summaryrefslogtreecommitdiffstats
path: root/krebs/3modules
diff options
context:
space:
mode:
Diffstat (limited to 'krebs/3modules')
-rw-r--r--krebs/3modules/backup.nix138
-rw-r--r--krebs/3modules/build.nix2
-rw-r--r--krebs/3modules/default.nix24
-rw-r--r--krebs/3modules/exim-retiolum.nix2
-rw-r--r--krebs/3modules/exim-smarthost.nix4
-rw-r--r--krebs/3modules/exim.nix80
-rw-r--r--krebs/3modules/fetchWallpaper.nix3
-rw-r--r--krebs/3modules/iptables.nix3
-rw-r--r--krebs/3modules/lass/default.nix52
-rw-r--r--krebs/3modules/lass/default.pgp95
-rw-r--r--krebs/3modules/makefu/default.nix126
-rw-r--r--krebs/3modules/miefda/default.nix4
-rw-r--r--krebs/3modules/mv/default.nix4
-rw-r--r--krebs/3modules/nginx.nix40
-rw-r--r--krebs/3modules/on-failure.nix8
-rw-r--r--krebs/3modules/retiolum.nix133
-rw-r--r--krebs/3modules/shared/default.nix10
-rw-r--r--krebs/3modules/tv/default.nix69
18 files changed, 427 insertions, 370 deletions
diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix
index d22dd3810..71b22d8cb 100644
--- a/krebs/3modules/backup.nix
+++ b/krebs/3modules/backup.nix
@@ -103,103 +103,91 @@ let
plan.method == method &&
config.krebs.build.host.name == plan.${side}.host.name;
- start = plan: pkgs.writeDash "backup.${plan.name}" ''
+ start = plan: let
+ login-name = "root";
+ identity = local.host.ssh.privkey.path;
+ ssh = "ssh -i ${shell.escape identity}";
+ local = getAttr plan.method {
+ push = plan.src // { rsync = src-rsync; };
+ pull = plan.dst // { rsync = dst-rsync; };
+ };
+ remote = getAttr plan.method {
+ push = plan.dst // { rsync = dst-rsync; };
+ pull = plan.src // { rsync = src-rsync; };
+ };
+ src-rsync = "rsync";
+ dst-rsync = concatStringsSep " && " [
+ "stat ${shell.escape plan.dst.path} >/dev/null"
+ "mkdir -m 0700 -p ${shell.escape plan.dst.path}/current"
+ "flock -n ${shell.escape plan.dst.path} rsync"
+ ];
+ in pkgs.writeScript "backup.${plan.name}" ''
+ #! ${pkgs.bash}/bin/bash
set -efu
+ start_date=$(date +%s)
+ ssh_target=${shell.escape login-name}@$(${fastest-address remote.host})
${getAttr plan.method {
push = ''
- identity=${shell.escape plan.src.host.ssh.privkey.path}
- src_path=${shell.escape plan.src.path}
- src=$src_path
- dst_user=root
- dst_host=$(${fastest-address plan.dst.host})
- dst_port=$(${network-ssh-port plan.dst.host "$dst_host"})
- dst_path=${shell.escape plan.dst.path}
- dst=$dst_user@$dst_host:$dst_path
- echo "update snapshot: current; $src -> $dst" >&2
- dst_shell() {
- exec ssh -F /dev/null \
- -i "$identity" \
- ''${dst_port:+-p $dst_port} \
- "$dst_user@$dst_host" \
- -T "$with_dst_path_lock_script"
- }
- rsh="ssh -F /dev/null -i $identity ''${dst_port:+-p $dst_port}"
- local_rsync() {
- rsync "$@"
- }
- remote_rsync=${shell.escape (concatStringsSep " && " [
- "mkdir -m 0700 -p ${shell.escape plan.dst.path}/current"
- "exec flock -n ${shell.escape plan.dst.path} rsync"
- ])}
+ rsync_src=${shell.escape plan.src.path}
+ rsync_dst=$ssh_target:${shell.escape plan.dst.path}
+ echo >&2 "update snapshot current; $rsync_src -> $rsync_dst"
'';
pull = ''
- identity=${shell.escape plan.dst.host.ssh.privkey.path}
- src_user=root
- src_host=$(${fastest-address plan.src.host})
- src_port=$(${network-ssh-port plan.src.host "$src_host"})
- src_path=${shell.escape plan.src.path}
- src=$src_user@$src_host:$src_path
- dst_path=${shell.escape plan.dst.path}
- dst=$dst_path
- echo "update snapshot: current; $dst <- $src" >&2
- dst_shell() {
- eval "$with_dst_path_lock_script"
- }
- rsh="ssh -F /dev/null -i $identity ''${src_port:+-p $src_port}"
- local_rsync() {
- mkdir -m 0700 -p ${shell.escape plan.dst.path}/current
- flock -n ${shell.escape plan.dst.path} rsync "$@"
- }
- remote_rsync=rsync
+ rsync_src=$ssh_target:${shell.escape plan.src.path}
+ rsync_dst=${shell.escape plan.dst.path}
+ echo >&2 "update snapshot current; $rsync_dst <- $rsync_src"
'';
}}
- # Note that this only works because we trust date +%s to produce output
- # that doesn't need quoting when used to generate a command string.
