Merge remote-tracking branch 'gum/master'

53 files changed, 965 insertions, 272 deletions

diff --git a/krebs/3modules/krebs/default.nix b/krebs/3modules/krebs/default.nix
index e6eb3d287..889ee2817 100644
--- a/krebs/3modules/krebs/default.nix
+++ b/krebs/3modules/krebs/default.nix
@@ -129,6 +129,8 @@ in {
             "graphite.shack"
             "acng.shack"
             "drivedroid.shack"
+            "mobile.lounge.mpd.shack"
+            "lounge.mpd.wolf.shack"
           ];
         };
         retiolum = {
@@ -138,6 +140,7 @@ in {
             "wolf.r"
             "build.wolf.r"
             "cgit.wolf.r"
+            "lounge.mpd.wolf.r"
           ];
           tinc.pubkey = ''
             -----BEGIN RSA PUBLIC KEY-----
diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index 9630d7a7f..454f9bc65 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -1,7 +1,9 @@
 { config, ... }:
 
 with import <stockholm/lib>;
-
+## generate keys with:
+# tinc generate-keys
+# ssh-keygen -f ssh.id_ed25519 -t ed25519 -C host
 {
   hosts = mapAttrs (_: setAttr "owner" config.krebs.users.makefu) {
     cake = rec {
@@ -29,6 +31,32 @@ with import <stockholm/lib>;
       ssh.privkey.path = <secrets/ssh_host_ed25519_key>;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGyJlI0YpIh/LiiPMseD2IBHg+uVGrkSy0MPNeD+Jv8Y cake";
     };
+    crapi = rec { # raspi1
+      cores = 1;
+      ci = false;
+      nets = {
+        retiolum = {
+          ip4.addr = "10.243.136.237";
+          ip6.addr  = "42:b3b2:9552:eef0:ee67:f3b3:8d33:eee2";
+          aliases = [
+            "crapi.r"
+          ];
+          tinc.pubkey = ''
+            Ed25519PublicKey = Zkh6vtSNBvKYUjCPsMyAFJmxzueglCDoawVPCezKy4F
+            -----BEGIN RSA PUBLIC KEY-----
+            MIIBCgKCAQEAloXLBfZQEVW9mJ7uwOoa+DfV4ek/SG+JQuexJMugei/iNy0NjY66
+            OVIkzFmED32c3D7S1+Q+5Mc3eR02k1o7XERpZeZhCtJOBlS4xMzCKH62E4USvH5L
+            R4O8XX1o/tpeOuZvpnpY1oPmFFc/B5G2jWWQR4Slpbw7kODwYYm5o+B7n+MkVNrk
+            OEOHLaaO6I5QB3GJvDH2JbwzDKLVClQM20L/EvIwnB+Xg0q3veKFj0WTXEK+tuME
+            di++RV4thhZ9IOgRTJOeT94j7ulloh15gqYaIqRqgtzfWE2TnUxvl+upB+yQHNtl
+            bJFLHkE34cQGxEv9dMjRe8i14+Onhb3B6wIDAQAB
+            -----END RSA PUBLIC KEY-----
+            '';
+        };
+      };
+      ssh.privkey.path = <secrets/ssh.id_ed25519>;
+      ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGaV5Ga5R8RTrA+nclxw6uy5Z+hPBLitQTfuXdsmbVW6 crapi";
+    };
     drop = rec {
       ci = true;
       cores = 1;
@@ -298,6 +326,13 @@ with import <stockholm/lib>;
             -----END RSA PUBLIC KEY-----
           '';
         };
+        #wiregrill = {
+        #  ip6.addr = "42:4200:0000:0000:0000:0000:0000:a4db";
+        #  aliases = [
+        #    "x.w"
+        #  ];
+        #  wireguard.pubkey = "fe5smvKVy5GAn7EV4w4tav6mqIAKhGWQotm7dRuRt1g=";
+        #};
       };
       ssh.privkey.path = <secrets/ssh_host_ed25519_key>;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHDM0E608d/6rGzXqGbNSuMb2RlCojCJSiiz6QcPOC2G root@x";
@@ -457,8 +492,6 @@ with import <stockholm/lib>;
