summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--Makefile19
-rw-r--r--default.nix83
-rw-r--r--krebs/3modules/build/default.nix269
-rw-r--r--krebs/3modules/build/infest/finalize.sh (renamed from krebs/4lib/infest/4finalize)2
-rw-r--r--krebs/3modules/build/infest/install-nix.sh (renamed from krebs/4lib/infest/2install-nix)8
-rw-r--r--krebs/3modules/build/infest/prepare.sh (renamed from krebs/4lib/infest/1prepare)0
-rw-r--r--krebs/3modules/default.nix263
-rw-r--r--krebs/3modules/github-hosts-sync.nix2
-rw-r--r--krebs/3modules/retiolum.nix2
-rw-r--r--krebs/4lib/infest/3install-nix-tools9
-rw-r--r--krebs/4lib/types.nix10
-rw-r--r--krebs/5pkgs/cac/default.nix6
-rw-r--r--krebs/5pkgs/default.nix1
-rw-r--r--krebs/5pkgs/get/default.nix37
-rw-r--r--lass/2configs/base.nix2
-rw-r--r--lass/2configs/mc.nix346
-rw-r--r--makefu/1systems/pornocauster.nix19
-rw-r--r--makefu/2configs/base-sources.nix19
-rw-r--r--makefu/2configs/base.nix9
-rw-r--r--tv/1systems/cd.nix68
-rw-r--r--tv/1systems/mkdir.nix42
-rw-r--r--tv/1systems/nomic.nix15
-rw-r--r--tv/1systems/rmdir.nix35
-rw-r--r--tv/1systems/wu.nix23
-rw-r--r--tv/2configs/base.nix3
-rw-r--r--tv/2configs/charybdis.nix4
-rw-r--r--tv/2configs/exim-smarthost.nix55
-rw-r--r--tv/2configs/git.nix4
-rw-r--r--tv/3modules/consul.nix2
-rw-r--r--tv/3modules/ejabberd.nix2
30 files changed, 956 insertions, 403 deletions
diff --git a/Makefile b/Makefile
index b34278ced..3727793e8 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
# usage:
# make system=foo
# make systems='foo bar'
-# make eval system=foo get=config.networking.extraHosts [filter=json]
+# make eval get=tv.wu.config.time.timeZone [filter=json]
#
.ONESHELL:
@@ -10,20 +10,19 @@
ifdef systems
$(systems):
+ @
parallel \
--line-buffer \
-j0 \
--no-notice \
--tagstring {} \
- -q make systems= system={} ::: $(systems)
+ -q make -s systems= system={} ::: $(systems)
else ifdef system
-.PHONY: deploy
-deploy:;@
- make eval system=$(system) get=config.krebs.build.script filter=json | sh
-
-.PHONY: infest
-infest:;@
- make eval system=$(system) get=config.krebs.build.infest filter=json | sh
+.PHONY: deploy infest
+deploy infest:;@
+ export get=$$LOGNAME.${system}.config.krebs.build.scripts.$@
+ export filter=json
+ make -s eval | sh
.PHONY: eval
eval:
@@ -41,7 +40,7 @@ endif
-A "$$get" \
'<stockholm>' \
--argstr user-name "$$LOGNAME" \
- --argstr system-name "$$system" \
+ --argstr host-name "$$HOSTNAME" \
| filter
else
$(error unbound variable: system[s])
diff --git a/default.nix b/default.nix
index 875f0d5b4..64c69a2f4 100644
--- a/default.nix
+++ b/default.nix
@@ -1,26 +1,81 @@
-{ user-name, system-name }:
+{ user-name, host-name }:
let
+ lib = import <nixpkgs/lib>;
- eval = import <nixpkgs/nixos/lib/eval-config.nix> {
+ krebs-modules-path = ./krebs/3modules;
+ krebs-pkgs-path = ./krebs/5pkgs;
+ user-modules-path = ./. + "/${user-name}/3modules";
+ user-pkgs-path = ./. + "/${user-name}/5pkgs";
+
+ out =
+ (lib.mapAttrs (k: v: mk-namespace (./. + "/${k}"))
+ (lib.filterAttrs
+ (k: v: !lib.hasPrefix "." k && v == "directory")
+ (builtins.readDir ./.)));
+
+ eval = path: import <nixpkgs/nixos/lib/eval-config.nix> {
