summaryrefslogtreecommitdiffstats
path: root/krebs
diff options
context:
space:
mode:
Diffstat (limited to 'krebs')
-rw-r--r--krebs/3modules/acl.nix55
-rw-r--r--krebs/3modules/ci.nix2
-rw-r--r--krebs/3modules/default.nix15
-rw-r--r--krebs/3modules/external/mic92.nix25
-rw-r--r--krebs/3modules/makefu/default.nix3
-rw-r--r--krebs/3modules/sync-containers.nix2
-rw-r--r--krebs/3modules/tinc.nix5
7 files changed, 72 insertions, 35 deletions
diff --git a/krebs/3modules/acl.nix b/krebs/3modules/acl.nix
new file mode 100644
index 000000000..9cdbb6cff
--- /dev/null
+++ b/krebs/3modules/acl.nix
@@ -0,0 +1,55 @@
+{ config, lib, pkgs, ... }: let
+ parents = dir:
+ if dir == "/" then
+ [ dir ]
+ else
+ [ dir ] ++ parents (builtins.dirOf dir)
+ ;
+in {
+ options.krebs.acl = lib.mkOption {
+ type = lib.types.attrsOf (lib.types.attrsOf (lib.types.submodule ({ config, ... }: {
+ options = {
+ rule = lib.mkOption {
+ type = lib.types.str;
+ default = config._module.args.name;
+ };
+ default = lib.mkOption {
+ type = lib.types.bool;
+ default = !config.parents;
+ };
+ recursive = lib.mkOption {
+ type = lib.types.bool;
+ default = !config.parents;
+ };
+ parents = lib.mkOption {
+ type = lib.types.bool;
+ default = false;
+ description = ''
+ apply ACL to every parent folder
+ '';
+ };
+ };
+ })));
+ default = {};
+ };
+ config = {
+ systemd.services = lib.mapAttrs' (path: rules: lib.nameValuePair "acl-${lib.replaceChars ["/"] ["_"] path}" {
+ wantedBy = [ "multi-user.target" ];
+ path = [
+ pkgs.acl
+ pkgs.coreutils
+ ];
+ serviceConfig = {
+ ExecStart = pkgs.writers.writeDash "acl" (lib.concatStrings (
+ lib.mapAttrsToList (_: rule: ''
+ setfacl -${lib.optionalString rule.recursive "R"}m ${rule.rule} ${path}
+ ${lib.optionalString rule.default "setfacl -${lib.optionalString rule.recursive "R"}dm ${rule.rule} ${path}"}
+ ${lib.optionalString rule.parents (lib.concatMapStringsSep "\n" (folder: "setfacl -m ${rule.rule} ${folder}") (parents path))}
+ '') rules
+ ));
+ RemainAfterExit = true;
+ Type = "simple";
+ };
+ }) config.krebs.acl;
+ };
+}
diff --git a/krebs/3modules/ci.nix b/krebs/3modules/ci.nix
index 822dbab61..5efe41786 100644
--- a/krebs/3modules/ci.nix
+++ b/krebs/3modules/ci.nix
@@ -166,6 +166,8 @@ let
nick = "buildbot|${hostname}",
notify_events = [ 'started', 'finished', 'failure', 'success', 'exception', 'problem' ],
channels = [{"channel": "#xxx"}],
+ showBlameList = True,
+ authz={'force': True},
)
''];
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index b58b52038..fc57d8188 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -6,6 +6,7 @@ let
out = {
imports = [
+ ./acl.nix
./airdcpp.nix
./announce-activation.nix
./apt-cacher-ng.nix
@@ -19,13 +20,13 @@ let
./current.nix
./dns.nix
./ergo.nix
- ./exim.nix
./exim-retiolum.nix
./exim-smarthost.nix
+ ./exim.nix
./fetchWallpaper.nix
+ ./git.nix
./github-hosts-sync.nix
./github-known-hosts.nix
- ./git.nix
./go.nix
./hidden-ssh.nix
./hosts.nix
@@ -38,11 +39,12 @@ let
./nixpkgs.nix
./on-failure.nix
./os-release.nix
- ./permown.nix
./per-user.nix
+ ./permown.nix
./power-action.nix
./reaktor2.nix
./realwallpaper.nix
+ ./repo-sync.nix
./retiolum-bootstrap.nix
./rtorrent.nix
./secret.nix
@@ -55,7 +57,6 @@ let
./tinc_graphs.nix
./upstream
./urlwatch.nix
- ./repo-sync.nix
./xresources.nix
./zones.nix
];
@@ -102,13 +103,13 @@ let
imp = lib.mkMerge [
{ krebs = import ./external { inherit config; }; }
+ { krebs = import ./external/kmein.nix { inherit config; }; }
+ { krebs = import ./external/mic92.nix { inherit config; }; }
+ { krebs = import ./external/palo.nix { inherit config; }; }
{ krebs = import ./jeschli { inherit config; }; }
{ krebs = import ./krebs { inherit config; }; }
{ krebs = import ./lass { inherit config; }; }
{ krebs = import ./makefu { inherit config; }; }
- { krebs = import ./external/palo.nix { inherit config; }; }
