summaryrefslogtreecommitdiffstats
path: root/tv/2configs
diff options
context:
space:
mode:
Diffstat (limited to 'tv/2configs')
-rw-r--r--tv/2configs/bash.nix37
-rw-r--r--tv/2configs/default.nix69
-rw-r--r--tv/2configs/exim-smarthost.nix2
-rw-r--r--tv/2configs/git.nix2
-rw-r--r--tv/2configs/hw/x220.nix3
-rw-r--r--tv/2configs/ssh.nix25
-rw-r--r--tv/2configs/sshd.nix16
-rw-r--r--tv/2configs/xdg.nix14
-rw-r--r--tv/2configs/xserver/default.nix3
9 files changed, 103 insertions, 68 deletions
diff --git a/tv/2configs/bash.nix b/tv/2configs/bash.nix
new file mode 100644
index 000000000..fe87aa8d7
--- /dev/null
+++ b/tv/2configs/bash.nix
@@ -0,0 +1,37 @@
+{ config, lib, pkgs, ... }:
+
+with config.krebs.lib;
+
+{
+ programs.bash = {
+ interactiveShellInit = ''
+ HISTCONTROL='erasedups:ignorespace'
+ HISTSIZE=65536
+ HISTFILESIZE=$HISTSIZE
+
+ shopt -s checkhash
+ shopt -s histappend histreedit histverify
+ shopt -s no_empty_cmd_completion
+ complete -d cd
+ '';
+ promptInit = ''
+ case $UID in
+ 0)
+ PS1='\[\e[1;31m\]\w\[\e[0m\] '
+ ;;
+ ${toString config.krebs.build.user.uid})
+ PS1='\[\e[1;32m\]\w\[\e[0m\] '
+ ;;
+ *)
+ PS1='\[\e[1;35m\]\u \[\e[1;32m\]\w\[\e[0m\] '
+ ;;
+ esac
+ if test -n "$SSH_CLIENT"; then
+ PS1='\[\e[35m\]\h'" $PS1"
+ fi
+ if test -n "$SSH_AGENT_PID"; then
+ PS1="ssh-agent[$SSH_AGENT_PID] $PS1"
+ fi
+ '';
+ };
+}
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 04009f54d..db1bfe5a2 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -14,7 +14,7 @@ with config.krebs.lib;
stockholm.file = "/home/tv/stockholm";
nixpkgs.git = {
url = https://github.com/NixOS/nixpkgs;
- ref = "8bf31d7d27cae435d7c1e9e0ccb0a320b424066f";
+ ref = "2568ee3d73bdebd6bab6739adf8a900f3429c8e6";
};
} // optionalAttrs host.secure {
secrets-master.file = "/home/tv/secrets/master";
@@ -27,8 +27,12 @@ with config.krebs.lib;
<secrets>
./audit.nix
./backup.nix
+ ./bash.nix
./nginx
+ ./ssh.nix
+ ./sshd.nix
./vim.nix
+ ./xdg.nix
{
# stockholm dependencies
environment.systemPackages = with pkgs; [
@@ -104,49 +108,6 @@ with config.krebs.lib;
environment.variables = {
NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src";
};
-
- programs.bash = {
- interactiveShellInit = ''
- HISTCONTROL='erasedups:ignorespace'
- HISTSIZE=65536
- HISTFILESIZE=$HISTSIZE
-
- shopt -s checkhash
- shopt -s histappend histreedit histverify
- shopt -s no_empty_cmd_completion
- complete -d cd
-
- ${readFile ./bash_completion.sh}
-
- # TODO source bridge
- '';
- promptInit = ''
- case $UID in
- 0)
- PS1='\[\e[1;31m\]\w\[\e[0m\] '
- ;;
- ${toString config.krebs.users.tv.uid})
- PS1='\[\e[1;32m\]\w\[\e[0m\] '
- ;;
- *)
- PS1='\[\e[1;35m\]\u \[\e[1;32m\]\w\[\e[0m\] '
- ;;
- esac
- if test -n "$SSH_CLIENT"; then
- PS1='\[\e[35m\]\h'" $PS1"
- fi
- if test -n "$SSH_AGENT_PID"; then
- PS1="ssh-agent[$SSH_AGENT_PID] $PS1"
- fi
- '';
- };
-
- programs.ssh = {
- extraConfig = ''
- UseRoaming no
- '';
- startAgent = false;
- };
}
{
@@ -177,16 +138,6 @@ with config.krebs.lib;
}
{
- services.openssh = {
- enable = true;
- hostKeys = [
- { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
- ];
- };
- tv.iptables.input-internet-accept-tcp = singleton "ssh";
- }
-
- {
environment.systemPackages = [
pkgs.get
pkgs.krebszones
@@ -194,15 +145,5 @@ with config.krebs.lib;
pkgs.push
];
}
-
- {
- systemd.tmpfiles.rules = let
- forUsers = flip map users;
- isUser = { name, group, ... }:
- name == "root" || hasSuffix "users" group;
- users = filter isUser (mapAttrsToList (_: id) config.users.users);
