summaryrefslogtreecommitdiffstats
path: root/krebs
diff options
context:
space:
mode:
authormakefu <github@syntax-fehler.de>2019-04-12 19:28:17 +0200
committermakefu <github@syntax-fehler.de>2019-04-12 19:28:17 +0200
commit8bea69348ae0f286b395e9087db7d70e6f1a375a (patch)
tree956a2dfb39f0ca1bb00ba40bd21e18037f1093fb /krebs
parent179e95d0bfc985940d4970d6c1365c2c8e000d0d (diff)
parent72cd01d104bb61b5a5e28c2c10e0bd2bd55ce681 (diff)
Merge remote-tracking branch 'lass/master'
Diffstat (limited to 'krebs')
-rw-r--r--krebs/1systems/hotdog/config.nix1
-rw-r--r--krebs/3modules/default.nix1
-rw-r--r--krebs/3modules/lass/default.nix63
-rw-r--r--krebs/3modules/lass/ssh/android.rsa2
-rw-r--r--krebs/3modules/syncthing.nix161
-rw-r--r--krebs/5pkgs/haskell/blessings.nix4
-rw-r--r--krebs/5pkgs/haskell/email-header.nix5
-rw-r--r--krebs/5pkgs/simple/q-power_supply.nix126
-rw-r--r--krebs/nixpkgs.json6
-rwxr-xr-xkrebs/update-channel.sh2
10 files changed, 364 insertions, 7 deletions
diff --git a/krebs/1systems/hotdog/config.nix b/krebs/1systems/hotdog/config.nix
index 916073375..f68c8ce50 100644
--- a/krebs/1systems/hotdog/config.nix
+++ b/krebs/1systems/hotdog/config.nix
@@ -21,5 +21,4 @@
boot.isContainer = true;
networking.useDHCP = false;
- environment.variables.NIX_REMOTE = "daemon";
}
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 9c2f53cbe..567c077eb 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -48,6 +48,7 @@ let
./rtorrent.nix
./secret.nix
./setuid.nix
+ ./syncthing.nix
./tinc.nix
./tinc_graphs.nix
./urlwatch.nix
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index 630c14f18..a3b8cab39 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -106,6 +106,7 @@ in {
};
ssh.privkey.path = <secrets/ssh.id_ed25519>;
ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAsANFdMi825qWQXQbWLYuNZ6/fARt3lnh1KStQHQQMD";
+ syncthing.id = "QITFKYQ-VEPIPL2-AZIXHMD-BBT62ML-YHSB35A-BSUIBXS-QYMPFHW-M7XN2QU";
};
archprism = {
cores = 1;
@@ -204,6 +205,7 @@ in {
secure = true;
ssh.privkey.path = <secrets/ssh.id_ed25519>;
ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAMPlIG+6u75GJ3kvsPF6OoIZsU+u8ZQ+rdviv5fNMD";
+ syncthing.id = "ZPRS57K-YK32ROQ-7A6MRAV-VOYXQ3I-CQCXISZ-C5PCV2A-GSFLG3I-K7UGGAH";
};
shodan = {
cores = 2;
@@ -270,6 +272,7 @@ in {
secure = true;
ssh.privkey.path = <secrets/ssh.id_ed25519>;
ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOPgQIMYiyD4/Co+nlOQWEzCKssemOEXAY/lbIZZaMhj";
+ syncthing.id = "7V75LMM-MIFCAIZ-TAWR3AI-OXONVZR-TEW4GBK-URKPPN4-PQFG653-LGHPDQ4";
};
daedalus = {
cores = 2;
@@ -324,10 +327,18 @@ in {
-----END RSA PUBLIC KEY-----
