From 4aa2f9de3d40020c2e93efa942c76c4416d79fb0 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sat, 17 Oct 2015 20:11:00 +0200
Subject: [PATCH 01/48] l 2 desktop-base: add push pkg

---
 lass/2configs/desktop-base.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lass/2configs/desktop-base.nix b/lass/2configs/desktop-base.nix
index 4e693997d..27aadb590 100644
--- a/lass/2configs/desktop-base.nix
+++ b/lass/2configs/desktop-base.nix
@@ -30,6 +30,7 @@ in {
     powertop
     sxiv
     much
+    push
 
   #window manager stuff
     haskellPackages.xmobar

From 1022e82c0d71ecb072c60f16bfc6475c23bcc3e4 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sat, 17 Oct 2015 20:11:43 +0200
Subject: [PATCH 02/48] l 5 newsbot-js: cd32ef7 -> b227296

---
 lass/5pkgs/newsbot-js/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lass/5pkgs/newsbot-js/default.nix b/lass/5pkgs/newsbot-js/default.nix
index 7758b04db..ace2a976f 100644
--- a/lass/5pkgs/newsbot-js/default.nix
+++ b/lass/5pkgs/newsbot-js/default.nix
@@ -26,8 +26,8 @@ in nodePackages.buildNodePackage {
 
   src = fetchgit {
     url = "http://cgit.echelon/newsbot-js/";
-    rev = "cd32ef7b39819f53c7125b22c594202724cc8754";
-    sha256 = "425e800f7638a5679ed8a049614a7533f3c8dd09659061885240dc93952ff0ae";
+    rev = "b22729670236bfa6491207d57c5d7565137625ca";
+    sha256 = "8ff00de56d85543399776c82d41d92ccc68000e5dce0f008d926748e188f3c69";
   };
 
   phases = [

From b4326e31444e1dab51d7c4469f43d37dab2d73d5 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sun, 18 Oct 2015 01:05:49 +0200
Subject: [PATCH 03/48] krebs 4 infest: umount /mnt/boot prior to /boot

---
 krebs/4lib/infest/finalize.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/4lib/infest/finalize.sh b/krebs/4lib/infest/finalize.sh
index 0039960c5..94b13e0be 100644
--- a/krebs/4lib/infest/finalize.sh
+++ b/krebs/4lib/infest/finalize.sh
@@ -3,8 +3,8 @@ set -eux
 {
   umount /mnt/nix
   umount /mnt/root
-  umount /boot || :
   umount /mnt/boot
+  umount /boot || :
   umount /mnt
 
   coreutils_path=$(set +f; for i in /nix/store/*coreutils*/bin; do :; done; echo $i)

From c3a1bca74c1d7f6e598918a8fb52c192c38999d6 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sun, 18 Oct 2015 04:12:51 +0200
Subject: [PATCH 04/48] krebs 4 infest: add compatibility for centos 6.5

---
 krebs/4lib/infest/prepare.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/krebs/4lib/infest/prepare.sh b/krebs/4lib/infest/prepare.sh
index 9fbd5be86..94c9b0fb5 100644
--- a/krebs/4lib/infest/prepare.sh
+++ b/krebs/4lib/infest/prepare.sh
@@ -18,6 +18,13 @@ prepare() {(
         esac
         ;;
     esac
+  elif test -e /etc/centos-release; then
+    case $(cat /etc/centos-release) in
+      'CentOS release 6.5 (Final)')
+        prepare_centos "$@"
+        exit
+        ;;
+    esac
   fi
   echo "$0 prepare: unknown OS" >&2
   exit -1

From b5316b0458f30fb38600fba2ca74bdd16ac7dce6 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sun, 18 Oct 2015 04:24:39 +0200
Subject: [PATCH 05/48] lass 2 os-templatex: add cac centos 6.5 template

---
 .../os-templates/CAC-CentOS-6.5-64bit.nix     | 47 +++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 lass/2configs/os-templates/CAC-CentOS-6.5-64bit.nix

diff --git a/lass/2configs/os-templates/CAC-CentOS-6.5-64bit.nix b/lass/2configs/os-templates/CAC-CentOS-6.5-64bit.nix
new file mode 100644
index 000000000..b5ec722a0
--- /dev/null
+++ b/lass/2configs/os-templates/CAC-CentOS-6.5-64bit.nix
@@ -0,0 +1,47 @@
+_:
+
+{
+  boot.loader.grub = {
+    device = "/dev/sda";
+    splashImage = null;
+  };
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "vmw_pvscsi"
+  ];
+
+  fileSystems."/" = {
+    device = "/dev/VolGroup/lv_root";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/sda1";
+    fsType = "ext4";
+  };
+
+  swapDevices = [
+    { device = "/dev/VolGroup/lv_swap"; }
+  ];
+
+  users.extraGroups = {
+    # ● systemd-tmpfiles-setup.service - Create Volatile Files and Directories
+    #    Loaded: loaded (/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/example/systemd/system/systemd-tmpfiles-setup.service)
+    #    Active: failed (Result: exit-code) since Mon 2015-03-16 10:29:18 UTC; 4s ago
+    #      Docs: man:tmpfiles.d(5)
+    #            man:systemd-tmpfiles(8)
+    #   Process: 19272 ExecStart=/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/bin/systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev (code=exited, status=1/FAILURE)
+    #  Main PID: 19272 (code=exited, status=1/FAILURE)
+    #
+    # Mar 16 10:29:17 cd systemd-tmpfiles[19272]: [/usr/lib/tmpfiles.d/legacy.conf:26] Unknown group 'lock'.
+    # Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal configured, ignoring.
+    # Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal/7b35116927d74ea58785e00b47ac0f0d configured, ignoring.
+    # Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service: main process exited, code=exited, status=1/FAILURE
+    # Mar 16 10:29:18 cd systemd[1]: Failed to start Create Volatile Files and Directories.
+    # Mar 16 10:29:18 cd systemd[1]: Unit systemd-tmpfiles-setup.service entered failed state.
+    # Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service failed.
+    # warning: error(s) occured while switching to the new configuration
+    lock.gid = 10001;
+  };
+}

From 2e4573d2dd9f69da1dbd40c41ee70615171abebe Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sun, 18 Oct 2015 04:25:26 +0200
Subject: [PATCH 06/48] lass 3: add newsbot-js.nix

---
 lass/3modules/newsbot-js.nix | 87 ++++++++++++++++++++++++++++++++++++
 1 file changed, 87 insertions(+)
 create mode 100644 lass/3modules/newsbot-js.nix

diff --git a/lass/3modules/newsbot-js.nix b/lass/3modules/newsbot-js.nix
new file mode 100644
index 000000000..6d87d256d
--- /dev/null
+++ b/lass/3modules/newsbot-js.nix
@@ -0,0 +1,87 @@
+{ config, lib, pkgs, ... }:
+
+with builtins;
+with lib;
+
+let
+  cfg = config.lass.newsbot-js;
+
+  out = {
+    options.lass.newsbot-js = api;
+    config = mkIf cfg.enable imp;
+  };
+
+  api = {
+    enable = mkEnableOption "Enable krebs newsbot";
+    ircServer = mkOption {
+      type = types.str;
+      default = "echelon.retiolum";
+      description = "to which server the bot should connect";
+    };
+    channel = mkOption {
+      type = types.str;
+      default = "#news";
+      description = "post the news in this channel";
+    };
+    masterNick = mkOption {
+      type = types.str;
+      default = "knews";
+      description = "nickname of the master bot";
+    };
+    feeds = mkOption {
+      type = types.path;
+      description = ''
+        file with feeds to post
+        format:
+        $nick|$feedURI
+      '';
+    };
+    urlShortenerHost = mkOption {
+      type = types.str;
+      default = "echelon";
+      description = "what server to use for url shortening, host";
+    };
+    urlShortenerPort = mkOption {
+      type = types.str;
+      default = "80";
+      description = "what server to use for url shortening, port";
+    };
+  };
+
+  imp = {
+    users.extraUsers.newsbot-js = {
+      name = "newsbot-js";
+      uid = 1616759810; #genid newsbot-js
+      description = "newsbot-js user";
+      home = "/var/empty";
+    };
+
+    systemd.services.newsbot-js = {
+      description = "krebs newsbot";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      path = with pkgs; [
+        newsbot-js
+      ];
+
+      environment = {
+        irc_server = cfg.ircServer;
+        master_nick = cfg.masterNick;
+        news_channel = cfg.channel;
+        feeds_file = cfg.feeds;
+        url_shortener_host = cfg.urlShortenerHost;
+        url_shortener_port = cfg.urlShortenerPort;
+      };
+
+      restartIfChanged = true;
+
+      serviceConfig = {
+        User = "newsbot-js";
+        Restart = "always";
+        ExecStart = "${pkgs.newsbot-js}/bin/newsbot";
+      };
+    };
+  };
+
+in out

From ffef87c5dfc7cf6443bbef2fcc6661a06365e098 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Sun, 18 Oct 2015 17:50:54 +0200
Subject: [PATCH 07/48] l: specify krebs.hosts.*.nets.gg23

---
 krebs/3modules/lass/default.nix | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index afedf95f2..5c48d9642 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -104,7 +104,11 @@ with import ../../4lib { inherit lib; };
     uriel = {
       cores = 1;
       dc = "lass";
-      nets = rec {
+      nets = {
+        gg23 = {
+          addrs4 = ["10.23.1.12"];
+          aliases = ["uriel.gg23"];
+        };
         retiolum = {
           addrs4 = ["10.243.81.176"];
           addrs6 = ["42:dc25:60cf:94ef:759b:d2b6:98a9:2e56"];
@@ -131,7 +135,11 @@ with import ../../4lib { inherit lib; };
     mors = {
       cores = 2;
       dc = "lass";
-      nets = rec {
+      nets = {
+        gg23 = {
+          addrs4 = ["10.23.1.11"];
+          aliases = ["mors.gg23"];
+        };
         retiolum = {
           addrs4 = ["10.243.0.2"];
           addrs6 = ["42:0:0:0:0:0:0:dea7"];
@@ -155,6 +163,22 @@ with import ../../4lib { inherit lib; };
       ssh.privkey.path = <secrets/ssh.id_ed25519>;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAMPlIG+6u75GJ3kvsPF6OoIZsU+u8ZQ+rdviv5fNMD";
     };
+    schnabel-ap = {
+      nets = {
+        gg23 = {
+          addrs4 = ["10.23.1.20"];
+          aliases = ["schnabel-ap.gg23"];
+        };
+      };
+    };
+    Reichsfunk-ap = {
+      nets = {
+        gg23 = {
+          addrs4 = ["10.23.1.10"];
+          aliases = ["Reichsfunk-ap.gg23"];
+        };
+      };
+    };
 
   };
   users = addNames {

From 21b4d9ac2e14315a2c83ea9a2331dfe4baf3a913 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 19 Oct 2015 13:01:07 +0200
Subject: [PATCH 08/48] lass: remove obsolete sshkeys.nix

