summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--krebs/3modules/lass/default.nix2
-rw-r--r--krebs/3modules/makefu/default.nix2
-rw-r--r--lass/1systems/cloudkrebs.nix2
-rw-r--r--lass/1systems/echelon.nix3
-rw-r--r--lass/1systems/mors.nix2
-rw-r--r--lass/1systems/uriel.nix2
-rw-r--r--lass/2configs/git.nix (renamed from lass/2configs/new-repos.nix)4
-rw-r--r--lass/2configs/gitolite-base.nix173
-rw-r--r--lass/2configs/identity.nix50
-rw-r--r--makefu/1systems/wry.nix12
-rw-r--r--makefu/3modules/default.nix23
-rw-r--r--makefu/3modules/tinc_graphs.nix122
-rw-r--r--makefu/5pkgs/default.nix2
-rw-r--r--makefu/5pkgs/tinc_graphs/default.nix8
14 files changed, 156 insertions, 251 deletions
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index 0065f7692..aa071270c 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -9,7 +9,7 @@ with import ../../4lib { inherit lib; };
dc = "lass"; #dc = "cac";
nets = rec {
internet = {
- addrs4 = ["162.248.162.105"];
+ addrs4 = ["167.88.34.158"];
aliases = [
"echelon.internet"
];
diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index 9311be59d..b958514cc 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -169,6 +169,7 @@ with import ../../4lib { inherit lib; };
extraZones = {
"krebsco.de" = ''
wry IN A ${head nets.internet.addrs4}
+ graphs IN A ${head nets.internet.addrs4}
'';
};
nets = rec {
@@ -183,6 +184,7 @@ with import ../../4lib { inherit lib; };
addrs4 = ["10.243.29.169"];
addrs6 = ["42:6e1e:cc8a:7cef:827:f938:8c64:baad"];
aliases = [
+ "graphs.wry.retiolum"
"wry.retiolum"
];
tinc.pubkey = ''
diff --git a/lass/1systems/cloudkrebs.nix b/lass/1systems/cloudkrebs.nix
index 2a6a70ffd..0aca2146d 100644
--- a/lass/1systems/cloudkrebs.nix
+++ b/lass/1systems/cloudkrebs.nix
@@ -13,7 +13,7 @@ in {
../2configs/base.nix
../2configs/retiolum.nix
../2configs/fastpoke-pages.nix
- ../2configs/new-repos.nix
+ ../2configs/git.nix
../2configs/realwallpaper.nix
{
networking.interfaces.enp2s1.ip4 = [
diff --git a/lass/1systems/echelon.nix b/lass/1systems/echelon.nix
index 782674cb0..45f7ebd70 100644
--- a/lass/1systems/echelon.nix
+++ b/lass/1systems/echelon.nix
@@ -11,7 +11,8 @@ in {
../../tv/2configs/CAC-CentOS-7-64bit.nix
../2configs/base.nix
../2configs/retiolum.nix
- ../2configs/realwallpaper.nix
+ ../2configs/realwallpaper-server.nix
+ ../2configs/privoxy-retiolum.nix
{
networking.interfaces.enp2s1.ip4 = [
{
diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index 414afcbba..5cc03501f 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -17,7 +17,7 @@
../2configs/binary-caches.nix
#../2configs/ircd.nix
../2configs/chromium-patched.nix
- ../2configs/new-repos.nix
+ ../2configs/git.nix
#../../2configs/tv/synaptics.nix
../2configs/retiolum.nix
../2configs/wordpress.nix
diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix
index bd3770b43..62338d054 100644
--- a/lass/1systems/uriel.nix
