From 3175318eb0542d0751491b7f9e881d50f8ba6741 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 19 Oct 2015 19:46:26 +0200
Subject: [PATCH 01/10] m 2 cgit: add tinc_graphs repo

---
 makefu/2configs/git/cgit-retiolum.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/makefu/2configs/git/cgit-retiolum.nix b/makefu/2configs/git/cgit-retiolum.nix
index 1277a014e..189dd66c8 100644
--- a/makefu/2configs/git/cgit-retiolum.nix
+++ b/makefu/2configs/git/cgit-retiolum.nix
@@ -10,6 +10,9 @@ let
     stockholm = {
       desc = "Make all the systems into 1systems!";
     };
+    tinc_graphs = {
+      desc = "Tinc Advanced Graph Generation";
+    };
   };
 
   priv-repos = mapAttrs make-priv-repo {

From 7656868d1b3232d5a17ed422c25c38e37c81e588 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 19 Oct 2015 19:48:56 +0200
Subject: [PATCH 02/10] m 1 wry: start Reaktor

---
 makefu/1systems/wry.nix | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index 819a208ac..d8c8d6fa1 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -5,23 +5,29 @@ let
   ip = (lib.head config.krebs.build.host.nets.internet.addrs4);
 in {
   imports = [
-    ../../tv/2configs/CAC-CentOS-7-64bit.nix
-    ../2configs/base.nix
-    ../2configs/base-sources.nix
-    ../2configs/tinc-basic-retiolum.nix
+      # TODO: copy this config or move to krebs
+      ../../tv/2configs/CAC-CentOS-7-64bit.nix
+      ../2configs/base.nix
+      ../2configs/base-sources.nix
+      ../2configs/tinc-basic-retiolum.nix
+
+      # Reaktor
+      ../2configs/Reaktor/simpleExtend.nix
   ];
 
+  krebs.Reaktor.enable = true;
+
   networking.firewall.allowPing = true;
   networking.interfaces.enp2s1.ip4 = [
-      {
-        address = ip;
-        prefixLength = 24;
-      }
-    ];
-    networking.defaultGateway = "104.233.87.1";
-    networking.nameservers = [
-      "8.8.8.8"
-    ];
+  {
+    address = ip;
+    prefixLength = 24;
+  }
+  ];
+  networking.defaultGateway = "104.233.87.1";
+  networking.nameservers = [
+    "8.8.8.8"
+  ];
 
   # based on ../../tv/2configs/CAC-Developer-2.nix
   sound.enable = false;

From 952c03b3742cc1a979e4a1c148d083f1334cfe65 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 19 Oct 2015 20:02:29 +0200
Subject: [PATCH 03/10] krebs 5 retiolum-bootstrap: init new_install.sh package

---
 krebs/5pkgs/retiolum-bootstrap/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 krebs/5pkgs/retiolum-bootstrap/default.nix

diff --git a/krebs/5pkgs/retiolum-bootstrap/default.nix b/krebs/5pkgs/retiolum-bootstrap/default.nix
new file mode 100644
index 000000000..d3bcc05db
--- /dev/null
+++ b/krebs/5pkgs/retiolum-bootstrap/default.nix
@@ -0,0 +1,6 @@
+{ fetchurl }:
+
+fetchurl {
+  url = https://raw.githubusercontent.com/krebscode/painload/master/retiolum/scripts/tinc_setup/new_install.sh; 
+  sha256 = "03kmil8q2xm3rdm2jxyah7vww84pw6w01d0c3siid9zpn2j7la9s";
+}

From 5a1808617aa121b8fc66389d8e92e387bb25a64c Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 19 Oct 2015 21:49:08 +0200
Subject: [PATCH 04/10] krebs 5 retiolum-bootstrap: packing to be used by nginx

---
 krebs/5pkgs/retiolum-bootstrap/default.nix | 31 +++++++++++++++++++---
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/krebs/5pkgs/retiolum-bootstrap/default.nix b/krebs/5pkgs/retiolum-bootstrap/default.nix
index d3bcc05db..331b1cb7f 100644
--- a/krebs/5pkgs/retiolum-bootstrap/default.nix
+++ b/krebs/5pkgs/retiolum-bootstrap/default.nix
@@ -1,6 +1,29 @@
-{ fetchurl }:
+{ stdenv,lib,fetchurl, ... }:
+with lib;
+stdenv.mkDerivation rec {
+  name = "retiolum-bootstrap";
+  version = "4.2.3";
 
