Merge remote-tracking branch 'prism/master'

42 files changed, 1084 insertions, 334 deletions

diff --git a/lass/2configs/baseX.nix b/lass/2configs/baseX.nix
index 16f7502ac..6d26ff89a 100644
--- a/lass/2configs/baseX.nix
+++ b/lass/2configs/baseX.nix
@@ -8,7 +8,13 @@ in {
     #./urxvt.nix
     ./xserver
     ./mpv.nix
+    #./pulse.nix
+    ./power-action.nix
   ];
+  hardware.pulseaudio = {
+    enable = true;
+    systemWide = true;
+  };
 
   users.extraUsers.mainUser.extraGroups = [ "audio" ];
 
@@ -16,11 +22,6 @@ in {
 
   virtualisation.libvirtd.enable = true;
 
-  hardware.pulseaudio = {
-    enable = true;
-    systemWide = true;
-  };
-
   programs.ssh.startAgent = false;
 
   security.setuidPrograms = [ "slock" ];
@@ -32,6 +33,7 @@ in {
 
   environment.systemPackages = with pkgs; [
 
+    acpi
     dmenu
     gitAndTools.qgit
     lm_sensors
@@ -44,6 +46,7 @@ in {
     sxiv
     xclip
     xorg.xbacklight
+    xorg.xhost
     xsel
     zathura
 
diff --git a/lass/2configs/binary-cache/client.nix b/lass/2configs/binary-cache/client.nix
new file mode 100644
index 000000000..108ff7a1e
--- /dev/null
+++ b/lass/2configs/binary-cache/client.nix
@@ -0,0 +1,9 @@
+{ config, ... }:
+
+{
+  nix = {
+    binaryCaches = ["http://cache.prism.r"];
+    binaryCachePublicKeys = ["cache.prism-1:+S+6Lo/n27XEtvdlQKuJIcb1yO5NUqUCE2lolmTgNJU="];
+  };
+}
+
diff --git a/lass/2configs/binary-cache/server.nix b/lass/2configs/binary-cache/server.nix
new file mode 100644
index 000000000..22ec04307
--- /dev/null
+++ b/lass/2configs/binary-cache/server.nix
@@ -0,0 +1,30 @@
+{ config, lib, pkgs, ...}:
+
+{
+  # generate private key with:
+  # nix-store --generate-binary-cache-key my-secret-key my-public-key
+  services.nix-serve = {
+    enable = true;
+    secretKeyFile = config.krebs.secret.files.nix-serve-key.path;
+  };
+
+  systemd.services.nix-serve = {
+    requires = ["secret.service"];
+    after = ["secret.service"];
+  };
+  krebs.secret.files.nix-serve-key = {
+    path = "/run/secret/nix-serve.key";
+    owner.name = "nix-serve";
+    source-path = toString <secrets> + "/nix-serve.key";
+  };
+  krebs.nginx = {
+    enable = true;
+    servers.nix-serve = {
+      server-names = [ "cache.prism.r" ];
+      locations = lib.singleton (lib.nameValuePair "/" ''
+        proxy_pass http://localhost:${toString config.services.nix-serve.port};
+      '');
+    };
+  };
+}
+
diff --git a/lass/2configs/binary-caches.nix b/lass/2configs/binary-caches.nix
deleted file mode 100644
index c2727520d..000000000
--- a/lass/2configs/binary-caches.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ config, ... }:
-
-{
-  nix.sshServe.enable = true;
-  nix.sshServe.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBF9SBNKE3Pw/ALwTfzpzs+j6Rpaf0kUy6FiPMmgNNNt root@mors"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCZSq5oLrokkh3F+MOdK5/nzVIEDvqyvfzLMNWmzsYD root@uriel"
-  ];
-  nix.binaryCaches = [
-    #"scp://nix-ssh@mors"
-    #"scp://nix-ssh@uriel"
-  ];
-}
diff --git a/lass/2configs/buildbot-standalone.nix b/lass/2configs/buildbot-standalone.nix
index 604d0728d..04bdcf9d8 100644
--- a/lass/2configs/buildbot-standalone.nix
+++ b/lass/2configs/buildbot-standalone.nix
@@ -1,6 +1,14 @@
 { lib, config, pkgs, ... }:
-{
-  krebs.buildbot.master = let
+
+with config.krebs.lib;
+
+let
+  sshWrapper = pkgs.writeDash "ssh-wrapper" ''
+    ${pkgs.openssh}/bin/ssh -i ${shell.escape config.lass.build-ssh-privkey.path} "$@"
+  '';
+
+in {
+  config.krebs.buildbot.master = let
     stockholm-mirror-url = http://cgit.prism/stockholm ;
   in {
     slaves = {
@@ -25,20 +33,38 @@
         sched.append(schedulers.SingleBranchScheduler(
                                     ## all branches
                                     change_filter=util.ChangeFilter(branch_re=".*"),
-                                    # treeStableTimer=10,
+                                    treeStableTimer=10,
                                     name="fast-all-branches",
                                     builderNames=["fast-tests"]))
       '';
+      build-scheduler = ''
+        # build all hosts
+        sched.append(schedulers.SingleBranchScheduler(
+                                    change_filter=util.ChangeFilter(branch_re=".*"),
+                                    treeStableTimer=10,
+                                    name="prism-all-branches",
+                                    builderNames=["build-all"]))
+      '';
     };
     builder_pre = ''
       # prepare grab_repo step for stockholm
       grab_repo = steps.Git(repourl=stockholm_repo, mode='incremental')
 