system = builtins.currentSystem;
- modules = map (p: ./. + "/${p}") [
- "${user-name}/1systems/${system-name}.nix"
- "${user-name}/3modules"
- "krebs/3modules"
+ modules = [
+ ({ config, ... }:
+ with import ./krebs/4lib { inherit lib; };
+ {
+ options.krebs.exec.host = mkOption {
+ type = types.host;
+ default = config.krebs.hosts.${host-name};
+ };
+ options.krebs.exec.user = mkOption {
+ type = types.user;
+ default = config.krebs.users.${user-name};
+ };
+ }
+ )
+ path
+ krebs-modules-path
+ user-modules-path
] ++ [
- ({ lib, pkgs, ... }: {
+ ({ config, lib, pkgs, ... }@args: {
_module.args.pkgs =
- (import ./krebs/5pkgs { inherit lib pkgs; }) //
- (import (./. + "/${user-name}/5pkgs") { inherit lib pkgs; });
+ (import krebs-pkgs-path args) //
+ (import user-pkgs-path args);
})
];
};
-in
+ mk-namespace = path: mapNixDir mk-system (path + "/1systems");
+
+ mk-system = path: rec {
+ inherit (eval path) config options;
+ system = config.system.build.toplevel;
+ fetch = import ./krebs/0tools/fetch.nix { inherit config lib; };
+ };
+
+ mapNixDir = f: path: lib.mapAttrs (_: f) (nixDir path);
+
+ nixDir = path:
+ builtins.listToAttrs
+ (catMaybes
+ (lib.mapAttrsToList
+ (k: v: {
+ directory =
+ let p = path + "/${k}/default.nix"; in
+ if builtins.pathExists p
+ then Just (lib.nameValuePair k p)
+ else Nothing;
+ regular =
+ let p = path + "/${k}"; in
+ if lib.hasSuffix ".nix" p
+ then Just (lib.nameValuePair (lib.removeSuffix ".nix" k) p)
+ else Nothing;
+ }.${v} or Nothing)
+ (builtins.readDir path)));
-{
- inherit (eval) config options;
+ # TODO move to lib
+ Just = x: { type = "maybe"; value = x; };
+ Nothing = { type = "maybe"; };
+ isMaybe = x: builtins.typeOf x == "set" && x.type or false == "maybe";
+ isJust = x: isMaybe x && builtins.hasAttr "value" x;
+ fromJust = x: assert isJust x; x.value;
+ catMaybes = xs: map fromJust (builtins.filter isJust xs);
- system = eval.config.system.build.toplevel;
-}
+in out
diff --git a/krebs/3modules/build/default.nix b/krebs/3modules/build/default.nix
new file mode 100644
index 000000000..4d2f36a02
--- /dev/null
+++ b/krebs/3modules/build/default.nix
@@ -0,0 +1,269 @@
+{ config, lib, ... }:
+
+with import ../../4lib { inherit lib; };
+
+let
+ target = config.krebs.build // { user.name = "root"; };
+
+ out = {
+ # TODO deprecate krebs.build.host
+ options.krebs.build.host = mkOption {
+ type = types.host;
+ };
+
+ # TODO make krebs.build.profile shell safe
+ options.krebs.build.profile = mkOption {
+ type = types.str;
+ default = "/nix/var/nix/profiles/system";
+ };
+
+ # TODO make krebs.build.target.host :: host
+ options.krebs.build.target = mkOption {
+ type = with types; nullOr str;
+ default = null;
+ };
+
+ # TODO deprecate krebs.build.user
+ options.krebs.build.user = mkOption {
+ type = types.user;
+ };
+
+ options.krebs.build.scripts.deploy = lib.mkOption {
+ type = lib.types.str;
+ default = ''
+ set -efu
+ (${config.krebs.build.scripts._source})
+ ${ssh-target ''
+ ${config.krebs.build.scripts._nix-env}
+ ${config.krebs.build.profile}/bin/switch-to-configuration switch
+ ''}
+ echo OK
+ '';
+ };
+
