Merge remote-tracking branch 'cd/master'

0make/tv/nomic.makefile

@@ -1,4 +1,4 @@
 deploy_host := root@nomic.gg23
 nixpkgs_url := https://github.com/NixOS/nixpkgs
-nixpkgs_rev := 6ad8fab785695d04a6925e8b3464ca7c71a85c3f
+nixpkgs_rev := 9d5508d85c33b8fb22d79dde6176792eac2c2696
 secrets_dir := /home/tv/secrets/nomic

1systems/tv/cd.nix

@@ -7,6 +7,8 @@ let
 in
 
 {
+  krebs.build.host = config.krebs.hosts.cd;
+
   imports = [
     ../../2configs/tv/CAC-Developer-2.nix
     ../../2configs/tv/CAC-CentOS-7-64bit.nix
@@ -32,10 +34,6 @@ in
       tv.iptables.input-internet-accept-new-tcp =
         singleton config.krebs.github-hosts-sync.port;
     }
-    {
-      imports = [ ../../2configs/tv/identity.nix ];
-      tv.identity.self = config.krebs.hosts.cd;
-    }
     {
       tv.iptables = {
         enable = true;
@@ -86,7 +84,6 @@ in
     }
   ];
 
-  networking.hostName = "cd";
   networking.interfaces.enp2s1.ip4 = [
     {
       address = "162.219.7.216";
@@ -122,8 +119,8 @@ in
       home = "/home/mv";
       createHome = true;
       useDefaultShell = true;
-      openssh.authorizedKeys.keys = map readFile [
+      openssh.authorizedKeys.keys = [
-        ../../Zpubkeys/mv_vod.ssh.pub
+        config.krebs.users.mv.pubkey
       ];
     };
   };

1systems/tv/mkdir.nix

@@ -3,6 +3,8 @@
 with lib;
 
 {
+  krebs.build.host = config.krebs.hosts.mkdir;
+
   imports = [
     ../../2configs/tv/CAC-Developer-1.nix
     ../../2configs/tv/CAC-CentOS-7-64bit.nix
@@ -10,10 +12,6 @@ with lib;
     ../../2configs/tv/consul-server.nix
     ../../2configs/tv/exim-smarthost.nix
     ../../2configs/tv/git.nix
-    {
-      imports = [ ../../2configs/tv/identity.nix ];
-      tv.identity.self = config.krebs.hosts.mkdir;
-    }
     {
       tv.iptables = {
         enable = true;
@@ -40,7 +38,6 @@ with lib;
     }
   ];
 
-  networking.hostName = "mkdir";
   networking.interfaces.enp2s1.ip4 = [
     {
       address = "162.248.167.241"; # TODO

1systems/tv/nomic.nix

@@ -3,16 +3,14 @@
 with lib;
 
 {
+  krebs.build.host = config.krebs.hosts.nomic;
+
   imports = [
     ../../2configs/tv/AO753.nix
     ../../2configs/tv/base.nix
     ../../2configs/tv/consul-server.nix
     ../../2configs/tv/exim-retiolum.nix
     ../../2configs/tv/git.nix
-    {
-      imports = [ ../../2configs/tv/identity.nix ];
-      tv.identity.self = config.krebs.hosts.nomic;
-    }
     {
       tv.iptables = {
         enable = true;
@@ -99,6 +97,4 @@ with lib;
     rxvt_unicode.terminfo
     tmux
   ];
-
-  networking.hostName = "nomic";
 }

1systems/tv/rmdir.nix

@@ -3,6 +3,8 @@
 with lib;
 
 {
+  krebs.build.host = config.krebs.hosts.rmdir;
+
   imports = [
     ../../2configs/tv/CAC-Developer-1.nix
     ../../2configs/tv/CAC-CentOS-7-64bit.nix
@@ -10,10 +12,6 @@ with lib;
     ../../2configs/tv/consul-server.nix
     ../../2configs/tv/exim-smarthost.nix
     ../../2configs/tv/git.nix
-    {
-      imports = [ ../../2configs/tv/identity.nix ];
-      tv.identity.self = config.krebs.hosts.rmdir;
-    }
     {
       tv.iptables = {
         enable = true;
@@ -41,7 +39,6 @@ with lib;
     }
   ];
 
