From 67d3a55df5dd7a96d21781a581c249a9e50caaec Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 22 Mar 2019 07:57:34 +0100 Subject: k: add syncthing module --- krebs/3modules/default.nix | 1 + krebs/3modules/syncthing.nix | 129 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 130 insertions(+) create mode 100644 krebs/3modules/syncthing.nix (limited to 'krebs/3modules') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 9c2f53cbe..567c077eb 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -48,6 +48,7 @@ let ./rtorrent.nix ./secret.nix ./setuid.nix + ./syncthing.nix ./tinc.nix ./tinc_graphs.nix ./urlwatch.nix diff --git a/krebs/3modules/syncthing.nix b/krebs/3modules/syncthing.nix new file mode 100644 index 000000000..389da81d4 --- /dev/null +++ b/krebs/3modules/syncthing.nix @@ -0,0 +1,129 @@ +{ config, pkgs, ... }: with import ; + +let + + cfg = config.krebs.syncthing; + + devices = mapAttrsToList (name: peer: { + name = name; + deviceID = peer.id; + addresses = peer.addresses; + }) cfg.peers; + + folders = map (folder: { + inherit (folder) path type; + id = folder.path; + devices = map (peer: { deviceId = cfg.peers.${peer}.id; }) folder.peers; + rescanIntervalS = folder.rescanInterval; + }) cfg.folders; + + getApiKey = pkgs.writeDash "getAPIKey" '' + ${pkgs.libxml2}/bin/xmllint \ + --xpath 'string(configuration/gui/apikey)'\ + ${config.services.syncthing.dataDir}/config.xml + ''; + + updateConfig = pkgs.writeDash "merge-syncthing-config" '' + set -efu + API_KEY=$(${getApiKey}) + CFG=$(${pkgs.curl}/bin/curl -Ss -H "X-API-Key: $API_KEY" localhost:8384/rest/system/config) + echo "$CFG" | ${pkgs.jq}/bin/jq -s '.[] * { + "devices": ${builtins.toJSON devices}, + "folders": ${builtins.toJSON folders} + }' | ${pkgs.curl}/bin/curl -Ss -H "X-API-Key: $API_KEY" localhost:8384/rest/system/config -d @- + ${pkgs.curl}/bin/curl -Ss -H "X-API-Key: $API_KEY" localhost:8384/rest/system/restart -X POST + ''; + +in + +{ + options.krebs.syncthing = { + + enable = mkEnableOption "syncthing-init"; + + id = mkOption { + type = types.str; + default = config.krebs.build.host.name; + }; + + cert = mkOption { + type = types.nullOr types.absolute-pathname; + default = null; + }; + + key = mkOption { + type = types.nullOr types.absolute-pathname; + default = null; + }; + + peers = mkOption { + default = {}; + type = types.attrsOf (types.submodule ({ + options = { + + # TODO make into addr + port submodule + addresses = mkOption { + type = types.listOf types.str; + default = []; + }; + + #TODO check + id = mkOption { + type = types.str; + }; + + }; + })); + }; + + folders = mkOption { + default = []; + type = types.listOf (types.submodule ({ + options = { + + path = mkOption { + type = types.absolute-pathname; + }; + + peers = mkOption { + type = types.listOf types.str; + default = []; + }; + + rescanInterval = mkOption { + type = types.int; + default = 60; + }; + + type = mkOption { + type = types.enum [ "sendreceive" "sendonly" "receiveonly" ]; + default = "sendreceive"; + }; + + }; + })); + }; + }; + + config = (mkIf cfg.enable) { + + systemd.services.syncthing = mkIf (cfg.cert != null || cfg.key != null) { + preStart = '' + ${optionalString (cfg.cert != null) "cp ${toString cfg.cert} ${config.services.syncthing.dataDir}/cert.pem"} + ${optionalString (cfg.key != null) "cp ${toString