- # TODO relax this requirement by selectively allowing to inject variables
- # e.g.: ''${shell.quote "exec env NOW=''${shell.unquote "$NOW"} ..."}
- with_dst_path_lock_script="exec env start_date=$(date +%s) "${shell.escape
- "flock -n ${shell.escape plan.dst.path} /bin/sh"
- }
- local_rsync >&2 \
+ ${local.rsync} >&2 \
-aAXF --delete \
- --rsh="$rsh" \
- --rsync-path="$remote_rsync" \
- --link-dest="$dst_path/current" \
- "$src/" \
- "$dst/.partial"
- dst_shell < ${toFile "backup.${plan.name}.take-snapshots" ''
+ --rsh=${shell.escape ssh} \
+ --rsync-path=${shell.escape remote.rsync} \
+ --link-dest=${shell.escape plan.dst.path}/current \
+ "$rsync_src/" \
+ "$rsync_dst/.partial"
+
+ dst_exec() {
+ ${getAttr plan.method {
+ push = ''exec ${ssh} "$ssh_target" -T "exec$(printf ' %q' "$@")"'';
+ pull = ''exec "$@"'';
+ }}
+ }
+ dst_exec env \
+ start_date="$start_date" \
+ flock -n ${shell.escape plan.dst.path} \
+ /bin/sh < ${toFile "backup.${plan.name}.take-snapshots" ''
set -efu
: $start_date
- dst=${shell.escape plan.dst.path}
+ dst_path=${shell.escape plan.dst.path}
- mv "$dst/current" "$dst/.previous"
- mv "$dst/.partial" "$dst/current"
- rm -fR "$dst/.previous"
+ mv "$dst_path/current" "$dst_path/.previous"
+ mv "$dst_path/.partial" "$dst_path/current"
+ rm -fR "$dst_path/.previous"
echo >&2
snapshot() {(
: $ns $format $retain
name=$(date --date="@$start_date" +"$format")
- if ! test -e "$dst/$ns/$name"; then
+ if ! test -e "$dst_path/$ns/$name"; then
echo >&2 "create snapshot: $ns/$name"
- mkdir -m 0700 -p "$dst/$ns"
+ mkdir -m 0700 -p "$dst_path/$ns"
rsync >&2 \
-aAXF --delete \
- --link-dest="$dst/current" \
- "$dst/current/" \
- "$dst/$ns/.partial.$name"
- mv "$dst/$ns/.partial.$name" "$dst/$ns/$name"
+ --link-dest="$dst_path/current" \
+ "$dst_path/current/" \
+ "$dst_path/$ns/.partial.$name"
+ mv "$dst_path/$ns/.partial.$name" "$dst_path/$ns/$name"
echo >&2
fi
case $retain in
([0-9]*)
delete_from=$(($retain + 1))
- ls -r "$dst/$ns" \
+ ls -r "$dst_path/$ns" \
| sed -n "$delete_from,\$p" \
| while read old_name; do
echo >&2 "delete snapshot: $ns/$old_name"
- rm -fR "$dst/$ns/$old_name"
+ rm -fR "$dst_path/$ns/$old_name"
done
;;
(ALL)
@@ -227,24 +215,12 @@ let
| ${pkgs.coreutils}/bin/head -1; }
'';
- # Note that we don't escape word on purpose, so we can deref shell vars.
- # TODO type word
- network-ssh-port = host: word: ''
- case ${word} in
- ${concatStringsSep ";;\n" (mapAttrsToList
- (_: net: "(${head net.aliases}) echo ${toString net.ssh.port}")
- host.nets)};;
- esac
- '';
-
in out
# TODO ionice
-# TODO mail on failed push, pull
# TODO mail on missing push
# TODO don't cancel plans on activation
# also, don't hang while deploying at:
# starting the following units: backup.wu-home-xu.push.service, backup.wu-home-xu.push.timer
-# TODO make sure /bku is properly mounted
# TODO make sure that secure hosts cannot backup to insecure ones
# TODO optionally only backup when src and dst are near enough :)
# TODO try using btrfs for snapshots (configurable)
diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix
index d4c6b08df..9cd095622 100644
--- a/krebs/3modules/build.nix
+++ b/krebs/3modules/build.nix
@@ -88,6 +88,8 @@ let
#! /bin/sh
set -efu
+ export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
+
verbose() {
printf '%s%s\n' "$PS5$(printf ' %q' "$@")" >&2
"$@"
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index be530d46f..e87b33600 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -13,6 +13,7 @@ let
./buildbot/slave.nix
./build.nix
./current.nix
+ ./exim.nix
./exim-retiolum.nix
./exim-smarthost.nix
./fetchWallpaper.nix
@@ -218,7 +219,7 @@ let
(filter (hasSuffix ".${cfg.search-domain}")
longs);
add-port = a:
- if net.ssh.port != null
+ if net.ssh.port != 22
then "[${a}]:${toString net.ssh.port}"
else a;
in
@@ -228,8 +229,25 @@ let
publicKey = host.ssh.pubkey;
})
(filterAttrs (_: host: host.ssh.pubkey != null) cfg.hosts);
+
+ programs.ssh.extraConfig = concatMapStrings
+ (net: ''
+ Host ${toString (net.aliases ++ net.addrs)}
+ Port ${toString net.ssh.port}
+ '')
+ (filter
+ (net: net.ssh.port != 22)
+ (concatMap (host: attrValues host.nets)
+ (mapAttrsToList
+ (_: host: recursiveUpdate host
+ (optionalAttrs (hasAttr config.krebs.search-domain host.nets) {
+ nets."" = host.nets.${config.krebs.search-domain} // {
+ aliases = [host.name];
+ addrs = [];
+ };
+ }))
+ config.krebs.hosts)));
}
];
-in
-out
+in out
diff --git a/krebs/3modules/exim-retiolum.nix b/krebs/3modules/exim-retiolum.nix
index 696c48baf..8b6ac4a4e 100644
--- a/krebs/3modules/exim-retiolum.nix
+++ b/krebs/3modules/exim-retiolum.nix
@@ -32,7 +32,7 @@ let
};
imp = {
- services.exim = {
+ krebs.exim = {
enable = true;
