summaryrefslogtreecommitdiffstats
path: root/lass/2configs
diff options
context:
space:
mode:
Diffstat (limited to 'lass/2configs')
-rw-r--r--lass/2configs/baseX.nix13
-rw-r--r--lass/2configs/binary-cache/client.nix9
-rw-r--r--lass/2configs/binary-cache/server.nix30
-rw-r--r--lass/2configs/binary-caches.nix13
-rw-r--r--lass/2configs/buildbot-standalone.nix100
-rw-r--r--lass/2configs/c-base.nix (renamed from lass/2configs/cbase.nix)0
-rw-r--r--lass/2configs/default.nix21
-rw-r--r--lass/2configs/downloading.nix1
-rw-r--r--lass/2configs/exim-smarthost.nix2
-rw-r--r--lass/2configs/fetchWallpaper.nix3
-rw-r--r--lass/2configs/gc.nix8
-rw-r--r--lass/2configs/git.nix13
-rw-r--r--lass/2configs/hw/tp-x220.nix54
-rw-r--r--lass/2configs/mail.nix7
-rw-r--r--lass/2configs/newsbot-js.nix3
-rw-r--r--lass/2configs/nixpkgs.nix8
-rw-r--r--lass/2configs/power-action.nix41
-rw-r--r--lass/2configs/pulse.nix96
-rw-r--r--lass/2configs/radio.nix25
-rw-r--r--lass/2configs/realwallpaper-server.nix32
-rw-r--r--lass/2configs/realwallpaper.nix29
-rw-r--r--lass/2configs/repo-sync.nix106
-rw-r--r--lass/2configs/tests/dummy-secrets/cbase.txt0
-rw-r--r--lass/2configs/tests/dummy-secrets/hashedPasswords.nix1
-rw-r--r--lass/2configs/tests/dummy-secrets/icecast-admin-pw1
-rw-r--r--lass/2configs/tests/dummy-secrets/icecast-source-pw1
-rw-r--r--lass/2configs/tests/dummy-secrets/lassul.us.dkim.priv3
-rw-r--r--lass/2configs/tests/dummy-secrets/mysql_rootPassword1
-rw-r--r--lass/2configs/tests/dummy-secrets/nix-serve.key1
-rw-r--r--lass/2configs/tests/dummy-secrets/repos.nix1
-rw-r--r--lass/2configs/tests/dummy-secrets/retiolum.rsa_key.priv4
-rw-r--r--lass/2configs/tests/dummy-secrets/ssh.id_ed255193
-rw-r--r--lass/2configs/tests/dummy-secrets/ssh.id_rsa3
-rw-r--r--lass/2configs/tests/dummy-secrets/transmission-pw1
-rw-r--r--lass/2configs/umts.nix62
-rw-r--r--lass/2configs/vim.nix463
-rw-r--r--lass/2configs/websites/domsen.nix105
-rw-r--r--lass/2configs/websites/fritz.nix39
-rw-r--r--lass/2configs/weechat.nix1
-rw-r--r--lass/2configs/wordpress.nix59
-rw-r--r--lass/2configs/xserver/Xresources.nix47
-rw-r--r--lass/2configs/zsh.nix8
42 files changed, 1084 insertions, 334 deletions
diff --git a/lass/2configs/baseX.nix b/lass/2configs/baseX.nix
index 16f7502ac..6d26ff89a 100644
--- a/lass/2configs/baseX.nix
+++ b/lass/2configs/baseX.nix
@@ -8,7 +8,13 @@ in {
#./urxvt.nix
./xserver
./mpv.nix
+ #./pulse.nix
+ ./power-action.nix
];
+ hardware.pulseaudio = {
+ enable = true;
+ systemWide = true;
+ };
users.extraUsers.mainUser.extraGroups = [ "audio" ];
@@ -16,11 +22,6 @@ in {
virtualisation.libvirtd.enable = true;
- hardware.pulseaudio = {
- enable = true;
- systemWide = true;
- };
-
programs.ssh.startAgent = false;
security.setuidPrograms = [ "slock" ];
@@ -32,6 +33,7 @@ in {
environment.systemPackages = with pkgs; [
+ acpi
dmenu
gitAndTools.qgit
lm_sensors
@@ -44,6 +46,7 @@ in {
sxiv
xclip
xorg.xbacklight
+ xorg.xhost
xsel
zathura