cfg.key} ${config.services.syncthing.dataDir}/key.pem"} + ''; + }; + + systemd.services.syncthing-init = { + after = [ "syncthing.service" ]; + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + User = config.services.syncthing.user; + RemainAfterExit = true; + Type = "oneshot"; + ExecStart = updateConfig; + }; + }; + }; +} -- cgit v1.2.3 From 90ab9c288e0baa6f2e7f7b2e7cdffd10bda89938 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 22 Mar 2019 08:01:03 +0100 Subject: l: add syncthing ids for mors, icarus & skynet --- krebs/3modules/lass/default.nix | 3 +++ 1 file changed, 3 insertions(+) (limited to 'krebs/3modules') diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index 630c14f18..6849f0813 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -204,6 +204,7 @@ in { secure = true; ssh.privkey.path = ; ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAMPlIG+6u75GJ3kvsPF6OoIZsU+u8ZQ+rdviv5fNMD"; + syncthing.id = "ZPRS57K-YK32ROQ-7A6MRAV-VOYXQ3I-CQCXISZ-C5PCV2A-GSFLG3I-K7UGGAH"; }; shodan = { cores = 2; @@ -270,6 +271,7 @@ in { secure = true; ssh.privkey.path = ; ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOPgQIMYiyD4/Co+nlOQWEzCKssemOEXAY/lbIZZaMhj"; + syncthing.id = "7V75LMM-MIFCAIZ-TAWR3AI-OXONVZR-TEW4GBK-URKPPN4-PQFG653-LGHPDQ4"; }; daedalus = { cores = 2; @@ -328,6 +330,7 @@ in { secure = true; ssh.privkey.path = ; ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEB/MmASvx3i09DY1xFVM5jOhZRZA8rMRqtf8bCIkC+t"; + syncthing.id = "KWGPAHH-H53Y2WL-SDAUVQE-7PMYRVP-6Q2INYB-FL535EO-HIE7425-ZCNP7A3"; }; littleT = { cores = 2; -- cgit v1.2.3 From e1f33f0b588cbdc28a91790ee372359678ae8dbe Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 23 Mar 2019 14:18:03 +0100 Subject: l littleT: add wiregrill & syncthing --- krebs/3modules/lass/default.nix | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'krebs/3modules') diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index 6849f0813..eaba2d734 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -368,10 +368,18 @@ in { -----END RSA PUBLIC KEY----- ''; }; + wiregrill = { + ip6.addr = w6 "771e"; + aliases = [ + "littleT.w" + ]; + wireguard.pubkey = "VfSTPO1XGqLqujAGCov1yA0WxyRXJndZCW5XYkScNXg="; + }; }; secure = true; ssh.privkey.path = ; ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJzb9BPFClubs6wSOi/ivqPFVPlowXwAxBS0jHaB29hX"; + syncthing.id = "PCDXICO-GMGWKSB-V6CYF3I-LQMZSGV-B7YBJXA-DVO7KXN-TFCSQXW-XY6WNQD"; }; red = { monitoring = false; -- cgit v1.2.3 From c3a1847b9826b9bd08bbf21d006ce7e5e3fe57e1 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 23 Mar 2019 16:02:07 +0100 Subject: l blue: add syncthing.id --- krebs/3modules/lass/default.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'krebs/3modules') diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index eaba2d734..575ff3d62 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -485,6 +485,7 @@ in { }; ssh.privkey.path = ; ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSBxtPf8yJfzzI7/iYpoRSc/TT+zYmE/HM9XWS3MZlv"; + syncthing.id = "J2LMIPD-PBEPVKL-A3MN6NQ-KL6DZ4N-K4GGWZB-E2EPLFN-PDLVAOC-DCSZHAD"; }; phone = { nets = { -- cgit v1.2.3 From 84d0489583e2ee8a299d066e57e28f899c23c3d5 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 23 Mar 2019 16:03:20 +0100 Subject: l phone: add syncthing.id --- krebs/3modules/lass/default.