diff options
28 files changed, 292 insertions, 53 deletions
diff --git a/krebs/3modules/Reaktor.nix b/krebs/3modules/Reaktor.nix index 407f1bce7..fce24fa63 100644 --- a/krebs/3modules/Reaktor.nix +++ b/krebs/3modules/Reaktor.nix @@ -40,7 +40,7 @@ let nickname = mkOption { default = config.krebs.build.host.name + "|r"; - type = types.str; + type = types.string; description = '' The nick name of the irc bot. Defaults to {hostname}|r @@ -58,7 +58,7 @@ let }; extraConfig = mkOption { default = ""; - type = types.str; + type = types.string; description = '' configuration appended to the default or overridden configuration ''; @@ -70,6 +70,12 @@ let the Reaktor pkg to use. ''; }; + debug = mkOption { + default = false; + description = '' + Reaktor debug output + ''; + }; }; imp = { @@ -101,6 +107,7 @@ let environment = { GIT_SSL_CAINFO = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; REAKTOR_NICKNAME = cfg.nickname; + REAKTOR_DEBUG = (if cfg.debug then "True" else "False"); }; serviceConfig= { ExecStartPre = pkgs.writeScript "Reaktor-init" '' @@ -115,8 +122,8 @@ let PrivateTmp = "true"; User = "Reaktor"; Restart = "on-abort"; - #StartLimitInterval = "5m"; - #StartLimitBurst = "1"; + StartLimitInterval = "1m"; + StartLimitBurst = "1"; }; }; }; diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 077a0e069..a6b5a1906 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -59,8 +59,6 @@ let --exclude .graveyard \ --exclude old \ --rsync-path="mkdir -p \"$2\" && rsync" \ - --usermap=\*:0 \ - --groupmap=\*:0 \ --delete-excluded \ -vrLptgoD \ "$src" "$dst" @@ -219,6 +217,37 @@ let lass-imp = { hosts = addNames { + echelon = { + cores = 4; + dc = "lass"; #dc = "cac"; + nets = rec { + internet = { + addrs4 = ["162.248.167.198"]; + aliases = [ + "echelon.internet" + ]; + }; + retiolum = { + via = internet; + addrs4 = ["10.243.206.103"]; + addrs6 = ["42:941e:2816:35f4:5c5e:206b:3f0b:f763"]; + aliases = [ + "echelon.retiolum" + "cgit.echelon.retiolum" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEA92ybhDahtGybpAkUNlG5Elxw05MVY4Pg7yK0dQugB4nVq+pnmi78 + DOMeIciecMHmJM8n9UlUU0eWZVCgHeVd23d6J0hTHCv24p24uHEGGy7XlO/dPJ6A + IjROYU0l8c03pipdJ3cDBx6riArSglwmZJ7xH/Iw0BUhRZrPqbtijY7EcG2wc+8K + N9N9mBofVMl4EcBiDR/eecK+ro8OkeOmYPtYgFJLvxTYXiPIhOxMAlkOY2fpin/t + cgFLUFuN4ag751XjjcNpVovVq95vdg+VhKrrNVWZjJt03owW81BzoryY6CD2kIPq + UxK89zEdeYOUT7AxaT/5V5v41IvGFZxCzwIDAQAB + -----END RSA PUBLIC KEY----- + ''; + }; + }; + }; cloudkrebs = { cores = 1; dc = "lass"; #dc = "cac"; diff --git a/krebs/5pkgs/Reaktor/default.nix b/krebs/5pkgs/Reaktor/default.nix index 0619d232b..524782081 100644 --- a/krebs/5pkgs/Reaktor/default.nix +++ b/krebs/5pkgs/Reaktor/default.nix @@ -2,14 +2,14 @@ python3Packages.buildPythonPackage rec { name = "Reaktor-${version}"; - version = "0.4.0"; + version = "0.4.3"; propagatedBuildInputs = with pkgs;[ python3Packages.docopt python3Packages.requests2 ]; src = fetchurl { url = "https://pypi.python.org/packages/source/R/Reaktor/Reaktor-${version}.tar.gz"; - sha256 = "0izwpq6smp86964hiddnk2bbx8g27nrzfbvdp790bjmnw6gk64nb"; + sha256 = "1rvfw9vg7i7z2ah7m5k3zik2b92d3xdaqa8am62qw6vgvmxcmfp4"; }; meta = { homepage = http://krebsco.de/; diff --git a/lass/1systems/echelon.nix b/lass/1systems/echelon.nix new file mode 100644 index 000000000..12765a101 --- /dev/null +++ b/lass/1systems/echelon.nix @@ -0,0 +1,42 @@ +{ config, pkgs, ... }: + +{ + imports = [ + ../../tv/2configs/CAC-Developer-2.nix + ../../tv/2configs/CAC-CentOS-7-64bit.nix + ../2configs/base.nix + ../2configs/retiolum.nix + ../2configs/fastpoke-pages.nix + ../2configs/new-repos.nix + { + networking.interfaces.enp2s1.ip4 = [ + { + address = "162.248.167.198"; + prefixLength = 24; + } + ]; + networking.defaultGateway = "162.248.167.1"; + networking.nameservers = [ + "8.8.8.8" + ]; + + } + ]; + + krebs.build = { + user = config.krebs.users.lass; + target = "root@162.248.167.198"; + host = config.krebs.hosts.echelon; + deps = { + secrets = { + url = "/home/lass/secrets/${config.krebs.build.host.name}"; + }; + stockholm = { + url = toString ../..; + }; + }; + }; + + networking.hostName = "cloudkrebs"; + +} diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix index 7c3d08123..bb98975e4 100644 --- a/lass/1systems/uriel.nix +++ b/lass/1systems/uriel.nix @@ -16,7 +16,7 @@ with builtins; users.extraUsers = { root = { openssh.authorizedKeys.keys = map readFile [ - ../../Zpubkeys/uriel.ssh.pub + ../../krebs/Zpubkeys/uriel.ssh.pub ]; }; }; diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix index d44a19c1e..b29d028d9 100644 --- a/lass/2configs/base.nix +++ b/lass/2configs/base.nix @@ -14,7 +14,7 @@ with lib; users.extraUsers = { root = { openssh.authorizedKeys.keys = map readFile [ - ../../Zpubkeys/lass.ssh.pub + ../../krebs/Zpubkeys/lass.ssh.pub ]; }; mainUser = { @@ -29,7 +29,7 @@ with lib; "wheel" ]; openssh.authorizedKeys.keys = map readFile [ - ../../Zpubkeys/lass.ssh.pub + ../../krebs/Zpubkeys/lass.ssh.pub ]; }; }; diff --git a/lass/2configs/browsers.nix b/lass/2configs/browsers.nix index 9849c829a..2aaeda63d 100644 --- a/lass/2configs/browsers.nix +++ b/lass/2configs/browsers.nix @@ -26,8 +26,17 @@ let ]; }; + #TODO: abstract this + in { + environment.systemPackages = [ + (simpleScript "browser-select" '' + BROWSER=$(echo -e "ff\ncr\nfb\ngm\nflash" | dmenu) + $BROWSER $@ + '') + ]; + imports = [ ../3modules/per-user.nix ] ++ [ diff --git a/lass/2configs/chromium-patched.nix b/lass/2configs/chromium-patched.nix index 715181778..d9d7760dd 100644 --- a/lass/2configs/chromium-patched.nix +++ b/lass/2configs/chromium-patched.nix @@ -37,12 +37,12 @@ let in { environment.etc."chromium/policies/managed/master.json".source = pkgs.lib.mkForce masterPolicy; - environment.systemPackages = [ - #pkgs.chromium - (pkgs.lib.overrideDerivation pkgs.chromium (attrs: { - buildCommand = attrs.buildCommand + '' - touch $out/TEST123 - ''; - })) - ]; + #environment.systemPackages = [ + # #pkgs.chromium + # (pkgs.lib.overrideDerivation pkgs.chromium (attrs: { + # buildCommand = attrs.buildCommand + '' + # touch $out/TEST123 + # ''; + # })) + #]; } diff --git a/lass/2configs/retiolum.nix b/lass/2configs/retiolum.nix index 7c7f2b4d4..17cd1d822 100644 --- a/lass/2configs/retiolum.nix +++ b/lass/2configs/retiolum.nix @@ -17,7 +17,7 @@ krebs.retiolum = { enable = true; - hosts = ../../Zhosts; + hosts = ../../krebs/Zhosts; connectTo = [ "fastpoke" "cloudkrebs" diff --git a/lass/2configs/steam.nix b/lass/2configs/steam.nix index 7d088fc6a..bd895e156 100644 --- a/lass/2configs/steam.nix +++ b/lass/2configs/steam.nix @@ -16,15 +16,14 @@ environment.systemPackages = with pkgs; [ steam ]; - networking.firewall = { - allowedUDPPorts = [ - 27031 - 27036 - ]; - allowedTCPPorts = [ - 27036 - 27037 - ]; + lass.iptables = { + tables = { + filter.INPUT.rules = [ + { predicate = "-p tcp --dport 27031"; target = "ACCEPT"; } + { predicate = "-p tcp --dport 27036"; target = "ACCEPT"; } + { predicate = "-p udp --dport 27031"; target = "ACCEPT"; } + { predicate = "-p udp --dport 27036"; target = "ACCEPT"; } + ]; + }; }; - } diff --git a/lass/2configs/virtualbox.nix b/lass/2configs/virtualbox.nix index ad7ac1429..9769cd68d 100644 --- a/lass/2configs/virtualbox.nix +++ b/lass/2configs/virtualbox.nix @@ -4,7 +4,6 @@ let mainUser = config.users.extraUsers.mainUser; in { - virtualisation.virtualbox.host.enable = true; users.extraUsers = { virtual = { diff --git a/lass/5pkgs/default.nix b/lass/5pkgs/default.nix index c776262ff..6df35b905 100644 --- a/lass/5pkgs/default.nix +++ b/lass/5pkgs/default.nix @@ -2,10 +2,8 @@ let inherit (pkgs) callPackage; - kpkgs = import ../../krebs/5pkgs { inherit pkgs; }; in -kpkgs // rec { bitlbee-dev = callPackage ./bitlbee-dev.nix {}; bitlbee-steam = callPackage ./bitlbee-steam.nix { inherit bitlbee-dev; }; diff --git a/makefu/1systems/pnp.nix b/makefu/1systems/pnp.nix index bbb99390d..98f3ecd22 100644 --- a/makefu/1systems/pnp.nix +++ b/makefu/1systems/pnp.nix @@ -7,26 +7,38 @@ { imports = [ # Include the results of the hardware scan. - <nixpkgs/nixos/modules/profiles/qemu-guest.nix> + # Base ../2configs/base.nix - ../2configs/cgit-retiolum.nix - # ../2configs/graphite-standalone.nix - ../2configs/vm-single-partition.nix ../2configs/tinc-basic-retiolum.nix + # HW/FS + <nixpkgs/nixos/modules/profiles/qemu-guest.nix> + ../2configs/fs/vm-single-partition.nix + + # Services + ../2configs/git/cgit-retiolum.nix + + ## Reaktor + ## \/ are only plugins, must enable Reaktor explicitly + ../2configs/Reaktor/stockholmLentil.nix + ../2configs/Reaktor/simpleExtend.nix + ../2configs/exim-retiolum.nix ../2configs/urlwatch.nix + + # ../2configs/graphite-standalone.nix ]; + krebs.Reaktor.enable = true; + krebs.build.host = config.krebs.hosts.pnp; krebs.build.user = config.krebs.users.makefu; krebs.build.target = "root@pnp"; - krebs.Reaktor.enable = true; krebs.build.deps = { nixpkgs = { url = https://github.com/NixOS/nixpkgs; - rev = "13576925552b1d0751498fdda22e91a055a1ff6c"; + rev = "03921972268934d900cc32dad253ff383926771c"; }; }; diff --git a/makefu/1systems/pornocauster.nix b/makefu/1systems/pornocauster.nix index 1e2c31257..4dcfe4eca 100644 --- a/makefu/1systems/pornocauster.nix +++ b/makefu/1systems/pornocauster.nix @@ -13,9 +13,7 @@ ../2configs/tinc-basic-retiolum.nix #../2configs/disable_v6.nix - #../2configs/sda-crypto-root.nix - ../2configs/sda-crypto-root-home.nix - + # environment ../2configs/zsh-user.nix # applications @@ -23,16 +21,22 @@ ../2configs/virtualization.nix ../2configs/wwan.nix - ../2configs/Reaktor/simpleExtend.nix + # services + ../2configs/git/brain-retiolum.nix + # ../2configs/Reaktor/simpleExtend.nix # hardware specifics are in here - ../2configs/tp-x220.nix + ../2configs/hw/tp-x220.nix + # mount points + ../2configs/fs/sda-crypto-root-home.nix ]; krebs.build.host = config.krebs.hosts.pornocauster; krebs.build.user = config.krebs.users.makefu; krebs.build.target = "root@pornocauster"; + #krebs.Reaktor.nickname = "makefu|r"; + networking.firewall.allowedTCPPorts = [ 25 ]; @@ -41,7 +45,7 @@ nixpkgs = { url = https://github.com/NixOS/nixpkgs; #url = https://github.com/makefu/nixpkgs; - rev = "13576925552b1d0751498fdda22e91a055a1ff6c"; + rev = "03921972268934d900cc32dad253ff383926771c"; }; }; } diff --git a/makefu/1systems/tsp.nix b/makefu/1systems/tsp.nix index 67db22460..3c2bb2eda 100644 --- a/makefu/1systems/tsp.nix +++ b/makefu/1systems/tsp.nix @@ -9,9 +9,9 @@ ../2configs/base.nix ../2configs/base-gui.nix ../2configs/tinc-basic-retiolum.nix - ../2configs/sda-crypto-root.nix + ../2configs/fs/sda-crypto-root.nix # hardware specifics are in here - ../2configs/tp-x200.nix #< imports tp-x2x0.nix + ../2configs/hw/tp-x200.nix #< imports tp-x2x0.nix ../2configs/disable_v6.nix ../2configs/rad1o.nix diff --git a/makefu/2configs/Reaktor/random-issue.sh b/makefu/2configs/Reaktor/random-issue.sh new file mode 100644 index 000000000..5c47c6156 --- /dev/null +++ b/makefu/2configs/Reaktor/random-issue.sh @@ -0,0 +1,20 @@ +#! /bin/sh +set -eu +# requires env: +# $state_dir +# $origin + +# in PATH: git,lentil,coreutils +subdir=`echo "$1" | tr -dc "[:alnum:]"` +name=`echo "$origin" | tr -dc "[:alnum:]"` +track="$state_dir/$name-checkout" +(if test -e "$track" ;then + cd "$track" + git fetch origin master + git reset --hard origin/master +else + git clone "$origin" "$track" +fi) >&2 + +cd "$track" +lentil "${subdir:-.}" -f csv | sed 1d | shuf | head -1 diff --git a/makefu/2configs/Reaktor/simpleExtend.nix b/makefu/2configs/Reaktor/simpleExtend.nix index 3b55ca412..95175a4e0 100644 --- a/makefu/2configs/Reaktor/simpleExtend.nix +++ b/makefu/2configs/Reaktor/simpleExtend.nix @@ -8,8 +8,6 @@ let echo "$PRETTY_NAME" ''; in { - krebs.Reaktor.enable = true; - krebs.Reaktor.nickname = "test-reaktor"; krebs.Reaktor.extraConfig = '' public_commands.insert(0,{ 'capname' : "nixos-version", diff --git a/makefu/2configs/Reaktor/stockholmLentil.nix b/makefu/2configs/Reaktor/stockholmLentil.nix