Merge remote-tracking branch 'cd/master'

krebs/3modules/Reaktor.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
 
   ReaktorConfig = pkgs.writeText "config.py" ''

krebs/3modules/apt-cacher-ng.nix

@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   acng-config = pkgs.writeTextFile {
     name = "acng-configuration";

krebs/3modules/backup.nix

@@ -1,5 +1,5 @@
 { config, lib, pkgs, ... }:
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   out = {
     options.krebs.backup = api;

krebs/3modules/bepasty-server.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   gunicorn = pkgs.pythonPackages.gunicorn;
   bepasty = pkgs.pythonPackages.bepasty-server;

krebs/3modules/build.nix

@@ -1,6 +1,6 @@
 { config, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 {
   options.krebs.build = {

krebs/3modules/buildbot/master.nix

@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
 
   # https://github.com/NixOS/nixpkgs/issues/14026

krebs/3modules/buildbot/slave.nix

@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   buildbot-slave-init = pkgs.writeText "buildbot-slave.tac" ''
     import os

krebs/3modules/current.nix

@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 let
   cfg = config.krebs.current;

krebs/3modules/default.nix

@@ -1,6 +1,6 @@
 { config, lib, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   cfg = config.krebs;
 
@@ -21,7 +21,6 @@ let
       ./git.nix
       ./go.nix
       ./iptables.nix
-      ./lib.nix
       ./newsbot-js.nix
       ./nginx.nix
       ./nixpkgs.nix

krebs/3modules/exim-retiolum.nix

@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   cfg = config.krebs.exim-retiolum;
 

krebs/3modules/exim-smarthost.nix

@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   indent = replaceChars ["\n"] ["\n  "];
   cfg = config.krebs.exim-smarthost;

krebs/3modules/exim.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }: with config.krebs.lib; let
+{ config, lib, pkgs, ... }: with import <stockholm/lib>; let
   cfg = config.krebs.exim;
 in {
   options.krebs.exim = {

krebs/3modules/fetchWallpaper.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 let
   cfg = config.krebs.fetchWallpaper;

krebs/3modules/git.nix

@@ -6,7 +6,7 @@
 # TODO when authorized_keys changes, then restart ssh
 #       (or kill already connected users somehow)
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   cfg = config.krebs.git;
 
@@ -97,7 +97,7 @@ let
         singleton {
           user = [ config.krebs.users.tv ];
           repo = [ testing ]; # see literal example of repos
-          perm = push "refs/*" (with config.krebs.lib.git; [
+          perm = push "refs/*" (with git; [
             non-fast-forward create delete merge
           ]);
         }

krebs/3modules/github-hosts-sync.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   cfg = config.krebs.github-hosts-sync;
 

krebs/3modules/go.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 let
   cfg = config.krebs.go;

krebs/3modules/lass/default.nix

@@ -1,6 +1,6 @@
 { config, lib, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 {
   hosts = mapAttrs (_: setAttr "owner" config.krebs.users.lass) {

krebs/3modules/lib.nix

@@ -1,15 +0,0 @@
-{ config, pkgs, lib, ... }:
-with lib;
-let
-  out = {
-    options.krebs.lib = api;
-    config = imp;
-  };
-  api = mkOption {
-    default = {};
-    type = types.attrs;
-  };
-  imp = {
-    krebs.lib = lib // import ../4lib { inherit config lib; } // builtins;
-  };
-in out

krebs/3modules/makefu/default.nix

@@ -1,6 +1,6 @@
 { config, lib, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 {
   hosts = mapAttrs (_: setAttr "owner" config.krebs.users.makefu) {

krebs/3modules/mv/default.nix

@@ -1,6 +1,6 @@
 { config, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 {
   hosts = mapAttrs (_: setAttr "owner" config.krebs.users.mv) {

krebs/3modules/nginx.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   cfg = config.krebs.nginx;
 

krebs/3modules/nixpkgs.nix

@@ -1,5 +1,5 @@
 { config, lib, pkgs, ... }:
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   cfg = config.krebs.nixpkgs;
 

krebs/3modules/on-failure.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }: with config.krebs.lib; let
+{ config, lib, pkgs, ... }: with import <stockholm/lib>; let
   out = {
     options.krebs.on-failure = api;
     config = lib.mkIf cfg.enable imp;

krebs/3modules/os-release.nix

@@ -1,5 +1,5 @@
 { config, ... }:
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   nixos-version-id = "${config.system.nixosVersion}";
   nixos-version = "${nixos-version-id} (${config.system.nixosCodeName})";

