Merge branch 'staging/source'

64 files changed, 403 insertions, 282 deletions

diff --git a/Makefile b/Makefile
index cab53d52a..e35aa89bc 100644
--- a/Makefile
+++ b/Makefile
@@ -12,7 +12,7 @@ export STOCKHOLM_VERSION ?= $(shell \
 system ?= $(HOSTNAME)
 $(if $(system),,$(error unbound variable: system))
 
-nixos-config ?= $(stockholm)/$(LOGNAME)/1systems/$(system).nix
+nixos-config ?= $(stockholm)/$(LOGNAME)/1systems/$(system)/config.nix
 ifneq ($(words $(wildcard $(nixos-config))),1)
 $(error bad nixos-config: $(nixos-config))
 endif
diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix
index 976d378f9..904deb164 100644
--- a/krebs/3modules/build.nix
+++ b/krebs/3modules/build.nix
@@ -14,16 +14,9 @@ with import <stockholm/lib>;
       default = "/nix/var/nix/profiles/system";
     };
 
-    source = mkOption {
-      type = types.attrsOf types.source;
-      default = {};
-    };
-
     # TODO deprecate krebs.build.user
     user = mkOption {
       type = types.user;
     };
   };
-
-  config.krebs.build.source.stockholm.file = mkDefault (toString <stockholm>);
 }
diff --git a/krebs/5pkgs/simple/whatsupnix/whatsupnix.bash b/krebs/5pkgs/simple/whatsupnix/whatsupnix.bash
index 2ad9aadc9..e21e0f1b3 100644
--- a/krebs/5pkgs/simple/whatsupnix/whatsupnix.bash
+++ b/krebs/5pkgs/simple/whatsupnix/whatsupnix.bash
@@ -14,15 +14,30 @@
 #
 #   1     Usage error; arguments couldn't be parsed.
 #
-#   2     Build error; at least one failed derivation could be found.
+#   2     Nix error; input looks like Nix failed.
+#
+#   3     Build error; at least one failed derivation could be found.
 #
 
-failed_drvs=$(mktemp --tmpdir whatsupnix.XXXXXXXX)
-trap 'rm -f -- "$failed_drvs"' EXIT
+tmpdir=$(mktemp -d --tmpdir whatsupnix.XXXXXXXX)
+failed_drvs=$tmpdir/failed_drvs; touch "$failed_drvs"
+nix_errors=$tmpdir/nix_errors; touch "$nix_errors"
+cleanup() {
+  rm "$failed_drvs"
+  rm "$nix_errors"
+  rmdir "$tmpdir"
+}
+trap cleanup EXIT
 
 exec >&2
 
-gawk -v failed_drvs="$failed_drvs" '
+gawk \
+    -v failed_drvs="$failed_drvs" \
+    -v nix_errors="$nix_errors" \
+'
+  /^(\033\[31;1m)?error:/ {
+    print $0 >> nix_errors
+  }
   match($0, /^builder for ‘(\/nix\/store\/[^’]+\.drv)’ failed/, m) {
     print m[1] >> failed_drvs
   }
@@ -73,8 +88,10 @@ while read -r drv; do
   echo
 done < "$failed_drvs"
 
-if test -s "$failed_drvs"; then
+if test -s "$nix_errors"; then
   exit 2
+elif test -s "$failed_drvs"; then
+  exit 3
 else
   exit 0
 fi
diff --git a/lass/1systems/cloudkrebs.nix b/lass/1systems/cloudkrebs/config.nix
index e65b13d00..aa9a1f1ab 100644
--- a/lass/1systems/cloudkrebs.nix
+++ b/lass/1systems/cloudkrebs/config.nix
@@ -1,18 +1,17 @@
 { config, lib, pkgs, ... }:
 
