From 952c03b3742cc1a979e4a1c148d083f1334cfe65 Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 19 Oct 2015 20:02:29 +0200 Subject: krebs 5 retiolum-bootstrap: init new_install.sh package --- krebs/5pkgs/retiolum-bootstrap/default.nix | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 krebs/5pkgs/retiolum-bootstrap/default.nix (limited to 'krebs') diff --git a/krebs/5pkgs/retiolum-bootstrap/default.nix b/krebs/5pkgs/retiolum-bootstrap/default.nix new file mode 100644 index 000000000..d3bcc05db --- /dev/null +++ b/krebs/5pkgs/retiolum-bootstrap/default.nix @@ -0,0 +1,6 @@ +{ fetchurl }: + +fetchurl { + url = https://raw.githubusercontent.com/krebscode/painload/master/retiolum/scripts/tinc_setup/new_install.sh; + sha256 = "03kmil8q2xm3rdm2jxyah7vww84pw6w01d0c3siid9zpn2j7la9s"; +} -- cgit v1.2.3 From 5a1808617aa121b8fc66389d8e92e387bb25a64c Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 19 Oct 2015 21:49:08 +0200 Subject: krebs 5 retiolum-bootstrap: packing to be used by nginx --- krebs/5pkgs/retiolum-bootstrap/default.nix | 31 ++++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-) (limited to 'krebs') diff --git a/krebs/5pkgs/retiolum-bootstrap/default.nix b/krebs/5pkgs/retiolum-bootstrap/default.nix index d3bcc05db..331b1cb7f 100644 --- a/krebs/5pkgs/retiolum-bootstrap/default.nix +++ b/krebs/5pkgs/retiolum-bootstrap/default.nix @@ -1,6 +1,29 @@ -{ fetchurl }: +{ stdenv,lib,fetchurl, ... }: +with lib; +stdenv.mkDerivation rec { + name = "retiolum-bootstrap"; + version = "4.2.3"; -fetchurl { - url = https://raw.githubusercontent.com/krebscode/painload/master/retiolum/scripts/tinc_setup/new_install.sh; - sha256 = "03kmil8q2xm3rdm2jxyah7vww84pw6w01d0c3siid9zpn2j7la9s"; + + src = fetchurl { + url = https://raw.githubusercontent.com/krebscode/painload/master/retiolum/scripts/tinc_setup/new_install.sh; + sha256 = "03kmil8q2xm3rdm2jxyah7vww84pw6w01d0c3siid9zpn2j7la9s"; + }; + + phases = [ + "installPhase" + ]; + + installPhase = '' + mkdir -p "$out" + cp -a ${src} $out/retiolum.sh + ''; + + meta = { + description = "Retiolum boostrap scripts"; + url = https://github.com/krebscode/painload; + license = licenses.wtfpl; + platforms = platforms.unix; + maintainers = with maintainers; [ makefu ]; + }; } -- cgit v1.2.3 From 754ea55ab89cdeffaac7b4b66ca792558fed9237 Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 19 Oct 2015 21:50:08 +0200 Subject: krebs 3 retiolum-bootstrap: init module --- krebs/3modules/default.nix | 1 + krebs/3modules/retiolum-bootstrap.nix | 60 +++++++++++++++++++++++++++++++++++ 2 files changed, 61 insertions(+) create mode 100644 krebs/3modules/retiolum-bootstrap.nix (limited to 'krebs') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index ff0cc8346..756245c0b 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -14,6 +14,7 @@ let ./iptables.nix ./nginx.nix ./Reaktor.nix + ./retiolum-bootstrap.nix ./realwallpaper.nix ./retiolum.nix ./urlwatch.nix diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix new file mode 100644 index 000000000..5cce4c2af --- /dev/null +++ b/krebs/3modules/retiolum-bootstrap.nix @@ -0,0 +1,60 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + cfg = config.krebs.retiolum-bootstrap; + + out = { + options.krebs.retiolum-bootstrap = api; + config = mkIf cfg.enable imp ; + }; + + api = { + enable = mkEnableOption "retiolum boot strap for tinc.krebsco.de"; + hostname = mkOption { + type = types.str; + description = "hostname which serves tinc boot"; + default = "tinc.krebsco.de" ; + }; + ssl_certificate_key = mkOption { + type = types.str; + description = "Certificate key to use for ssl"; + default = "/root/secrets/tinc.krebsco.de.key"; + }; + ssl_certificate = mkOption { + type = types.str; + description = "Certificate file to use for ssl"; + default = "/root/secrets/tinc.krebsco.de.crt" ; + }; + # in use: + # + # + }; + + imp = { + # TODO: assert krebs nginx + + krebs.nginx.servers = { + retiolum-boot-redir = { + server-names = singleton cfg.hostname; + extraConfig = '' + return 301 https://$server_name$request_uri; + ''; + locations = []; + }; + retiolum-boot-ssl = { + server-names = singleton cfg.hostname; + listen = "443 ssl"; + extraConfig = '' + ssl_certificate ${cfg.ssl_certificate}; + ssl_certificate_key ${cfg.ssl_certificate_key}; + root ${pkgs.retiolum-bootstrap}; + try_files $uri $uri/retiolum.sh; + ''; + locations = []; + }; + }; + }; + +in +out -- cgit v1.2.3 From 858034cc615469c6e4b7e48711f6fb026f16ffb4 Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 19 Oct 2015 21:51:20 +0200 Subject: m 1 wry: host is the new provider for tinc.krebsco.de --- krebs/3modules/makefu/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs') diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix index 4628b2acc..659e71458 100644 --- a/krebs/3modules/makefu/default.nix +++ b/krebs/3modules/makefu/default.nix @@ -130,7 +130,6 @@ with import ../../4lib { inherit lib; }; io IN NS pigstarter.krebsco.de. pigstarter IN A ${head nets.internet.addrs4} gold IN A ${head nets.internet.addrs4} - tinc IN A ${head nets.internet.addrs4} boot IN A ${head nets.internet.addrs4}''; }; nets = { @@ -167,6 +166,7 @@ with import ../../4lib { inherit lib; }; "krebsco.de" = '' wry IN A ${head nets.internet.addrs4} graphs IN A ${head nets.internet.addrs4} + tinc IN A ${head nets.internet.addrs4} ''; }; nets = rec { -- cgit v1.2.3 From 8d3ebfc096c10e9d498ca0bed934ad9e35e6c022 Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 19 Oct 2015 21:57:05 +0200 Subject: krebs 3 retiolum-bootstrap: fix assert todo --- krebs/3modules/retiolum-bootstrap.nix | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'krebs') diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix index 5cce4c2af..eed11642f 100644 --- a/krebs/3modules/retiolum-bootstrap.nix +++ b/krebs/3modules/retiolum-bootstrap.nix @@ -32,9 +32,7 @@ let }; imp = { - # TODO: assert krebs nginx - - krebs.nginx.servers = { + krebs.nginx.servers = assert config.krebs.nginx.enable; { retiolum-boot-redir = { server-names = singleton cfg.hostname; extraConfig = '' -- cgit v1.2.3 From ded0821d9bf7c85e2197cb7811d5f95987ded02e Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 19 Oct 2015 23:46:10 +0200 Subject: m 1,2 : wry serves as iodine entry point --- krebs/3modules/makefu/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs') diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix index 659e71458..acc5d7dd2 100644 --- a/krebs/3modules/makefu/default.nix +++ b/krebs/3modules/makefu/default.nix @@ -127,7 +127,6 @@ with import ../../4lib { inherit lib; }; "krebsco.de" = '' IN MX 10 mx42 euer IN MX 1 aspmx.l.google.com. - io IN NS pigstarter.krebsco.de. pigstarter IN A ${head nets.internet.addrs4} gold IN A ${head nets.internet.addrs4} boot IN A ${head nets.internet.addrs4}''; @@ -165,6 +164,7 @@ with import ../../4lib { inherit lib; }; extraZones = { "krebsco.de" = '' wry IN A ${head nets.internet.addrs4} + io IN NS wry.krebsco.de. graphs IN A ${head nets.internet.addrs4} tinc IN A ${head nets.internet.addrs4} ''; -- cgit v1.2.3 From 0bc015bf3c2b8f70952793cc117cd9b976ebc96e Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 20 Oct 2015 19:59:59 +0200 Subject: krebs 3 retiolum-bootstra: use nginx listen list consolidate nginx servers into 1, provide a means to override the listen addresses. --- krebs/3modules/retiolum-bootstrap.nix | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) (limited to 'krebs') diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix index eed11642f..65bb51193 100644 --- a/krebs/3modules/retiolum-bootstrap.nix +++ b/krebs/3modules/retiolum-bootstrap.nix @@ -16,6 +16,14 @@ let description = "hostname which serves tinc boot"; default = "tinc.krebsco.de" ; }; + listen = mkOption { + type = with types; listOf str; + description = ''Addresses to listen on (nginx-syntax). + ssl will be configured, http will be redirected to ssl. + Make sure to have at least 1 ssl port configured. + ''; + default = [ "80" "443 ssl" ] ; + }; ssl_certificate_key = mkOption { type = types.str; description = "Certificate key to use for ssl"; @@ -33,19 +41,17 @@ let imp = { krebs.nginx.servers = assert config.krebs.nginx.enable; { - retiolum-boot-redir = { - server-names = singleton cfg.hostname; - extraConfig = '' - return 301 https://$server_name$request_uri; - ''; - locations = []; - }; retiolum-boot-ssl = { server-names = singleton cfg.hostname; - listen = "443 ssl"; + listen = cfg.listen; extraConfig = '' ssl_certificate ${cfg.ssl_certificate}; ssl_certificate_key ${cfg.ssl_certificate_key}; + + if ($scheme = http){ + return 301 https://$server_name$request_uri; + } + root ${pkgs.retiolum-bootstrap}; try_files $uri $uri/retiolum.sh; ''; -- cgit v1.2.3 From dc1bb40c45e69c6e4556ab2c4d92f04c25e5a2bf Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 21 Oct 2015 18:44:51 +0200 Subject: krebs 3 nginx: extraConfig is type string --- krebs/3modules/nginx.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs') diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix index 0530921a0..921771033 100644 --- a/krebs/3modules/nginx.nix +++ b/krebs/3modules/nginx.nix @@ -36,7 +36,7 @@ let type = with types; listOf (attrsOf str); }; extraConfig = mkOption { - type = with types; str; + type = with types; string; default = ""; }; }; -- cgit v1.2.3 From 6eb195b0bc1b2ecd1a39c842da4d14d4837d98cc Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 21 Oct 2015 18:49:20 +0200 Subject: wry: is the new provider for paste.krebsco.de --- krebs/3modules/makefu/default.nix | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) (limited to 'krebs') diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix index acc5d7dd2..6b3781b49 100644 --- a/krebs/3modules/makefu/default.nix +++ b/krebs/3modules/makefu/default.nix @@ -163,10 +163,11 @@ with import ../../4lib { inherit lib; }; dc = "makefu"; #dc = "cac"; extraZones = { "krebsco.de" = '' - wry IN A ${head nets.internet.addrs4} - io IN NS wry.krebsco.de. - graphs IN A ${head nets.internet.addrs4} - tinc IN A ${head nets.internet.addrs4} + wry IN A ${head nets.internet.addrs4} + io IN NS wry.krebsco.de. + graphs IN A ${head nets.internet.addrs4} + paste 60 IN A ${head nets.internet.addrs4} + tinc IN A ${head nets.internet.addrs4} ''; }; nets = rec { @@ -174,6 +175,7 @@ with import ../../4lib { inherit lib; }; addrs4 = ["104.233.87.86"]; aliases = [ "wry.internet" + "paste.internet" ]; }; retiolum = { @@ -182,6 +184,8 @@ with import ../../4lib { inherit lib; }; addrs6 = ["42:6e1e:cc8a:7cef:827:f938:8c64:baad"]; aliases = [ "graphs.wry.retiolum" + "paste.wry.retiolum" + "paste.retiolum" "wry.retiolum" ]; tinc.pubkey = '' @@ -210,8 +214,7 @@ with import ../../4lib { inherit lib; }; "krebsco.de" = '' omo IN A ${head nets.internet.addrs4} euer IN A ${head nets.internet.addrs4} - gum IN A ${head nets.internet.addrs4} - paste IN A ${head nets.internet.addrs4}''; + gum IN A ${head nets.internet.addrs4} ''; }; nets = { internet = { -- cgit v1.2.3 From 9be59a04001698e8e34ae4e2a49e2dea920765b1 Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 