Merge branch 'tv' into master

0make/tv/cd.makefile

@@ -1,4 +0,0 @@
-deploy_host := root@cd-global
-nixpkgs_url := https://github.com/NixOS/nixpkgs
-nixpkgs_rev := 4c01e6d91993b6de128795f4fbdd25f6227fb870
-secrets_dir := /home/tv/secrets/cd

0make/tv/mkdir.makefile

@@ -1,4 +0,0 @@
-deploy_host := root@mkdir
-nixpkgs_url := https://github.com/NixOS/nixpkgs
-nixpkgs_rev := 4c01e6d91993b6de128795f4fbdd25f6227fb870
-secrets_dir := /home/tv/secrets/mkdir

0make/tv/nomic.makefile

@@ -1,4 +0,0 @@
-deploy_host := root@nomic.gg23
-nixpkgs_url := https://github.com/NixOS/nixpkgs
-nixpkgs_rev := 9d5508d85c33b8fb22d79dde6176792eac2c2696
-secrets_dir := /home/tv/secrets/nomic

0make/tv/rmdir.makefile

@@ -1,4 +0,0 @@
-deploy_host := root@rmdir
-nixpkgs_url := https://github.com/NixOS/nixpkgs
-nixpkgs_rev := 4c01e6d91993b6de128795f4fbdd25f6227fb870
-secrets_dir := /home/tv/secrets/rmdir

0make/tv/wu.makefile

@@ -1,4 +0,0 @@
-deploy_host := root@wu
-nixpkgs_url := /home/tv/src/nixpkgs
-nixpkgs_rev := 7725eb1d3ed85fc34edde3c3a7907ab234933a68
-secrets_dir := /home/tv/secrets/wu

1systems/makefu/pnp.nix

@@ -11,7 +11,8 @@
       ../../2configs/makefu/base.nix
       ../../2configs/makefu/cgit-retiolum.nix
     ];
-  krebs.enable = true;
+  krebs.build.host = config.krebs.hosts.pnp;
+
   boot.loader.grub.enable = true;
   boot.loader.grub.version = 2;
   boot.loader.grub.device = "/dev/vda";
@@ -39,14 +40,8 @@
     ];
   };
 
-  nix.maxJobs = 2;
-  networking.hostName = "pnp"; # Define your hostname.
-
 # $ nix-env -qaP | grep wget
     environment.systemPackages = with pkgs; [
-      wget
-      git
-      gnumake
       jq
     ];
 }

2configs/makefu/base.nix

@@ -3,6 +3,10 @@
 with lib;
 {
   imports = [ ];
+  krebs.enable = true;
+  krebs.search-domain = "retiolum";
+
+  networking.hostName = config.krebs.build.host.name;
   users.extraUsers = {
     root = {
         openssh.authorizedKeys.keys = [ config.krebs.users.makefu.pubkey ];
@@ -37,6 +41,7 @@ with lib;
   environment.systemPackages = with pkgs; [
       git
       vim
+      gnumake
       rxvt_unicode.terminfo
   ];
 

3modules/krebs/default.nix

@@ -20,7 +20,7 @@ let
     enable = mkEnableOption "krebs";
 
     build = mkOption {
-      type = types.submodule {
+      type = types.submodule ({ config, ... }: {
         options = {
           target = mkOption {
             type = with types; nullOr str;
@@ -129,11 +129,19 @@ let
             type = types.user;
           };
         };
-      };
+      });
       # Define defaul value, so unset values of the submodule get reported.
       default = {};
     };
 