+ options.krebs.build.scripts.infest = lib.mkOption {
+ type = lib.types.str;
+ default = ''
+ set -efu
+
+ export RSYNC_RSH; RSYNC_RSH="$(type -p ssh) \
+ -o 'HostName ${target.host.infest.addr}' \
+ -o 'Port ${toString target.host.infest.port}' \
+ "
+ ssh() {
+ eval "$RSYNC_RSH \"\$@\""
+ }
+
+ ${ssh-target ''
+ ${readFile ./infest/prepare.sh}
+ ${readFile ./infest/install-nix.sh}
+ ''}
+
+ (${config.krebs.build.scripts._source})
+
+ ${ssh-target ''
+ export PATH; PATH=/root/.nix-profile/bin:$PATH
+
+ src=$(type -p nixos-install)
+ cat_src() {
+ sed < "$src" "$(
+ sed < "$src" -n '
+ /^if ! test -e "\$mountPoint\/\$NIXOS_CONFIG/,/^fi$/=
+ /^nixpkgs=/=
+ /^NIX_PATH=/,/^$/{/./=}
+ ' \
+ | sed 's:$:s/^/#krebs#/:'
+ )"
+ }
+
+ # Location to insert config.krebs.build.scripts._nix-env
+ i=$(sed -n '/^echo "building the system configuration/=' "$src")
+
+ {
+ cat_src | sed -n "1,$i{p}"
+ cat ${doc config.krebs.build.scripts._nix-env}
+ cat_src | sed -n "$i,\''${$i!p}"
+ } > nixos-install
+ chmod +x nixos-install
+
+ # Wrap inserted config.krebs.build.scripts._nix-env into chroot.
+ nix_env=$(cat_src | sed -n '
+ s:.*\(/nix/store/[a-z0-9]*-nix-[0-9.]\+/bin/nix-env\).*:\1:p;T;q
+ ')
+ echo nix-env is $nix_env
+ sed -i '
+ s:^nix-env:chroot $mountPoint '"$nix_env"':
+ ' nixos-install
+
+ ./nixos-install
+
+ ${readFile ./infest/finalize.sh}
+ ''}
+ '';
+ };
+
+ options.krebs.build.scripts._nix-env = lib.mkOption {
+ type = lib.types.str;
+ default = ''
+ set -efu
+ NIX_PATH=${config.krebs.build.source.NIX_PATH} \
+ nix-env \
+ -f '<stockholm>' \
+ -Q \
+ --argstr user-name ${config.krebs.exec.user.name} \
+ --argstr host-name ${target.host.name} \
+ --profile ${config.krebs.build.profile} \
+ --set \
+ -A ${lib.escapeShellArg (lib.concatStringsSep "." [
+ config.krebs.build.user.name
+ config.krebs.build.host.name
+ "system"
+ ])}
+ '';
+ };
+
+ options.krebs.build.scripts._source = lib.mkOption {
+ type = lib.types.str;
+ default = ''
+ set -efu
+ ${
+ lib.concatStringsSep "\n"
+ (lib.mapAttrsToList
+ (name: { scripts, url, ... }: "(${scripts._source})")
+ (config.krebs.build.source.dir //
+ config.krebs.build.source.git))
+ }
+ '';
+ };
+
+ options.krebs.build.source.NIX_PATH = mkOption {
+ type = types.str;
+ default =
+ lib.concatStringsSep ":"
+ (lib.mapAttrsToList (name: _: "${name}=/root/${name}")
+ (config.krebs.build.source.dir //
+ config.krebs.build.source.git));
+ };
+
+ options.krebs.build.source.dir = mkOption {
+ type =
+ let
+ exec = config.krebs.exec;
+ in
+ types.attrsOf (types.submodule ({ config, ... }:
+ let
+ url = "file://${config.host.name}${config.path}";
+
+ can-link = config.host.name == target.host.name;
+ can-push = config.host.name == exec.host.name;
+
+ push-method = ''
+ rsync \
+ --exclude .git \
+ --exclude .graveyard \
+ --exclude old \
+ --exclude tmp \
+ --rsync-path='mkdir -p ${config.target-path} && rsync' \
+ --delete-excluded \
+ -vrLptgoD \
+ ${config.path}/ \
+ ${target.user.name}@${target.host.name}:${config.target-path}
+ '';
+ in
+ {
+ options = {
+ host = mkOption {
+ type = types.host;
+ description = ''
+ define the host where the directory is stored on.
