Merge remote-tracking branch 'cd/master'

This commit is contained in:
makefu 2016-02-15 17:07:48 +01:00
commit 3ceff0ec29
163 changed files with 829 additions and 564 deletions

View File

@ -4,14 +4,16 @@ endif
export target_host ?= $(system)
export target_user ?= root
export target_port ?= 22
export target_path ?= /var/src
evaluate = \
nix-instantiate \
--arg configuration ./$(LOGNAME)/1systems/$(system).nix \
--eval \
--readonly-mode \
--show-trace \
-I nixos-config=./$(LOGNAME)/1systems/$(system).nix \
-I stockholm=. \
$(1)
execute = \
@ -22,19 +24,20 @@ execute = \
# usage: make deploy system=foo [target_host=bar]
deploy:
$(call execute,populate)
ssh $(target_user)@$(target_host) nixos-rebuild switch -I $(target_path)
ssh $(target_user)@$(target_host) -p $(target_port) \
nixos-rebuild switch --show-trace -I $(target_path)
# usage: make LOGNAME=shared system=wolf eval.config.krebs.build.host.name
eval eval.:;@$(call evaluate)
eval.%:;@$(call evaluate,-A $*)
# usage: make install system=foo [target_host=bar]
install: ssh = ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
install: ssh ?= ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
install:
$(ssh) $(target_user)@$(target_host) \
$(ssh) $(target_user)@$(target_host) -p $(target_port) \
env target_path=$(target_path) \
sh -s prepare < krebs/4lib/infest/prepare.sh
target_path=/mnt$(target_path) $(call execute,populate)
$(ssh) $(target_user)@$(target_host) \
$(ssh) $(target_user)@$(target_host) -p $(target_port) \
env NIXOS_CONFIG=$(target_path)/nixos-config \
nixos-install

View File

@ -1,84 +1,5 @@
{ configuration ? import (nixpkgs-path + "/nixos/lib/from-env.nix") "NIXOS_CONFIG" <nixos-config>
, system ? builtins.currentSystem
, current-host-name ?
let v = builtins.getEnv "HOSTNAME"; in
if v != "" then v else builtins.readFile /proc/sys/kernel/hostname
, current-user-name ?
let v = builtins.getEnv "LOGNAME"; in
if v != "" then v else abort "undefined variable: LOGNAME"
, nixpkgs-path ?
if (builtins.tryEval <nixpkgs/krebs>).success
then <upstream-nixpkgs>
else <nixpkgs>
, StrictHostKeyChecking ? "yes"
}@args:
let stockholm = {
inherit krebs;
inherit users;
inherit lib;
inherit config options pkgs;
system = config.system.build.toplevel;
};
krebs = import ./krebs (args // { inherit lib stockholm; });
lib = let
nlib = import (slib.npath "lib");
klib = import (slib.kpath "4lib") { lib = nlib; };
slib = rec {
nspath = ns: p: ./. + "/${ns}/${p}";
npath = p: nixpkgs-path + "/${p}";
kpath = nspath "krebs";
upath = nspath current-user-name;
};
ulib = let p = slib.upath "4lib"; in
nlib.optionalAttrs (klib.dir.has-default-nix p)
(import p { lib = nlib // klib; });
in nlib // klib // slib // ulib // builtins;
inherit (eval configuration) config options pkgs;
base-module = { config, ... }: {
imports = builtins.filter lib.dir.has-default-nix (lib.concatLists [
(map (f: f "2configs") [ lib.upath ])
(map (f: f "3modules") [ lib.kpath lib.upath ])
(map (f: f "5pkgs") [ lib.kpath lib.upath ])
]);
krebs.current.enable = true;
krebs.current.host = config.krebs.hosts.${current-host-name};
krebs.current.user = config.krebs.users.${current-user-name};
};
eval = config: import (lib.npath "nixos/lib/eval-config.nix") {
inherit system;
specialArgs = {
inherit lib;
};
import <nixpkgs/nixos/lib/eval-config.nix> {
modules = [
base-module
config
(import <nixpkgs/nixos/lib/from-env.nix> "NIXOS_CONFIG" <nixos-config>)
];
};
# TODO move user namespaces' to users/, so no exception for krebs/ is needed
users =
lib.mapAttrs
(name: _: eval-all-systems (lib.nspath name "1systems"))
(lib.filterAttrs
(n: t: !lib.hasPrefix "." n && t == "directory" && n != "krebs")
(builtins.readDir ./.));
eval-all-systems = path:
lib.mapAttrs'
(n: _: (lib.nameValuePair (lib.removeSuffix ".nix" n)
(eval-system (path + "/${n}"))))
(builtins.readDir path);
eval-system = path: rec {
inherit (eval path) config options;
system = config.system.build.toplevel;
};
in stockholm
}

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
ReaktorConfig = pkgs.writeText "config.py" ''
@ -16,7 +16,7 @@ let
out = {
options.krebs.Reaktor = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
};
api = {

View File

@ -1,6 +1,6 @@
{ config, pkgs, lib, ... }:
with lib;
with config.krebs.lib;
let
acng-config = pkgs.writeTextFile {
name = "acng-configuration";
@ -151,5 +151,5 @@ let
in
{
options.krebs.apt-cacher-ng = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
}

