diff options
| -rw-r--r-- | 0make/makefu/pnp.makefile | 4 | ||||
| -rw-r--r-- | 1systems/makefu/pnp.nix | 38 | ||||
| -rw-r--r-- | 2configs/makefu/base.nix | 96 | ||||
| -rw-r--r-- | 3modules/krebs/git.nix | 10 | ||||
| -rw-r--r-- | 3modules/krebs/retiolum.nix | 8 | ||||
| -rw-r--r-- | Zhosts/pnp | 11 | ||||
| -rw-r--r-- | Zpubkeys/makefu_arch.ssh.pub (renamed from Zpubkeys/makefu.ssh.pub) | 0 |
7 files changed, 164 insertions, 3 deletions
diff --git a/0make/makefu/pnp.makefile b/0make/makefu/pnp.makefile new file mode 100644 index 000000000..a18efe0e0 --- /dev/null +++ b/0make/makefu/pnp.makefile @@ -0,0 +1,4 @@ +deploy_host := root@pnp +nixpkgs_url := https://github.com/nixos/nixpkgs +nixpkgs_rev := 4c01e6d91993b6de128795f4fbdd25f6227fb870 +secrets_dir := /home/makefu/secrets/pnp diff --git a/1systems/makefu/pnp.nix b/1systems/makefu/pnp.nix new file mode 100644 index 000000000..51f5bb00c --- /dev/null +++ b/1systems/makefu/pnp.nix @@ -0,0 +1,38 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running ‘nixos-help’). + +{ config, pkgs, ... }: + +{ + imports = + [ # Include the results of the hardware scan. + <nixpkgs/nixos/modules/profiles/qemu-guest.nix> + ../../2configs/makefu/base.nix + ]; + boot.loader.grub.enable = true; + boot.loader.grub.version = 2; + boot.loader.grub.device = "/dev/vda"; + + boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ehci_pci" "virtio_pci" "virtio_blk" ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + hardware.enableAllFirmware = true; + hardware.cpu.amd.updateMicrocode = true; + + fileSystems."/" = + { device = "/dev/disk/by-label/nixos"; + fsType = "ext4"; + }; + + nix.maxJobs = 1; + networking.hostName = "pnp"; # Define your hostname. + +# $ nix-env -qaP | grep wget + environment.systemPackages = with pkgs; [ + wget + git + gnumake + ]; + +} diff --git a/2configs/makefu/base.nix b/2configs/makefu/base.nix new file mode 100644 index 000000000..ab2e6f247 --- /dev/null +++ b/2configs/makefu/base.nix @@ -0,0 +1,96 @@ +{ config, lib, pkgs, ... }: + +with lib; +{ + imports = [ ]; + users.extraUsers = { + root = { + openssh.authorizedKeys.keys = map readFile [ + ../../Zpubkeys/makefu_arch.ssh.pub + ]; + }; + makefu = { + uid = 9001; + group = "users"; + home = "/home/makefu"; + createHome = true; + useDefaultShell = true; + extraGroups = [ + "wheel" + ]; + openssh.authorizedKeys.keys = map readFile [ + ../../Zpubkeys/makefu_arch.ssh.pub + ]; + }; + }; + + services.openssh.enable = true; + nix.useChroot = true; + + users.mutableUsers = true; + + boot.tmpOnTmpfs = true; + systemd.tmpfiles.rules = [ + "d /tmp 1777 root root - -" + ]; + + environment.extraInit = '' + EDITOR=vim + ''; + + environment.systemPackages = with pkgs; [ + git + vim + rxvt_unicode.terminfo + ]; + + programs.bash = { + enableCompletion = true; + interactiveShellInit = '' + HISTCONTROL='erasedups:ignorespace' + HISTSIZE=900001 + HISTFILESIZE=$HISTSIZE + + shopt -s checkhash + shopt -s histappend histreedit histverify + shopt -s no_empty_cmd_completion + complete -d cd + + ''; + promptInit = '' + case $UID in + 0) PS1='\[\e[1;31m\]\w\[\e[0m\] ' ;; + 