From ed86c7f44e16cd70693ca78ecdcc620fc8c66495 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Mon, 2 Nov 2015 10:17:30 +0100
Subject: wu: {/root => /var/src}/{nixpkgs,stockholm}

---
 tv/1systems/wu.nix | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'tv')

diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 85fba1d8a..b12e7df93 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -12,6 +12,7 @@ with lib;
     git.nixpkgs = {
       url = https://github.com/NixOS/nixpkgs;
       rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
+      target-path = "/var/src/nixpkgs";
     };
     dir.secrets = {
       host = config.krebs.hosts.wu;
@@ -20,6 +21,7 @@ with lib;
     dir.stockholm = {
       host = config.krebs.hosts.wu;
       path = "/home/tv/stockholm";
+      target-path = "/var/src/stockholm";
     };
   };
 
-- 
cgit v1.2.3


From 1ddbdddc696316986b07376a7fc5e33aaf228e89 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Thu, 5 Nov 2015 00:31:14 +0100
Subject: tv vim: set et ts=2 sts=2 sw=2

---
 tv/2configs/vim.nix | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'tv')

diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 8c6c9fb45..14f086e5c 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -50,6 +50,8 @@ let
     set wildmenu
     set wildmode=longest,full
 
+    set et ts=2 sts=2 sw=2
+
     filetype plugin indent on
 
     set t_Co=256
-- 
cgit v1.2.3


From 5ec7cd4ad5ce3f40ca13b5b92d258b84409cd43b Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Fri, 6 Nov 2015 10:47:18 +0100
Subject: tv vim: isk, INTs, and comments

---
 tv/2configs/vim.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'tv')

diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 14f086e5c..295c78aff 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -66,9 +66,10 @@ let
 
     au BufRead,BufNewFile *.nix so ${pkgs.writeText "nix.vim" ''
       setf nix
+      set isk=@,48-57,_,192-255,-,'
 
       " Ref <nix/src/libexpr/lexer.l>
-      syn match INT   /[0-9]\+/
+      syn match INT   /\<[0-9]\+\>/
       syn match PATH  /[a-zA-Z0-9\.\_\-\+]*\(\/[a-zA-Z0-9\.\_\-\+]\+\)\+/
       syn match HPATH /\~\(\/[a-zA-Z0-9\.\_\-\+]\+\)\+/
       syn match SPATH /<[a-zA-Z0-9\.\_\-\+]\+\(\/[a-zA-Z0-9\.\_\-\+]\+\)*>/
@@ -80,7 +81,7 @@ let
       hi link URI Constant
 
       syn match String /"\([^"]\|\\\"\)*"/
-      syn match Comment /\s#.*/
+      syn match Comment /\(^\|\s\)#.*/
     ''}
 
     au BufRead,BufNewFile /dev/shm/* set nobackup nowritebackup noswapfile
-- 
cgit v1.2.3


From a2a3838e41db2260e84e377c158482309b9d0123 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Fri, 6 Nov 2015 12:04:34 +0100
Subject: tv vim: match strings harder!

---
 tv/2configs/vim.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'tv')

diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 295c78aff..04b1480c1 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -80,7 +80,7 @@ let
       hi link SPATH Constant
       hi link URI Constant
 
-      syn match String /"\([^"]\|\\\"\)*"/
+      syn match String /"\([^\\"]\|\\.\)*"/
       syn match Comment /\(^\|\s\)#.*/
     ''}
 
-- 
cgit v1.2.3


From 4f12837d0934ef1cc376669b2d00d6a821f662e2 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Fri, 6 Nov 2015 19:35:05 +0100
Subject: tv base: RIP old vim

---
 tv/2configs/base.nix | 16 ----------------
 1 file changed, 16 deletions(-)

(limited to 'tv')

diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix
index 41159690d..a74ce3297 100644
--- a/tv/2configs/base.nix
+++ b/tv/2configs/base.nix
@@ -68,22 +68,6 @@ with lib;
 
       nix.useChroot = true;
     }
-    {
-      # oldvim
-      environment.systemPackages = with pkgs; [
-        vim
-      ];
-
-      environment.etc."vim/vimrc".text = ''
-        set nocp
-      '';
-
-      environment.etc."vim/vim${majmin pkgs.vim.version}".source =
-          "${pkgs.vim}/share/vim/vim${majmin pkgs.vim.version}";
-
-      environment.variables.EDITOR = mkForce "vim";
-      environment.variables.VIM = "/etc/vim";
-    }
     {
       environment.systemPackages = with pkgs; [
         rxvt_unicode.terminfo
-- 
cgit v1.2.3


From b54f00c6954a0b44abb52289332c748f95d796d3 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 21:29:49 +0100
Subject: tv modules: add per-user

---
 tv/3modules/default.nix  |  1 +
 tv/3modules/per-user.nix | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 tv/3modules/per-user.nix

(limited to 'tv')

diff --git a/tv/3modules/default.nix b/tv/3modules/default.nix
index bb10d8261..3a75d6e43 100644
--- a/tv/3modules/default.nix
+++ b/tv/3modules/default.nix
@@ -5,5 +5,6 @@ _:
     ./consul.nix
     ./ejabberd.nix
     ./iptables.nix
+    ./per-user.nix
   ];
 }
diff --git a/tv/3modules/per-user.nix b/tv/3modules/per-user.nix
new file mode 100644
index 000000000..8d21a01d9
--- /dev/null
+++ b/tv/3modules/per-user.nix
@@ -0,0 +1,35 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.tv.per-user;
+
+  out = {
+    options.tv.per-user = api;
+    config = imp;
+  };
+
+  api = mkOption {
+    type = with types; attrsOf (submodule {
+      options = {
+        packages = mkOption {
+          type = listOf path;
+          default = [];
+        };
+      };
+    });
+    default = {};
+  };
+
+  imp = {
+    environment = {
+      etc = flip mapAttrs' cfg (name: { packages, ... }: {
+        name = "per-user/${name}";
+        value.source = pkgs.symlinkJoin "per-user.${name}" packages;
+      });
+      profiles = ["/etc/per-user/$LOGNAME"];
+    };
+  };
+
+in out
-- 
cgit v1.2.3