-  networking.hostName = "rmdir";
   networking.interfaces.enp2s1.ip4 = [
     {
       address = "167.88.44.94";

1systems/tv/wu.nix

@@ -7,6 +7,8 @@ let
 in
 
 {
+  krebs.build.host = config.krebs.hosts.wu;
+
   imports = [
     ../../2configs/tv/w110er.nix
     ../../2configs/tv/base.nix
@@ -16,10 +18,7 @@ in
     ../../2configs/tv/mail-client.nix
     ../../2configs/tv/xserver.nix
     ../../2configs/tv/synaptics.nix # TODO w110er if xserver is enabled
-    {
+    ../../2configs/tv/urlwatch.nix
-      imports = [ ../../2configs/tv/identity.nix ];
-      tv.identity.self = config.krebs.hosts.wu;
-    }
     {
       environment.systemPackages = with pkgs; [
 
@@ -30,6 +29,25 @@ in
         Zpkgs.genid
         Zpkgs.hashPassword
         Zpkgs.lentil
+        (pkgs.writeScriptBin "ff" ''
+          #! ${pkgs.bash}/bin/bash
+          exec sudo -u ff -i <<EOF
+          exec ${pkgs.firefoxWrapper}/bin/firefox $(printf " %q" "$@")
+          EOF
+        '')
+        (pkgs.writeScriptBin "im" ''
+          #! ${pkgs.bash}/bin/bash
+          export PATH=${makeSearchPath "bin" (with pkgs; [
+            tmux
+            gnugrep
+            weechat
+          ])}
+          if tmux list-sessions -F\#S | grep -q '^im''$'; then
+            exec tmux attach -t im
+          else
+            exec tmux new -s im weechat
+          fi
+        '')
 
         # root
         cryptsetup
@@ -57,7 +75,6 @@ in
         sxiv
         texLive
         tmux
-        weechat
         zathura
         Zpkgs.dic
 
@@ -96,7 +113,6 @@ in
         #ppp
         #proot
         #pythonPackages.arandr
-        #pythonPackages.urlwatch
         #pythonPackages.youtube-dl
         #racket
         #rxvt_unicode-with-plugins
@@ -151,55 +167,6 @@ in
         ];
       };
     }
-    {
-      krebs.urlwatch = {
-        enable = true;
-        mailto = "tv@wu.retiolum"; # TODO
-        onCalendar = "*-*-* 05:00:00";
-        urls = [
-          ## nixpkgs maintenance
-
-          # 2014-07-29 when one of the following urls change
-          # then we have to update the package
-
-          # ref src/nixpkgs/pkgs/tools/admin/sec/default.nix
-          https://api.github.com/repos/simple-evcorr/sec/tags
-
-          # ref src/nixpkgs/pkgs/tools/networking/urlwatch/default.nix
-          https://thp.io/2008/urlwatch/
-
-          # 2014-12-20 ref src/nixpkgs/pkgs/tools/networking/tlsdate/default.nix
-          https://api.github.com/repos/ioerror/tlsdate/tags
-
-          # 2015-02-18
-          # ref ~/src/nixpkgs/pkgs/tools/text/qprint/default.nix
-          http://www.fourmilab.ch/webtools/qprint/
-
-          # 2014-09-24 ref https://github.com/4z3/xintmap
-          http://www.mathstat.dal.ca/~selinger/quipper/
-
-          # 2014-12-12 remove nixopsUnstable when nixops get's bumped to 1.3
-          # ref https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/package-management/nixops/unstable.nix
-          http://nixos.org/releases/nixops/
-
-          ## other
-
-          https://nixos.org/channels/nixos-unstable/git-revision
-
-          ## 2014-10-17
-          ## TODO update ~/src/login/default.nix
-          #http://hackage.haskell.org/package/bcrypt
-          #http://hackage.haskell.org/package/cron
-          #http://hackage.haskell.org/package/hyphenation
-          #http://hackage.haskell.org/package/iso8601-time
-          #http://hackage.haskell.org/package/ixset-typed
-          #http://hackage.haskell.org/package/system-command
-          #http://hackage.haskell.org/package/transformers
-          #http://hackage.haskell.org/package/web-routes-wai
-          #http://hackage.haskell.org/package/web-page
-        ];
-      };
-    }
     {
       users.extraGroups = {
         tv-sub.gid = 1337;
@@ -414,7 +381,6 @@ in
     };
   };
 
