From e3f0ca7137b8b94c87f008c200fecb4042a7ec38 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 15 Mar 2016 15:58:45 +0100 Subject: [PATCH 01/17] krebs.on-failure: init --- krebs/3modules/default.nix | 1 + krebs/3modules/on-failure.nix | 91 +++++++++++++++++++++++++++++++++++ 2 files changed, 92 insertions(+) create mode 100644 krebs/3modules/on-failure.nix diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index bdd9049cb..77fb3d61c 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -23,6 +23,7 @@ let ./lib.nix ./nginx.nix ./nixpkgs.nix + ./on-failure.nix ./os-release.nix ./per-user.nix ./Reaktor.nix diff --git a/krebs/3modules/on-failure.nix b/krebs/3modules/on-failure.nix new file mode 100644 index 000000000..13d561b8d --- /dev/null +++ b/krebs/3modules/on-failure.nix @@ -0,0 +1,91 @@ +{ config, lib, pkgs, ... }: with config.krebs.lib; let + out = { + options.krebs.on-failure = api; + config = lib.mkIf cfg.enable imp; + }; + + cfg = config.krebs.on-failure; + + api = { + enable = mkEnableOption "krebs.on-failure" // { + default = cfg.plans != {}; + }; + plans = mkOption { + default = {}; + type = let + inherit (config) krebs; + in types.attrsOf (types.submodule ({ config, ... }: { + options = { + enable = mkEnableOption "krebs.on-failure.${config.name}" // { + default = true; + }; + journalctl = { + lines = mkOption { + type = types.int; + default = 100; + }; + output = mkOption { + type = types.enum [ + "cat" + "export" + "json" + "json-pretty" + "json-sse" + "short" + "short-iso" + "short-precise" + "verbose" + ]; + default = "short-iso"; + }; + }; + mailto = mkOption { + type = types.str; + default = krebs.build.user.mail; + description = "Mail address to send journal extract to."; + }; + subject = mkOption { + type = types.str; + default = "[${krebs.build.host.name}] ${config.name} has failed"; + }; + name = mkOption { + type = types.str; + default = config._module.args.name; + description = "Name of the to-be-monitored service."; + }; + }; + })); + }; + sendmail = mkOption { + type = types.str; + default = "/var/setuid-wrappers/sendmail"; + }; + }; + + imp = { + systemd.services = foldl (a: b: a // b) {} (map to-services enabled-plans); + }; + + enabled-plans = filter (getAttr "enable") (attrValues cfg.plans); + + to-services = plan: { + "${plan.name}".unitConfig.OnFailure = "on-failure.${plan.name}.service"; + "on-failure.${plan.name}".serviceConfig = rec { + ExecStart = start plan; + SyslogIdentifier = ExecStart.name; + Type = "oneshot"; + }; + }; + + start = plan: pkgs.writeDash "on-failure.${plan.name}" '' + { echo Subject: ${shell.escape plan.subject} + echo To: ${shell.escape plan.mailto} + echo + ${pkgs.systemd}/bin/journalctl \ + --lines=${toString plan.journalctl.lines} \ + --output=${plan.journalctl.output} \ + --unit=${shell.escape plan.name}.service + } | ${shell.escape cfg.sendmail} -t + ''; + +in out From 13df24f8f09469c32077ded463d99033042e25ee Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 15 Mar 2016 15:59:05 +0100 Subject: [PATCH 02/17] krebs.backup: use krebs.on-failure --- krebs/3modules/backup.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix index 97082f56a..d22dd3810 100644 --- a/krebs/3modules/backup.nix +++ b/krebs/3modules/backup.nix @@ -60,6 +60,12 @@ let }; imp = { + krebs.on-failure.plans = + listToAttrs (map (plan: nameValuePair "backup.${plan.name}" { + }) (filter (plan: build-host-is "pull" "dst" plan || + build-host-is "push" "src" plan) + enabled-plans)); + systemd.services = listToAttrs (map (plan: nameValuePair "backup.${plan.name}" { # TODO if there is plan.user, then use its privkey From fa67e6ff08237a067975275046aa6dae808859f6 Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 15 Mar 2016 23:54:53 +0100 Subject: [PATCH 03/17] k 3 nginx: add default404 option the default behavior is not changed but if the default does not apply to your use-case you now can change it --- krebs/3modules/nginx.nix | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix index 2aa023443..57774cfc0 100644 --- a/krebs/3modules/nginx.nix +++ b/krebs/3modules/nginx.nix @@ -12,6 +12,20 @@ let api = { enable = mkEnableOption "krebs.nginx"; + default404 = mkOption { + type = types.bool; + default = true; + description = '' + By default all requests not directed to an explicit hostname are + replied with a 404 error to avoid accidental exposition of nginx + services. + + Set this value to `false` to disable this behavior - you will then be + able to configure a new `default_server` in the listen address entries + again. + ''; + }; + servers = mkOption { type = types.attrsOf (types.submodule { options = { @@ -53,17 +67,19 @@ let sendfile on; keepalive_timeout 65; gzip on; - server { - listen 80 default_server; - server_name _; - return 404; - } + + ${optionalString cfg.default404 '' + server { + listen 80 default_server; + server_name _; + return 404; + }''} + ${concatStrings (mapAttrsToList (_: to-server) cfg.servers)} ''; }; }; - indent = replaceChars ["\n"] ["\n "]; to-location = { name, value }: '' From 03a72ef958055c958992c4fbde618c1e68bfff6e Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 15 Mar 2016 23:56:05 +0100 Subject: [PATCH 04/17] add new retiolum short form to default hostnames --- krebs/3modules/nginx.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix index 57774cfc0..8d0704e8c 100644 --- a/krebs/3modules/nginx.nix +++ b/krebs/3modules/nginx.nix @@ -34,6 +34,7 @@ let # TODO use identity default = [ "${config.networking.hostName}" + "${config.networking.hostName}.r" "${config.networking.hostName}.retiolum" ]; }; From 91844576fd201c628e070761be1eaffe3e40eca8 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 16 Mar 2016 00:49:32 +0100 Subject: [PATCH 05/17] krebs.users.tv.pgp.pubkey: 2CAEE3B5 --- krebs/3modules/tv/default.nix | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index a0237d361..dd1f0d289 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -357,6 +357,35 @@ with config.krebs.lib; }; tv = { mail = "tv@nomic.retiolum"; + pgp.pubkey = '' + -----BEGIN PGP PUBLIC KEY BLOCK----- + mQINBFbJ/B0BEADZx8l5gRurzhEHcc3PbBepdZqDJQZ2cGHixi8VEk9iN25qJO5y + HB0q5sQRsh7oNCbzKp6qRhaG9kXmEda+Uu+qbHWxE32QcT76+W8npH73qthaFwC/ + 5RA8KcSE8/XFxVBnVb14PNVHyAVxPHawawbhsOeaiZcHrq5IF6sVzcsc2KN87sIE + SthR4E01LBK4AFeFuKxga9OKFQV5WJNrihu+6H4wZwUfMpbE552N1rggxT4CouqZ + RocSg+el/aPRj3Jk9jDe/JFv4HU7KfioOD+NO8xLAkyw3aLsu/bv9nfUvcvTGeRp + z31UOjpNYpT3PS0+lNCUKQKUadAmhwU95V/0GdhadgxCFcS65qNO7ZZYDJqMIT2y + YH1d9MaVPDQD9W2v0ITCJcrks9p47o+C8zzDlcVr2VEGrTSngRDkWVNYjKwd3L8w + HuaTarqOprLzeZ6yblcLVOrW8tGTmxum0jB4Fn3enpTyJNzCfp6c0CoYp/ZziQ82 + 2jgLWuqKv3EKhX9aCUUgbeDFhnsM3GzdT5qYupX7UyWTLfiUlAEUQUgtyM7yBUNN + PsD5OeYeRQ/xFzUO30kglbjXOOUQpm7kyX38OJA01JdOOhXNI7BTvkFZsJzBLoVM + AdK3LvF4Rjau3HzYqL1Cr0ai1Y9jZVXP3vimcvUcI9bTRg9pMfD8LekiQQARAQAB + tAl0diA8dHZAcj6JAj0EEwEIACcFAlbJ/B0CGwMFCQHhM4AFCwkIBwIGFQgJCgsC + BBYCAwECHgECF4AACgkQJdgKWiyu47Xwow//ZS6Y1UcTDxHa066AQxL5UWL86Jj4 + pIw3k630384VrUlStP+OcwOSwa4igvyIUPrOhVLynkijNsutg6KAVi8BrtSZ8ZcP + 58gnyCPCQG4Ir0cSanp/GxMxfHKdEMyfMOopTLusLBa55VPr7sYrNi7WY20aojjJ + 05bviSrFv0+u9dEJGmCChLDv+IhHJDe4zXHbmwspGDMwlhy/E/clSZG7a1yoJjLf + DpqRVn8KmICqMX0lvBP6fsS51pSD0n82kCpedLZmnwYEHCp+Bkx/Cla7aS33N1+n + 5CUAR6HQvPT91LsLK/h/BKZ+SHAg4j7hANSfMFO+/0A5pby3JBo6Fck0LvrEMyog + 6oGedzszZztO1eSJ5h0UQlowD4g0Y7wlWrR8znvdO1gBxQpGIjZXKqGRcuIPNZpu + lgqIXw/pX6b0CWh2GsbHGE0FfIkBkgW2A2akA8cGEiKqOdp/kP4o7VGCLI5iZXZA + ZY405gOo3ePTTRJ3zxF7YFRzjMhTlc6KtLiA9/Wps67lrOU0w/O8Dd+zYxmZoani + lnXaqOj32/UCW76fZ+ovUzKP2lav5wf3tpJeekjV5Zs5dNpAYmrK6EuW7LvUg5lm + 7i5yz8yuD/xU6R3o1FycogDU6H0JtdFDYTJI9gd5EzNe3UNUEzBJF1yqQFwiW6xY + 3yFvks3C6e58YNE= + =Sqyp + -----END PGP PUBLIC KEY BLOCK----- + ''; pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDFR//RnCvEZAt0F6ExDsatKZ/DDdifanuSL360mqOhaFieKI34RoOwfQT9T+Ga52Vh5V2La6esvlph686EdgzeKLvDoxEwFM9ZYFBcMrNzu4bMTlgE7YUYw5JiORyXNfznBGnme6qpuvx9ibYhUyiZo99kM8ys5YrUHrP2JXQJMezDFZHxT4GFMOuSdh/1daGoKKD6hYL/jEHX8CI4E3BSmKK6ygYr1fVX0K0Tv77lIi5mLXucjR7CytWYWYnhM6DC3Hxpv2zRkPgf3k0x/Y1hrw3V/r0Me5h90pd2C8pFaWA2ZoUT/fmyVqvx1tZPYToU/O2dMItY0zgx2kR0yD+6g7Aahz3R+KlXkV8k5c8bbTbfGnZWDR1ZlbLRM9Yt5vosfwapUD90MmVkpmR3wUkO2sUKi80QfC7b4KvSDXQ+MImbGxMaU5Bnsq1PqLN95q+uat3nlAVBAELkcx51FlE9CaIS65y4J7FEDg8BE5JeuCNshh62VSYRXVSFt8bk3f/TFGgzC8OIo14BhVmiRQQ503Z1sROyf5xLX2a/EJavMm1i2Bs2TH6ROKY9z5Pz8hT5US0r381V8oG7TZyLF9HTtoy3wCYsgWA5EmLanjAsVU2YEeAA0rxzdtYP8Y2okFiJ6u+M4HQZ3Wg3peSodyp3vxdYce2vk4EKeqEFuuS82850DYb7Et7fmp+wQQUT8Q/bMO0DreWjHoMM5lE4LJ4ME6AxksmMiFtfo/4Fe2q9D+LAqZ+ANOcv9M+8Rn6ngiYmuRNd0l/a02q1PEvO6vTfXgcl4f7Z1IULHPEaDNZHCJS1K5RXYFqYQ6OHsTmOm7hnwaRAS97+VFMo1i5uvTx9nYaAcY7yzq3Ckfb67dMBKApGOpJpkvPgfrP7bgBO5rOZXM1opXqVPb09nljAhhAhyCTh1e/8+mJrBo0cLQ/LupQzVxGDgm3awSMPxsZAN45PSWz76zzxdDa1MMo51do+VJHfs7Wl0NcXAQrniOBYL9Wqt0qNkn1gY5smkkISGeQ/vxNap4MmzeZE7b5fpOy+2fpcRVQLpc4nooQzJvSVTFz+25lgZ6iHf45K87gQFMIAri1Pf/EDDpL87az+bRWvWi+BA2kMe1kf+Ay1LyMz8r+g51H0ma0bNFh6+fbWMfUiD9JCepIObclnUJ4NlWfcgHxTf17d/4tl6z4DTcLpCCk8Da77JouSHgvtcRbRlFV1OfhWZLXUsrlfpaQTiItv6TGIr3k7+7b66o3Qw/GQVs5GmYifaIZIz8n8my4XjkaMBd0SZfBzzvFjHMq6YUP9+SbjvReqofuoO+5tW1wTYZXitFFBfwuHlXm6w77K5QDBW6olT7pat41/F5eGxLcz tv@wu"; uid = 1337; # TODO use default }; From 1ff38bf6c69fd68cbf4e158a96cd8c97d6cf305d Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 16 Mar 2016 01:17:07 +0100 Subject: [PATCH 06/17] krebs lib += optionalTrace --- krebs/4lib/default.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/krebs/4lib/default.nix b/krebs/4lib/default.nix index deac02bb7..e984614a0 100644 --- a/krebs/4lib/default.nix +++ b/krebs/4lib/default.nix @@ -17,7 +17,7 @@ let out = rec { types = import ./types.nix { inherit config; - lib = lib // { inherit genid; }; + lib = lib // { inherit genid optionalTrace; }; }; dir.has-default-nix = path: pathExists (path + "/default.nix"); @@ -44,4 +44,6 @@ let out = rec { mapAttrValues = f: mapAttrs (_: f); setAttr = name: value: set: set // { ${name} = value; }; + optionalTrace = c: msg: x: if c then trace msg x else x; + }; in out From fb82aa8f34977de004df09d9e76c506557235d15 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 16 Mar 2016 01:19:27 +0100 Subject: [PATCH 07/17] krebs types.host.ssh.pubkeys: trace only own missing keys --- krebs/4lib/types.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix index 839a1a923..334a94c3a 100644 --- a/krebs/4lib/types.nix +++ b/krebs/4lib/types.nix @@ -6,7 +6,7 @@ with types; let # Inherited attributes are used in submodules that have their own `config`. - inherit (config.krebs) users; + inherit (config.krebs) build users; in types // rec { @@ -50,9 +50,9 @@ types // rec { type = nullOr str; default = null; apply = x: - if x != null - then x - else trace "The option `krebs.hosts.${config.name}.ssh.pubkey' is unused." null; + optionalTrace (x == null && config.owner.name == build.user.name) + "The option `krebs.hosts.${config.name}.ssh.pubkey' is unused." + x; }; ssh.privkey = mkOption { type = nullOr (submodule { From e6657cd46a6b97153f80006144fe6293f715bb7d Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 16 Mar 2016 01:52:34 +0100 Subject: [PATCH 08/17] krebs lib += getAttrDef --- krebs/4lib/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/krebs/4lib/default.nix b/krebs/4lib/default.nix index e984614a0..585bd313f 100644 --- a/krebs/4lib/default.nix +++ b/krebs/4lib/default.nix @@ -41,6 +41,7 @@ let out = rec { mapAttrs (name: _: path + "/${name}") (filterAttrs (_: eq "directory") (readDir path)); + getAttrDef = name: set: set.${name} or set.default or null; mapAttrValues = f: mapAttrs (_: f); setAttr = name: value: set: set // { ${name} = value; }; From 444d85ea86d150c4257781605ed372357cda2e18 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 16 Mar 2016 01:54:49 +0100 Subject: [PATCH 09/17] krebs types += ssh-{priv,pub}key --- krebs/4lib/types.nix | 44 +++++++++++++++++++++++--------------------- 1 file changed, 23 insertions(+), 21 deletions(-) diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix index 334a94c3a..ed6ae9e4f 100644 --- a/krebs/4lib/types.nix +++ b/krebs/4lib/types.nix @@ -47,7 +47,7 @@ types // rec { }; ssh.pubkey = mkOption { - type = nullOr str; + type = nullOr ssh-pubkey; default = null; apply = x: optionalTrace (x == null && config.owner.name == build.user.name) @@ -55,25 +55,7 @@ types // rec { x; }; ssh.privkey = mkOption { - type = nullOr (submodule { - options = { - bits = mkOption { - type = nullOr (enum ["4096"]); - default = null; - }; - path = mkOption { - type = either path str; - apply = x: { - path = toString x; - string = x; - }.${typeOf x}; - }; - type = mkOption { - type = enum ["rsa" "ed25519"]; - default = "ed25519"; - }; - }; - }); + type = nullOr ssh-privkey; default = null; }; }; @@ -184,7 +166,7 @@ types // rec { default = config._module.args.name; }; pubkey = mkOption { - type = nullOr str; + type = nullOr ssh-pubkey; default = null; }; uid = mkOption { @@ -198,6 +180,26 @@ types // rec { addr = str; addr4 = str; addr6 = str; + ssh-pubkey = str; + ssh-privkey = submodule { + options = { + bits = mkOption { + type = nullOr (enum ["4096"]); + default = null; + }; + path = mkOption { + type = either path str; + apply = x: { + path = toString x; + string = x; + }.${typeOf x}; + }; + type = mkOption { + type = enum ["rsa" "ed25519"]; + default = "ed25519"; + }; + }; + }; krebs.file-location = types.submodule { options = { From 9d16ea61451aff36963cef3610ac8d51ed0b488b Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 16 Mar 2016 01:57:03 +0100 Subject: [PATCH 10/17] krebs types += pgp-pubkey, user.pgp.pubkey --- krebs/3modules/tv/default.nix | 2 +- krebs/4lib/types.nix | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index dd1f0d289..262f508c3 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -357,7 +357,7 @@ with config.krebs.lib; }; tv = { mail = "tv@nomic.retiolum"; - pgp.pubkey = '' + pgp.pubkeys.default = '' -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFbJ/B0BEADZx8l5gRurzhEHcc3PbBepdZqDJQZ2cGHixi8VEk9iN25qJO5y HB0q5sQRsh7oNCbzKp6qRhaG9kXmEda+Uu+qbHWxE32QcT76+W8npH73qthaFwC/ diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix index ed6ae9e4f..112984445 100644 --- a/krebs/4lib/types.nix +++ b/krebs/4lib/types.nix @@ -165,6 +165,16 @@ types // rec { type = username; default = config._module.args.name; }; + pgp.pubkeys = mkOption { + type = attrsOf pgp-pubkey; + default = {}; + description = '' + Set of user's PGP public keys. + + Modules supporting PGP may use well-known key names to define option + defaults, e.g. using `getAttrDef well-known-name pubkeys`. + ''; + }; pubkey = mkOption { type = nullOr ssh-pubkey; default = null; @@ -180,6 +190,9 @@ types // rec { addr = str; addr4 = str; addr6 = str; + + pgp-pubkey = str; + ssh-pubkey = str; ssh-privkey = submodule { options = { From 20afe7b9aeb5d523e10a0d5c597b8c1656bca58e Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 16 Mar 2016 02:04:22 +0100 Subject: [PATCH 11/17] krebs types += tinc-pubkey --- krebs/4lib/types.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix index 112984445..32d1daf9d 100644 --- a/krebs/4lib/types.nix +++ b/krebs/4lib/types.nix @@ -111,7 +111,7 @@ types // rec { ); }; pubkey = mkOption { - type = str; + type = tinc-pubkey; }; }; })); @@ -214,6 +214,8 @@ types // rec { }; }; + tinc-pubkey = str; + krebs.file-location = types.submodule { options = { # TODO user From be5a136464ea2de6449fc9abe7ec9b0acc9708ff Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 16 Mar 2016 08:25:26 +0100 Subject: [PATCH 12/17] k 3 ma: add default and brain --- krebs/3modules/makefu/brain.pgp | 51 ++++++++++++++++++++++++ krebs/3modules/makefu/default.pgp | 64 +++++++++++++++++++++++++++++++ 2 files changed, 115 insertions(+) create mode 100644 krebs/3modules/makefu/brain.pgp create mode 100644 krebs/3modules/makefu/default.pgp diff --git a/krebs/3modules/makefu/brain.pgp b/krebs/3modules/makefu/brain.pgp new file mode 100644 index 000000000..739385a38 --- /dev/null +++ b/krebs/3modules/makefu/brain.pgp @@ -0,0 +1,51 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v2 + +mQINBFXn/k4BEACmXMbhoAKsMC/gFqBrQq2mgvo8+FnUe4F6JznVh7NiPH0PUdDw +jRnK2EEpD+NoDt3A0jtq6C+wnr1V+p/jYAPxRcvv8a7ym+xuA4sBIPrlW1fQIuWF +EjYnUVnN16Qa1xJiQQyEDeleAxgg0luOdqBZ0myT84a9O0deN8JM+zwqT/+sLY9c +2fVGNv496/mt7Ct294QbS6cfdR26r8PZ1Wfo8cr8UhFfFft0TE267HJdoJ8NBvH/ +BSEcoaS3kaxk2YyOdAJ1RgEoQY2w1/jeZv5IUyO7azAQUhbqBK7nVbgUd2l3nf4v +qmgNvvtcAlccY6L2M8BR6TI4Yw2hfbLOHPVTNjFlMXXX/MDYFFF9+GqmYOjyy5dy +8m4qA4ZEoHG9XT+xsZAsHJRFPBacSp2ydoVdlkJsEQnabb78NXLusgBBxhOmvVHe +5SeIvsrpn83/aIeHpLUQbzUdK3osERZUBTp9Pr0+dB+UkqThjE3MPntKcawm4cGN +dXY6iNXH4gGPOjb5ed0OzDiRS2bVyb0/F2wYXvIPE2e0CwJ0io2rRT410HfpFkWD +OPENdlNYb6FCXc4fpGxdtFL0hE6RZqBvwQAN9iDkEj+DxEwUc+yyroFRI25y+T1z +68T0xqVfKXUqcOmsACKtjlQ5QcikCj8kC9bNDln7v1Q9argSEJXJDdf3cwARAQAB +tBhwdyB1c2VyIDxyb290QGxvY2FsaG9zdD6JAjgEEwECACIFAlXn/k4CGwMGCwkI +BwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEDtOh4EJ4fmcIecP/1+HMD22wilyb3hQ +QLKz+Wx37ZM6w0p9o0lMEeeUpcYPtWeVBqID6vxmqFwIOU5LtkHiE0yO8AcW7TYx +14Ql3mPWd594fKXr04mN9RM9wTr09S0P4nqKuq0cR3x5s4C30DoKoUqt3ZKSZRW/ +4suhvebfYiTjlE5joH4lZy7bMaH2HpvLacZXGcyH7cmYfLuZekf1kNXRDh40IgrH +uzsXFoflhLEZouKWiV3mWFo1iIckvTDrFNHuJj5oHP2D3J1RYdbPNP+5yOu/34mt +wPK/R6MxXY+zKWZWU59Ll5nx+2wUkIP/MaE9Ubx1W0UdeB4In/Y/HhV2fwd9DFsq +cbKofeDRblEdaaTjiqc1MjSxyhPplApgG4389gXX4vszAuyxBq6AecJobYkzmVek +EOJVVqDFoT+a70p5hWMP5nQV7dE3jyy1esm6cjF9iv0cRf/GqZAIiNdeo9av56OO +H5uwamTwcRrDsy4xWzowUfJDB+nJzlXw08aQRTfczCZ3n5hXvqqxuoweH08hfm/S +oa0gU95mCkHYbscaxjXnkEgbuvCiVRhDqd8rZpi5WxNV63zHIaoeXIPVJH0zswIJ +MT2LofWB8W8in48rmRvUdzZlm/++c/9+evNyNyAyOmdRk6fP0nHdRmuINyeKc67P +0BrVstk/cywbNbpNBt+2uUJCemBBuQINBFXn/k4BEADQYsT81uL8XE9homHLRai0 +3Xo/gVe5lwXWouzzVImEQIICvmBCjdzA1nPfKvdBcFsBfOro6aefETq/cZeL16It +zJKhh2HDJ/7oCuJM0OufkwoSBwJ4f0I+0zXsPZV0+P1ijPaKunYW+YpoFm3z8rLc +iX/kxYRgo13jCNphL/TKOoq3ZTREzDcBk9QR8yLTV5i0j1qrlIsAx7iTv1jrC1L6 +fBZm40+wn0ahz9IgBWWv588i+1f7ekKQBYXi9n2+hSfMQ0ebhW14xG72eXDzV14Q +Yra+FNMOCeKhmHH9PnVw0NkwRPbtL92ZySeFMHxhYnBPckqBUuEO12TXUMWA9fzj +rpBjJWEtCRCeaSLAe5Nzleb09NKO3z4ghwedef/Cz8XZ+XDIpE/1yTQy0lSuLosw +ScmwG9UPYxpWWqJmC+H6GQ0qQmCgmPYG8b20JvnqROmsLooC/xmf4seT8J+fYpKt +fkQiuOd8RecW+1jyfr7qy2S3roNgNl7hyzlIHmtGnn3rYC4uCe4VjosvcPmnXP6N +Jcck3dQnFxmE+/JS1zdH47nDGJsn5fFrArdfU9DLGjU/L7BJt99vIvif89B2FF/n +0cR7bLeY72P1oJw+tgrsjo9uaS9u9vk/J8+Rhf3TIqbHfFh7/42sdkgk3Mqha+Bn +wAOpUP3tjdDTwow9/2iYjQARAQABiQIfBBgBAgAJBQJV5/5OAhsMAAoJEDtOh4EJ +4fmcTy8P/03eVL9GoarIjwRxYY8U23fU4xNIypkNrjspjJHVRcKJFCyA2/R9toKf +0XGJIM2fwBo6beH0rinq8Xm8hrT/gFIWupuDLSTR/km0UD6CtfFOIt+5jw3c5mMR +u9DbSWAiRYGzQKYYZUy5mdMG/kokDRSm5D0lO+YnLZtpECZn/Zi5rPKzbGyMus+a +fm8a/eNko+Eg6j8FSYBm+d8SKYdoLJN3R7hYji7JuERMs+UZMsuriSAn2Af2Jn1I +hc7fiwotrMdNifyWCtYqiFvcrsm8K8EC2J0KsieydBHwCuamlqTrjqVejbITD8Jl +ghTGNHe/crP7/XKTjKva+1+VJAHDLylZgcArQSKa+SsWB/GoKB0x9UEWThJ1DLi4 +j2GhNlCIYZtPBQMu3+2btDj0A3IUQp4aW0nd5+0zz0H7JVrl+pI37uUxTiXCZG9X +fjXrcP3niJhraHTG8mWD1v8+cG3NXpv/IZN82Z+sQlpabwjpybag2CeTfhEoFtEl +V6ez9wpgBKeDsLDLOB8VRgpsikw9f6H8GAUZe2PjKUwiDtptqa37nU+3A6wPiO2s +AWT/7D6vhMpDncp7E9DcsmsU9LNt7D+ISqi4uLKYJcfmqbJOui2YFo3zsYP8TqQD +JTZ1lSpFpipJpi6mAzQUS4P3H+aUjeW/LWiSS/YNmGIOAUeB6Y3c +=rEQB +-----END PGP PUBLIC KEY BLOCK----- diff --git a/krebs/3modules/makefu/default.pgp b/krebs/3modules/makefu/default.pgp new file mode 100644 index 000000000..bc5c50b76 --- /dev/null +++ b/krebs/3modules/makefu/default.pgp @@ -0,0 +1,64 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v2 + +mQINBE6quoQBEACemTuY0Ujeygxdyds3ugPbKuIsJMCQSdXAKsCkH4vV5qam8rQP +AabpYyQfew9nCUCJa4NkKFrLnGz4d7rl1u5ihVqMctYeJqZdtX88DqqNKQXoqKQv +crF5hcZmUtbGe5eyoMV55hiODPVPTVra6pbxWwhqa0pYeXEyDy1BPoqgcP0DUFho +yBeoyw71ujgdJZvl5rq6ZVjTGuToNKHn5UBDMu6n0rl9Ha7ukL4Gx8hOhmK8yv87 +zuUzBRQkTgoC48JA3Bt0kb15ghbOV7D411ZhmhEqWwE/OBk3//6MOGu24Mm0OG8J ++tbEMysck0LYe5q5U/2cmGsqlwV6FXLmnPOj6H4XtdTBDVXo/Hp6A8mVR1sSDopc +/2TnTwv0cdGOIS1CgxUc/qS6a8h+2UGaLSPnuPBWom163YbO/vgj8Th5q3N2DiRO +EP+mGCKn1/cghU7WjMny8z59A7SeZ0rRN8KaMlFEZMlgtQf7/6EjL5Ulo5H0vb2m +G5lAfW5xz55Y6M06sEl2wJ4pkgt+jeWRItKQvyqcdFEfiJfuP0+ESmQIMvz2ZnDC +ZJzpmjP5uDwqu5THcTHvJ/ptSHRtXEiqqwrpQ0dqtwxLMJtIdgOohVoPAUNTTXcy +XmL0qZsLFI2We2v0jgYMcYw1gswsksMLLmnVWlAsBqCALRyu4Ptxrkg9NwARAQAB +tB5tYWtlZnUgPHJvb3RAc3ludGF4LWZlaGxlci5kZT6JAjgEEwECACIFAk6quoQC +GwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEMk6uSvVJeKfr5UP/3vvBlZQ +9DjLRBx9YUjbq34LDl/wdDX7Fwsdb+TccUiOgKW2RAXbdnff2r5VRn4VSDUYoFfN +qtDrxKl04IWeVwiaTjCJdXp6veSpov5GcmARgPUow8v9Eu2gZw0o1LvW7NFP5e3u +YxmSTrlVGZMTCkwIkYoaETseCE0qsahWD0zCM19rAEuTkwKOQo58mXFUzNq829Ex +OAv4zIQE6V7SKKOZzXhvBu3s1ql1SDfmciaszMlwwPtwgFBkg1HrFvuimU7zqGkf +wQpWt91j8kJZdAC8iUf/7UNh/VZu+n9jtmynunRrY2PgPh6LgeDmiaTbVfHX51/3 +R01dzzTk0dnqwosNoc1u8Xsb/rTs9LDsncteUGKgiEh+LRjouGGh/C1g58dkF0wP +S00dgnEhI9d8ui/yTPa47l3zDSa/m6Nq6oEGVbZDivNDuTV1jfhrs0v3kx50aK0O +y+exKMmgxoxeCMZs53iHXiXAcsHSj+Gue6W2jDvRjaPqfxnM3GNd7y9ix8IF43R6 +n1oAZo7zWA4a5iq8yvBTjKqyDJAKu8C4kYM/9FMJlDgUjWYvNI4BiG1iw0iGVAjt +JHz/QEM/7Mg7fw1rtJB/A9ezLJGyiDcc5GwrLIVl6U8stNWF0ZqgtwWKF1lm0Faj +mPRDdOVZNTPw61YNqHJGdHVBD0usx3Xg/4V6tC5GZWxpeCBSaWNodGVyIDxGZWxp +eC5SaWNodGVyQHN5bnRheC1mZWhsZXIuZGU+iQI4BBMBAgAiBQJSpxSDAhsDBgsJ +CAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRDJOrkr1SXin4w8D/9QY5oTvCmFERHR +uUgGyU1hPomIE6RrSxoeqHsMUhUuqNeWYk0T/Oju/sZLlWUuBZHLTXeGPyFEe0/n +6ys4cqTSwCKUdB0kQO3GAzPKGmC6C5trQaMpY+A6yVi3He6rN37+XjfjrY+o7Rbl +s8K6S3jR/f/MSODjRnGNPTLsuDYKo+d4RwlWv2G+RFHueh4/aef0s3lzoDbmdJiW +zXaTqiCKgG34GzQO4hs6MsyG9mJo05qXvMAGgCyRDJkbcmwjgQonlEi6TIJyQ3J2 +CNLrl2UW5eUFKnZbWGZYL7Ojsq0UnRna6z1L4sxk1kCLxn1Gz8RiisJ1bUOM85vZ +dTyFTb9+iC43c2IbLpF139ic+hb6dYJC392cOwrT2UgfUuzqocY2V/HXjVsqsNtL +t4tnoZkZhjFMaUe5FQbUYwtA2IqqrqD7iC7ULtclYa2tvW2HIAs4VjocWxfbgY4b +He99Ma5xSNL171a34n2ZayjsI8cbYtHvVPTZ8Zs6xqsz8D+o+m0bBxGobOAkb6yN +UUdZjo5Jdcr2AxAITEgzgzcWR0sCbn+6Jj7XJuz2SYEtOhZBrY7tONoOkrysCtJD +fKOp2RCq60ZHMqoBTyyxtQ6LG/I0bZs7a2/6Wc3O3VhSIGgjSOan7N4G13CJqfFA +FfMATGPnK+nYxmVAQ2VR0GxscvjdBLkCDQROqrqEARAAzYUNba4eFVDLlF2SzSra +VMyV9eNBdi64tNQVTFDH+bj2KgcPKZXBUXDz+hizOb3jegaBojlbf6LYUgzQMQ96 +uHcE/mlBhtU1nUYKEH82kblA6UVOrtSyK/2MIX/aoK7C+pKFSIEkl2/V4NtPQ6Ay +H+UQ8c6uOP6Z0raaawjZ/rzvxIlVPD0Ou0PtJf6l0UtMQRWpYcwNl3O6JgMFhqP4 +LipP40aYEuxr9RUynWBb8HzXj1R5imPgF+F47L8EPKDgIqEr6OLWigQ6pBpKM8xP +lMQByGvv5Xi35rqMwn2porHwYE5BIUIQcSSSdhSxgwB0G/hlpucX7wtUMheAUFTj +sVVK5jirMf30h4NUlpyO1hNblIM+oex96yir8PRZwQFkZ8CFeMDXjsNYUhcqyAJC +Lr64XiaX7VdIshcIF07tC/Rjd7qKOs21phzIJ7FkYYFkhh607q6rzH7pBsnckJnX +ydFIo412ig4dac2f2FSgZXPYyZ9T6y9raL3Aq1WigOncG+ajpN60/r1pXXggoIgr +ZuSMXpklr3z7DZ+M5Vk7EjpTZqfUkcBuS9ObsfX/oIpVaY5MCZobjw4iBEee/t+f +4YigdPTWWxoHA259S2dH3MdWzIH515VWjUD4E7Jf9iEoYygT98u3fV/1GHjBsQTg +2CTXRCG3xpHnPliLvwkt6z8AEQEAAYkCHwQYAQIACQUCTqq6hAIbDAAKCRDJOrkr +1SXin9vjD/46juH2MLa/iyXzbz4QxEHt5/USZ+RFh8Bt5iBEGVvKY97QlOJ6Eq8Z +9BMA1z+QpdkU2Rx7H2l9ohA5Kznlz80KUGzkkEwCZTqycLLX2/oq825dqF0H6hJu +9R95ltC8xIYvW0KPunnyU4HO+RyVM544vR1KKBTXV/+ojHD2BviDQ41bFNfYjo+N +uInrJWCgsxAC1fhnxLjQH74BkBSMF0S85y68EnHbJ/4IAud24shb6blsF1Sjf1CK +UX0ZWwbBWj7cMg0pfkczdl7Y7pHJqOr/UrC40jHVO4CX0JrxhOT7u4cvhv0E4Y3O +y9+Js7+fM6Ua+YF6TuArOorOCH8vzx6xvM1AW2U5jS3iMglIi6fXEYRuQB9ygPTc +wJ/ByBApEKC7O0kA0PhwEF4FTgZntThlaJ+2rsUseONAXqZTJaX+CXtQdw6IVa8n +SmXN01YsZzW1qFhbBSYHowqbOxbW9WH0ObtL+bxfJbG8HrVoXZJ5pcytzIDsGbtE +1M2AQPZ4CaaWDGEvnM3REo1OOAf3f4Vf9C59suPoKVWqalBb94AhQqka8nZ81jL9 +tXDt0Yuaj2xroCNstmRFOgXJBWWx59kVdU9yoC2K0AWNrMdHAuyevgscAHsKkXq5 +4C1xL0RuUlNZ1qcX7Ev7kcLJ1RxRyXZQCbpIUi+UAWuNgEwMEHo1eQ== +=rHPd +-----END PGP PUBLIC KEY BLOCK----- From 61e312dff1333a2636315d9efb7ebf971e14256c Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 16 Mar 2016 08:35:06 +0100 Subject: [PATCH 13/17] k 3 ma: expose pgp pubkeys --- krebs/3modules/makefu/default.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix index d6ae9f12f..07382fee0 100644 --- a/krebs/3modules/makefu/default.nix +++ b/krebs/3modules/makefu/default.nix @@ -582,17 +582,19 @@ TNs2RYfwDy/r6H/hDeB/BSngPouedEVcPwIDAQAB makefu = { mail = "makefu@pornocauster.retiolum"; pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCl3RTOHd5DLiVeUbUr/GSiKoRWknXQnbkIf+uNiFO+XxiqZVojPlumQUVhasY8UzDzj9tSDruUKXpjut50FhIO5UFAgsBeMJyoZbgY/+R+QKU00Q19+IiUtxeFol/9dCO+F4o937MC0OpAC10LbOXN/9SYIXueYk3pJxIycXwUqhYmyEqtDdVh9Rx32LBVqlBoXRHpNGPLiswV2qNe0b5p919IGcslzf1XoUzfE3a3yjk/XbWh/59xnl4V7Oe7+iQheFxOT6rFA30WYwEygs5As//ZYtxvnn0gA02gOnXJsNjOW9irlxOUeP7IOU6Ye3WRKFRR0+7PS+w8IJLag2xb makefu@pornocauster"; + pgp.pubkeys.default = builtins.readFile ./default.pgp; + pgp.pubkeys.brain = builtins.readFile ./brain.pgp; }; makefu-omo = { - inherit (makefu) mail; + inherit (makefu) mail pgp; pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAtDhAxjiCH0SmTGNDqmlKPug9qTf+IFOVjdXfk01lAV2KMVW00CgNo2d5kl5+6pM99K7zZO7Uo7pmSFLSCAg8J6cMRI3v5OxFsnQfcJ9TeGLZt/ua7F8YsyIIr5wtqKtFbujqve31q9xJMypEpiX4np3nLiHfYwcWu7AFAUY8UHcCNl4JXm6hsmPe+9f6Mg2jICOdkfMMn0LtW+iq1KZpw1Nka2YUSiE2YuUtV+V+YaVMzdcjknkVkZNqcVk6tbJ1ZyZKM+bFEnE4VkHJYDABZfELpcgBAszfWrVG0QpEFjVCUq5atpIVHJcWWDx072r0zgdTPcBuzsHHC5PRfVBLEw== makefu@servarch"; }; makefu-tsp = { - inherit (makefu) mail; + inherit (makefu) mail pgp; pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1srWa67fcsw3r64eqgIuHbMbrj6Ywd9AwzCM+2dfXqYQZblchzH4Q4oydjdFOnV9LaA1LfNcWEjV/gVQKA2/xLSyXSDwzTxQDyOAZaqseKVg1F0a7wAF20+LiegQj6KXE29wcTW1RjcPncmagTBv5/vYbo1eDLKZjwGpEnG0+s+TRftrAhrgtbsuwR1GWWYACxk1CbxbcV+nIZ1RF9E1Fngbl4C4WjXDvsASi8s24utCd/XxgKwKcSFv7EWNfXlNzlETdTqyNVdhA7anc3N7d/TGrQuzCdtrvBFq4WbD3IRhSk79PXaB3L6xJ7LS8DyOSzfPyiJPK65Zw5s4BC07Z makefu@tsp"; }; makefu-vbob = { - inherit (makefu) mail; + inherit (makefu) mail pgp; pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCiKvLKaRQPL/Y/4EWx3rNhrY5YGKK4AeqDOFTLgJ7djwJnMo7FP+OIH/4pFxS6Ri2TZwS9QsR3hsycA4n8Z15jXAOXuK52kP65Ei3lLyz9mF+/s1mJsV0Ui/UKF3jE7PEAVky7zXuyYirJpMK8LhXydpFvH95aGrL1Dk30R9/vNkE9rc1XylBfNpT0X0GXmldI+r5OPOtiKLA5BHJdlV8qDYhQsU2fH8S0tmAHF/ir2bh7+PtLE2hmRT+b8I7y1ZagkJsC0sn9GT1AS8ys5s65V2xTTIfQO1zQ4sUH0LczuRuY8MLaO33GAzhyoSQdbdRAmwZQpY/JRJ3C/UROgHYt makefu@vbob"; }; exco = { From 3b3b372091b8c5a8015feba2801ba395bf513f2c Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 16 Mar 2016 08:39:58 +0100 Subject: [PATCH 14/17] ma 2 default: really do use tinc_pre --- makefu/2configs/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix index 313ccbec7..20faf7896 100644 --- a/makefu/2configs/default.nix +++ b/makefu/2configs/default.nix @@ -125,6 +125,7 @@ with config.krebs.lib; nixpkgs.config.packageOverrides = pkgs: { nano = pkgs.runCommand "empty" {} "mkdir -p $out"; + tinc = pkgs.tinc_pre; }; services.cron.enable = false; From 6cb6c96255427580d35fc6b6d545c016f882dcde Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 16 Mar 2016 08:41:13 +0100 Subject: [PATCH 15/17] ma 1 darth: configure aux disk --- makefu/1systems/darth.nix | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/makefu/1systems/darth.nix b/makefu/1systems/darth.nix index a33744f0b..ad3ac4f22 100644 --- a/makefu/1systems/darth.nix +++ b/makefu/1systems/darth.nix @@ -1,17 +1,39 @@ { config, pkgs, lib, ... }: with config.krebs.lib; -{ +let + byid = dev: "/dev/disk/by-id/" + dev; + rootDisk = byid "ata-ADATA_SSD_S599_64GB_10460000000000000039"; + auxDisk = byid "ata-HGST_HTS721010A9E630_JR10006PH3A02F"; + dataPartition = auxDisk + "-part1"; + + allDisks = [ rootDisk auxDisk ]; +in { imports = [ + ../. ../2configs/fs/single-partition-ext4.nix ../2configs/zsh-user.nix - ../. + ../2configs/smart-monitor.nix ]; + # virtualisation.nova.enableSingleNode = true; krebs.retiolum.enable = true; - boot.loader.grub.device = "/dev/disk/by-id/ata-ADATA_SSD_S599_64GB_10460000000000000039"; + # TODO smartd omo darth gum all-in-one + services.smartd.devices = builtins.map (x: { device = x; }) allDisks; + zramSwap.enable = true; + + fileSystems."/data" = { + device = dataPartition; + fsType = "ext4"; + }; + + boot.loader.grub.device = rootDisk; + users.users.root.openssh.authorizedKeys.keys = [ config.krebs.users.makefu-omo.pubkey + config.krebs.users.makefu-vbob.pubkey ]; + + krebs.build.host = config.krebs.hosts.darth; } From 6f7801509fd13c09161f9f1e28caa4cb89db1bfb Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 16 Mar 2016 08:42:19 +0100 Subject: [PATCH 16/17] ma 1 gum: allow vbob and omo users --- makefu/1systems/gum.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix index e784fdc12..2ddd2dccc 100644 --- a/makefu/1systems/gum.nix +++ b/makefu/1systems/gum.nix @@ -45,6 +45,12 @@ in { "cgit.euer.krebsco.de" ]; + # access + users.users = { + root.openssh.authorizedKeys.keys = [ config.krebs.users.makefu-omo.pubkey ]; + makefu.openssh.authorizedKeys.keys = [ config.krebs.users.makefu-vbob.pubkey ]; + }; + # Chat environment.systemPackages = with pkgs;[ weechat From 04ba4784ae0918fe9e79af5c95bace3cf8605792 Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 16 Mar 2016 08:43:20 +0100 Subject: [PATCH 17/17] ma 1 omo: fix misleading comment --- makefu/1systems/omo.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix index bfcd2298a..f0f1d3088 100644 --- a/makefu/1systems/omo.nix +++ b/makefu/1systems/omo.nix @@ -11,7 +11,7 @@ let # cryptsetup luksFormat $dev --cipher aes-xts-plain64 -s 512 -h sha512 # cryptsetup luksAddKey $dev tmpkey # cryptsetup luksOpen $dev crypt0 --key-file tmpkey --keyfile-size=4096 - # mkfs.ext4 /dev/mapper/crypt0 -L crypt0 -T largefile + # mkfs.xfs /dev/mapper/crypt0 -L crypt0 # omo Chassis: # __FRONT_ @@ -30,6 +30,8 @@ let cryptDisk2 = byid "ata-ST4000DM000-1F2168_Z303HVSG"; # cryptDisk3 = byid "ata-WDC_WD20EARS-00MVWB0_WD-WMAZA1786907"; # all physical disks + + # TODO callPackage ../3modules/MonitorDisks { disks = allDisks } allDisks = [ rootDisk cryptDisk0 cryptDisk1 cryptDisk2 ]; in { imports =