From 5db85240edfbac9c8db2218749add18d5430618a Mon Sep 17 00:00:00 2001 From: nin Date: Thu, 26 Jan 2017 21:23:34 +0100 Subject: [PATCH 01/41] n 2: remove MANPAGER --- nin/2configs/default.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/nin/2configs/default.nix b/nin/2configs/default.nix index e181a6041..260dbc5b5 100644 --- a/nin/2configs/default.nix +++ b/nin/2configs/default.nix @@ -82,7 +82,6 @@ with import ; # multiple-definition-problem when defining environment.variables.EDITOR environment.extraInit = '' EDITOR=vim - MANPAGER=most ''; nixpkgs.config.allowUnfree = true; From 1b57bcf233e66710a33380f2de0874be79a96f9e Mon Sep 17 00:00:00 2001 From: nin Date: Thu, 26 Jan 2017 21:25:18 +0100 Subject: [PATCH 02/41] n 2: add git status alias --- nin/2configs/default.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/nin/2configs/default.nix b/nin/2configs/default.nix index 260dbc5b5..0ff0f8ae8 100644 --- a/nin/2configs/default.nix +++ b/nin/2configs/default.nix @@ -86,6 +86,10 @@ with import ; nixpkgs.config.allowUnfree = true; + environment.shellAliases = { + gs = "git status"; + }; + environment.systemPackages = with pkgs; [ #stockholm git From 832fe4868cf6c800a559ebabb07b34babb181853 Mon Sep 17 00:00:00 2001 From: nin Date: Thu, 26 Jan 2017 22:08:57 +0100 Subject: [PATCH 03/41] n 1 hiawatha: sort, delete, add pkgs --- nin/1systems/hiawatha.nix | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/nin/1systems/hiawatha.nix b/nin/1systems/hiawatha.nix index 6fa8a3388..100985286 100644 --- a/nin/1systems/hiawatha.nix +++ b/nin/1systems/hiawatha.nix @@ -76,15 +76,14 @@ with lib; environment.systemPackages = with pkgs; [ firefox - steam - thunderbird - vim git - hexchat networkmanagerapplet python + steam + termite + thunderbird + vim virtmanager - libvirt ]; nixpkgs.config = { From ccdb47ed6c5ab88276214aacc869573dae9b867c Mon Sep 17 00:00:00 2001 From: nin Date: Thu, 26 Jan 2017 22:11:45 +0100 Subject: [PATCH 04/41] n 2: add dummy secrects --- nin/2configs/default.nix | 5 ++++- nin/6tests/dummysecrets/ssh.id_ed25519 | 0 2 files changed, 4 insertions(+), 1 deletion(-) create mode 100644 nin/6tests/dummysecrets/ssh.id_ed25519 diff --git a/nin/2configs/default.nix b/nin/2configs/default.nix index 0ff0f8ae8..ed205a791 100644 --- a/nin/2configs/default.nix +++ b/nin/2configs/default.nix @@ -58,7 +58,10 @@ with import ; user = config.krebs.users.nin; source = let inherit (config.krebs.build) host; in { nixos-config.symlink = "stockholm/nin/1systems/${host.name}.nix"; - secrets.file = "/home/nin/secrets/${host.name}"; + secrets.file = + if getEnv "dummy_secrets" == "true" + then toString + else "/home/nin/secrets/${host.name}"; stockholm.file = getEnv "PWD"; }; }; diff --git a/nin/6tests/dummysecrets/ssh.id_ed25519 b/nin/6tests/dummysecrets/ssh.id_ed25519 new file mode 100644 index 000000000..e69de29bb From 9e201365e262b8c13c03fa42da32c3b57c57c9ba Mon Sep 17 00:00:00 2001 From: nin Date: Thu, 26 Jan 2017 22:20:31 +0100 Subject: [PATCH 05/41] n 2: add prism as binary-cache --- nin/2configs/default.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/nin/2configs/default.nix b/nin/2configs/default.nix index ed205a791..fa05a5602 100644 --- a/nin/2configs/default.nix +++ b/nin/2configs/default.nix @@ -46,6 +46,12 @@ with import ; SSL_CERT_FILE = ca-bundle; }; }) + { + nix = { + binaryCaches = ["http://cache.prism.r"]; + binaryCachePublicKeys = ["cache.prism-1:+S+6Lo/n27XEtvdlQKuJIcb1yO5NUqUCE2lolmTgNJU="]; + }; + } ]; networking.hostName = config.krebs.build.host.name; From 999e1391c25f4ca8b35fe70675df91aab4c6a2a7 Mon Sep 17 00:00:00 2001 From: nin Date: Thu, 26 Jan 2017 22:45:42 +0100 Subject: [PATCH 06/41] n: move termite to default pkgs --- nin/1systems/hiawatha.nix | 1 - nin/2configs/default.nix | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/nin/1systems/hiawatha.nix b/nin/1systems/hiawatha.nix index 100985286..9d01d7a7e 100644 --- a/nin/1systems/hiawatha.nix +++ b/nin/1systems/hiawatha.nix @@ -80,7 +80,6 @@ with lib; networkmanagerapplet python steam - termite thunderbird vim virtmanager diff --git a/nin/2configs/default.nix b/nin/2configs/default.nix index fa05a5602..a1ed76d98 100644 --- a/nin/2configs/default.nix +++ b/nin/2configs/default.nix @@ -107,6 +107,7 @@ with import ; proot populate p7zip + termite unzip unrar hashPassword From 1ab3ea7e240edf496eb6db3725f2b6f0411bbb34 Mon Sep 17 00:00:00 2001 From: nin Date: Thu, 26 Jan 2017 22:49:00 +0100 Subject: [PATCH 07/41] n 6: add to dummysecrets hashedPassword.nix --- nin/6tests/dummysecrets/hashedPasswords.nix | 1 + 1 file changed, 1 insertion(+) create mode 100644 nin/6tests/dummysecrets/hashedPasswords.nix diff --git a/nin/6tests/dummysecrets/hashedPasswords.nix b/nin/6tests/dummysecrets/hashedPasswords.nix new file mode 100644 index 000000000..0967ef424 --- /dev/null +++ b/nin/6tests/dummysecrets/hashedPasswords.nix @@ -0,0 +1 @@ +{} From 712b05eb47ef796500a057cd6c2bec50152db970 Mon Sep 17 00:00:00 2001 From: nin Date: Thu, 26 Jan 2017 23:22:35 +0100 Subject: [PATCH 08/41] n 2: add git config --- nin/1systems/hiawatha.nix | 1 + nin/1systems/onondaga.nix | 1 + nin/2configs/git.nix | 70 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 72 insertions(+) create mode 100644 nin/2configs/git.nix diff --git a/nin/1systems/hiawatha.nix b/nin/1systems/hiawatha.nix index 9d01d7a7e..af865497e 100644 --- a/nin/1systems/hiawatha.nix +++ b/nin/1systems/hiawatha.nix @@ -11,6 +11,7 @@ with lib; ../. ../2configs/retiolum.nix + ../2configs/git.nix ]; krebs.build.host = config.krebs.hosts.hiawatha; diff --git a/nin/1systems/onondaga.nix b/nin/1systems/onondaga.nix index 59f26c46b..576847032 100644 --- a/nin/1systems/onondaga.nix +++ b/nin/1systems/onondaga.nix @@ -10,6 +10,7 @@ ../2configs/retiolum.nix ../2configs/weechat.nix + ../2configs/git.nix ]; krebs.build.host = config.krebs.hosts.onondaga; diff --git a/nin/2configs/git.nix b/nin/2configs/git.nix new file mode 100644 index 000000000..39f919e79 --- /dev/null +++ b/nin/2configs/git.nix @@ -0,0 +1,70 @@ +{ config, lib, pkgs, ... }: + +with import ; + +let + + out = { + krebs.git = { + enable = true; + cgit = { + settings = { + root-title = "public repositories at ${config.krebs.build.host.name}"; + root-desc = "keep calm and engage"; + }; + }; + repos = mapAttrs (_: s: removeAttrs s ["collaborators"]) repos; + rules = rules; + }; + + krebs.iptables.tables.filter.INPUT.rules = [ + { predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; } + ]; + }; + + repos = public-repos; + + rules = concatMap make-rules (attrValues repos); + + public-repos = mapAttrs make-public-repo { + stockholm = { + cgit.desc = "take all the computers hostage, they'll love you!"; + }; + }; + + make-public-repo = name: { cgit ? {}, ... }: { + inherit cgit name; + public = true; + hooks = { + post-receive = pkgs.git-hooks.irc-announce { + # TODO make nick = config.krebs.build.host.name the default + nick = config.krebs.build.host.name; + channel = "#retiolum"; + server = "ni.r"; + verbose = config.krebs.build.host.name == "onondaga"; + # TODO define branches in some kind of option per repo + branches = [ "master" ]; + }; + }; + }; + + make-rules = + with git // config.krebs.users; + repo: + singleton { + user = [ nin ]; + repo = [ repo ]; + perm = push "refs/*" [ non-fast-forward create delete merge ]; + } ++ + optional repo.public { + user = attrValues config.krebs.users; + repo = [ repo ]; + perm = fetch; + } ++ + optional (length (repo.collaborators or []) > 0) { + user = repo.collaborators; + repo = [ repo ]; + perm = fetch; + }; + +in out From fc627d0b999edb8bb7c58f2efa7dcbe1ccb83e7d Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 26 Jan 2017 23:44:31 +0100 Subject: [PATCH 09/41] l 1 prism: remove obsolete nin stuff --- lass/1systems/prism.nix | 13 +------------ lass/2configs/buildbot-standalone.nix | 17 +++++++++++++++++ 2 files changed, 18 insertions(+), 12 deletions(-) diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix index d8980a10c..86c2c7416 100644 --- a/lass/1systems/prism.nix +++ b/lass/1systems/prism.nix @@ -227,6 +227,7 @@ in { }; } { + # Nin stuff users.users.nin = { uid = genid "nin"; inherit (config.krebs.users.nin) home; @@ -240,18 +241,6 @@ in { "libvirtd" ]; }; - krebs.git.rules = [ - { - user = [ config.krebs.users.nin ]; - repo = [ config.krebs.git.repos.stockholm ]; - perm = with git; push "refs/heads/nin" [ fast-forward non-fast-forward create delete merge ]; - } - ]; - krebs.repo-sync.repos.stockholm.nin = { - origin.url = "http://cgit.prism/stockholm"; - origin.ref = "heads/nin"; - mirror.url = "git@${config.networking.hostName}:stockholm"; - }; krebs.iptables.tables.nat.PREROUTING.rules = [ { v6 = false; precedence = 1000; predicate = "-d 213.239.205.240 -p tcp --dport 1337"; target = "DNAT --to-destination 192.168.122.24:22"; } ]; diff --git a/lass/2configs/buildbot-standalone.nix b/lass/2configs/buildbot-standalone.nix index 7057d0c3d..c9e2928b3 100644 --- a/lass/2configs/buildbot-standalone.nix +++ b/lass/2configs/buildbot-standalone.nix @@ -58,6 +58,11 @@ in { "NIX_REMOTE": "daemon", "dummy_secrets": "true", } + env_nin = { + "LOGNAME": "nin", + "NIX_REMOTE": "daemon", + "dummy_secrets": "true", + } env_shared = { "LOGNAME": "shared", "NIX_REMOTE": "daemon", @@ -126,6 +131,18 @@ in { ] ) + for i in [ "hiawatha", "onondaga" ]: + addShell(f,name="build-{}".format(i),env=env_nin, + command=nixshell + \ + ["mkdir -p /tmp/testbuild/$LOGNAME && touch /tmp/testbuild/$LOGNAME/.populate; \ + make \ + test \ + target=$LOGNAME@${config.krebs.build.host.name}/tmp/testbuild/$LOGNAME \ + method=build \ + system={}".format(i) + ] + ) + bu.append( util.BuilderConfig( name="build-hosts", From b4537403f85417937f08fba04d01fc5fb23bc3a4 Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 26 Jan 2017 23:44:57 +0100 Subject: [PATCH 10/41] l 2 git: remove nin from announced branches --- lass/2configs/git.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix index d7ec39f2d..bdd65ce09 100644 --- a/lass/2configs/git.nix +++ b/lass/2configs/git.nix @@ -57,7 +57,7 @@ let server = "ni.r"; verbose = config.krebs.build.host.name == "prism"; # TODO define branches in some kind of option per repo - branches = [ "master" "newest" "nin" ]; + branches = [ "master" "newest" ]; }; }; }; From 53015a63cb6fd3f20350c37a67e593e5c87cbc9c Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 26 Jan 2017 23:45:43 +0100 Subject: [PATCH 11/41] l 2 repo-sync: merge from onondaga --- lass/2configs/repo-sync.