summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authormakefu <github@syntax-fehler.de>2016-07-27 10:58:39 +0200
committermakefu <github@syntax-fehler.de>2016-07-27 10:58:39 +0200
commit041eeaa4c9924d571d6977112ed7f0ebf7d0791c (patch)
treebb58908e6113917096a476cadf98ee5065b0ca83
parent88a220f78825c1bfc60f0e885e02eacc0b7cd6a9 (diff)
parentb139155bee6006f21993f3b2b6bfd5adde6fff6f (diff)
Merge remote-tracking branch 'prism/master'
-rw-r--r--krebs/3modules/default.nix2
-rw-r--r--krebs/3modules/exim-smarthost.nix24
-rw-r--r--krebs/3modules/mv/default.nix41
-rw-r--r--krebs/3modules/nginx.nix10
-rw-r--r--krebs/3modules/power-action.nix (renamed from lass/3modules/power-action.nix)4
-rw-r--r--krebs/3modules/tv/default.nix2
-rw-r--r--krebs/4lib/default.nix1
-rw-r--r--krebs/5pkgs/exim/default.nix5
-rw-r--r--lass/1systems/helios.nix2
-rw-r--r--lass/2configs/buildbot-standalone.nix7
-rw-r--r--lass/2configs/downloading.nix14
-rw-r--r--lass/2configs/exim-smarthost.nix1
-rw-r--r--lass/2configs/git.nix2
-rw-r--r--lass/2configs/nixpkgs.nix2
-rw-r--r--lass/2configs/power-action.nix4
-rw-r--r--lass/2configs/repo-sync.nix3
-rw-r--r--lass/2configs/websites/domsen.nix43
-rw-r--r--lass/3modules/default.nix1
-rw-r--r--mv/1systems/stro.nix172
-rw-r--r--tv/1systems/alnus.nix1
-rw-r--r--tv/1systems/xu.nix5
-rw-r--r--tv/1systems/zu.nix37
-rw-r--r--tv/2configs/bash.nix37
-rw-r--r--tv/2configs/default.nix69
-rw-r--r--tv/2configs/exim-smarthost.nix2
-rw-r--r--tv/2configs/git.nix2
-rw-r--r--tv/2configs/hw/x220.nix3
-rw-r--r--tv/2configs/ssh.nix25
-rw-r--r--tv/2configs/sshd.nix16
-rw-r--r--tv/2configs/xdg.nix14
-rw-r--r--tv/2configs/xserver/default.nix3
-rw-r--r--tv/5pkgs/default.nix12
-rw-r--r--tv/5pkgs/ff/default.nix12
33 files changed, 406 insertions, 172 deletions
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index a38d2b227..9af42acc9 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -28,6 +28,7 @@ let
./on-failure.nix
./os-release.nix
./per-user.nix
+ ./power-action.nix
./Reaktor.nix
./realwallpaper.nix
./retiolum-bootstrap.nix
@@ -91,6 +92,7 @@ let
imp = lib.mkMerge [
{ krebs = import ./lass { inherit config lib; }; }
{ krebs = import ./makefu { inherit config lib; }; }
+ { krebs = import ./mv { inherit config lib; }; }
{ krebs = import ./shared { inherit config lib; }; }
{ krebs = import ./tv { inherit config lib; }; }
{
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
index aba6ee0b5..cfe2e5f04 100644
--- a/krebs/3modules/exim-smarthost.nix
+++ b/krebs/3modules/exim-smarthost.nix
@@ -2,6 +2,7 @@
with config.krebs.lib;
let
+ indent = replaceChars ["\n"] ["\n "];
cfg = config.krebs.exim-smarthost;
out = {
@@ -12,6 +13,11 @@ let
api = {
enable = mkEnableOption "krebs.exim-smarthost";
+ authenticators = mkOption {
+ type = types.attrsOf types.str;
+ default = {};
+ };
+
dkim = mkOption {
type = types.listOf (types.submodule ({ config, ... }: {
options = {
@@ -80,6 +86,16 @@ let
default = [];
};
+ ssl_cert = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ };
+
+ ssl_key = mkOption {
+ type = types.nullOr types.str;
+ default = null;
