From 4fac738ed2092c8922b5126903bac3f258bf22f4 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Fri, 20 Apr 2018 23:35:35 +0200
Subject: l: add restic service

---
 lass/3modules/default.nix |   1 +
 lass/3modules/restic.nix  | 119 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 120 insertions(+)
 create mode 100644 lass/3modules/restic.nix

(limited to 'lass')

diff --git a/lass/3modules/default.nix b/lass/3modules/default.nix
index 0c10e1ec2..5e7e6dff3 100644
--- a/lass/3modules/default.nix
+++ b/lass/3modules/default.nix
@@ -8,6 +8,7 @@ _:
     ./mysql-backup.nix
     ./news.nix
     ./pyload.nix
+    ./restic.nix
     ./screenlock.nix
     ./umts.nix
     ./usershadow.nix
diff --git a/lass/3modules/restic.nix b/lass/3modules/restic.nix
new file mode 100644
index 000000000..c720793b1
--- /dev/null
+++ b/lass/3modules/restic.nix
@@ -0,0 +1,119 @@
+{ config, lib, pkgs, ... }:
+
+with import <stockholm/lib>;
+
+{
+  options.lass.restic = mkOption {
+    type = types.attrsOf (types.submodule ({ config, ... }: {
+      options = {
+        name = mkOption {
+          type = types.str;
+          default = config._module.args.name;
+        };
+        passwordFile = mkOption {
+          type = types.str;
+          default = toString <secrets/restic-password>;
+          description = ''
+            read the repository password from a file.
+          '';
+          example = "/etc/nixos/restic-password";
+
+        };
+        repo = mkOption {
+          type = types.str;
+          default = "sftp:backup@prism.r:/backups/${config.name}";
+          description = ''
+            repository to backup to.
+          '';
+          example = "sftp:backup@192.168.1.100:/backups/${config.name}";
+        };
+        dirs = mkOption {
+          type = types.listOf types.str;
+          default = [];
+          description = ''
+            which directories to backup.
+          '';
+          example = [
+            "/var/lib/postgresql"
+            "/home/user/backup"
+          ];
+        };
+        timerConfig = mkOption {
+          type = types.attrsOf types.str;
+          default = {
+            OnCalendar = "daily";
+          };
+          description = ''
+            When to run the backup. See man systemd.timer for details.
+          '';
+          example = {
+            OnCalendar = "00:05";
+            RandomizedDelaySec = "5h";
+          };
+        };
+        user = mkOption {
+          type = types.str;
+          default = "root";
+          description = ''
+            As which user the backup should run.
+          '';
+          example = "postgresql";
+        };
+        extraArguments = mkOption {
+          type = types.listOf types.str;
+          default = [];
+          description = ''
+            Extra arguments to append to the restic command.
+          '';
+          example = [
+            "sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp"
+          ];
+        };
+        initialize = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Create the repository if it doesn't exist.
+          '';
+        };
+      };
+    }));
+    default = {};
+  };
+
+  config = {
+    systemd.services =
+      mapAttrs' (_: plan:
+        let
+          extraArguments = concatMapStringsSep " " (arg: "-o ${arg}") plan.extraArguments;
+          connectTo = elemAt (splitString ":" plan.repo) 1;
+          resticCmd = "${pkgs.restic}/bin/restic ${extraArguments}";
+        in nameValuePair "backup.${plan.name}" {
+          environment = {
+            RESTIC_PASSWORD_FILE = plan.passwordFile;
+            RESTIC_REPOSITORY = plan.repo;
+          };
+          path = with pkgs; [
+            openssh
+          ];
+          restartIfChanged = false;
+          serviceConfig = {
+            ExecStartPre = mkIf plan.initialize (pkgs.writeScript "rustic-${plan.name}-init" ''
+              #! ${pkgs.bash}/bin/bash
+              ${resticCmd} snapshots || ${resticCmd} init
+            '');
+            ExecStart = pkgs.writeDash "rustic-${plan.name}" (
+              "#! ${pkgs.bash}/bin/bash\n" +
+              concatMapStringsSep "\n" (dir: "${resticCmd} backup ${dir}") plan.dirs
+            );
+            User = plan.user;
+          };
+        }
+      ) config.lass.restic;
+    systemd.timers =
+      mapAttrs' (_: plan: nameValuePair "backup.${plan.name}" {
+        wantedBy = [ "timers.target" ];
+        timerConfig = plan.timerConfig;
+      }) config.lass.restic;
+  };
+}
-- 
cgit v1.3.1


From ddb06a55426abe797b4ebad3165c4637c0b6975d Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Fri, 20 Apr 2018 23:27:53 +0200
Subject: l mors.r: add btc price getter

---
 lass/1systems/mors/config.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

(limited to 'lass')

diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix
index cd259d0fe..dab1910b4 100644
--- a/lass/1systems/mors/config.nix
+++ b/lass/1systems/mors/config.nix
@@ -141,6 +141,15 @@ with import <stockholm/lib>;
 
     dnsutils
     generate-secrets
+    (pkgs.writeDashBin "btc-coinbase" ''
+      ${pkgs.curl}/bin/curl -Ss 'https://api.coinbase.com/v2/prices/spot?currency=EUR' | ${pkgs.jq}/bin/jq '.data.amount'
+    '')
+    (pkgs.writeDashBin "btc-wex" ''
+      ${pkgs.curl}/bin/curl -Ss 'https://wex.nz/api/3/ticker/btc_eur' | ${pkgs.jq}/bin/jq '.btc_eur.avg'
+    '')
+    (pkgs.writeDashBin "btc-kraken" ''
+      ${pkgs.curl}/bin/curl -Ss  'https://api.kraken.com/0/public/Ticker?pair=BTCEUR' | ${pkgs.jq}/bin/jq '.result.XXBTZEUR.a[0]'
+    '')
   ];
 
   #TODO: fix this shit
-- 
cgit v1.3.1


From b0678507404bba2c12df39c1d21431ddd9102fcb Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Fri, 20 Apr 2018 23:28:39 +0200
Subject: l mors.r: add restic backups

---
 lass/1systems/mors/config.nix | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

(limited to 'lass')

diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix
index dab1910b4..c59494e4d 100644
--- a/lass/1systems/mors/config.nix
+++ b/lass/1systems/mors/config.nix
@@ -186,4 +186,34 @@ with import <stockholm/lib>;
   programs.adb.enable = true;
   users.users.mainUser.extraGroups = [ "adbusers" "docker" ];
   virtualisation.docker.enable = true;
+
+  lass.restic = genAttrs [
+    "daedalus"
+    "icarus"
+    "littleT"
+    "prism"
+    "shodan"
+    "skynet"
+  ] (dest: {
+    dirs = [
+      "/home/lass/src"
+      "/home/lass/work"
+      "/home/lass/.gnupg"
+      "/home/lass/Maildir"
+      "/home/lass/stockholm"
+      "/home/lass/.password-store"
+      "/home/bitcoin"
+      "/home/bch"
+    ];
+    passwordFile = (toString <secrets>) + "/restic/${dest}";
+    repo = "sftp:backup@${dest}.r:/backups/mors";
+    #sshPrivateKey = config.krebs.build.host.ssh.privkey.path;
+    extraArguments = [
+      "sftp.command='ssh backup@${dest}.r -i ${config.krebs.build.host.ssh.privkey.path} -s sftp'"
+    ];
+    timerConfig = {
+      OnCalendar = "00:05";
+      RandomizedDelaySec = "5h";
+    };
+  });
 }
-- 
cgit v1.3.1


From e77030e772899bcc747568752cdb2a997a6972bf Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Fri, 20 Apr 2018 23:30:19 +0200
Subject: l prism.r: use iptables for hackerfleet

---
 lass/1systems/prism/config.nix | 30 +++++++-----------------------
 1 file changed, 7 insertions(+), 23 deletions(-)

(limited to 'lass')

diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index c0e4620cc..e937db83a 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -110,29 +110,13 @@ in {
       };
 
       # TODO write function for proxy_pass (ssl/nonssl)
-      services.nginx.virtualHosts."hackerfleet.de" = {
-        serverAliases = [
-          "*.hackerfleet.de"
-        ];
-        locations."/".extraConfig = ''
-          proxy_pass http://192.168.122.92:80;
-        '';
-      };
-      services.nginx.virtualHosts."hackerfleet.de-s" = {
-        serverName = "hackerfleet.de";
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 443;
-          }
-        ];
-        serverAliases = [
-          "*.hackerfleet.de"
-        ];
-        locations."/".extraConfig = ''
-          proxy_pass http://192.168.122.92:443;
-        '';
-      };
+
+      krebs.iptables.tables.filter.FORWARD.rules = [
+        { v6 = false; precedence = 1000; predicate = "-d 192.168.122.92"; target = "ACCEPT"; }
+      ];
+      krebs.iptables.tables.nat.PREROUTING.rules = [
+        { v6 = false; precedence = 1000; predicate = "-d 46.4.114.243"; target = "DNAT --to-destination 192.168.122.92"; }
+      ];
     }
     {
       users.users.tv = {
-- 
cgit v1.3.1


From c85c0f1b39aed212bb128c674f194f124a9454ce Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Fri, 20 Apr 2018 23:31:08 +0200
Subject: l prism.r: fix deprecation warnings

---
 lass/1systems/prism/config.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'lass')

diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index e937db83a..983604f8e 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -8,11 +8,15 @@ in {
   imports = [
     <stockholm/lass>
     {
-      networking.interfaces.et0.ip4 = [
+      networking.interfaces.et0.ipv4.addresses = [
         {
           address = ip;
           prefixLength = 27;
         }
+        {
+          address = "46.4.114.243";
+          prefixLength = 27;
+        }
       ];
       networking.defaultGateway = "46.4.114.225";
       networking.nameservers = [
-- 
cgit v1.3.1


From 1d37fba51e4f4fbb7fe7acccc11e2b2ac5dcc5b7 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Fri, 20 Apr 2018 23:33:09 +0200
Subject: l reaktor-coders: /j #panthermoderns

---
 lass/2configs/reaktor-coders.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lass')

diff --git a/lass/2configs/reaktor-coders.nix b/lass/2configs/reaktor-coders.nix
index 5fa1611ae..922cd79cb 100644
--- a/lass/2configs/reaktor-coders.nix
+++ b/lass/2configs/reaktor-coders.nix
@@ -4,7 +4,7 @@ with import <stockholm/lib>;
 {
   krebs.Reaktor.coders = {
     nickname = "Reaktor|lass";
-    channels = [ "#coders" "#germany" ];
+    channels = [ "#coders" "#germany" "#panthermoderns" ];
     extraEnviron = {
       REAKTOR_HOST = "irc.hackint.org";
     };
-- 
cgit v1.3.1


From 824c19e81a5696018973be2d692fcd9f07f8ef10 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Fri, 20 Apr 2018 23:33:26 +0200
Subject: l reaktor-coders: add google & blockchain command

---
 lass/2configs/reaktor-coders.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

(limited to 'lass')

diff --git a/lass/2configs/reaktor-coders.nix b/lass/2configs/reaktor-coders.nix
index 922cd79cb..5a39f7115 100644
--- a/lass/2configs/reaktor-coders.nix
+++ b/lass/2configs/reaktor-coders.nix
@@ -87,6 +87,19 @@ with import <stockholm/lib>;
           exec /run/wrappers/bin/ping -q -c1 "$1" 2>&1 | tail -1
         '';
       })
+      (buildSimpleReaktorPlugin "google" {
+        pattern = "^!g (?P<args>.*)$$";
+        script = pkgs.writeDash "google" ''
+          exec ${pkgs.ddgr}/bin/ddgr -C -n1 --json "$@" | \
+            ${pkgs.jq}/bin/jq '@text "\(.[0].abstract) \(.[0].url)"'
+        '';
+      })
+      (buildSimpleReaktorPlugin "blockchain" {
+        pattern = ".*[Bb]lockchain.*$$";
+        script = pkgs.writeDash "blockchain" ''
+          exec echo 'DID SOMEBODY SAY BLOCKCHAIN? https://paste.krebsco.de/r99pMoQq/+inline'
+        '';
+      })
     ];
   };
 }
-- 
cgit v1.3.1


From 0521f960c8c93da7082722632309b533260781d5 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Fri, 20 Apr 2018 23:34:14 +0200
Subject: l syncthing: remove deprecated inotify

---
 lass/2configs/syncthing.nix | 1 -
 1 file changed, 1 deletion(-)

(limited to 'lass')

diff --git a/lass/2configs/syncthing.nix b/lass/2configs/syncthing.nix
index cef43d1e6..17debf822 100644
--- a/lass/2configs/syncthing.nix
+++ b/lass/2configs/syncthing.nix
@@ -3,7 +3,6 @@ with import <stockholm/lib>;
 {
   services.syncthing = {
     enable = true;
-    useInotify = true;
   };
   krebs.iptables.tables.filter.INPUT.rules = [
     { predicate = "-p tcp --dport 22000"; target = "ACCEPT";}
-- 
cgit v1.3.1


From 0164e142e3ce793cb98b237ba2384b3d88a3550c Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Fri, 20 Apr 2018 23:35:13 +0200
Subject: l websites: enableSSL -> onlySSL