 let
-  inherit (import ../4lib { inherit pkgs lib; }) getDefaultGateway;
-
+  inherit (import <stockholm/lass/4lib> { inherit pkgs lib; }) getDefaultGateway;
   ip = config.krebs.build.host.nets.internet.ip4.addr;
 in {
   imports = [
-    ../.
-    ../2configs/retiolum.nix
-    ../2configs/os-templates/CAC-CentOS-7-64bit.nix
-    ../2configs/exim-retiolum.nix
-    ../2configs/git.nix
-    ../2configs/realwallpaper.nix
-    ../2configs/privoxy-retiolum.nix
+    <stockholm/lass>
+    <stockholm/lass/2configs/retiolum.nix>
+    <stockholm/lass/2configs/os-templates/CAC-CentOS-7-64bit.nix>
+    <stockholm/lass/2configs/exim-retiolum.nix>
+    <stockholm/lass/2configs/git.nix>
+    <stockholm/lass/2configs/realwallpaper.nix>
+    <stockholm/lass/2configs/privoxy-retiolum.nix>
     {
       networking.interfaces.enp2s1.ip4 = [
         {
diff --git a/lass/1systems/cloudkrebs/source.nix b/lass/1systems/cloudkrebs/source.nix
new file mode 100644
index 000000000..99e71e755
--- /dev/null
+++ b/lass/1systems/cloudkrebs/source.nix
@@ -0,0 +1,3 @@
+import <stockholm/lass/source.nix> {
+  name = "cloudkrebs";
+}
diff --git a/lass/1systems/dishfire.nix b/lass/1systems/dishfire/config.nix
index e12367aca..416edeb82 100644
--- a/lass/1systems/dishfire.nix
+++ b/lass/1systems/dishfire/config.nix
@@ -2,11 +2,10 @@
 
 {
   imports = [
-    ../.
-    ../2configs/retiolum.nix
+    <stockholm/lass>
+    <stockholm/lass/2configs/retiolum.nix>
     <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
-    #../2configs/exim-retiolum.nix
-    ../2configs/git.nix
+    <stockholm/lass/2configs/git.nix>
     {
       boot.loader.grub = {
         device = "/dev/vda";
@@ -56,7 +55,7 @@
     }
     {
       imports = [
-        ../2configs/websites/fritz.nix
+        <stockholm/lass/2configs/websites/fritz.nix>
       ];
       krebs.iptables.tables.filter.INPUT.rules = [
          { predicate = "-p tcp --dport http"; target = "ACCEPT"; }
diff --git a/lass/1systems/dishfire/source.nix b/lass/1systems/dishfire/source.nix
new file mode 100644
index 000000000..2445af130
--- /dev/null
+++ b/lass/1systems/dishfire/source.nix
@@ -0,0 +1,3 @@
+import <stockholm/lass/source.nix> {
+  name = "dishfire";
+}
diff --git a/lass/1systems/echelon.nix b/lass/1systems/echelon/config.nix
index da8864011..f064a4788 100644
--- a/lass/1systems/echelon.nix
+++ b/lass/1systems/echelon/config.nix
@@ -1,22 +1,20 @@
 { config, lib, pkgs, ... }:
 
 let
-  inherit (import ../4lib { inherit pkgs lib; }) getDefaultGateway;
-
+  inherit (import <stockholm/lass/4lib> { inherit pkgs lib; }) getDefaultGateway;
   ip = config.krebs.build.host.nets.internet.ip4.addr;
 in {
   imports = [
-    ../.
-    ../2configs/retiolum.nix
-    ../2configs/os-templates/CAC-CentOS-7-64bit.nix
-    ../2configs/exim-retiolum.nix
-    ../2configs/realwallpaper.nix
-    ../2configs/privoxy-retiolum.nix
-    ../2configs/git.nix
-    #../2configs/redis.nix
-    ../2configs/go.nix
-    ../2configs/ircd.nix
-    ../2configs/newsbot-js.nix
+    <stockholm/lass>
+    <stockholm/lass/2configs/retiolum.nix>
+    <stockholm/lass/2configs/os-templates/CAC-CentOS-7-64bit.nix>
+    <stockholm/lass/2configs/exim-retiolum.nix>
+    <stockholm/lass/2configs/realwallpaper.nix>
+    <stockholm/lass/2configs/privoxy-retiolum.nix>
+    <stockholm/lass/2configs/git.nix>
+    <stockholm/lass/2configs/go.nix>
+    <stockholm/lass/2configs/ircd.nix>
+    <stockholm/lass/2configs/newsbot-js.nix>
     {
       networking.interfaces.enp2s1.ip4 = [
         {
@@ -34,9 +32,6 @@ in {
       sound.enable = false;
     }
     {
-      imports = [
-        ../3modules/dnsmasq.nix
-      ];
       lass.dnsmasq = {
         enable = true;
         config = ''
diff --git a/lass/1systems/echelon/source.nix b/lass/1systems/echelon/source.nix
new file mode 100644
index 000000000..96888d5a8
--- /dev/null
+++ b/lass/1systems/echelon/source.nix
@@ -0,0 +1,3 @@
+import <stockholm/lass/source.nix> {
+  name = "echelon";
+}
diff --git a/lass/1systems/icarus.nix b/lass/1systems/icarus/config.nix
index 13c517e3b..791ce0f46 100644
--- a/lass/1systems/icarus.nix
+++ b/lass/1systems/icarus/config.nix
@@ -1,19 +1,18 @@
 { config, pkgs, ... }:
 
