From 68655d1ddf078eb1bb3a48ba7e6e9376d913985e Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 3 Feb 2016 11:32:58 +0100 Subject: krebs.git: remove trailing spaces --- krebs/3modules/git.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'krebs/3modules') diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix index e6267d7e6..0fa6b240b 100644 --- a/krebs/3modules/git.nix +++ b/krebs/3modules/git.nix @@ -27,7 +27,7 @@ let description = '' Enable cgit. Cgit is an attempt to create a fast web interface for the git version - control system, using a built in cache to decrease pressure on the + control system, using a built in cache to decrease pressure on the git server. cgit in this module is being served via fastcgi nginx.This module deploys a http://cgit. nginx configuration and enables nginx @@ -127,7 +127,7 @@ let git-imp = { system.activationScripts.git-init = "${init-script}"; - + # TODO maybe put all scripts here and then use PATH? environment.etc."${etc-base}".source = scriptFarm "git-ssh-authorizers" { @@ -136,7 +136,7 @@ let (map getName (ensureList repo)) (map getName perm.allow-commands) ]) cfg.rules); - + authorize-push = makeAuthorizeScript (map ({ repo, user, perm }: [ (map getName (ensureList user)) (map getName (ensureList repo)) @@ -144,7 +144,7 @@ let (map getName perm.allow-receive-modes) ]) (filter (x: hasAttr "allow-receive-ref" x.perm) cfg.rules)); }; - + users.extraUsers = singleton rec { description = "Git repository hosting user"; name = "git"; -- cgit v1.3.1 From cdb590be5072712c9552a98f8979aa94288dcbc8 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 3 Feb 2016 13:36:54 +0100 Subject: krebs.git.rules: specify type --- krebs/3modules/git.nix | 193 +++++++++++++++++++++++++++++++++++-------------- tv/2configs/git.nix | 4 +- 2 files changed, 142 insertions(+), 55 deletions(-) (limited to 'krebs/3modules') diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix index 0fa6b240b..7b28ffca8 100644 --- a/krebs/3modules/git.nix +++ b/krebs/3modules/git.nix @@ -44,48 +44,8 @@ let default = "/etc/git"; }; repos = mkOption { - type = types.attrsOf (types.submodule ({ - options = { - desc = mkOption { - type = types.nullOr types.str; - default = null; - description = '' - Repository description. - ''; - }; - section = mkOption { - type = types.nullOr types.str; - default = null; - description = '' - Repository section. - ''; - }; - name = mkOption { - type = types.str; - description = '' - Repository name. - ''; - }; - hooks = mkOption { - type = types.attrsOf types.str; - default = {}; - description = '' - Repository-specific hooks. - ''; - }; - public = mkOption { - type = types.bool; - default = false; - description = '' - Allow everybody to read the repository via HTTP if cgit enabled. - ''; - # TODO allow every configured user to fetch the repository via SSH. - }; - }; - })); - + type = types.attrsOf subtypes.repo; default = {}; - example = literalExample '' { testing = { @@ -99,7 +59,6 @@ let testing2 = { name = "testing2"; }; } ''; - description = '' Repositories. ''; @@ -121,28 +80,156 @@ let ''; }; rules = mkOption { - type = types.unspecified; + type = types.listOf subtypes.rule; + default = []; + example = literalExample '' + singleton { + user = [ config.krebs.users.tv ]; + repo = [ testing ]; # see literal example of repos + perm = push "refs/*" (with lib.git; [ + non-fast-forward create delete merge + ]); + } + ''; + description = '' + Rules. + ''; }; }; + # TODO put into krebs/4lib/types.nix? + subtypes = { + repo = types.submodule ({ + options = { + collaborators = mkOption { + type = types.listOf types.user; + default = []; + description = '' + List of users that should be able to fetch from this repo. + + This option is currently not used by krebs.git but instead can be + used to create rules. See e.g. for + an example. + ''; + }; + desc = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + Repository description. + ''; + }; + section = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + Repository section. + ''; + }; + name = mkOption { + type = types.str; + description = '' + Repository name. + ''; + }; + hooks = mkOption { + type = types.attrsOf types.str; + default = {}; + description = '' + Repository-specific hooks. + ''; + }; + public = mkOption { + type = types.bool; + default = false; + description = '' + Allow everybody to read the repository via HTTP if cgit enabled. + ''; + # TODO allow every configured user to fetch the repository via SSH. + }; + }; + }); + rule = types.submodule ({ config, ... }: { + options = { + user = mkOption { + type = types.listOf types.user; + description = '' + List of users this rule should apply to. + Checked by authorize-command. + ''; + }; + repo = mkOption { + type = types.listOf subtypes.repo; + description = '' + List of repos this rule should apply to. + Checked by authorize-command. + ''; + }; + perm = mkOption { + type = types.submodule { + # TODO generate enum argument from krebs/4lib/git.nix + options = { + allow-commands = mkOption { + type = types.listOf (types.enum (with git; [ + git-receive-pack + git-upload-pack + ])); + default = []; + description = '' + List of commands the rule's users are allowed to execute. + Checked by authorize-command. + ''; + }; + allow-receive-ref = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + Ref that can receive objects. + Checked by authorize-push. + ''; + }; + allow-receive-modes = mkOption { + type = types.listOf (types.enum (with git; [ + fast-forward + non-fast-forward + create + delete + merge + ])); + default = []; + description = '' + List of allowed receive modes. + Checked by pre-receive hook. + ''; + }; + }; + }; + description = '' + Permissions granted. + ''; + }; + }; + }); + }; + git-imp = { system.activationScripts.git-init = "${init-script}"; # TODO maybe put all scripts here and then use PATH? environment.etc."