Merge remote-tracking branch 'origin/staging/jeschli'

33 files changed, 581 insertions, 539 deletions

diff --git a/lass/2configs/AP.nix b/lass/2configs/AP.nix
new file mode 100644
index 000000000..dfffbfdf9
--- /dev/null
+++ b/lass/2configs/AP.nix
@@ -0,0 +1,83 @@
+{ config, pkgs, ... }:
+with import <stockholm/lib>;
+let
+  wifi = "wlp0s29u1u2";
+in {
+  boot.extraModulePackages = [
+    pkgs.linuxPackages.rtl8814au
+  ];
+  networking.networkmanager.unmanaged = [ wifi "et0" ];
+
+  systemd.services.hostapd = {
+    description = "hostapd wireless AP";
+    path = [ pkgs.hostapd ];
+    wantedBy = [ "network.target" ];
+
+    after = [ "${wifi}-cfg.service" "nat.service" "bind.service" "dhcpd.service" "sys-subsystem-net-devices-${wifi}.device" ];
+
+    serviceConfig = {
+      ExecStart = "${pkgs.hostapd}/bin/hostapd ${pkgs.writeText "hostapd.conf" ''
+        interface=${wifi}
+        hw_mode=a
+        channel=36
+        ieee80211d=1
+        country_code=DE
+        ieee80211n=1
+        ieee80211ac=1
+        wmm_enabled=1
+
+        # 5ghz
+        ssid=krebsing
+        auth_algs=1
+        wpa=2
+        wpa_key_mgmt=WPA-PSK
+        rsn_pairwise=CCMP
+        wpa_passphrase=aidsballz
+      ''}";
+      Restart = "always";
+    };
+  };
+
+  networking.bridges.br0.interfaces = [
+    wifi
+    "et0"
+  ];
+
+  networking.interfaces.br0.ipv4.addresses = [
+    { address = "10.99.0.1"; prefixLength = 24; }
+  ];
+  services.dhcpd4 = {
+    enable = true;
+    interfaces = [ "br0" ];
+    extraConfig = ''
+      option subnet-mask 255.255.255.0;
+      option routers 10.99.0.1;
+      option domain-name-servers 1.1.1.1, 8.8.8.8;
+      subnet 10.99.0.0 netmask 255.255.255.0 {
+        range 10.99.0.100 10.99.0.200;
+      }
+    '';
+  };
+
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+  krebs.iptables.tables.filter.FORWARD.rules = [
+    { v6 = false; predicate = "-d 10.99.0.0/24 -o br0 -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
+    { v6 = false; predicate = "-s 10.99.0.0/24 -i br0"; target = "ACCEPT"; }
+    { v6 = false; predicate = "-i br0 -o br0"; target = "ACCEPT"; }
+    { v6 = false; predicate = "-i br0 -o br0"; target = "ACCEPT"; }
+    { v6 = false; predicate = "-o br0"; target = "REJECT --reject-with icmp-port-unreachable"; }
+    { v6 = false; predicate = "-i br0"; target = "REJECT --reject-with icmp-port-unreachable"; }
+  ];
+  krebs.iptables.tables.nat.PREROUTING.rules = [
+    { v6 = false; predicate = "-s 10.99.0.0/24"; target = "ACCEPT"; precedence = 1000; }
+  ];
+  krebs.iptables.tables.nat.POSTROUTING.rules = [
+    #TODO find out what this is about?
