21 files changed, 1067 insertions, 3 deletions

diff --git a/modules/cd/default.nix b/modules/cd/default.nix
new file mode 100644
index 000000000..a4e6bbc7d
--- /dev/null
+++ b/modules/cd/default.nix
@@ -0,0 +1,118 @@
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [
+      <secrets/hashedPasswords.nix>
+      ./iptables.nix
+      ./networking.nix
+      ../tv/base-cac-CentOS-7-64bit.nix
+      ../tv/ejabberd.nix # XXX echtes modul
+      ../tv/exim-smarthost.nix
+      ../tv/retiolum.nix
+      ../tv/sanitize.nix
+    ];
+
+  # "Developer 2" plan has two vCPUs.
+  nix.maxJobs = 2;
+
+
+  environment.systemPackages = with pkgs; [
+    htop
+    iftop
+    iotop
+    iptables
+    mutt    # for mv
+    nethogs
+    rxvt_unicode.terminfo
+    tcpdump
+  ];
+
+  security.rtkit.enable = false;
+
+  services.cron.enable = false;
+
+  services.ejabberd-cd = {
+    enable = true;
+  };
+
+  services.journald.extraConfig = ''
+    SystemMaxUse=1G
+    RuntimeMaxUse=128M
+  '';
+
+  services.ntp.enable = false;
+
+  services.openssh = {
+    enable = true;
+    hostKeys = [
+      # XXX bits here make no science
+      { bits = 8192; type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
+    ];
+    permitRootLogin = "yes";
+  };
+
+  services.retiolum = {
+    enable = true;
+    hosts = /etc/nixos/hosts;
+    privateKeyFile = "/etc/nixos/secrets/cd.retiolum.rsa_key.priv";
+    connectTo = [
+      "fastpoke"
+      "pigstarter"
+      "ire"
+    ];
+  };
+
+  sound.enable = false;
+
+  # TODO base
+  time.timeZone = "UTC";
+
+  # TODO replace by ./modules/cd-users.nix
+  users.extraGroups = {
+
+    # ● systemd-tmpfiles-setup.service - Create Volatile Files and Directories
+    #    Loaded: loaded (/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/example/systemd/system/systemd-tmpfiles-setup.service)
+    #    Active: failed (Result: exit-code) since Mon 2015-03-16 10:29:18 UTC; 4s ago
+    #      Docs: man:tmpfiles.d(5)
+    #            man:systemd-tmpfiles(8)
+    #   Process: 19272 ExecStart=/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/bin/systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev (code=exited, status=1/FAILURE)
+    #  Main PID: 19272 (code=exited, status=1/FAILURE)
+    # 
+    # Mar 16 10:29:17 cd systemd-tmpfiles[19272]: [/usr/lib/tmpfiles.d/legacy.conf:26] Unknown group 'lock'.
+    # Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal configured, ignoring.
+    # Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal/7b35116927d74ea58785e00b47ac0f0d configured, ignoring.
+    # Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service: main process exited, code=exited, status=1/FAILURE
+    # Mar 16 10:29:18 cd systemd[1]: Failed to start Create Volatile Files and Directories.
+    # Mar 16 10:29:18 cd systemd[1]: Unit systemd-tmpfiles-setup.service entered failed state.
+    # Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service failed.