diff --git a/lass/2configs/binary-cache/client.nix b/lass/2configs/binary-cache/client.nix
new file mode 100644
index 000000000..108ff7a1e
--- /dev/null
+++ b/lass/2configs/binary-cache/client.nix
@@ -0,0 +1,9 @@
+{ config, ... }:
+
+{
+ nix = {
+ binaryCaches = ["http://cache.prism.r"];
+ binaryCachePublicKeys = ["cache.prism-1:+S+6Lo/n27XEtvdlQKuJIcb1yO5NUqUCE2lolmTgNJU="];
+ };
+}
+
diff --git a/lass/2configs/binary-cache/server.nix b/lass/2configs/binary-cache/server.nix
new file mode 100644
index 000000000..22ec04307
--- /dev/null
+++ b/lass/2configs/binary-cache/server.nix
@@ -0,0 +1,30 @@
+{ config, lib, pkgs, ...}:
+
+{
+ # generate private key with:
+ # nix-store --generate-binary-cache-key my-secret-key my-public-key
+ services.nix-serve = {
+ enable = true;
+ secretKeyFile = config.krebs.secret.files.nix-serve-key.path;
+ };
+
+ systemd.services.nix-serve = {
+ requires = ["secret.service"];
+ after = ["secret.service"];
+ };
+ krebs.secret.files.nix-serve-key = {
+ path = "/run/secret/nix-serve.key";
+ owner.name = "nix-serve";
+ source-path = toString <secrets> + "/nix-serve.key";
+ };
+ krebs.nginx = {
+ enable = true;
+ servers.nix-serve = {
+ server-names = [ "cache.prism.r" ];
+ locations = lib.singleton (lib.nameValuePair "/" ''
+ proxy_pass http://localhost:${toString config.services.nix-serve.port};
+ '');
+ };
+ };
+}
+
diff --git a/lass/2configs/binary-caches.nix b/lass/2configs/binary-caches.nix
deleted file mode 100644
index c2727520d..000000000
--- a/lass/2configs/binary-caches.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ config, ... }:
-
-{
- nix.sshServe.enable = true;
- nix.sshServe.keys = [
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBF9SBNKE3Pw/ALwTfzpzs+j6Rpaf0kUy6FiPMmgNNNt root@mors"
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCZSq5oLrokkh3F+MOdK5/nzVIEDvqyvfzLMNWmzsYD root@uriel"
- ];
- nix.binaryCaches = [
- #"scp://nix-ssh@mors"
- #"scp://nix-ssh@uriel"
- ];
-}
diff --git a/lass/2configs/buildbot-standalone.nix b/lass/2configs/buildbot-standalone.nix
index 604d0728d..04bdcf9d8 100644
--- a/lass/2configs/buildbot-standalone.nix
+++ b/lass/2configs/buildbot-standalone.nix
@@ -1,6 +1,14 @@
{ lib, config, pkgs, ... }:
-{
- krebs.buildbot.master = let
+
+with config.krebs.lib;
+
+let
+ sshWrapper = pkgs.writeDash "ssh-wrapper" ''
+ ${pkgs.openssh}/bin/ssh -i ${shell.escape config.lass.build-ssh-privkey.path} "$@"
+ '';
+
+in {
+ config.krebs.buildbot.master = let
stockholm-mirror-url = http://cgit.prism/stockholm ;
in {
slaves = {
@@ -25,20 +33,38 @@
sched.append(schedulers.SingleBranchScheduler(
## all branches
change_filter=util.ChangeFilter(branch_re=".*"),
- # treeStableTimer=10,
+ treeStableTimer=10,
name="fast-all-branches",
builderNames=["fast-tests"]))
'';
+ build-scheduler = ''
+ # build all hosts
+ sched.append(schedulers.SingleBranchScheduler(
+ change_filter=util.ChangeFilter(branch_re=".*"),
+ treeStableTimer=10,
+ name="prism-all-branches",
