summaryrefslogtreecommitdiffstats
path: root/krebs
diff options
context:
space:
mode:
Diffstat (limited to 'krebs')
-rw-r--r--krebs/2configs/save-diskspace.nix1
-rw-r--r--krebs/3modules/backup.nix1
-rw-r--r--krebs/3modules/default.nix36
-rw-r--r--krebs/3modules/jeschli/default.nix45
-rw-r--r--krebs/3modules/lass/default.nix3
-rw-r--r--krebs/3modules/repo-sync.nix1
-rw-r--r--krebs/3modules/xresources.nix58
-rw-r--r--krebs/5pkgs/haskell/nix-diff/default.nix (renamed from krebs/5pkgs/haskell/nix-diff.nix)5
-rw-r--r--krebs/5pkgs/haskell/nix-diff/nixos-system.patch18
-rw-r--r--krebs/5pkgs/simple/apt-cacher-ng/default.nix21
-rw-r--r--krebs/5pkgs/simple/cidr2glob.nix30
-rw-r--r--krebs/5pkgs/simple/populate/default.nix11
-rw-r--r--krebs/source.nix11
13 files changed, 187 insertions, 54 deletions
diff --git a/krebs/2configs/save-diskspace.nix b/krebs/2configs/save-diskspace.nix
index ab074c750..b1416a97a 100644
--- a/krebs/2configs/save-diskspace.nix
+++ b/krebs/2configs/save-diskspace.nix
@@ -1,7 +1,6 @@
{lib, ... }:
# TODO: do not check out nixpkgs master but fetch revision from github
{
- environment.noXlibs = true;
nix.gc.automatic = true;
nix.gc.dates = lib.mkDefault "03:10";
programs.info.enable = false;
diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix
index 6f015d66b..c0b218c15 100644
--- a/krebs/3modules/backup.nix
+++ b/krebs/3modules/backup.nix
@@ -83,6 +83,7 @@ let
rsync
utillinux
];
+ restartIfChanged = false;
serviceConfig = rec {
ExecStart = start plan;
SyslogIdentifier = ExecStart.name;
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 2a3a64a82..9c343309a 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -44,6 +44,7 @@ let
./tinc_graphs.nix
./urlwatch.nix
./repo-sync.nix
+ ./xresources.nix
./zones.nix
];
options.krebs = api;
@@ -226,21 +227,26 @@ let
};
})
//
- # GitHub's IPv4 address range is 192.30.252.0/22
- # Refs https://help.github.com/articles/github-s-ip-addresses/
- # 192.30.252.0/22 = 192.30.252.0-192.30.255.255 (1024 addresses)
- # Because line length is limited by OPENSSH_LINE_MAX (= 8192),
- # we split each /24 into its own entry.
- listToAttrs (map
- (c: {
- name = "github${toString c}";
- value = {
- hostNames = ["github.com"] ++
- map (d: "192.30.${toString c}.${toString d}") (range 0 255);
- publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==";
- };
- })
- (range 252 255))
+ {
+ github = {
+ hostNames = [
+ "github.com"
+ # List generated with
+ # curl -sS https://api.github.com/meta | jq -r .git[] | cidr2glob
+ "192.30.253.*"
+ "192.30.254.*"
+ "192.30.255.*"
+ "185.199.108.*"
+ "185.199.109.*"
+ "185.199.110.*"
+ "185.199.111.*"
+ "18.195.85.27"
+ "18.194.104.89"
+ "35.159.8.160"
+ ];
+ publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==";