+ XXX: currently it is just used to check if rsync is working,
+ becomes part of url
+ '';
+ };
+ path = mkOption {
+ type = types.str;
+ };
+ scripts._source = mkOption {
+ type = types.str;
+ default =
+ #if can-link then link-method else
+ if can-push then push-method else
+ throw "cannot source ${url}";
+ };
+ target-path = mkOption {
+ type = types.str;
+ default = "/root/${config._module.args.name}";
+ };
+ url = mkOption {
+ type = types.str;
+ default = "file://${config.host.name}${config.path}";
+ };
+ };
+ }
+ ));
+ default = {};
+ };
+
+ options.krebs.build.source.git = mkOption {
+ type =
+ let
+ target = config.krebs.build // { user.name = "root"; };
+ in
+ with types; attrsOf (submodule ({ config, ... }:
+ {
+ options = {
+ url = mkOption {
+ type = types.str; # TODO must be shell safe
+ };
+ rev = mkOption {
+ type = types.str;
+ };
+ scripts._source = mkOption {
+ type = types.str;
+ default = ssh-target ''
+ mkdir -p ${config.target-path}
+ cd ${config.target-path}
+ if ! test -e .git; then
+ git init
+ fi
+ if ! cur_url=$(git config remote.origin.url 2>/dev/null); then
+ git remote add origin ${config.url}
+ elif test "$cur_url" != ${config.url}; then
+ git remote set-url origin ${config.url}
+ fi
+ if test "$(git rev-parse --verify HEAD 2>/dev/null)" != ${config.rev}; then
+ git fetch origin
+ git checkout ${config.rev} -- .