+    # warning: error(s) occured while switching to the new configuration
+    lock.gid = 10001;
+
+  };
+  users.extraUsers =
+    {
+      root = {
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEieAihh+o208aeCA14fAtjzyZN/nrpOJt2vZ5VYZp69 deploy@wu"
+          "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDYv5OkVrnerkzJwgi7ol7HzcWJf4oWCJTX84trFX5vgJXu1zMvSe+koY8xpnMOd7WHF2wgsjjrFlMuixTrfMPc/OjvG2N1TlnvzlFD8ivTW/AJzDwNxT//niqAYAZ9kmb8e/zE/SyNHSKZcyEKGiiW2+YW9wWHPYRP/XiNEjLP3BeTGScMwWr001V/8m7ne4SGHrE1FbHbHqaBXgqUFgnvzMY3CsfDafODZlj5xSMNGHyLGNNKvu3YR1crcAjbQrBXBdwaArThFxp+e2uWrnffshlks6WtRyR1AFVjc/gxEG74Axq1AHY6EJm2Fw/JdFNiYQ7yyQZHS9bZJYjgnWF tv@nomic"
+        ];
+      };
+
+      mv = rec {
+        name = "mv";
+        uid = 1338;
+        group = "users";
+        home = "/home/${name}";
+        createHome = true;
+        useDefaultShell = true;
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGer9e2+Lew7vnisgBbsFNECEIkpNJgEaqQqgb9inWkQ mv@vod"
+        ];
+      };
+
+    };
+
+  users.mutableUsers = false;
+
+}
diff --git a/modules/iptables-cd.nix b/modules/cd/iptables.nix
index 48425e8dc..48425e8dc 100644
--- a/modules/iptables-cd.nix
+++ b/modules/cd/iptables.nix
diff --git a/modules/networking-cd.nix b/modules/cd/networking.nix
index 215e20829..215e20829 100644
--- a/modules/networking-cd.nix
+++ b/modules/cd/networking.nix
diff --git a/modules/urxvtd.nix b/modules/lass/urxvtd.nix
index 7eb471ed9..a62e64a98 100644
--- a/modules/urxvtd.nix
+++ b/modules/lass/urxvtd.nix
@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 let
-  inherit (import ../lib { inherit pkgs; }) shell-escape;
+  inherit (import ../../lib { inherit pkgs; }) shell-escape;
   inherit (pkgs) writeScript;
 in
 
diff --git a/modules/mu/default.nix b/modules/mu/default.nix
new file mode 100644
index 000000000..baec9bf8e
--- /dev/null
+++ b/modules/mu/default.nix
@@ -0,0 +1,477 @@
+# TODO maybe give RT-stuff only to group rt or sth.
+
+{ config, pkgs, ... }:
+
+let
+  lib = import ../../lib { inherit pkgs; };
+
+  inherit (lib) majmin;
+in
+
+{
+  imports = [
+    <secrets/hashedPasswords.nix>
+    ../tv/exim-retiolum.nix
+    ../tv/retiolum.nix
+    ../tv/sanitize.nix
+  ];
+
+  time.timeZone = "Europe/Berlin";
+
+  services.udev.extraRules = ''
+    SUBSYSTEM=="net", ATTR{address}=="00:90:f5:da:aa:c3", NAME="en0"
+    SUBSYSTEM=="net", ATTR{address}=="a0:88:b4:1b:ae:6c", NAME="wl0"
+
+    # for jack
+    KERNEL=="rtc0", GROUP="audio"
+    KERNEL=="hpet", GROUP="audio"
+  '';
+
+
+  # hardware configuration
+  boot.initrd.luks.devices = [
+    { name = "vgmu1"; device = "/dev/sda2"; }
+  ];
+  boot.initrd.luks.cryptoModules = [ "aes" "sha512" "xts" ];
+  boot.initrd.availableKernelModules = [ "ahci" ];
+  #boot.kernelParams = [
+  #  "intel_pstate=enable"
+  #];
+  boot.kernelModules = [ "fbcon" "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  #boot.kernelPackages = pkgs.linuxPackages_3_17;
+
+  boot.kernel.sysctl = {
+    # Enable IPv6 Privacy Extensions
+    "net.ipv6.conf.all.use_tempaddr" = 2;
+    "net.ipv6.conf.default.use_tempaddr" = 2;
+  };
+
+  boot.extraModprobeConfig = ''
+    options kvm_intel nested=1
+  '';
+
+  fileSystems = {
+    "/" = {
+      device = "/dev/vgmu1/nixroot";
+      fsType = "ext4";
+      options = "defaults,noatime";
+    };
+    "/home" = {
+      device = "/dev/vgmu1/home";
+      options = "defaults,noatime";
+    };
+    "/boot" = {
+      device = "/dev/sda1";
+    };
+    "/tmp" = {
+      device = "tmpfs";
+      fsType = "tmpfs";
+      options = "nosuid,nodev,noatime";
+    };
+  };
+
+  swapDevices =[ ];
+
+  nix.maxJobs = 8;
+  nix.useChroot = true;
+
+  nixpkgs.config.firefox.enableAdobeFlash = true;
+  nixpkgs.config.chromium.enablePepperFlash = true;
+
+  nixpkgs.config.allowUnfree = true;
+  hardware.opengl.driSupport32Bit = true;
+
+  hardware.pulseaudio.enable = true;
+
+  hardware.enableAllFirmware = true;
+
+  # Use the gummiboot efi boot loader.
