Merge remote-tracking branch 'cd/master'

Makefile

@@ -4,14 +4,16 @@ endif
 
 export target_host ?= $(system)
 export target_user ?= root
+export target_port ?= 22
 export target_path ?= /var/src
 
 evaluate = \
 	nix-instantiate \
-		--arg configuration ./$(LOGNAME)/1systems/$(system).nix \
 		--eval \
 		--readonly-mode \
 		--show-trace \
+		-I nixos-config=./$(LOGNAME)/1systems/$(system).nix \
+		-I stockholm=. \
 		$(1)
 
 execute = \
@@ -22,19 +24,20 @@ execute = \
 # usage: make deploy system=foo [target_host=bar]
 deploy:
 	$(call execute,populate)
-	ssh $(target_user)@$(target_host) nixos-rebuild switch -I $(target_path)
+	ssh $(target_user)@$(target_host) -p $(target_port) \
+		nixos-rebuild switch --show-trace -I $(target_path)
 
 # usage: make LOGNAME=shared system=wolf eval.config.krebs.build.host.name
 eval eval.:;@$(call evaluate)
 eval.%:;@$(call evaluate,-A $*)
 
 # usage: make install system=foo [target_host=bar]
-install: ssh = ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
+install: ssh ?= ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
 install:
-	$(ssh) $(target_user)@$(target_host) \
+	$(ssh) $(target_user)@$(target_host) -p $(target_port) \
 		env target_path=$(target_path) \
 			sh -s prepare < krebs/4lib/infest/prepare.sh
 	target_path=/mnt$(target_path) $(call execute,populate)
-	$(ssh) $(target_user)@$(target_host) \
+	$(ssh) $(target_user)@$(target_host) -p $(target_port) \
 		env NIXOS_CONFIG=$(target_path)/nixos-config \
 			nixos-install

default.nix

@@ -1,84 +1,5 @@
-{ configuration ? import (nixpkgs-path + "/nixos/lib/from-env.nix") "NIXOS_CONFIG" <nixos-config>
-, system ? builtins.currentSystem
-, current-host-name ?
-    let v = builtins.getEnv "HOSTNAME"; in
-    if v != "" then v else builtins.readFile /proc/sys/kernel/hostname
-, current-user-name ?
-    let v = builtins.getEnv "LOGNAME"; in
-    if v != "" then v else abort "undefined variable: LOGNAME"
-, nixpkgs-path ?
-    if (builtins.tryEval <nixpkgs/krebs>).success
-      then <upstream-nixpkgs>
-      else <nixpkgs>
-, StrictHostKeyChecking ? "yes"
-}@args:
-
-let stockholm = {
-    inherit krebs;
-    inherit users;
-    inherit lib;
-    inherit config options pkgs;
-    system = config.system.build.toplevel;
-  };
-
-  krebs = import ./krebs (args // { inherit lib stockholm; });
-
-  lib = let
-    nlib = import (slib.npath "lib");
-    klib = import (slib.kpath "4lib") { lib = nlib; };
-    slib = rec {
-      nspath = ns: p: ./. + "/${ns}/${p}";
-      npath = p: nixpkgs-path + "/${p}";
-      kpath = nspath "krebs";
-      upath = nspath current-user-name;
-    };
-    ulib = let p = slib.upath "4lib"; in
-      nlib.optionalAttrs (klib.dir.has-default-nix p)
-                         (import p { lib = nlib // klib; });
-  in nlib // klib // slib // ulib // builtins;
-
-  inherit (eval configuration) config options pkgs;
-
-  base-module = { config, ... }: {
-    imports = builtins.filter lib.dir.has-default-nix (lib.concatLists [
-      (map (f: f "2configs") [ lib.upath ])
-      (map (f: f "3modules") [ lib.kpath lib.upath ])
-      (map (f: f "5pkgs") [ lib.kpath lib.upath ])
-    ]);
-
-    krebs.current.enable = true;
-    krebs.current.host = config.krebs.hosts.${current-host-name};
-    krebs.current.user = config.krebs.users.${current-user-name};
-  };
-
-  eval = config: import (lib.npath "nixos/lib/eval-config.nix") {
-    inherit system;
-    specialArgs = {
-      inherit lib;
-    };
+import <nixpkgs/nixos/lib/eval-config.nix> {
   modules = [
-      base-module
-      config
+    (import <nixpkgs/nixos/lib/from-env.nix> "NIXOS_CONFIG" <nixos-config>)
   ];
-  };
-
-  # TODO move user namespaces' to users/, so no exception for krebs/ is needed
-  users =
-    lib.mapAttrs
-      (name: _: eval-all-systems (lib.nspath name "1systems"))
-      (lib.filterAttrs
-        (n: t: !lib.hasPrefix "." n && t == "directory" && n != "krebs")
-        (builtins.readDir ./.));
-
-  eval-all-systems = path:
-    lib.mapAttrs'
-      (n: _: (lib.nameValuePair (lib.removeSuffix ".nix" n)
-                                (eval-system (path + "/${n}"))))
-      (builtins.readDir path);
-
-  eval-system = path: rec {
-    inherit (eval path) config options;
-    system = config.system.build.toplevel;
-  };
-
-in stockholm
+}

krebs/3modules/Reaktor.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
 
   ReaktorConfig = pkgs.writeText "config.py" ''
@@ -16,7 +16,7 @@ let
 
   out = {
     options.krebs.Reaktor = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {

krebs/3modules/apt-cacher-ng.nix

@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   acng-config = pkgs.writeTextFile {
     name = "acng-configuration";
@@ -151,5 +151,5 @@ let
 in
 {
   options.krebs.apt-cacher-ng = api;
-  config = mkIf cfg.enable imp;
+  config = lib.mkIf cfg.enable imp;
 }

krebs/3modules/backup.nix

@@ -1,9 +1,9 @@
 { config, lib, pkgs, ... }:
-with lib;
+with config.krebs.lib;
 let
   out = {
     options.krebs.backup = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   cfg = config.krebs.backup;
@@ -210,7 +210,7 @@ let
       | ${pkgs.coreutils}/bin/head -1; }
   '';
 