+    { v6 = false; predicate = "-s 10.99.0.0/24 -d 224.0.0.0/24"; target = "RETURN"; }
+    { v6 = false; predicate = "-s 10.99.0.0/24 -d 255.255.255.255"; target = "RETURN"; }
+
+    { v6 = false; predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24"; target = "MASQUERADE"; }
+    { v6 = false; predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24 -p tcp"; target = "MASQUERADE --to-ports 1024-65535"; }
+    { v6 = false; predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24 -p udp"; target = "MASQUERADE --to-ports 1024-65535"; }
+  ];
+}
diff --git a/lass/2configs/IM.nix b/lass/2configs/IM.nix
deleted file mode 100644
index 7d3dfd428..000000000
--- a/lass/2configs/IM.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-with (import <stockholm/lib>);
-{ config, lib, pkgs, ... }:
-
-let
-  tmux = pkgs.writeDash "tmux" ''
-    exec ${pkgs.tmux}/bin/tmux -f ${pkgs.writeText "tmux.conf" ''
-      set-option -g prefix `
-      unbind-key C-b
-      bind ` send-prefix
-
-      set-option -g status off
-      set-option -g default-terminal screen-256color
-
-      #use session instead of windows
-      bind-key c new-session
-      bind-key p switch-client -p
-      bind-key n switch-client -n
-      bind-key C-s switch-client -l
-    ''} "$@"
-  '';
-in {
-
-  services.bitlbee = {
-    enable = true;
-    portNumber = 6666;
-    plugins = [
-      pkgs.bitlbee-facebook
-      pkgs.bitlbee-steam
-      pkgs.bitlbee-discord
-    ];
-    libpurple_plugins = [ pkgs.telegram-purple ];
-  };
-
-  users.extraUsers.chat = {
-    home = "/home/chat";
-    uid = genid "chat";
-    useDefaultShell = true;
-    createHome = true;
-    openssh.authorizedKeys.keys = with config.krebs.users; [
-      lass.pubkey
-      lass-shodan.pubkey
-      lass-icarus.pubkey
-      lass-android.pubkey
-      lass-helios.pubkey
-    ];
-  };
-
-  # mosh
-  krebs.iptables.tables.filter.INPUT.rules = [
-    { predicate = "-p udp --dport 60000:61000"; target = "ACCEPT";}
-    { predicate = "-p tcp --dport 9999"; target = "ACCEPT";}
-  ];
-
-  systemd.services.chat = {
-    description = "chat environment setup";
-    after = [ "network.target" ];
-    wantedBy = [ "multi-user.target" ];
-
-    restartIfChanged = false;
-
-    path = [
-      pkgs.rxvt_unicode.terminfo
-    ];
-
-    serviceConfig = {
-      User = "chat";
-      RemainAfterExit = true;
-      Type = "oneshot";
-      ExecStart = "${tmux} -2 new-session -d -s IM ${pkgs.weechat}/bin/weechat";
-      ExecStop = "${tmux} kill-session -t IM";
-    };
-  };
-}
diff --git a/lass/2configs/backup.nix b/lass/2configs/backup.nix
new file mode 100644
index 000000000..d23cf9a43
--- /dev/null
+++ b/lass/2configs/backup.nix
@@ -0,0 +1,21 @@
+{ config, lib, ... }:
+with import <stockholm/lib>;
+
+{
+  fileSystems = {
+    "/backups" = {
+      device = "/dev/pool/backup";
+      fsType = "ext4";
+    };
+  };
+  users.users.backup = {
+    useDefaultShell = true;
+    home = "/backups";
+    createHome = true;
+    openssh.authorizedKeys.keys = with config.krebs.hosts; [
+      mors.ssh.pubkey
+      prism.ssh.pubkey
+      blue.ssh.pubkey
+    ];
+  };
+}
diff --git a/lass/2configs/backups.nix b/lass/2configs/backups.nix
deleted file mode 100644
index c4fb85420..000000000
--- a/lass/2configs/backups.nix
+++ /dev/null
@@ -1,173 +0,0 @@
-{ config, lib, ... }:
-with import <stockholm/lib>;
-{
-
-  # TODO add timerConfig to krebs.backup and randomize startup