+ };
+ }
//
mapAttrs
(name: host: {
diff --git a/krebs/3modules/jeschli/default.nix b/krebs/3modules/jeschli/default.nix
index 2a3fe3cfd..bc821f296 100644
--- a/krebs/3modules/jeschli/default.nix
+++ b/krebs/3modules/jeschli/default.nix
@@ -7,10 +7,7 @@ with import <stockholm/lib>;
owner = config.krebs.users.jeschli;
ci = true;
}) {
-
bln = {
- ci = false;
- external = true;
nets = {
retiolum = {
ip4.addr = "10.243.27.28";
@@ -47,9 +44,44 @@ with import <stockholm/lib>;
};
};
};
+ brauerei = {
+ nets = {
+ retiolum = {
+ ip4.addr = "10.243.27.29";
+ ip6.addr = "42::29";
+ aliases = [
+ "brauerei.r"
+ ];
+ tinc.pubkey = ''
+ -----BEGIN RSA PUBLIC KEY-----
+ MIIECgKCBAEAvC4AjkAoH01sKDXE3xVM2YUpPQ9iewIPQCCCSWYZQh2BWOfl+FFs
+ pW3ix5FjAzTxzkIf5NxW0usff8UTkFHB+sGZLZ9DPqvb8AM4GJsvXR06LORHtBlo
+ Vt/g1sndD3i3NXn5IJ2G4mZDImQjI3vuTkPyFQsR5LRAaPQgIORHBtN/X1UEVMRq
+ gThUeMb1kZ/y4AmUx0pepQYmAcYf0cN/7r9n68dWJCZ7DWX3q49bIz4TPG519IQp
+ KzoCtdXImKl6cFDepa2pRmIW4SPaDXztHDmXoJA1NBfdDOMOW67FUjzhcwZS9usM
+ q9x/1Tph63PJy4Vc0jsJnY29WrInx/nVAb22QuTOXQ9SfBNoOATYoFoVmY+yw1FX
+ 67y3bRbq8lQk1y3F2vZVYxQ52WiYLmtNtuzUMZHErL7VgFIEfQKoO2Oa/WZXdgSJ
+ Asmn67NSicc5QNI4rBUthju1JDuM/3ja0yCXh7trDCmPxKd94KzxMlq9VA6S2f/Q
+ uke3VnXEDqOWOZdcon5DnRTT1y4xjk1XHuO/9tVDcrL7x1unkdGL9BNMU6opJiLm
+ batAtKQ/7EJrlgIxYpEQyCNAjj0dEn0BgNZNqQSKkeGe6giVMuHtnXeTYMEraDas
+ DWxHmGOvYWrs3tZdELkB/h/y7DdijOabS4AlLOljKHiacw8e0D7p9qeIU2EwRaXD
+ ebPYaAIIWn1FU1aCYpvF4YJYbdNJZg6aKpoWNz86ZjO9t3GBkf612xB7fRO9mbTg
+ Ww2Hl6lir0rnlo7P9M1xhQqmZ0phaUjkqYRCaTOW1kC5ACpJJ/Jrq0oyplHVBY8Y
+ IvzPDA4nu/YOpyhQjlQwcVt62NgW0CZdwp3ZnMMoy7akgEo71bjoHbRxAeWy5oRB
+ 5CgGvQAB+qdf97XjZ5RggWQ2rglkCn49X4fXN6r4zuaIji1VVFTEZGRNsi0vt1YC
+ Eedz68auu1ZDO1qwNcX00n94E09B05DQBjE/6SAX6wBCY/BwUtzdQ9JnyfHNSl8i
+ dmHBPLssB9Dku4U0mo+LLer+bf6fiR7r5gp/KRuY/tMGFahprZRfWFtyO2Pg1cYI
+ HCdmDmSlbFq3EJmBl0egbU8Ym1m6t4EvPcoTxwy3ljZWybHlhm4wvhGcA/2bDRZA
+ jcXSL3G7buBOf8WJNYnMXCtPEyIYUdRyNvz3EUfvmbzZDhHd/bc0pJRrrtI7HqoF
+ +g67gCrtXx6i9PD0LSDJ1jExMZcmU1+DPg0dzDEmLHvW+HW538/HXGJ8FsunWBwD
+ /8wsQfoqAwlBSucLHDDrYVvfSp0+TLzg/HDMhNkcN7d5hm3syrI+IN4gEEjYeZIO
+ g7fjR1X7g5FGCDQnRA/dzNsZVnk6UFpCRwIDAQAB
+ -----END RSA PUBLIC KEY-----
+ '';
+ };
+ };
+ };
reagenzglas = {
- ci = false;
- external = true;
nets = {
retiolum = {
ip4.addr = "10.243.27.27";
@@ -92,5 +124,8 @@ with import <stockholm/lib>;
mail = "jeschli@gmail.com";
pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMPuFzd6p3zZETIjoV5mRxCTQgeZk9s/P374mEDbj58wDTT0uGWu2JRf7cL1QRTvd5238tYl0eSHXH65+oaFB/mIvmiRnuw6qQODOMHlSbJN5/J2hEw/3v5gveiP1xNLfKlFhj6mmMRF7Etvzns/kLGLCSjj1UTlfo4iHmtinPmU+iQ8J4foS4cZj4oZesF8gndkc2EFMfL6en7EuU8GK6U9GtwKNL9N4UoUZXu8Nf00pkn/jrpmsDdI4zdVVAxWeu/Lo4li43EVixLcfwQiwzf6S9FvYIv30xPdy92GJSJwxm/QkYuc48VZWUoE+qThf3IEPETtX+MRZrM8RTtY01";