-fetchurl {
-  url = https://raw.githubusercontent.com/krebscode/painload/master/retiolum/scripts/tinc_setup/new_install.sh; 
-  sha256 = "03kmil8q2xm3rdm2jxyah7vww84pw6w01d0c3siid9zpn2j7la9s";
+
+  src = fetchurl {
+    url = https://raw.githubusercontent.com/krebscode/painload/master/retiolum/scripts/tinc_setup/new_install.sh;
+    sha256 = "03kmil8q2xm3rdm2jxyah7vww84pw6w01d0c3siid9zpn2j7la9s";
+  };
+
+  phases = [
+    "installPhase"
+  ];
+
+  installPhase = ''
+    mkdir -p "$out"
+    cp -a ${src} $out/retiolum.sh
+  '';
+
+  meta = {
+    description = "Retiolum boostrap scripts";
+    url = https://github.com/krebscode/painload;
+    license = licenses.wtfpl;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ makefu ];
+  };
 }

From 754ea55ab89cdeffaac7b4b66ca792558fed9237 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 19 Oct 2015 21:50:08 +0200
Subject: [PATCH 05/10] krebs 3 retiolum-bootstrap: init module

---
 krebs/3modules/default.nix            |  1 +
 krebs/3modules/retiolum-bootstrap.nix | 60 +++++++++++++++++++++++++++
 2 files changed, 61 insertions(+)
 create mode 100644 krebs/3modules/retiolum-bootstrap.nix

diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index ff0cc8346..756245c0b 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -14,6 +14,7 @@ let
       ./iptables.nix
       ./nginx.nix
       ./Reaktor.nix
+      ./retiolum-bootstrap.nix
       ./realwallpaper.nix
       ./retiolum.nix
       ./urlwatch.nix
diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix
new file mode 100644
index 000000000..5cce4c2af
--- /dev/null
+++ b/krebs/3modules/retiolum-bootstrap.nix
@@ -0,0 +1,60 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.krebs.retiolum-bootstrap;
+
+  out = {
+    options.krebs.retiolum-bootstrap = api;
+    config = mkIf cfg.enable imp ;
+  };
+
+  api = {
+    enable = mkEnableOption "retiolum boot strap for tinc.krebsco.de";
+    hostname = mkOption {
+        type = types.str;
+        description = "hostname which serves tinc boot";
+        default = "tinc.krebsco.de" ;
+    };
+    ssl_certificate_key = mkOption {
+        type = types.str;
+        description = "Certificate key to use for ssl";
+        default = "/root/secrets/tinc.krebsco.de.key";
+    };
+    ssl_certificate = mkOption {
+        type = types.str;
+        description = "Certificate file to use for ssl";
+        default = "/root/secrets/tinc.krebsco.de.crt" ;
+    };
+    # in use:
+    #  <secrets/tinc.krebsco.de.crt>
+    #  <secrets/tinc.krebsco.de.key>
+  };
+
+  imp = {
+    # TODO: assert krebs nginx
+
+    krebs.nginx.servers = {
+      retiolum-boot-redir = {
+        server-names = singleton cfg.hostname;
+        extraConfig = ''
+          return 301 https://$server_name$request_uri;
+        '';
+        locations = [];
+      };
+      retiolum-boot-ssl = {
+        server-names = singleton cfg.hostname;
+        listen = "443 ssl";
+        extraConfig = ''
+          ssl_certificate ${cfg.ssl_certificate};
+          ssl_certificate_key ${cfg.ssl_certificate_key};
+          root ${pkgs.retiolum-bootstrap};
+          try_files $uri $uri/retiolum.sh;
+        '';
+        locations = [];
+      };
+    };
+  };
+
+in
+out

From 858034cc615469c6e4b7e48711f6fb026f16ffb4 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 19 Oct 2015 21:51:20 +0200
Subject: [PATCH 06/10] m 1 wry: host is the new provider  for tinc.krebsco.de

