From 9b38d314ca303db15a24c273b6c40c24bd0285b5 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 6 Jul 2019 22:34:28 +0200 Subject: nixpkgs: d77e3bd -> 754763f --- krebs/nixpkgs.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json index 4118a1dd6..7363507ad 100644 --- a/krebs/nixpkgs.json +++ b/krebs/nixpkgs.json @@ -1,7 +1,7 @@ { "url": "https://github.com/NixOS/nixpkgs-channels", - "rev": "d77e3bd661354ea775a8cacc97bb59ddde513c09", - "date": "2019-06-18T23:08:17+02:00", - "sha256": "1m82zs00n6nc0pkdpmd9amm013qxwksjfhzcm6gck3p469q7n866", + "rev": "754763ff4ba1dd03fe3fad3a0fea36d2e39f5860", + "date": "2019-07-05T14:34:03+02:00", + "sha256": "10752kda1rzljlpcchi826hmbc8853vnbg9rkh7s89mxq6yjnm15", "fetchSubmodules": false } -- cgit v1.3.1 From 03aea512d8be3b38be78ab99c6f0dd9400e71d97 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 9 Jul 2019 19:44:08 +0200 Subject: external: add rose,martha,donna (Mic92) --- krebs/3modules/external/default.nix | 84 +++++++++++++++++++++++++++++++++++++ 1 file changed, 84 insertions(+) diff --git a/krebs/3modules/external/default.nix b/krebs/3modules/external/default.nix index 1720811d9..5b602fc7d 100644 --- a/krebs/3modules/external/default.nix +++ b/krebs/3modules/external/default.nix @@ -229,6 +229,90 @@ in { }; }; }; + rose = { + owner = config.krebs.users.Mic92; + nets = rec { + retiolum = { + addrs = [ + config.krebs.hosts.rose.nets.retiolum.ip4.addr + config.krebs.hosts.rose.nets.retiolum.ip6.addr + ]; + ip4.addr = "10.243.29.178"; + aliases = [ "rose.r" ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIICCgKCAgEA0h88uEcgVFhggGh3xqHySt8T+oDdoSN8ve4ZPmMzrGCD4dnlWcUO + 6uMiwE7XG667wvjB0J2RbCJ8n8/r6eQgp6sRfPzSQL/Mc74J+py+sOVOjjjL5wJX + btrYmASO3GKUSMhGmM0IiwHMIPrmUViaREDrweF3bUwK45d/ocqpBkc+nF27kksd + DMYjHMWRIkKuQaj592zo/kY1pAJ/yAvDPess0x1CLL6uDNbjTr2S/L7JHdzZs9Xq + 1+SGdVtqD0sWgSBKA0PC/Mi+Divd4PC1SoSL7wZRWD0Y2DNgj3+xUc7hAWRCw2Gs + 5wofK+qiwnyYAmeNYcyQfDLosKZF9hOM8U3UbxptkPLsOK3cfZoGoLQCuOryVDBe + 6GfJkJ49WfuSSNWs3WPWL6/6zmVPeGR0TvoMt02VQ3cKTmeIkWyTIzSVoC7wYv5D + Dl8Xt3aFr9UFI2GxenesViyuDLi8cy2fOsM3r+gowXQtgEKoXc9W2vyPwIIlcWUJ + QrKVsyNlkKKL0YjsnGazaEvqdiE30/Iq7f7VBnXnWXRLnZhr85HbTdDQnpT4GcEv + W3jpl1y5zShr5Hz90QoYcUTsxg9uk/+yqKpwUySZ6Gh4q0bo5k7nkM9i8mCMfNGZ + 0UU94QmwS9RoV4Mt4pSLYRcCs0mVeEjLuIfTFHkXc6LCjBWMn8ICfeMCAwEAAQ== + -----END RSA PUBLIC KEY----- + ''; + }; + }; + }; + martha = { + owner = config.krebs.users.Mic92; + nets = rec { + retiolum = { + addrs = [ + config.krebs.hosts.martha.nets.retiolum.ip4.addr + config.krebs.hosts.martha.nets.retiolum.ip6.addr + ]; + ip4.addr = "10.243.29.179"; + aliases = [ "martha.r" ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIICCgKCAgEA3lR3Wup2yd9SYs9n9a7lq/jXxlKdwjgp9gPEirLn3/XCFM7NpLIp + LRm3Wdplv0NWim4zI3AsdGmUBrV3y0Ugj48Td4RpXlOiFjS8NHnvRbamCZF7m/pJ + 3T/QpQx98+QEKXb3gZ5aDGgcHLRbUYUBuwFOxAKaikuDe2qJxqXqOmA7RXZDkEqe + FrQE/H1/+8HqJ1vhgZKi3Vu7zLRB1EV8nggWFjQKR8o0AeViLwM3OxFtGyKTaXuK + WAQrvSdKQDpQwqAPogyeftGesOfW7z0xrelkux10p42YM9epYvZDFRG97/nupw/S + iYGiTTFDBDTzpyT3zl1uwhmQ3re/nJXf5e4fgnZEcsweU8ysHtDhbimqrm9impVn + XdKnnuNa9F8VlyHCT2pVC9+WDKDNtA2M8f+8lG8/hoJ7hhp5HhBZ3ncROyQqOg4F + e6YtaFidi+fYXjQkdUXHv5FCkqFJnoxZdI2vwqU2DumltG/o+qsksI2WSsLsuMVs + sa4KUq0+5OsmCJnIAKWV2YwbLVf1tJMjPGA0jQECrHPL6SKobRefqav6MPuTbytC + 4frtEIGbfdKqQ6nNTvTpCrAo+WAm3NE3khTYqGe4LqX/JMoGtWXp/Ex9IdG+sflM + mESMjuHp9vPY4aZGPtYPP93Cxv3q7gm+EfIGebajISpaG28J+XjiNNsCAwEAAQ== + -----END RSA PUBLIC KEY----- + ''; + }; + }; + }; + donna = { + owner = config.krebs.users.Mic92; + nets = rec { + retiolum = { + addrs = [ + config.krebs.hosts.donna.nets.retiolum.ip4.addr + config.krebs.hosts.donna.nets.retiolum.ip6.addr + ]; + ip4.addr = "10.243.29.180"; + aliases = [ "donna.r" ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIICCgKCAgEAnv5zVPwjHk5Q72D3tv2rlQkp7SOsZD7Wvz8l1yI/mWkxoriJ9MVa + x8RziSB3KF8sF1lRWIKmuynkgLI3w0X/YFs/fAvtayxk6Qf8DOl23Vd8Is0h/i3I + 0fCmCEIHhHboKsREW6NxY7w5WAI2+SFNmGef1P7vzrAv7iLyPbo9nQ8wlrAmc+PJ + Ao3BOf4U7kP778fhsPA4dlGtF2v9CBhygeGVI/DQR8jcvzeiPd2Dr0k/JvrVMYtf + wJW4xUwZkIpws/yfI8b4VJOFl2X/Yw9712Z8Jvga0rR32OG4YbnggvuCMum1g94k + YwMjaSckv1XTalvPQuf1Od96XzwL2hjPFpEK3Tdl4AitMnArgj9HNzhcRL+eGonf + U24zk52OToHnoP3palNpodi7DziIBeXIaIMl7VMXku2ymbOUJsI6zeew+uZahJkv + QIWjxveQ8N40BoTc8Yg6pea1AId3l4f3brtwJbQOVbb3bVQ5VcrxM9Q/TBvyADYR + Knwszxw3uBw5Za1FMbwCPwd8/y/Ar19qGCx25xK0QnsyqZZT/cHsbBOTzh6BBWwI + IzbYu49VO/B1rktYzZ2l2ENQy6OILXWbvFjC8Pt8f1ZZQ4A21PyNA1AdyJ/rbVj7 + awm3OnnvKSvMCXWnwHPFHjksb3qMx96Aep1cw3ZBx0sQQ41UWBoOsi8CAwEAAQ== + -----END RSA PUBLIC KEY----- + ''; + }; + }; + }; inspector = { owner = config.krebs.users.Mic92; nets = rec { -- cgit v1.3.1 From 41a49361440522529f9a74e5fd37dc3a5c4f2bd0 Mon Sep 17 00:00:00 2001 From: Kierán Meinhardt Date: Tue, 9 Jul 2019 20:29:41 +0200 Subject: urlwatch: optionalise custom sendmail --- krebs/3modules/urlwatch.nix | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/krebs/3modules/urlwatch.nix b/krebs/3modules/urlwatch.nix index 0cec1a2d3..3213080de 100644 --- a/krebs/3modules/urlwatch.nix +++ b/krebs/3modules/urlwatch.nix @@ -17,6 +17,8 @@ let api = { enable = mkEnableOption "krebs.urlwatch"; + customSendmail.enable = mkEnableOption "krebs.urlwatch.customSendmail"; + dataDir = mkOption { type = types.str; default = "/var/lib/urlwatch"; @@ -158,19 +160,21 @@ let --urls=${shell.escape urlsFile} \ > changes || : - if test -s changes; then - { - echo Date: $(date -R) - echo From: ${shell.escape cfg.from} - echo Subject: $( - sed -n 's/^\(CHANGED\|ERROR\|NEW\): //p' changes \ - | tr '\n' ' ' - ) - echo To: ${shell.escape cfg.mailto} - echo - cat changes - } | /run/wrappers/bin/sendmail -t - fi + ${optionalString cfg.customSendmail.enable /* sh */ '' + if test -s changes; then + { + echo Date: $(date -R) + echo From: ${shell.escape cfg.from} + echo Subject: $( + sed -n 's/^\(CHANGED\|ERROR\|NEW\): //p' changes \ + | tr '\n' ' ' + ) + echo To: ${shell.escape cfg.mailto} + echo + cat changes + } | /run/wrappers/bin/sendmail -t + fi + ''} ''; }; }; -- cgit v1.3.1 From b9ab8446354378719dfa546108d4e96f7852d3d7 Mon Sep 17 00:00:00 2001 From: Kierán Meinhardt Date: Tue, 9 Jul 2019 20:30:05 +0200 Subject: urlwatch: add telegram reporting options --- krebs/3modules/urlwatch.nix | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/krebs/3modules/urlwatch.nix b/krebs/3modules/urlwatch.nix index 3213080de..3c9ff7709 100644 --- a/krebs/3modules/urlwatch.nix +++ b/krebs/3modules/urlwatch.nix @@ -56,6 +56,15 @@ let The format is described in systemd.time(7), CALENDAR EVENTS. ''; }; + telegram = { + enable = mkEnableOption "krebs.urlwatch.telegram" // { default = false; }; + botToken = mkOption { + type = types.str; + }; + chatId = mkOption { + type = types.listOf types.str; + }; + }; urls = mkOption { type = with types; listOf (either str subtypes.job); default = []; @@ -112,6 +121,11 @@ let color = true; enabled = true; }; + ${if cfg.telegram.enable then "telegram" else null} = { + enabled = cfg.telegram.enable; + bot_token = cfg.telegram.botToken; + chat_id = cfg.telegram.chatId; + }; text = { details = true; footer = true; -- cgit v1.3.1 From 13d8d9f7d340a64cd69957854c628dc4ca0876e6 Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 11 Jul 2019 16:09:14 +0200 Subject: Revert "l: rip xerxes" This reverts commit 4e04b2ac99885f2d953487b506d37c5519794754. --- krebs/3modules/lass/default.nix | 40 +++++++++++++++++++++++++++++++++++++++ lass/1systems/xerxes/config.nix | 16 ++++++++++++++++ lass/1systems/xerxes/physical.nix | 29 ++++++++++++++++++++++++++++ 3 files changed, 85 insertions(+) create mode 100644 lass/1systems/xerxes/config.nix create mode 100644 lass/1systems/xerxes/physical.nix diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index f4c8f5c6a..1821ea7e9 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -393,6 +393,46 @@ in { ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJzb9BPFClubs6wSOi/ivqPFVPlowXwAxBS0jHaB29hX"; syncthing.id = "PCDXICO-GMGWKSB-V6CYF3I-LQMZSGV-B7YBJXA-DVO7KXN-TFCSQXW-XY6WNQD"; }; + xerxes = { + cores = 2; + nets = rec { + retiolum = { + ip4.addr = "10.243.1.3"; + aliases = [ + "xerxes.r" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIIECgKCBAEArqEaK+m7WZe/9/Vbc+qx2TjkkRJ9lDgDMr1dvj98xb8/EveUME6U + MZyAqNjLuKq3CKzJLo02ZmdFs4CT1Hj28p5IC0wLUWn53hrqdy8cCJDvIiKIv+Jk + gItsxJyMnRtsdDbB6IFJ08D5ReGdAFJT5lqpN0DZuNC6UQRxzUK5fwKYVVzVX2+W + /EZzEPe5XbE69V/Op2XJ2G6byg9KjOzNJyJxyjwVco7OXn1OBNp94NXoFrUO7kxb + mTNnh3D+iB4c3qv8woLhmb+Uh/9MbXS14QrSf85ou4kfUjb5gdhjIlzz+jfA/6XO + X4t86uv8L5IzrhSGb0TmhrIh5HhUmSKT4RdHJom0LB7EASMR2ZY9AqIG11XmXuhj + +2b5INBZSj8Cotv5aoRXiPSaOd7bw7lklYe4ZxAU+avXot9K3/4XVLmi6Wa6Okim + hz+MEYjW5gXY+YSUWXOR4o24jTmDjQJpdL83eKwLVAtbrE7TcVszHX6zfMoQZ5M9 + 3EtOkDMxhC+WfkL+DLQAURhgcPTZoaj0cAlvpb0TELZESwTBI09jh/IBMXHBZwI4 + H1gOD5YENpf0yUbLjVu4p82Qly10y58XFnUmYay0EnEgdPOOVViovGEqTiAHMmm5 + JixtwJDz7a6Prb+owIg27/eE1/E6hpfXpU8U83qDYGkIJazLnufy32MTFE4T9fI4 + hS8icFcNlsobZp+1pB3YK4GV5BnvMwOIVXVlP8yMCRTDRWZ4oYmAZ5apD7OXyNwe + SUP2mCNNlQCqyjRsxj5S1lZQRy1sLQztU5Sff4xYNK+5aPgJACmvSi3uaJAxBloo + 4xCCYzxhaBlvwVISJXZTq76VSPybeQ+pmSZFMleNnWOstvevLFeOoH2Is0Ioi1Fe + vnu5r0D0VYsb746wyRooiEuOAjBmni8X/je6Vwr1gb/WZfZ23EwYpGyakJdxLNv3 + Li+LD9vUfOR80WL608sUU45tAx1RAy6QcH/YDtdClbOdK53+cQVTsYnCvDW8uGlO + scQWgk+od3qvo6yCPO7pRlEd3nedcPSGh/KjBHao6eP+bsVERp733Vb9qrEVwmxv + jlZ1m12V63wHVu9uMAGi9MhK+2Q/l7uLTj03OYpi4NYKL2Bu01VXfoxuauuZLdIJ + Z3ZV+qUcjzZI0PBlGxubq6CqVFoSB7nhHUbcdPQ66WUnwoKq0cKmE7VOlJQvJ07u + /Wsl8BIsxODVt0rTzEAx0hTd5mJCX7sCawRt+NF+1DZizl9ouebNMkNlsEAg4Ps0 + bQerZLcOmpYjGa5+lWDwJIMXVIcxwTmQR86stlP/KQm0vdOvH2ZUWTXcYvCYlHkQ + sgVnnA2wt+7UpZnEBHy04ry+jYaSsPdYgwIDAQAB + -----END RSA PUBLIC KEY----- + ''; + }; + }; + secure = true; + ssh.privkey.path = ; + ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE5HyLyaIvVH0qHIQ4ciKhDiElhSqsK+uXcA6lTvL+5n"; + }; red = { monitoring = false; cores = 1; diff --git a/lass/1systems/xerxes/config.nix b/lass/1systems/xerxes/config.nix new file mode 100644 index 000000000..1bd6cf2c5 --- /dev/null +++ b/lass/1systems/xerxes/config.nix @@ -0,0 +1,16 @@ +{ config, pkgs, ... }: + +{ + imports = [ + + + + + + + + + ]; + + krebs.build.host = config.krebs.hosts.xerxes; +} diff --git a/lass/1systems/xerxes/physical.nix b/lass/1systems/xerxes/physical.nix new file mode 100644 index 000000000..17caccfe6 --- /dev/null +++ b/lass/1systems/xerxes/physical.nix @@ -0,0 +1,29 @@ +{ + imports = [ + ./config.nix + + + ]; + services.udev.extraRules = '' + SUBSYSTEM=="net", ATTR{address}=="b0:f1:ec:9f:5c:78", NAME="wl0" + ''; + + fileSystems."/" = { + device = "/dev/disk/by-uuid/d227d88f-bd24-4e8a-aa14-9e966b471437"; + fsType = "btrfs"; + }; + + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/16C8-D053"; + fsType = "vfat"; + }; + + fileSystems."