From a0c068d6ec5d1cc6b1c58fe9af379b638a346220 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 21:37:58 +0100
Subject: {tv => krebs} per-user

---
 tv/3modules/default.nix  |  1 -
 tv/3modules/per-user.nix | 35 -----------------------------------
 2 files changed, 36 deletions(-)
 delete mode 100644 tv/3modules/per-user.nix

(limited to 'tv')

diff --git a/tv/3modules/default.nix b/tv/3modules/default.nix
index 3a75d6e43..bb10d8261 100644
--- a/tv/3modules/default.nix
+++ b/tv/3modules/default.nix
@@ -5,6 +5,5 @@ _:
     ./consul.nix
     ./ejabberd.nix
     ./iptables.nix
-    ./per-user.nix
   ];
 }
diff --git a/tv/3modules/per-user.nix b/tv/3modules/per-user.nix
deleted file mode 100644
index 8d21a01d9..000000000
--- a/tv/3modules/per-user.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.tv.per-user;
-
-  out = {
-    options.tv.per-user = api;
-    config = imp;
-  };
-
-  api = mkOption {
-    type = with types; attrsOf (submodule {
-      options = {
-        packages = mkOption {
-          type = listOf path;
-          default = [];
-        };
-      };
-    });
-    default = {};
-  };
-
-  imp = {
-    environment = {
-      etc = flip mapAttrs' cfg (name: { packages, ... }: {
-        name = "per-user/${name}";
-        value.source = pkgs.symlinkJoin "per-user.${name}" packages;
-      });
-      profiles = ["/etc/per-user/$LOGNAME"];
-    };
-  };
-
-in out
-- 
cgit v1.2.3


From bad79f7f1270c01343b3c308f5a2cf390dac014c Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 21:53:21 +0100
Subject: tv: init user z

---
 tv/1systems/wu.nix              | 11 +----------
 tv/1systems/xu.nix              | 11 +----------
 tv/2configs/base.nix            |  3 +++
 tv/2configs/xserver/default.nix |  8 --------
 tv/2configs/z.nix               | 40 ++++++++++++++++++++++++++++++++++++++++
 5 files changed, 45 insertions(+), 28 deletions(-)
 create mode 100644 tv/2configs/z.nix

(limited to 'tv')

diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index b12e7df93..fe6a5f303 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -32,6 +32,7 @@ with lib;
     ../2configs/git.nix
     ../2configs/mail-client.nix
     ../2configs/xserver
+    ../2configs/z.nix
     {
       environment.systemPackages = with pkgs; [
 
@@ -287,16 +288,6 @@ with lib;
           onion = {
             uid = 6660010;
           };
-
-          zalora = {
-            uid = 1000301;
-            extraGroups = [
-              "audio"
-              # TODO remove vboxusers when hardening is active
-              "vboxusers"
-              "video"
-            ];
-          };
         };
 
       security.sudo.extraConfig =
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index e2cc2c06a..eb8c7c784 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -30,6 +30,7 @@ with lib;
     ../2configs/git.nix
     ../2configs/mail-client.nix
     ../2configs/xserver
+    ../2configs/z.nix
     {
       environment.systemPackages = with pkgs; [
 
@@ -286,16 +287,6 @@ with lib;
           onion = {
             uid = 6660010;
           };
-
-          zalora = {
-            uid = 1000301;
-            extraGroups = [
-              "audio"
-              # TODO remove vboxusers when hardening is active
-              "vboxusers"
-              "video"
-            ];
-          };
         };
 
       security.sudo.extraConfig =
diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix
index a74ce3297..4beece5ef 100644
--- a/tv/2configs/base.nix
+++ b/tv/2configs/base.nix
@@ -22,6 +22,9 @@ with lib;
         mapAttrs (_: h: { hashedPassword = h; })
                  (import <secrets/hashedPasswords.nix>);
     }
+    {
+      users.groups.subusers.gid = 1093178926; # genid subusers
+    }
     {
       users.defaultUserShell = "/run/current-system/sw/bin/bash";
       users.mutableUsers = false;
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index 4d2fe9e45..df00203be 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -70,14 +70,6 @@ let
         ExecStart = "${xserver}/bin/xserver";
       };
     };
-
-    programs.bash.interactiveShellInit = ''
-      case ''${XMONAD_SPAWN_WORKSPACE-} in
-        za|zh|zj|zs)
-          exec sudo -u zalora -i
-        ;;
-      esac
-    '';
   };
 
   xmonad-environment = {
diff --git a/tv/2configs/z.nix b/tv/2configs/z.nix
new file mode 100644
index 000000000..e5494ecc9
--- /dev/null
+++ b/tv/2configs/z.nix
@@ -0,0 +1,40 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  krebs.per-user.z.packages = [
+    (pkgs.writeScriptBin "cr" ''
+      #! /bin/sh
+      set -efu
+      export LC_TIME=de_DE.utf8
+      exec ${pkgs.chromium}/bin/chromium \
+          --ssl-version-min=tls1 \
+          --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \
+          --disk-cache-size=50000000 \
+          "%@"
+    '')
+  ];
+
+  programs.bash.interactiveShellInit = ''
+    case ''${XMONAD_SPAWN_WORKSPACE-} in
+      za|zh|zj|zs)
+        exec sudo -u z -i
+      ;;
+    esac
+  '';
+
+  security.sudo.extraConfig = "tv ALL=(z) NOPASSWD: ALL";
+
+  users.users.z = {
+    extraGroups = [
+      "audio"
+      "vboxusers"
+      "video"
+    ];
+    group = "subusers";
+    home = "/home/z";
+    uid = 3043726074; # genid z
+    useDefaultShell = true;
+  };
+}
-- 
cgit v1.2.3


From 3c75c59794d6b67c34d9a8857ca3fb64c649507c Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 21:54:53 +0100
Subject: tv: set environment.profileRelativeEnvVars.PATH

---
 tv/2configs/base.nix | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'tv')

diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix
index 4beece5ef..38cc1eefe 100644
--- a/tv/2configs/base.nix
+++ b/tv/2configs/base.nix
@@ -72,6 +72,8 @@ with lib;
       nix.useChroot = true;
     }
     {
+      environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
+
       environment.systemPackages = with pkgs; [
         rxvt_unicode.terminfo
       ];
-- 
cgit v1.2.3