config =
# This configuration makes only sense for retiolum-enabled hosts.
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
index cee10ce7d..8d9227039 100644
--- a/krebs/3modules/exim-smarthost.nix
+++ b/krebs/3modules/exim-smarthost.nix
@@ -105,7 +105,7 @@ let
requires = [ "secret.service" ];
};
};
- services.exim = {
+ krebs.exim = {
enable = true;
config = ''
keep_environment =
@@ -136,6 +136,8 @@ let
syslog_timestamp = false
syslog_duplication = false
+ tls_advertise_hosts =
+
begin acl
acl_check_rcpt:
diff --git a/krebs/3modules/exim.nix b/krebs/3modules/exim.nix
new file mode 100644
index 000000000..16a2a37b6
--- /dev/null
+++ b/krebs/3modules/exim.nix
@@ -0,0 +1,80 @@
+{ config, lib, pkgs, ... }: with config.krebs.lib; let
+ cfg = config.krebs.exim;
+in {
+ options.krebs.exim = {
+ enable = mkEnableOption "krebs.exim";
+ config = mkOption {
+ type = types.str;
+ default = "";
+ description = ''
+ Verbatim Exim configuration. This should not contain exim_user,
+ exim_group, exim_path, or spool_directory.
+ '';
+ };
+ user = mkOption {
+ type = types.user;
+ default = {
+ name = "exim";
+ home = "/var/spool/exim";
+ };
+ description = ''
+ User to use when no root privileges are required.
+ In particular, this applies when receiving messages and when doing
+ remote deliveries. (Local deliveries run as various non-root users,
+ typically as the owner of a local mailbox.) Specifying this value
+ as root is not supported.
+ '';
+ };
+ group = mkOption {
+ type = types.group;
+ default = {
+ name = "exim";
+ };
+ description = ''
+ Group to use when no root privileges are required.
+ '';
+ };
+ };
+ config = lib.mkIf cfg.enable {
+ environment = {
+ etc."exim.conf".text = ''
+ exim_user = ${cfg.user.name}
+ exim_group = ${cfg.group.name}
+ exim_path = /var/setuid-wrappers/exim
+ spool_directory = ${cfg.user.home}
+ ${cfg.config}
+ '';
+ systemPackages = [ pkgs.exim ];
+ };
+ krebs.setuid = {
+ exim = {
+ filename = "${pkgs.exim}/bin/exim";
+ mode = "4111";
+ };
+ sendmail = {
+ filename = "${pkgs.exim}/bin/exim";
+ mode = "4111";
+ };
+ };
+ systemd.services.exim = {
+ restartTriggers = [
+ config.environment.etc."exim.conf".source
+ ];
+ serviceConfig = {
+ ExecStart = "${pkgs.exim}/bin/exim -bdf -q30m";
+ ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+ };
+ wantedBy = [ "multi-user.target" ];
+ };
+ users = {
+ groups.${cfg.group.name} = {
+ inherit (cfg.group) name gid;
+ };
+ users.${cfg.user.name} = {
+ inherit (cfg.user) home name uid;
+ createHome = true;
+ group = cfg.group.name;
+ };
+ };
+ };
+}
diff --git a/krebs/3modules/fetchWallpaper.nix b/krebs/3modules/fetchWallpaper.nix
index bd3d6d3b2..0adcec3d8 100644
--- a/krebs/3modules/fetchWallpaper.nix