+ builderNames=["build-all"]))
+ '';
};
builder_pre = ''
# prepare grab_repo step for stockholm
grab_repo = steps.Git(repourl=stockholm_repo, mode='incremental')
- env = {"LOGNAME": "lass", "NIX_REMOTE": "daemon"}
+ # TODO: get nixpkgs/stockholm paths from krebs
+ env_lass = {
+ "LOGNAME": "lass",
+ "NIX_REMOTE": "daemon",
+ "dummy_secrets": "true",
+ }
+ env_makefu = {
+ "LOGNAME": "makefu",
+ "NIX_REMOTE": "daemon",
+ "dummy_secrets": "true",
+ }
# prepare nix-shell
# the dependencies which are used by the test script
- deps = [ "gnumake", "jq","nix","rsync" ]
+ deps = [ "gnumake", "jq", "nix", "rsync", "proot" ]
# TODO: --pure , prepare ENV in nix-shell command:
# SSL_CERT_FILE,LOGNAME,NIX_REMOTE
nixshell = ["nix-shell",
@@ -51,16 +77,45 @@
factory.addStep(steps.ShellCommand(**kwargs))
'';
builder = {
+ build-all = ''
+ f = util.BuildFactory()
+ f.addStep(grab_repo)
+ for i in [ "mors", "uriel", "shodan", "helios", "cloudkrebs", "echelon", "dishfire", "prism" ]:
+ addShell(f,name="build-{}".format(i),env=env_lass,
+ command=nixshell + \
+ ["make \
+ test \
+ ssh=${sshWrapper} \
+ target=build@localhost:${config.users.users.build.home}/testbuild \
+ method=build \
+ system={}".format(i)])
+
+ for i in [ "pornocauster", "wry" ]:
+ addShell(f,name="build-{}".format(i),env=env_makefu,
+ command=nixshell + \
+ ["make \
+ test \
+ ssh=${sshWrapper} \
+ target=build@localhost:${config.users.users.build.home}/testbuild \
+ method=build \
+ system={}".format(i)])
+
+ bu.append(util.BuilderConfig(name="build-all",
+ slavenames=slavenames,
+ factory=f))
+
+ '';
+
fast-tests = ''
f = util.BuildFactory()
f.addStep(grab_repo)
for i in [ "prism", "mors", "echelon" ]:
- addShell(f,name="populate-{}".format(i),env=env,
+ addShell(f,name="populate-{}".format(i),env=env_lass,
command=nixshell + \
["{}( make system={} eval.config.krebs.build.populate \
| jq -er .)".format("!" if "failing" in i else "",i)])
- addShell(f,name="build-test-minimal",env=env,
+ addShell(f,name="build-test-minimal",env=env_lass,
command=nixshell + \
["nix-instantiate \
--show-trace --eval --strict --json \
@@ -86,17 +141,17 @@
};
};
- krebs.buildbot.slave = {
+ config.krebs.buildbot.slave = {
enable = true;
masterhost = "localhost";
username = "testslave";
password = "lasspass";
packages = with pkgs;[ git nix gnumake jq rsync ];
extraEnviron = {
- NIX_PATH="nixpkgs=/var/src/nixpkgs:nixos-config=./shared/1systems/wolf.nix";
+ NIX_PATH="nixpkgs=/var/src/nixpkgs";
};
};
- krebs.iptables = {
+ config.krebs.iptables = {
tables = {
filter.INPUT.rules = [
{ predicate = "-p tcp --dport 8010"; target = "ACCEPT"; }
@@ -104,4 +159,29 @@
];
};
};
+
+ #ssh workaround for make test
+ options.lass.build-ssh-privkey = mkOption {
+ type = types.secret-file;
+ default = {
+ path = "${config.users.users.buildbotSlave.home}/ssh.privkey";
+ owner = { inherit (config.users.users.buildbotSlave ) name uid;};
+ source-path = toString <secrets> + "/build.ssh.key";
