merge cloudkrebs, fix path to krebs/4lib
This commit is contained in:
makefu
commit
0bf2b871dd
4
0make/lass/cloudkrebs.makefile
Normal file
4
0make/lass/cloudkrebs.makefile
Normal file
@ -0,0 +1,4 @@
|
||||
deploy_host := root@cloudkrebs
|
||||
nixpkgs_url := https://github.com/Lassulus/nixpkgs
|
||||
nixpkgs_rev := 1879a011925c561f0a7fd4043da0768bbff41d0b
|
||||
secrets_dir := /home/lass/secrets/cloudkrebs
|
||||
@ -1,140 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (builtins) map readFile;
|
||||
inherit (lib) concatMap listToAttrs;
|
||||
# TODO lib should already include our stuff
|
||||
inherit (import ../../4lib/tv { inherit lib pkgs; }) addNames git;
|
||||
|
||||
x-repos = [
|
||||
(krebs-private "brain")
|
||||
|
||||
(public "painload")
|
||||
(public "shitment")
|
||||
(public "wai-middleware-time")
|
||||
(public "web-routes-wai-custom")
|
||||
|
||||
(secret "pass")
|
||||
|
||||
(tv-lass "emse-drywall")
|
||||
(tv-lass "emse-hsdb")
|
||||
];
|
||||
|
||||
users = addNames {
|
||||
tv = { pubkey = readFile ../../Zpubkeys/tv_wu.ssh.pub; };
|
||||
lass = { pubkey = readFile ../../Zpubkeys/lass.ssh.pub; };
|
||||
uriel = { pubkey = readFile ../../Zpubkeys/uriel.ssh.pub; };
|
||||
makefu = { pubkey = readFile ../../Zpubkeys/makefu.ssh.pub; };
|
||||
};
|
||||
|
||||
repos = listToAttrs (map ({ repo, ... }: { name = repo.name; value = repo; }) x-repos);
|
||||
|
||||
rules = concatMap ({ rules, ... }: rules) x-repos;
|
||||
|
||||
krebs-private = repo-name:
|
||||
rec {
|
||||
repo = {
|
||||
name = repo-name;
|
||||
hooks = {
|
||||
post-receive = git.irc-announce {
|
||||
nick = config.networking.hostName; # TODO make this the default
|
||||
channel = "#retiolum";
|
||||
server = "ire.retiolum";
|
||||
};
|
||||
};
|
||||
};
|
||||
rules = with git; with users; [
|
||||
{ user = lass;
|
||||
repo = [ repo ];
|
||||
perm = push "refs/*" [ non-fast-forward create delete merge ];
|
||||
}
|
||||
{ user = [ tv makefu uriel ];
|
||||
repo = [ repo ];
|
||||
perm = fetch;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
public = repo-name:
|
||||
rec {
|
||||
repo = {
|
||||
name = repo-name;
|
||||
hooks = {
|
||||
post-receive = git.irc-announce {
|
||||
nick = config.networking.hostName; # TODO make this the default
|
||||
channel = "#retiolum";
|
||||
server = "ire.retiolum";
|
||||
};
|
||||
};
|
||||
public = true;
|
||||
};
|
||||
rules = with git; with users; [
|
||||
{ user = lass;
|
||||
repo = [ repo ];
|
||||
perm = push "refs/*" [ non-fast-forward create delete merge ];
|
||||
}
|
||||
{ user = [ tv makefu uriel ];
|
||||
repo = [ repo ];
|
||||
perm = fetch;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
secret = repo-name:
|
||||
rec {
|
||||
repo = {
|
||||
name = repo-name;
|
||||
hooks = {};
|
||||
};
|
||||
rules = with git; with users; [
|
||||
{ user = lass;
|
||||
repo = [ repo ];
|
||||
perm = push "refs/*" [ non-fast-forward create delete merge ];
|
||||
}
|
||||
{ user = [ uriel ];
|
||||
repo = [ repo ];
|
||||
perm = fetch;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
tv-lass = repo-name:
|
||||
rec {
|
||||
repo = {
|
||||
name = repo-name;
|
||||
hooks = {};
|
||||
};
|
||||
rules = with git; with users; [
|
||||
{ user = lass;
|
||||
repo = [ repo ];
|
||||
perm = push "refs/*" [ non-fast-forward create delete merge ];
|
||||
}
|
||||
{ user = [ tv ];
|
||||
repo = [ repo ];
|
||||
perm = fetch;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
in
|