-  # Note that we don't escape word on purpose, so we deref shell vars.
+  # Note that we don't escape word on purpose, so we can deref shell vars.
   # TODO type word
   network-ssh-port = host: word: ''
     case ${word} in

krebs/3modules/bepasty-server.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   gunicorn = pkgs.pythonPackages.gunicorn;
   bepasty = pkgs.pythonPackages.bepasty-server;
@@ -10,8 +10,8 @@ let
 
   out = {
     options.krebs.bepasty = api;
-    config = mkIf cfg.enable (mkMerge [
-      (mkIf cfg.serveNginx nginx-imp)
+    config = lib.mkIf cfg.enable (lib.mkMerge [
+      (lib.mkIf cfg.serveNginx nginx-imp)
       imp
     ]);
   };

krebs/3modules/build.nix

@@ -1,6 +1,6 @@
 { config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   out = {
@@ -51,6 +51,7 @@ let
         source = config.krebs.build.source;
         target-user = maybeEnv "target_user" "root";
         target-host = maybeEnv "target_host" config.krebs.build.host.name;
+        target-port = maybeEnv "target_port" "22";
         target-path = maybeEnv "target_path" "/var/src";
         out = ''
           #! /bin/sh
@@ -62,7 +63,8 @@ let
           }
 
           echo ${shell.escape git-script} \
-            | ssh ${shell.escape "${target-user}@${target-host}"} -T
+            | ssh -p ${shell.escape target-port} \
+                  ${shell.escape "${target-user}@${target-host}"} -T
 
           unset tmpdir
           trap '
@@ -93,6 +95,7 @@ let
                     (attrNames file-specs)} \
                   --delete \
                   -vFrlptD \
+                  -e ${shell.escape "ssh -p ${target-port}"} \
                   ${shell.escape target-path}/ \
                   ${shell.escape "${target-user}@${target-host}:${target-path}"}
         '';

krebs/3modules/buildbot/master.nix

@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   buildbot = pkgs.buildbot;
   buildbot-master-config = pkgs.writeText "buildbot-master.cfg" ''
@@ -381,5 +381,5 @@ let
 in
 {
   options.krebs.buildbot.master = api;
-  config = mkIf cfg.enable imp;
+  config = lib.mkIf cfg.enable imp;
 }

krebs/3modules/buildbot/slave.nix

@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   buildbot-slave-init = pkgs.writeText "buildbot-slave.tac" ''
     import os
@@ -182,5 +182,5 @@ let
 in
 {
   options.krebs.buildbot.slave = api;
-  config = mkIf cfg.enable imp;
+  config = lib.mkIf cfg.enable imp;
 }

krebs/3modules/current.nix

@@ -1,13 +1,13 @@
 { config, pkgs, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.krebs.current;
 
   out = {
     options.krebs.current = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {

krebs/3modules/default.nix

@@ -1,6 +1,6 @@
 { config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs;
 
@@ -9,9 +9,9 @@ let
       ./apt-cacher-ng.nix
       ./backup.nix
       ./bepasty-server.nix
-      ./build.nix
       ./buildbot/master.nix
       ./buildbot/slave.nix
+      ./build.nix
       ./current.nix
       ./exim-retiolum.nix
       ./exim-smarthost.nix
@@ -20,19 +20,21 @@ let
       ./git.nix
       ./go.nix
       ./iptables.nix
+      ./lib.nix
       ./nginx.nix
       ./nixpkgs.nix
       ./per-user.nix
       ./Reaktor.nix
-      ./retiolum-bootstrap.nix
       ./realwallpaper.nix
+      ./retiolum-bootstrap.nix
       ./retiolum.nix
+      ./setuid.nix
       ./tinc_graphs.nix
       ./urlwatch.nix
       ./repo-sync.nix
     ];
     options.krebs = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
@@ -83,13 +85,13 @@ let
     };
   };
 
-  imp = mkMerge [
-    { krebs = import ./lass { inherit lib; }; }
-    { krebs = import ./makefu { inherit lib; }; }
-    { krebs = import ./miefda { inherit lib; }; }
-    { krebs = import ./mv { inherit lib; }; }
-    { krebs = import ./shared { inherit lib; }; }
-    { krebs = import ./tv { inherit lib; }; }
+  imp = lib.mkMerge [
+    { krebs = import ./lass   { inherit config lib; }; }
+    { krebs = import ./makefu { inherit config lib; }; }
+    { krebs = import ./miefda { inherit config lib; }; }
+    { krebs = import ./mv     { inherit config lib; }; }
+    { krebs = import ./shared { inherit config lib; }; }
+    { krebs = import ./tv     { inherit config lib; }; }
     {
       krebs.dns.providers = {
         de.krebsco = "zones";

krebs/3modules/exim-retiolum.nix

@@ -1,12 +1,12 @@
 { config, pkgs, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.exim-retiolum;
 
   out = {
     options.krebs.exim-retiolum = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {

krebs/3modules/exim-smarthost.nix

@@ -1,13 +1,12 @@
 { config, pkgs, lib, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.exim-smarthost;
 
   out = {
     options.krebs.exim-smarthost = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {

krebs/3modules/fetchWallpaper.nix

@@ -1,13 +1,13 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.krebs.fetchWallpaper;
 
   out = {
     options.krebs.fetchWallpaper = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {

krebs/3modules/git.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, lib, pkgs, ... }:
 