-  # TODO define plans more abstract
-  krebs.backup.plans = {
-  } // mapAttrs (_: recursiveUpdate {
-    snapshots = {
-      daily    = { format = "%Y-%m-%d"; retain =  7; };
-      weekly   = { format = "%YW%W";    retain =  4; };
-      monthly  = { format = "%Y-%m";    retain = 12; };
-      yearly   = { format = "%Y";                    };
-    };
-  }) {
-    dishfire-http-prism = {
-      method = "pull";
-      src = { host = config.krebs.hosts.dishfire; path = "/srv/http"; };
-      dst = { host = config.krebs.hosts.prism;    path = "/bku/dishfire-http"; };
-      startAt = "03:00";
-    };
-    dishfire-http-icarus = {
-      method = "pull";
-      src = { host = config.krebs.hosts.dishfire; path = "/srv/http"; };
-      dst = { host = config.krebs.hosts.icarus;   path = "/bku/dishfire-http"; };
-      startAt = "03:10";
-    };
-    dishfire-http-mors = {
-      method = "pull";
-      src = { host = config.krebs.hosts.dishfire; path = "/srv/http"; };
-      dst = { host = config.krebs.hosts.mors;     path = "/bku/dishfire-http"; };
-      startAt = "03:05";
-    };
-    dishfire-http-shodan = {
-      method = "pull";
-      src = { host = config.krebs.hosts.dishfire; path = "/srv/http"; };
-      dst = { host = config.krebs.hosts.shodan;   path = "/bku/dishfire-http"; };
-      startAt = "03:10";
-    };
-    dishfire-sql-prism = {
-      method = "pull";
-      src = { host = config.krebs.hosts.dishfire; path = "/bku/sql_dumps"; };
-      dst = { host = config.krebs.hosts.prism;    path = "/bku/dishfire-sql"; };
-      startAt = "03:15";
-    };
-    dishfire-sql-icarus = {
-      method = "pull";
-      src = { host = config.krebs.hosts.dishfire; path = "/bku/sql_dumps"; };
-      dst = { host = config.krebs.hosts.icarus;   path = "/bku/dishfire-sql"; };
-      startAt = "03:25";
-    };
-    dishfire-sql-mors = {
-      method = "pull";
-      src = { host = config.krebs.hosts.dishfire; path = "/bku/sql_dumps"; };
-      dst = { host = config.krebs.hosts.mors;     path = "/bku/dishfire-sql"; };
-      startAt = "03:20";
-    };
-    dishfire-sql-shodan = {
-      method = "pull";
-      src = { host = config.krebs.hosts.dishfire; path = "/bku/sql_dumps"; };
-      dst = { host = config.krebs.hosts.shodan;   path = "/bku/dishfire-sql"; };
-      startAt = "03:25";
-    };
-    prism-bitlbee-icarus = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism;  path = "/var/lib/bitlbee"; };
-      dst = { host = config.krebs.hosts.icarus; path = "/bku/prism-bitlbee"; };
-      startAt = "03:25";
-    };
-    prism-bitlbee-mors = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism; path = "/var/lib/bitlbee"; };
-      dst = { host = config.krebs.hosts.mors;  path = "/bku/prism-bitlbee"; };
-      startAt = "03:25";
-    };
-    prism-bitlbee-shodan = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism;  path = "/var/lib/bitlbee"; };
-      dst = { host = config.krebs.hosts.shodan; path = "/bku/prism-bitlbee"; };
-      startAt = "03:25";
-    };
-    prism-chat-icarus = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism;  path = "/home/chat"; };
-      dst = { host = config.krebs.hosts.icarus; path = "/bku/prism-chat"; };
-      startAt = "03:35";
-    };
-    prism-chat-mors = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism; path = "/home/chat"; };
-      dst = { host = config.krebs.hosts.mors;  path = "/bku/prism-chat"; };
