From 4c50091a7c639fabf696d7c5aa727e72ad677233 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 14:24:31 +0200
Subject: l aergia.r: import jovian nixos

---
 lass/1systems/aergia/config.nix | 7 +++++++
 1 file changed, 7 insertions(+)

(limited to 'lass')

diff --git a/lass/1systems/aergia/config.nix b/lass/1systems/aergia/config.nix
index d49040a7a..08bf2b2b5 100644
--- a/lass/1systems/aergia/config.nix
+++ b/lass/1systems/aergia/config.nix
@@ -27,6 +27,13 @@
     <stockholm/lass/2configs/print.nix>
     <stockholm/lass/2configs/br.nix>
     <stockholm/lass/2configs/c-base.nix>
+    # steam-deck like experience https://github.com/Jovian-Experiments/Jovian-NixOS
+    {
+      imports = [
+        "${builtins.fetchTarball "https://github.com/Jovian-Experiments/Jovian-NixOS/archive/master.tar.gz"}/modules"
+      ];
+      jovian.steam.enable = true;
+    }
   ];
 
   system.stateVersion = "22.11";
-- 
cgit v1.2.3


From b74b986a5e34dbdcf8e4c6d092435e662e31e32a Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 14:25:12 +0200
Subject: l aergia.r: configure autorandr for docking

---
 lass/1systems/aergia/config.nix | 70 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)

(limited to 'lass')

diff --git a/lass/1systems/aergia/config.nix b/lass/1systems/aergia/config.nix
index 08bf2b2b5..c3ef6d732 100644
--- a/lass/1systems/aergia/config.nix
+++ b/lass/1systems/aergia/config.nix
@@ -34,6 +34,76 @@
       ];
       jovian.steam.enable = true;
     }
+    { # autorandrs
+      services.autorandr = {
+        enable = true;
+        hooks.postswitch.reset_usb = ''
+          echo 0 > /sys/bus/usb/devices/usb9/authorized; echo 1 > /sys/bus/usb/devices/usb9/authorized
+          ${pkgs.xorg.xmodmap}/bin/xmodmap -e 'keycode 96 = F12 Insert F12 F12' # rebind shift + F12 to shift + insert
+        '';
+        profiles = {
+          default = {
+            fingerprint = {
+              eDP = "00ffffffffffff00288931000100000016200104805932780a0dc9a05747982712484c0000000101010101010101010101010101010108700088a1401360c820a300d9870000001ead4a0088a1401360c820a30020c23100001e000000fd0016480f5a1e000a202020202020000000fc0047504431303031480a2020202000cf";
+            };
+            config = {
+              eDP = {
+                enable = true;
+                primary = true;
+                position = "0x0";
+                mode = "2560x1600";
+                rate = "60.01";
+                transform = [
+                  [ 0.750000 0.000000 0.000000 ]
+                  [ 0.000000 0.750000 0.000000 ]
+                  [ 0.000000 0.000000 1.000000 ]
+                ];
+                # scale = {
+                #   x = 0.599991;
+                #   y = 0.599991;
+                # };
+              };
+            };
+          };
+          docked2 = {
+            fingerprint = {
+              eDP = config.services.autorandr.profiles.default.fingerprint.eDP;
+              DisplayPort-8 = "00ffffffffffff0010ac39d14c3346300f200104b5462878fb26f5af4f46a5240f5054a54b00714f8140818081c081009500b300d1c0565e00a0a0a0295030203500b9882100001a000000ff00444342375847330a2020202020000000fc0044454c4c204733323233440a20000000fd0030a5fafa41010a2020202020200181020332f149030212110490131f3f2309070783010000e200eae305c000e606050162622c6d1a0000020b30a50007622c622c5a8780a070384d4030203500b9882100001af4fb0050a0a0285008206800b9882100001a40e7006aa0a0675008209804b9882100001a6fc200a0a0a0555030203500b9882100001a000000000009";
+              DisplayPort-7 = "00ffffffffffff0020a32f00010000000c190103807341780acf74a3574cb02309484c21080081c0814081800101010101010101010104740030f2705a80b0588a00501d7400001e023a801871382d40582c4500501d7400001e000000fc00484953454e53450a2020202020000000fd00324b0f451e000a2020202020200172020333714f5f5e5d01020400101113001f2021222909070715075057070083010000e200f96d030c002000183c200060010203662150b051001b304070360056005300001e011d8018711c1620582c2500c48e2100009e011d007251d01e206e285500c48e2100001800000000000000000000000000000000000000000000ea";
+            };
+            config = {
+              DisplayPort-7 = {
+                enable = true;
+                position = "2560x0";
+                mode = "1920x1080";
+                rate = "60.00";
+              };
+              DisplayPort-8 = config.services.autorandr.profiles.docked1.config.DisplayPort-1;
+              eDP = config.services.autorandr.profiles.docked1.config.eDP;
+            };
+          };
+          docked1 = {
+            fingerprint = {
+              eDP = config.services.autorandr.profiles.default.fingerprint.eDP;
+              DisplayPort-1 = "00ffffffffffff0010ac39d14c3346300f200104b5462878fb26f5af4f46a5240f5054a54b00714f8140818081c081009500b300d1c0565e00a0a0a0295030203500b9882100001a000000ff00444342375847330a2020202020000000fc0044454c4c204733323233440a20000000fd0030a5fafa41010a2020202020200181020332f149030212110490131f3f2309070783010000e200eae305c000e606050162622c6d1a0000020b30a50007622c622c000000000000000000000000000000000000f4fb0050a0a0285008206800b9882100001a40e7006aa0a0675008209804b9882100001a6fc200a0a0a0555030203500b9882100001a000000000040";
+            };
+            config = {
+              DisplayPort-1 = {
+                enable = true;
+                primary = true;
+                position = "0x0";
+                mode = "2560x1440";
+                rate = "165.08";
+              };
+              eDP = config.services.autorandr.profiles.default.config.eDP // {
+                primary = false;
+                position = "640x1440";
+              };
+            };
+          };
+        };
+      };
+    }
   ];
 
   system.stateVersion = "22.11";
-- 
cgit v1.2.3


From c614ec65355b821eb563e79930eee40e181088f6 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 14:25:28 +0200
Subject: l aergia.r: add more tools

---
 lass/1systems/aergia/config.nix | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'lass')

diff --git a/lass/1systems/aergia/config.nix b/lass/1systems/aergia/config.nix
index c3ef6d732..618938ce8 100644
--- a/lass/1systems/aergia/config.nix
+++ b/lass/1systems/aergia/config.nix
@@ -115,6 +115,8 @@
     bank
     l-gen-secrets
     generate-secrets
+    nixpkgs-review
+    pipenv
   ];
 
   programs.adb.enable = true;
@@ -142,4 +144,5 @@
   ];
 
   boot.cleanTmpDir = true;
+  programs.noisetorch.enable = true;
 }
-- 
cgit v1.2.3


From 4874f72c5b3500a895def67994113f02f3b622e8 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 14:55:56 +0200
Subject: l aergia.r: update disko config

---
 lass/1systems/aergia/disk.nix | 3 ---
 1 file changed, 3 deletions(-)

(limited to 'lass')

diff --git a/lass/1systems/aergia/disk.nix b/lass/1systems/aergia/disk.nix
index 0ae0892ee..848157729 100644
--- a/lass/1systems/aergia/disk.nix
+++ b/lass/1systems/aergia/disk.nix
@@ -10,14 +10,12 @@
         partitions = [
           {
             name = "boot";
-            type = "partition";
             start = "0";
             end = "1M";
             part-type = "primary";
             flags = ["bios_grub"];
           }
           {
-            type = "partition";
             name = "ESP";
             start = "1MiB";
             end = "1GiB";
@@ -31,7 +29,6 @@
           }
           {
             name = "root";
-            type = "partition";
             start = "1GiB";
             end = "100%";
             content = {
-- 
cgit v1.2.3


From 9b9e64fb6b2a1ef0f844a459186b0befa6b3f114 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 14:57:40 +0200
Subject: l aergia.r: remove cruft from physical.nix

---
 lass/1systems/aergia/physical.nix | 54 +++++----------------------------------
 1 file changed, 7 insertions(+), 47 deletions(-)

(limited to 'lass')

diff --git a/lass/1systems/aergia/physical.nix b/lass/1systems/aergia/physical.nix
index 692f68dcc..f24c6aa11 100644
--- a/lass/1systems/aergia/physical.nix
+++ b/lass/1systems/aergia/physical.nix
@@ -19,14 +19,10 @@
   boot.kernelPackages = pkgs.linuxPackages_latest;
 
   boot.kernelParams = [
-    # Enable energy savings during sleep
-    "mem_sleep_default=deep"
 
     # use less power with pstate
     "amd_pstate=passive"
 
-    # for ryzenadj -i
-    "iomem=relaxed"
 