+  boot.loader.gummiboot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "mu";
+  #networking.wireless.enable = true;
+  networking.networkmanager.enable = true;
+
+  networking.extraHosts = ''
+  '';
+
+  #system.activationScripts.powertopTunables =
+  #  ''
+  #    #echo 1 > /sys/module/snd_hda_intel/parameters/power_save
+  #    echo 1500 > /proc/sys/vm/dirty_writeback_centisecs
+  #    (cd /sys/bus/pci/devices
+  #      for i in *; do
+  #        echo auto > $i/power/control # defaults to 'on'
+  #      done)
+  #    # TODO maybe do this via udev or systemd
+  #    #   ref https://wiki.archlinux.org/index.php/Wake-on-LAN
+  #    # disable wol this cannot find ethtool
+  #    # TODO (cd /sys/class/net
+  #    # TODO   for i in *; do
+  #    # TODO     if ethtool $i | grep -q Wake-on &&
+  #    # TODO         ! ethtool $i | grep -q 'Wake-on: d'; then
+  #    # TODO       ethtool -s $i wol d
+  #    # TODO     fi
+  #    # TODO   done)
+  #    ${pkgs.ethtool}/sbin/ethtool -s en0 wol d
+  #  '';
+
+  environment.systemPackages = with pkgs; [
+    slock
+    tinc
+    iptables
+    vim
+    gimp
+    xsane
+    firefoxWrapper
+    chromiumDev
+    skype
+    libreoffice
+    kde4.l10n.de
+    kde4.networkmanagement
+    pidgin-with-plugins
+    pidginotr
+
+    kde4.print_manager
+    #foomatic_filters
+    #gutenprint
+    #cups_pdf_filter
+    #ghostscript
+  ];
+
+
+  environment.etc."vim/vimrc".text = ''
+    set nocp
+  '';
+  environment.etc."vim/vim${majmin pkgs.vim.version}".source =
+      "${pkgs.vim}/share/vim/vim${majmin pkgs.vim.version}";
+
+  # multiple-definition-problem when defining environment.variables.EDITOR
+  environment.extraInit = ''
+    EDITOR=vim
+  '';
+  environment.variables.VIM = "/etc/vim";
+
+  i18n.defaultLocale = "de_DE.UTF-8";
+
+  environment.shellAliases = {
+    # alias cal='cal -m3'
+    bc = "bc -q";
+    gp = "gp -q";
+    df = "df -h";
+    du = "du -h";
+    # alias grep='grep --color=auto'
+
+    # TODO alias cannot contain #\'
+    # "ps?" = "ps ax | head -n 1;ps ax | fgrep -v ' grep --color=auto ' | grep";
+
+    # alias la='ls -lA'
+    lAtr = "ls -lAtr";
+    # alias ll='ls -l'
+    ls = "ls -h --color=auto --group-directories-first";
+    # alias vim='vim -p'
+    # alias vi='vim'
+    # alias view='vim -R'
+    dmesg = "dmesg -L --reltime";
+  };
+
+
+  programs.bash = {
+    interactiveShellInit = ''
+      HISTCONTROL='erasedups:ignorespace'
+      HISTSIZE=65536
+      HISTFILESIZE=$HISTSIZE
+
+      shopt -s checkhash
+      shopt -s histappend histreedit histverify
+      shopt -s no_empty_cmd_completion
+      complete -d cd
+
+      # TODO source bridge
+    '';
+    promptInit = ''
+      case $UID in
+        0)
+          PS1='\[\e[1;31m\]\w\[\e[0m\] '
+          ;;
+        1337)
+          PS1='\[\e[1;32m\]\w\[\e[0m\] '
+          ;;
+        2000)
+          PS1='\[\e[1;32m\]\w\[\e[0m\] '
+          ;;
+        *)
+          PS1='\[\e[1;35m\]\u \[\e[1;32m\]\w\[\e[0m\] '
+          ;;
+      esac
+      if test -n "$SSH_CLIENT"; then
+        PS1='\[\e[35m\]\h'" $PS1"
+      fi
+    '';
+  };
+
+
+  programs.ssh.startAgent = false;
+
+