'';
};
+ wiregrill = {
+ ip6.addr = w6 "5ce7";
+ aliases = [
+ "skynet.w"
+ ];
+ wireguard.pubkey = "pt9a6nP+YPqxnSskcM9NqRmAmFzbO5bE7wzViFFonnU=";
+ };
};
secure = true;
ssh.privkey.path = <secrets/ssh.id_ed25519>;
ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEB/MmASvx3i09DY1xFVM5jOhZRZA8rMRqtf8bCIkC+t";
+ syncthing.id = "KWGPAHH-H53Y2WL-SDAUVQE-7PMYRVP-6Q2INYB-FL535EO-HIE7425-ZCNP7A3";
};
littleT = {
cores = 2;
@@ -365,10 +376,18 @@ in {
-----END RSA PUBLIC KEY-----
'';
};
+ wiregrill = {
+ ip6.addr = w6 "771e";
+ aliases = [
+ "littleT.w"
+ ];
+ wireguard.pubkey = "VfSTPO1XGqLqujAGCov1yA0WxyRXJndZCW5XYkScNXg=";
+ };
};
secure = true;
ssh.privkey.path = <secrets/ssh.id_ed25519>;
ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJzb9BPFClubs6wSOi/ivqPFVPlowXwAxBS0jHaB29hX";
+ syncthing.id = "PCDXICO-GMGWKSB-V6CYF3I-LQMZSGV-B7YBJXA-DVO7KXN-TFCSQXW-XY6WNQD";
};
red = {
monitoring = false;
@@ -474,7 +493,48 @@ in {
};
ssh.privkey.path = <secrets/ssh.id_ed25519>;
ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSBxtPf8yJfzzI7/iYpoRSc/TT+zYmE/HM9XWS3MZlv";
+ syncthing.id = "J2LMIPD-PBEPVKL-A3MN6NQ-KL6DZ4N-K4GGWZB-E2EPLFN-PDLVAOC-DCSZHAD";
};
+
+ green = {
+ cores = 1;
+ nets = {
+ retiolum = {
+ ip4.addr = "10.243.0.66";
+ ip6.addr = r6 "12ee";
+ aliases = [
+ "green.r"
+ ];
+ tinc.pubkey = ''
+ -----BEGIN PUBLIC KEY-----
+ MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAwpgFxMxWQ0Cp3I82bLWk
+ uoDBjWqhM9Pgq6PJSpJjyNAgMkKJcQnWi0WpELaHISAVqjdPGUQSLiar++JN3YBx
+ ZQGFiucG0ijVJKAUbQQDYbc+RGK8MGO2v3Bv/6E56UKjxtT1zjjvkyXpSC7FN477
+ n9IfsvIzH/RLcAP5VnHBYqZ467UR4rqi7T7yWjrEgr+VirY9Opp9LM9YozlbRrlI
+ hYshk5RET/EvOSwYlw/KJEMMmYHro74neZKIVKoXD3CSE66rncNmdFwD3ZXVxYn6
+ m3Eob8ojWPW+CpAL2AurUyq4Igem9JVigZiyKGgaYsdkOWgkYLW2M0DXX+vCRcM6
+ BvJgJn7s0PHkLvybEVveTolRWO+I/IG1LN8m0SvrVPXf5JYHB32nKYwVMLwi+BQ1
+ pwo0USGByVRv2lWZfy3doKxow0ppilq4DwoT+iqVO4sK5YhPipBHSmCcaxlquHjy
+ 2k1eb0gYisp0LBjHlhTErXtt4RlrUqs/84RfgtIZYUowJfXbtEbyDmLIlESbY7qk
+ UlXIMXtY0sWpDivWwpdMj9kJdKlS09QTMeLYz4fFGXMksFmLijx8RKDOYfNWL7oA
+ udmEOHPzYzu/Ex8RfKJjD4GhWLDvDTcyXDG9vmuDNZGcPHANeg23sGhr5Hz37FRT
+ 3MVh92sFyMVYkJcL7SISk80CAwEAAQ==
+ -----END PUBLIC KEY-----
+ '';
+ };
+ wiregrill = {
+ ip6.addr = w6 "12ee";
+ aliases = [
+ "green.w"
+ ];
+ wireguard.pubkey = "lOORkStNJ6iP5ffqjHa/kWOxilJIMW4E6BEtNvNhLGk=";
+ };
+ };
+ ssh.privkey.path = <secrets/ssh.id_ed25519>;
+ ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH0wqzo7rMkyw6gqTGuUp8aUA0vtwj0HuuaTIkkOnA30 ";
+ syncthing.id = "CADHN7J-CWRCWTZ-3GZRLII-JBVZN4N-RGHDGDL-UTAJNYI-RZPHK55-7EYAWQM";
+ };
+
phone = {
