From f76b72358dabd94c1e17a415e7e13cb8ecba2438 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 27 Sep 2020 15:40:10 +0200 Subject: l domsen: apanowicz.de is now a static site --- lass/2configs/websites/domsen.nix | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'lass/2configs/websites') diff --git a/lass/2configs/websites/domsen.nix b/lass/2configs/websites/domsen.nix index bd113567f..48ea5f0a2 100644 --- a/lass/2configs/websites/domsen.nix +++ b/lass/2configs/websites/domsen.nix @@ -26,6 +26,7 @@ in { ./default.nix ./sqlBackup.nix (servePage [ "aldonasiech.com" "www.aldonasiech.com" ]) + (servePage [ "apanowicz.de" "www.apanowicz.de" ]) (servePage [ "reich-gebaeudereinigung.de" "www.reich-gebaeudereinigung.de" ]) (servePage [ "freemonkey.art" @@ -34,7 +35,6 @@ in { (serveOwncloud [ "o.ubikmedia.de" ]) (serveWordpress [ "ubikmedia.de" - "apanowicz.de" "nirwanabluete.de" "ubikmedia.eu" "youthtube.xyz" @@ -42,7 +42,6 @@ in { "weirdwednesday.de" "jarugadesign.de" - "www.apanowicz.de" "www.nirwanabluete.de" "www.ubikmedia.eu" "www.youthtube.xyz" @@ -52,7 +51,6 @@ in { "www.jarugadesign.de" "aldona2.ubikmedia.de" - "apanowicz.ubikmedia.de" "cinevita.ubikmedia.de" "factscloud.ubikmedia.de" "illucloud.ubikmedia.de" -- cgit v1.3.1 From c361849c38cc1bfb86536043c9554bdc75953508 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 27 Sep 2020 15:40:34 +0200 Subject: l domsen: add legacy ssl certs for legacy devices --- lass/2configs/websites/domsen.nix | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'lass/2configs/websites') diff --git a/lass/2configs/websites/domsen.nix b/lass/2configs/websites/domsen.nix index 48ea5f0a2..8cd489bd5 100644 --- a/lass/2configs/websites/domsen.nix +++ b/lass/2configs/websites/domsen.nix @@ -105,6 +105,10 @@ in { # MAIL STUFF # TODO: make into its own module + + # workaround for android 7 + security.acme.certs."lassul.us".keyType = "rsa4096"; + services.dovecot2 = { enable = true; mailLocation = "maildir:~/Mail"; -- cgit v1.3.1 From bdc1cb2f02e61810e3e5ccd674cecb91d50c8e80 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 27 Sep 2020 15:40:52 +0200 Subject: l domsen: use nextcloud 18 --- lass/2configs/websites/domsen.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'lass/2configs/websites') diff --git a/lass/2configs/websites/domsen.nix b/lass/2configs/websites/domsen.nix index 8cd489bd5..2d2ba79be 100644 --- a/lass/2configs/websites/domsen.nix +++ b/lass/2configs/websites/domsen.nix @@ -91,6 +91,7 @@ in { services.nextcloud = { enable = true; hostName = "o.xanf.org"; + package = pkgs.nextcloud18; config = { adminpassFile = toString + "/nextcloud_pw"; overwriteProtocol = "https"; -- cgit v1.3.1 From e1251ee299af6b00dc81a76560d4810cd0a6126c Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 27 Sep 2020 15:41:35 +0200 Subject: l domsen: update mail aliases --- lass/2configs/websites/domsen.nix | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'lass/2configs/websites') diff --git a/lass/2configs/websites/domsen.nix b/lass/2configs/websites/domsen.nix index 2d2ba79be..a177a0228 100644 --- a/lass/2configs/websites/domsen.nix +++ b/lass/2configs/websites/domsen.nix @@ -134,18 +134,16 @@ in { server_condition = ''${run{${config.lass.usershadow.path}/bin/verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}} ''; internet-aliases = [ - { from = "dominik@apanowicz.de"; to = "dominik_a@gmx.de"; } { from = "dma@ubikmedia.de"; to = "domsen"; } { from = "dma@ubikmedia.eu"; to = "domsen"; } { from = "mail@habsys.de"; to = "domsen"; } { from = "mail@habsys.eu"; to = "domsen"; } + { from = "hallo@apanowicz.de"; to = "domsen"; } { from = "bruno@apanowicz.de"; to = "bruno"; } { from = "mail@jla-trading.com"; to = "jla-trading"; } { from = "jms@ubikmedia.eu"; to = "jms"; } { from = "ms@ubikmedia.eu"; to = "ms"; } { from = "ubik@ubikmedia.eu"; to = "domsen, jms, ms"; } - { from = "akayguen@freemonkey.art"; to ="akayguen"; } - { from = "bui@freemonkey.art"; to ="bui"; } { from = "kontakt@alewis.de"; to ="klabusterbeere"; } { from = "hallo@jarugadesign.de"; to ="kasia"; } @@ -156,9 +154,14 @@ in { "jla-trading.com" "ubikmedia.eu" "ubikmedia.de" + "apanowicz.de" "alewis.de" "jarugadesign.de" ]; + dkim = [ + { domain = "ubikmedia.eu"; } + { domain = "apanowicz.de"; } + ]; ssl_cert = "/var/lib/acme/lassul.us/fullchain.pem"; ssl_key = "/var/lib/acme/lassul.us/key.pem"; }; -- cgit v1.3.1 From 687ae7ca86bad6648ef53bf8ef5c6f335ad88037 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 27 Sep 2020 15:42:33 +0200 Subject: l init: update with local tests, sgdisk, etc.. --- lass/2configs/websites/lassulus.nix | 2 +- lass/5pkgs/init/default.nix | 45 +++++++++++-------------------------- lass/5pkgs/init/run-vm.sh | 7 ++++++ lass/5pkgs/init/test.nix | 13 +++++++++++ lass/5pkgs/init/test.sh | 11 +++++++++ 5 files changed, 45 insertions(+), 33 deletions(-) create mode 100755 lass/5pkgs/init/run-vm.sh create mode 100644 lass/5pkgs/init/test.nix create mode 100755 lass/5pkgs/init/test.sh (limited to 'lass/2configs/websites') diff --git a/lass/2configs/websites/lassulus.nix b/lass/2configs/websites/lassulus.nix index baeac213b..5a45f03ef 100644 --- a/lass/2configs/websites/lassulus.nix +++ b/lass/2configs/websites/lassulus.nix @@ -61,7 +61,7 @@ in { pubkey = config.krebs.users.lass.pubkey; }; in '' - alias ${initscript}; + alias ${initscript}/bin/init; ''; locations."= /blue.pub".extraConfig = '' alias ${pkgs.writeText "pub" config.krebs.users.lass.pubkey}; diff --git a/lass/5pkgs/init/default.nix b/lass/5pkgs/init/default.nix index cbcfe2c00..ee49951b1 100644 --- a/lass/5pkgs/init/default.nix +++ b/lass/5pkgs/init/default.nix @@ -2,10 +2,10 @@ with lib; -pkgs.writeScript "init" '' +pkgs.writeScriptBin "init" '' #!/usr/bin/env nix-shell - #! nix-shell -i bash -p jq parted libxfs - set -efu + #! nix-shell -i bash -p cryptsetup gptfdisk jq libxfs + set -xefuo pipefail disk=$1 @@ -14,12 +14,12 @@ pkgs.writeScript "init" '' exit 2 fi + bootdev="$disk"2 luksdev="$disk"3 luksmap=/dev/mapper/${luksmap} vgname=${vgname} - bootdev=/dev/sda2 rootdev=/dev/mapper/${vgname}-root homedev=/dev/mapper/${vgname}-home @@ -35,15 +35,13 @@ pkgs.writeScript "init" '' # dd if=/dev/zero bs=512 count=34 of=/dev/sda # TODO zero last 34 blocks (lsblk -bno SIZE /dev/sda) if ! test "$(blkid -o value -s PTTYPE "$disk")" = gpt; then - parted -s -a optimal "$disk" \ - mklabel gpt \ - mkpart no-fs 0 1024KiB \ - set 1 bios_grub on \ - mkpart ESP fat32 1025KiB 1024MiB set 2 boot on \ - mkpart primary 1025MiB 100% + sgdisk -og "$disk" + sgdisk -n 1:2048:4095 -c 1:"BIOS Boot Partition" -t 1:ef02 "$disk" + sgdisk -n 2:4096:+1G -c 2:"EFI System Partition" -t 2:ef00 "$disk" + sgdisk -n 3:0:0 -c 3:"LUKS container" -t 3:8300 "$disk" fi - if ! test "$(blkid -o value -s PARTLABEL "$luksdev")" = primary; then + if ! test "$(blkid -o value -s PARTLABEL "$luksdev")" = "LUKS container"; then echo zonk2 exit 23 fi @@ -58,7 +56,6 @@ pkgs.writeScript "init" '' if ! test -e "$luksmap"; then echo "$lukspw" | cryptsetup luksOpen "$luksdev" "$(basename "$luksmap")" - fi - # cryptsetup close if ! test "$(blkid -o value -s TYPE "$luksmap")" = LVM2_member; then pvcreate "$luksmap" @@ -68,11 +65,7 @@ pkgs.writeScript "init" '' lvchange -a y /dev/mapper/"$vgname" - if ! test -e "$rootdev"; then lvcreate -L 7G -n root "$vgname"; fi - if ! test -e "$homedev"; then lvcreate -L 100M -n home "$vgname"; fi - - # lvchange -a n "$vgname" - + if ! test -e "$rootdev"; then lvcreate -L 3G -n root "$vgname"; fi # # formatting @@ -82,35 +75,23 @@ pkgs.writeScript "init" '' mkfs.vfat "$bootdev" fi - if ! test "$(blkid -o value -s TYPE "$rootdev")" = btrfs; then + if ! test "$(blkid -o value -s TYPE "$rootdev")" = xfs; then mkfs.xfs "$rootdev" fi - if ! test "$(blkid -o value -s TYPE "$homedev")" = btrfs; then - mkfs.xfs "$homedev" - fi - - if ! test "$(lsblk -n -o MOUNTPOINT "$rootdev")" = /mnt; then + mkdir -p /mnt mount "$rootdev" /mnt fi if ! test "$(lsblk -n -o MOUNTPOINT "$bootdev")" = /mnt/boot; then mkdir -m 0000 -p /mnt/boot mount "$bootdev" /mnt/boot fi - if ! test "$(lsblk -n -o MOUNTPOINT "$homedev")" = /mnt/home; then - mkdir -m 0000 -p /mnt/home - mount "$homedev" /mnt/home - fi - - # umount -R /mnt # # dependencies for stockholm # - nix-env -iA nixos.git - # TODO: get sentinal file from target_path mkdir -p /mnt/var/src touch /mnt/var/src/.populate @@ -119,7 +100,7 @@ pkgs.writeScript "init" '' # print all the infos # - parted "$disk" print + gdisk -l "$disk" lsblk "$disk" echo READY. diff --git a/lass/5pkgs/init/run-vm.sh b/lass/5pkgs/init/run-vm.sh new file mode 100755 index 000000000..13914ad5f --- /dev/null +++ b/lass/5pkgs/init/run-vm.sh @@ -0,0 +1,7 @@ +#!/usr/bin/env nix-shell +#! nix-shell -i bash -p nixos-generators + +set -efu + +WD=$(dirname "$0") +nixos-generate -I stockholm="$WD"/../../.. -c "$WD"/config.nix -f vm-nogui --run diff --git a/lass/5pkgs/init/test.nix b/lass/5pkgs/init/test.nix new file mode 100644 index 000000000..e76e7e009 --- /dev/null +++ b/lass/5pkgs/init/test.nix @@ -0,0 +1,13 @@ +{ config, lib, pkgs, ... }: +{ + virtualisation.emptyDiskImages = [ + 8000 + ]; + virtualisation.memorySize = 1500; + boot.tmpOnTmpfs = true; + + environment.systemPackages = [ + (pkgs.callPackage ./default.nix {}) + ]; + services.mingetty.autologinUser = lib.mkForce "root"; +} diff --git a/lass/5pkgs/init/test.sh b/lass/5pkgs/init/test.sh new file mode 100755 index 000000000..0ceaa73ca --- /dev/null +++ b/lass/5pkgs/init/test.sh @@ -0,0 +1,11 @@ +#!/usr/bin/env nix-shell +#! nix-shell -i bash -p nixos-generators + +set -xefu + +WD=$(realpath $(dirname "$0")) +TMPDIR=$(mktemp -d) +cd "$TMPDIR" +nixos-generate -c "$WD"/test.nix -f vm-nogui --run "$@" +cd - +rm -r "$TMPDIR" -- cgit v1.3.1 From e870fd3ef82c06ad620ebff4ead8e7be9fb4a6c1 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 27 Sep 2020 15:43:33 +0200 Subject: l websites: serve yubi pubkey --- lass/2configs/websites/lassulus.nix | 3 +++ 1 file changed, 3 insertions(+) (limited to 'lass/2configs/websites') diff --git a/lass/2configs/websites/lassulus.nix b/lass/2configs/websites/lassulus.nix index 5a45f03ef..74585a6f8 100644 --- a/lass/2configs/websites/lassulus.nix +++ b/lass/2configs/websites/lassulus.nix @@ -69,6 +69,9 @@ in { locations."= /mors.pub".extraConfig = '' alias ${pkgs.writeText "pub" config.krebs.users.lass-mors.pubkey}; ''; + locations."= /yubi.pub".extraConfig = '' + alias ${pkgs.writeText "pub" config.krebs.users.lass-yubikey.pubkey}; + ''; }; security.acme.certs."cgit.lassul.us" = { -- cgit v1.3.1