9001) PS1='\[\e[1;32m\]\w\[\e[0m\] ' ;; + *) PS1='\[\e[1;35m\]\u \[\e[1;32m\]\w\[\e[0m\] ' ;; + esac + if test -n "$SSH_CLIENT"; then + PS1='\[\033[35m\]\h'" $PS1" + fi + ''; + }; + environment.shellAliases = { + lsl = "ls -latr"; + }; + + security.setuidPrograms = [ "sendmail" ]; + + services.journald.extraConfig = '' + SystemMaxUse=1G + RuntimeMaxUse=128M + ''; + nixpkgs.config.packageOverrides = pkgs: { + nano = pkgs.runCommand "empty" {} "mkdir -p $out"; + }; + services.cron.enable = false; + services.nscd.enable = false; + boot.kernel.sysctl = { +# Enable IPv6 Privacy Extensions + "net.ipv6.conf.all.use_tempaddr" = 2; + "net.ipv6.conf.default.use_tempaddr" = 2; + }; + i18n = { + consoleKeyMap = "us"; + defaultLocale = "en_US.UTF-8"; + }; + +} diff --git a/3modules/krebs/git.nix b/3modules/krebs/git.nix index be6619b4b..499d33095 100644 --- a/3modules/krebs/git.nix +++ b/3modules/krebs/git.nix @@ -28,7 +28,15 @@ let cgit = mkOption { type = types.bool; default = true; - description = "Enable cgit."; # TODO better desc; talk about nginx + description = '' + Enable cgit. + Cgit is an attempt to create a fast web interface for the git version + control system, using a built in cache to decrease pressure on the + git server. + cgit in this module is being served via fastcgi nginx.This module + deploys a http://cgit.<hostname> nginx configuration and enables nginx + if not yet enabled. + ''; }; dataDir = mkOption { type = types.str; diff --git a/3modules/krebs/retiolum.nix b/3modules/krebs/retiolum.nix index 1406f2fc4..481d6565c 100644 --- a/3modules/krebs/retiolum.nix +++ b/3modules/krebs/retiolum.nix @@ -76,12 +76,16 @@ let # bad unsafe permissions... type = types.str; default = "/root/src/secrets/retiolum.rsa_key.priv"; - description = "Generate file with <literal>tincd -K</literal>."; + description = '' + Generate file with <literal>tincd -K</literal>. + This file must exist on the local system. The default points to + <secrets/retiolum.rsa_key.priv>. + ''; }; connectTo = mkOption { type = types.listOf types.str; - default = [ "fastpoke" "pigstarter" "kheurop" ]; + default = [ "fastpoke" "pigstarter" "gum" ]; description = '' The list of hosts in the network which the client will try to connect to. These hosts should have an 'Address' configured which points to a diff --git a/Zhosts/pnp b/Zhosts/pnp new file mode 100644 index 000000000..66c99f24d --- /dev/null +++ b/Zhosts/pnp @@ -0,0 +1,11 @@ +Subnet = 10.243.0.210 +Subnet = 42:f9f1:0000:0000:0000:0000:0000:0001 + +-----BEGIN RSA PUBLIC KEY----- +MIIBCgKCAQEAugkgEK4iy2C5+VZHwhjj/q3IOhhazE3TYHuipz37KxHWX8ZbjH+g +Ewtm79dVysujAOX8ZqV8nD8JgDAvkIZDp8FCIK0/rgckhpTsy1HVlHxa7ECrOS8V +pGz4xOxgcPFRbv5H2coHtbnfQc4GdA5fcNedQ3BP3T2Tn7n/dbbVs30bOP5V0EMR +SqZwNmtqaDQxOvjpPg9EoHvAYTevrpbbIst9UzCyvmNli9R+SsiDrzEPgB7zOc4T +TG12MT+XQr6JUu4jPpzdhb6H/36V6ADCIkBjzWh0iSfWGiFDQFinD+YSWbA1NOTr +Qtd1I3Ov+He7uc2Z719mb0Og2kCGnCnPIwIDAQAB +-----END RSA PUBLIC KEY----- diff --git a/Zpubkeys/makefu.ssh.pub b/Zpubkeys/makefu_arch.ssh.pub index 6092ec469..6092ec469 100644 --- a/Zpubkeys/makefu.ssh.pub +++ b/Zpubkeys/makefu_arch.ssh.pub |