From 29746aec06b7d42d3c87245f6f14f048234251e4 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 18:54:01 +0100 Subject: [PATCH 01/81] krebs.{backup.plans,hosts,users}.*.name: add default value --- krebs/3modules/backup.nix | 3 ++- krebs/3modules/lass/default.nix | 4 ++-- krebs/3modules/makefu/default.nix | 4 ++-- krebs/3modules/mv/default.nix | 4 ++-- krebs/3modules/shared/default.nix | 4 ++-- krebs/3modules/tv/default.nix | 4 ++-- krebs/4lib/types.nix | 6 ++++-- makefu/2configs/backup.nix | 2 +- tv/2configs/backup.nix | 2 +- 9 files changed, 18 insertions(+), 15 deletions(-) diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix index a1f335905..17d8a3c98 100644 --- a/krebs/3modules/backup.nix +++ b/krebs/3modules/backup.nix @@ -12,7 +12,7 @@ let enable = mkEnableOption "krebs.backup" // { default = true; }; plans = mkOption { default = {}; - type = types.attrsOf (types.submodule ({ + type = types.attrsOf (types.submodule ({ config, ... }: { # TODO enable = mkEnableOption "TODO" // { default = true; }; options = { method = mkOption { @@ -20,6 +20,7 @@ let }; name = mkOption { type = types.str; + default = config._module.args.name; }; src = mkOption { type = types.krebs.file-location; diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index 26b0947bb..c880ea788 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -3,7 +3,7 @@ with lib; { - hosts = addNames { + hosts = { echelon = { cores = 2; dc = "lass"; #dc = "cac"; @@ -214,7 +214,7 @@ with lib; }; }; - users = addNames { + users = { lass = { pubkey = readFile ../../Zpubkeys/lass.ssh.pub; mail = "lass@mors.retiolum"; diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix index 38e773b53..693a954ab 100644 --- a/krebs/3modules/makefu/default.nix +++ b/krebs/3modules/makefu/default.nix @@ -3,7 +3,7 @@ with lib; { - hosts = addNames { + hosts = { pnp = { cores = 1; dc = "makefu"; #vm on 'omo' @@ -364,7 +364,7 @@ TNs2RYfwDy/r6H/hDeB/BSngPouedEVcPwIDAQAB ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcxWFEPzke/Sdd9qNX6rSJgXal8NmINYajpFCxXfYdj root@gum"; }; }; - users = addNames rec { + users = rec { makefu = { mail = "makefu@pornocauster.retiolum"; pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCl3RTOHd5DLiVeUbUr/GSiKoRWknXQnbkIf+uNiFO+XxiqZVojPlumQUVhasY8UzDzj9tSDruUKXpjut50FhIO5UFAgsBeMJyoZbgY/+R+QKU00Q19+IiUtxeFol/9dCO+F4o937MC0OpAC10LbOXN/9SYIXueYk3pJxIycXwUqhYmyEqtDdVh9Rx32LBVqlBoXRHpNGPLiswV2qNe0b5p919IGcslzf1XoUzfE3a3yjk/XbWh/59xnl4V7Oe7+iQheFxOT6rFA30WYwEygs5As//ZYtxvnn0gA02gOnXJsNjOW9irlxOUeP7IOU6Ye3WRKFRR0+7PS+w8IJLag2xb makefu@pornocauster"; diff --git a/krebs/3modules/mv/default.nix b/krebs/3modules/mv/default.nix index 6da2abc85..70417157f 100644 --- a/krebs/3modules/mv/default.nix +++ b/krebs/3modules/mv/default.nix @@ -3,7 +3,7 @@ with lib; { - hosts = addNames { + hosts = { stro = { cores = 4; dc = "mv"; @@ -31,7 +31,7 @@ with lib; ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+7Qa51l0NSkBiaK2s8vQEoeObV3UPZyEzMxfUK/ZAO root@stro"; }; }; - users = addNames { + users = { mv_stro = { mail = "mv@stro.retiolum"; pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCxM34g1GUm5EtU00DAOlGSx8MsCWunhGTrozurj460QT7EdUbZvj0AcrQC0lP9kaZyhX+KueTjmLC+ICsnlHYeg4zoSEnSAUkccuyZxfgynVc4wrpfNAc1nHjDhDb/ulnC+8wNxvxUpI0XlBgu/Y7AbbChZj3ofv6uGGHJKfG3uSyCkt9VTCi1KwydHpe9P252N8NbopnbnkT0EMkRHruh7ICEKr4/ivmUL/IUrbFicEeCy4SeRAl8+00x4WqqvbBPzgdXn0AIjKLvus3dBoQubJNpUoXnyXJbElnit5a7QcgZJNLMbV0kf9zzCGduxkADzHkAFB9D4PuSMYt62iy12QlGbm80A9ncuwaSyJf7hPTvNbU8VyCblyfRz/SCaudUrfk5Xbxxu26FHi4hZqr3IUQt4T8pD8JWYGl4n2ZKnD8hHz/jrmNBK8h9d+VFafU9t1hRxlFsW1AhMEM+kfWClyhfTcKBKbml2a657lgUEVmlZt+18kwwsivM1QhHNTgxn5urRXRkh1VQ40UQroVuV1OUmvAngyAthF441VPGc5z7kEI+D4qjmUjSy6k4dvEy/RGfsAgJCf63zilRuUbL68f2OpxE8aeZZUXPvgdLml284pry7+C5sjlnCDoJfCj/yhdVx6mU9pWUd/Q97CLQewbsYhMzsqlBlIkXuipkDQ== mv@stro"; diff --git a/krebs/3modules/shared/default.nix b/krebs/3modules/shared/default.nix index 91d92857b..52aa4de41 100644 --- a/krebs/3modules/shared/default.nix +++ b/krebs/3modules/shared/default.nix @@ -32,7 +32,7 @@ let }; }); in { - hosts = addNames { + hosts = { wolf = { dc = "shack"; nets = { @@ -68,7 +68,7 @@ in { ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKYMXMWZIK0jjnZDM9INiYAKcwjXs2241vew54K8veCR"; }; } // testHosts; - users = addNames { + users = { shared = { mail = "spam@krebsco.de"; pubkey = "lol"; # TODO krebs.users.shared.pubkey should be unnecessary diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index 9adb0ce11..ca07acd17 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -6,7 +6,7 @@ with lib; dns.providers = { de.viljetic = "regfish"; }; - hosts = addNames { + hosts = { cd = rec { cores = 2; dc = "tv"; #dc = "cac"; @@ -351,7 +351,7 @@ with lib; ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnjfceKuHNQu7S4eYFN1FqgzMqiL7haNZMh2ZLhvuhK root@xu"; }; }; - users = addNames rec { + users = rec { mv = { mail = "mv@cd.retiolum"; pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGer9e2+Lew7vnisgBbsFNECEIkpNJgEaqQqgb9inWkQ mv@vod"; diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix index 6c396a132..2907a413a 100644 --- a/krebs/4lib/types.nix +++ b/krebs/4lib/types.nix @@ -10,6 +10,7 @@ types // rec { options = { name = mkOption { type = label; + default = config._module.args.name; }; dc = mkOption { type = label; @@ -155,19 +156,20 @@ types // rec { merge = mergeOneOption; }; - user = submodule { + user = submodule ({ config, ... }: { options = { mail = mkOption { type = str; # TODO retiolum mail address }; name = mkOption { type = str; # TODO + default = config._module.args.name; }; pubkey = mkOption { type = str; }; }; - }; + }); # TODO addr = str; diff --git a/makefu/2configs/backup.nix b/makefu/2configs/backup.nix index ed6d1f4a7..936f31c1c 100644 --- a/makefu/2configs/backup.nix +++ b/makefu/2configs/backup.nix @@ -24,7 +24,7 @@ let }; }; in { - krebs.backup.plans = addNames { + krebs.backup.plans = { wry-to-omo_var-www = defaultPull wry "/var/www"; }; } diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix index ce937a744..f4d368557 100644 --- a/tv/2configs/backup.nix +++ b/tv/2configs/backup.nix @@ -1,7 +1,7 @@ { config, lib, ... }: with lib; { - krebs.backup.plans = addNames { + krebs.backup.plans = { wu-home-xu = { method = "push"; src = { host = config.krebs.hosts.wu; path = "/home"; }; From 30306159af3aac4f04db60f27637480bbecaaa1d Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 19:37:14 +0100 Subject: [PATCH 02/81] add krebs.types.{filename,username} --- krebs/4lib/types.nix | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix index 2907a413a..f91503794 100644 --- a/krebs/4lib/types.nix +++ b/krebs/4lib/types.nix @@ -162,7 +162,7 @@ types // rec { type = str; # TODO retiolum mail address }; name = mkOption { - type = str; # TODO + type = username; default = config._module.args.name; }; pubkey = mkOption { @@ -194,4 +194,20 @@ types // rec { }; }; }; + + # POSIX.1‐2013, 3.278 Portable Filename Character Set + filename = mkOptionType { + name = "POSIX filename"; + check = let + filename-chars = stringToCharacters + "-.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"; + in s: all (flip elem filename-chars) (stringToCharacters s); + merge = mergeOneOption; + }; + + # POSIX.1-2013, 3.431 User Name + username = mkOptionType { + name = "POSIX username"; + check = s: filename.check s && substring 0 1 s != "-"; + }; } From 221510db0cd2d9cb7c38d33a148086d9187be804 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 02:04:12 +0100 Subject: [PATCH 03/81] nixpkgs: relink --- nixpkgs/default.nix | 2 +- nixpkgs/lib | 2 +- nixpkgs/pkgs | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/nixpkgs/default.nix b/nixpkgs/default.nix index 74e9d7633..6e5223c16 120000 --- a/nixpkgs/default.nix +++ b/nixpkgs/default.nix @@ -1 +1 @@ -../upstream-nixpkgs/default.nix \ No newline at end of file +../../upstream-nixpkgs/default.nix \ No newline at end of file diff --git a/nixpkgs/lib b/nixpkgs/lib index 2284ef489..7b13c8069 120000 --- a/nixpkgs/lib +++ b/nixpkgs/lib @@ -1 +1 @@ -../upstream-nixpkgs/lib \ No newline at end of file +../../upstream-nixpkgs/lib \ No newline at end of file diff --git a/nixpkgs/pkgs b/nixpkgs/pkgs index ce5f5448b..983384943 120000 --- a/nixpkgs/pkgs +++ b/nixpkgs/pkgs @@ -1 +1 @@ -../upstream-nixpkgs/pkgs \ No newline at end of file +../../upstream-nixpkgs/pkgs \ No newline at end of file From 02c1f8d2703aa03e41adcd5aec0d3ec402bbb367 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 03:09:14 +0100 Subject: [PATCH 04/81] tv: accept internet echo requests --- tv/2configs/default.nix | 1 + tv/3modules/iptables.nix | 27 +++++++++++++++------------ 2 files changed, 16 insertions(+), 12 deletions(-) diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index 57c4620c4..52d85f856 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -165,6 +165,7 @@ with lib; { tv.iptables.enable = true; + tv.iptables.accept-echo-request = "internet"; } { diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix index cbf49f577..9d5b5d075 100644 --- a/tv/3modules/iptables.nix +++ b/tv/3modules/iptables.nix @@ -13,6 +13,11 @@ let api = { enable = mkEnableOption "tv.iptables"; + accept-echo-request = mkOption { + type = with types; nullOr (enum ["internet" "retiolum"]); + default = "retiolum"; + }; + input-internet-accept-new-tcp = mkOption { type = with types; listOf (either int str); default = []; @@ -49,10 +54,14 @@ let }; - accept-new-tcp = port: - "-p tcp -m tcp --dport ${port} -m conntrack --ctstate NEW -j ACCEPT"; - - rules = iptables-version: + rules = iptables-version: let + accept-echo-request = { + ip4tables = "-p icmp -m icmp --icmp-type echo-request -j ACCEPT"; + ip6tables = "-p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT"; + }."ip${toString iptables-version}tables"; + accept-new-tcp = port: + "-p tcp -m tcp --dport ${port} -m conntrack --ctstate NEW -j ACCEPT"; + in pkgs.writeText "tv-iptables-rules${toString iptables-version}" '' *nat :PREROUTING ACCEPT [0:0] @@ -76,18 +85,12 @@ let "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT" "-i lo -j ACCEPT" ] + ++ optional (cfg.accept-echo-request == "internet") accept-echo-request ++ map accept-new-tcp (unique (map toString cfg.input-internet-accept-new-tcp)) ++ ["-i retiolum -j Retiolum"] )} ${concatMapStringsSep "\n" (rule: "-A Retiolum ${rule}") ([] - ++ { - ip4tables = [ - "-p icmp -m icmp --icmp-type echo-request -j ACCEPT" - ]; - ip6tables = [ - "-p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT" - ]; - }."ip${toString iptables-version}tables" + ++ optional (cfg.accept-echo-request == "retiolum") accept-echo-request ++ map accept-new-tcp (unique (map toString cfg.input-retiolum-accept-new-tcp)) ++ { ip4tables = [ From 52fd80748d95b522561a477a1869d6923516f633 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 05:08:32 +0100 Subject: [PATCH 05/81] krebs.types.{hostname,label}: check RFC952 --- krebs/4lib/types.nix | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix index f91503794..52eb764ef 100644 --- a/krebs/4lib/types.nix +++ b/krebs/4lib/types.nix @@ -175,8 +175,6 @@ types // rec { addr = str; addr4 = str; addr6 = str; - hostname = str; - label = str; krebs.file-location = types.submodule { options = { @@ -195,6 +193,22 @@ types // rec { }; }; + # RFC952, B. Lexical grammar, + hostname = mkOptionType { + name = "hostname"; + check = x: all label.check (splitString "." x); + merge = mergeOneOption; + }; + + # RFC952, B. Lexical grammar, + # RFC1123, 2.1 Host Names and Numbers + label = mkOptionType { + name = "label"; + # TODO case-insensitive labels + check = x: match "[0-9A-Za-z]([0-9A-Za-z-]*[0-9A-Za-z])?" x != null; + merge = mergeOneOption; + }; + # POSIX.1‐2013, 3.278 Portable Filename Character Set filename = mkOptionType { name = "POSIX filename"; From 01dbc54c3207b44e4adaaae92fffc8a34bda6f18 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 05:09:56 +0100 Subject: [PATCH 06/81] krebs.backup: determine fastest address --- krebs/3modules/backup.nix | 43 ++++++++++++++++++++++++++++++--------- 1 file changed, 33 insertions(+), 10 deletions(-) diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix index 17d8a3c98..0f85b4879 100644 --- a/krebs/3modules/backup.nix +++ b/krebs/3modules/backup.nix @@ -145,9 +145,11 @@ let set -efu identity=${shell.escape plan.src.host.ssh.privkey.path} src=${shell.escape plan.src.path} - dst_target=${shell.escape "root@${getFQDN plan.dst.host}"} + dst_user=root + dst_host=$(${fastest-address plan.dst.host}) + dst_port=$(${network-ssh-port plan.dst.host "$dst_host"}) dst_path=${shell.escape plan.dst.path} - dst=$dst_target:$dst_path + dst=$dst_user@$dst_host:$dst_path # Export NOW so runtime of rsync doesn't influence snapshot naming. export NOW @@ -156,7 +158,7 @@ let echo >&2 "update snapshot: current; $src -> $dst" rsync >&2 \ -aAXF --delete \ - -e "ssh -F /dev/null -i $identity" \ + -e "ssh -F /dev/null -i $identity ''${dst_port:+-p $dst_port}" \ --rsync-path ${shell.escape "mkdir -m 0700 -p ${shell.escape plan.dst.path} && rsync"} \ --link-dest="$dst_path/current" \ @@ -165,10 +167,10 @@ let exec ssh -F /dev/null \ -i "$identity" \ - "$dst_target" \ + ''${dst_port:+-p $dst_port} \ + "$dst_user@$dst_host" \ -T \ env NOW="$NOW" /bin/sh < ${remote-snapshot} - EOF ''; remote-snapshot = writeDash "backup.${plan.name}.push.remote-snapshot" '' @@ -205,7 +207,11 @@ let # TODO check if there is a previous set -efu identity=${shell.escape plan.dst.host.ssh.privkey.path} - src=${shell.escape "root@${getFQDN plan.src.host}:${plan.src.path}"} + src_user=root + src_host=$(${fastest-address plan.src.host}) + src_port=$(${network-ssh-port plan.src.host "$src_host"}) + src_path=${shell.escape plan.src.path} + src=$src_user@$src_host:$src_path dst=${shell.escape plan.dst.path} # Export NOW so runtime of rsync doesn't influence snapshot naming. @@ -216,7 +222,7 @@ let mkdir -m 0700 -p ${shell.escape plan.dst.path} rsync >&2 \ -aAXF --delete \ - -e "ssh -F /dev/null -i $identity" \ + -e "ssh -F /dev/null -i $identity ''${src_port:+-p $src_port}" \ --link-dest="$dst/current" \ "$src/" \ "$dst/.partial" @@ -274,9 +280,6 @@ let plan.snapshots)} ''; - # TODO getFQDN: admit hosts in other domains - getFQDN = host: "${host.name}.${config.krebs.search-domain}"; - writeDash = name: text: pkgs.writeScript name '' #! ${pkgs.dash}/bin/dash ${text} @@ -292,6 +295,26 @@ let ''; }; + # XXX Is one ping enough to determine fastest address? + # Note that we're using net.addrs4 instead of net.aliases because we define + # ports only for addresses. See krebs/3modules/default.nix + fastest-address = host: '' + { ${pkgs.fping}/bin/fping Date: Sun, 7 Feb 2016 05:14:37 +0100 Subject: [PATCH 07/81] tv: define config.krebs.hosts.*.nets.gg23.ssh.port --- krebs/3modules/tv/default.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index ca07acd17..b9a6c5163 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -198,6 +198,7 @@ with lib; gg23 = { addrs4 = ["10.23.1.110"]; aliases = ["nomic.gg23"]; + ssh.port = 11423; }; retiolum = { addrs4 = ["10.243.0.110"]; @@ -292,6 +293,7 @@ with lib; gg23 = { addrs4 = ["10.23.1.37"]; aliases = ["wu.gg23"]; + ssh.port = 11423; }; retiolum = { addrs4 = ["10.243.13.37"]; @@ -326,6 +328,7 @@ with lib; gg23 = { addrs4 = ["10.23.1.38"]; aliases = ["xu.gg23"]; + ssh.port = 11423; }; retiolum = { addrs4 = ["10.243.13.38"]; From 949f466cf78ba2e76002012715172e5d5d394006 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 05:17:07 +0100 Subject: [PATCH 08/81] tv: s/_/-/g in usernames --- krebs/3modules/mv/default.nix | 2 +- krebs/3modules/tv/default.nix | 4 ++-- mv/2configs/git.nix | 2 +- tv/2configs/git.nix | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/krebs/3modules/mv/default.nix b/krebs/3modules/mv/default.nix index 70417157f..7245c143d 100644 --- a/krebs/3modules/mv/default.nix +++ b/krebs/3modules/mv/default.nix @@ -32,7 +32,7 @@ with lib; }; }; users = { - mv_stro = { + mv-stro = { mail = "mv@stro.retiolum"; pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCxM34g1GUm5EtU00DAOlGSx8MsCWunhGTrozurj460QT7EdUbZvj0AcrQC0lP9kaZyhX+KueTjmLC+ICsnlHYeg4zoSEnSAUkccuyZxfgynVc4wrpfNAc1nHjDhDb/ulnC+8wNxvxUpI0XlBgu/Y7AbbChZj3ofv6uGGHJKfG3uSyCkt9VTCi1KwydHpe9P252N8NbopnbnkT0EMkRHruh7ICEKr4/ivmUL/IUrbFicEeCy4SeRAl8+00x4WqqvbBPzgdXn0AIjKLvus3dBoQubJNpUoXnyXJbElnit5a7QcgZJNLMbV0kf9zzCGduxkADzHkAFB9D4PuSMYt62iy12QlGbm80A9ncuwaSyJf7hPTvNbU8VyCblyfRz/SCaudUrfk5Xbxxu26FHi4hZqr3IUQt4T8pD8JWYGl4n2ZKnD8hHz/jrmNBK8h9d+VFafU9t1hRxlFsW1AhMEM+kfWClyhfTcKBKbml2a657lgUEVmlZt+18kwwsivM1QhHNTgxn5urRXRkh1VQ40UQroVuV1OUmvAngyAthF441VPGc5z7kEI+D4qjmUjSy6k4dvEy/RGfsAgJCf63zilRuUbL68f2OpxE8aeZZUXPvgdLml284pry7+C5sjlnCDoJfCj/yhdVx6mU9pWUd/Q97CLQewbsYhMzsqlBlIkXuipkDQ== mv@stro"; }; diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index b9a6c5163..b6d779981 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -363,11 +363,11 @@ with lib; mail = "tv@wu.retiolum"; pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDFR//RnCvEZAt0F6ExDsatKZ/DDdifanuSL360mqOhaFieKI34RoOwfQT9T+Ga52Vh5V2La6esvlph686EdgzeKLvDoxEwFM9ZYFBcMrNzu4bMTlgE7YUYw5JiORyXNfznBGnme6qpuvx9ibYhUyiZo99kM8ys5YrUHrP2JXQJMezDFZHxT4GFMOuSdh/1daGoKKD6hYL/jEHX8CI4E3BSmKK6ygYr1fVX0K0Tv77lIi5mLXucjR7CytWYWYnhM6DC3Hxpv2zRkPgf3k0x/Y1hrw3V/r0Me5h90pd2C8pFaWA2ZoUT/fmyVqvx1tZPYToU/O2dMItY0zgx2kR0yD+6g7Aahz3R+KlXkV8k5c8bbTbfGnZWDR1ZlbLRM9Yt5vosfwapUD90MmVkpmR3wUkO2sUKi80QfC7b4KvSDXQ+MImbGxMaU5Bnsq1PqLN95q+uat3nlAVBAELkcx51FlE9CaIS65y4J7FEDg8BE5JeuCNshh62VSYRXVSFt8bk3f/TFGgzC8OIo14BhVmiRQQ503Z1sROyf5xLX2a/EJavMm1i2Bs2TH6ROKY9z5Pz8hT5US0r381V8oG7TZyLF9HTtoy3wCYsgWA5EmLanjAsVU2YEeAA0rxzdtYP8Y2okFiJ6u+M4HQZ3Wg3peSodyp3vxdYce2vk4EKeqEFuuS82850DYb7Et7fmp+wQQUT8Q/bMO0DreWjHoMM5lE4LJ4ME6AxksmMiFtfo/4Fe2q9D+LAqZ+ANOcv9M+8Rn6ngiYmuRNd0l/a02q1PEvO6vTfXgcl4f7Z1IULHPEaDNZHCJS1K5RXYFqYQ6OHsTmOm7hnwaRAS97+VFMo1i5uvTx9nYaAcY7yzq3Ckfb67dMBKApGOpJpkvPgfrP7bgBO5rOZXM1opXqVPb09nljAhhAhyCTh1e/8+mJrBo0cLQ/LupQzVxGDgm3awSMPxsZAN45PSWz76zzxdDa1MMo51do+VJHfs7Wl0NcXAQrniOBYL9Wqt0qNkn1gY5smkkISGeQ/vxNap4MmzeZE7b5fpOy+2fpcRVQLpc4nooQzJvSVTFz+25lgZ6iHf45K87gQFMIAri1Pf/EDDpL87az+bRWvWi+BA2kMe1kf+Ay1LyMz8r+g51H0ma0bNFh6+fbWMfUiD9JCepIObclnUJ4NlWfcgHxTf17d/4tl6z4DTcLpCCk8Da77JouSHgvtcRbRlFV1OfhWZLXUsrlfpaQTiItv6TGIr3k7+7b66o3Qw/GQVs5GmYifaIZIz8n8my4XjkaMBd0SZfBzzvFjHMq6YUP9+SbjvReqofuoO+5tW1wTYZXitFFBfwuHlXm6w77K5QDBW6olT7pat41/F5eGxLcz tv@wu"; }; - tv_nomic = { + tv-nomic = { inherit (tv) mail; pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3dYR/n4Yw8OsYmfR2rSUG7o10G6AqOlSJHuHSEmANbMkqjiWl1TnpORtt5bAktyAGI4vWf9vhNEnxuIqGXWSV+3yCd7yfBHR1m0Y9QSw6blQ0xc1venl3JU0kpEyJfUn8a9cdXlnRiS0MP1gcsN7Zk8cqBELJYJajkSEnsT4eVaU5/wdnyzUO1fk8D8tFBJbF/tsWDLJPu4P18rpxq4wZgA2qmyHoVDEVlrz2OYcziXT6gpG0JGnToteaNg9ok5QavEYFpp8P+k1AacrBjc1PAb4MaMX1nfkSyaZwSqLdH35XkNRgPhVVmqZ5PlG3VeNpPSwpdcKi8P3zH1xG9g6Usx1SAyvcoAyGHdOwmFuA2tc1HgYEiQ+OsPrHZHujBOOZsKTN9+IZHScCAe+UmUcK413WEZKPs8PeFjf1gQAoDXb55JpksxLAnC/SQOl4FhkctIAXxr12ALlyt9UFPzIoj/Nj2MpFzGSlf653fTFmnMbQ8+GICc4TUpqx5GELZhfQuprBTv/55a9zKvM4B8XT3Bn9olQzMQIXEjXb3WUVFDDNWeNydToorYn1wG3ZWQ+3f0IlqRicWO7Q9BRj1Lp5rcUCb+naJ48tGY6HFUZ1Kz/0x458GDFvUd8mCJjqqmeSkUEeZd0xet5tVFg/bYoSslEqPF6pz7V3ruJMSdYxnQ== tv@nomic #2"; }; - tv_xu = { + tv-xu = { inherit (tv) mail; pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/3nkqxe8YrDVt615n96A7iC3vvwsiqgpsBYC/bhwfBHu1bAtBmTWVqSKDIdwg7p8TQpIKtAgZ3IJT3BlrnVTeR4RIviLjHjYWW1NBhm+nXi+heThgi5fLciE3lVLVsy5X9Kc1ZPLgLa1In0REOanwbueOD0ESN1yKIDwUUdczw/o3dLDMzanqFHKuSSN4o9Ex2x+MRj9eLsb706s4VSYMo3lirRCJeAOGv1C7Xg1cuepdhIeJsq9aF7vSy15c0nCkWwr8zdY7pbMPYCe5zvIEymZ0UowZ5HQ3NmIZnYDxa4E1PFjDczHdQbVmmGMI80grNwMsHzQ6bynHSPXDoLf4WodXlhS0+9Ju5QavDT6uqZ9uhDBuWC8QNgWUMIJnEaTBFyA0OI1akl8Q2RLC+qnNf5IwItSq+GDwEsB2ZJNW3kOk1kNiCUrBafRYpPaFeP97wzzP4uYlBKAr2SOLrrkf7NFEdw2ihxhDMNnps/ErRJ8U0zdpmalw8mItGyqRULpHjk/wN00rYOdBIhW3G3QJuVgtGnWtGCBG5x70EfMiSEXPD3YSsVVsgKD+v8qr+YiilRRD+N3gaHhiOWA6HgxRNul/P4llk0ktTpb9LoHk2+oooTH5ZuuT/8yF8J4stZt7EIOH+mSOAXG1z0BwnEkQu7pVKwu/oOZpGJTvBrGwww== tv@xu"; }; diff --git a/mv/2configs/git.nix b/mv/2configs/git.nix index 991d0c410..c182d0d1e 100644 --- a/mv/2configs/git.nix +++ b/mv/2configs/git.nix @@ -45,7 +45,7 @@ let perm = push "refs/*" [ non-fast-forward create delete merge ]; } ++ optional repo.public { - user = [ lass makefu uriel tv tv_xu ]; + user = [ lass makefu uriel tv tv-xu ]; repo = [ repo ]; perm = fetch; } ++ diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix index b8180085f..85fd72539 100644 --- a/tv/2configs/git.nix +++ b/tv/2configs/git.nix @@ -90,7 +90,7 @@ let with git // config.krebs.users; repo: singleton { - user = [ tv tv_xu ]; + user = [ tv tv-xu ]; repo = [ repo ]; perm = push "refs/*" [ non-fast-forward create delete merge ]; } ++ From 02ad327081f2315b9ab15733319b167f64180a0d Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 05:32:03 +0100 Subject: [PATCH 09/81] krebs.backup writeDash* -> pkgs --- krebs/3modules/backup.nix | 35 ++++++++++------------------------- krebs/5pkgs/default.nix | 15 +++++++++++++++ 2 files changed, 25 insertions(+), 25 deletions(-) diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix index 0f85b4879..ae766fa9d 100644 --- a/krebs/3modules/backup.nix +++ b/krebs/3modules/backup.nix @@ -128,11 +128,11 @@ let }; push = plan: let - # We use writeDashBin and return the absolute path so systemd will produce - # nice names in the log, i.e. without the Nix store hash. + # We use pkgs.writeDashBin and return the absolute path so systemd will + # produce nice names in the log, i.e. without the Nix store hash. out = "${main}/bin/${main.name}"; - main = writeDashBin "backup.${plan.name}.push" '' + main = pkgs.writeDashBin "backup.${plan.name}.push" '' set -efu dst=${shell.escape plan.dst.path} @@ -140,7 +140,7 @@ let exec flock -n "$dst" ${critical-section} ''; - critical-section = writeDash "backup.${plan.name}.push.critical-section" '' + critical-section = pkgs.writeDash "backup.${plan.name}.push.critical-section" '' # TODO check if there is a previous set -efu identity=${shell.escape plan.src.host.ssh.privkey.path} @@ -173,7 +173,7 @@ let env NOW="$NOW" /bin/sh < ${remote-snapshot} ''; - remote-snapshot = writeDash "backup.${plan.name}.push.remote-snapshot" '' + remote-snapshot = pkgs.writeDash "backup.${plan.name}.push.remote-snapshot" '' set -efu dst=${shell.escape plan.dst.path} @@ -191,11 +191,11 @@ let # TODO admit plan.dst.user and its ssh identity pull = plan: let - # We use writeDashBin and return the absolute path so systemd will produce - # nice names in the log, i.e. without the Nix store hash. + # We use pkgs.writeDashBin and return the absolute path so systemd will + # produce nice names in the log, i.e. without the Nix store hash. out = "${main}/bin/${main.name}"; - main = writeDashBin "backup.${plan.name}.pull" '' + main = pkgs.writeDashBin "backup.${plan.name}.pull" '' set -efu dst=${shell.escape plan.dst.path} @@ -203,7 +203,7 @@ let exec flock -n "$dst" ${critical-section} ''; - critical-section = writeDash "backup.${plan.name}.pull.critical-section" '' + critical-section = pkgs.writeDash "backup.${plan.name}.pull.critical-section" '' # TODO check if there is a previous set -efu identity=${shell.escape plan.dst.host.ssh.privkey.path} @@ -235,7 +235,7 @@ let ''; in out; - take-snapshots = plan: writeDash "backup.${plan.name}.take-snapshots" '' + take-snapshots = plan: pkgs.writeDash "backup.${plan.name}.take-snapshots" '' set -efu NOW=''${NOW-$(date +%s)} dst=${shell.escape plan.dst.path} @@ -280,21 +280,6 @@ let plan.snapshots)} ''; - writeDash = name: text: pkgs.writeScript name '' - #! ${pkgs.dash}/bin/dash - ${text} - ''; - - writeDashBin = name: text: pkgs.writeTextFile { - executable = true; - destination = "/bin/${name}"; - name = name; - text = '' - #! ${pkgs.dash}/bin/dash - ${text} - ''; - }; - # XXX Is one ping enough to determine fastest address? # Note that we're using net.addrs4 instead of net.aliases because we define # ports only for addresses. See krebs/3modules/default.nix diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix index c4b1dafe4..a0ccdcf49 100644 --- a/krebs/5pkgs/default.nix +++ b/krebs/5pkgs/default.nix @@ -61,6 +61,21 @@ subdirs // rec { strip --strip-unneeded "$exe" ''; + writeDash = name: text: pkgs.writeScript name '' + #! ${pkgs.dash}/bin/dash + ${text} + ''; + + writeDashBin = name: text: pkgs.writeTextFile { + executable = true; + destination = "/bin/${name}"; + name = name; + text = '' + #! ${pkgs.dash}/bin/dash + ${text} + ''; + }; + writeNixFromCabal = name: path: pkgs.runCommand name {} '' ${pkgs.cabal2nix}/bin/cabal2nix ${path} > $out ''; From 076f93bc02897b01e3ed997fb2f9a543eb6547c9 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 05:38:27 +0100 Subject: [PATCH 10/81] mu: 10.243.20.01 -> 10.243.20.1 --- krebs/3modules/tv/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index b6d779981..abcc67933 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -172,7 +172,7 @@ with lib; mu = { nets = { retiolum = { - addrs4 = ["10.243.20.01"]; + addrs4 = ["10.243.20.1"]; addrs6 = ["42:0:0:0:0:0:0:2001"]; aliases = [ "mu.r" From b746dd09361b0cfb14abd3995afe10536c8fcad8 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 06:22:56 +0100 Subject: [PATCH 11/81] krebs.backup: ensure link dest exists --- krebs/3modules/backup.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix index ae766fa9d..d50628073 100644 --- a/krebs/3modules/backup.nix +++ b/krebs/3modules/backup.nix @@ -160,7 +160,7 @@ let -aAXF --delete \ -e "ssh -F /dev/null -i $identity ''${dst_port:+-p $dst_port}" \ --rsync-path ${shell.escape - "mkdir -m 0700 -p ${shell.escape plan.dst.path} && rsync"} \ + "mkdir -m 0700 -p ${shell.escape plan.dst.path}/current && rsync"} \ --link-dest="$dst_path/current" \ "$src/" \ "$dst/.partial" From f1ebd4e4e1bdc76bfca894ace336064b81cc98a1 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 06:43:26 +0100 Subject: [PATCH 12/81] krebs knownHosts: add-port everywhere --- krebs/3modules/default.nix | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 529506905..e11d40a05 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -179,7 +179,6 @@ let (mapAttrsToList (net-name: net: let - aliases = shorts ++ longs; longs = net.aliases; shorts = map (removeSuffix ".${cfg.search-domain}") @@ -190,7 +189,7 @@ let then "[${a}]:${toString net.ssh.port}" else a; in - aliases ++ map add-port net.addrs) + map add-port (shorts ++ longs ++ net.addrs)) host.nets); publicKey = host.ssh.pubkey; From b819d6c452605af66282c14e25907793a4b77c65 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 07:47:29 +0100 Subject: [PATCH 13/81] tv vim: add file-line plugin --- tv/2configs/vim.nix | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix index 23f90af05..9f702cd4d 100644 --- a/tv/2configs/vim.nix +++ b/tv/2configs/vim.nix @@ -13,9 +13,21 @@ let environment.variables.VIMINIT = ":so /etc/vimrc"; }; - extra-runtimepath = concatStringsSep "," [ - "${pkgs.vimPlugins.undotree}/share/vim-plugins/undotree" - ]; + extra-runtimepath = let + inherit (pkgs.vimUtils) buildVimPlugin rtpPath; + fromVimPlugins = pkgs: concatStringsSep "," + (mapAttrsToList (name: pkg: "${pkg}/${rtpPath}/${name}") pkgs); + in fromVimPlugins { + inherit (pkgs.vimPlugins) undotree; + file-line = buildVimPlugin { + name = "file-line-1.0"; + src = pkgs.fetchgit { + url = git://github.com/bogado/file-line; + rev = "refs/tags/1.0"; + sha256 = "0z47zq9rqh06ny0q8lpcdsraf3lyzn9xvb59nywnarf3nxrk6hx0"; + }; + }; + }; dirs = { backupdir = "$HOME/.cache/vim/backup"; From 698296eb8c986127e0fb195a51b3adf3f31eeedf Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 07:50:17 +0100 Subject: [PATCH 14/81] tv vim: restore original umask --- tv/2configs/vim.