mv: reinit
This commit is contained in:
tv
parent
b6dfed56dd
commit
ccb34ca338
@ -91,6 +91,7 @@ let
|
||||
imp = lib.mkMerge [
|
||||
{ krebs = import ./lass { inherit config lib; }; }
|
||||
{ krebs = import ./makefu { inherit config lib; }; }
|
||||
{ krebs = import ./mv { inherit config lib; }; }
|
||||
{ krebs = import ./shared { inherit config lib; }; }
|
||||
{ krebs = import ./tv { inherit config lib; }; }
|
||||
{
|
||||
|
||||
41
krebs/3modules/mv/default.nix
Normal file
41
krebs/3modules/mv/default.nix
Normal file
@ -0,0 +1,41 @@
|
||||
{ config, ... }:
|
||||
|
||||
with config.krebs.lib;
|
||||
|
||||
{
|
||||
hosts = mapAttrs (_: setAttr "owner" config.krebs.users.mv) {
|
||||
stro = {
|
||||
cores = 4;
|
||||
nets = {
|
||||
retiolum = {
|
||||
ip4.addr = "10.243.111.111";
|
||||
ip6.addr = "42:0:0:0:0:0:111:111";
|
||||
aliases = [
|
||||
"stro.r"
|
||||
"cgit.stro.r"
|
||||
"stro.retiolum"
|
||||
"cgit.stro.retiolum"
|
||||
];
|
||||
tinc.pubkey = ''
|
||||
-----BEGIN RSA PUBLIC KEY-----
|
||||
MIIBCgKCAQEA0vIzLyoetOyi3R7qOh3gjSvUVjPEdqCvd0NEevDCIhhFy0nIbZ/b
|
||||
vnuk3EUeTb6e384J8fKB4agig0JeR3JjtDvtjy5g9Cdy2nrU71w8wqU0etmv2PTb
|
||||
FjbCFfeBXn0N3U7gXwjZGCvjAXa1a4jGb4R2iYBYGG3aY4reCN8B8Ah81h+S0oLg
|
||||
ZJJfaBmWM5vNRFEI5X4CLaVnwtsoZuXIjYStgNn/9Mg/Y6NQS0H0H+HFeyhigAqG
|
||||
oYGqNar/2QqPU176V/FwrD30F3qJV1uyzuPta7hmdfOxqYjZ/jqdPSRYtlunYYcq
|
||||
XbH5oYmzO9NEeVWzjdac/DiV2OP8HufoYwIDAQAB
|
||||
-----END RSA PUBLIC KEY-----
|
||||
'';
|
||||
};
|
||||
};
|
||||
ssh.privkey.path = <secrets/ssh.ed25519>;
|
||||
ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+7Qa51l0NSkBiaK2s8vQEoeObV3UPZyEzMxfUK/ZAO root@stro";
|
||||
};
|
||||
};
|
||||
users = {
|
||||
mv = {
|
||||
mail = "mv@stro.r";
|
||||
pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDfMqkfXsGRaXJ86Pi5svAx4508ij5kc4cMLGwr1CLvFI5G7EHggiHMZYooibmkZimBF1PvLM1lOdoptJ4nSmc3UGuQaeV9BpZ1dNXexc8wOmVPKzAHYZG/2upcV/xVZQ9lk3UOmDym6fDUXThMx4nXdhOjScgWpKp7+0N3JRCf2UHusZjWFGlhE9l4irLFHCwlZeBQ16DNF4fc03vsfZBB1ZrGGZlaVpkcY+FTC3sm8R0iF5QGaq8PgltJoCNnp3L1g3Yn7Elva7kCHjZfJC1pu5icV8vZMNptPn1b10gPsNwb302FCjvZohzRcMo39L2gwdNWQmflYfYk+NPY9EgqkLtSvZJywYu8oTVLeYBAp0ZGzJR4+uIH9at/WQF499HFMxpF4uwYiQweUcPiHrrOqI5zLQoOvqh9Jv0UMsnFynNrszbCTgwzeW8bcvv8ILcjE9of8GXRCrlIMvt7Z9q8xrb5j1RhKscvusyyNOAL+HMZl6jgSxUBDtzRqPZ62QHJsBEBdRXdJRQLGeHNW9kGPrh/tiKGucuT3/HZC+2Rcemxt3RVT60+lHkghrMLi0/VOWBUKL9J94UK5xIE4Gb3RTW9DcNK53U4ql+N4ORSSEuhk3Rqzx3Bzv7AXpLKQCFKdB7tjxzGN7sCQM3PBUUo6Tk0VG2cIKOjzTRnDJlb7Q== mv@stro";
|
||||
};
|
||||
};
|
||||
}
|
||||
@ -418,7 +418,7 @@ with config.krebs.lib;
|
||||
dv = {
|
||||
mail = "dv@alnus.r";
|
||||
};
|
||||
mv = {
|
||||