+    dns = {
+      providers = mkOption {
+        # TODO with types; tree dns.label dns.provider, so we can merge.
+        # Currently providers can only be merged if aliases occur just once.
+        type = with types; attrsOf unspecified;
+      };
+    };
+
     hosts = mkOption {
       type = with types; attrsOf host;
     };
@@ -156,16 +164,10 @@ let
     { krebs = makefu-imp; }
     { krebs = tv-imp; }
     {
-      # XXX This overlaps with krebs.retiolum
-      networking.extraHosts =
-        let
-          # TODO move domain name providers to a dedicated module
-          # providers : tree label providername
-          providers = {
+      krebs.dns.providers = {
+        de.krebsco = "ovh";
         internet = "hosts";
         retiolum = "hosts";
-            de.viljetic = "regfish";
-            de.krebsco = "ovh";
         de.habsys = "hosts";
         de.pixelpocket = "hosts";
         de.karlaskop = "hosts";
@@ -173,25 +175,19 @@ let
         de.apanowicz = "hosts";
       };
 
-          # splitByProvider : [alias] -> listset providername alias
-          splitByProvider = foldl (acc: alias: listset-insert (providerOf alias) alias acc) {};
-
-          # providerOf : alias -> providername
-          providerOf = alias:
-            tree-get (splitString "." alias) providers;
-        in
-        concatStringsSep "\n" (flatten (
-          # TODO deepMap ["hosts" "nets"] (hostname: host: netname: net:
+      # XXX This overlaps with krebs.retiolum
+      networking.extraHosts = concatStringsSep "\n" (flatten (
         mapAttrsToList (hostname: host:
           mapAttrsToList (netname: net:
             let
               aliases = toString (unique (longs ++ shorts));
-                longs = (splitByProvider net.aliases).hosts;
+              providers = dns.split-by-provider net.aliases cfg.dns.providers;
+              longs = providers.hosts;
               shorts = map (removeSuffix ".${cfg.search-domain}") longs;
             in
             map (addr: "${addr} ${aliases}") net.addrs
           ) host.nets
-          ) config.krebs.hosts
+        ) cfg.hosts
       ));
     }
   ];
@@ -330,6 +326,9 @@ let
   };
 
   tv-imp = {
+    dns.providers = {
+      de.viljetic = "regfish";
+    };
     hosts = addNames {
       cd = {
         cores = 2;

3modules/krebs/urlwatch.nix

@@ -35,20 +35,22 @@ let
     };
     mailto = mkOption {
       type = types.str;
+      default = config.krebs.build.user.mail;
       description = ''
         Content of the To: header of the generated mails. [AKA recipient :)]
       '';
     };
     onCalendar = mkOption {
       type = types.str;
+      default = "04:23";
       description = ''
         Run urlwatch at this interval.
         The format is described in systemd.time(7), CALENDAR EVENTS.
       '';
-      example = "04:23";
     };
     urls = mkOption {
       type = with types; listOf str;
+      default = [];
       description = "URL to watch.";
       example = [
         https://nixos.org/channels/nixos-unstable/git-revision

4lib/krebs/default.nix

@@ -12,22 +12,7 @@ builtins // lib // rec {
 
   types = import ./types.nix { inherit lib; };
 
-
-  # listset k v = set k [v]
-
-  # listset-insert : k -> v -> listset k v -> listset k v
-  listset-insert = name: value: set:
-    set // { ${name} = set.${name} or [] ++ [value]; };
-
-  # tree k v = set k (either v (tree k v))
-
-  # tree-get : [k] -> tree k v -> v
-  tree-get = path: x:
-    let
-      y = x.${last path};
-    in
-    if typeOf y != "set"
-      then y
-      else tree-get (init path) y;
-
+  dns = import ./dns.nix { inherit lib; };
+  listset = import ./listset.nix { inherit lib; };
+  tree = import ./tree.nix { inherit lib; };
 }

4lib/krebs/dns.nix

@@ -0,0 +1,31 @@
+{ lib, ... }:
+
+let
+  listset = import ./listset.nix { inherit lib; };
+in
+
+with builtins;
+with lib;
+
+rec {
+  # label = string
+
+  # TODO does it make sense to have alias = list label?
+
+  # split-by-provider :
+  #   [[label]] -> tree label provider -> listset provider alias
+  split-by-provider = as: providers:
+    foldl (m: a: listset.insert (provider-of a providers) a m) {} as;
+
+  # provider-of : alias -> tree label provider -> provider
+  # Note that we cannot use tree.get here, because path can be longer
+  # than the tree depth.
+  provider-of = a:
+    let
+      go = path: tree:
+        if typeOf tree == "string"
+          then tree
+          else go (tail path) tree.${head path};
+    in
+    go (reverseList (splitString "." a));
+}

