summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authormakefu <github@syntax-fehler.de>2017-10-07 11:08:13 +0200
committermakefu <github@syntax-fehler.de>2017-10-07 11:08:13 +0200
commit8290c6507e500c1899f4a7d1184ef5b24c8132cb (patch)
tree91d64e1cc20647acce06f7f28da46b58e5dd2571
parent52f9105027a7c2d70145d7d2db69452e148b2158 (diff)
parenta8db051451d2827d7c7ad38f005284013e63c039 (diff)
Merge remote-tracking branch 'lass/master'
-rw-r--r--krebs/2configs/gitlab-runner-shackspace.nix27
-rw-r--r--krebs/2configs/ircd.nix1
-rw-r--r--krebs/2configs/shack/muell_caller.nix2
-rw-r--r--krebs/2configs/shack/radioactive.nix2
-rw-r--r--krebs/2configs/shack/worlddomination.nix2
-rw-r--r--krebs/3modules/bepasty-server.nix2
-rw-r--r--krebs/3modules/buildbot/slave.nix2
-rw-r--r--krebs/3modules/lass/default.nix14
-rw-r--r--krebs/3modules/lass/ssh/android.rsa2
-rw-r--r--krebs/3modules/tinc.nix6
-rw-r--r--krebs/5pkgs/simple/Reaktor/default.nix2
-rw-r--r--krebs/5pkgs/simple/bepasty-client-cli/default.nix2
-rw-r--r--krebs/5pkgs/simple/cac-panel/default.nix2
-rw-r--r--krebs/5pkgs/simple/treq/default.nix2
-rw-r--r--krebs/5pkgs/simple/urlwatch/default.nix2
-rw-r--r--krebs/source.nix2
-rw-r--r--lass/1systems/helios/config.nix14
-rw-r--r--lass/1systems/prism/config.nix7
-rw-r--r--lass/2configs/bepasty.nix1
-rw-r--r--lass/2configs/copyq.nix5
-rw-r--r--lass/2configs/dcso-vpn.nix44
-rw-r--r--lass/2configs/gc.nix2
-rw-r--r--lass/2configs/pass.nix3
-rw-r--r--lass/2configs/tests/dummy-secrets/dcsovpn/ca.pem0
-rw-r--r--lass/2configs/tests/dummy-secrets/dcsovpn/cert.key0
-rw-r--r--lass/2configs/tests/dummy-secrets/dcsovpn/cert.pem0
-rw-r--r--lass/2configs/tests/dummy-secrets/dcsovpn/login.txt0
-rw-r--r--lass/2configs/websites/lassulus.nix37
-rw-r--r--lass/2configs/websites/sqlBackup.nix3
-rw-r--r--lass/2configs/weechat.nix5
-rw-r--r--lass/2configs/wine.nix2
-rw-r--r--lass/3modules/ejabberd/config.nix218
-rw-r--r--lass/3modules/ejabberd/default.nix41
-rw-r--r--lass/5pkgs/default.nix3
-rw-r--r--lass/5pkgs/ejabberd/default.nix28
-rw-r--r--lass/5pkgs/xmonad-lass.nix26
-rw-r--r--lass/source.nix9
-rw-r--r--mv/source.nix4
-rw-r--r--tv/1systems/alnus/source.nix2
-rw-r--r--tv/1systems/mu/config.nix4
-rw-r--r--tv/2configs/br.nix1
-rw-r--r--tv/2configs/gitrepos.nix2
-rw-r--r--tv/5pkgs/default.nix10
-rw-r--r--tv/5pkgs/simple/mfcl2700dncupswrapper/default.nix45
-rw-r--r--tv/5pkgs/simple/mfcl2700dnlpr/default.nix44
-rw-r--r--tv/source.nix4
46 files changed, 320 insertions, 316 deletions
diff --git a/krebs/2configs/gitlab-runner-shackspace.nix b/krebs/2configs/gitlab-runner-shackspace.nix
index d9b4cd589..f4247b6da 100644
--- a/krebs/2configs/gitlab-runner-shackspace.nix
+++ b/krebs/2configs/gitlab-runner-shackspace.nix
@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, pkgs, ... }:
let
url = "https://git.shackspace.de/";
# generate token from CI-token via:
@@ -6,7 +6,7 @@ let
## cat /etc/gitlab-runner/config.toml
token = import <secrets/shackspace-gitlab-ci-token.nix> ;