-      startAt = "03:30";
-    };
-    prism-chat-shodan = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism;  path = "/home/chat"; };
-      dst = { host = config.krebs.hosts.shodan; path = "/bku/prism-chat"; };
-      startAt = "03:35";
-    };
-    prism-sql-icarus = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism;  path = "/bku/sql_dumps"; };
-      dst = { host = config.krebs.hosts.icarus; path = "/bku/prism-sql_dumps"; };
-      startAt = "03:45";
-    };
-    prism-sql-mors = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism; path = "/bku/sql_dumps"; };
-      dst = { host = config.krebs.hosts.mors;  path = "/bku/prism-sql_dumps"; };
-      startAt = "03:40";
-    };
-    prism-sql-shodan = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism;  path = "/bku/sql_dumps"; };
-      dst = { host = config.krebs.hosts.shodan; path = "/bku/prism-sql_dumps"; };
-      startAt = "03:45";
-    };
-    prism-http-icarus = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism;  path = "/srv/http"; };
-      dst = { host = config.krebs.hosts.icarus; path = "/bku/prism-http"; };
-      startAt = "03:55";
-    };
-    prism-http-mors = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism; path = "/srv/http"; };
-      dst = { host = config.krebs.hosts.mors;  path = "/bku/prism-http"; };
-      startAt = "03:50";
-    };
-    prism-http-shodan = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism;  path = "/srv/http"; };
-      dst = { host = config.krebs.hosts.shodan; path = "/bku/prism-http"; };
-      startAt = "03:55";
-    };
-    icarus-home-mors = {
-      method = "pull";
-      src = { host = config.krebs.hosts.icarus; path = "/home"; };
-      dst = { host = config.krebs.hosts.mors;   path = "/bku/icarus-home"; };
-      startAt = "05:00";
-    };
-    icarus-home-shodan = {
-      method = "push";
-      src = { host = config.krebs.hosts.icarus; path = "/home"; };
-      dst = { host = config.krebs.hosts.shodan; path = "/bku/icarus-home"; };
-      startAt = "05:00";
-    };
-    mors-home-icarus = {
-      method = "push";
-      src = { host = config.krebs.hosts.mors;   path = "/home"; };
-      dst = { host = config.krebs.hosts.icarus; path = "/bku/mors-home"; };
-      startAt = "05:00";
-    };
-    mors-home-shodan = {
-      method = "push";
-      src = { host = config.krebs.hosts.mors;   path = "/home"; };
-      dst = { host = config.krebs.hosts.shodan; path = "/bku/mors-home"; };
-      startAt = "05:00";
-    };
-    shodan-home-icarus = {
-      method = "pull";
-      src = { host = config.krebs.hosts.shodan; path = "/home"; };
-      dst = { host = config.krebs.hosts.icarus; path = "/bku/shodan-home"; };
-      startAt = "04:00";
-    };
-    shodan-home-mors = {
-      method = "pull";
-      src = { host = config.krebs.hosts.shodan; path = "/home"; };
-      dst = { host = config.krebs.hosts.mors;   path = "/bku/shodan-home"; };
-      startAt = "04:00";
-    };
-  };
-}
diff --git a/lass/2configs/baseX.nix b/lass/2configs/baseX.nix
index ed179ded6..afdefaa45 100644
--- a/lass/2configs/baseX.nix
+++ b/lass/2configs/baseX.nix
@@ -9,7 +9,6 @@ in {
     ./power-action.nix
     ./copyq.nix
     ./livestream.nix
-    ./dns-stuff.nix
     ./urxvt.nix
     ./network-manager.nix
     {
@@ -69,12 +68,15 @@ in {
 
   environment.systemPackages = with pkgs; [
     acpi
+    ag
     bank
+    cabal2nix
     dic
     dmenu
