From 2a0cd63387049350f6de73f609a32a0bf4e49253 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Tue, 29 Dec 2015 20:21:06 +0100
Subject: l 2 baseX: add pkgs.dmenu

---
 lass/2configs/baseX.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'lass')

diff --git a/lass/2configs/baseX.nix b/lass/2configs/baseX.nix
index 0596682df..ede1c7b7b 100644
--- a/lass/2configs/baseX.nix
+++ b/lass/2configs/baseX.nix
@@ -31,6 +31,7 @@ in {
 
   environment.systemPackages = with pkgs; [
 
+    dmenu
     gitAndTools.qgit
     mpv
     much
-- 
cgit v1.2.3


From 35902b25e35b75f64a8ac01a6b5d0baea2d4154e Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Wed, 30 Dec 2015 02:04:43 +0100
Subject: l 2 base: checkout nixpkgs to /var/src/

---
 lass/2configs/base.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'lass')

diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix
index 66e12b262..4685e1713 100644
--- a/lass/2configs/base.nix
+++ b/lass/2configs/base.nix
@@ -51,6 +51,7 @@ with lib;
         git.nixpkgs = {
           url = https://github.com/Lassulus/nixpkgs;
           rev = "93d8671e2c6d1d25f126ed30e5e6f16764330119";
+          target-path = "/var/src/nixpkgs";
         };
         dir.secrets = {
           host = config.krebs.hosts.mors;
-- 
cgit v1.2.3


From 83555272fdcb6ab5ce968b08a90199c8aaeb460b Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Wed, 30 Dec 2015 02:05:14 +0100
Subject: l 2: add buildbot-standalone

---
 lass/2configs/buildbot-standalone.nix | 78 +++++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)
 create mode 100644 lass/2configs/buildbot-standalone.nix

(limited to 'lass')

diff --git a/lass/2configs/buildbot-standalone.nix b/lass/2configs/buildbot-standalone.nix
new file mode 100644
index 000000000..4d02fb97a
--- /dev/null
+++ b/lass/2configs/buildbot-standalone.nix
@@ -0,0 +1,78 @@
+{ lib, config, pkgs, ... }:
+{
+  #networking.firewall.allowedTCPPorts = [ 8010 9989 ];
+  krebs.buildbot.master = {
+    slaves = {
+      testslave = "lasspass";
+    };
+    change_source.stockholm = ''
+      stockholm_repo = 'http://cgit.mors/stockholm'
+      cs.append(changes.GitPoller(
+              stockholm_repo,
+              workdir='stockholm-poller', branch='master',
+              project='stockholm',
+              pollinterval=120))
+    '';
+    scheduler = {
+      force-scheduler = ''
+        sched.append(schedulers.ForceScheduler(
+                                    name="force",
+                                    builderNames=["fast-tests"]))
+      '';
+      fast-tests-scheduler = ''
+        # test the master real quick
+        sched.append(schedulers.SingleBranchScheduler(
+                                    change_filter=util.ChangeFilter(branch="master"),
+                                    name="fast-master-test",
+                                    builderNames=["fast-tests"]))
+      '';
+    };
+    builder_pre = ''
+      # prepare grab_repo step for stockholm
+      grab_repo = steps.Git(repourl=stockholm_repo, mode='incremental')
+
+      env = {"LOGNAME": "lass", "NIX_REMOTE": "daemon"}
+
+      # prepare nix-shell
+      # the dependencies which are used by the test script
+      deps = [ "gnumake", "jq","nix","rsync" ]
+      # TODO: --pure , prepare ENV in nix-shell command:
+      #                   SSL_CERT_FILE,LOGNAME,NIX_REMOTE
+      nixshell = ["nix-shell", "-I", "stockholm=.", "-p" ] + deps + [ "--run" ]
+
+      # prepare addShell function
+      def addShell(factory,**kwargs):
+        factory.addStep(steps.ShellCommand(**kwargs))
+    '';
+    builder = {
+      fast-tests = ''
+        f = util.BuildFactory()
+        f.addStep(grab_repo)
+        addShell(f,name="mors-eval",env=env,
+                  command=nixshell + ["make -s eval get=krebs.deploy filter=json system=mors"])
+
+        bu.append(util.BuilderConfig(name="fast-tests",
+              slavenames=slavenames,
+              factory=f))
+      '';
+    };
+    enable = true;
+    web.enable = true;
+    irc = {
+      enable = true;
+      nick = "lass-buildbot";
+      server = "cd.retiolum";
+      channels = [ "retiolum" ];
+      allowForce = true;
+    };
+  };
+
+  krebs.buildbot.slave = {
+    enable = true;
+    masterhost = "localhost";
+    username = "testslave";
+    password = "lasspass";
+    packages = with pkgs;[ git nix ];
+    extraEnviron = { NIX_PATH="nixpkgs=${toString <nixpkgs>}"; };
+  };
+}
-- 
cgit v1.2.3


