stockholm/modules/wu/default.nix

{ config, pkgs, ... }:

let
  location = pkgs.lib.nameValuePair; # TODO this is also in modules/tv/git/cgit.nix
in

{
  imports = [
    ./hosts.nix
    ../tv/base.nix
    ../tv/exim-retiolum.nix
    ../tv/environment.nix
    ../tv/sanitize.nix
    ../tv/smartd.nix
    ../tv/synaptics.nix
    ../tv/urxvt.nix
    ../tv/xserver.nix
    ../wu/users.nix
    {
      imports = [ ../tv/identity ];
      tv.identity = {
        enable = true;
        self = config.tv.identity.hosts.wu;
      };
    }
    {
      imports = [ ../tv/iptables ];
      tv.iptables = {
        enable = true;
        input-internet-accept-new-tcp = [
          "ssh"
          "http"
          "tinc"
          "smtp"
        ];
      };
    }
    {
      imports = [ ../tv/nginx ];
      tv.nginx = {
        enable = true;
        retiolum-locations = [
          (location "~ ^/~(.+?)(/.*)?\$" ''
            alias /home/$1/public_html$2;
          '')
        ];
      };
    }
    {
      imports = [ ../tv/retiolum ];
      tv.retiolum = {
        enable = true;
        hosts = <retiolum-hosts>;
        connectTo = [
          "gum"
          "pigstarter"
        ];
      };
    }
    {
      imports = [ ../tv/urlwatch ];
      tv.urlwatch = {
        enable = true;
        mailto = "tv@wu.retiolum";
        onCalendar = "*-*-* 05:00:00";
        urls = [
          ## nixpkgs maintenance

          # 2014-07-29 when one of the following urls change
          # then we have to update the package

          # ref src/nixpkgs/pkgs/tools/admin/sec/default.nix
          http://simple-evcorr.sourceforge.net/

          # ref src/nixpkgs/pkgs/tools/networking/urlwatch/default.nix
          https://thp.io/2008/urlwatch/

          # 2014-12-20 ref src/nixpkgs/pkgs/tools/networking/tlsdate/default.nix
          https://api.github.com/repos/ioerror/tlsdate/tags

          # 2015-02-18
          # ref ~/src/nixpkgs/pkgs/tools/text/qprint/default.nix
          http://www.fourmilab.ch/webtools/qprint/

          # 2014-09-24 ref https://github.com/4z3/xintmap
          http://www.mathstat.dal.ca/~selinger/quipper/

          # 2014-12-12 remove nixopsUnstable when nixops get's bumped to 1.3
          # ref https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/package-management/nixops/unstable.nix
          http://nixos.org/releases/nixops/

          ## other

          https://nixos.org/channels/nixos-unstable/git-revision

          ## 2014-10-17
          ## TODO update ~/src/login/default.nix
          #http://hackage.haskell.org/package/bcrypt
          #http://hackage.haskell.org/package/cron
          #http://hackage.haskell.org/package/hyphenation
          #http://hackage.haskell.org/package/iso8601-time
          #http://hackage.haskell.org/package/ixset-typed
          #http://hackage.haskell.org/package/system-command
          #http://hackage.haskell.org/package/transformers
          #http://hackage.haskell.org/package/web-routes-wai
          #http://hackage.haskell.org/package/web-page
        ];
      };
    }
  ];

  nix = {
    buildCores = 4;
    maxJobs = 4;
    daemonIONiceLevel = 1;
    daemonNiceLevel = 1;
  };

  services.udev.extraRules = ''
    SUBSYSTEM=="net", ATTR{address}=="00:90:f5:da:aa:c3", NAME="en0"
    SUBSYSTEM=="net", ATTR{address}=="a0:88:b4:1b:ae:6c", NAME="wl0"

    # for jack
    KERNEL=="rtc0", GROUP="audio"
    KERNEL=="hpet", GROUP="audio"
  '';

  #services.virtualbox.enable = true;
  #services.virtualboxGuest.enable = false;
  services.virtualboxHost.enable = true;
  #services.virtualboxHost.addNetworkInterface = false;
  #systemd.services.vboxnet =
  #  let
  #    remove_vboxnets = ''
  #      for i in $(cd /sys/class/net && ls | grep ^vboxnet); do
  #        VBoxManage hostonlyif remove $i
  #      done
  #    '';
  #  in {
  #    wantedBy = [ "multi-user.target" ];
  #    requires = [ "dev-vboxnetctl.device" ];
  #    after = [ "dev-vboxnetctl.device" ];
  #    path = with pkgs; [
  #      linuxPackages.virtualbox
  #      nettools
  #    ];
  #    postStop = remove_vboxnets;
  #    script = ''
  #      ${remove_vboxnets} # just in case...
  #      VBoxManage hostonlyif create # vboxnet0
  #      ifconfig vboxnet0 up 169.254.13.37/16
  #    '';
  #    serviceConfig = {
  #      Type = "oneshot";
  #      PrivateTmp = true;
  #      RemainAfterExit = "yes";
  #    };
  #    environment.VBOX_USER_HOME = "/tmp";
  #  };


  services.bitlbee.enable = true;