     # suspend
     "resume_offset=178345675"
@@ -37,24 +33,6 @@
     # On recent AMD CPUs this can be more energy efficient.
     "amd-pstate"
     "kvm-amd"
-
-    # needed for zenstates
-    "msr"
-
-    # zenpower
-    "zenpower"
-  ];
-
-  boot.extraModulePackages = [
-    (config.boot.kernelPackages.zenpower.overrideAttrs (old: {
-      src = pkgs.fetchFromGitea {
-        domain = "git.exozy.me";
-        owner = "a";
-        repo = "zenpower3";
-        rev = "c176fdb0d5bcba6ba2aba99ea36812e40f47751f";
-        hash = "sha256-d2WH8Zv7F0phZmEKcDiaak9On+Mo9bAFhMulT/N5FWI=";
-      };
-    }))
   ];
 
   # hardware.cpu.amd.updateMicrocode = true;
@@ -76,7 +54,6 @@
 
   environment.systemPackages = [
     pkgs.vulkan-tools
-    pkgs.ryzenadj
     (pkgs.writers.writeDashBin "set_tdp" ''
       set -efux
       watt=$1
@@ -85,31 +62,9 @@
     '')
   ];
 
-  # textsize
-  services.xserver.dpi = 200;
-
   # corectrl
-  programs.corectrl = {
-    enable = true;
-    gpuOverclock = {
-      enable = true;
-      ppfeaturemask = "0xffffffff";
-    };
-  };
-  users.users.mainUser.extraGroups = [ "corectrl" ];
 
   # use newer ryzenadj
-  nixpkgs.config.packageOverrides = super: {
-    ryzenadj = super.ryzenadj.overrideAttrs (old: {
-      version = "unstable-2023-01-15";
-      src = pkgs.fetchFromGitHub {
-        owner = "FlyGoat";
-        repo = "RyzenAdj";
-        rev = "1052fb52b2c0e23ac4cd868c4e74d4a9510be57c"; # unstable on 2023-01-15
-        sha256 = "sha256-/IxkbQ1XrBrBVrsR4EdV6cbrFr1m+lGwz+rYBqxYG1k=";
-      };
-    });
-  };
 
   # keyboard quirks
   services.xserver.displayManager.sessionCommands = ''
@@ -122,11 +77,16 @@
       KEYBOARD_KEY_70027=reserved
   '';
 
-  # ignore power key
-
   # update cpu microcode
   hardware.cpu.amd.updateMicrocode = true;
 
+  hardware.opengl.enable = true;
+  hardware.opengl.extraPackages = [
+    pkgs.amdvlk
+    pkgs.rocm-opencl-icd
+    pkgs.rocm-opencl-runtime
+  ];
+
   # suspend to disk
   swapDevices = [{
     device = "/swapfile";
-- 
cgit v1.2.3


From 4aff1a4985faac187e0691a86dfc00f654006499 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 14:59:15 +0200
Subject: l aergia.r: reinit usb after docking

---
 lass/1systems/aergia/physical.nix | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'lass')

diff --git a/lass/1systems/aergia/physical.nix b/lass/1systems/aergia/physical.nix
index f24c6aa11..ef62478b4 100644
--- a/lass/1systems/aergia/physical.nix
+++ b/lass/1systems/aergia/physical.nix
@@ -99,4 +99,8 @@
 
   # firefox touchscreen support
   environment.sessionVariables.MOZ_USE_XINPUT2 = "1";
+  # reinit usb after docking station connect
+  services.udev.extraRules = ''
+    SUBSYSTEM=="drm", ACTION=="change", RUN+="${pkgs.dash}/bin/dash -c 'echo 0 > /sys/bus/usb/devices/usb9/authorized; echo 1 > /sys/bus/usb/devices/usb9/authorized'"
+  '';
 }
-- 
cgit v1.2.3


From 914dbb8fca1bf19a54266b6cf3d95d0aec6b1fd4 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 15:01:31 +0200
Subject: l daedalus.r: update stuff

---
 lass/1systems/daedalus/config.nix | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

(limited to 'lass')

diff --git a/lass/1systems/daedalus/config.nix b/lass/1systems/daedalus/config.nix
index 9ef858e28..c34dc0acf 100644
--- a/lass/1systems/daedalus/config.nix
+++ b/lass/1systems/daedalus/config.nix
@@ -6,7 +6,8 @@ with import <stockholm/lib>;
     <stockholm/lass>
 
     <stockholm/lass/2configs/retiolum.nix>
-    <stockholm/lass/2configs/nfs-dl.nix>
+    <stockholm/lass/2configs/pipewire.nix>
+    # <stockholm/lass/2configs/nfs-dl.nix>
     {
       # bubsy config
       users.users.bubsy = {
@@ -17,22 +18,20 @@ with import <stockholm/lib>;
         extraGroups = [
           "audio"
           "networkmanager"
+          "pipewire"
+          # "plugdev"
         ];
         useDefaultShell = true;
         isNormalUser = true;
       };
       networking.networkmanager.enable = true;
       networking.wireless.enable = mkForce false;
-      hardware.pulseaudio = {
-        enable = true;
-        systemWide = true;
-      };
-      programs.chromium = {
-        enable = true;
-        extensions = [
-          "cjpalhdlnbpafiamejdnhcphjbkeiagm" # ublock origin
-        ];
-      };
+      # programs.chromium = {
+      #   enable = true;
+      #   extensions = [
+      #     "cjpalhdlnbpafiamejdnhcphjbkeiagm" # ublock origin
+      #   ];
+      # };
       environment.systemPackages = with pkgs; [
         ark
         pavucontrol
@@ -48,7 +47,9 @@ with import <stockholm/lib>;
         geeqie
         vlc
         zsnes
+        telegram-desktop
       ];
+      # services.udev.packages = [ pkgs.ledger-udev-rules ];
       nixpkgs.config.firefox.enableAdobeFlash = true;
       services.xserver.enable = true;
       services.xserver.displayManager.lightdm.enable = true;
@@ -72,12 +73,10 @@ with import <stockholm/lib>;
               "networkmanager"
               "plugdev"
             ];
-            packages = let
-              unstable = import <nixpkgs-unstable> { config.allowUnfree = true; };
-            in [
+            packages = [
               pkgs.electrum
               pkgs.electron-cash
-              unstable.ledger-live-desktop
+              pkgs.ledger-live-desktop
             ];
           };
         };
-- 
cgit v1.2.3


From aa5d2d176c117d7d1fc183349fef84712dd1b99e Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 15:01:47 +0200
Subject: l dishfire.r: add monitoring & consul

---
 lass/1systems/dishfire/config.nix | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'lass')

diff --git a/lass/1systems/dishfire/config.nix b/lass/1systems/dishfire/config.nix
index b814d7188..279cad10b 100644
--- a/lass/1systems/dishfire/config.nix
+++ b/lass/1systems/dishfire/config.nix
@@ -4,6 +4,9 @@
   imports = [
     <stockholm/lass>
     <stockholm/lass/2configs/retiolum.nix>
+    <stockholm/lass/2configs/monitoring/prometheus.nix>
+    <stockholm/lass/2configs/monitoring/telegraf.nix>
+    <stockholm/lass/2configs/consul.nix>
   ];
 
   krebs.build.host = config.krebs.hosts.dishfire;
-- 
cgit v1.2.3


From 76848d24c224b3a88b1e2ead3e9b895ed9319006 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 15:05:48 +0200
Subject: l hilum.r: make config minimal

---
 lass/1systems/hilum/config.nix | 5 -----
 1 file changed, 5 deletions(-)

(limited to 'lass')

diff --git a/lass/1systems/hilum/config.nix b/lass/1systems/hilum/config.nix
index 3f25991d9..953b5d0d4 100644
--- a/lass/1systems/hilum/config.nix
+++ b/lass/1systems/hilum/config.nix
@@ -4,13 +4,8 @@
     <stockholm/lass>
 
     <stockholm/lass/2configs/retiolum.nix>
-    <stockholm/lass/2configs/baseX.nix>
-    <stockholm/lass/2configs/browsers.nix>
-    <stockholm/lass/2configs/programs.nix>
     <stockholm/lass/2configs/network-manager.nix>
-    <stockholm/lass/2configs/mail.nix>
     <stockholm/lass/2configs/syncthing.nix>
-    <stockholm/lass/2configs/nfs-dl.nix>
   ];
 
   krebs.build.host = config.krebs.hosts.hilum;
-- 
cgit v1.2.3


From add9f3161321417da7493ff2c22c643c44e28c47 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 15:14:05 +0200
Subject: l hilum.r: add usb-flash stick, update disko config

---
 lass/1systems/hilum/disk.nix       | 18 ++++--------------
 lass/1systems/hilum/flash-stick.sh |  8 +++++++-
 lass/1systems/hilum/physical.nix   |  5 ++++-
 3 files changed, 15 insertions(+), 16 deletions(-)

