From 29746aec06b7d42d3c87245f6f14f048234251e4 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 6 Feb 2016 18:54:01 +0100
Subject: krebs.{backup.plans,hosts,users}.*.name: add default value

---
 krebs/3modules/backup.nix         | 3 ++-
 krebs/3modules/lass/default.nix   | 4 ++--
 krebs/3modules/makefu/default.nix | 4 ++--
 krebs/3modules/mv/default.nix     | 4 ++--
 krebs/3modules/shared/default.nix | 4 ++--
 krebs/3modules/tv/default.nix     | 4 ++--
 krebs/4lib/types.nix              | 6 ++++--
 makefu/2configs/backup.nix        | 2 +-
 tv/2configs/backup.nix            | 2 +-
 9 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix
index a1f335905..17d8a3c98 100644
--- a/krebs/3modules/backup.nix
+++ b/krebs/3modules/backup.nix
@@ -12,7 +12,7 @@ let
     enable = mkEnableOption "krebs.backup" // { default = true; };
     plans = mkOption {
       default = {};
-      type = types.attrsOf (types.submodule ({
+      type = types.attrsOf (types.submodule ({ config, ... }: {
         # TODO enable = mkEnableOption "TODO" // { default = true; };
         options = {
           method = mkOption {
@@ -20,6 +20,7 @@ let
           };
           name = mkOption {
             type = types.str;
+            default = config._module.args.name;
           };
           src = mkOption {
             type = types.krebs.file-location;
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index 26b0947bb..c880ea788 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -3,7 +3,7 @@
 with lib;
 
 {
-  hosts = addNames {
+  hosts = {
     echelon = {
       cores = 2;
       dc = "lass"; #dc = "cac";
@@ -214,7 +214,7 @@ with lib;
     };
 
   };
-  users = addNames {
+  users = {
     lass = {
       pubkey = readFile ../../Zpubkeys/lass.ssh.pub;
       mail = "lass@mors.retiolum";
diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index 38e773b53..693a954ab 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -3,7 +3,7 @@
 with lib;
 
 {
-  hosts = addNames {
+  hosts = {
     pnp = {
       cores = 1;
       dc = "makefu"; #vm on 'omo'
@@ -364,7 +364,7 @@ TNs2RYfwDy/r6H/hDeB/BSngPouedEVcPwIDAQAB
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcxWFEPzke/Sdd9qNX6rSJgXal8NmINYajpFCxXfYdj root@gum";
     };
   };
-  users = addNames rec {
+  users = rec {
     makefu = {
       mail = "makefu@pornocauster.retiolum";
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCl3RTOHd5DLiVeUbUr/GSiKoRWknXQnbkIf+uNiFO+XxiqZVojPlumQUVhasY8UzDzj9tSDruUKXpjut50FhIO5UFAgsBeMJyoZbgY/+R+QKU00Q19+IiUtxeFol/9dCO+F4o937MC0OpAC10LbOXN/9SYIXueYk3pJxIycXwUqhYmyEqtDdVh9Rx32LBVqlBoXRHpNGPLiswV2qNe0b5p919IGcslzf1XoUzfE3a3yjk/XbWh/59xnl4V7Oe7+iQheFxOT6rFA30WYwEygs5As//ZYtxvnn0gA02gOnXJsNjOW9irlxOUeP7IOU6Ye3WRKFRR0+7PS+w8IJLag2xb makefu@pornocauster";
diff --git a/krebs/3modules/mv/default.nix b/krebs/3modules/mv/default.nix
index 6da2abc85..70417157f 100644
--- a/krebs/3modules/mv/default.nix
+++ b/krebs/3modules/mv/default.nix
@@ -3,7 +3,7 @@
 with lib;
 
 {
-  hosts = addNames {
+  hosts = {
     stro = {
       cores = 4;
       dc = "mv";
@@ -31,7 +31,7 @@ with lib;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+7Qa51l0NSkBiaK2s8vQEoeObV3UPZyEzMxfUK/ZAO root@stro";
     };
   };
-  users = addNames {
+  users = {
     mv_stro = {
       mail = "mv@stro.retiolum";
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCxM34g1GUm5EtU00DAOlGSx8MsCWunhGTrozurj460QT7EdUbZvj0AcrQC0lP9kaZyhX+KueTjmLC+ICsnlHYeg4zoSEnSAUkccuyZxfgynVc4wrpfNAc1nHjDhDb/ulnC+8wNxvxUpI0XlBgu/Y7AbbChZj3ofv6uGGHJKfG3uSyCkt9VTCi1KwydHpe9P252N8NbopnbnkT0EMkRHruh7ICEKr4/ivmUL/IUrbFicEeCy4SeRAl8+00x4WqqvbBPzgdXn0AIjKLvus3dBoQubJNpUoXnyXJbElnit5a7QcgZJNLMbV0kf9zzCGduxkADzHkAFB9D4PuSMYt62iy12QlGbm80A9ncuwaSyJf7hPTvNbU8VyCblyfRz/SCaudUrfk5Xbxxu26FHi4hZqr3IUQt4T8pD8JWYGl4n2ZKnD8hHz/jrmNBK8h9d+VFafU9t1hRxlFsW1AhMEM+kfWClyhfTcKBKbml2a657lgUEVmlZt+18kwwsivM1QhHNTgxn5urRXRkh1VQ40UQroVuV1OUmvAngyAthF441VPGc5z7kEI+D4qjmUjSy6k4dvEy/RGfsAgJCf63zilRuUbL68f2OpxE8aeZZUXPvgdLml284pry7+C5sjlnCDoJfCj/yhdVx6mU9pWUd/Q97CLQewbsYhMzsqlBlIkXuipkDQ== mv@stro";
diff --git a/krebs/3modules/shared/default.nix b/krebs/3modules/shared/default.nix
index 91d92857b..52aa4de41 100644
--- a/krebs/3modules/shared/default.nix
+++ b/krebs/3modules/shared/default.nix
@@ -32,7 +32,7 @@ let
     };
   });
 in {
-  hosts = addNames {
+  hosts = {
     wolf = {
       dc = "shack";
       nets = {
@@ -68,7 +68,7 @@ in {
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKYMXMWZIK0jjnZDM9INiYAKcwjXs2241vew54K8veCR";
     };
   } // testHosts;
-  users = addNames {
+  users = {
     shared = {
       mail = "spam@krebsco.de";
       pubkey = "lol"; # TODO krebs.users.shared.pubkey should be unnecessary
diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index 9adb0ce11..ca07acd17 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -6,7 +6,7 @@ with lib;
   dns.providers = {
     de.viljetic = "regfish";
   };
-  hosts = addNames {
+  hosts = {
     cd = rec {
       cores = 2;
       dc = "tv"; #dc = "cac";
@@ -351,7 +351,7 @@ with lib;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnjfceKuHNQu7S4eYFN1FqgzMqiL7haNZMh2ZLhvuhK root@xu";
     };
   };
-  users = addNames rec {
+  users = rec {
     mv = {
       mail = "mv@cd.retiolum";
       pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGer9e2+Lew7vnisgBbsFNECEIkpNJgEaqQqgb9inWkQ mv@vod";
diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index 6c396a132..2907a413a 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -10,6 +10,7 @@ types // rec {
     options = {
       name = mkOption {
         type = label;
+        default = config._module.args.name;
       };
       dc = mkOption {
         type = label;
@@ -155,19 +156,20 @@ types // rec {
       merge = mergeOneOption;
     };
 
-  user = submodule {
+  user = submodule ({ config, ... }: {
     options = {
       mail = mkOption {
         type = str; # TODO retiolum mail address
       };
       name = mkOption {
         type = str; # TODO
+        default = config._module.args.name;
       };
       pubkey = mkOption {
         type = str;
       };
     };
-  };
+  });
 
   # TODO
   addr = str;
diff --git a/makefu/2configs/backup.nix b/makefu/2configs/backup.nix
index ed6d1f4a7..936f31c1c 100644
--- a/makefu/2configs/backup.nix
+++ b/makefu/2configs/backup.nix
@@ -24,7 +24,7 @@ let
     };
   };
 in {
-  krebs.backup.plans = addNames {
+  krebs.backup.plans = {
     wry-to-omo_var-www = defaultPull wry "/var/www";
   };
 }
diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix
index ce937a744..f4d368557 100644
--- a/tv/2configs/backup.nix
+++ b/tv/2configs/backup.nix
@@ -1,7 +1,7 @@
 { config, lib, ... }:
 with lib;
 {
-  krebs.backup.plans = addNames {
+  krebs.backup.plans = {
     wu-home-xu = {
       method = "push";
       src = { host = config.krebs.hosts.wu; path = "/home"; };
-- 
cgit v1.2.3


From 30306159af3aac4f04db60f27637480bbecaaa1d Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 6 Feb 2016 19:37:14 +0100
Subject: add krebs.types.{filename,username}

---
 krebs/4lib/types.nix | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index 2907a413a..f91503794 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -162,7 +162,7 @@ types // rec {
         type = str; # TODO retiolum mail address
       };
       name = mkOption {
-        type = str; # TODO
+        type = username;
         default = config._module.args.name;
       };
       pubkey = mkOption {
@@ -194,4 +194,20 @@ types // rec {
       };
     };
   };
+
+  # POSIX.1‐2013, 3.278 Portable Filename Character Set
+  filename = mkOptionType {
+    name = "POSIX filename";
+    check = let
+      filename-chars = stringToCharacters
+        "-.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+    in s: all (flip elem filename-chars) (stringToCharacters s);
+    merge = mergeOneOption;
+  };
+
+  # POSIX.1-2013, 3.431 User Name
+  username = mkOptionType {
+    name = "POSIX username";
+    check = s: filename.check s && substring 0 1 s != "-";
+  };
 }
-- 
cgit v1.2.3