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix index 9f702cd4d..8a6299a39 100644 --- a/tv/2configs/vim.nix +++ b/tv/2configs/vim.nix @@ -47,9 +47,10 @@ let vim = pkgs.writeScriptBin "vim" '' #! ${pkgs.dash}/bin/dash set -f + umask=$(umask) umask 0077 ${concatStringsSep "\n" (map (x: "mkdir -p ${x}") mkdirs)} - umask 0022 + umask "$umask" exec ${pkgs.vim}/bin/vim "$@" ''; From ee5a1ddffe51117862f7e2669f3939dd165d5686 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 08:09:07 +0100 Subject: [PATCH 15/81] tv vim: simplify wrapper --- tv/2configs/vim.nix | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix index 8a6299a39..69a880dab 100644 --- a/tv/2configs/vim.nix +++ b/tv/2configs/vim.nix @@ -44,13 +44,9 @@ let alldirs = attrValues dirs ++ map dirOf (attrValues files); in unique (sort lessThan alldirs); - vim = pkgs.writeScriptBin "vim" '' - #! ${pkgs.dash}/bin/dash - set -f - umask=$(umask) - umask 0077 - ${concatStringsSep "\n" (map (x: "mkdir -p ${x}") mkdirs)} - umask "$umask" + vim = pkgs.writeDashBin "vim" '' + set -efu + (umask 0077; exec ${pkgs.coreutils}/bin/mkdir -p ${toString mkdirs}) exec ${pkgs.vim}/bin/vim "$@" ''; From 4c40eba8161d4afaa85984737c6f03adf861be7a Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 15:58:49 +0100 Subject: [PATCH 16/81] krebs: add localhost to knownHosts --- krebs/3modules/default.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index e11d40a05..e4e5642ce 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -155,7 +155,16 @@ let let inherit (config.krebs.build.host.ssh) privkey; in mkIf (privkey != null) (mkForce [privkey]); + # TODO use imports for merging services.openssh.knownHosts = + (let inherit (config.krebs.build.host.ssh) pubkey; in + optionalAttrs (pubkey != null) { + localhost = { + hostNames = ["localhost" "127.0.0.1" "::1"]; + publicKey = pubkey; + }; + }) + // # GitHub's IPv4 address range is 192.30.252.0/22 # Refs https://help.github.com/articles/what-ip-addresses-does-github-use-that-i-should-whitelist/ # 192.30.252.0/22 = 192.30.252.0-192.30.255.255 (1024 addresses) From 00525dc0ef2b73e6d883eb6e7358a616b8c15b69 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 16:08:07 +0100 Subject: [PATCH 17/81] krebs.backup.plans.*.startAt: null disables timer --- krebs/3modules/backup.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix index d50628073..881e126f6 100644 --- a/krebs/3modules/backup.nix +++ b/krebs/3modules/backup.nix @@ -30,7 +30,7 @@ let }; startAt = mkOption { default = "hourly"; - type = types.str; # TODO systemd.time(7)'s calendar event + type = with types; nullOr str; # TODO systemd.time(7)'s calendar event }; snapshots = mkOption { default = { @@ -115,7 +115,8 @@ let ExecStart = push plan; Type = "oneshot"; }; - startAt = plan.startAt; + } // optionalAttrs (plan.startAt != null) { + inherit (plan) startAt; }; makePullService = plan: assert isPullDst plan; { @@ -124,7 +125,8 @@ let ExecStart = pull plan; Type = "oneshot"; }; - startAt = plan.startAt; + } // optionalAttrs (plan.startAt != null) { + inherit (plan) startAt; }; push = plan: let From d01c6f9dbcd2d1d7ccccff5fc8c41ffb53d04a42 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 16:09:46 +0100 Subject: [PATCH 18/81] krebs.backup: don't append .{pull,push} to service name --- krebs/3modules/backup.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix index 881e126f6..935370d9c 100644 --- a/krebs/3modules/backup.nix +++ b/krebs/3modules/backup.nix @@ -72,12 +72,12 @@ let ; systemd.services = flip mapAttrs' (filterAttrs (_:isPullDst) cfg.plans) (name: plan: { - name = "backup.${name}.pull"; + name = "backup.${name}"; value = makePullService plan; }) // flip mapAttrs' (filterAttrs (_:isPushSrc) cfg.plans) (name: plan: { - name = "backup.${name}.push"; + name = "backup.${name}"; value = makePushService plan; }) ; From 071194c3946b325103311f5c6528fba30580f125 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 16:21:58 +0100 Subject: [PATCH 19/81] krebs.backup: DRY up push and pull --- krebs/3modules/backup.nix | 335 ++++++++++++++------------------------ 1 file changed, 126 insertions(+), 209 deletions(-) diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix index 935370d9c..fa5b0cfd2 100644 --- a/krebs/3modules/backup.nix +++ b/krebs/3modules/backup.nix @@ -58,228 +58,145 @@ let }; imp = { - users.groups.backup.gid = genid "backup"; - users.users = {} - // { - root.openssh.authorizedKeys.keys = - map (plan: plan.dst.host.ssh.pubkey) - (filter isPullSrc (attrValues cfg.plans)) - ++ - map (plan: plan.src.host.ssh.pubkey) - (filter isPushDst (attrValues cfg.plans)) - ; - } - ; systemd.services = - flip mapAttrs' (filterAttrs (_:isPullDst) cfg.plans) (name: plan: { - name = "backup.${name}"; - value = makePullService plan; - }) - // - flip mapAttrs' (filterAttrs (_:isPushSrc) cfg.plans) (name: plan: { - name = "backup.${name}"; - value = makePushService plan; - }) - ; + listToAttrs (map (plan: nameValuePair "backup.${plan.name}" { + # TODO if there is plan.user, then use its privkey + # TODO push destination users need a similar path + path = with pkgs; [ + coreutils + gnused + openssh + rsync + utillinux + ]; + serviceConfig = rec { + ExecStart = start plan; + SyslogIdentifier = ExecStart.name; + Type = "oneshot"; + }; + } // optionalAttrs (plan.startAt != null) { + inherit (plan) startAt; + }) (filter (plan: build-host-is "pull" "dst" plan || + build-host-is "push" "src" plan) + (attrValues cfg.plans))); + + users.groups.backup.gid = genid "backup"; + users.users.root.openssh.authorizedKeys.keys = + map (plan: getAttr plan.method { + push = plan.src.host.ssh.pubkey; + pull = plan.dst.host.ssh.pubkey; + }) (filter (plan: build-host-is "pull" "src" plan || + build-host-is "push" "dst" plan) + (attrValues cfg.plans)); }; - isPushSrc = plan: - plan.method == "push" && - plan.src.host.name == config.krebs.build.host.name; + build-host-is = method: side: plan: + plan.method == method && + config.krebs.build.host.name == plan.${side}.host.name; - isPullSrc = plan: - plan.method == "pull" && - plan.src.host.name == config.krebs.build.host.name; - - isPushDst = plan: - plan.method == "push" && - plan.dst.host.name == config.krebs.build.host.name; - - isPullDst = plan: - plan.method == "pull" && - plan.dst.host.name == config.krebs.build.host.name; - - # TODO push destination needs this in the dst.user's PATH - service-path = [ - pkgs.coreutils - pkgs.gnused - pkgs.openssh - pkgs.rsync - pkgs.utillinux - ]; - - # TODO if there is plan.user, then use its privkey - makePushService = plan: assert isPushSrc plan; { - path = service-path; - serviceConfig = { - ExecStart = push plan; - Type = "oneshot"; - }; - } // optionalAttrs (plan.startAt != null) { - inherit (plan) startAt; - }; - - makePullService = plan: assert isPullDst plan; { - path = service-path; - serviceConfig = { - ExecStart = pull plan; - Type = "oneshot"; - }; - } // optionalAttrs (plan.startAt != null) { - inherit (plan) startAt; - }; - - push = plan: let - # We use pkgs.writeDashBin and return the absolute path so systemd will - # produce nice names in the log, i.e. without the Nix store hash. - out = "${main}/bin/${main.name}"; - - main = pkgs.writeDashBin "backup.${plan.name}.push" '' + start = plan: pkgs.writeDash "backup.${plan.name}" '' + set -efu + ${getAttr plan.method { + push = '' + identity=${shell.escape plan.src.host.ssh.privkey.path} + src_path=${shell.escape plan.src.path} + src=$src_path + dst_user=root + dst_host=$(${fastest-address plan.dst.host}) + dst_port=$(${network-ssh-port plan.dst.host "$dst_host"}) + dst_path=${shell.escape plan.dst.path} + dst=$dst_user@$dst_host:$dst_path + echo "update snapshot: current; $src -> $dst" >&2 + dst_shell() { + exec ssh -F /dev/null \ + -i "$identity" \ + ''${dst_port:+-p $dst_port} \ + "$dst_user@$dst_host" \ + -T "$with_dst_path_lock_script" + } + ''; + pull = '' + identity=${shell.escape plan.dst.host.ssh.privkey.path} + src_user=root + src_host=$(${fastest-address plan.src.host}) + src_port=$(${network-ssh-port plan.src.host "$src_host"}) + src_path=${shell.escape plan.src.path} + src=$src_user@$src_host:$src_path + dst_path=${shell.escape plan.dst.path} + dst=$dst_path + echo "update snapshot: current; $dst <- $src" >&2 + dst_shell() { + eval "$with_dst_path_lock_script" + } + ''; + }} + # Note that this only works because we trust date +%s to produce output + # that doesn't need quoting when used to generate a command string. + # TODO relax this requirement by selectively allowing to inject variables + # e.g.: ''${shell.quote "exec env NOW=''${shell.unquote "$NOW"} ..."} + with_dst_path_lock_script="exec env start_date=$(date +%s) "${shell.escape + "flock -n ${shell.escape plan.dst.path} /bin/sh" + } + rsync >&2 \ + -aAXF --delete \ + -e "ssh -F /dev/null -i $identity ''${dst_port:+-p $dst_port}" \ + --rsync-path ${shell.escape (concatStringsSep " && " [ + "mkdir -m 0700 -p ${shell.escape plan.dst.path}/current" + "exec flock -n ${shell.escape plan.dst.path} rsync" + ])} \ + --link-dest="$dst_path/current" \ + "$src/" \ + "$dst/.partial" + dst_shell < ${toFile "backup.${plan.name}.take-snapshots" '' set -efu + : $start_date + dst=${shell.escape plan.dst.path} - mkdir -m 0700 -p "$dst" - exec flock -n "$dst" ${critical-section} - ''; - - critical-section = pkgs.writeDash "backup.${plan.name}.push.critical-section" '' - # TODO check if there is a previous - set -efu - identity=${shell.escape plan.src.host.ssh.privkey.path} - src=${shell.escape plan.src.path} - dst_user=root - dst_host=$(${fastest-address plan.dst.host}) - dst_port=$(${network-ssh-port plan.dst.host "$dst_host"}) - dst_path=${shell.escape plan.dst.path} - dst=$dst_user@$dst_host:$dst_path - - # Export NOW so runtime of rsync doesn't influence snapshot naming. - export NOW - NOW=$(date +%s) - - echo >&2 "update snapshot: current; $src -> $dst" - rsync >&2 \ - -aAXF --delete \ - -e "ssh -F /dev/null -i $identity ''${dst_port:+-p $dst_port}" \ - --rsync-path ${shell.escape - "mkdir -m 0700 -p ${shell.escape plan.dst.path}/current && rsync"} \ - --link-dest="$dst_path/current" \ - "$src/" \ - "$dst/.partial" - - exec ssh -F /dev/null \ - -i "$identity" \ - ''${dst_port:+-p $dst_port} \ - "$dst_user@$dst_host" \ - -T \ - env NOW="$NOW" /bin/sh < ${remote-snapshot} - ''; - - remote-snapshot = pkgs.writeDash "backup.${plan.name}.push.remote-snapshot" '' - set -efu - dst=${shell.escape plan.dst.path} - - if test -e "$dst/current"; then - mv "$dst/current" "$dst/.previous" - fi - mv "$dst/.partial" "$dst/current" - rm -fR "$dst/.previous" - echo >&2 - - (${(take-snapshots plan).text}) - ''; - - in out; - - # TODO admit plan.dst.user and its ssh identity - pull = plan: let - # We use pkgs.writeDashBin and return the absolute path so systemd will - # produce nice names in the log, i.e. without the Nix store hash. - out = "${main}/bin/${main.name}"; - - main = pkgs.writeDashBin "backup.${plan.name}.pull" '' - set -efu - dst=${shell.escape plan.dst.path} - - mkdir -m 0700 -p "$dst" - exec flock -n "$dst" ${critical-section} - ''; - - critical-section = pkgs.writeDash "backup.${plan.name}.pull.critical-section" '' - # TODO check if there is a previous - set -efu - identity=${shell.escape plan.dst.host.ssh.privkey.path} - src_user=root - src_host=$(${fastest-address plan.src.host}) - src_port=$(${network-ssh-port plan.src.host "$src_host"}) - src_path=${shell.escape plan.src.path} - src=$src_user@$src_host:$src_path - dst=${shell.escape plan.dst.path} - - # Export NOW so runtime of rsync doesn't influence snapshot naming. - export NOW - NOW=$(date +%s) - - echo >&2 "update snapshot: current; $dst <- $src" - mkdir -m 0700 -p ${shell.escape plan.dst.path} - rsync >&2 \ - -aAXF --delete \ - -e "ssh -F /dev/null -i $identity ''${src_port:+-p $src_port}" \ - --link-dest="$dst/current" \ - "$src/" \ - "$dst/.partial" mv "$dst/current" "$dst/.previous" mv "$dst/.partial" "$dst/current" rm -fR "$dst/.previous" echo >&2 - exec ${take-snapshots plan} - ''; - in out; + snapshot() {( + : $ns $format $retain + name=$(date --date="@$start_date" +"$format") + if ! test -e "$dst/$ns/$name"; then + echo >&2 "create snapshot: $ns/$name" + mkdir -m 0700 -p "$dst/$ns" + rsync >&2 \ + -aAXF --delete \ + --link-dest="$dst/current" \ + "$dst/current/" \ + "$dst/$ns/.partial.$name" + mv "$dst/$ns/.partial.$name" "$dst/$ns/$name" + echo >&2 + fi + case $retain in + ([0-9]*) + delete_from=$(($retain + 1)) + ls -r "$dst/$ns" \ + | sed -n "$delete_from,\$p" \ + | while read old_name; do + echo >&2 "delete snapshot: $ns/$old_name" + rm -fR "$dst/$ns/$old_name" + done + ;; + (ALL) + : + ;; + esac + )} - take-snapshots = plan: pkgs.writeDash "backup.${plan.name}.take-snapshots" '' - set -efu - NOW=''${NOW-$(date +%s)} - dst=${shell.escape plan.dst.path} - - snapshot() {( - : $ns $format $retain - name=$(date --date="@$NOW" +"$format") - if ! test -e "$dst/$ns/$name"; then - echo >&2 "create snapshot: $ns/$name" - mkdir -m 0700 -p "$dst/$ns" - rsync >&2 \ - -aAXF --delete \ - --link-dest="$dst/current" \ - "$dst/current/" \ - "$dst/$ns/.partial.$name" - mv "$dst/$ns/.partial.$name" "$dst/$ns/$name" - echo >&2 - fi - case $retain in - ([0-9]*) - delete_from=$(($retain + 1)) - ls -r "$dst/$ns" \ - | sed -n "$delete_from,\$p" \ - | while read old_name; do - echo >&2 "delete snapshot: $ns/$old_name" - rm -fR "$dst/$ns/$old_name" - done - ;; - (ALL) - : - ;; - esac - )} - - ${concatStringsSep "\n" (mapAttrsToList (ns: { format, retain ? null, ... }: - toString (map shell.escape [ - "ns=${ns}" - "format=${format}" - "retain=${if retain == null then "ALL" else toString retain}" - "snapshot" - ])) - plan.snapshots)} + ${concatStringsSep "\n" (mapAttrsToList (ns: { format, retain, ... }: + toString (map shell.escape [ + "ns=${ns}" + "format=${format}" + "retain=${if retain == null then "ALL" else toString retain}" + "snapshot" + ])) + plan.snapshots)} + ''} ''; # XXX Is one ping enough to determine fastest address? From 8a1ddc5e9b8012b141c3b5e997d44acb70e1f17f Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 23:48:34 +0100 Subject: [PATCH 20/81] krebs.backup.plans.*.enable.default = true --- krebs/3modules/backup.nix | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix index fa5b0cfd2..6e9e9813c 100644 --- a/krebs/3modules/backup.nix +++ b/krebs/3modules/backup.nix @@ -13,8 +13,10 @@ let plans = mkOption { default = {}; type = types.attrsOf (types.submodule ({ config, ... }: { - # TODO enable = mkEnableOption "TODO" // { default = true; }; options = { + enable = mkEnableOption "krebs.backup.${config.name}" // { + default = true; + }; method = mkOption { type = types.enum ["pull" "push"]; }; @@ -78,7 +80,7 @@ let inherit (plan) startAt; }) (filter (plan: build-host-is "pull" "dst" plan || build-host-is "push" "src" plan) - (attrValues cfg.plans))); + enabled-plans)); users.groups.backup.gid = genid "backup"; users.users.root.openssh.authorizedKeys.keys = @@ -87,9 +89,11 @@ let pull = plan.dst.host.ssh.pubkey; }) (filter (plan: build-host-is "pull" "src" plan || build-host-is "push" "dst" plan) - (attrValues cfg.plans)); + enabled-plans); }; + enabled-plans = filter (getAttr "enable") (attrValues cfg.plans); + build-host-is = method: side: plan: plan.method == method && config.krebs.build.host.name == plan.${side}.host.name; From 5a10c4beb56d052b816682058becedf7b8eacaaa Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 8 Feb 2016 00:25:35 +0100 Subject: [PATCH 21/81] =?UTF-8?q?tv=20backup:=20xu:/home=20=E2=86=92=20wu:?= =?UTF-8?q?/bku/xu-home=20@=2006:00?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- tv/2configs/backup.nix | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix index f4d368557..6c90709a8 100644 --- a/tv/2configs/backup.nix +++ b/tv/2configs/backup.nix @@ -14,5 +14,17 @@ with lib; yearly = { format = "%Y"; }; }; }; + xu-home-wu = { + method = "push"; + src = { host = config.krebs.hosts.xu; path = "/home"; }; + dst = { host = config.krebs.hosts.wu; path = "/bku/xu-home"; }; + startAt = "06:00"; + snapshots = { + daily = { format = "%Y-%m-%d"; retain = 7; }; + weekly = { format = "%YW%W"; retain = 4; }; + monthly = { format = "%Y-%m"; retain = 12; }; + yearly = { format = "%Y"; }; + }; + }; }; } From 14afbfef1251178b1599caaf9046c6aeeb97fb19 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 8 Feb 2016 00:31:26 +0100 Subject: [PATCH 22/81] krebs.backup: use aliases instead of addrs4 --- krebs/3modules/backup.nix | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix index 6e9e9813c..86e2e72e2 100644 --- a/krebs/3modules/backup.nix +++ b/krebs/3modules/backup.nix @@ -204,12 +204,10 @@ let ''; # XXX Is one ping enough to determine fastest address? - # Note that we're using net.addrs4 instead of net.aliases because we define - # ports only for addresses. See krebs/3modules/default.nix fastest-address = host: '' { ${pkgs.fping}/bin/fping Date: Mon, 8 Feb 2016 00:43:24 +0100 Subject: [PATCH 23/81] posix-array: how could this ever work? --- krebs/5pkgs/posix-array/default.nix | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/krebs/5pkgs/posix-array/default.nix b/krebs/5pkgs/posix-array/default.nix index 456a3cc11..cfcdb29a7 100644 --- a/krebs/5pkgs/posix-array/default.nix +++ b/krebs/5pkgs/posix-array/default.nix @@ -1,7 +1,7 @@ -{ stdenv, fetchgit, ... }: +{ fetchgit, lib, stdenv, ... }: -with stdenv; stdenv.mkDerivation rec { - name = "posix-array"; +stdenv.mkDerivation rec { + name = "posix-array-${version}"; version = "1.0.0"; src = fetchgit { @@ -16,16 +16,15 @@ with stdenv; stdenv.mkDerivation rec { ]; installPhase = '' - mkdir -p "$out/bin" + mkdir -p $out/bin cp -a ./array $out/bin - rm * ''; meta = { - description = "Posix-compliant array implementation"; + description = "POSIX-compliant array implementation"; url = https://github.com/makefu/array; - license = licenses.wtfpl; - platforms = platforms.unix; - maintainers = with maintainers; [ makefu ]; + license = lib.licenses.wtfpl; + platforms = lib.platforms.unix; + maintainers = with lib.maintainers; [ makefu ]; }; } From ec7dc8a5ace37cdf1005cabd5a8554f4dc73727e Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 8 Feb 2016 00:46:17 +0100 Subject: [PATCH 24/81] krebs pkgs: callPackages only subdirs with a defaut.nix --- krebs/5pkgs/default.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix index a0ccdcf49..cf81a96c5 100644 --- a/krebs/5pkgs/default.nix +++ b/krebs/5pkgs/default.nix @@ -2,8 +2,9 @@ with lib; let - subdirs = mapAttrs (_: flip pkgs.callPackage {}) (subdirsOf ./.); - pkgs' = pkgs // subdirs; + subdirs = mapAttrs (_: flip pkgs.callPackage {}) + (filterAttrs (_: dir.has-default-nix) + (subdirsOf ./.)); in subdirs // rec { @@ -22,7 +23,7 @@ subdirs // rec { (builtins.readDir ./haskell-overrides)); }; - push = pkgs'.callPackage ./push { + push = pkgs.callPackage ./push { inherit (subdirs) get jq; }; From d98578e3e190463a341a94f2cc778ef886f9252d Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 8 Feb 2016 01:07:03 +0100 Subject: [PATCH 25/81] rm krebs.build.target --- krebs/3modules/build.nix | 8 -------- krebs/5pkgs/test/infest-cac-centos7/notes | 1 - makefu/1systems/gum.nix | 1 - makefu/1systems/vbob.nix | 1 - mv/1systems/stro.nix | 2 -- shared/1systems/wolf.nix | 1 - tv/1systems/cd.nix | 1 - tv/1systems/mkdir.nix | 1 - tv/1systems/rmdir.nix | 2 -- tv/2configs/default.nix | 1 - 10 files changed, 19 deletions(-) diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix index 0da5dd38a..3530fd595 100644 --- a/krebs/3modules/build.nix +++ b/krebs/3modules/build.nix @@ -3,8 +3,6 @@ with lib; let - target = config.krebs.build // { user.name = "root"; }; - out = { # TODO deprecate krebs.build.host options.krebs.build.host = mkOption { @@ -17,12 +15,6 @@ let default = "/nix/var/nix/profiles/system"; }; - # TODO make krebs.build.target.host :: host - options.krebs.build.target = mkOption { - type = with types; nullOr str; - default = null; - }; - # TODO deprecate krebs.build.user options.krebs.build.user = mkOption { type = types.user; diff --git a/krebs/5pkgs/test/infest-cac-centos7/notes b/krebs/5pkgs/test/infest-cac-centos7/notes index b3beb392f..db80c0c6c 100755 --- a/krebs/5pkgs/test/infest-cac-centos7/notes +++ b/krebs/5pkgs/test/infest-cac-centos7/notes @@ -115,7 +115,6 @@ _: { users.extraUsers.root.openssh.authorizedKeys.keys = [ "$(cat ${krebs_ssh}.pub)" ]; - krebs.build.target = "$ip"; } EOF diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix index c4dfbf4b7..fe800f251 100644 --- a/makefu/1systems/gum.nix +++ b/makefu/1systems/gum.nix @@ -26,7 +26,6 @@ in { nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; }; ###### stable - krebs.build.target = "root@gum.krebsco.de"; krebs.build.host = config.krebs.hosts.gum; krebs.retiolum.extraConfig = '' ListenAddress = ${external-ip} 53 diff --git a/makefu/1systems/vbob.nix b/makefu/1systems/vbob.nix index 90b490802..20301795f 100644 --- a/makefu/1systems/vbob.nix +++ b/makefu/1systems/vbob.nix @@ -4,7 +4,6 @@ { lib, config, pkgs, ... }: { krebs.build.host = config.krebs.hosts.vbob; - krebs.build.target = "root@10.10.10.220"; imports = [ # Include the results of the hardware scan. diff --git a/mv/1systems/stro.nix b/mv/1systems/stro.nix index 38d4b4bc6..3915219b7 100644 --- a/mv/1systems/stro.nix +++ b/mv/1systems/stro.nix @@ -8,8 +8,6 @@ with lib; krebs.build.source.git.nixpkgs.rev = "7ae05edcdd14f6ace83ead9bf0d114e97c89a83a"; - krebs.build.target = "lolwat"; - imports = [ ../2configs/hw/x220.nix ../2configs/git.nix diff --git a/shared/1systems/wolf.nix b/shared/1systems/wolf.nix index bcfbd6810..9a514428a 100644 --- a/shared/1systems/wolf.nix +++ b/shared/1systems/wolf.nix @@ -45,7 +45,6 @@ in # uninteresting stuff ##################### krebs.build.host = config.krebs.hosts.wolf; - krebs.build.target = "wolf"; boot.kernel.sysctl = { # Enable IPv6 Privacy Extensions diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix index 8297a56df..b96548d61 100644 --- a/tv/1systems/cd.nix +++ b/tv/1systems/cd.nix @@ -4,7 +4,6 @@ with lib; { krebs.build.host = config.krebs.hosts.cd; - krebs.build.target = "root@cd.internet"; imports = [ ../2configs/hw/CAC-Developer-2.nix diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix index 79e5f73b9..2010dcd57 100644 --- a/tv/1systems/mkdir.nix +++ b/tv/1systems/mkdir.nix @@ -17,7 +17,6 @@ in { krebs.build.host = config.krebs.hosts.mkdir; - krebs.build.target = "root@${primary-addr4}"; imports = [ ../2configs/hw/CAC-Developer-1.nix diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix index 6fd79c596..4005b5e6f 100644 --- a/tv/1systems/rmdir.nix +++ b/tv/1systems/rmdir.nix @@ -18,8 +18,6 @@ in { krebs.build.host = config.krebs.hosts.rmdir; - krebs.build.target = "root@rmdir.internet"; - imports = [ ../2configs/hw/CAC-Developer-1.nix ../2configs/fs/CAC-CentOS-7-64bit.nix diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index 52d85f856..b5639af51 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -7,7 +7,6 @@ with lib; krebs.build = { user = config.krebs.users.tv; - target = mkDefault "root@${config.krebs.build.host.name}"; source = mapAttrs (_: mkDefault) ({ nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix"; nixpkgs = symlink:stockholm/nixpkgs; From 7f7256a76f5698a9f8599ce71780f47ab13590f4 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 8 Feb 2016 01:23:06 +0100 Subject: [PATCH 26/81] krebs pkgs: move builders to dedicated file --- krebs/5pkgs/builders.nix | 51 ++++++++++++++++++++++++++++++++ krebs/5pkgs/default.nix | 64 ++++------------------------------------ 2 files changed, 57 insertions(+), 58 deletions(-) create mode 100644 krebs/5pkgs/builders.nix diff --git a/krebs/5pkgs/builders.nix b/krebs/5pkgs/builders.nix new file mode 100644 index 000000000..b3cb1c943 --- /dev/null +++ b/krebs/5pkgs/builders.nix @@ -0,0 +1,51 @@ +{ lib, pkgs, ... }: +with lib; +{ + execve = name: { filename, argv, envp ? {}, destination ? "" }: + writeC name { inherit destination; } '' + #include + int main () { + const char *filename = ${toC filename}; + char *const argv[] = ${toC (argv ++ [null])}; + char *const envp[] = ${toC ( + mapAttrsToList (k: v: "${k}=${v}") envp ++ [null] + )}; + execve(filename, argv, envp); + return -1; + } + ''; + + execveBin = name: cfg: execve name (cfg // { destination = "/bin/${name}"; }); + + writeC = name: { destination ? "" }: src: pkgs.runCommand name {} '' + PATH=${makeSearchPath "bin" (with pkgs; [ + binutils + coreutils + gcc + ])} + src=${pkgs.writeText "${name}.c" src} + exe=$out${destination} + mkdir -p "$(dirname "$exe")" + gcc -O -Wall -o "$exe" $src + strip --strip-unneeded "$exe" + ''; + + writeDash = name: text: pkgs.writeScript name '' + #! ${pkgs.dash}/bin/dash + ${text} + ''; + + writeDashBin = name: text: pkgs.writeTextFile { + executable = true; + destination = "/bin/${name}"; + name = name; + text = '' + #! ${pkgs.dash}/bin/dash + ${text} + ''; + }; + + writeNixFromCabal = name: path: pkgs.runCommand name {} '' + ${pkgs.cabal2nix}/bin/cabal2nix ${path} > $out + ''; +} diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix index cf81a96c5..89e19dffd 100644 --- a/krebs/5pkgs/default.nix +++ b/krebs/5pkgs/default.nix @@ -1,14 +1,6 @@ -{ lib, pkgs, ... }: - +{ lib, pkgs, ... }@args: with lib; -let - subdirs = mapAttrs (_: flip pkgs.callPackage {}) - (filterAttrs (_: dir.has-default-nix) - (subdirsOf ./.)); -in - -subdirs // rec { - +{ haskellPackages = pkgs.haskellPackages.override { overrides = self: super: mapAttrs (name: path: self.callPackage path {}) @@ -29,55 +21,11 @@ subdirs // rec { ReaktorPlugins = pkgs.callPackage ./Reaktor/plugins.nix {}; - execve = name: { filename, argv, envp ? {}, destination ? "" }: - writeC name { inherit destination; } '' - #include - int main () { - const char *filename = ${toC filename}; - char *const argv[] = ${toC (argv ++ [null])}; - char *const envp[] = ${toC ( - mapAttrsToList (k: v: "${k}=${v}") envp ++ [null] - )}; - execve(filename, argv, envp); - return -1; - } - ''; - test = { infest-cac-centos7 = pkgs.callPackage ./test/infest-cac-centos7 {}; }; - - execveBin = name: cfg: execve name (cfg // { destination = "/bin/${name}"; }); - - writeC = name: { destination ? "" }: src: pkgs.runCommand name {} '' - PATH=${makeSearchPath "bin" (with pkgs; [ - binutils - coreutils - gcc - ])} - src=${pkgs.writeText "${name}.c" src} - exe=$out${destination} - mkdir -p "$(dirname "$exe")" - gcc -O -Wall -o "$exe" $src - strip --strip-unneeded "$exe" - ''; - - writeDash = name: text: pkgs.writeScript name '' - #! ${pkgs.dash}/bin/dash - ${text} - ''; - - writeDashBin = name: text: pkgs.writeTextFile { - executable = true; - destination = "/bin/${name}"; - name = name; - text = '' - #! ${pkgs.dash}/bin/dash - ${text} - ''; - }; - - writeNixFromCabal = name: path: pkgs.runCommand name {} '' - ${pkgs.cabal2nix}/bin/cabal2nix ${path} > $out - ''; } +// import ./builders.nix args +// mapAttrs (_: flip pkgs.callPackage {}) + (filterAttrs (_: dir.has-default-nix) + (subdirsOf ./.)) From 356bb8e0d3f9add02e177a3bdfa9314e1369748e Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 8 Feb 2016 02:19:38 +0100 Subject: [PATCH 27/81] tv.iptables: redirect 11423 locally too --- tv/3modules/iptables.nix | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix index 9d5b5d075..a4ebef44f 100644 --- a/tv/3modules/iptables.nix +++ b/tv/3modules/iptables.nix @@ -68,12 +68,13 @@ let :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] - ${concatMapStringsSep "\n" (rule: "-A PREROUTING ${rule}") ([] - ++ [ - "! -i retiolum -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 0" - "-p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22" - ] - )} + ${concatMapStringsSep "\n" (rule: "-A PREROUTING ${rule}") [ + "! -i retiolum -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 0" + "-p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22" + ]} + ${concatMapStringsSep "\n" (rule: "-A OUTPUT ${rule}") [ + "-o lo -p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22" + ]} COMMIT *filter :INPUT DROP [0:0] From 7a9f130c1230faf9662000dbd9ba8f06170bf254 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 8 Feb 2016 03:21:01 +0100 Subject: [PATCH 28/81] krebs: rm types.host.dc --- krebs/3modules/lass/default.nix | 6 ------ krebs/3modules/makefu/default.nix | 11 ----------- krebs/3modules/mv/default.nix | 1 - krebs/3modules/shared/default.nix | 1 - krebs/3modules/tv/default.nix | 8 -------- krebs/4lib/types.nix | 3 --- 6 files changed, 30 deletions(-) diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index c880ea788..2b3b285f2 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -6,7 +6,6 @@ with lib; hosts = { echelon = { cores = 2; - dc = "lass"; #dc = "cac"; nets = rec { internet = { addrs4 = ["162.252.241.33"]; @@ -40,7 +39,6 @@ with lib; }; prism = { cores = 4; - dc = "lass"; #dc = "cac"; nets = rec { internet = { addrs4 = ["213.239.205.240"]; @@ -72,7 +70,6 @@ with lib; ssh.pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQChm4sqQ2bUZj+2YnTf6G5HHRTpSe1jTUhJRnwcYPYZKF+CBqBncipRpuGlGXEsptNa+7ZMcQC0ySsz5SUOMt3Ih+NehVe/qt3VtRz0l0MgOWmH2qBwKK9Y4IuxrJQzUmP4UGlOGlFj9DORssSMOyFIG4eZ9k2qMn3xal0NVRfGTShKlouWsiUILZ8I+sDNE00z8DAYesgc1yazvRnjzvLkRxdNdpYiAFBbmXMpPKK95McRJaWsuNSeal9kd5p5PagWcgN4DZ6+ebzz3NKnmzk4j+vuHX0U9lTXBqKMlzzmM2YNLRtDPfrtJNyHqLpZUpFhJKqZCD+4/0zdrzRfC7Th+5czzUCSvHiKPVsqw5eOdiQX6EyzNAF5zpkpRp//QdUNNXC5/Ku6GKCO491+TuA8VCha0fOwBONccTLUI/hGNmCh88mLbukVoeGJrbYNCOA/6kEz7ZLEveU4i+TT7okhDElMsNk+AWCZ8/NdJQNX3/K6+JJ9qAn+/yC8LdjgYYJ2oU/aw5/HyOgiQ0z4n9UfQ7j+nHysY9CQb1b3guX7yjJoc3KpNXCXEztuIRHjFD1EP8NRTSmGjsa/VjLmTLSsqjD+7IE5mT0tO5RJvmagDgdJSr/iR5D9zjW7hx7ttvektrlp9g0v3CiCFVaW4l95hGYT0HaNBLJ5R0YHm0lD+Q=="; }; fastpoke = { - dc = "lass"; nets = rec { internet = { addrs4 = ["193.22.164.36"]; @@ -103,7 +100,6 @@ with lib; }; cloudkrebs = { cores = 1; - dc = "lass"; #dc = "cac"; nets = rec { internet = { addrs4 = ["104.167.113.104"]; @@ -136,7 +132,6 @@ with lib; }; uriel = { cores = 1; - dc = "lass"; nets = { gg23 = { addrs4 = ["10.23.1.12"]; @@ -167,7 +162,6 @@ with lib; }; mors = { cores = 2; - dc = "lass"; nets = { gg23 = { addrs4 = ["10.23.1.11"]; diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix index 693a954ab..2811c0c52 100644 --- a/krebs/3modules/makefu/default.nix +++ b/krebs/3modules/makefu/default.nix @@ -6,7 +6,6 @@ with lib; hosts = { pnp = { cores = 1; - dc = "makefu"; #vm on 'omo' nets = { retiolum = { addrs4 = ["10.243.0.210"]; @@ -30,7 +29,6 @@ with lib; }; tsp = { cores = 1; - dc = "makefu"; #x200 nets = { retiolum = { addrs4 = ["10.243.0.212"]; @@ -58,7 +56,6 @@ with lib; }; pornocauster = { cores = 2; - dc = "makefu"; #x220 nets = { retiolum = { addrs4 = ["10.243.0.91"]; @@ -90,7 +87,6 @@ with lib; vbob = { cores = 2; - dc = "makefu"; #vm local nets = { retiolum = { addrs4 = ["10.243.1.91"]; @@ -116,7 +112,6 @@ with lib; }; flap = rec { cores = 1; - dc = "cac"; #vps extraZones = { "krebsco.de" = '' @@ -152,7 +147,6 @@ with lib; }; pigstarter = rec { cores = 1; - dc = "frontrange"; #vps extraZones = { "krebsco.de" = '' @@ -191,7 +185,6 @@ with lib; }; wry = rec { cores = 1; - dc = "makefu"; #dc = "cac"; extraZones = { "krebsco.de" = '' euer IN A ${head nets.internet.addrs4} @@ -248,7 +241,6 @@ with lib; }; filepimp = rec { cores = 1; - dc = "makefu"; #nas nets = { retiolum = { @@ -273,7 +265,6 @@ with lib; omo = rec { cores = 2; - dc = "makefu"; #AMD E350 nets = { retiolum = { @@ -299,7 +290,6 @@ with lib; }; wbob = rec { cores = 1; - dc = "none"; nets = { retiolm = { addrs4 = ["10.243.214.15/32"]; @@ -323,7 +313,6 @@ TNs2RYfwDy/r6H/hDeB/BSngPouedEVcPwIDAQAB gum = rec { cores = 1; - dc = "online.net"; #root-server extraZones = { "krebsco.de" = '' diff --git a/krebs/3modules/mv/default.nix b/krebs/3modules/mv/default.nix index 7245c143d..8803cb249 100644 --- a/krebs/3modules/mv/default.nix +++ b/krebs/3modules/mv/default.nix @@ -6,7 +6,6 @@ with lib; hosts = { stro = { cores = 4; - dc = "mv"; nets = { retiolum = { addrs4 = ["10.243.111.111"]; diff --git a/krebs/3modules/shared/default.nix b/krebs/3modules/shared/default.nix index 52aa4de41..df4c529bf 100644 --- a/krebs/3modules/shared/default.nix +++ b/krebs/3modules/shared/default.nix @@ -34,7 +34,6 @@ let in { hosts = { wolf = { - dc = "shack"; nets = { shack = { addrs4 = [ "10.42.2.150" ]; diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index abcc67933..9a0b99396 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -9,7 +9,6 @@ with lib; hosts = { cd = rec { cores = 2; - dc = "tv"; #dc = "cac"; extraZones = { # TODO generate krebsco.de zone from nets and don't use extraZones at all "krebsco.de" = '' @@ -65,7 +64,6 @@ with lib; }; mkdir = rec { cores = 1; - dc = "tv"; #dc = "cac"; nets = rec { internet = { addrs4 = ["104.167.114.142"]; @@ -193,7 +191,6 @@ with lib; }; nomic = { cores = 2; - dc = "tv"; #dc = "gg23"; nets = rec { gg23 = { addrs4 = ["10.23.1.110"]; @@ -235,7 +232,6 @@ with lib; }; rmdir = rec { cores = 1; - dc = "tv"; #dc = "cac"; nets = rec { internet = { addrs4 = ["167.88.34.182"]; @@ -287,8 +283,6 @@ with lib; }; wu = { cores = 4; - # TODO wu is mobile, so dc means "home data center" - dc = "tv"; #dc = "gg23"; nets = { gg23 = { addrs4 = ["10.23.1.37"]; @@ -322,8 +316,6 @@ with lib; }; xu = { cores = 4; - # TODO xu is mobile, so dc means "home data center" - dc = "tv"; #dc = "gg23"; nets = { gg23 = { addrs4 = ["10.23.1.38"]; diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix index 52eb764ef..873f3ddfb 100644 --- a/krebs/4lib/types.nix +++ b/krebs/4lib/types.nix @@ -12,9 +12,6 @@ types // rec { type = label; default = config._module.args.name; }; - dc = mkOption { - type = label; - }; cores = mkOption { type = positive; }; From 42d2d5de77590e7d6c421a3f7d80126f34646750 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 8 Feb 2016 03:40:41 +0100 Subject: [PATCH 29/81] tv.iptables: inline startScript and use SyslogIdentifier --- tv/3modules/iptables.nix | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix index a4ebef44f..4924db4f3 100644 --- a/tv/3modules/iptables.nix +++ b/tv/3modules/iptables.nix @@ -48,7 +48,12 @@ let Type = "simple"; RemainAfterExit = true; Restart = "always"; - ExecStart = "@${startScript} tv-iptables_start"; + SyslogIdentifier = "tv-iptables_start"; + ExecStart = pkgs.writeDash "tv-iptables_start" '' + set -euf + iptables-restore < ${rules 4} + ip6tables-restore < ${rules 6} + ''; }; }; }; @@ -108,16 +113,7 @@ let )} COMMIT ''; - - startScript = pkgs.writeScript "tv-iptables_start" '' - #! /bin/sh - set -euf - iptables-restore < ${rules 4} - ip6tables-restore < ${rules 6} - ''; - -in -out +in out #let # cfg = config.tv.iptables; From 49ed93662983e67a8bef8641b4d6282e5a59b2f5 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 8 Feb 2016 04:12:56 +0100 Subject: [PATCH 30/81] tv git: bump descs --- tv/2configs/git.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix index 3ee708e03..f248a8cb5 100644 --- a/tv/2configs/git.nix +++ b/tv/2configs/git.nix @@ -7,8 +7,8 @@ let out = { krebs.git = { enable = true; - root-title = "public repositories at ${config.krebs.build.host.name}"; - root-desc = "keep calm and engage"; + root-title = "repositories at ${config.krebs.build.host.name}"; + root-desc = "mostly krebs"; repos = repos; rules = rules; }; @@ -21,7 +21,7 @@ let rules = concatMap make-rules (attrValues repos); public-repos = mapAttrs make-public-repo ({ - } // mapAttrValues (setAttr "section" "1. Miscellaneous") { + } // mapAttrValues (setAttr "section" "1. miscellaneous") { cac-api = { desc = "CloudAtCost API command line interface"; }; @@ -37,7 +37,7 @@ let desc = "SoundCloud command line interface"; }; stockholm = { - desc = "take all the computers hostage, they'll love you!"; + desc = "NixOS configuration"; }; with-tmpdir = {}; } // mapAttrValues (setAttr "section" "2. Haskell libraries") { @@ -49,7 +49,7 @@ let web-routes-wai-custom = {}; xintmap = {}; xmonad-stockholm = {}; - } // mapAttrValues (setAttr "section" "3. Museum") { + } // mapAttrValues (setAttr "section" "3. museum") { cgserver = {}; crude-mail-setup = {}; dot-xmonad = {}; From e6ea4875d467f1fbe6f39e1460352bd0d31feaea Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 8 Feb 2016 12:13:28 +0100 Subject: [PATCH 31/81] krebs.backup: admit plan.startAt --- krebs/3modules/backup.nix | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix index 86e2e72e2..66a325ed9 100644 --- a/krebs/3modules/backup.nix +++ b/krebs/3modules/backup.nix @@ -76,8 +76,7 @@ let SyslogIdentifier = ExecStart.name; Type = "oneshot"; }; - } // optionalAttrs (plan.startAt != null) { - inherit (plan) startAt; + startAt = mkIf (plan.startAt != null) plan.startAt; }) (filter (plan: build-host-is "pull" "dst" plan || build-host-is "push" "src" plan) enabled-plans)); From 28ea7e3745540c432b03d387ad2193a134a1eed4 Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 10 Feb 2016 15:34:41 +0100 Subject: [PATCH 32/81] ma 1 vbob: deployable again --- makefu/1systems/vbob.nix | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/makefu/1systems/vbob.nix b/makefu/1systems/vbob.nix index f4a22d720..b1e5ef8b5 100644 --- a/makefu/1systems/vbob.nix +++ b/makefu/1systems/vbob.nix @@ -18,8 +18,8 @@ tinc = pkgs.tinc_pre; }; - krebs.build.source.nixpkgs = { - # url = https://github.com/nixos/nixpkgs; + krebs.build.source.upstream-nixpkgs = { + url = https://github.com/makefu/nixpkgs; # HTTP Everywhere + libredir rev = "8239ac6"; }; @@ -39,7 +39,6 @@ buildbot buildbot-slave get - genid logstash ]; From 8b130a66287b829e7b6f9be0130df7231c7a6605 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 10 Feb 2016 19:06:32 +0100 Subject: [PATCH 33/81] krebs.nixpkgs.allowUnfreePredicate: init --- krebs/3modules/default.nix | 1 + krebs/3modules/nixpkgs.nix | 43 ++++++++++++++++++++++++++++++++++++++ tv/1systems/wu.nix | 2 +- tv/2configs/hw/AO753.nix | 2 +- 4 files changed, 46 insertions(+), 2 deletions(-) create mode 100644 krebs/3modules/nixpkgs.nix diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 62db9a5a0..3d51076cf 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -21,6 +21,7 @@ let ./go.nix ./iptables.nix ./nginx.nix + ./nixpkgs.nix ./per-user.nix ./Reaktor.nix ./retiolum-bootstrap.nix diff --git a/krebs/3modules/nixpkgs.nix b/krebs/3modules/nixpkgs.nix new file mode 100644 index 000000000..4129f9483 --- /dev/null +++ b/krebs/3modules/nixpkgs.nix @@ -0,0 +1,43 @@ +{ config, pkgs, lib, ... }: +with lib; +let + cfg = config.krebs.nixpkgs; + + out = { + options.krebs.nixpkgs = api; + config = mkIf cfg.enable imp; + }; + + api = { + enable = mkEnableOption "krebs.nixpkgs" // { default = true; }; + + allowUnfreePredicate = mkOption { + description = '' + This option is similar to `nixpkgs.config.allowUnfreePredicate' + but can be defined in several modules. An unfree package will be + allowed if any of the defined predicates returns true. + ''; + type = types.nullOr (mkOptionType { + name = "Predicate"; + check = isFunction; + merge = _locs: defs: pkg: let + evalPredicateDef = def: let + allow = def.value pkg; + in if cfg.verbose && allow + then trace "unfree ‘${pkg.name}’ allowed in ${def.file}" allow + else allow; + in any evalPredicateDef defs; + }); + default = null; + }; + + verbose = mkOption { + type = types.bool; + default = false; + }; + }; + + imp = mkIf (cfg.allowUnfreePredicate != null) { + nixpkgs.config.allowUnfreePredicate = cfg.allowUnfreePredicate; + }; +in out diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index 29e6de08b..4ed13a0ea 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -157,7 +157,7 @@ with lib; nixpkgs.config.chromium.enablePepperFlash = true; - nixpkgs.config.allowUnfreePredicate = pkg: hasPrefix "nvidia-x11-" pkg.name; + krebs.nixpkgs.allowUnfreePredicate = pkg: hasPrefix "nvidia-x11-" pkg.name; hardware.bumblebee.enable = true; hardware.bumblebee.group = "video"; hardware.enableAllFirmware = true; diff --git a/tv/2configs/hw/AO753.nix b/tv/2configs/hw/AO753.nix index 72a40819f..e7a2b9238 100644 --- a/tv/2configs/hw/AO753.nix +++ b/tv/2configs/hw/AO753.nix @@ -41,5 +41,5 @@ with lib; HandleSuspendKey=ignore ''; - nixpkgs.config.allowUnfreePredicate = pkg: hasPrefix "broadcom-sta-" pkg.name; + krebs.nixpkgs.allowUnfreePredicate = pkg: hasPrefix "broadcom-sta-" pkg.name; } From 0cf6d065f43c66efadd0a364c3414e6ecdae0004 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 11 Feb 2016 03:47:26 +0100 Subject: [PATCH 34/81] *: turn 5pkgs into a(n optional) module --- default.nix | 6 +---- krebs/5pkgs/default.nix | 50 +++++++++++++++++++++------------------- lass/5pkgs/default.nix | 21 +++++++++-------- makefu/5pkgs/default.nix | 12 ++++++---- miefda/5pkgs/default.nix | 1 - mv/5pkgs/default.nix | 39 ++++++++++++++++--------------- shared/5pkgs/default.nix | 5 ---- tv/5pkgs/default.nix | 37 +++++++++++++++-------------- 8 files changed, 85 insertions(+), 86 deletions(-) delete mode 100644 miefda/5pkgs/default.nix delete mode 100644 shared/5pkgs/default.nix diff --git a/default.nix b/default.nix index b0ad60d8a..2aa0a8e14 100644 --- a/default.nix +++ b/default.nix @@ -43,16 +43,12 @@ let stockholm = { imports = builtins.filter lib.dir.has-default-nix (lib.concatLists [ (map (f: f "2configs") [ lib.upath ]) (map (f: f "3modules") [ lib.kpath lib.upath ]) + (map (f: f "5pkgs") [ lib.kpath lib.upath ]) ]); krebs.current.enable = true; krebs.current.host = config.krebs.hosts.${current-host-name}; krebs.current.user = config.krebs.users.${current-user-name}; - - nixpkgs.config.packageOverrides = pkgs: let - kpkgs = import (lib.kpath "5pkgs") { inherit lib pkgs; }; - upkgs = import (lib.upath "5pkgs") { inherit lib; pkgs = pkgs // kpkgs; }; - in kpkgs // upkgs; }; eval = config: import (lib.npath "nixos/lib/eval-config.nix") { diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix index 89e19dffd..1cf3de56e 100644 --- a/krebs/5pkgs/default.nix +++ b/krebs/5pkgs/default.nix @@ -1,31 +1,33 @@ { lib, pkgs, ... }@args: with lib; { - haskellPackages = pkgs.haskellPackages.override { - overrides = self: super: - mapAttrs (name: path: self.callPackage path {}) - (mapAttrs' - (name: type: - if hasSuffix ".nix" name - then { - name = removeSuffix ".nix" name; - value = ./haskell-overrides + "/${name}"; - } - else null) - (builtins.readDir ./haskell-overrides)); - }; + nixpkgs.config.packageOverrides = pkgs: { + haskellPackages = pkgs.haskellPackages.override { + overrides = self: super: + mapAttrs (name: path: self.callPackage path {}) + (mapAttrs' + (name: type: + if hasSuffix ".nix" name + then { + name = removeSuffix ".nix" name; + value = ./haskell-overrides + "/${name}"; + } + else null) + (builtins.readDir ./haskell-overrides)); + }; - push = pkgs.callPackage ./push { - inherit (subdirs) get jq; - }; + push = pkgs.callPackage ./push { + inherit (subdirs) get jq; + }; - ReaktorPlugins = pkgs.callPackage ./Reaktor/plugins.nix {}; + ReaktorPlugins = pkgs.callPackage ./Reaktor/plugins.nix {}; - test = { - infest-cac-centos7 = pkgs.callPackage ./test/infest-cac-centos7 {}; - }; + test = { + infest-cac-centos7 = pkgs.callPackage ./test/infest-cac-centos7 {}; + }; + } + // import ./builders.nix args + // mapAttrs (_: flip pkgs.callPackage {}) + (filterAttrs (_: dir.has-default-nix) + (subdirsOf ./.)); } -// import ./builders.nix args -// mapAttrs (_: flip pkgs.callPackage {}) - (filterAttrs (_: dir.has-default-nix) - (subdirsOf ./.)) diff --git a/lass/5pkgs/default.nix b/lass/5pkgs/default.nix index 2b9582912..fee4654ae 100644 --- a/lass/5pkgs/default.nix +++ b/lass/5pkgs/default.nix @@ -3,15 +3,16 @@ let inherit (pkgs) callPackage; in - -rec { - firefoxPlugins = { - noscript = callPackage ./firefoxPlugins/noscript.nix {}; - ublock = callPackage ./firefoxPlugins/ublock.nix {}; - vimperator = callPackage ./firefoxPlugins/vimperator.nix {}; +{ + nixpkgs.config.packageOverrides = rec { + firefoxPlugins = { + noscript = callPackage ./firefoxPlugins/noscript.nix {}; + ublock = callPackage ./firefoxPlugins/ublock.nix {}; + vimperator = callPackage ./firefoxPlugins/vimperator.nix {}; + }; + newsbot-js = callPackage ./newsbot-js/default.nix {}; + xmonad-lass = + let src = pkgs.writeNixFromCabal "xmonad-lass.nix" ./xmonad-lass; in + pkgs.haskellPackages.callPackage src {}; }; - newsbot-js = callPackage ./newsbot-js/default.nix {}; - xmonad-lass = - let src = pkgs.writeNixFromCabal "xmonad-lass.nix" ./xmonad-lass; in - pkgs.haskellPackages.callPackage src {}; } diff --git a/makefu/5pkgs/default.nix b/makefu/5pkgs/default.nix index 436c52fcd..c4a7f498f 100644 --- a/makefu/5pkgs/default.nix +++ b/makefu/5pkgs/default.nix @@ -4,9 +4,11 @@ let inherit (pkgs) callPackage; in { - alsa-hdspmixer = callPackage ./alsa-tools { alsaToolTarget="hdspmixer";}; - alsa-hdspconf = callPackage ./alsa-tools { alsaToolTarget="hdspconf";}; - alsa-hdsploader = callPackage ./alsa-tools { alsaToolTarget="hdsploader";}; - awesomecfg = callPackage ./awesomecfg {}; - tw-upload-plugin = callPackage ./tw-upload-plugin {}; + nixpkgs.config.packageOverrides = rec { + alsa-hdspmixer = callPackage ./alsa-tools { alsaToolTarget="hdspmixer";}; + alsa-hdspconf = callPackage ./alsa-tools { alsaToolTarget="hdspconf";}; + alsa-hdsploader = callPackage ./alsa-tools { alsaToolTarget="hdsploader";}; + awesomecfg = callPackage ./awesomecfg {}; + tw-upload-plugin = callPackage ./tw-upload-plugin {}; + }; } diff --git a/miefda/5pkgs/default.nix b/miefda/5pkgs/default.nix deleted file mode 100644 index 2eb33a153..000000000 --- a/miefda/5pkgs/default.nix +++ /dev/null @@ -1 +0,0 @@ -_:{} diff --git a/mv/5pkgs/default.nix b/mv/5pkgs/default.nix index 0c72c450e..882ac0413 100644 --- a/mv/5pkgs/default.nix +++ b/mv/5pkgs/default.nix @@ -1,23 +1,24 @@ { pkgs, ... }: { - # TODO use XDG_RUNTIME_DIR? - cr = pkgs.writeScriptBin "cr" '' - #! /bin/sh - set -efu - export LC_TIME=de_DE.utf8 - exec ${pkgs.chromium}/bin/chromium \ - --ssl-version-min=tls1 \ - --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \ - --disk-cache-size=50000000 \ - "%@" - ''; - ff = pkgs.writeScriptBin "ff" '' - #! /bin/sh - set -efu - exec ${pkgs.firefoxWrapper}/bin/firefox $(printf " %q" "$@") - ''; - xmonad-tv = - let src = pkgs.writeNixFromCabal "xmonad-tv.nix" ./xmonad-tv; in - pkgs.haskellPackages.callPackage src {}; + nixpkgs.config.packageOverrides = rec { + cr = pkgs.writeScriptBin "cr" '' + #! /bin/sh + set -efu + export LC_TIME=de_DE.utf8 + exec ${pkgs.chromium}/bin/chromium \ + --ssl-version-min=tls1 \ + --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \ + --disk-cache-size=50000000 \ + "%@" + ''; + ff = pkgs.writeScriptBin "ff" '' + #! /bin/sh + set -efu + exec ${pkgs.firefoxWrapper}/bin/firefox $(printf " %q" "$@") + ''; + xmonad-tv = + let src = pkgs.writeNixFromCabal "xmonad-tv.nix" ./xmonad-tv; in + pkgs.haskellPackages.callPackage src {}; + }; } diff --git a/shared/5pkgs/default.nix b/shared/5pkgs/default.nix deleted file mode 100644 index fdcfbb209..000000000 --- a/shared/5pkgs/default.nix +++ /dev/null @@ -1,5 +0,0 @@ -# TODO don't require 5pkgs -_: - -{ -} diff --git a/tv/5pkgs/default.nix b/tv/5pkgs/default.nix index be10e91eb..b520e1a32 100644 --- a/tv/5pkgs/default.nix +++ b/tv/5pkgs/default.nix @@ -1,22 +1,25 @@ { pkgs, ... }: { - cr = pkgs.writeScriptBin "cr" '' - #! /bin/sh - set -efu - export LC_TIME=de_DE.utf8 - exec ${pkgs.chromium}/bin/chromium \ - --ssl-version-min=tls1 \ - --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \ - --disk-cache-size=50000000 \ - "%@" - ''; - ejabberd = pkgs.callPackage ./ejabberd { - erlang = pkgs.erlangR16; + nixpkgs.config.packageOverrides = { + # TODO use XDG_RUNTIME_DIR? + cr = pkgs.writeScriptBin "cr" '' + #! /bin/sh + set -efu + export LC_TIME=de_DE.utf8 + exec ${pkgs.chromium}/bin/chromium \ + --ssl-version-min=tls1 \ + --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \ + --disk-cache-size=50000000 \ + "%@" + ''; + ejabberd = pkgs.callPackage ./ejabberd { + erlang = pkgs.erlangR16; + }; + ff = pkgs.callPackage ./ff {}; + viljetic-pages = pkgs.callPackage ./viljetic-pages {}; + xmonad-tv = + let src = pkgs.writeNixFromCabal "xmonad-tv.nix" ./xmonad-tv; in + pkgs.haskellPackages.callPackage src {}; }; - ff = pkgs.callPackage ./ff {}; - viljetic-pages = pkgs.callPackage ./viljetic-pages {}; - xmonad-tv = - let src = pkgs.writeNixFromCabal "xmonad-tv.nix" ./xmonad-tv; in - pkgs.haskellPackages.callPackage src {}; } From a649befbfafaff80d1d1a10896bfc4343021797b Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 11 Feb 2016 11:04:19 +0100 Subject: [PATCH 35/81] k 3 fetchWallpaper: scrap predicate, use unitConfig --- krebs/3modules/fetchWallpaper.nix | 23 ++++++++++++----------- makefu/2configs/fetchWallpaper.nix | 15 +++------------ 2 files changed, 15 insertions(+), 23 deletions(-) diff --git a/krebs/3modules/fetchWallpaper.nix b/krebs/3modules/fetchWallpaper.nix index f320c7505..225f00803 100644 --- a/krebs/3modules/fetchWallpaper.nix +++ b/krebs/3modules/fetchWallpaper.nix @@ -12,10 +12,6 @@ let api = { enable = mkEnableOption "fetch wallpaper"; - predicate = mkOption { - type = with types; nullOr path; - default = null; - }; url = mkOption { type = types.str; }; @@ -33,16 +29,20 @@ let type = types.str; default = ":11"; }; + unitConfig = mkOption { + type = types.attrsOf types.str; + description = "Extra unit configuration for fetchWallpaper to define conditions and assertions for the unit"; + example = literalExample '' + # do not start when running on umts + { ConditionPathExists = "!/var/run/ppp0.pid"; } + ''; + default = {}; + }; }; fetchWallpaperScript = pkgs.writeScript "fetchWallpaper" '' #! ${pkgs.bash}/bin/bash - ${optionalString (cfg.predicate != null) '' - if ! ${cfg.predicate}; then - echo "predicate failed - will not fetch from remote" - exit 0 - fi - ''} + mkdir -p ${shell.escape cfg.stateDir} curl -s -o ${shell.escape cfg.stateDir}/wallpaper -z ${shell.escape cfg.stateDir}/wallpaper ${shell.escape cfg.url} feh --no-fehbg --bg-scale ${shell.escape cfg.stateDir}/wallpaper @@ -76,7 +76,6 @@ let URL = cfg.url; DISPLAY = cfg.display; }; - restartIfChanged = true; serviceConfig = { @@ -84,6 +83,8 @@ let ExecStart = fetchWallpaperScript; User = "fetchWallpaper"; }; + + unitConfig = cfg.unitConfig; }; }; in out diff --git a/makefu/2configs/fetchWallpaper.nix b/makefu/2configs/fetchWallpaper.nix index b071a128d..786df6d40 100644 --- a/makefu/2configs/fetchWallpaper.nix +++ b/makefu/2configs/fetchWallpaper.nix @@ -1,24 +1,15 @@ { config, pkgs, ... }: -let - # check if laptop runs on umts - weaksauce-internet = with pkgs;writeScript "weaksauce-internet" '' - #! /bin/sh - if ${iproute}/bin/ip addr show dev ppp0 2>/dev/null \ - | ${gnugrep}/bin/grep -q inet;then - exit 1 - fi - ''; - -in { +{ krebs.fetchWallpaper = { enable = true; display = ":0"; - predicate = weaksauce-internet; + unitConfig.ConditionPathExists = "!/var/run/ppp0.pid"; timerConfig = { OnCalendar = "*:0/30"; }; url = "http://echelon/wallpaper.png"; }; + } From aeb179696aa515865690cd752592240ff7542c78 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 11 Feb 2016 16:09:15 +0100 Subject: [PATCH 36/81] tv x220: remove unused stuff --- tv/2configs/hw/x220.nix | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/tv/2configs/hw/x220.nix b/tv/2configs/hw/x220.nix index 7cec670fa..dac580865 100644 --- a/tv/2configs/hw/x220.nix +++ b/tv/2configs/hw/x220.nix @@ -5,18 +5,11 @@ ../smartd.nix ]; - boot.initrd.availableKernelModules = [ "ahci" ]; - boot.kernelModules = [ "kvm-intel" ]; - boot.loader.gummiboot.enable = true; boot.loader.efi.canTouchEfiVariables = true; networking.wireless.enable = true; - #hardware.enableAllFirmware = true; - #zramSwap.enable = true; - #zramSwap.numDevices = 2; - hardware.trackpoint = { enable = true; sensitivity = 220; @@ -50,10 +43,4 @@ Option "AccelMethod" "sna" ''; }; - - #services.xserver.displayManager.sessionCommands ='' - # xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation" 8 1 - # xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Button" 8 2 - # xinput set-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Axes" 6 7 4 5 - #''; } From 908837089ce22e83eae2df6518ad499090d0e1ae Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 11 Feb 2016 17:05:00 +0100 Subject: [PATCH 37/81] ma 1 wbob: cleanup, add awesomerc todo --- makefu/1systems/wbob.nix | 65 ++++++++++++++++++++++++++++++++-------- 1 file changed, 53 insertions(+), 12 deletions(-) diff --git a/makefu/1systems/wbob.nix b/makefu/1systems/wbob.nix index d6916f006..8917e4339 100644 --- a/makefu/1systems/wbob.nix +++ b/makefu/1systems/wbob.nix @@ -4,16 +4,57 @@ [ # Include the results of the hardware scan. ../2configs/main-laptop.nix ]; - krebs = { - enable = true; - retiolum.enable = true; - build.host = config.krebs.hosts.wbob; - }; - boot.loader.grub.device = "/dev/sda"; - boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" ]; - boot.kernelModules = [ "kvm-intel" ]; - fileSystems."/" = { - device = "/dev/sda1"; - fsType = "ext4"; - }; + krebs = { + enable = true; + retiolum.enable = true; + build.host = config.krebs.hosts.wbob; + }; + + # rt2870.bin wifi card, part of linux-unfree + hardware.enableAllFirmware = true; + nixpkgs.config.allowUnfree = true; + networking.wireless.enable = true; + # rt2870 with nonfree creates wlp2s0 from wlp0s20u2 + # not explicitly setting the interface results in wpa_supplicant to crash + networking.wireless.interfaces = [ "wlp2s0" ]; + + + # nuc hardware + boot.loader.grub.device = "/dev/sda"; + hardware.cpu.intel.updateMicrocode = true; + boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ]; + boot.kernelModules = [ "kvm-intel" ]; + fileSystems."