+ git checkout -q ${config.rev}
+ git submodule init
+ git submodule update
+ fi
+ git clean -dxf
+ '';
+ };
+ target-path = mkOption {
+ type = types.str;
+ default = "/root/${config._module.args.name}";
+ };
+ };
+ }
+ ));
+ default = {};
+ };
+ };
+
+ doc = s:
+ let b = "EOF${hashString "sha256" s}"; in
+ ''
+ <<\${b}
+ ${s}
+ ${b}
+ '';
+
+ ssh-target = script:
+ "ssh root@${target.host.name} -T ${doc ''
+ set -efu
+ ${script}
+ ''}";
+
+in out
diff --git a/krebs/4lib/infest/4finalize b/krebs/3modules/build/infest/finalize.sh
index d095fa31b..ced5a4d4d 100644
--- a/krebs/4lib/infest/4finalize
+++ b/krebs/3modules/build/infest/finalize.sh
@@ -7,7 +7,7 @@ set -eux
umount /mnt || [ $? -eq 32 ]
umount /boot || [ $? -eq 32 ]
- PATH=$(for i in /nix/store/*coreutils*/bin; do :; done; echo $i)
+ PATH=$(set +f; for i in /nix/store/*coreutils*/bin; do :; done; echo $i)
export PATH
mkdir /oldshit
diff --git a/krebs/4lib/infest/2install-nix b/krebs/3modules/build/infest/install-nix.sh
index 3021c1143..88c8c3e1e 100644
--- a/krebs/4lib/infest/2install-nix
+++ b/krebs/3modules/build/infest/install-nix.sh
@@ -2,9 +2,9 @@
set -efu
nix_url=https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-linux.tar.bz2
-nix_sha256="504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4"
+nix_sha256=504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4
-install-nix() {(
+install_nix() {(
# install nix on host (cf. https://nixos.org/nix/install)
if ! test -e /root/.nix-profile/etc/profile.d/nix.sh; then
@@ -23,7 +23,7 @@ install-nix() {(
$nix_src_dir/install
fi
- #TODO: make this general or move to 1prepare
+ #TODO: make this general or move to prepare
if ! mount | grep -Fq '/dev/mapper/centos-root on /mnt/nix type xfs'; then
mkdir -p /mnt/nix
mount --bind /nix /mnt/nix
@@ -54,4 +54,4 @@ install-nix() {(
fi
)}
-install-nix "$@"
+install_nix "$@"
diff --git a/krebs/4lib/infest/1prepare b/krebs/3modules/build/infest/prepare.sh
index 07c00c3a5..07c00c3a5 100644
--- a/krebs/4lib/infest/1prepare
+++ b/krebs/3modules/build/infest/prepare.sh
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index f88ef2194..dc30b9c50 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -6,6 +6,7 @@ let
out = {
imports = [
+ ./build
./exim-retiolum.nix
./exim-smarthost.nix
./github-hosts-sync.nix
@@ -22,225 +23,6 @@ let
api = {
enable = mkEnableOption "krebs";
- build = mkOption {
- type = types.submodule ({ config, ... }: {
- options = {
- target = mkOption {
- type = with types; nullOr str;
- default = null;
- };
- deps = mkOption {
- type = with types; attrsOf (submodule {
- options = {
- url = mkOption {
- type = str;
- };
- rev = mkOption {
- type = nullOr str;
- default = null;
- };
- };
- });
- default = {};
- };
- script = mkOption {
- type = types.str;
- default = ''
- #! /bin/sh
- set -efux
-
- target=${escapeShellArg cfg.build.target}
-
- push(){(
- src=$1/
- dst=$target:$2
- rsync \
- --exclude .git \
- --exclude .graveyard \
- --exclude old \
- --rsync-path="mkdir -p \"$2\" && rsync" \
- --delete-excluded \
- -vrLptgoD \
- "$src" "$dst"
- )}
-
- ${concatStrings (mapAttrsToList (name: { url, rev, ... }:
- optionalString (rev == null) ''
- push ${toString (map escapeShellArg [
- "${url}"
- "/root/src/${name}"
- ])}
- '') config.deps)}
-
- exec ssh -S none "$target" /bin/sh <<\EOF
- set -efux
- fetch(){(
- url=$1
- rev=$2
- dst=$3
- mkdir -p "$dst"
- cd "$dst"
- if ! test -e .git; then
- git init
- fi
- if ! cur_url=$(git config remote.origin.url 2>/dev/null); then
- git remote add origin "$url"
- elif test "$cur_url" != "$url"; then
- git remote set-url origin "$url"
- fi
- if test "$(git rev-parse --verify HEAD 2>/dev/null)" != "$rev"; then
- git fetch origin
- git checkout "$rev" -- .
- git checkout -q "$rev"
- git submodule init
- git submodule update
- fi
- git clean -dxf
- )}
-
- ${concatStrings (mapAttrsToList (name: { url, rev, ... }:
- optionalString (rev != null) ''
- fetch ${toString (map escapeShellArg [
- url
- rev
- "/root/src/${name}"
- ])}
- '') config.deps)}
-
- echo build system...