 # TODO unify logging of shell scripts to user and journal
 # TODO move all scripts to ${etcDir}, so ControlMaster connections
@@ -6,13 +6,13 @@
 # TODO when authorized_keys changes, then restart ssh
 #       (or kill already connected users somehow)
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.git;
 
   out = {
     options.krebs.git = api;
-    config = mkIf cfg.enable (mkMerge [
+    config = with lib; mkIf cfg.enable (mkMerge [
       (mkIf cfg.cgit cgit-imp)
       git-imp
     ]);
@@ -86,7 +86,7 @@ let
         singleton {
           user = [ config.krebs.users.tv ];
           repo = [ testing ]; # see literal example of repos
-          perm = push "refs/*" (with lib.git; [
+          perm = push "refs/*" (with config.krebs.lib.git; [
             non-fast-forward create delete merge
           ]);
         }

krebs/3modules/github-hosts-sync.nix

@@ -1,12 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.github-hosts-sync;
 
   out = {
     options.krebs.github-hosts-sync = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {

krebs/3modules/go.nix

@@ -1,13 +1,13 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.krebs.go;
 
   out = {
     options.krebs.go = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {

krebs/3modules/lass/default.nix

@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   hosts = {

krebs/3modules/lib.nix

@@ -0,0 +1,15 @@
+{ config, pkgs, lib, ... }:
+with lib;
+let
+  out = {
+    options.krebs.lib = api;
+    config = imp;
+  };
+  api = mkOption {
+    default = {};
+    type = types.attrs;
+  };
+  imp = {
+    krebs.lib = lib // import ../4lib { inherit lib; } // builtins;
+  };
+in out

krebs/3modules/makefu/default.nix

@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   hosts = {
@@ -292,8 +292,8 @@ with lib;
       cores = 1;
       nets = {
         retiolm = {
-          addrs4 = ["10.243.214.15/32"];
-          addrs6 = ["42:5a02:2c30:c1b1:3f2e:7c19:2496:a732/128"];
+          addrs4 = ["10.243.214.15"];
+          addrs6 = ["42:5a02:2c30:c1b1:3f2e:7c19:2496:a732"];
           aliases = [
               "wbob.retiolum"
           ];

krebs/3modules/miefda/default.nix

@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   hosts = {

krebs/3modules/mv/default.nix

@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   hosts = {

krebs/3modules/nginx.nix

@@ -1,13 +1,12 @@
-{ config, pkgs, lib, ... }:
+{ config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.nginx;
 
   out = {
     options.krebs.nginx = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
@@ -34,6 +33,7 @@ let
         };
         locations = mkOption {
           type = with types; listOf (attrsOf str);
+          default = [];
         };
         extraConfig = mkOption {
           type = with types; string;
@@ -76,8 +76,8 @@ let
     server {
       ${concatMapStringsSep "\n" (x: "listen ${x};") listen}
       server_name ${toString server-names};
-      ${extraConfig}
-      ${indent (concatStrings (map to-location locations))}
+      ${indent extraConfig}
+      ${indent (concatMapStrings to-location locations)}
     }
   '';
 

krebs/3modules/nixpkgs.nix

@@ -1,11 +1,11 @@
-{ config, pkgs, lib, ... }:
-with lib;
+{ config, lib, pkgs, ... }:
+with config.krebs.lib;
 let
   cfg = config.krebs.nixpkgs;
 
   out = {
     options.krebs.nixpkgs = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
@@ -37,7 +37,7 @@ let
     };
   };
 
-  imp = mkIf (cfg.allowUnfreePredicate != null) {
+  imp = lib.mkIf (cfg.allowUnfreePredicate != null) {
     nixpkgs.config.allowUnfreePredicate = cfg.allowUnfreePredicate;
   };
 in out

krebs/3modules/per-user.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.krebs.per-user;

krebs/3modules/realwallpaper.nix

@@ -1,12 +1,12 @@
-arg@{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.realwallpaper;
 
   out = {
     options.krebs.realwallpaper = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {

krebs/3modules/retiolum-bootstrap.nix

@@ -1,12 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.retiolum-bootstrap;
 
   out = {
     options.krebs.retiolum-bootstrap = api;
-    config = mkIf cfg.enable imp ;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {

krebs/3modules/retiolum.nix

@@ -1,11 +1,11 @@
 { config, pkgs, lib, ... }:
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.retiolum;
 
   out = {
     options.krebs.retiolum = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {

krebs/3modules/setuid.nix

@@ -0,0 +1,75 @@
+{ config, pkgs, lib, ... }:
+with config.krebs.lib;
+let
+  cfg = config.krebs.setuid;
+
+  out = {
+    options.krebs.setuid = api;
+    config = imp;
+  };
+
+  api = mkOption {
+    default = {};
+    type = let
+      # TODO make wrapperDir configurable
+      inherit (config.security) wrapperDir;
+      inherit (config.users) groups users;
+    in types.attrsOf (types.submodule ({ config, ... }: {
+      options = {
+        name = mkOption {
+          type = types.filename;
+          default = config._module.args.name;
+        };
+        filename = mkOption {
+          type = mkOptionType {
+            # TODO unyuck string and merge with toC
+            name = "derivation or string";
+            check = x:
+              isDerivation x ||
+              isString x;
+          };
+          apply = toString;
+        };
+        owner = mkOption {
+          default = "root";
+          type = types.enum (attrNames users);
+        };
+        group = mkOption {
+          default = "root";
+          type = types.enum (attrNames groups);
+        };
+        mode = mkOption {
+          default = "4710";
+          type = mkOptionType {
+            # TODO admit symbolic mode
+            name = "octal mode";
+            check = x:
+              isString x &&
+              match "[0-7][0-7][0-7][0-7]" x != null;
+          };
+        };
+        activate = mkOption {
+          type = types.str;
+          visible = false;
+          readOnly = true;
+        };
+      };
+      config.activate = let
+        src = pkgs.execve config.name {
+          inherit (config) filename;
+        };
+        dst = "${wrapperDir}/${config.name}";
+      in ''
+        cp ${src} ${dst}
+        chown ${config.owner}.${config.group} ${dst}
+        chmod ${config.mode} ${dst}
+      '';
+    }));
+  };
+
+  imp = {
+    system.activationScripts."krebs.setuid" = stringAfter [ "setuid" ]
+      (concatMapStringsSep "\n" (getAttr "activate") (attrValues cfg));
+  };
+
+in out

krebs/3modules/shared/default.nix

@@ -1,9 +1,8 @@
-{ lib, ... }:
-
-with lib;
+{ config, ... }:
 