---
 krebs/3modules/makefu/default.nix | 2 +-
 makefu/1systems/wry.nix           | 6 +++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index 4628b2acc..659e71458 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -130,7 +130,6 @@ with import ../../4lib { inherit lib; };
           io                IN NS     pigstarter.krebsco.de.
           pigstarter        IN A      ${head nets.internet.addrs4}
           gold              IN A      ${head nets.internet.addrs4}
-          tinc              IN A      ${head nets.internet.addrs4}
           boot              IN A      ${head nets.internet.addrs4}'';
       };
       nets = {
@@ -167,6 +166,7 @@ with import ../../4lib { inherit lib; };
         "krebsco.de" = ''
           wry            IN A ${head nets.internet.addrs4}
           graphs         IN A ${head nets.internet.addrs4}
+          tinc           IN A ${head nets.internet.addrs4}
           '';
       };
       nets = rec {
diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index d8c8d6fa1..03b19d1c7 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -34,15 +34,19 @@ in {
 
   # prepare graphs
   nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
+
   krebs.nginx.enable = true;
+  krebs.retiolum-bootstrap.enable = true;
   makefu.tinc_graphs.enable = true;
+
   makefu.tinc_graphs.krebsNginx = {
     enable = true;
     # TODO: remove hard-coded hostname
     hostnames_complete  = [ "graphs.wry" ];
     hostnames_anonymous = [ "graphs.krebsco.de" ];
   };
-  networking.firewall.allowedTCPPorts = [80];
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
 
   krebs.build = {
     user = config.krebs.users.makefu;

From 8d3ebfc096c10e9d498ca0bed934ad9e35e6c022 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 19 Oct 2015 21:57:05 +0200
Subject: [PATCH 07/10] krebs 3 retiolum-bootstrap: fix assert todo

---
 krebs/3modules/retiolum-bootstrap.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix
index 5cce4c2af..eed11642f 100644
--- a/krebs/3modules/retiolum-bootstrap.nix
+++ b/krebs/3modules/retiolum-bootstrap.nix
@@ -32,9 +32,7 @@ let
   };
 
   imp = {
-    # TODO: assert krebs nginx
-
-    krebs.nginx.servers = {
+    krebs.nginx.servers = assert config.krebs.nginx.enable; {
       retiolum-boot-redir = {
         server-names = singleton cfg.hostname;
         extraConfig = ''

From ded0821d9bf7c85e2197cb7811d5f95987ded02e Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 19 Oct 2015 23:46:10 +0200
Subject: [PATCH 08/10] m 1,2 : wry serves as iodine entry point

---
 krebs/3modules/makefu/default.nix |  2 +-
 makefu/1systems/wry.nix           |  4 +++-
 makefu/2configs/base-sources.nix  |  6 +++---
 makefu/2configs/iodined.nix       | 16 ++++++++++++++++
 4 files changed, 23 insertions(+), 5 deletions(-)
 create mode 100644 makefu/2configs/iodined.nix

diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index 659e71458..acc5d7dd2 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -127,7 +127,6 @@ with import ../../4lib { inherit lib; };
         "krebsco.de" = ''
                             IN MX 10  mx42
           euer              IN MX 1   aspmx.l.google.com.
-          io                IN NS     pigstarter.krebsco.de.
           pigstarter        IN A      ${head nets.internet.addrs4}
           gold              IN A      ${head nets.internet.addrs4}
           boot              IN A      ${head nets.internet.addrs4}'';
@@ -165,6 +164,7 @@ with import ../../4lib { inherit lib; };
       extraZones = {
         "krebsco.de" = ''
           wry            IN A ${head nets.internet.addrs4}
+          io             IN NS     wry.krebsco.de.
           graphs         IN A ${head nets.internet.addrs4}
           tinc           IN A ${head nets.internet.addrs4}
           '';
diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index 03b19d1c7..a7ed93c43 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -11,6 +11,8 @@ in {
       ../2configs/base-sources.nix
       ../2configs/tinc-basic-retiolum.nix
 
+      ../2configs/iodined.nix
+
       # Reaktor
       ../2configs/Reaktor/simpleExtend.nix
   ];
@@ -46,7 +48,7 @@ in {
     hostnames_anonymous = [ "graphs.krebsco.de" ];
   };
 
