Mic92/stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

don't try to mimic nixpkgs

Browse Source
This commit is contained in:
tv 2016-02-15 16:27:11 +01:00
parent 673853e092
commit 8f520b19b6
55 changed files with 103 additions and 306 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Makefile
View File

@ -9,10 +9,11 @@ export target_path ?= /var/src
evaluate = \
nix-instantiate \
--arg configuration ./$(LOGNAME)/1systems/$(system).nix \
--eval \
--readonly-mode \
--show-trace \
-I nixos-config=./$(LOGNAME)/1systems/$(system).nix \
-I stockholm=. \
$(1)
execute = \

91
default.nix
View File

@ -1,86 +1,5 @@
{ configuration ? import (nixpkgs-path + "/nixos/lib/from-env.nix") "NIXOS_CONFIG" <nixos-config>
, system ? builtins.currentSystem
, current-host-name ?
let v = builtins.getEnv "HOSTNAME"; in
if v != "" then v else builtins.readFile /proc/sys/kernel/hostname
, current-user-name ?
let v = builtins.getEnv "LOGNAME"; in
if v != "" then v else abort "undefined variable: LOGNAME"
, nixpkgs-path ?
if (builtins.tryEval <nixpkgs/krebs>).success
then <upstream-nixpkgs>
else <nixpkgs>
, StrictHostKeyChecking ? "yes"
}@args:
let stockholm = {
inherit krebs;
inherit users;
inherit lib;
inherit config options pkgs;
system = config.system.build.toplevel;
};
krebs = import ./krebs (args // { inherit lib stockholm; });
lib = let
nlib = import (slib.npath "lib");
klib = import (slib.kpath "4lib") { lib = nlib; };
slib = rec {
nspath = ns: p: ./. + "/${ns}/${p}";
npath = p: nixpkgs-path + "/${p}";
kpath = nspath "krebs";
upath = nspath current-user-name;
};
ulib = let p = slib.upath "4lib"; in
nlib.optionalAttrs (klib.dir.has-default-nix p)
(import p { lib = nlib // klib; });
in nlib // klib // slib // ulib // builtins;
inherit (eval configuration) config options pkgs;
base-module = { config, ... }: {
imports = builtins.filter lib.dir.has-default-nix (lib.concatLists [
(map (f: f "2configs") [ lib.upath ])
(map (f: f "3modules") [ lib.kpath lib.upath ])
(map (f: f "5pkgs") [ lib.kpath lib.upath ])
]);
krebs.lib = lib;
krebs.current.enable = true;
krebs.current.host = config.krebs.hosts.${current-host-name};
krebs.current.user = config.krebs.users.${current-user-name};
};
eval = config: import (lib.npath "nixos/lib/eval-config.nix") {
inherit system;
specialArgs = {
inherit lib;
};
modules = [
base-module
config
];
};
# TODO move user namespaces' to users/, so no exception for krebs/ is needed
users =
lib.mapAttrs
(name: _: eval-all-systems (lib.nspath name "1systems"))
(lib.filterAttrs
(n: t: !lib.hasPrefix "." n && t == "directory" && n != "krebs")
(builtins.readDir ./.));
eval-all-systems = path:
lib.mapAttrs'
(n: _: (lib.nameValuePair (lib.removeSuffix ".nix" n)
(eval-system (path + "/${n}"))))
(builtins.readDir path);
eval-system = path: rec {
inherit (eval path) config options;
system = config.system.build.toplevel;
};
in stockholm
import <nixpkgs/nixos/lib/eval-config.nix> {
modules = [
(import <nixpkgs/nixos/lib/from-env.nix> "NIXOS_CONFIG" <nixos-config>)
];
}

4
krebs/3modules/lib.nix
View File

@ -3,9 +3,13 @@ with lib;
let
out = {
options.krebs.lib = api;
config = imp;
};
api = mkOption {
default = {};
type = types.attrs;
};
imp = {
krebs.lib = lib // import ../4lib { inherit lib; } // builtins;
};
in out