+with config.krebs.lib;
 let
-  testHosts = lib.genAttrs [
+  testHosts = genAttrs [
     "test-arch"
     "test-centos6"
     "test-centos7"

krebs/3modules/tinc_graphs.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.tinc_graphs;
   internal_dir = "${cfg.workingDir}/internal";
@@ -8,7 +8,7 @@ let
 
   out = {
     options.krebs.tinc_graphs = api;
-    config = mkIf cfg.enable imp ;
+    config = lib.mkIf cfg.enable imp ;
   };
 
   api = {

krebs/3modules/tv/default.nix

@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   dns.providers = {

krebs/3modules/urlwatch.nix

@@ -5,14 +5,14 @@
 # cache = url: "${cfg.dataDir}/.urlwatch/cache/${hashString "sha1" url}"
 # TODO hooks.py
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.urlwatch;
 
   # TODO assert sendmail's existence
   out = {
     options.krebs.urlwatch = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {

krebs/4lib/default.nix

@@ -26,11 +26,15 @@ let out = rec {
   shell = import ./shell.nix { inherit lib; };
   tree = import ./tree.nix { inherit lib; };
 
-  toC = x: {
+  toC = x: let
+    type = typeOf x;
+    reject = throw "cannot convert ${type}";
+  in {
     list = "{ ${concatStringsSep ", " (map toC x)} }";
     null = "NULL";
+    set = if isDerivation x then toJSON x else reject;
     string = toJSON x; # close enough
-  }.${typeOf x};
+  }.${type} or reject;
 
   subdirsOf = path:
     mapAttrs (name: _: path + "/${name}")

krebs/4lib/infest/install-nix.sh

@@ -1,50 +0,0 @@
-#! /bin/sh
-set -efu
-
-nix_url=https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-linux.tar.bz2
-nix_sha256=504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4
-
-install_nix() {(
-
-  # install nix on host (cf. https://nixos.org/nix/install)
-  if ! test -e /root/.nix-profile/etc/profile.d/nix.sh; then
-    (
-      verify() {
-        printf '%s  %s\n' $nix_sha256  $(basename $nix_url) | sha256sum -c
-      }
-      if ! verify; then
-        curl -C - -O "$nix_url"
-        verify
-      fi
-    )
-    nix_src_dir=$(basename $nix_url .tar.bz2)
-    tar jxf $nix_src_dir.tar.bz2
-    $nix_src_dir/install
-  fi
-
-  . /root/.nix-profile/etc/profile.d/nix.sh
-
-  for i in \
-    bash \
-    coreutils \
-    # This line intentionally left blank.
-  do
-    if ! nix-env -q $i | grep -q .; then
-      nix-env -iA nixpkgs.pkgs.$i
-    fi
-  done
-
-  # install nixos-install
-  if ! type nixos-install 2>/dev/null; then
-    nixpkgs_expr='import <nixpkgs> { system = builtins.currentSystem; }'
-    nixpkgs_path=$(find /nix/store -mindepth 1 -maxdepth 1 -name *-nixpkgs-* -type d)
-    nix-env \
-      --arg config "{ nix.package = ($nixpkgs_expr).nix; }" \
-      --arg pkgs "$nixpkgs_expr" \
-      --arg modulesPath 'throw "no modulesPath"' \
-      -f $nixpkgs_path/nixpkgs/nixos/modules/installer/tools/tools.nix \
-      -iA config.system.build.nixos-install
-  fi
-)}
-
-install_nix "$@"

krebs/4lib/infest/prepare.sh

@@ -1,6 +1,9 @@
 #! /bin/sh
 set -efu
 
+nix_url=https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-linux.tar.bz2
+nix_sha256=504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4
+
 prepare() {(
   if test -e /etc/os-release; then
     . /etc/os-release
@@ -33,6 +36,13 @@ prepare() {(
             ;;
         esac
         ;;
+      nixos)
+        case $(cat /proc/cmdline) in
+          *' root=LABEL=NIXOS_ISO '*)
+            prepare_nixos_iso "$@"
+            exit
+        esac
+        ;;
     esac
   elif test -e /etc/centos-release; then
     case $(cat /etc/centos-release) in
@@ -70,7 +80,25 @@ prepare_debian() {
   prepare_common
 }
 
-prepare_common() {
+prepare_nixos_iso() {
+  mountpoint /mnt
+
+  type git 2>/dev/null || nix-env -iA nixos.git
+
+  mkdir -p /mnt/"$target_path"
+  mkdir -p "$target_path"
+
+  if ! mountpoint "$target_path"; then
+    mount --rbind /mnt/"$target_path" "$target_path"
+  fi
+
+  mkdir -p bin
+  rm -f bin/nixos-install
+  cp "$(type -p nixos-install)" bin/nixos-install
+  sed -i "s@^NIX_PATH=\"[^\"]*\"@NIX_PATH=$target_path@" bin/nixos-install
+}
+
+prepare_common() {(
 