From f16742895c26b0f3df71ca8503afc5f4cb97a9ae Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Wed, 30 Dec 2015 17:14:31 +0100
Subject: l: add new host dishfire

---
 lass/1systems/dishfire.nix | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 lass/1systems/dishfire.nix

(limited to 'lass')

diff --git a/lass/1systems/dishfire.nix b/lass/1systems/dishfire.nix
new file mode 100644
index 000000000..a1288d578
--- /dev/null
+++ b/lass/1systems/dishfire.nix
@@ -0,0 +1,43 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
+    ../2configs/base.nix
+    {
+      boot.loader.grub = {
+        device = "/dev/vda";
+        splashImage = null;
+      };
+
+      boot.initrd.availableKernelModules = [
+        "ata_piix"
+        "ehci_pci"
+        "uhci_hcd"
+        "virtio_pci"
+        "virtio_blk"
+      ];
+
+      fileSystems."/" = {
+        device = "/dev/mapper/pool-nix";
+        fsType = "ext4";
+      };
+
+      fileSystems."/boot" = {
+        device = "/dev/vda1";
+        fsType = "ext4";
+      };
+    }
+    {
+      networking.dhcpcd.allowInterfaces = [
+        "enp*"
+        "eth*"
+      ];
+    }
+    {
+      sound.enable = false;
+    }
+  ];
+
+  krebs.build.host = config.krebs.hosts.dishfire;
+}
-- 
cgit v1.2.3


From 93a652d1e816d9ecdcf9af5e413cd180c54a5981 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sun, 17 Jan 2016 13:08:38 +0100
Subject: l 1 uriel: activate skype

---
 lass/1systems/uriel.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'lass')

diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix
index 1b008cbfd..d53e783d0 100644
--- a/lass/1systems/uriel.nix
+++ b/lass/1systems/uriel.nix
@@ -13,6 +13,7 @@ with builtins;
     ../2configs/retiolum.nix
     ../2configs/bitlbee.nix
     ../2configs/weechat.nix
+    ../2configs/skype.nix
     {
       users.extraUsers = {
         root = {
-- 
cgit v1.2.3


From 4ce4b0053fde81608a8f2e3ecb2888a71203801b Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sun, 17 Jan 2016 13:09:10 +0100
Subject: l 2 base: nixpkgs rev 93d8671 -> d0e3cca

---
 lass/2configs/base.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lass')

diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix
index 4685e1713..eca3becd6 100644
--- a/lass/2configs/base.nix
+++ b/lass/2configs/base.nix
@@ -50,7 +50,7 @@ with lib;
       source = {
         git.nixpkgs = {
           url = https://github.com/Lassulus/nixpkgs;
-          rev = "93d8671e2c6d1d25f126ed30e5e6f16764330119";
+          rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce";
           target-path = "/var/src/nixpkgs";
         };
         dir.secrets = {
-- 
cgit v1.2.3


From c6cec0234b5543d23e2b8afe9b2340395de8184c Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sun, 17 Jan 2016 13:10:14 +0100
Subject: l 2 base: CVE-2016-0778 workaround

---
 lass/2configs/base.nix | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'lass')

diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix
index eca3becd6..ab7cda7d3 100644
--- a/lass/2configs/base.nix
+++ b/lass/2configs/base.nix
@@ -177,4 +177,10 @@ with lib;
     noipv4ll
   '';
 
+  #CVE-2016-0777 and CVE-2016-0778 workaround
+  #https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-0778/openssh-cve-2016-0777-cve-2016-0778.txt
+  programs.ssh.extraConfig = ''
+    UseRoaming no
+  '';
+
 }
-- 
cgit v1.2.3


From 688db8b46d0d6c697ed8970a018a94dd9cfb41fe Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sun, 17 Jan 2016 13:11:10 +0100
Subject: l 2 git: add miefda to allowed users

---
 lass/2configs/git.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lass')

diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix
index 16ecaefec..10e54074c 100644
--- a/lass/2configs/git.nix
+++ b/lass/2configs/git.nix
@@ -74,7 +74,7 @@ let
         perm = push "refs/*" [ non-fast-forward create delete merge ];
       } ++
       optional repo.public {
-        user = [ tv makefu uriel ];
+        user = [ tv makefu miefda uriel ];
         repo = [ repo ];
         perm = fetch;
       } ++
-- 
cgit v1.2.3


From 63910263ccaf2f18bd83ed6e5d49301601ba53e1 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sun, 17 Jan 2016 13:12:17 +0100
Subject: l 1 mors: activate buildbot

