From 642583145200f5a2cb8be1b38707e2b2ea3dc3e5 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Sun, 25 Oct 2015 21:54:59 +0100
Subject: [PATCH 01/19] k 3 tinc_graphs: is now completely self-contained

---
 krebs/3modules/tinc_graphs.nix                  | 7 +++++--
 {makefu => krebs}/5pkgs/tinc_graphs/default.nix | 4 ++--
 2 files changed, 7 insertions(+), 4 deletions(-)
 rename {makefu => krebs}/5pkgs/tinc_graphs/default.nix (89%)

diff --git a/krebs/3modules/tinc_graphs.nix b/krebs/3modules/tinc_graphs.nix
index a6c628353..e415d20ab 100644
--- a/krebs/3modules/tinc_graphs.nix
+++ b/krebs/3modules/tinc_graphs.nix
@@ -95,8 +95,12 @@ let
 
         ExecStartPre = pkgs.writeScript "tinc_graphs-init" ''
           #!/bin/sh
+          mkdir -p "${internal_dir}" "${external_dir}"
           if ! test -e "${cfg.workingDir}/internal/index.html"; then
-            cp -fr "$(${pkgs.tinc_graphs}/bin/tincstats-static-dir)/internal/" "${internal_dir}"
+            cp -fr "$(${pkgs.tinc_graphs}/bin/tincstats-static-dir)/internal/." "${internal_dir}"
+          fi
+          if ! test -e "${cfg.workingDir}/external/index.html"; then
+            cp -fr "$(${pkgs.tinc_graphs}/bin/tincstats-static-dir)/external/." "${external_dir}"
           fi
         '';
 
@@ -118,7 +122,6 @@ let
     users.extraUsers.tinc_graphs = {
       uid = 3925439960; #genid tinc_graphs
       home = "/var/spool/tinc_graphs";
-      createHome = true;
     };
 
     krebs.nginx.servers = mkIf cfg.nginx.enable {
diff --git a/makefu/5pkgs/tinc_graphs/default.nix b/krebs/5pkgs/tinc_graphs/default.nix
similarity index 89%
rename from makefu/5pkgs/tinc_graphs/default.nix
rename to krebs/5pkgs/tinc_graphs/default.nix
index 62a787d30..3040cabe8 100644
--- a/makefu/5pkgs/tinc_graphs/default.nix
+++ b/krebs/5pkgs/tinc_graphs/default.nix
@@ -2,14 +2,14 @@
 
 python3Packages.buildPythonPackage rec {
   name = "tinc_graphs-${version}";
-  version = "0.3.6";
+  version = "0.3.8";
   propagatedBuildInputs = with pkgs;[
     python3Packages.pygeoip
     ## ${geolite-legacy}/share/GeoIP/GeoIPCity.dat
   ];
   src = fetchurl {
     url = "https://pypi.python.org/packages/source/t/tinc_graphs/tinc_graphs-${version}.tar.gz";
-    sha256 = "0ghdx9aaipmppvc2b6cgks4nxw6zsb0fhjrmnisbx7rz0vjvzc74";
+    sha256 = "0jc014ipx9pbx5dwi9s5n921c2c26m5vvzrvpjmca550gpdqd5f4";
   };
   preFixup = with pkgs;''
     wrapProgram $out/bin/build-graphs --prefix PATH : "$out/bin"

From cb1b101dfa2c8e0aa9a3ef0c64788912e0148085 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 26 Oct 2015 00:02:51 +0100
Subject: [PATCH 02/19] tinc_graphs: clean up mv {makefu,krebs}

---
 krebs/5pkgs/tinc_graphs/default.nix | 4 ++--
 makefu/5pkgs/default.nix            | 1 -
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/krebs/5pkgs/tinc_graphs/default.nix b/krebs/5pkgs/tinc_graphs/default.nix
index 3040cabe8..e5f1e40e8 100644
--- a/krebs/5pkgs/tinc_graphs/default.nix
+++ b/krebs/5pkgs/tinc_graphs/default.nix
@@ -2,14 +2,14 @@
 
 python3Packages.buildPythonPackage rec {
   name = "tinc_graphs-${version}";
-  version = "0.3.8";
+  version = "0.3.9";
   propagatedBuildInputs = with pkgs;[
     python3Packages.pygeoip
     ## ${geolite-legacy}/share/GeoIP/GeoIPCity.dat
   ];
   src = fetchurl {
     url = "https://pypi.python.org/packages/source/t/tinc_graphs/tinc_graphs-${version}.tar.gz";
-    sha256 = "0jc014ipx9pbx5dwi9s5n921c2c26m5vvzrvpjmca550gpdqd5f4";
+    sha256 = "0hjmkiclvyjb3707285x4b8mk5aqjcvh383hvkad1h7p1n61qrfx";
   };
   preFixup = with pkgs;''
     wrapProgram $out/bin/build-graphs --prefix PATH : "$out/bin"
diff --git a/makefu/5pkgs/default.nix b/makefu/5pkgs/default.nix
index 7945b6ebd..b9661e1cd 100644
--- a/makefu/5pkgs/default.nix
+++ b/makefu/5pkgs/default.nix
@@ -7,6 +7,5 @@ in
   alsa-hdspmixer = callPackage ./alsa-tools { alsaToolTarget="hdspmixer";};
   alsa-hdspconf = callPackage ./alsa-tools { alsaToolTarget="hdspconf";};
   alsa-hdsploader = callPackage ./alsa-tools { alsaToolTarget="hdsploader";};
-  tinc_graphs = callPackage ./tinc_graphs {};
   awesomecfg = callPackage ./awesomecfg {};
 }