---
 lass/2configs/websites/util.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'lass')

diff --git a/lass/2configs/websites/util.nix b/lass/2configs/websites/util.nix
index 62055d0fd..441b7af90 100644
--- a/lass/2configs/websites/util.nix
+++ b/lass/2configs/websites/util.nix
@@ -16,7 +16,7 @@ rec {
     in {
       services.nginx.virtualHosts.${domain} = {
         enableACME = true;
-        enableSSL = true;
+        onlySSL = true;
         extraConfig = ''
           listen 80;
           listen [::]:80;
@@ -34,7 +34,7 @@ rec {
     in {
       services.nginx.virtualHosts."${domain}" = {
         enableACME = true;
-        enableSSL = true;
+        onlySSL = true;
         serverAliases = domains;
         extraConfig = ''
           listen 80;
@@ -148,7 +148,7 @@ rec {
     in {
       services.nginx.virtualHosts."${domain}" = {
         enableACME = true;
-        enableSSL = true;
+        onlySSL = true;
         serverAliases = domains;
         extraConfig = ''
           listen 80;
-- 
cgit v1.3.1


From 2647f93715f73495d2b5cc1537a4ff47de085e1a Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Sat, 21 Apr 2018 12:42:30 +0200
Subject: l: generate-secrets -> l-gen-secrets

---
 lass/5pkgs/generate-secrets/default.nix | 46 ---------------------------------
 lass/5pkgs/l-gen-secrets/default.nix    | 46 +++++++++++++++++++++++++++++++++
 2 files changed, 46 insertions(+), 46 deletions(-)
 delete mode 100644 lass/5pkgs/generate-secrets/default.nix
 create mode 100644 lass/5pkgs/l-gen-secrets/default.nix

(limited to 'lass')

diff --git a/lass/5pkgs/generate-secrets/default.nix b/lass/5pkgs/generate-secrets/default.nix
deleted file mode 100644
index 5a4afe7c5..000000000
--- a/lass/5pkgs/generate-secrets/default.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{ pkgs }:
-pkgs.writeDashBin "generate-secrets" ''
-  HOSTNAME="$1"
-  TMPDIR=$(${pkgs.coreutils}/bin/mktemp -d)
-  PASSWORD=$(${pkgs.pwgen}/bin/pwgen 25 1)
-  HASHED_PASSWORD=$(echo $PASSWORD | ${pkgs.hashPassword}/bin/hashPassword -s) > /dev/null
-
-  ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f $TMPDIR/ssh.id_ed25519 -P "" -C "" >/dev/null
-  ${pkgs.openssl}/bin/openssl genrsa -out $TMPDIR/retiolum.rsa_key.priv 4096 2>/dev/null > /dev/null
-  ${pkgs.openssl}/bin/openssl rsa -in $TMPDIR/retiolum.rsa_key.priv -pubout -out $TMPDIR/retiolum.rsa_key.pub 2>/dev/null > /dev/null
-  cat <<EOF > $TMPDIR/hashedPasswords.nix
-  {
-    root = "$HASHED_PASSWORD";
-    mainUser = "$HASHED_PASSWORD";
-  }
-  EOF
-
-  cd $TMPDIR
-  for x in *; do
-    ${pkgs.coreutils}/bin/cat $x | ${pkgs.pass}/bin/pass insert -m hosts/$HOSTNAME/$x > /dev/null
-  done
-  echo $PASSWORD | ${pkgs.pass}/bin/pass insert -m admin/hosts/$HOSTNAME/pass > /dev/null
-
-  cat <<EOF
-    $HOSTNAME = {
-      cores = 1;
-      nets = {
-        retiolum = {
-          ip4.addr = "10.243.0.changeme";
-          ip6.addr = "42:0:0:0:0:0:0:changeme";
-          aliases = [
-            "$HOSTNAME.r"
-          ];
-          tinc.pubkey = ${"''"}
-  $(cat $TMPDIR/retiolum.rsa_key.pub)
-          ${"''"};
-        };
-      };
-      ssh.privkey.path = <secrets/ssh.id_ed25519>;
-      ssh.pubkey = "$(cat $TMPDIR/ssh.id_ed25519.pub)";
-    };
-  EOF
-
-  rm -rf $TMPDIR
-''
-
diff --git a/lass/5pkgs/l-gen-secrets/default.nix b/lass/5pkgs/l-gen-secrets/default.nix
new file mode 100644
index 000000000..4b25fbd4c
--- /dev/null
+++ b/lass/5pkgs/l-gen-secrets/default.nix
@@ -0,0 +1,46 @@
+{ pkgs }:
+pkgs.writeDashBin "l-gen-secrets" ''
+  HOSTNAME="$1"
+  TMPDIR=$(${pkgs.coreutils}/bin/mktemp -d)
+  PASSWORD=$(${pkgs.pwgen}/bin/pwgen 25 1)
+  HASHED_PASSWORD=$(echo $PASSWORD | ${pkgs.hashPassword}/bin/hashPassword -s) > /dev/null
+
+  ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f $TMPDIR/ssh.id_ed25519 -P "" -C "" >/dev/null
+  ${pkgs.openssl}/bin/openssl genrsa -out $TMPDIR/retiolum.rsa_key.priv 4096 2>/dev/null > /dev/null
+  ${pkgs.openssl}/bin/openssl rsa -in $TMPDIR/retiolum.rsa_key.priv -pubout -out $TMPDIR/retiolum.rsa_key.pub 2>/dev/null > /dev/null
+  cat <<EOF > $TMPDIR/hashedPasswords.nix
+  {
+    root = "$HASHED_PASSWORD";
+    mainUser = "$HASHED_PASSWORD";
+  }
+  EOF
+
+  cd $TMPDIR
+  for x in *; do
+    ${pkgs.coreutils}/bin/cat $x | ${pkgs.pass}/bin/pass insert -m krebs-secrets/$HOSTNAME/$x > /dev/null
+  done
+  echo $PASSWORD | ${pkgs.pass}/bin/pass insert -m hosts/$HOSTNAME/pass > /dev/null
+
+  cat <<EOF
+    $HOSTNAME = {
+      cores = 1;
+      nets = {
+        retiolum = {
+          ip4.addr = "10.243.0.changeme";
+          ip6.addr = "42:0:0:0:0:0:0:changeme";
+          aliases = [
+            "$HOSTNAME.r"
+          ];
+          tinc.pubkey = ${"''"}
+  $(cat $TMPDIR/retiolum.rsa_key.pub)
+          ${"''"};
+        };
+      };
+      ssh.privkey.path = <secrets/ssh.id_ed25519>;
+      ssh.pubkey = "$(cat $TMPDIR/ssh.id_ed25519.pub)";
+    };
+  EOF
+
+  rm -rf $TMPDIR
+''
+
-- 
cgit v1.3.1


From c99e8256b223761eb50cf5d6841ab64f989851c3 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Sat, 21 Apr 2018 17:52:45 +0200
Subject: l monitoring: add example prometheus config

---
 lass/2configs/monitoring/node-exporter.nix     |  13 ++
 lass/2configs/monitoring/prometheus-server.nix | 179 +++++++++++++++++++++++++
 2 files changed, 192 insertions(+)
 create mode 100644 lass/2configs/monitoring/node-exporter.nix
 create mode 100644 lass/2configs/monitoring/prometheus-server.nix

(limited to 'lass')

diff --git a/lass/2configs/monitoring/node-exporter.nix b/lass/2configs/monitoring/node-exporter.nix
new file mode 100644
index 000000000..8c27e90d4
--- /dev/null
+++ b/lass/2configs/monitoring/node-exporter.nix
@@ -0,0 +1,13 @@
+{ config, lib, pkgs, ... }:
+{
+  networking.firewall.allowedTCPPorts = [ 9100 ];
+
+  services.prometheus.exporters = {
+    node = {
+      enable = true;
+      enabledCollectors = [
+        "systemd"
+      ];
+    };
+  };
+}
diff --git a/lass/2configs/monitoring/prometheus-server.nix b/lass/2configs/monitoring/prometheus-server.nix
new file mode 100644
index 000000000..d56d7e552
--- /dev/null
+++ b/lass/2configs/monitoring/prometheus-server.nix
@@ -0,0 +1,179 @@
+{ pkgs, lib, config, ... }:
+{
+  #networking = {
+  #  firewall.allowedTCPPorts = [
+  #    3000  # grafana
+  #    9090  # prometheus
+  #    9093  # alertmanager
+  #  ];
+  #  useDHCP = true;
+  #};
+
+  services = {
+    prometheus = {
+      enable = true;
+      extraFlags = [
+        "-storage.local.retention 8760h"
+        "-storage.local.series-file-shrink-ratio 0.3"
+        "-storage.local.memory-chunks 2097152"
+        "-storage.local.max-chunks-to-persist 1048576"
+        "-storage.local.index-cache-size.fingerprint-to-metric 2097152"
+        "-storage.local.index-cache-size.fingerprint-to-timerange 1048576"
+        "-storage.local.index-cache-size.label-name-to-label-values 2097152"
+        "-storage.local.index-cache-size.label-pair-to-fingerprints 41943040"
+      ];
+      alertmanagerURL = [ "http://localhost:9093" ];
+      rules = [
+        ''
+          ALERT node_down
+          IF up == 0
+          FOR 5m
+          LABELS {
+            severity="page"
+          }
+          ANNOTATIONS {
+            summary = "{{$labels.alias}}: Node is down.",
+            description = "{{$labels.alias}} has been down for more than 5 minutes."
+          }
+          ALERT node_systemd_service_failed
+          IF node_systemd_unit_state{state="failed"} == 1
+          FOR 4m
+          LABELS {
+            severity="page"
+          }
+          ANNOTATIONS {
+            summary = "{{$labels.alias}}: Service {{$labels.name}} failed to start.",
+            description = "{{$labels.alias}} failed to (re)start service {{$labels.name}}."
+          }
+          ALERT node_filesystem_full_90percent
+          IF sort(node_filesystem_free{device!="ramfs"} < node_filesystem_size{device!="ramfs"} * 0.1) / 1024^3
+          FOR 5m
+          LABELS {
+            severity="page"
+          }
+          ANNOTATIONS {
+            summary = "{{$labels.alias}}: Filesystem is running out of space soon.",
+            description = "{{$labels.alias}} device {{$labels.device}} on {{$labels.mountpoint}} got less than 10% space left on its filesystem."
+          }
+          ALERT node_filesystem_full_in_4h
+          IF predict_linear(node_filesystem_free{device!="ramfs"}[1h], 4*3600) <= 0
+          FOR 5m
+          LABELS {
+            severity="page"
+          }
+          ANNOTATIONS {
+            summary = "{{$labels.alias}}: Filesystem is running out of space in 4 hours.",
+            description = "{{$labels.alias}} device {{$labels.device}} on {{$labels.mountpoint}} is running out of space of in approx. 4 hours"
+          }
+          ALERT node_filedescriptors_full_in_3h
+          IF predict_linear(node_filefd_allocated[1h], 3*3600) >= node_filefd_maximum
+          FOR 20m
+          LABELS {
+            severity="page"
+          }
+          ANNOTATIONS {
+            summary = "{{$labels.alias}} is running out of available file descriptors in 3 hours.",
+            description = "{{$labels.alias}} is running out of available file descriptors in approx. 3 hours"
+          }
+          ALERT node_load1_90percent
+          IF node_load1 / on(alias) count(node_cpu{mode="system"}) by (alias) >= 0.9
+          FOR 1h
+          LABELS {
+            severity="page"
+          }
+          ANNOTATIONS {
+            summary = "{{$labels.alias}}: Running on high load.",
+            description = "{{$labels.alias}} is running with > 90% total load for at least 1h."
+          }
+          ALERT node_cpu_util_90percent
+          IF 100 - (avg by (alias) (irate(node_cpu{mode="idle"}[5m])) * 100) >= 90
+          FOR 1h
+          LABELS {
+            severity="page"
+          }
+          ANNOTATIONS {
+            summary = "{{$labels.alias}}: High CPU utilization.",
+            description = "{{$labels.alias}} has total CPU utilization over 90% for at least 1h."
+          }
+          ALERT node_ram_using_90percent
+          IF node_memory_MemFree + node_memory_Buffers + node_memory_Cached < node_memory_MemTotal * 0.1
+          FOR 30m
+          LABELS {
+            severity="page"
+          }
+          ANNOTATIONS {
+            summary="{{$labels.alias}}: Using lots of RAM.",
+            description="{{$labels.alias}} is using at least 90% of its RAM for at least 30 minutes now.",
+          }
+          ALERT node_swap_using_80percent
+          IF node_memory_SwapTotal - (node_memory_SwapFree + node_memory_SwapCached) > node_memory_SwapTotal * 0.8
+          FOR 10m
+          LABELS {
+            severity="page"
+          }
+          ANNOTATIONS {
+            summary="{{$labels.alias}}: Running out of swap soon.",
+            description="{{$labels.alias}} is using 80% of its swap space for at least 10 minutes now."
+          }
+        ''
+      ];
+      scrapeConfigs = [
+        {
+          job_name = "node";
+          scrape_interval = "10s";
+          static_configs = [
+            {
+              targets = [
+                "localhost:9100"
+              ];
+              labels = {
+                alias = "prometheus.example.com";
+              };
+            }
+          ];
+        }
+      ];
+      alertmanager = {
+        enable = true;
+        listenAddress = "0.0.0.0";
+        configuration = {
+          "global" = {
+            "smtp_smarthost" = "smtp.example.com:587";
+            "smtp_from" = "alertmanager@example.com";
+          };
+          "route" = {
+            "group_by" = [ "alertname" "alias" ];
+            "group_wait" = "30s";
+            "group_interval" = "2m";
+            "repeat_interval" = "4h";
+            "receiver" = "team-admins";
+          };
+          "receivers" = [
+            {
+              "name" = "team-admins";
+              "email_configs" = [
+                {
+                  "to" = "devnull@example.com";
+                  "send_resolved" = true;
+                }
+              ];
+              "webhook_configs" = [
+                {
+                  "url" = "https://example.com/prometheus-alerts";
+                  "send_resolved" = true;
+                }
+              ];
+            }
+          ];
+        };
+      };
+    };
+    grafana = {
+      enable = true;
+      addr = "0.0.0.0";
+      domain = "grafana.example.com";
+      rootUrl = "https://grafana.example.com/";
+      security = import <secrets/grafana_security.nix>; # { AdminUser = ""; adminPassword = ""}
+    };
+  };
+}
-- 
cgit v1.3.1