/home" = { + device = "/dev/disk/by-uuid/1ec4193b-7f41-490d-8782-7677d437b358"; + fsType = "btrfs"; + }; + + boot.initrd.luks.devices = [ { name = "luksroot"; device = "/dev/disk/by-uuid/d17f19a3-dcba-456d-b5da-e45cc15dc9c8"; } ]; + + networking.wireless.enable = true; +} -- cgit v1.3.1 From 6451e650ec81e671c5c283005fd6eae7e0b5d271 Mon Sep 17 00:00:00 2001 From: mb Date: Sat, 8 Jun 2019 11:35:38 +0200 Subject: mb suns1n3.r: add configs; update users --- mb/1systems/sunsh1n3/configuration.nix | 180 ++++++++++++++++++++++++ mb/1systems/sunsh1n3/hardware-configuration.nix | 29 ++++ mb/2configs/default.nix | 23 +++ 3 files changed, 232 insertions(+) create mode 100644 mb/1systems/sunsh1n3/configuration.nix create mode 100644 mb/1systems/sunsh1n3/hardware-configuration.nix diff --git a/mb/1systems/sunsh1n3/configuration.nix b/mb/1systems/sunsh1n3/configuration.nix new file mode 100644 index 000000000..d0a609f1f --- /dev/null +++ b/mb/1systems/sunsh1n3/configuration.nix @@ -0,0 +1,180 @@ + +{ config, pkgs, ... }: let + unstable = import { config = { allowUnfree = true; }; }; +in { + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + + ]; + + krebs.build.host = config.krebs.hosts.sunsh1n3; + + boot.kernelPackages = pkgs.linuxPackages_latest; + + # Use the systemd-boot EFI boot loader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + fileSystems."/".options = [ "noatime" "nodiratime" "discard" ]; + + boot.initrd.luks.devices = [ + { + name = "root"; + device = "/dev/disk/by-uuid/5354ba31-c7de-4b55-8f86-a2a437dfbb21"; + preLVM = true; + allowDiscards = true; + } + ]; + + i18n = { + consoleFont = "Lat2-Terminus16"; + consoleKeyMap = "de"; + defaultLocale = "en_US.UTF-8"; + }; + + time.timeZone = "Europe/Berlin"; + + nixpkgs.config.packageOverrides = super : { + openvpn = super.openvpn.override { pkcs11Support = true; useSystemd = true ; }; + }; + + nixpkgs.config.allowUnfree = true; + + fonts = { + enableCoreFonts = true; + enableGhostscriptFonts = true; + fonts = with pkgs; [ + anonymousPro + corefonts + dejavu_fonts + envypn-font + fira + gentium + gohufont + inconsolata + liberation_ttf + powerline-fonts + source-code-pro + terminus_font + ttf_bitstream_vera + ubuntu_font_family + unifont + unstable.cherry + xorg.fontbitstream100dpi + xorg.fontbitstream75dpi + xorg.fontbitstreamtype1 + ]; + }; + + environment.systemPackages = with pkgs; [ + wget vim git curl fish + ag + chromium + firefox + gimp + p7zip + htop + mpv + mpvc + nmap + ntfs3g + keepassx2 + sshfs + #unstable.skrooge + skrooge + unstable.alacritty + tmux + tree + wcalc + virtmanager + virt-viewer + (wine.override { wineBuild = "wineWow"; }) + xz + ]; + + virtualisation.libvirtd.enable = true; + virtualisation.kvmgt.enable = true; + + # Some programs need SUID wrappers, can be configured further or are + # started in user sessions. + # programs.mtr.enable = true; + + programs.gnupg.agent = { enable = true; enableSSHSupport = true; }; + programs.dconf.enable = true; + + # Enable the OpenSSH daemon. + services.openssh.enable = true; + services.openssh.passwordAuthentication = false; + + krebs.iptables.enable = true; + #networking.wireless.enable = true; + networking.networkmanager.enable = true; + networking.enableIPv6 = false; + + # Enable sound. + sound.enable = true; + hardware.pulseaudio.enable = true; + hardware.pulseaudio.support32Bit = true; + nixpkgs.config.pulseaudio = true; + + services.xserver.enable = true; + services.xserver.layout = "de"; + services.xserver.xkbOptions = "nodeadkeys"; + services.xserver.libinput.enable = true; + + # Enable the KDE Desktop Environment. + services.xserver.displayManager.sddm.enable = true; + services.xserver.desktopManager.plasma5.enable = true; + + programs.fish = { + enable = true; + shellInit = '' + function ssh_agent --description 'launch the ssh-agent and add the id_rsa identity' + if begin + set -q SSH_AGENT_PID + and kill -0 $SSH_AGENT_PID + and grep -q '^ssh-agent' /proc/$SSH_AGENT_PID/cmdline + end + echo "ssh-agent running on pid $SSH_AGENT_PID" + else + eval (command ssh-agent -c | sed 's/^setenv/set -Ux/') + end + set -l identity $HOME/.ssh/id_rsa + set -l fingerprint (ssh-keygen -lf $identity | awk '{print $2}') + ssh-add -l | grep -q $fingerprint + or ssh-add $identity + end + ''; + promptInit = '' + function fish_prompt --description 'Write out the prompt' + set -l color_cwd + set -l suffix + set -l nix_shell_info ( + if test "$IN_NIX_SHELL" != "" + echo -n " " + end + ) + switch "$USER" + case root toor + if set -q fish_color_cwd_root + set color_cwd $fish_color_cwd_root + else + set color_cwd $fish_color_cwd + end + set suffix '#' + case '*' + set color_cwd $fish_color_cwd + set suffix '>' + end + + echo -n -s "$USER" @ (set_color yellow) (prompt_hostname) (set_color normal) "$nix_shell_info" ' ' (set_color $color_cwd) (prompt_pwd) (set_color normal) "$suffix " + end + ''; + }; + + nix.buildCores = 4; + + system.stateVersion = "19.09"; + +} diff --git a/mb/1systems/sunsh1n3/hardware-configuration.nix b/mb/1systems/sunsh1n3/hardware-configuration.nix new file mode 100644 index 000000000..2beee7c4f --- /dev/null +++ b/mb/1systems/sunsh1n3/hardware-configuration.nix @@ -0,0 +1,29 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, ... }: + +{ + imports = + [ + ]; + + boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "usb_storage" "sd_mod" "sdhci_pci" "rtsx_usb_sdmmc" ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/a3257922-d2d4-45ae-87cc-cc38d32e0774"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/60A6-4DAB"; + fsType = "vfat"; + }; + + swapDevices = [ ]; + + nix.maxJobs = lib.mkDefault 4; + powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; +} diff --git a/mb/2configs/default.nix b/mb/2configs/default.nix index ab11495c8..3066d1c36 100644 --- a/mb/2configs/default.nix +++ b/mb/2configs/default.nix @@ -21,6 +21,29 @@ with import ; "video" "fuse" "wheel" + "kvm" + "qemu-libvirtd" + "libvirtd" + ]; + openssh.authorizedKeys.keys = [ + config.krebs.users.mb.pubkey + ]; + }; + xo = { + name = "xo"; + uid = 2323; + home = "/home/xo"; + group = "users"; + createHome = true; + shell = "/run/current-system/sw/bin/fish"; + extraGroups = [ + "audio" + "video" + "fuse" + "wheel" + "kvm" + "qemu-libvirtd" + "libvirtd" ]; openssh.authorizedKeys.keys = [ config.krebs.users.mb.pubkey -- cgit v1.3.1 From 7351d5cff1f834990ee3dd698f36a1277e7d7cad Mon Sep 17 00:00:00 2001 From: magenbluten Date: Wed, 19 Jun 2019 20:06:35 +0200 Subject: mb: update host configs --- mb/1systems/gr33n/configuration.nix | 1 + mb/1systems/orange/configuration.nix | 1 + mb/1systems/p1nk/configuration.nix | 1 + mb/1systems/sunsh1n3/configuration.nix | 1 + 4 files changed, 4 insertions(+) diff --git a/mb/1systems/gr33n/configuration.nix b/mb/1systems/gr33n/configuration.nix index 4342ba0e2..e20503aec 100644 --- a/mb/1systems/gr33n/configuration.nix +++ b/mb/1systems/gr33n/configuration.nix @@ -62,6 +62,7 @@ in { wcalc wget xz + zbackup ]; programs.gnupg.agent = { enable = true; enableSSHSupport = true; }; diff --git a/mb/1systems/orange/configuration.nix b/mb/1systems/orange/configuration.nix index 3e90f89a2..a6e5d0dce 100644 --- a/mb/1systems/orange/configuration.nix +++ b/mb/1systems/orange/configuration.nix @@ -131,6 +131,7 @@ in { wcalc wget xz + zbackup ]; environment.shellAliases = { diff --git a/mb/1systems/p1nk/configuration.nix b/mb/1systems/p1nk/configuration.nix index 905630e78..dff4efaa2 100644 --- a/mb/1systems/p1nk/configuration.nix +++ b/mb/1systems/p1nk/configuration.nix @@ -125,6 +125,7 @@ in { wcalc wget xz + zbackup ]; environment.shellAliases = { diff --git a/mb/1systems/sunsh1n3/configuration.nix b/mb/1systems/sunsh1n3/configuration.nix index d0a609f1f..633d122ea 100644 --- a/mb/1systems/sunsh1n3/configuration.nix +++ b/mb/1systems/sunsh1n3/configuration.nix @@ -91,6 +91,7 @@ in { virt-viewer (wine.override { wineBuild = "wineWow"; }) xz + zbackup ]; virtualisation.libvirtd.enable = true; -- cgit v1.3.1 From cc470ff1580cdca5aa279c2f745c1bb07d20e24c Mon Sep 17 00:00:00 2001 From: magenbluten Date: Sat, 22 Jun 2019 09:01:31 +0200 Subject: mb: add neovim config --- mb/1systems/orange/configuration.nix | 2 +- mb/1systems/p1nk/configuration.nix | 2 +- mb/2configs/neovimrc | 446 +++++++++++++++++++++++++++++++++++ mb/2configs/nvim.nix | 70 ++++++ 4 files changed, 518 insertions(+), 2 deletions(-) create mode 100644 mb/2configs/neovimrc create mode 100644 mb/2configs/nvim.nix diff --git a/mb/1systems/orange/configuration.nix b/mb/1systems/orange/configuration.nix index a6e5d0dce..cabbc6fc1 100644 --- a/mb/1systems/orange/configuration.nix +++ b/mb/1systems/orange/configuration.nix @@ -5,6 +5,7 @@ in { [ # Include the results of the hardware scan. ./hardware-configuration.nix + ]; krebs.build.host = config.krebs.hosts.orange; @@ -124,7 +125,6 @@ in { unstable.ponyc unstable.sublime3 unstable.youtube-dl - vim virt-viewer virtmanager vulnix diff --git a/mb/1systems/p1nk/configuration.nix b/mb/1systems/p1nk/configuration.nix index dff4efaa2..ba11c85f4 100644 --- a/mb/1systems/p1nk/configuration.nix +++ b/mb/1systems/p1nk/configuration.nix @@ -5,6 +5,7 @@ in { [ # Include the results of the hardware scan. ./hardware-configuration.nix + ]; krebs.build.host = config.krebs.hosts.p1nk; @@ -118,7 +119,6 @@ in { unstable.ponyc unstable.sublime3 youtube-dl - vim virt-viewer virtmanager vulnix diff --git a/mb/2configs/neovimrc b/mb/2configs/neovimrc new file mode 100644 index 000000000..8dbeaec7b --- /dev/null +++ b/mb/2configs/neovimrc @@ -0,0 +1,446 @@ + +"***************************************************************************** +"" Functions +"***************************************************************************** + +function! GetBufferList() + redir =>buflist + silent! ls! + redir END + return buflist +endfunction + +function! ToggleList(bufname, pfx) + let buflist = GetBufferList() + for bufnum in map(filter(split(buflist, '\n'), 'v:val =~ "'.a:bufname.'"'), 'str2nr(matchstr(v:val, "\\d\\+"))') + if bufwinnr(bufnum) != -1 + exec(a:pfx.'close') + return + endif + endfor + if a:pfx == 'l' && len(getloclist(0)) == 0 + echohl ErrorMsg + echo "Location List is Empty." + return + endif + let winnr = winnr() + exec(a:pfx.'open') + if winnr() != winnr + wincmd p + endif +endfunction + + +"***************************************************************************** +"" Basic Setup +"*****************************************************************************" +" General +let no_buffers_menu=1 +syntax on +set ruler +set number +set mousemodel=popup +set t_Co=256 +set guioptions=egmrti +set gfn=Monospace\ 10 + +" TODO: Testing if this works against automatically setting paste mode +" Issue: https://github.com/neovim/neovim/issues/7994 +au InsertLeave * set nopaste + + +" undofile - This allows you to use undos after exiting and restarting +" This, like swap and backups, uses .vim-undo first, then ~/.vim/undo +" :help undo-persistence +if exists("+undofile") + if isdirectory($HOME . '/.vim/undo') == 0 + :silent !mkdir -p ~/.vim/undo > /dev/null 2>&1 + endif + set undodir=./.vim-undo// + set