201
krebs/default.nix
View File

@ -1,193 +1,8 @@
assert false;
{ current-host-name
, current-user-name
, lib
, stockholm
, StrictHostKeyChecking ? "yes"
}:
let out = {
inherit infest;
inherit init;
inherit nixos-install;
};
infest =
{ system ? current-host-name
, target ? system
}@args: let
config = get-config system;
in ''
#! /bin/sh
# krebs.infest
set -efu
${rootssh target ''
${builtins.readFile ./4lib/infest/prepare.sh}
${builtins.readFile ./4lib/infest/install-nix.sh}
''}
(${nixos-install args})
${rootssh target ''
${builtins.readFile ./4lib/infest/finalize.sh}
''}
'';
init =
{ system ? current-host-name
}@args: let
config = get-config system;
in ''
#! /bin/sh
# krebs.init
set -efu
system=${lib.shell.escape system}
secrets_dir=${config.krebs.build.source.dir.secrets.path}
key_type=ed25519
key_file=$secrets_dir/ssh.id_$key_type
key_comment=$system
if test -e "$key_file"; then
echo "Warning: privkey already exists: $key_file" >&2
else
ssh-keygen \
-C "$key_comment" \
-t "$key_type" \
-f "$key_file" \
-N ""
rm "$key_file.pub"
fi
pubkey=$(ssh-keygen -y -f "$key_file")
cat<<EOF
# put following into config.krebs.hosts.$system:
ssh.privkey.path = <secrets/ssh.$key_type>;
ssh.pubkey = $(echo $pubkey | jq -R .);
EOF
'';
nixos-install =
{ system ? current-host-name
, target ? system
}@args: let
in ''
#! /bin/sh
# krebs.nixos-install
(${populate (args // { root = "/mnt"; })})
${rootssh target ''
export PATH; PATH=/root/.nix-profile/bin:$PATH
src=$(type -p nixos-install)
cat_src() {
sed < "$src" "$(
{ sed < "$src" -n '
/^if ! test -e "\$mountPoint\/\$NIXOS_CONFIG/,/^fi$/=
/^nixpkgs=/=
/^NIX_PATH=/,/^$/{/./=}
# Disable: Copy the NixOS/Nixpkgs sources to the target as
# the initial contents of the NixOS channel.
/^srcs=/,/^ln -sfn /=
'
} | sed 's:$:s/^/#krebs#/:'
)"
}
# Location to insert `nix-install`
i=$(sed -n '/^echo "building the system configuration/=' "$src")
{
cat_src | sed -n "1,$i{p}"
cat ${doc (nix-install args)}
cat_src | sed -n "$i,\''${$i!p}"
} > nixos-install
chmod +x nixos-install
# Wrap inserted nix-install into chroot.
nix_env=$(cat_src | sed -n '
s:.*\(/nix/store/[a-z0-9]*-nix-[0-9.]\+/bin/nix-env\).*:\1:p;T;q
')
echo "nix-env is $nix_env" >&2
findpkg() {(
name=$1
path=$(find /nix/store \
-mindepth 1 -maxdepth 1 -type d -name '*-'"$name"'-*' \
| head -n 1 | sed s:^/mnt::)
if echo "$path" | grep .; then
echo "$name is $path" >&2
else
echo "Error: package not found: $name" >&2
exit 1
fi
)}
cacert=$(findpkg cacert)
coreutils=$(findpkg coreutils)
cp "$cacert"/etc/ssl/certs/ca-bundle.crt /mnt/root/SSL_CERT_FILE
env="$coreutils/bin/env SSL_CERT_FILE=/root/SSL_CERT_FILE"
sed -i '
s:^NIX_PATH=:chroot $mountPoint '"$env"' &:
s:^nix-env:'"$nix_env"':
' nixos-install
./nixos-install
''}
'';
doc = s:
let b = "EOF${builtins.hashString "sha256" s}"; in
''
<<\${b}
${s}
${b}
'';
get-config = system: let
config = stockholm.users.${current-user-name}.${system}.config
or (abort "unknown system: ${system}, user: ${current-user-name}");
in config;
nix-install =
{ system ? current-host-name
, target ? system
}:
let
config = get-config system;
nix-path =
lib.concatStringsSep ":"
(lib.mapAttrsToList (name: src: "${name}=${src.target-path}")
(config.krebs.build.source.dir //
config.krebs.build.source.git));
in ''
set -efu
NIX_PATH=${lib.shell.escape nix-path} \
nix-env \
--show-trace \
-f '<stockholm>' \
--argstr current-host-name ${lib.shell.escape current-host-name} \
--argstr current-user-name ${lib.shell.escape current-user-name} \
--profile ${lib.shell.escape config.krebs.build.profile} \
--set \
-A ${lib.escapeShellArg (lib.concatStringsSep "." [
"users"
config.krebs.build.user.name
config.krebs.build.host.name
"system"
])}
'';
rootssh = target: script:
let
flags = "-o StrictHostKeyChecking=${StrictHostKeyChecking}";
in
"ssh ${flags} root@${target} -T ${doc ''
set -efu
${script}
''}";
in out
{ config, lib, pkgs, ... }:
with config.krebs.lib;
{
imports = [
./3modules
./5pkgs
];
}

