From f6a4131daecd6e5c1a0727adbcac43ba8530ec13 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:13:46 +0100
Subject: tv exim-retiolum: init

---
 tv/1systems/nomic.nix | 7 +------
 tv/1systems/wu.nix    | 5 +----
 tv/1systems/xu.nix    | 8 +-------
 3 files changed, 3 insertions(+), 17 deletions(-)

(limited to 'tv/1systems')

diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 7bc7b70d2..145e9b236 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -5,11 +5,9 @@ with lib;
 {
   krebs.build.host = config.krebs.hosts.nomic;
 
-  krebs.build.target = "root@nomic.gg23";
-
   imports = [
     ../2configs/hw/AO753.nix
-    #../2configs/consul-server.nix
+    ../2configs/exim-retiolum.nix
     ../2configs/git.nix
     ../2configs/pulse.nix
     ../2configs/xserver
@@ -24,9 +22,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.exim-retiolum.enable = true;
-    }
     {
       krebs.nginx = {
         enable = true;
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 3bdf8d37a..47fdb2092 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -7,7 +7,7 @@ with lib;
 
   imports = [
     ../2configs/hw/w110er.nix
-    #../2configs/consul-client.nix
+    ../2configs/exim-retiolum.nix
     ../2configs/git.nix
     ../2configs/mail-client.nix
     ../2configs/pulse.nix
@@ -134,9 +134,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.exim-retiolum.enable = true;
-    }
     {
       krebs.nginx = {
         enable = true;
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index e6894b55e..12c115eb8 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -5,12 +5,9 @@ with lib;
 {
   krebs.build.host = config.krebs.hosts.xu;
 
-  krebs.build.source.git.nixpkgs.rev =
-    "7ae05edcdd14f6ace83ead9bf0d114e97c89a83a";
-
   imports = [
     ../2configs/hw/x220.nix
-    #../2configs/consul-client.nix
+    ../2configs/exim-retiolum.nix
     ../2configs/git.nix
     ../2configs/mail-client.nix
     ../2configs/pulse.nix
@@ -135,9 +132,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.exim-retiolum.enable = true;
-    }
     {
       krebs.nginx = {
         enable = true;
-- 
cgit v1.3.1


From a7e1709a466cee24783e20b6219ef5112b00e8c9 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:18:07 +0100
Subject: tv nginx-public_html: init

---
 tv/1systems/nomic.nix             | 11 +----------
 tv/1systems/wu.nix                | 11 +----------
 tv/1systems/xu.nix                | 11 +----------
 tv/2configs/nginx-public_html.nix | 14 ++++++++++++++
 4 files changed, 17 insertions(+), 30 deletions(-)
 create mode 100644 tv/2configs/nginx-public_html.nix

(limited to 'tv/1systems')

diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 145e9b236..64fe5a635 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -9,6 +9,7 @@ with lib;
     ../2configs/hw/AO753.nix
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
+    ../2configs/nginx-public_html.nix
     ../2configs/pulse.nix
     ../2configs/xserver
     {
@@ -22,16 +23,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.nginx = {
-        enable = true;
-        servers.default.locations = [
-          (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
-            alias /home/$1/public_html$2;
-          '')
-        ];
-      };
-    }
     {
       krebs.retiolum = {
         enable = true;
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 47fdb2092..6dd051210 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -10,6 +10,7 @@ with lib;
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
     ../2configs/mail-client.nix
+    ../2configs/nginx-public_html.nix
     ../2configs/pulse.nix
     ../2configs/xserver
     {
@@ -134,16 +135,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.nginx = {
-        enable = true;
-        servers.default.locations = [
-          (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
-            alias /home/$1/public_html$2;
-          '')
-        ];
-      };
-    }
     {
       krebs.retiolum = {
         enable = true;
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 12c115eb8..409129581 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -10,6 +10,7 @@ with lib;
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
     ../2configs/mail-client.nix
+    ../2configs/nginx-public_html.nix
     ../2configs/pulse.nix
     ../2configs/xserver
     {
@@ -132,16 +133,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.nginx = {
-        enable = true;
-        servers.default.locations = [
-          (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
-            alias /home/$1/public_html$2;
-          '')
-        ];
-      };
-    }
     {
       krebs.retiolum = {
         enable = true;
diff --git a/tv/2configs/nginx-public_html.nix b/tv/2configs/nginx-public_html.nix
new file mode 100644
index 000000000..50c623915
--- /dev/null
+++ b/tv/2configs/nginx-public_html.nix
@@ -0,0 +1,14 @@
+{ lib, ... }:
+
+with lib;
+
+{
+  krebs.nginx = {
+    enable = true;
+    servers.default.locations = [
+      (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
+        alias /home/$1/public_html$2;
+      '')
+    ];
+  };
+}
-- 
cgit v1.3.1