4lib/krebs/listset.nix

@@ -0,0 +1,11 @@
+{ lib, ... }:
+
+with lib;
+
+rec {
+  # listset k v = set k [v]
+
+  # insert : k -> v -> listset k v -> listset k v
+  insert = name: value: set:
+    set // { ${name} = set.${name} or [] ++ [value]; };
+}

4lib/krebs/tree.nix

@@ -0,0 +1,13 @@
+{ lib, ... }:
+
+with lib;
+
+rec {
+  # tree k v = set k (either v (tree k v))
+
+  # get : [k] -> tree k v -> v
+  get = path: tree:
+    if length path > 0
+      then get (tail path) tree.${head path} # TODO check if elem exists
+      else tree;
+}

4lib/krebs/types.nix

@@ -55,7 +55,7 @@ types // rec {
         type = listOf hostname;
       };
       tinc = mkOption {
-        type = let net-config = config; in submodule ({ config, ... }: {
+        type = let net-config = config; in nullOr (submodule ({ config, ... }: {
           options = {
             config = mkOption {
               type = str;
@@ -70,7 +70,8 @@ types // rec {
               type = str;
             };
           };
-        });
+        }));
+        default = null;
       };
     };
   });

4lib/tv/default.nix

@@ -1,52 +0,0 @@
-{ lib, pkgs, ... }:
-
-let
-  krebs = import ../../4lib/krebs { inherit lib; };
-in
-
-with krebs;
-
-krebs // rec {
-
-  git = import ./git.nix {
-    lib = lib // {
-      inherit addNames;
-    };
-    inherit pkgs;
-  };
-
-  # "7.4.335" -> "74"
-  majmin = with lib; x : concatStrings (take 2 (splitString "." x));
-
-  concat = xs :
-    if xs == []
-      then ""
-      else head xs + concat (tail xs)
-    ;
-
-  flip = f : x : y : f y x;
-
-  # isSuffixOf :: String -> String -> Bool
-  isSuffixOf =
-    s : xs :
-      let
-        sn = stringLength s;
-        xsn = stringLength xs;
-      in
-        xsn >= sn && substring (xsn - sn) sn xs == s ;
-
-  # setMap :: (String -> a -> b) -> Set String a -> [b]
-  #setMap = f: xs: map (k : f k (getAttr k xs)) (attrNames xs);
-
-  # setToList :: Set k a -> [a]
-  #setToList = setMap (_: v: v);
-
-  shell-escape =
-    let
-      isSafeChar = c: match "[-./0-9_a-zA-Z]" c != null;
-    in
-    stringAsChars (c:
-      if isSafeChar c then c
-      else if c == "\n" then "'\n'"
-      else "\\${c}");
-}

tv/configs/AO753.nix

@@ -2,7 +2,7 @@
 
 {
   imports = [
-    ../../2configs/tv/smartd.nix
+    ../configs/smartd.nix
   ];
 
   boot.loader.grub = {

tv/configs/charybdis.nix

@@ -1,5 +1,9 @@
 { config, lib, pkgs, ... }:
 
+let
+  tvpkgs = import ../pkgs { inherit pkgs; };
+in
+
 with builtins;
 with lib;
 let
@@ -59,7 +63,7 @@ let
         ExecStart = pkgs.writeScript "charybdis-service" ''
           #! /bin/sh
           set -euf
-          exec ${Zpkgs.charybdis}/bin/charybdis-ircd \
+          exec ${tvpkgs.charybdis}/bin/charybdis-ircd \
             -foreground \
             -logfile /dev/stderr \
             -configfile ${configFile}
@@ -597,7 +601,5 @@ let
       ip = "10.243.0.0/16";
     };
   '';
-  
-  Zpkgs = import ../../Zpkgs/tv { inherit pkgs; };
 in
 out

tv/configs/git.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with import ../../4lib/tv { inherit lib pkgs; };
+with import ../lib { inherit lib pkgs; };
 let
 
   out = {

tv/configs/mail-client.nix

@@ -1,6 +1,6 @@
 { pkgs, ... }:
 