(limited to 'lass')

diff --git a/lass/1systems/hilum/disk.nix b/lass/1systems/hilum/disk.nix
index 926401648..b5199d432 100644
--- a/lass/1systems/hilum/disk.nix
+++ b/lass/1systems/hilum/disk.nix
@@ -10,18 +10,14 @@
         partitions = [
           {
             name = "boot";
-            type = "partition";
             start = "0";
             end = "1M";
-            part-type = "primary";
             flags = ["bios_grub"];
           }
           {
-            type = "partition";
             name = "ESP";
-            start = "1MiB";
+            start = "1M";
             end = "50%";
-            fs-type = "fat32";
             bootable = true;
             content = {
               type = "filesystem";
@@ -31,18 +27,12 @@
           }
           {
             name = "root";
-            type = "partition";
             start = "50%";
             end = "100%";
             content = {
-              type = "luks";
-              name = "hilum_luks";
-              keyFile = keyFile;
-              content = {
-                type = "filesystem";
-                format = "xfs";
-                mountpoint = "/";
-              };
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
             };
           }
         ];
diff --git a/lass/1systems/hilum/flash-stick.sh b/lass/1systems/hilum/flash-stick.sh
index 17a5fc580..9846ea087 100755
--- a/lass/1systems/hilum/flash-stick.sh
+++ b/lass/1systems/hilum/flash-stick.sh
@@ -3,9 +3,13 @@ set -efux
 
 disk=$1
 
+cd "$(dirname "$0")"
 export NIXPKGS_ALLOW_UNFREE=1
 (umask 077; pass show admin/hilum/luks > /tmp/hilum.luks)
 trap 'rm -f /tmp/hilum.luks' EXIT
+echo "$disk" > /tmp/hilum-disk
+trap 'rm -f /tmp/hilum-disk' EXIT
+
 stockholm_root=$(git rev-parse --show-toplevel)
 ssh root@localhost -t -- $(nix-build \
   --no-out-link \
@@ -31,7 +35,9 @@ $(nix-build \
   --arg force true
 )
 ssh root@localhost << SSH
-NIXOS_CONFIG=/mnt/hilum/var/src/nixos-config nixos-install --no-root-password --root /mnt/hilum -I /var/src
+set -efux
+mkdir -p /mnt/hilum/etc
+NIXOS_CONFIG=/mnt/hilum/var/src/nixos-config nixos-install --no-bootloader --no-root-password --root /mnt/hilum -I /var/src
 nixos-enter --root /mnt/hilum -- nixos-rebuild -I /var/src switch --install-bootloader
 umount -Rv /mnt/hilum
 SSH
diff --git a/lass/1systems/hilum/physical.nix b/lass/1systems/hilum/physical.nix
index 6f160062d..9caf8e531 100644
--- a/lass/1systems/hilum/physical.nix
+++ b/lass/1systems/hilum/physical.nix
@@ -15,7 +15,7 @@
           ;
       in lib.mkOption {
         type = lib.types.str;
-        default = tryFile "/etc/hilum-disk" "/dev/sdz";
+        default = tryFile "/etc/hilum-disk" (tryFile "/tmp/hilum-disk" "/dev/sdz");
       };
       config.environment.etc.hilum-disk.text = config.mainDisk;
     }
@@ -47,4 +47,7 @@
 
   nix.maxJobs = lib.mkDefault 4;
   powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+
+  #weird bug with nixos-enter
+  services.logrotate.enable = false;
 }
-- 
cgit v1.2.3


From 703ad4aaef3ec84453958186ac0ac41d867c8c77 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 15:20:40 +0200
Subject: l mors.r: cleanup

---
 lass/1systems/mors/config.nix | 27 ++-------------------------
 1 file changed, 2 insertions(+), 25 deletions(-)

(limited to 'lass')

diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix
index a3486cffa..19b781ff5 100644
--- a/lass/1systems/mors/config.nix
+++ b/lass/1systems/mors/config.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
 with import <stockholm/lib>;
 {
@@ -8,6 +8,7 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/mouse.nix>
     <stockholm/lass/2configs/retiolum.nix>
     <stockholm/lass/2configs/baseX.nix>
+    <stockholm/lass/2configs/pipewire.nix>
     <stockholm/lass/2configs/exim-retiolum.nix>
     <stockholm/lass/2configs/programs.nix>
     <stockholm/lass/2configs/bitcoin.nix>
@@ -17,10 +18,8 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/elster.nix>
     <stockholm/lass/2configs/steam.nix>
     <stockholm/lass/2configs/wine.nix>
-    <stockholm/lass/2configs/git.nix>
     <stockholm/lass/2configs/fetchWallpaper.nix>
     <stockholm/lass/2configs/mail.nix>
-    <stockholm/krebs/2configs/ircd.nix>
     <stockholm/lass/2configs/logf.nix>
     <stockholm/lass/2configs/syncthing.nix>
     <stockholm/lass/2configs/sync/sync.nix>
@@ -104,28 +103,6 @@ with import <stockholm/lib>;
 
     dnsutils
     woeusb
-    l-gen-secrets
-    generate-secrets
-    (pkgs.writeDashBin "btc-coinbase" ''
-      ${pkgs.curl}/bin/curl -Ss 'https://api.coinbase.com/v2/prices/spot?currency=EUR' | ${pkgs.jq}/bin/jq '.data.amount'
-    '')
-    (pkgs.writeDashBin "btc-wex" ''
-      ${pkgs.curl}/bin/curl -Ss 'https://wex.nz/api/3/ticker/btc_eur' | ${pkgs.jq}/bin/jq '.btc_eur.avg'
-    '')
-    (pkgs.writeDashBin "btc-kraken" ''
-      ${pkgs.curl}/bin/curl -Ss  'https://api.kraken.com/0/public/Ticker?pair=BTCEUR' | ${pkgs.jq}/bin/jq '.result.XXBTZEUR.a[0]'
-    '')
-    (pkgs.writeDashBin "krebsco.de" ''
-      TMPDIR=$(${pkgs.coreutils}/bin/mktemp -d)
-      ${pkgs.brain}/bin/brain show krebs-secrets/ovh-secrets.json > "$TMPDIR"/ovh-secrets.json
-      OVH_ZONE_CONFIG="$TMPDIR"/ovh-secrets.json ${pkgs.krebszones}/bin/krebszones import
-      ${pkgs.coreutils}/bin/rm -rf "$TMPDIR"
-    '')
-    (pkgs.writeDashBin "lassul.us" ''
-      TMPDIR=$(${pkgs.coreutils}/bin/mktemp -d)
-      ${pkgs.pass}/bin/pass show admin/ovh/api.config > "$TMPDIR"/ovh-secrets.json
-      OVH_ZONE_CONFIG="$TMPDIR"/ovh-secrets.json ${pkgs.ovh-zone}/bin/ovh-zone import /etc/zones/lassul.us lassul.us
-      ${pkgs.coreutils}/bin/rm -rf "$TMPDIR"
     '')
   ];
 
-- 
cgit v1.2.3


From 93fd2821b33f152044f597dea933acf88cf99a56 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 15:21:00 +0200
Subject: l mors.r: cleanup physical config

---
 lass/1systems/mors/physical.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'lass')

diff --git a/lass/1systems/mors/physical.nix b/lass/1systems/mors/physical.nix
index a9108104b..2ffbf88c0 100644
--- a/lass/1systems/mors/physical.nix
+++ b/lass/1systems/mors/physical.nix
@@ -2,9 +2,11 @@
   imports = [
     ./config.nix
     <stockholm/lass/2configs/hw/x220.nix>
-    <stockholm/lass/2configs/boot/stock-x220.nix>
+    <stockholm/lass/2configs/boot/universal.nix>
   ];
 
+  boot.kernelParams = [ "acpi_backlight=native" ];
+
   fileSystems = {
     "/bku" = {
       device = "/dev/mapper/pool-bku";
-- 
cgit v1.2.3


From 9cbce7b82f0bad8efb4a2d47e5921f93ea9dc004 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 16:20:51 +0200
Subject: l: add monitoring config

---
 lass/2configs/monitoring/alert-rules.nix | 208 +++++++++++++++++++++++++++++++
 lass/2configs/monitoring/prometheus.nix  | 110 ++++++++++++++++
 lass/2configs/monitoring/telegraf.nix    |  72 +++++++++++
 3 files changed, 390 insertions(+)
 create mode 100644 lass/2configs/monitoring/alert-rules.nix
 create mode 100644 lass/2configs/monitoring/prometheus.nix
 create mode 100644 lass/2configs/monitoring/telegraf.nix