From d6ded00d012d4fb2a2a0a824604b25dac35ee349 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:32:04 +0100
Subject: tv retiolum: init

---
 tv/1systems/cd.nix       | 11 +----------
 tv/1systems/nomic.nix    | 10 +---------
 tv/1systems/wu.nix       | 10 +---------
 tv/1systems/xu.nix       | 11 +----------
 tv/2configs/retiolum.nix | 16 ++++++++++++++++
 5 files changed, 20 insertions(+), 38 deletions(-)
 create mode 100644 tv/2configs/retiolum.nix

(limited to 'tv/1systems')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index b69d7655a..da44f5077 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -17,6 +17,7 @@ with lib;
     #../2configs/consul-server.nix
     ../2configs/exim-smarthost.nix
     ../2configs/git.nix
+    ../2configs/retiolum.nix
     ../2configs/urlwatch.nix
     {
       imports = [ ../2configs/charybdis.nix ];
@@ -77,16 +78,6 @@ with lib;
         '');
       };
     }
-    {
-      krebs.retiolum = {
-        enable = true;
-        connectTo = [
-          "fastpoke"
-          "pigstarter"
-          "ire"
-        ];
-      };
-    }
   ];
 
   networking.interfaces.enp2s1.ip4 = [
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 64fe5a635..b7e77e973 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -11,6 +11,7 @@ with lib;
     ../2configs/git.nix
     ../2configs/nginx-public_html.nix
     ../2configs/pulse.nix
+    ../2configs/retiolum.nix
     ../2configs/xserver
     {
       tv.iptables = {
@@ -23,15 +24,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.retiolum = {
-        enable = true;
-        connectTo = [
-          "gum"
-          "pigstarter"
-        ];
-      };
-    }
   ];
 
   boot.initrd.luks = {
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 6dd051210..f52bbc091 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -12,6 +12,7 @@ with lib;
     ../2configs/mail-client.nix
     ../2configs/nginx-public_html.nix
     ../2configs/pulse.nix
+    ../2configs/retiolum.nix
     ../2configs/xserver
     {
       environment.systemPackages = with pkgs; [
@@ -135,15 +136,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.retiolum = {
-        enable = true;
-        connectTo = [
-          "gum"
-          "pigstarter"
-        ];
-      };
-    }
   ];
 
   boot.initrd.luks = {
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 409129581..54e16868f 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -12,6 +12,7 @@ with lib;
     ../2configs/mail-client.nix
     ../2configs/nginx-public_html.nix
     ../2configs/pulse.nix
+    ../2configs/retiolum.nix
     ../2configs/xserver
     {
       environment.systemPackages = with pkgs; [
@@ -133,16 +134,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.retiolum = {
-        enable = true;
-        connectTo = [
-          "cd"
-          "gum"
-          "pigstarter"
-        ];
-      };
-    }
   ];
 
   boot.initrd.luks = {
diff --git a/tv/2configs/retiolum.nix b/tv/2configs/retiolum.nix
new file mode 100644
index 000000000..91fe81d69
--- /dev/null
+++ b/tv/2configs/retiolum.nix
@@ -0,0 +1,16 @@
+{ config, lib, ... }:
+
+with lib;
+
+{
+  krebs.retiolum = {
+    enable = true;
+    connectTo = filter (ne config.krebs.build.host.name) [
+      "gum"
+      "prism"
+      "echelon"
+      "cd"
+      "ire"
+    ];
+  };
+}
-- 
cgit v1.3.1


From bb1dbae8187601cea2ddfbdcdc9baa456bc5b4ab Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:40:25 +0100
Subject: tv: open ssh port by default

---
 tv/1systems/cd.nix      | 4 ----
 tv/1systems/nomic.nix   | 1 -
 tv/1systems/wu.nix      | 1 -
 tv/1systems/xu.nix      | 1 -
 tv/2configs/default.nix | 5 +++++
 5 files changed, 5 insertions(+), 7 deletions(-)