-with import ../../Zpkgs/tv { inherit pkgs; };
+with import ../pkgs { inherit pkgs; };
 
 {
   environment.systemPackages = [

tv/configs/w110er.nix

@@ -2,7 +2,7 @@
 
 {
   imports = [
-    ../../2configs/tv/smartd.nix
+    ../configs/smartd.nix
   ];
 
   boot.extraModprobeConfig = ''

tv/configs/xserver.nix

@@ -2,7 +2,7 @@
 
 {
   imports = [
-    ../../2configs/tv/urxvt.nix # TODO via xserver
+    ../configs/urxvt.nix # TODO via xserver
   ];
 
   services.xserver.enable = true;

tv/lib/default.nix

@@ -0,0 +1,27 @@
+{ lib, pkgs, ... }:
+
+let
+  krebs = import ../../4lib/krebs { inherit lib; };
+in
+
+with krebs;
+
+krebs // rec {
+
+  git = import ./git.nix {
+    lib = krebs;
+    inherit pkgs;
+  };
+
+  # "7.4.335" -> "74"
+  majmin = with lib; x : concatStrings (take 2 (splitString "." x));
+
+  shell-escape =
+    let
+      isSafeChar = c: match "[-./0-9_a-zA-Z]" c != null;
+    in
+    stringAsChars (c:
+      if isSafeChar c then c
+      else if c == "\n" then "'\n'"
+      else "\\${c}");
+}

tv/modules/consul.nix

@@ -5,7 +5,7 @@
 # TODO consul-bootstrap HOST  that actually does is
 # TODO tools to inspect state of a cluster in outage state
 
-with import ../../4lib/tv { inherit lib pkgs; };
+with import ../lib { inherit lib pkgs; };
 let
   cfg = config.tv.consul;
 

tv/systems/cd.nix

@@ -3,21 +3,37 @@
 with lib;
 
 let
-  Zpkgs = import ../../Zpkgs/tv { inherit pkgs; };
+  tvpkgs = import ../pkgs { inherit pkgs; };
 in
 
 {
   krebs.build.host = config.krebs.hosts.cd;
+  krebs.build.user = config.krebs.users.tv;
+
+  krebs.build.target = "root@cd.internet";
+
+  krebs.build.deps = {
+    nixpkgs = {
+      url = https://github.com/NixOS/nixpkgs;
+      rev = "4c01e6d91993b6de128795f4fbdd25f6227fb870";
+    };
+    secrets = {
+      url = "/home/tv/secrets/${config.krebs.build.host.name}";
+    };
+    stockholm = {
+      url = toString ../..;
+    };
+  };
 
   imports = [
-    ../../2configs/tv/CAC-Developer-2.nix
-    ../../2configs/tv/CAC-CentOS-7-64bit.nix
-    ../../2configs/tv/base.nix
-    ../../2configs/tv/consul-server.nix
-    ../../2configs/tv/exim-smarthost.nix
-    ../../2configs/tv/git.nix
+    ../configs/CAC-Developer-2.nix
+    ../configs/CAC-CentOS-7-64bit.nix
+    ../configs/base.nix
+    ../configs/consul-server.nix
+    ../configs/exim-smarthost.nix
+    ../configs/git.nix
     {
-      imports = [ ../../2configs/tv/charybdis.nix ];
+      imports = [ ../configs/charybdis.nix ];
       tv.charybdis = {
         enable = true;
         sslCert = ../../Zcerts/charybdis_cd.crt.pem;
@@ -68,7 +84,7 @@ in
         server-names = singleton "viljetic.de";
         # TODO directly set root (instead via location)
         locations = singleton (nameValuePair "/" ''
-          root ${Zpkgs.viljetic-pages};
+          root ${tvpkgs.viljetic-pages};
         '');
       };
     }

tv/systems/mkdir.nix

@@ -4,14 +4,30 @@ with lib;
 