---
 lass/1systems/mors.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'lass')

diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index 61f57f1f9..effaa576b 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -25,6 +25,7 @@
     ../2configs/teamviewer.nix
     ../2configs/libvirt.nix
     ../2configs/fetchWallpaper.nix
+    ../2configs/buildbot-standalone.nix
     {
       #risk of rain port
       krebs.iptables.tables.filter.INPUT.rules = [
-- 
cgit v1.2.3


From 186d5cc95a7430136da3107734409511c64d7080 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Tue, 19 Jan 2016 19:59:53 +0100
Subject: l 2 bitcoin: add sudo config

---
 lass/2configs/bitcoin.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'lass')

diff --git a/lass/2configs/bitcoin.nix b/lass/2configs/bitcoin.nix
index d3bccbf5c..2f4cd5710 100644
--- a/lass/2configs/bitcoin.nix
+++ b/lass/2configs/bitcoin.nix
@@ -1,6 +1,8 @@
 { config, pkgs, ... }:
 
-{
+let
+  mainUser = config.users.extraUsers.mainUser;
+in {
   environment.systemPackages = with pkgs; [
     electrum
   ];
@@ -14,4 +16,7 @@
       createHome = true;
     };
   };
+  security.sudo.extraConfig = ''
+    ${mainUser.name} ALL=(bitcoin) NOPASSWD: ALL
+  '';
 }
-- 
cgit v1.2.3


From 314d0bd691d81386e1ff5c99faa04f035694ebb2 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 1 Feb 2016 15:45:30 +0100
Subject: l 1 mors: remove redundant retiolum import

---
 lass/1systems/mors.nix | 1 -
 1 file changed, 1 deletion(-)

(limited to 'lass')

diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index effaa576b..86a34a637 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -17,7 +17,6 @@
     #../2configs/ircd.nix
     ../2configs/chromium-patched.nix
     ../2configs/git.nix
-    ../2configs/retiolum.nix
     #../2configs/wordpress.nix
     ../2configs/bitlbee.nix
     ../2configs/firefoxPatched.nix
-- 
cgit v1.2.3


From e3806dfa40d61eb70b543ba34758b1c8a4d11aef Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 1 Feb 2016 15:54:43 +0100
Subject: l 2: give helios & uriel more access

---
 lass/2configs/base.nix | 5 +++--
 lass/2configs/git.nix  | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)

(limited to 'lass')

diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix
index ab7cda7d3..5505da67f 100644
--- a/lass/2configs/base.nix
+++ b/lass/2configs/base.nix
@@ -17,7 +17,8 @@ with lib;
         root = {
           openssh.authorizedKeys.keys = [
             config.krebs.users.lass.pubkey
-            config.krebs.users.uriel.pubkey
+            config.krebs.users.lass_uriel.pubkey
+            config.krebs.users.lass_helios.pubkey
           ];
         };
         mainUser = {
@@ -31,7 +32,7 @@ with lib;
           ];
           openssh.authorizedKeys.keys = [
             config.krebs.users.lass.pubkey
-            config.krebs.users.uriel.pubkey
+            config.krebs.users.lass_uriel.pubkey
           ];
         };
       };
diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix
index 10e54074c..2d8ee95dd 100644
--- a/lass/2configs/git.nix
+++ b/lass/2configs/git.nix
@@ -69,12 +69,12 @@ let
     with git // config.krebs.users;
     repo:
       singleton {
-        user = lass;
+        user = [ lass lass_helios lass_uriel ];
         repo = [ repo ];
         perm = push "refs/*" [ non-fast-forward create delete merge ];
       } ++
       optional repo.public {
-        user = [ tv makefu miefda uriel ];
+        user = [ tv makefu miefda ];
         repo = [ repo ];
         perm = fetch;
       } ++
-- 
cgit v1.2.3


From 55b99a6c056b28be7601d7f56fab5a08a181ea29 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 1 Feb 2016 15:55:41 +0100
Subject: l: add helios as new system

---
 lass/1systems/helios.nix | 72 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100644 lass/1systems/helios.nix

(limited to 'lass')