           ip6.addr = "42:f9f0::10";
           aliases = [
             "omo.r"
-            "logs.makefu.r"
-            "stats.makefu.r"
           ];
           tinc.pubkey = ''
             -----BEGIN RSA PUBLIC KEY-----
@@ -525,7 +558,9 @@ with import <stockholm/lib>;
         "krebsco.de" = ''
           cache.euer        IN A      ${nets.internet.ip4.addr}
           cache.gum         IN A      ${nets.internet.ip4.addr}
+          graph             IN A      ${nets.internet.ip4.addr}
           gold              IN A      ${nets.internet.ip4.addr}
+          iso.euer          IN A      ${nets.internet.ip4.addr}
         '';
       };
       cores = 8;
@@ -537,13 +572,24 @@ with import <stockholm/lib>;
             "nextgum.i"
           ];
         };
+        #wiregrill = {
+        #  via = internet;
+        #  ip6.addr = "42:4200:0000:0000:0000:0000:0000:70d3";
+        #  aliases = [
+        #    "gum.w"
+        #  ];
+        #  wireguard.pubkey = "yAKvxTvcEVdn+MeKsmptZkR3XSEue+wSyLxwcjBYxxo=";
+        #};
         retiolum = {
           via = internet;
           ip4.addr = "10.243.0.213";
           ip6.addr = "42:f9f0:0000:0000:0000:0000:0000:70d3";
           aliases = [
             "nextgum.r"
+            "graph.r"
             "cache.gum.r"
+            "logs.makefu.r"
+            "stats.makefu.r"
           ];
           tinc.pubkey = ''
             -----BEGIN RSA PUBLIC KEY-----
@@ -579,7 +625,6 @@ with import <stockholm/lib>;
           boot.euer         IN A      ${nets.internet.ip4.addr}
           wiki.euer         IN A      ${nets.internet.ip4.addr}
           mon.euer          IN A      ${nets.internet.ip4.addr}
-          graph             IN A      ${nets.internet.ip4.addr}
           ghook             IN A      ${nets.internet.ip4.addr}
           dockerhub         IN A      ${nets.internet.ip4.addr}
           photostore        IN A      ${nets.internet.ip4.addr}
@@ -604,7 +649,6 @@ with import <stockholm/lib>;
             "o.gum.r"
             "tracker.makefu.r"
 
-            "graph.r"
             "search.makefu.r"
             "wiki.makefu.r"
             "wiki.gum.r"
diff --git a/makefu/0tests/data/secrets/mqtt/hass b/makefu/0tests/data/secrets/mqtt/hass
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/0tests/data/secrets/mqtt/hass
diff --git a/makefu/0tests/data/secrets/mqtt/sensor b/makefu/0tests/data/secrets/mqtt/sensor
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/0tests/data/secrets/mqtt/sensor
diff --git a/makefu/0tests/data/secrets/mqtt/stats b/makefu/0tests/data/secrets/mqtt/stats
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/0tests/data/secrets/mqtt/stats
diff --git a/makefu/1systems/crapi/README b/makefu/1systems/crapi/README
new file mode 100644
index 000000000..9278c764a
--- /dev/null
+++ b/makefu/1systems/crapi/README
@@ -0,0 +1,4 @@
+1. flash arm6 image from https://www.cs.helsinki.fi/u/tmtynkky/nixos-arm/installer/ to sdcard
+2. passwd; systemctl start sshd; mkdir /var/src ; touch /var/src/.populate
+3. "environment.systemPackages = [ pkgs.rsync pkgs.git ];" in /etc/nixos/configuration.nix