(limited to 'tv/1systems')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index da44f5077..6db78ca89 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -41,7 +41,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "ssh"
           "tinc"
           "smtp"
           "xmpp-client"
@@ -58,10 +57,7 @@ with lib;
         "cgit.cd.krebsco.de"
         "cgit.cd.viljetic.de"
       ];
-    }
-    {
       # TODO make public_html also available to cd, cd.retiolum (AKA default)
-      tv.iptables.input-internet-accept-new-tcp = singleton "http";
       krebs.nginx.servers.public_html = {
         server-names = singleton "cd.viljetic.de";
         locations = singleton (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index b7e77e973..f176a5f23 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -17,7 +17,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "ssh"
           "http"
           "tinc"
           "smtp"
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index f52bbc091..16709052b 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -129,7 +129,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "ssh"
           "http"
           "tinc"
           "smtp"
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 54e16868f..c6f1a393e 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -127,7 +127,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "ssh"
           "http"
           "tinc"
           "smtp"
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 310077021..abe9d3de8 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -162,6 +162,10 @@ with lib;
       };
     }
 
+    {
+      tv.iptables.enable = true;
+    }
+
     {
       services.openssh = {
         enable = true;
@@ -169,6 +173,7 @@ with lib;
           { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
         ];
       };
+      tv.iptables.input-internet-accept-new-tcp = singleton "ssh";
     }
 
     {
-- 
cgit v1.3.1


From b172630f894362dc32cb6af7d5c9d44902ec5752 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:44:19 +0100
Subject: tv retiolum: open tinc port

---
 tv/1systems/cd.nix       | 1 -
 tv/1systems/nomic.nix    | 1 -
 tv/1systems/wu.nix       | 1 -
 tv/1systems/xu.nix       | 1 -
 tv/2configs/retiolum.nix | 1 +
 5 files changed, 1 insertion(+), 4 deletions(-)

(limited to 'tv/1systems')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 6db78ca89..783d23ca9 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -41,7 +41,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "tinc"
           "smtp"
           "xmpp-client"
           "xmpp-server"
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index f176a5f23..6f2c41823 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -18,7 +18,6 @@ with lib;
         enable = true;
         input-internet-accept-new-tcp = [
           "http"
-          "tinc"
           "smtp"
         ];
       };
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 16709052b..7635f6162 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -130,7 +130,6 @@ with lib;
         enable = true;
         input-internet-accept-new-tcp = [
           "http"
-          "tinc"
           "smtp"
         ];
       };
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index c6f1a393e..91b761d24 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -128,7 +128,6 @@ with lib;
         enable = true;
         input-internet-accept-new-tcp = [
           "http"
-          "tinc"
           "smtp"
         ];
       };
diff --git a/tv/2configs/retiolum.nix b/tv/2configs/retiolum.nix
index 91fe81d69..d2bb9e6cf 100644
--- a/tv/2configs/retiolum.nix
+++ b/tv/2configs/retiolum.nix
@@ -13,4 +13,5 @@ with lib;
       "ire"
     ];
   };
+  tv.iptables.input-internet-accept-new-tcp = singleton "tinc";
 }
-- 
cgit v1.3.1


From d85c70d1d669636fe2fcbb1179dca2c4aecb0802 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:46:33 +0100
Subject: tv nginx-public_html: open http port

---
 tv/1systems/nomic.nix             | 1 -
 tv/1systems/wu.nix                | 1 -
 tv/1systems/xu.nix                | 1 -
 tv/2configs/nginx-public_html.nix | 1 +
 4 files changed, 1 insertion(+), 3 deletions(-)

(limited to 'tv/1systems')

diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 6f2c41823..2b71a974e 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -17,7 +17,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "http"
           "smtp"
         ];
       };
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 7635f6162..a51e0e678 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -129,7 +129,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "http"
           "smtp"
         ];
       };
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 91b761d24..847b57249 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -127,7 +127,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "http"
           "smtp"
         ];
       };
diff --git a/tv/2configs/nginx-public_html.nix b/tv/2configs/nginx-public_html.nix
index 50c623915..dc74f7f8d 100644
--- a/tv/2configs/nginx-public_html.nix
+++ b/tv/2configs/nginx-public_html.nix
@@ -11,4 +11,5 @@ with lib;
       '')
     ];
   };
+  tv.iptables.input-internet-accept-new-tcp = singleton "http";
 }
-- 
cgit v1.3.1


From fe025213ea5c15012fd83f1064269a315a2d576a Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:50:00 +0100
Subject: tv exim-retiolum: open smtp port to retiolum

---
 tv/1systems/nomic.nix         | 8 --------
 tv/1systems/wu.nix            | 8 --------
 tv/1systems/xu.nix            | 8 --------
 tv/2configs/exim-retiolum.nix | 5 ++++-
 4 files changed, 4 insertions(+), 25 deletions(-)

