From b82fd9ba290c988e03e34c51fc3b1976be11739d Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 4 Sep 2015 01:29:32 +0200 Subject: krebs tv hosts: add xu --- krebs/3modules/default.nix | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) (limited to 'krebs') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 140045b93..077a0e069 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -683,6 +683,31 @@ let }; secure = true; }; + xu = { + cores = 4; + # TODO xu is mobile, so dc means "home data center" + dc = "tv"; #dc = "gg23"; + nets = { + retiolum = { + addrs4 = ["10.243.13.38"]; + addrs6 = ["42:0:0:0:0:0:0:1338"]; + aliases = [ + "xu.retiolum" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEAl3l7IWbfbkVgaJFM3s9g2UCh2rmqoTba16Of7NNWMj05L/hIkUsQ + uc43/QzidWh/4gEaq5MQ7JpLyzVBQYRJkNlPRF/Z07KdLBskAZCjDYdYue9BrziX + 8s2Irs2+FNbCK2LqtrPhbcXQJvixsk6vjl2OBpWTDUcDEsk+D1YQilxdtyUzCUkw + mmRo/mzNsLZsYlSgZ6El/ZLkRdtexAzGxJ0DrukpDR0uqXXkp7jUaxRCZ+Cwanvj + 4I1Hu5aHzWB7KJ1SIvpX3a4f+mun1gh3TPqWP5PUqJok1PSuScz6P2UGaLZZyH63 + 4o+9nGJPuzb9bpMVRaVGtKXd39jwY7mbqwIDAQAB + -----END RSA PUBLIC KEY----- + ''; + }; + }; + secure = true; + }; }; users = addNames { mv = { -- cgit v1.2.3 From c2c528926cb0fcf25a2ae4ca718e3ada89afcada Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 4 Sep 2015 01:51:40 +0200 Subject: krebs types net.tinc: s/apply/default/ --- krebs/4lib/types.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs') diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix index 4e123e723..f6b4bd8b1 100644 --- a/krebs/4lib/types.nix +++ b/krebs/4lib/types.nix @@ -67,7 +67,7 @@ types // rec { options = { config = mkOption { type = str; - apply = _: '' + default = '' ${optionalString (net-config.via != null) (concatMapStringsSep "\n" (a: "Address = ${a}") net-config.via.addrs)} ${concatMapStringsSep "\n" (a: "Subnet = ${a}") net-config.addrs} -- cgit v1.2.3 From 66a2f7a231599ffc182bcf6a5b4ccf24548861f3 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 4 Sep 2015 01:52:50 +0200 Subject: krebs Zhosts: add xu --- krebs/Zhosts/xu | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 krebs/Zhosts/xu (limited to 'krebs') diff --git a/krebs/Zhosts/xu b/krebs/Zhosts/xu new file mode 100644 index 000000000..688e4a340 --- /dev/null +++ b/krebs/Zhosts/xu @@ -0,0 +1,13 @@ + +Subnet = 10.243.13.38 +Subnet = 42:0:0:0:0:0:0:1338 +-----BEGIN RSA PUBLIC KEY----- +MIIBCgKCAQEAl3l7IWbfbkVgaJFM3s9g2UCh2rmqoTba16Of7NNWMj05L/hIkUsQ +uc43/QzidWh/4gEaq5MQ7JpLyzVBQYRJkNlPRF/Z07KdLBskAZCjDYdYue9BrziX +8s2Irs2+FNbCK2LqtrPhbcXQJvixsk6vjl2OBpWTDUcDEsk+D1YQilxdtyUzCUkw +mmRo/mzNsLZsYlSgZ6El/ZLkRdtexAzGxJ0DrukpDR0uqXXkp7jUaxRCZ+Cwanvj +4I1Hu5aHzWB7KJ1SIvpX3a4f+mun1gh3TPqWP5PUqJok1PSuScz6P2UGaLZZyH63 +4o+9nGJPuzb9bpMVRaVGtKXd39jwY7mbqwIDAQAB +-----END RSA PUBLIC KEY----- + + -- cgit v1.2.3 From 9dcea815c6d840abee2009c2cb56695039dbc8c8 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 5 Sep 2015 12:12:21 +0200 Subject: krebs 3: make rsync work on retarted systems --- krebs/3modules/default.nix | 2 -- 1 file changed, 2 deletions(-) (limited to 