From 221510db0cd2d9cb7c38d33a148086d9187be804 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 02:04:12 +0100
Subject: nixpkgs: relink

---
 nixpkgs/default.nix | 2 +-
 nixpkgs/lib         | 2 +-
 nixpkgs/pkgs        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/nixpkgs/default.nix b/nixpkgs/default.nix
index 74e9d7633..6e5223c16 120000
--- a/nixpkgs/default.nix
+++ b/nixpkgs/default.nix
@@ -1 +1 @@
-../upstream-nixpkgs/default.nix
\ No newline at end of file
+../../upstream-nixpkgs/default.nix
\ No newline at end of file
diff --git a/nixpkgs/lib b/nixpkgs/lib
index 2284ef489..7b13c8069 120000
--- a/nixpkgs/lib
+++ b/nixpkgs/lib
@@ -1 +1 @@
-../upstream-nixpkgs/lib
\ No newline at end of file
+../../upstream-nixpkgs/lib
\ No newline at end of file
diff --git a/nixpkgs/pkgs b/nixpkgs/pkgs
index ce5f5448b..983384943 120000
--- a/nixpkgs/pkgs
+++ b/nixpkgs/pkgs
@@ -1 +1 @@
-../upstream-nixpkgs/pkgs
\ No newline at end of file
+../../upstream-nixpkgs/pkgs
\ No newline at end of file
-- 
cgit v1.2.3


From 02c1f8d2703aa03e41adcd5aec0d3ec402bbb367 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 03:09:14 +0100
Subject: tv: accept internet echo requests

---
 tv/2configs/default.nix  |  1 +
 tv/3modules/iptables.nix | 27 +++++++++++++++------------
 2 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 57c4620c4..52d85f856 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -165,6 +165,7 @@ with lib;
 
     {
       tv.iptables.enable = true;
+      tv.iptables.accept-echo-request = "internet";
     }
 
     {
diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix
index cbf49f577..9d5b5d075 100644
--- a/tv/3modules/iptables.nix
+++ b/tv/3modules/iptables.nix
@@ -13,6 +13,11 @@ let
   api = {
     enable = mkEnableOption "tv.iptables";
 
+    accept-echo-request = mkOption {
+      type = with types; nullOr (enum ["internet" "retiolum"]);
+      default = "retiolum";
+    };
+
     input-internet-accept-new-tcp = mkOption {
       type = with types; listOf (either int str);
       default = [];
@@ -49,10 +54,14 @@ let
   };
 
 
-  accept-new-tcp = port:
-    "-p tcp -m tcp --dport ${port} -m conntrack --ctstate NEW -j ACCEPT";
-
-  rules = iptables-version:
+  rules = iptables-version: let
+    accept-echo-request = {
+      ip4tables = "-p icmp -m icmp --icmp-type echo-request -j ACCEPT";
+      ip6tables = "-p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT";
+    }."ip${toString iptables-version}tables";
+    accept-new-tcp = port:
+      "-p tcp -m tcp --dport ${port} -m conntrack --ctstate NEW -j ACCEPT";
+  in
     pkgs.writeText "tv-iptables-rules${toString iptables-version}" ''
       *nat
       :PREROUTING ACCEPT [0:0]
@@ -76,18 +85,12 @@ let
           "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
           "-i lo -j ACCEPT"
         ]
+        ++ optional (cfg.accept-echo-request == "internet") accept-echo-request
         ++ map accept-new-tcp (unique (map toString cfg.input-internet-accept-new-tcp))
         ++ ["-i retiolum -j Retiolum"]
       )}
       ${concatMapStringsSep "\n" (rule: "-A Retiolum ${rule}") ([]
-        ++ {
-          ip4tables = [
-            "-p icmp -m icmp --icmp-type echo-request -j ACCEPT"
-          ];
-          ip6tables = [
-            "-p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT"
-          ];
-        }."ip${toString iptables-version}tables"
+        ++ optional (cfg.accept-echo-request == "retiolum") accept-echo-request
         ++ map accept-new-tcp (unique (map toString cfg.input-retiolum-accept-new-tcp))
         ++ {
           ip4tables = [
-- 
cgit v1.2.3


From 52fd80748d95b522561a477a1869d6923516f633 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 05:08:32 +0100
Subject: krebs.types.{hostname,label}: check RFC952

---
 krebs/4lib/types.nix | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index f91503794..52eb764ef 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -175,8 +175,6 @@ types // rec {
   addr = str;
   addr4 = str;
   addr6 = str;
-  hostname = str;
-  label = str;
 
   krebs.file-location = types.submodule {
     options = {
@@ -195,6 +193,22 @@ types // rec {
     };
   };
 
+  # RFC952, B. Lexical grammar, <hname>
+  hostname = mkOptionType {
+    name = "hostname";
+    check = x: all label.check (splitString "." x);
+    merge = mergeOneOption;
+  };
+
+  # RFC952, B. Lexical grammar, <name>
+  # RFC1123, 2.1  Host Names and Numbers
+  label = mkOptionType {
+    name = "label";
+    # TODO case-insensitive labels
+    check = x: match "[0-9A-Za-z]([0-9A-Za-z-]*[0-9A-Za-z])?" x != null;
+    merge = mergeOneOption;
+  };
+
   # POSIX.1‐2013, 3.278 Portable Filename Character Set
   filename = mkOptionType {
     name = "POSIX filename";
-- 
cgit v1.2.3


From 01dbc54c3207b44e4adaaae92fffc8a34bda6f18 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 05:09:56 +0100
Subject: krebs.backup: determine fastest address

---
 krebs/3modules/backup.nix | 43 +++++++++++++++++++++++++++++++++----------
 1 file changed, 33 insertions(+), 10 deletions(-)

diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix
index 17d8a3c98..0f85b4879 100644
--- a/krebs/3modules/backup.nix
+++ b/krebs/3modules/backup.nix
@@ -145,9 +145,11 @@ let
       set -efu
       identity=${shell.escape plan.src.host.ssh.privkey.path}
       src=${shell.escape plan.src.path}
-      dst_target=${shell.escape "root@${getFQDN plan.dst.host}"}
+      dst_user=root
+      dst_host=$(${fastest-address plan.dst.host})
+      dst_port=$(${network-ssh-port plan.dst.host "$dst_host"})
       dst_path=${shell.escape plan.dst.path}
-      dst=$dst_target:$dst_path
+      dst=$dst_user@$dst_host:$dst_path
 
       # Export NOW so runtime of rsync doesn't influence snapshot naming.
       export NOW
@@ -156,7 +158,7 @@ let
       echo >&2 "update snapshot: current; $src -> $dst"
       rsync >&2 \
           -aAXF --delete \
-          -e "ssh -F /dev/null -i $identity" \
+          -e "ssh -F /dev/null -i $identity ''${dst_port:+-p $dst_port}" \
           --rsync-path ${shell.escape
             "mkdir -m 0700 -p ${shell.escape plan.dst.path} && rsync"} \
           --link-dest="$dst_path/current" \
@@ -165,10 +167,10 @@ let
 
       exec ssh -F /dev/null \
           -i "$identity" \
-          "$dst_target" \
+          ''${dst_port:+-p $dst_port} \
+          "$dst_user@$dst_host" \
           -T \
           env NOW="$NOW" /bin/sh < ${remote-snapshot}
-      EOF
     '';
 
     remote-snapshot = writeDash "backup.${plan.name}.push.remote-snapshot" ''
@@ -205,7 +207,11 @@ let
       # TODO check if there is a previous
       set -efu
       identity=${shell.escape plan.dst.host.ssh.privkey.path}
-      src=${shell.escape "root@${getFQDN plan.src.host}:${plan.src.path}"}
+      src_user=root
+      src_host=$(${fastest-address plan.src.host})
+      src_port=$(${network-ssh-port plan.src.host "$src_host"})
+      src_path=${shell.escape plan.src.path}
+      src=$src_user@$src_host:$src_path
       dst=${shell.escape plan.dst.path}
 
       # Export NOW so runtime of rsync doesn't influence snapshot naming.
@@ -216,7 +222,7 @@ let
       mkdir -m 0700 -p ${shell.escape plan.dst.path}
       rsync >&2 \
           -aAXF --delete \
-          -e "ssh -F /dev/null -i $identity" \
+          -e "ssh -F /dev/null -i $identity ''${src_port:+-p $src_port}" \
           --link-dest="$dst/current" \
           "$src/" \
           "$dst/.partial"
@@ -274,9 +280,6 @@ let
       plan.snapshots)}
   '';
 
-  # TODO getFQDN: admit hosts in other domains
-  getFQDN = host: "${host.name}.${config.krebs.search-domain}";
-
   writeDash = name: text: pkgs.writeScript name ''
     #! ${pkgs.dash}/bin/dash
     ${text}
@@ -292,6 +295,26 @@ let
     '';
   };
 