(limited to 'tv/1systems')

diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 2b71a974e..37ef204c7 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -13,14 +13,6 @@ with lib;
     ../2configs/pulse.nix
     ../2configs/retiolum.nix
     ../2configs/xserver
-    {
-      tv.iptables = {
-        enable = true;
-        input-internet-accept-new-tcp = [
-          "smtp"
-        ];
-      };
-    }
   ];
 
   boot.initrd.luks = {
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index a51e0e678..aef8ca761 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -125,14 +125,6 @@ with lib;
         unison
       ];
     }
-    {
-      tv.iptables = {
-        enable = true;
-        input-internet-accept-new-tcp = [
-          "smtp"
-        ];
-      };
-    }
   ];
 
   boot.initrd.luks = {
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 847b57249..31a8a3e99 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -123,14 +123,6 @@ with lib;
         unison
       ];
     }
-    {
-      tv.iptables = {
-        enable = true;
-        input-internet-accept-new-tcp = [
-          "smtp"
-        ];
-      };
-    }
   ];
 
   boot.initrd.luks = {
diff --git a/tv/2configs/exim-retiolum.nix b/tv/2configs/exim-retiolum.nix
index 1af72c28f..aedf25823 100644
--- a/tv/2configs/exim-retiolum.nix
+++ b/tv/2configs/exim-retiolum.nix
@@ -1,5 +1,8 @@
-{ ... }:
+{ lib, ... }:
+
+with lib;
 
 {
   krebs.exim-retiolum.enable = true;
+  tv.iptables.input-retiolum-accept-new-tcp = singleton "smtp";
 }
-- 
cgit v1.3.1


From b58f37ce3833b7800c0a9ec83367dc888ea571b3 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:53:16 +0100
Subject: tv exim-smarthost: open smtp port

---
 tv/1systems/cd.nix             | 1 -
 tv/2configs/exim-smarthost.nix | 5 ++++-
 2 files changed, 4 insertions(+), 2 deletions(-)

(limited to 'tv/1systems')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 783d23ca9..1d9457600 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -41,7 +41,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "smtp"
           "xmpp-client"
           "xmpp-server"
         ];
diff --git a/tv/2configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix
index f5f63d284..bcfea7821 100644
--- a/tv/2configs/exim-smarthost.nix
+++ b/tv/2configs/exim-smarthost.nix
@@ -1,4 +1,6 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
+
+with lib;
 
 {
   krebs.exim-smarthost = {
@@ -34,4 +36,5 @@
       { from = "mirko"; to = "mv"; }
     ];
   };
+  tv.iptables.input-internet-accept-new-tcp = singleton "smtp";
 }
-- 
cgit v1.3.1


From 0c1a2d11b18c73ddc7fdb429e0d09dcffa3906f8 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:56:10 +0100
Subject: cd: redistribute iptable rules

---
 tv/1systems/cd.nix | 20 +++++---------------
 1 file changed, 5 insertions(+), 15 deletions(-)

(limited to 'tv/1systems')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 1d9457600..27e94aef0 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -31,6 +31,10 @@ with lib;
         enable = true;
         hosts = [ "jabber.viljetic.de" ];
       };
+      tv.iptables.input-internet-accept-new-tcp = [
+        "xmpp-client"
+        "xmpp-server"
+      ];
     }
     {
       krebs.github-hosts-sync.enable = true;
@@ -38,19 +42,6 @@ with lib;
         singleton config.krebs.github-hosts-sync.port;
     }
     {
-      tv.iptables = {
-        enable = true;
-        input-internet-accept-new-tcp = [
-          "xmpp-client"
-          "xmpp-server"
-        ];
-        input-retiolum-accept-new-tcp = [
-          "http"
-        ];
-      };
-    }
-    {
-      tv.iptables.input-internet-accept-new-tcp = singleton "http";
       krebs.nginx.servers.cgit.server-names = [
         "cgit.cd.krebsco.de"
         "cgit.cd.viljetic.de"
@@ -62,8 +53,6 @@ with lib;
           alias /home/$1/public_html$2;
         '');
       };
-    }
-    {
       krebs.nginx.servers.viljetic = {
         server-names = singleton "viljetic.de";
         # TODO directly set root (instead via location)
@@ -71,6 +60,7 @@ with lib;
           root ${pkgs.viljetic-pages};
         '');
       };
+      tv.iptables.input-internet-accept-new-tcp = singleton "http";
     }
   ];
 
-- 
cgit v1.3.1


From 28382e43e0df74a6b10bfcf23465d8415fa86460 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 2 Feb 2016 19:51:01 +0100
Subject: tv: RIP consul