  #services.rabbitmq = {
  #  enable = true;
  #  cookie = "f00f";
  #  plugins = [
  #    "rabbitmq_management"
  #  ];
  #};


  #services.elasticsearch.enable = true;

  #services.cgserver = {
  #  enable = true;
  #  httpPort = 8003;
  #  #flushLog = false;
  #  #cgroupRoot = "/sys/fs/cgroup";
  #  #user = "zalora";
  #};




  #services.tlsdated = {
  #  enable = true;
  #  extraOptions = "-p";
  #};

  services.tor.enable = true;
  services.tor.client.enable = true;



  # hardware configuration
  boot.initrd.luks.devices = [
    { name = "home"; device = "/dev/vg840/enchome"; preLVM = false; }
  ];
  boot.initrd.luks.cryptoModules = [ "aes" "sha512" "xts" ];
  boot.initrd.availableKernelModules = [ "ahci" ];
  #boot.kernelParams = [
  #  "intel_pstate=enable"
  #];
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];

  # 2014-12-17 pkgs.linuxPackages_3_14 is known good
  boot.kernelPackages = pkgs.linuxPackages_3_18;

  boot.kernel.sysctl = {
    # Enable IPv6 Privacy Extensions
    "net.ipv6.conf.all.use_tempaddr" = 2;
    "net.ipv6.conf.default.use_tempaddr" = 2;
  };

  boot.extraModprobeConfig = ''
    options kvm_intel nested=1
  '';

  fileSystems = {
    "/" = {
      device = "/dev/mapper/vg840-wuroot";
      fsType = "btrfs";
      options = "defaults,noatime,ssd,compress=lzo";
    };
    "/home" = {
      device = "/dev/mapper/home";
      options = "defaults,noatime,ssd,compress=lzo";
    };
    "/boot" = {
      device = "/dev/sda1";
    };
    "/tmp" = {
      device = "tmpfs";
      fsType = "tmpfs";
      options = "nosuid,nodev,noatime";
    };
  };

  swapDevices =[ ];


  nixpkgs.config.firefox.enableAdobeFlash = true;
  nixpkgs.config.chromium.enablePepperFlash = true;

  nixpkgs.config.allowUnfree = true;
  hardware.bumblebee.enable = true; # TODO this is host specific
  hardware.bumblebee.group = "video";
  #services.xserver.videoDrivers = [ "nvidia" ];
  hardware.opengl.driSupport32Bit = true;

  hardware.pulseaudio.enable = true;

  hardware.enableAllFirmware = true;

  # Use the gummiboot efi boot loader.
  boot.loader.gummiboot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  networking.hostName = "wu";
  networking.wireless.enable = true;


  # Select internationalisation properties.
  # i18n = {
  #   consoleFont = "lat9w-16";
  #   consoleKeyMap = "us";
  #   defaultLocale = "en_US.UTF-8";
  # };

  system.activationScripts.powertopTunables =
    ''
      echo 1 > /sys/module/snd_hda_intel/parameters/power_save
      echo 1500 > /proc/sys/vm/dirty_writeback_centisecs
      (cd /sys/bus/pci/devices
        for i in *; do
          echo auto > $i/power/control # defaults to 'on'
        done)
      # TODO maybe do this via udev or systemd
      #   ref https://wiki.archlinux.org/index.php/Wake-on-LAN
      # disable wol this cannot find ethtool
      # TODO (cd /sys/class/net
      # TODO   for i in *; do
      # TODO     if ethtool $i | grep -q Wake-on &&
      # TODO         ! ethtool $i | grep -q 'Wake-on: d'; then
      # TODO       ethtool -s $i wol d
      # TODO     fi
      # TODO   done)
      ${pkgs.ethtool}/sbin/ethtool -s en0 wol d
    '';

  environment.systemPackages = with pkgs; [
    xlibs.fontschumachermisc
    slock
    ethtool
    #firefoxWrapper # with plugins
    #chromiumDevWrapper
    tinc
    iptables
    #jack2
  ];

  security.setuidPrograms = [
    "sendmail"  # for cron
    "slock"
  ];

  # TODO
  # Currently ./run doesn't know about certificates
  #security.pki.certificateFiles = [
  #  ./certs/zalora-ca.crt
  #];

  #security.pam.loginLimits = [
  #  # for jack
  #  { domain = "@audio"; item = "memlock"; type = "-"; value = "unlimited"; }
  #  { domain = "@audio"; item = "rtprio"; type = "-"; value = "99"; }
  #];

  #services.haveged.enable = true;
  #security.rngd.enable = true;

  #services.privoxy = {
  #  enable = true;
  #  extraConfig = ''
  #    actionsfile /etc/privoxy/easylist.script.action
  #    actionsfile /etc/privoxy/easylistgermany.script.action
  #    filterfile /etc/privoxy/easylist.script.filter
  #    filterfile /etc/privoxy/easylistgermany.script.filter
  #  '';
  #};

  #services.dbus.enable = true; # rqd4 wpa_supplicant

  services.logind.extraConfig = ''
    HandleHibernateKey=ignore
    HandleLidSwitch=ignore
    HandlePowerKey=ignore
    HandleSuspendKey=ignore
  '';

  # Enable the OpenSSH daemon.
  services.openssh = {
    enable = true;
    hostKeys = [
      # XXX bits here make no science
      { bits = 8192; type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
    ];
  };

  # services.printing.enable = true;
  services.printing = {
    enable = true;
    #extraConf = ''
    #  LogLevel debug
    #'';
    drivers = with pkgs; [
      #cups_filters
      #foomatic_filters
      #gutenprint
      #hplip
    ];
  };



  #services.kmscon.enable = true;


  # TODO virtualisation.libvirtd.enable = true;
  #       users.extraUsers.tv.extraGroups += [ "libvirtd" ]




  services.journald.extraConfig = ''
    SystemMaxUse=1G
    RuntimeMaxUse=128M
  '';


  #systemd.timers.chargeMon = {
  #  wantedBy = [ "multi-user.target" ];
  #  timerConfig.OnCalendar = "*-*-* *:*:00";
  #};
  #systemd.services.chargeMon = {
  #  path  = [ ];
  #  environment = {
  #    ac_online   = "/sys/class/power_supply/AC/online";
  #    charge_now  = "/sys/class/power_supply/BAT/charge_now";
  #    charge_full = "/sys/class/power_supply/BAT/charge_full";
  #  };
  #  serviceConfig = {
  #    User = "nobody";
  #    Type = "oneshot";
  #  };
  #  script = ''
  #    if test $(cat $ac_online) == 1; then
  #      echo "AC is online"
  #      exit
  #    fi
  #    cat $charge_now
  #  '';
  #};

  # see tmpfiles.d(5)
  systemd.tmpfiles.rules = [
    "d /tmp 1777 root root - -" # does this work with mounted /tmp?
  ];

  # TODO services.smartd
  # TODO services.statsd
  # TODO services.tor
  # TODO write arandr
  # TODO what does system.copySystemConfiguration (we need some kind of bku scheme)
  # TODO systemd.timers instead of cron(??)

  virtualisation.libvirtd.enable = true;




  #system.replaceRuntimeDependencies = with pkgs;
  #  let
  #      bashVulnPatches = [
  #        (fetchurl {
  #          url = "mirror://gnu/bash/bash-4.2-patches/bash42-048";
  #          sha256 = "091xk1ms7ycnczsl3fx461gjhj69j6ycnfijlymwj6mj60ims6km";
  #        })
  #        (fetchurl {
  #          url = "file:///etc/nixos/bash-20140926.patch";
  #          sha256 = "0gdwnimsbi4vh5l46krss4wjrgbch94skn4y2w3rpvb1w4jypha4";
  #        })
  #      ];
  #  in
  #  [
  #    {
  #      original = bash;
  #      replacement = pkgs.lib.overrideDerivation bash (oldAttrs: {
  #        patches = oldAttrs.patches ++ bashVulnPatches;
  #      });
  #    }
  #    {
  #      original = bashInteractive;
  #      replacement = pkgs.lib.overrideDerivation bashInteractive (oldAttrs: {
  #        patches = oldAttrs.patches ++ bashVulnPatches;
  #      });
  #    }
  #    {
  #      original = bitlbee;
  #      replacement = pkgs.lib.overrideDerivation bitlbee (oldAttrs: {
  #        configureFlags = [
  #          "--gcov=1"
  #          "--otr=1"
  #          "--ssl=gnutls"
  #        ];
  #      });
  #    }
  #];


}