---
 lass/2configs/sshkeys.nix | 11 -----------
 lass/3modules/sshkeys.nix | 26 --------------------------
 2 files changed, 37 deletions(-)
 delete mode 100644 lass/2configs/sshkeys.nix
 delete mode 100644 lass/3modules/sshkeys.nix

diff --git a/lass/2configs/sshkeys.nix b/lass/2configs/sshkeys.nix
deleted file mode 100644
index f6081cf37..000000000
--- a/lass/2configs/sshkeys.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ config, ... }:
-
-{
-  imports = [
-    ../3modules/sshkeys.nix
-  ];
-
-  config.sshKeys.lass.pub = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAp83zynhIueJJsWlSEykVSBrrgBFKq38+vT8bRfa+csqyjZBl2SQFuCPo+Qbh49mwchpZRshBa9jQEIGqmXxv/PYdfBFQuOFgyUq9ZcTZUXqeynicg/SyOYFW86iiqYralIAkuGPfQ4howLPVyjTZtWeEeeEttom6p6LMY5Aumjz2em0FG0n9rRFY2fBzrdYAgk9C0N6ojCs/Gzknk9SGntA96MDqHJ1HXWFMfmwOLCnxtE5TY30MqSmkrJb7Fsejwjoqoe9Y/mCaR0LpG2cStC1+37GbHJNH0caCMaQCX8qdfgMVbWTVeFWtV6aWOaRgwLrPDYn4cHWQJqTfhtPrNQ== lass@mors";
-
-  config.sshKeys.uriel.pub = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDExWuRcltGM2FqXO695nm6/QY3wU3r1bDTyCpMrLfUSym7TxcXDSmZSWcueexPXV6GENuUfjJPZswOdWqIo5u2AXw9t0aGvwEDmI6uJ7K5nzQOsXIneGMdYuoOaAzWI8pxZ4N+lIP1HsOYttIPDp8RwU6kyG+Ud8mnVHWSTO13C7xC9vePnDP6b+44nHS691Zj3X/Cq35Ls0ISC3EM17jreucdP62L3TKk2R4NCm3Sjqj+OYEv0LAqIpgqSw5FypTYQgNByxRcIcNDlri63Q1yVftUP1338UiUfxtraUu6cqa2CdsHQmtX5mTNWEluVWO3uUKTz9zla3rShC+d3qvr lass@uriel";
-}
diff --git a/lass/3modules/sshkeys.nix b/lass/3modules/sshkeys.nix
deleted file mode 100644
index 5f1c60668..000000000
--- a/lass/3modules/sshkeys.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib, ... }:
-
-with lib;
-
-{
-  options = {
-    sshKeys = mkOption {
-      type = types.attrsOf (types.submodule (
-      { config, ... }:
-      {
-        options = {
-          pub = mkOption {
-            type = types.str;
-            description = "Public part of the ssh key.";
-          };
-
-          priv = mkOption {
-            type = types.str;
-            description = "Private part of the ssh key.";
-          };
-        };
-      }));
-      description = "collection of ssh-keys";
-    };
-  };
-}

From 3384165fcf31d0afa2e47b784b409ec6345f1ebc Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 19 Oct 2015 13:31:06 +0200
Subject: [PATCH 09/48] l: import urxvt in desktop-base.nix

---
 lass/1systems/mors.nix         | 2 --
 lass/1systems/uriel.nix        | 1 -
 lass/2configs/desktop-base.nix | 1 +
 3 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index 7076c8b14..05efea472 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -10,7 +10,6 @@
     ../2configs/pass.nix
     ../2configs/virtualbox.nix
     ../2configs/elster.nix
-    ../2configs/urxvt.nix
     ../2configs/steam.nix
     ../2configs/wine.nix
     ../2configs/texlive.nix
@@ -18,7 +17,6 @@
     #../2configs/ircd.nix
     ../2configs/chromium-patched.nix
     ../2configs/git.nix
-    #../../2configs/tv/synaptics.nix
     ../2configs/retiolum.nix
     ../2configs/wordpress.nix
     ../2configs/bitlbee.nix
diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix
index 62338d054..2b36912e5 100644
--- a/lass/1systems/uriel.nix
+++ b/lass/1systems/uriel.nix
@@ -7,7 +7,6 @@ with builtins;
     ../2configs/browsers.nix
     ../2configs/games.nix
     ../2configs/pass.nix
-    ../2configs/urxvt.nix
     ../2configs/bird.nix
     ../2configs/git.nix
     ../2configs/chromium-patched.nix
diff --git a/lass/2configs/desktop-base.nix b/lass/2configs/desktop-base.nix
index 27aadb590..1f5c3de55 100644
--- a/lass/2configs/desktop-base.nix
+++ b/lass/2configs/desktop-base.nix
@@ -5,6 +5,7 @@ let
 in {
   imports = [
     ./base.nix
+    ./urxvt.nix
   ];
 
   time.timeZone = "Europe/Berlin";

From c52c48366eae0b06aa51a3f6d2cc85b34ba680c9 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 19 Oct 2015 13:57:42 +0200
Subject: [PATCH 10/48] l 2: rename desktop-base.nix to baseX.nix

---
 lass/1systems/mors.nix                        | 2 +-
 lass/1systems/uriel.nix                       | 2 +-
 lass/2configs/{desktop-base.nix => baseX.nix} | 0
 3 files changed, 2 insertions(+), 2 deletions(-)
 rename lass/2configs/{desktop-base.nix => baseX.nix} (100%)

diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index 05efea472..a21518e14 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -2,7 +2,7 @@
 
 {
   imports = [
-    ../2configs/desktop-base.nix
+    ../2configs/baseX.nix
     ../2configs/programs.nix
     ../2configs/bitcoin.nix
     ../2configs/browsers.nix
diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix
index 2b36912e5..d18559779 100644
--- a/lass/1systems/uriel.nix
+++ b/lass/1systems/uriel.nix
@@ -3,7 +3,7 @@
 with builtins;
 {
   imports = [
-    ../2configs/desktop-base.nix
+    ../2configs/baseX.nix
     ../2configs/browsers.nix
     ../2configs/games.nix
     ../2configs/pass.nix
diff --git a/lass/2configs/desktop-base.nix b/lass/2configs/baseX.nix
similarity index 100%
rename from lass/2configs/desktop-base.nix
rename to lass/2configs/baseX.nix

From 35b476288acce3810bb3ccba0a43dca3ebc094b5 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 19 Oct 2015 13:58:40 +0200
Subject: [PATCH 11/48] l 1 cloudkrebs: remove dic

---
 lass/1systems/cloudkrebs.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lass/1systems/cloudkrebs.nix b/lass/1systems/cloudkrebs.nix
index 17915e087..f3e039433 100644
--- a/lass/1systems/cloudkrebs.nix
+++ b/lass/1systems/cloudkrebs.nix
@@ -49,8 +49,4 @@ in {
 
   networking.hostName = "cloudkrebs";
 
-  environment.systemPackages = [
-    pkgs.dic
-  ];
-
 }

From 1d4f2bf01131d90e370bb8da2d5023aeaacf0b1d Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 19 Oct 2015 14:00:15 +0200
Subject: [PATCH 12/48] l: move more config to base.nix

---
 lass/1systems/cloudkrebs.nix | 19 +------------------
 lass/1systems/echelon.nix    | 19 +------------------
 lass/1systems/mors.nix       | 18 +-----------------
 lass/1systems/uriel.nix      | 19 +------------------
 lass/2configs/base.nix       | 22 ++++++++++++++++++----
 5 files changed, 22 insertions(+), 75 deletions(-)

diff --git a/lass/1systems/cloudkrebs.nix b/lass/1systems/cloudkrebs.nix
index f3e039433..ab24b584b 100644
--- a/lass/1systems/cloudkrebs.nix
+++ b/lass/1systems/cloudkrebs.nix
@@ -27,26 +27,9 @@ in {
 
     }
     {
-      nix.maxJobs = 1;
       sound.enable = false;
     }
   ];
 
-  krebs.build = {
-    user = config.krebs.users.lass;
-    host = config.krebs.hosts.cloudkrebs;
-    source = {
-      dir.secrets = {
-        host = config.krebs.hosts.mors;
-        path = "/home/lass/secrets/${config.krebs.build.host.name}";
-      };
-      dir.stockholm = {
-        host = config.krebs.hosts.mors;
-        path = "/home/lass/dev/stockholm";
-      };
-    };
-  };
-
-  networking.hostName = "cloudkrebs";
-
+  krebs.build.host = config.krebs.hosts.cloudkrebs;
 }
diff --git a/lass/1systems/echelon.nix b/lass/1systems/echelon.nix
index feaf77ef6..80cb51060 100644
--- a/lass/1systems/echelon.nix
+++ b/lass/1systems/echelon.nix
@@ -31,26 +31,9 @@ in {
 
     }
     {
-      nix.maxJobs = 1;
       sound.enable = false;
     }
   ];
 
-  krebs.build = {
-    user = config.krebs.users.lass;
-    host = config.krebs.hosts.echelon;
-    source = {
-      dir.secrets = {
-        host = config.krebs.hosts.mors;
-        path = "/home/lass/secrets/${config.krebs.build.host.name}";
-      };
-      dir.stockholm = {
-        host = config.krebs.hosts.mors;
-        path = "/home/lass/dev/stockholm";
-      };
-    };
-  };
-
-  networking.hostName = config.krebs.build.host.name;
-
+  krebs.build.host = config.krebs.hosts.echelon;
 }
diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index a21518e14..fcdabed40 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -24,22 +24,8 @@
     ../2configs/skype.nix
   ];
 
-  krebs.build = {
-    user = config.krebs.users.lass;
-    host = config.krebs.hosts.mors;
-    source = {
-      dir.secrets = {
-        host = config.krebs.hosts.mors;
-        path = "/home/lass/secrets/${config.krebs.build.host.name}";
-      };
-      dir.stockholm = {
-        host = config.krebs.hosts.mors;
-        path = "/home/lass/dev/stockholm";
-      };
-    };
-  };
+  krebs.build.host = config.krebs.hosts.mors;
 
-  networking.hostName = "mors";
   networking.wireless.enable = true;
 
   networking.extraHosts = ''
@@ -50,8 +36,6 @@
     10.243.206.102 apanowicz.de
   '';
 
-  nix.maxJobs = 4;
-
   hardware.enableAllFirmware = true;
   nixpkgs.config.allowUnfree = true;
 
diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix
index d18559779..3514459fd 100644
--- a/lass/1systems/uriel.nix
+++ b/lass/1systems/uriel.nix
@@ -24,26 +24,9 @@ with builtins;
     }
   ];
 
-  krebs.build = {
-    user = config.krebs.users.lass;
-    target = "root@uriel";
-    host = config.krebs.hosts.uriel;
-    source = {
-      dir.secrets = {
-        host = config.krebs.hosts.mors;
-        path = "/home/lass/secrets/${config.krebs.build.host.name}";
-      };
-      dir.stockholm = {
-        host = config.krebs.hosts.mors;
-        path = "/home/lass/dev/stockholm";
-      };
-    };
-  };
-
-  networking.hostName = "uriel";
+  krebs.build.host = config.krebs.hosts.uriel;
 
   networking.wireless.enable = true;
-  nix.maxJobs = 2;
 
   hardware.enableAllFirmware = true;
   nixpkgs.config.allowUnfree = true;
diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix
index f313054d9..2e42f86ae 100644
--- a/lass/2configs/base.nix
+++ b/lass/2configs/base.nix
@@ -38,14 +38,28 @@ with lib;
     }
   ];
 
+  networking.hostName = config.krebs.build.host.name;
+  nix.maxJobs = config.krebs.build.host.cores;
+
   krebs = {
     enable = true;
     search-domain = "retiolum";
     exim-retiolum.enable = true;
-    build.source = {
-      git.nixpkgs = {
-        url = https://github.com/Lassulus/nixpkgs;
-        rev = "b9270a2e8ac3d2cf4c95075a9529528aa1d859da";
+    build = {
+      user = config.krebs.users.lass;
+      source = {
+        git.nixpkgs = {
+          url = https://github.com/Lassulus/nixpkgs;
+          rev = "b9270a2e8ac3d2cf4c95075a9529528aa1d859da";
+        };
+        dir.secrets = {
+          host = config.krebs.hosts.mors;
+          path = "/home/lass/secrets/${config.krebs.build.host.name}";
+        };
+        dir.stockholm = {
+          host = config.krebs.hosts.mors;
+          path = "/home/lass/stockholm";
+        };
       };
     };
   };

From cd237e5f45a6fe0e155dec9cfa9a63d63c0f7b00 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 19 Oct 2015 14:01:30 +0200
Subject: [PATCH 13/48] l 1: remove dead code

---
 lass/1systems/mors.nix  | 5 -----
 lass/1systems/uriel.nix | 6 ------
 2 files changed, 11 deletions(-)

diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index fcdabed40..190ddb799 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -141,11 +141,6 @@
     emulateWheel = true;
   };
 
-  #system.activationScripts.trackpoint = ''
-  #  echo 0 > '/sys/devices/platform/i8042/serio1/serio2/speed'
-  #  echo 220 > '/sys/devices/platform/i8042/serio1/serio2/sensitivity'
-  #'';
-
   services.xserver = {
     videoDriver = "intel";
     vaapiDrivers = [ pkgs.vaapiIntel ];
diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix
index 3514459fd..2565f4c09 100644
--- a/lass/1systems/uriel.nix
+++ b/lass/1systems/uriel.nix
@@ -47,8 +47,6 @@ with builtins;
     initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
     #kernelModules = [ "kvm-intel" "msr" ];
     kernelModules = [ "msr" ];
-    extraModprobeConfig = ''
-    '';
   };
   fileSystems = {
     "/" = {
@@ -75,10 +73,6 @@ with builtins;
       Option "FingerLow"  "60"
     '';
   };
-
-  environment.systemPackages = with pkgs; [
-  ];
-
   #for google hangout
 
   users.extraUsers.google.extraGroups = [ "audio" "video" ];

