From 7838e709d149b9bf33c542a7451e235a61a29a21 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 12 Dec 2017 18:50:36 +0100
Subject: [PATCH 1/4] krebs.backup: restartIfChanged = false

---
 krebs/3modules/backup.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix
index 6f015d66b..c0b218c15 100644
--- a/krebs/3modules/backup.nix
+++ b/krebs/3modules/backup.nix
@@ -83,6 +83,7 @@ let
           rsync
           utillinux
         ];
+        restartIfChanged = false;
         serviceConfig = rec {
           ExecStart = start plan;
           SyslogIdentifier = ExecStart.name;

From fa3c5eb1d83d2948d9810e1fd9e3d6ef53830722 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 12 Dec 2017 20:30:27 +0100
Subject: [PATCH 2/4] tv urlwatch: watch GitHub Meta

---
 tv/2configs/urlwatch.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tv/2configs/urlwatch.nix b/tv/2configs/urlwatch.nix
index a35254345..b0e12625d 100644
--- a/tv/2configs/urlwatch.nix
+++ b/tv/2configs/urlwatch.nix
@@ -47,7 +47,7 @@ with import <stockholm/lib>;
       #http://hackage.haskell.org/package/web-page
 
       # ref <stockholm/krebs/3modules>, services.openssh.knownHosts.github*
-      https://help.github.com/articles/github-s-ip-addresses/
+      https://api.github.com/meta
 
       # <stockholm/tv/2configs/xserver/xserver.conf.nix>
       # is derived from `configFile` in:

From 2a3a3248def505c64c3f596acefa894959d4a20d Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 12 Dec 2017 21:06:21 +0100
Subject: [PATCH 3/4] cidr2glob: init

Based on https://gist.github.com/speshak/b62fa28b49377cda8047cb227837244c
---
 krebs/5pkgs/simple/cidr2glob.nix | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 krebs/5pkgs/simple/cidr2glob.nix

diff --git a/krebs/5pkgs/simple/cidr2glob.nix b/krebs/5pkgs/simple/cidr2glob.nix
new file mode 100644
index 000000000..9b0b3f86b
--- /dev/null
+++ b/krebs/5pkgs/simple/cidr2glob.nix
@@ -0,0 +1,30 @@
+{ python, writeScriptBin, ... }:
+
+let
+  pythonEnv = python.withPackages (ps: [ ps.netaddr ]);
+in
+  writeScriptBin "cidr2glob" ''
+    #! ${pythonEnv}/bin/python
+
+    import netaddr
+    import re
+    import sys
+
+    def cidr2glob(cidr):
+        net = netaddr.IPNetwork(cidr)
+
+        if net.prefixlen <= 8:
+            return map(lambda subnet: re.sub(r'\.0\.0\.0$', '.*', str(subnet.ip)), net.subnet(8))
+        elif net.prefixlen <= 16:
+            return map(lambda subnet: re.sub(r'\.0\.0$', '.*', str(subnet.ip)), net.subnet(16))
+        elif net.prefixlen <= 24:
+            return map(lambda subnet: re.sub(r'\.0$', '.*', str(subnet.ip)), net.subnet(24))
+        else:
+            return map(lambda ip: str(ip), list(net))
+
+    if __name__ == "__main__":
+        for cidr in sys.stdin:
+            for glob in cidr2glob(cidr):
+                print glob
+
+  ''

From 19fcba24f1ef050a8f8d553f09348adb2a007041 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 12 Dec 2017 21:08:50 +0100
Subject: [PATCH 4/4] github: generate ssh_config from API

---
 krebs/3modules/default.nix | 35 ++++++++++++++++++++---------------
 1 file changed, 20 insertions(+), 15 deletions(-)

diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index a8933e719..5bedbcf25 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -224,21 +224,26 @@ let
             };
           })
         //
-        # GitHub's IPv4 address range is 192.30.252.0/22
-        # Refs https://help.github.com/articles/github-s-ip-addresses/
-        # 192.30.252.0/22 = 192.30.252.0-192.30.255.255 (1024 addresses)
-        # Because line length is limited by OPENSSH_LINE_MAX (= 8192),
-        # we split each /24 into its own entry.
-        listToAttrs (map
-          (c: {
-            name = "github${toString c}";
-            value = {
-              hostNames = ["github.com"] ++
-                map (d: "192.30.${toString c}.${toString d}") (range 0 255);
-              publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==";
-            };
-          })
-          (range 252 255))
+        {
+          github = {
+            hostNames = [
+              "github.com"
+              # List generated with
+              # curl -sS https://api.github.com/meta | jq -r .git[] | cidr2glob
+              "192.30.253.*"
+              "192.30.254.*"
+              "192.30.255.*"
+              "185.199.108.*"
+              "185.199.109.*"
+              "185.199.110.*"
+              "185.199.111.*"
+              "18.195.85.27"
+              "18.194.104.89"
+              "35.159.8.160"
+            ];
+            publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==";
+          };
+        }
         //
         mapAttrs
           (name: host: {