(limited to 'lass')

diff --git a/lass/2configs/monitoring/alert-rules.nix b/lass/2configs/monitoring/alert-rules.nix
new file mode 100644
index 000000000..eae2569fb
--- /dev/null
+++ b/lass/2configs/monitoring/alert-rules.nix
@@ -0,0 +1,208 @@
+# inspiration from https://github.com/Mic92/dotfiles/blob/master/nixos/eva/modules/prometheus/alert-rules.nix
+{ lib }:
+
+lib.mapAttrsToList
+  (name: opts: {
+    alert = name;
+    expr = opts.condition;
+    for = opts.time or "2m";
+    labels = { };
+    annotations.description = opts.description;
+  })
+  ({
+    prometheus_too_many_restarts = {
+      condition = ''changes(process_start_time_seconds{job=~"prometheus|pushgateway|alertmanager|telegraf"}[15m]) > 2'';
+      description = "Prometheus has restarted more than twice in the last 15 minutes. It might be crashlooping.";
+    };
+
+    alert_manager_config_not_synced = {
+      condition = ''count(count_values("config_hash", alertmanager_config_hash)) > 1'';
+      description = "Configurations of AlertManager cluster instances are out of sync.";
+    };
+
+    prometheus_not_connected_to_alertmanager = {
+      condition = "prometheus_notifications_alertmanagers_discovered < 1";
+      description = "Prometheus cannot connect the alertmanager\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}";
+    };
+
+    prometheus_rule_evaluation_failures = {
+      condition = "increase(prometheus_rule_evaluation_failures_total[3m]) > 0";
+      description = "Prometheus encountered {{ $value }} rule evaluation failures, leading to potentially ignored alerts.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}";
+    };
+
+    prometheus_template_expansion_failures = {
+      condition = "increase(prometheus_template_text_expansion_failures_total[3m]) > 0";
+      time = "0m";
+      description = "Prometheus encountered {{ $value }} template text expansion failures\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}";
+    };
+
+    promtail_request_errors = {
+      condition = ''100 * sum(rate(promtail_request_duration_seconds_count{status_code=~"5..|failed"}[1m])) by (namespace, job, route, instance) / sum(rate(promtail_request_duration_seconds_count[1m])) by (namespace, job, route, instance) > 10'';
+      time = "15m";
+      description = ''{{ $labels.job }} {{ $labels.route }} is experiencing {{ printf "%.2f" $value }}% errors.'';
+    };
+
+    promtail_file_lagging = {
+      condition = ''abs(promtail_file_bytes_total - promtail_read_bytes_total) > 1e6'';
+      time = "15m";
+      description = ''{{ $labels.instance }} {{ $labels.job }} {{ $labels.path }} has been lagging by more than 1MB for more than 15m.'';
+    };
+
+    filesystem_full_80percent = {
+      condition = ''disk_used_percent{mode!="ro"} >= 95'';
+      time = "10m";
+      description = "{{$labels.instance}} device {{$labels.device}} on {{$labels.path}} got less than 20% space left on its filesystem.";
+    };
+
+    filesystem_full_krebs = {
+      condition = ''disk_used_percent{mode!="ro", org="krebs"} >= 95'';
+      time = "10m";
+      description = "{{$labels.instance}} device {{$labels.device}} on {{$labels.path}} got less than 5% space left on its filesystem.";
+    };
+
+    filesystem_inodes_full = {
+      condition = ''disk_inodes_free / disk_inodes_total < 0.10'';
+      time = "10m";
+      description = "{{$labels.instance}} device {{$labels.device}} on {{$labels.path}} got less than 10% inodes left on its filesystem.";
+    };
+
+    daily_task_not_run = {
+      # give 6 hours grace period
+      condition = ''time() - task_last_run{state="ok",frequency="daily"} > (24 + 6) * 60 * 60'';
+      description = "{{$labels.host}}: {{$labels.name}} was not run in the last 24h";
+    };
+
+    daily_task_failed = {
+      condition = ''task_last_run{state="fail"}'';
+      description = "{{$labels.host}}: {{$labels.name}} failed to run";
+    };
+
+    swap_using_30percent = {
+      condition = "mem_swap_total - (mem_swap_cached + mem_swap_free) > mem_swap_total * 0.3";
+      time = "30m";
+      description = "{{$labels.host}} is using 30% of its swap space for at least 30 minutes.";
+    };
+
+    systemd_service_failed = {
+      condition = ''systemd_units_active_code{name!~"nixpkgs-update-.*.service"} == 3'';
+      description = "{{$labels.host}} failed to (re)start service {{$labels.name}}.";
+    };
+
+    service_not_running = {
+      condition = ''systemd_units_active_code{name=~"teamspeak3-server.service|tt-rss.service", sub!="running"}'';
+      description = "{{$labels.host}} should have a running {{$labels.name}}.";
+    };
+
+    nfs_export_not_present = {
+      condition = "nfs_export_present == 0";
+      time = "1h";
+      description = "{{$labels.host}} cannot reach nfs export [{{$labels.server}}]:{{$labels.path}}";
+    };
+
+    ram_using_90percent = {
+      condition = "mem_buffered + mem_free + mem_cached < mem_total * 0.1";
+      time = "1h";
+      description = "{{$labels.host}} is using at least 90% of its RAM for at least 1 hour.";
+    };
+    load15 = {
+      condition = ''system_load15 / system_n_cpus{org!="nix-community"} >= 2.0'';
+      time = "10m";
+      description = "{{$labels.host}} is running with load15 > 1 for at least 5 minutes: {{$value}}";
+    };
+    reboot = {
+      condition = "system_uptime < 300";
+      description = "{{$labels.host}} just rebooted.";
+    };
+    uptime = {
+      # too scared to upgrade matchbox
+      condition = ''system_uptime {host!~"^(matchbox|grandalf)$"} > 2592000'';
+      description = "Uptime monster: {{$labels.host}} has been up for more than 30 days.";
+    };
+    telegraf_down = {
+      condition = ''min(up{job=~"telegraf",type!='mobile'}) by (source, job, instance, org) == 0'';
+      time = "3m";
+      description = "{{$labels.instance}}: {{$labels.job}} telegraf exporter from {{$labels.source}} is down.";
+    };
+    ping = {
+      condition = "ping_result_code{type!='mobile'} != 0";
+      description = "{{$labels.url}}: ping from {{$labels.instance}} has failed!";
+    };
+    ping_high_latency = {
+      condition = "ping_average_response_ms{type!='mobile'} > 5000";
+      description = "{{$labels.instance}}: ping probe from {{$labels.source}} is encountering high latency!";
+    };
+    http = {
+      condition = "http_response_result_code != 0";
+      description = "{{$labels.server}} : http request failed from {{$labels.instance}}: {{$labels.result}}!";
+    };
+    http_match_failed = {
+      condition = "http_response_response_string_match == 0";
+      description = "{{$labels.server}} : http body not as expected; status code: {{$labels.status_code}}!";
+    };
+    dns_query = {
+      condition = "dns_query_result_code != 0";
+      description = "{{$labels.domain}} : could retrieve A record {{$labels.instance}} from server {{$labels.server}}: {{$labels.result}}!";
+    };
+    secure_dns_query = {
+      condition = "secure_dns_state != 0";
+      description = "{{$labels.domain}} : could retrieve A record {{$labels.instance}} from server {{$labels.server}}: {{$labels.result}} for protocol {{$labels.protocol}}!";
+    };
+    connection_failed = {
+      condition = "net_response_result_code != 0";
+      description = "{{$labels.server}}: connection to {{$labels.port}}({{$labels.protocol}}) failed from {{$labels.instance}}";
+    };
+    healthchecks = {
+      condition = "hc_check_up == 0";
+      description = "{{$labels.instance}}: healtcheck {{$labels.job}} fails!";
+    };
+    cert_expiry = {
+      condition = "x509_cert_expiry < 7*24*3600";
+      description = "{{$labels.instance}}: The TLS certificate from {{$labels.source}} will expire in less than 7 days: {{$value}}s";
+    };
+
+    postfix_queue_length = {
+      condition = "avg_over_time(postfix_queue_length[1h]) > 10";
+      description = "{{$labels.instance}}: postfix mail queue has undelivered {{$value}} items";
+    };
+
+    zfs_errors = {
+      condition = "zfs_arcstats_l2_io_error + zfs_dmu_tx_error + zfs_arcstats_l2_writes_error > 0";
+      description = "{{$labels.instance}} reports: {{$value}} ZFS IO errors.";
+    };
+
+    # ignore devices that disabled S.M.A.R.T (example if attached via USB)
+    smart_errors = {
+      condition = ''smart_device_health_ok{enabled!="Disabled"} != 1'';
+      description = "{{$labels.instance}}: S.M.A.R.T reports: {{$labels.device}} ({{$labels.model}}) has errors.";
+    };
+
+    oom_kills = {
+      condition = "increase(kernel_vmstat_oom_kill[5m]) > 0";
+      description = "{{$labels.instance}}: OOM kill detected";
+    };
+
+    unusual_disk_read_latency = {
+      condition = "rate(diskio_read_time[1m]) / rate(diskio_reads[1m]) > 0.1 and rate(diskio_reads[1m]) > 0";
+      description = "{{$labels.instance}}: Disk latency is growing (read operations > 100ms)\n";
+    };
+
+    unusual_disk_write_latency = {
+      condition = "rate(diskio_write_time[1m]) / rate(diskio_write[1m]) > 0.1 and rate(diskio_write[1m]) > 0";
+      description = "{{$labels.instance}}: Disk latency is growing (write operations > 100ms)\n";
+    };
+
+    host_memory_under_memory_pressure = {
+      condition = "rate(node_vmstat_pgmajfault[1m]) > 1000";
+      description = "{{$labels.instance}}: The node is under heavy memory pressure. High rate of major page faults: {{$value}}";
+    };
+
+    ext4_errors = {
+      condition = "ext4_errors_value > 0";
+      description = "{{$labels.instance}}: ext4 has reported {{$value}} I/O errors: check /sys/fs/ext4/*/errors_count";
+    };
+
+    alerts_silences_changed = {
+      condition = ''abs(delta(alertmanager_silences{state="active"}[1h])) >= 1'';
+      description = "alertmanager: number of active silences has changed: {{$value}}";
+    };
+  })
diff --git a/lass/2configs/monitoring/prometheus.nix b/lass/2configs/monitoring/prometheus.nix
new file mode 100644
index 000000000..ba32c62a7
--- /dev/null
+++ b/lass/2configs/monitoring/prometheus.nix
@@ -0,0 +1,110 @@
+{ config, lib, pkgs, ... }:
+{
+  #prometheus
+  krebs.iptables = {
+    enable = true;
+    tables.filter.INPUT.rules = [
+      { predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; } # nginx
+      # { predicate = "-i retiolum -p tcp --dport 3012"; target = "ACCEPT"; } # grafana
+      # { predicate = "-i retiolum -p tcp --dport 9093"; target = "ACCEPT"; } # alertmanager
+      # { predicate = "-i retiolum -p tcp --dport 9223"; target = "ACCEPT"; } # alertmanager
+    ];
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "prometheus.lass.r" = {
+        locations."/".proxyPass = "http://localhost:9090";
+      };
+      "alert.lass.r" = {
+        locations."/".proxyPass = "http://localhost:9093";
+      };
+      "grafana.lass.r" = {
+        locations."/".proxyPass = "http://localhost:3012";
+      };
+    };
+  };
+
+  services.grafana = {
+    enable = true;
+    addr = "0.0.0.0";
+    port = 3012;
+    auth.anonymous = {
+      enable = true;
+      org_role = "Admin";
+    };
+  };
+  services.prometheus = {
+    enable = true;
+    ruleFiles = [
+      (pkgs.writeText "prometheus-rules.yml" (builtins.toJSON {
+        groups = [{
+          name = "alerting-rules";
+          rules = import ./alert-rules.nix { inherit lib; };
+        }];
+      }))
+    ];
+    scrapeConfigs = [
+      {
+        job_name = "telegraf";
+        scrape_interval = "60s";
+        metrics_path = "/metrics";
+        static_configs = [
+          {
+            targets = [
+              "prism.r:9273"
+              "dishfire.r:9273"
+              "yellow.r:9273"
+            ];
+          }
+        ];
+      }
+    ];
+    alertmanagers = [
+      { scheme = "http";
+        path_prefix = "/";
+        static_configs = [ { targets = [ "localhost:9093" ]; } ];
+      }
+    ];
+    alertmanager = {
+      enable = true;
+      webExternalUrl = "https://alert.lass.r";
+      listenAddress = "[::1]";
+      configuration = {
+        global = {
+          # The smarthost and SMTP sender used for mail notifications.
+          smtp_smarthost = "localhost:587";
+          smtp_from = "alertmanager@alert.lass.r";
+          # smtp_auth_username = "alertmanager@thalheim.io";
+          # smtp_auth_password = "$SMTP_PASSWORD";
+        };
+        route = {
+          receiver = "default";
+          routes = [
+            {
+              group_by = [ "host" ];
+              group_wait = "30s";
+              group_interval = "2m";
+              repeat_interval = "2h";
+              receiver = "all";
+            }
+          ];
+        };
+        receivers = [
+          {
+            name = "all";
+            webhook_configs = [{
+              url = "http://127.0.0.1:9223/";
+              max_alerts = 5;
+            }];
+          }
+          {
+            name = "default";
+          }
+        ];
+      };
+    };
+  };
+
+}
diff --git a/lass/2configs/monitoring/telegraf.nix b/lass/2configs/monitoring/telegraf.nix
new file mode 100644
index 000000000..5258b87ed
--- /dev/null
+++ b/lass/2configs/monitoring/telegraf.nix
@@ -0,0 +1,72 @@
+{ config, lib, pkgs, ... }:
+let
+  isVM = lib.any (mod: mod == "xen-blkfront" || mod == "virtio_console") config.boot.initrd.kernelModules;
+in {
+
+  krebs.iptables.tables.filter.INPUT.rules = [
+    { predicate = "-i retiolum -p tcp --dport 9273"; target = "ACCEPT"; }
+  ];
+
+  systemd.services.telegraf.path = [ pkgs.nvme-cli ];
+
+  services.telegraf = {
+    enable = true;
+    extraConfig = {
+      agent.interval = "60s";
+      inputs = {
+        http_response = [
+          { urls = [
+              "http://localhost:8080/about/health/"
+          ]; }
+        ];
+        prometheus.metric_version = 2;
+        kernel_vmstat = { };
+        # smart = lib.mkIf (!isVM) {
+        #   path = pkgs.writeShellScript "smartctl" ''
+        #     exec /run/wrappers/bin/sudo ${pkgs.smartmontools}/bin/smartctl "$@"
+        #   '';
+        # };
+        system = { };
+        mem = { };
+        file = [{
+          data_format = "influx";
+          file_tag = "name";
+          files = [ "/var/log/telegraf/*" ];
+        }] ++ lib.optional (lib.any (fs: fs == "ext4") config.boot.supportedFilesystems) {
+          name_override = "ext4_errors";
+          files = [ "/sys/fs/ext4/*/errors_count" ];
+          data_format = "value";
+        };
+        exec = lib.optionalAttrs (lib.any (fs: fs == "zfs") config.boot.supportedFilesystems) {
+          ## Commands array
+          commands = [
+            (pkgs.writeScript "zpool-health" ''
+              #!${pkgs.gawk}/bin/awk -f
+              BEGIN {
+                while ("${pkgs.zfs}/bin/zpool status" | getline) {
+                  if ($1 ~ /pool:/) { printf "zpool_status,name=%s ", $2 }
+                  if ($1 ~ /state:/) { printf " state=\"%s\",", $2 }
+                  if ($1 ~ /errors:/) {
+                    if (index($2, "No")) printf "errors=0i\n"; else printf "errors=%di\n", $2
+                  }
+                }
+              }
+            '')
+          ];
+          data_format = "influx";
+        };
+        systemd_units = { };
+        swap = { };
+        disk.tagdrop = {
+          fstype = [ "tmpfs" "ramfs" "devtmpfs" "devfs" "iso9660" "overlay" "aufs" "squashfs" ];
+          device = [ "rpc_pipefs" "lxcfs" "nsfs" "borgfs" ];
+        };
+        diskio = { };
+      };
+      outputs.prometheus_client = {
+        listen = ":9273";
+        metric_version = 2;
+      };
+    };
+  };
+}
-- 
cgit v1.2.3