${etc-base}".source = scriptFarm "git-ssh-authorizers" { - authorize-command = makeAuthorizeScript (map ({ repo, user, perm }: [ - (map getName (ensureList user)) - (map getName (ensureList repo)) - (map getName perm.allow-commands) + authorize-command = makeAuthorizeScript (map (rule: [ + (map getName (ensureList rule.user)) + (map getName (ensureList rule.repo)) + (map getName rule.perm.allow-commands) ]) cfg.rules); - authorize-push = makeAuthorizeScript (map ({ repo, user, perm }: [ - (map getName (ensureList user)) - (map getName (ensureList repo)) - (ensureList perm.allow-receive-ref) - (map getName perm.allow-receive-modes) - ]) (filter (x: hasAttr "allow-receive-ref" x.perm) cfg.rules)); + authorize-push = makeAuthorizeScript (map (rule: [ + (map getName (ensureList rule.user)) + (map getName (ensureList rule.repo)) + (ensureList rule.perm.allow-receive-ref) + (map getName rule.perm.allow-receive-modes) + ]) (filter (rule: rule.perm.allow-receive-ref != null) cfg.rules)); }; users.extraUsers = singleton rec { diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix index 5e0f95c15..01dc7de9b 100644 --- a/tv/2configs/git.nix +++ b/tv/2configs/git.nix @@ -9,7 +9,7 @@ let enable = true; root-title = "public repositories at ${config.krebs.build.host.name}"; root-desc = "keep calm and engage"; - repos = mapAttrs (_: s: removeAttrs s ["collaborators"]) repos; + repos = repos; rules = rules; }; }; @@ -99,7 +99,7 @@ let repo = [ repo ]; perm = fetch; } ++ - optional (length (repo.collaborators or []) > 0) { + optional (repo.collaborators or [] != []) { user = repo.collaborators; repo = [ repo ]; perm = fetch; -- cgit v1.3.1 From f7d979b21fc0a705105adbbc708645f94af6629c Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 4 Feb 2016 02:48:28 +0100 Subject: s 1 wolf: provide cgit mirror --- krebs/3modules/shared/default.nix | 1 + shared/1systems/wolf.nix | 1 + shared/2configs/cgit-mirror.nix | 41 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 43 insertions(+) create mode 100644 shared/2configs/cgit-mirror.nix (limited to 'krebs/3modules') diff --git a/krebs/3modules/shared/default.nix b/krebs/3modules/shared/default.nix index 518e46587..91d92857b 100644 --- a/krebs/3modules/shared/default.nix +++ b/krebs/3modules/shared/default.nix @@ -50,6 +50,7 @@ in { addrs6 = ["42:0:0:0:0:0:77:1"]; aliases = [ "wolf.retiolum" + "cgit.wolf.retiolum" ]; tinc.pubkey = '' -----BEGIN RSA PUBLIC KEY----- diff --git a/shared/1systems/wolf.nix b/shared/1systems/wolf.nix index 8cf5be71c..e45195487 100644 --- a/shared/1systems/wolf.nix +++ b/shared/1systems/wolf.nix @@ -12,6 +12,7 @@ in ../2configs/shack-nix-cacher.nix ../2configs/shack-drivedroid.nix ../2configs/buildbot-standalone.nix + ../2configs/cgit-mirror.nix # ../2configs/graphite.nix ]; # use your own binary cache, fallback use cache.nixos.org (which is used by diff --git a/shared/2configs/cgit-mirror.nix b/shared/2configs/cgit-mirror.nix new file mode 100644 index 000000000..5bcfc5818 --- /dev/null +++ b/shared/2configs/cgit-mirror.nix @@ -0,0 +1,41 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + rules = with git;[{ + # user = git-sync; + user = git-sync; + repo = [ stockholm-mirror ]; + perm = push ''refs/*'' [ non-fast-forward create delete merge ]; + }]; + + stockholm-mirror = { + public = true; + name = "stockholm-mirror"; + desc = "mirror for all stockholm branches"; + hooks = { + post-receive = pkgs.git-hooks.irc-announce { + nick = config.networking.hostName; + verbose = false; + channel = "#retiolum"; + server = "cd.retiolum"; + }; + }; + }; + + git-sync = { + name = "git-sync"; + mail = "spam@krebsco.de"; + # TODO put git-sync pubkey somewhere more appropriate + pubkey = ''ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzUuzyoAhMgJmsiaTVWNSXqcrZNTpKpv0nfFBOMcNXUWEbvfAq5eNpg5cX+P8eoYl6UQgfftbYi06flKK3yJdntxoZKLwJGgJt9NZr8yZTsiIfMG8XosvGNQtGPkBtpLusgmPpu7t2RQ9QrqumBvoUDGYEauKTslLwupp1QeyWKUGEhihn4CuqQKiPrz+9vbNd75XOfVZMggk3j4F7HScatmA+p1EQXWyq5Jj78jQN5ZIRnHjMQcIZ4DOz1U96atwSKMviI1xEZIODYfgoGjjiWYeEtKaLVPtSqtLRGI7l+RNouMfwHLdTWOJSlIdFncfPXC6R19hTll3UHeHLtqLP git-sync''; + }; + +in { + krebs.git = { + enable = true; + root-title = "Shared Repos"; + root-desc = "keep on krebsing"; + inherit rules; + repos.stockholm-mirror = stockholm-mirror; + }; +} -- cgit v1.3.1 From b857a48632128be0324c68be95bee16fb0f1b15f Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 05:40:26 +0100 Subject: krebs.build.populate: init and drop support for v1 --- Makefile | 108 ++++++++--------------- default.nix | 16 +++- krebs/3modules/build.nix | 218 +++++++++++++++++++++++++++++++--------------- krebs/default.nix | 95 +------------------- krebs/v2/default.nix | 132 ---------------------------- nixpkgs/krebs | 0 nixpkgs/nixos/default.nix | 66 +------------- nixpkgs/nixos/lib | 2 +- nixpkgs/nixos/modules | 2 +- root | 1 + tv/2configs/default.nix | 4 +- 11 files changed, 203 insertions(+), 441 deletions(-) delete mode 100644 krebs/v2/default.nix create mode 100644 nixpkgs/krebs create mode 120000 root (limited to 'krebs/3modules') diff --git a/Makefile b/Makefile index a1559b48c..87a636e72 100644 --- a/Makefile +++ b/Makefile @@ -1,87 +1,51 @@ -# -# usage: -# make infest system=foo [target=bar] -# make [deploy] system=foo [target=bar] -# make [deploy] systems='foo bar' -# make eval get=users.tv.wu.config.time.timeZone [filter=json] -# - .ONESHELL: .SHELLFLAGS := -eufc -ifdef systems -$(systems): - @ - unset target - parallel \ - --line-buffer \ - -j0 \ - --no-notice \ - --tagstring {} \ - -q make -s systems= system={} ::: $(systems) -else ifdef system -.PHONY: deploy infest -deploy infest:;@ - export get=krebs.$@ - export filter=json - script=$$(make -s eval) - echo "$$script" | sh - -.PHONY: eval -eval: - @ -ifeq ($(filter),json) - extraArgs='--json --strict' - filter() { jq -r .; } -else - filter() { cat; } +ifndef system +$(error unbound variable: system) endif - result=$$(nix-instantiate \ - $${extraArgs-} \ - --eval \ - -A "$$get" \ - -I stockholm="$$PWD" \ - '' \ - --argstr current-host-name "$$HOSTNAME" \ - --argstr current-user-name "$$LOGNAME" \ - $${system+--argstr system "$$system"} \ - $${target+--argstr target "$$target"}) - echo "$$result" | filter export target_host ?= $(system) export target_user ?= root export target_path ?= /var/src +# usage: make deploy system=foo [target_host=bar] +.PHONY: deploy +deploy: populate ;@set -x + ssh "$$target_user@$$target_host" nixos-rebuild switch -I "$$target_path" + # usage: make populate system=foo [target_host=bar] .PHONY: populate -populate: export lib = \ - let nlib = import ; in \ - nlib // import krebs/4lib { lib = nlib; } // builtins -populate: export source = \ - with builtins; \ - with (import ./. {}).users.$${getEnv "LOGNAME"}.$${getEnv "system"}; \ - assert config.krebs.build.source-version == 2; \ - config.krebs.build.source populate:;@ - result=$$(nix-instantiate \ - --eval \ - --json \ - --arg lib "$$lib" \ - --arg source "$$source" \ - --argstr target-user "$$target_user" \ - --argstr target-host "$$target_host" \ - --argstr target-path "$$target_path" \ - -A populate \ - krebs/v2) - script=$$(echo "$$result" | jq -r .) - echo "$$script" | sh - -# usage: make rebuild system=foo [target_host=bar] [operation=switch] -.PHONY: rebuild -rebuild: populate ;@set -x - ssh "$$target_user@$$target_host" \ - nixos-rebuild "$${operation-switch}" -I "$$target_path" + result=$$(make -s eval get=config.krebs.build.populate filter=json) + echo "$$result" | sh +# usage: make eval system=foo get=config.krebs.build [LOGNAME=tv] [filter=json] +.PHONY: eval +eval:;@ +ifeq ($(filter),json) + extraArgs='--json --strict' + filter() { echo "$$1" | jq -r .; } else -$(error unbound variable: system[s]) + filter() { echo "$$1"; } endif + result=$$(nix-instantiate \ + $${extraArgs-} \ + --show-trace \ + --readonly-mode \ + --eval \ + -A "$$get" \ + --arg configuration "") + filter "$$result" + +## usage: make install system=foo target= +#.PHONY: install +#install: ssh = ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null +#install:;@set -x +# $(ssh) "$$target_user@$$target_host" \ +# env target_path=/var/src \ +# sh -s prepare < krebs/4lib/infest/prepare.sh +# make -s populate target_path=/mnt"$$target_path" +# $(ssh) "$$target_user@$$target_host" \ +# env NIXOS_CONFIG=/var/src/nixos-config \ +# nixos-install diff --git a/default.nix b/default.nix index 656a7f4b3..278f1d14d 100644 --- a/default.nix +++ b/default.nix @@ -1,9 +1,15 @@ -{ current-host-name ? +{ configuration ? import (nixpkgs-path + "/nixos/lib/from-env.nix") "NIXOS_CONFIG" +, system ? builtins.currentSystem +, current-host-name ? let v = builtins.getEnv "HOSTNAME"; in if v != "" then v else builtins.readFile /proc/sys/kernel/hostname , current-user-name ? let v = builtins.getEnv "LOGNAME"; in if v != "" then v else abort "undefined variable: LOGNAME" +, nixpkgs-path ? + if (builtins.tryEval ).success + then + else , StrictHostKeyChecking ? "yes" }@args: @@ -11,7 +17,8 @@ let stockholm = { inherit krebs; inherit users; inherit lib; - inherit pkgs; + inherit config options pkgs; + system = config.system.build.toplevel; }; krebs = import ./krebs (args // { inherit lib stockholm; }); @@ -20,7 +27,7 @@ let stockholm = { nlib = import (slib.npath "lib"); klib = import (slib.kpath "4lib") { lib = nlib; }; slib = rec { - npath = p: + "/${p}"; + npath = p: nixpkgs-path + "/${p}"; kpath = p: ./. + "/krebs/${p}"; upath = p: ./. + "/${current-user-name}/${p}"; }; @@ -29,7 +36,7 @@ let stockholm = { (import p { lib = nlib // klib; }); in nlib // klib // slib // ulib // builtins; - inherit (eval {}) pkgs; + inherit (eval configuration) config options pkgs; base-module = { config, ... }: { imports = builtins.filter lib.dir.has-default-nix (lib.concatLists [ @@ -48,6 +55,7 @@ let stockholm = { }; eval = config: import (lib.npath "nixos/lib/eval-config.nix") { + inherit system; specialArgs = { inherit lib; }; diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix index 0f8aec89d..00142acdd 100644 --- a/krebs/3modules/build.nix +++ b/krebs/3modules/build.nix @@ -28,81 +28,157 @@ let type = types.user; }; - options.krebs.build.source-version = mkOption { - type = types.enum [ 1 2 ]; - default = 1; + options.krebs.build.source = let + raw = types.either types.str types.path; + url = types.submodule { + options = { + url = mkOption { + type = types.str; + }; + rev = mkOption { + type = types.str; + }; + dev = mkOption { + type = types.str; + }; + }; + }; + in mkOption { + type = types.attrsOf (types.either types.str url); + apply = let f = mapAttrs (_: value: { + string = value; + path = toString value; + set = f value; + }.${typeOf value}); in f; + default = {}; }; - options.krebs.build.source = getAttr "v${toString config.krebs.build.source-version}" { - v1 = { - dir = mkOption { - type = let - default-host = config.krebs.current.host; - in types.attrsOf (types.submodule ({ config, ... }: { - options = { - host = mkOption { - type = types.host; - default = default-host; - }; - path = mkOption { - type = types.str; - }; - target-path = mkOption { - type = types.str; - default = "/root/${config._module.args.name}"; - }; - url = mkOption { - type = types.str; - default = "file://${config.host.name}${config.path}"; - }; - }; - })); - default = {}; - }; + options.krebs.build.populate = mkOption { + type = types.str; + default = let + source = config.krebs.build.source; + target-user = maybeEnv "target_user" "root"; + target-host = maybeEnv "target_host" config.krebs.build.host.name; + target-path = maybeEnv "target_path" "/var/src"; + out = '' + #! /bin/sh + set -eu - git = mkOption { - type = with types; attrsOf (submodule ({ config, ... }: { - options = { - url = mkOption { - type = types.str; # TODO must be shell safe - }; - rev = mkOption { - type = types.str; - }; - target-path = mkOption { - type = types.str; - default = "/root/${config._module.args.name}"; - }; - }; - })); - default = {}; - }; - }; + verbose() { + printf '+%s\n' "$(printf ' %q' "$@")" >&2 + "$@" + } - v2 = let - raw = types.either types.str types.path; - url = types.submodule { - options = { - url = mkOption { - type = types.str; - }; - rev = mkOption { - type = types.str; - }; - dev = mkOption { - type = types.str; - }; - }; - }; - in mkOption { - type = types.attrsOf (types.either types.str url); - apply = let f = mapAttrs (_: value: { - string = value; - path = toString value; - set = f value; - }.${typeOf value}); in f; - default = {}; - }; + echo ${shell.escape git-script} \ + | ssh ${shell.escape "${target-user}@${target-host}"} -T + + unset tmpdir + trap ' + rm "$tmpdir"/* + rmdir "$tmpdir" + trap - EXIT INT QUIT + ' EXIT INT QUIT + tmpdir=$(mktemp -dt stockholm.XXXXXXXX) + chmod 0755 "$tmpdir" + + ${concatStringsSep "\n" + (mapAttrsToList + (name: spec: let dst = removePrefix "symlink:" (get-url spec); in + "verbose ln -s ${shell.escape dst} $tmpdir/${shell.escape name}") + symlink-specs)} + + verbose proot \ + -b $tmpdir:${shell.escape target-path} \ + ${concatStringsSep " \\\n " + (mapAttrsToList + (name: spec: + "-b ${shell.escape "${get-url spec}:${target-path}/${name}"}") + file-specs)} \ + rsync \ + -f ${shell.escape "P /*"} \ + ${concatMapStringsSep " \\\n " + (name: "-f ${shell.escape "R /${name}"}") + (attrNames file-specs)} \ + --delete \ + -vFrlptD \ + ${shell.escape target-path}/ \ + ${shell.escape "${target-user}@${target-host}:${target-path}"} + ''; + + get-schema = uri: + if substring 0 1 uri == "/" + then "file" + else head (splitString ":" uri); + + has-schema = schema: uri: get-schema uri == schema; + + get-url = spec: { + string = spec; + path = toString spec; + set = get-url spec.url; + }.${typeOf spec}; + + git-specs = + filterAttrs (_: spec: has-schema "https" (get-url spec)) source // + filterAttrs (_: spec: has-schema "http" (get-url spec)) source // + filterAttrs (_: spec: has-schema "git" (get-url spec)) source; + + file-specs = + filterAttrs (_: spec: has-schema "file" (get-url spec)) source; + + symlink-specs = + filterAttrs (_: spec: has-schema "symlink" (get-url spec)) source; + + git-script = '' + #! /bin/sh + set -efu + + verbose() { + printf '+%s\n' "$(printf ' %q' "$@")" >&2 + "$@" + } + + fetch_git() {( + dst_dir=$1 + src_url=$2 + src_ref=$3 + + if ! test -e "$dst_dir"; then + git clone "$src_url" "$dst_dir" + fi + + cd "$dst_dir" + + if ! url=$(git config remote.origin.url); then + git remote add origin "$src_url" + elif test "$url" != "$src_url"; then + git remote set-url origin "$src_url" + fi + + # TODO resolve src_ref to commit hash + hash=$src_ref + + if ! test "$(git log --format=%H -1)" = "$hash"; then + git fetch origin + git checkout "$hash" -- "$dst_dir" + git checkout "$hash" + fi + + git clean -dxf + )} + + ${concatStringsSep "\n" + (mapAttrsToList + (name: spec: toString (map