View File

@ -1,9 +1,9 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
out = {
options.krebs.backup = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
};
cfg = config.krebs.backup;
@ -210,7 +210,7 @@ let
| ${pkgs.coreutils}/bin/head -1; }
'';
# Note that we don't escape word on purpose, so we deref shell vars.
# Note that we don't escape word on purpose, so we can deref shell vars.
# TODO type word
network-ssh-port = host: word: ''
case ${word} in

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
gunicorn = pkgs.pythonPackages.gunicorn;
bepasty = pkgs.pythonPackages.bepasty-server;
@ -10,8 +10,8 @@ let
out = {
options.krebs.bepasty = api;
config = mkIf cfg.enable (mkMerge [
(mkIf cfg.serveNginx nginx-imp)
config = lib.mkIf cfg.enable (lib.mkMerge [
(lib.mkIf cfg.serveNginx nginx-imp)
imp
]);
};

View File

@ -1,6 +1,6 @@
{ config, lib, ... }:
with lib;
with config.krebs.lib;
let
out = {
@ -51,6 +51,7 @@ let
source = config.krebs.build.source;
target-user = maybeEnv "target_user" "root";
target-host = maybeEnv "target_host" config.krebs.build.host.name;
target-port = maybeEnv "target_port" "22";
target-path = maybeEnv "target_path" "/var/src";
out = ''
#! /bin/sh
@ -62,7 +63,8 @@ let
}
echo ${shell.escape git-script} \
| ssh ${shell.escape "${target-user}@${target-host}"} -T
| ssh -p ${shell.escape target-port} \
${shell.escape "${target-user}@${target-host}"} -T
unset tmpdir
trap '
@ -93,6 +95,7 @@ let
(attrNames file-specs)} \
--delete \
-vFrlptD \
-e ${shell.escape "ssh -p ${target-port}"} \
${shell.escape target-path}/ \
${shell.escape "${target-user}@${target-host}:${target-path}"}
'';

View File

@ -1,6 +1,6 @@
{ config, pkgs, lib, ... }:
with lib;
with config.krebs.lib;
let
buildbot = pkgs.buildbot;
buildbot-master-config = pkgs.writeText "buildbot-master.cfg" ''
@ -381,5 +381,5 @@ let
in
{
options.krebs.buildbot.master = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
}

View File

@ -1,6 +1,6 @@
{ config, pkgs, lib, ... }:
with lib;
with config.krebs.lib;
let
buildbot-slave-init = pkgs.writeText "buildbot-slave.tac" ''
import os
@ -182,5 +182,5 @@ let
in
{
options.krebs.buildbot.slave = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
}

View File

@ -1,13 +1,13 @@
{ config, pkgs, lib, ... }:
with lib;
with config.krebs.lib;
let
cfg = config.krebs.current;
out = {
options.krebs.current = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
};
api = {

View File

@ -1,6 +1,6 @@
{ config, lib, ... }:
with lib;
with config.krebs.lib;
let
cfg = config.krebs;
@ -9,9 +9,9 @@ let
./apt-cacher-ng.nix
./backup.nix
./bepasty-server.nix
./build.nix
./buildbot/master.nix
./buildbot/slave.nix
./build.nix
./current.nix
./exim-retiolum.nix
./exim-smarthost.nix
@ -20,19 +20,21 @@ let
./git.nix
./go.nix
./iptables.nix
./lib.nix
./nginx.nix
./nixpkgs.nix
./per-user.nix
./Reaktor.nix
./retiolum-bootstrap.nix
./realwallpaper.nix
./retiolum-bootstrap.nix
./retiolum.nix
./setuid.nix
./tinc_graphs.nix
./urlwatch.nix
./repo-sync.nix
];
options.krebs = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
};
api = {
@ -83,13 +85,13 @@ let
};
};
imp = mkMerge [
{ krebs = import ./lass { inherit lib; }; }
{ krebs = import ./makefu { inherit lib; }; }
{ krebs = import ./miefda { inherit lib; }; }
{ krebs = import ./mv { inherit lib; }; }
{ krebs = import ./shared { inherit lib; }; }
{ krebs = import ./tv { inherit lib; }; }
imp = lib.mkMerge [
{ krebs = import ./lass { inherit config lib; }; }
{ krebs = import ./makefu { inherit config lib; }; }
{ krebs = import ./miefda { inherit config lib; }; }
{ krebs = import ./mv { inherit config lib; }; }
{ krebs = import ./shared { inherit config lib; }; }
{ krebs = import ./tv { inherit config lib; }; }
{
krebs.dns.providers = {
de.krebsco = "zones";

View File

@ -1,12 +1,12 @@
{ config, pkgs, lib, ... }:
with lib;
with config.krebs.lib;
let
cfg = config.krebs.exim-retiolum;
out = {
options.krebs.exim-retiolum = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
};
api = {

View File

@ -1,13 +1,12 @@
{ config, pkgs, lib, ... }:
with builtins;
with lib;
with config.krebs.lib;
let
cfg = config.krebs.exim-smarthost;
out = {
options.krebs.exim-smarthost = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
};
api = {