+5. nixos-rebuild switch --fast --option binary-caches http://nixos-arm.dezgeg.me/channel --option binary-cache-public-keys nixos-arm.dezgeg.me-1:xBaUKS3n17BZPKeyxL4JfbTqECsT+ysbDJz29kLFRW0=%
diff --git a/makefu/1systems/crapi/config.nix b/makefu/1systems/crapi/config.nix
new file mode 100644
index 000000000..d96b872d5
--- /dev/null
+++ b/makefu/1systems/crapi/config.nix
@@ -0,0 +1,46 @@
+{ config, pkgs, lib, ... }:
+{
+  # :l <nixpkgs>
+  # builtins.readDir (pkgs.fetchFromGitHub { owner = "nixos"; repo = "nixpkgs-channels"; rev = "6c064e6b"; sha256 = "1rqzh475xn43phagrr30lb0fd292c1s8as53irihsnd5wcksnbyd"; })
+  imports = [
+    <stockholm/makefu>
+    <stockholm/makefu/2configs>
+    <stockholm/makefu/2configs/tinc/retiolum.nix>
+    <stockholm/makefu/2configs/save-diskspace.nix>
+
+  ];
+  krebs.build.host = config.krebs.hosts.crapi;
+  # NixOS wants to enable GRUB by default
+  boot.loader.grub.enable = false;
+
+  # Enables the generation of /boot/extlinux/extlinux.conf
+  boot.loader.generic-extlinux-compatible.enable = true;
+
+  boot.kernelPackages = pkgs.linuxPackages_rpi;
+
+  nix.binaryCaches = [ "http://nixos-arm.dezgeg.me/channel" ];
+  nix.binaryCachePublicKeys = [ "nixos-arm.dezgeg.me-1:xBaUKS3n17BZPKeyxL4JfbTqECsT+ysbDJz29kLFRW0=%" ];
+
+  fileSystems = {
+    "/boot" = {
+      device = "/dev/disk/by-label/NIXOS_BOOT";
+      fsType = "vfat";
+    };
+    "/" = {
+      device = "/dev/disk/by-label/NIXOS_SD";
+      fsType = "ext4";
+    };
+  };
+
+  system.activationScripts.create-swap = ''
+    if [ ! -e /swapfile ]; then
+      fallocate -l 2G /swapfile
+      mkswap /swapfile
+    fi
+  '';
+  swapDevices = [ { device = "/swapfile"; size = 2048; } ];
+
+  nix.package = lib.mkForce pkgs.nixStable;
+  services.openssh.enable = true;
+
+}
diff --git a/makefu/1systems/crapi/source.nix b/makefu/1systems/crapi/source.nix
new file mode 100644
index 000000000..4a4359ee6
--- /dev/null
+++ b/makefu/1systems/crapi/source.nix
@@ -0,0 +1,3 @@
+{
+  arm6 = true;
+}
diff --git a/makefu/1systems/omo/config.nix b/makefu/1systems/omo/config.nix
index 47e815e77..be49db024 100644
--- a/makefu/1systems/omo/config.nix
+++ b/makefu/1systems/omo/config.nix
@@ -17,7 +17,10 @@ in {
       # <stockholm/makefu/2configs/smart-monitor.nix>
       <stockholm/makefu/2configs/mail-client.nix>
       <stockholm/makefu/2configs/mosh.nix>
+      <stockholm/makefu/2configs/tools/core.nix>
+      <stockholm/makefu/2configs/tools/desktop.nix>
       <stockholm/makefu/2configs/tools/mobility.nix>
+      { environment.systemPackages = [ pkgs.esniper ]; }
       # <stockholm/makefu/2configs/disable_v6.nix>
       #<stockholm/makefu/2configs/graphite-standalone.nix>
       #<stockholm/makefu/2configs/share-user-sftp.nix>
@@ -33,12 +36,12 @@ in {
       # logs to influx
       <stockholm/makefu/2configs/stats/external/aralast.nix>
       <stockholm/makefu/2configs/stats/telegraf>
-      <stockholm/makefu/2configs/stats/telegraf/europastats.nix>
+      # <stockholm/makefu/2configs/stats/telegraf/europastats.nix>
+      <stockholm/makefu/2configs/stats/telegraf/hamstats.nix>