1
lass/1systems/cloudkrebs.nix
View File

@ -7,6 +7,7 @@ let
ip = (head config.krebs.build.host.nets.internet.addrs4);
in {
imports = [
../.
../2configs/os-templates/CAC-CentOS-7-64bit.nix
../2configs/base.nix
../2configs/retiolum.nix

1
lass/1systems/dishfire.nix
View File

@ -2,6 +2,7 @@
{
imports = [
../.
<nixpkgs/nixos/modules/profiles/qemu-guest.nix>
../2configs/base.nix
../2configs/git.nix

1
lass/1systems/echelon.nix
View File

@ -7,6 +7,7 @@ let
ip = (head config.krebs.build.host.nets.internet.addrs4);
in {
imports = [
../.
../2configs/os-templates/CAC-CentOS-7-64bit.nix
../2configs/base.nix
../2configs/retiolum.nix

1
lass/1systems/helios.nix
View File

@ -3,6 +3,7 @@
with builtins;
{
imports = [
../.
../2configs/baseX.nix
../2configs/browsers.nix
../2configs/programs.nix

1
lass/1systems/mors.nix
View File

@ -2,6 +2,7 @@
{
imports = [
../.
../2configs/baseX.nix
../2configs/programs.nix
../2configs/bitcoin.nix

1
lass/1systems/prism.nix
View File

@ -6,6 +6,7 @@ let
ip = (head config.krebs.build.host.nets.internet.addrs4);
in {
imports = [
../.
../2configs/base.nix
../2configs/downloading.nix
../2configs/git.nix

1
lass/1systems/uriel.nix
View File

@ -3,6 +3,7 @@
with builtins;
{
imports = [
../.
../2configs/baseX.nix
../2configs/browsers.nix
../2configs/games.nix

4
lass/2configs/base.nix
View File

@ -50,12 +50,10 @@ with config.krebs.lib;
user = config.krebs.users.lass;
source = mapAttrs (_: mkDefault) ({
nixos-config = "symlink:stockholm/lass/1systems/${config.krebs.build.host.name}.nix";
nixpkgs = symlink:stockholm/nixpkgs;
secrets = "/home/lass/secrets/${config.krebs.build.host.name}";
#secrets-common = "/home/lass/secrets/common";
stockholm = "/home/lass/stockholm";
stockholm-user = "symlink:stockholm/lass";
upstream-nixpkgs = {
nixpkgs = {
url = https://github.com/Lassulus/nixpkgs;
rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce";
dev = "/home/lass/src/nixpkgs";

