summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--krebs/3modules/bepasty-server.nix8
-rw-r--r--krebs/3modules/lass/default.nix8
-rw-r--r--krebs/3modules/makefu/default.nix22
-rw-r--r--krebs/3modules/nginx.nix58
-rw-r--r--krebs/5pkgs/test/infest-cac-centos7/default.nix5
-rw-r--r--lass/1systems/helios.nix11
-rw-r--r--lass/1systems/mors.nix22
-rw-r--r--lass/1systems/prism.nix11
-rw-r--r--lass/1systems/uriel.nix9
-rw-r--r--lass/2configs/base.nix7
-rw-r--r--lass/2configs/browsers.nix13
-rw-r--r--lass/2configs/cbase.nix93
-rw-r--r--lass/2configs/retiolum.nix2
-rw-r--r--lass/2configs/weechat.nix13
-rw-r--r--lass/3modules/newsbot-js.nix2
-rw-r--r--makefu/1systems/omo.nix1
-rw-r--r--makefu/1systems/pornocauster.nix4
-rw-r--r--makefu/1systems/wry.nix4
-rw-r--r--makefu/2configs/default.nix9
-rw-r--r--makefu/2configs/deployment/mycube.connector.one.nix2
-rw-r--r--makefu/2configs/git/brain-retiolum.nix1
-rw-r--r--makefu/2configs/git/cgit-retiolum.nix2
-rw-r--r--makefu/2configs/iodined.nix4
-rw-r--r--makefu/2configs/laptop-utils.nix65
-rw-r--r--makefu/2configs/mail-client.nix8
-rw-r--r--makefu/2configs/main-laptop.nix12
-rw-r--r--makefu/5pkgs/default.nix3
-rw-r--r--makefu/5pkgs/mycube-flask/default.nix2
-rw-r--r--makefu/5pkgs/nodemcu-uploader/default.nix22
29 files changed, 325 insertions, 98 deletions
diff --git a/krebs/3modules/bepasty-server.nix b/krebs/3modules/bepasty-server.nix
index 9e777a5ef..cbf87b2a7 100644
--- a/krebs/3modules/bepasty-server.nix
+++ b/krebs/3modules/bepasty-server.nix
@@ -96,9 +96,13 @@ let
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
restartIfChanged = true;
- environment = {
+ environment = let
+ penv = python.buildEnv.override {
+ extraLibs = [ bepasty gevent ];
+ };
+ in {
BEPASTY_CONFIG = "${server.workDir}/bepasty-${name}.conf";
- PYTHONPATH= "${bepasty}/lib/${python.libPrefix}/site-packages:${gevent}/lib/${python.libPrefix}/site-packages";
+ PYTHONPATH= "${penv}/${python.sitePackages}/";
};
serviceConfig = {
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index 4bf10ac56..6220a2d6f 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -19,6 +19,7 @@ with config.krebs.lib;
addrs6 = ["42:0000:0000:0000:0000:0000:d15f:1233"];
aliases = [
"dishfire.retiolum"
+ "dishfire.r"
];
tinc.pubkey = ''
-----BEGIN RSA PUBLIC KEY-----
@@ -52,6 +53,7 @@ with config.krebs.lib;
"echelon.retiolum"
"cgit.echelon.retiolum"
"go.retiolum"
+ "go.r"
];
tinc.pubkey = ''
-----BEGIN RSA PUBLIC KEY-----
@@ -83,6 +85,7 @@ with config.krebs.lib;
addrs6 = ["42:0000:0000:0000:0000:0000:0000:15ab"];
aliases = [
"prism.retiolum"