From d5096084d0ed25861309501d0f6c6730117f8713 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 19 Oct 2015 14:02:17 +0200
Subject: [PATCH 14/48] l 1 mors: configure touchpad

---
 lass/1systems/mors.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index 190ddb799..0e7ed7c62 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -187,9 +187,16 @@
       ];
     };
   };
+
   #touchpad config
   services.xserver.synaptics = {
     enable = true;
+    accelFactor = "0.035";
+    additionalOptions = ''
+      Option "FingerHigh" "60"
+      Option "FingerLow"  "60"
+    '';
     tapButtons = false;
+    twoFingerScroll = true;
   };
 }

From bb713845190d558d52ab29327055530e73345340 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 19 Oct 2015 14:02:38 +0200
Subject: [PATCH 15/48] l 1 uriel: remove obsolete code

---
 lass/1systems/uriel.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix
index 2565f4c09..1b008cbfd 100644
--- a/lass/1systems/uriel.nix
+++ b/lass/1systems/uriel.nix
@@ -73,7 +73,4 @@ with builtins;
       Option "FingerLow"  "60"
     '';
   };
-  #for google hangout
-
-  users.extraUsers.google.extraGroups = [ "audio" "video" ];
 }

From 517e6e00097f4f9ebb1f7bd784d2bb44dce5f4b8 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 19 Oct 2015 14:03:08 +0200
Subject: [PATCH 16/48] l 2 base: remove old code

---
 lass/2configs/base.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix
index 2e42f86ae..902fcb70b 100644
--- a/lass/2configs/base.nix
+++ b/lass/2configs/base.nix
@@ -137,12 +137,6 @@ with lib;
     "sendmail"
   ];
 
-  #services.gitolite = {
-  #  enable = true;
-  #  dataDir = "/home/gitolite";
-  #  adminPubkey = config.sshKeys.lass.pub;
-  #};
-
   services.openssh = {
     enable = true;
     hostKeys = [

From 34eb9a67a26ee847891d3c2a4d0172519da3e2fc Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 19 Oct 2015 14:03:50 +0200
Subject: [PATCH 17/48] l 2: add newsbot-js.nix

---
 lass/2configs/newsbot-js.nix | 202 +++++++++++++++++++++++++++++++++++
 1 file changed, 202 insertions(+)
 create mode 100644 lass/2configs/newsbot-js.nix

diff --git a/lass/2configs/newsbot-js.nix b/lass/2configs/newsbot-js.nix
new file mode 100644
index 000000000..211b29780
--- /dev/null
+++ b/lass/2configs/newsbot-js.nix
@@ -0,0 +1,202 @@
+{ config, pkgs, ... }:
+
+let
+  newsfile = pkgs.writeText "feeds" ''
+    aje|http://www.aljazeera.com/Services/Rss/?PostingId=2007731105943979989|#news
+    aktuelle_themen|http://bundestag.de/service/rss/Bundestag_Aktuelle_Themen.rss|#news #bundestag
+    allafrica|http://allafrica.com/tools/headlines/rdf/latest/headlines.rdf|#news
+    anon|http://anoninsiders.net/feed/|#news
+    antirez|http://antirez.com/rss|#news
+    arbor|http://feeds2.feedburner.com/asert/|#news
+    archlinux|http://www.archlinux.org/feeds/news/|#news
+    ars|http://feeds.arstechnica.com/arstechnica/index?format=xml|#news
+    asiaone_asia|http://news.asiaone.com/rss/asia|#news
+    asiaone_business|http://business.asiaone.com/rss.xml|#news
+    asiaone_sci|http://news.asiaone.com/rss/science-and-tech|#news
+    asiaone_world|http://news.asiaone.com/rss/world|#news
+    augustl|http://augustl.com/atom.xml|#news
+    bbc|http://feeds.bbci.co.uk/news/rss.xml|#news
+    bdt_drucksachen|http://www.bundestag.de/dip21rss/bundestag_drucksachen.rss|#news #bundestag
+    bdt_plenarproto|http://www.bundestag.de/rss_feeds/plenarprotokolle.rss|#news #bundestag
+    bdt_pressemitteilungen|http://bundestag.de/service/rss/Bundestag_Presse.rss|#news #bundestag
+    bdt_wd|http://bundestag.de/service/rss/Bundestag_WD.rss|#news #bundestag
+    bitcoinpakistan|https://bitcoinspakistan.com/feed/|#news #financial
+    cancer|http://feeds.feedburner.com/ncinewsreleases?format=xml|#news
+    carta|http://feeds2.feedburner.com/carta-standard-rss|#news
+    catholic_news|http://feeds.feedburner.com/catholicnewsagency/dailynews|#news
+    cbc_busi|http://rss.cbc.ca/lineup/business.xml|#news
+    cbc_offbeat|http://www.cbc.ca/cmlink/rss-offbeat|#news
+    cbc_pol|http://rss.cbc.ca/lineup/politics.xml|#news
+    cbc_tech|http://rss.cbc.ca/lineup/technology.xml|#news
+    cbc_top|http://rss.cbc.ca/lineup/topstories.xml|#news
+    ccc|http://www.ccc.de/rss/updates.rdf|#news
+    chan_b|https://boards.4chan.org/b/index.rss|#brainfuck
+    chan_biz|https://boards.4chan.org/biz/index.rss|#news #brainfuck
+    chan_int|https://boards.4chan.org/int/index.rss|#news #brainfuck
+    cna|http://www.channelnewsasia.com/starterkit/servlet/cna/rss/home.xml|#news
+    coinspotting|http://coinspotting.com/rss|#news #financial
+    cryptanalysis|https://cryptanalys.is/rss.php|#news
+    cryptocoinsnews|http://www.cryptocoinsnews.com/feed/|#news #financial
+    cryptogon|http://www.cryptogon.com/?feed=rss2|#news
+    csm|http://rss.csmonitor.com/feeds/csm|#news
+    csm_world|http://rss.csmonitor.com/feeds/world|#news
+    cyberguerrilla|https://www.cyberguerrilla.org/a/2012/?feed=rss2|#news
+    danisch|http://www.danisch.de/blog/feed/|#news
+    dod|http://www.defense.gov/news/afps2.xml|#news
+    dwn|http://deutsche-wirtschafts-nachrichten.de/feed/customfeed/|#news
+    ecat|http://ecat.com/feed|#news
+    eia_press|http://www.eia.gov/rss/press_rss.xml|#news
+    eia_today|http://www.eia.gov/rss/todayinenergy.xml|#news
+    embargowatch|https://embargowatch.wordpress.com/feed/|#news
+    ethereum-comments|http://blog.ethereum.org/comments/feed|#news
+    ethereum|http://blog.ethereum.org/feed|#news
+    europa_ric|http://ec.europa.eu/research/infocentre/rss/infocentre-rss.xml|#news
+    eu_survei|http://www.eurosurveillance.org/public/RSSFeed/RSS.aspx|#news
+    exploitdb|http://www.exploit-db.com/rss.xml|#news
+    fars|http://www.farsnews.com/rss.php|#news #test
+    faz_feui|http://www.faz.net/rss/aktuell/feuilleton/|#news
+    faz_politik|http://www.faz.net/rss/aktuell/politik/|#news
+    faz_wirtschaft|http://www.faz.net/rss/aktuell/wirtschaft/|#news #financial
+    fbi|http://www.fbi.gov/homepage/RSS|#news #bullerei
+    fbi_news|http://www.fbi.gov/news/news_blog/rss.xml|#news
+    fbi_press|http://www.fbi.gov/news/current/rss.xml|#news #bullerei
+    fbi_stories|http://www.fbi.gov/news/stories/all-stories/rss.xml|#news #bullerei
+    fedreserve|http://www.federalreserve.gov/feeds/press_all.xml|#news #financial
+    fefe|http://blog.fefe.de/rss.xml|#news
+    forbes|http://www.forbes.com/forbes/feed2/|#news
+    forbes_realtime|http://www.forbes.com/real-time/feed2/|#news
+    fox|http://feeds.foxnews.com/foxnews/latest|#news
+    geheimorganisation|http://geheimorganisation.org/feed/|#news
+    GerForPol|http://www.german-foreign-policy.com/de/news/rss-2.0|#news
+    gmanet|http://www.gmanetwork.com/news/rss/news|#news
+    golem|http://www.golem.de/rss.php?feed=RSS1.0|#news
+    google|http://news.google.com/?output=rss|#news
+    greenpeace|http://feeds.feedburner.com/GreenpeaceNews|#news
+    guardian_uk|http://feeds.theguardian.com/theguardian/uk-news/rss|#news
+    gulli|http://ticker.gulli.com/rss/|#news
+    handelsblatt|http://www.handelsblatt.com/contentexport/feed/schlagzeilen|#news #financial
+    heise|http://heise.de.feedsportal.com/c/35207/f/653902/index.rss|#news
+    hindu_business|http://www.thehindubusinessline.com/?service=rss|#news #financial
+    hindu|http://www.thehindu.com/?service=rss|#news
+    hintergrund|http://www.hintergrund.de/index.php?option=com_bca-rss-syndicator&feed_id=8|#news
+    ign|http://feeds.ign.com/ign/all|#news
+    independent|http://www.independent.com/rss/headlines/|#news
+    indymedia|http://de.indymedia.org/RSS/newswire.xml|#news
+    info_libera|http://www.informationliberation.com/rss.xml|#news
+    klagen-gegen-rundfuckbeitrag|http://klagen-gegen-rundfunkbeitrag.blogspot.com/feeds/posts/default|#news
+    korea_herald|http://www.koreaherald.com/rss_xml.php|#news
+    linuxinsider|http://www.linuxinsider.com/perl/syndication/rssfull.pl|#news
+    lisp|http://planet.lisp.org/rss20.xml|#news
+    liveleak|http://www.liveleak.com/rss|#news
+    lolmythesis|http://lolmythesis.com/rss|#news
+    LtU|http://lambda-the-ultimate.org/rss.xml|#news
+    lukepalmer|http://lukepalmer.wordpress.com/feed/|#news
+    mit|http://web.mit.edu/newsoffice/rss-feeds.feed?type=rss|#news
+    mongrel2_master|https://github.com/zedshaw/mongrel2/commits/master.atom|#news
+    nds|http://www.nachdenkseiten.de/?feed=atom|#news
+    netzpolitik|https://netzpolitik.org/feed/|#news
+    newsbtc|http://newsbtc.com/feed/|#news #financial
+    nnewsg|http://www.net-news-global.net/rss/rssfeed.xml|#news
+    npr_busi|http://www.npr.org/rss/rss.php?id=1006|#news
+    npr_headlines|http://www.npr.org/rss/rss.php?id=1001|#news
+    npr_pol|http://www.npr.org/rss/rss.php?id=1012|#news
+    npr_world|http://www.npr.org/rss/rss.php?id=1004|#news
+    nsa|http://www.nsa.gov/rss.shtml|#news #bullerei
+    nytimes|http://rss.nytimes.com/services/xml/rss/nyt/World.xml|#news
+    painload|https://github.com/krebscode/painload/commits/master.atom|#news
+    phys|http://phys.org/rss-feed/|#news
+    piraten|https://www.piratenpartei.de/feed/|#news
+    polizei_berlin|http://www.berlin.de/polizei/presse-fahndung/_rss_presse.xml|#news #bullerei
+    presse_polizei|http://www.presseportal.de/rss/polizei.rss2|#news #bullerei
+    presseportal|http://www.presseportal.de/rss/presseportal.rss2|#news
+    prisonplanet|http://prisonplanet.com/feed.rss|#news
+    proofmarket|https://proofmarket.org/feed_problem|#news
+    rawstory|http://www.rawstory.com/rs/feed/|#news
+    reddit_4chan|http://www.reddit.com/r/4chan/new/.rss|#news #brainfuck
+    reddit_anticonsum|http://www.reddit.com/r/Anticonsumption/new/.rss|#news
+    reddit_btc|http://www.reddit.com/r/Bitcoin/new/.rss|#news #financial
+    reddit_prog|http://www.reddit.com/r/programming/new/.rss|#news
+    reddit_tpp|http://www.reddit.com/r/twitchplayspokemon/.rss|#news #tpp
+    reddit_world|http://www.reddit.com/r/worldnews/.rss|#news
+    r-ethereum|http://www.reddit.com/r/ethereum/.rss|#news
+    reuters|http://feeds.reuters.com/Reuters/worldNews|#news
+    reuters-odd|http://feeds.reuters.com/reuters/oddlyEnoughNews?format=xml|#news
+    rt|http://rt.com/rss/news/|#news
+    schallurauch|http://feeds.feedburner.com/SchallUndRauch|#news
+    sciencemag|http://news.sciencemag.org/rss/current.xml|#news
+    scmp|http://www.scmp.com/rss/91/feed|#news
+    sec-db|http://feeds.security-database.com/SecurityDatabaseToolsWatch|#news
+    shackspace|http://shackspace.de/?feed=rss2|#news
+    shz_news|http://www.shz.de/nachrichten/newsticker/rss|#news
+    sky_busi|http://news.sky.com/feeds/rss/business.xml|#news
+    sky_pol|http://news.sky.com/feeds/rss/politics.xml|#news
+    sky_strange|http://news.sky.com/feeds/rss/strange.xml|#news
+    sky_tech|http://news.sky.com/feeds/rss/technology.xml|#news
+    sky_world|http://news.sky.com/feeds/rss/world.xml|#news
+    slashdot|http://rss.slashdot.org/Slashdot/slashdot|#news
+    slate|http://feeds.slate.com/slate|#news
+    spiegel_eil|http://www.spiegel.de/schlagzeilen/eilmeldungen/index.rss|#news
+    spiegelfechter|http://feeds.feedburner.com/DerSpiegelfechter?format=xml|#news
+    spiegel_top|http://www.spiegel.de/schlagzeilen/tops/index.rss|#news
+    standardmedia_ke|http://www.standardmedia.co.ke/rss/headlines.php|#news
+    stern|http://www.stern.de/feed/standard/all/|#news
+    stz|http://www.stuttgarter-zeitung.de/rss/topthemen.rss.feed|#news
+    sz_politik|http://rss.sueddeutsche.de/rss/Politik|#news
+    sz_wirtschaft|http://rss.sueddeutsche.de/rss/Wirtschaft|#news #financial
+    sz_wissen|http://suche.sueddeutsche.de/rss/Wissen|#news
+    tagesschau|http://www.tagesschau.de/newsticker.rdf|#news
+    taz|http://taz.de/Themen-des-Tages/!p15;rss/|#news
+    telegraph_finance|http://www.telegraph.co.uk/finance/rss|#news #financial
+    telegraph_pol|http://www.telegraph.co.uk/news/politics/rss|#news
+    telegraph_uk|http://www.telegraph.co.uk/news/uknews/rss|#news
+    telegraph_world|http://www.telegraph.co.uk/news/worldnews/rss|#news
+    telepolis|http://www.heise.de/tp/rss/news-atom.xml|#news
+    the_insider|http://www.theinsider.org/rss/news/headlines-xml.asp|#news
+    tigsource|http://www.tigsource.com/feed/|#news
+    times|http://www.thetimes.co.uk/tto/news/rss|#news
+    tinc|http://tinc-vpn.org/news/index.rss|#news
+    topix_b|http://www.topix.com/rss/wire/de/berlin|#news
+    torr_bits|http://feeds.feedburner.com/TorrentfreakBits|#news
+    torrentfreak|http://feeds.feedburner.com/Torrentfreak|#news
+    torr_news|http://feed.torrentfreak.com/Torrentfreak/|#news
+    travel_warnings|http://feeds.travel.state.gov/ca/travelwarnings-alerts|#news
+    truther|http://truthernews.wordpress.com/feed/|#news
+    un_afr|http://www.un.org/apps/news/rss/rss_africa.asp|#news
+    un_am|http://www.un.org/apps/news/rss/rss_americas.asp|#news
+    un_eu|http://www.un.org/apps/news/rss/rss_europe.asp|#news
+    un_me|http://www.un.org/apps/news/rss/rss_mideast.asp|#news
+    un_pac|http://www.un.org/apps/news/rss/rss_asiapac.asp|#news
+    un_top|http://www.un.org/apps/news/rss/rss_top.asp|#news
+    us_math_society|http://www.ams.org/cgi-bin/content/news_items.cgi?rss=1|#news
+    vimperator|https://sites.google.com/a/vimperator.org/www/blog/posts.xml|#news
+    weechat|http://dev.weechat.org/feed/atom|#news
+    wired_sci|http://www.wired.com/category/science/feed/|#news
+    wp_world|http://feeds.washingtonpost.com/rss/rss_blogpost|#news
+    xkcd|https://xkcd.com/rss.xml|#news
+    zdnet|http://www.zdnet.com/news/rss.xml|#news
+
+    chan_g|https://boards.4chan.org/g/index.rss|#news
+    chan_x|https://boards.4chan.org/x/index.rss|#news
+    chan_sci|https://boards.4chan.org/sci/index.rss|#news
+    reddit_consp|http://reddit.com/r/conspiracy/.rss|#news
+    reddit_sci|http://www.reddit.com/r/science/.rss|#news
+    reddit_tech|http://www.reddit.com/r/technology/.rss|#news
+    reddit_nix|http://www.reddit.com/r/nixos/.rss|#news
+    reddit_haskell|http://www.reddit.com/r/haskell/.rss|#news
+    hackernews|https://news.ycombinator.com/rss|#news
+  '';
+in {
+  imports = [
+    ../3modules/newsbot-js.nix
+  ];
+  environment.systemPackages = [
+    pkgs.newsbot-js
+  ];
+  lass.newsbot-js = {
+    enable = true;
+    ircServer = "localhost";
+    feeds = newsfile;
+    urlShortenerHost = "go";
+    urlShortenerPort = "80";
+  };
+}