From 817efa5f9d26effaa4c7a8efd6710fec4eb33300 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Fri, 27 Apr 2018 15:14:35 +0200
Subject: l prism.r: kill kaepsele container

---
 lass/1systems/prism/config.nix | 20 --------------------
 1 file changed, 20 deletions(-)

(limited to 'lass')

diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index 983604f8e..68f1826b4 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -189,26 +189,6 @@ in {
         localAddress = "10.233.2.2";
       };
     }
-    {
-      #kaepsele
-      systemd.services."container@kaepsele".reloadIfChanged = mkForce false;
-      containers.kaepsele = {
-        config = { ... }: {
-          imports = [ <stockholm/lass/2configs/rebuild-on-boot.nix> ];
-          environment.systemPackages = [ pkgs.git ];
-          services.openssh.enable = true;
-          users.users.root.openssh.authorizedKeys.keys = with config.krebs.users; [
-            lass.pubkey
-            tv.pubkey
-          ];
-        };
-        autoStart = true;
-        enableTun = true;
-        privateNetwork = true;
-        hostAddress = "10.233.2.3";
-        localAddress = "10.233.2.4";
-      };
-    }
     {
       #onondaga
       systemd.services."container@onondaga".reloadIfChanged = mkForce false;
-- 
cgit v1.3.1


From eca81992947815db2700a831aa1ec38a0e70216b Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Fri, 27 Apr 2018 16:52:48 +0200
Subject: l: kill legacy backups

---
 lass/1systems/cabal/config.nix    |   1 -
 lass/1systems/daedalus/config.nix |   1 -
 lass/1systems/icarus/config.nix   |   1 -
 lass/1systems/littleT/config.nix  |   1 -
 lass/1systems/shodan/config.nix   |   1 -
 lass/1systems/skynet/config.nix   |   1 -
 lass/2configs/backups.nix         | 173 --------------------------------------
 lass/2configs/default.nix         |   1 -
 8 files changed, 180 deletions(-)
 delete mode 100644 lass/2configs/backups.nix

(limited to 'lass')

diff --git a/lass/1systems/cabal/config.nix b/lass/1systems/cabal/config.nix
index 7eba86c52..88f642d6b 100644
--- a/lass/1systems/cabal/config.nix
+++ b/lass/1systems/cabal/config.nix
@@ -13,7 +13,6 @@
     <stockholm/lass/2configs/browsers.nix>
     <stockholm/lass/2configs/programs.nix>
     <stockholm/lass/2configs/fetchWallpaper.nix>
-    <stockholm/lass/2configs/backups.nix>
     <stockholm/lass/2configs/games.nix>
     <stockholm/lass/2configs/bitcoin.nix>
   ];
diff --git a/lass/1systems/daedalus/config.nix b/lass/1systems/daedalus/config.nix
index 609fae3c8..0c7b7b6da 100644
--- a/lass/1systems/daedalus/config.nix
+++ b/lass/1systems/daedalus/config.nix
@@ -8,7 +8,6 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/boot/coreboot.nix>
 
     <stockholm/lass/2configs/retiolum.nix>
-    <stockholm/lass/2configs/backups.nix>
     <stockholm/lass/2configs/games.nix>
     <stockholm/lass/2configs/steam.nix>
     {
diff --git a/lass/1systems/icarus/config.nix b/lass/1systems/icarus/config.nix
index 46dc5e873..c55d694c2 100644
--- a/lass/1systems/icarus/config.nix
+++ b/lass/1systems/icarus/config.nix
@@ -14,7 +14,6 @@
     <stockholm/lass/2configs/browsers.nix>
     <stockholm/lass/2configs/programs.nix>
     <stockholm/lass/2configs/fetchWallpaper.nix>
-    <stockholm/lass/2configs/backups.nix>
     <stockholm/lass/2configs/games.nix>
     <stockholm/lass/2configs/bitcoin.nix>
   ];
diff --git a/lass/1systems/littleT/config.nix b/lass/1systems/littleT/config.nix
index 7211c78eb..69c87e5a8 100644
--- a/lass/1systems/littleT/config.nix
+++ b/lass/1systems/littleT/config.nix
@@ -8,7 +8,6 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/boot/stock-x220.nix>
 
     <stockholm/lass/2configs/retiolum.nix>
-    <stockholm/lass/2configs/backups.nix>
     <stockholm/lass/2configs/steam.nix>
     {
       users.users.blacky = {
diff --git a/lass/1systems/shodan/config.nix b/lass/1systems/shodan/config.nix
index 7fb57544f..5877d1470 100644
--- a/lass/1systems/shodan/config.nix
+++ b/lass/1systems/shodan/config.nix
@@ -15,7 +15,6 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/browsers.nix>
     <stockholm/lass/2configs/programs.nix>
     <stockholm/lass/2configs/fetchWallpaper.nix>
-    <stockholm/lass/2configs/backups.nix>
     <stockholm/lass/2configs/wine.nix>
     <stockholm/lass/2configs/bitcoin.nix>
   ];
diff --git a/lass/1systems/skynet/config.nix b/lass/1systems/skynet/config.nix
index 0b9499982..b2210282f 100644
--- a/lass/1systems/skynet/config.nix
+++ b/lass/1systems/skynet/config.nix
@@ -9,7 +9,6 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/retiolum.nix>
     #<stockholm/lass/2configs/exim-retiolum.nix>
     <stockholm/lass/2configs/fetchWallpaper.nix>
-    <stockholm/lass/2configs/backups.nix>
     {
       # discordius config
       services.xserver.enable = true;
diff --git a/lass/2configs/backups.nix b/lass/2configs/backups.nix
deleted file mode 100644
index c4fb85420..000000000
--- a/lass/2configs/backups.nix
+++ /dev/null
@@ -1,173 +0,0 @@
-{ config, lib, ... }:
-with import <stockholm/lib>;
-{
-
-  # TODO add timerConfig to krebs.backup and randomize startup
-  # TODO define plans more abstract
-  krebs.backup.plans = {
-  } // mapAttrs (_: recursiveUpdate {
-    snapshots = {
-      daily    = { format = "%Y-%m-%d"; retain =  7; };
-      weekly   = { format = "%YW%W";    retain =  4; };
-      monthly  = { format = "%Y-%m";    retain = 12; };
-      yearly   = { format = "%Y";                    };
-    };
-  }) {
-    dishfire-http-prism = {
-      method = "pull";
-      src = { host = config.krebs.hosts.dishfire; path = "/srv/http"; };
-      dst = { host = config.krebs.hosts.prism;    path = "/bku/dishfire-http"; };
-      startAt = "03:00";
-    };
-    dishfire-http-icarus = {
-      method = "pull";
-      src = { host = config.krebs.hosts.dishfire; path = "/srv/http"; };
-      dst = { host = config.krebs.hosts.icarus;   path = "/bku/dishfire-http"; };
-      startAt = "03:10";
-    };
-    dishfire-http-mors = {
-      method = "pull";
-      src = { host = config.krebs.hosts.dishfire; path = "/srv/http"; };
-      dst = { host = config.krebs.hosts.mors;     path = "/bku/dishfire-http"; };
-      startAt = "03:05";
-    };
-    dishfire-http-shodan = {
-      method = "pull";
-      src = { host = config.krebs.hosts.dishfire; path = "/srv/http"; };
-      dst = { host = config.krebs.hosts.shodan;   path = "/bku/dishfire-http"; };
-      startAt = "03:10";
-    };
-    dishfire-sql-prism = {
-      method = "pull";
-      src = { host = config.krebs.hosts.dishfire; path = "/bku/sql_dumps"; };
-      dst = { host = config.krebs.hosts.prism;    path = "/bku/dishfire-sql"; };
-      startAt = "03:15";
-    };
-    dishfire-sql-icarus = {
-      method = "pull";
-      src = { host = config.krebs.hosts.dishfire; path = "/bku/sql_dumps"; };
-      dst = { host = config.krebs.hosts.icarus;   path = "/bku/dishfire-sql"; };
-      startAt = "03:25";
-    };
-    dishfire-sql-mors = {
-      method = "pull";
-      src = { host = config.krebs.hosts.dishfire; path = "/bku/sql_dumps"; };
-      dst = { host = config.krebs.hosts.mors;     path = "/bku/dishfire-sql"; };
-      startAt = "03:20";
-    };
-    dishfire-sql-shodan = {
-      method = "pull";
-      src = { host = config.krebs.hosts.dishfire; path = "/bku/sql_dumps"; };
-      dst = { host = config.krebs.hosts.shodan;   path = "/bku/dishfire-sql"; };
-      startAt = "03:25";
-    };
-    prism-bitlbee-icarus = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism;  path = "/var/lib/bitlbee"; };
-      dst = { host = config.krebs.hosts.icarus; path = "/bku/prism-bitlbee"; };
-      startAt = "03:25";
-    };
-    prism-bitlbee-mors = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism; path = "/var/lib/bitlbee"; };
-      dst = { host = config.krebs.hosts.mors;  path = "/bku/prism-bitlbee"; };
-      startAt = "03:25";
-    };
-    prism-bitlbee-shodan = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism;  path = "/var/lib/bitlbee"; };
-      dst = { host = config.krebs.hosts.shodan; path = "/bku/prism-bitlbee"; };
-      startAt = "03:25";
-    };
-    prism-chat-icarus = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism;  path = "/home/chat"; };
-      dst = { host = config.krebs.hosts.icarus; path = "/bku/prism-chat"; };
-      startAt = "03:35";
-    };
-    prism-chat-mors = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism; path = "/home/chat"; };
-      dst = { host = config.krebs.hosts.mors;  path = "/bku/prism-chat"; };
-      startAt = "03:30";
-    };
-    prism-chat-shodan = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism;  path = "/home/chat"; };
-      dst = { host = config.krebs.hosts.shodan; path = "/bku/prism-chat"; };
-      startAt = "03:35";
-    };
-    prism-sql-icarus = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism;  path = "/bku/sql_dumps"; };
-      dst = { host = config.krebs.hosts.icarus; path = "/bku/prism-sql_dumps"; };
-      startAt = "03:45";
-    };
-    prism-sql-mors = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism; path = "/bku/sql_dumps"; };
-      dst = { host = config.krebs.hosts.mors;  path = "/bku/prism-sql_dumps"; };
-      startAt = "03:40";
-    };
-    prism-sql-shodan = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism;  path = "/bku/sql_dumps"; };
-      dst = { host = config.krebs.hosts.shodan; path = "/bku/prism-sql_dumps"; };
-      startAt = "03:45";
-    };
-    prism-http-icarus = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism;  path = "/srv/http"; };
-      dst = { host = config.krebs.hosts.icarus; path = "/bku/prism-http"; };
-      startAt = "03:55";
-    };
-    prism-http-mors = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism; path = "/srv/http"; };
-      dst = { host = config.krebs.hosts.mors;  path = "/bku/prism-http"; };
-      startAt = "03:50";
-    };
-    prism-http-shodan = {
-      method = "pull";
-      src = { host = config.krebs.hosts.prism;  path = "/srv/http"; };
-      dst = { host = config.krebs.hosts.shodan; path = "/bku/prism-http"; };
-      startAt = "03:55";
-    };
-    icarus-home-mors = {
-      method = "pull";
-      src = { host = config.krebs.hosts.icarus; path = "/home"; };
-      dst = { host = config.krebs.hosts.mors;   path = "/bku/icarus-home"; };
-      startAt = "05:00";
-    };
-    icarus-home-shodan = {
-      method = "push";
-      src = { host = config.krebs.hosts.icarus; path = "/home"; };
-      dst = { host = config.krebs.hosts.shodan; path = "/bku/icarus-home"; };
-      startAt = "05:00";
-    };
-    mors-home-icarus = {
-      method = "push";
-      src = { host = config.krebs.hosts.mors;   path = "/home"; };
-      dst = { host = config.krebs.hosts.icarus; path = "/bku/mors-home"; };
-      startAt = "05:00";
-    };
-    mors-home-shodan = {
-      method = "push";
-      src = { host = config.krebs.hosts.mors;   path = "/home"; };
-      dst = { host = config.krebs.hosts.shodan; path = "/bku/mors-home"; };
-      startAt = "05:00";
-    };
-    shodan-home-icarus = {
-      method = "pull";
-      src = { host = config.krebs.hosts.shodan; path = "/home"; };
-      dst = { host = config.krebs.hosts.icarus; path = "/bku/shodan-home"; };
-      startAt = "04:00";
-    };
-    shodan-home-mors = {
-      method = "pull";
-      src = { host = config.krebs.hosts.shodan; path = "/home"; };
-      dst = { host = config.krebs.hosts.mors;   path = "/bku/shodan-home"; };
-      startAt = "04:00";
-    };
-  };
-}
diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix
index 5a5f1b347..d56f89c2f 100644
--- a/lass/2configs/default.nix
+++ b/lass/2configs/default.nix
@@ -9,7 +9,6 @@ with import <stockholm/lib>;
     ./monitoring/client.nix
     ./zsh.nix
     ./htop.nix
-    ./backups.nix
     ./security-workarounds.nix
     {
       users.extraUsers =
-- 
cgit v1.3.1