- in forUsers (u: "d /run/xdg/${u.name} 0700 ${u.name} ${u.group} -");
- environment.variables.XDG_RUNTIME_DIR = "/run/xdg/$LOGNAME";
- }
];
}
diff --git a/tv/2configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix
index 351b54da1..cade6fa7b 100644
--- a/tv/2configs/exim-smarthost.nix
+++ b/tv/2configs/exim-smarthost.nix
@@ -20,7 +20,7 @@ with config.krebs.lib;
];
internet-aliases = with config.krebs.users; [
{ from = "postmaster@viljetic.de"; to = tv.mail; } # RFC 822
- { from = "mirko@viljetic.de"; to = mv.mail; }
+ { from = "mirko@viljetic.de"; to = mv-cd.mail; }
{ from = "tomislav@viljetic.de"; to = tv.mail; }
{ from = "tv@destroy.dyn.shackspace.de"; to = tv.mail; }
{ from = "tv@viljetic.de"; to = tv.mail; }
diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix
index 4bc971370..fd3875410 100644
--- a/tv/2configs/git.nix
+++ b/tv/2configs/git.nix
@@ -101,7 +101,7 @@ let
perm = push "refs/*" [ non-fast-forward create delete merge ];
} ++
optional repo.public {
- user = [ lass makefu ];
+ user = attrValues config.krebs.users;
repo = [ repo ];
perm = fetch;
} ++
diff --git a/tv/2configs/hw/x220.nix b/tv/2configs/hw/x220.nix
index 9b3dd122a..c5a3485a2 100644
--- a/tv/2configs/hw/x220.nix
+++ b/tv/2configs/hw/x220.nix
@@ -10,6 +10,9 @@
networking.wireless.enable = true;
+ # Required for Centrino.
+ hardware.enableAllFirmware = true;
+
hardware.trackpoint = {
enable = true;
sensitivity = 220;
diff --git a/tv/2configs/ssh.nix b/tv/2configs/ssh.nix
new file mode 100644
index 000000000..7bf583426
--- /dev/null
+++ b/tv/2configs/ssh.nix
@@ -0,0 +1,25 @@
+{ config, pkgs, ... }:
+
+with config.krebs.lib;
+
+{
+ # Override NixOS's "Allow DSA keys for now."
+ environment.etc."ssh/ssh_config".text = mkForce ''
+ AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}
+
+ ${optionalString config.programs.ssh.setXAuthLocation ''
+ XAuthLocation ${pkgs.xorg.xauth}/bin/xauth
+ ''}
+
+ ForwardX11 ${if config.programs.ssh.forwardX11 then "yes" else "no"}
+
+ ${config.programs.ssh.extraConfig}
+ '';
+
+ programs.ssh = {
+ extraConfig = ''
+ UseRoaming no
+ '';
+ startAgent = false;
+ };
+}
diff --git a/tv/2configs/sshd.nix b/tv/2configs/sshd.nix
new file mode 100644
index 000000000..943f32fe9
--- /dev/null
+++ b/tv/2configs/sshd.nix
@@ -0,0 +1,16 @@
+{ config, lib, pkgs, ... }:
+
+with config.krebs.lib;
+
+{
+ services.openssh = {
+ enable = true;
+ hostKeys = [
+ {
+ type = "ed25519";
+ path = "/etc/ssh/ssh_host_ed25519_key";
+ }
+ ];
+ };
+ tv.iptables.input-internet-accept-tcp = singleton "ssh";
+}
diff --git a/tv/2configs/xdg.nix b/tv/2configs/xdg.nix
new file mode 100644
index 000000000..f05ec5431
--- /dev/null
+++ b/tv/2configs/xdg.nix
@@ -0,0 +1,14 @@
+{ config, lib, pkgs, ... }:
+
+with config.krebs.lib;
+
+{
+ environment.variables.XDG_RUNTIME_DIR = "/run/xdg/$LOGNAME";
+
+ systemd.tmpfiles.rules = let
+ forUsers = flip map users;
+ isUser = { name, group, ... }:
+ name == "root" || hasSuffix "users" group;
+ users = filter isUser (mapAttrsToList (_: id) config.users.users);
+ in forUsers (u: "d /run/xdg/${u.name} 0700 ${u.name} ${u.group} -");
+}
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index c41c0a81e..7a76530be 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -1,8 +1,7 @@
{ config, pkgs, ... }@args:
with config.krebs.lib;
let
- # TODO krebs.build.user
- user = config.users.users.tv;
+ user = config.krebs.build.user;
in {
environment.systemPackages = [