From 281ba78969e0c0233fef0746d42f0ec85179b1bd Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Mon, 19 Oct 2015 14:06:04 +0200
Subject: [PATCH 18/48] l 3: add modules to default.nix

---
 lass/3modules/default.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lass/3modules/default.nix b/lass/3modules/default.nix
index 9de987bf3..b081dc3cc 100644
--- a/lass/3modules/default.nix
+++ b/lass/3modules/default.nix
@@ -1,7 +1,13 @@
 _:
-
 {
   imports = [
     ./xresources.nix
+    ./bitlbee.nix
+    ./folderPerms.nix
+    ./go.nix
+    ./newsbot-js.nix
+    ./per-user.nix
+    ./urxvtd.nix
+    ./xresources.nix
   ];
 }

From 2efaf0f219850cd02cc77cb41d6c1c1bdd9de6ba Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Tue, 20 Oct 2015 20:06:17 +0200
Subject: [PATCH 19/48] populate dir: improve error message

---
 krebs/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/krebs/default.nix b/krebs/default.nix
index c23cf152a..5e6595ced 100644
--- a/krebs/default.nix
+++ b/krebs/default.nix
@@ -221,11 +221,15 @@ let out = {
               ${config.path}/ \
               root@${target}:${config.target-path}
           '';
-          url = "file://${config.host.name}${config.path}";
+          current-url = "${current-user-name}@${current-host.name}";
+          source-url = "file://${config.host.name}${config.path}";
+          target-url = "root@${target}:${config.target-path}";
         in
         #if can-link then link-method else
         if can-push then push-method else
-        throw "cannot source ${url}";
+        throw
+          # /!\ revise this message when using more than just push-method
+          "No way to push ${source-url} from ${current-url} to ${target-url}";
 
       methods.git = config:
         rootssh target ''

From acb53c23dcb11de02e642e7f99e83401531e48c1 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Tue, 20 Oct 2015 20:19:40 +0200
Subject: [PATCH 20/48] populate dir: drop link-method fragments

---
 krebs/default.nix | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/krebs/default.nix b/krebs/default.nix
index 5e6595ced..40b3550c8 100644
--- a/krebs/default.nix
+++ b/krebs/default.nix
@@ -203,11 +203,8 @@ let out = {
       current-host = config.krebs.hosts.${current-host-name};
       current-user = config.krebs.users.${current-user-name};
 
-      target-host = config.krebs.hosts.${system};
-
       methods.dir = config:
         let
-          can-link = config.host.name == target-host.name;
           can-push = config.host.name == current-host.name;
           push-method = ''
             rsync \
@@ -219,13 +216,12 @@ let out = {
               --delete-excluded \
               -vrLptgoD \
               ${config.path}/ \
-              root@${target}:${config.target-path}
+              ${target-url}
           '';
           current-url = "${current-user-name}@${current-host.name}";
           source-url = "file://${config.host.name}${config.path}";
           target-url = "root@${target}:${config.target-path}";
         in
-        #if can-link then link-method else
         if can-push then push-method else
         throw
           # /!\ revise this message when using more than just push-method

From 9cb1fdc946aecc96bd9bbadca77b6d7e3c87abd3 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Tue, 20 Oct 2015 20:24:25 +0200
Subject: [PATCH 21/48] populate dir: reduce noise in error message

---
 krebs/default.nix | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/krebs/default.nix b/krebs/default.nix
index 40b3550c8..3e86c0466 100644
--- a/krebs/default.nix
+++ b/krebs/default.nix
@@ -216,16 +216,13 @@ let out = {
               --delete-excluded \
               -vrLptgoD \
               ${config.path}/ \
-              ${target-url}
+              root@${target}:${config.target-path}
           '';
-          current-url = "${current-user-name}@${current-host.name}";
-          source-url = "file://${config.host.name}${config.path}";
-          target-url = "root@${target}:${config.target-path}";
         in
         if can-push then push-method else
-        throw
-          # /!\ revise this message when using more than just push-method
-          "No way to push ${source-url} from ${current-url} to ${target-url}";
+        let dir = "file://${config.host.name}${config.path}"; in
+        # /!\ revise this message when using more than just push-method
+        throw "No way to push ${dir} from ${current-host.name} to ${target}";
 
       methods.git = config:
         rootssh target ''

From 914c4c4a2fb6be95f7f4dbc9134fd272ec210c26 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Tue, 20 Oct 2015 20:28:26 +0200
Subject: [PATCH 22/48] krebs default: drop redundant "lib."

---
 krebs/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/krebs/default.nix b/krebs/default.nix
index 3e86c0466..9258c236b 100644
--- a/krebs/default.nix
+++ b/krebs/default.nix
@@ -48,14 +48,14 @@ let out = {
       #  eval "$RSYNC_RSH \"\$@\""
       #}
 
-      ${lib.rootssh target ''
+      ${rootssh target ''
         ${builtins.readFile ./4lib/infest/prepare.sh}
         ${builtins.readFile ./4lib/infest/install-nix.sh}
       ''}
 
-      (${lib.populate args})
+      (${populate args})
 
-      ${lib.rootssh target ''
+      ${rootssh target ''
         export PATH; PATH=/root/.nix-profile/bin:$PATH
 
         src=$(type -p nixos-install)
@@ -79,7 +79,7 @@ let out = {
 
         {
           cat_src | sed -n "1,$i{p}"
-          cat ${lib.doc (install args)}
+          cat ${doc (install args)}
           cat_src | sed -n "$i,\''${$i!p}"
         } > nixos-install
         chmod +x nixos-install

From d2c121e651e7b175b93a9962e861f286391ab3ca Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Tue, 20 Oct 2015 20:30:37 +0200
Subject: [PATCH 23/48] tv urlwatch: drop nixops

Because nixops 1.2 -> 1.3 in NixOS/nixpkgs@92e98c2.
---
 tv/2configs/urlwatch.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/tv/2configs/urlwatch.nix b/tv/2configs/urlwatch.nix
index c1c5d19d9..373803cc6 100644
--- a/tv/2configs/urlwatch.nix
+++ b/tv/2configs/urlwatch.nix
@@ -29,10 +29,6 @@
       # 2014-09-24 ref https://github.com/4z3/xintmap
       http://www.mathstat.dal.ca/~selinger/quipper/
 
-      # 2014-12-12 remove nixopsUnstable when nixops get's bumped to 1.3
-      # ref https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/package-management/nixops/unstable.nix
-      http://nixos.org/releases/nixops/
-
       ## other
 
       https://nixos.org/channels/nixos-unstable/git-revision

From 9bbdfb85cf333fde4050bbef738c54ca988db228 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Tue, 20 Oct 2015 22:13:42 +0200
Subject: [PATCH 24/48] export krebs.populate