undodir+=~/.vim/undo// + set undofile +endif + +" Encoding +set encoding=utf-8 +set fileencoding=utf-8 +set fileencodings=utf-8 +set bomb +set binary + +" Fix backspace indent +set backspace=indent,eol,start + +" Tabs. May be overriten by autocmd rules +set tabstop=4 +set softtabstop=0 +set shiftwidth=4 +set expandtab + +" Map leader to , +let mapleader=',' + +" Enable hidden buffers +set hidden + +" Searching +set hlsearch +set incsearch +set ignorecase +set smartcase + +" Directories for swp files +set nobackup +set noswapfile + +set fileformats=unix,dos,mac + +" File overview +set wildmode=list:longest,list:full +set wildignore+=*.o,*.obj,.git,*.rbc,*.pyc,__pycache__ + +" Shell to emulate +if exists('$SHELL') + set shell=$SHELL +else + set shell=/bin/bash +endif + +" Set color scheme +colorscheme molokai + +"Show always Status bar +set laststatus=2 + +" Use modeline overrides +set modeline +set modelines=10 + +" Set terminal title +set title +set titleold="Terminal" +set titlestring=%F + +" search will center on the line it's found in. +nnoremap n nzzzv +nnoremap N Nzzzv + + + +"***************************************************************************** +"" Abbreviations +"***************************************************************************** +" no one is really happy until you have this shortcuts +cnoreabbrev W! w! +cnoreabbrev Q! q! +cnoreabbrev Qall! qall! +cnoreabbrev Wq wq +cnoreabbrev Wa wa +cnoreabbrev wQ wq +cnoreabbrev WQ wq +cnoreabbrev W w +cnoreabbrev Q q +cnoreabbrev Qall qall + +" NERDTree configuration +let g:NERDTreeChDirMode=2 +let g:NERDTreeIgnore=['\.rbc$', '\~$', '\.pyc$', '\.db$', '\.sqlite$', '__pycache__'] +let g:NERDTreeSortOrder=['^__\.py$', '\/$', '*', '\.swp$', '\.bak$', '\~$'] +let g:NERDTreeShowBookmarks=1 +let g:nerdtree_tabs_focus_on_files=1 +let g:NERDTreeMapOpenInTabSilent = '' +let g:NERDTreeWinSize = 50 +set wildignore+=*/tmp/*,*.so,*.swp,*.zip,*.pyc,*.db,*.sqlite +nnoremap :NERDTreeFind +nnoremap :NERDTreeToggle + +" open terminal emulation +nnoremap sh :terminal:startinsert + +"***************************************************************************** +"" Autocmd Rules +"***************************************************************************** +"" The PC is fast enough, do syntax highlight syncing from start unless 200 lines +augroup vimrc-sync-fromstart + autocmd! + autocmd BufEnter * :syntax sync maxlines=200 +augroup END + +" Nasm filetype +augroup nasm + autocmd! + autocmd BufRead,BufNewFile *.nasm set ft=nasm +augroup END + +" Binary filetype +augroup Binary + au! + au BufReadPre *.bin,*.exe,*.elf let &bin=1 + au BufReadPost *.bin,*.exe,*.elf if &bin | %!xxd + au BufReadPost *.bin,*.exe,*.elf set ft=xxd | endif + au BufWritePre *.bin,*.exe,*.elf if &bin | %!xxd -r + au BufWritePre *.bin,*.exe,*.elf endif + au BufWritePost *.bin,*.exe,*.elf if &bin | %!xxd + au BufWritePost *.bin,*.exe,*.elf set nomod | endif +augroup END + +" Binary filetype +augroup fasm + au! + au BufReadPost *.fasm set ft=fasm +augroup END + +augroup deoplete-update + autocmd! + autocmd VimEnter * UpdateRemotePlugin +augroup END + +"" Remember cursor position +augroup vimrc-remember-cursor-position + autocmd! + autocmd BufReadPost * if line("'\"") > 1 && line("'\"") <= line("$") | exe "normal! g`\"" | endif +augroup END + +"" txt +" augroup vimrc-wrapping +" autocmd! +" autocmd BufRead,BufNewFile *.txt call s:setupWrapping() +" augroup END + +"" make/cmake +augroup vimrc-make-cmake + autocmd! + autocmd FileType make setlocal noexpandtab + autocmd BufNewFile,BufRead CMakeLists.txt setlocal filetype=cmake +augroup END + +set autoread + +"***************************************************************************** +"" Mappings +"***************************************************************************** + +" Split +noremap h :split +noremap v :vsplit + +" Git +noremap ga :Gwrite +noremap gc :Gcommit +noremap gsh :Gpush +noremap gll :Gpull +noremap gs :Gstatus +noremap gb :Gblame +noremap gd :Gvdiff +noremap gr :Gremove + +" Tabs +nnoremap gt +nnoremap gT +nnoremap :tabnew + +" Set working directory +nnoremap . :lcd %:p:h + +" Opens an edit command with the path of the currently edited file filled in +noremap e :e =expand("%:p:h") . "/" + +" Opens a tab edit command with the path of the currently edited file filled +noremap te :tabe =expand("%:p:h") . "/" + +" Tagbar +nmap :TagbarToggle +let g:tagbar_autofocus = 1 + +" Copy/Paste/Cut +set clipboard^=unnamed,unnamedplus + +noremap YY "+y +noremap p "+gP +noremap XX "+x + +" Enable mouse for vim +set mouse=a + +" Buffer nav +noremap z :bp +noremap q :bp +noremap x :bn +noremap w :bn + +" Close buffer +noremap c :bd + +" Clean search (highlight) +nnoremap :noh + +" Switching windows +noremap j +noremap k +noremap l +noremap h + +" Vmap for maintain Visual Mode after shifting > and < +vmap < >gv + +" Move visual block +vnoremap J :m '>+1gv=gv +vnoremap K :m '<-2gv=gv + +" Open current line on GitHub +nnoremap o :.Gbrowse + + +" Save on strg+s if not in paste mode +nmap :w +vmap gv +imap + +" Quit on strg+q in normal mode +nnoremap :q + +" Strg+d to replace word under cursor +nnoremap :%s/\<\>//g + +" Strg+f ro find word under cursor +nnoremap :/ + +" Remove unneccessary spaces +nnoremap :let _s=@/ :%s/\s\+$//e :let @/=_s :nohl :unlet _s + +" Reindent whole file with F6 +map mzgg=G`z + +" Toggle location list +nmap :call ToggleList("Quickfix List", 'c') + +" Replacing text in visual mode doesn't copy it anymore +xmap p ReplaceWithRegisterVisual +xmap ReplaceWithRegisterVisual + +" ALE mappings +nmap i (ale_hover) +nmap d (ale_go_to_definition_in_tab) +nmap rf (ale_find_references) +nmap (ale_fix) + +" Vim-Go mappings +au FileType go nmap i :GoDoc +au FileType go nmap d :GoDef +au FileType go nmap rf :GoReferrers + + +"" Opens an edit command with the path of the currently edited file filled in +noremap e :e =expand("%:p:h") . "/" + +" Use tab for navigatin in autocompletion window +inoremap pumvisible() ? "\" : "\" +inoremap pumvisible() ? "\" : "\" + + +"***************************************************************************** +"" Plugin settings +"***************************************************************************** + +" vim-airline +set statusline+=%{fugitive#statusline()} +let g:airline_theme = 'powerlineish' +let g:airline#extensions#syntastic#enabled = 1 +let g:airline#extensions#branch#enabled = 1 +let g:airline#extensions#tabline#enabled = 1 +let g:airline#extensions#tagbar#enabled = 1 +let g:airline_skip_empty_sections = 1 +let g:airline#extensions#ale#enabled = 1 + +" show indent lines +let g:indent_guides_enable_on_vim_startup = 1 +let g:indent_guides_auto_colors = 0 +hi IndentGuidesOdd ctermbg=235 +hi IndentGuidesEven ctermbg=235 +let g:indent_guides_guide_size = 1 +let g:indent_guides_start_level = 2 + +" Enable autocompletion +let g:deoplete#enable_at_startup = 1 +set completeopt-=preview + +" Ale no preview on hover +let g:ale_close_preview_on_insert = 0 +let g:ale_cursor_detail = 0 + +" Ale skip if file size over 2G +let g:ale_maximum_file_size = "2147483648" + +" Ale to loclist and quickfix +let g:ale_set_quickfix = 1 +" let g:ale_set_loclist = 1 + + +" Ale language server +let g:ale_linters = { + \ 'python': ['pyls'], + \ 'c': ['cquery'], + \ 'cpp': ['cquery'], + \ 'xml': ['xmllint'] + \ } + + +" ALE fixers +let g:ale_fixers = { '*': ['remove_trailing_lines', 'trim_whitespace'] } +let g:ale_fixers.python = ['black'] +let g:ale_fixers.go = ['gofmt'] +let g:ale_fixers.c = ['clang-format'] +let g:ale_fixers.cpp = ['clang-format'] +let g:ale_fixers.json = ['jq'] +let g:ale_fixers.xml = ['xmllint'] + +let g:ale_completion_enabled = 1 +let g:ale_sign_error = '⤫' +let g:ale_sign_warning = '⚠' +let g:ale_lint_on_insert_leave = 1 + +" Vim-Go Settings +let g:go_auto_sameids = 1 +let g:go_fmt_command = "goimports" +let g:go_auto_type_info = 1 + +" Disable syntastic for langserver supported languages +let g:syntastic_mode_map = { + \ "mode": "active", + \ "passive_filetypes": ["go", "python", "c", "cpp", "xml" ] + \ } +let g:syntastic_always_populate_loc_list = 1 +let g:syntastic_auto_loc_list = 2 +let g:syntastic_aggregate_errors = 1 +let g:syntastic_check_on_open = 1 +let g:syntastic_check_on_wq = 0 +let g:syntastic_error_symbol='✗' +let g:syntastic_warning_symbol='⚠' +let g:syntastic_style_error_symbol = '✗' +let g:syntastic_style_warning_symbol = '⚠' + +"***************************************************************************** +"" Shortcuts overview +"***************************************************************************** +" Shortcuts overview +" F1 --> Filetree find +" F2 --> Filetree toggle +" F3 --> Function overview +" F4 --> Toggle error bar + +" F5 --> Remove trailing whitespaces +" F6 --> Reindent whole file +" F7 --> Format and lint file +" ,i --> Information about function +" ,d --> Jump to definition +" ,r --> Rename in all occurences +" ,rf --> Find references of function/variable +" ,e --> Change current file +" ,te --> Open file in new tab +" strg+f --> Find current selected word +" strg+d --> Replace current selected word +" strg+s --> Save file +" strg+q --> Close current file +" space+, --> Stop highlighting words after search + diff --git a/mb/2configs/nvim.nix b/mb/2configs/nvim.nix new file mode 100644 index 000000000..a8e4173e2 --- /dev/null +++ b/mb/2configs/nvim.nix @@ -0,0 +1,70 @@ +{ pkgs, config, ... }: let + #unstable = import { }; +in + +{ + environment.variables = { + EDITOR = ["nvim"]; + }; + + nixpkgs.config.packageOverrides = pkgs: with pkgs;{ + neovim_custom = neovim.override { + configure = { + customRC = builtins.readFile ./neovimrc; + + packages.myVimPackage = with pkgs.vimPlugins; + { + # loaded on launch + start = [ + nerdtree # file manager + commentary # comment stuff out based on language + fugitive # full git integration + vim-airline-themes # lean & mean status/tabline + vim-airline # status bar + gitgutter # git diff in the gutter (sign column) + vim-trailing-whitespace # trailing whitspaces in red + tagbar # F3 function overview + syntastic # Fallback to singlethreaded but huge syntax support + ReplaceWithRegister # For better copying/replacing + polyglot # Language pack + vim-indent-guides # for displaying indent levels + ale # threaded language client + vim-go # go linting + deoplete-go # go autocompletion completion + deoplete-nvim # general autocompletion + molokai # color scheme + ]; + + # manually loadable by calling `:packadd $plugin-name` + opt = []; + }; + }; + }; + }; + + environment.systemPackages = with pkgs; [ + ctags + neovim_custom + jq # For fixing json files + xxd # .bin files will be displayed with xxd + shellcheck # Shell linting + ansible-lint # Ansible linting + unzip # To vim into unzipped files + nodePackages.jsonlint # json linting + #python36Packages.python-language-server # python linting + #python36Packages.pyls-mypy # Python static type