/" = { + device = "/dev/sda1"; + fsType = "ext4"; + }; + + # DualHead on NUC + services.xserver = { + # xrandrHeads = [ "HDMI1" "HDMI2" ]; + # prevent screen from turning off, disable dpms + displayManager.sessionCommands = '' + xset s off -dpms + xrandr --output HDMI2 --right-of HDMI1 + ''; + }; + ## TODO Awesomecfg + autostart chrome + # + #local current_screen = 1 + #awful.rules.rules = { + # { rule = { class = "chromium-browser" }, + # callback = function() + # awful.client.movetotag(tags[current_screen][1],c) + # if (current_screen == 1) then + # current_screen = current_screen+1 + # else + # current_screen = current_screen-1 + # end + # end + # }, + #} + #awful.util.spawn_with_shell("chromium --new-window --kiosk http://wolf:3000/dashboard/db/soc-critical-values") + # prevent Race Condition + #awful.util.spawn_with_shell("sleep 0.5;chromium --new-window --kiosk http://wolf:3000/dashboard/db/aralast") + } From ab52655e941f49be7f2b479bac264c030dda061d Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 11 Feb 2016 17:06:50 +0100 Subject: [PATCH 38/81] ma: refactoring --- makefu/1systems/pornocauster.nix | 25 ++----------------------- makefu/2configs/base-gui.nix | 2 ++ makefu/2configs/hw/tp-x220.nix | 14 ++++++++++---- makefu/2configs/hw/tp-x2x0.nix | 16 ++++++++-------- makefu/2configs/main-laptop.nix | 5 ++++- makefu/2configs/printer.nix | 4 ++++ makefu/3modules/umts.nix | 9 +-------- 7 files changed, 31 insertions(+), 44 deletions(-) diff --git a/makefu/1systems/pornocauster.nix b/makefu/1systems/pornocauster.nix index d7fa8edc5..d8ccc5846 100644 --- a/makefu/1systems/pornocauster.nix +++ b/makefu/1systems/pornocauster.nix @@ -18,7 +18,6 @@ ../2configs/exim-retiolum.nix ../2configs/mail-client.nix ../2configs/printer.nix - #../2configs/virtualization.nix ../2configs/virtualization.nix ../2configs/virtualization-virtualbox.nix ../2configs/wwan.nix @@ -35,33 +34,13 @@ # ../2configs/mediawiki.nix #../2configs/wordpress.nix ]; - hardware.sane.enable = true; - hardware.sane.extraBackends = [ pkgs.samsungUnifiedLinuxDriver ]; + nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; }; - krebs.Reaktor = { - enable = false; - nickname = "makefu|r"; - plugins = with pkgs.ReaktorPlugins; [ nixos-version random-emoji ]; - }; - - # nix.binaryCaches = [ "http://acng.shack/nixos" "https://cache.nixos.org" ]; - - environment.systemPackages = with pkgs;[ - get - virtmanager - gnome3.dconf - krebspaste - ]; - - services.logind.extraConfig = "HandleLidSwitch=ignore"; # configure pulseAudio to provide a HDMI sink as well - hardware.pulseaudio.configFile = pkgs.writeText "pulse-default-pa" '' - ${builtins.readFile "${config.hardware.pulseaudio.package}/etc/pulse/default.pa"} - load-module module-alsa-sink device=hw:0,3 sink_properties=device.description="HDMIOutput" sink_name="HDMI"''; - networking.firewall.enable = false; + networking.firewall.enable = true; networking.firewall.allowedTCPPorts = [ 25 ]; diff --git a/makefu/2configs/base-gui.nix b/makefu/2configs/base-gui.nix index 1d6750284..da3ad4afe 100644 --- a/makefu/2configs/base-gui.nix +++ b/makefu/2configs/base-gui.nix @@ -44,6 +44,8 @@ in displayManager.auto.user = mainUser; desktopManager.xterm.enable = false; }; + # lid switch is handled via button presses + services.logind.extraConfig = mkDefault "HandleLidSwitch=ignore"; nixpkgs.config.packageOverrides = pkgs: rec { awesome = pkgs.stdenv.lib.overrideDerivation pkgs.awesome (oldAttrs : { postFixup = '' diff --git a/makefu/2configs/hw/tp-x220.nix b/makefu/2configs/hw/tp-x220.nix index f03922150..0c90e6fde 100644 --- a/makefu/2configs/hw/tp-x220.nix +++ b/makefu/2configs/hw/tp-x220.nix @@ -16,10 +16,16 @@ with lib; }; services.xserver.displayManager.sessionCommands ='' - xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation" 8 1 - xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Button" 8 2 - xinput set-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Axes" 6 7 4 5 - # xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Timeout" 8 200 + xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation" 8 1 + xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Button" 8 2 + xinput set-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Axes" 6 7 4 5 + # xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Timeout" 8 200 + ''; + + # enable HDMI output switching with pulseaudio + hardware.pulseaudio.configFile = pkgs.writeText "pulse-default-pa" '' + ${builtins.readFile "${config.hardware.pulseaudio.package}/etc/pulse/default.pa"} + load-module module-alsa-sink device=hw:0,3 sink_properties=device.description="HDMIOutput" sink_name="HDMI" ''; } diff --git a/makefu/2configs/hw/tp-x2x0.nix b/makefu/2configs/hw/tp-x2x0.nix index ebc72a06e..1033f69c0 100644 --- a/makefu/2configs/hw/tp-x2x0.nix +++ b/makefu/2configs/hw/tp-x2x0.nix @@ -18,18 +18,18 @@ with lib; sensitivity = 220; speed = 220; emulateWheel = true; - }; + }; services.tlp.enable = true; services.tlp.extraConfig = '' - START_CHARGE_THRESH_BAT0=80 + START_CHARGE_THRESH_BAT0=80 - CPU_SCALING_GOVERNOR_ON_AC=performance - CPU_SCALING_GOVERNOR_ON_BAT=ondemand - CPU_MIN_PERF_ON_AC=0 - CPU_MAX_PERF_ON_AC=100 - CPU_MIN_PERF_ON_BAT=0 - CPU_MAX_PERF_ON_BAT=30 + CPU_SCALING_GOVERNOR_ON_AC=performance + CPU_SCALING_GOVERNOR_ON_BAT=ondemand + CPU_MIN_PERF_ON_AC=0 + CPU_MAX_PERF_ON_AC=100 + CPU_MIN_PERF_ON_BAT=0 + CPU_MAX_PERF_ON_BAT=30 ''; } diff --git a/makefu/2configs/main-laptop.nix b/makefu/2configs/main-laptop.nix index b725f661d..32f194e6b 100644 --- a/makefu/2configs/main-laptop.nix +++ b/makefu/2configs/main-laptop.nix @@ -3,6 +3,7 @@ # stuff for the main laptop # this is pretty much nice-to-have and does # not fit into base-gui +# TODO split generic desktop stuff and laptop-specifics like lidswitching with lib; { @@ -17,8 +18,10 @@ with lib; chromium keepassx ntfs3g + at_spi2_core + gnome3.dconf virtmanager - at_spi2_core # dep for virtmanager? + krebspaste ]; services.redshift = { diff --git a/makefu/2configs/printer.nix b/makefu/2configs/printer.nix index 35ad54bd9..d288748f9 100644 --- a/makefu/2configs/printer.nix +++ b/makefu/2configs/printer.nix @@ -7,4 +7,8 @@ pkgs.samsungUnifiedLinuxDriver ]; }; + + # scanners are printers just in reverse anyway + hardware.sane.enable = true; + hardware.sane.extraBackends = [ pkgs.samsungUnifiedLinuxDriver ]; } diff --git a/makefu/3modules/umts.nix b/makefu/3modules/umts.nix index d7be45f62..1bf3ba0b5 100644 --- a/makefu/3modules/umts.nix +++ b/makefu/3modules/umts.nix @@ -56,19 +56,12 @@ let environment.wvdial.dialerDefaults = wvdial-defaults; - systemd.targets.network-umts = { - description = "System is running on UMTS"; - unitConfig.StopWhenUnneeded = true; - }; - systemd.services.umts = { description = "UMTS wvdial Service"; - before = [ "network-umts.target" ]; - serviceConfig = { Type = "simple"; Restart = "always"; - RestartSec = "4s"; + RestartSec = "10s"; ExecStart = "${pkgs.wvdial}/bin/wvdial -n"; }; }; From 3f85a043e9c1a9cf2c24f8838e436719cd61ff44 Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 11 Feb 2016 17:27:53 +0100 Subject: [PATCH 39/81] ma 2 default: bump to newest unstable --- makefu/2configs/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix index 2b4e31119..5acc7f0a5 100644 --- a/makefu/2configs/default.nix +++ b/makefu/2configs/default.nix @@ -23,7 +23,7 @@ with lib; source = mapAttrs (_: mkDefault) { upstream-nixpkgs = { url = https://github.com/nixos/nixpkgs; - rev = "93d8671e2c6d1d25f126ed30e5e6f16764330119"; # unstable @ 2015-01-03, tested on filepimp + rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; # unstable @ 2015-01-27, tested on wry }; secrets = "/home/makefu/secrets/${config.krebs.build.host.name}/"; stockholm = "/home/makefu/stockholm"; @@ -87,6 +87,7 @@ with lib; environment.systemPackages = with pkgs; [ jq git + get gnumake rxvt_unicode.terminfo htop From 7a6c4452e10d590e9f357be1a8b2ad1ebb05a015 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 11 Feb 2016 17:30:56 +0100 Subject: [PATCH 40/81] tv x220: rm AccepMethod sna --- tv/2configs/hw/x220.nix | 3 --- 1 file changed, 3 deletions(-) diff --git a/tv/2configs/hw/x220.nix b/tv/2configs/hw/x220.nix index dac580865..9b3dd122a 100644 --- a/tv/2configs/hw/x220.nix +++ b/tv/2configs/hw/x220.nix @@ -39,8 +39,5 @@ services.xserver = { videoDriver = "intel"; vaapiDrivers = [ pkgs.vaapiIntel pkgs.vaapiVdpau ]; - deviceSection = '' - Option "AccelMethod" "sna" - ''; }; } From 7b3b839cc7a2af73dee9858e6ebcc7be831eb481 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 11 Feb 2016 18:19:56 +0100 Subject: [PATCH 41/81] cac-api: PATH += gnugrep (how could this ever pass full-tests?! :D) --- krebs/5pkgs/cac-api/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/krebs/5pkgs/cac-api/default.nix b/krebs/5pkgs/cac-api/default.nix index 9ab6ac8b2..30c0168f3 100644 --- a/krebs/5pkgs/cac-api/default.nix +++ b/krebs/5pkgs/cac-api/default.nix @@ -1,4 +1,4 @@ -{ stdenv, fetchgit, bc, cac-cert, coreutils, curl, dash, gnused, inotifyTools, jq, ncurses, openssh, sshpass, ... }: +{ stdenv, fetchgit, bc, cac-cert, coreutils, curl, dash, gnugrep, gnused, inotifyTools, jq, ncurses, openssh, sshpass, ... }: stdenv.mkDerivation { name = "cac-api-1.1.0"; @@ -22,6 +22,7 @@ stdenv.mkDerivation { bc coreutils curl + gnugrep gnused inotifyTools jq From cb9ff724b6420c9ef54ec0b620710c3632ce5be7 Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 11 Feb 2016 21:03:30 +0100 Subject: [PATCH 42/81] s 2 buildbot: poll stockholm-mirror --- shared/2configs/shared-buildbot.nix | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/shared/2configs/shared-buildbot.nix b/shared/2configs/shared-buildbot.nix index 50b279036..af877f5d8 100644 --- a/shared/2configs/shared-buildbot.nix +++ b/shared/2configs/shared-buildbot.nix @@ -12,10 +12,10 @@ testslave = "krebspass"; }; change_source.stockholm = '' - stockholm_repo = 'http://cgit.gum/stockholm' + stockholm_repo = 'http://cgit.wolf/stockholm-mirror' cs.append(changes.GitPoller( stockholm_repo, - workdir='stockholm-poller', branch='master', + workdir='stockholm-poller', branches=True, project='stockholm', pollinterval=120)) ''; @@ -28,7 +28,9 @@ fast-tests-scheduler = '' # test the master real quick sched.append(schedulers.SingleBranchScheduler( - change_filter=util.ChangeFilter(branch="master"), + ## all branches + change_filter=util.ChangeFilter(branch_re=".*"), + # change_filter=util.ChangeFilter(branch="master"), treeStableTimer=10, #only test the latest push name="fast-master-test", builderNames=["fast-tests"])) @@ -52,7 +54,6 @@ }; builder_pre = '' # prepare grab_repo step for stockholm - stockholm_repo = "http://cgit.gum.retiolum/stockholm" grab_repo = steps.Git(repourl=stockholm_repo, mode='incremental') env = {"LOGNAME": "shared", "NIX_REMOTE": "daemon"} @@ -78,8 +79,11 @@ f.addStep(grab_repo) for i in [ "test-centos7", "wolf", "test-failing" ]: addShell(f,name="populate-{}".format(i),env=env, - command=nixshell + ["set -o pipefail;{}( nix-instantiate --arg configuration shared/1systems/{}.nix --eval --readonly-mode --show-trace -A config.krebs.build.populate --strict | jq -r .)".format("!" if "failing" in i else "",i)]) + command=nixshell + \ + ["{}( make system={} eval.config.krebs.build.populate \ + | jq -er .)".format("!" if "failing" in i else "",i)]) + # XXX we must prepare ./retiolum.rsa_key.priv for secrets to work addShell(f,name="instantiate-test-all-modules",env=env, command=nixshell + \ ["touch retiolum.rsa_key.priv; \ From 8ecdb889dd3081ba29c6ea7eb35f60b30420d201 Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 11 Feb 2016 21:23:04 +0100 Subject: [PATCH 43/81] k 5 repo-sync: init --- krebs/5pkgs/repo-sync/default.nix | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 krebs/5pkgs/repo-sync/default.nix diff --git a/krebs/5pkgs/repo-sync/default.nix b/krebs/5pkgs/repo-sync/default.nix new file mode 100644 index 000000000..90f838de9 --- /dev/null +++ b/krebs/5pkgs/repo-sync/default.nix @@ -0,0 +1,19 @@ +{ lib, pkgs, python3Packages, fetchurl, ... }: +with python3Packages; buildPythonPackage rec { + name = "repo-sync-${version}"; + version = "0.1.1"; + disabled = isPy26 || isPy27; + propagatedBuildInputs = [ + docopt + GitPython + ]; + src = fetchurl { + url = "https://pypi.python.org/packages/source/r/repo-sync/repo-sync-${version}.tar.gz"; + sha256 = "01r30l2bbsld90ps13ip0zi2a41b53dv4q6fxrzvkfrprr64c0vv"; + }; + meta = { + homepage = http://github.com/makefu/repo-sync; + description = "Sync remotes to other remotes."; + license = lib.licenses.mit; + }; +} From 6cbe21aac7680af7a6c6c2ea367ee0569d53bb21 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 11 Feb 2016 23:16:08 +0100 Subject: [PATCH 44/81] krebs.retiolum: make hostsPackage configurable --- krebs/3modules/retiolum.nix | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/krebs/3modules/retiolum.nix b/krebs/3modules/retiolum.nix index 2bf8aa5db..3ebb5e230 100644 --- a/krebs/3modules/retiolum.nix +++ b/krebs/3modules/retiolum.nix @@ -64,6 +64,21 @@ let ''; }; + hostsPackage = mkOption { + type = types.package; + default = pkgs.stdenv.mkDerivation { + name = "${cfg.netname}-tinc-hosts"; + phases = [ "installPhase" ]; + installPhase = '' + mkdir $out + ${concatStrings (mapAttrsToList (_: host: '' + echo ${shell.escape host.nets.${cfg.netname}.tinc.config} \ + > $out/${shell.escape host.name} + '') cfg.hosts)} + ''; + }; + }; + iproutePackage = mkOption { type = types.package; default = pkgs.iproute; @@ -130,18 +145,6 @@ let tinc = cfg.tincPackage; - tinc-hosts = pkgs.stdenv.mkDerivation { - name = "${cfg.netname}-tinc-hosts"; - phases = [ "installPhase" ]; - installPhase = '' - mkdir $out - ${concatStrings (mapAttrsToList (_: host: '' - echo ${shell.escape host.nets.${cfg.netname}.tinc.config} \ - > $out/${shell.escape host.name} - '') cfg.hosts)} - ''; - }; - iproute = cfg.iproutePackage; confDir = pkgs.runCommand "retiolum" { @@ -153,7 +156,7 @@ let mkdir -p $out - ln -s ${tinc-hosts} $out/hosts + ln -s ${cfg.hostsPackage} $out/hosts cat > $out/tinc.conf < Date: Thu, 11 Feb 2016 23:23:50 +0100 Subject: [PATCH 45/81] k 3 tinc_graphs: use new tinc-hosts --- krebs/3modules/tinc_graphs.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/krebs/3modules/tinc_graphs.nix b/krebs/3modules/tinc_graphs.nix index 1f32c2e59..dc0484a8b 100644 --- a/krebs/3modules/tinc_graphs.nix +++ b/krebs/3modules/tinc_graphs.nix @@ -85,7 +85,7 @@ let EXTERNAL_FOLDER = external_dir; INTERNAL_FOLDER = internal_dir; GEODB = cfg.geodbPath; - TINC_HOSTPATH=config.krebs.retiolum.hosts; + TINC_HOSTPATH = config.krebs.retiolum.hostsPackage; }; restartIfChanged = true; From e8a0058f8cd654247eb0b08326dd34c3ac9cff6a Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 11 Feb 2016 23:38:12 +0100 Subject: [PATCH 46/81] s 2 base: bump revision --- shared/2configs/base.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/shared/2configs/base.nix b/shared/2configs/base.nix index dd698ba97..715397ed5 100644 --- a/shared/2configs/base.nix +++ b/shared/2configs/base.nix @@ -18,7 +18,7 @@ with lib; krebs.build.source = { upstream-nixpkgs = mkDefault { url = https://github.com/NixOS/nixpkgs; - rev = "d0e3cca"; + rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; # for urlwatch-minidb }; secrets = mkDefault "${getEnv "HOME"}/secrets/krebs/${config.krebs.build.host.name}"; stockholm = mkDefault "${getEnv "HOME"}/stockholm"; From 8c87356aee561fd8bc50dc2b7029ab30118f0d2c Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 11 Feb 2016 23:49:45 +0100 Subject: [PATCH 47/81] krebs.retiolum.hosts*: bump description --- krebs/3modules/retiolum.nix | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/krebs/3modules/retiolum.nix b/krebs/3modules/retiolum.nix index 3ebb5e230..407695273 100644 --- a/krebs/3modules/retiolum.nix +++ b/krebs/3modules/retiolum.nix @@ -58,9 +58,9 @@ let default = filterAttrs (_: h: hasAttr cfg.netname h.nets) config.krebs.hosts; description = '' - Hosts which should be part of the tinc configuration. - Note that these hosts must have a correspondingly named network - configured, see config.krebs.retiolum.netname. + Hosts to generate config.krebs.retiolum.hostsPackage. + Note that these hosts must have a network named + config.krebs.retiolum.netname. ''; }; @@ -77,6 +77,20 @@ let '') cfg.hosts)} ''; }; + description = '' + Package of tinc host configuration files. By default, a package will + be generated from config.krebs.retiolum.hosts. This + option's main purpose is to expose the generated hosts package to other + modules, like config.krebs.tinc_graphs. But it can + also be used to provide a custom hosts directory. + ''; + example = literalExample '' + (pkgs.stdenv.mkDerivation { + name = "my-tinc-hosts"; + src = /home/tv/my-tinc-hosts; + installPhase = "cp -R . $out"; + }) + ''; }; iproutePackage = mkOption { From 17a80f2b4a525af58df31bd7743950336090635b Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 12 Feb 2016 12:23:13 +0100 Subject: [PATCH 48/81] nixpkgs: expose stockholm pkgs --- nixpkgs/default.nix | 6 +++++- nixpkgs/pkgs | 1 - 2 files changed, 5 insertions(+), 2 deletions(-) mode change 120000 => 100644 nixpkgs/default.nix delete mode 120000 nixpkgs/pkgs diff --git a/nixpkgs/default.nix b/nixpkgs/default.nix deleted file mode 120000 index 6e5223c16..000000000 --- a/nixpkgs/default.nix +++ /dev/null @@ -1 +0,0 @@ -../../upstream-nixpkgs/default.nix \ No newline at end of file diff --git a/nixpkgs/default.nix b/nixpkgs/default.nix new file mode 100644 index 000000000..1fe99b0ab --- /dev/null +++ b/nixpkgs/default.nix @@ -0,0 +1,5 @@ +_: + +(import { + configuration = {}; +}).pkgs diff --git a/nixpkgs/pkgs b/nixpkgs/pkgs deleted file mode 120000 index 983384943..000000000 --- a/nixpkgs/pkgs +++ /dev/null @@ -1 +0,0 @@ -../../upstream-nixpkgs/pkgs \ No newline at end of file From 386a2191a13229b24a851d7ed02297d289cd5725 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 12 Feb 2016 14:20:51 +0100 Subject: [PATCH 49/81] xmonad-stockholm: 1.0.0 -> 1.1.0 --- .../haskell-overrides/xmonad-stockholm.nix | 8 +++---- tv/5pkgs/xmonad-tv/Main.hs | 21 +++++++++---------- 2 files changed, 14 insertions(+), 15 deletions(-) diff --git a/krebs/5pkgs/haskell-overrides/xmonad-stockholm.nix b/krebs/5pkgs/haskell-overrides/xmonad-stockholm.nix index 096597808..12eab943d 100644 --- a/krebs/5pkgs/haskell-overrides/xmonad-stockholm.nix +++ b/krebs/5pkgs/haskell-overrides/xmonad-stockholm.nix @@ -3,11 +3,11 @@ }: mkDerivation { pname = "xmonad-stockholm"; - version = "1.0.0"; + version = "1.1.0"; src = fetchgit { - url = "http://cgit.cd.krebsco.de/xmonad-stockholm"; - sha256 = "35dda5d16acc90af94ae2fae10ab5cc2d5b450c3f1ff2e7f515ac53877269abf"; - rev = "2dbefe42fc5cfe9093465bf3e22ba8f82feeef6e"; + url = http://cgit.cd.krebsco.de/xmonad-stockholm; + rev = "179d29fd4c765dee698058ef63295331ac603639"; + sha256 = "0c6mj68xsxxr4j8adkzhjszi7bg6cpisrsmqn587a16sblpbrnkj"; }; libraryHaskellDepends = [ base containers X11 X11-xshape xmonad xmonad-contrib diff --git a/tv/5pkgs/xmonad-tv/Main.hs b/tv/5pkgs/xmonad-tv/Main.hs index 6482d9cc8..817d0092e 100644 --- a/tv/5pkgs/xmonad-tv/Main.hs +++ b/tv/5pkgs/xmonad-tv/Main.hs @@ -13,7 +13,6 @@ import XMonad import System.IO (hPutStrLn, stderr) import System.Environment (getArgs, withArgs, getEnv, getEnvironment) import System.Posix.Process (executeFile) -import XMonad.Prompt (defaultXPConfig) import XMonad.Actions.DynamicWorkspaces ( addWorkspacePrompt, renameWorkspace , removeEmptyWorkspace) import XMonad.Actions.GridSelect @@ -64,7 +63,7 @@ mainNoArgs = do -- $ withUrgencyHook borderUrgencyHook "magenta" -- $ withUrgencyHookC BorderUrgencyHook { urgencyBorderColor = "magenta" } urgencyConfig { suppressWhen = Never } $ withUrgencyHook (SpawnUrgencyHook "echo emit Urgency ") - $ defaultConfig + $ def { terminal = myTerm , modMask = mod4Mask , keys = myKeys @@ -179,8 +178,8 @@ myKeys conf = Map.fromList $ , ((_4 , xK_comma ), sendMessage $ IncMasterN 1) , ((_4 , xK_period ), sendMessage $ IncMasterN (-1)) - , ((_4 , xK_a ), addWorkspacePrompt defaultXPConfig) - , ((_4 , xK_r ), renameWorkspace defaultXPConfig) + , ((_4 , xK_a ), addWorkspacePrompt def) + , ((_4 , xK_r ), renameWorkspace def) , ((_4 , xK_Delete ), removeEmptyWorkspace) , ((_4 , xK_Return ), toggleWS) @@ -205,7 +204,7 @@ myKeys conf = Map.fromList $ pagerConfig :: PagerConfig -pagerConfig = defaultPagerConfig +pagerConfig = def { pc_font = myFont , pc_cellwidth = 64 --, pc_cellheight = 36 -- TODO automatically keep screen aspect @@ -218,13 +217,13 @@ pagerConfig = defaultPagerConfig where windowColors _ _ _ True _ = ("#ef4242","#ff2323") windowColors wsf m c u wf = do - let def = defaultWindowColors wsf m c u wf + let y = defaultWindowColors wsf m c u wf if m == False && wf == True - then ("#402020", snd def) - else def + then ("#402020", snd y) + else y horseConfig :: RhombusConfig -horseConfig = defaultRhombusConfig +horseConfig = def { rc_font = myFont , rc_cellwidth = 64 --, rc_cellheight = 36 -- TODO automatically keep screen aspect @@ -236,7 +235,7 @@ horseConfig = defaultRhombusConfig } wGSConfig :: GSConfig Window -wGSConfig = defaultGSConfig +wGSConfig = def { gs_cellheight = 20 , gs_cellwidth = 192 , gs_cellpadding = 5 @@ -244,7 +243,7 @@ wGSConfig = defaultGSConfig , gs_navigate = navNSearch } --- wsGSConfig = defaultGSConfig +-- wsGSConfig = def -- { gs_cellheight = 20 -- , gs_cellwidth = 64 -- , gs_cellpadding = 5 From d954dd5e192834a72a2d05b428fc0e8cef599c31 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 12 Feb 2016 19:48:16 +0100 Subject: [PATCH 50/81] Makefile: interpolate $(target_*) for a nicer log --- Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index e61d16b75..9ed045e4d 100644 --- a/Makefile +++ b/Makefile @@ -8,7 +8,7 @@ export target_path ?= /var/src evaluate = \ nix-instantiate \ - --arg configuration "./$$LOGNAME/1systems/$$system.nix" \ + --arg configuration ./$(LOGNAME)/1systems/$(system).nix \ --eval \ --readonly-mode \ --show-trace \ @@ -22,7 +22,7 @@ execute = \ # usage: make deploy system=foo [target_host=bar] deploy: $(call execute,populate) - @set -x; ssh "$$target_user@$$target_host" nixos-rebuild switch -I "$$target_path" + ssh $(target_user)@$(target_host) nixos-rebuild switch -I $(target_path) # usage: make LOGNAME=shared system=wolf eval.config.krebs.build.host.name eval eval.:;@$(call evaluate) From 1497ee718256ff48c65ebcb0ddea633c6628eb69 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 12 Feb 2016 19:56:04 +0100 Subject: [PATCH 51/81] Makefile: enable "make install" --- Makefile | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/Makefile b/Makefile index 9ed045e4d..f39ed0c02 100644 --- a/Makefile +++ b/Makefile @@ -28,14 +28,13 @@ deploy: eval eval.:;@$(call evaluate) eval.%:;@$(call evaluate,-A $*) -## usage: make install system=foo target= -#.PHONY: install -#install: ssh = ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -#install:;@set -x -# $(ssh) "$$target_user@$$target_host" \ -# env target_path="$target_path" \ -# sh -s prepare < krebs/4lib/infest/prepare.sh -# make -s populate target_path=/mnt"$$target_path" -# $(ssh) "$$target_user@$$target_host" \ -# env NIXOS_CONFIG=/var/src/nixos-config \ -# nixos-install +# usage: make install system=foo [target_host=bar] +install: ssh = ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null +install: + $(ssh) $(target_user)@$(target_host) \ + env target_path=$(target_path) \ + sh -s prepare < krebs/4lib/infest/prepare.sh + target_path=/mnt$(target_path) $(call execute,populate) + $(ssh) $(target_user)@$(target_host) \ + env NIXOS_CONFIG=$(target_path)/nixos-config \ + nixos-install From c338330f066e3fe6903158ad6536d71a70cf1daa Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 12 Feb 2016 23:20:50 +0100 Subject: [PATCH 52/81] make install: make ssh configurable --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index f39ed0c02..a25b90771 100644 --- a/Makefile +++ b/Makefile @@ -29,7 +29,7 @@ eval eval.:;@$(call evaluate) eval.%:;@$(call evaluate,-A $*) # usage: make install system=foo [target_host=bar] -install: ssh = ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null +install: ssh ?= ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null install: $(ssh) $(target_user)@$(target_host) \ env target_path=$(target_path) \ From e0443f975be5e2d9dcea1c745cd46e856b7a400b Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 14:08:27 +0100 Subject: [PATCH 53/81] vncdotool: init at 0.9.0 --- krebs/5pkgs/vncdotool/default.nix | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 krebs/5pkgs/vncdotool/default.nix diff --git a/krebs/5pkgs/vncdotool/default.nix b/krebs/5pkgs/vncdotool/default.nix new file mode 100644 index 000000000..95e2ca706 --- /dev/null +++ b/krebs/5pkgs/vncdotool/default.nix @@ -0,0 +1,20 @@ +{ lib, pythonPackages, fetchurl, ... }: +with pythonPackages; buildPythonPackage rec { + name = lib.removeSuffix ".tar.gz" (builtins.baseNameOf src.name); + + src = fetchurl { + url = https://pypi.python.org/packages/source/v/vncdotool/vncdotool-0.9.0.tar.gz; + sha256 = "1hl44w4x9c8air0g6kp9h1af2vj4lmc50vnsxmca9g080740iyvi"; + }; + + propagatedBuildInputs = [ + twisted + pillow + ]; + + meta = { + homepage = https://github.com/sibson/vncdotool; + description = "A command line VNC client and python library"; + license = lib.licenses.mit; + }; +} From 45bd2ca7a2055e6d3f6e3d70edbbc9bebd9cbc40 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 14:25:44 +0100 Subject: [PATCH 54/81] noVNC: init at 0.5.1 --- krebs/5pkgs/noVNC/default.nix | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 krebs/5pkgs/noVNC/default.nix diff --git a/krebs/5pkgs/noVNC/default.nix b/krebs/5pkgs/noVNC/default.nix new file mode 100644 index 000000000..629d288ae --- /dev/null +++ b/krebs/5pkgs/noVNC/default.nix @@ -0,0 +1,21 @@ +{ fetchgit, lib, stdenv, ... }: +with builtins; +with lib; +stdenv.mkDerivation rec { + name = "${baseNameOf src.name}-${removePrefix "refs/tags/v" src.rev}"; + + src = fetchgit { + url = https://github.com/kanaka/noVNC; + rev = "refs/tags/v0.5.1"; + sha256 = "1azsnppwnrsv3axj0r5bw8lfarkibgz5vhgcyj8dzn4afn98f55w"; + }; + + phases = [ + "unpackPhase" + "installPhase" + ]; + + installPhase = '' + cp -R . $out + ''; +} From 411aec6bf9d1b53813e693f22b77972a00ce9078 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 16:03:40 +0100 Subject: [PATCH 55/81] deploy,install,populate: admit target SSH port --- Makefile | 8 +++++--- krebs/3modules/build.nix | 5 ++++- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/Makefile b/Makefile index a25b90771..c7dee134c 100644 --- a/Makefile +++ b/Makefile @@ -4,6 +4,7 @@ endif export target_host ?= $(system) export target_user ?= root +export target_port ?= 22 export target_path ?= /var/src evaluate = \ @@ -22,7 +23,8 @@ execute = \ # usage: make deploy system=foo [target_host=bar] deploy: $(call execute,populate) - ssh $(target_user)@$(target_host) nixos-rebuild switch -I $(target_path) + ssh $(target_user)@$(target_host) -p $(target_port) \ + nixos-rebuild switch -I $(target_path) # usage: make LOGNAME=shared system=wolf eval.config.krebs.build.host.name eval eval.:;@$(call evaluate) @@ -31,10 +33,10 @@ eval.%:;@$(call evaluate,-A $*) # usage: make install system=foo [target_host=bar] install: ssh ?= ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null install: - $(ssh) $(target_user)@$(target_host) \ + $(ssh) $(target_user)@$(target_host) -p $(target_port) \ env target_path=$(target_path) \ sh -s prepare < krebs/4lib/infest/prepare.sh target_path=/mnt$(target_path) $(call execute,populate) - $(ssh) $(target_user)@$(target_host) \ + $(ssh) $(target_user)@$(target_host) -p $(target_port) \ env NIXOS_CONFIG=$(target_path)/nixos-config \ nixos-install diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix index 3530fd595..1569072d1 100644 --- a/krebs/3modules/build.nix +++ b/krebs/3modules/build.nix @@ -51,6 +51,7 @@ let source = config.krebs.build.source; target-user = maybeEnv "target_user" "root"; target-host = maybeEnv "target_host" config.krebs.build.host.name; + target-port = maybeEnv "target_port" "22"; target-path = maybeEnv "target_path" "/var/src"; out = '' #! /bin/sh @@ -62,7 +63,8 @@ let } echo ${shell.escape git-script} \ - | ssh ${shell.escape "${target-user}@${target-host}"} -T + | ssh -p ${shell.escape target-port} \ + ${shell.escape "${target-user}@${target-host}"} -T unset tmpdir trap ' @@ -93,6 +95,7 @@ let (attrNames file-specs)} \ --delete \ -vFrlptD \ + -e ${shell.escape "ssh -p ${target-port}"} \ ${shell.escape target-path}/ \ ${shell.escape "${target-user}@${target-host}:${target-path}"} ''; From d38853027efe650e6de4b335014cd238624cd993 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 16:07:01 +0100 Subject: [PATCH 56/81] krebs.nginx: default locations = [] --- krebs/3modules/nginx.