---
 krebs/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/krebs/default.nix b/krebs/default.nix
index 9258c236b..4d09075cb 100644
--- a/krebs/default.nix
+++ b/krebs/default.nix
@@ -8,6 +8,7 @@ let out = {
     inherit deploy;
     inherit infest;
     inherit init;
+    inherit populate;
     inherit lib;
   };
 

From fc45cc29265e9b3e51033fddd5d8ea1042c1aa41 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Tue, 20 Oct 2015 23:17:32 +0200
Subject: [PATCH 25/48] export krebs.nixos-install

Collaterally, unexport krebs.populate again.
---
 krebs/default.nix | 101 ++++++++++++++++++++++------------------------
 1 file changed, 48 insertions(+), 53 deletions(-)

diff --git a/krebs/default.nix b/krebs/default.nix
index 4d09075cb..de805a89c 100644
--- a/krebs/default.nix
+++ b/krebs/default.nix
@@ -8,8 +8,8 @@ let out = {
     inherit deploy;
     inherit infest;
     inherit init;
-    inherit populate;
     inherit lib;
+    inherit nixos-install;
   };
 
   deploy =
@@ -24,7 +24,7 @@ let out = {
       set -efu
       (${populate args})
       ${rootssh target ''
-        ${install args}
+        ${nix-install args}
         ${config.krebs.build.profile}/bin/switch-to-configuration switch
       ''}
       echo OK
@@ -40,63 +40,14 @@ let out = {
       # krebs.infest
       set -efu
 
-      # XXX type -p is non-standard
-      #export RSYNC_RSH; RSYNC_RSH="$(type -p ssh) \
-      #  -o 'HostName $ {target.host.infest.addr}' \
-      #  -o 'Port $ {toString target.host.infest.port}' \
-      #"
-      #ssh() {
-      #  eval "$RSYNC_RSH \"\$@\""
-      #}
-
       ${rootssh target ''
         ${builtins.readFile ./4lib/infest/prepare.sh}
         ${builtins.readFile ./4lib/infest/install-nix.sh}
       ''}
 
-      (${populate args})
+      (${nixos-install args})
 
       ${rootssh target ''
-        export PATH; PATH=/root/.nix-profile/bin:$PATH
-
-        src=$(type -p nixos-install)
-        cat_src() {
-          sed < "$src" "$(
-            { sed < "$src" -n '
-                  /^if ! test -e "\$mountPoint\/\$NIXOS_CONFIG/,/^fi$/=
-                  /^nixpkgs=/=
-                  /^NIX_PATH=/,/^$/{/./=}
-
-                  # Disable: Copy the NixOS/Nixpkgs sources to the target as
-                  # the initial contents of the NixOS channel.
-                  /^srcs=/,/^ln -sfn /=
-                '
-            } | sed 's:$:s/^/#krebs#/:'
-          )"
-        }
-
-        # Location to insert install
-        i=$(sed -n '/^echo "building the system configuration/=' "$src")
-
-        {
-          cat_src | sed -n "1,$i{p}"
-          cat ${doc (install args)}
-          cat_src | sed -n "$i,\''${$i!p}"
-        } > nixos-install
-        chmod +x nixos-install
-
-        ## Wrap inserted install into chroot.
-        #nix_env=$(cat_src | sed -n '
-        #  s:.*\(/nix/store/[a-z0-9]*-nix-[0-9.]\+/bin/nix-env\).*:\1:p;T;q
-        #')
-        #echo nix-env is $nix_env
-        #sed -i '
-        #  s:^nix-env:chroot $mountPoint '"$nix_env"':
-        #' nixos-install
-
-        unset SSL_CERT_FILE
-        ./nixos-install
-
         ${builtins.readFile ./4lib/infest/finalize.sh}
       ''}
     '';
@@ -136,6 +87,50 @@ let out = {
       EOF
     '';
 
+  nixos-install =
+    { system ? current-host-name
+    , target ? system
+    }@args: let
+    in ''
+      #! /bin/sh
+      # ${current-date} ${current-user-name}@${current-host-name}
+      # krebs.nixos-install
+      (${populate args})
+
+      ${rootssh target ''
+        export PATH; PATH=/root/.nix-profile/bin:$PATH
+
+        src=$(type -p nixos-install)
+        cat_src() {
+          sed < "$src" "$(
+            { sed < "$src" -n '
+                  /^if ! test -e "\$mountPoint\/\$NIXOS_CONFIG/,/^fi$/=
+                  /^nixpkgs=/=
+                  /^NIX_PATH=/,/^$/{/./=}
+
+                  # Disable: Copy the NixOS/Nixpkgs sources to the target as
+                  # the initial contents of the NixOS channel.
+                  /^srcs=/,/^ln -sfn /=
+                '
+            } | sed 's:$:s/^/#krebs#/:'
+          )"
+        }
+
+        # Location to insert `nix-install`
+        i=$(sed -n '/^echo "building the system configuration/=' "$src")
+
+        {
+          cat_src | sed -n "1,$i{p}"
+          cat ${doc (nix-install args)}
+          cat_src | sed -n "$i,\''${$i!p}"
+        } > nixos-install
+        chmod +x nixos-install
+
+        unset SSL_CERT_FILE
+        ./nixos-install
+      ''}
+    '';
+
   lib = import ./4lib { lib = import <nixpkgs/lib>; } // rec {
     stockholm-path = ../.;
     nspath = ns: p: stockholm-path + "/${ns}/${p}";
@@ -153,7 +148,7 @@ let out = {
     stockholm.users.${current-user-name}.${system}.config
       or (abort "unknown system: ${system}, user: ${current-user-name}");
 
-  install =
+  nix-install =
     { system ? current-host-name
     , target ? system
     }:

From 226ea391caec5b3f2f112de263dd2db3a0e012f4 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Wed, 21 Oct 2015 00:08:18 +0200
Subject: [PATCH 26/48] stockholm: provide krebs lib

---
 default.nix                          | 24 +++++++++++++++++++-----
 krebs/3modules/build.nix             |  2 +-
 krebs/3modules/default.nix           |  2 +-
 krebs/3modules/git.nix               |  2 +-
 krebs/3modules/github-hosts-sync.nix |  3 +--
 krebs/3modules/lass/default.nix      |  2 +-
 krebs/3modules/makefu/default.nix    |  2 +-
 krebs/3modules/tv/default.nix        |  2 +-
 krebs/4lib/default.nix               |  2 --
 krebs/5pkgs/default.nix              |  5 ++---
 krebs/default.nix                    |  7 +------
 tv/2configs/test.nix                 |  2 +-
 tv/3modules/consul.nix               |  2 +-
 tv/4lib/default.nix                  | 14 ++++----------
 14 files changed, 35 insertions(+), 36 deletions(-)

diff --git a/default.nix b/default.nix
index 11bae7d98..c70225174 100644
--- a/default.nix
+++ b/default.nix
@@ -47,8 +47,20 @@ let stockholm = {
     inherit (eval {}) pkgs;
   };
 
-  krebs = import ./krebs (current // { inherit stockholm; });
-  inherit (krebs) lib;
+  krebs = import ./krebs (current // { inherit lib stockholm; });
+
+  lib =
+    let
+      lib = import <nixpkgs/lib>;
+      klib = import ./krebs/4lib { inherit lib; };
+      #ulib = import (./. + "/${current-user-name}/4lib") { lib = lib // klib; };
+      ulib = {}; # TODO
+    in
+    builtins // lib // klib // ulib // rec {
+      # TODO move this stuff
+      stockholm-path = ./.;
+      nspath = ns: p: stockholm-path + "/${ns}/${p}";
+    };
 
   # Path resolvers for common and individual files.
   # Example: `upath "3modules"` produces the current user's 3modules directory
@@ -65,8 +77,8 @@ let stockholm = {
       let
         # Notice the ordering.  Krebs packages can only depend on Nixpkgs,
         # whereas user packages additionally can depend on krebs packages.
-        kpkgs = import (kpath "5pkgs") { inherit pkgs; };
-        upkgs = import (upath "5pkgs") { pkgs = pkgs // kpkgs; };
+        kpkgs = import (kpath "5pkgs") { inherit lib pkgs; };
+        upkgs = import (upath "5pkgs") { inherit lib; pkgs = pkgs // kpkgs; };
       in
       kpkgs // upkgs;
   };
@@ -76,8 +88,10 @@ let stockholm = {
   # packages and modules on top of NixOS.  Some of this stuff might become
   # useful to a broader audience, at which point it should probably be merged
   # and pull-requested for inclusion into NixOS/nixpkgs.
-  # TODO provide krebs lib, so modules don't have to import it awkwardly
   eval = config: import <nixpkgs/nixos/lib/eval-config.nix> {
+    specialArgs = {
+      inherit lib;
+    };
     modules = [
       base-module
       config
diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix
index 57495ea69..1205e192b 100644
--- a/krebs/3modules/build.nix
+++ b/krebs/3modules/build.nix
@@ -1,6 +1,6 @@
 { config, lib, ... }:
 
-with import ../4lib { inherit lib; };
+with lib;
 
 let
   target = config.krebs.build // { user.name = "root"; };
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index ff0cc8346..e2aea7057 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -1,6 +1,6 @@
 { config, lib, ... }:
 
-with import ../4lib { inherit lib; };
+with lib;
 let
   cfg = config.krebs;
 
diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix
index 64b7820b2..234129497 100644
--- a/krebs/3modules/git.nix
+++ b/krebs/3modules/git.nix
@@ -6,7 +6,7 @@
 # TODO when authorized_keys changes, then restart ssh
 #       (or kill already connected users somehow)
 
-with import ../4lib { inherit lib; };
+with lib;
 let
   cfg = config.krebs.git;
 
diff --git a/krebs/3modules/github-hosts-sync.nix b/krebs/3modules/github-hosts-sync.nix
index 2a1df9e03..5503ee8d6 100644
--- a/krebs/3modules/github-hosts-sync.nix
+++ b/krebs/3modules/github-hosts-sync.nix
@@ -1,7 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with import ../4lib { inherit lib; };
+with lib;
 let
   cfg = config.krebs.github-hosts-sync;
 
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index afedf95f2..59052021b 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -1,6 +1,6 @@
 { lib, ... }:
 
-with import ../../4lib { inherit lib; };
+with lib;
 
 {
   hosts = addNames {
diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index 4628b2acc..9cf5c9aea 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -1,6 +1,6 @@
 { lib, ... }:
 
-with import ../../4lib { inherit lib; };
+with lib;
 
 {
   hosts = addNames {
diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index 5d5fead8f..5a1ff1416 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -1,6 +1,6 @@
 { lib, ... }:
 
-with import ../../4lib { inherit lib; };
+with lib;
 
 {
   dns.providers = {
diff --git a/krebs/4lib/default.nix b/krebs/4lib/default.nix
index 0a6101314..396307c22 100644
--- a/krebs/4lib/default.nix
+++ b/krebs/4lib/default.nix
@@ -3,8 +3,6 @@
 with builtins;
 with lib;
 
-builtins //
-lib //
 rec {
 
   eq = x: y: x == y;
diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix
index 84fb8725b..0ec4b3ded 100644
--- a/krebs/5pkgs/default.nix
+++ b/krebs/5pkgs/default.nix
@@ -1,7 +1,6 @@
-{ pkgs, ... }:
-
-with import ../4lib { inherit (pkgs) lib; };
+{ lib, pkgs, ... }:
 
+with lib;
 let
   subdirs = mapAttrs (_: flip pkgs.callPackage {}) (subdirsOf ./.);
   pkgs' = pkgs // subdirs;
diff --git a/krebs/default.nix b/krebs/default.nix
index de805a89c..5518a4496 100644
--- a/krebs/default.nix
+++ b/krebs/default.nix
@@ -1,6 +1,7 @@
 { current-date
 , current-host-name
 , current-user-name
+, lib
 , stockholm
 }:
 
@@ -8,7 +9,6 @@ let out = {
     inherit deploy;
     inherit infest;
     inherit init;
-    inherit lib;
     inherit nixos-install;
   };
 
@@ -131,11 +131,6 @@ let out = {
       ''}
     '';
 