- { krebs = import ./external/mic92.nix { inherit config; }; }
- { krebs = import ./external/kmein.nix { inherit config; }; }
{ krebs = import ./tv { inherit config; }; }
{
krebs.dns.providers = {
diff --git a/krebs/3modules/external/mic92.nix b/krebs/3modules/external/mic92.nix
index 27a2beed6..dd6f4f456 100644
--- a/krebs/3modules/external/mic92.nix
+++ b/krebs/3modules/external/mic92.nix
@@ -279,25 +279,6 @@ in {
'';
};
};
- philipsaendig = {
- owner = config.krebs.users.mic92;
- nets.retiolum = {
- ip4.addr = "10.243.29.193";
- aliases = [
- "philipsaendig.r"
- ];
- tinc.pubkey = ''
- -----BEGIN RSA PUBLIC KEY-----
- MIIBCgKCAQEAyWdCrXD0M9CIt0ZgVB6W5ozOvLDoxPmGzLBJUnAZV8f9oqfaIEIX
- 5TIaxozN3QMEgS0ChaOHTNFiQZjiiwJL/wPx1eFvKfDkkn7ayrRS/pP+bKhcDpKl
- 4tPejipee9T2ZhYg9tbk291CDBe1fHR5S2F8kPm8OuqwE2Fv9N8wldcsDLxHcTZl
- +wp4Oe/Wn5WLvZb3SUao17vKnNBLfMMCGC01yRfhZub41NkGYVWBjErsIVxQ+/rF
- Y7DdCekus+BQCKz+beEmtzG7d0Xwqwkif51HQ05CvwFNEtdUGodd8OrIO+gpIV6S
- oN+Q5zxsenLo6QRfsLD+nn7A7qbzd57kUwIDAQAB
- -----END RSA PUBLIC KEY-----
- '';
- };
- };
yasmin = {
owner = config.krebs.users.mic92;
nets.internet = {
@@ -306,7 +287,6 @@ in {
aliases = [ "yasmin.i" ];
};
nets.retiolum = {
- ip4.addr = "10.243.29.197";
aliases = [
"yasmin.r"
];
@@ -414,7 +394,6 @@ in {
};
retiolum = {
via = internet;
- ip4.addr = "10.243.29.195";
aliases = [ "bill.r" ];
tinc.pubkey = ''
-----BEGIN RSA PUBLIC KEY-----
@@ -445,7 +424,6 @@ in {
};
retiolum = {
via = internet;
- ip4.addr = "10.243.29.173";
aliases = [ "nardole.r" ];
tinc.pubkey = ''
-----BEGIN RSA PUBLIC KEY-----
@@ -470,7 +448,6 @@ in {
owner = config.krebs.users.mic92;
nets = {
retiolum = {
- ip4.addr = "10.243.29.171";
aliases = [
"rock.r"
];
@@ -736,7 +713,6 @@ in {
};
retiolum = {
via = internet;
- ip4.addr = "10.243.29.198";
aliases = [ "ryan.r" ];
tinc.pubkey = ''
-----BEGIN RSA PUBLIC KEY-----
@@ -764,7 +740,6 @@ in {
};
retiolum = {
via = internet;
- ip4.addr = "10.243.29.199";
aliases = [ "graham.r" ];
tinc.pubkey = ''
-----BEGIN RSA PUBLIC KEY-----
diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index b3c09db78..f87802b45 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -219,6 +219,9 @@ in {
retiolum = {
via = internet;
ip4.addr = "10.243.0.213";
+ # never connect via gum (he eats your packets!)
+ tinc.weight = 9001;
+
aliases = [
"gum.r"
"backup.makefu.r"
diff --git a/krebs/3modules/sync-containers.nix b/krebs/3modules/sync-containers.nix
index e47f9a3a7..e2caa0834 100644
--- a/krebs/3modules/sync-containers.nix
+++ b/krebs/3modules/sync-containers.nix
@@ -97,7 +97,7 @@ in {
${pkgs.coreutils}/bin/chmod a+x /var/lib/containers || :
'';
- services.syncthing.declarative.folders = (mapAttrs' (_: ctr: nameValuePair "${(paths ctr.name).${ctr.format}}" ({
+ services.syncthing.folders = (mapAttrs' (_: ctr: nameValuePair "${(paths ctr.name).${ctr.format}}" ({
devices = ctr.peers;
ignorePerms = false;
})) cfg.containers);
diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix
index 21ddde1c6..31371af59 100644
--- a/krebs/3modules/tinc.nix
+++ b/krebs/3modules/tinc.nix
@@ -48,7 +48,7 @@ with import <stockholm/lib>;
};
extraConfig = mkOption {
- type = types.str;
+ type = types.lines;
default = "";
description = ''
Extra Configuration to be appended to tinc.conf
@@ -233,6 +233,7 @@ with import <stockholm/lib>;
cfg.iproutePackage
cfg.tincPackage
];
+ reloadIfChanged = true;
serviceConfig = {
Restart = "always";
LoadCredential = filter (x: x != "") [
@@ -260,7 +261,7 @@ with import <stockholm/lib>;
"-o PrivateKeyFile=\${CREDENTIALS_DIRECTORY}/rsa_key"
"--pidfile=/var/run/tinc.${netname}.pid"
];
- ExecReload = "${cfg.tincPackage}/sbin/tinc -n ${netname} reload";
+ ExecReload = "${cfg.tincPackage}/sbin/tinc -n ${netname} restart";
SyslogIdentifier = netname;
};
}) config.krebs.tinc;
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-06 09:57:28 +0000