From c338330f066e3fe6903158ad6536d71a70cf1daa Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 12 Feb 2016 23:20:50 +0100
Subject: [PATCH 01/31] make install: make ssh configurable

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index f39ed0c02..a25b90771 100644
--- a/Makefile
+++ b/Makefile
@@ -29,7 +29,7 @@ eval eval.:;@$(call evaluate)
 eval.%:;@$(call evaluate,-A $*)
 
 # usage: make install system=foo [target_host=bar]
-install: ssh = ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
+install: ssh ?= ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
 install:
 	$(ssh) $(target_user)@$(target_host) \
 		env target_path=$(target_path) \

From e0443f975be5e2d9dcea1c745cd46e856b7a400b Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 14:08:27 +0100
Subject: [PATCH 02/31] vncdotool: init at 0.9.0

---
 krebs/5pkgs/vncdotool/default.nix | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 krebs/5pkgs/vncdotool/default.nix

diff --git a/krebs/5pkgs/vncdotool/default.nix b/krebs/5pkgs/vncdotool/default.nix
new file mode 100644
index 000000000..95e2ca706
--- /dev/null
+++ b/krebs/5pkgs/vncdotool/default.nix
@@ -0,0 +1,20 @@
+{ lib, pythonPackages, fetchurl, ... }:
+with pythonPackages; buildPythonPackage rec {
+  name = lib.removeSuffix ".tar.gz" (builtins.baseNameOf src.name);
+
+  src = fetchurl {
+    url = https://pypi.python.org/packages/source/v/vncdotool/vncdotool-0.9.0.tar.gz;
+    sha256 = "1hl44w4x9c8air0g6kp9h1af2vj4lmc50vnsxmca9g080740iyvi";
+  };
+
+  propagatedBuildInputs = [
+    twisted
+    pillow
+  ];
+
+  meta = {
+    homepage = https://github.com/sibson/vncdotool;
+    description = "A command line VNC client and python library";
+    license = lib.licenses.mit;
+  };
+}

From 45bd2ca7a2055e6d3f6e3d70edbbc9bebd9cbc40 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 14:25:44 +0100
Subject: [PATCH 03/31] noVNC: init at 0.5.1

---
 krebs/5pkgs/noVNC/default.nix | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 krebs/5pkgs/noVNC/default.nix

diff --git a/krebs/5pkgs/noVNC/default.nix b/krebs/5pkgs/noVNC/default.nix
new file mode 100644
index 000000000..629d288ae
--- /dev/null
+++ b/krebs/5pkgs/noVNC/default.nix
@@ -0,0 +1,21 @@
+{ fetchgit, lib, stdenv, ... }:
+with builtins;
+with lib;
+stdenv.mkDerivation rec {
+  name = "${baseNameOf src.name}-${removePrefix "refs/tags/v" src.rev}";
+
+  src = fetchgit {
+    url = https://github.com/kanaka/noVNC;
+    rev = "refs/tags/v0.5.1";
+    sha256 = "1azsnppwnrsv3axj0r5bw8lfarkibgz5vhgcyj8dzn4afn98f55w";
+  };
+
+  phases = [
+    "unpackPhase"
+    "installPhase"
+  ];
+
+  installPhase = ''
+    cp -R . $out
+  '';
+}

From 411aec6bf9d1b53813e693f22b77972a00ce9078 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 16:03:40 +0100
Subject: [PATCH 04/31] deploy,install,populate: admit target SSH port

---
 Makefile                 | 8 +++++---
 krebs/3modules/build.nix | 5 ++++-
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/Makefile b/Makefile
index a25b90771..c7dee134c 100644
--- a/Makefile
+++ b/Makefile
@@ -4,6 +4,7 @@ endif
 
 export target_host ?= $(system)
 export target_user ?= root
+export target_port ?= 22
 export target_path ?= /var/src
 
 evaluate = \
@@ -22,7 +23,8 @@ execute = \
 # usage: make deploy system=foo [target_host=bar]
 deploy:
 	$(call execute,populate)
-	ssh $(target_user)@$(target_host) nixos-rebuild switch -I $(target_path)
+	ssh $(target_user)@$(target_host) -p $(target_port) \
+		nixos-rebuild switch -I $(target_path)
 
 # usage: make LOGNAME=shared system=wolf eval.config.krebs.build.host.name
 eval eval.:;@$(call evaluate)
@@ -31,10 +33,10 @@ eval.%:;@$(call evaluate,-A $*)
 # usage: make install system=foo [target_host=bar]
 install: ssh ?= ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
 install:
-	$(ssh) $(target_user)@$(target_host) \
+	$(ssh) $(target_user)@$(target_host) -p $(target_port) \
 		env target_path=$(target_path) \
 			sh -s prepare < krebs/4lib/infest/prepare.sh
 	target_path=/mnt$(target_path) $(call execute,populate)
-	$(ssh) $(target_user)@$(target_host) \
+	$(ssh) $(target_user)@$(target_host) -p $(target_port) \
 		env NIXOS_CONFIG=$(target_path)/nixos-config \
 			nixos-install
diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix
index 3530fd595..1569072d1 100644
--- a/krebs/3modules/build.nix
+++ b/krebs/3modules/build.nix
@@ -51,6 +51,7 @@ let
         source = config.krebs.build.source;
         target-user = maybeEnv "target_user" "root";
         target-host = maybeEnv "target_host" config.krebs.build.host.name;
+        target-port = maybeEnv "target_port" "22";
         target-path = maybeEnv "target_path" "/var/src";
         out = ''
           #! /bin/sh
@@ -62,7 +63,8 @@ let
           }
 
           echo ${shell.escape git-script} \
-            | ssh ${shell.escape "${target-user}@${target-host}"} -T
+            | ssh -p ${shell.escape target-port} \
+                  ${shell.escape "${target-user}@${target-host}"} -T
 
           unset tmpdir
           trap '
@@ -93,6 +95,7 @@ let
                     (attrNames file-specs)} \
                   --delete \
                   -vFrlptD \
+                  -e ${shell.escape "ssh -p ${target-port}"} \
                   ${shell.escape target-path}/ \
                   ${shell.escape "${target-user}@${target-host}:${target-path}"}
         '';

From d38853027efe650e6de4b335014cd238624cd993 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 16:07:01 +0100
Subject: [PATCH 05/31] krebs.nginx: default locations = []

---
 krebs/3modules/nginx.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix
index 921771033..5bc0903e4 100644
--- a/krebs/3modules/nginx.nix
+++ b/krebs/3modules/nginx.nix
@@ -34,6 +34,7 @@ let
         };
         locations = mkOption {
           type = with types; listOf (attrsOf str);
+          default = [];
         };
         extraConfig = mkOption {
           type = with types; string;
@@ -76,8 +77,8 @@ let
     server {
       ${concatMapStringsSep "\n" (x: "listen ${x};") listen}
       server_name ${toString server-names};
-      ${extraConfig}
-      ${indent (concatStrings (map to-location locations))}
+      ${indent extraConfig}
+      ${indent (concatMapStrings to-location locations)}
     }
   '';
 

From 67b77ae4d7626d6007cc8e0726ca3b8239429681 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 16:21:24 +0100
Subject: [PATCH 06/31] krebs/4lib/infest: merge install-nix.sh into prepare.sh

---
 krebs/4lib/infest/install-nix.sh | 50 -------------------------------
 krebs/4lib/infest/prepare.sh     | 51 ++++++++++++++++++++++++++++++--
 2 files changed, 49 insertions(+), 52 deletions(-)
 delete mode 100644 krebs/4lib/infest/install-nix.sh

diff --git a/krebs/4lib/infest/install-nix.sh b/krebs/4lib/infest/install-nix.sh
deleted file mode 100644
index af1a8bd16..000000000
--- a/krebs/4lib/infest/install-nix.sh
+++ /dev/null
@@ -1,50 +0,0 @@
-#! /bin/sh
-set -efu
-
-nix_url=https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-linux.tar.bz2
-nix_sha256=504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4
-
-install_nix() {(
-
-  # install nix on host (cf. https://nixos.org/nix/install)
-  if ! test -e /root/.nix-profile/etc/profile.d/nix.sh; then
-    (
-      verify() {
-        printf '%s  %s\n' $nix_sha256  $(basename $nix_url) | sha256sum -c
-      }
-      if ! verify; then
-        curl -C - -O "$nix_url"
-        verify
-      fi
-    )
-    nix_src_dir=$(basename $nix_url .tar.bz2)
-    tar jxf $nix_src_dir.tar.bz2
-    $nix_src_dir/install
-  fi
-
-  . /root/.nix-profile/etc/profile.d/nix.sh
-
-  for i in \
-    bash \
-    coreutils \
-    # This line intentionally left blank.
-  do
-    if ! nix-env -q $i | grep -q .; then
-      nix-env -iA nixpkgs.pkgs.$i
-    fi
-  done
-
-  # install nixos-install
-  if ! type nixos-install 2>/dev/null; then
-    nixpkgs_expr='import <nixpkgs> { system = builtins.currentSystem; }'
-    nixpkgs_path=$(find /nix/store -mindepth 1 -maxdepth 1 -name *-nixpkgs-* -type d)
-    nix-env \
-      --arg config "{ nix.package = ($nixpkgs_expr).nix; }" \
-      --arg pkgs "$nixpkgs_expr" \
-      --arg modulesPath 'throw "no modulesPath"' \
-      -f $nixpkgs_path/nixpkgs/nixos/modules/installer/tools/tools.nix \
-      -iA config.system.build.nixos-install
-  fi
-)}
-
-install_nix "$@"
diff --git a/krebs/4lib/infest/prepare.sh b/krebs/4lib/infest/prepare.sh
index 0bfc49380..d9271da73 100644
--- a/krebs/4lib/infest/prepare.sh
+++ b/krebs/4lib/infest/prepare.sh
@@ -1,6 +1,9 @@
 #! /bin/sh
 set -efu
 
+nix_url=https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-linux.tar.bz2
+nix_sha256=504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4
+
 prepare() {(
   if test -e /etc/os-release; then
     . /etc/os-release
@@ -70,7 +73,7 @@ prepare_debian() {
   prepare_common
 }
 
-prepare_common() {
+prepare_common() {(
 
   if ! getent group nixbld >/dev/null; then
     groupadd -g 30000 -r nixbld
@@ -133,6 +136,50 @@ prepare_common() {
     mkdir -p /mnt/nix
     mount --bind /nix /mnt/nix
   fi
-}
+
+  #
+  # install nix
+  #
+
+  # install nix on host (cf. https://nixos.org/nix/install)
+  if ! test -e /root/.nix-profile/etc/profile.d/nix.sh; then
+    (
+      verify() {
+        printf '%s  %s\n' $nix_sha256  $(basename $nix_url) | sha256sum -c
+      }
+      if ! verify; then
+        curl -C - -O "$nix_url"
+        verify
+      fi
+    )
+    nix_src_dir=$(basename $nix_url .tar.bz2)
+    tar jxf $nix_src_dir.tar.bz2
+    $nix_src_dir/install
+  fi
+
+  . /root/.nix-profile/etc/profile.d/nix.sh
+
+  for i in \
+    bash \
+    coreutils \
+    # This line intentionally left blank.
+  do
+    if ! nix-env -q $i | grep -q .; then
+      nix-env -iA nixpkgs.pkgs.$i
+    fi
+  done
+
+  # install nixos-install
+  if ! type nixos-install 2>/dev/null; then
+    nixpkgs_expr='import <nixpkgs> { system = builtins.currentSystem; }'
+    nixpkgs_path=$(find /nix/store -mindepth 1 -maxdepth 1 -name *-nixpkgs-* -type d)
+    nix-env \
+      --arg config "{ nix.package = ($nixpkgs_expr).nix; }" \
+      --arg pkgs "$nixpkgs_expr" \
+      --arg modulesPath 'throw "no modulesPath"' \
+      -f $nixpkgs_path/nixpkgs/nixos/modules/installer/tools/tools.nix \
+      -iA config.system.build.nixos-install
+  fi
+)}
 
 prepare "$@"

From eb0797b7edcdfd6b01e5c99735799ccfdbf12153 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 16:22:23 +0100
Subject: [PATCH 07/31] krebs/4lib/infest/prepare.sh: recognize NixOS ISO

---
 krebs/4lib/infest/prepare.sh | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/krebs/4lib/infest/prepare.sh b/krebs/4lib/infest/prepare.sh
index d9271da73..b3824c7d4 100644
--- a/krebs/4lib/infest/prepare.sh
+++ b/krebs/4lib/infest/prepare.sh
@@ -36,6 +36,13 @@ prepare() {(
             ;;
         esac
         ;;
+      nixos)
+        case $(cat /proc/cmdline) in
+          *' root=LABEL=NIXOS_ISO '*)
+            prepare_nixos_iso "$@"
+            exit
+        esac
+        ;;
     esac
   elif test -e /etc/centos-release; then
     case $(cat /etc/centos-release) in
@@ -73,6 +80,24 @@ prepare_debian() {
   prepare_common
 }
 
+prepare_nixos_iso() {
+  mountpoint /mnt
+
+  type git 2>/dev/null || nix-env -iA nixos.git
+
+  mkdir -p /mnt/"$target_path"
+  mkdir -p "$target_path"
+
+  if ! mountpoint "$target_path"; then
+    mount --rbind /mnt/"$target_path" "$target_path"
+  fi
+
+  mkdir -p bin
+  rm -f bin/nixos-install
+  cp "$(type -p nixos-install)" bin/nixos-install
+  sed -i "s@^NIX_PATH=\"[^\"]*\"@NIX_PATH=$target_path@" bin/nixos-install
+}
+
 prepare_common() {(
 
   if ! getent group nixbld >/dev/null; then

From 49efebaad725fbc3c3e0eae9e97e8311844f262c Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 16:45:26 +0100
Subject: [PATCH 08/31] execve: allow argv propagation

---
 krebs/5pkgs/builders.nix | 39 +++++++++++++++++++++++++--------------
 1 file changed, 25 insertions(+), 14 deletions(-)

diff --git a/krebs/5pkgs/builders.nix b/krebs/5pkgs/builders.nix
index b3cb1c943..43707aeca 100644
--- a/krebs/5pkgs/builders.nix
+++ b/krebs/5pkgs/builders.nix
@@ -1,19 +1,30 @@
 { lib, pkgs, ... }:
 with lib;
-{
-  execve = name: { filename, argv, envp ? {}, destination ? "" }:
-    writeC name { inherit destination; } ''
-      #include <unistd.h>
-      int main () {
-        const char *filename = ${toC filename};
-        char *const argv[] = ${toC (argv ++ [null])};
-        char *const envp[] = ${toC (
-          mapAttrsToList (k: v: "${k}=${v}") envp ++ [null]
-        )};
-        execve(filename, argv, envp);
-        return -1;
-      }
-    '';
+rec {
+  execve = name: { filename, argv ? null, envp ? {}, destination ? "" }: let
+  in writeC name { inherit destination; } ''
+    #include <unistd.h>
+
+    static char *const filename = ${toC filename};
+
+    ${if argv == null
+      then /* Propagate arguments */ ''
+        #define MAIN_ARGS int argc, char **argv
+      ''
+      else /* Provide fixed arguments */ ''
+        #define MAIN_ARGS void
+        static char *const argv[] = ${toC (argv ++ [null])};
+      ''}
+
+    static char *const envp[] = ${toC (
+      mapAttrsToList (k: v: "${k}=${v}") envp ++ [null]
+    )};
+
+    int main (MAIN_ARGS) {
+      execve(filename, argv, envp);
+      return -1;
+    }
+  '';
 
   execveBin = name: cfg: execve name (cfg // { destination = "/bin/${name}"; });
 

From 96f3dbe6ec9f7eb6f9a897c960abbbe30ad316b9 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 16:46:15 +0100
Subject: [PATCH 09/31] krebs.types.host: default to empty nets

---
 krebs/4lib/types.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index 873f3ddfb..d0a537467 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -17,6 +17,7 @@ types // rec {
       };
       nets = mkOption {
         type = attrsOf net;
+        default = {};
       };
 
       extraZones = mkOption {

From 0257acf93a7cfc91fa65b0d00dcf7f70caa9a33b Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 17:56:06 +0100
Subject: [PATCH 10/31] tv urlwatch: add vncdotool and noVNC

---
 tv/2configs/urlwatch.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tv/2configs/urlwatch.nix b/tv/2configs/urlwatch.nix
index 8189f6345..0106cddf7 100644
--- a/tv/2configs/urlwatch.nix
+++ b/tv/2configs/urlwatch.nix
@@ -51,6 +51,9 @@
       # <stockholm/tv/2configs/xserver/xserver.conf.nix>
       # is derived from `configFile` in:
       https://raw.githubusercontent.com/NixOS/nixpkgs/master/nixos/modules/services/x11/xserver.nix
+
+      https://pypi.python.org/pypi/vncdotool
+      https://api.github.com/repos/kanaka/noVNC/tags
     ];
   };
 }

From de4260a6a2b77aeb8115167ee63c1b20facd5b6a Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 17:56:59 +0100
Subject: [PATCH 11/31] tv backup: add xu-test-*