-  lib = import ./4lib { lib = import <nixpkgs/lib>; } // rec {
-    stockholm-path = ../.;
-    nspath = ns: p: stockholm-path + "/${ns}/${p}";
-  };
-
   doc = s:
     let b = "EOF${builtins.hashString "sha256" s}"; in
     ''
diff --git a/tv/2configs/test.nix b/tv/2configs/test.nix
index 409b4e9b4..f5f068d6f 100644
--- a/tv/2configs/test.nix
+++ b/tv/2configs/test.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with import ../4lib { inherit lib pkgs; };
+with lib;
 
 let
   out = {
diff --git a/tv/3modules/consul.nix b/tv/3modules/consul.nix
index e764ab7b2..ccdee07f5 100644
--- a/tv/3modules/consul.nix
+++ b/tv/3modules/consul.nix
@@ -5,7 +5,7 @@
 # TODO consul-bootstrap HOST  that actually does is
 # TODO tools to inspect state of a cluster in outage state
 
-with import ../4lib { inherit lib pkgs; };
+with lib;
 let
   cfg = config.tv.consul;
 
diff --git a/tv/4lib/default.nix b/tv/4lib/default.nix
index 106535ba2..7e6b2ab17 100644
--- a/tv/4lib/default.nix
+++ b/tv/4lib/default.nix
@@ -1,20 +1,14 @@
 { lib, pkgs, ... }:
 
-let
-  krebs = import ../../krebs/4lib { inherit lib; };
-in
-
-with krebs;
-
-krebs // rec {
+lib // rec {
 
   git = import ./git.nix {
-    lib = krebs;
-    inherit pkgs;
+    inherit lib pkgs;
   };
 
   # "7.4.335" -> "74"
   majmin = with lib; x : concatStrings (take 2 (splitString "." x));
 
-  shell-escape = krebs.shell.escape;
+  # TODO deprecate shell-escape for lass
+  shell-escape = lib.shell.escape;
 }

From 309102967ebad616d3f6a0dec361d80a61092ec8 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Wed, 21 Oct 2015 01:32:44 +0200
Subject: [PATCH 27/48] l: add test systems

---
 krebs/3modules/lass/default.nix | 31 ++++++++++++++++++++++++++--
 lass/1systems/test-arch.nix     | 36 +++++++++++++++++++++++++++++++++
 lass/1systems/test-centos6.nix  | 30 +++++++++++++++++++++++++++
 lass/1systems/test-centos7.nix  | 31 ++++++++++++++++++++++++++++
 4 files changed, 126 insertions(+), 2 deletions(-)
 create mode 100644 lass/1systems/test-arch.nix
 create mode 100644 lass/1systems/test-centos6.nix
 create mode 100644 lass/1systems/test-centos7.nix

diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index 5c48d9642..3f81acb9e 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -2,7 +2,34 @@
 
 with import ../../4lib { inherit lib; };
 
-{
+let
+  testHosts = lib.genAttrs [
+    "test-arch"
+    "test-centos6"
+    "test-centos7"
+  ] (name: {
+    inherit name;
+    nets = {
+      retiolum = {
+        addrs4 = ["10.243.111.111"];
+        addrs6 = ["42:0:0:0:0:0:0:7357"];
+        aliases = [
+          "test.retiolum"
+        ];
+        tinc.pubkey = ''
+          -----BEGIN RSA PUBLIC KEY-----
+          MIIBCgKCAQEAy41YKF/wpHLnN370MSdnAo63QUW30aw+6O79cnaJyxoL6ZQkk4Nd
+          mrX2tBIfb2hhhgm4Jecy33WVymoEL7EiRZ6gshJaYwte51Jnrac6IFQyiRGMqHY5
+          TG/6IzzTOkeQrT1fw3Yfh0NRfqLBZLr0nAFoqgzIVRxvy+QO1gCU2UDKkQ/y5df1
+          K+YsMipxU08dsOkPkmLdC/+vDaZiEdYljIS3Omd+ED5JmLM3MSs/ZPQ8xjkjEAy8
+          QqD9/67bDoeXyg1ZxED2n0+aRKtU/CK/66Li//yev6yv38OQSEM4t/V0dr9sjLcY
+          VIdkxKf96F9r3vcDf/9xw2HrqVoy+D5XYQIDAQAB
+          -----END RSA PUBLIC KEY-----
+        '';
+      };
+    };
+  });
+in {
   hosts = addNames {
     echelon = {
       cores = 4;
@@ -180,7 +207,7 @@ with import ../../4lib { inherit lib; };
       };
     };
 
-  };
+  } // testHosts;
   users = addNames {
     lass = {
       pubkey = readFile ../../Zpubkeys/lass.ssh.pub;
diff --git a/lass/1systems/test-arch.nix b/lass/1systems/test-arch.nix
new file mode 100644
index 000000000..0ab9da2f3
--- /dev/null
+++ b/lass/1systems/test-arch.nix
@@ -0,0 +1,36 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (import ../4lib { inherit pkgs lib; }) getDefaultGateway;
+  inherit (lib) head;
+
+in {
+  imports = [
+    ../2configs/base.nix
+    {
+      boot.loader.grub = {
+        device = "/dev/sda";
+        splashImage = null;
+      };
+
+      boot.initrd.availableKernelModules = [
+        "ata_piix"
+        "vmw_pvscsi"
+      ];
+
+      fileSystems."/" = {
+        device = "/dev/sda1";
+      };
+    }
+    {
+      networking.dhcpcd.allowInterfaces = [
+        "enp*"
+      ];
+    }
+    {
+      sound.enable = false;
+    }
+  ];
+
+  krebs.build.host = config.krebs.hosts.test-arch;
+}
diff --git a/lass/1systems/test-centos6.nix b/lass/1systems/test-centos6.nix
new file mode 100644
index 000000000..7270c2262
--- /dev/null
+++ b/lass/1systems/test-centos6.nix
@@ -0,0 +1,30 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (import ../4lib { inherit pkgs lib; }) getDefaultGateway;
+  inherit (lib) head;
+
+  ip = "168.235.148.52";
+in {
+  imports = [
+    ../2configs/base.nix
+    ../2configs/os-templates/CAC-CentOS-6.5-64bit.nix
+    {
+      networking.interfaces.enp11s0.ip4 = [
+        {
+          address = ip;
+          prefixLength = 24;
+        }
+      ];
+      networking.defaultGateway = getDefaultGateway ip;
+      networking.nameservers = [
+        "8.8.8.8"
+      ];
+    }
+    {
+      sound.enable = false;
+    }
+  ];
+
+  krebs.build.host = config.krebs.hosts.test-centos6;
+}
diff --git a/lass/1systems/test-centos7.nix b/lass/1systems/test-centos7.nix
new file mode 100644
index 000000000..91bd3e0fe
--- /dev/null
+++ b/lass/1systems/test-centos7.nix
@@ -0,0 +1,31 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (import ../4lib { inherit pkgs lib; }) getDefaultGateway;
+  inherit (lib) head;
+
+  ip = "168.235.145.85";
+in {
+  imports = [
+    ../2configs/base.nix
+    ../2configs/os-templates/CAC-CentOS-7-64bit.nix
+    {
+      networking.interfaces.enp2s1.ip4 = [
+        {
+          address = ip;
+          prefixLength = 24;
+        }
+      ];
+      networking.defaultGateway = getDefaultGateway ip;
+      networking.nameservers = [
+        "8.8.8.8"
+      ];
+
+    }
+    {
+      sound.enable = false;
+    }
+  ];
+
+  krebs.build.host = config.krebs.hosts.test-centos7;
+}

From 61c72512989a9c83645493002d0f8230691a58e1 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Wed, 21 Oct 2015 01:33:00 +0200
Subject: [PATCH 28/48] l 1 mors: add hangouts permissions

---
 lass/1systems/mors.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index 0e7ed7c62..b0b8ff573 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -199,4 +199,7 @@
     tapButtons = false;
     twoFingerScroll = true;
   };
+
+  #for google hangout
+  users.extraUsers.gm.extraGroups = [ "audio" "video" ];
 }

From 8144b59c5786459619b4a06ecc150b6a96af014b Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Wed, 21 Oct 2015 01:34:05 +0200
Subject: [PATCH 29/48] l 2 base: nixpkgs b9270a2 -> 33bdc01

---
 lass/2configs/base.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix
index 902fcb70b..52501441a 100644
--- a/lass/2configs/base.nix
+++ b/lass/2configs/base.nix
@@ -50,7 +50,7 @@ with lib;
       source = {
         git.nixpkgs = {
           url = https://github.com/Lassulus/nixpkgs;
-          rev = "b9270a2e8ac3d2cf4c95075a9529528aa1d859da";
+          rev = "33bdc011f5360288cd10b9fda90da2950442b2ab";
         };
         dir.secrets = {
           host = config.krebs.hosts.mors;

From 8f7253184ac53792d125c6713b0757da58389b1e Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Wed, 21 Oct 2015 01:34:27 +0200
Subject: [PATCH 30/48] l 2 base: add aria2 to base install

---
 lass/2configs/base.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix
index 52501441a..6fa9c5b2d 100644
--- a/lass/2configs/base.nix
+++ b/lass/2configs/base.nix
@@ -96,6 +96,9 @@ with lib;
 
   #network
     iptables
+
+  #stuff for dl
+    aria2
   ];
 
   programs.bash = {

From 3ce57c3de3f3dc95669d3a0564f6f7d0ff425321 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Wed, 21 Oct 2015 00:08:18 +0200
Subject: [PATCH 31/48] stockholm: provide krebs lib

---
 default.nix                          | 24 +++++++++++++++++++-----
 krebs/3modules/build.nix             |  2 +-
 krebs/3modules/default.nix           |  2 +-
 krebs/3modules/git.nix               |  2 +-
 krebs/3modules/github-hosts-sync.nix |  3 +--
 krebs/3modules/lass/default.nix      |  2 +-
 krebs/3modules/makefu/default.nix    |  2 +-
 krebs/3modules/tv/default.nix        |  2 +-
 krebs/4lib/default.nix               |  2 --
 krebs/5pkgs/default.nix              |  5 ++---
 krebs/default.nix                    |  7 +------
 tv/2configs/test.nix                 |  2 +-
 tv/3modules/consul.nix               |  2 +-
 tv/4lib/default.nix                  | 14 ++++----------
 14 files changed, 35 insertions(+), 36 deletions(-)

diff --git a/default.nix b/default.nix
index 11bae7d98..c70225174 100644
--- a/default.nix
+++ b/default.nix
@@ -47,8 +47,20 @@ let stockholm = {
     inherit (eval {}) pkgs;
   };
 
-  krebs = import ./krebs (current // { inherit stockholm; });
-  inherit (krebs) lib;
+  krebs = import ./krebs (current // { inherit lib stockholm; });
+
+  lib =
+    let
+      lib = import <nixpkgs/lib>;
+      klib = import ./krebs/4lib { inherit lib; };
+      #ulib = import (./. + "/${current-user-name}/4lib") { lib = lib // klib; };
+      ulib = {}; # TODO
+    in
+    builtins // lib // klib // ulib // rec {
+      # TODO move this stuff
+      stockholm-path = ./.;
+      nspath = ns: p: stockholm-path + "/${ns}/${p}";
+    };
 
   # Path resolvers for common and individual files.
   # Example: `upath "3modules"` produces the current user's 3modules directory
@@ -65,8 +77,8 @@ let stockholm = {
       let
         # Notice the ordering.  Krebs packages can only depend on Nixpkgs,
         # whereas user packages additionally can depend on krebs packages.
-        kpkgs = import (kpath "5pkgs") { inherit pkgs; };
-        upkgs = import (upath "5pkgs") { pkgs = pkgs // kpkgs; };
+        kpkgs = import (kpath "5pkgs") { inherit lib pkgs; };
+        upkgs = import (upath "5pkgs") { inherit lib; pkgs = pkgs // kpkgs; };
       in
       kpkgs // upkgs;
   };
@@ -76,8 +88,10 @@ let stockholm = {
   # packages and modules on top of NixOS.  Some of this stuff might become
   # useful to a broader audience, at which point it should probably be merged
   # and pull-requested for inclusion into NixOS/nixpkgs.
-  # TODO provide krebs lib, so modules don't have to import it awkwardly
   eval = config: import <nixpkgs/nixos/lib/eval-config.nix> {
+    specialArgs = {
+      inherit lib;
+    };
     modules = [
       base-module
       config
diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix
index 57495ea69..1205e192b 100644
--- a/krebs/3modules/build.nix
+++ b/krebs/3modules/build.nix
@@ -1,6 +1,6 @@
 { config, lib, ... }:
 