+ };
+ };
+ config.krebs.secret.files = {
+ build-ssh-privkey = config.lass.build-ssh-privkey;
+ };
+ config.users.users = {
+ build = {
+ name = "build";
+ uid = genid "build";
+ home = "/home/build";
+ useDefaultShell = true;
+ createHome = true;
+ openssh.authorizedKeys.keys = [
+ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDiV0Xn60aVLHC/jGJknlrcxSvKd/MVeh2tjBpxSBT3II9XQGZhID2Gdh84eAtoWyxGVFQx96zCHSuc7tfE2YP2LhXnwaxHTeDc8nlMsdww53lRkxihZIEV7QHc/3LRcFMkFyxdszeUfhWz8PbJGL2GYT+s6CqoPwwa68zF33U1wrMOAPsf/NdpSN4alsqmjFc2STBjnOd9dXNQn1VEJQqGLG3kR3WkCuwMcTLS5eu0KLwG4i89Twjy+TGp2QsF5K6pNE+ZepwaycRgfYzGcPTn5d6YQXBgcKgHMoSJsK8wqpr0+eFPCDiEA3HDnf76E4mX4t6/9QkMXCLmvs0IO/WP lass@mors"
+ ];
+ };
+ };
}
diff --git a/lass/2configs/cbase.nix b/lass/2configs/c-base.nix
index 9d13bc30d..9d13bc30d 100644
--- a/lass/2configs/cbase.nix
+++ b/lass/2configs/c-base.nix
diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix
index 1c06acf38..377554514 100644
--- a/lass/2configs/default.nix
+++ b/lass/2configs/default.nix
@@ -7,6 +7,9 @@ with config.krebs.lib;
../2configs/zsh.nix
../2configs/mc.nix
../2configs/retiolum.nix
+ ../2configs/nixpkgs.nix
+ ../2configs/binary-cache/client.nix
+ ../2configs/gc.nix
./backups.nix
{
users.extraUsers =
@@ -52,21 +55,18 @@ with config.krebs.lib;
user = config.krebs.users.lass;
source = mapAttrs (_: mkDefault) ({
nixos-config = "symlink:stockholm/lass/1systems/${config.krebs.build.host.name}.nix";
- secrets = "/home/lass/secrets/${config.krebs.build.host.name}";
+ secrets = if getEnv "dummy_secrets" == "true"
+ then toString <stockholm/lass/2configs/tests/dummy-secrets>
+ else "/home/lass/secrets/${config.krebs.build.host.name}";
#secrets-common = "/home/lass/secrets/common";
- stockholm = "/home/lass/stockholm";
- nixpkgs = {
- url = https://github.com/lassulus/nixpkgs;
- rev = "f632f8edaf80ffa8bf0b8c9b9064cae3ccbe3894";
- dev = "/home/lass/src/nixpkgs";
- };
+ stockholm = getEnv "PWD";
} // optionalAttrs config.krebs.build.host.secure {
#secrets-master = "/home/lass/secrets/master";
});
};
};
- nix.useChroot = true;
+ nix.useSandbox = true;
users.mutableUsers = false;
@@ -114,8 +114,13 @@ with config.krebs.lib;
#neat utils
krebspaste
+ pciutils
psmisc
+ q
+ rs
+ tmux
untilport
+ usbutils
#unpack stuff
p7zip
diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix
index 3639a743a..cf9b631c8 100644
--- a/lass/2configs/downloading.nix
+++ b/lass/2configs/downloading.nix
@@ -21,6 +21,7 @@ in {
openssh.authorizedKeys.keys = [
config.krebs.users.lass.pubkey
config.krebs.users.lass-uriel.pubkey
+ config.krebs.users.lass-shodan.pubkey
];
};
diff --git a/lass/2configs/exim-smarthost.nix b/lass/2configs/exim-smarthost.nix
index 8199f2bd7..1ba99c8cb 100644
--- a/lass/2configs/exim-smarthost.nix
+++ b/lass/2configs/exim-smarthost.nix
@@ -28,6 +28,8 @@ with config.krebs.lib;
{ from = "wordpress@ubikmedia.de"; to = lass.mail; }
{ from = "finanzamt@lassul.us"; to = lass.mail; }