||||
|
||||
{
|
||||
imports = [
|
||||
../../3modules/tv/git.nix
|
||||
../../3modules/lass/iptables.nix
|
||||
];
|
||||
|
||||
tv.git = {
|
||||
enable = true;
|
||||
inherit repos rules users;
|
||||
};
|
||||
|
||||
lass.iptables = {
|
||||
tables = {
|
||||
filter.INPUT.rules = [
|
||||
{ predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; }
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
@ -1,21 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
../tv/retiolum
|
||||
];
|
||||
|
||||
tv.retiolum = {
|
||||
enable = true;
|
||||
hosts = <retiolum-hosts>;
|
||||
privateKeyFile = "/etc/nixos/secrets/mors.retiolum.rsa_key.priv";
|
||||
connectTo = [
|
||||
"fastpoke"
|
||||
"gum"
|
||||
"ire"
|
||||
];
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 655 ];
|
||||
networking.firewall.allowedUDPPorts = [ 655 ];
|
||||
}
|
||||
@ -7,7 +7,7 @@ let
|
||||
modules = map (p: ./. + "/${p}") [
|
||||
"${user-name}/1systems/${system-name}.nix"
|
||||
"${user-name}/3modules"
|
||||
"3modules/krebs"
|
||||
"krebs/3modules"
|
||||
];
|
||||
};
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
{ config, lib, ... }:
|
||||
|
||||
with import ../../4lib/krebs { inherit lib; };
|
||||
with import ../4lib { inherit lib; };
|
||||
let
|
||||
cfg = config.krebs;
|
||||
|
||||
@ -188,6 +188,87 @@ let
|
||||
|
||||
lass-imp = {
|
||||
hosts = addNames {
|
||||
cloudkrebs = {
|
||||
cores = 1;
|
||||
dc = "lass"; #dc = "cac";
|
||||
nets = rec {
|
||||
internet = {
|
||||
addrs4 = ["104.167.113.104"];
|
||||
aliases = [
|
||||
"cloudkrebs.internet"
|
||||
];
|
||||
};
|
||||
retiolum = {
|
||||
via = internet;
|
||||
addrs4 = ["10.243.206.102"];
|
||||
addrs6 = ["42:941e:2816:35f4:5c5e:206b:3f0b:f762"];
|
||||
aliases = [
|
||||
"cloudkrebs.retiolum"
|
||||
"cgit.cloudkrebs.retiolum"
|
||||
];
|
||||
tinc.pubkey = ''
|
||||
-----BEGIN RSA PUBLIC KEY-----
|
||||
MIIBCgKCAQEAttUygCu7G6lIA9y+9rfTpLKIy2UgNDglUVoKZYLs8JPjtAtQVbtA
|
||||
OcWwwPc8ijLQvwJWa8e/shqSzSIrtOe+HJbRGdXLdBLtOuLKpz+ZFHcS+95RS5aF
|
||||
QTehg+QY7pvhbrrwKX936tkMR568suTQG6C8qNC/5jWYO/wIxFMhnQ2iRRKQOq1v
|
||||
3aGGPC16KeXKVioY9KoV98S3n1rZW1JK07CIsZU4qb5txtLlW6FplJ7UmhVku1WC
|
||||
sgOOj9yi6Zk1t8R2Pwv9gxa3Hc270voj5U+I2hgLV/LjheE8yhQgYHEA4vXerPdO
|
||||
TGSATlSmMtE2NYGrKsLM7pKn286aSpXinwIDAQAB
|
||||
-----END RSA PUBLIC KEY-----
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
uriel = {
|
||||
cores = 1;
|
||||
dc = "lass";
|
||||
nets = rec {
|
||||
retiolum = {
|
||||
addrs4 = ["10.243.81.176"];
|
||||
addrs6 = ["42:dc25:60cf:94ef:759b:d2b6:98a9:2e56"];
|
||||
aliases = [
|
||||
"uriel.retiolum"
|
||||
"cgit.uriel.retiolum"
|
||||
];
|
||||
tinc.pubkey = ''
|
||||
-----BEGIN RSA PUBLIC KEY-----
|
||||
MIIBCgKCAQEAzw0pvoEmqeqiZrzSOPH0IT99gr1rrvMZbvabXoU4MAiVgGoGrkmR
|
||||
duJkk8Fj12ftMc+Of1gnwDkFhRcfAKOeH1RSc4CTircWVq99WyecTwEZoaR/goQb
|
||||
MND022kIBoG6NQNxv1Y5I1B/h7hfloMFEPym9oFtOAXoGhBY2vVl4g64NNz+RLME
|
||||
m1RipLXKANAh6LRNPGPQCUYX4TVY2ZJVxM3CM1XdomUAdOYXJmWFyUg9NcIKaacx
|
||||
uRrmuy7J9yFBcihZX5Y7NV361kINrpRmZYxJRf9cr0hb5EkJJ7bMIKQMEFQ5RnYo
|
||||
u7MPGKD7aNHa6hLLCeIfJ5u0igVmSLh3pwIDAQAB
|
||||
-----END RSA PUBLIC KEY-----
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
mors = {
|
||||
cores = 2;
|
||||
dc = "lass";
|
||||
nets = rec {
|
||||
retiolum = {
|
||||
addrs4 = ["10.243.0.2"];
|
||||
addrs6 = ["42:0:0:0:0:0:0:dea7"];
|
||||
aliases = [
|
||||
"mors.retiolum"
|
||||
"cgit.mors.retiolum"
|
||||
];
|
||||
tinc.pubkey = ''