View File

@ -1,13 +1,13 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
cfg = config.krebs.fetchWallpaper;
out = {
options.krebs.fetchWallpaper = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
};
api = {

View File

@ -1,4 +1,4 @@
{ config, pkgs, lib, ... }:
{ config, lib, pkgs, ... }:
# TODO unify logging of shell scripts to user and journal
# TODO move all scripts to ${etcDir}, so ControlMaster connections
@ -6,13 +6,13 @@
# TODO when authorized_keys changes, then restart ssh
# (or kill already connected users somehow)
with lib;
with config.krebs.lib;
let
cfg = config.krebs.git;
out = {
options.krebs.git = api;
config = mkIf cfg.enable (mkMerge [
config = with lib; mkIf cfg.enable (mkMerge [
(mkIf cfg.cgit cgit-imp)
git-imp
]);
@ -86,7 +86,7 @@ let
singleton {
user = [ config.krebs.users.tv ];
repo = [ testing ]; # see literal example of repos
perm = push "refs/*" (with lib.git; [
perm = push "refs/*" (with config.krebs.lib.git; [
non-fast-forward create delete merge
]);
}

View File

@ -1,12 +1,12 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
cfg = config.krebs.github-hosts-sync;
out = {
options.krebs.github-hosts-sync = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
};
api = {

View File

@ -1,13 +1,13 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
cfg = config.krebs.go;
out = {
options.krebs.go = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
};
api = {

View File

@ -1,6 +1,6 @@
{ lib, ... }:
{ config, lib, ... }:
with lib;
with config.krebs.lib;
{
hosts = {

15
krebs/3modules/lib.nix Normal file
View File

@ -0,0 +1,15 @@
{ config, pkgs, lib, ... }:
with lib;
let
out = {
options.krebs.lib = api;
config = imp;
};
api = mkOption {
default = {};
type = types.attrs;
};
imp = {
krebs.lib = lib // import ../4lib { inherit lib; } // builtins;
};
in out

View File

@ -1,6 +1,6 @@
{ lib, ... }:
{ config, lib, ... }:
with lib;
with config.krebs.lib;
{
hosts = {
@ -292,8 +292,8 @@ with lib;
cores = 1;
nets = {
retiolm = {
addrs4 = ["10.243.214.15/32"];
addrs6 = ["42:5a02:2c30:c1b1:3f2e:7c19:2496:a732/128"];
addrs4 = ["10.243.214.15"];
addrs6 = ["42:5a02:2c30:c1b1:3f2e:7c19:2496:a732"];
aliases = [
"wbob.retiolum"
];

View File

@ -1,6 +1,6 @@
{ lib, ... }:
{ config, lib, ... }:
with lib;
with config.krebs.lib;
{
hosts = {

View File

@ -1,6 +1,6 @@
{ lib, ... }:
{ config, ... }:
with lib;
with config.krebs.lib;
{
hosts = {

View File

@ -1,13 +1,12 @@
{ config, pkgs, lib, ... }:
{ config, lib, pkgs, ... }:
with builtins;
with lib;
with config.krebs.lib;
let
cfg = config.krebs.nginx;
out = {
options.krebs.nginx = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
};
api = {
@ -34,6 +33,7 @@ let
};
locations = mkOption {
type = with types; listOf (attrsOf str);
default = [];
};
extraConfig = mkOption {
type = with types; string;
@ -76,8 +76,8 @@ let
server {
${concatMapStringsSep "\n" (x: "listen ${x};") listen}
server_name ${toString server-names};
${extraConfig}
${indent (concatStrings (map to-location locations))}
${indent extraConfig}
${indent (concatMapStrings to-location locations)}
}
'';

View File

@ -1,11 +1,11 @@
{ config, pkgs, lib, ... }:
with lib;
{ config, lib, pkgs, ... }:
with config.krebs.lib;
let
cfg = config.krebs.nixpkgs;
out = {
options.krebs.nixpkgs = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
};
api = {
@ -37,7 +37,7 @@ let
};
};
imp = mkIf (cfg.allowUnfreePredicate != null) {
imp = lib.mkIf (cfg.allowUnfreePredicate != null) {
nixpkgs.config.allowUnfreePredicate = cfg.allowUnfreePredicate;
};
in out

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
cfg = config.krebs.per-user;

View File

@ -1,12 +1,12 @@
arg@{ config, lib, pkgs, ... }:
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
cfg = config.krebs.realwallpaper;
out = {
options.krebs.realwallpaper = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
};
api = {

View File

@ -1,12 +1,12 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
cfg = config.krebs.retiolum-bootstrap;
out = {
options.krebs.retiolum-bootstrap = api;
config = mkIf cfg.enable imp ;
config = lib.mkIf cfg.enable imp;
};
api = {

View File

@ -1,11 +1,11 @@
{ config, pkgs, lib, ... }:
with lib;
with config.krebs.lib;
let
cfg = config.krebs.retiolum;
out = {
options.krebs.retiolum = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
};
api = {

