summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--jeschli/5pkgs/firefox/firefox-with-config.nix3
-rw-r--r--krebs/1systems/hotdog/config.nix1
-rw-r--r--krebs/2configs/buildbot-stockholm.nix2
-rw-r--r--krebs/2configs/reaktor2.nix4
-rw-r--r--krebs/2configs/wiki.nix19
-rw-r--r--krebs/3modules/exim-smarthost.nix9
-rw-r--r--krebs/3modules/external/mic92.nix55
-rw-r--r--krebs/3modules/konsens.nix2
-rw-r--r--krebs/3modules/krebs/default.nix2
-rw-r--r--krebs/3modules/repo-sync.nix9
-rw-r--r--krebs/3modules/secret.nix68
-rw-r--r--krebs/3modules/tinc.nix10
-rw-r--r--krebs/nixpkgs-unstable.json6
-rw-r--r--krebs/nixpkgs.json6
-rw-r--r--lass/1systems/mors/physical.nix4
-rw-r--r--lass/1systems/skynet/config.nix5
-rw-r--r--lass/2configs/baseX.nix36
-rw-r--r--lass/2configs/binary-cache/server.nix8
-rw-r--r--lass/2configs/nfs-dl.nix8
-rw-r--r--lass/2configs/websites/sqlBackup.nix8
-rw-r--r--lass/3modules/default.nix1
-rw-r--r--lass/3modules/ejabberd/default.nix13
-rw-r--r--lass/3modules/klem.nix75
-rw-r--r--lass/5pkgs/custom/xmonad-lass/default.nix4
-rw-r--r--lib/default.nix3
-rw-r--r--lib/types.nix14
-rw-r--r--makefu/2configs/binary-cache/server.nix8
-rw-r--r--makefu/2configs/bureautomation/camera/comic.nix4
-rw-r--r--makefu/2configs/bureautomation/comic-updater.nix12
-rw-r--r--makefu/2configs/bureautomation/default.nix7
-rw-r--r--makefu/3modules/netdata.nix8
-rw-r--r--tv/2configs/binary-cache/default.nix8
-rw-r--r--tv/2configs/default.nix1
-rw-r--r--tv/3modules/charybdis/default.nix13
-rw-r--r--tv/3modules/ejabberd/default.nix13
-rw-r--r--tv/3modules/x0vncserver.nix13
36 files changed, 382 insertions, 80 deletions
diff --git a/jeschli/5pkgs/firefox/firefox-with-config.nix b/jeschli/5pkgs/firefox/firefox-with-config.nix
index 9be6250d7..fc22c434e 100644
--- a/jeschli/5pkgs/firefox/firefox-with-config.nix
+++ b/jeschli/5pkgs/firefox/firefox-with-config.nix
@@ -5,7 +5,7 @@
, MPlayerPlugin, ffmpeg, xorg, libpulseaudio, libcanberra-gtk2
, jrePlugin, icedtea_web
, bluejeans, djview4, adobe-reader
-, google_talk_plugin, fribid, gnome3/*.gnome-shell*/
+, fribid, gnome3/*.gnome-shell*/
, esteidfirefoxplugin ? ""
, browserpass, chrome-gnome-shell, uget-integrator, plasma-browser-integration, bukubrow
, udev
@@ -82,7 +82,6 @@ let
++ lib.optional (cfg.enableMPlayer or false) (MPlayerPlugin browser)
++ lib.optional (supportsJDK && jre && jrePlugin ? mozillaPlugin) jrePlugin
++ lib.optional icedtea icedtea_web
- ++ lib.optional (cfg.enableGoogleTalkPlugin or false) google_talk_plugin
++ lib.optional (cfg.enableFriBIDPlugin or false) fribid
++ lib.optional (cfg.enableGnomeExtensions or false) gnome3.gnome-shell
++ lib.optional (cfg.enableBluejeans or false) bluejeans
diff --git a/krebs/1systems/hotdog/config.nix b/krebs/1systems/hotdog/config.nix
index 60ec625f2..bb84b1873 100644
--- a/krebs/1systems/hotdog/config.nix