From 526adba3c81d267266946e7fc96a4a3b51cab366 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 26 Oct 2015 00:04:15 +0100
Subject: [PATCH 03/19] k 3 urlwatch: add verbose flag

---
 krebs/3modules/urlwatch.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/krebs/3modules/urlwatch.nix b/krebs/3modules/urlwatch.nix
index 80d9f5e93..206bc5697 100644
--- a/krebs/3modules/urlwatch.nix
+++ b/krebs/3modules/urlwatch.nix
@@ -56,6 +56,13 @@ let
         https://nixos.org/channels/nixos-unstable/git-revision
       ];
     };
+    verbose = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        verbose output of urlwatch
+      '';
+    };
   };
 
   urlsFile = toFile "urls" (concatStringsSep "\n" cfg.urls);
@@ -106,7 +113,7 @@ let
 
           cd /tmp
 
-          urlwatch -e --urls="$urlsFile" > changes 2>&1 || :
+          urlwatch -e ${optionalString cfg.verbose "-v"} --urls="$urlsFile" > changes || :
 
           if test -s changes; then
             date=$(date -R)

From 20ad77468131b7c69c5b3a26ea149ae7fdc0173b Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 26 Oct 2015 00:47:10 +0100
Subject: [PATCH 04/19] m 1 pnp: make urlwatch verbose, update url list

---
 makefu/1systems/pnp.nix      | 2 ++
 makefu/2configs/urlwatch.nix | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/makefu/1systems/pnp.nix b/makefu/1systems/pnp.nix
index e7ceca60d..80600e988 100644
--- a/makefu/1systems/pnp.nix
+++ b/makefu/1systems/pnp.nix
@@ -32,6 +32,8 @@
 
       # ../2configs/graphite-standalone.nix
     ];
+  krebs.urlwatch.verbose = true;
+
   krebs.Reaktor.enable = true;
   krebs.Reaktor.debug = true;
   krebs.Reaktor.nickname = "Reaktor|bot";
diff --git a/makefu/2configs/urlwatch.nix b/makefu/2configs/urlwatch.nix
index 933cb93c5..01e5e8be5 100644
--- a/makefu/2configs/urlwatch.nix
+++ b/makefu/2configs/urlwatch.nix
@@ -10,6 +10,8 @@
       https://api.github.com/repos/ovh/python-ovh/tags
       https://api.github.com/repos/embray/d2to1/tags
       http://git.sysphere.org/vicious/log/?qt=grep&q=Next+release
+      https://github.com/bepasty/bepasty-server/tags
+      https://pypi.python.org/simple/xstatic/
 
     ];
   };

From 8c9c74a03bfc1aa7b74bd1d4098851075608f311 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Tue, 27 Oct 2015 18:10:32 +0100
Subject: [PATCH 05/19] k 5 collectd-connect-time: initial commit

---
 krebs/5pkgs/collectd-connect-time/default.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 krebs/5pkgs/collectd-connect-time/default.nix

diff --git a/krebs/5pkgs/collectd-connect-time/default.nix b/krebs/5pkgs/collectd-connect-time/default.nix
new file mode 100644
index 000000000..bff4928cc
--- /dev/null
+++ b/krebs/5pkgs/collectd-connect-time/default.nix
@@ -0,0 +1,15 @@
+{lib, pkgs, pythonPackages, fetchurl, ... }:
+
+pythonPackages.buildPythonPackage rec {
+  name = "collectd-connect-time-${version}";
+  version = "0.1.1";
+  src = fetchurl {
+    url = "https://pypi.python.org/packages/source/c/collectd-connect-time/collectd-connect-time-${version}.tar.gz";
+    sha256 = "0j2glcm4qjry1hqgci84ifj83xjpannl5yckyjadc8s9vyf0mp99";
+  };
+  meta = {
+    homepage = https://pypi.python.org/pypi/collectd-connect-time/;
+    description = "TCP Connection time plugin for collectd";
+    license = lib.licenses.wtfpl;
+  };
+}

From 3708839857669e3c7fc9899e324350ff55a34586 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Tue, 27 Oct 2015 18:11:13 +0100
Subject: [PATCH 06/19] m 2 collectd: add first sample howto configure collectd
 with collectd-connect-time