22 Oct 2015 15:26:54 +0200 Subject: krebs 3 modules: bepasty-server is a krebs module --- krebs/3modules/bepasty-server.nix | 164 ++++++++++++++++++++++++++++++++++++++ krebs/3modules/default.nix | 1 + 2 files changed, 165 insertions(+) create mode 100644 krebs/3modules/bepasty-server.nix (limited to 'krebs') diff --git a/krebs/3modules/bepasty-server.nix b/krebs/3modules/bepasty-server.nix new file mode 100644 index 000000000..ff32eea60 --- /dev/null +++ b/krebs/3modules/bepasty-server.nix @@ -0,0 +1,164 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + gunicorn = pkgs.pythonPackages.gunicorn; + bepasty = pkgs.pythonPackages.bepasty-server; + gevent = pkgs.pythonPackages.gevent; + python = pkgs.pythonPackages.python; + cfg = config.krebs.bepasty; + + out = { + options.krebs.bepasty = api; + config = mkIf cfg.enable (mkMerge [(mkIf cfg.serveNginx nginx-imp) imp ]) ; + }; + + api = { + enable = mkEnableOption "Bepasty Servers"; + serveNginx = mkEnableOption "Serve Bepasty Servers with Nginx"; + + servers = mkOption { + type = with types; attrsOf optionSet; + options = singleton { + nginx = mkOption { + # TODO use the correct type + type = with types; attrsOf unspecified; + description = '' + additional nginx configuration. see krebs.nginx for all options + '' ; + }; + + secretKey = mkOption { + type = types.str; + description = '' + server secret for safe session cookies, must be set. + ''; + default = ""; + }; + + # we create a wsgi socket in $workDir/gunicorn-${name}.wsgi + workDir = mkOption { + type = types.str; + description = '' + Path to the working directory (used for sockets and pidfile). + Defaults to the users home directory. Must be accessible to nginx, + permissions will be set to 755 + ''; + default = config.users.extraUsers.bepasty.home; + }; + + dataDir = mkOption { + type = types.str; + description = '' + Defaults to the new users home dir which defaults to + /var/lib/bepasty-server/data + ''; + default = "${config.users.extraUsers.bepasty.home}/data"; + }; + + extraConfig = mkOption { + type = types.str; + default = ""; + # TODO configure permissions in separate + example = '' + PERMISSIONS = { + 'myadminsecret': 'admin,list,create,read,delete', + } + MAX_ALLOWED_FILE_SIZE = 5 * 1000 * 1000 + ''; + }; + + defaultPermissions = mkOption { + # TODO: listOf str + type = types.str; + description = '' + default permissions for all unauthenticated users. + ''; + example = "read,create,delete"; + default = "read"; + }; + + }; + default = {}; + }; + + }; + + imp = { + # Configures systemd services for each configured server + # environment.systemPackages = [ bepasty gunicorn gevent ]; + systemd.services = mapAttrs' (name: server: + nameValuePair ("bepasty-server-${name}") + ({ + description = "Bepasty Server ${name}"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + restartIfChanged = true; + environment = { + BEPASTY_CONFIG = "${server.workDir}/bepasty-${name}.conf"; + PYTHONPATH= "${bepasty}/lib/${python.libPrefix}/site-packages:${gevent}/lib/${python.libPrefix}/site-packages"; + }; + serviceConfig = { + Type = "simple"; + PrivateTmp = true; + + ExecStartPre = assert server.secretKey != ""; pkgs.writeScript "bepasty-server.${name}-init" '' + #!