mv-cd = {
|
||||
mail = "mv@cd.r";
|
||||
pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGer9e2+Lew7vnisgBbsFNECEIkpNJgEaqQqgb9inWkQ mv@vod";
|
||||
};
|
||||
|
||||
172
mv/1systems/stro.nix
Normal file
172
mv/1systems/stro.nix
Normal file
@ -0,0 +1,172 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with config.krebs.lib;
|
||||
|
||||
{
|
||||
krebs = {
|
||||
enable = true;
|
||||
build = {
|
||||
user = config.krebs.users.mv;
|
||||
host = config.krebs.hosts.stro;
|
||||
source = let
|
||||
HOME = getEnv "HOME";
|
||||
host = config.krebs.build.host;
|
||||
in {
|
||||
nixos-config.symlink = "stockholm/mv/1systems/${host.name}.nix";
|
||||
secrets.file = "${HOME}/secrets/${host.name}";
|
||||
stockholm.file = "${HOME}/stockholm";
|
||||
nixpkgs.git = {
|
||||
url = https://github.com/NixOS/nixpkgs;
|
||||
ref = "8bf31d7d27cae435d7c1e9e0ccb0a320b424066f";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
imports = [
|
||||
<secrets>
|
||||
<stockholm/krebs>
|
||||
<stockholm/tv/2configs/audit.nix>
|
||||
<stockholm/tv/2configs/bash.nix>
|
||||
<stockholm/tv/2configs/exim-retiolum.nix>
|
||||
<stockholm/tv/2configs/hw/x220.nix>
|
||||
<stockholm/tv/2configs/im.nix>
|
||||
<stockholm/tv/2configs/mail-client.nix>
|
||||
<stockholm/tv/2configs/retiolum.nix>
|
||||
<stockholm/tv/2configs/ssh.nix>
|
||||
<stockholm/tv/2configs/sshd.nix>
|
||||
<stockholm/tv/2configs/vim.nix>
|
||||
<stockholm/tv/2configs/xdg.nix>
|
||||
<stockholm/tv/2configs/xserver>
|
||||
<stockholm/tv/3modules>
|
||||
<stockholm/tv/5pkgs>
|
||||
];
|
||||
|
||||
boot.kernel.sysctl = {
|
||||
# Enable IPv6 Privacy Extensions
|
||||
"net.ipv6.conf.all.use_tempaddr" = 2;
|
||||
"net.ipv6.conf.default.use_tempaddr" = 2;
|
||||
};
|
||||
|
||||
boot.initrd.luks = {
|
||||
cryptoModules = [ "aes" "sha512" "xts" ];
|
||||
devices = [
|
||||
{
|
||||
name = "luks1";
|
||||
device = "/dev/disk/by-id/ata-TOSHIBA-TR150_467B50JXK8WU-part2";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
environment = {
|
||||
profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
|
||||
shellAliases = mkForce {
|
||||
gp = "${pkgs.pari}/bin/gp -q";
|
||||
df = "df -h";
|
||||
du = "du -h";
|
||||
ls = "ls -h --color=auto --group-directories-first";
|
||||
dmesg = "dmesg -L --reltime";
|
||||
view = "vim -R";
|
||||
|
||||
reload = "systemctl reload";
|
||||
restart = "systemctl restart";
|
||||
start = "systemctl start";
|
||||
status = "systemctl status";
|
||||
stop = "systemctl stop";
|
||||
};
|
||||
systemPackages = with pkgs; [
|
||||
dic
|
||||
htop
|
||||
p7zip
|
||||
q
|
||||
|
||||
pavucontrol
|
||||
rxvt_unicode.terminfo
|
||||
|
||||
# stockholm
|
||||
git
|
||||
gnumake
|
||||
populate
|
||||
];
|
||||
variables = {
|
||||
NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src";
|
||||
};
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-id/ata-TOSHIBA-TR150_467B50JXK8WU-part1";
|
||||
};
|
||||
"/" = {
|
||||
device = "/dev/mapper/vg1-root";
|
||||
fsType = "btrfs";
|
||||
options = ["defaults" "noatime" "ssd" "compress=lzo"];
|
||||
};
|
||||
"/home" = {
|
||||
device = "/dev/mapper/vg1-home";
|
||||
fsType = "btrfs";
|
||||
options = ["defaults" "noatime" "ssd" "compress=lzo"];
|
||||
};
|
||||
"/tmp" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
options = ["nosuid" "nodev" "noatime"];
|
||||
};
|
||||
};
|
||||
|
||||
hardware.pulseaudio = {
|
||||
enable = true;
|
||||
systemWide = true;
|
||||
};
|
||||
|
||||
networking.hostName = config.krebs.build.host.name;
|
||||
|
||||
nix = {
|
||||
binaryCaches = ["https://cache.nixos.org"];
|
||||
# TODO check if both are required:
|
||||
chrootDirs = [ "/etc/protocols" pkgs.iana_etc.outPath ];
|
||||
requireSignedBinaryCaches = true;
|
||||
useChroot = true;
|
||||
};
|
||||
|
||||
nixpkgs.config.allowUnfree = false;
|
||||
|
||||
users = {
|
||||
defaultUserShell = "/run/current-system/sw/bin/bash";
|
||||
mutableUsers = false;
|
||||
users = {
|
||||
mv = {
|
||||
inherit (config.krebs.users.mv) home uid;
|
||||
isNormalUser = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
security.setuidPrograms = [
|
||||
"sendmail"
|
||||
];
|
||||
|
||||
security.sudo.extraConfig = ''
|
||||
Defaults env_keep+="SSH_CLIENT"
|
||||
Defaults mailto="${config.krebs.users.mv.mail}"
|
||||
Defaults !lecture
|
||||
'';
|
||||
|
||||
services.cron.enable = false;
|
||||
services.journald.extraConfig = ''
|
||||
SystemMaxUse=1G
|
||||
RuntimeMaxUse=128M
|
||||
'';
|
||||
services.nscd.enable = false;
|
||||
services.ntp.enable = false;
|
||||
services.timesyncd.enable = true;
|
||||
|
||||
time.timeZone = "Europe/Berlin";
|
||||
|
||||
tv.iptables = {
|
||||
enable = true;
|
||||
accept-echo-request = "internet";
|
||||
};
|
||||
|
||||
system.stateVersion = "16.03";
|
||||
}
|
||||
@ -20,7 +20,7 @@ with config.krebs.lib;
|
||||
];
|
||||
internet-aliases = with config.krebs.users; [
|
||||
{ from = "postmaster@viljetic.de"; to = tv.mail; } # RFC 822
|
||||
{ from = "mirko@viljetic.de"; to = mv.mail; }
|
||||
{ from = "mirko@viljetic.de"; to = mv-cd.mail; }
|
||||
{ from = "tomislav@viljetic.de"; to = tv.mail; }
|
||||
{ from = "tv@destroy.dyn.shackspace.de"; to = tv.mail; }
|
||||
{ from = "tv@viljetic.de"; to = tv.mail; }
|
||||
|
||||
Loading…
Reference in New Issue
Block a user