 {
   krebs.build.host = config.krebs.hosts.mkdir;
+  krebs.build.user = config.krebs.users.tv;
+
+  krebs.build.target = "root@mkdir.internet";
+
+  krebs.build.deps = {
+    nixpkgs = {
+      url = https://github.com/NixOS/nixpkgs;
+      rev = "9d5508d85c33b8fb22d79dde6176792eac2c2696";
+    };
+    secrets = {
+      url = "/home/tv/secrets/${config.krebs.build.host.name}";
+    };
+    stockholm = {
+      url = toString ../..;
+    };
+  };
 
   imports = [
-    ../../2configs/tv/CAC-Developer-1.nix
-    ../../2configs/tv/CAC-CentOS-7-64bit.nix
-    ../../2configs/tv/base.nix
-    ../../2configs/tv/consul-server.nix
-    ../../2configs/tv/exim-smarthost.nix
-    ../../2configs/tv/git.nix
+    ../configs/CAC-Developer-1.nix
+    ../configs/CAC-CentOS-7-64bit.nix
+    ../configs/base.nix
+    ../configs/consul-server.nix
+    ../configs/exim-smarthost.nix
+    ../configs/git.nix
     {
       tv.iptables = {
         enable = true;

tv/systems/nomic.nix

@@ -4,13 +4,29 @@ with lib;
 
 {
   krebs.build.host = config.krebs.hosts.nomic;
+  krebs.build.user = config.krebs.users.tv;
+
+  krebs.build.target = "root@nomic.gg23";
+
+  krebs.build.deps = {
+    nixpkgs = {
+      url = https://github.com/NixOS/nixpkgs;
+      rev = "9d5508d85c33b8fb22d79dde6176792eac2c2696";
+    };
+    secrets = {
+      url = "/home/tv/secrets/${config.krebs.build.host.name}";
+    };
+    stockholm = {
+      url = toString ../..;
+    };
+  };
 
   imports = [
-    ../../2configs/tv/AO753.nix
-    ../../2configs/tv/base.nix
-    ../../2configs/tv/consul-server.nix
-    ../../2configs/tv/exim-retiolum.nix
-    ../../2configs/tv/git.nix
+    ../configs/AO753.nix
+    ../configs/base.nix
+    ../configs/consul-server.nix
+    ../configs/exim-retiolum.nix
+    ../configs/git.nix
     {
       tv.iptables = {
         enable = true;

tv/systems/rmdir.nix

@@ -4,14 +4,30 @@ with lib;
 
 {
   krebs.build.host = config.krebs.hosts.rmdir;
+  krebs.build.user = config.krebs.users.tv;
+
+  krebs.build.target = "root@rmdir.internet";
+
+  krebs.build.deps = {
+    nixpkgs = {
+      url = https://github.com/NixOS/nixpkgs;
+      rev = "4c01e6d91993b6de128795f4fbdd25f6227fb870";
+    };
+    secrets = {
+      url = "/home/tv/secrets/${config.krebs.build.host.name}";
+    };
+    stockholm = {
+      url = toString ../..;
+    };
+  };
 
   imports = [
-    ../../2configs/tv/CAC-Developer-1.nix
-    ../../2configs/tv/CAC-CentOS-7-64bit.nix
-    ../../2configs/tv/base.nix
-    ../../2configs/tv/consul-server.nix
-    ../../2configs/tv/exim-smarthost.nix
-    ../../2configs/tv/git.nix
+    ../configs/CAC-Developer-1.nix
+    ../configs/CAC-CentOS-7-64bit.nix
+    ../configs/base.nix
+    ../configs/consul-server.nix
+    ../configs/exim-smarthost.nix
+    ../configs/git.nix
     {
       tv.iptables = {
         enable = true;

tv/systems/wu.nix

@@ -3,22 +3,38 @@
 with lib;
 
 let
-  Zpkgs = import ../../Zpkgs/tv { inherit pkgs; };
+  tvpkgs = import ../pkgs { inherit pkgs; };
 in
 