'krebs') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 65ebad7b8..ab78bcd2e 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -58,8 +58,6 @@ let --exclude .graveyard \ --exclude old \ --rsync-path="mkdir -p \"$2\" && rsync" \ - --usermap=\*:0 \ - --groupmap=\*:0 \ --delete-excluded \ -vrLptgoD \ "$src" "$dst" -- cgit v1.2.3 From f3c1727659c59ff638b1adead8e30ee2f79f39de Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 5 Sep 2015 12:15:31 +0200 Subject: lass: add echelon --- krebs/3modules/default.nix | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) (limited to 'krebs') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index ab78bcd2e..78907960b 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -216,6 +216,37 @@ let lass-imp = { hosts = addNames { + echelon = { + cores = 4; + dc = "lass"; #dc = "cac"; + nets = rec { + internet = { + addrs4 = ["162.248.167.198"]; + aliases = [ + "echelon.internet" + ]; + }; + retiolum = { + via = internet; + addrs4 = ["10.243.206.103"]; + addrs6 = ["42:941e:2816:35f4:5c5e:206b:3f0b:f763"]; + aliases = [ + "echelon.retiolum" + "cgit.echelon.retiolum" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEA92ybhDahtGybpAkUNlG5Elxw05MVY4Pg7yK0dQugB4nVq+pnmi78 + DOMeIciecMHmJM8n9UlUU0eWZVCgHeVd23d6J0hTHCv24p24uHEGGy7XlO/dPJ6A + IjROYU0l8c03pipdJ3cDBx6riArSglwmZJ7xH/Iw0BUhRZrPqbtijY7EcG2wc+8K + N9N9mBofVMl4EcBiDR/eecK+ro8OkeOmYPtYgFJLvxTYXiPIhOxMAlkOY2fpin/t + cgFLUFuN4ag751XjjcNpVovVq95vdg+VhKrrNVWZjJt03owW81BzoryY6CD2kIPq + UxK89zEdeYOUT7AxaT/5V5v41IvGFZxCzwIDAQAB + -----END RSA PUBLIC KEY----- + ''; + }; + }; + }; cloudkrebs = { cores = 1; dc = "lass"; #dc = "cac"; -- cgit v1.2.3 From b35fd2bb734e0d857ba6d673e924affafe1475e6 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 18 Sep 2015 02:59:37 +0200 Subject: krebs 5 cac: add inotifyTools as dependency --- krebs/5pkgs/cac/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'krebs') diff --git a/krebs/5pkgs/cac/default.nix b/krebs/5pkgs/cac/default.nix index eff523048..838eddd2f 100644 --- a/krebs/5pkgs/cac/default.nix +++ b/krebs/5pkgs/cac/default.nix @@ -1,4 +1,4 @@ -{ stdenv, fetchgit, coreutils, curl, gnused, jq, ncurses, sshpass, ... }: +{ stdenv, fetchgit, coreutils, curl, gnused, inotifyTools, jq, ncurses, sshpass, ... }: stdenv.mkDerivation { name = "cac"; @@ -20,6 +20,7 @@ stdenv.mkDerivation { coreutils curl gnused + inotifyTools jq ncurses sshpass -- cgit v1.2.3 From 03263a58d870229b61430c80f21cb178ee251cc6 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 18 Sep 2015 03:04:13 +0200 Subject: krebs Zhosts: add echelon --- krebs/Zhosts/echelon | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 krebs/Zhosts/echelon (limited to 'krebs') diff --git a/krebs/Zhosts/echelon b/krebs/Zhosts/echelon new file mode 100644 index 000000000..9d1c324fd --- /dev/null +++ b/krebs/Zhosts/echelon @@ -0,0 +1,12 @@ +Address = 168.235.156.81 +Subnet = 10.243.206.103 +Subnet = 42:941e:2816:35f4:5c5e:206b:3f0b:f763 + +-----BEGIN RSA PUBLIC KEY----- +MIIBCgKCAQEA92ybhDahtGybpAkUNlG5Elxw05MVY4Pg7yK0dQugB4nVq+pnmi78 +DOMeIciecMHmJM8n9UlUU0eWZVCgHeVd23d6J0hTHCv24p24uHEGGy7XlO/dPJ6A +IjROYU0l8c03pipdJ3cDBx6riArSglwmZJ7xH/Iw0BUhRZrPqbtijY7EcG2wc+8K +N9N9mBofVMl4EcBiDR/eecK+ro8OkeOmYPtYgFJLvxTYXiPIhOxMAlkOY2fpin/t +cgFLUFuN4ag751XjjcNpVovVq95vdg+VhKrrNVWZjJt03owW81BzoryY6CD2kIPq +UxK89zEdeYOUT7AxaT/5V5v41IvGFZxCzwIDAQAB +-----END RSA PUBLIC KEY----- -- cgit v1.2.3 From ab946ab7c12a5f25c62c0abfea5fa38189411e7b Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 18 Sep 2015 03:04:39 +0200 Subject: add "make infest" --- krebs/3modules/default.nix | 106 +++++++++++++++++++++++++++++++++++ krebs/4lib/infest/1prepare | 74 ++++++++++++++++++++++++ krebs/4lib/infest/2install-nix | 57 +++++++++++++++++++ krebs/4lib/infest/3install-nix-tools | 9 +++ krebs/4lib/infest/4finalize | 65 +++++++++++++++++++++ 5 files changed, 311 insertions(+) create mode 100644 krebs/4lib/infest/1prepare create mode 100644 krebs/4lib/infest/2install-nix create mode 100644 krebs/4lib/infest/3install-nix-tools create mode 100644 krebs/4lib/infest/4finalize (limited to 'krebs') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index a6b5a1906..2db9feda0 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -121,6 +121,112 @@ let exec "$profile"/bin/switch-to-configuration switch EOF + + ''; + }; + infest = mkOption { + type = types.str; + default = '' + #! /bin/sh + set -efux + + target=${escapeShellArg cfg.build.target} + + push(){( + src=$1/ + dst=$target:/mnt$2 + rsync \ + --exclude .git \ + --exclude .graveyard \ + --exclude old \ + --rsync-path="mkdir -p \"/mnt$2\" && rsync" \ + --delete-excluded \ + -vrLptgoD \ + "$src" "$dst" + )} + + cat krebs/4lib/infest/1prepare | ssh "$target" + cat krebs/4lib/infest/2install-nix | ssh "$target" + + ${concatStrings (mapAttrsToList (name: { url, rev, ... }: + optionalString (rev == null) '' + push ${toString (map escapeShellArg [ + "${url}" + "/root/src/${name}" + ])} + '') config.deps)} + + ssh -S none "$target" /bin/sh <<\EOF + set -efux + + fetch(){( + url=$1 + rev=$2 + dst=$3 + mkdir -p "$dst" + cd "$dst" + if ! test -e .git; then + git init + fi + if ! cur_url=$(git config remote.origin.url 2>/dev/null); then + git remote add origin "$url" + elif test "$cur_url" != "$url"; then + git remote set-url origin "$url" + fi + if test "$(git rev-parse --verify HEAD 2>/dev/null)" != "$rev"; then + git fetch origin + git checkout "$rev" -- . + git checkout -q "$rev" + git submodule init + git submodule update + fi + git clean -dxf + )} + + ${concatStrings (mapAttrsToList (name: { url, rev, ... }: + optionalString (rev != null) '' + fetch ${toString (map escapeShellArg [ + url + rev + "/mnt/root/src/${name}" + ])} + '') config.deps)} + + export PATH=/root/.nix-profile/bin:/root/.nix-profile/sbin:$PATH + + sed < "$(type -p nixos-install)" > nixos-install ' + /^echo "building the system configuration..."/,/--set -A system/{ + s/.*/# &/ + s@.*--set -A system.*@&\n${concatStringsSep " " [ + "NIX_PATH=/mnt/root/src/" + "nix-env" + "-Q" + "-p /nix/var/nix/profiles/system" + "-f \"\"" + "--set" + "-A system" + "--argstr user-name ${escapeShellArg cfg.build.user.name}" + "--argstr system-name ${escapeShellArg cfg.build.host.name}" + ]}@ + } + ' + + sed -i 's/^nixpkgs=.