krebs/3modules/per-user.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 let
   cfg = config.krebs.per-user;

krebs/3modules/power-action.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 let
   cfg = config.krebs.power-action;

krebs/3modules/realwallpaper.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   cfg = config.krebs.realwallpaper;
 

krebs/3modules/repo-sync.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   cfg = config.krebs.repo-sync;
 

krebs/3modules/retiolum-bootstrap.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   cfg = config.krebs.retiolum-bootstrap;
 

krebs/3modules/retiolum.nix

@@ -1,5 +1,5 @@
 { config, pkgs, lib, ... }:
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   out = {
     options.krebs.tinc = api;

krebs/3modules/rtorrent.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   cfg = config.krebs.rtorrent;
   webcfg = config.krebs.rtorrent.web;

krebs/3modules/secret.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }@args: with config.krebs.lib; let
+{ config, lib, pkgs, ... }@args: with import <stockholm/lib>; let
   cfg = config.krebs.secret;
 in {
   options.krebs.secret = {

krebs/3modules/setuid.nix

@@ -1,5 +1,5 @@
 { config, pkgs, lib, ... }:
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   cfg = config.krebs.setuid;
 

krebs/3modules/shared/default.nix

@@ -1,6 +1,6 @@
 { config, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   testHosts = genAttrs [
     "test-arch"

krebs/3modules/tinc_graphs.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   cfg = config.krebs.tinc_graphs;
   internal_dir = "${cfg.workingDir}/internal";

krebs/3modules/tv/default.nix

@@ -1,6 +1,6 @@
 { config, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 {
   dns.providers = {

krebs/3modules/urlwatch.nix

@@ -4,7 +4,7 @@
 # TODO inform about unused caches
 # cache = url: "${cfg.dataDir}/.urlwatch/cache/${hashString "sha1" url}"
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   cfg = config.krebs.urlwatch;
 

krebs/4lib/default.nix

@@ -1,59 +0,0 @@
-_:
-
-let
-  lib = import <stockholm/lib>;
-in
-
-with lib;
-
-let out = lib // rec {
-
-  guard = spec@{ type, value, ... }:
-    assert isOptionType type;
-    if type.check value
-      then value
-      else throw (toString (filter isString [
-        "argument"
-        (if spec ? name then "‘${spec.name}’" else null)
-        "is not a ${type.name}"
-      ]));
-
-  types = import ./types.nix {
-    lib = lib // { inherit genid optionalTrace; };
-  };
-
-  genid = import ./genid.nix { lib = lib // out; };
-  genid_signed = x: ((genid x) + 16777216) / 2;
-  git = import ./git.nix { lib = lib // out; };
-  tree = import ./tree.nix { inherit lib; };
-
-  lpad = n: c: s:
-    if stringLength s < n
-      then lpad n c (c + s)
-      else s;
-
-  toC = x: let
-    type = typeOf x;
-    reject = throw "cannot convert ${type}";
-  in {
-    list = "{ ${concatStringsSep ", " (map toC x)} }";
-    null = "NULL";
-    set = if isDerivation x then toJSON x else reject;
-    string = toJSON x; # close enough
-  }.${type} or reject;
-
-  subdirsOf = path:
-    mapAttrs (name: _: path + "/${name}")
-             (filterAttrs (_: eq "directory") (readDir path));
-
-  genAttrs' = names: f: listToAttrs (map f names);
-
-  getAttrs = names: set:
-    listToAttrs (map (name: nameValuePair name set.${name})
-                     (filter (flip hasAttr set) names));
-
-  setAttr = name: value: set: set // { ${name} = value; };
-
-  optionalTrace = c: msg: x: if c then trace msg x else x;
-
-}; in out

krebs/4lib/tree.nix

@@ -1,13 +0,0 @@
-{ lib, ... }:
-
-with lib;
-
-rec {
-  # tree k v = set k (either v (tree k v))
-
-  # get : [k] -> tree k v -> v
-  get = path: tree:
-    if length path > 0
-      then get (tail path) tree.${head path} # TODO check if elem exists
-      else tree;
-}

krebs/5pkgs/builders.nix

@@ -1,5 +1,5 @@
 { config, pkgs, ... }:
-with config.krebs.lib;
+with import <stockholm/lib>;
 rec {
   execve = name: { filename, argv ? null, envp ? {}, destination ? "" }: let
   in writeC name { inherit destination; } /* c */ ''