-      env = {"LOGNAME": "lass", "NIX_REMOTE": "daemon"}
+      # TODO: get nixpkgs/stockholm paths from krebs
+      env_lass = {
+        "LOGNAME": "lass",
+        "NIX_REMOTE": "daemon",
+        "dummy_secrets": "true",
+      }
+      env_makefu = {
+        "LOGNAME": "makefu",
+        "NIX_REMOTE": "daemon",
+        "dummy_secrets": "true",
+      }
 
       # prepare nix-shell
       # the dependencies which are used by the test script
-      deps = [ "gnumake", "jq","nix","rsync" ]
+      deps = [ "gnumake", "jq", "nix", "rsync", "proot" ]
       # TODO: --pure , prepare ENV in nix-shell command:
       #                   SSL_CERT_FILE,LOGNAME,NIX_REMOTE
       nixshell = ["nix-shell",
@@ -51,16 +77,45 @@
         factory.addStep(steps.ShellCommand(**kwargs))
     '';
     builder = {
+      build-all = ''
+        f = util.BuildFactory()
+        f.addStep(grab_repo)
+        for i in [ "mors", "uriel", "shodan", "helios", "cloudkrebs", "echelon", "dishfire", "prism" ]:
+          addShell(f,name="build-{}".format(i),env=env_lass,
+                  command=nixshell + \
+                      ["make \
+                            test \
+                            ssh=${sshWrapper} \
+                            target=build@localhost:${config.users.users.build.home}/testbuild \
+                            method=build \
+                            system={}".format(i)])
+
+        for i in [ "pornocauster", "wry" ]:
+          addShell(f,name="build-{}".format(i),env=env_makefu,
+                  command=nixshell + \
+                      ["make \
+                            test \
+                            ssh=${sshWrapper} \
+                            target=build@localhost:${config.users.users.build.home}/testbuild \
+                            method=build \
+                            system={}".format(i)])
+
+        bu.append(util.BuilderConfig(name="build-all",
+              slavenames=slavenames,
+              factory=f))
+
+            '';
+
       fast-tests = ''
         f = util.BuildFactory()
         f.addStep(grab_repo)
         for i in [ "prism", "mors", "echelon" ]:
-          addShell(f,name="populate-{}".format(i),env=env,
+          addShell(f,name="populate-{}".format(i),env=env_lass,
                   command=nixshell + \
                             ["{}( make system={} eval.config.krebs.build.populate \
                                | jq -er .)".format("!" if "failing" in i else "",i)])
 
-        addShell(f,name="build-test-minimal",env=env,
+        addShell(f,name="build-test-minimal",env=env_lass,
                   command=nixshell + \
                             ["nix-instantiate \
                                   --show-trace --eval --strict --json \
@@ -86,17 +141,17 @@
     };
   };
 