|
||||
-----BEGIN RSA PUBLIC KEY-----
|
||||
MIIBCgKCAQEAsj1PCibKOfF68gmFQ+wwyfhUWpqKqpznrJX1dZ+daae7l7nBHvsE
|
||||
H0QwkiMmk3aZy1beq3quM6gX13aT+/wMfWnLyuvT11T5C9JEf/IS91STpM2BRN+R
|
||||
+P/DhbuDcW4UsdEe6uwQDGEJbXRN5ZA7GI0bmcYcwHJ9SQmW5v7P9Z3oZ+09hMD+
|
||||
1cZ3HkPN7weSdMLMPpUpmzCsI92cXGW0xRC4iBEt1ZeBwjkLCRsBFBGcUMuKWwVa
|
||||
9sovca0q3DUar+kikEKVrVy26rZUlGuBLobMetDGioSawWkRSxVlfZvTHjAK5JzU
|
||||
O6y6hj0yQ1sp6W2JjU8ntDHf63aM71dB9QIDAQAB
|
||||
-----END RSA PUBLIC KEY-----
|
||||
'';
|
||||
};
|
||||
};
|
||||
secure = true;
|
||||
};
|
||||
|
||||
};
|
||||
users = addNames {
|
||||
lass = {
|
||||
@ -6,15 +6,11 @@
|
||||
# TODO when authorized_keys changes, then restart ssh
|
||||
# (or kill already connected users somehow)
|
||||
|
||||
with import ../../4lib/krebs { inherit lib; };
|
||||
with import ../4lib { inherit lib; };
|
||||
let
|
||||
cfg = config.krebs.git;
|
||||
|
||||
out = {
|
||||
# TODO don't import krebs.nginx here
|
||||
imports = [
|
||||
../../3modules/krebs/nginx.nix
|
||||
];
|
||||
options.krebs.git = api;
|
||||
config = mkIf cfg.enable (mkMerge [
|
||||
(mkIf cfg.cgit cgit-imp)
|
||||
@ -61,9 +61,9 @@ let
|
||||
${cfg.ssh-identity-file} \
|
||||
"$ssh_identity_file_target"
|
||||
|
||||
ln -snf ${Zpkgs.github-known_hosts} ${cfg.dataDir}/.ssh/known_hosts
|
||||
ln -snf ${kpkgs.github-known_hosts} ${cfg.dataDir}/.ssh/known_hosts
|
||||
'';
|
||||
ExecStart = "${Zpkgs.github-hosts-sync}/bin/github-hosts-sync";
|
||||
ExecStart = "${kpkgs.github-hosts-sync}/bin/github-hosts-sync";
|
||||
};
|
||||
};
|
||||
|
||||
@ -78,6 +78,6 @@ let
|
||||
uid = 3220554646; # genid github-hosts-sync
|
||||
};
|
||||
|
||||
Zpkgs = import ../../Zpkgs/krebs { inherit pkgs; };
|
||||
kpkgs = import ../../krebs/5pkgs { inherit pkgs; };
|
||||
in
|
||||
out
|
||||
46
lass/1systems/cloudkrebs.nix
Normal file
46
lass/1systems/cloudkrebs.nix
Normal file
@ -0,0 +1,46 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
../../2configs/tv/CAC-Developer-2.nix
|
||||
../../2configs/tv/CAC-CentOS-7-64bit.nix
|
||||
../../2configs/lass/base.nix
|
||||
../../2configs/lass/retiolum.nix
|
||||
../../2configs/lass/fastpoke-pages.nix
|
||||
../../2configs/lass/new-repos.nix
|
||||
{
|
||||
networking.interfaces.enp2s1.ip4 = [
|
||||
{
|
||||
address = "104.167.113.104";
|
||||
prefixLength = 24;
|
||||
}
|
||||
];
|
||||
networking.defaultGateway = "104.167.113.1";
|
||||
networking.nameservers = [
|
||||
"8.8.8.8"
|
||||
];
|
||||
|
||||
}
|
||||
];
|
||||
|
||||
krebs.build = {
|
||||
user = config.krebs.users.lass;
|
||||
target = "root@cloudkrebs";
|
||||
host = config.krebs.hosts.cloudkrebs;
|
||||
deps = {
|
||||
nixpkgs = {
|
||||
url = https://github.com/Lassulus/nixpkgs;
|
||||
rev = "1879a011925c561f0a7fd4043da0768bbff41d0b";
|
||||
};
|
||||
secrets = {
|
||||
url = "/home/lass/secrets/${config.krebs.build.host.name}";
|
||||
};
|
||||
stockholm = {
|
||||
url = toString ../..;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.hostName = "cloudkrebs";
|
||||
|
||||
}
|
||||
@ -2,45 +2,44 @@
|
||||
|
||||
{
|
||||
imports = [
|
||||
../../2configs/lass/desktop-base.nix
|
||||
../../2configs/lass/programs.nix
|
||||
../../2configs/lass/bitcoin.nix
|
||||
../../2configs/lass/browsers.nix
|
||||
../../2configs/lass/games.nix
|
||||
../../2configs/lass/pass.nix
|
||||
../../2configs/lass/vim.nix
|
||||
../../2configs/lass/virtualbox.nix
|
||||
../../2configs/lass/elster.nix
|
||||
../../2configs/lass/urxvt.nix