krebs/5pkgs/default.nix

@@ -1,5 +1,5 @@
 { config, lib, pkgs, ... }@args:
-with config.krebs.lib;
+with import <stockholm/lib>;
 {
   nixpkgs.config.packageOverrides = pkgs: let
 

krebs/default.nix

@@ -1,5 +1,5 @@
 { config, lib, pkgs, ... }:
-with config.krebs.lib;
+with import <stockholm/lib>;
 {
   imports = [
     ./3modules

lass/1systems/helios.nix

@@ -1,7 +1,7 @@
 { config, pkgs, ... }:
 
 with builtins;
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 {
   imports = [

lass/1systems/mors.nix

@@ -1,6 +1,6 @@
 { config, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 {
   imports = [
     ../.

lass/1systems/prism.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 let
   ip = config.krebs.build.host.nets.internet.ip4.addr;

lass/1systems/uriel.nix

@@ -1,7 +1,7 @@
 { config, pkgs, ... }:
 
 with builtins;
-with config.krebs.lib;
+with import <stockholm/lib>;
 {
   imports = [
     ../.

lass/2configs/backups.nix

@@ -1,5 +1,5 @@
 { config, lib, ... }:
-with config.krebs.lib;
+with import <stockholm/lib>;
 {
 
   krebs.backup.plans = {

lass/2configs/browsers.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
 
   mainUser = config.users.extraUsers.mainUser;

lass/2configs/buildbot-standalone.nix

@@ -1,6 +1,6 @@
 { lib, config, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 let
   sshHostConfig = pkgs.writeText "ssh-config" ''

lass/2configs/c-base.nix

@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 let
-  inherit (config.krebs.lib) genid;
+  inherit (import <stockholm/lib>) genid;
 
 in {
 

lass/2configs/default.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 {
   imports = [
     ../2configs/audit.nix

lass/2configs/downloading.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 {
   users.extraUsers = {

lass/2configs/exim-retiolum.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 {
   krebs.exim-retiolum.enable = true;

lass/2configs/exim-smarthost.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 {
   krebs.exim-smarthost = {

lass/2configs/gc.nix

@@ -1,6 +1,6 @@
 { config, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 {
   nix.gc = {
     automatic = ! elem config.krebs.build.host.name [ "prism" "mors" ];

lass/2configs/git.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 let
 

lass/2configs/go.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 {
   environment.systemPackages = [
     pkgs.go

lass/2configs/hw/tp-x220.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 {
   networking.wireless.enable = lib.mkDefault true;
 

lass/2configs/libvirt.nix

@@ -2,7 +2,7 @@
 
 let
   mainUser = config.users.extraUsers.mainUser;
-  inherit (config.krebs.lib) genid;
+  inherit (import <stockholm/lib>) genid;
 
 in {
   virtualisation.libvirtd.enable = true;

lass/2configs/pulse.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   pkg = pkgs.pulseaudioLight;
   runDir = "/run/pulse";

lass/2configs/radio.nix

@@ -1,11 +1,11 @@
 { config, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 let
   name = "radio";
   mainUser = config.users.extraUsers.mainUser;
-  inherit (config.krebs.lib) genid;
+  inherit (import <stockholm/lib>) genid;
 
   admin-password = import <secrets/icecast-admin-pw>;
   source-password = import <secrets/icecast-source-pw>;

lass/2configs/repo-sync.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 let
   mirror = "git@${config.networking.hostName}:";

lass/2configs/skype.nix

@@ -2,7 +2,7 @@
 
 let
   mainUser = config.users.extraUsers.mainUser;
-  inherit (config.krebs.lib) genid;
+  inherit (import <stockholm/lib>) genid;
 
 in {
   users.extraUsers = {

lass/2configs/teamviewer.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 {
   services.teamviewer.enable = true;
 }

lass/2configs/vim.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   out = {
     environment.systemPackages = [

lass/2configs/weechat.nix

@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 let
-  inherit (config.krebs.lib) genid;
+  inherit (import <stockholm/lib>) genid;
 in {
   krebs.per-user.chat.packages = with pkgs; [
     mosh

lass/2configs/xserver/Xresources.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 pkgs.writeText "Xresources" ''
   URxvt*scrollBar:                      false

lass/2configs/xserver/default.nix

@@ -1,5 +1,5 @@
 { config, pkgs, ... }@args:
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   user = config.krebs.build.user;
 in {

lass/2configs/xserver/xserver.conf.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 let
   cfg = config.services.xserver;

lass/3modules/ejabberd/config.nix

@@ -1,4 +1,4 @@
-{ config, ... }: with config.krebs.lib; let
+{ config, ... }: with import <stockholm/lib>; let
   cfg = config.lass.ejabberd;
 