From 72abe80227ec5de5c2f7a55f6e2fe3da46c14538 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Fri, 27 Apr 2018 16:55:43 +0200
Subject: l: config for backup target

---
 lass/1systems/daedalus/config.nix |  1 +
 lass/1systems/helios/config.nix   |  1 +
 lass/1systems/icarus/config.nix   |  1 +
 lass/1systems/littleT/config.nix  |  1 +
 lass/1systems/mors/config.nix     |  1 +
 lass/1systems/shodan/config.nix   |  1 +
 lass/2configs/backup.nix          | 20 ++++++++++++++++++++
 7 files changed, 26 insertions(+)
 create mode 100644 lass/2configs/backup.nix

(limited to 'lass')

diff --git a/lass/1systems/daedalus/config.nix b/lass/1systems/daedalus/config.nix
index 0c7b7b6da..c15fcdc21 100644
--- a/lass/1systems/daedalus/config.nix
+++ b/lass/1systems/daedalus/config.nix
@@ -10,6 +10,7 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/retiolum.nix>
     <stockholm/lass/2configs/games.nix>
     <stockholm/lass/2configs/steam.nix>
+    <stockholm/lass/2configs/backup.nix>
     {
       # bubsy config
       users.users.bubsy = {
diff --git a/lass/1systems/helios/config.nix b/lass/1systems/helios/config.nix
index e64cfbe79..557fce1e8 100644
--- a/lass/1systems/helios/config.nix
+++ b/lass/1systems/helios/config.nix
@@ -17,6 +17,7 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/dcso-dev.nix>
     <stockholm/lass/2configs/steam.nix>
     <stockholm/lass/2configs/rtl-sdr.nix>
+    <stockholm/lass/2configs/backup.nix>
     { # automatic hardware detection
       boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
       boot.kernelModules = [ "kvm-intel" ];
diff --git a/lass/1systems/icarus/config.nix b/lass/1systems/icarus/config.nix
index c55d694c2..b6a0822b9 100644
--- a/lass/1systems/icarus/config.nix
+++ b/lass/1systems/icarus/config.nix
@@ -16,6 +16,7 @@
     <stockholm/lass/2configs/fetchWallpaper.nix>
     <stockholm/lass/2configs/games.nix>
     <stockholm/lass/2configs/bitcoin.nix>
+    <stockholm/lass/2configs/backup.nix>
   ];
 
   krebs.build.host = config.krebs.hosts.icarus;
diff --git a/lass/1systems/littleT/config.nix b/lass/1systems/littleT/config.nix
index 69c87e5a8..ef19e8d16 100644
--- a/lass/1systems/littleT/config.nix
+++ b/lass/1systems/littleT/config.nix
@@ -8,6 +8,7 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/boot/stock-x220.nix>
 
     <stockholm/lass/2configs/retiolum.nix>
+    <stockholm/lass/2configs/backup.nix>
     <stockholm/lass/2configs/steam.nix>
     {
       users.users.blacky = {
diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix
index c59494e4d..c21197f89 100644
--- a/lass/1systems/mors/config.nix
+++ b/lass/1systems/mors/config.nix
@@ -33,6 +33,7 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/ableton.nix>
     <stockholm/lass/2configs/dunst.nix>
     <stockholm/lass/2configs/rtl-sdr.nix>
+    <stockholm/lass/2configs/backup.nix>
     {
       #risk of rain port
       krebs.iptables.tables.filter.INPUT.rules = [
diff --git a/lass/1systems/shodan/config.nix b/lass/1systems/shodan/config.nix
index 5877d1470..42a46c5f5 100644
--- a/lass/1systems/shodan/config.nix
+++ b/lass/1systems/shodan/config.nix
@@ -17,6 +17,7 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/fetchWallpaper.nix>
     <stockholm/lass/2configs/wine.nix>
     <stockholm/lass/2configs/bitcoin.nix>
+    <stockholm/lass/2configs/backup.nix>
   ];
 
   krebs.build.host = config.krebs.hosts.shodan;
diff --git a/lass/2configs/backup.nix b/lass/2configs/backup.nix
new file mode 100644
index 000000000..27adf6d2a
--- /dev/null
+++ b/lass/2configs/backup.nix
@@ -0,0 +1,20 @@
+{ config, lib, ... }:
+with import <stockholm/lib>;
+
+{
+  fileSystems = {
+    "/backups" = {
+      device = "/dev/pool/backup";
+      fsType = "ext4";
+    };
+  };
+  users.users.backup = {
+    useDefaultShell = true;
+    home = "/backups";
+    createHome = true;
+    openssh.authorizedKeys.keys = with config.krebs.hosts; [
+      mors.ssh.pubkey
+      prism.ssh.pubkey
+    ];
+  };
+}
-- 
cgit v1.3.1


From f888226d37abeff6e5c4e61d393a886b16ff0178 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Fri, 27 Apr 2018 18:04:46 +0200
Subject: l: RIP echelon.r

---
 krebs/3modules/lass/default.nix  | 33 --------------------------
 lass/1systems/echelon/config.nix | 50 ----------------------------------------
 lass/1systems/echelon/source.nix |  3 ---
 3 files changed, 86 deletions(-)
 delete mode 100644 lass/1systems/echelon/config.nix
 delete mode 100644 lass/1systems/echelon/source.nix

(limited to 'lass')

diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index cf4229a82..1ad0cd6d4 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -44,39 +44,6 @@ with import <stockholm/lib>;
       ssh.privkey.path = <secrets/ssh.id_ed25519>;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGv0JMp0y+E5433GRSFKVK3cQmP0AAlS9aH9fk49yFxy";
     };
-    echelon = {
-      cores = 2;
-      nets = rec {
-        internet = {
-          ip4.addr = "64.137.242.41";
-          aliases = [
-            "echelon.i"
-          ];
-          ssh.port = 45621;
-        };
-        retiolum = {
-          via = internet;
-          ip4.addr = "10.243.206.103";
-          ip6.addr = "42:941e:2816:35f4:5c5e:206b:3f0b:f763";
-          aliases = [
-            "echelon.r"
-            "cgit.echelon.r"
-          ];
-          tinc.pubkey = ''
-            -----BEGIN RSA PUBLIC KEY-----
-            MIIBCgKCAQEAuscWOYdHu0bpWacvwTNd6bcmrAQ0YFxJWHZF8kPZr+bMKIhnXLkJ
-            oJheENIM6CA9lQQQFUxh2P2pxZavW5rgVlJxIKeiB+MB4v6ZO60LmZgpCsWGD/dX
-            MipM2tLtQxYhvLJIJxEBWn3rxIgeEnCtZsH1KLWyLczb+QpvTjMJ4TNh1nEBPE/f
-            4LUH1JHaGhcaHl2dLemR9wnnDIjmSj0ENJp2al+hWnIggcA/Zp0e4b86Oqbbs5wA
-            n++n5j971cTrBdA89nJDYOEtepisglScVRbgLqJG81lDA+n24RWFynn+U3oD/L8p
-            do+kxlwZUEDRbPU4AO5L+UeIbimsuIfXiQIDAQAB
-            -----END RSA PUBLIC KEY-----
-          '';
-        };
-      };
-      ssh.privkey.path = <secrets/ssh.id_ed25519>;
-      ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL21QDOEFdODFh6WAfNp6odrXo15pEsDQuGJfMu/cKzK";
-    };
     prism = rec {
       cores = 4;
       extraZones = {
diff --git a/lass/1systems/echelon/config.nix b/lass/1systems/echelon/config.nix
deleted file mode 100644
index 6f96883bf..000000000
--- a/lass/1systems/echelon/config.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  inherit (import <stockholm/lass/4lib> { inherit pkgs lib; }) getDefaultGateway;
-  ip = config.krebs.build.host.nets.internet.ip4.addr;
-in {
-  imports = [
-    <stockholm/lass>
-    <stockholm/lass/2configs/retiolum.nix>
-    <stockholm/lass/2configs/os-templates/CAC-CentOS-7-64bit.nix>
-    <stockholm/lass/2configs/exim-retiolum.nix>
-    <stockholm/lass/2configs/privoxy-retiolum.nix>
-    <stockholm/lass/2configs/git.nix>
-    {
-      networking.interfaces.enp2s1.ip4 = [
-        {
-          address = ip;
-          prefixLength = 24;
-        }
-      ];
-      networking.defaultGateway = getDefaultGateway ip;
-      networking.nameservers = [
-        "8.8.8.8"
-      ];
-
-    }
-    {
-      sound.enable = false;
-    }
-    {
-      users.extraUsers = {
-        satan = {
-          name = "satan";
-          uid = 1338;
-          home = "/home/satan";
-          group = "users";
-          createHome = true;
-          useDefaultShell = true;
-          extraGroups = [
-          ];
-          openssh.authorizedKeys.keys = [
-            "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+l3ajjOd80uJBM8oHO9HRbtA5hK6hvrpxxnk7qWW7OloT9IXcoM8bbON755vK0O6XyxZo1JZ1SZ7QIaOREGVIRDjcbJbqD3O+nImc6Rzxnrz7hvE+tuav9Yylwcw5HeQi82UIMGTEAwMHwLvsW6R/xyMCuOTbbzo9Ib8vlJ8IPDECY/05RhL7ZYFR0fdphI7jq7PobnO8WEpCZDhMvSYjO9jf3ac53wyghT3gH7AN0cxTR9qgQlPHhTbw+nZEI0sUKtrIhjfVE80wgK3NQXZZj7YAplRs/hYwSi7i8V0+8CBt2epc/5RKnJdDHFQnaTENq9kYQPOpUCP6YUwQIo8X nineinchnade@gmail.com"
-          ];
-        };
-      };
-    }
-  ];
-
-  krebs.build.host = config.krebs.hosts.echelon;
-}
diff --git a/lass/1systems/echelon/source.nix b/lass/1systems/echelon/source.nix
deleted file mode 100644
index 96888d5a8..000000000
--- a/lass/1systems/echelon/source.nix
+++ /dev/null
@@ -1,3 +0,0 @@
-import <stockholm/lass/source.nix> {
-  name = "echelon";
-}
-- 
cgit v1.3.1


From afb63ca8c747e0604d16d806640e42284061372a Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Fri, 27 Apr 2018 19:10:49 +0200
Subject: l mors.r: add redshift

---
 lass/1systems/mors/config.nix | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'lass')

diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix
index c21197f89..71d020775 100644
--- a/lass/1systems/mors/config.nix
+++ b/lass/1systems/mors/config.nix
@@ -187,6 +187,10 @@ with import <stockholm/lib>;
   programs.adb.enable = true;
   users.users.mainUser.extraGroups = [ "adbusers" "docker" ];
   virtualisation.docker.enable = true;
+  services.redshift = {
+    enable = true;
+    provider = "geoclue2";
+  };
 
   lass.restic = genAttrs [
     "daedalus"
-- 
cgit v1.3.1


From 76cd1c70b6643be6262e046f1daba5aaeee71efb Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Fri, 27 Apr 2018 19:16:12 +0200
Subject: l mors.r: add some pkgs

---
 lass/1systems/mors/config.nix | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'lass')

diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix
index 71d020775..f8a16ad2e 100644
--- a/lass/1systems/mors/config.nix
+++ b/lass/1systems/mors/config.nix
@@ -141,6 +141,8 @@ with import <stockholm/lib>;
     dpass
 
     dnsutils
+    woeusb
+    l-gen-secrets
     generate-secrets
     (pkgs.writeDashBin "btc-coinbase" ''
       ${pkgs.curl}/bin/curl -Ss 'https://api.coinbase.com/v2/prices/spot?currency=EUR' | ${pkgs.jq}/bin/jq '.data.amount'
-- 
cgit v1.3.1


From 2701bdd97f0f2ea8681b1d66670eb68ea0f11017 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Fri, 27 Apr 2018 19:34:36 +0200
Subject: l: use prometheus as monitoring

---
 lass/1systems/prism/config.nix | 3 +--
 lass/2configs/default.nix      | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