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'krebs/3modules') diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index 575ff3d62..7352d36e9 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -499,6 +499,7 @@ in { }; external = true; ci = false; + syncthing.id = "V6D4CKT-7POOIKX-KB6UM7R-3R774RB-DSZ26FE-MSW3VTO-6AIJCIA-ZHJXKA7"; }; morpheus = { cores = 1; -- cgit v1.2.3 From 0bb9321d1b979f64703c22fa6c25a46776da50af Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 23 Mar 2019 16:04:01 +0100 Subject: syncthing folders: add watch & ignorePerms options --- krebs/3modules/syncthing.nix | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'krebs/3modules') diff --git a/krebs/3modules/syncthing.nix b/krebs/3modules/syncthing.nix index 389da81d4..485dd3991 100644 --- a/krebs/3modules/syncthing.nix +++ b/krebs/3modules/syncthing.nix @@ -15,6 +15,9 @@ let id = folder.path; devices = map (peer: { deviceId = cfg.peers.${peer}.id; }) folder.peers; rescanIntervalS = folder.rescanInterval; + fsWatcherEnabled = folder.watch; + fsWatcherDelayS = folder.watchDelay; + ignorePerms = folder.ignorePerms; }) cfg.folders; getApiKey = pkgs.writeDash "getAPIKey" '' @@ -100,6 +103,21 @@ in default = "sendreceive"; }; + watch = mkOption { + type = types.bool; + default = true; + }; + + watchDelay = mkOption { + type = types.int; + default = 10; + }; + + ignorePerms = mkOption { + type = types.bool; + default = true; + }; + }; })); }; -- cgit v1.2.3 From 86150b31f20772c761dac2ce76862928bcc07537 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 23 Mar 2019 16:04:22 +0100 Subject: syncthing: wait for service startup --- krebs/3modules/syncthing.nix | 2 ++ 1 file changed, 2 insertions(+) (limited to 'krebs/3modules') diff --git a/krebs/3modules/syncthing.nix b/krebs/3modules/syncthing.nix index 485dd3991..e7f95f7fc 100644 --- a/krebs/3modules/syncthing.nix +++ b/krebs/3modules/syncthing.nix @@ -28,6 +28,8 @@ let updateConfig = pkgs.writeDash "merge-syncthing-config" '' set -efu + # wait for service to restart + ${pkgs.untilport}/bin/untilport localhost 8384 API_KEY=$(${getApiKey}) CFG=$(${pkgs.curl}/bin/curl -Ss -H "X-API-Key: $API_KEY" localhost:8384/rest/system/config) echo "$CFG" | ${pkgs.jq}/bin/jq -s '.[] * { -- cgit v1.2.3 From 67ca249e33e977a83b54b21ad7c717e3eaa38d84 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 23 Mar 2019 16:04:50 +0100 Subject: syncthing: increase rescanInterval to track upstream --- krebs/3modules/syncthing.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs/3modules') diff --git a/krebs/3modules/syncthing.nix b/krebs/3modules/syncthing.nix index e7f95f7fc..3c60eec4b 100644 --- a/krebs/3modules/syncthing.nix +++ b/krebs/3modules/syncthing.nix @@ -97,7 +97,7 @@ in rescanInterval = mkOption { type = types.int; - default = 60; + default = 3600; }; type = mkOption { -- cgit v1.2.3 From 1c014eb05c0022906629ee7fb9189cf6764ddc2f Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 7 Apr 2019 18:08:54 +0200 Subject: l prism.r: add syncthing.id --- krebs/3modules/lass/default.