Merge remote-tracking branch 'cd/master'

This commit is contained in:
tv 2015-11-07 09:48:06 +01:00
commit 8ad05d0f40
13 changed files with 111 additions and 125 deletions

View File

@ -32,7 +32,10 @@ let stockholm = {
upath = lib.nspath current-user-name; upath = lib.nspath current-user-name;
base-module = { config, ... }: { base-module = { config, ... }: {
imports = map (f: f "3modules") [ kpath upath ]; imports = builtins.filter builtins.pathExists (lib.concatLists [
(map (f: f "2configs") [ upath ])
(map (f: f "3modules") [ kpath upath ])
]);
krebs.current.enable = true; krebs.current.enable = true;
krebs.current.host = config.krebs.hosts.${current-host-name}; krebs.current.host = config.krebs.hosts.${current-host-name};

View File

@ -29,10 +29,13 @@ let
}; };
options.krebs.build.source.dir = mkOption { options.krebs.build.source.dir = mkOption {
type = types.attrsOf (types.submodule ({ config, ... }: { type = let
default-host = config.krebs.current.host;
in types.attrsOf (types.submodule ({ config, ... }: {
options = { options = {
host = mkOption { host = mkOption {
type = types.host; type = types.host;
default = default-host;
}; };
path = mkOption { path = mkOption {
type = types.str; type = types.str;

View File

@ -15,6 +15,7 @@ let
./git.nix ./git.nix
./iptables.nix ./iptables.nix
./nginx.nix ./nginx.nix
./per-user.nix
./Reaktor.nix ./Reaktor.nix
./retiolum-bootstrap.nix ./retiolum-bootstrap.nix
./realwallpaper.nix ./realwallpaper.nix

View File

@ -0,0 +1,35 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.krebs.per-user;
out = {
options.krebs.per-user = api;
config = imp;
};
api = mkOption {
type = with types; attrsOf (submodule {
options = {
packages = mkOption {
type = listOf path;
default = [];
};
};
});
default = {};
};
imp = {
environment = {
etc = flip mapAttrs' cfg (name: { packages, ... }: {
name = "per-user/${name}";
value.source = pkgs.symlinkJoin "per-user.${name}" packages;
});
profiles = ["/etc/per-user/$LOGNAME"];
};
};
in out

View File

@ -14,11 +14,9 @@ with lib;
rev = "c44a593aa43bba6a0708f6f36065a514a5110613"; rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
}; };
dir.secrets = { dir.secrets = {
host = config.krebs.hosts.wu;
path = "/home/tv/secrets/cd"; path = "/home/tv/secrets/cd";
}; };
dir.stockholm = { dir.stockholm = {
host = config.krebs.hosts.wu;
path = "/home/tv/stockholm"; path = "/home/tv/stockholm";
}; };
}; };
@ -26,7 +24,6 @@ with lib;
imports = [ imports = [
../2configs/hw/CAC-Developer-2.nix ../2configs/hw/CAC-Developer-2.nix
../2configs/fs/CAC-CentOS-7-64bit.nix ../2configs/fs/CAC-CentOS-7-64bit.nix
../2configs/base.nix
#../2configs/consul-server.nix #../2configs/consul-server.nix
../2configs/exim-smarthost.nix ../2configs/exim-smarthost.nix
../2configs/git.nix ../2configs/git.nix

View File

@ -17,29 +17,12 @@ in
{ {
krebs.build.host = config.krebs.hosts.mkdir; krebs.build.host = config.krebs.hosts.mkdir;
krebs.build.user = config.krebs.users.tv;
krebs.build.target = "root@${primary-addr4}"; krebs.build.target = "root@${primary-addr4}";
krebs.build.source = {
git.nixpkgs = {
url = https://github.com/NixOS/nixpkgs;
rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
};
dir.secrets = {
host = config.krebs.hosts.wu;
path = "/home/tv/secrets/mkdir";
};
dir.stockholm = {
host = config.krebs.hosts.wu;
path = "/home/tv/stockholm";
};
};
imports = [ imports = [
../2configs/hw/CAC-Developer-1.nix ../2configs/hw/CAC-Developer-1.nix
../2configs/fs/CAC-CentOS-7-64bit.nix ../2configs/fs/CAC-CentOS-7-64bit.nix
../2configs/base.nix
../2configs/consul-server.nix ../2configs/consul-server.nix
../2configs/exim-smarthost.nix ../2configs/exim-smarthost.nix
../2configs/git.nix ../2configs/git.nix