3
lass/3modules/dnsmasq.nix
View File

@ -1,6 +1,7 @@
{ config, lib, pkgs, ... }:
with config.krebs.lib;
with builtins;
with lib;
let
cfg = config.lass.dnsmasq;

3
lass/3modules/newsbot-js.nix
View File

@ -1,6 +1,7 @@
{ config, lib, pkgs, ... }:
with config.krebs.lib;
with builtins;
with lib;
let
cfg = config.lass.newsbot-js;

7
lass/default.nix Normal file
View File

@ -0,0 +1,7 @@
_:
{
imports = [
../krebs
./3modules
];
}

1
makefu/1systems/filepimp.nix
View File

@ -11,6 +11,7 @@ let
in {
imports =
[ # Include the results of the hardware scan.
../.
../2configs/fs/single-partition-ext4.nix
../2configs/tinc-basic-retiolum.nix
../2configs/smart-monitor.nix

1
makefu/1systems/gum.nix
View File

@ -6,6 +6,7 @@ let
internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
in {
imports = [
../.
../2configs/tinc-basic-retiolum.nix
../2configs/headless.nix
../2configs/fs/simple-swap.nix

1
makefu/1systems/omo.nix
View File

@ -20,6 +20,7 @@ let
in {
imports =
[
../.
# TODO: unlock home partition via ssh
../2configs/fs/single-partition-ext4.nix
../2configs/tinc-basic-retiolum.nix

1
makefu/1systems/pnp.nix
View File

@ -6,6 +6,7 @@
{
imports =
[
../.
../2configs/tinc-basic-retiolum.nix
../2configs/headless.nix
../../krebs/3modules/Reaktor.nix

1
makefu/1systems/pornocauster.nix
View File

@ -6,6 +6,7 @@
{
imports =
[ # Include the results of the hardware scan.
../.
../2configs/main-laptop.nix #< base-gui + zsh
# Krebs

1
makefu/1systems/repunit.nix
View File

@ -7,6 +7,7 @@
{
imports =
[ # Include the results of the hardware scan.
../.
<nixpkgs/nixos/modules/profiles/qemu-guest.nix>
../2configs/cgit-retiolum.nix
];

1
makefu/1systems/tsp.nix
View File

@ -6,6 +6,7 @@
{
imports =
[ # Include the results of the hardware scan.
../.
../2configs/base-gui.nix
../2configs/tinc-basic-retiolum.nix
../2configs/fs/sda-crypto-root.nix

1
makefu/1systems/vbob.nix
View File

@ -6,6 +6,7 @@
krebs.build.host = config.krebs.hosts.vbob;
imports =
[ # Include the results of the hardware scan.
../.
<nixpkgs/nixos/modules/virtualisation/virtualbox-image.nix>
../2configs/main-laptop.nix #< base-gui

1
makefu/1systems/wbob.nix
View File

@ -2,6 +2,7 @@
{
imports =
[ # Include the results of the hardware scan.
../.
../2configs/main-laptop.nix
];
krebs = {

1
makefu/1systems/wry.nix
View File

@ -7,6 +7,7 @@ let
internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
in {
imports = [
../.
# TODO: copy this config or move to krebs
../../tv/2configs/hw/CAC.nix
../../tv/2configs/fs/CAC-CentOS-7-64bit.nix

4
makefu/2configs/default.nix
View File

@ -21,7 +21,7 @@ with config.krebs.lib;
target = mkDefault "root@${config.krebs.build.host.name}";
user = config.krebs.users.makefu;
source = mapAttrs (_: mkDefault) {
upstream-nixpkgs = {
nixpkgs = {
url = https://github.com/nixos/nixpkgs;
rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; # unstable @ 2015-01-27, tested on wry
};
@ -30,8 +30,6 @@ with config.krebs.lib;
# Defaults for all stockholm users?
nixos-config = "symlink:stockholm/${config.krebs.build.user.name}/1systems/${config.krebs.build.host.name}.nix";
nixpkgs = symlink:stockholm/nixpkgs;
stockholm-user = "symlink:stockholm/${config.krebs.build.user.name}";
};
};
};