+  # XXX Is one ping enough to determine fastest address?
+  # Note that we're using net.addrs4 instead of net.aliases because we define
+  # ports only for addresses.  See krebs/3modules/default.nix
+  fastest-address = host: ''
+    { ${pkgs.fping}/bin/fping </dev/null -a \
+        ${concatMapStringsSep " " shell.escape
+          (mapAttrsToList (_: net: head net.addrs4) host.nets)} \
+      | ${pkgs.coreutils}/bin/head -1; }
+  '';
+
+  # Note that we don't escape word on purpose, so we deref shell vars.
+  # TODO type word
+  network-ssh-port = host: word: ''
+    case ${word} in
+    ${concatStringsSep ";;\n" (mapAttrsToList
+      (_: net: "(${head net.addrs4}) echo ${toString net.ssh.port}")
+      host.nets)};;
+    esac
+  '';
+
 in out
 # TODO ionice
 # TODO mail on failed push, pull
-- 
cgit v1.2.3


From f68c977a20daa4d2e62f76e1f58a26188ef84b64 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 05:14:37 +0100
Subject: tv: define config.krebs.hosts.*.nets.gg23.ssh.port

---
 krebs/3modules/tv/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index ca07acd17..b9a6c5163 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -198,6 +198,7 @@ with lib;
         gg23 = {
           addrs4 = ["10.23.1.110"];
           aliases = ["nomic.gg23"];
+          ssh.port = 11423;
         };
         retiolum = {
           addrs4 = ["10.243.0.110"];
@@ -292,6 +293,7 @@ with lib;
         gg23 = {
           addrs4 = ["10.23.1.37"];
           aliases = ["wu.gg23"];
+          ssh.port = 11423;
         };
         retiolum = {
           addrs4 = ["10.243.13.37"];
@@ -326,6 +328,7 @@ with lib;
         gg23 = {
           addrs4 = ["10.23.1.38"];
           aliases = ["xu.gg23"];
+          ssh.port = 11423;
         };
         retiolum = {
           addrs4 = ["10.243.13.38"];
-- 
cgit v1.2.3


From 949f466cf78ba2e76002012715172e5d5d394006 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 05:17:07 +0100
Subject: tv: s/_/-/g in usernames

---
 krebs/3modules/mv/default.nix | 2 +-
 krebs/3modules/tv/default.nix | 4 ++--
 mv/2configs/git.nix           | 2 +-
 tv/2configs/git.nix           | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/krebs/3modules/mv/default.nix b/krebs/3modules/mv/default.nix
index 70417157f..7245c143d 100644
--- a/krebs/3modules/mv/default.nix
+++ b/krebs/3modules/mv/default.nix
@@ -32,7 +32,7 @@ with lib;
     };
   };
   users = {
-    mv_stro = {
+    mv-stro = {
       mail = "mv@stro.retiolum";
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCxM34g1GUm5EtU00DAOlGSx8MsCWunhGTrozurj460QT7EdUbZvj0AcrQC0lP9kaZyhX+KueTjmLC+ICsnlHYeg4zoSEnSAUkccuyZxfgynVc4wrpfNAc1nHjDhDb/ulnC+8wNxvxUpI0XlBgu/Y7AbbChZj3ofv6uGGHJKfG3uSyCkt9VTCi1KwydHpe9P252N8NbopnbnkT0EMkRHruh7ICEKr4/ivmUL/IUrbFicEeCy4SeRAl8+00x4WqqvbBPzgdXn0AIjKLvus3dBoQubJNpUoXnyXJbElnit5a7QcgZJNLMbV0kf9zzCGduxkADzHkAFB9D4PuSMYt62iy12QlGbm80A9ncuwaSyJf7hPTvNbU8VyCblyfRz/SCaudUrfk5Xbxxu26FHi4hZqr3IUQt4T8pD8JWYGl4n2ZKnD8hHz/jrmNBK8h9d+VFafU9t1hRxlFsW1AhMEM+kfWClyhfTcKBKbml2a657lgUEVmlZt+18kwwsivM1QhHNTgxn5urRXRkh1VQ40UQroVuV1OUmvAngyAthF441VPGc5z7kEI+D4qjmUjSy6k4dvEy/RGfsAgJCf63zilRuUbL68f2OpxE8aeZZUXPvgdLml284pry7+C5sjlnCDoJfCj/yhdVx6mU9pWUd/Q97CLQewbsYhMzsqlBlIkXuipkDQ== mv@stro";
     };
diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index b9a6c5163..b6d779981 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -363,11 +363,11 @@ with lib;
       mail = "tv@wu.retiolum";
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDFR//RnCvEZAt0F6ExDsatKZ/DDdifanuSL360mqOhaFieKI34RoOwfQT9T+Ga52Vh5V2La6esvlph686EdgzeKLvDoxEwFM9ZYFBcMrNzu4bMTlgE7YUYw5JiORyXNfznBGnme6qpuvx9ibYhUyiZo99kM8ys5YrUHrP2JXQJMezDFZHxT4GFMOuSdh/1daGoKKD6hYL/jEHX8CI4E3BSmKK6ygYr1fVX0K0Tv77lIi5mLXucjR7CytWYWYnhM6DC3Hxpv2zRkPgf3k0x/Y1hrw3V/r0Me5h90pd2C8pFaWA2ZoUT/fmyVqvx1tZPYToU/O2dMItY0zgx2kR0yD+6g7Aahz3R+KlXkV8k5c8bbTbfGnZWDR1ZlbLRM9Yt5vosfwapUD90MmVkpmR3wUkO2sUKi80QfC7b4KvSDXQ+MImbGxMaU5Bnsq1PqLN95q+uat3nlAVBAELkcx51FlE9CaIS65y4J7FEDg8BE5JeuCNshh62VSYRXVSFt8bk3f/TFGgzC8OIo14BhVmiRQQ503Z1sROyf5xLX2a/EJavMm1i2Bs2TH6ROKY9z5Pz8hT5US0r381V8oG7TZyLF9HTtoy3wCYsgWA5EmLanjAsVU2YEeAA0rxzdtYP8Y2okFiJ6u+M4HQZ3Wg3peSodyp3vxdYce2vk4EKeqEFuuS82850DYb7Et7fmp+wQQUT8Q/bMO0DreWjHoMM5lE4LJ4ME6AxksmMiFtfo/4Fe2q9D+LAqZ+ANOcv9M+8Rn6ngiYmuRNd0l/a02q1PEvO6vTfXgcl4f7Z1IULHPEaDNZHCJS1K5RXYFqYQ6OHsTmOm7hnwaRAS97+VFMo1i5uvTx9nYaAcY7yzq3Ckfb67dMBKApGOpJpkvPgfrP7bgBO5rOZXM1opXqVPb09nljAhhAhyCTh1e/8+mJrBo0cLQ/LupQzVxGDgm3awSMPxsZAN45PSWz76zzxdDa1MMo51do+VJHfs7Wl0NcXAQrniOBYL9Wqt0qNkn1gY5smkkISGeQ/vxNap4MmzeZE7b5fpOy+2fpcRVQLpc4nooQzJvSVTFz+25lgZ6iHf45K87gQFMIAri1Pf/EDDpL87az+bRWvWi+BA2kMe1kf+Ay1LyMz8r+g51H0ma0bNFh6+fbWMfUiD9JCepIObclnUJ4NlWfcgHxTf17d/4tl6z4DTcLpCCk8Da77JouSHgvtcRbRlFV1OfhWZLXUsrlfpaQTiItv6TGIr3k7+7b66o3Qw/GQVs5GmYifaIZIz8n8my4XjkaMBd0SZfBzzvFjHMq6YUP9+SbjvReqofuoO+5tW1wTYZXitFFBfwuHlXm6w77K5QDBW6olT7pat41/F5eGxLcz tv@wu";
     };
-    tv_nomic = {
+    tv-nomic = {
       inherit (tv) mail;
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3dYR/n4Yw8OsYmfR2rSUG7o10G6AqOlSJHuHSEmANbMkqjiWl1TnpORtt5bAktyAGI4vWf9vhNEnxuIqGXWSV+3yCd7yfBHR1m0Y9QSw6blQ0xc1venl3JU0kpEyJfUn8a9cdXlnRiS0MP1gcsN7Zk8cqBELJYJajkSEnsT4eVaU5/wdnyzUO1fk8D8tFBJbF/tsWDLJPu4P18rpxq4wZgA2qmyHoVDEVlrz2OYcziXT6gpG0JGnToteaNg9ok5QavEYFpp8P+k1AacrBjc1PAb4MaMX1nfkSyaZwSqLdH35XkNRgPhVVmqZ5PlG3VeNpPSwpdcKi8P3zH1xG9g6Usx1SAyvcoAyGHdOwmFuA2tc1HgYEiQ+OsPrHZHujBOOZsKTN9+IZHScCAe+UmUcK413WEZKPs8PeFjf1gQAoDXb55JpksxLAnC/SQOl4FhkctIAXxr12ALlyt9UFPzIoj/Nj2MpFzGSlf653fTFmnMbQ8+GICc4TUpqx5GELZhfQuprBTv/55a9zKvM4B8XT3Bn9olQzMQIXEjXb3WUVFDDNWeNydToorYn1wG3ZWQ+3f0IlqRicWO7Q9BRj1Lp5rcUCb+naJ48tGY6HFUZ1Kz/0x458GDFvUd8mCJjqqmeSkUEeZd0xet5tVFg/bYoSslEqPF6pz7V3ruJMSdYxnQ== tv@nomic #2";
     };
-    tv_xu = {
+    tv-xu = {
       inherit (tv) mail;
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/3nkqxe8YrDVt615n96A7iC3vvwsiqgpsBYC/bhwfBHu1bAtBmTWVqSKDIdwg7p8TQpIKtAgZ3IJT3BlrnVTeR4RIviLjHjYWW1NBhm+nXi+heThgi5fLciE3lVLVsy5X9Kc1ZPLgLa1In0REOanwbueOD0ESN1yKIDwUUdczw/o3dLDMzanqFHKuSSN4o9Ex2x+MRj9eLsb706s4VSYMo3lirRCJeAOGv1C7Xg1cuepdhIeJsq9aF7vSy15c0nCkWwr8zdY7pbMPYCe5zvIEymZ0UowZ5HQ3NmIZnYDxa4E1PFjDczHdQbVmmGMI80grNwMsHzQ6bynHSPXDoLf4WodXlhS0+9Ju5QavDT6uqZ9uhDBuWC8QNgWUMIJnEaTBFyA0OI1akl8Q2RLC+qnNf5IwItSq+GDwEsB2ZJNW3kOk1kNiCUrBafRYpPaFeP97wzzP4uYlBKAr2SOLrrkf7NFEdw2ihxhDMNnps/ErRJ8U0zdpmalw8mItGyqRULpHjk/wN00rYOdBIhW3G3QJuVgtGnWtGCBG5x70EfMiSEXPD3YSsVVsgKD+v8qr+YiilRRD+N3gaHhiOWA6HgxRNul/P4llk0ktTpb9LoHk2+oooTH5ZuuT/8yF8J4stZt7EIOH+mSOAXG1z0BwnEkQu7pVKwu/oOZpGJTvBrGwww== tv@xu";
     };
diff --git a/mv/2configs/git.nix b/mv/2configs/git.nix
index 991d0c410..c182d0d1e 100644
--- a/mv/2configs/git.nix
+++ b/mv/2configs/git.nix
@@ -45,7 +45,7 @@ let
         perm = push "refs/*" [ non-fast-forward create delete merge ];
       } ++
       optional repo.public {
-        user = [ lass makefu uriel tv tv_xu ];
+        user = [ lass makefu uriel tv tv-xu ];
         repo = [ repo ];
         perm = fetch;
       } ++
diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix
index b8180085f..85fd72539 100644
--- a/tv/2configs/git.nix
+++ b/tv/2configs/git.nix
@@ -90,7 +90,7 @@ let
     with git // config.krebs.users;
     repo:
       singleton {
-        user = [ tv tv_xu ];
+        user = [ tv tv-xu ];
         repo = [ repo ];
         perm = push "refs/*" [ non-fast-forward create delete merge ];
       } ++
-- 
cgit v1.2.3