nets = {
wiregrill = {
@@ -482,11 +542,12 @@ in {
aliases = [
"phone.w"
];
- wireguard.pubkey = "zVunBVOxsMETlnHkgjfH71HaZjjNUOeYNveAVv5z3jw=";
+ wireguard.pubkey = "MRicxap2VxPnzmXoOqqjQNGWJ54cQC8Tfy28+IXXsxM=";
};
};
external = true;
ci = false;
+ syncthing.id = "DUFMX7V-HNR6WXM-LZB5LJE-TM6QIOH-MTGHEUJ-QSD3XIY-YRFJLOR-G6Y3XQB";
};
morpheus = {
cores = 1;
diff --git a/krebs/3modules/lass/ssh/android.rsa b/krebs/3modules/lass/ssh/android.rsa
index 3d35b76e4..675ba8df2 100644
--- a/krebs/3modules/lass/ssh/android.rsa
+++ b/krebs/3modules/lass/ssh/android.rsa
@@ -1 +1 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOPH4c2zQCaCmus4T9GvaY1lrgVR9CKV3Fx1vRn1K1XB u0_a194@android
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPF7RHU4q6w1f3xWcfeAD6u23jDs2fd/H3IuxdT5G1ZL
diff --git a/krebs/3modules/syncthing.nix b/krebs/3modules/syncthing.nix
new file mode 100644
index 000000000..bfbac1db9
--- /dev/null
+++ b/krebs/3modules/syncthing.nix
@@ -0,0 +1,161 @@
+{ config, pkgs, ... }: with import <stockholm/lib>;
+
+let
+
+ cfg = config.krebs.syncthing;
+
+ devices = mapAttrsToList (name: peer: {
+ name = name;
+ deviceID = peer.id;
+ addresses = peer.addresses;
+ }) cfg.peers;
+
+ folders = map (folder: {
+ inherit (folder) path id type;
+ devices = map (peer: { deviceId = cfg.peers.${peer}.id; }) folder.peers;
+ rescanIntervalS = folder.rescanInterval;
+ fsWatcherEnabled = folder.watch;
+ fsWatcherDelayS = folder.watchDelay;
+ ignorePerms = folder.ignorePerms;
+ }) cfg.folders;
+
+ getApiKey = pkgs.writeDash "getAPIKey" ''
+ ${pkgs.libxml2}/bin/xmllint \
+ --xpath 'string(configuration/gui/apikey)'\
+ ${config.services.syncthing.dataDir}/config.xml
+ '';
+
+ updateConfig = pkgs.writeDash "merge-syncthing-config" ''
+ set -efu
+ # wait for service to restart
+ ${pkgs.untilport}/bin/untilport localhost 8384
+ API_KEY=$(${getApiKey})
+ CFG=$(${pkgs.curl}/bin/curl -Ss -H "X-API-Key: $API_KEY" localhost:8384/rest/system/config)
+ echo "$CFG" | ${pkgs.jq}/bin/jq -s '.[] * {
+ "devices": ${builtins.toJSON devices},
+ "folders": ${builtins.toJSON folders}
+ }' | ${pkgs.curl}/bin/curl -Ss -H "X-API-Key: $API_KEY" localhost:8384/rest/system/config -d @-
+ ${pkgs.curl}/bin/curl -Ss -H "X-API-Key: $API_KEY" localhost:8384/rest/system/restart -X POST
+ '';
+
+in
+
+{
+ options.krebs.syncthing = {
+
+ enable = mkEnableOption "syncthing-init";
+
+ id = mkOption {
+ type = types.str;
+ default = config.krebs.build.host.name;
+ };
+
+ cert = mkOption {
+ type = types.nullOr types.absolute-pathname;
+ default = null;
+ };
+
+ key = mkOption {