   if ! getent group nixbld >/dev/null; then
     groupadd -g 30000 -r nixbld
@@ -133,6 +161,50 @@ prepare_common() {
     mkdir -p /mnt/nix
     mount --bind /nix /mnt/nix
   fi
+
+  #
+  # install nix
+  #
+
+  # install nix on host (cf. https://nixos.org/nix/install)
+  if ! test -e /root/.nix-profile/etc/profile.d/nix.sh; then
+    (
+      verify() {
+        printf '%s  %s\n' $nix_sha256  $(basename $nix_url) | sha256sum -c
       }
+      if ! verify; then
+        curl -C - -O "$nix_url"
+        verify
+      fi
+    )
+    nix_src_dir=$(basename $nix_url .tar.bz2)
+    tar jxf $nix_src_dir.tar.bz2
+    $nix_src_dir/install
+  fi
+
+  . /root/.nix-profile/etc/profile.d/nix.sh
+
+  for i in \
+    bash \
+    coreutils \
+    # This line intentionally left blank.
+  do
+    if ! nix-env -q $i | grep -q .; then
+      nix-env -iA nixpkgs.pkgs.$i
+    fi
+  done
+
+  # install nixos-install
+  if ! type nixos-install 2>/dev/null; then
+    nixpkgs_expr='import <nixpkgs> { system = builtins.currentSystem; }'
+    nixpkgs_path=$(find /nix/store -mindepth 1 -maxdepth 1 -name *-nixpkgs-* -type d)
+    nix-env \
+      --arg config "{ nix.package = ($nixpkgs_expr).nix; }" \
+      --arg pkgs "$nixpkgs_expr" \
+      --arg modulesPath 'throw "no modulesPath"' \
+      -f $nixpkgs_path/nixpkgs/nixos/modules/installer/tools/tools.nix \
+      -iA config.system.build.nixos-install
+  fi
+)}
 
 prepare "$@"

krebs/4lib/types.nix

@@ -17,6 +17,7 @@ types // rec {
       };
       nets = mkOption {
         type = attrsOf net;
+        default = {};
       };
 
       extraZones = mkOption {

krebs/5pkgs/builders.nix

@@ -1,15 +1,26 @@
-{ lib, pkgs, ... }:
-with lib;
-{
-  execve = name: { filename, argv, envp ? {}, destination ? "" }:
-    writeC name { inherit destination; } ''
+{ config, lib, pkgs, ... }:
+with config.krebs.lib;
+rec {
+  execve = name: { filename, argv ? null, envp ? {}, destination ? "" }: let
+  in writeC name { inherit destination; } ''
     #include <unistd.h>
-      int main () {
-        const char *filename = ${toC filename};
-        char *const argv[] = ${toC (argv ++ [null])};
-        char *const envp[] = ${toC (
+
+    static char *const filename = ${toC filename};
+
+    ${if argv == null
+      then /* Propagate arguments */ ''
+        #define MAIN_ARGS int argc, char **argv
+      ''
+      else /* Provide fixed arguments */ ''
+        #define MAIN_ARGS void
+        static char *const argv[] = ${toC (argv ++ [null])};
+      ''}
+
+    static char *const envp[] = ${toC (
       mapAttrsToList (k: v: "${k}=${v}") envp ++ [null]
     )};
+
+    int main (MAIN_ARGS) {
       execve(filename, argv, envp);
       return -1;
     }

krebs/5pkgs/default.nix

@@ -1,5 +1,5 @@
-{ lib, pkgs, ... }@args:
-with lib;
+{ config, lib, pkgs, ... }@args:
+with config.krebs.lib;
 {
   nixpkgs.config.packageOverrides = pkgs: {
     haskellPackages = pkgs.haskellPackages.override {

krebs/5pkgs/noVNC/default.nix

@@ -0,0 +1,21 @@
+{ fetchgit, lib, stdenv, ... }:
+with builtins;
+with lib;
+stdenv.mkDerivation rec {
+  name = "${baseNameOf src.name}-${removePrefix "refs/tags/v" src.rev}";
+
+  src = fetchgit {
+    url = https://github.com/kanaka/noVNC;
+    rev = "refs/tags/v0.5.1";
+    sha256 = "1azsnppwnrsv3axj0r5bw8lfarkibgz5vhgcyj8dzn4afn98f55w";
+  };
+
+  phases = [
+    "unpackPhase"
+    "installPhase"
+  ];
+
+  installPhase = ''
+    cp -R . $out
+  '';
+}

krebs/5pkgs/vncdotool/default.nix

@@ -0,0 +1,20 @@
+{ lib, pythonPackages, fetchurl, ... }:
+with pythonPackages; buildPythonPackage rec {
+  name = lib.removeSuffix ".tar.gz" (builtins.baseNameOf src.name);
+
+  src = fetchurl {
+    url = https://pypi.python.org/packages/source/v/vncdotool/vncdotool-0.9.0.tar.gz;
+    sha256 = "1hl44w4x9c8air0g6kp9h1af2vj4lmc50vnsxmca9g080740iyvi";
+  };
+
+  propagatedBuildInputs = [
+    twisted
+    pillow
+  ];
+
+  meta = {
+    homepage = https://github.com/sibson/vncdotool;
+    description = "A command line VNC client and python library";
+    license = lib.licenses.mit;
+  };
+}