-  krebs.buildbot.slave = {
+  config.krebs.buildbot.slave = {
     enable = true;
     masterhost = "localhost";
     username = "testslave";
     password = "lasspass";
     packages = with pkgs;[ git nix gnumake jq rsync ];
     extraEnviron = {
-      NIX_PATH="nixpkgs=/var/src/nixpkgs:nixos-config=./shared/1systems/wolf.nix";
+      NIX_PATH="nixpkgs=/var/src/nixpkgs";
     };
   };
-  krebs.iptables = {
+  config.krebs.iptables = {
     tables = {
       filter.INPUT.rules = [
         { predicate = "-p tcp --dport 8010"; target = "ACCEPT"; }
@@ -104,4 +159,29 @@
       ];
     };
   };
+
+  #ssh workaround for make test
+  options.lass.build-ssh-privkey = mkOption {
+    type = types.secret-file;
+    default = {
+      path = "${config.users.users.buildbotSlave.home}/ssh.privkey";
+      owner = { inherit (config.users.users.buildbotSlave ) name uid;};
+      source-path = toString <secrets> + "/build.ssh.key";
+    };
+  };
+  config.krebs.secret.files = {
+    build-ssh-privkey = config.lass.build-ssh-privkey;
+  };
+  config.users.users = {
+    build = {
+      name = "build";
+      uid = genid "build";
+      home = "/home/build";
+      useDefaultShell = true;
+      createHome = true;
+      openssh.authorizedKeys.keys = [
+        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDiV0Xn60aVLHC/jGJknlrcxSvKd/MVeh2tjBpxSBT3II9XQGZhID2Gdh84eAtoWyxGVFQx96zCHSuc7tfE2YP2LhXnwaxHTeDc8nlMsdww53lRkxihZIEV7QHc/3LRcFMkFyxdszeUfhWz8PbJGL2GYT+s6CqoPwwa68zF33U1wrMOAPsf/NdpSN4alsqmjFc2STBjnOd9dXNQn1VEJQqGLG3kR3WkCuwMcTLS5eu0KLwG4i89Twjy+TGp2QsF5K6pNE+ZepwaycRgfYzGcPTn5d6YQXBgcKgHMoSJsK8wqpr0+eFPCDiEA3HDnf76E4mX4t6/9QkMXCLmvs0IO/WP lass@mors"
+      ];
+    };
+  };
 }
diff --git a/lass/2configs/cbase.nix b/lass/2configs/c-base.nix
index 9d13bc30d..9d13bc30d 100644
--- a/lass/2configs/cbase.nix
+++ b/lass/2configs/c-base.nix
diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix
index 1c06acf38..377554514 100644
--- a/lass/2configs/default.nix
+++ b/lass/2configs/default.nix
@@ -7,6 +7,9 @@ with config.krebs.lib;
     ../2configs/zsh.nix
     ../2configs/mc.nix
     ../2configs/retiolum.nix
+    ../2configs/nixpkgs.nix
+    ../2configs/binary-cache/client.nix
+    ../2configs/gc.nix
     ./backups.nix
     {
       users.extraUsers =
@@ -52,21 +55,18 @@ with config.krebs.lib;
       user = config.krebs.users.lass;
       source = mapAttrs (_: mkDefault) ({
         nixos-config = "symlink:stockholm/lass/1systems/${config.krebs.build.host.name}.nix";
-        secrets = "/home/lass/secrets/${config.krebs.build.host.name}";
+        secrets = if getEnv "dummy_secrets" == "true"
+          then toString <stockholm/lass/2configs/tests/dummy-secrets>
+          else "/home/lass/secrets/${config.krebs.build.host.name}";
         #secrets-common = "/home/lass/secrets/common";
-        stockholm = "/home/lass/stockholm";
-        nixpkgs = {
-          url = https://github.com/lassulus/nixpkgs;
-          rev = "f632f8edaf80ffa8bf0b8c9b9064cae3ccbe3894";
-          dev = "/home/lass/src/nixpkgs";
-        };
+        stockholm = getEnv "PWD";
       } // optionalAttrs config.krebs.build.host.secure {
         #secrets-master = "/home/lass/secrets/master";
       });
     };
   };
 