|
||||
../../2configs/lass/steam.nix
|
||||
../../2configs/lass/wine.nix
|
||||
../../2configs/lass/texlive.nix
|
||||
../../2configs/lass/binary-caches.nix
|
||||
../../2configs/lass/ircd.nix
|
||||
../../2configs/lass/chromium-patched.nix
|
||||
../../2configs/lass/git-repos.nix
|
||||
../../2configs/tv/synaptics.nix
|
||||
../../2configs/tv/exim-retiolum.nix
|
||||
{
|
||||
imports = [ ../../3modules/tv/retiolum.nix ];
|
||||
tv.retiolum = {
|
||||
enable = true;
|
||||
hosts = ../../Zhosts;
|
||||
connectTo = [
|
||||
"fastpoke"
|
||||
"gum"
|
||||
"pigstarter"
|
||||
];
|
||||
};
|
||||
}
|
||||
{
|
||||
imports = [ ../../3modules/tv/identity.nix ];
|
||||
tv.identity = {
|
||||
enable = true;
|
||||
};
|
||||
}
|
||||
../2configs/desktop-base.nix
|
||||
../2configs/programs.nix
|
||||
../2configs/bitcoin.nix
|
||||
../2configs/browsers.nix
|
||||
../2configs/games.nix
|
||||
../2configs/pass.nix
|
||||
../2configs/virtualbox.nix
|
||||
../2configs/elster.nix
|
||||
../2configs/urxvt.nix
|
||||
../2configs/steam.nix
|
||||
../2configs/wine.nix
|
||||
../2configs/texlive.nix
|
||||
../2configs/binary-caches.nix
|
||||
../2configs/ircd.nix
|
||||
../2configs/chromium-patched.nix
|
||||
../2configs/new-repos.nix
|
||||
#../../2configs/tv/synaptics.nix
|
||||
../2configs/retiolum.nix
|
||||
];
|
||||
|
||||
krebs.build = {
|
||||
user = config.krebs.users.lass;
|
||||
target = "root@mors";
|
||||
host = config.krebs.hosts.mors;
|
||||
deps = {
|
||||
nixpkgs = {
|
||||
url = https://github.com/Lassulus/nixpkgs;
|
||||
rev = "1879a011925c561f0a7fd4043da0768bbff41d0b";
|
||||
};
|
||||
secrets = {
|
||||
url = "/home/lass/secrets/${config.krebs.build.host.name}";
|
||||
};
|
||||
stockholm = {
|
||||
url = toString ../..;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.hostName = "mors";
|
||||
networking.wireless.enable = true;
|
||||
|
||||
@ -168,21 +167,6 @@
|
||||
'';
|
||||
};
|
||||
|
||||
users.extraUsers = {
|
||||
#main user
|
||||
mainUser = {
|
||||
uid = 1337;
|
||||
name = "lass";
|
||||
#isNormalUser = true;
|
||||
group = "users";
|
||||
createHome = true;
|
||||
home = "/home/lass";
|
||||
useDefaultShell = true;
|
||||
isSystemUser = false;
|
||||
extraGroups = [ "wheel" "audio" ];
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
];
|
||||
|
||||
@ -217,4 +201,12 @@
|
||||
services.mongodb = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
lass.iptables = {
|
||||
tables = {
|
||||
filter.INPUT.rules = [
|
||||
{ predicate = "-p tcp --dport 8000"; target = "ACCEPT"; precedence = 9001; }
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
@ -1,38 +1,48 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
with builtins;
|
||||
{
|
||||
imports = [
|
||||
../../2configs/lass/desktop-base.nix
|
||||
../../2configs/lass/browsers.nix
|
||||
../../2configs/lass/games.nix
|
||||
../../2configs/lass/pass.nix
|
||||
../../2configs/lass/vim.nix
|
||||
../../2configs/lass/urxvt.nix
|
||||
../../2configs/lass/bird.nix
|
||||
../../2configs/lass/git-repos.nix
|
||||
../../2configs/lass/new-repos.nix
|
||||
../../2configs/lass/chromium-patched.nix
|
||||
../../2configs/tv/exim-retiolum.nix
|
||||
../../2configs/lass/retiolum.nix
|
||||
{
|
||||
imports = [ ../../3modules/tv/retiolum.nix ];
|
||||
tv.retiolum = {
|
||||
enable = true;
|
||||
hosts = ../../Zhosts;
|
||||
connectTo = [
|
||||
"fastpoke"
|
||||
"gum"
|
||||
"pigstarter"
|
||||
];
|
||||
};
|
||||
}
|
||||
{
|
||||
