Merge remote-tracking branch 'lass/master'
This commit is contained in:
makefu
commit
0ea25143c9
|
|
@ -37,7 +37,7 @@ let
|
|||
# TODO use the correct type
|
||||
type = with types; attrsOf unspecified;
|
||||
description = ''
|
||||
additional nginx configuration. see krebs.nginx for all options
|
||||
Additional nginx configuration.
|
||||
'';
|
||||
};
|
||||
secretKey = mkOption {
|
||||
|
|
|
|||
|
|
@ -78,7 +78,6 @@ let
|
|||
# stopAllBuilds = 'auth',
|
||||
# cancelPendingBuild = 'auth'
|
||||
#)
|
||||
# TODO: configure krebs.nginx
|
||||
c['www'] = dict(
|
||||
port = ${toString cfg.web.port},
|
||||
plugins = { 'waterfall_view':{}, 'console_view':{} }
|
||||
|
|
|
|||
|
|
@ -26,7 +26,6 @@ let
|
|||
./kapacitor.nix
|
||||
./monit.nix
|
||||
./newsbot-js.nix
|
||||
./nginx.nix
|
||||
./nixpkgs.nix
|
||||
./on-failure.nix
|
||||
./os-release.nix
|
||||
|
|
|
|||
|
|
@ -1,190 +0,0 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with import <stockholm/lib>;
|
||||
let
|
||||
cfg = config.krebs.nginx;
|
||||
|
||||
out = {
|
||||
options.krebs.nginx = api;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
};
|
||||
|
||||
api = {
|
||||
enable = mkEnableOption "krebs.nginx";
|
||||
|
||||
default404 = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
By default all requests not directed to an explicit hostname are
|
||||
replied with a 404 error to avoid accidental exposition of nginx
|
||||
services.
|
||||
|
||||
Set this value to `false` to disable this behavior - you will then be
|
||||
able to configure a new `default_server` in the listen address entries
|
||||
again.
|
||||
'';
|
||||
};
|
||||
|
||||
servers = mkOption {
|
||||
type = types.attrsOf (types.submodule {
|
||||
options = {
|
||||
server-names = mkOption {
|
||||
type = with types; listOf str;
|
||||
default =
|
||||
[config.krebs.build.host.name] ++
|
||||
concatMap (getAttr "aliases")
|
||||
(attrValues config.krebs.build.host.nets);
|
||||
};
|
||||
listen = mkOption {
|
||||
type = with types; either str (listOf str);
|
||||
default = "80";
|
||||
apply = x:
|
||||
if typeOf x != "list"
|
||||
then [x]
|
||||
else x;
|
||||
};
|
||||
locations = mkOption {
|
||||
type = with types; listOf (attrsOf str);
|
||||
default = [];
|
||||
};
|
||||
extraConfig = mkOption {
|
||||
type = with types; string;
|
||||
default = "";
|
||||
};
|
||||
ssl = mkOption {
|
||||
type = with types; submodule ({ config, ... }: {
|
||||
options = {
|
||||
enable = mkEnableOption "ssl";
|
||||
acmeEnable = mkOption {
|
||||
type = bool;
|
||||
apply = x:
|
||||
if x && config.enable
|
||||
#conflicts because of certificate/certificate_key location
|
||||
then throw "can't use ssl.enable and ssl.acmeEnable together"
|
||||
else x;
|
||||
default = false;
|
||||
description = ''
|
||||
enables automatical generation of lets-encrypt certificates and setting them as certificate
|
||||
conflicts with ssl.enable
|
||||
'';
|
||||
};
|
||||
certificate = mkOption {
|
||||
type = str;
|
||||
};
|
||||
certificate_key = mkOption {
|
||||
type = str;
|
||||
};
|
||||
#TODO: check for valid cipher
|
||||
ciphers = mkOption {
|
||||
type = str;
|
||||
default = "AES128+EECDH:AES128+EDH";
|
||||
};
|
||||
prefer_server_ciphers = mkOption {
|
||||
type = bool;
|
||||
default = true;
|
||||
};
|
||||
force_encryption = mkOption {
|
||||
type = bool;
|
||||
default = false;
|
||||
description = ''
|
||||
redirect all `http` traffic to the same domain but with ssl
|
||||
protocol.
