Merge remote-tracking branch 'lass/master'

11 files changed, 147 insertions, 34 deletions

diff --git a/lass/1systems/helios/config.nix b/lass/1systems/helios/config.nix
new file mode 100644
index 000000000..89949bcbf
--- /dev/null
+++ b/lass/1systems/helios/config.nix
@@ -0,0 +1,86 @@
+with import <stockholm/lib>;
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    <stockholm/lass>
+    <stockholm/lass/2configs/baseX.nix>
+    <stockholm/lass/2configs/browsers.nix>
+    <stockholm/lass/2configs/mouse.nix>
+    <stockholm/lass/2configs/pass.nix>
+    <stockholm/lass/2configs/retiolum.nix>
+    <stockholm/lass/2configs/otp-ssh.nix>
+    <stockholm/lass/2configs/git.nix>
+    { # automatic hardware detection
+      boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
+      boot.kernelModules = [ "kvm-intel" ];
+
+      fileSystems."/" =
+        { device = "/dev/pool/root";
+          fsType = "btrfs";
+        };
+
+      fileSystems."/boot" =
+        { device = "/dev/disk/by-uuid/1F60-17C6";
+          fsType = "vfat";
+        };
+
+      fileSystems."/home" =
+        { device = "/dev/pool/home";
+          fsType = "btrfs";
+        };
+
+      nix.maxJobs = lib.mkDefault 8;
+      powerManagement.cpuFreqGovernor = "powersave";
+    }
+    { # crypto stuff
+      boot.initrd.luks = {
+        cryptoModules = [ "aes" "sha512" "sha1" "xts" ];
+        devices =  [{
+           name = "luksroot";
+           device = "/dev/nvme0n1p3";
+        }];
+      };
+    }
+    {
+      services.xserver.dpi = 200;
+      fonts.fontconfig.dpi = 200;
+      lass.myFont = "-schumacher-clean-*-*-*-*-26-*-*-*-*-*-iso10646-1";
+    }
+  ];
+  krebs.build.host = config.krebs.hosts.helios;
+
+  krebs.git.rules = [
+    {
+      user = [ config.krebs.users.lass-helios ];
+      repo = [ config.krebs.git.repos.stockholm ];
+      perm = with git; push "refs/heads/*" [ fast-forward non-fast-forward create delete merge ];
+    }
+  ];
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.wireless.enable = true;
+  hardware.enableRedistributableFirmware = true;
+
+  environment.systemPackages = with pkgs; [
+    vim
+    rxvt_unicode
+    git
+    rsync
+    hashPassword
+    thunderbird
+    dpass
+  ];
+
+  users.users = {
+    root.openssh.authorizedKeys.keys = [
+      config.krebs.users.lass-helios.pubkey
+    ];
+  };
+
+  programs.ssh.startAgent = lib.mkForce true;
+
+}
diff --git a/lass/1systems/helios/source.nix b/lass/1systems/helios/source.nix
new file mode 100644
index 000000000..bfe4dca4c
--- /dev/null
+++ b/lass/1systems/helios/source.nix
@@ -0,0 +1,4 @@
+import <stockholm/lass/source.nix> {
+  name = "helios";
+  secure = true;
+}
diff --git a/lass/2configs/baseX.nix b/lass/2configs/baseX.nix
index 3a99e65a0..0e0273dcc 100644
--- a/lass/2configs/baseX.nix
+++ b/lass/2configs/baseX.nix
@@ -27,6 +27,12 @@ in {
         lass ALL= (root) NOPASSWD:SETENV: ${pkgs.sshuttle}/bin/.sshuttle-wrapped
       '';
     }
+    { #font magic
+      options.lass.myFont = mkOption {
+        type = types.str;
+        default = "-schumacher-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1";
+      };
+    }
   ];
 
   users.extraUsers.mainUser.extraGroups = [ "audio" "video" ];
diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix
index 7bce93ae1..3991acadc 100644
--- a/lass/2configs/git.nix
+++ b/lass/2configs/git.nix
@@ -14,7 +14,7 @@ let
           root-desc = "keep calm and engage";
         };
       };
-      repos = mapAttrs (_: s: removeAttrs s ["collaborators"]) repos;
+      repos = repos;
       rules = rules;
     };
 
@@ -87,8 +87,8 @@ let
     public = true;
   };
 