From 02ad327081f2315b9ab15733319b167f64180a0d Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 05:32:03 +0100
Subject: krebs.backup writeDash* -> pkgs

---
 krebs/3modules/backup.nix | 35 ++++++++++-------------------------
 krebs/5pkgs/default.nix   | 15 +++++++++++++++
 2 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix
index 0f85b4879..ae766fa9d 100644
--- a/krebs/3modules/backup.nix
+++ b/krebs/3modules/backup.nix
@@ -128,11 +128,11 @@ let
   };
 
   push = plan: let
-    # We use writeDashBin and return the absolute path so systemd will produce
-    # nice names in the log, i.e. without the Nix store hash.
+    # We use pkgs.writeDashBin and return the absolute path so systemd will
+    # produce nice names in the log, i.e. without the Nix store hash.
     out = "${main}/bin/${main.name}";
 
-    main = writeDashBin "backup.${plan.name}.push" ''
+    main = pkgs.writeDashBin "backup.${plan.name}.push" ''
       set -efu
       dst=${shell.escape plan.dst.path}
 
@@ -140,7 +140,7 @@ let
       exec flock -n "$dst" ${critical-section}
     '';
 
-    critical-section = writeDash "backup.${plan.name}.push.critical-section" ''
+    critical-section = pkgs.writeDash "backup.${plan.name}.push.critical-section" ''
       # TODO check if there is a previous
       set -efu
       identity=${shell.escape plan.src.host.ssh.privkey.path}
@@ -173,7 +173,7 @@ let
           env NOW="$NOW" /bin/sh < ${remote-snapshot}
     '';
 
-    remote-snapshot = writeDash "backup.${plan.name}.push.remote-snapshot" ''
+    remote-snapshot = pkgs.writeDash "backup.${plan.name}.push.remote-snapshot" ''
       set -efu
       dst=${shell.escape plan.dst.path}
 
@@ -191,11 +191,11 @@ let
 
   # TODO admit plan.dst.user and its ssh identity
   pull = plan: let
-    # We use writeDashBin and return the absolute path so systemd will produce
-    # nice names in the log, i.e. without the Nix store hash.
+    # We use pkgs.writeDashBin and return the absolute path so systemd will
+    # produce nice names in the log, i.e. without the Nix store hash.
     out = "${main}/bin/${main.name}";
 
-    main = writeDashBin "backup.${plan.name}.pull" ''
+    main = pkgs.writeDashBin "backup.${plan.name}.pull" ''
       set -efu
       dst=${shell.escape plan.dst.path}
 
@@ -203,7 +203,7 @@ let
       exec flock -n "$dst" ${critical-section}
     '';
 
-    critical-section = writeDash "backup.${plan.name}.pull.critical-section" ''
+    critical-section = pkgs.writeDash "backup.${plan.name}.pull.critical-section" ''
       # TODO check if there is a previous
       set -efu
       identity=${shell.escape plan.dst.host.ssh.privkey.path}
@@ -235,7 +235,7 @@ let
     '';
   in out;
 
-  take-snapshots = plan: writeDash "backup.${plan.name}.take-snapshots" ''
+  take-snapshots = plan: pkgs.writeDash "backup.${plan.name}.take-snapshots" ''
     set -efu
     NOW=''${NOW-$(date +%s)}
     dst=${shell.escape plan.dst.path}
@@ -280,21 +280,6 @@ let
       plan.snapshots)}
   '';
 
-  writeDash = name: text: pkgs.writeScript name ''
-    #! ${pkgs.dash}/bin/dash
-    ${text}
-  '';
-
-  writeDashBin = name: text: pkgs.writeTextFile {
-    executable = true;
-    destination = "/bin/${name}";
-    name = name;
-    text = ''
-      #! ${pkgs.dash}/bin/dash
-      ${text}
-    '';
-  };
-
   # XXX Is one ping enough to determine fastest address?
   # Note that we're using net.addrs4 instead of net.aliases because we define
   # ports only for addresses.  See krebs/3modules/default.nix
diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix
index c4b1dafe4..a0ccdcf49 100644
--- a/krebs/5pkgs/default.nix
+++ b/krebs/5pkgs/default.nix
@@ -61,6 +61,21 @@ subdirs // rec {
     strip --strip-unneeded "$exe"
   '';
 
+  writeDash = name: text: pkgs.writeScript name ''
+    #! ${pkgs.dash}/bin/dash
+    ${text}
+  '';
+
+  writeDashBin = name: text: pkgs.writeTextFile {
+    executable = true;
+    destination = "/bin/${name}";
+    name = name;
+    text = ''
+      #! ${pkgs.dash}/bin/dash
+      ${text}
+    '';
+  };
+
   writeNixFromCabal = name: path: pkgs.runCommand name {} ''
     ${pkgs.cabal2nix}/bin/cabal2nix ${path} > $out
   '';
-- 
cgit v1.2.3


From 076f93bc02897b01e3ed997fb2f9a543eb6547c9 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 05:38:27 +0100
Subject: mu: 10.243.20.01 -> 10.243.20.1

---
 krebs/3modules/tv/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index b6d779981..abcc67933 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -172,7 +172,7 @@ with lib;
     mu = {
       nets = {
         retiolum = {
-          addrs4 = ["10.243.20.01"];
+          addrs4 = ["10.243.20.1"];
           addrs6 = ["42:0:0:0:0:0:0:2001"];
           aliases = [
             "mu.r"
-- 
cgit v1.2.3


From b746dd09361b0cfb14abd3995afe10536c8fcad8 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 06:22:56 +0100
Subject: krebs.backup: ensure link dest exists

---
 krebs/3modules/backup.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix
index ae766fa9d..d50628073 100644
--- a/krebs/3modules/backup.nix
+++ b/krebs/3modules/backup.nix
@@ -160,7 +160,7 @@ let
           -aAXF --delete \
           -e "ssh -F /dev/null -i $identity ''${dst_port:+-p $dst_port}" \
           --rsync-path ${shell.escape
-            "mkdir -m 0700 -p ${shell.escape plan.dst.path} && rsync"} \
+            "mkdir -m 0700 -p ${shell.escape plan.dst.path}/current && rsync"} \
           --link-dest="$dst_path/current" \
           "$src/" \
           "$dst/.partial"
-- 
cgit v1.2.3


From f1ebd4e4e1bdc76bfca894ace336064b81cc98a1 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 06:43:26 +0100
Subject: krebs knownHosts: add-port everywhere