diff --git a/lass/1systems/helios.nix b/lass/1systems/helios.nix
new file mode 100644
index 000000000..93b24c793
--- /dev/null
+++ b/lass/1systems/helios.nix
@@ -0,0 +1,72 @@
+{ config, pkgs, ... }:
+
+with builtins;
+{
+  imports = [
+    ../2configs/baseX.nix
+    ../2configs/browsers.nix
+    ../2configs/programs.nix
+    #{
+    #  users.extraUsers = {
+    #    root = {
+    #      openssh.authorizedKeys.keys = map readFile [
+    #        ../../krebs/Zpubkeys/uriel.ssh.pub
+    #      ];
+    #    };
+    #  };
+    #}
+  ];
+
+  krebs.build.host = config.krebs.hosts.helios;
+
+  networking.wireless.enable = true;
+
+  hardware.enableAllFirmware = true;
+  nixpkgs.config.allowUnfree = true;
+
+  boot = {
+    loader.grub.enable = true;
+    loader.grub.version = 2;
+    loader.grub.device = "/dev/sda";
+
+    initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; } ];
+    initrd.luks.cryptoModules = [ "aes" "sha512" "sha1" "xts" ];
+    initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
+    #kernelModules = [ "kvm-intel" "msr" ];
+    kernelModules = [ "msr" ];
+  };
+  fileSystems = {
+    "/" = {
+      device = "/dev/pool/nix";
+      fsType = "ext4";
+    };
+
+    "/boot" = {
+      device = "/dev/sda1";
+    };
+  };
+
+  #services.udev.extraRules = ''
+  #  SUBSYSTEM=="net", ATTR{address}=="64:27:37:7d:d8:ae", NAME="wl0"
+  #  SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:b8:c8:2e", NAME="et0"
+  #'';
+
+  services.xserver = {
+    videoDriver = "intel";
+    vaapiDrivers = [ pkgs.vaapiIntel ];
+    deviceSection = ''
+      Option "AccelMethod" "sna"
+      BusID "PCI:0:2:0"
+    '';
+  };
+
+  services.xserver.synaptics = {
+    enable = true;
+    twoFingerScroll = true;
+    accelFactor = "0.035";
+    additionalOptions = ''
+      Option "FingerHigh" "60"
+      Option "FingerLow"  "60"
+    '';
+  };
+}
-- 
cgit v1.2.3


From 87c8d7830fb09d9e956308396018d5a00509cbf3 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 1 Feb 2016 15:56:24 +0100
Subject: l 1 mors: update nginx tests

---
 lass/1systems/mors.nix | 91 ++++++++++++++++++++++++++++++--------------------
 1 file changed, 55 insertions(+), 36 deletions(-)

(limited to 'lass')

diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index 86a34a637..d0aae6dbb 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -32,51 +32,70 @@
       ];
     }
     {
-      #wordpress-test
-      #imports = singleton (sitesGenerators.createWordpress "testserver.de");
+      #static-nginx-test
       imports = [
-        ../3modules/wordpress_nginx.nix
+        ../3modules/static_nginx.nix
       ];
-      lass.wordpress."testserver.de" = {
-        multiSite = {
-          "1" = "testserver.de";
-          "2" = "bla.testserver.de";
+      lass.staticPage."testserver.de" = {
+        #sslEnable = true;
+        #certificate = "${toString <secrets>}/testserver.de/server.cert";
+        #certificate_key = "${toString <secrets>}/testserver.de/server.pem";
+        ssl = {
+          enable = true;
+          certificate = "${toString <secrets>}/testserver.de/server.cert";
+          certificate_key = "${toString <secrets>}/testserver.de/server.pem";
         };
       };
-
-      services.mysql = {
-        enable = true;
-        package = pkgs.mariadb;
-        rootPassword = "<secrets>/mysql_rootPassword";
-      };
       networking.extraHosts = ''
         10.243.0.2 testserver.de
       '';
-      krebs.iptables.tables.filter.INPUT.rules = [
-        { predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; precedence = 9998; }
-      ];
     }
-    {
-      #owncloud-test
-      #imports = singleton (sitesGenerators.createWordpress "testserver.de");
-      imports = [
-        ../3modules/owncloud_nginx.nix
-      ];
-      lass.owncloud."owncloud-test.de" = {
-      };
+    #{
+    #  #wordpress-test
+    #  #imports = singleton (sitesGenerators.createWordpress "testserver.de");
+    #  imports = [
+    #    ../3modules/wordpress_nginx.nix
+    #  ];
+    #  lass.wordpress."testserver.de" = {
+    #    multiSite = {
+    #      "1" = "testserver.de";
+    #      "2" = "bla.testserver.de";
+    #    };
+    #  };
 
-      #services.mysql = {
-      #  enable = true;
-      #  package = pkgs.mariadb;
-      #  rootPassword = "<secrets>/mysql_rootPassword";
-      #};
-      networking.extraHosts = ''
-        10.243.0.2 owncloud-test.de
-      '';
-      krebs.iptables.tables.filter.INPUT.rules = [
-        { predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; precedence = 9998; }
-      ];
-    }
+    #  services.mysql = {
+    #    enable = true;
+    #    package = pkgs.mariadb;
+    #    rootPassword = "<secrets>/mysql_rootPassword";
+    #  };
+    #  networking.extraHosts = ''
+    #    10.243.0.2 testserver.de
+    #  '';
+    #  krebs.iptables.tables.filter.INPUT.rules = [
+    #    { predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; precedence = 9998; }
+    #  ];
+    #}
+    #{
+    #  #owncloud-test
+    #  #imports = singleton (sitesGenerators.createWordpress "testserver.de");
+    #  imports = [
+    #    ../3modules/owncloud_nginx.nix
+    #  ];
+    #  lass.owncloud."owncloud-test.de" = {
+    #  };
+
+    #  #services.mysql = {
+    #  #  enable = true;
+    #  #  package = pkgs.mariadb;
+    #  #  rootPassword = "<secrets>/mysql_rootPassword";
+    #  #};
+    #  networking.extraHosts = ''
+    #    10.243.0.2 owncloud-test.de
+    #  '';
+    #  krebs.iptables.tables.filter.INPUT.rules = [
+    #    { predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; precedence = 9998; }
+    #  ];
+    #}
   ];
 