---
 tv/2configs/backup.nix | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix
index 6c90709a8..57f299ebd 100644
--- a/tv/2configs/backup.nix
+++ b/tv/2configs/backup.nix
@@ -26,5 +26,28 @@ with lib;
         yearly   = { format = "%Y";                       };
       };
     };
+  } // mapAttrs (_: recursiveUpdate {
+    snapshots = {
+      minutely = { format = "%Y-%m-%dT%H:%M"; retain = 3; };
+      hourly   = { format = "%Y-%m-%dT%H";    retain = 3; };
+      daily    = { format = "%Y-%m-%d";       retain = 3; };
+    };
+    startAt = null;
+  }) {
+    xu-test-push-xu = {
+      method = "push";
+      src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; };
+      dst = { host = config.krebs.hosts.xu; path = "/bku/xu-test-push"; };
+    };
+    xu-test-pull-xu = {
+      method = "pull";
+      src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; };
+      dst = { host = config.krebs.hosts.xu; path = "/bku/xu-test-pull"; };
+    };
+    xu-test-push-wu = {
+      method = "push";
+      src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; };
+      dst = { host = config.krebs.hosts.wu; path = "/bku/xu-test-push"; };
+    };
   };
 }

From 9fbd327b80caa3c79940631138963e2e4b069ff7 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 17:58:02 +0100
Subject: [PATCH 12/31] tv systemPackages: add get, krebszones,
 nix-prefetch-scripts, and push

---
 tv/2configs/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index b5639af51..dee0b15b1 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -183,6 +183,15 @@ with lib;
         "sendmail"  # for sudo
       ];
     }
+    {
+      environment.systemPackages = [
+        pkgs.get
+        pkgs.krebszones
+        pkgs.nix-prefetch-scripts
+        pkgs.push
+      ];
+    }
+
     {
       systemd.tmpfiles.rules = let
         forUsers = flip map users;

From 7bc891476d143f03185b5d948d92599a20adc385 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 17:58:40 +0100
Subject: [PATCH 13/31] xu systemPackages: s/#cac/cac-api/

---
 tv/1systems/xu.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 8c4af2bd3..6f882cd4a 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -43,7 +43,7 @@ with lib;
         # tv
         bc
         bind # dig
-        #cac
+        cac-api
         dic
         file
         gnupg21

From bc73780b06d5841cf49d2696911f9733330f00d9 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 18:15:59 +0100
Subject: [PATCH 14/31] tv: lol libvirt

---
 tv/1systems/wu.nix | 3 ---
 tv/1systems/xu.nix | 2 --
 2 files changed, 5 deletions(-)

diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 4ed13a0ea..0184ed991 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -191,8 +191,6 @@ with lib;
     "d /tmp 1777 root root - -" # does this work with mounted /tmp?
   ];
 
-  virtualisation.libvirtd.enable = true;
-
   services.udev.extraRules = ''
     SUBSYSTEM=="net", ATTR{address}=="00:90:f5:da:aa:c3", NAME="en0"
     SUBSYSTEM=="net", ATTR{address}=="a0:88:b4:1b:ae:6c", NAME="wl0"
@@ -211,5 +209,4 @@ with lib;
   services.tor.client.enable = true;
   services.tor.enable = true;
   services.virtualboxHost.enable = true;
-
 }
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 6f882cd4a..098d5ffa5 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -189,8 +189,6 @@ with lib;
     "d /tmp 1777 root root - -" # does this work with mounted /tmp?
   ];
 
-  #virtualisation.libvirtd.enable = true;
-
   #services.bitlbee.enable = true;
   #services.tor.client.enable = true;
   #services.tor.enable = true;

From 05bca39544b248d209e371a8406b97e47d63516c Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 18:17:55 +0100
Subject: [PATCH 15/31] nixpkgs: enable nix-* autocall

---
 nixpkgs/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nixpkgs/default.nix b/nixpkgs/default.nix
index 1fe99b0ab..8514fa499 100644
--- a/nixpkgs/default.nix
+++ b/nixpkgs/default.nix
@@ -1,5 +1,6 @@
-_:
+{ system ? builtins.currentSystem }:
 
 (import <stockholm> {
+  inherit system;
   configuration = {};
 }).pkgs

From 115711d529500684da5b72f3e20c98279184b045 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 18:21:17 +0100
Subject: [PATCH 16/31] xu-qemu0: init

---
 tv/1systems/xu-qemu0.nix |  27 +++++
 tv/1systems/xu.nix       |   1 +
 tv/2configs/xu-qemu0.nix | 226 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 254 insertions(+)
 create mode 100644 tv/1systems/xu-qemu0.nix
 create mode 100644 tv/2configs/xu-qemu0.nix

diff --git a/tv/1systems/xu-qemu0.nix b/tv/1systems/xu-qemu0.nix
new file mode 100644
index 000000000..03ac19cf7
--- /dev/null
+++ b/tv/1systems/xu-qemu0.nix
@@ -0,0 +1,27 @@
+{ config, lib, pkgs, ... }:
+
+{
+  krebs.hosts.xu-qemu0 = {
+    cores = 1;
+    ssh.privkey.path = <secrets/ssh.id_ed25519>;
+    # cannot define ssh.pubkey without at least one addr or alias
+    #ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFe51rD0ZqlMXNi/YpapnRzvdzCjI0icmxfCyBLSKG04";
+  };
+  krebs.build.host = config.krebs.hosts.xu-qemu0;
+
+  imports = [
+    <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
+  ];
+
+  boot.loader.grub.device = "/dev/sda";
+
+  fileSystems = {
+    "/boot" = {
+      device = "/dev/sda1";
+    };
+    "/" = {
+      device = "/dev/sda2";
+      fsType = "btrfs";
+    };
+  };
+}
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 098d5ffa5..2719d56f4 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -14,6 +14,7 @@ with lib;
     ../2configs/pulse.nix
     ../2configs/retiolum.nix
     ../2configs/xserver
+    ../2configs/xu-qemu0.nix
     {
       environment.systemPackages = with pkgs; [
 
diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
new file mode 100644
index 000000000..836603663
--- /dev/null
+++ b/tv/2configs/xu-qemu0.nix
@@ -0,0 +1,226 @@
+{ config, lib, pkgs, ... }:
+
+let
+  # XXX cannot use config.build.host.name here because infinite recursion when
+  # defining  krebs.hosts.${host-name}.nets.retiolum.aliases  below.
+  host-name = "xu";
+in
+
+# usage:
+#   sudo -iu df xu-qemu0
+#   set_password vnc correcthorze
+#
+#   vncdo -s xu:1 type 'curl init.xu.r' key shift-\\ type sh key return
+#
+#   http://vnc.xu/vnc_auto.html?port=5701&host=xu&password=correcthorze
+#
+#   make [install] system=xu-qemu0 target_host=10.56.0.101
+
+
+with lib;
+
+{
+  #networking.wireless.interfaces = [ "wlp3s0" ];
+
+  #networking.useNetworkd = true;
+
+  #networking.dhcpcd.allowInterfaces = [
+  #  "qemubr0"
+  #];
+
+  #systemd.network.networks.wlp3s0 = {
+  #  matchConfig.name = "wlp3s0";
+  #  networkConfig.Bridge = "qemubr0";
+  #};
+
+  systemd.network.enable = true;
+
+  systemd.network.netdevs.qemubr0 = {
+    netdevConfig = {
+      Name = "qemubr0";
+      Kind = "bridge";
+    };
+  };
+
+  users.groups.qemu-users.gid = genid "qemu-users";
+  users.users.df.extraGroups = [ "qemu-users" ];
+
+  environment.etc."qemu/bridge.conf".text = ''
+    allow qemubr0
+  '';
+
+  krebs.per-user.tv.packages = [
+    pkgs.vncdotool
+  ];
+
+  krebs.per-user.df.packages = [
+    (pkgs.writeDashBin "xu-qemu0" ''
+      set -efux
+      img=$HOME/tmp/xu-qemu0.raw
+      if ! test -e "$img"; then
+        ${pkgs.coreutils}/bin/mkdir -p "$(${pkgs.coreutils}/bin/dirname "$img")"
+        ${pkgs.kvm}/bin/qemu-img create "$img" 10G
+      fi
+      exec ${pkgs.kvm}/bin/qemu-kvm \
+          -monitor stdio \
+          -boot order=cd \
+          -cdrom ${pkgs.fetchurl {
+            url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso;
+            sha256 = "18bc9wrsrjnhj9rya75xliqkl99gxbsk4dmwqivhvwfzb5qb5yp9";
+          }} \
+          -m 1024 \
+          -netdev bridge,br=qemubr0,id=hn0,helper=/var/setuid-wrappers/qemu-bridge-helper \
+          -net nic,netdev=hn0,id=nic1,macaddr=52:54:00:12:34:56 \
+          -drive file="$img",format=raw \
+          -display vnc=:1,websocket=5701,password,lossy \
+          -name xu-qemu0 \
+    '')
+  ];
+
+  #TODO krebs.setuid.qemu-bridge-helper = {
+  #  filename = "${pkgs.qemu}/libexec/qemu-bridge-helper";
+  #  owner = "root";
+  #  group = "qemu-users";
+  #  mode = "4710";
+  #};
+  system.activationScripts."krebs.setuid" = stringAfter [ "setuid" ] ''
+    src=${pkgs.execve "qemu-bridge-helper" {
+      filename = "${pkgs.qemu}/libexec/qemu-bridge-helper";
+    }}
+    dst=${config.security.wrapperDir}/qemu-bridge-helper
+    cp "$src" "$dst"
+    chown root.qemu-users "$dst"
+    chmod 4710 "$dst"
+  '';
+
+  users.users.qemu-dnsmasq.uid = genid "qemu-dnsmasq";
+
+  # TODO need custom etc/dbus-1/system.d/dnsmasq.conf for different BusName
+  services.dbus.packages = [ pkgs.dnsmasq ];
+
+  systemd.services.qemu-dnsmasq = let
+    # bind-interfaces
+    conf = pkgs.writeText "qemu-dnsmasq.conf" ''
+      listen-address=10.56.0.1
+      interface=qemubr0
+      dhcp-range=10.56.0.200,10.56.0.250
+      dhcp-no-override
+      dhcp-leasefile=/tmp/qemu-dnsmasq.leases
+      domain=${host-name}.local
+      dhcp-host=52:54:00:12:34:56,xu-qemu0,10.56.0.101,1440m
+    '';
+  in {
+    after = [ "network.target" "systemd-resolved.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "dbus";
+      BusName = "uk.org.thekelleys.dnsmasq";
+      # -1 --enable-dbus[=uk.org.thekelleys.dnsmasq]
+      SyslogIdentifier = "qemu-dnsmasq";
+      ExecStart = "${pkgs.dnsmasq}/bin/dnsmasq -1k -u qemu-dnsmasq -C ${conf}";
+      ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+      PrivateTmp = "true";
+    };
+    restartTriggers = [ config.environment.etc.hosts.source ];
+  };
+
+
+  krebs.nginx.servers.init = {
+    server-names = [
+      "init.${host-name}"
+      "init.${host-name}.r"
+      "init.${host-name}.retiolum"
+    ];
+    extraConfig = ''
+      index init.txt;
+      root ${pkgs.writeTextFile {
+        name = "init-pages";
+        text = ''
+          #! /bin/sh
+          set -efu
+
+          dev=/dev/sda
+          pttype=dos # gpt
+
+          case $pttype in
+            dos)
+              if ! test "$(blkid -o value -s PTTYPE "$dev")" = dos; then
+                parted -s "$dev" mklabel msdos
+              fi
+              if ! test "$(blkid -o value -s PARTLABEL "$dev"1)" = primary; then
+                parted -s "$dev" mkpart primary ext4 1MiB 513MiB
+                parted -s "$dev" set 1 boot on
+              fi
+              ;;
+            gpt)
+              if ! test "$(blkid -o value -s PTTYPE "$dev")" = gpt; then
+                parted -s "$dev" mklabel gpt
+              fi
+              if ! test "$(blkid -o value -s PARTLABEL "$dev"1)" = ESP; then
+                parted -s "$dev" mkpart ESP fat32 1MiB 513MiB
+                parted -s "$dev" set 1 boot on
+              fi
+              ;;
+            *)
+              echo "Error: bad pttype: $pttype" >&2
+              exit -1
+          esac
+
+          if ! test "$(blkid -o value -s PARTLABEL "$dev"2)" = primary; then
+            parted -s "$dev" mkpart primary btrfs 513MiB 100%
+          fi
+          if ! test "$(blkid -o value -s TYPE "$dev"1)" = vfat; then
+            mkfs.vfat "$dev"1
+          fi
+          if ! test "$(blkid -o value -s TYPE "$dev"2)" = btrfs; then
+            mkfs.btrfs "$dev"2
+          fi
+
+          parted "$dev" print
+
+          if ! test "$(lsblk -n -o MOUNTPOINT "$dev"2)" = /mnt; then
+            mount "$dev"2 /mnt
+          fi
+          if ! test "$(lsblk -n -o MOUNTPOINT "$dev"1)" = /mnt/boot; then
+            mkdir -m 0000 -p /mnt/boot
+            mount "$dev"1 /mnt/boot
+          fi
+
+          lsblk "$dev"
+
+          key=${shell.escape config.krebs.users.tv-xu.pubkey}
+
+          if [ "$(cat /root/.ssh/authorized_keys 2>/dev/null)" != "$key" ]; then
+            mkdir -p /root/.ssh
+            echo "$key" > /root/.ssh/authorized_keys
+          fi
+          systemctl start sshd
+          ip route
+          echo READY.
+        '';
+        destination = "/init.txt";
+      }};
+    '';
+  };
+
+
+  krebs.hosts.${host-name}.nets.retiolum.aliases = [
+    "init.${host-name}.r"
+    "init.${host-name}.retiolum"
+    "vnc.${host-name}.r"
+    "vnc.${host-name}.retiolum"
+  ];
+
+  krebs.nginx.servers.noVNC = {
+    server-names = [
+      "vnc.${host-name}"
+      "vnc.${host-name}.r"
+      "vnc.${host-name}.retiolum"
+    ];
+    #rewrite ^([^.]*)$ /vnc_auto.html?host=localhost&port=5701;
+    locations = singleton (nameValuePair "/" ''
+      index vnc.html;
+      root ${pkgs.noVNC};
+    '');
+  };
+}

From 0e35bc5c193916a5424689d04234978d3c57ecf5 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 19:43:02 +0100
Subject: [PATCH 17/31] wbob: fix addrs

---
 krebs/3modules/makefu/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index 2811c0c52..d21c80e78 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -292,8 +292,8 @@ with lib;
       cores = 1;
       nets = {
         retiolm = {
-          addrs4 = ["10.243.214.15/32"];
-          addrs6 = ["42:5a02:2c30:c1b1:3f2e:7c19:2496:a732/128"];
+          addrs4 = ["10.243.214.15"];
+          addrs6 = ["42:5a02:2c30:c1b1:3f2e:7c19:2496:a732"];
           aliases = [
               "wbob.retiolum"
           ];

From 3ca0df0447c30d83c14144ad6f9a95cd4514117c Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 19:57:45 +0100
Subject: [PATCH 18/31] tv: add systemd.services.xu-qemu0 + xu-qemu0-monitor

---
 tv/2configs/default.nix  |  1 +
 tv/2configs/xu-qemu0.nix | 86 ++++++++++++++++++++++++++++------------
 2 files changed, 61 insertions(+), 26 deletions(-)

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index dee0b15b1..2edaed76d 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -44,6 +44,7 @@ with lib;
           tv = {
             isNormalUser = true;
             uid = 1337;
+            extraGroups = [ "tv" ];
           };
         };
       };
diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
index 836603663..4584dcd7c 100644
--- a/tv/2configs/xu-qemu0.nix
+++ b/tv/2configs/xu-qemu0.nix
@@ -7,8 +7,7 @@ let
 in
 
 # usage:
-#   sudo -iu df xu-qemu0
-#   set_password vnc correcthorze
+#   echo set_password vnc correcthorze | xu-qemu0-monitor
 #
 #   vncdo -s xu:1 type 'curl init.xu.r' key shift-\\ type sh key return
 #
@@ -16,6 +15,13 @@ in
 #
 #   make [install] system=xu-qemu0 target_host=10.56.0.101
 
+# TODO iptables -A INPUT -p udp -m udp --dport bootps -j ACCEPT
+# TODO iptables -A FORWARD -i qemubr0 -s 10.56.0.1/24 -m conntrack --ctstate NEW -j ACCEPT
+# TODO iptables -A POSTROUTING -t nat -j MASQUERADE
+# TODO iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+# TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT
+# TODO echo 1 > /proc/sys/net/ipv4/ip_forward
+# TODO ifconfig qemubr0 10.56.0.1/24 up
 
 with lib;
 
@@ -43,7 +49,6 @@ with lib;
   };
 
   users.groups.qemu-users.gid = genid "qemu-users";
-  users.users.df.extraGroups = [ "qemu-users" ];
 
   environment.etc."qemu/bridge.conf".text = ''
     allow qemubr0
@@ -53,29 +58,58 @@ with lib;
     pkgs.vncdotool
   ];
 