---
 makefu/2configs/collectd/collectd-base.nix | 42 ++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 makefu/2configs/collectd/collectd-base.nix

diff --git a/makefu/2configs/collectd/collectd-base.nix b/makefu/2configs/collectd/collectd-base.nix
new file mode 100644
index 000000000..7909c1be5
--- /dev/null
+++ b/makefu/2configs/collectd/collectd-base.nix
@@ -0,0 +1,42 @@
+{ config, lib, pkgs, ... }:
+
+# graphite-web on port 8080
+# carbon cache on port 2003 (tcp/udp)
+with lib;
+let
+  connect-time-cfg = with pkgs; writeText "collectd-connect-time.cfg" ''
+    LoadPlugin python
+    <Plugin python>
+      ModulePath "${collectd-connect-time}/lib/${python.libPrefix}/site-packages/"
+      Import "collectd_connect_time"
+      <Module collectd_connect_time>
+        target "wry.retiolum" "localhost" "google.com"
+        interval 30
+      </Module>
+    </Plugin>
+  '';
+  graphite-cfg = pkgs.writeText "collectd-graphite-cfg" ''
+    LoadPlugin write_graphite
+    <Plugin "write_graphite">
+      <Carbon>
+        Host "heidi.retiolum"
+        Port "2003"
+        Prefix "retiolum."
+        EscapeCharacter "_"
+        StoreRates false
+        AlwaysAppendDS false
+      </Carbon>
+    </Plugin>
+  '';
+in {
+  imports = [ ];
+
+  nixpkgs.config.packageOverrides = pkgs: with pkgs; {
+    collectd = pkgs.collectd.override { python= pkgs.python; };
+  };
+  services.collectd = {
+    enable = true;
+    include = [ (toString connect-time-cfg) (toString graphite-cfg) ];
+  };
+
+}

From fe4f5b98b91f6bacb036d57b5322fb4e09c22f14 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Tue, 27 Oct 2015 18:12:05 +0100
Subject: [PATCH 07/19] m 12 collectd: wry uses cherry-picked collectd to
 enable python support

---
 makefu/1systems/wry.nix              | 3 +++
 makefu/2configs/unstable-sources.nix | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index 6627d87b5..fc98179e4 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -19,6 +19,9 @@ in {
 
       # Reaktor
       ../2configs/Reaktor/simpleExtend.nix
+
+      # collectd
+      ../2configs/collectd/collectd-base.nix
   ];
 
   krebs.build = {
diff --git a/makefu/2configs/unstable-sources.nix b/makefu/2configs/unstable-sources.nix
index f2d28dcaf..5cb4e8016 100644
--- a/makefu/2configs/unstable-sources.nix
+++ b/makefu/2configs/unstable-sources.nix
@@ -4,7 +4,7 @@
   krebs.build.source = {
     git.nixpkgs = {
       url = https://github.com/makefu/nixpkgs;
-      rev = "984d33884d63d404ff2da76920b8bc8b15471552";
+      rev = "15b5bbfbd1c8a55e7d9e05dd9058dc102fac04fe"; # cherry-picked collectd
     };
 
     dir.secrets = {

From d394cd26de014c718431b970c7d8e47a725a8202 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Tue, 27 Oct 2015 18:59:46 +0100
Subject: [PATCH 08/19] k 5 collectd-connect-time: bump to 0.2.0

---
 krebs/5pkgs/collectd-connect-time/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/krebs/5pkgs/collectd-connect-time/default.nix b/krebs/5pkgs/collectd-connect-time/default.nix
index bff4928cc..c94bf21a6 100644
--- a/krebs/5pkgs/collectd-connect-time/default.nix
+++ b/krebs/5pkgs/collectd-connect-time/default.nix
@@ -2,10 +2,10 @@
 
 pythonPackages.buildPythonPackage rec {
   name = "collectd-connect-time-${version}";
-  version = "0.1.1";
+  version = "0.2.0";
   src = fetchurl {
     url = "https://pypi.python.org/packages/source/c/collectd-connect-time/collectd-connect-time-${version}.tar.gz";
-    sha256 = "0j2glcm4qjry1hqgci84ifj83xjpannl5yckyjadc8s9vyf0mp99";
+    sha256 = "1l63pi79z6vg4xf744a71g5rxgsngpkc96a7y4ha2x798r55g7v6";
   };
   meta = {
     homepage = https://pypi.python.org/pypi/collectd-connect-time/;

From bbd28caa40c06574653fc8364157721c562eabbb Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Wed, 28 Oct 2015 00:42:36 +0100
Subject: [PATCH 09/19] krebs 5 collectd-connect-time: bump version (again)

