diff options
Diffstat (limited to 'lass/2configs')
| -rw-r--r-- | lass/2configs/downloading.nix | 1 | ||||
| -rw-r--r-- | lass/2configs/git.nix | 14 | ||||
| -rw-r--r-- | lass/2configs/otp-ssh.nix | 18 | ||||
| -rw-r--r-- | lass/2configs/wine.nix | 3 |
4 files changed, 34 insertions, 2 deletions
diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix index d32262810..9582413ed 100644 --- a/lass/2configs/downloading.nix +++ b/lass/2configs/downloading.nix @@ -17,6 +17,7 @@ with import <stockholm/lib>; lass-shodan.pubkey lass-icarus.pubkey makefu.pubkey + wine-mors.pubkey ]; }; diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix index 4137c482e..a66d08927 100644 --- a/lass/2configs/git.nix +++ b/lass/2configs/git.nix @@ -49,6 +49,7 @@ let { brain = { collaborators = with config.krebs.users; [ tv makefu ]; + announce = true; }; } // import <secrets/repos.nix> { inherit config lib pkgs; } @@ -75,9 +76,20 @@ let public = true; }; - make-restricted-repo = name: { collaborators ? [], ... }: { + make-restricted-repo = name: { collaborators ? [], announce ? false, ... }: { inherit collaborators name; public = false; + hooks = optionalAttrs announce { + post-receive = pkgs.git-hooks.irc-announce { + # TODO make nick = config.krebs.build.host.name the default + nick = config.krebs.build.host.name; + channel = "#retiolum"; + server = "ni.r"; + verbose = true; + # TODO define branches in some kind of option per repo + branches = [ "master" "staging*" ]; + }; + }; }; make-rules = diff --git a/lass/2configs/otp-ssh.nix b/lass/2configs/otp-ssh.nix new file mode 100644 index 000000000..f9984e245 --- /dev/null +++ b/lass/2configs/otp-ssh.nix @@ -0,0 +1,18 @@ +{ pkgs, ... }: +# Enables second factor for ssh password login + +## Usage: +# gen-oath-safe <username> totp +## scan the qrcode with google authenticator (or FreeOTP) +## copy last line into secrets/<host>/users.oath (chmod 700) +{ + security.pam.oath = { + # enabling it will make it a requisite of `all` services + # enable = true; + digits = 6; + # TODO assert existing + usersFile = (toString <secrets>) + "/users.oath"; + }; + # I want TFA only active for sshd with password-auth + security.pam.services.sshd.oathAuth = true; +} diff --git a/lass/2configs/wine.nix b/lass/2configs/wine.nix index d4a91e645..2444d32d3 100644 --- a/lass/2configs/wine.nix +++ b/lass/2configs/wine.nix @@ -5,7 +5,8 @@ let in { krebs.per-user.wine.packages = with pkgs; [ - wineUnstable + wineFull + #(wineFull.override { wineBuild = "wine64"; }) ]; users.users= { wine = { |