in {
- systemd.services.gitlab-runner.path = [
+ systemd.services.gitlab-runner.path = [
"/run/wrappers" # /run/wrappers/bin/su
"/" # /bin/sh
];
@@ -16,19 +16,18 @@ in {
enable = true;
# configFile, configOptions and gracefulTimeout not yet in stable
# gracefulTimeout = "120min";
- configText = ''
- concurrent = 1
- check_interval = 0
-
- [[runners]]
- name = "krebs-shell"
- url = "${url}"
- token = "${token}"
- executor = "shell"
- shell = "sh"
- environment = ["PATH=/bin:/run/wrappers/bin:/etc/per-user/gitlab-runner/bin:/etc/per-user-pkgs/gitlab-runner/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin"]
- [runners.cache]
+ configFile = pkgs.writeText "gitlab-runner.cfg" ''
+ concurrent = 1
+ check_interval = 0
+ [[runners]]
+ name = "krebs-shell"
+ url = "${url}"
+ token = "${token}"
+ executor = "shell"
+ shell = "sh"
+ environment = ["PATH=/bin:/run/wrappers/bin:/etc/per-user/gitlab-runner/bin:/etc/per-user-pkgs/gitlab-runner/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin"]
+ [runners.cache]
'';
};
}
diff --git a/krebs/2configs/ircd.nix b/krebs/2configs/ircd.nix
index 116337733..38f58952e 100644
--- a/krebs/2configs/ircd.nix
+++ b/krebs/2configs/ircd.nix
@@ -92,6 +92,7 @@
};
general {
#maybe we want ident someday?
+ default_floodcount = 1000;
disable_auth = yes;
throttle_duration = 1;
throttle_count = 1000;
diff --git a/krebs/2configs/shack/muell_caller.nix b/krebs/2configs/shack/muell_caller.nix
index 7e8d278f6..19768cb2e 100644
--- a/krebs/2configs/shack/muell_caller.nix
+++ b/krebs/2configs/shack/muell_caller.nix
@@ -12,7 +12,7 @@ let
buildInputs = [
(pkgs.python3.withPackages (pythonPackages: with pythonPackages; [
docopt
- requests2
+ requests
paramiko
python
]))
diff --git a/krebs/2configs/shack/radioactive.nix b/krebs/2configs/shack/radioactive.nix
index 378b54056..566146d6e 100644
--- a/krebs/2configs/shack/radioactive.nix
+++ b/krebs/2configs/shack/radioactive.nix
@@ -12,7 +12,7 @@ let
buildInputs = [
(pkgs.python3.withPackages (pythonPackages: with pythonPackages; [
docopt
- requests2
+ requests
python
]))
];
diff --git a/krebs/2configs/shack/worlddomination.nix b/krebs/2configs/shack/worlddomination.nix
index d0f9f5fa6..828b6cd70 100644
--- a/krebs/2configs/shack/worlddomination.nix
+++ b/krebs/2configs/shack/worlddomination.nix
@@ -37,7 +37,7 @@ let
docopt
LinkHeader
aiocoap
- requests2
+ requests
paramiko
python
]))
diff --git a/krebs/3modules/bepasty-server.nix b/krebs/3modules/bepasty-server.nix
index 0ca13366b..dd29a4e17 100644
--- a/krebs/3modules/bepasty-server.nix
+++ b/krebs/3modules/bepasty-server.nix
@@ -3,7 +3,7 @@
with import <stockholm/lib>;
let
gunicorn = pkgs.pythonPackages.gunicorn;
- bepasty = pkgs.pythonPackages.bepasty-server;
+ bepasty = pkgs.bepasty;
gevent = pkgs.pythonPackages.gevent;
python = pkgs.pythonPackages.python;
cfg = config.krebs.bepasty;
diff --git a/krebs/3modules/buildbot/slave.nix b/krebs/3modules/buildbot/slave.nix