+ };
+
system-aliases = mkOption {
type = types.listOf (types.submodule ({
options = {
@@ -136,7 +152,9 @@ let
syslog_timestamp = false
syslog_duplication = false
- tls_advertise_hosts =
+ ${optionalString (cfg.ssl_cert != null) "tls_certificate = ${cfg.ssl_cert}"}
+ ${optionalString (cfg.ssl_key != null) "tls_privatekey = ${cfg.ssl_key}"}
+ tls_advertise_hosts =${optionalString (cfg.ssl_cert != null) " *"}
begin acl
@@ -257,6 +275,10 @@ let
begin rewrite
begin authenticators
+ ${concatStringsSep "\n" (mapAttrsToList (name: text: ''
+ ${name}:
+ ${indent text}
+ '') cfg.authenticators)}
'';
};
};
diff --git a/krebs/3modules/mv/default.nix b/krebs/3modules/mv/default.nix
new file mode 100644
index 000000000..dc47d8983
--- /dev/null
+++ b/krebs/3modules/mv/default.nix
@@ -0,0 +1,41 @@
+{ config, ... }:
+
+with config.krebs.lib;
+
+{
+ hosts = mapAttrs (_: setAttr "owner" config.krebs.users.mv) {
+ stro = {
+ cores = 4;
+ nets = {
+ retiolum = {
+ ip4.addr = "10.243.111.111";
+ ip6.addr = "42:0:0:0:0:0:111:111";
+ aliases = [
+ "stro.r"
+ "cgit.stro.r"
+ "stro.retiolum"
+ "cgit.stro.retiolum"
+ ];
+ tinc.pubkey = ''
+ -----BEGIN RSA PUBLIC KEY-----
+ MIIBCgKCAQEA0vIzLyoetOyi3R7qOh3gjSvUVjPEdqCvd0NEevDCIhhFy0nIbZ/b
+ vnuk3EUeTb6e384J8fKB4agig0JeR3JjtDvtjy5g9Cdy2nrU71w8wqU0etmv2PTb
+ FjbCFfeBXn0N3U7gXwjZGCvjAXa1a4jGb4R2iYBYGG3aY4reCN8B8Ah81h+S0oLg
+ ZJJfaBmWM5vNRFEI5X4CLaVnwtsoZuXIjYStgNn/9Mg/Y6NQS0H0H+HFeyhigAqG
+ oYGqNar/2QqPU176V/FwrD30F3qJV1uyzuPta7hmdfOxqYjZ/jqdPSRYtlunYYcq
+ XbH5oYmzO9NEeVWzjdac/DiV2OP8HufoYwIDAQAB
+ -----END RSA PUBLIC KEY-----
+ '';
+ };
+ };
+ ssh.privkey.path = <secrets/ssh.ed25519>;
+ ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+7Qa51l0NSkBiaK2s8vQEoeObV3UPZyEzMxfUK/ZAO root@stro";
+ };
+ };
+ users = {
+ mv = {
+ mail = "mv@stro.r";
+ pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDfMqkfXsGRaXJ86Pi5svAx4508ij5kc4cMLGwr1CLvFI5G7EHggiHMZYooibmkZimBF1PvLM1lOdoptJ4nSmc3UGuQaeV9BpZ1dNXexc8wOmVPKzAHYZG/2upcV/xVZQ9lk3UOmDym6fDUXThMx4nXdhOjScgWpKp7+0N3JRCf2UHusZjWFGlhE9l4irLFHCwlZeBQ16DNF4fc03vsfZBB1ZrGGZlaVpkcY+FTC3sm8R0iF5QGaq8PgltJoCNnp3L1g3Yn7Elva7kCHjZfJC1pu5icV8vZMNptPn1b10gPsNwb302FCjvZohzRcMo39L2gwdNWQmflYfYk+NPY9EgqkLtSvZJywYu8oTVLeYBAp0ZGzJR4+uIH9at/WQF499HFMxpF4uwYiQweUcPiHrrOqI5zLQoOvqh9Jv0UMsnFynNrszbCTgwzeW8bcvv8ILcjE9of8GXRCrlIMvt7Z9q8xrb5j1RhKscvusyyNOAL+HMZl6jgSxUBDtzRqPZ62QHJsBEBdRXdJRQLGeHNW9kGPrh/tiKGucuT3/HZC+2Rcemxt3RVT60+lHkghrMLi0/VOWBUKL9J94UK5xIE4Gb3RTW9DcNK53U4ql+N4ORSSEuhk3Rqzx3Bzv7AXpLKQCFKdB7tjxzGN7sCQM3PBUUo6Tk0VG2cIKOjzTRnDJlb7Q== mv@stro";
+ };
+ };
+}
diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix
index 25dfb5d6a..214f55018 100644
--- a/krebs/3modules/nginx.nix
+++ b/krebs/3modules/nginx.nix
@@ -31,12 +31,10 @@ let
options = {
server-names = mkOption {
type = with types; listOf str;
- # TODO use identity
- default = [
- "${config.networking.hostName}"
- "${config.networking.hostName}.r"
- "${config.networking.hostName}.retiolum"
- ];
+ default =
+ [config.krebs.build.host.name] ++
+ concatMap (getAttr "aliases")
+ (attrValues config.krebs.build.host.nets);