-  nix.useChroot = true;
+  nix.useSandbox = true;
 
   users.mutableUsers = false;
 
@@ -114,8 +114,13 @@ with config.krebs.lib;
 
   #neat utils
     krebspaste
+    pciutils
     psmisc
+    q
+    rs
+    tmux
     untilport
+    usbutils
 
   #unpack stuff
     p7zip
diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix
index 3639a743a..cf9b631c8 100644
--- a/lass/2configs/downloading.nix
+++ b/lass/2configs/downloading.nix
@@ -21,6 +21,7 @@ in {
       openssh.authorizedKeys.keys = [
         config.krebs.users.lass.pubkey
         config.krebs.users.lass-uriel.pubkey
+        config.krebs.users.lass-shodan.pubkey
       ];
     };
 
diff --git a/lass/2configs/exim-smarthost.nix b/lass/2configs/exim-smarthost.nix
index 8199f2bd7..1ba99c8cb 100644
--- a/lass/2configs/exim-smarthost.nix
+++ b/lass/2configs/exim-smarthost.nix
@@ -28,6 +28,8 @@ with config.krebs.lib;
       { from = "wordpress@ubikmedia.de"; to = lass.mail; }
       { from = "finanzamt@lassul.us"; to = lass.mail; }
       { from = "dominik@apanowicz.de"; to = "dma@ubikmedia.eu"; }
+      { from = "netzclub@lassul.us"; to = lass.mail; }
+      { from = "nebenan@lassul.us"; to = lass.mail; }
     ];
     system-aliases = [
       { from = "mailer-daemon"; to = "postmaster"; }
diff --git a/lass/2configs/fetchWallpaper.nix b/lass/2configs/fetchWallpaper.nix
index f3b65e816..a724e2e45 100644
--- a/lass/2configs/fetchWallpaper.nix
+++ b/lass/2configs/fetchWallpaper.nix
@@ -5,7 +5,8 @@ let
 in {
   krebs.fetchWallpaper = {
     enable = true;
-    url = "cloudkrebs/wallpaper.png";
+    unitConfig.ConditionPathExists = "!/var/run/ppp0.pid";
+    url = "prism/wallpaper.png";
   };
 }
 
diff --git a/lass/2configs/gc.nix b/lass/2configs/gc.nix
new file mode 100644
index 000000000..8762ad95e
--- /dev/null
+++ b/lass/2configs/gc.nix
@@ -0,0 +1,8 @@
+{ config, ... }:
+
+with config.krebs.lib;
+{
+  nix.gc = {
+    automatic = ! elem config.krebs.build.host.name [ "prism" "mors" ];
+  };
+}
diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix
index c0affe981..381a37e1b 100644
--- a/lass/2configs/git.nix
+++ b/lass/2configs/git.nix
@@ -29,18 +29,10 @@ let
   rules = concatMap make-rules (attrValues repos);
 