shell.escape [ + "verbose" + "fetch_git" + "${target-path}/${name}" + spec.url + spec.rev + ])) + git-specs)} + ''; + in out; }; }; diff --git a/krebs/default.nix b/krebs/default.nix index e9ee71b34..17c035896 100644 --- a/krebs/default.nix +++ b/krebs/default.nix @@ -1,3 +1,5 @@ +assert false; + { current-host-name , current-user-name , lib @@ -6,30 +8,11 @@ }: let out = { - inherit deploy; inherit infest; inherit init; inherit nixos-install; - inherit populate; }; - deploy = - { system ? current-host-name - , target ? system - }@args: let - config = get-config system; - in '' - #! /bin/sh - # krebs.deploy - set -efu - (${populate args}) - ${rootssh target '' - ${nix-install args} - ${config.krebs.build.profile}/bin/switch-to-configuration switch - ''} - echo OK - ''; - infest = { system ? current-host-name , target ? system @@ -45,9 +28,6 @@ let out = { ${builtins.readFile ./4lib/infest/install-nix.sh} ''} - # Prepare target source via bind-mounting - - (${nixos-install args}) ${rootssh target '' @@ -169,9 +149,7 @@ let out = { get-config = system: let config = stockholm.users.${current-user-name}.${system}.config or (abort "unknown system: ${system}, user: ${current-user-name}"); - in - assert config.krebs.build.source-version == 1; - config; + in config; nix-install = { system ? current-host-name @@ -203,73 +181,6 @@ let out = { ])} ''; - populate = - { system ? current-host-name - , target ? system - , root ? "" - }@args: - let out = '' - #! /bin/sh - set -efu - ${lib.concatStringsSep "\n" - (lib.concatMap - (type: lib.mapAttrsToList (_: methods.${type}) - config.krebs.build.source.${type}) - ["dir" "git"])} - ''; - - - config = get-config system; - - current-host = config.krebs.hosts.${current-host-name}; - current-user = config.krebs.users.${current-user-name}; - - methods.dir = config: - let - can-push = config.host.name == current-host.name; - target-path = root + config.target-path; - push-method = '' - rsync \ - --exclude .git \ - --exclude .graveyard \ - --exclude old \ - --exclude tmp \ - --rsync-path='mkdir -p ${target-path} && rsync' \ - --delete-excluded \ - -vrlptD \ - ${config.path}/ \ - root@${target}:${target-path} - ''; - in - if can-push then push-method else - let dir = "file://${config.host.name}${config.path}"; in - # /!\ revise this message when using more than just push-method - throw "No way to push ${dir} from ${current-host.name} to ${target}"; - - methods.git = config: - let target-path = root + config.target-path; - in rootssh target '' - mkdir -p ${target-path} - cd ${target-path} - if ! test -e .git; then - git init - fi - if ! cur_url=$(git config remote.origin.url 2>/dev/null); then - git remote add origin ${config.url} - elif test "$cur_url" != ${config.url}; then - git remote set-url origin ${config.url} - fi - if test "$(git rev-parse --verify HEAD 2>/dev/null)" != ${config.rev}; then - git fetch origin - git checkout ${config.rev} -- . - git checkout -q ${config.rev} - git submodule init - git submodule update - fi - git clean -dxf - ''; - in out; - rootssh = target: script: let flags = "-o StrictHostKeyChecking=${StrictHostKeyChecking}"; diff --git a/krebs/v2/default.nix b/krebs/v2/default.nix deleted file mode 100644 index cba7a75ff..000000000 --- a/krebs/v2/default.nix +++ /dev/null @@ -1,132 +0,0 @@ -{ lib -, source -, target-user ? "root" -, target-host -, target-path ? "/var/src" -}: -with lib; -let - out = { - inherit populate; - }; - - populate = '' - #! /bin/sh - set -eu - - verbose() { - printf '+%s\n' "$(printf ' %q' "$@")" >&2 - "$@" - } - - echo ${shell.escape git-script} \ - | ssh ${shell.escape "${target-user}@${target-host}"} -T - - unset tmpdir - trap ' - rm "$tmpdir"/* - rmdir "$tmpdir" - trap - EXIT INT QUIT - ' EXIT INT QUIT - tmpdir=$(mktemp -dt stockholm.XXXXXXXX) - chmod 0755 "$tmpdir" - - ${concatStringsSep "\n" - (mapAttrsToList - (name: spec: let dst = removePrefix "symlink:" (get-url spec); in - "verbose ln -s ${shell.escape dst} $tmpdir/${shell.escape name}") - symlink-specs)} - - verbose proot \ - -b $tmpdir:${shell.escape target-path} \ - ${concatStringsSep " \\\n " - (mapAttrsToList - (name: spec: - "-b ${shell.escape "${get-url spec}:${target-path}/${name}"}") - file-specs)} \ - rsync \ - -f ${shell.escape "P /*"} \ - ${concatMapStringsSep " \\\n " - (name: "-f ${shell.escape "R /${name}"}") - (attrNames file-specs)} \ - --delete \ - -vFrlptD \ - ${shell.escape target-path}/ \ - ${shell.escape "${target-user}@${target-host}:${target-path}"} - ''; - - get-schema = uri: - if substring 0 1 uri == "/" - then "file" - else head (splitString ":" uri); - - has-schema = schema: uri: get-schema uri == schema; - - get-url = spec: { - string = spec; - path = toString spec; - set = get-url spec.url; - }.${typeOf spec}; - - git-specs = - filterAttrs (_: spec: has-schema "https" (get-url spec)) source // - filterAttrs (_: spec: has-schema "http" (get-url spec)) source // - filterAttrs (_: spec: has-schema "git" (get-url spec)) source; - - file-specs = - filterAttrs (_: spec: has-schema "file" (get-url spec)) source; - - symlink-specs = - filterAttrs (_: spec: has-schema "symlink" (get-url spec)) source; - - git-script = '' - #! /bin/sh - set -efu - - verbose() { - printf '+%s\n' "$(printf ' %q' "$@")" >&2 - "$@" - } - - fetch_git() {( - dst_dir=$1 - src_url=$2 - src_ref=$3 - - if ! test -e "$dst_dir"; then - git clone "$src_url" "$dst_dir" - fi - - cd "$dst_dir" - - if ! url=$(git config remote.origin.url); then - git remote add origin "$src_url" - elif test "$url" != "$src_url"; then - git remote set-url origin "$src_url" - fi - - # TODO resolve src_ref to commit hash - hash=$src_ref - - if ! test "$(git log --format=%H -1)" = "$hash"; then - git fetch origin - git checkout "$hash" -- "$dst_dir" - git checkout "$hash" - fi - - git clean -dxf - )} - - ${concatStringsSep "\n" - (mapAttrsToList - (name: spec: toString (map shell.escape [ - "verbose" - "fetch_git" - "${target-path}/${name}" - spec.url - spec.rev - ])) - git-specs)} - ''; - -in out diff --git a/nixpkgs/krebs b/nixpkgs/krebs new file mode 100644 index 000000000..e69de29bb diff --git a/nixpkgs/nixos/default.nix b/nixpkgs/nixos/default.nix index 6c5adf365..4fe08efd2 100644 --- a/nixpkgs/nixos/default.nix +++ b/nixpkgs/nixos/default.nix @@ -1,65 +1 @@ -{ configuration ? import "NIXOS_CONFIG" -, system ? builtins.currentSystem -}: - -let - eval-config = modules: import { - inherit system; - modules = modules ++ [({ config, lib, ... }: with lib; { - imports = filter dir.has-default-nix (concatLists [ - (map (p: p + "/2configs") [ ]) - (map (p: p + "/3modules") [ ]) - ]); - - krebs.current = { - enable = true; - host = config.krebs.hosts.${readFile /proc/sys/kernel/hostname}; - user = config.krebs.users.