{ from = "dominik@apanowicz.de"; to = "dma@ubikmedia.eu"; }
+ { from = "netzclub@lassul.us"; to = lass.mail; }
+ { from = "nebenan@lassul.us"; to = lass.mail; }
];
system-aliases = [
{ from = "mailer-daemon"; to = "postmaster"; }
diff --git a/lass/2configs/fetchWallpaper.nix b/lass/2configs/fetchWallpaper.nix
index f3b65e816..a724e2e45 100644
--- a/lass/2configs/fetchWallpaper.nix
+++ b/lass/2configs/fetchWallpaper.nix
@@ -5,7 +5,8 @@ let
in {
krebs.fetchWallpaper = {
enable = true;
- url = "cloudkrebs/wallpaper.png";
+ unitConfig.ConditionPathExists = "!/var/run/ppp0.pid";
+ url = "prism/wallpaper.png";
};
}
diff --git a/lass/2configs/gc.nix b/lass/2configs/gc.nix
new file mode 100644
index 000000000..8762ad95e
--- /dev/null
+++ b/lass/2configs/gc.nix
@@ -0,0 +1,8 @@
+{ config, ... }:
+
+with config.krebs.lib;
+{
+ nix.gc = {
+ automatic = ! elem config.krebs.build.host.name [ "prism" "mors" ];
+ };
+}
diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix
index c0affe981..381a37e1b 100644
--- a/lass/2configs/git.nix
+++ b/lass/2configs/git.nix
@@ -29,18 +29,10 @@ let
rules = concatMap make-rules (attrValues repos);
public-repos = mapAttrs make-public-repo {
- painload = {};
stockholm = {
cgit.desc = "take all the computers hostage, they'll love you!";
};
- wai-middleware-time = {};
- web-routes-wai-custom = {};
- go = {};
- newsbot-js = {};
kimsufi-check = {};
- realwallpaper = {};
- xmonad-stockholm = {};
- the_playlist = {};
} // mapAttrs make-public-repo-silent {
the_playlist = {};
};
@@ -50,8 +42,6 @@ let
brain = {
collaborators = with config.krebs.users; [ tv makefu ];
};
- extraction_webinterface = {};
- politics-fetching = {};
} //
import <secrets/repos.nix> { inherit config lib pkgs; }
);
@@ -66,6 +56,7 @@ let
channel = "#retiolum";
server = "cd.retiolum";
verbose = config.krebs.build.host.name == "prism";
+ branches = [ "master" ];
};
};
};
@@ -84,7 +75,7 @@ let
with git // config.krebs.users;
repo:
singleton {
- user = [ lass lass-helios lass-uriel ];
+ user = [ lass lass-uriel ];
repo = [ repo ];
perm = push "refs/*" [ non-fast-forward create delete merge ];
} ++
diff --git a/lass/2configs/hw/tp-x220.nix b/lass/2configs/hw/tp-x220.nix
new file mode 100644
index 000000000..be1faccea
--- /dev/null
+++ b/lass/2configs/hw/tp-x220.nix
@@ -0,0 +1,54 @@
+{ config, lib, pkgs, ... }:
+
+with config.krebs.lib;
+{
+ networking.wireless.enable = lib.mkDefault true;
+
+ hardware.enableAllFirmware = true;
+ nixpkgs.config.allowUnfree = true;
+
+ hardware.cpu.intel.updateMicrocode = true;
+
+ zramSwap.enable = true;
+ zramSwap.numDevices = 2;
+
+ hardware.trackpoint = {
+ enable = true;
+ sensitivity = 220;
+ speed = 0;
+ emulateWheel = true;
+ };
+
+ services.tlp.enable = true;
+ services.tlp.extraConfig = ''
+ # BUG: http://linrunner.de/en/tlp/docs/tlp-faq.html#erratic-battery
+ #START_CHARGE_THRESH_BAT0=80
+ STOP_CHARGE_THRESH_BAT0=95
+
+ CPU_SCALING_GOVERNOR_ON_AC=performance
+ CPU_SCALING_GOVERNOR_ON_BAT=ondemand