-  krebs.per-user.df.packages = [
-    (pkgs.writeDashBin "xu-qemu0" ''
-      set -efux
-      img=$HOME/tmp/xu-qemu0.raw
-      if ! test -e "$img"; then
-        ${pkgs.coreutils}/bin/mkdir -p "$(${pkgs.coreutils}/bin/dirname "$img")"
-        ${pkgs.kvm}/bin/qemu-img create "$img" 10G
-      fi
-      exec ${pkgs.kvm}/bin/qemu-kvm \
-          -monitor stdio \
-          -boot order=cd \
-          -cdrom ${pkgs.fetchurl {
-            url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso;
-            sha256 = "18bc9wrsrjnhj9rya75xliqkl99gxbsk4dmwqivhvwfzb5qb5yp9";
-          }} \
-          -m 1024 \
-          -netdev bridge,br=qemubr0,id=hn0,helper=/var/setuid-wrappers/qemu-bridge-helper \
-          -net nic,netdev=hn0,id=nic1,macaddr=52:54:00:12:34:56 \
-          -drive file="$img",format=raw \
-          -display vnc=:1,websocket=5701,password,lossy \
-          -name xu-qemu0 \
-    '')
-  ];
+  users.users.xu-qemu0 = {
+    createHome = true;
+    group = "qemu-users";
+    home = "/home/xu-qemu0";
+    uid = genid "xu-qemu0";
+  };
+
+  systemd.services.xu-qemu0 = let
+  in {
+    after = [ "network.target" "systemd-resolved.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      User = "xu-qemu0";
+      SyslogIdentifier = "xu-qemu0";
+      ExecStart = pkgs.writeDash "xu-qemu0" ''
+        set -efu
+        img=$HOME/tmp/xu-qemu0.raw
+        if ! test -e "$img"; then
+          ${pkgs.coreutils}/bin/mkdir -p "$(${pkgs.coreutils}/bin/dirname "$img")"
+          ${pkgs.kvm}/bin/qemu-img create "$img" 10G
+        fi
+        exec ${pkgs.kvm}/bin/qemu-kvm \
+            -monitor unix:$HOME/xu-qemu0.sock,server,nowait \
+            -boot order=cd \
+            -cdrom ${pkgs.fetchurl {
+              url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso;
+              sha256 = "18bc9wrsrjnhj9rya75xliqkl99gxbsk4dmwqivhvwfzb5qb5yp9";
+            }} \
+            -m 1024 \
+            -netdev bridge,br=qemubr0,id=hn0,helper=/var/setuid-wrappers/qemu-bridge-helper \
+            -net nic,netdev=hn0,id=nic1,macaddr=52:54:00:12:34:56 \
+            -drive file="$img",format=raw \
+            -display vnc=:1,websocket=5701,password,lossy \
+            -name xu-qemu0 \
+      '';
+    };
+  };
+
+  system.activationScripts."krebs.setuid.xu-qemu0-monitor" = stringAfter [ "setuid" ] ''
+    src=${pkgs.execve "xu-qemu0-monitor" {
+      # TODO toC should handle derivation, then we don't have to "${...}" here
+      filename = "${pkgs.writeDash "xu-qemu0-monitor" ''
+        exec ${pkgs.socat}/bin/socat \
+            stdio \
+            UNIX-CONNECT:${config.users.users.xu-qemu0.home}/xu-qemu0.sock \
+      ''}";
+    }}
+    dst=${config.security.wrapperDir}/xu-qemu0-monitor
+    cp "$src" "$dst"
+    chown xu-qemu0.tv "$dst"
+    chmod 4710 "$dst"
+  '';
 
   #TODO krebs.setuid.qemu-bridge-helper = {
   #  filename = "${pkgs.qemu}/libexec/qemu-bridge-helper";

From 450ca1f0cce267e68b4950504140cdbebe1b4b8e Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 20:09:23 +0100
Subject: [PATCH 19/31] xu-qemu0: create socket in ~/tmp

---
 tv/2configs/xu-qemu0.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
index 4584dcd7c..470b16ea4 100644
--- a/tv/2configs/xu-qemu0.nix
+++ b/tv/2configs/xu-qemu0.nix
@@ -74,13 +74,13 @@ with lib;
       SyslogIdentifier = "xu-qemu0";
       ExecStart = pkgs.writeDash "xu-qemu0" ''
         set -efu
+        ${pkgs.coreutils}/bin/mkdir -p "$HOME/tmp"
         img=$HOME/tmp/xu-qemu0.raw
         if ! test -e "$img"; then
-          ${pkgs.coreutils}/bin/mkdir -p "$(${pkgs.coreutils}/bin/dirname "$img")"
           ${pkgs.kvm}/bin/qemu-img create "$img" 10G
         fi
         exec ${pkgs.kvm}/bin/qemu-kvm \
-            -monitor unix:$HOME/xu-qemu0.sock,server,nowait \
+            -monitor unix:$HOME/tmp/xu-qemu0.sock,server,nowait \
             -boot order=cd \
             -cdrom ${pkgs.fetchurl {
               url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso;
@@ -102,7 +102,7 @@ with lib;
       filename = "${pkgs.writeDash "xu-qemu0-monitor" ''
         exec ${pkgs.socat}/bin/socat \
             stdio \
-            UNIX-CONNECT:${config.users.users.xu-qemu0.home}/xu-qemu0.sock \
+            UNIX-CONNECT:${config.users.users.xu-qemu0.home}/tmp/xu-qemu0.sock \
       ''}";
     }}
     dst=${config.security.wrapperDir}/xu-qemu0-monitor

From edd8bc21d33a631e0c9fb12e44e55b68d8f4cdf6 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 20:11:26 +0100
Subject: [PATCH 20/31] xu-qemu0: not wanted by multi-user.target

---
 tv/2configs/xu-qemu0.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
index 470b16ea4..bc108b4a2 100644
--- a/tv/2configs/xu-qemu0.nix
+++ b/tv/2configs/xu-qemu0.nix
@@ -68,7 +68,6 @@ with lib;
   systemd.services.xu-qemu0 = let
   in {
     after = [ "network.target" "systemd-resolved.service" ];
-    wantedBy = [ "multi-user.target" ];
     serviceConfig = {
       User = "xu-qemu0";
       SyslogIdentifier = "xu-qemu0";

From ca246b6994950cf45aeb69e6e2e4c8f40fda7aa2 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 20:16:50 +0100
Subject: [PATCH 21/31] xu-qemu0: disable services.resolved

---
 tv/2configs/xu-qemu0.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
index bc108b4a2..205b1c011 100644
--- a/tv/2configs/xu-qemu0.nix
+++ b/tv/2configs/xu-qemu0.nix
@@ -40,6 +40,7 @@ with lib;
   #};
 
   systemd.network.enable = true;
+  services.resolved.enable = mkForce false;
 
   systemd.network.netdevs.qemubr0 = {
     netdevConfig = {

From 230c8088c8e96a990400533c780b035c8a4102de Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 20:55:38 +0100
Subject: [PATCH 22/31] xu-qemu0: setup qemubr0 address and route

---
 tv/2configs/xu-qemu0.nix | 28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
index 205b1c011..4d39031db 100644
--- a/tv/2configs/xu-qemu0.nix
+++ b/tv/2configs/xu-qemu0.nix
@@ -15,33 +15,31 @@ in
 #
 #   make [install] system=xu-qemu0 target_host=10.56.0.101
 
-# TODO iptables -A INPUT -p udp -m udp --dport bootps -j ACCEPT
+# TODO iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 # TODO iptables -A FORWARD -i qemubr0 -s 10.56.0.1/24 -m conntrack --ctstate NEW -j ACCEPT
 # TODO iptables -A POSTROUTING -t nat -j MASQUERADE
-# TODO iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+# TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport bootps -j ACCEPT
 # TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT
 # TODO echo 1 > /proc/sys/net/ipv4/ip_forward
-# TODO ifconfig qemubr0 10.56.0.1/24 up
 
 with lib;
 
 {
-  #networking.wireless.interfaces = [ "wlp3s0" ];
-
-  #networking.useNetworkd = true;
-
-  #networking.dhcpcd.allowInterfaces = [
-  #  "qemubr0"
-  #];
-
-  #systemd.network.networks.wlp3s0 = {
-  #  matchConfig.name = "wlp3s0";
-  #  networkConfig.Bridge = "qemubr0";
-  #};
+  networking.dhcpcd.denyInterfaces = [ "qemubr0" ];
 
   systemd.network.enable = true;
   services.resolved.enable = mkForce false;
 
+  systemd.network.networks.qemubr0 = {
+    matchConfig.Name = "qemubr0";
+    address = ["10.56.0.1/24"];
+    routes = [{
+      routeConfig = {
+        Gateway = "*";
+        Destination = "10.56.0.0";
+      };
+    }];
+  };
   systemd.network.netdevs.qemubr0 = {
     netdevConfig = {
       Name = "qemubr0";

From 9a7b7dc5091b0af43fe9d6620f236878f93b3225 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 13 Feb 2016 20:58:27 +0100
Subject: [PATCH 23/31] xu-qemu0: net.ipv4.ip_forward = 1

---
 tv/2configs/xu-qemu0.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
index 4d39031db..9962ca56a 100644
--- a/tv/2configs/xu-qemu0.nix
+++ b/tv/2configs/xu-qemu0.nix
@@ -20,7 +20,6 @@ in
 # TODO iptables -A POSTROUTING -t nat -j MASQUERADE
 # TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport bootps -j ACCEPT
 # TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT
-# TODO echo 1 > /proc/sys/net/ipv4/ip_forward
 
 with lib;
 
@@ -30,6 +29,8 @@ with lib;
   systemd.network.enable = true;
   services.resolved.enable = mkForce false;
 
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+
   systemd.network.networks.qemubr0 = {
     matchConfig.Name = "qemubr0";
     address = ["10.56.0.1/24"];

From c1a9a89c9a211b48bb04f1862a216bb5d444c3a2 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 14 Feb 2016 12:28:56 +0100
Subject: [PATCH 24/31] lib.toC: admit derivations

---
 krebs/4lib/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/krebs/4lib/default.nix b/krebs/4lib/default.nix
index 4d7e0b549..d5b6d03ac 100644
--- a/krebs/4lib/default.nix
+++ b/krebs/4lib/default.nix
@@ -26,11 +26,15 @@ let out = rec {
   shell = import ./shell.nix { inherit lib; };
   tree = import ./tree.nix { inherit lib; };
 
-  toC = x: {
+  toC = x: let
+    type = typeOf x;
+    reject = throw "cannot convert ${type}";
+  in {
     list = "{ ${concatStringsSep ", " (map toC x)} }";
     null = "NULL";
+    set = if isDerivation x then toJSON x else reject;
     string = toJSON x; # close enough
-  }.${typeOf x};
+  }.${type} or reject;
 
   subdirsOf = path:
     mapAttrs (name: _: path + "/${name}")

From e890eb244af82ba678e894a84983db5057fbb60a Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 14 Feb 2016 13:26:37 +0100
Subject: [PATCH 25/31] krebs.setuid: init

---
 krebs/3modules/default.nix |  1 +
 krebs/3modules/setuid.nix  | 75 ++++++++++++++++++++++++++++++++++++++
 tv/2configs/xu-qemu0.nix   | 44 +++++++---------------
 3 files changed, 90 insertions(+), 30 deletions(-)
 create mode 100644 krebs/3modules/setuid.nix

diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 3d51076cf..b2a02e9c7 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -27,6 +27,7 @@ let
       ./retiolum-bootstrap.nix
       ./realwallpaper.nix
       ./retiolum.nix
+      ./setuid.nix
       ./tinc_graphs.nix
       ./urlwatch.nix
     ];
diff --git a/krebs/3modules/setuid.nix b/krebs/3modules/setuid.nix
new file mode 100644
index 000000000..22123c926
--- /dev/null
+++ b/krebs/3modules/setuid.nix
@@ -0,0 +1,75 @@
+{ config, pkgs, lib, ... }:
+with lib;
+let
+  cfg = config.krebs.setuid;
+
+  out = {
+    options.krebs.setuid = api;
+    config = imp;
+  };
+
+  api = mkOption {
+    default = {};
+    type = let
+      # TODO make wrapperDir configurable
+      inherit (config.security) wrapperDir;
+      inherit (config.users) groups users;
+    in types.attrsOf (types.submodule ({ config, ... }: {
+      options = {
+        name = mkOption {
+          type = types.filename;
+          default = config._module.args.name;
+        };
+        filename = mkOption {
+          type = mkOptionType {
+            # TODO unyuck string and merge with toC
+            name = "derivation or string";
+            check = x:
+              isDerivation x ||
+              isString x;
+          };
+          apply = toString;
+        };
+        owner = mkOption {
+          default = "root";
+          type = types.enum (attrNames users);
+        };
+        group = mkOption {
+          default = "root";
+          type = types.enum (attrNames groups);
+        };
+        mode = mkOption {
+          default = "4710";
+          type = mkOptionType {
+            # TODO admit symbolic mode
+            name = "octal mode";
+            check = x:
+              isString x &&
+              match "[0-7][0-7][0-7][0-7]" x != null;
+          };
+        };
+        activate = mkOption {
+          type = types.str;
+          visible = false;
+          readOnly = true;
+        };
+      };
+      config.activate = let
+        src = pkgs.execve config.name {
+          inherit (config) filename;
+        };
+        dst = "${wrapperDir}/${config.name}";
+      in ''
+        cp ${src} ${dst}
+        chown ${config.owner}.${config.group} ${dst}
+        chmod ${config.mode} ${dst}
+      '';
+    }));
+  };
+
+  imp = {
+    system.activationScripts."krebs.setuid" = stringAfter [ "setuid" ]
+      (concatMapStringsSep "\n" (getAttr "activate") (attrValues cfg));
+  };
+
+in out
diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
index 9962ca56a..df35f5c3f 100644
--- a/tv/2configs/xu-qemu0.nix
+++ b/tv/2configs/xu-qemu0.nix
@@ -79,7 +79,7 @@ with lib;
           ${pkgs.kvm}/bin/qemu-img create "$img" 10G
         fi
         exec ${pkgs.kvm}/bin/qemu-kvm \
-            -monitor unix:$HOME/tmp/xu-qemu0.sock,server,nowait \
+            -monitor unix:$HOME/tmp/xu-qemu0-monitor.sock,server,nowait \
             -boot order=cd \
             -cdrom ${pkgs.fetchurl {
               url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso;
@@ -95,36 +95,20 @@ with lib;
     };
   };
 
-  system.activationScripts."krebs.setuid.xu-qemu0-monitor" = stringAfter [ "setuid" ] ''
-    src=${pkgs.execve "xu-qemu0-monitor" {
-      # TODO toC should handle derivation, then we don't have to "${...}" here
-      filename = "${pkgs.writeDash "xu-qemu0-monitor" ''
-        exec ${pkgs.socat}/bin/socat \
-            stdio \
-            UNIX-CONNECT:${config.users.users.xu-qemu0.home}/tmp/xu-qemu0.sock \
-      ''}";
-    }}
-    dst=${config.security.wrapperDir}/xu-qemu0-monitor
-    cp "$src" "$dst"
-    chown xu-qemu0.tv "$dst"
-    chmod 4710 "$dst"
-  '';
+  krebs.setuid.xu-qemu0-monitor = {
+    filename = pkgs.writeDash "xu-qemu0-monitor" ''
+      exec ${pkgs.socat}/bin/socat \
+          stdio \
+          UNIX-CONNECT:${config.users.users.xu-qemu0.home}/tmp/xu-qemu0-monitor.sock \
+    '';
+    owner = "xu-qemu0";
+    group = "tv";
+  };
 
-  #TODO krebs.setuid.qemu-bridge-helper = {
-  #  filename = "${pkgs.qemu}/libexec/qemu-bridge-helper";
-  #  owner = "root";
-  #  group = "qemu-users";
-  #  mode = "4710";
-  #};
-  system.activationScripts."krebs.setuid" = stringAfter [ "setuid" ] ''
-    src=${pkgs.execve "qemu-bridge-helper" {
-      filename = "${pkgs.qemu}/libexec/qemu-bridge-helper";
-    }}
-    dst=${config.security.wrapperDir}/qemu-bridge-helper
-    cp "$src" "$dst"
-    chown root.qemu-users "$dst"
-    chmod 4710 "$dst"
-  '';
+  krebs.setuid.qemu-bridge-helper = {
+    filename = "${pkgs.qemu}/libexec/qemu-bridge-helper";
+    group = "qemu-users";
+  };
 
   users.users.qemu-dnsmasq.uid = genid "qemu-dnsmasq";
 

From 6150679d748c1996694011ba20b8c0a27004f955 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 14 Feb 2016 13:27:42 +0100
Subject: [PATCH 26/31] make deploy: --show-trace

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index c7dee134c..e5e3b19d5 100644
--- a/Makefile
+++ b/Makefile
@@ -24,7 +24,7 @@ execute = \
 deploy:
 	$(call execute,populate)
 	ssh $(target_user)@$(target_host) -p $(target_port) \
-		nixos-rebuild switch -I $(target_path)
+		nixos-rebuild switch --show-trace -I $(target_path)
 
 # usage: make LOGNAME=shared system=wolf eval.config.krebs.build.host.name
 eval eval.:;@$(call evaluate)

From 9f16d7ea71a2566b973ad0ac603c63ac3c6f4311 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 14 Feb 2016 13:38:47 +0100
Subject: [PATCH 27/31] krebs.lib: init

---
 default.nix                |  2 ++
 krebs/3modules/default.nix |  1 +
 krebs/3modules/lib.nix     | 11 +++++++++++
 3 files changed, 14 insertions(+)
 create mode 100644 krebs/3modules/lib.nix

diff --git a/default.nix b/default.nix
index 2aa0a8e14..c96d4dd1c 100644
--- a/default.nix
+++ b/default.nix
@@ -46,6 +46,8 @@ let stockholm = {
       (map (f: f "5pkgs") [ lib.kpath lib.upath ])
     ]);
 
+    krebs.lib = lib;
+
     krebs.current.enable = true;
     krebs.current.host = config.krebs.hosts.${current-host-name};
     krebs.current.user = config.krebs.users.${current-user-name};
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index b2a02e9c7..695562192 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -20,6 +20,7 @@ let
       ./git.nix
       ./go.nix
       ./iptables.nix
+      ./lib.nix
       ./nginx.nix
       ./nixpkgs.nix
       ./per-user.nix
diff --git a/krebs/3modules/lib.nix b/krebs/3modules/lib.nix
new file mode 100644
index 000000000..31390a263
--- /dev/null
+++ b/krebs/3modules/lib.nix
@@ -0,0 +1,11 @@
+{ config, pkgs, lib, ... }:
+with lib;
+let
+  out = {
+    options.krebs.lib = api;
+  };
+  api = mkOption {
+    default = {};
+    type = types.attrs;
+  };
+in out