+ type = types.nullOr types.absolute-pathname;
+ default = null;
+ };
+
+ peers = mkOption {
+ default = {};
+ type = types.attrsOf (types.submodule ({
+ options = {
+
+ # TODO make into addr + port submodule
+ addresses = mkOption {
+ type = types.listOf types.str;
+ default = [];
+ };
+
+ #TODO check
+ id = mkOption {
+ type = types.str;
+ };
+
+ };
+ }));
+ };
+
+ folders = mkOption {
+ default = [];
+ type = types.listOf (types.submodule ({ config, ... }: {
+ options = {
+
+ path = mkOption {
+ type = types.absolute-pathname;
+ };
+
+ id = mkOption {
+ type = types.str;
+ default = config.path;
+ };
+
+ peers = mkOption {
+ type = types.listOf types.str;
+ default = [];
+ };
+
+ rescanInterval = mkOption {
+ type = types.int;
+ default = 3600;
+ };
+
+ type = mkOption {
+ type = types.enum [ "sendreceive" "sendonly" "receiveonly" ];
+ default = "sendreceive";
+ };
+
+ watch = mkOption {
+ type = types.bool;
+ default = true;
+ };
+
+ watchDelay = mkOption {
+ type = types.int;
+ default = 10;
+ };
+
+ ignorePerms = mkOption {
+ type = types.bool;
+ default = true;
+ };
+
+ };
+ }));
+ };
+ };
+
+ config = (mkIf cfg.enable) {
+
+ systemd.services.syncthing = mkIf (cfg.cert != null || cfg.key != null) {
+ preStart = ''
+ ${optionalString (cfg.cert != null) ''
+ cp ${toString cfg.cert} ${config.services.syncthing.dataDir}/cert.pem
+ chown ${config.services.syncthing.user}:${config.services.syncthing.group} ${config.services.syncthing.dataDir}/cert.pem
+ chmod 400 ${config.services.syncthing.dataDir}/cert.pem
+ ''}
+ ${optionalString (cfg.key != null) ''
+ cp ${toString cfg.key} ${config.services.syncthing.dataDir}/key.pem
+ chown ${config.services.syncthing.user}:${config.services.syncthing.group} ${config.services.syncthing.dataDir}/key.pem
+ chmod 400 ${config.services.syncthing.dataDir}/key.pem
+ ''}
+ '';
+ };
+
+ systemd.services.syncthing-init = {
+ after = [ "syncthing.service" ];
+ wantedBy = [ "multi-user.target" ];
+
+ serviceConfig = {
+ User = config.services.syncthing.user;
+ RemainAfterExit = true;
+ Type = "oneshot";
+ ExecStart = updateConfig;
+ };
+ };
+ };
+}
diff --git a/krebs/5pkgs/haskell/blessings.nix b/krebs/5pkgs/haskell/blessings.nix
index f730cc72b..c35706ebf 100644
--- a/krebs/5pkgs/haskell/blessings.nix
+++ b/krebs/5pkgs/haskell/blessings.nix
@@ -10,6 +10,10 @@ with import <stockholm/lib>;
version = "2.2.0";
sha256 = "1pb56dgf3jj2kq3cbbppwzyg3ccgqy9xara62hkjwyxzdx20clk1";
};
+ "19.03" = {
+ version = "2.2.0";
+ sha256 = "1pb56dgf3jj2kq3cbbppwzyg3ccgqy9xara62hkjwyxzdx20clk1";
+ };
}.${versions.majorMinor nixpkgsVersion};