checker + #python36Packages.black # Python code formatter + #python37Packages.yamllint # For linting yaml files + #python37Packages.libxml2 # For fixing yaml files + cquery # C/C++ support + clang-tools # C++ fixer + ]; + + fonts = { + fonts = with pkgs; [ + font-awesome_5 + ]; + }; + +} + -- cgit v1.3.1 From 02ab71056896e651b6998b5211caf1d51f1d26b7 Mon Sep 17 00:00:00 2001 From: magenbluten Date: Sun, 14 Jul 2019 13:24:51 +0200 Subject: mb gr33n.r: add codimd --- mb/1systems/gr33n/configuration.nix | 13 +++++++++++++ mb/1systems/orange/configuration.nix | 4 ++++ 2 files changed, 17 insertions(+) diff --git a/mb/1systems/gr33n/configuration.nix b/mb/1systems/gr33n/configuration.nix index e20503aec..dcf987791 100644 --- a/mb/1systems/gr33n/configuration.nix +++ b/mb/1systems/gr33n/configuration.nix @@ -72,6 +72,19 @@ in { services.openssh.enable = true; services.openssh.passwordAuthentication = false; + services.codimd = { + enable = true; + workDir = "/storage/codimd"; + configuration = { + port = 1337; + host = "0.0.0.0"; + db = { + dialect = "sqlite"; + storage = "/storage/codimd/db.codimd.sqlite"; + }; + }; + }; + networking.wireless.enable = false; networking.networkmanager.enable = false; krebs.iptables.enable = true; diff --git a/mb/1systems/orange/configuration.nix b/mb/1systems/orange/configuration.nix index cabbc6fc1..b43bd8a0f 100644 --- a/mb/1systems/orange/configuration.nix +++ b/mb/1systems/orange/configuration.nix @@ -134,6 +134,10 @@ in { zbackup ]; + environment.variables = { + EDITOR = ["nvim"]; + }; + environment.shellAliases = { ll = "ls -alh"; ls = "ls --color=tty"; -- cgit v1.3.1 From 08b81051969e0b0e03dd240bd3c83e42e2619521 Mon Sep 17 00:00:00 2001 From: magenbluten Date: Sun, 14 Jul 2019 13:05:51 +0200 Subject: mb: add rofl.r --- krebs/3modules/mb/default.nix | 26 ++++ mb/1systems/rofl/configuration.nix | 103 +++++++++++++++ mb/2configs/google-compute-config.nix | 231 ++++++++++++++++++++++++++++++++++ mb/2configs/headless.nix | 25 ++++ mb/2configs/qemu-guest.nix | 19 +++ 5 files changed, 404 insertions(+) create mode 100644 mb/1systems/rofl/configuration.nix create mode 100644 mb/2configs/google-compute-config.nix create mode 100644 mb/2configs/headless.nix create mode 100644 mb/2configs/qemu-guest.nix diff --git a/krebs/3modules/mb/default.nix b/krebs/3modules/mb/default.nix index e77811f08..31e01c4ab 100644 --- a/krebs/3modules/mb/default.nix +++ b/krebs/3modules/mb/default.nix @@ -36,6 +36,32 @@ in { }; }; }; + rofl = { + nets = { + retiolum = { + ip4.addr = "10.243.42.43"; + aliases = [ + "rofl.r" + ]; + tinc.pubkey = '' + -----BEGIN PUBLIC KEY----- + MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAnysdVVwxkmSroNUleYZm + xdaIB9EdZYCo2xj3WyhsD2lWMpj51FzSH6Y052Vy1V1TCuIXIwjidpmMohBvflG8 + txKCaBGQOZbVqRgzyCDXsNisbr05ayYuHcRrXTpn5ask4HN0Vtx2uJOn8YmOxA0D + VhyEnf8xWu+vi8dwDqRVR17QnPBYqgenzIBmAuRngvNqg6WZg+E9X2e1Dco/PMzb + VW0AgC2+zFCl4+G7dEW7uhsI6IJLy4LsJuEN4TlvWAf7tfdFEnBzTfODW8quGdts + 1Yzah4svPNNt9F1ZhOR/1bDsfVoOjI76BgB0G+ZZPQAGV1zxgn8DXSKi/tJTLNu1 + vj/n9sUJfXMYQdTAOkABghCyEDFUspPKCffQqUXUcJbLKY9fNssGGBeanMsobUQC + Ch9z7kIJ52JDcP/D58z9Yf62P5ENqXzeVPCcodIOey1EizOu/FH3jVo52we1M5sp + 1iM4hMc3ZINUBI9AA1nLWWlB3lBnErAXrhmMMHjcO4nO7/M0YU+EalkDB5eIhqiH + QJx7VnOE2UZYU9Y0vVNSWfYocU12aABK98T7lr5Tde4dI1J81sk2MUZcbNHger3f + NxpvNzOBpeC5xvq/ENCRR7MDf/59xWW5P5N7PbGprLQAi8cfdSoIEhSPz17Taq1f + 3aAAePgBsZvRQozxXZfqp58CAwEAAQ== + -----END PUBLIC KEY----- + ''; + }; + }; + }; p1nk = { nets = { retiolum = { diff --git a/mb/1systems/rofl/configuration.nix b/mb/1systems/rofl/configuration.nix new file mode 100644 index 000000000..3c5c56c84 --- /dev/null +++ b/mb/1systems/rofl/configuration.nix @@ -0,0 +1,103 @@ +{ config, pkgs, callPackage, ... }: let + unstable = import { config = { allowUnfree = true; }; }; +in { + imports = + [ # Include the results of the hardware scan. + + + ]; + + krebs.build.host = config.krebs.hosts.rofl; + + i18n = { + consoleFont = "Lat2-Terminus16"; + consoleKeyMap = "de"; + defaultLocale = "en_US.UTF-8"; + }; + + time.timeZone = "Europe/Berlin"; + + nixpkgs.config.allowUnfree = true; + + environment.shellAliases = { + ll = "ls -alh"; + ls = "ls --color=tty"; + }; + + environment.systemPackages = with pkgs; [ + curl + fish + git + htop + nmap + ranger + tcpdump + tmux + traceroute + tree + vim + xz + zbackup + ]; + + sound.enable = false; + + services.openssh.enable = true; + services.openssh.passwordAuthentication = false; + + networking.wireless.enable = false; + networking.networkmanager.enable = false; + krebs.iptables.enable = true; + networking.enableIPv6 = false; + + programs.fish = { + enable = true; + shellInit = '' + function ssh_agent --description 'launch the ssh-agent and add the id_rsa identity' + if begin + set -q SSH_AGENT_PID + and kill -0 $SSH_AGENT_PID + and grep -q '^ssh-agent' /proc/$SSH_AGENT_PID/cmdline + end + echo "ssh-agent running on pid $SSH_AGENT_PID" + else + eval (command ssh-agent -c | sed 's/^setenv/set -Ux/') + end + set -l identity $HOME/.ssh/id_rsa + set -l fingerprint (ssh-keygen -lf $identity | awk '{print $2}') + ssh-add -l | grep -q $fingerprint + or ssh-add $identity + end + ''; + promptInit = '' + function fish_prompt --description 'Write out the prompt' + set -l color_cwd + set -l suffix + set -l nix_shell_info ( + if test "$IN_NIX_SHELL" != "" + echo -n " " + end + ) + switch "$USER" + case root toor + if set -q fish_color_cwd_root + set color_cwd $fish_color_cwd_root + else + set color_cwd $fish_color_cwd + end + set suffix '#' + case '*' + set color_cwd $fish_color_cwd + set suffix '>' + end + + echo -n -s "$USER" @ (set_color green) (prompt_hostname) (set_color normal) "$nix_shell_info" ' ' (set_color $color_cwd) (prompt_pwd) (set_color normal) "$suffix " + end + ''; + }; + + system.autoUpgrade.enable = false; + system.autoUpgrade.channel = "https://nixos.org/channels/nixos-19.03"; + system.stateVersion = "19.03"; + +} diff --git a/mb/2configs/google-compute-config.nix b/mb/2configs/google-compute-config.nix new file mode 100644 index 000000000..b201bd4b8 --- /dev/null +++ b/mb/2configs/google-compute-config.nix @@ -0,0 +1,231 @@ +{ config, lib, pkgs, ... }: +with lib; +let + gce = pkgs.google-compute-engine; +in +{ + imports = [ + ./headless.nix + ./qemu-guest.nix + ]; + + fileSystems."/" = { + device = "/dev/disk/by-label/nixos"; + autoResize = true; + }; + + boot.growPartition = true; + boot.kernelParams = [ "console=ttyS0" "panic=1" "boot.panic_on_fail" ]; + boot.initrd.kernelModules = [ "virtio_scsi" ]; + boot.kernelModules = [ "virtio_pci" "virtio_net" ]; + + # Generate a GRUB menu. Amazon's pv-grub uses this to boot our kernel/initrd. + boot.loader.grub.device = "/dev/sda"; + boot.loader.timeout = 0; + + # Don't put old configurations in the GRUB menu. The user has no + # way to select them anyway. + boot.loader.grub.configurationLimit = 0; + + # Allow root logins only using the SSH key that the user specified + # at instance creation time. + #services.openssh.enable = true; + #services.openssh.permitRootLogin = "prohibit-password"; + #services.openssh.passwordAuthentication = mkDefault false; + + # Use GCE udev rules for dynamic disk volumes + services.udev.packages = [ gce ]; + + # Force getting the hostname from Google Compute. + networking.hostName = mkDefault ""; + + # Always include cryptsetup so that NixOps can use it. + environment.systemPackages = [ pkgs.cryptsetup ]; + + # Make sure GCE image does not replace host key that NixOps sets + environment.etc."default/instance_configs.cfg".text = lib.mkDefault '' + [InstanceSetup] + set_host_keys = false + ''; + + # Rely on GCP's firewall instead + networking.firewall.enable = mkDefault false; + + # Configure default metadata hostnames + networking.extraHosts = '' + 169.254.169.254 metadata.google.internal metadata + ''; + + networking.timeServers = [ "metadata.google.internal" ]; + + networking.usePredictableInterfaceNames = false; + + # GC has 1460 MTU + networking.interfaces.eth0.mtu = 1460; + + security.googleOsLogin.enable = true; + + systemd.services.google-clock-skew-daemon = { + description = "Google Compute Engine Clock Skew Daemon"; + after = [ + "network.target" + "google-instance-setup.service" + "google-network-setup.service" + ]; + requires = ["network.target"]; + wantedBy = ["multi-user.target"]; + serviceConfig = { + Type = "simple"; + ExecStart = "${gce}/bin/google_clock_skew_daemon --debug"; + }; + }; + + systemd.services.google-instance-setup = { + description = "Google Compute Engine Instance Setup"; + after = ["local-fs.target" "network-online.target" "network.target" "rsyslog.service"]; + before = ["sshd.service"]; + wants = ["local-fs.target" "network-online.target" "network.target"]; + wantedBy = [ "sshd.service" "multi-user.target" ]; + path = with pkgs; [ ethtool openssh ]; + serviceConfig = { + ExecStart = "${gce}/bin/google_instance_setup --debug"; + Type = "oneshot"; + }; + }; + + systemd.services.google-network-daemon = { + description = "Google Compute Engine Network Daemon"; + after = ["local-fs.target" "network-online.target" "network.target" "rsyslog.service" "google-instance-setup.service"]; + wants = ["local-fs.target" "network-online.target" "network.target"]; + requires = ["network.target"]; + partOf = ["network.target"]; + wantedBy = [ "multi-user.target" ]; + path = with pkgs; [ iproute ]; + serviceConfig = { + ExecStart = "${gce}/bin/google_network_daemon --debug"; + }; + }; + + systemd.services.google-shutdown-scripts = { + description = "Google Compute Engine Shutdown Scripts"; + after = [ + "local-fs.target" + "network-online.target" + "network.target" + "rsyslog.service" + "systemd-resolved.service" + "google-instance-setup.service" + "google-network-daemon.service" + ]; + wants = [ "local-fs.target" "network-online.target" "network.target"]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + ExecStart = "${pkgs.coreutils}/bin/true"; + ExecStop = "${gce}/bin/google_metadata_script_runner --debug --script-type shutdown"; + Type = "oneshot"; + RemainAfterExit = true; + TimeoutStopSec = "infinity"; + }; + }; + + systemd.services.google-startup-scripts = { + description = "Google Compute Engine Startup Scripts"; + after = [ + "local-fs.target" + "network-online.target" + "network.target" + "rsyslog.service" + "google-instance-setup.service" + "google-network-daemon.service" + ]; + wants = ["local-fs.target" "network-online.target" "network.target"]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + ExecStart = "${gce}/bin/google_metadata_script_runner --debug --script-type startup"; + KillMode = "process"; + Type = "oneshot"; + }; + }; + + + # Settings taken from https://github.com/GoogleCloudPlatform/compute-image-packages/blob/master/google_config/sysctl/11-gce-network-security.conf + boot.kernel.sysctl = { + # Turn on SYN-flood protections. Starting with 2.6.26, there is no loss + # of TCP functionality/features under normal conditions. When flood + # protections kick in under high unanswered-SYN load, the system + # should remain more stable, with a trade off of some loss of TCP + # functionality/features (e.g. TCP Window scaling). + "net.ipv4.tcp_syncookies" = mkDefault "1"; + + # ignores source-routed packets + "net.ipv4.conf.all.accept_source_route" = mkDefault "0"; + + # ignores source-routed packets + "net.ipv4.conf.default.accept_source_route" = mkDefault "0"; + + # ignores ICMP redirects + "net.ipv4.conf.all.accept_redirects" = mkDefault "0"; + + # ignores ICMP redirects + "net.ipv4.conf.default.accept_redirects" = mkDefault "0"; + + # ignores ICMP redirects from non-GW hosts + "net.ipv4.conf.all.secure_redirects" = mkDefault "1"; + + # ignores ICMP redirects from non-GW hosts + "net.ipv4.conf.default.secure_redirects" = mkDefault "1"; + + # don't allow traffic between networks or act as a router + "net.ipv4.ip_forward" = mkDefault "0"; + + # don't allow traffic between networks or act as a router + "net.ipv4.conf.all.send_redirects" = mkDefault "0"; + + # don't allow traffic between networks or act as a router + "net.ipv4.conf.default.send_redirects" = mkDefault "0"; + + # reverse path filtering - IP spoofing protection + "net.ipv4.conf.all.rp_filter" = mkDefault "1"; + + # reverse path filtering - IP spoofing protection + "net.ipv4.conf.default.rp_filter" = mkDefault "1"; + + # ignores ICMP broadcasts to avoid participating in Smurf attacks + "net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault "1"; + + # ignores bad ICMP errors + "net.ipv4.icmp_ignore_bogus_error_responses" = mkDefault "1"; + + # logs spoofed, source-routed, and redirect packets + "net.ipv4.conf.all.log_martians" = mkDefault "1"; + + # log spoofed, source-routed, and redirect packets + "net.ipv4.conf.default.log_martians" = mkDefault "1"; + + # implements RFC 1337 fix + "net.ipv4.tcp_rfc1337" = mkDefault "1"; + + # randomizes addresses of mmap base, heap, stack and VDSO page + "kernel.randomize_va_space" = mkDefault "2"; + + # Reboot the machine soon after a kernel panic. + "kernel.panic" = mkDefault "10"; + + ## Not part of the original config + + # provides protection from ToCToU races + "fs.protected_hardlinks" = mkDefault "1"; + + # provides protection from ToCToU races + "fs.protected_symlinks" = mkDefault "1"; + + # makes locating kernel addresses more difficult + "kernel.kptr_restrict" = mkDefault "1"; + + # set ptrace protections + "kernel.yama.ptrace_scope" = mkOverride 500 "1"; + + # set perf only available to root + "kernel.perf_event_paranoid" = mkDefault "2"; + }; +} diff --git a/mb/2configs/headless.nix b/mb/2configs/headless.nix new file mode 100644 index 000000000..46a9b6a7d --- /dev/null +++ b/mb/2configs/headless.nix @@ -0,0 +1,25 @@ +# Common configuration for headless machines (e.g., Amazon EC2 +# instances). + +{ lib, ... }: + +with lib; + +{ + boot.vesa = false; + + # Don't start a tty on the serial consoles. + systemd.services."serial-getty@ttyS0".enable = false; + systemd.services."serial-getty@hvc0".enable = false; + systemd.services."getty@tty1".enable = false; + systemd.services."autovt@".enable = false; + + # Since we can't manually respond to a panic, just reboot. + boot.kernelParams = [ "panic=1" "boot.panic_on_fail" ]; + + # Don't allow emergency mode, because we don't have a console. + systemd.enableEmergencyMode = false; + + # Being headless, we don't need a GRUB splash image. + boot.loader.grub.splashImage = null; +} diff --git a/mb/2configs/qemu-guest.nix b/mb/2configs/qemu-guest.nix new file mode 100644 index 000000000..315d04093 --- /dev/null +++ b/mb/2configs/qemu-guest.nix @@ -0,0 +1,19 @@ +# Common configuration for virtual machines running under QEMU (using +# virtio). + +{ ... }: + +{ + boot.initrd.availableKernelModules = [ "virtio_net" "virtio_pci" "virtio_mmio" "virtio_blk" "virtio_scsi" "9p" "9pnet_virtio" ]; + boot.initrd.kernelModules = [ "virtio_balloon" "virtio_console" "virtio_rng" ]; + + boot.initrd.postDeviceCommands = + '' + # Set the system time from the hardware clock to work around a + # bug in qemu-kvm > 1.5.2 (where the VM clock is initialised + # to the *boot time* of the host). + hwclock -s + ''; + + security.rngd.enable = false; +} -- cgit v1.3.1 From 976e6d77031b9e9648789d72cf893a6d1192fedb Mon Sep 17 00:00:00 2001 From: magenbluten Date: Sun, 14 Jul 2019 13:26:37 +0200 Subject: mb p1nk.r: add pekwm --- mb/1systems/p1nk/configuration.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mb/1systems/p1nk/configuration.nix b/mb/1systems/p1nk/configuration.nix index ba11c85f4..19efc75b0 100644 --- a/mb/1systems/p1nk/configuration.nix +++ b/mb/1systems/p1nk/configuration.nix @@ -5,7 +5,7 @@ in { [ # Include the results of the hardware scan. ./hardware-configuration.nix - + ]; krebs.build.host = config.krebs.hosts.p1nk; @@ -160,6 +160,7 @@ in { }; }; windowManager.ratpoison.enable = true; + windowManager.pekwm.enable = true; }; services.openssh.enable = true; -- cgit v1.3.1 From 3f0435e89cbdccf8ad8ab351cc3eab349c427e60 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 14 Jul 2019 16:27:44 +0200 Subject: l xerxes.r: revive more --- krebs/3modules/lass/default.nix | 11 ++++- krebs/3modules/lass/ssh/xerxes.ed25519 | 1 + krebs/3modules/lass/ssh/xerxes.rsa | 1 - lass/1systems/xerxes/config.nix | 21 +++++++- lass/1systems/xerxes/icarus/config.nix | 33 +++++++++++++ lass/1systems/xerxes/icarus/physical.nix | 25 ++++++++++ lass/1systems/xerxes/physical.nix | 83 +++++++++++++++++++++++++++----- 7 files changed, 159 insertions(+), 16 deletions(-) create mode 100644 krebs/3modules/lass/ssh/xerxes.ed25519 delete mode 100644 krebs/3modules/lass/ssh/xerxes.rsa create mode 100644 lass/1systems/xerxes/icarus/config.nix create mode 100644 lass/1systems/xerxes/icarus/physical.nix diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index 1821ea7e9..217edfdd1 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -398,6 +398,7 @@ in { nets = rec { retiolum = { ip4.addr = "10.243.1.3"; + ip6.addr = r6 "3"; aliases = [ "xerxes.r" ]; @@ -428,10 +429,18 @@ in { -----END RSA PUBLIC KEY----- ''; }; + wiregrill = { + ip6.addr = w6 "3"; + aliases = [ + "xerxes.w" + ]; + wireguard.pubkey = "UTm8B8YUVvBGqwwxAUMVFsVQFQGQ6jbcXAavZ8LxYT8="; + }; }; secure = true; ssh.privkey.path = ; ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE5HyLyaIvVH0qHIQ4ciKhDiElhSqsK+uXcA6lTvL+5n"; + syncthing.id = "EA76ZHP-DF2I3CJ-NNTFEUH-YGPQK5S-T7FQ6JA-BNQQUNC-GF2YL46-CKOZCQM"; }; red = { monitoring = false; @@ -666,7 +675,7 @@ in { }; lass-xerxes = { mail = "lass@xerxes.r"; - pubkey = builtins.readFile ./ssh/xerxes.rsa; + pubkey = builtins.readFile ./ssh/xerxes.ed25519; }; lass-daedalus = { mail = "lass@daedalus.r"; diff --git a/krebs/3modules/lass/ssh/xerxes.ed25519 b/krebs/3modules/lass/ssh/xerxes.ed25519 new file mode 100644 index 000000000..87a40ca2a --- /dev/null +++ b/krebs/3modules/lass/ssh/xerxes.ed25519 @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGwCq56DGqj/kz8d8ax0xIl29jV9f3tUtDgtnCnS1b4q lass@xerxes diff --git a/krebs/3modules/lass/ssh/xerxes.rsa b/krebs/3modules/lass/ssh/xerxes.rsa deleted file mode 100644 index 2b5da7b25..000000000 --- a/krebs/3modules/lass/ssh/xerxes.rsa +++ /dev/null @@ -1 +0,0 @@ -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEZgGjBN0aFs6GxNwMjCvlddbN6+vb6LZuWiWWe+wbAynaGuGbae0TXCLp0/eMNy7fH8poDjpdW9M4mKbBFKOqyG8WJLCPFoQw761tjKl1hccJn0hFSkQAEGKxtfzHlAl/Mz+59yvqNg7/WNSivv41hE7btYltzRy238VQDYFv2eLM7acyxrgGo7tWOtkbpfELj5cM8Qw1j3TF9bGV5pK6IOEtaHbmalS8Iiz77syAu+6E/y6zKBTtGMHI15l6RNJ/Y7A1LM/WwuNL+9dJMYWJFVHy3/4dpaxiioHREiSawUbz9wNHknCrT6vaPCIVVcujhz9Oee1C5UiYUyyfJrFYdlzaTg7FuLNIt2hKMY6NYx1D8/Pwpq1JOsaEfK/K5ytCgaJb115mRevcaUA5s7KYNWHmmZvy08JzCgSM6ZPRtfkQIcha77wVq6DugJ+KgBz+oADQRKiaMrumOMldd0B3q4Oxb71gDTE1XLAbWJnd/0Up1H5GAtZZUUrMUslZiU/23R6SOkyEMLWQTx/KgkWcz8DZLtib5o03uZpfJDVqp2CR+sjmy4x9aa+lSaOzuZP0KRyg+mOKl0o3zL7TNAzrzSCORVBg7nOh+0SPJkDxVRkc6dVY1L3ZOfdm2P/19fhWEr5ECgVrmYYKnDPwWY1iWJlZsiEc3Mj7KB1m44ov0FJg2hiNnydImqcXTCoszp515MBmeHnpqJsqEZuWS8dAnaEiOwZaSKIO1E7lQ7CoP86+eD4yAwLq6fb2tgjHT69LgDMaIha4hMfrO2o4UDVw9OZMfnPtyatI4pxplaQDoQM1p0dej0rZ7uxL1tfoKAyT0UCdtjhxfnNs0x1gOQbML4eGbqyKuyF82eOQRgKRDqH/tParoE4SRBVi7o3s0kILRmXA3ng3n1uhEiGwPTH8JsQ9huM+XOhH8+CzQeg4yb/jCrhsDzvLaW654+ouq9G+kjwqmO4vLNs5eZxfae84rppbS2MJqK1x8rkJixvKBKEfvYJOuDNV+hXyMbToaq8qtGy7cCSq4+UDio3DsSHY0Tpt9e+yEzoOOqFQLQyq6uHv/+u9MY+VADoa4N64U3S2SXul9tE3g6hOAY0F5BYMbxQSuj59kzwghlAmbsyWN2FCmWdsfCQkkZX7wCTj20DtZB/GdVSGNgHGAoU5JZrXKca3A2Yc9hzbYjyNYr0NmQ9NUbkbaOkcYJRIUXtS2OBOHP+FoUkkqL3ieKXR07l5xJbWLzbyVUxN9Zii4Baj5xnDO/RLZPDvTUxbER/0d1orMZztL2EKmfSn4j4uhWqpi04Rg9sWH+WVLAq22EKhAuqcFEOUimjcyZWYKxcAq5Z51NJNBQB7euz55eCJUZkBUYEpNuYr0UDlmBxKB2r6ZWDeNXT7eLxBdwDHCHSqXV7qOG1vMhHtjbbxmQMnkQ4InhO9TdpaN3tj67nGmc6hhgYO4b7NvyL1/pvDPrHrR/3GzkDkwqvt3uESdVdqAJSCk6gFh9V1aGs= lass@xerxes diff --git a/lass/1systems/xerxes/config.nix b/lass/1systems/xerxes/config.nix index 1bd6cf2c5..b393f203d 100644 --- a/lass/1systems/xerxes/config.nix +++ b/lass/1systems/xerxes/config.nix @@ -1,4 +1,4 @@ -{ config, pkgs, ... }: +{ config, lib, pkgs, ... }: { imports = [ @@ -9,8 +9,27 @@ + + + + + + + + ]; krebs.build.host = config.krebs.hosts.xerxes; + + services.xserver = { + displayManager.lightdm.autoLogin.enable = true; + displayManager.lightdm.autoLogin.user = "lass"; + }; + + boot.blacklistedKernelModules = [ + "xpad" + ]; + + lass.screenlock.enable = lib.mkForce false; } diff --git a/lass/1systems/xerxes/icarus/config.nix b/lass/1systems/xerxes/icarus/config.nix new file mode 100644 index 000000000..dada4949e --- /dev/null +++ b/lass/1systems/xerxes/icarus/config.nix @@ -0,0 +1,33 @@ +{ config, lib, pkgs, ... }: + +{ + imports = [ + + + + + + + + # + + + + + + # + # + + + # + + ]; + + krebs.build.host = config.krebs.hosts.icarus; + + environment.systemPackages = with pkgs; [ + macchanger + nix-review + ]; + programs.adb.enable = true; +} diff --git a/lass/1systems/xerxes/icarus/physical.nix b/lass/1systems/xerxes/icarus/physical.nix new file mode 100644 index 000000000..e9e09bc05 --- /dev/null +++ b/lass/1systems/xerxes/icarus/physical.nix @@ -0,0 +1,25 @@ +{ + imports = [ + ./config.nix + + + ]; + + fileSystems = { + "/bku" = { + device = "/dev/mapper/pool-bku"; + fsType = "btrfs"; + options = ["defaults" "noatime" "ssd" "compress=lzo"]; + }; + }; + + services.udev.extraRules = '' + SUBSYSTEM=="net", ATTR{address}=="00:24:d7:f0:a0:0c", NAME="wl0" + SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:71:cb:35", NAME="et0" + ''; + + services.thinkfan.enable = true; + services.tlp.extraConfig = '' + START_CHARGE_THRESH_BAT0=80 + ''; +} diff --git a/lass/1systems/xerxes/physical.nix b/lass/1systems/xerxes/physical.nix index 17caccfe6..f88578e19 100644 --- a/lass/1systems/xerxes/physical.nix +++ b/lass/1systems/xerxes/physical.nix @@ -1,29 +1,86 @@ +{ pkgs, lib, ... }: { imports = [ ./config.nix - - + ]; - services.udev.extraRules = '' - SUBSYSTEM=="net", ATTR{address}=="b0:f1:ec:9f:5c:78", NAME="wl0" + + boot.zfs.enableUnstable = true; + boot.loader.grub = { + enable = true; + device = "/dev/sda"; + efiSupport = true; + }; + boot.loader.efi.canTouchEfiVariables = true; + + # TODO fix touchscreen + boot.blacklistedKernelModules = [ + "goodix" + ]; + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.initrd.luks.devices.crypted.device = "/dev/sda3"; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + boot.kernelParams = [ + "fbcon=rotate:1" + "boot.shell_on_fail" + ]; + + services.xserver.displayManager.sessionCommands = '' + (sleep 2 && ${pkgs.xorg.xrandr}/bin/xrandr --output eDP-1 --rotate right) + (sleep 2 && ${pkgs.xorg.xinput}/bin/xinput set-prop 'Goodix Capacitive TouchScreen' 'Coordinate Transformation Matrix' 0 1 0 -1 0 1 0 0 1) ''; fileSystems."/" = { - device = "/dev/disk/by-uuid/d227d88f-bd24-4e8a-aa14-9e966b471437"; - fsType = "btrfs"; + device = "rpool/root"; + fsType = "zfs"; + }; + + fileSystems."/home" = { + device = "rpool/home"; + fsType = "zfs"; }; fileSystems."/boot" = { - device = "/dev/disk/by-uuid/16C8-D053"; + device = "/dev/disk/by-uuid/E749-784C"; fsType = "vfat"; }; - fileSystems."/home" = { - device = "/dev/disk/by-uuid/1ec4193b-7f41-490d-8782-7677d437b358"; - fsType = "btrfs"; - }; + swapDevices = [ ]; + + boot.extraModprobeConfig = '' + options zfs zfs_arc_max=1073741824 + ''; + + nix.maxJobs = lib.mkDefault 4; + + networking.hostId = "9b0a74ac"; + networking.networkmanager.enable = true; - boot.initrd.luks.devices = [ { name = "luksroot"; device = "/dev/disk/by-uuid/d17f19a3-dcba-456d-b5da-e45cc15dc9c8"; } ]; + hardware.opengl.enable = true; - networking.wireless.enable = true; + services.tlp.enable = true; + services.tlp.extraConfig = '' + CPU_SCALING_GOVERNOR_ON_AC=ondemand + CPU_SCALING_GOVERNOR_ON_BAT=powersave + CPU_MIN_PERF_ON_AC=0 + CPU_MAX_PERF_ON_AC=100 + CPU_MIN_PERF_ON_BAT=0 + CPU_MAX_PERF_ON_BAT=30 + ''; + + services.logind.extraConfig = '' + HandlePowerKey=suspend + IdleAction=suspend + IdleActionSec=300 + ''; + + services.xserver.extraConfig = '' + Section "Device" + Identifier "Intel Graphics" + Driver "Intel" + Option "TearFree" "true" + EndSection + ''; } -- cgit v1.3.1 From b13a28d867653afb99f7fa7bf74d6b8c6800fe86 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 15 Jul 2019 18:22:35 +0200 Subject: bier bal: prefix nicks with the_ --- krebs/2configs/reaktor2.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/krebs/2configs/reaktor2.nix b/krebs/2configs/reaktor2.nix index b52125ae8..f4fa2ca7c 100644 --- a/krebs/2configs/reaktor2.nix +++ b/krebs/2configs/reaktor2.nix @@ -70,7 +70,8 @@ let filename = pkgs.writeDash "bier-balance" '' ${pkgs.hledger}/bin/hledger -f $state_file bal -N -O csv \ | ${pkgs.coreutils}/bin/tail +2 \ - | ${pkgs.miller}/bin/mlr --icsv --opprint cat + | ${pkgs.miller}/bin/mlr --icsv --opprint cat \ + | ${pkgs.gnused}/bin/sed 's/^/the_/' ''; }; } -- cgit v1.3.1 From 035cf33ab9dba52adda38f16e90d76dcda448e9a Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 15 Jul 2019 18:23:27 +0200 Subject: l: add domsen-backup host --- krebs/3modules/external/default.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/krebs/3modules/external/default.nix b/krebs/3modules/external/default.nix index 5b602fc7d..a0ba09782 100644 --- a/krebs/3modules/external/default.nix +++ b/krebs/3modules/external/default.nix @@ -620,6 +620,13 @@ in { }; }; }; + domsen-backup = { + owner = config.krebs.users.domsen; + ci = false; + external = true; + syncthing.id = "22NLFY5-QMRM3BH-76QIBYI-OPMKVGM-DU4FNZI-3KN2POF-V4WIC6M-2SFFUAC"; + nets = {}; + }; }; users = { ciko = { @@ -665,5 +672,7 @@ in { filly = { }; pie_ = {}; + domsen = { + }; }; } -- cgit v1.3.1 From 9bc7f594f5a084ec7f87005cd13d337b0b79cd75 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 15 Jul 2019 18:26:30 +0200 Subject: syncthing: run preStart as root on 19.09 --- krebs/3modules/syncthing.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/krebs/3modules/syncthing.nix b/krebs/3modules/syncthing.nix index 939c8fddf..799ed7eda 100644 --- a/krebs/3modules/syncthing.nix +++ b/krebs/3modules/syncthing.nix @@ -176,6 +176,7 @@ in config = mkIf kcfg.enable { systemd.services.syncthing = mkIf (kcfg.cert != null || kcfg.key != null) { + serviceConfig.PermissionsStartOnly = mkDefault true; preStart = '' ${optionalString (kcfg.cert != null) '' cp ${toString kcfg.cert} ${scfg.configDir}/cert.pem -- cgit v1.3.1 From bc1a0aa0faa87297bf5a1e7e1cf4e303f28bd1ae Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 15 Jul 2019 18:27:17 +0200 Subject: l blue.r: fix source.nix --- lass/1systems/blue/source.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lass/1systems/blue/source.nix b/lass/1systems/blue/source.nix index 21f3a8bd5..1a98fc058 100644 --- a/lass/1systems/blue/source.nix +++ b/lass/1systems/blue/source.nix @@ -1,6 +1,6 @@ -{ lib, pkgs, ... }: +{ lib, pkgs, test, ... }: { - nixpkgs = lib.mkForce { + nixpkgs = lib.mkIf (! test) (lib.mkForce { file = { path = toString (pkgs.fetchFromGitHub { owner = "nixos"; @@ -10,5 +10,5 @@ }); useChecksum = true; }; - }; + }); } -- cgit v1.3.1 From ea68d0fe56d747737161086584e3545e7f69d701 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 15 Jul 2019 18:28:17 +0200 Subject: blessings/email-header: add 19.09 compat --- krebs/5pkgs/haskell/blessings.nix | 4 ++++ krebs/5pkgs/haskell/email-header.nix | 5 +++++ 2 files changed, 9 insertions(+) diff --git a/krebs/5pkgs/haskell/blessings.nix b/krebs/5pkgs/haskell/blessings.nix index 7abebba56..55f2d17d0 100644 --- a/krebs/5pkgs/haskell/blessings.nix +++ b/krebs/5pkgs/haskell/blessings.nix @@ -14,6 +14,10 @@ with import ; version = "2.2.0"; sha256 = "1pb56dgf3jj2kq3cbbppwzyg3ccgqy9xara62hkjwyxzdx20clk1"; }; + "19.09" = { + version = "2.2.0"; + sha256 = "1pb56dgf3jj2kq3cbbppwzyg3ccgqy9xara62hkjwyxzdx20clk1"; + }; }.${versions.majorMinor version}; in mkDerivation { diff --git a/krebs/5pkgs/haskell/email-header.nix b/krebs/5pkgs/haskell/email-header.nix index fe4bb839b..8b7165860 100644 --- a/krebs/5pkgs/haskell/email-header.nix +++ b/krebs/5pkgs/haskell/email-header.nix @@ -20,6 +20,11 @@ with import ; rev = "refs/tags/v${cfg.version}"; sha256 = "11xjivpj495r2ss9aqljnpzzycb57cm4sr7yzmf939rzwsd3ib0x"; }; + "19.09" = { + version = "0.4.1-tv1"; + rev = "refs/tags/v${cfg.version}"; + sha256 = "11xjivpj495r2ss9aqljnpzzycb57cm4sr7yzmf939rzwsd3ib0x"; + }; }.${versions.majorMinor version}; in mkDerivation { -- cgit v1.3.1 From 43b2333e50722e3be30c4337a732ac09528b1aba Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 15 Jul 2019 18:48:53 +0200 Subject: l xerxes.r: add the_playlist sync --- lass/1systems/xerxes/config.nix | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/lass/1systems/xerxes/config.nix b/lass/1systems/xerxes/config.nix index b393f203d..c120c17d7 100644 --- a/lass/1systems/xerxes/config.nix +++ b/lass/1systems/xerxes/config.nix @@ -32,4 +32,19 @@ ]; lass.screenlock.enable = lib.mkForce false; + krebs.syncthing = { + folders = { + the_playlist = { + path = "/home/lass/tmp/the_playlist"; + peers = [ "mors" "phone" "prism" "xerxes" ]; + }; + }; + }; + krebs.permown = { + "/home/lass/tmp/the_playlist" = { + owner = "lass"; + group = "syncthing"; + umask = "0007"; + }; + }; } -- cgit v1.3.1 From 2885fbd942163d733586cd966c76ccf9159ae208 Mon Sep 17 00:00:00 2001 From: Jörg Thalheim Date: Thu, 18 Jul 2019 10:34:11 +0100 Subject: external: public ips for rose/martha/donna MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jörg Thalheim --- krebs/3modules/external/default.nix | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/krebs/3modules/external/default.nix b/krebs/3modules/external/default.nix index a0ba09782..66f9620c7 100644 --- a/krebs/3modules/external/default.nix +++ b/krebs/3modules/external/default.nix @@ -232,7 +232,12 @@ in { rose = { owner = config.krebs.users.Mic92; nets = rec { + internet = { + ip4.addr = "129.215.165.52"; + aliases = [ "rose.i" ]; + }; retiolum = { + via = internet; addrs = [ config.krebs.hosts.rose.nets.retiolum.ip4.addr config.krebs.hosts.rose.nets.retiolum.ip6.addr @@ -260,7 +265,12 @@ in { martha = { owner = config.krebs.users.Mic92; nets = rec { + internet = { + ip4.addr = "129.215.165.53"; + aliases = [ "martha.i" ]; + }; retiolum = { + via = internet; addrs = [ config.krebs.hosts.martha.nets.retiolum.ip4.addr config.krebs.hosts.martha.nets.retiolum.ip6.addr @@ -288,7 +298,12 @@ in { donna = { owner = config.krebs.users.Mic92; nets = rec { + internet = { + ip4.addr = "129.215.165.54"; + aliases = [ "donna.i" ]; + }; retiolum = { + via = internet; addrs = [ config.krebs.hosts.donna.nets.retiolum.ip4.addr config.krebs.hosts.donna.nets.retiolum.ip6.addr -- cgit v1.3.1 From f15434475faf17795bd296fc3570bc7dca34591a Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 30 Jul 2019 19:20:32 +0200 Subject: tv sshd: drop default generated host key Fixes an issue with 222160fc3a195415e859048bdef21f703154b3ee which caused the generated ed25519 host key to be preferred over the one defined in krebs/3modules/*/default.nix --- tv/2configs/sshd.nix | 6 ------ 1 file changed, 6 deletions(-) diff --git a/tv/2configs/sshd.nix b/tv/2configs/sshd.nix index 1749b552d..25468f23e 100644 --- a/tv/2configs/sshd.nix +++ b/tv/2configs/sshd.nix @@ -5,12 +5,6 @@ with import ; { services.openssh = { enable = true; - hostKeys = [ - { - type = "ed25519"; - path = "/etc/ssh/ssh_host_ed25519_key"; - } - ]; }; tv.iptables.input-internet-accept-tcp = singleton "ssh"; } -- cgit v1.3.1 From b92610eacb6c88fe28f46a91ee8697cb542ab6aa Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 2 Aug 2019 17:03:12 +0200 Subject: tv mu: reload iwlwifi on activation --- tv/1systems/mu/config.