From 673853e092c211e26a08030f87f9c868c6442a71 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 14 Feb 2016 16:43:44 +0100
Subject: [PATCH 28/31] RIP specialArgs.lib

---
 krebs/3modules/Reaktor.nix                     |  4 ++--
 krebs/3modules/apt-cacher-ng.nix               |  4 ++--
 krebs/3modules/backup.nix                      |  4 ++--
 krebs/3modules/bepasty-server.nix              |  6 +++---
 krebs/3modules/build.nix                       |  2 +-
 krebs/3modules/buildbot/master.nix             |  4 ++--
 krebs/3modules/buildbot/slave.nix              |  4 ++--
 krebs/3modules/current.nix                     |  4 ++--
 krebs/3modules/default.nix                     | 18 +++++++++---------
 krebs/3modules/exim-retiolum.nix               |  4 ++--
 krebs/3modules/exim-smarthost.nix              |  5 ++---
 krebs/3modules/fetchWallpaper.nix              |  4 ++--
 krebs/3modules/git.nix                         |  8 ++++----
 krebs/3modules/github-hosts-sync.nix           |  4 ++--
 krebs/3modules/go.nix                          |  4 ++--
 krebs/3modules/lass/default.nix                |  4 ++--
 krebs/3modules/makefu/default.nix              |  4 ++--
 krebs/3modules/miefda/default.nix              |  4 ++--
 krebs/3modules/mv/default.nix                  |  4 ++--
 krebs/3modules/nginx.nix                       |  7 +++----
 krebs/3modules/nixpkgs.nix                     |  8 ++++----
 krebs/3modules/per-user.nix                    |  2 +-
 krebs/3modules/realwallpaper.nix               |  6 +++---
 krebs/3modules/retiolum-bootstrap.nix          |  4 ++--
 krebs/3modules/retiolum.nix                    |  4 ++--
 krebs/3modules/setuid.nix                      |  2 +-
 krebs/3modules/shared/default.nix              |  7 +++----
 krebs/3modules/tinc_graphs.nix                 |  4 ++--
 krebs/3modules/tv/default.nix                  |  4 ++--
 krebs/3modules/urlwatch.nix                    |  4 ++--
 krebs/5pkgs/builders.nix                       |  4 ++--
 krebs/5pkgs/default.nix                        |  4 ++--
 lass/2configs/base.nix                         |  2 +-
 lass/2configs/downloading.nix                  |  2 +-
 lass/2configs/fastpoke-pages.nix               |  2 +-
 lass/2configs/git.nix                          |  2 +-
 lass/2configs/go.nix                           |  2 +-
 lass/2configs/teamviewer.nix                   |  2 +-
 lass/2configs/xserver/Xresources.nix           |  2 +-
 lass/2configs/xserver/default.nix              |  2 +-
 lass/2configs/xserver/xserver.conf.nix         |  2 +-
 lass/3modules/dnsmasq.nix                      |  3 +--
 lass/3modules/newsbot-js.nix                   |  3 +--
 lass/3modules/owncloud_nginx.nix               |  2 +-
 lass/3modules/per-user.nix                     |  3 +--
 lass/3modules/static_nginx.nix                 |  2 +-
 lass/3modules/urxvtd.nix                       |  3 +--
 lass/3modules/wordpress_nginx.nix              |  2 +-
 lass/3modules/xresources.nix                   |  3 +--
 makefu/1systems/gum.nix                        |  2 +-
 makefu/1systems/wry.nix                        |  2 +-
 makefu/2configs/backup.nix                     |  2 +-
 makefu/2configs/base-gui.nix                   |  2 +-
 makefu/2configs/bepasty-dual.nix               |  2 +-
 makefu/2configs/collectd/collectd-base.nix     |  2 +-
 makefu/2configs/default.nix                    |  2 +-
 makefu/2configs/exim-retiolum.nix              |  2 +-
 makefu/2configs/fs/cac-boot-partition.nix      |  2 +-
 makefu/2configs/fs/sda-crypto-root-home.nix    |  2 +-
 makefu/2configs/fs/sda-crypto-root.nix         |  2 +-
 makefu/2configs/fs/vm-single-partition.nix     |  2 +-
 makefu/2configs/git/brain-retiolum.nix         |  2 +-
 makefu/2configs/git/cgit-retiolum.nix          |  2 +-
 makefu/2configs/graphite-standalone.nix        |  2 +-
 makefu/2configs/hw/tp-x200.nix                 |  2 +-
 makefu/2configs/hw/tp-x220.nix                 |  2 +-
 makefu/2configs/hw/tp-x2x0.nix                 |  2 +-
 makefu/2configs/mail-client.nix                |  2 +-
 makefu/2configs/main-laptop.nix                |  2 +-
 makefu/2configs/mattermost-docker.nix          |  2 +-
 makefu/2configs/nginx/euer.blog.nix            |  2 +-
 makefu/2configs/nginx/euer.test.nix            |  2 +-
 makefu/2configs/nginx/euer.wiki.nix            |  2 +-
 makefu/2configs/nginx/update.connector.one.nix |  2 +-
 makefu/2configs/omo-share.nix                  |  2 +-
 makefu/2configs/tinc-basic-retiolum.nix        |  2 +-
 makefu/2configs/zsh-user.nix                   |  2 +-
 makefu/3modules/snapraid.nix                   |  2 +-
 makefu/3modules/umts.nix                       |  2 +-
 miefda/2configs/git.nix                        |  2 +-
 miefda/2configs/miefda.nix                     |  2 +-
 miefda/2configs/tinc-basic-retiolum.nix        |  2 +-
 miefda/2configs/tlp.nix                        |  2 +-
 miefda/2configs/x220t.nix                      |  2 +-
 mv/1systems/stro.nix                           |  2 +-
 mv/2configs/default.nix                        |  2 +-
 mv/2configs/git.nix                            |  2 +-
 mv/2configs/vim.nix                            |  4 ++--
 mv/2configs/xserver/Xresources.nix             |  2 +-
 mv/2configs/xserver/default.nix                |  2 +-
 mv/2configs/xserver/xserver.conf.nix           |  2 +-
 mv/3modules/iptables.nix                       |  5 ++---
 shared/2configs/base.nix                       |  2 +-
 shared/2configs/cgit-mirror.nix                |  2 +-
 shared/2configs/collectd-base.nix              |  2 +-
 shared/2configs/graphite.nix                   |  2 +-
 tv/1systems/cd.nix                             |  2 +-
 tv/1systems/mkdir.nix                          |  2 +-
 tv/1systems/nomic.nix                          |  2 +-
 tv/1systems/rmdir.nix                          |  2 +-
 tv/1systems/wu.nix                             |  2 +-
 tv/1systems/xu.nix                             |  2 +-
 tv/2configs/backup.nix                         |  2 +-
 tv/2configs/charybdis.nix                      |  5 ++---
 tv/2configs/default.nix                        |  2 +-
 tv/2configs/exim-retiolum.nix                  |  4 ++--
 tv/2configs/exim-smarthost.nix                 |  2 +-
 tv/2configs/git.nix                            |  2 +-
 tv/2configs/hw/AO753.nix                       |  2 +-
 tv/2configs/nginx-public_html.nix              |  4 ++--
 tv/2configs/pulse.nix                          |  2 +-
 tv/2configs/retiolum.nix                       |  2 +-
 tv/2configs/vim.nix                            |  4 ++--
 tv/2configs/xserver/Xresources.nix             |  2 +-
 tv/2configs/xserver/default.nix                |  2 +-
 tv/2configs/xserver/xserver.conf.nix           |  2 +-
 tv/2configs/xu-qemu0.nix                       |  2 +-
 tv/3modules/ejabberd.nix                       |  5 ++---
 tv/3modules/iptables.nix                       |  5 ++---
 119 files changed, 171 insertions(+), 183 deletions(-)

diff --git a/krebs/3modules/Reaktor.nix b/krebs/3modules/Reaktor.nix
index 92400139c..d58661a28 100644
--- a/krebs/3modules/Reaktor.nix
+++ b/krebs/3modules/Reaktor.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
 
   ReaktorConfig = pkgs.writeText "config.py" ''
@@ -16,7 +16,7 @@ let
 
   out = {
     options.krebs.Reaktor = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/apt-cacher-ng.nix b/krebs/3modules/apt-cacher-ng.nix
index 371d39b6f..46b405842 100644
--- a/krebs/3modules/apt-cacher-ng.nix
+++ b/krebs/3modules/apt-cacher-ng.nix
@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   acng-config = pkgs.writeTextFile {
     name = "acng-configuration";
@@ -151,5 +151,5 @@ let
 in
 {
   options.krebs.apt-cacher-ng = api;
-  config = mkIf cfg.enable imp;
+  config = lib.mkIf cfg.enable imp;
 }
diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix
index 66a325ed9..5e1a1597b 100644
--- a/krebs/3modules/backup.nix
+++ b/krebs/3modules/backup.nix
@@ -1,9 +1,9 @@
 { config, lib, pkgs, ... }:
-with lib;
+with config.krebs.lib;
 let
   out = {
     options.krebs.backup = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   cfg = config.krebs.backup;
diff --git a/krebs/3modules/bepasty-server.nix b/krebs/3modules/bepasty-server.nix
index e74841205..9e777a5ef 100644
--- a/krebs/3modules/bepasty-server.nix
+++ b/krebs/3modules/bepasty-server.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   gunicorn = pkgs.pythonPackages.gunicorn;
   bepasty = pkgs.pythonPackages.bepasty-server;
@@ -10,8 +10,8 @@ let
 
   out = {
     options.krebs.bepasty = api;
-    config = mkIf cfg.enable (mkMerge [
-      (mkIf cfg.serveNginx nginx-imp)
+    config = lib.mkIf cfg.enable (lib.mkMerge [
+      (lib.mkIf cfg.serveNginx nginx-imp)
       imp
     ]);
   };
diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix
index 1569072d1..a1f446188 100644
--- a/krebs/3modules/build.nix
+++ b/krebs/3modules/build.nix
@@ -1,6 +1,6 @@
 { config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   out = {
diff --git a/krebs/3modules/buildbot/master.nix b/krebs/3modules/buildbot/master.nix
index 74385a433..825cb3413 100644
--- a/krebs/3modules/buildbot/master.nix
+++ b/krebs/3modules/buildbot/master.nix
@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   buildbot = pkgs.buildbot;
   buildbot-master-config = pkgs.writeText "buildbot-master.cfg" ''
@@ -381,5 +381,5 @@ let
 in
 {
   options.krebs.buildbot.master = api;
-  config = mkIf cfg.enable imp;
+  config = lib.mkIf cfg.enable imp;
 }
diff --git a/krebs/3modules/buildbot/slave.nix b/krebs/3modules/buildbot/slave.nix
index 0e7796d8a..7705ac31c 100644
--- a/krebs/3modules/buildbot/slave.nix
+++ b/krebs/3modules/buildbot/slave.nix
@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   buildbot-slave-init = pkgs.writeText "buildbot-slave.tac" ''
     import os
@@ -182,5 +182,5 @@ let
 in
 {
   options.krebs.buildbot.slave = api;
-  config = mkIf cfg.enable imp;
+  config = lib.mkIf cfg.enable imp;
 }
diff --git a/krebs/3modules/current.nix b/krebs/3modules/current.nix
index 41941e289..9f63e33ac 100644
--- a/krebs/3modules/current.nix
+++ b/krebs/3modules/current.nix
@@ -1,13 +1,13 @@
 { config, pkgs, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.krebs.current;
 
   out = {
     options.krebs.current = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 695562192..23f82ed1c 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -1,6 +1,6 @@
 { config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs;
 
@@ -33,7 +33,7 @@ let
       ./urlwatch.nix
     ];
     options.krebs = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
@@ -84,13 +84,13 @@ let
     };
   };
 
-  imp = mkMerge [
-    { krebs = import ./lass { inherit lib; }; }
-    { krebs = import ./makefu { inherit lib; }; }
-    { krebs = import ./miefda { inherit lib; }; }
-    { krebs = import ./mv { inherit lib; }; }
-    { krebs = import ./shared { inherit lib; }; }
-    { krebs = import ./tv { inherit lib; }; }
+  imp = lib.mkMerge [
+    { krebs = import ./lass   { inherit config lib; }; }
+    { krebs = import ./makefu { inherit config lib; }; }
+    { krebs = import ./miefda { inherit config lib; }; }
+    { krebs = import ./mv     { inherit config lib; }; }
+    { krebs = import ./shared { inherit config lib; }; }
+    { krebs = import ./tv     { inherit config lib; }; }
     {
       krebs.dns.providers = {
         de.krebsco = "zones";
diff --git a/krebs/3modules/exim-retiolum.nix b/krebs/3modules/exim-retiolum.nix
index ea012c38c..1722eef1f 100644
--- a/krebs/3modules/exim-retiolum.nix
+++ b/krebs/3modules/exim-retiolum.nix
@@ -1,12 +1,12 @@
 { config, pkgs, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.exim-retiolum;
 
   out = {
     options.krebs.exim-retiolum = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
index a564430ea..267ee2900 100644
--- a/krebs/3modules/exim-smarthost.nix
+++ b/krebs/3modules/exim-smarthost.nix
@@ -1,13 +1,12 @@
 { config, pkgs, lib, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.exim-smarthost;
 
   out = {
     options.krebs.exim-smarthost = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/fetchWallpaper.nix b/krebs/3modules/fetchWallpaper.nix
index 225f00803..53fe0839d 100644
--- a/krebs/3modules/fetchWallpaper.nix
+++ b/krebs/3modules/fetchWallpaper.nix
@@ -1,13 +1,13 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.krebs.fetchWallpaper;
 
   out = {
     options.krebs.fetchWallpaper = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix
index 11cf21b5f..a9542718d 100644
--- a/krebs/3modules/git.nix
+++ b/krebs/3modules/git.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, lib, pkgs, ... }:
 
 # TODO unify logging of shell scripts to user and journal
 # TODO move all scripts to ${etcDir}, so ControlMaster connections
@@ -6,13 +6,13 @@
 # TODO when authorized_keys changes, then restart ssh
 #       (or kill already connected users somehow)
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.git;
 
   out = {
     options.krebs.git = api;
-    config = mkIf cfg.enable (mkMerge [
+    config = with lib; mkIf cfg.enable (mkMerge [
       (mkIf cfg.cgit cgit-imp)
       git-imp
     ]);
@@ -86,7 +86,7 @@ let
         singleton {
           user = [ config.krebs.users.tv ];
           repo = [ testing ]; # see literal example of repos
-          perm = push "refs/*" (with lib.git; [
+          perm = push "refs/*" (with config.krebs.lib.git; [
             non-fast-forward create delete merge
           ]);
         }
diff --git a/krebs/3modules/github-hosts-sync.nix b/krebs/3modules/github-hosts-sync.nix
index 2aa18d53a..1d3873232 100644
--- a/krebs/3modules/github-hosts-sync.nix
+++ b/krebs/3modules/github-hosts-sync.nix
@@ -1,12 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.github-hosts-sync;
 
   out = {
     options.krebs.github-hosts-sync = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/go.nix b/krebs/3modules/go.nix
index 08a93dab7..52a104bb9 100644
--- a/krebs/3modules/go.nix
+++ b/krebs/3modules/go.nix
@@ -1,13 +1,13 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.krebs.go;
 
   out = {
     options.krebs.go = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index 749d3ff49..41a609105 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   hosts = {
diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index d21c80e78..ca83d6906 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   hosts = {
diff --git a/krebs/3modules/miefda/default.nix b/krebs/3modules/miefda/default.nix
index 0cfa8bd27..6587ad92d 100644
--- a/krebs/3modules/miefda/default.nix
+++ b/krebs/3modules/miefda/default.nix
@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   hosts = {
diff --git a/krebs/3modules/mv/default.nix b/krebs/3modules/mv/default.nix
index 8803cb249..33f941aae 100644
--- a/krebs/3modules/mv/default.nix
+++ b/krebs/3modules/mv/default.nix
@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   hosts = {
diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix
index 5bc0903e4..7b7163071 100644
--- a/krebs/3modules/nginx.nix
+++ b/krebs/3modules/nginx.nix
@@ -1,13 +1,12 @@
-{ config, pkgs, lib, ... }:
+{ config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.nginx;
 
   out = {
     options.krebs.nginx = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/nixpkgs.nix b/krebs/3modules/nixpkgs.nix
index 4129f9483..5816b8a30 100644
--- a/krebs/3modules/nixpkgs.nix
+++ b/krebs/3modules/nixpkgs.nix
@@ -1,11 +1,11 @@
-{ config, pkgs, lib, ... }:
-with lib;
+{ config, lib, pkgs, ... }:
+with config.krebs.lib;
 let
   cfg = config.krebs.nixpkgs;
 
   out = {
     options.krebs.nixpkgs = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
@@ -37,7 +37,7 @@ let
     };
   };
 