+ "prism.r"
"cgit.prism.retiolum"
];
tinc.pubkey = ''
@@ -114,6 +117,7 @@ with config.krebs.lib;
addrs6 = ["42:422a:194f:ff3b:e196:2f82:5cf5:bc00"];
aliases = [
"fastpoke.retiolum"
+ "fastpoke.r"
"cgit.fastpoke.retiolum"
];
tinc.pubkey = ''
@@ -144,6 +148,7 @@ with config.krebs.lib;
addrs6 = ["42:941e:2816:35f4:5c5e:206b:3f0b:f762"];
aliases = [
"cloudkrebs.retiolum"
+ "cloudkrebs.r"
"cgit.cloudkrebs.retiolum"
];
tinc.pubkey = ''
@@ -173,6 +178,7 @@ with config.krebs.lib;
addrs6 = ["42:dc25:60cf:94ef:759b:d2b6:98a9:2e56"];
aliases = [
"uriel.retiolum"
+ "uriel.r"
"cgit.uriel.retiolum"
];
tinc.pubkey = ''
@@ -203,6 +209,7 @@ with config.krebs.lib;
addrs6 = ["42:0:0:0:0:0:0:dea7"];
aliases = [
"mors.retiolum"
+ "mors.r"
"cgit.mors.retiolum"
];
tinc.pubkey = ''
@@ -229,6 +236,7 @@ with config.krebs.lib;
addrs6 = ["42:0:0:0:0:0:0:7105"];
aliases = [
"helios.retiolum"
+ "helios.r"
"cgit.helios.retiolum"
];
tinc.pubkey = ''
diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index ccf21c868..24f0cdd84 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -221,17 +221,17 @@ with config.krebs.lib;
];
tinc.pubkey = ''
-----BEGIN RSA PUBLIC KEY-----
- MIICCgKCAgEAvmCBVNKT/Su4v9nl/Nm3STPo5QxWPg7xEkzIs3Oh39BS8+r6/7UQ
- rebib7mczb+ebZd+Rg2yFoGrWO8cmM0VcLy5bYRMK7in8XroLEjWecNNM4TRfNR4
- e53+LhcPdkxo0A3/D+yiut+A2Mkqe+4VXDm/JhAiAYkZTn7jUtj00Atrc7CWW1gN
- sP3jIgv4+CGftdSYOB4dm699B7OD9XDLci2kOaFqFl4cjDYUok03G0AduUlRx10v
- CKbKOTIdm8C36A902/3ms+Hyzkruu+VagGIZuPSwqXHJPCu7Ju+jarKQstMmpQi0
- PubweWDL0o/Dfz2qT3DuL4xDecIvGE6kv3m41hHJYiK+2/azTSehyPFbsVbL7w0V
- LgKN3usnZNcpTsBWxRGT7nMFSnX2FLDu7d9OfCuaXYxHVFLZaNrpccOq8NF/7Hbk
- DDW81W7CvLyJDlp0WLnAawSOGTUTPoYv/2wAapJ89i8QGCueGvEc6o2EcnBVMFEW
- ejWTQzyD816f4RsplnrRqLVlIMbr9Q/n5TvlgjjhX7IMEfMy4+7qLGRQkNbFzgwK
- jxNG2fFSCjOEQitm0gAtx7QRIyvYr6c7/xiHz4AwxYzBmvQsL/OK57NO4+Krwgj5
- Vk8TQ2jGO7J4bB38zaxK+Lrtfl8i1AK1171JqFMhOc34JSJ7T4LWDMECAwEAAQ==
+ MIICCgKCAgEAs9bq++H4HF8EpZMfWGfoIsh/C+YNO2pg74UPBsP/tFFe71yzWwUn
+ U9LW0n3bBqCMQ/oDthbSMwCkS9JzcUi22QJEdjbQs/aay9gZR115b+UxWPocw0Ms
+ ZoREKo3Oe0hETk7Ing8NdBDI0kCBh9QnvqQ3iKd0rBae3DYvcWlDsY93GLGMddgA
+ 7E9oa3EHVYH/MPZaeJtTknaJduanBSbiEb/xQOqxTadHoQASKU6DQD1czMH3hLG2
+ 8Wn4MBj9fgKBAoIy092tIzPtE2QwAHO73yz4mSW/3r190hREgVbjuEPiw4w5mEyQ
+ j+NeN3f3heFKx+GCgdWH9xPw6m6qPdqUiGUPq91KXMOhNa8lLcTp95mHdCMesZCF
+ TFj7hf6y+SVt17Vo+YUL7UqnMtAm3eZZmwyDu0DfKFrdgz6MtDD+5dQp9g8VHpqw
+ RfbaB1Srlr24EUYYoOBEF9CcIacFbsr+MKh+hQk5R0uEMSeAWARzxvvr69iMgdEC
+ zDiu0rrRLN+CrfgkDir7pkRKxeA1lz8KpySyIZRziNg6mSHjKjih4++Bbu4N2ack
+ 86h84qBrA8lq2xsub4+HgKZGH2l5Y8tvlr+rx0mQKEJkT6XDKCXZFPfl2N0QrWGT
