From 6121befdb64cccf9ff9a562b42217289c43c67f4 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 26 Apr 2016 23:58:36 +0200
Subject: wu: disable tor

---
 tv/1systems/wu.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 27dd12520..cebd7c9e4 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -183,7 +183,5 @@ with config.krebs.lib;
     KERNEL=="hpet", GROUP="audio"
   '';
 
-  services.tor.client.enable = true;
-  services.tor.enable = true;
   services.virtualboxHost.enable = true;
 }
-- 
cgit v1.2.3


From 87dabec64d9dbe35f1fcc35b7b4c8ab00a02cf84 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 27 Apr 2016 01:33:39 +0200
Subject: krebs types.group: init

---
 krebs/4lib/types.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index 405a91e45..56d1d55c3 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -213,6 +213,18 @@ types // rec {
       };
     };
   });
+  group = submodule ({ config, ... }: {
+    options = {
+      name = mkOption {
+        type = username;
+        default = config._module.args.name;
+      };
+      gid = mkOption {
+        type = int;
+        default = genid config.name;
+      };
+    };
+  });
 
   addr = either addr4 addr6;
   addr4 = mkOptionType {
-- 
cgit v1.2.3


From f9d42f3a814a316b3dc0a517b76d6dadcfa8b6a8 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 27 Apr 2016 01:03:47 +0200
Subject: import NixOS' services.exim

---
 krebs/3modules/exim.nix | 111 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 111 insertions(+)
 create mode 100644 krebs/3modules/exim.nix

diff --git a/krebs/3modules/exim.nix b/krebs/3modules/exim.nix
new file mode 100644
index 000000000..e0890d96a
--- /dev/null
+++ b/krebs/3modules/exim.nix
@@ -0,0 +1,111 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib) mkIf mkOption singleton types;
+  inherit (pkgs) coreutils exim;
+  cfg = config.services.exim;
+in
+
+{
+
+  ###### interface
+
+  options = {
+
+    services.exim = {
+
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to enable the Exim mail transfer agent.";
+      };
+
+      config = mkOption {
+        type = types.string;
+        default = "";
+        description = ''
+          Verbatim Exim configuration.  This should not contain exim_user,
+          exim_group, exim_path, or spool_directory.
+        '';
+      };
+
+      user = mkOption {
+        type = types.string;
+        default = "exim";
+        description = ''
+          User to use when no root privileges are required.
+          In particular, this applies when receiving messages and when doing
+          remote deliveries.  (Local deliveries run as various non-root users,
+          typically as the owner of a local mailbox.) Specifying this value
+          as root is not supported.
+        '';
+      };
+
+      group = mkOption {
+        type = types.string;
+        default = "exim";
+        description = ''
+          Group to use when no root privileges are required.
+        '';
+      };
+
+      spoolDir = mkOption {
+        type = types.string;
+        default = "/var/spool/exim";
+        description = ''
+          Location of the spool directory of exim.
+        '';
+      };
+
+    };
+
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+
+    environment = {
+      etc."exim.conf".text = ''
+        exim_user = ${cfg.user}
+        exim_group = ${cfg.group}
+        exim_path = /var/setuid-wrappers/exim
+        spool_directory = ${cfg.spoolDir}
+        ${cfg.config}
+      '';
+      systemPackages = [ exim ];
+    };
+
+    users.extraUsers = singleton {
+      name = cfg.user;
+      description = "Exim mail transfer agent user";
+      uid = config.ids.uids.exim;
+      group = cfg.group;
+    };
+
+    users.extraGroups = singleton {
+      name = cfg.group;
+      gid = config.ids.gids.exim;
+    };
+
+    security.setuidPrograms = [ "exim" ];
+
+    systemd.services.exim = {
+      description = "Exim Mail Daemon";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart   = "${exim}/bin/exim -bdf -q30m";
+        ExecReload  = "${coreutils}/bin/kill -HUP $MAINPID";
+      };
+      preStart = ''
+        if ! test -d ${cfg.spoolDir}; then
+          ${coreutils}/bin/mkdir -p ${cfg.spoolDir}
+          ${coreutils}/bin/chown ${cfg.user}:${cfg.group} ${cfg.spoolDir}
+        fi
+      '';
+    };
+
+  };
+
+}
-- 
cgit v1.2.3


From 96301634b906182be0d8a5d669481da309f4a17a Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 27 Apr 2016 01:10:25 +0200
Subject: services.exim -> krebs.exim