index 544f9c4e0..0af553c5d 100644
--- a/krebs/3modules/buildbot/slave.nix
+++ b/krebs/3modules/buildbot/slave.nix
@@ -160,6 +160,8 @@ let
# TODO: maybe also prepare buildbot.tac?
ExecStartPre = pkgs.writeDash "buildbot-master-init" ''
set -efux
+ #remove garbage from old versions
+ rm -r ${workdir}
mkdir -p ${workdir}/info
cp ${buildbot-slave-init} ${workdir}/buildbot.tac
echo ${contact} > ${workdir}/info/admin
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index 4b553fac2..534eac716 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -432,8 +432,13 @@ with import <stockholm/lib>;
eddie = {
ci = false;
external = true;
- nets = {
+ nets = rec {
+ internet = {
+ ip4.addr = "129.215.90.4";
+ aliases = [ "eddie.i" ];
+ };
retiolum = {
+ via = internet;
ip4.addr = "10.243.29.170";
ip6.addr = "42:4992:6a6d:700::1";
aliases = [ "eddie.r" ];
@@ -485,8 +490,13 @@ with import <stockholm/lib>;
inspector = {
ci = false;
external = true;
- nets = {
+ nets = rec {
+ internet = {
+ ip4.addr = "141.76.44.154";
+ aliases = [ "inspector.i" ];
+ };
retiolum = {
+ via = internet;
ip4.addr = "10.243.29.172";
ip6.addr = "42:4992:6a6d:800::1";
aliases = [ "inspector.r" ];
diff --git a/krebs/3modules/lass/ssh/android.rsa b/krebs/3modules/lass/ssh/android.rsa
index b39f7ce1e..f5190f45c 100644
--- a/krebs/3modules/lass/ssh/android.rsa
+++ b/krebs/3modules/lass/ssh/android.rsa
@@ -1 +1 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDjesiOnhpT9XgWZqw/64M5lVQg3q0k22BtMyCv+33sGX8VmfTyD11GuwSjNGf5WiswKLqFvYBQsHfDDtS3k0ZNTDncGw3Pbilm6QoCuHEyDPaQYin0P+JmkocrL/6QF5uhZVFnsXCH5wntwOa00VFGwpMgQYSfRlReRx42Pu9Jk+iJduZMRBbOMvJI68Z7iJ4DgW/1U9J4MQdCsk7QlFgUstQQfV1zk4VfVfXuxDP3hjx6Q05nDChjpmzJbFunzb7aiy/1/Sl0QhROTpvxrQLksg7yYLw4BRs9ptjehX45A2Sxi8WKOb/g5u3xJNy0X07rE+N+o5v2hS7wF0DLQdK5+4TGtO+Y+ABUCqqA+T1ynAjNBWvsgY5uD4PZjuPgCMSw0JBmIy/P0THi3v5/8Cohvfnspl7Jpf80qENMu3unvvE9EePzgSRZY1PvDjPQfkWy0yBX1yQMhHuVGke9QgaletitwuahRujml37waeUuOl8Rpz+2iV+6OIS4tfO368uLFHKWbobXTbTDXODBgxZ/IyvO7vxM2uDX/kIWaeYKrip3nSyWBYnixwrcS4vm6ZQcoejwp2KCfGQwIE4MnGYRlwcOEYjvyjLkZHDiZEivUQ0rThMYBzec8bQ08QW8oxF+NXkFKG3awt3f7TKTRkYqQcOMpFKmV24KDiwgwm0miQ== JuiceSSH
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEZgGgImN/9D4yJBjYlkAvT3X45kzt4n8hmgsqPcdcHWNC7fofWG4fZe8NNrTLdKsK+xYxTstj49l8Vb3YDvw4fAyyyhms/eFRlD2BRqAISwc39EIeTC4g3PXNeUtUGdczXKxsJf5iWf4kxUrUOuZ3FeKxeYXDMSqzzk1oKalhWNl4PmgRc5FzjeRJ2WziilwFq7ntLswoeTBW3c53fbcp3XuPza3M1/sN3NHJx9ZMpWVfJhZ/CXr+nqpc25ZIr5HZVZbgDTyJQimlTF5JCfU0NiiBIh7ep7x4o93tARmilit7+mWUkkxk6ba+zG6nr+s+zyd85AFAYRioOEczbC6mI44UZUB11KkEzOon5JWSA8pK+DPqsqhFkwWYMHLXZp8zemdp9kushRZ6nuI9MzBwacngro1vAvDL6jrS5MR7zf7rMAo6wexovWoEowvZz629mjC3OAt9iOm4VJdvEmq+rHLfjjznVEY6llF7DUu2QNEazaXhxZH9V9N1gyubIE97SQVqmwDrf8BGC0Hq+hC4OOweqfo4XP0etbqAfDozZbqcqyE1m9Bj8DpjrSXka1PuJf5fgEtoxPadd2qdiHMfIx9sM+4uu2nI5aFvWO3OlJmhF80QzNdFzZWjsyvJ24C1/a2FAyzoab1Sg9ljstQThseTtvlXcX8jfFn0U3RbgXgCgOWad3Oy9vA0OCdsHut0nzv3UO+T5+wv2+lvE3QSSKOlmVtdKMhCFb+Rg+FliKxyd820h9yR3wDYmkurVkAxaj8Kx5MaY/7aypOi8fRAV2FSDtCKkuMyPv4xEtdPi/4lj55pRBEO8lJkeb+WurCzZ7ZeaPdrW1YIQtToPpiz3dXeRhkts6jq8247xIplzHh9Iu18gOrnZ+ygn70g19x842vvcfLQNAghDPS93msJdSe+EtulMCwNTjUaF9LyzhW9ptLG9NmwgbT5kGsFiRw3BFdyfcQVWVzDhuP3hPPx+hjiZtFfpIKpxV9MjO1xQ830Ngk3JpSphMZTQ432yfvu9yEsUWmAa8ax1jxJ361AiIp0U2xioJmdVd3E2sxkpOUYqE89IR9X6hS3fH38Gc5IL5+BnhuZvRgXuA+nrqdU4pMB3TIoC5oXlOMRXpxaS91YiO4ERx2t6WkBRCoaDuRWnLpewV6lhjwi1+4Emlrs2q1R0K64emZTv7O1MKwWRHOlBJD3HLyCCS763OzYW4mEQcfBAQtbm6sTooJ+D/zbmYgbnZt0z/nP9R/n25pzlSPpZ49fCiRV7QN6D9mksISTz8qIiCzNBn1F7DUewXqkrdPopl4npeNVcOyyo7P1lFFGde+jq/7REdzD+vno1h9+17WZbyzQtlOyipQYzb6l4QuXq/zejJrELJAQdN4yRQq5NJzIh0HXaPnPC083T791moBflyqiwPEIWsSMfILqSqL1jVVNgvV4fHnMixgH2zK9f0EyE3fG9PnuRribPR2DlESqpHZTcBixgh660EPKh0gCLYoWKgU= lass-android@XperiaXCompact
diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix
index 8af15c13b..b032f3148 100644
--- a/krebs/3modules/tinc.nix
+++ b/krebs/3modules/tinc.nix
@@ -1,5 +1,5 @@
-{ config, pkgs, lib, ... }:
with import <stockholm/lib>;
+{ config, pkgs, ... }:
let
out = {
options.krebs.tinc = api;
@@ -11,7 +11,7 @@ let
description = ''
define a tinc network
'';
- type = with types; attrsOf (submodule (tinc: {
+ type = types.attrsOf (types.submodule (tinc: {
options = let
netname = tinc.config._module.args.name;
in {
@@ -116,7 +116,7 @@ let
phases = [ "installPhase" ];
installPhase = ''
mkdir $out
- ${concatStrings (lib.mapAttrsToList (_: host: ''
+ ${concatStrings (mapAttrsToList (_: host: ''
echo ${shell.escape host.nets."${tinc.config.netname}".tinc.config} \
> $out/${shell.escape host.name}
'') tinc.config.hosts)}
diff --git a/krebs/5pkgs/simple/Reaktor/default.nix b/krebs/5pkgs/simple/Reaktor/default.nix
index fc3710820..6989bb02b 100644
--- a/krebs/5pkgs/simple/Reaktor/default.nix
+++ b/krebs/5pkgs/simple/Reaktor/default.nix
@@ -8,7 +8,7 @@ python3Packages.buildPythonPackage rec {
propagatedBuildInputs = with pkgs;[
python3Packages.docopt
- python3Packages.requests2
+ python3Packages.requests
];
src = fetchurl {
url = "https://pypi.python.org/packages/source/R/Reaktor/Reaktor-${version}.tar.gz";
diff --git a/krebs/5pkgs/simple/bepasty-client-cli/default.nix b/krebs/5pkgs/simple/bepasty-client-cli/default.nix
index c58e637b3..7811ef5fc 100644
--- a/krebs/5pkgs/simple/bepasty-client-cli/default.nix
+++ b/krebs/5pkgs/simple/bepasty-client-cli/default.nix
@@ -5,7 +5,7 @@ with pythonPackages; buildPythonPackage rec {
propagatedBuildInputs = [
python_magic
click
- requests2
+ requests
];
src = fetchFromGitHub {
diff --git a/krebs/5pkgs/simple/cac-panel/default.nix b/krebs/5pkgs/simple/cac-panel/default.nix
index fd4799535..57f58f4de 100644
--- a/krebs/5pkgs/simple/cac-panel/default.nix
+++ b/krebs/5pkgs/simple/cac-panel/default.nix