-with import ../4lib { inherit lib; };
+with lib;
 
 let
   target = config.krebs.build // { user.name = "root"; };
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 756245c0b..c695589ca 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -1,6 +1,6 @@
 { config, lib, ... }:
 
-with import ../4lib { inherit lib; };
+with lib;
 let
   cfg = config.krebs;
 
diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix
index 64b7820b2..234129497 100644
--- a/krebs/3modules/git.nix
+++ b/krebs/3modules/git.nix
@@ -6,7 +6,7 @@
 # TODO when authorized_keys changes, then restart ssh
 #       (or kill already connected users somehow)
 
-with import ../4lib { inherit lib; };
+with lib;
 let
   cfg = config.krebs.git;
 
diff --git a/krebs/3modules/github-hosts-sync.nix b/krebs/3modules/github-hosts-sync.nix
index 2a1df9e03..5503ee8d6 100644
--- a/krebs/3modules/github-hosts-sync.nix
+++ b/krebs/3modules/github-hosts-sync.nix
@@ -1,7 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with import ../4lib { inherit lib; };
+with lib;
 let
   cfg = config.krebs.github-hosts-sync;
 
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index 3f81acb9e..d86c00563 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -1,6 +1,6 @@
 { lib, ... }:
 
-with import ../../4lib { inherit lib; };
+with lib;
 
 let
   testHosts = lib.genAttrs [
diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index acc5d7dd2..42764e48c 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -1,6 +1,6 @@
 { lib, ... }:
 
-with import ../../4lib { inherit lib; };
+with lib;
 
 {
   hosts = addNames {
diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index 5d5fead8f..5a1ff1416 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -1,6 +1,6 @@
 { lib, ... }:
 
-with import ../../4lib { inherit lib; };
+with lib;
 
 {
   dns.providers = {
diff --git a/krebs/4lib/default.nix b/krebs/4lib/default.nix
index 0a6101314..396307c22 100644
--- a/krebs/4lib/default.nix
+++ b/krebs/4lib/default.nix
@@ -3,8 +3,6 @@
 with builtins;
 with lib;
 
-builtins //
-lib //
 rec {
 
   eq = x: y: x == y;
diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix
index 84fb8725b..0ec4b3ded 100644
--- a/krebs/5pkgs/default.nix
+++ b/krebs/5pkgs/default.nix
@@ -1,7 +1,6 @@
-{ pkgs, ... }:
-
-with import ../4lib { inherit (pkgs) lib; };
+{ lib, pkgs, ... }:
 
+with lib;
 let
   subdirs = mapAttrs (_: flip pkgs.callPackage {}) (subdirsOf ./.);
   pkgs' = pkgs // subdirs;
diff --git a/krebs/default.nix b/krebs/default.nix
index de805a89c..5518a4496 100644
--- a/krebs/default.nix
+++ b/krebs/default.nix
@@ -1,6 +1,7 @@
 { current-date
 , current-host-name
 , current-user-name
+, lib
 , stockholm
 }:
 
@@ -8,7 +9,6 @@ let out = {
     inherit deploy;
     inherit infest;
     inherit init;
-    inherit lib;
     inherit nixos-install;
   };
 
@@ -131,11 +131,6 @@ let out = {
       ''}
     '';
 
-  lib = import ./4lib { lib = import <nixpkgs/lib>; } // rec {
-    stockholm-path = ../.;
-    nspath = ns: p: stockholm-path + "/${ns}/${p}";
-  };
-
   doc = s:
     let b = "EOF${builtins.hashString "sha256" s}"; in
     ''
diff --git a/tv/2configs/test.nix b/tv/2configs/test.nix
index 409b4e9b4..f5f068d6f 100644
--- a/tv/2configs/test.nix
+++ b/tv/2configs/test.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with import ../4lib { inherit lib pkgs; };
+with lib;
 
 let
   out = {
diff --git a/tv/3modules/consul.nix b/tv/3modules/consul.nix
index e764ab7b2..ccdee07f5 100644
--- a/tv/3modules/consul.nix
+++ b/tv/3modules/consul.nix
@@ -5,7 +5,7 @@
 # TODO consul-bootstrap HOST  that actually does is
 # TODO tools to inspect state of a cluster in outage state
 
-with import ../4lib { inherit lib pkgs; };
+with lib;
 let
   cfg = config.tv.consul;
 
diff --git a/tv/4lib/default.nix b/tv/4lib/default.nix
index 106535ba2..7e6b2ab17 100644
--- a/tv/4lib/default.nix
+++ b/tv/4lib/default.nix
@@ -1,20 +1,14 @@
 { lib, pkgs, ... }:
 
-let
-  krebs = import ../../krebs/4lib { inherit lib; };
-in
-
-with krebs;
-
-krebs // rec {
+lib // rec {
 
   git = import ./git.nix {
-    lib = krebs;
-    inherit pkgs;
+    inherit lib pkgs;
   };
 
   # "7.4.335" -> "74"
   majmin = with lib; x : concatStrings (take 2 (splitString "." x));
 
-  shell-escape = krebs.shell.escape;
+  # TODO deprecate shell-escape for lass
+  shell-escape = lib.shell.escape;
 }

From 9c9a7d611ed9201e84ed49067027e85389313b7c Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Wed, 21 Oct 2015 02:21:56 +0200
Subject: [PATCH 32/48] krebs.nixos-install: bring back chroot wrapper

Because we _do_ need it. :D
---
 krebs/default.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/krebs/default.nix b/krebs/default.nix
index 5518a4496..5f1cfb95b 100644
--- a/krebs/default.nix
+++ b/krebs/default.nix
@@ -126,6 +126,16 @@ let out = {
         } > nixos-install
         chmod +x nixos-install
 
+        # Wrap inserted nix-install into chroot.
+        nix_env=$(cat_src | sed -n '
+          s:.*\(/nix/store/[a-z0-9]*-nix-[0-9.]\+/bin/nix-env\).*:\1:p;T;q
+        ')
+        echo nix-env is $nix_env
+        sed -i '
+          s:^NIX_PATH=:chroot $mountPoint /usr/bin/env &:
+          s:^nix-env:'"$nix_env"':
+        ' nixos-install
+
         unset SSL_CERT_FILE
         ./nixos-install
       ''}

From 5f0e54f3cc8775fa609c3e790b2a287e0f4e9d4d Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Wed, 21 Oct 2015 02:23:57 +0200
Subject: [PATCH 33/48] l 4: no longer import krebs

---
 lass/4lib/default.nix | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/lass/4lib/default.nix b/lass/4lib/default.nix
index 2e493177d..6a8a28972 100644
--- a/lass/4lib/default.nix
+++ b/lass/4lib/default.nix
@@ -1,12 +1,8 @@
 { lib, pkgs, ... }:
 
-let
-  krebs = import ../../krebs/4lib { inherit lib; };
-in
+with lib;
 
-with krebs;
-
-krebs // rec {
+{
 
   simpleScript = name: content:
     pkgs.stdenv.mkDerivation {

From 48abef60c172bdd5d15e574138824a89b23fa86d Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Wed, 21 Oct 2015 12:45:50 +0200
Subject: [PATCH 34/48] krebs.nixos-install: discover coreutils in /mnt

---
 krebs/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/krebs/default.nix b/krebs/default.nix
index 5f1cfb95b..24d9e843b 100644
--- a/krebs/default.nix
+++ b/krebs/default.nix
@@ -130,9 +130,12 @@ let out = {
         nix_env=$(cat_src | sed -n '
           s:.*\(/nix/store/[a-z0-9]*-nix-[0-9.]\+/bin/nix-env\).*:\1:p;T;q
         ')
+        coreutils=$(find /mnt/nix/store \
+            -mindepth 1 -maxdepth 1 -type d -name '*-coreutils-*' \
+          | head -n 1 | sed s:^/mnt::)
         echo nix-env is $nix_env
         sed -i '
-          s:^NIX_PATH=:chroot $mountPoint /usr/bin/env &:
+          s:^NIX_PATH=:chroot $mountPoint '"$coreutils"'/bin/env &:
           s:^nix-env:'"$nix_env"':
         ' nixos-install
 

From df04a82426ad36726da7becae5ec4b6c33d8d14b Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Wed, 21 Oct 2015 13:13:49 +0200
Subject: [PATCH 35/48] krebs.nixos-infest: set SSL_CERT_FILE properly

---
 krebs/default.nix | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/krebs/default.nix b/krebs/default.nix
index 24d9e843b..0b055cd24 100644
--- a/krebs/default.nix
+++ b/krebs/default.nix
@@ -130,16 +130,24 @@ let out = {
         nix_env=$(cat_src | sed -n '
           s:.*\(/nix/store/[a-z0-9]*-nix-[0-9.]\+/bin/nix-env\).*:\1:p;T;q
         ')
-        coreutils=$(find /mnt/nix/store \
-            -mindepth 1 -maxdepth 1 -type d -name '*-coreutils-*' \
-          | head -n 1 | sed s:^/mnt::)
-        echo nix-env is $nix_env
+        echo "nix-env is $nix_env" >&2
+        getchrootpath() {(
+          name=$1
+          path=$(find /mnt/nix/store \
+              -mindepth 1 -maxdepth 1 -type d -name '*-'"$name"'-*' \
+            | head -n 1 | sed s:^/mnt::)
+          echo "$name is $path" >&2
+          echo "$path"
+        )}
+        cacert=$(getchrootpath cacert)
+        coreutils=$(getchrootpath coreutils)
+        env="$coreutils/bin/env \
+            SSL_CERT_FILE=$cacert/etc/ssl/certs/ca-bundle.crt"
         sed -i '
-          s:^NIX_PATH=:chroot $mountPoint '"$coreutils"'/bin/env &:
+          s:^NIX_PATH=:chroot $mountPoint '"$env"' &:
           s:^nix-env:'"$nix_env"':
         ' nixos-install
 
-        unset SSL_CERT_FILE
         ./nixos-install
       ''}
     '';

From 0863983b7d7568266ed078dbce7ff96e08f2f082 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Wed, 21 Oct 2015 13:16:04 +0200
Subject: [PATCH 36/48] wu: add alias cgit.wu.retiolum

---
 krebs/3modules/tv/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index 5a1ff1416..f3dcd18b0 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -231,6 +231,7 @@ with lib;
           addrs6 = ["42:0:0:0:0:0:0:1337"];
           aliases = [
             "wu.retiolum"
+            "cgit.wu.retiolum"
           ];
           tinc.pubkey = ''
             -----BEGIN RSA PUBLIC KEY-----

From b55f07e57af69f918182405d473d22981c515b86 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Wed, 21 Oct 2015 13:48:53 +0200
Subject: [PATCH 37/48] mkdir: 104.233.84.215 -> 104.167.114.142

---
 krebs/3modules/tv/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index f3dcd18b0..4c295dffe 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -65,7 +65,7 @@ with lib;
       dc = "tv"; #dc = "cac";
       nets = rec {
         internet = {
-          addrs4 = ["104.233.84.215"];
+          addrs4 = ["104.167.114.142"];
           aliases = [
             "mkdir.internet"
           ];

From 14f08e2a1c6e8065c0fef15539df030eb2054ac1 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Wed, 21 Oct 2015 13:51:10 +0200
Subject: [PATCH 38/48] k 3 l: add cores to testsystems

---
 krebs/3modules/lass/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index d86c00563..498282b03 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -9,6 +9,7 @@ let
     "test-centos7"
   ] (name: {
     inherit name;
+    cores = 1;
     nets = {
       retiolum = {
         addrs4 = ["10.243.111.111"];

From 10be0e70063ba83fef47295ebcbb1ac11a22c6b5 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Wed, 21 Oct 2015 15:59:36 +0200
Subject: [PATCH 39/48] l 3: add dnsmasq.nix