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix index 921771033..5bc0903e4 100644 --- a/krebs/3modules/nginx.nix +++ b/krebs/3modules/nginx.nix @@ -34,6 +34,7 @@ let }; locations = mkOption { type = with types; listOf (attrsOf str); + default = []; }; extraConfig = mkOption { type = with types; string; @@ -76,8 +77,8 @@ let server { ${concatMapStringsSep "\n" (x: "listen ${x};") listen} server_name ${toString server-names}; - ${extraConfig} - ${indent (concatStrings (map to-location locations))} + ${indent extraConfig} + ${indent (concatMapStrings to-location locations)} } ''; From 67b77ae4d7626d6007cc8e0726ca3b8239429681 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 16:21:24 +0100 Subject: [PATCH 57/81] krebs/4lib/infest: merge install-nix.sh into prepare.sh --- krebs/4lib/infest/install-nix.sh | 50 ------------------------------- krebs/4lib/infest/prepare.sh | 51 ++++++++++++++++++++++++++++++-- 2 files changed, 49 insertions(+), 52 deletions(-) delete mode 100644 krebs/4lib/infest/install-nix.sh diff --git a/krebs/4lib/infest/install-nix.sh b/krebs/4lib/infest/install-nix.sh deleted file mode 100644 index af1a8bd16..000000000 --- a/krebs/4lib/infest/install-nix.sh +++ /dev/null @@ -1,50 +0,0 @@ -#! /bin/sh -set -efu - -nix_url=https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-linux.tar.bz2 -nix_sha256=504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4 - -install_nix() {( - - # install nix on host (cf. https://nixos.org/nix/install) - if ! test -e /root/.nix-profile/etc/profile.d/nix.sh; then - ( - verify() { - printf '%s %s\n' $nix_sha256 $(basename $nix_url) | sha256sum -c - } - if ! verify; then - curl -C - -O "$nix_url" - verify - fi - ) - nix_src_dir=$(basename $nix_url .tar.bz2) - tar jxf $nix_src_dir.tar.bz2 - $nix_src_dir/install - fi - - . /root/.nix-profile/etc/profile.d/nix.sh - - for i in \ - bash \ - coreutils \ - # This line intentionally left blank. - do - if ! nix-env -q $i | grep -q .; then - nix-env -iA nixpkgs.pkgs.$i - fi - done - - # install nixos-install - if ! type nixos-install 2>/dev/null; then - nixpkgs_expr='import { system = builtins.currentSystem; }' - nixpkgs_path=$(find /nix/store -mindepth 1 -maxdepth 1 -name *-nixpkgs-* -type d) - nix-env \ - --arg config "{ nix.package = ($nixpkgs_expr).nix; }" \ - --arg pkgs "$nixpkgs_expr" \ - --arg modulesPath 'throw "no modulesPath"' \ - -f $nixpkgs_path/nixpkgs/nixos/modules/installer/tools/tools.nix \ - -iA config.system.build.nixos-install - fi -)} - -install_nix "$@" diff --git a/krebs/4lib/infest/prepare.sh b/krebs/4lib/infest/prepare.sh index 0bfc49380..d9271da73 100644 --- a/krebs/4lib/infest/prepare.sh +++ b/krebs/4lib/infest/prepare.sh @@ -1,6 +1,9 @@ #! /bin/sh set -efu +nix_url=https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-linux.tar.bz2 +nix_sha256=504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4 + prepare() {( if test -e /etc/os-release; then . /etc/os-release @@ -70,7 +73,7 @@ prepare_debian() { prepare_common } -prepare_common() { +prepare_common() {( if ! getent group nixbld >/dev/null; then groupadd -g 30000 -r nixbld @@ -133,6 +136,50 @@ prepare_common() { mkdir -p /mnt/nix mount --bind /nix /mnt/nix fi -} + + # + # install nix + # + + # install nix on host (cf. https://nixos.org/nix/install) + if ! test -e /root/.nix-profile/etc/profile.d/nix.sh; then + ( + verify() { + printf '%s %s\n' $nix_sha256 $(basename $nix_url) | sha256sum -c + } + if ! verify; then + curl -C - -O "$nix_url" + verify + fi + ) + nix_src_dir=$(basename $nix_url .tar.bz2) + tar jxf $nix_src_dir.tar.bz2 + $nix_src_dir/install + fi + + . /root/.nix-profile/etc/profile.d/nix.sh + + for i in \ + bash \ + coreutils \ + # This line intentionally left blank. + do + if ! nix-env -q $i | grep -q .; then + nix-env -iA nixpkgs.pkgs.$i + fi + done + + # install nixos-install + if ! type nixos-install 2>/dev/null; then + nixpkgs_expr='import { system = builtins.currentSystem; }' + nixpkgs_path=$(find /nix/store -mindepth 1 -maxdepth 1 -name *-nixpkgs-* -type d) + nix-env \ + --arg config "{ nix.package = ($nixpkgs_expr).nix; }" \ + --arg pkgs "$nixpkgs_expr" \ + --arg modulesPath 'throw "no modulesPath"' \ + -f $nixpkgs_path/nixpkgs/nixos/modules/installer/tools/tools.nix \ + -iA config.system.build.nixos-install + fi +)} prepare "$@" From eb0797b7edcdfd6b01e5c99735799ccfdbf12153 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 16:22:23 +0100 Subject: [PATCH 58/81] krebs/4lib/infest/prepare.sh: recognize NixOS ISO --- krebs/4lib/infest/prepare.sh | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/krebs/4lib/infest/prepare.sh b/krebs/4lib/infest/prepare.sh index d9271da73..b3824c7d4 100644 --- a/krebs/4lib/infest/prepare.sh +++ b/krebs/4lib/infest/prepare.sh @@ -36,6 +36,13 @@ prepare() {( ;; esac ;; + nixos) + case $(cat /proc/cmdline) in + *' root=LABEL=NIXOS_ISO '*) + prepare_nixos_iso "$@" + exit + esac + ;; esac elif test -e /etc/centos-release; then case $(cat /etc/centos-release) in @@ -73,6 +80,24 @@ prepare_debian() { prepare_common } +prepare_nixos_iso() { + mountpoint /mnt + + type git 2>/dev/null || nix-env -iA nixos.git + + mkdir -p /mnt/"$target_path" + mkdir -p "$target_path" + + if ! mountpoint "$target_path"; then + mount --rbind /mnt/"$target_path" "$target_path" + fi + + mkdir -p bin + rm -f bin/nixos-install + cp "$(type -p nixos-install)" bin/nixos-install + sed -i "s@^NIX_PATH=\"[^\"]*\"@NIX_PATH=$target_path@" bin/nixos-install +} + prepare_common() {( if ! getent group nixbld >/dev/null; then From 49efebaad725fbc3c3e0eae9e97e8311844f262c Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 16:45:26 +0100 Subject: [PATCH 59/81] execve: allow argv propagation --- krebs/5pkgs/builders.nix | 39 +++++++++++++++++++++++++-------------- 1 file changed, 25 insertions(+), 14 deletions(-) diff --git a/krebs/5pkgs/builders.nix b/krebs/5pkgs/builders.nix index b3cb1c943..43707aeca 100644 --- a/krebs/5pkgs/builders.nix +++ b/krebs/5pkgs/builders.nix @@ -1,19 +1,30 @@ { lib, pkgs, ... }: with lib; -{ - execve = name: { filename, argv, envp ? {}, destination ? "" }: - writeC name { inherit destination; } '' - #include - int main () { - const char *filename = ${toC filename}; - char *const argv[] = ${toC (argv ++ [null])}; - char *const envp[] = ${toC ( - mapAttrsToList (k: v: "${k}=${v}") envp ++ [null] - )}; - execve(filename, argv, envp); - return -1; - } - ''; +rec { + execve = name: { filename, argv ? null, envp ? {}, destination ? "" }: let + in writeC name { inherit destination; } '' + #include + + static char *const filename = ${toC filename}; + + ${if argv == null + then /* Propagate arguments */ '' + #define MAIN_ARGS int argc, char **argv + '' + else /* Provide fixed arguments */ '' + #define MAIN_ARGS void + static char *const argv[] = ${toC (argv ++ [null])}; + ''} + + static char *const envp[] = ${toC ( + mapAttrsToList (k: v: "${k}=${v}") envp ++ [null] + )}; + + int main (MAIN_ARGS) { + execve(filename, argv, envp); + return -1; + } + ''; execveBin = name: cfg: execve name (cfg // { destination = "/bin/${name}"; }); From 96f3dbe6ec9f7eb6f9a897c960abbbe30ad316b9 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 16:46:15 +0100 Subject: [PATCH 60/81] krebs.types.host: default to empty nets --- krebs/4lib/types.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix index 873f3ddfb..d0a537467 100644 --- a/krebs/4lib/types.nix +++ b/krebs/4lib/types.nix @@ -17,6 +17,7 @@ types // rec { }; nets = mkOption { type = attrsOf net; + default = {}; }; extraZones = mkOption { From 0257acf93a7cfc91fa65b0d00dcf7f70caa9a33b Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 17:56:06 +0100 Subject: [PATCH 61/81] tv urlwatch: add vncdotool and noVNC --- tv/2configs/urlwatch.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tv/2configs/urlwatch.nix b/tv/2configs/urlwatch.nix index 8189f6345..0106cddf7 100644 --- a/tv/2configs/urlwatch.nix +++ b/tv/2configs/urlwatch.nix @@ -51,6 +51,9 @@ # # is derived from `configFile` in: https://raw.githubusercontent.com/NixOS/nixpkgs/master/nixos/modules/services/x11/xserver.nix + + https://pypi.python.org/pypi/vncdotool + https://api.github.com/repos/kanaka/noVNC/tags ]; }; } From de4260a6a2b77aeb8115167ee63c1b20facd5b6a Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 17:56:59 +0100 Subject: [PATCH 62/81] tv backup: add xu-test-* --- tv/2configs/backup.nix | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix index 6c90709a8..57f299ebd 100644 --- a/tv/2configs/backup.nix +++ b/tv/2configs/backup.nix @@ -26,5 +26,28 @@ with lib; yearly = { format = "%Y"; }; }; }; + } // mapAttrs (_: recursiveUpdate { + snapshots = { + minutely = { format = "%Y-%m-%dT%H:%M"; retain = 3; }; + hourly = { format = "%Y-%m-%dT%H"; retain = 3; }; + daily = { format = "%Y-%m-%d"; retain = 3; }; + }; + startAt = null; + }) { + xu-test-push-xu = { + method = "push"; + src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; }; + dst = { host = config.krebs.hosts.xu; path = "/bku/xu-test-push"; }; + }; + xu-test-pull-xu = { + method = "pull"; + src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; }; + dst = { host = config.krebs.hosts.xu; path = "/bku/xu-test-pull"; }; + }; + xu-test-push-wu = { + method = "push"; + src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; }; + dst = { host = config.krebs.hosts.wu; path = "/bku/xu-test-push"; }; + }; }; } From 9fbd327b80caa3c79940631138963e2e4b069ff7 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 17:58:02 +0100 Subject: [PATCH 63/81] tv systemPackages: add get, krebszones, nix-prefetch-scripts, and push --- tv/2configs/default.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index b5639af51..dee0b15b1 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -183,6 +183,15 @@ with lib; "sendmail" # for sudo ]; } + { + environment.systemPackages = [ + pkgs.get + pkgs.krebszones + pkgs.nix-prefetch-scripts + pkgs.push + ]; + } + { systemd.tmpfiles.rules = let forUsers = flip map users; From 7bc891476d143f03185b5d948d92599a20adc385 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 17:58:40 +0100 Subject: [PATCH 64/81] xu systemPackages: s/#cac/cac-api/ --- tv/1systems/xu.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index 8c4af2bd3..6f882cd4a 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -43,7 +43,7 @@ with lib; # tv bc bind # dig - #cac + cac-api dic file gnupg21 From bc73780b06d5841cf49d2696911f9733330f00d9 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 18:15:59 +0100 Subject: [PATCH 65/81] tv: lol libvirt --- tv/1systems/wu.nix | 3 --- tv/1systems/xu.nix | 2 -- 2 files changed, 5 deletions(-) diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index 4ed13a0ea..0184ed991 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -191,8 +191,6 @@ with lib; "d /tmp 1777 root root - -" # does this work with mounted /tmp? ]; - virtualisation.libvirtd.enable = true; - services.udev.extraRules = '' SUBSYSTEM=="net", ATTR{address}=="00:90:f5:da:aa:c3", NAME="en0" SUBSYSTEM=="net", ATTR{address}=="a0:88:b4:1b:ae:6c", NAME="wl0" @@ -211,5 +209,4 @@ with lib; services.tor.client.enable = true; services.tor.enable = true; services.virtualboxHost.enable = true; - } diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index 6f882cd4a..098d5ffa5 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -189,8 +189,6 @@ with lib; "d /tmp 1777 root root - -" # does this work with mounted /tmp? ]; - #virtualisation.libvirtd.enable = true; - #services.bitlbee.enable = true; #services.tor.client.enable = true; #services.tor.enable = true; From 05bca39544b248d209e371a8406b97e47d63516c Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 18:17:55 +0100 Subject: [PATCH 66/81] nixpkgs: enable nix-* autocall --- nixpkgs/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nixpkgs/default.nix b/nixpkgs/default.nix index 1fe99b0ab..8514fa499 100644 --- a/nixpkgs/default.nix +++ b/nixpkgs/default.nix @@ -1,5 +1,6 @@ -_: +{ system ? builtins.currentSystem }: (import { + inherit system; configuration = {}; }).pkgs From 115711d529500684da5b72f3e20c98279184b045 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 18:21:17 +0100 Subject: [PATCH 67/81] xu-qemu0: init --- tv/1systems/xu-qemu0.nix | 27 +++++ tv/1systems/xu.nix | 1 + tv/2configs/xu-qemu0.nix | 226 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 254 insertions(+) create mode 100644 tv/1systems/xu-qemu0.nix create mode 100644 tv/2configs/xu-qemu0.nix diff --git a/tv/1systems/xu-qemu0.nix b/tv/1systems/xu-qemu0.nix new file mode 100644 index 000000000..03ac19cf7 --- /dev/null +++ b/tv/1systems/xu-qemu0.nix @@ -0,0 +1,27 @@ +{ config, lib, pkgs, ... }: + +{ + krebs.hosts.xu-qemu0 = { + cores = 1; + ssh.privkey.path = ; + # cannot define ssh.pubkey without at least one addr or alias + #ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFe51rD0ZqlMXNi/YpapnRzvdzCjI0icmxfCyBLSKG04"; + }; + krebs.build.host = config.krebs.hosts.xu-qemu0; + + imports = [ + + ]; + + boot.loader.grub.device = "/dev/sda"; + + fileSystems = { + "/boot" = { + device = "/dev/sda1"; + }; + "/" = { + device = "/dev/sda2"; + fsType = "btrfs"; + }; + }; +} diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index 098d5ffa5..2719d56f4 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -14,6 +14,7 @@ with lib; ../2configs/pulse.nix ../2configs/retiolum.nix ../2configs/xserver + ../2configs/xu-qemu0.nix { environment.systemPackages = with pkgs; [ diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix new file mode 100644 index 000000000..836603663 --- /dev/null +++ b/tv/2configs/xu-qemu0.nix @@ -0,0 +1,226 @@ +{ config, lib, pkgs, ... }: + +let + # XXX cannot use config.build.host.name here because infinite recursion when + # defining krebs.hosts.${host-name}.nets.retiolum.aliases below. + host-name = "xu"; +in + +# usage: +# sudo -iu df xu-qemu0 +# set_password vnc correcthorze +# +# vncdo -s xu:1 type 'curl init.xu.r' key shift-\\ type sh key return +# +# http://vnc.xu/vnc_auto.html?port=5701&host=xu&password=correcthorze +# +# make [install] system=xu-qemu0 target_host=10.56.0.101 + + +with lib; + +{ + #networking.wireless.interfaces = [ "wlp3s0" ]; + + #networking.useNetworkd = true; + + #networking.dhcpcd.allowInterfaces = [ + # "qemubr0" + #]; + + #systemd.network.networks.wlp3s0 = { + # matchConfig.name = "wlp3s0"; + # networkConfig.Bridge = "qemubr0"; + #}; + + systemd.network.enable = true; + + systemd.network.netdevs.qemubr0 = { + netdevConfig = { + Name = "qemubr0"; + Kind = "bridge"; + }; + }; + + users.groups.qemu-users.gid = genid "qemu-users"; + users.users.df.extraGroups = [ "qemu-users" ]; + + environment.etc."qemu/bridge.conf".text = '' + allow qemubr0 + ''; + + krebs.per-user.tv.packages = [ + pkgs.vncdotool + ]; + + krebs.per-user.df.packages = [ + (pkgs.writeDashBin "xu-qemu0" '' + set -efux + img=$HOME/tmp/xu-qemu0.raw + if ! test -e "$img"; then + ${pkgs.coreutils}/bin/mkdir -p "$(${pkgs.coreutils}/bin/dirname "$img")" + ${pkgs.kvm}/bin/qemu-img create "$img" 10G + fi + exec ${pkgs.kvm}/bin/qemu-kvm \ + -monitor stdio \ + -boot order=cd \ + -cdrom ${pkgs.fetchurl { + url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso; + sha256 = "18bc9wrsrjnhj9rya75xliqkl99gxbsk4dmwqivhvwfzb5qb5yp9"; + }} \ + -m 1024 \ + -netdev bridge,br=qemubr0,id=hn0,helper=/var/setuid-wrappers/qemu-bridge-helper \ + -net nic,netdev=hn0,id=nic1,macaddr=52:54:00:12:34:56 \ + -drive file="$img",format=raw \ + -display vnc=:1,websocket=5701,password,lossy \ + -name xu-qemu0 \ + '') + ]; + + #TODO krebs.setuid.qemu-bridge-helper = { + # filename = "${pkgs.qemu}/libexec/qemu-bridge-helper"; + # owner = "root"; + # group = "qemu-users"; + # mode = "4710"; + #}; + system.activationScripts."krebs.setuid" = stringAfter [ "setuid" ] '' + src=${pkgs.execve "qemu-bridge-helper" { + filename = "${pkgs.qemu}/libexec/qemu-bridge-helper"; + }} + dst=${config.security.wrapperDir}/qemu-bridge-helper + cp "$src" "$dst" + chown root.qemu-users "$dst" + chmod 4710 "$dst" + ''; + + users.users.qemu-dnsmasq.uid = genid "qemu-dnsmasq"; + + # TODO need custom etc/dbus-1/system.d/dnsmasq.conf for different BusName + services.dbus.packages = [ pkgs.dnsmasq ]; + + systemd.services.qemu-dnsmasq = let + # bind-interfaces + conf = pkgs.writeText "qemu-dnsmasq.conf" '' + listen-address=10.56.0.1 + interface=qemubr0 + dhcp-range=10.56.0.200,10.56.0.250 + dhcp-no-override + dhcp-leasefile=/tmp/qemu-dnsmasq.leases + domain=${host-name}.local + dhcp-host=52:54:00:12:34:56,xu-qemu0,10.56.0.101,1440m + ''; + in { + after = [ "network.target" "systemd-resolved.service" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + Type = "dbus"; + BusName = "uk.org.thekelleys.dnsmasq"; + # -1 --enable-dbus[=uk.org.thekelleys.dnsmasq] + SyslogIdentifier = "qemu-dnsmasq"; + ExecStart = "${pkgs.dnsmasq}/bin/dnsmasq -1k -u qemu-dnsmasq -C ${conf}"; + ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; + PrivateTmp = "true"; + }; + restartTriggers = [ config.environment.etc.hosts.source ]; + }; + + + krebs.nginx.servers.init = { + server-names = [ + "init.${host-name}" + "init.${host-name}.r" + "init.${host-name}.retiolum" + ]; + extraConfig = '' + index init.txt; + root ${pkgs.writeTextFile { + name = "init-pages"; + text = '' + #! /bin/sh + set -efu + + dev=/dev/sda + pttype=dos # gpt + + case $pttype in + dos) + if ! test "$(blkid -o value -s PTTYPE "$dev")" = dos; then + parted -s "$dev" mklabel msdos + fi + if ! test "$(blkid -o value -s PARTLABEL "$dev"1)" = primary; then + parted -s "$dev" mkpart primary ext4 1MiB 513MiB + parted -s "$dev" set 1 boot on + fi + ;; + gpt) + if ! test "$(blkid -o value -s PTTYPE "$dev")" = gpt; then + parted -s "$dev" mklabel gpt + fi + if ! test "$(blkid -o value -s PARTLABEL "$dev"1)" = ESP; then + parted -s "$dev" mkpart ESP fat32 1MiB 513MiB + parted -s "$dev" set 1 boot on + fi + ;; + *) + echo "Error: bad pttype: $pttype" >&2 + exit -1 + esac + + if ! test "$(blkid -o value -s PARTLABEL "$dev"2)" = primary; then + parted -s "$dev" mkpart primary btrfs 513MiB 100% + fi + if ! test "$(blkid -o value -s TYPE "$dev"1)" = vfat; then + mkfs.vfat "$dev"1 + fi + if ! test "$(blkid -o value -s TYPE "$dev"2)" = btrfs; then + mkfs.btrfs "$dev"2 + fi + + parted "$dev" print + + if ! test "$(lsblk -n -o MOUNTPOINT "$dev"2)" = /mnt; then + mount "$dev"2 /mnt + fi + if ! test "$(lsblk -n -o MOUNTPOINT "$dev"1)" = /mnt/boot; then + mkdir -m 0000 -p /mnt/boot + mount "$dev"1 /mnt/boot + fi + + lsblk "$dev" + + key=${shell.escape config.krebs.users.tv-xu.pubkey} + + if [ "$(cat /root/.ssh/authorized_keys 2>/dev/null)" != "$key" ]; then + mkdir -p /root/.ssh + echo "$key" > /root/.ssh/authorized_keys + fi + systemctl start sshd + ip route + echo READY. + ''; + destination = "/init.txt"; + }}; + ''; + }; + + + krebs.hosts.${host-name}.nets.retiolum.aliases = [ + "init.${host-name}.r" + "init.${host-name}.retiolum" + "vnc.${host-name}.r" + "vnc.${host-name}.retiolum" + ]; + + krebs.nginx.servers.noVNC = { + server-names = [ + "vnc.${host-name}" + "vnc.${host-name}.r" + "vnc.${host-name}.retiolum" + ]; + #rewrite ^([^.]*)$ /vnc_auto.html?host=localhost&port=5701; + locations = singleton (nameValuePair "/" '' + index vnc.html; + root ${pkgs.noVNC}; + ''); + }; +} From 0e35bc5c193916a5424689d04234978d3c57ecf5 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 19:43:02 +0100 Subject: [PATCH 68/81] wbob: fix addrs --- krebs/3modules/makefu/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix index 2811c0c52..d21c80e78 100644 --- a/krebs/3modules/makefu/default.nix +++ b/krebs/3modules/makefu/default.nix @@ -292,8 +292,8 @@ with lib; cores = 1; nets = { retiolm = { - addrs4 = ["10.243.214.15/32"]; - addrs6 = ["42:5a02:2c30:c1b1:3f2e:7c19:2496:a732/128"]; + addrs4 = ["10.243.214.15"]; + addrs6 = ["42:5a02:2c30:c1b1:3f2e:7c19:2496:a732"]; aliases = [ "wbob.retiolum" ]; From 3ca0df0447c30d83c14144ad6f9a95cd4514117c Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 19:57:45 +0100 Subject: [PATCH 69/81] tv: add systemd.services.xu-qemu0 + xu-qemu0-monitor --- tv/2configs/default.nix | 1 + tv/2configs/xu-qemu0.nix | 86 ++++++++++++++++++++++++++++------------ 2 files changed, 61 insertions(+), 26 deletions(-) diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index dee0b15b1..2edaed76d 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -44,6 +44,7 @@ with lib; tv = { isNormalUser = true; uid = 1337; + extraGroups = [ "tv" ]; }; }; }; diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix index 836603663..4584dcd7c 100644 --- a/tv/2configs/xu-qemu0.nix +++ b/tv/2configs/xu-qemu0.nix @@ -7,8 +7,7 @@ let in # usage: -# sudo -iu df xu-qemu0 -# set_password vnc correcthorze +# echo set_password vnc correcthorze | xu-qemu0-monitor # # vncdo -s xu:1 type 'curl init.xu.r' key shift-\\ type sh key return # @@ -16,6 +15,13 @@ in # # make [install] system=xu-qemu0 target_host=10.56.0.101 +# TODO iptables -A INPUT -p udp -m udp --dport bootps -j ACCEPT +# TODO iptables -A FORWARD -i qemubr0 -s 10.56.0.1/24 -m conntrack --ctstate NEW -j ACCEPT +# TODO iptables -A POSTROUTING -t nat -j MASQUERADE +# TODO iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT +# TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT +# TODO echo 1 > /proc/sys/net/ipv4/ip_forward +# TODO ifconfig qemubr0 10.56.0.1/24 up with lib; @@ -43,7 +49,6 @@ with lib; }; users.groups.qemu-users.gid = genid "qemu-users"; - users.users.df.extraGroups = [ "qemu-users" ]; environment.etc."qemu/bridge.conf".text = '' allow qemubr0 @@ -53,29 +58,58 @@ with lib; pkgs.vncdotool ]; - krebs.per-user.df.packages = [ - (pkgs.writeDashBin "xu-qemu0" '' - set -efux - img=$HOME/tmp/xu-qemu0.raw - if ! test -e "$img"; then - ${pkgs.coreutils}/bin/mkdir -p "$(${pkgs.coreutils}/bin/dirname "$img")" - ${pkgs.kvm}/bin/qemu-img create "$img" 10G - fi - exec ${pkgs.kvm}/bin/qemu-kvm \ - -monitor stdio \ - -boot order=cd \ - -cdrom ${pkgs.fetchurl { - url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso; - sha256 = "18bc9wrsrjnhj9rya75xliqkl99gxbsk4dmwqivhvwfzb5qb5yp9"; - }} \ - -m 1024 \ - -netdev bridge,br=qemubr0,id=hn0,helper=/var/setuid-wrappers/qemu-bridge-helper \ - -net nic,netdev=hn0,id=nic1,macaddr=52:54:00:12:34:56 \ - -drive file="$img",format=raw \ - -display vnc=:1,websocket=5701,password,lossy \ - -name xu-qemu0 \ - '') - ]; + users.users.xu-qemu0 = { + createHome = true; + group = "qemu-users"; + home = "/home/xu-qemu0"; + uid = genid "xu-qemu0"; + }; + + systemd.services.xu-qemu0 = let + in { + after = [ "network.target" "systemd-resolved.service" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + User = "xu-qemu0"; + SyslogIdentifier = "xu-qemu0"; + ExecStart = pkgs.writeDash "xu-qemu0" '' + set -efu + img=$HOME/tmp/xu-qemu0.raw + if ! test -e "$img"; then + ${pkgs.coreutils}/bin/mkdir -p "$(${pkgs.coreutils}/bin/dirname "$img")" + ${pkgs.kvm}/bin/qemu-img create "$img" 10G + fi + exec ${pkgs.kvm}/bin/qemu-kvm \ + -monitor unix:$HOME/xu-qemu0.sock,server,nowait \ + -boot order=cd \ + -cdrom ${pkgs.fetchurl { + url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso; + sha256 = "18bc9wrsrjnhj9rya75xliqkl99gxbsk4dmwqivhvwfzb5qb5yp9"; + }} \ + -m 1024 \ + -netdev bridge,br=qemubr0,id=hn0,helper=/var/setuid-wrappers/qemu-bridge-helper \ + -net nic,netdev=hn0,id=nic1,macaddr=52:54:00:12:34:56 \ + -drive file="$img",format=raw \ + -display vnc=:1,websocket=5701,password,lossy \ + -name xu-qemu0 \ + ''; + }; + }; + + system.activationScripts."krebs.setuid.xu-qemu0-monitor" = stringAfter [ "setuid" ] '' + src=${pkgs.execve "xu-qemu0-monitor" { + # TODO toC should handle derivation, then we don't have to "${...}" here + filename = "${pkgs.writeDash "xu-qemu0-monitor" '' + exec ${pkgs.socat}/bin/socat \ + stdio \ + UNIX-CONNECT:${config.users.users.xu-qemu0.home}/xu-qemu0.sock \ + ''}"; + }} + dst=${config.security.wrapperDir}/xu-qemu0-monitor + cp "$src" "$dst" + chown xu-qemu0.tv "$dst" + chmod 4710 "$dst" + ''; #TODO krebs.setuid.qemu-bridge-helper = { # filename = "${pkgs.qemu}/libexec/qemu-bridge-helper"; From 450ca1f0cce267e68b4950504140cdbebe1b4b8e Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 20:09:23 +0100 Subject: [PATCH 70/81] xu-qemu0: create socket in ~/tmp --- tv/2configs/xu-qemu0.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix index 4584dcd7c..470b16ea4 100644 --- a/tv/2configs/xu-qemu0.nix +++ b/tv/2configs/xu-qemu0.nix @@ -74,13 +74,13 @@ with lib; SyslogIdentifier = "xu-qemu0"; ExecStart = pkgs.writeDash "xu-qemu0" '' set -efu + ${pkgs.coreutils}/bin/mkdir -p "$HOME/tmp" img=$HOME/tmp/xu-qemu0.raw if ! test -e "$img"; then - ${pkgs.coreutils}/bin/mkdir -p "$(${pkgs.coreutils}/bin/dirname "$img")" ${pkgs.kvm}/bin/qemu-img create "$img" 10G fi exec ${pkgs.kvm}/bin/qemu-kvm \ - -monitor unix:$HOME/xu-qemu0.sock,server,nowait \ + -monitor unix:$HOME/tmp/xu-qemu0.sock,server,nowait \ -boot order=cd \ -cdrom ${pkgs.fetchurl { url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso; @@ -102,7 +102,7 @@ with lib; filename = "${pkgs.writeDash "xu-qemu0-monitor" '' exec ${pkgs.socat}/bin/socat \ stdio \ - UNIX-CONNECT:${config.users.users.xu-qemu0.home}/xu-qemu0.sock \ + UNIX-CONNECT:${config.users.users.xu-qemu0.home}/tmp/xu-qemu0.sock \ ''}"; }} dst=${config.security.wrapperDir}/xu-qemu0-monitor From edd8bc21d33a631e0c9fb12e44e55b68d8f4cdf6 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 20:11:26 +0100 Subject: [PATCH 71/81] xu-qemu0: not wanted by multi-user.target --- tv/2configs/xu-qemu0.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix index 470b16ea4..bc108b4a2 100644 --- a/tv/2configs/xu-qemu0.nix +++ b/tv/2configs/xu-qemu0.nix @@ -68,7 +68,6 @@ with lib; systemd.services.xu-qemu0 = let in { after = [ "network.target" "systemd-resolved.service" ]; - wantedBy = [ "multi-user.target" ]; serviceConfig = { User = "xu-qemu0"; SyslogIdentifier = "xu-qemu0"; From ca246b6994950cf45aeb69e6e2e4c8f40fda7aa2 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 20:16:50 +0100 Subject: [PATCH 72/81] xu-qemu0: disable services.resolved --- tv/2configs/xu-qemu0.