krebs/default.nix

@@ -1,193 +1,8 @@
-assert false;
-
-{ current-host-name
-, current-user-name
-, lib
-, stockholm
-, StrictHostKeyChecking ? "yes"
-}:
-
-let out = {
-    inherit infest;
-    inherit init;
-    inherit nixos-install;
-  };
-
-  infest =
-    { system ? current-host-name
-    , target ? system
-    }@args: let
-      config = get-config system;
-    in ''
-      #! /bin/sh
-      # krebs.infest
-      set -efu
-
-      ${rootssh target ''
-        ${builtins.readFile ./4lib/infest/prepare.sh}
-        ${builtins.readFile ./4lib/infest/install-nix.sh}
-      ''}
-
-      (${nixos-install args})
-
-      ${rootssh target ''
-        ${builtins.readFile ./4lib/infest/finalize.sh}
-      ''}
-    '';
-
-  init =
-    { system ? current-host-name
-    }@args: let
-      config = get-config system;
-    in ''
-      #! /bin/sh
-      # krebs.init
-      set -efu
-
-      system=${lib.shell.escape system}
-      secrets_dir=${config.krebs.build.source.dir.secrets.path}
-      key_type=ed25519
-      key_file=$secrets_dir/ssh.id_$key_type
-      key_comment=$system
-
-      if test -e "$key_file"; then
-        echo "Warning: privkey already exists: $key_file" >&2
-      else
-        ssh-keygen \
-            -C "$key_comment" \
-            -t "$key_type" \
-            -f "$key_file" \
-            -N ""
-        rm "$key_file.pub"
-      fi
-
-      pubkey=$(ssh-keygen -y -f "$key_file")
-
-      cat<<EOF
-      # put following into config.krebs.hosts.$system:
-      ssh.privkey.path = <secrets/ssh.$key_type>;
-      ssh.pubkey = $(echo $pubkey | jq -R .);
-      EOF
-    '';
-
-  nixos-install =
-    { system ? current-host-name
-    , target ? system
-    }@args: let
-    in ''
-      #! /bin/sh
-      # krebs.nixos-install
-      (${populate (args // { root = "/mnt"; })})
-
-      ${rootssh target ''
-        export PATH; PATH=/root/.nix-profile/bin:$PATH
-
-        src=$(type -p nixos-install)
-        cat_src() {
-          sed < "$src" "$(
-            { sed < "$src" -n '
-                  /^if ! test -e "\$mountPoint\/\$NIXOS_CONFIG/,/^fi$/=
-                  /^nixpkgs=/=
-                  /^NIX_PATH=/,/^$/{/./=}
-
-                  # Disable: Copy the NixOS/Nixpkgs sources to the target as
-                  # the initial contents of the NixOS channel.
-                  /^srcs=/,/^ln -sfn /=
-                '
-            } | sed 's:$:s/^/#krebs#/:'
-          )"
-        }
-
-        # Location to insert `nix-install`
-        i=$(sed -n '/^echo "building the system configuration/=' "$src")
-
+{ config, lib, pkgs, ... }:
+with config.krebs.lib;
 {
-          cat_src | sed -n "1,$i{p}"
-          cat ${doc (nix-install args)}
-          cat_src | sed -n "$i,\''${$i!p}"
-        } > nixos-install
-        chmod +x nixos-install
-
-        # Wrap inserted nix-install into chroot.
-        nix_env=$(cat_src | sed -n '
-          s:.*\(/nix/store/[a-z0-9]*-nix-[0-9.]\+/bin/nix-env\).*:\1:p;T;q
-        ')
-        echo "nix-env is $nix_env" >&2
-        findpkg() {(
-          name=$1
-          path=$(find /nix/store \
-              -mindepth 1 -maxdepth 1 -type d -name '*-'"$name"'-*' \
-            | head -n 1 | sed s:^/mnt::)
-          if echo "$path" | grep .; then
-            echo "$name is $path" >&2
-          else
-            echo "Error: package not found: $name" >&2
-            exit 1
-          fi
-        )}
-        cacert=$(findpkg cacert)
-        coreutils=$(findpkg coreutils)
-        cp "$cacert"/etc/ssl/certs/ca-bundle.crt /mnt/root/SSL_CERT_FILE
-        env="$coreutils/bin/env SSL_CERT_FILE=/root/SSL_CERT_FILE"
-        sed -i '
-          s:^NIX_PATH=:chroot $mountPoint '"$env"' &:
-          s:^nix-env:'"$nix_env"':
-        ' nixos-install
-
-        ./nixos-install
-      ''}
-    '';
-
-  doc = s:
-    let b = "EOF${builtins.hashString "sha256" s}"; in
-    ''
-    <<\${b}
-    ${s}
-    ${b}
-    '';
-
-  get-config = system: let
-    config = stockholm.users.${current-user-name}.${system}.config
-      or (abort "unknown system: ${system}, user: ${current-user-name}");
-  in config;
-
-  nix-install =
-    { system ? current-host-name
-    , target ? system
-    }:
-    let
-      config = get-config system;
-
-      nix-path =
-        lib.concatStringsSep ":"
-          (lib.mapAttrsToList (name: src: "${name}=${src.target-path}")
-            (config.krebs.build.source.dir //
-             config.krebs.build.source.git));
-    in ''
-      set -efu
-      NIX_PATH=${lib.shell.escape nix-path} \
-      nix-env \
-        --show-trace \
-        -f '<stockholm>' \
-        --argstr current-host-name ${lib.shell.escape current-host-name} \
-        --argstr current-user-name ${lib.shell.escape current-user-name} \
-        --profile ${lib.shell.escape config.krebs.build.profile} \
-        --set \
-        -A ${lib.escapeShellArg (lib.concatStringsSep "." [
-              "users"
-              config.krebs.build.user.name
-              config.krebs.build.host.name
-              "system"
-            ])}
-    '';
-
-  rootssh = target: script:
-    let
-      flags = "-o StrictHostKeyChecking=${StrictHostKeyChecking}";
-    in
-    "ssh ${flags} root@${target} -T ${doc ''
-      set -efu
-      ${script}
-    ''}";
-
-in out
+  imports = [
+    ./3modules
+    ./5pkgs
+  ];
+}

lass/1systems/cloudkrebs.nix

@@ -7,6 +7,7 @@ let
   ip = (head config.krebs.build.host.nets.internet.addrs4);
 in {
   imports = [
+    ../.
     ../2configs/os-templates/CAC-CentOS-7-64bit.nix
     ../2configs/base.nix
     ../2configs/retiolum.nix

lass/1systems/dishfire.nix

@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ../.
     <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
     ../2configs/base.nix
     ../2configs/git.nix

