8 files changed, 82 insertions, 12 deletions
diff --git a/lass/2configs/fetchWallpaper.nix b/lass/2configs/fetchWallpaper.nix
index 065ee9c42..251f886a9 100644
--- a/lass/2configs/fetchWallpaper.nix
+++ b/lass/2configs/fetchWallpaper.nix
@@ -5,8 +5,7 @@ let
 in {
   krebs.fetchWallpaper = {
     enable = true;
-    unitConfig.ConditionPathExists = "!/var/run/ppp0.pid";
-    url = "prism/realwallpaper-krebs.png";
+    url = "prism/realwallpaper-krebs-stars.png";
   };
 }
 
diff --git a/lass/2configs/hass/default.nix b/lass/2configs/hass/default.nix
index 7765db84e..be9c32809 100644
--- a/lass/2configs/hass/default.nix
+++ b/lass/2configs/hass/default.nix
@@ -43,11 +43,9 @@ in {
 
   services.home-assistant = {
     enable = true;
-    package = (unstable.home-assistant.overrideAttrs (old: {
+    package = unstable.home-assistant.overrideAttrs (old: {
       doInstallCheck = false;
-    })).override {
-      extraPackages = _: [ dwdwfsapi ];
-    };
+    });
     configWritable = true;
     lovelaceConfigWritable = true;
     config = let
diff --git a/lass/2configs/realwallpaper.nix b/lass/2configs/realwallpaper.nix
index 7a2f6e916..0bae91d89 100644
--- a/lass/2configs/realwallpaper.nix
+++ b/lass/2configs/realwallpaper.nix
@@ -28,6 +28,12 @@ in {
     locations."/realwallpaper-krebs.png".extraConfig = ''
       root /var/realwallpaper/;
     '';
+    locations."/realwallpaper-krebs-stars.png".extraConfig = ''
+      root /var/realwallpaper/;
+    '';
+    locations."/realwallpaper-krebs-stars-berlin.png".extraConfig = ''
+      root /var/realwallpaper/;
+    '';
     locations."/realwallpaper-video.mp4".extraConfig = ''
       root /var/realwallpaper/archive;
     '';
diff --git a/lass/2configs/searx.nix b/lass/2configs/searx.nix
new file mode 100644
index 000000000..ed6586a26
--- /dev/null
+++ b/lass/2configs/searx.nix
@@ -0,0 +1,23 @@
+{ pkgs, ... }:
+let
+  port = 8889;
+in {
+  services.nginx.virtualHosts.search = {
+    serverAliases = [ "search.r" ];
+    locations."/".extraConfig = ''
+      proxy_set_header Host $host;
+      proxy_pass http://127.0.0.1:${builtins.toString port};
+    '';
+  };
+
+  services.searx = {
+    enable = true;
+    configFile = pkgs.writeText "searx.cfg" (builtins.toJSON {
+      use_default_settings = true;
+      server = {
+        port = port;
+        secret_key = builtins.readFile <secrets/searx.key>;
+      };
+    });
+  };
+}
diff --git a/lass/2configs/syncthing.nix b/lass/2configs/syncthing.nix
index 7801c758c..7b8850681 100644
--- a/lass/2configs/syncthing.nix
+++ b/lass/2configs/syncthing.nix
@@ -3,10 +3,6 @@
   imports = [ <stockholm/krebs/2configs/syncthing.nix> ];
   services.syncthing = {
     group = "syncthing";
-    declarative = {
-      key = toString <secrets/syncthing.key>;
-      cert = toString <secrets/syncthing.cert>;
-    };
   };
   krebs.iptables.tables.filter.INPUT.rules = [
     { predicate = "-p tcp --dport 22000"; target = "ACCEPT";}
@@ -16,6 +12,4 @@
   system.activationScripts.syncthing-home = mkDefault ''
     ${pkgs.coreutils}/bin/chmod a+x /home/lass
   '';
-
-  boot.kernel.sysctl."fs.inotify.max_user_watches" = 524288;
 }
diff --git a/lass/2configs/tests/dummy-secrets/initrd/ssh.ed25519_key b/lass/2configs/tests/dummy-secrets/initrd/ssh.ed25519_key
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/lass/2configs/tests/dummy-secrets/initrd/ssh.ed25519_key
diff --git a/lass/2configs/tests/dummy-secrets/searx.key b/lass/2configs/tests/dummy-secrets/searx.key
new file mode 100644
index 000000000..bd88e01cd
--- /dev/null
+++ b/lass/2configs/tests/dummy-secrets/searx.key
@@ -0,0 +1 @@
+yolo
diff --git a/lass/2configs/tor-initrd.nix b/lass/2configs/tor-initrd.nix
new file mode 100644
index 000000000..64e64b5b3
--- /dev/null
+++ b/lass/2configs/tor-initrd.nix
@@ -0,0 +1,49 @@
+{config, pkgs, ... }:
+## unlock command:
+# (pass admin/$host/root;echo) | torify ssh root@$(pass hosts/$host/initrd/hostname) 'cat > /crypt-ramfs/passphrase'
+{
+  boot.initrd.network.enable = true;
+  boot.initrd.network.ssh = {
+    enable = true;
+    port = 22;
+    authorizedKeys = [
+      config.krebs.users.lass.pubkey
+      config.krebs.users.lass-mors.pubkey
+      config.krebs.users.lass-green.pubkey
+    ];
+    hostKeys = [ <secrets/initrd/ssh.ed25519_key> ];
+  };
+  boot.initrd.availableKernelModules = [ "e1000e" ];
+
+  boot.initrd.secrets = {
+    "/etc/tor/onion/bootup" = <secrets/initrd>;
+  };
+
+  boot.initrd.extraUtilsCommands = ''
+    copy_bin_and_libs ${pkgs.tor}/bin/tor
+  '';
+
+  # start tor during boot process
+  boot.initrd.network.postCommands = let
+    torRc = (pkgs.writeText "tor.rc" ''
+      DataDirectory /etc/tor
+      SOCKSPort 127.0.0.1:9050 IsolateDestAddr
+      SOCKSPort 127.0.0.1:9063
+      HiddenServiceDir /etc/tor/onion/bootup
+      HiddenServicePort 22 127.0.0.1:22
+    '');
+  in ''
+    echo "tor: preparing onion folder"
+    # have to do this otherwise tor does not want to start
+    chmod -R 700 /etc/tor
+
+    echo "make sure localhost is up"
+    ip a a 127.0.0.1/8 dev lo
+    ip link set lo up
+
+    echo "tor: starting tor"
+    tor -f ${torRc} --verify-config
+    tor -f ${torRc} &
+  '';
+}
+