@@ -11,7 +11,7 @@ python3Packages.buildPythonPackage rec {
propagatedBuildInputs = with python3Packages; [
docopt
- requests2
+ requests
beautifulsoup4
];
}
diff --git a/krebs/5pkgs/simple/treq/default.nix b/krebs/5pkgs/simple/treq/default.nix
index 20387b9cb..7cb826a51 100644
--- a/krebs/5pkgs/simple/treq/default.nix
+++ b/krebs/5pkgs/simple/treq/default.nix
@@ -11,7 +11,7 @@ pythonPackages.buildPythonPackage rec {
propagatedBuildInputs = with pythonPackages; [
twisted
pyopenssl
- requests2
+ requests
service-identity
];
}
diff --git a/krebs/5pkgs/simple/urlwatch/default.nix b/krebs/5pkgs/simple/urlwatch/default.nix
index 509555669..adaefbc4d 100644
--- a/krebs/5pkgs/simple/urlwatch/default.nix
+++ b/krebs/5pkgs/simple/urlwatch/default.nix
@@ -13,7 +13,7 @@ python3Packages.buildPythonPackage rec {
minidb
pycodestyle
pyyaml
- requests2
+ requests
];
meta = {
diff --git a/krebs/source.nix b/krebs/source.nix
index 1aba3d7ff..09edc817b 100644
--- a/krebs/source.nix
+++ b/krebs/source.nix
@@ -14,6 +14,6 @@ in
stockholm.file = toString <stockholm>;
nixpkgs.git = {
url = https://github.com/NixOS/nixpkgs;
- ref = "8ed299faacbf8813fc47b4fca34f32b835d6481e"; # nixos-17.03 @ 2017-09-09
+ ref = "07ca7b64d2ff2fa7a79e4eab1aba70ff746fed8c"; # nixos-17.09 @ 2017-10-02
};
}
diff --git a/lass/1systems/helios/config.nix b/lass/1systems/helios/config.nix
index 6ff3fbb86..a94bbd3e9 100644
--- a/lass/1systems/helios/config.nix
+++ b/lass/1systems/helios/config.nix
@@ -11,6 +11,7 @@ with import <stockholm/lib>;
<stockholm/lass/2configs/retiolum.nix>
<stockholm/lass/2configs/otp-ssh.nix>
<stockholm/lass/2configs/git.nix>
+ <stockholm/lass/2configs/dcso-vpn.nix>
{ # automatic hardware detection
boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
boot.kernelModules = [ "kvm-intel" ];
@@ -94,4 +95,17 @@ with import <stockholm/lib>;
programs.ssh.startAgent = lib.mkForce true;
services.tlp.enable = true;
+
+ services.xserver.videoDrivers = [ "nvidia" ];
+
+ security.pki.certificateFiles = [
+ (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAROOTC1G1.pem"; sha256 = "14vz9c0fk6li0a26vx0s5ha6y3yivnshx9pjlh9vmnpkbph5a7rh"; })
+ (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAROOTC2G1.pem"; sha256 = "0r1dd48a850cv7whk4g2maik550rd0vsrsl73r6x0ivzz7ap1xz5"; })
+ (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAROOTC3G1.pem"; sha256 = "0b5cdchdkvllnr0kz35d8jrmrf9cjw0kd98mmvzr0x6nkc8hwpdy"; })
+
+ (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCACOMPC2G1.pem"; sha256 = "0rn57zv1ry9vj4p2248mxmafmqqmdhbrfx1plszrxsphshbk2hfz"; })
+ (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCACOMPC3G1.pem"; sha256 = "0w88qaqhwxzvdkx40kzj2gka1yi85ipppjdkxah4mscwfhlryrnk"; })
+ (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAIDENC2G1.pem"; sha256 = "1z2qkyhgjvri13bvi06ynkb7mjmpcznmc9yw8chx1lnwc3cxa7kf"; })