${getEnv "LOGNAME"}; - }; - - nixpkgs.config.packageOverrides = pkgs: let - kpkgs = import { inherit lib pkgs; }; - upkgs = import { inherit lib; pkgs = pkgs // kpkgs; }; - in kpkgs // upkgs; - })]; - specialArgs = { - lib = let - nlib = import // builtins; - klib = nlib // import { lib = nlib; }; - ulib = klib // (with klib; let p = + "/4lib"; in - optionalAttrs (dir.has-default-nix p) - (import p { lib = klib; })); - in ulib; - }; - }; - - eval = eval-config [ - configuration - ]; - - # This is for `nixos-rebuild build-vm'. - vm = eval-config [ - configuration - - ]; - - # This is for `nixos-rebuild build-vm-with-bootloader'. - vm-with-bootloader = eval-config [ - configuration - - { virtualisation.useBootLoader = true; } - ]; -in - -{ - inherit (eval) config options; - - system = eval.config.system.build.toplevel; - - vm = vm.config.system.build.vm; - - vmWithBootLoader = vm-with-bootloader.config.system.build.vm; - - # The following are used by nixos-rebuild. - nixFallback = eval.pkgs.nixUnstable; -} +import diff --git a/nixpkgs/nixos/lib b/nixpkgs/nixos/lib index eb942f88b..9e69d1a67 120000 --- a/nixpkgs/nixos/lib +++ b/nixpkgs/nixos/lib @@ -1 +1 @@ -../../upstream-nixpkgs/nixos/lib \ No newline at end of file +../../../upstream-nixpkgs/nixos/lib \ No newline at end of file diff --git a/nixpkgs/nixos/modules b/nixpkgs/nixos/modules index 8fbc4373e..8aa24885c 120000 --- a/nixpkgs/nixos/modules +++ b/nixpkgs/nixos/modules @@ -1 +1 @@ -../../upstream-nixpkgs/nixos/modules \ No newline at end of file +../../../upstream-nixpkgs/nixos/modules \ No newline at end of file diff --git a/root b/root new file mode 120000 index 000000000..1cd18253d --- /dev/null +++ b/root @@ -0,0 +1 @@ +../stockholm-user \ No newline at end of file diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index 46320b738..57c4620c4 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -8,11 +8,9 @@ with lib; krebs.build = { user = config.krebs.users.tv; target = mkDefault "root@${config.krebs.build.host.name}"; - source-version = 2; source = mapAttrs (_: mkDefault) ({ nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix"; nixpkgs = symlink:stockholm/nixpkgs; - null = "symlink:stockholm/null"; secrets = "/home/tv/secrets/${config.krebs.build.host.name}"; secrets-common = "/home/tv/secrets/common"; stockholm = "/home/tv/stockholm"; @@ -104,7 +102,7 @@ with lib; }; environment.variables = { - NIX_PATH = mkForce "secrets=/var/src/null:/var/src"; + NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src"; }; programs.bash = { -- cgit v1.3.1 From d739448ab940da4ed5bdf9be5398f6b93b854412 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 4 Feb 2016 12:46:09 +0100 Subject: krebs.build.populate: cleanup (less) harder --- krebs/3modules/build.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs/3modules') diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix index 00142acdd..0da5dd38a 100644 --- a/krebs/3modules/build.nix +++ b/krebs/3modules/build.nix @@ -74,7 +74,7 @@ let unset tmpdir trap ' - rm "$tmpdir"/* + rm -f "$tmpdir"/* rmdir "$tmpdir" trap - EXIT INT QUIT ' EXIT INT QUIT -- cgit v1.3.1 From e402c8ce1d2786abafc1efdc64adca84d174a756 Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 4 Feb 2016 13:07:47 +0100 Subject: k 3 git.nix: flesh out rules description --- krebs/3modules/git.nix | 2 +- makefu/1systems/omo.nix | 1 - makefu/1systems/vbob.nix | 19 ------------------- 3 files changed, 1 insertion(+), 21 deletions(-) (limited to 'krebs/3modules') diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix index 7b28ffca8..11cf21b5f 100644 --- a/krebs/3modules/git.nix +++ b/krebs/3modules/git.nix @@ -92,7 +92,7 @@ let } ''; description = '' - Rules. + access and permission rules for git repositories. ''; }; }; diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix index d15cc2779..34d5a394d 100644 --- a/makefu/1systems/omo.nix +++ b/makefu/1systems/omo.nix @@ -29,7 +29,6 @@ in { ../2configs/mail-client.nix ../2configs/share-user-sftp.nix ../2configs/omo-share.nix - ../3modules ]; networking.firewall.trustedInterfaces = [ "enp3s0" ]; # udp:137 udp:138 tcp:445 tcp:139 - samba, allowed in local net diff --git a/makefu/1systems/vbob.nix b/makefu/1systems/vbob.nix index 6c8f5ca26..f4a22d720 100644 --- a/makefu/1systems/vbob.nix +++ b/makefu/1systems/vbob.nix @@ -18,25 +18,6 @@ tinc = pkgs.tinc_pre; }; - makefu.buildbot.master = { - enable = false; - irc = { - enable = true; - server = "cd.retiolum"; - channel = "retiolum"; - allowForce = true; - }; - }; - # services.logstash.enable = true; - makefu.buildbot.slave = { - enable = false; - masterhost = "localhost"; - username = "testslave"; - password = "krebspass"; - packages = with pkgs;[ git nix ]; - extraEnviron = { NIX_PATH="nixpkgs=${toString }"; }; - }; - krebs.build.source.nixpkgs = { # url = https://github.com/nixos/nixpkgs; # HTTP Everywhere + libredir -- cgit v1.3.1 From 23c7c10f5a5ed83dca001d7382e5b89981277f8c Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 15:11:30 +0100 Subject: krebs.retiolum.hosts: change type to attrsOf host --- krebs/3modules/retiolum.nix | 46 +++++++++++++++++----------------- krebs/4lib/types.nix | 16 ++++++------ krebs/Zhosts/Styx | 10 -------- krebs/Zhosts/ThinkArmageddon | 9 ------- krebs/Zhosts/TriBot | 11 -------- krebs/Zhosts/ach | 11 -------- krebs/Zhosts/air | 11 -------- krebs/Zhosts/alarmpi | 11 -------- krebs/Zhosts/albi10 | 11 -------- krebs/Zhosts/albi7 | 10 -------- krebs/Zhosts/almoehi | 11 -------- krebs/Zhosts/alphalabs | 10 -------- krebs/Zhosts/apfull | 11 -------- krebs/Zhosts/bitchctl | 11 -------- krebs/Zhosts/bitchextend | 11 -------- krebs/Zhosts/bitchtop | 11 -------- krebs/Zhosts/bobby | 11 -------- krebs/Zhosts/box | 10 -------- krebs/Zhosts/bridge | 12 --------- krebs/Zhosts/c2ft | 10 -------- krebs/Zhosts/c2fthome | 10 -------- krebs/Zhosts/casino | 11 -------- krebs/Zhosts/cat1 | 11 -------- krebs/Zhosts/cband | 11 -------- krebs/Zhosts/cd | 17 ------------- krebs/Zhosts/cloudkrebs | 12 --------- krebs/Zhosts/darth | 12 --------- krebs/Zhosts/dei | 11 -------- krebs/Zhosts/destroy | 11 -------- krebs/Zhosts/devstar | 11 -------- krebs/Zhosts/echelon | 12 --------- krebs/Zhosts/eigenserv | 11 -------- krebs/Zhosts/elvis | 12 --------- krebs/Zhosts/eulerwalk | 11 -------- krebs/Zhosts/exile | 9 ------- krebs/Zhosts/exitium_mobilis | 10 -------- krebs/Zhosts/falk | 11 -------- krebs/Zhosts/fastpoke | 12 --------- krebs/Zhosts/filebitch | 11 -------- krebs/Zhosts/filepimp | 11 -------- krebs/Zhosts/flap | 12 --------- krebs/Zhosts/foobar | 11 -------- krebs/Zhosts/fuerkrebs | 10 -------- krebs/Zhosts/gum | 15 ----------- krebs/Zhosts/heidi | 11 -------- krebs/Zhosts/horisa | 12 --------- krebs/Zhosts/horreum_magnus | 15 ----------- krebs/Zhosts/incept | 13 ---------- krebs/Zhosts/ire | 12 --------- krebs/Zhosts/ire2 | 9 ------- krebs/Zhosts/irkel | 12 --------- krebs/Zhosts/juhulian | 11 -------- krebs/Zhosts/k2 | 28 --------------------- krebs/Zhosts/kabinett | 11 -------- krebs/Zhosts/kaepsele | 11 -------- krebs/Zhosts/kalle | 11 -------- krebs/Zhosts/karthus | 10 -------- krebs/Zhosts/kebsco | 11 -------- krebs/Zhosts/khackplug | 11 -------- krebs/Zhosts/kheurop | 12 --------- krebs/Zhosts/kiosk | 12 --------- krebs/Zhosts/krebsplug | 10 -------- krebs/Zhosts/kvasir | 11 -------- krebs/Zhosts/laqueus | 11 -------- krebs/Zhosts/linuxatom | 11 -------- krebs/Zhosts/luminos | 11 -------- krebs/Zhosts/machine | 11 -------- krebs/Zhosts/makalu | 11 -------- krebs/Zhosts/mako | 11 -------- krebs/Zhosts/miefda0 | 10 -------- krebs/Zhosts/minikrebs | 10 -------- krebs/Zhosts/mkdir | 11 -------- krebs/Zhosts/monitor | 11 -------- krebs/Zhosts/mors | 10 -------- krebs/Zhosts/motor | 12 --------- krebs/Zhosts/mu | 10 -------- krebs/Zhosts/muhbaasu | 13 ---------- krebs/Zhosts/nomic | 10 -------- krebs/Zhosts/nomic2 | 10 -------- krebs/Zhosts/nukular | 11 -------- krebs/Zhosts/omo | 9 ------- krebs/Zhosts/pic | 11 -------- krebs/Zhosts/pigstarter | 13 ---------- krebs/Zhosts/pike | 11 -------- krebs/Zhosts/pnp | 11 -------- krebs/Zhosts/pornocauster | 10 -------- krebs/Zhosts/prism | 12 --------- krebs/Zhosts/radiotuxmini | 11 -------- krebs/Zhosts/random | 10 -------- krebs/Zhosts/raspafari | 11 -------- krebs/Zhosts/reimae | 12 --------- krebs/Zhosts/rmdir | 11 -------- krebs/Zhosts/robchina | 11 -------- krebs/Zhosts/rockit | 11 -------- krebs/Zhosts/rtjure_debian_oder_so | 11 -------- krebs/Zhosts/rtjure_ras | 11 -------- krebs/Zhosts/rtjure_rdrlab_linkstation | 11 -------- krebs/Zhosts/rubus | 9 ------- krebs/Zhosts/senderechner | 10 -------- krebs/Zhosts/serenity | 11 -------- krebs/Zhosts/seruundroid | 12 --------- krebs/Zhosts/sir_krebs_a_lot | 11 -------- krebs/Zhosts/skirfir | 11 -------- krebs/Zhosts/sleipnir | 12 --------- krebs/Zhosts/smove | 9 ------- krebs/Zhosts/sokrates | 11 -------- krebs/Zhosts/sokrateslaptop | 11 -------- krebs/Zhosts/soundflower | 10 -------- krebs/Zhosts/steve | 10 -------- krebs/Zhosts/stro | 10 -------- krebs/Zhosts/tahoe | 12 --------- krebs/Zhosts/taschenkrebs | 11 -------- krebs/Zhosts/terrapi | 11 -------- krebs/Zhosts/thomasDOTde | 9 ------- krebs/Zhosts/tincdroid | 9 ------- krebs/Zhosts/tmpd | 11 -------- krebs/Zhosts/tpsw | 11 -------- krebs/Zhosts/tsp | 16 ------------ krebs/Zhosts/ufo | 11 -------- krebs/Zhosts/uriel | 11 -------- krebs/Zhosts/vault | 10 -------- krebs/Zhosts/vbob | 9 ------- krebs/Zhosts/voyager | 17 ------------- krebs/Zhosts/wbob | 10 -------- krebs/Zhosts/wolf | 10 -------- krebs/Zhosts/wooktop | 11 -------- krebs/Zhosts/wry | 16 ------------ krebs/Zhosts/wu | 10 -------- krebs/Zhosts/xu | 13 ---------- krebs/Zhosts/ytart | 9 ------- krebs/Zhosts/zombiecancer | 11 -------- lass/2configs/retiolum.nix | 1 - makefu/1systems/repunit.nix | 1 - makefu/1systems/vbob.nix | 1 - 134 files changed, 32 insertions(+), 1479 deletions(-) delete mode 100644 krebs/Zhosts/Styx delete mode 100644 krebs/Zhosts/ThinkArmageddon delete mode 100644 krebs/Zhosts/TriBot delete mode 100644 krebs/Zhosts/ach delete mode 100644 krebs/Zhosts/air delete mode 100644 krebs/Zhosts/alarmpi delete mode 100644 krebs/Zhosts/albi10 delete mode 100644 krebs/Zhosts/albi7 delete mode 100644 krebs/Zhosts/almoehi delete mode 100644 krebs/Zhosts/alphalabs delete mode 100644 krebs/Zhosts/apfull delete mode 100644 krebs/Zhosts/bitchctl delete mode 100644 krebs/Zhosts/bitchextend delete mode 100644 krebs/Zhosts/bitchtop delete mode 100644 krebs/Zhosts/bobby delete mode 100644 krebs/Zhosts/box delete mode 100644 krebs/Zhosts/bridge delete mode 100644 krebs/Zhosts/c2ft delete mode 100644 krebs/Zhosts/c2fthome delete mode 100644 krebs/Zhosts/casino delete mode 100644 krebs/Zhosts/cat1 delete mode 100644 krebs/Zhosts/cband delete mode 100644 krebs/Zhosts/cd delete mode 100644 krebs/Zhosts/cloudkrebs delete mode 100644 krebs/Zhosts/darth delete mode 100644 krebs/Zhosts/dei delete mode 100644 krebs/Zhosts/destroy delete mode 100644 krebs/Zhosts/devstar delete mode 100644 krebs/Zhosts/echelon delete mode 100644 krebs/Zhosts/eigenserv delete mode 100644 krebs/Zhosts/elvis delete mode 100644 krebs/Zhosts/eulerwalk delete mode 100644 krebs/Zhosts/exile delete mode 100644 krebs/Zhosts/exitium_mobilis delete mode 100644 krebs/Zhosts/falk delete mode 100644 krebs/Zhosts/fastpoke delete mode 100644 krebs/Zhosts/filebitch delete mode 100644 krebs/Zhosts/filepimp delete mode 100644 krebs/Zhosts/flap delete mode 100644 krebs/Zhosts/foobar delete mode 100644 krebs/Zhosts/fuerkrebs delete mode 100644 krebs/Zhosts/gum delete mode 100644 krebs/Zhosts/heidi delete mode 100644 krebs/Zhosts/horisa delete mode 100644 krebs/Zhosts/horreum_magnus delete mode 100644 krebs/Zhosts/incept delete mode 100644 krebs/Zhosts/ire delete mode 100644 krebs/Zhosts/ire2 delete mode 100644 krebs/Zhosts/irkel delete mode 100644 krebs/Zhosts/juhulian delete mode 100644 krebs/Zhosts/k2 delete mode 100644 krebs/Zhosts/kabinett delete mode 100644 krebs/Zhosts/kaepsele delete mode 100644 krebs/Zhosts/kalle delete mode 100644 krebs/Zhosts/karthus delete mode 100644 krebs/Zhosts/kebsco delete mode 100644 krebs/Zhosts/khackplug delete mode 100644 krebs/Zhosts/kheurop delete mode 100644 krebs/Zhosts/kiosk delete mode 100644 krebs/Zhosts/krebsplug delete mode 100644 krebs/Zhosts/kvasir delete mode 100644 krebs/Zhosts/laqueus delete mode 100644 krebs/Zhosts/linuxatom delete mode 100644 krebs/Zhosts/luminos delete mode 100644 krebs/Zhosts/machine delete mode 100644 krebs/Zhosts/makalu delete mode 100644 krebs/Zhosts/mako delete mode 100644 krebs/Zhosts/miefda0 delete mode 100644 krebs/Zhosts/minikrebs delete mode 100644 krebs/Zhosts/mkdir delete mode 100644 krebs/Zhosts/monitor delete mode 100644 krebs/Zhosts/mors delete mode 100644 krebs/Zhosts/motor delete mode 100644 krebs/Zhosts/mu delete mode 100644 krebs/Zhosts/muhbaasu delete mode 100644 krebs/Zhosts/nomic delete mode 100644 krebs/Zhosts/nomic2 delete mode 100644 krebs/Zhosts/nukular delete mode 100644 krebs/Zhosts/omo delete mode 100644 krebs/Zhosts/pic delete mode 100644 krebs/Zhosts/pigstarter delete mode 100644 krebs/Zhosts/pike delete mode 100644 krebs/Zhosts/pnp delete mode 100644 krebs/Zhosts/pornocauster delete mode 100644 krebs/Zhosts/prism delete mode 100644 krebs/Zhosts/radiotuxmini delete mode 100644 krebs/Zhosts/random delete mode 100644 krebs/Zhosts/raspafari delete mode 100644 krebs/Zhosts/reimae delete mode 100644 krebs/Zhosts/rmdir delete mode 100644 krebs/Zhosts/robchina delete mode 100644 krebs/Zhosts/rockit delete mode 100644 krebs/Zhosts/rtjure_debian_oder_so delete mode 100644 krebs/Zhosts/rtjure_ras delete mode 100644 krebs/Zhosts/rtjure_rdrlab_linkstation delete mode 100644 krebs/Zhosts/rubus delete mode 100644 krebs/Zhosts/senderechner delete mode 100644 krebs/Zhosts/serenity delete mode 100644 krebs/Zhosts/seruundroid delete mode 100644 krebs/Zhosts/sir_krebs_a_lot delete mode 100644 krebs/Zhosts/skirfir delete mode 100644 krebs/Zhosts/sleipnir