+++ b/krebs/1systems/hotdog/config.nix
@@ -14,6 +14,7 @@
<stockholm/krebs/2configs/ircd.nix>
<stockholm/krebs/2configs/nscd-fix.nix>
<stockholm/krebs/2configs/reaktor2.nix>
+ <stockholm/krebs/2configs/wiki.nix>
];
krebs.build.host = config.krebs.hosts.hotdog;
diff --git a/krebs/2configs/buildbot-stockholm.nix b/krebs/2configs/buildbot-stockholm.nix
index 43dd96919..43a38a9f8 100644
--- a/krebs/2configs/buildbot-stockholm.nix
+++ b/krebs/2configs/buildbot-stockholm.nix
@@ -5,7 +5,7 @@
services.nginx = {
enable = true;
virtualHosts.build = {
- serverAliases = [ "build.${config.networking.hostName}.r" ];
+ serverAliases = [ "build.r" "build.${config.networking.hostName}.r" ];
locations."/".extraConfig = ''
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
diff --git a/krebs/2configs/reaktor2.nix b/krebs/2configs/reaktor2.nix
index f4fa2ca7c..72eff176b 100644
--- a/krebs/2configs/reaktor2.nix
+++ b/krebs/2configs/reaktor2.nix
@@ -14,7 +14,7 @@ let
confirmation=no
'';
in {
- pattern = "^${name}-([a-z]+)(?::\\s*(.*))?";
+ pattern = "^${name}-([a-z]+)(?::?\\s*(.*))?";
activate = "match";
command = 1;
arguments = [2];
@@ -76,7 +76,7 @@ let
};
}
{
- pattern = ''^(\S+)\s+([+-][1-9][0-9]*)\s+(\S+)$'';
+ pattern = ''^([\w-]*):?\s+([+-][1-9][0-9]*)\s+(\S+)$'';
activate = "match";
arguments = [1 2 3];
command = {
diff --git a/krebs/2configs/wiki.nix b/krebs/2configs/wiki.nix
new file mode 100644
index 000000000..2350e711e
--- /dev/null
+++ b/krebs/2configs/wiki.nix
@@ -0,0 +1,19 @@
+{ config, ... }:
+
+{
+ services.gollum = {
+ enable = true;
+ };
+ networking.firewall.allowedTCPPorts = [ 80 ];
+ services.nginx = {
+ enable = true;
+ virtualHosts.wiki = {
+ serverAliases = [ "wiki.r" "wiki.${config.networking.hostName}.r" ];
+ locations."/".extraConfig = ''
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection "upgrade";
+ proxy_pass http://127.0.0.1:${toString config.services.gollum.port};
+ '';
+ };
+ };
+}
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
index e988fb563..c5969caac 100644
--- a/krebs/3modules/exim-smarthost.nix
+++ b/krebs/3modules/exim-smarthost.nix
@@ -26,6 +26,7 @@ let
private_key = mkOption {
type = types.secret-file;
default = {
+ name = "exim.dkim_private_key/${config.domain}";
path = "/run/krebs.secret/${config.domain}.dkim_private_key";
owner.name = "exim";
source-path = toString <secrets> + "/${config.domain}.dkim.priv";
@@ -115,8 +116,12 @@ let
}));
systemd.services = mkIf (cfg.dkim != []) {
exim = {
- after = [ "secret.service" ];
- requires = [ "secret.service" ];
+ after = flip map cfg.dkim (dkim:
+ config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
+ );
+ partOf = flip map cfg.dkim (dkim:
+ config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
+ );
};
};
krebs.exim = {
diff --git a/krebs/3modules/external/mic92.nix b/krebs/3modules/external/mic92.nix
index 23ab4f684..b8aaf9900 100644
--- a/krebs/3modules/external/mic92.nix
+++ b/krebs/3modules/external/mic92.nix
@@ -13,6 +13,11 @@ in {
amy = {
owner = config.krebs.users.Mic92;
nets = rec {
+ internet = {
+ ip4.addr = "129.215.165.57";
+ ip6.addr = "2001:630:3c1:164:b62e:99ff:fe3e:d369";
+ aliases = [ "amy.i" ];
+ };
retiolum = {
addrs = [
config.krebs.hosts.amy.nets.retiolum.ip4.addr
@@ -41,6 +46,11 @@ in {
clara = {
owner = config.krebs.users.Mic92;
nets = rec {
+ internet = {
+ ip4.addr = "129.215.165.58";
+ ip6.addr = "2001:630:3c1:164:b62e:99ff:fe3d:70f2";
+ aliases = [ "clara.i" ];
+ };
retiolum = {
addrs = [
config.krebs.hosts.clara.nets.retiolum.ip4.addr
@@ -92,6 +102,7 @@ in {
nets = rec {
internet = {
ip4.addr = "129.215.165.54";
+ ip6.addr = "2001:630:3c1:164:30a2:6e7b:c58b:cafd";
aliases = [ "donna.i" ];
};
retiolum = {
@@ -272,6 +283,7 @@ in {
nets = rec {
internet = {
ip4.addr = "129.215.165.53";
+ ip6.addr = "2001:630:3c1:164:6d4:c4ff:fe04:4aba";
aliases = [ "martha.i" ];
};
retiolum = {
@@ -355,6 +367,7 @@ in {
nets = rec {
internet = {
ip4.addr = "129.215.165.52";
+ ip6.addr = "2001:630:3c1:164:6d4:c4ff:fe04:4e4b";
aliases = [ "rose.i" ];
};
retiolum = {
@@ -411,5 +424,47 @@ in {
};
};
};
+ harsha = {
+ owner = config.krebs.users.Mic92;
+ nets = {
+ retiolum = {
+ ip4.addr = "10.243.29.184";
+ aliases = [
+ "harsha.r"
+ ];
+ tinc.pubkey = ''
+ -----BEGIN RSA PUBLIC KEY-----
+ MIIBCgKCAQEAqIc+ozq3hKHMe/X3v4j+6or8LMjEV7MtQ8/+n00xpG4NkI4G38Bv
+ 3nmAcV7OhN6of0fr0psbBmym+2VxCZbpl8E3g1GWSKpAvlmP/9v4wDVdrADaTvXC
+ pzCxejtCwEhKLisnMwCMJCuUPbIsSBU+IQDPKP7NP0yY5VapgW3Xl3qXpnehCW1r
+ NBZjZASnhSXcJRLJayEDN6uBviYrnnfbrHOx4fPcjQPTHX5RYr3EbgGZQO9xki44
+ 9dKT4EA95lupTqC3wzuQbaNpvIuVzmggiDY/NsBIVh0/2XjGnO54wtCEPudaLnWd
+ WNtc1wfVFB6gzgG1N7msOuFUReOIfyF/ywIDAQAB
+ -----END RSA PUBLIC KEY-----
+ '';
+ };
+ };
+ };
+ eva = {
+ owner = config.krebs.users.Mic92;
+ nets = {
+ retiolum = {
+ ip4.addr = "10.243.29.185";
+ aliases = [
+ "eva.r"
+ ];
+ tinc.pubkey = ''
+ -----BEGIN RSA PUBLIC KEY-----
+ MIIBCgKCAQEAqIc+ozq3hKHMe/X3v4j+6or8LMjEV7MtQ8/+n00xpG4NkI4G38Bv
+ 3nmAcV7OhN6of0fr0psbBmym+2VxCZbpl8E3g1GWSKpAvlmP/9v4wDVdrADaTvXC
+ pzCxejtCwEhKLisnMwCMJCuUPbIsSBU+IQDPKP7NP0yY5VapgW3Xl3qXpnehCW1r
+ NBZjZASnhSXcJRLJayEDN6uBviYrnnfbrHOx4fPcjQPTHX5RYr3EbgGZQO9xki44
+ 9dKT4EA95lupTqC3wzuQbaNpvIuVzmggiDY/NsBIVh0/2XjGnO54wtCEPudaLnWd
+ WNtc1wfVFB6gzgG1N7msOuFUReOIfyF/ywIDAQAB
+ -----END RSA PUBLIC KEY-----
+ '';
+ };
+ };
+ };
};
}
diff --git a/krebs/3modules/konsens.nix b/krebs/3modules/konsens.nix
index 74895a971..81486810b 100644
--- a/krebs/3modules/konsens.nix
+++ b/krebs/3modules/konsens.nix
@@ -56,7 +56,7 @@ let
systemd.services = mapAttrs' (name: repo:
nameValuePair "konsens-${name}" {
- after = [ "network.target" "secret.service" ];
+ after = [ "network.target" ];
path = [ pkgs.git ];
restartIfChanged = false;
serviceConfig = {
diff --git a/krebs/3modules/krebs/default.nix b/krebs/3modules/krebs/default.nix
index de09b4251..5e3ddcb2d 100644
--- a/krebs/3modules/krebs/default.nix
+++ b/krebs/3modules/krebs/default.nix
@@ -74,6 +74,8 @@ in {
"build.hotdog.r"
"cgit.hotdog.r"
"irc.r"
+ "wiki.r"
+ "wiki.hotdog.r"
];
tinc.pubkey = ''
-----BEGIN RSA PUBLIC KEY-----
diff --git a/krebs/3modules/repo-sync.nix b/krebs/3modules/repo-sync.nix
index 45d9d81c3..91111f3eb 100644
--- a/krebs/3modules/repo-sync.nix
+++ b/krebs/3modules/repo-sync.nix
@@ -124,6 +124,7 @@ let
privateKeyFile = mkOption {
type = types.secret-file;
default = {
+ name = "repo-sync-key";
path = "${cfg.stateDir}/ssh.priv";
owner = cfg.user;
source-path = toString <secrets> + "/repo-sync.ssh.key";
@@ -166,7 +167,13 @@ let
});
in nameValuePair "repo-sync-${name}" {
description = "repo-sync";
- after = [ "network.target" "secret.service" ];
+ after = [
+ config.krebs.secret.files.repo-sync-key.service
+ "network.target"
+ ];
+ partOf = [
+ config.krebs.secret.files.repo-sync-key.service
+ ];
environment = {
GIT_SSH_COMMAND = "${pkgs.openssh}/bin/ssh -i ${cfg.stateDir}/ssh.priv";
diff --git a/krebs/3modules/secret.nix b/krebs/3modules/secret.nix
index 672c503b0..bf2c62cc9 100644
--- a/krebs/3modules/secret.nix
+++ b/krebs/3modules/secret.nix
@@ -1,4 +1,5 @@
-{ config, lib, pkgs, ... }@args: with import <stockholm/lib>; let
+with import <stockholm/lib>;
+{ config, lib, pkgs, ... }: let
cfg = config.krebs.secret;
in {
options.krebs.secret = {
@@ -8,32 +9,43 @@ in {
};
};
config = lib.mkIf (cfg.files != {}) {
- systemd.services.secret = let
- # TODO fail if two files have the same path but differ otherwise
- files = unique (map (flip removeAttrs ["_module"])
- (attrValues cfg.files));
- in {
- serviceConfig = {
- Type = "oneshot";
- RemainAfterExit = "yes";
- SyslogIdentifier = "secret";
- ExecStart = pkgs.writeDash "install-secret-files" ''
- exit_code=0
- ${concatMapStringsSep "\n" (file: ''
- ${pkgs.coreutils}/bin/install \
- -D \
- --compare \
- --verbose \
- --mode=${shell.escape file.mode} \
- --owner=${shell.escape file.owner.name} \
- --group=${shell.escape file.group-name} \
- ${shell.escape file.source-path} \
- ${shell.escape file.path} \
- || exit_code=1
- '') files}
- exit $exit_code
- '';
- };
- };
+ systemd.paths =
+ mapAttrs'
+ (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
+ wantedBy = ["multi-user.target"];
+ pathConfig.PathChanged = file.source-path;
+ })
+ cfg.files;
+ systemd.services =
+ mapAttrs'
+ (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
+ wantedBy = ["multi-user.target"];
+ serviceConfig = {
+ Type = "oneshot";
+ ExecStart = "${pkgs.systemd}/bin/systemctl restart ${file.service}";
+ };
+ })
+ cfg.files
+ //
+ mapAttrs'
+ (name: file: nameValuePair "secret-${systemd.encodeName name}" {
+ wantedBy = ["multi-user.target"];
+ serviceConfig = {
+ Type = "oneshot";
+ RemainAfterExit = "yes";
+ ExecStart = toString [
+ "${pkgs.coreutils}/bin/install"
+ "-D"
+ "--compare"
+ "--verbose"
+ "--mode=${file.mode}"
+ "--owner=${file.owner.name}"
+ "--group=${file.group-name}"
+ file.source-path
+ file.path
+ ];
+ };
+ })
+ cfg.files;
};
}
diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix
index 8b6e959d4..1fca7de5c 100644
--- a/krebs/3modules/tinc.nix
+++ b/krebs/3modules/tinc.nix
@@ -158,6 +158,7 @@ let
privkey = mkOption {
type = types.secret-file;
default = {
+ name = "${tinc.config.netname}.rsa_key.priv";
path = "${tinc.config.user.home}/tinc.rsa_key.priv";
owner = tinc.config.user;
source-path = toString <secrets> + "/${tinc.config.netname}.rsa_key.priv";
@@ -219,9 +220,14 @@ let
iproute = cfg.iproutePackage;
in {
description = "Tinc daemon for ${netname}";
- after = [ "network.target" ];
+ after = [
+ config.krebs.secret.files."${netname}.rsa_key.priv".service
+ "network.target"
+ ];
+ partOf = [
+ config.krebs.secret.files."${netname}.rsa_key.priv".service
+ ];
wantedBy = [ "multi-user.target" ];
- requires = [ "secret.service" ];
path = [ tinc iproute ];
serviceConfig = rec {
Restart = "always";
diff --git a/krebs/nixpkgs-unstable.json b/krebs/nixpkgs-unstable.json
index c64d43862..1973a012a 100644
--- a/krebs/nixpkgs-unstable.json
+++ b/krebs/nixpkgs-unstable.json
@@ -1,7 +1,7 @@
{
"url": "https://github.com/NixOS/nixpkgs-channels",
- "rev": "0f5ce2fac0c726036ca69a5524c59a49e2973dd4",
- "date": "2020-05-19T01:31:20+02:00",
- "sha256": "0nkk492aa7pr0d30vv1aw192wc16wpa1j02925pldc09s9m9i0r3",
+ "rev": "8e2b14aceb1d40c7e8b84c03a7c78955359872bb",
+ "date": "2020-08-05T09:17:35+01:00",
+ "sha256": "0zzjpd9smr7rxzrdf6raw9kbj42fbvafxb5bz36lcxgv290pgsm8",
"fetchSubmodules": false
}
diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json
index cee3c5ec8..04684a220 100644
--- a/krebs/nixpkgs.json
+++ b/krebs/nixpkgs.json
@@ -1,7 +1,7 @@
{
"url": "https://github.com/NixOS/nixpkgs-channels",
- "rev": "e2bb73ce5f786b83e984b80199112f86b8a6cc9d",
- "date": "2020-06-07T23:11:12+02:00",
- "sha256": "0mpcdwhippvgsj3kj8vw35dgz94dnzgxgsfqqzcfpmvnzjc23vk7",
+ "rev": "e23e05452c67ce406debffa831290fb3abaabf0e",
+ "date": "2020-08-06T15:33:30+02:00",
+ "sha256": "10wlcm20bvak8cxjhfvmn0vm4n9da3zl19026h66zc1wfmcqgrkp",
"fetchSubmodules": false
}
diff --git a/lass/1systems/mors/physical.nix b/lass/1systems/mors/physical.nix
index 6828d70de..2f3a68442 100644
--- a/lass/1systems/mors/physical.nix
+++ b/lass/1systems/mors/physical.nix
@@ -23,7 +23,7 @@
services.udev.extraRules = ''
SUBSYSTEM=="net", DEVPATH=="/devices/pci*/*1c.1/*/net/*", NAME="wl0"
- SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:c4:7a:f1", NAME="et0"
+ SUBSYSTEM=="net", ATTR{address}=="3c:97:0e:4f:42:35", NAME="et0"
'';
#TODO activationScripts seem broken, fix them!
@@ -37,12 +37,10 @@
echo 'auto' > '/sys/bus/pci/devices/0000:00:1f.2/power/control'
echo 'auto' > '/sys/bus/pci/devices/0000:00:1f.0/power/control'
echo 'auto' > '/sys/bus/pci/devices/0000:00:1d.0/power/control'
- echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.3/power/control'
echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.0/power/control'
echo 'auto' > '/sys/bus/pci/devices/0000:00:1b.0/power/control'
echo 'auto' > '/sys/bus/pci/devices/0000:00:1a.0/power/control'
echo 'auto' > '/sys/bus/pci/devices/0000:00:19.0/power/control'
echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.1/power/control'
- echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.4/power/control'
'';
}
diff --git a/lass/1systems/skynet/config.nix b/lass/1systems/skynet/config.nix
index 70787e514..1bc440a98 100644
--- a/lass/1systems/skynet/config.nix
+++ b/lass/1systems/skynet/config.nix
@@ -36,7 +36,6 @@ with import <stockholm/lib>;
networking.wireless.enable = false;
networking.networkmanager.enable = true;
- services.logind.extraConfig = ''
- HandleLidSwitch=ignore
- '';
+ services.logind.lidSwitch = "ignore";
+ services.logind.lidSwitchDocked = "ignore";
}
diff --git a/lass/2configs/baseX.nix b/lass/2configs/baseX.nix
index 1185be9d4..baf93ffe5 100644
--- a/lass/2configs/baseX.nix
+++ b/lass/2configs/baseX.nix
@@ -91,6 +91,10 @@ in {
xorg.xhost
xsel
zathura
+ (pkgs.writeDashBin "screenshot" ''
+ ${pkgs.flameshot-once}/bin/flameshot-once
+ ${pkgs.klem}/bin/klem
+ '')
];
fonts.fonts = with pkgs; [
@@ -147,4 +151,36 @@ in {
krebs.xresources.enable = true;
lass.screenlock.enable = true;
+
+ lass.klem = {
+ kpaste.script = pkgs.writeDash "kpaste-wrapper" ''
+ ${pkgs.kpaste}/bin/kpaste \
+ | ${pkgs.coreutils}/bin/tail -1 \
+ | ${pkgs.coreutils}/bin/tr -d '\r\n'
+ '';
+ go = {
+ target = "STRING";
+ script = "${pkgs.goify}/bin/goify";
+ };
+ "go.lassul.us" = {
+ target = "STRING";
+ script = pkgs.writeDash "go.lassul.us" ''
+ export GO_HOST='go.lassul.us'
+ ${pkgs.goify}/bin/goify
+ '';
+ };
+ qrcode = {
+ target = "image";
+ script = pkgs.writeDash "zbar" ''
+ ${pkgs.zbar}/bin/zbarimg -q -
+ '';
+ };
+ ocr = {
+ target = "image";
+ script = pkgs.writeDash "gocr" ''
+ ${pkgs.netpbm}/bin/pngtopnm - \
+ | ${pkgs.gocr}/bin/gocr -
+ '';
+ };
+ };
}
diff --git a/lass/2configs/binary-cache/server.nix b/lass/2configs/binary-cache/server.nix
index d3775b5df..9b91035a8 100644
--- a/lass/2configs/binary-cache/server.nix
+++ b/lass/2configs/binary-cache/server.nix
@@ -9,8 +9,12 @@
};
systemd.services.nix-serve = {
- requires = ["secret.service"];
- after = ["secret.service"];
+ after = [
+ config.krebs.secret.files.nix-serve-key.service
+ ];
+ partOf = [
+ config.krebs.secret.files.nix-serve-key.service
+ ];
};
krebs.secret.files.nix-serve-key = {
path = "/run/secret/nix-serve.key";
diff --git a/lass/2configs/nfs-dl.nix b/lass/2configs/nfs-dl.nix
index ba53321b9..91b026455 100644
--- a/lass/2configs/nfs-dl.nix
+++ b/lass/2configs/nfs-dl.nix
@@ -3,17 +3,19 @@
device = "prism.w:/export/download";
fsType = "nfs";
options = [
- "timeo=14"
+ #"timeo=14"
"noauto"
"noatime"
"nodiratime"
- "noac"
- "nocto"
+ #"noac"
+ #"nocto"
"x-systemd.automount"
"x-systemd.device-timeout=1"
"x-systemd.idle-timeout=1min"
"x-systemd.requires=retiolum.service"
"x-systemd.requires=wpa_supplicant.service"
+ "user"
+ "_netdev"
];
};
}
diff --git a/lass/2configs/websites/sqlBackup.nix b/lass/2configs/websites/sqlBackup.nix
index 10a6e4643..c9783bece 100644
--- a/lass/2configs/websites/sqlBackup.nix
+++ b/lass/2configs/websites/sqlBackup.nix
@@ -14,8 +14,12 @@
};
systemd.services.mysql = {
- requires = [ "secret.service" ];
- after = [ "secret.service" ];
+ after = [
+ config.krebs.secret.files.mysql_rootPassword.service
+ ];
+ partOf = [
+ config.krebs.secret.files.mysql_rootPassword.service
+ ];
};
lass.mysqlBackup = {
diff --git a/lass/3modules/default.nix b/lass/3modules/default.nix
index f6179c394..335658ed8 100644
--- a/lass/3modules/default.nix
+++ b/lass/3modules/default.nix
@@ -6,6 +6,7 @@ _:
./folderPerms.nix
./hass.nix
./hosts.nix
+ ./klem.nix
./mysql-backup.nix
./news.nix
./nichtparasoup.nix
diff --git a/lass/3modules/ejabberd/default.nix b/lass/3modules/ejabberd/default.nix
index 4838a9093..20a38d572 100644
--- a/lass/3modules/ejabberd/default.nix
+++ b/lass/3modules/ejabberd/default.nix
@@ -17,6 +17,7 @@ in {
certfile = mkOption {
type = types.secret-file;
default = {
+ name = "ejabberd-certfile";
path = "${cfg.user.home}/ejabberd.pem";
owner = cfg.user;
source-path = "/var/lib/acme/lassul.us/full.pem";
@@ -25,6 +26,7 @@ in {
dhfile = mkOption {
type = types.secret-file;
default = {
+ name = "ejabberd-dhfile";
path = "${cfg.user.home}/dhparams.pem";
owner = cfg.user;
source-path = "/dev/null";
@@ -74,8 +76,15 @@ in {
systemd.services.ejabberd = {
wantedBy = [ "multi-user.target" ];
- requires = [ "secret.service" ];
- after = [ "network.target" "secret.service" ];
+ after = [
+ config.krebs.secret.files.ejabberd-certfile.service
+ config.krebs.secret.files.ejabberd-s2s_certfile.service
+ "network.target"
+ ];
+ partOf = [
+ config.krebs.secret.files.ejabberd-certfile.service
+ config.krebs.secret.files.ejabberd-s2s_certfile.service
+ ];
serviceConfig = {
ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}";
ExecStart = "${cfg.pkgs.ejabberdctl}/bin/ejabberdctl foreground";
diff --git a/lass/3modules/klem.nix b/lass/3modules/klem.nix
new file mode 100644
index 000000000..a297adcd1
--- /dev/null
+++ b/lass/3modules/klem.nix
@@ -0,0 +1,75 @@
+{ config, pkgs, ... }: with import <stockholm/lib>; let
+ cfg = config.lass.klem;
+in {
+ options.lass.klem = mkOption {
+ default = {};
+ type = types.attrsOf (types.submodule ({ config, ...}: {
+ options = {
+ target = mkOption {
+ default = ".*";
+ description = ''
+ regex of valid targets
+ can be shown with xclip -selection clipboard -t TARGETS
+ the first hit is taken as target argument
+ '';
+ type = types.str;
+ };
+ script = mkOption {
+ description = ''
+ file to run if entry is selected
+ '';
+ type = types.path;
+ };
+ label = mkOption {
+ default = config._module.args.name;
+ description = ''
+ label to show in dmenu for this script
+ '';
+ type = types.str;
+ };