lass/1systems/echelon.nix

@@ -7,6 +7,7 @@ let
   ip = (head config.krebs.build.host.nets.internet.addrs4);
 in {
   imports = [
+    ../.
     ../2configs/os-templates/CAC-CentOS-7-64bit.nix
     ../2configs/base.nix
     ../2configs/retiolum.nix

lass/1systems/helios.nix

@@ -3,6 +3,7 @@
 with builtins;
 {
   imports = [
+    ../.
     ../2configs/baseX.nix
     ../2configs/browsers.nix
     ../2configs/programs.nix

lass/1systems/mors.nix

@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ../.
     ../2configs/baseX.nix
     ../2configs/programs.nix
     ../2configs/bitcoin.nix

lass/1systems/prism.nix

@@ -6,6 +6,7 @@ let
   ip = (head config.krebs.build.host.nets.internet.addrs4);
 in {
   imports = [
+    ../.
     ../2configs/base.nix
     ../2configs/downloading.nix
     ../2configs/git.nix

lass/1systems/uriel.nix

@@ -3,6 +3,7 @@
 with builtins;
 {
   imports = [
+    ../.
     ../2configs/baseX.nix
     ../2configs/browsers.nix
     ../2configs/games.nix

lass/2configs/base.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   imports = [
     ../2configs/vim.nix
@@ -50,12 +50,10 @@ with lib;
       user = config.krebs.users.lass;
       source = mapAttrs (_: mkDefault) ({
         nixos-config = "symlink:stockholm/lass/1systems/${config.krebs.build.host.name}.nix";
-        nixpkgs = symlink:stockholm/nixpkgs;
         secrets = "/home/lass/secrets/${config.krebs.build.host.name}";
         #secrets-common = "/home/lass/secrets/common";
         stockholm = "/home/lass/stockholm";
-        stockholm-user = "symlink:stockholm/lass";
-        upstream-nixpkgs = {
+        nixpkgs = {
           url = https://github.com/Lassulus/nixpkgs;
           rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce";
           dev = "/home/lass/src/nixpkgs";

lass/2configs/downloading.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   rpc-password = import <secrets/transmission-pw.nix>;

lass/2configs/fastpoke-pages.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   createStaticPage = domain:

lass/2configs/git.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
 

lass/2configs/go.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   environment.systemPackages = [
     pkgs.go

lass/2configs/teamviewer.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   services.teamviewer.enable = true;
 }

lass/2configs/xserver/Xresources.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 pkgs.writeText "Xresources" ''
   URxvt*scrollBar:                      false

lass/2configs/xserver/default.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }@args:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO krebs.build.user

lass/2configs/xserver/xserver.conf.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.services.xserver;

lass/3modules/owncloud_nginx.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.lass.owncloud;

lass/3modules/per-user.nix

@@ -1,7 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.lass.per-user;
 

lass/3modules/static_nginx.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.lass.staticPage;

lass/3modules/wordpress_nginx.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.lass.wordpress;

lass/default.nix

@@ -0,0 +1,7 @@
+_:
+{
+  imports = [
+    ../krebs
+    ./3modules
+  ];
+}

makefu/1systems/filepimp.nix

@@ -11,6 +11,7 @@ let
 in {
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       ../2configs/fs/single-partition-ext4.nix
       ../2configs/tinc-basic-retiolum.nix
       ../2configs/smart-monitor.nix

makefu/1systems/gum.nix

@@ -1,11 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   external-ip = head config.krebs.build.host.nets.internet.addrs4;
   internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
 in {
   imports = [
+      ../.
       ../2configs/tinc-basic-retiolum.nix
       ../2configs/headless.nix
       ../2configs/fs/simple-swap.nix

makefu/1systems/omo.nix

@@ -20,6 +20,7 @@ let
 in {
   imports =
     [
+      ../.
       # TODO: unlock home partition via ssh
       ../2configs/fs/single-partition-ext4.nix
       ../2configs/tinc-basic-retiolum.nix

makefu/1systems/pnp.nix

@@ -6,6 +6,7 @@
 {
   imports =
     [
+      ../.
       ../2configs/tinc-basic-retiolum.nix
       ../2configs/headless.nix
       ../../krebs/3modules/Reaktor.nix

makefu/1systems/pornocauster.nix

@@ -6,6 +6,7 @@
 {
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       ../2configs/main-laptop.nix #< base-gui + zsh
 
       # Krebs

makefu/1systems/repunit.nix

@@ -7,8 +7,9 @@
 {
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
-      ../2configs/cgit-retiolum.nix
+      ../2configs/git/cgit-retiolum.nix
     ];
   krebs.build.host = config.krebs.hosts.repunit;
 

makefu/1systems/tsp.nix

@@ -6,6 +6,7 @@
 {
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       ../2configs/base-gui.nix
       ../2configs/tinc-basic-retiolum.nix
       ../2configs/fs/sda-crypto-root.nix

makefu/1systems/vbob.nix

@@ -6,6 +6,7 @@
   krebs.build.host = config.krebs.hosts.vbob;
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       <nixpkgs/nixos/modules/virtualisation/virtualbox-image.nix>
       ../2configs/main-laptop.nix #< base-gui
 

makefu/1systems/wbob.nix

@@ -2,6 +2,7 @@
 {
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       ../2configs/main-laptop.nix
     ];
   krebs = {

makefu/1systems/wry.nix

@@ -1,12 +1,13 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
 
   external-ip = head config.krebs.build.host.nets.internet.addrs4;
   internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
 in {
   imports = [
+      ../.
       # TODO: copy this config or move to krebs
       ../../tv/2configs/hw/CAC.nix
       ../../tv/2configs/fs/CAC-CentOS-7-64bit.nix

makefu/2configs/backup.nix

@@ -1,5 +1,5 @@
 { config, lib, ... }:
-with lib;
+with config.krebs.lib;
 let
   startAt = "0,6,12,18:00";
   defaultBackupServer = config.krebs.hosts.omo;

makefu/2configs/base-gui.nix

@@ -21,7 +21,7 @@
 # URxvt.visualBell: false
 # URxvt.font : xft:Terminus
 
-with lib;
+with config.krebs.lib;
 let
   mainUser = config.krebs.build.user.name;
   awesomecfg = pkgs.awesomecfg.full;

makefu/2configs/bepasty-dual.nix

@@ -10,7 +10,7 @@
 #   wildcard.krebsco.de.key
 #   bepasty-secret.nix     <- contains single string
 
