diff options
Diffstat (limited to 'krebs')
| -rw-r--r-- | krebs/3modules/default.nix | 4 | ||||
| -rw-r--r-- | krebs/3modules/mb/default.nix | 73 | ||||
| -rw-r--r-- | krebs/3modules/permown.nix | 2 | ||||
| -rw-r--r-- | krebs/3modules/shadow.nix | 79 | ||||
| -rw-r--r-- | krebs/5pkgs/haskell/blessings.nix | 2 | ||||
| -rw-r--r-- | krebs/5pkgs/haskell/email-header.nix | 2 | ||||
| -rw-r--r-- | krebs/5pkgs/haskell/flameshot-once.nix | 6 | ||||
| -rw-r--r-- | krebs/5pkgs/simple/flameshot-once/profile.nix | 11 | ||||
| -rw-r--r-- | krebs/5pkgs/simple/irc-announce/default.nix | 2 | ||||
| -rw-r--r-- | krebs/5pkgs/simple/ssh-audit.nix | 55 | ||||
| -rw-r--r-- | krebs/nixpkgs.json | 6 |
11 files changed, 230 insertions, 12 deletions
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 4d40f3856..10a33d5d7 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -49,6 +49,7 @@ let ./rtorrent.nix ./secret.nix ./setuid.nix + ./shadow.nix ./syncthing.nix ./tinc.nix ./tinc_graphs.nix @@ -102,6 +103,7 @@ let { krebs = import ./krebs { inherit config; }; } { krebs = import ./lass { inherit config; }; } { krebs = import ./makefu { inherit config; }; } + { krebs = import ./mb { inherit config; }; } { krebs = import ./external/palo.nix { inherit config; }; } { krebs = import ./tv { inherit config; }; } { @@ -130,7 +132,7 @@ let services.openssh.hostKeys = let inherit (config.krebs.build.host.ssh) privkey; in - mkIf (privkey != null) (mkForce [privkey]); + mkIf (privkey != null) [privkey]; # TODO use imports for merging services.openssh.knownHosts = diff --git a/krebs/3modules/mb/default.nix b/krebs/3modules/mb/default.nix new file mode 100644 index 000000000..c98db4b27 --- /dev/null +++ b/krebs/3modules/mb/default.nix @@ -0,0 +1,73 @@ +with import <stockholm/lib>; +{ config, ... }: let + + hostDefaults = hostName: host: flip recursiveUpdate host { + ci = true; + monitoring = true; + owner = config.krebs.users.mb; + }; + +in { + hosts = mapAttrs hostDefaults { + orange = { + nets = { + retiolum = { + ip4.addr = "10.243.42.23"; + aliases = [ + "orange.r" + "or4ng3.r" + "0r4n93.r" + ]; + tinc.pubkey = '' + -----BEGIN PUBLIC KEY----- + MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAr7P0CkmC5HWnTdgGFzmA + zQuJzHSkSjcGgSkIt0pvqU6xi8P/d4eJlmeXeGTpH62JfM1xhEMpxMVd/4NOON2u + IlWnfu5bB763145IJwE0HmZziWjQXWRPAZMqYdQ5f2Pvmxv1yr3uBNzr8UlV6BjD + FXn8sCvikXttYzts9szlz5+pkY09qfiz48+DMzRBNO6JzXYQ9kPyS+TIXlGpN4Jp + C1TRF38eF2DTEZ58Yx8Z99dGrXVuqlSe77fehTQGxCckTpaZ0HS3XfZNa/cas8JY + /0RzH2n2AndnPirISDZ7r4ZIFuKAaivqaEkM8v7llI77URVB9ZJb/IqCrBzueAbt + V/5ts2HpfBAUhw0RoiH8ql+IQZsuSOpRUC2gUN8460V4SQkVtDcsVTENiD+NM5Mg + ImBv041CsW/rSJOilT2r/rWDN8RFnz/RrAQn+L31KXr81kg1TOLxO0ybs/eMJM3r + RnHFZPiiKdqPlA60g0AnzKXPR2JTszHIgHHoRUW16I1WJeuAJNjg0JDQ0JM7pZ27 + JEaCc7uR12TPiuExKaNEaxKZVY1J0hzxOzF2MFIbAMVz/3K2ycvvuLxKojqIAXxA + D+UtcOfJ62k2WnLXOEIZqFU0J2bvhxYUZOFS55wIn1UJF7hemD/LUFHBiWnuhwHk + TAEl8M851t+Zp3hZeJzgx2kCAwEAAQ== + -----END PUBLIC KEY----- + ''; + }; + }; + }; + p1nk = { + nets = { + retiolum = { + ip4.addr = "10.243.42.42"; + aliases = [ + "p1nk.r" + ]; + tinc.pubkey = '' + -----BEGIN PUBLIC KEY----- + MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5YVML71oW3iJrzZKuX48 + AKrGitO5zNvsAHOI8BVsGfZTyxAAZgG4OaDX45kr27K39NcBU43LdDD0I1yjNvGe + zAoL5MIiCPD/QR1kAvLmgpMUSqOVvrk+uoGLVt6dOGvxlOiG1AAaN0gA8Q0B/jZV + 4tZlBpZ7MX9xeK10wqVT56msN69P3EzKQn1uoVRrBxEnNvI1iqmmkgMLcrFVJFBQ + 888Uuw9Hx5MO7ES/ATe8mt0zReUGvn91jYVVsPpmAopWnjCol271gflY0RomFXKy + XaIuvbeF+3otF0+MNqJfm4IsAKJjvl92pjVX0f0eBCSPCYR7D1EtgQrqflLkZKZ8 + jBGDlgpsFWt/Omz1BYcuGZU/djM4+SNxr4YRYMi3lMix3s2PmHvm304I7eEEBlC9 + qy1jq/sLaf8mHJrF6Htl7W5WS/Famkwv/VreI92iHrhsmIDiX7OIbXzYDCxT/PQa + 6uCm/3jIbcHG/ZHZ12H6thkafK0Aoe009+p1n+5Y7V2oNvYe3KzZTnCN5t6z1QHZ + V5iypsd6lNDzlodjleTgGK8FmHGRPRdq1wb3eOLE8mWZj7ygDT50FwaC8FzAcHgC + bLN/zlHvCbYmk9IJhktO3B6wtMrZl60+XCpb5rTulM94RirifFYsnTIDJApI11yb + 3AYi5dQXHjab/lvj6917xa0CAwEAAQ== + -----END PUBLIC KEY----- + ''; + }; + }; + }; + }; + users = { + mb = { + mail = "mb0@codemonkey.cc"; + pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDCHAdKGHP/De/GLEsPo5RBfbaiiitMw4Y/akOekJbImswT6Np2lzqno/WBJcfVs3D39wgPKNld4P/QZc5IwxC26q/PnBFu93KES0GqnlAqUNE63IOJ8UzNdyEqWggnRiLrBU+ZgyFZvmqp6NoSO4YEGEK4RZRMJM/GcAuQMj/nGjx2AHwPGZCkIRgz8/ctBOzX1/knZd3cOnNowH1wlqUKX6UcEzJdAVDQijHF1wl0Ri8tJKq9u8s/fw+1PSOpOHaeF1BALsXSKgeJDqUCTnZW5mAVUWJ86LvvyfCP4In9lhhLisbDm2cD96QaVvJyV6HfmegdSxZ1Phh+9Qz+3WhDJRedBTSKWfK/9j7VWSb+z/KV37q72W25ZfFMSay58LmCqn3v5fGt9qj4nlPw0By4baGLiGlA7xyvkJfdt8ZVPps5d2g6UprTbSA79lYN4qtWKq2Z9t317xch7Lix6EunQcoTkJ6QXEbDrAIk3zvkWr/CtpwEhNcSdWvQsua42dkD2oOI2F2IgFyYgOx9Iba2yj8A0TD2iqfYVhsJIYuk12QfeaR7ovQ6DhHlUxyQzeF6h0Y+I4AN6Sq/Mmj/cxfQoIaAEybUQMX+7KjFceIszT3JbGlz7DCxi7DMmNYuc7LELMRG3jNAOk+fW8u42Bhgc44tzvAondojerUGqCbUDw== mb0@codemonkey.cc"; + }; + }; +} diff --git a/krebs/3modules/permown.nix b/krebs/3modules/permown.nix index 63adb2236..fe293810c 100644 --- a/krebs/3modules/permown.nix +++ b/krebs/3modules/permown.nix @@ -88,7 +88,7 @@ with import <stockholm/lib>; fi done < "$paths" ''; - PrivateTemp = true; + PrivateTmp = true; Restart = "always"; RestartSec = 10; UMask = plan.umask; diff --git a/krebs/3modules/shadow.nix b/krebs/3modules/shadow.nix new file mode 100644 index 000000000..cff66492d --- /dev/null +++ b/krebs/3modules/shadow.nix @@ -0,0 +1,79 @@ +with import <stockholm/lib>; +{ config, pkgs, ... }: let + + cfg = config.krebs.shadow; + + mergeShadowsJq = pkgs.writeJq "merge-shadows.jq" '' + def fields_3_to_9: ["1", "", "", "", "", "", ""]; + + def read_value: + split(":") | + if length == 9 then + if .[2:] == fields_3_to_9 then + . + else + error("unrecognized field contents") + end + elif length == 2 then + if .[1] | test("^\\$6\\$") then + . + fields_3_to_9 + else + error("unrecognized hashed password") + end + else + error("unexpected field count: expected 9 or 2, got \(length)") + end; + + def write_value: + join(":"); + + split("\n") | + map(select(length > 0) | read_value) | + + reverse | + unique_by(.