in mkDerivation {
diff --git a/krebs/5pkgs/haskell/email-header.nix b/krebs/5pkgs/haskell/email-header.nix
index 4049168c1..6689f1d2c 100644
--- a/krebs/5pkgs/haskell/email-header.nix
+++ b/krebs/5pkgs/haskell/email-header.nix
@@ -15,6 +15,11 @@ with import <stockholm/lib>;
rev = "refs/tags/v${cfg.version}";
sha256 = "11xjivpj495r2ss9aqljnpzzycb57cm4sr7yzmf939rzwsd3ib0x";
};
+ "19.03" = {
+ version = "0.4.1-tv1";
+ rev = "refs/tags/v${cfg.version}";
+ sha256 = "11xjivpj495r2ss9aqljnpzzycb57cm4sr7yzmf939rzwsd3ib0x";
+ };
}.${versions.majorMinor nixpkgsVersion};
in mkDerivation {
diff --git a/krebs/5pkgs/simple/q-power_supply.nix b/krebs/5pkgs/simple/q-power_supply.nix
new file mode 100644
index 000000000..87f900194
--- /dev/null
+++ b/krebs/5pkgs/simple/q-power_supply.nix
@@ -0,0 +1,126 @@
+{ gawk, gnused, writeDashBin }:
+
+writeDashBin "q-power_supply" ''
+ power_supply() {(
+ set -efu
+ uevent=$1
+ eval "$(${gnused}/bin/sed -n '
+ s/^\([A-Z_]\+=[0-9A-Za-z_-]*\)$/export \1/p
+ ' $uevent)"
+ case $POWER_SUPPLY_NAME in
+ AC)
+ exit # not battery
+ ;;
+ esac
+ exec </dev/null
+ exec ${gawk}/bin/awk '
+ function die(s) {
+ printf "%s: %s\n", name, s
+ exit 1
+ }
+
+ function print_hm(h, m) {
+ m = (h - int(h)) * 60
+ return sprintf("%dh%dm", h, m)
+ }
+
+ function print_bar(n, r, t1, t2, t_col) {
+ t1 = int(r * n)
+ t2 = n - t1
+ if (r >= .42) t_col = "1;32"
+ else if (r >= 23) t_col = "1;33"
+ else if (r >= 11) t_col = "1;31"
+ else t_col = "5;1;31"
+ return sgr(t_col) strdup("■", t1) sgr(";30") strdup("■", t2) sgr()
+ }
+
+ function sgr(p) {
+ return "\x1b[" p "m"
+ }
+
+ function strdup(s,n,t) {
+ t = sprintf("%"n"s","")
+ gsub(/ /,s,t)
+ return t
+ }
+
+ END {
+ name = ENVIRON["POWER_SUPPLY_NAME"]
+
+ charge_unit = "Ah"
+ charge_now = ENVIRON["POWER_SUPPLY_CHARGE_NOW"] / 10^6
+ charge_full = ENVIRON["POWER_SUPPLY_CHARGE_FULL"] / 10^6
+
+ current_unit = "A"
+ current_now = ENVIRON["POWER_SUPPLY_CURRENT_NOW"] / 10^6
+
+ energy_unit = "Wh"
+ energy_now = ENVIRON["POWER_SUPPLY_ENERGY_NOW"] / 10^6
+ energy_full = ENVIRON["POWER_SUPPLY_ENERGY_FULL"] / 10^6
+
+ power_unit = "W"
+ power_now = ENVIRON["POWER_SUPPLY_POWER_NOW"] / 10^6
+
+ voltage_unit = "V"
+ voltage_now = ENVIRON["POWER_SUPPLY_VOLTAGE_NOW"] / 10^6
+ voltage_min_design = ENVIRON["POWER_SUPPLY_VOLTAGE_MIN_DESIGN"] / 10^6
+
+ #printf "charge_now: %s\n", charge_now
+ #printf "charge_full: %s\n", charge_full
+ #printf "current_now: %s\n", current_now
+ #printf "energy_now: %s\n", energy_now
+ #printf "energy_full: %s\n", energy_full
+ #printf "energy_full: %s\n", ENVIRON["POWER_SUPPLY_ENERGY_FULL"]