       <stockholm/makefu/2configs/stats/arafetch.nix>
 
       # services
       <stockholm/makefu/2configs/syncthing.nix>
-      <stockholm/makefu/2configs/mqtt.nix>
       <stockholm/makefu/2configs/remote-build/slave.nix>
       <stockholm/makefu/2configs/deployment/google-muell.nix>
       <stockholm/makefu/2configs/virtualisation/docker.nix>
@@ -67,8 +70,8 @@ in {
       # <stockholm/makefu/2configs/temp/rst-issue.nix>
 
     ];
-  makefu.full-populate = true;
-  krebs.rtorrent = {
+  makefu.full-populate =  true;
+  krebs.rtorrent = (builtins.trace (builtins.toJSON config.services.telegraf.extraConfig)) {
     downloadDir = lib.mkForce "/media/cryptX/torrent";
     extraConfig = ''
       upload_rate = 200
diff --git a/makefu/1systems/omo/hw/tsp.nix b/makefu/1systems/omo/hw/tsp.nix
index 4af0d73fc..a289fadce 100644
--- a/makefu/1systems/omo/hw/tsp.nix
+++ b/makefu/1systems/omo/hw/tsp.nix
@@ -6,7 +6,8 @@ let
     rev = "9c9b62e15e4ac11d4379e66b974f1389daf939fe";
   });
   cfg = fromJSON (readFile ../../hardware/tsp-disk.json);
-  primaryInterface = "enp1s0";
+  # primaryInterface = "enp1s0";
+  primaryInterface = "wlp2s0";
   rootDisk = "/dev/sda"; # TODO same as disko uses
 in {
   imports = [
@@ -28,5 +29,13 @@ in {
 
     kernelModules = [ "kvm-intel" ];
   };
-
+  networking.wireless.enable = true;
+  hardware.enableRedistributableFirmware = true;
+  hardware.cpu.intel.updateMicrocode = true;
+  services.logind.lidSwitch = "ignore";
+  services.logind.lidSwitchDocked = "ignore";
+  services.logind.extraConfig = ''
+    HandleSuspendKey = ignore
+  '';
+  powerManagement.enable = false;
 }
diff --git a/makefu/1systems/sdev/config.nix b/makefu/1systems/sdev/config.nix
index c2cd23d1e..2f289d500 100644
--- a/makefu/1systems/sdev/config.nix
+++ b/makefu/1systems/sdev/config.nix
@@ -6,13 +6,13 @@
     [ # Include the results of the hardware scan.
       <stockholm/makefu>
 
-     #  <stockholm/makefu/2configs/hw/vbox-guest.nix>
-      { # until virtualbox-image is fixed
-        imports = [
-            <stockholm/makefu/2configs/fs/single-partition-ext4.nix>
-          ];
-        boot.loader.grub.device = "/dev/sda";
-      }
+       <stockholm/makefu/2configs/hw/vbox-guest.nix>
+      #{ # until virtualbox-image is fixed
+      #  imports = [
+      #      <stockholm/makefu/2configs/fs/single-partition-ext4.nix>
+      #    ];
+      #  boot.loader.grub.device = lib.mkForce "/dev/sda";
+      #}
       <stockholm/makefu/2configs/main-laptop.nix>
       # <secrets/extra-hosts.nix>
 
diff --git a/makefu/1systems/shack-autoinstall/config.nix b/makefu/1systems/shack-autoinstall/config.nix
new file mode 100644
index 000000000..d53c411c0
--- /dev/null
+++ b/makefu/1systems/shack-autoinstall/config.nix
@@ -0,0 +1,49 @@
+{ config, pkgs, lib, ... }:
+
+with import <stockholm/lib>;
+let
+  disk = "/dev/sda";
+in {
+  imports = [
+    <stockholm/makefu>
+    <nixpkgs/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix>
+    <nixpkgs/nixos/modules/installer/cd-dvd/channel.nix>
+    <stockholm/makefu/2configs/tools/core.nix>