   # XXX this is a placeholder that happens to work the default strings.

lass/3modules/ejabberd/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }@args: with config.krebs.lib; let
+{ config, lib, pkgs, ... }@args: with import <stockholm/lib>; let
   cfg = config.lass.ejabberd;
 in {
   options.lass.ejabberd = {

lass/3modules/hosts.nix

@@ -1,6 +1,6 @@
 { config, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 {
   options.lass.hosts = mkOption {

lass/3modules/owncloud_nginx.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 let
   cfg = config.lass.owncloud;

lass/3modules/static_nginx.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 let
   cfg = config.lass.staticPage;

lass/3modules/umts.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 let
   cfg = config.lass.umts;

lass/3modules/usershadow.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }@args: with config.krebs.lib; let
+{ config, lib, pkgs, ... }@args: with import <stockholm/lib>; let
 
   cfg = config.lass.usershadow;
 

lass/3modules/wordpress_nginx.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 
 let
   cfg = config.lass.wordpress;

lib/default.nix

@@ -1,10 +1,44 @@
 let
-  lib = import <nixpkgs/lib> // builtins // {
+  nixpkgs-lib = import <nixpkgs/lib>;
+  lib = with lib; nixpkgs-lib // builtins // {
+    git = import ./git.nix { inherit lib; };
     shell = import ./shell.nix { inherit lib; };
+    types = nixpkgs-lib.types // import ./types.nix { inherit lib; };
 
     eq = x: y: x == y;
     ne = x: y: x != y;
     mod = x: y: x - y * (x / y);
+
+    genid = import ./genid.nix { inherit lib; };
+    genid_signed = x: ((lib.genid x) + 16777216) / 2;
+
+    lpad = n: c: s:
+      if lib.stringLength s < n
+        then lib.lpad n c (c + s)
+        else s;
+
+    subdirsOf = path:
+      lib.mapAttrs (name: _: path + "/${name}")
+                   (filterAttrs (_: eq "directory") (readDir path));
+
+    genAttrs' = names: f: listToAttrs (map f names);
+
+    getAttrs = names: set:
+      listToAttrs (map (name: nameValuePair name set.${name})
+                       (filter (flip hasAttr set) names));
+
+    setAttr = name: value: set: set // { ${name} = value; };
+
+    toC = x: let
+      type = typeOf x;
+      reject = throw "cannot convert ${type}";
+    in {
+      list = "{ ${concatStringsSep ", " (map toC x)} }";
+      null = "NULL";
+      set = if isDerivation x then toJSON x else reject;
+      string = toJSON x; # close enough
+    }.${type} or reject;
+
   };
 in
 

lib/types.nix

@@ -1,10 +1,16 @@
 { lib, ... }:
 
-with builtins;
-with lib;
-with types;
+let
+  inherit (lib)
+    all any concatMapStringsSep concatStringsSep const filter flip genid
+    hasSuffix head isInt isString length match mergeOneOption mkOption
+    mkOptionType optional optionalAttrs optionals range splitString
+    stringLength tail typeOf;
+  inherit (lib.types)
+    attrsOf bool either enum int listOf nullOr path str string submodule;
+in
 
-types // rec {
+rec {
 
   host = submodule ({ config, ... }: {
     options = {
@@ -20,6 +26,11 @@ types // rec {
         default = {};
       };
 
+      binary-cache.pubkey = mkOption {
+        type = nullOr binary-cache-pubkey;
+        default = null;
+      };
+
       owner = mkOption {
         type = user;
       };
@@ -27,7 +38,7 @@ types // rec {
       extraZones = mkOption {
         default = {};
         # TODO: string is either MX, NS, A or AAAA
-        type = with types; attrsOf string;
+        type = attrsOf string;
       };
 
       secure = mkOption {
@@ -331,6 +342,8 @@ types // rec {
     merge = mergeOneOption;
   };
 
+  binary-cache-pubkey = str;
+
   pgp-pubkey = str;
 
   ssh-pubkey = str;
@@ -356,7 +369,7 @@ types // rec {
 
   tinc-pubkey = str;
 