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  networking.firewall.allowedTCPPorts = [ 53 80 443 ];
 
   krebs.build = {
     user = config.krebs.users.makefu;
diff --git a/makefu/2configs/base-sources.nix b/makefu/2configs/base-sources.nix
index 826cd6fef..7e6bebec3 100644
--- a/makefu/2configs/base-sources.nix
+++ b/makefu/2configs/base-sources.nix
@@ -3,9 +3,9 @@
 {
   krebs.build.source = {
     git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      #url = https://github.com/makefu/nixpkgs;
-      rev = "dc18f39bfb2f9d1ba62c7e8ad98544bb15cb26b2"; # nixos-15.09
+      #url = https://github.com/NixOS/nixpkgs;
+      url = https://github.com/makefu/nixpkgs;
+      rev = "78340b042463fd35caa587b0db2e400e5666dbe1"; # nixos-15.09 + cherry-picked iodine
     };
 
     dir.secrets = {
diff --git a/makefu/2configs/iodined.nix b/makefu/2configs/iodined.nix
new file mode 100644
index 000000000..db8a1bfed
--- /dev/null
+++ b/makefu/2configs/iodined.nix
@@ -0,0 +1,16 @@
+{ services,builtins,environment,pkgs, ... }:
+
+let
+  # TODO: make this a parameter
+  domain = "io.krebsco.de";
+  pw = import <secrets/iodinepw.nix>;
+in {
+
+  services.iodined = {
+    enable = true;
+    domain = domain;
+    ip = "172.16.10.1/24";
+    extraConfig = "-P ${pw}";
+  };
+
+}

From be44341c6ba0d8fe66220f4fe6493a88fdce849b Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Tue, 20 Oct 2015 14:25:49 +0200
Subject: [PATCH 09/10] m 2 mail: split exim-retiolum

---
 makefu/1systems/pornocauster.nix |  1 +
 makefu/2configs/mail-client.nix  | 12 ++++++++++++
 2 files changed, 13 insertions(+)
 create mode 100644 makefu/2configs/mail-client.nix

diff --git a/makefu/1systems/pornocauster.nix b/makefu/1systems/pornocauster.nix
index 8f7f5ea7c..97cf86a4e 100644
--- a/makefu/1systems/pornocauster.nix
+++ b/makefu/1systems/pornocauster.nix
@@ -21,6 +21,7 @@
 
       # applications
       ../2configs/exim-retiolum.nix
+      ../2configs/mail-client.nix
       #../2configs/virtualization.nix
       ../2configs/virtualization-virtualbox.nix
       ../2configs/wwan.nix
diff --git a/makefu/2configs/mail-client.nix b/makefu/2configs/mail-client.nix
new file mode 100644
index 000000000..a6ae33d2f
--- /dev/null
+++ b/makefu/2configs/mail-client.nix
@@ -0,0 +1,12 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+{
+  environment.systemPackages = with pkgs; [
+    msmtp
+    mutt-kz
+    notmuch
+    offlineimap
+  ];
+
+}

From 24271c6f6b4e730eccb238c28ca4b04eb70ede92 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Tue, 20 Oct 2015 18:11:30 +0200
Subject: [PATCH 10/10] m 3 bepasty-server.nix: init

---
 makefu/3modules/bepasty-server.nix | 160 +++++++++++++++++++++++++++++
 1 file changed, 160 insertions(+)
 create mode 100644 makefu/3modules/bepasty-server.nix