---
 lass/3modules/dnsmasq.nix | 55 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 lass/3modules/dnsmasq.nix

diff --git a/lass/3modules/dnsmasq.nix b/lass/3modules/dnsmasq.nix
new file mode 100644
index 000000000..99c165479
--- /dev/null
+++ b/lass/3modules/dnsmasq.nix
@@ -0,0 +1,55 @@
+{ config, lib, pkgs, ... }:
+
+with builtins;
+with lib;
+
+let
+  cfg = config.lass.dnsmasq;
+
+  out = {
+    options.lass.dnsmasq = api;
+    config = mkIf cfg.enable imp;
+  };
+
+  api = {
+    enable = mkEnableOption "dnsmasq";
+    config = mkOption {
+      type = types.str;
+      #TODO: find a good default
+      default = ''
+      '';
+      description = "configuration dnsmasq is started with";
+    };
+  };
+
+  configFile = pkgs.writeText "dnsmasq.conf" cfg.config;
+
+  imp = {
+    #users.extraUsers.go = {
+    #  name = "go";
+    #  uid = 42774411; #genid go
+    #  description = "go url shortener user";
+    #  home = "/var/lib/go";
+    #  createHome = true;
+    #};
+
+    systemd.services.dnsmasq = {
+      description = "dnsmasq";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      path = with pkgs; [
+        dnsmasq
+      ];
+
+
+      restartIfChanged = true;
+
+      serviceConfig = {
+        Restart = "always";
+        ExecStart = "${pkgs.dnsmasq}/bin/dnsmasq -k -C ${configFile}";
+      };
+    };
+  };
+
+in out

From 27a4aa4a49b9befe278bb4dfa68a749822aea2c0 Mon Sep 17 00:00:00 2001
From: lassulus <lass@aidsballs.de>
Date: Wed, 21 Oct 2015 15:59:47 +0200
Subject: [PATCH 40/48] l 1 echelon: add dnsmasq config

---
 lass/1systems/echelon.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/lass/1systems/echelon.nix b/lass/1systems/echelon.nix
index 80cb51060..94c793b08 100644
--- a/lass/1systems/echelon.nix
+++ b/lass/1systems/echelon.nix
@@ -33,6 +33,20 @@ in {
     {
       sound.enable = false;
     }
+    {
+      imports = [
+        ../3modules/dnsmasq.nix
+      ];
+      lass.dnsmasq = {
+        enable = true;
+        config = ''
+          interface=retiolum
+        '';
+      };
+      krebs.iptables.tables.filter.INPUT.rules = [
+        { predicate = "-i retiolum -p udp --dport 53"; target = "ACCEPT"; }
+      ];
+    }
   ];
 
   krebs.build.host = config.krebs.hosts.echelon;

From 714a2e492270d984e8987532c247ae4caf69fce0 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Wed, 21 Oct 2015 22:29:35 +0200
Subject: [PATCH 41/48] stockholm: only inherit in out

---
 default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/default.nix b/default.nix
index c70225174..fc322cb80 100644
--- a/default.nix
+++ b/default.nix
@@ -44,7 +44,7 @@ let stockholm = {
     # Additionally, output lib and pkgs for easy access from the shell.
     # Notice how we're evaluating just the base module to obtain pkgs.
     inherit lib;
-    inherit (eval {}) pkgs;
+    inherit pkgs;
   };
 
   krebs = import ./krebs (current // { inherit lib stockholm; });
@@ -62,6 +62,8 @@ let stockholm = {
       nspath = ns: p: stockholm-path + "/${ns}/${p}";
     };
 
+  inherit (eval {}) pkgs;
+
   # Path resolvers for common and individual files.
   # Example: `upath "3modules"` produces the current user's 3modules directory
   kpath = lib.nspath "krebs";

From 5206c11026245b1fe20a66fb5b14165e51195f0b Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Wed, 21 Oct 2015 22:43:11 +0200
Subject: [PATCH 42/48] wu nixpkgs: f77bf46 -> 9048637

---
 tv/1systems/wu.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index c691066cb..c687ae52d 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -10,8 +10,11 @@ with lib;
 
   krebs.build.source = {
     git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "e916273209560b302ab231606babf5ce1c481f08";
+      #url = https://github.com/NixOS/nixpkgs;
+      #rev = "f77bf46c1e705934a00c52d90cc62a76fbb1f6b5";
+      # Revert "rxvt_unicode: add patch to fix Shift+PgUp/PgDown bug"
+      url = https://github.com/4z3/nixpkgs;
+      rev = "9048637";
     };
     dir.secrets = {
       host = config.krebs.hosts.wu;

From fc64fd18cb8677f08d038a086de879fd69f89b8c Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Thu, 22 Oct 2015 00:20:16 +0200
Subject: [PATCH 43/48] krebs.*: make StrictHostKeyChecking configurable

---
 default.nix       | 5 +++--
 krebs/default.nix | 6 +++++-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/default.nix b/default.nix
index fc322cb80..b261e51e7 100644
--- a/default.nix
+++ b/default.nix
@@ -17,7 +17,8 @@
 { current-date ? abort "current-date not defined"
 , current-host-name ? abort "current-host-name not defined"
 , current-user-name ? builtins.getEnv "LOGNAME"
-}@current:
+, StrictHostKeyChecking ? "yes"
+}@args:
 
 let stockholm = {
     # The generated scripts to deploy (or infest) systems can be found in the
@@ -47,7 +48,7 @@ let stockholm = {
     inherit pkgs;
   };
 
-  krebs = import ./krebs (current // { inherit lib stockholm; });
+  krebs = import ./krebs (args // { inherit lib stockholm; });
 
   lib =
     let
diff --git a/krebs/default.nix b/krebs/default.nix
index 0b055cd24..08de72294 100644
--- a/krebs/default.nix
+++ b/krebs/default.nix
@@ -3,6 +3,7 @@
 , current-user-name
 , lib
 , stockholm
+, StrictHostKeyChecking ? "yes"
 }:
 
 let out = {
@@ -260,7 +261,10 @@ let out = {
     in out;
 
   rootssh = target: script:
-    "ssh root@${target} -T ${doc ''
+    let
+      flags = "-o StrictHostKeyChecking=${StrictHostKeyChecking}";
+    in
+    "ssh ${flags} root@${target} -T ${doc ''
       set -efu
       ${script}
     ''}";

From 4b8ffc1bfd494de1fafde2527a337ad5eb31a27c Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Thu, 22 Oct 2015 00:23:02 +0200
Subject: [PATCH 44/48] krebs.nixos-install: fail if pkg cannot be found

Collaterally, search in /nix instead of /mnt/nix
---
 krebs/default.nix | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/krebs/default.nix b/krebs/default.nix
index 08de72294..40d245f98 100644
--- a/krebs/default.nix
+++ b/krebs/default.nix
@@ -132,16 +132,20 @@ let out = {
           s:.*\(/nix/store/[a-z0-9]*-nix-[0-9.]\+/bin/nix-env\).*:\1:p;T;q
         ')
         echo "nix-env is $nix_env" >&2
-        getchrootpath() {(
+        findpkg() {(
           name=$1
-          path=$(find /mnt/nix/store \
+          path=$(find /nix/store \
               -mindepth 1 -maxdepth 1 -type d -name '*-'"$name"'-*' \
             | head -n 1 | sed s:^/mnt::)
-          echo "$name is $path" >&2
-          echo "$path"
+          if echo "$path" | grep .; then
+            echo "$name is $path" >&2
+          else
+            echo "Error: package not found: $name" >&2
+            exit 1
+          fi
         )}
-        cacert=$(getchrootpath cacert)
-        coreutils=$(getchrootpath coreutils)
+        cacert=$(findpkg cacert)
+        coreutils=$(findpkg coreutils)
         env="$coreutils/bin/env \
             SSL_CERT_FILE=$cacert/etc/ssl/certs/ca-bundle.crt"
         sed -i '

From df6f0392cbdf7923537eb5d328bd345cde11eb53 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Thu, 22 Oct 2015 00:49:51 +0200
Subject: [PATCH 45/48] krebs.nixos-install: cacert -> /root/SSL_CERT_FILE

---
 krebs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/krebs/default.nix b/krebs/default.nix
index 40d245f98..31a7f7d04 100644
--- a/krebs/default.nix
+++ b/krebs/default.nix
@@ -146,8 +146,8 @@ let out = {
         )}
         cacert=$(findpkg cacert)
         coreutils=$(findpkg coreutils)
-        env="$coreutils/bin/env \
-            SSL_CERT_FILE=$cacert/etc/ssl/certs/ca-bundle.crt"
+        cp "$cacert"/etc/ssl/certs/ca-bundle.crt /mnt/root/SSL_CERT_FILE
+        env="$coreutils/bin/env SSL_CERT_FILE=/root/SSL_CERT_FILE"
         sed -i '
           s:^NIX_PATH=:chroot $mountPoint '"$env"' &:
           s:^nix-env:'"$nix_env"':

From e557bc2e58c3e276656853c42cb00db979570135 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Thu, 22 Oct 2015 01:25:44 +0200
Subject: [PATCH 46/48] nomic: bump file systems

---
 tv/1systems/nomic.nix | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 718f6ae24..210846215 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -64,27 +64,24 @@ with lib;
   ];
 
   boot.initrd.luks = {
-    cryptoModules = [ "aes" "sha1" "xts" ];
+    cryptoModules = [ "aes" "sha512" "xts" ];
     devices = [
-      {
-        name = "luks1";
-        device = "/dev/disk/by-uuid/cac73902-1023-4906-8e95-3a8b245337d4";
-      }
+      { name = "luks1"; device = "/dev/sda2"; }
     ];
   };
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/de4780fc-0473-4708-81df-299b7383274c";
+    { device = "/dev/mapper/nomic1-root";
       fsType = "btrfs";
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/be3a1d80-3157-4d7c-86cc-ef01b64eff5e";
+    { device = "/dev/sda1";
       fsType = "ext4";
     };
 
   fileSystems."/home" =
-    { device = "/dev/disk/by-uuid/9db9c8ff-51da-4cbd-9f0a-0cd3333bbaff";
+    { device = "/dev/mapper/nomic1-home";
       fsType = "btrfs";
     };
 

From c2e1ab2bd09c204e1fa1c4ecd637c2e5b8a4b9ab Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Thu, 22 Oct 2015 01:25:02 +0200
Subject: [PATCH 47/48] tv base systemPackages += git

---
 tv/1systems/cd.nix    | 1 -
 tv/1systems/mkdir.nix | 1 -
 tv/1systems/rmdir.nix | 1 -
 tv/1systems/wu.nix    | 1 -
 tv/2configs/base.nix  | 6 ++++++
 5 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 12e52cd11..d2b08bef7 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -114,7 +114,6 @@ with lib;
   ];
 
   environment.systemPackages = with pkgs; [
-    git # required for ./deploy, clone_or_update
     htop
     iftop
     iotop
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index 669dcc2f3..f0c7dc2a0 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -88,7 +88,6 @@ in
   ];
 
   environment.systemPackages = with pkgs; [
-    git # required for ./deploy, clone_or_update
     htop
     iftop
     iotop
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index 79e47c539..c52222cd1 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -84,7 +84,6 @@ in
   ];
 
   environment.systemPackages = with pkgs; [
-    git # required for ./deploy, clone_or_update
     htop
     iftop
     iotop
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index c687ae52d..404fdb3d1 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -40,7 +40,6 @@ with lib;
 
         # stockholm
         genid
-        git
         gnumake
         hashPassword
         lentil
diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix
index 010d4b326..4de980cf1 100644
--- a/tv/2configs/base.nix
+++ b/tv/2configs/base.nix
@@ -14,6 +14,12 @@ in
   networking.hostName = config.krebs.build.host.name;
 
   imports = [
+    {
+      # stockholm dependencies
+      environment.systemPackages = with pkgs; [
+        git
+      ];
+    }
     {
       # TODO never put hashedPassword into the store
       users.extraUsers =

From 9ba8fc142cb14aa3768cb99bf9170f7875beafd1 Mon Sep 17 00:00:00 2001
From: tv <tv@shackspace.de>
Date: Thu, 22 Oct 2015 12:48:17 +0200
Subject: [PATCH 48/48] wu nixpkgs: 9048637 -> e916273

Current unstable is really unstable w/system hangs.
---
 tv/1systems/wu.nix | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 404fdb3d1..89ad257f0 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -10,11 +10,8 @@ with lib;
 
   krebs.build.source = {
     git.nixpkgs = {
-      #url = https://github.com/NixOS/nixpkgs;
-      #rev = "f77bf46c1e705934a00c52d90cc62a76fbb1f6b5";
-      # Revert "rxvt_unicode: add patch to fix Shift+PgUp/PgDown bug"
-      url = https://github.com/4z3/nixpkgs;
-      rev = "9048637";
+      url = https://github.com/NixOS/nixpkgs;
+      rev = "e916273209560b302ab231606babf5ce1c481f08";
     };
     dir.secrets = {
       host = config.krebs.hosts.wu;