   krebs.build.host = config.krebs.hosts.mors;
-- 
cgit v1.2.3


From 8efbd093537de1e419b0c193b6aa2a262ae1f4c3 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 1 Feb 2016 15:57:54 +0100
Subject: l 2 buildbot-sta..: change name to buildbot-lass

---
 lass/2configs/buildbot-standalone.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lass')

diff --git a/lass/2configs/buildbot-standalone.nix b/lass/2configs/buildbot-standalone.nix
index 4d02fb97a..8c71553fe 100644
--- a/lass/2configs/buildbot-standalone.nix
+++ b/lass/2configs/buildbot-standalone.nix
@@ -60,7 +60,7 @@
     web.enable = true;
     irc = {
       enable = true;
-      nick = "lass-buildbot";
+      nick = "buildbot-lass";
       server = "cd.retiolum";
       channels = [ "retiolum" ];
       allowForce = true;
-- 
cgit v1.2.3


From cebb19ca9e412cd355638d0fbf028eba3b721bfa Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 1 Feb 2016 15:58:35 +0100
Subject: l 2 websites wohnprojekt: add laura user

---
 lass/2configs/websites/wohnprojekt-rhh.de.nix | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'lass')

diff --git a/lass/2configs/websites/wohnprojekt-rhh.de.nix b/lass/2configs/websites/wohnprojekt-rhh.de.nix
index cd31450c5..ac784d4c7 100644
--- a/lass/2configs/websites/wohnprojekt-rhh.de.nix
+++ b/lass/2configs/websites/wohnprojekt-rhh.de.nix
@@ -8,5 +8,11 @@
   lass.staticPage = {
     "wohnprojekt-rhh.de" = {};
   };
+
+  users.users.laura = {
+    home = "/srv/http/wohnprojekt-rhh.de";
+    createHome = true;
+    useDefaultShell = true;
+  };
 }
 
-- 
cgit v1.2.3


From 77eaa656683dbe84bd66c4e7bc84670d836ed379 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 1 Feb 2016 15:58:53 +0100
Subject: l 2 newsbot-js: disable truther feed

---
 lass/2configs/newsbot-js.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lass')

diff --git a/lass/2configs/newsbot-js.nix b/lass/2configs/newsbot-js.nix
index 74d09b7fa..4482c4e9d 100644
--- a/lass/2configs/newsbot-js.nix
+++ b/lass/2configs/newsbot-js.nix
@@ -161,7 +161,7 @@ let
     torrentfreak|http://feeds.feedburner.com/Torrentfreak|#news
     torr_news|http://feed.torrentfreak.com/Torrentfreak/|#news
     travel_warnings|http://feeds.travel.state.gov/ca/travelwarnings-alerts|#news
-    truther|http://truthernews.wordpress.com/feed/|#news
+    #truther|http://truthernews.wordpress.com/feed/|#news
     un_afr|http://www.un.org/apps/news/rss/rss_africa.asp|#news
     un_am|http://www.un.org/apps/news/rss/rss_americas.asp|#news
     un_eu|http://www.un.org/apps/news/rss/rss_europe.asp|#news
-- 
cgit v1.2.3


From 7d6d0a46643f66b18aa9480df6bb88391924f262 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 1 Feb 2016 16:01:48 +0100
Subject: l 2 xserver: copy default.nix from tv

---
 lass/2configs/xserver/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

(limited to 'lass')

diff --git a/lass/2configs/xserver/default.nix b/lass/2configs/xserver/default.nix
index 04d14c7ce..d351fcf19 100644
--- a/lass/2configs/xserver/default.nix
+++ b/lass/2configs/xserver/default.nix
@@ -44,7 +44,7 @@ let
       "slock"
     ];
 
-    systemd.services.display-manager = mkForce {};
+    systemd.services.display-manager.enable = false;
 
     services.xserver.enable = true;
 