+  ];
+  # TODO: NIX_PATH and nix.nixPath are being set by default.nix right now
+  # cd ~/stockholm ; nix-build -A config.system.build.isoImage -I nixos-config=makefu/1systems/iso.nix -I secrets=/home/makefu/secrets/iso /var/src/nixpkgs/nixos
+  krebs.build.host = config.krebs.hosts.iso;
+  krebs.hidden-ssh.enable = true;
+
+  environment.extraInit = ''
+    EDITOR=vim
+  '';
+  # iso-specific
+  boot.kernelParams = [ "copytoram" ];
+
+
+  environment.systemPackages = [
+    pkgs.parted
+    (  pkgs.writeScriptBin "shack-install" ''
+      #! /bin/sh
+      echo "go ahead and try NIX_PATH=/root/.nix-defexpr/channels/ nixos-install"
+    '')
+  ];
+
+  systemd.services.wpa_supplicant.wantedBy = lib.mkForce [ "multi-user.target" ];
+
+  networking.wireless = {
+    enable = true;
+    networks.shack.psk = "welcome2shack";
+  };
+
+
+  services.openssh = {
+    enable = true;
+    hostKeys = [
+      { bits = 8192; type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
+    ];
+  };
+  # enable ssh in the iso boot process
+  systemd.services.sshd.wantedBy = lib.mkForce [ "multi-user.target" ];
+}
diff --git a/makefu/1systems/shack-autoinstall/grub-partition.sh b/makefu/1systems/shack-autoinstall/grub-partition.sh
new file mode 100644
index 000000000..c23c89799
--- /dev/null
+++ b/makefu/1systems/shack-autoinstall/grub-partition.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+set -euf
+parted -s ${disk} mklabel msdos
+parted -s ${disk} -- mkpart primary linux-swap 1M 4096M
+parted -s ${disk} -- mkpart primary ext2 4096M 100%
diff --git a/makefu/1systems/shack-autoinstall/shack-config.nix b/makefu/1systems/shack-autoinstall/shack-config.nix
new file mode 100644
index 000000000..9fa54ae32
--- /dev/null
+++ b/makefu/1systems/shack-autoinstall/shack-config.nix
@@ -0,0 +1,231 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    # TODO:
+  ];
+
+  # shacks-specific
+  networking.wireless = {
+    enable = true;
+    networks.shack.psk = "181471eb97eb23f12c6871227bc4a7b13c8f6af56dcc0d0e8b71f4d7a510cb4e";
+  };
+  networking.hostName = "shackbook";
+
+  boot.tmpOnTmpfs = true;
+
+  users.users.shack = {
+    createHome = true;
+    useDefaultShell = true;
+    home = "/home/shack";
+    uid = 9001;
+    packages = with pkgs;[
+      chromium
+      firefox
+    ];
+    extraGroups = [ "audio" "wheel"  ];
+    hashedPassword = "$6$KIxlQTLEnKl7cwC$LrmbwZ64Mlm7zqUUZ0EObPJMES3C0mQ6Sw7ynTuXzUo7d9EWg/k5XCGkDHMFvL/Pz19Awcv0knHB1j3dHT6fh/" ;
+  };
+
+  environment.variables = let
+    ca-bundle = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+  in {
+    EDITOR = lib.mkForce "vim";
+    CURL_CA_BUNDLE = ca-bundle;
+    GIT_SSL_CAINFO = ca-bundle;
+    SSL_CERT_FILE  = ca-bundle;
+  };
+
+  services.printing = {
+    enable = true;
+    # TODO: shack-printer
+  };
+
+
+  environment.systemPackages = with pkgs;[
+    parted
+    ddrescue
+    tmux
+    jq git gnumake htop rxvt_unicode.terminfo
+    (pkgs.vim_configurable.customize {
+      name = "vim";
+      vimrcConfig.customRC = ''
+      set nocompatible
+      syntax on
+      set list