imports = [ ../../3modules/tv/identity.nix ];
|
||||
tv.identity = {
|
||||
enable = true;
|
||||
users.extraUsers = {
|
||||
root = {
|
||||
openssh.authorizedKeys.keys = map readFile [
|
||||
../../Zpubkeys/uriel.ssh.pub
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
];
|
||||
|
||||
krebs.build = {
|
||||
user = config.krebs.users.lass;
|
||||
target = "root@uriel";
|
||||
host = config.krebs.hosts.uriel;
|
||||
deps = {
|
||||
nixpkgs = {
|
||||
url = https://github.com/Lassulus/nixpkgs;
|
||||
rev = "961fcbabd7643171ea74bd550fee1ce5c13c2e90";
|
||||
};
|
||||
secrets = {
|
||||
url = "/home/lass/secrets/${config.krebs.build.host.name}";
|
||||
};
|
||||
stockholm = {
|
||||
url = toString ../..;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.hostName = "uriel";
|
||||
|
||||
networking.wireless.enable = true;
|
||||
nix.maxJobs = 2;
|
||||
|
||||
@ -87,29 +97,6 @@
|
||||
'';
|
||||
};
|
||||
|
||||
users.extraUsers = {
|
||||
root = {
|
||||
openssh.authorizedKeys.keys = [
|
||||
config.sshKeys.lass.pub
|
||||
];
|
||||
};
|
||||
mainUser = {
|
||||
uid = 1337;
|
||||
name = "lass";
|
||||
#isNormalUser = true;
|
||||
group = "users";
|
||||
createHome = true;
|
||||
home = "/home/lass";
|
||||
useDefaultShell = true;
|
||||
isSystemUser = false;
|
||||
description = "lassulus";
|
||||
extraGroups = [ "wheel" "audio" ];
|
||||
openssh.authorizedKeys.keys = [
|
||||
config.sshKeys.lass.pub
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
];
|
||||
|
||||
@ -3,16 +3,44 @@
|
||||
with lib;
|
||||
{
|
||||
imports = [
|
||||
./sshkeys.nix
|
||||
../../3modules/lass/iptables.nix
|
||||
../3modules/iptables.nix
|
||||
../2configs/vim.nix
|
||||
{
|
||||
users.extraUsers =
|
||||
mapAttrs (_: h: { hashedPassword = h; })
|
||||
(import /root/src/secrets/hashedPasswords.nix);
|
||||
}
|
||||
|
||||
{
|
||||
users.extraUsers = {
|
||||
root = {
|
||||
openssh.authorizedKeys.keys = map readFile [
|
||||
../../Zpubkeys/lass.ssh.pub
|
||||
];
|
||||
};
|
||||
mainUser = {
|
||||
name = "lass";
|
||||
uid = 1337;
|
||||
home = "/home/lass";
|
||||
group = "users";
|
||||
createHome = true;
|
||||
useDefaultShell = true;
|
||||
extraGroups = [
|
||||
"audio"
|
||||
"wheel"
|
||||
];
|
||||
openssh.authorizedKeys.keys = map readFile [
|
||||
../../Zpubkeys/lass.ssh.pub
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
];
|
||||
|
||||
krebs = {
|
||||
enable = true;
|
||||
search-domain = "retiolum";
|
||||
};
|
||||
|
||||
nix.useChroot = true;
|
||||
|
||||
users.mutableUsers = false;
|
||||
@ -30,6 +58,8 @@ with lib;
|
||||
'';
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
nmap
|
||||
|
||||
git
|
||||
most
|
||||
rxvt_unicode.terminfo
|
||||
@ -77,11 +107,11 @@ with lib;
|
||||
"sendmail"
|
||||
];
|
||||
|
||||
services.gitolite = {
|
||||
enable = true;
|
||||
dataDir = "/home/gitolite";
|
||||
adminPubkey = config.sshKeys.lass.pub;
|
||||
};
|
||||
#services.gitolite = {
|
||||
# enable = true;
|
||||
# dataDir = "/home/gitolite";
|
||||
# adminPubkey = config.sshKeys.lass.pub;
|
||||
#};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
@ -102,35 +132,12 @@ with lib;
|
||||
filter.INPUT.policy = "DROP";
|
||||
filter.FORWARD.policy = "DROP";
|
||||
filter.INPUT.rules = [
|
||||
{ predicate = "-i lo"; target = "ACCEPT"; }
|
||||
{ predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
|
||||
{ predicate = "-p icmp"; target = "ACCEPT"; }
|
||||
{ predicate = "-p tcp --dport 22"; target = "ACCEPT"; }