@@ -93,9 +93,10 @@ let
   xmonad-start = pkgs.writeScriptBin "xmonad" ''
     #! ${pkgs.bash}/bin/bash
     set -efu
-    export PATH; PATH=${makeSearchPath "bin" ([
+    export PATH; PATH=${makeSearchPath "bin" [
+      pkgs.alsaUtils
       pkgs.rxvt_unicode
-    ] ++ config.environment.systemPackages)}:/var/setuid-wrappers
+    ]}:/var/setuid-wrappers
     settle() {(
       # Use PATH for a clean journal
       command=''${1##*/}
-- 
cgit v1.2.3


From 45343b1e14a3fd2f581465d3e78adac372918a0c Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 1 Feb 2016 16:03:03 +0100
Subject: l 3 *_nginx: allow configuration of ssl

---
 lass/3modules/owncloud_nginx.nix  | 29 +++++++++++++++++++++++---
 lass/3modules/static_nginx.nix    | 44 ++++++++++++++++++++++++++++++++++++++-
 lass/3modules/wordpress_nginx.nix | 29 +++++++++++++++++++++++++-
 3 files changed, 97 insertions(+), 5 deletions(-)

(limited to 'lass')

diff --git a/lass/3modules/owncloud_nginx.nix b/lass/3modules/owncloud_nginx.nix
index 0cb11846c..79c9de1d4 100644
--- a/lass/3modules/owncloud_nginx.nix
+++ b/lass/3modules/owncloud_nginx.nix
@@ -46,8 +46,22 @@ let
           type = str;
         };
         ssl = mkOption {
-          type = bool;
-          default = false;
+          type = with types; submodule ({
+            options = {
+              enable = mkEnableOption "ssl";
+              certificate = mkOption {
+                type = str;
+              };
+              certificate_key = mkOption {
+                type = str;
+              };
+              ciphers = mkOption {
+                type = str;
+                default = "AES128+EECDH:AES128+EDH";
+              };
+            };
+          });
+          default = {};
         };
       };
     }));
@@ -58,7 +72,7 @@ let
   group = config.services.nginx.group;
 
   imp = {
-    krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, ... }: {
+    krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, ssl, ... }: {
       server-names = [
         "${domain}"
         "www.${domain}"
@@ -102,7 +116,16 @@ let
 
         error_page 403 /core/templates/403.php;
         error_page 404 /core/templates/404.php;
+        ${if ssl.enable then ''
+          ssl_certificate ${ssl.certificate};
+          ssl_certificate_key ${ssl.certificate_key};
+        '' else ""}
       '';
+      listen = (if ssl.enable then
+          [ "80" "443 ssl" ]
+        else
+          "80"
+      );
     });
     services.phpfpm.poolConfigs = flip mapAttrs cfg (name: { domain, folder, ... }: ''
       listen = ${folder}/phpfpm.pool
diff --git a/lass/3modules/static_nginx.nix b/lass/3modules/static_nginx.nix
index cc2641af2..fd5cfdfd7 100644
--- a/lass/3modules/static_nginx.nix
+++ b/lass/3modules/static_nginx.nix
@@ -21,6 +21,35 @@ let
           type = str;
           default = "/srv/http/${config.domain}";
         };
+        #sslEnable = mkEnableOption "ssl";
+        #certificate = mkOption {
+        #  type = str;
+        #};
+        #certificate_key = mkOption {
+        #  type = str;
+        #};
+        #ciphers = mkOption {
+        #  type = str;
+        #  default = "AES128+EECDH:AES128+EDH";
+        #};
+        ssl = mkOption {
+          type = with types; submodule ({
+            options = {
+              enable = mkEnableOption "ssl";
+              certificate = mkOption {
+                type = str;
+              };
+              certificate_key = mkOption {
+                type = str;
+              };
+              ciphers = mkOption {
+                type = str;
+                default = "AES128+EECDH:AES128+EDH";
+              };
+            };
+          });
+          default = {};
+        };
       };
     }));
     default = {};
@@ -29,8 +58,10 @@ let
   user = config.services.nginx.user;
   group = config.services.nginx.group;
 
+  external-ip = head config.krebs.build.host.nets.internet.addrs4;
+
   imp = {
-    krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, ... }: {
+    krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, ssl, ... }: {
       server-names = [
         "${domain}"
         "www.${domain}"
@@ -43,6 +74,17 @@ let
           deny all;
         '')
       ];
+
+      listen = (if ssl.enable then
+          [ "80" "443 ssl" ]
+        else
+          "80"
+      );
+      extraConfig = (if ssl.enable then ''
+        ssl_certificate ${ssl.certificate};
+        ssl_certificate_key ${ssl.certificate_key};
+      '' else "");
+
     });
   };
 
diff --git a/lass/3modules/wordpress_nginx.nix b/lass/3modules/wordpress_nginx.nix
index 974aacd83..bfed9e7c6 100644
--- a/lass/3modules/wordpress_nginx.nix
+++ b/lass/3modules/wordpress_nginx.nix
@@ -53,6 +53,23 @@ let
             "1" = "test.testsite.de";
           };
         };
+        ssl = mkOption {
+          type = with types; submodule ({
+            options = {
+              enable = mkEnableOption "ssl";
+              certificate = mkOption {
+                type = str;
+              };
+              certificate_key = mkOption {
+                type = str;
+              };
+              ciphers = mkOption {
+                type = str;
+                default = "AES128+EECDH:AES128+EDH";
+              };
+            };
+          });
+        };
       };
     }));
     default = {};
@@ -68,7 +85,7 @@ let
     #  }
     #'';
 