-  make-restricted-repo = name: { collaborators ? [], announce ? false, hooks ? {}, ... }: {
-    inherit collaborators name;
+  make-restricted-repo = name: { admins ? [], collaborators ? [], announce ? false, hooks ? {}, ... }: {
+    inherit admins collaborators name;
     public = false;
     hooks = optionalAttrs announce {
       post-receive = pkgs.git-hooks.irc-announce {
@@ -111,15 +111,20 @@ let
         repo = [ repo ];
         perm = push "refs/*" [ non-fast-forward create delete merge ];
       } ++
-      optional repo.public {
-        user = attrValues config.krebs.users;
+      optional (length (repo.admins or []) > 0) {
+        user = repo.admins;
         repo = [ repo ];
-        perm = fetch;
+        perm = push "refs/*" [ non-fast-forward create delete merge ];
       } ++
       optional (length (repo.collaborators or []) > 0) {
         user = repo.collaborators;
         repo = [ repo ];
         perm = fetch;
+      } ++
+      optional repo.public {
+        user = attrValues config.krebs.users;
+        repo = [ repo ];
+        perm = fetch;
       };
 
 in out
diff --git a/lass/2configs/retiolum.nix b/lass/2configs/retiolum.nix
index e7779f53e..fb76c5735 100644
--- a/lass/2configs/retiolum.nix
+++ b/lass/2configs/retiolum.nix
@@ -1,12 +1,14 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 
 {
 
   krebs.iptables = {
     tables = {
-      filter.INPUT.rules = [
-        { predicate = "-p tcp --dport tinc"; target = "ACCEPT"; }
-        { predicate = "-p udp --dport tinc"; target = "ACCEPT"; }
+      filter.INPUT.rules = let
+        tincport = toString config.krebs.build.host.nets.retiolum.tinc.port;
+      in [
+        { predicate = "-p tcp --dport ${tincport}"; target = "ACCEPT"; }
+        { predicate = "-p udp --dport ${tincport}"; target = "ACCEPT"; }
       ];
     };
   };
diff --git a/lass/2configs/vim.nix b/lass/2configs/vim.nix
index 29800dbeb..7f36fcd90 100644
--- a/lass/2configs/vim.nix
+++ b/lass/2configs/vim.nix
@@ -106,9 +106,10 @@ let
     pkgs.vimPlugins.undotree
     (pkgs.vimUtils.buildVimPlugin {
       name = "file-line-1.0";
-      src = pkgs.fetchgit {
-        url = git://github.com/bogado/file-line;
-        rev = "refs/tags/1.0";
+      src = pkgs.fetchFromGitHub {
+        owner = "bogado";
+        repo = "file-line";
+        rev = "1.0";
         sha256 = "0z47zq9rqh06ny0q8lpcdsraf3lyzn9xvb59nywnarf3nxrk6hx0";
       };
     })
diff --git a/lass/2configs/websites/lassulus.nix b/lass/2configs/websites/lassulus.nix
index 93b817c3b..d37dd5301 100644
--- a/lass/2configs/websites/lassulus.nix
+++ b/lass/2configs/websites/lassulus.nix
@@ -14,14 +14,6 @@ in {
 
   security.acme = {
     certs."lassul.us" = {
-      email = "lass@lassul.us";
-      webroot = "/var/lib/acme/acme-challenges";
-      plugins = [
-        "account_key.json"
-        "key.pem"
-        "fullchain.pem"
-        "full.pem"
-      ];
       allowKeysForGroup = true;
       group = "lasscert";
     };
@@ -71,13 +63,11 @@ in {
   ];
 
   services.nginx.virtualHosts."lassul.us" = {
+    enableACME = true;
     serverAliases = [ "lassul.us" ];
     locations."/".extraConfig = ''
       root /srv/http/lassul.us;
     '';
-    locations."/.well-known/acme-challenge".extraConfig = ''
-      root /var/lib/acme/challenges/lassul.us/;
-    '';
     locations."= /retiolum-hosts.tar.bz2".extraConfig = ''
       alias ${config.krebs.tinc.retiolum.hostsArchive};
     '';
diff --git a/lass/2configs/xresources.nix b/lass/2configs/xresources.nix
index 2fbc31677..adbcd353d 100644
--- a/lass/2configs/xresources.nix
+++ b/lass/2configs/xresources.nix
@@ -8,8 +8,8 @@ let
     URxvt*scrollBar: false
     URxvt*urgentOnBell: true
     URxvt*SaveLines: 4096
-    URxvt*font: -*-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1
-    URxvt*boldFont: -*-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1
+    URxvt*font: ${config.lass.myFont}
+    URxvt*boldFont: ${config.lass.myFont}
 
     ! ref https://github.com/muennich/urxvt-perls
     URxvt.perl-lib: ${pkgs.urxvt_perls}/lib/urxvt/perl
diff --git a/lass/5pkgs/default.nix b/lass/5pkgs/default.nix
index 6e6ba56fa..46633ba1a 100644
--- a/lass/5pkgs/default.nix
+++ b/lass/5pkgs/default.nix
@@ -1,8 +1,9 @@
-{ pkgs, ... }@args:
+{ config, pkgs, ... }@args:
 
