From 9919cb25912dfcc50881239f95494dd2f8e7b858 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Thu, 5 Nov 2020 22:14:09 +0100
Subject: puyak.r: initrd bootstrapping via tor

---
 krebs/2configs/tor/initrd.nix | 50 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 krebs/2configs/tor/initrd.nix

(limited to 'krebs/2configs')

diff --git a/krebs/2configs/tor/initrd.nix b/krebs/2configs/tor/initrd.nix
new file mode 100644
index 000000000..cb6008f73
--- /dev/null
+++ b/krebs/2configs/tor/initrd.nix
@@ -0,0 +1,50 @@
+{config, pkgs, ... }:
+## unlock command:
+# (brain hosts/puyak/luks-ssd;echo)  | ssh root@$(brain krebs-secrets/puyak/initrd/hostname) 'cat > /crypt-ramfs/passphrase'
+{
+  boot.initrd.network.enable = true;
+  boot.initrd.network.ssh = {
+    enable = true;
+    port = 22;
+    authorizedKeys = [
+      config.krebs.users.jeschli-brauerei.pubkey
+      config.krebs.users.lass.pubkey
+      config.krebs.users.lass-mors.pubkey
+      config.krebs.users.makefu.pubkey
+      config.krebs.users.tv.pubkey
+    ];
+    hostECDSAKey = <secrets/initrd/host_ecdsa_key>;
+  };
+  boot.initrd.availableKernelModules = [ "e1000e" ];
+
+  boot.initrd.secrets = {
+    "/etc/tor/onion/bootup" = <secrets/initrd>;
+  };
+
+  boot.initrd.extraUtilsCommands = ''
+    copy_bin_and_libs ${pkgs.tor}/bin/tor
+  '';
+
+  # start tor during boot process
+  boot.initrd.network.postCommands = let
+    torRc = (pkgs.writeText "tor.rc" ''
+      DataDirectory /etc/tor
+      SOCKSPort 127.0.0.1:9050 IsolateDestAddr
+      SOCKSPort 127.0.0.1:9063
+      HiddenServiceDir /etc/tor/onion/bootup
+      HiddenServicePort 22 127.0.0.1:22
+    '');
+  in ''
+    echo "tor: preparing onion folder"
+    # have to do this otherwise tor does not want to start
+    chmod -R 700 /etc/tor
+
+    echo "make sure localhost is up"
+    ip a a 127.0.0.1/8 dev lo
+    ip link set lo up
+
+    echo "tor: starting tor"
+    tor -f ${torRc} --verify-config
+    tor -f ${torRc} &
+  '';
+}
-- 
cgit v1.3.1


From 5e6f56889580d4e2924491a7f471d7994b35212f Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Thu, 12 Nov 2020 10:28:14 +0100
Subject: puyak,wolf: add documentation for imports

update share
---
 krebs/1systems/puyak/config.nix | 20 ++++++++++++--------
 krebs/1systems/wolf/config.nix  |  4 +++-
 krebs/2configs/shack/share.nix  |  3 +++
 3 files changed, 18 insertions(+), 9 deletions(-)

(limited to 'krebs/2configs')

diff --git a/krebs/1systems/puyak/config.nix b/krebs/1systems/puyak/config.nix
index 3357964ef..0cadc3a10 100644
--- a/krebs/1systems/puyak/config.nix
+++ b/krebs/1systems/puyak/config.nix
@@ -27,20 +27,24 @@
     # drivedroid.shack for shackphone
     <stockholm/krebs/2configs/shack/drivedroid.nix>
     # <stockholm/krebs/2configs/shack/nix-cacher.nix>
+
     # Say if muell will be collected
     <stockholm/krebs/2configs/shack/muell_caller.nix>
-    # provide muellshack api
+    # provide muellshack api: muell.shack
     <stockholm/krebs/2configs/shack/muellshack.nix>
-    # provide light control api
-    <stockholm/krebs/2configs/shack/node-light.nix>
-    # light.shack web-ui
-    <stockholm/krebs/2configs/shack/light.shack.nix>
     # send mail if muell was not handled
     <stockholm/krebs/2configs/shack/muell_mail.nix>
-    # send mail if muell was not handled
-    <stockholm/krebs/2configs/shack/s3-power.nix>
+
+    # provide light control api
+    <stockholm/krebs/2configs/shack/node-light.nix> # light.shack lounge.light.shack power.light.shack openhab.shack lightapi.shack
+    # light.shack web-ui
+    <stockholm/krebs/2configs/shack/light.shack.nix> #light.shack
+
     # powerraw usb serial to mqtt and raw socket
-    <stockholm/krebs/2configs/shack/powerraw.nix>
+    <stockholm/krebs/2configs/shack/powerraw.nix> # powerraw.shack standby.shack
+    # send power stats to s3
+    <stockholm/krebs/2configs/shack/s3-power.nix> # powerraw.shack must be available
+
 
     { # do not log to /var/spool/log
       services.nginx.appendHttpConfig = ''
diff --git a/krebs/1systems/wolf/config.nix b/krebs/1systems/wolf/config.nix
index 0c95f4d13..25e7c5f06 100644
--- a/krebs/1systems/wolf/config.nix
+++ b/krebs/1systems/wolf/config.nix
@@ -15,8 +15,10 @@ in
     <stockholm/krebs/2configs/binary-cache/prism.nix>
 
     #### shackspace services
-    <stockholm/krebs/2configs/shack/share.nix>
+    <stockholm/krebs/2configs/shack/share.nix> # wolf.shack
 
+    # gitlab runner
+    <stockholm/krebs/2configs/shack/gitlab-runner.nix>
     # misc
     <stockholm/krebs/2configs/shack/ssh-keys.nix>
     <stockholm/krebs/2configs/save-diskspace.nix>
diff --git a/krebs/2configs/shack/share.nix b/krebs/2configs/shack/share.nix
index 465d6ef69..d8d65d309 100644
--- a/krebs/2configs/shack/share.nix
+++ b/krebs/2configs/shack/share.nix
@@ -37,6 +37,9 @@
       # for legacy systems
       client min protocol = NT1
       server min protocol = NT1
+      workgroup = WORKGROUP
+      server string = ${config.networking.hostName}
+      netbios name = ${config.networking.hostName}
     '';
   };
 }
-- 
cgit v1.3.1