+  security.setuidPrograms = [
+    "sendmail"  # for cron
+    "slock"
+  ];
+
+  security.pam.loginLimits = [
+    # for jack
+    { domain = "@audio"; item = "memlock"; type = "-"; value = "unlimited"; }
+    { domain = "@audio"; item = "rtprio"; type = "-"; value = "99"; }
+  ];
+
+  #services.haveged.enable = true;
+  #security.rngd.enable = true;
+
+  services.retiolum = {
+    enable = true;
+    hosts = /etc/nixos/hosts;
+    connectTo = [
+      "gum"
+      "pigstarter"
+    ];
+  };
+
+  security.rtkit.enable = false;
+  services.nscd.enable = false;
+  services.ntp.enable = false;
+  #services.dbus.enable = true; # rqd4 wpa_supplicant
+
+  services.sshd.enable = true;
+
+  # vixiecron sucks
+  services.cron.enable = false;
+  services.fcron.enable = true;
+
+  fonts.fonts = [
+    pkgs.xlibs.fontschumachermisc
+  ];
+
+  #services.logind.extraConfig = ''
+  #  HandleHibernateKey=ignore
+  #  HandleLidSwitch=ignore
+  #  HandlePowerKey=ignore
+  #  HandleSuspendKey=ignore
+  #'';
+  #services.xserver.displayManager.desktopManagerHandlesLidAndPower = true;
+
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+    enable = true;
+    hostKeys = [
+      # XXX bits here make no science
+      { bits = 8192; type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
+    ];
+  };
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+  services.printing = {
+    enable = true;
+    #drivers = [
+    #  #pkgs.foomatic_filters
+    #  #pkgs.gutenprint
+    #  #pkgs.cups_pdf_filter
+    #  #pkgs.ghostscript
+    #];
+    #cupsdConf = ''
+    #  LogLevel debug2
+    #'';
+  };
+
+  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+  #services.xserver.display = 11;
+  #services.xserver.tty = 11;
+  services.xserver.layout = "de";
+  services.xserver.xkbOptions = "eurosign:e";
+
+  # TODO this is host specific
+  services.xserver.synaptics = {
+    enable = true;
+    twoFingerScroll = true;
+    #accelFactor = "0.035";
+    #additionalOptions = ''
+    #  Option "FingerHigh" "60"
+    #  Option "FingerLow"  "60"
+    #'';
+  };
+
+  services.xserver.desktopManager.kde4.enable = true;
+  services.xserver.displayManager.auto = {
+    enable = true;
+    user = "vv";
+  };
+
+  users.defaultUserShell = "/run/current-system/sw/bin/bash";
+  users.mutableUsers = false;
+  users.extraGroups =
+    {
+    };
+  users.extraUsers =
+    {
+      tv = {
+        uid = 1337;
+        name = "tv";
+        group = "users";
+        home = "/home/tv";
+        useDefaultShell = true;
+        extraGroups = [
+          "audio"
+          "video"
+          "wheel"
+        ];
+        createHome = true;
+      };
+
+      vv = {
+        uid = 2000;
+        name = "vv";
+        home = "/home/vv";
+        createHome = true;
+        group = "users";
+        useDefaultShell = true;
+        extraGroups = [
+          "audio"
+          "video"
+          "networkmanager"
+        ];
+      };
+    };
+
+  services.journald.extraConfig = ''
+    SystemMaxUse=1G
+    RuntimeMaxUse=128M
+  '';
+
+  # see tmpfiles.d(5)
+  systemd.tmpfiles.rules = [
+    "d /tmp 1777 root root - -" # does this work with mounted /tmp?