new file mode 100644 index 000000000..147fb5a7a --- /dev/null +++ b/makefu/2configs/Reaktor/stockholmLentil.nix @@ -0,0 +1,22 @@ +{ config, lib, pkgs, ... }: + +with pkgs; +let + random-issue = pkgs.writeScript "random-issue" (builtins.readFile ./random-issue.sh); + random-issue-path = lib.makeSearchPath "bin" (with pkgs; [ + coreutils + git + gnused + lentil]); +in { + # TODO: make origin a variable, <- module is generic enough to handle different origins, not only stockholm + krebs.Reaktor.extraConfig = '' + public_commands.insert(0,{ + 'capname' : "stockholm-issue", + 'pattern' : indirect_pattern.format("stockholm-issue"), + 'argv' : ["${random-issue}"], + 'env' : { 'state_dir': workdir, + 'PATH':'${random-issue-path}', + 'origin':'http://cgit.pnp/stockholm' } }) + ''; +} diff --git a/makefu/2configs/fs/cac-boot-partition.nix b/makefu/2configs/fs/cac-boot-partition.nix new file mode 100644 index 000000000..fdf4b89d8 --- /dev/null +++ b/makefu/2configs/fs/cac-boot-partition.nix @@ -0,0 +1,23 @@ +{ config, lib, pkgs, ... }: + +# vda1 ext4 (label nixos) -> only root partition +with lib; +{ + boot.loader.grub.enable = true; + boot.loader.grub.version = 2; + boot.loader.grub.device = "/dev/sda"; + + fileSystems."/" = { + device = "/dev/disk/by-label/nixos"; + fsType = "ext4"; + }; + fileSystems."/boot" = { + device = "/dev/disk/by-label/boot"; + fsType = "ext4"; + }; + + hardware.enableAllFirmware = true; + nixpkgs.config.allowUnfree = true; + hardware.cpu.amd.updateMicrocode = true; + +} diff --git a/makefu/2configs/sda-crypto-root-home.nix b/makefu/2configs/fs/sda-crypto-root-home.nix index 3821c7504..3821c7504 100644 --- a/makefu/2configs/sda-crypto-root-home.nix +++ b/makefu/2configs/fs/sda-crypto-root-home.nix diff --git a/makefu/2configs/sda-crypto-root.nix b/makefu/2configs/fs/sda-crypto-root.nix index 54db87547..54db87547 100644 --- a/makefu/2configs/sda-crypto-root.nix +++ b/makefu/2configs/fs/sda-crypto-root.nix diff --git a/makefu/2configs/vm-single-partition.nix b/makefu/2configs/fs/vm-single-partition.nix index 78a5e7175..78a5e7175 100644 --- a/makefu/2configs/vm-single-partition.nix +++ b/makefu/2configs/fs/vm-single-partition.nix diff --git a/makefu/2configs/git/brain-retiolum.nix b/makefu/2configs/git/brain-retiolum.nix new file mode 100644 index 000000000..0ab64773f --- /dev/null +++ b/makefu/2configs/git/brain-retiolum.nix @@ -0,0 +1,77 @@ +{ config, lib, pkgs, ... }: +# TODO: remove tv lib :) +with import ../../../tv/4lib { inherit lib pkgs; }; +let + + repos = priv-repos // krebs-repos ; + rules = concatMap krebs-rules (attrValues krebs-repos) ++ concatMap priv-rules (attrValues priv-repos); + + krebs-repos = mapAttrs make-krebs-repo { + brain = { + desc = "braiiiins"; + }; + }; + + priv-repos = mapAttrs make-priv-repo { + autosync = { }; + }; + + # TODO move users to separate module + make-priv-repo = name: { desc ? null, ... }: { + inherit name desc; + public = false; + }; + + make-krebs-repo = with git; name: { desc ? null, ... }: { + inherit name desc; + public = false; + hooks = { + post-receive = git.irc-announce { + nick = config.networking.hostName; + channel = "#retiolum"; + # TODO remove the hardcoded hostname + server = "cd.retiolum"; + }; + }; + }; + + set-owners = with git;repo: user: + singleton { + inherit user; + repo = [ repo ]; + perm = push "refs/*" [ non-fast-forward create delete merge ]; + }; + + set-ro-access = with git; repo: user: + optional repo.public { + inherit user; + repo = [ repo ]; + perm = fetch; + }; + + # TODO: get the list of all krebsministers + krebsminister = with config.krebs.users; [ lass tv ]; + all-makefu = with config.krebs.users; [ makefu makefu-omo makefu-tsp ]; + + priv-rules = repo: set-owners repo all-makefu; + + krebs-rules = repo: + set-owners repo all-makefu ++ set-ro-access repo krebsminister; + +in { + imports = [{ + krebs.users.makefu-omo = { + name = "makefu-omo" ; + pubkey= with builtins; readFile ../../../krebs/Zpubkeys/makefu_omo.ssh.pub; + }; + krebs.users.makefu-tsp = { + name = "makefu-tsp" ; + pubkey= with builtins; readFile ../../../krebs/Zpubkeys/makefu_tsp.ssh.pub; + }; + }]; + krebs.git = { + enable = true; + cgit = false; + inherit repos rules; + }; +} diff --git a/makefu/2configs/cgit-retiolum.nix b/makefu/2configs/git/cgit-retiolum.nix index a40dabb3f..40b51e601 100644 --- a/makefu/2configs/cgit-retiolum.nix +++ b/makefu/2configs/git/cgit-retiolum.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: # TODO: remove tv lib :) -with import ../../tv/4lib { inherit lib pkgs; }; +with import ../../../tv/4lib { inherit lib pkgs; }; let repos = priv-repos // krebs-repos ; @@ -63,11 +63,11 @@ in { imports = [{ krebs.users.makefu-omo = { name = "makefu-omo" ; - pubkey= with builtins; readFile ../../krebs/Zpubkeys/makefu_omo.ssh.pub; + pubkey= with builtins; readFile ../../../krebs/Zpubkeys/makefu_omo.ssh.pub; }; krebs.users.makefu-tsp = { name = "makefu-tsp" ; - pubkey= with builtins; readFile ../../krebs/Zpubkeys/makefu_tsp.ssh.pub; + pubkey= with builtins; readFile ../../../krebs/Zpubkeys/makefu_tsp.ssh.pub; }; }]; krebs.git = { diff --git a/makefu/2configs/tp-x200.nix b/makefu/2configs/hw/tp-x200.nix index ed46875d8..ed46875d8 100644 --- a/makefu/2configs/tp-x200.nix +++ b/makefu/2configs/hw/tp-x200.nix diff --git a/makefu/2configs/tp-x220.nix b/makefu/2configs/hw/tp-x220.nix index f03922150..f03922150 100644 --- a/makefu/2configs/tp-x220.nix +++ b/makefu/2configs/hw/tp-x220.nix diff --git a/makefu/2configs/tp-x2x0.nix b/makefu/2configs/hw/tp-x2x0.nix index aa2fc2050..aa2fc2050 100644 --- a/makefu/2configs/tp-x2x0.nix +++ b/makefu/2configs/hw/tp-x2x0.nix diff --git a/makefu/3modules/default.nix b/makefu/3modules/default.nix index 015f472f7..417808425 100644 --- a/makefu/3modules/default.nix +++ b/makefu/3modules/default.nix @@ -1,6 +1,6 @@ { config, lib, ... }: -with import ../../krebs/4lib { inherit lib; }; +with lib; let cfg = config.krebs; |