From 28fad6e2fc3aa45a9d1b5fad8810bbc7c78a5dc6 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 21:55:08 +0100
Subject: tv base: drop redundant with builtins

---
 tv/2configs/base.nix | 1 -
 1 file changed, 1 deletion(-)

(limited to 'tv')

diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix
index 38cc1eefe..b74b721cb 100644
--- a/tv/2configs/base.nix
+++ b/tv/2configs/base.nix
@@ -1,6 +1,5 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
 with lib;
 
 {
-- 
cgit v1.2.3


From 0bf6e55f77cffb4ca65c6926eea7bc77140574a5 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 21:55:38 +0100
Subject: tv base: tv@xu can root

---
 tv/2configs/base.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'tv')

diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix
index b74b721cb..d3f4eed0d 100644
--- a/tv/2configs/base.nix
+++ b/tv/2configs/base.nix
@@ -33,6 +33,7 @@ with lib;
         root = {
           openssh.authorizedKeys.keys = [
             config.krebs.users.tv.pubkey
+            config.krebs.users.tv_xu.pubkey
           ];
         };
         tv = {
-- 
cgit v1.2.3


From f559b19bec61730c537cdd76233304e66c3f497a Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 22:05:36 +0100
Subject: stockholm: import default user config

---
 tv/1systems/cd.nix      |   1 -
 tv/1systems/mkdir.nix   |   1 -
 tv/1systems/nomic.nix   |   1 -
 tv/1systems/rmdir.nix   |   1 -
 tv/1systems/wu.nix      |   1 -
 tv/1systems/xu.nix      |   1 -
 tv/2configs/base.nix    | 168 ------------------------------------------------
 tv/2configs/default.nix | 168 ++++++++++++++++++++++++++++++++++++++++++++++++
 8 files changed, 168 insertions(+), 174 deletions(-)
 delete mode 100644 tv/2configs/base.nix
 create mode 100644 tv/2configs/default.nix

(limited to 'tv')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 1122e6a19..3f496fefb 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -26,7 +26,6 @@ with lib;
   imports = [
     ../2configs/hw/CAC-Developer-2.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
-    ../2configs/base.nix
     #../2configs/consul-server.nix
     ../2configs/exim-smarthost.nix
     ../2configs/git.nix
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index e8e354197..64896daf4 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -39,7 +39,6 @@ in
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
-    ../2configs/base.nix
     ../2configs/consul-server.nix
     ../2configs/exim-smarthost.nix
     ../2configs/git.nix
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index df45b8177..495c765f3 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -25,7 +25,6 @@ with lib;
 
   imports = [
     ../2configs/hw/AO753.nix
-    ../2configs/base.nix
     #../2configs/consul-server.nix
     ../2configs/git.nix
     {
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index e24ef64fc..62340b88c 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -39,7 +39,6 @@ in
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
-    ../2configs/base.nix
     ../2configs/consul-server.nix
     ../2configs/exim-smarthost.nix
     ../2configs/git.nix
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index fe6a5f303..8f714ec6b 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -27,7 +27,6 @@ with lib;
 
   imports = [
     ../2configs/hw/w110er.nix
-    ../2configs/base.nix
     #../2configs/consul-client.nix
     ../2configs/git.nix
     ../2configs/mail-client.nix
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index eb8c7c784..6f673ce9c 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -25,7 +25,6 @@ with lib;
 