+ Dv7l2vn0QMj9E6+BdRhYaO/m3+cIZ9faM851nRj/gq2OOtzW3ekrne0CAwEAAQ==
-----END RSA PUBLIC KEY-----
'';
};
diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix
index 2aa023443..196a6eae7 100644
--- a/krebs/3modules/nginx.nix
+++ b/krebs/3modules/nginx.nix
@@ -39,6 +39,34 @@ let
type = with types; string;
default = "";
};
+ ssl = mkOption {
+ type = with types; submodule ({
+ options = {
+ enable = mkEnableOption "ssl";
+ certificate = mkOption {
+ type = str;
+ };
+ certificate_key = mkOption {
+ type = str;
+ };
+ #TODO: check for valid cipher
+ ciphers = mkOption {
+ type = str;
+ default = "AES128+EECDH:AES128+EDH";
+ };
+ prefer_server_ciphers = mkOption {
+ type = bool;
+ default = true;
+ };
+ protocols = mkOption {
+ type = listOf (enum [ "SSLv2" "SSLv3" "TLSv1" "TLSv1.1" "TLSv1.2" ]);
+ default = [ "TLSv1.1" "TLSv1.2" ];
+
+ };
+ };
+ });
+ default = {};
+ };
};
});
default = {};
@@ -72,14 +100,28 @@ let
}
'';
- to-server = { server-names, listen, locations, extraConfig, ... }: ''
- server {
- ${concatMapStringsSep "\n" (x: "listen ${x};") listen}
- server_name ${toString server-names};
- ${indent extraConfig}
- ${indent (concatMapStrings to-location locations)}
- }
- '';
+ to-server = { server-names, listen, locations, extraConfig, ssl, ... }:
+ let
+ _extraConfig = if ssl.enable then
+ extraConfig + ''
+ ssl_certificate ${ssl.certificate};
+ ssl_certificate_key ${ssl.certificate_key};
+ ${optionalString ssl.prefer_server_ciphers "ssl_prefer_server_ciphers On;"}
+ ssl_ciphers ${ssl.ciphers};
+ ssl_protocols ${toString ssl.protocols};
+ ''
+ else
+ extraConfig
+ ;
+
+ in ''
+ server {
+ ${concatMapStringsSep "\n" (x: "listen ${x};") (listen ++ optional ssl.enable "443 ssl")}
+ server_name ${toString server-names};
+ ${indent _extraConfig}
+ ${indent (concatMapStrings to-location locations)}
+ }
+ '';
in
out
diff --git a/krebs/5pkgs/test/infest-cac-centos7/default.nix b/krebs/5pkgs/test/infest-cac-centos7/default.nix
index 3be4b1c41..f5fe84823 100644
--- a/krebs/5pkgs/test/infest-cac-centos7/default.nix
+++ b/krebs/5pkgs/test/infest-cac-centos7/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, coreutils,makeWrapper, cac-api, cac-cert, cac-panel, gnumake, gnused, jq, openssh, ... }:
+{ stdenv, coreutils, makeWrapper,
+ cac-api, cac-cert, cac-panel, gnumake, gnused, jq, openssh, sshpass,
+ ... }:
stdenv.mkDerivation rec {
name = "${shortname}-${version}";
@@ -21,6 +23,7 @@ stdenv.mkDerivation rec {
gnused
jq
openssh
+ sshpass
];
installPhase = ''
diff --git a/lass/1systems/helios.nix b/lass/1systems/helios.nix
index 0103b6ec0..2784375c2 100644
