+          call mkdir(l:parent)
+        endif
+        if !isdirectory(l:backup)
+          call mkdir(l:backup)
+        endif
+        if !isdirectory(l:tmpdir)
+          call mkdir(l:tmpdir)
+        endif
+        if !isdirectory(l:undodir)
+          call mkdir(l:undodir)
+        endif
+      endfunction
+      call InitBackupDir()
+
+
+    '';
+
+      vimrcConfig.vam.knownPlugins = pkgs.vimPlugins // customPlugins;
+      vimrcConfig.vam.pluginDictionaries = [
+        { names = [ "undotree"
+          "YouCompleteMe"
+          "vim-better-whitespace" ]; }
+        { names = [ "vim-addon-nix" ]; ft_regex = "^nix\$"; }
+      ];
+
+    })
+  ];
+}
diff --git a/makefu/2configs/vm-single-partition.nix b/makefu/2configs/vm-single-partition.nix
new file mode 100644
index 000000000..78a5e7175
--- /dev/null
+++ b/makefu/2configs/vm-single-partition.nix
@@ -0,0 +1,20 @@
+{ config, lib, pkgs, ... }:
+
+# vda1 ext4 (label nixos) -> only root partition
+with lib;
+{
+  boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
+  boot.loader.grub.device = "/dev/vda";
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "ext4";
+  };
+
+  hardware.enableAllFirmware = true;
+  nixpkgs.config.allowUnfree = true;
+  hardware.cpu.amd.updateMicrocode = true;
+
+
+}
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index b9a10cb4f..896c1ad29 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -25,7 +25,6 @@ with lib;
     ../2configs/AO753.nix
     ../2configs/base.nix
     ../2configs/consul-server.nix
-    ../2configs/exim-retiolum.nix
     ../2configs/git.nix
     {
       tv.iptables = {
@@ -39,6 +38,9 @@ with lib;
       };
     }
     {
+      krebs.exim-retiolum = true;
+    }
+    {
       krebs.nginx = {
         enable = true;
         servers.default.locations = [
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 27691ec56..a5cbde3ec 1