(limited to 'lass')

diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index 68f1826b4..f8178a200 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -217,13 +217,12 @@ in {
     <stockholm/lass/2configs/repo-sync.nix>
     <stockholm/lass/2configs/binary-cache/server.nix>
     <stockholm/lass/2configs/iodined.nix>
-    <stockholm/lass/2configs/monitoring/server.nix>
-    <stockholm/lass/2configs/monitoring/monit-alarms.nix>
     <stockholm/lass/2configs/paste.nix>
     <stockholm/lass/2configs/syncthing.nix>
     <stockholm/lass/2configs/reaktor-coders.nix>
     <stockholm/lass/2configs/ciko.nix>
     <stockholm/lass/2configs/container-networking.nix>
+    <stockholm/lass/2configs/monitoring/prometheus-server.nix>
     { # quasi bepasty.nix
       imports = [
         <stockholm/lass/2configs/bepasty.nix>
diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix
index d56f89c2f..12a814605 100644
--- a/lass/2configs/default.nix
+++ b/lass/2configs/default.nix
@@ -6,7 +6,7 @@ with import <stockholm/lib>;
     ./gc.nix
     ./mc.nix
     ./vim.nix
-    ./monitoring/client.nix
+    ./monitoring/node-exporter.nix
     ./zsh.nix
     ./htop.nix
     ./security-workarounds.nix
-- 
cgit v1.3.1


From ba1a8d0b5a0296e6f8673bd87983bfd482085e2c Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Fri, 27 Apr 2018 19:43:38 +0200
Subject: l: kill dns-stuff

---
 lass/2configs/baseX.nix     |  1 -
 lass/2configs/dns-stuff.nix | 16 ----------------
 2 files changed, 17 deletions(-)
 delete mode 100644 lass/2configs/dns-stuff.nix

(limited to 'lass')

diff --git a/lass/2configs/baseX.nix b/lass/2configs/baseX.nix
index ed179ded6..e2e44b6fc 100644
--- a/lass/2configs/baseX.nix
+++ b/lass/2configs/baseX.nix
@@ -9,7 +9,6 @@ in {
     ./power-action.nix
     ./copyq.nix
     ./livestream.nix
-    ./dns-stuff.nix
     ./urxvt.nix
     ./network-manager.nix
     {
diff --git a/lass/2configs/dns-stuff.nix b/lass/2configs/dns-stuff.nix
deleted file mode 100644
index cbcce8df9..000000000
--- a/lass/2configs/dns-stuff.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ config, pkgs, ... }:
-with import <stockholm/lib>;
-{
-  services.dnscrypt-proxy = {
-    enable = true;
-    localAddress = "127.1.0.1";
-    customResolver = {
-      address = config.krebs.hosts.gum.nets.internet.ip4.addr;
-      port = 15251;
-      name = "2.dnscrypt-cert.euer.krebsco.de";
-      key = "1AFC:E58D:F242:0FBB:9EE9:4E51:47F4:5373:D9AE:C2AB:DD96:8448:333D:5D79:272C:A44C";
-    };
-  };
-  services.resolved.enable = true;
-  services.resolved.fallbackDns = [ "127.1.0.1" ];
-}
-- 
cgit v1.3.1


From 8f81bc6deec5fbcc41d2bc463ceaaa3b203cc2bf Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Sat, 28 Apr 2018 08:37:44 +0200
Subject: l xerxes.r: remove deprecated nixpkgs override

---
 lass/1systems/xerxes/source.nix | 6 ------
 1 file changed, 6 deletions(-)

(limited to 'lass')

diff --git a/lass/1systems/xerxes/source.nix b/lass/1systems/xerxes/source.nix
index 11f5bf796..d256b885b 100644
--- a/lass/1systems/xerxes/source.nix
+++ b/lass/1systems/xerxes/source.nix
@@ -2,10 +2,4 @@ with import <stockholm/lib>;
 import <stockholm/lass/source.nix> {
   name = "xerxes";
   secure = true;
-  override = {
-    nixpkgs.git = mkForce {
-      url = https://github.com/lassulus/nixpkgs;
-      ref = "3eccd0b";
-    };
-  };
 }
-- 
cgit v1.3.1


From 102324c0d88a535f7518c97cb908da8d377a0bd8 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Sat, 28 Apr 2018 08:44:04 +0200
Subject: l bitcoin: remove ethereum

---
 lass/2configs/bitcoin.nix | 10 ----------
 1 file changed, 10 deletions(-)

(limited to 'lass')

diff --git a/lass/2configs/bitcoin.nix b/lass/2configs/bitcoin.nix
index a405addfc..9f6fd3bf0 100644
--- a/lass/2configs/bitcoin.nix
+++ b/lass/2configs/bitcoin.nix
@@ -10,9 +10,6 @@ in {
   krebs.per-user.bitcoin.packages = [
     pkgs.electrum
   ];
-  krebs.per-user.ethereum.packages = [
-    pkgs.go-ethereum
-  ];
   users.extraUsers = {
     bch = {
       name = "bch";
@@ -28,13 +25,6 @@ in {
       useDefaultShell = true;
       createHome = true;
     };
-    ethereum = {
-      name = "ethereum";
-      description = "user for ethereum stuff";
-      home = "/home/ethereum";
-      useDefaultShell = true;
-      createHome = true;
-    };
   };
   security.sudo.extraConfig = ''
     ${mainUser.name} ALL=(bitcoin) NOPASSWD: ALL
-- 
cgit v1.3.1


From 004b6a895ad7ee9f7bb8864f99f98c356d93a6f2 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Sat, 28 Apr 2018 09:10:40 +0200
Subject: l: add dev to docker group

---
 lass/2configs/dcso-dev.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'lass')

diff --git a/lass/2configs/dcso-dev.nix b/lass/2configs/dcso-dev.nix
index ae1c7bc8d..b985b67b3 100644
--- a/lass/2configs/dcso-dev.nix
+++ b/lass/2configs/dcso-dev.nix
@@ -9,6 +9,7 @@ in {
     dev = {
       name = "dev";
       uid = genid "dev";
+      extraGroups = [ "docker" ];
       description = "user for collaborative development";
       home = "/home/dev";
       useDefaultShell = true;
-- 
cgit v1.3.1


From dabd9f0f02b44b048b6355184fa64612201db72d Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Sat, 28 Apr 2018 09:41:43 +0200
Subject: l monitoring: open ports

---
 lass/2configs/monitoring/node-exporter.nix     | 6 ++++--
 lass/2configs/monitoring/prometheus-server.nix | 6 ++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

(limited to 'lass')

diff --git a/lass/2configs/monitoring/node-exporter.nix b/lass/2configs/monitoring/node-exporter.nix
index 8c27e90d4..561e3a25c 100644
--- a/lass/2configs/monitoring/node-exporter.nix
+++ b/lass/2configs/monitoring/node-exporter.nix
@@ -1,7 +1,9 @@
 { config, lib, pkgs, ... }:
 {
-  networking.firewall.allowedTCPPorts = [ 9100 ];
-
+  krebs.iptables.tables.filter.INPUT.rules = [
+    { predicate = "-i retiolum -p tcp --dport 9100 -s ${config.krebs.hosts.prism.nets.retiolum.ip4.addr}"; target = "ACCEPT"; v6 = false; }
+    { predicate = "-i retiolum -p tcp --dport 9100 -s ${config.krebs.hosts.prism.nets.retiolum.ip6.addr}"; target = "ACCEPT"; v4 = false; }
+  ];
   services.prometheus.exporters = {
     node = {
       enable = true;
diff --git a/lass/2configs/monitoring/prometheus-server.nix b/lass/2configs/monitoring/prometheus-server.nix
index d56d7e552..c5c97412d 100644
--- a/lass/2configs/monitoring/prometheus-server.nix
+++ b/lass/2configs/monitoring/prometheus-server.nix
@@ -9,6 +9,12 @@
   #  useDHCP = true;
   #};
 
+  krebs.iptables.tables.filter.INPUT.rules = [
+    { predicate = "-i retiolum -p tcp --dport 3000"; target = "ACCEPT"; }
+    { predicate = "-i retiolum -p tcp --dport 9090"; target = "ACCEPT"; }
+    { predicate = "-i retiolum -p tcp --dport 9093"; target = "ACCEPT"; }
+  ];
+
   services = {
     prometheus = {
       enable = true;
-- 
cgit v1.3.1


From a0862fa505ba8fb1d94c8bdac69a2077ba89bcdc Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Sat, 28 Apr 2018 09:43:17 +0200
Subject: l monitoring: monitor more hosts

---
 lass/2configs/monitoring/prometheus-server.nix | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

(limited to 'lass')

diff --git a/lass/2configs/monitoring/prometheus-server.nix b/lass/2configs/monitoring/prometheus-server.nix
index c5c97412d..92bb0519f 100644
--- a/lass/2configs/monitoring/prometheus-server.nix
+++ b/lass/2configs/monitoring/prometheus-server.nix
@@ -130,11 +130,10 @@
           static_configs = [
             {
               targets = [
-                "localhost:9100"
-              ];
-              labels = {
-                alias = "prometheus.example.com";
-              };
+              ] ++ map (host: "${host}:9100") (lib.attrNames (lib.filterAttrs (_: host: host.owner.name == "lass" && host.monitoring) config.krebs.hosts));
+              #labels = {
+              #  alias = "prometheus.example.com";
+              #};
             }
           ];
         }
-- 
cgit v1.3.1


From da44ae1115af80bb71f38de20b7421d08e435ea7 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Sat, 28 Apr 2018 09:43:51 +0200
Subject: l monitoring: print alarms to irc

---
 lass/2configs/monitoring/prometheus-server.nix | 33 ++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

(limited to 'lass')

diff --git a/lass/2configs/monitoring/prometheus-server.nix b/lass/2configs/monitoring/prometheus-server.nix
index 92bb0519f..1f9419e1a 100644
--- a/lass/2configs/monitoring/prometheus-server.nix
+++ b/lass/2configs/monitoring/prometheus-server.nix
@@ -181,4 +181,37 @@
       security = import <secrets/grafana_security.nix>; # { AdminUser = ""; adminPassword = ""}
     };
   };
+  services.logstash = {
+    enable = true;
+    inputConfig = ''
+      http {
+        port => 14813
+        host => "127.0.0.1"
+      }
+    '';
+    filterConfig = ''
+      if ([alerts]) {
+        ruby {
+          code => '
+            lines = []
+            event["alerts"].each {|p|
+              lines << "#{p["labels"]["instance"]}#{p["annotations"]["summary"]} #{p["status"]}"
+            }
+            event["output"] = lines.join("\n")
+          '
+        }
+      }
+    '';
+    outputConfig = ''
+      file { path => "/tmp/logs.json" codec => "json_lines" }
+      irc {
+        channels => [ "#noise" ]
+        host => "irc.r"
+        nick => "alarm"
+        codec => "json_lines"
+        format => "%{output}"
+      }
+    '';
+    #plugins = [ ];
+  };
 }
-- 
cgit v1.3.1


From 1d1861fe7c3c2906a0deff9ae9598fa7ffe08c0d Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Sat, 28 Apr 2018 11:29:46 +0200
Subject: l notmuch: disable tests

---
 lass/2configs/mail.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'lass')

diff --git a/lass/2configs/mail.nix b/lass/2configs/mail.nix
index 81db59617..2bb51b50a 100644
--- a/lass/2configs/mail.nix
+++ b/lass/2configs/mail.nix
@@ -206,8 +206,11 @@ in {
     msmtp
     mutt
     pkgs.much
-    pkgs.notmuch
     tag-new-mails
     tag-old-mails
   ];
+
+  nixpkgs.config.packageOverrides = opkgs: {
+    notmuch = (opkgs.notmuch.overrideAttrs (o: { doCheck = false; }));
+  };
 }
-- 
cgit v1.3.1


From 4190562d1233e40b3364c1bd812f2702a0748e49 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Sat, 28 Apr 2018 16:12:10 +0200
Subject: l monitoring: delete legacy config

---
 lass/2configs/monitoring/client.nix       | 26 ---------
 lass/2configs/monitoring/monit-alarms.nix | 44 ----------------
 lass/2configs/monitoring/server.nix       | 87 -------------------------------
 3 files changed, 157 deletions(-)
 delete mode 100644 lass/2configs/monitoring/client.nix
 delete mode 100644 lass/2configs/monitoring/monit-alarms.nix
 delete mode 100644 lass/2configs/monitoring/server.nix