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lass/2configs/repo-sync.nix b/lass/2configs/repo-sync.nix index 765769936..b1a26b171 100644 --- a/lass/2configs/repo-sync.nix +++ b/lass/2configs/repo-sync.nix @@ -44,6 +44,10 @@ let origin.url = "http://cgit.ni.r/${name}"; mirror.url = "${mirror}${name}"; }; + nin = { + origin.url = "http://cgit.onondaga.r/${name}"; + mirror.url = "${mirror}${name}"; + }; lassulus = { origin.url = "http://cgit.prism/${name}"; mirror.url = "${mirror}${name}"; From c363534571075914bc4bdbab2988c809f3499300 Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 26 Jan 2017 23:53:46 +0100 Subject: [PATCH 12/41] l 1 prism: I'm not proud of this commit --- lass/1systems/prism.nix | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix index 86c2c7416..386bcf812 100644 --- a/lass/1systems/prism.nix +++ b/lass/1systems/prism.nix @@ -316,16 +316,16 @@ in { script = pkgs.writePython2 "rup" '' #!${pkgs.python2}/bin/python t1 = """ - _. - ;=',_ () - 8===D~~ S" .--`|| - sS \__ || - __.' ( \-->|| - _=/ _./-\/ || - 8===D~~ ((\( /-' -'l || - ) |/ \\ (_)) - \\ \\ - '~ '~ + _. + ;=',_ () + 8===D~~ S" .--`|| + sS \__ || + __.' ( \-->|| + _=/ _./-\/ || + 8===D~~ ((\( /-' -'l || + ) |/ \\ (_)) + \\ \\ + '~ '~ """ print(t1) ''; From 5edbdb287d9365fe1b519aa3fee38451c82d4a95 Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 26 Jan 2017 23:59:26 +0100 Subject: [PATCH 13/41] k 3 fetchWallpaper: add maxTime option --- krebs/3modules/fetchWallpaper.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/krebs/3modules/fetchWallpaper.nix b/krebs/3modules/fetchWallpaper.nix index aed5f595c..29c4f50e9 100644 --- a/krebs/3modules/fetchWallpaper.nix +++ b/krebs/3modules/fetchWallpaper.nix @@ -38,6 +38,11 @@ let ''; default = {}; }; + maxTime = mkOption { + type = types.int; + default = 0; + description = "Time to wait before download is aborted"; + }; }; fetchWallpaperScript = pkgs.writeDash "fetchWallpaper" '' @@ -45,7 +50,7 @@ let mkdir -p ${shell.escape cfg.stateDir} cd ${shell.escape cfg.stateDir} - (curl -s -o wallpaper.tmp -z wallpaper ${shell.escape cfg.url} && mv wallpaper.tmp wallpaper) || : + (curl --max-time ${toString cfg.maxTime} -s -o wallpaper.tmp -z wallpaper ${shell.escape cfg.url} && mv wallpaper.tmp wallpaper) || : feh --no-fehbg --bg-scale ${shell.escape cfg.stateDir}/wallpaper ''; From 97edec1f2dd9785d515fe99e031b38f8f379258a Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 26 Jan 2017 23:59:54 +0100 Subject: [PATCH 14/41] l 2 fetchWallpaper: add maxTime of 10 secs --- lass/2configs/fetchWallpaper.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/lass/2configs/fetchWallpaper.nix b/lass/2configs/fetchWallpaper.nix index cf084ea8f..29f321994 100644 --- a/lass/2configs/fetchWallpaper.nix +++ b/lass/2configs/fetchWallpaper.nix @@ -7,6 +7,7 @@ in { enable = true; unitConfig.ConditionPathExists = "!/var/run/ppp0.pid"; url = "prism/wallpaper.png"; + maxTime = 10; }; systemd.services.fetchWallpaper = { after = [ "xmonad.service" ]; From 0112e59b1f40097fb1fe4dcc239ed082cc1ac0e7 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 28 Jan 2017 18:36:53 +0100 Subject: [PATCH 15/41] l 3 kapacitor: add alert definition --- lass/3modules/kapacitor.nix | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/lass/3modules/kapacitor.nix b/lass/3modules/kapacitor.nix index 8524c8198..a2ee71732 100644 --- a/lass/3modules/kapacitor.nix +++ b/lass/3modules/kapacitor.nix @@ -21,6 +21,14 @@ let type = types.str; default = "kapacitor"; }; + alarms = mkOption { + type = with types; attrsOf str; + default = {}; + }; + check_db = mkOption { + type = types.str; + default = "kapacitor_example"; + }; config = mkOption { type = types.str; #TODO: find a good default @@ -216,6 +224,29 @@ let ExecStart = "${pkgs.kapacitor}/bin/kapacitord -config ${configFile}"; }; }; + + systemd.services.kapacitor-alarms = { + description = "kapacitor-alarms"; + after = [ "kapacitor.service" ]; + wantedBy = [ "multi-user.target" ]; + + restartIfChanged = true; + + serviceConfig = { + Type = "oneshot"; + ExecStart = pkgs.writeDash "add_alarms" '' + ${pkgs.kapacitor}/bin/kapacitor delete tasks \* + ${concatStrings (mapAttrsToList (name: alarm: '' + ${pkgs.kapacitor}/bin/kapacitor define ${name} \ + -type batch \ + -tick ${pkgs.writeText "${name}.tick" alarm} \ + -dbrp ${cfg.check_db}.default + ${pkgs.kapacitor}/bin/kapacitor enable ${name} + '') cfg.alarms)} + ''; + }; + }; + }; in out From 302fcaa2f8b7057fa9a5884020ed2cd783dc42c5 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 30 Jan 2017 22:51:48 +0100 Subject: [PATCH 16/41] k 3 l: remove obsolte domsen_nas pubkey --- krebs/3modules/lass/default.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index 6f79aea0e..05b28a0b5 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -119,7 +119,6 @@ with import ; ssh.port = 2223; }; }; - ssh.pubkey = "ssh-dss AAAAB3NzaC1kc3MAAAEBAPH5Hcrc2QzIi7KQLf17N+aUuFfwb7uKxuojzmO3kyb3nMdn3s+rfTCJLWTJeHCeKb6yMpDF1XGXZwVN+omWV8CsA9tivOHYzZws3b0QB/JENjYmhHbNkKijm6EWXSyvsJ2RuFj0PC8+cv77ZFx7VTnrwZk6Excv7v51j+qo5BejLL1ZybISld/n3kQWE+GJqBYJ9zp/25XEl7macH02o58lRhfqygunDlKm4yiq34pfkA7FS4eHNzcXGvmtQlAHeDts1APbKq8OAoYoyCo0gjK9nbAwbfm0yqM51+eIo3H6xLWjSBdMI9guqndNJWps9PpKHa3bvM1xFB3vfoQZ6m8AAAAVAKf8ZCwMgP4ZpqwwNw4vIn1AuLnfAAABAQCVfUrpUWFvf/TXPucJde4CuAmtoMOrjpepAiXK7N9dwGyq/PbVxr4tnJ/RTyNGOFmBroc6/n0MnxR0qmkQPJNtM/Yz+kk+BCgwsyu2uenVOIX/eJFuQPQYiUdktTcgAyChMp99WF4yfKKgv1CDdMkpFi8xgBEN03s1sOKCRNwJ5rlpTNqh9LatuRyzWOIjNd7atkEYIQK92idJgqSmleo+UhJFfoOGjYlRbsnRVbvfqh7GVd7SSydhKhdb2eZjj2J8eMBwHNl1FLtqt02cnFW3FQDdXPbYYakN25z3F3sex/CPuBGJ0HRGq+y/Ynj/m99TPq9vLkzSUQPR4MmQ5feoAAABAG5L9ffMc/8T9dTeF7FEPlS54ka73M+pNY/5ehMykrrS9CVjFmvpeclnxkBpvjt3G5IlvkSsjUEE6kMk7mW9EV+USL0TTU/LavxXD8fLCSiIwResfLDRxjixjxVI1ouZeKNQ6B3tPOWOEIKR5nPlc7iy435nS77/NM3yBFH0KGdepr+3ZmdgWAjDLKjQhNyCz4Joc1IH1Vf5Ccvb6rsaJ91ajiq29iI2ZpLXXIQsS1ZYzO1Gr9xBTNgmzEmeLqFMcxDSJ+rLMF4VDjRdL2zz5BSmv/Ffj2nICMgv/gj3zzuk7zcMpnbvGyA3W8VWb6IjJDvww4rJ21Q2gHBC5XCohJs="; }; cloudkrebs = { cores = 1; From 5d76418bcd977d815c0305c88ef611d16cddb7d4 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 30 Jan 2017 22:52:25 +0100 Subject: [PATCH 17/41] l 1 mors: cleanup --- lass/1systems/mors.nix | 192 +++++++++++------------------------------ 1 file changed, 50 insertions(+), 142 deletions(-) diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix index dde867eb3..afe37e958 100644 --- a/lass/1systems/mors.nix +++ b/lass/1systems/mors.nix @@ -31,13 +31,6 @@ with import ; ]; } #{ - # services.mysql = { - # enable = true; - # package = pkgs.mariadb; - # rootPassword = "/mysql_rootPassword"; - # }; - #} - #{ # services.elasticsearch = { # enable = true; # plugins = [ @@ -83,140 +76,56 @@ with import ; { services.redis.enable = true; } - { - virtualisation.libvirtd.enable = true; - } - { - services.nginx = { - enable = mkDefault true; - virtualHosts = { - "stats.mors" = { - locations = { - "/" = { - proxyPass = "http://localhost:3000/"; - extraConfig = '' - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - ''; - }; - }; - }; - }; - }; - - services.grafana = { - enable = true; - addr = "127.0.0.1"; - users.allowSignUp = false; - users.allowOrgCreate = false; - users.autoAssignOrg = false; - auth.anonymous.enable = true; - security = import ; # { AdminUser = ""; adminPassword = ""} - }; - - services.graphite = { - api = { - enable = true; - listenAddress = "127.0.0.1"; - port = 18080; - }; - carbon = { - enableCache = true; - # save disk usage by restricting to 1 bulk update per second - config = '' - [cache] - MAX_CACHE_SIZE = inf - MAX_UPDATES_PER_SECOND = 1 - MAX_CREATES_PER_MINUTE = 500 - ''; - storageSchemas = '' - [carbon] - pattern = ^carbon\. - retentions = 60:90d - - [elchos] - patterhn = ^elchos\. - retentions = 10s:30d,60s:3y - - [default] - pattern = .* - retentions = 30s:30d,300s:1y - ''; - }; - }; - - services.collectd = { - enable = true; - include = [ (toString (pkgs.writeText "collectd-graphite-cfg" '' - LoadPlugin write_graphite - - - Host "localhost" - Port "2003" - EscapeCharacter "_" - StoreRates false - AlwaysAppendDS false - - - '')) - ]; - extraConfig = '' - LoadPlugin interface - LoadPlugin battery - LoadPlugin load - LoadPlugin cpu - LoadPlugin entropy - LoadPlugin write_graphite - - Interface "et0" - Interface "wl0" - Interface "retiolum" - - ''; - }; - services.graphite.beacon = { - enable = true; - config = { - graphite_url = "http://localhost:18080"; - cli = { - command = ''${pkgs.irc-announce}/bin/irc-announce irc.freenode.org 6667 mors-beacon-alert \#krebs ' ''${level} ''${name} ''${value}' ''; - }; - smtp = { - from = "beacon@mors.r"; - to = [ - "lass@mors.r" - ]; - }; - normal_handlers = [ - "smtp" - "cli" - ]; - warning_handlers = [ - "smtp" - "cli" - ]; - critical_handlers = [ - "smtp" - "cli" - ]; - alerts = [ - { - name = "testbattery"; - query = "*.battery-0.capacity"; - method = "last_value"; - interval = "1minute"; - logging = "info"; - repeat_interval = "5minute"; - rules = [ - "warning: < 30.0" - "critical: < 10.0" - ]; - } - ]; - }; - }; - } + #{ + # #gitit magic + # imports = [ ]; + # services.gitit = { + # enable = true; + # haskellPackages = pkgs.haskell.packages.ghc7103; + # }; + #} + #{ + # lass.icinga2 = { + # enable = true; + # configFiles = [ + # '' + # template Service "generic-service" { + # max_check_attempts = 3 + # check_interval = 5m + # retry_interval = 1m + # enable_perfdata = true + # } + # apply Service "ping4" { + # } + # '' + # ]; + # }; + # services.mysql = { + # enable = true; + # package = pkgs.mariadb; + # rootPassword = "/mysql_rootPassword"; + # }; + # lass.icingaweb2 = { + # enable = true; + # initialRootPasswordHash = "$1$HpWDCehI$ITbAoyfOB6HEN1ftooxZq0"; + # resources = { + # icinga2db = { + # type = "mysql"; + # host = "localhost"; + # user = "icingaweb2"; + # db = "icinga"; + # passfile = ; + # }; + # icingaweb2db = { + # type = "mysql"; + # host = "localhost"; + # user = "icingaweb2"; + # db = "icingaweb2"; + # passfile = ; + # }; + # }; + # }; + #} ]; krebs.build.host = config.krebs.hosts.mors; @@ -229,7 +138,6 @@ with import ; initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; } ]; initrd.luks.cryptoModules = [ "aes" "sha512" "sha1" "xts" ]; initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ]; - #kernelModules = [ "kvm-intel" "msr" ]; }; fileSystems = { "/" = { From 6edbfeb6f5f048e5646b72b7bca241df3bdd9002 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 30 Jan 2017 22:53:28 +0100 Subject: [PATCH 18/41] l 3 kapacitor: better defaults --- lass/3modules/kapacitor.nix | 117 +----------------------------------- 1 file changed, 2 insertions(+), 115 deletions(-) diff --git a/lass/3modules/kapacitor.nix b/lass/3modules/kapacitor.nix index a2ee71732..a1e82b830 100644 --- a/lass/3modules/kapacitor.nix +++ b/lass/3modules/kapacitor.nix @@ -27,7 +27,7 @@ let }; check_db = mkOption { type = types.str; - default = "kapacitor_example"; + default = "all_data"; }; config = mkOption { type = types.str; @@ -82,115 +82,7 @@ let [logging] file = "STDERR" - level = "INFO" - - [collectd] - enabled = false - bind-address = ":25826" - database = "collectd" - retention-policy = "" - batch-size = 5000 - batch-pending = 10 - batch-timeout = "10s" - read-buffer = 0 - typesdb = "/usr/share/collectd/types.db" - - [opentsdb] - enabled = false - bind-address = ":4242" - database = "opentsdb" - retention-policy = "" - consistency-level = "one" - tls-enabled = false - certificate = "/etc/ssl/influxdb.pem" - batch-size = 1000 - batch-pending = 5 - batch-timeout = "1s" - log-point-errors = true - - [smtp] - enabled = false - host = "localhost" - port = 25 - username = "" - password = "" - no-verify = false - global = false - state-changes-only = false - from = "" - idle-timeout = "30s" - - [opsgenie] - enabled = false - api-key = "" - url = "https://api.opsgenie.com/v1/json/alert" - recovery_url = "https://api.opsgenie.com/v1/json/alert/note" - global = false - - [victorops] - enabled = false - api-key = "" - routing-key = "" - url = "https://alert.victorops.com/integrations/generic/20131114/alert" - global = false - - [pagerduty] - enabled = false - url = "https://events.pagerduty.com/generic/2010-04-15/create_event.json" - service-key = "" - global = false - - [sensu] - enabled = false - addr = "" - source = "Kapacitor" - - [slack] - enabled = false - url = "" - channel = "" - global = false - state-changes-only = false - - [telegram] - enabled = false - url = "https://api.telegram.org/bot" - token = "" - chat-id = "" - parse-mode = "" - disable-web-page-preview = false - disable-notification = false - global = false - state-changes-only = false - - [hipchat] - enabled = false - url = "" - token = "" - room = "" - global = false - state-changes-only = false - - [alerta] - enabled = false - url = "" - token = "" - environment = "" - origin = "" - - [reporting] - enabled = true - url = "https://usage.influxdata.com" - - [stats] - enabled = true - stats-interval = "10s" - database = "_kapacitor" - retention-policy = "autogen" - timing-sample-rate = 0.1 - timing-movavg-size = 1000 - - [udf] + level = "DEBUG" [deadman] interval = "10s" @@ -198,11 +90,6 @@ let id = "{{ .Group }}:NODE_NAME for task '{{ .TaskName }}'" message = "{{ .ID }} is {{ if eq .Level \"OK\" }}alive{{ else }}dead{{ end }}: {{ index .Fields \"emitted\" | printf \"%0.3f\" }} points/INTERVAL." global = false - - [talk] - enabled = false - url = "" - author_name = "" ''; description = "configuration kapacitor is started with"; }; From ece8aa5ab92e8e59eb9fcfbbb2d2d0380bd1a5a6 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 30 Jan 2017 22:54:44 +0100 Subject: [PATCH 19/41] l 2 hw tp-x220: remove broken sna acceleration --- lass/2configs/hw/tp-x220.nix | 7 ------- 1 file changed, 7 deletions(-) diff --git a/lass/2configs/hw/tp-x220.nix b/lass/2configs/hw/tp-x220.nix index ec36fa96a..d551cd44e 100644 --- a/lass/2configs/hw/tp-x220.nix +++ b/lass/2configs/hw/tp-x220.nix @@ -47,12 +47,5 @@ with import ; pkgs.vaapiVdpau ]; - services.xserver = { - videoDriver = "intel"; - deviceSection = '' - Option "AccelMethod" "sna" - ''; - }; - security.rngd.enable = true; } From d9c5f0d8de9e49ac0b406412e781ed1390c6ece6 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 30 Jan 2017 22:55:30 +0100 Subject: [PATCH 20/41] l 1 prism: remove obsolete public_html --- lass/1systems/prism.nix | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix index 386bcf812..b89fcf013 100644 --- a/lass/1systems/prism.nix +++ b/lass/1systems/prism.nix @@ -202,20 +202,6 @@ in { ]; }; } - { - services.nginx = { - enable = true; - virtualHosts.public = { - port = 8088; - locations."~ ^/~(.+?)(/.*)?\$".extraConfig = '' - alias /home/$1/public_html$2; - ''; - }; - }; - krebs.iptables.tables.filter.INPUT.rules = [ - { predicate = "-p tcp --dport 8088"; target = "ACCEPT"; } - ]; - } { krebs.repo-sync.timerConfig = { OnCalendar = "*:0/5"; From 26b3298f774f95806af7b253edeb3624c32cc9a1 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 30 Jan 2017 22:55:46 +0100 Subject: [PATCH 21/41] l 2: remove deprecated MANPAGER declaration --- lass/2configs/default.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix index 911b7738a..38f70c2b5 100644 --- a/lass/2configs/default.nix +++ b/lass/2configs/default.nix @@ -98,7 +98,6 @@ with import ; # multiple-definition-problem when defining environment.variables.EDITOR environment.extraInit = '' EDITOR=vim - MANPAGER=most ''; nixpkgs.config.allowUnfree = true; From f0a345d79b0ab80d2e38baddba7f19e40241c79a Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 30 Jan 2017 22:56:12 +0100 Subject: [PATCH 22/41] l 3 telegraf: split config into inputs/outputs --- lass/3modules/telegraf.nix | 33 +++++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 10 deletions(-) diff --git a/lass/3modules/telegraf.nix b/lass/3modules/telegraf.nix index 64b323460..a54e71a9d 100644 --- a/lass/3modules/telegraf.nix +++ b/lass/3modules/telegraf.nix @@ -21,6 +21,26 @@ let type = types.str; default = "telegraf"; }; + outputs = mkOption { + type = types.str; + default = '' + [outputs.influxdb] + urls = ["http://localhost:8086"] + database = "all_data" + user_agent = "telegraf" + ''; + }; + inputs = mkOption { + type = with types; listOf str; + default = [ + '' + [cpu] + percpu = false + totalcpu = true + drop = ["cpu_time"] + '' + ]; + }; config = mkOption { type = types.str; #TODO: find a good default @@ -30,17 +50,10 @@ let [outputs] - # Configuration to send data to InfluxDB. - [outputs.influxdb] - urls = ["http://localhost:8086"] - database = "kapacitor_example" - user_agent = "telegraf" + ${cfg.outputs} + + ${concatStringsSep "\n" cfg.inputs} - # Collect metrics about cpu usage - [cpu] - percpu = false - totalcpu = true - drop = ["cpu_time"] ''; description = "configuration telegraf is started with"; }; From 1d2c058d78f9cb5d4a51dd2ffb1bfd4b09623055 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 30 Jan 2017 22:56:43 +0100 Subject: [PATCH 23/41] l 2 monitoring: introduce {client,server}.nix --- lass/2configs/monitoring/client.nix | 32 ++++++++++++++++ lass/2configs/monitoring/server.nix | 59 +++++++++++++++++++++++++++++ 2 files changed, 91 insertions(+) create mode 100644 lass/2configs/monitoring/client.nix create mode 100644 lass/2configs/monitoring/server.nix diff --git a/lass/2configs/monitoring/client.nix b/lass/2configs/monitoring/client.nix new file mode 100644 index 000000000..eebf2f2e9 --- /dev/null +++ b/lass/2configs/monitoring/client.nix @@ -0,0 +1,32 @@ +{pkgs, config, ...}: +with import ; +{ + lass.telegraf = { + enable = true; + outputs = '' + [outputs.influxdb] + urls = ["http://prism:8086"] + database = "all_data" + user_agent = "telegraf" + ''; + inputs = [ + '' + [cpu] + percpu = false + totalcpu = true + drop = ["cpu_time"] + '' + '' + [[inputs.mem]] + '' + '' + [[inputs.ping]] + urls = ["8.8.8.8"] + '' + ]; + }; + systemd.services.telegraf.path = with pkgs; [ + iputils + lm_sensors + ]; +} diff --git a/lass/2configs/monitoring/server.nix b/lass/2configs/monitoring/server.nix new file mode 100644 index 000000000..335820bc7 --- /dev/null +++ b/lass/2configs/monitoring/server.nix @@ -0,0 +1,59 @@ +{pkgs, config, ...}: +with import ; +{ + services.influxdb = { + enable = true; + }; + + services.influxdb.extraConfig = { + meta.hostname = config.krebs.build.host.name; + # meta.logging-enabled = true; + http.bind-address = ":8086"; + admin.bind-address = ":8083"; + monitoring = { + enabled = false; + # write-interval = "24h"; + }; + }; + + lass.kapacitor = + let + echoToIrc = pkgs.writeDash "echo_irc" '' + set -euf + data="$(${pkgs.jq}/bin/jq -r .message)" + export LOGNAME=prism-alarm + ${pkgs.irc-announce}/bin/irc-announce \ + irc.freenode.org 6667 prism-alarm \#krebs-bots "$data" >/dev/null + ''; + in { + enable = true; + alarms = { + test2 = '' + batch + |query(${"'''"} + SELECT mean("usage_user") AS mean + FROM "${config.lass.kapacitor.check_db}"."default"."cpu" + ${"'''"}) + .every(3m) + .period(1m) + .groupBy('host') + |alert() + .crit(lambda: "mean" > 90) + // Whenever we get an alert write it to a file. + .log('/tmp/alerts.log') + .exec('${echoToIrc}') + ''; + }; + }; + + krebs.iptables.tables.filter.INPUT.rules = [ + { predicate = "-p tcp -i retiolum --dport 8086"; target = "ACCEPT"; } + { predicate = "-p tcp -i retiolum --dport 3000"; target = "ACCEPT"; } + ]; + services.grafana = { + enable = true; + addr = "0.0.0.0"; + auth.anonymous.enable = true; + security = import ; # { AdminUser = ""; adminPassword = ""} + }; +} From d70028d9e788c6156ad674678734c546f1fcc246 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 30 Jan 2017 22:58:39 +0100 Subject: [PATCH 24/41] l 1 prism: import monitoring server --- lass/1systems/prism.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix index b89fcf013..839e52f81 100644 --- a/lass/1systems/prism.nix +++ b/lass/1systems/prism.nix @@ -43,6 +43,7 @@ in { ../2configs/libvirt.nix ../2configs/hfos.nix ../2configs/makefu-sip.nix + ../2configs/monitoring/server.nix { users.extraGroups = { # ● systemd-tmpfiles-setup.service - Create Volatile Files and Directories From 072a1adde199ac875d6a56a04f3948ae4f436663 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 30 Jan 2017 22:58:54 +0100 Subject: [PATCH 25/41] l 2: enable monitoring on every host --- lass/2configs/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix index 38f70c2b5..d1810c00c 100644 --- a/lass/2configs/default.nix +++ b/lass/2configs/default.nix @@ -9,6 +9,7 @@ with import ; ../2configs/mc.nix ../2configs/nixpkgs.nix ../2configs/vim.nix + ../2configs/monitoring/client.nix ./backups.nix { users.extraUsers = From 9bc0b9d8a2b5139fb694f1415fe3ef798d0e9980 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 31 Jan 2017 00:33:22 +0100 Subject: [PATCH 26/41] l 2 nixpkgs: 3909827 -> 5fff5a9 --- lass/2configs/nixpkgs.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lass/2configs/nixpkgs.nix b/lass/2configs/nixpkgs.nix index 27b7c2439..4a1b0379b 100644 --- a/lass/2configs/nixpkgs.nix +++ b/lass/2configs/nixpkgs.nix @@ -3,6 +3,6 @@ { krebs.build.source.nixpkgs.git = { url = https://github.com/nixos/nixpkgs; - ref = "39098270855c171f0824c09d071b606ae991ff87"; + ref = "5fff5a902594b34471b613eb2babcec923e1e1f1"; }; } From 9d0b47c3d9ab03bef348262b58fa0839c5f7d399 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 31 Jan 2017 15:28:46 +0100 Subject: [PATCH 27/41] l 2 websites domsen: add joemisch.com to ubikmedia --- lass/2configs/websites/domsen.