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tv/1systems/mu/config.nix b/tv/1systems/mu/config.nix index f1cd7d673..98332b2d6 100644 --- a/tv/1systems/mu/config.nix +++ b/tv/1systems/mu/config.nix @@ -49,6 +49,13 @@ with import ; networking.networkmanager.enable = true; + # XXX reload to work around occasional "Failed to load firmware chunk!" + # TODO only do this if firmware is actually broken(?) + system.activationScripts.reload-iwlwifi = /* sh */ '' + ${pkgs.kmod}/bin/modprobe -vr iwlwifi + ${pkgs.kmod}/bin/modprobe -v iwlwifi + ''; + environment.systemPackages = with pkgs; [ chromium firefoxWrapper -- cgit v1.3.1 From daf7c2d05d207d876f0383955e3f1c8c3f0c0822 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 5 Aug 2019 14:08:31 +0200 Subject: tv field: init --- tv/5pkgs/simple/field.nix | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 tv/5pkgs/simple/field.nix diff --git a/tv/5pkgs/simple/field.nix b/tv/5pkgs/simple/field.nix new file mode 100644 index 000000000..71362398d --- /dev/null +++ b/tv/5pkgs/simple/field.nix @@ -0,0 +1,6 @@ +{ gawk, writeDashBin }: + +writeDashBin "field" '' + set -u + exec ${gawk}/bin/awk -v n="$1" '{print$n}' +'' -- cgit v1.3.1 From 5f22fbed30828d6e297554060744f57cd2af556e Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 5 Aug 2019 14:09:03 +0200 Subject: tv: add field to systemPackages --- tv/2configs/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index 4fc755c43..72c48da2c 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -120,6 +120,7 @@ with import ; { environment.systemPackages = [ + pkgs.field pkgs.get pkgs.git pkgs.git-crypt -- cgit v1.3.1 From 4258ff5c0c5e287c986b7199158dee1b4c49f1d9 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 12 Aug 2019 23:51:23 +0200 Subject: tv urlwatch: add json' --- tv/2configs/urlwatch.nix | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/tv/2configs/urlwatch.nix b/tv/2configs/urlwatch.nix index 40dc7d237..4fb111063 100644 --- a/tv/2configs/urlwatch.nix +++ b/tv/2configs/urlwatch.nix @@ -1,8 +1,11 @@ with import ; { config, pkgs, ... }: let - json = url: { + json = json' ["."]; + json' = args: url: { inherit url; - filter = "system:${pkgs.jq}/bin/jq ."; + filter = "system:${pkgs.jq}/bin/jq ${ + concatMapStringsSep " " shell.escape (toList args) + }"; }; in { krebs.urlwatch = { -- cgit v1.3.1 From f319d31e3641ec4b9e235cb77933d5c98f0cd6a4 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 12 Aug 2019 23:51:43 +0200 Subject: tv urlwatch: add xml and xml' --- tv/2configs/urlwatch.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tv/2configs/urlwatch.nix b/tv/2configs/urlwatch.nix index 4fb111063..b2364e6e6 100644 --- a/tv/2configs/urlwatch.nix +++ b/tv/2configs/urlwatch.nix @@ -7,6 +7,13 @@ with import ; concatMapStringsSep " " shell.escape (toList args) }"; }; + xml = xml' ["--format" "-"]; + xml' = args: url: { + inherit url; + filter = "system:${pkgs.libxml2}/bin/xmllint ${ + concatMapStringsSep " " shell.escape (toList args) + }"; + }; in { krebs.urlwatch = { enable = true; -- cgit v1.3.1 From 8527caef164fe872dd9c77772d1e6ed7a0a85b77 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 13 Aug 2019 00:02:54 +0200 Subject: tv urlwatch: add exec --- tv/2configs/urlwatch.nix | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/tv/2configs/urlwatch.nix b/tv/2configs/urlwatch.nix index b2364e6e6..378b5d167 100644 --- a/tv/2configs/urlwatch.nix +++ b/tv/2configs/urlwatch.nix @@ -1,19 +1,15 @@ with import ; { config, pkgs, ... }: let - json = json' ["."]; - json' = args: url: { + exec = filename: args: url: { inherit url; - filter = "system:${pkgs.jq}/bin/jq ${ - concatMapStringsSep " " shell.escape (toList args) + filter = "system:${ + concatMapStringsSep " " shell.escape ([filename] ++ toList args) }"; }; + json = json' ["."]; + json' = exec "${pkgs.jq}/bin/jq"; xml = xml' ["--format" "-"]; - xml' = args: url: { - inherit url; - filter = "system:${pkgs.libxml2}/bin/xmllint ${ - concatMapStringsSep " " shell.escape (toList args) - }"; - }; + xml' = exec "${pkgs.libxml2}/bin/xmllint"; in { krebs.urlwatch = { enable = true; -- cgit v1.3.1 From 9cf4d9e26f07e31cb04888c00779900c91718f1b Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 13 Aug 2019 00:15:26 +0200 Subject: tv vim nix: add `comment` --- tv/5pkgs/vim/nix.nix | 40 ++++++++++++++++++---------------------- 1 file changed, 18 insertions(+), 22 deletions(-) diff --git a/tv/5pkgs/vim/nix.nix b/tv/5pkgs/vim/nix.nix index 747ab0bc0..1998f9d72 100644 --- a/tv/5pkgs/vim/nix.nix +++ b/tv/5pkgs/vim/nix.nix @@ -63,16 +63,27 @@ with import ; syn cluster nix_ind_strings contains=NixIND_STRING syn cluster nix_strings contains=NixSTRING - ${concatStringsSep "\n" (mapAttrsToList (name: { + ${concatStringsSep "\n" (let + alts = xs: ''\(${concatStringsSep ''\|'' xs}\)''; + capitalize = s: let + xs = stringToCharacters s; + in + toUpper (head xs) + concatStrings (tail xs); + comment = k: ''/\* ${k} \*/''; + def = k: ''${k}[ \t\r\n]*=''; + writer = k: ''write${k}[^ \t\r\n]*[ \t\r\n]*\("[^"]*"\|[a-z]\+\)''; + writerExt = k: writerName ''[^"]*\.${k}''; + writerName = k: ''write[^ \t\r\n]*[ \t\r\n]*"${k}"''; + in mapAttrsToList (name: { extraStart ? null, lang ? name }: let startAlts = filter isString [ - ''/\* ${name} \*/'' + (comment name) extraStart ]; - sigil = ''\(${concatStringsSep ''\|'' startAlts}\)[ \t\r\n]*''; + sigil = ''${alts startAlts}[ \t\r\n]*''; in /* vim */ '' syn include @nix_${lang}_syntax syntax/${lang}.vim if exists("b:current_syntax") @@ -111,22 +122,7 @@ with import ; " This is required because containedin isn't transitive. syn cluster nix_has_dollar_curly \ add=@nix_${lang}_syntax - '') (let - - # TODO move this higher - capitalize = s: let - xs = stringToCharacters s; - in - toUpper (head xs) + concatStrings (tail xs); - - alts = xs: ''\(${concatStringsSep ''\|'' xs}\)''; - def = k: ''${k}[ \t\r\n]*=''; - writer = k: ''write${k}[^ \t\r\n]*[ \t\r\n]*\("[^"]*"\|[a-z]\+\)''; - - writerExt = k: writerName ''[^"]*\.${k}''; - writerName = k: ''write[^ \t\r\n]*[ \t\r\n]*"${k}"''; - - in { + '') { c = {}; cabal = {}; diff = {}; @@ -136,10 +132,10 @@ with import ; (writer "Jq") (writerExt "jq") ]; - javascript.extraStart = ''/\* js \*/''; + javascript.extraStart = comment "jq"; lua = {}; #nginx = {}; - python.extraStart = ''/\* py \*/''; + python.extraStart = comment "py"; sed.extraStart = writer "Sed"; sh.extraStart = let phases = [ @@ -172,7 +168,7 @@ with import ; ]; xdefaults = {}; xmodmap = {}; - }))} + })} " Clear syntax that interferes with nixINSIDE_DOLLAR_CURLY. syn clear shVarAssign -- cgit v1.3.1 From af518678bf730ee540dc3d3fe922e1f8f4fa1059 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 13 Aug 2019 00:16:54 +0200 Subject: tv vim nix: recognize python by extension --- tv/5pkgs/vim/nix.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tv/5pkgs/vim/nix.nix b/tv/5pkgs/vim/nix.nix index 1998f9d72..61323ab35 100644 --- a/tv/5pkgs/vim/nix.nix +++ b/tv/5pkgs/vim/nix.nix @@ -135,7 +135,10 @@ with import ; javascript.extraStart = comment "jq"; lua = {}; #nginx = {}; - python.extraStart = comment "py"; + python.extraStart = alts [ + (comment "py") + (writerExt "py") + ]; sed.extraStart = writer "Sed"; sh.extraStart = let phases = [ -- cgit v1.3.1 From bc7c360b80409cff1bea0fe2c187c43b0eec8269 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 13 Aug 2019 00:22:59 +0200 Subject: tv vim nix writerName: recognize toFile --- tv/5pkgs/vim/nix.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tv/5pkgs/vim/nix.nix b/tv/5pkgs/vim/nix.nix index 61323ab35..4f3f83aaa 100644 --- a/tv/5pkgs/vim/nix.nix +++ b/tv/5pkgs/vim/nix.nix @@ -73,7 +73,8 @@ with import ; def = k: ''${k}[ \t\r\n]*=''; writer = k: ''write${k}[^ \t\r\n]*[ \t\r\n]*\("[^"]*"\|[a-z]\+\)''; writerExt = k: writerName ''[^"]*\.${k}''; - writerName = k: ''write[^ \t\r\n]*[ \t\r\n]*"${k}"''; + writerName = k: + ''${alts [''toFile'' ''write[^ \t\r\n]*'']}*[ \t\r\n]*"${k}"''; in mapAttrsToList (name: { extraStart ? null, lang ? name -- cgit v1.3.1 From 681075a8f41ecfbac4c113481adde4d61f497c36 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 13 Aug 2019 09:29:49 +0200 Subject: urlwatch: (re-) enable sendmail by default --- krebs/3modules/urlwatch.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/krebs/3modules/urlwatch.nix b/krebs/3modules/urlwatch.nix index 3c9ff7709..61ee72e74 100644 --- a/krebs/3modules/urlwatch.nix +++ b/krebs/3modules/urlwatch.nix @@ -16,9 +16,6 @@ let api = { enable = mkEnableOption "krebs.urlwatch"; - - customSendmail.enable = mkEnableOption "krebs.urlwatch.customSendmail"; - dataDir = mkOption { type = types.str; default = "/var/lib/urlwatch"; @@ -56,8 +53,11 @@ let The format is described in systemd.time(7), CALENDAR EVENTS. ''; }; + sendmail.enable = mkEnableOption "krebs.urlwatch.sendmail" // { + default = true; + }; telegram = { - enable = mkEnableOption "krebs.urlwatch.telegram" // { default = false; }; + enable = mkEnableOption "krebs.urlwatch.telegram"; botToken = mkOption { type = types.str; }; @@ -174,7 +174,7 @@ let --urls=${shell.escape urlsFile} \ > changes || : - ${optionalString cfg.customSendmail.enable /* sh */ '' + ${optionalString cfg.sendmail.enable /* sh */ '' if test -s changes; then { echo Date: $(date -R) -- cgit v1.3.1 From 13d7c14bd06bf22558ca13e0c213cc231c98abdb Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 13 Aug 2019 09:41:55 +0200 Subject: urlwatch: filter defaults to null --- krebs/3modules/urlwatch.nix | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/krebs/3modules/urlwatch.nix b/krebs/3modules/urlwatch.nix index 61ee72e74..f82e68376 100644 --- a/krebs/3modules/urlwatch.nix +++ b/krebs/3modules/urlwatch.nix @@ -75,10 +75,7 @@ let ]; apply = map (x: getAttr (typeOf x) { set = x; - string = { - url = x; - filter = null; - }; + string.url = x; }); }; verbose = mkOption { @@ -210,6 +207,7 @@ let type = types.str; }; filter = mkOption { + default = null; type = with types; nullOr str; # TODO nullOr subtypes.filter }; }; -- cgit v1.3.1 From b13d9d3149c349160e43e9ea1dbe654829b58ad9 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 13 Aug 2019 09:42:14 +0200 Subject: urlwatch: add ignore_cached option --- krebs/3modules/urlwatch.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/krebs/3modules/urlwatch.nix b/krebs/3modules/urlwatch.nix index f82e68376..79b45c622 100644 --- a/krebs/3modules/urlwatch.nix +++ b/krebs/3modules/urlwatch.nix @@ -210,6 +210,10 @@ let default = null; type = with types; nullOr str; # TODO nullOr subtypes.filter }; + ignore_cached = mkOption { + default = null; + type = with types; nullOr bool; + }; }; }; in out -- cgit v1.3.1 From ccb7fb731c9118f86300b2b02c987b28b079c938 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 13 Aug 2019 09:44:26 +0200 Subject: urlwatch: use writeJSON --- krebs/3modules/urlwatch.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/krebs/3modules/urlwatch.nix b/krebs/3modules/urlwatch.nix index 79b45c622..43535b08f 100644 --- a/krebs/3modules/urlwatch.nix +++ b/krebs/3modules/urlwatch.nix @@ -93,7 +93,7 @@ let hooksFile = cfg.hooksFile; - configFile = pkgs.writeText "urlwatch.yaml" (toJSON { + configFile = pkgs.writeJSON "urlwatch.yaml" { display = { error = true; new = true; @@ -129,7 +129,7 @@ let line_length = 75; }; }; - }); + }; imp = { systemd.timers.urlwatch = { -- cgit v1.3.1 From d81e1101ac47010415f2848d22327cc5c807ef0f Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 13 Aug 2019 20:52:11 +0200 Subject: krops: 1.14.0 -> 1.16.0 --- submodules/krops | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/submodules/krops b/submodules/krops index ee41207df..8f4446000 160000 --- a/submodules/krops +++ b/submodules/krops @@ -1 +1 @@ -Subproject commit ee41207df1ce718e0b154ed8047384118a0133a4 +Subproject commit 8f44460003ae10f543ccb6a29f15b57e42ca3aad -- cgit v1.3.1 From aac6c242e8da2d630da4b712e20622db604da75a Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 14 Aug 2019 13:07:21 +0200 Subject: nix-prefetch-github: init --- krebs/5pkgs/simple/nix-prefetch-github.nix | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 krebs/5pkgs/simple/nix-prefetch-github.nix diff --git a/krebs/5pkgs/simple/nix-prefetch-github.nix b/krebs/5pkgs/simple/nix-prefetch-github.nix new file mode 100644 index 000000000..14096c33f --- /dev/null +++ b/krebs/5pkgs/simple/nix-prefetch-github.nix @@ -0,0 +1,25 @@ +{ curl, jq, nix, writeDashBin }: + +writeDashBin "nix-prefetch-github" '' + # usage: nix-prefetch-github OWNER REPO [REF] + set -efu + + owner=$1 + repo=$2 + ref=''${3-master} + + info_url=https://api.github.com/repos/$owner/$repo/commits/$ref + info=$(${curl}/bin/curl -fsS "$info_url") + rev=$(printf %s "$info" | ${jq}/bin/jq -r .sha) + + name=$owner-$repo-$ref + url=https://github.com/$owner/$repo/tarball/$rev + sha256=$(${nix}/bin/nix-prefetch-url --name "$name" --unpack "$url") + + export owner repo rev sha256 + ${jq}/bin/jq -n ' + env | { + owner, repo, rev, sha256 + } + ' +'' -- cgit v1.3.1 From 38bf02df0aedd219d70be49c363ccac4da2d09ca Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 4 Sep 2019 20:17:02 +0200 Subject: lib: add packageName --- lib/default.