---
 krebs/3modules/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 529506905..e11d40a05 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -179,7 +179,6 @@ let
                 (mapAttrsToList
                   (net-name: net:
                     let
-                      aliases = shorts ++ longs;
                       longs = net.aliases;
                       shorts =
                         map (removeSuffix ".${cfg.search-domain}")
@@ -190,7 +189,7 @@ let
                           then "[${a}]:${toString net.ssh.port}"
                           else a;
                     in
-                    aliases ++ map add-port net.addrs)
+                    map add-port (shorts ++ longs ++ net.addrs))
                   host.nets);
 
             publicKey = host.ssh.pubkey;
-- 
cgit v1.2.3


From b819d6c452605af66282c14e25907793a4b77c65 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 07:47:29 +0100
Subject: tv vim: add file-line plugin

---
 tv/2configs/vim.nix | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 23f90af05..9f702cd4d 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -13,9 +13,21 @@ let
     environment.variables.VIMINIT = ":so /etc/vimrc";
   };
 
-  extra-runtimepath = concatStringsSep "," [
-    "${pkgs.vimPlugins.undotree}/share/vim-plugins/undotree"
-  ];
+  extra-runtimepath = let
+    inherit (pkgs.vimUtils) buildVimPlugin rtpPath;
+    fromVimPlugins = pkgs: concatStringsSep ","
+      (mapAttrsToList (name: pkg: "${pkg}/${rtpPath}/${name}") pkgs);
+  in fromVimPlugins {
+    inherit (pkgs.vimPlugins) undotree;
+    file-line = buildVimPlugin {
+      name = "file-line-1.0";
+      src = pkgs.fetchgit {
+        url = git://github.com/bogado/file-line;
+        rev = "refs/tags/1.0";
+        sha256 = "0z47zq9rqh06ny0q8lpcdsraf3lyzn9xvb59nywnarf3nxrk6hx0";
+      };
+    };
+  };
 
   dirs = {
     backupdir = "$HOME/.cache/vim/backup";
-- 
cgit v1.2.3


From 698296eb8c986127e0fb195a51b3adf3f31eeedf Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 07:50:17 +0100
Subject: tv vim: restore original umask

---
 tv/2configs/vim.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 9f702cd4d..8a6299a39 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -47,9 +47,10 @@ let
   vim = pkgs.writeScriptBin "vim" ''
     #! ${pkgs.dash}/bin/dash
     set -f
+    umask=$(umask)
     umask 0077
     ${concatStringsSep "\n" (map (x: "mkdir -p ${x}") mkdirs)}
-    umask 0022
+    umask "$umask"
     exec ${pkgs.vim}/bin/vim "$@"
   '';
 
-- 
cgit v1.2.3


From ee5a1ddffe51117862f7e2669f3939dd165d5686 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 08:09:07 +0100
Subject: tv vim: simplify wrapper

---
 tv/2configs/vim.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 8a6299a39..69a880dab 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -44,13 +44,9 @@ let
     alldirs = attrValues dirs ++ map dirOf (attrValues files);
   in unique (sort lessThan alldirs);
 
-  vim = pkgs.writeScriptBin "vim" ''
-    #! ${pkgs.dash}/bin/dash
-    set -f
-    umask=$(umask)
-    umask 0077
-    ${concatStringsSep "\n" (map (x: "mkdir -p ${x}") mkdirs)}
-    umask "$umask"
+  vim = pkgs.writeDashBin "vim" ''
+    set -efu
+    (umask 0077; exec ${pkgs.coreutils}/bin/mkdir -p ${toString mkdirs})
     exec ${pkgs.vim}/bin/vim "$@"
   '';
 
-- 
cgit v1.2.3


From 4c40eba8161d4afaa85984737c6f03adf861be7a Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 15:58:49 +0100
Subject: krebs: add localhost to knownHosts

---
 krebs/3modules/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index e11d40a05..e4e5642ce 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -155,7 +155,16 @@ let
         let inherit (config.krebs.build.host.ssh) privkey; in
         mkIf (privkey != null) (mkForce [privkey]);
 
+      # TODO use imports for merging
       services.openssh.knownHosts =
+        (let inherit (config.krebs.build.host.ssh) pubkey; in
+          optionalAttrs (pubkey != null) {
+            localhost = {
+              hostNames = ["localhost" "127.0.0.1" "::1"];
+              publicKey = pubkey;
+            };
+          })
+        //
         # GitHub's IPv4 address range is 192.30.252.0/22
         # Refs https://help.github.com/articles/what-ip-addresses-does-github-use-that-i-should-whitelist/
         # 192.30.252.0/22 = 192.30.252.0-192.30.255.255 (1024 addresses)
-- 
cgit v1.2.3


From 00525dc0ef2b73e6d883eb6e7358a616b8c15b69 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 16:08:07 +0100
Subject: krebs.backup.plans.*.startAt: null disables timer

---
 krebs/3modules/backup.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix
index d50628073..881e126f6 100644
--- a/krebs/3modules/backup.nix
+++ b/krebs/3modules/backup.nix
@@ -30,7 +30,7 @@ let
           };
           startAt = mkOption {
             default = "hourly";
-            type = types.str; # TODO systemd.time(7)'s calendar event
+            type = with types; nullOr str; # TODO systemd.time(7)'s calendar event
           };
           snapshots = mkOption {
             default = {
@@ -115,7 +115,8 @@ let
       ExecStart = push plan;
       Type = "oneshot";
     };
-    startAt = plan.startAt;
+  } // optionalAttrs (plan.startAt != null) {
+    inherit (plan) startAt;
   };
 
   makePullService = plan: assert isPullDst plan; {
@@ -124,7 +125,8 @@ let
       ExecStart = pull plan;
       Type = "oneshot";
     };
-    startAt = plan.startAt;
+  } // optionalAttrs (plan.startAt != null) {
+    inherit (plan) startAt;
   };
 
   push = plan: let
-- 
cgit v1.2.3


From d01c6f9dbcd2d1d7ccccff5fc8c41ffb53d04a42 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 16:09:46 +0100
Subject: krebs.backup: don't append .{pull,push} to service name

---
 krebs/3modules/backup.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix
index 881e126f6..935370d9c 100644
--- a/krebs/3modules/backup.nix
+++ b/krebs/3modules/backup.nix
@@ -72,12 +72,12 @@ let
       ;
     systemd.services =
       flip mapAttrs' (filterAttrs (_:isPullDst) cfg.plans) (name: plan: {
-        name = "backup.${name}.pull";
+        name = "backup.${name}";
         value = makePullService plan;
       })
       //
       flip mapAttrs' (filterAttrs (_:isPushSrc) cfg.plans) (name: plan: {
-        name = "backup.${name}.push";
+        name = "backup.${name}";
         value = makePushService plan;
       })
       ;
-- 
cgit v1.2.3


From 071194c3946b325103311f5c6528fba30580f125 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 16:21:58 +0100
Subject: krebs.backup: DRY up push and pull

---
 krebs/3modules/backup.nix | 333 +++++++++++++++++-----------------------------
 1 file changed, 125 insertions(+), 208 deletions(-)

diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix
index 935370d9c..fa5b0cfd2 100644
--- a/krebs/3modules/backup.nix
+++ b/krebs/3modules/backup.nix
@@ -58,228 +58,145 @@ let
   };
 
   imp = {
-    users.groups.backup.gid = genid "backup";
-    users.users = {}
-      // {
-        root.openssh.authorizedKeys.keys =
-          map (plan: plan.dst.host.ssh.pubkey)
-              (filter isPullSrc (attrValues cfg.plans))
-          ++
-          map (plan: plan.src.host.ssh.pubkey)
-              (filter isPushDst (attrValues cfg.plans))
-          ;
-      }
-      ;
     systemd.services =
-      flip mapAttrs' (filterAttrs (_:isPullDst) cfg.plans) (name: plan: {
-        name = "backup.${name}";
-        value = makePullService plan;
-      })
-      //
-      flip mapAttrs' (filterAttrs (_:isPushSrc) cfg.plans) (name: plan: {
-        name = "backup.${name}";
-        value = makePushService plan;
-      })
-      ;
-  };
-
-  isPushSrc = plan:
-    plan.method == "push" &&
-    plan.src.host.name == config.krebs.build.host.name;
-
-  isPullSrc = plan:
-    plan.method == "pull" &&
-    plan.src.host.name == config.krebs.build.host.name;
-
-  isPushDst = plan:
-    plan.method == "push" &&
-    plan.dst.host.name == config.krebs.build.host.name;
-
-  isPullDst = plan:
-    plan.method == "pull" &&
-    plan.dst.host.name == config.krebs.build.host.name;
-
-  # TODO push destination needs this in the dst.user's PATH
-  service-path = [
-    pkgs.coreutils
-    pkgs.gnused
-    pkgs.openssh
-    pkgs.rsync
-    pkgs.utillinux
-  ];
-
-  # TODO if there is plan.user, then use its privkey
-  makePushService = plan: assert isPushSrc plan; {
-    path = service-path;
-    serviceConfig = {
-      ExecStart = push plan;
-      Type = "oneshot";
-    };
-  } // optionalAttrs (plan.startAt != null) {
-    inherit (plan) startAt;
-  };
+      listToAttrs (map (plan: nameValuePair "backup.${plan.name}" {
+        # TODO if there is plan.user, then use its privkey
+        # TODO push destination users need a similar path
+        path = with pkgs; [
+          coreutils
+          gnused
+          openssh
+          rsync
+          utillinux
+        ];
+        serviceConfig = rec {
+          ExecStart = start plan;
+          SyslogIdentifier = ExecStart.name;
+          Type = "oneshot";
+        };
+      } // optionalAttrs (plan.startAt != null) {
+        inherit (plan) startAt;
+      }) (filter (plan: build-host-is "pull" "dst" plan ||
+                        build-host-is "push" "src" plan)
+                 (attrValues cfg.plans)));
 
