Merge remote-tracking branch 'pnp/master'

14 files changed, 167 insertions, 174 deletions

diff --git a/makefu/1systems/pornocauster.nix b/makefu/1systems/pornocauster.nix
index 8f7f5ea7c..97cf86a4e 100644
--- a/makefu/1systems/pornocauster.nix
+++ b/makefu/1systems/pornocauster.nix
@@ -21,6 +21,7 @@
 
       # applications
       ../2configs/exim-retiolum.nix
+      ../2configs/mail-client.nix
       #../2configs/virtualization.nix
       ../2configs/virtualization-virtualbox.nix
       ../2configs/wwan.nix
diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index 819a208ac..6627d87b5 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -1,47 +1,72 @@
 { config, lib, pkgs, ... }:
 
+with lib;
 let
 
-  ip = (lib.head config.krebs.build.host.nets.internet.addrs4);
+  external-ip = head config.krebs.build.host.nets.internet.addrs4;
+  internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
 in {
   imports = [
-    ../../tv/2configs/CAC-CentOS-7-64bit.nix
-    ../2configs/base.nix
-    ../2configs/base-sources.nix
-    ../2configs/tinc-basic-retiolum.nix
+      # TODO: copy this config or move to krebs
+      ../../tv/2configs/CAC-CentOS-7-64bit.nix
+      ../2configs/base.nix
+      ../2configs/unstable-sources.nix
+      ../2configs/tinc-basic-retiolum.nix
+
+      ../2configs/bepasty-dual.nix
+
+      ../2configs/iodined.nix
+
+      # Reaktor
+      ../2configs/Reaktor/simpleExtend.nix
   ];
 
-  networking.firewall.allowPing = true;
-  networking.interfaces.enp2s1.ip4 = [
-      {
-        address = ip;
-        prefixLength = 24;
-      }
-    ];
-    networking.defaultGateway = "104.233.87.1";
-    networking.nameservers = [
-      "8.8.8.8"
-    ];
+  krebs.build = {
+    user = config.krebs.users.makefu;
+    target = "root@wry";
+    host = config.krebs.hosts.wry;
+  };
 
-  # based on ../../tv/2configs/CAC-Developer-2.nix
-  sound.enable = false;
+
+
+  krebs.Reaktor.enable = true;
+
+  # bepasty to listen only on the correct interfaces
+  krebs.bepasty.servers.internal.nginx.listen  = [ "${internal-ip}:80" ];
+  krebs.bepasty.servers.external.nginx.listen  = [ "${external-ip}:80" "${external-ip}:443 ssl" ];
 
   # prepare graphs
-  nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
   krebs.nginx.enable = true;
-  makefu.tinc_graphs.enable = true;
-  makefu.tinc_graphs.krebsNginx = {
+  krebs.retiolum-bootstrap.enable = true;
+
+  nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
+  krebs.tinc_graphs = {
     enable = true;
-    # TODO: remove hard-coded hostname
-    hostnames_complete  = [ "graphs.wry" ];
-    hostnames_anonymous = [ "graphs.krebsco.de" ];
+    nginx = {
+      enable = true;
+      # TODO: remove hard-coded hostname
+      complete = {
+        listen = [ "${internal-ip}:80" ];
+        server-names = [ "graphs.wry" ];
+      };
+      anonymous = {
+        listen = [ "${external-ip}:80" ] ;
+        server-names = [ "graphs.krebsco.de" ];
+      };
+    };
   };
-  networking.firewall.allowedTCPPorts = [80];
-
-  krebs.build = {
-    user = config.krebs.users.makefu;
-    target = "root@${ip}";
-    host = config.krebs.hosts.wry;
+  networking = {
+    firewall.allowPing = true;
+    firewall.allowedTCPPorts = [ 53 80 443 ];
+    interfaces.enp2s1.ip4 = [{
+      address = external-ip;
+      prefixLength = 24;
+    }];
+    defaultGateway = "104.233.87.1";
+    nameservers = [ "8.8.8.8" ];
   };
 