+ (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAIDENC3G1.pem"; sha256 = "0smdjjvz95n652cb45yhzdb2lr83zg52najgbzf6lm3w71f8mv7f"; })
+ ];
}
diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index 5b3091a39..8e44b113b 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -115,7 +115,12 @@ in {
};
services.nginx.virtualHosts."hackerfleet.de-s" = {
serverName = "hackerfleet.de";
- port = 443;
+ listen = [
+ {
+ addr = "0.0.0.0";
+ port = 443;
+ }
+ ];
serverAliases = [
"*.hackerfleet.de"
];
diff --git a/lass/2configs/bepasty.nix b/lass/2configs/bepasty.nix
index b2d40d4f3..43647892f 100644
--- a/lass/2configs/bepasty.nix
+++ b/lass/2configs/bepasty.nix
@@ -31,7 +31,6 @@ in {
} //
genAttrs ext-doms (ext-dom: {
nginx = {
- enableSSL = true;
forceSSL = true;
enableACME = true;
};
diff --git a/lass/2configs/copyq.nix b/lass/2configs/copyq.nix
index b255254f2..fa01a99c9 100644
--- a/lass/2configs/copyq.nix
+++ b/lass/2configs/copyq.nix
@@ -25,12 +25,15 @@ in {
environment = {
DISPLAY = ":0";
};
+ path = with pkgs; [
+ qt5.full
+ ];
serviceConfig = {
SyslogIdentifier = "copyq";
ExecStart = "${pkgs.copyq}/bin/copyq";
ExecStartPost = copyqConfig;
Restart = "always";
- RestartSec = "2s";
+ RestartSec = "15s";
StartLimitBurst = 0;
User = "lass";
};
diff --git a/lass/2configs/dcso-vpn.nix b/lass/2configs/dcso-vpn.nix
new file mode 100644
index 000000000..0a5623bf0
--- /dev/null
+++ b/lass/2configs/dcso-vpn.nix
@@ -0,0 +1,44 @@
+with import <stockholm/lib>;
+{ ... }:
+
+{
+
+ users.extraUsers = {
+ dcsovpn = rec {
+ name = "dcsovpn";
+ uid = genid "dcsovpn";
+ description = "user for running dcso openvpn";
+ home = "/home/${name}";
+ };
+ };
+
+ users.extraGroups.dcsovpn.gid = genid "dcsovpn";
+
+ services.openvpn.servers = {
+ dcso = {
+ config = ''
+ client
+ dev tun
+ tun-mtu 1356
+ mssfix
+ proto udp
+ float
+ remote 217.111.55.41 1194
+ nobind
+ user dcsovpn
+ group dcsovpn
+ persist-key
+ persist-tun
+ ca ${toString <secrets/dcsovpn/ca.pem>}
+ cert ${toString <secrets/dcsovpn/cert.pem>}
+ key ${toString <secrets/dcsovpn/cert.key>}
+ verb 3
+ mute 20
+ auth-user-pass ${toString <secrets/dcsovpn/login.txt>}
+ route-method exe
+ route-delay 2
+ '';
+ updateResolvConf = true;
+ };
+ };
+}
diff --git a/lass/2configs/gc.nix b/lass/2configs/gc.nix
index 00f318e51..ad015180a 100644
--- a/lass/2configs/gc.nix
+++ b/lass/2configs/gc.nix
@@ -3,6 +3,6 @@
with import <stockholm/lib>;
{
nix.gc = {
- automatic = ! elem config.krebs.build.host.name [ "prism" "mors" ];
+ automatic = ! elem config.krebs.build.host.name [ "prism" "mors" "helios" ];
};
}
diff --git a/lass/2configs/pass.nix b/lass/2configs/pass.nix
index 5bd2f2f7f..1c253a6c5 100644
--- a/lass/2configs/pass.nix
+++ b/lass/2configs/pass.nix
@@ -3,7 +3,8 @@
{
krebs.per-user.lass.packages = with pkgs; [
pass
- gnupg1
+ gnupg
];
+ programs.gnupg.agent.enable = true;
}