+  ];
+
+  # TODO services.smartd
+  # TODO services.statsd
+  # TODO services.tor
+  # TODO write arandr
+  # TODO what does system.copySystemConfiguration (we need some kind of bku scheme)
+  # TODO systemd.timers instead of cron(??)
+
+  virtualisation.libvirtd.enable = true;
+
+  #
+  # iptables
+  #
+  networking.firewall.enable = false;
+  system.activationScripts.iptables =
+    let
+      log = false;
+      when = c: f: if c then f else "";
+    in
+      ''
+        ip4tables() { ${pkgs.iptables}/sbin/iptables "$@"; }
+        ip6tables() { ${pkgs.iptables}/sbin/ip6tables "$@"; }
+        ipXtables() { ip4tables "$@"; ip6tables "$@"; }
+
+        #
+        # nat
+        #
+
+        # reset tables
+        ipXtables -t nat -F
+        ipXtables -t nat -X
+
+        #
+        ipXtables -t nat -A PREROUTING -j REDIRECT ! -i retiolum -p tcp --dport ssh --to-ports 0
+        ipXtables -t nat -A PREROUTING -j REDIRECT -p tcp --dport 11423 --to-ports ssh
+
+        #
+        # filter
+        #
+
+        # reset tables
+        ipXtables -P INPUT DROP
+        ipXtables -P FORWARD DROP
+        ipXtables -F
+        ipXtables -X
+
+        # create custom chains
+        ipXtables -N Retiolum
+
+        # INPUT
+        ipXtables -A INPUT -j ACCEPT -m conntrack --ctstate RELATED,ESTABLISHED
+        ipXtables -A INPUT -j ACCEPT -i lo
+        ipXtables -A INPUT -j ACCEPT -p tcp --dport ssh -m conntrack --ctstate NEW
+        ipXtables -A INPUT -j ACCEPT -p tcp --dport http -m conntrack --ctstate NEW
+        ipXtables -A INPUT -j ACCEPT -p tcp --dport tinc -m conntrack --ctstate NEW
+        ipXtables -A INPUT -j ACCEPT -p tcp --dport smtp -m conntrack --ctstate NEW
+        ipXtables -A INPUT -j Retiolum -i retiolum
+        ${when log "ipXtables -A INPUT -j LOG --log-level info --log-prefix 'INPUT DROP '"}
+
+        # FORWARD
+        ${when log "ipXtables -A FORWARD -j LOG --log-level info --log-prefix 'FORWARD DROP '"}
+
+        # Retiolum
+        ip4tables -A Retiolum -j ACCEPT -p icmp --icmp-type echo-request
+        ip6tables -A Retiolum -j ACCEPT -p ipv6-icmp -m icmp6 --icmpv6-type echo-request
+
+
+        ${when log "ipXtables -A Retiolum -j LOG --log-level info --log-prefix 'REJECT '"}
+        ipXtables -A Retiolum -j REJECT -p tcp --reject-with tcp-reset
+        ip4tables -A Retiolum -j REJECT -p udp --reject-with icmp-port-unreachable
+        ip4tables -A Retiolum -j REJECT        --reject-with icmp-proto-unreachable
+        ip6tables -A Retiolum -j REJECT -p udp --reject-with icmp6-port-unreachable
+        ip6tables -A Retiolum -j REJECT
+
+      '';
+
+
+
+
+  #system.replaceRuntimeDependencies = with pkgs;