|
||||
'';
|
||||
};
|
||||
protocols = mkOption {
|
||||
type = listOf (enum [ "SSLv2" "SSLv3" "TLSv1" "TLSv1.1" "TLSv1.2" ]);
|
||||
default = [ "TLSv1.1" "TLSv1.2" ];
|
||||
|
||||
};
|
||||
};
|
||||
});
|
||||
default = {};
|
||||
};
|
||||
};
|
||||
});
|
||||
default = {};
|
||||
};
|
||||
};
|
||||
|
||||
imp = {
|
||||
security.acme.certs = mapAttrs (_: to-acme) (filterAttrs (_: server: server.ssl.acmeEnable) cfg.servers);
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
httpConfig = ''
|
||||
default_type application/octet-stream;
|
||||
sendfile on;
|
||||
keepalive_timeout 65;
|
||||
gzip on;
|
||||
|
||||
${optionalString cfg.default404 ''
|
||||
server {
|
||||
listen 80 default_server;
|
||||
server_name _;
|
||||
return 404;
|
||||
}''}
|
||||
|
||||
${concatStrings (mapAttrsToList (_: to-server) cfg.servers)}
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
to-acme = { server-names, ssl, ... }:
|
||||
optionalAttrs ssl.acmeEnable {
|
||||
email = "lassulus@gmail.com";
|
||||
webroot = "${config.security.acme.directory}/${head server-names}";
|
||||
};
|
||||
|
||||
to-location = { name, value }: ''
|
||||
location ${name} {
|
||||
${indent value}
|
||||
}
|
||||
'';
|
||||
|
||||
to-server = { server-names, listen, locations, extraConfig, ssl, ... }: let
|
||||
domain = head server-names;
|
||||
acmeLocation = optionalAttrs ssl.acmeEnable (nameValuePair "/.well-known/acme-challenge" ''
|
||||
root ${config.security.acme.certs.${domain}.webroot};
|
||||
'');
|
||||
in ''
|
||||
server {
|
||||
server_name ${toString (unique server-names)};
|
||||
${concatMapStringsSep "\n" (x: indent "listen ${x};") listen}
|
||||
${optionalString ssl.enable (indent ''
|
||||
${optionalString ssl.force_encryption ''
|
||||
if ($scheme = http){
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
''}
|
||||
listen 443 ssl;
|
||||
ssl_certificate ${ssl.certificate};
|
||||
ssl_certificate_key ${ssl.certificate_key};
|
||||
${optionalString ssl.prefer_server_ciphers ''
|
||||
ssl_prefer_server_ciphers On;
|
||||
''}
|
||||
ssl_ciphers ${ssl.ciphers};
|
||||
ssl_protocols ${toString ssl.protocols};
|
||||
'')}
|
||||
${optionalString ssl.acmeEnable (indent ''
|
||||
${optionalString ssl.force_encryption ''
|
||||
if ($scheme = http){
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
''}
|
||||
listen 443 ssl;
|
||||
ssl_certificate ${config.security.acme.directory}/${domain}/fullchain.pem;
|
||||
ssl_certificate_key ${config.security.acme.directory}/${domain}/key.pem;
|
||||
${optionalString ssl.prefer_server_ciphers ''
|
||||
ssl_prefer_server_ciphers On;
|
||||
''}
|
||||
ssl_ciphers ${ssl.ciphers};
|
||||
ssl_protocols ${toString ssl.protocols};
|
||||
'')}
|
||||
${indent extraConfig}
|
||||
${optionalString ssl.acmeEnable (indent (to-location acmeLocation))}
|
||||
${indent (concatMapStrings to-location locations)}
|
||||
}
|
||||
'';
|
||||
|
||||
in
|
||||
out
|
||||
|
|
@ -1,53 +1,38 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
with import <stockholm/lib>;
|
||||
let
|
||||
cfg = config.krebs.retiolum-bootstrap;
|
||||
|
||||
out = {
|
||||
options.krebs.retiolum-bootstrap = api;
|
||||
config = lib.mkIf cfg.enable imp;
|
||||
};
|
||||
|
||||
api = {
|
||||
enable = mkEnableOption "retiolum boot strap for tinc.krebsco.de";
|
||||
hostname = mkOption {
|
||||
in
|
||||
{
|
||||
options.krebs.retiolum-bootstrap = {
|
||||
enable = mkEnableOption "retiolum boot strap for ${cfg.serverName}";
|
||||
serverName = mkOption {
|
||||
type = types.str;
|
||||
description = "hostname which serves tinc boot";
|
||||
default = "tinc.krebsco.de" ;
|
||||
};
|
||||
listen = mkOption {
|
||||
type = with types; listOf str;
|
||||
description = ''Addresses to listen on (nginx-syntax).
|
||||
ssl will be configured, http will be redirected to ssl.
|
||||
Make sure to have at least 1 ssl port configured.