-  imp = mkIf (cfg.allowUnfreePredicate != null) {
+  imp = lib.mkIf (cfg.allowUnfreePredicate != null) {
     nixpkgs.config.allowUnfreePredicate = cfg.allowUnfreePredicate;
   };
 in out
diff --git a/krebs/3modules/per-user.nix b/krebs/3modules/per-user.nix
index ee213deda..13da5c4c3 100644
--- a/krebs/3modules/per-user.nix
+++ b/krebs/3modules/per-user.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.krebs.per-user;
diff --git a/krebs/3modules/realwallpaper.nix b/krebs/3modules/realwallpaper.nix
index b377368f7..df374e184 100644
--- a/krebs/3modules/realwallpaper.nix
+++ b/krebs/3modules/realwallpaper.nix
@@ -1,12 +1,12 @@
-arg@{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.realwallpaper;
 
   out = {
     options.krebs.realwallpaper = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix
index 65bb51193..40382d098 100644
--- a/krebs/3modules/retiolum-bootstrap.nix
+++ b/krebs/3modules/retiolum-bootstrap.nix
@@ -1,12 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.retiolum-bootstrap;
 
   out = {
     options.krebs.retiolum-bootstrap = api;
-    config = mkIf cfg.enable imp ;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/retiolum.nix b/krebs/3modules/retiolum.nix
index 407695273..d0162eae9 100644
--- a/krebs/3modules/retiolum.nix
+++ b/krebs/3modules/retiolum.nix
@@ -1,11 +1,11 @@
 { config, pkgs, lib, ... }:
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.retiolum;
 
   out = {
     options.krebs.retiolum = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/setuid.nix b/krebs/3modules/setuid.nix
index 22123c926..1137788d8 100644
--- a/krebs/3modules/setuid.nix
+++ b/krebs/3modules/setuid.nix
@@ -1,5 +1,5 @@
 { config, pkgs, lib, ... }:
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.setuid;
 
diff --git a/krebs/3modules/shared/default.nix b/krebs/3modules/shared/default.nix
index df4c529bf..208b596f8 100644
--- a/krebs/3modules/shared/default.nix
+++ b/krebs/3modules/shared/default.nix
@@ -1,9 +1,8 @@
-{ lib, ... }:
-
-with lib;
+{ config, ... }:
 
+with config.krebs.lib;
 let
-  testHosts = lib.genAttrs [
+  testHosts = genAttrs [
     "test-arch"
     "test-centos6"
     "test-centos7"
diff --git a/krebs/3modules/tinc_graphs.nix b/krebs/3modules/tinc_graphs.nix
index dc0484a8b..2692de982 100644
--- a/krebs/3modules/tinc_graphs.nix
+++ b/krebs/3modules/tinc_graphs.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.tinc_graphs;
   internal_dir = "${cfg.workingDir}/internal";
@@ -8,7 +8,7 @@ let
 
   out = {
     options.krebs.tinc_graphs = api;
-    config = mkIf cfg.enable imp ;
+    config = lib.mkIf cfg.enable imp ;
   };
 
   api = {
diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index 9a0b99396..f8d3d8671 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   dns.providers = {
diff --git a/krebs/3modules/urlwatch.nix b/krebs/3modules/urlwatch.nix
index 7a9fb55fd..cd4976a21 100644
--- a/krebs/3modules/urlwatch.nix
+++ b/krebs/3modules/urlwatch.nix
@@ -5,14 +5,14 @@
 # cache = url: "${cfg.dataDir}/.urlwatch/cache/${hashString "sha1" url}"
 # TODO hooks.py
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.urlwatch;
 
   # TODO assert sendmail's existence
   out = {
     options.krebs.urlwatch = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/5pkgs/builders.nix b/krebs/5pkgs/builders.nix
index 43707aeca..fa51857ba 100644
--- a/krebs/5pkgs/builders.nix
+++ b/krebs/5pkgs/builders.nix
@@ -1,5 +1,5 @@
-{ lib, pkgs, ... }:
-with lib;
+{ config, lib, pkgs, ... }:
+with config.krebs.lib;
 rec {
   execve = name: { filename, argv ? null, envp ? {}, destination ? "" }: let
   in writeC name { inherit destination; } ''
diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix
index 1cf3de56e..d395fe00a 100644
--- a/krebs/5pkgs/default.nix
+++ b/krebs/5pkgs/default.nix
@@ -1,5 +1,5 @@
-{ lib, pkgs, ... }@args:
-with lib;
+{ config, lib, pkgs, ... }@args:
+with config.krebs.lib;
 {
   nixpkgs.config.packageOverrides = pkgs: {
     haskellPackages = pkgs.haskellPackages.override {
diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix
index 4c73fc0ce..68103c3ef 100644
--- a/lass/2configs/base.nix
+++ b/lass/2configs/base.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   imports = [
     ../2configs/vim.nix
diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix
index e80b74007..115cb8b61 100644
--- a/lass/2configs/downloading.nix
+++ b/lass/2configs/downloading.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   rpc-password = import <secrets/transmission-pw.nix>;
diff --git a/lass/2configs/fastpoke-pages.nix b/lass/2configs/fastpoke-pages.nix
index 0470865b6..bf6ea8952 100644
--- a/lass/2configs/fastpoke-pages.nix
+++ b/lass/2configs/fastpoke-pages.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   createStaticPage = domain:
diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix
index ac6aae44f..76b897d1f 100644
--- a/lass/2configs/git.nix
+++ b/lass/2configs/git.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
 
diff --git a/lass/2configs/go.nix b/lass/2configs/go.nix
index f4c2ac289..795ad7a26 100644
--- a/lass/2configs/go.nix
+++ b/lass/2configs/go.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   environment.systemPackages = [
     pkgs.go
diff --git a/lass/2configs/teamviewer.nix b/lass/2configs/teamviewer.nix
index 48053d7db..22bfb18d8 100644
--- a/lass/2configs/teamviewer.nix
+++ b/lass/2configs/teamviewer.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   services.teamviewer.enable = true;
 }
diff --git a/lass/2configs/xserver/Xresources.nix b/lass/2configs/xserver/Xresources.nix
index d52418897..e3b0f45dc 100644
--- a/lass/2configs/xserver/Xresources.nix
+++ b/lass/2configs/xserver/Xresources.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 pkgs.writeText "Xresources" ''
   URxvt*scrollBar:                      false
diff --git a/lass/2configs/xserver/default.nix b/lass/2configs/xserver/default.nix
index c407bb59e..82cfd57bb 100644
--- a/lass/2configs/xserver/default.nix
+++ b/lass/2configs/xserver/default.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }@args:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO krebs.build.user
diff --git a/lass/2configs/xserver/xserver.conf.nix b/lass/2configs/xserver/xserver.conf.nix
index e8a997a99..c452b4226 100644
--- a/lass/2configs/xserver/xserver.conf.nix
+++ b/lass/2configs/xserver/xserver.conf.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.services.xserver;
diff --git a/lass/3modules/dnsmasq.nix b/lass/3modules/dnsmasq.nix
index 83a9cb180..c05ad0fc9 100644
--- a/lass/3modules/dnsmasq.nix
+++ b/lass/3modules/dnsmasq.nix
@@ -1,7 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.lass.dnsmasq;
diff --git a/lass/3modules/newsbot-js.nix b/lass/3modules/newsbot-js.nix
index 5e340b26f..ef4d97b76 100644
--- a/lass/3modules/newsbot-js.nix
+++ b/lass/3modules/newsbot-js.nix
@@ -1,7 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.lass.newsbot-js;
diff --git a/lass/3modules/owncloud_nginx.nix b/lass/3modules/owncloud_nginx.nix
index 79c9de1d4..a10df779e 100644
--- a/lass/3modules/owncloud_nginx.nix
+++ b/lass/3modules/owncloud_nginx.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.lass.owncloud;
diff --git a/lass/3modules/per-user.nix b/lass/3modules/per-user.nix
index 98d6339db..f8d357ce2 100644
--- a/lass/3modules/per-user.nix
+++ b/lass/3modules/per-user.nix
@@ -1,7 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.lass.per-user;
 
diff --git a/lass/3modules/static_nginx.nix b/lass/3modules/static_nginx.nix
index fd5cfdfd7..93441cf0d 100644
--- a/lass/3modules/static_nginx.nix
+++ b/lass/3modules/static_nginx.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.lass.staticPage;
diff --git a/lass/3modules/urxvtd.nix b/lass/3modules/urxvtd.nix
index 469616a9f..1eb463955 100644
--- a/lass/3modules/urxvtd.nix
+++ b/lass/3modules/urxvtd.nix
@@ -3,8 +3,7 @@
 let
 in
 
-with builtins;
-with lib;
+with config.krebs.lib;
 
 {
   options = {
diff --git a/lass/3modules/wordpress_nginx.nix b/lass/3modules/wordpress_nginx.nix
index bfed9e7c6..108054cb6 100644
--- a/lass/3modules/wordpress_nginx.nix
+++ b/lass/3modules/wordpress_nginx.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.lass.wordpress;
diff --git a/lass/3modules/xresources.nix b/lass/3modules/xresources.nix
index 074963022..729eccecc 100644
--- a/lass/3modules/xresources.nix
+++ b/lass/3modules/xresources.nix
@@ -6,8 +6,7 @@
 
 #
 #
-with builtins;
-with lib;
+with config.krebs.lib;
 
 
 let
diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix
index fe800f251..43fc8109d 100644
--- a/makefu/1systems/gum.nix
+++ b/makefu/1systems/gum.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   external-ip = head config.krebs.build.host.nets.internet.addrs4;
   internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index f022311c9..41d207ed2 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
 
   external-ip = head config.krebs.build.host.nets.internet.addrs4;
diff --git a/makefu/2configs/backup.nix b/makefu/2configs/backup.nix
index 936f31c1c..6f79ed4f4 100644
--- a/makefu/2configs/backup.nix
+++ b/makefu/2configs/backup.nix
@@ -1,5 +1,5 @@
 { config, lib, ... }:
-with lib;
+with config.krebs.lib;
 let
   startAt = "0,6,12,18:00";
   defaultBackupServer = config.krebs.hosts.omo;
diff --git a/makefu/2configs/base-gui.nix b/makefu/2configs/base-gui.nix
index da3ad4afe..341a2ab20 100644
--- a/makefu/2configs/base-gui.nix
+++ b/makefu/2configs/base-gui.nix
@@ -21,7 +21,7 @@
 # URxvt.visualBell: false
 # URxvt.font : xft:Terminus
 
-with lib;
+with config.krebs.lib;
 let
   mainUser = config.krebs.build.user.name;
   awesomecfg = pkgs.awesomecfg.full;
diff --git a/makefu/2configs/bepasty-dual.nix b/makefu/2configs/bepasty-dual.nix
index 123ae3cf9..5682f5eb6 100644
--- a/makefu/2configs/bepasty-dual.nix
+++ b/makefu/2configs/bepasty-dual.nix
@@ -10,7 +10,7 @@
 #   wildcard.krebsco.de.key
 #   bepasty-secret.nix     <- contains single string
 
-with lib;
+with config.krebs.lib;
 let
   sec = toString <secrets>;
   # secKey is nothing worth protecting on a local machine
diff --git a/makefu/2configs/collectd/collectd-base.nix b/makefu/2configs/collectd/collectd-base.nix
index 7909c1be5..c739368ca 100644
--- a/makefu/2configs/collectd/collectd-base.nix
+++ b/makefu/2configs/collectd/collectd-base.nix
@@ -2,7 +2,7 @@
 
 # graphite-web on port 8080
 # carbon cache on port 2003 (tcp/udp)
-with lib;
+with config.krebs.lib;
 let
   connect-time-cfg = with pkgs; writeText "collectd-connect-time.cfg" ''
     LoadPlugin python
diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix
index 5acc7f0a5..c35bfc173 100644
--- a/makefu/2configs/default.nix
+++ b/makefu/2configs/default.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   system.stateVersion = "15.09";
 
diff --git a/makefu/2configs/exim-retiolum.nix b/makefu/2configs/exim-retiolum.nix
index b8c5c5236..34943f593 100644
--- a/makefu/2configs/exim-retiolum.nix
+++ b/makefu/2configs/exim-retiolum.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   krebs.exim-retiolum.enable = true;
   environment.systemPackages = with pkgs; [
diff --git a/makefu/2configs/fs/cac-boot-partition.nix b/makefu/2configs/fs/cac-boot-partition.nix
index cec004582..bf08504d5 100644
--- a/makefu/2configs/fs/cac-boot-partition.nix
+++ b/makefu/2configs/fs/cac-boot-partition.nix
@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 # vda1 ext4 (label nixos) -> only root partition
-with lib;
+with config.krebs.lib;
 {
   boot.loader.grub.enable = true;
   boot.loader.grub.version = 2;
diff --git a/makefu/2configs/fs/sda-crypto-root-home.nix b/makefu/2configs/fs/sda-crypto-root-home.nix
index cc2133a49..5214cf872 100644
--- a/makefu/2configs/fs/sda-crypto-root-home.nix
+++ b/makefu/2configs/fs/sda-crypto-root-home.nix
@@ -8,7 +8,7 @@
 #             /     (main-root)
 #             /home (main-home)
 
-with lib;
+with config.krebs.lib;
 {
 
   imports = [
diff --git a/makefu/2configs/fs/sda-crypto-root.nix b/makefu/2configs/fs/sda-crypto-root.nix
index 2bfe26960..e9d7b755a 100644
--- a/makefu/2configs/fs/sda-crypto-root.nix
+++ b/makefu/2configs/fs/sda-crypto-root.nix
@@ -3,7 +3,7 @@
 # sda:  bootloader grub2
 # sda1: boot ext4 (label nixboot)
 # sda2: cryptoluks -> ext4
-with lib;
+with config.krebs.lib;
 {
   boot = {
     loader.grub.enable = true;
diff --git a/makefu/2configs/fs/vm-single-partition.nix b/makefu/2configs/fs/vm-single-partition.nix
index 27e28cb68..88f209597 100644
--- a/makefu/2configs/fs/vm-single-partition.nix
+++ b/makefu/2configs/fs/vm-single-partition.nix
@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 # vda1 ext4 (label nixos) -> only root partition
-with lib;
+with config.krebs.lib;
 {
   imports = [
     ./single-partition-ext4.nix
diff --git a/makefu/2configs/git/brain-retiolum.nix b/makefu/2configs/git/brain-retiolum.nix
index 25ef584bf..58fd250e5 100644
--- a/makefu/2configs/git/brain-retiolum.nix
+++ b/makefu/2configs/git/brain-retiolum.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 # TODO: remove tv lib :)
-with lib;
+with config.krebs.lib;
 let
 
   repos = priv-repos // krebs-repos ;
diff --git a/makefu/2configs/git/cgit-retiolum.nix b/makefu/2configs/git/cgit-retiolum.nix
index 7d85eb8d1..a488d98f2 100644
--- a/makefu/2configs/git/cgit-retiolum.nix
+++ b/makefu/2configs/git/cgit-retiolum.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 # TODO: remove tv lib :)
-with lib;
+with config.krebs.lib;
 let
 
   repos = priv-repos // krebs-repos // connector-repos ;
diff --git a/makefu/2configs/graphite-standalone.nix b/makefu/2configs/graphite-standalone.nix
index 8b70c11c8..dd5438e8d 100644
--- a/makefu/2configs/graphite-standalone.nix
+++ b/makefu/2configs/graphite-standalone.nix
@@ -2,7 +2,7 @@
 
 # graphite-web on port 8080
 # carbon cache on port 2003 (tcp/udp)
-with lib;
+with config.krebs.lib;
 {
   imports = [ ];
 
diff --git a/makefu/2configs/hw/tp-x200.nix b/makefu/2configs/hw/tp-x200.nix
index ed46875d8..f17ac74a6 100644
--- a/makefu/2configs/hw/tp-x200.nix
+++ b/makefu/2configs/hw/tp-x200.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
 
   imports = [ ./tp-x2x0.nix ];
diff --git a/makefu/2configs/hw/tp-x220.nix b/makefu/2configs/hw/tp-x220.nix
index 0c90e6fde..0a471bde0 100644
--- a/makefu/2configs/hw/tp-x220.nix
+++ b/makefu/2configs/hw/tp-x220.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
 
   imports = [ ./tp-x2x0.nix ];
diff --git a/makefu/2configs/hw/tp-x2x0.nix b/makefu/2configs/hw/tp-x2x0.nix
index 1033f69c0..892be07b8 100644
--- a/makefu/2configs/hw/tp-x2x0.nix
+++ b/makefu/2configs/hw/tp-x2x0.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   # TODO: put this somewhere else
   networking.wireless.enable = true;
diff --git a/makefu/2configs/mail-client.nix b/makefu/2configs/mail-client.nix
index bda21e9d0..913cbf25b 100644
--- a/makefu/2configs/mail-client.nix
+++ b/makefu/2configs/mail-client.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   environment.systemPackages = with pkgs; [
     msmtp
diff --git a/makefu/2configs/main-laptop.nix b/makefu/2configs/main-laptop.nix
index 32f194e6b..c3e43723c 100644
--- a/makefu/2configs/main-laptop.nix
+++ b/makefu/2configs/main-laptop.nix
@@ -5,7 +5,7 @@
 # not fit into base-gui
 # TODO split generic desktop stuff and laptop-specifics like lidswitching
 
-with lib;
+with config.krebs.lib;
 {
   imports = [
     ./base-gui.nix
diff --git a/makefu/2configs/mattermost-docker.nix b/makefu/2configs/mattermost-docker.nix
index 20a93dff1..e679a3d91 100644
--- a/makefu/2configs/mattermost-docker.nix
+++ b/makefu/2configs/mattermost-docker.nix
@@ -1,6 +1,6 @@
 {config, lib, ...}:
 
-with lib;
+with config.krebs.lib;
 let
   sec = toString <secrets>;
   ssl_cert = "${sec}/wildcard.krebsco.de.crt";
diff --git a/makefu/2configs/nginx/euer.blog.nix b/makefu/2configs/nginx/euer.blog.nix
index c6724c617..9d08f4b9a 100644
--- a/makefu/2configs/nginx/euer.blog.nix
+++ b/makefu/2configs/nginx/euer.blog.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   sec = toString <secrets>;
   ssl_cert = "${sec}/wildcard.krebsco.de.crt";
diff --git a/makefu/2configs/nginx/euer.test.nix b/makefu/2configs/nginx/euer.test.nix
index ffdc0bc60..f7214e613 100644
--- a/makefu/2configs/nginx/euer.test.nix
+++ b/makefu/2configs/nginx/euer.test.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   hostname = config.krebs.build.host.name;
   user = config.services.nginx.user;
diff --git a/makefu/2configs/nginx/euer.wiki.nix b/makefu/2configs/nginx/euer.wiki.nix
index 2b5fa6ead..a5572a519 100644
--- a/makefu/2configs/nginx/euer.wiki.nix
+++ b/makefu/2configs/nginx/euer.wiki.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   sec = toString <secrets>;
   ssl_cert = "${sec}/wildcard.krebsco.de.crt";
diff --git a/makefu/2configs/nginx/update.connector.one.nix b/makefu/2configs/nginx/update.connector.one.nix
index eb39a1668..044a14075 100644
--- a/makefu/2configs/nginx/update.connector.one.nix
+++ b/makefu/2configs/nginx/update.connector.one.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   hostname = config.krebs.build.host.name;
   external-ip = head config.krebs.build.host.nets.internet.addrs4;
diff --git a/makefu/2configs/omo-share.nix b/makefu/2configs/omo-share.nix
index 1e0975e1d..a9640b38b 100644
--- a/makefu/2configs/omo-share.nix
+++ b/makefu/2configs/omo-share.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   hostname = config.krebs.build.host.name;
   # TODO local-ip from the nets config
diff --git a/makefu/2configs/tinc-basic-retiolum.nix b/makefu/2configs/tinc-basic-retiolum.nix
index f49c596fc..12d3b8b7c 100644
--- a/makefu/2configs/tinc-basic-retiolum.nix
+++ b/makefu/2configs/tinc-basic-retiolum.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   krebs.retiolum = {
     enable = true;
diff --git a/makefu/2configs/zsh-user.nix b/makefu/2configs/zsh-user.nix
index f79f258f3..9527ead1a 100644
--- a/makefu/2configs/zsh-user.nix
+++ b/makefu/2configs/zsh-user.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 ##
-with lib;
+with config.krebs.lib;
 let
   mainUser = config.krebs.build.user.name;
 in
diff --git a/makefu/3modules/snapraid.nix b/makefu/3modules/snapraid.nix
index fbdf50219..4a0363e6a 100644
--- a/makefu/3modules/snapraid.nix
+++ b/makefu/3modules/snapraid.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   # returns dirname without / , used as disk name
diff --git a/makefu/3modules/umts.nix b/makefu/3modules/umts.nix
index 1bf3ba0b5..7e0e5dada 100644
--- a/makefu/3modules/umts.nix
+++ b/makefu/3modules/umts.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO: currently it is only netzclub
diff --git a/miefda/2configs/git.nix b/miefda/2configs/git.nix
index fec828f80..052cc4ab2 100644
--- a/miefda/2configs/git.nix
+++ b/miefda/2configs/git.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
 
diff --git a/miefda/2configs/miefda.nix b/miefda/2configs/miefda.nix
index 545987a68..f17e8aa34 100644
--- a/miefda/2configs/miefda.nix
+++ b/miefda/2configs/miefda.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   
   #networking.wicd.enable = true;
diff --git a/miefda/2configs/tinc-basic-retiolum.nix b/miefda/2configs/tinc-basic-retiolum.nix
index b31fe15af..f82fd6b03 100644
--- a/miefda/2configs/tinc-basic-retiolum.nix
+++ b/miefda/2configs/tinc-basic-retiolum.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   krebs.retiolum = {
     enable = true;
diff --git a/miefda/2configs/tlp.nix b/miefda/2configs/tlp.nix
index 0e1bb0d6b..32f4f2ee7 100644
--- a/miefda/2configs/tlp.nix
+++ b/miefda/2configs/tlp.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   hardware.enableAllFirmware = true;
   nixpkgs.config.allowUnfree = true;
diff --git a/miefda/2configs/x220t.nix b/miefda/2configs/x220t.nix
index bea84f796..2d128e533 100644
--- a/miefda/2configs/x220t.nix
+++ b/miefda/2configs/x220t.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
 
   services.xserver = {
diff --git a/mv/1systems/stro.nix b/mv/1systems/stro.nix
index 3915219b7..b3dfc5708 100644
--- a/mv/1systems/stro.nix
+++ b/mv/1systems/stro.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.stro;
diff --git a/mv/2configs/default.nix b/mv/2configs/default.nix
index 9c412099e..d93218a18 100644
--- a/mv/2configs/default.nix
+++ b/mv/2configs/default.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   HOME = getEnv "HOME";
 in
diff --git a/mv/2configs/git.nix b/mv/2configs/git.nix
index c182d0d1e..933649f20 100644
--- a/mv/2configs/git.nix
+++ b/mv/2configs/git.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
 
diff --git a/mv/2configs/vim.nix b/mv/2configs/vim.nix
index a961b6b26..adf1da9db 100644
--- a/mv/2configs/vim.nix
+++ b/mv/2configs/vim.nix
@@ -1,6 +1,6 @@
-{ lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   out = {
     environment.systemPackages = [
diff --git a/mv/2configs/xserver/Xresources.nix b/mv/2configs/xserver/Xresources.nix
index f287bf206..923572721 100644
--- a/mv/2configs/xserver/Xresources.nix
+++ b/mv/2configs/xserver/Xresources.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 pkgs.writeText "Xresources" ''
   !URxvt*background:	#050505
diff --git a/mv/2configs/xserver/default.nix b/mv/2configs/xserver/default.nix
index 44539c54b..3d4aa8847 100644
--- a/mv/2configs/xserver/default.nix
+++ b/mv/2configs/xserver/default.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }@args:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO krebs.build.user
diff --git a/mv/2configs/xserver/xserver.conf.nix b/mv/2configs/xserver/xserver.conf.nix
index e8a997a99..c452b4226 100644
--- a/mv/2configs/xserver/xserver.conf.nix
+++ b/mv/2configs/xserver/xserver.conf.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.services.xserver;
diff --git a/mv/3modules/iptables.nix b/mv/3modules/iptables.nix
index cbf49f577..b2b41bf00 100644
--- a/mv/3modules/iptables.nix
+++ b/mv/3modules/iptables.nix
@@ -1,13 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.tv.iptables;
 
   out = {
     options.tv.iptables = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/shared/2configs/base.nix b/shared/2configs/base.nix
index 715397ed5..679764bc6 100644
--- a/shared/2configs/base.nix
+++ b/shared/2configs/base.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   krebs.enable = true;
   krebs.retiolum = {
diff --git a/shared/2configs/cgit-mirror.nix b/shared/2configs/cgit-mirror.nix
index 4ff1902f9..d30f1444f 100644
--- a/shared/2configs/cgit-mirror.nix
+++ b/shared/2configs/cgit-mirror.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   rules = with git; singleton {
     user = [ git-sync ];
diff --git a/shared/2configs/collectd-base.nix b/shared/2configs/collectd-base.nix
index 3b792bf23..9c63dcd20 100644
--- a/shared/2configs/collectd-base.nix
+++ b/shared/2configs/collectd-base.nix
@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 # TODO: krebs.collectd.plugins
-with lib;
+with config.krebs.lib;
 let
   connect-time-cfg = with pkgs; writeText "collectd-connect-time.conf" ''
     LoadPlugin python
diff --git a/shared/2configs/graphite.nix b/shared/2configs/graphite.nix
index 707ec6e9a..37c6b09fd 100644
--- a/shared/2configs/graphite.nix
+++ b/shared/2configs/graphite.nix
@@ -5,7 +5,7 @@
 
 # TODO: krebs.graphite.minimal.enable
 # TODO: configure firewall
-with lib;
+with config.krebs.lib;
 {
   imports = [ ];
 
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index b96548d61..3f804ba12 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.cd;
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index 2010dcd57..4b1fcde36 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO merge with lass
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 37ef204c7..610434f06 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.nomic;
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index 4005b5e6f..942e55e53 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO merge with lass
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 0184ed991..4b9799178 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.wu;
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 2719d56f4..6d300f186 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.xu;
diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix
index 57f299ebd..641e2d586 100644
--- a/tv/2configs/backup.nix
+++ b/tv/2configs/backup.nix
@@ -1,5 +1,5 @@
 { config, lib, ... }:
-with lib;
+with config.krebs.lib;
 {
   krebs.backup.plans = {
     wu-home-xu = {
diff --git a/tv/2configs/charybdis.nix b/tv/2configs/charybdis.nix
index f9ab3da68..eefb2810b 100644
--- a/tv/2configs/charybdis.nix
+++ b/tv/2configs/charybdis.nix
@@ -1,13 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.tv.charybdis;
 
   out = {
     options.tv.charybdis = api;
-    config = mkIf cfg.enable (mkMerge [
+    config = lib.mkIf cfg.enable (lib.mkMerge [
       imp
       { tv.iptables.input-retiolum-accept-new-tcp = [ 6667 6697 ]; }
     ]);
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 2edaed76d..9694e7b5b 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.enable = true;
diff --git a/tv/2configs/exim-retiolum.nix b/tv/2configs/exim-retiolum.nix
index aedf25823..9197a3c30 100644
--- a/tv/2configs/exim-retiolum.nix
+++ b/tv/2configs/exim-retiolum.nix
@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.exim-retiolum.enable = true;
diff --git a/tv/2configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix
index bcfea7821..4b49e20b1 100644
--- a/tv/2configs/exim-smarthost.nix
+++ b/tv/2configs/exim-smarthost.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.exim-smarthost = {
diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix
index f248a8cb5..7a42ca9fa 100644
--- a/tv/2configs/git.nix
+++ b/tv/2configs/git.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
 
diff --git a/tv/2configs/hw/AO753.nix b/tv/2configs/hw/AO753.nix
index e7a2b9238..b81b773be 100644
--- a/tv/2configs/hw/AO753.nix
+++ b/tv/2configs/hw/AO753.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   imports = [
diff --git a/tv/2configs/nginx-public_html.nix b/tv/2configs/nginx-public_html.nix
index dc74f7f8d..15a3b5482 100644
--- a/tv/2configs/nginx-public_html.nix
+++ b/tv/2configs/nginx-public_html.nix
@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.nginx = {
diff --git a/tv/2configs/pulse.nix b/tv/2configs/pulse.nix
index e1894ca64..8e611f21e 100644
--- a/tv/2configs/pulse.nix
+++ b/tv/2configs/pulse.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   pkg = pkgs.pulseaudioLight;
   runDir = "/run/pulse";
diff --git a/tv/2configs/retiolum.nix b/tv/2configs/retiolum.nix
index d2bb9e6cf..e1598d792 100644
--- a/tv/2configs/retiolum.nix
+++ b/tv/2configs/retiolum.nix
@@ -1,6 +1,6 @@
 { config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.retiolum = {
diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 69a880dab..b0c26e50e 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -1,6 +1,6 @@
-{ lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   out = {
     environment.systemPackages = [
diff --git a/tv/2configs/xserver/Xresources.nix b/tv/2configs/xserver/Xresources.nix
index f287bf206..923572721 100644
--- a/tv/2configs/xserver/Xresources.nix
+++ b/tv/2configs/xserver/Xresources.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 pkgs.writeText "Xresources" ''
   !URxvt*background:	#050505
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index 5cd17aa1d..4b936f473 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }@args:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO krebs.build.user
diff --git a/tv/2configs/xserver/xserver.conf.nix b/tv/2configs/xserver/xserver.conf.nix
index e8a997a99..c452b4226 100644
--- a/tv/2configs/xserver/xserver.conf.nix
+++ b/tv/2configs/xserver/xserver.conf.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.services.xserver;
diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
index df35f5c3f..720a8acd8 100644
--- a/tv/2configs/xu-qemu0.nix
+++ b/tv/2configs/xu-qemu0.nix
@@ -21,7 +21,7 @@ in
 # TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport bootps -j ACCEPT
 # TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT
 
-with lib;
+with config.krebs.lib;
 
 {
   networking.dhcpcd.denyInterfaces = [ "qemubr0" ];
diff --git a/tv/3modules/ejabberd.nix b/tv/3modules/ejabberd.nix
index 581e10074..c9d9b48b1 100644
--- a/tv/3modules/ejabberd.nix
+++ b/tv/3modules/ejabberd.nix
@@ -1,13 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.tv.ejabberd;
 
   out = {
     options.tv.ejabberd = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix
index 4924db4f3..c0fd7ec12 100644
--- a/tv/3modules/iptables.nix
+++ b/tv/3modules/iptables.nix
@@ -1,13 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.tv.iptables;
 
   out = {
     options.tv.iptables = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {

From 8f520b19b623919fa6319029a955d43fd051773c Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 15 Feb 2016 16:27:11 +0100
Subject: [PATCH 29/31] don't try to mimic nixpkgs

---
 Makefile                                   |   3 +-
 default.nix                                |  91 +---------
 krebs/3modules/lib.nix                     |   4 +
 krebs/default.nix                          | 201 +--------------------
 lass/1systems/cloudkrebs.nix               |   1 +
 lass/1systems/dishfire.nix                 |   1 +
 lass/1systems/echelon.nix                  |   1 +
 lass/1systems/helios.nix                   |   1 +
 lass/1systems/mors.nix                     |   1 +
 lass/1systems/prism.nix                    |   1 +
 lass/1systems/uriel.nix                    |   1 +
 lass/2configs/base.nix                     |   4 +-
 lass/3modules/dnsmasq.nix                  |   3 +-
 lass/3modules/newsbot-js.nix               |   3 +-
 lass/default.nix                           |   7 +
 makefu/1systems/filepimp.nix               |   1 +
 makefu/1systems/gum.nix                    |   1 +
 makefu/1systems/omo.nix                    |   1 +
 makefu/1systems/pnp.nix                    |   1 +
 makefu/1systems/pornocauster.nix           |   1 +
 makefu/1systems/repunit.nix                |   1 +
 makefu/1systems/tsp.nix                    |   1 +
 makefu/1systems/vbob.nix                   |   1 +
 makefu/1systems/wbob.nix                   |   1 +
 makefu/1systems/wry.nix                    |   1 +
 makefu/2configs/default.nix                |   4 +-
 makefu/default.nix                         |   8 +
 miefda/1systems/bobby.nix                  |   2 +-
 miefda/default.nix                         |   6 +
 mv/1systems/stro.nix                       |   1 +
 nixpkgs/default.nix                        |   6 -
 nixpkgs/krebs                              |   0
 nixpkgs/lib                                |   1 -
 nixpkgs/nixos/default.nix                  |   1 -
 nixpkgs/nixos/lib                          |   1 -
 nixpkgs/nixos/modules                      |   1 -
 root                                       |   1 -
 shared/1systems/test-all-krebs-modules.nix |   3 +
 shared/1systems/test-arch.nix              |   1 +
 shared/1systems/test-centos6.nix           |   1 +
 shared/1systems/test-centos7.nix           |   1 +
 shared/1systems/test-failing.nix           |   3 +
 shared/1systems/test-minimal-deploy.nix    |   3 +
 shared/1systems/wolf.nix                   |   1 +
 shared/2configs/base.nix                   |   4 +-
 shared/default.nix                         |   7 +
 tv/1systems/cd.nix                         |   1 +
 tv/1systems/mkdir.nix                      |   1 +
 tv/1systems/nomic.nix                      |   1 +
 tv/1systems/rmdir.nix                      |   1 +
 tv/1systems/wu.nix                         |   1 +
 tv/1systems/xu-qemu0.nix                   |   1 +
 tv/1systems/xu.nix                         |   1 +
 tv/2configs/default.nix                    |   4 +-
 tv/default.nix                             |   9 +
 55 files changed, 103 insertions(+), 306 deletions(-)
 create mode 100644 lass/default.nix
 create mode 100644 makefu/default.nix
 create mode 100644 miefda/default.nix
 delete mode 100644 nixpkgs/default.nix
 delete mode 100644 nixpkgs/krebs
 delete mode 120000 nixpkgs/lib
 delete mode 100644 nixpkgs/nixos/default.nix
 delete mode 120000 nixpkgs/nixos/lib
 delete mode 120000 nixpkgs/nixos/modules
 delete mode 120000 root
 create mode 100644 shared/default.nix
 create mode 100644 tv/default.nix

diff --git a/Makefile b/Makefile
index e5e3b19d5..384c872ab 100644
--- a/Makefile
+++ b/Makefile
@@ -9,10 +9,11 @@ export target_path ?= /var/src
 
 evaluate = \
 	nix-instantiate \
-		--arg configuration ./$(LOGNAME)/1systems/$(system).nix \
 		--eval \
 		--readonly-mode \
 		--show-trace \
+		-I nixos-config=./$(LOGNAME)/1systems/$(system).nix \
+		-I stockholm=. \
 		$(1)
 
 execute = \
diff --git a/default.nix b/default.nix
index c96d4dd1c..52e8924cd 100644
--- a/default.nix
+++ b/default.nix
@@ -1,86 +1,5 @@
-{ configuration ? import (nixpkgs-path + "/nixos/lib/from-env.nix") "NIXOS_CONFIG" <nixos-config>
-, system ? builtins.currentSystem
-, current-host-name ?
-    let v = builtins.getEnv "HOSTNAME"; in
-    if v != "" then v else builtins.readFile /proc/sys/kernel/hostname
-, current-user-name ?
-    let v = builtins.getEnv "LOGNAME"; in
-    if v != "" then v else abort "undefined variable: LOGNAME"
-, nixpkgs-path ?
-    if (builtins.tryEval <nixpkgs/krebs>).success
-      then <upstream-nixpkgs>
-      else <nixpkgs>
-, StrictHostKeyChecking ? "yes"
-}@args:
-
-let stockholm = {
-    inherit krebs;
-    inherit users;
-    inherit lib;
-    inherit config options pkgs;
-    system = config.system.build.toplevel;
-  };
-
-  krebs = import ./krebs (args // { inherit lib stockholm; });
-
-  lib = let
-    nlib = import (slib.npath "lib");
-    klib = import (slib.kpath "4lib") { lib = nlib; };
-    slib = rec {
-      nspath = ns: p: ./. + "/${ns}/${p}";
-      npath = p: nixpkgs-path + "/${p}";
-      kpath = nspath "krebs";
-      upath = nspath current-user-name;
-    };
-    ulib = let p = slib.upath "4lib"; in
-      nlib.optionalAttrs (klib.dir.has-default-nix p)
-                         (import p { lib = nlib // klib; });
-  in nlib // klib // slib // ulib // builtins;
-
-  inherit (eval configuration) config options pkgs;
-
-  base-module = { config, ... }: {
-    imports = builtins.filter lib.dir.has-default-nix (lib.concatLists [
-      (map (f: f "2configs") [ lib.upath ])
-      (map (f: f "3modules") [ lib.kpath lib.upath ])
-      (map (f: f "5pkgs") [ lib.kpath lib.upath ])
-    ]);
-
-    krebs.lib = lib;
-
-    krebs.current.enable = true;
-    krebs.current.host = config.krebs.hosts.${current-host-name};
-    krebs.current.user = config.krebs.users.${current-user-name};
-  };
-
-  eval = config: import (lib.npath "nixos/lib/eval-config.nix") {
-    inherit system;
-    specialArgs = {
-      inherit lib;
-    };
-    modules = [
-      base-module
-      config
-    ];
-  };
-
-  # TODO move user namespaces' to users/, so no exception for krebs/ is needed
-  users =
-    lib.mapAttrs
-      (name: _: eval-all-systems (lib.nspath name "1systems"))
-      (lib.filterAttrs
-        (n: t: !lib.hasPrefix "." n && t == "directory" && n != "krebs")
-        (builtins.readDir ./.));
-
-  eval-all-systems = path:
-    lib.mapAttrs'
-      (n: _: (lib.nameValuePair (lib.removeSuffix ".nix" n)
-                                (eval-system (path + "/${n}"))))
-      (builtins.readDir path);
-
-  eval-system = path: rec {
-    inherit (eval path) config options;
-    system = config.system.build.toplevel;
-  };
-
-in stockholm
+import <nixpkgs/nixos/lib/eval-config.nix> {
+  modules = [
+    (import <nixpkgs/nixos/lib/from-env.nix> "NIXOS_CONFIG" <nixos-config>)
+  ];
+}
diff --git a/krebs/3modules/lib.nix b/krebs/3modules/lib.nix
index 31390a263..b19f275b5 100644
--- a/krebs/3modules/lib.nix
+++ b/krebs/3modules/lib.nix
@@ -3,9 +3,13 @@ with lib;
 let
   out = {
     options.krebs.lib = api;
+    config = imp;
   };
   api = mkOption {
     default = {};
     type = types.attrs;
   };
+  imp = {
+    krebs.lib = lib // import ../4lib { inherit lib; } // builtins;
+  };
 in out
diff --git a/krebs/default.nix b/krebs/default.nix
index 17c035896..93e006f3d 100644
--- a/krebs/default.nix
+++ b/krebs/default.nix
@@ -1,193 +1,8 @@
-assert false;
-
-{ current-host-name
-, current-user-name
-, lib
-, stockholm
-, StrictHostKeyChecking ? "yes"
-}:
-
-let out = {
-    inherit infest;
-    inherit init;
-    inherit nixos-install;
-  };
-
-  infest =
-    { system ? current-host-name
-    , target ? system
-    }@args: let
-      config = get-config system;
-    in ''
-      #! /bin/sh
-      # krebs.infest
-      set -efu
-
-      ${rootssh target ''
-        ${builtins.readFile ./4lib/infest/prepare.sh}
-        ${builtins.readFile ./4lib/infest/install-nix.sh}
-      ''}
-
-      (${nixos-install args})
-
-      ${rootssh target ''
-        ${builtins.readFile ./4lib/infest/finalize.sh}
-      ''}
-    '';
-
-  init =
-    { system ? current-host-name
-    }@args: let
-      config = get-config system;
-    in ''
-      #! /bin/sh
-      # krebs.init
-      set -efu
-
-      system=${lib.shell.escape system}
-      secrets_dir=${config.krebs.build.source.dir.secrets.path}
-      key_type=ed25519
-      key_file=$secrets_dir/ssh.id_$key_type
-      key_comment=$system
-
-      if test -e "$key_file"; then
-        echo "Warning: privkey already exists: $key_file" >&2
-      else
-        ssh-keygen \
-            -C "$key_comment" \
-            -t "$key_type" \
-            -f "$key_file" \
-            -N ""
-        rm "$key_file.pub"
-      fi
-
-      pubkey=$(ssh-keygen -y -f "$key_file")
-
-      cat<<EOF
-      # put following into config.krebs.hosts.$system:
-      ssh.privkey.path = <secrets/ssh.$key_type>;
-      ssh.pubkey = $(echo $pubkey | jq -R .);
-      EOF
-    '';
-
-  nixos-install =
-    { system ? current-host-name
-    , target ? system
-    }@args: let
-    in ''
-      #! /bin/sh
-      # krebs.nixos-install
-      (${populate (args // { root = "/mnt"; })})
-
-      ${rootssh target ''
-        export PATH; PATH=/root/.nix-profile/bin:$PATH
-
-        src=$(type -p nixos-install)
-        cat_src() {
-          sed < "$src" "$(
-            { sed < "$src" -n '
-                  /^if ! test -e "\$mountPoint\/\$NIXOS_CONFIG/,/^fi$/=
-                  /^nixpkgs=/=
-                  /^NIX_PATH=/,/^$/{/./=}
-
-                  # Disable: Copy the NixOS/Nixpkgs sources to the target as
-                  # the initial contents of the NixOS channel.
-                  /^srcs=/,/^ln -sfn /=
-                '
-            } | sed 's:$:s/^/#krebs#/:'
-          )"
-        }
-
-        # Location to insert `nix-install`
-        i=$(sed -n '/^echo "building the system configuration/=' "$src")
-
-        {
-          cat_src | sed -n "1,$i{p}"
-          cat ${doc (nix-install args)}
-          cat_src | sed -n "$i,\''${$i!p}"
-        } > nixos-install
-        chmod +x nixos-install
-
-        # Wrap inserted nix-install into chroot.
-        nix_env=$(cat_src | sed -n '
-          s:.*\(/nix/store/[a-z0-9]*-nix-[0-9.]\+/bin/nix-env\).*:\1:p;T;q
-        ')
-        echo "nix-env is $nix_env" >&2
-        findpkg() {(
-          name=$1
-          path=$(find /nix/store \
-              -mindepth 1 -maxdepth 1 -type d -name '*-'"$name"'-*' \
-            | head -n 1 | sed s:^/mnt::)
-          if echo "$path" | grep .; then
-            echo "$name is $path" >&2
-          else
-            echo "Error: package not found: $name" >&2
-            exit 1
-          fi
-        )}
-        cacert=$(findpkg cacert)
-        coreutils=$(findpkg coreutils)
-        cp "$cacert"/etc/ssl/certs/ca-bundle.crt /mnt/root/SSL_CERT_FILE
-        env="$coreutils/bin/env SSL_CERT_FILE=/root/SSL_CERT_FILE"
-        sed -i '
-          s:^NIX_PATH=:chroot $mountPoint '"$env"' &:
-          s:^nix-env:'"$nix_env"':
-        ' nixos-install
-
-        ./nixos-install
-      ''}
-    '';
-
-  doc = s:
-    let b = "EOF${builtins.hashString "sha256" s}"; in
-    ''
-    <<\${b}
-    ${s}
-    ${b}
-    '';
-
-  get-config = system: let
-    config = stockholm.users.${current-user-name}.${system}.config
-      or (abort "unknown system: ${system}, user: ${current-user-name}");
-  in config;
-
-  nix-install =
-    { system ? current-host-name
-    , target ? system
-    }:
-    let
-      config = get-config system;
-
-      nix-path =
-        lib.concatStringsSep ":"
-          (lib.mapAttrsToList (name: src: "${name}=${src.target-path}")
-            (config.krebs.build.source.dir //
-             config.krebs.build.source.git));
-    in ''
-      set -efu
-      NIX_PATH=${lib.shell.escape nix-path} \
-      nix-env \
-        --show-trace \
-        -f '<stockholm>' \
-        --argstr current-host-name ${lib.shell.escape current-host-name} \
-        --argstr current-user-name ${lib.shell.escape current-user-name} \
-        --profile ${lib.shell.escape config.krebs.build.profile} \
-        --set \
-        -A ${lib.escapeShellArg (lib.concatStringsSep "." [
-              "users"
-              config.krebs.build.user.name
-              config.krebs.build.host.name
-              "system"
-            ])}
-    '';
-
-  rootssh = target: script:
-    let
-      flags = "-o StrictHostKeyChecking=${StrictHostKeyChecking}";
-    in
-    "ssh ${flags} root@${target} -T ${doc ''
-      set -efu
-      ${script}
-    ''}";
-
-in out
+{ config, lib, pkgs, ... }:
+with config.krebs.lib;
+{
+  imports = [
+    ./3modules
+    ./5pkgs
+  ];
+}
diff --git a/lass/1systems/cloudkrebs.nix b/lass/1systems/cloudkrebs.nix
index ab24b584b..98f509050 100644
--- a/lass/1systems/cloudkrebs.nix
+++ b/lass/1systems/cloudkrebs.nix
@@ -7,6 +7,7 @@ let
   ip = (head config.krebs.build.host.nets.internet.addrs4);
 in {
   imports = [
+    ../.
     ../2configs/os-templates/CAC-CentOS-7-64bit.nix
     ../2configs/base.nix
     ../2configs/retiolum.nix
diff --git a/lass/1systems/dishfire.nix b/lass/1systems/dishfire.nix
index cc9836dff..c7d016cd3 100644
--- a/lass/1systems/dishfire.nix
+++ b/lass/1systems/dishfire.nix
@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ../.
     <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
     ../2configs/base.nix
     ../2configs/git.nix
diff --git a/lass/1systems/echelon.nix b/lass/1systems/echelon.nix
index 39af4a96f..2ff6dba70 100644
--- a/lass/1systems/echelon.nix
+++ b/lass/1systems/echelon.nix
@@ -7,6 +7,7 @@ let
   ip = (head config.krebs.build.host.nets.internet.addrs4);
 in {
   imports = [
+    ../.
     ../2configs/os-templates/CAC-CentOS-7-64bit.nix
     ../2configs/base.nix
     ../2configs/retiolum.nix
diff --git a/lass/1systems/helios.nix b/lass/1systems/helios.nix
index 67e3738ea..88fb6aac7 100644
--- a/lass/1systems/helios.nix
+++ b/lass/1systems/helios.nix
@@ -3,6 +3,7 @@
 with builtins;
 {
   imports = [
+    ../.
     ../2configs/baseX.nix
     ../2configs/browsers.nix
     ../2configs/programs.nix
diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index ebce93957..f6ac1b4e6 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ../.
     ../2configs/baseX.nix
     ../2configs/programs.nix
     ../2configs/bitcoin.nix
diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix
index 95c55533c..05b3470e5 100644
--- a/lass/1systems/prism.nix
+++ b/lass/1systems/prism.nix
@@ -6,6 +6,7 @@ let
   ip = (head config.krebs.build.host.nets.internet.addrs4);
 in {
   imports = [
+    ../.
     ../2configs/base.nix
     ../2configs/downloading.nix
     ../2configs/git.nix
diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix
index d53e783d0..0758164f0 100644
--- a/lass/1systems/uriel.nix
+++ b/lass/1systems/uriel.nix
@@ -3,6 +3,7 @@
 with builtins;
 {
   imports = [
+    ../.
     ../2configs/baseX.nix
     ../2configs/browsers.nix
     ../2configs/games.nix
diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix
index 68103c3ef..d2c96fdaa 100644
--- a/lass/2configs/base.nix
+++ b/lass/2configs/base.nix
@@ -50,12 +50,10 @@ with config.krebs.lib;
       user = config.krebs.users.lass;
       source = mapAttrs (_: mkDefault) ({
         nixos-config = "symlink:stockholm/lass/1systems/${config.krebs.build.host.name}.nix";
-        nixpkgs = symlink:stockholm/nixpkgs;
         secrets = "/home/lass/secrets/${config.krebs.build.host.name}";
         #secrets-common = "/home/lass/secrets/common";
         stockholm = "/home/lass/stockholm";
-        stockholm-user = "symlink:stockholm/lass";
-        upstream-nixpkgs = {
+        nixpkgs = {
           url = https://github.com/Lassulus/nixpkgs;
           rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce";
           dev = "/home/lass/src/nixpkgs";
diff --git a/lass/3modules/dnsmasq.nix b/lass/3modules/dnsmasq.nix
index c05ad0fc9..83a9cb180 100644
--- a/lass/3modules/dnsmasq.nix
+++ b/lass/3modules/dnsmasq.nix
@@ -1,6 +1,7 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with builtins;
+with lib;
 
 let
   cfg = config.lass.dnsmasq;
diff --git a/lass/3modules/newsbot-js.nix b/lass/3modules/newsbot-js.nix
index ef4d97b76..5e340b26f 100644
--- a/lass/3modules/newsbot-js.nix
+++ b/lass/3modules/newsbot-js.nix
@@ -1,6 +1,7 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with builtins;
+with lib;
 
 let
   cfg = config.lass.newsbot-js;
diff --git a/lass/default.nix b/lass/default.nix
new file mode 100644
index 000000000..69b4abaac
--- /dev/null
+++ b/lass/default.nix
@@ -0,0 +1,7 @@
+_:
+{
+  imports = [
+    ../krebs
+    ./3modules
+  ];
+}
diff --git a/makefu/1systems/filepimp.nix b/makefu/1systems/filepimp.nix
index fb9324ee9..f2c592ea9 100644
--- a/makefu/1systems/filepimp.nix
+++ b/makefu/1systems/filepimp.nix
@@ -11,6 +11,7 @@ let
 in {
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       ../2configs/fs/single-partition-ext4.nix
       ../2configs/tinc-basic-retiolum.nix
       ../2configs/smart-monitor.nix
diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix
index 43fc8109d..04adc4941 100644
--- a/makefu/1systems/gum.nix
+++ b/makefu/1systems/gum.nix
@@ -6,6 +6,7 @@ let
   internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
 in {
   imports = [
+      ../.
       ../2configs/tinc-basic-retiolum.nix
       ../2configs/headless.nix
       ../2configs/fs/simple-swap.nix
diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix
index 34d5a394d..6cff35e9d 100644
--- a/makefu/1systems/omo.nix
+++ b/makefu/1systems/omo.nix
@@ -20,6 +20,7 @@ let
 in {
   imports =
     [
+      ../.
       # TODO: unlock home partition via ssh
       ../2configs/fs/single-partition-ext4.nix
       ../2configs/tinc-basic-retiolum.nix
diff --git a/makefu/1systems/pnp.nix b/makefu/1systems/pnp.nix
index 51c124bbe..8791ad1d7 100644
--- a/makefu/1systems/pnp.nix
+++ b/makefu/1systems/pnp.nix
@@ -6,6 +6,7 @@
 {
   imports =
     [
+      ../.
       ../2configs/tinc-basic-retiolum.nix
       ../2configs/headless.nix
       ../../krebs/3modules/Reaktor.nix
diff --git a/makefu/1systems/pornocauster.nix b/makefu/1systems/pornocauster.nix
index d8ccc5846..b2cf0be79 100644
--- a/makefu/1systems/pornocauster.nix
+++ b/makefu/1systems/pornocauster.nix
@@ -6,6 +6,7 @@
 {
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       ../2configs/main-laptop.nix #< base-gui + zsh
 
       # Krebs
diff --git a/makefu/1systems/repunit.nix b/makefu/1systems/repunit.nix
index 0c6ba09fb..6d2e7273d 100644
--- a/makefu/1systems/repunit.nix
+++ b/makefu/1systems/repunit.nix
@@ -7,6 +7,7 @@
 {
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
       ../2configs/cgit-retiolum.nix
     ];
diff --git a/makefu/1systems/tsp.nix b/makefu/1systems/tsp.nix
index 990db65d2..d5d44cce0 100644
--- a/makefu/1systems/tsp.nix
+++ b/makefu/1systems/tsp.nix
@@ -6,6 +6,7 @@
 {
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       ../2configs/base-gui.nix
       ../2configs/tinc-basic-retiolum.nix
       ../2configs/fs/sda-crypto-root.nix
diff --git a/makefu/1systems/vbob.nix b/makefu/1systems/vbob.nix
index 2dee83728..e07525d0d 100644
--- a/makefu/1systems/vbob.nix
+++ b/makefu/1systems/vbob.nix
@@ -6,6 +6,7 @@
   krebs.build.host = config.krebs.hosts.vbob;
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       <nixpkgs/nixos/modules/virtualisation/virtualbox-image.nix>
       ../2configs/main-laptop.nix #< base-gui
 
diff --git a/makefu/1systems/wbob.nix b/makefu/1systems/wbob.nix
index 8917e4339..b4f7c9058 100644
--- a/makefu/1systems/wbob.nix
+++ b/makefu/1systems/wbob.nix
@@ -2,6 +2,7 @@
 {
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       ../2configs/main-laptop.nix
     ];
   krebs = {
diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index 41d207ed2..747321968 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -7,6 +7,7 @@ let
   internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
 in {
   imports = [
+      ../.
       # TODO: copy this config or move to krebs
       ../../tv/2configs/hw/CAC.nix
       ../../tv/2configs/fs/CAC-CentOS-7-64bit.nix
diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix
index c35bfc173..153e80bb1 100644
--- a/makefu/2configs/default.nix
+++ b/makefu/2configs/default.nix
@@ -21,7 +21,7 @@ with config.krebs.lib;
       target = mkDefault "root@${config.krebs.build.host.name}";
       user = config.krebs.users.makefu;
       source =  mapAttrs (_: mkDefault) {
-        upstream-nixpkgs = {
+        nixpkgs = {
           url = https://github.com/nixos/nixpkgs;
           rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; # unstable @ 2015-01-27, tested on wry
         };
@@ -30,8 +30,6 @@ with config.krebs.lib;
 
         # Defaults for all stockholm users?
         nixos-config = "symlink:stockholm/${config.krebs.build.user.name}/1systems/${config.krebs.build.host.name}.nix";
-        nixpkgs = symlink:stockholm/nixpkgs;
-        stockholm-user = "symlink:stockholm/${config.krebs.build.user.name}";
       };
     };
   };
diff --git a/makefu/default.nix b/makefu/default.nix
new file mode 100644
index 000000000..320e1a133
--- /dev/null
+++ b/makefu/default.nix
@@ -0,0 +1,8 @@
+_:
+{
+  imports = [
+    ../krebs
+    ./2configs
+    ./3modules
+  ];
+}
diff --git a/miefda/1systems/bobby.nix b/miefda/1systems/bobby.nix
index d24595256..b85e686b5 100644
--- a/miefda/1systems/bobby.nix
+++ b/miefda/1systems/bobby.nix
@@ -7,7 +7,7 @@
 {
   imports =
     [ # Include the results of the hardware scan.
-
+      ../.
       ../2configs/miefda.nix
       ../2configs/tlp.nix
       ../2configs/x220t.nix
diff --git a/miefda/default.nix b/miefda/default.nix
new file mode 100644
index 000000000..7f275c2eb
--- /dev/null
+++ b/miefda/default.nix
@@ -0,0 +1,6 @@
+_:
+{
+  imports = [
+    ../krebs
+  ];
+}
diff --git a/mv/1systems/stro.nix b/mv/1systems/stro.nix
index b3dfc5708..f251cb092 100644
--- a/mv/1systems/stro.nix
+++ b/mv/1systems/stro.nix
@@ -9,6 +9,7 @@ with config.krebs.lib;
     "7ae05edcdd14f6ace83ead9bf0d114e97c89a83a";
 
   imports = [
+    ../.
     ../2configs/hw/x220.nix
     ../2configs/git.nix
     ../2configs/mail-client.nix
diff --git a/nixpkgs/default.nix b/nixpkgs/default.nix
deleted file mode 100644
index 8514fa499..000000000
--- a/nixpkgs/default.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ system ? builtins.currentSystem }:
-
-(import <stockholm> {
-  inherit system;
-  configuration = {};
-}).pkgs
diff --git a/nixpkgs/krebs b/nixpkgs/krebs
deleted file mode 100644
index e69de29bb..000000000
diff --git a/nixpkgs/lib b/nixpkgs/lib
deleted file mode 120000
index 7b13c8069..000000000
--- a/nixpkgs/lib
+++ /dev/null
@@ -1 +0,0 @@
-../../upstream-nixpkgs/lib
\ No newline at end of file
diff --git a/nixpkgs/nixos/default.nix b/nixpkgs/nixos/default.nix
deleted file mode 100644
index 4fe08efd2..000000000
--- a/nixpkgs/nixos/default.nix
+++ /dev/null
@@ -1 +0,0 @@
-import <stockholm>
diff --git a/nixpkgs/nixos/lib b/nixpkgs/nixos/lib
deleted file mode 120000
index 9e69d1a67..000000000
--- a/nixpkgs/nixos/lib
+++ /dev/null
@@ -1 +0,0 @@
-../../../upstream-nixpkgs/nixos/lib
\ No newline at end of file
diff --git a/nixpkgs/nixos/modules b/nixpkgs/nixos/modules
deleted file mode 120000
index 8aa24885c..000000000
--- a/nixpkgs/nixos/modules
+++ /dev/null
@@ -1 +0,0 @@
-../../../upstream-nixpkgs/nixos/modules
\ No newline at end of file
diff --git a/root b/root
deleted file mode 120000
index 1cd18253d..000000000
--- a/root
+++ /dev/null
@@ -1 +0,0 @@
-../stockholm-user
\ No newline at end of file
diff --git a/shared/1systems/test-all-krebs-modules.nix b/shared/1systems/test-all-krebs-modules.nix
index b98004dfe..e1021c7e0 100644
--- a/shared/1systems/test-all-krebs-modules.nix
+++ b/shared/1systems/test-all-krebs-modules.nix
@@ -2,6 +2,9 @@
 let
   en = { enable = true;};
 in {
+  imports = [
+    ../.
+  ];
   krebs = {
     enable = true;
     build.user = config.krebs.users.shared;
diff --git a/shared/1systems/test-arch.nix b/shared/1systems/test-arch.nix
index ece209490..14fc0384b 100644
--- a/shared/1systems/test-arch.nix
+++ b/shared/1systems/test-arch.nix
@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ../.
     ../2configs/base.nix
     {
       boot.loader.grub = {
diff --git a/shared/1systems/test-centos6.nix b/shared/1systems/test-centos6.nix
index a8b5f9b9c..8add0b7c1 100644
--- a/shared/1systems/test-centos6.nix
+++ b/shared/1systems/test-centos6.nix
@@ -7,6 +7,7 @@ let
   gw = "168.235.148.1";
 in {
   imports = [
+    ../.
     ../2configs/base.nix
     ../2configs/os-templates/CAC-CentOS-6.5-64bit.nix
     {
diff --git a/shared/1systems/test-centos7.nix b/shared/1systems/test-centos7.nix
index 48cecc877..65daff509 100644
--- a/shared/1systems/test-centos7.nix
+++ b/shared/1systems/test-centos7.nix
@@ -5,6 +5,7 @@ let
 
 in {
   imports = [
+    ../.
     ../2configs/base.nix
     ../2configs/os-templates/CAC-CentOS-7-64bit.nix
     ../2configs/temp/networking.nix
diff --git a/shared/1systems/test-failing.nix b/shared/1systems/test-failing.nix
index 81a9e48d6..fe1c2cb65 100644
--- a/shared/1systems/test-failing.nix
+++ b/shared/1systems/test-failing.nix
@@ -1,6 +1,9 @@
 { config, pkgs, ... }:
 
 {
+  imports = [
+    ../.
+  ];
   programs.ssh.startAgent = true;
   programs.ssh.startAgent = false;
 }
diff --git a/shared/1systems/test-minimal-deploy.nix b/shared/1systems/test-minimal-deploy.nix
index 309e28950..bec2b38d5 100644
--- a/shared/1systems/test-minimal-deploy.nix
+++ b/shared/1systems/test-minimal-deploy.nix
@@ -1,5 +1,8 @@
 { config, pkgs, lib, ... }:
 {
+  imports = [
+    ../.
+  ];
   krebs = {
     enable = true;
     build.user = config.krebs.users.shared;
diff --git a/shared/1systems/wolf.nix b/shared/1systems/wolf.nix
index 9a514428a..317591433 100644
--- a/shared/1systems/wolf.nix
+++ b/shared/1systems/wolf.nix
@@ -6,6 +6,7 @@ let
 in
 {
   imports = [
+    ../.
     ../2configs/base.nix
     <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
     ../2configs/collectd-base.nix
diff --git a/shared/2configs/base.nix b/shared/2configs/base.nix
index 679764bc6..9f998b554 100644
--- a/shared/2configs/base.nix
+++ b/shared/2configs/base.nix
@@ -16,7 +16,7 @@ with config.krebs.lib;
   # TODO rename shared user to "krebs"
   krebs.build.user = mkDefault config.krebs.users.shared;
   krebs.build.source = {
-    upstream-nixpkgs = mkDefault {
+    nixpkgs = mkDefault {
       url = https://github.com/NixOS/nixpkgs;
       rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; # for urlwatch-minidb
     };
@@ -24,8 +24,6 @@ with config.krebs.lib;
     stockholm = mkDefault "${getEnv "HOME"}/stockholm";
 
     nixos-config = "symlink:stockholm/${config.krebs.build.user.name}/1systems/${config.krebs.build.host.name}.nix";
-    nixpkgs = symlink:stockholm/nixpkgs;
-    stockholm-user = "symlink:stockholm/${config.krebs.build.user.name}";
   };
 
   networking.hostName = config.krebs.build.host.name;
diff --git a/shared/default.nix b/shared/default.nix
new file mode 100644
index 000000000..69b4abaac
--- /dev/null
+++ b/shared/default.nix
@@ -0,0 +1,7 @@
+_:
+{
+  imports = [
+    ../krebs
+    ./3modules
+  ];
+}
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 3f804ba12..9b6382607 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -6,6 +6,7 @@ with config.krebs.lib;
   krebs.build.host = config.krebs.hosts.cd;
 
   imports = [
+    ../.
     ../2configs/hw/CAC-Developer-2.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
     ../2configs/exim-smarthost.nix
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index 4b1fcde36..58a8fdcb2 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -19,6 +19,7 @@ in
   krebs.build.host = config.krebs.hosts.mkdir;
 
   imports = [
+    ../.
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
     ../2configs/exim-smarthost.nix
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 610434f06..2c9775da7 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -6,6 +6,7 @@ with config.krebs.lib;
   krebs.build.host = config.krebs.hosts.nomic;
 
   imports = [
+    ../.
     ../2configs/hw/AO753.nix
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index 942e55e53..c54caa649 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -19,6 +19,7 @@ in
   krebs.build.host = config.krebs.hosts.rmdir;
 
   imports = [
+    ../.
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
     ../2configs/exim-smarthost.nix
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 4b9799178..6154e4df9 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -6,6 +6,7 @@ with config.krebs.lib;
   krebs.build.host = config.krebs.hosts.wu;
 
   imports = [
+    ../.
     ../2configs/hw/w110er.nix
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
diff --git a/tv/1systems/xu-qemu0.nix b/tv/1systems/xu-qemu0.nix
index 03ac19cf7..8945c1907 100644
--- a/tv/1systems/xu-qemu0.nix
+++ b/tv/1systems/xu-qemu0.nix
@@ -10,6 +10,7 @@
   krebs.build.host = config.krebs.hosts.xu-qemu0;
 
   imports = [
+    ../.
     <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
   ];
 
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 6d300f186..5ec1fe52b 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -6,6 +6,7 @@ with config.krebs.lib;
   krebs.build.host = config.krebs.hosts.xu;
 
   imports = [
+    ../.
     ../2configs/hw/x220.nix
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 9694e7b5b..c4a2d6baa 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -9,12 +9,10 @@ with config.krebs.lib;
     user = config.krebs.users.tv;
     source = mapAttrs (_: mkDefault) ({
       nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix";
-      nixpkgs = symlink:stockholm/nixpkgs;
       secrets = "/home/tv/secrets/${config.krebs.build.host.name}";
       secrets-common = "/home/tv/secrets/common";
       stockholm = "/home/tv/stockholm";
-      stockholm-user = "symlink:stockholm/tv";
-      upstream-nixpkgs = {
+      nixpkgs = {
         url = https://github.com/NixOS/nixpkgs;
         rev = "77f8f35d57618c1ba456d968524f2fb2c3448295";
         dev = "/home/tv/nixpkgs";
diff --git a/tv/default.nix b/tv/default.nix
new file mode 100644
index 000000000..b1c7c1be8
--- /dev/null
+++ b/tv/default.nix
@@ -0,0 +1,9 @@
+_:
+{
+  imports = [
+    ../krebs
+    ./2configs
+    ./3modules
+    ./5pkgs
+  ];
+}

From b7a92f63884af00eb0243ec9328be689a6c9b845 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 15 Feb 2016 16:29:01 +0100
Subject: [PATCH 30/31] *: make eval.config.krebs.build.host.name work
 everywhere

---
 krebs/3modules/backup.nix    | 2 +-
 krebs/3modules/default.nix   | 4 ++--
 lass/3modules/urxvtd.nix     | 3 ++-
 lass/3modules/xresources.nix | 3 ++-
 makefu/1systems/repunit.nix  | 2 +-
 makefu/2configs/default.nix  | 1 -
 makefu/3modules/snapraid.nix | 2 +-
 makefu/3modules/umts.nix     | 2 +-
 8 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix
index 5e1a1597b..0aa86dec9 100644
--- a/krebs/3modules/backup.nix
+++ b/krebs/3modules/backup.nix
@@ -210,7 +210,7 @@ let
       | ${pkgs.coreutils}/bin/head -1; }
   '';
 
-  # Note that we don't escape word on purpose, so we deref shell vars.
+  # Note that we don't escape word on purpose, so we can deref shell vars.
   # TODO type word
   network-ssh-port = host: word: ''
     case ${word} in
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 23f82ed1c..16a74e7c1 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -9,9 +9,9 @@ let
       ./apt-cacher-ng.nix
       ./backup.nix
       ./bepasty-server.nix
-      ./build.nix
       ./buildbot/master.nix
       ./buildbot/slave.nix
+      ./build.nix
       ./current.nix
       ./exim-retiolum.nix
       ./exim-smarthost.nix
@@ -25,8 +25,8 @@ let
       ./nixpkgs.nix
       ./per-user.nix
       ./Reaktor.nix
-      ./retiolum-bootstrap.nix
       ./realwallpaper.nix
+      ./retiolum-bootstrap.nix
       ./retiolum.nix
       ./setuid.nix
       ./tinc_graphs.nix
diff --git a/lass/3modules/urxvtd.nix b/lass/3modules/urxvtd.nix
index 1eb463955..469616a9f 100644
--- a/lass/3modules/urxvtd.nix
+++ b/lass/3modules/urxvtd.nix
@@ -3,7 +3,8 @@
 let
 in
 
-with config.krebs.lib;
+with builtins;
+with lib;
 
 {
   options = {
diff --git a/lass/3modules/xresources.nix b/lass/3modules/xresources.nix
index 729eccecc..074963022 100644
--- a/lass/3modules/xresources.nix
+++ b/lass/3modules/xresources.nix
@@ -6,7 +6,8 @@
 
 #
 #
-with config.krebs.lib;
+with builtins;
+with lib;
 
 
 let
diff --git a/makefu/1systems/repunit.nix b/makefu/1systems/repunit.nix
index 6d2e7273d..f9421cfa2 100644
--- a/makefu/1systems/repunit.nix
+++ b/makefu/1systems/repunit.nix
@@ -9,7 +9,7 @@
     [ # Include the results of the hardware scan.
       ../.
       <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
-      ../2configs/cgit-retiolum.nix
+      ../2configs/git/cgit-retiolum.nix
     ];
   krebs.build.host = config.krebs.hosts.repunit;
 
diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix
index 153e80bb1..83018e9f8 100644
--- a/makefu/2configs/default.nix
+++ b/makefu/2configs/default.nix
@@ -18,7 +18,6 @@ with config.krebs.lib;
     enable = true;
     search-domain = "retiolum";
     build =  {
-      target = mkDefault "root@${config.krebs.build.host.name}";
       user = config.krebs.users.makefu;
       source =  mapAttrs (_: mkDefault) {
         nixpkgs = {
diff --git a/makefu/3modules/snapraid.nix b/makefu/3modules/snapraid.nix
index 4a0363e6a..3d458bbbf 100644
--- a/makefu/3modules/snapraid.nix
+++ b/makefu/3modules/snapraid.nix
@@ -28,7 +28,7 @@ let
 
   out = {
     options.makefu.snapraid = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/makefu/3modules/umts.nix b/makefu/3modules/umts.nix
index 7e0e5dada..e527a5cb7 100644
--- a/makefu/3modules/umts.nix
+++ b/makefu/3modules/umts.nix
@@ -32,7 +32,7 @@ let
 
   out = {
     options.makefu.umts = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {

From 372f2d77f301719e396a6f943657325e2f8b2cf4 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 15 Feb 2016 16:57:15 +0100
Subject: [PATCH 31/31] shared-buildbot: <stockholm> isn't a function

---
 shared/2configs/shared-buildbot.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/shared/2configs/shared-buildbot.nix b/shared/2configs/shared-buildbot.nix
index af877f5d8..f6798bf99 100644
--- a/shared/2configs/shared-buildbot.nix
+++ b/shared/2configs/shared-buildbot.nix
@@ -61,7 +61,7 @@
   # prepare nix-shell
   # the dependencies which are used by the test script
   deps = [ "gnumake", "jq","nix","rsync",
-            "(import <stockholm> {}).pkgs.test.infest-cac-centos7" ]
+            "(import <stockholm>).pkgs.test.infest-cac-centos7" ]
   # TODO: --pure , prepare ENV in nix-shell command:
   #                   SSL_CERT_FILE,LOGNAME,NIX_REMOTE
   nixshell = ["nix-shell",