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'krebs/3modules') diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index 7352d36e9..0b5eb93ce 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -106,6 +106,7 @@ in { }; ssh.privkey.path = ; ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAsANFdMi825qWQXQbWLYuNZ6/fARt3lnh1KStQHQQMD"; + syncthing.id = "QITFKYQ-VEPIPL2-AZIXHMD-BBT62ML-YHSB35A-BSUIBXS-QYMPFHW-M7XN2QU"; }; archprism = { cores = 1; -- cgit v1.2.3 From a8c958821dcc9912dddb6727a4ad74a4dbcbe02f Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 7 Apr 2019 18:10:02 +0200 Subject: l skynet.r: add wiregrill --- krebs/3modules/lass/default.nix | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'krebs/3modules') diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index 0b5eb93ce..9c18f8a73 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -327,6 +327,13 @@ in { -----END RSA PUBLIC KEY----- ''; }; + wiregrill = { + ip6.addr = w6 "5ce7"; + aliases = [ + "skynet.w" + ]; + wireguard.pubkey = "pt9a6nP+YPqxnSskcM9NqRmAmFzbO5bE7wzViFFonnU="; + }; }; secure = true; ssh.privkey.path = ; -- cgit v1.2.3 From e56e7fbe7103f4c570bf8e4cdee764b9ad0b5062 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 7 Apr 2019 18:19:05 +0200 Subject: l phone.w: rotate all keys --- krebs/3modules/lass/default.nix | 4 ++-- krebs/3modules/lass/ssh/android.rsa | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) (limited to 'krebs/3modules') diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index 9c18f8a73..146d7a441 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -502,12 +502,12 @@ in { aliases = [ "phone.w" ]; - wireguard.pubkey = "zVunBVOxsMETlnHkgjfH71HaZjjNUOeYNveAVv5z3jw="; + wireguard.pubkey = "MRicxap2VxPnzmXoOqqjQNGWJ54cQC8Tfy28+IXXsxM="; }; }; external = true; ci = false; - syncthing.id = "V6D4CKT-7POOIKX-KB6UM7R-3R774RB-DSZ26FE-MSW3VTO-6AIJCIA-ZHJXKA7"; + syncthing.id = "DUFMX7V-HNR6WXM-LZB5LJE-TM6QIOH-MTGHEUJ-QSD3XIY-YRFJLOR-G6Y3XQB"; }; morpheus = { cores = 1; diff --git a/krebs/3modules/lass/ssh/android.rsa b/krebs/3modules/lass/ssh/android.rsa index 3d35b76e4..675ba8df2 100644 --- a/krebs/3modules/lass/ssh/android.rsa +++ b/krebs/3modules/lass/ssh/android.rsa @@ -1 +1 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOPH4c2zQCaCmus4T9GvaY1lrgVR9CKV3Fx1vRn1K1XB u0_a194@android +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPF7RHU4q6w1f3xWcfeAD6u23jDs2fd/H3IuxdT5G1ZL -- cgit v1.2.3 From 212e7f4b9843790e29fd990a17279dc96e181baf Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 7 Apr 2019 18:21:18 +0200 Subject: syncthing: add id option --- krebs/3modules/syncthing.nix | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'krebs/3modules') diff --git a/krebs/3modules/syncthing.nix b/krebs/3modules/syncthing.nix index 3c60eec4b..34879fd3f 100644 --- a/krebs/3modules/syncthing.nix +++ b/krebs/3modules/syncthing.nix @@ -11,8 +11,7 @@ let }) cfg.peers; folders = map (folder: { - inherit (folder) path type; - id = folder.path; + inherit (folder) path id type; devices = map (peer: { deviceId = cfg.peers.${peer}.id; }) folder.peers; rescanIntervalS = folder.rescanInterval; fsWatcherEnabled = folder.watch; @@ -83,13 +82,18 @@ in folders = mkOption { default = []; - type = types.listOf (types.submodule ({ + type = types.listOf (types.submodule ({ config, ... }: { options = { path = mkOption { type = types.absolute-pathname; }; + id = mkOption { + type = types.str; + default = config.path; + }; + peers = mkOption { type = types.listOf types.str; default = []; -- cgit v1.2.3 From 44a48a8d3a4ce4732545a96828bf41ab6cf283da Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 