   imports = [
     ../2configs/hw/x220.nix
-    ../2configs/base.nix
     #../2configs/consul-client.nix
     ../2configs/git.nix
     ../2configs/mail-client.nix
diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix
deleted file mode 100644
index d3f4eed0d..000000000
--- a/tv/2configs/base.nix
+++ /dev/null
@@ -1,168 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-{
-  krebs.enable = true;
-
-  networking.hostName = config.krebs.build.host.name;
-
-  imports = [
-    ./vim.nix
-    {
-      # stockholm dependencies
-      environment.systemPackages = with pkgs; [
-        git
-      ];
-    }
-    {
-      # TODO never put hashedPassword into the store
-      users.extraUsers =
-        mapAttrs (_: h: { hashedPassword = h; })
-                 (import <secrets/hashedPasswords.nix>);
-    }
-    {
-      users.groups.subusers.gid = 1093178926; # genid subusers
-    }
-    {
-      users.defaultUserShell = "/run/current-system/sw/bin/bash";
-      users.mutableUsers = false;
-    }
-    {
-      users.extraUsers = {
-        root = {
-          openssh.authorizedKeys.keys = [
-            config.krebs.users.tv.pubkey
-            config.krebs.users.tv_xu.pubkey
-          ];
-        };
-        tv = {
-          uid = 1337;
-          group = "users";
-          home = "/home/tv";
-          createHome = true;
-          useDefaultShell = true;
-          extraGroups = [
-            "audio"
-            "video"
-            "wheel"
-          ];
-          openssh.authorizedKeys.keys = [
-            config.krebs.users.tv.pubkey
-          ];
-        };
-      };
-    }
-    {
-      security.sudo.extraConfig = ''
-        Defaults mailto="${config.krebs.users.tv.mail}"
-      '';
-      time.timeZone = "Europe/Berlin";
-    }
-    {
-      # TODO check if both are required:
-      nix.chrootDirs = [ "/etc/protocols" pkgs.iana_etc.outPath ];
-
-      nix.trustedBinaryCaches = [
-        "https://cache.nixos.org"
-        "http://cache.nixos.org"
-        "http://hydra.nixos.org"
-      ];
-
-      nix.useChroot = true;
-    }
-    {
-      environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
-
-      environment.systemPackages = with pkgs; [
-        rxvt_unicode.terminfo
-      ];
-
-      environment.shellAliases = mkForce {
-        # alias cal='cal -m3'
-        gp = "${pkgs.pari}/bin/gp -q";
-        df = "df -h";
-        du = "du -h";
-        # alias grep='grep --color=auto'
-
-        # TODO alias cannot contain #\'
-        # "ps?" = "ps ax | head -n 1;ps ax | fgrep -v ' grep --color=auto ' | grep";
-
-        # alias la='ls -lA'
-        lAtr = "ls -lAtr";
-        # alias ll='ls -l'
-        ls = "ls -h --color=auto --group-directories-first";
-        dmesg = "dmesg -L --reltime";
-        view = "vim -R";
-      };
-
-      programs.bash = {
-        interactiveShellInit = ''
-          HISTCONTROL='erasedups:ignorespace'
-          HISTSIZE=65536
-          HISTFILESIZE=$HISTSIZE
-
-          shopt -s checkhash
-          shopt -s histappend histreedit histverify
-          shopt -s no_empty_cmd_completion
-          complete -d cd
-
-          ${readFile ./bash_completion.sh}
-
-          # TODO source bridge
-        '';
-        promptInit = ''
-          case $UID in
-            0)
-              PS1='\[\e[1;31m\]\w\[\e[0m\] '
-              ;;
-            1337)
-              PS1='\[\e[1;32m\]\w\[\e[0m\] '
-              ;;
-            *)
-              PS1='\[\e[1;35m\]\u \[\e[1;32m\]\w\[\e[0m\] '
-              ;;
-          esac
-          if test -n "$SSH_CLIENT"; then
-            PS1='\[\e[35m\]\h'" $PS1"
-          fi
-          if test -n "$SSH_AGENT_PID"; then
-            PS1="ssh-agent[$SSH_AGENT_PID] $PS1"
-          fi
-        '';
-      };
-
-      programs.ssh.startAgent = false;
-    }
-
-    {
-      services.cron.enable = false;
-      services.nscd.enable = false;
-      services.ntp.enable = false;
-    }
-
-    {
-      boot.kernel.sysctl = {
-        # Enable IPv6 Privacy Extensions
-        "net.ipv6.conf.all.use_tempaddr" = 2;
-        "net.ipv6.conf.default.use_tempaddr" = 2;
-      };
-    }
-
-    {
-      services.openssh = {
-        enable = true;
-        hostKeys = [
-          { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
-        ];
-      };
-    }
-
-    {
-      # TODO: exim
-      security.setuidPrograms = [
-        "sendmail"  # for sudo
-      ];
-    }
-  ];
-}
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
new file mode 100644
index 000000000..d3f4eed0d
--- /dev/null
+++ b/tv/2configs/default.nix
@@ -0,0 +1,168 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  krebs.enable = true;
+
+  networking.hostName = config.krebs.build.host.name;
+
+  imports = [
+    ./vim.nix
+    {
+      # stockholm dependencies
+      environment.systemPackages = with pkgs; [
+        git
+      ];
+    }
+    {
+      # TODO never put hashedPassword into the store
+      users.extraUsers =
+        mapAttrs (_: h: { hashedPassword = h; })
+                 (import <secrets/hashedPasswords.nix>);
+    }
+    {
+      users.groups.subusers.gid = 1093178926; # genid subusers
+    }
+    {
+      users.defaultUserShell = "/run/current-system/sw/bin/bash";
+      users.mutableUsers = false;
+    }
+    {
+      users.extraUsers = {
+        root = {
+          openssh.authorizedKeys.keys = [
+            config.krebs.users.tv.pubkey
+            config.krebs.users.tv_xu.pubkey
+          ];
+        };
+        tv = {
+          uid = 1337;
+          group = "users";
+          home = "/home/tv";
+          createHome = true;
+          useDefaultShell = true;
+          extraGroups = [
+            "audio"
+            "video"
+            "wheel"
+          ];
+          openssh.authorizedKeys.keys = [
+            config.krebs.users.tv.pubkey
+          ];
+        };
+      };
+    }
+    {
+      security.sudo.extraConfig = ''
+        Defaults mailto="${config.krebs.users.tv.mail}"
+      '';
+      time.timeZone = "Europe/Berlin";
+    }
+    {
+      # TODO check if both are required:
+      nix.chrootDirs = [ "/etc/protocols" pkgs.iana_etc.outPath ];
+
+      nix.trustedBinaryCaches = [
+        "https://cache.nixos.org"
+        "http://cache.nixos.org"
+        "http://hydra.nixos.org"
+      ];
+
+      nix.useChroot = true;
+    }
+    {
+      environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
+
+      environment.systemPackages = with pkgs; [
+        rxvt_unicode.terminfo
+      ];
+
+      environment.shellAliases = mkForce {
+        # alias cal='cal -m3'
+        gp = "${pkgs.pari}/bin/gp -q";
+        df = "df -h";
+        du = "du -h";
+        # alias grep='grep --color=auto'
+
+        # TODO alias cannot contain #\'
+        # "ps?" = "ps ax | head -n 1;ps ax | fgrep -v ' grep --color=auto ' | grep";
+
+        # alias la='ls -lA'
+        lAtr = "ls -lAtr";
+        # alias ll='ls -l'
+        ls = "ls -h --color=auto --group-directories-first";
+        dmesg = "dmesg -L --reltime";
+        view = "vim -R";
+      };
+
+      programs.bash = {
+        interactiveShellInit = ''
+          HISTCONTROL='erasedups:ignorespace'
+          HISTSIZE=65536
+          HISTFILESIZE=$HISTSIZE
+
+          shopt -s checkhash
+          shopt -s histappend histreedit histverify
+          shopt -s no_empty_cmd_completion
+          complete -d cd
+
+          ${readFile ./bash_completion.sh}
+
+          # TODO source bridge
+        '';
+        promptInit = ''
+          case $UID in
+            0)
+              PS1='\[\e[1;31m\]\w\[\e[0m\] '
+              ;;
+            1337)
+              PS1='\[\e[1;32m\]\w\[\e[0m\] '
+              ;;
+            *)
+              PS1='\[\e[1;35m\]\u \[\e[1;32m\]\w\[\e[0m\] '
+              ;;
+          esac
+          if test -n "$SSH_CLIENT"; then
+            PS1='\[\e[35m\]\h'" $PS1"
+          fi
+          if test -n "$SSH_AGENT_PID"; then
+            PS1="ssh-agent[$SSH_AGENT_PID] $PS1"
+          fi
+        '';
+      };
+
+      programs.ssh.startAgent = false;
+    }
+
+    {
+      services.cron.enable = false;
+      services.nscd.enable = false;
+      services.ntp.enable = false;
+    }
+
+    {
+      boot.kernel.sysctl = {
+        # Enable IPv6 Privacy Extensions
+        "net.ipv6.conf.all.use_tempaddr" = 2;
+        "net.ipv6.conf.default.use_tempaddr" = 2;
+      };
+    }
+
+    {
+      services.openssh = {
+        enable = true;
+        hostKeys = [
+          { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
+        ];
+      };
+    }
+
+    {
+      # TODO: exim
+      security.setuidPrograms = [
+        "sendmail"  # for sudo
+      ];
+    }
+  ];
+}
-- 
cgit v1.2.3