-  nixpkgs.config.firefox.enableAdobeFlash = true;
   nixpkgs.config.chromium.enablePepperFlash = true;
 
   nixpkgs.config.allowUnfree = true;
@@ -424,8 +390,6 @@ in
   hardware.opengl.driSupport32Bit = true;
   hardware.pulseaudio.enable = true;
 
-  networking.hostName = "wu";
-
   environment.systemPackages = with pkgs; [
     xlibs.fontschumachermisc
     slock

2configs/tv/base.nix

@@ -10,6 +10,9 @@ in
 
 {
   krebs.enable = true;
+  krebs.search-domain = "retiolum";
+
+  networking.hostName = config.krebs.build.host.name;
 
   imports = [
     {
@@ -24,8 +27,8 @@ in
     {
       users.extraUsers = {
         root = {
-          openssh.authorizedKeys.keys = map readFile [
+          openssh.authorizedKeys.keys = [
-            ../../Zpubkeys/tv_wu.ssh.pub
+            config.krebs.users.tv.pubkey
           ];
         };
         tv = {
@@ -39,15 +42,15 @@ in
             "video"
             "wheel"
           ];
-          openssh.authorizedKeys.keys = map readFile [
+          openssh.authorizedKeys.keys = [
-            ../../Zpubkeys/tv_wu.ssh.pub
+            config.krebs.users.tv.pubkey
           ];
         };
       };
     }
     {
       security.sudo.extraConfig = ''
-        Defaults mailto="tv@wu.retiolum"
+        Defaults mailto="${config.krebs.users.tv.mail}"
       '';
       time.timeZone = "Europe/Berlin";
     }

2configs/tv/charybdis.nix

@@ -123,7 +123,7 @@ let
     #loadmodule "extensions/ip_cloaking.so";
     
     serverinfo {
-      name = ${toJSON (head config.tv.identity.self.nets.retiolum.aliases)};
+      name = ${toJSON (head config.krebs.build.host.nets.retiolum.aliases)};
       sid = "4z3";
       description = "miep!";
       network_name = "irc.retiolum";
@@ -133,9 +133,9 @@ let
       /* On multi-homed hosts you may need the following. These define
        * the addresses we connect from to other servers. */
       /* for IPv4 */
-      vhost = ${concatMapStringsSep ", " toJSON config.tv.identity.self.nets.retiolum.addrs4};
+      vhost = ${concatMapStringsSep ", " toJSON config.krebs.build.host.nets.retiolum.addrs4};
       /* for IPv6 */
-      vhost6 = ${concatMapStringsSep ", " toJSON config.tv.identity.self.nets.retiolum.addrs6};
+      vhost6 = ${concatMapStringsSep ", " toJSON config.krebs.build.host.nets.retiolum.addrs6};
       
       /* ssl_private_key: our ssl private key */
       ssl_private_key = "/tmp/ssl.key";
@@ -170,7 +170,7 @@ let
     admin {
       name = "tv";
       description = "peer";
-      email = "tv@wu.retiolum";
+      mail = "${config.krebs.users.tv.mail}";
     };
 
     log {
@@ -240,7 +240,7 @@ let
        */
       # XXX This is stupid because only one host is allowed[?]
       #host = ''${concatMapStringsSep ", " toJSON (
-      #  config.tv.identity.self.nets.retiolum.addrs
+      #  config.krebs.build.host.nets.retiolum.addrs
       #)};
       port = 6667;
       sslport = 6697;