 {
   krebs.build.host = config.krebs.hosts.wu;
+  krebs.build.user = config.krebs.users.tv;
+
+  krebs.build.target = "root@wu";
+
+  krebs.build.deps = {
+    nixpkgs = {
+      url = https://github.com/NixOS/nixpkgs;
+      rev = "9d5508d85c33b8fb22d79dde6176792eac2c2696";
+    };
+    secrets = {
+      url = "/home/tv/secrets/${config.krebs.build.host.name}";
+    };
+    stockholm = {
+      url = toString ../..;
+    };
+  };
 
   imports = [
-    ../../2configs/tv/w110er.nix
-    ../../2configs/tv/base.nix
-    ../../2configs/tv/consul-client.nix
-    ../../2configs/tv/exim-retiolum.nix
-    ../../2configs/tv/git.nix
-    ../../2configs/tv/mail-client.nix
-    ../../2configs/tv/xserver.nix
-    ../../2configs/tv/synaptics.nix # TODO w110er if xserver is enabled
-    ../../2configs/tv/urlwatch.nix
+    ../configs/w110er.nix
+    ../configs/base.nix
+    ../configs/consul-client.nix
+    ../configs/exim-retiolum.nix
+    ../configs/git.nix
+    ../configs/mail-client.nix
+    ../configs/xserver.nix
+    ../configs/synaptics.nix # TODO w110er if xserver is enabled
+    ../configs/urlwatch.nix
     {
       environment.systemPackages = with pkgs; [
 
@@ -26,9 +42,28 @@ in
         git
         gnumake
         parallel
-        Zpkgs.genid
-        Zpkgs.hashPassword
-        Zpkgs.lentil
+        tvpkgs.genid
+        tvpkgs.hashPassword
+        tvpkgs.lentil
+        (pkgs.writeScriptBin "ff" ''
+          #! ${pkgs.bash}/bin/bash
+          exec sudo -u ff -i <<EOF
+          exec ${pkgs.firefoxWrapper}/bin/firefox $(printf " %q" "$@")
+          EOF
+        '')
+        (pkgs.writeScriptBin "im" ''
+          #! ${pkgs.bash}/bin/bash
+          export PATH=${makeSearchPath "bin" (with pkgs; [
+            tmux
+            gnugrep
+            weechat
+          ])}
+          if tmux list-sessions -F\#S | grep -q '^im''$'; then
+            exec tmux attach -t im
+          else
+            exec tmux new -s im weechat
+          fi
+        '')
 
         # root
         cryptsetup
@@ -56,9 +91,8 @@ in
         sxiv
         texLive
         tmux
-        weechat
+        tvpkgs.dic
         zathura
-        Zpkgs.dic
 
         #ack
         #apache-httpd
@@ -151,19 +185,21 @@ in
     }
     {
       users.extraGroups = {
-        tv-sub.gid = 1337;
+        tv.gid = 1337;
+        slaves.gid = 3799582008; # genid slaves
       };
 
       users.extraUsers =
-        mapAttrs (name: user: user // {
+        mapAttrs (name: user@{ extraGroups ? [], ... }: user // {
           inherit name;
           home = "/home/${name}";
           createHome = true;
           useDefaultShell = true;
+          group = "tv";
+          extraGroups = ["slaves"] ++ extraGroups;
         }) {
           ff = {
             uid = 13378001;
-            group = "tv-sub";
             extraGroups = [
               "audio"
               "video"
@@ -172,17 +208,6 @@ in
 