---
 tv/1systems/cd.nix            |   1 -
 tv/1systems/mkdir.nix         |   1 -
 tv/1systems/rmdir.nix         |   1 -
 tv/2configs/consul-client.nix |   9 ----
 tv/2configs/consul-server.nix |  21 --------
 tv/3modules/consul.nix        | 118 ------------------------------------------
 tv/3modules/default.nix       |   1 -
 7 files changed, 152 deletions(-)
 delete mode 100644 tv/2configs/consul-client.nix
 delete mode 100644 tv/2configs/consul-server.nix
 delete mode 100644 tv/3modules/consul.nix

(limited to 'tv/1systems')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 27e94aef0..e42d5750a 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -14,7 +14,6 @@ with lib;
   imports = [
     ../2configs/hw/CAC-Developer-2.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
-    #../2configs/consul-server.nix
     ../2configs/exim-smarthost.nix
     ../2configs/git.nix
     ../2configs/retiolum.nix
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index 9d8a0bcfa..79e5f73b9 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -22,7 +22,6 @@ in
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
-    ../2configs/consul-server.nix
     ../2configs/exim-smarthost.nix
     ../2configs/git.nix
     {
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index 1f1d975c9..6fd79c596 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -23,7 +23,6 @@ in
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
-    ../2configs/consul-server.nix
     ../2configs/exim-smarthost.nix
     ../2configs/git.nix
     {
diff --git a/tv/2configs/consul-client.nix b/tv/2configs/consul-client.nix
deleted file mode 100644
index 0a8bf4d75..000000000
--- a/tv/2configs/consul-client.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ pkgs, ... }:
-
-{
-  imports = [ ./consul-server.nix ];
-
-  tv.consul = {
-    server = pkgs.lib.mkForce false;
-  };
-}
diff --git a/tv/2configs/consul-server.nix b/tv/2configs/consul-server.nix
deleted file mode 100644
index d10f9ea75..000000000
--- a/tv/2configs/consul-server.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ config, ... }:
-
-{
-  tv.consul = rec {
-    enable = true;
-
-    self = config.krebs.build.host;
-    inherit (self) dc;
-
-    server = true;
-
-    hosts = with config.krebs.hosts; [
-      # TODO get this list automatically from each host where tv.consul.enable is true
-      cd
-      mkdir
-      nomic
-      rmdir
-      #wu
-    ];
-  };
-}
diff --git a/tv/3modules/consul.nix b/tv/3modules/consul.nix
deleted file mode 100644
index 5c955fdb5..000000000
--- a/tv/3modules/consul.nix
+++ /dev/null
@@ -1,118 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-# if quorum gets lost, then start any node with a config that doesn't contain bootstrap_expect
-# but -bootstrap
-# TODO consul-bootstrap HOST  that actually does is
-# TODO tools to inspect state of a cluster in outage state
-
-with lib;
-let
-  cfg = config.tv.consul;
-
-  out = {
-    options.tv.consul = api;
-    config = mkIf cfg.enable (mkMerge [
-      imp
-      { tv.iptables.input-retiolum-accept-new-tcp = [ "8300" "8301" ]; }
-      # TODO udp for 8301
-    ]);
-  };
-
-  api = {
-    enable = mkEnableOption "tv.consul";
-
-    dc = mkOption {
-      type = types.label;
-    };
-    hosts = mkOption {
-      type = with types; listOf host;
-    };
-    encrypt-file = mkOption {
-      type = types.str; # TODO path (but not just into store)
-      default = toString <secrets/consul-encrypt.json>;
-    };
-    data-dir = mkOption {
-      type = types.str; # TODO path (but not just into store)
-      default = "/var/lib/consul";
-    };
-    self = mkOption {
-      type = types.host;
-    };
-    server = mkOption {
-      type = types.bool;
-      default = false;
-    };
-    GOMAXPROCS = mkOption {
-      type = types.int;
-      default = cfg.self.cores;
-    };
-  };
-
-  consul-config = {
-    datacenter = cfg.dc;
-    data_dir = cfg.data-dir;
-    log_level = "INFO";
-    #node_name =
-    server = cfg.server;
-    enable_syslog = true;
-    retry_join =
-      # TODO allow consul in other nets than retiolum [maybe]
-      concatMap (host: host.nets.retiolum.addrs)
-                (filter (host: host.name != cfg.self.name) cfg.hosts);
-    leave_on_terminate = true;
-  } // optionalAttrs cfg.server {
-    bootstrap_expect = length cfg.hosts;
-    leave_on_terminate = false;
-  };
-
-  imp = {
-    environment.systemPackages = with pkgs; [
-      consul
-    ];
-
-    systemd.services.consul = {
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      path = with pkgs; [
-        consul
-      ];
-      environment = {
-        GOMAXPROCS = toString cfg.GOMAXPROCS;
-      };
-      serviceConfig = {
-        PermissionsStartOnly = "true";
-        SyslogIdentifier = "consul";
-        User = user.name;
-        PrivateTmp = "true";
-        Restart = "always";
-        ExecStartPre = pkgs.writeScript "consul-init" ''
-          #! /bin/sh
-          mkdir -p ${cfg.data-dir}
-          chown ${user.name}: ${cfg.data-dir}
-          install -o ${user.name} -m 0400 ${cfg.encrypt-file} /tmp/encrypt.json
-        '';
-        ExecStart = pkgs.writeScript "consul-service" ''
-          #! /bin/sh
-          set -euf
-          exec >/dev/null
-          exec consul agent \
-            -config-file=${toFile "consul.json" (toJSON consul-config)} \
-            -config-file=/tmp/encrypt.json
-        '';
-        #-node=${cfg.self.fqdn} \
-        #ExecStart = "${tinc}/sbin/tincd -c ${confDir} -d 0 -U ${user} -D";
-      };
-    };
-
-    users.extraUsers = singleton {
-      inherit (user) name uid;
-    };
-  };
-
-  user = rec {
-    name = "consul";
-    uid = genid name;
-  };
-
-in
-out
diff --git a/tv/3modules/default.nix b/tv/3modules/default.nix
index bb10d8261..f7889b245 100644
--- a/tv/3modules/default.nix
+++ b/tv/3modules/default.nix
@@ -2,7 +2,6 @@ _:
 