|
||||
'';
|
||||
default = [ "80" "443 ssl" ] ;
|
||||
};
|
||||
ssl_certificate_key = mkOption {
|
||||
type = types.str;
|
||||
description = "Certificate key to use for ssl";
|
||||
default = "${toString <secrets>}/tinc.krebsco.de.key";
|
||||
};
|
||||
ssl_certificate = mkOption {
|
||||
sslCertificate = mkOption {
|
||||
type = types.str;
|
||||
description = "Certificate file to use for ssl";
|
||||
default = "${toString <secrets>}/tinc.krebsco.de.crt" ;
|
||||
};
|
||||
sslCertificateKey = mkOption {
|
||||
type = types.str;
|
||||
description = "Certificate key to use for ssl";
|
||||
default = "${toString <secrets>}/tinc.krebsco.de.key";
|
||||
};
|
||||
# in use:
|
||||
# <secrets/tinc.krebsco.de.crt>
|
||||
# <secrets/tinc.krebsco.de.key>
|
||||
};
|
||||
|
||||
imp = {
|
||||
krebs.nginx.servers = assert config.krebs.nginx.enable; {
|
||||
retiolum-boot-ssl = {
|
||||
server-names = singleton cfg.hostname;
|
||||
listen = cfg.listen;
|
||||
extraConfig = ''
|
||||
ssl_certificate ${cfg.ssl_certificate};
|
||||
ssl_certificate_key ${cfg.ssl_certificate_key};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
services.nginx = {
|
||||
enable = mkDefault true;
|
||||
virtualHosts.retiolum-bootstrap = {
|
||||
inherit (cfg) serverName sslCertificate sslCertificateKey;
|
||||
enableSSL = true;
|
||||
extraConfig =''
|
||||
if ($scheme = http){
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
|
@ -55,10 +40,7 @@ let
|
|||
root ${pkgs.retiolum-bootstrap};
|
||||
try_files $uri $uri/retiolum.sh;
|
||||
'';
|
||||
locations = [];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
in
|
||||
out
|
||||
}
|
||||
|
|
|
|||
|
|
@ -11,6 +11,30 @@ with import <stockholm/lib>;
|
|||
../2configs/mc.nix
|
||||
../2configs/nixpkgs.nix
|
||||
../2configs/vim.nix
|
||||
{
|
||||
# /dev/stderr doesn't work. I don't know why
|
||||
# /proc/self doesn't seem to work correctly
|
||||
# /dev/pts is empty except for 1 file
|
||||
# my life sucks
|
||||
nixpkgs.config.packageOverrides = super: {
|
||||
irc-announce = super.callPackage <stockholm/krebs/5pkgs/irc-announce> {
|
||||
pkgs = pkgs // { coreutils = pkgs.concat "coreutils-hack" [
|
||||
pkgs.coreutils
|
||||
(pkgs.writeDashBin "tee" ''
|
||||
if test "$1" = /dev/stderr; then
|
||||
while read -r line; do
|
||||
echo "$line"
|
||||
echo "$line" >&2
|
||||
done
|
||||
else
|
||||
${super.coreutils}/bin/tee "$@"
|
||||
fi
|
||||
'')
|
||||
];};
|
||||
};
|
||||
};
|
||||
boot.kernelParams = [ "copytoram" ];
|
||||
}
|
||||
{
|
||||
krebs.enable = true;
|
||||
krebs.build.user = config.krebs.users.lass;
|
||||
|
|
|
|||
|
|
@ -32,8 +32,6 @@ in {
|
|||
|
||||
time.timeZone = "Europe/Berlin";
|
||||
|
||||
virtualisation.libvirtd.enable = true;
|
||||
|
||||
programs.ssh.startAgent = false;
|
||||
|
||||
services.printing = {
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ in {
|
|||
};
|
||||
|
||||
config.krebs.buildbot.master = let
|
||||
stockholm-mirror-url = http://cgit.lassul.us/stockholm ;
|
||||
stockholm-mirror-url = http://cgit.prism.r/stockholm ;
|
||||
in {
|
||||
workers = {
|
||||
testworker = "lasspass";
|
||||
|
|
|
|||
|
|
@ -64,7 +64,10 @@ with import <stockholm/lib>;
|
|||
];
|
||||
}
|
||||
{
|
||||
services.dnscrypt-proxy.enable = true;
|
||||
services.dnscrypt-proxy = {
|
||||
enable = true;
|
||||
resolverName = "cs-de";
|
||||
};
|
||||
networking.extraResolvconfConf = ''
|
||||
name_servers='127.0.0.1'
|
||||
'';
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ in {
|
|||
krebs.fetchWallpaper = {
|
||||
enable = true;
|
||||
unitConfig.ConditionPathExists = "!/var/run/ppp0.pid";
|
||||
url = "prism/wallpaper.png";
|
||||
url = "prism/realwallpaper-sat-krebs.png";
|
||||
maxTime = 10;
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,6 +3,6 @@
|
|||
{
|
||||
krebs.build.source.nixpkgs.git = {
|
||||
url = https://cgit.lassul.us/nixpkgs;
|
||||
ref = "5acb454";
|
||||
ref = "c85f39e";
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -36,7 +36,6 @@ in {
|
|||
enable = true;
|
||||
tables = {};
|
||||
};
|
||||
nginx.enable = true;
|
||||
realwallpaper.enable = true;
|
||||
tinc.retiolum.enable = true;
|
||||
retiolum-bootstrap.enable = true;
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user