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/lass/2configs/websites/domsen.nix b/lass/2configs/websites/domsen.nix index e79973a66..66fc681b1 100644 --- a/lass/2configs/websites/domsen.nix +++ b/lass/2configs/websites/domsen.nix @@ -66,6 +66,7 @@ in { "karlaskop.ubikmedia.de" "nb.ubikmedia.de" "youthtube.ubikmedia.de" + "joemisch.com" ]) ]; From 3bfcf88629a73365875993a7b093d28d00299f7c Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 31 Jan 2017 16:49:53 +0100 Subject: [PATCH 28/41] k 3 {l,m}: move paste.r to prism --- krebs/3modules/lass/default.nix | 1 + krebs/3modules/makefu/default.nix | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index 05b28a0b5..d35a9f357 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -93,6 +93,7 @@ with import ; "cgit.prism.retiolum" "cgit.prism.r" "cache.prism.r" + "paste.r" "paste.retiolum" ]; tinc.pubkey = '' -----BEGIN RSA PUBLIC KEY----- diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix index 9942ac043..84720859f 100644 --- a/krebs/3modules/makefu/default.nix +++ b/krebs/3modules/makefu/default.nix @@ -313,7 +313,6 @@ with import ; "graphs.wry.retiolum" "graphs.r" "graphs.retiolum" "paste.wry.retiolum" - "paste.r" "paste.retiolum" "wry.r" "wry.retiolum" "wiki.makefu.retiolum" "wiki.wry.retiolum" From 8f98fde52310f21e5aceafb5fd1dfe1707227739 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 31 Jan 2017 16:57:42 +0100 Subject: [PATCH 29/41] l 2: add bepasty.nix --- lass/2configs/bepasty.nix | 40 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 lass/2configs/bepasty.nix diff --git a/lass/2configs/bepasty.nix b/lass/2configs/bepasty.nix new file mode 100644 index 000000000..a3c6d0f28 --- /dev/null +++ b/lass/2configs/bepasty.nix @@ -0,0 +1,40 @@ +{ config, pkgs, ... }: +with import ; + +# secrets used: +# wildcard.krebsco.de.crt +# wildcard.krebsco.de.key +# bepasty-secret.nix <- contains single string + +with import ; +let + secKey = import ; + ext-dom = "paste.lassul.us" ; +in { + + services.nginx.enable = mkDefault true; + krebs.bepasty = { + enable = true; + serveNginx= true; + + servers = { + "paste.r" = { + nginx = { + serverAliases = [ "paste.retiolum" "paste.${config.krebs.build.host.name}" ]; + }; + defaultPermissions = "admin,list,create,read,delete"; + secretKey = secKey; + }; + + "${ext-dom}" = { + nginx = { + enableSSL = true; + forceSSL = true; + enableACME = true; + }; + defaultPermissions = "read"; + secretKey = secKey; + }; + }; + }; +} From 8f4ed1af13a6ef0533f36dc22117434aea22a764 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 31 Jan 2017 16:57:56 +0100 Subject: [PATCH 30/41] l 1 prism: import bepasty.nix --- lass/1systems/prism.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix index 839e52f81..b92c8d900 100644 --- a/lass/1systems/prism.nix +++ b/lass/1systems/prism.nix @@ -44,6 +44,7 @@ in { ../2configs/hfos.nix ../2configs/makefu-sip.nix ../2configs/monitoring/server.nix + ../2configs/bepasty.nix { users.extraGroups = { # ● systemd-tmpfiles-setup.service - Create Volatile Files and Directories From 904d75b482e78ec2386e2e9cca4751b2bcdb8106 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 31 Jan 2017 16:58:11 +0100 Subject: [PATCH 31/41] l 2 tests dummy-secrets: add bepasty-secret.nix --- lass/2configs/tests/dummy-secrets/bepasty-secret.nix | 1 + 1 file changed, 1 insertion(+) create mode 100644 lass/2configs/tests/dummy-secrets/bepasty-secret.nix diff --git a/lass/2configs/tests/dummy-secrets/bepasty-secret.nix b/lass/2configs/tests/dummy-secrets/bepasty-secret.nix new file mode 100644 index 000000000..e16c76dff --- /dev/null +++ b/lass/2configs/tests/dummy-secrets/bepasty-secret.nix @@ -0,0 +1 @@ +"" From dfa32223172e6d5324c3d186d4720461e684cd7f Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 31 Jan 2017 17:14:30 +0100 Subject: [PATCH 32/41] l 1 prism: protect bepasty from external ip --- lass/1systems/prism.nix | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix index b92c8d900..5fa86da4d 100644 --- a/lass/1systems/prism.nix +++ b/lass/1systems/prism.nix @@ -44,7 +44,16 @@ in { ../2configs/hfos.nix ../2configs/makefu-sip.nix ../2configs/monitoring/server.nix - ../2configs/bepasty.nix + { + imports = [ + ../2configs/bepasty.nix + ]; + krebs.bepasty.servers."paste.r".nginx.extraConfig = '' + if ( $server_addr = "${config.krebs.build.host.nets.internet.ip4.addr}" ) { + return 403; + } + ''; + } { users.extraGroups = { # ● systemd-tmpfiles-setup.service - Create Volatile Files and Directories From 611c26439ebeec200f02d1344b6a668e64908fda Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 31 Jan 2017 17:30:25 +0100 Subject: [PATCH 33/41] l 2 tests dummy-secrets bepasty: fix assertion --- lass/2configs/tests/dummy-secrets/bepasty-secret.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lass/2configs/tests/dummy-secrets/bepasty-secret.nix b/lass/2configs/tests/dummy-secrets/bepasty-secret.nix index e16c76dff..6e08144d0 100644 --- a/lass/2configs/tests/dummy-secrets/bepasty-secret.nix +++ b/lass/2configs/tests/dummy-secrets/bepasty-secret.nix @@ -1 +1 @@ -"" +"bla" From 698894853abba6e1730f10a64d35c2a01af96d99 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 3 Feb 2017 00:21:34 +0100 Subject: [PATCH 34/41] l 1 mors: remove /mnt/public --- lass/1systems/mors.nix | 5 ----- 1 file changed, 5 deletions(-) diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix index afe37e958..a5eaaed9d 100644 --- a/lass/1systems/mors.nix +++ b/lass/1systems/mors.nix @@ -174,11 +174,6 @@ with import ; fsType = "ext4"; }; - "/mnt/public" = { - device = "/dev/big/public"; - fsType = "ext4"; - }; - "/mnt/conf" = { device = "/dev/big/conf"; fsType = "ext4"; From 48dc0a6aa973f9c069b860bedaffdb4dd0583b08 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 3 Feb 2017 00:21:49 +0100 Subject: [PATCH 35/41] l 1 prism: remvoe sed-plugin from #coders bot --- lass/1systems/prism.