From 4d93a8215f08cbea0bbcb8c668f2bbc9600016da Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 22:16:59 +0100
Subject: krebs.build.source.dir.host defaults to current.host

---
 tv/1systems/cd.nix    | 2 --
 tv/1systems/mkdir.nix | 2 --
 tv/1systems/nomic.nix | 2 --
 tv/1systems/rmdir.nix | 2 --
 tv/1systems/wu.nix    | 2 --
 tv/1systems/xu.nix    | 2 --
 6 files changed, 12 deletions(-)

(limited to 'tv')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 3f496fefb..126c6feb5 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -14,11 +14,9 @@ with lib;
       rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
     };
     dir.secrets = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/secrets/cd";
     };
     dir.stockholm = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/stockholm";
     };
   };
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index 64896daf4..55d83f8f3 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -27,11 +27,9 @@ in
       rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
     };
     dir.secrets = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/secrets/mkdir";
     };
     dir.stockholm = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/stockholm";
     };
   };
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 495c765f3..c2bb4dc78 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -14,11 +14,9 @@ with lib;
       rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
     };
     dir.secrets = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/secrets/nomic";
     };
     dir.stockholm = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/stockholm";
     };
   };
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index 62340b88c..53f14d7df 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -27,11 +27,9 @@ in
       rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
     };
     dir.secrets = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/secrets/rmdir";
     };
     dir.stockholm = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/stockholm";
     };
   };
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 8f714ec6b..33292c608 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -15,11 +15,9 @@ with lib;
       target-path = "/var/src/nixpkgs";
     };
     dir.secrets = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/secrets/wu";
     };
     dir.stockholm = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/stockholm";
       target-path = "/var/src/stockholm";
     };
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 6f673ce9c..607f89aea 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -14,11 +14,9 @@ with lib;
       rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
     };
     dir.secrets = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/secrets/xu";
     };
     dir.stockholm = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/stockholm";
     };
   };
-- 
cgit v1.2.3


From bae469d2a64165a42d93cdb31e231fa75e9813a5 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 22:36:01 +0100
Subject: tv: condense krebs.build

---
 tv/1systems/mkdir.nix   | 14 --------------
 tv/1systems/nomic.nix   | 14 --------------
 tv/1systems/rmdir.nix   | 14 --------------
 tv/1systems/wu.nix      | 18 ------------------
 tv/1systems/xu.nix      | 16 ----------------
 tv/2configs/default.nix | 19 +++++++++++++++++++
 6 files changed, 19 insertions(+), 76 deletions(-)

(limited to 'tv')

diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index 55d83f8f3..6ae4f80e8 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -17,23 +17,9 @@ in
 
 {
   krebs.build.host = config.krebs.hosts.mkdir;
-  krebs.build.user = config.krebs.users.tv;
 
   krebs.build.target = "root@${primary-addr4}";
 
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      path = "/home/tv/secrets/mkdir";
-    };
-    dir.stockholm = {
-      path = "/home/tv/stockholm";
-    };
-  };
-
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index c2bb4dc78..0c6c935a3 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -4,23 +4,9 @@ with lib;
 
 {
   krebs.build.host = config.krebs.hosts.nomic;
-  krebs.build.user = config.krebs.users.tv;
 
   krebs.build.target = "root@nomic.gg23";
 
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      path = "/home/tv/secrets/nomic";
-    };
-    dir.stockholm = {
-      path = "/home/tv/stockholm";
-    };
-  };
-
   imports = [
     ../2configs/hw/AO753.nix
     #../2configs/consul-server.nix
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index 53f14d7df..1f1d975c9 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -17,23 +17,9 @@ in
 
 {
   krebs.build.host = config.krebs.hosts.rmdir;
-  krebs.build.user = config.krebs.users.tv;
 
   krebs.build.target = "root@rmdir.internet";
 
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      path = "/home/tv/secrets/rmdir";
-    };
-    dir.stockholm = {
-      path = "/home/tv/stockholm";
-    };
-  };
-
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 33292c608..26a603e9b 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -4,24 +4,6 @@ with lib;
 
 {
   krebs.build.host = config.krebs.hosts.wu;
-  krebs.build.user = config.krebs.users.tv;
-
-  krebs.build.target = "root@wu";
-
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-      target-path = "/var/src/nixpkgs";
-    };
-    dir.secrets = {
-      path = "/home/tv/secrets/wu";
-    };
-    dir.stockholm = {
-      path = "/home/tv/stockholm";
-      target-path = "/var/src/stockholm";
-    };
-  };
 
   imports = [
     ../2configs/hw/w110er.nix
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 607f89aea..65220fe3e 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -4,22 +4,6 @@ with lib;
 
 {
   krebs.build.host = config.krebs.hosts.xu;
-  krebs.build.user = config.krebs.users.tv;
-
-  krebs.build.target = "root@xu";
-
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      path = "/home/tv/secrets/xu";
-    };
-    dir.stockholm = {
-      path = "/home/tv/stockholm";
-    };
-  };
 
   imports = [
     ../2configs/hw/x220.nix
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index d3f4eed0d..d31862b60 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -5,6 +5,25 @@ with lib;
 {
   krebs.enable = true;
 