---
 krebs/5pkgs/collectd-connect-time/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/krebs/5pkgs/collectd-connect-time/default.nix b/krebs/5pkgs/collectd-connect-time/default.nix
index c94bf21a6..b07a119db 100644
--- a/krebs/5pkgs/collectd-connect-time/default.nix
+++ b/krebs/5pkgs/collectd-connect-time/default.nix
@@ -2,10 +2,10 @@
 
 pythonPackages.buildPythonPackage rec {
   name = "collectd-connect-time-${version}";
-  version = "0.2.0";
+  version = "0.2.1";
   src = fetchurl {
     url = "https://pypi.python.org/packages/source/c/collectd-connect-time/collectd-connect-time-${version}.tar.gz";
-    sha256 = "1l63pi79z6vg4xf744a71g5rxgsngpkc96a7y4ha2x798r55g7v6";
+    sha256 = "0611h53ww9lk1qm27njsffckkibirmq7p8cxlq02dgl1zbh7583d";
   };
   meta = {
     homepage = https://pypi.python.org/pypi/collectd-connect-time/;

From bd09f983913ed6e0181d2a9bc4e92e1e8fa4c4fe Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Wed, 28 Oct 2015 15:05:15 +0100
Subject: [PATCH 10/19] m 2 headless: init

---
 makefu/1systems/pnp.nix      | 1 +
 makefu/1systems/wry.nix      | 3 +--
 makefu/2configs/headless.nix | 4 ++++
 3 files changed, 6 insertions(+), 2 deletions(-)
 create mode 100644 makefu/2configs/headless.nix

diff --git a/makefu/1systems/pnp.nix b/makefu/1systems/pnp.nix
index 80600e988..9c7be3b79 100644
--- a/makefu/1systems/pnp.nix
+++ b/makefu/1systems/pnp.nix
@@ -11,6 +11,7 @@
       ../2configs/base.nix
       ../2configs/base-sources.nix
       ../2configs/tinc-basic-retiolum.nix
+      ../2configs/headless.nix
 
       # HW/FS
       <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index 3baf31dc5..1c6f35503 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -11,6 +11,7 @@ in {
       ../../tv/2configs/CAC-CentOS-7-64bit.nix
       ../2configs/base.nix
       ../2configs/unstable-sources.nix
+      ../2configs/headless.nix
       ../2configs/tinc-basic-retiolum.nix
 
       ../2configs/bepasty-dual.nix
@@ -67,6 +68,4 @@ in {
   };
 
 
-  # based on ../../tv/2configs/CAC-Developer-2.nix
-  sound.enable = false;
 }
diff --git a/makefu/2configs/headless.nix b/makefu/2configs/headless.nix
new file mode 100644
index 000000000..33847c5e1
--- /dev/null
+++ b/makefu/2configs/headless.nix
@@ -0,0 +1,4 @@
+_:
+{
+  sound.enable = false;
+}

From 85f48e73b223ae3d4cddf577b66188954750d608 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Wed, 28 Oct 2015 15:05:48 +0100
Subject: [PATCH 11/19] m 2 urlwatch: replace dynamic with static page for
 bepasty

---
 makefu/2configs/urlwatch.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/makefu/2configs/urlwatch.nix b/makefu/2configs/urlwatch.nix
index 01e5e8be5..cd05f0114 100644
--- a/makefu/2configs/urlwatch.nix
+++ b/makefu/2configs/urlwatch.nix
@@ -10,7 +10,7 @@
       https://api.github.com/repos/ovh/python-ovh/tags
       https://api.github.com/repos/embray/d2to1/tags
       http://git.sysphere.org/vicious/log/?qt=grep&q=Next+release
-      https://github.com/bepasty/bepasty-server/tags
+      https://pypi.python.org/simple/bepasty/
       https://pypi.python.org/simple/xstatic/
 
     ];

From c6ca11062ab3a1e2f6903a08ba57bf394bfa05e3 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Wed, 28 Oct 2015 15:06:41 +0100
Subject: [PATCH 12/19] m 1 gum: prepare stockholm

---
 krebs/3modules/makefu/default.nix |  3 ++-
 makefu/1systems/gum.nix           | 44 +++++++++++++++++++++++++++++++
 2 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 makefu/1systems/gum.nix

diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index e36a083f2..7c0aacbb7 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -214,9 +214,10 @@ with lib;
 
       extraZones = {
         "krebsco.de" = ''
-          omo               IN A      ${head nets.internet.addrs4}
           euer              IN A      ${head nets.internet.addrs4}
+          euer.blog         IN A      ${head nets.internet.addrs4}
           gum               IN A      ${head nets.internet.addrs4}
+          euer.wiki         IN A      ${head nets.internet.addrs4}
         '';
       };
       nets = {
diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix
new file mode 100644
index 000000000..c4fa064b3
--- /dev/null
+++ b/makefu/1systems/gum.nix
@@ -0,0 +1,44 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  external-ip = head config.krebs.build.host.nets.internet.addrs4;
+  internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
+in {
+  imports = [
+      # TODO: copy this config or move to krebs
+      ../2configs/base.nix
+      ../2configs/base-sources.nix
+      ../2configs/tinc-basic-retiolum.nix
+      ../2configs/headless.nix
+      # ../2configs/iodined.nix
+
+      # Reaktor
+      ../2configs/Reaktor/simpleExtend.nix
+  ];
+
+  krebs.build = {
+    user = config.krebs.users.makefu;
+    target = "root@gum.krebsco.de";
+    host = config.krebs.hosts.gum;
+  };
+
+  krebs.Reaktor.enable = true;
+
+  # prepare graphs
+  krebs.nginx.enable = true;
+
+  networking = {
+    firewall.allowPing = true;
+    firewall.allowedTCPPorts = [ 80 443 655 ];
+    firewall.allowedUDPPorts = [ 655 ];
+    interfaces.enp2s1.ip4 = [{
+      address = external-ip;
+      prefixLength = 24;
+    }];
+    defaultGateway = "195.154.108.1";
+    nameservers = [ "8.8.8.8" ];
+  };
+
+  # based on ../../tv/2configs/CAC-Developer-2.nix
+}

