From 48c75276c5a5ed8e7ea33ccb330f8ee6b7a6a927 Mon Sep 17 00:00:00 2001 From: mv Date: Tue, 29 Aug 2017 21:00:46 +0200 Subject: mv: the future is now! --- mv/1systems/stro.nix | 169 -------------------------------------------- mv/1systems/stro/config.nix | 156 ++++++++++++++++++++++++++++++++++++++++ mv/1systems/stro/source.nix | 3 + mv/source.nix | 23 ++++++ 4 files changed, 182 insertions(+), 169 deletions(-) delete mode 100644 mv/1systems/stro.nix create mode 100644 mv/1systems/stro/config.nix create mode 100644 mv/1systems/stro/source.nix create mode 100644 mv/source.nix diff --git a/mv/1systems/stro.nix b/mv/1systems/stro.nix deleted file mode 100644 index bb37aedda..000000000 --- a/mv/1systems/stro.nix +++ /dev/null @@ -1,169 +0,0 @@ -{ config, lib, pkgs, ... }: - -with import ; - -{ - krebs = { - enable = true; - build = { - user = config.krebs.users.mv; - host = config.krebs.hosts.stro; - source = let - HOME = getEnv "HOME"; - host = config.krebs.build.host; - in { - nixos-config.symlink = "stockholm/mv/1systems/${host.name}.nix"; - secrets.file = "${HOME}/secrets/${host.name}"; - stockholm.file = "${HOME}/stockholm"; - nixpkgs.git = { - url = https://github.com/NixOS/nixpkgs; - ref = "8bf31d7d27cae435d7c1e9e0ccb0a320b424066f"; - }; - }; - }; - }; - - imports = [ - - - - - - - - - - - - - - - - - - ]; - - boot.kernel.sysctl = { - # Enable IPv6 Privacy Extensions - "net.ipv6.conf.all.use_tempaddr" = 2; - "net.ipv6.conf.default.use_tempaddr" = 2; - }; - - boot.initrd.luks = { - cryptoModules = [ "aes" "sha512" "xts" ]; - devices = [ - { - name = "luks1"; - device = "/dev/disk/by-id/ata-TOSHIBA-TR150_467B50JXK8WU-part2"; - } - ]; - }; - - environment = { - profileRelativeEnvVars.PATH = mkForce [ "/bin" ]; - shellAliases = mkForce { - gp = "${pkgs.pari}/bin/gp -q"; - df = "df -h"; - du = "du -h"; - ls = "ls -h --color=auto --group-directories-first"; - dmesg = "dmesg -L --reltime"; - view = "vim -R"; - - reload = "systemctl reload"; - restart = "systemctl restart"; - start = "systemctl start"; - status = "systemctl status"; - stop = "systemctl stop"; - }; - systemPackages = with pkgs; [ - dic - htop - p7zip - q - - pavucontrol - rxvt_unicode.terminfo - - # stockholm - git - gnumake - populate - ]; - variables = { - NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src"; - }; - }; - - fileSystems = { - "/boot" = { - device = "/dev/disk/by-id/ata-TOSHIBA-TR150_467B50JXK8WU-part1"; - }; - "/" = { - device = "/dev/mapper/vg1-root"; - fsType = "btrfs"; - options = ["defaults" "noatime" "ssd" "compress=lzo"]; - }; - "/home" = { - device = "/dev/mapper/vg1-home"; - fsType = "btrfs"; - options = ["defaults" "noatime" "ssd" "compress=lzo"]; - }; - "/tmp" = { - device = "tmpfs"; - fsType = "tmpfs"; - options = ["nosuid" "nodev" "noatime"]; - }; - }; - - hardware.pulseaudio = { - enable = true; - systemWide = true; - }; - - networking.hostName = config.krebs.build.host.name; - - nix = { - binaryCaches = ["https://cache.nixos.org"]; - # TODO check if both are required: - chrootDirs = [ "/etc/protocols" pkgs.iana_etc.outPath ]; - requireSignedBinaryCaches = true; - useChroot = true; - }; - - nixpkgs.config.allowUnfree = false; - - users = { - defaultUserShell = "/run/current-system/sw/bin/bash"; - mutableUsers = false; - users = { - mv = { - inherit (config.krebs.users.mv) home uid; - isNormalUser = true; - }; - }; - }; - - security.sudo.extraConfig = '' - Defaults env_keep+="SSH_CLIENT" - Defaults mailto="${config.krebs.users.mv.mail}" - Defaults !lecture - ''; - - services.cron.enable = false; - services.journald.extraConfig = '' - SystemMaxUse=1G - RuntimeMaxUse=128M - ''; - services.nscd.enable = false; - services.ntp.enable = false; - services.timesyncd.enable = true; - - time.timeZone = "Europe/Berlin"; - - tv.iptables = { - enable = true; - accept-echo-request = "internet"; - }; - - system.stateVersion = "16.03"; -} diff --git