(limited to 'lass')

diff --git a/lass/2configs/monitoring/client.nix b/lass/2configs/monitoring/client.nix
deleted file mode 100644
index b8c245215..000000000
--- a/lass/2configs/monitoring/client.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{pkgs, config, ...}:
-with import <stockholm/lib>;
-{
-  services.telegraf = {
-    enable = true;
-
-    extraConfig = {
-      agent.interval = "1s";
-      outputs = {
-        influxdb = {
-          urls = ["http://prism:8086"];
-          database = "telegraf_db";
-          user_agent = "telegraf";
-        };
-      };
-      inputs = {
-        cpu = {
-          percpu = false;
-          totalcpu = true;
-        };
-        mem = {};
-        net = {};
-      };
-    };
-  };
-}
diff --git a/lass/2configs/monitoring/monit-alarms.nix b/lass/2configs/monitoring/monit-alarms.nix
deleted file mode 100644
index 2cfc292e5..000000000
--- a/lass/2configs/monitoring/monit-alarms.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{pkgs, config, ...}:
-with import <stockholm/lib>;
-let
-  echoToIrc = msg:
-    pkgs.writeDash "echo_irc" ''
-      set -euf
-      export LOGNAME=prism-alarm
-      ${pkgs.irc-announce}/bin/irc-announce \
-        irc.r 6667 ${config.networking.hostName}-alarm \#noise "${msg}" >/dev/null
-    '';
-
-in {
-  krebs.monit = {
-    enable = true;
-    http.enable = true;
-    alarms = {
-      nirwanabluete = {
-        test = "${pkgs.curl}/bin/curl -sf 'https://nirwanabluete.de/'";
-        alarm = echoToIrc "test nirwanabluete failed";
-      };
-      ubik = {
-        test = "${pkgs.curl}/bin/curl -sf 'https://ubikmedia.de'";
-        alarm = echoToIrc "test ubik failed";
-      };
-      cac-panel = {
-        test = "${pkgs.curl}/bin/curl -sf 'https://panel.cloudatcost.com/login.php'";
-        alarm = echoToIrc "test cac-panel failed";
-      };
-      radio = {
-        test = pkgs.writeBash "check_stream" ''
-          ${pkgs.curl}/bin/curl -sif http://lassul.us:8000/radio.ogg \
-          | ${pkgs.gawk}/bin/awk '/^\r$/{exit}{print $0}' \
-          | ${pkgs.gnugrep}/bin/grep -q "200 OK" || exit "''${PIPESTATUS[0]}"
-        '';
-        alarm = echoToIrc "test radio failed";
-      };
-    };
-  };
-
-  krebs.iptables.tables.filter.INPUT.rules = [
-    { predicate = "-p tcp -i retiolum --dport 9093"; target = "ACCEPT"; }
-  ];
-}
-
diff --git a/lass/2configs/monitoring/server.nix b/lass/2configs/monitoring/server.nix
deleted file mode 100644
index adaecde2c..000000000
--- a/lass/2configs/monitoring/server.nix
+++ /dev/null
@@ -1,87 +0,0 @@
-{pkgs, config, ...}:
-with import <stockholm/lib>;
-{
-  services.influxdb.enable = true;
-
-  services.influxdb.extraConfig = {
-    meta.hostname = config.krebs.build.host.name;
-    # meta.logging-enabled = true;
-    http.bind-address = ":8086";
-    admin.bind-address = ":8083";
-    http.log-enabled = false;
-    monitoring = {
-      enabled = false;
-      # write-interval = "24h";
-    };
-    collectd = [{
-      enabled = true;
-      typesdb = "${pkgs.collectd}/share/collectd/types.db";
-      database = "collectd_db";
-      port = 25826;
-    }];
-  };
-
-  krebs.kapacitor =
-    let
-      db = "telegraf_db";
-      echoToIrc = pkgs.writeDash "echo_irc" ''
-        set -euf
-        data="$(${pkgs.jq}/bin/jq -r .message)"
-        export LOGNAME=prism-alarm
-        ${pkgs.irc-announce}/bin/irc-announce \
-          irc.r 6667 prism-alarm \#noise "$data" >/dev/null
-      '';
-    in {
-      enable = true;
-      alarms = {
-        cpu = {
-          database = db;
-          text = ''
-            var data = batch
-              |query(${"'''"}
-                SELECT mean("usage_user") AS mean
-                FROM "${db}"."default"."cpu"
-              ${"'''"})
-              .period(10m)
-              .every(1m)
-              .groupBy('host')
-              data |alert()
-                .crit(lambda: "mean" > 90)
-                .exec('${echoToIrc}')
-              data |deadman(1.0,5m)
-                .stateChangesOnly()
-                .exec('${echoToIrc}')
-          '';
-        };
-        ram = {
-          database = db;
-          text = ''
-            var data = batch
-              |query(${"'''"}
-                SELECT mean("used_percent") AS mean
-                FROM "${db}"."default"."mem"
-              ${"'''"})
-              .period(10m)
-              .every(1m)
-              .groupBy('host')
-              data |alert()
-                .crit(lambda: "mean" > 90)
-                .exec('${echoToIrc}')
-          '';
-        };
-      };
-  };
-
-  services.grafana = {
-    enable = true;
-    addr = "0.0.0.0";
-    auth.anonymous.enable = true;
-    security = import <secrets/grafana_security.nix>; # { AdminUser = ""; adminPassword = ""}
-  };
-
-  krebs.iptables.tables.filter.INPUT.rules = [
-    { predicate = "-p tcp -i retiolum --dport 8086"; target = "ACCEPT"; }
-    { predicate = "-p tcp -i retiolum --dport 3000"; target = "ACCEPT"; }
-    { predicate = "-p udp -i retiolum --dport 25826"; target = "ACCEPT"; }
-  ];
-}
-- 
cgit v1.3.1


From 92c123397188ae6cf115197862e8d79015995356 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Sat, 28 Apr 2018 17:26:43 +0200
Subject: l prism.r: run go-shortener

---
 lass/1systems/prism/config.nix |  1 +
 lass/2configs/go.nix           | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+)
 create mode 100644 lass/2configs/go.nix

(limited to 'lass')

diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index f8178a200..7b581d905 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -303,6 +303,7 @@ in {
         { predicate = "-p tcp --dport 53589"; target = "ACCEPT"; }
       ];
     }
+    <stockholm/lass/2configs/go.nix>
   ];
 
   krebs.build.host = config.krebs.hosts.prism;
diff --git a/lass/2configs/go.nix b/lass/2configs/go.nix
new file mode 100644
index 000000000..ecf89b298
--- /dev/null
+++ b/lass/2configs/go.nix
@@ -0,0 +1,19 @@
+{ config, lib, pkgs, ... }:
+{
+  krebs.go = {
+    enable = true;
+  };
+  services.nginx = {
+    enable = true;
+    virtualHosts.go = {
+      locations."/".extraConfig = ''
+        proxy_set_header Host go.lassul.us;
+        proxy_pass http://localhost:1337;
+      '';
+      serverAliases = [
+        "go.lassul.us"
+      ];
+    };
+  };
+}
+
-- 
cgit v1.3.1


From b96f9d898a77bb5a735ad35d1bc1eeeea1833cae Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Sat, 28 Apr 2018 23:14:34 +0200
Subject: l websites: move servephpBB to util

---
 lass/2configs/websites/lassulus.nix | 55 -------------------------------------
 lass/2configs/websites/util.nix     | 53 +++++++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+), 55 deletions(-)

(limited to 'lass')

diff --git a/lass/2configs/websites/lassulus.nix b/lass/2configs/websites/lassulus.nix
index 25ca1f455..b9811221c 100644
--- a/lass/2configs/websites/lassulus.nix
+++ b/lass/2configs/websites/lassulus.nix
@@ -6,61 +6,6 @@ let
     genid
   ;
 
-  servephpBB = domains:
-    let
-      domain = head domains;
-
-    in {
-      services.nginx.virtualHosts."${domain}" = {
-        enableACME = true;
-        forceSSL = true;
-        serverAliases = domains;
-        extraConfig = ''
-          index index.php;
-          root /srv/http/${domain}/;
-          access_log /tmp/nginx_acc.log;
-          error_log /tmp/nginx_err.log;
-          error_page 404 /404.html;
-          error_page 500 502 503 504 /50x.html;
-          client_max_body_size 100m;
-        '';
-        locations."/".extraConfig = ''
-          try_files $uri $uri/ /index.php?$args;
-        '';
-        locations."~ \.php(?:$|/)".extraConfig =  ''
-          fastcgi_split_path_info ^(.+\.php)(/.+)$;
-          include ${pkgs.nginx}/conf/fastcgi_params;
-          fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-          fastcgi_param PATH_INFO $fastcgi_path_info;
-          fastcgi_param HTTPS on;
-          fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
-          fastcgi_pass unix:/srv/http/${domain}/phpfpm.pool;
-          fastcgi_intercept_errors on;
-        '';
-        #Directives to send expires headers and turn off 404 error logging.
-        locations."~* ^.+\.(xml|ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|css|rss|atom|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$".extraConfig = ''
-          access_log off;
-          log_not_found off;
-          expires max;
-        '';
-      };
-      services.phpfpm.poolConfigs."${domain}" = ''
-        listen = /srv/http/${domain}/phpfpm.pool
-        user = nginx
-        group = nginx
-        pm = dynamic
-        pm.max_children = 25
-        pm.start_servers = 5
-        pm.min_spare_servers = 3
-        pm.max_spare_servers = 20
-        listen.owner = nginx
-        listen.group = nginx
-        php_admin_value[error_log] = 'stderr'
-        php_admin_flag[log_errors] = on
-        catch_workers_output = yes
-      '';
-    };
-
 in {
   imports = [
     ./default.nix
diff --git a/lass/2configs/websites/util.nix b/lass/2configs/websites/util.nix
index 441b7af90..61b5543ce 100644
--- a/lass/2configs/websites/util.nix
+++ b/lass/2configs/websites/util.nix
@@ -28,6 +28,59 @@ rec {
       };
     };
 
+  servephpBB = domains:
+    let
+      domain = head domains;
+
+    in {
+      services.nginx.virtualHosts."${domain}" = {
+        serverAliases = domains;
+        extraConfig = ''
+          index index.php;
+          root /srv/http/${domain}/;
+          access_log /tmp/nginx_acc.log;
+          error_log /tmp/nginx_err.log;
+          error_page 404 /404.html;
+          error_page 500 502 503 504 /50x.html;
+          client_max_body_size 100m;
+        '';
+        locations."/".extraConfig = ''
+          try_files $uri $uri/ /index.php?$args;
+        '';
+        locations."~ \.php(?:$|/)".extraConfig =  ''
+          fastcgi_split_path_info ^(.+\.php)(/.+)$;
+          include ${pkgs.nginx}/conf/fastcgi_params;
+          fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+          fastcgi_param PATH_INFO $fastcgi_path_info;
+          fastcgi_param HTTPS on;
+          fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
+          fastcgi_pass unix:/srv/http/${domain}/phpfpm.pool;
+          fastcgi_intercept_errors on;
+        '';
+        #Directives to send expires headers and turn off 404 error logging.
+        locations."~* ^.+\.(xml|ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|css|rss|atom|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$".extraConfig = ''
+          access_log off;
+          log_not_found off;
+          expires max;
+        '';
+      };
+      services.phpfpm.poolConfigs."${domain}" = ''
+        listen = /srv/http/${domain}/phpfpm.pool
+        user = nginx
+        group = nginx
+        pm = dynamic
+        pm.max_children = 25
+        pm.start_servers = 5
+        pm.min_spare_servers = 3
+        pm.max_spare_servers = 20
+        listen.owner = nginx
+        listen.group = nginx
+        php_admin_value[error_log] = 'stderr'
+        php_admin_flag[log_errors] = on
+        catch_workers_output = yes
+      '';
+    };
+
   serveOwncloud = domains:
     let
       domain = head domains;
-- 
cgit v1.3.1


From 1820b1753011eb42bb9be30011e6fbd11993b201 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Sat, 28 Apr 2018 23:18:05 +0200
Subject: l: add red.r

---
 krebs/3modules/lass/default.nix     | 31 +++++++++++++++++++++++++++++++
 lass/1systems/prism/config.nix      | 28 ++++++++++++++++++++++++++++
 lass/1systems/red/config.nix        | 30 ++++++++++++++++++++++++++++++
 lass/1systems/red/source.nix        |  4 ++++
 lass/2configs/websites/lassulus.nix |  1 -
 5 files changed, 93 insertions(+), 1 deletion(-)
 create mode 100644 lass/1systems/red/config.nix
 create mode 100644 lass/1systems/red/source.nix

(limited to 'lass')

diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index 99010481b..48df04bcb 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -639,6 +639,37 @@ with import <stockholm/lib>;
       ssh.privkey.path = <secrets/ssh.id_ed25519>;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPsTeSAedrbp7/KmZX8Mvka702fIUy77Mvqo9HwzCbym";
     };
+    red = {
+      monitoring = false;
+      cores = 1;
+      nets = {
+        retiolum = {
+          ip4.addr = "10.243.0.13";
+          ip6.addr = "42:0:0:0:0:0:0:12ed";
+          aliases = [
+            "red.r"
+          ];
+          tinc.pubkey = ''
+            -----BEGIN PUBLIC KEY-----
+            MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEArAN/62V2MV18wsZ9VMTG
+            4/cqsjvHlffAN8jYDq+GImgREvbiLlFhhHgxwKh0gcDTR8P1xX/00P3/fx/g5bRF
+            Te7LZT2AFmVFFFfx1n9NBweN/gG2/hzB9J8epbWLNT+RzpzHuAoREvDZ+jweSXaI
+            phdmQY2s36yrR3TAShqq0q4cwlXuHT00J+InDutM0mTftBQG/fvYkBhHOfq4WSY0
+            FeMK7DTKNbsqQiKKQ/kvWi7KfTW0F0c7SDpi7BLwbQzP2WbogtGy9MIrw9ZhE6Ox
+            TVdAksPKw0TlYdb16X/MkbzBqTYbxFlmWzpMJABMxIVwAfQx3ZGYvJDdDXmQS2qa
+            mDN2xBb/5pj3fbfp4wbwWlRVSd/AJQtRvaNY24F+UsRJb0WinIguDI6oRZx7Xt8w
+            oYirKqqq1leb3EYUt8TMIXQsOw0/Iq+JJCwB+ZyLLGVNB19XOxdR3RN1JYeZANpE
+            cMSS3SdFGgZ//ZAdhIN5kw9yMeKo6Rnt+Vdz3vZWTuSVp/xYO3IMGXNGAdIWIwrJ
+            7fwSl/rfXGG816h0sD46U0mxd+i68YOtHlzOKe+vMZ4/FJZYd/E5/IDQluV8HLwa
+            5lODfZXUmfStdV+GDA9KVEGUP5xSkC3rMnir66NgHzKpIL002/g/HfGu7O3MrvpW
+            ng7AMvRv5vbsYcJBj2HUhKUCAwEAAQ==
+            -----END PUBLIC KEY-----
+          '';
+        };
+      };
+      ssh.privkey.path = <secrets/ssh.id_ed25519>;
+      ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd/6eCR8yxC14zBJLIQgVa4Zbutv5yr2S8k08ztmBpp";
+    };
   };
   users = {
     lass = {
diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index 7b581d905..d1faf77bd 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -304,6 +304,34 @@ in {
       ];
     }
     <stockholm/lass/2configs/go.nix>
+    {
+      environment.systemPackages = [ pkgs.cryptsetup ];
+      systemd.services."container@red".reloadIfChanged = mkForce false;
+      containers.red = {
+        config = { ... }: {
+          environment.systemPackages = [ pkgs.git ];
+          services.openssh.enable = true;
+          users.users.root.openssh.authorizedKeys.keys = [
+            config.krebs.users.lass.pubkey
+          ];
+        };
+        autoStart = false;
+        enableTun = true;
+        privateNetwork = true;
+        hostAddress = "10.233.2.3";
+        localAddress = "10.233.2.4";
+      };
+      services.nginx.virtualHosts."rote-allez-fraktion.de" = {
+        enableACME = true;
+        addSSL = true;
+        locations."/" = {
+          extraConfig = ''
+            proxy_set_header Host rote-allez-fraktion.de;
+            proxy_pass http://10.233.2.4;
+          '';
+        };
+      };
+    }
   ];
 