-with import <stockholm/lib>;
 {
   imports = [
-    ../.
-    ../2configs/retiolum.nix
-    ../2configs/hw/tp-x220.nix
-    ../2configs/git.nix
-    ../2configs/exim-retiolum.nix
-    ../2configs/baseX.nix
-    ../2configs/browsers.nix
-    ../2configs/programs.nix
-    ../2configs/fetchWallpaper.nix
-    ../2configs/backups.nix
-    ../2configs/games.nix
+    <stockholm/lass>
+    <stockholm/lass/2configs/retiolum.nix>
+    <stockholm/lass/2configs/hw/tp-x220.nix>
+    <stockholm/lass/2configs/git.nix>
+    <stockholm/lass/2configs/exim-retiolum.nix>
+    <stockholm/lass/2configs/baseX.nix>
+    <stockholm/lass/2configs/browsers.nix>
+    <stockholm/lass/2configs/programs.nix>
+    <stockholm/lass/2configs/fetchWallpaper.nix>
+    <stockholm/lass/2configs/backups.nix>
+    <stockholm/lass/2configs/games.nix>
   ];
 
   krebs.build.host = config.krebs.hosts.icarus;
diff --git a/lass/1systems/icarus/source.nix b/lass/1systems/icarus/source.nix
new file mode 100644
index 000000000..5b46a44f3
--- /dev/null
+++ b/lass/1systems/icarus/source.nix
@@ -0,0 +1,4 @@
+import <stockholm/lass/source.nix> {
+  name = "icarus";
+  secure = true;
+}
diff --git a/lass/1systems/iso.nix b/lass/1systems/iso.nix
index b45d5b228..820ef74b8 100644
--- a/lass/1systems/iso.nix
+++ b/lass/1systems/iso.nix
@@ -4,12 +4,11 @@ with import <stockholm/lib>;
 {
   imports = [
     <nixpkgs/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix>
-    ../../krebs
-    ../3modules
-    ../5pkgs
-    ../2configs/mc.nix
-    ../2configs/nixpkgs.nix
-    ../2configs/vim.nix
+    <stockholm/krebs>
+    <stockholm/lass/3modules>
+    <stockholm/lass/5pkgs>
+    <stockholm/lass/2configs/mc.nix>
+    <stockholm/lass/2configs/vim.nix>
     {
       # /dev/stderr doesn't work. I don't know why
       # /proc/self doesn't seem to work correctly
diff --git a/lass/1systems/mors.nix b/lass/1systems/mors/config.nix
index 0bfd54515..bb0a4e23e 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors/config.nix
@@ -3,28 +3,27 @@
 with import <stockholm/lib>;
 {
   imports = [
-    ../.
-    ../2configs/retiolum.nix
-    ../2configs/hw/tp-x220.nix
-    ../2configs/baseX.nix
-    ../2configs/exim-retiolum.nix
-    ../2configs/programs.nix
-    ../2configs/bitcoin.nix
-    ../2configs/browsers.nix
-    ../2configs/games.nix
-    ../2configs/pass.nix
-    ../2configs/elster.nix
-    ../2configs/steam.nix
-    ../2configs/wine.nix
-    ../2configs/git.nix
-    ../2configs/virtualbox.nix
-    ../2configs/fetchWallpaper.nix
-    #../2configs/c-base.nix
-    ../2configs/mail.nix
-    ../2configs/repo-sync.nix
-    ../2configs/ircd.nix
-    ../2configs/logf.nix
-    ../2configs/syncthing.nix
+    <stockholm/lass>
+    <stockholm/lass/2configs/retiolum.nix>
+    <stockholm/lass/2configs/hw/tp-x220.nix>
+    <stockholm/lass/2configs/baseX.nix>
+    <stockholm/lass/2configs/exim-retiolum.nix>
+    <stockholm/lass/2configs/programs.nix>
+    <stockholm/lass/2configs/bitcoin.nix>
+    <stockholm/lass/2configs/browsers.nix>
+    <stockholm/lass/2configs/games.nix>
+    <stockholm/lass/2configs/pass.nix>
+    <stockholm/lass/2configs/elster.nix>
+    <stockholm/lass/2configs/steam.nix>
+    <stockholm/lass/2configs/wine.nix>
+    <stockholm/lass/2configs/git.nix>
+    <stockholm/lass/2configs/virtualbox.nix>
+    <stockholm/lass/2configs/fetchWallpaper.nix>
+    <stockholm/lass/2configs/mail.nix>
+    <stockholm/lass/2configs/repo-sync.nix>
+    <stockholm/lass/2configs/ircd.nix>
+    <stockholm/lass/2configs/logf.nix>
+    <stockholm/lass/2configs/syncthing.nix>
     {
       #risk of rain port
       krebs.iptables.tables.filter.INPUT.rules = [
diff --git a/lass/1systems/mors/source.nix b/lass/1systems/mors/source.nix
new file mode 100644
index 000000000..a9dfa2eb6
--- /dev/null
+++ b/lass/1systems/mors/source.nix
@@ -0,0 +1,4 @@
+import <stockholm/lass/source.nix> {
+  name = "mors";
+  secure = true;
+}
diff --git a/lass/1systems/prism.nix b/lass/1systems/prism/config.nix
index 531dec9df..9faa4d473 100644
--- a/lass/1systems/prism.nix
+++ b/lass/1systems/prism/config.nix
@@ -4,13 +4,9 @@ with import <stockholm/lib>;
 let
   ip = config.krebs.build.host.nets.internet.ip4.addr;
 
-  inherit (import <stockholm/lass/2configs/websites/util.nix> {inherit lib pkgs;})
-    manageCerts
-  ;
-
 in {
   imports = [
-    ../.
+    <stockholm/lass>
     {
       networking.interfaces.et0.ip4 = [
         {
@@ -26,33 +22,33 @@ in {
         SUBSYSTEM=="net", ATTR{address}=="54:04:a6:7e:f4:06", NAME="et0"
       '';
     }
-    ../2configs/retiolum.nix
-    ../2configs/exim-smarthost.nix
-    ../2configs/downloading.nix
-    ../2configs/ts3.nix
-    ../2configs/bitlbee.nix
-    ../2configs/weechat.nix
-    ../2configs/privoxy-retiolum.nix
-    ../2configs/radio.nix
-    ../2configs/buildbot-standalone.nix
-    ../2configs/repo-sync.nix
-    ../2configs/binary-cache/server.nix
-    ../2configs/iodined.nix
-    ../2configs/libvirt.nix
-    ../2configs/hfos.nix
-    ../2configs/makefu-sip.nix
-    ../2configs/monitoring/server.nix
-    ../2configs/monitoring/monit-alarms.nix
-    ../2configs/paste.nix
-    ../2configs/syncthing.nix
-    ../2configs/coders-irc.nix
-    ../2configs/ciko.nix
+    <stockholm/lass/2configs/retiolum.nix>
+    <stockholm/lass/2configs/exim-smarthost.nix>
+    <stockholm/lass/2configs/downloading.nix>
+    <stockholm/lass/2configs/ts3.nix>
+    <stockholm/lass/2configs/bitlbee.nix>
+    <stockholm/lass/2configs/weechat.nix>
+    <stockholm/lass/2configs/privoxy-retiolum.nix>
+    <stockholm/lass/2configs/radio.nix>
+    <stockholm/lass/2configs/buildbot-standalone.nix>
+    <stockholm/lass/2configs/repo-sync.nix>
+    <stockholm/lass/2configs/binary-cache/server.nix>
+    <stockholm/lass/2configs/iodined.nix>
+    <stockholm/lass/2configs/libvirt.nix>
+    <stockholm/lass/2configs/hfos.nix>
+    <stockholm/lass/2configs/makefu-sip.nix>
+    <stockholm/lass/2configs/monitoring/server.nix>
+    <stockholm/lass/2configs/monitoring/monit-alarms.nix>
+    <stockholm/lass/2configs/paste.nix>
+    <stockholm/lass/2configs/syncthing.nix>
+    <stockholm/lass/2configs/coders-irc.nix>
+    <stockholm/lass/2configs/ciko.nix>
     {
       lass.pyload.enable = true;
     }
     {
       imports = [
-        ../2configs/bepasty.nix
+        <stockholm/lass/2configs/bepasty.nix>
       ];
       krebs.bepasty.servers."paste.r".nginx.extraConfig = ''
         if ( $server_addr = "${config.krebs.build.host.nets.internet.ip4.addr}" ) {
@@ -170,8 +166,8 @@ in {
     }
     {
       imports = [
-        ../2configs/websites/domsen.nix
-        ../2configs/websites/lassulus.nix
+        <stockholm/lass/2configs/websites/domsen.nix>
+        <stockholm/lass/2configs/websites/lassulus.nix>
       ];
       krebs.iptables.tables.filter.INPUT.rules = [
          { predicate = "-p tcp --dport http"; target = "ACCEPT"; }
@@ -195,7 +191,7 @@ in {
     }
     {
       imports = [
-        ../2configs/realwallpaper.nix
+        <stockholm/lass/2configs/realwallpaper.nix>
       ];
       services.nginx.virtualHosts."lassul.us".locations."/wallpaper.png".extraConfig = ''
         alias /var/realwallpaper/realwallpaper.png;
diff --git a/lass/1systems/prism/source.nix b/lass/1systems/prism/source.nix
new file mode 100644
index 000000000..557fbf509
--- /dev/null
+++ b/lass/1systems/prism/source.nix
@@ -0,0 +1,3 @@
+import <stockholm/lass/source.nix> {
+  name = "prism";
+}
diff --git a/lass/1systems/shodan.nix b/lass/1systems/shodan/config.nix
index 044e2ccf8..a68471aa0 100644
--- a/lass/1systems/shodan.nix
+++ b/lass/1systems/shodan/config.nix
@@ -3,17 +3,17 @@
 with import <stockholm/lib>;
 {
   imports = [
-    ../.
-    ../2configs/retiolum.nix
-    ../2configs/hw/tp-x220.nix
-    ../2configs/baseX.nix
-    ../2configs/git.nix
-    ../2configs/exim-retiolum.nix
-    ../2configs/browsers.nix
-    ../2configs/programs.nix
-    ../2configs/fetchWallpaper.nix
-    ../2configs/backups.nix
-    ../2configs/wine.nix
+    <stockholm/lass>
+    <stockholm/lass/2configs/retiolum.nix>
+    <stockholm/lass/2configs/hw/tp-x220.nix>
+    <stockholm/lass/2configs/baseX.nix>
+    <stockholm/lass/2configs/git.nix>
+    <stockholm/lass/2configs/exim-retiolum.nix>
+    <stockholm/lass/2configs/browsers.nix>
+    <stockholm/lass/2configs/programs.nix>
+    <stockholm/lass/2configs/fetchWallpaper.nix>
+    <stockholm/lass/2configs/backups.nix>
+    <stockholm/lass/2configs/wine.nix>
     #{
     #  users.extraUsers = {
     #    root = {
diff --git a/lass/1systems/shodan/source.nix b/lass/1systems/shodan/source.nix
new file mode 100644
index 000000000..be24ae2d5
--- /dev/null
+++ b/lass/1systems/shodan/source.nix
@@ -0,0 +1,3 @@
+import <stockholm/lass/source.nix> {
+  name = "shodan";
+}
diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel/config.nix
index b84fec317..70bef9883 100644
--- a/lass/1systems/uriel.nix
+++ b/