+
+  # based on ../../tv/2configs/CAC-Developer-2.nix
+  sound.enable = false;
 }
diff --git a/makefu/2configs/Reaktor/random-emoji.nix b/makefu/2configs/Reaktor/random-emoji.nix
index b2d99b36b..3113a826b 100644
--- a/makefu/2configs/Reaktor/random-emoji.nix
+++ b/makefu/2configs/Reaktor/random-emoji.nix
@@ -12,6 +12,7 @@ let
                         coreutils
                         gnused
                         gnugrep
+                        xmlstarlet
                         curl]);
 in {
   # TODO: make origin a variable, <- module is generic enough to handle different origins, not only stockholm
diff --git a/makefu/2configs/Reaktor/random-emoji.sh b/makefu/2configs/Reaktor/random-emoji.sh
index 913d615be..386aa68b9 100644
--- a/makefu/2configs/Reaktor/random-emoji.sh
+++ b/makefu/2configs/Reaktor/random-emoji.sh
@@ -2,4 +2,5 @@
 curl http://emojicons.com/random -s | \
   grep data-text | \
   sed -n 's/.*>\(.*\)<\/textarea>/\1/p' | \
-  head -n 1
+  head -n 1 | \
+  xmlstarlet unesc
diff --git a/makefu/2configs/base-sources.nix b/makefu/2configs/base-sources.nix
index 826cd6fef..7e6bebec3 100644
--- a/makefu/2configs/base-sources.nix
+++ b/makefu/2configs/base-sources.nix
@@ -3,9 +3,9 @@
 {
   krebs.build.source = {
     git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      #url = https://github.com/makefu/nixpkgs;
-      rev = "dc18f39bfb2f9d1ba62c7e8ad98544bb15cb26b2"; # nixos-15.09
+      #url = https://github.com/NixOS/nixpkgs;
+      url = https://github.com/makefu/nixpkgs;
+      rev = "78340b042463fd35caa587b0db2e400e5666dbe1"; # nixos-15.09 + cherry-picked iodine
     };
 
     dir.secrets = {
diff --git a/makefu/2configs/bepasty-dual.nix b/makefu/2configs/bepasty-dual.nix
new file mode 100644
index 000000000..fb170957a
--- /dev/null
+++ b/makefu/2configs/bepasty-dual.nix
@@ -0,0 +1,52 @@
+{ config, lib, pkgs, ... }:
+
+# 1systems should configure itself:
+#   krebs.bepasty.servers.internal.nginx.listen  = [ "80" ]
+#   krebs.bepasty.servers.external.nginx.listen  = [ "80" "443 ssl" ]
+#     80 is redirected to 443 ssl
+
+# secrets used:
+#   wildcard.krebsco.de.crt
+#   wildcard.krebsco.de.key
+#   bepasty-secret.nix     <- contains single string
+
+with lib;
+{
+
+  krebs.nginx.enable = mkDefault true;
+  krebs.bepasty = {
+    enable = true;
+    serveNginx= true;
+
+    servers = {
+      internal = {
+        nginx = {
+          server-names = [ "paste.retiolum" "paste.${config.krebs.build.host.name}" ];
+        };
+        defaultPermissions = "admin,list,create,read,delete";
+        secretKey = import <secrets/bepasty-secret.nix>;
+      };
+
+      external = {
+        nginx = {
+          server-names = [ "paste.krebsco.de" ];
+          extraConfig = ''
+          ssl_session_cache    shared:SSL:1m;
+          ssl_session_timeout  10m;
+          ssl_certificate     /root/secrets/wildcard.krebsco.de.crt;
+          ssl_certificate_key /root/secrets/wildcard.krebsco.de.key;
+          ssl_verify_client off;
+          proxy_ssl_session_reuse off;
+          ssl_protocols        TLSv1 TLSv1.1 TLSv1.2;
+          ssl_ciphers RC4:HIGH:!aNULL:!MD5;
+          ssl_prefer_server_ciphers on;
+          if ($scheme = http){
+            return 301 https://$server_name$request_uri;
+          }'';
+        };
+        defaultPermissions = "read";
+        secretKey = import <secrets/bepasty-secret.nix>;
+      };
+    };
+  };
+}
diff --git a/makefu/2configs/exim-retiolum.nix b/makefu/2configs/exim-retiolum.nix
index cebfd7cea..b8c5c5236 100644
--- a/makefu/2configs/exim-retiolum.nix
+++ b/makefu/2configs/exim-retiolum.nix
@@ -5,10 +5,6 @@ with lib;
   krebs.exim-retiolum.enable = true;
   environment.systemPackages = with pkgs; [
     msmtp
-    mutt-kz
-    notmuch
-    # TODO: put this somewhere else
-    offlineimap
   ];
 