};
listen = mkOption {
type = with types; either str (listOf str);
diff --git a/lass/3modules/power-action.nix b/krebs/3modules/power-action.nix
index 30875c9a9..4c2533eb7 100644
--- a/lass/3modules/power-action.nix
+++ b/krebs/3modules/power-action.nix
@@ -3,10 +3,10 @@
with config.krebs.lib;
let
- cfg = config.lass.power-action;
+ cfg = config.krebs.power-action;
out = {
- options.lass.power-action = api;
+ options.krebs.power-action = api;
config = lib.mkIf cfg.enable imp;
};
diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index d04f1cab2..a933cbddb 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -418,7 +418,7 @@ with config.krebs.lib;
dv = {
mail = "dv@alnus.r";
};
- mv = {
+ mv-cd = {
mail = "mv@cd.r";
pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGer9e2+Lew7vnisgBbsFNECEIkpNJgEaqQqgb9inWkQ mv@vod";
};
diff --git a/krebs/4lib/default.nix b/krebs/4lib/default.nix
index 296748333..f62c033bd 100644
--- a/krebs/4lib/default.nix
+++ b/krebs/4lib/default.nix
@@ -33,6 +33,7 @@ let out = rec {
dir.has-default-nix = path: pathExists (path + "/default.nix");
genid = import ./genid.nix { lib = lib // out; };
+ genid_signed = x: ((genid x) + 16777216) / 2;
git = import ./git.nix { lib = lib // out; };
shell = import ./shell.nix { inherit lib; };
tree = import ./tree.nix { inherit lib; };
diff --git a/krebs/5pkgs/exim/default.nix b/krebs/5pkgs/exim/default.nix
index 0918e308d..835970555 100644
--- a/krebs/5pkgs/exim/default.nix
+++ b/krebs/5pkgs/exim/default.nix
@@ -1,4 +1,4 @@
-{ coreutils, fetchurl, db, openssl, pcre, perl, pkgconfig, stdenv }:
+{ coreutils, fetchurl, db, openssl, pam, pcre, perl, pkgconfig, stdenv }:
stdenv.mkDerivation rec {
name = "exim-4.87";
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
sha256 = "1jbxn13shq90kpn0s73qpjnx5xm8jrpwhcwwgqw5s6sdzw6iwsbl";
};
- buildInputs = [ coreutils db openssl pcre perl pkgconfig ];
+ buildInputs = [ coreutils db openssl pam pcre perl pkgconfig ];
preBuild = ''
sed '
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
s:^# \(SUPPORT_TLS\)=.*:\1=yes:
s:^# \(USE_OPENSSL_PC=openssl\)$:\1:
s:^# \(LOG_FILE_PATH=syslog\)$:\1:
+ s:^# \(SUPPORT_PAM\)=.*:\1=yes\nEXTRALIBS=-lpam:
s:^# \(HAVE_IPV6=yes\)$:\1:
s:^# \(CHOWN_COMMAND\)=.*:\1=${coreutils}/bin/chown:
s:^# \(CHGRP_COMMAND\)=.*:\1=${coreutils}/bin/chgrp:
diff --git a/lass/1systems/helios.nix b/lass/1systems/helios.nix
index 5f161d731..53026a6fb 100644
--- a/lass/1systems/helios.nix
+++ b/lass/1systems/helios.nix
@@ -58,7 +58,7 @@ with config.krebs.lib;
# };
#}
{
- lass.power-action.battery = "BAT1";
+ krebs.power-action.battery = "BAT1";
}
];
diff --git a/lass/2configs/buildbot-standalone.nix b/lass/2configs/buildbot-standalone.nix
index 5afb23687..7c7693ab7 100644
--- a/lass/2configs/buildbot-standalone.nix
+++ b/lass/2configs/buildbot-standalone.nix
@@ -3,8 +3,13 @@
with config.krebs.lib;
let
+ sshHostConfig = pkgs.writeText "ssh-config" ''
+ ControlMaster auto
+ ControlPath /tmp/%u_sshmux_%r@%h:%p
+ ControlPersist 4h
+ '';
sshWrapper = pkgs.writeDash "ssh-wrapper" ''