-  krebs.file-location = types.submodule {
+  krebs.file-location = submodule {
     options = {
       # TODO user
       host = mkOption {
@@ -364,7 +377,7 @@ types // rec {
       };
       # TODO merge with ssl.privkey.path
       path = mkOption {
-        type = types.either types.path types.str;
+        type = either path str;
         apply = x: {
           path = toString x;
           string = x;

makefu/1systems/darth.nix

@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   byid = dev: "/dev/disk/by-id/" + dev;
   rootDisk = byid "ata-ADATA_SSD_S599_64GB_10460000000000000039";

makefu/1systems/gum.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   external-ip = config.krebs.build.host.nets.internet.ip4.addr;
   internal-ip = config.krebs.build.host.nets.retiolum.ip4.addr;

makefu/1systems/omo.nix

@@ -66,7 +66,7 @@ in {
     '';
   };
   users.groups.share = {
-    gid = config.krebs.lib.genid "share";
+    gid = (import <stockholm/lib>).genid "share";
     members = [ "makefu" "misa" ];
   };
   networking.firewall.trustedInterfaces = [ primaryInterface ];

makefu/1systems/wry.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
 
   external-ip = config.krebs.build.host.nets.internet.ip4.addr;

makefu/2configs/backup.nix

@@ -1,5 +1,5 @@
 { config, lib, ... }:
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   # preparation:
   # mkdir -p defaultBackupDir/host.name/src

makefu/2configs/base-gui.nix

@@ -11,7 +11,7 @@
 # if this is not enough, check out main-laptop.nix
 
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   mainUser = config.krebs.build.user.name;
 in

makefu/2configs/bepasty-dual.nix

@@ -10,7 +10,7 @@
 #   wildcard.krebsco.de.key
 #   bepasty-secret.nix     <- contains single string
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   sec = toString <secrets>;
   # secKey is nothing worth protecting on a local machine

makefu/2configs/collectd/collectd-base.nix

@@ -2,7 +2,7 @@
 
 # graphite-web on port 8080
 # carbon cache on port 2003 (tcp/udp)
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   connect-time-cfg = with pkgs; writeText "collectd-connect-time.cfg" ''
     LoadPlugin python

makefu/2configs/default.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 {
   imports = [
     {

makefu/2configs/deployment/mycube.connector.one.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 # more than just nginx config but not enough to become a module
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   hostname = config.krebs.build.host.name;
   external-ip = config.krebs.build.host.nets.internet.ip4.addr;

makefu/2configs/elchos/stats.nix

@@ -2,7 +2,7 @@
 
 # graphite-web on port 8080
 # carbon cache on port 2003 (tcp/udp)
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   sec = toString <secrets>;
   acmepath = "/var/lib/acme/";

makefu/2configs/exim-retiolum.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 {
   networking.firewall.allowedTCPPorts = [ 25 ];
 

makefu/2configs/filepimp-share.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
   hostname = config.krebs.build.host.name;
 in {

makefu/2configs/fs/cac-boot-partition.nix

@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 # vda1 ext4 (label nixos) -> only root partition
-with config.krebs.lib;
+with import <stockholm/lib>;
 {
   boot.loader.grub.enable = true;
   boot.loader.grub.version = 2;

makefu/2configs/fs/sda-crypto-root-home.nix

@@ -8,7 +8,7 @@
 #             /     (main-root)
 #             /home (main-home)
 
-with config.krebs.lib;
+with import <stockholm/lib>;
 {
 
   imports = [

makefu/2configs/fs/sda-crypto-root.nix

@@ -4,7 +4,7 @@
 # sda1: boot ext4 (label nixboot) - must be unlocked on boot if required:
   # boot.initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; allowDiscards=true; }];
 # sda2: cryptoluks -> ext4
-with config.krebs.lib;
+with import <stockholm/lib>;
 {
   boot = {
     loader.grub.enable = true;

makefu/2configs/fs/vm-single-partition.nix

@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 # vda1 ext4 (label nixos) -> only root partition
-with config.krebs.lib;
+with import <stockholm/lib>;
 {
   imports = [
     ./single-partition-ext4.nix

makefu/2configs/git/brain-retiolum.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 # TODO: remove tv lib :)
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
 
   repos = priv-repos // krebs-repos ;

makefu/2configs/git/cgit-retiolum.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 # TODO: remove tv lib :)
-with config.krebs.lib;
+with import <stockholm/lib>;
 let
 
   repos = priv-repos // krebs-repos // connector-repos ;