     gi
-    git-preview
     gitAndTools.qgit
+    git-preview
+    gnome3.dconf
     lm_sensors
     mpv-poll
     much
@@ -87,19 +89,18 @@ in {
     rxvt_unicode_with-plugins
     slock
     sxiv
-    timewarrior
     taskwarrior
     termite
+    thesauron
+    timewarrior
     xclip
+    xephyrify
     xorg.xbacklight
     xorg.xhost
     xsel
     youtube-tools
     yt-next
     zathura
-
-    cabal2nix
-    xephyrify
   ];
 
   fonts.fonts = with pkgs; [
diff --git a/lass/2configs/bitcoin.nix b/lass/2configs/bitcoin.nix
index a405addfc..9f6fd3bf0 100644
--- a/lass/2configs/bitcoin.nix
+++ b/lass/2configs/bitcoin.nix
@@ -10,9 +10,6 @@ in {
   krebs.per-user.bitcoin.packages = [
     pkgs.electrum
   ];
-  krebs.per-user.ethereum.packages = [
-    pkgs.go-ethereum
-  ];
   users.extraUsers = {
     bch = {
       name = "bch";
@@ -28,13 +25,6 @@ in {
       useDefaultShell = true;
       createHome = true;
     };
-    ethereum = {
-      name = "ethereum";
-      description = "user for ethereum stuff";
-      home = "/home/ethereum";
-      useDefaultShell = true;
-      createHome = true;
-    };
   };
   security.sudo.extraConfig = ''
     ${mainUser.name} ALL=(bitcoin) NOPASSWD: ALL
diff --git a/lass/2configs/bitlbee.nix b/lass/2configs/bitlbee.nix
new file mode 100644
index 000000000..1220fa0cd
--- /dev/null
+++ b/lass/2configs/bitlbee.nix
@@ -0,0 +1,15 @@
+with (import <stockholm/lib>);
+{ config, lib, pkgs, ... }:
+
+{
+  services.bitlbee = {
+    enable = true;
+    portNumber = 6666;
+    plugins = [
+      pkgs.bitlbee-facebook
+      pkgs.bitlbee-steam
+      pkgs.bitlbee-discord
+    ];
+    libpurple_plugins = [ pkgs.telegram-purple ];
+  };
+}
diff --git a/lass/2configs/blue-host.nix b/lass/2configs/blue-host.nix
new file mode 100644
index 000000000..657234bc1
--- /dev/null
+++ b/lass/2configs/blue-host.nix
@@ -0,0 +1,22 @@
+{ config, lib, pkgs, ... }:
+with import <stockholm/lib>;
+
+{
+  imports = [
+    <stockholm/lass/2configs/container-networking.nix>
+  ];
+  containers.blue = {
+    config = { ... }: {
+      environment.systemPackages = [ pkgs.git ];
+      services.openssh.enable = true;
+      users.users.root.openssh.authorizedKeys.keys = [
+        config.krebs.users.lass.pubkey
+      ];
+    };
+    autoStart = true;
+    enableTun = true;
+    privateNetwork = true;
+    hostAddress = "10.233.2.9";
+    localAddress = "10.233.2.10";
+  };
+}
diff --git a/lass/2configs/blue.nix b/lass/2configs/blue.nix
new file mode 100644
index 000000000..363705edc
--- /dev/null
+++ b/lass/2configs/blue.nix
@@ -0,0 +1,60 @@
+with (import <stockholm/lib>);
+{ config, lib, pkgs, ... }:
+
+{
+
+  imports = [
+    ./bitlbee.nix
+    ./mail.nix
+    ./pass.nix
+  ];
+
+  environment.systemPackages = with pkgs; [
+    ag
+    nmap
+  ];
+
+  services.tor.enable = true;
+
+  krebs.iptables.tables.filter.INPUT.rules = [
+    { predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT";}
+    { predicate = "-i retiolum -p tcp --dport 9999"; target = "ACCEPT";}
+  ];
+
+  systemd.services.chat = let
+    tmux = pkgs.writeDash "tmux" ''
+      exec ${pkgs.tmux}/bin/tmux -f ${pkgs.writeText "tmux.conf" ''
+        set-option -g prefix `
+        unbind-key C-b
+        bind ` send-prefix
+
+        set-option -g status off
+        set-option -g default-terminal screen-256color
+
+        #use session instead of windows
+        bind-key c new-session