 {
   imports = [
-    ./consul.nix
     ./ejabberd.nix
     ./iptables.nix
   ];
-- 
cgit v1.3.1


From ba4bfed2715cb3973f9dbaa6f0a6010c59121a54 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 2 Feb 2016 20:05:12 +0100
Subject: wu: selectively allowUnfree nvidia-x11

---
 tv/1systems/wu.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'tv/1systems')

diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index aef8ca761..2fa0e8ab7 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -157,7 +157,7 @@ with lib;
 
   nixpkgs.config.chromium.enablePepperFlash = true;
 
-  nixpkgs.config.allowUnfree = true;
+  nixpkgs.config.allowUnfreePredicate = pkg: hasPrefix "nvidia-x11-" pkg.name;
   hardware.bumblebee.enable = true;
   hardware.bumblebee.group = "video";
   hardware.enableAllFirmware = true;
-- 
cgit v1.3.1


From 34dcaa692382072889e7e796461933ff129d5a13 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 2 Feb 2016 20:06:15 +0100
Subject: xu: don't unconditionally allowUnfree

---
 tv/1systems/xu.nix | 1 -
 1 file changed, 1 deletion(-)

(limited to 'tv/1systems')

diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 31a8a3e99..8c4af2bd3 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -155,7 +155,6 @@ with lib;
 
   nixpkgs.config.chromium.enablePepperFlash = true;
 
-  nixpkgs.config.allowUnfree = true;
   #hardware.bumblebee.enable = true;
   #hardware.bumblebee.group = "video";
   hardware.enableAllFirmware = true;
-- 
cgit v1.3.1


From 5bc7523bb54e960f5ac00492b16519b1bce21007 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 3 Feb 2016 19:39:00 +0100
Subject: cac-1.0.3 -> cac-api-1.1.0

---
 krebs/5pkgs/cac-api/default.nix                 | 37 +++++++++++++++++++++++
 krebs/5pkgs/cac/default.nix                     | 39 -------------------------
 krebs/5pkgs/test/infest-cac-centos7/default.nix |  4 +--
 krebs/5pkgs/test/infest-cac-centos7/notes       | 32 ++++++++++----------
 tv/1systems/wu.nix                              |  2 +-
 tv/2configs/git.nix                             |  4 +--
 6 files changed, 58 insertions(+), 60 deletions(-)
 create mode 100644 krebs/5pkgs/cac-api/default.nix
 delete mode 100644 krebs/5pkgs/cac/default.nix