+++ b/lass/1systems/uriel.nix
@@ -9,7 +9,7 @@ with builtins;
../2configs/pass.nix
../2configs/urxvt.nix
../2configs/bird.nix
- ../2configs/new-repos.nix
+ ../2configs/git.nix
../2configs/chromium-patched.nix
../2configs/retiolum.nix
../2configs/bitlbee.nix
diff --git a/lass/2configs/new-repos.nix b/lass/2configs/git.nix
index 3d293d654..78e6f0baa 100644
--- a/lass/2configs/new-repos.nix
+++ b/lass/2configs/git.nix
@@ -12,6 +12,10 @@ let
repos = mapAttrs (_: s: removeAttrs s ["collaborators"]) repos;
rules = rules;
};
+
+ krebs.iptables.tables.filter.INPUT.rules = [
+ { predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; }
+ ];
};
repos =
diff --git a/lass/2configs/gitolite-base.nix b/lass/2configs/gitolite-base.nix
deleted file mode 100644
index b47629956..000000000
--- a/lass/2configs/gitolite-base.nix
+++ /dev/null
@@ -1,173 +0,0 @@
-{ config, ... }:
-
-{
- services.gitolite = {
- mutable = false;
- keys = {
- lass = config.sshKeys.lass.pub;
- uriel = config.sshKeys.uriel.pub;
- };
- rc = ''
- %RC = (
- UMASK => 0077,
- GIT_CONFIG_KEYS => "",
- LOG_EXTRA => 1,
- ROLES => {
- READERS => 1,
- WRITERS => 1,
- },
- LOCAL_CODE => "$ENV{HOME}/.gitolite",
- ENABLE => [
- 'help',
- 'desc',
- 'info',
- 'perms',
- 'writable',
- 'ssh-authkeys',
- 'git-config',
- 'daemon',
- 'gitweb',
- 'repo-specific-hooks',
- ],
- );
- 1;
- '';
-
- repoSpecificHooks = {
- irc-announce = ''
- #! /bin/sh
- set -euf
-
- config_file="$GL_ADMIN_BASE/conf/irc-announce.conf"
- if test -f "$config_file"; then
- . "$config_file"
- fi
-
- # XXX when changing IRC_CHANNEL or IRC_SERVER/_PORT, don't forget to update
- # any relevant gitolite LOCAL_CODE!
- # CAVEAT we hope that IRC_NICK is unique
- IRC_NICK="''${IRC_NICK-gl$GL_TID}"
- IRC_CHANNEL="''${IRC_CHANNEL-#retiolum}"
- IRC_SERVER="''${IRC_SERVER-ire.retiolum}"
- IRC_PORT="''${IRC_PORT-6667}"
-
- # for privmsg_cat below
- export IRC_CHANNEL
-
- # collect users that are mentioned in the gitolite configuration
- interested_users="$(perl -e '
- do "gl-conf";
- print join(" ", keys%{ $one_repo{$ENV{"GL_REPO"}} });
- ')"
-
- # CAVEAT beware of real TABs in grep pattern!
- # CAVEAT there will never be more than 42 relevant log entries!
- tab=$(printf '\x09')
- log="$(tail -n 42 "$GL_LOGFILE" | grep "^[^$tab]*$tab$GL_TID$tab" || :)"
-
- update_log="$(echo "$log" | grep "^[^$tab]*$tab$GL_TID''${tab}update")"
-
- # (debug output)
- env | sed 's/^/env: /'
- echo "$log" | sed 's/^/log: /'
-
- # see http://gitolite.com/gitolite/dev-notes.html#lff
- reponame=$(echo "$update_log" | cut -f 4)
- username=$(echo "$update_log" | cut -f 5)
- ref_name=$(echo "$update_log" | cut -f 7 | sed 's|^refs/heads/||')
- old_sha=$(echo "$update_log" | cut -f 8)
- new_sha=$(echo "$update_log" | cut -f 9)
-
- # check if new branch is created
- if test $old_sha = 0000000000000000000000000000000000000000; then
- # TODO what should we really show?