/bin/sh + mkdir -p "${server.dataDir}" "${server.workDir}" + chown bepasty:bepasty "${server.workDir}" "${server.dataDir}" + cat > "${server.workDir}/bepasty-${name}.conf" < Date: Thu, 22 Oct 2015 15:33:05 +0200 Subject: krebs 3 tinc_graphs: mv from makefu 3 tinc_graphs --- krebs/3modules/default.nix | 1 + krebs/3modules/tinc_graphs.nix | 145 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 146 insertions(+) create mode 100644 krebs/3modules/tinc_graphs.nix (limited to 'krebs') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 1f34c8e68..5c5bec005 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -18,6 +18,7 @@ let ./retiolum-bootstrap.nix ./realwallpaper.nix ./retiolum.nix + ./tinc_graphs.nix ./urlwatch.nix ]; options.krebs = api; diff --git a/krebs/3modules/tinc_graphs.nix b/krebs/3modules/tinc_graphs.nix new file mode 100644 index 000000000..a6c628353 --- /dev/null +++ b/krebs/3modules/tinc_graphs.nix @@ -0,0 +1,145 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + cfg = config.krebs.tinc_graphs; + internal_dir = "${cfg.workingDir}/internal"; + external_dir = "${cfg.workingDir}/external"; + + out = { + options.krebs.tinc_graphs = api; + config = mkIf cfg.enable imp ; + }; + + api = { + enable = mkEnableOption "tinc graphs"; + + geodbPath = mkOption { + type = types.str; + description = "Path to geocitydb, defaults to geolite-legacy"; + default = "${pkgs.geolite-legacy}/share/GeoIP/GeoIPCity.dat"; + }; + + nginx = { + enable = mkEnableOption "enable tinc_graphs to be served with nginx"; + + anonymous = { + server-names = mkOption { + type = with types; listOf str; + description = "hostnames which serve anonymous graphs"; + default = [ "graphs.${config.krebs.build.host.name}" ]; + }; + + listen = mkOption { + # use the type of the nginx listen option + type = with types; listOf str; + description = "listen address for anonymous graphs"; + default = [ "80" ]; + }; + + }; + + complete = { + server-names = mkOption { + type = with types; listOf str; + description = "hostname which serves complete graphs"; + default = [ "graphs.${config.krebs.build.host.name}" ]; + }; + + listen = mkOption { + type = with types; listOf str; + description = "listen address for complete graphs"; + default = [ "127.0.0.1:80" ]; + }; + + }; + }; + + workingDir = mkOption { + type = types.str; + description = '' + Path to working dir, will create interal and external/. + Defaults to the new users home dir which defaults to + /var/cache/tinc_graphs''; + default = config.users.extraUsers.tinc_graphs.home; + }; + + timerConfig = mkOption { + type = with types; attrsOf str; + default = { + OnCalendar = "*:0/15"; + }; + }; + }; + + imp = { + environment.systemPackages = [ pkgs.tinc_graphs]; + systemd.timers.tinc_graphs = { + description = "Build Tinc Graphs via via timer"; + wantedBy = [ "timers.target"]; + timerConfig = cfg.timerConfig; + }; + systemd.services.tinc_graphs = { + description = "Build Tinc Graphs"; + environment = { + EXTERNAL_FOLDER = external_dir; + INTERNAL_FOLDER = internal_dir; + GEODB = cfg.geodbPath; + TINC_HOSTPATH=config.krebs.retiolum.hosts; + }; + + restartIfChanged = true; + + serviceConfig = { + Type = "simple"; + + ExecStartPre = pkgs.writeScript "tinc_graphs-init" '' + #!/bin/sh + if ! test -e "${cfg.workingDir}/internal/index.html"; then + cp -fr "$(${pkgs.tinc_graphs}/bin/tincstats-static-dir)/internal/" "${internal_dir}" + fi + ''; + + ExecStart = "${pkgs.tinc_graphs}/bin/all-the-graphs"; + + ExecStartPost = pkgs.writeScript "tinc_graphs-post" '' + #!/bin/sh + # TODO: this may break if workingDir is set to something stupid + # this is needed because homedir is created with 700 + chmod 755 "${cfg.workingDir}" + ''; + PrivateTmp = "yes"; + + User = "root"; # tinc cannot be queried as user, + # seems to be a tinc-pre issue + }; + }; + + users.extraUsers.tinc_graphs = { + uid = 3925439960; #genid tinc_graphs + home = "/var/spool/tinc_graphs"; + createHome = true; + }; + + krebs.nginx.servers = mkIf cfg.nginx.enable { + tinc_graphs_complete = mkMerge [ cfg.nginx.complete { + locations = [ + (nameValuePair "/" '' + autoindex on; + root ${internal_dir}; + '') + ]; + }] ; + tinc_graphs_anonymous = mkMerge [ cfg.nginx.anonymous { + locations = [ + (nameValuePair "/" '' + autoindex on; + root ${external_dir}; + '') + ]; + }]; + }; + }; + +in +out -- cgit v1.2.3 From be39c6d8494724c6d7c87b826830f626aada15d8 Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 22 Oct 2015 16:14:37 +0200 Subject: krebs 3 bepasty-server: styling --- krebs/3modules/bepasty-server.nix | 102 +++++++++++++++++++------------------- 1 file changed, 51 insertions(+), 51 deletions(-) (limited to 'krebs') diff --git a/krebs/3modules/bepasty-server.nix b/krebs/3modules/bepasty-server.nix index ff32eea60..c99c3d11a 100644 --- a/krebs/3modules/bepasty-server.nix +++ b/krebs/3modules/bepasty-server.nix @@ -10,7 +10,10 @@ let out = { options.krebs.bepasty = api; - config = mkIf cfg.enable (mkMerge [(mkIf cfg.serveNginx nginx-imp) imp ]) ; + config = mkIf cfg.enable (mkMerge [ + (mkIf cfg.serveNginx nginx-imp) + imp + ]); }; api = { @@ -25,7 +28,7 @@ let type = with types; attrsOf unspecified; description = '' additional nginx configuration. see krebs.nginx for all options - '' ; + ''; }; secretKey = mkOption { @@ -52,7 +55,7 @@ let description = '' Defaults to the new users home dir which defaults to /var/lib/bepasty-server/data - ''; + ''; default = "${config.users.extraUsers.bepasty.home}/data"; }; @@ -65,14 +68,14 @@ let 'myadminsecret': 'admin,list,create,read,delete', } MAX_ALLOWED_FILE_SIZE = 5 * 1000 * 1000 - ''; + ''; }; defaultPermissions = mkOption { # TODO: listOf str type = types.str; description = '' - default permissions for all unauthenticated users. + default permissions for all unauthenticated users. ''; example = "read,create,delete"; default = "read"; @@ -88,42 +91,42 @@ let # Configures systemd services for each configured server # environment.systemPackages = [ bepasty gunicorn gevent ]; systemd.services = mapAttrs' (name: server: - nameValuePair ("bepasty-server-${name}") - ({ - description = "Bepasty Server ${name}"; - wantedBy = [ "multi-user.target" ]; - after = [ "network.target" ]; - restartIfChanged = true; - environment = { - BEPASTY_CONFIG = "${server.workDir}/bepasty-${name}.conf"; - PYTHONPATH= "${bepasty}/lib/${python.libPrefix}/site-packages:${gevent}/lib/${python.libPrefix}/site-packages"; - }; - serviceConfig = { - Type = "simple"; - PrivateTmp = true; - - ExecStartPre = assert server.secretKey != ""; pkgs.writeScript "bepasty-server.${name}-init" '' - #!/bin/sh - mkdir -p "${server.dataDir}" "${server.workDir}" - chown bepasty:bepasty "${server.workDir}" "${server.dataDir}" - cat > "${server.workDir}/bepasty-${name}.conf" < "${server.workDir}/bepasty-${name}.conf" < Date: Thu, 22 Oct 2015 17:17:04 +0200 Subject: krebs 3 zones: remove empty lines --- krebs/3modules/default.nix | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'krebs') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 5c5bec005..075db1826 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -105,10 +105,14 @@ let # Implements environment.etc."zones/" environment.etc = let + stripEmptyLines = s: concatStringsSep "\n" + (remove "\n" (remove "" (splitString "\n" s))); all-zones = foldAttrs (sum: current: sum + "\n" +current ) "" - ([cfg.zone-head-config] ++ combined-hosts) ; + ([cfg.zone-head-config] ++ combined-hosts); combined-hosts = (mapAttrsToList (name: value: value.extraZones) cfg.hosts ); - in lib.mapAttrs' (name: value: nameValuePair (("zones/" + name)) ({ text=value; })) all-zones; + in lib.mapAttrs' (name: value: nameValuePair + ("zones/" + name) + { text=(stripEmptyLines value); }) all-zones; krebs.exim-smarthost.internet-aliases = let format = from: to: -- cgit v1.2.3