(limited to 'tv/1systems')

diff --git a/krebs/5pkgs/cac-api/default.nix b/krebs/5pkgs/cac-api/default.nix
new file mode 100644
index 000000000..2a32bb096
--- /dev/null
+++ b/krebs/5pkgs/cac-api/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, fetchgit, bc, coreutils, curl, gnused, inotifyTools, jq, ncurses, sshpass, ... }:
+
+stdenv.mkDerivation {
+  name = "cac-api-1.1.0";
+
+  src = fetchgit {
+    url = http://cgit.cd.krebsco.de/cac-api;
+    rev = "0809fae379239687ed1170e04311dc2880ef0aba";
+    sha256 = "357ced27c9ed88028967c934178a1d230bf38617a7494cd4632fabdd2a04fcdd";
+  };
+
+  phases = [
+    "unpackPhase"
+    "installPhase"
+  ];
+
+  installPhase =
+    let
+      path = stdenv.lib.makeSearchPath "bin" [
+        bc
+        coreutils
+        curl
+        gnused
+        inotifyTools
+        jq
+        ncurses
+        sshpass
+      ];
+    in
+    ''
+      mkdir -p $out/bin
+      cp cac-api $out/bin/cac-api
+      sed -i '
+        s;^_cac_cli_main .*;PATH=${path}''${PATH+:$PATH} &;
+      ' $out/bin/cac-api
+    '';
+}
diff --git a/krebs/5pkgs/cac/default.nix b/krebs/5pkgs/cac/default.nix
deleted file mode 100644
index 4d39ce2fb..000000000
--- a/krebs/5pkgs/cac/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ stdenv, fetchgit, bc, coreutils, curl, gnused, inotifyTools, jq, ncurses, sshpass, ... }:
-
-stdenv.mkDerivation {
-  name = "cac-1.0.3";
-
-  src = fetchgit {
-    url = http://cgit.cd.retiolum/cac;
-    rev = "22acc1b990ac7d97c16344fbcbc2621e24cdf915";
-    sha256 = "135b740617c983b3f46a1983d4744be17340d5146a0a0de0dff4bb7a53688f2f";
-  };
-
-  phases = [
-    "unpackPhase"
-    "installPhase"
-  ];
-
-  installPhase =
-    let
-      path = stdenv.lib.makeSearchPath "bin" [
-        bc
-        coreutils
-        curl
-        gnused
-        inotifyTools
-        jq
-        ncurses
-        sshpass
-      ];
-    in
-    ''
-      mkdir -p $out/bin
-
-      sed < ./cac > $out/bin/cac '
-        s;^_cac_main .*;PATH=${path}''${PATH+:$PATH} &;
-      '
-
-      chmod +x $out/bin/cac
-    '';
-}
diff --git a/krebs/5pkgs/test/infest-cac-centos7/default.nix b/krebs/5pkgs/test/infest-cac-centos7/default.nix
index 7f2e3f231..ebea5ae1c 100644
--- a/krebs/5pkgs/test/infest-cac-centos7/default.nix
+++ b/krebs/5pkgs/test/infest-cac-centos7/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, coreutils,makeWrapper, cac, cacpanel, gnumake, gnused, jq, openssh, ... }:
+{ stdenv, coreutils,makeWrapper, cac-api, cacpanel, gnumake, gnused, jq, openssh, ... }:
 
 stdenv.mkDerivation rec {
   name = "${shortname}-${version}";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   path = stdenv.lib.makeSearchPath "bin" [
     coreutils
-    cac
+    cac-api
     cacpanel
     gnumake
     gnused
diff --git a/krebs/5pkgs/test/infest-cac-centos7/notes b/krebs/5pkgs/test/infest-cac-centos7/notes
index 6bfb6906e..7b9cbb46f 100755
--- a/krebs/5pkgs/test/infest-cac-centos7/notes
+++ b/krebs/5pkgs/test/infest-cac-centos7/notes
@@ -1,6 +1,6 @@
 #! /bin/sh
 
-# nix-shell -p gnumake jq openssh cac cacpanel
+# nix-shell -p gnumake jq openssh cac-api cacpanel
 set -eufx
 
 # 2 secrets are required:
@@ -47,15 +47,15 @@ export cac_secrets=$sec_file
 cac-cli --config $krebs_cred panel  add-api-ip
 
 # test login:
-cac update
-cac servers
+cac-api update
+cac-api servers
 
 # preserve old trap
 old_trapstr=$(clear_defer)
 while true;do
   # Template 26: CentOS7
-  # TODO: use cac templates to determine the real Centos7 template in case it changes
-  out=$(cac build cpu=1 ram=512 storage=10 os=26 2>&1)
+  # TODO: use cac-api templates to determine the real Centos7 template in case it changes
+  out=$(cac-api build cpu=1 ram=512 storage=10 os=26 2>&1)
   if name=$(echo "$out" | jq -r .servername);then
     id=servername:$name
     echo "got a working machine, id=$id"
@@ -67,15 +67,15 @@ while true;do
   fi
 
   clear_defer >/dev/null
-  defer "cac delete $id"
+  defer "cac-api delete $id"
 