-  makePullService = plan: assert isPullDst plan; {
-    path = service-path;
-    serviceConfig = {
-      ExecStart = pull plan;
-      Type = "oneshot";
-    };
-  } // optionalAttrs (plan.startAt != null) {
-    inherit (plan) startAt;
+    users.groups.backup.gid = genid "backup";
+    users.users.root.openssh.authorizedKeys.keys =
+      map (plan: getAttr plan.method {
+        push = plan.src.host.ssh.pubkey;
+        pull = plan.dst.host.ssh.pubkey;
+      }) (filter (plan: build-host-is "pull" "src" plan ||
+                        build-host-is "push" "dst" plan)
+                 (attrValues cfg.plans));
   };
 
-  push = plan: let
-    # We use pkgs.writeDashBin and return the absolute path so systemd will
-    # produce nice names in the log, i.e. without the Nix store hash.
-    out = "${main}/bin/${main.name}";
-
-    main = pkgs.writeDashBin "backup.${plan.name}.push" ''
-      set -efu
-      dst=${shell.escape plan.dst.path}
-
-      mkdir -m 0700 -p "$dst"
-      exec flock -n "$dst" ${critical-section}
-    '';
-
-    critical-section = pkgs.writeDash "backup.${plan.name}.push.critical-section" ''
-      # TODO check if there is a previous
-      set -efu
-      identity=${shell.escape plan.src.host.ssh.privkey.path}
-      src=${shell.escape plan.src.path}
-      dst_user=root
-      dst_host=$(${fastest-address plan.dst.host})
-      dst_port=$(${network-ssh-port plan.dst.host "$dst_host"})
-      dst_path=${shell.escape plan.dst.path}
-      dst=$dst_user@$dst_host:$dst_path
-
-      # Export NOW so runtime of rsync doesn't influence snapshot naming.
-      export NOW
-      NOW=$(date +%s)
-
-      echo >&2 "update snapshot: current; $src -> $dst"
-      rsync >&2 \
-          -aAXF --delete \
-          -e "ssh -F /dev/null -i $identity ''${dst_port:+-p $dst_port}" \
-          --rsync-path ${shell.escape
-            "mkdir -m 0700 -p ${shell.escape plan.dst.path}/current && rsync"} \
-          --link-dest="$dst_path/current" \
-          "$src/" \
-          "$dst/.partial"
+  build-host-is = method: side: plan:
+    plan.method == method &&
+    config.krebs.build.host.name == plan.${side}.host.name;
 
-      exec ssh -F /dev/null \
-          -i "$identity" \
-          ''${dst_port:+-p $dst_port} \
-          "$dst_user@$dst_host" \
-          -T \
-          env NOW="$NOW" /bin/sh < ${remote-snapshot}
-    '';
-
-    remote-snapshot = pkgs.writeDash "backup.${plan.name}.push.remote-snapshot" ''
-      set -efu
-      dst=${shell.escape plan.dst.path}
-
-      if test -e "$dst/current"; then
-        mv "$dst/current" "$dst/.previous"
-      fi
-      mv "$dst/.partial" "$dst/current"
-      rm -fR "$dst/.previous"
-      echo >&2
-
-      (${(take-snapshots plan).text})
-    '';
-
-  in out;
-
-  # TODO admit plan.dst.user and its ssh identity
-  pull = plan: let
-    # We use pkgs.writeDashBin and return the absolute path so systemd will
-    # produce nice names in the log, i.e. without the Nix store hash.
-    out = "${main}/bin/${main.name}";
-
-    main = pkgs.writeDashBin "backup.${plan.name}.pull" ''
+  start = plan: pkgs.writeDash "backup.${plan.name}" ''
+    set -efu
+    ${getAttr plan.method {
+      push = ''
+        identity=${shell.escape plan.src.host.ssh.privkey.path}
+        src_path=${shell.escape plan.src.path}
+        src=$src_path
+        dst_user=root
+        dst_host=$(${fastest-address plan.dst.host})
+        dst_port=$(${network-ssh-port plan.dst.host "$dst_host"})
+        dst_path=${shell.escape plan.dst.path}
+        dst=$dst_user@$dst_host:$dst_path
+        echo "update snapshot: current; $src -> $dst" >&2
+        dst_shell() {
+          exec ssh -F /dev/null \
+              -i "$identity" \
+              ''${dst_port:+-p $dst_port} \
+              "$dst_user@$dst_host" \
+              -T "$with_dst_path_lock_script"
+        }
+      '';
+      pull = ''
+        identity=${shell.escape plan.dst.host.ssh.privkey.path}
+        src_user=root
+        src_host=$(${fastest-address plan.src.host})
+        src_port=$(${network-ssh-port plan.src.host "$src_host"})
+        src_path=${shell.escape plan.src.path}
+        src=$src_user@$src_host:$src_path
+        dst_path=${shell.escape plan.dst.path}
+        dst=$dst_path
+        echo "update snapshot: current; $dst <- $src" >&2
+        dst_shell() {
+          eval "$with_dst_path_lock_script"
+        }
+      '';
+    }}
+    # Note that this only works because we trust date +%s to produce output
+    # that doesn't need quoting when used to generate a command string.
+    # TODO relax this requirement by selectively allowing to inject variables
+    #   e.g.: ''${shell.quote "exec env NOW=''${shell.unquote "$NOW"} ..."}
+    with_dst_path_lock_script="exec env start_date=$(date +%s) "${shell.escape
+      "flock -n ${shell.escape plan.dst.path} /bin/sh"
+    }
+    rsync >&2 \
+        -aAXF --delete \
+        -e "ssh -F /dev/null -i $identity ''${dst_port:+-p $dst_port}" \
+        --rsync-path ${shell.escape (concatStringsSep " && " [
+          "mkdir -m 0700 -p ${shell.escape plan.dst.path}/current"
+          "exec flock -n ${shell.escape plan.dst.path} rsync"
+        ])} \
+        --link-dest="$dst_path/current" \
+        "$src/" \
+        "$dst/.partial"
+    dst_shell < ${toFile "backup.${plan.name}.take-snapshots" ''
       set -efu
-      dst=${shell.escape plan.dst.path}
+      : $start_date
 
-      mkdir -m 0700 -p "$dst"
-      exec flock -n "$dst" ${critical-section}
-    '';
-
-    critical-section = pkgs.writeDash "backup.${plan.name}.pull.critical-section" ''
-      # TODO check if there is a previous
-      set -efu
-      identity=${shell.escape plan.dst.host.ssh.privkey.path}
-      src_user=root
-      src_host=$(${fastest-address plan.src.host})
-      src_port=$(${network-ssh-port plan.src.host "$src_host"})
-      src_path=${shell.escape plan.src.path}
-      src=$src_user@$src_host:$src_path
       dst=${shell.escape plan.dst.path}
 
-      # Export NOW so runtime of rsync doesn't influence snapshot naming.
-      export NOW
-      NOW=$(date +%s)
-
-      echo >&2 "update snapshot: current; $dst <- $src"
-      mkdir -m 0700 -p ${shell.escape plan.dst.path}
-      rsync >&2 \
-          -aAXF --delete \
-          -e "ssh -F /dev/null -i $identity ''${src_port:+-p $src_port}" \
-          --link-dest="$dst/current" \
-          "$src/" \
-          "$dst/.partial"
       mv "$dst/current" "$dst/.previous"
       mv "$dst/.partial" "$dst/current"
       rm -fR "$dst/.previous"
       echo >&2
 
-      exec ${take-snapshots plan}
-    '';
-  in out;
-
-  take-snapshots = plan: pkgs.writeDash "backup.${plan.name}.take-snapshots" ''
-    set -efu
-    NOW=''${NOW-$(date +%s)}
-    dst=${shell.escape plan.dst.path}
-
-    snapshot() {(
-      : $ns $format $retain
-      name=$(date --date="@$NOW" +"$format")
-      if ! test -e "$dst/$ns/$name"; then
-        echo >&2 "create snapshot: $ns/$name"
-        mkdir -m 0700 -p "$dst/$ns"
-        rsync >&2 \
-            -aAXF --delete \
-            --link-dest="$dst/current" \
-            "$dst/current/" \
-            "$dst/$ns/.partial.$name"
-        mv "$dst/$ns/.partial.$name" "$dst/$ns/$name"
-        echo >&2
-      fi
-      case $retain in
-        ([0-9]*)
-          delete_from=$(($retain + 1))
-          ls -r "$dst/$ns" \
-            | sed -n "$delete_from,\$p" \
-            | while read old_name; do
-                echo >&2 "delete snapshot: $ns/$old_name"
-                rm -fR "$dst/$ns/$old_name"
-              done
-          ;;
-        (ALL)
-          :
-          ;;
-      esac
-    )}
-
-    ${concatStringsSep "\n" (mapAttrsToList (ns: { format, retain ? null, ... }:
-      toString (map shell.escape [
-        "ns=${ns}"
-        "format=${format}"
-        "retain=${if retain == null then "ALL" else toString retain}"
-        "snapshot"
-      ]))
-      plan.snapshots)}
+      snapshot() {(
+        : $ns $format $retain
+        name=$(date --date="@$start_date" +"$format")
+        if ! test -e "$dst/$ns/$name"; then
+          echo >&2 "create snapshot: $ns/$name"
+          mkdir -m 0700 -p "$dst/$ns"
+          rsync >&2 \
+              -aAXF --delete \
+              --link-dest="$dst/current" \
+              "$dst/current/" \
+              "$dst/$ns/.partial.$name"
+          mv "$dst/$ns/.partial.$name" "$dst/$ns/$name"
+          echo >&2
+        fi
+        case $retain in
+          ([0-9]*)
+            delete_from=$(($retain + 1))
+            ls -r "$dst/$ns" \
+              | sed -n "$delete_from,\$p" \
+              | while read old_name; do
+                  echo >&2 "delete snapshot: $ns/$old_name"
+                  rm -fR "$dst/$ns/$old_name"
+                done
+            ;;
+          (ALL)
+            :
+            ;;
+        esac
+      )}
+
+      ${concatStringsSep "\n" (mapAttrsToList (ns: { format, retain, ... }:
+        toString (map shell.escape [
+          "ns=${ns}"
+          "format=${format}"
+          "retain=${if retain == null then "ALL" else toString retain}"
+          "snapshot"
+        ]))
+        plan.snapshots)}
+    ''}
   '';
 