View File

@ -4,28 +4,11 @@ with lib;
{ {
krebs.build.host = config.krebs.hosts.nomic; krebs.build.host = config.krebs.hosts.nomic;
krebs.build.user = config.krebs.users.tv;
krebs.build.target = "root@nomic.gg23"; krebs.build.target = "root@nomic.gg23";
krebs.build.source = {
git.nixpkgs = {
url = https://github.com/NixOS/nixpkgs;
rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
};
dir.secrets = {
host = config.krebs.hosts.wu;
path = "/home/tv/secrets/nomic";
};
dir.stockholm = {
host = config.krebs.hosts.wu;
path = "/home/tv/stockholm";
};
};
imports = [ imports = [
../2configs/hw/AO753.nix ../2configs/hw/AO753.nix
../2configs/base.nix
#../2configs/consul-server.nix #../2configs/consul-server.nix
../2configs/git.nix ../2configs/git.nix
{ {

View File

@ -17,29 +17,12 @@ in
{ {
krebs.build.host = config.krebs.hosts.rmdir; krebs.build.host = config.krebs.hosts.rmdir;
krebs.build.user = config.krebs.users.tv;
krebs.build.target = "root@rmdir.internet"; krebs.build.target = "root@rmdir.internet";
krebs.build.source = {
git.nixpkgs = {
url = https://github.com/NixOS/nixpkgs;
rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
};
dir.secrets = {
host = config.krebs.hosts.wu;
path = "/home/tv/secrets/rmdir";
};
dir.stockholm = {
host = config.krebs.hosts.wu;
path = "/home/tv/stockholm";
};
};
imports = [ imports = [
../2configs/hw/CAC-Developer-1.nix ../2configs/hw/CAC-Developer-1.nix
../2configs/fs/CAC-CentOS-7-64bit.nix ../2configs/fs/CAC-CentOS-7-64bit.nix
../2configs/base.nix
../2configs/consul-server.nix ../2configs/consul-server.nix
../2configs/exim-smarthost.nix ../2configs/exim-smarthost.nix
../2configs/git.nix ../2configs/git.nix

View File

@ -4,34 +4,14 @@ with lib;
{ {
krebs.build.host = config.krebs.hosts.wu; krebs.build.host = config.krebs.hosts.wu;
krebs.build.user = config.krebs.users.tv;
krebs.build.target = "root@wu";
krebs.build.source = {
git.nixpkgs = {
url = https://github.com/NixOS/nixpkgs;
rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
target-path = "/var/src/nixpkgs";
};
dir.secrets = {
host = config.krebs.hosts.wu;
path = "/home/tv/secrets/wu";
};
dir.stockholm = {
host = config.krebs.hosts.wu;
path = "/home/tv/stockholm";
target-path = "/var/src/stockholm";
};
};
imports = [ imports = [
../2configs/hw/w110er.nix ../2configs/hw/w110er.nix
../2configs/base.nix
#../2configs/consul-client.nix #../2configs/consul-client.nix
../2configs/git.nix ../2configs/git.nix
../2configs/mail-client.nix ../2configs/mail-client.nix
../2configs/xserver ../2configs/xserver
../2configs/z.nix
{ {
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
@ -287,16 +267,6 @@ with lib;
onion = { onion = {
uid = 6660010; uid = 6660010;
}; };
zalora = {
uid = 1000301;
extraGroups = [
"audio"
# TODO remove vboxusers when hardening is active
"vboxusers"
"video"
];
};
}; };
security.sudo.extraConfig = security.sudo.extraConfig =