2configs/tv/consul-server.nix

@@ -4,7 +4,7 @@
   tv.consul = rec {
     enable = true;
 
-    inherit (config.tv.identity) self;
+    self = config.krebs.build.host;
     inherit (self) dc;
 
     server = true;

2configs/tv/exim-smarthost.nix

@@ -11,20 +11,21 @@ in
     let
       retiolumHostname = "${config.networking.hostName}.retiolum";
 
-      internet-aliases = [
+      internet-aliases = with config.krebs.users; [
-        { from = "tomislav@viljetic.de"; to = "tv@wu.retiolum"; }
+        { from = "tomislav@viljetic.de"; to = tv.mail; }
 
         # (mindestens) lisp-stammtisch und elli haben die:
-        { from = "tv@viljetic.de"; to = "tv@wu.retiolum"; }
+        { from = "tv@viljetic.de"; to = tv.mail; }
 
-        { from = "tv@destroy.dyn.shackspace.de"; to = "tv@wu.retiolum"; }
+        { from = "tv@destroy.dyn.shackspace.de"; to = tv.mail; }
 
-        { from = "mirko@viljetic.de"; to = "mv@cd.retiolum"; }
+        { from = "mirko@viljetic.de"; to = mv.mail; }
 
         # TODO killme (wo wird die benutzt?)
-        { from = "tv@cd.retiolum"; to = "tv@wu.retiolum"; }
+        { from = "tv@cd.retiolum"; to = tv.mail; }
 
-        { from = "postmaster@krebsco.de"; to = "tv@wu.retiolum"; }
+        # TODO lists@smtp.retiolum [consul]
+        { from = "postmaster@krebsco.de"; to = tv.mail; }
       ];
 
       system-aliases = [

2configs/tv/git.nix

@@ -6,7 +6,7 @@ let
   out = {
     krebs.git = {
       enable = true;
-      root-title = "public repositories at ${config.tv.identity.self.name}";
+      root-title = "public repositories at ${config.krebs.build.host.name}";
       root-desc = "keep calm and engage";
       inherit repos rules;
     };
@@ -14,7 +14,7 @@ let
 
   repos = mapAttrs (_: s: removeAttrs s ["collaborators"]) (
     public-repos //
-    optionalAttrs config.tv.identity.self.secure restricted-repos
+    optionalAttrs config.krebs.build.host.secure restricted-repos
   );
 
   rules = concatMap make-rules (attrValues repos);
@@ -55,8 +55,8 @@ let
     public = true;
     hooks = {
       post-receive = git.irc-announce {
-        # TODO make nick = config.tv.identity.self.name the default
+        # TODO make nick = config.krebs.build.host.name the default
-        nick = config.tv.identity.self.name;
+        nick = config.krebs.build.host.name;
         channel = "#retiolum";
         server = "cd.retiolum";
       };
@@ -66,7 +66,6 @@ let
   make-restricted-repo = name: { desc ? null, ... }: {
     inherit name desc;
     public = false;
-    hooks = {}; # TODO default
   };
 
   make-rules =

2configs/tv/identity.nix

@@ -1,8 +0,0 @@
-{ config, ... }:
-
-{
-  tv.identity = {
-    enable = true;
-    search = "retiolum";
-  };
-}

2configs/tv/smartd.nix

@@ -8,7 +8,7 @@
         device = "DEVICESCAN";
         options = toString [
           "-a"
-          "-m tv@wu.retiolum"
+          "-m ${config.krebs.users.tv.mail}"
           "-s (O/../.././09|S/../.././04|L/../../6/05)"
         ];
       }