--- a/lass/1systems/helios.nix
+++ b/lass/1systems/helios.nix
@@ -19,12 +19,11 @@ with builtins;
# };
#}
{
- krebs.iptables = {
- tables = {
- filter.INPUT.rules = [
- { predicate = "-p tcp --dport 8000"; target = "ACCEPT"; precedence = 9001; }
- ];
- };
+ services.elasticsearch = {
+ enable = true;
+ plugins = [
+ pkgs.elasticsearchPlugins.elasticsearch_kopf
+ ];
};
}
];
diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index 9f492e2c6..b95e61a58 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -25,6 +25,7 @@
../2configs/teamviewer.nix
../2configs/libvirt.nix
../2configs/fetchWallpaper.nix
+ ../2configs/cbase.nix
#../2configs/buildbot-standalone.nix
{
#risk of rain port
@@ -141,7 +142,7 @@
services.elasticsearch = {
enable = true;
plugins = [
- pkgs.elasticsearchPlugins.elasticsearch_kopf
+ # pkgs.elasticsearchPlugins.elasticsearch_kopf
];
};
}
@@ -270,14 +271,14 @@
emulateWheel = true;
};
- services.xserver = {
- videoDriver = "intel";
- vaapiDrivers = [ pkgs.vaapiIntel ];
- deviceSection = ''
- Option "AccelMethod" "sna"
- BusID "PCI:0:2:0"
- '';
- };
+ #services.xserver = {
+ # videoDriver = "intel";
+ # vaapiDrivers = [ pkgs.vaapiIntel ];
+ # deviceSection = ''
+ # Option "AccelMethod" "sna"
+ # BusID "PCI:0:2:0"
+ # '';
+ #};
environment.systemPackages = with pkgs; [
cac-api
@@ -328,7 +329,4 @@
tapButtons = false;
twoFingerScroll = true;
};
-
- #for google hangout
- users.extraUsers.gm.extraGroups = [ "audio" "video" ];
}
diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix
index 05b3470e5..864e59b21 100644
--- a/lass/1systems/prism.nix
+++ b/lass/1systems/prism.nix
@@ -83,10 +83,10 @@ in {
{
sound.enable = false;
}
- {
- #workaround for server dying after 6-7h
- boot.kernelPackages = pkgs.linuxPackages_4_2;
- }
+ #{
+ # #workaround for server dying after 6-7h
+ # boot.kernelPackages = pkgs.linuxPackages_4_2;
+ #}
{
nixpkgs.config.allowUnfree = true;
}
@@ -119,7 +119,8 @@ in {
}
{
users.users.chat.openssh.authorizedKeys.keys = [
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDJJKlOeAHyi7lToCqRF/hdA2TrtVbrTUd2ayuWsXe9JWiyeyKH/LNY3SrgxCWPZSItE9VK68ghMuVYK/A8IAcgzNhzFYLDxmtsidjiOJBj2ZGsjqevoQ5HuKB/pob8CLW3dr1Rx38Any/XXxpfeO6vemCJMGLTe5gSlrCI+Tk1qNt0Rz+rke73Hwt9wW39g8X3prF2q9ryL9OFCcsoYUE7PIOV9xM1GaDFfTR4bKux7HyFKmG+rBvmJHB5OPW8UAtVZGY/FIChwlmF6QNO5Zym497bG1RCOGplaLpRXVJrmoUkZUO7EazePPxIjz2duWYqFtwl5R9YGy1+a+F58G19DS7wJHM29td117/ZANjRTxE5q/aJm2okJYOVSqhYzdhji+BWVZ5ai7cktpAdtPo++yiZN90LvogXNB64kFxVGuX52xZcA3KLKmvrd47o9k0pzO+oCoArxPFIx0YkHfy/yw7OG8Z+KLK8l9WXWBZO5TpjcydnEcRZ8OEqVhtmDh+9h1zhPphuFBtT1JPbt8m132RUy23qsNRtZ/lnnfQbrxgHPRzVuvA8o4ahOEUdvV9SYnzKb6qMFXGp25EhlcWnR4/toyG6I3paBtByeHkaxjgCuvm9Hob6f/xFr3kEJ4WXTVguyrcFgNg2EcEfdkrTMhNn9OIHEFFQ8whIBv5jlw== JuiceSSH"
+ "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAFhFJUMTfPbv3SzqlT9S67Av/m/ctLfTd3mMhD4O9hZc+t+dZmaHWj3v1KujzMBiDp3Yfo2YdVVZLTwTluHD8yNoQH418Vm01nrYHwOsc5J0br3mb0URZSstPiz6/6Fc+PNCDfQ2skUAWUidWiH+JolROFQ4y2lfpLOw+wsK2jj+Gqx6w== JuiceSSH"
+ config.krebs.users.lass-uriel.pubkey
];
}
{
diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix
index 0758164f0..4e4eca21f 100644
--- a/lass/1systems/uriel.nix
+++ b/lass/1systems/uriel.nix
@@ -15,15 +15,6 @@ with builtins;
../2configs/bitlbee.nix
../2configs/weechat.nix
../2configs/skype.nix
- {
- users.extraUsers = {
- root = {
- openssh.authorizedKeys.keys = map readFile [
- ../../krebs/Zpubkeys/uriel.ssh.pub
- ];
- };
- };
- }
];
krebs.build.host = config.krebs.hosts.uriel;
diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix
index d2c96fdaa..51a6d9da8 100644
--- a/lass/2configs/base.nix
+++ b/lass/2configs/base.nix
@@ -54,8 +54,8 @@ with config.krebs.lib;
#secrets-common = "/home/lass/secrets/common";
stockholm = "/home/lass/stockholm";
nixpkgs = {
- url = https://github.com/Lassulus/nixpkgs;
- rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce";
+ url = https://github.com/NixOS/nixpkgs;
+ rev = "40c586b7ce2c559374df435f46d673baf711c543";
dev = "/home/lass/src/nixpkgs";
};
} // optionalAttrs config.krebs.build.host.secure {
@@ -104,6 +104,9 @@ with config.krebs.lib;
#stuff for dl
aria2
+
+ #neat utils
+ krebspaste
];
programs.bash = {
diff --git a/lass/2configs/browsers.nix b/lass/2configs/browsers.nix
index eb764068b..47a16d4cb 100644
--- a/lass/2configs/browsers.nix
+++ b/lass/2configs/browsers.nix
@@ -1,6 +1,8 @@
{ config, lib, pkgs, ... }:
let
+ inherit (config.krebs.lib) genid;
+
mainUser = config.users.extraUsers.mainUser;
createChromiumUser = name: extraGroups: packages:
{
@@ -8,6 +10,7 @@ let
inherit name;
inherit extraGroups;
home = "/home/${name}";
+ uid = genid name;
useDefaultShell = true;
createHome = true;
};
@@ -28,6 +31,7 @@ let
inherit name;
inherit extraGroups;
home = "/home/${name}";
+ uid = genid name;
useDefaultShell = true;
createHome = true;
};
@@ -48,16 +52,17 @@ in {
environment.systemPackages = [
(pkgs.writeScriptBin "browser-select" ''
- BROWSER=$(echo -e "ff\ncr\nfb\ngm\nflash" | dmenu)
+ BROWSER=$(echo -e "ff\ncr\nwk\nfb\ngm\nflash" | dmenu)
$BROWSER $@
'')
];
imports = [
- ( createFirefoxUser "ff" [ "audio" ] [ ] )
+ ( createFirefoxUser "ff" [ "audio" ] [ pkgs.firefox ] )
( createChromiumUser "cr" [ "audio" ] [ pkgs.chromium ] )
- ( createChromiumUser "fb" [ ] [ pkgs.chromium ] )
- ( createChromiumUser "gm" [ ] [ pkgs.chromium ] )
+ ( createChromiumUser "wk" [ "audio" ] [ pkgs.chromium ] )
+ ( createChromiumUser "fb" [ "audio" ] [ pkgs.chromium ] )
+ ( createChromiumUser "gm" [ "audio" ] [ pkgs.chromium ] )
( createChromiumUser "flash" [ "audio" ] [ pkgs.flash ] )
];
diff --git a/lass/2configs/cbase.nix b/lass/2configs/cbase.nix
new file mode 100644
index 000000000..9d13bc30d
--- /dev/null
+++ b/lass/2configs/cbase.nix
@@ -0,0 +1,93 @@
+{ config, lib, pkgs, ... }:
+
+let
+ inherit (config.krebs.lib) genid;
+
+in {
+
+ users.extraUsers = {
+ cbasevpn = rec {
+ name = "cbasevpn";
+ uid = genid "cbasevpn";
+ description = "user for running c-base openvpn";
+ home = "/home/${name}";
+ };
+ };
+
+ users.extraGroups.cbasevpn.gid = genid "cbasevpn";
+
+ services.openvpn.servers = {
+ c-base = {
+ config = ''
+ client
+ dev tap
+ proto tcp
+ remote vpn.ext.c-base.org 1194
+ resolv-retry infinite
+ nobind
+ user cbasevpn
+ group cbasevpn
+ persist-key
+ persist-tun
+
+ auth-nocache
+ #auth-user-pass
+ auth-user-pass ${toString <secrets/cbase.txt>}
+
+ comp-lzo
+ verb 3
+
+ #script-security 2
+ #up /etc/openvpn/update-resolv-conf
+ #down /etc/openvpn/update-resolv-conf
+
+ <ca>
+ -----BEGIN CERTIFICATE-----
+ MIIDUjCCArugAwIBAgIJAOOk8EXgjsf5MA0GCSqGSIb3DQEBBQUAMHoxCzAJBgNV
+ BAYTAkRFMQswCQYDVQQIEwJERTEPMA0GA1UEBxMGQmVybGluMQ8wDQYDVQQKEwZj
+ LWJhc2UxGzAZBgNVBAMTEnZwbi5leHQuYy1iYXNlLm9yZzEfMB0GCSqGSIb3DQEJ
+ ARYQYWRtYXhAYy1iYXNlLm9yZzAeFw0wOTAyMTMwOTE1MzdaFw0xOTAyMTEwOTE1
+ MzdaMHoxCzAJBgNVBAYTAkRFMQswCQYDVQQIEwJERTEPMA0GA1UEBxMGQmVybGlu
+ MQ8wDQYDVQQKEwZjLWJhc2UxGzAZBgNVBAMTEnZwbi5leHQuYy1iYXNlLm9yZzEf
+ MB0GCSqGSIb3DQEJARYQYWRtYXhAYy1iYXNlLm9yZzCBnzANBgkqhkiG9w0BAQEF
+ AAOBjQAwgYkCgYEAt3wEgXbqFKxs8z/E4rv13hkRi6J+QdshNzntm7rTOmUsXKE7
+ IEwoJSglrmsDPv4UqE86A7bjW7YYSFjhzxFRkTEHJanyOCF48ZPItVl7Eq7T81co
+ uR+6lAhxnLDrwnPJCC83NzAa6lw8U1DsQRDkayKlrQrtZq6++pFFEvZvt1cCAwEA
+ AaOB3zCB3DAdBgNVHQ4EFgQUqkSbdXS90+HtqXDeAI+PcyTSSHEwgawGA1UdIwSB
+ pDCBoYAUqkSbdXS90+HtqXDeAI+PcyTSSHGhfqR8MHoxCzAJBgNVBAYTAkRFMQsw
+ CQYDVQQIEwJERTEPMA0GA1UEBxMGQmVybGluMQ8wDQYDVQQKEwZjLWJhc2UxGzAZ
+ BgNVBAMTEnZwbi5leHQuYy1iYXNlLm9yZzEfMB0GCSqGSIb3DQEJARYQYWRtYXhA
+ Yy1iYXNlLm9yZ4IJAOOk8EXgjsf5MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF
+ BQADgYEAOBANG1H4uEEWk3sbeQoSMeA3LFG1+6MgFGk2WAdeHYuV9GKYBq6/PLP5
+ ffw+FNkiDjLSeSQO88vHYJr2V1v8n/ZoCIT+1VBcDWXTpGz0YxDI1iBauO3tUPzK
+ wGs46RA/S0YwiZw64MaUHd88ZVadjKy9kNoO3w6/vpAS6s/Mh+o=
+ -----END CERTIFICATE-----
+ </ca>
+ key-direction 1