From d89a10ffec96bba4e367ace42b7fc9afed99abc5 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 16:24:54 +0200
Subject: l mors.r: fix syntax, add play-on

---
 lass/1systems/mors/config.nix | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'lass')

diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix
index 19b781ff5..1b205f25c 100644
--- a/lass/1systems/mors/config.nix
+++ b/lass/1systems/mors/config.nix
@@ -103,6 +103,9 @@ with import <stockholm/lib>;
 
     dnsutils
     woeusb
+    (pkgs.writeDashBin "play-on" ''
+      HOST=$(echo 'styx\nshodan' | fzfmenu)
+      ssh -t "$HOST" -- mpv "$@"
     '')
   ];
 
-- 
cgit v1.2.3


From bf94b004efb08fa375a4115578a35f6fe7d38d98 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 16:40:32 +0200
Subject: l boot: add uniersal boot method

---
 lass/2configs/boot/universal.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 lass/2configs/boot/universal.nix

(limited to 'lass')

diff --git a/lass/2configs/boot/universal.nix b/lass/2configs/boot/universal.nix
new file mode 100644
index 000000000..33f4323cc
--- /dev/null
+++ b/lass/2configs/boot/universal.nix
@@ -0,0 +1,11 @@
+{ ... }:
+
+{
+  boot = {
+    loader.grub.enable = true;
+    loader.grub.version = 2;
+    loader.grub.device = "/dev/sda";
+    loader.grub.efiSupport = true;
+    loader.grub.efiInstallAsRemovable = true;
+  };
+}
-- 
cgit v1.2.3


From 6ee4f8c1c1847c901f76caf7548383c9af339a92 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 17:03:10 +0200
Subject: l neoprism.r: add more services

---
 lass/1systems/neoprism/config.nix | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

(limited to 'lass')

diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix
index 7b402f8a6..79402959e 100644
--- a/lass/1systems/neoprism/config.nix
+++ b/lass/1systems/neoprism/config.nix
@@ -4,6 +4,9 @@
   imports = [
     <stockholm/lass>
     <stockholm/lass/2configs/retiolum.nix>
+    <stockholm/lass/2configs/mail/internet-gateway.nix>
+    <stockholm/lass/2configs/binary-cache/server.nix>
+    <stockholm/lass/2configs/matrix.nix>
     <stockholm/lass/2configs/gsm-wiki.nix>
 