 }
diff --git a/makefu/2configs/git/cgit-retiolum.nix b/makefu/2configs/git/cgit-retiolum.nix
index 1277a014e..189dd66c8 100644
--- a/makefu/2configs/git/cgit-retiolum.nix
+++ b/makefu/2configs/git/cgit-retiolum.nix
@@ -10,6 +10,9 @@ let
     stockholm = {
       desc = "Make all the systems into 1systems!";
     };
+    tinc_graphs = {
+      desc = "Tinc Advanced Graph Generation";
+    };
   };
 
   priv-repos = mapAttrs make-priv-repo {
diff --git a/makefu/2configs/iodined.nix b/makefu/2configs/iodined.nix
new file mode 100644
index 000000000..db8a1bfed
--- /dev/null
+++ b/makefu/2configs/iodined.nix
@@ -0,0 +1,16 @@
+{ services,builtins,environment,pkgs, ... }:
+
+let
+  # TODO: make this a parameter
+  domain = "io.krebsco.de";
+  pw = import <secrets/iodinepw.nix>;
+in {
+
+  services.iodined = {
+    enable = true;
+    domain = domain;
+    ip = "172.16.10.1/24";
+    extraConfig = "-P ${pw}";
+  };
+
+}
diff --git a/makefu/2configs/mail-client.nix b/makefu/2configs/mail-client.nix
new file mode 100644
index 000000000..a6ae33d2f
--- /dev/null
+++ b/makefu/2configs/mail-client.nix
@@ -0,0 +1,12 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+{
+  environment.systemPackages = with pkgs; [
+    msmtp
+    mutt-kz
+    notmuch
+    offlineimap
+  ];
+
+}
diff --git a/makefu/2configs/unstable-sources.nix b/makefu/2configs/unstable-sources.nix
new file mode 100644
index 000000000..f2d28dcaf
--- /dev/null
+++ b/makefu/2configs/unstable-sources.nix
@@ -0,0 +1,19 @@
+{ config, lib, pkgs, ... }:
+
+{
+  krebs.build.source = {
+    git.nixpkgs = {
+      url = https://github.com/makefu/nixpkgs;
+      rev = "984d33884d63d404ff2da76920b8bc8b15471552";
+    };
+
+    dir.secrets = {
+      host = config.krebs.hosts.pornocauster;
+      path = "/home/makefu/secrets/${config.krebs.build.host.name}/";
+    };
+    dir.stockholm = {
+      host = config.krebs.hosts.pornocauster;
+      path = toString ../.. ;
+    };
+  };
+}
diff --git a/makefu/3modules/default.nix b/makefu/3modules/default.nix
index 598365c39..a8a1f69d0 100644
--- a/makefu/3modules/default.nix
+++ b/makefu/3modules/default.nix
@@ -2,7 +2,6 @@ _:
 