+  krebs.build = {
+    user = config.krebs.users.tv;
+    target = mkDefault "root@${config.krebs.build.host.name}";
+    source = {
+      git.nixpkgs = {
+        url = mkDefault https://github.com/NixOS/nixpkgs;
+        rev = mkDefault "c44a593aa43bba6a0708f6f36065a514a5110613";
+        target-path = mkDefault "/var/src/nixpkgs";
+      };
+      dir.secrets = {
+        path = mkDefault "/home/tv/secrets/${config.krebs.build.host.name}";
+      };
+      dir.stockholm = {
+        path = mkDefault "/home/tv/stockholm";
+        target-path = mkDefault "/var/src/stockholm";
+      };
+    };
+  };
+
   networking.hostName = config.krebs.build.host.name;
 
   imports = [
-- 
cgit v1.2.3


From a3f6dcb75ce73f57e1053054cf70667c2daef22d Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Sat, 7 Nov 2015 10:04:46 +0100
Subject: tv: move X-based tools to xserver

---
 tv/1systems/wu.nix              | 7 -------
 tv/1systems/xu.nix              | 8 +-------
 tv/2configs/xserver/default.nix | 6 ++++++
 3 files changed, 7 insertions(+), 14 deletions(-)

(limited to 'tv')

diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 26a603e9b..ee529f3dc 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -44,31 +44,24 @@ with lib;
         bind # dig
         cac
         dic
-        ff
         file
         get
-        gitAndTools.qgit
         gnupg21
         haskellPackages.hledger
         htop
         jq
         manpages
         mkpasswd
-        mpv
         netcat
         nix-repl
         nmap
         nq
         p7zip
-        pavucontrol
         posix_man_pages
-        pssh
         push
         qrencode
-        sxiv
         texLive
         tmux
-        zathura
 
         #ack
         #apache-httpd
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 65220fe3e..32688aaed 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -44,29 +44,23 @@ with lib;
         bind # dig
         #cac
         dic
-        ff
         file
-        gitAndTools.qgit  #xserver
         gnupg21
         haskellPackages.hledger
         htop
         jq
         manpages
         mkpasswd
-        mpv #xserver
         netcat
         nix-repl
         nmap
         nq
         p7zip
-        pavucontrol #xserver
+        pass
         posix_man_pages
-        #pssh
         qrencode
-        sxiv #xserver
         texLive
         tmux
-        zathura #xserver
 
         #ack
         #apache-httpd
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index df00203be..7a48db6b8 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -34,7 +34,13 @@ let
     };
 
     environment.systemPackages = [
+      pkgs.ff
+      pkgs.gitAndTools.qgit
+      pkgs.mpv
+      pkgs.pavucontrol
       pkgs.slock
+      pkgs.sxiv
+      pkgs.zathura
     ];
 
     security.setuidPrograms = [
-- 
cgit v1.2.3


From e57ce8bc98ba3d90b0044d90f4bff10475354fd1 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 7 Nov 2015 19:21:01 +0100
Subject: xu nixpkgs: c44a593 -> 7ae05ed

---
 tv/1systems/xu.nix | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'tv')

diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 65220fe3e..d9aec4070 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -5,6 +5,9 @@ with lib;
 {
   krebs.build.host = config.krebs.hosts.xu;
 
+  krebs.build.source.git.nixpkgs.rev =
+    "7ae05edcdd14f6ace83ead9bf0d114e97c89a83a";
+
   imports = [
     ../2configs/hw/x220.nix
     #../2configs/consul-client.nix
-- 
cgit v1.2.3


From e35e3b5eb05cea1e3c033423c2f6ee4e0a511817 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 7 Nov 2015 19:24:25 +0100
Subject: tv: mv user xr to sub

---
 tv/1systems/wu.nix              | 11 +++--------
 tv/1systems/xu.nix              |  9 +--------
 tv/2configs/sub/xr.nix          | 22 ++++++++++++++++++++++
 tv/2configs/xserver/default.nix |  1 +
 tv/2configs/z.nix               | 11 +----------
 tv/5pkgs/default.nix            | 10 ++++++++++
 6 files changed, 38 insertions(+), 26 deletions(-)
 create mode 100644 tv/2configs/sub/xr.nix

(limited to 'tv')

diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index ee529f3dc..2c0098c1c 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -12,6 +12,7 @@ with lib;
     ../2configs/mail-client.nix
     ../2configs/xserver
     ../2configs/z.nix
+    ../2configs/sub/xr.nix
     {
       environment.systemPackages = with pkgs; [
 
@@ -120,6 +121,8 @@ with lib;
         #xkill
         #xl2tpd
         #xsel
+
+        unison
       ];
     }
     {
@@ -234,14 +237,6 @@ with lib;
             ];
           };
 
-          xr = {
-            uid = 13370061;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
           "23" = {
             uid = 13370023;
           };
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 20e0e9681..57f318ad0 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -15,6 +15,7 @@ with lib;
     ../2configs/mail-client.nix
     ../2configs/xserver
     ../2configs/z.nix
+    ../2configs/sub/xr.nix
     {
       environment.systemPackages = with pkgs; [
 
@@ -239,14 +240,6 @@ with lib;
             ];
           };
 
-          xr = {
-            uid = 13370061;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
           "23" = {
             uid = 13370023;
           };
diff --git a/tv/2configs/sub/xr.nix b/tv/2configs/sub/xr.nix
new file mode 100644
index 000000000..6c9cbb93e
--- /dev/null
+++ b/tv/2configs/sub/xr.nix
@@ -0,0 +1,22 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  krebs.per-user.xr.packages = [
+    pkgs.cr
+  ];
+
+  security.sudo.extraConfig = "tv ALL=(xr) NOPASSWD: ALL";
+
+  users.users.xr = {
+    extraGroups = [
+      "audio"
+      "video"
+    ];
+    group = "subusers";
+    home = "/home/xr";
+    uid = 1660006127; # genid xr
+    useDefaultShell = true;
+  };
+}
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index 7a48db6b8..afc2d699c 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -40,6 +40,7 @@ let
       pkgs.pavucontrol
       pkgs.slock
       pkgs.sxiv
+      pkgs.xsel
       pkgs.zathura
     ];
 
diff --git a/tv/2configs/z.nix b/tv/2configs/z.nix
index e5494ecc9..3acd168d4 100644
--- a/tv/2configs/z.nix
+++ b/tv/2configs/z.nix
@@ -4,16 +4,7 @@ with lib;
 