---
 krebs/3modules/default.nix |   1 +
 krebs/3modules/exim.nix    | 157 ++++++++++++++++++---------------------------
 2 files changed, 64 insertions(+), 94 deletions(-)

diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 9dac50d55..e87b33600 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -13,6 +13,7 @@ let
       ./buildbot/slave.nix
       ./build.nix
       ./current.nix
+      ./exim.nix
       ./exim-retiolum.nix
       ./exim-smarthost.nix
       ./fetchWallpaper.nix
diff --git a/krebs/3modules/exim.nix b/krebs/3modules/exim.nix
index e0890d96a..16a2a37b6 100644
--- a/krebs/3modules/exim.nix
+++ b/krebs/3modules/exim.nix
@@ -1,111 +1,80 @@
-{ config, lib, pkgs, ... }:
-
-let
-  inherit (lib) mkIf mkOption singleton types;
-  inherit (pkgs) coreutils exim;
-  cfg = config.services.exim;
-in
-
-{
-
-  ###### interface
-
-  options = {
-
-    services.exim = {
-
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Whether to enable the Exim mail transfer agent.";
-      };
-
-      config = mkOption {
-        type = types.string;
-        default = "";
-        description = ''
-          Verbatim Exim configuration.  This should not contain exim_user,
-          exim_group, exim_path, or spool_directory.
-        '';
-      };
-
-      user = mkOption {
-        type = types.string;
-        default = "exim";
-        description = ''
-          User to use when no root privileges are required.
-          In particular, this applies when receiving messages and when doing
-          remote deliveries.  (Local deliveries run as various non-root users,
-          typically as the owner of a local mailbox.) Specifying this value
-          as root is not supported.
-        '';
-      };
-
-      group = mkOption {
-        type = types.string;
-        default = "exim";
-        description = ''
-          Group to use when no root privileges are required.
-        '';
+{ config, lib, pkgs, ... }: with config.krebs.lib; let
+  cfg = config.krebs.exim;
+in {
+  options.krebs.exim = {
+    enable = mkEnableOption "krebs.exim";
+    config = mkOption {
+      type = types.str;
+      default = "";
+      description = ''
+        Verbatim Exim configuration.  This should not contain exim_user,
+        exim_group, exim_path, or spool_directory.
+      '';
+    };
+    user = mkOption {
+      type = types.user;
+      default = {
+        name = "exim";
+        home = "/var/spool/exim";
       };
-
-      spoolDir = mkOption {
-        type = types.string;
-        default = "/var/spool/exim";
-        description = ''
-          Location of the spool directory of exim.
-        '';
+      description = ''
+        User to use when no root privileges are required.
+        In particular, this applies when receiving messages and when doing
+        remote deliveries.  (Local deliveries run as various non-root users,
+        typically as the owner of a local mailbox.) Specifying this value
+        as root is not supported.
+      '';
+    };
+    group = mkOption {
+      type = types.group;
+      default = {
+        name = "exim";
       };
-
+      description = ''
+        Group to use when no root privileges are required.
+      '';
     };
-
   };
-
-
-  ###### implementation
-
-  config = mkIf cfg.enable {
-
+  config = lib.mkIf cfg.enable {
     environment = {
       etc."exim.conf".text = ''
-        exim_user = ${cfg.user}
-        exim_group = ${cfg.group}
+        exim_user = ${cfg.user.name}
+        exim_group = ${cfg.group.name}
         exim_path = /var/setuid-wrappers/exim
-        spool_directory = ${cfg.spoolDir}
+        spool_directory = ${cfg.user.home}
         ${cfg.config}
       '';
-      systemPackages = [ exim ];
-    };
-
-    users.extraUsers = singleton {
-      name = cfg.user;
-      description = "Exim mail transfer agent user";
-      uid = config.ids.uids.exim;
-      group = cfg.group;
+      systemPackages = [ pkgs.exim ];
     };
-
-    users.extraGroups = singleton {
-      name = cfg.group;
-      gid = config.ids.gids.exim;
+    krebs.setuid = {
+      exim = {
+        filename = "${pkgs.exim}/bin/exim";
+        mode = "4111";
+      };
+      sendmail = {
+        filename = "${pkgs.exim}/bin/exim";
+        mode = "4111";
+      };
     };
-
-    security.setuidPrograms = [ "exim" ];
-
     systemd.services.exim = {
-      description = "Exim Mail Daemon";
-      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [
+        config.environment.etc."exim.conf".source
+      ];
       serviceConfig = {
-        ExecStart   = "${exim}/bin/exim -bdf -q30m";
-        ExecReload  = "${coreutils}/bin/kill -HUP $MAINPID";
+        ExecStart = "${pkgs.exim}/bin/exim -bdf -q30m";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+      };
+      wantedBy = [ "multi-user.target" ];
+    };
+    users = {
+      groups.${cfg.group.name} = {
+        inherit (cfg.group) name gid;
+      };
+      users.${cfg.user.name} = {
+        inherit (cfg.user) home name uid;
+        createHome = true;
+        group = cfg.group.name;
       };
-      preStart = ''
-        if ! test -d ${cfg.spoolDir}; then
-          ${coreutils}/bin/mkdir -p ${cfg.spoolDir}
-          ${coreutils}/bin/chown ${cfg.user}:${cfg.group} ${cfg.spoolDir}
-        fi
-      '';
     };
-
   };
-
 }
-- 
cgit v1.2.3