};
+ jeschli-bln = {
+ pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDhQdDQFMxXOjbC+Avx3mlcFHqQpFUk/q9sO6ATA65jCV3YzN11vhZDDv54hABVS2h8TPXs7Lu3PCvK9qouASd2h4Ie9cExUmn50G/iwgFIODsCugVYBzVt1iwaAdwz1Hb9DKYXbVXanzVJjimmrrlQNvsyZg85lcnfyedpPX5ad+4FdSP68LHqEHC18LTitldR6V4P1omaKHlOtVpDgR/72tDgbtNZDBn3EU+TPk9OLTzjc6PinPw4iIvjEfiu14APwXpFDIqT7P7SjOEFpa0v/1z7dhxIy/Z9XbqyEdUfhv3PjZR5K2C+VzR7g6jVEVR2xFId51MpLv/Un4/lalbphBEw3I90Rr8tatOJiFhyrXbaKTcLqp1sIu05OxdPkm3hzfmLIhoKxhaIlXH7WQ9sAqxL1NAQ7O+J6yT4DMnwKzvpkkJjBaGtV84Pp1cccfNRH8XXID3FkWkrUpdgXWBpyLnRq4ilUJTajkU0GSdXkq8kLL3mWg9LPRTg3dmDj61ZB/qhjM61ppwHJvDRN9WI5HruXIU6nOQjh5yE2C/JZfLcsZD4Y1UDBy5/JSZrCVT2sQjFopkkYEkRCbX7oITHOH4iyRdxZkKWLUPboFrcmBpXO+owCEhO4JZrtfFWMC6qM++nrmiZWOrdIOIvdYHWluhKR2shlkisEKQP5pUqkw== markus.hihn@dcso.de";
+ };
};
}
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index 6158882ec..ba6d85e7a 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -628,8 +628,5 @@ with import <stockholm/lib>;
pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKbBp2dH2X3dcU1zh+xW3ZsdYROKpJd3n13ssOP092qE";
mail = "joerg@higgsboson.tk";
};
- jeschli = {
- pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMPuFzd6p3zZETIjoV5mRxCTQgeZk9s/P374mEDbj58wDTT0uGWu2JRf7cL1QRTvd5238tYl0eSHXH65+oaFB/mIvmiRnuw6qQODOMHlSbJN5/J2hEw/3v5gveiP1xNLfKlFhj6mmMRF7Etvzns/kLGLCSjj1UTlfo4iHmtinPmU+iQ8J4foS4cZj4oZesF8gndkc2EFMfL6en7EuU8GK6U9GtwKNL9N4UoUZXu8Nf00pkn/jrpmsDdI4zdVVAxWeu/Lo4li43EVixLcfwQiwzf6S9FvYIv30xPdy92GJSJwxm/QkYuc48VZWUoE+qThf3IEPETtX+MRZrM8RTtY01";
- };
};
}
diff --git a/krebs/3modules/repo-sync.nix b/krebs/3modules/repo-sync.nix
index 0211b31ba..b2e3aa7c5 100644
--- a/krebs/3modules/repo-sync.nix
+++ b/krebs/3modules/repo-sync.nix
@@ -173,6 +173,7 @@ let
REPONAME = "${name}.git";
};
+ restartIfChanged = false;
serviceConfig = {
Type = "simple";
PermissionsStartOnly = true;
diff --git a/krebs/3modules/xresources.nix b/krebs/3modules/xresources.nix
new file mode 100644
index 000000000..017dbff2b
--- /dev/null
+++ b/krebs/3modules/xresources.nix
@@ -0,0 +1,58 @@
+{ config, lib, pkgs, ... }:
+
+#TODO:
+#prefix with Attribute Name
+#ex: urxvt
+
+with builtins;
+with lib;
+
+
+let
+
+ inherit (pkgs) writeScript writeText;
+
+in
+
+{
+
+ options = {
+ services.xresources.enable = mkOption {
+ type = types.bool;
+ default = false;
+ description = ''
+ Whether to enable the automatic loading of Xresources definitions at display-manager start;
+ '';
+ };
+
+ services.xresources.resources = mkOption {
+ default = {};
+ type = types.attrsOf types.str;
+ example = {
+ urxvt = ''
+ URxvt*scrollBar: false
+ URxvt*urgentOnBell: true
+ '';
+ };
+ description = ''
+ Xresources definitions.