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/default.nix b/lib/default.nix index 8ba55b571..14e6e27a3 100644 --- a/lib/default.nix +++ b/lib/default.nix @@ -30,6 +30,9 @@ let listToAttrs (map (name: nameValuePair name set.${name}) (filter (flip hasAttr set) names)); + packageName = pkg: + pkg.pname or (parseDrvName pkg.name).name; + test = re: x: isString x && testString re x; testString = re: x: match re x != null; -- cgit v1.3.1 From 856ee03a203722722fb646c62c36e4b6aabadaee Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 4 Sep 2019 20:17:56 +0200 Subject: treewide: use packageName --- lass/2configs/br.nix | 9 +++++---- makefu/2configs/default.nix | 3 ++- tv/2configs/br.nix | 9 +++++---- tv/2configs/hw/AO753.nix | 2 +- tv/2configs/hw/w110er.nix | 9 +++++---- tv/2configs/xp-332.nix | 2 +- 6 files changed, 19 insertions(+), 15 deletions(-) diff --git a/lass/2configs/br.nix b/lass/2configs/br.nix index ad307c797..e4ccffe23 100644 --- a/lass/2configs/br.nix +++ b/lass/2configs/br.nix @@ -5,10 +5,11 @@ with import ; ]; - krebs.nixpkgs.allowUnfreePredicate = pkg: any (flip hasPrefix pkg.name) [ - "brother-udev-rule-type1-" - "brscan4-" - "mfcl2700dnlpr-" + krebs.nixpkgs.allowUnfreePredicate = pkg: any (eq (packageName pkg)) [ + "brother-udev-rule-type1" + "brscan4" + "brscan4-etc-files" + "mfcl2700dnlpr" ]; hardware.sane = { diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix index 177114a49..5faf3ce93 100644 --- a/makefu/2configs/default.nix +++ b/makefu/2configs/default.nix @@ -31,7 +31,8 @@ with import ; boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest; - nixpkgs.config.allowUnfreePredicate = (pkg: pkgs.lib.hasPrefix "unrar-" pkg.name); + nixpkgs.config.allowUnfreePredicate = pkg: packageName pkg == "unrar"; + krebs = { enable = true; diff --git a/tv/2configs/br.nix b/tv/2configs/br.nix index d660ebc35..e6a46e903 100644 --- a/tv/2configs/br.nix +++ b/tv/2configs/br.nix @@ -5,10 +5,11 @@ with import ; ]; - krebs.nixpkgs.allowUnfreePredicate = pkg: any (flip hasPrefix pkg.name) [ - "brother-udev-rule-type1-" - "brscan4-" - "mfcl2700dnlpr-" + krebs.nixpkgs.allowUnfreePredicate = pkg: any (eq (packageName pkg)) [ + "brother-udev-rule-type1" + "brscan4" + "brscan4-etc-files" + "mfcl2700dnlpr" ]; hardware.sane = { diff --git a/tv/2configs/hw/AO753.nix b/tv/2configs/hw/AO753.nix index 4df5e097a..d5b755cef 100644 --- a/tv/2configs/hw/AO753.nix +++ b/tv/2configs/hw/AO753.nix @@ -39,5 +39,5 @@ with import ; HandleSuspendKey=ignore ''; - krebs.nixpkgs.allowUnfreePredicate = pkg: hasPrefix "broadcom-sta-" pkg.name; + krebs.nixpkgs.allowUnfreePredicate = pkg: packageName pkg == "broadcom-sta"; } diff --git a/tv/2configs/hw/w110er.nix b/tv/2configs/hw/w110er.nix index 55e9482d4..7d837eabc 100644 --- a/tv/2configs/hw/w110er.nix +++ b/tv/2configs/hw/w110er.nix @@ -10,10 +10,11 @@ with import ; #hardware.bumblebee.enable = true; #hardware.bumblebee.group = "video"; #hardware.enableRedistributableFirmware= true; - #krebs.nixpkgs.allowUnfreePredicate = pkg: - # hasPrefix "nvidia-x11-" pkg.name || - # hasPrefix "nvidia-persistenced-" pkg.name || - # hasPrefix "nvidia-settings-" pkg.name; + #krebs.nixpkgs.allowUnfreePredicate = pkg: any (eq (packageName pkg)) [ + # "nvidia-x11" + # "nvidia-persistenced" + # "nvidia-settings" + #]; } ]; diff --git a/tv/2configs/xp-332.nix b/tv/2configs/xp-332.nix index 4a0b0ae16..a66b884c8 100644 --- a/tv/2configs/xp-332.nix +++ b/tv/2configs/xp-332.nix @@ -16,7 +16,7 @@ with import ; }; krebs.nixpkgs.allowUnfreePredicate = pkg: - elem (parseDrvName pkg.name).name [ "imagescan-plugin-networkscan" ]; + packageName pkg == "imagescan-plugin-networkscan"; nixpkgs.overlays = singleton (self: super: { utsushi-customized = self.utsushi.override { -- cgit v1.3.1 From a1ca4c183e25b8ea97657c736e23ac71c1c23a17 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 4 Sep 2019 15:55:20 +0200 Subject: tv utsushi: use pname and version --- tv/5pkgs/simple/utsushi.nix | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/tv/5pkgs/simple/utsushi.nix b/tv/5pkgs/simple/utsushi.nix index 0ae4ed880..9a86feddf 100644 --- a/tv/5pkgs/simple/utsushi.nix +++ b/tv/5pkgs/simple/utsushi.nix @@ -46,7 +46,8 @@ let ''; imagescan-plugin-networkscan = stdenv.mkDerivation rec { - name = "imagescan-plugin-networkscan-${meta.version}"; + pname = "imagescan-plugin-networkscan"; + version = "1.1.2"; src = if stdenv.system == "i686-linux" then @@ -65,14 +66,14 @@ let ]; sha256 = "1wp372hqhzdar6ldxy7s9js2s872x8c5nwq3608dwg9gca11ppc5"; } - else throw "${name} is not supported on ${stdenv.system} (only i686-linux and x86_64 linux are supported)"; + else throw "${pname} is not supported on ${stdenv.system} (only i686-linux and x86_64 linux are supported)"; dontBuild = true; installPhase = '' # Wildcard * stand for either i386 or amd64 ${dpkg}/bin/dpkg -x \ - plugins/imagescan-plugin-networkscan_${meta.version}-1epson4debian9_*.deb \ + plugins/imagescan-plugin-networkscan_${version}-1epson4debian9_*.deb \ tmp mv tmp/usr $out @@ -94,23 +95,23 @@ let This package provides the unfree networkscan plugin from the Epson Image Scan v3 scanner driver bundle, which can be used by Utsushi. ''; - homepage = "http://support.epson.net/linux/en/imagescanv3.php?version=${meta.version}"; + homepage = "http://support.epson.net/linux/en/imagescanv3.php?version=${version}"; license = stdenv.lib.licenses.eapl; maintainers = [ stdenv.lib.maintainers.tv ]; platforms = stdenv.lib.platforms.linux; - version = "1.1.2"; }; }; in stdenv.mkDerivation rec { - name = "utsushi-${meta.version}"; + pname = "utsushi"; + version = "3.55.0"; src = fetchurl { urls = [ - "http://support.epson.net/linux/src/scanner/imagescanv3/debian/imagescan_${meta.version}.orig.tar.gz" - "http://ni.r/~tv/mirrors/epson/imagescan_${meta.version}.orig.tar.gz" + "http://support.epson.net/linux/src/scanner/imagescanv3/debian/imagescan_${version}.orig.tar.gz" + "http://ni.r/~tv/mirrors/epson/imagescan_${version}.orig.tar.gz" ]; sha256 = "0xwl4xp07cigslbi1qc52jsjvxcyvjlx54g812mn7211p01v2h4l"; }; @@ -212,6 +213,5 @@ stdenv.mkDerivation rec { license = stdenv.lib.licenses.gpl3; maintainers = [ stdenv.lib.maintainers.tv ]; platforms = stdenv.lib.platforms.linux; - version = "3.55.0"; }; } -- cgit v1.3.1 From af6f37979cf1efd0166010c7ebee0e8933759e0b Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 4 Sep 2019 16:08:17 +0200 Subject: tv utsushi: 3.55.0 -> 3.59.2 --- tv/5pkgs/simple/utsushi.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tv/5pkgs/simple/utsushi.nix b/tv/5pkgs/simple/utsushi.nix index 9a86feddf..045271321 100644 --- a/tv/5pkgs/simple/utsushi.nix +++ b/tv/5pkgs/simple/utsushi.nix @@ -106,14 +106,14 @@ in stdenv.mkDerivation rec { pname = "utsushi"; - version = "3.55.0"; + version = "3.59.2"; src = fetchurl { urls = [ "http://support.epson.net/linux/src/scanner/imagescanv3/debian/imagescan_${version}.orig.tar.gz" "http://ni.r/~tv/mirrors/epson/imagescan_${version}.orig.tar.gz" ]; - sha256 = "0xwl4xp07cigslbi1qc52jsjvxcyvjlx54g812mn7211p01v2h4l"; + sha256 = "1mns10mpyjprkrh2bjcg2nda9iyrnd0pf1did9py84glpapkzrdq"; }; preConfigure = '' -- cgit v1.3.1 From 099311c6d828d50238ab485b06548874ec620a31 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 4 Sep 2019 16:01:49 +0200 Subject: tv imagescan-plugin-networkscan: 1.1.2 -> 1.1.3 --- tv/5pkgs/simple/utsushi.nix | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/tv/5pkgs/simple/utsushi.nix b/tv/5pkgs/simple/utsushi.nix index 045271321..0414eae09 100644 --- a/tv/5pkgs/simple/utsushi.nix +++ b/tv/5pkgs/simple/utsushi.nix @@ -47,24 +47,24 @@ let imagescan-plugin-networkscan = stdenv.mkDerivation rec { pname = "imagescan-plugin-networkscan"; - version = "1.1.2"; + version = "1.1.3"; src = if stdenv.system == "i686-linux" then fetchurl { urls = [ - "https://download2.ebz.epson.net/imagescanv3/debian/latest1/deb/x86/imagescan-bundle-debian-9-3.55.0.x86.deb.tar.gz" - "http://ni.r/~tv/mirrors/epson/imagescan-bundle-debian-9-3.55.0.x86.deb.tar.gz" + "https://download2.ebz.epson.net/imagescanv3/debian/latest1/deb/x86/imagescan-bundle-debian-9-3.59.2.x86.deb.tar.gz" + "http://ni.r/~tv/mirrors/epson/imagescan-bundle-debian-9-3.59.2.x86.deb.tar.gz" ]; - sha256 = "12syk4y8z22hm9r1lgxqp81vd24jbqgmq83b7yiyqfd4wfxb6k3s"; + sha256 = "1whw96kcfj65h2jnk72xgyr9jj05fa07d0xjxpaqb0zwdag3465g"; } else if stdenv.system == "x86_64-linux" then fetchurl { urls = [ - "https://download2.ebz.epson.net/imagescanv3/debian/latest1/deb/x64/imagescan-bundle-debian-9-3.55.0.x64.deb.tar.gz" - "http://ni.r/~tv/mirrors/epson/imagescan-bundle-debian-9-3.55.0.x64.deb.tar.gz" + "https://download2.ebz.epson.net/imagescanv3/debian/latest1/deb/x64/imagescan-bundle-debian-9-3.59.2.x64.deb.tar.gz" + "http://ni.r/~tv/mirrors/epson/imagescan-bundle-debian-9-3.59.2.x64.deb.tar.gz" ]; - sha256 = "1wp372hqhzdar6ldxy7s9js2s872x8c5nwq3608dwg9gca11ppc5"; + sha256 = "0kd6mrs48wwss54gw4v9fm7ss5ma2xpn6gd1pz26cgjvp6n8hknn"; } else throw "${pname} is not supported on ${stdenv.system} (only i686-linux and x86_64 linux are supported)"; -- cgit v1.3.1 From e388d02623b98bad5db52b29ea1ef1f494fddae8 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 6 Sep 2019 15:07:05 +0200 Subject: exim: init at 4.92.2 because security --- krebs/5pkgs/override/default.nix | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 krebs/5pkgs/override/default.nix diff --git a/krebs/5pkgs/override/default.nix b/krebs/5pkgs/override/default.nix new file mode 100644 index 000000000..704831823 --- /dev/null +++ b/krebs/5pkgs/override/default.nix @@ -0,0 +1,12 @@ +with import ; +self: super: { + + exim = super.exim.overrideAttrs (old: rec { + name = warnOldVersion old.name "exim-4.92.2"; + src = self.fetchurl { + url = "https://ftp.exim.org/pub/exim/exim4/${name}.tar.xz"; + sha256 = "0m56jsh2fzvwj4rdpcc3pkd5vsi40cjrpzalis7l1zq33m4axmq1"; + }; + }); + +} -- cgit v1.3.1