   # XXX Is one ping enough to determine fastest address?
-- 
cgit v1.2.3


From 8a1ddc5e9b8012b141c3b5e997d44acb70e1f17f Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 7 Feb 2016 23:48:34 +0100
Subject: krebs.backup.plans.*.enable.default = true

---
 krebs/3modules/backup.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix
index fa5b0cfd2..6e9e9813c 100644
--- a/krebs/3modules/backup.nix
+++ b/krebs/3modules/backup.nix
@@ -13,8 +13,10 @@ let
     plans = mkOption {
       default = {};
       type = types.attrsOf (types.submodule ({ config, ... }: {
-        # TODO enable = mkEnableOption "TODO" // { default = true; };
         options = {
+          enable = mkEnableOption "krebs.backup.${config.name}" // {
+            default = true;
+          };
           method = mkOption {
             type = types.enum ["pull" "push"];
           };
@@ -78,7 +80,7 @@ let
         inherit (plan) startAt;
       }) (filter (plan: build-host-is "pull" "dst" plan ||
                         build-host-is "push" "src" plan)
-                 (attrValues cfg.plans)));
+                 enabled-plans));
 
     users.groups.backup.gid = genid "backup";
     users.users.root.openssh.authorizedKeys.keys =
@@ -87,9 +89,11 @@ let
         pull = plan.dst.host.ssh.pubkey;
       }) (filter (plan: build-host-is "pull" "src" plan ||
                         build-host-is "push" "dst" plan)
-                 (attrValues cfg.plans));
+                 enabled-plans);
   };
 
+  enabled-plans = filter (getAttr "enable") (attrValues cfg.plans);
+
   build-host-is = method: side: plan:
     plan.method == method &&
     config.krebs.build.host.name == plan.${side}.host.name;
-- 
cgit v1.2.3


From 5a10c4beb56d052b816682058becedf7b8eacaaa Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 8 Feb 2016 00:25:35 +0100
Subject: =?UTF-8?q?tv=20backup:=20xu:/home=20=E2=86=92=20wu:/bku/xu-home?=
 =?UTF-8?q?=20@=2006:00?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tv/2configs/backup.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix
index f4d368557..6c90709a8 100644
--- a/tv/2configs/backup.nix
+++ b/tv/2configs/backup.nix
@@ -14,5 +14,17 @@ with lib;
         yearly   = { format = "%Y";                       };
       };
     };
+    xu-home-wu = {
+      method = "push";
+      src = { host = config.krebs.hosts.xu; path = "/home"; };
+      dst = { host = config.krebs.hosts.wu; path = "/bku/xu-home"; };
+      startAt = "06:00";
+      snapshots = {
+        daily    = { format = "%Y-%m-%d";    retain =  7; };
+        weekly   = { format = "%YW%W";       retain =  4; };
+        monthly  = { format = "%Y-%m";       retain = 12; };
+        yearly   = { format = "%Y";                       };
+      };
+    };
   };
 }
-- 
cgit v1.2.3


From 14afbfef1251178b1599caaf9046c6aeeb97fb19 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 8 Feb 2016 00:31:26 +0100
Subject: krebs.backup: use aliases instead of addrs4

---
 krebs/3modules/backup.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix
index 6e9e9813c..86e2e72e2 100644
--- a/krebs/3modules/backup.nix
+++ b/krebs/3modules/backup.nix
@@ -204,12 +204,10 @@ let
   '';
 
   # XXX Is one ping enough to determine fastest address?
-  # Note that we're using net.addrs4 instead of net.aliases because we define
-  # ports only for addresses.  See krebs/3modules/default.nix
   fastest-address = host: ''
     { ${pkgs.fping}/bin/fping </dev/null -a \
         ${concatMapStringsSep " " shell.escape
-          (mapAttrsToList (_: net: head net.addrs4) host.nets)} \
+          (mapAttrsToList (_: net: head net.aliases) host.nets)} \
       | ${pkgs.coreutils}/bin/head -1; }
   '';
 
@@ -218,7 +216,7 @@ let
   network-ssh-port = host: word: ''
     case ${word} in
     ${concatStringsSep ";;\n" (mapAttrsToList
-      (_: net: "(${head net.addrs4}) echo ${toString net.ssh.port}")
+      (_: net: "(${head net.aliases}) echo ${toString net.ssh.port}")
       host.nets)};;
     esac
   '';
-- 
cgit v1.2.3


From 2b8b92cf751831cfbfbf56745871b5242e29c26a Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 8 Feb 2016 00:43:24 +0100
Subject: posix-array: how could this ever work?

---
 krebs/5pkgs/posix-array/default.nix | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/krebs/5pkgs/posix-array/default.nix b/krebs/5pkgs/posix-array/default.nix
index 456a3cc11..cfcdb29a7 100644
--- a/krebs/5pkgs/posix-array/default.nix
+++ b/krebs/5pkgs/posix-array/default.nix
@@ -1,7 +1,7 @@
-{ stdenv, fetchgit, ... }:
+{ fetchgit, lib, stdenv, ... }:
 
-with stdenv; stdenv.mkDerivation rec {
-  name = "posix-array";
+stdenv.mkDerivation rec {
+  name = "posix-array-${version}";
   version = "1.0.0";
 
   src = fetchgit {
@@ -16,16 +16,15 @@ with stdenv; stdenv.mkDerivation rec {
   ];
 
   installPhase = ''
-    mkdir -p "$out/bin"
+    mkdir -p $out/bin
     cp -a ./array $out/bin
-    rm *
   '';
 
   meta = {
-    description = "Posix-compliant array implementation";
+    description = "POSIX-compliant array implementation";
     url = https://github.com/makefu/array;
-    license = licenses.wtfpl;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ makefu ];
+    license = lib.licenses.wtfpl;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ makefu ];
   };
 }
-- 
cgit v1.2.3


From ec7dc8a5ace37cdf1005cabd5a8554f4dc73727e Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 8 Feb 2016 00:46:17 +0100
Subject: krebs pkgs: callPackages only subdirs with a defaut.nix

---
 krebs/5pkgs/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix
index a0ccdcf49..cf81a96c5 100644
--- a/krebs/5pkgs/default.nix
+++ b/krebs/5pkgs/default.nix
@@ -2,8 +2,9 @@
 
 with lib;
 let
-  subdirs = mapAttrs (_: flip pkgs.callPackage {}) (subdirsOf ./.);
-  pkgs' = pkgs // subdirs;
+  subdirs = mapAttrs (_: flip pkgs.callPackage {})
+                     (filterAttrs (_: dir.has-default-nix)
+                                  (subdirsOf ./.));
 in
 
 subdirs // rec {
@@ -22,7 +23,7 @@ subdirs // rec {
           (builtins.readDir ./haskell-overrides));
   };
 
-  push = pkgs'.callPackage ./push {
+  push = pkgs.callPackage ./push {
     inherit (subdirs) get jq;
   };
 
-- 
cgit v1.2.3


From d98578e3e190463a341a94f2cc778ef886f9252d Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 8 Feb 2016 01:07:03 +0100
Subject: rm krebs.build.target

---
 krebs/3modules/build.nix                  | 8 --------
 krebs/5pkgs/test/infest-cac-centos7/notes | 1 -
 makefu/1systems/gum.nix                   | 1 -
 makefu/1systems/vbob.nix                  | 1 -
 mv/1systems/stro.nix                      | 2 --
 shared/1systems/wolf.nix                  | 1 -
 tv/1systems/cd.nix                        | 1 -
 tv/1systems/mkdir.nix                     | 1 -
 tv/1systems/rmdir.nix                     | 2 --
 tv/2configs/default.nix                   | 1 -
 10 files changed, 19 deletions(-)

diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix
index 0da5dd38a..3530fd595 100644
--- a/krebs/3modules/build.nix
+++ b/krebs/3modules/build.nix
@@ -3,8 +3,6 @@
 with lib;
 
 let
-  target = config.krebs.build // { user.name = "root"; };
-
   out = {
     # TODO deprecate krebs.build.host
     options.krebs.build.host = mkOption {
@@ -17,12 +15,6 @@ let
       default = "/nix/var/nix/profiles/system";
     };
 