8
makefu/default.nix Normal file
View File

@ -0,0 +1,8 @@
_:
{
imports = [
../krebs
./2configs
./3modules
];
}

2
miefda/1systems/bobby.nix
View File

@ -7,7 +7,7 @@
{
imports =
[ # Include the results of the hardware scan.
../.
../2configs/miefda.nix
../2configs/tlp.nix
../2configs/x220t.nix

6
miefda/default.nix Normal file
View File

@ -0,0 +1,6 @@
_:
{
imports = [
../krebs
];
}

1
mv/1systems/stro.nix
View File

@ -9,6 +9,7 @@ with config.krebs.lib;
"7ae05edcdd14f6ace83ead9bf0d114e97c89a83a";
imports = [
../.
../2configs/hw/x220.nix
../2configs/git.nix
../2configs/mail-client.nix

6
nixpkgs/default.nix
View File

@ -1,6 +0,0 @@
{ system ? builtins.currentSystem }:
(import <stockholm> {
inherit system;
configuration = {};
}).pkgs

0
nixpkgs/krebs
View File

1
nixpkgs/lib
View File

@ -1 +0,0 @@
../../upstream-nixpkgs/lib

1
nixpkgs/nixos/default.nix
View File

@ -1 +0,0 @@
import <stockholm>

1
nixpkgs/nixos/lib
View File

@ -1 +0,0 @@
../../../upstream-nixpkgs/nixos/lib

1
nixpkgs/nixos/modules
View File

@ -1 +0,0 @@
../../../upstream-nixpkgs/nixos/modules

1
root
View File

@ -1 +0,0 @@
../stockholm-user

3
shared/1systems/test-all-krebs-modules.nix
View File

@ -2,6 +2,9 @@
let
en = { enable = true;};
in {
imports = [
../.
];
krebs = {
enable = true;
build.user = config.krebs.users.shared;

1
shared/1systems/test-arch.nix
View File

@ -2,6 +2,7 @@
{
imports = [
../.
../2configs/base.nix
{
boot.loader.grub = {

1
shared/1systems/test-centos6.nix
View File

@ -7,6 +7,7 @@ let
gw = "168.235.148.1";
in {
imports = [
../.
../2configs/base.nix
../2configs/os-templates/CAC-CentOS-6.5-64bit.nix
{

1
shared/1systems/test-centos7.nix
View File

@ -5,6 +5,7 @@ let
in {
imports = [
../.
../2configs/base.nix
../2configs/os-templates/CAC-CentOS-7-64bit.nix
../2configs/temp/networking.nix

3
shared/1systems/test-failing.nix
View File

@ -1,6 +1,9 @@
{ config, pkgs, ... }:
{
imports = [
../.
];
programs.ssh.startAgent = true;
programs.ssh.startAgent = false;
}

3
shared/1systems/test-minimal-deploy.nix
View File

@ -1,5 +1,8 @@
{ config, pkgs, lib, ... }:
{
imports = [
../.
];
krebs = {
enable = true;
build.user = config.krebs.users.shared;

1
shared/1systems/wolf.nix
View File

@ -6,6 +6,7 @@ let
in
{
imports = [
../.
../2configs/base.nix
<nixpkgs/nixos/modules/profiles/qemu-guest.nix>
../2configs/collectd-base.nix