+  #  let
+  #      bashVulnPatches = [
+  #        (fetchurl {
+  #          url = "mirror://gnu/bash/bash-4.2-patches/bash42-048";
+  #          sha256 = "091xk1ms7ycnczsl3fx461gjhj69j6ycnfijlymwj6mj60ims6km";
+  #        })
+  #        (fetchurl {
+  #          url = "file:///etc/nixos/bash-20140926.patch";
+  #          sha256 = "0gdwnimsbi4vh5l46krss4wjrgbch94skn4y2w3rpvb1w4jypha4";
+  #        })
+  #      ];
+  #  in
+  #  [
+  #    {
+  #      original = bash;
+  #      replacement = pkgs.lib.overrideDerivation bash (oldAttrs: {
+  #        patches = oldAttrs.patches ++ bashVulnPatches;
+  #      });
+  #    }
+  #    {
+  #      original = bashInteractive;
+  #      replacement = pkgs.lib.overrideDerivation bashInteractive (oldAttrs: {
+  #        patches = oldAttrs.patches ++ bashVulnPatches;
+  #      });
+  #    }
+  #    {
+  #      original = bitlbee;
+  #      replacement = pkgs.lib.overrideDerivation bitlbee (oldAttrs: {
+  #        configureFlags = [
+  #          "--gcov=1"
+  #          "--otr=1"
+  #          "--ssl=gnutls"
+  #        ];
+  #      });
+  #    }
+  #];
+
+
+}
diff --git a/modules/base-cac-CentOS-7-64bit.nix b/modules/tv/base-cac-CentOS-7-64bit.nix
index 42ab481b3..42ab481b3 100644
--- a/modules/base-cac-CentOS-7-64bit.nix
+++ b/modules/tv/base-cac-CentOS-7-64bit.nix
diff --git a/modules/base.nix b/modules/tv/base.nix
index 76c8b8970..76c8b8970 100644
--- a/modules/base.nix
+++ b/modules/tv/base.nix
diff --git a/modules/ejabberd-cd.nix b/modules/tv/ejabberd.nix
index e836d2cdd..e836d2cdd 100644
--- a/modules/ejabberd-cd.nix
+++ b/modules/tv/ejabberd.nix
diff --git a/modules/exim.nix b/modules/tv/exim-retiolum.nix
index e80358fcd..e80358fcd 100644
--- a/modules/exim.nix
+++ b/modules/tv/exim-retiolum.nix
diff --git a/modules/exim-cd.nix b/modules/tv/exim-smarthost.nix
index a4c47b399..a4c47b399 100644
--- a/modules/exim-cd.nix
+++ b/modules/tv/exim-smarthost.nix
diff --git a/modules/nginx.nix b/modules/tv/nginx.nix
index 8b420613b..8b420613b 100644
--- a/modules/nginx.nix
+++ b/modules/tv/nginx.nix
diff --git a/modules/retiolum.nix b/modules/tv/retiolum.nix
index 578547af6..578547af6 100644
--- a/modules/retiolum.nix
+++ b/modules/tv/retiolum.nix
diff --git a/modules/sanitize.nix b/modules/tv/sanitize.nix
index b6c749b6d..b6c749b6d 100644
--- a/modules/sanitize.nix
+++ b/modules/tv/sanitize.nix
diff --git a/modules/synaptics.nix b/modules/tv/synaptics.nix
index c47cb9deb..c47cb9deb 100644
--- a/modules/synaptics.nix
+++ b/modules/tv/synaptics.nix
diff --git a/modules/tools.nix b/modules/tv/tools.nix
index 4be84a6be..cf3fda93a 100644
--- a/modules/tools.nix
+++ b/modules/tv/tools.nix
@@ -5,7 +5,7 @@ let