- ${pkgs.openssh}/bin/ssh -i ${shell.escape config.lass.build-ssh-privkey.path} "$@"
+ ${pkgs.openssh}/bin/ssh -F ${sshHostConfig} -i ${shell.escape config.lass.build-ssh-privkey.path} "$@"
'';
in {
diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix
index cf9b631c8..597d20721 100644
--- a/lass/2configs/downloading.nix
+++ b/lass/2configs/downloading.nix
@@ -5,9 +5,6 @@ with config.krebs.lib;
let
rpc-password = import <secrets/transmission-pw>;
in {
- imports = [
- ../3modules/folderPerms.nix
- ];
users.extraUsers = {
download = {
@@ -64,15 +61,4 @@ in {
{ predicate = "-p udp --dport 51413"; target = "ACCEPT"; }
];
};
-
- lass.folderPerms = {
- enable = true;
- permissions = [
- {
- path = "/var/download";
- permission = "775";
- owner = "transmission:download";
- }
- ];
- };
}
diff --git a/lass/2configs/exim-smarthost.nix b/lass/2configs/exim-smarthost.nix
index 1ba99c8cb..00a3612fd 100644
--- a/lass/2configs/exim-smarthost.nix
+++ b/lass/2configs/exim-smarthost.nix
@@ -27,7 +27,6 @@ with config.krebs.lib;
{ from = "lass@aidsballs.de"; to = lass.mail; }
{ from = "wordpress@ubikmedia.de"; to = lass.mail; }
{ from = "finanzamt@lassul.us"; to = lass.mail; }
- { from = "dominik@apanowicz.de"; to = "dma@ubikmedia.eu"; }
{ from = "netzclub@lassul.us"; to = lass.mail; }
{ from = "nebenan@lassul.us"; to = lass.mail; }
];
diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix
index 9a1cab176..ab4450715 100644
--- a/lass/2configs/git.nix
+++ b/lass/2configs/git.nix
@@ -80,7 +80,7 @@ let
perm = push "refs/*" [ non-fast-forward create delete merge ];
} ++
optional repo.public {
- user = [ tv makefu ];
+ user = attrValues config.krebs.users;
repo = [ repo ];
perm = fetch;
} ++
diff --git a/lass/2configs/nixpkgs.nix b/lass/2configs/nixpkgs.nix
index 931aabf08..b758bc24a 100644
--- a/lass/2configs/nixpkgs.nix
+++ b/lass/2configs/nixpkgs.nix
@@ -3,6 +3,6 @@
{
krebs.build.source.nixpkgs.git = {
url = https://github.com/lassulus/nixpkgs;
- ref = "11a7899222929b6eb0951f7a1c0182f65b3b4637";
+ ref = "c6ca9c8c8b7eb8f8e68868e36fb90e162adf080f";
};
}
diff --git a/lass/2configs/power-action.nix b/lass/2configs/power-action.nix
index 0ff8547c7..133966498 100644
--- a/lass/2configs/power-action.nix
+++ b/lass/2configs/power-action.nix
@@ -11,7 +11,7 @@ let
'';
in {
- lass.power-action = {
+ krebs.power-action = {
enable = true;
plans.low-battery = {
upperLimit = 30;
@@ -36,6 +36,6 @@ in {
];
security.sudo.extraConfig = ''
- ${config.lass.power-action.user.name} ALL= (root) NOPASSWD: ${suspend}
+ ${config.krebs.power-action.user.name} ALL= (root) NOPASSWD: ${suspend}
'';
}
diff --git a/lass/2configs/repo-sync.nix b/lass/2configs/repo-sync.nix
index 45a4e2afd..027f31fe0 100644
--- a/lass/2configs/repo-sync.nix
+++ b/lass/2configs/repo-sync.nix
@@ -91,12 +91,11 @@ in {
(sync-remote "repo-sync" "https://github.com/makefu/repo-sync")
(sync-remote "skytraq-datalogger" "https://github.com/makefu/skytraq-datalogger")
(sync-remote "xintmap" "https://github.com/4z3/xintmap")
+ (sync-remote "realwallpaper" "https://github.com/lassulus/realwallpaper")
(sync-remote-silent "nixpkgs" "https://github.com/nixos/nixpkgs")