+ '';
+ };
+ };
+
+ config =
+ let
+ cfg = config.services.xresources;
+ xres = writeText "xresources" (concatStringsSep "\n" (attrValues cfg.resources));
+
+ in mkIf cfg.enable {
+ services.xserver.displayManager.sessionCommands = ''
+ ${pkgs.xorg.xrdb}/bin/xrdb -merge ${xres}
+ '';
+ environment.systemPackages = [
+ (pkgs.writeDashBin "updateXresources" ''
+ ${pkgs.xorg.xrdb}/bin/xrdb -merge ${xres}
+ '')
+ ];
+ };
+}
diff --git a/krebs/5pkgs/haskell/nix-diff.nix b/krebs/5pkgs/haskell/nix-diff/default.nix
index 2070dbd2e..df0315048 100644
--- a/krebs/5pkgs/haskell/nix-diff.nix
+++ b/krebs/5pkgs/haskell/nix-diff/default.nix
@@ -4,12 +4,15 @@
}:
mkDerivation {
pname = "nix-diff";
- version = "1.0.0";
+ version = "1.0.0-krebs1";
src = fetchgit {
url = "https://github.com/Gabriel439/nix-diff";
sha256 = "1k00nx8pannqmpzadkwfrs6bf79yk22ynhd033z5rsyw0m8fcz9k";
rev = "e32ffa2c7f38b47a71325a042c1d887fb46cdf7d";
};
+ patches = [
+ ./nixos-system.patch
+ ];
isLibrary = false;
isExecutable = true;
executableHaskellDepends = [
diff --git a/krebs/5pkgs/haskell/nix-diff/nixos-system.patch b/krebs/5pkgs/haskell/nix-diff/nixos-system.patch
new file mode 100644
index 000000000..03e186aa9
--- /dev/null
+++ b/krebs/5pkgs/haskell/nix-diff/nixos-system.patch
@@ -0,0 +1,18 @@
+diff --git a/src/Main.hs b/src/Main.hs
+index 959ab8e..d3b6077 100644
+--- a/src/Main.hs
++++ b/src/Main.hs
+@@ -95,7 +95,12 @@ pathToText path =
+ underneath `/nix/store`, but this is the overwhelmingly common use case
+ -}
+ derivationName :: FilePath -> Text
+-derivationName = Data.Text.dropEnd 4 . Data.Text.drop 44 . pathToText
++derivationName p =
++ if Data.Text.isPrefixOf "nixos-system" s
++ then "nixos-system"
++ else s
++ where
++ s = Data.Text.dropEnd 4 . Data.Text.drop 44 . pathToText $ p
+
+ -- | Group input derivations by their name
+ groupByName :: Map FilePath (Set Text) -> Map Text (Map FilePath (Set Text))
diff --git a/krebs/5pkgs/simple/apt-cacher-ng/default.nix b/krebs/5pkgs/simple/apt-cacher-ng/default.nix
deleted file mode 100644
index e3986713b..000000000
--- a/krebs/5pkgs/simple/apt-cacher-ng/default.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ stdenv, fetchurl, cmake, doxygen, zlib, openssl, bzip2, pkgconfig, libpthreadstubs }:
-
-stdenv.mkDerivation rec {
- name = "apt-cacher-ng-${version}";
- version = "2";
-
- src = fetchurl {
- url = "http://ftp.debian.org/debian/pool/main/a/apt-cacher-ng/apt-cacher-ng_${version}.orig.tar.xz";
- sha256 = "0bkc3012vinridl5ch46pwnxjalymx4wf6nxax64nm7bdkcj9azf";
- };
-
- NIX_LDFLAGS = "-lpthread";
- buildInputs = [ doxygen cmake zlib openssl bzip2 pkgconfig libpthreadstubs ];
-
- meta = {
- description = "A caching proxy specialized for linux distribution files";
- homepage = http://www.unix-ag.uni-kl.de/~bloch/acng/;
- license = stdenv.lib.licenses.gpl2;