 {
   krebs.per-user.z.packages = [
-    (pkgs.writeScriptBin "cr" ''
-      #! /bin/sh
-      set -efu
-      export LC_TIME=de_DE.utf8
-      exec ${pkgs.chromium}/bin/chromium \
-          --ssl-version-min=tls1 \
-          --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \
-          --disk-cache-size=50000000 \
-          "%@"
-    '')
+    pkgs.cr
   ];
 
   programs.bash.interactiveShellInit = ''
diff --git a/tv/5pkgs/default.nix b/tv/5pkgs/default.nix
index 1ca5e70a2..2108d972c 100644
--- a/tv/5pkgs/default.nix
+++ b/tv/5pkgs/default.nix
@@ -1,6 +1,16 @@
 { pkgs, ... }:
 
 {
+  cr = pkgs.writeScriptBin "cr" ''
+    #! /bin/sh
+    set -efu
+    export LC_TIME=de_DE.utf8
+    exec ${pkgs.chromium}/bin/chromium \
+        --ssl-version-min=tls1 \
+        --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \
+        --disk-cache-size=50000000 \
+        "%@"
+  '';
   ff = pkgs.callPackage ./ff {};
   viljetic-pages = pkgs.callPackage ./viljetic-pages {};
   xmonad-tv =
-- 
cgit v1.2.3


From b166b6c29d2cfd39348073b9873da13a1581ad61 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Sat, 7 Nov 2015 19:27:47 +0100
Subject: xu: add unison

---
 tv/1systems/xu.nix | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'tv')

diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 57f318ad0..168eafcc7 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -122,6 +122,8 @@ with lib;
         #xkill
         #xl2tpd
         #xsel
+
+        unison
       ];
     }
     {
-- 
cgit v1.2.3


From 60faa6e3cf3b592a4aad71b246fbe2abdd699b9c Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 8 Nov 2015 11:53:29 +0100
Subject: tv: remove legacy users

---
 tv/1systems/cd.nix      |  14 ------
 tv/1systems/wu.nix      | 110 ----------------------------------------------
 tv/1systems/xu.nix      | 113 ------------------------------------------------
 tv/2configs/default.nix |  43 ++++--------------
 tv/2configs/sub/xr.nix  |  22 ----------
 tv/2configs/z.nix       |  31 -------------
 6 files changed, 9 insertions(+), 324 deletions(-)
 delete mode 100644 tv/2configs/sub/xr.nix
 delete mode 100644 tv/2configs/z.nix

(limited to 'tv')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 126c6feb5..10c87b2c6 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -115,7 +115,6 @@ with lib;
     iftop
     iotop
     iptables
-    mutt    # for mv
     nethogs
     ntp     # ntpate
     rxvt_unicode.terminfo
@@ -126,17 +125,4 @@ with lib;
     SystemMaxUse=1G
     RuntimeMaxUse=128M
   '';
-
-  users.extraUsers = {
-    mv = {
-      uid = 1338;
-      group = "users";
-      home = "/home/mv";
-      createHome = true;
-      useDefaultShell = true;
-      openssh.authorizedKeys.keys = [
-        config.krebs.users.mv.pubkey
-      ];
-    };
-  };
 }
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 2c0098c1c..3fa5481e2 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -11,8 +11,6 @@ with lib;
     ../2configs/git.nix
     ../2configs/mail-client.nix
     ../2configs/xserver
-    ../2configs/z.nix
-    ../2configs/sub/xr.nix
     {
       environment.systemPackages = with pkgs; [
 
@@ -158,114 +156,6 @@ with lib;
         ];
       };
     }
-    {
-      users.extraGroups = {
-        tv.gid = 1337;
-        slaves.gid = 3799582008; # genid slaves
-      };
-
-      users.extraUsers =
-        mapAttrs (name: user@{ extraGroups ? [], ... }: user // {
-          inherit name;
-          home = "/home/${name}";
-          createHome = true;
-          useDefaultShell = true;
-          group = "tv";
-          extraGroups = ["slaves"] ++ extraGroups;
-        }) {
-          ff = {
-            uid = 13378001;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          cr = {
-            uid = 13378002;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          fa = {
-            uid = 2300001;
-          };
-
-          rl = {
-            uid = 2300002;
-          };
-
-          tief = {
-            uid = 2300702;
-          };
-
-          btc-bitcoind = {
-            uid = 2301001;
-          };
-
-          btc-electrum = {
-            uid = 2301002;
-          };
-
-          ltc-litecoind = {
-            uid = 2301101;
-          };
-
-          eth = {
-            uid = 2302001;
-          };
-
-          emse-hsdb = {
-            uid = 4200101;
-          };
-
-          wine = {
-            uid = 13370400;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          df = {
-            uid = 13370401;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          "23" = {
-            uid = 13370023;
-          };
-
-          electrum = {
-            uid = 13370102;
-          };
-
-          skype = {
-            uid = 6660001;
-            extraGroups = [
-              "audio"
-            ];
-          };
-
-          onion = {
-            uid = 6660010;
-          };
-        };
-
-      security.sudo.extraConfig =
-        let
-          isSlave = u: elem "slaves" u.extraGroups;
-          masterOf = u: u.group;
-          slaves = filterAttrs (_: isSlave) config.users.extraUsers;
-          toSudoers = u: "${masterOf u} ALL=(${u.name}) NOPASSWD: ALL";
-        in
-        concatMapStringsSep "\n" toSudoers (attrValues slaves);
-    }
   ];
 
   boot.initrd.luks = {
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 168eafcc7..1a9dddb55 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -14,8 +14,6 @@ with lib;
     ../2configs/git.nix
     ../2configs/mail-client.nix
     ../2configs/xserver
-    ../2configs/z.nix
-    ../2configs/sub/xr.nix
     {
       environment.systemPackages = with pkgs; [
 