     # sync-containers
@@ -26,7 +29,23 @@
   krebs.build.host = config.krebs.hosts.neoprism;
 
   networking.firewall.allowedTCPPorts = [ 80 443 ];
-  services.nginx.enable = true;
   security.acme.acceptTerms = true;
   security.acme.defaults.email = "acme@lassul.us";
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedTlsSettings = true;
+
+    enableReload = true;
+
+    virtualHosts.default = {
+      default = true;
+      locations."= /etc/os-release".extraConfig = ''
+        default_type text/plain;
+        alias /etc/os-release;
+      '';
+      locations."~ ^/.well-known/acme-challenge/".root = "/var/lib/acme/acme-challenge";
+    };
+  };
 }
-- 
cgit v1.2.3


From b62c59380203ee44c28da87710d6b24ccae0a089 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 17:03:28 +0200
Subject: l neoprism.r: update disko config

---
 lass/1systems/neoprism/disk.nix | 36 ++++++++++++++++++++++++------------
 1 file changed, 24 insertions(+), 12 deletions(-)

(limited to 'lass')

diff --git a/lass/1systems/neoprism/disk.nix b/lass/1systems/neoprism/disk.nix
index cf9a8cef4..dfebaf8d8 100644
--- a/lass/1systems/neoprism/disk.nix
+++ b/lass/1systems/neoprism/disk.nix
@@ -9,14 +9,12 @@
       partitions = [
         {
           name = "boot";
-          type = "partition";
           start = "0";
           end = "1M";
           part-type = "primary";
           flags = ["bios_grub"];
         }
         {
-          type = "partition";
           name = "ESP";
           start = "1M";
           end = "1GiB";
@@ -28,7 +26,6 @@
           };
         }
         {
-          type = "partition";
           name = "zfs";
           start = "1GiB";
           end = "100%";
@@ -69,7 +66,7 @@
       rootFsOptions = {
       };
       datasets.reserved = {
-        zfs_type = "filesystem";
+        type = "zfs_fs";
         options.refreservation = "1G";
       };
     };
@@ -77,38 +74,53 @@
       type = "zpool";
       datasets = {
         reserved = {
-          zfs_type = "filesystem";
+          type = "zfs_fs";
           options.refreservation = "1G";
         };
         containers = {
-          zfs_type = "filesystem";
+          type = "zfs_fs";
           mountpoint = "/var/lib/containers";
+          options = {
+            canmount = "noauto";
+          };
         };
         home = {
-          zfs_type = "filesystem";
+          type = "zfs_fs";
           mountpoint = "/home";
+          options = {
+            canmount = "noauto";
+          };
         };
         srv = {
-          zfs_type = "filesystem";
+          type = "zfs_fs";
           mountpoint = "/srv";
+          options = {
+            canmount = "noauto";
+          };
         };
         libvirt = {
-          zfs_type = "filesystem";
+          type = "zfs_fs";
           mountpoint = "/var/lib/libvirt";
+          options = {
+            canmount = "noauto";
+          };
         };
         # encrypted = {
-        #   zfs_type = "filesystem";
+        #   type = "zfs_fs";
         #   options = {
+        #     canmount = "noauto";
         #     mountpoint = "none";
         #     encryption = "aes-256-gcm";
         #     keyformat = "passphrase";
         #     keylocation = "prompt";
         #   };
         # };
-
         # "encrypted/download" = {
-        #   zfs_type = "filesystem";
+        #   type = "zfs_fs";
         #   mountpoint = "/var/download";
+        #   options = {
+        #     canmount = "noauto";
+        #   };
         # };
       };
     };
-- 
cgit v1.2.3


From a2fae747ec5c3b9af3cd210c8cc921c5800d46e1 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 17:04:00 +0200
Subject: l neoprism.r: add networking

---
 lass/1systems/neoprism/physical.nix | 72 ++++++++++++++++++++++++++-----------
 1 file changed, 52 insertions(+), 20 deletions(-)

(limited to 'lass')

diff --git a/lass/1systems/neoprism/physical.nix b/lass/1systems/neoprism/physical.nix
index 4ffb749f1..84397db13 100644
--- a/lass/1systems/neoprism/physical.nix
+++ b/lass/1systems/neoprism/physical.nix
@@ -17,26 +17,58 @@
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 
   # networking config
-  boot.kernelParams = [ "net.ifnames=0" ];
-  networking.bridges."ext-br".interfaces = [ "eth0" ];
-  networking = {
-    hostId = "2283aaae";
-    defaultGateway = "95.217.192.1";
-    defaultGateway6 = { address = "fe80::1"; interface = "ext-br"; };
-    # Use google's public DNS server
-    nameservers = [ "8.8.8.8" ];
-    interfaces.ext-br.ipv4.addresses = [
-      {
-        address = "95.217.192.59";
-        prefixLength = 26;
-      }
-    ];
-    interfaces.ext-br.ipv6.addresses = [
-      {
-        address = "2a01:4f9:4a:4f1a::1";
-        prefixLength = 64;
-      }
-    ];
+  networking.useNetworkd = true;
+  systemd.network = {
+    enable = true;
+    config = {
+      networkConfig.SpeedMeter = true;
+    };
+    # netdevs.ext-br.netdevConfig = {
+    #   Kind = "bridge";
+    #   Name = "ext-br";
+    #   MACAddress = "a8:a1:59:0f:2d:69";
+    # };
+    # networks.ext-br = {
+    #   name = "ext-br";
+    #   address = [
+    #     "95.217.192.59/26"
+    #     "2a01:4f9:4a:4f1a::1/64"
+    #   ];
+    #   gateway = [
+    #     "95.217.192.1"
+    #     "fe80::1"
+    #   ];
+    # };
+    networks.eth0 = {
+      #bridge = [ "ext-br" ];
+      matchConfig.Name = "eth0";
+       address = [
+         "95.217.192.59/26"
+         "2a01:4f9:4a:4f1a::1/64"
+       ];
+       gateway = [
+         "95.217.192.1"
+         "fe80::1"
+       ];
+    };
   };
 
+  networking.useDHCP = false;
+  boot.initrd.network = {
+    enable = true;
+    ssh = {
+      enable = true;
+      authorizedKeys = [ config.krebs.users.lass.pubkey ];
+      port = 2222;
+      hostKeys = [
+        (toString <secrets/ssh.id_ed25519>)
+        (toString <secrets/ssh.id_rsa>)
+      ];
+    };
+  };
+  boot.kernelParams = [
+    "net.ifnames=0"
+    "ip=dhcp"
+    "boot.trace"
+  ];
 }
-- 
cgit v1.2.3


From ac2ad2468631a8cece029f8c3797962175d6bc3e Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 8 Jul 2023 17:04:25 +0200
Subject: l neoprism.r: add hostId

---
 lass/1systems/neoprism/physical.nix | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'lass')

diff --git a/lass/1systems/neoprism/physical.nix b/lass/1systems/neoprism/physical.nix
index 84397db13..f2092d9aa 100644
--- a/lass/1systems/neoprism/physical.nix
+++ b/lass/1systems/neoprism/physical.nix
@@ -8,6 +8,8 @@
   ];
 
   disko.devices = import ./disk.nix;
+  networking.hostId = "9c0a74ac";
+
   boot.loader.grub.enable = true;
   boot.loader.grub.version = 2;
   boot.loader.grub.efiSupport = true;
-- 
cgit v1.2.3


From b22541175baa2a4372afaac71419e6854470175a Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sun, 9 Jul 2023 12:20:02 +0200
Subject: l: add missing mail/internet-gateway file

---
 lass/2configs/mail/internet-gateway.nix | 48 +++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 lass/2configs/mail/internet-gateway.nix

(limited to 'lass')

diff --git a/lass/2configs/mail/internet-gateway.nix b/lass/2configs/mail/internet-gateway.nix
new file mode 100644
index 000000000..134e408a4
--- /dev/null
+++ b/lass/2configs/mail/internet-gateway.nix
@@ -0,0 +1,48 @@
+{ config, lib, pkgs, ... }:
+{
+  security.acme.certs."mail.lassul.us" = {
+    group = "lasscert";
+    webroot = "/var/lib/acme/acme-challenge";
+  };
+  users.groups.lasscert.members = [
+    "exim"
+    "nginx"
+  ];
+
+  krebs.exim-smarthost = {
+    enable = true;
+    primary_hostname = "lassul.us";
+    dkim = [
+      { domain = "lassul.us"; }
+    ];
+    ssl_cert = "/var/lib/acme/mail.lassul.us/fullchain.pem";
+    ssl_key = "/var/lib/acme/mail.lassul.us/key.pem";
+    local_domains = [
+      "localhost"
+      "lassul.us"
+      "ubikmedia.eu"
+      "ubikmedia.de"
+      "apanowicz.de"
+      "alewis.de"
+      "jarugadesign.de"
+      "beesmooth.ch"
+      "event-extra.de"
+      "jla-trading.com"
+    ];
+    extraRouters = ''
+      forward_lassul_us:
+        driver = manualroute
+        domains = lassul.us
+        transport = remote_smtp
+        route_list = * orange.r
+        no_more
+
+      forward_ubik:
+        driver = manualroute
+        domains = ubikmedia.eu:ubikmedia.de:apanowicz.de:alewis.de:jarugadesign.de:beesmooth.ch:event-extra.de:jla-trading.com
+        transport = remote_smtp
+        route_list = * ubik.r
+        no_more
+    '';
+  };
+}
-- 
cgit v1.2.3