*$/#&/' nixos-install + + + chmod +x nixos-install + + echo {} > /root/dummy.nix + + echo build system... + profile=/nix/var/nix/profiles/system + NIXOS_CONFIG=/root/dummy.nix \ + ./nixos-install -I /root/src/ + #nl -bp nixos-install + + EOF + + cat krebs/4lib/infest/4finalize | ssh "$target" ''; }; host = mkOption { diff --git a/krebs/4lib/infest/1prepare b/krebs/4lib/infest/1prepare new file mode 100644 index 000000000..07c00c3a5 --- /dev/null +++ b/krebs/4lib/infest/1prepare @@ -0,0 +1,74 @@ +#! /bin/sh +set -efu + +prepare() {( + if test -e /etc/os-release; then + . /etc/os-release + case $ID in + centos) + case $VERSION_ID in + 7) + prepare_centos7 "$@" + exit + ;; + esac + ;; + esac + fi + echo "$0 prepare: unknown OS" >&2 + exit -1 +)} + +prepare_centos7() { + type bzip2 2>/dev/null || yum install -y bzip2 + type git 2>/dev/null || yum install -y git + type rsync 2>/dev/null || yum install -y rsync + if ! getent group nixbld >/dev/null; then + groupadd -g 30000 -r nixbld + fi + for i in `seq 1 10`; do + if ! getent passwd nixbld$i 2>/dev/null; then + useradd \ + -c "CentOS Nix build user $i" \ + -d /var/empty \ + -g 30000 \ + -G 30000 \ + -l \ + -M \ + -s /sbin/nologin \ + -u $(expr 30000 + $i) \ + nixbld$i + rm -f /var/spool/mail/nixbld$i + fi + done + + # + # mount install directory + # + + if ! mount | grep -Fq '/dev/mapper/centos-root on /mnt type xfs'; then + mkdir -p /newshit + mount --bind /newshit /mnt + fi + + if ! mount | grep -Fq '/dev/sda1 on /mnt/boot type xfs'; then + mkdir -p /mnt/boot + mount /dev/sda1 /mnt/boot + fi + + mount | grep 'on /mnt\>' >&2 + + # + # prepare install directory + # + + mkdir -p /mnt/etc/nixos + mkdir -m 0555 -p /mnt/var/empty + + if ! mount | grep -Fq '/dev/mapper/centos-root on /mnt/root type xfs'; then + mkdir -p /mnt/root + mount --bind /root /mnt/root + fi +} + +prepare "$@" diff --git a/krebs/4lib/infest/2install-nix b/krebs/4lib/infest/2install-nix new file mode 100644 index 000000000..3021c1143 --- /dev/null +++ b/krebs/4lib/infest/2install-nix @@ -0,0 +1,57 @@ +#! /bin/sh +set -efu + +nix_url=https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-linux.tar.bz2 +nix_sha256="504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4" + +install-nix() {( + + # install nix on host (cf. https://nixos.org/nix/install) + if ! test -e /root/.nix-profile/etc/profile.d/nix.sh; then + ( + verify() { + printf '%s %s\n' $nix_sha256 $(basename $nix_url) | sha256sum -c + } + if ! verify; then + curl -C - -O "$nix_url" + verify + fi + ) + nix_src_dir=$(basename $nix_url .tar.bz2) + tar jxf $nix_src_dir.tar.bz2 + mkdir -v -m 0755 -p /nix + $nix_src_dir/install + fi + + #TODO: make this general or move to 1prepare + if ! mount | grep -Fq '/dev/mapper/centos-root on /mnt/nix type xfs'; then + mkdir -p /mnt/nix + mount --bind /nix /mnt/nix + fi + + . /root/.nix-profile/etc/profile.d/nix.sh + + for i in \ + bash \ + coreutils \ + # This line intentionally left blank. + do + if ! nix-env -q $i | grep -q .; then + nix-env -iA nixpkgs.pkgs.