diff options
33 files changed, 864 insertions, 178 deletions
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index e2aea7057..c695589ca 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -14,6 +14,7 @@ let ./iptables.nix ./nginx.nix ./Reaktor.nix + ./retiolum-bootstrap.nix ./realwallpaper.nix ./retiolum.nix ./urlwatch.nix diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index 59052021b..d86c00563 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -2,7 +2,34 @@ with lib; -{ +let + testHosts = lib.genAttrs [ + "test-arch" + "test-centos6" + "test-centos7" + ] (name: { + inherit name; + nets = { + retiolum = { + addrs4 = ["10.243.111.111"]; + addrs6 = ["42:0:0:0:0:0:0:7357"]; + aliases = [ + "test.retiolum" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEAy41YKF/wpHLnN370MSdnAo63QUW30aw+6O79cnaJyxoL6ZQkk4Nd + mrX2tBIfb2hhhgm4Jecy33WVymoEL7EiRZ6gshJaYwte51Jnrac6IFQyiRGMqHY5 + TG/6IzzTOkeQrT1fw3Yfh0NRfqLBZLr0nAFoqgzIVRxvy+QO1gCU2UDKkQ/y5df1 + K+YsMipxU08dsOkPkmLdC/+vDaZiEdYljIS3Omd+ED5JmLM3MSs/ZPQ8xjkjEAy8 + QqD9/67bDoeXyg1ZxED2n0+aRKtU/CK/66Li//yev6yv38OQSEM4t/V0dr9sjLcY + VIdkxKf96F9r3vcDf/9xw2HrqVoy+D5XYQIDAQAB + -----END RSA PUBLIC KEY----- + ''; + }; + }; + }); +in { hosts = addNames { echelon = { cores = 4; @@ -104,7 +131,11 @@ with lib; uriel = { cores = 1; dc = "lass"; - nets = rec { + nets = { + gg23 = { + addrs4 = ["10.23.1.12"]; + aliases = ["uriel.gg23"]; + }; retiolum = { addrs4 = ["10.243.81.176"]; addrs6 = ["42:dc25:60cf:94ef:759b:d2b6:98a9:2e56"]; @@ -131,7 +162,11 @@ with lib; mors = { cores = 2; dc = "lass"; - nets = rec { + nets = { + gg23 = { + addrs4 = ["10.23.1.11"]; + aliases = ["mors.gg23"]; + }; retiolum = { addrs4 = ["10.243.0.2"]; addrs6 = ["42:0:0:0:0:0:0:dea7"]; @@ -155,8 +190,24 @@ with lib; ssh.privkey.path = <secrets/ssh.id_ed25519>; ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAMPlIG+6u75GJ3kvsPF6OoIZsU+u8ZQ+rdviv5fNMD"; }; + schnabel-ap = { + nets = { + gg23 = { + addrs4 = ["10.23.1.20"]; + aliases = ["schnabel-ap.gg23"]; + }; + }; + }; + Reichsfunk-ap = { + nets = { + gg23 = { + addrs4 = ["10.23.1.10"]; + aliases = ["Reichsfunk-ap.gg23"]; + }; + }; + }; - }; + } // testHosts; users = addNames { lass = { pubkey = readFile ../../Zpubkeys/lass.ssh.pub; diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix index 9cf5c9aea..42764e48c 100644 --- a/krebs/3modules/makefu/default.nix +++ b/krebs/3modules/makefu/default.nix @@ -127,10 +127,8 @@ with lib; "krebsco.de" = '' IN MX 10 mx42 euer IN MX 1 aspmx.l.google.com. - io IN NS pigstarter.krebsco.de. pigstarter IN A ${head nets.internet.addrs4} gold IN A ${head nets.internet.addrs4} - tinc IN A ${head nets.internet.addrs4} boot IN A ${head nets.internet.addrs4}''; }; nets = { @@ -166,7 +164,9 @@ with lib; extraZones = { "krebsco.de" = '' wry IN A ${head nets.internet.addrs4} + io IN NS wry.krebsco.de. graphs IN A ${head nets.internet.addrs4} + tinc IN A ${head nets.internet.addrs4} ''; }; nets = rec { diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix new file mode 100644 index 000000000..eed11642f --- /dev/null +++ b/krebs/3modules/retiolum-bootstrap.nix @@ -0,0 +1,58 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + cfg = config.krebs.retiolum-bootstrap; + + out = { + options.krebs.retiolum-bootstrap = api; + config = mkIf cfg.enable imp ; + }; + + api = { + enable = mkEnableOption "retiolum boot strap for tinc.krebsco.de"; + hostname = mkOption { + type = types.str; + description = "hostname which serves tinc boot"; + default = "tinc.krebsco.de" ; + }; + ssl_certificate_key = mkOption { + type = types.str; + description = "Certificate key to use for ssl"; + default = "/root/secrets/tinc.krebsco.de.key"; + }; + ssl_certificate = mkOption { + type = types.str; + description = "Certificate file to use for ssl"; + default = "/root/secrets/tinc.krebsco.de.crt" ; + }; + # in use: + # <secrets/tinc.krebsco.de.crt> + # <secrets/tinc.krebsco.de.key> + }; + + imp = { + krebs.nginx.servers = assert config.krebs.nginx.enable; { + retiolum-boot-redir = { + server-names = singleton cfg.hostname; + extraConfig = '' + return 301 https://$server_name$request_uri; + ''; + locations = []; + }; + retiolum-boot-ssl = { + server-names = singleton cfg.hostname; + listen = "443 ssl"; + extraConfig = '' + ssl_certificate ${cfg.ssl_certificate}; + ssl_certificate_key ${cfg.ssl_certificate_key}; + root ${pkgs.retiolum-bootstrap}; + try_files $uri $uri/retiolum.sh; + ''; + locations = []; + }; + }; + }; + +in +out diff --git a/krebs/4lib/infest/finalize.sh b/krebs/4lib/infest/finalize.sh index 0039960c5..94b13e0be 100644 --- a/krebs/4lib/infest/finalize.sh +++ b/krebs/4lib/infest/finalize.sh @@ -3,8 +3,8 @@ set -eux { umount /mnt/nix umount /mnt/root - umount /boot || : umount /mnt/boot + umount /boot || : umount /mnt coreutils_path=$(set +f; for i in /nix/store/*coreutils*/bin; do :; done; echo $i) diff --git a/krebs/4lib/infest/prepare.sh b/krebs/4lib/infest/prepare.sh index 9fbd5be86..94c9b0fb5 100644 --- a/krebs/4lib/infest/prepare.sh +++ b/krebs/4lib/infest/prepare.sh @@ -18,6 +18,13 @@ prepare() {( esac ;; esac + elif test -e /etc/centos-release; then + case $(cat /etc/centos-release) in + 'CentOS release 6.5 (Final)') + prepare_centos "$@" + exit + ;; + esac fi echo "$0 prepare: unknown OS" >&2 exit -1 diff --git a/krebs/5pkgs/retiolum-bootstrap/default.nix b/krebs/5pkgs/retiolum-bootstrap/default.nix new file mode 100644 index 000000000..331b1cb7f --- /dev/null +++ b/krebs/5pkgs/retiolum-bootstrap/default.nix @@ -0,0 +1,29 @@ +{ stdenv,lib,fetchurl, ... }: +with lib; +stdenv.mkDerivation rec { + name = "retiolum-bootstrap"; + version = "4.2.3"; + + + src = fetchurl { + url = https://raw.githubusercontent.com/krebscode/painload/master/retiolum/scripts/tinc_setup/new_install.sh; + sha256 = "03kmil8q2xm3rdm2jxyah7vww84pw6w01d0c3siid9zpn2j7la9s"; + }; + + phases = [ + "installPhase" + ]; + + installPhase = '' + mkdir -p "$out" + cp -a ${src} $out/retiolum.sh + ''; + + meta = { + description = "Retiolum boostrap scripts"; + url = https://github.com/krebscode/painload; + license = licenses.wtfpl; + platforms = platforms.unix; + maintainers = with maintainers; [ makefu ]; + }; +} diff --git a/lass/1systems/cloudkrebs.nix b/lass/1systems/cloudkrebs.nix index 17915e087..ab24b584b 100644 --- a/lass/1systems/cloudkrebs.nix +++ b/lass/1systems/cloudkrebs.nix @@ -27,30 +27,9 @@ in { } { - nix.maxJobs = 1; sound.enable = false; } ]; - krebs.build = { - user = config.krebs.users.lass; - host = config.krebs.hosts.cloudkrebs; - source = { - dir.secrets = { - host = config.krebs.hosts.mors; - path = "/home/lass/secrets/${config.krebs.build.host.name}"; - }; - dir.stockholm = { - host = config.krebs.hosts.mors; - path = "/home/lass/dev/stockholm"; - }; - }; - }; - - networking.hostName = "cloudkrebs"; - - environment.systemPackages = [ - pkgs.dic - ]; - + krebs.build.host = config.krebs.hosts.cloudkrebs; } diff --git a/lass/1systems/echelon.nix b/lass/1systems/echelon.nix index feaf77ef6..80cb51060 100644 --- a/lass/1systems/echelon.nix +++ b/lass/1systems/echelon.nix @@ -31,26 +31,9 @@ in { } { - nix.maxJobs = 1; sound.enable = false; } ]; - krebs.build = { - user = config.krebs.users.lass; - host = config.krebs.hosts.echelon; - source = { - dir.secrets = { - host = config.krebs.hosts.mors; - path = "/home/lass/secrets/${config.krebs.build.host.name}"; - }; - dir.stockholm = { - host = config.krebs.hosts.mors; - path = "/home/lass/dev/stockholm"; - }; - }; - }; - - networking.hostName = config.krebs.build.host.name; - + krebs.build.host = config.krebs.hosts.echelon; } diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix index 7076c8b14..b0b8ff573 100644 --- a/lass/1systems/mors.nix +++ b/lass/1systems/mors.nix @@ -2,7 +2,7 @@ { imports = [ - ../2configs/desktop-base.nix + ../2configs/baseX.nix ../2configs/programs.nix ../2configs/bitcoin.nix ../2configs/browsers.nix @@ -10,7 +10,6 @@ ../2configs/pass.nix ../2configs/virtualbox.nix ../2configs/elster.nix - ../2configs/urxvt.nix ../2configs/steam.nix ../2configs/wine.nix ../2configs/texlive.nix @@ -18,7 +17,6 @@ #../2configs/ircd.nix ../2configs/chromium-patched.nix ../2configs/git.nix - #../../2configs/tv/synaptics.nix ../2configs/retiolum.nix ../2configs/wordpress.nix ../2configs/bitlbee.nix @@ -26,22 +24,8 @@ ../2configs/skype.nix ]; - krebs.build = { - user = config.krebs.users.lass; - host = config.krebs.hosts.mors; - source = { - dir.secrets = { - host = config.krebs.hosts.mors; - path = "/home/lass/secrets/${config.krebs.build.host.name}"; - }; - dir.stockholm = { - host = config.krebs.hosts.mors; - path = "/home/lass/dev/stockholm"; - }; - }; - }; + krebs.build.host = config.krebs.hosts.mors; - networking.hostName = "mors"; networking.wireless.enable = true; networking.extraHosts = '' @@ -52,8 +36,6 @@ 10.243.206.102 apanowicz.de ''; - nix.maxJobs = 4; - hardware.enableAllFirmware = true; nixpkgs.config.allowUnfree = true; @@ -159,11 +141,6 @@ emulateWheel = true; }; - #system.activationScripts.trackpoint = '' - # echo 0 > '/sys/devices/platform/i8042/serio1/serio2/speed' - # echo 220 > '/sys/devices/platform/i8042/serio1/serio2/sensitivity' - #''; - services.xserver = { videoDriver = "intel"; vaapiDrivers = [ pkgs.vaapiIntel ]; @@ -210,9 +187,19 @@ ]; }; }; + #touchpad config services.xserver.synaptics = { enable = true; + accelFactor = "0.035"; + additionalOptions = '' + Option "FingerHigh" "60" + Option "FingerLow" "60" + ''; tapButtons = false; + twoFingerScroll = true; }; + + #for