From 2a7fab786fb3da081849dbfb85acde957571218c Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Wed, 28 Oct 2015 15:09:31 +0100
Subject: [PATCH 13/19] m 2 sources: add system tag

---
 makefu/2configs/base-sources.nix     | 1 +
 makefu/2configs/unstable-sources.nix | 1 +
 2 files changed, 2 insertions(+)

diff --git a/makefu/2configs/base-sources.nix b/makefu/2configs/base-sources.nix
index 7e6bebec3..65c6e8e76 100644
--- a/makefu/2configs/base-sources.nix
+++ b/makefu/2configs/base-sources.nix
@@ -1,6 +1,7 @@
 { config, lib, pkgs, ... }:
 
 {
+  system.stateVersion = "15.09";
   krebs.build.source = {
     git.nixpkgs = {
       #url = https://github.com/NixOS/nixpkgs;
diff --git a/makefu/2configs/unstable-sources.nix b/makefu/2configs/unstable-sources.nix
index f2d28dcaf..173060515 100644
--- a/makefu/2configs/unstable-sources.nix
+++ b/makefu/2configs/unstable-sources.nix
@@ -1,6 +1,7 @@
 { config, lib, pkgs, ... }:
 
 {
+  system.stateVersion = "15.09";
   krebs.build.source = {
     git.nixpkgs = {
       url = https://github.com/makefu/nixpkgs;

From 6147e3069ac3df5c4c652c47d2c1ee459493d784 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Wed, 28 Oct 2015 17:43:36 +0100
Subject: [PATCH 14/19] m 5 tw-upload-plugin: init

---
 makefu/5pkgs/default.nix                  | 1 +
 makefu/5pkgs/tw-upload-plugin/default.nix | 8 ++++++++
 2 files changed, 9 insertions(+)
 create mode 100644 makefu/5pkgs/tw-upload-plugin/default.nix

diff --git a/makefu/5pkgs/default.nix b/makefu/5pkgs/default.nix
index b9661e1cd..436c52fcd 100644
--- a/makefu/5pkgs/default.nix
+++ b/makefu/5pkgs/default.nix
@@ -8,4 +8,5 @@ in
   alsa-hdspconf = callPackage ./alsa-tools { alsaToolTarget="hdspconf";};
   alsa-hdsploader = callPackage ./alsa-tools { alsaToolTarget="hdsploader";};
   awesomecfg = callPackage ./awesomecfg {};
+  tw-upload-plugin = callPackage ./tw-upload-plugin {};
 }
diff --git a/makefu/5pkgs/tw-upload-plugin/default.nix b/makefu/5pkgs/tw-upload-plugin/default.nix
new file mode 100644
index 000000000..e73aea585
--- /dev/null
+++ b/makefu/5pkgs/tw-upload-plugin/default.nix
@@ -0,0 +1,8 @@
+{pkgs}:
+
+pkgs.fetchFromGitHub {
+  owner = "makefu";
+  repo = "tw-upload-plugin";
+  rev = "4a99de";
+  sha256 = "0y7bqzi4fmm3lxb7pbgicph5r31xlvkkz4a1pklsrb7vjwsyb91m";
+}

From 23424a3a2ae7fd489547c453374d6ffc551c5483 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Wed, 28 Oct 2015 21:27:39 +0100
Subject: [PATCH 15/19] m 5 tw-upload-plugin: use new version

---
 makefu/5pkgs/tw-upload-plugin/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/makefu/5pkgs/tw-upload-plugin/default.nix b/makefu/5pkgs/tw-upload-plugin/default.nix
index e73aea585..a68dc09dc 100644
--- a/makefu/5pkgs/tw-upload-plugin/default.nix
+++ b/makefu/5pkgs/tw-upload-plugin/default.nix
@@ -3,6 +3,6 @@
 pkgs.fetchFromGitHub {
   owner = "makefu";
   repo = "tw-upload-plugin";
-  rev = "4a99de";
-  sha256 = "0y7bqzi4fmm3lxb7pbgicph5r31xlvkkz4a1pklsrb7vjwsyb91m";
+  rev = "a00aac";
+  sha256 = "0kazqs24kzjxqzr33kg1jbfx8xyvmrnrdxh6g27kgkgbl1d2qknh";
 }