- maintainers = [ stdenv.lib.maintainers.makefu ];
- };
-}
diff --git a/krebs/5pkgs/simple/cidr2glob.nix b/krebs/5pkgs/simple/cidr2glob.nix
new file mode 100644
index 000000000..9b0b3f86b
--- /dev/null
+++ b/krebs/5pkgs/simple/cidr2glob.nix
@@ -0,0 +1,30 @@
+{ python, writeScriptBin, ... }:
+
+let
+ pythonEnv = python.withPackages (ps: [ ps.netaddr ]);
+in
+ writeScriptBin "cidr2glob" ''
+ #! ${pythonEnv}/bin/python
+
+ import netaddr
+ import re
+ import sys
+
+ def cidr2glob(cidr):
+ net = netaddr.IPNetwork(cidr)
+
+ if net.prefixlen <= 8:
+ return map(lambda subnet: re.sub(r'\.0\.0\.0$', '.*', str(subnet.ip)), net.subnet(8))
+ elif net.prefixlen <= 16:
+ return map(lambda subnet: re.sub(r'\.0\.0$', '.*', str(subnet.ip)), net.subnet(16))
+ elif net.prefixlen <= 24:
+ return map(lambda subnet: re.sub(r'\.0$', '.*', str(subnet.ip)), net.subnet(24))
+ else:
+ return map(lambda ip: str(ip), list(net))
+
+ if __name__ == "__main__":
+ for cidr in sys.stdin:
+ for glob in cidr2glob(cidr):
+ print glob
+
+ ''
diff --git a/krebs/5pkgs/simple/populate/default.nix b/krebs/5pkgs/simple/populate/default.nix
index 78ee2f042..62e3ab216 100644
--- a/krebs/5pkgs/simple/populate/default.nix
+++ b/krebs/5pkgs/simple/populate/default.nix
@@ -1,24 +1,27 @@
-{ coreutils, fetchgit, git, jq, openssh, proot, rsync, stdenv, ... }:
+{ coreutils, fetchgit, findutils, git, gnused, jq, openssh, pass, rsync, stdenv
+}:
let
PATH = stdenv.lib.makeBinPath [
coreutils
+ findutils
git
+ gnused
jq
openssh
- proot
+ pass
rsync
];
in
stdenv.mkDerivation rec {
name = "populate";
- version = "1.2.5";
+ version = "2.1.0";
src = fetchgit {
url = http://cgit.ni.krebsco.de/populate;
rev = "refs/tags/v${version}";
- sha256 = "10s4x117zp5whqq991xzw1i2jc1xhl580kx8hhzv8f1b4c9carx1";
+ sha256 = "0cr50y6h6nps0qgpmi01h0z9wzpv2704y5zgx2salk1grkmvcfmh";
};
phases = [
diff --git a/krebs/source.nix b/krebs/source.nix
index 39a388e03..8fbdce284 100644
--- a/krebs/source.nix
+++ b/krebs/source.nix
@@ -7,13 +7,16 @@ host@{ name, secure ? false }: let
in
evalSource (toString _file) {
nixos-config.symlink = "stockholm/krebs/1systems/${name}/config.nix";
- secrets.file = getAttr builder {
- buildbot = toString <stockholm/krebs/6tests/data/secrets>;
- krebs = "${getEnv "HOME"}/secrets/krebs/${host.name}";
+ secrets = getAttr builder {
+ buildbot.file = toString <stockholm/krebs/6tests/data/secrets>;
+ krebs.pass = {
+ dir = "${getEnv "HOME"}/brain";
+ name = "krebs-secrets/${name}";
+ };
};
stockholm.file = toString <stockholm>;
nixpkgs.git = {
url = https://github.com/NixOS/nixpkgs;
- ref = "0c5a587eeba5302ff87e494baefd2f14f4e19bee"; # nixos-17.09 @ 2017-11-10
+ ref = "cb751f9b1c3fe6885f3257e69ce328f77523ad77"; # nixos-17.09 @ 2017-12-13
};
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-03 04:03:50 +0000