2configs/tv/urlwatch.nix

@@ -0,0 +1,51 @@
+{ config, ... }:
+
+{
+  krebs.urlwatch = {
+    enable = true;
+    mailto = config.krebs.users.tv.mail;
+    onCalendar = "*-*-* 05:00:00";
+    urls = [
+      ## nixpkgs maintenance
+
+      # 2014-07-29 when one of the following urls change
+      # then we have to update the package
+
+      # ref src/nixpkgs/pkgs/tools/admin/sec/default.nix
+      https://api.github.com/repos/simple-evcorr/sec/tags
+
+      # ref src/nixpkgs/pkgs/tools/networking/urlwatch/default.nix
+      https://thp.io/2008/urlwatch/
+
+      # 2014-12-20 ref src/nixpkgs/pkgs/tools/networking/tlsdate/default.nix
+      https://api.github.com/repos/ioerror/tlsdate/tags
+
+      # 2015-02-18
+      # ref ~/src/nixpkgs/pkgs/tools/text/qprint/default.nix
+      http://www.fourmilab.ch/webtools/qprint/
+
+      # 2014-09-24 ref https://github.com/4z3/xintmap
+      http://www.mathstat.dal.ca/~selinger/quipper/
+
+      # 2014-12-12 remove nixopsUnstable when nixops get's bumped to 1.3
+      # ref https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/package-management/nixops/unstable.nix
+      http://nixos.org/releases/nixops/
+
+      ## other
+
+      https://nixos.org/channels/nixos-unstable/git-revision
+
+      ## 2014-10-17
+      ## TODO update ~/src/login/default.nix
+      #http://hackage.haskell.org/package/bcrypt
+      #http://hackage.haskell.org/package/cron
+      #http://hackage.haskell.org/package/hyphenation
+      #http://hackage.haskell.org/package/iso8601-time
+      #http://hackage.haskell.org/package/ixset-typed
+      #http://hackage.haskell.org/package/system-command
+      #http://hackage.haskell.org/package/transformers
+      #http://hackage.haskell.org/package/web-routes-wai
+      #http://hackage.haskell.org/package/web-page
+    ];
+  };
+}

3modules/krebs/default.nix

@@ -19,6 +19,21 @@ let
   api = {
     enable = mkEnableOption "krebs";
 
+    build = mkOption {
+      type = types.submodule {
+        options = {
+          host = mkOption {
+            type = types.host;
+          };
+          user = mkOption {
+            type = types.user;
+          };
+        };
+      };
+      # Define defaul value, so unset values of the submodule get reported.
+      default = {};
+    };
+
     hosts = mkOption {
       type = with types; attrsOf host;
     };
@@ -26,12 +41,54 @@ let
     users = mkOption {
       type = with types; attrsOf user;
     };
+
+    # XXX is there a better place to define search-domain?
+    # TODO search-domains :: listOf hostname
+    search-domain = mkOption {
+      type = types.hostname;
+      default = "";
+      example = "retiolum";
+    };
   };
 
   imp = mkMerge [
     { krebs = lass-imp; }
     { krebs = makefu-imp; }
     { krebs = tv-imp; }
+    {
+      # XXX This overlaps with krebs.retiolum
+      networking.extraHosts =
+        let
+          # TODO move domain name providers to a dedicated module
+          # providers : tree label providername
+          providers = {
+            internet = "hosts";
+            retiolum = "hosts";
+            de.viljetic = "regfish";
+            de.krebsco = "ovh";
+          };
+
+          # splitByProvider : [alias] -> listset providername alias
+          splitByProvider = foldl (acc: alias: listset-insert (providerOf alias) alias acc) {};
+
+          # providerOf : alias -> providername
+          providerOf = alias:
+            tree-get (splitString "." alias) providers;
+        in
+        concatStringsSep "\n" (flatten (
+          # TODO deepMap ["hosts" "nets"] (hostname: host: netname: net:
+          mapAttrsToList (hostname: host:
+            mapAttrsToList (netname: net:
+              let
+                aliases = toString (unique (longs ++ shorts));
+                longs = (splitByProvider net.aliases).hosts;
+                shorts = map (removeSuffix ".${cfg.search-domain}") longs;
+              in
+              map (addr: "${addr} ${aliases}") net.addrs
+            ) host.nets
+          ) config.krebs.hosts
+        ));
+    }
   ];
 
   lass-imp = {
@@ -236,7 +293,12 @@ let
       };
     };
     users = addNames {
+      mv = {
+        mail = "mv@cd.retiolum";
+        pubkey = readFile ../../Zpubkeys/mv_vod.ssh.pub;
+      };
       tv = {
+        mail = "tv@wu.retiolum";
         pubkey = readFile ../../Zpubkeys/tv_wu.ssh.pub;
       };
     };