+ #printf "energy_full: %s\n", ENVIRON["POWER_SUPPLY_ENERGY_FULL"] / 10^6
+ #printf "power_now: %s\n", power_now
+ #printf "voltage_now: %s\n", voltage_now
+
+ if (current_now == 0 && voltage_now != 0) {
+ current_now = power_now / voltage_now
+ }
+ if (power_now == 0) {
+ power_now = current_now * voltage_now
+ }
+ if (charge_now == 0 && voltage_min_design != 0) {
+ charge_now = energy_now / voltage_min_design
+ }
+ if (energy_now == 0) {
+ energy_now = charge_now * voltage_min_design
+ }
+ if (charge_full == 0 && voltage_min_design != 0) {
+ charge_full = energy_full / voltage_min_design
+ }
+ if (energy_full == 0) {
+ energy_full = charge_full * voltage_min_design
+ }
+
+ if (charge_now == 0 || charge_full == 0) {
+ die("unknown charge")
+ }
+
+ charge_ratio = charge_now / charge_full
+
+ out = out name
+ out = out sprintf(" %s", print_bar(10, charge_ratio))
+ out = out sprintf(" %d%", charge_ratio * 100)
+ out = out sprintf(" %.2f%s", charge_now, charge_unit)
+ if (current_now != 0) {
+ out = out sprintf("/%.1f%s", current_now, current_unit)
+ }
+ out = out sprintf(" %d%s", energy_full, energy_unit)
+ if (power_now != 0) {
+ out = out sprintf("/%.1f%s", power_now, power_unit)
+ }
+ if (current_now != 0) {
+ out = out sprintf(" %s", print_hm(charge_now / current_now))
+ }
+
+ print out
+ }
+ '
+ )}
+
+ for uevent in /sys/class/power_supply/*/uevent; do
+ power_supply "$uevent" || :
+ done
+''
diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json
index 28c98ceb2..de6403bd0 100644
--- a/krebs/nixpkgs.json
+++ b/krebs/nixpkgs.json
@@ -1,7 +1,7 @@
{
"url": "https://github.com/NixOS/nixpkgs-channels",
- "rev": "8abca4bc7b8b313c6e3073d074d623d1095c0dba",
- "date": "2019-03-07T09:54:51+01:00",
- "sha256": "1qhhlqkwzxwhq8ga4n7p4zg4nrhl79m6x4qd0pgaic6n4z5m82gr",
+ "rev": "5c52b25283a6cccca443ffb7a358de6fe14b4a81",
+ "date": "2019-04-09T21:48:56+02:00",
+ "sha256": "0fhbl6bgabhi1sw1lrs64i0hibmmppy1bh256lq8hxy3a2p1haip",
"fetchSubmodules": false
}
diff --git a/krebs/update-channel.sh b/krebs/update-channel.sh
index 7f24cd31a..08354357a 100755
--- a/krebs/update-channel.sh
+++ b/krebs/update-channel.sh
@@ -3,7 +3,7 @@ dir=$(dirname $0)
oldrev=$(cat $dir/nixpkgs.json | jq -r .rev | sed 's/\(.\{7\}\).*/\1/')
nix-shell -p nix-prefetch-git --run 'nix-prefetch-git \
--url https://github.com/NixOS/nixpkgs-channels \
- --rev refs/heads/nixos-18.09' \
+ --rev refs/heads/nixos-19.03' \
> $dir/nixpkgs.json
newrev=$(cat $dir/nixpkgs.json | jq -r .rev | sed 's/\(.\{7\}\).*/\1/')
git commit $dir/nixpkgs.json -m "nixpkgs: $oldrev -> $newrev"