           cr = {
             uid = 13378002;
-            group = "tv-sub";
-            extraGroups = [
-              "audio"
-              "video"
-              "bumblebee"
-            ];
-          };
-
-          vimb = {
-            uid = 13378003;
-            group = "tv-sub";
             extraGroups = [
               "audio"
               "video"
@@ -192,47 +217,38 @@ in
 
           fa = {
             uid = 2300001;
-            group = "tv-sub";
           };
 
           rl = {
             uid = 2300002;
-            group = "tv-sub";
           };
 
           tief = {
             uid = 2300702;
-            group = "tv-sub";
           };
 
           btc-bitcoind = {
             uid = 2301001;
-            group = "tv-sub";
           };
 
           btc-electrum = {
             uid = 2301002;
-            group = "tv-sub";
           };
 
           ltc-litecoind = {
             uid = 2301101;
-            group = "tv-sub";
           };
 
           eth = {
             uid = 2302001;
-            group = "tv-sub";
           };
 
           emse-hsdb = {
             uid = 4200101;
-            group = "tv-sub";
           };
 
           wine = {
             uid = 13370400;
-            group = "tv-sub";
             extraGroups = [
               "audio"
               "video"
@@ -240,10 +256,8 @@ in
             ];
           };
 
-          # dwarffortress
           df = {
             uid = 13370401;
-            group = "tv-sub";
             extraGroups = [
               "audio"
               "video"
@@ -251,25 +265,8 @@ in
             ];
           };
 
-          # XXX visudo: Warning: Runas_Alias `FTL' referenced but not defined
-          FTL = {
-            uid = 13370402;
-            #group = "tv-sub";
-            extraGroups = [
-              "audio"
-              "video"
-              "bumblebee"
-            ];
-          };
-
-          freeciv = {
-            uid = 13370403;
-            group = "tv-sub";
-          };
-
           xr = {
             uid = 13370061;
-            group = "tv-sub";
             extraGroups = [
               "audio"
               "video"
@@ -278,26 +275,14 @@ in
 
           "23" = {
             uid = 13370023;
-            group = "tv-sub";
           };
 
           electrum = {
             uid = 13370102;
-            group = "tv-sub";
-          };
-
-          Reaktor = {
-            uid = 4230010;
-            group = "tv-sub";
-          };
-
-          gitolite = {
-            uid = 7700;
           };
 
           skype = {
             uid = 6660001;
-            group = "tv-sub";
             extraGroups = [
               "audio"
             ];
@@ -305,12 +290,10 @@ in
 
           onion = {
             uid = 6660010;
-            group = "tv-sub";
           };
 
           zalora = {
             uid = 1000301;
-            group = "tv-sub";
             extraGroups = [
               "audio"
               # TODO remove vboxusers when hardening is active
@@ -322,17 +305,12 @@ in
 
       security.sudo.extraConfig =
         let
-          inherit (import ../../4lib/tv { inherit lib pkgs; })
-            isSuffixOf;
-
-          hasMaster = { group ? "", ... }:
-            isSuffixOf "-sub" group;
-
-          masterOf = user : removeSuffix "-sub" user.group;
+          isSlave = u: elem "slaves" u.extraGroups;
+          masterOf = u: u.group;
+          slaves = filterAttrs (_: isSlave) config.users.extraUsers;
+          toSudoers = u: "${masterOf u} ALL=(${u.name}) NOPASSWD: ALL";
         in
-        concatStringsSep "\n"
-          (map (u: "${masterOf u} ALL=(${u.name}) NOPASSWD: ALL")
-               (filter hasMaster (attrValues config.users.extraUsers)));
+        concatMapStringsSep "\n" toSudoers (attrValues slaves);
     }
   ];
 
@@ -363,7 +341,6 @@ in
     };
   };
 
-  nixpkgs.config.firefox.enableAdobeFlash = true;
   nixpkgs.config.chromium.enablePepperFlash = true;
 
   nixpkgs.config.allowUnfree = true;