   inherit (lib.strings) concatStringsSep stringAsChars;
   inherit (lib.attrsets) attrValues mapAttrs;
   inherit (lib) makeSearchPath;
-  inherit (import ../lib { inherit pkgs; }) shell-escape;
+  inherit (import ../../lib { inherit pkgs; }) shell-escape;
 
 
   # TODO make these scripts available in an maintenance shell
diff --git a/modules/urxvt-tv.nix b/modules/tv/urxvt.nix
index a97581248..a97581248 100644
--- a/modules/urxvt-tv.nix
+++ b/modules/tv/urxvt.nix
diff --git a/modules/users.nix b/modules/tv/users.nix
index 79a00e3a1..f42ba33c5 100644
--- a/modules/users.nix
+++ b/modules/tv/users.nix
@@ -189,7 +189,7 @@ let
   sudoers =
     let
       inherit (builtins) filter hasAttr;
-      inherit (import ../lib { inherit pkgs; }) concat isSuffixOf removeSuffix setToList;
+      inherit (import ../../lib { inherit pkgs; }) concat isSuffixOf removeSuffix setToList;
 
       hasMaster = { group ? "", ... }:
         isSuffixOf "-sub" group;
diff --git a/modules/xserver.nix b/modules/tv/xserver.nix
index 897dbcc28..897dbcc28 100644
--- a/modules/xserver.nix
+++ b/modules/tv/xserver.nix
diff --git a/modules/wu/default.nix b/modules/wu/default.nix
new file mode 100644
index 000000000..f586552e4
--- /dev/null
+++ b/modules/wu/default.nix
@@ -0,0 +1,469 @@
+{ config, pkgs, ... }:
+
+let
+  lib = import ../../lib { inherit pkgs; };
+
+  inherit (lib) majmin;
+in
+
+{
+  imports = [
+    ./hosts.nix
+    ./iptables.nix
+    ../tv/base.nix
+    ../tv/exim-retiolum.nix
+    ../tv/nginx.nix
+    ../tv/retiolum.nix
+    ../tv/sanitize.nix
+    ../tv/synaptics.nix
+    #../tv/tools.nix
+    ../tv/urxvt.nix
+    ../tv/users.nix
+    ../tv/xserver.nix
+  ];
+
+  services.udev.extraRules = ''
+    SUBSYSTEM=="net", ATTR{address}=="00:90:f5:da:aa:c3", NAME="en0"
+    SUBSYSTEM=="net", ATTR{address}=="a0:88:b4:1b:ae:6c", NAME="wl0"
+
+    # for jack
+    KERNEL=="rtc0", GROUP="audio"
+    KERNEL=="hpet", GROUP="audio"
+  '';
+
+  #services.virtualbox.enable = true;
+  #services.virtualboxGuest.enable = false;
+  services.virtualboxHost.enable = true;
+  #services.virtualboxHost.addNetworkInterface = false;
+  #systemd.services.vboxnet =
+  #  let
+  #    remove_vboxnets = ''
+  #      for i in $(cd /sys/class/net && ls | grep ^vboxnet); do
+  #        VBoxManage hostonlyif remove $i
+  #      done
+  #    '';
+  #  in {
+  #    wantedBy = [ "multi-user.target" ];
+  #    requires = [ "dev-vboxnetctl.device" ];
+  #    after = [ "dev-vboxnetctl.device" ];
+  #    path = with pkgs; [
+  #      linuxPackages.virtualbox
+  #      nettools
+  #    ];
+  #    postStop = remove_vboxnets;
+  #    script = ''
+  #      ${remove_vboxnets} # just in case...