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix index 5fa86da4d..f9654ac4c 100644 --- a/lass/1systems/prism.nix +++ b/lass/1systems/prism.nix @@ -258,7 +258,6 @@ in { -XFlexibleInstances -XMultiParamTypeClasses \ -XOverloadedStrings -XFunctionalDependencies \''; in [ - sed-plugin url-title (buildSimpleReaktorPlugin "lambdabot-pl" { pattern = "^@pl (?P.*)$$"; From 93e79da6f929749a1b8c4735e38bd5ce8034a18b Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 3 Feb 2017 00:22:10 +0100 Subject: [PATCH 36/41] l 2 downloading: add icarus to authorized_keys --- lass/2configs/downloading.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix index 27b6d22d5..eb9575018 100644 --- a/lass/2configs/downloading.nix +++ b/lass/2configs/downloading.nix @@ -16,6 +16,7 @@ with import ; lass.pubkey lass-shodan.pubkey lass-helios.pubkey + lass-icarus.pubkey makefu.pubkey ]; }; From 561d4f7bf52a48eca4f4a88c32b4621e5ef3425e Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 3 Feb 2017 00:23:00 +0100 Subject: [PATCH 37/41] l 2 monitoring server: add collectdb support --- lass/2configs/monitoring/server.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/lass/2configs/monitoring/server.nix b/lass/2configs/monitoring/server.nix index 335820bc7..2e1c15ca1 100644 --- a/lass/2configs/monitoring/server.nix +++ b/lass/2configs/monitoring/server.nix @@ -14,6 +14,12 @@ with import ; enabled = false; # write-interval = "24h"; }; + collectd = [{ + enabled = true; + typesdb = "${pkgs.collectd}/share/collectd/types.db"; + database = "collectd_db"; + port = 25826; + }]; }; lass.kapacitor = @@ -49,6 +55,7 @@ with import ; krebs.iptables.tables.filter.INPUT.rules = [ { predicate = "-p tcp -i retiolum --dport 8086"; target = "ACCEPT"; } { predicate = "-p tcp -i retiolum --dport 3000"; target = "ACCEPT"; } + { predicate = "-p udp -i retiolum --dport 25826"; target = "ACCEPT"; } ]; services.grafana = { enable = true; From 920cb3456045f7ec431de68a2613e478a7e30751 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 3 Feb 2017 00:23:23 +0100 Subject: [PATCH 38/41] l 3 telegraf: set default db to `telegraf_db` --- lass/3modules/telegraf.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lass/3modules/telegraf.nix b/lass/3modules/telegraf.nix index a54e71a9d..6ef775090 100644 --- a/lass/3modules/telegraf.nix +++ b/lass/3modules/telegraf.nix @@ -26,7 +26,7 @@ let default = '' [outputs.influxdb] urls = ["http://localhost:8086"] - database = "all_data" + database = "telegraf_db" user_agent = "telegraf" ''; }; From 7d9bd2024826928c028d63b6448f126966e6552c Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 3 Feb 2017 00:23:59 +0100 Subject: [PATCH 39/41] l 3 telegraf: add interval option --- lass/3modules/telegraf.nix | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lass/3modules/telegraf.nix b/lass/3modules/telegraf.nix index 6ef775090..0b3be2d69 100644 --- a/lass/3modules/telegraf.nix +++ b/lass/3modules/telegraf.nix @@ -41,12 +41,16 @@ let '' ]; }; + interval = mkOption { + type = types.str; + default = "10s"; + }; config = mkOption { type = types.str; #TODO: find a good default default = '' [agent] - interval = "1s" + interval = "${cfg.interval}" [outputs] From 10b97adc5fb76d7558280f865381f61662cc19c4 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 3 Feb 2017 00:24:21 +0100 Subject: [PATCH 40/41] l 2 monitoring client: add more telegraf defaults --- lass/2configs/monitoring/client.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lass/2configs/monitoring/client.nix b/lass/2configs/monitoring/client.nix index eebf2f2e9..fc2c2ff40 100644 --- a/lass/2configs/monitoring/client.nix +++ b/lass/2configs/monitoring/client.nix @@ -3,10 +3,13 @@ with import ; { lass.telegraf = { enable = true; + interval = "1s"; + + outputs = '' [outputs.influxdb] urls = ["http://prism:8086"] - database = "all_data" + database = "telegraf_db" user_agent = "telegraf" ''; inputs = [ From 8daef993dcb6149a02c72a4895d6e808a6c6a8d4 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 3 Feb 2017 00:24:39 +0100 Subject: [PATCH 41/41] l 2 monitoring client: add collectd config --- lass/2configs/monitoring/client.nix | 59 +++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) diff --git a/lass/2configs/monitoring/client.nix b/lass/2configs/monitoring/client.nix index fc2c2ff40..e879d6960 100644 --- a/lass/2configs/monitoring/client.nix +++ b/lass/2configs/monitoring/client.nix @@ -26,10 +26,69 @@ with import ; [[inputs.ping]] urls = ["8.8.8.8"] '' + '' + [[inputs.net]] + '' + '' + [[inputs.dns_query]] + servers = ["8.8.8.8"] + '' ]; }; systemd.services.telegraf.path = with pkgs; [ iputils lm_sensors ]; + + services.collectd = { + enable = true; + autoLoadPlugin = true; + extraConfig = '' + Hostname ${config.krebs.build.host.name} + LoadPlugin load + LoadPlugin disk + LoadPlugin memory + Interval 30.0 + + LoadPlugin interface + + Interface "*Link" + Interface "lo" + Interface "vboxnet*" + Interface "virbr*" + IgnoreSelected true + + + LoadPlugin df + + MountPoint "/nix/store" + FSType "tmpfs" + FSType "binfmt_misc" + FSType "debugfs" + FSType "mqueue" + FSType "hugetlbfs" + FSType "systemd-1" + FSType "cgroup" + FSType "securityfs" + FSType "ramfs" + FSType "proc" + FSType "devpts" + FSType "devtmpfs" + MountPoint "/var/lib/docker/devicemapper" + IgnoreSelected true + + + LoadPlugin cpu + + ReportByCpu true + ReportByState true + ValuesPercentage true + + + LoadPlugin network + + Server "prism" "25826" + + ''; + }; }