+ CPU_MIN_PERF_ON_AC=0
+ CPU_MAX_PERF_ON_AC=100
+ CPU_MIN_PERF_ON_BAT=0
+ CPU_MAX_PERF_ON_BAT=30
+ '';
+
+ boot = {
+ kernelModules = [ "kvm-intel" "acpi_call" "tpm-rng" ];
+ extraModulePackages = [ config.boot.kernelPackages.tp_smapi ];
+ };
+
+ hardware.opengl.extraPackages = [
+ pkgs.vaapiIntel
+ pkgs.vaapiVdpau
+ ];
+
+ services.xserver = {
+ videoDriver = "intel";
+ deviceSection = ''
+ Option "AccelMethod" "sna"
+ '';
+ };
+
+ security.rngd.enable = true;
+}
diff --git a/lass/2configs/mail.nix b/lass/2configs/mail.nix
index 72d6f987f..7c050005b 100644
--- a/lass/2configs/mail.nix
+++ b/lass/2configs/mail.nix
@@ -10,8 +10,9 @@ let
account default: prism
'';
- msmtp = pkgs.writeDashBin "msmtp" ''
- exec ${pkgs.msmtp}/bin/msmtp -C ${msmtprc} $@
+ msmtp = pkgs.writeBashBin "msmtp" ''
+ ${pkgs.coreutils}/bin/tee >(${pkgs.notmuch}/bin/notmuch insert +sent) | \
+ ${pkgs.msmtp}/bin/msmtp -C ${msmtprc} $@
'';
muttrc = pkgs.writeText "muttrc" ''
@@ -42,7 +43,7 @@ let
set nm_record = yes
set nm_record_tags = "-inbox me archive"
set virtual_spoolfile=yes # enable virtual folders
- set sendmail="msmtp" # enables parsing of outgoing mail
+ set sendmail="${msmtp}/bin/msmtp" # enables parsing of outgoing mail
set use_from=yes
set envelope_from=yes
diff --git a/lass/2configs/newsbot-js.nix b/lass/2configs/newsbot-js.nix
index 636b44395..f2b70d831 100644
--- a/lass/2configs/newsbot-js.nix
+++ b/lass/2configs/newsbot-js.nix
@@ -41,7 +41,6 @@ let
cryptogon|http://www.cryptogon.com/?feed=rss2|#news
csm|http://rss.csmonitor.com/feeds/csm|#news
csm_world|http://rss.csmonitor.com/feeds/world|#news
- cyberguerrilla|https://www.cyberguerrilla.org/a/2012/?feed=rss2|#news
danisch|http://www.danisch.de/blog/feed/|#news
dod|http://www.defense.gov/news/afps2.xml|#news
dwn|http://deutsche-wirtschafts-nachrichten.de/feed/customfeed/|#news
@@ -102,7 +101,7 @@ let
npr_headlines|http://www.npr.org/rss/rss.php?id=1001|#news
npr_pol|http://www.npr.org/rss/rss.php?id=1012|#news
npr_world|http://www.npr.org/rss/rss.php?id=1004|#news
- nsa|http://www.nsa.gov/rss.shtml|#news #bullerei
+ nsa|https://www.nsa.gov/rss.xml|#news #bullerei
nytimes|http://rss.nytimes.com/services/xml/rss/nyt/World.xml|#news
painload|https://github.com/krebscode/painload/commits/master.atom|#news
phys|http://phys.org/rss-feed/|#news
diff --git a/lass/2configs/nixpkgs.nix b/lass/2configs/nixpkgs.nix
new file mode 100644
index 000000000..0021a8615
--- /dev/null
+++ b/lass/2configs/nixpkgs.nix
@@ -0,0 +1,8 @@
+{ ... }:
+
+{
+ krebs.build.source.nixpkgs = {
+ url = https://github.com/lassulus/nixpkgs;
+ rev = "c78f9ad2f91019648bdcf5a911f86ea3a397d290";
+ };
+}
diff --git a/lass/2configs/power-action.nix b/lass/2configs/power-action.nix
new file mode 100644
index 000000000..0ff8547c7
--- /dev/null
+++ b/lass/2configs/power-action.nix
@@ -0,0 +1,41 @@
+{ config, pkgs, ... }:
+
+let
+ suspend = pkgs.writeDash "suspend" ''
+ ${pkgs.systemd}/bin/systemctl suspend