- old_sha=$new_sha^
- fi
-
- #
- git_log="$(git log $old_sha..$new_sha --pretty=oneline --abbrev-commit)"
- commit_count=$(echo "$git_log" | wc -l)
-
- # echo2 and cat2 are used output to both, stdout and stderr
- # This is used to see what we send to the irc server. (debug output)
- echo2() { echo "$*"; echo "$*" >&2; }
- cat2() { tee /dev/stderr; }
-
- # privmsg_cat transforms stdin to a privmsg
- privmsg_cat() { awk '{ print "PRIVMSG "ENVIRON["IRC_CHANNEL"]" :"$0 }'; }
-
- # ircin is used to feed the output of netcat back to the "irc client"
- # so we can implement expect-like behavior with sed^_^
- # XXX mkselfdestructingtmpfifo would be nice instead of this cruft
- tmpdir="$(mktemp -d irc-announce_XXXXXXXX)"
- cd "$tmpdir"
- mkfifo ircin
- trap "
- rm ircin
- cd '$OLDPWD'
- rmdir '$tmpdir'
- trap - EXIT INT QUIT
- " EXIT INT QUIT
-
- #
- #
- #
- {
- echo2 "USER $LOGNAME 0 * :$LOGNAME@$(hostname)"
- echo2 "NICK $IRC_NICK"
-
- # wait for MODE message
- sed -n '/^:[^ ]* MODE /q'
-
- echo2 "JOIN $IRC_CHANNEL"
-
- echo "$interested_users" \
- | tr ' ' '\n' \
- | grep -v "^$GL_USER" \
- | sed 's/$/: poke/' \
- | privmsg_cat \
- | cat2
-
- printf '[\x0313%s\x03] %s pushed %s new commit%s to \x036%s %s\x03\n' \
- "$reponame" \
- "$username" \
- "$commit_count" \
- "$(test $commit_count = 1 || echo s)" \
- "$(hostname)" \
- "$ref_name" \
- | privmsg_cat \
- | cat2
-
- echo "$git_log" \
- | sed 's/^/\x0314/;s/ /\x03 /' \
- | privmsg_cat \
- | cat2
-
- echo2 "PART $IRC_CHANNEL"
-
- # wait for PART confirmation
- sed -n '/:'"$IRC_NICK"'![^ ]* PART /q'
-
- echo2 'QUIT :Gone to have lunch'
- } < ircin \
- | nc "$IRC_SERVER" "$IRC_PORT" | tee -a ircin
- '';
- };
- customFiles = [
- {
- path = ".gitolite/conf/irc-announce.conf";
- file = ''
- IRC_NICK="$(hostname)$GL_TID"
- case "$GL_REPO" in
- brain|painload|services|load-env|config)
- IRC_CHANNEL='#retiolum'
- ;;
- *)
- IRC_CHANNEL='&testing'
- ;;
- esac
- '';
- }
- ];
- };
-}
diff --git a/lass/2configs/identity.nix b/lass/2configs/identity.nix
deleted file mode 100644
index e712b16ac..000000000
--- a/lass/2configs/identity.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-{ config, ... }:
-
-{
- imports = [
- ../../tv/3modules/identity.nix
- ];
- tv.identity = {
- enable = true;
- search = "retiolum";
- hosts = {
- cloudkrebs = {
- cores = 1;
- dc = "lass"; #dc = "cac";
- nets = rec {
- internet = {
- addrs4 = ["104.167.113.104"];
- aliases = [
- "cloudkrebs.internet"
- ];
- };
- retiolum = {
- via = internet;
- addrs4 = ["10.243.206.102"];
- addrs6 = ["42:941e:2816:35f4:5c5e:206b:3f0b:f762"];
- aliases = [
- "cloudkrebs.retiolum"
- "cgit.cloudkrebs.retiolum"
- "habsys.de"
- "pixelpocket.de"
- "karlaskop.de"
- "ubikmedia.de"
- "apanowicz.de"
- "aidsballs.de"
- ];
- tinc.pubkey = ''
- -----BEGIN RSA PUBLIC KEY-----
- MIIBCgKCAQEAttUygCu7G6lIA9y+9rfTpLKIy2UgNDglUVoKZYLs8JPjtAtQVbtA
- OcWwwPc8ijLQvwJWa8e/shqSzSIrtOe+HJbRGdXLdBLtOuLKpz+ZFHcS+95RS5aF
