From b60be1128bf5525cf78b9b57afd19e001cd5a9d3 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 2 May 2023 20:39:46 +0200
Subject: konsens: all directories are safe

---
 krebs/3modules/konsens.nix | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'krebs/3modules')

diff --git a/krebs/3modules/konsens.nix b/krebs/3modules/konsens.nix
index 439bcc7f4..d27a702fb 100644
--- a/krebs/3modules/konsens.nix
+++ b/krebs/3modules/konsens.nix
@@ -66,6 +66,8 @@ let
           Type = "simple";
           PermissionsStartOnly = true;
           ExecStart = pkgs.writeDash "konsens-${name}" ''
+            set -efu
+            git config --global --replace-all safe.directory *
             if ! test -e ${name}; then
               git clone ${repo.url} ${name}
             fi
-- 
cgit v1.2.3


From 4faebce3c6a2e9c3a5c6a3f4bd89ab683b65ca58 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 2 May 2023 21:28:13 +0200
Subject: konsens: add ssh to pkgs

---
 krebs/3modules/konsens.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'krebs/3modules')

diff --git a/krebs/3modules/konsens.nix b/krebs/3modules/konsens.nix
index d27a702fb..81dbb33e1 100644
--- a/krebs/3modules/konsens.nix
+++ b/krebs/3modules/konsens.nix
@@ -60,7 +60,10 @@ let
     systemd.services = mapAttrs' (name: repo:
       nameValuePair "konsens-${name}" {
         after = [ "network.target" ];
-        path = [ pkgs.git ];
+        path = [
+          pkgs.git
+          pkgs.openssh
+        ];
         restartIfChanged = false;
         serviceConfig = {
           Type = "simple";
-- 
cgit v1.2.3


From e3c8492f30a2c73acfb43478d8ceb8c38d7fa777 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 15 May 2023 13:31:19 +0200
Subject: tinc: use DynamicUser

---
 krebs/3modules/tinc.nix | 37 ++++++++++---------------------------
 1 file changed, 10 insertions(+), 27 deletions(-)

(limited to 'krebs/3modules')

diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix
index 52cdafe67..437f3b633 100644
--- a/krebs/3modules/tinc.nix
+++ b/krebs/3modules/tinc.nix
@@ -190,35 +190,16 @@ with import <stockholm/lib>;
           default = 3;
         };
 
-        user = mkOption {
-          type = types.user;
-          default = {
-            name = tinc.config.netname;
-            home = "/var/lib/${tinc.config.user.name}";
-          };
-          defaultText = {
-            name = "‹netname›";
-            home = "/var/lib/‹netname›";
-          };
+        username = mkOption {
+          type = types.username;
+          default = tinc.config.netname;
+          defaultText = literalExample "netname";
         };
       };
     }));
   };
 
   config = {
-    users.users = mapAttrs' (netname: cfg:
-      nameValuePair "${netname}" {
-        inherit (cfg.user) home name uid;
-        createHome = true;
-        isSystemUser = true;
-        group = netname;
-      }
-    ) config.krebs.tinc;
-
-    users.groups = mapAttrs' (netname: cfg:
-      nameValuePair netname {}
-    ) config.krebs.tinc;
-
     krebs.systemd.services = mapAttrs (netname: cfg: {
       restartIfCredentialsChange = true;
     }) config.krebs.tinc;
@@ -238,11 +219,11 @@ with import <stockholm/lib>;
           )
           "rsa_key.priv:${cfg.privkey}"
         ];
-        ExecStartPre = pkgs.writers.writeDash "init-tinc-${netname}" ''
+        ExecStartPre = "+" + pkgs.writers.writeDash "init-tinc-${netname}" ''
           set -efu
           ${pkgs.coreutils}/bin/mkdir -p /etc/tinc
           ${pkgs.rsync}/bin/rsync -Lacv --delete \
-            --chown ${cfg.user.name} \
+            --chown ${cfg.username} \
             --chmod u=rwX,g=rX \
             --exclude='/*.priv' \
             ${cfg.confDir}/ /etc/tinc/${netname}/
@@ -255,14 +236,16 @@ with import <stockholm/lib>;
               "$CREDENTIALS_DIRECTORY"/rsa_key.priv \
               /etc/tinc/${netname}/
         '';
-        ExecStart = toString [
+        ExecStart = "+" + toString [
           "${cfg.tincPackage}/sbin/tincd"
           "-D"
-          "-U ${cfg.user.name}"
+          "-U ${cfg.username}"
           "-d 0"
           "-n ${netname}"
         ];
         SyslogIdentifier = netname;
+        DynamicUser = true;
+        User = cfg.username;
       };
     }) config.krebs.tinc;
   };
-- 
cgit v1.2.3