+ '';
+
+ speak = text:
+ pkgs.writeDash "speak" ''
+ ${pkgs.espeak}/bin/espeak -v +whisper -s 110 "${text}"
+ '';
+
+in {
+ lass.power-action = {
+ enable = true;
+ plans.low-battery = {
+ upperLimit = 30;
+ lowerLimit = 25;
+ charging = false;
+ action = pkgs.writeDash "warn-low-battery" ''
+ ${speak "power level low"}
+ '';
+ };
+ plans.suspend = {
+ upperLimit = 10;
+ lowerLimit = 0;
+ charging = false;
+ action = pkgs.writeDash "suspend-wrapper" ''
+ /var/setuid-wrappers/sudo ${suspend}
+ '';
+ };
+ };
+
+ users.users.power-action.extraGroups = [
+ "audio"
+ ];
+
+ security.sudo.extraConfig = ''
+ ${config.lass.power-action.user.name} ALL= (root) NOPASSWD: ${suspend}
+ '';
+}
diff --git a/lass/2configs/pulse.nix b/lass/2configs/pulse.nix
new file mode 100644
index 000000000..3be482191
--- /dev/null
+++ b/lass/2configs/pulse.nix
@@ -0,0 +1,96 @@
+{ config, lib, pkgs, ... }:
+
+with config.krebs.lib;
+let
+ pkg = pkgs.pulseaudioLight;
+ runDir = "/run/pulse";
+
+ alsaConf = pkgs.writeText "asound.conf" ''
+ ctl_type.pulse {
+ libs.native = ${pkgs.alsaPlugins}/lib/alsa-lib/libasound_module_ctl_pulse.so;
+ }
+ pcm_type.pulse {
+ libs.native = ${pkgs.alsaPlugins}/lib/alsa-lib/libasound_module_pcm_pulse.so;
+ }
+ ctl.!default {
+ type pulse
+ }
+ pcm.!default {
+ type pulse
+ }
+ '';
+
+ clientConf = pkgs.writeText "client.conf" ''
+ autospawn=no
+ default-server = unix:${runDir}/socket
+ '';
+
+ daemonConf = pkgs.writeText "daemon.conf" ''
+ exit-idle-time=0
+ flat-volumes = no
+ default-fragments = 4
+ default-fragment-size-msec = 25
+ '';
+
+ configFile = pkgs.writeText "default.pa" ''
+ .include ${pkg}/etc/pulse/default.pa
+ load-module ${toString [
+ "module-native-protocol-unix"
+ "auth-anonymous=1"
+ "socket=${runDir}/socket"
+ ]}
+ '';
+in
+
+{
+ environment = {
+ etc = {
+ "asound.conf".source = alsaConf;
+ # XXX mkForce is not strong enough (and neither is mkOverride) to create
+ # /etc/pulse/client.conf, see pulseaudio-hack below for a solution.
+ #"pulse/client.conf" = mkForce { source = clientConf; };
+ #"pulse/client.conf".source = mkForce clientConf;
+ "pulse/default.pa".source = configFile;
+ "pulse/daemon.pa".source = daemonConf;
+ };
+ systemPackages = [
+ pkg
+ ] ++ optionals config.services.xserver.enable [
+ pkgs.pavucontrol
+ ];
+ };
+
+ # Allow PulseAudio to get realtime priority using rtkit.
+ security.rtkit.enable = true;
+
+ system.activationScripts.pulseaudio-hack = ''
+ ln -fns ${clientConf} /etc/pulse/client.conf
+ '';
+
+ systemd.services.pulse = {
+ wantedBy = [ "sound.target" ];
+ before = [ "sound.target" ];
+ environment = {
+ PULSE_RUNTIME_PATH = "${runDir}/home";
+ };
+ serviceConfig = {
+ ExecStart = "${pkg}/bin/pulseaudio";
+ ExecStartPre = pkgs.writeDash "pulse-start" ''
+ install -o pulse -g audio -m 0750 -d ${runDir}
+ install -o pulse -g audio -m 0700 -d ${runDir}/home
+ '';
+ PermissionsStartOnly = "true";
+ User = "pulse";
+ };
+ };
+
+ users = {