-    krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, multiSite, ... }: {
+    krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, multiSite, ssl, ... }: {
       server-names = [
         "${domain}"
         "www.${domain}"
@@ -114,7 +131,17 @@ let
         error_log /tmp/nginx_err.log;
         error_page 404 /404.html;
         error_page 500 502 503 504 /50x.html;
+        ${if ssl.enable then ''
+          ssl_certificate ${ssl.certificate};
+          ssl_certificate_key ${ssl.certificate_key};
+        '' else ""}
+
       '';
+      listen = (if ssl.enable then
+          [ "80" "443 ssl" ]
+        else
+          "80"
+      );
     });
     services.phpfpm.poolConfigs = flip mapAttrs cfg (name: { domain, folder, ... }: ''
       listen = ${folder}/phpfpm.pool
-- 
cgit v1.2.3


From 8beca9b31177183bfec031c6d0a947a1c99fc497 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 1 Feb 2016 16:04:05 +0100
Subject: l: add fritz websites to dishfire

---
 lass/1systems/dishfire.nix       |  1 +
 lass/2configs/websites/fritz.nix | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+)
 create mode 100644 lass/2configs/websites/fritz.nix

(limited to 'lass')

diff --git a/lass/1systems/dishfire.nix b/lass/1systems/dishfire.nix
index a1288d578..0e650bfad 100644
--- a/lass/1systems/dishfire.nix
+++ b/lass/1systems/dishfire.nix
@@ -4,6 +4,7 @@
   imports = [
     <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
     ../2configs/base.nix
+    ../2configs/websites/fritz.nix
     {
       boot.loader.grub = {
         device = "/dev/vda";
diff --git a/lass/2configs/websites/fritz.nix b/lass/2configs/websites/fritz.nix
new file mode 100644
index 000000000..073f3de14
--- /dev/null
+++ b/lass/2configs/websites/fritz.nix
@@ -0,0 +1,33 @@
+{ config, pkgs, ... }:
+
+{
+
+  imports = [
+    ../../3modules/static_nginx.nix
+    ../../3modules/owncloud_nginx.nix
+    ../../3modules/wordpress_nginx.nix
+  ];
+
+  lass.staticPage = {
+    "biostase.de" = {};
+    "gs-maubach.de" = {};
+    "spielwaren-kern.de" = {};
+    "societyofsimtech.de" = {};
+    "ttf-kleinaspach.de" = {};
+    "edsn.de" = {};
+    "eab.berkeley.edu" = {};
+    "habsys.de" = {};
+  };
+
+  #lass.owncloud = {
+  #  "o.ubikmedia.de" = {
+  #    instanceid = "oc8n8ddbftgh";
+  #  };
+  #};
+
+  #services.mysql = {
+  #  enable = true;
+  #  package = pkgs.mariadb;
+  #  rootPassword = toString (<secrets/mysql_rootPassword>);
+  #};
+}
-- 
cgit v1.2.3


From 04d14aac7670e37c633565fad8e15e46b74b0eb6 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 1 Feb 2016 16:10:02 +0100
Subject: l 1 helios: import git.nix

---
 lass/1systems/helios.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'lass')

diff --git a/lass/1systems/helios.nix b/lass/1systems/helios.nix
index 93b24c793..67e3738ea 100644
--- a/lass/1systems/helios.nix
+++ b/lass/1systems/helios.nix
@@ -6,6 +6,7 @@ with builtins;
     ../2configs/baseX.nix
     ../2configs/browsers.nix
     ../2configs/programs.nix
+    ../2configs/git.nix
     #{
     #  users.extraUsers = {
     #    root = {
-- 
cgit v1.2.3


From 138bdc6bf6a18a59cf47d2d2db7c4e7640f50641 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 1 Feb 2016 16:18:36 +0100
Subject: l 1 dishfire: import git.nix

---
 lass/1systems/dishfire.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'lass')

diff --git a/lass/1systems/dishfire.nix b/lass/1systems/dishfire.nix
index 0e650bfad..cc9836dff 100644
--- a/lass/1systems/dishfire.nix
+++ b/lass/1systems/dishfire.nix
@@ -4,6 +4,7 @@
   imports = [
     <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
     ../2configs/base.nix
+    ../2configs/git.nix
     ../2configs/websites/fritz.nix
     {
       boot.loader.grub = {
-- 
cgit v1.2.3