+  #      VBoxManage hostonlyif create # vboxnet0
+  #      ifconfig vboxnet0 up 169.254.13.37/16
+  #    '';
+  #    serviceConfig = {
+  #      Type = "oneshot";
+  #      PrivateTmp = true;
+  #      RemainAfterExit = "yes";
+  #    };
+  #    environment.VBOX_USER_HOME = "/tmp";
+  #  };
+
+
+  services.bitlbee.enable = true;
+
+  #services.rabbitmq = {
+  #  enable = true;
+  #  cookie = "f00f";
+  #  plugins = [
+  #    "rabbitmq_management"
+  #  ];
+  #};
+
+
+  #services.elasticsearch.enable = true;
+
+  #services.cgserver = {
+  #  enable = true;
+  #  httpPort = 8003;
+  #  #flushLog = false;
+  #  #cgroupRoot = "/sys/fs/cgroup";
+  #  #user = "zalora";
+  #};
+
+
+
+
+  #services.tlsdated = {
+  #  enable = true;
+  #  extraOptions = "-p";
+  #};
+
+  services.tor.enable = true;
+  services.tor.client.enable = true;
+
+
+
+  # hardware configuration
+  boot.initrd.luks.devices = [
+    { name = "home"; device = "/dev/vg840/enchome"; preLVM = false; }
+  ];
+  boot.initrd.luks.cryptoModules = [ "aes" "sha512" "xts" ];
+  boot.initrd.availableKernelModules = [ "ahci" ];
+  #boot.kernelParams = [
+  #  "intel_pstate=enable"
+  #];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  # 2014-12-17 pkgs.linuxPackages_3_14 is known good
+  boot.kernelPackages = pkgs.linuxPackages_3_18;
+
+  boot.kernel.sysctl = {
+    # Enable IPv6 Privacy Extensions
+    "net.ipv6.conf.all.use_tempaddr" = 2;
+    "net.ipv6.conf.default.use_tempaddr" = 2;
+  };
+
+  boot.extraModprobeConfig = ''
+    options kvm_intel nested=1
+  '';
+
+  fileSystems = {
+    "/" = {
+      device = "/dev/mapper/vg840-wuroot";
+      fsType = "btrfs";
+      options = "defaults,noatime,ssd,compress=lzo";
+    };
+    "/home" = {
+      device = "/dev/mapper/home";
+      options = "defaults,noatime,ssd,compress=lzo";
+    };
+    "/boot" = {
+      device = "/dev/sda1";
+    };
+    "/tmp" = {
+      device = "tmpfs";
+      fsType = "tmpfs";
+      options = "nosuid,nodev,noatime";
+    };
+  };
+
+  swapDevices =[ ];
+
+
+  nixpkgs.config.firefox.enableAdobeFlash = true;
+  nixpkgs.config.chromium.enablePepperFlash = true;
+
+  nixpkgs.config.allowUnfree = true;
+  hardware.bumblebee.enable = true; # TODO this is host specific
+  hardware.bumblebee.group = "video";
+  #services.xserver.videoDrivers = [ "nvidia" ];
+  hardware.opengl.driSupport32Bit = true;
+
+  hardware.pulseaudio.enable = true;
+
+  hardware.enableAllFirmware = true;
+
+  # Use the gummiboot efi boot loader.
+  boot.loader.gummiboot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "wu";
+  networking.wireless.enable = true;
+
+
+  # Select internationalisation properties.
+  # i18n = {
+  #   consoleFont = "lat9w-16";
+  #   consoleKeyMap = "us";
+  #   defaultLocale = "en_US.UTF-8";
+  # };
+
+  system.activationScripts.powertopTunables =
+    ''
+      echo 1 > /sys/module/snd_hda_intel/parameters/power_save
+      echo 1500 > /proc/sys/vm/dirty_writeback_centisecs
+      (cd /sys/bus/pci/devices
+        for i in *; do
+          echo auto > $i/power/control # defaults to 'on'
+        done)
+      # TODO maybe do this via udev or systemd
+      #   ref https://wiki.archlinux.org/index.php/Wake-on-LAN
+      # disable wol this cannot find ethtool
+      # TODO (cd /sys/class/net
+      # TODO   for i in *; do
+      # TODO     if ethtool $i | grep -q Wake-on &&
+      # TODO         ! ethtool $i | grep -q 'Wake-on: d'; then
+      # TODO       ethtool -s $i wol d