-with lib;
+with config.krebs.lib;
 let
   sec = toString <secrets>;
   # secKey is nothing worth protecting on a local machine

makefu/2configs/collectd/collectd-base.nix

@@ -2,7 +2,7 @@
 
 # graphite-web on port 8080
 # carbon cache on port 2003 (tcp/udp)
-with lib;
+with config.krebs.lib;
 let
   connect-time-cfg = with pkgs; writeText "collectd-connect-time.cfg" ''
     LoadPlugin python

makefu/2configs/default.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   system.stateVersion = "15.09";
 
@@ -20,7 +20,7 @@ with lib;
     build =  {
       user = config.krebs.users.makefu;
       source =  mapAttrs (_: mkDefault) {
-        upstream-nixpkgs = {
+        nixpkgs = {
           url = https://github.com/nixos/nixpkgs;
           rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; # unstable @ 2015-01-27, tested on wry
         };
@@ -29,8 +29,6 @@ with lib;
 
         # Defaults for all stockholm users?
         nixos-config = "symlink:stockholm/${config.krebs.build.user.name}/1systems/${config.krebs.build.host.name}.nix";
-        nixpkgs = symlink:stockholm/nixpkgs;
-        stockholm-user = "symlink:stockholm/${config.krebs.build.user.name}";
       };
     };
   };

makefu/2configs/exim-retiolum.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   krebs.exim-retiolum.enable = true;
   environment.systemPackages = with pkgs; [

makefu/2configs/fs/cac-boot-partition.nix

@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 # vda1 ext4 (label nixos) -> only root partition
-with lib;
+with config.krebs.lib;
 {
   boot.loader.grub.enable = true;
   boot.loader.grub.version = 2;

makefu/2configs/fs/sda-crypto-root-home.nix

@@ -8,7 +8,7 @@
 #             /     (main-root)
 #             /home (main-home)
 
-with lib;
+with config.krebs.lib;
 {
 
   imports = [

makefu/2configs/fs/sda-crypto-root.nix

@@ -3,7 +3,7 @@
 # sda:  bootloader grub2
 # sda1: boot ext4 (label nixboot)
 # sda2: cryptoluks -> ext4
-with lib;
+with config.krebs.lib;
 {
   boot = {
     loader.grub.enable = true;

makefu/2configs/fs/vm-single-partition.nix

@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 # vda1 ext4 (label nixos) -> only root partition
-with lib;
+with config.krebs.lib;
 {
   imports = [
     ./single-partition-ext4.nix

makefu/2configs/git/brain-retiolum.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 # TODO: remove tv lib :)
-with lib;
+with config.krebs.lib;
 let
 
   repos = priv-repos // krebs-repos ;

makefu/2configs/git/cgit-retiolum.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 # TODO: remove tv lib :)
-with lib;
+with config.krebs.lib;
 let
 
   repos = priv-repos // krebs-repos // connector-repos ;

makefu/2configs/graphite-standalone.nix

@@ -2,7 +2,7 @@
 
 # graphite-web on port 8080
 # carbon cache on port 2003 (tcp/udp)
-with lib;
+with config.krebs.lib;
 {
   imports = [ ];
 

makefu/2configs/hw/tp-x200.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
 
   imports = [ ./tp-x2x0.nix ];

makefu/2configs/hw/tp-x220.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
 
   imports = [ ./tp-x2x0.nix ];

makefu/2configs/hw/tp-x2x0.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   # TODO: put this somewhere else
   networking.wireless.enable = true;

makefu/2configs/mail-client.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   environment.systemPackages = with pkgs; [
     msmtp

makefu/2configs/main-laptop.nix

@@ -5,7 +5,7 @@
 # not fit into base-gui
 # TODO split generic desktop stuff and laptop-specifics like lidswitching
 
-with lib;
+with config.krebs.lib;
 {
   imports = [
     ./base-gui.nix

makefu/2configs/mattermost-docker.nix

@@ -1,6 +1,6 @@
 {config, lib, ...}:
 
-with lib;
+with config.krebs.lib;
 let
   sec = toString <secrets>;
   ssl_cert = "${sec}/wildcard.krebsco.de.crt";

makefu/2configs/nginx/euer.blog.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   sec = toString <secrets>;
   ssl_cert = "${sec}/wildcard.krebsco.de.crt";

makefu/2configs/nginx/euer.test.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   hostname = config.krebs.build.host.name;
   user = config.services.nginx.user;

makefu/2configs/nginx/euer.wiki.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   sec = toString <secrets>;
   ssl_cert = "${sec}/wildcard.krebsco.de.crt";

makefu/2configs/nginx/update.connector.one.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   hostname = config.krebs.build.host.name;
   external-ip = head config.krebs.build.host.nets.internet.addrs4;

makefu/2configs/omo-share.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   hostname = config.krebs.build.host.name;
   # TODO local-ip from the nets config

makefu/2configs/tinc-basic-retiolum.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   krebs.retiolum = {
     enable = true;

makefu/2configs/zsh-user.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 ##
-with lib;
+with config.krebs.lib;
 let
   mainUser = config.krebs.build.user.name;
 in

makefu/3modules/snapraid.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   # returns dirname without / , used as disk name
@@ -28,7 +28,7 @@ let
 
   out = {
     options.makefu.snapraid = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {