stockholm/tv/2configs/xu-qemu0.nix

{ config, lib, pkgs, ... }:

let
  # XXX cannot use config.build.host.name here because infinite recursion when
  # defining  krebs.hosts.${host-name}.nets.retiolum.aliases  below.
  host-name = "xu";
in

# usage:
#   echo set_password vnc correcthorze | xu-qemu0-monitor
#
#   vncdo -s xu:1 type 'curl init.xu.r' key shift-\\ type sh key return
#
#   http://vnc.xu/vnc_auto.html?port=5701&host=xu&password=correcthorze
#
#   make [install] system=xu-qemu0 target_host=10.56.0.101

# TODO iptables -A INPUT -p udp -m udp --dport bootps -j ACCEPT
# TODO iptables -A FORWARD -i qemubr0 -s 10.56.0.1/24 -m conntrack --ctstate NEW -j ACCEPT
# TODO iptables -A POSTROUTING -t nat -j MASQUERADE
# TODO iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT
# TODO echo 1 > /proc/sys/net/ipv4/ip_forward
# TODO ifconfig qemubr0 10.56.0.1/24 up

with lib;

{
  #networking.wireless.interfaces = [ "wlp3s0" ];

  #networking.useNetworkd = true;

  #networking.dhcpcd.allowInterfaces = [
  #  "qemubr0"
  #];

  #systemd.network.networks.wlp3s0 = {
  #  matchConfig.name = "wlp3s0";
  #  networkConfig.Bridge = "qemubr0";
  #};

  systemd.network.enable = true;

  systemd.network.netdevs.qemubr0 = {
    netdevConfig = {
      Name = "qemubr0";
      Kind = "bridge";
    };
  };

  users.groups.qemu-users.gid = genid "qemu-users";

  environment.etc."qemu/bridge.conf".text = ''
    allow qemubr0
  '';

  krebs.per-user.tv.packages = [
    pkgs.vncdotool
  ];

  users.users.xu-qemu0 = {
    createHome = true;
    group = "qemu-users";
    home = "/home/xu-qemu0";
    uid = genid "xu-qemu0";
  };

  systemd.services.xu-qemu0 = let
  in {
    after = [ "network.target" "systemd-resolved.service" ];
    serviceConfig = {
      User = "xu-qemu0";
      SyslogIdentifier = "xu-qemu0";
      ExecStart = pkgs.writeDash "xu-qemu0" ''
        set -efu
        ${pkgs.coreutils}/bin/mkdir -p "$HOME/tmp"
        img=$HOME/tmp/xu-qemu0.raw
        if ! test -e "$img"; then
          ${pkgs.kvm}/bin/qemu-img create "$img" 10G
        fi
        exec ${pkgs.kvm}/bin/qemu-kvm \
            -monitor unix:$HOME/tmp/xu-qemu0.sock,server,nowait \
            -boot order=cd \
            -cdrom ${pkgs.fetchurl {
              url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso;
              sha256 = "18bc9wrsrjnhj9rya75xliqkl99gxbsk4dmwqivhvwfzb5qb5yp9";
            }} \
            -m 1024 \
            -netdev bridge,br=qemubr0,id=hn0,helper=/var/setuid-wrappers/qemu-bridge-helper \
            -net nic,netdev=hn0,id=nic1,macaddr=52:54:00:12:34:56 \
            -drive file="$img",format=raw \
            -display vnc=:1,websocket=5701,password,lossy \
            -name xu-qemu0 \
      '';
    };
  };

  system.activationScripts."krebs.setuid.xu-qemu0-monitor" = stringAfter [ "setuid" ] ''
    src=${pkgs.execve "xu-qemu0-monitor" {
      # TODO toC should handle derivation, then we don't have to "${...}" here
      filename = "${pkgs.writeDash "xu-qemu0-monitor" ''
        exec ${pkgs.socat}/bin/socat \
            stdio \
            UNIX-CONNECT:${config.users.users.xu-qemu0.home}/tmp/xu-qemu0.sock \
      ''}";
    }}
    dst=${config.security.wrapperDir}/xu-qemu0-monitor
    cp "$src" "$dst"
    chown xu-qemu0.tv "$dst"
    chmod 4710 "$dst"
  '';

  #TODO krebs.setuid.qemu-bridge-helper = {
  #  filename = "${pkgs.qemu}/libexec/qemu-bridge-helper";
  #  owner = "root";
  #  group = "qemu-users";
  #  mode = "4710";
  #};
  system.activationScripts."krebs.setuid" = stringAfter [ "setuid" ] ''
    src=${pkgs.execve "qemu-bridge-helper" {
      filename = "${pkgs.qemu}/libexec/qemu-bridge-helper";
    }}
    dst=${config.security.wrapperDir}/qemu-bridge-helper
    cp "$src" "$dst"
    chown root.qemu-users "$dst"
    chmod 4710 "$dst"
  '';

  users.users.qemu-dnsmasq.uid = genid "qemu-dnsmasq";

  # TODO need custom etc/dbus-1/system.d/dnsmasq.conf for different BusName
  services.dbus.packages = [ pkgs.dnsmasq ];

  systemd.services.qemu-dnsmasq = let
    # bind-interfaces
    conf = pkgs.writeText "qemu-dnsmasq.conf" ''
      listen-address=10.56.0.1
      interface=qemubr0
      dhcp-range=10.56.0.200,10.56.0.250
      dhcp-no-override
      dhcp-leasefile=/tmp/qemu-dnsmasq.leases
      domain=${host-name}.local
      dhcp-host=52:54:00:12:34:56,xu-qemu0,10.56.0.101,1440m
    '';
  in {
    after = [ "network.target" "systemd-resolved.service" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "dbus";
      BusName = "uk.org.thekelleys.dnsmasq";
      # -1 --enable-dbus[=uk.org.thekelleys.dnsmasq]
      SyslogIdentifier = "qemu-dnsmasq";
      ExecStart = "${pkgs.dnsmasq}/bin/dnsmasq -1k -u qemu-dnsmasq -C ${conf}";
      ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
      PrivateTmp = "true";
    };
    restartTriggers = [ config.environment.etc.hosts.source ];
  };


  krebs.nginx.servers.init = {
    server-names = [
      "init.${host-name}"
      "init.${host-name}.r"
      "init.${host-name}.retiolum"
    ];
    extraConfig = ''
      index init.txt;
      root ${pkgs.writeTextFile {
        name = "init-pages";
        text = ''
          #! /bin/sh
          set -efu

          dev=/dev/sda
          pttype=dos # gpt

          case $pttype in
            dos)
              if ! test "$(blkid -o value -s PTTYPE "$dev")" = dos; then
                parted -s "$dev" mklabel msdos
              fi
              if ! test "$(blkid -o value -s PARTLABEL "$dev"1)" = primary; then
                parted -s "$dev" mkpart primary ext4 1MiB 513MiB
                parted -s "$dev" set 1 boot on
              fi
              ;;
            gpt)
              if ! test "$(blkid -o value -s PTTYPE "$dev")" = gpt; then
                parted -s "$dev" mklabel gpt
              fi
              if ! test "$(blkid -o value -s PARTLABEL "$dev"1)" = ESP; then
                parted -s "$dev" mkpart ESP fat32 1MiB 513MiB
                parted -s "$dev" set 1 boot on
              fi
              ;;
            *)
              echo "Error: bad pttype: $pttype" >&2
              exit -1
          esac

          if ! test "$(blkid -o value -s PARTLABEL "$dev"2)" = primary; then
            parted -s "$dev" mkpart primary btrfs 513MiB 100%
          fi
          if ! test "$(blkid -o value -s TYPE "$dev"1)" = vfat; then
            mkfs.vfat "$dev"1
          fi
          if ! test "$(blkid -o value -s TYPE "$dev"2)" = btrfs; then
            mkfs.btrfs "$dev"2
          fi

          parted "$dev" print

          if ! test "$(lsblk -n -o MOUNTPOINT "$dev"2)" = /mnt; then
            mount "$dev"2 /mnt
          fi
          if ! test "$(lsblk -n -o MOUNTPOINT "$dev"1)" = /mnt/boot; then
            mkdir -m 0000 -p /mnt/boot
            mount "$dev"1 /mnt/boot
          fi

          lsblk "$dev"

          key=${shell.escape config.krebs.users.tv-xu.pubkey}

          if [ "$(cat /root/.ssh/authorized_keys 2>/dev/null)" != "$key" ]; then
            mkdir -p /root/.ssh
            echo "$key" > /root/.ssh/authorized_keys
          fi
          systemctl start sshd
          ip route
          echo READY.
        '';
        destination = "/init.txt";
      }};
    '';
  };


  krebs.hosts.${host-name}.nets.retiolum.aliases = [
    "init.${host-name}.r"
    "init.${host-name}.retiolum"
    "vnc.${host-name}.r"
    "vnc.${host-name}.retiolum"
  ];

  krebs.nginx.servers.noVNC = {
    server-names = [
      "vnc.${host-name}"
      "vnc.${host-name}.r"
      "vnc.${host-name}.retiolum"
    ];
    #rewrite ^([^.]*)$ /vnc_auto.html?host=localhost&port=5701;
    locations = singleton (nameValuePair "/" ''
      index vnc.html;
      root ${pkgs.noVNC};
    '');
  };
}