   krebs.build.host = config.krebs.hosts.prism;
diff --git a/lass/1systems/red/config.nix b/lass/1systems/red/config.nix
new file mode 100644
index 000000000..8c60aed62
--- /dev/null
+++ b/lass/1systems/red/config.nix
@@ -0,0 +1,30 @@
+with import <stockholm/lib>;
+{ config, lib, pkgs, ... }:
+let
+  inherit (import <stockholm/lass/2configs/websites/util.nix> {inherit lib pkgs;})
+    servephpBB
+  ;
+in
+{
+  imports = [
+    <stockholm/lass>
+    <stockholm/lass/2configs>
+    <stockholm/lass/2configs/retiolum.nix>
+    <stockholm/lass/2configs/websites>
+    <stockholm/lass/2configs/websites/sqlBackup.nix>
+    (servephpBB [ "rote-allez-fraktion.de" ])
+  ];
+
+  krebs.iptables.tables.filter.INPUT.rules = [
+    { predicate = "-p tcp --dport 80"; target = "ACCEPT"; }
+  ];
+
+  krebs.build.host = config.krebs.hosts.red;
+  boot.isContainer = true;
+  networking.useDHCP = false;
+
+  services.nginx.enable = true;
+  environment.systemPackages = [
+    pkgs.mk_sql_pair
+  ];
+}
diff --git a/lass/1systems/red/source.nix b/lass/1systems/red/source.nix
new file mode 100644
index 000000000..f2bad743c
--- /dev/null
+++ b/lass/1systems/red/source.nix
@@ -0,0 +1,4 @@
+import <stockholm/lass/source.nix> {
+  name = "red";
+  secure = true;
+}
diff --git a/lass/2configs/websites/lassulus.nix b/lass/2configs/websites/lassulus.nix
index b9811221c..53f1eea5c 100644
--- a/lass/2configs/websites/lassulus.nix
+++ b/lass/2configs/websites/lassulus.nix
@@ -10,7 +10,6 @@ in {
   imports = [
     ./default.nix
     ../git.nix
-    (servephpBB [ "rote-allez-fraktion.de" ])
   ];
 
   security.acme = {
-- 
cgit v1.3.1


From 74b52f1c3e1db674adab2a397def13dda495a66f Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Sat, 28 Apr 2018 23:20:53 +0200
Subject: l: add immoscout@lassul.us

---
 lass/2configs/exim-smarthost.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'lass')

diff --git a/lass/2configs/exim-smarthost.nix b/lass/2configs/exim-smarthost.nix
index 4455d2761..e05ed2427 100644
--- a/lass/2configs/exim-smarthost.nix
+++ b/lass/2configs/exim-smarthost.nix
@@ -79,6 +79,7 @@ with import <stockholm/lib>;
       { from = "ovh@lassul.us"; to = lass.mail; }
       { from = "hetzner@lassul.us"; to = lass.mail; }
       { from = "allygator@lassul.us"; to = lass.mail; }
+      { from = "immoscout@lassul.us"; to = lass.mail; }
     ];
     system-aliases = [
       { from = "mailer-daemon"; to = "postmaster"; }
-- 
cgit v1.3.1


From 7240963fb9a0a98696cae7d9a0d9ba248eb51676 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Sat, 28 Apr 2018 23:27:25 +0200
Subject: l git: add collaborators to public repos

---
 lass/2configs/git.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'lass')

diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix
index 1fe87c666..2e3c6290f 100644
--- a/lass/2configs/git.nix
+++ b/lass/2configs/git.nix
@@ -70,8 +70,8 @@ let
     import <secrets/repos.nix> { inherit config lib pkgs; }
   );
 
-  make-public-repo = name: { cgit ? {}, ... }: {
-    inherit cgit name;
+  make-public-repo = name: { cgit ? {}, collaborators ? [], ... }: {
+    inherit cgit collaborators name;
     public = true;
     hooks = {
       post-receive = pkgs.git-hooks.irc-announce {
-- 
cgit v1.3.1


From 867db7d464f101f0be77199b7178b5f110d79bf7 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Sat, 28 Apr 2018 23:27:51 +0200
Subject: l git: add nixos-aws

---
 lass/2configs/git.nix | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'lass')

diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix
index 2e3c6290f..d18524cf5 100644
--- a/lass/2configs/git.nix
+++ b/lass/2configs/git.nix
@@ -57,6 +57,12 @@ let
       cgit.desc = "Fork of nix-user-chroot my lethalman";
       cgit.section = "software";
     };
+    nixos-aws = {
+      collaborators = [ {
+        name = "fabio";
+        pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDFst8DvnfOu4pQJYxcwdf//jWTvP+jj0iSrOdt59c9Gbujm/8K1mBXhcSQhHj/GBRC1Qc1wipf9qZsWnEHMI+SRwq6tDr8gqlAcdWmHAs1bU96jJtc8EgmUKbXTFG/VmympMPi4cEbNUtH93v6NUjQKwq9szvDhhqSW4Y8zE32xLkySwobQapNaUrGAtQp3eTxu5Lkx+cEaaartaAspt8wSosXjUHUJktg0O5/XOP+CiWAx89AXxbQCy4XTQvUExoRGdw9sdu0lF0/A0dF4lFF/dDUS7+avY8MrKEcQ8Fwk8NcW1XrKMmCdNdpvou0whL9aHCdTJ+522dsSB1zZWh63Si4CrLKlc1TiGKCXdvzmCYrD+6WxbPJdRpMM4dFNtpAwhCm/dM+CBXfDkP0s5veFiYvp1ri+3hUqV/sep9r5/+d+5/R1gQs8WDNjWqcshveFbD5LxE6APEySB4QByGxIrw7gFbozE+PNxtlVP7bq4MyE6yIzL6ofQgO1e4THquPcqSCfCvyib5M2Q1phi5DETlMemWp84AsNkqbhRa4BGRycuOXXrBzE+RgQokcIY7t3xcu3q0xJo2+HxW/Lqi72zYU1NdT4nJMETEaG49FfIAnUuoVaQWWvOz8mQuVEmmdw2Yzo2ikILYSUdHTp1VPOeo6aNPvESkPw1eM0xDRlQ== ada";
+      } ];
+    };
   } // mapAttrs make-public-repo-silent {
   };
 
-- 
cgit v1.3.1


From 02e24615adeac1ab6062ba83748eafe7418ac3ed Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 1 May 2018 15:36:07 +0200
Subject: l prism.r: enable ipv4 forwarding

---
 lass/1systems/prism/config.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'lass')

diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index d1faf77bd..89ea749c5 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -104,6 +104,7 @@ in {
       ];
     }
     { # TODO make new hfos.nix out of this vv
+      boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
       users.users.riot = {
         uid = genid "riot";
         isNormalUser = true;
-- 
cgit v1.3.1


From 652b540d4b9978e0b01d6dad0feb725fd79a13d4 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 1 May 2018 15:41:42 +0200
Subject: l red.r: env NIX_REMOTE=daemon

---
 lass/1systems/red/config.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'lass')

diff --git a/lass/1systems/red/config.nix b/lass/1systems/red/config.nix
index 8c60aed62..31e2de966 100644
--- a/lass/1systems/red/config.nix
+++ b/lass/1systems/red/config.nix
@@ -24,6 +24,7 @@ in
   networking.useDHCP = false;
 
   services.nginx.enable = true;
+  environment.variables.NIX_REMOTE = "daemon";
   environment.systemPackages = [
     pkgs.mk_sql_pair
   ];
-- 
cgit v1.3.1


From a7595f3ab19b8e94696fdca18c0b78cc605281b3 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 1 May 2018 15:49:56 +0200
Subject: l gc: don't gc on containers

---
 lass/2configs/gc.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lass')

diff --git a/lass/2configs/gc.nix b/lass/2configs/gc.nix
index ad015180a..c5073e384 100644
--- a/lass/2configs/gc.nix
+++ b/lass/2configs/gc.nix
@@ -3,6 +3,6 @@
 with import <stockholm/lib>;
 {
   nix.gc = {
-    automatic = ! elem config.krebs.build.host.name [ "prism" "mors" "helios" ];
+    automatic = ! (elem config.krebs.build.host.name [ "prism" "mors" "helios" ] || config.boot.isContainer);
   };
 }
-- 
cgit v1.3.1


From 0f98216757cfeb3cfe318181fee0fc5c7b7f1c04 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 1 May 2018 16:04:21 +0200
Subject: l zsh: use recent LS_COLORS

---
 lass/2configs/zsh.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'lass')

diff --git a/lass/2configs/zsh.nix b/lass/2configs/zsh.nix
index aa3e6731d..76cac9f56 100644
--- a/lass/2configs/zsh.nix
+++ b/lass/2configs/zsh.nix
@@ -54,8 +54,8 @@
       eval $(dircolors -b ${pkgs.fetchFromGitHub {
         owner = "trapd00r";
         repo = "LS_COLORS";
-        rev = "master";
-        sha256="05lh5w3bgj9h8d8lrbbwbzw8788709cnzzkl8yh7m1dawkpf6nlp";
+        rev = "a75fca8545f91abb8a5f802981033ef54bf1eac0";
+        sha256="1lzj0qnj89mzh76ha137mnz2hf86k278rh0y9x124ghxj9yqsnb4";
       }}/LS_COLORS)
       alias ls='ls --color'
       zstyle ':completion:*:default' list-colors ''${(s.:.)LS_COLORS}
-- 
cgit v1.3.1


From 37fa7bff9339799984554b8ccbacf1f07281d6ce Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 1 May 2018 16:04:48 +0200
Subject: l git: add krops repo

---
 lass/2configs/git.nix | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'lass')

diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix
index d18524cf5..43085ba5e 100644
--- a/lass/2configs/git.nix
+++ b/lass/2configs/git.nix
@@ -63,6 +63,10 @@ let
         pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDFst8DvnfOu4pQJYxcwdf//jWTvP+jj0iSrOdt59c9Gbujm/8K1mBXhcSQhHj/GBRC1Qc1wipf9qZsWnEHMI+SRwq6tDr8gqlAcdWmHAs1bU96jJtc8EgmUKbXTFG/VmympMPi4cEbNUtH93v6NUjQKwq9szvDhhqSW4Y8zE32xLkySwobQapNaUrGAtQp3eTxu5Lkx+cEaaartaAspt8wSosXjUHUJktg0O5/XOP+CiWAx89AXxbQCy4XTQvUExoRGdw9sdu0lF0/A0dF4lFF/dDUS7+avY8MrKEcQ8Fwk8NcW1XrKMmCdNdpvou0whL9aHCdTJ+522dsSB1zZWh63Si4CrLKlc1TiGKCXdvzmCYrD+6WxbPJdRpMM4dFNtpAwhCm/dM+CBXfDkP0s5veFiYvp1ri+3hUqV/sep9r5/+d+5/R1gQs8WDNjWqcshveFbD5LxE6APEySB4QByGxIrw7gFbozE+PNxtlVP7bq4MyE6yIzL6ofQgO1e4THquPcqSCfCvyib5M2Q1phi5DETlMemWp84AsNkqbhRa4BGRycuOXXrBzE+RgQokcIY7t3xcu3q0xJo2+HxW/Lqi72zYU1NdT4nJMETEaG49FfIAnUuoVaQWWvOz8mQuVEmmdw2Yzo2ikILYSUdHTp1VPOeo6aNPvESkPw1eM0xDRlQ== ada";
       } ];
     };
+    krops = {
+      cgit.desc = "krebs deployment";
+      cgit.section = "software";
+    };
   } // mapAttrs make-public-repo-silent {
   };
 
-- 
cgit v1.3.1


From b847bcdc02ded53c946a8f75dabfbda8ac3498dc Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Wed, 2 May 2018 15:53:09 +0200
Subject: l helios.r: update certs