diff --git a/lass/2configs/tests/dummy-secrets/dcsovpn/ca.pem b/lass/2configs/tests/dummy-secrets/dcsovpn/ca.pem
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/lass/2configs/tests/dummy-secrets/dcsovpn/ca.pem
diff --git a/lass/2configs/tests/dummy-secrets/dcsovpn/cert.key b/lass/2configs/tests/dummy-secrets/dcsovpn/cert.key
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/lass/2configs/tests/dummy-secrets/dcsovpn/cert.key
diff --git a/lass/2configs/tests/dummy-secrets/dcsovpn/cert.pem b/lass/2configs/tests/dummy-secrets/dcsovpn/cert.pem
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/lass/2configs/tests/dummy-secrets/dcsovpn/cert.pem
diff --git a/lass/2configs/tests/dummy-secrets/dcsovpn/login.txt b/lass/2configs/tests/dummy-secrets/dcsovpn/login.txt
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/lass/2configs/tests/dummy-secrets/dcsovpn/login.txt
diff --git a/lass/2configs/websites/lassulus.nix b/lass/2configs/websites/lassulus.nix
index 17c39a5f4..6e185a4d6 100644
--- a/lass/2configs/websites/lassulus.nix
+++ b/lass/2configs/websites/lassulus.nix
@@ -73,17 +73,6 @@ in {
allowKeysForGroup = true;
group = "lasscert";
};
- certs."cgit.lassul.us" = {
- email = "lassulus@gmail.com";
- webroot = "/var/lib/acme/acme-challenges";
- plugins = [
- "account_key.json"
- "key.pem"
- "fullchain.pem"
- ];
- group = "nginx";
- allowKeysForGroup = true;
- };
};
krebs.tinc_graphs.enable = true;
@@ -119,8 +108,8 @@ in {
];
services.nginx.virtualHosts."lassul.us" = {
+ addSSL = true;
enableACME = true;
- serverAliases = [ "lassul.us" ];
locations."/".extraConfig = ''
root /srv/http/lassul.us;
'';
@@ -158,30 +147,12 @@ in {
in ''
alias ${initscript};
'';
-
- enableSSL = true;
- extraConfig = ''
- listen 80;
- listen [::]:80;
- '';
- sslCertificate = "/var/lib/acme/lassul.us/fullchain.pem";
- sslCertificateKey = "/var/lib/acme/lassul.us/key.pem";
};
services.nginx.virtualHosts.cgit = {
- serverAliases = [
- "cgit.lassul.us"
- ];
- locations."/.well-known/acme-challenge".extraConfig = ''
- root /var/lib/acme/acme-challenges;
- '';
- enableSSL = true;
- extraConfig = ''
- listen 80;
- listen [::]:80;
- '';
- sslCertificate = "/var/lib/acme/cgit.lassul.us/fullchain.pem";
- sslCertificateKey = "/var/lib/acme/cgit.lassul.us/key.pem";
+ serverName = "cgit.lassul.us";
+ addSSL = true;
+ enableACME = true;
};
users.users.blog = {
diff --git a/lass/2configs/websites/sqlBackup.nix b/lass/2configs/websites/sqlBackup.nix
index 7cb4b320e..2fffa6cc9 100644
--- a/lass/2configs/websites/sqlBackup.nix
+++ b/lass/2configs/websites/sqlBackup.nix
@@ -3,12 +3,13 @@
{
krebs.secret.files.mysql_rootPassword = {
path = "${config.services.mysql.dataDir}/mysql_rootPassword";
- owner.name = "root";
+ owner.name = "mysql";
source-path = toString <secrets> + "/mysql_rootPassword";
};
services.mysql = {
enable = true;
+ dataDir = "/var