+      set listchars=tab:▸\ 
+      "set list listchars=tab:>-,trail:.,extends:>
+
+      filetype off
+      filetype plugin indent on
+
+      colorscheme darkblue
+      set background=dark
+
+      set number
+      set relativenumber
+      set mouse=a
+      set ignorecase
+      set incsearch
+      set wildignore=*.o,*.obj,*.bak,*.exe,*.os
+      set textwidth=79
+      set shiftwidth=2
+      set expandtab
+      set softtabstop=2
+      set shiftround
+      set smarttab
+      set tabstop=2
+      set et
+      set autoindent
+      set backspace=indent,eol,start
+
+
+      inoremap <F1> <ESC>
+      nnoremap <F1> <ESC>
+      vnoremap <F1> <ESC>
+
+      nnoremap <F5> :UndotreeToggle<CR>
+      set undodir  =~/.vim/undo
+      set undofile
+      "maximum number of changes that can be undone
+      set undolevels=1000000
+      "maximum number lines to save for undo on a buffer reload
+      set undoreload=10000000
+
+      nnoremap <F2> :set invpaste paste?<CR>
+      set pastetoggle=<F2>
+      set showmode
+
+      set showmatch
+      set matchtime=3
+      set hlsearch
+
+      autocmd ColorScheme * highlight ExtraWhitespace ctermbg=red guibg=red
+
+
+      " save on focus lost
+      au FocusLost * :wa
+
+      autocmd BufRead *.json set filetype=json
+      au  BufNewFile,BufRead *.mustache set syntax=mustache
+
+      cnoremap SudoWrite w !sudo tee > /dev/null %
+
+      " create Backup/tmp/undo dirs
+      set backupdir=~/.vim/backup
+      set directory=~/.vim/tmp
+
+      function! InitBackupDir()
+        let l:parent = $HOME    . '/.vim/'
+        let l:backup = l:parent . 'backup/'
+        let l:tmpdir = l:parent . 'tmp/'
+        let l:undodir= l:parent . 'undo/'
+
+
+        if !isdirectory(l:parent)
+          call mkdir(l:parent)
+        endif
+        if !isdirectory(l:backup)
+          call mkdir(l:backup)
+        endif
+        if !isdirectory(l:tmpdir)
+          call mkdir(l:tmpdir)
+        endif
+        if !isdirectory(l:undodir)
+          call mkdir(l:undodir)
+        endif
+      endfunction
+      call InitBackupDir()
+
+      augroup Binary
+        " edit binaries in xxd-output, xxd is part of vim
+        au!
+        au BufReadPre  *.bin let &bin=1
+        au BufReadPost *.bin if &bin | %!xxd
+        au BufReadPost *.bin set ft=xxd | endif
+        au BufWritePre *.bin if &bin | %!xxd -r
+        au BufWritePre *.bin endif
+        au BufWritePost *.bin if &bin | %!xxd
+        au BufWritePost *.bin set nomod | endif
+      augroup END
+      '';
+      vimrcConfig.vam.knownPlugins = pkgs.vimPlugins;
+      vimrcConfig.vam.pluginDictionaries = [
+        { names = [ "undotree" ]; }
+        # vim-nix handles indentation better but does not perform sanity
+        { names = [ "vim-addon-nix" ]; ft_regex = "^nix\$"; }
+      ];
+    })
+
+  ];
+  programs.bash = {
+    enableCompletion = true;
+    interactiveShellInit = ''
+      HISTCONTROL='erasedups:ignorespace'
+      HISTSIZE=900001
+      HISTFILESIZE=$HISTSIZE
+      shopt -s checkhash
+      shopt -s histappend histreedit histverify<