4
shared/2configs/base.nix
View File

@ -16,7 +16,7 @@ with config.krebs.lib;
# TODO rename shared user to "krebs"
krebs.build.user = mkDefault config.krebs.users.shared;
krebs.build.source = {
upstream-nixpkgs = mkDefault {
nixpkgs = mkDefault {
url = https://github.com/NixOS/nixpkgs;
rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; # for urlwatch-minidb
};
@ -24,8 +24,6 @@ with config.krebs.lib;
stockholm = mkDefault "${getEnv "HOME"}/stockholm";
nixos-config = "symlink:stockholm/${config.krebs.build.user.name}/1systems/${config.krebs.build.host.name}.nix";
nixpkgs = symlink:stockholm/nixpkgs;
stockholm-user = "symlink:stockholm/${config.krebs.build.user.name}";
};
networking.hostName = config.krebs.build.host.name;

7
shared/default.nix Normal file
View File

@ -0,0 +1,7 @@
_:
{
imports = [
../krebs
./3modules
];
}

1
tv/1systems/cd.nix
View File

@ -6,6 +6,7 @@ with config.krebs.lib;
krebs.build.host = config.krebs.hosts.cd;
imports = [
../.
../2configs/hw/CAC-Developer-2.nix
../2configs/fs/CAC-CentOS-7-64bit.nix
../2configs/exim-smarthost.nix

1
tv/1systems/mkdir.nix
View File

@ -19,6 +19,7 @@ in
krebs.build.host = config.krebs.hosts.mkdir;
imports = [
../.
../2configs/hw/CAC-Developer-1.nix
../2configs/fs/CAC-CentOS-7-64bit.nix
../2configs/exim-smarthost.nix

1
tv/1systems/nomic.nix
View File

@ -6,6 +6,7 @@ with config.krebs.lib;
krebs.build.host = config.krebs.hosts.nomic;
imports = [
../.
../2configs/hw/AO753.nix
../2configs/exim-retiolum.nix
../2configs/git.nix

1
tv/1systems/rmdir.nix
View File

@ -19,6 +19,7 @@ in
krebs.build.host = config.krebs.hosts.rmdir;
imports = [
../.
../2configs/hw/CAC-Developer-1.nix
../2configs/fs/CAC-CentOS-7-64bit.nix
../2configs/exim-smarthost.nix

1
tv/1systems/wu.nix
View File

@ -6,6 +6,7 @@ with config.krebs.lib;
krebs.build.host = config.krebs.hosts.wu;
imports = [
../.
../2configs/hw/w110er.nix
../2configs/exim-retiolum.nix
../2configs/git.nix

1
tv/1systems/xu-qemu0.nix
View File

@ -10,6 +10,7 @@
krebs.build.host = config.krebs.hosts.xu-qemu0;
imports = [
../.
<nixpkgs/nixos/modules/profiles/qemu-guest.nix>
];

1
tv/1systems/xu.nix
View File

@ -6,6 +6,7 @@ with config.krebs.lib;
krebs.build.host = config.krebs.hosts.xu;
imports = [
../.
../2configs/hw/x220.nix
../2configs/exim-retiolum.nix
../2configs/git.nix

4
tv/2configs/default.nix
View File

@ -9,12 +9,10 @@ with config.krebs.lib;
user = config.krebs.users.tv;
source = mapAttrs (_: mkDefault) ({
nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix";
nixpkgs = symlink:stockholm/nixpkgs;
secrets = "/home/tv/secrets/${config.krebs.build.host.name}";
secrets-common = "/home/tv/secrets/common";
stockholm = "/home/tv/stockholm";
stockholm-user = "symlink:stockholm/tv";
upstream-nixpkgs = {
nixpkgs = {
url = https://github.com/NixOS/nixpkgs;
rev = "77f8f35d57618c1ba456d968524f2fb2c3448295";
dev = "/home/tv/nixpkgs";

9
tv/default.nix Normal file
View File

@ -0,0 +1,9 @@
_:
{
imports = [
../krebs
./2configs
./3modules
./5pkgs
];
}