   public-repos = mapAttrs make-public-repo {
-    painload = {};
     stockholm = {
       cgit.desc = "take all the computers hostage, they'll love you!";
     };
-    wai-middleware-time = {};
-    web-routes-wai-custom = {};
-    go = {};
-    newsbot-js = {};
     kimsufi-check = {};
-    realwallpaper = {};
-    xmonad-stockholm = {};
-    the_playlist = {};
   } // mapAttrs make-public-repo-silent {
     the_playlist = {};
   };
@@ -50,8 +42,6 @@ let
       brain = {
         collaborators = with config.krebs.users; [ tv makefu ];
       };
-      extraction_webinterface = {};
-      politics-fetching = {};
     } //
     import <secrets/repos.nix> { inherit config lib pkgs; }
   );
@@ -66,6 +56,7 @@ let
         channel = "#retiolum";
         server = "cd.retiolum";
         verbose = config.krebs.build.host.name == "prism";
+        branches = [ "master" ];
       };
     };
   };
@@ -84,7 +75,7 @@ let
     with git // config.krebs.users;
     repo:
       singleton {
-        user = [ lass lass-helios lass-uriel ];
+        user = [ lass lass-uriel ];
         repo = [ repo ];
         perm = push "refs/*" [ non-fast-forward create delete merge ];
       } ++
diff --git a/lass/2configs/hw/tp-x220.nix b/lass/2configs/hw/tp-x220.nix
new file mode 100644
index 000000000..be1faccea
--- /dev/null
+++ b/lass/2configs/hw/tp-x220.nix
@@ -0,0 +1,54 @@
+{ config, lib, pkgs, ... }:
+
+with config.krebs.lib;
+{
+  networking.wireless.enable = lib.mkDefault true;
+
+  hardware.enableAllFirmware = true;
+  nixpkgs.config.allowUnfree = true;
+
+  hardware.cpu.intel.updateMicrocode = true;
+
+  zramSwap.enable = true;
+  zramSwap.numDevices = 2;
+
+  hardware.trackpoint = {
+    enable = true;
+    sensitivity = 220;
+    speed = 0;
+    emulateWheel = true;
+  };
+
+  services.tlp.enable = true;
+  services.tlp.extraConfig = ''
+    # BUG: http://linrunner.de/en/tlp/docs/tlp-faq.html#erratic-battery
+    #START_CHARGE_THRESH_BAT0=80
+    STOP_CHARGE_THRESH_BAT0=95
+
+    CPU_SCALING_GOVERNOR_ON_AC=performance
+    CPU_SCALING_GOVERNOR_ON_BAT=ondemand
+    CPU_MIN_PERF_ON_AC=0
+    CPU_MAX_PERF_ON_AC=100
+    CPU_MIN_PERF_ON_BAT=0
+    CPU_MAX_PERF_ON_BAT=30
+  '';
+
+  boot = {
+    kernelModules = [ "kvm-intel" "acpi_call" "tpm-rng" ];
+    extraModulePackages = [ config.boot.kernelPackages.tp_smapi ];
+  };
+
+  hardware.opengl.extraPackages = [
+    pkgs.vaapiIntel
+    pkgs.vaapiVdpau
+  ];
+
+  services.xserver = {
+    videoDriver = "intel";
+    deviceSection = ''
+      Option "AccelMethod" "sna"
+    '';
+  };
+
+  security.rngd.enable = true;
+}
diff --git a/lass/2configs/mail.nix b/lass/2configs/mail.nix
index 72d6f987f..7c050005b 100644
--- a/lass/2configs/mail.nix
+++ b/lass/2configs/mail.nix
@@ -10,8 +10,9 @@ let
     account default: prism
   '';
 
-  msmtp = pkgs.writeDashBin "msmtp" ''
-    exec ${pkgs.msmtp}/bin/msmtp -C ${msmtprc} $@
+  msmtp = pkgs.writeBashBin "msmtp" ''
+    ${pkgs.coreutils}/bin/tee >(${pkgs.notmuch}/bin/notmuch insert +sent) | \
+      ${pkgs.msmtp}/bin/msmtp -C ${msmtprc} $@
   '';
 
   muttrc = pkgs.writeText "muttrc" ''
@@ -42,7 +43,7 @@ let
     set nm_record = yes
     set nm_record_tags = "-inbox me archive"
     set virtual_spoolfile=yes                    # enable virtual folders
-    set sendmail="msmtp"                         # enables parsing of outgoing mail
+    set sendmail="${msmtp}/bin/msmtp"                         # enables parsing of outgoing mail
     set use_from=yes
     set envelope_from=yes
 