$i + fi + done + + # install nixos-install + if ! type nixos-install 2>/dev/null; then + nixpkgs_expr='import { system = builtins.currentSystem; }' + nixpkgs_path=$(find /nix/store -mindepth 1 -maxdepth 1 -name *-nixpkgs-* -type d) + nix-env \ + --arg config "{ nix.package = ($nixpkgs_expr).nix; }" \ + --arg pkgs "$nixpkgs_expr" \ + --arg modulesPath 'throw "no modulesPath"' \ + -f $nixpkgs_path/nixpkgs/nixos/modules/installer/tools/tools.nix \ + -iA config.system.build.nixos-install + fi +)} + +install-nix "$@" diff --git a/krebs/4lib/infest/3install-nix-tools b/krebs/4lib/infest/3install-nix-tools new file mode 100644 index 000000000..59fa6f14a --- /dev/null +++ b/krebs/4lib/infest/3install-nix-tools @@ -0,0 +1,9 @@ +#! /bin/sh +set -efu + +install-nix-tools() {( + + +)} + +install-nix-tools "$@" diff --git a/krebs/4lib/infest/4finalize b/krebs/4lib/infest/4finalize new file mode 100644 index 000000000..d095fa31b --- /dev/null +++ b/krebs/4lib/infest/4finalize @@ -0,0 +1,65 @@ +#! /bin/sh +set -eux +{ + umount /mnt/nix || [ $? -eq 32 ] + umount /mnt/boot || [ $? -eq 32 ] + umount /mnt/root || [ $? -eq 32 ] + umount /mnt || [ $? -eq 32 ] + umount /boot || [ $? -eq 32 ] + + PATH=$(for i in /nix/store/*coreutils*/bin; do :; done; echo $i) + export PATH + + mkdir /oldshit + + mv /bin /oldshit/ + mv /newshit/bin / + + # TODO ensure /boot is empty + rmdir /newshit/boot + + # skip /dev + rmdir /newshit/dev + + mv /etc /oldshit/ + mv /newshit/etc / + + # skip /nix (it's already there) + rmdir /newshit/nix + + # skip /proc + rmdir /newshit/proc + + # skip /run + rmdir /newshit/run + + # skip /sys + rmdir /newshit/sys + + # skip /root + rmdir /newshit/root + + # skip /tmp + # TODO rmdir /newshit/tmp + + mv /home /oldshit/ + mv /newshit/home / + + mv /usr /oldshit/ + mv /newshit/usr / + + mv /var /oldshit/ + mv /newshit/var / + + mv /lib /oldshit/ + mv /lib64 /oldshit/ + mv /sbin /oldshit/ + mv /srv /oldshit/ + mv /opt /oldshit/ + + + mv /newshit /root/ # TODO this one shoult be empty + mv /oldshit /root/ + + sync +} -- cgit v1.2.3 From c20e49bd20554f2874aded7f29dd4958b3b78f38 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 18 Sep 2015 03:07:13 +0200 Subject: krebs 3: update echelon ip --- krebs/3modules/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 2db9feda0..3879ccdd0 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -328,7 +328,7 @@ let dc = "lass"; #dc = "cac"; nets = rec { internet = { - addrs4 = ["162.248.167.198"]; + addrs4 = ["162.248.8.61"]; aliases = [ "echelon.internet" ]; -- cgit v1.2.3 From 1c6d6918d710dd106dd163ef271cad0bf83edeec Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 19 Sep 2015 23:40:25 +0200 Subject: krebs 3: update echelon ip --- krebs/3modules/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 3879ccdd0..0ffdec5f8 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -328,7 +328,7 @@ let dc = "lass"; #dc = "cac"; nets = rec { internet = { - addrs4 = ["162.248.8.61"]; + addrs4 = ["162.248.8.63"]; aliases = [ "echelon.internet" ]; -- cgit v1.2.3