75
krebs/3modules/setuid.nix Normal file
View File

@ -0,0 +1,75 @@
{ config, pkgs, lib, ... }:
with config.krebs.lib;
let
cfg = config.krebs.setuid;
out = {
options.krebs.setuid = api;
config = imp;
};
api = mkOption {
default = {};
type = let
# TODO make wrapperDir configurable
inherit (config.security) wrapperDir;
inherit (config.users) groups users;
in types.attrsOf (types.submodule ({ config, ... }: {
options = {
name = mkOption {
type = types.filename;
default = config._module.args.name;
};
filename = mkOption {
type = mkOptionType {
# TODO unyuck string and merge with toC
name = "derivation or string";
check = x:
isDerivation x ||
isString x;
};
apply = toString;
};
owner = mkOption {
default = "root";
type = types.enum (attrNames users);
};
group = mkOption {
default = "root";
type = types.enum (attrNames groups);
};
mode = mkOption {
default = "4710";
type = mkOptionType {
# TODO admit symbolic mode
name = "octal mode";
check = x:
isString x &&
match "[0-7][0-7][0-7][0-7]" x != null;
};
};
activate = mkOption {
type = types.str;
visible = false;
readOnly = true;
};
};
config.activate = let
src = pkgs.execve config.name {
inherit (config) filename;
};
dst = "${wrapperDir}/${config.name}";
in ''
cp ${src} ${dst}
chown ${config.owner}.${config.group} ${dst}
chmod ${config.mode} ${dst}
'';
}));
};
imp = {
system.activationScripts."krebs.setuid" = stringAfter [ "setuid" ]
(concatMapStringsSep "\n" (getAttr "activate") (attrValues cfg));
};
in out

View File

@ -1,9 +1,8 @@
{ lib, ... }:
with lib;
{ config, ... }:
with config.krebs.lib;
let
testHosts = lib.genAttrs [
testHosts = genAttrs [
"test-arch"
"test-centos6"
"test-centos7"

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
cfg = config.krebs.tinc_graphs;
internal_dir = "${cfg.workingDir}/internal";
@ -8,7 +8,7 @@ let
out = {
options.krebs.tinc_graphs = api;
config = mkIf cfg.enable imp ;
config = lib.mkIf cfg.enable imp ;
};
api = {

View File

@ -1,6 +1,6 @@
{ lib, ... }:
{ config, ... }:
with lib;
with config.krebs.lib;
{
dns.providers = {

View File

@ -5,14 +5,14 @@
# cache = url: "${cfg.dataDir}/.urlwatch/cache/${hashString "sha1" url}"
# TODO hooks.py
with lib;
with config.krebs.lib;
let
cfg = config.krebs.urlwatch;
# TODO assert sendmail's existence
out = {
options.krebs.urlwatch = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
};
api = {

View File

@ -26,11 +26,15 @@ let out = rec {
shell = import ./shell.nix { inherit lib; };
tree = import ./tree.nix { inherit lib; };
toC = x: {
toC = x: let
type = typeOf x;
reject = throw "cannot convert ${type}";
in {
list = "{ ${concatStringsSep ", " (map toC x)} }";
null = "NULL";
set = if isDerivation x then toJSON x else reject;
string = toJSON x; # close enough
}.${typeOf x};
}.${type} or reject;
subdirsOf = path:
mapAttrs (name: _: path + "/${name}")

View File

@ -1,50 +0,0 @@
#! /bin/sh
set -efu
nix_url=https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-linux.tar.bz2
nix_sha256=504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4
install_nix() {(
# install nix on host (cf. https://nixos.org/nix/install)
if ! test -e /root/.nix-profile/etc/profile.d/nix.sh; then
(
verify() {
printf '%s %s\n' $nix_sha256 $(basename $nix_url) | sha256sum -c
}
if ! verify; then
curl -C - -O "$nix_url"
verify
fi
)
nix_src_dir=$(basename $nix_url .tar.bz2)
tar jxf $nix_src_dir.tar.bz2
$nix_src_dir/install
fi
. /root/.nix-profile/etc/profile.d/nix.sh
for i in \
bash \
coreutils \
# This line intentionally left blank.
do
if ! nix-env -q $i | grep -q .; then
nix-env -iA nixpkgs.pkgs.$i
fi
done
# install nixos-install
if ! type nixos-install 2>/dev/null; then
nixpkgs_expr='import <nixpkgs> { system = builtins.currentSystem; }'
nixpkgs_path=$(find /nix/store -mindepth 1 -maxdepth 1 -name *-nixpkgs-* -type d)
nix-env \
--arg config "{ nix.package = ($nixpkgs_expr).nix; }" \
--arg pkgs "$nixpkgs_expr" \
--arg modulesPath 'throw "no modulesPath"' \
-f $nixpkgs_path/nixpkgs/nixos/modules/installer/tools/tools.nix \
-iA config.system.build.nixos-install
fi
)}
install_nix "$@"

View File

@ -1,6 +1,9 @@
#! /bin/sh
set -efu
nix_url=https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-linux.tar.bz2
nix_sha256=504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4
prepare() {(
if test -e /etc/os-release; then
. /etc/os-release
@ -33,6 +36,13 @@ prepare() {(
;;
esac
;;
nixos)
case $(cat /proc/cmdline) in
*' root=LABEL=NIXOS_ISO '*)
prepare_nixos_iso "$@"
exit
esac
;;
esac
elif test -e /etc/centos-release; then
case $(cat /etc/centos-release) in
@ -70,7 +80,25 @@ prepare_debian() {
prepare_common
}
prepare_common() {
prepare_nixos_iso() {
mountpoint /mnt
type git 2>/dev/null || nix-env -iA nixos.git
mkdir -p /mnt/"$target_path"
mkdir -p "$target_path"
if ! mountpoint "$target_path"; then
mount --rbind /mnt/"$target_path" "$target_path"
fi
mkdir -p bin
rm -f bin/nixos-install
cp "$(type -p nixos-install)" bin/nixos-install
sed -i "s@^NIX_PATH=\"[^\"]*\"@NIX_PATH=$target_path@" bin/nixos-install
}
prepare_common() {(
if ! getent group nixbld >/dev/null; then
groupadd -g 30000 -r nixbld
@ -133,6 +161,50 @@ prepare_common() {
mkdir -p /mnt/nix
mount --bind /nix /mnt/nix
fi
#
# install nix
#
# install nix on host (cf. https://nixos.org/nix/install)
if ! test -e /root/.nix-profile/etc/profile.d/nix.sh; then
(
verify() {
printf '%s %s\n' $nix_sha256 $(basename $nix_url) | sha256sum -c
}
if ! verify; then
curl -C - -O "$nix_url"
verify
fi
)
nix_src_dir=$(basename $nix_url .tar.bz2)
tar jxf $nix_src_dir.tar.bz2
$nix_src_dir/install
fi
. /root/.nix-profile/etc/profile.d/nix.sh
for i in \
bash \
coreutils \
# This line intentionally left blank.
do
if ! nix-env -q $i | grep -q .; then
nix-env -iA nixpkgs.pkgs.$i
fi
done
# install nixos-install
if ! type nixos-install 2>/dev/null; then
nixpkgs_expr='import <nixpkgs> { system = builtins.currentSystem; }'
nixpkgs_path=$(find /nix/store -mindepth 1 -maxdepth 1 -name *-nixpkgs-* -type d)
nix-env \
--arg config "{ nix.package = ($nixpkgs_expr).nix; }" \
--arg pkgs "$nixpkgs_expr" \
--arg modulesPath 'throw "no modulesPath"' \
-f $nixpkgs_path/nixpkgs/nixos/modules/installer/tools/tools.nix \
-iA config.system.build.nixos-install
fi
)}
prepare "$@"

View File

@ -17,6 +17,7 @@ types // rec {
};
nets = mkOption {
type = attrsOf net;
default = {};
};
extraZones = mkOption {

View File

@ -1,15 +1,26 @@
{ lib, pkgs, ... }:
with lib;
{
execve = name: { filename, argv, envp ? {}, destination ? "" }:
writeC name { inherit destination; } ''
{ config, lib, pkgs, ... }:
with config.krebs.lib;
rec {
execve = name: { filename, argv ? null, envp ? {}, destination ? "" }: let
in writeC name { inherit destination; } ''
#include <unistd.h>
int main () {
const char *filename = ${toC filename};
char *const argv[] = ${toC (argv ++ [null])};
char *const envp[] = ${toC (
static char *const filename = ${toC filename};
${if argv == null
then /* Propagate arguments */ ''
#define MAIN_ARGS int argc, char **argv
''
else /* Provide fixed arguments */ ''
#define MAIN_ARGS void
static char *const argv[] = ${toC (argv ++ [null])};
''}
static char *const envp[] = ${toC (
mapAttrsToList (k: v: "${k}=${v}") envp ++ [null]
)};
int main (MAIN_ARGS) {
execve(filename, argv, envp);
return -1;
}

View File

@ -1,5 +1,5 @@
{ lib, pkgs, ... }@args:
with lib;
{ config, lib, pkgs, ... }@args:
with config.krebs.lib;
{
nixpkgs.config.packageOverrides = pkgs: {
haskellPackages = pkgs.haskellPackages.override {

View File

@ -0,0 +1,21 @@
{ fetchgit, lib, stdenv, ... }:
with builtins;
with lib;
stdenv.mkDerivation rec {
name = "${baseNameOf src.name}-${removePrefix "refs/tags/v" src.rev}";
src = fetchgit {
url = https://github.com/kanaka/noVNC;
rev = "refs/tags/v0.5.1";
sha256 = "1azsnppwnrsv3axj0r5bw8lfarkibgz5vhgcyj8dzn4afn98f55w";
};
phases = [
"unpackPhase"
"installPhase"
];
installPhase = ''
cp -R . $out
'';
}

View File

@ -0,0 +1,20 @@
{ lib, pythonPackages, fetchurl, ... }:
with pythonPackages; buildPythonPackage rec {
name = lib.removeSuffix ".tar.gz" (builtins.baseNameOf src.name);
src = fetchurl {
url = https://pypi.python.org/packages/source/v/vncdotool/vncdotool-0.9.0.tar.gz;
sha256 = "1hl44w4x9c8air0g6kp9h1af2vj4lmc50vnsxmca9g080740iyvi";
};
propagatedBuildInputs = [
twisted
pillow
];
meta = {
homepage = https://github.com/sibson/vncdotool;
description = "A command line VNC client and python library";
license = lib.licenses.mit;
};
}

View File

@ -1,193 +1,8 @@
assert false;
{ current-host-name
, current-user-name
, lib
, stockholm
, StrictHostKeyChecking ? "yes"
}:
let out = {
inherit infest;
inherit init;
inherit nixos-install;
};
infest =
{ system ? current-host-name
, target ? system
}@args: let
config = get-config system;
in ''
#! /bin/sh
# krebs.infest
set -efu
${rootssh target ''
${builtins.readFile ./4lib/infest/prepare.sh}
${builtins.readFile ./4lib/infest/install-nix.sh}
''}
(${nixos-install args})
${rootssh target ''
${builtins.readFile ./4lib/infest/finalize.sh}
''}
'';
init =
{ system ? current-host-name
}@args: let
config = get-config system;
in ''
#! /bin/sh
# krebs.init
set -efu
system=${lib.shell.escape system}
secrets_dir=${config.krebs.build.source.dir.secrets.path}
key_type=ed25519
key_file=$secrets_dir/ssh.id_$key_type
key_comment=$system
if test -e "$key_file"; then
echo "Warning: privkey already exists: $key_file" >&2
else
ssh-keygen \
-C "$key_comment" \
-t "$key_type" \
-f "$key_file" \
-N ""
rm "$key_file.pub"
fi
pubkey=$(ssh-keygen -y -f "$key_file")
cat<<EOF
# put following into config.krebs.hosts.$system:
ssh.privkey.path = <secrets/ssh.$key_type>;
ssh.pubkey = $(echo $pubkey | jq -R .);
EOF
'';
nixos-install =
{ system ? current-host-name
, target ? system
}@args: let
in ''
#! /bin/sh
# krebs.nixos-install
(${populate (args // { root = "/mnt"; })})
${rootssh target ''
export PATH; PATH=/root/.nix-profile/bin:$PATH
src=$(type -p nixos-install)
cat_src() {
sed < "$src" "$(
{ sed < "$src" -n '
/^if ! test -e "\$mountPoint\/\$NIXOS_CONFIG/,/^fi$/=
/^nixpkgs=/=
/^NIX_PATH=/,/^$/{/./=}
# Disable: Copy the NixOS/Nixpkgs sources to the target as
# the initial contents of the NixOS channel.
/^srcs=/,/^ln -sfn /=
'
} | sed 's:$:s/^/#krebs#/:'
)"
}
# Location to insert `nix-install`
i=$(sed -n '/^echo "building the system configuration/=' "$src")
{ config, lib, pkgs, ... }:
with config.krebs.lib;
{
cat_src | sed -n "1,$i{p}"
cat ${doc (nix-install args)}
cat_src | sed -n "$i,\''${$i!p}"
} > nixos-install
chmod +x nixos-install
# Wrap inserted nix-install into chroot.
nix_env=$(cat_src | sed -n '
s:.*\(/nix/store/[a-z0-9]*-nix-[0-9.]\+/bin/nix-env\).*:\1:p;T;q
')
echo "nix-env is $nix_env" >&2
findpkg() {(
name=$1
path=$(find /nix/store \
-mindepth 1 -maxdepth 1 -type d -name '*-'"$name"'-*' \
| head -n 1 | sed s:^/mnt::)
if echo "$path" | grep .; then
echo "$name is $path" >&2
else
echo "Error: package not found: $name" >&2
exit 1
fi
)}
cacert=$(findpkg cacert)
coreutils=$(findpkg coreutils)
cp "$cacert"/etc/ssl/certs/ca-bundle.crt /mnt/root/SSL_CERT_FILE
env="$coreutils/bin/env SSL_CERT_FILE=/root/SSL_CERT_FILE"
sed -i '
s:^NIX_PATH=:chroot $mountPoint '"$env"' &:
s:^nix-env:'"$nix_env"':
' nixos-install
./nixos-install
''}
'';
doc = s:
let b = "EOF${builtins.hashString "sha256" s}"; in
''
<<\${b}
${s}
${b}
'';
get-config = system: let
config = stockholm.users.${current-user-name}.${system}.config
or (abort "unknown system: ${system}, user: ${current-user-name}");
in config;
nix-install =
{ system ? current-host-name
, target ? system
}:
let
config = get-config system;
nix-path =
lib.concatStringsSep ":"
(lib.mapAttrsToList (name: src: "${name}=${src.target-path}")
(config.krebs.build.source.dir //
config.krebs.build.source.git));
in ''
set -efu
NIX_PATH=${lib.shell.escape nix-path} \
nix-env \
--show-trace \
-f '<stockholm>' \
--argstr current-host-name ${lib.shell.escape current-host-name} \
--argstr current-user-name ${lib.shell.escape current-user-name} \
--profile ${lib.shell.escape config.krebs.build.profile} \
--set \
-A ${lib.escapeShellArg (lib.concatStringsSep "." [
"users"
config.krebs.build.user.name
config.krebs.build.host.name
"system"
])}
'';
rootssh = target: script:
let
flags = "-o StrictHostKeyChecking=${StrictHostKeyChecking}";
in
"ssh ${flags} root@${target} -T ${doc ''
set -efu
${script}
''}";
in out
imports = [
./3modules
./5pkgs
];
}

View File

@ -7,6 +7,7 @@ let
ip = (head config.krebs.build.host.nets.internet.addrs4);
in {
imports = [
../.
../2configs/os-templates/CAC-CentOS-7-64bit.nix
../2configs/base.nix
../2configs/retiolum.nix

View File

@ -2,6 +2,7 @@
{
imports = [
../.
<nixpkgs/nixos/modules/profiles/qemu-guest.nix>
../2configs/base.nix
../2configs/git.nix

View File

@ -7,6 +7,7 @@ let
ip = (head config.krebs.build.host.nets.internet.addrs4);
in {
imports = [
../.
../2configs/os-templates/CAC-CentOS-7-64bit.nix
../2configs/base.nix
../2configs/retiolum.nix

View File

@ -3,6 +3,7 @@
with builtins;
{
imports = [
../.
../2configs/baseX.nix
../2configs/browsers.nix
../2configs/programs.nix

View File

@ -2,6 +2,7 @@
{
imports = [
../.
../2configs/baseX.nix
../2configs/programs.nix
../2configs/bitcoin.nix

View File

@ -6,6 +6,7 @@ let
ip = (head config.krebs.build.host.nets.internet.addrs4);
in {
imports = [
../.
../2configs/base.nix
../2configs/downloading.nix
../2configs/git.nix

View File

@ -3,6 +3,7 @@
with builtins;
{
imports = [
../.
../2configs/baseX.nix
../2configs/browsers.nix
../2configs/games.nix

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
{
imports = [
../2configs/vim.nix
@ -50,12 +50,10 @@ with lib;
user = config.krebs.users.lass;
source = mapAttrs (_: mkDefault) ({
nixos-config = "symlink:stockholm/lass/1systems/${config.krebs.build.host.name}.nix";
nixpkgs = symlink:stockholm/nixpkgs;
secrets = "/home/lass/secrets/${config.krebs.build.host.name}";
#secrets-common = "/home/lass/secrets/common";
stockholm = "/home/lass/stockholm";
stockholm-user = "symlink:stockholm/lass";
upstream-nixpkgs = {
nixpkgs = {
url = https://github.com/Lassulus/nixpkgs;
rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce";
dev = "/home/lass/src/nixpkgs";

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
rpc-password = import <secrets/transmission-pw.nix>;

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
createStaticPage = domain:

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
{
environment.systemPackages = [
pkgs.go

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
{
services.teamviewer.enable = true;
}

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
pkgs.writeText "Xresources" ''
URxvt*scrollBar: false

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }@args:
with lib;
with config.krebs.lib;
let
# TODO krebs.build.user

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
cfg = config.services.xserver;

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
cfg = config.lass.owncloud;

View File

@ -1,7 +1,6 @@
{ config, lib, pkgs, ... }:
with builtins;
with lib;
with config.krebs.lib;
let
cfg = config.lass.per-user;

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
cfg = config.lass.staticPage;

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
cfg = config.lass.wordpress;

7
lass/default.nix Normal file
View File

@ -0,0 +1,7 @@
_:
{
imports = [
../krebs
./3modules
];
}

View File

@ -11,6 +11,7 @@ let
in {
imports =
[ # Include the results of the hardware scan.
../.
../2configs/fs/single-partition-ext4.nix
../2configs/tinc-basic-retiolum.nix
../2configs/smart-monitor.nix

View File

@ -1,11 +1,12 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
external-ip = head config.krebs.build.host.nets.internet.addrs4;
internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
in {
imports = [
../.
../2configs/tinc-basic-retiolum.nix
../2configs/headless.nix
../2configs/fs/simple-swap.nix

View File

@ -20,6 +20,7 @@ let
in {
imports =
[
../.
# TODO: unlock home partition via ssh
../2configs/fs/single-partition-ext4.nix
../2configs/tinc-basic-retiolum.nix

View File

@ -6,6 +6,7 @@
{
imports =
[
../.
../2configs/tinc-basic-retiolum.nix
../2configs/headless.nix
../../krebs/3modules/Reaktor.nix

View File

@ -6,6 +6,7 @@
{
imports =
[ # Include the results of the hardware scan.
../.
../2configs/main-laptop.nix #< base-gui + zsh
# Krebs

View File

@ -7,8 +7,9 @@
{
imports =
[ # Include the results of the hardware scan.
../.
<nixpkgs/nixos/modules/profiles/qemu-guest.nix>
../2configs/cgit-retiolum.nix
../2configs/git/cgit-retiolum.nix
];
krebs.build.host = config.krebs.hosts.repunit;

View File

@ -6,6 +6,7 @@
{
imports =
[ # Include the results of the hardware scan.
../.
../2configs/base-gui.nix
../2configs/tinc-basic-retiolum.nix
../2configs/fs/sda-crypto-root.nix

View File

@ -6,6 +6,7 @@
krebs.build.host = config.krebs.hosts.vbob;
imports =
[ # Include the results of the hardware scan.
../.
<nixpkgs/nixos/modules/virtualisation/virtualbox-image.nix>
../2configs/main-laptop.nix #< base-gui

View File

@ -2,6 +2,7 @@
{
imports =
[ # Include the results of the hardware scan.
../.
../2configs/main-laptop.nix
];
krebs = {