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix index bc108b4a2..205b1c011 100644 --- a/tv/2configs/xu-qemu0.nix +++ b/tv/2configs/xu-qemu0.nix @@ -40,6 +40,7 @@ with lib; #}; systemd.network.enable = true; + services.resolved.enable = mkForce false; systemd.network.netdevs.qemubr0 = { netdevConfig = { From 230c8088c8e96a990400533c780b035c8a4102de Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 20:55:38 +0100 Subject: [PATCH 73/81] xu-qemu0: setup qemubr0 address and route --- tv/2configs/xu-qemu0.nix | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-) diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix index 205b1c011..4d39031db 100644 --- a/tv/2configs/xu-qemu0.nix +++ b/tv/2configs/xu-qemu0.nix @@ -15,33 +15,31 @@ in # # make [install] system=xu-qemu0 target_host=10.56.0.101 -# TODO iptables -A INPUT -p udp -m udp --dport bootps -j ACCEPT +# TODO iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # TODO iptables -A FORWARD -i qemubr0 -s 10.56.0.1/24 -m conntrack --ctstate NEW -j ACCEPT # TODO iptables -A POSTROUTING -t nat -j MASQUERADE -# TODO iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT +# TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport bootps -j ACCEPT # TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT # TODO echo 1 > /proc/sys/net/ipv4/ip_forward -# TODO ifconfig qemubr0 10.56.0.1/24 up with lib; { - #networking.wireless.interfaces = [ "wlp3s0" ]; - - #networking.useNetworkd = true; - - #networking.dhcpcd.allowInterfaces = [ - # "qemubr0" - #]; - - #systemd.network.networks.wlp3s0 = { - # matchConfig.name = "wlp3s0"; - # networkConfig.Bridge = "qemubr0"; - #}; + networking.dhcpcd.denyInterfaces = [ "qemubr0" ]; systemd.network.enable = true; services.resolved.enable = mkForce false; + systemd.network.networks.qemubr0 = { + matchConfig.Name = "qemubr0"; + address = ["10.56.0.1/24"]; + routes = [{ + routeConfig = { + Gateway = "*"; + Destination = "10.56.0.0"; + }; + }]; + }; systemd.network.netdevs.qemubr0 = { netdevConfig = { Name = "qemubr0"; From 9a7b7dc5091b0af43fe9d6620f236878f93b3225 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 13 Feb 2016 20:58:27 +0100 Subject: [PATCH 74/81] xu-qemu0: net.ipv4.ip_forward = 1 --- tv/2configs/xu-qemu0.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix index 4d39031db..9962ca56a 100644 --- a/tv/2configs/xu-qemu0.nix +++ b/tv/2configs/xu-qemu0.nix @@ -20,7 +20,6 @@ in # TODO iptables -A POSTROUTING -t nat -j MASQUERADE # TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport bootps -j ACCEPT # TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT -# TODO echo 1 > /proc/sys/net/ipv4/ip_forward with lib; @@ -30,6 +29,8 @@ with lib; systemd.network.enable = true; services.resolved.enable = mkForce false; + boot.kernel.sysctl."net.ipv4.ip_forward" = 1; + systemd.network.networks.qemubr0 = { matchConfig.Name = "qemubr0"; address = ["10.56.0.1/24"]; From c1a9a89c9a211b48bb04f1862a216bb5d444c3a2 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 14 Feb 2016 12:28:56 +0100 Subject: [PATCH 75/81] lib.toC: admit derivations --- krebs/4lib/default.nix | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/krebs/4lib/default.nix b/krebs/4lib/default.nix index 4d7e0b549..d5b6d03ac 100644 --- a/krebs/4lib/default.nix +++ b/krebs/4lib/default.nix @@ -26,11 +26,15 @@ let out = rec { shell = import ./shell.nix { inherit lib; }; tree = import ./tree.nix { inherit lib; }; - toC = x: { + toC = x: let + type = typeOf x; + reject = throw "cannot convert ${type}"; + in { list = "{ ${concatStringsSep ", " (map toC x)} }"; null = "NULL"; + set = if isDerivation x then toJSON x else reject; string = toJSON x; # close enough - }.${typeOf x}; + }.${type} or reject; subdirsOf = path: mapAttrs (name: _: path + "/${name}") From e890eb244af82ba678e894a84983db5057fbb60a Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 14 Feb 2016 13:26:37 +0100 Subject: [PATCH 76/81] krebs.setuid: init --- krebs/3modules/default.nix | 1 + krebs/3modules/setuid.nix | 75 ++++++++++++++++++++++++++++++++++++++ tv/2configs/xu-qemu0.nix | 44 +++++++--------------- 3 files changed, 90 insertions(+), 30 deletions(-) create mode 100644 krebs/3modules/setuid.nix diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 3d51076cf..b2a02e9c7 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -27,6 +27,7 @@ let ./retiolum-bootstrap.nix ./realwallpaper.nix ./retiolum.nix + ./setuid.nix ./tinc_graphs.nix ./urlwatch.nix ]; diff --git a/krebs/3modules/setuid.nix b/krebs/3modules/setuid.nix new file mode 100644 index 000000000..22123c926 --- /dev/null +++ b/krebs/3modules/setuid.nix @@ -0,0 +1,75 @@ +{ config, pkgs, lib, ... }: +with lib; +let + cfg = config.krebs.setuid; + + out = { + options.krebs.setuid = api; + config = imp; + }; + + api = mkOption { + default = {}; + type = let + # TODO make wrapperDir configurable + inherit (config.security) wrapperDir; + inherit (config.users) groups users; + in types.attrsOf (types.submodule ({ config, ... }: { + options = { + name = mkOption { + type = types.filename; + default = config._module.args.name; + }; + filename = mkOption { + type = mkOptionType { + # TODO unyuck string and merge with toC + name = "derivation or string"; + check = x: + isDerivation x || + isString x; + }; + apply = toString; + }; + owner = mkOption { + default = "root"; + type = types.enum (attrNames users); + }; + group = mkOption { + default = "root"; + type = types.enum (attrNames groups); + }; + mode = mkOption { + default = "4710"; + type = mkOptionType { + # TODO admit symbolic mode + name = "octal mode"; + check = x: + isString x && + match "[0-7][0-7][0-7][0-7]" x != null; + }; + }; + activate = mkOption { + type = types.str; + visible = false; + readOnly = true; + }; + }; + config.activate = let + src = pkgs.execve config.name { + inherit (config) filename; + }; + dst = "${wrapperDir}/${config.name}"; + in '' + cp ${src} ${dst} + chown ${config.owner}.${config.group} ${dst} + chmod ${config.mode} ${dst} + ''; + })); + }; + + imp = { + system.activationScripts."krebs.setuid" = stringAfter [ "setuid" ] + (concatMapStringsSep "\n" (getAttr "activate") (attrValues cfg)); + }; + +in out diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix index 9962ca56a..df35f5c3f 100644 --- a/tv/2configs/xu-qemu0.nix +++ b/tv/2configs/xu-qemu0.nix @@ -79,7 +79,7 @@ with lib; ${pkgs.kvm}/bin/qemu-img create "$img" 10G fi exec ${pkgs.kvm}/bin/qemu-kvm \ - -monitor unix:$HOME/tmp/xu-qemu0.sock,server,nowait \ + -monitor unix:$HOME/tmp/xu-qemu0-monitor.sock,server,nowait \ -boot order=cd \ -cdrom ${pkgs.fetchurl { url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso; @@ -95,36 +95,20 @@ with lib; }; }; - system.activationScripts."krebs.setuid.xu-qemu0-monitor" = stringAfter [ "setuid" ] '' - src=${pkgs.execve "xu-qemu0-monitor" { - # TODO toC should handle derivation, then we don't have to "${...}" here - filename = "${pkgs.writeDash "xu-qemu0-monitor" '' - exec ${pkgs.socat}/bin/socat \ - stdio \ - UNIX-CONNECT:${config.users.users.xu-qemu0.home}/tmp/xu-qemu0.sock \ - ''}"; - }} - dst=${config.security.wrapperDir}/xu-qemu0-monitor - cp "$src" "$dst" - chown xu-qemu0.tv "$dst" - chmod 4710 "$dst" - ''; + krebs.setuid.xu-qemu0-monitor = { + filename = pkgs.writeDash "xu-qemu0-monitor" '' + exec ${pkgs.socat}/bin/socat \ + stdio \ + UNIX-CONNECT:${config.users.users.xu-qemu0.home}/tmp/xu-qemu0-monitor.sock \ + ''; + owner = "xu-qemu0"; + group = "tv"; + }; - #TODO krebs.setuid.qemu-bridge-helper = { - # filename = "${pkgs.qemu}/libexec/qemu-bridge-helper"; - # owner = "root"; - # group = "qemu-users"; - # mode = "4710"; - #}; - system.activationScripts."krebs.setuid" = stringAfter [ "setuid" ] '' - src=${pkgs.execve "qemu-bridge-helper" { - filename = "${pkgs.qemu}/libexec/qemu-bridge-helper"; - }} - dst=${config.security.wrapperDir}/qemu-bridge-helper - cp "$src" "$dst" - chown root.qemu-users "$dst" - chmod 4710 "$dst" - ''; + krebs.setuid.qemu-bridge-helper = { + filename = "${pkgs.qemu}/libexec/qemu-bridge-helper"; + group = "qemu-users"; + }; users.users.qemu-dnsmasq.uid = genid "qemu-dnsmasq"; From 6150679d748c1996694011ba20b8c0a27004f955 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 14 Feb 2016 13:27:42 +0100 Subject: [PATCH 77/81] make deploy: --show-trace --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index c7dee134c..e5e3b19d5 100644 --- a/Makefile +++ b/Makefile @@ -24,7 +24,7 @@ execute = \ deploy: $(call execute,populate) ssh $(target_user)@$(target_host) -p $(target_port) \ - nixos-rebuild switch -I $(target_path) + nixos-rebuild switch --show-trace -I $(target_path) # usage: make LOGNAME=shared system=wolf eval.config.krebs.build.host.name eval eval.:;@$(call evaluate) From 9f16d7ea71a2566b973ad0ac603c63ac3c6f4311 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 14 Feb 2016 13:38:47 +0100 Subject: [PATCH 78/81] krebs.lib: init --- default.nix | 2 ++ krebs/3modules/default.nix | 1 + krebs/3modules/lib.nix | 11 +++++++++++ 3 files changed, 14 insertions(+) create mode 100644 krebs/3modules/lib.nix diff --git a/default.nix b/default.nix index 2aa0a8e14..c96d4dd1c 100644 --- a/default.nix +++ b/default.nix @@ -46,6 +46,8 @@ let stockholm = { (map (f: f "5pkgs") [ lib.kpath lib.upath ]) ]); + krebs.lib = lib; + krebs.current.enable = true; krebs.current.host = config.krebs.hosts.${current-host-name}; krebs.current.user = config.krebs.users.${current-user-name}; diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index b2a02e9c7..695562192 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -20,6 +20,7 @@ let ./git.nix ./go.nix ./iptables.nix + ./lib.nix ./nginx.nix ./nixpkgs.nix ./per-user.nix diff --git a/krebs/3modules/lib.nix b/krebs/3modules/lib.nix new file mode 100644 index 000000000..31390a263 --- /dev/null +++ b/krebs/3modules/lib.nix @@ -0,0 +1,11 @@ +{ config, pkgs, lib, ... }: +with lib; +let + out = { + options.krebs.lib = api; + }; + api = mkOption { + default = {}; + type = types.attrs; + }; +in out From 673853e092c211e26a08030f87f9c868c6442a71 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 14 Feb 2016 16:43:44 +0100 Subject: [PATCH 79/81] RIP specialArgs.lib --- krebs/3modules/Reaktor.nix | 4 ++-- krebs/3modules/apt-cacher-ng.nix | 4 ++-- krebs/3modules/backup.nix | 4 ++-- krebs/3modules/bepasty-server.nix | 6 +++--- krebs/3modules/build.nix | 2 +- krebs/3modules/buildbot/master.nix | 4 ++-- krebs/3modules/buildbot/slave.nix | 4 ++-- krebs/3modules/current.nix | 4 ++-- krebs/3modules/default.nix | 18 +++++++++--------- krebs/3modules/exim-retiolum.nix | 4 ++-- krebs/3modules/exim-smarthost.nix | 5 ++--- krebs/3modules/fetchWallpaper.nix | 4 ++-- krebs/3modules/git.nix | 8 ++++---- krebs/3modules/github-hosts-sync.nix | 4 ++-- krebs/3modules/go.nix | 4 ++-- krebs/3modules/lass/default.nix | 4 ++-- krebs/3modules/makefu/default.nix | 4 ++-- krebs/3modules/miefda/default.nix | 4 ++-- krebs/3modules/mv/default.nix | 4 ++-- krebs/3modules/nginx.nix | 7 +++---- krebs/3modules/nixpkgs.nix | 8 ++++---- krebs/3modules/per-user.nix | 2 +- krebs/3modules/realwallpaper.nix | 6 +++--- krebs/3modules/retiolum-bootstrap.nix | 4 ++-- krebs/3modules/retiolum.nix | 4 ++-- krebs/3modules/setuid.nix | 2 +- krebs/3modules/shared/default.nix | 7 +++---- krebs/3modules/tinc_graphs.nix | 4 ++-- krebs/3modules/tv/default.nix | 4 ++-- krebs/3modules/urlwatch.nix | 4 ++-- krebs/5pkgs/builders.nix | 4 ++-- krebs/5pkgs/default.nix | 4 ++-- lass/2configs/base.nix | 2 +- lass/2configs/downloading.nix | 2 +- lass/2configs/fastpoke-pages.nix | 2 +- lass/2configs/git.nix | 2 +- lass/2configs/go.nix | 2 +- lass/2configs/teamviewer.nix | 2 +- lass/2configs/xserver/Xresources.nix | 2 +- lass/2configs/xserver/default.nix | 2 +- lass/2configs/xserver/xserver.conf.nix | 2 +- lass/3modules/dnsmasq.nix | 3 +-- lass/3modules/newsbot-js.nix | 3 +-- lass/3modules/owncloud_nginx.nix | 2 +- lass/3modules/per-user.nix | 3 +-- lass/3modules/static_nginx.nix | 2 +- lass/3modules/urxvtd.nix | 3 +-- lass/3modules/wordpress_nginx.nix | 2 +- lass/3modules/xresources.nix | 3 +-- makefu/1systems/gum.nix | 2 +- makefu/1systems/wry.nix | 2 +- makefu/2configs/backup.nix | 2 +- makefu/2configs/base-gui.nix | 2 +- makefu/2configs/bepasty-dual.nix | 2 +- makefu/2configs/collectd/collectd-base.nix | 2 +- makefu/2configs/default.nix | 2 +- makefu/2configs/exim-retiolum.nix | 2 +- makefu/2configs/fs/cac-boot-partition.nix | 2 +- makefu/2configs/fs/sda-crypto-root-home.nix | 2 +- makefu/2configs/fs/sda-crypto-root.nix | 2 +- makefu/2configs/fs/vm-single-partition.nix | 2 +- makefu/2configs/git/brain-retiolum.nix | 2 +- makefu/2configs/git/cgit-retiolum.nix | 2 +- makefu/2configs/graphite-standalone.nix | 2 +- makefu/2configs/hw/tp-x200.nix | 2 +- makefu/2configs/hw/tp-x220.nix | 2 +- makefu/2configs/hw/tp-x2x0.nix | 2 +- makefu/2configs/mail-client.nix | 2 +- makefu/2configs/main-laptop.nix | 2 +- makefu/2configs/mattermost-docker.nix | 2 +- makefu/2configs/nginx/euer.blog.nix | 2 +- makefu/2configs/nginx/euer.test.nix | 2 +- makefu/2configs/nginx/euer.wiki.nix | 2 +- makefu/2configs/nginx/update.connector.one.nix | 2 +- makefu/2configs/omo-share.nix | 2 +- makefu/2configs/tinc-basic-retiolum.nix | 2 +- makefu/2configs/zsh-user.nix | 2 +- makefu/3modules/snapraid.nix | 2 +- makefu/3modules/umts.nix | 2 +- miefda/2configs/git.nix | 2 +- miefda/2configs/miefda.nix | 2 +- miefda/2configs/tinc-basic-retiolum.nix | 2 +- miefda/2configs/tlp.nix | 2 +- miefda/2configs/x220t.nix | 2 +- mv/1systems/stro.nix | 2 +- mv/2configs/default.nix | 2 +- mv/2configs/git.nix | 2 +- mv/2configs/vim.nix | 4 ++-- mv/2configs/xserver/Xresources.nix | 2 +- mv/2configs/xserver/default.nix | 2 +- mv/2configs/xserver/xserver.conf.nix | 2 +- mv/3modules/iptables.nix | 5 ++--- shared/2configs/base.nix | 2 +- shared/2configs/cgit-mirror.nix | 2 +- shared/2configs/collectd-base.nix | 2 +- shared/2configs/graphite.nix | 2 +- tv/1systems/cd.nix | 2 +- tv/1systems/mkdir.nix | 2 +- tv/1systems/nomic.nix | 2 +- tv/1systems/rmdir.nix | 2 +- tv/1systems/wu.nix | 2 +- tv/1systems/xu.nix | 2 +- tv/2configs/backup.nix | 2 +- tv/2configs/charybdis.nix | 5 ++--- tv/2configs/default.nix | 2 +- tv/2configs/exim-retiolum.nix | 4 ++-- tv/2configs/exim-smarthost.nix | 2 +- tv/2configs/git.nix | 2 +- tv/2configs/hw/AO753.nix | 2 +- tv/2configs/nginx-public_html.nix | 4 ++-- tv/2configs/pulse.nix | 2 +- tv/2configs/retiolum.nix | 2 +- tv/2configs/vim.nix | 4 ++-- tv/2configs/xserver/Xresources.nix | 2 +- tv/2configs/xserver/default.nix | 2 +- tv/2configs/xserver/xserver.conf.nix | 2 +- tv/2configs/xu-qemu0.nix | 2 +- tv/3modules/ejabberd.nix | 5 ++--- tv/3modules/iptables.nix | 5 ++--- 119 files changed, 171 insertions(+), 183 deletions(-) diff --git a/krebs/3modules/Reaktor.nix b/krebs/3modules/Reaktor.nix index 92400139c..d58661a28 100644 --- a/krebs/3modules/Reaktor.nix +++ b/krebs/3modules/Reaktor.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let ReaktorConfig = pkgs.writeText "config.py" '' @@ -16,7 +16,7 @@ let out = { options.krebs.Reaktor = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/apt-cacher-ng.nix b/krebs/3modules/apt-cacher-ng.nix index 371d39b6f..46b405842 100644 --- a/krebs/3modules/apt-cacher-ng.nix +++ b/krebs/3modules/apt-cacher-ng.nix @@ -1,6 +1,6 @@ { config, pkgs, lib, ... }: -with lib; +with config.krebs.lib; let acng-config = pkgs.writeTextFile { name = "acng-configuration"; @@ -151,5 +151,5 @@ let in { options.krebs.apt-cacher-ng = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; } diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix index 66a325ed9..5e1a1597b 100644 --- a/krebs/3modules/backup.nix +++ b/krebs/3modules/backup.nix @@ -1,9 +1,9 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let out = { options.krebs.backup = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; cfg = config.krebs.backup; diff --git a/krebs/3modules/bepasty-server.nix b/krebs/3modules/bepasty-server.nix index e74841205..9e777a5ef 100644 --- a/krebs/3modules/bepasty-server.nix +++ b/krebs/3modules/bepasty-server.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let gunicorn = pkgs.pythonPackages.gunicorn; bepasty = pkgs.pythonPackages.bepasty-server; @@ -10,8 +10,8 @@ let out = { options.krebs.bepasty = api; - config = mkIf cfg.enable (mkMerge [ - (mkIf cfg.serveNginx nginx-imp) + config = lib.mkIf cfg.enable (lib.mkMerge [ + (lib.mkIf cfg.serveNginx nginx-imp) imp ]); }; diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix index 1569072d1..a1f446188 100644 --- a/krebs/3modules/build.nix +++ b/krebs/3modules/build.nix @@ -1,6 +1,6 @@ { config, lib, ... }: -with lib; +with config.krebs.lib; let out = { diff --git a/krebs/3modules/buildbot/master.nix b/krebs/3modules/buildbot/master.nix index 74385a433..825cb3413 100644 --- a/krebs/3modules/buildbot/master.nix +++ b/krebs/3modules/buildbot/master.nix @@ -1,6 +1,6 @@ { config, pkgs, lib, ... }: -with lib; +with config.krebs.lib; let buildbot = pkgs.buildbot; buildbot-master-config = pkgs.writeText "buildbot-master.cfg" '' @@ -381,5 +381,5 @@ let in { options.krebs.buildbot.master = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; } diff --git a/krebs/3modules/buildbot/slave.nix b/krebs/3modules/buildbot/slave.nix index 0e7796d8a..7705ac31c 100644 --- a/krebs/3modules/buildbot/slave.nix +++ b/krebs/3modules/buildbot/slave.nix @@ -1,6 +1,6 @@ { config, pkgs, lib, ... }: -with lib; +with config.krebs.lib; let buildbot-slave-init = pkgs.writeText "buildbot-slave.tac" '' import os @@ -182,5 +182,5 @@ let in { options.krebs.buildbot.slave = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; } diff --git a/krebs/3modules/current.nix b/krebs/3modules/current.nix index 41941e289..9f63e33ac 100644 --- a/krebs/3modules/current.nix +++ b/krebs/3modules/current.nix @@ -1,13 +1,13 @@ { config, pkgs, lib, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.current; out = { options.krebs.current = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 695562192..23f82ed1c 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -1,6 +1,6 @@ { config, lib, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs; @@ -33,7 +33,7 @@ let ./urlwatch.nix ]; options.krebs = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { @@ -84,13 +84,13 @@ let }; }; - imp = mkMerge [ - { krebs = import ./lass { inherit lib; }; } - { krebs = import ./makefu { inherit lib; }; } - { krebs = import ./miefda { inherit lib; }; } - { krebs = import ./mv { inherit lib; }; } - { krebs = import ./shared { inherit lib; }; } - { krebs = import ./tv { inherit lib; }; } + imp = lib.mkMerge [ + { krebs = import ./lass { inherit config lib; }; } + { krebs = import ./makefu { inherit config lib; }; } + { krebs = import ./miefda { inherit config lib; }; } + { krebs = import ./mv { inherit config lib; }; } + { krebs = import ./shared { inherit config lib; }; } + { krebs = import ./tv { inherit config lib; }; } { krebs.dns.providers = { de.krebsco = "zones"; diff --git a/krebs/3modules/exim-retiolum.nix b/krebs/3modules/exim-retiolum.nix index ea012c38c..1722eef1f 100644 --- a/krebs/3modules/exim-retiolum.nix +++ b/krebs/3modules/exim-retiolum.nix @@ -1,12 +1,12 @@ { config, pkgs, lib, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.exim-retiolum; out = { options.krebs.exim-retiolum = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix index a564430ea..267ee2900 100644 --- a/krebs/3modules/exim-smarthost.nix +++ b/krebs/3modules/exim-smarthost.nix @@ -1,13 +1,12 @@ { config, pkgs, lib, ... }: -with builtins; -with lib; +with config.krebs.lib; let cfg = config.krebs.exim-smarthost; out = { options.krebs.exim-smarthost = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/fetchWallpaper.nix b/krebs/3modules/fetchWallpaper.nix index 225f00803..53fe0839d 100644 --- a/krebs/3modules/fetchWallpaper.nix +++ b/krebs/3modules/fetchWallpaper.nix @@ -1,13 +1,13 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.fetchWallpaper; out = { options.krebs.fetchWallpaper = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix index 11cf21b5f..a9542718d 100644 --- a/krebs/3modules/git.nix +++ b/krebs/3modules/git.nix @@ -1,4 +1,4 @@ -{ config, pkgs, lib, ... }: +{ config, lib, pkgs, ... }: # TODO unify logging of shell scripts to user and journal # TODO move all scripts to ${etcDir}, so ControlMaster connections @@ -6,13 +6,13 @@ # TODO when authorized_keys changes, then restart ssh # (or kill already connected users somehow) -with lib; +with config.krebs.lib; let cfg = config.krebs.git; out = { options.krebs.git = api; - config = mkIf cfg.enable (mkMerge [ + config = with lib; mkIf cfg.enable (mkMerge [ (mkIf cfg.cgit cgit-imp) git-imp ]); @@ -86,7 +86,7 @@ let singleton { user = [ config.krebs.users.tv ]; repo = [ testing ]; # see literal example of repos - perm = push "refs/*" (with lib.git; [ + perm = push "refs/*" (with config.krebs.lib.git; [ non-fast-forward create delete merge ]); } diff --git a/krebs/3modules/github-hosts-sync.nix b/krebs/3modules/github-hosts-sync.nix index 2aa18d53a..1d3873232 100644 --- a/krebs/3modules/github-hosts-sync.nix +++ b/krebs/3modules/github-hosts-sync.nix @@ -1,12 +1,12 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.github-hosts-sync; out = { options.krebs.github-hosts-sync = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/go.nix b/krebs/3modules/go.nix index 08a93dab7..52a104bb9 100644 --- a/krebs/3modules/go.nix +++ b/krebs/3modules/go.nix @@ -1,13 +1,13 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.go; out = { options.krebs.go = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index 749d3ff49..41a609105 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -1,6 +1,6 @@ -{ lib, ... }: +{ config, lib, ... }: -with lib; +with config.krebs.lib; { hosts = { diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix index d21c80e78..ca83d6906 100644 --- a/krebs/3modules/makefu/default.nix +++ b/krebs/3modules/makefu/default.nix @@ -1,6 +1,6 @@ -{ lib, ... }: +{ config, lib, ... }: -with lib; +with config.krebs.lib; { hosts = { diff --git a/krebs/3modules/miefda/default.nix b/krebs/3modules/miefda/default.nix index 0cfa8bd27..6587ad92d 100644 --- a/krebs/3modules/miefda/default.nix +++ b/krebs/3modules/miefda/default.nix @@ -1,6 +1,6 @@ -{ lib, ... }: +{ config, lib, ... }: -with lib; +with config.krebs.lib; { hosts = { diff --git a/krebs/3modules/mv/default.nix b/krebs/3modules/mv/default.nix index 8803cb249..33f941aae 100644 --- a/krebs/3modules/mv/default.nix +++ b/krebs/3modules/mv/default.nix @@ -1,6 +1,6 @@ -{ lib, ... }: +{ config, ... }: -with lib; +with config.krebs.lib; { hosts = { diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix index 5bc0903e4..7b7163071 100644 --- a/krebs/3modules/nginx.nix +++ b/krebs/3modules/nginx.nix @@ -1,13 +1,12 @@ -{ config, pkgs, lib, ... }: +{ config, lib, pkgs, ... }: -with builtins; -with lib; +with config.krebs.lib; let cfg = config.krebs.nginx; out = { options.krebs.nginx = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/nixpkgs.nix b/krebs/3modules/nixpkgs.nix index 4129f9483..5816b8a30 100644 --- a/krebs/3modules/nixpkgs.nix +++ b/krebs/3modules/nixpkgs.nix @@ -1,11 +1,11 @@ -{ config, pkgs, lib, ... }: -with lib; +{ config, lib, pkgs, ... }: +with config.krebs.lib; let cfg = config.krebs.nixpkgs; out = { options.krebs.nixpkgs = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { @@ -37,7 +37,7 @@ let }; }; - imp = mkIf (cfg.allowUnfreePredicate != null) { + imp = lib.mkIf (cfg.allowUnfreePredicate != null) { nixpkgs.config.allowUnfreePredicate = cfg.allowUnfreePredicate; }; in out diff --git a/krebs/3modules/per-user.nix b/krebs/3modules/per-user.nix index ee213deda..13da5c4c3 100644 --- a/krebs/3modules/per-user.nix +++ b/krebs/3modules/per-user.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.per-user; diff --git a/krebs/3modules/realwallpaper.nix b/krebs/3modules/realwallpaper.nix index b377368f7..df374e184 100644 --- a/krebs/3modules/realwallpaper.nix +++ b/krebs/3modules/realwallpaper.nix @@ -1,12 +1,12 @@ -arg@{ config, lib, pkgs, ... }: +{ config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.realwallpaper; out = { options.krebs.realwallpaper = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix index 65bb51193..40382d098 100644 --- a/krebs/3modules/retiolum-bootstrap.nix +++ b/krebs/3modules/retiolum-bootstrap.nix @@ -1,12 +1,12 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.retiolum-bootstrap; out = { options.krebs.retiolum-bootstrap = api; - config = mkIf cfg.enable imp ; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/retiolum.nix b/krebs/3modules/retiolum.nix index 407695273..d0162eae9 100644 --- a/krebs/3modules/retiolum.nix +++ b/krebs/3modules/retiolum.nix @@ -1,11 +1,11 @@ { config, pkgs, lib, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.retiolum; out = { options.krebs.retiolum = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/3modules/setuid.nix b/krebs/3modules/setuid.nix index 22123c926..1137788d8 100644 --- a/krebs/3modules/setuid.nix +++ b/krebs/3modules/setuid.nix @@ -1,5 +1,5 @@ { config, pkgs, lib, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.setuid; diff --git a/krebs/3modules/shared/default.nix b/krebs/3modules/shared/default.nix index df4c529bf..208b596f8 100644 --- a/krebs/3modules/shared/default.nix +++ b/krebs/3modules/shared/default.nix @@ -1,9 +1,8 @@ -{ lib, ... }: - -with lib; +{ config, ... }: +with config.krebs.lib; let - testHosts = lib.genAttrs [ + testHosts = genAttrs [ "test-arch" "test-centos6" "test-centos7" diff --git a/krebs/3modules/tinc_graphs.nix b/krebs/3modules/tinc_graphs.nix index dc0484a8b..2692de982 100644 --- a/krebs/3modules/tinc_graphs.nix +++ b/krebs/3modules/tinc_graphs.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.krebs.tinc_graphs; internal_dir = "${cfg.workingDir}/internal"; @@ -8,7 +8,7 @@ let out = { options.krebs.tinc_graphs = api; - config = mkIf cfg.enable imp ; + config = lib.mkIf cfg.enable imp ; }; api = { diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index 9a0b99396..f8d3d8671 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -1,6 +1,6 @@ -{ lib, ... }: +{ config, ... }: -with lib; +with config.krebs.lib; { dns.providers = { diff --git a/krebs/3modules/urlwatch.nix b/krebs/3modules/urlwatch.nix index 7a9fb55fd..cd4976a21 100644 --- a/krebs/3modules/urlwatch.nix +++ b/krebs/3modules/urlwatch.nix @@ -5,14 +5,14 @@ # cache = url: "${cfg.dataDir}/.urlwatch/cache/${hashString "sha1" url}" # TODO hooks.py -with lib; +with config.krebs.lib; let cfg = config.krebs.urlwatch; # TODO assert sendmail's existence out = { options.krebs.urlwatch = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/krebs/5pkgs/builders.nix b/krebs/5pkgs/builders.nix index 43707aeca..fa51857ba 100644 --- a/krebs/5pkgs/builders.nix +++ b/krebs/5pkgs/builders.nix @@ -1,5 +1,5 @@ -{ lib, pkgs, ... }: -with lib; +{ config, lib, pkgs, ... }: +with config.krebs.lib; rec { execve = name: { filename, argv ? null, envp ? {}, destination ? "" }: let in writeC name { inherit destination; } '' diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix index 1cf3de56e..d395fe00a 100644 --- a/krebs/5pkgs/default.nix +++ b/krebs/5pkgs/default.nix @@ -1,5 +1,5 @@ -{ lib, pkgs, ... }@args: -with lib; +{ config, lib, pkgs, ... }@args: +with config.krebs.lib; { nixpkgs.config.packageOverrides = pkgs: { haskellPackages = pkgs.haskellPackages.override { diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix index 4c73fc0ce..68103c3ef 100644 --- a/lass/2configs/base.nix +++ b/lass/2configs/base.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { imports = [ ../2configs/vim.nix diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix index e80b74007..115cb8b61 100644 --- a/lass/2configs/downloading.nix +++ b/lass/2configs/downloading.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let rpc-password = import ; diff --git a/lass/2configs/fastpoke-pages.nix b/lass/2configs/fastpoke-pages.nix index 0470865b6..bf6ea8952 100644 --- a/lass/2configs/fastpoke-pages.nix +++ b/lass/2configs/fastpoke-pages.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let createStaticPage = domain: diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix index ac6aae44f..76b897d1f 100644 --- a/lass/2configs/git.nix +++ b/lass/2configs/git.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let diff --git a/lass/2configs/go.nix b/lass/2configs/go.nix index f4c2ac289..795ad7a26 100644 --- a/lass/2configs/go.nix +++ b/lass/2configs/go.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { environment.systemPackages = [ pkgs.go diff --git a/lass/2configs/teamviewer.nix b/lass/2configs/teamviewer.nix index 48053d7db..22bfb18d8 100644 --- a/lass/2configs/teamviewer.nix +++ b/lass/2configs/teamviewer.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { services.teamviewer.enable = true; } diff --git a/lass/2configs/xserver/Xresources.nix b/lass/2configs/xserver/Xresources.nix index d52418897..e3b0f45dc 100644 --- a/lass/2configs/xserver/Xresources.nix +++ b/lass/2configs/xserver/Xresources.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; pkgs.writeText "Xresources" '' URxvt*scrollBar: false diff --git a/lass/2configs/xserver/default.nix b/lass/2configs/xserver/default.nix index c407bb59e..82cfd57bb 100644 --- a/lass/2configs/xserver/default.nix +++ b/lass/2configs/xserver/default.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }@args: -with lib; +with config.krebs.lib; let # TODO krebs.build.user diff --git a/lass/2configs/xserver/xserver.conf.nix b/lass/2configs/xserver/xserver.conf.nix index e8a997a99..c452b4226 100644 --- a/lass/2configs/xserver/xserver.conf.nix +++ b/lass/2configs/xserver/xserver.conf.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.services.xserver; diff --git a/lass/3modules/dnsmasq.nix b/lass/3modules/dnsmasq.nix index 83a9cb180..c05ad0fc9 100644 --- a/lass/3modules/dnsmasq.nix +++ b/lass/3modules/dnsmasq.nix @@ -1,7 +1,6 @@ { config, lib, pkgs, ... }: -with builtins; -with lib; +with config.krebs.lib; let cfg = config.lass.dnsmasq; diff --git a/lass/3modules/newsbot-js.nix b/lass/3modules/newsbot-js.nix index 5e340b26f..ef4d97b76 100644 --- a/lass/3modules/newsbot-js.nix +++ b/lass/3modules/newsbot-js.nix @@ -1,7 +1,6 @@ { config, lib, pkgs, ... }: -with builtins; -with lib; +with config.krebs.lib; let cfg = config.lass.newsbot-js; diff --git a/lass/3modules/owncloud_nginx.nix b/lass/3modules/owncloud_nginx.nix index 79c9de1d4..a10df779e 100644 --- a/lass/3modules/owncloud_nginx.nix +++ b/lass/3modules/owncloud_nginx.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.lass.owncloud; diff --git a/lass/3modules/per-user.nix b/lass/3modules/per-user.nix index 98d6339db..f8d357ce2 100644 --- a/lass/3modules/per-user.nix +++ b/lass/3modules/per-user.nix @@ -1,7 +1,6 @@ { config, lib, pkgs, ... }: -with builtins; -with lib; +with config.krebs.lib; let cfg = config.lass.per-user; diff --git a/lass/3modules/static_nginx.nix b/lass/3modules/static_nginx.nix index fd5cfdfd7..93441cf0d 100644 --- a/lass/3modules/static_nginx.nix +++ b/lass/3modules/static_nginx.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.lass.staticPage; diff --git a/lass/3modules/urxvtd.nix b/lass/3modules/urxvtd.nix index 469616a9f..1eb463955 100644 --- a/lass/3modules/urxvtd.nix +++ b/lass/3modules/urxvtd.nix @@ -3,8 +3,7 @@ let in -with builtins; -with lib; +with config.krebs.lib; { options = { diff --git a/lass/3modules/wordpress_nginx.nix b/lass/3modules/wordpress_nginx.nix index bfed9e7c6..108054cb6 100644 --- a/lass/3modules/wordpress_nginx.nix +++ b/lass/3modules/wordpress_nginx.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.lass.wordpress; diff --git a/lass/3modules/xresources.nix b/lass/3modules/xresources.nix index 074963022..729eccecc 100644 --- a/lass/3modules/xresources.nix +++ b/lass/3modules/xresources.nix @@ -6,8 +6,7 @@ # # -with builtins; -with lib; +with config.krebs.lib; let diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix index fe800f251..43fc8109d 100644 --- a/makefu/1systems/gum.nix +++ b/makefu/1systems/gum.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let external-ip = head config.krebs.build.host.nets.internet.addrs4; internal-ip = head config.krebs.build.host.nets.retiolum.addrs4; diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix index f022311c9..41d207ed2 100644 --- a/makefu/1systems/wry.nix +++ b/makefu/1systems/wry.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let external-ip = head config.krebs.build.host.nets.internet.addrs4; diff --git a/makefu/2configs/backup.nix b/makefu/2configs/backup.nix index 936f31c1c..6f79ed4f4 100644 --- a/makefu/2configs/backup.nix +++ b/makefu/2configs/backup.nix @@ -1,5 +1,5 @@ { config, lib, ... }: -with lib; +with config.krebs.lib; let startAt = "0,6,12,18:00"; defaultBackupServer = config.krebs.hosts.omo; diff --git a/makefu/2configs/base-gui.nix b/makefu/2configs/base-gui.nix index da3ad4afe..341a2ab20 100644 --- a/makefu/2configs/base-gui.nix +++ b/makefu/2configs/base-gui.nix @@ -21,7 +21,7 @@ # URxvt.visualBell: false # URxvt.font : xft:Terminus -with lib; +with config.krebs.lib; let mainUser = config.krebs.build.user.name; awesomecfg = pkgs.awesomecfg.full; diff --git a/makefu/2configs/bepasty-dual.nix b/makefu/2configs/bepasty-dual.nix index 123ae3cf9..5682f5eb6 100644 --- a/makefu/2configs/bepasty-dual.nix +++ b/makefu/2configs/bepasty-dual.nix @@ -10,7 +10,7 @@ # wildcard.krebsco.de.key # bepasty-secret.nix <- contains single string -with lib; +with config.krebs.lib; let sec = toString ; # secKey is nothing worth protecting on a local machine diff --git a/makefu/2configs/collectd/collectd-base.nix b/makefu/2configs/collectd/collectd-base.nix index 7909c1be5..c739368ca 100644 --- a/makefu/2configs/collectd/collectd-base.nix +++ b/makefu/2configs/collectd/collectd-base.nix @@ -2,7 +2,7 @@ # graphite-web on port 8080 # carbon cache on port 2003 (tcp/udp) -with lib; +with config.krebs.lib; let connect-time-cfg = with pkgs; writeText "collectd-connect-time.cfg" '' LoadPlugin python diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix index 5acc7f0a5..c35bfc173 100644 --- a/makefu/2configs/default.nix +++ b/makefu/2configs/default.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { system.stateVersion = "15.09"; diff --git a/makefu/2configs/exim-retiolum.nix b/makefu/2configs/exim-retiolum.nix index b8c5c5236..34943f593 100644 --- a/makefu/2configs/exim-retiolum.nix +++ b/makefu/2configs/exim-retiolum.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.exim-retiolum.enable = true; environment.systemPackages = with pkgs; [ diff --git a/makefu/2configs/fs/cac-boot-partition.nix b/makefu/2configs/fs/cac-boot-partition.nix index cec004582..bf08504d5 100644 --- a/makefu/2configs/fs/cac-boot-partition.nix +++ b/makefu/2configs/fs/cac-boot-partition.nix @@ -1,7 +1,7 @@ { config, lib, pkgs, ... }: # vda1 ext4 (label nixos) -> only root partition -with lib; +with config.krebs.lib; { boot.loader.grub.enable = true; boot.loader.grub.version = 2; diff --git a/makefu/2configs/fs/sda-crypto-root-home.nix b/makefu/2configs/fs/sda-crypto-root-home.nix index cc2133a49..5214cf872 100644 --- a/makefu/2configs/fs/sda-crypto-root-home.nix +++ b/makefu/2configs/fs/sda-crypto-root-home.nix @@ -8,7 +8,7 @@ # / (main-root) # /home (main-home) -with lib; +with config.krebs.lib; { imports = [ diff --git a/makefu/2configs/fs/sda-crypto-root.nix b/makefu/2configs/fs/sda-crypto-root.nix index 2bfe26960..e9d7b755a 100644 --- a/makefu/2configs/fs/sda-crypto-root.nix +++ b/makefu/2configs/fs/sda-crypto-root.nix @@ -3,7 +3,7 @@ # sda: bootloader grub2 # sda1: boot ext4 (label nixboot) # sda2: cryptoluks -> ext4 -with lib; +with config.krebs.lib; { boot = { loader.grub.enable = true; diff --git a/makefu/2configs/fs/vm-single-partition.nix b/makefu/2configs/fs/vm-single-partition.nix index 27e28cb68..88f209597 100644 --- a/makefu/2configs/fs/vm-single-partition.nix +++ b/makefu/2configs/fs/vm-single-partition.nix @@ -1,7 +1,7 @@ { config, lib, pkgs, ... }: # vda1 ext4 (label nixos) -> only root partition -with lib; +with config.krebs.lib; { imports = [ ./single-partition-ext4.nix diff --git a/makefu/2configs/git/brain-retiolum.nix b/makefu/2configs/git/brain-retiolum.nix index 25ef584bf..58fd250e5 100644 --- a/makefu/2configs/git/brain-retiolum.nix +++ b/makefu/2configs/git/brain-retiolum.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: # TODO: remove tv lib :) -with lib; +with config.krebs.lib; let repos = priv-repos // krebs-repos ; diff --git a/makefu/2configs/git/cgit-retiolum.nix b/makefu/2configs/git/cgit-retiolum.nix index 7d85eb8d1..a488d98f2 100644 --- a/makefu/2configs/git/cgit-retiolum.nix +++ b/makefu/2configs/git/cgit-retiolum.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: # TODO: remove tv lib :) -with lib; +with config.krebs.lib; let repos = priv-repos // krebs-repos // connector-repos ; diff --git a/makefu/2configs/graphite-standalone.nix b/makefu/2configs/graphite-standalone.nix index 8b70c11c8..dd5438e8d 100644 --- a/makefu/2configs/graphite-standalone.nix +++ b/makefu/2configs/graphite-standalone.nix @@ -2,7 +2,7 @@ # graphite-web on port 8080 # carbon cache on port 2003 (tcp/udp) -with lib; +with config.krebs.lib; { imports = [ ]; diff --git a/makefu/2configs/hw/tp-x200.nix b/makefu/2configs/hw/tp-x200.nix index ed46875d8..f17ac74a6 100644 --- a/makefu/2configs/hw/tp-x200.nix +++ b/makefu/2configs/hw/tp-x200.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { imports = [ ./tp-x2x0.nix ]; diff --git a/makefu/2configs/hw/tp-x220.nix b/makefu/2configs/hw/tp-x220.nix index 0c90e6fde..0a471bde0 100644 --- a/makefu/2configs/hw/tp-x220.nix +++ b/makefu/2configs/hw/tp-x220.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { imports = [ ./tp-x2x0.nix ]; diff --git a/makefu/2configs/hw/tp-x2x0.nix b/makefu/2configs/hw/tp-x2x0.nix index 1033f69c0..892be07b8 100644 --- a/makefu/2configs/hw/tp-x2x0.nix +++ b/makefu/2configs/hw/tp-x2x0.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { # TODO: put this somewhere else networking.wireless.enable = true; diff --git a/makefu/2configs/mail-client.nix b/makefu/2configs/mail-client.nix index bda21e9d0..913cbf25b 100644 --- a/makefu/2configs/mail-client.nix +++ b/makefu/2configs/mail-client.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { environment.systemPackages = with pkgs; [ msmtp diff --git a/makefu/2configs/main-laptop.nix b/makefu/2configs/main-laptop.nix index 32f194e6b..c3e43723c 100644 --- a/makefu/2configs/main-laptop.nix +++ b/makefu/2configs/main-laptop.nix @@ -5,7 +5,7 @@ # not fit into base-gui # TODO split generic desktop stuff and laptop-specifics like lidswitching -with lib; +with config.krebs.lib; { imports = [ ./base-gui.nix diff --git a/makefu/2configs/mattermost-docker.nix b/makefu/2configs/mattermost-docker.nix index 20a93dff1..e679a3d91 100644 --- a/makefu/2configs/mattermost-docker.nix +++ b/makefu/2configs/mattermost-docker.nix @@ -1,6 +1,6 @@ {config, lib, ...}: -with lib; +with config.krebs.lib; let sec = toString ; ssl_cert = "${sec}/wildcard.krebsco.de.crt"; diff --git a/makefu/2configs/nginx/euer.blog.nix b/makefu/2configs/nginx/euer.blog.nix index c6724c617..9d08f4b9a 100644 --- a/makefu/2configs/nginx/euer.blog.nix +++ b/makefu/2configs/nginx/euer.blog.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let sec = toString ; ssl_cert = "${sec}/wildcard.krebsco.de.crt"; diff --git a/makefu/2configs/nginx/euer.test.nix b/makefu/2configs/nginx/euer.test.nix index ffdc0bc60..f7214e613 100644 --- a/makefu/2configs/nginx/euer.test.nix +++ b/makefu/2configs/nginx/euer.test.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let hostname = config.krebs.build.host.name; user = config.services.nginx.user; diff --git a/makefu/2configs/nginx/euer.wiki.nix b/makefu/2configs/nginx/euer.wiki.nix index 2b5fa6ead..a5572a519 100644 --- a/makefu/2configs/nginx/euer.wiki.nix +++ b/makefu/2configs/nginx/euer.wiki.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let sec = toString ; ssl_cert = "${sec}/wildcard.krebsco.de.crt"; diff --git a/makefu/2configs/nginx/update.connector.one.nix b/makefu/2configs/nginx/update.connector.one.nix index eb39a1668..044a14075 100644 --- a/makefu/2configs/nginx/update.connector.one.nix +++ b/makefu/2configs/nginx/update.connector.one.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let hostname = config.krebs.build.host.name; external-ip = head config.krebs.build.host.nets.internet.addrs4; diff --git a/makefu/2configs/omo-share.nix b/makefu/2configs/omo-share.nix index 1e0975e1d..a9640b38b 100644 --- a/makefu/2configs/omo-share.nix +++ b/makefu/2configs/omo-share.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let hostname = config.krebs.build.host.name; # TODO local-ip from the nets config diff --git a/makefu/2configs/tinc-basic-retiolum.nix b/makefu/2configs/tinc-basic-retiolum.nix index f49c596fc..12d3b8b7c 100644 --- a/makefu/2configs/tinc-basic-retiolum.nix +++ b/makefu/2configs/tinc-basic-retiolum.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.retiolum = { enable = true; diff --git a/makefu/2configs/zsh-user.nix b/makefu/2configs/zsh-user.nix index f79f258f3..9527ead1a 100644 --- a/makefu/2configs/zsh-user.nix +++ b/makefu/2configs/zsh-user.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: ## -with lib; +with config.krebs.lib; let mainUser = config.krebs.build.user.name; in diff --git a/makefu/3modules/snapraid.nix b/makefu/3modules/snapraid.nix index fbdf50219..4a0363e6a 100644 --- a/makefu/3modules/snapraid.nix +++ b/makefu/3modules/snapraid.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let # returns dirname without / , used as disk name diff --git a/makefu/3modules/umts.nix b/makefu/3modules/umts.nix index 1bf3ba0b5..7e0e5dada 100644 --- a/makefu/3modules/umts.nix +++ b/makefu/3modules/umts.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let # TODO: currently it is only netzclub diff --git a/miefda/2configs/git.nix b/miefda/2configs/git.nix index fec828f80..052cc4ab2 100644 --- a/miefda/2configs/git.nix +++ b/miefda/2configs/git.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let diff --git a/miefda/2configs/miefda.nix b/miefda/2configs/miefda.nix index 545987a68..f17e8aa34 100644 --- a/miefda/2configs/miefda.nix +++ b/miefda/2configs/miefda.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { #networking.wicd.enable = true; diff --git a/miefda/2configs/tinc-basic-retiolum.nix b/miefda/2configs/tinc-basic-retiolum.nix index b31fe15af..f82fd6b03 100644 --- a/miefda/2configs/tinc-basic-retiolum.nix +++ b/miefda/2configs/tinc-basic-retiolum.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.retiolum = { enable = true; diff --git a/miefda/2configs/tlp.nix b/miefda/2configs/tlp.nix index 0e1bb0d6b..32f4f2ee7 100644 --- a/miefda/2configs/tlp.nix +++ b/miefda/2configs/tlp.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { hardware.enableAllFirmware = true; nixpkgs.config.allowUnfree = true; diff --git a/miefda/2configs/x220t.nix b/miefda/2configs/x220t.nix index bea84f796..2d128e533 100644 --- a/miefda/2configs/x220t.nix +++ b/miefda/2configs/x220t.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { services.xserver = { diff --git a/mv/1systems/stro.nix b/mv/1systems/stro.nix index 3915219b7..b3dfc5708 100644 --- a/mv/1systems/stro.nix +++ b/mv/1systems/stro.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.build.host = config.krebs.hosts.stro; diff --git a/mv/2configs/default.nix b/mv/2configs/default.nix index 9c412099e..d93218a18 100644 --- a/mv/2configs/default.nix +++ b/mv/2configs/default.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let HOME = getEnv "HOME"; in diff --git a/mv/2configs/git.nix b/mv/2configs/git.nix index c182d0d1e..933649f20 100644 --- a/mv/2configs/git.nix +++ b/mv/2configs/git.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let diff --git a/mv/2configs/vim.nix b/mv/2configs/vim.nix index a961b6b26..adf1da9db 100644 --- a/mv/2configs/vim.nix +++ b/mv/2configs/vim.nix @@ -1,6 +1,6 @@ -{ lib, pkgs, ... }: +{ config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let out = { environment.systemPackages = [ diff --git a/mv/2configs/xserver/Xresources.nix b/mv/2configs/xserver/Xresources.nix index f287bf206..923572721 100644 --- a/mv/2configs/xserver/Xresources.nix +++ b/mv/2configs/xserver/Xresources.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; pkgs.writeText "Xresources" '' !URxvt*background: #050505 diff --git a/mv/2configs/xserver/default.nix b/mv/2configs/xserver/default.nix index 44539c54b..3d4aa8847 100644 --- a/mv/2configs/xserver/default.nix +++ b/mv/2configs/xserver/default.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }@args: -with lib; +with config.krebs.lib; let # TODO krebs.build.user diff --git a/mv/2configs/xserver/xserver.conf.nix b/mv/2configs/xserver/xserver.conf.nix index e8a997a99..c452b4226 100644 --- a/mv/2configs/xserver/xserver.conf.nix +++ b/mv/2configs/xserver/xserver.conf.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.services.xserver; diff --git a/mv/3modules/iptables.nix b/mv/3modules/iptables.nix index cbf49f577..b2b41bf00 100644 --- a/mv/3modules/iptables.nix +++ b/mv/3modules/iptables.nix @@ -1,13 +1,12 @@ { config, lib, pkgs, ... }: -with builtins; -with lib; +with config.krebs.lib; let cfg = config.tv.iptables; out = { options.tv.iptables = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/shared/2configs/base.nix b/shared/2configs/base.nix index 715397ed5..679764bc6 100644 --- a/shared/2configs/base.nix +++ b/shared/2configs/base.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.enable = true; krebs.retiolum = { diff --git a/shared/2configs/cgit-mirror.nix b/shared/2configs/cgit-mirror.nix index 4ff1902f9..d30f1444f 100644 --- a/shared/2configs/cgit-mirror.nix +++ b/shared/2configs/cgit-mirror.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let rules = with git; singleton { user = [ git-sync ]; diff --git a/shared/2configs/collectd-base.nix b/shared/2configs/collectd-base.nix index 3b792bf23..9c63dcd20 100644 --- a/shared/2configs/collectd-base.nix +++ b/shared/2configs/collectd-base.nix @@ -1,7 +1,7 @@ { config, lib, pkgs, ... }: # TODO: krebs.collectd.plugins -with lib; +with config.krebs.lib; let connect-time-cfg = with pkgs; writeText "collectd-connect-time.conf" '' LoadPlugin python diff --git a/shared/2configs/graphite.nix b/shared/2configs/graphite.nix index 707ec6e9a..37c6b09fd 100644 --- a/shared/2configs/graphite.nix +++ b/shared/2configs/graphite.nix @@ -5,7 +5,7 @@ # TODO: krebs.graphite.minimal.enable # TODO: configure firewall -with lib; +with config.krebs.lib; { imports = [ ]; diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix index b96548d61..3f804ba12 100644 --- a/tv/1systems/cd.nix +++ b/tv/1systems/cd.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.build.host = config.krebs.hosts.cd; diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix index 2010dcd57..4b1fcde36 100644 --- a/tv/1systems/mkdir.nix +++ b/tv/1systems/mkdir.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let # TODO merge with lass diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix index 37ef204c7..610434f06 100644 --- a/tv/1systems/nomic.nix +++ b/tv/1systems/nomic.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.build.host = config.krebs.hosts.nomic; diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix index 4005b5e6f..942e55e53 100644 --- a/tv/1systems/rmdir.nix +++ b/tv/1systems/rmdir.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let # TODO merge with lass diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index 0184ed991..4b9799178 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.build.host = config.krebs.hosts.wu; diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index 2719d56f4..6d300f186 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.build.host = config.krebs.hosts.xu; diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix index 57f299ebd..641e2d586 100644 --- a/tv/2configs/backup.nix +++ b/tv/2configs/backup.nix @@ -1,5 +1,5 @@ { config, lib, ... }: -with lib; +with config.krebs.lib; { krebs.backup.plans = { wu-home-xu = { diff --git a/tv/2configs/charybdis.nix b/tv/2configs/charybdis.nix index f9ab3da68..eefb2810b 100644 --- a/tv/2configs/charybdis.nix +++ b/tv/2configs/charybdis.nix @@ -1,13 +1,12 @@ { config, lib, pkgs, ... }: -with builtins; -with lib; +with config.krebs.lib; let cfg = config.tv.charybdis; out = { options.tv.charybdis = api; - config = mkIf cfg.enable (mkMerge [ + config = lib.mkIf cfg.enable (lib.mkMerge [ imp { tv.iptables.input-retiolum-accept-new-tcp = [ 6667 6697 ]; } ]); diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index 2edaed76d..9694e7b5b 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.enable = true; diff --git a/tv/2configs/exim-retiolum.nix b/tv/2configs/exim-retiolum.nix index aedf25823..9197a3c30 100644 --- a/tv/2configs/exim-retiolum.nix +++ b/tv/2configs/exim-retiolum.nix @@ -1,6 +1,6 @@ -{ lib, ... }: +{ config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.exim-retiolum.enable = true; diff --git a/tv/2configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix index bcfea7821..4b49e20b1 100644 --- a/tv/2configs/exim-smarthost.nix +++ b/tv/2configs/exim-smarthost.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { krebs.exim-smarthost = { diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix index f248a8cb5..7a42ca9fa 100644 --- a/tv/2configs/git.nix +++ b/tv/2configs/git.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let diff --git a/tv/2configs/hw/AO753.nix b/tv/2configs/hw/AO753.nix index e7a2b9238..b81b773be 100644 --- a/tv/2configs/hw/AO753.nix +++ b/tv/2configs/hw/AO753.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; { imports = [ diff --git a/tv/2configs/nginx-public_html.nix b/tv/2configs/nginx-public_html.nix index dc74f7f8d..15a3b5482 100644 --- a/tv/2configs/nginx-public_html.nix +++ b/tv/2configs/nginx-public_html.nix @@ -1,6 +1,6 @@ -{ lib, ... }: +{ config, lib, ... }: -with lib; +with config.krebs.lib; { krebs.nginx = { diff --git a/tv/2configs/pulse.nix b/tv/2configs/pulse.nix index e1894ca64..8e611f21e 100644 --- a/tv/2configs/pulse.nix +++ b/tv/2configs/pulse.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let pkg = pkgs.pulseaudioLight; runDir = "/run/pulse"; diff --git a/tv/2configs/retiolum.nix b/tv/2configs/retiolum.nix index d2bb9e6cf..e1598d792 100644 --- a/tv/2configs/retiolum.nix +++ b/tv/2configs/retiolum.nix @@ -1,6 +1,6 @@ { config, lib, ... }: -with lib; +with config.krebs.lib; { krebs.retiolum = { diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix index 69a880dab..b0c26e50e 100644 --- a/tv/2configs/vim.nix +++ b/tv/2configs/vim.nix @@ -1,6 +1,6 @@ -{ lib, pkgs, ... }: +{ config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let out = { environment.systemPackages = [ diff --git a/tv/2configs/xserver/Xresources.nix b/tv/2configs/xserver/Xresources.nix index f287bf206..923572721 100644 --- a/tv/2configs/xserver/Xresources.nix +++ b/tv/2configs/xserver/Xresources.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; pkgs.writeText "Xresources" '' !URxvt*background: #050505 diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix index 5cd17aa1d..4b936f473 100644 --- a/tv/2configs/xserver/default.nix +++ b/tv/2configs/xserver/default.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }@args: -with lib; +with config.krebs.lib; let # TODO krebs.build.user diff --git a/tv/2configs/xserver/xserver.conf.nix b/tv/2configs/xserver/xserver.conf.nix index e8a997a99..c452b4226 100644 --- a/tv/2configs/xserver/xserver.conf.nix +++ b/tv/2configs/xserver/xserver.conf.nix @@ -1,6 +1,6 @@ { config, lib, pkgs, ... }: -with lib; +with config.krebs.lib; let cfg = config.services.xserver; diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix index df35f5c3f..720a8acd8 100644 --- a/tv/2configs/xu-qemu0.nix +++ b/tv/2configs/xu-qemu0.nix @@ -21,7 +21,7 @@ in # TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport bootps -j ACCEPT # TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT -with lib; +with config.krebs.lib; { networking.dhcpcd.denyInterfaces = [ "qemubr0" ]; diff --git a/tv/3modules/ejabberd.nix b/tv/3modules/ejabberd.nix index 581e10074..c9d9b48b1 100644 --- a/tv/3modules/ejabberd.nix +++ b/tv/3modules/ejabberd.nix @@ -1,13 +1,12 @@ { config, lib, pkgs, ... }: -with builtins; -with lib; +with config.krebs.lib; let cfg = config.tv.ejabberd; out = { options.tv.ejabberd = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix index 4924db4f3..c0fd7ec12 100644 --- a/tv/3modules/iptables.nix +++ b/tv/3modules/iptables.nix @@ -1,13 +1,12 @@ { config, lib, pkgs, ... }: -with builtins; -with lib; +with config.krebs.lib; let cfg = config.tv.iptables; out = { options.tv.iptables = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { From 8f520b19b623919fa6319029a955d43fd051773c Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 15 Feb 2016 16:27:11 +0100 Subject: [PATCH 80/81] don't try to mimic nixpkgs --- Makefile | 3 +- default.nix | 91 +--------- krebs/3modules/lib.nix | 4 + krebs/default.nix | 201 +-------------------- lass/1systems/cloudkrebs.nix | 1 + lass/1systems/dishfire.nix | 1 + lass/1systems/echelon.nix | 1 + lass/1systems/helios.nix | 1 + lass/1systems/mors.nix | 1 + lass/1systems/prism.nix | 1 + lass/1systems/uriel.nix | 1 + lass/2configs/base.nix | 4 +- lass/3modules/dnsmasq.nix | 3 +- lass/3modules/newsbot-js.nix | 3 +- lass/default.nix | 7 + makefu/1systems/filepimp.nix | 1 + makefu/1systems/gum.nix | 1 + makefu/1systems/omo.nix | 1 + makefu/1systems/pnp.nix | 1 + makefu/1systems/pornocauster.nix | 1 + makefu/1systems/repunit.nix | 1 + makefu/1systems/tsp.nix | 1 + makefu/1systems/vbob.nix | 1 + makefu/1systems/wbob.nix | 1 + makefu/1systems/wry.nix | 1 + makefu/2configs/default.nix | 4 +- makefu/default.nix | 8 + miefda/1systems/bobby.nix | 2 +- miefda/default.nix | 6 + mv/1systems/stro.nix | 1 + nixpkgs/default.nix | 6 - nixpkgs/krebs | 0 nixpkgs/lib | 1 - nixpkgs/nixos/default.nix | 1 - nixpkgs/nixos/lib | 1 - nixpkgs/nixos/modules | 1 - root | 1 - shared/1systems/test-all-krebs-modules.nix | 3 + shared/1systems/test-arch.nix | 1 + shared/1systems/test-centos6.nix | 1 + shared/1systems/test-centos7.nix | 1 + shared/1systems/test-failing.nix | 3 + shared/1systems/test-minimal-deploy.nix | 3 + shared/1systems/wolf.nix | 1 + shared/2configs/base.nix | 4 +- shared/default.nix | 7 + tv/1systems/cd.nix | 1 + tv/1systems/mkdir.nix | 1 + tv/1systems/nomic.nix | 1 + tv/1systems/rmdir.nix | 1 + tv/1systems/wu.nix | 1 + tv/1systems/xu-qemu0.nix | 1 + tv/1systems/xu.nix | 1 + tv/2configs/default.nix | 4 +- tv/default.nix | 9 + 55 files changed, 103 insertions(+), 306 deletions(-) create mode 100644 lass/default.nix create mode 100644 makefu/default.nix create mode 100644 miefda/default.nix delete mode 100644 nixpkgs/default.nix delete mode 100644 nixpkgs/krebs delete mode 120000 nixpkgs/lib delete mode 100644 nixpkgs/nixos/default.nix delete mode 120000 nixpkgs/nixos/lib delete mode 120000 nixpkgs/nixos/modules delete mode 120000 root create mode 100644 shared/default.nix create mode 100644 tv/default.nix diff --git a/Makefile b/Makefile index e5e3b19d5..384c872ab 100644 --- a/Makefile +++ b/Makefile @@ -9,10 +9,11 @@ export target_path ?