[0]) | + map(write_value) | + sort | + + join("\n") + ''; + +in { + + options.krebs.shadow = { + enable = mkEnableOption "krebs.shadow" // { + default = cfg.overridesFile != null; + }; + overridesFile = mkOption { + apply = x: if typeOf x == "path" then toString x else x; + default = null; + description = '' + Path to a file containing additional shadow entries, used for adding + encrypted passwords which should not be placed into the Nix store. + + The overrides file may contain either regular shadow(5) entries like: + + <code><login-name>:<hashed-password>:1::::::</code> + + Or shortened entries only containing login name and password like: + + <code><login-name>:<hashed-password></code> + ''; + type = types.nullOr (types.either types.path types.absolute-pathname); + }; + }; + + config = let + in mkIf cfg.enable { + system.activationScripts.users-tv = stringAfter [ "users" ] /* sh */ '' + ( + set -efu + umask 77 + ${pkgs.jq}/bin/jq -Rrs -f ${mergeShadowsJq} \ + /etc/shadow ${cfg.overridesFile} > /etc/shadow~ + ${pkgs.coreutils}/bin/mv /etc/shadow /etc/shadow- + ${pkgs.coreutils}/bin/mv /etc/shadow~ /etc/shadow + ) + ''; + }; +} diff --git a/krebs/5pkgs/haskell/blessings.nix b/krebs/5pkgs/haskell/blessings.nix index c35706ebf..7abebba56 100644 --- a/krebs/5pkgs/haskell/blessings.nix +++ b/krebs/5pkgs/haskell/blessings.nix @@ -14,7 +14,7 @@ with import <stockholm/lib>; version = "2.2.0"; sha256 = "1pb56dgf3jj2kq3cbbppwzyg3ccgqy9xara62hkjwyxzdx20clk1"; }; - }.${versions.majorMinor nixpkgsVersion}; + }.${versions.majorMinor version}; in mkDerivation { pname = "blessings"; diff --git a/krebs/5pkgs/haskell/email-header.nix b/krebs/5pkgs/haskell/email-header.nix index 6689f1d2c..fe4bb839b 100644 --- a/krebs/5pkgs/haskell/email-header.nix +++ b/krebs/5pkgs/haskell/email-header.nix @@ -20,7 +20,7 @@ with import <stockholm/lib>; rev = "refs/tags/v${cfg.version}"; sha256 = "11xjivpj495r2ss9aqljnpzzycb57cm4sr7yzmf939rzwsd3ib0x"; }; - }.${versions.majorMinor nixpkgsVersion}; + }.${versions.majorMinor version}; in mkDerivation { pname = "email-header"; diff --git a/krebs/5pkgs/haskell/flameshot-once.nix b/krebs/5pkgs/haskell/flameshot-once.nix index 89b95ca07..5b369362e 100644 --- a/krebs/5pkgs/haskell/flameshot-once.nix +++ b/krebs/5pkgs/haskell/flameshot-once.nix @@ -4,11 +4,11 @@ }: mkDerivation { pname = "flameshot-once"; - version = "1.1.0"; + version = "1.2.0"; src = fetchgit { url = "https://cgit.krebsco.de/flameshot-once"; - sha256 = "158ha1yyj3p3mdjjga62j91ml83nhrsg34xbg3dir5cb399j8pxx"; - rev = "9d688b6ffad14912bd1afe42555747cb3d213d95"; + sha256 = "01c11dk8ss37awfn9xqsgx668dcrf4kvzfxlq7ycnqsnpbjjvm0a"; + rev = "cebaefa37095e74ad2253c4e2f9d9ab390f88737"; fetchSubmodules = true; }; isLibrary = false; diff --git a/krebs/5pkgs/simple/flameshot-once/profile.nix b/krebs/5pkgs/simple/flameshot-once/profile.nix index 7373da00a..8ea8a850c 100644 --- a/krebs/5pkgs/simple/flameshot-once/profile.nix +++ b/krebs/5pkgs/simple/flameshot-once/profile.nix @@ -29,7 +29,7 @@ let eval = evalModules { modules = singleton { - _file = toString ./config.nix; + _file = toString ./profile.nix; imports = singleton config; options = { buttons = mkOption { @@ -77,6 +77,14 @@ let default = false; type = types.bool; }; + timeout = mkOption { + default = 100; + description = '' + Maximum time in milliseconds allowed for the flameshot daemon to + react. + ''; + type = types.positive; + }; }; }; }; @@ -125,5 +133,6 @@ in pkgs.writeDash "flameshot.profile" '' export FLAMESHOT_CAPTURE_PATH=${cfg.savePath} + export FLAMESHOT_ONCE_TIMEOUT=${toString cfg.timeout} export XDG_CONFIG_HOME=${XDG_CONFIG_HOME} '' diff --git a/krebs/5pkgs/simple/irc-announce/default.nix b/krebs/5pkgs/simple/irc-announce/default.nix index e1f4919d5..b22e67535 100644 --- a/krebs/5pkgs/simple/irc-announce/default.nix +++ b/krebs/5pkgs/simple/irc-announce/default.nix @@ -15,7 +15,7 @@ pkgs.writeDashBin "irc-announce" '' IRC_SERVER=$1 IRC_PORT=$2 - IRC_NICK=$3$$ + IRC_NICK=$3_$$ IRC_CHANNEL=$4 message=$5 diff --git a/krebs/5pkgs/simple/ssh-audit.nix b/krebs/5pkgs/simple/ssh-audit.nix new file mode 100644 index 000000000..7d2e6fb34 --- /dev/null +++ b/krebs/5pkgs/simple/ssh-audit.nix @@ -0,0 +1,55 @@ +{ fetchFromGitHub, python3Packages, stdenv }: + +python3Packages.buildPythonPackage rec { + inherit (meta) version; + + pname = "ssh-audit"; + + src = fetchFromGitHub { + owner = "arthepsy"; + repo = pname; + rev = "refs/tags/v${meta.version}"; + sha256 = "0akrychkdym9f6830ysq787c9nc0bkyqvy4h72498lyghwvwc2ms"; + }; + + checkInputs = [ + python3Packages.pytest + python3Packages.pytestcov + ]; + + checkPhase = '' + py.test --cov-report= --cov=ssh-audit -v test + ''; + + postPatch = '' + printf %s "$setupPy" > setup.py + mkdir scripts + cp ssh-audit.py scripts/ssh-audit + mkdir ssh-audit + cp ssh-audit.py ssh-audit/__init__.py + ''; + + setupPy = /* py */ '' + from distutils.core import setup + setup( + author='arthepsy', + description='${meta.description}', + license='${meta.license.spdxId}', + name='${pname}', + packages=['ssh-audit'], + scripts=['scripts/ssh-audit'], + url='${meta.homepage}', + version='${version}', + ) + ''; + + meta = { + description = "tool for ssh server auditing"; + homepage = "https://github.com/arthepsy/ssh-audit"; + license = stdenv.lib.licenses.mit; + maintainers = [ + stdenv.lib.maintainers.tv + ]; + version = "1.7.0"; + }; +} diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json index d5ca0e21f..ae75f6074 100644 --- a/krebs/nixpkgs.json +++ b/krebs/nixpkgs.json @@ -1,7 +1,7 @@ { "url": "https://github.com/NixOS/nixpkgs-channels", - "rev": "8ea36d732567c80b2d11eb029e10400fe85ca786", - "date": "2019-04-18T22:37:03+01:00", - "sha256": "1d59i55qwqd76n2d0hr1si26q333ydizkd91h8lfczb00xnr5pqn", + "rev": "04954e39df88487bf5b6bb5e532520e83a6c22ea", + "date": "2019-05-04T20:25:55-04:00", + "sha256": "1l6wc13mwwhv0msa0596wvsq2j2kxj1wjchdz4v1zzia781rpd8m", "fetchSubmodules": false } |