From 84ebd8c02132131d893fd9bb92ea523e59272649 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Wed, 28 Oct 2015 21:31:07 +0100
Subject: [PATCH 16/19] m 1 wry: serve euer wiki

---
 krebs/3modules/makefu/default.nix   |   5 +-
 makefu/1systems/wry.nix             |   6 +-
 makefu/2configs/nginx/euer.wiki.nix | 114 ++++++++++++++++++++++++++++
 3 files changed, 121 insertions(+), 4 deletions(-)
 create mode 100644 makefu/2configs/nginx/euer.wiki.nix

diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index 7c0aacbb7..2d33b9275 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -164,6 +164,7 @@ with lib;
       dc = "makefu"; #dc = "cac";
       extraZones = {
         "krebsco.de" = ''
+          wiki.euer      IN A  ${head nets.internet.addrs4}
           wry            IN A  ${head nets.internet.addrs4}
           io             IN NS wry.krebsco.de.
           graphs         IN A  ${head nets.internet.addrs4}
@@ -189,6 +190,7 @@ with lib;
             "paste.wry.retiolum"
             "paste.retiolum"
             "wry.retiolum"
+            "wiki.makefu.retiolum"
           ];
           tinc.pubkey = ''
             -----BEGIN RSA PUBLIC KEY-----
@@ -215,9 +217,8 @@ with lib;
       extraZones = {
         "krebsco.de" = ''
           euer              IN A      ${head nets.internet.addrs4}
-          euer.blog         IN A      ${head nets.internet.addrs4}
+          share.euer        IN A      ${head nets.internet.addrs4}
           gum               IN A      ${head nets.internet.addrs4}
-          euer.wiki         IN A      ${head nets.internet.addrs4}
         '';
       };
       nets = {
diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index 1c6f35503..24ec16c64 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -20,6 +20,9 @@ in {
 
       # Reaktor
       ../2configs/Reaktor/simpleExtend.nix
+
+      # other nginx
+      ../2configs/nginx/euer.wiki.nix
   ];
 
   krebs.build = {
@@ -28,8 +31,6 @@ in {
     host = config.krebs.hosts.wry;
   };
 
-
-
   krebs.Reaktor.enable = true;
 
   # bepasty to listen only on the correct interfaces
@@ -59,6 +60,7 @@ in {
   networking = {
     firewall.allowPing = true;
     firewall.allowedTCPPorts = [ 53 80 443 ];
+    firewall.allowedUDPPorts = [ 655 ];
     interfaces.enp2s1.ip4 = [{
       address = external-ip;
       prefixLength = 24;
diff --git a/makefu/2configs/nginx/euer.wiki.nix b/makefu/2configs/nginx/euer.wiki.nix
new file mode 100644
index 000000000..1e1834b1b
--- /dev/null
+++ b/makefu/2configs/nginx/euer.wiki.nix
@@ -0,0 +1,114 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  ssl_cert = "/root/secrets/wildcard.krebsco.de.crt";
+  ssl_key  = "/root/secrets/wildcard.krebsco.de.key";
+  user = config.services.nginx.user;
+  group = config.services.nginx.group;
+  fpm-socket = "/var/run/php5-fpm.sock";
+  hostname = config.krebs.build.host.name;
+  tw-upload = pkgs.tw-upload-plugin;
+  base-dir = "/var/www/wiki.euer";
+  base-cfg = "${base-dir}/twconf.ini";
+  wiki-dir = "${base-dir}/store/";
+  backup-dir = "${base-dir}/backup/";
+  # contains:
+  #  user1 = pass1
+  #  userN = passN
+  tw-pass-file = "/root/secrets/tw-pass.ini";
+  external-ip = head config.krebs.build.host.nets.internet.addrs4;
+  internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
+in {
+  services.phpfpm = {
+    # phpfpm does not have an enable option
+    poolConfigs  = {
+      euer-wiki = ''
+        user =  ${user}
+        group =  ${group}
+        listen = ${fpm-socket}
+        listen.owner = ${user}
+        listen.group = ${group}
+        env[twconf] = ${base-cfg};
+        pm = dynamic
+        pm.max_children = 5
+        pm.start_servers = 2
+        pm.min_spare_servers = 1
+        pm.max_spare_servers = 3
+        chdir = /
+        # errors to journal
+        php_admin_value[error_log] = 'stderr'
+        php_admin_flag[log_errors] = on
+        catch_workers_output = yes
+      '';
+    };
+  };
+
+  systemd.services.prepare-tw = {
+    wantedBy = [ "local-fs.target" ];
+    before = [ "phpfpm.service" ];
+    serviceConfig = {
+      ExecStart = pkgs.writeScript "prepare-tw-service" ''
+        #!/bin/sh
+        mkdir -p "${wiki-dir}" "${backup-dir}"
+
+        # write the base configuration
+        cat > "${base-cfg}" <<EOF
+        [users]
+        $(cat "${tw-pass-file}")
+        [directories]
+        backupdir = ${backup-dir}
+        savedir = ${wiki-dir}
+        EOF
+        chown -R ${user}:${group} "${base-dir}"
+        chmod 700  -R "${base-dir}"
+      '';
+      Type = "oneshot";
+      RemainAfterExit = "yes";
+      TimeoutSec = "0";
+    };
+  };
+
+  krebs.nginx = {
+    enable = mkDefault true;
+    servers = {
+      euer-wiki = {
+        listen = [ "${external-ip}:80" "${external-ip}:443 ssl"
+                   "${internal-ip}:80" "${internal-ip}:443 ssl" ];
+        server-names = [
+          "wiki.euer.krebsco.de"
+          "wiki.makefu.retiolum"
+          "wiki.makefu"
+        ];
+        extraConfig = ''
+          gzip on;
+          gzip_buffers 4 32k;
+          gzip_types  text/plain application/x-javascript text/css;
+          ssl_certificate ${ssl_cert};
+          ssl_certificate_key ${ssl_key};
+          default_type text/plain;
+
+          if ($scheme = http){
+            return 301 https://$server_name$request_uri;
+          }
+
+        '';
+        locations = [
+          (nameValuePair "/" ''
+            root ${wiki-dir};
+            expires -1;
+            autoindex on;
+          '')
+          (nameValuePair "/store.php" ''
+            root ${tw-upload};
+            client_max_body_size 200M;
+            fastcgi_split_path_info ^(.+\.php)(/.+)$;
+            fastcgi_pass unix:${fpm-socket};
+            include ${pkgs.nginx}/conf/fastcgi_params;
+            include ${pkgs.nginx}/conf/fastcgi.conf;
+          '')
+        ];
+      };
+    };
+  };
+}