View File

@ -4,32 +4,14 @@ with lib;
{ {
krebs.build.host = config.krebs.hosts.xu; krebs.build.host = config.krebs.hosts.xu;
krebs.build.user = config.krebs.users.tv;
krebs.build.target = "root@xu";
krebs.build.source = {
git.nixpkgs = {
url = https://github.com/NixOS/nixpkgs;
rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
};
dir.secrets = {
host = config.krebs.hosts.wu;
path = "/home/tv/secrets/xu";
};
dir.stockholm = {
host = config.krebs.hosts.wu;
path = "/home/tv/stockholm";
};
};
imports = [ imports = [
../2configs/hw/x220.nix ../2configs/hw/x220.nix
../2configs/base.nix
#../2configs/consul-client.nix #../2configs/consul-client.nix
../2configs/git.nix ../2configs/git.nix
../2configs/mail-client.nix ../2configs/mail-client.nix
../2configs/xserver ../2configs/xserver
../2configs/z.nix
{ {
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
@ -286,16 +268,6 @@ with lib;
onion = { onion = {
uid = 6660010; uid = 6660010;
}; };
zalora = {
uid = 1000301;
extraGroups = [
"audio"
# TODO remove vboxusers when hardening is active
"vboxusers"
"video"
];
};
}; };
security.sudo.extraConfig = security.sudo.extraConfig =

View File

@ -1,11 +1,29 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
with builtins;
with lib; with lib;
{ {
krebs.enable = true; krebs.enable = true;
krebs.build = {
user = config.krebs.users.tv;
target = mkDefault "root@${config.krebs.build.host.name}";
source = {
git.nixpkgs = {
url = mkDefault https://github.com/NixOS/nixpkgs;
rev = mkDefault "c44a593aa43bba6a0708f6f36065a514a5110613";
target-path = mkDefault "/var/src/nixpkgs";
};
dir.secrets = {
path = mkDefault "/home/tv/secrets/${config.krebs.build.host.name}";
};
dir.stockholm = {
path = mkDefault "/home/tv/stockholm";
target-path = mkDefault "/var/src/stockholm";
};
};
};
networking.hostName = config.krebs.build.host.name; networking.hostName = config.krebs.build.host.name;
imports = [ imports = [
@ -22,6 +40,9 @@ with lib;
mapAttrs (_: h: { hashedPassword = h; }) mapAttrs (_: h: { hashedPassword = h; })
(import <secrets/hashedPasswords.nix>); (import <secrets/hashedPasswords.nix>);
} }
{
users.groups.subusers.gid = 1093178926; # genid subusers
}
{ {
users.defaultUserShell = "/run/current-system/sw/bin/bash"; users.defaultUserShell = "/run/current-system/sw/bin/bash";
users.mutableUsers = false; users.mutableUsers = false;
@ -31,6 +52,7 @@ with lib;
root = { root = {
openssh.authorizedKeys.keys = [ openssh.authorizedKeys.keys = [
config.krebs.users.tv.pubkey config.krebs.users.tv.pubkey
config.krebs.users.tv_xu.pubkey
]; ];
}; };
tv = { tv = {
@ -69,6 +91,8 @@ with lib;
nix.useChroot = true; nix.useChroot = true;
} }
{ {
environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
rxvt_unicode.terminfo rxvt_unicode.terminfo
]; ];

View File

@ -70,14 +70,6 @@ let
ExecStart = "${xserver}/bin/xserver"; ExecStart = "${xserver}/bin/xserver";
}; };
}; };
programs.bash.interactiveShellInit = ''
case ''${XMONAD_SPAWN_WORKSPACE-} in
za|zh|zj|zs)
exec sudo -u zalora -i
;;
esac
'';
}; };
xmonad-environment = { xmonad-environment = {

40
tv/2configs/z.nix Normal file
View File

@ -0,0 +1,40 @@
{ config, lib, pkgs, ... }:
with lib;
{
krebs.per-user.z.packages = [
(pkgs.writeScriptBin "cr" ''
#! /bin/sh
set -efu
export LC_TIME=de_DE.utf8
exec ${pkgs.chromium}/bin/chromium \
--ssl-version-min=tls1 \
--disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \
--disk-cache-size=50000000 \
"%@"
'')
];
programs.bash.interactiveShellInit = ''
case ''${XMONAD_SPAWN_WORKSPACE-} in
za|zh|zj|zs)
exec sudo -u z -i
;;
esac
'';
security.sudo.extraConfig = "tv ALL=(z) NOPASSWD: ALL";
users.users.z = {
extraGroups = [
"audio"
"vboxusers"
"video"
];
group = "subusers";
home = "/home/z";
uid = 3043726074; # genid z
useDefaultShell = true;
};
}