+++ b/krebs/3modules/fetchWallpaper.nix
@@ -40,8 +40,7 @@ let
};
};
- fetchWallpaperScript = pkgs.writeScript "fetchWallpaper" ''
- #! ${pkgs.bash}/bin/bash
+ fetchWallpaperScript = pkgs.writeDash "fetchWallpaper" ''
set -euf
mkdir -p ${shell.escape cfg.stateDir}
diff --git a/krebs/3modules/iptables.nix b/krebs/3modules/iptables.nix
index 9596229de..4b99873a1 100644
--- a/krebs/3modules/iptables.nix
+++ b/krebs/3modules/iptables.nix
@@ -20,6 +20,7 @@ let
flatten
length
hasAttr
+ hasPrefix
mkEnableOption
mkOption
mkIf
@@ -123,7 +124,7 @@ let
buildRule = tn: cn: rule:
#target validation test:
- assert (elem rule.target ([ "ACCEPT" "REJECT" "DROP" "QUEUE" "LOG" "RETURN" ] ++ (attrNames ts."${tn}")));
+ assert (elem rule.target ([ "ACCEPT" "REJECT" "DROP" "QUEUE" "LOG" "RETURN" ] ++ (attrNames ts."${tn}"))) || hasPrefix "REDIRECT" rule.target;
#predicate validation test:
#maybe use iptables-test
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index 3d54900e4..d36f35bd6 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -8,15 +8,16 @@ with config.krebs.lib;
cores = 4;
nets = rec {
internet = {
- addrs4 = ["144.76.172.188"];
+ ip4.addr = "144.76.172.188";
aliases = [
"dishfire.internet"
];
+ ssh.port = 45621;
};
retiolum = {
via = internet;
- addrs4 = ["10.243.133.99"];
- addrs6 = ["42:0000:0000:0000:0000:0000:d15f:1233"];
+ ip4.addr = "10.243.133.99";
+ ip6.addr = "42:0000:0000:0000:0000:0000:d15f:1233";
aliases = [
"dishfire.retiolum"
"dishfire.r"
@@ -40,15 +41,16 @@ with config.krebs.lib;
cores = 2;
nets = rec {
internet = {
- addrs4 = ["162.252.241.33"];
+ ip4.addr = "104.167.115.184";
aliases = [
"echelon.internet"
];
+ ssh.port = 45621;
};
retiolum = {
via = internet;
- addrs4 = ["10.243.206.103"];
- addrs6 = ["42:941e:2816:35f4:5c5e:206b:3f0b:f763"];
+ ip4.addr = "10.243.206.103";
+ ip6.addr = "42:941e:2816:35f4:5c5e:206b:3f0b:f763";
aliases = [
"echelon.retiolum"
"echelon.r"
@@ -75,15 +77,16 @@ with config.krebs.lib;
cores = 4;
nets = rec {
internet = {
- addrs4 = ["213.239.205.240"];
+ ip4.addr = "213.239.205.240";
aliases = [
"prism.internet"
];
+ ssh.port = 45621;
};
retiolum = {
via = internet;
- addrs4 = ["10.243.0.103"];
- addrs6 = ["42:0000:0000:0000:0000:0000:0000:15ab"];
+ ip4.addr = "10.243.0.103";
+ ip6.addr = "42:0000:0000:0000:0000:0000:0000:15ab";
aliases = [
"prism.retiolum"
"prism.r"
@@ -107,15 +110,15 @@ with config.krebs.lib;
fastpoke = {
nets = rec {
internet = {
- addrs4 = ["193.22.164.36"];
+ ip4.addr = "193.22.164.36";
aliases = [
"fastpoke.internet"
];
};
retiolum = {
via = internet;
- addrs4 = ["10.243.253.152"];
- addrs6 = ["42:422a:194f:ff3b:e196:2f82:5cf5:bc00"];
+ ip4.addr = "10.243.253.152";
+ ip6.addr = "42:422a:194f:ff3b:e196:2f82:5cf5:bc00";
aliases = [