From 8bc538b9e7bdf6fa9d93d1662ee1b889e0a5d458 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Thu, 29 Oct 2015 09:28:27 +0100
Subject: [PATCH 17/19] m 2 euer.blog: init (untested)

---
 makefu/2configs/nginx/euer.blog.nix | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 makefu/2configs/nginx/euer.blog.nix

diff --git a/makefu/2configs/nginx/euer.blog.nix b/makefu/2configs/nginx/euer.blog.nix
new file mode 100644
index 000000000..a8be1993b
--- /dev/null
+++ b/makefu/2configs/nginx/euer.blog.nix
@@ -0,0 +1,29 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  ssl_cert = "/root/secrets/wildcard.krebsco.de.crt";
+  ssl_key  = "/root/secrets/wildcard.krebsco.de.key";
+  hostname = krebs.build.host.name;
+in {
+  krebs.nginx = {
+    enable = mkDefault true;
+    servers = {
+      euer-blog = {
+        listen = [ "80" "443 ssl" ];
+        server-names = [ "euer.krebsco.de" "euer.blog.krebsco.de" "blog.${hostname}" ];
+        extraConfig = ''
+          gzip on;
+          gzip_buffers 4 32k;
+          gzip_types  text/plain application/x-javascript text/css;
+          ssl_certificate ${ssl_cert};
+          ssl_certificate_key ${ssl_key};
+          default_type text/plain;
+        '';
+        locations = singleton (nameValuePair "/" ''
+          root /var/www/euer.blog/;
+        '');
+      };
+    };
+  };
+}

From 6410fd0f8557658fa5e180844def32f8bda7313d Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Thu, 29 Oct 2015 10:55:54 +0100
Subject: [PATCH 18/19] m 2 *: s,/root/secrets,<secrets>,

---
 makefu/2configs/bepasty-dual.nix    | 14 +++++++++-----
 makefu/2configs/nginx/euer.blog.nix |  5 +++--
 makefu/2configs/nginx/euer.wiki.nix |  7 ++++---
 3 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/makefu/2configs/bepasty-dual.nix b/makefu/2configs/bepasty-dual.nix
index fb170957a..123ae3cf9 100644
--- a/makefu/2configs/bepasty-dual.nix
+++ b/makefu/2configs/bepasty-dual.nix
@@ -11,7 +11,11 @@
 #   bepasty-secret.nix     <- contains single string
 
 with lib;
-{
+let
+  sec = toString <secrets>;
+  # secKey is nothing worth protecting on a local machine
+  secKey = import <secrets/bepasty-secret.nix>;
+in {
 
   krebs.nginx.enable = mkDefault true;
   krebs.bepasty = {
@@ -24,7 +28,7 @@ with lib;
           server-names = [ "paste.retiolum" "paste.${config.krebs.build.host.name}" ];
         };
         defaultPermissions = "admin,list,create,read,delete";
-        secretKey = import <secrets/bepasty-secret.nix>;
+        secretKey = secKey;
       };
 