|
||||
{ predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; precedence = 10001; }
|
||||
{ predicate = "-p icmp"; target = "ACCEPT"; precedence = 10000; }
|
||||
{ predicate = "-i lo"; target = "ACCEPT"; precedence = 9999; }
|
||||
{ predicate = "-p tcp --dport 22"; target = "ACCEPT"; precedence = 9998; }
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
#Networking.firewall = {
|
||||
# enable = true;
|
||||
|
||||
# allowedTCPPorts = [
|
||||
# 22
|
||||
# ];
|
||||
|
||||
# extraCommands = ''
|
||||
# iptables -A INPUT -j ACCEPT -m conntrack --ctstate RELATED,ESTABLISHED
|
||||
# iptables -A INPUT -j ACCEPT -i lo
|
||||
# #http://serverfault.com/questions/84963/why-not-block-icmp
|
||||
# iptables -A INPUT -j ACCEPT -p icmp
|
||||
|
||||
# #TODO: fix Retiolum firewall
|
||||
# #iptables -N RETIOLUM
|
||||
# #iptables -A INPUT -j RETIOLUM -i retiolum
|
||||
# #iptables -A RETIOLUM -j ACCEPT -m conntrack --ctstate RELATED,ESTABLISHED
|
||||
# #iptables -A RETIOLUM -j REJECT -p tcp --reject-with tcp-reset
|
||||
# #iptables -A RETIOLUM -j REJECT -p udp --reject-with icmp-port-unreachable
|
||||
# #iptables -A RETIOLUM -j REJECT --reject-with icmp-proto-unreachable
|
||||
# #iptables -A RETIOLUM -j REJECT
|
||||
# '';
|
||||
#};
|
||||
}
|
||||
@ -55,11 +55,9 @@ in {
|
||||
displayManager.auto.enable = true;
|
||||
displayManager.auto.user = mainUser.name;
|
||||
|
||||
layout = "us,de";
|
||||
layout = "us";
|
||||
xkbModel = "evdev";
|
||||
xkbVariant = "altgr-intl,nodeadkeys";
|
||||
xkbOptions = "grp:caps_toggle";
|
||||
|
||||
xkbVariant = "altgr-intl";
|
||||
};
|
||||
|
||||
}
|
||||
97
lass/2configs/fastpoke-pages.nix
Normal file
97
lass/2configs/fastpoke-pages.nix
Normal file
@ -0,0 +1,97 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
createStaticPage = domain:
|
||||
{
|
||||
krebs.nginx.servers."${domain}" = {
|
||||
server-names = [
|
||||
"${domain}"
|
||||
"www.${domain}"
|
||||
];
|
||||
locations = [
|
||||
(nameValuePair "/" ''
|
||||
root /var/lib/http/${domain};
|
||||
'')
|
||||
];
|
||||
};
|
||||
#networking.extraHosts = ''
|
||||
# 10.243.206.102 ${domain}
|
||||
#'';
|
||||
};
|
||||
|
||||
in {
|
||||
imports = [
|
||||
../../3modules/lass/iptables.nix
|
||||
] ++ map createStaticPage [
|
||||
"habsys.de"
|
||||
"pixelpocket.de"
|
||||
"karlaskop.de"
|
||||
"ubikmedia.de"
|
||||
"apanowicz.de"
|
||||
];
|
||||
|
||||
lass.iptables = {
|
||||
tables = {
|
||||
filter.INPUT.rules = [
|
||||
{ predicate = "-p tcp --dport http"; target = "ACCEPT"; }
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
krebs.nginx = {
|
||||
enable = true;
|
||||
servers = {
|
||||
|
||||
#"habsys.de" = {
|
||||
# server-names = [
|
||||
# "habsys.de"
|
||||
# "www.habsys.de"
|
||||
# ];
|
||||
# locations = [
|
||||
# (nameValuePair "/" ''
|
||||
# root /var/lib/http/habsys.de;
|
||||
# '')
|
||||
# ];
|
||||
#};
|
||||
|
||||
#"karlaskop.de" = {
|
||||
# server-names = [
|
||||
# "karlaskop.de"
|
||||
# "www.karlaskop.de"
|
||||
# ];
|
||||
# locations = [
|
||||
# (nameValuePair "/" ''
|
||||
# root /var/lib/http/karlaskop.de;
|
||||
# '')
|
||||
# ];
|
||||
#};
|
||||
|
||||
#"pixelpocket.de" = {
|
||||
# server-names = [
|
||||
# "pixelpocket.de"
|
||||
# "www.karlaskop.de"
|
||||
# ];
|
||||
# locations = [
|
||||
# (nameValuePair "/" ''
|
||||
# root /var/lib/http/karlaskop.de;
|
||||
# '')
|
||||
# ];
|
||||
#};
|
||||
|
||||
};
|
||||
};
|
||||
|
||||
#services.postgresql = {