"fastpoke.retiolum"
"fastpoke.r"
@@ -139,15 +142,16 @@ with config.krebs.lib;
cores = 1;
nets = rec {
internet = {
- addrs4 = ["104.167.113.104"];
+ ip4.addr = "104.167.113.104";
aliases = [
"cloudkrebs.internet"
];
+ ssh.port = 45621;
};
retiolum = {
via = internet;
- addrs4 = ["10.243.206.102"];
- addrs6 = ["42:941e:2816:35f4:5c5e:206b:3f0b:f762"];
+ ip4.addr = "10.243.206.102";
+ ip6.addr = "42:941e:2816:35f4:5c5e:206b:3f0b:f762";
aliases = [
"cloudkrebs.retiolum"
"cloudkrebs.r"
@@ -172,12 +176,13 @@ with config.krebs.lib;
cores = 1;
nets = {
gg23 = {
- addrs4 = ["10.23.1.12"];
+ ip4.addr = "10.23.1.12";
aliases = ["uriel.gg23"];
+ ssh.port = 45621;
};
retiolum = {
- addrs4 = ["10.243.81.176"];
- addrs6 = ["42:dc25:60cf:94ef:759b:d2b6:98a9:2e56"];
+ ip4.addr = "10.243.81.176";
+ ip6.addr = "42:dc25:60cf:94ef:759b:d2b6:98a9:2e56";
aliases = [
"uriel.retiolum"
"uriel.r"
@@ -203,12 +208,13 @@ with config.krebs.lib;
cores = 2;
nets = {
gg23 = {
- addrs4 = ["10.23.1.11"];
+ ip4.addr = "10.23.1.11";
aliases = ["mors.gg23"];
+ ssh.port = 45621;
};
retiolum = {
- addrs4 = ["10.243.0.2"];
- addrs6 = ["42:0:0:0:0:0:0:dea7"];
+ ip4.addr = "10.243.0.2";
+ ip6.addr = "42:0:0:0:0:0:0:dea7";
aliases = [
"mors.retiolum"
"mors.r"
@@ -234,8 +240,8 @@ with config.krebs.lib;
cores = 2;
nets = {
retiolum = {
- addrs4 = ["10.243.0.3"];
- addrs6 = ["42:0:0:0:0:0:0:7105"];
+ ip4.addr = "10.243.0.3";
+ ip6.addr = "42:0:0:0:0:0:0:7105";
aliases = [
"helios.retiolum"
"helios.r"
diff --git a/krebs/3modules/lass/default.pgp b/krebs/3modules/lass/default.pgp
index 38e2fa8df..6d985f0e2 100644
--- a/krebs/3modules/lass/default.pgp
+++ b/krebs/3modules/lass/default.pgp
@@ -1,52 +1,51 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2
-mQINBFSZ3/oBEADYvRPoLdDkASIArXyWR5ccugJQURxMDgphAGrvj6qskSkn0chF
-gnc/kcQr4aVTaDFdonSyHjYvspDOZm5BgHAICCu1PL8rkMTGS+vHM5dlwnok6IKy
-e2aLjLPq5sHyp4+Zeq1eHe5TQ1cgN0cPdMMnEHd8GQke21pRQ5Vz79s8qRfWlt1Y
-+OQ5uY/52iZ9qJ11/N4bPPe/Zm63sRTpGw14i8UCgBAsMQOG1XPUX2/IJc1CC9+1
-Ohn/hPCbIdCbwOs7/HFFMRWmV6w4ul9gr7Js0owkWAS8FNOactS2i2SSwdONetKs
-UbCVQ1PubPBZvh2Vij/oUBK5BvfNDR6nRYhOjYbt6PW/Q6bjqGecjnlO98dpcqag
-+8bdl1JY9FpE4RzfuRgAFjVbtNztrmm9t6EuOHGZ5ec34TG9+i02ixh0YTEDK/Yt
-my2MfIbGUbeIYRKJscqgxKkL6nv4x0lOvs8nDiUmqztGdSdTGni+BAWZz3+1xaJH
-DTyQ36qYauBb5FWneRTBeagrDOAvvk/WxS+fMFZpnQovevOQBqxEL62fntikmMFn
-ddPgq7R1VPdivvr+BO8yMI8i45Vn9EzIJR02WAp7oAsT966yzopVT4JLT8++CVPh
-/VBrFID9yRyWjW5IJPsMsOt7z3UJaP08ua0UG4uVqo6dT6IdR8jKKxYdvwARAQAB
-tCBsYXNzdWx1cyA8bGFzc3VsdXNAYWlkc2JhbGxzLmRlPokCPQQTAQoAJwUCVJnf
-+gIbAwUJBaOagAULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRAyqvthRFEnnviI
-D/95QdNgttsly9CUeHKGfNGlJ2NgDepqob/VR2385q7cXCbFftRIsD0vaWYfsQ87
-kbKs3fpeHz8teKqZtMnXYkPIaSK0TcoaqQtyfkmj+agP2YRSkNYonlmmCiCWkodP