- QTehg+QY7pvhbrrwKX936tkMR568suTQG6C8qNC/5jWYO/wIxFMhnQ2iRRKQOq1v
- 3aGGPC16KeXKVioY9KoV98S3n1rZW1JK07CIsZU4qb5txtLlW6FplJ7UmhVku1WC
- sgOOj9yi6Zk1t8R2Pwv9gxa3Hc270voj5U+I2hgLV/LjheE8yhQgYHEA4vXerPdO
- TGSATlSmMtE2NYGrKsLM7pKn286aSpXinwIDAQAB
- -----END RSA PUBLIC KEY-----
- '';
- };
- };
- };
- };
- };
-}
diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index b4cdab7cf..9368f1ae5 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -9,9 +9,8 @@ in {
../2configs/base.nix
../2configs/base-sources.nix
../2configs/tinc-basic-retiolum.nix
- {
- }
];
+
networking.firewall.allowPing = true;
networking.interfaces.enp2s1.ip4 = [
{
@@ -29,6 +28,15 @@ in {
# prepare graphs
nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
+ krebs.nginx.enable = true;
+ makefu.tinc_graphs.enable = true;
+ makefu.tinc_graphs.krebsNginx = {
+ enable = true;
+ hostnames_complete = [ "graphs.wry" "graphs.wry.retiolum" ];
+ # TODO: remove hard-coded path
+ hostnames_anonymous = [ "graphs.krebsco.de" ];
+ };
+ networking.firewall.allowedTCPPorts = [80];
krebs.build = {
user = config.krebs.users.makefu;
diff --git a/makefu/3modules/default.nix b/makefu/3modules/default.nix
index 417808425..598365c39 100644
--- a/makefu/3modules/default.nix
+++ b/makefu/3modules/default.nix
@@ -1,19 +1,8 @@
-{ config, lib, ... }:
+_:
-with lib;
-let
- cfg = config.krebs;
+{
+ imports = [
+ ./tinc_graphs.nix
+ ];
+}
- out = {
- imports = [
- ];
- options.krebs = api;
- config = mkIf cfg.enable imp;
- };
-
- api = { };
-
- imp = { };
-
-in
-out
diff --git a/makefu/3modules/tinc_graphs.nix b/makefu/3modules/tinc_graphs.nix
new file mode 100644
index 000000000..10f1b23a0
--- /dev/null
+++ b/makefu/3modules/tinc_graphs.nix
@@ -0,0 +1,122 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+ cfg = config.makefu.tinc_graphs;
+ internal_dir = "${cfg.workingDir}/internal";
+ external_dir = "${cfg.workingDir}/external";
+
+ out = {
+ options.makefu.tinc_graphs = api;
+ config = mkIf cfg.enable imp ;
+ };
+
+ api = {
+ enable = mkEnableOption "tinc graphs";
+
+ geodbPath = mkOption {
+ type = types.str;
+ description = "Path to geocitydb, defaults to geolite-legacy";
+ default = "${pkgs.geolite-legacy}/share/GeoIP/GeoIPCity.dat";
+ };
+
+ krebsNginx = {
+ # configure krebs nginx to serve the new graphs
+ enable = mkEnableOption "tinc_graphs nginx";
+
+ hostnames_complete = {
+ #TODO: this is not a secure way to serve these graphs,better listen to
+ # the correct interface, krebs.nginx does not support this yet
+
+ type = with types; listOf str;
+ description = "hostname which serves complete graphs";
+ default = config.krebs.build.host.name;
+ };
+
+ hostnames_anonymous = {
+ type = with types; listOf str;
+ description = ''
+ hostname which serves anonymous graphs
+ must be different from hostname_complete
+ '';
+ };
+ };
+
+ workingDir = mkOption {
+ type = types.str;
+ description = ''
+ Path to working dir, will create interal and external/.