+        bind-key p switch-client -p
+        bind-key n switch-client -n
+        bind-key C-s switch-client -l
+      ''} "$@"
+    '';
+  in {
+    description = "chat environment setup";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+
+    restartIfChanged = false;
+
+    path = [
+      pkgs.rxvt_unicode.terminfo
+    ];
+
+    serviceConfig = {
+      User = "lass";
+      RemainAfterExit = true;
+      Type = "oneshot";
+      ExecStart = "${tmux} -2 new-session -d -s IM ${pkgs.weechat}/bin/weechat";
+      ExecStop = "${tmux} kill-session -t IM";
+    };
+  };
+}
diff --git a/lass/2configs/container-networking.nix b/lass/2configs/container-networking.nix
index 3dae3420d..f04e4342d 100644
--- a/lass/2configs/container-networking.nix
+++ b/lass/2configs/container-networking.nix
@@ -1,12 +1,6 @@
-{ ... }:
+{ lib, ... }:
 
 {
-  #krebs.iptables.tables.filter.INPUT.rules = [
-  #  { v6 = false; predicate = "-i ve-+ -p udp -m udp --dport 53"; target = "ACCEPT"; }
-  #  { v6 = false; predicate = "-i ve-+ -p tcp -m tcp --dport 53"; target = "ACCEPT"; }
-  #  { v6 = false; predicate = "-i ve-+ -p udp -m udp --dport 67"; target = "ACCEPT"; }
-  #  { v6 = false; predicate = "-i ve-+ -p tcp -m tcp --dport 67"; target = "ACCEPT"; }
-  #];
   krebs.iptables.tables.filter.FORWARD.rules = [
     { v6 = false; predicate = "-d 10.233.2.0/24 -o ve-+ -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
     { v6 = false; predicate = "-s 10.233.2.0/24 -i ve-+"; target = "ACCEPT"; }
@@ -14,9 +8,9 @@
     { v6 = false; predicate = "-o ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; }
     { v6 = false; predicate = "-i ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; }
   ];
-  #krebs.iptables.tables.filter.OUTPUT.rules = [
-  #  { v6 = false; predicate = "-o ve-+ -p udp -m udp --dport 68"; target = "ACCEPT"; }
-  #];
+  krebs.iptables.tables.nat.PREROUTING.rules = [
+    { v6 = false; predicate = "-s 10.233.2.0/24"; target = "ACCEPT"; precedence = 1000; }
+  ];
   krebs.iptables.tables.nat.POSTROUTING.rules = [
     { v6 = false; predicate = "-s 10.233.2.0/24 -d 224.0.0.0/24"; target = "RETURN"; }
     { v6 = false; predicate = "-s 10.233.2.0/24 -d 255.255.255.255"; target = "RETURN"; }
@@ -24,4 +18,5 @@
     { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24 -p tcp"; target = "MASQUERADE --to-ports 1024-65535"; }
     { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24 -p udp"; target = "MASQUERADE --to-ports 1024-65535"; }
   ];
+  boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkDefault 1;
 }
diff --git a/lass/2configs/dcso-dev.nix b/lass/2configs/dcso-dev.nix
index ae1c7bc8d..b985b67b3 100644
--- a/lass/2configs/dcso-dev.nix
+++ b/lass/2configs/dcso-dev.nix
@@ -9,6 +9,7 @@ in {
     dev = {
       name = "dev";
       uid = genid "dev";
+      extraGroups = [ "docker" ];
       description = "user for collaborative development";
       home = "/home/dev";
       useDefaultShell = true;
diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix
index 5a5f1b347..a43113177 100644
--- a/lass/2configs/default.nix
+++ b/lass/2configs/default.nix
@@ -6,10 +6,9 @@ with import <stockholm/lib>;
     ./gc.nix
     ./mc.nix
     ./vim.nix
-    ./monitoring/client.nix
+    ./monitoring/node-exporter.nix
     ./zsh.nix
     ./htop.nix
-    ./backups.nix
     ./security-workarounds.nix
     {
       users.extraUsers =
@@ -20,10 +19,10 @@ with import <stockholm/lib>;