-2VnnmRUSwHcgxS14xsUHh13JXsU5nTHDAdJqOxUX6l6Lxb989h7Q8wTn5SX1XRVd
-0U5P7fNXKvVF34J6uGyWraxQLOqJEEzi82F/61hbI6zVPhxu/R+qmiSqgHIlp0ax
-u+8u3eyDVP1q95AMPaL1GsNYDcSl5njbkEbruSmjVcO99cD1ZLAODFJuaa+h/IvQ
-HoPnFL3hRo0SHt/RimokboJL7nx5jT/0y+FtGuPMVKUqiLApOfoeWeHWVKgMLV/0
-1+O4jEDRMNSIClI2YHdgyuQPBuHkaYXrrpDpJnYDEz2qAiijx+xIAPzifxebuVFV
-NQl/XnXlzTmYrt0GHfCrNZa/ZtsqQqnJSRpydjey+ATGgs+3Oqa6z8lHhYx83ST2
-cGsUmSnzk0TnxXmqwWxb3aGA0kO50atrObWwNXud7n3hu4V0FWwfHXUk8gJxtMN6
-IenjLcI0WyLwSKvTazF6GSgtUhwNgON88eiqLS8CWdop4CEyEUfxFoZeQoS72Yzq
-4pSOYPnbRDcBn2zkYaWyCTmf9qvWbZOu0Sl2lfy9n5LiKrkCDQRUmd/6ARAAq+Mt
-/9LohA9Qnz/GjE504h38G3USXgEV9/ctr2PXkc2onW67u45trLSYLyCK6kDq3VIN
-/3uLt8Pr+IL41NntW1exRtqohVeKI38CCqR5RP9tVxLkyxnpA/SPpSvOjWhyBkph
-MRXYta1+nBHwxSaPcc2e+15pk/cYgg0cTY7Nvgo+wL4bgI+b2OHwwIwRov/t4aim
-0y63OaCG82NqWrX7i2ONaR8RsZ8RHLnC+TyFaoj0mdp+vp4WFwxbqcIq+Vvn1m5j
-gPlkzXK4Yrykp2IULGuj+qZyS043FzZYhbxZoE85zIMtQ5gV/ktaP25+YsU1bwb9
-75FQvdMM827bbOJJ67/l96asQNg1TMzosL8/t9xLPDry4YYu8kRIPZgKWvT0Eg1Q
-AWzWJCXplTdPlhj660OCGuuyv/XJIbhqtBVZhIyR7gs6EZHZ6FHax7F41fEWGgSv
-WVAMrjrnG4XYAyCP1yiW1i7/ogCzKXYvV42tzBFuPcza6jhBnU17w5E7nwYaEWgA
-02Ai7aTK9WDAi8j8emQ8XppU9hqEILSvR5tG4R0YOAUbIUplIpnpf8KcEhNy48ei
-MuhiTJBjPyu7bRJoZXvipNPjqhESGlvrcr1QKuEqPLRcfLo3DOt3zgxBqOZZGHKL
-ckaud05wevMPK09F7taLgwBCHOmAxiMa5NQVjL8AEQEAAYkCJQQYAQoADwUCVJnf
-+gIbDAUJBaOagAAKCRAyqvthRFEnngGYD/wP77ax6yczKT/AHEvqyMMRPigLHIHy
-XIWt8uNKwbn1RTXuH9Nj1rtVuj7ck4jscNwmDYeT52ZDxHQjLHWgAG0CBq6afdBi
-VwLur6M7jv0EwY/SMed+QD1+a59kiO8+difwLDF+Q50lYQ4fmSGsfdQ4Qxesm92r
-Y1Q/xFg1K9MNZbItpzYTE4P+ii4kU5BnWwExX2OEhhlrNUjJhA30HvvUID6bsguq
-Jl7mWnGpS5YYqPxiABNI++TzYXQvP95nWGROvdx2vSPuJ756S8VJ81LL7BmQyQzq
-8S/ciHjmgtgLRyncqqXl1uJBqtK+50vEFHxJrANdDNzD+K4S7+23DpRsmEl/2ECQ
-laGsU6HtYbnr+hc1alE4uNMEN1/a75EFI59BISnUm8jIy1nLhcIXMhFh4JuG7kGk
-2ePa4Gv2DafMR8N0WYPIhP3LIIDP0s9gv2QSA+5BmI9OhZDkz9Ubuut1+PMfWCXm
-aNmF2Bh8puTffsFxGJSiQ4CXDzuNRqMR5wB0OCnB/WAnuZhRAJhXmgR8FJY+EvTN
-PcA1QZIZ0hQGVf8eJ5Gx4W1w2Q6mQCGnCy1XtEkZP0BOP0Or5CMtqP/VSuwaF4wh
-4FLYTOLZ7oDr2ErK/bhnpuoPoUU0y3n7AG/nhtmqenlMPLWB246XnEoJMb6Ar8vW
-It6jrzDh3+COSQ==
-=0gFT
+mQINBFcWQhEBEADwt+hHRZxZx05USejn4x5LVWqqg5I2nIzjwI8pVyBra2AmXaMA
+SAImFk1W6oM35rwYmez6TG8QC7RPRUrMHX2aAdDwJ/VtU/b87q0ICwlMxYUnikg1
+tsHV4kRB7ukm+Rs0ECMqZzjwdlbiEEfQ6VPUrIBzDHeD0idkC82DonZ6xe083klH
+LpO36ckBOtyaoZZspzRu5yB76vsbeviVqsQ9WTQ8GoQk1i6FUbTbtOlvjhtx05Rk
+ic66RrfFSM/ElLe5yA96kZd7m/Sn9WIRwRj3clxnT1vAVpMlpISsTutEQtuG3MDX
+tT3EPVSSZEEcY1xxlJF+u1JZu4QqqtH+nczjshv+z3HZdmGd7OGqmgI8D3Ly/Ufi
+Uyz+ewZbhbgy/XSHqwriUbnMuE9OKxx0LqlQLA59+/icT+upW4TexiHKd6PYeSeJ
+kCxUEAmzqxsnilmwbehQrmmhI7uzxT8YxNGjF5mRJ1zOY55praTMKlp3MOxKvVPn
+EZSyWm/22CuUZZEX0XR6TBgkL71VoGrlaezADzhHu9i5yBwbNCuiE2CYcS5IuDf+
+GkoKGtWeLbXTXccWOaIItSzlVUcJx3D009kTXeLEo2T1RPpz41LMvqWkUlZg4CA1