delete mode 100644 krebs/Zhosts/smove delete mode 100644 krebs/Zhosts/sokrates delete mode 100644 krebs/Zhosts/sokrateslaptop delete mode 100644 krebs/Zhosts/soundflower delete mode 100644 krebs/Zhosts/steve delete mode 100644 krebs/Zhosts/stro delete mode 100644 krebs/Zhosts/tahoe delete mode 100644 krebs/Zhosts/taschenkrebs delete mode 100644 krebs/Zhosts/terrapi delete mode 100644 krebs/Zhosts/thomasDOTde delete mode 100644 krebs/Zhosts/tincdroid delete mode 100644 krebs/Zhosts/tmpd delete mode 100644 krebs/Zhosts/tpsw delete mode 100644 krebs/Zhosts/tsp delete mode 100644 krebs/Zhosts/ufo delete mode 100644 krebs/Zhosts/uriel delete mode 100644 krebs/Zhosts/vault delete mode 100644 krebs/Zhosts/vbob delete mode 100644 krebs/Zhosts/voyager delete mode 100644 krebs/Zhosts/wbob delete mode 100644 krebs/Zhosts/wolf delete mode 100644 krebs/Zhosts/wooktop delete mode 100644 krebs/Zhosts/wry delete mode 100644 krebs/Zhosts/wu delete mode 100644 krebs/Zhosts/xu delete mode 100644 krebs/Zhosts/ytart delete mode 100644 krebs/Zhosts/zombiecancer (limited to 'krebs/3modules') diff --git a/krebs/3modules/retiolum.nix b/krebs/3modules/retiolum.nix index e0e2692a8..08ac96461 100644 --- a/krebs/3modules/retiolum.nix +++ b/krebs/3modules/retiolum.nix @@ -1,6 +1,4 @@ { config, pkgs, lib, ... }: - -with builtins; with lib; let cfg = config.krebs.retiolum; @@ -40,7 +38,7 @@ let ''; }; - network = mkOption { + netname = mkOption { type = types.str; default = "retiolum"; description = '' @@ -65,10 +63,13 @@ let }; hosts = mkOption { - type = with types; either package path; - default = ../Zhosts; + type = with types; attrsOf host; + default = + filterAttrs (_: h: hasAttr cfg.netname h.nets) config.krebs.hosts; description = '' - If a path is given, then it will be used to generate an ad-hoc package. + Hosts which should be part of the tinc configuration. + Note that these hosts must have a correspondingly named network + configured, see config.krebs.retiolum.netname. ''; }; @@ -104,7 +105,7 @@ let }; imp = { - environment.systemPackages = [ tinc hosts iproute ]; + environment.systemPackages = [ tinc iproute ]; networking.extraHosts = retiolumExtraHosts; @@ -140,17 +141,16 @@ let tinc = cfg.tincPackage; - hosts = getAttr (typeOf cfg.hosts) { - package = cfg.hosts; - path = pkgs.stdenv.mkDerivation { - name = "custom-retiolum-hosts"; - src = cfg.hosts; - installPhase = '' - mkdir $out - find . -name .git -prune -o -type f -print0 \ - | xargs -0 cp --target-directory $out - ''; - }; + tinc-hosts = pkgs.stdenv.mkDerivation { + name = "${cfg.netname}-tinc-hosts"; + phases = [ "installPhase" ]; + installPhase = '' + mkdir $out + ${concatStrings (mapAttrsToList (_: host: '' + echo ${shell.escape host.nets.${cfg.netname}.tinc.config} \ + > $out/${shell.escape host.name} + '') cfg.hosts)} + ''; }; iproute = cfg.iproutePackage; @@ -159,7 +159,7 @@ let { } '' generate() { - (cd ${hosts} + (cd ${tinc-hosts} printf \'\' for i in `ls`; do names=$(hostnames $i) @@ -180,11 +180,11 @@ let generate ;; long) - hostnames() { echo "$1.${cfg.network}"; } + hostnames() { echo "$1.${cfg.netname}"; } generate ;; both) - hostnames() { echo "$1.${cfg.network} $1"; } + hostnames() { echo "$1.${cfg.netname} $1"; } generate ;; *) @@ -203,12 +203,12 @@ let mkdir -p $out - ln -s ${hosts} $out/hosts + ln -s ${tinc-hosts} $out/hosts cat > $out/tinc.conf < Date: Sat, 6 Feb 2016 15:43:24 +0100 Subject: krebs.retiolum: don't generate extraHosts --- krebs/3modules/default.nix | 1 - krebs/3modules/retiolum.nix | 54 ++------------------------------------------- 2 files changed, 2 insertions(+), 53 deletions(-) (limited to 'krebs/3modules') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index ba1f425d9..7418434ea 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -96,7 +96,6 @@ let retiolum = "hosts"; }; - # XXX This overlaps with krebs.retiolum networking.extraHosts = concatStringsSep "\n" (flatten ( mapAttrsToList (hostname: host: mapAttrsToList (netname: net: diff --git a/krebs/3modules/retiolum.nix b/krebs/3modules/retiolum.nix index 08ac96461..2bf8aa5db 100644 --- a/krebs/3modules/retiolum.nix +++ b/krebs/3modules/retiolum.nix @@ -29,22 +29,13 @@ let ''; }; - generateEtcHosts = mkOption { - type = types.str; - default = "both"; - description = '' - If set to short, long, or both, - then generate entries in /etc/hosts from subnets. - ''; - }; - netname = mkOption { type = types.str; default = "retiolum"; description = '' The tinc network name. - It is used to generate long host entries, - and name the TUN device. + It is used to name the TUN device and to generate the default value for + config.krebs.retiolum.hosts. ''; }; @@ -107,8 +98,6 @@ let imp = { environment.systemPackages = [ tinc iproute ]; - networking.extraHosts = retiolumExtraHosts; - systemd.services.retiolum = { description = "Tinc daemon for Retiolum"; after = [ "network.target" ]; @@ -155,45 +144,6 @@ let iproute = cfg.iproutePackage; - retiolumExtraHosts = import (pkgs.runCommand "retiolum-etc-hosts" - { } - '' - generate() { - (cd ${tinc-hosts} - printf \'\' - for i in `ls`; do - names=$(hostnames $i) - for j in `sed -En 's|^ *Aliases *= *(.+)|\1|p' $i`; do - names="$names $(hostnames $j)" - done - sed -En ' - s|^ *Subnet *= *([^ /]*)(/[0-9]*)? *$|\1 '"$names"'|p - ' $i - done | sort - printf \'\' - ) - } - - case ${cfg.generateEtcHosts} in - short) - hostnames() { echo "$1"; } - generate - ;; - long) - hostnames() { echo "$1.${cfg.netname}"; } - generate - ;; - both) - hostnames() { echo "$1.${cfg.netname} $1"; } - generate - ;; - *) - echo '""' - ;; - esac > $out - ''); - - confDir = pkgs.runCommand "retiolum" { # TODO text executable = true; -- cgit v1.3.1 From a1f7f5e510ddc7a35bebe4ec7698e19d83d57c3f Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 15:57:43 +0100 Subject: krebs: DRY up shorts of the networking.extraHosts generator --- krebs/3modules/default.nix | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'krebs/3modules') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 7418434ea..20eb944e2 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -103,10 +103,8 @@ let aliases = longs ++ shorts; providers = dns.split-by-provider net.aliases cfg.dns.providers; longs = providers.hosts; - shorts = - map (removeSuffix ".${cfg.search-domain}") - (filter (hasSuffix ".${cfg.search-domain}") - longs); + shorts = let s = ".