From 57d8a9ed20ab3150bd98b2437e3a966cda5c670f Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sat, 6 Feb 2016 19:26:51 +0100
Subject: l 1 mors: pkgs.cac -> pkgs.cac-api

---
 lass/1systems/mors.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lass')

diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index d0aae6dbb..ebce93957 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -226,7 +226,7 @@
   };
 
   environment.systemPackages = with pkgs; [
-    cac
+    cac-api
     sshpass
     get
     teamspeak_client
-- 
cgit v1.2.3


From f73feaccd7a28d06d1d62d08795574b232f0c8b9 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sat, 6 Feb 2016 19:28:07 +0100
Subject: l 2 base: krebs.source adapt to api change

---
 lass/2configs/base.nix | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

(limited to 'lass')

diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix
index 5505da67f..6dceace18 100644
--- a/lass/2configs/base.nix
+++ b/lass/2configs/base.nix
@@ -48,21 +48,21 @@ with lib;
     exim-retiolum.enable = true;
     build = {
       user = config.krebs.users.lass;
-      source = {
-        git.nixpkgs = {
+      source = mapAttrs (_: mkDefault) ({
+        nixos-config = "symlink:stockholm/lass/1systems/${config.krebs.build.host.name}.nix";
+        nixpkgs = symlink:stockholm/nixpkgs;
+        secrets = "/home/lass/secrets/${config.krebs.build.host.name}";
+        #secrets-common = "/home/lass/secrets/common";
+        stockholm = "/home/lass/stockholm";
+        stockholm-user = "symlink:stockholm/lass";
+        upstream-nixpkgs = {
           url = https://github.com/Lassulus/nixpkgs;
           rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce";
-          target-path = "/var/src/nixpkgs";
+          dev = "/home/lass/src/nixpkgs";
         };
-        dir.secrets = {
-          host = config.krebs.hosts.mors;
-          path = "/home/lass/secrets/${config.krebs.build.host.name}";
-        };
-        dir.stockholm = {
-          host = config.krebs.hosts.mors;
-          path = "/home/lass/stockholm";
-        };
-      };
+      } // optionalAttrs config.krebs.build.host.secure {
+        #secrets-master = "/home/lass/secrets/master";
+      });
     };
   };
 
-- 
cgit v1.2.3


From d98a8c0be822655da317e101e26f2063a20b910c Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sat, 6 Feb 2016 19:28:56 +0100
Subject: l 2 base: require pkgs.proot for stockholm

---
 lass/2configs/base.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'lass')

diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix
index 6dceace18..7212698bb 100644
--- a/lass/2configs/base.nix
+++ b/lass/2configs/base.nix
@@ -91,6 +91,7 @@ with lib;
     git
     jq
     parallel
+    proot
 
   #style
     most
-- 
cgit v1.2.3


From 3dacf4626f12c32a100ee032a14ad72f98fe6a70 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sat, 6 Feb 2016 19:29:21 +0100
Subject: l 2 browsers: don't import per-user.nix

---
 lass/2configs/browsers.nix | 2 --
 1 file changed, 2 deletions(-)

(limited to 'lass')

diff --git a/lass/2configs/browsers.nix b/lass/2configs/browsers.nix
index d36801863..61016fed0 100644
--- a/lass/2configs/browsers.nix
+++ b/lass/2configs/browsers.nix
@@ -54,8 +54,6 @@ in {
   ];
 
   imports = [
-    ../3modules/per-user.nix
-  ] ++ [
     ( createFirefoxUser "ff" [ "audio" ] [ ] )
     ( createChromiumUser "cr" [ "audio" ] [ pkgs.chromium ] )
     ( createChromiumUser "fb" [ ] [ pkgs.chromium ] )
-- 
cgit v1.2.3


From 5856d240888e89dbed141087c9580026f52dff59 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sat, 6 Feb 2016 19:32:34 +0100
Subject: l 2 xserver: add pulseaudio to xserver deps

---
 lass/2configs/xserver/default.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'lass')

diff --git a/lass/2configs/xserver/default.nix b/lass/2configs/xserver/default.nix
index d351fcf19..c407bb59e 100644
--- a/lass/2configs/xserver/default.nix
+++ b/lass/2configs/xserver/default.nix
@@ -95,6 +95,7 @@ let
     set -efu
     export PATH; PATH=${makeSearchPath "bin" [
       pkgs.alsaUtils
+      pkgs.pulseaudioLight
       pkgs.rxvt_unicode
     ]}:/var/setuid-wrappers
     settle() {(
-- 
cgit v1.2.3