|
||||
# enable = true;
|
||||
#};
|
||||
|
||||
#config.services.vsftpd = {
|
||||
# enable = true;
|
||||
# userlistEnable = true;
|
||||
# userlistFile = pkgs.writeFile "vsftpd-userlist" ''
|
||||
# '';
|
||||
#};
|
||||
}
|
||||
50
lass/2configs/identity.nix
Normal file
50
lass/2configs/identity.nix
Normal file
@ -0,0 +1,50 @@
|
||||
{ config, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
../../tv/3modules/identity.nix
|
||||
];
|
||||
tv.identity = {
|
||||
enable = true;
|
||||
search = "retiolum";
|
||||
hosts = {
|
||||
cloudkrebs = {
|
||||
cores = 1;
|
||||
dc = "lass"; #dc = "cac";
|
||||
nets = rec {
|
||||
internet = {
|
||||
addrs4 = ["104.167.113.104"];
|
||||
aliases = [
|
||||
"cloudkrebs.internet"
|
||||
];
|
||||
};
|
||||
retiolum = {
|
||||
via = internet;
|
||||
addrs4 = ["10.243.206.102"];
|
||||
addrs6 = ["42:941e:2816:35f4:5c5e:206b:3f0b:f762"];
|
||||
aliases = [
|
||||
"cloudkrebs.retiolum"
|
||||
"cgit.cloudkrebs.retiolum"
|
||||
"habsys.de"
|
||||
"pixelpocket.de"
|
||||
"karlaskop.de"
|
||||
"ubikmedia.de"
|
||||
"apanowicz.de"
|
||||
"aidsballs.de"
|
||||
];
|
||||
tinc.pubkey = ''
|
||||
-----BEGIN RSA PUBLIC KEY-----
|
||||
MIIBCgKCAQEAttUygCu7G6lIA9y+9rfTpLKIy2UgNDglUVoKZYLs8JPjtAtQVbtA
|
||||
OcWwwPc8ijLQvwJWa8e/shqSzSIrtOe+HJbRGdXLdBLtOuLKpz+ZFHcS+95RS5aF
|
||||
QTehg+QY7pvhbrrwKX936tkMR568suTQG6C8qNC/5jWYO/wIxFMhnQ2iRRKQOq1v
|
||||
3aGGPC16KeXKVioY9KoV98S3n1rZW1JK07CIsZU4qb5txtLlW6FplJ7UmhVku1WC
|
||||
sgOOj9yi6Zk1t8R2Pwv9gxa3Hc270voj5U+I2hgLV/LjheE8yhQgYHEA4vXerPdO
|
||||
TGSATlSmMtE2NYGrKsLM7pKn286aSpXinwIDAQAB
|
||||
-----END RSA PUBLIC KEY-----
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
77
lass/2configs/new-repos.nix
Normal file
77
lass/2configs/new-repos.nix
Normal file
@ -0,0 +1,77 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with import ../../tv/4lib { inherit lib pkgs; };
|
||||
let
|
||||
|
||||
out = {
|
||||
krebs.git = {
|
||||
enable = true;
|
||||
root-title = "public repositories at ${config.krebs.build.host.name}";
|
||||
root-desc = "keep calm and engage";
|
||||
inherit repos rules;
|
||||
};
|
||||
};
|
||||
|
||||
repos = mapAttrs (_: s: removeAttrs s ["collaborators"]) (
|
||||
public-repos //
|
||||
optionalAttrs config.krebs.build.host.secure restricted-repos
|
||||
);
|
||||
|
||||
rules = concatMap make-rules (attrValues repos);
|
||||
|
||||
public-repos = mapAttrs make-public-repo {
|
||||
painload = {};
|
||||
stockholm = {
|
||||
desc = "take all the computers hostage, they'll love you!";
|
||||
};
|
||||
wai-middleware-time = {};
|
||||
web-routes-wai-custom = {};
|
||||
};
|
||||
|
||||
restricted-repos = mapAttrs make-restricted-repo (
|
||||
{
|
||||
brain = {
|
||||
collaborators = with config.krebs.users; [ tv makefu ];
|
||||
};
|
||||
} //
|
||||
import /root/src/secrets/repos.nix { inherit config lib pkgs; }
|
||||
);
|
||||
|
||||
make-public-repo = name: { desc ? null, ... }: {
|
||||
inherit name desc;
|
||||
public = true;
|
||||
hooks = {
|
||||
post-receive = git.irc-announce {
|
||||
# TODO make nick = config.krebs.build.host.name the default
|
||||
nick = config.krebs.build.host.name;
|
||||
channel = "#retiolum";
|
||||
server = "cd.retiolum";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
make-restricted-repo = name: { desc ? null, ... }: {
|
||||
inherit name desc;
|
||||
public = false;
|
||||
};
|
||||
|
||||
make-rules =
|
||||
with git // config.krebs.users;
|
||||
repo:
|
||||
singleton {