(sync-retiolum "go")
(sync-retiolum "much")
(sync-retiolum "newsbot-js")
- (sync-retiolum "painload")
- (sync-retiolum "realwallpaper")
(sync-retiolum "stockholm")
(sync-retiolum "wai-middleware-time")
(sync-retiolum "web-routes-wai-custom")
diff --git a/lass/2configs/websites/domsen.nix b/lass/2configs/websites/domsen.nix
index 07df2e8de..becd1a872 100644
--- a/lass/2configs/websites/domsen.nix
+++ b/lass/2configs/websites/domsen.nix
@@ -110,14 +110,6 @@ in {
};
};
- users.users.domsen = {
- uid = genid "domsen";
- description = "maintenance acc for domsen";
- home = "/home/domsen";
- useDefaultShell = true;
- extraGroups = [ "nginx" ];
- createHome = true;
- };
#services.phpfpm.phpOptions = ''
# extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
@@ -133,5 +125,40 @@ in {
cat ${pkgs.php}/etc/php-recommended.ini > $out
echo "$options" >> $out
'';
+
+ # MAIL STUFF
+ # TODO: make into its own module
+ services.dovecot2 = {
+ enable = true;
+ mailLocation = "maildir:~/Mail";
+ };
+ krebs.iptables.tables.filter.INPUT.rules = [
+ { predicate = "-p tcp --dport pop3"; target = "ACCEPT"; }
+ { predicate = "-p tcp --dport imap"; target = "ACCEPT"; }
+ ];
+ krebs.exim-smarthost = {
+ internet-aliases = [
+ { from = "dominik@apanowicz.de"; to = "dma@ubikmedia.eu"; }
+ { from = "mail@jla-trading.com"; to = "jla-trading"; }
+ ];
+ system-aliases = [
+ ];
+ };
+
+ users.users.domsen = {
+ uid = genid "domsen";
+ description = "maintenance acc for domsen";
+ home = "/home/domsen";
+ useDefaultShell = true;
+ extraGroups = [ "nginx" ];
+ createHome = true;
+ };
+
+ users.users.jla-trading = {
+ uid = genid "jla-trading";
+ home = "/home/jla-trading";
+ useDefaultShell = true;
+ createHome = true;
+ };
}
diff --git a/lass/3modules/default.nix b/lass/3modules/default.nix
index 6a3b41ca4..60370b230 100644
--- a/lass/3modules/default.nix
+++ b/lass/3modules/default.nix
@@ -4,7 +4,6 @@ _:
./ejabberd
./folderPerms.nix
./mysql-backup.nix
- ./power-action.nix
./umts.nix
./urxvtd.nix
./wordpress_nginx.nix
diff --git a/mv/1systems/stro.nix b/mv/1systems/stro.nix
new file mode 100644
index 000000000..c948754df
--- /dev/null
+++ b/mv/1systems/stro.nix
@@ -0,0 +1,172 @@
+{ config, lib, pkgs, ... }:
+
+with config.krebs.lib;
+
+{
+ krebs = {
+ enable = true;
+ build = {
+ user = config.krebs.users.mv;
+ host = config.krebs.hosts.stro;
+ source = let
+ HOME = getEnv "HOME";
+ host = config.krebs.build.host;
+ in {
+ nixos-config.symlink = "stockholm/mv/1systems/${host.name}.nix";
+ secrets.file = "${HOME}/secrets/${host.name}";
+ stockholm.file = "${HOME}/stockholm";
+ nixpkgs.git = {
+ url = https://github.com/NixOS/nixpkgs;
+ ref = "8bf31d7d27cae435d7c1e9e0ccb0a320b424066f";
+ };
+ };
+ };
+ };
+
+ imports = [
+ <secrets>
+ <stockholm/krebs>
+ <stockholm/tv/2configs/audit.nix>
+ <stockholm/tv/2configs/bash.nix>
+ <stockholm/tv/2configs/exim-retiolum.nix>
+ <stockholm/tv/2configs/hw/x220.nix>
+ <stockholm/tv/2configs/im.nix>
+ <stockholm/tv/2configs/mail-client.nix>
+ <stockholm/tv/2configs/retiolum.nix>
+ <stockholm/tv/2configs/ssh.nix>