From 4abd59f59d8541a93ccbf1e76d1f9b95c44a9bf2 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 27 Apr 2016 01:54:58 +0200
Subject: krebs.exim-{retiolum,smarthost}: use krebs.exim

---
 krebs/3modules/exim-retiolum.nix  | 2 +-
 krebs/3modules/exim-smarthost.nix | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/krebs/3modules/exim-retiolum.nix b/krebs/3modules/exim-retiolum.nix
index 696c48baf..8b6ac4a4e 100644
--- a/krebs/3modules/exim-retiolum.nix
+++ b/krebs/3modules/exim-retiolum.nix
@@ -32,7 +32,7 @@ let
   };
 
   imp = {
-    services.exim = {
+    krebs.exim = {
       enable = true;
       config =
         # This configuration makes only sense for retiolum-enabled hosts.
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
index a01ab543b..8d9227039 100644
--- a/krebs/3modules/exim-smarthost.nix
+++ b/krebs/3modules/exim-smarthost.nix
@@ -105,7 +105,7 @@ let
         requires = [ "secret.service" ];
       };
     };
-    services.exim = {
+    krebs.exim = {
       enable = true;
       config = ''
         keep_environment =
-- 
cgit v1.2.3


From 92605d46b2d770b4724809fcb2267c1618ae0b59 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 27 Apr 2016 02:00:26 +0200
Subject: tv exim: drop krebs.setuid.sendmail

---
 tv/2configs/exim-retiolum.nix  | 4 ----
 tv/2configs/exim-smarthost.nix | 4 ----
 2 files changed, 8 deletions(-)

diff --git a/tv/2configs/exim-retiolum.nix b/tv/2configs/exim-retiolum.nix
index dbe83dcf1..9197a3c30 100644
--- a/tv/2configs/exim-retiolum.nix
+++ b/tv/2configs/exim-retiolum.nix
@@ -4,9 +4,5 @@ with config.krebs.lib;
 
 {
   krebs.exim-retiolum.enable = true;
-  krebs.setuid.sendmail = {
-    filename = "${pkgs.exim}/bin/exim";
-    mode = "4111";
-  };
   tv.iptables.input-retiolum-accept-new-tcp = singleton "smtp";
 }
diff --git a/tv/2configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix
index 2b9ad77d7..3616a8f52 100644
--- a/tv/2configs/exim-smarthost.nix
+++ b/tv/2configs/exim-smarthost.nix
@@ -43,9 +43,5 @@ with config.krebs.lib;
       { from = "mirko"; to = "mv"; }
     ];
   };
-  krebs.setuid.sendmail = {
-    filename = "${pkgs.exim}/bin/exim";
-    mode = "4111";
-  };
   tv.iptables.input-internet-accept-new-tcp = singleton "smtp";
 }
-- 
cgit v1.2.3


From 1241c61b8867b46a572605a69dd9b1fead65aa2b Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 27 Apr 2016 02:24:20 +0200
Subject: test-all-krebs-modules: disable exim-retiolum

---
 shared/1systems/test-all-krebs-modules.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/shared/1systems/test-all-krebs-modules.nix b/shared/1systems/test-all-krebs-modules.nix
index 5c3ba9421..0084a7837 100644
--- a/shared/1systems/test-all-krebs-modules.nix
+++ b/shared/1systems/test-all-krebs-modules.nix
@@ -19,10 +19,11 @@ in {
       username = "lol";
       password = "wut";
     };
-    exim-retiolum = {
-      enable = true;
-      primary_hostname = "test.r";
-    };
+    # XXX exim-retiolum and exim-smarthost are mutually exclusive
+    #exim-retiolum = {
+    #  enable = true;
+    #  primary_hostname = "test.r";
+    #};
     exim-smarthost = {
       enable = true;
       primary_hostname = "test.r";
-- 
cgit v1.2.3