+ <tls-auth>
+ #
+ # 2048 bit OpenVPN static key
+ #
+ -----BEGIN OpenVPN Static key V1-----
+ 5d49aa8c9cec18de7ab6e0b5cd09a368
+ d3f1b8b77e055e448804fa0e14f487cb
+ 491681742f96b54a23fb8639aa9ed14e
+ c40b86a5546b888c4f3873f23c956e87
+ 169076ec869127ffc85353fd5928871c
+ da19776b79f723abb366fae6cdfe4ad6
+ 7ef667b7d05a7b78dfd5ea1d2da276dc
+ 5f6c82313fe9c1178c7256b8d1d081b0
+ 4c80bc8f21add61fbc52c158579edc1d
+ bbde230afb9d0e531624ce289a17098a
+ 3261f9144a9a2a6f0da4250c9eed4086
+ 187ec6fa757a454de743a349e32af193
+ e9f8b49b010014bdfb3240d992f2f234
+ 581d0ce05d4e07a2b588ad9b0555b704
+ 9d5edc28efde59226ec8942feed690a1
+ 2acd0c8bc9424d6074d0d495391023b6
+ -----END OpenVPN Static key V1-----
+ </tls-auth>
+ '';
+ };
+ };
+}
diff --git a/lass/2configs/retiolum.nix b/lass/2configs/retiolum.nix
index f8a63706e..1646cdea9 100644
--- a/lass/2configs/retiolum.nix
+++ b/lass/2configs/retiolum.nix
@@ -16,8 +16,6 @@
enable = true;
connectTo = [
"prism"
- "cloudkrebs"
- "echelon"
"pigstarter"
"gum"
"flap"
diff --git a/lass/2configs/weechat.nix b/lass/2configs/weechat.nix
index 6a257f0bb..98f5df42a 100644
--- a/lass/2configs/weechat.nix
+++ b/lass/2configs/weechat.nix
@@ -1,14 +1,17 @@
{ config, lib, pkgs, ... }:
-{
- krebs.per-user.chat.packages = [
- pkgs.weechat
- pkgs.tmux
+let
+ inherit (config.krebs.lib) genid;
+in {
+ krebs.per-user.chat.packages = with pkgs; [
+ mosh
+ tmux
+ weechat
];
users.extraUsers.chat = {
home = "/home/chat";
- uid = lib.genid "chat";
+ uid = genid "chat";
useDefaultShell = true;
createHome = true;
openssh.authorizedKeys.keys = [
diff --git a/lass/3modules/newsbot-js.nix b/lass/3modules/newsbot-js.nix
index 5e340b26f..0772971da 100644
--- a/lass/3modules/newsbot-js.nix
+++ b/lass/3modules/newsbot-js.nix
@@ -4,6 +4,8 @@ with builtins;
with lib;
let
+ inherit (config.krebs.lib) genid;
+
cfg = config.lass.newsbot-js;
out = {
diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix
index 6cff35e9d..ca0bfd2b5 100644
--- a/makefu/1systems/omo.nix
+++ b/makefu/1systems/omo.nix
@@ -40,7 +40,6 @@ in {
networking.firewall.allowedTCPPorts = [ 80 655 8080 ];
# services.openssh.allowSFTP = false;
- krebs.build.source.nixpkgs.rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce";
# copy config from <secrets/sabnzbd.ini> to /var/lib/sabnzbd/
services.sabnzbd.enable = true;
diff --git a/makefu/1systems/pornocauster.nix b/makefu/1systems/pornocauster.nix
index b2cf0be79..9415f2345 100644
--- a/makefu/1systems/pornocauster.nix
+++ b/makefu/1systems/pornocauster.nix
@@ -8,6 +8,7 @@
[ # Include the results of the hardware scan.
../.