+ <stockholm/tv/2configs/sshd.nix>
+ <stockholm/tv/2configs/vim.nix>
+ <stockholm/tv/2configs/xdg.nix>
+ <stockholm/tv/2configs/xserver>
+ <stockholm/tv/3modules>
+ <stockholm/tv/5pkgs>
+ ];
+
+ boot.kernel.sysctl = {
+ # Enable IPv6 Privacy Extensions
+ "net.ipv6.conf.all.use_tempaddr" = 2;
+ "net.ipv6.conf.default.use_tempaddr" = 2;
+ };
+
+ boot.initrd.luks = {
+ cryptoModules = [ "aes" "sha512" "xts" ];
+ devices = [
+ {
+ name = "luks1";
+ device = "/dev/disk/by-id/ata-TOSHIBA-TR150_467B50JXK8WU-part2";
+ }
+ ];
+ };
+
+ environment = {
+ profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
+ shellAliases = mkForce {
+ gp = "${pkgs.pari}/bin/gp -q";
+ df = "df -h";
+ du = "du -h";
+ ls = "ls -h --color=auto --group-directories-first";
+ dmesg = "dmesg -L --reltime";
+ view = "vim -R";
+
+ reload = "systemctl reload";
+ restart = "systemctl restart";
+ start = "systemctl start";
+ status = "systemctl status";
+ stop = "systemctl stop";
+ };
+ systemPackages = with pkgs; [
+ dic
+ htop
+ p7zip
+ q
+
+ pavucontrol
+ rxvt_unicode.terminfo
+
+ # stockholm
+ git
+ gnumake
+ populate
+ ];
+ variables = {
+ NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src";
+ };
+ };
+
+ fileSystems = {
+ "/boot" = {
+ device = "/dev/disk/by-id/ata-TOSHIBA-TR150_467B50JXK8WU-part1";
+ };
+ "/" = {
+ device = "/dev/mapper/vg1-root";
+ fsType = "btrfs";
+ options = ["defaults" "noatime" "ssd" "compress=lzo"];
+ };
+ "/home" = {
+ device = "/dev/mapper/vg1-home";
+ fsType = "btrfs";
+ options = ["defaults" "noatime" "ssd" "compress=lzo"];
+ };
+ "/tmp" = {
+ device = "tmpfs";
+ fsType = "tmpfs";
+ options = ["nosuid" "nodev" "noatime"];
+ };
+ };
+
+ hardware.pulseaudio = {
+ enable = true;
+ systemWide = true;
+ };
+
+ networking.hostName = config.krebs.build.host.name;
+
+ nix = {
+ binaryCaches = ["https://cache.nixos.org"];
+ # TODO check if both are required:
+ chrootDirs = [ "/etc/protocols" pkgs.iana_etc.outPath ];
+ requireSignedBinaryCaches = true;
+ useChroot = true;
+ };
+
+ nixpkgs.config.allowUnfree = false;
+
+ users = {
+ defaultUserShell = "/run/current-system/sw/bin/bash";
+ mutableUsers = false;
+ users = {
+ mv = {
+ inherit (config.krebs.users.mv) home uid;
+ isNormalUser = true;
+ };
+ };
+ };
+
+ security.setuidPrograms = [
+ "sendmail"
+ ];
+
+ security.sudo.extraConfig = ''
+ Defaults env_keep+="SSH_CLIENT"
+ Defaults mailto="${config.krebs.users.mv.mail}"
+ Defaults !lecture
+ '';
+
+ services.cron.enable = false;
+ services.journald.extraConfig = ''
+ SystemMaxUse=1G
+ RuntimeMaxUse=128M
+ '';
+ services.nscd.enable = false;
+ services.ntp.enable = false;
+ services.timesyncd.enable = true;
+
+ time.timeZone = "Europe/Berlin";
+
+ tv.iptables = {
+ enable = true;
+ accept-echo-request = "internet";
+ };
+
+ system.stateVersion = "16.03";
+}
diff --git a/tv/1systems/alnus.nix b/tv/1systems/alnus.nix
index 360390c09..a9646b588 100644
--- a/tv/1systems/alnus.nix
+++ b/tv/1systems/alnus.nix
@@ -53,7 +53,6 @@ with config.krebs.lib;
};
hardware = {
- enableAllFirmware = true;
opengl.driSupport32Bit = true;
pulseaudio.enable = true;