${cfg.search-domain}"; in + map (removeSuffix s) (filter (hasSuffix s) longs); in map (addr: "${addr} ${toString aliases}") net.addrs ) (filterAttrs (name: host: host.aliases != []) host.nets) -- cgit v1.3.1 From 171df3acbe8ebe97d690bfb386fbf15bc14984cd Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 16:15:25 +0100 Subject: tv: adopt kaepsele --- krebs/3modules/tv/default.nix | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) (limited to 'krebs/3modules') diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index 31c1a375a..5f70f8489 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -130,6 +130,35 @@ with lib; }; ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBaMjBJ/BfYlHjyn5CO0xzFNaQ0LPvMP3W9UlOs1OxGY"; }; + kaepsele = { + nets = { + internet = { + addrs4 = ["92.222.10.169"]; + aliases = [ + "kaepsele.internet" + # TODO "kaepsele.org" + ]; + }; + retiolum = { + addrs4 = ["10.243.166.2"]; + addrs6 = ["42:0b9d:6660:d07c:2bb7:4e91:1a01:2e7d"]; + aliases = [ + "kaepsele.retiolum" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEAxj7kaye4pGLou7mVRTVgtcWFjuEosJlxVg24gM7nU1EaoRnBD93/ + Y3Je7BSUbz5xMXr5SFTPSkitInL7vU+jDOf2bEpqv+uUJAJIz85494oPS9xocdWo + rQsrQRAtOg4MLD+YIoAxQm2Mc4nt2CSE1+UP4uXGxpuh0c051b+9Kmwv1bTyHB9y + y01VSkDvNyHk5eA+RGDiujBAzhi35hzTlQgCJ3REOBiq4YmE1d3qpk3oNiYUcrcu + yFzQrSRIfhXjuzIR+wxqS95HDUsewSwt9HgkjJzYF5sQZSea0/XsroFqZyTJ8iB5 + FQx2emBqB525cWKOt0f5jgyjklhozhJyiwIDAQAB + -----END RSA PUBLIC KEY----- + ''; + }; + }; + ssh.pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDA9cDUg7qm37uOhQpdKSgpnJPWao9VZR6LFNphVcJQ++gYvVgWu6WMhigiy7DcGQSStUlXkZc4HZBBugwwNWcf7aAF6ijBuG5rVwb9AFQmSexpTOfWap33iA5f+LXYFHe7iv4Pt9TYO1ga1Ryl4EGKb7ol2h5vbKC+JiGaDejB0WqhBAyrTg4tTWO8k2JT11CrlTjNVctqV0IVAMtTc/hcJcNusnoGD4ic0QGSzEMYxcIGRNvIgWmxhI6GHeaHxXWH5fv4b0OpLlDfVUsIvEo9KVozoLGm/wgLBG/tQXKaF9qVMVgOYi9sX/hDLwhRrcD2cyAlq9djo2pMARYiriXF"; + }; nomic = { cores = 2; dc = "tv"; #dc = "gg23"; -- cgit v1.3.1 From c4655c3baad28525550e7c1d0fb9589e06663a2b Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 16:21:30 +0100 Subject: krebs.dns.providers: add i and r --- krebs/3modules/default.nix | 2 ++ 1 file changed, 2 insertions(+) (limited to 'krebs/3modules') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 20eb944e2..529506905 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -92,7 +92,9 @@ let de.krebsco = "zones"; gg23 = "hosts"; shack = "hosts"; + i = "hosts"; internet = "hosts"; + r = "hosts"; retiolum = "hosts"; }; -- cgit v1.3.1 From b16bfb9c99e6f1f063c5b7358003149db42b70e3 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 16:18:52 +0100 Subject: tv: add .i and .r TLDs --- krebs/3modules/tv/default.nix | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'krebs/3modules') diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index 5f70f8489..7db5c532e 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -24,6 +24,7 @@ with lib; internet = { addrs4 = ["162.219.7.216"]; aliases = [ + "cd.i" "cd.internet" "cd.krebsco.de" "cgit.cd.krebsco.de" @@ -37,6 +38,7 @@ with lib; addrs4 = ["10.243.113.222"]; addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af3"]; aliases = [ + "cd.r" "cd.retiolum" "cgit.cd.retiolum" ]; @@ -67,6 +69,7 @@ with lib; internet = { addrs4 = ["104.167.114.142"]; aliases = [ + "mkdir.i" "mkdir.internet" ]; }; @@ -75,6 +78,7 @@ with lib; addrs4 = ["10.243.113.223"]; addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af4"]; aliases = [ + "mkdir.r" "mkdir.retiolum" "cgit.mkdir.retiolum" ]; @@ -104,6 +108,7 @@ with lib; internet = { addrs4 = ["198.147.22.115"]; aliases = [ + "ire.i" "ire.internet" "ire.krebsco.de" ]; @@ -113,6 +118,7 @@ with lib; addrs4 = ["10.243.231.66"]; addrs6 = ["42:b912:0f42:a82d:0d27:8610:e89b:490c"]; aliases = [ + "ire.r" "ire.retiolum" ]; tinc.pubkey = '' @@ -135,6 +141,7 @@ with lib; internet = { addrs4 = ["92.222.10.169"]; aliases = [ + "kaepsele.i" "kaepsele.internet" # TODO "kaepsele.org" ]; @@ -143,6 +150,7 @@ with lib; addrs4 = ["10.243.166.2"]; addrs6 = ["42:0b9d:6660:d07c:2bb7:4e91:1a01:2e7d"]; aliases = [ + "kaepsele.r" "kaepsele.retiolum" ]; tinc.pubkey = '' @@ -171,6 +179,7 @@ with lib; addrs4 = ["10.243.0.110"]; addrs6 = ["42:02d5:733f:d6da:c0f5:2bb7:2b18:09ec"]; aliases = [ + "nomic.r" "nomic.retiolum" "cgit.nomic.retiolum" ]; @@ -205,6 +214,7 @@ with lib; internet = { addrs4 = ["167.88.34.182"]; aliases = [ + "rmdir.i" "rmdir.internet" ]; }; @@ -213,6 +223,7 @@ with lib; addrs4 = ["10.243.113.224"]; addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af5"]; aliases = [ + "rmdir.r" "rmdir.retiolum" "cgit.rmdir.retiolum" ]; @@ -260,6 +271,7 @@ with lib; addrs4 = ["10.243.13.37"]; addrs6 = ["42:0:0:0:0:0:0:1337"]; aliases = [ + "wu.r" "wu.retiolum" "cgit.wu.retiolum" ]; @@ -292,6 +304,7 @@ with lib; addrs4 = ["10.243.13.38"]; addrs6 = ["42:0:0:0:0:0:0:1338"]; aliases = [ + "xu.r" "xu.retiolum" ]; tinc.pubkey = '' -- cgit v1.3.1 From 9742953ee932b96cafb390f7b61edd68499cec82 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 16:53:35 +0100 Subject: tv: add cgit.*.r aliases --- krebs/3modules/tv/default.nix | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'krebs/3modules') diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index 7db5c532e..b7fd1c54c 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -40,6 +40,7 @@ with lib; aliases = [ "cd.r" "cd.retiolum" + "cgit.cd.r" "cgit.cd.retiolum" ]; tinc.pubkey = '' @@ -80,6 +81,7 @@ with lib; aliases = [ "mkdir.r" "mkdir.retiolum" + "cgit.mkdir.r" "cgit.mkdir.retiolum" ]; tinc.pubkey = '' @@ -181,6 +183,7 @@ with lib; aliases = [ "nomic.r" "nomic.retiolum" + "cgit.nomic.r" "cgit.nomic.retiolum" ]; tinc.pubkey = '' @@ -225,6 +228,7 @@ with lib; aliases = [ "rmdir.r" "rmdir.retiolum" + "cgit.rmdir.r" "cgit.rmdir.retiolum" ]; tinc.pubkey = '' @@ -273,6 +277,7 @@ with lib; aliases = [ "wu.r" "wu.retiolum" + "cgit.wu.r" "cgit.wu.retiolum" ]; tinc.pubkey = '' -- cgit v1.3.1 From c784d271c5dc8783e5e6308baf4f6dd26430bfca Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 18:38:51 +0100 Subject: tv: adopt mu --- krebs/3modules/tv/default.nix | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) (limited to 'krebs/3modules') diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index b7fd1c54c..9adb0ce11 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -169,6 +169,28 @@ with lib; }; ssh.pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDA9cDUg7qm37uOhQpdKSgpnJPWao9VZR6LFNphVcJQ++gYvVgWu6WMhigiy7DcGQSStUlXkZc4HZBBugwwNWcf7aAF6ijBuG5rVwb9AFQmSexpTOfWap33iA5f+LXYFHe7iv4Pt9TYO1ga1Ryl4EGKb7ol2h5vbKC+JiGaDejB0WqhBAyrTg4tTWO8k2JT11CrlTjNVctqV0IVAMtTc/hcJcNusnoGD4ic0QGSzEMYxcIGRNvIgWmxhI6GHeaHxXWH5fv4b0OpLlDfVUsIvEo9KVozoLGm/wgLBG/tQXKaF9qVMVgOYi9sX/hDLwhRrcD2cyAlq9djo2pMARYiriXF"; }; + mu = { + nets = { + retiolum = { + addrs4 = ["10.243.20.01"]; + addrs6 = ["42:0:0:0:0:0:0:2001"]; + aliases = [ + "mu.r" + "mu.retiolum" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEApXErmPSn2CO4V25lqxanCGCFgxEAjdzFUiTCCu0IvELEuCc3PqVA + g4ecf8gGwPCbzMW/1txjlgbsQcm87U5enaCwzSv/pa7P9/memV74OhqEVOypFlDE + XeZczqQfNbjoLYl4cKZpTsSZmOgASXaMDrH2N37f50q35C0MQw0HRzaQM5VLrzb4 + o87MClS+yPqpvp34QjW+1lqnOKvMkr6mDrmtcAjCOs9Ma16txyfjGVFi8KmYqIs1 + QEJmyC9Uocz5zuoSLUghgVRn9yl4+MEw6++akFDwKt/eMkcSq0GPB+3Rz/WLDiBs + FK6BsssQWdwiEWpv6xIl1Fi+s7F0riq2cwIDAQAB + -----END RSA PUBLIC KEY----- + ''; + }; + }; + }; nomic = { cores = 2; dc = "tv"; #dc = "gg23"; -- cgit v1.3.1