diff --git a/lass/2configs/newsbot-js.nix b/lass/2configs/newsbot-js.nix
index 636b44395..f2b70d831 100644
--- a/lass/2configs/newsbot-js.nix
+++ b/lass/2configs/newsbot-js.nix
@@ -41,7 +41,6 @@ let
     cryptogon|http://www.cryptogon.com/?feed=rss2|#news
     csm|http://rss.csmonitor.com/feeds/csm|#news
     csm_world|http://rss.csmonitor.com/feeds/world|#news
-    cyberguerrilla|https://www.cyberguerrilla.org/a/2012/?feed=rss2|#news
     danisch|http://www.danisch.de/blog/feed/|#news
     dod|http://www.defense.gov/news/afps2.xml|#news
     dwn|http://deutsche-wirtschafts-nachrichten.de/feed/customfeed/|#news
@@ -102,7 +101,7 @@ let
     npr_headlines|http://www.npr.org/rss/rss.php?id=1001|#news
     npr_pol|http://www.npr.org/rss/rss.php?id=1012|#news
     npr_world|http://www.npr.org/rss/rss.php?id=1004|#news
-    nsa|http://www.nsa.gov/rss.shtml|#news #bullerei
+    nsa|https://www.nsa.gov/rss.xml|#news #bullerei
     nytimes|http://rss.nytimes.com/services/xml/rss/nyt/World.xml|#news
     painload|https://github.com/krebscode/painload/commits/master.atom|#news
     phys|http://phys.org/rss-feed/|#news
diff --git a/lass/2configs/nixpkgs.nix b/lass/2configs/nixpkgs.nix
new file mode 100644
index 000000000..0021a8615
--- /dev/null
+++ b/lass/2configs/nixpkgs.nix
@@ -0,0 +1,8 @@
+{ ... }:
+
+{
+  krebs.build.source.nixpkgs = {
+      url = https://github.com/lassulus/nixpkgs;
+      rev = "c78f9ad2f91019648bdcf5a911f86ea3a397d290";
+    };
+}
diff --git a/lass/2configs/power-action.nix b/lass/2configs/power-action.nix
new file mode 100644
index 000000000..0ff8547c7
--- /dev/null
+++ b/lass/2configs/power-action.nix
@@ -0,0 +1,41 @@
+{ config, pkgs, ... }:
+
+let
+  suspend = pkgs.writeDash "suspend" ''
+    ${pkgs.systemd}/bin/systemctl suspend
+  '';
+
+  speak = text:
+    pkgs.writeDash "speak" ''
+      ${pkgs.espeak}/bin/espeak -v +whisper -s 110 "${text}"
+    '';
+
+in {
+  lass.power-action = {
+    enable = true;
+    plans.low-battery = {
+      upperLimit = 30;
+      lowerLimit = 25;
+      charging = false;
+      action = pkgs.writeDash "warn-low-battery" ''
+        ${speak "power level low"}
+      '';
+    };
+    plans.suspend = {
+      upperLimit = 10;
+      lowerLimit = 0;
+      charging = false;
+      action = pkgs.writeDash "suspend-wrapper" ''
+        /var/setuid-wrappers/sudo ${suspend}
+      '';
+    };
+  };
+
+  users.users.power-action.extraGroups = [
+    "audio"
+  ];
+
+  security.sudo.extraConfig = ''
+    ${config.lass.power-action.user.name} ALL= (root) NOPASSWD: ${suspend}
+  '';
+}
diff --git a/lass/2configs/pulse.nix b/lass/2configs/pulse.nix
new file mode 100644
index 000000000..3be482191
--- /dev/null
+++ b/lass/2configs/pulse.nix
@@ -0,0 +1,96 @@
+{ config, lib, pkgs, ... }:
+
+with config.krebs.lib;
+let
+  pkg = pkgs.pulseaudioLight;
+  runDir = "/run/pulse";
+
+  alsaConf = pkgs.writeText "asound.conf" ''
+    ctl_type.pulse {
+      libs.native = ${pkgs.alsaPlugins}/lib/alsa-lib/libasound_module_ctl_pulse.so;
+    }
+    pcm_type.pulse {
+      libs.native = ${pkgs.alsaPlugins}/lib/alsa-lib/libasound_module_pcm_pulse.so;
+    }
+    ctl.!default {
+      type pulse
+    }
+    pcm.!default {
+      type pulse
+    }
+  '';
+
+  clientConf = pkgs.writeText "client.conf" ''
+    autospawn=no
+    default-server = unix:${runDir}/socket
+  '';
+
+  daemonConf = pkgs.writeText "daemon.conf" ''
+    exit-idle-time=0
+    flat-volumes = no
+    default-fragments = 4
+    default-fragment-size-msec = 25
+  '';
+
+  configFile = pkgs.writeText "default.pa" ''
+    .include ${pkg}/etc/pulse/default.pa
+    load-module ${toString [
+      "module-native-proto