       users.extraUsers = {
         root = {
           openssh.authorizedKeys.keys = [
-            config.krebs.users.lass.pubkey
+            config.krebs.users.lass-mors.pubkey
+            config.krebs.users.lass-blue.pubkey
             config.krebs.users.lass-shodan.pubkey
             config.krebs.users.lass-icarus.pubkey
-            config.krebs.users.lass-xerxes.pubkey
           ];
         };
         mainUser = {
@@ -39,7 +38,8 @@ with import <stockholm/lib>;
             "wheel"
           ];
           openssh.authorizedKeys.keys = [
-            config.krebs.users.lass.pubkey
+            config.krebs.users.lass-mors.pubkey
+            config.krebs.users.lass-blue.pubkey
             config.krebs.users.lass-shodan.pubkey
             config.krebs.users.lass-icarus.pubkey
           ];
diff --git a/lass/2configs/dns-stuff.nix b/lass/2configs/dns-stuff.nix
deleted file mode 100644
index cbcce8df9..000000000
--- a/lass/2configs/dns-stuff.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ config, pkgs, ... }:
-with import <stockholm/lib>;
-{
-  services.dnscrypt-proxy = {
-    enable = true;
-    localAddress = "127.1.0.1";
-    customResolver = {
-      address = config.krebs.hosts.gum.nets.internet.ip4.addr;
-      port = 15251;
-      name = "2.dnscrypt-cert.euer.krebsco.de";
-      key = "1AFC:E58D:F242:0FBB:9EE9:4E51:47F4:5373:D9AE:C2AB:DD96:8448:333D:5D79:272C:A44C";
-    };
-  };
-  services.resolved.enable = true;
-  services.resolved.fallbackDns = [ "127.1.0.1" ];
-}
diff --git a/lass/2configs/exim-smarthost.nix b/lass/2configs/exim-smarthost.nix
index 4455d2761..371f20885 100644
--- a/lass/2configs/exim-smarthost.nix
+++ b/lass/2configs/exim-smarthost.nix
@@ -14,7 +14,7 @@ with import <stockholm/lib>;
     ];
     relay_from_hosts = map (host: host.nets.retiolum.ip6.addr) [
       config.krebs.hosts.mors
-      config.krebs.hosts.uriel
+      config.krebs.hosts.blue
     ];
     internet-aliases = with config.krebs.users; [
       { from = "postmaster@lassul.us"; to = lass.mail; } # RFC 822
@@ -79,6 +79,10 @@ with import <stockholm/lib>;
       { from = "ovh@lassul.us"; to = lass.mail; }
       { from = "hetzner@lassul.us"; to = lass.mail; }
       { from = "allygator@lassul.us"; to = lass.mail; }
+      { from = "immoscout@lassul.us"; to = lass.mail; }
+      { from = "elitedangerous@lassul.us"; to = lass.mail; }
+      { from = "boardgamegeek@lassul.us"; to = lass.mail; }
+      { from = "qwertee@lassul.us"; to = lass.mail; }
     ];
     system-aliases = [
       { from = "mailer-daemon"; to = "postmaster"; }
diff --git a/lass/2configs/games.nix b/lass/2configs/games.nix
index 3ee3a98a5..81f53bf69 100644
--- a/lass/2configs/games.nix
+++ b/lass/2configs/games.nix
@@ -80,6 +80,7 @@ in {
     };
   };
 
+  hardware.opengl.driSupport32Bit = true;
   hardware.pulseaudio.support32Bit = true;
 
   security.sudo.extraConfig = ''
diff --git a/lass/2configs/gc.nix b/lass/2configs/gc.nix
index ad015180a..c5073e384 100644
--- a/lass/2configs/gc.nix
+++ b/lass/2configs/gc.nix
@@ -3,6 +3,6 @@
 with import <stockholm/lib>;
 {
   nix.gc = {
-    automatic = ! elem config.krebs.build.host.name [ "prism" "mors" "helios" ];
+    automatic = ! (elem config.krebs.build.host.name [ "prism" "mors" "helios" ] || config.boot.isContainer);
   };
 }
diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix
index 1fe87c666..72cfd5e75 100644
--- a/lass/2configs/git.ni