diff --git a/makefu/3modules/bepasty-server.nix b/makefu/3modules/bepasty-server.nix
new file mode 100644
index 000000000..d970652a4
--- /dev/null
+++ b/makefu/3modules/bepasty-server.nix
@@ -0,0 +1,160 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  gunicorn = pkgs.pythonPackages.gunicorn;
+  bepasty = pkgs.pythonPackages.bepasty-server;
+  gevent = pkgs.pythonPackages.gevent;
+  python = pkgs.pythonPackages.python;
+  cfg = config.makefu.bepasty-server;
+
+  out = {
+    options.makefu.bepasty-server = api;
+    config = mkIf cfg.enable (mkMerge [(mkIf cfg.serveNginx nginx-imp) imp ]) ;
+  };
+
+  api = {
+    enable = mkEnableOption "Bepasty Servers";
+    serveNginx = mkEnableOption "Serve Bepasty Servers with Nginx";
+
+    servers = mkOption {
+      type = with types; attrsOf optionSet;
+      options = singleton {
+        nginxCfg = mkOption {
+          # TODO use the correct type
+          type = with types; attrsOf unspecified;
+          description = ''
+            additional nginx configuration. see krebs.nginx for all options
+          '' ;
+        };
+        debug = mkOption {
+          type = types.bool;
+          description = ''
+            run server in debug mode
+          '';
+          default = false;
+        };
+
+        # TODO: assert secretKey
+        secretKey = mkOption {
+          type = types.str;
+          description = ''
+            server secret for safe session cookies, must be set.
+          '';
+        };
+
+        # we create a wsgi socket in $workDir/gunicorn-${name}.wsgi
+        workDir = mkOption {
+          type = types.str;
+          description = ''
+            Path to the working directory (used for sockets and pidfile).
+            Defaults to the users home directory. Must be accessible to nginx,
+            permissions will be set to 755
+          '';
+          default = config.users.extraUsers.bepasty.home;
+        };
+
+        dataDir = mkOption {
+          type = types.str;
+          description = ''
+            Defaults to the new users home dir which defaults to
+            /var/lib/bepasty-server/data
+            '';
+          default = "${config.users.extraUsers.bepasty.home}/data";
+        };
+
+        extraConfig = mkOption {
+          type = types.str;
+          default = "";
+          example = ''
+            PERMISSIONS = {
+              'myadminsecret': 'admin,list,create,read,delete',
+            }
+            MAX_ALLOWED_FILE_SIZE = 5 * 1000 * 1000
+            '';
+        };
+
+        defaultPermissions = mkOption {
+          type = types.str;
+          default = "list";
+        };
+
+      };
+      default = {};
+    };
+
+  };
+
+  imp = {
+    # Configures systemd services for each configured server
+    # environment.systemPackages = [ bepasty gunicorn gevent ];
+    systemd.services = mapAttrs' (name: server:
+      nameValuePair ("bepasty-server-${name}")
+        ({
+          description = "Bepasty Server ${name}";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
+          restartIfChanged = true;
+          environment = {
+            BEPASTY_CONFIG = "${server.workDir}/bepasty-${name}.conf";
+            PYTHONPATH= "${bepasty}/lib/${python.libPrefix}/site-packages:${gevent}/lib/${python.libPrefix}/site-packages";
+          };
+          serviceConfig = {
+            Type = "simple";
+            PrivateTmp = true;
+            ExecStartPre = pkgs.writeScript "bepasty-server.${name}-init" ''
+              #!/bin/sh
+              chmod 755 ${server.workDir}
+              mkdir -p ${server.dataDir}
+              cat > ${server.workDir}/bepasty-${name}.conf <<EOF
+              SITENAME="${name}"
+              STORAGE_FILESYSTEM_DIRECTORY="${server.dataDir}"
+              SECRET_KEY="${escapeShellArg server.secretKey}"
+              DEFAULT_PERMISSIONS="${server.defaultPermissions}"
+              ${server.extraConfig}
+              EOF
+            '';
+            Directory = "${bepasty}/lib/${python.libPrefix}/site-packages";
+            # we use Gunicorn to start a wsgi server
+            ExecStart = ''${gunicorn}/bin/gunicorn bepasty.wsgi --name ${name} \
+              --workers 3 --log-level=info \
+              --bind=unix:${server.workDir}/gunicorn-${name}.sock \
+              --pid ${server.workDir}/gunicorn-${name}.pid \
+              -k gevent
+            '';
+          };
+        })
+    ) cfg.servers;
+
+    users.extraUsers.bepasty = {
+      uid = 2796546855; #genid bepasty
+      home = "/var/lib/bepasty-server";
+      createHome = true;
+    };
+  };
+  nginx-imp = {
+    assertions = [ { assertion = config.krebs.nginx.enable;
+                      message = "krebs.nginx.enable must be true"; }];
+
+    krebs.nginx.servers = mapAttrs' (name: server:
+      nameValuePair("bepasty-server-${name}")
+      (server.nginxCfg // {
+        extraConfig = ''
+          client_max_body_size 32M;
+          '';
+        locations = [
+          (nameValuePair ("/")
+          (''
+            proxy_set_header Host $http_host;
+            proxy_pass http://unix:${server.workDir}/gunicorn-${name}.sock;
+          ''))
+          (nameValuePair ("/static/")
+          (''
+            alias ${bepasty}/lib/${python.libPrefix}/site-packages/bepasty/static/;
+          ''))
+          ];
+      })
+    ) cfg.servers ;
+  };
+in
+out