+zMAcudsXDtXGJEvS3dZAaiUUdASktzNL/ltuW/CXITJ0V7UjmA0pOyLDOQARAQAB
+tBlsYXNzdWx1cyA8bGFzc0BsYXNzdWwudXM+iQI3BBMBCAAhBQJXFkIRAhsDBQsJ
+CAcCBhUICQoLAgQWAgMBAh4BAheAAAoJEInoKVKXan5NFVsP/RfU4dychz5eadnN
+/iCybL2eXCkpNbSJaPVqKKmBqY4oDEqK0NekwgOiWXFuFI6BpNyTW5z1a2PaBgF2
+bG5K/k/aGnzUUqH+LhtMCYr90UjJPtsrgi+C5poL4e2EsPN1SASSOSYFtYY1EQCe
+NcYut2foM/PjviJKuS9t/kJxmZn8Vi3+qQKSwys219IQuXqos44aihjnwEL+TR6D
+MgcDCW2QSCqB5kfksjustSihDck8ZkT+nISTrSdZVPzROcyBeswN/UqjOUBZd1p1
+sO7SqDaBnzovRD3G4kyscepPWChnOFCIq9tuE2Mai2QliQ4q1Bn0+8uhLPLG+nQI
+leL/6pFXY9ecjmpqrSAXEysDUgfpiqJzDtv8WC3fY7wl88/ROiHrgF8x5P4PmUMl
+oTfe+BGQar6BNV3rStPsW6Ogm6Mu6WNVXCRIJboM+ev3JdVSGF/ehnmb06EGCIrI
+ahWbMViDSAjOvM92By/RJkP8ADCN2ezvdf86Ubyib5EyRoleu0WHvtO1mLQn0pIP
+cYCGXrnQlkduC7ENS942hLUq976LPH1ZatM26gaN1MKxN03v+6e9E6jtxUH3wWk1
+oDGddTl+zu4fqUxEAA391sPMhp+DTVxXmPKvpnJivKAsL2Hkg0vKQt6VQNEv2Lgm
+G8vdqOcapWLBcddR9d0DpFgkZNQCuQINBFcWQhEBEADgv6HfZQyxuiFpHQbt59s4
+7mA4AmzgjA1GiS73xo16qjwLieKPJWlrgPk4OOwqQpdygZ9LAhH+FIqcGo4wCNKL
+1qiMQeQcFOACvLOfxpv8F1TkOc9IbQUoMPxXEYRK/c0ZtaWpe8dy4QL3tDwS/ovk
+sCZBpvXdpJXDuccfTQ23UPozWKs21JAIKqbO7p5n86VGr0Co07xmBsxOK6ylK8YM
+ftBjugfbxfmFApW2lAsjeDe7J5RY6W5NaeMg/IxTy6wkfoz1UjwtQaRvp1XbWqPz
+Ib+mx8AeRQQXzuVKxS20ZVgazSZHg1PYu9PoKTIWK0NLd68CydcQ4q6F3PjNytFH
+tDM13q5kWmTU0yFy2OWvy4JAq2z02C+Z+/+nffp0ZfsdEeVNm5ZvlDLmOYMWFzDj
+OScYgBYIAvAs3pYV+xl6pxvdTyI3JXed7Q889e36TC3mwUIR4sL+oOfctA7Swzkr
+aU8uMCwIE6ppGsxIcXQt15sUjgM5THXzAQXVkbM8i1x9F0JjP7bFMWcIP1pmqcaO
+6znM2D/wocY+RO3xYj0GLFgRBW2O/pJUWrWHInpO3mrwZeRMGZix5nZH8U6cvfD5
+9SwIVdyKj6sZklcS2JJclBDrAudYUbckAuV7KI1ZWcU4kVS3joYdWcFQO3vOxJW5
+mGXML9roJXeXN664iNBgpQARAQABiQIfBBgBCAAJBQJXFkIRAhsMAAoJEInoKVKX
+an5NGhcP/jkeR/fYPYuYEUWLGBxq2hFhwMssiJ+pwx5Nj+Kh9rLm90LBLCcwBVu0
+ILbaePkPCmin8p9F+AOy11DsWb5lBrlyUqU6+ID9nY/WbNL5ZYl6zIBmuYQ5qFEA
+n5NQD6hLllC6wyOqIeKXrnkvFJMW8+W0aYRQh7hhpAzyJz9gawXWvWY45NhWl3Tm
+S3LfJbA5nM6uZvO0VU7LERgfwTgPSjMwYVQGtktndy9N4Avi1N02l5BEmuZoXwTC
+oQuW6LiAPGE2ztXztyNGnUYUAGMWl22UTezqfU/aOG9Qum+QebwTgBUH4pTgLiV/
+pWxXib517wGkect/0Yd+zcya8lA7x1EzFFMb3i4ToawIz76I2ncIlpC2q31x2nVI
+6fBW4kfu8AR7XW9Yyv+plIuva1AeTf+sMc7FSb5CpOmjjLpUfQ96vZvQwarcEip7
+UmOBoAoFdhtwJotskBOje52AUgDIBWZrIfH1bq7/NjAO73UdR1mJkOpY01qQXkED
+TiLeIBGYqseCbnJNi1PVOVNEOT4Up3/RSjpAu8dBrXKqx7yS8bKlVk3RsIDlgyb4
+rWMc88uBl57YsjSnQN36LN7j0hPpb0TAD1OsPI1pepsKUAPZKA2EAyLXKyQ3oLqN
+DWU4ZWpIi8+RKm3UpWgQ9qN4tuRHvVX/AQjEW1LkhfmR2VIqnrkv
+=fgFG
-----END PGP PUBLIC KEY BLOCK-----
diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index f9af577b6..a6d4597f7 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -8,8 +8,8 @@ with config.krebs.lib;
cores = 1;
nets = {
retiolum = {
- addrs4 = ["10.243.0.210"];
- addrs6 = ["42:f9f1:0000:0000:0000:0000:0000:0001"];
+ ip4.addr = "10.243.0.210";