- profile=/nix/var/nix/profiles/system
- NIX_PATH=/root/src \
- nix-env \
- -Q \
- -p "$profile" \
- -f '<stockholm>' \
- --set \
- -A system \
- --argstr user-name ${escapeShellArg cfg.build.user.name} \
- --argstr system-name ${escapeShellArg cfg.build.host.name}
-
- exec "$profile"/bin/switch-to-configuration switch
- EOF
-
- '';
- };
- infest = mkOption {
- type = types.str;
- default = ''
- #! /bin/sh
- set -efux
-
- target=${escapeShellArg cfg.build.target}
-
- push(){(
- src=$1/
- dst=$target:/mnt$2
- rsync \
- --exclude .git \
- --exclude .graveyard \
- --exclude old \
- --rsync-path="mkdir -p \"/mnt$2\" && rsync" \
- --delete-excluded \
- -vrLptgoD \
- "$src" "$dst"
- )}
-
- cat krebs/4lib/infest/1prepare | ssh "$target"
- cat krebs/4lib/infest/2install-nix | ssh "$target"
-
- ${concatStrings (mapAttrsToList (name: { url, rev, ... }:
- optionalString (rev == null) ''
- push ${toString (map escapeShellArg [
- "${url}"
- "/root/src/${name}"
- ])}
- '') config.deps)}
-
- ssh -S none "$target" /bin/sh <<\EOF
- set -efux
-
- fetch(){(
- url=$1
- rev=$2
- dst=$3
- mkdir -p "$dst"
- cd "$dst"
- if ! test -e .git; then
- git init
- fi
- if ! cur_url=$(git config remote.origin.url 2>/dev/null); then
- git remote add origin "$url"
- elif test "$cur_url" != "$url"; then
- git remote set-url origin "$url"
- fi
- if test "$(git rev-parse --verify HEAD 2>/dev/null)" != "$rev"; then
- git fetch origin
- git checkout "$rev" -- .
- git checkout -q "$rev"
- git submodule init
- git submodule update
- fi
- git clean -dxf
- )}
-
- ${concatStrings (mapAttrsToList (name: { url, rev, ... }:
- optionalString (rev != null) ''
- fetch ${toString (map escapeShellArg [
- url
- rev
- "/mnt/root/src/${name}"
- ])}
- '') config.deps)}
-
- export PATH=/root/.nix-profile/bin:/root/.nix-profile/sbin:$PATH
-
- sed < "$(type -p nixos-install)" > nixos-install '
- /^echo "building the system configuration..."/,/--set -A system/{
- s/.*/# &/
- s@.*--set -A system.*@&\n${concatStringsSep " " [
- "NIX_PATH=/mnt/root/src/"
- "nix-env"
- "-Q"
- "-p /nix/var/nix/profiles/system"
- "-f \"<stockholm>\""
- "--set"
- "-A system"
- "--argstr user-name ${escapeShellArg cfg.build.user.name}"
- "--argstr system-name ${escapeShellArg cfg.build.host.name}"
- ]}@
- }
- '
-
- sed -i 's/^nixpkgs=.*$/#&/' nixos-install
-
-
- chmod +x nixos-install
-
- echo {} > /root/dummy.nix
-
- echo build system...
- profile=/nix/var/nix/profiles/system
- NIXOS_CONFIG=/root/dummy.nix \
- ./nixos-install -I /root/src/
- #nl -bp nixos-install
-
- EOF
-
- cat krebs/4lib/infest/4finalize | ssh "$target"
- '';
- };
- host = mkOption {
- type = types.host;
- };
- user = mkOption {
- type = types.user;
- };
- };
- });
- # Define defaul value, so unset values of the submodule get reported.