google hangout + users.extraUsers.gm.extraGroups = [ "audio" "video" ]; } diff --git a/lass/1systems/test-arch.nix b/lass/1systems/test-arch.nix new file mode 100644 index 000000000..0ab9da2f3 --- /dev/null +++ b/lass/1systems/test-arch.nix @@ -0,0 +1,36 @@ +{ config, lib, pkgs, ... }: + +let + inherit (import ../4lib { inherit pkgs lib; }) getDefaultGateway; + inherit (lib) head; + +in { + imports = [ + ../2configs/base.nix + { + boot.loader.grub = { + device = "/dev/sda"; + splashImage = null; + }; + + boot.initrd.availableKernelModules = [ + "ata_piix" + "vmw_pvscsi" + ]; + + fileSystems."/" = { + device = "/dev/sda1"; + }; + } + { + networking.dhcpcd.allowInterfaces = [ + "enp*" + ]; + } + { + sound.enable = false; + } + ]; + + krebs.build.host = config.krebs.hosts.test-arch; +} diff --git a/lass/1systems/test-centos6.nix b/lass/1systems/test-centos6.nix new file mode 100644 index 000000000..7270c2262 --- /dev/null +++ b/lass/1systems/test-centos6.nix @@ -0,0 +1,30 @@ +{ config, lib, pkgs, ... }: + +let + inherit (import ../4lib { inherit pkgs lib; }) getDefaultGateway; + inherit (lib) head; + + ip = "168.235.148.52"; +in { + imports = [ + ../2configs/base.nix + ../2configs/os-templates/CAC-CentOS-6.5-64bit.nix + { + networking.interfaces.enp11s0.ip4 = [ + { + address = ip; + prefixLength = 24; + } + ]; + networking.defaultGateway = getDefaultGateway ip; + networking.nameservers = [ + "8.8.8.8" + ]; + } + { + sound.enable = false; + } + ]; + + krebs.build.host = config.krebs.hosts.test-centos6; +} diff --git a/lass/1systems/test-centos7.nix b/lass/1systems/test-centos7.nix new file mode 100644 index 000000000..91bd3e0fe --- /dev/null +++ b/lass/1systems/test-centos7.nix @@ -0,0 +1,31 @@ +{ config, lib, pkgs, ... }: + +let + inherit (import ../4lib { inherit pkgs lib; }) getDefaultGateway; + inherit (lib) head; + + ip = "168.235.145.85"; +in { + imports = [ + ../2configs/base.nix + ../2configs/os-templates/CAC-CentOS-7-64bit.nix + { + networking.interfaces.enp2s1.ip4 = [ + { + address = ip; + prefixLength = 24; + } + ]; + networking.defaultGateway = getDefaultGateway ip; + networking.nameservers = [ + "8.8.8.8" + ]; + + } + { + sound.enable = false; + } + ]; + + krebs.build.host = config.krebs.hosts.test-centos7; +} diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix index 62338d054..1b008cbfd 100644 --- a/lass/1systems/uriel.nix +++ b/lass/1systems/uriel.nix @@ -3,11 +3,10 @@ with builtins; { imports = [ - ../2configs/desktop-base.nix + ../2configs/baseX.nix ../2configs/browsers.nix ../2configs/games.nix ../2configs/pass.nix - ../2configs/urxvt.nix ../2configs/bird.nix ../2configs/git.nix ../2configs/chromium-patched.nix @@ -25,26 +24,9 @@ with builtins; } ]; - krebs.build = { - user = config.krebs.users.lass; - target = "root@uriel"; - host = config.krebs.hosts.uriel; - source = { - dir.secrets = { - host = config.krebs.hosts.mors; - path = "/home/lass/secrets/${config.krebs.build.host.name}"; - }; - dir.stockholm = { - host = config.krebs.hosts.mors; - path = "/home/lass/dev/stockholm"; - }; - }; - }; - - networking.hostName = "uriel"; + krebs.build.host = config.krebs.hosts.uriel; networking.wireless.enable = true; - nix.maxJobs = 2; hardware.enableAllFirmware = true; nixpkgs.config.allowUnfree = true; @@ -65,8 +47,6 @@ with builtins; initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ]; #kernelModules = [ "kvm-intel" "msr" ]; kernelModules = [ "msr" ]; - extraModprobeConfig = '' - ''; }; fileSystems = { "/" = { @@ -93,11 +73,4 @@ with builtins; Option "FingerLow" "60" ''; }; - - environment.systemPackages = with pkgs; [ - ]; - - #for google hangout - - users.extraUsers.google.extraGroups = [ "audio" "video" ]; } diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix index f313054d9..6fa9c5b2d 100644 --- a/lass/2configs/base.nix +++ b/lass/2configs/base.nix @@ -38,14 +38,28 @@ with lib; } ]; + networking.hostName = config.krebs.build.host.name; + nix.maxJobs = config.krebs.build.host.cores; + krebs = { enable = true; search-domain = "retiolum"; exim-retiolum.enable = true; - build.source = { - git.nixpkgs = { - url = https://github.com/Lassulus/nixpkgs; - rev = "b9270a2e8ac3d2cf4c95075a9529528aa1d859da"; + build = { + user = config.krebs.users.lass; + source = { + git.nixpkgs = { + url = https://github.com/Lassulus/nixpkgs; + rev = "33bdc011f5360288cd10b9fda90da2950442b2ab"; + }; + dir.secrets = { + host = config.krebs.hosts.mors; + path = "/home/lass/secrets/${config.krebs.build.host.name}"; + }; + dir.stockholm = { + host = config.krebs.hosts.mors; + path = "/home/lass/stockholm"; + }; }; }; }; @@ -82,6 +96,9 @@ with lib; #network iptables + + #stuff for dl + aria2 ]; programs.bash = { @@ -123,12 +140,6 @@ with lib; "sendmail" ]; - #services.gitolite = { - # enable = true; - # dataDir = "/home/gitolite"; - # adminPubkey = config.sshKeys.lass.pub; - #}; - services.openssh = { enable = true; hostKeys = [ diff --git a/lass/2configs/desktop-base.nix b/lass/2configs/baseX.nix index 4e693997d..1f5c3de55 100644 --- a/lass/2configs/desktop-base.nix +++ b/lass/2configs/baseX.nix @@ -5,6 +5,7 @@ let in { imports = [ ./base.nix + ./urxvt.nix ]; time.timeZone = "Europe/Berlin"; @@ -30,6 +31,7 @@ in { powertop sxiv much + push #window manager stuff haskellPackages.xmobar diff --git a/lass/2configs/newsbot-js.nix b/lass/2configs/newsbot-js.nix new file mode 100644 index 000000000..211b29780 --- /dev/null +++ b/lass/2configs/newsbot-js.nix @@ -0,0 +1,202 @@ +{ config, pkgs, ... }: + +let + newsfile = pkgs.writeText "feeds" '' + aje|http://www.aljazeera.com/Services/Rss/?PostingId=2007731105943979989|#news + aktuelle_themen|http://bundestag.de/service/rss/Bundestag_Aktuelle_Themen.rss|#news #bundestag + allafrica|http://allafrica.com/tools/headlines/rdf/latest/headlines.rdf|#news + anon|http://anoninsiders.net/feed/|#news + antirez|http://antirez.com/rss|#news + arbor|http://feeds2.feedburner.com/asert/|#news + archlinux|http://www.archlinux.org/feeds/news/|#news + ars|http://feeds.arstechnica.com/arstechnica/index?format=xml|#news + asiaone_asia|http://news.asiaone.com/rss/asia|#news + asiaone_business|http://business.asiaone.com/rss.xml|#news + asiaone_sci|http://news.asiaone.com/rss/science-and-tech|#news + asiaone_world|http://news.asiaone.com/rss/world|#news + augustl|http://augustl.com/atom.xml|#news + bbc|http://feeds.bbci.co.uk/news/rss.xml|#news + bdt_drucksachen|http://www.bundestag.de/dip21rss/bundestag_drucksachen.rss|#news #bundestag + bdt_plenarproto|http://www.bundestag.de/rss_feeds/plenarprotokolle.rss|#news #bundestag + bdt_pressemitteilungen|http://bundestag.de/service/rss/Bundestag_Presse.rss|#news #bundestag + bdt_wd|http://bundestag.de/service/rss/Bundestag_WD.rss|#news #bundestag + bitcoinpakistan|https://bitcoinspakistan.com/feed/|#news #financial + cancer|http://feeds.feedburner.com/ncinewsreleases?format=xml|#news + carta|http://feeds2.feedburner.com/carta-standard-rss|#news + catholic_news|http://feeds.feedburner.com/catholicnewsagency/dailynews|#news + cbc_busi|http://rss.cbc.ca/lineup/business.xml|#news + cbc_offbeat|http://www.cbc.ca/cmlink/rss-offbeat|#news + cbc_pol|http://rss.cbc.ca/lineup/politics.xml|#news + cbc_tech|http://rss.cbc.ca/lineup/technology.xml|#news + cbc_top|http://rss.cbc.ca/lineup/topstories.xml|#news + ccc|http://www.ccc.de/rss/updates.rdf|#news + chan_b|https://boards.4chan.org/b/index.rss|#brainfuck + chan_biz|https://boards.4chan.org/biz/index.rss|#news #brainfuck + chan_int|https://boards.4chan.org/int/index.rss|#news #brainfuck + cna|http://www.channelnewsasia.com/starterkit/servlet/cna/rss/home.xml|#news + coinspotting|http://coinspotting.com/rss|#news #financial + cryptanalysis|https://cryptanalys.is/rss.php|#news + cryptocoinsnews|http://www.cryptocoinsnews.com/feed/|#news #financial + cryptogon|http://www.cryptogon.com/?feed=rss2|#news + csm|http://rss.csmonitor.com/feeds/csm|#news + csm_world|http://rss.csmonitor.com/feeds/world|#news + cyberguerrilla|https://www.cyberguerrilla.org/a/2012/?feed=rss2|#news + danisch|http://www.danisch.de/blog/feed/|#news + dod|http://www.defense.gov/news/afps2.xml|#news + dwn|http://deutsche-wirtschafts-nachrichten.de/feed/customfeed/|#news + ecat|http://ecat.com/feed|#news + eia_press|http://www.eia.gov/rss/press_rss.xml|#news + eia_today|http://www.eia.gov/rss/todayinenergy.xml|#news + embargowatch|https://embargowatch.wordpress.com/feed/|#news + ethereum-comments|http://blog.ethereum.org/comments/feed|#news + ethereum|http://blog.ethereum.org/feed|#news + europa_ric|http://ec.europa.eu/research/infocentre/rss/infocentre-rss.xml|#news + eu_survei|http://www.eurosurveillance.org/public/RSSFeed/RSS.aspx|#news + exploitdb|http://www.exploit-db.com/rss.xml|#news + fars|http://www.farsnews.com/rss.php|#news #test + faz_feui|http://www.faz.net/rss/aktuell/feuilleton/|#news + faz_politik|http://www.faz.net/rss/aktuell/politik/|#news + faz_wirtschaft|http://www.faz.net/rss/aktuell/wirtschaft/|#news #financial + fbi|http://www.fbi.gov/homepage/RSS|#news #bullerei + fbi_news|http://www.fbi.gov/news/news_blog/rss.xml|#news + fbi_press|http://www.fbi.gov/news/current/rss.xml|#news #bullerei + fbi_stories|http://www.fbi.gov/news/stories/all-stories/rss.xml|#news #bullerei + fedreserve|http://www.federalreserve.gov/feeds/press_all.xml|#news #financial + fefe|http://blog.fefe.de/rss.xml|#news + forbes|http://www.forbes.com/forbes/feed2/|#news + forbes_realtime|http://www.forbes.com/real-time/feed2/|#news + fox|http://feeds.f |