From 3ecc50fb63c6d460d3693ec8fb24cf9a15ed2fa7 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Fri, 14 Jul 2023 21:55:25 +0200
Subject: l: use networkd everywhere

---
 lass/2configs/default.nix  |  1 +
 lass/2configs/networkd.nix | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+)
 create mode 100644 lass/2configs/networkd.nix

(limited to 'lass')

diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix
index 3d7188dc6..72dbfc480 100644
--- a/lass/2configs/default.nix
+++ b/lass/2configs/default.nix
@@ -12,6 +12,7 @@ with import <stockholm/lib>;
     ./wiregrill.nix
     ./tmux.nix
     ./tor-ssh.nix
+    ./networkd.nix
     {
       users.extraUsers =
         mapAttrs (_: h: { hashedPassword = h; })
diff --git a/lass/2configs/networkd.nix b/lass/2configs/networkd.nix
new file mode 100644
index 000000000..12ffe0bd7
--- /dev/null
+++ b/lass/2configs/networkd.nix
@@ -0,0 +1,20 @@
+{ config, lib, pkgs, ... }:
+{
+  systemd.services.systemd-networkd-wait-online.enable = lib.mkForce false;
+  systemd.services.systemd-networkd.stopIfChanged = false;
+  # Services that are only restarted might be not able to resolve when resolved is stopped before
+  systemd.services.systemd-resolved.stopIfChanged = false;
+
+  networking.useNetworkd = true;
+  systemd.network = {
+    enable = true;
+    networks.wl0 = {
+      matchConfig.Name = "wl0";
+      DHCP = "yes";
+      networkConfig = {
+        IgnoreCarrierLoss = "3s";
+      };
+      dhcpV4Config.UseDNS = true;
+    };
+  };
+}
-- 
cgit v1.2.3


From 7762c5ff9b41f1061b77806eb41cb87357b6213b Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 15 Jul 2023 17:04:58 +0200
Subject: l krops: actually deploy unstable

---
 lass/krops.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lass')

diff --git a/lass/krops.nix b/lass/krops.nix
index 81c679c5e..a7dcaf5bf 100644
--- a/lass/krops.nix
+++ b/lass/krops.nix
@@ -27,7 +27,7 @@
         '';
       } else {
         git = {
-          ref = (lib.importJSON ../krebs/nixpkgs.json).rev;
+          ref = (lib.importJSON ../krebs/nixpkgs-unstable.json).rev;
           url = https://github.com/NixOS/nixpkgs;
           shallow = true;
         };
-- 
cgit v1.2.3


From dd4c71d1429bba2251165ba4ac4ecad132b8947c Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sat, 15 Jul 2023 19:44:41 +0200
Subject: l nm-dmenu: add props to PATH

---
 lass/5pkgs/nm-dmenu/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

(limited to 'lass')

diff --git a/lass/5pkgs/nm-dmenu/default.nix b/lass/5pkgs/nm-dmenu/default.nix
index cb47bded3..ff4ba1633 100644
--- a/lass/5pkgs/nm-dmenu/default.nix
+++ b/lass/5pkgs/nm-dmenu/default.nix
@@ -1,6 +1,10 @@
-{ pkgs, ... }:
+{ pkgs, lib, ... }:
 
 pkgs.writeDashBin "nm-dmenu" ''
-  export PATH=$PATH:${pkgs.dmenu}/bin:${pkgs.networkmanagerapplet}/bin
+  export PATH=$PATH:${lib.makeBinPath [
+    pkgs.dmenu
+    pkgs.networkmanagerapplet
+    pkgs.procps
+  ]}
   exec ${pkgs.networkmanager_dmenu}/bin/networkmanager_dmenu "$@"
 ''
-- 
cgit v1.2.3


From caa22d7d6457b0a69fb0c60acaa396c4b2aee7f3 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sun, 23 Jul 2023 23:01:09 +0200
Subject: l aergia.r: enable corectrl

---
 lass/1systems/aergia/physical.nix | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

(limited to 'lass')

diff --git a/lass/1systems/aergia/physical.nix b/lass/1systems/aergia/physical.nix
index ef62478b4..9f06dccdc 100644
--- a/lass/1systems/aergia/physical.nix
+++ b/lass/1systems/aergia/physical.nix
@@ -19,11 +19,9 @@
   boot.kernelPackages = pkgs.linuxPackages_latest;
 
   boot.kernelParams = [
-
     # use less power with pstate
     "amd_pstate=passive"
 
-
     # suspend
     "resume_offset=178345675"
   ];
@@ -63,6 +61,14 @@
   ];
 
   # corectrl
+  programs.corectrl = {
+    enable = true;
+    gpuOverclock = {
+      enable = true;
+      ppfeaturemask = "0xffffffff";
+    };
+  };
+  users.users.mainUser.extraGroups = [ "corectrl" ];
 
   # use newer ryzenadj
 
-- 
cgit v1.2.3


From 0d94dc9000c9a65ffb9839ff6983c24013ddb805 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sun, 23 Jul 2023 23:02:02 +0200
Subject: l neoprism.r: update disk config

---
 lass/1systems/neoprism/disk.nix | 36 +++++++++++++-----------------------
 1 file changed, 13 insertions(+), 23 deletions(-)

(limited to 'lass')

diff --git a/lass/1systems/neoprism/disk.nix b/lass/1systems/neoprism/disk.nix
index dfebaf8d8..c5bd44c94 100644
--- a/lass/1systems/neoprism/disk.nix
+++ b/lass/1systems/neoprism/disk.nix
@@ -4,37 +4,27 @@
     type = "disk";
     device = disk;
     content = {
-      type = "table";
-      format = "gpt";
-      partitions = [
-        {
-          name = "boot";
-          start = "0";
-          end = "1M";
-          part-type = "primary";
-          flags = ["bios_grub"];
-        }
-        {
-          name = "ESP";
-          start = "1M";
-          end = "1GiB";
-          fs-type = "fat32";
-          bootable = true;
+      type = "gpt";
+      partitions = {
+        boot = {
+          size = "1M";
+          type = "EF02";
+        };
+        ESP = {
+          size = "1G";
           content = {
             type = "mdraid";
             name = "boot";
           };
-        }
-        {
-          name = "zfs";
-          start = "1GiB";
-          end = "100%";
+        };
+        zfs = {
+          size = "100%";
           content = {
             type = "zfs";
             pool = "zroot";
           };
-        }
-      ];
+        };
+      };
     };
   })) // {
     hdd1 = {
-- 
cgit v1.2.3


From 3db106bbd364db697a3f09279875eb5ca3711db9 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sun, 23 Jul 2023 23:03:24 +0200
Subject: l styx.r: mount yellow

---
 lass/1systems/styx/config.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'lass')

diff --git a/lass/1systems/styx/config.nix b/lass/1systems/styx/config.nix
index e49d24f9a..93d60727e 100644
--- a/lass/1systems/styx/config.nix
+++ b/lass/1systems/styx/config.nix
@@ -13,6 +13,7 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/browsers.nix>
     <stockholm/lass/2configs/programs.nix>
     <stockholm/lass/2configs/nfs-dl.nix>
+    <stockholm/lass/2configs/yellow-mounts/samba.nix>
     <stockholm/lass/2configs/gg23.nix>
     <stockholm/lass/2configs/hass>
     <stockholm/lass/2configs/green-host.nix>
-- 
cgit v1.2.3


From 0af999432992e98b9541afdf28b5a6ba5846ad71 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sun, 23 Jul 2023 23:03:57 +0200
Subject: l styx.r: allow smokeping from more interfaces

---
 lass/1systems/styx/config.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'lass')

diff --git a/lass/1systems/styx/config.nix b/lass/1systems/styx/config.nix
index 93d60727e..51016926f 100644
--- a/lass/1systems/styx/config.nix
+++ b/lass/1systems/styx/config.nix
@@ -31,9 +31,9 @@ with import <stockholm/lib>;
 
   krebs.build.host = config.krebs.hosts.styx;
 
-  krebs.iptables.tables.filter.INPUT.rules = [
-    { predicate = "-p tcp --dport ${toString config.services.smokeping.port}"; target = "ACCEPT"; }
-  ];
+  networking.firewall.interfaces.int0.allowedTCPPorts = [ config.services.smokeping.port ];
+  networking.firewall.interfaces.retiolum.allowedTCPPorts = [ config.services.smokeping.port ];
+  networking.firewall.interfaces.wiregrill.allowedTCPPorts = [ config.services.smokeping.port ];
   krebs.power-action.enable = mkForce false;
 
   services.smokeping = {
-- 
cgit v1.2.3


From 00449032df948eb84f2c477a096251ef19ae0acb Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sun, 23 Jul 2023 23:04:24 +0200
Subject: l styx.r: allow usb wan