       external = {
@@ -33,8 +37,8 @@ with lib;
           extraConfig = ''
           ssl_session_cache    shared:SSL:1m;
           ssl_session_timeout  10m;
-          ssl_certificate     /root/secrets/wildcard.krebsco.de.crt;
-          ssl_certificate_key /root/secrets/wildcard.krebsco.de.key;
+          ssl_certificate     ${sec}/wildcard.krebsco.de.crt;
+          ssl_certificate_key ${sec}/wildcard.krebsco.de.key;
           ssl_verify_client off;
           proxy_ssl_session_reuse off;
           ssl_protocols        TLSv1 TLSv1.1 TLSv1.2;
@@ -45,7 +49,7 @@ with lib;
           }'';
         };
         defaultPermissions = "read";
-        secretKey = import <secrets/bepasty-secret.nix>;
+        secretKey = secKey;
       };
     };
   };
diff --git a/makefu/2configs/nginx/euer.blog.nix b/makefu/2configs/nginx/euer.blog.nix
index a8be1993b..e97050ec4 100644
--- a/makefu/2configs/nginx/euer.blog.nix
+++ b/makefu/2configs/nginx/euer.blog.nix
@@ -2,8 +2,9 @@
 
 with lib;
 let
-  ssl_cert = "/root/secrets/wildcard.krebsco.de.crt";
-  ssl_key  = "/root/secrets/wildcard.krebsco.de.key";
+  sec = toString <secrets>;
+  ssl_cert = "${sec}/wildcard.krebsco.de.crt";
+  ssl_key  = "${sec}/wildcard.krebsco.de.key";
   hostname = krebs.build.host.name;
 in {
   krebs.nginx = {
diff --git a/makefu/2configs/nginx/euer.wiki.nix b/makefu/2configs/nginx/euer.wiki.nix
index 1e1834b1b..fbcfe2047 100644
--- a/makefu/2configs/nginx/euer.wiki.nix
+++ b/makefu/2configs/nginx/euer.wiki.nix
@@ -2,8 +2,9 @@
 
 with lib;
 let
-  ssl_cert = "/root/secrets/wildcard.krebsco.de.crt";
-  ssl_key  = "/root/secrets/wildcard.krebsco.de.key";
+  sec = toString <secrets>;
+  ssl_cert = "${sec}/wildcard.krebsco.de.crt";
+  ssl_key  = "${sec}/wildcard.krebsco.de.key";
   user = config.services.nginx.user;
   group = config.services.nginx.group;
   fpm-socket = "/var/run/php5-fpm.sock";
@@ -16,7 +17,7 @@ let
   # contains:
   #  user1 = pass1
   #  userN = passN
-  tw-pass-file = "/root/secrets/tw-pass.ini";
+  tw-pass-file = "${sec}/tw-pass.ini";
   external-ip = head config.krebs.build.host.nets.internet.addrs4;
   internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
 in {

From 546469e18d24252360279ea276eb9a502670c712 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Fri, 30 Oct 2015 15:28:12 +0100
Subject: [PATCH 19/19] shared wolf: enable collectd towards heidi

---
 shared/1systems/wolf.nix          |  1 +
 shared/2configs/collectd-base.nix | 41 +++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+)
 create mode 100644 shared/2configs/collectd-base.nix

diff --git a/shared/1systems/wolf.nix b/shared/1systems/wolf.nix
index aeaeee288..73552e705 100644
--- a/shared/1systems/wolf.nix
+++ b/shared/1systems/wolf.nix
@@ -5,6 +5,7 @@ with lib;
 {
   imports = [
     <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
+    ../2configs/collectd-base.nix
   ];
 
   krebs.build.host = config.krebs.hosts.wolf;
diff --git a/shared/2configs/collectd-base.nix b/shared/2configs/collectd-base.nix
new file mode 100644
index 000000000..b2ec40b28
--- /dev/null
+++ b/shared/2configs/collectd-base.nix
@@ -0,0 +1,41 @@
+{ config, lib, pkgs, ... }:
+
+# TODO: krebs.collectd.plugins
+with lib;
+let
+  connect-time-cfg = with pkgs; writeText "collectd-connect-time.conf" ''
+    LoadPlugin python
+    <Plugin python>
+      ModulePath "${collectd-connect-time}/lib/${python.libPrefix}/site-packages/"
+      Import "collectd_connect_time"
+      <Module collectd_connect_time>
+        target "heidi.retiolum:8080" "localhost" "google.com" "google.de" "omo.retiolum" "gum.retiolum" "gum.krebsco.de"
+        interval 10
+      </Module>
+    </Plugin>
+  '';
+  graphite-cfg = pkgs.writeText "collectd-graphite.conf" ''
+    LoadPlugin write_graphite
+    <Plugin "write_graphite">
+      <Carbon>
+        Host "heidi.retiolum"
+        Port "2003"
+        Prefix "retiolum."
+        EscapeCharacter "_"
+        StoreRates false
+        AlwaysAppendDS false
+      </Carbon>
+    </Plugin>
+  '';
+in {
+  imports = [ ];
+
+  nixpkgs.config.packageOverrides = pkgs: with pkgs; {
+    collectd = pkgs.collectd.override { python= pkgs.python; };
+  };
+  services.collectd = {
+    enable = true;
+    include = [ (toString connect-time-cfg) (toString graphite-cfg) ];
+  };
+
+}