   # TODO: timeout?
 
   wait_login_cac(){
     # we wait for 30 minutes
     for t in `seq 180`;do
-      # now we have a working cac server
-      if cac ssh $1 -o ConnectTimeout=10 \
+      # now we have a working cac-api server
+      if cac-api ssh $1 -o ConnectTimeout=10 \
                     cat /etc/redhat-release | \
                       grep CentOS ;then
         return 0
@@ -87,7 +87,7 @@ while true;do
   # die on timeout
   if ! wait_login_cac $id;then
     echo "unable to boot a working system within time frame, retrying..." >&2
-    echo "Cleaning up old image,last status: $(cac update;cac getserver $id | jq -r .status)"
+    echo "Cleaning up old image,last status: $(cac-api update;cac-api getserver $id | jq -r .status)"
     eval "$(clear_defer | sed 's/;exit//')"
     sleep 15
   else
@@ -96,17 +96,17 @@ while true;do
   fi
 done
 clear_defer >/dev/null
-defer "cac delete $id;$old_trapstr"
+defer "cac-api delete $id;$old_trapstr"
 
 mkdir -p shared/2configs/temp
-cac generatenetworking $id > \
+cac-api generatenetworking $id > \
   shared/2configs/temp/networking.nix
 # new temporary ssh key we will use to log in after infest
 ssh-keygen -f $krebs_ssh -N ""
 cp $retiolum_key $krebs_secrets/retiolum.rsa_key.priv
 # we override the directories for secrets and stockholm
 # additionally we set the ssh key we generated
-ip=$(cac getserver $id | jq -r .ip)
+ip=$(cac-api getserver $id | jq -r .ip)
 
 cat > shared/2configs/temp/dirs.nix <<EOF
 _: {
@@ -123,18 +123,18 @@ EOF
 
 LOGNAME=shared make eval get=krebs.infest \
   target=derp system=test-centos7 filter=json \
-  | sed -e "s#^ssh.*<<#cac ssh $id<<#" \
-        -e "/^rsync/a -e 'cac ssh $id' \\\\"  \
+  | sed -e "s#^ssh.*<<#cac-api ssh $id<<#" \
+        -e "/^rsync/a -e 'cac-api ssh $id' \\\\"  \
         -e "s#root.derp:#:#" > $krebs_secrets/infest
 sh -x $krebs_secrets/infest
 
 # TODO: generate secrets directory $krebs_secrets for nix import
-cac powerop $id reset
+cac-api powerop $id reset
 
 wait_login(){
   # timeout
   for t in `seq 90`;do
-    # now we have a working cac server
+    # now we have a working cac-api server
     if ssh -o StrictHostKeyChecking=no \
            -o UserKnownHostsFile=/dev/null \
            -i $krebs_ssh \
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 2fa0e8ab7..29e6de08b 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -43,7 +43,7 @@ with lib;
         # tv
         bc
         bind # dig
-        cac
+        cac-api
         dic
         file
         get
diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix
index 01dc7de9b..b8180085f 100644
--- a/tv/2configs/git.nix
+++ b/tv/2configs/git.nix
@@ -22,8 +22,8 @@ let
 
   public-repos = mapAttrs make-public-repo ({
   } // mapAttrValues (setAttr "section" "1. Miscellaneous") {
-    cac = {
-      desc = "CloudAtCost command line interface";
+    cac-api = {
+      desc = "CloudAtCost API command line interface";
     };
     get = {};
     hack = {};
-- 
cgit v1.3.1


From b2303e081fb1ccc9a0b88f538736045fb2fba14f Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 5 Feb 2016 15:18:28 +0100
Subject: cd: use default upstream-nixpkgs

---
 tv/1systems/cd.nix | 5 -----
 1 file changed, 5 deletions(-)

(limited to 'tv/1systems')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index e42d5750a..8297a56df 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -6,11 +6,6 @@ with lib;
   krebs.build.host = config.krebs.hosts.cd;
   krebs.build.target = "root@cd.internet";
 
-  krebs.build.source.upstream-nixpkgs = {
-    url = https://github.com/NixOS/nixpkgs;
-    rev = "b7ff030";
-  };
-
   imports = [
     ../2configs/hw/CAC-Developer-2.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
-- 
cgit v1.3.1