|
||||
user = lass;
|
||||
repo = [ repo ];
|
||||
perm = push "refs/*" [ non-fast-forward create delete merge ];
|
||||
} ++
|
||||
optional repo.public {
|
||||
user = [ tv makefu uriel ];
|
||||
repo = [ repo ];
|
||||
perm = fetch;
|
||||
} ++
|
||||
optional (length (repo.collaborators or []) > 0) {
|
||||
user = repo.collaborators;
|
||||
repo = [ repo ];
|
||||
perm = fetch;
|
||||
};
|
||||
|
||||
in out
|
||||
28
lass/2configs/retiolum.nix
Normal file
28
lass/2configs/retiolum.nix
Normal file
@ -0,0 +1,28 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
../3modules/iptables.nix
|
||||
../../tv/2configs/exim-retiolum.nix
|
||||
];
|
||||
|
||||
lass.iptables = {
|
||||
tables = {
|
||||
filter.INPUT.rules = [
|
||||
{ predicate = "-p tcp --dport smtp"; target = "ACCEPT"; }
|
||||
{ predicate = "-p tcp --dport tinc"; target = "ACCEPT"; }
|
||||
{ predicate = "-p udp --dport tinc"; target = "ACCEPT"; }
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
krebs.retiolum = {
|
||||
enable = true;
|
||||
hosts = ../../Zhosts;
|
||||
connectTo = [
|
||||
"fastpoke"
|
||||
"cloudkrebs"
|
||||
"pigstarter"
|
||||
];
|
||||
};
|
||||
}
|
||||
@ -2,7 +2,7 @@
|
||||
|
||||
{
|
||||
imports = [
|
||||
../../3modules/lass/sshkeys.nix
|
||||
../3modules/sshkeys.nix
|
||||
];
|
||||
|
||||
config.sshKeys.lass.pub = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAp83zynhIueJJsWlSEykVSBrrgBFKq38+vT8bRfa+csqyjZBl2SQFuCPo+Qbh49mwchpZRshBa9jQEIGqmXxv/PYdfBFQuOFgyUq9ZcTZUXqeynicg/SyOYFW86iiqYralIAkuGPfQ4howLPVyjTZtWeEeeEttom6p6LMY5Aumjz2em0FG0n9rRFY2fBzrdYAgk9C0N6ojCs/Gzknk9SGntA96MDqHJ1HXWFMfmwOLCnxtE5TY30MqSmkrJb7Fsejwjoqoe9Y/mCaR0LpG2cStC1+37GbHJNH0caCMaQCX8qdfgMVbWTVeFWtV6aWOaRgwLrPDYn4cHWQJqTfhtPrNQ== lass@mors";
|
||||
@ -7,8 +7,8 @@ in
|
||||
|
||||
{
|
||||
imports = [
|
||||
../../3modules/lass/urxvtd.nix
|
||||
../../3modules/lass/xresources.nix
|
||||
../3modules/urxvtd.nix
|
||||
../3modules/xresources.nix
|
||||
];
|
||||
|
||||
services.urxvtd = {
|
||||
8
lass/3modules/default.nix
Normal file
8
lass/3modules/default.nix
Normal file
@ -0,0 +1,8 @@
|
||||
_:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./xresources.nix
|
||||
./iptables.nix
|
||||
];
|
||||
}
|
||||
@ -106,7 +106,7 @@ let
|
||||
|
||||
buildChain = tn: cn:
|
||||
let
|
||||
sortedRules = sort (a: b: a.precedence < b.precedence) ts."${tn}"."${cn}".rules;
|
||||
sortedRules = sort (a: b: a.precedence > b.precedence) ts."${tn}"."${cn}".rules;
|
||||
|
||||
in
|
||||
#TODO: double check should be unneccessary, refactor!
|
||||
@ -12,7 +12,7 @@ with lib;
|
||||
|
||||
let
|
||||
|
||||
inherit (import ../../4lib/tv { inherit pkgs lib; }) shell-escape;
|
||||
inherit (import ../../tv/4lib { inherit pkgs lib; }) shell-escape;
|
||||
inherit (pkgs) writeScript;
|
||||
|
||||
in
|
||||
@ -1,7 +1,7 @@
|
||||
{ lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
krebs = import ../../4lib/krebs { inherit lib; };
|
||||
krebs = import ../../krebs/4lib { inherit lib; };
|
||||
in
|
||||
|
||||
with krebs;
|
||||
|
||||
@ -2,10 +2,10 @@
|
||||
|
||||
let
|
||||
inherit (pkgs) callPackage;
|
||||
krebs = import ../../Zpkgs/krebs { inherit pkgs; };
|
||||
kpkgs = import ../../krebs/5pkgs { inherit pkgs; };
|
||||
in
|
||||
|
||||
krebs // {
|
||||
kpkgs // {
|
||||
charybdis = callPackage ./charybdis {};
|
||||
lentil = callPackage ./lentil {};
|
||||
much = callPackage ./much.nix {};
|
||||
|
||||
Loading…
Reference in New Issue
Block a user