---
 lass/1systems/helios/config.nix | 37 ++++++++-----------------------------
 1 file changed, 8 insertions(+), 29 deletions(-)

(limited to 'lass')

diff --git a/lass/1systems/helios/config.nix b/lass/1systems/helios/config.nix
index 557fce1e8..759bb6d06 100644
--- a/lass/1systems/helios/config.nix
+++ b/lass/1systems/helios/config.nix
@@ -138,35 +138,14 @@ with import <stockholm/lib>;
   networking.hostName = lib.mkForce "BLN02NB0162";
 
   security.pki.certificateFiles = [
-    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAROOTC1G1.pem"; sha256 = "14vz9c0fk6li0a26vx0s5ha6y3yivnshx9pjlh9vmnpkbph5a7rh"; })
-    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAROOTC2G1.pem"; sha256 = "0r1dd48a850cv7whk4g2maik550rd0vsrsl73r6x0ivzz7ap1xz5"; })
-    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAROOTC3G1.pem"; sha256 = "0b5cdchdkvllnr0kz35d8jrmrf9cjw0kd98mmvzr0x6nkc8hwpdy"; })
-
-    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCACOMPC2G1.pem"; sha256 = "0rn57zv1ry9vj4p2248mxmafmqqmdhbrfx1plszrxsphshbk2hfz"; })
-    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCACOMPC3G1.pem"; sha256 = "0w88qaqhwxzvdkx40kzj2gka1yi85ipppjdkxah4mscwfhlryrnk"; })
-    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAIDENC2G1.pem"; sha256 = "1z2qkyhgjvri13bvi06ynkb7mjmpcznmc9yw8chx1lnwc3cxa7kf"; })
-    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAIDENC3G1.pem"; sha256 = "0smdjjvz95n652cb45yhzdb2lr83zg52najgbzf6lm3w71f8mv7f"; })
-    (pkgs.writeText "minio.cert" ''
-      -----BEGIN CERTIFICATE-----
-      MIIDFDCCAfygAwIBAgIQBEKYm9VmbR6T/XNLP2P5kDANBgkqhkiG9w0BAQsFADAS
-      MRAwDgYDVQQKEwdBY21lIENvMB4XDTE4MDIxNDEyNTk1OVoXDTE5MDIxNDEyNTk1
-      OVowEjEQMA4GA1UEChMHQWNtZSBDbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
-      AQoCggEBAMmRGUTMDxOaoEZ3osG1ZpGj4enHl6ToWaoCXvRXvI6RB/99QOFlwLdL
-      8lGjIbXyovNkH686pVsfgCTOLRGzftWHmWgfmaSUv0TToBW8F9DN4ww9YgiLZjvV
-      YZunRyp1n0x9OrBXMs7xEBBa4q0AG1IvlRJTrd7CW519FlVq7T95LLB7P6t6K54C
-      ksG4kEzXLRPD/FMdU7LWbhWnQSOxPMCq8erTv3kW3A3Y9hSAKOFQKQHH/3O2HDrM
-      CbK5ldNklswg2rIHxx7kg1fteLD1lVCNPfCMfuwlLUaMeoRZ03HDof8wFlRz3pzw
-      hQRWPvfLfRvFCZ0LFNvfgAqXtmG/ywUCAwEAAaNmMGQwDgYDVR0PAQH/BAQDAgKk
-      MBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wLAYDVR0RBCUw
-      I4IJbG9jYWxob3N0ggZoZWxpb3OCCGhlbGlvcy5yhwR/AAABMA0GCSqGSIb3DQEB
-      CwUAA4IBAQBzrPb3NmAn60awoJG3d4BystaotaFKsO3iAnP4Lfve1bhKRELIjJ30
-      hX/mRYkEVRbfwKRgkkLab4zpJ/abjb3DjFNo8E4QPNeCqS+8xxeBOf7x61Kg/0Ox
-      jRQ95fTATyItiChwNkoxYjVIwosqxBVsbe3KxwhkmKPQ6wH/nvr6URX/IGUz2qWY
-      EqHdjsop83u4Rjn3C0u46U0P+W4U5IFiLfcE3RzFFYh67ko5YEhkyXP+tBNSgrTM
-      zFisVoQZdXpMCWWxBVWulB4FvvTx3jKUPRZVOrfexBfY4TA/PyhXLoz7FeEK9n2a
-      qFkrxy+GrHBXfSRZgCaHQFdKorg2fwwa
-      -----END CERTIFICATE-----
-    '')
+    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAROOTC1G1.pem"; sha256 = "006j61q2z44z6d92638iin6r46r4cj82ipwm37784h34i5x4mp0d"; })
+    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAROOTC2G1.pem"; sha256 = "1nkd1rjcn02q9xxjg7sw79lbwy08i7hb4v4pn98djknvcmplpz5m"; })
+    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAROOTC3G1.pem"; sha256 = "094m12npglnnv1nf1ijcv70p8l15l00id44qq7rwynhcgxi5539i"; })
+
+    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCACOMPC2G1.pem"; sha256 = "1anfncdf5xsp219kryncv21ra87flpzcjwcc85hzvlwbxhid3g4x"; })
+    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCACOMPC3G1.pem"; sha256 = "035kkfizyl5dndj7rhvmy91rr75lakqbqgjx4dpiw0kqq369mz8r"; })
+    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAIDENC2G1.pem"; sha256 = "14fpzx1qjs9ws9sz0y7pb6j40336xlckkqcm2rc5j86yn7r22lp7"; })
+    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAIDENC3G1.pem"; sha256 = "1yjl3kyw4chc8vw7bnqac2h9vn8dxryw7lr7i03lqi9sdvs4108s"; })
   ];
 
   programs.adb.enable = true;
-- 
cgit v1.3.1


From ecc09522d9073386c91fc61838ca418489ab648f Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Thu, 3 May 2018 12:13:14 +0200
Subject: l cabal.r: use as AP

---
 lass/1systems/cabal/config.nix |  1 +
 lass/2configs/AP.nix           | 77 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 78 insertions(+)
 create mode 100644 lass/2configs/AP.nix

(limited to 'lass')

diff --git a/lass/1systems/cabal/config.nix b/lass/1systems/cabal/config.nix
index 88f642d6b..9ac3cb681 100644
--- a/lass/1systems/cabal/config.nix
+++ b/lass/1systems/cabal/config.nix
@@ -15,6 +15,7 @@
     <stockholm/lass/2configs/fetchWallpaper.nix>
     <stockholm/lass/2configs/games.nix>
     <stockholm/lass/2configs/bitcoin.nix>
+    <stockholm/lass/2configs/AP.nix>
   ];
 
   krebs.build.host = config.krebs.hosts.cabal;
diff --git a/lass/2configs/AP.nix b/lass/2configs/AP.nix
new file mode 100644
index 000000000..5ce7cfff8
--- /dev/null
+++ b/lass/2configs/AP.nix
@@ -0,0 +1,77 @@
+{ config, pkgs, ... }:
+with import <stockholm/lib>;
+let
+  wifi = "wlp0s29u1u2";
+in {
+  boot.extraModulePackages = [
+    pkgs.linuxPackages.rtl8814au
+  ];
+  networking.networkmanager.unmanaged = [ wifi ];
+
+  systemd.services.hostapd = {
+    description = "hostapd wireless AP";
+    path = [ pkgs.hostapd ];
+    wantedBy = [ "network.target" ];
+
+    after = [ "${wifi}-cfg.service" "nat.service" "bind.service" "dhcpd.service" "sys-subsystem-net-devices-${wifi}.device" ];
+
+    serviceConfig = {
+      ExecStart = "${pkgs.hostapd}/bin/hostapd ${pkgs.writeText "hostapd.conf" ''
+        interface=${wifi}
+        hw_mode=a
+        channel=36
+        ieee80211d=1
+        country_code=DE
+        ieee80211n=1
+        ieee80211ac=1
+        wmm_enabled=1
+
+        # 5ghz
+        ssid=krebsing
+        auth_algs=1
+        wpa=2
+        wpa_key_mgmt=WPA-PSK
+        rsn_pairwise=CCMP
+        wpa_passphrase=aidsballz
+      ''}";
+      Restart = "always";
+    };
+  };
+
+  networking.interfaces.${wifi}.ipv4.addresses = [
+    { address = "10.99.0.1"; prefixLength = 24; }
+  ];
+  services.dhcpd4 = {
+    enable = true;
+    interfaces = [ wifi ];
+    extraConfig = ''
+      option subnet-mask 255.255.255.0;
+      option routers 10.99.0.1;
+      option domain-name-servers 1.1.1.1, 8.8.8.8;
+      subnet 10.99.0.0 netmask 255.255.255.0 {
+        range 10.99.0.100 10.99.0.200;
+      }
+    '';
+  };
+
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+  krebs.iptables.tables.filter.FORWARD.rules = [
+    { v6 = false; predicate = "-d 10.99.0.0/24 -o ${wifi} -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
+    { v6 = false; predicate = "-s 10.99.0.0/24 -i ${wifi}"; target = "ACCEPT"; }
+    { v6 = false; predicate = "-i ${wifi} -o ${wifi}"; target = "ACCEPT"; }
+    { v6 = false; predicate = "-o ${wifi}"; target = "REJECT --reject-with icmp-port-unreachable"; }
+    { v6 = false; predicate = "-i ${wifi}"; target = "REJECT --reject-with icmp-port-unreachable"; }
+  ];
+  krebs.iptables.tables.nat.PREROUTING.rules = [
+    { v6 = false; predicate = "-s 10.99.0.0/24"; target = "ACCEPT"; precedence = 1000; }
+  ];
+  krebs.iptables.tables.nat.POSTROUTING.rules = [
+    #TODO find out what this is about?
+    { v6 = false; predicate = "-s 10.99.0.0/24 -d 224.0.0.0/24"; target = "RETURN"; }
+    { v6 = false; predicate = "-s 10.99.0.0/24 -d 255.255.255.255"; target = "RETURN"; }
+
+    { v6 = false; predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24"; target = "MASQUERADE"; }
+    { v6 = false; predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24 -p tcp"; target = "MASQUERADE --to-ports 1024-65535"; }
+    { v6 = false; predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24 -p udp"; target = "MASQUERADE --to-ports 1024-65535"; }
+  ];
+}
-- 
cgit v1.3.1


From 28d6704a0d617ca7d379b836ab9fdd4d6a0be868 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Thu, 3 May 2018 18:04:38 +0200
Subject: l monitoring: use correct logstash url

---
 lass/2configs/monitoring/prometheus-server.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lass')

diff --git a/lass/2configs/monitoring/prometheus-server.nix b/lass/2configs/monitoring/prometheus-server.nix
index 1f9419e1a..e16d421a0 100644
--- a/lass/2configs/monitoring/prometheus-server.nix
+++ b/lass/2configs/monitoring/prometheus-server.nix
@@ -164,7 +164,7 @@
               ];
               "webhook_configs" = [
                 {
-                  "url" = "https://example.com/prometheus-alerts";
+                  "url" = "http://127.0.0.1:14813/prometheus-alerts";
                   "send_resolved" = true;
                 }
               ];
-- 
cgit v1.3.1


From 7330cce0d46f23036a42e19421ca3b59dc21f9cf Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Thu, 3 May 2018 18:21:39 +0200
Subject: l prism.r: add restic backups

---
 lass/1systems/prism/config.nix | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

(limited to 'lass')

diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index 89ea749c5..564315e8f 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -333,6 +333,31 @@ in {
         };
       };
     }
+    {
+      imports = [ <stockholm/lass/2configs/backup.nix> ];
+      lass.restic = genAttrs [
+        "daedalus"
+        "icarus"
+        "littleT"
+        "mors"
+        "shodan"
+        "skynet"
+      ] (dest: {
+        dirs = [
+          "/home/chat/.weechat"
+          "/bku/sql_dumps"
+        ];
+        passwordFile = (toString <secrets>) + "/restic/${dest}";
+        repo = "sftp:backup@${dest}.r:/backups/prism";
+        extraArguments = [
+          "sftp.command='ssh backup@${dest}.r -i ${config.krebs.build.host.ssh.privkey.path} -s sftp'"
+        ];
+        timerConfig = {
+          OnCalendar = "00:05";
+          RandomizedDelaySec = "5h";
+        };
+      });
+    }
   ];
 
   krebs.build.host = config.krebs.hosts.prism;
-- 
cgit v1.3.1


From 66b55d0a27327b5f0f6adf675a779f8d09e9c703 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Thu, 3 May 2018 18:33:11 +0200
Subject: l repo-sync: RIP web-routes-wai-custom

---
 lass/2configs/repo-sync.nix | 1 -
 1 file changed, 1 deletion(-)

(limited to 'lass')

diff --git a/lass/2configs/repo-sync.nix b/lass/2configs/repo-sync.nix
index ad44c67e1..1cf22552c 100644
--- a/lass/2configs/repo-sync.nix
+++ b/lass/2configs/repo-sync.nix
@@ -135,7 +135,6 @@ in {
     (sync-retiolum "populate")
     (sync-retiolum "stockholm")
     (sync-retiolum "wai-middleware-time")
-    (sync-retiolum "web-routes-wai-custom")
     (sync-retiolum "xmonad-stockholm")
   ];
 }
-- 
cgit v1.3.1