 {
   nixpkgs.config.packageOverrides = rec {
     acronym = pkgs.callPackage ./acronym/default.nix {};
+    dpass = pkgs.callPackage ./dpass {};
     ejabberd = pkgs.callPackage ./ejabberd {
       erlang = pkgs.erlangR16;
     };
@@ -20,7 +21,7 @@
     rs = pkgs.callPackage ./rs/default.nix {};
     urban = pkgs.callPackage ./urban/default.nix {};
     xml2json = pkgs.callPackage ./xml2json/default.nix {};
-    xmonad-lass = import ./xmonad-lass.nix { inherit pkgs; };
+    xmonad-lass = import ./xmonad-lass.nix { inherit config pkgs; };
     yt-next = pkgs.callPackage ./yt-next/default.nix {};
   };
 }
diff --git a/lass/5pkgs/dpass/default.nix b/lass/5pkgs/dpass/default.nix
new file mode 100644
index 000000000..7e75d50c7
--- /dev/null
+++ b/lass/5pkgs/dpass/default.nix
@@ -0,0 +1,12 @@
+{ pass, writeOut, writeDash, ... }:
+
+writeOut "dsco-pass" {
+  "/bin/dpass".link = writeDash "dpass" ''
+    PASSWORD_STORE_DIR=$HOME/.dpasswordstore \
+    exec ${pass}/bin/pass $@
+  '';
+  "/bin/dpassmenu".link = writeDash "dpassmenu" ''
+    PASSWORD_STORE_DIR=$HOME/.dpasswordstore \
+    exec ${pass}/bin/passmenu $@
+  '';
+}
diff --git a/lass/5pkgs/xmonad-lass.nix b/lass/5pkgs/xmonad-lass.nix
index 67a1dc787..bf737dc5e 100644
--- a/lass/5pkgs/xmonad-lass.nix
+++ b/lass/5pkgs/xmonad-lass.nix
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 pkgs.writeHaskell "xmonad-lass" {
   executables.xmonad = {
     extra-depends = [
@@ -40,7 +40,7 @@ import XMonad.Hooks.UrgencyHook (SpawnUrgencyHook(..), withUrgencyHook)
 import XMonad.Layout.FixedColumn (FixedColumn(..))
 import XMonad.Layout.Minimize (minimize, minimizeWindow, MinimizeMsg(RestoreNextMinimizedWin))
 import XMonad.Layout.NoBorders (smartBorders)
-import XMonad.Prompt (autoComplete, searchPredicate, XPConfig)
+import XMonad.Prompt (autoComplete, font, searchPredicate, XPConfig)
 import XMonad.Prompt.Window (windowPromptGoto, windowPromptBringCopy)
 import XMonad.Util.EZConfig (additionalKeysP)
 import XMonad.Layout.SimpleFloat (simpleFloat)
@@ -51,7 +51,7 @@ urxvtcPath :: FilePath
 urxvtcPath = "${pkgs.rxvt_unicode}/bin/urxvtc"
 
 myFont :: String
-myFont = "-schumacher-*-*-*-*-*-*-*-*-*-*-*-iso10646-*"
+myFont = "${config.lass.myFont}"
 
 main :: IO ()
 main = getArgs >>= \case
@@ -99,6 +99,7 @@ myKeyMap =
     , ("M4-C-p", spawn "${pkgs.scrot}/bin/scrot ~/public_html/scrot.png")
     , ("M4-p", spawn "${pkgs.pass}/bin/passmenu --type")
     , ("M4-o", spawn "${pkgs.brain}/bin/brainmenu --type")
+    , ("M4-i", spawn "${pkgs.dpass}/bin/dpassmenu --type")
     , ("<XF86AudioRaiseVolume>", spawn "${pkgs.pulseaudioLight.out}/bin/pactl -- set-sink-volume @DEFAULT_SINK@ +4%")
     , ("<XF86AudioLowerVolume>", spawn "${pkgs.pulseaudioLight.out}/bin/pactl -- set-sink-volume @DEFAULT_SINK@ -4%")
     , ("<XF86MonBrightnessDown>", spawn "${pkgs.xorg.xbacklight}/bin/xbacklight -time 0 -dec 1%")
@@ -107,8 +108,8 @@ myKeyMap =
     , ("M4-C-k", spawn "${pkgs.xorg.xkill}/bin/xkill")
 
     , ("M4-a", focusUrgent)
-    , ("M4-S-r", renameWorkspace    def)
-    , ("M4-S-a", addWorkspacePrompt def)
+    , ("M4-S-r", renameWorkspace    myXPConfig)
+    , ("M4-S-a", addWorkspacePrompt myXPConfig)
     , ("M4-S-<Backspace>", removeEmptyWorkspace)
     , ("M4-S-c", kill1)
     , ("M4-<Esc>", toggleWS)
@@ -141,8 +142,13 @@ forkFile :: FilePath -> [String] -> Maybe [(String, String)] -> X ()
 forkFile path args env =
     xfork (executeFile path False args env) >> return ()
 
+myXPConfig :: XPConfig
+myXPConfig = def
+    { font = myFont
+    }
+
 autoXPConfig :: XPConfig
-autoXPConfig = def
+autoXPConfig = myXPConfig
     { autoComplete = Just 5000
     }