---
 lass/1systems/styx/config.nix | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'lass')

diff --git a/lass/1systems/styx/config.nix b/lass/1systems/styx/config.nix
index 51016926f..41a0a115d 100644
--- a/lass/1systems/styx/config.nix
+++ b/lass/1systems/styx/config.nix
@@ -85,5 +85,8 @@ with import <stockholm/lib>;
       host = prism.r
     '';
   };
+
+  # for usb internet
+  hardware.usbWwan.enable = true;
 }
 
-- 
cgit v1.2.3


From c32c2996ab27ffd70087e71b8d506096e00f0fd8 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sun, 23 Jul 2023 23:04:42 +0200
Subject: l styx.r: add some scripts

---
 lass/1systems/styx/config.nix | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

(limited to 'lass')

diff --git a/lass/1systems/styx/config.nix b/lass/1systems/styx/config.nix
index 41a0a115d..edb2a35e1 100644
--- a/lass/1systems/styx/config.nix
+++ b/lass/1systems/styx/config.nix
@@ -36,6 +36,24 @@ with import <stockholm/lib>;
   networking.firewall.interfaces.wiregrill.allowedTCPPorts = [ config.services.smokeping.port ];
   krebs.power-action.enable = mkForce false;
 
+  environment.systemPackages = with pkgs; [
+    wol
+    (writeDashBin "wake-alien" ''
+      ${wol}/bin/wol -h 10.42.0.255 10:65:30:68:83:a3
+    '')
+    (writers.writeDashBin "iptv" ''
+      set -efu
+      /run/current-system/sw/bin/mpv \
+        --audio-display=no --audio-channels=stereo \
+        --audio-samplerate=48000 --audio-format=s16 \
+        --ao-pcm-file=/run/snapserver/snapfifo --ao=pcm \
+        --audio-delay=-1 \
+        --playlist=https://iptv-org.github.io/iptv/index.nsfw.m3u \
+        --idle=yes \
+        --input-ipc-server=/tmp/mpv.ipc \
+        "$@"
+    '')
+  ];
   services.smokeping = {
     enable = true;
     targetConfig = ''
-- 
cgit v1.2.3


From 8692b5a886fff479729f8914534932e13362eda3 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sun, 23 Jul 2023 23:05:01 +0200
Subject: l styx.r: fix smokeping

---
 lass/1systems/styx/config.nix | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'lass')

diff --git a/lass/1systems/styx/config.nix b/lass/1systems/styx/config.nix
index edb2a35e1..6c054abfe 100644
--- a/lass/1systems/styx/config.nix
+++ b/lass/1systems/styx/config.nix
@@ -54,8 +54,14 @@ with import <stockholm/lib>;
         "$@"
     '')
   ];
+
+  users.users.mainUser.openssh.authorizedKeys.keys = [
+    config.krebs.users.lass-android.pubkey
+  ];
+  # http://10.42.0.1:8081/smokeping.fcgi
   services.smokeping = {
     enable = true;
+    host = null;
     targetConfig = ''
       probe = FPing
       menu = top
-- 
cgit v1.2.3


From 4dc356281cc96bbfa84471c1ac2fe31f4bb09335 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Sun, 23 Jul 2023 23:05:41 +0200
Subject: l ubik.r: copy config from domsen.nix

---
 lass/1systems/ubik/config.nix | 231 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 231 insertions(+)

(limited to 'lass')

diff --git a/lass/1systems/ubik/config.nix b/lass/1systems/ubik/config.nix
index b153c0d3b..3afbf6bd1 100644
--- a/lass/1systems/ubik/config.nix
+++ b/lass/1systems/ubik/config.nix
@@ -42,4 +42,235 @@ with import <stockholm/lib>;
         /var/src/secrets/nextcloud.pw /run/nextcloud.pw
     ''}"
   ];
+
+  # mail
+  lass.usershadow.enable = true;
+  services.nginx.virtualHosts."mail.ubikmedia.eu" = {
+    enableACME = true;
+    forceSSL = true;
+  };
+  services.roundcube = {
+    enable = true;
+    hostName = "mail.ubikmedia.eu";
+    extraConfig = ''
+      $config['smtp_debug'] = true;
+      $config['smtp_host'] = "localhost:25";
+    '';
+  };
+  services.dovecot2 = {
+    enable = true;
+    showPAMFailure = true;
+    mailLocation = "maildir:~/Mail";
+    sslServerCert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
+    sslServerKey = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
+  };
+  krebs.exim-smarthost = {
+    ssl_cert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
+    ssl_key = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
+    authenticators.PLAIN = ''
+      driver = plaintext
+      public_name = PLAIN
+      server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
+    '';
+    authenticators.LOGIN = ''
+      driver = plaintext
+      public_name = LOGIN
+      server_prompts = "Username:: : Password::"
+      server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
+      # server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
+    '';
+    internet-aliases = [
+      { from = "dma@ubikmedia.de"; to = "domsen"; }
+      { from = "dma@ubikmedia.eu"; to = "domsen"; }
+      { from = "hallo@apanowicz.de"; to = "domsen"; }
+      { from = "bruno@apanowicz.de"; to = "bruno"; }
+      { from = "mail@jla-trading.com"; to = "jla-trading"; }
+      { from = "jms@ubikmedia.eu"; to = "jms"; }
+      { from = "ms@ubikmedia.eu"; to = "ms"; }
+      { from = "ubik@ubikmedia.eu"; to = "domsen, jms, ms"; }
+      { from = "kontakt@alewis.de"; to ="klabusterbeere"; }
+      { from = "hallo@jarugadesign.de"; to ="kasia"; }
+      { from = "noreply@beeshmooth.ch"; to ="besmooth@gmx.ch"; }
+
+      { from = "testuser@ubikmedia.eu"; to = "testuser"; }
+    ];
+    sender_domains = [
+      "jla-trading.com"
+      "ubikmedia.eu"
+      "ubikmedia.de"
+      "apanowicz.de"
+      "alewis.de"
+      "jarugadesign.de"
+      "beesmooth.ch"
+      "event-extra.de"
+    ];
+    dkim = [
+      { domain = "ubikmedia.eu"; }
+      { domain = "apanowicz.de"; }
+      { domain = "beesmooth.ch"; }
+    ];
+  };
+
+  # users
+  users.users.UBIK-SFTP = {
+    uid = pkgs.stockholm.lib.genid_uint31 "UBIK-SFTP";
+    home = "/home/UBIK-SFTP";
+    useDefaultShell = true;
+    createHome = true;
+    isNormalUser = true;
+  };
+
+  users.users.xanf = {
+    uid = pkgs.stockholm.lib.genid_uint31 "xanf";
+    group = "xanf";
+    home = "/home/xanf";
+    useDefaultShell = true;
+    createHome = false; # creathome forces permissions
+    isNormalUser = true;
+  };
+
+  users.users.domsen = {
+    uid = pkgs.stockholm.lib.genid_uint31 "domsen";
+    description = "maintenance acc for domsen";
+    home = "/home/domsen";
+    useDefaultShell = true;
+    extraGroups = [ "syncthing" "download" "xanf" ];
+    createHome = true;
+    isNormalUser = true;
+  };
+
+  users.users.bruno = {
+    uid = pkgs.stockholm.lib.genid_uint31 "bruno";
+    home = "/home/bruno";
+    useDefaultShell = true;
+    createHome = true;
+    isNormalUser = true;
+  };
+
+  users.users.jla-trading = {
+    uid = pkgs.stockholm.lib.genid_uint31 "jla-trading";
+    home = "/home/jla-trading";
+    useDefaultShell = true;
+    createHome = true;
+    isNormalUser = true;
+  };
+
+  users.users.jms = {
+    uid = pkgs.stockholm.lib.genid_uint31 "jms";
+    home = "/home/jms";
+    useDefaultShell = true;
+    createHome = true;
+    isNormalUser = true;
+  };
+
+  users.users.ms = {
+    uid = pkgs.stockholm.lib.genid_uint31 "ms";
+    home = "/home/ms";
+    useDefaultShell = true;
+    createHome = true;
+    isNormalUser = true;
+  };
+
+  users.users.testuser = {
+    uid = pkgs.stockholm.lib.genid_uint31 "testuser";
+    home = "/home/testuser";
+    useDefaultShell = true;
+    createHome = true;
+    isNormalUser = true;
+  };
+
+  users.users.bui = {
+    uid = pkgs.stockholm.lib.genid_uint31 "bui";
+    home = "/home/bui";
+    useDefaultShell = true;
+    createHome = true;
+    isNormalUser = true;
+  };
+
+  users.users.klabusterbeere = {
+    uid = pkgs.stockholm.lib.genid_uint31 "klabusterbeere"