7 Apr 2019 19:35:34 +0200 Subject: l: add green.r --- krebs/3modules/lass/default.nix | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) (limited to 'krebs/3modules') diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index 146d7a441..a3b8cab39 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -495,6 +495,46 @@ in { ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSBxtPf8yJfzzI7/iYpoRSc/TT+zYmE/HM9XWS3MZlv"; syncthing.id = "J2LMIPD-PBEPVKL-A3MN6NQ-KL6DZ4N-K4GGWZB-E2EPLFN-PDLVAOC-DCSZHAD"; }; + + green = { + cores = 1; + nets = { + retiolum = { + ip4.addr = "10.243.0.66"; + ip6.addr = r6 "12ee"; + aliases = [ + "green.r" + ]; + tinc.pubkey = '' + -----BEGIN PUBLIC KEY----- + MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAwpgFxMxWQ0Cp3I82bLWk + uoDBjWqhM9Pgq6PJSpJjyNAgMkKJcQnWi0WpELaHISAVqjdPGUQSLiar++JN3YBx + ZQGFiucG0ijVJKAUbQQDYbc+RGK8MGO2v3Bv/6E56UKjxtT1zjjvkyXpSC7FN477 + n9IfsvIzH/RLcAP5VnHBYqZ467UR4rqi7T7yWjrEgr+VirY9Opp9LM9YozlbRrlI + hYshk5RET/EvOSwYlw/KJEMMmYHro74neZKIVKoXD3CSE66rncNmdFwD3ZXVxYn6 + m3Eob8ojWPW+CpAL2AurUyq4Igem9JVigZiyKGgaYsdkOWgkYLW2M0DXX+vCRcM6 + BvJgJn7s0PHkLvybEVveTolRWO+I/IG1LN8m0SvrVPXf5JYHB32nKYwVMLwi+BQ1 + pwo0USGByVRv2lWZfy3doKxow0ppilq4DwoT+iqVO4sK5YhPipBHSmCcaxlquHjy + 2k1eb0gYisp0LBjHlhTErXtt4RlrUqs/84RfgtIZYUowJfXbtEbyDmLIlESbY7qk + UlXIMXtY0sWpDivWwpdMj9kJdKlS09QTMeLYz4fFGXMksFmLijx8RKDOYfNWL7oA + udmEOHPzYzu/Ex8RfKJjD4GhWLDvDTcyXDG9vmuDNZGcPHANeg23sGhr5Hz37FRT + 3MVh92sFyMVYkJcL7SISk80CAwEAAQ== + -----END PUBLIC KEY----- + ''; + }; + wiregrill = { + ip6.addr = w6 "12ee"; + aliases = [ + "green.w" + ]; + wireguard.pubkey = "lOORkStNJ6iP5ffqjHa/kWOxilJIMW4E6BEtNvNhLGk="; + }; + }; + ssh.privkey.path = ; + ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH0wqzo7rMkyw6gqTGuUp8aUA0vtwj0HuuaTIkkOnA30 "; + syncthing.id = "CADHN7J-CWRCWTZ-3GZRLII-JBVZN4N-RGHDGDL-UTAJNYI-RZPHK55-7EYAWQM"; + }; + phone = { nets = { wiregrill = { -- cgit v1.2.3 From 3fee51f7378a523a95e494d160b7562206cf714b Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 9 Apr 2019 16:52:17 +0200 Subject: syncthing: fix permissions of keys --- krebs/3modules/syncthing.nix | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'krebs/3modules') diff --git a/krebs/3modules/syncthing.nix b/krebs/3modules/syncthing.nix index 34879fd3f..bfbac1db9 100644 --- a/krebs/3modules/syncthing.nix +++ b/krebs/3modules/syncthing.nix @@ -133,8 +133,16 @@ in systemd.services.syncthing = mkIf (cfg.cert != null || cfg.key != null) { preStart = '' - ${optionalString (cfg.cert != null) "cp ${toString cfg.cert} ${config.services.syncthing.dataDir}/cert.pem"} - ${optionalString (cfg.key != null) "cp ${toString cfg.key} ${config.services.syncthing.dataDir}/key.pem"} + ${optionalString (cfg.cert != null) '' + cp ${toString cfg.cert} ${config.services.syncthing.dataDir}/cert.pem + chown ${config.services.syncthing.user}:${config.services.syncthing.group} ${config.services.syncthing.dataDir}/cert.pem + chmod 400 ${config.services.syncthing.dataDir}/cert.pem + ''} + ${optionalString (cfg.key != null) '' + cp ${toString cfg.key} ${config.services.syncthing.dataDir}/key.pem + chown ${config.services.syncthing.user}:${config.services.syncthing.group} ${config.services.syncthing.dataDir}/key.pem + chmod 400 ${config.services.syncthing.dataDir}/key.pem + ''} ''; }; -- cgit v1.2.3