3modules/krebs/git.nix

@@ -72,6 +72,7 @@ let
           };
           hooks = mkOption {
             type = types.attrsOf types.str;
+            default = {};
             description = ''
               Repository-specific hooks.
             '';

3modules/tv/default.nix

@@ -4,7 +4,6 @@ _:
   imports = [
     ./consul.nix
     ./ejabberd.nix
-    ./identity.nix
     ./iptables.nix
   ];
 }

3modules/tv/identity.nix

@@ -1,77 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with import ../../4lib/tv { inherit lib pkgs; };
-let
-  cfg = config.tv.identity;
-
-  out = {
-    options.tv.identity = api;
-    config = mkIf cfg.enable imp;
-  };
-
-  api = {
-    enable = mkEnableOption "tv.identity";
-
-    self = mkOption {
-      type = types.host;
-    };
-
-    #others = mkOption {
-    #  type = types.host;
-    #  default = filterAttrs (name: _host: name != cfg.self.name) cfg.hosts;
-    #};
-
-    search = mkOption {
-      type = types.hostname;
-    };
-  };
-
-  imp = {
-    networking.extraHosts =
-      concatStringsSep "\n" (flatten (
-        # TODO deepMap ["hosts" "nets"] (hostname: host: netname: net:
-        mapAttrsToList (hostname: host:
-          mapAttrsToList (netname: net:
-            let
-              aliases = toString (unique (longs ++ shorts));
-              longs = (splitByProvider net.aliases).hosts;
-              shorts = map (removeSuffix ".${cfg.search}") longs;
-            in
-            map (addr: "${addr} ${aliases}") net.addrs
-          ) host.nets
-        ) config.krebs.hosts
-      ));
-  };
-
-  # TODO move domain name providers to a dedicated module
-  # providers : tree label providername
-  providers = {
-    internet = "hosts";
-    retiolum = "hosts";
-    de.viljetic = "regfish";
-    de.krebsco = "ovh";
-  };
-
-  # splitByProvider : [alias] -> set providername [alias]
-  splitByProvider = foldl (acc: alias: insert (providerOf alias) alias acc) {};
-
-  # providerOf : alias -> providername
-  providerOf = alias:
-    tree-get (splitString "." alias) providers;
-
-  # insert : k -> v -> set k [v] -> set k [v]
-  insert = name: value: set:
-    set // { ${name} = set.${name} or [] ++ [value]; };
-
-  # tree k v = set k (either v (tree k v))
-
-  # tree-get : [k] -> tree k v -> v
-  tree-get = path: x:
-    let
-      y = x.${last path};
-    in
-    if typeOf y != "set"
-      then y
-      else tree-get (init path) y;
-in
-out

4lib/krebs/default.nix

@@ -12,4 +12,22 @@ builtins // lib // rec {
 
   types = import ./types.nix { inherit lib; };
 
+
+  # listset k v = set k [v]
+
+  # listset-insert : k -> v -> listset k v -> listset k v
+  listset-insert = name: value: set:
+    set // { ${name} = set.${name} or [] ++ [value]; };
+
+  # tree k v = set k (either v (tree k v))
+
+  # tree-get : [k] -> tree k v -> v
+  tree-get = path: x:
+    let
+      y = x.${last path};
+    in
+    if typeOf y != "set"
+      then y
+      else tree-get (init path) y;
+
 }

4lib/krebs/types.nix

@@ -83,6 +83,9 @@ types // rec {
 
   user = submodule {
     options = {
+      mail = mkOption {
+        type = str; # TODO retiolum mail address
+      };
       name = mkOption {
         type = str; # TODO
       };