-    # TODO make krebs.build.target.host :: host
-    options.krebs.build.target = mkOption {
-      type = with types; nullOr str;
-      default = null;
-    };
-
     # TODO deprecate krebs.build.user
     options.krebs.build.user = mkOption {
       type = types.user;
diff --git a/krebs/5pkgs/test/infest-cac-centos7/notes b/krebs/5pkgs/test/infest-cac-centos7/notes
index b3beb392f..db80c0c6c 100755
--- a/krebs/5pkgs/test/infest-cac-centos7/notes
+++ b/krebs/5pkgs/test/infest-cac-centos7/notes
@@ -115,7 +115,6 @@ _: {
   users.extraUsers.root.openssh.authorizedKeys.keys = [
     "$(cat ${krebs_ssh}.pub)"
   ];
-  krebs.build.target = "$ip";
 }
 EOF
 
diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix
index c4dfbf4b7..fe800f251 100644
--- a/makefu/1systems/gum.nix
+++ b/makefu/1systems/gum.nix
@@ -26,7 +26,6 @@ in {
   nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
 
   ###### stable
-  krebs.build.target = "root@gum.krebsco.de";
   krebs.build.host = config.krebs.hosts.gum;
   krebs.retiolum.extraConfig = ''
     ListenAddress = ${external-ip} 53
diff --git a/makefu/1systems/vbob.nix b/makefu/1systems/vbob.nix
index 90b490802..20301795f 100644
--- a/makefu/1systems/vbob.nix
+++ b/makefu/1systems/vbob.nix
@@ -4,7 +4,6 @@
 { lib, config, pkgs, ... }:
 {
   krebs.build.host = config.krebs.hosts.vbob;
-  krebs.build.target = "root@10.10.10.220";
   imports =
     [ # Include the results of the hardware scan.
       <nixpkgs/nixos/modules/virtualisation/virtualbox-image.nix>
diff --git a/mv/1systems/stro.nix b/mv/1systems/stro.nix
index 38d4b4bc6..3915219b7 100644
--- a/mv/1systems/stro.nix
+++ b/mv/1systems/stro.nix
@@ -8,8 +8,6 @@ with lib;
   krebs.build.source.git.nixpkgs.rev =
     "7ae05edcdd14f6ace83ead9bf0d114e97c89a83a";
 
-  krebs.build.target = "lolwat";
-
   imports = [
     ../2configs/hw/x220.nix
     ../2configs/git.nix
diff --git a/shared/1systems/wolf.nix b/shared/1systems/wolf.nix
index bcfbd6810..9a514428a 100644
--- a/shared/1systems/wolf.nix
+++ b/shared/1systems/wolf.nix
@@ -45,7 +45,6 @@ in
   # uninteresting stuff
   #####################
   krebs.build.host = config.krebs.hosts.wolf;
-  krebs.build.target = "wolf";
 
   boot.kernel.sysctl = {
     # Enable IPv6 Privacy Extensions
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 8297a56df..b96548d61 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -4,7 +4,6 @@ with lib;
 
 {
   krebs.build.host = config.krebs.hosts.cd;
-  krebs.build.target = "root@cd.internet";
 
   imports = [
     ../2configs/hw/CAC-Developer-2.nix
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index 79e5f73b9..2010dcd57 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -17,7 +17,6 @@ in
 
 {
   krebs.build.host = config.krebs.hosts.mkdir;
-  krebs.build.target = "root@${primary-addr4}";
 
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index 6fd79c596..4005b5e6f 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -18,8 +18,6 @@ in
 {
   krebs.build.host = config.krebs.hosts.rmdir;
 
-  krebs.build.target = "root@rmdir.internet";
-
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 52d85f856..b5639af51 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -7,7 +7,6 @@ with lib;
 
   krebs.build = {
     user = config.krebs.users.tv;
-    target = mkDefault "root@${config.krebs.build.host.name}";
     source = mapAttrs (_: mkDefault) ({
       nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix";
       nixpkgs = symlink:stockholm/nixpkgs;
-- 
cgit v1.2.3


From 7f7256a76f5698a9f8599ce71780f47ab13590f4 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 8 Feb 2016 01:23:06 +0100
Subject: krebs pkgs: move builders to dedicated file

---
 krebs/5pkgs/builders.nix | 51 ++++++++++++++++++++++++++++++++++++++
 krebs/5pkgs/default.nix  | 64 +++++-------------------------------------------
 2 files changed, 57 insertions(+), 58 deletions(-)
 create mode 100644 krebs/5pkgs/builders.nix

diff --git a/krebs/5pkgs/builders.nix b/krebs/5pkgs/builders.nix
new file mode 100644
index 000000000..b3cb1c943
--- /dev/null
+++ b/krebs/5pkgs/builders.nix
@@ -0,0 +1,51 @@
+{ lib, pkgs, ... }:
+with lib;
+{
+  execve = name: { filename, argv, envp ? {}, destination ? "" }:
+    writeC name { inherit destination; } ''
+      #include <unistd.h>
+      int main () {
+        const char *filename = ${toC filename};
+        char *const argv[] = ${toC (argv ++ [null])};
+        char *const envp[] = ${toC (
+          mapAttrsToList (k: v: "${k}=${v}") envp ++ [null]
+        )};
+        execve(filename, argv, envp);
+        return -1;
+      }
+    '';
+
+  execveBin = name: cfg: execve name (cfg // { destination = "/bin/${name}"; });
+
+  writeC = name: { destination ? "" }: src: pkgs.runCommand name {} ''
+    PATH=${makeSearchPath "bin" (with pkgs; [
+      binutils
+      coreutils
+      gcc
+    ])}
+    src=${pkgs.writeText "${name}.c" src}
+    exe=$out${destination}
+    mkdir -p "$(dirname "$exe")"
+    gcc -O -Wall -o "$exe" $src
+    strip --strip-unneeded "$exe"
+  '';
+
+  writeDash = name: text: pkgs.writeScript name ''
+    #! ${pkgs.dash}/bin/dash
+    ${text}
+  '';
+
+  writeDashBin = name: text: pkgs.writeTextFile {
+    executable = true;
+    destination = "/bin/${name}";
+    name = name;
+    text = ''
+      #! ${pkgs.dash}/bin/dash
+      ${text}
+    '';
+  };
+
+  writeNixFromCabal = name: path: pkgs.runCommand name {} ''
+    ${pkgs.cabal2nix}/bin/cabal2nix ${path} > $out
+  '';
+}
diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix
index cf81a96c5..89e19dffd 100644
--- a/krebs/5pkgs/default.nix
+++ b/krebs/5pkgs/default.nix
@@ -1,14 +1,6 @@
-{ lib, pkgs, ... }:
-
+{ lib, pkgs, ... }@args:
 with lib;
-let
-  subdirs = mapAttrs (_: flip pkgs.callPackage {})
-                     (filterAttrs (_: dir.has-default-nix)
-                                  (subdirsOf ./.));
-in
-
-subdirs // rec {
-
+{
   haskellPackages = pkgs.haskellPackages.override {
     overrides = self: super:
       mapAttrs (name: path: self.callPackage path {})
@@ -29,55 +21,11 @@ subdirs // rec {
 
   ReaktorPlugins = pkgs.callPackage ./Reaktor/plugins.nix {};
 
-  execve = name: { filename, argv, envp ? {}, destination ? "" }:
-    writeC name { inherit destination; } ''
-      #include <unistd.h>
-      int main () {
-        const char *filename = ${toC filename};
-        char *const argv[] = ${toC (argv ++ [null])};
-        char *const envp[] = ${toC (
-          mapAttrsToList (k: v: "${k}=${v}") envp ++ [null]
-        )};
-        execve(filename, argv, envp);
-        return -1;
-      }
-    '';
-
   test = {
     infest-cac-centos7 = pkgs.callPackage ./test/infest-cac-centos7 {};
   };
-
-  execveBin = name: cfg: execve name (cfg // { destination = "/bin/${name}"; });
-
-  writeC = name: { destination ? "" }: src: pkgs.runCommand name {} ''
-    PATH=${makeSearchPath "bin" (with pkgs; [
-      binutils
-      coreutils
-      gcc
-    ])}
-    src=${pkgs.writeText "${name}.c" src}
-    exe=$out${destination}
-    mkdir -p "$(dirname "$exe")"
-    gcc -O -Wall -o "$exe" $src
-    strip --strip-unneeded "$exe"
-  '';
-
-  writeDash = name: text: pkgs.writeScript name ''
-    #! ${pkgs.dash}/bin/dash
-    ${text}
-  '';
-
-  writeDashBin = name: text: pkgs.writeTextFile {
-    executable = true;
-    destination = "/bin/${name}";
-    name = name;
-    text = ''
-      #! ${pkgs.dash}/bin/dash
-      ${text}
-    '';
-  };
-
-  writeNixFromCabal = name: path: pkgs.runCommand name {} ''
-    ${pkgs.cabal2nix}/bin/cabal2nix ${path} > $out
-  '';
 }
+// import ./builders.nix args
+// mapAttrs (_: flip pkgs.callPackage {})
+            (filterAttrs (_: dir.has-default-nix)
+                         (subdirsOf ./.))
-- 
cgit v1.2.3


From 356bb8