+ Defaults to the new users home dir which defaults to
+ /var/cache/tinc_graphs'';
+ default = config.users.extraUsers.tinc_graphs.home;
+ };
+
+ timerConfig = mkOption {
+ type = with types; attrsOf str;
+ default = {
+ OnCalendar = "*:0/15";
+ };
+ };
+ };
+
+ imp = {
+ environment.systemPackages = [ pkgs.tinc_graphs];
+ systemd.timers.tinc_graphs = {
+ description = "Build Tinc Graphs via via timer";
+
+ timerConfig = cfg.timerConfig;
+ };
+ systemd.services.tinc_graphs = {
+ description = "Build Tinc Graphs";
+ wantedBy = [ "multi-user.target" ];
+ after = [ "network.target" ];
+ environment = {
+ EXTERNAL_FOLDER = external_dir;
+ INTERNAL_FOLDER = internal_dir;
+ GEODB = cfg.geodbPath;
+ };
+
+ restartIfChanged = true;
+
+ serviceConfig = {
+ Type = "simple";
+ ExecStartPre = pkgs.writeScript "tinc_graphs-init" ''
+ #!/bin/sh
+ mkdir -p "${external_dir}" "${internal_dir}"
+ '';
+ ExecStart = "${pkgs.tinc_graphs}/bin/all-the-graphs";
+ User = "root"; # tinc cannot be queried as user,
+ # seems to be a tinc-pre issue
+ privateTmp = true;
+ };
+ };
+
+ users.extraUsers.tinc_graphs = {
+ uid = 3925439960; #genid tinc_graphs
+ home = "/var/cache/tinc_graphs";
+ createHome = true;
+ };
+
+ krebs.nginx.servers = mkIf cfg.krebsNginx.enable {
+ tinc_graphs_complete = {
+ server-names = cfg.krebsNginx.hostnames_complete;
+ locations = [
+ (nameValuePair "/" ''
+ root ${internal_dir};
+ '')
+ ];
+ };
+ tinc_graphs_anonymous = {
+ server-names = cfg.krebsNginx.hostnames_anonymous;
+ #server-names = [ "dick" ];
+ locations = [
+ (nameValuePair "/" ''
+ root ${external_dir};
+ '')
+ ];
+ };
+ };
+ };
+
+in
+out
diff --git a/makefu/5pkgs/default.nix b/makefu/5pkgs/default.nix
index 15dab1100..b78183a2a 100644
--- a/makefu/5pkgs/default.nix
+++ b/makefu/5pkgs/default.nix
@@ -4,7 +4,7 @@ let
inherit (pkgs) callPackage;
in
{
- alsa-hdspmixer = callPackage ./alsa-tools { alsaToolTarget="hdspmixer";};
+ alsa-hdspmixer = callPackage ./alsa-tools { alsaToolTarget="hdspmixer";};
alsa-hdspconf = callPackage ./alsa-tools { alsaToolTarget="hdspconf";};
alsa-hdsploader = callPackage ./alsa-tools { alsaToolTarget="hdsploader";};
tinc_graphs = callPackage ./tinc_graphs {};
diff --git a/makefu/5pkgs/tinc_graphs/default.nix b/makefu/5pkgs/tinc_graphs/default.nix
index c35a8b02e..95f096a30 100644
--- a/makefu/5pkgs/tinc_graphs/default.nix
+++ b/makefu/5pkgs/tinc_graphs/default.nix
@@ -2,17 +2,19 @@
python3Packages.buildPythonPackage rec {
name = "tinc_graphs-${version}";
- version = "0.2.8";
+ version = "0.2.9";
propagatedBuildInputs = with pkgs;[
python3Packages.pygeoip
## ${geolite-legacy}/share/GeoIP/GeoIPCity.dat
];
src = fetchurl {
url = "https://pypi.python.org/packages/source/t/tinc_graphs/tinc_graphs-${version}.tar.gz";
- sha256 = "1rvy07ybjpqlsf9qizdp0zyq4ibd6w74k4glbbkw0x7j3j2skzdk";
+ sha256 = "0fm063qhjlb8g1xahwcqqrd2dxgd38wwi55rhl1k5chr7zajsqfz";
};
preFixup = with pkgs;''
- wrapProgram $out/bin/build-graphs --prefix PATH : "${imagemagick}/bin:${graphviz}/bin"
+ wrapProgram $out/bin/build-graphs --prefix PATH : "$out/bin"
+ wrapProgram $out/bin/all-the-graphs --prefix PATH : "${imagemagick}/bin:${graphviz}/bin:$out/bin"
+ wrapProgram $out/bin/tinc-stats2json --prefix PATH : "${tinc}/bin"
'';
meta = {
homepage = http://krebsco.de/;
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-14 09:41:06 +0000