};
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index b832470d0..fec0a02c5 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -155,11 +155,6 @@ with config.krebs.lib;
nixpkgs.config.chromium.enablePepperFlash = true;
- #hardware.bumblebee.enable = true;
- #hardware.bumblebee.group = "video";
- hardware.enableAllFirmware = true;
- #hardware.opengl.driSupport32Bit = true;
-
environment.systemPackages = with pkgs; [
ethtool
tinc_pre
diff --git a/tv/1systems/zu.nix b/tv/1systems/zu.nix
index bfc018cc3..c0d51436a 100644
--- a/tv/1systems/zu.nix
+++ b/tv/1systems/zu.nix
@@ -161,11 +161,6 @@ with config.krebs.lib;
nixpkgs.config.chromium.enablePepperFlash = true;
- #hardware.bumblebee.enable = true;
- #hardware.bumblebee.group = "video";
- hardware.enableAllFirmware = true;
- #hardware.opengl.driSupport32Bit = true;
-
environment.systemPackages = with pkgs; [
ethtool
tinc_pre
@@ -194,36 +189,4 @@ with config.krebs.lib;
# The NixOS release to be compatible with for stateful data such as databases.
system.stateVersion = "15.09";
-
-#/*
-#{ host api.doraemon.sg.zalora.net | awk '{print$4" api.zalora.sg"}';
-# host bob.live.sg.zalora.net | awk '{print$4" bob.zalora.sg"}';
-# host www.live.sg.zalora.net | awk '{print$4" www.zalora.sg costa.zalora.sg"}'; }
-#*/
-# networking.extraHosts = optionalString (1 == 1) ''
-#54.255.133.72 api.zalora.sg
-#52.77.12.194 bob.zalora.sg
-#52.74.232.49 www.zalora.sg costa.zalora.sg
-# '';
-
-
- #services.elasticsearch.enable = true;
- #services.kibana.enable = true;
- #services.logstash.enable = true;
-
- environment.etc."ssh/ssh_config".text = mkForce ''
- AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}
-
- ${optionalString config.programs.ssh.setXAuthLocation ''
- XAuthLocation ${pkgs.xorg.xauth}/bin/xauth
- ''}
-
- ForwardX11 ${if config.programs.ssh.forwardX11 then "yes" else "no"}
-
- # Allow DSA keys for now. (These were deprecated in OpenSSH 7.0.)
- #PubkeyAcceptedKeyTypes +ssh-dss
-
- ${config.programs.ssh.extraConfig}
- '';
-
}
diff --git a/tv/2configs/bash.nix b/tv/2configs/bash.nix
new file mode 100644
index 000000000..fe87aa8d7
--- /dev/null
+++ b/tv/2configs/bash.nix
@@ -0,0 +1,37 @@
+{ config, lib, pkgs, ... }:
+
+with config.krebs.lib;
+
+{
+ programs.bash = {
+ interactiveShellInit = ''
+ HISTCONTROL='erasedups:ignorespace'
+ HISTSIZE=65536
+ HISTFILESIZE=$HISTSIZE
+
+ shopt -s checkhash
+ shopt -s histappend histreedit histverify
+ shopt -s no_empty_cmd_completion
+ complete -d cd
+ '';
+ promptInit = ''
+ case $UID in
+ 0)
+ PS1='\[\e[1;31m\]\w\[\e[0m\] '
+ ;;
+ ${toString config.krebs.build.user.uid})
+ PS1='\[\e[1;32m\]\w\[\e[0m\] '
+ ;;
+ *)
+ PS1='\[\e[1;35m\]\u \[\e[1;32m\]\w\[\e[0m\] '
+ ;;
+ esac
+ if test -n "$SSH_CLIENT"; then
+ PS1='\[\e[35m\]\h'" $PS1"
+ fi
+ if test -n "$SSH_AGENT_PID"; then
+ PS1="ssh-agent[$SSH_AGENT_PID] $PS1"
+ fi
+ '';
+ };
+}
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 04009f54d..db1bfe5a2 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -14,7 +14,7 @@ with config.krebs.lib;
stockholm.file = "/home/tv/stockholm";
nixpkgs