 {
   imports = [
-    ./tinc_graphs.nix
   ];
 }
 
diff --git a/makefu/3modules/tinc_graphs.nix b/makefu/3modules/tinc_graphs.nix
deleted file mode 100644
index 62d607527..000000000
--- a/makefu/3modules/tinc_graphs.nix
+++ /dev/null
@@ -1,133 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-let
-  cfg = config.makefu.tinc_graphs;
-  internal_dir = "${cfg.workingDir}/internal";
-  external_dir = "${cfg.workingDir}/external";
-
-  out = {
-    options.makefu.tinc_graphs = api;
-    config = mkIf cfg.enable imp ;
-  };
-
-  api = {
-    enable = mkEnableOption "tinc graphs";
-
-    geodbPath = mkOption {
-      type = types.str;
-      description = "Path to geocitydb, defaults to geolite-legacy";
-      default = "${pkgs.geolite-legacy}/share/GeoIP/GeoIPCity.dat";
-    };
-
-    krebsNginx = {
-      # configure krebs nginx to serve the new graphs
-      enable = mkEnableOption "tinc_graphs nginx";
-
-      hostnames_complete = mkOption {
-        #TODO: this is not a secure way to serve these graphs,better listen to
-        #      the correct interface, krebs.nginx does not support this yet
-
-        type = with types; listOf str;
-        description = "hostname which serves complete graphs";
-        default = [ "graphs.${config.krebs.build.host.name}" ];
-      };
-
-      hostnames_anonymous = mkOption {
-        type = with types; listOf str;
-        description = ''
-          hostname which serves anonymous graphs
-          must be different from hostname_complete
-        '';
-        default = [ "anongraphs.${config.krebs.build.host.name}" ];
-      };
-    };
-
-    workingDir = mkOption {
-      type = types.str;
-      description = ''
-        Path to working dir, will create interal and external/.
-        Defaults to the new users home dir which defaults to
-        /var/cache/tinc_graphs'';
-      default = config.users.extraUsers.tinc_graphs.home;
-    };
-
-    timerConfig = mkOption {
-      type = with types; attrsOf str;
-      default = {
-        OnCalendar = "*:0/15";
-      };
-    };
-  };
-
-  imp = {
-    environment.systemPackages = [ pkgs.tinc_graphs];
-    systemd.timers.tinc_graphs = {
-      description = "Build Tinc Graphs via via timer";
-      wantedBy = [ "timers.target"];
-      timerConfig = cfg.timerConfig;
-    };
-    systemd.services.tinc_graphs = {
-      description = "Build Tinc Graphs";
-      environment = {
-        EXTERNAL_FOLDER = external_dir;
-        INTERNAL_FOLDER = internal_dir;
-        GEODB = cfg.geodbPath;
-        TINC_HOSTPATH=config.krebs.retiolum.hosts;
-      };
-
-      restartIfChanged = true;
-
-      serviceConfig = {
-        Type = "simple";
-
-        ExecStartPre = pkgs.writeScript "tinc_graphs-init" ''
-          #!/bin/sh
-          mkdir -p "${external_dir}" "${internal_dir}"
-        '';
-
-        ExecStart = "${pkgs.tinc_graphs}/bin/all-the-graphs";
-
-        ExecStartPost = pkgs.writeScript "tinc_graphs-post" ''
-          #!/bin/sh
-          # TODO: this may break if workingDir is set to something stupid
-          # this is needed because homedir is created with 700
-          chmod 755  "${cfg.workingDir}"
-        '';
-
-        User = "root"; # tinc cannot be queried as user,
-                       #  seems to be a tinc-pre issue
-        privateTmp = true;
-      };
-    };
-
-    users.extraUsers.tinc_graphs = {
-      uid = 3925439960; #genid tinc_graphs
-      home = "/var/spool/tinc_graphs";
-      createHome = true;
-    };
-
-    krebs.nginx.servers = mkIf cfg.krebsNginx.enable {
-      tinc_graphs_complete = {
-        server-names = cfg.krebsNginx.hostnames_complete;
-        locations = [
-          (nameValuePair "/" ''
-            autoindex on;
-            root ${internal_dir};
-          '')
-        ];
-      };
-      tinc_graphs_anonymous = {
-        server-names = cfg.krebsNginx.hostnames_anonymous;
-        locations = [
-          (nameValuePair "/" ''
-            autoindex on;
-            root ${external_dir};
-          '')
-        ];
-      };
-    };
-  };
-
-in
-out
diff --git a/makefu/5pkgs/tinc_graphs/default.nix b/makefu/5pkgs/tinc_graphs/default.nix
index 5bc974157..62a787d30 100644
--- a/makefu/5pkgs/tinc_graphs/default.nix
+++ b/makefu/5pkgs/tinc_graphs/default.nix
@@ -2,20 +2,21 @@
 
 python3Packages.buildPythonPackage rec {
   name = "tinc_graphs-${version}";
-  version = "0.2.12";
+  version = "0.3.6";
   propagatedBuildInputs = with pkgs;[
     python3Packages.pygeoip
     ## ${geolite-legacy}/share/GeoIP/GeoIPCity.dat
   ];
   src = fetchurl {
     url = "https://pypi.python.org/packages/source/t/tinc_graphs/tinc_graphs-${version}.tar.gz";
-    sha256 = "03jxvxahpcbpnz4668x32b629dwaaz5jcjkyaijm0zzpgcn4cbgp";
+    sha256 = "0ghdx9aaipmppvc2b6cgks4nxw6zsb0fhjrmnisbx7rz0vjvzc74";
   };
   preFixup = with pkgs;''
     wrapProgram $out/bin/build-graphs --prefix PATH : "$out/bin"
     wrapProgram $out/bin/all-the-graphs --prefix PATH : "${imagemagick}/bin:${graphviz}/bin:$out/bin"
     wrapProgram $out/bin/tinc-stats2json --prefix PATH : "${tinc}/bin"
   '';
+
   meta = {
     homepage = http://krebsco.de/;
     description = "Create Graphs from Tinc Stats";