View File

@ -1,12 +1,13 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
external-ip = head config.krebs.build.host.nets.internet.addrs4;
internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
in {
imports = [
../.
# TODO: copy this config or move to krebs
../../tv/2configs/hw/CAC.nix
../../tv/2configs/fs/CAC-CentOS-7-64bit.nix

View File

@ -1,5 +1,5 @@
{ config, lib, ... }:
with lib;
with config.krebs.lib;
let
startAt = "0,6,12,18:00";
defaultBackupServer = config.krebs.hosts.omo;

View File

@ -21,7 +21,7 @@
# URxvt.visualBell: false
# URxvt.font : xft:Terminus
with lib;
with config.krebs.lib;
let
mainUser = config.krebs.build.user.name;
awesomecfg = pkgs.awesomecfg.full;

View File

@ -10,7 +10,7 @@
# wildcard.krebsco.de.key
# bepasty-secret.nix <- contains single string
with lib;
with config.krebs.lib;
let
sec = toString <secrets>;
# secKey is nothing worth protecting on a local machine

View File

@ -2,7 +2,7 @@
# graphite-web on port 8080
# carbon cache on port 2003 (tcp/udp)
with lib;
with config.krebs.lib;
let
connect-time-cfg = with pkgs; writeText "collectd-connect-time.cfg" ''
LoadPlugin python

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
{
system.stateVersion = "15.09";
@ -20,7 +20,7 @@ with lib;
build = {
user = config.krebs.users.makefu;
source = mapAttrs (_: mkDefault) {
upstream-nixpkgs = {
nixpkgs = {
url = https://github.com/nixos/nixpkgs;
rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; # unstable @ 2015-01-27, tested on wry
};
@ -29,8 +29,6 @@ with lib;
# Defaults for all stockholm users?
nixos-config = "symlink:stockholm/${config.krebs.build.user.name}/1systems/${config.krebs.build.host.name}.nix";
nixpkgs = symlink:stockholm/nixpkgs;
stockholm-user = "symlink:stockholm/${config.krebs.build.user.name}";
};
};
};

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
{
krebs.exim-retiolum.enable = true;
environment.systemPackages = with pkgs; [

View File

@ -1,7 +1,7 @@
{ config, lib, pkgs, ... }:
# vda1 ext4 (label nixos) -> only root partition
with lib;
with config.krebs.lib;
{
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;

View File

@ -8,7 +8,7 @@
# / (main-root)
# /home (main-home)
with lib;
with config.krebs.lib;
{
imports = [

View File

@ -3,7 +3,7 @@
# sda: bootloader grub2
# sda1: boot ext4 (label nixboot)
# sda2: cryptoluks -> ext4
with lib;
with config.krebs.lib;
{
boot = {
loader.grub.enable = true;

View File

@ -1,7 +1,7 @@
{ config, lib, pkgs, ... }:
# vda1 ext4 (label nixos) -> only root partition
with lib;
with config.krebs.lib;
{
imports = [
./single-partition-ext4.nix

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
# TODO: remove tv lib :)
with lib;
with config.krebs.lib;
let
repos = priv-repos // krebs-repos ;

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
# TODO: remove tv lib :)
with lib;
with config.krebs.lib;
let
repos = priv-repos // krebs-repos // connector-repos ;

View File

@ -2,7 +2,7 @@
# graphite-web on port 8080
# carbon cache on port 2003 (tcp/udp)
with lib;
with config.krebs.lib;
{
imports = [ ];

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
{
imports = [ ./tp-x2x0.nix ];

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
{
imports = [ ./tp-x2x0.nix ];

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
{
# TODO: put this somewhere else
networking.wireless.enable = true;

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
{
environment.systemPackages = with pkgs; [
msmtp

View File

@ -5,7 +5,7 @@
# not fit into base-gui
# TODO split generic desktop stuff and laptop-specifics like lidswitching
with lib;
with config.krebs.lib;
{
imports = [
./base-gui.nix

View File

@ -1,6 +1,6 @@
{config, lib, ...}:
with lib;
with config.krebs.lib;
let
sec = toString <secrets>;
ssl_cert = "${sec}/wildcard.krebsco.de.crt";

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
sec = toString <secrets>;
ssl_cert = "${sec}/wildcard.krebsco.de.crt";

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
hostname = config.krebs.build.host.name;
user = config.services.nginx.user;

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
sec = toString <secrets>;
ssl_cert = "${sec}/wildcard.krebsco.de.crt";

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
hostname = config.krebs.build.host.name;
external-ip = head config.krebs.build.host.nets.internet.addrs4;

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
hostname = config.krebs.build.host.name;
# TODO local-ip from the nets config

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
{
krebs.retiolum = {
enable = true;

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
##
with lib;
with config.krebs.lib;
let
mainUser = config.krebs.build.user.name;
in

View File

@ -1,6 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
with config.krebs.lib;
let
# returns dirname without / , used as disk name
@ -28,7 +28,7 @@ let
out = {
options.makefu.snapraid = api;
config = mkIf cfg.enable imp;
config = lib.mkIf cfg.enable imp;
};
api = {

Some files were not shown because too many files have changed in this diff Show More