= /var/src evaluate = \ nix-instantiate \ - --arg configuration ./$(LOGNAME)/1systems/$(system).nix \ --eval \ --readonly-mode \ --show-trace \ + -I nixos-config=./$(LOGNAME)/1systems/$(system).nix \ + -I stockholm=. \ $(1) execute = \ diff --git a/default.nix b/default.nix index c96d4dd1c..52e8924cd 100644 --- a/default.nix +++ b/default.nix @@ -1,86 +1,5 @@ -{ configuration ? import (nixpkgs-path + "/nixos/lib/from-env.nix") "NIXOS_CONFIG" -, system ? builtins.currentSystem -, current-host-name ? - let v = builtins.getEnv "HOSTNAME"; in - if v != "" then v else builtins.readFile /proc/sys/kernel/hostname -, current-user-name ? - let v = builtins.getEnv "LOGNAME"; in - if v != "" then v else abort "undefined variable: LOGNAME" -, nixpkgs-path ? - if (builtins.tryEval ).success - then - else -, StrictHostKeyChecking ? "yes" -}@args: - -let stockholm = { - inherit krebs; - inherit users; - inherit lib; - inherit config options pkgs; - system = config.system.build.toplevel; - }; - - krebs = import ./krebs (args // { inherit lib stockholm; }); - - lib = let - nlib = import (slib.npath "lib"); - klib = import (slib.kpath "4lib") { lib = nlib; }; - slib = rec { - nspath = ns: p: ./. + "/${ns}/${p}"; - npath = p: nixpkgs-path + "/${p}"; - kpath = nspath "krebs"; - upath = nspath current-user-name; - }; - ulib = let p = slib.upath "4lib"; in - nlib.optionalAttrs (klib.dir.has-default-nix p) - (import p { lib = nlib // klib; }); - in nlib // klib // slib // ulib // builtins; - - inherit (eval configuration) config options pkgs; - - base-module = { config, ... }: { - imports = builtins.filter lib.dir.has-default-nix (lib.concatLists [ - (map (f: f "2configs") [ lib.upath ]) - (map (f: f "3modules") [ lib.kpath lib.upath ]) - (map (f: f "5pkgs") [ lib.kpath lib.upath ]) - ]); - - krebs.lib = lib; - - krebs.current.enable = true; - krebs.current.host = config.krebs.hosts.${current-host-name}; - krebs.current.user = config.krebs.users.${current-user-name}; - }; - - eval = config: import (lib.npath "nixos/lib/eval-config.nix") { - inherit system; - specialArgs = { - inherit lib; - }; - modules = [ - base-module - config - ]; - }; - - # TODO move user namespaces' to users/, so no exception for krebs/ is needed - users = - lib.mapAttrs - (name: _: eval-all-systems (lib.nspath name "1systems")) - (lib.filterAttrs - (n: t: !lib.hasPrefix "." n && t == "directory" && n != "krebs") - (builtins.readDir ./.)); - - eval-all-systems = path: - lib.mapAttrs' - (n: _: (lib.nameValuePair (lib.removeSuffix ".nix" n) - (eval-system (path + "/${n}")))) - (builtins.readDir path); - - eval-system = path: rec { - inherit (eval path) config options; - system = config.system.build.toplevel; - }; - -in stockholm +import { + modules = [ + (import "NIXOS_CONFIG" ) + ]; +} diff --git a/krebs/3modules/lib.nix b/krebs/3modules/lib.nix index 31390a263..b19f275b5 100644 --- a/krebs/3modules/lib.nix +++ b/krebs/3modules/lib.nix @@ -3,9 +3,13 @@ with lib; let out = { options.krebs.lib = api; + config = imp; }; api = mkOption { default = {}; type = types.attrs; }; + imp = { + krebs.lib = lib // import ../4lib { inherit lib; } // builtins; + }; in out diff --git a/krebs/default.nix b/krebs/default.nix index 17c035896..93e006f3d 100644 --- a/krebs/default.nix +++ b/krebs/default.nix @@ -1,193 +1,8 @@ -assert false; - -{ current-host-name -, current-user-name -, lib -, stockholm -, StrictHostKeyChecking ? "yes" -}: - -let out = { - inherit infest; - inherit init; - inherit nixos-install; - }; - - infest = - { system ? current-host-name - , target ? system - }@args: let - config = get-config system; - in '' - #! /bin/sh - # krebs.infest - set -efu - - ${rootssh target '' - ${builtins.readFile ./4lib/infest/prepare.sh} - ${builtins.readFile ./4lib/infest/install-nix.sh} - ''} - - (${nixos-install args}) - - ${rootssh target '' - ${builtins.readFile ./4lib/infest/finalize.sh} - ''} - ''; - - init = - { system ? current-host-name - }@args: let - config = get-config system; - in '' - #! /bin/sh - # krebs.init - set -efu - - system=${lib.shell.escape system} - secrets_dir=${config.krebs.build.source.dir.secrets.path} - key_type=ed25519 - key_file=$secrets_dir/ssh.id_$key_type - key_comment=$system - - if test -e "$key_file"; then - echo "Warning: privkey already exists: $key_file" >&2 - else - ssh-keygen \ - -C "$key_comment" \ - -t "$key_type" \ - -f "$key_file" \ - -N "" - rm "$key_file.pub" - fi - - pubkey=$(ssh-keygen -y -f "$key_file") - - cat<; - ssh.pubkey = $(echo $pubkey | jq -R .); - EOF - ''; - - nixos-install = - { system ? current-host-name - , target ? system - }@args: let - in '' - #! /bin/sh - # krebs.nixos-install - (${populate (args // { root = "/mnt"; })}) - - ${rootssh target '' - export PATH; PATH=/root/.nix-profile/bin:$PATH - - src=$(type -p nixos-install) - cat_src() { - sed < "$src" "$( - { sed < "$src" -n ' - /^if ! test -e "\$mountPoint\/\$NIXOS_CONFIG/,/^fi$/= - /^nixpkgs=/= - /^NIX_PATH=/,/^$/{/./=} - - # Disable: Copy the NixOS/Nixpkgs sources to the target as - # the initial contents of the NixOS channel. - /^srcs=/,/^ln -sfn /= - ' - } | sed 's:$:s/^/#krebs#/:' - )" - } - - # Location to insert `nix-install` - i=$(sed -n '/^echo "building the system configuration/=' "$src") - - { - cat_src | sed -n "1,$i{p}" - cat ${doc (nix-install args)} - cat_src | sed -n "$i,\''${$i!p}" - } > nixos-install - chmod +x nixos-install - - # Wrap inserted nix-install into chroot. - nix_env=$(cat_src | sed -n ' - s:.*\(/nix/store/[a-z0-9]*-nix-[0-9.]\+/bin/nix-env\).*:\1:p;T;q - ') - echo "nix-env is $nix_env" >&2 - findpkg() {( - name=$1 - path=$(find /nix/store \ - -mindepth 1 -maxdepth 1 -type d -name '*-'"$name"'-*' \ - | head -n 1 | sed s:^/mnt::) - if echo "$path" | grep .; then - echo "$name is $path" >&2 - else - echo "Error: package not found: $name" >&2 - exit 1 - fi - )} - cacert=$(findpkg cacert) - coreutils=$(findpkg coreutils) - cp "$cacert"/etc/ssl/certs/ca-bundle.crt /mnt/root/SSL_CERT_FILE - env="$coreutils/bin/env SSL_CERT_FILE=/root/SSL_CERT_FILE" - sed -i ' - s:^NIX_PATH=:chroot $mountPoint '"$env"' &: - s:^nix-env:'"$nix_env"': - ' nixos-install - - ./nixos-install - ''} - ''; - - doc = s: - let b = "EOF${builtins.hashString "sha256" s}"; in - '' - <<\${b} - ${s} - ${b} - ''; - - get-config = system: let - config = stockholm.users.${current-user-name}.${system}.config - or (abort "unknown system: ${system}, user: ${current-user-name}"); - in config; - - nix-install = - { system ? current-host-name - , target ? system - }: - let - config = get-config system; - - nix-path = - lib.concatStringsSep ":" - (lib.mapAttrsToList (name: src: "${name}=${src.target-path}") - (config.krebs.build.source.dir // - config.krebs.build.source.git)); - in '' - set -efu - NIX_PATH=${lib.shell.escape nix-path} \ - nix-env \ - --show-trace \ - -f '' \ - --argstr current-host-name ${lib.shell.escape current-host-name} \ - --argstr current-user-name ${lib.shell.escape current-user-name} \ - --profile ${lib.shell.escape config.krebs.build.profile} \ - --set \ - -A ${lib.escapeShellArg (lib.concatStringsSep "." [ - "users" - config.krebs.build.user.name - config.krebs.build.host.name - "system" - ])} - ''; - - rootssh = target: script: - let - flags = "-o StrictHostKeyChecking=${StrictHostKeyChecking}"; - in - "ssh ${flags} root@${target} -T ${doc '' - set -efu - ${script} - ''}"; - -in out +{ config, lib, pkgs, ... }: +with config.krebs.lib; +{ + imports = [ + ./3modules + ./5pkgs + ]; +} diff --git a/lass/1systems/cloudkrebs.nix b/lass/1systems/cloudkrebs.nix index ab24b584b..98f509050 100644 --- a/lass/1systems/cloudkrebs.nix +++ b/lass/1systems/cloudkrebs.nix @@ -7,6 +7,7 @@ let ip = (head config.krebs.build.host.nets.internet.addrs4); in { imports = [ + ../. ../2configs/os-templates/CAC-CentOS-7-64bit.nix ../2configs/base.nix ../2configs/retiolum.nix diff --git a/lass/1systems/dishfire.nix b/lass/1systems/dishfire.nix index cc9836dff..c7d016cd3 100644 --- a/lass/1systems/dishfire.nix +++ b/lass/1systems/dishfire.nix @@ -2,6 +2,7 @@ { imports = [ + ../. ../2configs/base.nix ../2configs/git.nix diff --git a/lass/1systems/echelon.nix b/lass/1systems/echelon.nix index 39af4a96f..2ff6dba70 100644 --- a/lass/1systems/echelon.nix +++ b/lass/1systems/echelon.nix @@ -7,6 +7,7 @@ let ip = (head config.krebs.build.host.nets.internet.addrs4); in { imports = [ + ../. ../2configs/os-templates/CAC-CentOS-7-64bit.nix ../2configs/base.nix ../2configs/retiolum.nix diff --git a/lass/1systems/helios.nix b/lass/1systems/helios.nix index 67e3738ea..88fb6aac7 100644 --- a/lass/1systems/helios.nix +++ b/lass/1systems/helios.nix @@ -3,6 +3,7 @@ with builtins; { imports = [ + ../. ../2configs/baseX.nix ../2configs/browsers.nix ../2configs/programs.nix diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix index ebce93957..f6ac1b4e6 100644 --- a/lass/1systems/mors.nix +++ b/lass/1systems/mors.nix @@ -2,6 +2,7 @@ { imports = [ + ../. ../2configs/baseX.nix ../2configs/programs.nix ../2configs/bitcoin.nix diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix index 95c55533c..05b3470e5 100644 --- a/lass/1systems/prism.nix +++ b/lass/1systems/prism.nix @@ -6,6 +6,7 @@ let ip = (head config.krebs.build.host.nets.internet.addrs4); in { imports = [ + ../. ../2configs/base.nix ../2configs/downloading.nix ../2configs/git.nix diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix index d53e783d0..0758164f0 100644 --- a/lass/1systems/uriel.nix +++ b/lass/1systems/uriel.nix @@ -3,6 +3,7 @@ with builtins; { imports = [ + ../. ../2configs/baseX.nix ../2configs/browsers.nix ../2configs/games.nix diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix index 68103c3ef..d2c96fdaa 100644 --- a/lass/2configs/base.nix +++ b/lass/2configs/base.nix @@ -50,12 +50,10 @@ with config.krebs.lib; user = config.krebs.users.lass; source = mapAttrs (_: mkDefault) ({ nixos-config = "symlink:stockholm/lass/1systems/${config.krebs.build.host.name}.nix"; - nixpkgs = symlink:stockholm/nixpkgs; secrets = "/home/lass/secrets/${config.krebs.build.host.name}"; #secrets-common = "/home/lass/secrets/common"; stockholm = "/home/lass/stockholm"; - stockholm-user = "symlink:stockholm/lass"; - upstream-nixpkgs = { + nixpkgs = { url = https://github.com/Lassulus/nixpkgs; rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce"; dev = "/home/lass/src/nixpkgs"; diff --git a/lass/3modules/dnsmasq.nix b/lass/3modules/dnsmasq.nix index c05ad0fc9..83a9cb180 100644 --- a/lass/3modules/dnsmasq.nix +++ b/lass/3modules/dnsmasq.nix @@ -1,6 +1,7 @@ { config, lib, pkgs, ... }: -with config.krebs.lib; +with builtins; +with lib; let cfg = config.lass.dnsmasq; diff --git a/lass/3modules/newsbot-js.nix b/lass/3modules/newsbot-js.nix index ef4d97b76..5e340b26f 100644 --- a/lass/3modules/newsbot-js.nix +++ b/lass/3modules/newsbot-js.nix @@ -1,6 +1,7 @@ { config, lib, pkgs, ... }: -with config.krebs.lib; +with builtins; +with lib; let cfg = config.lass.newsbot-js; diff --git a/lass/default.nix b/lass/default.nix new file mode 100644 index 000000000..69b4abaac --- /dev/null +++ b/lass/default.nix @@ -0,0 +1,7 @@ +_: +{ + imports = [ + ../krebs + ./3modules + ]; +} diff --git a/makefu/1systems/filepimp.nix b/makefu/1systems/filepimp.nix index fb9324ee9..f2c592ea9 100644 --- a/makefu/1systems/filepimp.nix +++ b/makefu/1systems/filepimp.nix @@ -11,6 +11,7 @@ let in { imports = [ # Include the results of the hardware scan. + ../. ../2configs/fs/single-partition-ext4.nix ../2configs/tinc-basic-retiolum.nix ../2configs/smart-monitor.nix diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix index 43fc8109d..04adc4941 100644 --- a/makefu/1systems/gum.nix +++ b/makefu/1systems/gum.nix @@ -6,6 +6,7 @@ let internal-ip = head config.krebs.build.host.nets.retiolum.addrs4; in { imports = [ + ../. ../2configs/tinc-basic-retiolum.nix ../2configs/headless.nix ../2configs/fs/simple-swap.nix diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix index 34d5a394d..6cff35e9d 100644 --- a/makefu/1systems/omo.nix +++ b/makefu/1systems/omo.nix @@ -20,6 +20,7 @@ let in { imports = [ + ../. # TODO: unlock home partition via ssh ../2configs/fs/single-partition-ext4.nix ../2configs/tinc-basic-retiolum.nix diff --git a/makefu/1systems/pnp.nix b/makefu/1systems/pnp.nix index 51c124bbe..8791ad1d7 100644 --- a/makefu/1systems/pnp.nix +++ b/makefu/1systems/pnp.nix @@ -6,6 +6,7 @@ { imports = [ + ../. ../2configs/tinc-basic-retiolum.nix ../2configs/headless.nix ../../krebs/3modules/Reaktor.nix diff --git a/makefu/1systems/pornocauster.nix b/makefu/1systems/pornocauster.nix index d8ccc5846..b2cf0be79 100644 --- a/makefu/1systems/pornocauster.nix +++ b/makefu/1systems/pornocauster.nix @@ -6,6 +6,7 @@ { imports = [ # Include the results of the hardware scan. + ../. ../2configs/main-laptop.nix #< base-gui + zsh # Krebs diff --git a/makefu/1systems/repunit.nix b/makefu/1systems/repunit.nix index 0c6ba09fb..6d2e7273d 100644 --- a/makefu/1systems/repunit.nix +++ b/makefu/1systems/repunit.nix @@ -7,6 +7,7 @@ { imports = [ # Include the results of the hardware scan. + ../. ../2configs/cgit-retiolum.nix ]; diff --git a/makefu/1systems/tsp.nix b/makefu/1systems/tsp.nix index 990db65d2..d5d44cce0 100644 --- a/makefu/1systems/tsp.nix +++ b/makefu/1systems/tsp.nix @@ -6,6 +6,7 @@ { imports = [ # Include the results of the hardware scan. + ../. ../2configs/base-gui.nix ../2configs/tinc-basic-retiolum.nix ../2configs/fs/sda-crypto-root.nix diff --git a/makefu/1systems/vbob.nix b/makefu/1systems/vbob.nix index 2dee83728..e07525d0d 100644 --- a/makefu/1systems/vbob.nix +++ b/makefu/1systems/vbob.nix @@ -6,6 +6,7 @@ krebs.build.host = config.krebs.hosts.vbob; imports = [ # Include the results of the hardware scan. + ../. ../2configs/main-laptop.nix #< base-gui diff --git a/makefu/1systems/wbob.nix b/makefu/1systems/wbob.nix index 8917e4339..b4f7c9058 100644 --- a/makefu/1systems/wbob.nix +++ b/makefu/1systems/wbob.nix @@ -2,6 +2,7 @@ { imports = [ # Include the results of the hardware scan. + ../. ../2configs/main-laptop.nix ]; krebs = { diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix index 41d207ed2..747321968 100644 --- a/makefu/1systems/wry.nix +++ b/makefu/1systems/wry.nix @@ -7,6 +7,7 @@ let internal-ip = head config.krebs.build.host.nets.retiolum.addrs4; in { imports = [ + ../. # TODO: copy this config or move to krebs ../../tv/2configs/hw/CAC.nix ../../tv/2configs/fs/CAC-CentOS-7-64bit.nix diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix index c35bfc173..153e80bb1 100644 --- a/makefu/2configs/default.nix +++ b/makefu/2configs/default.nix @@ -21,7 +21,7 @@ with config.krebs.lib; target = mkDefault "root@${config.krebs.build.host.name}"; user = config.krebs.users.makefu; source = mapAttrs (_: mkDefault) { - upstream-nixpkgs = { + nixpkgs = { url = https://github.com/nixos/nixpkgs; rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; # unstable @ 2015-01-27, tested on wry }; @@ -30,8 +30,6 @@ with config.krebs.lib; # Defaults for all stockholm users? nixos-config = "symlink:stockholm/${config.krebs.build.user.name}/1systems/${config.krebs.build.host.name}.nix"; - nixpkgs = symlink:stockholm/nixpkgs; - stockholm-user = "symlink:stockholm/${config.krebs.build.user.name}"; }; }; }; diff --git a/makefu/default.nix b/makefu/default.nix new file mode 100644 index 000000000..320e1a133 --- /dev/null +++ b/makefu/default.nix @@ -0,0 +1,8 @@ +_: +{ + imports = [ + ../krebs + ./2configs + ./3modules + ]; +} diff --git a/miefda/1systems/bobby.nix b/miefda/1systems/bobby.nix index d24595256..b85e686b5 100644 --- a/miefda/1systems/bobby.nix +++ b/miefda/1systems/bobby.nix @@ -7,7 +7,7 @@ { imports = [ # Include the results of the hardware scan. - + ../. ../2configs/miefda.nix ../2configs/tlp.nix ../2configs/x220t.nix diff --git a/miefda/default.nix b/miefda/default.nix new file mode 100644 index 000000000..7f275c2eb --- /dev/null +++ b/miefda/default.nix @@ -0,0 +1,6 @@ +_: +{ + imports = [ + ../krebs + ]; +} diff --git a/mv/1systems/stro.nix b/mv/1systems/stro.nix index b3dfc5708..f251cb092 100644 --- a/mv/1systems/stro.nix +++ b/mv/1systems/stro.nix @@ -9,6 +9,7 @@ with config.krebs.lib; "7ae05edcdd14f6ace83ead9bf0d114e97c89a83a"; imports = [ + ../. ../2configs/hw/x220.nix ../2configs/git.nix ../2configs/mail-client.nix diff --git a/nixpkgs/default.nix b/nixpkgs/default.nix deleted file mode 100644 index 8514fa499..000000000 --- a/nixpkgs/default.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ system ? builtins.currentSystem }: - -(import { - inherit system; - configuration = {}; -}).pkgs diff --git a/nixpkgs/krebs b/nixpkgs/krebs deleted file mode 100644 index e69de29bb..000000000 diff --git a/nixpkgs/lib b/nixpkgs/lib deleted file mode 120000 index 7b13c8069..000000000 --- a/nixpkgs/lib +++ /dev/null @@ -1 +0,0 @@ -../../upstream-nixpkgs/lib \ No newline at end of file diff --git a/nixpkgs/nixos/default.nix b/nixpkgs/nixos/default.nix deleted file mode 100644 index 4fe08efd2..000000000 --- a/nixpkgs/nixos/default.nix +++ /dev/null @@ -1 +0,0 @@ -import diff --git a/nixpkgs/nixos/lib b/nixpkgs/nixos/lib deleted file mode 120000 index 9e69d1a67..000000000 --- a/nixpkgs/nixos/lib +++ /dev/null @@ -1 +0,0 @@ -../../../upstream-nixpkgs/nixos/lib \ No newline at end of file diff --git a/nixpkgs/nixos/modules b/nixpkgs/nixos/modules deleted file mode 120000 index 8aa24885c..000000000 --- a/nixpkgs/nixos/modules +++ /dev/null @@ -1 +0,0 @@ -../../../upstream-nixpkgs/nixos/modules \ No newline at end of file diff --git a/root b/root deleted file mode 120000 index 1cd18253d..000000000 --- a/root +++ /dev/null @@ -1 +0,0 @@ -../stockholm-user \ No newline at end of file diff --git a/shared/1systems/test-all-krebs-modules.nix b/shared/1systems/test-all-krebs-modules.nix index b98004dfe..e1021c7e0 100644 --- a/shared/1systems/test-all-krebs-modules.nix +++ b/shared/1systems/test-all-krebs-modules.nix @@ -2,6 +2,9 @@ let en = { enable = true;}; in { + imports = [ + ../. + ]; krebs = { enable = true; build.user = config.krebs.users.shared; diff --git a/shared/1systems/test-arch.nix b/shared/1systems/test-arch.nix index ece209490..14fc0384b 100644 --- a/shared/1systems/test-arch.nix +++ b/shared/1systems/test-arch.nix @@ -2,6 +2,7 @@ { imports = [ + ../. ../2configs/base.nix { boot.loader.grub = { diff --git a/shared/1systems/test-centos6.nix b/shared/1systems/test-centos6.nix index a8b5f9b9c..8add0b7c1 100644 --- a/shared/1systems/test-centos6.nix +++ b/shared/1systems/test-centos6.nix @@ -7,6 +7,7 @@ let gw = "168.235.148.1"; in { imports = [ + ../. ../2configs/base.nix ../2configs/os-templates/CAC-CentOS-6.5-64bit.nix { diff --git a/shared/1systems/test-centos7.nix b/shared/1systems/test-centos7.nix index 48cecc877..65daff509 100644 --- a/shared/1systems/test-centos7.nix +++ b/shared/1systems/test-centos7.nix @@ -5,6 +5,7 @@ let in { imports = [ + ../. ../2configs/base.nix ../2configs/os-templates/CAC-CentOS-7-64bit.nix ../2configs/temp/networking.nix diff --git a/shared/1systems/test-failing.nix b/shared/1systems/test-failing.nix index 81a9e48d6..fe1c2cb65 100644 --- a/shared/1systems/test-failing.nix +++ b/shared/1systems/test-failing.nix @@ -1,6 +1,9 @@ { config, pkgs, ... }: { + imports = [ + ../. + ]; programs.ssh.startAgent = true; programs.ssh.startAgent = false; } diff --git a/shared/1systems/test-minimal-deploy.nix b/shared/1systems/test-minimal-deploy.nix index 309e28950..bec2b38d5 100644 --- a/shared/1systems/test-minimal-deploy.nix +++ b/shared/1systems/test-minimal-deploy.nix @@ -1,5 +1,8 @@ { config, pkgs, lib, ... }: { + imports = [ + ../. + ]; krebs = { enable = true; build.user = config.krebs.users.shared; diff --git a/shared/1systems/wolf.nix b/shared/1systems/wolf.nix index 9a514428a..317591433 100644 --- a/shared/1systems/wolf.nix +++ b/shared/1systems/wolf.nix @@ -6,6 +6,7 @@ let in { imports = [ + ../. ../2configs/base.nix ../2configs/collectd-base.nix diff --git a/shared/2configs/base.nix b/shared/2configs/base.nix index 679764bc6..9f998b554 100644 --- a/shared/2configs/base.nix +++ b/shared/2configs/base.nix @@ -16,7 +16,7 @@ with config.krebs.lib; # TODO rename shared user to "krebs" krebs.build.user = mkDefault config.krebs.users.shared; krebs.build.source = { - upstream-nixpkgs = mkDefault { + nixpkgs = mkDefault { url = https://github.com/NixOS/nixpkgs; rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; # for urlwatch-minidb }; @@ -24,8 +24,6 @@ with config.krebs.lib; stockholm = mkDefault "${getEnv "HOME"}/stockholm"; nixos-config = "symlink:stockholm/${config.krebs.build.user.name}/1systems/${config.krebs.build.host.name}.nix"; - nixpkgs = symlink:stockholm/nixpkgs; - stockholm-user = "symlink:stockholm/${config.krebs.build.user.name}"; }; networking.hostName = config.krebs.build.host.name; diff --git a/shared/default.nix b/shared/default.nix new file mode 100644 index 000000000..69b4abaac --- /dev/null +++ b/shared/default.nix @@ -0,0 +1,7 @@ +_: +{ + imports = [ + ../krebs + ./3modules + ]; +} diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix index 3f804ba12..9b6382607 100644 --- a/tv/1systems/cd.nix +++ b/tv/1systems/cd.nix @@ -6,6 +6,7 @@ with config.krebs.lib; krebs.build.host = config.krebs.hosts.cd; imports = [ + ../. ../2configs/hw/CAC-Developer-2.nix ../2configs/fs/CAC-CentOS-7-64bit.nix ../2configs/exim-smarthost.nix diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix index 4b1fcde36..58a8fdcb2 100644 --- a/tv/1systems/mkdir.nix +++ b/tv/1systems/mkdir.nix @@ -19,6 +19,7 @@ in krebs.build.host = config.krebs.hosts.mkdir; imports = [ + ../. ../2configs/hw/CAC-Developer-1.nix ../2configs/fs/CAC-CentOS-7-64bit.nix ../2configs/exim-smarthost.nix diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix index 610434f06..2c9775da7 100644 --- a/tv/1systems/nomic.nix +++ b/tv/1systems/nomic.nix @@ -6,6 +6,7 @@ with config.krebs.lib; krebs.build.host = config.krebs.hosts.nomic; imports = [ + ../. ../2configs/hw/AO753.nix ../2configs/exim-retiolum.nix ../2configs/git.nix diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix index 942e55e53..c54caa649 100644 --- a/tv/1systems/rmdir.nix +++ b/tv/1systems/rmdir.nix @@ -19,6 +19,7 @@ in krebs.build.host = config.krebs.hosts.rmdir; imports = [ + ../. ../2configs/hw/CAC-Developer-1.nix ../2configs/fs/CAC-CentOS-7-64bit.nix ../2configs/exim-smarthost.nix diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index 4b9799178..6154e4df9 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -6,6 +6,7 @@ with config.krebs.lib; krebs.build.host = config.krebs.hosts.wu; imports = [ + ../. ../2configs/hw/w110er.nix ../2configs/exim-retiolum.nix ../2configs/git.nix diff --git a/tv/1systems/xu-qemu0.nix b/tv/1systems/xu-qemu0.nix index 03ac19cf7..8945c1907 100644 --- a/tv/1systems/xu-qemu0.nix +++ b/tv/1systems/xu-qemu0.nix @@ -10,6 +10,7 @@ krebs.build.host = config.krebs.hosts.xu-qemu0; imports = [ + ../. ]; diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index 6d300f186..5ec1fe52b 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -6,6 +6,7 @@ with config.krebs.lib; krebs.build.host = config.krebs.hosts.xu; imports = [ + ../. ../2configs/hw/x220.nix ../2configs/exim-retiolum.nix ../2configs/git.nix diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index 9694e7b5b..c4a2d6baa 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -9,12 +9,10 @@ with config.krebs.lib; user = config.krebs.users.tv; source = mapAttrs (_: mkDefault) ({ nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix"; - nixpkgs = symlink:stockholm/nixpkgs; secrets = "/home/tv/secrets/${config.krebs.build.host.name}"; secrets-common = "/home/tv/secrets/common"; stockholm = "/home/tv/stockholm"; - stockholm-user = "symlink:stockholm/tv"; - upstream-nixpkgs = { + nixpkgs = { url = https://github.com/NixOS/nixpkgs; rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; dev = "/home/tv/nixpkgs"; diff --git a/tv/default.nix b/tv/default.nix new file mode 100644 index 000000000..b1c7c1be8 --- /dev/null +++ b/tv/default.nix @@ -0,0 +1,9 @@ +_: +{ + imports = [ + ../krebs + ./2configs + ./3modules + ./5pkgs + ]; +} From b7a92f63884af00eb0243ec9328be689a6c9b845 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 15 Feb 2016 16:29:01 +0100 Subject: [PATCH 81/81] *: make eval.config.krebs.build.host.name work everywhere --- krebs/3modules/backup.nix | 2 +- krebs/3modules/default.nix | 4 ++-- lass/3modules/urxvtd.nix | 3 ++- lass/3modules/xresources.nix | 3 ++- makefu/1systems/repunit.nix | 2 +- makefu/2configs/default.nix | 1 - makefu/3modules/snapraid.nix | 2 +- makefu/3modules/umts.nix | 2 +- 8 files changed, 10 insertions(+), 9 deletions(-) diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix index 5e1a1597b..0aa86dec9 100644 --- a/krebs/3modules/backup.nix +++ b/krebs/3modules/backup.nix @@ -210,7 +210,7 @@ let | ${pkgs.coreutils}/bin/head -1; } ''; - # Note that we don't escape word on purpose, so we deref shell vars. + # Note that we don't escape word on purpose, so we can deref shell vars. # TODO type word network-ssh-port = host: word: '' case ${word} in diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 23f82ed1c..16a74e7c1 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -9,9 +9,9 @@ let ./apt-cacher-ng.nix ./backup.nix ./bepasty-server.nix - ./build.nix ./buildbot/master.nix ./buildbot/slave.nix + ./build.nix ./current.nix ./exim-retiolum.nix ./exim-smarthost.nix @@ -25,8 +25,8 @@ let ./nixpkgs.nix ./per-user.nix ./Reaktor.nix - ./retiolum-bootstrap.nix ./realwallpaper.nix + ./retiolum-bootstrap.nix ./retiolum.nix ./setuid.nix ./tinc_graphs.nix diff --git a/lass/3modules/urxvtd.nix b/lass/3modules/urxvtd.nix index 1eb463955..469616a9f 100644 --- a/lass/3modules/urxvtd.nix +++ b/lass/3modules/urxvtd.nix @@ -3,7 +3,8 @@ let in -with config.krebs.lib; +with builtins; +with lib; { options = { diff --git a/lass/3modules/xresources.nix b/lass/3modules/xresources.nix index 729eccecc..074963022 100644 --- a/lass/3modules/xresources.nix +++ b/lass/3modules/xresources.nix @@ -6,7 +6,8 @@ # # -with config.krebs.lib; +with builtins; +with lib; let diff --git a/makefu/1systems/repunit.nix b/makefu/1systems/repunit.nix index 6d2e7273d..f9421cfa2 100644 --- a/makefu/1systems/repunit.nix +++ b/makefu/1systems/repunit.nix @@ -9,7 +9,7 @@ [ # Include the results of the hardware scan. ../. - ../2configs/cgit-retiolum.nix + ../2configs/git/cgit-retiolum.nix ]; krebs.build.host = config.krebs.hosts.repunit; diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix index 153e80bb1..83018e9f8 100644 --- a/makefu/2configs/default.nix +++ b/makefu/2configs/default.nix @@ -18,7 +18,6 @@ with config.krebs.lib; enable = true; search-domain = "retiolum"; build = { - target = mkDefault "root@${config.krebs.build.host.name}"; user = config.krebs.users.makefu; source = mapAttrs (_: mkDefault) { nixpkgs = { diff --git a/makefu/3modules/snapraid.nix b/makefu/3modules/snapraid.nix index 4a0363e6a..3d458bbbf 100644 --- a/makefu/3modules/snapraid.nix +++ b/makefu/3modules/snapraid.nix @@ -28,7 +28,7 @@ let out = { options.makefu.snapraid = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = { diff --git a/makefu/3modules/umts.nix b/makefu/3modules/umts.nix index 7e0e5dada..e527a5cb7 100644 --- a/makefu/3modules/umts.nix +++ b/makefu/3modules/umts.nix @@ -32,7 +32,7 @@ let out = { options.makefu.umts = api; - config = mkIf cfg.enable imp; + config = lib.mkIf cfg.enable imp; }; api = {