@@ -160,117 +158,6 @@ with lib;
         ];
       };
     }
-    {
-      users.extraGroups = {
-        tv.gid = 1337;
-        slaves.gid = 3799582008; # genid slaves
-      };
-
-      users.extraUsers =
-        mapAttrs (name: user@{ extraGroups ? [], ... }: user // {
-          inherit name;
-          home = "/home/${name}";
-          createHome = true;
-          useDefaultShell = true;
-          group = "tv";
-          extraGroups = ["slaves"] ++ extraGroups;
-        }) {
-          ff = {
-            uid = 13378001;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          cr = {
-            uid = 13378002;
-            extraGroups = [
-              "audio"
-              "video"
-              "bumblebee"
-            ];
-          };
-
-          fa = {
-            uid = 2300001;
-          };
-
-          rl = {
-            uid = 2300002;
-          };
-
-          tief = {
-            uid = 2300702;
-          };
-
-          btc-bitcoind = {
-            uid = 2301001;
-          };
-
-          btc-electrum = {
-            uid = 2301002;
-          };
-
-          ltc-litecoind = {
-            uid = 2301101;
-          };
-
-          eth = {
-            uid = 2302001;
-          };
-
-          emse-hsdb = {
-            uid = 4200101;
-          };
-
-          wine = {
-            uid = 13370400;
-            extraGroups = [
-              "audio"
-              "video"
-              "bumblebee"
-            ];
-          };
-
-          df = {
-            uid = 13370401;
-            extraGroups = [
-              "audio"
-              "video"
-              "bumblebee"
-            ];
-          };
-
-          "23" = {
-            uid = 13370023;
-          };
-
-          electrum = {
-            uid = 13370102;
-          };
-
-          skype = {
-            uid = 6660001;
-            extraGroups = [
-              "audio"
-            ];
-          };
-
-          onion = {
-            uid = 6660010;
-          };
-        };
-
-      security.sudo.extraConfig =
-        let
-          isSlave = u: elem "slaves" u.extraGroups;
-          masterOf = u: u.group;
-          slaves = filterAttrs (_: isSlave) config.users.extraUsers;
-          toSudoers = u: "${masterOf u} ALL=(${u.name}) NOPASSWD: ALL";
-        in
-        concatMapStringsSep "\n" toSudoers (attrValues slaves);
-    }
   ];
 
   boot.initrd.luks = {
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index d31862b60..688f8f9cf 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -27,6 +27,7 @@ with lib;
   networking.hostName = config.krebs.build.host.name;
 
   imports = [
+    <secrets>
     ./vim.nix
     {
       # stockholm dependencies
@@ -35,40 +36,14 @@ with lib;
       ];
     }
     {
-      # TODO never put hashedPassword into the store
-      users.extraUsers =
-        mapAttrs (_: h: { hashedPassword = h; })
-                 (import <secrets/hashedPasswords.nix>);
-    }
-    {
-      users.groups.subusers.gid = 1093178926; # genid subusers
-    }
-    {
-      users.defaultUserShell = "/run/current-system/sw/bin/bash";
-      users.mutableUsers = false;
-    }
-    {
-      users.extraUsers = {
-        root = {
-          openssh.authorizedKeys.keys = [
-            config.krebs.users.tv.pubkey
-            config.krebs.users.tv_xu.pubkey
-          ];
-        };
-        tv = {
-          uid = 1337;
-          group = "users";
-          home = "/home/tv";
-          createHome = true;
-          useDefaultShell = true;
-          extraGroups = [
-            "audio"
-            "video"
-            "wheel"
-          ];
-          openssh.authorizedKeys.keys = [
-            config.krebs.users.tv.pubkey
-          ];
+      users = {
+        defaultUserShell = "/run/current-system/sw/bin/bash";
+        mutableUsers = false;
+        users = {
+          tv = {
+            isNormalUser = true;
+            uid = 1337;
+          };
         };
       };
     }
diff --git a/tv/2configs/sub/xr.nix b/tv/2configs/sub/xr.nix
deleted file mode 100644
index 6c9cbb93e..000000000
--- a/tv/2configs/sub/xr.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-{
-  krebs.per-user.xr.packages = [
-    pkgs.cr
-  ];
-
-  security.sudo.extraConfig = "tv ALL=(xr) NOPASSWD: ALL";
-
-  users.users.xr = {
-    extraGroups = [
-      "audio"
-      "video"
-    ];
-    group = "subusers";
-    home = "/home/xr";
-    uid = 1660006127; # genid xr
-    useDefaultShell = true;
-  };
-}
diff --git a/tv/2configs/z.nix b/tv/2configs/z.nix
deleted file mode 100644
index 3acd168d4..000000000
--- a/tv/2configs/z.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-{
-  krebs.per-user.z.packages = [
-    pkgs.cr
-  ];
-
-  programs.bash.interactiveShellInit = ''
-    case ''${XMONAD_SPAWN_WORKSPACE-} in
-      za|zh|zj|zs)
-        exec sudo -u z -i
-      ;;
-    esac
-  '';
-
-  security.sudo.extraConfig = "tv ALL=(z) NOPASSWD: ALL";
-
-  users.users.z = {
-    extraGroups = [
-      "audio"
-      "vboxusers"
-      "video"
-    ];
-    group = "subusers";
-    home = "/home/z";
-    uid = 3043726074; # genid z
-    useDefaultShell = true;
-  };
-}
-- 
cgit v1.2.3


From 0faad027e7e241edbe842cf6a54aad606d00adf7 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 8 Nov 2015 12:28:53 +0100
Subject: tv configs: set NIX_PATH

---
 tv/2configs/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

(limited to 'tv')

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 688f8f9cf..6ed1c65f9 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -90,6 +90,15 @@ with lib;
         view = "vim -R";
       };
 
+      environment.variables = {
+        NIX_PATH =
+          with config.krebs.build.source; with dir; with git;
+          mkForce (concatStringsSep ":" [
+            "nixpkgs=${nixpkgs.target-path}"
+            "secrets=${stockholm.target-path}/null"
+          ]);
+      };
+
       programs.bash = {
         interactiveShellInit = ''
           HISTCONTROL='erasedups:ignorespace'
-- 
cgit v1.2.3