+ ip6.addr = "42:f9f1:0000:0000:0000:0000:0000:0001";
aliases = [
"pnp.retiolum"
"cgit.pnp.retiolum"
@@ -31,8 +31,8 @@ with config.krebs.lib;
cores = 4;
nets = {
retiolum = {
- addrs4 = ["10.243.0.84"];
- addrs6 = ["42:ff6b:5f0b:460d:2cee:4d05:73f7:5566"];
+ ip4.addr = "10.243.0.84";
+ ip6.addr = "42:ff6b:5f0b:460d:2cee:4d05:73f7:5566";
aliases = [
"darth.retiolum"
"darth.r"
@@ -54,8 +54,8 @@ with config.krebs.lib;
cores = 1;
nets = {
retiolum = {
- addrs4 = ["10.243.0.212"];
- addrs6 = ["42:f9f1:0000:0000:0000:0000:0000:0002"];
+ ip4.addr = "10.243.0.212";
+ ip6.addr = "42:f9f1:0000:0000:0000:0000:0000:0002";
aliases = [
"tsp.retiolum"
];
@@ -81,8 +81,8 @@ with config.krebs.lib;
cores = 2;
nets = {
retiolum = {
- addrs4 = ["10.243.0.91"];
- addrs6 = ["42:0b2c:d90e:e717:03dc:9ac1:7c30:a4db"];
+ ip4.addr = "10.243.0.91";
+ ip6.addr = "42:0b2c:d90e:e717:03dc:9ac1:7c30:a4db";
aliases = [
"pornocauster.retiolum"
"pornocauster.r"
@@ -108,8 +108,8 @@ with config.krebs.lib;
cores = 2;
nets = {
retiolum = {
- addrs4 = ["10.243.1.91"];
- addrs6 = ["42:0b2c:d90e:e717:03dd:9ac1:0000:a400"];
+ ip4.addr = "10.243.1.91";
+ ip6.addr = "42:0b2c:d90e:e717:03dd:9ac1:0000:a400";
aliases = [
"vbob.retiolum"
];
@@ -135,22 +135,22 @@ with config.krebs.lib;
extraZones = {
"krebsco.de" = ''
euer IN MX 1 aspmx.l.google.com.
- pigstarter IN A ${head nets.internet.addrs4}
- gold IN A ${head nets.internet.addrs4}
- boot IN A ${head nets.internet.addrs4}
+ pigstarter IN A ${nets.internet.ip4.addr}
+ gold IN A ${nets.internet.ip4.addr}
+ boot IN A ${nets.internet.ip4.addr}
'';
};
nets = {
internet = {
- addrs4 = ["192.40.56.122"];
- addrs6 = ["2604:2880::841f:72c"];
+ ip4.addr = "192.40.56.122";
+ ip6.addr = "2604:2880::841f:72c";
aliases = [
"pigstarter.internet"
];
};
retiolum = {
- addrs4 = ["10.243.0.153"];
- addrs6 = ["42:9143:b4c0:f981:6030:7aa2:8bc5:4110"];
+ ip4.addr = "10.243.0.153";
+ ip6.addr = "42:9143:b4c0:f981:6030:7aa2:8bc5:4110";
aliases = [
"pigstarter.retiolum"
];
@@ -171,18 +171,18 @@ with config.krebs.lib;
cores = 1;
extraZones = {
"krebsco.de" = ''
- euer IN A ${head nets.internet.addrs4}
- wiki.euer IN A ${head nets.internet.addrs4}
- wry IN A ${head nets.internet.addrs4}
+ euer IN A ${nets.internet.ip4.addr}
+ wiki.euer IN A ${nets.internet.ip4.addr}
+ wry IN A ${nets.internet.ip4.addr}
io IN NS wry.krebsco.de.
- graphs IN A ${head nets.internet.addrs4}
- paste 60 IN A ${head nets.internet.addrs4}
- tinc IN A ${head nets.internet.addrs4}
+ graphs IN A ${nets.internet.ip4.addr}
+ paste 60 IN A ${nets.internet.ip4.addr}
+ tinc IN A ${nets.internet.ip4.addr}
'';
};
nets = rec {
internet = {
- addrs4 = ["104.233.87.86"];
+ ip4.addr = "104.233.87.86";
aliases = [
"wry.internet"
"paste.internet"
@@ -190,8 +190,8 @@ with