a/mv/1systems/stro/config.nix b/mv/1systems/stro/config.nix new file mode 100644 index 000000000..669655eec --- /dev/null +++ b/mv/1systems/stro/config.nix @@ -0,0 +1,156 @@ +{ config, lib, pkgs, ... }: + +with import ; + +{ + krebs = { + enable = true; + build = { + user = config.krebs.users.mv; + host = config.krebs.hosts.stro; + }; + }; + + imports = [ + + + + + + + + + + + + + + + + + ]; + + boot.kernel.sysctl = { + # Enable IPv6 Privacy Extensions + "net.ipv6.conf.all.use_tempaddr" = 2; + "net.ipv6.conf.default.use_tempaddr" = 2; + }; + + boot.initrd.luks = { + cryptoModules = [ "aes" "sha512" "xts" ]; + devices = [ + { + name = "luks1"; + device = "/dev/disk/by-id/ata-TOSHIBA-TR150_467B50JXK8WU-part2"; + } + ]; + }; + + environment = { + profileRelativeEnvVars.PATH = mkForce [ "/bin" ]; + shellAliases = mkForce { + gp = "${pkgs.pari}/bin/gp -q"; + df = "df -h"; + du = "du -h"; + ls = "ls -h --color=auto --group-directories-first"; + dmesg = "dmesg -L --reltime"; + view = "vim -R"; + + reload = "systemctl reload"; + restart = "systemctl restart"; + start = "systemctl start"; + status = "systemctl status"; + stop = "systemctl stop"; + }; + systemPackages = with pkgs; [ + dic + htop + p7zip + q + + pavucontrol + rxvt_unicode.terminfo + + # stockholm + git + gnumake + populate + ]; + variables = { + NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src"; + }; + }; + + fileSystems = { + "/boot" = { + device = "/dev/disk/by-id/ata-TOSHIBA-TR150_467B50JXK8WU-part1"; + }; + "/" = { + device = "/dev/mapper/vg1-root"; + fsType = "btrfs"; + options = ["defaults" "noatime" "ssd" "compress=lzo"]; + }; + "/home" = { + device = "/dev/mapper/vg1-home"; + fsType = "btrfs"; + options = ["defaults" "noatime" "ssd" "compress=lzo"]; + }; + "/tmp" = { + device = "tmpfs"; + fsType = "tmpfs"; + options = ["nosuid" "nodev" "noatime"]; + }; + }; + + hardware.pulseaudio = { + enable = true; + systemWide = true; + }; + + networking.hostName = config.krebs.build.host.name; + + nix = { + binaryCaches = ["https://cache.nixos.org"]; + requireSignedBinaryCaches = true; + # TODO check if both are required: + sandboxPaths = [ "/etc/protocols" pkgs.iana_etc.outPath ]; + useSandbox = true; + }; + + nixpkgs.config.packageOverrides = import pkgs; + + users = { + defaultUserShell = "/run/current-system/sw/bin/bash"; + mutableUsers = false; + users = { + mv = { + inherit (config.krebs.users.mv) home uid; + isNormalUser = true; + }; + }; + }; + + security.sudo.extraConfig = '' + Defaults env_keep+="SSH_CLIENT" + Defaults mailto="${config.krebs.users.mv.mail}" + Defaults !lecture + ''; + + services.cron.enable = false; + services.journald.extraConfig = '' + SystemMaxUse=1G + RuntimeMaxUse=128M + ''; + services.nscd.enable = false; + services.ntp.enable = false; + services.timesyncd.enable = true; + + time.timeZone = "Europe/Berlin"; + + tv.iptables = { + enable = true; + accept-echo-request = "internet"; + }; + + system.stateVersion = "16.03"; +} diff --git a/mv/1systems/stro/source.nix b/mv/1systems/stro/source.nix new file mode 100644 index 000000000..888d616c8 --- /dev/null +++ b/mv/1systems/stro/source.nix @@ -0,0 +1,3 @@ +import { + name = "stro"; +} diff --git a/mv/source.nix b/mv/source.nix new file mode 100644 index 000000000..8b1563914 --- /dev/null +++ b/mv/source.nix @@ -0,0 +1,23 @@ +with import ; +host@{ name, override ? {} }: let + builder = if getEnv "dummy_secrets" == "true" + then "buildbot" + else "mv"; + _file = + "/mv/1systems/${name}/source.nix"; +in + evalSource (toString _file) [ + { + nixos-config.symlink = "stockholm/mv/1systems/${name}/config.nix"; + nixpkgs.git = { + # nixos-17.03 + ref = mkDefault "94941cb0455bfc50b1bf63186cfad7136d629f78"; + url = https://github.com/NixOS/nixpkgs; + }; + secrets.file = getAttr builder { + buildbot = toString ; + mv = "/home/mv/secrets/${name}"; + }; + stockholm.file = toString ; + } + override + ] -- cgit v1.2.3