../2configs/main-laptop.nix #< base-gui + zsh
+ ../2configs/laptop-utils.nix
# Krebs
../2configs/tinc-basic-retiolum.nix
@@ -39,6 +40,9 @@
nixpkgs.config.packageOverrides = pkgs: {
tinc = pkgs.tinc_pre;
};
+ # steam
+ hardware.opengl.driSupport32Bit = true;
+ hardware.pulseaudio.support32Bit = true;
# configure pulseAudio to provide a HDMI sink as well
networking.firewall.enable = true;
diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index 747321968..462ec4faf 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -11,7 +11,6 @@ in {
# TODO: copy this config or move to krebs
../../tv/2configs/hw/CAC.nix
../../tv/2configs/fs/CAC-CentOS-7-64bit.nix
- ../2configs/unstable-sources.nix
../2configs/headless.nix
../2configs/tinc-basic-retiolum.nix
@@ -28,7 +27,8 @@ in {
# collectd
../2configs/collectd/collectd-base.nix
];
-
+ services.nixosManual.enable = false;
+ programs.man.enable = false;
krebs.build.host = config.krebs.hosts.wry;
krebs.Reaktor = {
diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix
index 3043a1af3..313ccbec7 100644
--- a/makefu/2configs/default.nix
+++ b/makefu/2configs/default.nix
@@ -4,13 +4,6 @@ with config.krebs.lib;
{
system.stateVersion = "15.09";
- system.replaceRuntimeDependencies = with pkgs.lib;
- [{original = pkgs.glibc; replacement = pkgs.stdenv.lib.overrideDerivation pkgs.glibc (oldAttr: { patches = oldAttr.patches ++
- [(pkgs.fetchurl { url = "https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/development/libraries/glibc/cve-2015-7547.patch";
- sha256 = "0awpc4rp2x27rjpj83ps0rclmn73hsgfv2xxk18k82w4hdxqpp5r";})];
- });}
- ];
-
imports = [
{
users.extraUsers =
@@ -29,7 +22,7 @@ with config.krebs.lib;
source = mapAttrs (_: mkDefault) {
nixpkgs = {
url = https://github.com/nixos/nixpkgs;
- rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; # unstable @ 2015-01-27, tested on wry
+ rev = "40c586b7ce2c559374df435f46d673baf711c543"; # unstable @ 2016-02-27, tested on wry
};
secrets = "/home/makefu/secrets/${config.krebs.build.host.name}/";
stockholm = "/home/makefu/stockholm";
diff --git a/makefu/2configs/deployment/mycube.connector.one.nix b/makefu/2configs/deployment/mycube.connector.one.nix
index 38fc4a243..125b3dfff 100644
--- a/makefu/2configs/deployment/mycube.connector.one.nix
+++ b/makefu/2configs/deployment/mycube.connector.one.nix
@@ -16,7 +16,7 @@ in {
vassals = {
mycube-flask = {
type = "normal";
- python2Packages = self: with self; [ pkgs.mycube-flask flask redis werkzeug jinja2 markupsafe itsdangerous ];
+ pythonPackages = self: with self; [ pkgs.mycube-flask ];
socket = wsgi-sock;
};
};
diff --git a/makefu/2configs/git/brain-retiolum.nix b/makefu/2configs/git/brain-retiolum.nix
index 58fd250e5..80e4c87cf 100644
--- a/makefu/2configs/git/brain-retiolum.nix
+++ b/makefu/2configs/git/brain-retiolum.nix
@@ -14,6 +14,7 @@ let
priv-repos = mapAttrs make-priv-repo {
autosync = { };
+ pass = { };
};
# TODO move users to separate module
diff --git a/makefu/2configs/git/cgit-retiolum.nix b/makefu/2configs/git/cgit-retiolum.nix
index 15700e10d..0b69dbcaf 100644
--- a/makefu/2configs/git/cgit-retiolum.nix
+++ b/makefu/2configs/git/cgit-retiolum.nix
@@ -15,7 +15,7 @@ let
tinc_graphs = {
desc = "Tinc Advanced Graph Generation";
};
- cac = { };
+ cac-api = { };
init-stockholm = {
desc = "Init stuff for stockholm";
};
diff --git a/makefu/2configs/iodined.nix b/makefu/2configs/iodined.nix
index db8a1bfed..2e69d167c 100644
--- a/makefu/2configs/iodined.nix
+++ b/makefu/2configs/iodined.nix
@@ -1,4 +1,4 @@
-{ services,builtins,environment,pkgs, ... }:
+{ pkgs, config, ... }:
let
# TODO: make this a parameter
@@ -10,7 +10,7 @@ in {
enable =