- default = {};
- };
-
dns = {
providers = mkOption {
# TODO with types; tree dns.label dns.provider, so we can merge.
@@ -537,8 +319,8 @@ let
extraZones = {
"krebsco.de" = ''
- mediengewitter IN A ${elemAt nets.internet.addrs4 0}
- flap IN A ${elemAt nets.internet.addrs4 0}'';
+ mediengewitter IN A ${head nets.internet.addrs4}
+ flap IN A ${head nets.internet.addrs4}'';
};
nets = {
internet = {
@@ -575,13 +357,13 @@ let
IN MX 10 mx42
euer IN MX 1 aspmx.l.google.com.
io IN NS pigstarter.krebsco.de.
- pigstarter IN A ${elemAt nets.internet.addrs4 0}
- conf IN A ${elemAt nets.internet.addrs4 0}
- gold IN A ${elemAt nets.internet.addrs4 0}
- graph IN A ${elemAt nets.internet.addrs4 0}
- tinc IN A ${elemAt nets.internet.addrs4 0}
- boot IN A ${elemAt nets.internet.addrs4 0}
- mx42 IN A ${elemAt nets.internet.addrs4 0}'';
+ pigstarter IN A ${head nets.internet.addrs4}
+ conf IN A ${head nets.internet.addrs4}
+ gold IN A ${head nets.internet.addrs4}
+ graph IN A ${head nets.internet.addrs4}
+ tinc IN A ${head nets.internet.addrs4}
+ boot IN A ${head nets.internet.addrs4}
+ mx42 IN A ${head nets.internet.addrs4}'';
};
nets = {
internet = {
@@ -615,7 +397,7 @@ let
dc = "makefu"; #dc = "cac";
extraZones = {
"krebsco.de" = ''
- wry IN A ${elemAt nets.internet.addrs4 0}
+ wry IN A ${head nets.internet.addrs4}
'';
};
nets = rec {
@@ -627,11 +409,10 @@ let
};
retiolum = {
via = internet;
- addrs4 = [""];
- addrs6 = [""];
+ addrs4 = ["10.243.29.169"];
+ addrs6 = ["42:6e1e:cc8a:7cef:827:f938:8c64:baad"];
aliases = [
"wry.retiolum"
- "cgit.cd.retiolum"
];
tinc.pubkey = ''
-----BEGIN RSA PUBLIC KEY-----
@@ -657,10 +438,10 @@ let
extraZones = {
"krebsco.de" = ''
- omo IN A ${elemAt nets.internet.addrs4 0}
- euer IN A ${elemAt nets.internet.addrs4 0}
- gum IN A ${elemAt nets.internet.addrs4 0}
- paste IN A ${elemAt nets.internet.addrs4 0}'';
+ omo IN A ${head nets.internet.addrs4}
+ euer IN A ${head nets.internet.addrs4}
+ gum IN A ${head nets.internet.addrs4}
+ paste IN A ${head nets.internet.addrs4}'';
};
nets = {
internet = {
@@ -747,12 +528,13 @@ let
};
};
};
- mkdir = {
+ mkdir = rec {
cores = 1;
dc = "tv"; #dc = "cac";
+ infest.addr = head nets.internet.addrs4;
nets = rec {
internet = {
- addrs4 = ["162.248.167.241"];
+ addrs4 = ["104.233.84.102"];
aliases = [
"mkdir.internet"
];
@@ -803,12 +585,13 @@ let
};
secure = true;
};
- rmdir = {
+ rmdir = rec {
cores = 1;
dc = "tv"; #dc = "cac";
+ infest.addr = head nets.internet.addrs4;
nets = rec {
internet = {
- addrs4 = ["167.88.44.94"];
+ addrs4 = ["104.233.84.70"];
aliases = [
"rmdir.internet"
];
diff --git a/krebs/3modules/github-hosts-sync.nix b/krebs/3modules/github-hosts-sync.nix
index dbc0cc1de..f44fe3ad8 100644
--- a/